3162 files changed, 411480 insertions, 237383 deletions

diff --git a/drivers/Kconfig b/drivers/Kconfig
index 48bbdbe43e69..368ae6d3a096 100644
--- a/drivers/Kconfig
+++ b/drivers/Kconfig
@@ -1,5 +1,3 @@
-# drivers/Kconfig
-
 menu "Device Drivers"
 
 source "drivers/base/Kconfig"
@@ -30,7 +28,7 @@ source "drivers/md/Kconfig"
 
 source "drivers/message/fusion/Kconfig"
 
-source "drivers/ieee1394/Kconfig"
+source "drivers/firewire/Kconfig"
 
 source "drivers/message/i2o/Kconfig"
 
@@ -98,6 +96,8 @@ source "drivers/edac/Kconfig"
 
 source "drivers/rtc/Kconfig"
 
+source "drivers/clocksource/Kconfig"
+
 source "drivers/dma/Kconfig"
 
 source "drivers/dca/Kconfig"
diff --git a/drivers/accessibility/braille/braille_console.c b/drivers/accessibility/braille/braille_console.c
index d672cfe7ca59..cb423f5aef24 100644
--- a/drivers/accessibility/braille/braille_console.c
+++ b/drivers/accessibility/braille/braille_console.c
@@ -21,7 +21,6 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
-#include <linux/autoconf.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/moduleparam.h>
diff --git a/drivers/acpi/Makefile b/drivers/acpi/Makefile
index 7702118509a0..66cc3f36a954 100644
--- a/drivers/acpi/Makefile
+++ b/drivers/acpi/Makefile
@@ -19,6 +19,7 @@ obj-y				+= acpi.o \
 
 # All the builtin files are in the "acpi." module_param namespace.
 acpi-y				+= osl.o utils.o reboot.o
+acpi-y				+= hest.o
 
 # sleep related files
 acpi-y				+= wakeup.o
@@ -31,6 +32,7 @@ acpi-$(CONFIG_ACPI_SLEEP)	+= proc.o
 #
 acpi-y				+= bus.o glue.o
 acpi-y				+= scan.o
+acpi-y				+= processor_pdc.o
 acpi-y				+= ec.o
 acpi-$(CONFIG_ACPI_DOCK)	+= dock.o
 acpi-y				+= pci_root.o pci_link.o pci_irq.o pci_bind.o
diff --git a/drivers/acpi/acpi_memhotplug.c b/drivers/acpi/acpi_memhotplug.c
index 28ccdbc05ac8..3597d73f28f6 100644
--- a/drivers/acpi/acpi_memhotplug.c
+++ b/drivers/acpi/acpi_memhotplug.c
@@ -537,7 +537,7 @@ static int __init acpi_memory_device_init(void)
 
 	status = acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT,
 				     ACPI_UINT32_MAX,
-				     acpi_memory_register_notify_handler,
+				     acpi_memory_register_notify_handler, NULL,
 				     NULL, NULL);
 
 	if (ACPI_FAILURE(status)) {
@@ -561,7 +561,7 @@ static void __exit acpi_memory_device_exit(void)
 	 */
 	status = acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT,
 				     ACPI_UINT32_MAX,
-				     acpi_memory_deregister_notify_handler,
+				     acpi_memory_deregister_notify_handler, NULL,
 				     NULL, NULL);
 
 	if (ACPI_FAILURE(status))
diff --git a/drivers/acpi/acpi_pad.c b/drivers/acpi/acpi_pad.c
index 0d2cdb86158b..7e52295f1ecc 100644
--- a/drivers/acpi/acpi_pad.c
+++ b/drivers/acpi/acpi_pad.c
@@ -100,7 +100,8 @@ static void round_robin_cpu(unsigned int tsk_index)
 	struct cpumask *pad_busy_cpus = to_cpumask(pad_busy_cpus_bits);
 	cpumask_var_t tmp;
 	int cpu;
-	unsigned long min_weight = -1, preferred_cpu;
+	unsigned long min_weight = -1;
+	unsigned long uninitialized_var(preferred_cpu);
 
 	if (!alloc_cpumask_var(&tmp, GFP_KERNEL))
 		return;
@@ -207,7 +208,7 @@ static int power_saving_thread(void *data)
 		 * the mechanism only works when all CPUs have RT task running,
 		 * as if one CPU hasn't RT task, RT task from other CPUs will
 		 * borrow CPU time from this CPU and cause RT task use > 95%
-		 * CPU time. To make 'avoid staration' work, takes a nap here.
+		 * CPU time. To make 'avoid starvation' work, takes a nap here.
 		 */
 		if (do_sleep)
 			schedule_timeout_killable(HZ * idle_pct / 100);
@@ -221,14 +222,18 @@ static struct task_struct *ps_tsks[NR_CPUS];
 static unsigned int ps_tsk_num;
 static int create_power_saving_task(void)
 {
+	int rc = -ENOMEM;
+
 	ps_tsks[ps_tsk_num] = kthread_run(power_saving_thread,
 		(void *)(unsigned long)ps_tsk_num,
 		"power_saving/%d", ps_tsk_num);
-	if (ps_tsks[ps_tsk_num]) {
+	rc = IS_ERR(ps_tsks[ps_tsk_num]) ? PTR_ERR(ps_tsks[ps_tsk_num]) : 0;
+	if (!rc)
 		ps_tsk_num++;
-		return 0;
-	}
-	return -EINVAL;
+	else
+		ps_tsks[ps_tsk_num] = NULL;
+
+	return rc;
 }
 
 static void destroy_power_saving_task(void)
@@ -236,6 +241,7 @@ static void destroy_power_saving_task(void)
 	if (ps_tsk_num > 0) {
 		ps_tsk_num--;
 		kthread_stop(ps_tsks[ps_tsk_num]);
+		ps_tsks[ps_tsk_num] = NULL;
 	}
 }
 
@@ -252,7 +258,7 @@ static void set_power_saving_task_num(unsigned int num)
 	}
 }
 
-static int acpi_pad_idle_cpus(unsigned int num_cpus)
+static void acpi_pad_idle_cpus(unsigned int num_cpus)
 {
 	get_online_cpus();
 
@@ -260,7 +266,6 @@ static int acpi_pad_idle_cpus(unsigned int num_cpus)
 	set_power_saving_task_num(num_cpus);
 
 	put_online_cpus();
-	return 0;
 }
 
 static uint32_t acpi_pad_idle_cpus_num(void)
@@ -368,19 +373,21 @@ static void acpi_pad_remove_sysfs(struct acpi_device *device)
 static int acpi_pad_pur(acpi_handle handle, int *num_cpus)
 {
 	struct acpi_buffer buffer = {ACPI_ALLOCATE_BUFFER, NULL};
-	acpi_status status;
 	union acpi_object *package;
 	int rev, num, ret = -EINVAL;
 
-	status = acpi_evaluate_object(handle, "_PUR", NULL, &buffer);
-	if (ACPI_FAILURE(status))
+	if (ACPI_FAILURE(acpi_evaluate_object(handle, "_PUR", NULL, &buffer)))
+		return -EINVAL;
+
+	if (!buffer.length || !buffer.pointer)
 		return -EINVAL;
+
 	package = buffer.pointer;
 	if (package->type != ACPI_TYPE_PACKAGE || package->package.count != 2)
 		goto out;
 	rev = package->package.elements[0].integer.value;
 	num = package->package.elements[1].integer.value;
-	if (rev != 1)
+	if (rev != 1 || num < 0)
 		goto out;
 	*num_cpus = num;
 	ret = 0;
@@ -409,7 +416,7 @@ static void acpi_pad_ost(acpi_handle handle, int stat,
 
 static void acpi_pad_handle_notify(acpi_handle handle)
 {
-	int num_cpus, ret;
+	int num_cpus;
 	uint32_t idle_cpus;
 
 	mutex_lock(&isolated_cpus_lock);
@@ -417,12 +424,9 @@ static void acpi_pad_handle_notify(acpi_handle handle)
 		mutex_unlock(&isolated_cpus_lock);
 		return;
 	}
-	ret = acpi_pad_idle_cpus(num_cpus);
+	acpi_pad_idle_cpus(num_cpus);
 	idle_cpus = acpi_pad_idle_cpus_num();
-	if (!ret)
-		acpi_pad_ost(handle, 0, idle_cpus);
-	else
-		acpi_pad_ost(handle, 1, 0);
+	acpi_pad_ost(handle, 0, idle_cpus);
 	mutex_unlock(&isolated_cpus_lock);
 }
 
diff --git a/drivers/acpi/acpica/Makefile b/drivers/acpi/acpica/Makefile
index e7973bc16846..7423052ece5a 100644
--- a/drivers/acpi/acpica/Makefile
+++ b/drivers/acpi/acpica/Makefile
@@ -28,7 +28,7 @@ acpi-$(ACPI_FUTURE_USAGE) += hwtimer.o
 acpi-y += nsaccess.o  nsload.o    nssearch.o  nsxfeval.o \
 	 nsalloc.o   nseval.o    nsnames.o   nsutils.o   nsxfname.o \
 	 nsdump.o    nsinit.o    nsobject.o  nswalk.o    nsxfobj.o  \
-	 nsparse.o   nspredef.o  nsrepair.o
+	 nsparse.o   nspredef.o  nsrepair.o  nsrepair2.o
 
 acpi-$(ACPI_FUTURE_USAGE) += nsdumpdv.o
 
diff --git a/drivers/acpi/acpica/acmacros.h b/drivers/acpi/acpica/acmacros.h
index 3acd9c6760ea..7d9ba6e57554 100644
--- a/drivers/acpi/acpica/acmacros.h
+++ b/drivers/acpi/acpica/acmacros.h
@@ -341,6 +341,7 @@
 #define ACPI_ERROR_NAMESPACE(s, e)      acpi_ns_report_error (AE_INFO, s, e);
 #define ACPI_ERROR_METHOD(s, n, p, e)   acpi_ns_report_method_error (AE_INFO, s, n, p, e);
 #define ACPI_WARN_PREDEFINED(plist)     acpi_ut_predefined_warning plist
+#define ACPI_INFO_PREDEFINED(plist)     acpi_ut_predefined_info plist
 
 #else
 
@@ -349,6 +350,8 @@
 #define ACPI_ERROR_NAMESPACE(s, e)
 #define ACPI_ERROR_METHOD(s, n, p, e)
 #define ACPI_WARN_PREDEFINED(plist)
+#define ACPI_INFO_PREDEFINED(plist)
+
 #endif		/* ACPI_NO_ERROR_MESSAGES */
 
 /*
diff --git a/drivers/acpi/acpica/acnamesp.h b/drivers/acpi/acpica/acnamesp.h
index 09a2764c734b..61edb156e8d0 100644
--- a/drivers/acpi/acpica/acnamesp.h
+++ b/drivers/acpi/acpica/acnamesp.h
@@ -104,7 +104,8 @@ acpi_ns_walk_namespace(acpi_object_type type,
 		       acpi_handle start_object,
 		       u32 max_depth,
 		       u32 flags,
-		       acpi_walk_callback user_function,
+		       acpi_walk_callback pre_order_visit,
+		       acpi_walk_callback post_order_visit,
 		       void *context, void **return_value);
 
 struct acpi_namespace_node *acpi_ns_get_next_node(struct acpi_namespace_node
@@ -272,7 +273,8 @@ acpi_ns_get_attached_data(struct acpi_namespace_node *node,
 			  acpi_object_handler handler, void **data);
 
 /*
- * nsrepair - return object repair for predefined methods/objects
+ * nsrepair - General return object repair for all
+ * predefined methods/objects
  */
 acpi_status
 acpi_ns_repair_object(struct acpi_predefined_data *data,
@@ -285,6 +287,21 @@ acpi_ns_repair_package_list(struct acpi_predefined_data *data,
 			    union acpi_operand_object **obj_desc_ptr);
 
 /*
+ * nsrepair2 - Return object repair for specific
+ * predefined methods/objects
+ */
+acpi_status
+acpi_ns_complex_repairs(struct acpi_predefined_data *data,
+			struct acpi_namespace_node *node,
+			acpi_status validate_status,
+			union acpi_operand_object **return_object_ptr);
+
+void
+acpi_ns_remove_null_elements(struct acpi_predefined_data *data,
+			     u8 package_type,
+			     union acpi_operand_object *obj_desc);
+
+/*
  * nssearch - Namespace searching and entry
  */
 acpi_status
@@ -342,9 +359,7 @@ acpi_ns_externalize_name(u32 internal_name_length,
 			 const char *internal_name,
 			 u32 * converted_name_length, char **converted_name);
 
-struct acpi_namespace_node *acpi_ns_map_handle_to_node(acpi_handle handle);
-
-acpi_handle acpi_ns_convert_entry_to_handle(struct acpi_namespace_node *node);
+struct acpi_namespace_node *acpi_ns_validate_handle(acpi_handle handle);
 
 void acpi_ns_terminate(void);
 
diff --git a/drivers/acpi/acpica/acobject.h b/drivers/acpi/acpica/acobject.h
index b39d682a2140..64062b1be3ee 100644
--- a/drivers/acpi/acpica/acobject.h
+++ b/drivers/acpi/acpica/acobject.h
@@ -180,7 +180,11 @@ struct acpi_object_method {
 	u8 sync_level;
 	union acpi_operand_object *mutex;
 	u8 *aml_start;
-	ACPI_INTERNAL_METHOD implementation;
+	union {
+		ACPI_INTERNAL_METHOD implementation;
+		union acpi_operand_object *handler;
+	} extra;
+
 	u32 aml_length;
 	u8 thread_count;
 	acpi_owner_id owner_id;
diff --git a/drivers/acpi/acpica/acutils.h b/drivers/acpi/acpica/acutils.h
index 863a264b829e..3a451a21a3f9 100644
--- a/drivers/acpi/acpica/acutils.h
+++ b/drivers/acpi/acpica/acutils.h
@@ -386,6 +386,8 @@ u8 acpi_ut_valid_internal_object(void *object);
 
 union acpi_operand_object *acpi_ut_create_package_object(u32 count);
 
+union acpi_operand_object *acpi_ut_create_integer_object(u64 value);
+
 union acpi_operand_object *acpi_ut_create_buffer_object(acpi_size buffer_size);
 
 union acpi_operand_object *acpi_ut_create_string_object(acpi_size string_size);
@@ -481,6 +483,11 @@ acpi_ut_predefined_warning(const char *module_name,
 			   char *pathname,
 			   u8 node_flags, const char *format, ...);
 
+void ACPI_INTERNAL_VAR_XFACE
+acpi_ut_predefined_info(const char *module_name,
+			u32 line_number,
+			char *pathname, u8 node_flags, const char *format, ...);
+
 /* Values for Base above (16=Hex, 10=Decimal) */
 
 #define ACPI_ANY_BASE        0
diff --git a/drivers/acpi/acpica/dsinit.c b/drivers/acpi/acpica/dsinit.c
index 3aae13f30c5e..f23fa0be6fc2 100644
--- a/drivers/acpi/acpica/dsinit.c
+++ b/drivers/acpi/acpica/dsinit.c
@@ -192,7 +192,7 @@ acpi_ds_initialize_objects(u32 table_index,
 	status =
 	    acpi_ns_walk_namespace(ACPI_TYPE_ANY, start_node, ACPI_UINT32_MAX,
 				   ACPI_NS_WALK_UNLOCK, acpi_ds_init_one_object,
-				   &info, NULL);
+				   NULL, &info, NULL);
 	if (ACPI_FAILURE(status)) {
 		ACPI_EXCEPTION((AE_INFO, status, "During WalkNamespace"));
 	}
diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c
index 567a4899a018..e786f9fd767f 100644
--- a/drivers/acpi/acpica/dsmethod.c
+++ b/drivers/acpi/acpica/dsmethod.c
@@ -414,7 +414,7 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread,
 	/* Invoke an internal method if necessary */
 
 	if (obj_desc->method.method_flags & AML_METHOD_INTERNAL_ONLY) {
-		status = obj_desc->method.implementation(next_walk_state);
+		status = obj_desc->method.extra.implementation(next_walk_state);
 		if (status == AE_OK) {
 			status = AE_CTRL_TERMINATE;
 		}
diff --git a/drivers/acpi/acpica/dsmthdat.c b/drivers/acpi/acpica/dsmthdat.c
index 7d077bb2f525..0ba19f84ad82 100644
--- a/drivers/acpi/acpica/dsmthdat.c
+++ b/drivers/acpi/acpica/dsmthdat.c
@@ -409,13 +409,11 @@ acpi_ds_method_data_get_value(u8 type,
 		/* If slack enabled, init the local_x/arg_x to an Integer of value zero */
 
 		if (acpi_gbl_enable_interpreter_slack) {
-			object =
-			    acpi_ut_create_internal_object(ACPI_TYPE_INTEGER);
+			object = acpi_ut_create_integer_object((u64) 0);
 			if (!object) {
 				return_ACPI_STATUS(AE_NO_MEMORY);
 			}
 
-			object->integer.value = 0;
 			node->object = object;
 		}
 
diff --git a/drivers/acpi/acpica/dsobject.c b/drivers/acpi/acpica/dsobject.c
index 507e1f0bbdfd..9bc1ba076347 100644
--- a/drivers/acpi/acpica/dsobject.c
+++ b/drivers/acpi/acpica/dsobject.c
@@ -486,7 +486,7 @@ acpi_ds_build_internal_package_obj(struct acpi_walk_state *walk_state,
 		 *
 		 * Note: technically, this is an error, from ACPI spec: "It is an error
 		 * for NumElements to be less than the number of elements in the
-		 * PackageList". However, we just print an error message and
+		 * PackageList". However, we just print a message and
 		 * no exception is returned. This provides Windows compatibility. Some
 		 * BIOSs will alter the num_elements on the fly, creating this type
 		 * of ill-formed package object.
@@ -510,9 +510,9 @@ acpi_ds_build_internal_package_obj(struct acpi_walk_state *walk_state,
 			arg = arg->common.next;
 		}
 
-		ACPI_WARNING((AE_INFO,
-			    "Package List length (0x%X) larger than NumElements count (0x%X), truncated\n",
-			    i, element_count));
+		ACPI_INFO((AE_INFO,
+			   "Actual Package length (0x%X) is larger than NumElements field (0x%X), truncated\n",
+			   i, element_count));
 	} else if (i < element_count) {
 		/*
 		 * Arg list (elements) was exhausted, but we did not reach num_elements count.
diff --git a/drivers/acpi/acpica/dswload.c b/drivers/acpi/acpica/dswload.c
index 6de3a99d4cd4..b40513dd6a6a 100644
--- a/drivers/acpi/acpica/dswload.c
+++ b/drivers/acpi/acpica/dswload.c
@@ -212,18 +212,19 @@ acpi_ds_load1_begin_op(struct acpi_walk_state * walk_state,
 		case ACPI_TYPE_BUFFER:
 
 			/*
-			 * These types we will allow, but we will change the type. This
-			 * enables some existing code of the form:
+			 * These types we will allow, but we will change the type.
+			 * This enables some existing code of the form:
 			 *
 			 *  Name (DEB, 0)
 			 *  Scope (DEB) { ... }
 			 *
-			 * Note: silently change the type here. On the second pass, we will report
-			 * a warning
+			 * Note: silently change the type here. On the second pass,
+			 * we will report a warning
 			 */
 			ACPI_DEBUG_PRINT((ACPI_DB_INFO,
-					  "Type override - [%4.4s] had invalid type (%s) for Scope operator, changed to (Scope)\n",
-					  path,
+					  "Type override - [%4.4s] had invalid type (%s) "
+					  "for Scope operator, changed to type ANY\n",
+					  acpi_ut_get_node_name(node),
 					  acpi_ut_get_type_name(node->type)));
 
 			node->type = ACPI_TYPE_ANY;
@@ -235,8 +236,10 @@ acpi_ds_load1_begin_op(struct acpi_walk_state * walk_state,
 			/* All other types are an error */
 
 			ACPI_ERROR((AE_INFO,
-				    "Invalid type (%s) for target of Scope operator [%4.4s] (Cannot override)",
-				    acpi_ut_get_type_name(node->type), path));
+				    "Invalid type (%s) for target of "
+				    "Scope operator [%4.4s] (Cannot override)",
+				    acpi_ut_get_type_name(node->type),
+				    acpi_ut_get_node_name(node)));
 
 			return_ACPI_STATUS(AE_AML_OPERAND_TYPE);
 		}
@@ -639,26 +642,42 @@ acpi_ds_load2_begin_op(struct acpi_walk_state *walk_state,
 		break;
 
 	case AML_SCOPE_OP:
-		/*
-		 * The Path is an object reference to an existing object.
-		 * Don't enter the name into the namespace, but look it up
-		 * for use later.
-		 */
-		status =
-		    acpi_ns_lookup(walk_state->scope_info, buffer_ptr,
-				   object_type, ACPI_IMODE_EXECUTE,
-				   ACPI_NS_SEARCH_PARENT, walk_state, &(node));
-		if (ACPI_FAILURE(status)) {
-#ifdef ACPI_ASL_COMPILER
-			if (status == AE_NOT_FOUND) {
-				status = AE_OK;
-			} else {
-				ACPI_ERROR_NAMESPACE(buffer_ptr, status);
+
+		/* Special case for Scope(\) -> refers to the Root node */
+
+		if (op && (op->named.node == acpi_gbl_root_node)) {
+			node = op->named.node;
+
+			status =
+			    acpi_ds_scope_stack_push(node, object_type,
+						     walk_state);
+			if (ACPI_FAILURE(status)) {
+				return_ACPI_STATUS(status);
 			}
+		} else {
+			/*
+			 * The Path is an object reference to an existing object.
+			 * Don't enter the name into the namespace, but look it up
+			 * for use later.
+			 */
+			status =
+			    acpi_ns_lookup(walk_state->scope_info, buffer_ptr,
+					   object_type, ACPI_IMODE_EXECUTE,
+					   ACPI_NS_SEARCH_PARENT, walk_state,
+					   &(node));
+			if (ACPI_FAILURE(status)) {
+#ifdef ACPI_ASL_COMPILER
+				if (status == AE_NOT_FOUND) {
+					status = AE_OK;
+				} else {
+					ACPI_ERROR_NAMESPACE(buffer_ptr,
+							     status);
+				}
 #else
-			ACPI_ERROR_NAMESPACE(buffer_ptr, status);
+				ACPI_ERROR_NAMESPACE(buffer_ptr, status);
 #endif
-			return_ACPI_STATUS(status);
+				return_ACPI_STATUS(status);
+			}
 		}
 
 		/*
@@ -681,15 +700,16 @@ acpi_ds_load2_begin_op(struct acpi_walk_state *walk_state,
 		case ACPI_TYPE_BUFFER:
 
 			/*
-			 * These types we will allow, but we will change the type. This
-			 * enables some existing code of the form:
+			 * These types we will allow, but we will change the type.
+			 * This enables some existing code of the form:
 			 *
 			 *  Name (DEB, 0)
 			 *  Scope (DEB) { ... }
 			 */
 			ACPI_WARNING((AE_INFO,
-				      "Type override - [%4.4s] had invalid type (%s) for Scope operator, changed to (Scope)",
-				      buffer_ptr,
+				      "Type override - [%4.4s] had invalid type (%s) "
+				      "for Scope operator, changed to type ANY\n",
+				      acpi_ut_get_node_name(node),
 				      acpi_ut_get_type_name(node->type)));
 
 			node->type = ACPI_TYPE_ANY;
@@ -701,9 +721,10 @@ acpi_ds_load2_begin_op(struct acpi_walk_state *walk_state,
 			/* All other types are an error */
 
 			ACPI_ERROR((AE_INFO,
-				    "Invalid type (%s) for target of Scope operator [%4.4s]",
+				    "Invalid type (%s) for target of "
+				    "Scope operator [%4.4s] (Cannot override)",
 				    acpi_ut_get_type_name(node->type),
-				    buffer_ptr));
+				    acpi_ut_get_node_name(node)));
 
 			return (AE_AML_OPERAND_TYPE);
 		}
@@ -1031,9 +1052,22 @@ acpi_status acpi_ds_load2_end_op(struct acpi_walk_state *walk_state)
 			}
 
 			/*
-			 * If we are executing a method, initialize the region
+			 * The op_region is not fully parsed at this time. The only valid
+			 * argument is the space_id. (We must save the address of the
+			 * AML of the address and length operands)
+			 *
+			 * If we have a valid region, initialize it. The namespace is
+			 * unlocked at this point.
+			 *
+			 * Need to unlock interpreter if it is locked (if we are running
+			 * a control method), in order to allow _REG methods to be run
+			 * during acpi_ev_initialize_region.
 			 */
 			if (walk_state->method_node) {
+				/*
+				 * Executing a method: initialize the region and unlock
+				 * the interpreter
+				 */
 				status =
 				    acpi_ex_create_region(op->named.data,
 							  op->named.length,
@@ -1042,21 +1076,17 @@ acpi_status acpi_ds_load2_end_op(struct acpi_walk_state *walk_state)
 				if (ACPI_FAILURE(status)) {
 					return (status);
 				}
-			}
 
-			/*
-			 * The op_region is not fully parsed at this time. Only valid
-			 * argument is the space_id. (We must save the address of the
-			 * AML of the address and length operands)
-			 */
+				acpi_ex_exit_interpreter();
+			}
 
-			/*
-			 * If we have a valid region, initialize it
-			 * Namespace is NOT locked at this point.
-			 */
 			status =
 			    acpi_ev_initialize_region
 			    (acpi_ns_get_attached_object(node), FALSE);
+			if (walk_state->method_node) {
+				acpi_ex_enter_interpreter();
+			}
+
 			if (ACPI_FAILURE(status)) {
 				/*
 				 *  If AE_NOT_EXIST is returned, it is not fatal
diff --git a/drivers/acpi/acpica/evgpeblk.c b/drivers/acpi/acpica/evgpeblk.c
index a60aaa7635f3..247920900187 100644
--- a/drivers/acpi/acpica/evgpeblk.c
+++ b/drivers/acpi/acpica/evgpeblk.c
@@ -945,8 +945,8 @@ acpi_ev_create_gpe_block(struct acpi_namespace_node *gpe_device,
 
 	status = acpi_ns_walk_namespace(ACPI_TYPE_METHOD, gpe_device,
 					ACPI_UINT32_MAX, ACPI_NS_WALK_NO_UNLOCK,
-					acpi_ev_save_method_info, gpe_block,
-					NULL);
+					acpi_ev_save_method_info, NULL,
+					gpe_block, NULL);
 
 	/* Return the new block */
 
@@ -1022,8 +1022,8 @@ acpi_ev_initialize_gpe_block(struct acpi_namespace_node *gpe_device,
 		status =
 		    acpi_ns_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT,
 					   ACPI_UINT32_MAX, ACPI_NS_WALK_UNLOCK,
-					   acpi_ev_match_prw_and_gpe, &gpe_info,
-					   NULL);
+					   acpi_ev_match_prw_and_gpe, NULL,
+					   &gpe_info, NULL);
 	}
 
 	/*
diff --git a/drivers/acpi/acpica/evregion.c b/drivers/acpi/acpica/evregion.c
index 98c7f9c62653..5336d911fbf0 100644
--- a/drivers/acpi/acpica/evregion.c
+++ b/drivers/acpi/acpica/evregion.c
@@ -51,6 +51,10 @@
 ACPI_MODULE_NAME("evregion")
 
 /* Local prototypes */
+static u8
+acpi_ev_has_default_handler(struct acpi_namespace_node *node,
+			    acpi_adr_space_type space_id);
+
 static acpi_status
 acpi_ev_reg_run(acpi_handle obj_handle,
 		u32 level, void *context, void **return_value);
@@ -142,6 +146,50 @@ acpi_status acpi_ev_install_region_handlers(void)
 
 /*******************************************************************************
  *
+ * FUNCTION:    acpi_ev_has_default_handler
+ *
+ * PARAMETERS:  Node                - Namespace node for the device
+ *              space_id            - The address space ID
+ *
+ * RETURN:      TRUE if default handler is installed, FALSE otherwise
+ *
+ * DESCRIPTION: Check if the default handler is installed for the requested
+ *              space ID.
+ *
+ ******************************************************************************/
+
+static u8
+acpi_ev_has_default_handler(struct acpi_namespace_node *node,
+			    acpi_adr_space_type space_id)
+{
+	union acpi_operand_object *obj_desc;
+	union acpi_operand_object *handler_obj;
+
+	/* Must have an existing internal object */
+
+	obj_desc = acpi_ns_get_attached_object(node);
+	if (obj_desc) {
+		handler_obj = obj_desc->device.handler;
+
+		/* Walk the linked list of handlers for this object */
+
+		while (handler_obj) {
+			if (handler_obj->address_space.space_id == space_id) {
+				if (handler_obj->address_space.handler_flags &
+				    ACPI_ADDR_HANDLER_DEFAULT_INSTALLED) {
+					return (TRUE);
+				}
+			}
+
+			handler_obj = handler_obj->address_space.next;
+		}
+	}
+
+	return (FALSE);
+}
+
+/*******************************************************************************
+ *
  * FUNCTION:    acpi_ev_initialize_op_regions
  *
  * PARAMETERS:  None
@@ -169,12 +217,18 @@ acpi_status acpi_ev_initialize_op_regions(void)
 
 	for (i = 0; i < ACPI_NUM_DEFAULT_SPACES; i++) {
 		/*
-		 * TBD: Make sure handler is the DEFAULT handler, otherwise
-		 * _REG will have already been run.
+		 * Make sure the installed handler is the DEFAULT handler. If not the
+		 * default, the _REG methods will have already been run (when the
+		 * handler was installed)
 		 */
-		status = acpi_ev_execute_reg_methods(acpi_gbl_root_node,
-						     acpi_gbl_default_address_spaces
-						     [i]);
+		if (acpi_ev_has_default_handler(acpi_gbl_root_node,
+						acpi_gbl_default_address_spaces
+						[i])) {
+			status =
+			    acpi_ev_execute_reg_methods(acpi_gbl_root_node,
+							acpi_gbl_default_address_spaces
+							[i]);
+		}
 	}
 
 	(void)acpi_ut_release_mutex(ACPI_MTX_NAMESPACE);
@@ -235,23 +289,20 @@ acpi_ev_execute_reg_method(union acpi_operand_object *region_obj, u32 function)
 	 *  connection status 1 for connecting the handler, 0 for disconnecting
 	 *  the handler (Passed as a parameter)
 	 */
-	args[0] = acpi_ut_create_internal_object(ACPI_TYPE_INTEGER);
+	args[0] =
+	    acpi_ut_create_integer_object((u64) region_obj->region.space_id);
 	if (!args[0]) {
 		status = AE_NO_MEMORY;
 		goto cleanup1;
 	}
 
-	args[1] = acpi_ut_create_internal_object(ACPI_TYPE_INTEGER);
+	args[1] = acpi_ut_create_integer_object((u64) function);
 	if (!args[1]) {
 		status = AE_NO_MEMORY;
 		goto cleanup2;
 	}
 
-	/* Setup the parameter objects */
-
-	args[0]->integer.value = region_obj->region.space_id;
-	args[1]->integer.value = function;
-	args[2] = NULL;
+	args[2] = NULL;		/* Terminate list */
 
 	/* Execute the method, no return value */
 
@@ -667,7 +718,7 @@ acpi_ev_install_handler(acpi_handle obj_handle,
 
 	/* Convert and validate the device handle */
 
-	node = acpi_ns_map_handle_to_node(obj_handle);
+	node = acpi_ns_validate_handle(obj_handle);
 	if (!node) {
 		return (AE_BAD_PARAMETER);
 	}
@@ -971,8 +1022,8 @@ acpi_ev_install_space_handler(struct acpi_namespace_node * node,
 	 */
 	status = acpi_ns_walk_namespace(ACPI_TYPE_ANY, node, ACPI_UINT32_MAX,
 					ACPI_NS_WALK_UNLOCK,
-					acpi_ev_install_handler, handler_obj,
-					NULL);
+					acpi_ev_install_handler, NULL,
+					handler_obj, NULL);
 
       unlock_and_exit:
 	return_ACPI_STATUS(status);
@@ -1008,7 +1059,7 @@ acpi_ev_execute_reg_methods(struct acpi_namespace_node *node,
 	 */
 	status = acpi_ns_walk_namespace(ACPI_TYPE_ANY, node, ACPI_UINT32_MAX,
 					ACPI_NS_WALK_UNLOCK, acpi_ev_reg_run,
-					&space_id, NULL);
+					NULL, &space_id, NULL);
 
 	return_ACPI_STATUS(status);
 }
@@ -1036,7 +1087,7 @@ acpi_ev_reg_run(acpi_handle obj_handle,
 
 	/* Convert and validate the device handle */
 
-	node = acpi_ns_map_handle_to_node(obj_handle);
+	node = acpi_ns_validate_handle(obj_handle);
 	if (!node) {
 		return (AE_BAD_PARAMETER);
 	}
diff --git a/drivers/acpi/acpica/evrgnini.c b/drivers/acpi/acpica/evrgnini.c
index cf29c4953028..ff168052a332 100644
--- a/drivers/acpi/acpica/evrgnini.c
+++ b/drivers/acpi/acpica/evrgnini.c
@@ -575,6 +575,21 @@ acpi_ev_initialize_region(union acpi_operand_object *region_obj,
 				handler_obj = obj_desc->thermal_zone.handler;
 				break;
 
+			case ACPI_TYPE_METHOD:
+				/*
+				 * If we are executing module level code, the original
+				 * Node's object was replaced by this Method object and we
+				 * saved the handler in the method object.
+				 *
+				 * See acpi_ns_exec_module_code
+				 */
+				if (obj_desc->method.
+				    flags & AOPOBJ_MODULE_LEVEL) {
+					handler_obj =
+					    obj_desc->method.extra.handler;
+				}
+				break;
+
 			default:
 				/* Ignore other objects */
 				break;
diff --git a/drivers/acpi/acpica/evxface.c b/drivers/acpi/acpica/evxface.c
index 10b8543dd466..2fe0809d4eb2 100644
--- a/drivers/acpi/acpica/evxface.c
+++ b/drivers/acpi/acpica/evxface.c
@@ -259,7 +259,7 @@ acpi_install_notify_handler(acpi_handle device,
 
 	/* Convert and validate the device handle */
 
-	node = acpi_ns_map_handle_to_node(device);
+	node = acpi_ns_validate_handle(device);
 	if (!node) {
 		status = AE_BAD_PARAMETER;
 		goto unlock_and_exit;
@@ -425,7 +425,7 @@ acpi_remove_notify_handler(acpi_handle device,
 
 	/* Convert and validate the device handle */
 
-	node = acpi_ns_map_handle_to_node(device);
+	node = acpi_ns_validate_handle(device);
 	if (!node) {
 		status = AE_BAD_PARAMETER;
 		goto unlock_and_exit;
diff --git a/drivers/acpi/acpica/evxfevnt.c b/drivers/acpi/acpica/evxfevnt.c
index 4721f58fe42c..eed7a38d25f2 100644
--- a/drivers/acpi/acpica/evxfevnt.c
+++ b/drivers/acpi/acpica/evxfevnt.c
@@ -610,7 +610,7 @@ acpi_install_gpe_block(acpi_handle gpe_device,
 		return (status);
 	}
 
-	node = acpi_ns_map_handle_to_node(gpe_device);
+	node = acpi_ns_validate_handle(gpe_device);
 	if (!node) {
 		status = AE_BAD_PARAMETER;
 		goto unlock_and_exit;
@@ -698,7 +698,7 @@ acpi_status acpi_remove_gpe_block(acpi_handle gpe_device)
 		return (status);
 	}
 
-	node = acpi_ns_map_handle_to_node(gpe_device);
+	node = acpi_ns_validate_handle(gpe_device);
 	if (!node) {
 		status = AE_BAD_PARAMETER;
 		goto unlock_and_exit;
diff --git a/drivers/acpi/acpica/evxfregn.c b/drivers/acpi/acpica/evxfregn.c
index 7c3d2d356ffb..c98aa7c2d67c 100644
--- a/drivers/acpi/acpica/evxfregn.c
+++ b/drivers/acpi/acpica/evxfregn.c
@@ -89,7 +89,7 @@ acpi_install_address_space_handler(acpi_handle device,
 
 	/* Convert and validate the device handle */
 
-	node = acpi_ns_map_handle_to_node(device);
+	node = acpi_ns_validate_handle(device);
 	if (!node) {
 		status = AE_BAD_PARAMETER;
 		goto unlock_and_exit;
@@ -155,7 +155,7 @@ acpi_remove_address_space_handler(acpi_handle device,
 
 	/* Convert and validate the device handle */
 
-	node = acpi_ns_map_handle_to_node(device);
+	node = acpi_ns_validate_handle(device);
 	if (!node ||
 	    ((node->type != ACPI_TYPE_DEVICE) &&
 	     (node->type != ACPI_TYPE_PROCESSOR) &&
diff --git a/drivers/acpi/acpica/exconfig.c b/drivers/acpi/acpica/exconfig.c
index 24afef81af39..46adfa541cbc 100644
--- a/drivers/acpi/acpica/exconfig.c
+++ b/drivers/acpi/acpica/exconfig.c
@@ -170,14 +170,12 @@ acpi_ex_load_table_op(struct acpi_walk_state *walk_state,
 
 		/* Table not found, return an Integer=0 and AE_OK */
 
-		ddb_handle = acpi_ut_create_internal_object(ACPI_TYPE_INTEGER);
+		ddb_handle = acpi_ut_create_integer_object((u64) 0);
 		if (!ddb_handle) {
 			return_ACPI_STATUS(AE_NO_MEMORY);
 		}
 
-		ddb_handle->integer.value = 0;
 		*return_desc = ddb_handle;
-
 		return_ACPI_STATUS(AE_OK);
 	}
 
diff --git a/drivers/acpi/acpica/exconvrt.c b/drivers/acpi/acpica/exconvrt.c
index 37d0d39e60a6..51d5f224f9fa 100644
--- a/drivers/acpi/acpica/exconvrt.c
+++ b/drivers/acpi/acpica/exconvrt.c
@@ -167,7 +167,7 @@ acpi_ex_convert_to_integer(union acpi_operand_object *obj_desc,
 
 	/* Create a new integer */
 
-	return_desc = acpi_ut_create_internal_object(ACPI_TYPE_INTEGER);
+	return_desc = acpi_ut_create_integer_object(result);
 	if (!return_desc) {
 		return_ACPI_STATUS(AE_NO_MEMORY);
 	}
@@ -177,7 +177,6 @@ acpi_ex_convert_to_integer(union acpi_operand_object *obj_desc,
 
 	/* Save the Result */
 
-	return_desc->integer.value = result;
 	acpi_ex_truncate_for32bit_table(return_desc);
 	*result_desc = return_desc;
 	return_ACPI_STATUS(AE_OK);
diff --git a/drivers/acpi/acpica/exfield.c b/drivers/acpi/acpica/exfield.c
index 0b33d6c887b9..1588a2d660e7 100644
--- a/drivers/acpi/acpica/exfield.c
+++ b/drivers/acpi/acpica/exfield.c
@@ -162,13 +162,12 @@ acpi_ex_read_data_from_field(struct acpi_walk_state *walk_state,
 	} else {
 		/* Field will fit within an Integer (normal case) */
 
-		buffer_desc = acpi_ut_create_internal_object(ACPI_TYPE_INTEGER);
+		buffer_desc = acpi_ut_create_integer_object((u64) 0);
 		if (!buffer_desc) {
 			return_ACPI_STATUS(AE_NO_MEMORY);
 		}
 
 		length = acpi_gbl_integer_byte_width;
-		buffer_desc->integer.value = 0;
 		buffer = &buffer_desc->integer.value;
 	}
 
diff --git a/drivers/acpi/acpica/exmutex.c b/drivers/acpi/acpica/exmutex.c
index 2f0114202b05..3c456bd575d0 100644
--- a/drivers/acpi/acpica/exmutex.c
+++ b/drivers/acpi/acpica/exmutex.c
@@ -375,6 +375,15 @@ acpi_ex_release_mutex(union acpi_operand_object *obj_desc,
 		return_ACPI_STATUS(AE_AML_MUTEX_NOT_ACQUIRED);
 	}
 
+	/* Must have a valid thread ID */
+
+	if (!walk_state->thread) {
+		ACPI_ERROR((AE_INFO,
+			    "Cannot release Mutex [%4.4s], null thread info",
+			    acpi_ut_get_node_name(obj_desc->mutex.node)));
+		return_ACPI_STATUS(AE_AML_INTERNAL);
+	}
+
 	/*
 	 * The Mutex is owned, but this thread must be the owner.
 	 * Special case for Global Lock, any thread can release
@@ -392,15 +401,6 @@ acpi_ex_release_mutex(union acpi_operand_object *obj_desc,
 		return_ACPI_STATUS(AE_AML_NOT_OWNER);
 	}
 
-	/* Must have a valid thread ID */
-
-	if (!walk_state->thread) {
-		ACPI_ERROR((AE_INFO,
-			    "Cannot release Mutex [%4.4s], null thread info",
-			    acpi_ut_get_node_name(obj_desc->mutex.node)));
-		return_ACPI_STATUS(AE_AML_INTERNAL);
-	}
-
 	/*
 	 * The sync level of the mutex must be equal to the current sync level. In
 	 * other words, the current level means that at least one mutex at that
diff --git a/drivers/acpi/acpica/exoparg1.c b/drivers/acpi/acpica/exoparg1.c
index 9635d21e568d..752fe48b2d20 100644
--- a/drivers/acpi/acpica/exoparg1.c
+++ b/drivers/acpi/acpica/exoparg1.c
@@ -100,12 +100,12 @@ acpi_status acpi_ex_opcode_0A_0T_1R(struct acpi_walk_state *walk_state)
 
 		/* Create a return object of type Integer */
 
-		return_desc = acpi_ut_create_internal_object(ACPI_TYPE_INTEGER);
+		return_desc =
+		    acpi_ut_create_integer_object(acpi_os_get_timer());
 		if (!return_desc) {
 			status = AE_NO_MEMORY;
 			goto cleanup;
 		}
-		return_desc->integer.value = acpi_os_get_timer();
 		break;
 
 	default:		/*  Unknown opcode  */
@@ -599,7 +599,7 @@ acpi_status acpi_ex_opcode_1A_0T_1R(struct acpi_walk_state *walk_state)
 	switch (walk_state->opcode) {
 	case AML_LNOT_OP:	/* LNot (Operand) */
 
-		return_desc = acpi_ut_create_internal_object(ACPI_TYPE_INTEGER);
+		return_desc = acpi_ut_create_integer_object((u64) 0);
 		if (!return_desc) {
 			status = AE_NO_MEMORY;
 			goto cleanup;
@@ -702,13 +702,11 @@ acpi_status acpi_ex_opcode_1A_0T_1R(struct acpi_walk_state *walk_state)
 
 		/* Allocate a descriptor to hold the type. */
 
-		return_desc = acpi_ut_create_internal_object(ACPI_TYPE_INTEGER);
+		return_desc = acpi_ut_create_integer_object((u64) type);
 		if (!return_desc) {
 			status = AE_NO_MEMORY;
 			goto cleanup;
 		}
-
-		return_desc->integer.value = type;
 		break;
 
 	case AML_SIZE_OF_OP:	/* size_of (source_object) */
@@ -777,13 +775,11 @@ acpi_status acpi_ex_opcode_1A_0T_1R(struct acpi_walk_state *walk_state)
 		 * Now that we have the size of the object, create a result
 		 * object to hold the value
 		 */
-		return_desc = acpi_ut_create_internal_object(ACPI_TYPE_INTEGER);
+		return_desc = acpi_ut_create_integer_object(value);
 		if (!return_desc) {
 			status = AE_NO_MEMORY;
 			goto cleanup;
 		}
-
-		return_desc->integer.value = value;
 		break;
 
 	case AML_REF_OF_OP:	/* ref_of (source_object) */
@@ -946,24 +942,24 @@ acpi_status acpi_ex_opcode_1A_0T_1R(struct acpi_walk_state *walk_state)
 					 * NOTE: index into a buffer is NOT a pointer to a
 					 * sub-buffer of the main buffer, it is only a pointer to a
 					 * single element (byte) of the buffer!
+					 *
+					 * Since we are returning the value of the buffer at the
+					 * indexed location, we don't need to add an additional
+					 * reference to the buffer itself.
 					 */
 					return_desc =
-					    acpi_ut_create_internal_object
-					    (ACPI_TYPE_INTEGER);
+					    acpi_ut_create_integer_object((u64)
+									  temp_desc->
+									  buffer.
+									  pointer
+									  [operand
+									   [0]->
+									   reference.
+									   value]);
 					if (!return_desc) {
 						status = AE_NO_MEMORY;
 						goto cleanup;
 					}
-
-					/*
-					 * Since we are returning the value of the buffer at the
-					 * indexed location, we don't need to add an additional
-					 * reference to the buffer itself.
-					 */
-					return_desc->integer.value =
-					    temp_desc->buffer.
-					    pointer[operand[0]->reference.
-						    value];
 					break;
 
 				case ACPI_TYPE_PACKAGE:
diff --git a/drivers/acpi/acpica/exoparg6.c b/drivers/acpi/acpica/exoparg6.c
index ae43f7670a6c..295542e6bd51 100644
--- a/drivers/acpi/acpica/exoparg6.c
+++ b/drivers/acpi/acpica/exoparg6.c
@@ -253,18 +253,15 @@ acpi_status acpi_ex_opcode_6A_0T_1R(struct acpi_walk_state * walk_state)
 		}
 
 		/* Create an integer for the return value */
+		/* Default return value is ACPI_INTEGER_MAX if no match found */
 
-		return_desc = acpi_ut_create_internal_object(ACPI_TYPE_INTEGER);
+		return_desc = acpi_ut_create_integer_object(ACPI_INTEGER_MAX);
 		if (!return_desc) {
 			status = AE_NO_MEMORY;
 			goto cleanup;
 
 		}
 
-		/* Default return value if no match found */
-
-		return_desc->integer.value = ACPI_INTEGER_MAX;
-
 		/*
 		 * Examine each element until a match is found. Both match conditions
 		 * must be satisfied for a match to occur. Within the loop,
diff --git a/drivers/acpi/acpica/nsaccess.c b/drivers/acpi/acpica/nsaccess.c
index 9c3cdbe2d82a..d622ba770000 100644
--- a/drivers/acpi/acpica/nsaccess.c
+++ b/drivers/acpi/acpica/nsaccess.c
@@ -165,7 +165,7 @@ acpi_status acpi_ns_root_initialize(void)
 
 				obj_desc->method.method_flags =
 				    AML_METHOD_INTERNAL_ONLY;
-				obj_desc->method.implementation =
+				obj_desc->method.extra.implementation =
 				    acpi_ut_osi_implementation;
 #endif
 				break;
diff --git a/drivers/acpi/acpica/nsdump.c b/drivers/acpi/acpica/nsdump.c
index 2bad613db73a..e37836e27e29 100644
--- a/drivers/acpi/acpica/nsdump.c
+++ b/drivers/acpi/acpica/nsdump.c
@@ -180,7 +180,7 @@ acpi_ns_dump_one_object(acpi_handle obj_handle,
 		return (AE_OK);
 	}
 
-	this_node = acpi_ns_map_handle_to_node(obj_handle);
+	this_node = acpi_ns_validate_handle(obj_handle);
 	if (!this_node) {
 		ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Invalid object handle %p\n",
 				  obj_handle));
@@ -634,8 +634,8 @@ acpi_ns_dump_objects(acpi_object_type type,
 	(void)acpi_ns_walk_namespace(type, start_handle, max_depth,
 				     ACPI_NS_WALK_NO_UNLOCK |
 				     ACPI_NS_WALK_TEMP_NODES,
-				     acpi_ns_dump_one_object, (void *)&info,
-				     NULL);
+				     acpi_ns_dump_one_object, NULL,
+				     (void *)&info, NULL);
 }
 #endif				/* ACPI_FUTURE_USAGE */
 
diff --git a/drivers/acpi/acpica/nsdumpdv.c b/drivers/acpi/acpica/nsdumpdv.c
index 0fe87f1aef16..36be7f0e97ec 100644
--- a/drivers/acpi/acpica/nsdumpdv.c
+++ b/drivers/acpi/acpica/nsdumpdv.c
@@ -131,7 +131,8 @@ void acpi_ns_dump_root_devices(void)
 
 	status = acpi_ns_walk_namespace(ACPI_TYPE_DEVICE, sys_bus_handle,
 					ACPI_UINT32_MAX, ACPI_NS_WALK_NO_UNLOCK,
-					acpi_ns_dump_one_device, NULL, NULL);
+					acpi_ns_dump_one_device, NULL, NULL,
+					NULL);
 }
 
 #endif
diff --git a/drivers/acpi/acpica/nseval.c b/drivers/acpi/acpica/nseval.c
index 846d1132feb1..af9fe9103734 100644
--- a/drivers/acpi/acpica/nseval.c
+++ b/drivers/acpi/acpica/nseval.c
@@ -366,50 +366,88 @@ static void
 acpi_ns_exec_module_code(union acpi_operand_object *method_obj,
 			 struct acpi_evaluate_info *info)
 {
-	union acpi_operand_object *root_obj;
+	union acpi_operand_object *parent_obj;
+	struct acpi_namespace_node *parent_node;
+	acpi_object_type type;
 	acpi_status status;
 
 	ACPI_FUNCTION_TRACE(ns_exec_module_code);
 
+	/*
+	 * Get the parent node. We cheat by using the next_object field
+	 * of the method object descriptor.
+	 */
+	parent_node = ACPI_CAST_PTR(struct acpi_namespace_node,
+				    method_obj->method.next_object);
+	type = acpi_ns_get_type(parent_node);
+
+	/*
+	 * Get the region handler and save it in the method object. We may need
+	 * this if an operation region declaration causes a _REG method to be run.
+	 *
+	 * We can't do this in acpi_ps_link_module_code because
+	 * acpi_gbl_root_node->Object is NULL at PASS1.
+	 */
+	if ((type == ACPI_TYPE_DEVICE) && parent_node->object) {
+		method_obj->method.extra.handler =
+		    parent_node->object->device.handler;
+	}
+
+	/* Must clear next_object (acpi_ns_attach_object needs the field) */
+
+	method_obj->method.next_object = NULL;
+
 	/* Initialize the evaluation information block */
 
 	ACPI_MEMSET(info, 0, sizeof(struct acpi_evaluate_info));
-	info->prefix_node = acpi_gbl_root_node;
+	info->prefix_node = parent_node;
 
 	/*
-	 * Get the currently attached root object. Add a reference, because the
+	 * Get the currently attached parent object. Add a reference, because the
 	 * ref count will be decreased when the method object is installed to
-	 * the root node.
+	 * the parent node.
 	 */
-	root_obj = acpi_ns_get_attached_object(acpi_gbl_root_node);
-	acpi_ut_add_reference(root_obj);
+	parent_obj = acpi_ns_get_attached_object(parent_node);
+	if (parent_obj) {
+		acpi_ut_add_reference(parent_obj);
+	}
 
-	/* Install the method (module-level code) in the root node */
+	/* Install the method (module-level code) in the parent node */
 
-	status = acpi_ns_attach_object(acpi_gbl_root_node, method_obj,
+	status = acpi_ns_attach_object(parent_node, method_obj,
 				       ACPI_TYPE_METHOD);
 	if (ACPI_FAILURE(status)) {
 		goto exit;
 	}
 
-	/* Execute the root node as a control method */
+	/* Execute the parent node as a control method */
 
 	status = acpi_ns_evaluate(info);
 
 	ACPI_DEBUG_PRINT((ACPI_DB_INIT, "Executed module-level code at %p\n",
 			  method_obj->method.aml_start));
 
+	/* Delete a possible implicit return value (in slack mode) */
+
+	if (info->return_object) {
+		acpi_ut_remove_reference(info->return_object);
+	}
+
 	/* Detach the temporary method object */
 
-	acpi_ns_detach_object(acpi_gbl_root_node);
+	acpi_ns_detach_object(parent_node);
 
-	/* Restore the original root object */
+	/* Restore the original parent object */
 
-	status =
-	    acpi_ns_attach_object(acpi_gbl_root_node, root_obj,
-				  ACPI_TYPE_DEVICE);
+	if (parent_obj) {
+		status = acpi_ns_attach_object(parent_node, parent_obj, type);
+	} else {
+		parent_node->type = (u8)type;
+	}
 
       exit:
-	acpi_ut_remove_reference(root_obj);
+	if (parent_obj) {
+		acpi_ut_remove_reference(parent_obj);
+	}
 	return_VOID;
 }
diff --git a/drivers/acpi/acpica/nsinit.c b/drivers/acpi/acpica/nsinit.c
index 1d5b360eb25b..4f8abac231d2 100644
--- a/drivers/acpi/acpica/nsinit.c
+++ b/drivers/acpi/acpica/nsinit.c
@@ -96,7 +96,7 @@ acpi_status acpi_ns_initialize_objects(void)
 	/* Walk entire namespace from the supplied root */
 
 	status = acpi_walk_namespace(ACPI_TYPE_ANY, ACPI_ROOT_OBJECT,
-				     ACPI_UINT32_MAX, acpi_ns_init_one_object,
+				     ACPI_UINT32_MAX, acpi_ns_init_one_object, NULL,
 				     &info, NULL);
 	if (ACPI_FAILURE(status)) {
 		ACPI_EXCEPTION((AE_INFO, status, "During WalkNamespace"));
@@ -156,7 +156,8 @@ acpi_status acpi_ns_initialize_devices(void)
 
 	status = acpi_ns_walk_namespace(ACPI_TYPE_ANY, ACPI_ROOT_OBJECT,
 					ACPI_UINT32_MAX, FALSE,
-					acpi_ns_find_ini_methods, &info, NULL);
+					acpi_ns_find_ini_methods, NULL, &info,
+					NULL);
 	if (ACPI_FAILURE(status)) {
 		goto error_exit;
 	}
@@ -189,7 +190,8 @@ acpi_status acpi_ns_initialize_devices(void)
 
 	status = acpi_ns_walk_namespace(ACPI_TYPE_ANY, ACPI_ROOT_OBJECT,
 					ACPI_UINT32_MAX, FALSE,
-					acpi_ns_init_one_device, &info, NULL);
+					acpi_ns_init_one_device, NULL, &info,
+					NULL);
 
 	ACPI_FREE(info.evaluate_info);
 	if (ACPI_FAILURE(status)) {
diff --git a/drivers/acpi/acpica/nsnames.c b/drivers/acpi/acpica/nsnames.c
index af8e6bcee07e..8f9a4875ce26 100644
--- a/drivers/acpi/acpica/nsnames.c
+++ b/drivers/acpi/acpica/nsnames.c
@@ -232,7 +232,7 @@ acpi_ns_handle_to_pathname(acpi_handle target_handle,
 
 	ACPI_FUNCTION_TRACE_PTR(ns_handle_to_pathname, target_handle);
 
-	node = acpi_ns_map_handle_to_node(target_handle);
+	node = acpi_ns_validate_handle(target_handle);
 	if (!node) {
 		return_ACPI_STATUS(AE_BAD_PARAMETER);
 	}
diff --git a/drivers/acpi/acpica/nspredef.c b/drivers/acpi/acpica/nspredef.c
index f8427afeebdf..d34fa59548f7 100644
--- a/drivers/acpi/acpica/nspredef.c
+++ b/drivers/acpi/acpica/nspredef.c
@@ -216,23 +216,38 @@ acpi_ns_check_predefined_names(struct acpi_namespace_node *node,
 	data->pathname = pathname;
 
 	/*
-	 * Check that the type of the return object is what is expected for
-	 * this predefined name
+	 * Check that the type of the main return object is what is expected
+	 * for this predefined name
 	 */
 	status = acpi_ns_check_object_type(data, return_object_ptr,
 					   predefined->info.expected_btypes,
 					   ACPI_NOT_PACKAGE_ELEMENT);
 	if (ACPI_FAILURE(status)) {
-		goto check_validation_status;
+		goto exit;
 	}
 
-	/* For returned Package objects, check the type of all sub-objects */
-
-	if (return_object->common.type == ACPI_TYPE_PACKAGE) {
+	/*
+	 * For returned Package objects, check the type of all sub-objects.
+	 * Note: Package may have been newly created by call above.
+	 */
+	if ((*return_object_ptr)->common.type == ACPI_TYPE_PACKAGE) {
 		status = acpi_ns_check_package(data, return_object_ptr);
+		if (ACPI_FAILURE(status)) {
+			goto exit;
+		}
 	}
 
-check_validation_status:
+	/*
+	 * The return object was OK, or it was successfully repaired above.
+	 * Now make some additional checks such as verifying that package
+	 * objects are sorted correctly (if required) or buffer objects have
+	 * the correct data width (bytes vs. dwords). These repairs are
+	 * performed on a per-name basis, i.e., the code is specific to
+	 * particular predefined names.
+	 */
+	status = acpi_ns_complex_repairs(data, node, status, return_object_ptr);
+
+exit:
 	/*
 	 * If the object validation failed or if we successfully repaired one
 	 * or more objects, mark the parent node to suppress further warning
@@ -421,6 +436,13 @@ acpi_ns_check_package(struct acpi_predefined_data *data,
 			  data->pathname, package->ret_info.type,
 			  return_object->package.count));
 
+	/*
+	 * For variable-length Packages, we can safely remove all embedded
+	 * and trailing NULL package elements
+	 */
+	acpi_ns_remove_null_elements(data, package->ret_info.type,
+				     return_object);
+
 	/* Extract package count and elements array */
 
 	elements = return_object->package.elements;
@@ -455,11 +477,11 @@ acpi_ns_check_package(struct acpi_predefined_data *data,
 		if (count < expected_count) {
 			goto package_too_small;
 		} else if (count > expected_count) {
-			ACPI_WARN_PREDEFINED((AE_INFO, data->pathname,
-					      data->node_flags,
-					      "Return Package is larger than needed - "
-					      "found %u, expected %u", count,
-					      expected_count));
+			ACPI_DEBUG_PRINT((ACPI_DB_REPAIR,
+					  "%s: Return Package is larger than needed - "
+					  "found %u, expected %u\n",
+					  data->pathname, count,
+					  expected_count));
 		}
 
 		/* Validate all elements of the returned package */
@@ -601,7 +623,8 @@ acpi_ns_check_package(struct acpi_predefined_data *data,
 		 * there is only one entry). We may be able to repair this by
 		 * wrapping the returned Package with a new outer Package.
 		 */
-		if ((*elements)->common.type != ACPI_TYPE_PACKAGE) {
+		if (*elements
+		    && ((*elements)->common.type != ACPI_TYPE_PACKAGE)) {
 
 			/* Create the new outer package and populate it */
 
@@ -677,8 +700,13 @@ acpi_ns_check_package_list(struct acpi_predefined_data *data,
 	u32 i;
 	u32 j;
 
-	/* Validate each sub-Package in the parent Package */
-
+	/*
+	 * Validate each sub-Package in the parent Package
+	 *
+	 * NOTE: assumes list of sub-packages contains no NULL elements.
+	 * Any NULL elements should have been removed by earlier call
+	 * to acpi_ns_remove_null_elements.
+	 */
 	for (i = 0; i < count; i++) {
 		sub_package = *elements;
 		sub_elements = sub_package->package.elements;
diff --git a/drivers/acpi/acpica/nsrepair.c b/drivers/acpi/acpica/nsrepair.c
index db2b2a99c3a8..4fd1bdb056b2 100644
--- a/drivers/acpi/acpica/nsrepair.c
+++ b/drivers/acpi/acpica/nsrepair.c
@@ -44,13 +44,53 @@
 #include <acpi/acpi.h>
 #include "accommon.h"
 #include "acnamesp.h"
-#include "acpredef.h"
+#include "acinterp.h"
 
 #define _COMPONENT          ACPI_NAMESPACE
 ACPI_MODULE_NAME("nsrepair")
 
 /*******************************************************************************
  *
+ * This module attempts to repair or convert objects returned by the
+ * predefined methods to an object type that is expected, as per the ACPI
+ * specification. The need for this code is dictated by the many machines that
+ * return incorrect types for the standard predefined methods. Performing these
+ * conversions here, in one place, eliminates the need for individual ACPI
+ * device drivers to do the same. Note: Most of these conversions are different
+ * than the internal object conversion routines used for implicit object
+ * conversion.
+ *
+ * The following conversions can be performed as necessary:
+ *
+ * Integer -> String
+ * Integer -> Buffer
+ * String  -> Integer
+ * String  -> Buffer
+ * Buffer  -> Integer
+ * Buffer  -> String
+ * Buffer  -> Package of Integers
+ * Package -> Package of one Package
+ *
+ ******************************************************************************/
+/* Local prototypes */
+static acpi_status
+acpi_ns_convert_to_integer(union acpi_operand_object *original_object,
+			   union acpi_operand_object **return_object);
+
+static acpi_status
+acpi_ns_convert_to_string(union acpi_operand_object *original_object,
+			  union acpi_operand_object **return_object);
+
+static acpi_status
+acpi_ns_convert_to_buffer(union acpi_operand_object *original_object,
+			  union acpi_operand_object **return_object);
+
+static acpi_status
+acpi_ns_convert_to_package(union acpi_operand_object *original_object,
+			   union acpi_operand_object **return_object);
+
+/*******************************************************************************
+ *
  * FUNCTION:    acpi_ns_repair_object
  *
  * PARAMETERS:  Data                - Pointer to validation data structure
@@ -67,6 +107,7 @@ ACPI_MODULE_NAME("nsrepair")
  *              not expected.
  *
  ******************************************************************************/
+
 acpi_status
 acpi_ns_repair_object(struct acpi_predefined_data *data,
 		      u32 expected_btypes,
@@ -75,26 +116,206 @@ acpi_ns_repair_object(struct acpi_predefined_data *data,
 {
 	union acpi_operand_object *return_object = *return_object_ptr;
 	union acpi_operand_object *new_object;
-	acpi_size length;
+	acpi_status status;
+
+	ACPI_FUNCTION_NAME(ns_repair_object);
+
+	/*
+	 * At this point, we know that the type of the returned object was not
+	 * one of the expected types for this predefined name. Attempt to
+	 * repair the object by converting it to one of the expected object
+	 * types for this predefined name.
+	 */
+	if (expected_btypes & ACPI_RTYPE_INTEGER) {
+		status = acpi_ns_convert_to_integer(return_object, &new_object);
+		if (ACPI_SUCCESS(status)) {
+			goto object_repaired;
+		}
+	}
+	if (expected_btypes & ACPI_RTYPE_STRING) {
+		status = acpi_ns_convert_to_string(return_object, &new_object);
+		if (ACPI_SUCCESS(status)) {
+			goto object_repaired;
+		}
+	}
+	if (expected_btypes & ACPI_RTYPE_BUFFER) {
+		status = acpi_ns_convert_to_buffer(return_object, &new_object);
+		if (ACPI_SUCCESS(status)) {
+			goto object_repaired;
+		}
+	}
+	if (expected_btypes & ACPI_RTYPE_PACKAGE) {
+		status = acpi_ns_convert_to_package(return_object, &new_object);
+		if (ACPI_SUCCESS(status)) {
+			goto object_repaired;
+		}
+	}
+
+	/* We cannot repair this object */
+
+	return (AE_AML_OPERAND_TYPE);
+
+      object_repaired:
+
+	/* Object was successfully repaired */
+
+	/*
+	 * If the original object is a package element, we need to:
+	 * 1. Set the reference count of the new object to match the
+	 *    reference count of the old object.
+	 * 2. Decrement the reference count of the original object.
+	 */
+	if (package_index != ACPI_NOT_PACKAGE_ELEMENT) {
+		new_object->common.reference_count =
+		    return_object->common.reference_count;
+
+		if (return_object->common.reference_count > 1) {
+			return_object->common.reference_count--;
+		}
+
+		ACPI_DEBUG_PRINT((ACPI_DB_REPAIR,
+				  "%s: Converted %s to expected %s at index %u\n",
+				  data->pathname,
+				  acpi_ut_get_object_type_name(return_object),
+				  acpi_ut_get_object_type_name(new_object),
+				  package_index));
+	} else {
+		ACPI_DEBUG_PRINT((ACPI_DB_REPAIR,
+				  "%s: Converted %s to expected %s\n",
+				  data->pathname,
+				  acpi_ut_get_object_type_name(return_object),
+				  acpi_ut_get_object_type_name(new_object)));
+	}
+
+	/* Delete old object, install the new return object */
+
+	acpi_ut_remove_reference(return_object);
+	*return_object_ptr = new_object;
+	data->flags |= ACPI_OBJECT_REPAIRED;
+	return (AE_OK);
+}
+
+/*******************************************************************************
+ *
+ * FUNCTION:    acpi_ns_convert_to_integer
+ *
+ * PARAMETERS:  original_object     - Object to be converted
+ *              return_object       - Where the new converted object is returned
+ *
+ * RETURN:      Status. AE_OK if conversion was successful.
+ *
+ * DESCRIPTION: Attempt to convert a String/Buffer object to an Integer.
+ *
+ ******************************************************************************/
+
+static acpi_status
+acpi_ns_convert_to_integer(union acpi_operand_object *original_object,
+			   union acpi_operand_object **return_object)
+{
+	union acpi_operand_object *new_object;
+	acpi_status status;
+	u64 value = 0;
+	u32 i;
+
+	switch (original_object->common.type) {
+	case ACPI_TYPE_STRING:
+
+		/* String-to-Integer conversion */
+
+		status = acpi_ut_strtoul64(original_object->string.pointer,
+					   ACPI_ANY_BASE, &value);
+		if (ACPI_FAILURE(status)) {
+			return (status);
+		}
+		break;
 
-	switch (return_object->common.type) {
 	case ACPI_TYPE_BUFFER:
 
-		/* Does the method/object legally return a string? */
+		/* Buffer-to-Integer conversion. Max buffer size is 64 bits. */
 
-		if (!(expected_btypes & ACPI_RTYPE_STRING)) {
+		if (original_object->buffer.length > 8) {
 			return (AE_AML_OPERAND_TYPE);
 		}
 
+		/* Extract each buffer byte to create the integer */
+
+		for (i = 0; i < original_object->buffer.length; i++) {
+			value |=
+			    ((u64) original_object->buffer.
+			     pointer[i] << (i * 8));
+		}
+		break;
+
+	default:
+		return (AE_AML_OPERAND_TYPE);
+	}
+
+	new_object = acpi_ut_create_integer_object(value);
+	if (!new_object) {
+		return (AE_NO_MEMORY);
+	}
+
+	*return_object = new_object;
+	return (AE_OK);
+}
+
+/*******************************************************************************
+ *
+ * FUNCTION:    acpi_ns_convert_to_string
+ *
+ * PARAMETERS:  original_object     - Object to be converted
+ *              return_object       - Where the new converted object is returned
+ *
+ * RETURN:      Status. AE_OK if conversion was successful.
+ *
+ * DESCRIPTION: Attempt to convert a Integer/Buffer object to a String.
+ *
+ ******************************************************************************/
+
+static acpi_status
+acpi_ns_convert_to_string(union acpi_operand_object *original_object,
+			  union acpi_operand_object **return_object)
+{
+	union acpi_operand_object *new_object;
+	acpi_size length;
+	acpi_status status;
+
+	switch (original_object->common.type) {
+	case ACPI_TYPE_INTEGER:
+		/*
+		 * Integer-to-String conversion. Commonly, convert
+		 * an integer of value 0 to a NULL string. The last element of
+		 * _BIF and _BIX packages occasionally need this fix.
+		 */
+		if (original_object->integer.value == 0) {
+
+			/* Allocate a new NULL string object */
+
+			new_object = acpi_ut_create_string_object(0);
+			if (!new_object) {
+				return (AE_NO_MEMORY);
+			}
+		} else {
+			status =
+			    acpi_ex_convert_to_string(original_object,
+						      &new_object,
+						      ACPI_IMPLICIT_CONVERT_HEX);
+			if (ACPI_FAILURE(status)) {
+				return (status);
+			}
+		}
+		break;
+
+	case ACPI_TYPE_BUFFER:
 		/*
-		 * Have a Buffer, expected a String, convert. Use a to_string
+		 * Buffer-to-String conversion. Use a to_string
 		 * conversion, no transform performed on the buffer data. The best
 		 * example of this is the _BIF method, where the string data from
 		 * the battery is often (incorrectly) returned as buffer object(s).
 		 */
 		length = 0;
-		while ((length < return_object->buffer.length) &&
-		       (return_object->buffer.pointer[length])) {
+		while ((length < original_object->buffer.length) &&
+		       (original_object->buffer.pointer[length])) {
 			length++;
 		}
 
@@ -110,44 +331,177 @@ acpi_ns_repair_object(struct acpi_predefined_data *data,
 		 * terminated at Length+1.
 		 */
 		ACPI_MEMCPY(new_object->string.pointer,
-			    return_object->buffer.pointer, length);
+			    original_object->buffer.pointer, length);
+		break;
+
+	default:
+		return (AE_AML_OPERAND_TYPE);
+	}
+
+	*return_object = new_object;
+	return (AE_OK);
+}
+
+/*******************************************************************************
+ *
+ * FUNCTION:    acpi_ns_convert_to_buffer
+ *
+ * PARAMETERS:  original_object     - Object to be converted
+ *              return_object       - Where the new converted object is returned
+ *
+ * RETURN:      Status. AE_OK if conversion was successful.
+ *
+ * DESCRIPTION: Attempt to convert a Integer/String/Package object to a Buffer.
+ *
+ ******************************************************************************/
 
+static acpi_status
+acpi_ns_convert_to_buffer(union acpi_operand_object *original_object,
+			  union acpi_operand_object **return_object)
+{
+	union acpi_operand_object *new_object;
+	acpi_status status;
+	union acpi_operand_object **elements;
+	u32 *dword_buffer;
+	u32 count;
+	u32 i;
+
+	switch (original_object->common.type) {
+	case ACPI_TYPE_INTEGER:
 		/*
-		 * If the original object is a package element, we need to:
-		 * 1. Set the reference count of the new object to match the
-		 *    reference count of the old object.
-		 * 2. Decrement the reference count of the original object.
+		 * Integer-to-Buffer conversion.
+		 * Convert the Integer to a packed-byte buffer. _MAT and other
+		 * objects need this sometimes, if a read has been performed on a
+		 * Field object that is less than or equal to the global integer
+		 * size (32 or 64 bits).
 		 */
-		if (package_index != ACPI_NOT_PACKAGE_ELEMENT) {
-			new_object->common.reference_count =
-			    return_object->common.reference_count;
+		status =
+		    acpi_ex_convert_to_buffer(original_object, &new_object);
+		if (ACPI_FAILURE(status)) {
+			return (status);
+		}
+		break;
+
+	case ACPI_TYPE_STRING:
+
+		/* String-to-Buffer conversion. Simple data copy */
+
+		new_object =
+		    acpi_ut_create_buffer_object(original_object->string.
+						 length);
+		if (!new_object) {
+			return (AE_NO_MEMORY);
+		}
+
+		ACPI_MEMCPY(new_object->buffer.pointer,
+			    original_object->string.pointer,
+			    original_object->string.length);
+		break;
+
+	case ACPI_TYPE_PACKAGE:
+		/*
+		 * This case is often seen for predefined names that must return a
+		 * Buffer object with multiple DWORD integers within. For example,
+		 * _FDE and _GTM. The Package can be converted to a Buffer.
+		 */
+
+		/* All elements of the Package must be integers */
 
-			if (return_object->common.reference_count > 1) {
-				return_object->common.reference_count--;
+		elements = original_object->package.elements;
+		count = original_object->package.count;
+
+		for (i = 0; i < count; i++) {
+			if ((!*elements) ||
+			    ((*elements)->common.type != ACPI_TYPE_INTEGER)) {
+				return (AE_AML_OPERAND_TYPE);
 			}
+			elements++;
+		}
 
-			ACPI_WARN_PREDEFINED((AE_INFO, data->pathname,
-					      data->node_flags,
-					      "Converted Buffer to expected String at index %u",
-					      package_index));
-		} else {
-			ACPI_WARN_PREDEFINED((AE_INFO, data->pathname,
-					      data->node_flags,
-					      "Converted Buffer to expected String"));
+		/* Create the new buffer object to replace the Package */
+
+		new_object = acpi_ut_create_buffer_object(ACPI_MUL_4(count));
+		if (!new_object) {
+			return (AE_NO_MEMORY);
 		}
 
-		/* Delete old object, install the new return object */
+		/* Copy the package elements (integers) to the buffer as DWORDs */
 
-		acpi_ut_remove_reference(return_object);
-		*return_object_ptr = new_object;
-		data->flags |= ACPI_OBJECT_REPAIRED;
-		return (AE_OK);
+		elements = original_object->package.elements;
+		dword_buffer = ACPI_CAST_PTR(u32, new_object->buffer.pointer);
+
+		for (i = 0; i < count; i++) {
+			*dword_buffer = (u32) (*elements)->integer.value;
+			dword_buffer++;
+			elements++;
+		}
+		break;
 
 	default:
+		return (AE_AML_OPERAND_TYPE);
+	}
+
+	*return_object = new_object;
+	return (AE_OK);
+}
+
+/*******************************************************************************
+ *
+ * FUNCTION:    acpi_ns_convert_to_package
+ *
+ * PARAMETERS:  original_object     - Object to be converted
+ *              return_object       - Where the new converted object is returned
+ *
+ * RETURN:      Status. AE_OK if conversion was successful.
+ *
+ * DESCRIPTION: Attempt to convert a Buffer object to a Package. Each byte of
+ *              the buffer is converted to a single integer package element.
+ *
+ ******************************************************************************/
+
+static acpi_status
+acpi_ns_convert_to_package(union acpi_operand_object *original_object,
+			   union acpi_operand_object **return_object)
+{
+	union acpi_operand_object *new_object;
+	union acpi_operand_object **elements;
+	u32 length;
+	u8 *buffer;
+
+	switch (original_object->common.type) {
+	case ACPI_TYPE_BUFFER:
+
+		/* Buffer-to-Package conversion */
+
+		length = original_object->buffer.length;
+		new_object = acpi_ut_create_package_object(length);
+		if (!new_object) {
+			return (AE_NO_MEMORY);
+		}
+
+		/* Convert each buffer byte to an integer package element */
+
+		elements = new_object->package.elements;
+		buffer = original_object->buffer.pointer;
+
+		while (length--) {
+			*elements =
+			    acpi_ut_create_integer_object((u64) *buffer);
+			if (!*elements) {
+				acpi_ut_remove_reference(new_object);
+				return (AE_NO_MEMORY);
+			}
+			elements++;
+			buffer++;
+		}
 		break;
+
+	default:
+		return (AE_AML_OPERAND_TYPE);
 	}
 
-	return (AE_AML_OPERAND_TYPE);
+	*return_object = new_object;
+	return (AE_OK);
 }
 
 /*******************************************************************************
@@ -180,6 +534,8 @@ acpi_ns_repair_package_list(struct acpi_predefined_data *data,
 {
 	union acpi_operand_object *pkg_obj_desc;
 
+	ACPI_FUNCTION_NAME(ns_repair_package_list);
+
 	/*
 	 * Create the new outer package and populate it. The new package will
 	 * have a single element, the lone subpackage.
@@ -196,8 +552,9 @@ acpi_ns_repair_package_list(struct acpi_predefined_data *data,
 	*obj_desc_ptr = pkg_obj_desc;
 	data->flags |= ACPI_OBJECT_REPAIRED;
 
-	ACPI_WARN_PREDEFINED((AE_INFO, data->pathname, data->node_flags,
-			      "Incorrectly formed Package, attempting repair"));
+	ACPI_DEBUG_PRINT((ACPI_DB_REPAIR,
+			  "%s: Repaired incorrectly formed Package\n",
+			  data->pathname));
 
 	return (AE_OK);
 }
diff --git a/drivers/acpi/acpica/nsrepair2.c b/drivers/acpi/acpica/nsrepair2.c
new file mode 100644
index 000000000000..f13691c1cca5
--- /dev/null
+++ b/drivers/acpi/acpica/nsrepair2.c
@@ -0,0 +1,657 @@
+/******************************************************************************
+ *
+ * Module Name: nsrepair2 - Repair for objects returned by specific
+ *                          predefined methods
+ *
+ *****************************************************************************/
+
+/*
+ * Copyright (C) 2000 - 2009, Intel Corp.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include <acpi/acpi.h>
+#include "accommon.h"
+#include "acnamesp.h"
+#include "acpredef.h"
+
+#define _COMPONENT          ACPI_NAMESPACE
+ACPI_MODULE_NAME("nsrepair2")
+
+/*
+ * Information structure and handler for ACPI predefined names that can
+ * be repaired on a per-name basis.
+ */
+typedef
+acpi_status(*acpi_repair_function) (struct acpi_predefined_data *data,
+				    union acpi_operand_object **return_object_ptr);
+
+typedef struct acpi_repair_info {
+	char name[ACPI_NAME_SIZE];
+	acpi_repair_function repair_function;
+
+} acpi_repair_info;
+
+/* Local prototypes */
+
+static const struct acpi_repair_info *acpi_ns_match_repairable_name(struct
+								    acpi_namespace_node
+								    *node);
+
+static acpi_status
+acpi_ns_repair_ALR(struct acpi_predefined_data *data,
+		   union acpi_operand_object **return_object_ptr);
+
+static acpi_status
+acpi_ns_repair_FDE(struct acpi_predefined_data *data,
+		   union acpi_operand_object **return_object_ptr);
+
+static acpi_status
+acpi_ns_repair_PSS(struct acpi_predefined_data *data,
+		   union acpi_operand_object **return_object_ptr);
+
+static acpi_status
+acpi_ns_repair_TSS(struct acpi_predefined_data *data,
+		   union acpi_operand_object **return_object_ptr);
+
+static acpi_status
+acpi_ns_check_sorted_list(struct acpi_predefined_data *data,
+			  union acpi_operand_object *return_object,
+			  u32 expected_count,
+			  u32 sort_index,
+			  u8 sort_direction, char *sort_key_name);
+
+static acpi_status
+acpi_ns_sort_list(union acpi_operand_object **elements,
+		  u32 count, u32 index, u8 sort_direction);
+
+/* Values for sort_direction above */
+
+#define ACPI_SORT_ASCENDING     0
+#define ACPI_SORT_DESCENDING    1
+
+/*
+ * This table contains the names of the predefined methods for which we can
+ * perform more complex repairs.
+ *
+ * As necessary:
+ *
+ * _ALR: Sort the list ascending by ambient_illuminance
+ * _FDE: Convert Buffer of BYTEs to a Buffer of DWORDs
+ * _GTM: Convert Buffer of BYTEs to a Buffer of DWORDs
+ * _PSS: Sort the list descending by Power
+ * _TSS: Sort the list descending by Power
+ */
+static const struct acpi_repair_info acpi_ns_repairable_names[] = {
+	{"_ALR", acpi_ns_repair_ALR},
+	{"_FDE", acpi_ns_repair_FDE},
+	{"_GTM", acpi_ns_repair_FDE},	/* _GTM has same repair as _FDE */
+	{"_PSS", acpi_ns_repair_PSS},
+	{"_TSS", acpi_ns_repair_TSS},
+	{{0, 0, 0, 0}, NULL}	/* Table terminator */
+};
+
+#define ACPI_FDE_FIELD_COUNT        5
+#define ACPI_FDE_BYTE_BUFFER_SIZE   5
+#define ACPI_FDE_DWORD_BUFFER_SIZE  (ACPI_FDE_FIELD_COUNT * sizeof (u32))
+
+/******************************************************************************
+ *
+ * FUNCTION:    acpi_ns_complex_repairs
+ *
+ * PARAMETERS:  Data                - Pointer to validation data structure
+ *              Node                - Namespace node for the method/object
+ *              validate_status     - Original status of earlier validation
+ *              return_object_ptr   - Pointer to the object returned from the
+ *                                    evaluation of a method or object
+ *
+ * RETURN:      Status. AE_OK if repair was successful. If name is not
+ *              matched, validate_status is returned.
+ *
+ * DESCRIPTION: Attempt to repair/convert a return object of a type that was
+ *              not expected.
+ *
+ *****************************************************************************/
+
+acpi_status
+acpi_ns_complex_repairs(struct acpi_predefined_data *data,
+			struct acpi_namespace_node *node,
+			acpi_status validate_status,
+			union acpi_operand_object **return_object_ptr)
+{
+	const struct acpi_repair_info *predefined;
+	acpi_status status;
+
+	/* Check if this name is in the list of repairable names */
+
+	predefined = acpi_ns_match_repairable_name(node);
+	if (!predefined) {
+		return (validate_status);
+	}
+
+	status = predefined->repair_function(data, return_object_ptr);
+	return (status);
+}
+
+/******************************************************************************
+ *
+ * FUNCTION:    acpi_ns_match_repairable_name
+ *
+ * PARAMETERS:  Node                - Namespace node for the method/object
+ *
+ * RETURN:      Pointer to entry in repair table. NULL indicates not found.
+ *
+ * DESCRIPTION: Check an object name against the repairable object list.
+ *
+ *****************************************************************************/
+
+static const struct acpi_repair_info *acpi_ns_match_repairable_name(struct
+								    acpi_namespace_node
+								    *node)
+{
+	const struct acpi_repair_info *this_name;
+
+	/* Search info table for a repairable predefined method/object name */
+
+	this_name = acpi_ns_repairable_names;
+	while (this_name->repair_function) {
+		if (ACPI_COMPARE_NAME(node->name.ascii, this_name->name)) {
+			return (this_name);
+		}
+		this_name++;
+	}
+
+	return (NULL);		/* Not found */
+}
+
+/******************************************************************************
+ *
+ * FUNCTION:    acpi_ns_repair_ALR
+ *
+ * PARAMETERS:  Data                - Pointer to validation data structure
+ *              return_object_ptr   - Pointer to the object returned from the
+ *                                    evaluation of a method or object
+ *
+ * RETURN:      Status. AE_OK if object is OK or was repaired successfully
+ *
+ * DESCRIPTION: Repair for the _ALR object. If necessary, sort the object list
+ *              ascending by the ambient illuminance values.
+ *
+ *****************************************************************************/
+
+static acpi_status
+acpi_ns_repair_ALR(struct acpi_predefined_data *data,
+		   union acpi_operand_object **return_object_ptr)
+{
+	union acpi_operand_object *return_object = *return_object_ptr;
+	acpi_status status;
+
+	status = acpi_ns_check_sorted_list(data, return_object, 2, 1,
+					   ACPI_SORT_ASCENDING,
+					   "AmbientIlluminance");
+
+	return (status);
+}
+
+/******************************************************************************
+ *
+ * FUNCTION:    acpi_ns_repair_FDE
+ *
+ * PARAMETERS:  Data                - Pointer to validation data structure
+ *              return_object_ptr   - Pointer to the object returned from the
+ *                                    evaluation of a method or object
+ *
+ * RETURN:      Status. AE_OK if object is OK or was repaired successfully
+ *
+ * DESCRIPTION: Repair for the _FDE and _GTM objects. The expected return
+ *              value is a Buffer of 5 DWORDs. This function repairs a common
+ *              problem where the return value is a Buffer of BYTEs, not
+ *              DWORDs.
+ *
+ *****************************************************************************/
+
+static acpi_status
+acpi_ns_repair_FDE(struct acpi_predefined_data *data,
+		   union acpi_operand_object **return_object_ptr)
+{
+	union acpi_operand_object *return_object = *return_object_ptr;
+	union acpi_operand_object *buffer_object;
+	u8 *byte_buffer;
+	u32 *dword_buffer;
+	u32 i;
+
+	ACPI_FUNCTION_NAME(ns_repair_FDE);
+
+	switch (return_object->common.type) {
+	case ACPI_TYPE_BUFFER:
+
+		/* This is the expected type. Length should be (at least) 5 DWORDs */
+
+		if (return_object->buffer.length >= ACPI_FDE_DWORD_BUFFER_SIZE) {
+			return (AE_OK);
+		}
+
+		/* We can only repair if we have exactly 5 BYTEs */
+
+		if (return_object->buffer.length != ACPI_FDE_BYTE_BUFFER_SIZE) {
+			ACPI_WARN_PREDEFINED((AE_INFO, data->pathname,
+					      data->node_flags,
+					      "Incorrect return buffer length %u, expected %u",
+					      return_object->buffer.length,
+					      ACPI_FDE_DWORD_BUFFER_SIZE));
+
+			return (AE_AML_OPERAND_TYPE);
+		}
+
+		/* Create the new (larger) buffer object */
+
+		buffer_object =
+		    acpi_ut_create_buffer_object(ACPI_FDE_DWORD_BUFFER_SIZE);
+		if (!buffer_object) {
+			return (AE_NO_MEMORY);
+		}
+
+		/* Expand each byte to a DWORD */
+
+		byte_buffer = return_object->buffer.pointer;
+		dword_buffer =
+		    ACPI_CAST_PTR(u32, buffer_object->buffer.pointer);
+
+		for (i = 0; i < ACPI_FDE_FIELD_COUNT; i++) {
+			*dword_buffer = (u32) *byte_buffer;
+			dword_buffer++;
+			byte_buffer++;
+		}
+
+		ACPI_DEBUG_PRINT((ACPI_DB_REPAIR,
+				  "%s Expanded Byte Buffer to expected DWord Buffer\n",
+				  data->pathname));
+		break;
+
+	default:
+		return (AE_AML_OPERAND_TYPE);
+	}
+
+	/* Delete the original return object, return the new buffer object */
+
+	acpi_ut_remove_reference(return_object);
+	*return_object_ptr = buffer_object;
+
+	data->flags |= ACPI_OBJECT_REPAIRED;
+	return (AE_OK);
+}
+
+/******************************************************************************
+ *
+ * FUNCTION:    acpi_ns_repair_TSS
+ *
+ * PARAMETERS:  Data                - Pointer to validation data structure
+ *              return_object_ptr   - Pointer to the object returned from the
+ *                                    evaluation of a method or object
+ *
+ * RETURN:      Status. AE_OK if object is OK or was repaired successfully
+ *
+ * DESCRIPTION: Repair for the _TSS object. If necessary, sort the object list
+ *              descending by the power dissipation values.
+ *
+ *****************************************************************************/
+
+static acpi_status
+acpi_ns_repair_TSS(struct acpi_predefined_data *data,
+		   union acpi_operand_object **return_object_ptr)
+{
+	union acpi_operand_object *return_object = *return_object_ptr;
+	acpi_status status;
+
+	status = acpi_ns_check_sorted_list(data, return_object, 5, 1,
+					   ACPI_SORT_DESCENDING,
+					   "PowerDissipation");
+
+	return (status);
+}
+
+/******************************************************************************
+ *
+ * FUNCTION:    acpi_ns_repair_PSS
+ *
+ * PARAMETERS:  Data                - Pointer to validation data structure
+ *              return_object_ptr   - Pointer to the object returned from the
+ *                                    evaluation of a method or object
+ *
+ * RETURN:      Status. AE_OK if object is OK or was repaired successfully
+ *
+ * DESCRIPTION: Repair for the _PSS object. If necessary, sort the object list
+ *              by the CPU frequencies. Check that the power dissipation values
+ *              are all proportional to CPU frequency (i.e., sorting by
+ *              frequency should be the same as sorting by power.)
+ *
+ *****************************************************************************/
+
+static acpi_status
+acpi_ns_repair_PSS(struct acpi_predefined_data *data,
+		   union acpi_operand_object **return_object_ptr)
+{
+	union acpi_operand_object *return_object = *return_object_ptr;
+	union acpi_operand_object **outer_elements;
+	u32 outer_element_count;
+	union acpi_operand_object **elements;
+	union acpi_operand_object *obj_desc;
+	u32 previous_value;
+	acpi_status status;
+	u32 i;
+
+	/*
+	 * Entries (sub-packages) in the _PSS Package must be sorted by power
+	 * dissipation, in descending order. If it appears that the list is
+	 * incorrectly sorted, sort it. We sort by cpu_frequency, since this
+	 * should be proportional to the power.
+	 */
+	status = acpi_ns_check_sorted_list(data, return_object, 6, 0,
+					   ACPI_SORT_DESCENDING,
+					   "CpuFrequency");
+	if (ACPI_FAILURE(status)) {
+		return (status);
+	}
+
+	/*
+	 * We now know the list is correctly sorted by CPU frequency. Check if
+	 * the power dissipation values are proportional.
+	 */
+	previous_value = ACPI_UINT32_MAX;
+	outer_elements = return_object->package.elements;
+	outer_element_count = return_object->package.count;
+
+	for (i = 0; i < outer_element_count; i++) {
+		elements = (*outer_elements)->package.elements;
+		obj_desc = elements[1];	/* Index1 = power_dissipation */
+
+		if ((u32) obj_desc->integer.value > previous_value) {
+			ACPI_WARN_PREDEFINED((AE_INFO, data->pathname,
+					      data->node_flags,
+					      "SubPackage[%u,%u] - suspicious power dissipation values",
+					      i - 1, i));
+		}
+
+		previous_value = (u32) obj_desc->integer.value;
+		outer_elements++;
+	}
+
+	return (AE_OK);
+}
+
+/******************************************************************************
+ *
+ * FUNCTION:    acpi_ns_check_sorted_list
+ *
+ * PARAMETERS:  Data                - Pointer to validation data structure
+ *              return_object       - Pointer to the top-level returned object
+ *              expected_count      - Minimum length of each sub-package
+ *              sort_index          - Sub-package entry to sort on
+ *              sort_direction      - Ascending or descending
+ *              sort_key_name       - Name of the sort_index field
+ *
+ * RETURN:      Status. AE_OK if the list is valid and is sorted correctly or
+ *              has been repaired by sorting the list.
+ *
+ * DESCRIPTION: Check if the package list is valid and sorted correctly by the
+ *              sort_index. If not, then sort the list.
+ *
+ *****************************************************************************/
+
+static acpi_status
+acpi_ns_check_sorted_list(struct acpi_predefined_data *data,
+			  union acpi_operand_object *return_object,
+			  u32 expected_count,
+			  u32 sort_index,
+			  u8 sort_direction, char *sort_key_name)
+{
+	u32 outer_element_count;
+	union acpi_operand_object **outer_elements;
+	union acpi_operand_object **elements;
+	union acpi_operand_object *obj_desc;
+	u32 i;
+	u32 previous_value;
+	acpi_status status;
+
+	ACPI_FUNCTION_NAME(ns_check_sorted_list);
+
+	/* The top-level object must be a package */
+
+	if (return_object->common.type != ACPI_TYPE_PACKAGE) {
+		return (AE_AML_OPERAND_TYPE);
+	}
+
+	/*
+	 * NOTE: assumes list of sub-packages contains no NULL elements.
+	 * Any NULL elements should have been removed by earlier call
+	 * to acpi_ns_remove_null_elements.
+	 */
+	outer_elements = return_object->package.elements;
+	outer_element_count = return_object->package.count;
+	if (!outer_element_count) {
+		return (AE_AML_PACKAGE_LIMIT);
+	}
+
+	previous_value = 0;
+	if (sort_direction == ACPI_SORT_DESCENDING) {
+		previous_value = ACPI_UINT32_MAX;
+	}
+
+	/* Examine each subpackage */
+
+	for (i = 0; i < outer_element_count; i++) {
+
+		/* Each element of the top-level package must also be a package */
+
+		if ((*outer_elements)->common.type != ACPI_TYPE_PACKAGE) {
+			return (AE_AML_OPERAND_TYPE);
+		}
+
+		/* Each sub-package must have the minimum length */
+
+		if ((*outer_elements)->package.count < expected_count) {
+			return (AE_AML_PACKAGE_LIMIT);
+		}
+
+		elements = (*outer_elements)->package.elements;
+		obj_desc = elements[sort_index];
+
+		if (obj_desc->common.type != ACPI_TYPE_INTEGER) {
+			return (AE_AML_OPERAND_TYPE);
+		}
+
+		/*
+		 * The list must be sorted in the specified order. If we detect a
+		 * discrepancy, issue a warning and sort the entire list
+		 */
+		if (((sort_direction == ACPI_SORT_ASCENDING) &&
+		     (obj_desc->integer.value < previous_value)) ||
+		    ((sort_direction == ACPI_SORT_DESCENDING) &&
+		     (obj_desc->integer.value > previous_value))) {
+			status =
+			    acpi_ns_sort_list(return_object->package.elements,
+					      outer_element_count, sort_index,
+					      sort_direction);
+			if (ACPI_FAILURE(status)) {
+				return (status);
+			}
+
+			data->flags |= ACPI_OBJECT_REPAIRED;
+
+			ACPI_DEBUG_PRINT((ACPI_DB_REPAIR,
+					  "%s: Repaired unsorted list - now sorted by %s\n",
+					  data->pathname, sort_key_name));
+			return (AE_OK);
+		}
+
+		previous_value = (u32) obj_desc->integer.value;
+		outer_elements++;
+	}
+
+	return (AE_OK);
+}
+
+/******************************************************************************
+ *
+ * FUNCTION:    acpi_ns_remove_null_elements
+ *
+ * PARAMETERS:  Data                - Pointer to validation data structure
+ *              package_type        - An acpi_return_package_types value
+ *              obj_desc            - A Package object
+ *
+ * RETURN:      None.
+ *
+ * DESCRIPTION: Remove all NULL package elements from packages that contain
+ *              a variable number of sub-packages.
+ *
+ *****************************************************************************/
+
+void
+acpi_ns_remove_null_elements(struct acpi_predefined_data *data,
+			     u8 package_type,
+			     union acpi_operand_object *obj_desc)
+{
+	union acpi_operand_object **source;
+	union acpi_operand_object **dest;
+	u32 count;
+	u32 new_count;
+	u32 i;
+
+	ACPI_FUNCTION_NAME(ns_remove_null_elements);
+
+	/*
+	 * PTYPE1 packages contain no subpackages.
+	 * PTYPE2 packages contain a variable number of sub-packages. We can
+	 * safely remove all NULL elements from the PTYPE2 packages.
+	 */
+	switch (package_type) {
+	case ACPI_PTYPE1_FIXED:
+	case ACPI_PTYPE1_VAR:
+	case ACPI_PTYPE1_OPTION:
+		return;
+
+	case ACPI_PTYPE2:
+	case ACPI_PTYPE2_COUNT:
+	case ACPI_PTYPE2_PKG_COUNT:
+	case ACPI_PTYPE2_FIXED:
+	case ACPI_PTYPE2_MIN:
+	case ACPI_PTYPE2_REV_FIXED:
+		break;
+
+	default:
+		return;
+	}
+
+	count = obj_desc->package.count;
+	new_count = count;
+
+	source = obj_desc->package.elements;
+	dest = source;
+
+	/* Examine all elements of the package object, remove nulls */
+
+	for (i = 0; i < count; i++) {
+		if (!*source) {
+			new_count--;
+		} else {
+			*dest = *source;
+			dest++;
+		}
+		source++;
+	}
+
+	/* Update parent package if any null elements were removed */
+
+	if (new_count < count) {
+		ACPI_DEBUG_PRINT((ACPI_DB_REPAIR,
+				  "%s: Found and removed %u NULL elements\n",
+				  data->pathname, (count - new_count)));
+
+		/* NULL terminate list and update the package count */
+
+		*dest = NULL;
+		obj_desc->package.count = new_count;
+	}
+}
+
+/******************************************************************************
+ *
+ * FUNCTION:    acpi_ns_sort_list
+ *
+ * PARAMETERS:  Elements            - Package object element list
+ *              Count               - Element count for above
+ *              Index               - Sort by which package element
+ *              sort_direction      - Ascending or Descending sort
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Sort the objects that are in a package element list.
+ *
+ * NOTE: Assumes that all NULL elements have been removed from the package.
+ *
+ *****************************************************************************/
+
+static acpi_status
+acpi_ns_sort_list(union acpi_operand_object **elements,
+		  u32 count, u32 index, u8 sort_direction)
+{
+	union acpi_operand_object *obj_desc1;
+	union acpi_operand_object *obj_desc2;
+	union acpi_operand_object *temp_obj;
+	u32 i;
+	u32 j;
+
+	/* Simple bubble sort */
+
+	for (i = 1; i < count; i++) {
+		for (j = (count - 1); j >= i; j--) {
+			obj_desc1 = elements[j - 1]->package.elements[index];
+			obj_desc2 = elements[j]->package.elements[index];
+
+			if (((sort_direction == ACPI_SORT_ASCENDING) &&
+			     (obj_desc1->integer.value >
+			      obj_desc2->integer.value))
+			    || ((sort_direction == ACPI_SORT_DESCENDING)
+				&& (obj_desc1->integer.value <
+				    obj_desc2->integer.value))) {
+				temp_obj = elements[j - 1];
+				elements[j - 1] = elements[j];
+				elements[j] = temp_obj;
+			}
+		}
+	}
+
+	return (AE_OK);
+}
diff --git a/drivers/acpi/acpica/nsutils.c b/drivers/acpi/acpica/nsutils.c
index ea55ab4f9849..47d91e668a1b 100644
--- a/drivers/acpi/acpica/nsutils.c
+++ b/drivers/acpi/acpica/nsutils.c
@@ -671,24 +671,25 @@ acpi_ns_externalize_name(u32 internal_name_length,
 
 /*******************************************************************************
  *
- * FUNCTION:    acpi_ns_map_handle_to_node
+ * FUNCTION:    acpi_ns_validate_handle
  *
- * PARAMETERS:  Handle          - Handle to be converted to an Node
+ * PARAMETERS:  Handle          - Handle to be validated and typecast to a
+ *                                namespace node.
  *
- * RETURN:      A Name table entry pointer
+ * RETURN:      A pointer to a namespace node
  *
- * DESCRIPTION: Convert a namespace handle to a real Node
+ * DESCRIPTION: Convert a namespace handle to a namespace node. Handles special
+ *              cases for the root node.
  *
- * Note: Real integer handles would allow for more verification
+ * NOTE: Real integer handles would allow for more verification
  *       and keep all pointers within this subsystem - however this introduces
- *       more (and perhaps unnecessary) overhead.
- *
- * The current implemenation is basically a placeholder until such time comes
- * that it is needed.
+ *       more overhead and has not been necessary to this point. Drivers
+ *       holding handles are typically notified before a node becomes invalid
+ *       due to a table unload.
  *
  ******************************************************************************/
 
-struct acpi_namespace_node *acpi_ns_map_handle_to_node(acpi_handle handle)
+struct acpi_namespace_node *acpi_ns_validate_handle(acpi_handle handle)
 {
 
 	ACPI_FUNCTION_ENTRY();
@@ -710,42 +711,6 @@ struct acpi_namespace_node *acpi_ns_map_handle_to_node(acpi_handle handle)
 
 /*******************************************************************************
  *
- * FUNCTION:    acpi_ns_convert_entry_to_handle
- *
- * PARAMETERS:  Node          - Node to be converted to a Handle
- *
- * RETURN:      A user handle
- *
- * DESCRIPTION: Convert a real Node to a namespace handle
- *
- ******************************************************************************/
-
-acpi_handle acpi_ns_convert_entry_to_handle(struct acpi_namespace_node *node)
-{
-
-	/*
-	 * Simple implementation for now;
-	 */
-	return ((acpi_handle) node);
-
-/* Example future implementation ---------------------
-
-	if (!Node)
-	{
-		return (NULL);
-	}
-
-	if (Node == acpi_gbl_root_node)
-	{
-		return (ACPI_ROOT_OBJECT);
-	}
-
-	return ((acpi_handle) Node);
-------------------------------------------------------*/
-}
-
-/*******************************************************************************
- *
  * FUNCTION:    acpi_ns_terminate
  *
  * PARAMETERS:  none
diff --git a/drivers/acpi/acpica/nswalk.c b/drivers/acpi/acpica/nswalk.c
index 35539df5c75d..d7e6b52b4482 100644
--- a/drivers/acpi/acpica/nswalk.c
+++ b/drivers/acpi/acpica/nswalk.c
@@ -165,24 +165,27 @@ struct acpi_namespace_node *acpi_ns_get_next_node_typed(acpi_object_type type,
  *              max_depth           - Depth to which search is to reach
  *              Flags               - Whether to unlock the NS before invoking
  *                                    the callback routine
- *              user_function       - Called when an object of "Type" is found
- *              Context             - Passed to user function
- *              return_value        - from the user_function if terminated early.
- *                                    Otherwise, returns NULL.
+ *              pre_order_visit     - Called during tree pre-order visit
+ *                                    when an object of "Type" is found
+ *              post_order_visit    - Called during tree post-order visit
+ *                                    when an object of "Type" is found
+ *              Context             - Passed to user function(s) above
+ *              return_value        - from the user_function if terminated
+ *                                    early. Otherwise, returns NULL.
  * RETURNS:     Status
  *
  * DESCRIPTION: Performs a modified depth-first walk of the namespace tree,
  *              starting (and ending) at the node specified by start_handle.
- *              The user_function is called whenever a node that matches
- *              the type parameter is found.  If the user function returns
+ *              The callback function is called whenever a node that matches
+ *              the type parameter is found. If the callback function returns
  *              a non-zero value, the search is terminated immediately and
  *              this value is returned to the caller.
  *
  *              The point of this procedure is to provide a generic namespace
  *              walk routine that can be called from multiple places to
- *              provide multiple services;  the User Function can be tailored
- *              to each task, whether it is a print function, a compare
- *              function, etc.
+ *              provide multiple services; the callback function(s) can be
+ *              tailored to each task, whether it is a print function,
+ *              a compare function, etc.
  *
  ******************************************************************************/
 
@@ -191,7 +194,8 @@ acpi_ns_walk_namespace(acpi_object_type type,
 		       acpi_handle start_node,
 		       u32 max_depth,
 		       u32 flags,
-		       acpi_walk_callback user_function,
+		       acpi_walk_callback pre_order_visit,
+		       acpi_walk_callback post_order_visit,
 		       void *context, void **return_value)
 {
 	acpi_status status;
@@ -200,6 +204,7 @@ acpi_ns_walk_namespace(acpi_object_type type,
 	struct acpi_namespace_node *parent_node;
 	acpi_object_type child_type;
 	u32 level;
+	u8 node_previously_visited = FALSE;
 
 	ACPI_FUNCTION_TRACE(ns_walk_namespace);
 
@@ -212,7 +217,7 @@ acpi_ns_walk_namespace(acpi_object_type type,
 	/* Null child means "get first node" */
 
 	parent_node = start_node;
-	child_node = NULL;
+	child_node = acpi_ns_get_next_node(parent_node, NULL);
 	child_type = ACPI_TYPE_ANY;
 	level = 1;
 
@@ -221,102 +226,129 @@ acpi_ns_walk_namespace(acpi_object_type type,
 	 * started. When Level is zero, the loop is done because we have
 	 * bubbled up to (and passed) the original parent handle (start_entry)
 	 */
-	while (level > 0) {
+	while (level > 0 && child_node) {
+		status = AE_OK;
 
-		/* Get the next node in this scope.  Null if not found */
+		/* Found next child, get the type if we are not searching for ANY */
 
-		status = AE_OK;
-		child_node = acpi_ns_get_next_node(parent_node, child_node);
-		if (child_node) {
+		if (type != ACPI_TYPE_ANY) {
+			child_type = child_node->type;
+		}
 
-			/* Found next child, get the type if we are not searching for ANY */
+		/*
+		 * Ignore all temporary namespace nodes (created during control
+		 * method execution) unless told otherwise. These temporary nodes
+		 * can cause a race condition because they can be deleted during
+		 * the execution of the user function (if the namespace is
+		 * unlocked before invocation of the user function.) Only the
+		 * debugger namespace dump will examine the temporary nodes.
+		 */
+		if ((child_node->flags & ANOBJ_TEMPORARY) &&
+		    !(flags & ACPI_NS_WALK_TEMP_NODES)) {
+			status = AE_CTRL_DEPTH;
+		}
 
-			if (type != ACPI_TYPE_ANY) {
-				child_type = child_node->type;
-			}
+		/* Type must match requested type */
 
+		else if (child_type == type) {
 			/*
-			 * Ignore all temporary namespace nodes (created during control
-			 * method execution) unless told otherwise. These temporary nodes
-			 * can cause a race condition because they can be deleted during
-			 * the execution of the user function (if the namespace is
-			 * unlocked before invocation of the user function.) Only the
-			 * debugger namespace dump will examine the temporary nodes.
+			 * Found a matching node, invoke the user callback function.
+			 * Unlock the namespace if flag is set.
 			 */
-			if ((child_node->flags & ANOBJ_TEMPORARY) &&
-			    !(flags & ACPI_NS_WALK_TEMP_NODES)) {
-				status = AE_CTRL_DEPTH;
+			if (flags & ACPI_NS_WALK_UNLOCK) {
+				mutex_status =
+				    acpi_ut_release_mutex(ACPI_MTX_NAMESPACE);
+				if (ACPI_FAILURE(mutex_status)) {
+					return_ACPI_STATUS(mutex_status);
+				}
 			}
 
-			/* Type must match requested type */
-
-			else if (child_type == type) {
-				/*
-				 * Found a matching node, invoke the user callback function.
-				 * Unlock the namespace if flag is set.
-				 */
-				if (flags & ACPI_NS_WALK_UNLOCK) {
-					mutex_status =
-					    acpi_ut_release_mutex
-					    (ACPI_MTX_NAMESPACE);
-					if (ACPI_FAILURE(mutex_status)) {
-						return_ACPI_STATUS
-						    (mutex_status);
-					}
+			/*
+			 * Invoke the user function, either pre-order or post-order
+			 * or both.
+			 */
+			if (!node_previously_visited) {
+				if (pre_order_visit) {
+					status =
+					    pre_order_visit(child_node, level,
+							    context,
+							    return_value);
 				}
+			} else {
+				if (post_order_visit) {
+					status =
+					    post_order_visit(child_node, level,
+							     context,
+							     return_value);
+				}
+			}
 
-				status =
-				    user_function(child_node, level, context,
-						  return_value);
-
-				if (flags & ACPI_NS_WALK_UNLOCK) {
-					mutex_status =
-					    acpi_ut_acquire_mutex
-					    (ACPI_MTX_NAMESPACE);
-					if (ACPI_FAILURE(mutex_status)) {
-						return_ACPI_STATUS
-						    (mutex_status);
-					}
+			if (flags & ACPI_NS_WALK_UNLOCK) {
+				mutex_status =
+				    acpi_ut_acquire_mutex(ACPI_MTX_NAMESPACE);
+				if (ACPI_FAILURE(mutex_status)) {
+					return_ACPI_STATUS(mutex_status);
 				}
+			}
 
-				switch (status) {
-				case AE_OK:
-				case AE_CTRL_DEPTH:
+			switch (status) {
+			case AE_OK:
+			case AE_CTRL_DEPTH:
 
-					/* Just keep going */
-					break;
+				/* Just keep going */
+				break;
 
-				case AE_CTRL_TERMINATE:
+			case AE_CTRL_TERMINATE:
 
-					/* Exit now, with OK status */
+				/* Exit now, with OK status */
 
-					return_ACPI_STATUS(AE_OK);
+				return_ACPI_STATUS(AE_OK);
 
-				default:
+			default:
 
-					/* All others are valid exceptions */
+				/* All others are valid exceptions */
 
-					return_ACPI_STATUS(status);
-				}
+				return_ACPI_STATUS(status);
+			}
+		}
+
+		/*
+		 * Depth first search: Attempt to go down another level in the
+		 * namespace if we are allowed to.  Don't go any further if we have
+		 * reached the caller specified maximum depth or if the user
+		 * function has specified that the maximum depth has been reached.
+		 */
+		if (!node_previously_visited &&
+		    (level < max_depth) && (status != AE_CTRL_DEPTH)) {
+			if (child_node->child) {
+
+				/* There is at least one child of this node, visit it */
+
+				level++;
+				parent_node = child_node;
+				child_node =
+				    acpi_ns_get_next_node(parent_node, NULL);
+				continue;
 			}
+		}
 
-			/*
-			 * Depth first search: Attempt to go down another level in the
-			 * namespace if we are allowed to.  Don't go any further if we have
-			 * reached the caller specified maximum depth or if the user
-			 * function has specified that the maximum depth has been reached.
-			 */
-			if ((level < max_depth) && (status != AE_CTRL_DEPTH)) {
-				if (child_node->child) {
+		/* No more children, re-visit this node */
 
-					/* There is at least one child of this node, visit it */
+		if (!node_previously_visited) {
+			node_previously_visited = TRUE;
+			continue;
+		}
 
-					level++;
-					parent_node = child_node;
-					child_node = NULL;
-				}
-			}
-		} else {
+		/* No more children, visit peers */
+
+		child_node = acpi_ns_get_next_node(parent_node, child_node);
+		if (child_node) {
+			node_previously_visited = FALSE;
+		}
+
+		/* No peers, re-visit parent */
+
+		else {
 			/*
 			 * No more children of this node (acpi_ns_get_next_node failed), go
 			 * back upwards in the namespace tree to the node's parent.
@@ -324,6 +356,8 @@ acpi_ns_walk_namespace(acpi_object_type type,
 			level--;
 			child_node = parent_node;
 			parent_node = acpi_ns_get_parent_node(parent_node);
+
+			node_previously_visited = TRUE;
 		}
 	}
 
diff --git a/drivers/acpi/acpica/nsxfeval.c b/drivers/acpi/acpica/nsxfeval.c
index 4929dbdbc8f0..f0c0892bc7e5 100644
--- a/drivers/acpi/acpica/nsxfeval.c
+++ b/drivers/acpi/acpica/nsxfeval.c
@@ -190,7 +190,7 @@ acpi_evaluate_object(acpi_handle handle,
 
 	/* Convert and validate the device handle */
 
-	info->prefix_node = acpi_ns_map_handle_to_node(handle);
+	info->prefix_node = acpi_ns_validate_handle(handle);
 	if (!info->prefix_node) {
 		status = AE_BAD_PARAMETER;
 		goto cleanup;
@@ -433,8 +433,11 @@ static void acpi_ns_resolve_references(struct acpi_evaluate_info *info)
  * PARAMETERS:  Type                - acpi_object_type to search for
  *              start_object        - Handle in namespace where search begins
  *              max_depth           - Depth to which search is to reach
- *              user_function       - Called when an object of "Type" is found
- *              Context             - Passed to user function
+ *              pre_order_visit     - Called during tree pre-order visit
+ *                                    when an object of "Type" is found
+ *              post_order_visit    - Called during tree post-order visit
+ *                                    when an object of "Type" is found
+ *              Context             - Passed to user function(s) above
  *              return_value        - Location where return value of
  *                                    user_function is put if terminated early
  *
@@ -443,16 +446,16 @@ static void acpi_ns_resolve_references(struct acpi_evaluate_info *info)
  *
  * DESCRIPTION: Performs a modified depth-first walk of the namespace tree,
  *              starting (and ending) at the object specified by start_handle.
- *              The user_function is called whenever an object that matches
- *              the type parameter is found.  If the user function returns
+ *              The callback function is called whenever an object that matches
+ *              the type parameter is found. If the callback function returns
  *              a non-zero value, the search is terminated immediately and this
  *              value is returned to the caller.
  *
  *              The point of this procedure is to provide a generic namespace
  *              walk routine that can be called from multiple places to
- *              provide multiple services;  the User Function can be tailored
- *              to each task, whether it is a print function, a compare
- *              function, etc.
+ *              provide multiple services; the callback function(s) can be
+ *              tailored to each task, whether it is a print function,
+ *              a compare function, etc.
  *
  ******************************************************************************/
 
@@ -460,7 +463,8 @@ acpi_status
 acpi_walk_namespace(acpi_object_type type,
 		    acpi_handle start_object,
 		    u32 max_depth,
-		    acpi_walk_callback user_function,
+		    acpi_walk_callback pre_order_visit,
+		    acpi_walk_callback post_order_visit,
 		    void *context, void **return_value)
 {
 	acpi_status status;
@@ -469,7 +473,8 @@ acpi_walk_namespace(acpi_object_type type,
 
 	/* Parameter validation */
 
-	if ((type > ACPI_TYPE_LOCAL_MAX) || (!max_depth) || (!user_function)) {
+	if ((type > ACPI_TYPE_LOCAL_MAX) ||
+	    (!max_depth) || (!pre_order_visit && !post_order_visit)) {
 		return_ACPI_STATUS(AE_BAD_PARAMETER);
 	}
 
@@ -501,8 +506,9 @@ acpi_walk_namespace(acpi_object_type type,
 	}
 
 	status = acpi_ns_walk_namespace(type, start_object, max_depth,
-					ACPI_NS_WALK_UNLOCK, user_function,
-					context, return_value);
+					ACPI_NS_WALK_UNLOCK, pre_order_visit,
+					post_order_visit, context,
+					return_value);
 
 	(void)acpi_ut_release_mutex(ACPI_MTX_NAMESPACE);
 
@@ -546,7 +552,7 @@ acpi_ns_get_device_callback(acpi_handle obj_handle,
 		return (status);
 	}
 
-	node = acpi_ns_map_handle_to_node(obj_handle);
+	node = acpi_ns_validate_handle(obj_handle);
 	status = acpi_ut_release_mutex(ACPI_MTX_NAMESPACE);
 	if (ACPI_FAILURE(status)) {
 		return (status);
@@ -681,8 +687,8 @@ acpi_get_devices(const char *HID,
 
 	status = acpi_ns_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT,
 					ACPI_UINT32_MAX, ACPI_NS_WALK_UNLOCK,
-					acpi_ns_get_device_callback, &info,
-					return_value);
+					acpi_ns_get_device_callback, NULL,
+					&info, return_value);
 
 	(void)acpi_ut_release_mutex(ACPI_MTX_NAMESPACE);
 	return_ACPI_STATUS(status);
@@ -723,7 +729,7 @@ acpi_attach_data(acpi_handle obj_handle,
 
 	/* Convert and validate the handle */
 
-	node = acpi_ns_map_handle_to_node(obj_handle);
+	node = acpi_ns_validate_handle(obj_handle);
 	if (!node) {
 		status = AE_BAD_PARAMETER;
 		goto unlock_and_exit;
@@ -769,7 +775,7 @@ acpi_detach_data(acpi_handle obj_handle, acpi_object_handler handler)
 
 	/* Convert and validate the handle */
 
-	node = acpi_ns_map_handle_to_node(obj_handle);
+	node = acpi_ns_validate_handle(obj_handle);
 	if (!node) {
 		status = AE_BAD_PARAMETER;
 		goto unlock_and_exit;
@@ -816,7 +822,7 @@ acpi_get_data(acpi_handle obj_handle, acpi_object_handler handler, void **data)
 
 	/* Convert and validate the handle */
 
-	node = acpi_ns_map_handle_to_node(obj_handle);
+	node = acpi_ns_validate_handle(obj_handle);
 	if (!node) {
 		status = AE_BAD_PARAMETER;
 		goto unlock_and_exit;
diff --git a/drivers/acpi/acpica/nsxfname.c b/drivers/acpi/acpica/nsxfname.c
index ddc84af6336e..e611dd961b20 100644
--- a/drivers/acpi/acpica/nsxfname.c
+++ b/drivers/acpi/acpica/nsxfname.c
@@ -93,7 +93,7 @@ acpi_get_handle(acpi_handle parent,
 	/* Convert a parent handle to a prefix node */
 
 	if (parent) {
-		prefix_node = acpi_ns_map_handle_to_node(parent);
+		prefix_node = acpi_ns_validate_handle(parent);
 		if (!prefix_node) {
 			return (AE_BAD_PARAMETER);
 		}
@@ -114,7 +114,7 @@ acpi_get_handle(acpi_handle parent,
 
 		if (!ACPI_STRCMP(pathname, ACPI_NS_ROOT_PATH)) {
 			*ret_handle =
-			    acpi_ns_convert_entry_to_handle(acpi_gbl_root_node);
+			    ACPI_CAST_PTR(acpi_handle, acpi_gbl_root_node);
 			return (AE_OK);
 		}
 	} else if (!prefix_node) {
@@ -129,7 +129,7 @@ acpi_get_handle(acpi_handle parent,
 	status =
 	    acpi_ns_get_node(prefix_node, pathname, ACPI_NS_NO_UPSEARCH, &node);
 	if (ACPI_SUCCESS(status)) {
-		*ret_handle = acpi_ns_convert_entry_to_handle(node);
+		*ret_handle = ACPI_CAST_PTR(acpi_handle, node);
 	}
 
 	return (status);
@@ -186,7 +186,7 @@ acpi_get_name(acpi_handle handle, u32 name_type, struct acpi_buffer * buffer)
 		return (status);
 	}
 
-	node = acpi_ns_map_handle_to_node(handle);
+	node = acpi_ns_validate_handle(handle);
 	if (!node) {
 		status = AE_BAD_PARAMETER;
 		goto unlock_and_exit;
@@ -291,7 +291,7 @@ acpi_get_object_info(acpi_handle handle,
 		goto cleanup;
 	}
 
-	node = acpi_ns_map_handle_to_node(handle);
+	node = acpi_ns_validate_handle(handle);
 	if (!node) {
 		(void)acpi_ut_release_mutex(ACPI_MTX_NAMESPACE);
 		return (AE_BAD_PARAMETER);
diff --git a/drivers/acpi/acpica/nsxfobj.c b/drivers/acpi/acpica/nsxfobj.c
index 4071bad4458e..0cc6ba01a495 100644
--- a/drivers/acpi/acpica/nsxfobj.c
+++ b/drivers/acpi/acpica/nsxfobj.c
@@ -79,7 +79,7 @@ acpi_status acpi_get_id(acpi_handle handle, acpi_owner_id * ret_id)
 
 	/* Convert and validate the handle */
 
-	node = acpi_ns_map_handle_to_node(handle);
+	node = acpi_ns_validate_handle(handle);
 	if (!node) {
 		(void)acpi_ut_release_mutex(ACPI_MTX_NAMESPACE);
 		return (AE_BAD_PARAMETER);
@@ -132,7 +132,7 @@ acpi_status acpi_get_type(acpi_handle handle, acpi_object_type * ret_type)
 
 	/* Convert and validate the handle */
 
-	node = acpi_ns_map_handle_to_node(handle);
+	node = acpi_ns_validate_handle(handle);
 	if (!node) {
 		(void)acpi_ut_release_mutex(ACPI_MTX_NAMESPACE);
 		return (AE_BAD_PARAMETER);
@@ -182,7 +182,7 @@ acpi_status acpi_get_parent(acpi_handle handle, acpi_handle * ret_handle)
 
 	/* Convert and validate the handle */
 
-	node = acpi_ns_map_handle_to_node(handle);
+	node = acpi_ns_validate_handle(handle);
 	if (!node) {
 		status = AE_BAD_PARAMETER;
 		goto unlock_and_exit;
@@ -191,7 +191,7 @@ acpi_status acpi_get_parent(acpi_handle handle, acpi_handle * ret_handle)
 	/* Get the parent entry */
 
 	parent_node = acpi_ns_get_parent_node(node);
-	*ret_handle = acpi_ns_convert_entry_to_handle(parent_node);
+	*ret_handle = ACPI_CAST_PTR(acpi_handle, parent_node);
 
 	/* Return exception if parent is null */
 
@@ -251,7 +251,7 @@ acpi_get_next_object(acpi_object_type type,
 
 		/* Start search at the beginning of the specified scope */
 
-		parent_node = acpi_ns_map_handle_to_node(parent);
+		parent_node = acpi_ns_validate_handle(parent);
 		if (!parent_node) {
 			status = AE_BAD_PARAMETER;
 			goto unlock_and_exit;
@@ -260,7 +260,7 @@ acpi_get_next_object(acpi_object_type type,
 		/* Non-null handle, ignore the parent */
 		/* Convert and validate the handle */
 
-		child_node = acpi_ns_map_handle_to_node(child);
+		child_node = acpi_ns_validate_handle(child);
 		if (!child_node) {
 			status = AE_BAD_PARAMETER;
 			goto unlock_and_exit;
@@ -276,7 +276,7 @@ acpi_get_next_object(acpi_object_type type,
 	}
 
 	if (ret_handle) {
-		*ret_handle = acpi_ns_convert_entry_to_handle(node);
+		*ret_handle = ACPI_CAST_PTR(acpi_handle, node);
 	}
 
       unlock_and_exit:
diff --git a/drivers/acpi/acpica/psloop.c b/drivers/acpi/acpica/psloop.c
index cd7995b3aed4..0988e4a8901d 100644
--- a/drivers/acpi/acpica/psloop.c
+++ b/drivers/acpi/acpica/psloop.c
@@ -87,7 +87,8 @@ acpi_ps_complete_final_op(struct acpi_walk_state *walk_state,
 			  union acpi_parse_object *op, acpi_status status);
 
 static void
-acpi_ps_link_module_code(u8 *aml_start, u32 aml_length, acpi_owner_id owner_id);
+acpi_ps_link_module_code(union acpi_parse_object *parent_op,
+			 u8 *aml_start, u32 aml_length, acpi_owner_id owner_id);
 
 /*******************************************************************************
  *
@@ -479,11 +480,14 @@ acpi_ps_get_arguments(struct acpi_walk_state *walk_state,
 				 */
 				if (walk_state->pass_number ==
 				    ACPI_IMODE_LOAD_PASS1) {
-					acpi_ps_link_module_code(aml_op_start,
-								 walk_state->
+					acpi_ps_link_module_code(op->common.
+								 parent,
+								 aml_op_start,
+								 (u32)
+								 (walk_state->
 								 parser_state.
 								 pkg_end -
-								 aml_op_start,
+								 aml_op_start),
 								 walk_state->
 								 owner_id);
 				}
@@ -598,7 +602,8 @@ acpi_ps_get_arguments(struct acpi_walk_state *walk_state,
  *
  * FUNCTION:    acpi_ps_link_module_code
  *
- * PARAMETERS:  aml_start           - Pointer to the AML
+ * PARAMETERS:  parent_op           - Parent parser op
+ *              aml_start           - Pointer to the AML
  *              aml_length          - Length of executable AML
  *              owner_id            - owner_id of module level code
  *
@@ -611,11 +616,13 @@ acpi_ps_get_arguments(struct acpi_walk_state *walk_state,
  ******************************************************************************/
 
 static void
-acpi_ps_link_module_code(u8 *aml_start, u32 aml_length, acpi_owner_id owner_id)
+acpi_ps_link_module_code(union acpi_parse_object *parent_op,
+			 u8 *aml_start, u32 aml_length, acpi_owner_id owner_id)
 {
 	union acpi_operand_object *prev;
 	union acpi_operand_object *next;
 	union acpi_operand_object *method_obj;
+	struct acpi_namespace_node *parent_node;
 
 	/* Get the tail of the list */
 
@@ -639,11 +646,24 @@ acpi_ps_link_module_code(u8 *aml_start, u32 aml_length, acpi_owner_id owner_id)
 			return;
 		}
 
+		if (parent_op->common.node) {
+			parent_node = parent_op->common.node;
+		} else {
+			parent_node = acpi_gbl_root_node;
+		}
+
 		method_obj->method.aml_start = aml_start;
 		method_obj->method.aml_length = aml_length;
 		method_obj->method.owner_id = owner_id;
 		method_obj->method.flags |= AOPOBJ_MODULE_LEVEL;
 
+		/*
+		 * Save the parent node in next_object. This is cheating, but we
+		 * don't want to expand the method object.
+		 */
+		method_obj->method.next_object =
+		    ACPI_CAST_PTR(union acpi_operand_object, parent_node);
+
 		if (!prev) {
 			acpi_gbl_module_code_list = method_obj;
 		} else {
diff --git a/drivers/acpi/acpica/psparse.c b/drivers/acpi/acpica/psparse.c
index 70838e9b608c..4df8f139026c 100644
--- a/drivers/acpi/acpica/psparse.c
+++ b/drivers/acpi/acpica/psparse.c
@@ -610,17 +610,13 @@ acpi_status acpi_ps_parse_aml(struct acpi_walk_state *walk_state)
 					    implicit_return_obj) {
 						previous_walk_state->
 						    implicit_return_obj =
-						    acpi_ut_create_internal_object
-						    (ACPI_TYPE_INTEGER);
+						    acpi_ut_create_integer_object
+						    ((u64) 0);
 						if (!previous_walk_state->
 						    implicit_return_obj) {
 							return_ACPI_STATUS
 							    (AE_NO_MEMORY);
 						}
-
-						previous_walk_state->
-						    implicit_return_obj->
-						    integer.value = 0;
 					}
 
 					/* Restart the calling control method */
diff --git a/drivers/acpi/acpica/psxface.c b/drivers/acpi/acpica/psxface.c
index dd9731c29a79..d0c1b91eb8ca 100644
--- a/drivers/acpi/acpica/psxface.c
+++ b/drivers/acpi/acpica/psxface.c
@@ -287,7 +287,8 @@ acpi_status acpi_ps_execute_method(struct acpi_evaluate_info *info)
 	/* Invoke an internal method if necessary */
 
 	if (info->obj_desc->method.method_flags & AML_METHOD_INTERNAL_ONLY) {
-		status = info->obj_desc->method.implementation(walk_state);
+		status =
+		    info->obj_desc->method.extra.implementation(walk_state);
 		info->return_object = walk_state->return_desc;
 
 		/* Cleanup states */
@@ -306,14 +307,12 @@ acpi_status acpi_ps_execute_method(struct acpi_evaluate_info *info)
 	 */
 	if (acpi_gbl_enable_interpreter_slack) {
 		walk_state->implicit_return_obj =
-		    acpi_ut_create_internal_object(ACPI_TYPE_INTEGER);
+		    acpi_ut_create_integer_object((u64) 0);
 		if (!walk_state->implicit_return_obj) {
 			status = AE_NO_MEMORY;
 			acpi_ds_delete_walk_state(walk_state);
 			goto cleanup;
 		}
-
-		walk_state->implicit_return_obj->integer.value = 0;
 	}
 
 	/* Parse the AML */
diff --git a/drivers/acpi/acpica/rsxface.c b/drivers/acpi/acpica/rsxface.c
index 395212bcd19b..f27feb4772f6 100644
--- a/drivers/acpi/acpica/rsxface.c
+++ b/drivers/acpi/acpica/rsxface.c
@@ -104,7 +104,7 @@ acpi_rs_validate_parameters(acpi_handle device_handle,
 		return_ACPI_STATUS(AE_BAD_PARAMETER);
 	}
 
-	node = acpi_ns_map_handle_to_node(device_handle);
+	node = acpi_ns_validate_handle(device_handle);
 	if (!node) {
 		return_ACPI_STATUS(AE_BAD_PARAMETER);
 	}
diff --git a/drivers/acpi/acpica/utcopy.c b/drivers/acpi/acpica/utcopy.c
index 0f0c64bf8ac9..f857c5efb79f 100644
--- a/drivers/acpi/acpica/utcopy.c
+++ b/drivers/acpi/acpica/utcopy.c
@@ -323,11 +323,11 @@ acpi_ut_copy_ielement_to_eelement(u8 object_type,
  * RETURN:      Status
  *
  * DESCRIPTION: This function is called to place a package object in a user
- *              buffer.  A package object by definition contains other objects.
+ *              buffer. A package object by definition contains other objects.
  *
  *              The buffer is assumed to have sufficient space for the object.
- *              The caller must have verified the buffer length needed using the
- *              acpi_ut_get_object_size function before calling this function.
+ *              The caller must have verified the buffer length needed using
+ *              the acpi_ut_get_object_size function before calling this function.
  *
  ******************************************************************************/
 
@@ -382,12 +382,12 @@ acpi_ut_copy_ipackage_to_epackage(union acpi_operand_object *internal_object,
  * FUNCTION:    acpi_ut_copy_iobject_to_eobject
  *
  * PARAMETERS:  internal_object     - The internal object to be converted
- *              buffer_ptr          - Where the object is returned
+ *              ret_buffer          - Where the object is returned
  *
  * RETURN:      Status
  *
- * DESCRIPTION: This function is called to build an API object to be returned to
- *              the caller.
+ * DESCRIPTION: This function is called to build an API object to be returned
+ *              to the caller.
  *
  ******************************************************************************/
 
@@ -626,7 +626,7 @@ acpi_ut_copy_epackage_to_ipackage(union acpi_object *external_object,
  * PARAMETERS:  external_object     - The external object to be converted
  *              internal_object     - Where the internal object is returned
  *
- * RETURN:      Status              - the status of the call
+ * RETURN:      Status
  *
  * DESCRIPTION: Converts an external object to an internal object.
  *
@@ -665,7 +665,7 @@ acpi_ut_copy_eobject_to_iobject(union acpi_object *external_object,
  *
  * RETURN:      Status
  *
- * DESCRIPTION: Simple copy of one internal object to another.  Reference count
+ * DESCRIPTION: Simple copy of one internal object to another. Reference count
  *              of the destination object is preserved.
  *
  ******************************************************************************/
@@ -897,10 +897,11 @@ acpi_ut_copy_ielement_to_ielement(u8 object_type,
  *
  * FUNCTION:    acpi_ut_copy_ipackage_to_ipackage
  *
- * PARAMETERS:  *source_obj     - Pointer to the source package object
- *              *dest_obj       - Where the internal object is returned
+ * PARAMETERS:  source_obj      - Pointer to the source package object
+ *              dest_obj        - Where the internal object is returned
+ *              walk_state      - Current Walk state descriptor
  *
- * RETURN:      Status          - the status of the call
+ * RETURN:      Status
  *
  * DESCRIPTION: This function is called to copy an internal package object
  *              into another internal package object.
@@ -953,9 +954,9 @@ acpi_ut_copy_ipackage_to_ipackage(union acpi_operand_object *source_obj,
  *
  * FUNCTION:    acpi_ut_copy_iobject_to_iobject
  *
- * PARAMETERS:  walk_state          - Current walk state
- *              source_desc         - The internal object to be copied
+ * PARAMETERS:  source_desc         - The internal object to be copied
  *              dest_desc           - Where the copied object is returned
+ *              walk_state          - Current walk state
  *
  * RETURN:      Status
  *
diff --git a/drivers/acpi/acpica/utmisc.c b/drivers/acpi/acpica/utmisc.c
index 61f6315fce9f..6c6a5137b728 100644
--- a/drivers/acpi/acpica/utmisc.c
+++ b/drivers/acpi/acpica/utmisc.c
@@ -1161,3 +1161,45 @@ acpi_ut_predefined_warning(const char *module_name,
 	ACPI_COMMON_MSG_SUFFIX;
 	va_end(args);
 }
+
+/*******************************************************************************
+ *
+ * FUNCTION:    acpi_ut_predefined_info
+ *
+ * PARAMETERS:  module_name     - Caller's module name (for error output)
+ *              line_number     - Caller's line number (for error output)
+ *              Pathname        - Full pathname to the node
+ *              node_flags      - From Namespace node for the method/object
+ *              Format          - Printf format string + additional args
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Info messages for the predefined validation module. Messages
+ *              are only emitted the first time a problem with a particular
+ *              method/object is detected. This prevents a flood of
+ *              messages for methods that are repeatedly evaluated.
+ *
+ ******************************************************************************/
+
+void ACPI_INTERNAL_VAR_XFACE
+acpi_ut_predefined_info(const char *module_name,
+			u32 line_number,
+			char *pathname, u8 node_flags, const char *format, ...)
+{
+	va_list args;
+
+	/*
+	 * Warning messages for this method/object will be disabled after the
+	 * first time a validation fails or an object is successfully repaired.
+	 */
+	if (node_flags & ANOBJ_EVALUATED) {
+		return;
+	}
+
+	acpi_os_printf("ACPI Info for %s: ", pathname);
+
+	va_start(args, format);
+	acpi_os_vprintf(format, args);
+	ACPI_COMMON_MSG_SUFFIX;
+	va_end(args);
+}
diff --git a/drivers/acpi/acpica/utobject.c b/drivers/acpi/acpica/utobject.c
index 0207b625274a..42e658b543f1 100644
--- a/drivers/acpi/acpica/utobject.c
+++ b/drivers/acpi/acpica/utobject.c
@@ -190,6 +190,35 @@ union acpi_operand_object *acpi_ut_create_package_object(u32 count)
 
 /*******************************************************************************
  *
+ * FUNCTION:    acpi_ut_create_integer_object
+ *
+ * PARAMETERS:  initial_value       - Initial value for the integer
+ *
+ * RETURN:      Pointer to a new Integer object, null on failure
+ *
+ * DESCRIPTION: Create an initialized integer object
+ *
+ ******************************************************************************/
+
+union acpi_operand_object *acpi_ut_create_integer_object(u64 initial_value)
+{
+	union acpi_operand_object *integer_desc;
+
+	ACPI_FUNCTION_TRACE(ut_create_integer_object);
+
+	/* Create and initialize a new integer object */
+
+	integer_desc = acpi_ut_create_internal_object(ACPI_TYPE_INTEGER);
+	if (!integer_desc) {
+		return_PTR(NULL);
+	}
+
+	integer_desc->integer.value = initial_value;
+	return_PTR(integer_desc);
+}
+
+/*******************************************************************************
+ *
  * FUNCTION:    acpi_ut_create_buffer_object
  *
  * PARAMETERS:  buffer_size            - Size of buffer to be created
diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index 3f4602b8f287..cada73ffdfa7 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -831,7 +831,7 @@ static void acpi_battery_notify(struct acpi_device *device, u32 event)
 					dev_name(&device->dev), event,
 					acpi_battery_present(battery));
 #ifdef CONFIG_ACPI_SYSFS_POWER
-	/* acpi_batter_update could remove power_supply object */
+	/* acpi_battery_update could remove power_supply object */
 	if (battery->bat.dev)
 		kobject_uevent(&battery->bat.dev->kobj, KOBJ_CHANGE);
 #endif
diff --git a/drivers/acpi/blacklist.c b/drivers/acpi/blacklist.c
index 23e5a0519af5..2815df66f6f7 100644
--- a/drivers/acpi/blacklist.c
+++ b/drivers/acpi/blacklist.c
@@ -185,6 +185,12 @@ static int __init dmi_disable_osi_vista(const struct dmi_system_id *d)
 	acpi_osi_setup("!Windows 2006");
 	return 0;
 }
+static int __init dmi_disable_osi_win7(const struct dmi_system_id *d)
+{
+	printk(KERN_NOTICE PREFIX "DMI detected: %s\n", d->ident);
+	acpi_osi_setup("!Windows 2009");
+	return 0;
+}
 
 static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
 	{
@@ -211,6 +217,14 @@ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
 		     DMI_MATCH(DMI_PRODUCT_NAME, "Sony VGN-SR290J"),
 		},
 	},
+	{
+	.callback = dmi_disable_osi_win7,
+	.ident = "ASUS K50IJ",
+	.matches = {
+		     DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK Computer Inc."),
+		     DMI_MATCH(DMI_PRODUCT_NAME, "K50IJ"),
+		},
+	},
 
 	/*
 	 * BIOS invocation of _OSI(Linux) is almost always a BIOS bug.
diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
index 741191524353..a52126e46307 100644
--- a/drivers/acpi/bus.c
+++ b/drivers/acpi/bus.c
@@ -344,6 +344,167 @@ bool acpi_bus_can_wakeup(acpi_handle handle)
 
 EXPORT_SYMBOL(acpi_bus_can_wakeup);
 
+static void acpi_print_osc_error(acpi_handle handle,
+	struct acpi_osc_context *context, char *error)
+{
+	struct acpi_buffer buffer = {ACPI_ALLOCATE_BUFFER};
+	int i;
+
+	if (ACPI_FAILURE(acpi_get_name(handle, ACPI_FULL_PATHNAME, &buffer)))
+		printk(KERN_DEBUG "%s\n", error);
+	else {
+		printk(KERN_DEBUG "%s:%s\n", (char *)buffer.pointer, error);
+		kfree(buffer.pointer);
+	}
+	printk(KERN_DEBUG"_OSC request data:");
+	for (i = 0; i < context->cap.length; i += sizeof(u32))
+		printk("%x ", *((u32 *)(context->cap.pointer + i)));
+	printk("\n");
+}
+
+static u8 hex_val(unsigned char c)
+{
+	return isdigit(c) ? c - '0' : toupper(c) - 'A' + 10;
+}
+
+static acpi_status acpi_str_to_uuid(char *str, u8 *uuid)
+{
+	int i;
+	static int opc_map_to_uuid[16] = {6, 4, 2, 0, 11, 9, 16, 14, 19, 21,
+		24, 26, 28, 30, 32, 34};
+
+	if (strlen(str) != 36)
+		return AE_BAD_PARAMETER;
+	for (i = 0; i < 36; i++) {
+		if (i == 8 || i == 13 || i == 18 || i == 23) {
+			if (str[i] != '-')
+				return AE_BAD_PARAMETER;
+		} else if (!isxdigit(str[i]))
+			return AE_BAD_PARAMETER;
+	}
+	for (i = 0; i < 16; i++) {
+		uuid[i] = hex_val(str[opc_map_to_uuid[i]]) << 4;
+		uuid[i] |= hex_val(str[opc_map_to_uuid[i] + 1]);
+	}
+	return AE_OK;
+}
+
+acpi_status acpi_run_osc(acpi_handle handle, struct acpi_osc_context *context)
+{
+	acpi_status status;
+	struct acpi_object_list input;
+	union acpi_object in_params[4];
+	union acpi_object *out_obj;
+	u8 uuid[16];
+	u32 errors;
+	struct acpi_buffer output = {ACPI_ALLOCATE_BUFFER, NULL};
+
+	if (!context)
+		return AE_ERROR;
+	if (ACPI_FAILURE(acpi_str_to_uuid(context->uuid_str, uuid)))
+		return AE_ERROR;
+	context->ret.length = ACPI_ALLOCATE_BUFFER;
+	context->ret.pointer = NULL;
+
+	/* Setting up input parameters */
+	input.count = 4;
+	input.pointer = in_params;
+	in_params[0].type 		= ACPI_TYPE_BUFFER;
+	in_params[0].buffer.length 	= 16;
+	in_params[0].buffer.pointer	= uuid;
+	in_params[1].type 		= ACPI_TYPE_INTEGER;
+	in_params[1].integer.value 	= context->rev;
+	in_params[2].type 		= ACPI_TYPE_INTEGER;
+	in_params[2].integer.value	= context->cap.length/sizeof(u32);
+	in_params[3].type		= ACPI_TYPE_BUFFER;
+	in_params[3].buffer.length 	= context->cap.length;
+	in_params[3].buffer.pointer 	= context->cap.pointer;
+
+	status = acpi_evaluate_object(handle, "_OSC", &input, &output);
+	if (ACPI_FAILURE(status))
+		return status;
+
+	if (!output.length)
+		return AE_NULL_OBJECT;
+
+	out_obj = output.pointer;
+	if (out_obj->type != ACPI_TYPE_BUFFER
+		|| out_obj->buffer.length != context->cap.length) {
+		acpi_print_osc_error(handle, context,
+			"_OSC evaluation returned wrong type");
+		status = AE_TYPE;
+		goto out_kfree;
+	}
+	/* Need to ignore the bit0 in result code */
+	errors = *((u32 *)out_obj->buffer.pointer) & ~(1 << 0);
+	if (errors) {
+		if (errors & OSC_REQUEST_ERROR)
+			acpi_print_osc_error(handle, context,
+				"_OSC request failed");
+		if (errors & OSC_INVALID_UUID_ERROR)
+			acpi_print_osc_error(handle, context,
+				"_OSC invalid UUID");
+		if (errors & OSC_INVALID_REVISION_ERROR)
+			acpi_print_osc_error(handle, context,
+				"_OSC invalid revision");
+		if (errors & OSC_CAPABILITIES_MASK_ERROR) {
+			if (((u32 *)context->cap.pointer)[OSC_QUERY_TYPE]
+			    & OSC_QUERY_ENABLE)
+				goto out_success;
+			status = AE_SUPPORT;
+			goto out_kfree;
+		}
+		status = AE_ERROR;
+		goto out_kfree;
+	}
+out_success:
+	context->ret.length = out_obj->buffer.length;
+	context->ret.pointer = kmalloc(context->ret.length, GFP_KERNEL);
+	if (!context->ret.pointer) {
+		status =  AE_NO_MEMORY;
+		goto out_kfree;
+	}
+	memcpy(context->ret.pointer, out_obj->buffer.pointer,
+		context->ret.length);
+	status =  AE_OK;
+
+out_kfree:
+	kfree(output.pointer);
+	if (status != AE_OK)
+		context->ret.pointer = NULL;
+	return status;
+}
+EXPORT_SYMBOL(acpi_run_osc);
+
+static u8 sb_uuid_str[] = "0811B06E-4A27-44F9-8D60-3CBBC22E7B48";
+static void acpi_bus_osc_support(void)
+{
+	u32 capbuf[2];
+	struct acpi_osc_context context = {
+		.uuid_str = sb_uuid_str,
+		.rev = 1,
+		.cap.length = 8,
+		.cap.pointer = capbuf,
+	};
+	acpi_handle handle;
+
+	capbuf[OSC_QUERY_TYPE] = OSC_QUERY_ENABLE;
+	capbuf[OSC_SUPPORT_TYPE] = OSC_SB_PR3_SUPPORT; /* _PR3 is in use */
+#if defined(CONFIG_ACPI_PROCESSOR_AGGREGATOR) ||\
+			defined(CONFIG_ACPI_PROCESSOR_AGGREGATOR_MODULE)
+	capbuf[OSC_SUPPORT_TYPE] |= OSC_SB_PAD_SUPPORT;
+#endif
+
+#if defined(CONFIG_ACPI_PROCESSOR) || defined(CONFIG_ACPI_PROCESSOR_MODULE)
+	capbuf[OSC_SUPPORT_TYPE] |= OSC_SB_PPC_OST_SUPPORT;
+#endif
+	if (ACPI_FAILURE(acpi_get_handle(NULL, "\\_SB", &handle)))
+		return;
+	if (ACPI_SUCCESS(acpi_run_osc(handle, &context)))
+		kfree(context.ret.pointer);
+	/* do we need to check the returned cap? Sounds no */
+}
+
 /* --------------------------------------------------------------------------
                                 Event Management
    -------------------------------------------------------------------------- */
@@ -734,12 +895,16 @@ static int __init acpi_bus_init(void)
 	status = acpi_ec_ecdt_probe();
 	/* Ignore result. Not having an ECDT is not fatal. */
 
+	acpi_bus_osc_support();
+
 	status = acpi_initialize_objects(ACPI_FULL_INITIALIZATION);
 	if (ACPI_FAILURE(status)) {
 		printk(KERN_ERR PREFIX "Unable to initialize ACPI objects\n");
 		goto error1;
 	}
 
+	acpi_early_processor_set_pdc();
+
 	/*
 	 * Maybe EC region is required at bus_scan/acpi_get_devices. So it
 	 * is necessary to enable it as early as possible.
diff --git a/drivers/acpi/button.c b/drivers/acpi/button.c
index 0c9c6a9a002c..8a95e8329df7 100644
--- a/drivers/acpi/button.c
+++ b/drivers/acpi/button.c
@@ -282,6 +282,13 @@ static int acpi_lid_send_state(struct acpi_device *device)
 	if (ret == NOTIFY_DONE)
 		ret = blocking_notifier_call_chain(&acpi_lid_notifier, state,
 						   device);
+	if (ret == NOTIFY_DONE || ret == NOTIFY_OK) {
+		/*
+		 * It is also regarded as success if the notifier_chain
+		 * returns NOTIFY_OK or NOTIFY_DONE.
+		 */
+		ret = 0;
+	}
 	return ret;
 }
 
diff --git a/drivers/acpi/container.c b/drivers/acpi/container.c
index 642bb305cb65..5faf6c21257d 100644
--- a/drivers/acpi/container.c
+++ b/drivers/acpi/container.c
@@ -258,7 +258,7 @@ static int __init acpi_container_init(void)
 	acpi_walk_namespace(ACPI_TYPE_DEVICE,
 			    ACPI_ROOT_OBJECT,
 			    ACPI_UINT32_MAX,
-			    container_walk_namespace_cb, &action, NULL);
+			    container_walk_namespace_cb, NULL, &action, NULL);
 
 	return (0);
 }
@@ -271,7 +271,7 @@ static void __exit acpi_container_exit(void)
 	acpi_walk_namespace(ACPI_TYPE_DEVICE,
 			    ACPI_ROOT_OBJECT,
 			    ACPI_UINT32_MAX,
-			    container_walk_namespace_cb, &action, NULL);
+			    container_walk_namespace_cb, NULL, &action, NULL);
 
 	acpi_bus_unregister_driver(&acpi_container_driver);
 
diff --git a/drivers/acpi/debug.c b/drivers/acpi/debug.c
index 8a690c3b8e23..cc421b7ae166 100644
--- a/drivers/acpi/debug.c
+++ b/drivers/acpi/debug.c
@@ -8,6 +8,7 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/moduleparam.h>
+#include <linux/debugfs.h>
 #include <asm/uaccess.h>
 #include <acpi/acpi_drivers.h>
 
@@ -196,6 +197,80 @@ module_param_call(trace_state, param_set_trace_state, param_get_trace_state,
 		  NULL, 0644);
 
 /* --------------------------------------------------------------------------
+				DebugFS Interface
+   -------------------------------------------------------------------------- */
+
+static ssize_t cm_write(struct file *file, const char __user *user_buf,
+			size_t count, loff_t *ppos)
+{
+	static char *buf;
+	static int uncopied_bytes;
+	struct acpi_table_header table;
+	acpi_status status;
+
+	if (!(*ppos)) {
+		/* parse the table header to get the table length */
+		if (count <= sizeof(struct acpi_table_header))
+			return -EINVAL;
+		if (copy_from_user(&table, user_buf,
+			sizeof(struct acpi_table_header)))
+			return -EFAULT;
+		uncopied_bytes = table.length;
+		buf = kzalloc(uncopied_bytes, GFP_KERNEL);
+		if (!buf)
+			return -ENOMEM;
+	}
+
+	if (uncopied_bytes < count) {
+		kfree(buf);
+		return -EINVAL;
+	}
+
+	if (copy_from_user(buf + (*ppos), user_buf, count)) {
+		kfree(buf);
+		return -EFAULT;
+	}
+
+	uncopied_bytes -= count;
+	*ppos += count;
+
+	if (!uncopied_bytes) {
+		status = acpi_install_method(buf);
+		kfree(buf);
+		if (ACPI_FAILURE(status))
+			return -EINVAL;
+		add_taint(TAINT_OVERRIDDEN_ACPI_TABLE);
+	}
+
+	return count;
+}
+
+static const struct file_operations cm_fops = {
+	.write = cm_write,
+};
+
+static int acpi_debugfs_init(void)
+{
+	struct dentry *acpi_dir, *cm_dentry;
+
+	acpi_dir = debugfs_create_dir("acpi", NULL);
+	if (!acpi_dir)
+		goto err;
+
+	cm_dentry = debugfs_create_file("custom_method", S_IWUGO,
+					acpi_dir, NULL, &cm_fops);
+	if (!cm_dentry)
+		goto err;
+
+	return 0;
+
+err:
+	if (acpi_dir)
+		debugfs_remove(acpi_dir);
+	return -EINVAL;
+}
+
+/* --------------------------------------------------------------------------
                               FS Interface (/proc)
    -------------------------------------------------------------------------- */
 #ifdef CONFIG_ACPI_PROCFS
@@ -286,7 +361,7 @@ static const struct file_operations acpi_system_debug_proc_fops = {
 };
 #endif
 
-int __init acpi_debug_init(void)
+int __init acpi_procfs_init(void)
 {
 #ifdef CONFIG_ACPI_PROCFS
 	struct proc_dir_entry *entry;
@@ -321,3 +396,10 @@ int __init acpi_debug_init(void)
 	return 0;
 #endif
 }
+
+int __init acpi_debug_init(void)
+{
+	acpi_debugfs_init();
+	acpi_procfs_init();
+	return 0;
+}
diff --git a/drivers/acpi/dock.c b/drivers/acpi/dock.c
index 7338b6a3e049..bbc2c1315c47 100644
--- a/drivers/acpi/dock.c
+++ b/drivers/acpi/dock.c
@@ -50,7 +50,6 @@ MODULE_PARM_DESC(immediate_undock, "1 (default) will cause the driver to "
 	" before undocking");
 
 static struct atomic_notifier_head dock_notifier_list;
-static char dock_device_name[] = "dock";
 
 static const struct acpi_device_id dock_device_ids[] = {
 	{"LNXDOCK", 0},
@@ -93,40 +92,30 @@ struct dock_dependent_device {
  *                         Dock Dependent device functions                   *
  *****************************************************************************/
 /**
- *  alloc_dock_dependent_device - allocate and init a dependent device
- *  @handle: the acpi_handle of the dependent device
+ * add_dock_dependent_device - associate a device with the dock station
+ * @ds: The dock station
+ * @handle: handle of the dependent device
  *
- *  Allocate memory for a dependent device structure for a device referenced
- *  by the acpi handle
+ * Add the dependent device to the dock's dependent device list.
  */
-static struct dock_dependent_device *
-alloc_dock_dependent_device(acpi_handle handle)
+static int
+add_dock_dependent_device(struct dock_station *ds, acpi_handle handle)
 {
 	struct dock_dependent_device *dd;
 
 	dd = kzalloc(sizeof(*dd), GFP_KERNEL);
-	if (dd) {
-		dd->handle = handle;
-		INIT_LIST_HEAD(&dd->list);
-		INIT_LIST_HEAD(&dd->hotplug_list);
-	}
-	return dd;
-}
+	if (!dd)
+		return -ENOMEM;
+
+	dd->handle = handle;
+	INIT_LIST_HEAD(&dd->list);
+	INIT_LIST_HEAD(&dd->hotplug_list);
 
-/**
- * add_dock_dependent_device - associate a device with the dock station
- * @ds: The dock station
- * @dd: The dependent device
- *
- * Add the dependent device to the dock's dependent device list.
- */
-static void
-add_dock_dependent_device(struct dock_station *ds,
-			  struct dock_dependent_device *dd)
-{
 	spin_lock(&ds->dd_lock);
 	list_add_tail(&dd->list, &ds->dependent_devices);
 	spin_unlock(&ds->dd_lock);
+
+	return 0;
 }
 
 /**
@@ -249,6 +238,7 @@ static int is_battery(acpi_handle handle)
 static int is_ejectable_bay(acpi_handle handle)
 {
 	acpi_handle phandle;
+
 	if (!is_ejectable(handle))
 		return 0;
 	if (is_battery(handle) || is_ata(handle))
@@ -275,14 +265,13 @@ int is_dock_device(acpi_handle handle)
 
 	if (is_dock(handle))
 		return 1;
-	list_for_each_entry(dock_station, &dock_stations, sibling) {
+
+	list_for_each_entry(dock_station, &dock_stations, sibling)
 		if (find_dock_dependent_device(dock_station, handle))
 			return 1;
-	}
 
 	return 0;
 }
-
 EXPORT_SYMBOL_GPL(is_dock_device);
 
 /**
@@ -305,8 +294,6 @@ static int dock_present(struct dock_station *ds)
 	return 0;
 }
 
-
-
 /**
  * dock_create_acpi_device - add new devices to acpi
  * @handle - handle of the device to add
@@ -320,7 +307,7 @@ static int dock_present(struct dock_station *ds)
  */
 static struct acpi_device * dock_create_acpi_device(acpi_handle handle)
 {
-	struct acpi_device *device = NULL;
+	struct acpi_device *device;
 	struct acpi_device *parent_device;
 	acpi_handle parent;
 	int ret;
@@ -337,8 +324,7 @@ static struct acpi_device * dock_create_acpi_device(acpi_handle handle)
 		ret = acpi_bus_add(&device, parent_device, handle,
 			ACPI_BUS_TYPE_DEVICE);
 		if (ret) {
-			pr_debug("error adding bus, %x\n",
-				-ret);
+			pr_debug("error adding bus, %x\n", -ret);
 			return NULL;
 		}
 	}
@@ -364,7 +350,6 @@ static void dock_remove_acpi_device(acpi_handle handle)
 	}
 }
 
-
 /**
  * hotplug_dock_devices - insert or remove devices on the dock station
  * @ds: the dock station
@@ -384,10 +369,9 @@ static void hotplug_dock_devices(struct dock_station *ds, u32 event)
 	/*
 	 * First call driver specific hotplug functions
 	 */
-	list_for_each_entry(dd, &ds->hotplug_devices, hotplug_list) {
+	list_for_each_entry(dd, &ds->hotplug_devices, hotplug_list)
 		if (dd->ops && dd->ops->handler)
 			dd->ops->handler(dd->handle, event, dd->context);
-	}
 
 	/*
 	 * Now make sure that an acpi_device is created for each
@@ -426,6 +410,7 @@ static void dock_event(struct dock_station *ds, u32 event, int num)
 	list_for_each_entry(dd, &ds->hotplug_devices, hotplug_list)
 		if (dd->ops && dd->ops->uevent)
 			dd->ops->uevent(dd->handle, event, dd->context);
+
 	if (num != DOCK_EVENT)
 		kobject_uevent_env(&dev->kobj, KOBJ_CHANGE, envp);
 }
@@ -456,8 +441,8 @@ static void eject_dock(struct dock_station *ds)
 	arg.type = ACPI_TYPE_INTEGER;
 	arg.integer.value = 1;
 
-	if (ACPI_FAILURE(acpi_evaluate_object(ds->handle, "_EJ0",
-					      &arg_list, NULL)))
+	status = acpi_evaluate_object(ds->handle, "_EJ0", &arg_list, NULL);
+	if (ACPI_FAILURE(status))
 		pr_debug("Failed to evaluate _EJ0!\n");
 }
 
@@ -577,7 +562,6 @@ int register_dock_notifier(struct notifier_block *nb)
 
 	return atomic_notifier_chain_register(&dock_notifier_list, nb);
 }
-
 EXPORT_SYMBOL_GPL(register_dock_notifier);
 
 /**
@@ -591,7 +575,6 @@ void unregister_dock_notifier(struct notifier_block *nb)
 
 	atomic_notifier_chain_unregister(&dock_notifier_list, nb);
 }
-
 EXPORT_SYMBOL_GPL(unregister_dock_notifier);
 
 /**
@@ -636,7 +619,6 @@ register_hotplug_dock_device(acpi_handle handle, struct acpi_dock_ops *ops,
 
 	return ret;
 }
-
 EXPORT_SYMBOL_GPL(register_hotplug_dock_device);
 
 /**
@@ -657,7 +639,6 @@ void unregister_hotplug_dock_device(acpi_handle handle)
 			dock_del_hotplug_device(dock_station, dd);
 	}
 }
-
 EXPORT_SYMBOL_GPL(unregister_hotplug_dock_device);
 
 /**
@@ -772,7 +753,7 @@ struct dock_data {
 
 static void acpi_dock_deferred_cb(void *context)
 {
-	struct dock_data *data = (struct dock_data *)context;
+	struct dock_data *data = context;
 
 	dock_notify(data->handle, data->event, data->ds);
 	kfree(data);
@@ -782,23 +763,22 @@ static int acpi_dock_notifier_call(struct notifier_block *this,
 	unsigned long event, void *data)
 {
 	struct dock_station *dock_station;
-	acpi_handle handle = (acpi_handle)data;
+	acpi_handle handle = data;
 
 	if (event != ACPI_NOTIFY_BUS_CHECK && event != ACPI_NOTIFY_DEVICE_CHECK
 	   && event != ACPI_NOTIFY_EJECT_REQUEST)
 		return 0;
 	list_for_each_entry(dock_station, &dock_stations, sibling) {
 		if (dock_station->handle == handle) {
-			struct dock_data *dock_data;
+			struct dock_data *dd;
 
-			dock_data = kmalloc(sizeof(*dock_data), GFP_KERNEL);
-			if (!dock_data)
+			dd = kmalloc(sizeof(*dd), GFP_KERNEL);
+			if (!dd)
 				return 0;
-			dock_data->handle = handle;
-			dock_data->event = event;
-			dock_data->ds = dock_station;
-			acpi_os_hotplug_execute(acpi_dock_deferred_cb,
-				dock_data);
+			dd->handle = handle;
+			dd->event = event;
+			dd->ds = dock_station;
+			acpi_os_hotplug_execute(acpi_dock_deferred_cb, dd);
 			return 0 ;
 		}
 	}
@@ -826,7 +806,6 @@ find_dock_devices(acpi_handle handle, u32 lvl, void *context, void **rv)
 	acpi_status status;
 	acpi_handle tmp, parent;
 	struct dock_station *ds = context;
-	struct dock_dependent_device *dd;
 
 	status = acpi_bus_get_ejd(handle, &tmp);
 	if (ACPI_FAILURE(status)) {
@@ -840,11 +819,9 @@ find_dock_devices(acpi_handle handle, u32 lvl, void *context, void **rv)
 			goto fdd_out;
 	}
 
-	if (tmp == ds->handle) {
-		dd = alloc_dock_dependent_device(handle);
-		if (dd)
-			add_dock_dependent_device(ds, dd);
-	}
+	if (tmp == ds->handle)
+		add_dock_dependent_device(ds, handle);
+
 fdd_out:
 	return AE_OK;
 }
@@ -857,8 +834,7 @@ static ssize_t show_docked(struct device *dev,
 {
 	struct acpi_device *tmp;
 
-	struct dock_station *dock_station = *((struct dock_station **)
-		dev->platform_data);
+	struct dock_station *dock_station = dev->platform_data;
 
 	if (ACPI_SUCCESS(acpi_bus_get_device(dock_station->handle, &tmp)))
 		return snprintf(buf, PAGE_SIZE, "1\n");
@@ -872,8 +848,7 @@ static DEVICE_ATTR(docked, S_IRUGO, show_docked, NULL);
 static ssize_t show_flags(struct device *dev,
 			  struct device_attribute *attr, char *buf)
 {
-	struct dock_station *dock_station = *((struct dock_station **)
-		dev->platform_data);
+	struct dock_station *dock_station = dev->platform_data;
 	return snprintf(buf, PAGE_SIZE, "%d\n", dock_station->flags);
 
 }
@@ -886,8 +861,7 @@ static ssize_t write_undock(struct device *dev, struct device_attribute *attr,
 			   const char *buf, size_t count)
 {
 	int ret;
-	struct dock_station *dock_station = *((struct dock_station **)
-		dev->platform_data);
+	struct dock_station *dock_station = dev->platform_data;
 
 	if (!count)
 		return -EINVAL;
@@ -905,8 +879,7 @@ static ssize_t show_dock_uid(struct device *dev,
 			     struct device_attribute *attr, char *buf)
 {
 	unsigned long long lbuf;
-	struct dock_station *dock_station = *((struct dock_station **)
-		dev->platform_data);
+	struct dock_station *dock_station = dev->platform_data;
 	acpi_status status = acpi_evaluate_integer(dock_station->handle,
 					"_UID", NULL, &lbuf);
 	if (ACPI_FAILURE(status))
@@ -919,8 +892,7 @@ static DEVICE_ATTR(uid, S_IRUGO, show_dock_uid, NULL);
 static ssize_t show_dock_type(struct device *dev,
 		struct device_attribute *attr, char *buf)
 {
-	struct dock_station *dock_station = *((struct dock_station **)
-		dev->platform_data);
+	struct dock_station *dock_station = dev->platform_data;
 	char *type;
 
 	if (dock_station->flags & DOCK_IS_DOCK)
@@ -936,6 +908,19 @@ static ssize_t show_dock_type(struct device *dev,
 }
 static DEVICE_ATTR(type, S_IRUGO, show_dock_type, NULL);
 
+static struct attribute *dock_attributes[] = {
+	&dev_attr_docked.attr,
+	&dev_attr_flags.attr,
+	&dev_attr_undock.attr,
+	&dev_attr_uid.attr,
+	&dev_attr_type.attr,
+	NULL
+};
+
+static struct attribute_group dock_attribute_group = {
+	.attrs = dock_attributes
+};
+
 /**
  * dock_add - add a new dock station
  * @handle: the dock station handle
@@ -945,39 +930,30 @@ static DEVICE_ATTR(type, S_IRUGO, show_dock_type, NULL);
  */
 static int dock_add(acpi_handle handle)
 {
-	int ret;
-	struct dock_dependent_device *dd;
-	struct dock_station *dock_station;
-	struct platform_device *dock_device;
+	int ret, id;
+	struct dock_station ds, *dock_station;
+	struct platform_device *dd;
+
+	id = dock_station_count;
+	dd = platform_device_register_data(NULL, "dock", id, &ds, sizeof(ds));
+	if (IS_ERR(dd))
+		return PTR_ERR(dd);
+
+	dock_station = dd->dev.platform_data;
 
-	/* allocate & initialize the dock_station private data */
-	dock_station = kzalloc(sizeof(*dock_station), GFP_KERNEL);
-	if (!dock_station)
-		return -ENOMEM;
 	dock_station->handle = handle;
+	dock_station->dock_device = dd;
 	dock_station->last_dock_time = jiffies - HZ;
-	INIT_LIST_HEAD(&dock_station->dependent_devices);
-	INIT_LIST_HEAD(&dock_station->hotplug_devices);
-	INIT_LIST_HEAD(&dock_station->sibling);
-	spin_lock_init(&dock_station->dd_lock);
+
 	mutex_init(&dock_station->hp_lock);
+	spin_lock_init(&dock_station->dd_lock);
+	INIT_LIST_HEAD(&dock_station->sibling);
+	INIT_LIST_HEAD(&dock_station->hotplug_devices);
 	ATOMIC_INIT_NOTIFIER_HEAD(&dock_notifier_list);
-
-	/* initialize platform device stuff */
-	dock_station->dock_device =
-		platform_device_register_simple(dock_device_name,
-			dock_station_count, NULL, 0);
-	dock_device = dock_station->dock_device;
-	if (IS_ERR(dock_device)) {
-		kfree(dock_station);
-		dock_station = NULL;
-		return PTR_ERR(dock_device);
-	}
-	platform_device_add_data(dock_device, &dock_station,
-		sizeof(struct dock_station *));
+	INIT_LIST_HEAD(&dock_station->dependent_devices);
 
 	/* we want the dock device to send uevents */
-	dev_set_uevent_suppress(&dock_device->dev, 0);
+	dev_set_uevent_suppress(&dd->dev, 0);
 
 	if (is_dock(handle))
 		dock_station->flags |= DOCK_IS_DOCK;
@@ -986,106 +962,53 @@ static int dock_add(acpi_handle handle)
 	if (is_battery(handle))
 		dock_station->flags |= DOCK_IS_BAT;
 
-	ret = device_create_file(&dock_device->dev, &dev_attr_docked);
-	if (ret) {
-		printk(KERN_ERR "Error %d adding sysfs file\n", ret);
-		platform_device_unregister(dock_device);
-		kfree(dock_station);
-		dock_station = NULL;
-		return ret;
-	}
-	ret = device_create_file(&dock_device->dev, &dev_attr_undock);
-	if (ret) {
-		printk(KERN_ERR "Error %d adding sysfs file\n", ret);
-		device_remove_file(&dock_device->dev, &dev_attr_docked);
-		platform_device_unregister(dock_device);
-		kfree(dock_station);
-		dock_station = NULL;
-		return ret;
-	}
-	ret = device_create_file(&dock_device->dev, &dev_attr_uid);
-	if (ret) {
-		printk(KERN_ERR "Error %d adding sysfs file\n", ret);
-		device_remove_file(&dock_device->dev, &dev_attr_docked);
-		device_remove_file(&dock_device->dev, &dev_attr_undock);
-		platform_device_unregister(dock_device);
-		kfree(dock_station);
-		dock_station = NULL;
-		return ret;
-	}
-	ret = device_create_file(&dock_device->dev, &dev_attr_flags);
-	if (ret) {
-		printk(KERN_ERR "Error %d adding sysfs file\n", ret);
-		device_remove_file(&dock_device->dev, &dev_attr_docked);
-		device_remove_file(&dock_device->dev, &dev_attr_undock);
-		device_remove_file(&dock_device->dev, &dev_attr_uid);
-		platform_device_unregister(dock_device);
-		kfree(dock_station);
-		dock_station = NULL;
-		return ret;
-	}
-	ret = device_create_file(&dock_device->dev, &dev_attr_type);
+	ret = sysfs_create_group(&dd->dev.kobj, &dock_attribute_group);
 	if (ret)
-		printk(KERN_ERR"Error %d adding sysfs file\n", ret);
+		goto err_unregister;
 
 	/* Find dependent devices */
 	acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT,
-			    ACPI_UINT32_MAX, find_dock_devices, dock_station,
-			    NULL);
+			    ACPI_UINT32_MAX, find_dock_devices, NULL,
+			    dock_station, NULL);
 
 	/* add the dock station as a device dependent on itself */
-	dd = alloc_dock_dependent_device(handle);
-	if (!dd) {
-		kfree(dock_station);
-		dock_station = NULL;
-		ret = -ENOMEM;
-		goto dock_add_err_unregister;
-	}
-	add_dock_dependent_device(dock_station, dd);
+	ret = add_dock_dependent_device(dock_station, handle);
+	if (ret)
+		goto err_rmgroup;
 
 	dock_station_count++;
 	list_add(&dock_station->sibling, &dock_stations);
 	return 0;
 
-dock_add_err_unregister:
-	device_remove_file(&dock_device->dev, &dev_attr_type);
-	device_remove_file(&dock_device->dev, &dev_attr_docked);
-	device_remove_file(&dock_device->dev, &dev_attr_undock);
-	device_remove_file(&dock_device->dev, &dev_attr_uid);
-	device_remove_file(&dock_device->dev, &dev_attr_flags);
-	platform_device_unregister(dock_device);
-	kfree(dock_station);
-	dock_station = NULL;
+err_rmgroup:
+	sysfs_remove_group(&dd->dev.kobj, &dock_attribute_group);
+err_unregister:
+	platform_device_unregister(dd);
+	printk(KERN_ERR "%s encountered error %d\n", __func__, ret);
 	return ret;
 }
 
 /**
  * dock_remove - free up resources related to the dock station
  */
-static int dock_remove(struct dock_station *dock_station)
+static int dock_remove(struct dock_station *ds)
 {
 	struct dock_dependent_device *dd, *tmp;
-	struct platform_device *dock_device = dock_station->dock_device;
+	struct platform_device *dock_device = ds->dock_device;
 
 	if (!dock_station_count)
 		return 0;
 
 	/* remove dependent devices */
-	list_for_each_entry_safe(dd, tmp, &dock_station->dependent_devices,
-				 list)
-	    kfree(dd);
+	list_for_each_entry_safe(dd, tmp, &ds->dependent_devices, list)
+		kfree(dd);
+
+	list_del(&ds->sibling);
 
 	/* cleanup sysfs */
-	device_remove_file(&dock_device->dev, &dev_attr_type);
-	device_remove_file(&dock_device->dev, &dev_attr_docked);
-	device_remove_file(&dock_device->dev, &dev_attr_undock);
-	device_remove_file(&dock_device->dev, &dev_attr_uid);
-	device_remove_file(&dock_device->dev, &dev_attr_flags);
+	sysfs_remove_group(&dock_device->dev.kobj, &dock_attribute_group);
 	platform_device_unregister(dock_device);
 
-	/* free dock station memory */
-	kfree(dock_station);
-	dock_station = NULL;
 	return 0;
 }
 
@@ -1103,11 +1026,10 @@ find_dock(acpi_handle handle, u32 lvl, void *context, void **rv)
 {
 	acpi_status status = AE_OK;
 
-	if (is_dock(handle)) {
-		if (dock_add(handle) >= 0) {
+	if (is_dock(handle))
+		if (dock_add(handle) >= 0)
 			status = AE_CTRL_TERMINATE;
-		}
-	}
+
 	return status;
 }
 
@@ -1127,11 +1049,11 @@ static int __init dock_init(void)
 
 	/* look for a dock station */
 	acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT,
-			    ACPI_UINT32_MAX, find_dock, NULL, NULL);
+			    ACPI_UINT32_MAX, find_dock, NULL, NULL, NULL);
 
 	/* look for bay */
 	acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT,
-			ACPI_UINT32_MAX, find_bay, NULL, NULL);
+			ACPI_UINT32_MAX, find_bay, NULL, NULL, NULL);
 	if (!dock_station_count) {
 		printk(KERN_INFO PREFIX "No dock devices found.\n");
 		return 0;
@@ -1145,8 +1067,7 @@ static int __init dock_init(void)
 
 static void __exit dock_exit(void)
 {
-	struct dock_station *dock_station;
-	struct dock_station *tmp;
+	struct dock_station *tmp, *dock_station;
 
 	unregister_acpi_bus_notifier(&dock_acpi_notifier);
 	list_for_each_entry_safe(dock_station, tmp, &dock_stations, sibling)
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index baef28c1e630..d6471bb6852f 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -201,14 +201,13 @@ unlock:
 	spin_unlock_irqrestore(&ec->curr_lock, flags);
 }
 
-static void acpi_ec_gpe_query(void *ec_cxt);
+static int acpi_ec_sync_query(struct acpi_ec *ec);
 
-static int ec_check_sci(struct acpi_ec *ec, u8 state)
+static int ec_check_sci_sync(struct acpi_ec *ec, u8 state)
 {
 	if (state & ACPI_EC_FLAG_SCI) {
 		if (!test_and_set_bit(EC_FLAGS_QUERY_PENDING, &ec->flags))
-			return acpi_os_execute(OSL_EC_BURST_HANDLER,
-				acpi_ec_gpe_query, ec);
+			return acpi_ec_sync_query(ec);
 	}
 	return 0;
 }
@@ -249,11 +248,6 @@ static int acpi_ec_transaction_unlocked(struct acpi_ec *ec,
 {
 	unsigned long tmp;
 	int ret = 0;
-	pr_debug(PREFIX "transaction start\n");
-	/* disable GPE during transaction if storm is detected */
-	if (test_bit(EC_FLAGS_GPE_STORM, &ec->flags)) {
-		acpi_disable_gpe(NULL, ec->gpe);
-	}
 	if (EC_FLAGS_MSI)
 		udelay(ACPI_EC_MSI_UDELAY);
 	/* start transaction */
@@ -265,20 +259,9 @@ static int acpi_ec_transaction_unlocked(struct acpi_ec *ec,
 		clear_bit(EC_FLAGS_QUERY_PENDING, &ec->flags);
 	spin_unlock_irqrestore(&ec->curr_lock, tmp);
 	ret = ec_poll(ec);
-	pr_debug(PREFIX "transaction end\n");
 	spin_lock_irqsave(&ec->curr_lock, tmp);
 	ec->curr = NULL;
 	spin_unlock_irqrestore(&ec->curr_lock, tmp);
-	if (test_bit(EC_FLAGS_GPE_STORM, &ec->flags)) {
-		/* check if we received SCI during transaction */
-		ec_check_sci(ec, acpi_ec_read_status(ec));
-		/* it is safe to enable GPE outside of transaction */
-		acpi_enable_gpe(NULL, ec->gpe);
-	} else if (t->irq_count > ACPI_EC_STORM_THRESHOLD) {
-		pr_info(PREFIX "GPE storm detected, "
-			"transactions will use polling mode\n");
-		set_bit(EC_FLAGS_GPE_STORM, &ec->flags);
-	}
 	return ret;
 }
 
@@ -321,7 +304,26 @@ static int acpi_ec_transaction(struct acpi_ec *ec, struct transaction *t)
 		status = -ETIME;
 		goto end;
 	}
+	pr_debug(PREFIX "transaction start\n");
+	/* disable GPE during transaction if storm is detected */
+	if (test_bit(EC_FLAGS_GPE_STORM, &ec->flags)) {
+		acpi_disable_gpe(NULL, ec->gpe);
+	}
+
 	status = acpi_ec_transaction_unlocked(ec, t);
+
+	/* check if we received SCI during transaction */
+	ec_check_sci_sync(ec, acpi_ec_read_status(ec));
+	if (test_bit(EC_FLAGS_GPE_STORM, &ec->flags)) {
+		msleep(1);
+		/* it is safe to enable GPE outside of transaction */
+		acpi_enable_gpe(NULL, ec->gpe);
+	} else if (t->irq_count > ACPI_EC_STORM_THRESHOLD) {
+		pr_info(PREFIX "GPE storm detected, "
+			"transactions will use polling mode\n");
+		set_bit(EC_FLAGS_GPE_STORM, &ec->flags);
+	}
+	pr_debug(PREFIX "transaction end\n");
 end:
 	if (ec->global_lock)
 		acpi_release_global_lock(glk);
@@ -443,7 +445,7 @@ int ec_transaction(u8 command,
 
 EXPORT_SYMBOL(ec_transaction);
 
-static int acpi_ec_query(struct acpi_ec *ec, u8 * data)
+static int acpi_ec_query_unlocked(struct acpi_ec *ec, u8 * data)
 {
 	int result;
 	u8 d;
@@ -452,20 +454,16 @@ static int acpi_ec_query(struct acpi_ec *ec, u8 * data)
 				.wlen = 0, .rlen = 1};
 	if (!ec || !data)
 		return -EINVAL;
-
 	/*
 	 * Query the EC to find out which _Qxx method we need to evaluate.
 	 * Note that successful completion of the query causes the ACPI_EC_SCI
 	 * bit to be cleared (and thus clearing the interrupt source).
 	 */
-
-	result = acpi_ec_transaction(ec, &t);
+	result = acpi_ec_transaction_unlocked(ec, &t);
 	if (result)
 		return result;
-
 	if (!d)
 		return -ENODATA;
-
 	*data = d;
 	return 0;
 }
@@ -509,43 +507,79 @@ void acpi_ec_remove_query_handler(struct acpi_ec *ec, u8 query_bit)
 
 EXPORT_SYMBOL_GPL(acpi_ec_remove_query_handler);
 
-static void acpi_ec_gpe_query(void *ec_cxt)
+static void acpi_ec_run(void *cxt)
 {
-	struct acpi_ec *ec = ec_cxt;
-	u8 value = 0;
-	struct acpi_ec_query_handler *handler, copy;
-
-	if (!ec || acpi_ec_query(ec, &value))
+	struct acpi_ec_query_handler *handler = cxt;
+	if (!handler)
 		return;
-	mutex_lock(&ec->lock);
+	pr_debug(PREFIX "start query execution\n");
+	if (handler->func)
+		handler->func(handler->data);
+	else if (handler->handle)
+		acpi_evaluate_object(handler->handle, NULL, NULL, NULL);
+	pr_debug(PREFIX "stop query execution\n");
+	kfree(handler);
+}
+
+static int acpi_ec_sync_query(struct acpi_ec *ec)
+{
+	u8 value = 0;
+	int status;
+	struct acpi_ec_query_handler *handler, *copy;
+	if ((status = acpi_ec_query_unlocked(ec, &value)))
+		return status;
 	list_for_each_entry(handler, &ec->list, node) {
 		if (value == handler->query_bit) {
 			/* have custom handler for this bit */
-			memcpy(&copy, handler, sizeof(copy));
-			mutex_unlock(&ec->lock);
-			if (copy.func) {
-				copy.func(copy.data);
-			} else if (copy.handle) {
-				acpi_evaluate_object(copy.handle, NULL, NULL, NULL);
-			}
-			return;
+			copy = kmalloc(sizeof(*handler), GFP_KERNEL);
+			if (!copy)
+				return -ENOMEM;
+			memcpy(copy, handler, sizeof(*copy));
+			pr_debug(PREFIX "push query execution (0x%2x) on queue\n", value);
+			return acpi_os_execute((copy->func) ?
+				OSL_NOTIFY_HANDLER : OSL_GPE_HANDLER,
+				acpi_ec_run, copy);
 		}
 	}
+	return 0;
+}
+
+static void acpi_ec_gpe_query(void *ec_cxt)
+{
+	struct acpi_ec *ec = ec_cxt;
+	if (!ec)
+		return;
+	mutex_lock(&ec->lock);
+	acpi_ec_sync_query(ec);
 	mutex_unlock(&ec->lock);
 }
 
+static void acpi_ec_gpe_query(void *ec_cxt);
+
+static int ec_check_sci(struct acpi_ec *ec, u8 state)
+{
+	if (state & ACPI_EC_FLAG_SCI) {
+		if (!test_and_set_bit(EC_FLAGS_QUERY_PENDING, &ec->flags)) {
+			pr_debug(PREFIX "push gpe query to the queue\n");
+			return acpi_os_execute(OSL_NOTIFY_HANDLER,
+				acpi_ec_gpe_query, ec);
+		}
+	}
+	return 0;
+}
+
 static u32 acpi_ec_gpe_handler(void *data)
 {
 	struct acpi_ec *ec = data;
-	u8 status;
 
 	pr_debug(PREFIX "~~~> interrupt\n");
-	status = acpi_ec_read_status(ec);
 
-	advance_transaction(ec, status);
-	if (ec_transaction_done(ec) && (status & ACPI_EC_FLAG_IBF) == 0)
+	advance_transaction(ec, acpi_ec_read_status(ec));
+	if (ec_transaction_done(ec) &&
+	    (acpi_ec_read_status(ec) & ACPI_EC_FLAG_IBF) == 0) {
 		wake_up(&ec->wait);
-	ec_check_sci(ec, status);
+		ec_check_sci(ec, acpi_ec_read_status(ec));
+	}
 	return ACPI_INTERRUPT_HANDLED;
 }
 
@@ -820,7 +854,7 @@ static int acpi_ec_add(struct acpi_device *device)
 
 	/* Find and register all query methods */
 	acpi_walk_namespace(ACPI_TYPE_METHOD, ec->handle, 1,
-			    acpi_ec_register_query_methods, ec, NULL);
+			    acpi_ec_register_query_methods, NULL, ec, NULL);
 
 	if (!first_ec)
 		first_ec = ec;
@@ -916,6 +950,7 @@ static int ec_validate_ecdt(const struct dmi_system_id *id)
 /* MSI EC needs special treatment, enable it */
 static int ec_flag_msi(const struct dmi_system_id *id)
 {
+	printk(KERN_DEBUG PREFIX "Detected MSI hardware, enabling workarounds.\n");
 	EC_FLAGS_MSI = 1;
 	EC_FLAGS_VALIDATE_ECDT = 1;
 	return 0;
@@ -928,8 +963,13 @@ static struct dmi_system_id __initdata ec_dmi_table[] = {
 	DMI_MATCH(DMI_BOARD_NAME, "JFL92") }, NULL},
 	{
 	ec_flag_msi, "MSI hardware", {
-	DMI_MATCH(DMI_BIOS_VENDOR, "Micro-Star"),
-	DMI_MATCH(DMI_CHASSIS_VENDOR, "MICRO-Star") }, NULL},
+	DMI_MATCH(DMI_BIOS_VENDOR, "Micro-Star")}, NULL},
+	{
+	ec_flag_msi, "MSI hardware", {
+	DMI_MATCH(DMI_SYS_VENDOR, "Micro-Star")}, NULL},
+	{
+	ec_flag_msi, "MSI hardware", {
+	DMI_MATCH(DMI_CHASSIS_VENDOR, "MICRO-Star")}, NULL},
 	{
 	ec_validate_ecdt, "ASUS hardware", {
 	DMI_MATCH(DMI_BIOS_VENDOR, "ASUS") }, NULL},
diff --git a/drivers/acpi/fan.c b/drivers/acpi/fan.c
index f419849a0d3f..acf2ab249842 100644
--- a/drivers/acpi/fan.c
+++ b/drivers/acpi/fan.c
@@ -267,7 +267,7 @@ static int acpi_fan_add(struct acpi_device *device)
 		goto end;
 	}
 
-	dev_info(&device->dev, "registered as cooling_device%d\n", cdev->id);
+	dev_dbg(&device->dev, "registered as cooling_device%d\n", cdev->id);
 
 	device->driver_data = cdev;
 	result = sysfs_create_link(&device->dev.kobj,
diff --git a/drivers/acpi/glue.c b/drivers/acpi/glue.c
index c6645f26224b..4c8fcff662cf 100644
--- a/drivers/acpi/glue.c
+++ b/drivers/acpi/glue.c
@@ -113,7 +113,7 @@ acpi_handle acpi_get_child(acpi_handle parent, acpi_integer address)
 	if (!parent)
 		return NULL;
 	acpi_walk_namespace(ACPI_TYPE_DEVICE, parent,
-			    1, do_acpi_find_child, &find, NULL);
+			    1, do_acpi_find_child, NULL, &find, NULL);
 	return find.handle;
 }
 
diff --git a/drivers/acpi/hest.c b/drivers/acpi/hest.c
new file mode 100644
index 000000000000..4bb18c980ac6
--- /dev/null
+++ b/drivers/acpi/hest.c
@@ -0,0 +1,135 @@
+#include <linux/acpi.h>
+#include <linux/pci.h>
+
+#define PREFIX "ACPI: "
+
+static inline unsigned long parse_acpi_hest_ia_machine_check(struct acpi_hest_ia_machine_check *p)
+{
+	return sizeof(*p) +
+		(sizeof(struct acpi_hest_ia_error_bank) * p->num_hardware_banks);
+}
+
+static inline unsigned long parse_acpi_hest_ia_corrected(struct acpi_hest_ia_corrected *p)
+{
+	return sizeof(*p) +
+		(sizeof(struct acpi_hest_ia_error_bank) * p->num_hardware_banks);
+}
+
+static inline unsigned long parse_acpi_hest_ia_nmi(struct acpi_hest_ia_nmi *p)
+{
+	return sizeof(*p);
+}
+
+static inline unsigned long parse_acpi_hest_generic(struct acpi_hest_generic *p)
+{
+	return sizeof(*p);
+}
+
+static inline unsigned int hest_match_pci(struct acpi_hest_aer_common *p, struct pci_dev *pci)
+{
+	return	(0           == pci_domain_nr(pci->bus) &&
+		 p->bus      == pci->bus->number &&
+		 p->device   == PCI_SLOT(pci->devfn) &&
+		 p->function == PCI_FUNC(pci->devfn));
+}
+
+static unsigned long parse_acpi_hest_aer(void *hdr, int type, struct pci_dev *pci, int *firmware_first)
+{
+	struct acpi_hest_aer_common *p = hdr + sizeof(struct acpi_hest_header);
+	unsigned long rc=0;
+	u8 pcie_type = 0;
+	u8 bridge = 0;
+	switch (type) {
+	case ACPI_HEST_TYPE_AER_ROOT_PORT:
+		rc = sizeof(struct acpi_hest_aer_root);
+		pcie_type = PCI_EXP_TYPE_ROOT_PORT;
+		break;
+	case ACPI_HEST_TYPE_AER_ENDPOINT:
+		rc = sizeof(struct acpi_hest_aer);
+		pcie_type = PCI_EXP_TYPE_ENDPOINT;
+		break;
+	case ACPI_HEST_TYPE_AER_BRIDGE:
+		rc = sizeof(struct acpi_hest_aer_bridge);
+		if ((pci->class >> 16) == PCI_BASE_CLASS_BRIDGE)
+			bridge = 1;
+		break;
+	}
+
+	if (p->flags & ACPI_HEST_GLOBAL) {
+		if ((pci->is_pcie && (pci->pcie_type == pcie_type)) || bridge)
+			*firmware_first = !!(p->flags & ACPI_HEST_FIRMWARE_FIRST);
+	}
+	else
+		if (hest_match_pci(p, pci))
+			*firmware_first = !!(p->flags & ACPI_HEST_FIRMWARE_FIRST);
+	return rc;
+}
+
+static int acpi_hest_firmware_first(struct acpi_table_header *stdheader, struct pci_dev *pci)
+{
+	struct acpi_table_hest *hest = (struct acpi_table_hest *)stdheader;
+	void *p = (void *)hest + sizeof(*hest); /* defined by the ACPI 4.0 spec */
+	struct acpi_hest_header *hdr = p;
+
+	int i;
+	int firmware_first = 0;
+	static unsigned char printed_unused = 0;
+	static unsigned char printed_reserved = 0;
+
+	for (i=0, hdr=p; p < (((void *)hest) + hest->header.length) && i < hest->error_source_count; i++) {
+		switch (hdr->type) {
+		case ACPI_HEST_TYPE_IA32_CHECK:
+			p += parse_acpi_hest_ia_machine_check(p);
+			break;
+		case ACPI_HEST_TYPE_IA32_CORRECTED_CHECK:
+			p += parse_acpi_hest_ia_corrected(p);
+			break;
+		case ACPI_HEST_TYPE_IA32_NMI:
+			p += parse_acpi_hest_ia_nmi(p);
+			break;
+		/* These three should never appear */
+		case ACPI_HEST_TYPE_NOT_USED3:
+		case ACPI_HEST_TYPE_NOT_USED4:
+		case ACPI_HEST_TYPE_NOT_USED5:
+			if (!printed_unused) {
+				printk(KERN_DEBUG PREFIX
+				       "HEST Error Source list contains an obsolete type (%d).\n", hdr->type);
+				printed_unused = 1;
+			}
+			break;
+		case ACPI_HEST_TYPE_AER_ROOT_PORT:
+		case ACPI_HEST_TYPE_AER_ENDPOINT:
+		case ACPI_HEST_TYPE_AER_BRIDGE:
+			p += parse_acpi_hest_aer(p, hdr->type, pci, &firmware_first);
+			break;
+		case ACPI_HEST_TYPE_GENERIC_ERROR:
+			p += parse_acpi_hest_generic(p);
+			break;
+		/* These should never appear either */
+		case ACPI_HEST_TYPE_RESERVED:
+		default:
+			if (!printed_reserved) {
+				printk(KERN_DEBUG PREFIX
+				       "HEST Error Source list contains a reserved type (%d).\n", hdr->type);
+				printed_reserved = 1;
+			}
+			break;
+		}
+	}
+	return firmware_first;
+}
+
+int acpi_hest_firmware_first_pci(struct pci_dev *pci)
+{
+	acpi_status status = AE_NOT_FOUND;
+	struct acpi_table_header *hest = NULL;
+	status = acpi_get_table(ACPI_SIG_HEST, 1, &hest);
+
+	if (ACPI_SUCCESS(status)) {
+		if (acpi_hest_firmware_first(hest, pci)) {
+			return 1;
+		}
+	}
+	return 0;
+}
+EXPORT_SYMBOL_GPL(acpi_hest_firmware_first_pci);
diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h
index 074cf8682d52..cb28e0502acc 100644
--- a/drivers/acpi/internal.h
+++ b/drivers/acpi/internal.h
@@ -43,6 +43,7 @@ int acpi_power_transition(struct acpi_device *device, int state);
 extern int acpi_power_nocheck;
 
 int acpi_wakeup_device_init(void);
+void acpi_early_processor_set_pdc(void);
 
 /* --------------------------------------------------------------------------
                                   Embedded Controller
diff --git a/drivers/acpi/numa.c b/drivers/acpi/numa.c
index 202dd0c976a3..7ad48dfc12db 100644
--- a/drivers/acpi/numa.c
+++ b/drivers/acpi/numa.c
@@ -28,6 +28,7 @@
 #include <linux/types.h>
 #include <linux/errno.h>
 #include <linux/acpi.h>
+#include <linux/numa.h>
 #include <acpi/acpi_bus.h>
 
 #define PREFIX "ACPI: "
@@ -40,14 +41,14 @@ static nodemask_t nodes_found_map = NODE_MASK_NONE;
 
 /* maps to convert between proximity domain and logical node ID */
 static int pxm_to_node_map[MAX_PXM_DOMAINS]
-				= { [0 ... MAX_PXM_DOMAINS - 1] = NID_INVAL };
+			= { [0 ... MAX_PXM_DOMAINS - 1] = NUMA_NO_NODE };
 static int node_to_pxm_map[MAX_NUMNODES]
-				= { [0 ... MAX_NUMNODES - 1] = PXM_INVAL };
+			= { [0 ... MAX_NUMNODES - 1] = PXM_INVAL };
 
 int pxm_to_node(int pxm)
 {
 	if (pxm < 0)
-		return NID_INVAL;
+		return NUMA_NO_NODE;
 	return pxm_to_node_map[pxm];
 }
 
@@ -68,9 +69,9 @@ int acpi_map_pxm_to_node(int pxm)
 {
 	int node = pxm_to_node_map[pxm];
 
-	if (node < 0){
+	if (node < 0) {
 		if (nodes_weight(nodes_found_map) >= MAX_NUMNODES)
-			return NID_INVAL;
+			return NUMA_NO_NODE;
 		node = first_unset_node(nodes_found_map);
 		__acpi_map_pxm_to_node(pxm, node);
 		node_set(node, nodes_found_map);
@@ -79,16 +80,6 @@ int acpi_map_pxm_to_node(int pxm)
 	return node;
 }
 
-#if 0
-void __cpuinit acpi_unmap_pxm_to_node(int node)
-{
-	int pxm = node_to_pxm_map[node];
-	pxm_to_node_map[pxm] = NID_INVAL;
-	node_to_pxm_map[node] = PXM_INVAL;
-	node_clear(node, nodes_found_map);
-}
-#endif  /*  0  */
-
 static void __init
 acpi_table_print_srat_entry(struct acpi_subtable_header *header)
 {
@@ -283,22 +274,24 @@ acpi_table_parse_srat(enum acpi_srat_type id,
 
 int __init acpi_numa_init(void)
 {
+	int ret = 0;
+
 	/* SRAT: Static Resource Affinity Table */
 	if (!acpi_table_parse(ACPI_SIG_SRAT, acpi_parse_srat)) {
 		acpi_table_parse_srat(ACPI_SRAT_TYPE_X2APIC_CPU_AFFINITY,
 				      acpi_parse_x2apic_affinity, NR_CPUS);
 		acpi_table_parse_srat(ACPI_SRAT_TYPE_CPU_AFFINITY,
 				      acpi_parse_processor_affinity, NR_CPUS);
-		acpi_table_parse_srat(ACPI_SRAT_TYPE_MEMORY_AFFINITY,
-				      acpi_parse_memory_affinity,
-				      NR_NODE_MEMBLKS);
+		ret = acpi_table_parse_srat(ACPI_SRAT_TYPE_MEMORY_AFFINITY,
+					    acpi_parse_memory_affinity,
+					    NR_NODE_MEMBLKS);
 	}
 
 	/* SLIT: System Locality Information Table */
 	acpi_table_parse(ACPI_SIG_SLIT, acpi_parse_slit);
 
 	acpi_numa_arch_fixup();
-	return 0;
+	return ret;
 }
 
 int acpi_get_pxm(acpi_handle h)
diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
index 7c1c59ea9ec6..02e8464e480f 100644
--- a/drivers/acpi/osl.c
+++ b/drivers/acpi/osl.c
@@ -1118,7 +1118,7 @@ __setup("acpi_enforce_resources=", acpi_enforce_resources_setup);
 
 /* Check for resource conflicts between ACPI OperationRegions and native
  * drivers */
-int acpi_check_resource_conflict(struct resource *res)
+int acpi_check_resource_conflict(const struct resource *res)
 {
 	struct acpi_res_list *res_list_elem;
 	int ioport;
diff --git a/drivers/acpi/pci_link.c b/drivers/acpi/pci_link.c
index 394ae89409c2..04b0f007c9b7 100644
--- a/drivers/acpi/pci_link.c
+++ b/drivers/acpi/pci_link.c
@@ -56,7 +56,7 @@ ACPI_MODULE_NAME("pci_link");
 static int acpi_pci_link_add(struct acpi_device *device);
 static int acpi_pci_link_remove(struct acpi_device *device, int type);
 
-static struct acpi_device_id link_device_ids[] = {
+static const struct acpi_device_id link_device_ids[] = {
 	{"PNP0C0F", 0},
 	{"", 0},
 };
diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c
index 1af808171d46..64f55b6db73c 100644
--- a/drivers/acpi/pci_root.c
+++ b/drivers/acpi/pci_root.c
@@ -46,7 +46,7 @@ static int acpi_pci_root_add(struct acpi_device *device);
 static int acpi_pci_root_remove(struct acpi_device *device, int type);
 static int acpi_pci_root_start(struct acpi_device *device);
 
-static struct acpi_device_id root_device_ids[] = {
+static const struct acpi_device_id root_device_ids[] = {
 	{"PNP0A03", 0},
 	{"", 0},
 };
@@ -202,72 +202,24 @@ static void acpi_pci_bridge_scan(struct acpi_device *device)
 		}
 }
 
-static u8 OSC_UUID[16] = {0x5B, 0x4D, 0xDB, 0x33, 0xF7, 0x1F, 0x1C, 0x40,
-			  0x96, 0x57, 0x74, 0x41, 0xC0, 0x3D, 0xD7, 0x66};
+static u8 pci_osc_uuid_str[] = "33DB4D5B-1FF7-401C-9657-7441C03DD766";
 
 static acpi_status acpi_pci_run_osc(acpi_handle handle,
 				    const u32 *capbuf, u32 *retval)
 {
+	struct acpi_osc_context context = {
+		.uuid_str = pci_osc_uuid_str,
+		.rev = 1,
+		.cap.length = 12,
+		.cap.pointer = (void *)capbuf,
+	};
 	acpi_status status;
-	struct acpi_object_list input;
-	union acpi_object in_params[4];
-	struct acpi_buffer output = {ACPI_ALLOCATE_BUFFER, NULL};
-	union acpi_object *out_obj;
-	u32 errors;
-
-	/* Setting up input parameters */
-	input.count = 4;
-	input.pointer = in_params;
-	in_params[0].type 		= ACPI_TYPE_BUFFER;
-	in_params[0].buffer.length 	= 16;
-	in_params[0].buffer.pointer	= OSC_UUID;
-	in_params[1].type 		= ACPI_TYPE_INTEGER;
-	in_params[1].integer.value 	= 1;
-	in_params[2].type 		= ACPI_TYPE_INTEGER;
-	in_params[2].integer.value	= 3;
-	in_params[3].type		= ACPI_TYPE_BUFFER;
-	in_params[3].buffer.length 	= 12;
-	in_params[3].buffer.pointer 	= (u8 *)capbuf;
-
-	status = acpi_evaluate_object(handle, "_OSC", &input, &output);
-	if (ACPI_FAILURE(status))
-		return status;
 
-	if (!output.length)
-		return AE_NULL_OBJECT;
-
-	out_obj = output.pointer;
-	if (out_obj->type != ACPI_TYPE_BUFFER) {
-		printk(KERN_DEBUG "_OSC evaluation returned wrong type\n");
-		status = AE_TYPE;
-		goto out_kfree;
-	}
-	/* Need to ignore the bit0 in result code */
-	errors = *((u32 *)out_obj->buffer.pointer) & ~(1 << 0);
-	if (errors) {
-		if (errors & OSC_REQUEST_ERROR)
-			printk(KERN_DEBUG "_OSC request failed\n");
-		if (errors & OSC_INVALID_UUID_ERROR)
-			printk(KERN_DEBUG "_OSC invalid UUID\n");
-		if (errors & OSC_INVALID_REVISION_ERROR)
-			printk(KERN_DEBUG "_OSC invalid revision\n");
-		if (errors & OSC_CAPABILITIES_MASK_ERROR) {
-			if (capbuf[OSC_QUERY_TYPE] & OSC_QUERY_ENABLE)
-				goto out_success;
-			printk(KERN_DEBUG
-			       "Firmware did not grant requested _OSC control\n");
-			status = AE_SUPPORT;
-			goto out_kfree;
-		}
-		status = AE_ERROR;
-		goto out_kfree;
+	status = acpi_run_osc(handle, &context);
+	if (ACPI_SUCCESS(status)) {
+		*retval = *((u32 *)(context.ret.pointer + 8));
+		kfree(context.ret.pointer);
 	}
-out_success:
-	*retval = *((u32 *)(out_obj->buffer.pointer + 8));
-	status = AE_OK;
-
-out_kfree:
-	kfree(output.pointer);
 	return status;
 }
 
@@ -277,10 +229,10 @@ static acpi_status acpi_pci_query_osc(struct acpi_pci_root *root, u32 flags)
 	u32 support_set, result, capbuf[3];
 
 	/* do _OSC query for all possible controls */
-	support_set = root->osc_support_set | (flags & OSC_SUPPORT_MASKS);
+	support_set = root->osc_support_set | (flags & OSC_PCI_SUPPORT_MASKS);
 	capbuf[OSC_QUERY_TYPE] = OSC_QUERY_ENABLE;
 	capbuf[OSC_SUPPORT_TYPE] = support_set;
-	capbuf[OSC_CONTROL_TYPE] = OSC_CONTROL_MASKS;
+	capbuf[OSC_CONTROL_TYPE] = OSC_PCI_CONTROL_MASKS;
 
 	status = acpi_pci_run_osc(root->device->handle, capbuf, &result);
 	if (ACPI_SUCCESS(status)) {
@@ -427,7 +379,7 @@ acpi_status acpi_pci_osc_control_set(acpi_handle handle, u32 flags)
 	if (ACPI_FAILURE(status))
 		return status;
 
-	control_req = (flags & OSC_CONTROL_MASKS);
+	control_req = (flags & OSC_PCI_CONTROL_MASKS);
 	if (!control_req)
 		return AE_TYPE;
 
diff --git a/drivers/acpi/pci_slot.c b/drivers/acpi/pci_slot.c
index 45da2bae36c8..11f219743204 100644
--- a/drivers/acpi/pci_slot.c
+++ b/drivers/acpi/pci_slot.c
@@ -219,12 +219,12 @@ walk_p2p_bridge(acpi_handle handle, u32 lvl, void *context, void **rv)
 
 	dbg("p2p bridge walk, pci_bus = %x\n", dev->subordinate->number);
 	status = acpi_walk_namespace(ACPI_TYPE_DEVICE, handle, (u32)1,
-				     user_function, &child_context, NULL);
+				     user_function, NULL, &child_context, NULL);
 	if (ACPI_FAILURE(status))
 		goto out;
 
 	status = acpi_walk_namespace(ACPI_TYPE_DEVICE, handle, (u32)1,
-				     walk_p2p_bridge, &child_context, NULL);
+				     walk_p2p_bridge, NULL, &child_context, NULL);
 out:
 	pci_dev_put(dev);
 	return AE_OK;
@@ -277,12 +277,12 @@ walk_root_bridge(acpi_handle handle, acpi_walk_callback user_function)
 
 	dbg("root bridge walk, pci_bus = %x\n", pci_bus->number);
 	status = acpi_walk_namespace(ACPI_TYPE_DEVICE, handle, (u32)1,
-				     user_function, &context, NULL);
+				     user_function, NULL, &context, NULL);
 	if (ACPI_FAILURE(status))
 		return status;
 
 	status = acpi_walk_namespace(ACPI_TYPE_DEVICE, handle, (u32)1,
-				     walk_p2p_bridge, &context, NULL);
+				     walk_p2p_bridge, NULL, &context, NULL);
 	if (ACPI_FAILURE(status))
 		err("%s: walk_p2p_bridge failure - %d\n", __func__, status);
 
diff --git a/drivers/acpi/power.c b/drivers/acpi/power.c
index 22b297916519..0f30c3c1eea4 100644
--- a/drivers/acpi/power.c
+++ b/drivers/acpi/power.c
@@ -65,7 +65,7 @@ static int acpi_power_remove(struct acpi_device *device, int type);
 static int acpi_power_resume(struct acpi_device *device);
 static int acpi_power_open_fs(struct inode *inode, struct file *file);
 
-static struct acpi_device_id power_device_ids[] = {
+static const struct acpi_device_id power_device_ids[] = {
 	{ACPI_POWER_HID, 0},
 	{"", 0},
 };
diff --git a/drivers/acpi/power_meter.c b/drivers/acpi/power_meter.c
index 2ef7030a0c28..dc4ffadf8122 100644
--- a/drivers/acpi/power_meter.c
+++ b/drivers/acpi/power_meter.c
@@ -64,7 +64,7 @@ static int can_cap_in_hardware(void)
 	return force_cap_on || cap_in_hardware;
 }
 
-static struct acpi_device_id power_meter_ids[] = {
+static const struct acpi_device_id power_meter_ids[] = {
 	{"ACPI000D", 0},
 	{"", 0},
 };
@@ -534,6 +534,7 @@ static void remove_domain_devices(struct acpi_power_meter_resource *resource)
 
 	kfree(resource->domain_devices);
 	kobject_put(resource->holders_dir);
+	resource->num_domain_devices = 0;
 }
 
 static int read_domain_devices(struct acpi_power_meter_resource *resource)
@@ -740,7 +741,6 @@ skip_unsafe_cap:
 
 	return res;
 error:
-	remove_domain_devices(resource);
 	remove_attrs(resource);
 	return res;
 }
diff --git a/drivers/acpi/processor_core.c b/drivers/acpi/processor_core.c
index ec742a4e5635..9863c98c81ba 100644
--- a/drivers/acpi/processor_core.c
+++ b/drivers/acpi/processor_core.c
@@ -124,29 +124,6 @@ static const struct file_operations acpi_processor_info_fops = {
 
 DEFINE_PER_CPU(struct acpi_processor *, processors);
 struct acpi_processor_errata errata __read_mostly;
-static int set_no_mwait(const struct dmi_system_id *id)
-{
-	printk(KERN_NOTICE PREFIX "%s detected - "
-		"disabling mwait for CPU C-states\n", id->ident);
-	idle_nomwait = 1;
-	return 0;
-}
-
-static struct dmi_system_id __cpuinitdata processor_idle_dmi_table[] = {
-	{
-	set_no_mwait, "IFL91 board", {
-	DMI_MATCH(DMI_BIOS_VENDOR, "COMPAL"),
-	DMI_MATCH(DMI_SYS_VENDOR, "ZEPTO"),
-	DMI_MATCH(DMI_PRODUCT_VERSION, "3215W"),
-	DMI_MATCH(DMI_BOARD_NAME, "IFL91") }, NULL},
-	{
-	set_no_mwait, "Extensa 5220", {
-	DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies LTD"),
-	DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
-	DMI_MATCH(DMI_PRODUCT_VERSION, "0100"),
-	DMI_MATCH(DMI_BOARD_NAME, "Columbia") }, NULL},
-	{},
-};
 
 /* --------------------------------------------------------------------------
                                 Errata Handling
@@ -277,45 +254,6 @@ static int acpi_processor_errata(struct acpi_processor *pr)
 }
 
 /* --------------------------------------------------------------------------
-                              Common ACPI processor functions
-   -------------------------------------------------------------------------- */
-
-/*
- * _PDC is required for a BIOS-OS handshake for most of the newer
- * ACPI processor features.
- */
-static int acpi_processor_set_pdc(struct acpi_processor *pr)
-{
-	struct acpi_object_list *pdc_in = pr->pdc;
-	acpi_status status = AE_OK;
-
-
-	if (!pdc_in)
-		return status;
-	if (idle_nomwait) {
-		/*
-		 * If mwait is disabled for CPU C-states, the C2C3_FFH access
-		 * mode will be disabled in the parameter of _PDC object.
-		 * Of course C1_FFH access mode will also be disabled.
-		 */
-		union acpi_object *obj;
-		u32 *buffer = NULL;
-
-		obj = pdc_in->pointer;
-		buffer = (u32 *)(obj->buffer.pointer);
-		buffer[2] &= ~(ACPI_PDC_C_C2C3_FFH | ACPI_PDC_C_C1_FFH);
-
-	}
-	status = acpi_evaluate_object(pr->handle, "_PDC", pdc_in, NULL);
-
-	if (ACPI_FAILURE(status))
-		ACPI_DEBUG_PRINT((ACPI_DB_INFO,
-		    "Could not evaluate _PDC, using legacy perf. control...\n"));
-
-	return status;
-}
-
-/* --------------------------------------------------------------------------
                               FS Interface (/proc)
    -------------------------------------------------------------------------- */
 
@@ -353,7 +291,7 @@ static int acpi_processor_info_open_fs(struct inode *inode, struct file *file)
 			   PDE(inode)->data);
 }
 
-static int acpi_processor_add_fs(struct acpi_device *device)
+static int __cpuinit acpi_processor_add_fs(struct acpi_device *device)
 {
 	struct proc_dir_entry *entry = NULL;
 
@@ -722,7 +660,7 @@ static void acpi_processor_notify(struct acpi_device *device, u32 event)
 	switch (event) {
 	case ACPI_PROCESSOR_NOTIFY_PERFORMANCE:
 		saved = pr->performance_platform_limit;
-		acpi_processor_ppc_has_changed(pr);
+		acpi_processor_ppc_has_changed(pr, 1);
 		if (saved == pr->performance_platform_limit)
 			break;
 		acpi_bus_generate_proc_event(device, event,
@@ -758,7 +696,7 @@ static int acpi_cpu_soft_notify(struct notifier_block *nfb,
 	struct acpi_processor *pr = per_cpu(processors, cpu);
 
 	if (action == CPU_ONLINE && pr) {
-		acpi_processor_ppc_has_changed(pr);
+		acpi_processor_ppc_has_changed(pr, 0);
 		acpi_processor_cst_has_changed(pr);
 		acpi_processor_tstate_has_changed(pr);
 	}
@@ -825,12 +763,10 @@ static int __cpuinit acpi_processor_add(struct acpi_device *device)
 	}
 
 	/* _PDC call should be done before doing anything else (if reqd.). */
-	arch_acpi_processor_init_pdc(pr);
-	acpi_processor_set_pdc(pr);
-	arch_acpi_processor_cleanup_pdc(pr);
+	acpi_processor_set_pdc(pr->handle);
 
 #ifdef CONFIG_CPU_FREQ
-	acpi_processor_ppc_has_changed(pr);
+	acpi_processor_ppc_has_changed(pr, 0);
 #endif
 	acpi_processor_get_throttling_info(pr);
 	acpi_processor_get_limit_info(pr);
@@ -845,7 +781,7 @@ static int __cpuinit acpi_processor_add(struct acpi_device *device)
 		goto err_power_exit;
 	}
 
-	dev_info(&device->dev, "registered as cooling_device%d\n",
+	dev_dbg(&device->dev, "registered as cooling_device%d\n",
 		 pr->cdev->id);
 
 	result = sysfs_create_link(&device->dev.kobj,
@@ -1102,7 +1038,7 @@ void acpi_processor_install_hotplug_notify(void)
 	acpi_walk_namespace(ACPI_TYPE_PROCESSOR,
 			    ACPI_ROOT_OBJECT,
 			    ACPI_UINT32_MAX,
-			    processor_walk_namespace_cb, &action, NULL);
+			    processor_walk_namespace_cb, NULL, &action, NULL);
 #endif
 	register_hotcpu_notifier(&acpi_cpu_notifier);
 }
@@ -1115,7 +1051,7 @@ void acpi_processor_uninstall_hotplug_notify(void)
 	acpi_walk_namespace(ACPI_TYPE_PROCESSOR,
 			    ACPI_ROOT_OBJECT,
 			    ACPI_UINT32_MAX,
-			    processor_walk_namespace_cb, &action, NULL);
+			    processor_walk_namespace_cb, NULL, &action, NULL);
 #endif
 	unregister_hotcpu_notifier(&acpi_cpu_notifier);
 }
@@ -1145,11 +1081,6 @@ static int __init acpi_processor_init(void)
 	if (!acpi_processor_dir)
 		return -ENOMEM;
 #endif
-	/*
-	 * Check whether the system is DMI table. If yes, OSPM
-	 * should not use mwait for CPU-states.
-	 */
-	dmi_check_system(processor_idle_dmi_table);
 	result = cpuidle_register_driver(&acpi_idle_driver);
 	if (result < 0)
 		goto out_proc;
diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index bbd066e7f854..7c0441f63b39 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -164,7 +164,7 @@ static void lapic_timer_check_state(int state, struct acpi_processor *pr,
 		pr->power.timer_broadcast_on_state = state;
 }
 
-static void lapic_timer_propagate_broadcast(void *arg)
+static void __lapic_timer_propagate_broadcast(void *arg)
 {
 	struct acpi_processor *pr = (struct acpi_processor *) arg;
 	unsigned long reason;
@@ -175,6 +175,12 @@ static void lapic_timer_propagate_broadcast(void *arg)
 	clockevents_notify(reason, &pr->id);
 }
 
+static void lapic_timer_propagate_broadcast(struct acpi_processor *pr)
+{
+	smp_call_function_single(pr->id, __lapic_timer_propagate_broadcast,
+				 (void *)pr, 1);
+}
+
 /* Power(C) State timer broadcast control */
 static void lapic_timer_state_broadcast(struct acpi_processor *pr,
 				       struct acpi_processor_cx *cx,
@@ -299,6 +305,28 @@ static int acpi_processor_get_power_info_fadt(struct acpi_processor *pr)
 	pr->power.states[ACPI_STATE_C2].latency = acpi_gbl_FADT.C2latency;
 	pr->power.states[ACPI_STATE_C3].latency = acpi_gbl_FADT.C3latency;
 
+	/*
+	 * FADT specified C2 latency must be less than or equal to
+	 * 100 microseconds.
+	 */
+	if (acpi_gbl_FADT.C2latency > ACPI_PROCESSOR_MAX_C2_LATENCY) {
+		ACPI_DEBUG_PRINT((ACPI_DB_INFO,
+			"C2 latency too large [%d]\n", acpi_gbl_FADT.C2latency));
+		/* invalidate C2 */
+		pr->power.states[ACPI_STATE_C2].address = 0;
+	}
+
+	/*
+	 * FADT supplied C3 latency must be less than or equal to
+	 * 1000 microseconds.
+	 */
+	if (acpi_gbl_FADT.C3latency > ACPI_PROCESSOR_MAX_C3_LATENCY) {
+		ACPI_DEBUG_PRINT((ACPI_DB_INFO,
+			"C3 latency too large [%d]\n", acpi_gbl_FADT.C3latency));
+		/* invalidate C3 */
+		pr->power.states[ACPI_STATE_C3].address = 0;
+	}
+
 	ACPI_DEBUG_PRINT((ACPI_DB_INFO,
 			  "lvl2[0x%08x] lvl3[0x%08x]\n",
 			  pr->power.states[ACPI_STATE_C2].address,
@@ -488,33 +516,6 @@ static int acpi_processor_get_power_info_cst(struct acpi_processor *pr)
 	return status;
 }
 
-static void acpi_processor_power_verify_c2(struct acpi_processor_cx *cx)
-{
-
-	if (!cx->address)
-		return;
-
-	/*
-	 * C2 latency must be less than or equal to 100
-	 * microseconds.
-	 */
-	else if (cx->latency > ACPI_PROCESSOR_MAX_C2_LATENCY) {
-		ACPI_DEBUG_PRINT((ACPI_DB_INFO,
-				  "latency too large [%d]\n", cx->latency));
-		return;
-	}
-
-	/*
-	 * Otherwise we've met all of our C2 requirements.
-	 * Normalize the C2 latency to expidite policy
-	 */
-	cx->valid = 1;
-
-	cx->latency_ticks = cx->latency;
-
-	return;
-}
-
 static void acpi_processor_power_verify_c3(struct acpi_processor *pr,
 					   struct acpi_processor_cx *cx)
 {
@@ -526,16 +527,6 @@ static void acpi_processor_power_verify_c3(struct acpi_processor *pr,
 		return;
 
 	/*
-	 * C3 latency must be less than or equal to 1000
-	 * microseconds.
-	 */
-	else if (cx->latency > ACPI_PROCESSOR_MAX_C3_LATENCY) {
-		ACPI_DEBUG_PRINT((ACPI_DB_INFO,
-				  "latency too large [%d]\n", cx->latency));
-		return;
-	}
-
-	/*
 	 * PIIX4 Erratum #18: We don't support C3 when Type-F (fast)
 	 * DMA transfers are used by any ISA device to avoid livelock.
 	 * Note that we could disable Type-F DMA (as recommended by
@@ -623,7 +614,10 @@ static int acpi_processor_power_verify(struct acpi_processor *pr)
 			break;
 
 		case ACPI_STATE_C2:
-			acpi_processor_power_verify_c2(cx);
+			if (!cx->address)
+				break;
+			cx->valid = 1; 
+			cx->latency_ticks = cx->latency; /* Normalize latency */
 			break;
 
 		case ACPI_STATE_C3:
@@ -638,8 +632,7 @@ static int acpi_processor_power_verify(struct acpi_processor *pr)
 		working++;
 	}
 
-	smp_call_function_single(pr->id, lapic_timer_propagate_broadcast,
-				 pr, 1);
+	lapic_timer_propagate_broadcast(pr);
 
 	return (working);
 }
diff --git a/drivers/acpi/processor_pdc.c b/drivers/acpi/processor_pdc.c
new file mode 100644
index 000000000000..7247819dbd80
--- /dev/null
+++ b/drivers/acpi/processor_pdc.c
@@ -0,0 +1,195 @@
+/*
+ * Copyright (C) 2005 Intel Corporation
+ * Copyright (C) 2009 Hewlett-Packard Development Company, L.P.
+ *
+ *	Alex Chiang <achiang@hp.com>
+ *	- Unified x86/ia64 implementations
+ *	Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>
+ *	- Added _PDC for platforms with Intel CPUs
+ */
+#include <linux/dmi.h>
+
+#include <acpi/acpi_drivers.h>
+#include <acpi/processor.h>
+
+#include "internal.h"
+
+#define PREFIX			"ACPI: "
+#define _COMPONENT		ACPI_PROCESSOR_COMPONENT
+ACPI_MODULE_NAME("processor_pdc");
+
+static int set_no_mwait(const struct dmi_system_id *id)
+{
+	printk(KERN_NOTICE PREFIX "%s detected - "
+		"disabling mwait for CPU C-states\n", id->ident);
+	idle_nomwait = 1;
+	return 0;
+}
+
+static struct dmi_system_id __cpuinitdata processor_idle_dmi_table[] = {
+	{
+	set_no_mwait, "IFL91 board", {
+	DMI_MATCH(DMI_BIOS_VENDOR, "COMPAL"),
+	DMI_MATCH(DMI_SYS_VENDOR, "ZEPTO"),
+	DMI_MATCH(DMI_PRODUCT_VERSION, "3215W"),
+	DMI_MATCH(DMI_BOARD_NAME, "IFL91") }, NULL},
+	{
+	set_no_mwait, "Extensa 5220", {
+	DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies LTD"),
+	DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+	DMI_MATCH(DMI_PRODUCT_VERSION, "0100"),
+	DMI_MATCH(DMI_BOARD_NAME, "Columbia") }, NULL},
+	{},
+};
+
+static void acpi_set_pdc_bits(u32 *buf)
+{
+	buf[0] = ACPI_PDC_REVISION_ID;
+	buf[1] = 1;
+
+	/* Enable coordination with firmware's _TSD info */
+	buf[2] = ACPI_PDC_SMP_T_SWCOORD;
+
+	/* Twiddle arch-specific bits needed for _PDC */
+	arch_acpi_set_pdc_bits(buf);
+}
+
+static struct acpi_object_list *acpi_processor_alloc_pdc(void)
+{
+	struct acpi_object_list *obj_list;
+	union acpi_object *obj;
+	u32 *buf;
+
+	/* allocate and initialize pdc. It will be used later. */
+	obj_list = kmalloc(sizeof(struct acpi_object_list), GFP_KERNEL);
+	if (!obj_list) {
+		printk(KERN_ERR "Memory allocation error\n");
+		return NULL;
+	}
+
+	obj = kmalloc(sizeof(union acpi_object), GFP_KERNEL);
+	if (!obj) {
+		printk(KERN_ERR "Memory allocation error\n");
+		kfree(obj_list);
+		return NULL;
+	}
+
+	buf = kmalloc(12, GFP_KERNEL);
+	if (!buf) {
+		printk(KERN_ERR "Memory allocation error\n");
+		kfree(obj);
+		kfree(obj_list);
+		return NULL;
+	}
+
+	acpi_set_pdc_bits(buf);
+
+	obj->type = ACPI_TYPE_BUFFER;
+	obj->buffer.length = 12;
+	obj->buffer.pointer = (u8 *) buf;
+	obj_list->count = 1;
+	obj_list->pointer = obj;
+
+	return obj_list;
+}
+
+/*
+ * _PDC is required for a BIOS-OS handshake for most of the newer
+ * ACPI processor features.
+ */
+static int
+acpi_processor_eval_pdc(acpi_handle handle, struct acpi_object_list *pdc_in)
+{
+	acpi_status status = AE_OK;
+
+	if (idle_nomwait) {
+		/*
+		 * If mwait is disabled for CPU C-states, the C2C3_FFH access
+		 * mode will be disabled in the parameter of _PDC object.
+		 * Of course C1_FFH access mode will also be disabled.
+		 */
+		union acpi_object *obj;
+		u32 *buffer = NULL;
+
+		obj = pdc_in->pointer;
+		buffer = (u32 *)(obj->buffer.pointer);
+		buffer[2] &= ~(ACPI_PDC_C_C2C3_FFH | ACPI_PDC_C_C1_FFH);
+
+	}
+	status = acpi_evaluate_object(handle, "_PDC", pdc_in, NULL);
+
+	if (ACPI_FAILURE(status))
+		ACPI_DEBUG_PRINT((ACPI_DB_INFO,
+		    "Could not evaluate _PDC, using legacy perf. control.\n"));
+
+	return status;
+}
+
+void acpi_processor_set_pdc(acpi_handle handle)
+{
+	struct acpi_object_list *obj_list;
+
+	if (arch_has_acpi_pdc() == false)
+		return;
+
+	obj_list = acpi_processor_alloc_pdc();
+	if (!obj_list)
+		return;
+
+	acpi_processor_eval_pdc(handle, obj_list);
+
+	kfree(obj_list->pointer->buffer.pointer);
+	kfree(obj_list->pointer);
+	kfree(obj_list);
+}
+EXPORT_SYMBOL_GPL(acpi_processor_set_pdc);
+
+static int early_pdc_optin;
+static int set_early_pdc_optin(const struct dmi_system_id *id)
+{
+	early_pdc_optin = 1;
+	return 0;
+}
+
+static struct dmi_system_id __cpuinitdata early_pdc_optin_table[] = {
+	{
+	set_early_pdc_optin, "HP Envy", {
+	DMI_MATCH(DMI_BIOS_VENDOR, "Hewlett-Packard"),
+	DMI_MATCH(DMI_PRODUCT_NAME, "HP Envy") }, NULL},
+	{
+	set_early_pdc_optin, "HP Pavilion dv6", {
+	DMI_MATCH(DMI_BIOS_VENDOR, "Hewlett-Packard"),
+	DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv6") }, NULL},
+	{
+	set_early_pdc_optin, "HP Pavilion dv7", {
+	DMI_MATCH(DMI_BIOS_VENDOR, "Hewlett-Packard"),
+	DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv7") }, NULL},
+	{},
+};
+
+static acpi_status
+early_init_pdc(acpi_handle handle, u32 lvl, void *context, void **rv)
+{
+	acpi_processor_set_pdc(handle);
+	return AE_OK;
+}
+
+void __init acpi_early_processor_set_pdc(void)
+{
+	/*
+	 * Check whether the system is DMI table. If yes, OSPM
+	 * should not use mwait for CPU-states.
+	 */
+	dmi_check_system(processor_idle_dmi_table);
+
+	/*
+	 * Allow systems to opt-in to early _PDC evaluation.
+	 */
+	dmi_check_system(early_pdc_optin_table);
+	if (!early_pdc_optin)
+		return;
+
+	acpi_walk_namespace(ACPI_TYPE_PROCESSOR, ACPI_ROOT_OBJECT,
+			    ACPI_UINT32_MAX,
+			    early_init_pdc, NULL, NULL, NULL);
+}
diff --git a/drivers/acpi/processor_perflib.c b/drivers/acpi/processor_perflib.c
index 8ba0ed0b9ddb..2cabadcc4d8c 100644
--- a/drivers/acpi/processor_perflib.c
+++ b/drivers/acpi/processor_perflib.c
@@ -152,21 +152,78 @@ static int acpi_processor_get_platform_limit(struct acpi_processor *pr)
 	return 0;
 }
 
-int acpi_processor_ppc_has_changed(struct acpi_processor *pr)
+#define ACPI_PROCESSOR_NOTIFY_PERFORMANCE	0x80
+/*
+ * acpi_processor_ppc_ost: Notify firmware the _PPC evaluation status
+ * @handle: ACPI processor handle
+ * @status: the status code of _PPC evaluation
+ *	0: success. OSPM is now using the performance state specificed.
+ *	1: failure. OSPM has not changed the number of P-states in use
+ */
+static void acpi_processor_ppc_ost(acpi_handle handle, int status)
+{
+	union acpi_object params[2] = {
+		{.type = ACPI_TYPE_INTEGER,},
+		{.type = ACPI_TYPE_INTEGER,},
+	};
+	struct acpi_object_list arg_list = {2, params};
+	acpi_handle temp;
+
+	params[0].integer.value = ACPI_PROCESSOR_NOTIFY_PERFORMANCE;
+	params[1].integer.value =  status;
+
+	/* when there is no _OST , skip it */
+	if (ACPI_FAILURE(acpi_get_handle(handle, "_OST", &temp)))
+		return;
+
+	acpi_evaluate_object(handle, "_OST", &arg_list, NULL);
+	return;
+}
+
+int acpi_processor_ppc_has_changed(struct acpi_processor *pr, int event_flag)
 {
 	int ret;
 
-	if (ignore_ppc)
+	if (ignore_ppc) {
+		/*
+		 * Only when it is notification event, the _OST object
+		 * will be evaluated. Otherwise it is skipped.
+		 */
+		if (event_flag)
+			acpi_processor_ppc_ost(pr->handle, 1);
 		return 0;
+	}
 
 	ret = acpi_processor_get_platform_limit(pr);
-
+	/*
+	 * Only when it is notification event, the _OST object
+	 * will be evaluated. Otherwise it is skipped.
+	 */
+	if (event_flag) {
+		if (ret < 0)
+			acpi_processor_ppc_ost(pr->handle, 1);
+		else
+			acpi_processor_ppc_ost(pr->handle, 0);
+	}
 	if (ret < 0)
 		return (ret);
 	else
 		return cpufreq_update_policy(pr->id);
 }
 
+int acpi_processor_get_bios_limit(int cpu, unsigned int *limit)
+{
+	struct acpi_processor *pr;
+
+	pr = per_cpu(processors, cpu);
+	if (!pr || !pr->performance || !pr->performance->state_count)
+		return -ENODEV;
+	*limit = pr->performance->states[pr->performance_platform_limit].
+		core_frequency * 1000;
+	return 0;
+}
+EXPORT_SYMBOL(acpi_processor_get_bios_limit);
+
 void acpi_processor_ppc_init(void)
 {
 	if (!cpufreq_register_notifier
diff --git a/drivers/acpi/processor_thermal.c b/drivers/acpi/processor_thermal.c
index 140c5c5b423c..6deafb4aa0da 100644
--- a/drivers/acpi/processor_thermal.c
+++ b/drivers/acpi/processor_thermal.c
@@ -443,8 +443,7 @@ struct thermal_cooling_device_ops processor_cooling_ops = {
 #ifdef CONFIG_ACPI_PROCFS
 static int acpi_processor_limit_seq_show(struct seq_file *seq, void *offset)
 {
-	struct acpi_processor *pr = (struct acpi_processor *)seq->private;
-
+	struct acpi_processor *pr = seq->private;
 
 	if (!pr)
 		goto end;
diff --git a/drivers/acpi/sbs.c b/drivers/acpi/sbs.c
index 52b9db8afc20..b16ddbf23a9c 100644
--- a/drivers/acpi/sbs.c
+++ b/drivers/acpi/sbs.c
@@ -822,7 +822,10 @@ static int acpi_battery_add(struct acpi_sbs *sbs, int id)
 
 static void acpi_battery_remove(struct acpi_sbs *sbs, int id)
 {
+#if defined(CONFIG_ACPI_SYSFS_POWER) || defined(CONFIG_ACPI_PROCFS_POWER)
 	struct acpi_battery *battery = &sbs->battery[id];
+#endif
+
 #ifdef CONFIG_ACPI_SYSFS_POWER
 	if (battery->bat.dev) {
 		if (battery->have_sysfs_alarm)
diff --git a/drivers/acpi/sbshc.c b/drivers/acpi/sbshc.c
index d9339806df45..fd09229282ea 100644
--- a/drivers/acpi/sbshc.c
+++ b/drivers/acpi/sbshc.c
@@ -242,7 +242,7 @@ static int smbus_alarm(void *context)
 		case ACPI_SBS_CHARGER:
 		case ACPI_SBS_MANAGER:
 		case ACPI_SBS_BATTERY:
-			acpi_os_execute(OSL_GPE_HANDLER,
+			acpi_os_execute(OSL_NOTIFY_HANDLER,
 					acpi_smbus_callback, hc);
 		default:;
 	}
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index 14a7481c97d7..ff9f6226085d 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -1332,7 +1332,7 @@ static int acpi_bus_scan(acpi_handle handle, struct acpi_bus_ops *ops,
 	status = acpi_bus_check_add(handle, 0, ops, &device);
 	if (ACPI_SUCCESS(status))
 		acpi_walk_namespace(ACPI_TYPE_ANY, handle, ACPI_UINT32_MAX,
-				    acpi_bus_check_add, ops, &device);
+				    acpi_bus_check_add, NULL, ops, &device);
 
 	if (child)
 		*child = device;
diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
index 5f2c379ab7bf..79d33d908b5a 100644
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -81,6 +81,23 @@ static int acpi_sleep_prepare(u32 acpi_state)
 #ifdef CONFIG_ACPI_SLEEP
 static u32 acpi_target_sleep_state = ACPI_STATE_S0;
 /*
+ * According to the ACPI specification the BIOS should make sure that ACPI is
+ * enabled and SCI_EN bit is set on wake-up from S1 - S3 sleep states.  Still,
+ * some BIOSes don't do that and therefore we use acpi_enable() to enable ACPI
+ * on such systems during resume.  Unfortunately that doesn't help in
+ * particularly pathological cases in which SCI_EN has to be set directly on
+ * resume, although the specification states very clearly that this flag is
+ * owned by the hardware.  The set_sci_en_on_resume variable will be set in such
+ * cases.
+ */
+static bool set_sci_en_on_resume;
+
+void __init acpi_set_sci_en_on_resume(void)
+{
+	set_sci_en_on_resume = true;
+}
+
+/*
  * ACPI 1.0 wants us to execute _PTS before suspending devices, so we allow the
  * user to request that behavior by using the 'acpi_old_suspend_ordering'
  * kernel command line option that causes the following variable to be set.
@@ -170,18 +187,6 @@ static void acpi_pm_end(void)
 #endif /* CONFIG_ACPI_SLEEP */
 
 #ifdef CONFIG_SUSPEND
-/*
- * According to the ACPI specification the BIOS should make sure that ACPI is
- * enabled and SCI_EN bit is set on wake-up from S1 - S3 sleep states.  Still,
- * some BIOSes don't do that and therefore we use acpi_enable() to enable ACPI
- * on such systems during resume.  Unfortunately that doesn't help in
- * particularly pathological cases in which SCI_EN has to be set directly on
- * resume, although the specification states very clearly that this flag is
- * owned by the hardware.  The set_sci_en_on_resume variable will be set in such
- * cases.
- */
-static bool set_sci_en_on_resume;
-
 extern void do_suspend_lowlevel(void);
 
 static u32 acpi_suspend_states[] = {
diff --git a/drivers/acpi/thermal.c b/drivers/acpi/thermal.c
index 65f67815902a..9073ada88835 100644
--- a/drivers/acpi/thermal.c
+++ b/drivers/acpi/thermal.c
@@ -1052,6 +1052,13 @@ static int acpi_thermal_trip_seq_show(struct seq_file *seq, void *offset)
 				   acpi_device_bid(device));
 		}
 		seq_puts(seq, "\n");
+	} else {
+		seq_printf(seq, "passive (forced):");
+		if (tz->thermal_zone->forced_passive)
+			seq_printf(seq, "        %i C\n",
+				   tz->thermal_zone->forced_passive / 1000);
+		else
+			seq_printf(seq, "<not set>\n");
 	}
 
 	for (i = 0; i < ACPI_THERMAL_MAX_ACTIVE; i++) {
diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
index 05dff631591c..b765790b32be 100644
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -78,6 +78,13 @@ MODULE_LICENSE("GPL");
 static int brightness_switch_enabled = 1;
 module_param(brightness_switch_enabled, bool, 0644);
 
+/*
+ * By default, we don't allow duplicate ACPI video bus devices
+ * under the same VGA controller
+ */
+static int allow_duplicates;
+module_param(allow_duplicates, bool, 0644);
+
 static int register_count = 0;
 static int acpi_video_bus_add(struct acpi_device *device);
 static int acpi_video_bus_remove(struct acpi_device *device, int type);
@@ -999,8 +1006,10 @@ static void acpi_video_device_find_cap(struct acpi_video_device *device)
 		sprintf(name, "acpi_video%d", count++);
 		device->backlight = backlight_device_register(name,
 			NULL, device, &acpi_backlight_ops);
-		device->backlight->props.max_brightness = device->brightness->count-3;
 		kfree(name);
+		if (IS_ERR(device->backlight))
+			return;
+		device->backlight->props.max_brightness = device->brightness->count-3;
 
 		result = sysfs_create_link(&device->backlight->dev.kobj,
 					   &device->dev->dev.kobj, "device");
@@ -1979,6 +1988,10 @@ acpi_video_switch_brightness(struct acpi_video_device *device, int event)
 	unsigned long long level_current, level_next;
 	int result = -EINVAL;
 
+	/* no warning message if acpi_backlight=vendor is used */
+	if (!acpi_video_backlight_support())
+		return 0;
+
 	if (!device->brightness)
 		goto out;
 
@@ -2233,11 +2246,47 @@ static int acpi_video_resume(struct acpi_device *device)
 	return AE_OK;
 }
 
+static acpi_status
+acpi_video_bus_match(acpi_handle handle, u32 level, void *context,
+			void **return_value)
+{
+	struct acpi_device *device = context;
+	struct acpi_device *sibling;
+	int result;
+
+	if (handle == device->handle)
+		return AE_CTRL_TERMINATE;
+
+	result = acpi_bus_get_device(handle, &sibling);
+	if (result)
+		return AE_OK;
+
+	if (!strcmp(acpi_device_name(sibling), ACPI_VIDEO_BUS_NAME))
+			return AE_ALREADY_EXISTS;
+
+	return AE_OK;
+}
+
 static int acpi_video_bus_add(struct acpi_device *device)
 {
 	struct acpi_video_bus *video;
 	struct input_dev *input;
 	int error;
+	acpi_status status;
+
+	status = acpi_walk_namespace(ACPI_TYPE_DEVICE,
+				device->parent->handle, 1,
+				acpi_video_bus_match, NULL,
+				device, NULL);
+	if (status == AE_ALREADY_EXISTS) {
+		printk(KERN_WARNING FW_BUG
+			"Duplicate ACPI video bus devices for the"
+			" same VGA controller, please try module "
+			"parameter \"video.allow_duplicates=1\""
+			"if the current driver doesn't work.\n");
+		if (!allow_duplicates)
+			return -ENODEV;
+	}
 
 	video = kzalloc(sizeof(struct acpi_video_bus), GFP_KERNEL);
 	if (!video)
diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
index 575593a8b4e6..fc2f26b9b407 100644
--- a/drivers/acpi/video_detect.c
+++ b/drivers/acpi/video_detect.c
@@ -7,7 +7,7 @@
  * video_detect.c:
  * Provides acpi_is_video_device() for early scanning of ACPI devices in scan.c
  * There a Linux specific (Spec does not provide a HID for video devices) is
- * assinged
+ * assigned
  *
  * After PCI devices are glued with ACPI devices
  * acpi_get_pci_dev() can be called to identify ACPI graphics
@@ -83,16 +83,16 @@ long acpi_is_video_device(struct acpi_device *device)
 	if (!device)
 		return 0;
 
-	/* Does this device able to support video switching ? */
+	/* Is this device able to support video switching ? */
 	if (ACPI_SUCCESS(acpi_get_handle(device->handle, "_DOD", &h_dummy)) ||
 	    ACPI_SUCCESS(acpi_get_handle(device->handle, "_DOS", &h_dummy)))
 		video_caps |= ACPI_VIDEO_OUTPUT_SWITCHING;
 
-	/* Does this device able to retrieve a video ROM ? */
+	/* Is this device able to retrieve a video ROM ? */
 	if (ACPI_SUCCESS(acpi_get_handle(device->handle, "_ROM", &h_dummy)))
 		video_caps |= ACPI_VIDEO_ROM_AVAILABLE;
 
-	/* Does this device able to configure which video head to be POSTed ? */
+	/* Is this device able to configure which video head to be POSTed ? */
 	if (ACPI_SUCCESS(acpi_get_handle(device->handle, "_VPO", &h_dummy)) &&
 	    ACPI_SUCCESS(acpi_get_handle(device->handle, "_GPD", &h_dummy)) &&
 	    ACPI_SUCCESS(acpi_get_handle(device->handle, "_SPD", &h_dummy)))
@@ -101,7 +101,7 @@ long acpi_is_video_device(struct acpi_device *device)
 	/* Only check for backlight functionality if one of the above hit. */
 	if (video_caps)
 		acpi_walk_namespace(ACPI_TYPE_DEVICE, device->handle,
-				    ACPI_UINT32_MAX, acpi_backlight_cap_match,
+				    ACPI_UINT32_MAX, acpi_backlight_cap_match, NULL,
 				    &video_caps, NULL);
 
 	return video_caps;
@@ -137,7 +137,7 @@ find_video(acpi_handle handle, u32 lvl, void *context, void **rv)
  *
  * if NULL is passed as argument all ACPI devices are enumerated and
  * all graphics capabilities of physically present devices are
- * summerized and returned. This is cached and done only once.
+ * summarized and returned. This is cached and done only once.
  */
 long acpi_video_get_capabilities(acpi_handle graphics_handle)
 {
@@ -151,7 +151,7 @@ long acpi_video_get_capabilities(acpi_handle graphics_handle)
 	if (!graphics_handle) {
 		/* Only do the global walk through all graphics devices once */
 		acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT,
-				    ACPI_UINT32_MAX, find_video,
+				    ACPI_UINT32_MAX, find_video, NULL,
 				    &caps, NULL);
 		/* There might be boot param flags set already... */
 		acpi_video_support |= caps;
@@ -173,7 +173,7 @@ long acpi_video_get_capabilities(acpi_handle graphics_handle)
 			return 0;
 		}
 		acpi_walk_namespace(ACPI_TYPE_DEVICE, graphics_handle,
-				    ACPI_UINT32_MAX, find_video,
+				    ACPI_UINT32_MAX, find_video, NULL,
 				    &caps, NULL);
 	}
 	ACPI_DEBUG_PRINT((ACPI_DB_INFO, "We have 0x%lX video support %s %s\n",
diff --git a/drivers/ata/Kconfig b/drivers/ata/Kconfig
index 676f08b004b3..56c6374a3989 100644
--- a/drivers/ata/Kconfig
+++ b/drivers/ata/Kconfig
@@ -40,7 +40,6 @@ config ATA_VERBOSE_ERROR
 config ATA_ACPI
 	bool "ATA ACPI Support"
 	depends on ACPI && PCI
-	select ACPI_DOCK
 	default y
 	help
 	  This option adds support for ATA-related ACPI objects.
@@ -790,5 +789,15 @@ config PATA_BF54X
 
 	  If unsure, say N.
 
+config PATA_MACIO
+	tristate "Apple PowerMac/PowerBook internal 'MacIO' IDE"
+	depends on PPC_PMAC
+	help
+	  Most IDE capable PowerMacs have IDE busses driven by a variant
+          of this controller which is part of the Apple chipset used on
+          most PowerMac models. Some models have multiple busses using
+          different chipsets, though generally, MacIO is one of them.
+
+
 endif # ATA_SFF
 endif # ATA
diff --git a/drivers/ata/Makefile b/drivers/ata/Makefile
index d909435e9d81..fc936d4471d6 100644
--- a/drivers/ata/Makefile
+++ b/drivers/ata/Makefile
@@ -18,6 +18,7 @@ obj-$(CONFIG_SATA_MV)		+= sata_mv.o
 obj-$(CONFIG_SATA_INIC162X)	+= sata_inic162x.o
 obj-$(CONFIG_PDC_ADMA)		+= pdc_adma.o
 obj-$(CONFIG_SATA_FSL)		+= sata_fsl.o
+obj-$(CONFIG_PATA_MACIO)	+= pata_macio.o
 
 obj-$(CONFIG_PATA_ALI)		+= pata_ali.o
 obj-$(CONFIG_PATA_AMD)		+= pata_amd.o
diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
index 0c6155f51173..6f3f2257d0f0 100644
--- a/drivers/ata/ata_piix.c
+++ b/drivers/ata/ata_piix.c
@@ -329,7 +329,7 @@ static struct ata_port_operations ich_pata_ops = {
 };
 
 static struct ata_port_operations piix_sata_ops = {
-	.inherits		= &ata_bmdma_port_ops,
+	.inherits		= &ata_bmdma32_port_ops,
 };
 
 static struct ata_port_operations piix_sidpr_sata_ops = {
@@ -599,7 +599,7 @@ static const struct ich_laptop ich_laptop[] = {
 	{ 0x27DF, 0x1028, 0x02b0 },	/* ICH7 on unknown Dell */
 	{ 0x27DF, 0x1043, 0x1267 },	/* ICH7 on Asus W5F */
 	{ 0x27DF, 0x103C, 0x30A1 },	/* ICH7 on HP Compaq nc2400 */
-	{ 0x27DF, 0x103C, 0x361a },	/* ICH7 on unkown HP  */
+	{ 0x27DF, 0x103C, 0x361a },	/* ICH7 on unknown HP  */
 	{ 0x27DF, 0x1071, 0xD221 },	/* ICH7 on Hercules EC-900 */
 	{ 0x27DF, 0x152D, 0x0778 },	/* ICH7 on unknown Intel */
 	{ 0x24CA, 0x1025, 0x0061 },	/* ICH4 on ACER Aspire 2023WLMi */
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 22ff51bdbc8a..6728328f3bea 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -3790,21 +3790,45 @@ int sata_link_debounce(struct ata_link *link, const unsigned long *params,
 int sata_link_resume(struct ata_link *link, const unsigned long *params,
 		     unsigned long deadline)
 {
+	int tries = ATA_LINK_RESUME_TRIES;
 	u32 scontrol, serror;
 	int rc;
 
 	if ((rc = sata_scr_read(link, SCR_CONTROL, &scontrol)))
 		return rc;
 
-	scontrol = (scontrol & 0x0f0) | 0x300;
+	/*
+	 * Writes to SControl sometimes get ignored under certain
+	 * controllers (ata_piix SIDPR).  Make sure DET actually is
+	 * cleared.
+	 */
+	do {
+		scontrol = (scontrol & 0x0f0) | 0x300;
+		if ((rc = sata_scr_write(link, SCR_CONTROL, scontrol)))
+			return rc;
+		/*
+		 * Some PHYs react badly if SStatus is pounded
+		 * immediately after resuming.  Delay 200ms before
+		 * debouncing.
+		 */
+		msleep(200);
 
-	if ((rc = sata_scr_write(link, SCR_CONTROL, scontrol)))
-		return rc;
+		/* is SControl restored correctly? */
+		if ((rc = sata_scr_read(link, SCR_CONTROL, &scontrol)))
+			return rc;
+	} while ((scontrol & 0xf0f) != 0x300 && --tries);
 
-	/* Some PHYs react badly if SStatus is pounded immediately
-	 * after resuming.  Delay 200ms before debouncing.
-	 */
-	msleep(200);
+	if ((scontrol & 0xf0f) != 0x300) {
+		ata_link_printk(link, KERN_ERR,
+				"failed to resume link (SControl %X)\n",
+				scontrol);
+		return 0;
+	}
+
+	if (tries < ATA_LINK_RESUME_TRIES)
+		ata_link_printk(link, KERN_WARNING,
+				"link resume succeeded after %d retries\n",
+				ATA_LINK_RESUME_TRIES - tries);
 
 	if ((rc = sata_link_debounce(link, params, deadline)))
 		return rc;
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index 0ea97c942ced..9f6cfac0f2cc 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -2028,8 +2028,9 @@ static void ata_eh_link_autopsy(struct ata_link *link)
 			qc->err_mask &= ~(AC_ERR_DEV | AC_ERR_OTHER);
 
 		/* determine whether the command is worth retrying */
-		if (!(qc->err_mask & AC_ERR_INVALID) &&
-		    ((qc->flags & ATA_QCFLAG_IO) || qc->err_mask != AC_ERR_DEV))
+		if (qc->flags & ATA_QCFLAG_IO ||
+		    (!(qc->err_mask & AC_ERR_INVALID) &&
+		     qc->err_mask != AC_ERR_DEV))
 			qc->flags |= ATA_QCFLAG_RETRY;
 
 		/* accumulate error info */
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 62e6b9ea96af..f4ea5a8c325b 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -1208,6 +1208,7 @@ void ata_scsi_slave_destroy(struct scsi_device *sdev)
  *	ata_scsi_change_queue_depth - SCSI callback for queue depth config
  *	@sdev: SCSI device to configure queue depth for
  *	@queue_depth: new queue depth
+ *	@reason: calling context
  *
  *	This is libata standard hostt->change_queue_depth callback.
  *	SCSI will call into this callback when user tries to set queue
@@ -1219,12 +1220,16 @@ void ata_scsi_slave_destroy(struct scsi_device *sdev)
  *	RETURNS:
  *	Newly configured queue depth.
  */
-int ata_scsi_change_queue_depth(struct scsi_device *sdev, int queue_depth)
+int ata_scsi_change_queue_depth(struct scsi_device *sdev, int queue_depth,
+				int reason)
 {
 	struct ata_port *ap = ata_shost_to_port(sdev->host);
 	struct ata_device *dev;
 	unsigned long flags;
 
+	if (reason != SCSI_QDEPTH_DEFAULT)
+		return -EOPNOTSUPP;
+
 	if (queue_depth < 1 || queue_depth == sdev->queue_depth)
 		return sdev->queue_depth;
 
@@ -3017,7 +3022,7 @@ static inline ata_xlat_func_t ata_get_xlat_func(struct ata_device *dev, u8 cmd)
 	case WRITE_16:
 		return ata_scsi_rw_xlat;
 
-	case 0x93 /*WRITE_SAME_16*/:
+	case WRITE_SAME_16:
 		return ata_scsi_write_same_xlat;
 
 	case SYNCHRONIZE_CACHE:
diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c
index 51eb1e298601..741065c9da67 100644
--- a/drivers/ata/libata-sff.c
+++ b/drivers/ata/libata-sff.c
@@ -736,7 +736,7 @@ unsigned int ata_sff_data_xfer(struct ata_device *dev, unsigned char *buf,
 
 		/*
 		 * Use io*16_rep() accessors here as well to avoid pointlessly
-		 * swapping bytes to and fro on the big endian machines...
+		 * swapping bytes to and from on the big endian machines...
 		 */
 		if (rw == READ) {
 			ioread16_rep(data_addr, pad, 1);
@@ -776,7 +776,7 @@ unsigned int ata_sff_data_xfer32(struct ata_device *dev, unsigned char *buf,
 	void __iomem *data_addr = ap->ioaddr.data_addr;
 	unsigned int words = buflen >> 2;
 	int slop = buflen & 3;
-	
+
 	if (!(ap->pflags & ATA_PFLAG_PIO32))
 		return ata_sff_data_xfer(dev, buf, buflen, rw);
 
@@ -795,7 +795,7 @@ unsigned int ata_sff_data_xfer32(struct ata_device *dev, unsigned char *buf,
 
 		/*
 		 * Use io*_rep() accessors here as well to avoid pointlessly
-		 * swapping bytes to and fro on the big endian machines...
+		 * swapping bytes to and from on the big endian machines...
 		 */
 		if (rw == READ) {
 			if (slop < 3)
@@ -2275,7 +2275,7 @@ void ata_sff_drain_fifo(struct ata_queued_cmd *qc)
 	ap = qc->ap;
 	/* Drain up to 64K of data before we give up this recovery method */
 	for (count = 0; (ap->ops->sff_check_status(ap) & ATA_DRQ)
-						&& count < 32768; count++)
+						&& count < 65536; count += 2)
 		ioread16(ap->ioaddr.data_addr);
 
 	/* Can become DEBUG later */
diff --git a/drivers/ata/pata_bf54x.c b/drivers/ata/pata_bf54x.c
index c4b47a3e5446..02c81f12c702 100644
--- a/drivers/ata/pata_bf54x.c
+++ b/drivers/ata/pata_bf54x.c
@@ -1557,6 +1557,25 @@ static unsigned short atapi_io_port[] = {
 	P_ATAPI_DMARQ,
 	P_ATAPI_INTRQ,
 	P_ATAPI_IORDY,
+	P_ATAPI_D0A,
+	P_ATAPI_D1A,
+	P_ATAPI_D2A,
+	P_ATAPI_D3A,
+	P_ATAPI_D4A,
+	P_ATAPI_D5A,
+	P_ATAPI_D6A,
+	P_ATAPI_D7A,
+	P_ATAPI_D8A,
+	P_ATAPI_D9A,
+	P_ATAPI_D10A,
+	P_ATAPI_D11A,
+	P_ATAPI_D12A,
+	P_ATAPI_D13A,
+	P_ATAPI_D14A,
+	P_ATAPI_D15A,
+	P_ATAPI_A0A,
+	P_ATAPI_A1A,
+	P_ATAPI_A2A,
 	0
 };
 
diff --git a/drivers/ata/pata_cmd64x.c b/drivers/ata/pata_cmd64x.c
index dadfc358ba1c..0efb1f58f255 100644
--- a/drivers/ata/pata_cmd64x.c
+++ b/drivers/ata/pata_cmd64x.c
@@ -31,7 +31,7 @@
 #include <linux/libata.h>
 
 #define DRV_NAME "pata_cmd64x"
-#define DRV_VERSION "0.3.1"
+#define DRV_VERSION "0.2.5"
 
 /*
  * CMD64x specific registers definition.
@@ -219,7 +219,7 @@ static void cmd64x_set_dmamode(struct ata_port *ap, struct ata_device *adev)
 		regU |= udma_data[adev->dma_mode - XFER_UDMA_0] << shift;
 		/* Merge the control bits */
 		regU |= 1 << adev->devno; /* UDMA on */
-		if (adev->dma_mode > 2)	/* 15nS timing */
+		if (adev->dma_mode > XFER_UDMA_2) /* 15nS timing */
 			regU |= 4 << adev->devno;
 	} else {
 		regU &= ~ (1 << adev->devno);	/* UDMA off */
@@ -254,109 +254,17 @@ static void cmd648_bmdma_stop(struct ata_queued_cmd *qc)
 }
 
 /**
- *	cmd64x_bmdma_stop	-	DMA stop callback
+ *	cmd646r1_dma_stop	-	DMA stop callback
  *	@qc: Command in progress
  *
- *	Track the completion of live DMA commands and clear the
- *	host->private_data DMA tracking flag as we do.
+ *	Stub for now while investigating the r1 quirk in the old driver.
  */
 
-static void cmd64x_bmdma_stop(struct ata_queued_cmd *qc)
+static void cmd646r1_bmdma_stop(struct ata_queued_cmd *qc)
 {
-	struct ata_port *ap = qc->ap;
 	ata_bmdma_stop(qc);
-	WARN_ON(ap->host->private_data != ap);
-	ap->host->private_data = NULL;
-}
-
-/**
- *	cmd64x_qc_defer		-	Defer logic for chip limits
- *	@qc: queued command
- *
- *	Decide whether we can issue the command. Called under the host lock.
- */
-
-static int cmd64x_qc_defer(struct ata_queued_cmd *qc)
-{
-	struct ata_host *host = qc->ap->host;
-	struct ata_port *alt = host->ports[1 ^ qc->ap->port_no];
-	int rc;
-	int dma = 0;
-
-	/* Apply the ATA rules first */
-	rc = ata_std_qc_defer(qc);
-	if (rc)
-		return rc;
-
-	if (qc->tf.protocol == ATAPI_PROT_DMA ||
-			qc->tf.protocol == ATA_PROT_DMA)
-		dma = 1;
-
-	/* If the other port is not live then issue the command */
-	if (alt == NULL || !alt->qc_active) {
-		if (dma)
-			host->private_data = qc->ap;
-		return 0;
-	}
-	/* If there is a live DMA command then wait */
-	if (host->private_data != NULL)
-		return 	ATA_DEFER_PORT;
-	if (dma)
-		/* Cannot overlap our DMA command */
-		return ATA_DEFER_PORT;
-	return 0;
 }
 
-/**
- *	cmd64x_interrupt - ATA host interrupt handler
- *	@irq: irq line (unused)
- *	@dev_instance: pointer to our ata_host information structure
- *
- *	Our interrupt handler for PCI IDE devices.  Calls
- *	ata_sff_host_intr() for each port that is flagging an IRQ. We cannot
- *	use the defaults as we need to avoid touching status/altstatus during
- *	a DMA.
- *
- *	LOCKING:
- *	Obtains host lock during operation.
- *
- *	RETURNS:
- *	IRQ_NONE or IRQ_HANDLED.
- */
-irqreturn_t cmd64x_interrupt(int irq, void *dev_instance)
-{
-	struct ata_host *host = dev_instance;
-	struct pci_dev *pdev = to_pci_dev(host->dev);
-	unsigned int i;
-	unsigned int handled = 0;
-	unsigned long flags;
-	static const u8 irq_reg[2] = { CFR, ARTTIM23 };
-	static const u8 irq_mask[2] = { 1 << 2, 1 << 4 };
-
-	/* TODO: make _irqsave conditional on x86 PCI IDE legacy mode */
-	spin_lock_irqsave(&host->lock, flags);
-
-	for (i = 0; i < host->n_ports; i++) {
-		struct ata_port *ap;
-		u8 reg;
-
-		pci_read_config_byte(pdev, irq_reg[i], &reg);
-		ap = host->ports[i];
-		if (ap && (reg & irq_mask[i]) &&
-		    !(ap->flags & ATA_FLAG_DISABLED)) {
-			struct ata_queued_cmd *qc;
-
-			qc = ata_qc_from_tag(ap, ap->link.active_tag);
-			if (qc && (!(qc->tf.flags & ATA_TFLAG_POLLING)) &&
-			    (qc->flags & ATA_QCFLAG_ACTIVE))
-				handled |= ata_sff_host_intr(ap, qc);
-		}
-	}
-
-	spin_unlock_irqrestore(&host->lock, flags);
-
-	return IRQ_RETVAL(handled);
-}
 static struct scsi_host_template cmd64x_sht = {
 	ATA_BMDMA_SHT(DRV_NAME),
 };
@@ -365,8 +273,6 @@ static const struct ata_port_operations cmd64x_base_ops = {
 	.inherits	= &ata_bmdma_port_ops,
 	.set_piomode	= cmd64x_set_piomode,
 	.set_dmamode	= cmd64x_set_dmamode,
-	.bmdma_stop	= cmd64x_bmdma_stop,
-	.qc_defer	= cmd64x_qc_defer,
 };
 
 static struct ata_port_operations cmd64x_port_ops = {
@@ -376,6 +282,7 @@ static struct ata_port_operations cmd64x_port_ops = {
 
 static struct ata_port_operations cmd646r1_port_ops = {
 	.inherits	= &cmd64x_base_ops,
+	.bmdma_stop	= cmd646r1_bmdma_stop,
 	.cable_detect	= ata_cable_40wire,
 };
 
@@ -383,7 +290,6 @@ static struct ata_port_operations cmd648_port_ops = {
 	.inherits	= &cmd64x_base_ops,
 	.bmdma_stop	= cmd648_bmdma_stop,
 	.cable_detect	= cmd648_cable_detect,
-	.qc_defer	= ata_std_qc_defer
 };
 
 static int cmd64x_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
@@ -432,7 +338,6 @@ static int cmd64x_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
 	const struct ata_port_info *ppi[] = { &cmd_info[id->driver_data], NULL };
 	u8 mrdmode;
 	int rc;
-	struct ata_host *host;
 
 	rc = pcim_enable_device(pdev);
 	if (rc)
@@ -450,25 +355,20 @@ static int cmd64x_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
 			ppi[0] = &cmd_info[3];
 	}
 
-
 	pci_write_config_byte(pdev, PCI_LATENCY_TIMER, 64);
 	pci_read_config_byte(pdev, MRDMODE, &mrdmode);
 	mrdmode &= ~ 0x30;	/* IRQ set up */
 	mrdmode |= 0x02;	/* Memory read line enable */
 	pci_write_config_byte(pdev, MRDMODE, mrdmode);
 
+	/* Force PIO 0 here.. */
+
 	/* PPC specific fixup copied from old driver */
 #ifdef CONFIG_PPC
 	pci_write_config_byte(pdev, UDIDETCR0, 0xF0);
 #endif
-	rc = ata_pci_sff_prepare_host(pdev, ppi, &host);
-	if (rc)
-		return rc;
-	/* We use this pointer to track the AP which has DMA running */
-	host->private_data = NULL;
 
-	pci_set_master(pdev);
-	return ata_pci_sff_activate_host(host, cmd64x_interrupt, &cmd64x_sht);
+	return ata_pci_sff_init_one(pdev, ppi, &cmd64x_sht, NULL);
 }
 
 #ifdef CONFIG_PM
diff --git a/drivers/ata/pata_cs5535.c b/drivers/ata/pata_cs5535.c
index 403f56165cec..71cef9a962d4 100644
--- a/drivers/ata/pata_cs5535.c
+++ b/drivers/ata/pata_cs5535.c
@@ -4,7 +4,7 @@
  *			  Alan Cox <alan@lxorguk.ukuu.org.uk>
  *
  * based upon cs5535.c from AMD <Jens.Altmann@amd.com> as cleaned up and
- * made readable and Linux style by Wolfgang Zuleger <wolfgang.zuleger@gmx.de
+ * made readable and Linux style by Wolfgang Zuleger <wolfgang.zuleger@gmx.de>
  * and Alexander Kiausch <alex.kiausch@t-online.de>
  *
  * This program is free software; you can redistribute it and/or modify
diff --git a/drivers/ata/pata_hpt3x2n.c b/drivers/ata/pata_hpt3x2n.c
index 9a09a1b11ca5..dd26bc73bd9a 100644
--- a/drivers/ata/pata_hpt3x2n.c
+++ b/drivers/ata/pata_hpt3x2n.c
@@ -8,7 +8,7 @@
  * Copyright (C) 1999-2003		Andre Hedrick <andre@linux-ide.org>
  * Portions Copyright (C) 2001	        Sun Microsystems, Inc.
  * Portions Copyright (C) 2003		Red Hat Inc
- * Portions Copyright (C) 2005-2007	MontaVista Software, Inc.
+ * Portions Copyright (C) 2005-2009	MontaVista Software, Inc.
  *
  *
  * TODO
@@ -25,7 +25,7 @@
 #include <linux/libata.h>
 
 #define DRV_NAME	"pata_hpt3x2n"
-#define DRV_VERSION	"0.3.7"
+#define DRV_VERSION	"0.3.8"
 
 enum {
 	HPT_PCI_FAST	=	(1 << 31),
@@ -264,7 +264,7 @@ static void hpt3x2n_bmdma_stop(struct ata_queued_cmd *qc)
 
 static void hpt3x2n_set_clock(struct ata_port *ap, int source)
 {
-	void __iomem *bmdma = ap->ioaddr.bmdma_addr;
+	void __iomem *bmdma = ap->ioaddr.bmdma_addr - ap->port_no * 8;
 
 	/* Tristate the bus */
 	iowrite8(0x80, bmdma+0x73);
@@ -274,9 +274,9 @@ static void hpt3x2n_set_clock(struct ata_port *ap, int source)
 	iowrite8(source, bmdma+0x7B);
 	iowrite8(0xC0, bmdma+0x79);
 
-	/* Reset state machines */
-	iowrite8(0x37, bmdma+0x70);
-	iowrite8(0x37, bmdma+0x74);
+	/* Reset state machines, avoid enabling the disabled channels */
+	iowrite8(ioread8(bmdma+0x70) | 0x32, bmdma+0x70);
+	iowrite8(ioread8(bmdma+0x74) | 0x32, bmdma+0x74);
 
 	/* Complete reset */
 	iowrite8(0x00, bmdma+0x79);
@@ -286,21 +286,10 @@ static void hpt3x2n_set_clock(struct ata_port *ap, int source)
 	iowrite8(0x00, bmdma+0x77);
 }
 
-/* Check if our partner interface is busy */
-
-static int hpt3x2n_pair_idle(struct ata_port *ap)
-{
-	struct ata_host *host = ap->host;
-	struct ata_port *pair = host->ports[ap->port_no ^ 1];
-
-	if (pair->hsm_task_state == HSM_ST_IDLE)
-		return 1;
-	return 0;
-}
-
 static int hpt3x2n_use_dpll(struct ata_port *ap, int writing)
 {
 	long flags = (long)ap->host->private_data;
+
 	/* See if we should use the DPLL */
 	if (writing)
 		return USE_DPLL;	/* Needed for write */
@@ -309,20 +298,35 @@ static int hpt3x2n_use_dpll(struct ata_port *ap, int writing)
 	return 0;
 }
 
+static int hpt3x2n_qc_defer(struct ata_queued_cmd *qc)
+{
+	struct ata_port *ap = qc->ap;
+	struct ata_port *alt = ap->host->ports[ap->port_no ^ 1];
+	int rc, flags = (long)ap->host->private_data;
+	int dpll = hpt3x2n_use_dpll(ap, qc->tf.flags & ATA_TFLAG_WRITE);
+
+	/* First apply the usual rules */
+	rc = ata_std_qc_defer(qc);
+	if (rc != 0)
+		return rc;
+
+	if ((flags & USE_DPLL) != dpll && alt->qc_active)
+		return ATA_DEFER_PORT;
+	return 0;
+}
+
 static unsigned int hpt3x2n_qc_issue(struct ata_queued_cmd *qc)
 {
-	struct ata_taskfile *tf = &qc->tf;
 	struct ata_port *ap = qc->ap;
 	int flags = (long)ap->host->private_data;
+	int dpll = hpt3x2n_use_dpll(ap, qc->tf.flags & ATA_TFLAG_WRITE);
 
-	if (hpt3x2n_pair_idle(ap)) {
-		int dpll = hpt3x2n_use_dpll(ap, (tf->flags & ATA_TFLAG_WRITE));
-		if ((flags & USE_DPLL) != dpll) {
-			if (dpll == 1)
-				hpt3x2n_set_clock(ap, 0x21);
-			else
-				hpt3x2n_set_clock(ap, 0x23);
-		}
+	if ((flags & USE_DPLL) != dpll) {
+		flags &= ~USE_DPLL;
+		flags |= dpll;
+		ap->host->private_data = (void *)(long)flags;
+
+		hpt3x2n_set_clock(ap, dpll ? 0x21 : 0x23);
 	}
 	return ata_sff_qc_issue(qc);
 }
@@ -339,6 +343,8 @@ static struct ata_port_operations hpt3x2n_port_ops = {
 	.inherits	= &ata_bmdma_port_ops,
 
 	.bmdma_stop	= hpt3x2n_bmdma_stop,
+
+	.qc_defer	= hpt3x2n_qc_defer,
 	.qc_issue	= hpt3x2n_qc_issue,
 
 	.cable_detect	= hpt3x2n_cable_detect,
@@ -454,7 +460,7 @@ static int hpt3x2n_init_one(struct pci_dev *dev, const struct pci_device_id *id)
 	unsigned int f_low, f_high;
 	int adjust;
 	unsigned long iobase = pci_resource_start(dev, 4);
-	void *hpriv = NULL;
+	void *hpriv = (void *)USE_DPLL;
 	int rc;
 
 	rc = pcim_enable_device(dev);
@@ -539,7 +545,7 @@ static int hpt3x2n_init_one(struct pci_dev *dev, const struct pci_device_id *id)
 	/* Set our private data up. We only need a few flags so we use
 	   it directly */
 	if (pci_mhz > 60) {
-		hpriv = (void *)PCI66;
+		hpriv = (void *)(PCI66 | USE_DPLL);
 		/*
 		 * On  HPT371N, if ATA clock is 66 MHz we must set bit 2 in
 		 * the MISC. register to stretch the UltraDMA Tss timing.
diff --git a/drivers/ata/pata_macio.c b/drivers/ata/pata_macio.c
new file mode 100644
index 000000000000..4cc7bbd10ec2
--- /dev/null
+++ b/drivers/ata/pata_macio.c
@@ -0,0 +1,1427 @@
+/*
+ * Libata based driver for Apple "macio" family of PATA controllers
+ *
+ * Copyright 2008/2009 Benjamin Herrenschmidt, IBM Corp
+ *                     <benh@kernel.crashing.org>
+ *
+ * Some bits and pieces from drivers/ide/ppc/pmac.c
+ *
+ */
+
+#undef DEBUG
+#undef DEBUG_DMA
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/blkdev.h>
+#include <linux/ata.h>
+#include <linux/libata.h>
+#include <linux/adb.h>
+#include <linux/pmu.h>
+#include <linux/scatterlist.h>
+#include <linux/of.h>
+
+#include <scsi/scsi.h>
+#include <scsi/scsi_host.h>
+#include <scsi/scsi_device.h>
+
+#include <asm/macio.h>
+#include <asm/io.h>
+#include <asm/dbdma.h>
+#include <asm/pci-bridge.h>
+#include <asm/machdep.h>
+#include <asm/pmac_feature.h>
+#include <asm/mediabay.h>
+
+#ifdef DEBUG_DMA
+#define dev_dbgdma(dev, format, arg...)		\
+	dev_printk(KERN_DEBUG , dev , format , ## arg)
+#else
+#define dev_dbgdma(dev, format, arg...)		\
+	({ if (0) dev_printk(KERN_DEBUG, dev, format, ##arg); 0; })
+#endif
+
+#define DRV_NAME	"pata_macio"
+#define DRV_VERSION	"0.9"
+
+/* Models of macio ATA controller */
+enum {
+	controller_ohare,	/* OHare based */
+	controller_heathrow,	/* Heathrow/Paddington */
+	controller_kl_ata3,	/* KeyLargo ATA-3 */
+	controller_kl_ata4,	/* KeyLargo ATA-4 */
+	controller_un_ata6,	/* UniNorth2 ATA-6 */
+	controller_k2_ata6,	/* K2 ATA-6 */
+	controller_sh_ata6,	/* Shasta ATA-6 */
+};
+
+static const char* macio_ata_names[] = {
+	"OHare ATA",		/* OHare based */
+	"Heathrow ATA",		/* Heathrow/Paddington */
+	"KeyLargo ATA-3",	/* KeyLargo ATA-3 (MDMA only) */
+	"KeyLargo ATA-4",	/* KeyLargo ATA-4 (UDMA/66) */
+	"UniNorth ATA-6",	/* UniNorth2 ATA-6 (UDMA/100) */
+	"K2 ATA-6",		/* K2 ATA-6 (UDMA/100) */
+	"Shasta ATA-6",		/* Shasta ATA-6 (UDMA/133) */
+};
+
+/*
+ * Extra registers, both 32-bit little-endian
+ */
+#define IDE_TIMING_CONFIG	0x200
+#define IDE_INTERRUPT		0x300
+
+/* Kauai (U2) ATA has different register setup */
+#define IDE_KAUAI_PIO_CONFIG	0x200
+#define IDE_KAUAI_ULTRA_CONFIG	0x210
+#define IDE_KAUAI_POLL_CONFIG	0x220
+
+/*
+ * Timing configuration register definitions
+ */
+
+/* Number of IDE_SYSCLK_NS ticks, argument is in nanoseconds */
+#define SYSCLK_TICKS(t)		(((t) + IDE_SYSCLK_NS - 1) / IDE_SYSCLK_NS)
+#define SYSCLK_TICKS_66(t)	(((t) + IDE_SYSCLK_66_NS - 1) / IDE_SYSCLK_66_NS)
+#define IDE_SYSCLK_NS		30	/* 33Mhz cell */
+#define IDE_SYSCLK_66_NS	15	/* 66Mhz cell */
+
+/* 133Mhz cell, found in shasta.
+ * See comments about 100 Mhz Uninorth 2...
+ * Note that PIO_MASK and MDMA_MASK seem to overlap, that's just
+ * weird and I don't now why .. at this stage
+ */
+#define TR_133_PIOREG_PIO_MASK		0xff000fff
+#define TR_133_PIOREG_MDMA_MASK		0x00fff800
+#define TR_133_UDMAREG_UDMA_MASK	0x0003ffff
+#define TR_133_UDMAREG_UDMA_EN		0x00000001
+
+/* 100Mhz cell, found in Uninorth 2 and K2. It appears as a pci device
+ * (106b/0033) on uninorth or K2 internal PCI bus and it's clock is
+ * controlled like gem or fw. It appears to be an evolution of keylargo
+ * ATA4 with a timing register extended to 2x32bits registers (one
+ * for PIO & MWDMA and one for UDMA, and a similar DBDMA channel.
+ * It has it's own local feature control register as well.
+ *
+ * After scratching my mind over the timing values, at least for PIO
+ * and MDMA, I think I've figured the format of the timing register,
+ * though I use pre-calculated tables for UDMA as usual...
+ */
+#define TR_100_PIO_ADDRSETUP_MASK	0xff000000 /* Size of field unknown */
+#define TR_100_PIO_ADDRSETUP_SHIFT	24
+#define TR_100_MDMA_MASK		0x00fff000
+#define TR_100_MDMA_RECOVERY_MASK	0x00fc0000
+#define TR_100_MDMA_RECOVERY_SHIFT	18
+#define TR_100_MDMA_ACCESS_MASK		0x0003f000
+#define TR_100_MDMA_ACCESS_SHIFT	12
+#define TR_100_PIO_MASK			0xff000fff
+#define TR_100_PIO_RECOVERY_MASK	0x00000fc0
+#define TR_100_PIO_RECOVERY_SHIFT	6
+#define TR_100_PIO_ACCESS_MASK		0x0000003f
+#define TR_100_PIO_ACCESS_SHIFT		0
+
+#define TR_100_UDMAREG_UDMA_MASK	0x0000ffff
+#define TR_100_UDMAREG_UDMA_EN		0x00000001
+
+
+/* 66Mhz cell, found in KeyLargo. Can do ultra mode 0 to 2 on
+ * 40 connector cable and to 4 on 80 connector one.
+ * Clock unit is 15ns (66Mhz)
+ *
+ * 3 Values can be programmed:
+ *  - Write data setup, which appears to match the cycle time. They
+ *    also call it DIOW setup.
+ *  - Ready to pause time (from spec)
+ *  - Address setup. That one is weird. I don't see where exactly
+ *    it fits in UDMA cycles, I got it's name from an obscure piece
+ *    of commented out code in Darwin. They leave it to 0, we do as
+ *    well, despite a comment that would lead to think it has a
+ *    min value of 45ns.
+ * Apple also add 60ns to the write data setup (or cycle time ?) on
+ * reads.
+ */
+#define TR_66_UDMA_MASK			0xfff00000
+#define TR_66_UDMA_EN			0x00100000 /* Enable Ultra mode for DMA */
+#define TR_66_PIO_ADDRSETUP_MASK	0xe0000000 /* Address setup */
+#define TR_66_PIO_ADDRSETUP_SHIFT	29
+#define TR_66_UDMA_RDY2PAUS_MASK	0x1e000000 /* Ready 2 pause time */
+#define TR_66_UDMA_RDY2PAUS_SHIFT	25
+#define TR_66_UDMA_WRDATASETUP_MASK	0x01e00000 /* Write data setup time */
+#define TR_66_UDMA_WRDATASETUP_SHIFT	21
+#define TR_66_MDMA_MASK			0x000ffc00
+#define TR_66_MDMA_RECOVERY_MASK	0x000f8000
+#define TR_66_MDMA_RECOVERY_SHIFT	15
+#define TR_66_MDMA_ACCESS_MASK		0x00007c00
+#define TR_66_MDMA_ACCESS_SHIFT		10
+#define TR_66_PIO_MASK			0xe00003ff
+#define TR_66_PIO_RECOVERY_MASK		0x000003e0
+#define TR_66_PIO_RECOVERY_SHIFT	5
+#define TR_66_PIO_ACCESS_MASK		0x0000001f
+#define TR_66_PIO_ACCESS_SHIFT		0
+
+/* 33Mhz cell, found in OHare, Heathrow (& Paddington) and KeyLargo
+ * Can do pio & mdma modes, clock unit is 30ns (33Mhz)
+ *
+ * The access time and recovery time can be programmed. Some older
+ * Darwin code base limit OHare to 150ns cycle time. I decided to do
+ * the same here fore safety against broken old hardware ;)
+ * The HalfTick bit, when set, adds half a clock (15ns) to the access
+ * time and removes one from recovery. It's not supported on KeyLargo
+ * implementation afaik. The E bit appears to be set for PIO mode 0 and
+ * is used to reach long timings used in this mode.
+ */
+#define TR_33_MDMA_MASK			0x003ff800
+#define TR_33_MDMA_RECOVERY_MASK	0x001f0000
+#define TR_33_MDMA_RECOVERY_SHIFT	16
+#define TR_33_MDMA_ACCESS_MASK		0x0000f800
+#define TR_33_MDMA_ACCESS_SHIFT		11
+#define TR_33_MDMA_HALFTICK		0x00200000
+#define TR_33_PIO_MASK			0x000007ff
+#define TR_33_PIO_E			0x00000400
+#define TR_33_PIO_RECOVERY_MASK		0x000003e0
+#define TR_33_PIO_RECOVERY_SHIFT	5
+#define TR_33_PIO_ACCESS_MASK		0x0000001f
+#define TR_33_PIO_ACCESS_SHIFT		0
+
+/*
+ * Interrupt register definitions. Only present on newer cells
+ * (Keylargo and later afaik) so we don't use it.
+ */
+#define IDE_INTR_DMA			0x80000000
+#define IDE_INTR_DEVICE			0x40000000
+
+/*
+ * FCR Register on Kauai. Not sure what bit 0x4 is  ...
+ */
+#define KAUAI_FCR_UATA_MAGIC		0x00000004
+#define KAUAI_FCR_UATA_RESET_N		0x00000002
+#define KAUAI_FCR_UATA_ENABLE		0x00000001
+
+
+/* Allow up to 256 DBDMA commands per xfer */
+#define MAX_DCMDS		256
+
+/* Don't let a DMA segment go all the way to 64K */
+#define MAX_DBDMA_SEG		0xff00
+
+
+/*
+ * Wait 1s for disk to answer on IDE bus after a hard reset
+ * of the device (via GPIO/FCR).
+ *
+ * Some devices seem to "pollute" the bus even after dropping
+ * the BSY bit (typically some combo drives slave on the UDMA
+ * bus) after a hard reset. Since we hard reset all drives on
+ * KeyLargo ATA66, we have to keep that delay around. I may end
+ * up not hard resetting anymore on these and keep the delay only
+ * for older interfaces instead (we have to reset when coming
+ * from MacOS...) --BenH.
+ */
+#define IDE_WAKEUP_DELAY_MS	1000
+
+struct pata_macio_timing;
+
+struct pata_macio_priv {
+	int				kind;
+	int				aapl_bus_id;
+	int				mediabay : 1;
+	struct device_node		*node;
+	struct macio_dev		*mdev;
+	struct pci_dev			*pdev;
+	struct device			*dev;
+	int				irq;
+	u32				treg[2][2];
+	void __iomem			*tfregs;
+	void __iomem			*kauai_fcr;
+	struct dbdma_cmd *		dma_table_cpu;
+	dma_addr_t			dma_table_dma;
+	struct ata_host			*host;
+	const struct pata_macio_timing	*timings;
+};
+
+/* Previous variants of this driver used to calculate timings
+ * for various variants of the chip and use tables for others.
+ *
+ * Not only was this confusing, but in addition, it isn't clear
+ * whether our calculation code was correct. It didn't entirely
+ * match the darwin code and whatever documentation I could find
+ * on these cells
+ *
+ * I decided to entirely rely on a table instead for this version
+ * of the driver. Also, because I don't really care about derated
+ * modes and really old HW other than making it work, I'm not going
+ * to calculate / snoop timing values for something else than the
+ * standard modes.
+ */
+struct pata_macio_timing {
+	int	mode;
+	u32	reg1;	/* Bits to set in first timing reg */
+	u32	reg2;	/* Bits to set in second timing reg */
+};
+
+static const struct pata_macio_timing pata_macio_ohare_timings[] = {
+	{ XFER_PIO_0,		0x00000526,	0, },
+	{ XFER_PIO_1,		0x00000085,	0, },
+	{ XFER_PIO_2,		0x00000025,	0, },
+	{ XFER_PIO_3,		0x00000025,	0, },
+	{ XFER_PIO_4,		0x00000025,	0, },
+	{ XFER_MW_DMA_0,	0x00074000,	0, },
+	{ XFER_MW_DMA_1,	0x00221000,	0, },
+	{ XFER_MW_DMA_2,	0x00211000,	0, },
+	{ -1, 0, 0 }
+};
+
+static const struct pata_macio_timing pata_macio_heathrow_timings[] = {
+	{ XFER_PIO_0,		0x00000526,	0, },
+	{ XFER_PIO_1,		0x00000085,	0, },
+	{ XFER_PIO_2,		0x00000025,	0, },
+	{ XFER_PIO_3,		0x00000025,	0, },
+	{ XFER_PIO_4,		0x00000025,	0, },
+	{ XFER_MW_DMA_0,	0x00074000,	0, },
+	{ XFER_MW_DMA_1,	0x00221000,	0, },
+	{ XFER_MW_DMA_2,	0x00211000,	0, },
+	{ -1, 0, 0 }
+};
+
+static const struct pata_macio_timing pata_macio_kl33_timings[] = {
+	{ XFER_PIO_0,		0x00000526,	0, },
+	{ XFER_PIO_1,		0x00000085,	0, },
+	{ XFER_PIO_2,		0x00000025,	0, },
+	{ XFER_PIO_3,		0x00000025,	0, },
+	{ XFER_PIO_4,		0x00000025,	0, },
+	{ XFER_MW_DMA_0,	0x00084000,	0, },
+	{ XFER_MW_DMA_1,	0x00021800,	0, },
+	{ XFER_MW_DMA_2,	0x00011800,	0, },
+	{ -1, 0, 0 }
+};
+
+static const struct pata_macio_timing pata_macio_kl66_timings[] = {
+	{ XFER_PIO_0,		0x0000038c,	0, },
+	{ XFER_PIO_1,		0x0000020a,	0, },
+	{ XFER_PIO_2,		0x00000127,	0, },
+	{ XFER_PIO_3,		0x000000c6,	0, },
+	{ XFER_PIO_4,		0x00000065,	0, },
+	{ XFER_MW_DMA_0,	0x00084000,	0, },
+	{ XFER_MW_DMA_1,	0x00029800,	0, },
+	{ XFER_MW_DMA_2,	0x00019400,	0, },
+	{ XFER_UDMA_0,		0x19100000,	0, },
+	{ XFER_UDMA_1,		0x14d00000,	0, },
+	{ XFER_UDMA_2,		0x10900000,	0, },
+	{ XFER_UDMA_3,		0x0c700000,	0, },
+	{ XFER_UDMA_4,		0x0c500000,	0, },
+	{ -1, 0, 0 }
+};
+
+static const struct pata_macio_timing pata_macio_kauai_timings[] = {
+	{ XFER_PIO_0,		0x08000a92,	0, },
+	{ XFER_PIO_1,		0x0800060f,	0, },
+	{ XFER_PIO_2,		0x0800038b,	0, },
+	{ XFER_PIO_3,		0x05000249,	0, },
+	{ XFER_PIO_4,		0x04000148,	0, },
+	{ XFER_MW_DMA_0,	0x00618000,	0, },
+	{ XFER_MW_DMA_1,	0x00209000,	0, },
+	{ XFER_MW_DMA_2,	0x00148000,	0, },
+	{ XFER_UDMA_0,		         0,	0x000070c1, },
+	{ XFER_UDMA_1,		         0,	0x00005d81, },
+	{ XFER_UDMA_2,		         0,	0x00004a61, },
+	{ XFER_UDMA_3,		         0,	0x00003a51, },
+	{ XFER_UDMA_4,		         0,	0x00002a31, },
+	{ XFER_UDMA_5,		         0,	0x00002921, },
+	{ -1, 0, 0 }
+};
+
+static const struct pata_macio_timing pata_macio_shasta_timings[] = {
+	{ XFER_PIO_0,		0x0a000c97,	0, },
+	{ XFER_PIO_1,		0x07000712,	0, },
+	{ XFER_PIO_2,		0x040003cd,	0, },
+	{ XFER_PIO_3,		0x0500028b,	0, },
+	{ XFER_PIO_4,		0x0400010a,	0, },
+	{ XFER_MW_DMA_0,	0x00820800,	0, },
+	{ XFER_MW_DMA_1,	0x0028b000,	0, },
+	{ XFER_MW_DMA_2,	0x001ca000,	0, },
+	{ XFER_UDMA_0,		         0,	0x00035901, },
+	{ XFER_UDMA_1,		         0,	0x000348b1, },
+	{ XFER_UDMA_2,		         0,	0x00033881, },
+	{ XFER_UDMA_3,		         0,	0x00033861, },
+	{ XFER_UDMA_4,		         0,	0x00033841, },
+	{ XFER_UDMA_5,		         0,	0x00033031, },
+	{ XFER_UDMA_6,		         0,	0x00033021, },
+	{ -1, 0, 0 }
+};
+
+static const struct pata_macio_timing *pata_macio_find_timing(
+					    struct pata_macio_priv *priv,
+					    int mode)
+{
+	int i;
+
+	for (i = 0; priv->timings[i].mode > 0; i++) {
+		if (priv->timings[i].mode == mode)
+			return &priv->timings[i];
+	}
+	return NULL;
+}
+
+
+static void pata_macio_apply_timings(struct ata_port *ap, unsigned int device)
+{
+	struct pata_macio_priv *priv = ap->private_data;
+	void __iomem *rbase = ap->ioaddr.cmd_addr;
+
+	if (priv->kind == controller_sh_ata6 ||
+	    priv->kind == controller_un_ata6 ||
+	    priv->kind == controller_k2_ata6) {
+		writel(priv->treg[device][0], rbase + IDE_KAUAI_PIO_CONFIG);
+		writel(priv->treg[device][1], rbase + IDE_KAUAI_ULTRA_CONFIG);
+	} else
+		writel(priv->treg[device][0], rbase + IDE_TIMING_CONFIG);
+}
+
+static void pata_macio_dev_select(struct ata_port *ap, unsigned int device)
+{
+	ata_sff_dev_select(ap, device);
+
+	/* Apply timings */
+	pata_macio_apply_timings(ap, device);
+}
+
+static void pata_macio_set_timings(struct ata_port *ap,
+				   struct ata_device *adev)
+{
+	struct pata_macio_priv *priv = ap->private_data;
+	const struct pata_macio_timing *t;
+
+	dev_dbg(priv->dev, "Set timings: DEV=%d,PIO=0x%x (%s),DMA=0x%x (%s)\n",
+		adev->devno,
+		adev->pio_mode,
+		ata_mode_string(ata_xfer_mode2mask(adev->pio_mode)),
+		adev->dma_mode,
+		ata_mode_string(ata_xfer_mode2mask(adev->dma_mode)));
+
+	/* First clear timings */
+	priv->treg[adev->devno][0] = priv->treg[adev->devno][1] = 0;
+
+	/* Now get the PIO timings */
+	t = pata_macio_find_timing(priv, adev->pio_mode);
+	if (t == NULL) {
+		dev_warn(priv->dev, "Invalid PIO timing requested: 0x%x\n",
+			 adev->pio_mode);
+		t = pata_macio_find_timing(priv, XFER_PIO_0);
+	}
+	BUG_ON(t == NULL);
+
+	/* PIO timings only ever use the first treg */
+	priv->treg[adev->devno][0] |= t->reg1;
+
+	/* Now get DMA timings */
+	t = pata_macio_find_timing(priv, adev->dma_mode);
+	if (t == NULL || (t->reg1 == 0 && t->reg2 == 0)) {
+		dev_dbg(priv->dev, "DMA timing not set yet, using MW_DMA_0\n");
+		t = pata_macio_find_timing(priv, XFER_MW_DMA_0);
+	}
+	BUG_ON(t == NULL);
+
+	/* DMA timings can use both tregs */
+	priv->treg[adev->devno][0] |= t->reg1;
+	priv->treg[adev->devno][1] |= t->reg2;
+
+	dev_dbg(priv->dev, " -> %08x %08x\n",
+		priv->treg[adev->devno][0],
+		priv->treg[adev->devno][1]);
+
+	/* Apply to hardware */
+	pata_macio_apply_timings(ap, adev->devno);
+}
+
+/*
+ * Blast some well known "safe" values to the timing registers at init or
+ * wakeup from sleep time, before we do real calculation
+ */
+static void pata_macio_default_timings(struct pata_macio_priv *priv)
+{
+	unsigned int value, value2 = 0;
+
+	switch(priv->kind) {
+		case controller_sh_ata6:
+			value = 0x0a820c97;
+			value2 = 0x00033031;
+			break;
+		case controller_un_ata6:
+		case controller_k2_ata6:
+			value = 0x08618a92;
+			value2 = 0x00002921;
+			break;
+		case controller_kl_ata4:
+			value = 0x0008438c;
+			break;
+		case controller_kl_ata3:
+			value = 0x00084526;
+			break;
+		case controller_heathrow:
+		case controller_ohare:
+		default:
+			value = 0x00074526;
+			break;
+	}
+	priv->treg[0][0] = priv->treg[1][0] = value;
+	priv->treg[0][1] = priv->treg[1][1] = value2;
+}
+
+static int pata_macio_cable_detect(struct ata_port *ap)
+{
+	struct pata_macio_priv *priv = ap->private_data;
+
+	/* Get cable type from device-tree */
+	if (priv->kind == controller_kl_ata4 ||
+	    priv->kind == controller_un_ata6 ||
+	    priv->kind == controller_k2_ata6 ||
+	    priv->kind == controller_sh_ata6) {
+		const char* cable = of_get_property(priv->node, "cable-type",
+						    NULL);
+		struct device_node *root = of_find_node_by_path("/");
+		const char *model = of_get_property(root, "model", NULL);
+
+		if (cable && !strncmp(cable, "80-", 3)) {
+			/* Some drives fail to detect 80c cable in PowerBook
+			 * These machine use proprietary short IDE cable
+			 * anyway
+			 */
+			if (!strncmp(model, "PowerBook", 9))
+				return ATA_CBL_PATA40_SHORT;
+			else
+				return ATA_CBL_PATA80;
+		}
+	}
+
+	/* G5's seem to have incorrect cable type in device-tree.
+	 * Let's assume they always have a 80 conductor cable, this seem to
+	 * be always the case unless the user mucked around
+	 */
+	if (of_device_is_compatible(priv->node, "K2-UATA") ||
+	    of_device_is_compatible(priv->node, "shasta-ata"))
+		return ATA_CBL_PATA80;
+
+	/* Anything else is 40 connectors */
+	return ATA_CBL_PATA40;
+}
+
+static void pata_macio_qc_prep(struct ata_queued_cmd *qc)
+{
+	unsigned int write = (qc->tf.flags & ATA_TFLAG_WRITE);
+	struct ata_port *ap = qc->ap;
+	struct pata_macio_priv *priv = ap->private_data;
+	struct scatterlist *sg;
+	struct dbdma_cmd *table;
+	unsigned int si, pi;
+
+	dev_dbgdma(priv->dev, "%s: qc %p flags %lx, write %d dev %d\n",
+		   __func__, qc, qc->flags, write, qc->dev->devno);
+
+	if (!(qc->flags & ATA_QCFLAG_DMAMAP))
+		return;
+
+	table = (struct dbdma_cmd *) priv->dma_table_cpu;
+
+	pi = 0;
+	for_each_sg(qc->sg, sg, qc->n_elem, si) {
+		u32 addr, sg_len, len;
+
+		/* determine if physical DMA addr spans 64K boundary.
+		 * Note h/w doesn't support 64-bit, so we unconditionally
+		 * truncate dma_addr_t to u32.
+		 */
+		addr = (u32) sg_dma_address(sg);
+		sg_len = sg_dma_len(sg);
+
+		while (sg_len) {
+			/* table overflow should never happen */
+			BUG_ON (pi++ >= MAX_DCMDS);
+
+			len = (sg_len < MAX_DBDMA_SEG) ? sg_len : MAX_DBDMA_SEG;
+			st_le16(&table->command, write ? OUTPUT_MORE: INPUT_MORE);
+			st_le16(&table->req_count, len);
+			st_le32(&table->phy_addr, addr);
+			table->cmd_dep = 0;
+			table->xfer_status = 0;
+			table->res_count = 0;
+			addr += len;
+			sg_len -= len;
+			++table;
+		}
+	}
+
+	/* Should never happen according to Tejun */
+	BUG_ON(!pi);
+
+	/* Convert the last command to an input/output */
+	table--;
+	st_le16(&table->command, write ? OUTPUT_LAST: INPUT_LAST);
+	table++;
+
+	/* Add the stop command to the end of the list */
+	memset(table, 0, sizeof(struct dbdma_cmd));
+	st_le16(&table->command, DBDMA_STOP);
+
+	dev_dbgdma(priv->dev, "%s: %d DMA list entries\n", __func__, pi);
+}
+
+
+static void pata_macio_freeze(struct ata_port *ap)
+{
+	struct dbdma_regs __iomem *dma_regs = ap->ioaddr.bmdma_addr;
+
+	if (dma_regs) {
+		unsigned int timeout = 1000000;
+
+		/* Make sure DMA controller is stopped */
+		writel((RUN|PAUSE|FLUSH|WAKE|DEAD) << 16, &dma_regs->control);
+		while (--timeout && (readl(&dma_regs->status) & RUN))
+			udelay(1);
+	}
+
+	ata_sff_freeze(ap);
+}
+
+
+static void pata_macio_bmdma_setup(struct ata_queued_cmd *qc)
+{
+	struct ata_port *ap = qc->ap;
+	struct pata_macio_priv *priv = ap->private_data;
+	struct dbdma_regs __iomem *dma_regs = ap->ioaddr.bmdma_addr;
+	int dev = qc->dev->devno;
+
+	dev_dbgdma(priv->dev, "%s: qc %p\n", __func__, qc);
+
+	/* Make sure DMA commands updates are visible */
+	writel(priv->dma_table_dma, &dma_regs->cmdptr);
+
+	/* On KeyLargo 66Mhz cell, we need to add 60ns to wrDataSetup on
+	 * UDMA reads
+	 */
+	if (priv->kind == controller_kl_ata4 &&
+	    (priv->treg[dev][0] & TR_66_UDMA_EN)) {
+		void __iomem *rbase = ap->ioaddr.cmd_addr;
+		u32 reg = priv->treg[dev][0];
+
+		if (!(qc->tf.flags & ATA_TFLAG_WRITE))
+			reg += 0x00800000;
+		writel(reg, rbase + IDE_TIMING_CONFIG);
+	}
+
+	/* issue r/w command */
+	ap->ops->sff_exec_command(ap, &qc->tf);
+}
+
+static void pata_macio_bmdma_start(struct ata_queued_cmd *qc)
+{
+	struct ata_port *ap = qc->ap;
+	struct pata_macio_priv *priv = ap->private_data;
+	struct dbdma_regs __iomem *dma_regs = ap->ioaddr.bmdma_addr;
+
+	dev_dbgdma(priv->dev, "%s: qc %p\n", __func__, qc);
+
+	writel((RUN << 16) | RUN, &dma_regs->control);
+	/* Make sure it gets to the controller right now */
+	(void)readl(&dma_regs->control);
+}
+
+static void pata_macio_bmdma_stop(struct ata_queued_cmd *qc)
+{
+	struct ata_port *ap = qc->ap;
+	struct pata_macio_priv *priv = ap->private_data;
+	struct dbdma_regs __iomem *dma_regs = ap->ioaddr.bmdma_addr;
+	unsigned int timeout = 1000000;
+
+	dev_dbgdma(priv->dev, "%s: qc %p\n", __func__, qc);
+
+	/* Stop the DMA engine and wait for it to full halt */
+	writel (((RUN|WAKE|DEAD) << 16), &dma_regs->control);
+	while (--timeout && (readl(&dma_regs->status) & RUN))
+		udelay(1);
+}
+
+static u8 pata_macio_bmdma_status(struct ata_port *ap)
+{
+	struct pata_macio_priv *priv = ap->private_data;
+	struct dbdma_regs __iomem *dma_regs = ap->ioaddr.bmdma_addr;
+	u32 dstat, rstat = ATA_DMA_INTR;
+	unsigned long timeout = 0;
+
+	dstat = readl(&dma_regs->status);
+
+	dev_dbgdma(priv->dev, "%s: dstat=%x\n", __func__, dstat);
+
+	/* We have two things to deal with here:
+	 *
+	 * - The dbdma won't stop if the command was started
+	 * but completed with an error without transferring all
+	 * datas. This happens when bad blocks are met during
+	 * a multi-block transfer.
+	 *
+	 * - The dbdma fifo hasn't yet finished flushing to
+	 * to system memory when the disk interrupt occurs.
+	 *
+	 */
+
+	/* First check for errors */
+	if ((dstat & (RUN|DEAD)) != RUN)
+		rstat |= ATA_DMA_ERR;
+
+	/* If ACTIVE is cleared, the STOP command has been hit and
+	 * the transfer is complete. If not, we have to flush the
+	 * channel.
+	 */
+	if ((dstat & ACTIVE) == 0)
+		return rstat;
+
+	dev_dbgdma(priv->dev, "%s: DMA still active, flushing...\n", __func__);
+
+	/* If dbdma didn't execute the STOP command yet, the
+	 * active bit is still set. We consider that we aren't
+	 * sharing interrupts (which is hopefully the case with
+	 * those controllers) and so we just try to flush the
+	 * channel for pending data in the fifo
+	 */
+	udelay(1);
+	writel((FLUSH << 16) | FLUSH, &dma_regs->control);
+	for (;;) {
+		udelay(1);
+		dstat = readl(&dma_regs->status);
+		if ((dstat & FLUSH) == 0)
+			break;
+		if (++timeout > 1000) {
+			dev_warn(priv->dev, "timeout flushing DMA\n");
+			rstat |= ATA_DMA_ERR;
+			break;
+		}
+	}
+	return rstat;
+}
+
+/* port_start is when we allocate the DMA command list */
+static int pata_macio_port_start(struct ata_port *ap)
+{
+	struct pata_macio_priv *priv = ap->private_data;
+
+	if (ap->ioaddr.bmdma_addr == NULL)
+		return 0;
+
+	/* Allocate space for the DBDMA commands.
+	 *
+	 * The +2 is +1 for the stop command and +1 to allow for
+	 * aligning the start address to a multiple of 16 bytes.
+	 */
+	priv->dma_table_cpu =
+		dmam_alloc_coherent(priv->dev,
+				    (MAX_DCMDS + 2) * sizeof(struct dbdma_cmd),
+				    &priv->dma_table_dma, GFP_KERNEL);
+	if (priv->dma_table_cpu == NULL) {
+		dev_err(priv->dev, "Unable to allocate DMA command list\n");
+		ap->ioaddr.bmdma_addr = NULL;
+	}
+	return 0;
+}
+
+static void pata_macio_irq_clear(struct ata_port *ap)
+{
+	struct pata_macio_priv *priv = ap->private_data;
+
+	/* Nothing to do here */
+
+	dev_dbgdma(priv->dev, "%s\n", __func__);
+}
+
+static void pata_macio_reset_hw(struct pata_macio_priv *priv, int resume)
+{
+	dev_dbg(priv->dev, "Enabling & resetting... \n");
+
+	if (priv->mediabay)
+		return;
+
+	if (priv->kind == controller_ohare && !resume) {
+		/* The code below is having trouble on some ohare machines
+		 * (timing related ?). Until I can put my hand on one of these
+		 * units, I keep the old way
+		 */
+		ppc_md.feature_call(PMAC_FTR_IDE_ENABLE, priv->node, 0, 1);
+	} else {
+		int rc;
+
+ 		/* Reset and enable controller */
+		rc = ppc_md.feature_call(PMAC_FTR_IDE_RESET,
+					 priv->node, priv->aapl_bus_id, 1);
+		ppc_md.feature_call(PMAC_FTR_IDE_ENABLE,
+				    priv->node, priv->aapl_bus_id, 1);
+		msleep(10);
+		/* Only bother waiting if there's a reset control */
+		if (rc == 0) {
+			ppc_md.feature_call(PMAC_FTR_IDE_RESET,
+					    priv->node, priv->aapl_bus_id, 0);
+			msleep(IDE_WAKEUP_DELAY_MS);
+		}
+	}
+
+	/* If resuming a PCI device, restore the config space here */
+	if (priv->pdev && resume) {
+		int rc;
+
+		pci_restore_state(priv->pdev);
+		rc = pcim_enable_device(priv->pdev);
+		if (rc)
+			dev_printk(KERN_ERR, &priv->pdev->dev,
+				   "Failed to enable device after resume (%d)\n", rc);
+		else
+			pci_set_master(priv->pdev);
+	}
+
+	/* On Kauai, initialize the FCR. We don't perform a reset, doesn't really
+	 * seem necessary and speeds up the boot process
+	 */
+	if (priv->kauai_fcr)
+		writel(KAUAI_FCR_UATA_MAGIC |
+		       KAUAI_FCR_UATA_RESET_N |
+		       KAUAI_FCR_UATA_ENABLE, priv->kauai_fcr);
+}
+
+/* Hook the standard slave config to fixup some HW related alignment
+ * restrictions
+ */
+static int pata_macio_slave_config(struct scsi_device *sdev)
+{
+	struct ata_port *ap = ata_shost_to_port(sdev->host);
+	struct pata_macio_priv *priv = ap->private_data;
+	struct ata_device *dev;
+	u16 cmd;
+	int rc;
+
+	/* First call original */
+	rc = ata_scsi_slave_config(sdev);
+	if (rc)
+		return rc;
+
+	/* This is lifted from sata_nv */
+	dev = &ap->link.device[sdev->id];
+
+	/* OHare has issues with non cache aligned DMA on some chipsets */
+	if (priv->kind == controller_ohare) {
+		blk_queue_update_dma_alignment(sdev->request_queue, 31);
+		blk_queue_update_dma_pad(sdev->request_queue, 31);
+
+		/* Tell the world about it */
+		ata_dev_printk(dev, KERN_INFO, "OHare alignment limits applied\n");
+		return 0;
+	}
+
+	/* We only have issues with ATAPI */
+	if (dev->class != ATA_DEV_ATAPI)
+		return 0;
+
+	/* Shasta and K2 seem to have "issues" with reads ... */
+	if (priv->kind == controller_sh_ata6 || priv->kind == controller_k2_ata6) {
+		/* Allright these are bad, apply restrictions */
+		blk_queue_update_dma_alignment(sdev->request_queue, 15);
+		blk_queue_update_dma_pad(sdev->request_queue, 15);
+
+		/* We enable MWI and hack cache line size directly here, this
+		 * is specific to this chipset and not normal values, we happen
+		 * to somewhat know what we are doing here (which is basically
+		 * to do the same Apple does and pray they did not get it wrong :-)
+		 */
+		BUG_ON(!priv->pdev);
+		pci_write_config_byte(priv->pdev, PCI_CACHE_LINE_SIZE, 0x08);
+		pci_read_config_word(priv->pdev, PCI_COMMAND, &cmd);
+		pci_write_config_word(priv->pdev, PCI_COMMAND,
+				      cmd | PCI_COMMAND_INVALIDATE);
+
+		/* Tell the world about it */
+		ata_dev_printk(dev, KERN_INFO,
+			       "K2/Shasta alignment limits applied\n");
+	}
+
+	return 0;
+}
+
+#ifdef CONFIG_PM
+
+static int pata_macio_do_suspend(struct pata_macio_priv *priv, pm_message_t mesg)
+{
+	int rc;
+
+	/* First, core libata suspend to do most of the work */
+	rc = ata_host_suspend(priv->host, mesg);
+	if (rc)
+		return rc;
+
+	/* Restore to default timings */
+	pata_macio_default_timings(priv);
+
+	/* Mask interrupt. Not strictly necessary but old driver did
+	 * it and I'd rather not change that here */
+	disable_irq(priv->irq);
+
+	/* The media bay will handle itself just fine */
+	if (priv->mediabay)
+		return 0;
+
+	/* Kauai has bus control FCRs directly here */
+	if (priv->kauai_fcr) {
+		u32 fcr = readl(priv->kauai_fcr);
+		fcr &= ~(KAUAI_FCR_UATA_RESET_N | KAUAI_FCR_UATA_ENABLE);
+		writel(fcr, priv->kauai_fcr);
+	}
+
+	/* For PCI, save state and disable DMA. No need to call
+	 * pci_set_power_state(), the HW doesn't do D states that
+	 * way, the platform code will take care of suspending the
+	 * ASIC properly
+	 */
+	if (priv->pdev) {
+		pci_save_state(priv->pdev);
+		pci_disable_device(priv->pdev);
+	}
+
+	/* Disable the bus on older machines and the cell on kauai */
+	ppc_md.feature_call(PMAC_FTR_IDE_ENABLE, priv->node,
+			    priv->aapl_bus_id, 0);
+
+	return 0;
+}
+
+static int pata_macio_do_resume(struct pata_macio_priv *priv)
+{
+	/* Reset and re-enable the HW */
+	pata_macio_reset_hw(priv, 1);
+
+	/* Sanitize drive timings */
+	pata_macio_apply_timings(priv->host->ports[0], 0);
+
+	/* We want our IRQ back ! */
+	enable_irq(priv->irq);
+
+	/* Let the libata core take it from there */
+	ata_host_resume(priv->host);
+
+	return 0;
+}
+
+#endif /* CONFIG_PM */
+
+static struct scsi_host_template pata_macio_sht = {
+	ATA_BASE_SHT(DRV_NAME),
+	.sg_tablesize		= MAX_DCMDS,
+	/* We may not need that strict one */
+	.dma_boundary		= ATA_DMA_BOUNDARY,
+	.slave_configure	= pata_macio_slave_config,
+};
+
+static struct ata_port_operations pata_macio_ops = {
+	.inherits		= &ata_sff_port_ops,
+
+	.freeze			= pata_macio_freeze,
+	.set_piomode		= pata_macio_set_timings,
+	.set_dmamode		= pata_macio_set_timings,
+	.cable_detect		= pata_macio_cable_detect,
+	.sff_dev_select		= pata_macio_dev_select,
+	.qc_prep		= pata_macio_qc_prep,
+	.mode_filter		= ata_bmdma_mode_filter,
+	.bmdma_setup		= pata_macio_bmdma_setup,
+	.bmdma_start		= pata_macio_bmdma_start,
+	.bmdma_stop		= pata_macio_bmdma_stop,
+	.bmdma_status		= pata_macio_bmdma_status,
+	.port_start		= pata_macio_port_start,
+	.sff_irq_clear		= pata_macio_irq_clear,
+};
+
+static void __devinit pata_macio_invariants(struct pata_macio_priv *priv)
+{
+	const int *bidp;
+
+	/* Identify the type of controller */
+	if (of_device_is_compatible(priv->node, "shasta-ata")) {
+		priv->kind = controller_sh_ata6;
+	        priv->timings = pata_macio_shasta_timings;
+	} else if (of_device_is_compatible(priv->node, "kauai-ata")) {
+		priv->kind = controller_un_ata6;
+	        priv->timings = pata_macio_kauai_timings;
+	} else if (of_device_is_compatible(priv->node, "K2-UATA")) {
+		priv->kind = controller_k2_ata6;
+	        priv->timings = pata_macio_kauai_timings;
+	} else if (of_device_is_compatible(priv->node, "keylargo-ata")) {
+		if (strcmp(priv->node->name, "ata-4") == 0) {
+			priv->kind = controller_kl_ata4;
+			priv->timings = pata_macio_kl66_timings;
+		} else {
+			priv->kind = controller_kl_ata3;
+			priv->timings = pata_macio_kl33_timings;
+		}
+	} else if (of_device_is_compatible(priv->node, "heathrow-ata")) {
+		priv->kind = controller_heathrow;
+		priv->timings = pata_macio_heathrow_timings;
+	} else {
+		priv->kind = controller_ohare;
+		priv->timings = pata_macio_ohare_timings;
+	}
+
+	/* XXX FIXME --- setup priv->mediabay here */
+
+	/* Get Apple bus ID (for clock and ASIC control) */
+	bidp = of_get_property(priv->node, "AAPL,bus-id", NULL);
+	priv->aapl_bus_id =  bidp ? *bidp : 0;
+
+	/* Fixup missing Apple bus ID in case of media-bay */
+	if (priv->mediabay && bidp == 0)
+		priv->aapl_bus_id = 1;
+}
+
+static void __devinit pata_macio_setup_ios(struct ata_ioports *ioaddr,
+					   void __iomem * base,
+					   void __iomem * dma)
+{
+	/* cmd_addr is the base of regs for that port */
+	ioaddr->cmd_addr	= base;
+
+	/* taskfile registers */
+	ioaddr->data_addr	= base + (ATA_REG_DATA    << 4);
+	ioaddr->error_addr	= base + (ATA_REG_ERR     << 4);
+	ioaddr->feature_addr	= base + (ATA_REG_FEATURE << 4);
+	ioaddr->nsect_addr	= base + (ATA_REG_NSECT   << 4);
+	ioaddr->lbal_addr	= base + (ATA_REG_LBAL    << 4);
+	ioaddr->lbam_addr	= base + (ATA_REG_LBAM    << 4);
+	ioaddr->lbah_addr	= base + (ATA_REG_LBAH    << 4);
+	ioaddr->device_addr	= base + (ATA_REG_DEVICE  << 4);
+	ioaddr->status_addr	= base + (ATA_REG_STATUS  << 4);
+	ioaddr->command_addr	= base + (ATA_REG_CMD     << 4);
+	ioaddr->altstatus_addr	= base + 0x160;
+	ioaddr->ctl_addr	= base + 0x160;
+	ioaddr->bmdma_addr	= dma;
+}
+
+static void __devinit pmac_macio_calc_timing_masks(struct pata_macio_priv *priv,
+						   struct ata_port_info   *pinfo)
+{
+	int i = 0;
+
+	pinfo->pio_mask		= 0;
+	pinfo->mwdma_mask	= 0;
+	pinfo->udma_mask	= 0;
+
+	while (priv->timings[i].mode > 0) {
+		unsigned int mask = 1U << (priv->timings[i].mode & 0x0f);
+		switch(priv->timings[i].mode & 0xf0) {
+		case 0x00: /* PIO */
+			pinfo->pio_mask |= (mask >> 8);
+			break;
+		case 0x20: /* MWDMA */
+			pinfo->mwdma_mask |= mask;
+			break;
+		case 0x40: /* UDMA */
+			pinfo->udma_mask |= mask;
+			break;
+		}
+		i++;
+	}
+	dev_dbg(priv->dev, "Supported masks: PIO=%lx, MWDMA=%lx, UDMA=%lx\n",
+		pinfo->pio_mask, pinfo->mwdma_mask, pinfo->udma_mask);
+}
+
+static int __devinit pata_macio_common_init(struct pata_macio_priv	*priv,
+					    resource_size_t		tfregs,
+					    resource_size_t		dmaregs,
+					    resource_size_t		fcregs,
+					    unsigned long		irq)
+{
+	struct ata_port_info		pinfo;
+	const struct ata_port_info	*ppi[] = { &pinfo, NULL };
+	void __iomem			*dma_regs = NULL;
+
+	/* Fill up privates with various invariants collected from the
+	 * device-tree
+	 */
+	pata_macio_invariants(priv);
+
+	/* Make sure we have sane initial timings in the cache */
+	pata_macio_default_timings(priv);
+
+	/* Not sure what the real max is but we know it's less than 64K, let's
+	 * use 64K minus 256
+	 */
+	dma_set_max_seg_size(priv->dev, MAX_DBDMA_SEG);
+
+	/* Allocate libata host for 1 port */
+	memset(&pinfo, 0, sizeof(struct ata_port_info));
+	pmac_macio_calc_timing_masks(priv, &pinfo);
+	pinfo.flags		= ATA_FLAG_SLAVE_POSS | ATA_FLAG_MMIO |
+				  ATA_FLAG_NO_LEGACY;
+	pinfo.port_ops		= &pata_macio_ops;
+	pinfo.private_data	= priv;
+
+	priv->host = ata_host_alloc_pinfo(priv->dev, ppi, 1);
+	if (priv->host == NULL) {
+		dev_err(priv->dev, "Failed to allocate ATA port structure\n");
+		return -ENOMEM;
+	}
+
+	/* Setup the private data in host too */
+	priv->host->private_data = priv;
+
+	/* Map base registers */
+	priv->tfregs = devm_ioremap(priv->dev, tfregs, 0x100);
+	if (priv->tfregs == NULL) {
+		dev_err(priv->dev, "Failed to map ATA ports\n");
+		return -ENOMEM;
+	}
+	priv->host->iomap = &priv->tfregs;
+
+	/* Map DMA regs */
+	if (dmaregs != 0) {
+		dma_regs = devm_ioremap(priv->dev, dmaregs,
+					sizeof(struct dbdma_regs));
+		if (dma_regs == NULL)
+			dev_warn(priv->dev, "Failed to map ATA DMA registers\n");
+	}
+
+	/* If chip has local feature control, map those regs too */
+	if (fcregs != 0) {
+		priv->kauai_fcr = devm_ioremap(priv->dev, fcregs, 4);
+		if (priv->kauai_fcr == NULL) {
+			dev_err(priv->dev, "Failed to map ATA FCR register\n");
+			return -ENOMEM;
+		}
+	}
+
+	/* Setup port data structure */
+	pata_macio_setup_ios(&priv->host->ports[0]->ioaddr,
+			     priv->tfregs, dma_regs);
+	priv->host->ports[0]->private_data = priv;
+
+	/* hard-reset the controller */
+	pata_macio_reset_hw(priv, 0);
+	pata_macio_apply_timings(priv->host->ports[0], 0);
+
+	/* Enable bus master if necessary */
+	if (priv->pdev && dma_regs)
+		pci_set_master(priv->pdev);
+
+	dev_info(priv->dev, "Activating pata-macio chipset %s, Apple bus ID %d\n",
+		 macio_ata_names[priv->kind], priv->aapl_bus_id);
+
+	/* Start it up */
+	priv->irq = irq;
+	return ata_host_activate(priv->host, irq, ata_sff_interrupt, 0,
+				 &pata_macio_sht);
+}
+
+static int __devinit pata_macio_attach(struct macio_dev *mdev,
+				       const struct of_device_id *match)
+{
+	struct pata_macio_priv	*priv;
+	resource_size_t		tfregs, dmaregs = 0;
+	unsigned long		irq;
+	int			rc;
+
+	/* Check for broken device-trees */
+	if (macio_resource_count(mdev) == 0) {
+		dev_err(&mdev->ofdev.dev,
+			"No addresses for controller\n");
+		return -ENXIO;
+	}
+
+	/* Enable managed resources */
+	macio_enable_devres(mdev);
+
+	/* Allocate and init private data structure */
+	priv = devm_kzalloc(&mdev->ofdev.dev,
+			    sizeof(struct pata_macio_priv), GFP_KERNEL);
+	if (priv == NULL) {
+		dev_err(&mdev->ofdev.dev,
+			"Failed to allocate private memory\n");
+		return -ENOMEM;
+	}
+	priv->node = of_node_get(mdev->ofdev.node);
+	priv->mdev = mdev;
+	priv->dev = &mdev->ofdev.dev;
+
+	/* Request memory resource for taskfile registers */
+	if (macio_request_resource(mdev, 0, "pata-macio")) {
+		dev_err(&mdev->ofdev.dev,
+			"Cannot obtain taskfile resource\n");
+		return -EBUSY;
+	}
+	tfregs = macio_resource_start(mdev, 0);
+
+	/* Request resources for DMA registers if any */
+	if (macio_resource_count(mdev) >= 2) {
+		if (macio_request_resource(mdev, 1, "pata-macio-dma"))
+			dev_err(&mdev->ofdev.dev,
+				"Cannot obtain DMA resource\n");
+		else
+			dmaregs = macio_resource_start(mdev, 1);
+	}
+
+	/*
+	 * Fixup missing IRQ for some old implementations with broken
+	 * device-trees.
+	 *
+	 * This is a bit bogus, it should be fixed in the device-tree itself,
+	 * via the existing macio fixups, based on the type of interrupt
+	 * controller in the machine. However, I have no test HW for this case,
+	 * and this trick works well enough on those old machines...
+	 */
+	if (macio_irq_count(mdev) == 0) {
+		dev_warn(&mdev->ofdev.dev,
+			 "No interrupts for controller, using 13\n");
+		irq = irq_create_mapping(NULL, 13);
+	} else
+		irq = macio_irq(mdev, 0);
+
+	/* Prevvent media bay callbacks until fully registered */
+	lock_media_bay(priv->mdev->media_bay);
+
+	/* Get register addresses and call common initialization */
+	rc = pata_macio_common_init(priv,
+				    tfregs,		/* Taskfile regs */
+				    dmaregs,		/* DBDMA regs */
+				    0,			/* Feature control */
+				    irq);
+	unlock_media_bay(priv->mdev->media_bay);
+
+	return rc;
+}
+
+static int __devexit pata_macio_detach(struct macio_dev *mdev)
+{
+	struct ata_host *host = macio_get_drvdata(mdev);
+	struct pata_macio_priv *priv = host->private_data;
+
+	lock_media_bay(priv->mdev->media_bay);
+
+	/* Make sure the mediabay callback doesn't try to access
+	 * dead stuff
+	 */
+	priv->host->private_data = NULL;
+
+	ata_host_detach(host);
+
+	unlock_media_bay(priv->mdev->media_bay);
+
+	return 0;
+}
+
+#ifdef CONFIG_PM
+
+static int pata_macio_suspend(struct macio_dev *mdev, pm_message_t mesg)
+{
+	struct ata_host *host = macio_get_drvdata(mdev);
+
+	return pata_macio_do_suspend(host->private_data, mesg);
+}
+
+static int pata_macio_resume(struct macio_dev *mdev)
+{
+	struct ata_host *host = macio_get_drvdata(mdev);
+
+	return pata_macio_do_resume(host->private_data);
+}
+
+#endif /* CONFIG_PM */
+
+#ifdef CONFIG_PMAC_MEDIABAY
+static void pata_macio_mb_event(struct macio_dev* mdev, int mb_state)
+{
+	struct ata_host *host = macio_get_drvdata(mdev);
+	struct ata_port *ap;
+	struct ata_eh_info *ehi;
+	struct ata_device *dev;
+	unsigned long flags;
+
+	if (!host || !host->private_data)
+		return;
+	ap = host->ports[0];
+	spin_lock_irqsave(ap->lock, flags);
+	ehi = &ap->link.eh_info;
+	if (mb_state == MB_CD) {
+		ata_ehi_push_desc(ehi, "mediabay plug");
+		ata_ehi_hotplugged(ehi);
+		ata_port_freeze(ap);
+	} else {
+		ata_ehi_push_desc(ehi, "mediabay unplug");
+		ata_for_each_dev(dev, &ap->link, ALL)
+			dev->flags |= ATA_DFLAG_DETACH;
+		ata_port_abort(ap);
+	}
+	spin_unlock_irqrestore(ap->lock, flags);
+
+}
+#endif /* CONFIG_PMAC_MEDIABAY */
+
+
+static int __devinit pata_macio_pci_attach(struct pci_dev *pdev,
+					   const struct pci_device_id *id)
+{
+	struct pata_macio_priv	*priv;
+	struct device_node	*np;
+	resource_size_t		rbase;
+
+	/* We cannot use a MacIO controller without its OF device node */
+	np = pci_device_to_OF_node(pdev);
+	if (np == NULL) {
+		dev_err(&pdev->dev,
+			"Cannot find OF device node for controller\n");
+		return -ENODEV;
+	}
+
+	/* Check that it can be enabled */
+	if (pcim_enable_device(pdev)) {
+		dev_err(&pdev->dev,
+			"Cannot enable controller PCI device\n");
+		return -ENXIO;
+	}
+
+	/* Allocate and init private data structure */
+	priv = devm_kzalloc(&pdev->dev,
+			    sizeof(struct pata_macio_priv), GFP_KERNEL);
+	if (priv == NULL) {
+		dev_err(&pdev->dev,
+			"Failed to allocate private memory\n");
+		return -ENOMEM;
+	}
+	priv->node = of_node_get(np);
+	priv->pdev = pdev;
+	priv->dev = &pdev->dev;
+
+	/* Get MMIO regions */
+	if (pci_request_regions(pdev, "pata-macio")) {
+		dev_err(&pdev->dev,
+			"Cannot obtain PCI resources\n");
+		return -EBUSY;
+	}
+
+	/* Get register addresses and call common initialization */
+	rbase = pci_resource_start(pdev, 0);
+	if (pata_macio_common_init(priv,
+				   rbase + 0x2000,	/* Taskfile regs */
+				   rbase + 0x1000,	/* DBDMA regs */
+				   rbase,		/* Feature control */
+				   pdev->irq))
+		return -ENXIO;
+
+	return 0;
+}
+
+static void __devexit pata_macio_pci_detach(struct pci_dev *pdev)
+{
+	struct ata_host *host = dev_get_drvdata(&pdev->dev);
+
+	ata_host_detach(host);
+}
+
+#ifdef CONFIG_PM
+
+static int pata_macio_pci_suspend(struct pci_dev *pdev, pm_message_t mesg)
+{
+	struct ata_host *host = dev_get_drvdata(&pdev->dev);
+
+	return pata_macio_do_suspend(host->private_data, mesg);
+}
+
+static int pata_macio_pci_resume(struct pci_dev *pdev)
+{
+	struct ata_host *host = dev_get_drvdata(&pdev->dev);
+
+	return pata_macio_do_resume(host->private_data);
+}
+
+#endif /* CONFIG_PM */
+
+static struct of_device_id pata_macio_match[] =
+{
+	{
+	.name 		= "IDE",
+	},
+	{
+	.name 		= "ATA",
+	},
+	{
+	.type		= "ide",
+	},
+	{
+	.type		= "ata",
+	},
+	{},
+};
+
+static struct macio_driver pata_macio_driver =
+{
+	.name 		= "pata-macio",
+	.match_table	= pata_macio_match,
+	.probe		= pata_macio_attach,
+	.remove		= pata_macio_detach,
+#ifdef CONFIG_PM
+	.suspend	= pata_macio_suspend,
+	.resume		= pata_macio_resume,
+#endif
+#ifdef CONFIG_PMAC_MEDIABAY
+	.mediabay_event	= pata_macio_mb_event,
+#endif
+	.driver = {
+		.owner		= THIS_MODULE,
+	},
+};
+
+static const struct pci_device_id pata_macio_pci_match[] = {
+	{ PCI_VDEVICE(APPLE, PCI_DEVICE_ID_APPLE_UNI_N_ATA),	0 },
+	{ PCI_VDEVICE(APPLE, PCI_DEVICE_ID_APPLE_IPID_ATA100),	0 },
+	{ PCI_VDEVICE(APPLE, PCI_DEVICE_ID_APPLE_K2_ATA100),	0 },
+	{ PCI_VDEVICE(APPLE, PCI_DEVICE_ID_APPLE_SH_ATA),	0 },
+	{ PCI_VDEVICE(APPLE, PCI_DEVICE_ID_APPLE_IPID2_ATA),	0 },
+	{},
+};
+
+static struct pci_driver pata_macio_pci_driver = {
+	.name		= "pata-pci-macio",
+	.id_table	= pata_macio_pci_match,
+	.probe		= pata_macio_pci_attach,
+	.remove		= pata_macio_pci_detach,
+#ifdef CONFIG_PM
+	.suspend	= pata_macio_pci_suspend,
+	.resume		= pata_macio_pci_resume,
+#endif
+	.driver = {
+		.owner		= THIS_MODULE,
+	},
+};
+MODULE_DEVICE_TABLE(pci, pata_macio_pci_match);
+
+
+static int __init pata_macio_init(void)
+{
+	int rc;
+
+	if (!machine_is(powermac))
+		return -ENODEV;
+
+	rc = pci_register_driver(&pata_macio_pci_driver);
+	if (rc)
+		return rc;
+	rc = macio_register_driver(&pata_macio_driver);
+	if (rc) {
+		pci_unregister_driver(&pata_macio_pci_driver);
+		return rc;
+	}
+	return 0;
+}
+
+static void __exit pata_macio_exit(void)
+{
+	macio_unregister_driver(&pata_macio_driver);
+	pci_unregister_driver(&pata_macio_pci_driver);
+}
+
+module_init(pata_macio_init);
+module_exit(pata_macio_exit);
+
+MODULE_AUTHOR("Benjamin Herrenschmidt");
+MODULE_DESCRIPTION("Apple MacIO PATA driver");
+MODULE_LICENSE("GPL");
+MODULE_VERSION(DRV_VERSION);
diff --git a/drivers/ata/pata_octeon_cf.c b/drivers/ata/pata_octeon_cf.c
index d6f69561dc86..37ef416c1242 100644
--- a/drivers/ata/pata_octeon_cf.c
+++ b/drivers/ata/pata_octeon_cf.c
@@ -853,7 +853,7 @@ static int __devinit octeon_cf_probe(struct platform_device *pdev)
 			return -EINVAL;
 
 		cs1 = devm_ioremap_nocache(&pdev->dev, res_cs1->start,
-					   res_cs0->end - res_cs1->start + 1);
+					   resource_size(res_cs1));
 
 		if (!cs1)
 			return -ENOMEM;
diff --git a/drivers/ata/sata_fsl.c b/drivers/ata/sata_fsl.c
index 8a5d35b759dd..ce4136eea08f 100644
--- a/drivers/ata/sata_fsl.c
+++ b/drivers/ata/sata_fsl.c
@@ -43,9 +43,9 @@ enum {
 	/*
 	 * SATA-FSL host controller supports a max. of (15+1) direct PRDEs, and
 	 * chained indirect PRDEs upto a max count of 63.
-	 * We are allocating an array of 63 PRDEs contigiously, but PRDE#15 will
+	 * We are allocating an array of 63 PRDEs contiguously, but PRDE#15 will
 	 * be setup as an indirect descriptor, pointing to it's next
-	 * (contigious) PRDE. Though chained indirect PRDE arrays are
+	 * (contiguous) PRDE. Though chained indirect PRDE arrays are
 	 * supported,it will be more efficient to use a direct PRDT and
 	 * a single chain/link to indirect PRDE array/PRDT.
 	 */
@@ -314,7 +314,7 @@ static unsigned int sata_fsl_fill_sg(struct ata_queued_cmd *qc, void *cmd_desc,
 	u32 ttl_dwords = 0;
 
 	/*
-	 * NOTE : direct & indirect prdt's are contigiously allocated
+	 * NOTE : direct & indirect prdt's are contiguously allocated
 	 */
 	struct prde *prd = (struct prde *)&((struct command_desc *)
 					    cmd_desc)->prdt;
diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
index a8a7be0d06ff..df8ee325d3ca 100644
--- a/drivers/ata/sata_mv.c
+++ b/drivers/ata/sata_mv.c
@@ -59,6 +59,7 @@
 #include <linux/dmapool.h>
 #include <linux/dma-mapping.h>
 #include <linux/device.h>
+#include <linux/clk.h>
 #include <linux/platform_device.h>
 #include <linux/ata_platform.h>
 #include <linux/mbus.h>
@@ -538,6 +539,7 @@ struct mv_port_signal {
 
 struct mv_host_priv {
 	u32			hp_flags;
+	unsigned int 		board_idx;
 	u32			main_irq_mask;
 	struct mv_port_signal	signal[8];
 	const struct mv_hw_ops	*ops;
@@ -548,6 +550,10 @@ struct mv_host_priv {
 	u32			irq_cause_offset;
 	u32			irq_mask_offset;
 	u32			unmask_all_irqs;
+
+#if defined(CONFIG_HAVE_CLK)
+	struct clk		*clk;
+#endif
 	/*
 	 * These consistent DMA memory pools give us guaranteed
 	 * alignment for hardware-accessed data structures,
@@ -2775,7 +2781,7 @@ static void mv_port_intr(struct ata_port *ap, u32 port_cause)
 	struct mv_port_priv *pp;
 	int edma_was_enabled;
 
-	if (!ap || (ap->flags & ATA_FLAG_DISABLED)) {
+	if (ap->flags & ATA_FLAG_DISABLED) {
 		mv_unexpected_intr(ap, 0);
 		return;
 	}
@@ -3393,7 +3399,7 @@ static void mv_soc_reset_hc_port(struct mv_host_priv *hpriv,
 	ZERO(0x024);		/* respq outp */
 	ZERO(0x020);		/* respq inp */
 	ZERO(0x02c);		/* test control */
-	writel(0xbc, port_mmio + EDMA_IORDY_TMOUT);
+	writel(0x800, port_mmio + EDMA_IORDY_TMOUT);
 }
 
 #undef ZERO
@@ -3854,7 +3860,6 @@ static int mv_chip_id(struct ata_host *host, unsigned int board_idx)
 /**
  *      mv_init_host - Perform some early initialization of the host.
  *	@host: ATA host to initialize
- *      @board_idx: controller index
  *
  *      If possible, do an early global reset of the host.  Then do
  *      our port init and clear/unmask all/relevant host interrupts.
@@ -3862,13 +3867,13 @@ static int mv_chip_id(struct ata_host *host, unsigned int board_idx)
  *      LOCKING:
  *      Inherited from caller.
  */
-static int mv_init_host(struct ata_host *host, unsigned int board_idx)
+static int mv_init_host(struct ata_host *host)
 {
 	int rc = 0, n_hc, port, hc;
 	struct mv_host_priv *hpriv = host->private_data;
 	void __iomem *mmio = hpriv->base;
 
-	rc = mv_chip_id(host, board_idx);
+	rc = mv_chip_id(host, hpriv->board_idx);
 	if (rc)
 		goto done;
 
@@ -3905,14 +3910,6 @@ static int mv_init_host(struct ata_host *host, unsigned int board_idx)
 		void __iomem *port_mmio = mv_port_base(mmio, port);
 
 		mv_port_init(&ap->ioaddr, port_mmio);
-
-#ifdef CONFIG_PCI
-		if (!IS_SOC(hpriv)) {
-			unsigned int offset = port_mmio - mmio;
-			ata_port_pbar_desc(ap, MV_PRIMARY_BAR, -1, "mmio");
-			ata_port_pbar_desc(ap, MV_PRIMARY_BAR, offset, "port");
-		}
-#endif
 	}
 
 	for (hc = 0; hc < n_hc; hc++) {
@@ -4035,12 +4032,21 @@ static int mv_platform_probe(struct platform_device *pdev)
 		return -ENOMEM;
 	host->private_data = hpriv;
 	hpriv->n_ports = n_ports;
+	hpriv->board_idx = chip_soc;
 
 	host->iomap = NULL;
 	hpriv->base = devm_ioremap(&pdev->dev, res->start,
 				   resource_size(res));
 	hpriv->base -= SATAHC0_REG_BASE;
 
+#if defined(CONFIG_HAVE_CLK)
+	hpriv->clk = clk_get(&pdev->dev, NULL);
+	if (IS_ERR(hpriv->clk))
+		dev_notice(&pdev->dev, "cannot get clkdev\n");
+	else
+		clk_enable(hpriv->clk);
+#endif
+
 	/*
 	 * (Re-)program MBUS remapping windows if we are asked to.
 	 */
@@ -4049,12 +4055,12 @@ static int mv_platform_probe(struct platform_device *pdev)
 
 	rc = mv_create_dma_pools(hpriv, &pdev->dev);
 	if (rc)
-		return rc;
+		goto err;
 
 	/* initialize adapter */
-	rc = mv_init_host(host, chip_soc);
+	rc = mv_init_host(host);
 	if (rc)
-		return rc;
+		goto err;
 
 	dev_printk(KERN_INFO, &pdev->dev,
 		   "slots %u ports %d\n", (unsigned)MV_MAX_Q_DEPTH,
@@ -4062,6 +4068,15 @@ static int mv_platform_probe(struct platform_device *pdev)
 
 	return ata_host_activate(host, platform_get_irq(pdev, 0), mv_interrupt,
 				 IRQF_SHARED, &mv6_sht);
+err:
+#if defined(CONFIG_HAVE_CLK)
+	if (!IS_ERR(hpriv->clk)) {
+		clk_disable(hpriv->clk);
+		clk_put(hpriv->clk);
+	}
+#endif
+
+	return rc;
 }
 
 /*
@@ -4076,14 +4091,66 @@ static int __devexit mv_platform_remove(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
 	struct ata_host *host = dev_get_drvdata(dev);
-
+#if defined(CONFIG_HAVE_CLK)
+	struct mv_host_priv *hpriv = host->private_data;
+#endif
 	ata_host_detach(host);
+
+#if defined(CONFIG_HAVE_CLK)
+	if (!IS_ERR(hpriv->clk)) {
+		clk_disable(hpriv->clk);
+		clk_put(hpriv->clk);
+	}
+#endif
 	return 0;
 }
 
+#ifdef CONFIG_PM
+static int mv_platform_suspend(struct platform_device *pdev, pm_message_t state)
+{
+	struct ata_host *host = dev_get_drvdata(&pdev->dev);
+	if (host)
+		return ata_host_suspend(host, state);
+	else
+		return 0;
+}
+
+static int mv_platform_resume(struct platform_device *pdev)
+{
+	struct ata_host *host = dev_get_drvdata(&pdev->dev);
+	int ret;
+
+	if (host) {
+		struct mv_host_priv *hpriv = host->private_data;
+		const struct mv_sata_platform_data *mv_platform_data = \
+			pdev->dev.platform_data;
+		/*
+		 * (Re-)program MBUS remapping windows if we are asked to.
+		 */
+		if (mv_platform_data->dram != NULL)
+			mv_conf_mbus_windows(hpriv, mv_platform_data->dram);
+
+		/* initialize adapter */
+		ret = mv_init_host(host);
+		if (ret) {
+			printk(KERN_ERR DRV_NAME ": Error during HW init\n");
+			return ret;
+		}
+		ata_host_resume(host);
+	}
+
+	return 0;
+}
+#else
+#define mv_platform_suspend NULL
+#define mv_platform_resume NULL
+#endif
+
 static struct platform_driver mv_platform_driver = {
 	.probe			= mv_platform_probe,
 	.remove			= __devexit_p(mv_platform_remove),
+	.suspend		= mv_platform_suspend,
+	.resume			= mv_platform_resume,
 	.driver			= {
 				   .name = DRV_NAME,
 				   .owner = THIS_MODULE,
@@ -4094,6 +4161,9 @@ static struct platform_driver mv_platform_driver = {
 #ifdef CONFIG_PCI
 static int mv_pci_init_one(struct pci_dev *pdev,
 			   const struct pci_device_id *ent);
+#ifdef CONFIG_PM
+static int mv_pci_device_resume(struct pci_dev *pdev);
+#endif
 
 
 static struct pci_driver mv_pci_driver = {
@@ -4101,6 +4171,11 @@ static struct pci_driver mv_pci_driver = {
 	.id_table		= mv_pci_tbl,
 	.probe			= mv_pci_init_one,
 	.remove			= ata_pci_remove_one,
+#ifdef CONFIG_PM
+	.suspend		= ata_pci_device_suspend,
+	.resume			= mv_pci_device_resume,
+#endif
+
 };
 
 /* move to PCI layer or libata core? */
@@ -4194,7 +4269,7 @@ static int mv_pci_init_one(struct pci_dev *pdev,
 	const struct ata_port_info *ppi[] = { &mv_port_info[board_idx], NULL };
 	struct ata_host *host;
 	struct mv_host_priv *hpriv;
-	int n_ports, rc;
+	int n_ports, port, rc;
 
 	if (!printed_version++)
 		dev_printk(KERN_INFO, &pdev->dev, "version " DRV_VERSION "\n");
@@ -4208,6 +4283,7 @@ static int mv_pci_init_one(struct pci_dev *pdev,
 		return -ENOMEM;
 	host->private_data = hpriv;
 	hpriv->n_ports = n_ports;
+	hpriv->board_idx = board_idx;
 
 	/* acquire resources */
 	rc = pcim_enable_device(pdev);
@@ -4230,8 +4306,17 @@ static int mv_pci_init_one(struct pci_dev *pdev,
 	if (rc)
 		return rc;
 
+	for (port = 0; port < host->n_ports; port++) {
+		struct ata_port *ap = host->ports[port];
+		void __iomem *port_mmio = mv_port_base(hpriv->base, port);
+		unsigned int offset = port_mmio - hpriv->base;
+
+		ata_port_pbar_desc(ap, MV_PRIMARY_BAR, -1, "mmio");
+		ata_port_pbar_desc(ap, MV_PRIMARY_BAR, offset, "port");
+	}
+
 	/* initialize adapter */
-	rc = mv_init_host(host, board_idx);
+	rc = mv_init_host(host);
 	if (rc)
 		return rc;
 
@@ -4247,6 +4332,27 @@ static int mv_pci_init_one(struct pci_dev *pdev,
 	return ata_host_activate(host, pdev->irq, mv_interrupt, IRQF_SHARED,
 				 IS_GEN_I(hpriv) ? &mv5_sht : &mv6_sht);
 }
+
+#ifdef CONFIG_PM
+static int mv_pci_device_resume(struct pci_dev *pdev)
+{
+	struct ata_host *host = dev_get_drvdata(&pdev->dev);
+	int rc;
+
+	rc = ata_pci_device_do_resume(pdev);
+	if (rc)
+		return rc;
+
+	/* initialize adapter */
+	rc = mv_init_host(host);
+	if (rc)
+		return rc;
+
+	ata_host_resume(host);
+
+	return 0;
+}
+#endif
 #endif
 
 static int mv_platform_probe(struct platform_device *pdev);
diff --git a/drivers/ata/sata_nv.c b/drivers/ata/sata_nv.c
index 1eb4e020eb5c..0c82d335c55d 100644
--- a/drivers/ata/sata_nv.c
+++ b/drivers/ata/sata_nv.c
@@ -1975,7 +1975,7 @@ static int nv_swncq_slave_config(struct scsi_device *sdev)
 	ata_id_c_string(dev->id, model_num, ATA_ID_PROD, sizeof(model_num));
 
 	if (strncmp(model_num, "Maxtor", 6) == 0) {
-		ata_scsi_change_queue_depth(sdev, 1);
+		ata_scsi_change_queue_depth(sdev, 1, SCSI_QDEPTH_DEFAULT);
 		ata_dev_printk(dev, KERN_NOTICE,
 			"Disabling SWNCQ mode (depth %x)\n", sdev->queue_depth);
 	}
diff --git a/drivers/ata/sata_promise.c b/drivers/ata/sata_promise.c
index 07d8d00b4d34..63306285c843 100644
--- a/drivers/ata/sata_promise.c
+++ b/drivers/ata/sata_promise.c
@@ -862,7 +862,7 @@ static void pdc_error_intr(struct ata_port *ap, struct ata_queued_cmd *qc,
 	if (port_status & PDC_DRIVE_ERR)
 		ac_err_mask |= AC_ERR_DEV;
 	if (port_status & (PDC_OVERRUN_ERR | PDC_UNDERRUN_ERR))
-		ac_err_mask |= AC_ERR_HSM;
+		ac_err_mask |= AC_ERR_OTHER;
 	if (port_status & (PDC2_ATA_HBA_ERR | PDC2_ATA_DMA_CNT_ERR))
 		ac_err_mask |= AC_ERR_ATA_BUS;
 	if (port_status & (PDC_PH_ERR | PDC_SH_ERR | PDC_DH_ERR | PDC2_HTO_ERR
diff --git a/drivers/atm/iphase.c b/drivers/atm/iphase.c
index b2c1b37ab2e4..25a4c86f839b 100644
--- a/drivers/atm/iphase.c
+++ b/drivers/atm/iphase.c
@@ -557,7 +557,7 @@ static int ia_cbr_setup (IADEV *dev, struct atm_vcc *vcc) {
           memcpy((caddr_t)&cbrVC,(caddr_t)TstSchedTbl,sizeof(cbrVC));
        } /* while */
        // Move this VCI number into this location of the CBR Sched table.
-       memcpy((caddr_t)TstSchedTbl, (caddr_t)&vcIndex,sizeof(TstSchedTbl));
+       memcpy((caddr_t)TstSchedTbl, (caddr_t)&vcIndex, sizeof(*TstSchedTbl));
        dev->CbrRemEntries--;
        toBeAssigned--;
    } /* while */ 
@@ -1132,7 +1132,7 @@ static int rx_pkt(struct atm_dev *dev)
                     IF_ERR(printk(" cause: packet time out\n");)
                 }
                 else {
-                    IF_ERR(printk(" cause: buffer over flow\n");)
+                    IF_ERR(printk(" cause: buffer overflow\n");)
                 }
 		goto out_free_desc;
 	}  
diff --git a/drivers/base/bus.c b/drivers/base/bus.c
index 63c143e54a57..c0c5a43d9fb3 100644
--- a/drivers/base/bus.c
+++ b/drivers/base/bus.c
@@ -703,9 +703,9 @@ int bus_add_driver(struct device_driver *drv)
 	return 0;
 
 out_unregister:
+	kobject_put(&priv->kobj);
 	kfree(drv->p);
 	drv->p = NULL;
-	kobject_put(&priv->kobj);
 out_put_bus:
 	bus_put(bus);
 	return error;
diff --git a/drivers/base/core.c b/drivers/base/core.c
index 6bee6af8d8e1..282025770429 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -56,7 +56,14 @@ static inline int device_is_not_partition(struct device *dev)
  */
 const char *dev_driver_string(const struct device *dev)
 {
-	return dev->driver ? dev->driver->name :
+	struct device_driver *drv;
+
+	/* dev->driver can change to NULL underneath us because of unbinding,
+	 * so be careful about accessing it.  dev->bus and dev->class should
+	 * never change once they are set, so they don't need special care.
+	 */
+	drv = ACCESS_ONCE(dev->driver);
+	return drv ? drv->name :
 			(dev->bus ? dev->bus->name :
 			(dev->class ? dev->class->name : ""));
 }
@@ -439,7 +446,8 @@ struct kset *devices_kset;
  * @dev: device.
  * @attr: device attribute descriptor.
  */
-int device_create_file(struct device *dev, struct device_attribute *attr)
+int device_create_file(struct device *dev,
+		       const struct device_attribute *attr)
 {
 	int error = 0;
 	if (dev)
@@ -452,7 +460,8 @@ int device_create_file(struct device *dev, struct device_attribute *attr)
  * @dev: device.
  * @attr: device attribute descriptor.
  */
-void device_remove_file(struct device *dev, struct device_attribute *attr)
+void device_remove_file(struct device *dev,
+			const struct device_attribute *attr)
 {
 	if (dev)
 		sysfs_remove_file(&dev->kobj, &attr->attr);
@@ -463,7 +472,8 @@ void device_remove_file(struct device *dev, struct device_attribute *attr)
  * @dev: device.
  * @attr: device binary attribute descriptor.
  */
-int device_create_bin_file(struct device *dev, struct bin_attribute *attr)
+int device_create_bin_file(struct device *dev,
+			   const struct bin_attribute *attr)
 {
 	int error = -EINVAL;
 	if (dev)
@@ -477,7 +487,8 @@ EXPORT_SYMBOL_GPL(device_create_bin_file);
  * @dev: device.
  * @attr: device binary attribute descriptor.
  */
-void device_remove_bin_file(struct device *dev, struct bin_attribute *attr)
+void device_remove_bin_file(struct device *dev,
+			    const struct bin_attribute *attr)
 {
 	if (dev)
 		sysfs_remove_bin_file(&dev->kobj, attr);
@@ -898,8 +909,10 @@ int device_add(struct device *dev)
 		dev->init_name = NULL;
 	}
 
-	if (!dev_name(dev))
+	if (!dev_name(dev)) {
+		error = -EINVAL;
 		goto name_error;
+	}
 
 	pr_debug("device: '%s': %s\n", dev_name(dev), __func__);
 
@@ -987,6 +1000,8 @@ done:
 	device_remove_class_symlinks(dev);
  SymlinkError:
 	if (MAJOR(dev->devt))
+		devtmpfs_delete_node(dev);
+	if (MAJOR(dev->devt))
 		device_remove_sys_dev_entry(dev);
  devtattrError:
 	if (MAJOR(dev->devt))
@@ -1728,8 +1743,5 @@ void device_shutdown(void)
 			dev->driver->shutdown(dev);
 		}
 	}
-	kobject_put(sysfs_dev_char_kobj);
-	kobject_put(sysfs_dev_block_kobj);
-	kobject_put(dev_kobj);
 	async_synchronize_full();
 }
diff --git a/drivers/base/cpu.c b/drivers/base/cpu.c
index e62a4ccea54d..958bd1540c30 100644
--- a/drivers/base/cpu.c
+++ b/drivers/base/cpu.c
@@ -35,6 +35,7 @@ static ssize_t __ref store_online(struct sys_device *dev, struct sysdev_attribut
 	struct cpu *cpu = container_of(dev, struct cpu, sysdev);
 	ssize_t ret;
 
+	cpu_hotplug_driver_lock();
 	switch (buf[0]) {
 	case '0':
 		ret = cpu_down(cpu->sysdev.id);
@@ -49,6 +50,7 @@ static ssize_t __ref store_online(struct sys_device *dev, struct sysdev_attribut
 	default:
 		ret = -EINVAL;
 	}
+	cpu_hotplug_driver_unlock();
 
 	if (ret >= 0)
 		ret = count;
@@ -72,6 +74,38 @@ void unregister_cpu(struct cpu *cpu)
 	per_cpu(cpu_sys_devices, logical_cpu) = NULL;
 	return;
 }
+
+#ifdef CONFIG_ARCH_CPU_PROBE_RELEASE
+static ssize_t cpu_probe_store(struct class *class, const char *buf,
+			       size_t count)
+{
+	return arch_cpu_probe(buf, count);
+}
+
+static ssize_t cpu_release_store(struct class *class, const char *buf,
+				 size_t count)
+{
+	return arch_cpu_release(buf, count);
+}
+
+static CLASS_ATTR(probe, S_IWUSR, NULL, cpu_probe_store);
+static CLASS_ATTR(release, S_IWUSR, NULL, cpu_release_store);
+
+int __init cpu_probe_release_init(void)
+{
+	int rc;
+
+	rc = sysfs_create_file(&cpu_sysdev_class.kset.kobj,
+			       &class_attr_probe.attr);
+	if (!rc)
+		rc = sysfs_create_file(&cpu_sysdev_class.kset.kobj,
+				       &class_attr_release.attr);
+
+	return rc;
+}
+device_initcall(cpu_probe_release_init);
+#endif /* CONFIG_ARCH_CPU_PROBE_RELEASE */
+
 #else /* ... !CONFIG_HOTPLUG_CPU */
 static inline void register_cpu_control(struct cpu *cpu)
 {
@@ -97,7 +131,7 @@ static ssize_t show_crash_notes(struct sys_device *dev, struct sysdev_attribute
 	 * boot up and this data does not change there after. Hence this
 	 * operation should be safe. No locking required.
 	 */
-	addr = __pa(per_cpu_ptr(crash_notes, cpunum));
+	addr = per_cpu_ptr_to_phys(per_cpu_ptr(crash_notes, cpunum));
 	rc = sprintf(buf, "%Lx\n", addr);
 	return rc;
 }
diff --git a/drivers/base/dd.c b/drivers/base/dd.c
index 979d159b5cd1..ee95c76bfd3d 100644
--- a/drivers/base/dd.c
+++ b/drivers/base/dd.c
@@ -188,7 +188,7 @@ EXPORT_SYMBOL_GPL(wait_for_device_probe);
  * @dev: device to try to bind to the driver
  *
  * This function returns -ENODEV if the device is not registered,
- * 1 if the device is bound sucessfully and 0 otherwise.
+ * 1 if the device is bound successfully and 0 otherwise.
  *
  * This function must be called with @dev->sem held.  When called for a
  * USB interface, @dev->parent->sem must be held as well.
diff --git a/drivers/base/devtmpfs.c b/drivers/base/devtmpfs.c
index a1cb5afe6801..42ae452b36b0 100644
--- a/drivers/base/devtmpfs.c
+++ b/drivers/base/devtmpfs.c
@@ -32,6 +32,8 @@ static int dev_mount = 1;
 static int dev_mount;
 #endif
 
+static DEFINE_MUTEX(dirlock);
+
 static int __init mount_param(char *str)
 {
 	dev_mount = simple_strtoul(str, NULL, 0);
@@ -74,47 +76,37 @@ static int dev_mkdir(const char *name, mode_t mode)
 	dentry = lookup_create(&nd, 1);
 	if (!IS_ERR(dentry)) {
 		err = vfs_mkdir(nd.path.dentry->d_inode, dentry, mode);
+		if (!err)
+			/* mark as kernel-created inode */
+			dentry->d_inode->i_private = &dev_mnt;
 		dput(dentry);
 	} else {
 		err = PTR_ERR(dentry);
 	}
-	mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
 
+	mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
 	path_put(&nd.path);
 	return err;
 }
 
 static int create_path(const char *nodepath)
 {
-	char *path;
-	struct nameidata nd;
-	int err = 0;
-
-	path = kstrdup(nodepath, GFP_KERNEL);
-	if (!path)
-		return -ENOMEM;
-
-	err = vfs_path_lookup(dev_mnt->mnt_root, dev_mnt,
-			      path, LOOKUP_PARENT, &nd);
-	if (err == 0) {
-		struct dentry *dentry;
-
-		/* create directory right away */
-		dentry = lookup_create(&nd, 1);
-		if (!IS_ERR(dentry)) {
-			err = vfs_mkdir(nd.path.dentry->d_inode,
-					dentry, 0755);
-			dput(dentry);
-		}
-		mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
+	int err;
 
-		path_put(&nd.path);
-	} else if (err == -ENOENT) {
+	mutex_lock(&dirlock);
+	err = dev_mkdir(nodepath, 0755);
+	if (err == -ENOENT) {
+		char *path;
 		char *s;
 
 		/* parent directories do not exist, create them */
+		path = kstrdup(nodepath, GFP_KERNEL);
+		if (!path) {
+			err = -ENOMEM;
+			goto out;
+		}
 		s = path;
-		while (1) {
+		for (;;) {
 			s = strchr(s, '/');
 			if (!s)
 				break;
@@ -125,9 +117,10 @@ static int create_path(const char *nodepath)
 			s[0] = '/';
 			s++;
 		}
+		kfree(path);
 	}
-
-	kfree(path);
+out:
+	mutex_unlock(&dirlock);
 	return err;
 }
 
@@ -156,34 +149,40 @@ int devtmpfs_create_node(struct device *dev)
 		mode |= S_IFCHR;
 
 	curr_cred = override_creds(&init_cred);
+
 	err = vfs_path_lookup(dev_mnt->mnt_root, dev_mnt,
 			      nodename, LOOKUP_PARENT, &nd);
 	if (err == -ENOENT) {
-		/* create missing parent directories */
 		create_path(nodename);
 		err = vfs_path_lookup(dev_mnt->mnt_root, dev_mnt,
 				      nodename, LOOKUP_PARENT, &nd);
-		if (err)
-			goto out;
 	}
+	if (err)
+		goto out;
 
 	dentry = lookup_create(&nd, 0);
 	if (!IS_ERR(dentry)) {
-		int umask;
-
-		umask = sys_umask(0000);
 		err = vfs_mknod(nd.path.dentry->d_inode,
 				dentry, mode, dev->devt);
-		sys_umask(umask);
-		/* mark as kernel created inode */
-		if (!err)
+		if (!err) {
+			struct iattr newattrs;
+
+			/* fixup possibly umasked mode */
+			newattrs.ia_mode = mode;
+			newattrs.ia_valid = ATTR_MODE;
+			mutex_lock(&dentry->d_inode->i_mutex);
+			notify_change(dentry, &newattrs);
+			mutex_unlock(&dentry->d_inode->i_mutex);
+
+			/* mark as kernel-created inode */
 			dentry->d_inode->i_private = &dev_mnt;
+		}
 		dput(dentry);
 	} else {
 		err = PTR_ERR(dentry);
 	}
-	mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
 
+	mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
 	path_put(&nd.path);
 out:
 	kfree(tmp);
@@ -205,16 +204,21 @@ static int dev_rmdir(const char *name)
 	mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT);
 	dentry = lookup_one_len(nd.last.name, nd.path.dentry, nd.last.len);
 	if (!IS_ERR(dentry)) {
-		if (dentry->d_inode)
-			err = vfs_rmdir(nd.path.dentry->d_inode, dentry);
-		else
+		if (dentry->d_inode) {
+			if (dentry->d_inode->i_private == &dev_mnt)
+				err = vfs_rmdir(nd.path.dentry->d_inode,
+						dentry);
+			else
+				err = -EPERM;
+		} else {
 			err = -ENOENT;
+		}
 		dput(dentry);
 	} else {
 		err = PTR_ERR(dentry);
 	}
-	mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
 
+	mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
 	path_put(&nd.path);
 	return err;
 }
@@ -228,7 +232,8 @@ static int delete_path(const char *nodepath)
 	if (!path)
 		return -ENOMEM;
 
-	while (1) {
+	mutex_lock(&dirlock);
+	for (;;) {
 		char *base;
 
 		base = strrchr(path, '/');
@@ -239,6 +244,7 @@ static int delete_path(const char *nodepath)
 		if (err)
 			break;
 	}
+	mutex_unlock(&dirlock);
 
 	kfree(path);
 	return err;
@@ -322,9 +328,8 @@ out:
  * If configured, or requested by the commandline, devtmpfs will be
  * auto-mounted after the kernel mounted the root filesystem.
  */
-int devtmpfs_mount(const char *mountpoint)
+int devtmpfs_mount(const char *mntdir)
 {
-	struct path path;
 	int err;
 
 	if (!dev_mount)
@@ -333,15 +338,11 @@ int devtmpfs_mount(const char *mountpoint)
 	if (!dev_mnt)
 		return 0;
 
-	err = kern_path(mountpoint, LOOKUP_FOLLOW, &path);
-	if (err)
-		return err;
-	err = do_add_mount(dev_mnt, &path, 0, NULL);
+	err = sys_mount("devtmpfs", (char *)mntdir, "devtmpfs", MS_SILENT, NULL);
 	if (err)
 		printk(KERN_INFO "devtmpfs: error mounting %i\n", err);
 	else
 		printk(KERN_INFO "devtmpfs: mounted\n");
-	path_put(&path);
 	return err;
 }
 
@@ -353,6 +354,7 @@ int __init devtmpfs_init(void)
 {
 	int err;
 	struct vfsmount *mnt;
+	char options[] = "mode=0755";
 
 	err = register_filesystem(&dev_fs_type);
 	if (err) {
@@ -361,7 +363,7 @@ int __init devtmpfs_init(void)
 		return err;
 	}
 
-	mnt = kern_mount(&dev_fs_type);
+	mnt = kern_mount_data(&dev_fs_type, options);
 	if (IS_ERR(mnt)) {
 		err = PTR_ERR(mnt);
 		printk(KERN_ERR "devtmpfs: unable to create devtmpfs %i\n", err);
diff --git a/drivers/base/driver.c b/drivers/base/driver.c
index f367885a7646..90c9fff09ead 100644
--- a/drivers/base/driver.c
+++ b/drivers/base/driver.c
@@ -98,7 +98,7 @@ EXPORT_SYMBOL_GPL(driver_find_device);
  * @attr: driver attribute descriptor.
  */
 int driver_create_file(struct device_driver *drv,
-		       struct driver_attribute *attr)
+		       const struct driver_attribute *attr)
 {
 	int error;
 	if (drv)
@@ -115,7 +115,7 @@ EXPORT_SYMBOL_GPL(driver_create_file);
  * @attr: driver attribute descriptor.
  */
 void driver_remove_file(struct device_driver *drv,
-			struct driver_attribute *attr)
+			const struct driver_attribute *attr)
 {
 	if (drv)
 		sysfs_remove_file(&drv->p->kobj, &attr->attr);
diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
index 7376367bcb80..a95024166b66 100644
--- a/drivers/base/firmware_class.c
+++ b/drivers/base/firmware_class.c
@@ -601,12 +601,9 @@ request_firmware_work_func(void *arg)
 	}
 	ret = _request_firmware(&fw, fw_work->name, fw_work->device,
 		fw_work->uevent);
-	if (ret < 0)
-		fw_work->cont(NULL, fw_work->context);
-	else {
-		fw_work->cont(fw, fw_work->context);
-		release_firmware(fw);
-	}
+
+	fw_work->cont(fw, fw_work->context);
+
 	module_put(fw_work->module);
 	kfree(fw_work);
 	return ret;
@@ -619,6 +616,7 @@ request_firmware_work_func(void *arg)
  *	is non-zero else the firmware copy must be done manually.
  * @name: name of firmware file
  * @device: device for which firmware is being loaded
+ * @gfp: allocation flags
  * @context: will be passed over to @cont, and
  *	@fw may be %NULL if firmware request fails.
  * @cont: function will be called asynchronously when the firmware
@@ -631,12 +629,12 @@ request_firmware_work_func(void *arg)
 int
 request_firmware_nowait(
 	struct module *module, int uevent,
-	const char *name, struct device *device, void *context,
+	const char *name, struct device *device, gfp_t gfp, void *context,
 	void (*cont)(const struct firmware *fw, void *context))
 {
 	struct task_struct *task;
 	struct firmware_work *fw_work = kmalloc(sizeof (struct firmware_work),
-						GFP_ATOMIC);
+						gfp);
 
 	if (!fw_work)
 		return -ENOMEM;
diff --git a/drivers/base/memory.c b/drivers/base/memory.c
index 989429cfed88..bd025059711f 100644
--- a/drivers/base/memory.c
+++ b/drivers/base/memory.c
@@ -63,6 +63,20 @@ void unregister_memory_notifier(struct notifier_block *nb)
 }
 EXPORT_SYMBOL(unregister_memory_notifier);
 
+static ATOMIC_NOTIFIER_HEAD(memory_isolate_chain);
+
+int register_memory_isolate_notifier(struct notifier_block *nb)
+{
+	return atomic_notifier_chain_register(&memory_isolate_chain, nb);
+}
+EXPORT_SYMBOL(register_memory_isolate_notifier);
+
+void unregister_memory_isolate_notifier(struct notifier_block *nb)
+{
+	atomic_notifier_chain_unregister(&memory_isolate_chain, nb);
+}
+EXPORT_SYMBOL(unregister_memory_isolate_notifier);
+
 /*
  * register_memory - Setup a sysfs device for a memory block
  */
@@ -157,6 +171,11 @@ int memory_notify(unsigned long val, void *v)
 	return blocking_notifier_call_chain(&memory_chain, val, v);
 }
 
+int memory_isolate_notify(unsigned long val, void *v)
+{
+	return atomic_notifier_call_chain(&memory_isolate_chain, val, v);
+}
+
 /*
  * MEMORY_HOTPLUG depends on SPARSEMEM in mm/Kconfig, so it is
  * OK to have direct references to sparsemem variables in here.
@@ -292,7 +311,7 @@ static SYSDEV_ATTR(removable, 0444, show_mem_removable, NULL);
 static ssize_t
 print_block_size(struct class *class, char *buf)
 {
-	return sprintf(buf, "%lx\n", (unsigned long)PAGES_PER_SECTION * PAGE_SIZE);
+	return sprintf(buf, "%#lx\n", (unsigned long)PAGES_PER_SECTION * PAGE_SIZE);
 }
 
 static CLASS_ATTR(block_size_bytes, 0444, print_block_size, NULL);
@@ -341,6 +360,64 @@ static inline int memory_probe_init(void)
 }
 #endif
 
+#ifdef CONFIG_MEMORY_FAILURE
+/*
+ * Support for offlining pages of memory
+ */
+
+/* Soft offline a page */
+static ssize_t
+store_soft_offline_page(struct class *class, const char *buf, size_t count)
+{
+	int ret;
+	u64 pfn;
+	if (!capable(CAP_SYS_ADMIN))
+		return -EPERM;
+	if (strict_strtoull(buf, 0, &pfn) < 0)
+		return -EINVAL;
+	pfn >>= PAGE_SHIFT;
+	if (!pfn_valid(pfn))
+		return -ENXIO;
+	ret = soft_offline_page(pfn_to_page(pfn), 0);
+	return ret == 0 ? count : ret;
+}
+
+/* Forcibly offline a page, including killing processes. */
+static ssize_t
+store_hard_offline_page(struct class *class, const char *buf, size_t count)
+{
+	int ret;
+	u64 pfn;
+	if (!capable(CAP_SYS_ADMIN))
+		return -EPERM;
+	if (strict_strtoull(buf, 0, &pfn) < 0)
+		return -EINVAL;
+	pfn >>= PAGE_SHIFT;
+	ret = __memory_failure(pfn, 0, 0);
+	return ret ? ret : count;
+}
+
+static CLASS_ATTR(soft_offline_page, 0644, NULL, store_soft_offline_page);
+static CLASS_ATTR(hard_offline_page, 0644, NULL, store_hard_offline_page);
+
+static __init int memory_fail_init(void)
+{
+	int err;
+
+	err = sysfs_create_file(&memory_sysdev_class.kset.kobj,
+				&class_attr_soft_offline_page.attr);
+	if (!err)
+		err = sysfs_create_file(&memory_sysdev_class.kset.kobj,
+				&class_attr_hard_offline_page.attr);
+	return err;
+}
+#else
+static inline int memory_fail_init(void)
+{
+	return 0;
+}
+#endif
+
 /*
  * Note that phys_device is optional.  It is here to allow for
  * differentiation between which *physical* devices each
@@ -473,6 +550,9 @@ int __init memory_dev_init(void)
 	err = memory_probe_init();
 	if (!ret)
 		ret = err;
+	err = memory_fail_init();
+	if (!ret)
+		ret = err;
 	err = block_size_init();
 	if (!ret)
 		ret = err;
diff --git a/drivers/base/node.c b/drivers/base/node.c
index 1fe5536d404f..70122791683d 100644
--- a/drivers/base/node.c
+++ b/drivers/base/node.c
@@ -173,6 +173,47 @@ static ssize_t node_read_distance(struct sys_device * dev,
 }
 static SYSDEV_ATTR(distance, S_IRUGO, node_read_distance, NULL);
 
+#ifdef CONFIG_HUGETLBFS
+/*
+ * hugetlbfs per node attributes registration interface:
+ * When/if hugetlb[fs] subsystem initializes [sometime after this module],
+ * it will register its per node attributes for all online nodes with
+ * memory.  It will also call register_hugetlbfs_with_node(), below, to
+ * register its attribute registration functions with this node driver.
+ * Once these hooks have been initialized, the node driver will call into
+ * the hugetlb module to [un]register attributes for hot-plugged nodes.
+ */
+static node_registration_func_t __hugetlb_register_node;
+static node_registration_func_t __hugetlb_unregister_node;
+
+static inline bool hugetlb_register_node(struct node *node)
+{
+	if (__hugetlb_register_node &&
+			node_state(node->sysdev.id, N_HIGH_MEMORY)) {
+		__hugetlb_register_node(node);
+		return true;
+	}
+	return false;
+}
+
+static inline void hugetlb_unregister_node(struct node *node)
+{
+	if (__hugetlb_unregister_node)
+		__hugetlb_unregister_node(node);
+}
+
+void register_hugetlbfs_with_node(node_registration_func_t doregister,
+				  node_registration_func_t unregister)
+{
+	__hugetlb_register_node   = doregister;
+	__hugetlb_unregister_node = unregister;
+}
+#else
+static inline void hugetlb_register_node(struct node *node) {}
+
+static inline void hugetlb_unregister_node(struct node *node) {}
+#endif
+
 
 /*
  * register_node - Setup a sysfs device for a node.
@@ -196,6 +237,8 @@ int register_node(struct node *node, int num, struct node *parent)
 		sysdev_create_file(&node->sysdev, &attr_distance);
 
 		scan_unevictable_register_node(node);
+
+		hugetlb_register_node(node);
 	}
 	return error;
 }
@@ -216,6 +259,7 @@ void unregister_node(struct node *node)
 	sysdev_remove_file(&node->sysdev, &attr_distance);
 
 	scan_unevictable_unregister_node(node);
+	hugetlb_unregister_node(node);		/* no-op, if memoryless node */
 
 	sysdev_unregister(&node->sysdev);
 }
@@ -227,26 +271,43 @@ struct node node_devices[MAX_NUMNODES];
  */
 int register_cpu_under_node(unsigned int cpu, unsigned int nid)
 {
-	if (node_online(nid)) {
-		struct sys_device *obj = get_cpu_sysdev(cpu);
-		if (!obj)
-			return 0;
-		return sysfs_create_link(&node_devices[nid].sysdev.kobj,
-					 &obj->kobj,
-					 kobject_name(&obj->kobj));
-	 }
+	int ret;
+	struct sys_device *obj;
 
-	return 0;
+	if (!node_online(nid))
+		return 0;
+
+	obj = get_cpu_sysdev(cpu);
+	if (!obj)
+		return 0;
+
+	ret = sysfs_create_link(&node_devices[nid].sysdev.kobj,
+				&obj->kobj,
+				kobject_name(&obj->kobj));
+	if (ret)
+		return ret;
+
+	return sysfs_create_link(&obj->kobj,
+				 &node_devices[nid].sysdev.kobj,
+				 kobject_name(&node_devices[nid].sysdev.kobj));
 }
 
 int unregister_cpu_under_node(unsigned int cpu, unsigned int nid)
 {
-	if (node_online(nid)) {
-		struct sys_device *obj = get_cpu_sysdev(cpu);
-		if (obj)
-			sysfs_remove_link(&node_devices[nid].sysdev.kobj,
-					 kobject_name(&obj->kobj));
-	}
+	struct sys_device *obj;
+
+	if (!node_online(nid))
+		return 0;
+
+	obj = get_cpu_sysdev(cpu);
+	if (!obj)
+		return 0;
+
+	sysfs_remove_link(&node_devices[nid].sysdev.kobj,
+			  kobject_name(&obj->kobj));
+	sysfs_remove_link(&obj->kobj,
+			  kobject_name(&node_devices[nid].sysdev.kobj));
+
 	return 0;
 }
 
@@ -268,6 +329,7 @@ static int get_nid_for_pfn(unsigned long pfn)
 /* register memory section under specified node if it spans that node */
 int register_mem_sect_under_node(struct memory_block *mem_blk, int nid)
 {
+	int ret;
 	unsigned long pfn, sect_start_pfn, sect_end_pfn;
 
 	if (!mem_blk)
@@ -284,9 +346,15 @@ int register_mem_sect_under_node(struct memory_block *mem_blk, int nid)
 			continue;
 		if (page_nid != nid)
 			continue;
-		return sysfs_create_link_nowarn(&node_devices[nid].sysdev.kobj,
+		ret = sysfs_create_link_nowarn(&node_devices[nid].sysdev.kobj,
 					&mem_blk->sysdev.kobj,
 					kobject_name(&mem_blk->sysdev.kobj));
+		if (ret)
+			return ret;
+
+		return sysfs_create_link_nowarn(&mem_blk->sysdev.kobj,
+				&node_devices[nid].sysdev.kobj,
+				kobject_name(&node_devices[nid].sysdev.kobj));
 	}
 	/* mem section does not span the specified node */
 	return 0;
@@ -295,12 +363,16 @@ int register_mem_sect_under_node(struct memory_block *mem_blk, int nid)
 /* unregister memory section under all nodes that it spans */
 int unregister_mem_sect_under_nodes(struct memory_block *mem_blk)
 {
-	nodemask_t unlinked_nodes;
+	NODEMASK_ALLOC(nodemask_t, unlinked_nodes, GFP_KERNEL);
 	unsigned long pfn, sect_start_pfn, sect_end_pfn;
 
-	if (!mem_blk)
+	if (!mem_blk) {
+		NODEMASK_FREE(unlinked_nodes);
 		return -EFAULT;
-	nodes_clear(unlinked_nodes);
+	}
+	if (!unlinked_nodes)
+		return -ENOMEM;
+	nodes_clear(*unlinked_nodes);
 	sect_start_pfn = section_nr_to_pfn(mem_blk->phys_index);
 	sect_end_pfn = sect_start_pfn + PAGES_PER_SECTION - 1;
 	for (pfn = sect_start_pfn; pfn <= sect_end_pfn; pfn++) {
@@ -311,11 +383,14 @@ int unregister_mem_sect_under_nodes(struct memory_block *mem_blk)
 			continue;
 		if (!node_online(nid))
 			continue;
-		if (node_test_and_set(nid, unlinked_nodes))
+		if (node_test_and_set(nid, *unlinked_nodes))
 			continue;
 		sysfs_remove_link(&node_devices[nid].sysdev.kobj,
 			 kobject_name(&mem_blk->sysdev.kobj));
+		sysfs_remove_link(&mem_blk->sysdev.kobj,
+			 kobject_name(&node_devices[nid].sysdev.kobj));
 	}
+	NODEMASK_FREE(unlinked_nodes);
 	return 0;
 }
 
@@ -345,9 +420,77 @@ static int link_mem_sections(int nid)
 	}
 	return err;
 }
-#else
+
+#ifdef CONFIG_HUGETLBFS
+/*
+ * Handle per node hstate attribute [un]registration on transistions
+ * to/from memoryless state.
+ */
+static void node_hugetlb_work(struct work_struct *work)
+{
+	struct node *node = container_of(work, struct node, node_work);
+
+	/*
+	 * We only get here when a node transitions to/from memoryless state.
+	 * We can detect which transition occurred by examining whether the
+	 * node has memory now.  hugetlb_register_node() already check this
+	 * so we try to register the attributes.  If that fails, then the
+	 * node has transitioned to memoryless, try to unregister the
+	 * attributes.
+	 */
+	if (!hugetlb_register_node(node))
+		hugetlb_unregister_node(node);
+}
+
+static void init_node_hugetlb_work(int nid)
+{
+	INIT_WORK(&node_devices[nid].node_work, node_hugetlb_work);
+}
+
+static int node_memory_callback(struct notifier_block *self,
+				unsigned long action, void *arg)
+{
+	struct memory_notify *mnb = arg;
+	int nid = mnb->status_change_nid;
+
+	switch (action) {
+	case MEM_ONLINE:
+	case MEM_OFFLINE:
+		/*
+		 * offload per node hstate [un]registration to a work thread
+		 * when transitioning to/from memoryless state.
+		 */
+		if (nid != NUMA_NO_NODE)
+			schedule_work(&node_devices[nid].node_work);
+		break;
+
+	case MEM_GOING_ONLINE:
+	case MEM_GOING_OFFLINE:
+	case MEM_CANCEL_ONLINE:
+	case MEM_CANCEL_OFFLINE:
+	default:
+		break;
+	}
+
+	return NOTIFY_OK;
+}
+#endif	/* CONFIG_HUGETLBFS */
+#else	/* !CONFIG_MEMORY_HOTPLUG_SPARSE */
+
 static int link_mem_sections(int nid) { return 0; }
-#endif /* CONFIG_MEMORY_HOTPLUG_SPARSE */
+#endif	/* CONFIG_MEMORY_HOTPLUG_SPARSE */
+
+#if !defined(CONFIG_MEMORY_HOTPLUG_SPARSE) || \
+    !defined(CONFIG_HUGETLBFS)
+static inline int node_memory_callback(struct notifier_block *self,
+				unsigned long action, void *arg)
+{
+	return NOTIFY_OK;
+}
+
+static void init_node_hugetlb_work(int nid) { }
+
+#endif
 
 int register_one_node(int nid)
 {
@@ -371,6 +514,9 @@ int register_one_node(int nid)
 
 		/* link memory sections under this node */
 		error = link_mem_sections(nid);
+
+		/* initialize work queue for memory hot plug */
+		init_node_hugetlb_work(nid);
 	}
 
 	return error;
@@ -460,13 +606,17 @@ static int node_states_init(void)
 	return err;
 }
 
+#define NODE_CALLBACK_PRI	2	/* lower than SLAB */
 static int __init register_node_type(void)
 {
 	int ret;
 
 	ret = sysdev_class_register(&node_class);
-	if (!ret)
+	if (!ret) {
 		ret = node_states_init();
+		hotplug_memory_notifier(node_memory_callback,
+					NODE_CALLBACK_PRI);
+	}
 
 	/*
 	 * Note:  we're not going to unregister the node class if we fail
diff --git a/drivers/base/platform.c b/drivers/base/platform.c
index 4fa954b07ac4..58efaf2f1259 100644
--- a/drivers/base/platform.c
+++ b/drivers/base/platform.c
@@ -441,6 +441,7 @@ error:
 	platform_device_put(pdev);
 	return ERR_PTR(retval);
 }
+EXPORT_SYMBOL_GPL(platform_device_register_data);
 
 static int platform_drv_probe(struct device *_dev)
 {
@@ -1000,7 +1001,7 @@ static __initdata LIST_HEAD(early_platform_device_list);
 int __init early_platform_driver_register(struct early_platform_driver *epdrv,
 					  char *buf)
 {
-	unsigned long index;
+	char *tmp;
 	int n;
 
 	/* Simply add the driver to the end of the global list.
@@ -1019,13 +1020,28 @@ int __init early_platform_driver_register(struct early_platform_driver *epdrv,
 	if (buf && !strncmp(buf, epdrv->pdrv->driver.name, n)) {
 		list_move(&epdrv->list, &early_platform_driver_list);
 
-		if (!strcmp(buf, epdrv->pdrv->driver.name))
+		/* Allow passing parameters after device name */
+		if (buf[n] == '\0' || buf[n] == ',')
 			epdrv->requested_id = -1;
-		else if (buf[n] == '.' && strict_strtoul(&buf[n + 1], 10,
-							 &index) == 0)
-			epdrv->requested_id = index;
-		else
-			epdrv->requested_id = EARLY_PLATFORM_ID_ERROR;
+		else {
+			epdrv->requested_id = simple_strtoul(&buf[n + 1],
+							     &tmp, 10);
+
+			if (buf[n] != '.' || (tmp == &buf[n + 1])) {
+				epdrv->requested_id = EARLY_PLATFORM_ID_ERROR;
+				n = 0;
+			} else
+				n += strcspn(&buf[n + 1], ",") + 1;
+		}
+
+		if (buf[n] == ',')
+			n++;
+
+		if (epdrv->bufsize) {
+			memcpy(epdrv->buffer, &buf[n],
+			       min_t(int, epdrv->bufsize, strlen(&buf[n]) + 1));
+			epdrv->buffer[epdrv->bufsize - 1] = '\0';
+		}
 	}
 
 	return 0;
diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
index 8aa2443182d5..a5142bddef41 100644
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -23,8 +23,8 @@
 #include <linux/pm.h>
 #include <linux/pm_runtime.h>
 #include <linux/resume-trace.h>
-#include <linux/rwsem.h>
 #include <linux/interrupt.h>
+#include <linux/sched.h>
 
 #include "../base.h"
 #include "power.h"
@@ -161,6 +161,32 @@ void device_pm_move_last(struct device *dev)
 	list_move_tail(&dev->power.entry, &dpm_list);
 }
 
+static ktime_t initcall_debug_start(struct device *dev)
+{
+	ktime_t calltime = ktime_set(0, 0);
+
+	if (initcall_debug) {
+		pr_info("calling  %s+ @ %i\n",
+				dev_name(dev), task_pid_nr(current));
+		calltime = ktime_get();
+	}
+
+	return calltime;
+}
+
+static void initcall_debug_report(struct device *dev, ktime_t calltime,
+				  int error)
+{
+	ktime_t delta, rettime;
+
+	if (initcall_debug) {
+		rettime = ktime_get();
+		delta = ktime_sub(rettime, calltime);
+		pr_info("call %s+ returned %d after %Ld usecs\n", dev_name(dev),
+			error, (unsigned long long)ktime_to_ns(delta) >> 10);
+	}
+}
+
 /**
  * pm_op - Execute the PM operation appropriate for given PM event.
  * @dev: Device to handle.
@@ -172,6 +198,9 @@ static int pm_op(struct device *dev,
 		 pm_message_t state)
 {
 	int error = 0;
+	ktime_t calltime;
+
+	calltime = initcall_debug_start(dev);
 
 	switch (state.event) {
 #ifdef CONFIG_SUSPEND
@@ -219,6 +248,9 @@ static int pm_op(struct device *dev,
 	default:
 		error = -EINVAL;
 	}
+
+	initcall_debug_report(dev, calltime, error);
+
 	return error;
 }
 
@@ -236,6 +268,13 @@ static int pm_noirq_op(struct device *dev,
 			pm_message_t state)
 {
 	int error = 0;
+	ktime_t calltime, delta, rettime;
+
+	if (initcall_debug) {
+		pr_info("calling  %s_i+ @ %i\n",
+				dev_name(dev), task_pid_nr(current));
+		calltime = ktime_get();
+	}
 
 	switch (state.event) {
 #ifdef CONFIG_SUSPEND
@@ -283,6 +322,15 @@ static int pm_noirq_op(struct device *dev,
 	default:
 		error = -EINVAL;
 	}
+
+	if (initcall_debug) {
+		rettime = ktime_get();
+		delta = ktime_sub(rettime, calltime);
+		printk("initcall %s_i+ returned %d after %Ld usecs\n",
+			dev_name(dev), error,
+			(unsigned long long)ktime_to_ns(delta) >> 10);
+	}
+
 	return error;
 }
 
@@ -324,6 +372,23 @@ static void pm_dev_err(struct device *dev, pm_message_t state, char *info,
 		kobject_name(&dev->kobj), pm_verb(state.event), info, error);
 }
 
+static void dpm_show_time(ktime_t starttime, pm_message_t state, char *info)
+{
+	ktime_t calltime;
+	s64 usecs64;
+	int usecs;
+
+	calltime = ktime_get();
+	usecs64 = ktime_to_ns(ktime_sub(calltime, starttime));
+	do_div(usecs64, NSEC_PER_USEC);
+	usecs = usecs64;
+	if (usecs == 0)
+		usecs = 1;
+	pr_info("PM: %s%s%s of devices complete after %ld.%03ld msecs\n",
+		info ?: "", info ? " " : "", pm_verb(state.event),
+		usecs / USEC_PER_MSEC, usecs % USEC_PER_MSEC);
+}
+
 /*------------------------- Resume routines -------------------------*/
 
 /**
@@ -341,14 +406,11 @@ static int device_resume_noirq(struct device *dev, pm_message_t state)
 	TRACE_DEVICE(dev);
 	TRACE_RESUME(0);
 
-	if (!dev->bus)
-		goto End;
-
-	if (dev->bus->pm) {
+	if (dev->bus && dev->bus->pm) {
 		pm_dev_dbg(dev, state, "EARLY ");
 		error = pm_noirq_op(dev, dev->bus->pm, state);
 	}
- End:
+
 	TRACE_RESUME(error);
 	return error;
 }
@@ -363,6 +425,7 @@ static int device_resume_noirq(struct device *dev, pm_message_t state)
 void dpm_resume_noirq(pm_message_t state)
 {
 	struct device *dev;
+	ktime_t starttime = ktime_get();
 
 	mutex_lock(&dpm_list_mtx);
 	transition_started = false;
@@ -376,11 +439,32 @@ void dpm_resume_noirq(pm_message_t state)
 				pm_dev_err(dev, state, " early", error);
 		}
 	mutex_unlock(&dpm_list_mtx);
+	dpm_show_time(starttime, state, "early");
 	resume_device_irqs();
 }
 EXPORT_SYMBOL_GPL(dpm_resume_noirq);
 
 /**
+ * legacy_resume - Execute a legacy (bus or class) resume callback for device.
+ * @dev: Device to resume.
+ * @cb: Resume callback to execute.
+ */
+static int legacy_resume(struct device *dev, int (*cb)(struct device *dev))
+{
+	int error;
+	ktime_t calltime;
+
+	calltime = initcall_debug_start(dev);
+
+	error = cb(dev);
+	suspend_report_result(cb, error);
+
+	initcall_debug_report(dev, calltime, error);
+
+	return error;
+}
+
+/**
  * device_resume - Execute "resume" callbacks for given device.
  * @dev: Device to handle.
  * @state: PM transition of the system being carried out.
@@ -400,7 +484,7 @@ static int device_resume(struct device *dev, pm_message_t state)
 			error = pm_op(dev, dev->bus->pm, state);
 		} else if (dev->bus->resume) {
 			pm_dev_dbg(dev, state, "legacy ");
-			error = dev->bus->resume(dev);
+			error = legacy_resume(dev, dev->bus->resume);
 		}
 		if (error)
 			goto End;
@@ -421,7 +505,7 @@ static int device_resume(struct device *dev, pm_message_t state)
 			error = pm_op(dev, dev->class->pm, state);
 		} else if (dev->class->resume) {
 			pm_dev_dbg(dev, state, "legacy class ");
-			error = dev->class->resume(dev);
+			error = legacy_resume(dev, dev->class->resume);
 		}
 	}
  End:
@@ -441,6 +525,7 @@ static int device_resume(struct device *dev, pm_message_t state)
 static void dpm_resume(pm_message_t state)
 {
 	struct list_head list;
+	ktime_t starttime = ktime_get();
 
 	INIT_LIST_HEAD(&list);
 	mutex_lock(&dpm_list_mtx);
@@ -469,6 +554,7 @@ static void dpm_resume(pm_message_t state)
 	}
 	list_splice(&list, &dpm_list);
 	mutex_unlock(&dpm_list_mtx);
+	dpm_show_time(starttime, state, NULL);
 }
 
 /**
@@ -521,7 +607,7 @@ static void dpm_complete(pm_message_t state)
 			mutex_unlock(&dpm_list_mtx);
 
 			device_complete(dev, state);
-			pm_runtime_put_noidle(dev);
+			pm_runtime_put_sync(dev);
 
 			mutex_lock(&dpm_list_mtx);
 		}
@@ -584,10 +670,7 @@ static int device_suspend_noirq(struct device *dev, pm_message_t state)
 {
 	int error = 0;
 
-	if (!dev->bus)
-		return 0;
-
-	if (dev->bus->pm) {
+	if (dev->bus && dev->bus->pm) {
 		pm_dev_dbg(dev, state, "LATE ");
 		error = pm_noirq_op(dev, dev->bus->pm, state);
 	}
@@ -604,6 +687,7 @@ static int device_suspend_noirq(struct device *dev, pm_message_t state)
 int dpm_suspend_noirq(pm_message_t state)
 {
 	struct device *dev;
+	ktime_t starttime = ktime_get();
 	int error = 0;
 
 	suspend_device_irqs();
@@ -619,11 +703,35 @@ int dpm_suspend_noirq(pm_message_t state)
 	mutex_unlock(&dpm_list_mtx);
 	if (error)
 		dpm_resume_noirq(resume_event(state));
+	else
+		dpm_show_time(starttime, state, "late");
 	return error;
 }
 EXPORT_SYMBOL_GPL(dpm_suspend_noirq);
 
 /**
+ * legacy_suspend - Execute a legacy (bus or class) suspend callback for device.
+ * @dev: Device to suspend.
+ * @state: PM transition of the system being carried out.
+ * @cb: Suspend callback to execute.
+ */
+static int legacy_suspend(struct device *dev, pm_message_t state,
+			  int (*cb)(struct device *dev, pm_message_t state))
+{
+	int error;
+	ktime_t calltime;
+
+	calltime = initcall_debug_start(dev);
+
+	error = cb(dev, state);
+	suspend_report_result(cb, error);
+
+	initcall_debug_report(dev, calltime, error);
+
+	return error;
+}
+
+/**
  * device_suspend - Execute "suspend" callbacks for given device.
  * @dev: Device to handle.
  * @state: PM transition of the system being carried out.
@@ -640,8 +748,7 @@ static int device_suspend(struct device *dev, pm_message_t state)
 			error = pm_op(dev, dev->class->pm, state);
 		} else if (dev->class->suspend) {
 			pm_dev_dbg(dev, state, "legacy class ");
-			error = dev->class->suspend(dev, state);
-			suspend_report_result(dev->class->suspend, error);
+			error = legacy_suspend(dev, state, dev->class->suspend);
 		}
 		if (error)
 			goto End;
@@ -662,8 +769,7 @@ static int device_suspend(struct device *dev, pm_message_t state)
 			error = pm_op(dev, dev->bus->pm, state);
 		} else if (dev->bus->suspend) {
 			pm_dev_dbg(dev, state, "legacy ");
-			error = dev->bus->suspend(dev, state);
-			suspend_report_result(dev->bus->suspend, error);
+			error = legacy_suspend(dev, state, dev->bus->suspend);
 		}
 	}
  End:
@@ -679,6 +785,7 @@ static int device_suspend(struct device *dev, pm_message_t state)
 static int dpm_suspend(pm_message_t state)
 {
 	struct list_head list;
+	ktime_t starttime = ktime_get();
 	int error = 0;
 
 	INIT_LIST_HEAD(&list);
@@ -704,6 +811,8 @@ static int dpm_suspend(pm_message_t state)
 	}
 	list_splice(&list, dpm_list.prev);
 	mutex_unlock(&dpm_list_mtx);
+	if (!error)
+		dpm_show_time(starttime, state, NULL);
 	return error;
 }
 
@@ -772,7 +881,7 @@ static int dpm_prepare(pm_message_t state)
 		pm_runtime_get_noresume(dev);
 		if (pm_runtime_barrier(dev) && device_may_wakeup(dev)) {
 			/* Wake-up requested during system sleep transition. */
-			pm_runtime_put_noidle(dev);
+			pm_runtime_put_sync(dev);
 			error = -EBUSY;
 		} else {
 			error = device_prepare(dev, state);
diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
index 5a01ecef4af3..f8b044e8aef7 100644
--- a/drivers/base/power/runtime.c
+++ b/drivers/base/power/runtime.c
@@ -85,6 +85,19 @@ static int __pm_runtime_idle(struct device *dev)
 		dev->bus->pm->runtime_idle(dev);
 
 		spin_lock_irq(&dev->power.lock);
+	} else if (dev->type && dev->type->pm && dev->type->pm->runtime_idle) {
+		spin_unlock_irq(&dev->power.lock);
+
+		dev->type->pm->runtime_idle(dev);
+
+		spin_lock_irq(&dev->power.lock);
+	} else if (dev->class && dev->class->pm
+	    && dev->class->pm->runtime_idle) {
+		spin_unlock_irq(&dev->power.lock);
+
+		dev->class->pm->runtime_idle(dev);
+
+		spin_lock_irq(&dev->power.lock);
 	}
 
 	dev->power.idle_notification = false;
@@ -194,6 +207,22 @@ int __pm_runtime_suspend(struct device *dev, bool from_wq)
 
 		spin_lock_irq(&dev->power.lock);
 		dev->power.runtime_error = retval;
+	} else if (dev->type && dev->type->pm
+	    && dev->type->pm->runtime_suspend) {
+		spin_unlock_irq(&dev->power.lock);
+
+		retval = dev->type->pm->runtime_suspend(dev);
+
+		spin_lock_irq(&dev->power.lock);
+		dev->power.runtime_error = retval;
+	} else if (dev->class && dev->class->pm
+	    && dev->class->pm->runtime_suspend) {
+		spin_unlock_irq(&dev->power.lock);
+
+		retval = dev->class->pm->runtime_suspend(dev);
+
+		spin_lock_irq(&dev->power.lock);
+		dev->power.runtime_error = retval;
 	} else {
 		retval = -ENOSYS;
 	}
@@ -359,6 +388,22 @@ int __pm_runtime_resume(struct device *dev, bool from_wq)
 
 		spin_lock_irq(&dev->power.lock);
 		dev->power.runtime_error = retval;
+	} else if (dev->type && dev->type->pm
+	    && dev->type->pm->runtime_resume) {
+		spin_unlock_irq(&dev->power.lock);
+
+		retval = dev->type->pm->runtime_resume(dev);
+
+		spin_lock_irq(&dev->power.lock);
+		dev->power.runtime_error = retval;
+	} else if (dev->class && dev->class->pm
+	    && dev->class->pm->runtime_resume) {
+		spin_unlock_irq(&dev->power.lock);
+
+		retval = dev->class->pm->runtime_resume(dev);
+
+		spin_lock_irq(&dev->power.lock);
+		dev->power.runtime_error = retval;
 	} else {
 		retval = -ENOSYS;
 	}
@@ -701,15 +746,15 @@ EXPORT_SYMBOL_GPL(pm_request_resume);
  * @dev: Device to handle.
  * @sync: If set and the device is suspended, resume it synchronously.
  *
- * Increment the usage count of the device and if it was zero previously,
- * resume it or submit a resume request for it, depending on the value of @sync.
+ * Increment the usage count of the device and resume it or submit a resume
+ * request for it, depending on the value of @sync.
  */
 int __pm_runtime_get(struct device *dev, bool sync)
 {
-	int retval = 1;
+	int retval;
 
-	if (atomic_add_return(1, &dev->power.usage_count) == 1)
-		retval = sync ? pm_runtime_resume(dev) : pm_request_resume(dev);
+	atomic_inc(&dev->power.usage_count);
+	retval = sync ? pm_runtime_resume(dev) : pm_request_resume(dev);
 
 	return retval;
 }
diff --git a/drivers/block/DAC960.c b/drivers/block/DAC960.c
index eb4fa1943944..ce1fa923c414 100644
--- a/drivers/block/DAC960.c
+++ b/drivers/block/DAC960.c
@@ -7101,7 +7101,7 @@ static struct DAC960_privdata DAC960_BA_privdata = {
 
 static struct DAC960_privdata DAC960_LP_privdata = {
 	.HardwareType =		DAC960_LP_Controller,
-	.FirmwareType 	=	DAC960_LP_Controller,
+	.FirmwareType 	=	DAC960_V2_Controller,
 	.InterruptHandler =	DAC960_LP_InterruptHandler,
 	.MemoryWindowSize =	DAC960_LP_RegisterWindowSize,
 };
diff --git a/drivers/block/aoe/aoecmd.c b/drivers/block/aoe/aoecmd.c
index 13bb69d2abb3..64a223b0cc22 100644
--- a/drivers/block/aoe/aoecmd.c
+++ b/drivers/block/aoe/aoecmd.c
@@ -735,21 +735,6 @@ diskstats(struct gendisk *disk, struct bio *bio, ulong duration, sector_t sector
 	part_stat_unlock();
 }
 
-/*
- * Ensure we don't create aliases in VI caches
- */
-static inline void
-killalias(struct bio *bio)
-{
-	struct bio_vec *bv;
-	int i;
-
-	if (bio_data_dir(bio) == READ)
-		__bio_for_each_segment(bv, bio, i, 0) {
-			flush_dcache_page(bv->bv_page);
-		}
-}
-
 void
 aoecmd_ata_rsp(struct sk_buff *skb)
 {
@@ -871,7 +856,7 @@ aoecmd_ata_rsp(struct sk_buff *skb)
 		if (buf->flags & BUFFL_FAIL)
 			bio_endio(buf->bio, -EIO);
 		else {
-			killalias(buf->bio);
+			bio_flush_dcache_pages(buf->bio);
 			bio_endio(buf->bio, 0);
 		}
 		mempool_free(buf, d->bufpool);
diff --git a/drivers/block/ataflop.c b/drivers/block/ataflop.c
index 847a9e57570a..a5af1d6dda8b 100644
--- a/drivers/block/ataflop.c
+++ b/drivers/block/ataflop.c
@@ -1478,10 +1478,7 @@ void do_fd_request(struct request_queue * q)
 	stdma_lock(floppy_irq, NULL);
 
 	atari_disable_irq( IRQ_MFP_FDC );
-	local_save_flags(flags);	/* The request function is called with ints
-	local_irq_disable();		 * disabled... so must save the IPL for later */ 
 	redo_fd_request();
-	local_irq_restore(flags);
 	atari_enable_irq( IRQ_MFP_FDC );
 }
 
diff --git a/drivers/block/cciss_cmd.h b/drivers/block/cciss_cmd.h
index b50a9b261b85..6afa700890ff 100644
--- a/drivers/block/cciss_cmd.h
+++ b/drivers/block/cciss_cmd.h
@@ -5,7 +5,7 @@
 //###########################################################################
 #define CISS_VERSION "1.00"
 
-//general boundary defintions
+//general boundary definitions
 #define SENSEINFOBYTES          32//note that this value may vary between host implementations
 #define MAXSGENTRIES            32
 #define CCISS_SG_CHAIN          0x80000000
diff --git a/drivers/block/drbd/Kconfig b/drivers/block/drbd/Kconfig
index f4acd04ebeef..df0983787390 100644
--- a/drivers/block/drbd/Kconfig
+++ b/drivers/block/drbd/Kconfig
@@ -3,7 +3,7 @@
 #
 
 comment "DRBD disabled because PROC_FS, INET or CONNECTOR not selected"
-	depends on !PROC_FS || !INET || !CONNECTOR
+	depends on PROC_FS='n' || INET='n' || CONNECTOR='n'
 
 config BLK_DEV_DRBD
 	tristate "DRBD Distributed Replicated Block Device support"
diff --git a/drivers/block/drbd/drbd_int.h b/drivers/block/drbd/drbd_int.h
index 2312d782fe99..2bf3a6ef3684 100644
--- a/drivers/block/drbd/drbd_int.h
+++ b/drivers/block/drbd/drbd_int.h
@@ -1275,7 +1275,7 @@ struct bm_extent {
 #if DRBD_MAX_SECTORS_BM < DRBD_MAX_SECTORS_32
 #define DRBD_MAX_SECTORS      DRBD_MAX_SECTORS_BM
 #define DRBD_MAX_SECTORS_FLEX DRBD_MAX_SECTORS_BM
-#elif !defined(CONFIG_LBD) && BITS_PER_LONG == 32
+#elif !defined(CONFIG_LBDAF) && BITS_PER_LONG == 32
 #define DRBD_MAX_SECTORS      DRBD_MAX_SECTORS_32
 #define DRBD_MAX_SECTORS_FLEX DRBD_MAX_SECTORS_32
 #else
@@ -1371,10 +1371,9 @@ extern int is_valid_ar_handle(struct drbd_request *, sector_t);
 extern void drbd_suspend_io(struct drbd_conf *mdev);
 extern void drbd_resume_io(struct drbd_conf *mdev);
 extern char *ppsize(char *buf, unsigned long long size);
-extern sector_t drbd_new_dev_size(struct drbd_conf *,
-		struct drbd_backing_dev *);
+extern sector_t drbd_new_dev_size(struct drbd_conf *, struct drbd_backing_dev *, int);
 enum determine_dev_size { dev_size_error = -1, unchanged = 0, shrunk = 1, grew = 2 };
-extern enum determine_dev_size drbd_determin_dev_size(struct drbd_conf *) __must_hold(local);
+extern enum determine_dev_size drbd_determin_dev_size(struct drbd_conf *, int force) __must_hold(local);
 extern void resync_after_online_grow(struct drbd_conf *);
 extern void drbd_setup_queue_param(struct drbd_conf *mdev, unsigned int) __must_hold(local);
 extern int drbd_set_role(struct drbd_conf *mdev, enum drbd_role new_role,
@@ -1490,7 +1489,7 @@ void drbd_bump_write_ordering(struct drbd_conf *mdev, enum write_ordering_e wo);
 
 /* drbd_proc.c */
 extern struct proc_dir_entry *drbd_proc;
-extern struct file_operations drbd_proc_fops;
+extern const struct file_operations drbd_proc_fops;
 extern const char *drbd_conn_str(enum drbd_conns s);
 extern const char *drbd_role_str(enum drbd_role s);
 
diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
index 157d1e4343c2..e898ad9eb1c3 100644
--- a/drivers/block/drbd/drbd_main.c
+++ b/drivers/block/drbd/drbd_main.c
@@ -27,7 +27,6 @@
  */
 
 #include <linux/module.h>
-#include <linux/version.h>
 #include <linux/drbd.h>
 #include <asm/uaccess.h>
 #include <asm/types.h>
@@ -151,7 +150,7 @@ wait_queue_head_t drbd_pp_wait;
 
 DEFINE_RATELIMIT_STATE(drbd_ratelimit_state, 5 * HZ, 5);
 
-static struct block_device_operations drbd_ops = {
+static const struct block_device_operations drbd_ops = {
 	.owner =   THIS_MODULE,
 	.open =    drbd_open,
 	.release = drbd_release,
@@ -1299,6 +1298,7 @@ static void after_state_ch(struct drbd_conf *mdev, union drbd_state os,
 				dev_err(DEV, "Sending state in drbd_io_error() failed\n");
 		}
 
+		wait_event(mdev->misc_wait, !atomic_read(&mdev->local_cnt));
 		lc_destroy(mdev->resync);
 		mdev->resync = NULL;
 		lc_destroy(mdev->act_log);
@@ -3623,7 +3623,7 @@ _drbd_fault_random(struct fault_random_state *rsp)
 {
 	long refresh;
 
-	if (--rsp->count < 0) {
+	if (!rsp->count--) {
 		get_random_bytes(&refresh, sizeof(refresh));
 		rsp->state += refresh;
 		rsp->count = FAULT_RANDOM_REFRESH;
diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c
index 436a090b532b..1292e0620663 100644
--- a/drivers/block/drbd/drbd_nl.c
+++ b/drivers/block/drbd/drbd_nl.c
@@ -510,7 +510,7 @@ void drbd_resume_io(struct drbd_conf *mdev)
  * Returns 0 on success, negative return values indicate errors.
  * You should call drbd_md_sync() after calling this function.
  */
-enum determine_dev_size drbd_determin_dev_size(struct drbd_conf *mdev) __must_hold(local)
+enum determine_dev_size drbd_determin_dev_size(struct drbd_conf *mdev, int force) __must_hold(local)
 {
 	sector_t prev_first_sect, prev_size; /* previous meta location */
 	sector_t la_size;
@@ -541,7 +541,7 @@ enum determine_dev_size drbd_determin_dev_size(struct drbd_conf *mdev) __must_ho
 	/* TODO: should only be some assert here, not (re)init... */
 	drbd_md_set_sector_offsets(mdev, mdev->ldev);
 
-	size = drbd_new_dev_size(mdev, mdev->ldev);
+	size = drbd_new_dev_size(mdev, mdev->ldev, force);
 
 	if (drbd_get_capacity(mdev->this_bdev) != size ||
 	    drbd_bm_capacity(mdev) != size) {
@@ -596,7 +596,7 @@ out:
 }
 
 sector_t
-drbd_new_dev_size(struct drbd_conf *mdev, struct drbd_backing_dev *bdev)
+drbd_new_dev_size(struct drbd_conf *mdev, struct drbd_backing_dev *bdev, int assume_peer_has_space)
 {
 	sector_t p_size = mdev->p_size;   /* partner's disk size. */
 	sector_t la_size = bdev->md.la_size_sect; /* last agreed size. */
@@ -606,6 +606,11 @@ drbd_new_dev_size(struct drbd_conf *mdev, struct drbd_backing_dev *bdev)
 
 	m_size = drbd_get_max_capacity(bdev);
 
+	if (mdev->state.conn < C_CONNECTED && assume_peer_has_space) {
+		dev_warn(DEV, "Resize while not connected was forced by the user!\n");
+		p_size = m_size;
+	}
+
 	if (p_size && m_size) {
 		size = min_t(sector_t, p_size, m_size);
 	} else {
@@ -965,7 +970,7 @@ static int drbd_nl_disk_conf(struct drbd_conf *mdev, struct drbd_nl_cfg_req *nlp
 
 	/* Prevent shrinking of consistent devices ! */
 	if (drbd_md_test_flag(nbc, MDF_CONSISTENT) &&
-	   drbd_new_dev_size(mdev, nbc) < nbc->md.la_size_sect) {
+	    drbd_new_dev_size(mdev, nbc, 0) < nbc->md.la_size_sect) {
 		dev_warn(DEV, "refusing to truncate a consistent device\n");
 		retcode = ERR_DISK_TO_SMALL;
 		goto force_diskless_dec;
@@ -1052,7 +1057,7 @@ static int drbd_nl_disk_conf(struct drbd_conf *mdev, struct drbd_nl_cfg_req *nlp
 	    !drbd_md_test_flag(mdev->ldev, MDF_CONNECTED_IND))
 		set_bit(USE_DEGR_WFC_T, &mdev->flags);
 
-	dd = drbd_determin_dev_size(mdev);
+	dd = drbd_determin_dev_size(mdev, 0);
 	if (dd == dev_size_error) {
 		retcode = ERR_NOMEM_BITMAP;
 		goto force_diskless_dec;
@@ -1271,8 +1276,7 @@ static int drbd_nl_net_conf(struct drbd_conf *mdev, struct drbd_nl_cfg_req *nlp,
 			goto fail;
 		}
 
-		if (crypto_tfm_alg_type(crypto_hash_tfm(tfm))
-						!= CRYPTO_ALG_TYPE_HASH) {
+		if (!drbd_crypto_is_hash(crypto_hash_tfm(tfm))) {
 			retcode = ERR_AUTH_ALG_ND;
 			goto fail;
 		}
@@ -1505,7 +1509,7 @@ static int drbd_nl_resize(struct drbd_conf *mdev, struct drbd_nl_cfg_req *nlp,
 	}
 
 	mdev->ldev->dc.disk_size = (sector_t)rs.resize_size;
-	dd = drbd_determin_dev_size(mdev);
+	dd = drbd_determin_dev_size(mdev, rs.resize_force);
 	drbd_md_sync(mdev);
 	put_ldev(mdev);
 	if (dd == dev_size_error) {
diff --git a/drivers/block/drbd/drbd_proc.c b/drivers/block/drbd/drbd_proc.c
index bdd0b4943b10..df8ad9660d8f 100644
--- a/drivers/block/drbd/drbd_proc.c
+++ b/drivers/block/drbd/drbd_proc.c
@@ -38,7 +38,7 @@ static int drbd_proc_open(struct inode *inode, struct file *file);
 
 
 struct proc_dir_entry *drbd_proc;
-struct file_operations drbd_proc_fops = {
+const struct file_operations drbd_proc_fops = {
 	.owner		= THIS_MODULE,
 	.open		= drbd_proc_open,
 	.read		= seq_read,
diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
index c548f24f54a1..f22a5283128a 100644
--- a/drivers/block/drbd/drbd_receiver.c
+++ b/drivers/block/drbd/drbd_receiver.c
@@ -28,7 +28,6 @@
 #include <asm/uaccess.h>
 #include <net/sock.h>
 
-#include <linux/version.h>
 #include <linux/drbd.h>
 #include <linux/fs.h>
 #include <linux/file.h>
@@ -879,9 +878,13 @@ retry:
 
 	if (mdev->cram_hmac_tfm) {
 		/* drbd_request_state(mdev, NS(conn, WFAuth)); */
-		if (!drbd_do_auth(mdev)) {
+		switch (drbd_do_auth(mdev)) {
+		case -1:
 			dev_err(DEV, "Authentication of peer failed\n");
 			return -1;
+		case 0:
+			dev_err(DEV, "Authentication of peer failed, trying again.\n");
+			return 0;
 		}
 	}
 
@@ -1202,10 +1205,11 @@ static int receive_Barrier(struct drbd_conf *mdev, struct p_header *h)
 
 	case WO_bdev_flush:
 	case WO_drain_io:
-		D_ASSERT(rv == FE_STILL_LIVE);
-		set_bit(DE_BARRIER_IN_NEXT_EPOCH_ISSUED, &mdev->current_epoch->flags);
-		drbd_wait_ee_list_empty(mdev, &mdev->active_ee);
-		rv = drbd_flush_after_epoch(mdev, mdev->current_epoch);
+		if (rv == FE_STILL_LIVE) {
+			set_bit(DE_BARRIER_IN_NEXT_EPOCH_ISSUED, &mdev->current_epoch->flags);
+			drbd_wait_ee_list_empty(mdev, &mdev->active_ee);
+			rv = drbd_flush_after_epoch(mdev, mdev->current_epoch);
+		}
 		if (rv == FE_RECYCLED)
 			return TRUE;
 
@@ -2866,7 +2870,7 @@ static int receive_sizes(struct drbd_conf *mdev, struct p_header *h)
 
 		/* Never shrink a device with usable data during connect.
 		   But allow online shrinking if we are connected. */
-		if (drbd_new_dev_size(mdev, mdev->ldev) <
+		if (drbd_new_dev_size(mdev, mdev->ldev, 0) <
 		   drbd_get_capacity(mdev->this_bdev) &&
 		   mdev->state.disk >= D_OUTDATED &&
 		   mdev->state.conn < C_CONNECTED) {
@@ -2881,7 +2885,7 @@ static int receive_sizes(struct drbd_conf *mdev, struct p_header *h)
 #undef min_not_zero
 
 	if (get_ldev(mdev)) {
-		dd = drbd_determin_dev_size(mdev);
+	  dd = drbd_determin_dev_size(mdev, 0);
 		put_ldev(mdev);
 		if (dd == dev_size_error)
 			return FALSE;
@@ -3831,10 +3835,17 @@ static int drbd_do_auth(struct drbd_conf *mdev)
 {
 	dev_err(DEV, "This kernel was build without CONFIG_CRYPTO_HMAC.\n");
 	dev_err(DEV, "You need to disable 'cram-hmac-alg' in drbd.conf.\n");
-	return 0;
+	return -1;
 }
 #else
 #define CHALLENGE_LEN 64
+
+/* Return value:
+	1 - auth succeeded,
+	0 - failed, try again (network error),
+	-1 - auth failed, don't try again.
+*/
+
 static int drbd_do_auth(struct drbd_conf *mdev)
 {
 	char my_challenge[CHALLENGE_LEN];  /* 64 Bytes... */
@@ -3855,7 +3866,7 @@ static int drbd_do_auth(struct drbd_conf *mdev)
 				(u8 *)mdev->net_conf->shared_secret, key_len);
 	if (rv) {
 		dev_err(DEV, "crypto_hash_setkey() failed with %d\n", rv);
-		rv = 0;
+		rv = -1;
 		goto fail;
 	}
 
@@ -3878,14 +3889,14 @@ static int drbd_do_auth(struct drbd_conf *mdev)
 
 	if (p.length > CHALLENGE_LEN*2) {
 		dev_err(DEV, "expected AuthChallenge payload too big.\n");
-		rv = 0;
+		rv = -1;
 		goto fail;
 	}
 
 	peers_ch = kmalloc(p.length, GFP_NOIO);
 	if (peers_ch == NULL) {
 		dev_err(DEV, "kmalloc of peers_ch failed\n");
-		rv = 0;
+		rv = -1;
 		goto fail;
 	}
 
@@ -3901,7 +3912,7 @@ static int drbd_do_auth(struct drbd_conf *mdev)
 	response = kmalloc(resp_size, GFP_NOIO);
 	if (response == NULL) {
 		dev_err(DEV, "kmalloc of response failed\n");
-		rv = 0;
+		rv = -1;
 		goto fail;
 	}
 
@@ -3911,7 +3922,7 @@ static int drbd_do_auth(struct drbd_conf *mdev)
 	rv = crypto_hash_digest(&desc, &sg, sg.length, response);
 	if (rv) {
 		dev_err(DEV, "crypto_hash_digest() failed with %d\n", rv);
-		rv = 0;
+		rv = -1;
 		goto fail;
 	}
 
@@ -3945,9 +3956,9 @@ static int drbd_do_auth(struct drbd_conf *mdev)
 	}
 
 	right_response = kmalloc(resp_size, GFP_NOIO);
-	if (response == NULL) {
+	if (right_response == NULL) {
 		dev_err(DEV, "kmalloc of right_response failed\n");
-		rv = 0;
+		rv = -1;
 		goto fail;
 	}
 
@@ -3956,7 +3967,7 @@ static int drbd_do_auth(struct drbd_conf *mdev)
 	rv = crypto_hash_digest(&desc, &sg, sg.length, right_response);
 	if (rv) {
 		dev_err(DEV, "crypto_hash_digest() failed with %d\n", rv);
-		rv = 0;
+		rv = -1;
 		goto fail;
 	}
 
@@ -3965,6 +3976,8 @@ static int drbd_do_auth(struct drbd_conf *mdev)
 	if (rv)
 		dev_info(DEV, "Peer authenticated using %d bytes of '%s' HMAC\n",
 		     resp_size, mdev->net_conf->cram_hmac_alg);
+	else
+		rv = -1;
 
  fail:
 	kfree(peers_ch);
diff --git a/drivers/block/drbd/drbd_worker.c b/drivers/block/drbd/drbd_worker.c
index ed8796f1112d..b453c2bca3be 100644
--- a/drivers/block/drbd/drbd_worker.c
+++ b/drivers/block/drbd/drbd_worker.c
@@ -24,7 +24,6 @@
  */
 
 #include <linux/module.h>
-#include <linux/version.h>
 #include <linux/drbd.h>
 #include <linux/sched.h>
 #include <linux/smp_lock.h>
@@ -34,7 +33,6 @@
 #include <linux/mm_inline.h>
 #include <linux/slab.h>
 #include <linux/random.h>
-#include <linux/mm.h>
 #include <linux/string.h>
 #include <linux/scatterlist.h>
 
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index 5c01f747571b..3266b4f65daa 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -3497,6 +3497,9 @@ static int fd_ioctl(struct block_device *bdev, fmode_t mode, unsigned int cmd,
 	    ((cmd & 0x80) && !capable(CAP_SYS_ADMIN)))
 		return -EPERM;
 
+	if (WARN_ON(size < 0 || size > sizeof(inparam)))
+		return -EINVAL;
+
 	/* copyin */
 	CLEARSTRUCT(&inparam);
 	if (_IOC_DIR(cmd) & _IOC_WRITE)
@@ -4162,7 +4165,7 @@ static int floppy_resume(struct device *dev)
 	return 0;
 }
 
-static struct dev_pm_ops floppy_pm_ops = {
+static const struct dev_pm_ops floppy_pm_ops = {
 	.resume = floppy_resume,
 	.restore = floppy_resume,
 };
diff --git a/drivers/block/mg_disk.c b/drivers/block/mg_disk.c
index e0339aaa1815..02b2583df7fc 100644
--- a/drivers/block/mg_disk.c
+++ b/drivers/block/mg_disk.c
@@ -860,7 +860,7 @@ static int mg_probe(struct platform_device *plat_dev)
 		err = -EINVAL;
 		goto probe_err_2;
 	}
-	host->dev_base = ioremap(rsc->start , rsc->end + 1);
+	host->dev_base = ioremap(rsc->start, resource_size(rsc));
 	if (!host->dev_base) {
 		printk(KERN_ERR "%s:%d ioremap fail\n",
 				__func__, __LINE__);
diff --git a/drivers/block/swim3.c b/drivers/block/swim3.c
index 6380ad8d91bd..59ca2b77b574 100644
--- a/drivers/block/swim3.c
+++ b/drivers/block/swim3.c
@@ -200,7 +200,7 @@ struct floppy_state {
 	int	ejected;
 	wait_queue_head_t wait;
 	int	wanted;
-	struct device_node*	media_bay; /* NULL when not in bay */
+	struct macio_dev *mdev;
 	char	dbdma_cmd_space[5 * sizeof(struct dbdma_cmd)];
 };
 
@@ -303,14 +303,13 @@ static int swim3_readbit(struct floppy_state *fs, int bit)
 static void do_fd_request(struct request_queue * q)
 {
 	int i;
-	for(i=0;i<floppy_count;i++)
-	{
-#ifdef CONFIG_PMAC_MEDIABAY
-		if (floppy_states[i].media_bay &&
-			check_media_bay(floppy_states[i].media_bay, MB_FD))
+
+	for(i=0; i<floppy_count; i++) {
+		struct floppy_state *fs = &floppy_states[i];
+		if (fs->mdev->media_bay &&
+		    check_media_bay(fs->mdev->media_bay) != MB_FD)
 			continue;
-#endif /* CONFIG_PMAC_MEDIABAY */
-		start_request(&floppy_states[i]);
+		start_request(fs);
 	}
 }
 
@@ -849,10 +848,9 @@ static int floppy_ioctl(struct block_device *bdev, fmode_t mode,
 	if ((cmd & 0x80) && !capable(CAP_SYS_ADMIN))
 		return -EPERM;
 
-#ifdef CONFIG_PMAC_MEDIABAY
-	if (fs->media_bay && check_media_bay(fs->media_bay, MB_FD))
+	if (fs->mdev->media_bay &&
+	    check_media_bay(fs->mdev->media_bay) != MB_FD)
 		return -ENXIO;
-#endif
 
 	switch (cmd) {
 	case FDEJECT:
@@ -876,10 +874,9 @@ static int floppy_open(struct block_device *bdev, fmode_t mode)
 	int n, err = 0;
 
 	if (fs->ref_count == 0) {
-#ifdef CONFIG_PMAC_MEDIABAY
-		if (fs->media_bay && check_media_bay(fs->media_bay, MB_FD))
+		if (fs->mdev->media_bay &&
+		    check_media_bay(fs->mdev->media_bay) != MB_FD)
 			return -ENXIO;
-#endif
 		out_8(&sw->setup, S_IBM_DRIVE | S_FCLK_DIV2);
 		out_8(&sw->control_bic, 0xff);
 		out_8(&sw->mode, 0x95);
@@ -963,10 +960,9 @@ static int floppy_revalidate(struct gendisk *disk)
 	struct swim3 __iomem *sw;
 	int ret, n;
 
-#ifdef CONFIG_PMAC_MEDIABAY
-	if (fs->media_bay && check_media_bay(fs->media_bay, MB_FD))
+	if (fs->mdev->media_bay &&
+	    check_media_bay(fs->mdev->media_bay) != MB_FD)
 		return -ENXIO;
-#endif
 
 	sw = fs->swim3;
 	grab_drive(fs, revalidating, 0);
@@ -1009,7 +1005,6 @@ static const struct block_device_operations floppy_fops = {
 static int swim3_add_device(struct macio_dev *mdev, int index)
 {
 	struct device_node *swim = mdev->ofdev.node;
-	struct device_node *mediabay;
 	struct floppy_state *fs = &floppy_states[index];
 	int rc = -EBUSY;
 
@@ -1036,9 +1031,7 @@ static int swim3_add_device(struct macio_dev *mdev, int index)
 	}
 	dev_set_drvdata(&mdev->ofdev.dev, fs);
 
-	mediabay = (strcasecmp(swim->parent->type, "media-bay") == 0) ?
-		swim->parent : NULL;
-	if (mediabay == NULL)
+	if (mdev->media_bay == NULL)
 		pmac_call_feature(PMAC_FTR_SWIM3_ENABLE, swim, 0, 1);
 	
 	memset(fs, 0, sizeof(*fs));
@@ -1068,7 +1061,7 @@ static int swim3_add_device(struct macio_dev *mdev, int index)
 	fs->secpercyl = 36;
 	fs->secpertrack = 18;
 	fs->total_secs = 2880;
-	fs->media_bay = mediabay;
+	fs->mdev = mdev;
 	init_waitqueue_head(&fs->wait);
 
 	fs->dma_cmd = (struct dbdma_cmd *) DBDMA_ALIGN(fs->dbdma_cmd_space);
@@ -1093,7 +1086,7 @@ static int swim3_add_device(struct macio_dev *mdev, int index)
 	init_timer(&fs->timeout);
 
 	printk(KERN_INFO "fd%d: SWIM3 floppy controller %s\n", floppy_count,
-		mediabay ? "in media bay" : "");
+		mdev->media_bay ? "in media bay" : "");
 
 	return 0;
 
diff --git a/drivers/block/xd.c b/drivers/block/xd.c
index 0877d3628fda..d1fd032e7514 100644
--- a/drivers/block/xd.c
+++ b/drivers/block/xd.c
@@ -169,13 +169,6 @@ static int __init xd_init(void)
 
 	init_timer (&xd_watchdog_int); xd_watchdog_int.function = xd_watchdog;
 
-	if (!xd_dma_buffer)
-		xd_dma_buffer = (char *)xd_dma_mem_alloc(xd_maxsectors * 0x200);
-	if (!xd_dma_buffer) {
-		printk(KERN_ERR "xd: Out of memory.\n");
-		return -ENOMEM;
-	}
-
 	err = -EBUSY;
 	if (register_blkdev(XT_DISK_MAJOR, "xd"))
 		goto out1;
@@ -202,6 +195,19 @@ static int __init xd_init(void)
 			xd_drives,xd_drives == 1 ? "" : "s",xd_irq,xd_dma);
 	}
 
+	/*
+	 * With the drive detected, xd_maxsectors should now be known.
+	 * If xd_maxsectors is 0, nothing was detected and we fall through
+	 * to return -ENODEV
+	 */
+	if (!xd_dma_buffer && xd_maxsectors) {
+		xd_dma_buffer = (char *)xd_dma_mem_alloc(xd_maxsectors * 0x200);
+		if (!xd_dma_buffer) {
+			printk(KERN_ERR "xd: Out of memory.\n");
+			goto out3;
+		}
+	}
+
 	err = -ENODEV;
 	if (!xd_drives)
 		goto out3;
@@ -249,15 +255,17 @@ out4:
 	for (i = 0; i < xd_drives; i++)
 		put_disk(xd_gendisk[i]);
 out3:
-	release_region(xd_iobase,4);
+	if (xd_maxsectors)
+		release_region(xd_iobase,4);
+
+	if (xd_dma_buffer)
+		xd_dma_mem_free((unsigned long)xd_dma_buffer,
+				xd_maxsectors * 0x200);
 out2:
 	blk_cleanup_queue(xd_queue);
 out1a:
 	unregister_blkdev(XT_DISK_MAJOR, "xd");
 out1:
-	if (xd_dma_buffer)
-		xd_dma_mem_free((unsigned long)xd_dma_buffer,
-				xd_maxsectors * 0x200);
 	return err;
 Enomem:
 	err = -ENOMEM;
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index b8578bb3f4c9..05a31e55d278 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -42,6 +42,7 @@
 #include <linux/module.h>
 #include <linux/scatterlist.h>
 
+#include <xen/xen.h>
 #include <xen/xenbus.h>
 #include <xen/grant_table.h>
 #include <xen/events.h>
diff --git a/drivers/bluetooth/Kconfig b/drivers/bluetooth/Kconfig
index 652367aa6546..058fbccf2f52 100644
--- a/drivers/bluetooth/Kconfig
+++ b/drivers/bluetooth/Kconfig
@@ -195,5 +195,16 @@ config BT_MRVL_SDIO
 	  Say Y here to compile support for Marvell BT-over-SDIO driver
 	  into the kernel or say M to compile it as module.
 
-endmenu
+config BT_ATH3K
+	tristate "Atheros firmware download driver"
+	depends on BT_HCIBTUSB
+	select FW_LOADER
+	help
+	  Bluetooth firmware download driver.
+	  This driver loads the firmware into the Atheros Bluetooth
+	  chipset.
 
+	  Say Y here to compile support for "Atheros firmware download driver"
+	  into the kernel or say M to compile it as module (ath3k).
+
+endmenu
diff --git a/drivers/bluetooth/Makefile b/drivers/bluetooth/Makefile
index b3f57d2d4eb0..7e5aed598121 100644
--- a/drivers/bluetooth/Makefile
+++ b/drivers/bluetooth/Makefile
@@ -15,6 +15,7 @@ obj-$(CONFIG_BT_HCIBTUART)	+= btuart_cs.o
 obj-$(CONFIG_BT_HCIBTUSB)	+= btusb.o
 obj-$(CONFIG_BT_HCIBTSDIO)	+= btsdio.o
 
+obj-$(CONFIG_BT_ATH3K)		+= ath3k.o
 obj-$(CONFIG_BT_MRVL)		+= btmrvl.o
 obj-$(CONFIG_BT_MRVL_SDIO)	+= btmrvl_sdio.o
 
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
new file mode 100644
index 000000000000..add9485ca5b6
--- /dev/null
+++ b/drivers/bluetooth/ath3k.c
@@ -0,0 +1,187 @@
+/*
+ * Copyright (c) 2008-2009 Atheros Communications Inc.
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ */
+
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/types.h>
+#include <linux/errno.h>
+#include <linux/device.h>
+#include <linux/firmware.h>
+#include <linux/usb.h>
+#include <net/bluetooth/bluetooth.h>
+
+#define VERSION "1.0"
+
+
+static struct usb_device_id ath3k_table[] = {
+	/* Atheros AR3011 */
+	{ USB_DEVICE(0x0CF3, 0x3000) },
+	{ }	/* Terminating entry */
+};
+
+MODULE_DEVICE_TABLE(usb, ath3k_table);
+
+#define USB_REQ_DFU_DNLOAD	1
+#define BULK_SIZE		4096
+
+struct ath3k_data {
+	struct usb_device *udev;
+	u8 *fw_data;
+	u32 fw_size;
+	u32 fw_sent;
+};
+
+static int ath3k_load_firmware(struct ath3k_data *data,
+				unsigned char *firmware,
+				int count)
+{
+	u8 *send_buf;
+	int err, pipe, len, size, sent = 0;
+
+	BT_DBG("ath3k %p udev %p", data, data->udev);
+
+	pipe = usb_sndctrlpipe(data->udev, 0);
+
+	if ((usb_control_msg(data->udev, pipe,
+				USB_REQ_DFU_DNLOAD,
+				USB_TYPE_VENDOR, 0, 0,
+				firmware, 20, USB_CTRL_SET_TIMEOUT)) < 0) {
+		BT_ERR("Can't change to loading configuration err");
+		return -EBUSY;
+	}
+	sent += 20;
+	count -= 20;
+
+	send_buf = kmalloc(BULK_SIZE, GFP_ATOMIC);
+	if (!send_buf) {
+		BT_ERR("Can't allocate memory chunk for firmware");
+		return -ENOMEM;
+	}
+
+	while (count) {
+		size = min_t(uint, count, BULK_SIZE);
+		pipe = usb_sndbulkpipe(data->udev, 0x02);
+		memcpy(send_buf, firmware + sent, size);
+
+		err = usb_bulk_msg(data->udev, pipe, send_buf, size,
+					&len, 3000);
+
+		if (err || (len != size)) {
+			BT_ERR("Error in firmware loading err = %d,"
+				"len = %d, size = %d", err, len, size);
+			goto error;
+		}
+
+		sent  += size;
+		count -= size;
+	}
+
+	kfree(send_buf);
+	return 0;
+
+error:
+	kfree(send_buf);
+	return err;
+}
+
+static int ath3k_probe(struct usb_interface *intf,
+			const struct usb_device_id *id)
+{
+	const struct firmware *firmware;
+	struct usb_device *udev = interface_to_usbdev(intf);
+	struct ath3k_data *data;
+	int size;
+
+	BT_DBG("intf %p id %p", intf, id);
+
+	if (intf->cur_altsetting->desc.bInterfaceNumber != 0)
+		return -ENODEV;
+
+	data = kzalloc(sizeof(*data), GFP_KERNEL);
+	if (!data)
+		return -ENOMEM;
+
+	data->udev = udev;
+
+	if (request_firmware(&firmware, "ath3k-1.fw", &udev->dev) < 0) {
+		kfree(data);
+		return -EIO;
+	}
+
+	size = max_t(uint, firmware->size, 4096);
+	data->fw_data = kmalloc(size, GFP_KERNEL);
+	if (!data->fw_data) {
+		release_firmware(firmware);
+		kfree(data);
+		return -ENOMEM;
+	}
+
+	memcpy(data->fw_data, firmware->data, firmware->size);
+	data->fw_size = firmware->size;
+	data->fw_sent = 0;
+	release_firmware(firmware);
+
+	usb_set_intfdata(intf, data);
+	if (ath3k_load_firmware(data, data->fw_data, data->fw_size)) {
+		usb_set_intfdata(intf, NULL);
+		return -EIO;
+	}
+
+	return 0;
+}
+
+static void ath3k_disconnect(struct usb_interface *intf)
+{
+	struct ath3k_data *data = usb_get_intfdata(intf);
+
+	BT_DBG("ath3k_disconnect intf %p", intf);
+
+	kfree(data->fw_data);
+	kfree(data);
+}
+
+static struct usb_driver ath3k_driver = {
+	.name		= "ath3k",
+	.probe		= ath3k_probe,
+	.disconnect	= ath3k_disconnect,
+	.id_table	= ath3k_table,
+};
+
+static int __init ath3k_init(void)
+{
+	BT_INFO("Atheros AR30xx firmware driver ver %s", VERSION);
+	return usb_register(&ath3k_driver);
+}
+
+static void __exit ath3k_exit(void)
+{
+	usb_deregister(&ath3k_driver);
+}
+
+module_init(ath3k_init);
+module_exit(ath3k_exit);
+
+MODULE_AUTHOR("Atheros Communications");
+MODULE_DESCRIPTION("Atheros AR30xx firmware driver");
+MODULE_VERSION(VERSION);
+MODULE_LICENSE("GPL");
+MODULE_FIRMWARE("ath3k-1.fw");
diff --git a/drivers/bluetooth/bluecard_cs.c b/drivers/bluetooth/bluecard_cs.c
index 2acdc605cb4b..c2cf81144715 100644
--- a/drivers/bluetooth/bluecard_cs.c
+++ b/drivers/bluetooth/bluecard_cs.c
@@ -503,7 +503,9 @@ static irqreturn_t bluecard_interrupt(int irq, void *dev_inst)
 	unsigned int iobase;
 	unsigned char reg;
 
-	BUG_ON(!info->hdev);
+	if (!info || !info->hdev)
+		/* our irq handler is shared */
+		return IRQ_NONE;
 
 	if (!test_bit(CARD_READY, &(info->hw_state)))
 		return IRQ_HANDLED;
diff --git a/drivers/bluetooth/bt3c_cs.c b/drivers/bluetooth/bt3c_cs.c
index d814a2755ccb..9f5926aaf57f 100644
--- a/drivers/bluetooth/bt3c_cs.c
+++ b/drivers/bluetooth/bt3c_cs.c
@@ -345,7 +345,9 @@ static irqreturn_t bt3c_interrupt(int irq, void *dev_inst)
 	int iir;
 	irqreturn_t r = IRQ_NONE;
 
-	BUG_ON(!info->hdev);
+	if (!info || !info->hdev)
+		/* our irq handler is shared */
+		return IRQ_NONE;
 
 	iobase = info->p_dev->io.BasePort1;
 
diff --git a/drivers/bluetooth/btmrvl_sdio.c b/drivers/bluetooth/btmrvl_sdio.c
index 1e6eb1aeba2b..57d965b7f521 100644
--- a/drivers/bluetooth/btmrvl_sdio.c
+++ b/drivers/bluetooth/btmrvl_sdio.c
@@ -535,7 +535,7 @@ static int btmrvl_sdio_card_to_host(struct btmrvl_private *priv)
 		break;
 
 	default:
-		BT_ERR("Unknow packet type:%d", type);
+		BT_ERR("Unknown packet type:%d", type);
 		print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, payload,
 						blksz * buf_block_len);
 
@@ -808,6 +808,7 @@ static int btmrvl_sdio_host_to_card(struct btmrvl_private *priv,
 
 exit:
 	sdio_release_host(card->func);
+	kfree(tmpbuf);
 
 	return ret;
 }
diff --git a/drivers/bluetooth/btuart_cs.c b/drivers/bluetooth/btuart_cs.c
index d339464dc15e..91c523099804 100644
--- a/drivers/bluetooth/btuart_cs.c
+++ b/drivers/bluetooth/btuart_cs.c
@@ -295,7 +295,9 @@ static irqreturn_t btuart_interrupt(int irq, void *dev_inst)
 	int iir, lsr;
 	irqreturn_t r = IRQ_NONE;
 
-	BUG_ON(!info->hdev);
+	if (!info || !info->hdev)
+		/* our irq handler is shared */
+		return IRQ_NONE;
 
 	iobase = info->p_dev->io.BasePort1;
 
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 44bc8bbabf54..a699f09ddf7c 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -307,6 +307,7 @@ static void btusb_bulk_complete(struct urb *urb)
 		return;
 
 	usb_anchor_urb(urb, &data->bulk_anchor);
+	usb_mark_last_busy(data->udev);
 
 	err = usb_submit_urb(urb, GFP_ATOMIC);
 	if (err < 0) {
@@ -1066,7 +1067,7 @@ static int btusb_suspend(struct usb_interface *intf, pm_message_t message)
 		return 0;
 
 	spin_lock_irq(&data->txlock);
-	if (!(interface_to_usbdev(intf)->auto_pm && data->tx_in_flight)) {
+	if (!((message.event & PM_EVENT_AUTO) && data->tx_in_flight)) {
 		set_bit(BTUSB_SUSPENDING, &data->flags);
 		spin_unlock_irq(&data->txlock);
 	} else {
diff --git a/drivers/bluetooth/dtl1_cs.c b/drivers/bluetooth/dtl1_cs.c
index 4f02a6f3c980..697591941e17 100644
--- a/drivers/bluetooth/dtl1_cs.c
+++ b/drivers/bluetooth/dtl1_cs.c
@@ -299,7 +299,9 @@ static irqreturn_t dtl1_interrupt(int irq, void *dev_inst)
 	int iir, lsr;
 	irqreturn_t r = IRQ_NONE;
 
-	BUG_ON(!info->hdev);
+	if (!info || !info->hdev)
+		/* our irq handler is shared */
+		return IRQ_NONE;
 
 	iobase = info->p_dev->io.BasePort1;
 
diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
index 4895f0e05322..aa0919386b8c 100644
--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -214,7 +214,7 @@ static int hci_uart_send_frame(struct sk_buff *skb)
 	struct hci_uart *hu;
 
 	if (!hdev) {
-		BT_ERR("Frame for uknown device (hdev=NULL)");
+		BT_ERR("Frame for unknown device (hdev=NULL)");
 		return -ENODEV;
 	}
 
diff --git a/drivers/cdrom/gdrom.c b/drivers/cdrom/gdrom.c
index a762283d2a21..e789e6c9a422 100644
--- a/drivers/cdrom/gdrom.c
+++ b/drivers/cdrom/gdrom.c
@@ -214,7 +214,7 @@ static void gdrom_spicommand(void *spi_string, int buflen)
 		gdrom_getsense(NULL);
 		return;
 	}
-	outsw(PHYSADDR(GDROM_DATA_REG), cmd, 6);
+	outsw(GDROM_DATA_REG, cmd, 6);
 }
 
 
@@ -298,7 +298,7 @@ static int gdrom_readtoc_cmd(struct gdromtoc *toc, int session)
 		err = -EINVAL;
 		goto cleanup_readtoc;
 	}
-	insw(PHYSADDR(GDROM_DATA_REG), toc, tocsize/2);
+	insw(GDROM_DATA_REG, toc, tocsize/2);
 	if (gd.status & 0x01)
 		err = -EINVAL;
 
@@ -449,7 +449,7 @@ static int gdrom_getsense(short *bufstring)
 		GDROM_DEFAULT_TIMEOUT);
 	if (gd.pending)
 		goto cleanup_sense;
-	insw(PHYSADDR(GDROM_DATA_REG), &sense, sense_command->buflen/2);
+	insw(GDROM_DATA_REG, &sense, sense_command->buflen/2);
 	if (sense[1] & 40) {
 		printk(KERN_INFO "GDROM: Drive not ready - command aborted\n");
 		goto cleanup_sense;
@@ -586,7 +586,7 @@ static void gdrom_readdisk_dma(struct work_struct *work)
 		spin_unlock(&gdrom_lock);
 		block = blk_rq_pos(req)/GD_TO_BLK + GD_SESSION_OFFSET;
 		block_cnt = blk_rq_sectors(req)/GD_TO_BLK;
-		ctrl_outl(PHYSADDR(req->buffer), GDROM_DMA_STARTADDR_REG);
+		ctrl_outl(virt_to_phys(req->buffer), GDROM_DMA_STARTADDR_REG);
 		ctrl_outl(block_cnt * GDROM_HARD_SECTOR, GDROM_DMA_LENGTH_REG);
 		ctrl_outl(1, GDROM_DMA_DIRECTION_REG);
 		ctrl_outl(1, GDROM_DMA_ENABLE_REG);
@@ -615,7 +615,7 @@ static void gdrom_readdisk_dma(struct work_struct *work)
 			cpu_relax();
 		gd.pending = 1;
 		gd.transfer = 1;
-		outsw(PHYSADDR(GDROM_DATA_REG), &read_command->cmd, 6);
+		outsw(GDROM_DATA_REG, &read_command->cmd, 6);
 		timeout = jiffies + HZ / 2;
 		/* Wait for any pending DMA to finish */
 		while (ctrl_inb(GDROM_DMA_STATUS_REG) &&
diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index 6aad99ec4e0f..e023682be2c4 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -201,19 +201,6 @@ config DIGIEPCA
 	  To compile this driver as a module, choose M here: the
 	  module will be called epca.
 
-config ESPSERIAL
-	tristate "Hayes ESP serial port support"
-	depends on SERIAL_NONSTANDARD && ISA && ISA_DMA_API && BROKEN
-	help
-	  This is a driver which supports Hayes ESP serial ports.  Both single
-	  port cards and multiport cards are supported.  Make sure to read
-	  <file:Documentation/hayes-esp.txt>.
-
-	  To compile this driver as a module, choose M here: the
-	  module will be called esp.
-
-	  If unsure, say N.
-
 config MOXA_INTELLIO
 	tristate "Moxa Intellio support"
 	depends on SERIAL_NONSTANDARD && (ISA || EISA || PCI)
@@ -515,7 +502,7 @@ config BRIQ_PANEL
 
 config BFIN_OTP
 	tristate "Blackfin On-Chip OTP Memory Support"
-	depends on BLACKFIN && (BF52x || BF54x)
+	depends on BLACKFIN && (BF51x || BF52x || BF54x)
 	default y
 	help
 	  If you say Y here, you will get support for a character device
@@ -682,7 +669,7 @@ config VIRTIO_CONSOLE
 
 config HVCS
 	tristate "IBM Hypervisor Virtual Console Server support"
-	depends on PPC_PSERIES
+	depends on PPC_PSERIES && HVC_CONSOLE
 	help
 	  Partitionable IBM Power5 ppc64 machines allow hosting of
 	  firmware virtual consoles from one Linux partition by
diff --git a/drivers/char/Makefile b/drivers/char/Makefile
index 19a79dd79eee..f957edf7e45d 100644
--- a/drivers/char/Makefile
+++ b/drivers/char/Makefile
@@ -18,7 +18,6 @@ obj-$(CONFIG_CONSOLE_TRANSLATIONS) += consolemap.o consolemap_deftbl.o
 obj-$(CONFIG_HW_CONSOLE)	+= vt.o defkeymap.o
 obj-$(CONFIG_AUDIT)		+= tty_audit.o
 obj-$(CONFIG_MAGIC_SYSRQ)	+= sysrq.o
-obj-$(CONFIG_ESPSERIAL)		+= esp.o
 obj-$(CONFIG_MVME147_SCC)	+= generic_serial.o vme_scc.o
 obj-$(CONFIG_MVME162_SCC)	+= generic_serial.o vme_scc.o
 obj-$(CONFIG_BVME6000_SCC)	+= generic_serial.o vme_scc.o
diff --git a/drivers/char/agp/amd64-agp.c b/drivers/char/agp/amd64-agp.c
index 2fb2e6cc322a..1afb8968a342 100644
--- a/drivers/char/agp/amd64-agp.c
+++ b/drivers/char/agp/amd64-agp.c
@@ -728,6 +728,10 @@ int __init agp_amd64_init(void)
 
 	if (agp_off)
 		return -EINVAL;
+
+	if (gart_iommu_aperture)
+		return agp_bridges_found ? 0 : -ENODEV;
+
 	err = pci_register_driver(&agp_amd64_pci_driver);
 	if (err < 0)
 		return err;
@@ -766,17 +770,15 @@ int __init agp_amd64_init(void)
 
 static void __exit agp_amd64_cleanup(void)
 {
+	if (gart_iommu_aperture)
+		return;
 	if (aperture_resource)
 		release_resource(aperture_resource);
 	pci_unregister_driver(&agp_amd64_pci_driver);
 }
 
-/* On AMD64 the PCI driver needs to initialize this driver early
-   for the IOMMU, so it has to be called via a backdoor. */
-#ifndef CONFIG_GART_IOMMU
 module_init(agp_amd64_init);
 module_exit(agp_amd64_cleanup);
-#endif
 
 MODULE_AUTHOR("Dave Jones <davej@redhat.com>, Andi Kleen");
 module_param(agp_try_unsupported, bool, 0);
diff --git a/drivers/char/agp/backend.c b/drivers/char/agp/backend.c
index a56ca080e108..c3ab46da51a3 100644
--- a/drivers/char/agp/backend.c
+++ b/drivers/char/agp/backend.c
@@ -285,18 +285,22 @@ int agp_add_bridge(struct agp_bridge_data *bridge)
 {
 	int error;
 
-	if (agp_off)
-		return -ENODEV;
+	if (agp_off) {
+		error = -ENODEV;
+		goto err_put_bridge;
+	}
 
 	if (!bridge->dev) {
 		printk (KERN_DEBUG PFX "Erk, registering with no pci_dev!\n");
-		return -EINVAL;
+		error = -EINVAL;
+		goto err_put_bridge;
 	}
 
 	/* Grab reference on the chipset driver. */
 	if (!try_module_get(bridge->driver->owner)) {
 		dev_info(&bridge->dev->dev, "can't lock chipset driver\n");
-		return -EINVAL;
+		error = -EINVAL;
+		goto err_put_bridge;
 	}
 
 	error = agp_backend_initialize(bridge);
@@ -326,6 +330,7 @@ frontend_err:
 	agp_backend_cleanup(bridge);
 err_out:
 	module_put(bridge->driver->owner);
+err_put_bridge:
 	agp_put_bridge(bridge);
 	return error;
 }
diff --git a/drivers/char/agp/frontend.c b/drivers/char/agp/frontend.c
index a96f3197e60f..43412c03969e 100644
--- a/drivers/char/agp/frontend.c
+++ b/drivers/char/agp/frontend.c
@@ -676,25 +676,25 @@ static int agp_open(struct inode *inode, struct file *file)
 	int minor = iminor(inode);
 	struct agp_file_private *priv;
 	struct agp_client *client;
-	int rc = -ENXIO;
-
-	lock_kernel();
-	mutex_lock(&(agp_fe.agp_mutex));
 
 	if (minor != AGPGART_MINOR)
-		goto err_out;
+		return -ENXIO;
+
+	mutex_lock(&(agp_fe.agp_mutex));
 
 	priv = kzalloc(sizeof(struct agp_file_private), GFP_KERNEL);
-	if (priv == NULL)
-		goto err_out_nomem;
+	if (priv == NULL) {
+		mutex_unlock(&(agp_fe.agp_mutex));
+		return -ENOMEM;
+	}
 
 	set_bit(AGP_FF_ALLOW_CLIENT, &priv->access_flags);
 	priv->my_pid = current->pid;
 
-	if (capable(CAP_SYS_RAWIO)) {
+	if (capable(CAP_SYS_RAWIO))
 		/* Root priv, can be controller */
 		set_bit(AGP_FF_ALLOW_CONTROLLER, &priv->access_flags);
-	}
+
 	client = agp_find_client_by_pid(current->pid);
 
 	if (client != NULL) {
@@ -704,16 +704,10 @@ static int agp_open(struct inode *inode, struct file *file)
 	file->private_data = (void *) priv;
 	agp_insert_file_private(priv);
 	DBG("private=%p, client=%p", priv, client);
-	mutex_unlock(&(agp_fe.agp_mutex));
-	unlock_kernel();
-	return 0;
 
-err_out_nomem:
-	rc = -ENOMEM;
-err_out:
 	mutex_unlock(&(agp_fe.agp_mutex));
-	unlock_kernel();
-	return rc;
+
+	return 0;
 }
 
 
diff --git a/drivers/char/agp/hp-agp.c b/drivers/char/agp/hp-agp.c
index 9047b2714653..58752b70efea 100644
--- a/drivers/char/agp/hp-agp.c
+++ b/drivers/char/agp/hp-agp.c
@@ -488,9 +488,8 @@ zx1_gart_probe (acpi_handle obj, u32 depth, void *context, void **ret)
 	handle = obj;
 	do {
 		status = acpi_get_object_info(handle, &info);
-		if (ACPI_SUCCESS(status)) {
+		if (ACPI_SUCCESS(status) && (info->valid & ACPI_VALID_HID)) {
 			/* TBD check _CID also */
-			info->hardware_id.string[sizeof(info->hardware_id.length)-1] = '\0';
 			match = (strcmp(info->hardware_id.string, "HWP0001") == 0);
 			kfree(info);
 			if (match) {
@@ -509,6 +508,9 @@ zx1_gart_probe (acpi_handle obj, u32 depth, void *context, void **ret)
 		handle = parent;
 	} while (ACPI_SUCCESS(status));
 
+	if (ACPI_FAILURE(status))
+		return AE_OK;	/* found no enclosing IOC */
+
 	if (hp_zx1_setup(sba_hpa + HP_ZX1_IOC_OFFSET, lba_hpa))
 		return AE_OK;
 
diff --git a/drivers/char/agp/intel-agp.c b/drivers/char/agp/intel-agp.c
index 3cb56a049e24..3999a5f25f38 100644
--- a/drivers/char/agp/intel-agp.c
+++ b/drivers/char/agp/intel-agp.c
@@ -36,10 +36,10 @@
 #define PCI_DEVICE_ID_INTEL_82965GME_IG     0x2A12
 #define PCI_DEVICE_ID_INTEL_82945GME_HB     0x27AC
 #define PCI_DEVICE_ID_INTEL_82945GME_IG     0x27AE
-#define PCI_DEVICE_ID_INTEL_IGDGM_HB        0xA010
-#define PCI_DEVICE_ID_INTEL_IGDGM_IG        0xA011
-#define PCI_DEVICE_ID_INTEL_IGDG_HB         0xA000
-#define PCI_DEVICE_ID_INTEL_IGDG_IG         0xA001
+#define PCI_DEVICE_ID_INTEL_PINEVIEW_M_HB        0xA010
+#define PCI_DEVICE_ID_INTEL_PINEVIEW_M_IG        0xA011
+#define PCI_DEVICE_ID_INTEL_PINEVIEW_HB         0xA000
+#define PCI_DEVICE_ID_INTEL_PINEVIEW_IG         0xA001
 #define PCI_DEVICE_ID_INTEL_G33_HB          0x29C0
 #define PCI_DEVICE_ID_INTEL_G33_IG          0x29C2
 #define PCI_DEVICE_ID_INTEL_Q35_HB          0x29B0
@@ -50,20 +50,20 @@
 #define PCI_DEVICE_ID_INTEL_B43_IG          0x2E42
 #define PCI_DEVICE_ID_INTEL_GM45_HB         0x2A40
 #define PCI_DEVICE_ID_INTEL_GM45_IG         0x2A42
-#define PCI_DEVICE_ID_INTEL_IGD_E_HB        0x2E00
-#define PCI_DEVICE_ID_INTEL_IGD_E_IG        0x2E02
+#define PCI_DEVICE_ID_INTEL_EAGLELAKE_HB        0x2E00
+#define PCI_DEVICE_ID_INTEL_EAGLELAKE_IG        0x2E02
 #define PCI_DEVICE_ID_INTEL_Q45_HB          0x2E10
 #define PCI_DEVICE_ID_INTEL_Q45_IG          0x2E12
 #define PCI_DEVICE_ID_INTEL_G45_HB          0x2E20
 #define PCI_DEVICE_ID_INTEL_G45_IG          0x2E22
 #define PCI_DEVICE_ID_INTEL_G41_HB          0x2E30
 #define PCI_DEVICE_ID_INTEL_G41_IG          0x2E32
-#define PCI_DEVICE_ID_INTEL_IGDNG_D_HB	    0x0040
-#define PCI_DEVICE_ID_INTEL_IGDNG_D_IG	    0x0042
-#define PCI_DEVICE_ID_INTEL_IGDNG_M_HB	    0x0044
-#define PCI_DEVICE_ID_INTEL_IGDNG_MA_HB	    0x0062
-#define PCI_DEVICE_ID_INTEL_IGDNG_MC2_HB    0x006a
-#define PCI_DEVICE_ID_INTEL_IGDNG_M_IG	    0x0046
+#define PCI_DEVICE_ID_INTEL_IRONLAKE_D_HB	    0x0040
+#define PCI_DEVICE_ID_INTEL_IRONLAKE_D_IG	    0x0042
+#define PCI_DEVICE_ID_INTEL_IRONLAKE_M_HB	    0x0044
+#define PCI_DEVICE_ID_INTEL_IRONLAKE_MA_HB	    0x0062
+#define PCI_DEVICE_ID_INTEL_IRONLAKE_MC2_HB    0x006a
+#define PCI_DEVICE_ID_INTEL_IRONLAKE_M_IG	    0x0046
 
 /* cover 915 and 945 variants */
 #define IS_I915 (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_E7221_HB || \
@@ -83,22 +83,22 @@
 #define IS_G33 (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_G33_HB || \
 		agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_Q35_HB || \
 		agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_Q33_HB || \
-		agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDGM_HB || \
-		agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDG_HB)
+		agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_PINEVIEW_M_HB || \
+		agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_PINEVIEW_HB)
 
-#define IS_IGD (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDGM_HB || \
-		agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDG_HB)
+#define IS_PINEVIEW (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_PINEVIEW_M_HB || \
+		agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_PINEVIEW_HB)
 
-#define IS_G4X (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGD_E_HB || \
+#define IS_G4X (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_EAGLELAKE_HB || \
 		agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_Q45_HB || \
 		agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_G45_HB || \
 		agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_GM45_HB || \
 		agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_G41_HB || \
 		agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_B43_HB || \
-		agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDNG_D_HB || \
-		agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDNG_M_HB || \
-		agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDNG_MA_HB || \
-		agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDNG_MC2_HB)
+		agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IRONLAKE_D_HB || \
+		agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IRONLAKE_M_HB || \
+		agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IRONLAKE_MA_HB || \
+		agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IRONLAKE_MC2_HB)
 
 extern int agp_memory_reserved;
 
@@ -178,6 +178,7 @@ static struct _intel_private {
 	 * popup and for the GTT.
 	 */
 	int gtt_entries;			/* i830+ */
+	int gtt_total_size;
 	union {
 		void __iomem *i9xx_flush_page;
 		void *i8xx_flush_page;
@@ -653,7 +654,7 @@ static void intel_i830_init_gtt_entries(void)
 			size = 512;
 		}
 		size += 4; /* add in BIOS popup space */
-	} else if (IS_G33 && !IS_IGD) {
+	} else if (IS_G33 && !IS_PINEVIEW) {
 	/* G33's GTT size defined in gmch_ctrl */
 		switch (gmch_ctrl & G33_PGETBL_SIZE_MASK) {
 		case G33_PGETBL_SIZE_1M:
@@ -669,7 +670,7 @@ static void intel_i830_init_gtt_entries(void)
 			size = 512;
 		}
 		size += 4;
-	} else if (IS_G4X || IS_IGD) {
+	} else if (IS_G4X || IS_PINEVIEW) {
 		/* On 4 series hardware, GTT stolen is separate from graphics
 		 * stolen, ignore it in stolen gtt entries counting.  However,
 		 * 4KB of the stolen memory doesn't get mapped to the GTT.
@@ -1153,7 +1154,7 @@ static int intel_i915_configure(void)
 	readl(intel_private.registers+I810_PGETBL_CTL);	/* PCI Posting. */
 
 	if (agp_bridge->driver->needs_scratch_page) {
-		for (i = intel_private.gtt_entries; i < current_size->num_entries; i++) {
+		for (i = intel_private.gtt_entries; i < intel_private.gtt_total_size; i++) {
 			writel(agp_bridge->scratch_page, intel_private.gtt+i);
 		}
 		readl(intel_private.gtt+i-1);	/* PCI Posting. */
@@ -1308,6 +1309,8 @@ static int intel_i915_create_gatt_table(struct agp_bridge_data *bridge)
 	if (!intel_private.gtt)
 		return -ENOMEM;
 
+	intel_private.gtt_total_size = gtt_map_size / 4;
+
 	temp &= 0xfff80000;
 
 	intel_private.registers = ioremap(temp, 128 * 4096);
@@ -1352,15 +1355,15 @@ static void intel_i965_get_gtt_range(int *gtt_offset, int *gtt_size)
 {
 	switch (agp_bridge->dev->device) {
 	case PCI_DEVICE_ID_INTEL_GM45_HB:
-	case PCI_DEVICE_ID_INTEL_IGD_E_HB:
+	case PCI_DEVICE_ID_INTEL_EAGLELAKE_HB:
 	case PCI_DEVICE_ID_INTEL_Q45_HB:
 	case PCI_DEVICE_ID_INTEL_G45_HB:
 	case PCI_DEVICE_ID_INTEL_G41_HB:
 	case PCI_DEVICE_ID_INTEL_B43_HB:
-	case PCI_DEVICE_ID_INTEL_IGDNG_D_HB:
-	case PCI_DEVICE_ID_INTEL_IGDNG_M_HB:
-	case PCI_DEVICE_ID_INTEL_IGDNG_MA_HB:
-	case PCI_DEVICE_ID_INTEL_IGDNG_MC2_HB:
+	case PCI_DEVICE_ID_INTEL_IRONLAKE_D_HB:
+	case PCI_DEVICE_ID_INTEL_IRONLAKE_M_HB:
+	case PCI_DEVICE_ID_INTEL_IRONLAKE_MA_HB:
+	case PCI_DEVICE_ID_INTEL_IRONLAKE_MC2_HB:
 		*gtt_offset = *gtt_size = MB(2);
 		break;
 	default:
@@ -1395,6 +1398,8 @@ static int intel_i965_create_gatt_table(struct agp_bridge_data *bridge)
 	if (!intel_private.gtt)
 		return -ENOMEM;
 
+	intel_private.gtt_total_size = gtt_size / 4;
+
 	intel_private.registers = ioremap(temp, 128 * 4096);
 	if (!intel_private.registers) {
 		iounmap(intel_private.gtt);
@@ -2340,14 +2345,14 @@ static const struct intel_driver_description {
 		NULL, &intel_g33_driver },
 	{ PCI_DEVICE_ID_INTEL_Q33_HB, PCI_DEVICE_ID_INTEL_Q33_IG, 0, "Q33",
 		NULL, &intel_g33_driver },
-	{ PCI_DEVICE_ID_INTEL_IGDGM_HB, PCI_DEVICE_ID_INTEL_IGDGM_IG, 0, "IGD",
+	{ PCI_DEVICE_ID_INTEL_PINEVIEW_M_HB, PCI_DEVICE_ID_INTEL_PINEVIEW_M_IG, 0, "Pineview",
 		NULL, &intel_g33_driver },
-	{ PCI_DEVICE_ID_INTEL_IGDG_HB, PCI_DEVICE_ID_INTEL_IGDG_IG, 0, "IGD",
+	{ PCI_DEVICE_ID_INTEL_PINEVIEW_HB, PCI_DEVICE_ID_INTEL_PINEVIEW_IG, 0, "Pineview",
 		NULL, &intel_g33_driver },
 	{ PCI_DEVICE_ID_INTEL_GM45_HB, PCI_DEVICE_ID_INTEL_GM45_IG, 0,
-	    "Mobile Intel® GM45 Express", NULL, &intel_i965_driver },
-	{ PCI_DEVICE_ID_INTEL_IGD_E_HB, PCI_DEVICE_ID_INTEL_IGD_E_IG, 0,
-	    "Intel Integrated Graphics Device", NULL, &intel_i965_driver },
+	    "GM45", NULL, &intel_i965_driver },
+	{ PCI_DEVICE_ID_INTEL_EAGLELAKE_HB, PCI_DEVICE_ID_INTEL_EAGLELAKE_IG, 0,
+	    "Eaglelake", NULL, &intel_i965_driver },
 	{ PCI_DEVICE_ID_INTEL_Q45_HB, PCI_DEVICE_ID_INTEL_Q45_IG, 0,
 	    "Q45/Q43", NULL, &intel_i965_driver },
 	{ PCI_DEVICE_ID_INTEL_G45_HB, PCI_DEVICE_ID_INTEL_G45_IG, 0,
@@ -2356,14 +2361,14 @@ static const struct intel_driver_description {
 	    "B43", NULL, &intel_i965_driver },
 	{ PCI_DEVICE_ID_INTEL_G41_HB, PCI_DEVICE_ID_INTEL_G41_IG, 0,
 	    "G41", NULL, &intel_i965_driver },
-	{ PCI_DEVICE_ID_INTEL_IGDNG_D_HB, PCI_DEVICE_ID_INTEL_IGDNG_D_IG, 0,
-	    "IGDNG/D", NULL, &intel_i965_driver },
-	{ PCI_DEVICE_ID_INTEL_IGDNG_M_HB, PCI_DEVICE_ID_INTEL_IGDNG_M_IG, 0,
-	    "IGDNG/M", NULL, &intel_i965_driver },
-	{ PCI_DEVICE_ID_INTEL_IGDNG_MA_HB, PCI_DEVICE_ID_INTEL_IGDNG_M_IG, 0,
-	    "IGDNG/MA", NULL, &intel_i965_driver },
-	{ PCI_DEVICE_ID_INTEL_IGDNG_MC2_HB, PCI_DEVICE_ID_INTEL_IGDNG_M_IG, 0,
-	    "IGDNG/MC2", NULL, &intel_i965_driver },
+	{ PCI_DEVICE_ID_INTEL_IRONLAKE_D_HB, PCI_DEVICE_ID_INTEL_IRONLAKE_D_IG, 0,
+	    "Ironlake/D", NULL, &intel_i965_driver },
+	{ PCI_DEVICE_ID_INTEL_IRONLAKE_M_HB, PCI_DEVICE_ID_INTEL_IRONLAKE_M_IG, 0,
+	    "Ironlake/M", NULL, &intel_i965_driver },
+	{ PCI_DEVICE_ID_INTEL_IRONLAKE_MA_HB, PCI_DEVICE_ID_INTEL_IRONLAKE_M_IG, 0,
+	    "Ironlake/MA", NULL, &intel_i965_driver },
+	{ PCI_DEVICE_ID_INTEL_IRONLAKE_MC2_HB, PCI_DEVICE_ID_INTEL_IRONLAKE_M_IG, 0,
+	    "Ironlake/MC2", NULL, &intel_i965_driver },
 	{ 0, 0, 0, NULL, NULL, NULL }
 };
 
@@ -2455,10 +2460,14 @@ static int __devinit agp_intel_probe(struct pci_dev *pdev,
 				&bridge->mode);
 	}
 
-	if (bridge->driver->mask_memory == intel_i965_mask_memory)
+	if (bridge->driver->mask_memory == intel_i965_mask_memory) {
 		if (pci_set_dma_mask(intel_private.pcidev, DMA_BIT_MASK(36)))
 			dev_err(&intel_private.pcidev->dev,
 				"set gfx device dma mask 36bit failed!\n");
+		else
+			pci_set_consistent_dma_mask(intel_private.pcidev,
+						    DMA_BIT_MASK(36));
+	}
 
 	pci_set_drvdata(pdev, bridge);
 	return agp_add_bridge(bridge);
@@ -2545,8 +2554,8 @@ static struct pci_device_id agp_intel_pci_table[] = {
 	ID(PCI_DEVICE_ID_INTEL_82945G_HB),
 	ID(PCI_DEVICE_ID_INTEL_82945GM_HB),
 	ID(PCI_DEVICE_ID_INTEL_82945GME_HB),
-	ID(PCI_DEVICE_ID_INTEL_IGDGM_HB),
-	ID(PCI_DEVICE_ID_INTEL_IGDG_HB),
+	ID(PCI_DEVICE_ID_INTEL_PINEVIEW_M_HB),
+	ID(PCI_DEVICE_ID_INTEL_PINEVIEW_HB),
 	ID(PCI_DEVICE_ID_INTEL_82946GZ_HB),
 	ID(PCI_DEVICE_ID_INTEL_82G35_HB),
 	ID(PCI_DEVICE_ID_INTEL_82965Q_HB),
@@ -2557,15 +2566,15 @@ static struct pci_device_id agp_intel_pci_table[] = {
 	ID(PCI_DEVICE_ID_INTEL_Q35_HB),
 	ID(PCI_DEVICE_ID_INTEL_Q33_HB),
 	ID(PCI_DEVICE_ID_INTEL_GM45_HB),
-	ID(PCI_DEVICE_ID_INTEL_IGD_E_HB),
+	ID(PCI_DEVICE_ID_INTEL_EAGLELAKE_HB),
 	ID(PCI_DEVICE_ID_INTEL_Q45_HB),
 	ID(PCI_DEVICE_ID_INTEL_G45_HB),
 	ID(PCI_DEVICE_ID_INTEL_G41_HB),
 	ID(PCI_DEVICE_ID_INTEL_B43_HB),
-	ID(PCI_DEVICE_ID_INTEL_IGDNG_D_HB),
-	ID(PCI_DEVICE_ID_INTEL_IGDNG_M_HB),
-	ID(PCI_DEVICE_ID_INTEL_IGDNG_MA_HB),
-	ID(PCI_DEVICE_ID_INTEL_IGDNG_MC2_HB),
+	ID(PCI_DEVICE_ID_INTEL_IRONLAKE_D_HB),
+	ID(PCI_DEVICE_ID_INTEL_IRONLAKE_M_HB),
+	ID(PCI_DEVICE_ID_INTEL_IRONLAKE_MA_HB),
+	ID(PCI_DEVICE_ID_INTEL_IRONLAKE_MC2_HB),
 	{ }
 };
 
diff --git a/drivers/char/agp/uninorth-agp.c b/drivers/char/agp/uninorth-agp.c
index 703959eba45a..d89da4ac061f 100644
--- a/drivers/char/agp/uninorth-agp.c
+++ b/drivers/char/agp/uninorth-agp.c
@@ -144,16 +144,13 @@ static int uninorth_configure(void)
 	return 0;
 }
 
-static int uninorth_insert_memory(struct agp_memory *mem, off_t pg_start,
-				int type)
+static int uninorth_insert_memory(struct agp_memory *mem, off_t pg_start, int type)
 {
-	int i, j, num_entries;
+	int i, num_entries;
 	void *temp;
+	u32 *gp;
 	int mask_type;
 
-	temp = agp_bridge->current_size;
-	num_entries = A_SIZE_32(temp)->num_entries;
-
 	if (type != mem->type)
 		return -EINVAL;
 
@@ -163,49 +160,12 @@ static int uninorth_insert_memory(struct agp_memory *mem, off_t pg_start,
 		return -EINVAL;
 	}
 
-	if ((pg_start + mem->page_count) > num_entries)
-		return -EINVAL;
-
-	j = pg_start;
-
-	while (j < (pg_start + mem->page_count)) {
-		if (agp_bridge->gatt_table[j])
-			return -EBUSY;
-		j++;
-	}
-
-	for (i = 0, j = pg_start; i < mem->page_count; i++, j++) {
-		agp_bridge->gatt_table[j] =
-			cpu_to_le32((page_to_phys(mem->pages[i]) & 0xFFFFF000UL) | 0x1UL);
-		flush_dcache_range((unsigned long)__va(page_to_phys(mem->pages[i])),
-				   (unsigned long)__va(page_to_phys(mem->pages[i]))+0x1000);
-	}
-	(void)in_le32((volatile u32*)&agp_bridge->gatt_table[pg_start]);
-	mb();
-
-	uninorth_tlbflush(mem);
-	return 0;
-}
-
-static int u3_insert_memory(struct agp_memory *mem, off_t pg_start, int type)
-{
-	int i, num_entries;
-	void *temp;
-	u32 *gp;
-	int mask_type;
+	if (mem->page_count == 0)
+		return 0;
 
 	temp = agp_bridge->current_size;
 	num_entries = A_SIZE_32(temp)->num_entries;
 
-	if (type != mem->type)
-		return -EINVAL;
-
-	mask_type = agp_bridge->driver->agp_type_to_mask_type(agp_bridge, type);
-	if (mask_type != 0) {
-		/* We know nothing of memory types */
-		return -EINVAL;
-	}
-
 	if ((pg_start + mem->page_count) > num_entries)
 		return -EINVAL;
 
@@ -213,14 +173,18 @@ static int u3_insert_memory(struct agp_memory *mem, off_t pg_start, int type)
 	for (i = 0; i < mem->page_count; ++i) {
 		if (gp[i]) {
 			dev_info(&agp_bridge->dev->dev,
-				 "u3_insert_memory: entry 0x%x occupied (%x)\n",
+				 "uninorth_insert_memory: entry 0x%x occupied (%x)\n",
 				 i, gp[i]);
 			return -EBUSY;
 		}
 	}
 
 	for (i = 0; i < mem->page_count; i++) {
-		gp[i] = (page_to_phys(mem->pages[i]) >> PAGE_SHIFT) | 0x80000000UL;
+		if (is_u3)
+			gp[i] = (page_to_phys(mem->pages[i]) >> PAGE_SHIFT) | 0x80000000UL;
+		else
+			gp[i] =	cpu_to_le32((page_to_phys(mem->pages[i]) & 0xFFFFF000UL) |
+					    0x1UL);
 		flush_dcache_range((unsigned long)__va(page_to_phys(mem->pages[i])),
 				   (unsigned long)__va(page_to_phys(mem->pages[i]))+0x1000);
 	}
@@ -230,14 +194,23 @@ static int u3_insert_memory(struct agp_memory *mem, off_t pg_start, int type)
 	return 0;
 }
 
-int u3_remove_memory(struct agp_memory *mem, off_t pg_start, int type)
+int uninorth_remove_memory(struct agp_memory *mem, off_t pg_start, int type)
 {
 	size_t i;
 	u32 *gp;
+	int mask_type;
+
+	if (type != mem->type)
+		return -EINVAL;
 
-	if (type != 0 || mem->type != 0)
+	mask_type = agp_bridge->driver->agp_type_to_mask_type(agp_bridge, type);
+	if (mask_type != 0) {
 		/* We know nothing of memory types */
 		return -EINVAL;
+	}
+
+	if (mem->page_count == 0)
+		return 0;
 
 	gp = (u32 *) &agp_bridge->gatt_table[pg_start];
 	for (i = 0; i < mem->page_count; ++i)
@@ -536,7 +509,7 @@ const struct agp_bridge_driver uninorth_agp_driver = {
 	.create_gatt_table	= uninorth_create_gatt_table,
 	.free_gatt_table	= uninorth_free_gatt_table,
 	.insert_memory		= uninorth_insert_memory,
-	.remove_memory		= agp_generic_remove_memory,
+	.remove_memory		= uninorth_remove_memory,
 	.alloc_by_type		= agp_generic_alloc_by_type,
 	.free_by_type		= agp_generic_free_by_type,
 	.agp_alloc_page		= agp_generic_alloc_page,
@@ -562,8 +535,8 @@ const struct agp_bridge_driver u3_agp_driver = {
 	.agp_enable		= uninorth_agp_enable,
 	.create_gatt_table	= uninorth_create_gatt_table,
 	.free_gatt_table	= uninorth_free_gatt_table,
-	.insert_memory		= u3_insert_memory,
-	.remove_memory		= u3_remove_memory,
+	.insert_memory		= uninorth_insert_memory,
+	.remove_memory		= uninorth_remove_memory,
 	.alloc_by_type		= agp_generic_alloc_by_type,
 	.free_by_type		= agp_generic_free_by_type,
 	.agp_alloc_page		= agp_generic_alloc_page,
diff --git a/drivers/char/bfin_jtag_comm.c b/drivers/char/bfin_jtag_comm.c
index 1d7c34c73b20..2628c7415ea8 100644
--- a/drivers/char/bfin_jtag_comm.c
+++ b/drivers/char/bfin_jtag_comm.c
@@ -226,7 +226,7 @@ bfin_jc_wait_until_sent(struct tty_struct *tty, int timeout)
 	}
 }
 
-static struct tty_operations bfin_jc_ops = {
+static const struct tty_operations bfin_jc_ops = {
 	.open            = bfin_jc_open,
 	.close           = bfin_jc_close,
 	.write           = bfin_jc_write,
diff --git a/drivers/char/cs5535_gpio.c b/drivers/char/cs5535_gpio.c
index 04ba906b4880..4d830dc482ef 100644
--- a/drivers/char/cs5535_gpio.c
+++ b/drivers/char/cs5535_gpio.c
@@ -17,7 +17,7 @@
 #include <linux/cdev.h>
 #include <linux/ioport.h>
 #include <linux/pci.h>
-#include <linux/smp_lock.h>
+
 #include <asm/uaccess.h>
 #include <asm/io.h>
 
@@ -158,7 +158,6 @@ static int cs5535_gpio_open(struct inode *inode, struct file *file)
 {
 	u32 m = iminor(inode);
 
-	cycle_kernel_lock();
 	/* the mask says which pins are usable by this driver */
 	if ((mask & (1 << m)) == 0)
 		return -EINVAL;
diff --git a/drivers/char/efirtc.c b/drivers/char/efirtc.c
index 34d15d548236..53c524e7b829 100644
--- a/drivers/char/efirtc.c
+++ b/drivers/char/efirtc.c
@@ -27,8 +27,6 @@
  * 	- Add module support
  */
 
-
-#include <linux/smp_lock.h>
 #include <linux/types.h>
 #include <linux/errno.h>
 #include <linux/miscdevice.h>
@@ -174,13 +172,12 @@ static long efi_rtc_ioctl(struct file *file, unsigned int cmd,
 			return -EINVAL;
 
 		case RTC_RD_TIME:
-			lock_kernel();
 			spin_lock_irqsave(&efi_rtc_lock, flags);
 
 			status = efi.get_time(&eft, &cap);
 
 			spin_unlock_irqrestore(&efi_rtc_lock,flags);
-			unlock_kernel();
+
 			if (status != EFI_SUCCESS) {
 				/* should never happen */
 				printk(KERN_ERR "efitime: can't read time\n");
@@ -202,13 +199,11 @@ static long efi_rtc_ioctl(struct file *file, unsigned int cmd,
 
 			convert_to_efi_time(&wtime, &eft);
 
-			lock_kernel();
 			spin_lock_irqsave(&efi_rtc_lock, flags);
 
 			status = efi.set_time(&eft);
 
 			spin_unlock_irqrestore(&efi_rtc_lock,flags);
-			unlock_kernel();
 
 			return status == EFI_SUCCESS ? 0 : -EINVAL;
 
@@ -224,7 +219,6 @@ static long efi_rtc_ioctl(struct file *file, unsigned int cmd,
 
 			convert_to_efi_time(&wtime, &eft);
 
-			lock_kernel();
 			spin_lock_irqsave(&efi_rtc_lock, flags);
 			/*
 			 * XXX Fixme:
@@ -235,19 +229,16 @@ static long efi_rtc_ioctl(struct file *file, unsigned int cmd,
 			status = efi.set_wakeup_time((efi_bool_t)enabled, &eft);
 
 			spin_unlock_irqrestore(&efi_rtc_lock,flags);
-			unlock_kernel();
 
 			return status == EFI_SUCCESS ? 0 : -EINVAL;
 
 		case RTC_WKALM_RD:
 
-			lock_kernel();
 			spin_lock_irqsave(&efi_rtc_lock, flags);
 
 			status = efi.get_wakeup_time((efi_bool_t *)&enabled, (efi_bool_t *)&pending, &eft);
 
 			spin_unlock_irqrestore(&efi_rtc_lock,flags);
-			unlock_kernel();
 
 			if (status != EFI_SUCCESS) return -EINVAL;
 
@@ -277,7 +268,6 @@ static int efi_rtc_open(struct inode *inode, struct file *file)
 	 * We do accept multiple open files at the same time as we
 	 * synchronize on the per call operation.
 	 */
-	cycle_kernel_lock();
 	return 0;
 }
 
@@ -295,6 +285,7 @@ static const struct file_operations efi_rtc_fops = {
 	.unlocked_ioctl	= efi_rtc_ioctl,
 	.open		= efi_rtc_open,
 	.release	= efi_rtc_close,
+	.llseek		= no_llseek,
 };
 
 static struct miscdevice efi_rtc_dev= {
diff --git a/drivers/char/epca.c b/drivers/char/epca.c
index dde5134713e2..17b044a71e02 100644
--- a/drivers/char/epca.c
+++ b/drivers/char/epca.c
@@ -935,7 +935,7 @@ static int info_open(struct tty_struct *tty, struct file *filp)
 	return 0;
 }
 
-static struct tty_operations info_ops = {
+static const struct tty_operations info_ops = {
 	.open = info_open,
 	.ioctl = info_ioctl,
 };
diff --git a/drivers/char/esp.c b/drivers/char/esp.c
deleted file mode 100644
index b19d43cd9542..000000000000
--- a/drivers/char/esp.c
+++ /dev/null
@@ -1,2533 +0,0 @@
-/*
- *  esp.c - driver for Hayes ESP serial cards
- *
- *  --- Notices from serial.c, upon which this driver is based ---
- *
- *  Copyright (C) 1991, 1992  Linus Torvalds
- *
- *  Extensively rewritten by Theodore Ts'o, 8/16/92 -- 9/14/92.  Now
- *  much more extensible to support other serial cards based on the
- *  16450/16550A UART's.  Added support for the AST FourPort and the
- *  Accent Async board.
- *
- *  set_serial_info fixed to set the flags, custom divisor, and uart
- * 	type fields.  Fix suggested by Michael K. Johnson 12/12/92.
- *
- *  11/95: TIOCMIWAIT, TIOCGICOUNT by Angelo Haritsis <ah@doc.ic.ac.uk>
- *
- *  03/96: Modularised by Angelo Haritsis <ah@doc.ic.ac.uk>
- *
- *  rs_set_termios fixed to look also for changes of the input
- *      flags INPCK, BRKINT, PARMRK, IGNPAR and IGNBRK.
- *                                            Bernd Anhäupl 05/17/96.
- *
- * --- End of notices from serial.c ---
- *
- * Support for the ESP serial card by Andrew J. Robinson
- *     <arobinso@nyx.net> (Card detection routine taken from a patch
- *     by Dennis J. Boylan).  Patches to allow use with 2.1.x contributed
- *     by Chris Faylor.
- *
- * Most recent changes: (Andrew J. Robinson)
- *   Support for PIO mode.  This allows the driver to work properly with
- *     multiport cards.
- *
- * Arnaldo Carvalho de Melo <acme@conectiva.com.br> -
- * several cleanups, use module_init/module_exit, etc
- *
- * This module exports the following rs232 io functions:
- *
- *	int espserial_init(void);
- */
-
-#include <linux/module.h>
-#include <linux/errno.h>
-#include <linux/signal.h>
-#include <linux/sched.h>
-#include <linux/interrupt.h>
-#include <linux/tty.h>
-#include <linux/tty_flip.h>
-#include <linux/serial.h>
-#include <linux/serialP.h>
-#include <linux/serial_reg.h>
-#include <linux/major.h>
-#include <linux/string.h>
-#include <linux/fcntl.h>
-#include <linux/ptrace.h>
-#include <linux/ioport.h>
-#include <linux/mm.h>
-#include <linux/init.h>
-#include <linux/delay.h>
-#include <linux/bitops.h>
-
-#include <asm/system.h>
-#include <linux/io.h>
-
-#include <asm/dma.h>
-#include <linux/slab.h>
-#include <linux/uaccess.h>
-
-#include <linux/hayesesp.h>
-
-#define NR_PORTS 64	/* maximum number of ports */
-#define NR_PRIMARY 8	/* maximum number of primary ports */
-#define REGION_SIZE 8   /* size of io region to request */
-
-/* The following variables can be set by giving module options */
-static int irq[NR_PRIMARY];	/* IRQ for each base port */
-static unsigned int divisor[NR_PRIMARY]; /* custom divisor for each port */
-static unsigned int dma = ESP_DMA_CHANNEL; /* DMA channel */
-static unsigned int rx_trigger = ESP_RX_TRIGGER;
-static unsigned int tx_trigger = ESP_TX_TRIGGER;
-static unsigned int flow_off = ESP_FLOW_OFF;
-static unsigned int flow_on = ESP_FLOW_ON;
-static unsigned int rx_timeout = ESP_RX_TMOUT;
-static unsigned int pio_threshold = ESP_PIO_THRESHOLD;
-
-MODULE_LICENSE("GPL");
-
-module_param_array(irq, int, NULL, 0);
-module_param_array(divisor, uint, NULL, 0);
-module_param(dma, uint, 0);
-module_param(rx_trigger, uint, 0);
-module_param(tx_trigger, uint, 0);
-module_param(flow_off, uint, 0);
-module_param(flow_on, uint, 0);
-module_param(rx_timeout, uint, 0);
-module_param(pio_threshold, uint, 0);
-
-/* END */
-
-static char *dma_buffer;
-static int dma_bytes;
-static struct esp_pio_buffer *free_pio_buf;
-
-#define DMA_BUFFER_SZ 1024
-
-#define WAKEUP_CHARS 1024
-
-static char serial_name[] __initdata = "ESP serial driver";
-static char serial_version[] __initdata = "2.2";
-
-static struct tty_driver *esp_driver;
-
-/*
- * Serial driver configuration section.  Here are the various options:
- *
- * SERIAL_PARANOIA_CHECK
- * 		Check the magic number for the esp_structure where
- * 		ever possible.
- */
-
-#undef SERIAL_PARANOIA_CHECK
-#define SERIAL_DO_RESTART
-
-#undef SERIAL_DEBUG_INTR
-#undef SERIAL_DEBUG_OPEN
-#undef SERIAL_DEBUG_FLOW
-
-#if defined(MODULE) && defined(SERIAL_DEBUG_MCOUNT)
-#define DBG_CNT(s) printk(KERN_DEBUG "(%s): [%x] refc=%d, serc=%d, ttyc=%d -> %s\n", \
-				tty->name, info->port.flags, \
-				serial_driver.refcount, \
-				info->port.count, tty->count, s)
-#else
-#define DBG_CNT(s)
-#endif
-
-static struct esp_struct *ports;
-
-static void change_speed(struct esp_struct *info);
-static void rs_wait_until_sent(struct tty_struct *, int);
-
-/*
- * The ESP card has a clock rate of 14.7456 MHz (that is, 2**ESPC_SCALE
- * times the normal 1.8432 Mhz clock of most serial boards).
- */
-#define BASE_BAUD ((1843200 / 16) * (1 << ESPC_SCALE))
-
-/* Standard COM flags (except for COM4, because of the 8514 problem) */
-#define STD_COM_FLAGS (ASYNC_BOOT_AUTOCONF | ASYNC_SKIP_TEST)
-
-static inline int serial_paranoia_check(struct esp_struct *info,
-					char *name, const char *routine)
-{
-#ifdef SERIAL_PARANOIA_CHECK
-	static const char badmagic[] = KERN_WARNING
-		"Warning: bad magic number for serial struct (%s) in %s\n";
-	static const char badinfo[] = KERN_WARNING
-		"Warning: null esp_struct for (%s) in %s\n";
-
-	if (!info) {
-		printk(badinfo, name, routine);
-		return 1;
-	}
-	if (info->magic != ESP_MAGIC) {
-		printk(badmagic, name, routine);
-		return 1;
-	}
-#endif
-	return 0;
-}
-
-static inline unsigned int serial_in(struct esp_struct *info, int offset)
-{
-	return inb(info->io_port + offset);
-}
-
-static inline void serial_out(struct esp_struct *info, int offset,
-			      unsigned char value)
-{
-	outb(value, info->io_port+offset);
-}
-
-/*
- * ------------------------------------------------------------
- * rs_stop() and rs_start()
- *
- * This routines are called before setting or resetting tty->stopped.
- * They enable or disable transmitter interrupts, as necessary.
- * ------------------------------------------------------------
- */
-static void rs_stop(struct tty_struct *tty)
-{
-	struct esp_struct *info = tty->driver_data;
-	unsigned long flags;
-
-	if (serial_paranoia_check(info, tty->name, "rs_stop"))
-		return;
-
-	spin_lock_irqsave(&info->lock, flags);
-	if (info->IER & UART_IER_THRI) {
-		info->IER &= ~UART_IER_THRI;
-		serial_out(info, UART_ESI_CMD1, ESI_SET_SRV_MASK);
-		serial_out(info, UART_ESI_CMD2, info->IER);
-	}
-	spin_unlock_irqrestore(&info->lock, flags);
-}
-
-static void rs_start(struct tty_struct *tty)
-{
-	struct esp_struct *info = tty->driver_data;
-	unsigned long flags;
-
-	if (serial_paranoia_check(info, tty->name, "rs_start"))
-		return;
-
-	spin_lock_irqsave(&info->lock, flags);
-	if (info->xmit_cnt && info->xmit_buf && !(info->IER & UART_IER_THRI)) {
-		info->IER |= UART_IER_THRI;
-		serial_out(info, UART_ESI_CMD1, ESI_SET_SRV_MASK);
-		serial_out(info, UART_ESI_CMD2, info->IER);
-	}
-	spin_unlock_irqrestore(&info->lock, flags);
-}
-
-/*
- * ----------------------------------------------------------------------
- *
- * Here starts the interrupt handling routines.  All of the following
- * subroutines are declared as inline and are folded into
- * rs_interrupt().  They were separated out for readability's sake.
- *
- * Note: rs_interrupt() is a "fast" interrupt, which means that it
- * runs with interrupts turned off.  People who may want to modify
- * rs_interrupt() should try to keep the interrupt handler as fast as
- * possible.  After you are done making modifications, it is not a bad
- * idea to do:
- *
- * gcc -S -DKERNEL -Wall -Wstrict-prototypes -O6 -fomit-frame-pointer serial.c
- *
- * and look at the resulting assemble code in serial.s.
- *
- * 				- Ted Ts'o (tytso@mit.edu), 7-Mar-93
- * -----------------------------------------------------------------------
- */
-
-static DEFINE_SPINLOCK(pio_lock);
-
-static inline struct esp_pio_buffer *get_pio_buffer(void)
-{
-	struct esp_pio_buffer *buf;
-	unsigned long flags;
-
-	spin_lock_irqsave(&pio_lock, flags);
-	if (free_pio_buf) {
-		buf = free_pio_buf;
-		free_pio_buf = buf->next;
-	} else {
-		buf = kmalloc(sizeof(struct esp_pio_buffer), GFP_ATOMIC);
-	}
-	spin_unlock_irqrestore(&pio_lock, flags);
-	return buf;
-}
-
-static inline void release_pio_buffer(struct esp_pio_buffer *buf)
-{
-	unsigned long flags;
-	spin_lock_irqsave(&pio_lock, flags);
-	buf->next = free_pio_buf;
-	free_pio_buf = buf;
-	spin_unlock_irqrestore(&pio_lock, flags);
-}
-
-static inline void receive_chars_pio(struct esp_struct *info, int num_bytes)
-{
-	struct tty_struct *tty = info->port.tty;
-	int i;
-	struct esp_pio_buffer *pio_buf;
-	struct esp_pio_buffer *err_buf;
-	unsigned char status_mask;
-
-	pio_buf = get_pio_buffer();
-
-	if (!pio_buf)
-		return;
-
-	err_buf = get_pio_buffer();
-
-	if (!err_buf) {
-		release_pio_buffer(pio_buf);
-		return;
-	}
-
-	status_mask = (info->read_status_mask >> 2) & 0x07;
-
-	for (i = 0; i < num_bytes - 1; i += 2) {
-		*((unsigned short *)(pio_buf->data + i)) =
-			inw(info->io_port + UART_ESI_RX);
-		err_buf->data[i] = serial_in(info, UART_ESI_RWS);
-		err_buf->data[i + 1] = (err_buf->data[i] >> 3) & status_mask;
-		err_buf->data[i] &= status_mask;
-	}
-
-	if (num_bytes & 0x0001) {
-		pio_buf->data[num_bytes - 1] = serial_in(info, UART_ESI_RX);
-		err_buf->data[num_bytes - 1] =
-			(serial_in(info, UART_ESI_RWS) >> 3) & status_mask;
-	}
-
-	/* make sure everything is still ok since interrupts were enabled */
-	tty = info->port.tty;
-
-	if (!tty) {
-		release_pio_buffer(pio_buf);
-		release_pio_buffer(err_buf);
-		info->stat_flags &= ~ESP_STAT_RX_TIMEOUT;
-		return;
-	}
-
-	status_mask = (info->ignore_status_mask >> 2) & 0x07;
-
-	for (i = 0; i < num_bytes; i++) {
-		if (!(err_buf->data[i] & status_mask)) {
-			int flag = 0;
-
-			if (err_buf->data[i] & 0x04) {
-				flag = TTY_BREAK;
-				if (info->port.flags & ASYNC_SAK)
-					do_SAK(tty);
-			} else if (err_buf->data[i] & 0x02)
-				flag = TTY_FRAME;
-			else if (err_buf->data[i] & 0x01)
-				flag = TTY_PARITY;
-			tty_insert_flip_char(tty, pio_buf->data[i], flag);
-		}
-	}
-
-	tty_schedule_flip(tty);
-
-	info->stat_flags &= ~ESP_STAT_RX_TIMEOUT;
-	release_pio_buffer(pio_buf);
-	release_pio_buffer(err_buf);
-}
-
-static void program_isa_dma(int dma, int dir, unsigned long addr, int len)
-{
-	unsigned long flags;
-
-	flags = claim_dma_lock();
-	disable_dma(dma);
-	clear_dma_ff(dma);
-	set_dma_mode(dma, dir);
-	set_dma_addr(dma, addr);
-	set_dma_count(dma, len);
-	enable_dma(dma);
-	release_dma_lock(flags);
-}
-
-static void receive_chars_dma(struct esp_struct *info, int num_bytes)
-{
-	info->stat_flags &= ~ESP_STAT_RX_TIMEOUT;
-	dma_bytes = num_bytes;
-	info->stat_flags |= ESP_STAT_DMA_RX;
-
-	program_isa_dma(dma, DMA_MODE_READ, isa_virt_to_bus(dma_buffer),
-								dma_bytes);
-	serial_out(info, UART_ESI_CMD1, ESI_START_DMA_RX);
-}
-
-static inline void receive_chars_dma_done(struct esp_struct *info,
-					    int status)
-{
-	struct tty_struct *tty = info->port.tty;
-	int num_bytes;
-	unsigned long flags;
-
-	flags = claim_dma_lock();
-	disable_dma(dma);
-	clear_dma_ff(dma);
-
-	info->stat_flags &= ~ESP_STAT_DMA_RX;
-	num_bytes = dma_bytes - get_dma_residue(dma);
-	release_dma_lock(flags);
-
-	info->icount.rx += num_bytes;
-
-	if (num_bytes > 0) {
-		tty_insert_flip_string(tty, dma_buffer, num_bytes - 1);
-
-		status &= (0x1c & info->read_status_mask);
-
-		/* Is the status significant or do we throw the last byte ? */
-		if (!(status & info->ignore_status_mask)) {
-			int statflag = 0;
-
-			if (status & 0x10) {
-				statflag = TTY_BREAK;
-				(info->icount.brk)++;
-				if (info->port.flags & ASYNC_SAK)
-					do_SAK(tty);
-			} else if (status & 0x08) {
-				statflag = TTY_FRAME;
-				info->icount.frame++;
-			} else if (status & 0x04) {
-				statflag = TTY_PARITY;
-				info->icount.parity++;
-			}
-			tty_insert_flip_char(tty, dma_buffer[num_bytes - 1],
-								statflag);
-		}
-		tty_schedule_flip(tty);
-	}
-
-	if (dma_bytes != num_bytes) {
-		num_bytes = dma_bytes - num_bytes;
-		dma_bytes = 0;
-		receive_chars_dma(info, num_bytes);
-	} else
-		dma_bytes = 0;
-}
-
-/* Caller must hold info->lock */
-
-static inline void transmit_chars_pio(struct esp_struct *info,
-					int space_avail)
-{
-	int i;
-	struct esp_pio_buffer *pio_buf;
-
-	pio_buf = get_pio_buffer();
-
-	if (!pio_buf)
-		return;
-
-	while (space_avail && info->xmit_cnt) {
-		if (info->xmit_tail + space_avail <= ESP_XMIT_SIZE) {
-			memcpy(pio_buf->data,
-			       &(info->xmit_buf[info->xmit_tail]),
-			       space_avail);
-		} else {
-			i = ESP_XMIT_SIZE - info->xmit_tail;
-			memcpy(pio_buf->data,
-			       &(info->xmit_buf[info->xmit_tail]), i);
-			memcpy(&(pio_buf->data[i]), info->xmit_buf,
-			       space_avail - i);
-		}
-
-		info->xmit_cnt -= space_avail;
-		info->xmit_tail = (info->xmit_tail + space_avail) &
-			(ESP_XMIT_SIZE - 1);
-
-		for (i = 0; i < space_avail - 1; i += 2) {
-			outw(*((unsigned short *)(pio_buf->data + i)),
-			     info->io_port + UART_ESI_TX);
-		}
-
-		if (space_avail & 0x0001)
-			serial_out(info, UART_ESI_TX,
-				   pio_buf->data[space_avail - 1]);
-
-		if (info->xmit_cnt) {
-			serial_out(info, UART_ESI_CMD1, ESI_NO_COMMAND);
-			serial_out(info, UART_ESI_CMD1, ESI_GET_TX_AVAIL);
-			space_avail = serial_in(info, UART_ESI_STAT1) << 8;
-			space_avail |= serial_in(info, UART_ESI_STAT2);
-
-			if (space_avail > info->xmit_cnt)
-				space_avail = info->xmit_cnt;
-		}
-	}
-
-	if (info->xmit_cnt < WAKEUP_CHARS) {
-		if (info->port.tty)
-			tty_wakeup(info->port.tty);
-
-#ifdef SERIAL_DEBUG_INTR
-		printk("THRE...");
-#endif
-
-		if (info->xmit_cnt <= 0) {
-			info->IER &= ~UART_IER_THRI;
-			serial_out(info, UART_ESI_CMD1,
-				   ESI_SET_SRV_MASK);
-			serial_out(info, UART_ESI_CMD2, info->IER);
-		}
-	}
-
-	release_pio_buffer(pio_buf);
-}
-
-/* Caller must hold info->lock */
-static inline void transmit_chars_dma(struct esp_struct *info, int num_bytes)
-{
-	dma_bytes = num_bytes;
-
-	if (info->xmit_tail + dma_bytes <= ESP_XMIT_SIZE) {
-		memcpy(dma_buffer, &(info->xmit_buf[info->xmit_tail]),
-		       dma_bytes);
-	} else {
-		int i = ESP_XMIT_SIZE - info->xmit_tail;
-		memcpy(dma_buffer, &(info->xmit_buf[info->xmit_tail]),
-			i);
-		memcpy(&(dma_buffer[i]), info->xmit_buf, dma_bytes - i);
-	}
-
-	info->xmit_cnt -= dma_bytes;
-	info->xmit_tail = (info->xmit_tail + dma_bytes) & (ESP_XMIT_SIZE - 1);
-
-	if (info->xmit_cnt < WAKEUP_CHARS) {
-		if (info->port.tty)
-			tty_wakeup(info->port.tty);
-
-#ifdef SERIAL_DEBUG_INTR
-		printk("THRE...");
-#endif
-
-		if (info->xmit_cnt <= 0) {
-			info->IER &= ~UART_IER_THRI;
-			serial_out(info, UART_ESI_CMD1, ESI_SET_SRV_MASK);
-			serial_out(info, UART_ESI_CMD2, info->IER);
-		}
-	}
-
-	info->stat_flags |= ESP_STAT_DMA_TX;
-
-	program_isa_dma(dma, DMA_MODE_WRITE, isa_virt_to_bus(dma_buffer),
-								dma_bytes);
-	serial_out(info, UART_ESI_CMD1, ESI_START_DMA_TX);
-}
-
-static inline void transmit_chars_dma_done(struct esp_struct *info)
-{
-	int num_bytes;
-	unsigned long flags;
-
-	flags = claim_dma_lock();
-	disable_dma(dma);
-	clear_dma_ff(dma);
-
-	num_bytes = dma_bytes - get_dma_residue(dma);
-	info->icount.tx += dma_bytes;
-	release_dma_lock(flags);
-
-	if (dma_bytes != num_bytes) {
-		dma_bytes -= num_bytes;
-		memmove(dma_buffer, dma_buffer + num_bytes, dma_bytes);
-
-		program_isa_dma(dma, DMA_MODE_WRITE,
-				isa_virt_to_bus(dma_buffer), dma_bytes);
-
-		serial_out(info, UART_ESI_CMD1, ESI_START_DMA_TX);
-	} else {
-		dma_bytes = 0;
-		info->stat_flags &= ~ESP_STAT_DMA_TX;
-	}
-}
-
-static void check_modem_status(struct esp_struct *info)
-{
-	int	status;
-
-	serial_out(info, UART_ESI_CMD1, ESI_GET_UART_STAT);
-	status = serial_in(info, UART_ESI_STAT2);
-
-	if (status & UART_MSR_ANY_DELTA) {
-		/* update input line counters */
-		if (status & UART_MSR_TERI)
-			info->icount.rng++;
-		if (status & UART_MSR_DDSR)
-			info->icount.dsr++;
-		if (status & UART_MSR_DDCD)
-			info->icount.dcd++;
-		if (status & UART_MSR_DCTS)
-			info->icount.cts++;
-		wake_up_interruptible(&info->port.delta_msr_wait);
-	}
-
-	if ((info->port.flags & ASYNC_CHECK_CD) && (status & UART_MSR_DDCD)) {
-#if (defined(SERIAL_DEBUG_OPEN) || defined(SERIAL_DEBUG_INTR))
-		printk("ttys%d CD now %s...", info->line,
-		       (status & UART_MSR_DCD) ? "on" : "off");
-#endif
-		if (status & UART_MSR_DCD)
-			wake_up_interruptible(&info->port.open_wait);
-		else {
-#ifdef SERIAL_DEBUG_OPEN
-			printk("scheduling hangup...");
-#endif
-			tty_hangup(info->port.tty);
-		}
-	}
-}
-
-/*
- * This is the serial driver's interrupt routine
- */
-static irqreturn_t rs_interrupt_single(int irq, void *dev_id)
-{
-	struct esp_struct *info;
-	unsigned err_status;
-	unsigned int scratch;
-
-#ifdef SERIAL_DEBUG_INTR
-	printk("rs_interrupt_single(%d)...", irq);
-#endif
-	info = (struct esp_struct *)dev_id;
-	err_status = 0;
-	scratch = serial_in(info, UART_ESI_SID);
-
-	spin_lock(&info->lock);
-
-	if (!info->port.tty) {
-		spin_unlock(&info->lock);
-		return IRQ_NONE;
-	}
-
-	if (scratch & 0x04) { /* error */
-		serial_out(info, UART_ESI_CMD1, ESI_GET_ERR_STAT);
-		err_status = serial_in(info, UART_ESI_STAT1);
-		serial_in(info, UART_ESI_STAT2);
-
-		if (err_status & 0x01)
-			info->stat_flags |= ESP_STAT_RX_TIMEOUT;
-
-		if (err_status & 0x20) /* UART status */
-			check_modem_status(info);
-
-		if (err_status & 0x80) /* Start break */
-			wake_up_interruptible(&info->break_wait);
-	}
-
-	if ((scratch & 0x88) || /* DMA completed or timed out */
-	    (err_status & 0x1c) /* receive error */) {
-		if (info->stat_flags & ESP_STAT_DMA_RX)
-			receive_chars_dma_done(info, err_status);
-		else if (info->stat_flags & ESP_STAT_DMA_TX)
-			transmit_chars_dma_done(info);
-	}
-
-	if (!(info->stat_flags & (ESP_STAT_DMA_RX | ESP_STAT_DMA_TX)) &&
-	    ((scratch & 0x01) || (info->stat_flags & ESP_STAT_RX_TIMEOUT)) &&
-	    (info->IER & UART_IER_RDI)) {
-		int num_bytes;
-
-		serial_out(info, UART_ESI_CMD1, ESI_NO_COMMAND);
-		serial_out(info, UART_ESI_CMD1, ESI_GET_RX_AVAIL);
-		num_bytes = serial_in(info, UART_ESI_STAT1) << 8;
-		num_bytes |= serial_in(info, UART_ESI_STAT2);
-
-		num_bytes = tty_buffer_request_room(info->port.tty, num_bytes);
-
-		if (num_bytes) {
-			if (dma_bytes ||
-			    (info->stat_flags & ESP_STAT_USE_PIO) ||
-			    (num_bytes <= info->config.pio_threshold))
-				receive_chars_pio(info, num_bytes);
-			else
-				receive_chars_dma(info, num_bytes);
-		}
-	}
-
-	if (!(info->stat_flags & (ESP_STAT_DMA_RX | ESP_STAT_DMA_TX)) &&
-	    (scratch & 0x02) && (info->IER & UART_IER_THRI)) {
-		if ((info->xmit_cnt <= 0) || info->port.tty->stopped) {
-			info->IER &= ~UART_IER_THRI;
-			serial_out(info, UART_ESI_CMD1, ESI_SET_SRV_MASK);
-			serial_out(info, UART_ESI_CMD2, info->IER);
-		} else {
-			int num_bytes;
-
-			serial_out(info, UART_ESI_CMD1, ESI_NO_COMMAND);
-			serial_out(info, UART_ESI_CMD1, ESI_GET_TX_AVAIL);
-			num_bytes = serial_in(info, UART_ESI_STAT1) << 8;
-			num_bytes |= serial_in(info, UART_ESI_STAT2);
-
-			if (num_bytes > info->xmit_cnt)
-				num_bytes = info->xmit_cnt;
-
-			if (num_bytes) {
-				if (dma_bytes ||
-				    (info->stat_flags & ESP_STAT_USE_PIO) ||
-				    (num_bytes <= info->config.pio_threshold))
-					transmit_chars_pio(info, num_bytes);
-				else
-					transmit_chars_dma(info, num_bytes);
-			}
-		}
-	}
-
-	info->last_active = jiffies;
-
-#ifdef SERIAL_DEBUG_INTR
-	printk("end.\n");
-#endif
-	spin_unlock(&info->lock);
-	return IRQ_HANDLED;
-}
-
-/*
- * -------------------------------------------------------------------
- * Here ends the serial interrupt routines.
- * -------------------------------------------------------------------
- */
-
-/*
- * ---------------------------------------------------------------
- * Low level utility subroutines for the serial driver:  routines to
- * figure out the appropriate timeout for an interrupt chain, routines
- * to initialize and startup a serial port, and routines to shutdown a
- * serial port.  Useful stuff like that.
- *
- * Caller should hold lock
- * ---------------------------------------------------------------
- */
-
-static void esp_basic_init(struct esp_struct *info)
-{
-	/* put ESPC in enhanced mode */
-	serial_out(info, UART_ESI_CMD1, ESI_SET_MODE);
-
-	if (info->stat_flags & ESP_STAT_NEVER_DMA)
-		serial_out(info, UART_ESI_CMD2, 0x01);
-	else
-		serial_out(info, UART_ESI_CMD2, 0x31);
-
-	/* disable interrupts for now */
-	serial_out(info, UART_ESI_CMD1, ESI_SET_SRV_MASK);
-	serial_out(info, UART_ESI_CMD2, 0x00);
-
-	/* set interrupt and DMA channel */
-	serial_out(info, UART_ESI_CMD1, ESI_SET_IRQ);
-
-	if (info->stat_flags & ESP_STAT_NEVER_DMA)
-		serial_out(info, UART_ESI_CMD2, 0x01);
-	else
-		serial_out(info, UART_ESI_CMD2, (dma << 4) | 0x01);
-
-	serial_out(info, UART_ESI_CMD1, ESI_SET_ENH_IRQ);
-
-	if (info->line % 8)	/* secondary port */
-		serial_out(info, UART_ESI_CMD2, 0x0d);	/* shared */
-	else if (info->irq == 9)
-		serial_out(info, UART_ESI_CMD2, 0x02);
-	else
-		serial_out(info, UART_ESI_CMD2, info->irq);
-
-	/* set error status mask (check this) */
-	serial_out(info, UART_ESI_CMD1, ESI_SET_ERR_MASK);
-
-	if (info->stat_flags & ESP_STAT_NEVER_DMA)
-		serial_out(info, UART_ESI_CMD2, 0xa1);
-	else
-		serial_out(info, UART_ESI_CMD2, 0xbd);
-
-	serial_out(info, UART_ESI_CMD2, 0x00);
-
-	/* set DMA timeout */
-	serial_out(info, UART_ESI_CMD1, ESI_SET_DMA_TMOUT);
-	serial_out(info, UART_ESI_CMD2, 0xff);
-
-	/* set FIFO trigger levels */
-	serial_out(info, UART_ESI_CMD1, ESI_SET_TRIGGER);
-	serial_out(info, UART_ESI_CMD2, info->config.rx_trigger >> 8);
-	serial_out(info, UART_ESI_CMD2, info->config.rx_trigger);
-	serial_out(info, UART_ESI_CMD2, info->config.tx_trigger >> 8);
-	serial_out(info, UART_ESI_CMD2, info->config.tx_trigger);
-
-	/* Set clock scaling and wait states */
-	serial_out(info, UART_ESI_CMD1, ESI_SET_PRESCALAR);
-	serial_out(info, UART_ESI_CMD2, 0x04 | ESPC_SCALE);
-
-	/* set reinterrupt pacing */
-	serial_out(info, UART_ESI_CMD1, ESI_SET_REINTR);
-	serial_out(info, UART_ESI_CMD2, 0xff);
-}
-
-static int startup(struct esp_struct *info)
-{
-	unsigned long flags;
-	int	retval = 0;
-	unsigned int num_chars;
-
-	spin_lock_irqsave(&info->lock, flags);
-
-	if (info->port.flags & ASYNC_INITIALIZED)
-		goto out;
-
-	if (!info->xmit_buf) {
-		info->xmit_buf = (unsigned char *)get_zeroed_page(GFP_ATOMIC);
-		retval = -ENOMEM;
-		if (!info->xmit_buf)
-			goto out;
-	}
-
-#ifdef SERIAL_DEBUG_OPEN
-	printk(KERN_DEBUG "starting up ttys%d (irq %d)...",
-						info->line, info->irq);
-#endif
-
-	/* Flush the RX buffer.  Using the ESI flush command may cause */
-	/* wild interrupts, so read all the data instead. */
-
-	serial_out(info, UART_ESI_CMD1, ESI_NO_COMMAND);
-	serial_out(info, UART_ESI_CMD1, ESI_GET_RX_AVAIL);
-	num_chars = serial_in(info, UART_ESI_STAT1) << 8;
-	num_chars |= serial_in(info, UART_ESI_STAT2);
-
-	while (num_chars > 1) {
-		inw(info->io_port + UART_ESI_RX);
-		num_chars -= 2;
-	}
-
-	if (num_chars)
-		serial_in(info, UART_ESI_RX);
-
-	/* set receive character timeout */
-	serial_out(info, UART_ESI_CMD1, ESI_SET_RX_TIMEOUT);
-	serial_out(info, UART_ESI_CMD2, info->config.rx_timeout);
-
-	/* clear all flags except the "never DMA" flag */
-	info->stat_flags &= ESP_STAT_NEVER_DMA;
-
-	if (info->stat_flags & ESP_STAT_NEVER_DMA)
-		info->stat_flags |= ESP_STAT_USE_PIO;
-
-	spin_unlock_irqrestore(&info->lock, flags);
-
-	/*
-	 * Allocate the IRQ
-	 */
-
-	retval = request_irq(info->irq, rs_interrupt_single, IRQF_SHARED,
-			     "esp serial", info);
-
-	if (retval) {
-		if (capable(CAP_SYS_ADMIN)) {
-			if (info->port.tty)
-				set_bit(TTY_IO_ERROR,
-					&info->port.tty->flags);
-			retval = 0;
-		}
-		goto out_unlocked;
-	}
-
-	if (!(info->stat_flags & ESP_STAT_USE_PIO) && !dma_buffer) {
-		dma_buffer = (char *)__get_dma_pages(
-			GFP_KERNEL, get_order(DMA_BUFFER_SZ));
-
-		/* use PIO mode if DMA buf/chan cannot be allocated */
-		if (!dma_buffer)
-			info->stat_flags |= ESP_STAT_USE_PIO;
-		else if (request_dma(dma, "esp serial")) {
-			free_pages((unsigned long)dma_buffer,
-				   get_order(DMA_BUFFER_SZ));
-			dma_buffer = NULL;
-			info->stat_flags |= ESP_STAT_USE_PIO;
-		}
-
-	}
-
-	info->MCR = UART_MCR_DTR | UART_MCR_RTS | UART_MCR_OUT2;
-
-	spin_lock_irqsave(&info->lock, flags);
-	serial_out(info, UART_ESI_CMD1, ESI_WRITE_UART);
-	serial_out(info, UART_ESI_CMD2, UART_MCR);
-	serial_out(info, UART_ESI_CMD2, info->MCR);
-
-	/*
-	 * Finally, enable interrupts
-	 */
-	/* info->IER = UART_IER_MSI | UART_IER_RLSI | UART_IER_RDI; */
-	info->IER = UART_IER_RLSI | UART_IER_RDI | UART_IER_DMA_TMOUT |
-			UART_IER_DMA_TC;
-	serial_out(info, UART_ESI_CMD1, ESI_SET_SRV_MASK);
-	serial_out(info, UART_ESI_CMD2, info->IER);
-
-	if (info->port.tty)
-		clear_bit(TTY_IO_ERROR, &info->port.tty->flags);
-	info->xmit_cnt = info->xmit_head = info->xmit_tail = 0;
-	spin_unlock_irqrestore(&info->lock, flags);
-
-	/*
-	 * Set up the tty->alt_speed kludge
-	 */
-	if (info->port.tty) {
-		if ((info->port.flags & ASYNC_SPD_MASK) == ASYNC_SPD_HI)
-			info->port.tty->alt_speed = 57600;
-		if ((info->port.flags & ASYNC_SPD_MASK) == ASYNC_SPD_VHI)
-			info->port.tty->alt_speed = 115200;
-		if ((info->port.flags & ASYNC_SPD_MASK) == ASYNC_SPD_SHI)
-			info->port.tty->alt_speed = 230400;
-		if ((info->port.flags & ASYNC_SPD_MASK) == ASYNC_SPD_WARP)
-			info->port.tty->alt_speed = 460800;
-	}
-
-	/*
-	 * set the speed of the serial port
-	 */
-	change_speed(info);
-	info->port.flags |= ASYNC_INITIALIZED;
-	return 0;
-
-out:
-	spin_unlock_irqrestore(&info->lock, flags);
-out_unlocked:
-	return retval;
-}
-
-/*
- * This routine will shutdown a serial port; interrupts are disabled, and
- * DTR is dropped if the hangup on close termio flag is on.
- */
-static void shutdown(struct esp_struct *info)
-{
-	unsigned long	flags, f;
-
-	if (!(info->port.flags & ASYNC_INITIALIZED))
-		return;
-
-#ifdef SERIAL_DEBUG_OPEN
-	printk("Shutting down serial port %d (irq %d)....", info->line,
-	       info->irq);
-#endif
-
-	spin_lock_irqsave(&info->lock, flags);
-	/*
-	 * clear delta_msr_wait queue to avoid mem leaks: we may free the irq
-	 * here so the queue might never be waken up
-	 */
-	wake_up_interruptible(&info->port.delta_msr_wait);
-	wake_up_interruptible(&info->break_wait);
-
-	/* stop a DMA transfer on the port being closed */
-	/* DMA lock is higher priority always */
-	if (info->stat_flags & (ESP_STAT_DMA_RX | ESP_STAT_DMA_TX)) {
-		f = claim_dma_lock();
-		disable_dma(dma);
-		clear_dma_ff(dma);
-		release_dma_lock(f);
-
-		dma_bytes = 0;
-	}
-
-	/*
-	 * Free the IRQ
-	 */
-	free_irq(info->irq, info);
-
-	if (dma_buffer) {
-		struct esp_struct *current_port = ports;
-
-		while (current_port) {
-			if ((current_port != info) &&
-			    (current_port->port.flags & ASYNC_INITIALIZED))
-				break;
-
-			current_port = current_port->next_port;
-		}
-
-		if (!current_port) {
-			free_dma(dma);
-			free_pages((unsigned long)dma_buffer,
-				   get_order(DMA_BUFFER_SZ));
-			dma_buffer = NULL;
-		}
-	}
-
-	if (info->xmit_buf) {
-		free_page((unsigned long) info->xmit_buf);
-		info->xmit_buf = NULL;
-	}
-
-	info->IER = 0;
-	serial_out(info, UART_ESI_CMD1, ESI_SET_SRV_MASK);
-	serial_out(info, UART_ESI_CMD2, 0x00);
-
-	if (!info->port.tty || (info->port.tty->termios->c_cflag & HUPCL))
-		info->MCR &= ~(UART_MCR_DTR|UART_MCR_RTS);
-
-	info->MCR &= ~UART_MCR_OUT2;
-	serial_out(info, UART_ESI_CMD1, ESI_WRITE_UART);
-	serial_out(info, UART_ESI_CMD2, UART_MCR);
-	serial_out(info, UART_ESI_CMD2, info->MCR);
-
-	if (info->port.tty)
-		set_bit(TTY_IO_ERROR, &info->port.tty->flags);
-
-	info->port.flags &= ~ASYNC_INITIALIZED;
-	spin_unlock_irqrestore(&info->lock, flags);
-}
-
-/*
- * This routine is called to set the UART divisor registers to match
- * the specified baud rate for a serial port.
- */
-static void change_speed(struct esp_struct *info)
-{
-	unsigned short port;
-	int	quot = 0;
-	unsigned cflag, cval;
-	int	baud, bits;
-	unsigned char flow1 = 0, flow2 = 0;
-	unsigned long flags;
-
-	if (!info->port.tty || !info->port.tty->termios)
-		return;
-	cflag = info->port.tty->termios->c_cflag;
-	port = info->io_port;
-
-	/* byte size and parity */
-	switch (cflag & CSIZE) {
-	case CS5: cval = 0x00; bits = 7; break;
-	case CS6: cval = 0x01; bits = 8; break;
-	case CS7: cval = 0x02; bits = 9; break;
-	case CS8: cval = 0x03; bits = 10; break;
-	default:  cval = 0x00; bits = 7; break;
-	}
-	if (cflag & CSTOPB) {
-		cval |= 0x04;
-		bits++;
-	}
-	if (cflag & PARENB) {
-		cval |= UART_LCR_PARITY;
-		bits++;
-	}
-	if (!(cflag & PARODD))
-		cval |= UART_LCR_EPAR;
-#ifdef CMSPAR
-	if (cflag & CMSPAR)
-		cval |= UART_LCR_SPAR;
-#endif
-	baud = tty_get_baud_rate(info->port.tty);
-	if (baud == 38400 &&
-		((info->port.flags & ASYNC_SPD_MASK) == ASYNC_SPD_CUST))
-		quot = info->custom_divisor;
-	else {
-		if (baud == 134) /* Special case since 134 is really 134.5 */
-			quot = (2*BASE_BAUD / 269);
-		else if (baud)
-			quot = BASE_BAUD / baud;
-	}
-	/* If the quotient is ever zero, default to 9600 bps */
-	if (!quot)
-		quot = BASE_BAUD / 9600;
-
-	if (baud) {
-		/* Actual rate */
-		baud = BASE_BAUD/quot;
-		tty_encode_baud_rate(info->port.tty, baud, baud);
-	}
-	info->timeout = ((1024 * HZ * bits * quot) / BASE_BAUD) + (HZ / 50);
-
-	/* CTS flow control flag and modem status interrupts */
-	/* info->IER &= ~UART_IER_MSI; */
-	if (cflag & CRTSCTS) {
-		info->port.flags |= ASYNC_CTS_FLOW;
-		/* info->IER |= UART_IER_MSI; */
-		flow1 = 0x04;
-		flow2 = 0x10;
-	} else
-		info->port.flags &= ~ASYNC_CTS_FLOW;
-	if (cflag & CLOCAL)
-		info->port.flags &= ~ASYNC_CHECK_CD;
-	else
-		info->port.flags |= ASYNC_CHECK_CD;
-
-	/*
-	 * Set up parity check flag
-	 */
-	info->read_status_mask = UART_LSR_OE | UART_LSR_THRE | UART_LSR_DR;
-	if (I_INPCK(info->port.tty))
-		info->read_status_mask |= UART_LSR_FE | UART_LSR_PE;
-	if (I_BRKINT(info->port.tty) || I_PARMRK(info->port.tty))
-		info->read_status_mask |= UART_LSR_BI;
-
-	info->ignore_status_mask = 0;
-#if 0
-	/* This should be safe, but for some broken bits of hardware... */
-	if (I_IGNPAR(info->port.tty)) {
-		info->ignore_status_mask |= UART_LSR_PE | UART_LSR_FE;
-		info->read_status_mask |= UART_LSR_PE | UART_LSR_FE;
-	}
-#endif
-	if (I_IGNBRK(info->port.tty)) {
-		info->ignore_status_mask |= UART_LSR_BI;
-		info->read_status_mask |= UART_LSR_BI;
-		/*
-		 * If we're ignore parity and break indicators, ignore
-		 * overruns too.  (For real raw support).
-		 */
-		if (I_IGNPAR(info->port.tty)) {
-			info->ignore_status_mask |= UART_LSR_OE | \
-				UART_LSR_PE | UART_LSR_FE;
-			info->read_status_mask |= UART_LSR_OE | \
-				UART_LSR_PE | UART_LSR_FE;
-		}
-	}
-
-	if (I_IXOFF(info->port.tty))
-		flow1 |= 0x81;
-
-	spin_lock_irqsave(&info->lock, flags);
-	/* set baud */
-	serial_out(info, UART_ESI_CMD1, ESI_SET_BAUD);
-	serial_out(info, UART_ESI_CMD2, quot >> 8);
-	serial_out(info, UART_ESI_CMD2, quot & 0xff);
-
-	/* set data bits, parity, etc. */
-	serial_out(info, UART_ESI_CMD1, ESI_WRITE_UART);
-	serial_out(info, UART_ESI_CMD2, UART_LCR);
-	serial_out(info, UART_ESI_CMD2, cval);
-
-	/* Enable flow control */
-	serial_out(info, UART_ESI_CMD1, ESI_SET_FLOW_CNTL);
-	serial_out(info, UART_ESI_CMD2, flow1);
-	serial_out(info, UART_ESI_CMD2, flow2);
-
-	/* set flow control characters (XON/XOFF only) */
-	if (I_IXOFF(info->port.tty)) {
-		serial_out(info, UART_ESI_CMD1, ESI_SET_FLOW_CHARS);
-		serial_out(info, UART_ESI_CMD2, START_CHAR(info->port.tty));
-		serial_out(info, UART_ESI_CMD2, STOP_CHAR(info->port.tty));
-		serial_out(info, UART_ESI_CMD2, 0x10);
-		serial_out(info, UART_ESI_CMD2, 0x21);
-		switch (cflag & CSIZE) {
-		case CS5:
-			serial_out(info, UART_ESI_CMD2, 0x1f);
-			break;
-		case CS6:
-			serial_out(info, UART_ESI_CMD2, 0x3f);
-			break;
-		case CS7:
-		case CS8:
-			serial_out(info, UART_ESI_CMD2, 0x7f);
-			break;
-		default:
-			serial_out(info, UART_ESI_CMD2, 0xff);
-			break;
-		}
-	}
-
-	/* Set high/low water */
-	serial_out(info, UART_ESI_CMD1, ESI_SET_FLOW_LVL);
-	serial_out(info, UART_ESI_CMD2, info->config.flow_off >> 8);
-	serial_out(info, UART_ESI_CMD2, info->config.flow_off);
-	serial_out(info, UART_ESI_CMD2, info->config.flow_on >> 8);
-	serial_out(info, UART_ESI_CMD2, info->config.flow_on);
-
-	spin_unlock_irqrestore(&info->lock, flags);
-}
-
-static int rs_put_char(struct tty_struct *tty, unsigned char ch)
-{
-	struct esp_struct *info = tty->driver_data;
-	unsigned long flags;
-	int ret = 0;
-
-	if (serial_paranoia_check(info, tty->name, "rs_put_char"))
-		return 0;
-
-	if (!info->xmit_buf)
-		return 0;
-
-	spin_lock_irqsave(&info->lock, flags);
-	if (info->xmit_cnt < ESP_XMIT_SIZE - 1) {
-		info->xmit_buf[info->xmit_head++] = ch;
-		info->xmit_head &= ESP_XMIT_SIZE-1;
-		info->xmit_cnt++;
-		ret = 1;
-	}
-	spin_unlock_irqrestore(&info->lock, flags);
-	return ret;
-}
-
-static void rs_flush_chars(struct tty_struct *tty)
-{
-	struct esp_struct *info = tty->driver_data;
-	unsigned long flags;
-
-	if (serial_paranoia_check(info, tty->name, "rs_flush_chars"))
-		return;
-
-	spin_lock_irqsave(&info->lock, flags);
-
-	if (info->xmit_cnt <= 0 || tty->stopped || !info->xmit_buf)
-		goto out;
-
-	if (!(info->IER & UART_IER_THRI)) {
-		info->IER |= UART_IER_THRI;
-		serial_out(info, UART_ESI_CMD1, ESI_SET_SRV_MASK);
-		serial_out(info, UART_ESI_CMD2, info->IER);
-	}
-out:
-	spin_unlock_irqrestore(&info->lock, flags);
-}
-
-static int rs_write(struct tty_struct *tty,
-		    const unsigned char *buf, int count)
-{
-	int	c, t, ret = 0;
-	struct esp_struct *info = tty->driver_data;
-	unsigned long flags;
-
-	if (serial_paranoia_check(info, tty->name, "rs_write"))
-		return 0;
-
-	if (!info->xmit_buf)
-		return 0;
-
-	while (1) {
-		/* Thanks to R. Wolff for suggesting how to do this with */
-		/* interrupts enabled */
-
-		c = count;
-		t = ESP_XMIT_SIZE - info->xmit_cnt - 1;
-
-		if (t < c)
-			c = t;
-
-		t = ESP_XMIT_SIZE - info->xmit_head;
-
-		if (t < c)
-			c = t;
-
-		if (c <= 0)
-			break;
-
-		memcpy(info->xmit_buf + info->xmit_head, buf, c);
-
-		info->xmit_head = (info->xmit_head + c) & (ESP_XMIT_SIZE-1);
-		info->xmit_cnt += c;
-		buf += c;
-		count -= c;
-		ret += c;
-	}
-
-	spin_lock_irqsave(&info->lock, flags);
-
-	if (info->xmit_cnt && !tty->stopped && !(info->IER & UART_IER_THRI)) {
-		info->IER |= UART_IER_THRI;
-		serial_out(info, UART_ESI_CMD1, ESI_SET_SRV_MASK);
-		serial_out(info, UART_ESI_CMD2, info->IER);
-	}
-
-	spin_unlock_irqrestore(&info->lock, flags);
-	return ret;
-}
-
-static int rs_write_room(struct tty_struct *tty)
-{
-	struct esp_struct *info = tty->driver_data;
-	int	ret;
-	unsigned long flags;
-
-	if (serial_paranoia_check(info, tty->name, "rs_write_room"))
-		return 0;
-
-	spin_lock_irqsave(&info->lock, flags);
-
-	ret = ESP_XMIT_SIZE - info->xmit_cnt - 1;
-	if (ret < 0)
-		ret = 0;
-	spin_unlock_irqrestore(&info->lock, flags);
-	return ret;
-}
-
-static int rs_chars_in_buffer(struct tty_struct *tty)
-{
-	struct esp_struct *info = tty->driver_data;
-
-	if (serial_paranoia_check(info, tty->name, "rs_chars_in_buffer"))
-		return 0;
-	return info->xmit_cnt;
-}
-
-static void rs_flush_buffer(struct tty_struct *tty)
-{
-	struct esp_struct *info = tty->driver_data;
-	unsigned long flags;
-
-	if (serial_paranoia_check(info, tty->name, "rs_flush_buffer"))
-		return;
-	spin_lock_irqsave(&info->lock, flags);
-	info->xmit_cnt = info->xmit_head = info->xmit_tail = 0;
-	spin_unlock_irqrestore(&info->lock, flags);
-	tty_wakeup(tty);
-}
-
-/*
- * ------------------------------------------------------------
- * rs_throttle()
- *
- * This routine is called by the upper-layer tty layer to signal that
- * incoming characters should be throttled.
- * ------------------------------------------------------------
- */
-static void rs_throttle(struct tty_struct *tty)
-{
-	struct esp_struct *info = tty->driver_data;
-	unsigned long flags;
-#ifdef SERIAL_DEBUG_THROTTLE
-	char	buf[64];
-
-	printk("throttle %s: %d....\n", tty_name(tty, buf),
-						tty_chars_in_buffer(tty));
-#endif
-
-	if (serial_paranoia_check(info, tty->name, "rs_throttle"))
-		return;
-
-	spin_lock_irqsave(&info->lock, flags);
-	info->IER &= ~UART_IER_RDI;
-	serial_out(info, UART_ESI_CMD1, ESI_SET_SRV_MASK);
-	serial_out(info, UART_ESI_CMD2, info->IER);
-	serial_out(info, UART_ESI_CMD1, ESI_SET_RX_TIMEOUT);
-	serial_out(info, UART_ESI_CMD2, 0x00);
-	spin_unlock_irqrestore(&info->lock, flags);
-}
-
-static void rs_unthrottle(struct tty_struct *tty)
-{
-	struct esp_struct *info = tty->driver_data;
-	unsigned long flags;
-#ifdef SERIAL_DEBUG_THROTTLE
-	char	buf[64];
-
-	printk(KERN_DEBUG "unthrottle %s: %d....\n", tty_name(tty, buf),
-	       tty_chars_in_buffer(tty));
-#endif
-
-	if (serial_paranoia_check(info, tty->name, "rs_unthrottle"))
-		return;
-
-	spin_lock_irqsave(&info->lock, flags);
-	info->IER |= UART_IER_RDI;
-	serial_out(info, UART_ESI_CMD1, ESI_SET_SRV_MASK);
-	serial_out(info, UART_ESI_CMD2, info->IER);
-	serial_out(info, UART_ESI_CMD1, ESI_SET_RX_TIMEOUT);
-	serial_out(info, UART_ESI_CMD2, info->config.rx_timeout);
-	spin_unlock_irqrestore(&info->lock, flags);
-}
-
-/*
- * ------------------------------------------------------------
- * rs_ioctl() and friends
- * ------------------------------------------------------------
- */
-
-static int get_serial_info(struct esp_struct *info,
-			   struct serial_struct __user *retinfo)
-{
-	struct serial_struct tmp;
-
-	lock_kernel();
-	memset(&tmp, 0, sizeof(tmp));
-	tmp.type = PORT_16550A;
-	tmp.line = info->line;
-	tmp.port = info->io_port;
-	tmp.irq = info->irq;
-	tmp.flags = info->port.flags;
-	tmp.xmit_fifo_size = 1024;
-	tmp.baud_base = BASE_BAUD;
-	tmp.close_delay = info->close_delay;
-	tmp.closing_wait = info->closing_wait;
-	tmp.custom_divisor = info->custom_divisor;
-	tmp.hub6 = 0;
-	unlock_kernel();
-	if (copy_to_user(retinfo, &tmp, sizeof(*retinfo)))
-		return -EFAULT;
-	return 0;
-}
-
-static int get_esp_config(struct esp_struct *info,
-			  struct hayes_esp_config __user *retinfo)
-{
-	struct hayes_esp_config tmp;
-
-	if (!retinfo)
-		return -EFAULT;
-
-	memset(&tmp, 0, sizeof(tmp));
-	lock_kernel();
-	tmp.rx_timeout = info->config.rx_timeout;
-	tmp.rx_trigger = info->config.rx_trigger;
-	tmp.tx_trigger = info->config.tx_trigger;
-	tmp.flow_off = info->config.flow_off;
-	tmp.flow_on = info->config.flow_on;
-	tmp.pio_threshold = info->config.pio_threshold;
-	tmp.dma_channel = (info->stat_flags & ESP_STAT_NEVER_DMA ? 0 : dma);
-	unlock_kernel();
-
-	return copy_to_user(retinfo, &tmp, sizeof(*retinfo)) ? -EFAULT : 0;
-}
-
-static int set_serial_info(struct esp_struct *info,
-			   struct serial_struct __user *new_info)
-{
-	struct serial_struct new_serial;
-	struct esp_struct old_info;
-	unsigned int change_irq;
-	int retval = 0;
-	struct esp_struct *current_async;
-
-	if (copy_from_user(&new_serial, new_info, sizeof(new_serial)))
-		return -EFAULT;
-	old_info = *info;
-
-	if ((new_serial.type != PORT_16550A) ||
-	    (new_serial.hub6) ||
-	    (info->io_port != new_serial.port) ||
-	    (new_serial.baud_base != BASE_BAUD) ||
-	    (new_serial.irq > 15) ||
-	    (new_serial.irq < 2) ||
-	    (new_serial.irq == 6) ||
-	    (new_serial.irq == 8) ||
-	    (new_serial.irq == 13))
-		return -EINVAL;
-
-	change_irq = new_serial.irq != info->irq;
-
-	if (change_irq && (info->line % 8))
-		return -EINVAL;
-
-	if (!capable(CAP_SYS_ADMIN)) {
-		if (change_irq ||
-		    (new_serial.close_delay != info->close_delay) ||
-		    ((new_serial.flags & ~ASYNC_USR_MASK) !=
-		     (info->port.flags & ~ASYNC_USR_MASK)))
-			return -EPERM;
-		info->port.flags = ((info->port.flags & ~ASYNC_USR_MASK) |
-			       (new_serial.flags & ASYNC_USR_MASK));
-		info->custom_divisor = new_serial.custom_divisor;
-	} else {
-		if (new_serial.irq == 2)
-			new_serial.irq = 9;
-
-		if (change_irq) {
-			current_async = ports;
-
-			while (current_async) {
-				if ((current_async->line >= info->line) &&
-				    (current_async->line < (info->line + 8))) {
-					if (current_async == info) {
-						if (current_async->port.count > 1)
-							return -EBUSY;
-					} else if (current_async->port.count)
-						return -EBUSY;
-				}
-
-				current_async = current_async->next_port;
-			}
-		}
-
-		/*
-		 * OK, past this point, all the error checking has been done.
-		 * At this point, we start making changes.....
-		 */
-
-		info->port.flags = ((info->port.flags & ~ASYNC_FLAGS) |
-			       (new_serial.flags & ASYNC_FLAGS));
-		info->custom_divisor = new_serial.custom_divisor;
-		info->close_delay = new_serial.close_delay * HZ/100;
-		info->closing_wait = new_serial.closing_wait * HZ/100;
-
-		if (change_irq) {
-			/*
-			 * We need to shutdown the serial port at the old
-			 * port/irq combination.
-			 */
-			shutdown(info);
-
-			current_async = ports;
-
-			while (current_async) {
-				if ((current_async->line >= info->line) &&
-				    (current_async->line < (info->line + 8)))
-					current_async->irq = new_serial.irq;
-
-				current_async = current_async->next_port;
-			}
-
-			serial_out(info, UART_ESI_CMD1, ESI_SET_ENH_IRQ);
-			if (info->irq == 9)
-				serial_out(info, UART_ESI_CMD2, 0x02);
-			else
-				serial_out(info, UART_ESI_CMD2, info->irq);
-		}
-	}
-
-	if (info->port.flags & ASYNC_INITIALIZED) {
-		if (((old_info.port.flags & ASYNC_SPD_MASK) !=
-		     (info->port.flags & ASYNC_SPD_MASK)) ||
-		    (old_info.custom_divisor != info->custom_divisor)) {
-			if ((info->port.flags & ASYNC_SPD_MASK) == ASYNC_SPD_HI)
-				info->port.tty->alt_speed = 57600;
-			if ((info->port.flags & ASYNC_SPD_MASK) == ASYNC_SPD_VHI)
-				info->port.tty->alt_speed = 115200;
-			if ((info->port.flags & ASYNC_SPD_MASK) == ASYNC_SPD_SHI)
-				info->port.tty->alt_speed = 230400;
-			if ((info->port.flags & ASYNC_SPD_MASK) == ASYNC_SPD_WARP)
-				info->port.tty->alt_speed = 460800;
-			change_speed(info);
-		}
-	} else
-		retval = startup(info);
-
-	return retval;
-}
-
-static int set_esp_config(struct esp_struct *info,
-			  struct hayes_esp_config __user *new_info)
-{
-	struct hayes_esp_config new_config;
-	unsigned int change_dma;
-	int retval = 0;
-	struct esp_struct *current_async;
-	unsigned long flags;
-
-	/* Perhaps a non-sysadmin user should be able to do some of these */
-	/* operations.  I haven't decided yet. */
-
-	if (!capable(CAP_SYS_ADMIN))
-		return -EPERM;
-
-	if (copy_from_user(&new_config, new_info, sizeof(new_config)))
-		return -EFAULT;
-
-	if ((new_config.flow_on >= new_config.flow_off) ||
-	    (new_config.rx_trigger < 1) ||
-	    (new_config.tx_trigger < 1) ||
-	    (new_config.flow_off < 1) ||
-	    (new_config.flow_on < 1) ||
-	    (new_config.rx_trigger > 1023) ||
-	    (new_config.tx_trigger > 1023) ||
-	    (new_config.flow_off > 1023) ||
-	    (new_config.flow_on > 1023) ||
-	    (new_config.pio_threshold < 0) ||
-	    (new_config.pio_threshold > 1024))
-		return -EINVAL;
-
-	if ((new_config.dma_channel != 1) && (new_config.dma_channel != 3))
-		new_config.dma_channel = 0;
-
-	if (info->stat_flags & ESP_STAT_NEVER_DMA)
-		change_dma = new_config.dma_channel;
-	else
-		change_dma = (new_config.dma_channel != dma);
-
-	if (change_dma) {
-		if (new_config.dma_channel) {
-			/* PIO mode to DMA mode transition OR */
-			/* change current DMA channel */
-			current_async = ports;
-
-			while (current_async) {
-				if (current_async == info) {
-					if (current_async->port.count > 1)
-						return -EBUSY;
-				} else if (current_async->port.count)
-					return -EBUSY;
-
-				current_async = current_async->next_port;
-			}
-
-			shutdown(info);
-			dma = new_config.dma_channel;
-			info->stat_flags &= ~ESP_STAT_NEVER_DMA;
-
-			/* all ports must use the same DMA channel */
-
-			spin_lock_irqsave(&info->lock, flags);
-			current_async = ports;
-
-			while (current_async) {
-				esp_basic_init(current_async);
-				current_async = current_async->next_port;
-			}
-			spin_unlock_irqrestore(&info->lock, flags);
-		} else {
-			/* DMA mode to PIO mode only */
-			if (info->port.count > 1)
-				return -EBUSY;
-
-			shutdown(info);
-			spin_lock_irqsave(&info->lock, flags);
-			info->stat_flags |= ESP_STAT_NEVER_DMA;
-			esp_basic_init(info);
-			spin_unlock_irqrestore(&info->lock, flags);
-		}
-	}
-
-	info->config.pio_threshold = new_config.pio_threshold;
-
-	if ((new_config.flow_off != info->config.flow_off) ||
-	    (new_config.flow_on != info->config.flow_on)) {
-		info->config.flow_off = new_config.flow_off;
-		info->config.flow_on = new_config.flow_on;
-
-		spin_lock_irqsave(&info->lock, flags);
-		serial_out(info, UART_ESI_CMD1, ESI_SET_FLOW_LVL);
-		serial_out(info, UART_ESI_CMD2, new_config.flow_off >> 8);
-		serial_out(info, UART_ESI_CMD2, new_config.flow_off);
-		serial_out(info, UART_ESI_CMD2, new_config.flow_on >> 8);
-		serial_out(info, UART_ESI_CMD2, new_config.flow_on);
-		spin_unlock_irqrestore(&info->lock, flags);
-	}
-
-	if ((new_config.rx_trigger != info->config.rx_trigger) ||
-	    (new_config.tx_trigger != info->config.tx_trigger)) {
-		info->config.rx_trigger = new_config.rx_trigger;
-		info->config.tx_trigger = new_config.tx_trigger;
-		spin_lock_irqsave(&info->lock, flags);
-		serial_out(info, UART_ESI_CMD1, ESI_SET_TRIGGER);
-		serial_out(info, UART_ESI_CMD2,
-			   new_config.rx_trigger >> 8);
-		serial_out(info, UART_ESI_CMD2, new_config.rx_trigger);
-		serial_out(info, UART_ESI_CMD2,
-			   new_config.tx_trigger >> 8);
-		serial_out(info, UART_ESI_CMD2, new_config.tx_trigger);
-		spin_unlock_irqrestore(&info->lock, flags);
-	}
-
-	if (new_config.rx_timeout != info->config.rx_timeout) {
-		info->config.rx_timeout = new_config.rx_timeout;
-		spin_lock_irqsave(&info->lock, flags);
-
-		if (info->IER & UART_IER_RDI) {
-			serial_out(info, UART_ESI_CMD1,
-				   ESI_SET_RX_TIMEOUT);
-			serial_out(info, UART_ESI_CMD2,
-				   new_config.rx_timeout);
-		}
-
-		spin_unlock_irqrestore(&info->lock, flags);
-	}
-
-	if (!(info->port.flags & ASYNC_INITIALIZED))
-		retval = startup(info);
-
-	return retval;
-}
-
-/*
- * get_lsr_info - get line status register info
- *
- * Purpose: Let user call ioctl() to get info when the UART physically
- * 	    is emptied.  On bus types like RS485, the transmitter must
- * 	    release the bus after transmitting. This must be done when
- * 	    the transmit shift register is empty, not be done when the
- * 	    transmit holding register is empty.  This functionality
- * 	    allows an RS485 driver to be written in user space.
- */
-static int get_lsr_info(struct esp_struct *info, unsigned int __user *value)
-{
-	unsigned char status;
-	unsigned int result;
-	unsigned long flags;
-
-	spin_lock_irqsave(&info->lock, flags);
-	serial_out(info, UART_ESI_CMD1, ESI_GET_UART_STAT);
-	status = serial_in(info, UART_ESI_STAT1);
-	spin_unlock_irqrestore(&info->lock, flags);
-	result = ((status & UART_LSR_TEMT) ? TIOCSER_TEMT : 0);
-	return put_user(result, value);
-}
-
-
-static int esp_tiocmget(struct tty_struct *tty, struct file *file)
-{
-	struct esp_struct *info = tty->driver_data;
-	unsigned char control, status;
-	unsigned long flags;
-
-	if (serial_paranoia_check(info, tty->name, __func__))
-		return -ENODEV;
-	if (tty->flags & (1 << TTY_IO_ERROR))
-		return -EIO;
-
-	control = info->MCR;
-
-	spin_lock_irqsave(&info->lock, flags);
-	serial_out(info, UART_ESI_CMD1, ESI_GET_UART_STAT);
-	status = serial_in(info, UART_ESI_STAT2);
-	spin_unlock_irqrestore(&info->lock, flags);
-
-	return    ((control & UART_MCR_RTS) ? TIOCM_RTS : 0)
-		| ((control & UART_MCR_DTR) ? TIOCM_DTR : 0)
-		| ((status  & UART_MSR_DCD) ? TIOCM_CAR : 0)
-		| ((status  & UART_MSR_RI) ? TIOCM_RNG : 0)
-		| ((status  & UART_MSR_DSR) ? TIOCM_DSR : 0)
-		| ((status  & UART_MSR_CTS) ? TIOCM_CTS : 0);
-}
-
-static int esp_tiocmset(struct tty_struct *tty, struct file *file,
-			unsigned int set, unsigned int clear)
-{
-	struct esp_struct *info = tty->driver_data;
-	unsigned long flags;
-
-	if (serial_paranoia_check(info, tty->name, __func__))
-		return -ENODEV;
-	if (tty->flags & (1 << TTY_IO_ERROR))
-		return -EIO;
-
-	spin_lock_irqsave(&info->lock, flags);
-
-	if (set & TIOCM_RTS)
-		info->MCR |= UART_MCR_RTS;
-	if (set & TIOCM_DTR)
-		info->MCR |= UART_MCR_DTR;
-
-	if (clear & TIOCM_RTS)
-		info->MCR &= ~UART_MCR_RTS;
-	if (clear & TIOCM_DTR)
-		info->MCR &= ~UART_MCR_DTR;
-
-	serial_out(info, UART_ESI_CMD1, ESI_WRITE_UART);
-	serial_out(info, UART_ESI_CMD2, UART_MCR);
-	serial_out(info, UART_ESI_CMD2, info->MCR);
-
-	spin_unlock_irqrestore(&info->lock, flags);
-	return 0;
-}
-
-/*
- * rs_break() --- routine which turns the break handling on or off
- */
-static int esp_break(struct tty_struct *tty, int break_state)
-{
-	struct esp_struct *info = tty->driver_data;
-	unsigned long flags;
-
-	if (serial_paranoia_check(info, tty->name, "esp_break"))
-		return -EINVAL;
-
-	if (break_state == -1) {
-		spin_lock_irqsave(&info->lock, flags);
-		serial_out(info, UART_ESI_CMD1, ESI_ISSUE_BREAK);
-		serial_out(info, UART_ESI_CMD2, 0x01);
-		spin_unlock_irqrestore(&info->lock, flags);
-
-		/* FIXME - new style wait needed here */
-		interruptible_sleep_on(&info->break_wait);
-	} else {
-		spin_lock_irqsave(&info->lock, flags);
-		serial_out(info, UART_ESI_CMD1, ESI_ISSUE_BREAK);
-		serial_out(info, UART_ESI_CMD2, 0x00);
-		spin_unlock_irqrestore(&info->lock, flags);
-	}
-	return 0;
-}
-
-static int rs_ioctl(struct tty_struct *tty, struct file *file,
-		    unsigned int cmd, unsigned long arg)
-{
-	struct esp_struct *info = tty->driver_data;
-	struct async_icount cprev, cnow;	/* kernel counter temps */
-	struct serial_icounter_struct __user *p_cuser;	/* user space */
-	void __user *argp = (void __user *)arg;
-	unsigned long flags;
-	int ret;
-
-	if (serial_paranoia_check(info, tty->name, "rs_ioctl"))
-		return -ENODEV;
-
-	if ((cmd != TIOCGSERIAL) && (cmd != TIOCSSERIAL) &&
-	    (cmd != TIOCSERCONFIG) && (cmd != TIOCSERGWILD)  &&
-	    (cmd != TIOCSERSWILD) && (cmd != TIOCSERGSTRUCT) &&
-	    (cmd != TIOCMIWAIT) && (cmd != TIOCGICOUNT) &&
-	    (cmd != TIOCGHAYESESP) && (cmd != TIOCSHAYESESP)) {
-		if (tty->flags & (1 << TTY_IO_ERROR))
-		    return -EIO;
-	}
-
-	switch (cmd) {
-	case TIOCGSERIAL:
-		return get_serial_info(info, argp);
-	case TIOCSSERIAL:
-		lock_kernel();
-		ret = set_serial_info(info, argp);
-		unlock_kernel();
-		return ret;
-	case TIOCSERGWILD:
-		return put_user(0L, (unsigned long __user *)argp);
-	case TIOCSERGETLSR: /* Get line status register */
-		return get_lsr_info(info, argp);
-	case TIOCSERSWILD:
-		if (!capable(CAP_SYS_ADMIN))
-			return -EPERM;
-		return 0;
-	/*
-	 * Wait for any of the 4 modem inputs (DCD,RI,DSR,CTS) to change
-	 * - mask passed in arg for lines of interest
-	 *   (use |'ed TIOCM_RNG/DSR/CD/CTS for masking)
-	 * Caller should use TIOCGICOUNT to see which one it was
-	 */
-	case TIOCMIWAIT:
-		spin_lock_irqsave(&info->lock, flags);
-		cprev = info->icount;	/* note the counters on entry */
-		spin_unlock_irqrestore(&info->lock, flags);
-		while (1) {
-			/* FIXME: convert to new style wakeup */
-			interruptible_sleep_on(&info->port.delta_msr_wait);
-			/* see if a signal did it */
-			if (signal_pending(current))
-				return -ERESTARTSYS;
-			spin_lock_irqsave(&info->lock, flags);
-			cnow = info->icount;	/* atomic copy */
-			spin_unlock_irqrestore(&info->lock, flags);
-			if (cnow.rng == cprev.rng &&
-			    cnow.dsr == cprev.dsr &&
-			    cnow.dcd == cprev.dcd &&
-			    cnow.cts == cprev.cts)
-				return -EIO; /* no change => error */
-			if (((arg & TIOCM_RNG) &&
-			     (cnow.rng != cprev.rng)) ||
-			     ((arg & TIOCM_DSR) &&
-			      (cnow.dsr != cprev.dsr)) ||
-			     ((arg & TIOCM_CD) &&
-			      (cnow.dcd != cprev.dcd)) ||
-			     ((arg & TIOCM_CTS) &&
-			      (cnow.cts != cprev.cts))) {
-				return 0;
-			}
-			cprev = cnow;
-		}
-		/* NOTREACHED */
-	/*
-	 * Get counter of input serial line interrupts (DCD,RI,DSR,CTS)
-	 * Return: write counters to the user passed counter struct
-	 * NB: both 1->0 and 0->1 transitions are counted except for
-	 *     RI where only 0->1 is counted.
-	 */
-	case TIOCGICOUNT:
-		spin_lock_irqsave(&info->lock, flags);
-		cnow = info->icount;
-		spin_unlock_irqrestore(&info->lock, flags);
-		p_cuser = argp;
-		if (put_user(cnow.cts, &p_cuser->cts) ||
-		    put_user(cnow.dsr, &p_cuser->dsr) ||
-		    put_user(cnow.rng, &p_cuser->rng) ||
-		    put_user(cnow.dcd, &p_cuser->dcd))
-			return -EFAULT;
-			return 0;
-	case TIOCGHAYESESP:
-		return get_esp_config(info, argp);
-	case TIOCSHAYESESP:
-		lock_kernel();
-		ret = set_esp_config(info, argp);
-		unlock_kernel();
-		return ret;
-	default:
-		return -ENOIOCTLCMD;
-	}
-	return 0;
-}
-
-static void rs_set_termios(struct tty_struct *tty, struct ktermios *old_termios)
-{
-	struct esp_struct *info = tty->driver_data;
-	unsigned long flags;
-
-	change_speed(info);
-
-	spin_lock_irqsave(&info->lock, flags);
-
-	/* Handle transition to B0 status */
-	if ((old_termios->c_cflag & CBAUD) &&
-		!(tty->termios->c_cflag & CBAUD)) {
-		info->MCR &= ~(UART_MCR_DTR|UART_MCR_RTS);
-		serial_out(info, UART_ESI_CMD1, ESI_WRITE_UART);
-		serial_out(info, UART_ESI_CMD2, UART_MCR);
-		serial_out(info, UART_ESI_CMD2, info->MCR);
-	}
-
-	/* Handle transition away from B0 status */
-	if (!(old_termios->c_cflag & CBAUD) &&
-		(tty->termios->c_cflag & CBAUD)) {
-		info->MCR |= (UART_MCR_DTR | UART_MCR_RTS);
-		serial_out(info, UART_ESI_CMD1, ESI_WRITE_UART);
-		serial_out(info, UART_ESI_CMD2, UART_MCR);
-		serial_out(info, UART_ESI_CMD2, info->MCR);
-	}
-
-	spin_unlock_irqrestore(&info->lock, flags);
-
-	/* Handle turning of CRTSCTS */
-	if ((old_termios->c_cflag & CRTSCTS) &&
-	    !(tty->termios->c_cflag & CRTSCTS)) {
-		rs_start(tty);
-	}
-}
-
-/*
- * ------------------------------------------------------------
- * rs_close()
- *
- * This routine is called when the serial port gets closed.  First, we
- * wait for the last remaining data to be sent.  Then, we unlink its
- * async structure from the interrupt chain if necessary, and we free
- * that IRQ if nothing is left in the chain.
- * ------------------------------------------------------------
- */
-static void rs_close(struct tty_struct *tty, struct file *filp)
-{
-	struct esp_struct *info = tty->driver_data;
-	unsigned long flags;
-
-	if (!info || serial_paranoia_check(info, tty->name, "rs_close"))
-		return;
-
-	spin_lock_irqsave(&info->lock, flags);
-
-	if (tty_hung_up_p(filp)) {
-		DBG_CNT("before DEC-hung");
-		goto out;
-	}
-
-#ifdef SERIAL_DEBUG_OPEN
-	printk(KERN_DEBUG "rs_close ttys%d, count = %d\n",
-						info->line, info->port.count);
-#endif
-	if (tty->count == 1 && info->port.count != 1) {
-		/*
-		 * Uh, oh.  tty->count is 1, which means that the tty
-		 * structure will be freed.  Info->count should always
-		 * be one in these conditions.  If it's greater than
-		 * one, we've got real problems, since it means the
-		 * serial port won't be shutdown.
-		 */
-		printk(KERN_DEBUG "rs_close: bad serial port count; tty->count is 1, info->port.count is %d\n", info->port.count);
-		info->port.count = 1;
-	}
-	if (--info->port.count < 0) {
-		printk(KERN_ERR "rs_close: bad serial port count for ttys%d: %d\n",
-		       info->line, info->port.count);
-		info->port.count = 0;
-	}
-	if (info->port.count) {
-		DBG_CNT("before DEC-2");
-		goto out;
-	}
-	info->port.flags |= ASYNC_CLOSING;
-
-	spin_unlock_irqrestore(&info->lock, flags);
-	/*
-	 * Now we wait for the transmit buffer to clear; and we notify
-	 * the line discipline to only process XON/XOFF characters.
-	 */
-	tty->closing = 1;
-	if (info->closing_wait != ASYNC_CLOSING_WAIT_NONE)
-		tty_wait_until_sent(tty, info->closing_wait);
-	/*
-	 * At this point we stop accepting input.  To do this, we
-	 * disable the receive line status interrupts, and tell the
-	 * interrupt driver to stop checking the data ready bit in the
-	 * line status register.
-	 */
-	/* info->IER &= ~UART_IER_RLSI; */
-	info->IER &= ~UART_IER_RDI;
-	info->read_status_mask &= ~UART_LSR_DR;
-	if (info->port.flags & ASYNC_INITIALIZED) {
-
-		spin_lock_irqsave(&info->lock, flags);
-		serial_out(info, UART_ESI_CMD1, ESI_SET_SRV_MASK);
-		serial_out(info, UART_ESI_CMD2, info->IER);
-
-		/* disable receive timeout */
-		serial_out(info, UART_ESI_CMD1, ESI_SET_RX_TIMEOUT);
-		serial_out(info, UART_ESI_CMD2, 0x00);
-
-		spin_unlock_irqrestore(&info->lock, flags);
-
-		/*
-		 * Before we drop DTR, make sure the UART transmitter
-		 * has completely drained; this is especially
-		 * important if there is a transmit FIFO!
-		 */
-		rs_wait_until_sent(tty, info->timeout);
-	}
-	shutdown(info);
-	rs_flush_buffer(tty);
-	tty_ldisc_flush(tty);
-	tty->closing = 0;
-	info->port.tty = NULL;
-
-	if (info->port.blocked_open) {
-		if (info->close_delay)
-			msleep_interruptible(jiffies_to_msecs(info->close_delay));
-		wake_up_interruptible(&info->port.open_wait);
-	}
-	info->port.flags &= ~(ASYNC_NORMAL_ACTIVE|ASYNC_CLOSING);
-	wake_up_interruptible(&info->port.close_wait);
-	return;
-
-out:
-	spin_unlock_irqrestore(&info->lock, flags);
-}
-
-static void rs_wait_until_sent(struct tty_struct *tty, int timeout)
-{
-	struct esp_struct *info = tty->driver_data;
-	unsigned long orig_jiffies, char_time;
-	unsigned long flags;
-
-	if (serial_paranoia_check(info, tty->name, "rs_wait_until_sent"))
-		return;
-
-	orig_jiffies = jiffies;
-	char_time = ((info->timeout - HZ / 50) / 1024) / 5;
-
-	if (!char_time)
-		char_time = 1;
-
-	spin_lock_irqsave(&info->lock, flags);
-	serial_out(info, UART_ESI_CMD1, ESI_NO_COMMAND);
-	serial_out(info, UART_ESI_CMD1, ESI_GET_TX_AVAIL);
-
-	while ((serial_in(info, UART_ESI_STAT1) != 0x03) ||
-		(serial_in(info, UART_ESI_STAT2) != 0xff)) {
-
-		spin_unlock_irqrestore(&info->lock, flags);
-		msleep_interruptible(jiffies_to_msecs(char_time));
-
-		if (signal_pending(current))
-			return;
-
-		if (timeout && time_after(jiffies, orig_jiffies + timeout))
-			return;
-
-		spin_lock_irqsave(&info->lock, flags);
-		serial_out(info, UART_ESI_CMD1, ESI_NO_COMMAND);
-		serial_out(info, UART_ESI_CMD1, ESI_GET_TX_AVAIL);
-	}
-	spin_unlock_irqrestore(&info->lock, flags);
-	set_current_state(TASK_RUNNING);
-}
-
-/*
- * esp_hangup() --- called by tty_hangup() when a hangup is signaled.
- */
-static void esp_hangup(struct tty_struct *tty)
-{
-	struct esp_struct *info = tty->driver_data;
-
-	if (serial_paranoia_check(info, tty->name, "esp_hangup"))
-		return;
-
-	rs_flush_buffer(tty);
-	shutdown(info);
-	info->port.count = 0;
-	info->port.flags &= ~ASYNC_NORMAL_ACTIVE;
-	info->port.tty = NULL;
-	wake_up_interruptible(&info->port.open_wait);
-}
-
-static int esp_carrier_raised(struct tty_port *port)
-{
-	struct esp_struct *info = container_of(port, struct esp_struct, port);
-	serial_out(info, UART_ESI_CMD1, ESI_GET_UART_STAT);
-	if (serial_in(info, UART_ESI_STAT2) & UART_MSR_DCD)
-		return 1;
-	return 0;
-}
-
-/*
- * ------------------------------------------------------------
- * esp_open() and friends
- * ------------------------------------------------------------
- */
-static int block_til_ready(struct tty_struct *tty, struct file *filp,
-			   struct esp_struct *info)
-{
-	DECLARE_WAITQUEUE(wait, current);
-	int		retval;
-	int		do_clocal = 0;
-	unsigned long	flags;
-	int		cd;
-	struct tty_port *port = &info->port;
-
-	/*
-	 * If the device is in the middle of being closed, then block
-	 * until it's done, and then try again.
-	 */
-	if (tty_hung_up_p(filp) ||
-	    (port->flags & ASYNC_CLOSING)) {
-		if (port->flags & ASYNC_CLOSING)
-			interruptible_sleep_on(&port->close_wait);
-#ifdef SERIAL_DO_RESTART
-		if (port->flags & ASYNC_HUP_NOTIFY)
-			return -EAGAIN;
-		else
-			return -ERESTARTSYS;
-#else
-		return -EAGAIN;
-#endif
-	}
-
-	/*
-	 * If non-blocking mode is set, or the port is not enabled,
-	 * then make the check up front and then exit.
-	 */
-	if ((filp->f_flags & O_NONBLOCK) ||
-	    (tty->flags & (1 << TTY_IO_ERROR))) {
-		port->flags |= ASYNC_NORMAL_ACTIVE;
-		return 0;
-	}
-
-	if (tty->termios->c_cflag & CLOCAL)
-		do_clocal = 1;
-
-	/*
-	 * Block waiting for the carrier detect and the line to become
-	 * free (i.e., not in use by the callout).  While we are in
-	 * this loop, port->count is dropped by one, so that
-	 * rs_close() knows when to free things.  We restore it upon
-	 * exit, either normal or abnormal.
-	 */
-	retval = 0;
-	add_wait_queue(&port->open_wait, &wait);
-#ifdef SERIAL_DEBUG_OPEN
-	printk(KERN_DEBUG "block_til_ready before block: ttys%d, count = %d\n",
-	       info->line, port->count);
-#endif
-	spin_lock_irqsave(&info->lock, flags);
-	if (!tty_hung_up_p(filp))
-		port->count--;
-	port->blocked_open++;
-	while (1) {
-		if ((tty->termios->c_cflag & CBAUD)) {
-			unsigned int scratch;
-
-			serial_out(info, UART_ESI_CMD1, ESI_READ_UART);
-			serial_out(info, UART_ESI_CMD2, UART_MCR);
-			scratch = serial_in(info, UART_ESI_STAT1);
-			serial_out(info, UART_ESI_CMD1, ESI_WRITE_UART);
-			serial_out(info, UART_ESI_CMD2, UART_MCR);
-			serial_out(info, UART_ESI_CMD2,
-				scratch | UART_MCR_DTR | UART_MCR_RTS);
-		}
-		set_current_state(TASK_INTERRUPTIBLE);
-		if (tty_hung_up_p(filp) ||
-		    !(port->flags & ASYNC_INITIALIZED)) {
-#ifdef SERIAL_DO_RESTART
-			if (port->flags & ASYNC_HUP_NOTIFY)
-				retval = -EAGAIN;
-			else
-				retval = -ERESTARTSYS;
-#else
-			retval = -EAGAIN;
-#endif
-			break;
-		}
-
-		cd = tty_port_carrier_raised(port);
-
-		if (!(port->flags & ASYNC_CLOSING) &&
-		    (do_clocal))
-			break;
-		if (signal_pending(current)) {
-			retval = -ERESTARTSYS;
-			break;
-		}
-#ifdef SERIAL_DEBUG_OPEN
-		printk(KERN_DEBUG "block_til_ready blocking: ttys%d, count = %d\n",
-		       info->line, port->count);
-#endif
-		spin_unlock_irqrestore(&info->lock, flags);
-		schedule();
-		spin_lock_irqsave(&info->lock, flags);
-	}
-	set_current_state(TASK_RUNNING);
-	remove_wait_queue(&port->open_wait, &wait);
-	if (!tty_hung_up_p(filp))
-		port->count++;
-	port->blocked_open--;
-	spin_unlock_irqrestore(&info->lock, flags);
-#ifdef SERIAL_DEBUG_OPEN
-	printk(KERN_DEBUG "block_til_ready after blocking: ttys%d, count = %d\n",
-	       info->line, port->count);
-#endif
-	if (retval)
-		return retval;
-	port->flags |= ASYNC_NORMAL_ACTIVE;
-	return 0;
-}
-
-/*
- * This routine is called whenever a serial port is opened.  It
- * enables interrupts for a serial port, linking in its async structure into
- * the IRQ chain.   It also performs the serial-specific
- * initialization for the tty structure.
- */
-static int esp_open(struct tty_struct *tty, struct file *filp)
-{
-	struct esp_struct	*info;
-	int 			retval, line;
-	unsigned long		flags;
-
-	line = tty->index;
-	if ((line < 0) || (line >= NR_PORTS))
-		return -ENODEV;
-
-	/* find the port in the chain */
-
-	info = ports;
-
-	while (info && (info->line != line))
-		info = info->next_port;
-
-	if (!info) {
-		serial_paranoia_check(info, tty->name, "esp_open");
-		return -ENODEV;
-	}
-
-#ifdef SERIAL_DEBUG_OPEN
-	printk(KERN_DEBUG "esp_open %s, count = %d\n", tty->name, info->port.count);
-#endif
-	spin_lock_irqsave(&info->lock, flags);
-	info->port.count++;
-	tty->driver_data = info;
-	info->port.tty = tty;
-
-	spin_unlock_irqrestore(&info->lock, flags);
-
-	/*
-	 * Start up serial port
-	 */
-	retval = startup(info);
-	if (retval)
-		return retval;
-
-	retval = block_til_ready(tty, filp, info);
-	if (retval) {
-#ifdef SERIAL_DEBUG_OPEN
-		printk(KERN_DEBUG "esp_open returning after block_til_ready with %d\n",
-		       retval);
-#endif
-		return retval;
-	}
-#ifdef SERIAL_DEBUG_OPEN
-	printk(KERN_DEBUG "esp_open %s successful...", tty->name);
-#endif
-	return 0;
-}
-
-/*
- * ---------------------------------------------------------------------
- * espserial_init() and friends
- *
- * espserial_init() is called at boot-time to initialize the serial driver.
- * ---------------------------------------------------------------------
- */
-
-/*
- * This routine prints out the appropriate serial driver version
- * number, and identifies which options were configured into this
- * driver.
- */
-
-static void __init show_serial_version(void)
-{
-	printk(KERN_INFO "%s version %s (DMA %u)\n",
-		serial_name, serial_version, dma);
-}
-
-/*
- * This routine is called by espserial_init() to initialize a specific serial
- * port.
- */
-static int autoconfig(struct esp_struct *info)
-{
-	int port_detected = 0;
-	unsigned long flags;
-
-	if (!request_region(info->io_port, REGION_SIZE, "esp serial"))
-		return -EIO;
-
-	spin_lock_irqsave(&info->lock, flags);
-	/*
-	 * Check for ESP card
-	 */
-
-	if (serial_in(info, UART_ESI_BASE) == 0xf3) {
-		serial_out(info, UART_ESI_CMD1, 0x00);
-		serial_out(info, UART_ESI_CMD1, 0x01);
-
-		if ((serial_in(info, UART_ESI_STAT2) & 0x70) == 0x20) {
-			port_detected = 1;
-
-			if (!(info->irq)) {
-				serial_out(info, UART_ESI_CMD1, 0x02);
-
-				if (serial_in(info, UART_ESI_STAT1) & 0x01)
-					info->irq = 3;
-				else
-					info->irq = 4;
-			}
-
-
-			/* put card in enhanced mode */
-			/* this prevents access through */
-			/* the "old" IO ports */
-			esp_basic_init(info);
-
-			/* clear out MCR */
-			serial_out(info, UART_ESI_CMD1, ESI_WRITE_UART);
-			serial_out(info, UART_ESI_CMD2, UART_MCR);
-			serial_out(info, UART_ESI_CMD2, 0x00);
-		}
-	}
-	if (!port_detected)
-		release_region(info->io_port, REGION_SIZE);
-
-	spin_unlock_irqrestore(&info->lock, flags);
-	return (port_detected);
-}
-
-static const struct tty_operations esp_ops = {
-	.open = esp_open,
-	.close = rs_close,
-	.write = rs_write,
-	.put_char = rs_put_char,
-	.flush_chars = rs_flush_chars,
-	.write_room = rs_write_room,
-	.chars_in_buffer = rs_chars_in_buffer,
-	.flush_buffer = rs_flush_buffer,
-	.ioctl = rs_ioctl,
-	.throttle = rs_throttle,
-	.unthrottle = rs_unthrottle,
-	.set_termios = rs_set_termios,
-	.stop = rs_stop,
-	.start = rs_start,
-	.hangup = esp_hangup,
-	.break_ctl = esp_break,
-	.wait_until_sent = rs_wait_until_sent,
-	.tiocmget = esp_tiocmget,
-	.tiocmset = esp_tiocmset,
-};
-
-static const struct tty_port_operations esp_port_ops = {
-	.esp_carrier_raised,
-};
-
-/*
- * The serial driver boot-time initialization code!
- */
-static int __init espserial_init(void)
-{
-	int i, offset;
-	struct esp_struct *info;
-	struct esp_struct *last_primary = NULL;
-	int esp[] = { 0x100, 0x140, 0x180, 0x200, 0x240, 0x280, 0x300, 0x380 };
-
-	esp_driver = alloc_tty_driver(NR_PORTS);
-	if (!esp_driver)
-		return -ENOMEM;
-
-	for (i = 0; i < NR_PRIMARY; i++) {
-		if (irq[i] != 0) {
-			if ((irq[i] < 2) || (irq[i] > 15) || (irq[i] == 6) ||
-			    (irq[i] == 8) || (irq[i] == 13))
-				irq[i] = 0;
-			else if (irq[i] == 2)
-				irq[i] = 9;
-		}
-	}
-
-	if ((dma != 1) && (dma != 3))
-		dma = 0;
-
-	if ((rx_trigger < 1) || (rx_trigger > 1023))
-		rx_trigger = 768;
-
-	if ((tx_trigger < 1) || (tx_trigger > 1023))
-		tx_trigger = 768;
-
-	if ((flow_off < 1) || (flow_off > 1023))
-		flow_off = 1016;
-
-	if ((flow_on < 1) || (flow_on > 1023))
-		flow_on = 944;
-
-	if ((rx_timeout < 0) || (rx_timeout > 255))
-		rx_timeout = 128;
-
-	if (flow_on >= flow_off)
-		flow_on = flow_off - 1;
-
-	show_serial_version();
-
-	/* Initialize the tty_driver structure */
-
-	esp_driver->owner = THIS_MODULE;
-	esp_driver->name = "ttyP";
-	esp_driver->major = ESP_IN_MAJOR;
-	esp_driver->minor_start = 0;
-	esp_driver->type = TTY_DRIVER_TYPE_SERIAL;
-	esp_driver->subtype = SERIAL_TYPE_NORMAL;
-	esp_driver->init_termios = tty_std_termios;
-	esp_driver->init_termios.c_cflag =
-		B9600 | CS8 | CREAD | HUPCL | CLOCAL;
-	esp_driver->init_termios.c_ispeed = 9600;
-	esp_driver->init_termios.c_ospeed = 9600;
-	esp_driver->flags = TTY_DRIVER_REAL_RAW;
-	tty_set_operations(esp_driver, &esp_ops);
-	if (tty_register_driver(esp_driver)) {
-		printk(KERN_ERR "Couldn't register esp serial driver");
-		put_tty_driver(esp_driver);
-		return 1;
-	}
-
-	info = kzalloc(sizeof(struct esp_struct), GFP_KERNEL);
-
-	if (!info) {
-		printk(KERN_ERR "Couldn't allocate memory for esp serial device information\n");
-		tty_unregister_driver(esp_driver);
-		put_tty_driver(esp_driver);
-		return 1;
-	}
-
-	spin_lock_init(&info->lock);
-	/* rx_trigger, tx_trigger are needed by autoconfig */
-	info->config.rx_trigger = rx_trigger;
-	info->config.tx_trigger = tx_trigger;
-
-	i = 0;
-	offset = 0;
-
-	do {
-		tty_port_init(&info->port);
-		info->port.ops = &esp_port_ops;
-		info->io_port = esp[i] + offset;
-		info->irq = irq[i];
-		info->line = (i * 8) + (offset / 8);
-
-		if (!autoconfig(info)) {
-			i++;
-			offset = 0;
-			continue;
-		}
-
-		info->custom_divisor = (divisor[i] >> (offset / 2)) & 0xf;
-		info->port.flags = STD_COM_FLAGS;
-		if (info->custom_divisor)
-			info->port.flags |= ASYNC_SPD_CUST;
-		info->magic = ESP_MAGIC;
-		info->close_delay = 5*HZ/10;
-		info->closing_wait = 30*HZ;
-		info->config.rx_timeout = rx_timeout;
-		info->config.flow_on = flow_on;
-		info->config.flow_off = flow_off;
-		info->config.pio_threshold = pio_threshold;
-		info->next_port = ports;
-		init_waitqueue_head(&info->break_wait);
-		ports = info;
-		printk(KERN_INFO "ttyP%d at 0x%04x (irq = %d) is an ESP ",
-			info->line, info->io_port, info->irq);
-
-		if (info->line % 8) {
-			printk("secondary port\n");
-			/* 8 port cards can't do DMA */
-			info->stat_flags |= ESP_STAT_NEVER_DMA;
-
-			if (last_primary)
-				last_primary->stat_flags |= ESP_STAT_NEVER_DMA;
-		} else {
-			printk("primary port\n");
-			last_primary = info;
-			irq[i] = info->irq;
-		}
-
-		if (!dma)
-			info->stat_flags |= ESP_STAT_NEVER_DMA;
-
-		info = kzalloc(sizeof(struct esp_struct), GFP_KERNEL);
-		if (!info) {
-			printk(KERN_ERR "Couldn't allocate memory for esp serial device information\n");
-			/* allow use of the already detected ports */
-			return 0;
-		}
-
-		spin_lock_init(&info->lock);
-		/* rx_trigger, tx_trigger are needed by autoconfig */
-		info->config.rx_trigger = rx_trigger;
-		info->config.tx_trigger = tx_trigger;
-
-		if (offset == 56) {
-			i++;
-			offset = 0;
-		} else {
-			offset += 8;
-		}
-	} while (i < NR_PRIMARY);
-
-	/* free the last port memory allocation */
-	kfree(info);
-
-	return 0;
-}
-
-static void __exit espserial_exit(void)
-{
-	int e1;
-	struct esp_struct *temp_async;
-	struct esp_pio_buffer *pio_buf;
-
-	e1 = tty_unregister_driver(esp_driver);
-	if (e1)
-		printk(KERN_ERR "esp: failed to unregister driver (%d)\n", e1);
-	put_tty_driver(esp_driver);
-
-	while (ports) {
-		if (ports->io_port)
-			release_region(ports->io_port, REGION_SIZE);
-		temp_async = ports->next_port;
-		kfree(ports);
-		ports = temp_async;
-	}
-
-	if (dma_buffer)
-		free_pages((unsigned long)dma_buffer,
-			get_order(DMA_BUFFER_SZ));
-
-	while (free_pio_buf) {
-		pio_buf = free_pio_buf->next;
-		kfree(free_pio_buf);
-		free_pio_buf = pio_buf;
-	}
-}
-
-module_init(espserial_init);
-module_exit(espserial_exit);
diff --git a/drivers/char/generic_nvram.c b/drivers/char/generic_nvram.c
index ef31738c2cbe..fda4181b5e67 100644
--- a/drivers/char/generic_nvram.c
+++ b/drivers/char/generic_nvram.c
@@ -19,7 +19,6 @@
 #include <linux/miscdevice.h>
 #include <linux/fcntl.h>
 #include <linux/init.h>
-#include <linux/smp_lock.h>
 #include <asm/uaccess.h>
 #include <asm/nvram.h>
 #ifdef CONFIG_PPC_PMAC
@@ -32,7 +31,6 @@ static ssize_t nvram_len;
 
 static loff_t nvram_llseek(struct file *file, loff_t offset, int origin)
 {
-	lock_kernel();
 	switch (origin) {
 	case 1:
 		offset += file->f_pos;
@@ -41,12 +39,11 @@ static loff_t nvram_llseek(struct file *file, loff_t offset, int origin)
 		offset += nvram_len;
 		break;
 	}
-	if (offset < 0) {
-		unlock_kernel();
+	if (offset < 0)
 		return -EINVAL;
-	}
+
 	file->f_pos = offset;
-	unlock_kernel();
+
 	return file->f_pos;
 }
 
diff --git a/drivers/char/hvc_console.c b/drivers/char/hvc_console.c
index a632f25f144a..416d3423150d 100644
--- a/drivers/char/hvc_console.c
+++ b/drivers/char/hvc_console.c
@@ -832,6 +832,7 @@ int hvc_remove(struct hvc_struct *hp)
 		tty_hangup(tty);
 	return 0;
 }
+EXPORT_SYMBOL_GPL(hvc_remove);
 
 /* Driver initialization: called as soon as someone uses hvc_alloc(). */
 static int hvc_init(void)
diff --git a/drivers/char/hvc_iucv.c b/drivers/char/hvc_iucv.c
index b8a5d654d3d0..fe62bd0e17b7 100644
--- a/drivers/char/hvc_iucv.c
+++ b/drivers/char/hvc_iucv.c
@@ -931,7 +931,7 @@ static struct hv_ops hvc_iucv_ops = {
 };
 
 /* Suspend / resume device operations */
-static struct dev_pm_ops hvc_iucv_pm_ops = {
+static const struct dev_pm_ops hvc_iucv_pm_ops = {
 	.freeze	  = hvc_iucv_pm_freeze,
 	.thaw	  = hvc_iucv_pm_restore_thaw,
 	.restore  = hvc_iucv_pm_restore_thaw,
diff --git a/drivers/char/hvc_xen.c b/drivers/char/hvc_xen.c
index a6ee32b599a8..b1a71638c772 100644
--- a/drivers/char/hvc_xen.c
+++ b/drivers/char/hvc_xen.c
@@ -25,6 +25,8 @@
 #include <linux/types.h>
 
 #include <asm/xen/hypervisor.h>
+
+#include <xen/xen.h>
 #include <xen/page.h>
 #include <xen/events.h>
 #include <xen/interface/io/console.h>
diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c
index 1573aebd54b5..3d9c61e5acbf 100644
--- a/drivers/char/hw_random/core.c
+++ b/drivers/char/hw_random/core.c
@@ -52,7 +52,9 @@
 static struct hwrng *current_rng;
 static LIST_HEAD(rng_list);
 static DEFINE_MUTEX(rng_mutex);
-
+static int data_avail;
+static u8 rng_buffer[SMP_CACHE_BYTES < 32 ? 32 : SMP_CACHE_BYTES]
+	__cacheline_aligned;
 
 static inline int hwrng_init(struct hwrng *rng)
 {
@@ -67,19 +69,6 @@ static inline void hwrng_cleanup(struct hwrng *rng)
 		rng->cleanup(rng);
 }
 
-static inline int hwrng_data_present(struct hwrng *rng, int wait)
-{
-	if (!rng->data_present)
-		return 1;
-	return rng->data_present(rng, wait);
-}
-
-static inline int hwrng_data_read(struct hwrng *rng, u32 *data)
-{
-	return rng->data_read(rng, data);
-}
-
-
 static int rng_dev_open(struct inode *inode, struct file *filp)
 {
 	/* enforce read-only access to this chrdev */
@@ -87,60 +76,93 @@ static int rng_dev_open(struct inode *inode, struct file *filp)
 		return -EINVAL;
 	if (filp->f_mode & FMODE_WRITE)
 		return -EINVAL;
-	cycle_kernel_lock();
+	return 0;
+}
+
+static inline int rng_get_data(struct hwrng *rng, u8 *buffer, size_t size,
+			int wait) {
+	int present;
+
+	if (rng->read)
+		return rng->read(rng, (void *)buffer, size, wait);
+
+	if (rng->data_present)
+		present = rng->data_present(rng, wait);
+	else
+		present = 1;
+
+	if (present)
+		return rng->data_read(rng, (u32 *)buffer);
+
 	return 0;
 }
 
 static ssize_t rng_dev_read(struct file *filp, char __user *buf,
 			    size_t size, loff_t *offp)
 {
-	u32 data;
 	ssize_t ret = 0;
 	int err = 0;
-	int bytes_read;
+	int bytes_read, len;
 
 	while (size) {
-		err = -ERESTARTSYS;
-		if (mutex_lock_interruptible(&rng_mutex))
+		if (mutex_lock_interruptible(&rng_mutex)) {
+			err = -ERESTARTSYS;
 			goto out;
+		}
+
 		if (!current_rng) {
-			mutex_unlock(&rng_mutex);
 			err = -ENODEV;
-			goto out;
+			goto out_unlock;
 		}
 
-		bytes_read = 0;
-		if (hwrng_data_present(current_rng,
-				       !(filp->f_flags & O_NONBLOCK)))
-			bytes_read = hwrng_data_read(current_rng, &data);
-		mutex_unlock(&rng_mutex);
-
-		err = -EAGAIN;
-		if (!bytes_read && (filp->f_flags & O_NONBLOCK))
-			goto out;
-		if (bytes_read < 0) {
-			err = bytes_read;
-			goto out;
+		if (!data_avail) {
+			bytes_read = rng_get_data(current_rng, rng_buffer,
+				sizeof(rng_buffer),
+				!(filp->f_flags & O_NONBLOCK));
+			if (bytes_read < 0) {
+				err = bytes_read;
+				goto out_unlock;
+			}
+			data_avail = bytes_read;
 		}
 
-		err = -EFAULT;
-		while (bytes_read && size) {
-			if (put_user((u8)data, buf++))
-				goto out;
-			size--;
-			ret++;
-			bytes_read--;
-			data >>= 8;
+		if (!data_avail) {
+			if (filp->f_flags & O_NONBLOCK) {
+				err = -EAGAIN;
+				goto out_unlock;
+			}
+		} else {
+			len = data_avail;
+			if (len > size)
+				len = size;
+
+			data_avail -= len;
+
+			if (copy_to_user(buf + ret, rng_buffer + data_avail,
+								len)) {
+				err = -EFAULT;
+				goto out_unlock;
+			}
+
+			size -= len;
+			ret += len;
 		}
 
+		mutex_unlock(&rng_mutex);
+
 		if (need_resched())
 			schedule_timeout_interruptible(1);
-		err = -ERESTARTSYS;
-		if (signal_pending(current))
+
+		if (signal_pending(current)) {
+			err = -ERESTARTSYS;
 			goto out;
+		}
 	}
 out:
 	return ret ? : err;
+out_unlock:
+	mutex_unlock(&rng_mutex);
+	goto out;
 }
 
 
@@ -280,7 +302,7 @@ int hwrng_register(struct hwrng *rng)
 	struct hwrng *old_rng, *tmp;
 
 	if (rng->name == NULL ||
-	    rng->data_read == NULL)
+	    (rng->data_read == NULL && rng->read == NULL))
 		goto out;
 
 	mutex_lock(&rng_mutex);
diff --git a/drivers/char/hw_random/virtio-rng.c b/drivers/char/hw_random/virtio-rng.c
index 915157fcff98..64fe0a793efd 100644
--- a/drivers/char/hw_random/virtio-rng.c
+++ b/drivers/char/hw_random/virtio-rng.c
@@ -16,6 +16,7 @@
  *  along with this program; if not, write to the Free Software
  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301 USA
  */
+
 #include <linux/err.h>
 #include <linux/hw_random.h>
 #include <linux/scatterlist.h>
@@ -23,78 +24,64 @@
 #include <linux/virtio.h>
 #include <linux/virtio_rng.h>
 
-/* The host will fill any buffer we give it with sweet, sweet randomness.  We
- * give it 64 bytes at a time, and the hwrng framework takes it 4 bytes at a
- * time. */
-#define RANDOM_DATA_SIZE 64
-
 static struct virtqueue *vq;
-static u32 *random_data;
-static unsigned int data_left;
+static unsigned int data_avail;
 static DECLARE_COMPLETION(have_data);
+static bool busy;
 
 static void random_recv_done(struct virtqueue *vq)
 {
-	unsigned int len;
-
 	/* We can get spurious callbacks, e.g. shared IRQs + virtio_pci. */
-	if (!vq->vq_ops->get_buf(vq, &len))
+	if (!vq->vq_ops->get_buf(vq, &data_avail))
 		return;
 
-	data_left += len;
 	complete(&have_data);
 }
 
-static void register_buffer(void)
+/* The host will fill any buffer we give it with sweet, sweet randomness. */
+static void register_buffer(u8 *buf, size_t size)
 {
 	struct scatterlist sg;
 
-	sg_init_one(&sg, random_data+data_left, RANDOM_DATA_SIZE-data_left);
+	sg_init_one(&sg, buf, size);
+
 	/* There should always be room for one buffer. */
-	if (vq->vq_ops->add_buf(vq, &sg, 0, 1, random_data) < 0)
+	if (vq->vq_ops->add_buf(vq, &sg, 0, 1, buf) < 0)
 		BUG();
+
 	vq->vq_ops->kick(vq);
 }
 
-/* At least we don't udelay() in a loop like some other drivers. */
-static int virtio_data_present(struct hwrng *rng, int wait)
+static int virtio_read(struct hwrng *rng, void *buf, size_t size, bool wait)
 {
-	if (data_left >= sizeof(u32))
-		return 1;
 
-again:
+	if (!busy) {
+		busy = true;
+		init_completion(&have_data);
+		register_buffer(buf, size);
+	}
+
 	if (!wait)
 		return 0;
 
 	wait_for_completion(&have_data);
 
-	/* Not enough?  Re-register. */
-	if (unlikely(data_left < sizeof(u32))) {
-		register_buffer();
-		goto again;
-	}
+	busy = false;
 
-	return 1;
+	return data_avail;
 }
 
-/* virtio_data_present() must have succeeded before this is called. */
-static int virtio_data_read(struct hwrng *rng, u32 *data)
+static void virtio_cleanup(struct hwrng *rng)
 {
-	BUG_ON(data_left < sizeof(u32));
-	data_left -= sizeof(u32);
-	*data = random_data[data_left / 4];
-
-	if (data_left < sizeof(u32)) {
-		init_completion(&have_data);
-		register_buffer();
-	}
-	return sizeof(*data);
+	if (busy)
+		wait_for_completion(&have_data);
 }
 
+
 static struct hwrng virtio_hwrng = {
-	.name = "virtio",
-	.data_present = virtio_data_present,
-	.data_read = virtio_data_read,
+	.name		= "virtio",
+	.cleanup	= virtio_cleanup,
+	.read		= virtio_read,
 };
 
 static int virtrng_probe(struct virtio_device *vdev)
@@ -112,7 +99,6 @@ static int virtrng_probe(struct virtio_device *vdev)
 		return err;
 	}
 
-	register_buffer();
 	return 0;
 }
 
@@ -128,7 +114,7 @@ static struct virtio_device_id id_table[] = {
 	{ 0 },
 };
 
-static struct virtio_driver virtio_rng = {
+static struct virtio_driver virtio_rng_driver = {
 	.driver.name =	KBUILD_MODNAME,
 	.driver.owner =	THIS_MODULE,
 	.id_table =	id_table,
@@ -138,22 +124,12 @@ static struct virtio_driver virtio_rng = {
 
 static int __init init(void)
 {
-	int err;
-
-	random_data = kmalloc(RANDOM_DATA_SIZE, GFP_KERNEL);
-	if (!random_data)
-		return -ENOMEM;
-
-	err = register_virtio_driver(&virtio_rng);
-	if (err)
-		kfree(random_data);
-	return err;
+	return register_virtio_driver(&virtio_rng_driver);
 }
 
 static void __exit fini(void)
 {
-	kfree(random_data);
-	unregister_virtio_driver(&virtio_rng);
+	unregister_virtio_driver(&virtio_rng_driver);
 }
 module_init(init);
 module_exit(fini);
diff --git a/drivers/char/ipmi/ipmi_kcs_sm.c b/drivers/char/ipmi/ipmi_kcs_sm.c
index 80704875794c..cf82fedae099 100644
--- a/drivers/char/ipmi/ipmi_kcs_sm.c
+++ b/drivers/char/ipmi/ipmi_kcs_sm.c
@@ -370,7 +370,7 @@ static enum si_sm_result kcs_event(struct si_sm_data *kcs, long time)
 			return SI_SM_IDLE;
 
 	case KCS_START_OP:
-		if (state != KCS_IDLE) {
+		if (state != KCS_IDLE_STATE) {
 			start_error_recovery(kcs,
 					     "State machine not idle at start");
 			break;
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index d2e698096ace..176f1751237f 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -64,6 +64,7 @@
 #include <linux/dmi.h>
 #include <linux/string.h>
 #include <linux/ctype.h>
+#include <linux/pnp.h>
 
 #ifdef CONFIG_PPC_OF
 #include <linux/of_device.h>
@@ -1919,7 +1920,7 @@ struct SPMITable {
 	s8      spmi_id[1]; /* A '\0' terminated array starts here. */
 };
 
-static __devinit int try_init_acpi(struct SPMITable *spmi)
+static __devinit int try_init_spmi(struct SPMITable *spmi)
 {
 	struct smi_info  *info;
 	u8 		 addr_space;
@@ -1940,7 +1941,7 @@ static __devinit int try_init_acpi(struct SPMITable *spmi)
 		return -ENOMEM;
 	}
 
-	info->addr_source = "ACPI";
+	info->addr_source = "SPMI";
 
 	/* Figure out the interface type. */
 	switch (spmi->InterfaceType) {
@@ -2002,7 +2003,7 @@ static __devinit int try_init_acpi(struct SPMITable *spmi)
 	return 0;
 }
 
-static __devinit void acpi_find_bmc(void)
+static __devinit void spmi_find_bmc(void)
 {
 	acpi_status      status;
 	struct SPMITable *spmi;
@@ -2020,9 +2021,106 @@ static __devinit void acpi_find_bmc(void)
 		if (status != AE_OK)
 			return;
 
-		try_init_acpi(spmi);
+		try_init_spmi(spmi);
 	}
 }
+
+static int __devinit ipmi_pnp_probe(struct pnp_dev *dev,
+				    const struct pnp_device_id *dev_id)
+{
+	struct acpi_device *acpi_dev;
+	struct smi_info *info;
+	acpi_handle handle;
+	acpi_status status;
+	unsigned long long tmp;
+
+	acpi_dev = pnp_acpi_device(dev);
+	if (!acpi_dev)
+		return -ENODEV;
+
+	info = kzalloc(sizeof(*info), GFP_KERNEL);
+	if (!info)
+		return -ENOMEM;
+
+	info->addr_source = "ACPI";
+
+	handle = acpi_dev->handle;
+
+	/* _IFT tells us the interface type: KCS, BT, etc */
+	status = acpi_evaluate_integer(handle, "_IFT", NULL, &tmp);
+	if (ACPI_FAILURE(status))
+		goto err_free;
+
+	switch (tmp) {
+	case 1:
+		info->si_type = SI_KCS;
+		break;
+	case 2:
+		info->si_type = SI_SMIC;
+		break;
+	case 3:
+		info->si_type = SI_BT;
+		break;
+	default:
+		dev_info(&dev->dev, "unknown interface type %lld\n", tmp);
+		goto err_free;
+	}
+
+	if (pnp_port_valid(dev, 0)) {
+		info->io_setup = port_setup;
+		info->io.addr_type = IPMI_IO_ADDR_SPACE;
+		info->io.addr_data = pnp_port_start(dev, 0);
+	} else if (pnp_mem_valid(dev, 0)) {
+		info->io_setup = mem_setup;
+		info->io.addr_type = IPMI_MEM_ADDR_SPACE;
+		info->io.addr_data = pnp_mem_start(dev, 0);
+	} else {
+		dev_err(&dev->dev, "no I/O or memory address\n");
+		goto err_free;
+	}
+
+	info->io.regspacing = DEFAULT_REGSPACING;
+	info->io.regsize = DEFAULT_REGSPACING;
+	info->io.regshift = 0;
+
+	/* If _GPE exists, use it; otherwise use standard interrupts */
+	status = acpi_evaluate_integer(handle, "_GPE", NULL, &tmp);
+	if (ACPI_SUCCESS(status)) {
+		info->irq = tmp;
+		info->irq_setup = acpi_gpe_irq_setup;
+	} else if (pnp_irq_valid(dev, 0)) {
+		info->irq = pnp_irq(dev, 0);
+		info->irq_setup = std_irq_setup;
+	}
+
+	info->dev = &acpi_dev->dev;
+	pnp_set_drvdata(dev, info);
+
+	return try_smi_init(info);
+
+err_free:
+	kfree(info);
+	return -EINVAL;
+}
+
+static void __devexit ipmi_pnp_remove(struct pnp_dev *dev)
+{
+	struct smi_info *info = pnp_get_drvdata(dev);
+
+	cleanup_one_si(info);
+}
+
+static const struct pnp_device_id pnp_dev_table[] = {
+	{"IPI0001", 0},
+	{"", 0},
+};
+
+static struct pnp_driver ipmi_pnp_driver = {
+	.name		= DEVICE_NAME,
+	.probe		= ipmi_pnp_probe,
+	.remove		= __devexit_p(ipmi_pnp_remove),
+	.id_table	= pnp_dev_table,
+};
 #endif
 
 #ifdef CONFIG_DMI
@@ -2202,7 +2300,6 @@ static int __devinit ipmi_pci_probe(struct pci_dev *pdev,
 	int rv;
 	int class_type = pdev->class & PCI_ERMC_CLASSCODE_TYPE_MASK;
 	struct smi_info *info;
-	int first_reg_offset = 0;
 
 	info = kzalloc(sizeof(*info), GFP_KERNEL);
 	if (!info)
@@ -2241,9 +2338,6 @@ static int __devinit ipmi_pci_probe(struct pci_dev *pdev,
 	info->addr_source_cleanup = ipmi_pci_cleanup;
 	info->addr_source_data = pdev;
 
-	if (pdev->subsystem_vendor == PCI_HP_VENDOR_ID)
-		first_reg_offset = 1;
-
 	if (pci_resource_flags(pdev, 0) & IORESOURCE_IO) {
 		info->io_setup = port_setup;
 		info->io.addr_type = IPMI_IO_ADDR_SPACE;
@@ -3108,7 +3202,10 @@ static __devinit int init_ipmi_si(void)
 #endif
 
 #ifdef CONFIG_ACPI
-	acpi_find_bmc();
+	spmi_find_bmc();
+#endif
+#ifdef CONFIG_ACPI
+	pnp_register_driver(&ipmi_pnp_driver);
 #endif
 
 #ifdef CONFIG_PCI
@@ -3233,6 +3330,9 @@ static __exit void cleanup_ipmi_si(void)
 #ifdef CONFIG_PCI
 	pci_unregister_driver(&ipmi_pci_driver);
 #endif
+#ifdef CONFIG_ACPI
+	pnp_unregister_driver(&ipmi_pnp_driver);
+#endif
 
 #ifdef CONFIG_PPC_OF
 	of_unregister_platform_driver(&ipmi_of_platform_driver);
diff --git a/drivers/char/isicom.c b/drivers/char/isicom.c
index 426bfdd7f3e0..300d5bd6cd06 100644
--- a/drivers/char/isicom.c
+++ b/drivers/char/isicom.c
@@ -793,35 +793,30 @@ static inline void isicom_setup_board(struct isi_board *bp)
 {
 	int channel;
 	struct isi_port *port;
-	unsigned long flags;
 
-	spin_lock_irqsave(&bp->card_lock, flags);
-	if (bp->status & BOARD_ACTIVE) {
-		spin_unlock_irqrestore(&bp->card_lock, flags);
-		return;
+	bp->count++;
+	if (!(bp->status & BOARD_INIT)) {
+		port = bp->ports;
+		for (channel = 0; channel < bp->port_count; channel++, port++)
+			drop_dtr_rts(port);
 	}
-	port = bp->ports;
-	bp->status |= BOARD_ACTIVE;
-	for (channel = 0; channel < bp->port_count; channel++, port++)
-		drop_dtr_rts(port);
-	spin_unlock_irqrestore(&bp->card_lock, flags);
+	bp->status |= BOARD_ACTIVE | BOARD_INIT;
 }
 
-static int isicom_setup_port(struct tty_struct *tty)
+/* Activate and thus setup board are protected from races against shutdown
+   by the tty_port mutex */
+
+static int isicom_activate(struct tty_port *tport, struct tty_struct *tty)
 {
-	struct isi_port *port = tty->driver_data;
+	struct isi_port *port = container_of(tport, struct isi_port, port);
 	struct isi_board *card = port->card;
 	unsigned long flags;
 
-	if (port->port.flags & ASYNC_INITIALIZED)
-		return 0;
-	if (tty_port_alloc_xmit_buf(&port->port) < 0)
+	if (tty_port_alloc_xmit_buf(tport) < 0)
 		return -ENOMEM;
 
 	spin_lock_irqsave(&card->card_lock, flags);
-	clear_bit(TTY_IO_ERROR, &tty->flags);
-	if (port->port.count == 1)
-		card->count++;
+	isicom_setup_board(card);
 
 	port->xmit_cnt = port->xmit_head = port->xmit_tail = 0;
 
@@ -832,9 +827,7 @@ static int isicom_setup_port(struct tty_struct *tty)
 		outw(((ISICOM_KILLTX | ISICOM_KILLRX) << 8) | 0x06, card->base);
 		InterruptTheCard(card->base);
 	}
-
 	isicom_config_port(tty);
-	port->port.flags |= ASYNC_INITIALIZED;
 	spin_unlock_irqrestore(&card->card_lock, flags);
 
 	return 0;
@@ -871,85 +864,37 @@ static struct tty_port *isicom_find_port(struct tty_struct *tty)
 
 	return &port->port;
 }
-	
+
 static int isicom_open(struct tty_struct *tty, struct file *filp)
 {
 	struct isi_port *port;
 	struct isi_board *card;
 	struct tty_port *tport;
-	int error = 0;
 
 	tport = isicom_find_port(tty);
 	if (tport == NULL)
 		return -ENODEV;
 	port = container_of(tport, struct isi_port, port);
 	card = &isi_card[BOARD(tty->index)];
-	isicom_setup_board(card);
 
-	/* FIXME: locking on port.count etc */
-	port->port.count++;
-	tty->driver_data = port;
-	tty_port_tty_set(&port->port, tty);
-	/* FIXME: Locking on Initialized flag */
-	if (!test_bit(ASYNCB_INITIALIZED, &tport->flags))
-		error = isicom_setup_port(tty);
-	if (error == 0)
-		error = tty_port_block_til_ready(&port->port, tty, filp);
-	return error;
+	return tty_port_open(tport, tty, filp);
 }
 
 /* close et all */
 
-static inline void isicom_shutdown_board(struct isi_board *bp)
-{
-	if (bp->status & BOARD_ACTIVE)
-		bp->status &= ~BOARD_ACTIVE;
-}
-
 /* card->lock HAS to be held */
 static void isicom_shutdown_port(struct isi_port *port)
 {
 	struct isi_board *card = port->card;
-	struct tty_struct *tty;
-
-	tty = tty_port_tty_get(&port->port);
-
-	if (!(port->port.flags & ASYNC_INITIALIZED)) {
-		tty_kref_put(tty);
-		return;
-	}
-
-	tty_port_free_xmit_buf(&port->port);
-	port->port.flags &= ~ASYNC_INITIALIZED;
-	/* 3rd October 2000 : Vinayak P Risbud */
-	tty_port_tty_set(&port->port, NULL);
-
-	/*Fix done by Anil .S on 30-04-2001
-	remote login through isi port has dtr toggle problem
-	due to which the carrier drops before the password prompt
-	appears on the remote end. Now we drop the dtr only if the
-	HUPCL(Hangup on close) flag is set for the tty*/
-
-	if (C_HUPCL(tty))
-		/* drop dtr on this port */
-		drop_dtr(port);
-
-	/* any other port uninits  */
-	if (tty)
-		set_bit(TTY_IO_ERROR, &tty->flags);
 
 	if (--card->count < 0) {
 		pr_dbg("isicom_shutdown_port: bad board(0x%lx) count %d.\n",
 			card->base, card->count);
 		card->count = 0;
 	}
-
-	/* last port was closed, shutdown that boad too */
-	if (C_HUPCL(tty)) {
-		if (!card->count)
-			isicom_shutdown_board(card);
-	}
-	tty_kref_put(tty);
+	/* last port was closed, shutdown that board too */
+	if (!card->count)
+		card->status &= BOARD_ACTIVE;
 }
 
 static void isicom_flush_buffer(struct tty_struct *tty)
@@ -968,7 +913,7 @@ static void isicom_flush_buffer(struct tty_struct *tty)
 	tty_wakeup(tty);
 }
 
-static void isicom_close_port(struct tty_port *port)
+static void isicom_shutdown(struct tty_port *port)
 {
 	struct isi_port *ip = container_of(port, struct isi_port, port);
 	struct isi_board *card = ip->card;
@@ -977,12 +922,11 @@ static void isicom_close_port(struct tty_port *port)
 	/* indicate to the card that no more data can be received
 	   on this port */
 	spin_lock_irqsave(&card->card_lock, flags);
-	if (port->flags & ASYNC_INITIALIZED) {
-		card->port_status &= ~(1 << ip->channel);
-		outw(card->port_status, card->base + 0x02);
-	}
+	card->port_status &= ~(1 << ip->channel);
+	outw(card->port_status, card->base + 0x02);
 	isicom_shutdown_port(ip);
 	spin_unlock_irqrestore(&card->card_lock, flags);
+	tty_port_free_xmit_buf(port);
 }
 
 static void isicom_close(struct tty_struct *tty, struct file *filp)
@@ -991,12 +935,7 @@ static void isicom_close(struct tty_struct *tty, struct file *filp)
 	struct tty_port *port = &ip->port;
 	if (isicom_paranoia_check(ip, tty->name, "isicom_close"))
 		return;
-
-	if (tty_port_close_start(port, tty, filp) == 0)
-		return;
-	isicom_close_port(port);
-	isicom_flush_buffer(tty);
-	tty_port_close_end(port, tty);
+	tty_port_close(port, tty, filp);
 }
 
 /* write et all */
@@ -1326,15 +1265,9 @@ static void isicom_start(struct tty_struct *tty)
 static void isicom_hangup(struct tty_struct *tty)
 {
 	struct isi_port *port = tty->driver_data;
-	unsigned long flags;
 
 	if (isicom_paranoia_check(port, tty->name, "isicom_hangup"))
 		return;
-
-	spin_lock_irqsave(&port->card->card_lock, flags);
-	isicom_shutdown_port(port);
-	spin_unlock_irqrestore(&port->card->card_lock, flags);
-
 	tty_port_hangup(&port->port);
 }
 
@@ -1367,6 +1300,8 @@ static const struct tty_operations isicom_ops = {
 static const struct tty_port_operations isicom_port_ops = {
 	.carrier_raised		= isicom_carrier_raised,
 	.dtr_rts		= isicom_dtr_rts,
+	.activate		= isicom_activate,
+	.shutdown		= isicom_shutdown,
 };
 
 static int __devinit reset_card(struct pci_dev *pdev,
diff --git a/drivers/char/istallion.c b/drivers/char/istallion.c
index 402838f4083e..4cd6c527ee41 100644
--- a/drivers/char/istallion.c
+++ b/drivers/char/istallion.c
@@ -213,7 +213,6 @@ static int		stli_shared;
  *	with the slave. Most of them need to be updated atomically, so always
  *	use the bit setting operations (unless protected by cli/sti).
  */
-#define	ST_INITIALIZING	1
 #define	ST_OPENING	2
 #define	ST_CLOSING	3
 #define	ST_CMDING	4
@@ -621,7 +620,7 @@ static int	stli_brdinit(struct stlibrd *brdp);
 static int	stli_startbrd(struct stlibrd *brdp);
 static ssize_t	stli_memread(struct file *fp, char __user *buf, size_t count, loff_t *offp);
 static ssize_t	stli_memwrite(struct file *fp, const char __user *buf, size_t count, loff_t *offp);
-static int	stli_memioctl(struct inode *ip, struct file *fp, unsigned int cmd, unsigned long arg);
+static long	stli_memioctl(struct file *fp, unsigned int cmd, unsigned long arg);
 static void	stli_brdpoll(struct stlibrd *brdp, cdkhdr_t __iomem *hdrp);
 static void	stli_poll(unsigned long arg);
 static int	stli_hostcmd(struct stlibrd *brdp, struct stliport *portp);
@@ -704,7 +703,7 @@ static const struct file_operations	stli_fsiomem = {
 	.owner		= THIS_MODULE,
 	.read		= stli_memread,
 	.write		= stli_memwrite,
-	.ioctl		= stli_memioctl,
+	.unlocked_ioctl	= stli_memioctl,
 };
 
 /*****************************************************************************/
@@ -783,13 +782,32 @@ static int stli_parsebrd(struct stlconf *confp, char **argp)
 
 /*****************************************************************************/
 
+/*
+ *	On the first open of the device setup the port hardware, and
+ *	initialize the per port data structure. Since initializing the port
+ *	requires several commands to the board we will need to wait for any
+ *	other open that is already initializing the port.
+ *
+ *	Locking: protected by the port mutex.
+ */
+
+static int stli_activate(struct tty_port *port, struct tty_struct *tty)
+{
+	struct stliport *portp = container_of(port, struct stliport, port);
+	struct stlibrd *brdp = stli_brds[portp->brdnr];
+	int rc;
+
+	if ((rc = stli_initopen(tty, brdp, portp)) >= 0)
+		clear_bit(TTY_IO_ERROR, &tty->flags);
+	wake_up_interruptible(&portp->raw_wait);
+	return rc;
+}
+
 static int stli_open(struct tty_struct *tty, struct file *filp)
 {
 	struct stlibrd *brdp;
 	struct stliport *portp;
-	struct tty_port *port;
 	unsigned int minordev, brdnr, portnr;
-	int rc;
 
 	minordev = tty->index;
 	brdnr = MINOR2BRD(minordev);
@@ -809,95 +827,56 @@ static int stli_open(struct tty_struct *tty, struct file *filp)
 		return -ENODEV;
 	if (portp->devnr < 1)
 		return -ENODEV;
-	port = &portp->port;
-
-/*
- *	On the first open of the device setup the port hardware, and
- *	initialize the per port data structure. Since initializing the port
- *	requires several commands to the board we will need to wait for any
- *	other open that is already initializing the port.
- *
- *	Review - locking
- */
-	tty_port_tty_set(port, tty);
-	tty->driver_data = portp;
-	port->count++;
-
-	wait_event_interruptible(portp->raw_wait,
-			!test_bit(ST_INITIALIZING, &portp->state));
-	if (signal_pending(current))
-		return -ERESTARTSYS;
-
-	if ((portp->port.flags & ASYNC_INITIALIZED) == 0) {
-		set_bit(ST_INITIALIZING, &portp->state);
-		if ((rc = stli_initopen(tty, brdp, portp)) >= 0) {
-			/* Locking */
-			port->flags |= ASYNC_INITIALIZED;
-			clear_bit(TTY_IO_ERROR, &tty->flags);
-		}
-		clear_bit(ST_INITIALIZING, &portp->state);
-		wake_up_interruptible(&portp->raw_wait);
-		if (rc < 0)
-			return rc;
-	}
-	return tty_port_block_til_ready(&portp->port, tty, filp);
+	return tty_port_open(&portp->port, tty, filp);
 }
 
+
 /*****************************************************************************/
 
-static void stli_close(struct tty_struct *tty, struct file *filp)
+static void stli_shutdown(struct tty_port *port)
 {
 	struct stlibrd *brdp;
-	struct stliport *portp;
-	struct tty_port *port;
+	unsigned long ftype;
 	unsigned long flags;
+	struct stliport *portp = container_of(port, struct stliport, port);
 
-	portp = tty->driver_data;
-	if (portp == NULL)
+	if (portp->brdnr >= stli_nrbrds)
 		return;
-	port = &portp->port;
-
-	if (tty_port_close_start(port, tty, filp) == 0)
+	brdp = stli_brds[portp->brdnr];
+	if (brdp == NULL)
 		return;
 
-/*
- *	May want to wait for data to drain before closing. The BUSY flag
- *	keeps track of whether we are still transmitting or not. It is
- *	updated by messages from the slave - indicating when all chars
- *	really have drained.
- */
- 	spin_lock_irqsave(&stli_lock, flags);
-	if (tty == stli_txcooktty)
-		stli_flushchars(tty);
-	spin_unlock_irqrestore(&stli_lock, flags);
-
-	/* We end up doing this twice for the moment. This needs looking at
-	   eventually. Note we still use portp->closing_wait as a result */
-	if (portp->closing_wait != ASYNC_CLOSING_WAIT_NONE)
-		tty_wait_until_sent(tty, portp->closing_wait);
+	/*
+	 *	May want to wait for data to drain before closing. The BUSY
+	 *	flag keeps track of whether we are still transmitting or not.
+	 *	It is updated by messages from the slave - indicating when all
+	 *	chars really have drained.
+	 */
 
-	/* FIXME: port locking here needs attending to */
-	port->flags &= ~ASYNC_INITIALIZED;
+	if (!test_bit(ST_CLOSING, &portp->state))
+		stli_rawclose(brdp, portp, 0, 0);
 
-	brdp = stli_brds[portp->brdnr];
-	stli_rawclose(brdp, portp, 0, 0);
-	if (tty->termios->c_cflag & HUPCL) {
-		stli_mkasysigs(&portp->asig, 0, 0);
-		if (test_bit(ST_CMDING, &portp->state))
-			set_bit(ST_DOSIGS, &portp->state);
-		else
-			stli_sendcmd(brdp, portp, A_SETSIGNALS, &portp->asig,
-				sizeof(asysigs_t), 0);
-	}
+ 	spin_lock_irqsave(&stli_lock, flags);
 	clear_bit(ST_TXBUSY, &portp->state);
 	clear_bit(ST_RXSTOP, &portp->state);
-	set_bit(TTY_IO_ERROR, &tty->flags);
-	tty_ldisc_flush(tty);
-	set_bit(ST_DOFLUSHRX, &portp->state);
-	stli_flushbuffer(tty);
+	spin_unlock_irqrestore(&stli_lock, flags);
 
-	tty_port_close_end(port, tty);
-	tty_port_tty_set(port, NULL);
+	ftype = FLUSHTX | FLUSHRX;
+	stli_cmdwait(brdp, portp, A_FLUSH, &ftype, sizeof(u32), 0);
+}
+
+static void stli_close(struct tty_struct *tty, struct file *filp)
+{
+	struct stliport *portp = tty->driver_data;
+	unsigned long flags;
+	if (portp == NULL)
+		return;
+ 	spin_lock_irqsave(&stli_lock, flags);
+	/*	Flush any internal buffering out first */
+	if (tty == stli_txcooktty)
+		stli_flushchars(tty);
+	spin_unlock_irqrestore(&stli_lock, flags);
+	tty_port_close(&portp->port, tty, filp);
 }
 
 /*****************************************************************************/
@@ -1724,6 +1703,7 @@ static void stli_start(struct tty_struct *tty)
 
 /*****************************************************************************/
 
+
 /*
  *	Hangup this port. This is pretty much like closing the port, only
  *	a little more brutal. No waiting for data to drain. Shutdown the
@@ -1733,47 +1713,8 @@ static void stli_start(struct tty_struct *tty)
 
 static void stli_hangup(struct tty_struct *tty)
 {
-	struct stliport *portp;
-	struct stlibrd *brdp;
-	struct tty_port *port;
-	unsigned long flags;
-
-	portp = tty->driver_data;
-	if (portp == NULL)
-		return;
-	if (portp->brdnr >= stli_nrbrds)
-		return;
-	brdp = stli_brds[portp->brdnr];
-	if (brdp == NULL)
-		return;
-	port = &portp->port;
-
-	spin_lock_irqsave(&port->lock, flags);
-	port->flags &= ~ASYNC_INITIALIZED;
-	spin_unlock_irqrestore(&port->lock, flags);
-
-	if (!test_bit(ST_CLOSING, &portp->state))
-		stli_rawclose(brdp, portp, 0, 0);
-
-	spin_lock_irqsave(&stli_lock, flags);
-	if (tty->termios->c_cflag & HUPCL) {
-		stli_mkasysigs(&portp->asig, 0, 0);
-		if (test_bit(ST_CMDING, &portp->state)) {
-			set_bit(ST_DOSIGS, &portp->state);
-			set_bit(ST_DOFLUSHTX, &portp->state);
-			set_bit(ST_DOFLUSHRX, &portp->state);
-		} else {
-			stli_sendcmd(brdp, portp, A_SETSIGNALSF,
-				&portp->asig, sizeof(asysigs_t), 0);
-		}
-	}
-
-	clear_bit(ST_TXBUSY, &portp->state);
-	clear_bit(ST_RXSTOP, &portp->state);
-	set_bit(TTY_IO_ERROR, &tty->flags);
-	spin_unlock_irqrestore(&stli_lock, flags);
-
-	tty_port_hangup(port);
+	struct stliport *portp = tty->driver_data;
+	tty_port_hangup(&portp->port);
 }
 
 /*****************************************************************************/
@@ -4311,7 +4252,7 @@ static int stli_getbrdstruct(struct stlibrd __user *arg)
  *	reset it, and start/stop it.
  */
 
-static int stli_memioctl(struct inode *ip, struct file *fp, unsigned int cmd, unsigned long arg)
+static long stli_memioctl(struct file *fp, unsigned int cmd, unsigned long arg)
 {
 	struct stlibrd *brdp;
 	int brdnr, rc, done;
@@ -4356,7 +4297,7 @@ static int stli_memioctl(struct inode *ip, struct file *fp, unsigned int cmd, un
  *	Now handle the board specific ioctls. These all depend on the
  *	minor number of the device they were called from.
  */
-	brdnr = iminor(ip);
+	brdnr = iminor(fp->f_dentry->d_inode);
 	if (brdnr >= STL_MAXBRDS)
 		return -ENODEV;
 	brdp = stli_brds[brdnr];
@@ -4420,6 +4361,8 @@ static const struct tty_operations stli_ops = {
 static const struct tty_port_operations stli_port_ops = {
 	.carrier_raised = stli_carrier_raised,
 	.dtr_rts = stli_dtr_rts,
+	.activate = stli_activate,
+	.shutdown = stli_shutdown,
 };
 
 /*****************************************************************************/
diff --git a/drivers/char/keyboard.c b/drivers/char/keyboard.c
index 950837cf9e9c..f706b1dffdb3 100644
--- a/drivers/char/keyboard.c
+++ b/drivers/char/keyboard.c
@@ -46,8 +46,6 @@
 
 extern void ctrl_alt_del(void);
 
-#define to_handle_h(n) container_of(n, struct input_handle, h_node)
-
 /*
  * Exported functions/variables
  */
@@ -132,6 +130,7 @@ int shift_state = 0;
  */
 
 static struct input_handler kbd_handler;
+static DEFINE_SPINLOCK(kbd_event_lock);
 static unsigned long key_down[BITS_TO_LONGS(KEY_CNT)];	/* keyboard key bitmap */
 static unsigned char shift_down[NR_SHIFT];		/* shift state counters.. */
 static int dead_key_next;
@@ -190,78 +189,89 @@ EXPORT_SYMBOL_GPL(unregister_keyboard_notifier);
  *  etc.). So this means that scancodes for the extra function keys won't
  *  be valid for the first event device, but will be for the second.
  */
+
+struct getset_keycode_data {
+	unsigned int scancode;
+	unsigned int keycode;
+	int error;
+};
+
+static int getkeycode_helper(struct input_handle *handle, void *data)
+{
+	struct getset_keycode_data *d = data;
+
+	d->error = input_get_keycode(handle->dev, d->scancode, &d->keycode);
+
+	return d->error == 0; /* stop as soon as we successfully get one */
+}
+
 int getkeycode(unsigned int scancode)
 {
-	struct input_handle *handle;
-	int keycode;
-	int error = -ENODEV;
+	struct getset_keycode_data d = { scancode, 0, -ENODEV };
 
-	list_for_each_entry(handle, &kbd_handler.h_list, h_node) {
-		error = input_get_keycode(handle->dev, scancode, &keycode);
-		if (!error)
-			return keycode;
-	}
+	input_handler_for_each_handle(&kbd_handler, &d, getkeycode_helper);
 
-	return error;
+	return d.error ?: d.keycode;
+}
+
+static int setkeycode_helper(struct input_handle *handle, void *data)
+{
+	struct getset_keycode_data *d = data;
+
+	d->error = input_set_keycode(handle->dev, d->scancode, d->keycode);
+
+	return d->error == 0; /* stop as soon as we successfully set one */
 }
 
 int setkeycode(unsigned int scancode, unsigned int keycode)
 {
-	struct input_handle *handle;
-	int error = -ENODEV;
+	struct getset_keycode_data d = { scancode, keycode, -ENODEV };
 
-	list_for_each_entry(handle, &kbd_handler.h_list, h_node) {
-		error = input_set_keycode(handle->dev, scancode, keycode);
-		if (!error)
-			break;
-	}
+	input_handler_for_each_handle(&kbd_handler, &d, setkeycode_helper);
 
-	return error;
+	return d.error;
 }
 
 /*
- * Making beeps and bells.
+ * Making beeps and bells. Note that we prefer beeps to bells, but when
+ * shutting the sound off we do both.
  */
-static void kd_nosound(unsigned long ignored)
+
+static int kd_sound_helper(struct input_handle *handle, void *data)
 {
-	struct input_handle *handle;
+	unsigned int *hz = data;
+	struct input_dev *dev = handle->dev;
 
-	list_for_each_entry(handle, &kbd_handler.h_list, h_node) {
-		if (test_bit(EV_SND, handle->dev->evbit)) {
-			if (test_bit(SND_TONE, handle->dev->sndbit))
-				input_inject_event(handle, EV_SND, SND_TONE, 0);
-			if (test_bit(SND_BELL, handle->dev->sndbit))
-				input_inject_event(handle, EV_SND, SND_BELL, 0);
+	if (test_bit(EV_SND, dev->evbit)) {
+		if (test_bit(SND_TONE, dev->sndbit)) {
+			input_inject_event(handle, EV_SND, SND_TONE, *hz);
+			if (*hz)
+				return 0;
 		}
+		if (test_bit(SND_BELL, dev->sndbit))
+			input_inject_event(handle, EV_SND, SND_BELL, *hz ? 1 : 0);
 	}
+
+	return 0;
+}
+
+static void kd_nosound(unsigned long ignored)
+{
+	static unsigned int zero;
+
+	input_handler_for_each_handle(&kbd_handler, &zero, kd_sound_helper);
 }
 
 static DEFINE_TIMER(kd_mksound_timer, kd_nosound, 0, 0);
 
 void kd_mksound(unsigned int hz, unsigned int ticks)
 {
-	struct list_head *node;
+	del_timer_sync(&kd_mksound_timer);
 
-	del_timer(&kd_mksound_timer);
+	input_handler_for_each_handle(&kbd_handler, &hz, kd_sound_helper);
 
-	if (hz) {
-		list_for_each_prev(node, &kbd_handler.h_list) {
-			struct input_handle *handle = to_handle_h(node);
-			if (test_bit(EV_SND, handle->dev->evbit)) {
-				if (test_bit(SND_TONE, handle->dev->sndbit)) {
-					input_inject_event(handle, EV_SND, SND_TONE, hz);
-					break;
-				}
-				if (test_bit(SND_BELL, handle->dev->sndbit)) {
-					input_inject_event(handle, EV_SND, SND_BELL, 1);
-					break;
-				}
-			}
-		}
-		if (ticks)
-			mod_timer(&kd_mksound_timer, jiffies + ticks);
-	} else
-		kd_nosound(0);
+	if (hz && ticks)
+		mod_timer(&kd_mksound_timer, jiffies + ticks);
 }
 EXPORT_SYMBOL(kd_mksound);
 
@@ -269,27 +279,34 @@ EXPORT_SYMBOL(kd_mksound);
  * Setting the keyboard rate.
  */
 
-int kbd_rate(struct kbd_repeat *rep)
+static int kbd_rate_helper(struct input_handle *handle, void *data)
 {
-	struct list_head *node;
-	unsigned int d = 0;
-	unsigned int p = 0;
-
-	list_for_each(node, &kbd_handler.h_list) {
-		struct input_handle *handle = to_handle_h(node);
-		struct input_dev *dev = handle->dev;
-
-		if (test_bit(EV_REP, dev->evbit)) {
-			if (rep->delay > 0)
-				input_inject_event(handle, EV_REP, REP_DELAY, rep->delay);
-			if (rep->period > 0)
-				input_inject_event(handle, EV_REP, REP_PERIOD, rep->period);
-			d = dev->rep[REP_DELAY];
-			p = dev->rep[REP_PERIOD];
-		}
+	struct input_dev *dev = handle->dev;
+	struct kbd_repeat *rep = data;
+
+	if (test_bit(EV_REP, dev->evbit)) {
+
+		if (rep[0].delay > 0)
+			input_inject_event(handle,
+					   EV_REP, REP_DELAY, rep[0].delay);
+		if (rep[0].period > 0)
+			input_inject_event(handle,
+					   EV_REP, REP_PERIOD, rep[0].period);
+
+		rep[1].delay = dev->rep[REP_DELAY];
+		rep[1].period = dev->rep[REP_PERIOD];
 	}
-	rep->delay  = d;
-	rep->period = p;
+
+	return 0;
+}
+
+int kbd_rate(struct kbd_repeat *rep)
+{
+	struct kbd_repeat data[2] = { *rep };
+
+	input_handler_for_each_handle(&kbd_handler, data, kbd_rate_helper);
+	*rep = data[1];	/* Copy currently used settings */
+
 	return 0;
 }
 
@@ -997,36 +1014,36 @@ static inline unsigned char getleds(void)
 	return leds;
 }
 
+static int kbd_update_leds_helper(struct input_handle *handle, void *data)
+{
+	unsigned char leds = *(unsigned char *)data;
+
+	if (test_bit(EV_LED, handle->dev->evbit)) {
+		input_inject_event(handle, EV_LED, LED_SCROLLL, !!(leds & 0x01));
+		input_inject_event(handle, EV_LED, LED_NUML,    !!(leds & 0x02));
+		input_inject_event(handle, EV_LED, LED_CAPSL,   !!(leds & 0x04));
+		input_inject_event(handle, EV_SYN, SYN_REPORT, 0);
+	}
+
+	return 0;
+}
+
 /*
- * This routine is the bottom half of the keyboard interrupt
- * routine, and runs with all interrupts enabled. It does
- * console changing, led setting and copy_to_cooked, which can
- * take a reasonably long time.
- *
- * Aside from timing (which isn't really that important for
- * keyboard interrupts as they happen often), using the software
- * interrupt routines for this thing allows us to easily mask
- * this when we don't want any of the above to happen.
- * This allows for easy and efficient race-condition prevention
- * for kbd_start => input_inject_event(dev, EV_LED, ...) => ...
+ * This is the tasklet that updates LED state on all keyboards
+ * attached to the box. The reason we use tasklet is that we
+ * need to handle the scenario when keyboard handler is not
+ * registered yet but we already getting updates form VT to
+ * update led state.
  */
-
 static void kbd_bh(unsigned long dummy)
 {
-	struct list_head *node;
 	unsigned char leds = getleds();
 
 	if (leds != ledstate) {
-		list_for_each(node, &kbd_handler.h_list) {
-			struct input_handle *handle = to_handle_h(node);
-			input_inject_event(handle, EV_LED, LED_SCROLLL, !!(leds & 0x01));
-			input_inject_event(handle, EV_LED, LED_NUML,    !!(leds & 0x02));
-			input_inject_event(handle, EV_LED, LED_CAPSL,   !!(leds & 0x04));
-			input_inject_event(handle, EV_SYN, SYN_REPORT, 0);
-		}
+		input_handler_for_each_handle(&kbd_handler, &leds,
+					      kbd_update_leds_helper);
+		ledstate = leds;
 	}
-
-	ledstate = leds;
 }
 
 DECLARE_TASKLET_DISABLED(keyboard_tasklet, kbd_bh, 0);
@@ -1136,7 +1153,7 @@ static int emulate_raw(struct vc_data *vc, unsigned int keycode, unsigned char u
 static void kbd_rawcode(unsigned char data)
 {
 	struct vc_data *vc = vc_cons[fg_console].d;
-	kbd = kbd_table + fg_console;
+	kbd = kbd_table + vc->vc_num;
 	if (kbd->kbdmode == VC_RAW)
 		put_queue(vc, data);
 }
@@ -1157,7 +1174,7 @@ static void kbd_keycode(unsigned int keycode, int down, int hw_raw)
 		tty->driver_data = vc;
 	}
 
-	kbd = kbd_table + fg_console;
+	kbd = kbd_table + vc->vc_num;
 
 	if (keycode == KEY_LEFTALT || keycode == KEY_RIGHTALT)
 		sysrq_alt = down ? keycode : 0;
@@ -1296,10 +1313,16 @@ static void kbd_keycode(unsigned int keycode, int down, int hw_raw)
 static void kbd_event(struct input_handle *handle, unsigned int event_type,
 		      unsigned int event_code, int value)
 {
+	/* We are called with interrupts disabled, just take the lock */
+	spin_lock(&kbd_event_lock);
+
 	if (event_type == EV_MSC && event_code == MSC_RAW && HW_RAW(handle->dev))
 		kbd_rawcode(value);
 	if (event_type == EV_KEY)
 		kbd_keycode(event_code, value, HW_RAW(handle->dev));
+
+	spin_unlock(&kbd_event_lock);
+
 	tasklet_schedule(&keyboard_tasklet);
 	do_poke_blanked_console = 1;
 	schedule_console_callback();
@@ -1363,15 +1386,11 @@ static void kbd_disconnect(struct input_handle *handle)
  */
 static void kbd_start(struct input_handle *handle)
 {
-	unsigned char leds = ledstate;
-
 	tasklet_disable(&keyboard_tasklet);
-	if (leds != 0xff) {
-		input_inject_event(handle, EV_LED, LED_SCROLLL, !!(leds & 0x01));
-		input_inject_event(handle, EV_LED, LED_NUML,    !!(leds & 0x02));
-		input_inject_event(handle, EV_LED, LED_CAPSL,   !!(leds & 0x04));
-		input_inject_event(handle, EV_SYN, SYN_REPORT, 0);
-	}
+
+	if (ledstate != 0xff)
+		kbd_update_leds_helper(handle, &ledstate);
+
 	tasklet_enable(&keyboard_tasklet);
 }
 
diff --git a/drivers/char/lp.c b/drivers/char/lp.c
index e444c2dba160..938a3a273886 100644
--- a/drivers/char/lp.c
+++ b/drivers/char/lp.c
@@ -127,6 +127,7 @@
 #include <linux/wait.h>
 #include <linux/jiffies.h>
 #include <linux/smp_lock.h>
+#include <linux/compat.h>
 
 #include <linux/parport.h>
 #undef LP_STATS
@@ -571,13 +572,11 @@ static int lp_release(struct inode * inode, struct file * file)
 	return 0;
 }
 
-static int lp_ioctl(struct inode *inode, struct file *file,
-		    unsigned int cmd, unsigned long arg)
+static int lp_do_ioctl(unsigned int minor, unsigned int cmd,
+	unsigned long arg, void __user *argp)
 {
-	unsigned int minor = iminor(inode);
 	int status;
 	int retval = 0;
-	void __user *argp = (void __user *)arg;
 
 #ifdef LP_DEBUG
 	printk(KERN_DEBUG "lp%d ioctl, cmd: 0x%x, arg: 0x%lx\n", minor, cmd, arg);
@@ -587,9 +586,6 @@ static int lp_ioctl(struct inode *inode, struct file *file,
 	if ((LP_F(minor) & LP_EXIST) == 0)
 		return -ENODEV;
 	switch ( cmd ) {
-		struct timeval par_timeout;
-		long to_jiffies;
-
 		case LPTIME:
 			LP_TIME(minor) = arg * HZ/100;
 			break;
@@ -652,34 +648,101 @@ static int lp_ioctl(struct inode *inode, struct file *file,
 				return -EFAULT;
 			break;
 
-		case LPSETTIMEOUT:
-			if (copy_from_user (&par_timeout, argp,
-					    sizeof (struct timeval))) {
-				return -EFAULT;
-			}
-			/* Convert to jiffies, place in lp_table */
-			if ((par_timeout.tv_sec < 0) ||
-			    (par_timeout.tv_usec < 0)) {
-				return -EINVAL;
-			}
-			to_jiffies = DIV_ROUND_UP(par_timeout.tv_usec, 1000000/HZ);
-			to_jiffies += par_timeout.tv_sec * (long) HZ;
-			if (to_jiffies <= 0) {
-				return -EINVAL;
-			}
-			lp_table[minor].timeout = to_jiffies;
-			break;
-
 		default:
 			retval = -EINVAL;
 	}
 	return retval;
 }
 
+static int lp_set_timeout(unsigned int minor, struct timeval *par_timeout)
+{
+	long to_jiffies;
+
+	/* Convert to jiffies, place in lp_table */
+	if ((par_timeout->tv_sec < 0) ||
+	    (par_timeout->tv_usec < 0)) {
+		return -EINVAL;
+	}
+	to_jiffies = DIV_ROUND_UP(par_timeout->tv_usec, 1000000/HZ);
+	to_jiffies += par_timeout->tv_sec * (long) HZ;
+	if (to_jiffies <= 0) {
+		return -EINVAL;
+	}
+	lp_table[minor].timeout = to_jiffies;
+	return 0;
+}
+
+static long lp_ioctl(struct file *file, unsigned int cmd,
+			unsigned long arg)
+{
+	unsigned int minor;
+	struct timeval par_timeout;
+	int ret;
+
+	minor = iminor(file->f_path.dentry->d_inode);
+	lock_kernel();
+	switch (cmd) {
+	case LPSETTIMEOUT:
+		if (copy_from_user(&par_timeout, (void __user *)arg,
+					sizeof (struct timeval))) {
+			ret = -EFAULT;
+			break;
+		}
+		ret = lp_set_timeout(minor, &par_timeout);
+		break;
+	default:
+		ret = lp_do_ioctl(minor, cmd, arg, (void __user *)arg);
+		break;
+	}
+	unlock_kernel();
+
+	return ret;
+}
+
+#ifdef CONFIG_COMPAT
+static long lp_compat_ioctl(struct file *file, unsigned int cmd,
+			unsigned long arg)
+{
+	unsigned int minor;
+	struct timeval par_timeout;
+	struct compat_timeval __user *tc;
+	int ret;
+
+	minor = iminor(file->f_path.dentry->d_inode);
+	lock_kernel();
+	switch (cmd) {
+	case LPSETTIMEOUT:
+		tc = compat_ptr(arg);
+		if (get_user(par_timeout.tv_sec, &tc->tv_sec) ||
+		    get_user(par_timeout.tv_usec, &tc->tv_usec)) {
+			ret = -EFAULT;
+			break;
+		}
+		ret = lp_set_timeout(minor, &par_timeout);
+		break;
+#ifdef LP_STATS
+	case LPGETSTATS:
+		/* FIXME: add an implementation if you set LP_STATS */
+		ret = -EINVAL;
+		break;
+#endif
+	default:
+		ret = lp_do_ioctl(minor, cmd, arg, compat_ptr(arg));
+		break;
+	}
+	unlock_kernel();
+
+	return ret;
+}
+#endif
+
 static const struct file_operations lp_fops = {
 	.owner		= THIS_MODULE,
 	.write		= lp_write,
-	.ioctl		= lp_ioctl,
+	.unlocked_ioctl	= lp_ioctl,
+#ifdef CONFIG_COMPAT
+	.compat_ioctl	= lp_compat_ioctl,
+#endif
 	.open		= lp_open,
 	.release	= lp_release,
 #ifdef CONFIG_PARPORT_1284
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index a074fceb67d3..be832b6f8279 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -5,7 +5,7 @@
  *
  *  Added devfs support. 
  *    Jan-11-1998, C. Scott Ananian <cananian@alumni.princeton.edu>
- *  Shared /dev/zero mmaping support, Feb 2000, Kanoj Sarcar <kanoj@sgi.com>
+ *  Shared /dev/zero mmapping support, Feb 2000, Kanoj Sarcar <kanoj@sgi.com>
  */
 
 #include <linux/mm.h>
@@ -26,7 +26,6 @@
 #include <linux/bootmem.h>
 #include <linux/splice.h>
 #include <linux/pfn.h>
-#include <linux/smp_lock.h>
 
 #include <asm/uaccess.h>
 #include <asm/io.h>
@@ -35,6 +34,16 @@
 # include <linux/efi.h>
 #endif
 
+static inline unsigned long size_inside_page(unsigned long start,
+					     unsigned long size)
+{
+	unsigned long sz;
+
+	sz = PAGE_SIZE - (start & (PAGE_SIZE - 1));
+
+	return min(sz, size);
+}
+
 /*
  * Architectures vary in how they handle caching for addresses
  * outside of main memory.
@@ -44,7 +53,7 @@ static inline int uncached_access(struct file *file, unsigned long addr)
 {
 #if defined(CONFIG_IA64)
 	/*
-	 * On ia64, we ignore O_SYNC because we cannot tolerate memory attribute aliases.
+	 * On ia64, we ignore O_DSYNC because we cannot tolerate memory attribute aliases.
 	 */
 	return !(efi_mem_attributes(addr) & EFI_MEMORY_WB);
 #elif defined(CONFIG_MIPS)
@@ -57,9 +66,9 @@ static inline int uncached_access(struct file *file, unsigned long addr)
 #else
 	/*
 	 * Accessing memory above the top the kernel knows about or through a file pointer
-	 * that was marked O_SYNC will be done non-cached.
+	 * that was marked O_DSYNC will be done non-cached.
 	 */
-	if (file->f_flags & O_SYNC)
+	if (file->f_flags & O_DSYNC)
 		return 1;
 	return addr >= __pa(high_memory);
 #endif
@@ -127,9 +136,7 @@ static ssize_t read_mem(struct file * file, char __user * buf,
 #ifdef __ARCH_HAS_NO_PAGE_ZERO_MAPPED
 	/* we don't have page 0 mapped on sparc and m68k.. */
 	if (p < PAGE_SIZE) {
-		sz = PAGE_SIZE - p;
-		if (sz > count) 
-			sz = count; 
+		sz = size_inside_page(p, count);
 		if (sz > 0) {
 			if (clear_user(buf, sz))
 				return -EFAULT;
@@ -142,15 +149,9 @@ static ssize_t read_mem(struct file * file, char __user * buf,
 #endif
 
 	while (count > 0) {
-		/*
-		 * Handle first page in case it's not aligned
-		 */
-		if (-p & (PAGE_SIZE - 1))
-			sz = -p & (PAGE_SIZE - 1);
-		else
-			sz = PAGE_SIZE;
+		unsigned long remaining;
 
-		sz = min_t(unsigned long, sz, count);
+		sz = size_inside_page(p, count);
 
 		if (!range_is_allowed(p >> PAGE_SHIFT, count))
 			return -EPERM;
@@ -164,12 +165,10 @@ static ssize_t read_mem(struct file * file, char __user * buf,
 		if (!ptr)
 			return -EFAULT;
 
-		if (copy_to_user(buf, ptr, sz)) {
-			unxlate_dev_mem_ptr(p, ptr);
-			return -EFAULT;
-		}
-
+		remaining = copy_to_user(buf, ptr, sz);
 		unxlate_dev_mem_ptr(p, ptr);
+		if (remaining)
+			return -EFAULT;
 
 		buf += sz;
 		p += sz;
@@ -197,9 +196,7 @@ static ssize_t write_mem(struct file * file, const char __user * buf,
 #ifdef __ARCH_HAS_NO_PAGE_ZERO_MAPPED
 	/* we don't have page 0 mapped on sparc and m68k.. */
 	if (p < PAGE_SIZE) {
-		unsigned long sz = PAGE_SIZE - p;
-		if (sz > count)
-			sz = count;
+		sz = size_inside_page(p, count);
 		/* Hmm. Do something? */
 		buf += sz;
 		p += sz;
@@ -209,15 +206,7 @@ static ssize_t write_mem(struct file * file, const char __user * buf,
 #endif
 
 	while (count > 0) {
-		/*
-		 * Handle first page in case it's not aligned
-		 */
-		if (-p & (PAGE_SIZE - 1))
-			sz = -p & (PAGE_SIZE - 1);
-		else
-			sz = PAGE_SIZE;
-
-		sz = min_t(unsigned long, sz, count);
+		sz = size_inside_page(p, count);
 
 		if (!range_is_allowed(p >> PAGE_SHIFT, sz))
 			return -EPERM;
@@ -235,16 +224,14 @@ static ssize_t write_mem(struct file * file, const char __user * buf,
 		}
 
 		copied = copy_from_user(ptr, buf, sz);
+		unxlate_dev_mem_ptr(p, ptr);
 		if (copied) {
 			written += sz - copied;
-			unxlate_dev_mem_ptr(p, ptr);
 			if (written)
 				break;
 			return -EFAULT;
 		}
 
-		unxlate_dev_mem_ptr(p, ptr);
-
 		buf += sz;
 		p += sz;
 		count -= sz;
@@ -418,27 +405,18 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
 #ifdef __ARCH_HAS_NO_PAGE_ZERO_MAPPED
 		/* we don't have page 0 mapped on sparc and m68k.. */
 		if (p < PAGE_SIZE && low_count > 0) {
-			size_t tmp = PAGE_SIZE - p;
-			if (tmp > low_count) tmp = low_count;
-			if (clear_user(buf, tmp))
+			sz = size_inside_page(p, low_count);
+			if (clear_user(buf, sz))
 				return -EFAULT;
-			buf += tmp;
-			p += tmp;
-			read += tmp;
-			low_count -= tmp;
-			count -= tmp;
+			buf += sz;
+			p += sz;
+			read += sz;
+			low_count -= sz;
+			count -= sz;
 		}
 #endif
 		while (low_count > 0) {
-			/*
-			 * Handle first page in case it's not aligned
-			 */
-			if (-p & (PAGE_SIZE - 1))
-				sz = -p & (PAGE_SIZE - 1);
-			else
-				sz = PAGE_SIZE;
-
-			sz = min_t(unsigned long, sz, low_count);
+			sz = size_inside_page(p, low_count);
 
 			/*
 			 * On ia64 if a page has been mapped somewhere as
@@ -462,21 +440,18 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
 		if (!kbuf)
 			return -ENOMEM;
 		while (count > 0) {
-			int len = count;
-
-			if (len > PAGE_SIZE)
-				len = PAGE_SIZE;
-			len = vread(kbuf, (char *)p, len);
-			if (!len)
+			sz = size_inside_page(p, count);
+			sz = vread(kbuf, (char *)p, sz);
+			if (!sz)
 				break;
-			if (copy_to_user(buf, kbuf, len)) {
+			if (copy_to_user(buf, kbuf, sz)) {
 				free_page((unsigned long)kbuf);
 				return -EFAULT;
 			}
-			count -= len;
-			buf += len;
-			read += len;
-			p += len;
+			count -= sz;
+			buf += sz;
+			read += sz;
+			p += sz;
 		}
 		free_page((unsigned long)kbuf);
 	}
@@ -486,7 +461,7 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
 
 
 static inline ssize_t
-do_write_kmem(void *p, unsigned long realp, const char __user * buf,
+do_write_kmem(unsigned long p, const char __user *buf,
 	      size_t count, loff_t *ppos)
 {
 	ssize_t written, sz;
@@ -495,14 +470,11 @@ do_write_kmem(void *p, unsigned long realp, const char __user * buf,
 	written = 0;
 #ifdef __ARCH_HAS_NO_PAGE_ZERO_MAPPED
 	/* we don't have page 0 mapped on sparc and m68k.. */
-	if (realp < PAGE_SIZE) {
-		unsigned long sz = PAGE_SIZE - realp;
-		if (sz > count)
-			sz = count;
+	if (p < PAGE_SIZE) {
+		sz = size_inside_page(p, count);
 		/* Hmm. Do something? */
 		buf += sz;
 		p += sz;
-		realp += sz;
 		count -= sz;
 		written += sz;
 	}
@@ -510,22 +482,15 @@ do_write_kmem(void *p, unsigned long realp, const char __user * buf,
 
 	while (count > 0) {
 		char *ptr;
-		/*
-		 * Handle first page in case it's not aligned
-		 */
-		if (-realp & (PAGE_SIZE - 1))
-			sz = -realp & (PAGE_SIZE - 1);
-		else
-			sz = PAGE_SIZE;
 
-		sz = min_t(unsigned long, sz, count);
+		sz = size_inside_page(p, count);
 
 		/*
 		 * On ia64 if a page has been mapped somewhere as
 		 * uncached, then it must also be accessed uncached
 		 * by the kernel or data corruption may occur
 		 */
-		ptr = xlate_dev_kmem_ptr(p);
+		ptr = xlate_dev_kmem_ptr((char *)p);
 
 		copied = copy_from_user(ptr, buf, sz);
 		if (copied) {
@@ -536,7 +501,6 @@ do_write_kmem(void *p, unsigned long realp, const char __user * buf,
 		}
 		buf += sz;
 		p += sz;
-		realp += sz;
 		count -= sz;
 		written += sz;
 	}
@@ -555,19 +519,14 @@ static ssize_t write_kmem(struct file * file, const char __user * buf,
 	unsigned long p = *ppos;
 	ssize_t wrote = 0;
 	ssize_t virtr = 0;
-	ssize_t written;
 	char * kbuf; /* k-addr because vwrite() takes vmlist_lock rwlock */
 
 	if (p < (unsigned long) high_memory) {
-
-		wrote = count;
-		if (count > (unsigned long) high_memory - p)
-			wrote = (unsigned long) high_memory - p;
-
-		written = do_write_kmem((void*)p, p, buf, wrote, ppos);
-		if (written != wrote)
-			return written;
-		wrote = written;
+		unsigned long to_write = min_t(unsigned long, count,
+					       (unsigned long)high_memory - p);
+		wrote = do_write_kmem(p, buf, to_write, ppos);
+		if (wrote != to_write)
+			return wrote;
 		p += wrote;
 		buf += wrote;
 		count -= wrote;
@@ -578,24 +537,21 @@ static ssize_t write_kmem(struct file * file, const char __user * buf,
 		if (!kbuf)
 			return wrote ? wrote : -ENOMEM;
 		while (count > 0) {
-			int len = count;
-
-			if (len > PAGE_SIZE)
-				len = PAGE_SIZE;
-			if (len) {
-				written = copy_from_user(kbuf, buf, len);
-				if (written) {
-					if (wrote + virtr)
-						break;
-					free_page((unsigned long)kbuf);
-					return -EFAULT;
-				}
+			unsigned long sz = size_inside_page(p, count);
+			unsigned long n;
+
+			n = copy_from_user(kbuf, buf, sz);
+			if (n) {
+				if (wrote + virtr)
+					break;
+				free_page((unsigned long)kbuf);
+				return -EFAULT;
 			}
-			len = vwrite(kbuf, (char *)p, len);
-			count -= len;
-			buf += len;
-			virtr += len;
-			p += len;
+			sz = vwrite(kbuf, (char *)p, sz);
+			count -= sz;
+			buf += sz;
+			virtr += sz;
+			p += sz;
 		}
 		free_page((unsigned long)kbuf);
 	}
@@ -892,29 +848,23 @@ static int memory_open(struct inode *inode, struct file *filp)
 {
 	int minor;
 	const struct memdev *dev;
-	int ret = -ENXIO;
-
-	lock_kernel();
 
 	minor = iminor(inode);
 	if (minor >= ARRAY_SIZE(devlist))
-		goto out;
+		return -ENXIO;
 
 	dev = &devlist[minor];
 	if (!dev->fops)
-		goto out;
+		return -ENXIO;
 
 	filp->f_op = dev->fops;
 	if (dev->dev_info)
 		filp->f_mapping->backing_dev_info = dev->dev_info;
 
 	if (dev->fops->open)
-		ret = dev->fops->open(inode, filp);
-	else
-		ret = 0;
-out:
-	unlock_kernel();
-	return ret;
+		return dev->fops->open(inode, filp);
+
+	return 0;
 }
 
 static const struct file_operations memory_fops = {
diff --git a/drivers/char/misc.c b/drivers/char/misc.c
index 07fa612a58d5..94a136e96c06 100644
--- a/drivers/char/misc.c
+++ b/drivers/char/misc.c
@@ -49,7 +49,6 @@
 #include <linux/device.h>
 #include <linux/tty.h>
 #include <linux/kmod.h>
-#include <linux/smp_lock.h>
 
 /*
  * Head entry for the doubly linked miscdevice list
@@ -61,9 +60,7 @@ static DEFINE_MUTEX(misc_mtx);
  * Assigned numbers, used for dynamic minors
  */
 #define DYNAMIC_MINORS 64 /* like dynamic majors */
-static unsigned char misc_minors[DYNAMIC_MINORS / 8];
-
-extern int pmu_device_init(void);
+static DECLARE_BITMAP(misc_minors, DYNAMIC_MINORS);
 
 #ifdef CONFIG_PROC_FS
 static void *misc_seq_start(struct seq_file *seq, loff_t *pos)
@@ -118,8 +115,7 @@ static int misc_open(struct inode * inode, struct file * file)
 	struct miscdevice *c;
 	int err = -ENODEV;
 	const struct file_operations *old_fops, *new_fops = NULL;
-	
-	lock_kernel();
+
 	mutex_lock(&misc_mtx);
 	
 	list_for_each_entry(c, &misc_list, list) {
@@ -157,7 +153,6 @@ static int misc_open(struct inode * inode, struct file * file)
 	fops_put(old_fops);
 fail:
 	mutex_unlock(&misc_mtx);
-	unlock_kernel();
 	return err;
 }
 
@@ -201,24 +196,23 @@ int misc_register(struct miscdevice * misc)
 	}
 
 	if (misc->minor == MISC_DYNAMIC_MINOR) {
-		int i = DYNAMIC_MINORS;
-		while (--i >= 0)
-			if ( (misc_minors[i>>3] & (1 << (i&7))) == 0)
-				break;
-		if (i<0) {
+		int i = find_first_zero_bit(misc_minors, DYNAMIC_MINORS);
+		if (i >= DYNAMIC_MINORS) {
 			mutex_unlock(&misc_mtx);
 			return -EBUSY;
 		}
-		misc->minor = i;
+		misc->minor = DYNAMIC_MINORS - i - 1;
+		set_bit(i, misc_minors);
 	}
 
-	if (misc->minor < DYNAMIC_MINORS)
-		misc_minors[misc->minor >> 3] |= 1 << (misc->minor & 7);
 	dev = MKDEV(MISC_MAJOR, misc->minor);
 
 	misc->this_device = device_create(misc_class, misc->parent, dev,
 					  misc, "%s", misc->name);
 	if (IS_ERR(misc->this_device)) {
+		int i = DYNAMIC_MINORS - misc->minor - 1;
+		if (i < DYNAMIC_MINORS && i >= 0)
+			clear_bit(i, misc_minors);
 		err = PTR_ERR(misc->this_device);
 		goto out;
 	}
@@ -245,7 +239,7 @@ int misc_register(struct miscdevice * misc)
 
 int misc_deregister(struct miscdevice *misc)
 {
-	int i = misc->minor;
+	int i = DYNAMIC_MINORS - misc->minor - 1;
 
 	if (list_empty(&misc->list))
 		return -EINVAL;
@@ -253,9 +247,8 @@ int misc_deregister(struct miscdevice *misc)
 	mutex_lock(&misc_mtx);
 	list_del(&misc->list);
 	device_destroy(misc_class, MKDEV(MISC_MAJOR, misc->minor));
-	if (i < DYNAMIC_MINORS && i>0) {
-		misc_minors[i>>3] &= ~(1 << (misc->minor & 7));
-	}
+	if (i < DYNAMIC_MINORS && i >= 0)
+		clear_bit(i, misc_minors);
 	mutex_unlock(&misc_mtx);
 	return 0;
 }
diff --git a/drivers/char/moxa.c b/drivers/char/moxa.c
index dd0083bbb64a..63ee3bbc1ce4 100644
--- a/drivers/char/moxa.c
+++ b/drivers/char/moxa.c
@@ -34,7 +34,6 @@
 #include <linux/tty.h>
 #include <linux/tty_flip.h>
 #include <linux/major.h>
-#include <linux/smp_lock.h>
 #include <linux/string.h>
 #include <linux/fcntl.h>
 #include <linux/ptrace.h>
@@ -139,7 +138,7 @@ struct moxa_port {
 	int cflag;
 	unsigned long statusflags;
 
-	u8 DCDState;
+	u8 DCDState;		/* Protected by the port lock */
 	u8 lineCtrl;
 	u8 lowChkFlag;
 };
@@ -151,10 +150,9 @@ struct mon_str {
 };
 
 /* statusflags */
-#define TXSTOPPED	0x1
-#define LOWWAIT 	0x2
-#define EMPTYWAIT	0x4
-#define THROTTLE	0x8
+#define TXSTOPPED	1
+#define LOWWAIT 	2
+#define EMPTYWAIT	3
 
 #define SERIAL_DO_RESTART
 
@@ -165,6 +163,7 @@ static struct mon_str moxaLog;
 static unsigned int moxaFuncTout = HZ / 2;
 static unsigned int moxaLowWaterChk;
 static DEFINE_MUTEX(moxa_openlock);
+static DEFINE_SPINLOCK(moxa_lock);
 /* Variables for insmod */
 #ifdef MODULE
 static unsigned long baseaddr[MAX_BOARDS];
@@ -194,8 +193,6 @@ static int moxa_write(struct tty_struct *, const unsigned char *, int);
 static int moxa_write_room(struct tty_struct *);
 static void moxa_flush_buffer(struct tty_struct *);
 static int moxa_chars_in_buffer(struct tty_struct *);
-static void moxa_throttle(struct tty_struct *);
-static void moxa_unthrottle(struct tty_struct *);
 static void moxa_set_termios(struct tty_struct *, struct ktermios *);
 static void moxa_stop(struct tty_struct *);
 static void moxa_start(struct tty_struct *);
@@ -205,9 +202,9 @@ static int moxa_tiocmset(struct tty_struct *tty, struct file *file,
 			 unsigned int set, unsigned int clear);
 static void moxa_poll(unsigned long);
 static void moxa_set_tty_param(struct tty_struct *, struct ktermios *);
-static void moxa_setup_empty_event(struct tty_struct *);
-static void moxa_shut_down(struct tty_struct *);
+static void moxa_shutdown(struct tty_port *);
 static int moxa_carrier_raised(struct tty_port *);
+static void moxa_dtr_rts(struct tty_port *, int);
 /*
  * moxa board interface functions:
  */
@@ -234,6 +231,8 @@ static void MoxaSetFifo(struct moxa_port *port, int enable);
  * I/O functions
  */
 
+static DEFINE_SPINLOCK(moxafunc_lock);
+
 static void moxa_wait_finish(void __iomem *ofsAddr)
 {
 	unsigned long end = jiffies + moxaFuncTout;
@@ -247,9 +246,25 @@ static void moxa_wait_finish(void __iomem *ofsAddr)
 
 static void moxafunc(void __iomem *ofsAddr, u16 cmd, u16 arg)
 {
+        unsigned long flags;
+        spin_lock_irqsave(&moxafunc_lock, flags);
 	writew(arg, ofsAddr + FuncArg);
 	writew(cmd, ofsAddr + FuncCode);
 	moxa_wait_finish(ofsAddr);
+	spin_unlock_irqrestore(&moxafunc_lock, flags);
+}
+
+static int moxafuncret(void __iomem *ofsAddr, u16 cmd, u16 arg)
+{
+        unsigned long flags;
+        u16 ret;
+        spin_lock_irqsave(&moxafunc_lock, flags);
+	writew(arg, ofsAddr + FuncArg);
+	writew(cmd, ofsAddr + FuncCode);
+	moxa_wait_finish(ofsAddr);
+	ret = readw(ofsAddr + FuncArg);
+	spin_unlock_irqrestore(&moxafunc_lock, flags);
+	return ret;
 }
 
 static void moxa_low_water_check(void __iomem *ofsAddr)
@@ -299,22 +314,20 @@ static int moxa_ioctl(struct tty_struct *tty, struct file *file,
 		struct moxa_port *p;
 		unsigned int i, j;
 
-		mutex_lock(&moxa_openlock);
 		for (i = 0; i < MAX_BOARDS; i++) {
 			p = moxa_boards[i].ports;
 			for (j = 0; j < MAX_PORTS_PER_BOARD; j++, p++, argm++) {
 				memset(&tmp, 0, sizeof(tmp));
+				spin_lock_bh(&moxa_lock);
 				if (moxa_boards[i].ready) {
 					tmp.inq = MoxaPortRxQueue(p);
 					tmp.outq = MoxaPortTxQueue(p);
 				}
-				if (copy_to_user(argm, &tmp, sizeof(tmp))) {
-					mutex_unlock(&moxa_openlock);
+				spin_unlock_bh(&moxa_lock);
+				if (copy_to_user(argm, &tmp, sizeof(tmp)))
 					return -EFAULT;
-				}
 			}
 		}
-		mutex_unlock(&moxa_openlock);
 		break;
 	} case MOXA_GET_OQUEUE:
 		status = MoxaPortTxQueue(ch);
@@ -330,16 +343,20 @@ static int moxa_ioctl(struct tty_struct *tty, struct file *file,
 		struct moxa_port *p;
 		unsigned int i, j;
 
-		mutex_lock(&moxa_openlock);
 		for (i = 0; i < MAX_BOARDS; i++) {
 			p = moxa_boards[i].ports;
 			for (j = 0; j < MAX_PORTS_PER_BOARD; j++, p++, argm++) {
 				struct tty_struct *ttyp;
 				memset(&tmp, 0, sizeof(tmp));
-				if (!moxa_boards[i].ready)
+				spin_lock_bh(&moxa_lock);
+				if (!moxa_boards[i].ready) {
+				        spin_unlock_bh(&moxa_lock);
 					goto copy;
+                                }
 
 				status = MoxaPortLineStatus(p);
+				spin_unlock_bh(&moxa_lock);
+
 				if (status & 1)
 					tmp.cts = 1;
 				if (status & 2)
@@ -354,24 +371,21 @@ static int moxa_ioctl(struct tty_struct *tty, struct file *file,
 					tmp.cflag = ttyp->termios->c_cflag;
 				tty_kref_put(tty);
 copy:
-				if (copy_to_user(argm, &tmp, sizeof(tmp))) {
-					mutex_unlock(&moxa_openlock);
+				if (copy_to_user(argm, &tmp, sizeof(tmp)))
 					return -EFAULT;
-				}
 			}
 		}
-		mutex_unlock(&moxa_openlock);
 		break;
 	}
 	case TIOCGSERIAL:
-		mutex_lock(&moxa_openlock);
+	        mutex_lock(&ch->port.mutex);
 		ret = moxa_get_serial_info(ch, argp);
-		mutex_unlock(&moxa_openlock);
+		mutex_unlock(&ch->port.mutex);
 		break;
 	case TIOCSSERIAL:
-		mutex_lock(&moxa_openlock);
+	        mutex_lock(&ch->port.mutex);
 		ret = moxa_set_serial_info(ch, argp);
-		mutex_unlock(&moxa_openlock);
+		mutex_unlock(&ch->port.mutex);
 		break;
 	default:
 		ret = -ENOIOCTLCMD;
@@ -396,8 +410,6 @@ static const struct tty_operations moxa_ops = {
 	.flush_buffer = moxa_flush_buffer,
 	.chars_in_buffer = moxa_chars_in_buffer,
 	.ioctl = moxa_ioctl,
-	.throttle = moxa_throttle,
-	.unthrottle = moxa_unthrottle,
 	.set_termios = moxa_set_termios,
 	.stop = moxa_stop,
 	.start = moxa_start,
@@ -409,11 +421,12 @@ static const struct tty_operations moxa_ops = {
 
 static const struct tty_port_operations moxa_port_ops = {
 	.carrier_raised = moxa_carrier_raised,
+	.dtr_rts = moxa_dtr_rts,
+	.shutdown = moxa_shutdown,
 };
 
 static struct tty_driver *moxaDriver;
 static DEFINE_TIMER(moxaTimer, moxa_poll, 0, 0);
-static DEFINE_SPINLOCK(moxa_lock);
 
 /*
  * HW init
@@ -1112,14 +1125,12 @@ static void __exit moxa_exit(void)
 module_init(moxa_init);
 module_exit(moxa_exit);
 
-static void moxa_close_port(struct tty_struct *tty)
+static void moxa_shutdown(struct tty_port *port)
 {
-	struct moxa_port *ch = tty->driver_data;
-	moxa_shut_down(tty);
+	struct moxa_port *ch = container_of(port, struct moxa_port, port);
+        MoxaPortDisable(ch);
 	MoxaPortFlushData(ch, 2);
-	ch->port.flags &= ~ASYNC_NORMAL_ACTIVE;
-	tty->driver_data = NULL;
-	tty_port_tty_set(&ch->port, NULL);
+	clear_bit(ASYNCB_NORMAL_ACTIVE, &port->flags);
 }
 
 static int moxa_carrier_raised(struct tty_port *port)
@@ -1127,45 +1138,19 @@ static int moxa_carrier_raised(struct tty_port *port)
 	struct moxa_port *ch = container_of(port, struct moxa_port, port);
 	int dcd;
 
-	spin_lock_bh(&moxa_lock);
+	spin_lock_irq(&port->lock);
 	dcd = ch->DCDState;
-	spin_unlock_bh(&moxa_lock);
+	spin_unlock_irq(&port->lock);
 	return dcd;
 }
 
-static int moxa_block_till_ready(struct tty_struct *tty, struct file *filp,
-			    struct moxa_port *ch)
+static void moxa_dtr_rts(struct tty_port *port, int onoff)
 {
-	struct tty_port *port = &ch->port;
-	DEFINE_WAIT(wait);
-	int retval = 0;
-	u8 dcd;
-
-	while (1) {
-		prepare_to_wait(&port->open_wait, &wait, TASK_INTERRUPTIBLE);
-		if (tty_hung_up_p(filp)) {
-#ifdef SERIAL_DO_RESTART
-			retval = -ERESTARTSYS;
-#else
-			retval = -EAGAIN;
-#endif
-			break;
-		}
-		dcd = tty_port_carrier_raised(port);
-		if (dcd)
-			break;
-
-		if (signal_pending(current)) {
-			retval = -ERESTARTSYS;
-			break;
-		}
-		schedule();
-	}
-	finish_wait(&port->open_wait, &wait);
-
-	return retval;
+	struct moxa_port *ch = container_of(port, struct moxa_port, port);
+	MoxaPortLineCtrl(ch, onoff, onoff);
 }
 
+
 static int moxa_open(struct tty_struct *tty, struct file *filp)
 {
 	struct moxa_board_conf *brd;
@@ -1194,6 +1179,7 @@ static int moxa_open(struct tty_struct *tty, struct file *filp)
 	ch->port.count++;
 	tty->driver_data = ch;
 	tty_port_tty_set(&ch->port, tty);
+	mutex_lock(&ch->port.mutex);
 	if (!(ch->port.flags & ASYNC_INITIALIZED)) {
 		ch->statusflags = 0;
 		moxa_set_tty_param(tty, tty->termios);
@@ -1202,58 +1188,20 @@ static int moxa_open(struct tty_struct *tty, struct file *filp)
 		MoxaSetFifo(ch, ch->type == PORT_16550A);
 		ch->port.flags |= ASYNC_INITIALIZED;
 	}
+	mutex_unlock(&ch->port.mutex);
 	mutex_unlock(&moxa_openlock);
 
-	retval = 0;
-	if (!(filp->f_flags & O_NONBLOCK) && !C_CLOCAL(tty))
-		retval = moxa_block_till_ready(tty, filp, ch);
-	mutex_lock(&moxa_openlock);
-	if (retval) {
-		if (ch->port.count) /* 0 means already hung up... */
-			if (--ch->port.count == 0)
-				moxa_close_port(tty);
-	} else
-		ch->port.flags |= ASYNC_NORMAL_ACTIVE;
-	mutex_unlock(&moxa_openlock);
-
+	retval = tty_port_block_til_ready(&ch->port, tty, filp);
+	if (retval == 0)
+	        set_bit(ASYNCB_NORMAL_ACTIVE, &ch->port.flags);
 	return retval;
 }
 
 static void moxa_close(struct tty_struct *tty, struct file *filp)
 {
-	struct moxa_port *ch;
-	int port;
-
-	port = tty->index;
-	if (port == MAX_PORTS || tty_hung_up_p(filp))
-		return;
-
-	mutex_lock(&moxa_openlock);
-	ch = tty->driver_data;
-	if (ch == NULL)
-		goto unlock;
-	if (tty->count == 1 && ch->port.count != 1) {
-		printk(KERN_WARNING "moxa_close: bad serial port count; "
-			"tty->count is 1, ch->port.count is %d\n", ch->port.count);
-		ch->port.count = 1;
-	}
-	if (--ch->port.count < 0) {
-		printk(KERN_WARNING "moxa_close: bad serial port count, "
-			"device=%s\n", tty->name);
-		ch->port.count = 0;
-	}
-	if (ch->port.count)
-		goto unlock;
-
+	struct moxa_port *ch = tty->driver_data;
 	ch->cflag = tty->termios->c_cflag;
-	if (ch->port.flags & ASYNC_INITIALIZED) {
-		moxa_setup_empty_event(tty);
-		tty_wait_until_sent(tty, 30 * HZ);	/* 30 seconds timeout */
-	}
-
-	moxa_close_port(tty);
-unlock:
-	mutex_unlock(&moxa_openlock);
+	tty_port_close(&ch->port, tty, filp);
 }
 
 static int moxa_write(struct tty_struct *tty,
@@ -1269,7 +1217,7 @@ static int moxa_write(struct tty_struct *tty,
 	len = MoxaPortWriteData(tty, buf, count);
 	spin_unlock_bh(&moxa_lock);
 
-	ch->statusflags |= LOWWAIT;
+	set_bit(LOWWAIT, &ch->statusflags);
 	return len;
 }
 
@@ -1300,40 +1248,21 @@ static int moxa_chars_in_buffer(struct tty_struct *tty)
 	struct moxa_port *ch = tty->driver_data;
 	int chars;
 
-	/*
-	 * Sigh...I have to check if driver_data is NULL here, because
-	 * if an open() fails, the TTY subsystem eventually calls
-	 * tty_wait_until_sent(), which calls the driver's chars_in_buffer()
-	 * routine.  And since the open() failed, we return 0 here.  TDJ
-	 */
-	if (ch == NULL)
-		return 0;
-	lock_kernel();
 	chars = MoxaPortTxQueue(ch);
-	if (chars) {
+	if (chars)
 		/*
 		 * Make it possible to wakeup anything waiting for output
 		 * in tty_ioctl.c, etc.
 		 */
-		if (!(ch->statusflags & EMPTYWAIT))
-			moxa_setup_empty_event(tty);
-	}
-	unlock_kernel();
+        	set_bit(EMPTYWAIT, &ch->statusflags);
 	return chars;
 }
 
 static int moxa_tiocmget(struct tty_struct *tty, struct file *file)
 {
-	struct moxa_port *ch;
+	struct moxa_port *ch = tty->driver_data;
 	int flag = 0, dtr, rts;
 
-	mutex_lock(&moxa_openlock);
-	ch = tty->driver_data;
-	if (!ch) {
-		mutex_unlock(&moxa_openlock);
-		return -EINVAL;
-	}
-
 	MoxaPortGetLineOut(ch, &dtr, &rts);
 	if (dtr)
 		flag |= TIOCM_DTR;
@@ -1346,7 +1275,6 @@ static int moxa_tiocmget(struct tty_struct *tty, struct file *file)
 		flag |= TIOCM_DSR;
 	if (dtr & 4)
 		flag |= TIOCM_CD;
-	mutex_unlock(&moxa_openlock);
 	return flag;
 }
 
@@ -1379,20 +1307,6 @@ static int moxa_tiocmset(struct tty_struct *tty, struct file *file,
 	return 0;
 }
 
-static void moxa_throttle(struct tty_struct *tty)
-{
-	struct moxa_port *ch = tty->driver_data;
-
-	ch->statusflags |= THROTTLE;
-}
-
-static void moxa_unthrottle(struct tty_struct *tty)
-{
-	struct moxa_port *ch = tty->driver_data;
-
-	ch->statusflags &= ~THROTTLE;
-}
-
 static void moxa_set_termios(struct tty_struct *tty,
 		struct ktermios *old_termios)
 {
@@ -1412,7 +1326,7 @@ static void moxa_stop(struct tty_struct *tty)
 	if (ch == NULL)
 		return;
 	MoxaPortTxDisable(ch);
-	ch->statusflags |= TXSTOPPED;
+	set_bit(TXSTOPPED, &ch->statusflags);
 }
 
 
@@ -1427,38 +1341,32 @@ static void moxa_start(struct tty_struct *tty)
 		return;
 
 	MoxaPortTxEnable(ch);
-	ch->statusflags &= ~TXSTOPPED;
+	clear_bit(TXSTOPPED, &ch->statusflags);
 }
 
 static void moxa_hangup(struct tty_struct *tty)
 {
-	struct moxa_port *ch;
-
-	mutex_lock(&moxa_openlock);
-	ch = tty->driver_data;
-	if (ch == NULL) {
-		mutex_unlock(&moxa_openlock);
-		return;
-	}
-	ch->port.count = 0;
-	moxa_close_port(tty);
-	mutex_unlock(&moxa_openlock);
-
-	wake_up_interruptible(&ch->port.open_wait);
+	struct moxa_port *ch = tty->driver_data;
+	tty_port_hangup(&ch->port);
 }
 
 static void moxa_new_dcdstate(struct moxa_port *p, u8 dcd)
 {
 	struct tty_struct *tty;
+	unsigned long flags;
 	dcd = !!dcd;
 
+	spin_lock_irqsave(&p->port.lock, flags);
 	if (dcd != p->DCDState) {
+        	p->DCDState = dcd;
+        	spin_unlock_irqrestore(&p->port.lock, flags);
 		tty = tty_port_tty_get(&p->port);
 		if (tty && C_CLOCAL(tty) && !dcd)
 			tty_hangup(tty);
 		tty_kref_put(tty);
 	}
-	p->DCDState = dcd;
+	else
+		spin_unlock_irqrestore(&p->port.lock, flags);
 }
 
 static int moxa_poll_port(struct moxa_port *p, unsigned int handle,
@@ -1470,24 +1378,24 @@ static int moxa_poll_port(struct moxa_port *p, unsigned int handle,
 	u16 intr;
 
 	if (tty) {
-		if ((p->statusflags & EMPTYWAIT) &&
+		if (test_bit(EMPTYWAIT, &p->statusflags) &&
 				MoxaPortTxQueue(p) == 0) {
-			p->statusflags &= ~EMPTYWAIT;
+			clear_bit(EMPTYWAIT, &p->statusflags);
 			tty_wakeup(tty);
 		}
-		if ((p->statusflags & LOWWAIT) && !tty->stopped &&
+		if (test_bit(LOWWAIT, &p->statusflags) && !tty->stopped &&
 				MoxaPortTxQueue(p) <= WAKEUP_CHARS) {
-			p->statusflags &= ~LOWWAIT;
+			clear_bit(LOWWAIT, &p->statusflags);
 			tty_wakeup(tty);
 		}
 
-		if (inited && !(p->statusflags & THROTTLE) &&
+		if (inited && !test_bit(TTY_THROTTLED, &tty->flags) &&
 				MoxaPortRxQueue(p) > 0) { /* RX */
 			MoxaPortReadData(p);
 			tty_schedule_flip(tty);
 		}
 	} else {
-		p->statusflags &= ~EMPTYWAIT;
+		clear_bit(EMPTYWAIT, &p->statusflags);
 		MoxaPortFlushData(p, 0); /* flush RX */
 	}
 
@@ -1588,35 +1496,6 @@ static void moxa_set_tty_param(struct tty_struct *tty, struct ktermios *old_term
 	tty_encode_baud_rate(tty, baud, baud);
 }
 
-static void moxa_setup_empty_event(struct tty_struct *tty)
-{
-	struct moxa_port *ch = tty->driver_data;
-
-	spin_lock_bh(&moxa_lock);
-	ch->statusflags |= EMPTYWAIT;
-	spin_unlock_bh(&moxa_lock);
-}
-
-static void moxa_shut_down(struct tty_struct *tty)
-{
-	struct moxa_port *ch = tty->driver_data;
-
-	if (!(ch->port.flags & ASYNC_INITIALIZED))
-		return;
-
-	MoxaPortDisable(ch);
-
-	/*
-	 * If we're a modem control device and HUPCL is on, drop RTS & DTR.
-	 */
-	if (C_HUPCL(tty))
-		MoxaPortLineCtrl(ch, 0, 0);
-
-	spin_lock_bh(&moxa_lock);
-	ch->port.flags &= ~ASYNC_INITIALIZED;
-	spin_unlock_bh(&moxa_lock);
-}
-
 /*****************************************************************************
  *	Driver level functions: 					     *
  *****************************************************************************/
@@ -1918,10 +1797,12 @@ static int MoxaPortSetTermio(struct moxa_port *port, struct ktermios *termio,
 	baud = MoxaPortSetBaud(port, baud);
 
 	if (termio->c_iflag & (IXON | IXOFF | IXANY)) {
+	        spin_lock_irq(&moxafunc_lock);
 		writeb(termio->c_cc[VSTART], ofsAddr + FuncArg);
 		writeb(termio->c_cc[VSTOP], ofsAddr + FuncArg1);
 		writeb(FC_SetXonXoff, ofsAddr + FuncCode);
 		moxa_wait_finish(ofsAddr);
+		spin_unlock_irq(&moxafunc_lock);
 
 	}
 	return baud;
@@ -1974,18 +1855,14 @@ static int MoxaPortLineStatus(struct moxa_port *port)
 	int val;
 
 	ofsAddr = port->tableAddr;
-	if (MOXA_IS_320(port->board)) {
-		moxafunc(ofsAddr, FC_LineStatus, 0);
-		val = readw(ofsAddr + FuncArg);
-	} else {
+	if (MOXA_IS_320(port->board))
+		val = moxafuncret(ofsAddr, FC_LineStatus, 0);
+	else
 		val = readw(ofsAddr + FlagStat) >> 4;
-	}
 	val &= 0x0B;
 	if (val & 8)
 		val |= 4;
-	spin_lock_bh(&moxa_lock);
 	moxa_new_dcdstate(port, val & 8);
-	spin_unlock_bh(&moxa_lock);
 	val &= 7;
 	return val;
 }
diff --git a/drivers/char/mspec.c b/drivers/char/mspec.c
index 1997270bb6f4..ecb89d798e35 100644
--- a/drivers/char/mspec.c
+++ b/drivers/char/mspec.c
@@ -248,7 +248,7 @@ static const struct vm_operations_struct mspec_vm_ops = {
 /*
  * mspec_mmap
  *
- * Called when mmaping the device.  Initializes the vma with a fault handler
+ * Called when mmapping the device.  Initializes the vma with a fault handler
  * and private data structure necessary to allocate, track, and free the
  * underlying pages.
  */
diff --git a/drivers/char/mxser.c b/drivers/char/mxser.c
index 5e28d39b9e81..3d923065d9a2 100644
--- a/drivers/char/mxser.c
+++ b/drivers/char/mxser.c
@@ -23,7 +23,6 @@
 #include <linux/errno.h>
 #include <linux/signal.h>
 #include <linux/sched.h>
-#include <linux/smp_lock.h>
 #include <linux/timer.h>
 #include <linux/interrupt.h>
 #include <linux/tty.h>
@@ -856,9 +855,9 @@ static void mxser_check_modem_status(struct tty_struct *tty,
 	}
 }
 
-static int mxser_startup(struct tty_struct *tty)
+static int mxser_activate(struct tty_port *port, struct tty_struct *tty)
 {
-	struct mxser_port *info = tty->driver_data;
+	struct mxser_port *info = container_of(port, struct mxser_port, port);
 	unsigned long page;
 	unsigned long flags;
 
@@ -868,22 +867,13 @@ static int mxser_startup(struct tty_struct *tty)
 
 	spin_lock_irqsave(&info->slock, flags);
 
-	if (info->port.flags & ASYNC_INITIALIZED) {
-		free_page(page);
-		spin_unlock_irqrestore(&info->slock, flags);
-		return 0;
-	}
-
 	if (!info->ioaddr || !info->type) {
 		set_bit(TTY_IO_ERROR, &tty->flags);
 		free_page(page);
 		spin_unlock_irqrestore(&info->slock, flags);
 		return 0;
 	}
-	if (info->port.xmit_buf)
-		free_page(page);
-	else
-		info->port.xmit_buf = (unsigned char *) page;
+	info->port.xmit_buf = (unsigned char *) page;
 
 	/*
 	 * Clear the FIFO buffers and disable them
@@ -951,24 +941,19 @@ static int mxser_startup(struct tty_struct *tty)
 	 * and set the speed of the serial port
 	 */
 	mxser_change_speed(tty, NULL);
-	info->port.flags |= ASYNC_INITIALIZED;
 	spin_unlock_irqrestore(&info->slock, flags);
 
 	return 0;
 }
 
 /*
- * This routine will shutdown a serial port; interrupts maybe disabled, and
- * DTR is dropped if the hangup on close termio flag is on.
+ * This routine will shutdown a serial port
  */
-static void mxser_shutdown(struct tty_struct *tty)
+static void mxser_shutdown_port(struct tty_port *port)
 {
-	struct mxser_port *info = tty->driver_data;
+	struct mxser_port *info = container_of(port, struct mxser_port, port);
 	unsigned long flags;
 
-	if (!(info->port.flags & ASYNC_INITIALIZED))
-		return;
-
 	spin_lock_irqsave(&info->slock, flags);
 
 	/*
@@ -978,7 +963,7 @@ static void mxser_shutdown(struct tty_struct *tty)
 	wake_up_interruptible(&info->port.delta_msr_wait);
 
 	/*
-	 * Free the IRQ, if necessary
+	 * Free the xmit buffer, if necessary
 	 */
 	if (info->port.xmit_buf) {
 		free_page((unsigned long) info->port.xmit_buf);
@@ -988,10 +973,6 @@ static void mxser_shutdown(struct tty_struct *tty)
 	info->IER = 0;
 	outb(0x00, info->ioaddr + UART_IER);
 
-	if (tty->termios->c_cflag & HUPCL)
-		info->MCR &= ~(UART_MCR_DTR | UART_MCR_RTS);
-	outb(info->MCR, info->ioaddr + UART_MCR);
-
 	/* clear Rx/Tx FIFO's */
 	if (info->board->chip_flag)
 		outb(UART_FCR_CLEAR_RCVR | UART_FCR_CLEAR_XMIT |
@@ -1004,9 +985,6 @@ static void mxser_shutdown(struct tty_struct *tty)
 	/* read data port to reset things */
 	(void) inb(info->ioaddr + UART_RX);
 
-	set_bit(TTY_IO_ERROR, &tty->flags);
-
-	info->port.flags &= ~ASYNC_INITIALIZED;
 
 	if (info->board->chip_flag)
 		SET_MOXA_MUST_NO_SOFTWARE_FLOW_CONTROL(info->ioaddr);
@@ -1023,8 +1001,7 @@ static void mxser_shutdown(struct tty_struct *tty)
 static int mxser_open(struct tty_struct *tty, struct file *filp)
 {
 	struct mxser_port *info;
-	unsigned long flags;
-	int retval, line;
+	int line;
 
 	line = tty->index;
 	if (line == MXSER_PORTS)
@@ -1035,23 +1012,7 @@ static int mxser_open(struct tty_struct *tty, struct file *filp)
 	if (!info->ioaddr)
 		return -ENODEV;
 
-	tty->driver_data = info;
-	tty_port_tty_set(&info->port, tty);
-	/*
-	 * Start up serial port
-	 */
-	spin_lock_irqsave(&info->port.lock, flags);
-	info->port.count++;
-	spin_unlock_irqrestore(&info->port.lock, flags);
-	retval = mxser_startup(tty);
-	if (retval)
-		return retval;
-
-	retval = tty_port_block_til_ready(&info->port, tty, filp);
-	if (retval)
-		return retval;
-
-	return 0;
+	return tty_port_open(&info->port, tty, filp);
 }
 
 static void mxser_flush_buffer(struct tty_struct *tty)
@@ -1075,19 +1036,11 @@ static void mxser_flush_buffer(struct tty_struct *tty)
 }
 
 
-static void mxser_close_port(struct tty_struct *tty, struct tty_port *port)
+static void mxser_close_port(struct tty_port *port)
 {
 	struct mxser_port *info = container_of(port, struct mxser_port, port);
 	unsigned long timeout;
 	/*
-	 * Save the termios structure, since this port may have
-	 * separate termios for callout and dialin.
-	 *
-	 * FIXME: Can this go ?
-	 */
-	if (port->flags & ASYNC_NORMAL_ACTIVE)
-		info->normal_termios = *tty->termios;
-	/*
 	 * At this point we stop accepting input.  To do this, we
 	 * disable the receive line status interrupts, and tell the
 	 * interrupt driver to stop checking the data ready bit in the
@@ -1097,22 +1050,18 @@ static void mxser_close_port(struct tty_struct *tty, struct tty_port *port)
 	if (info->board->chip_flag)
 		info->IER &= ~MOXA_MUST_RECV_ISR;
 
-	if (port->flags & ASYNC_INITIALIZED) {
-		outb(info->IER, info->ioaddr + UART_IER);
-		/*
-		 * Before we drop DTR, make sure the UART transmitter
-		 * has completely drained; this is especially
-		 * important if there is a transmit FIFO!
-		 */
-		timeout = jiffies + HZ;
-		while (!(inb(info->ioaddr + UART_LSR) & UART_LSR_TEMT)) {
-			schedule_timeout_interruptible(5);
-			if (time_after(jiffies, timeout))
-				break;
-		}
+	outb(info->IER, info->ioaddr + UART_IER);
+	/*
+	 * Before we drop DTR, make sure the UART transmitter
+	 * has completely drained; this is especially
+	 * important if there is a transmit FIFO!
+	 */
+	timeout = jiffies + HZ;
+	while (!(inb(info->ioaddr + UART_LSR) & UART_LSR_TEMT)) {
+		schedule_timeout_interruptible(5);
+		if (time_after(jiffies, timeout))
+			break;
 	}
-	mxser_shutdown(tty);
-
 }
 
 /*
@@ -1130,8 +1079,12 @@ static void mxser_close(struct tty_struct *tty, struct file *filp)
 		return;
 	if (tty_port_close_start(port, tty, filp) == 0)
 		return;
-	mxser_close_port(tty, port);
+	mutex_lock(&port->mutex);
+	mxser_close_port(port);
 	mxser_flush_buffer(tty);
+	mxser_shutdown_port(port);
+	clear_bit(ASYNCB_INITIALIZED, &port->flags);
+	mutex_unlock(&port->mutex);
 	/* Right now the tty_port set is done outside of the close_end helper
 	   as we don't yet have everyone using refcounts */	
 	tty_port_close_end(port, tty);
@@ -1275,6 +1228,7 @@ static int mxser_set_serial_info(struct tty_struct *tty,
 		struct serial_struct __user *new_info)
 {
 	struct mxser_port *info = tty->driver_data;
+	struct tty_port *port = &info->port;
 	struct serial_struct new_serial;
 	speed_t baud;
 	unsigned long sl_flags;
@@ -1290,7 +1244,7 @@ static int mxser_set_serial_info(struct tty_struct *tty,
 			new_serial.port != info->ioaddr)
 		return -EINVAL;
 
-	flags = info->port.flags & ASYNC_SPD_MASK;
+	flags = port->flags & ASYNC_SPD_MASK;
 
 	if (!capable(CAP_SYS_ADMIN)) {
 		if ((new_serial.baud_base != info->baud_base) ||
@@ -1304,16 +1258,17 @@ static int mxser_set_serial_info(struct tty_struct *tty,
 		 * OK, past this point, all the error checking has been done.
 		 * At this point, we start making changes.....
 		 */
-		info->port.flags = ((info->port.flags & ~ASYNC_FLAGS) |
+		port->flags = ((port->flags & ~ASYNC_FLAGS) |
 				(new_serial.flags & ASYNC_FLAGS));
-		info->port.close_delay = new_serial.close_delay * HZ / 100;
-		info->port.closing_wait = new_serial.closing_wait * HZ / 100;
-		tty->low_latency = (info->port.flags & ASYNC_LOW_LATENCY)
-								? 1 : 0;
-		if ((info->port.flags & ASYNC_SPD_MASK) == ASYNC_SPD_CUST &&
+		port->close_delay = new_serial.close_delay * HZ / 100;
+		port->closing_wait = new_serial.closing_wait * HZ / 100;
+		tty->low_latency = (port->flags & ASYNC_LOW_LATENCY) ? 1 : 0;
+		if ((port->flags & ASYNC_SPD_MASK) == ASYNC_SPD_CUST &&
 				(new_serial.baud_base != info->baud_base ||
 				new_serial.custom_divisor !=
 				info->custom_divisor)) {
+			if (new_serial.custom_divisor == 0)
+				return -EINVAL;
 			baud = new_serial.baud_base / new_serial.custom_divisor;
 			tty_encode_baud_rate(tty, baud, baud);
 		}
@@ -1323,15 +1278,17 @@ static int mxser_set_serial_info(struct tty_struct *tty,
 
 	process_txrx_fifo(info);
 
-	if (info->port.flags & ASYNC_INITIALIZED) {
-		if (flags != (info->port.flags & ASYNC_SPD_MASK)) {
+	if (test_bit(ASYNCB_INITIALIZED, &port->flags)) {
+		if (flags != (port->flags & ASYNC_SPD_MASK)) {
 			spin_lock_irqsave(&info->slock, sl_flags);
 			mxser_change_speed(tty, NULL);
 			spin_unlock_irqrestore(&info->slock, sl_flags);
 		}
-	} else
-		retval = mxser_startup(tty);
-
+	} else {
+		retval = mxser_activate(port, tty);
+		if (retval == 0)
+			set_bit(ASYNCB_INITIALIZED, &port->flags);
+	}
 	return retval;
 }
 
@@ -1520,7 +1477,8 @@ static int __init mxser_read_register(int port, unsigned short *regs)
 
 static int mxser_ioctl_special(unsigned int cmd, void __user *argp)
 {
-	struct mxser_port *port;
+	struct mxser_port *ip;
+	struct tty_port *port;
 	struct tty_struct *tty;
 	int result, status;
 	unsigned int i, j;
@@ -1536,38 +1494,39 @@ static int mxser_ioctl_special(unsigned int cmd, void __user *argp)
 
 	case MOXA_CHKPORTENABLE:
 		result = 0;
-		lock_kernel();
 		for (i = 0; i < MXSER_BOARDS; i++)
 			for (j = 0; j < MXSER_PORTS_PER_BOARD; j++)
 				if (mxser_boards[i].ports[j].ioaddr)
 					result |= (1 << i);
-		unlock_kernel();
 		return put_user(result, (unsigned long __user *)argp);
 	case MOXA_GETDATACOUNT:
-		lock_kernel();
+		/* The receive side is locked by port->slock but it isn't
+		   clear that an exact snapshot is worth copying here */
 		if (copy_to_user(argp, &mxvar_log, sizeof(mxvar_log)))
 			ret = -EFAULT;
-		unlock_kernel();
 		return ret;
 	case MOXA_GETMSTATUS: {
 		struct mxser_mstatus ms, __user *msu = argp;
-		lock_kernel();
 		for (i = 0; i < MXSER_BOARDS; i++)
 			for (j = 0; j < MXSER_PORTS_PER_BOARD; j++) {
-				port = &mxser_boards[i].ports[j];
+				ip = &mxser_boards[i].ports[j];
+				port = &ip->port;
 				memset(&ms, 0, sizeof(ms));
 
-				if (!port->ioaddr)
+				mutex_lock(&port->mutex);
+				if (!ip->ioaddr)
 					goto copy;
 				
-				tty = tty_port_tty_get(&port->port);
+				tty = tty_port_tty_get(port);
 
 				if (!tty || !tty->termios)
-					ms.cflag = port->normal_termios.c_cflag;
+					ms.cflag = ip->normal_termios.c_cflag;
 				else
 					ms.cflag = tty->termios->c_cflag;
 				tty_kref_put(tty);
-				status = inb(port->ioaddr + UART_MSR);
+				spin_lock_irq(&ip->slock);
+				status = inb(ip->ioaddr + UART_MSR);
+				spin_unlock_irq(&ip->slock);
 				if (status & UART_MSR_DCD)
 					ms.dcd = 1;
 				if (status & UART_MSR_DSR)
@@ -1575,13 +1534,11 @@ static int mxser_ioctl_special(unsigned int cmd, void __user *argp)
 				if (status & UART_MSR_CTS)
 					ms.cts = 1;
 			copy:
-				if (copy_to_user(msu, &ms, sizeof(ms))) {
-					unlock_kernel();
+				mutex_unlock(&port->mutex);
+				if (copy_to_user(msu, &ms, sizeof(ms)))
 					return -EFAULT;
-				}
 				msu++;
 			}
-		unlock_kernel();
 		return 0;
 	}
 	case MOXA_ASPP_MON_EXT: {
@@ -1593,41 +1550,48 @@ static int mxser_ioctl_special(unsigned int cmd, void __user *argp)
 		if (!me)
 			return -ENOMEM;
 
-		lock_kernel();
 		for (i = 0, p = 0; i < MXSER_BOARDS; i++) {
 			for (j = 0; j < MXSER_PORTS_PER_BOARD; j++, p++) {
 				if (p >= ARRAY_SIZE(me->rx_cnt)) {
 					i = MXSER_BOARDS;
 					break;
 				}
-				port = &mxser_boards[i].ports[j];
-				if (!port->ioaddr)
+				ip = &mxser_boards[i].ports[j];
+				port = &ip->port;
+
+				mutex_lock(&port->mutex);
+				if (!ip->ioaddr) {
+					mutex_unlock(&port->mutex);
 					continue;
+				}
 
-				status = mxser_get_msr(port->ioaddr, 0, p);
+				spin_lock_irq(&ip->slock);
+				status = mxser_get_msr(ip->ioaddr, 0, p);
 
 				if (status & UART_MSR_TERI)
-					port->icount.rng++;
+					ip->icount.rng++;
 				if (status & UART_MSR_DDSR)
-					port->icount.dsr++;
+					ip->icount.dsr++;
 				if (status & UART_MSR_DDCD)
-					port->icount.dcd++;
+					ip->icount.dcd++;
 				if (status & UART_MSR_DCTS)
-					port->icount.cts++;
+					ip->icount.cts++;
 
-				port->mon_data.modem_status = status;
-				me->rx_cnt[p] = port->mon_data.rxcnt;
-				me->tx_cnt[p] = port->mon_data.txcnt;
-				me->up_rxcnt[p] = port->mon_data.up_rxcnt;
-				me->up_txcnt[p] = port->mon_data.up_txcnt;
+				ip->mon_data.modem_status = status;
+				me->rx_cnt[p] = ip->mon_data.rxcnt;
+				me->tx_cnt[p] = ip->mon_data.txcnt;
+				me->up_rxcnt[p] = ip->mon_data.up_rxcnt;
+				me->up_txcnt[p] = ip->mon_data.up_txcnt;
 				me->modem_status[p] =
-					port->mon_data.modem_status;
-				tty = tty_port_tty_get(&port->port);
+					ip->mon_data.modem_status;
+				spin_unlock_irq(&ip->slock);
+
+				tty = tty_port_tty_get(&ip->port);
 
 				if (!tty || !tty->termios) {
-					cflag = port->normal_termios.c_cflag;
-					iflag = port->normal_termios.c_iflag;
-					me->baudrate[p] = tty_termios_baud_rate(&port->normal_termios);
+					cflag = ip->normal_termios.c_cflag;
+					iflag = ip->normal_termios.c_iflag;
+					me->baudrate[p] = tty_termios_baud_rate(&ip->normal_termios);
 				} else {
 					cflag = tty->termios->c_cflag;
 					iflag = tty->termios->c_iflag;
@@ -1646,16 +1610,15 @@ static int mxser_ioctl_special(unsigned int cmd, void __user *argp)
 				if (iflag & (IXON | IXOFF))
 					me->flowctrl[p] |= 0x0C;
 
-				if (port->type == PORT_16550A)
+				if (ip->type == PORT_16550A)
 					me->fifo[p] = 1;
 
-				opmode = inb(port->opmode_ioaddr) >>
-						((p % 4) * 2);
+				opmode = inb(ip->opmode_ioaddr)>>((p % 4) * 2);
 				opmode &= OP_MODE_MASK;
 				me->iftype[p] = opmode;
+				mutex_unlock(&port->mutex);
 			}
 		}
-		unlock_kernel();
 		if (copy_to_user(argp, me, sizeof(*me)))
 			ret = -EFAULT;
 		kfree(me);
@@ -1692,6 +1655,7 @@ static int mxser_ioctl(struct tty_struct *tty, struct file *file,
 		unsigned int cmd, unsigned long arg)
 {
 	struct mxser_port *info = tty->driver_data;
+	struct tty_port *port = &info->port;
 	struct async_icount cnow;
 	unsigned long flags;
 	void __user *argp = (void __user *)arg;
@@ -1716,20 +1680,20 @@ static int mxser_ioctl(struct tty_struct *tty, struct file *file,
 					opmode != RS422_MODE &&
 					opmode != RS485_4WIRE_MODE)
 				return -EFAULT;
-			lock_kernel();
 			mask = ModeMask[p];
 			shiftbit = p * 2;
+			spin_lock_irq(&info->slock);
 			val = inb(info->opmode_ioaddr);
 			val &= mask;
 			val |= (opmode << shiftbit);
 			outb(val, info->opmode_ioaddr);
-			unlock_kernel();
+			spin_unlock_irq(&info->slock);
 		} else {
-			lock_kernel();
 			shiftbit = p * 2;
+			spin_lock_irq(&info->slock);
 			opmode = inb(info->opmode_ioaddr) >> shiftbit;
+			spin_unlock_irq(&info->slock);
 			opmode &= OP_MODE_MASK;
-			unlock_kernel();
 			if (put_user(opmode, (int __user *)argp))
 				return -EFAULT;
 		}
@@ -1742,14 +1706,14 @@ static int mxser_ioctl(struct tty_struct *tty, struct file *file,
 
 	switch (cmd) {
 	case TIOCGSERIAL:
-		lock_kernel();
+		mutex_lock(&port->mutex);
 		retval = mxser_get_serial_info(tty, argp);
-		unlock_kernel();
+		mutex_unlock(&port->mutex);
 		return retval;
 	case TIOCSSERIAL:
-		lock_kernel();
+		mutex_lock(&port->mutex);
 		retval = mxser_set_serial_info(tty, argp);
-		unlock_kernel();
+		mutex_unlock(&port->mutex);
 		return retval;
 	case TIOCSERGETLSR:	/* Get line status register */
 		return  mxser_get_lsr_info(info, argp);
@@ -1795,31 +1759,33 @@ static int mxser_ioctl(struct tty_struct *tty, struct file *file,
 	case MOXA_HighSpeedOn:
 		return put_user(info->baud_base != 115200 ? 1 : 0, (int __user *)argp);
 	case MOXA_SDS_RSTICOUNTER:
-		lock_kernel();
+		spin_lock_irq(&info->slock);
 		info->mon_data.rxcnt = 0;
 		info->mon_data.txcnt = 0;
-		unlock_kernel();
+		spin_unlock_irq(&info->slock);
 		return 0;
 
 	case MOXA_ASPP_OQUEUE:{
 		int len, lsr;
 
-		lock_kernel();
 		len = mxser_chars_in_buffer(tty);
+		spin_lock(&info->slock);
 		lsr = inb(info->ioaddr + UART_LSR) & UART_LSR_THRE;
+		spin_unlock_irq(&info->slock);
 		len += (lsr ? 0 : 1);
-		unlock_kernel();
 
 		return put_user(len, (int __user *)argp);
 	}
 	case MOXA_ASPP_MON: {
 		int mcr, status;
 
-		lock_kernel();
+		spin_lock(&info->slock);
 		status = mxser_get_msr(info->ioaddr, 1, tty->index);
 		mxser_check_modem_status(tty, info, status);
 
 		mcr = inb(info->ioaddr + UART_MCR);
+		spin_unlock(&info->slock);
+
 		if (mcr & MOXA_MUST_MCR_XON_FLAG)
 			info->mon_data.hold_reason &= ~NPPI_NOTIFY_XOFFHOLD;
 		else
@@ -1834,7 +1800,7 @@ static int mxser_ioctl(struct tty_struct *tty, struct file *file,
 			info->mon_data.hold_reason |= NPPI_NOTIFY_CTSHOLD;
 		else
 			info->mon_data.hold_reason &= ~NPPI_NOTIFY_CTSHOLD;
-		unlock_kernel();
+
 		if (copy_to_user(argp, &info->mon_data,
 				sizeof(struct mxser_mon)))
 			return -EFAULT;
@@ -1993,6 +1959,7 @@ static void mxser_wait_until_sent(struct tty_struct *tty, int timeout)
 {
 	struct mxser_port *info = tty->driver_data;
 	unsigned long orig_jiffies, char_time;
+	unsigned long flags;
 	int lsr;
 
 	if (info->type == PORT_UNKNOWN)
@@ -2032,19 +1999,21 @@ static void mxser_wait_until_sent(struct tty_struct *tty, int timeout)
 		timeout, char_time);
 	printk("jiff=%lu...", jiffies);
 #endif
-	lock_kernel();
+	spin_lock_irqsave(&info->slock, flags);
 	while (!((lsr = inb(info->ioaddr + UART_LSR)) & UART_LSR_TEMT)) {
 #ifdef SERIAL_DEBUG_RS_WAIT_UNTIL_SENT
 		printk("lsr = %d (jiff=%lu)...", lsr, jiffies);
 #endif
+		spin_unlock_irqrestore(&info->slock, flags);
 		schedule_timeout_interruptible(char_time);
+		spin_lock_irqsave(&info->slock, flags);
 		if (signal_pending(current))
 			break;
 		if (timeout && time_after(jiffies, orig_jiffies + timeout))
 			break;
 	}
+	spin_unlock_irqrestore(&info->slock, flags);
 	set_current_state(TASK_RUNNING);
-	unlock_kernel();
 
 #ifdef SERIAL_DEBUG_RS_WAIT_UNTIL_SENT
 	printk("lsr = %d (jiff=%lu)...done\n", lsr, jiffies);
@@ -2059,7 +2028,6 @@ static void mxser_hangup(struct tty_struct *tty)
 	struct mxser_port *info = tty->driver_data;
 
 	mxser_flush_buffer(tty);
-	mxser_shutdown(tty);
 	tty_port_hangup(&info->port);
 }
 
@@ -2363,6 +2331,8 @@ static const struct tty_operations mxser_ops = {
 struct tty_port_operations mxser_port_ops = {
 	.carrier_raised = mxser_carrier_raised,
 	.dtr_rts = mxser_dtr_rts,
+	.activate = mxser_activate,
+	.shutdown = mxser_shutdown_port,
 };
 
 /*
diff --git a/drivers/char/n_r3964.c b/drivers/char/n_r3964.c
index 6934025a1ac1..c1d8b54c816d 100644
--- a/drivers/char/n_r3964.c
+++ b/drivers/char/n_r3964.c
@@ -602,7 +602,7 @@ static void receive_char(struct r3964_info *pInfo, const unsigned char c)
 		}
 		break;
 	case R3964_WAIT_FOR_RX_REPEAT:
-		/* FALLTROUGH */
+		/* FALLTHROUGH */
 	case R3964_IDLE:
 		if (c == STX) {
 			/* Prevent rx_queue from overflow: */
diff --git a/drivers/char/nozomi.c b/drivers/char/nozomi.c
index d3400b20444f..2ad7d37afbd0 100644
--- a/drivers/char/nozomi.c
+++ b/drivers/char/nozomi.c
@@ -358,7 +358,7 @@ struct port {
 	u8 update_flow_control;
 	struct ctrl_ul ctrl_ul;
 	struct ctrl_dl ctrl_dl;
-	struct kfifo *fifo_ul;
+	struct kfifo fifo_ul;
 	void __iomem *dl_addr[2];
 	u32 dl_size[2];
 	u8 toggle_dl;
@@ -685,8 +685,6 @@ static int nozomi_read_config_table(struct nozomi *dc)
 		dump_table(dc);
 
 		for (i = PORT_MDM; i < MAX_PORT; i++) {
-			dc->port[i].fifo_ul =
-			    kfifo_alloc(FIFO_BUFFER_SIZE_UL, GFP_ATOMIC, NULL);
 			memset(&dc->port[i].ctrl_dl, 0, sizeof(struct ctrl_dl));
 			memset(&dc->port[i].ctrl_ul, 0, sizeof(struct ctrl_ul));
 		}
@@ -798,7 +796,7 @@ static int send_data(enum port_type index, struct nozomi *dc)
 	struct tty_struct *tty = tty_port_tty_get(&port->port);
 
 	/* Get data from tty and place in buf for now */
-	size = __kfifo_get(port->fifo_ul, dc->send_buf,
+	size = kfifo_out(&port->fifo_ul, dc->send_buf,
 			   ul_size < SEND_BUF_MAX ? ul_size : SEND_BUF_MAX);
 
 	if (size == 0) {
@@ -988,11 +986,11 @@ static int receive_flow_control(struct nozomi *dc)
 
 	} else if (old_ctrl.CTS == 0 && ctrl_dl.CTS == 1) {
 
-		if (__kfifo_len(dc->port[port].fifo_ul)) {
+		if (kfifo_len(&dc->port[port].fifo_ul)) {
 			DBG1("Enable interrupt (0x%04X) on port: %d",
 				enable_ier, port);
 			DBG1("Data in buffer [%d], enable transmit! ",
-				__kfifo_len(dc->port[port].fifo_ul));
+				kfifo_len(&dc->port[port].fifo_ul));
 			enable_transmit_ul(port, dc);
 		} else {
 			DBG1("No data in buffer...");
@@ -1433,6 +1431,16 @@ static int __devinit nozomi_card_init(struct pci_dev *pdev,
 		goto err_free_sbuf;
 	}
 
+	for (i = PORT_MDM; i < MAX_PORT; i++) {
+		if (kfifo_alloc(&dc->port[i].fifo_ul,
+		      FIFO_BUFFER_SIZE_UL, GFP_ATOMIC)) {
+			dev_err(&pdev->dev,
+					"Could not allocate kfifo buffer\n");
+			ret = -ENOMEM;
+			goto err_free_kfifo;
+		}
+	}
+
 	spin_lock_init(&dc->spin_mutex);
 
 	nozomi_setup_private_data(dc);
@@ -1445,7 +1453,7 @@ static int __devinit nozomi_card_init(struct pci_dev *pdev,
 			NOZOMI_NAME, dc);
 	if (unlikely(ret)) {
 		dev_err(&pdev->dev, "can't request irq %d\n", pdev->irq);
-		goto err_free_sbuf;
+		goto err_free_kfifo;
 	}
 
 	DBG1("base_addr: %p", dc->base_addr);
@@ -1464,13 +1472,28 @@ static int __devinit nozomi_card_init(struct pci_dev *pdev,
 	dc->state = NOZOMI_STATE_ENABLED;
 
 	for (i = 0; i < MAX_PORT; i++) {
+		struct device *tty_dev;
+
 		mutex_init(&dc->port[i].tty_sem);
 		tty_port_init(&dc->port[i].port);
-		tty_register_device(ntty_driver, dc->index_start + i,
+		tty_dev = tty_register_device(ntty_driver, dc->index_start + i,
 							&pdev->dev);
+
+		if (IS_ERR(tty_dev)) {
+			ret = PTR_ERR(tty_dev);
+			dev_err(&pdev->dev, "Could not allocate tty?\n");
+			goto err_free_tty;
+		}
 	}
+
 	return 0;
 
+err_free_tty:
+	for (i = dc->index_start; i < dc->index_start + MAX_PORT; ++i)
+		tty_unregister_device(ntty_driver, i);
+err_free_kfifo:
+	for (i = 0; i < MAX_PORT; i++)
+		kfifo_free(&dc->port[i].fifo_ul);
 err_free_sbuf:
 	kfree(dc->send_buf);
 	iounmap(dc->base_addr);
@@ -1536,8 +1559,7 @@ static void __devexit nozomi_card_exit(struct pci_dev *pdev)
 	free_irq(pdev->irq, dc);
 
 	for (i = 0; i < MAX_PORT; i++)
-		if (dc->port[i].fifo_ul)
-			kfifo_free(dc->port[i].fifo_ul);
+		kfifo_free(&dc->port[i].fifo_ul);
 
 	kfree(dc->send_buf);
 
@@ -1629,10 +1651,10 @@ static void ntty_close(struct tty_struct *tty, struct file *file)
 
 	dc->open_ttys--;
 	port->count--;
-	tty_port_tty_set(port, NULL);
 
 	if (port->count == 0) {
 		DBG1("close: %d", nport->token_dl);
+		tty_port_tty_set(port, NULL);
 		spin_lock_irqsave(&dc->spin_mutex, flags);
 		dc->last_ier &= ~(nport->token_dl);
 		writew(dc->last_ier, dc->reg_ier);
@@ -1673,7 +1695,7 @@ static int ntty_write(struct tty_struct *tty, const unsigned char *buffer,
 		goto exit;
 	}
 
-	rval = __kfifo_put(port->fifo_ul, (unsigned char *)buffer, count);
+	rval = kfifo_in(&port->fifo_ul, (unsigned char *)buffer, count);
 
 	/* notify card */
 	if (unlikely(dc == NULL)) {
@@ -1721,7 +1743,7 @@ static int ntty_write_room(struct tty_struct *tty)
 	if (!port->port.count)
 		goto exit;
 
-	room = port->fifo_ul->size - __kfifo_len(port->fifo_ul);
+	room = port->fifo_ul.size - kfifo_len(&port->fifo_ul);
 
 exit:
 	mutex_unlock(&port->tty_sem);
@@ -1878,7 +1900,7 @@ static s32 ntty_chars_in_buffer(struct tty_struct *tty)
 		goto exit_in_buffer;
 	}
 
-	rval = __kfifo_len(port->fifo_ul);
+	rval = kfifo_len(&port->fifo_ul);
 
 exit_in_buffer:
 	return rval;
diff --git a/drivers/char/nvram.c b/drivers/char/nvram.c
index 88cee4099be9..fdbcc9fd6d31 100644
--- a/drivers/char/nvram.c
+++ b/drivers/char/nvram.c
@@ -38,7 +38,6 @@
 #define NVRAM_VERSION	"1.3"
 
 #include <linux/module.h>
-#include <linux/smp_lock.h>
 #include <linux/nvram.h>
 
 #define PC		1
@@ -111,6 +110,7 @@
 #include <linux/spinlock.h>
 #include <linux/io.h>
 #include <linux/uaccess.h>
+#include <linux/smp_lock.h>
 
 #include <asm/system.h>
 
@@ -214,7 +214,6 @@ void nvram_set_checksum(void)
 
 static loff_t nvram_llseek(struct file *file, loff_t offset, int origin)
 {
-	lock_kernel();
 	switch (origin) {
 	case 0:
 		/* nothing to do */
@@ -226,7 +225,7 @@ static loff_t nvram_llseek(struct file *file, loff_t offset, int origin)
 		offset += NVRAM_BYTES;
 		break;
 	}
-	unlock_kernel();
+
 	return (offset >= 0) ? (file->f_pos = offset) : -EINVAL;
 }
 
@@ -265,10 +264,16 @@ static ssize_t nvram_write(struct file *file, const char __user *buf,
 	unsigned char contents[NVRAM_BYTES];
 	unsigned i = *ppos;
 	unsigned char *tmp;
-	int len;
 
-	len = (NVRAM_BYTES - i) < count ? (NVRAM_BYTES - i) : count;
-	if (copy_from_user(contents, buf, len))
+	if (i >= NVRAM_BYTES)
+		return 0;	/* Past EOF */
+
+	if (count > NVRAM_BYTES - i)
+		count = NVRAM_BYTES - i;
+	if (count > NVRAM_BYTES)
+		return -EFAULT;	/* Can't happen, but prove it to gcc */
+
+	if (copy_from_user(contents, buf, count))
 		return -EFAULT;
 
 	spin_lock_irq(&rtc_lock);
@@ -276,7 +281,7 @@ static ssize_t nvram_write(struct file *file, const char __user *buf,
 	if (!__nvram_check_checksum())
 		goto checksum_err;
 
-	for (tmp = contents; count-- > 0 && i < NVRAM_BYTES; ++i, ++tmp)
+	for (tmp = contents; count--; ++i, ++tmp)
 		__nvram_write_byte(*tmp, i);
 
 	__nvram_set_checksum();
diff --git a/drivers/char/nwflash.c b/drivers/char/nwflash.c
index 8c7df5ba088f..f80810901db6 100644
--- a/drivers/char/nwflash.c
+++ b/drivers/char/nwflash.c
@@ -27,6 +27,7 @@
 #include <linux/init.h>
 #include <linux/smp_lock.h>
 #include <linux/mutex.h>
+#include <linux/jiffies.h>
 
 #include <asm/hardware/dec21285.h>
 #include <asm/io.h>
diff --git a/drivers/char/pc8736x_gpio.c b/drivers/char/pc8736x_gpio.c
index 3f7da8cf3a80..8ecbcc174c15 100644
--- a/drivers/char/pc8736x_gpio.c
+++ b/drivers/char/pc8736x_gpio.c
@@ -20,7 +20,6 @@
 #include <linux/mutex.h>
 #include <linux/nsc_gpio.h>
 #include <linux/platform_device.h>
-#include <linux/smp_lock.h>
 #include <asm/uaccess.h>
 
 #define DEVNAME "pc8736x_gpio"
@@ -223,7 +222,6 @@ static int pc8736x_gpio_open(struct inode *inode, struct file *file)
 	unsigned m = iminor(inode);
 	file->private_data = &pc8736x_gpio_ops;
 
-	cycle_kernel_lock();
 	dev_dbg(&pdev->dev, "open %d\n", m);
 
 	if (m >= PC8736X_GPIO_CT)
diff --git a/drivers/char/pcmcia/ipwireless/tty.c b/drivers/char/pcmcia/ipwireless/tty.c
index 674b3ab3587d..2bb7874a6899 100644
--- a/drivers/char/pcmcia/ipwireless/tty.c
+++ b/drivers/char/pcmcia/ipwireless/tty.c
@@ -603,7 +603,7 @@ void ipwireless_tty_free(struct ipw_tty *tty)
 	}
 }
 
-static struct tty_operations tty_ops = {
+static const struct tty_operations tty_ops = {
 	.open = ipw_open,
 	.close = ipw_close,
 	.hangup = ipw_hangup,
diff --git a/drivers/char/pty.c b/drivers/char/pty.c
index d86c0bc05c1c..385c44b3034f 100644
--- a/drivers/char/pty.c
+++ b/drivers/char/pty.c
@@ -659,7 +659,7 @@ static int __ptmx_open(struct inode *inode, struct file *filp)
 	if (!retval)
 		return 0;
 out1:
-	tty_release_dev(filp);
+	tty_release(inode, filp);
 	return retval;
 out:
 	devpts_kill_index(inode, index);
diff --git a/drivers/char/random.c b/drivers/char/random.c
index dcd08635cf1b..8258982b49ec 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -1245,12 +1245,8 @@ static int proc_do_uuid(ctl_table *table, int write,
 	if (uuid[8] == 0)
 		generate_random_uuid(uuid);
 
-	sprintf(buf, "%02x%02x%02x%02x-%02x%02x-%02x%02x-%02x%02x-"
-		"%02x%02x%02x%02x%02x%02x",
-		uuid[0],  uuid[1],  uuid[2],  uuid[3],
-		uuid[4],  uuid[5],  uuid[6],  uuid[7],
-		uuid[8],  uuid[9],  uuid[10], uuid[11],
-		uuid[12], uuid[13], uuid[14], uuid[15]);
+	sprintf(buf, "%pU", uuid);
+
 	fake_table.data = buf;
 	fake_table.maxlen = sizeof(buf);
 
@@ -1310,7 +1306,7 @@ ctl_table random_table[] = {
 
 /********************************************************************
  *
- * Random funtions for networking
+ * Random functions for networking
  *
  ********************************************************************/
 
diff --git a/drivers/char/rio/route.h b/drivers/char/rio/route.h
index 20ed73f3fd7b..46e963771c30 100644
--- a/drivers/char/rio/route.h
+++ b/drivers/char/rio/route.h
@@ -67,7 +67,7 @@
 typedef struct COST_ROUTE COST_ROUTE;
 struct COST_ROUTE {
 	unsigned char cost;	/* Cost down this link */
-	unsigned char route[NODE_BYTES];	/* Nodes thorough this route */
+	unsigned char route[NODE_BYTES];	/* Nodes through this route */
 };
 
 typedef struct ROUTE_STR ROUTE_STR;
diff --git a/drivers/char/riscom8.c b/drivers/char/riscom8.c
index 3cfa22d469e0..0a8d1e56c993 100644
--- a/drivers/char/riscom8.c
+++ b/drivers/char/riscom8.c
@@ -793,26 +793,21 @@ static void rc_change_speed(struct tty_struct *tty, struct riscom_board *bp,
 }
 
 /* Must be called with interrupts enabled */
-static int rc_setup_port(struct tty_struct *tty, struct riscom_board *bp,
-						struct riscom_port *port)
+static int rc_activate_port(struct tty_port *port, struct tty_struct *tty)
 {
+	struct riscom_port *rp = container_of(port, struct riscom_port, port);
+	struct riscom_board *bp = port_Board(rp);
 	unsigned long flags;
 
-	if (port->port.flags & ASYNC_INITIALIZED)
-		return 0;
-
-	if (tty_port_alloc_xmit_buf(&port->port) < 0)
+	if (tty_port_alloc_xmit_buf(port) < 0)
 		return -ENOMEM;
 
 	spin_lock_irqsave(&riscom_lock, flags);
 
 	clear_bit(TTY_IO_ERROR, &tty->flags);
-	if (port->port.count == 1)
-		bp->count++;
-	port->xmit_cnt = port->xmit_head = port->xmit_tail = 0;
-	rc_change_speed(tty, bp, port);
-	port->port.flags |= ASYNC_INITIALIZED;
-
+	bp->count++;
+	rp->xmit_cnt = rp->xmit_head = rp->xmit_tail = 0;
+	rc_change_speed(tty, bp, rp);
 	spin_unlock_irqrestore(&riscom_lock, flags);
 	return 0;
 }
@@ -821,9 +816,6 @@ static int rc_setup_port(struct tty_struct *tty, struct riscom_board *bp,
 static void rc_shutdown_port(struct tty_struct *tty,
 			struct riscom_board *bp, struct riscom_port *port)
 {
-	if (!(port->port.flags & ASYNC_INITIALIZED))
-		return;
-
 #ifdef RC_REPORT_OVERRUN
 	printk(KERN_INFO "rc%d: port %d: Total %ld overruns were detected.\n",
 	       board_No(bp), port_No(port), port->overrun);
@@ -840,11 +832,6 @@ static void rc_shutdown_port(struct tty_struct *tty,
 	}
 #endif
 	tty_port_free_xmit_buf(&port->port);
-	if (C_HUPCL(tty)) {
-		/* Drop DTR */
-		bp->DTR |= (1u << port_No(port));
-		rc_out(bp, RC_DTR, bp->DTR);
-	}
 
 	/* Select port */
 	rc_out(bp, CD180_CAR, port_No(port));
@@ -856,7 +843,6 @@ static void rc_shutdown_port(struct tty_struct *tty,
 	rc_out(bp, CD180_IER, port->IER);
 
 	set_bit(TTY_IO_ERROR, &tty->flags);
-	port->port.flags &= ~ASYNC_INITIALIZED;
 
 	if (--bp->count < 0)  {
 		printk(KERN_INFO "rc%d: rc_shutdown_port: "
@@ -889,6 +875,20 @@ static int carrier_raised(struct tty_port *port)
 	return CD;
 }
 
+static void dtr_rts(struct tty_port *port, int onoff)
+{
+	struct riscom_port *p = container_of(port, struct riscom_port, port);
+	struct riscom_board *bp = port_Board(p);
+	unsigned long flags;
+
+	spin_lock_irqsave(&riscom_lock, flags);
+	bp->DTR &= ~(1u << port_No(p));
+	if (onoff == 0)
+		bp->DTR |= (1u << port_No(p));
+	rc_out(bp, RC_DTR, bp->DTR);
+	spin_unlock_irqrestore(&riscom_lock, flags);
+}
+
 static int rc_open(struct tty_struct *tty, struct file *filp)
 {
 	int board;
@@ -909,14 +909,7 @@ static int rc_open(struct tty_struct *tty, struct file *filp)
 	if (error)
 		return error;
 
-	port->port.count++;
-	tty->driver_data = port;
-	tty_port_tty_set(&port->port, tty);
-
-	error = rc_setup_port(tty, bp, port);
-	if (error == 0)
-		error = tty_port_block_til_ready(&port->port, tty, filp);
-	return error;
+	return tty_port_open(&port->port, tty, filp);
 }
 
 static void rc_flush_buffer(struct tty_struct *tty)
@@ -950,24 +943,23 @@ static void rc_close_port(struct tty_port *port)
 
 	spin_lock_irqsave(&riscom_lock, flags);
 	rp->IER &= ~IER_RXD;
-	if (port->flags & ASYNC_INITIALIZED) {
-		rp->IER &= ~IER_TXRDY;
-		rp->IER |= IER_TXEMPTY;
-		rc_out(bp, CD180_CAR, port_No(rp));
-		rc_out(bp, CD180_IER, rp->IER);
-		/*
-		 * Before we drop DTR, make sure the UART transmitter
-		 * has completely drained; this is especially
-		 * important if there is a transmit FIFO!
-		 */
-		timeout = jiffies + HZ;
-		while (rp->IER & IER_TXEMPTY) {
-			spin_unlock_irqrestore(&riscom_lock, flags);
-			msleep_interruptible(jiffies_to_msecs(rp->timeout));
-			spin_lock_irqsave(&riscom_lock, flags);
-			if (time_after(jiffies, timeout))
-				break;
-		}
+
+	rp->IER &= ~IER_TXRDY;
+	rp->IER |= IER_TXEMPTY;
+	rc_out(bp, CD180_CAR, port_No(rp));
+	rc_out(bp, CD180_IER, rp->IER);
+	/*
+	 * Before we drop DTR, make sure the UART transmitter
+	 * has completely drained; this is especially
+	 * important if there is a transmit FIFO!
+	 */
+	timeout = jiffies + HZ;
+	while (rp->IER & IER_TXEMPTY) {
+		spin_unlock_irqrestore(&riscom_lock, flags);
+		msleep_interruptible(jiffies_to_msecs(rp->timeout));
+		spin_lock_irqsave(&riscom_lock, flags);
+		if (time_after(jiffies, timeout))
+			break;
 	}
 	rc_shutdown_port(port->tty, bp, rp);
 	spin_unlock_irqrestore(&riscom_lock, flags);
@@ -1354,7 +1346,6 @@ static void rc_hangup(struct tty_struct *tty)
 	if (rc_paranoia_check(port, tty->name, "rc_hangup"))
 		return;
 
-	rc_shutdown_port(tty, port_Board(port), port);
 	tty_port_hangup(&port->port);
 }
 
@@ -1401,7 +1392,9 @@ static const struct tty_operations riscom_ops = {
 
 static const struct tty_port_operations riscom_port_ops = {
 	.carrier_raised = carrier_raised,
+	.dtr_rts = dtr_rts,
 	.shutdown = rc_close_port,
+	.activate = rc_activate_port,
 };
 
 
diff --git a/drivers/char/scx200_gpio.c b/drivers/char/scx200_gpio.c
index 1d9100561c8a..99e5272e3c53 100644
--- a/drivers/char/scx200_gpio.c
+++ b/drivers/char/scx200_gpio.c
@@ -12,7 +12,6 @@
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/platform_device.h>
-#include <linux/smp_lock.h>
 #include <asm/uaccess.h>
 #include <asm/io.h>
 
@@ -52,7 +51,6 @@ static int scx200_gpio_open(struct inode *inode, struct file *file)
 	unsigned m = iminor(inode);
 	file->private_data = &scx200_gpio_ops;
 
-	cycle_kernel_lock();
 	if (m >= MAX_PINS)
 		return -EINVAL;
 	return nonseekable_open(inode, file);
diff --git a/drivers/char/sonypi.c b/drivers/char/sonypi.c
index 8c262aaf7c26..bba727c3807e 100644
--- a/drivers/char/sonypi.c
+++ b/drivers/char/sonypi.c
@@ -50,7 +50,6 @@
 #include <linux/err.h>
 #include <linux/kfifo.h>
 #include <linux/platform_device.h>
-#include <linux/smp_lock.h>
 
 #include <asm/uaccess.h>
 #include <asm/io.h>
@@ -487,7 +486,7 @@ static struct sonypi_device {
 	int camera_power;
 	int bluetooth_power;
 	struct mutex lock;
-	struct kfifo *fifo;
+	struct kfifo fifo;
 	spinlock_t fifo_lock;
 	wait_queue_head_t fifo_proc_list;
 	struct fasync_struct *fifo_async;
@@ -496,7 +495,7 @@ static struct sonypi_device {
 	struct input_dev *input_jog_dev;
 	struct input_dev *input_key_dev;
 	struct work_struct input_work;
-	struct kfifo *input_fifo;
+	struct kfifo input_fifo;
 	spinlock_t input_fifo_lock;
 } sonypi_device;
 
@@ -777,8 +776,9 @@ static void input_keyrelease(struct work_struct *work)
 {
 	struct sonypi_keypress kp;
 
-	while (kfifo_get(sonypi_device.input_fifo, (unsigned char *)&kp,
-			 sizeof(kp)) == sizeof(kp)) {
+	while (kfifo_out_locked(&sonypi_device.input_fifo, (unsigned char *)&kp,
+			 sizeof(kp), &sonypi_device.input_fifo_lock)
+			== sizeof(kp)) {
 		msleep(10);
 		input_report_key(kp.dev, kp.key, 0);
 		input_sync(kp.dev);
@@ -827,8 +827,9 @@ static void sonypi_report_input_event(u8 event)
 	if (kp.dev) {
 		input_report_key(kp.dev, kp.key, 1);
 		input_sync(kp.dev);
-		kfifo_put(sonypi_device.input_fifo,
-			  (unsigned char *)&kp, sizeof(kp));
+		kfifo_in_locked(&sonypi_device.input_fifo,
+			(unsigned char *)&kp, sizeof(kp),
+			&sonypi_device.input_fifo_lock);
 		schedule_work(&sonypi_device.input_work);
 	}
 }
@@ -880,7 +881,8 @@ found:
 		acpi_bus_generate_proc_event(sonypi_acpi_device, 1, event);
 #endif
 
-	kfifo_put(sonypi_device.fifo, (unsigned char *)&event, sizeof(event));
+	kfifo_in_locked(&sonypi_device.fifo, (unsigned char *)&event,
+			sizeof(event), &sonypi_device.fifo_lock);
 	kill_fasync(&sonypi_device.fifo_async, SIGIO, POLL_IN);
 	wake_up_interruptible(&sonypi_device.fifo_proc_list);
 
@@ -902,14 +904,13 @@ static int sonypi_misc_release(struct inode *inode, struct file *file)
 
 static int sonypi_misc_open(struct inode *inode, struct file *file)
 {
-	lock_kernel();
 	mutex_lock(&sonypi_device.lock);
 	/* Flush input queue on first open */
 	if (!sonypi_device.open_count)
-		kfifo_reset(sonypi_device.fifo);
+		kfifo_reset(&sonypi_device.fifo);
 	sonypi_device.open_count++;
 	mutex_unlock(&sonypi_device.lock);
-	unlock_kernel();
+
 	return 0;
 }
 
@@ -919,17 +920,18 @@ static ssize_t sonypi_misc_read(struct file *file, char __user *buf,
 	ssize_t ret;
 	unsigned char c;
 
-	if ((kfifo_len(sonypi_device.fifo) == 0) &&
+	if ((kfifo_len(&sonypi_device.fifo) == 0) &&
 	    (file->f_flags & O_NONBLOCK))
 		return -EAGAIN;
 
 	ret = wait_event_interruptible(sonypi_device.fifo_proc_list,
-				       kfifo_len(sonypi_device.fifo) != 0);
+				       kfifo_len(&sonypi_device.fifo) != 0);
 	if (ret)
 		return ret;
 
 	while (ret < count &&
-	       (kfifo_get(sonypi_device.fifo, &c, sizeof(c)) == sizeof(c))) {
+	       (kfifo_out_locked(&sonypi_device.fifo, &c, sizeof(c),
+				 &sonypi_device.fifo_lock) == sizeof(c))) {
 		if (put_user(c, buf++))
 			return -EFAULT;
 		ret++;
@@ -946,15 +948,15 @@ static ssize_t sonypi_misc_read(struct file *file, char __user *buf,
 static unsigned int sonypi_misc_poll(struct file *file, poll_table *wait)
 {
 	poll_wait(file, &sonypi_device.fifo_proc_list, wait);
-	if (kfifo_len(sonypi_device.fifo))
+	if (kfifo_len(&sonypi_device.fifo))
 		return POLLIN | POLLRDNORM;
 	return 0;
 }
 
-static int sonypi_misc_ioctl(struct inode *ip, struct file *fp,
+static long sonypi_misc_ioctl(struct file *fp,
 			     unsigned int cmd, unsigned long arg)
 {
-	int ret = 0;
+	long ret = 0;
 	void __user *argp = (void __user *)arg;
 	u8 val8;
 	u16 val16;
@@ -1070,7 +1072,8 @@ static const struct file_operations sonypi_misc_fops = {
 	.open		= sonypi_misc_open,
 	.release	= sonypi_misc_release,
 	.fasync		= sonypi_misc_fasync,
-	.ioctl		= sonypi_misc_ioctl,
+	.unlocked_ioctl	= sonypi_misc_ioctl,
+	.llseek		= no_llseek,
 };
 
 static struct miscdevice sonypi_misc_device = {
@@ -1313,11 +1316,10 @@ static int __devinit sonypi_probe(struct platform_device *dev)
 			"http://www.linux.it/~malattia/wiki/index.php/Sony_drivers\n");
 
 	spin_lock_init(&sonypi_device.fifo_lock);
-	sonypi_device.fifo = kfifo_alloc(SONYPI_BUF_SIZE, GFP_KERNEL,
-					 &sonypi_device.fifo_lock);
-	if (IS_ERR(sonypi_device.fifo)) {
+	error = kfifo_alloc(&sonypi_device.fifo, SONYPI_BUF_SIZE, GFP_KERNEL);
+	if (error) {
 		printk(KERN_ERR "sonypi: kfifo_alloc failed\n");
-		return PTR_ERR(sonypi_device.fifo);
+		return error;
 	}
 
 	init_waitqueue_head(&sonypi_device.fifo_proc_list);
@@ -1393,12 +1395,10 @@ static int __devinit sonypi_probe(struct platform_device *dev)
 		}
 
 		spin_lock_init(&sonypi_device.input_fifo_lock);
-		sonypi_device.input_fifo =
-			kfifo_alloc(SONYPI_BUF_SIZE, GFP_KERNEL,
-				    &sonypi_device.input_fifo_lock);
-		if (IS_ERR(sonypi_device.input_fifo)) {
+		error = kfifo_alloc(&sonypi_device.input_fifo, SONYPI_BUF_SIZE,
+				GFP_KERNEL);
+		if (error) {
 			printk(KERN_ERR "sonypi: kfifo_alloc failed\n");
-			error = PTR_ERR(sonypi_device.input_fifo);
 			goto err_inpdev_unregister;
 		}
 
@@ -1423,7 +1423,7 @@ static int __devinit sonypi_probe(struct platform_device *dev)
 		pci_disable_device(pcidev);
  err_put_pcidev:
 	pci_dev_put(pcidev);
-	kfifo_free(sonypi_device.fifo);
+	kfifo_free(&sonypi_device.fifo);
 
 	return error;
 }
@@ -1438,7 +1438,7 @@ static int __devexit sonypi_remove(struct platform_device *dev)
 	if (useinput) {
 		input_unregister_device(sonypi_device.input_key_dev);
 		input_unregister_device(sonypi_device.input_jog_dev);
-		kfifo_free(sonypi_device.input_fifo);
+		kfifo_free(&sonypi_device.input_fifo);
 	}
 
 	misc_deregister(&sonypi_misc_device);
@@ -1451,7 +1451,7 @@ static int __devexit sonypi_remove(struct platform_device *dev)
 		pci_dev_put(sonypi_device.dev);
 	}
 
-	kfifo_free(sonypi_device.fifo);
+	kfifo_free(&sonypi_device.fifo);
 
 	return 0;
 }
diff --git a/drivers/char/stallion.c b/drivers/char/stallion.c
index db6dcfa35ba0..0e511d61f544 100644
--- a/drivers/char/stallion.c
+++ b/drivers/char/stallion.c
@@ -407,7 +407,7 @@ static unsigned int	stl_baudrates[] = {
  *	Declare all those functions in this driver!
  */
 
-static int	stl_memioctl(struct inode *ip, struct file *fp, unsigned int cmd, unsigned long arg);
+static long	stl_memioctl(struct file *fp, unsigned int cmd, unsigned long arg);
 static int	stl_brdinit(struct stlbrd *brdp);
 static int	stl_getportstats(struct tty_struct *tty, struct stlport *portp, comstats_t __user *cp);
 static int	stl_clrportstats(struct stlport *portp, comstats_t __user *cp);
@@ -607,7 +607,7 @@ static unsigned int	sc26198_baudtable[] = {
  */
 static const struct file_operations	stl_fsiomem = {
 	.owner		= THIS_MODULE,
-	.ioctl		= stl_memioctl,
+	.unlocked_ioctl	= stl_memioctl,
 };
 
 static struct class *stallion_class;
@@ -702,6 +702,24 @@ static struct stlbrd *stl_allocbrd(void)
 
 /*****************************************************************************/
 
+static int stl_activate(struct tty_port *port, struct tty_struct *tty)
+{
+	struct stlport *portp = container_of(port, struct stlport, port);
+	if (!portp->tx.buf) {
+		portp->tx.buf = kmalloc(STL_TXBUFSIZE, GFP_KERNEL);
+		if (!portp->tx.buf)
+			return -ENOMEM;
+		portp->tx.head = portp->tx.buf;
+		portp->tx.tail = portp->tx.buf;
+	}
+	stl_setport(portp, tty->termios);
+	portp->sigs = stl_getsignals(portp);
+	stl_setsignals(portp, 1, 1);
+	stl_enablerxtx(portp, 1, 1);
+	stl_startrxtx(portp, 1, 0);
+	return 0;
+}
+
 static int stl_open(struct tty_struct *tty, struct file *filp)
 {
 	struct stlport	*portp;
@@ -737,32 +755,8 @@ static int stl_open(struct tty_struct *tty, struct file *filp)
 	if (portp == NULL)
 		return -ENODEV;
 	port = &portp->port;
+	return tty_port_open(&portp->port, tty, filp);
 
-/*
- *	On the first open of the device setup the port hardware, and
- *	initialize the per port data structure.
- */
-	tty_port_tty_set(port, tty);
-	tty->driver_data = portp;
-	port->count++;
-
-	if ((port->flags & ASYNC_INITIALIZED) == 0) {
-		if (!portp->tx.buf) {
-			portp->tx.buf = kmalloc(STL_TXBUFSIZE, GFP_KERNEL);
-			if (!portp->tx.buf)
-				return -ENOMEM;
-			portp->tx.head = portp->tx.buf;
-			portp->tx.tail = portp->tx.buf;
-		}
-		stl_setport(portp, tty->termios);
-		portp->sigs = stl_getsignals(portp);
-		stl_setsignals(portp, 1, 1);
-		stl_enablerxtx(portp, 1, 1);
-		stl_startrxtx(portp, 1, 0);
-		clear_bit(TTY_IO_ERROR, &tty->flags);
-		port->flags |= ASYNC_INITIALIZED;
-	}
-	return tty_port_block_til_ready(port, tty, filp);
 }
 
 /*****************************************************************************/
@@ -826,38 +820,12 @@ static void stl_waituntilsent(struct tty_struct *tty, int timeout)
 
 /*****************************************************************************/
 
-static void stl_close(struct tty_struct *tty, struct file *filp)
+static void stl_shutdown(struct tty_port *port)
 {
-	struct stlport	*portp;
-	struct tty_port *port;
-	unsigned long	flags;
-
-	pr_debug("stl_close(tty=%p,filp=%p)\n", tty, filp);
-
-	portp = tty->driver_data;
-	BUG_ON(portp == NULL);
-
-	port = &portp->port;
-
-	if (tty_port_close_start(port, tty, filp) == 0)
-		return;
-/*
- *	May want to wait for any data to drain before closing. The BUSY
- *	flag keeps track of whether we are still sending or not - it is
- *	very accurate for the cd1400, not quite so for the sc26198.
- *	(The sc26198 has no "end-of-data" interrupt only empty FIFO)
- */
-	stl_waituntilsent(tty, (HZ / 2));
-
-	spin_lock_irqsave(&port->lock, flags);
-	portp->port.flags &= ~ASYNC_INITIALIZED;
-	spin_unlock_irqrestore(&port->lock, flags);
-
+	struct stlport *portp = container_of(port, struct stlport, port);
 	stl_disableintrs(portp);
-	if (tty->termios->c_cflag & HUPCL)
-		stl_setsignals(portp, 0, 0);
 	stl_enablerxtx(portp, 0, 0);
-	stl_flushbuffer(tty);
+	stl_flush(portp);
 	portp->istate = 0;
 	if (portp->tx.buf != NULL) {
 		kfree(portp->tx.buf);
@@ -865,9 +833,16 @@ static void stl_close(struct tty_struct *tty, struct file *filp)
 		portp->tx.head = NULL;
 		portp->tx.tail = NULL;
 	}
+}
+
+static void stl_close(struct tty_struct *tty, struct file *filp)
+{
+	struct stlport*portp;
+	pr_debug("stl_close(tty=%p,filp=%p)\n", tty, filp);
 
-	tty_port_close_end(port, tty);
-	tty_port_tty_set(port, NULL);
+	portp = tty->driver_data;
+	BUG_ON(portp == NULL);
+	tty_port_close(&portp->port, tty, filp);
 }
 
 /*****************************************************************************/
@@ -1314,35 +1289,12 @@ static void stl_stop(struct tty_struct *tty)
 
 static void stl_hangup(struct tty_struct *tty)
 {
-	struct stlport	*portp;
-	struct tty_port *port;
-	unsigned long flags;
-
+	struct stlport	*portp = tty->driver_data;
 	pr_debug("stl_hangup(tty=%p)\n", tty);
 
-	portp = tty->driver_data;
 	if (portp == NULL)
 		return;
-	port = &portp->port;
-
-	spin_lock_irqsave(&port->lock, flags);
-	port->flags &= ~ASYNC_INITIALIZED;
-	spin_unlock_irqrestore(&port->lock, flags);
-
-	stl_disableintrs(portp);
-	if (tty->termios->c_cflag & HUPCL)
-		stl_setsignals(portp, 0, 0);
-	stl_enablerxtx(portp, 0, 0);
-	stl_flushbuffer(tty);
-	portp->istate = 0;
-	set_bit(TTY_IO_ERROR, &tty->flags);
-	if (portp->tx.buf != NULL) {
-		kfree(portp->tx.buf);
-		portp->tx.buf = NULL;
-		portp->tx.head = NULL;
-		portp->tx.tail = NULL;
-	}
-	tty_port_hangup(port);
+	tty_port_hangup(&portp->port);
 }
 
 /*****************************************************************************/
@@ -2486,18 +2438,19 @@ static int stl_getbrdstruct(struct stlbrd __user *arg)
  *	collection.
  */
 
-static int stl_memioctl(struct inode *ip, struct file *fp, unsigned int cmd, unsigned long arg)
+static long stl_memioctl(struct file *fp, unsigned int cmd, unsigned long arg)
 {
 	int	brdnr, rc;
 	void __user *argp = (void __user *)arg;
 
-	pr_debug("stl_memioctl(ip=%p,fp=%p,cmd=%x,arg=%lx)\n", ip, fp, cmd,arg);
+	pr_debug("stl_memioctl(fp=%p,cmd=%x,arg=%lx)\n", fp, cmd,arg);
 
-	brdnr = iminor(ip);
+	brdnr = iminor(fp->f_dentry->d_inode);
 	if (brdnr >= STL_MAXBRDS)
 		return -ENODEV;
 	rc = 0;
 
+	lock_kernel();
 	switch (cmd) {
 	case COM_GETPORTSTATS:
 		rc = stl_getportstats(NULL, NULL, argp);
@@ -2518,7 +2471,7 @@ static int stl_memioctl(struct inode *ip, struct file *fp, unsigned int cmd, uns
 		rc = -ENOIOCTLCMD;
 		break;
 	}
-
+	unlock_kernel();
 	return rc;
 }
 
@@ -2549,6 +2502,8 @@ static const struct tty_operations stl_ops = {
 static const struct tty_port_operations stl_port_ops = {
 	.carrier_raised = stl_carrier_raised,
 	.dtr_rts = stl_dtr_rts,
+	.activate = stl_activate,
+	.shutdown = stl_shutdown,
 };
 
 /*****************************************************************************/
diff --git a/drivers/char/sysrq.c b/drivers/char/sysrq.c
index 44203ff599da..1ae2de7d8b4f 100644
--- a/drivers/char/sysrq.c
+++ b/drivers/char/sysrq.c
@@ -339,7 +339,7 @@ static struct sysrq_key_op sysrq_term_op = {
 
 static void moom_callback(struct work_struct *ignored)
 {
-	out_of_memory(node_zonelist(0, GFP_KERNEL), GFP_KERNEL, 0);
+	out_of_memory(node_zonelist(0, GFP_KERNEL), GFP_KERNEL, 0, NULL);
 }
 
 static DECLARE_WORK(moom_work, moom_callback);
diff --git a/drivers/char/tb0219.c b/drivers/char/tb0219.c
index b3ec9b10e292..cad4eb65f13d 100644
--- a/drivers/char/tb0219.c
+++ b/drivers/char/tb0219.c
@@ -21,7 +21,6 @@
 #include <linux/fs.h>
 #include <linux/init.h>
 #include <linux/module.h>
-#include <linux/smp_lock.h>
 
 #include <asm/io.h>
 #include <asm/reboot.h>
@@ -38,7 +37,7 @@ MODULE_PARM_DESC(major, "Major device number");
 
 static void (*old_machine_restart)(char *command);
 static void __iomem *tb0219_base;
-static spinlock_t tb0219_lock;
+static DEFINE_SPINLOCK(tb0219_lock);
 
 #define tb0219_read(offset)		readw(tb0219_base + (offset))
 #define tb0219_write(offset, value)	writew((value), tb0219_base + (offset))
@@ -237,7 +236,6 @@ static int tanbac_tb0219_open(struct inode *inode, struct file *file)
 {
 	unsigned int minor;
 
-	cycle_kernel_lock();
 	minor = iminor(inode);
 	switch (minor) {
 	case 0:
@@ -306,8 +304,6 @@ static int __devinit tb0219_probe(struct platform_device *dev)
 		return retval;
 	}
 
-	spin_lock_init(&tb0219_lock);
-
 	old_machine_restart = _machine_restart;
 	_machine_restart = tb0219_restart;
 
diff --git a/drivers/char/toshiba.c b/drivers/char/toshiba.c
index 663cd15d7c78..f8bc79f6de34 100644
--- a/drivers/char/toshiba.c
+++ b/drivers/char/toshiba.c
@@ -68,7 +68,7 @@
 #include <linux/stat.h>
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
-
+#include <linux/smp_lock.h>
 #include <linux/toshiba.h>
 
 #define TOSH_MINOR_DEV 181
@@ -88,13 +88,13 @@ static int tosh_date;
 static int tosh_sci;
 static int tosh_fan;
 
-static int tosh_ioctl(struct inode *, struct file *, unsigned int,
+static long tosh_ioctl(struct file *, unsigned int,
 	unsigned long);
 
 
 static const struct file_operations tosh_fops = {
 	.owner		= THIS_MODULE,
-	.ioctl		= tosh_ioctl,
+	.unlocked_ioctl	= tosh_ioctl,
 };
 
 static struct miscdevice tosh_device = {
@@ -252,8 +252,7 @@ int tosh_smm(SMMRegisters *regs)
 EXPORT_SYMBOL(tosh_smm);
 
 
-static int tosh_ioctl(struct inode *ip, struct file *fp, unsigned int cmd,
-	unsigned long arg)
+static long tosh_ioctl(struct file *fp, unsigned int cmd, unsigned long arg)
 {
 	SMMRegisters regs;
 	SMMRegisters __user *argp = (SMMRegisters __user *)arg;
@@ -275,13 +274,16 @@ static int tosh_ioctl(struct inode *ip, struct file *fp, unsigned int cmd,
 				return -EINVAL;
 
 			/* do we need to emulate the fan ? */
+			lock_kernel();
 			if (tosh_fan==1) {
 				if (((ax==0xf300) || (ax==0xf400)) && (bx==0x0004)) {
 					err = tosh_emulate_fan(&regs);
+					unlock_kernel();
 					break;
 				}
 			}
 			err = tosh_smm(&regs);
+			unlock_kernel();
 			break;
 		default:
 			return -EINVAL;
diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index 59499ee0fe6a..c6f3b48be9dd 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -142,7 +142,6 @@ ssize_t redirected_tty_write(struct file *, const char __user *,
 							size_t, loff_t *);
 static unsigned int tty_poll(struct file *, poll_table *);
 static int tty_open(struct inode *, struct file *);
-static int tty_release(struct inode *, struct file *);
 long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
 #ifdef CONFIG_COMPAT
 static long tty_compat_ioctl(struct file *file, unsigned int cmd,
@@ -506,8 +505,6 @@ static void do_tty_hangup(struct work_struct *work)
 	if (!tty)
 		return;
 
-	/* inuse_filps is protected by the single kernel lock */
-	lock_kernel();
 
 	spin_lock(&redirect_lock);
 	if (redirect && redirect->private_data == tty) {
@@ -516,7 +513,10 @@ static void do_tty_hangup(struct work_struct *work)
 	}
 	spin_unlock(&redirect_lock);
 
+	/* inuse_filps is protected by the single kernel lock */
+	lock_kernel();
 	check_tty_count(tty, "do_tty_hangup");
+
 	file_list_lock();
 	/* This breaks for file handles being sent over AF_UNIX sockets ? */
 	list_for_each_entry(filp, &tty->tty_files, f_u.fu_list) {
@@ -708,6 +708,8 @@ void disassociate_ctty(int on_exit)
 	struct tty_struct *tty;
 	struct pid *tty_pgrp = NULL;
 
+	if (!current->signal->leader)
+		return;
 
 	tty = get_current_tty();
 	if (tty) {
@@ -773,8 +775,7 @@ void no_tty(void)
 {
 	struct task_struct *tsk = current;
 	lock_kernel();
-	if (tsk->signal->leader)
-		disassociate_ctty(0);
+	disassociate_ctty(0);
 	unlock_kernel();
 	proc_clear_tty(tsk);
 }
@@ -1017,14 +1018,16 @@ out:
 
 void tty_write_message(struct tty_struct *tty, char *msg)
 {
-	lock_kernel();
 	if (tty) {
 		mutex_lock(&tty->atomic_write_lock);
-		if (tty->ops->write && !test_bit(TTY_CLOSING, &tty->flags))
+		lock_kernel();
+		if (tty->ops->write && !test_bit(TTY_CLOSING, &tty->flags)) {
+			unlock_kernel();
 			tty->ops->write(tty, msg, strlen(msg));
+		} else
+			unlock_kernel();
 		tty_write_unlock(tty);
 	}
-	unlock_kernel();
 	return;
 }
 
@@ -1202,14 +1205,21 @@ static int tty_driver_install_tty(struct tty_driver *driver,
 						struct tty_struct *tty)
 {
 	int idx = tty->index;
+	int ret;
 
-	if (driver->ops->install)
-		return driver->ops->install(driver, tty);
+	if (driver->ops->install) {
+		lock_kernel();
+		ret = driver->ops->install(driver, tty);
+		unlock_kernel();
+		return ret;
+	}
 
 	if (tty_init_termios(tty) == 0) {
+		lock_kernel();
 		tty_driver_kref_get(driver);
 		tty->count++;
 		driver->ttys[idx] = tty;
+		unlock_kernel();
 		return 0;
 	}
 	return -ENOMEM;
@@ -1302,10 +1312,14 @@ struct tty_struct *tty_init_dev(struct tty_driver *driver, int idx,
 	struct tty_struct *tty;
 	int retval;
 
+	lock_kernel();
 	/* Check if pty master is being opened multiple times */
 	if (driver->subtype == PTY_TYPE_MASTER &&
-		(driver->flags & TTY_DRIVER_DEVPTS_MEM) && !first_ok)
+		(driver->flags & TTY_DRIVER_DEVPTS_MEM) && !first_ok) {
+		unlock_kernel();
 		return ERR_PTR(-EIO);
+	}
+	unlock_kernel();
 
 	/*
 	 * First time open is complex, especially for PTY devices.
@@ -1335,7 +1349,6 @@ struct tty_struct *tty_init_dev(struct tty_driver *driver, int idx,
 	 * If we fail here just call release_tty to clean up.  No need
 	 * to decrement the use counts, as release_tty doesn't care.
 	 */
-
 	retval = tty_ldisc_setup(tty, tty->link);
 	if (retval)
 		goto release_mem_out;
@@ -1350,7 +1363,9 @@ release_mem_out:
 	if (printk_ratelimit())
 		printk(KERN_INFO "tty_init_dev: ldisc open failed, "
 				 "clearing slot %d\n", idx);
+	lock_kernel();
 	release_tty(tty, idx);
+	unlock_kernel();
 	return ERR_PTR(retval);
 }
 
@@ -1464,7 +1479,17 @@ static void release_tty(struct tty_struct *tty, int idx)
 	tty_kref_put(tty);
 }
 
-/*
+/**
+ *	tty_release		-	vfs callback for close
+ *	@inode: inode of tty
+ *	@filp: file pointer for handle to tty
+ *
+ *	Called the last time each file handle is closed that references
+ *	this tty. There may however be several such references.
+ *
+ *	Locking:
+ *		Takes bkl. See tty_release_dev
+ *
  * Even releasing the tty structures is a tricky business.. We have
  * to be very careful that the structures are all released at the
  * same time, as interrupts might otherwise get the wrong pointers.
@@ -1472,20 +1497,20 @@ static void release_tty(struct tty_struct *tty, int idx)
  * WSH 09/09/97: rewritten to avoid some nasty race conditions that could
  * lead to double frees or releasing memory still in use.
  */
-void tty_release_dev(struct file *filp)
+
+int tty_release(struct inode *inode, struct file *filp)
 {
 	struct tty_struct *tty, *o_tty;
 	int	pty_master, tty_closing, o_tty_closing, do_sleep;
 	int	devpts;
 	int	idx;
 	char	buf[64];
-	struct 	inode *inode;
 
-	inode = filp->f_path.dentry->d_inode;
 	tty = (struct tty_struct *)filp->private_data;
 	if (tty_paranoia_check(tty, inode, "tty_release_dev"))
-		return;
+		return 0;
 
+	lock_kernel();
 	check_tty_count(tty, "tty_release_dev");
 
 	tty_fasync(-1, filp, 0);
@@ -1500,19 +1525,22 @@ void tty_release_dev(struct file *filp)
 	if (idx < 0 || idx >= tty->driver->num) {
 		printk(KERN_DEBUG "tty_release_dev: bad idx when trying to "
 				  "free (%s)\n", tty->name);
-		return;
+		unlock_kernel();
+		return 0;
 	}
 	if (!devpts) {
 		if (tty != tty->driver->ttys[idx]) {
+			unlock_kernel();
 			printk(KERN_DEBUG "tty_release_dev: driver.table[%d] not tty "
 			       "for (%s)\n", idx, tty->name);
-			return;
+			return 0;
 		}
 		if (tty->termios != tty->driver->termios[idx]) {
+			unlock_kernel();
 			printk(KERN_DEBUG "tty_release_dev: driver.termios[%d] not termios "
 			       "for (%s)\n",
 			       idx, tty->name);
-			return;
+			return 0;
 		}
 	}
 #endif
@@ -1526,26 +1554,30 @@ void tty_release_dev(struct file *filp)
 	if (tty->driver->other &&
 	     !(tty->driver->flags & TTY_DRIVER_DEVPTS_MEM)) {
 		if (o_tty != tty->driver->other->ttys[idx]) {
+			unlock_kernel();
 			printk(KERN_DEBUG "tty_release_dev: other->table[%d] "
 					  "not o_tty for (%s)\n",
 			       idx, tty->name);
-			return;
+			return 0 ;
 		}
 		if (o_tty->termios != tty->driver->other->termios[idx]) {
+			unlock_kernel();
 			printk(KERN_DEBUG "tty_release_dev: other->termios[%d] "
 					  "not o_termios for (%s)\n",
 			       idx, tty->name);
-			return;
+			return 0;
 		}
 		if (o_tty->link != tty) {
+			unlock_kernel();
 			printk(KERN_DEBUG "tty_release_dev: bad pty pointers\n");
-			return;
+			return 0;
 		}
 	}
 #endif
 	if (tty->ops->close)
 		tty->ops->close(tty, filp);
 
+	unlock_kernel();
 	/*
 	 * Sanity check: if tty->count is going to zero, there shouldn't be
 	 * any waiters on tty->read_wait or tty->write_wait.  We test the
@@ -1568,6 +1600,7 @@ void tty_release_dev(struct file *filp)
 		   opens on /dev/tty */
 
 		mutex_lock(&tty_mutex);
+		lock_kernel();
 		tty_closing = tty->count <= 1;
 		o_tty_closing = o_tty &&
 			(o_tty->count <= (pty_master ? 1 : 0));
@@ -1598,6 +1631,7 @@ void tty_release_dev(struct file *filp)
 
 		printk(KERN_WARNING "tty_release_dev: %s: read/write wait queue "
 				    "active!\n", tty_name(tty, buf));
+		unlock_kernel();
 		mutex_unlock(&tty_mutex);
 		schedule();
 	}
@@ -1661,8 +1695,10 @@ void tty_release_dev(struct file *filp)
 	mutex_unlock(&tty_mutex);
 
 	/* check whether both sides are closing ... */
-	if (!tty_closing || (o_tty && !o_tty_closing))
-		return;
+	if (!tty_closing || (o_tty && !o_tty_closing)) {
+		unlock_kernel();
+		return 0;
+	}
 
 #ifdef TTY_DEBUG_HANGUP
 	printk(KERN_DEBUG "freeing tty structure...");
@@ -1680,10 +1716,12 @@ void tty_release_dev(struct file *filp)
 	/* Make this pty number available for reallocation */
 	if (devpts)
 		devpts_kill_index(inode, idx);
+	unlock_kernel();
+	return 0;
 }
 
 /**
- *	__tty_open		-	open a tty device
+ *	tty_open		-	open a tty device
  *	@inode: inode of device file
  *	@filp: file pointer to tty
  *
@@ -1703,7 +1741,7 @@ void tty_release_dev(struct file *filp)
  *		 ->siglock protects ->signal/->sighand
  */
 
-static int __tty_open(struct inode *inode, struct file *filp)
+static int tty_open(struct inode *inode, struct file *filp)
 {
 	struct tty_struct *tty = NULL;
 	int noctty, retval;
@@ -1720,10 +1758,12 @@ retry_open:
 	retval = 0;
 
 	mutex_lock(&tty_mutex);
+	lock_kernel();
 
 	if (device == MKDEV(TTYAUX_MAJOR, 0)) {
 		tty = get_current_tty();
 		if (!tty) {
+			unlock_kernel();
 			mutex_unlock(&tty_mutex);
 			return -ENXIO;
 		}
@@ -1755,12 +1795,14 @@ retry_open:
 				goto got_driver;
 			}
 		}
+		unlock_kernel();
 		mutex_unlock(&tty_mutex);
 		return -ENODEV;
 	}
 
 	driver = get_tty_driver(device, &index);
 	if (!driver) {
+		unlock_kernel();
 		mutex_unlock(&tty_mutex);
 		return -ENODEV;
 	}
@@ -1770,6 +1812,7 @@ got_driver:
 		tty = tty_driver_lookup_tty(driver, inode, index);
 
 		if (IS_ERR(tty)) {
+			unlock_kernel();
 			mutex_unlock(&tty_mutex);
 			return PTR_ERR(tty);
 		}
@@ -1784,8 +1827,10 @@ got_driver:
 
 	mutex_unlock(&tty_mutex);
 	tty_driver_kref_put(driver);
-	if (IS_ERR(tty))
+	if (IS_ERR(tty)) {
+		unlock_kernel();
 		return PTR_ERR(tty);
+	}
 
 	filp->private_data = tty;
 	file_move(filp, &tty->tty_files);
@@ -1813,11 +1858,15 @@ got_driver:
 		printk(KERN_DEBUG "error %d in opening %s...", retval,
 		       tty->name);
 #endif
-		tty_release_dev(filp);
-		if (retval != -ERESTARTSYS)
+		tty_release(inode, filp);
+		if (retval != -ERESTARTSYS) {
+			unlock_kernel();
 			return retval;
-		if (signal_pending(current))
+		}
+		if (signal_pending(current)) {
+			unlock_kernel();
 			return retval;
+		}
 		schedule();
 		/*
 		 * Need to reset f_op in case a hangup happened.
@@ -1826,8 +1875,11 @@ got_driver:
 			filp->f_op = &tty_fops;
 		goto retry_open;
 	}
+	unlock_kernel();
+
 
 	mutex_lock(&tty_mutex);
+	lock_kernel();
 	spin_lock_irq(&current->sighand->siglock);
 	if (!noctty &&
 	    current->signal->leader &&
@@ -1835,43 +1887,12 @@ got_driver:
 	    tty->session == NULL)
 		__proc_set_tty(current, tty);
 	spin_unlock_irq(&current->sighand->siglock);
+	unlock_kernel();
 	mutex_unlock(&tty_mutex);
 	return 0;
 }
 
-/* BKL pushdown: scary code avoidance wrapper */
-static int tty_open(struct inode *inode, struct file *filp)
-{
-	int ret;
-
-	lock_kernel();
-	ret = __tty_open(inode, filp);
-	unlock_kernel();
-	return ret;
-}
-
-
-
-
-/**
- *	tty_release		-	vfs callback for close
- *	@inode: inode of tty
- *	@filp: file pointer for handle to tty
- *
- *	Called the last time each file handle is closed that references
- *	this tty. There may however be several such references.
- *
- *	Locking:
- *		Takes bkl. See tty_release_dev
- */
 
-static int tty_release(struct inode *inode, struct file *filp)
-{
-	lock_kernel();
-	tty_release_dev(filp);
-	unlock_kernel();
-	return 0;
-}
 
 /**
  *	tty_poll	-	check tty status
@@ -1930,8 +1951,8 @@ static int tty_fasync(int fd, struct file *filp, int on)
 			pid = task_pid(current);
 			type = PIDTYPE_PID;
 		}
-		spin_unlock_irqrestore(&tty->ctrl_lock, flags);
 		retval = __f_setown(filp, pid, type, 0);
+		spin_unlock_irqrestore(&tty->ctrl_lock, flags);
 		if (retval)
 			goto out;
 	} else {
@@ -2317,9 +2338,7 @@ static int tiocsetd(struct tty_struct *tty, int __user *p)
 	if (get_user(ldisc, p))
 		return -EFAULT;
 
-	lock_kernel();
 	ret = tty_set_ldisc(tty, ldisc);
-	unlock_kernel();
 
 	return ret;
 }
diff --git a/drivers/char/tty_ioctl.c b/drivers/char/tty_ioctl.c
index 8e67d5c642a4..6bd5f8866c74 100644
--- a/drivers/char/tty_ioctl.c
+++ b/drivers/char/tty_ioctl.c
@@ -315,7 +315,7 @@ EXPORT_SYMBOL(tty_termios_input_baud_rate);
  *	For maximal back compatibility with legacy SYS5/POSIX *nix behaviour
  *	we need to carefully set the bits when the user does not get the
  *	desired speed. We allow small margins and preserve as much of possible
- *	of the input intent to keep compatiblity.
+ *	of the input intent to keep compatibility.
  *
  *	Locking: Caller should hold termios lock. This is already held
  *	when calling this function from the driver termios handler.
diff --git a/drivers/char/tty_ldisc.c b/drivers/char/tty_ldisc.c
index feb55075819b..3f653f7d849f 100644
--- a/drivers/char/tty_ldisc.c
+++ b/drivers/char/tty_ldisc.c
@@ -34,6 +34,8 @@
 #include <linux/vt_kern.h>
 #include <linux/selection.h>
 
+#include <linux/smp_lock.h>	/* For the moment */
+
 #include <linux/kmod.h>
 #include <linux/nsproxy.h>
 
@@ -443,8 +445,14 @@ static void tty_set_termios_ldisc(struct tty_struct *tty, int num)
 static int tty_ldisc_open(struct tty_struct *tty, struct tty_ldisc *ld)
 {
 	WARN_ON(test_and_set_bit(TTY_LDISC_OPEN, &tty->flags));
-	if (ld->ops->open)
-		return ld->ops->open(tty);
+	if (ld->ops->open) {
+		int ret;
+                /* BKL here locks verus a hangup event */
+		lock_kernel();
+		ret = ld->ops->open(tty);
+		unlock_kernel();
+		return ret;
+	}
 	return 0;
 }
 
@@ -545,6 +553,7 @@ int tty_set_ldisc(struct tty_struct *tty, int ldisc)
 	if (IS_ERR(new_ldisc))
 		return PTR_ERR(new_ldisc);
 
+	lock_kernel();
 	/*
 	 *	We need to look at the tty locking here for pty/tty pairs
 	 *	when both sides try to change in parallel.
@@ -558,10 +567,12 @@ int tty_set_ldisc(struct tty_struct *tty, int ldisc)
 	 */
 
 	if (tty->ldisc->ops->num == ldisc) {
+		unlock_kernel();
 		tty_ldisc_put(new_ldisc);
 		return 0;
 	}
 
+	unlock_kernel();
 	/*
 	 *	Problem: What do we do if this blocks ?
 	 *	We could deadlock here
@@ -582,6 +593,9 @@ int tty_set_ldisc(struct tty_struct *tty, int ldisc)
 			test_bit(TTY_LDISC_CHANGING, &tty->flags) == 0);
 		mutex_lock(&tty->ldisc_mutex);
 	}
+
+	lock_kernel();
+
 	set_bit(TTY_LDISC_CHANGING, &tty->flags);
 
 	/*
@@ -592,6 +606,8 @@ int tty_set_ldisc(struct tty_struct *tty, int ldisc)
 	tty->receive_room = 0;
 
 	o_ldisc = tty->ldisc;
+
+	unlock_kernel();
 	/*
 	 *	Make sure we don't change while someone holds a
 	 *	reference to the line discipline. The TTY_LDISC bit
@@ -617,12 +633,14 @@ int tty_set_ldisc(struct tty_struct *tty, int ldisc)
 	flush_scheduled_work();
 
 	mutex_lock(&tty->ldisc_mutex);
+	lock_kernel();
 	if (test_bit(TTY_HUPPED, &tty->flags)) {
 		/* We were raced by the hangup method. It will have stomped
 		   the ldisc data and closed the ldisc down */
 		clear_bit(TTY_LDISC_CHANGING, &tty->flags);
 		mutex_unlock(&tty->ldisc_mutex);
 		tty_ldisc_put(new_ldisc);
+		unlock_kernel();
 		return -EIO;
 	}
 
@@ -664,6 +682,7 @@ int tty_set_ldisc(struct tty_struct *tty, int ldisc)
 	if (o_work)
 		schedule_delayed_work(&o_tty->buf.work, 1);
 	mutex_unlock(&tty->ldisc_mutex);
+	unlock_kernel();
 	return retval;
 }
 
diff --git a/drivers/char/tty_port.c b/drivers/char/tty_port.c
index c63f3d33914a..be492dd66437 100644
--- a/drivers/char/tty_port.c
+++ b/drivers/char/tty_port.c
@@ -25,19 +25,21 @@ void tty_port_init(struct tty_port *port)
 	init_waitqueue_head(&port->close_wait);
 	init_waitqueue_head(&port->delta_msr_wait);
 	mutex_init(&port->mutex);
+	mutex_init(&port->buf_mutex);
 	spin_lock_init(&port->lock);
 	port->close_delay = (50 * HZ) / 100;
 	port->closing_wait = (3000 * HZ) / 100;
+	kref_init(&port->kref);
 }
 EXPORT_SYMBOL(tty_port_init);
 
 int tty_port_alloc_xmit_buf(struct tty_port *port)
 {
 	/* We may sleep in get_zeroed_page() */
-	mutex_lock(&port->mutex);
+	mutex_lock(&port->buf_mutex);
 	if (port->xmit_buf == NULL)
 		port->xmit_buf = (unsigned char *)get_zeroed_page(GFP_KERNEL);
-	mutex_unlock(&port->mutex);
+	mutex_unlock(&port->buf_mutex);
 	if (port->xmit_buf == NULL)
 		return -ENOMEM;
 	return 0;
@@ -46,15 +48,32 @@ EXPORT_SYMBOL(tty_port_alloc_xmit_buf);
 
 void tty_port_free_xmit_buf(struct tty_port *port)
 {
-	mutex_lock(&port->mutex);
+	mutex_lock(&port->buf_mutex);
 	if (port->xmit_buf != NULL) {
 		free_page((unsigned long)port->xmit_buf);
 		port->xmit_buf = NULL;
 	}
-	mutex_unlock(&port->mutex);
+	mutex_unlock(&port->buf_mutex);
 }
 EXPORT_SYMBOL(tty_port_free_xmit_buf);
 
+static void tty_port_destructor(struct kref *kref)
+{
+	struct tty_port *port = container_of(kref, struct tty_port, kref);
+	if (port->xmit_buf)
+		free_page((unsigned long)port->xmit_buf);
+	if (port->ops->destruct)
+		port->ops->destruct(port);
+	else
+		kfree(port);
+}
+
+void tty_port_put(struct tty_port *port)
+{
+	if (port)
+		kref_put(&port->kref, tty_port_destructor);
+}
+EXPORT_SYMBOL(tty_port_put);
 
 /**
  *	tty_port_tty_get	-	get a tty reference
@@ -99,10 +118,11 @@ EXPORT_SYMBOL(tty_port_tty_set);
 
 static void tty_port_shutdown(struct tty_port *port)
 {
+	mutex_lock(&port->mutex);
 	if (port->ops->shutdown &&
 		test_and_clear_bit(ASYNCB_INITIALIZED, &port->flags))
 			port->ops->shutdown(port);
-
+	mutex_unlock(&port->mutex);
 }
 
 /**
@@ -120,8 +140,10 @@ void tty_port_hangup(struct tty_port *port)
 	spin_lock_irqsave(&port->lock, flags);
 	port->count = 0;
 	port->flags &= ~ASYNC_NORMAL_ACTIVE;
-	if (port->tty)
+	if (port->tty) {
+		set_bit(TTY_IO_ERROR, &port->tty->flags);
 		tty_kref_put(port->tty);
+	}
 	port->tty = NULL;
 	spin_unlock_irqrestore(&port->lock, flags);
 	wake_up_interruptible(&port->open_wait);
@@ -198,7 +220,7 @@ EXPORT_SYMBOL(tty_port_lower_dtr_rts);
  *	management of these lines. Note that the dtr/rts raise is done each
  *	iteration as a hangup may have previously dropped them while we wait.
  */
- 
+
 int tty_port_block_til_ready(struct tty_port *port,
 				struct tty_struct *tty, struct file *filp)
 {
@@ -253,7 +275,8 @@ int tty_port_block_til_ready(struct tty_port *port,
 			tty_port_raise_dtr_rts(port);
 
 		prepare_to_wait(&port->open_wait, &wait, TASK_INTERRUPTIBLE);
-		/* Check for a hangup or uninitialised port. Return accordingly */
+		/* Check for a hangup or uninitialised port.
+							Return accordingly */
 		if (tty_hung_up_p(filp) || !(port->flags & ASYNC_INITIALIZED)) {
 			if (port->flags & ASYNC_HUP_NOTIFY)
 				retval = -EAGAIN;
@@ -285,11 +308,11 @@ int tty_port_block_til_ready(struct tty_port *port,
 		port->flags |= ASYNC_NORMAL_ACTIVE;
 	spin_unlock_irqrestore(&port->lock, flags);
 	return retval;
-	
 }
 EXPORT_SYMBOL(tty_port_block_til_ready);
 
-int tty_port_close_start(struct tty_port *port, struct tty_struct *tty, struct file *filp)
+int tty_port_close_start(struct tty_port *port,
+				struct tty_struct *tty, struct file *filp)
 {
 	unsigned long flags;
 
@@ -299,7 +322,7 @@ int tty_port_close_start(struct tty_port *port, struct tty_struct *tty, struct f
 		return 0;
 	}
 
-	if( tty->count == 1 && port->count != 1) {
+	if (tty->count == 1 && port->count != 1) {
 		printk(KERN_WARNING
 		    "tty_port_close_start: tty->count = 1 port count = %d.\n",
 								port->count);
@@ -331,12 +354,20 @@ int tty_port_close_start(struct tty_port *port, struct tty_struct *tty, struct f
 		long timeout;
 
 		if (bps > 1200)
-			timeout = max_t(long, (HZ * 10 * port->drain_delay) / bps,
-								HZ / 10);
+			timeout = max_t(long,
+				(HZ * 10 * port->drain_delay) / bps, HZ / 10);
 		else
 			timeout = 2 * HZ;
 		schedule_timeout_interruptible(timeout);
 	}
+	/* Flush the ldisc buffering */
+	tty_ldisc_flush(tty);
+
+	/* Drop DTR/RTS if HUPCL is set. This causes any attached modem to
+	   hang up the line */
+	if (tty->termios->c_cflag & HUPCL)
+		tty_port_lower_dtr_rts(port);
+
 	/* Don't call port->drop for the last reference. Callers will want
 	   to drop the last active reference in ->shutdown() or the tty
 	   shutdown path */
@@ -348,11 +379,6 @@ void tty_port_close_end(struct tty_port *port, struct tty_struct *tty)
 {
 	unsigned long flags;
 
-	tty_ldisc_flush(tty);
-
-	if (tty->termios->c_cflag & HUPCL)
-		tty_port_lower_dtr_rts(port);
-
 	spin_lock_irqsave(&port->lock, flags);
 	tty->closing = 0;
 
@@ -377,7 +403,42 @@ void tty_port_close(struct tty_port *port, struct tty_struct *tty,
 	if (tty_port_close_start(port, tty, filp) == 0)
 		return;
 	tty_port_shutdown(port);
+	set_bit(TTY_IO_ERROR, &tty->flags);
 	tty_port_close_end(port, tty);
 	tty_port_tty_set(port, NULL);
 }
 EXPORT_SYMBOL(tty_port_close);
+
+int tty_port_open(struct tty_port *port, struct tty_struct *tty,
+							struct file *filp)
+{
+	spin_lock_irq(&port->lock);
+	if (!tty_hung_up_p(filp))
+		++port->count;
+	spin_unlock_irq(&port->lock);
+	tty_port_tty_set(port, tty);
+
+	/*
+	 * Do the device-specific open only if the hardware isn't
+	 * already initialized. Serialize open and shutdown using the
+	 * port mutex.
+	 */
+
+	mutex_lock(&port->mutex);
+
+	if (!test_bit(ASYNCB_INITIALIZED, &port->flags)) {
+		clear_bit(TTY_IO_ERROR, &tty->flags);
+		if (port->ops->activate) {
+			int retval = port->ops->activate(port, tty);
+			if (retval) {
+				mutex_unlock(&port->mutex);
+				return retval;
+			}
+		}
+		set_bit(ASYNCB_INITIALIZED, &port->flags);
+	}
+	mutex_unlock(&port->mutex);
+	return tty_port_block_til_ready(port, tty, filp);
+}
+
+EXPORT_SYMBOL(tty_port_open);
diff --git a/drivers/char/vt.c b/drivers/char/vt.c
index 0c80c68cd047..50faa1fb0f06 100644
--- a/drivers/char/vt.c
+++ b/drivers/char/vt.c
@@ -161,6 +161,11 @@ static void set_palette(struct vc_data *vc);
 static int printable;		/* Is console ready for printing? */
 int default_utf8 = true;
 module_param(default_utf8, int, S_IRUGO | S_IWUSR);
+int global_cursor_default = -1;
+module_param(global_cursor_default, int, S_IRUGO | S_IWUSR);
+
+static int cur_default = CUR_DEFAULT;
+module_param(cur_default, int, S_IRUGO | S_IWUSR);
 
 /*
  * ignore_poke: don't unblank the screen when things are typed.  This is
@@ -182,12 +187,10 @@ static DECLARE_WORK(console_work, console_callback);
  * fg_console is the current virtual console,
  * last_console is the last used one,
  * want_console is the console we want to switch to,
- * kmsg_redirect is the console for kernel messages,
  */
 int fg_console;
 int last_console;
 int want_console = -1;
-int kmsg_redirect;
 
 /*
  * For each existing display, we have a pointer to console currently visible
@@ -775,6 +778,12 @@ int vc_allocate(unsigned int currcons)	/* return 0 on success */
 		vc_cons[currcons].d = NULL;
 		return -ENOMEM;
 	    }
+
+	    /* If no drivers have overridden us and the user didn't pass a
+	       boot option, default to displaying the cursor */
+	    if (global_cursor_default == -1)
+		    global_cursor_default = 1;
+
 	    vc_init(vc, vc->vc_rows, vc->vc_cols, 1);
 	    vcs_make_sysfs(currcons);
 	    atomic_notifier_call_chain(&vt_notifier_list, VT_ALLOCATE, &param);
@@ -1616,7 +1625,7 @@ static void reset_terminal(struct vc_data *vc, int do_clear)
 	vc->vc_decscnm		= 0;
 	vc->vc_decom		= 0;
 	vc->vc_decawm		= 1;
-	vc->vc_deccm		= 1;
+	vc->vc_deccm		= global_cursor_default;
 	vc->vc_decim		= 0;
 
 	set_kbd(vc, decarm);
@@ -1630,7 +1639,7 @@ static void reset_terminal(struct vc_data *vc, int do_clear)
 	/* do not do set_leds here because this causes an endless tasklet loop
 	   when the keyboard hasn't been initialized yet */
 
-	vc->vc_cursor_type = CUR_DEFAULT;
+	vc->vc_cursor_type = cur_default;
 	vc->vc_complement_mask = vc->vc_s_complement_mask;
 
 	default_attr(vc);
@@ -1832,7 +1841,7 @@ static void do_con_trol(struct tty_struct *tty, struct vc_data *vc, int c)
 				if (vc->vc_par[0])
 					vc->vc_cursor_type = vc->vc_par[0] | (vc->vc_par[1] << 8) | (vc->vc_par[2] << 16);
 				else
-					vc->vc_cursor_type = CUR_DEFAULT;
+					vc->vc_cursor_type = cur_default;
 				return;
 			}
 			break;
@@ -2426,6 +2435,37 @@ struct tty_driver *console_driver;
 
 #ifdef CONFIG_VT_CONSOLE
 
+/**
+ * vt_kmsg_redirect() - Sets/gets the kernel message console
+ * @new:	The new virtual terminal number or -1 if the console should stay
+ * 		unchanged
+ *
+ * By default, the kernel messages are always printed on the current virtual
+ * console. However, the user may modify that default with the
+ * TIOCL_SETKMSGREDIRECT ioctl call.
+ *
+ * This function sets the kernel message console to be @new. It returns the old
+ * virtual console number. The virtual terminal number 0 (both as parameter and
+ * return value) means no redirection (i.e. always printed on the currently
+ * active console).
+ *
+ * The parameter -1 means that only the current console is returned, but the
+ * value is not modified. You may use the macro vt_get_kmsg_redirect() in that
+ * case to make the code more understandable.
+ *
+ * When the kernel is compiled without CONFIG_VT_CONSOLE, this function ignores
+ * the parameter and always returns 0.
+ */
+int vt_kmsg_redirect(int new)
+{
+	static int kmsg_con;
+
+	if (new != -1)
+		return xchg(&kmsg_con, new);
+	else
+		return kmsg_con;
+}
+
 /*
  *	Console on virtual terminal
  *
@@ -2440,6 +2480,7 @@ static void vt_console_print(struct console *co, const char *b, unsigned count)
 	const ushort *start;
 	ushort cnt = 0;
 	ushort myx;
+	int kmsg_console;
 
 	/* console busy or not yet initialized */
 	if (!printable)
@@ -2447,8 +2488,9 @@ static void vt_console_print(struct console *co, const char *b, unsigned count)
 	if (!spin_trylock(&printing_lock))
 		return;
 
-	if (kmsg_redirect && vc_cons_allocated(kmsg_redirect - 1))
-		vc = vc_cons[kmsg_redirect - 1].d;
+	kmsg_console = vt_get_kmsg_redirect();
+	if (kmsg_console && vc_cons_allocated(kmsg_console - 1))
+		vc = vc_cons[kmsg_console - 1].d;
 
 	/* read `x' only after setting currcons properly (otherwise
 	   the `x' macro will read the x of the foreground console). */
@@ -2605,7 +2647,7 @@ int tioclinux(struct tty_struct *tty, unsigned long arg)
 			ret = set_vesa_blanking(p);
 			break;
 		case TIOCL_GETKMSGREDIRECT:
-			data = kmsg_redirect;
+			data = vt_get_kmsg_redirect();
 			ret = __put_user(data, p);
 			break;
 		case TIOCL_SETKMSGREDIRECT:
@@ -2615,7 +2657,7 @@ int tioclinux(struct tty_struct *tty, unsigned long arg)
 				if (get_user(data, p+1))
 					ret = -EFAULT;
 				else
-					kmsg_redirect = data;
+					vt_kmsg_redirect(data);
 			}
 			break;
 		case TIOCL_GETFGCONSOLE:
@@ -4078,6 +4120,7 @@ EXPORT_SYMBOL(fg_console);
 EXPORT_SYMBOL(console_blank_hook);
 EXPORT_SYMBOL(console_blanked);
 EXPORT_SYMBOL(vc_cons);
+EXPORT_SYMBOL(global_cursor_default);
 #ifndef VT_SINGLE_DRIVER
 EXPORT_SYMBOL(take_over_console);
 EXPORT_SYMBOL(give_up_console);
diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
new file mode 100644
index 000000000000..08f726c5fee5
--- /dev/null
+++ b/drivers/clocksource/Kconfig
@@ -0,0 +1,9 @@
+config CS5535_CLOCK_EVENT_SRC
+	tristate "CS5535/CS5536 high-res timer (MFGPT) events"
+	depends on GENERIC_TIME && GENERIC_CLOCKEVENTS && CS5535_MFGPT
+	help
+	  This driver provides a clock event source based on the MFGPT
+	  timer(s) in the CS5535 and CS5536 companion chips.
+	  MFGPTs have a better resolution and max interval than the
+	  generic PIT, and are suitable for use as high-res timers.
+
diff --git a/drivers/clocksource/Makefile b/drivers/clocksource/Makefile
index eef216f7f61d..be61ece6330b 100644
--- a/drivers/clocksource/Makefile
+++ b/drivers/clocksource/Makefile
@@ -2,6 +2,7 @@ obj-$(CONFIG_ATMEL_TCB_CLKSRC)	+= tcb_clksrc.o
 obj-$(CONFIG_X86_CYCLONE_TIMER)	+= cyclone.o
 obj-$(CONFIG_X86_PM_TIMER)	+= acpi_pm.o
 obj-$(CONFIG_SCx200HR_TIMER)	+= scx200_hrt.o
+obj-$(CONFIG_CS5535_CLOCK_EVENT_SRC)	+= cs5535-clockevt.o
 obj-$(CONFIG_SH_TIMER_CMT)	+= sh_cmt.o
 obj-$(CONFIG_SH_TIMER_MTU2)	+= sh_mtu2.o
 obj-$(CONFIG_SH_TIMER_TMU)	+= sh_tmu.o
diff --git a/drivers/clocksource/cs5535-clockevt.c b/drivers/clocksource/cs5535-clockevt.c
new file mode 100644
index 000000000000..27d20fac19d1
--- /dev/null
+++ b/drivers/clocksource/cs5535-clockevt.c
@@ -0,0 +1,197 @@
+/*
+ * Clock event driver for the CS5535/CS5536
+ *
+ * Copyright (C) 2006, Advanced Micro Devices, Inc.
+ * Copyright (C) 2007  Andres Salomon <dilinger@debian.org>
+ * Copyright (C) 2009  Andres Salomon <dilinger@collabora.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public License
+ * as published by the Free Software Foundation.
+ *
+ * The MFGPTs are documented in AMD Geode CS5536 Companion Device Data Book.
+ */
+
+#include <linux/kernel.h>
+#include <linux/irq.h>
+#include <linux/interrupt.h>
+#include <linux/module.h>
+#include <linux/cs5535.h>
+#include <linux/clockchips.h>
+
+#define DRV_NAME "cs5535-clockevt"
+
+static int timer_irq = CONFIG_CS5535_MFGPT_DEFAULT_IRQ;
+module_param_named(irq, timer_irq, int, 0644);
+MODULE_PARM_DESC(irq, "Which IRQ to use for the clock source MFGPT ticks.");
+
+/*
+ * We are using the 32.768kHz input clock - it's the only one that has the
+ * ranges we find desirable.  The following table lists the suitable
+ * divisors and the associated Hz, minimum interval and the maximum interval:
+ *
+ *  Divisor   Hz      Min Delta (s)  Max Delta (s)
+ *   1        32768   .00048828125      2.000
+ *   2        16384   .0009765625       4.000
+ *   4         8192   .001953125        8.000
+ *   8         4096   .00390625        16.000
+ *   16        2048   .0078125         32.000
+ *   32        1024   .015625          64.000
+ *   64         512   .03125          128.000
+ *  128         256   .0625           256.000
+ *  256         128   .125            512.000
+ */
+
+static unsigned int cs5535_tick_mode = CLOCK_EVT_MODE_SHUTDOWN;
+static struct cs5535_mfgpt_timer *cs5535_event_clock;
+
+/* Selected from the table above */
+
+#define MFGPT_DIVISOR 16
+#define MFGPT_SCALE  4     /* divisor = 2^(scale) */
+#define MFGPT_HZ  (32768 / MFGPT_DIVISOR)
+#define MFGPT_PERIODIC (MFGPT_HZ / HZ)
+
+/*
+ * The MFPGT timers on the CS5536 provide us with suitable timers to use
+ * as clock event sources - not as good as a HPET or APIC, but certainly
+ * better than the PIT.  This isn't a general purpose MFGPT driver, but
+ * a simplified one designed specifically to act as a clock event source.
+ * For full details about the MFGPT, please consult the CS5536 data sheet.
+ */
+
+static void disable_timer(struct cs5535_mfgpt_timer *timer)
+{
+	/* avoid races by clearing CMP1 and CMP2 unconditionally */
+	cs5535_mfgpt_write(timer, MFGPT_REG_SETUP,
+			(uint16_t) ~MFGPT_SETUP_CNTEN | MFGPT_SETUP_CMP1 |
+				MFGPT_SETUP_CMP2);
+}
+
+static void start_timer(struct cs5535_mfgpt_timer *timer, uint16_t delta)
+{
+	cs5535_mfgpt_write(timer, MFGPT_REG_CMP2, delta);
+	cs5535_mfgpt_write(timer, MFGPT_REG_COUNTER, 0);
+
+	cs5535_mfgpt_write(timer, MFGPT_REG_SETUP,
+			MFGPT_SETUP_CNTEN | MFGPT_SETUP_CMP2);
+}
+
+static void mfgpt_set_mode(enum clock_event_mode mode,
+		struct clock_event_device *evt)
+{
+	disable_timer(cs5535_event_clock);
+
+	if (mode == CLOCK_EVT_MODE_PERIODIC)
+		start_timer(cs5535_event_clock, MFGPT_PERIODIC);
+
+	cs5535_tick_mode = mode;
+}
+
+static int mfgpt_next_event(unsigned long delta, struct clock_event_device *evt)
+{
+	start_timer(cs5535_event_clock, delta);
+	return 0;
+}
+
+static struct clock_event_device cs5535_clockevent = {
+	.name = DRV_NAME,
+	.features = CLOCK_EVT_FEAT_PERIODIC | CLOCK_EVT_FEAT_ONESHOT,
+	.set_mode = mfgpt_set_mode,
+	.set_next_event = mfgpt_next_event,
+	.rating = 250,
+	.cpumask = cpu_all_mask,
+	.shift = 32
+};
+
+static irqreturn_t mfgpt_tick(int irq, void *dev_id)
+{
+	uint16_t val = cs5535_mfgpt_read(cs5535_event_clock, MFGPT_REG_SETUP);
+
+	/* See if the interrupt was for us */
+	if (!(val & (MFGPT_SETUP_SETUP | MFGPT_SETUP_CMP2 | MFGPT_SETUP_CMP1)))
+		return IRQ_NONE;
+
+	/* Turn off the clock (and clear the event) */
+	disable_timer(cs5535_event_clock);
+
+	if (cs5535_tick_mode == CLOCK_EVT_MODE_SHUTDOWN)
+		return IRQ_HANDLED;
+
+	/* Clear the counter */
+	cs5535_mfgpt_write(cs5535_event_clock, MFGPT_REG_COUNTER, 0);
+
+	/* Restart the clock in periodic mode */
+
+	if (cs5535_tick_mode == CLOCK_EVT_MODE_PERIODIC)
+		cs5535_mfgpt_write(cs5535_event_clock, MFGPT_REG_SETUP,
+				MFGPT_SETUP_CNTEN | MFGPT_SETUP_CMP2);
+
+	cs5535_clockevent.event_handler(&cs5535_clockevent);
+	return IRQ_HANDLED;
+}
+
+static struct irqaction mfgptirq  = {
+	.handler = mfgpt_tick,
+	.flags = IRQF_DISABLED | IRQF_NOBALANCING | IRQF_TIMER,
+	.name = DRV_NAME,
+};
+
+static int __init cs5535_mfgpt_init(void)
+{
+	struct cs5535_mfgpt_timer *timer;
+	int ret;
+	uint16_t val;
+
+	timer = cs5535_mfgpt_alloc_timer(MFGPT_TIMER_ANY, MFGPT_DOMAIN_WORKING);
+	if (!timer) {
+		printk(KERN_ERR DRV_NAME ": Could not allocate MFPGT timer\n");
+		return -ENODEV;
+	}
+	cs5535_event_clock = timer;
+
+	/* Set up the IRQ on the MFGPT side */
+	if (cs5535_mfgpt_setup_irq(timer, MFGPT_CMP2, &timer_irq)) {
+		printk(KERN_ERR DRV_NAME ": Could not set up IRQ %d\n",
+				timer_irq);
+		return -EIO;
+	}
+
+	/* And register it with the kernel */
+	ret = setup_irq(timer_irq, &mfgptirq);
+	if (ret) {
+		printk(KERN_ERR DRV_NAME ": Unable to set up the interrupt.\n");
+		goto err;
+	}
+
+	/* Set the clock scale and enable the event mode for CMP2 */
+	val = MFGPT_SCALE | (3 << 8);
+
+	cs5535_mfgpt_write(cs5535_event_clock, MFGPT_REG_SETUP, val);
+
+	/* Set up the clock event */
+	cs5535_clockevent.mult = div_sc(MFGPT_HZ, NSEC_PER_SEC,
+			cs5535_clockevent.shift);
+	cs5535_clockevent.min_delta_ns = clockevent_delta2ns(0xF,
+			&cs5535_clockevent);
+	cs5535_clockevent.max_delta_ns = clockevent_delta2ns(0xFFFE,
+			&cs5535_clockevent);
+
+	printk(KERN_INFO DRV_NAME
+		": Registering MFGPT timer as a clock event, using IRQ %d\n",
+		timer_irq);
+	clockevents_register_device(&cs5535_clockevent);
+
+	return 0;
+
+err:
+	cs5535_mfgpt_release_irq(cs5535_event_clock, MFGPT_CMP2, &timer_irq);
+	printk(KERN_ERR DRV_NAME ": Unable to set up the MFGPT clock source\n");
+	return -EIO;
+}
+
+module_init(cs5535_mfgpt_init);
+
+MODULE_AUTHOR("Andres Salomon <dilinger@collabora.co.uk>");
+MODULE_DESCRIPTION("CS5535/CS5536 MFGPT clock event driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/connector/connector.c b/drivers/connector/connector.c
index f06024668f99..537c29ac4487 100644
--- a/drivers/connector/connector.c
+++ b/drivers/connector/connector.c
@@ -36,17 +36,6 @@ MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Evgeniy Polyakov <zbr@ioremap.net>");
 MODULE_DESCRIPTION("Generic userspace <-> kernelspace connector.");
 
-static u32 cn_idx = CN_IDX_CONNECTOR;
-static u32 cn_val = CN_VAL_CONNECTOR;
-
-module_param(cn_idx, uint, 0);
-module_param(cn_val, uint, 0);
-MODULE_PARM_DESC(cn_idx, "Connector's main device idx.");
-MODULE_PARM_DESC(cn_val, "Connector's main device val.");
-
-static DEFINE_MUTEX(notify_lock);
-static LIST_HEAD(notify_list);
-
 static struct cn_dev cdev;
 
 static int cn_already_initialized;
@@ -210,54 +199,6 @@ static void cn_rx_skb(struct sk_buff *__skb)
 }
 
 /*
- * Notification routing.
- *
- * Gets id and checks if there are notification request for it's idx
- * and val.  If there are such requests notify the listeners with the
- * given notify event.
- *
- */
-static void cn_notify(struct cb_id *id, u32 notify_event)
-{
-	struct cn_ctl_entry *ent;
-
-	mutex_lock(&notify_lock);
-	list_for_each_entry(ent, &notify_list, notify_entry) {
-		int i;
-		struct cn_notify_req *req;
-		struct cn_ctl_msg *ctl = ent->msg;
-		int idx_found, val_found;
-
-		idx_found = val_found = 0;
-
-		req = (struct cn_notify_req *)ctl->data;
-		for (i = 0; i < ctl->idx_notify_num; ++i, ++req) {
-			if (id->idx >= req->first &&
-					id->idx < req->first + req->range) {
-				idx_found = 1;
-				break;
-			}
-		}
-
-		for (i = 0; i < ctl->val_notify_num; ++i, ++req) {
-			if (id->val >= req->first &&
-					id->val < req->first + req->range) {
-				val_found = 1;
-				break;
-			}
-		}
-
-		if (idx_found && val_found) {
-			struct cn_msg m = { .ack = notify_event, };
-
-			memcpy(&m.id, id, sizeof(m.id));
-			cn_netlink_send(&m, ctl->group, GFP_KERNEL);
-		}
-	}
-	mutex_unlock(&notify_lock);
-}
-
-/*
  * Callback add routing - adds callback with given ID and name.
  * If there is registered callback with the same ID it will not be added.
  *
@@ -276,8 +217,6 @@ int cn_add_callback(struct cb_id *id, char *name,
 	if (err)
 		return err;
 
-	cn_notify(id, 0);
-
 	return 0;
 }
 EXPORT_SYMBOL_GPL(cn_add_callback);
@@ -295,111 +234,9 @@ void cn_del_callback(struct cb_id *id)
 	struct cn_dev *dev = &cdev;
 
 	cn_queue_del_callback(dev->cbdev, id);
-	cn_notify(id, 1);
 }
 EXPORT_SYMBOL_GPL(cn_del_callback);
 
-/*
- * Checks two connector's control messages to be the same.
- * Returns 1 if they are the same or if the first one is corrupted.
- */
-static int cn_ctl_msg_equals(struct cn_ctl_msg *m1, struct cn_ctl_msg *m2)
-{
-	int i;
-	struct cn_notify_req *req1, *req2;
-
-	if (m1->idx_notify_num != m2->idx_notify_num)
-		return 0;
-
-	if (m1->val_notify_num != m2->val_notify_num)
-		return 0;
-
-	if (m1->len != m2->len)
-		return 0;
-
-	if ((m1->idx_notify_num + m1->val_notify_num) * sizeof(*req1) !=
-	    m1->len)
-		return 1;
-
-	req1 = (struct cn_notify_req *)m1->data;
-	req2 = (struct cn_notify_req *)m2->data;
-
-	for (i = 0; i < m1->idx_notify_num; ++i) {
-		if (req1->first != req2->first || req1->range != req2->range)
-			return 0;
-		req1++;
-		req2++;
-	}
-
-	for (i = 0; i < m1->val_notify_num; ++i) {
-		if (req1->first != req2->first || req1->range != req2->range)
-			return 0;
-		req1++;
-		req2++;
-	}
-
-	return 1;
-}
-
-/*
- * Main connector device's callback.
- *
- * Used for notification of a request's processing.
- */
-static void cn_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp)
-{
-	struct cn_ctl_msg *ctl;
-	struct cn_ctl_entry *ent;
-	u32 size;
-
-	if (msg->len < sizeof(*ctl))
-		return;
-
-	ctl = (struct cn_ctl_msg *)msg->data;
-
-	size = (sizeof(*ctl) + ((ctl->idx_notify_num +
-				 ctl->val_notify_num) *
-				sizeof(struct cn_notify_req)));
-
-	if (msg->len != size)
-		return;
-
-	if (ctl->len + sizeof(*ctl) != msg->len)
-		return;
-
-	/*
-	 * Remove notification.
-	 */
-	if (ctl->group == 0) {
-		struct cn_ctl_entry *n;
-
-		mutex_lock(&notify_lock);
-		list_for_each_entry_safe(ent, n, &notify_list, notify_entry) {
-			if (cn_ctl_msg_equals(ent->msg, ctl)) {
-				list_del(&ent->notify_entry);
-				kfree(ent);
-			}
-		}
-		mutex_unlock(&notify_lock);
-
-		return;
-	}
-
-	size += sizeof(*ent);
-
-	ent = kzalloc(size, GFP_KERNEL);
-	if (!ent)
-		return;
-
-	ent->msg = (struct cn_ctl_msg *)(ent + 1);
-
-	memcpy(ent->msg, ctl, size - sizeof(*ent));
-
-	mutex_lock(&notify_lock);
-	list_add(&ent->notify_entry, &notify_list);
-	mutex_unlock(&notify_lock);
-}
-
 static int cn_proc_show(struct seq_file *m, void *v)
 {
 	struct cn_queue_dev *dev = cdev.cbdev;
@@ -437,11 +274,8 @@ static const struct file_operations cn_file_ops = {
 static int __devinit cn_init(void)
 {
 	struct cn_dev *dev = &cdev;
-	int err;
 
 	dev->input = cn_rx_skb;
-	dev->id.idx = cn_idx;
-	dev->id.val = cn_val;
 
 	dev->nls = netlink_kernel_create(&init_net, NETLINK_CONNECTOR,
 					 CN_NETLINK_USERS + 0xf,
@@ -457,14 +291,6 @@ static int __devinit cn_init(void)
 
 	cn_already_initialized = 1;
 
-	err = cn_add_callback(&dev->id, "connector", &cn_callback);
-	if (err) {
-		cn_already_initialized = 0;
-		cn_queue_free_dev(dev->cbdev);
-		netlink_kernel_release(dev->nls);
-		return -EINVAL;
-	}
-
 	proc_net_fops_create(&init_net, "connector", S_IRUGO, &cn_file_ops);
 
 	return 0;
@@ -478,7 +304,6 @@ static void __devexit cn_fini(void)
 
 	proc_net_remove(&init_net, "connector");
 
-	cn_del_callback(&dev->id);
 	cn_queue_free_dev(dev->cbdev);
 	netlink_kernel_release(dev->nls);
 }
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index ff57c40e9b8b..67bc2ece7b4b 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -64,14 +64,14 @@ static DEFINE_SPINLOCK(cpufreq_driver_lock);
  * - Lock should not be held across
  *     __cpufreq_governor(data, CPUFREQ_GOV_STOP);
  */
-static DEFINE_PER_CPU(int, policy_cpu);
+static DEFINE_PER_CPU(int, cpufreq_policy_cpu);
 static DEFINE_PER_CPU(struct rw_semaphore, cpu_policy_rwsem);
 
 #define lock_policy_rwsem(mode, cpu)					\
 int lock_policy_rwsem_##mode						\
 (int cpu)								\
 {									\
-	int policy_cpu = per_cpu(policy_cpu, cpu);			\
+	int policy_cpu = per_cpu(cpufreq_policy_cpu, cpu);		\
 	BUG_ON(policy_cpu == -1);					\
 	down_##mode(&per_cpu(cpu_policy_rwsem, policy_cpu));		\
 	if (unlikely(!cpu_online(cpu))) {				\
@@ -90,7 +90,7 @@ EXPORT_SYMBOL_GPL(lock_policy_rwsem_write);
 
 void unlock_policy_rwsem_read(int cpu)
 {
-	int policy_cpu = per_cpu(policy_cpu, cpu);
+	int policy_cpu = per_cpu(cpufreq_policy_cpu, cpu);
 	BUG_ON(policy_cpu == -1);
 	up_read(&per_cpu(cpu_policy_rwsem, policy_cpu));
 }
@@ -98,7 +98,7 @@ EXPORT_SYMBOL_GPL(unlock_policy_rwsem_read);
 
 void unlock_policy_rwsem_write(int cpu)
 {
-	int policy_cpu = per_cpu(policy_cpu, cpu);
+	int policy_cpu = per_cpu(cpufreq_policy_cpu, cpu);
 	BUG_ON(policy_cpu == -1);
 	up_write(&per_cpu(cpu_policy_rwsem, policy_cpu));
 }
@@ -647,6 +647,21 @@ static ssize_t show_scaling_setspeed(struct cpufreq_policy *policy, char *buf)
 	return policy->governor->show_setspeed(policy, buf);
 }
 
+/**
+ * show_scaling_driver - show the current cpufreq HW/BIOS limitation
+ */
+static ssize_t show_bios_limit(struct cpufreq_policy *policy, char *buf)
+{
+	unsigned int limit;
+	int ret;
+	if (cpufreq_driver->bios_limit) {
+		ret = cpufreq_driver->bios_limit(policy->cpu, &limit);
+		if (!ret)
+			return sprintf(buf, "%u\n", limit);
+	}
+	return sprintf(buf, "%u\n", policy->cpuinfo.max_freq);
+}
+
 #define define_one_ro(_name) \
 static struct freq_attr _name = \
 __ATTR(_name, 0444, show_##_name, NULL)
@@ -666,6 +681,7 @@ define_one_ro(cpuinfo_transition_latency);
 define_one_ro(scaling_available_governors);
 define_one_ro(scaling_driver);
 define_one_ro(scaling_cur_freq);
+define_one_ro(bios_limit);
 define_one_ro(related_cpus);
 define_one_ro(affected_cpus);
 define_one_rw(scaling_min_freq);
@@ -767,8 +783,9 @@ static struct kobj_type ktype_cpufreq = {
  *   0:        Success
  *   Positive: When we have a managed CPU and the sysfs got symlinked
  */
-int cpufreq_add_dev_policy(unsigned int cpu, struct cpufreq_policy *policy,
-		struct sys_device *sys_dev)
+static int cpufreq_add_dev_policy(unsigned int cpu,
+				  struct cpufreq_policy *policy,
+				  struct sys_device *sys_dev)
 {
 	int ret = 0;
 #ifdef CONFIG_SMP
@@ -801,7 +818,7 @@ int cpufreq_add_dev_policy(unsigned int cpu, struct cpufreq_policy *policy,
 
 			/* Set proper policy_cpu */
 			unlock_policy_rwsem_write(cpu);
-			per_cpu(policy_cpu, cpu) = managed_policy->cpu;
+			per_cpu(cpufreq_policy_cpu, cpu) = managed_policy->cpu;
 
 			if (lock_policy_rwsem_write(cpu) < 0) {
 				/* Should not go through policy unlock path */
@@ -842,7 +859,8 @@ int cpufreq_add_dev_policy(unsigned int cpu, struct cpufreq_policy *policy,
 
 
 /* symlink affected CPUs */
-int cpufreq_add_dev_symlink(unsigned int cpu, struct cpufreq_policy *policy)
+static int cpufreq_add_dev_symlink(unsigned int cpu,
+				   struct cpufreq_policy *policy)
 {
 	unsigned int j;
 	int ret = 0;
@@ -869,8 +887,9 @@ int cpufreq_add_dev_symlink(unsigned int cpu, struct cpufreq_policy *policy)
 	return ret;
 }
 
-int cpufreq_add_dev_interface(unsigned int cpu, struct cpufreq_policy *policy,
-		struct sys_device *sys_dev)
+static int cpufreq_add_dev_interface(unsigned int cpu,
+				     struct cpufreq_policy *policy,
+				     struct sys_device *sys_dev)
 {
 	struct cpufreq_policy new_policy;
 	struct freq_attr **drv_attr;
@@ -902,13 +921,18 @@ int cpufreq_add_dev_interface(unsigned int cpu, struct cpufreq_policy *policy,
 		if (ret)
 			goto err_out_kobj_put;
 	}
+	if (cpufreq_driver->bios_limit) {
+		ret = sysfs_create_file(&policy->kobj, &bios_limit.attr);
+		if (ret)
+			goto err_out_kobj_put;
+	}
 
 	spin_lock_irqsave(&cpufreq_driver_lock, flags);
 	for_each_cpu(j, policy->cpus) {
 	if (!cpu_online(j))
 		continue;
 		per_cpu(cpufreq_cpu_data, j) = policy;
-		per_cpu(policy_cpu, j) = policy->cpu;
+		per_cpu(cpufreq_policy_cpu, j) = policy->cpu;
 	}
 	spin_unlock_irqrestore(&cpufreq_driver_lock, flags);
 
@@ -996,7 +1020,7 @@ static int cpufreq_add_dev(struct sys_device *sys_dev)
 	cpumask_copy(policy->cpus, cpumask_of(cpu));
 
 	/* Initially set CPU itself as the policy_cpu */
-	per_cpu(policy_cpu, cpu) = cpu;
+	per_cpu(cpufreq_policy_cpu, cpu) = cpu;
 	ret = (lock_policy_rwsem_write(cpu) < 0);
 	WARN_ON(ret);
 
@@ -1978,7 +2002,7 @@ static int __init cpufreq_core_init(void)
 	int cpu;
 
 	for_each_possible_cpu(cpu) {
-		per_cpu(policy_cpu, cpu) = -1;
+		per_cpu(cpufreq_policy_cpu, cpu) = -1;
 		init_rwsem(&per_cpu(cpu_policy_rwsem, cpu));
 	}
 
diff --git a/drivers/cpufreq/cpufreq_conservative.c b/drivers/cpufreq/cpufreq_conservative.c
index c7b081b839ff..599a40b25cb0 100644
--- a/drivers/cpufreq/cpufreq_conservative.c
+++ b/drivers/cpufreq/cpufreq_conservative.c
@@ -164,20 +164,22 @@ static struct notifier_block dbs_cpufreq_notifier_block = {
 };
 
 /************************** sysfs interface ************************/
-static ssize_t show_sampling_rate_max(struct cpufreq_policy *policy, char *buf)
+static ssize_t show_sampling_rate_max(struct kobject *kobj,
+				      struct attribute *attr, char *buf)
 {
 	printk_once(KERN_INFO "CPUFREQ: conservative sampling_rate_max "
 		    "sysfs file is deprecated - used by: %s\n", current->comm);
 	return sprintf(buf, "%u\n", -1U);
 }
 
-static ssize_t show_sampling_rate_min(struct cpufreq_policy *policy, char *buf)
+static ssize_t show_sampling_rate_min(struct kobject *kobj,
+				      struct attribute *attr, char *buf)
 {
 	return sprintf(buf, "%u\n", min_sampling_rate);
 }
 
 #define define_one_ro(_name)		\
-static struct freq_attr _name =		\
+static struct global_attr _name =	\
 __ATTR(_name, 0444, show_##_name, NULL)
 
 define_one_ro(sampling_rate_max);
@@ -186,7 +188,7 @@ define_one_ro(sampling_rate_min);
 /* cpufreq_conservative Governor Tunables */
 #define show_one(file_name, object)					\
 static ssize_t show_##file_name						\
-(struct cpufreq_policy *unused, char *buf)				\
+(struct kobject *kobj, struct attribute *attr, char *buf)		\
 {									\
 	return sprintf(buf, "%u\n", dbs_tuners_ins.object);		\
 }
@@ -197,8 +199,40 @@ show_one(down_threshold, down_threshold);
 show_one(ignore_nice_load, ignore_nice);
 show_one(freq_step, freq_step);
 
-static ssize_t store_sampling_down_factor(struct cpufreq_policy *unused,
-		const char *buf, size_t count)
+/*** delete after deprecation time ***/
+#define DEPRECATION_MSG(file_name)					\
+	printk_once(KERN_INFO "CPUFREQ: Per core conservative sysfs "	\
+		"interface is deprecated - " #file_name "\n");
+
+#define show_one_old(file_name)						\
+static ssize_t show_##file_name##_old					\
+(struct cpufreq_policy *unused, char *buf)				\
+{									\
+	printk_once(KERN_INFO "CPUFREQ: Per core conservative sysfs "	\
+		"interface is deprecated - " #file_name "\n");		\
+	return show_##file_name(NULL, NULL, buf);			\
+}
+show_one_old(sampling_rate);
+show_one_old(sampling_down_factor);
+show_one_old(up_threshold);
+show_one_old(down_threshold);
+show_one_old(ignore_nice_load);
+show_one_old(freq_step);
+show_one_old(sampling_rate_min);
+show_one_old(sampling_rate_max);
+
+#define define_one_ro_old(object, _name)	\
+static struct freq_attr object =		\
+__ATTR(_name, 0444, show_##_name##_old, NULL)
+
+define_one_ro_old(sampling_rate_min_old, sampling_rate_min);
+define_one_ro_old(sampling_rate_max_old, sampling_rate_max);
+
+/*** delete after deprecation time ***/
+
+static ssize_t store_sampling_down_factor(struct kobject *a,
+					  struct attribute *b,
+					  const char *buf, size_t count)
 {
 	unsigned int input;
 	int ret;
@@ -214,8 +248,8 @@ static ssize_t store_sampling_down_factor(struct cpufreq_policy *unused,
 	return count;
 }
 
-static ssize_t store_sampling_rate(struct cpufreq_policy *unused,
-		const char *buf, size_t count)
+static ssize_t store_sampling_rate(struct kobject *a, struct attribute *b,
+				   const char *buf, size_t count)
 {
 	unsigned int input;
 	int ret;
@@ -231,8 +265,8 @@ static ssize_t store_sampling_rate(struct cpufreq_policy *unused,
 	return count;
 }
 
-static ssize_t store_up_threshold(struct cpufreq_policy *unused,
-		const char *buf, size_t count)
+static ssize_t store_up_threshold(struct kobject *a, struct attribute *b,
+				  const char *buf, size_t count)
 {
 	unsigned int input;
 	int ret;
@@ -251,8 +285,8 @@ static ssize_t store_up_threshold(struct cpufreq_policy *unused,
 	return count;
 }
 
-static ssize_t store_down_threshold(struct cpufreq_policy *unused,
-		const char *buf, size_t count)
+static ssize_t store_down_threshold(struct kobject *a, struct attribute *b,
+				    const char *buf, size_t count)
 {
 	unsigned int input;
 	int ret;
@@ -272,8 +306,8 @@ static ssize_t store_down_threshold(struct cpufreq_policy *unused,
 	return count;
 }
 
-static ssize_t store_ignore_nice_load(struct cpufreq_policy *policy,
-		const char *buf, size_t count)
+static ssize_t store_ignore_nice_load(struct kobject *a, struct attribute *b,
+				      const char *buf, size_t count)
 {
 	unsigned int input;
 	int ret;
@@ -308,8 +342,8 @@ static ssize_t store_ignore_nice_load(struct cpufreq_policy *policy,
 	return count;
 }
 
-static ssize_t store_freq_step(struct cpufreq_policy *policy,
-		const char *buf, size_t count)
+static ssize_t store_freq_step(struct kobject *a, struct attribute *b,
+			       const char *buf, size_t count)
 {
 	unsigned int input;
 	int ret;
@@ -331,7 +365,7 @@ static ssize_t store_freq_step(struct cpufreq_policy *policy,
 }
 
 #define define_one_rw(_name) \
-static struct freq_attr _name = \
+static struct global_attr _name = \
 __ATTR(_name, 0644, show_##_name, store_##_name)
 
 define_one_rw(sampling_rate);
@@ -358,6 +392,53 @@ static struct attribute_group dbs_attr_group = {
 	.name = "conservative",
 };
 
+/*** delete after deprecation time ***/
+
+#define write_one_old(file_name)					\
+static ssize_t store_##file_name##_old					\
+(struct cpufreq_policy *unused, const char *buf, size_t count)		\
+{									\
+	printk_once(KERN_INFO "CPUFREQ: Per core conservative sysfs "	\
+		"interface is deprecated - " #file_name "\n");	\
+	return store_##file_name(NULL, NULL, buf, count);		\
+}
+write_one_old(sampling_rate);
+write_one_old(sampling_down_factor);
+write_one_old(up_threshold);
+write_one_old(down_threshold);
+write_one_old(ignore_nice_load);
+write_one_old(freq_step);
+
+#define define_one_rw_old(object, _name)	\
+static struct freq_attr object =		\
+__ATTR(_name, 0644, show_##_name##_old, store_##_name##_old)
+
+define_one_rw_old(sampling_rate_old, sampling_rate);
+define_one_rw_old(sampling_down_factor_old, sampling_down_factor);
+define_one_rw_old(up_threshold_old, up_threshold);
+define_one_rw_old(down_threshold_old, down_threshold);
+define_one_rw_old(ignore_nice_load_old, ignore_nice_load);
+define_one_rw_old(freq_step_old, freq_step);
+
+static struct attribute *dbs_attributes_old[] = {
+	&sampling_rate_max_old.attr,
+	&sampling_rate_min_old.attr,
+	&sampling_rate_old.attr,
+	&sampling_down_factor_old.attr,
+	&up_threshold_old.attr,
+	&down_threshold_old.attr,
+	&ignore_nice_load_old.attr,
+	&freq_step_old.attr,
+	NULL
+};
+
+static struct attribute_group dbs_attr_group_old = {
+	.attrs = dbs_attributes_old,
+	.name = "conservative",
+};
+
+/*** delete after deprecation time ***/
+
 /************************** sysfs end ************************/
 
 static void dbs_check_cpu(struct cpu_dbs_info_s *this_dbs_info)
@@ -530,7 +611,7 @@ static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
 
 		mutex_lock(&dbs_mutex);
 
-		rc = sysfs_create_group(&policy->kobj, &dbs_attr_group);
+		rc = sysfs_create_group(&policy->kobj, &dbs_attr_group_old);
 		if (rc) {
 			mutex_unlock(&dbs_mutex);
 			return rc;
@@ -564,6 +645,13 @@ static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
 			if (latency == 0)
 				latency = 1;
 
+			rc = sysfs_create_group(cpufreq_global_kobject,
+						&dbs_attr_group);
+			if (rc) {
+				mutex_unlock(&dbs_mutex);
+				return rc;
+			}
+
 			/*
 			 * conservative does not implement micro like ondemand
 			 * governor, thus we are bound to jiffes/HZ
@@ -591,7 +679,7 @@ static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
 		dbs_timer_exit(this_dbs_info);
 
 		mutex_lock(&dbs_mutex);
-		sysfs_remove_group(&policy->kobj, &dbs_attr_group);
+		sysfs_remove_group(&policy->kobj, &dbs_attr_group_old);
 		dbs_enable--;
 		mutex_destroy(&this_dbs_info->timer_mutex);
 
@@ -605,6 +693,9 @@ static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
 					CPUFREQ_TRANSITION_NOTIFIER);
 
 		mutex_unlock(&dbs_mutex);
+		if (!dbs_enable)
+			sysfs_remove_group(cpufreq_global_kobject,
+					   &dbs_attr_group);
 
 		break;
 
diff --git a/drivers/cpufreq/freq_table.c b/drivers/cpufreq/freq_table.c
index a9bd3a05a684..05432216e224 100644
--- a/drivers/cpufreq/freq_table.c
+++ b/drivers/cpufreq/freq_table.c
@@ -174,7 +174,7 @@ int cpufreq_frequency_table_target(struct cpufreq_policy *policy,
 }
 EXPORT_SYMBOL_GPL(cpufreq_frequency_table_target);
 
-static DEFINE_PER_CPU(struct cpufreq_frequency_table *, show_table);
+static DEFINE_PER_CPU(struct cpufreq_frequency_table *, cpufreq_show_table);
 /**
  * show_available_freqs - show available frequencies for the specified CPU
  */
@@ -185,10 +185,10 @@ static ssize_t show_available_freqs(struct cpufreq_policy *policy, char *buf)
 	ssize_t count = 0;
 	struct cpufreq_frequency_table *table;
 
-	if (!per_cpu(show_table, cpu))
+	if (!per_cpu(cpufreq_show_table, cpu))
 		return -ENODEV;
 
-	table = per_cpu(show_table, cpu);
+	table = per_cpu(cpufreq_show_table, cpu);
 
 	for (i = 0; (table[i].frequency != CPUFREQ_TABLE_END); i++) {
 		if (table[i].frequency == CPUFREQ_ENTRY_INVALID)
@@ -217,20 +217,20 @@ void cpufreq_frequency_table_get_attr(struct cpufreq_frequency_table *table,
 				      unsigned int cpu)
 {
 	dprintk("setting show_table for cpu %u to %p\n", cpu, table);
-	per_cpu(show_table, cpu) = table;
+	per_cpu(cpufreq_show_table, cpu) = table;
 }
 EXPORT_SYMBOL_GPL(cpufreq_frequency_table_get_attr);
 
 void cpufreq_frequency_table_put_attr(unsigned int cpu)
 {
 	dprintk("clearing show_table for cpu %u\n", cpu);
-	per_cpu(show_table, cpu) = NULL;
+	per_cpu(cpufreq_show_table, cpu) = NULL;
 }
 EXPORT_SYMBOL_GPL(cpufreq_frequency_table_put_attr);
 
 struct cpufreq_frequency_table *cpufreq_frequency_get_table(unsigned int cpu)
 {
-	return per_cpu(show_table, cpu);
+	return per_cpu(cpufreq_show_table, cpu);
 }
 EXPORT_SYMBOL_GPL(cpufreq_frequency_get_table);
 
diff --git a/drivers/cpuidle/governor.c b/drivers/cpuidle/governor.c
index 70b59642a708..724c164d31c9 100644
--- a/drivers/cpuidle/governor.c
+++ b/drivers/cpuidle/governor.c
@@ -21,7 +21,7 @@ struct cpuidle_governor *cpuidle_curr_governor;
  * __cpuidle_find_governor - finds a governor of the specified name
  * @str: the name
  *
- * Must be called with cpuidle_lock aquired.
+ * Must be called with cpuidle_lock acquired.
  */
 static struct cpuidle_governor * __cpuidle_find_governor(const char *str)
 {
@@ -39,7 +39,7 @@ static struct cpuidle_governor * __cpuidle_find_governor(const char *str)
  * @gov: the new target governor
  *
  * NOTE: "gov" can be NULL to specify disabled
- * Must be called with cpuidle_lock aquired.
+ * Must be called with cpuidle_lock acquired.
  */
 int cpuidle_switch_governor(struct cpuidle_governor *gov)
 {
diff --git a/drivers/cpuidle/governors/ladder.c b/drivers/cpuidle/governors/ladder.c
index a4bec3f919aa..1c1ceb4f218f 100644
--- a/drivers/cpuidle/governors/ladder.c
+++ b/drivers/cpuidle/governors/ladder.c
@@ -69,9 +69,6 @@ static int ladder_select_state(struct cpuidle_device *dev)
 	int last_residency, last_idx = ldev->last_state_idx;
 	int latency_req = pm_qos_requirement(PM_QOS_CPU_DMA_LATENCY);
 
-	if (unlikely(!ldev))
-		return 0;
-
 	/* Special case when user has set very strict latency requirement */
 	if (unlikely(latency_req == 0)) {
 		ladder_do_selection(ldev, last_idx, 0);
diff --git a/drivers/cpuidle/governors/menu.c b/drivers/cpuidle/governors/menu.c
index 68104434ebb5..73655aeb3a60 100644
--- a/drivers/cpuidle/governors/menu.c
+++ b/drivers/cpuidle/governors/menu.c
@@ -18,6 +18,7 @@
 #include <linux/hrtimer.h>
 #include <linux/tick.h>
 #include <linux/sched.h>
+#include <linux/math64.h>
 
 #define BUCKETS 12
 #define RESOLUTION 1024
@@ -169,6 +170,12 @@ static DEFINE_PER_CPU(struct menu_device, menu_devices);
 
 static void menu_update(struct cpuidle_device *dev);
 
+/* This implements DIV_ROUND_CLOSEST but avoids 64 bit division */
+static u64 div_round64(u64 dividend, u32 divisor)
+{
+	return div_u64(dividend + (divisor / 2), divisor);
+}
+
 /**
  * menu_select - selects the next idle state to enter
  * @dev: the CPU
@@ -209,9 +216,8 @@ static int menu_select(struct cpuidle_device *dev)
 		data->correction_factor[data->bucket] = RESOLUTION * DECAY;
 
 	/* Make sure to round up for half microseconds */
-	data->predicted_us = DIV_ROUND_CLOSEST(
-		data->expected_us * data->correction_factor[data->bucket],
-		RESOLUTION * DECAY);
+	data->predicted_us = div_round64(data->expected_us * data->correction_factor[data->bucket],
+					 RESOLUTION * DECAY);
 
 	/*
 	 * We want to default to C1 (hlt), not to busy polling
diff --git a/drivers/crypto/hifn_795x.c b/drivers/crypto/hifn_795x.c
index 5f753fc08730..09ad9154d86c 100644
--- a/drivers/crypto/hifn_795x.c
+++ b/drivers/crypto/hifn_795x.c
@@ -863,7 +863,7 @@ static int hifn_init_pubrng(struct hifn_device *dev)
 		dev->dmareg |= HIFN_DMAIER_PUBDONE;
 		hifn_write_1(dev, HIFN_1_DMA_IER, dev->dmareg);
 
-		dprintk("Chip %s: Public key engine has been sucessfully "
+		dprintk("Chip %s: Public key engine has been successfully "
 				"initialised.\n", dev->name);
 	}
 
diff --git a/drivers/crypto/padlock-aes.c b/drivers/crypto/padlock-aes.c
index 84c51e177269..8c2f3703ec85 100644
--- a/drivers/crypto/padlock-aes.c
+++ b/drivers/crypto/padlock-aes.c
@@ -64,7 +64,7 @@ struct aes_ctx {
 	u32 *D;
 };
 
-static DEFINE_PER_CPU(struct cword *, last_cword);
+static DEFINE_PER_CPU(struct cword *, paes_last_cword);
 
 /* Tells whether the ACE is capable to generate
    the extended key for a given key_len. */
@@ -152,9 +152,9 @@ static int aes_set_key(struct crypto_tfm *tfm, const u8 *in_key,
 
 ok:
 	for_each_online_cpu(cpu)
-		if (&ctx->cword.encrypt == per_cpu(last_cword, cpu) ||
-		    &ctx->cword.decrypt == per_cpu(last_cword, cpu))
-			per_cpu(last_cword, cpu) = NULL;
+		if (&ctx->cword.encrypt == per_cpu(paes_last_cword, cpu) ||
+		    &ctx->cword.decrypt == per_cpu(paes_last_cword, cpu))
+			per_cpu(paes_last_cword, cpu) = NULL;
 
 	return 0;
 }
@@ -166,7 +166,7 @@ static inline void padlock_reset_key(struct cword *cword)
 {
 	int cpu = raw_smp_processor_id();
 
-	if (cword != per_cpu(last_cword, cpu))
+	if (cword != per_cpu(paes_last_cword, cpu))
 #ifndef CONFIG_X86_64
 		asm volatile ("pushfl; popfl");
 #else
@@ -176,7 +176,7 @@ static inline void padlock_reset_key(struct cword *cword)
 
 static inline void padlock_store_cword(struct cword *cword)
 {
-	per_cpu(last_cword, raw_smp_processor_id()) = cword;
+	per_cpu(paes_last_cword, raw_smp_processor_id()) = cword;
 }
 
 /*
diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig
index eb140ff38c27..e02d74b1e892 100644
--- a/drivers/dma/Kconfig
+++ b/drivers/dma/Kconfig
@@ -111,6 +111,24 @@ config SH_DMAE
 	help
 	  Enable support for the Renesas SuperH DMA controllers.
 
+config COH901318
+	bool "ST-Ericsson COH901318 DMA support"
+	select DMA_ENGINE
+	depends on ARCH_U300
+	help
+	  Enable support for ST-Ericsson COH 901 318 DMA.
+
+config AMCC_PPC440SPE_ADMA
+	tristate "AMCC PPC440SPe ADMA support"
+	depends on 440SPe || 440SP
+	select DMA_ENGINE
+	select ARCH_HAS_ASYNC_TX_FIND_CHANNEL
+	help
+	  Enable support for the AMCC PPC440SPe RAID engines.
+
+config ARCH_HAS_ASYNC_TX_FIND_CHANNEL
+	bool
+
 config DMA_ENGINE
 	bool
 
diff --git a/drivers/dma/Makefile b/drivers/dma/Makefile
index eca71ba78ae9..807053d48232 100644
--- a/drivers/dma/Makefile
+++ b/drivers/dma/Makefile
@@ -10,3 +10,5 @@ obj-$(CONFIG_AT_HDMAC) += at_hdmac.o
 obj-$(CONFIG_MX3_IPU) += ipu/
 obj-$(CONFIG_TXX9_DMAC) += txx9dmac.o
 obj-$(CONFIG_SH_DMAE) += shdma.o
+obj-$(CONFIG_COH901318) += coh901318.o coh901318_lli.o
+obj-$(CONFIG_AMCC_PPC440SPE_ADMA) += ppc4xx/
diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
index 7585c4164bd5..efc1a61ca231 100644
--- a/drivers/dma/at_hdmac.c
+++ b/drivers/dma/at_hdmac.c
@@ -99,7 +99,7 @@ static struct at_desc *atc_alloc_descriptor(struct dma_chan *chan,
 }
 
 /**
- * atc_desc_get - get a unsused descriptor from free_list
+ * atc_desc_get - get an unused descriptor from free_list
  * @atchan: channel we want a new descriptor for
  */
 static struct at_desc *atc_desc_get(struct at_dma_chan *atchan)
@@ -815,7 +815,7 @@ atc_is_tx_complete(struct dma_chan *chan,
 	dev_vdbg(chan2dev(chan), "is_tx_complete: %d (d%d, u%d)\n",
 			cookie, done ? *done : 0, used ? *used : 0);
 
-	spin_lock_bh(atchan->lock);
+	spin_lock_bh(&atchan->lock);
 
 	last_complete = atchan->completed_cookie;
 	last_used = chan->cookie;
@@ -830,7 +830,7 @@ atc_is_tx_complete(struct dma_chan *chan,
 		ret = dma_async_is_complete(cookie, last_complete, last_used);
 	}
 
-	spin_unlock_bh(atchan->lock);
+	spin_unlock_bh(&atchan->lock);
 
 	if (done)
 		*done = last_complete;
@@ -1188,7 +1188,7 @@ static int at_dma_resume_noirq(struct device *dev)
 	return 0;
 }
 
-static struct dev_pm_ops at_dma_dev_pm_ops = {
+static const struct dev_pm_ops at_dma_dev_pm_ops = {
 	.suspend_noirq = at_dma_suspend_noirq,
 	.resume_noirq = at_dma_resume_noirq,
 };
diff --git a/drivers/dma/coh901318.c b/drivers/dma/coh901318.c
new file mode 100644
index 000000000000..b5f2ee0f8e2c
--- /dev/null
+++ b/drivers/dma/coh901318.c
@@ -0,0 +1,1325 @@
+/*
+ * driver/dma/coh901318.c
+ *
+ * Copyright (C) 2007-2009 ST-Ericsson
+ * License terms: GNU General Public License (GPL) version 2
+ * DMA driver for COH 901 318
+ * Author: Per Friden <per.friden@stericsson.com>
+ */
+
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/kernel.h> /* printk() */
+#include <linux/fs.h> /* everything... */
+#include <linux/slab.h> /* kmalloc() */
+#include <linux/dmaengine.h>
+#include <linux/platform_device.h>
+#include <linux/device.h>
+#include <linux/irqreturn.h>
+#include <linux/interrupt.h>
+#include <linux/io.h>
+#include <linux/uaccess.h>
+#include <linux/debugfs.h>
+#include <mach/coh901318.h>
+
+#include "coh901318_lli.h"
+
+#define COHC_2_DEV(cohc) (&cohc->chan.dev->device)
+
+#ifdef VERBOSE_DEBUG
+#define COH_DBG(x) ({ if (1) x; 0; })
+#else
+#define COH_DBG(x) ({ if (0) x; 0; })
+#endif
+
+struct coh901318_desc {
+	struct dma_async_tx_descriptor desc;
+	struct list_head node;
+	struct scatterlist *sg;
+	unsigned int sg_len;
+	struct coh901318_lli *data;
+	enum dma_data_direction dir;
+	int pending_irqs;
+	unsigned long flags;
+};
+
+struct coh901318_base {
+	struct device *dev;
+	void __iomem *virtbase;
+	struct coh901318_pool pool;
+	struct powersave pm;
+	struct dma_device dma_slave;
+	struct dma_device dma_memcpy;
+	struct coh901318_chan *chans;
+	struct coh901318_platform *platform;
+};
+
+struct coh901318_chan {
+	spinlock_t lock;
+	int allocated;
+	int completed;
+	int id;
+	int stopped;
+
+	struct work_struct free_work;
+	struct dma_chan chan;
+
+	struct tasklet_struct tasklet;
+
+	struct list_head active;
+	struct list_head queue;
+	struct list_head free;
+
+	unsigned long nbr_active_done;
+	unsigned long busy;
+	int pending_irqs;
+
+	struct coh901318_base *base;
+};
+
+static void coh901318_list_print(struct coh901318_chan *cohc,
+				 struct coh901318_lli *lli)
+{
+	struct coh901318_lli *l;
+	dma_addr_t addr =  virt_to_phys(lli);
+	int i = 0;
+
+	while (addr) {
+		l = phys_to_virt(addr);
+		dev_vdbg(COHC_2_DEV(cohc), "i %d, lli %p, ctrl 0x%x, src 0x%x"
+			 ", dst 0x%x, link 0x%x link_virt 0x%p\n",
+			 i, l, l->control, l->src_addr, l->dst_addr,
+			 l->link_addr, phys_to_virt(l->link_addr));
+		i++;
+		addr = l->link_addr;
+	}
+}
+
+#ifdef CONFIG_DEBUG_FS
+
+#define COH901318_DEBUGFS_ASSIGN(x, y) (x = y)
+
+static struct coh901318_base *debugfs_dma_base;
+static struct dentry *dma_dentry;
+
+static int coh901318_debugfs_open(struct inode *inode, struct file *file)
+{
+
+	file->private_data = inode->i_private;
+	return 0;
+}
+
+static int coh901318_debugfs_read(struct file *file, char __user *buf,
+				  size_t count, loff_t *f_pos)
+{
+	u64 started_channels = debugfs_dma_base->pm.started_channels;
+	int pool_count = debugfs_dma_base->pool.debugfs_pool_counter;
+	int i;
+	int ret = 0;
+	char *dev_buf;
+	char *tmp;
+	int dev_size;
+
+	dev_buf = kmalloc(4*1024, GFP_KERNEL);
+	if (dev_buf == NULL)
+		goto err_kmalloc;
+	tmp = dev_buf;
+
+	tmp += sprintf(tmp, "DMA -- enable dma channels\n");
+
+	for (i = 0; i < debugfs_dma_base->platform->max_channels; i++)
+		if (started_channels & (1 << i))
+			tmp += sprintf(tmp, "channel %d\n", i);
+
+	tmp += sprintf(tmp, "Pool alloc nbr %d\n", pool_count);
+	dev_size = tmp  - dev_buf;
+
+	/* No more to read if offset != 0 */
+	if (*f_pos > dev_size)
+		goto out;
+
+	if (count > dev_size - *f_pos)
+		count = dev_size - *f_pos;
+
+	if (copy_to_user(buf, dev_buf + *f_pos, count))
+		ret = -EINVAL;
+	ret = count;
+	*f_pos += count;
+
+ out:
+	kfree(dev_buf);
+	return ret;
+
+ err_kmalloc:
+	return 0;
+}
+
+static const struct file_operations coh901318_debugfs_status_operations = {
+	.owner		= THIS_MODULE,
+	.open		= coh901318_debugfs_open,
+	.read		= coh901318_debugfs_read,
+};
+
+
+static int __init init_coh901318_debugfs(void)
+{
+
+	dma_dentry = debugfs_create_dir("dma", NULL);
+
+	(void) debugfs_create_file("status",
+				   S_IFREG | S_IRUGO,
+				   dma_dentry, NULL,
+				   &coh901318_debugfs_status_operations);
+	return 0;
+}
+
+static void __exit exit_coh901318_debugfs(void)
+{
+	debugfs_remove_recursive(dma_dentry);
+}
+
+module_init(init_coh901318_debugfs);
+module_exit(exit_coh901318_debugfs);
+#else
+
+#define COH901318_DEBUGFS_ASSIGN(x, y)
+
+#endif /* CONFIG_DEBUG_FS */
+
+static inline struct coh901318_chan *to_coh901318_chan(struct dma_chan *chan)
+{
+	return container_of(chan, struct coh901318_chan, chan);
+}
+
+static inline dma_addr_t
+cohc_dev_addr(struct coh901318_chan *cohc)
+{
+	return cohc->base->platform->chan_conf[cohc->id].dev_addr;
+}
+
+static inline const struct coh901318_params *
+cohc_chan_param(struct coh901318_chan *cohc)
+{
+	return &cohc->base->platform->chan_conf[cohc->id].param;
+}
+
+static inline const struct coh_dma_channel *
+cohc_chan_conf(struct coh901318_chan *cohc)
+{
+	return &cohc->base->platform->chan_conf[cohc->id];
+}
+
+static void enable_powersave(struct coh901318_chan *cohc)
+{
+	unsigned long flags;
+	struct powersave *pm = &cohc->base->pm;
+
+	spin_lock_irqsave(&pm->lock, flags);
+
+	pm->started_channels &= ~(1ULL << cohc->id);
+
+	if (!pm->started_channels) {
+		/* DMA no longer intends to access memory */
+		cohc->base->platform->access_memory_state(cohc->base->dev,
+							  false);
+	}
+
+	spin_unlock_irqrestore(&pm->lock, flags);
+}
+static void disable_powersave(struct coh901318_chan *cohc)
+{
+	unsigned long flags;
+	struct powersave *pm = &cohc->base->pm;
+
+	spin_lock_irqsave(&pm->lock, flags);
+
+	if (!pm->started_channels) {
+		/* DMA intends to access memory */
+		cohc->base->platform->access_memory_state(cohc->base->dev,
+							  true);
+	}
+
+	pm->started_channels |= (1ULL << cohc->id);
+
+	spin_unlock_irqrestore(&pm->lock, flags);
+}
+
+static inline int coh901318_set_ctrl(struct coh901318_chan *cohc, u32 control)
+{
+	int channel = cohc->id;
+	void __iomem *virtbase = cohc->base->virtbase;
+
+	writel(control,
+	       virtbase + COH901318_CX_CTRL +
+	       COH901318_CX_CTRL_SPACING * channel);
+	return 0;
+}
+
+static inline int coh901318_set_conf(struct coh901318_chan *cohc, u32 conf)
+{
+	int channel = cohc->id;
+	void __iomem *virtbase = cohc->base->virtbase;
+
+	writel(conf,
+	       virtbase + COH901318_CX_CFG +
+	       COH901318_CX_CFG_SPACING*channel);
+	return 0;
+}
+
+
+static int coh901318_start(struct coh901318_chan *cohc)
+{
+	u32 val;
+	int channel = cohc->id;
+	void __iomem *virtbase = cohc->base->virtbase;
+
+	disable_powersave(cohc);
+
+	val = readl(virtbase + COH901318_CX_CFG +
+		    COH901318_CX_CFG_SPACING * channel);
+
+	/* Enable channel */
+	val |= COH901318_CX_CFG_CH_ENABLE;
+	writel(val, virtbase + COH901318_CX_CFG +
+	       COH901318_CX_CFG_SPACING * channel);
+
+	return 0;
+}
+
+static int coh901318_prep_linked_list(struct coh901318_chan *cohc,
+				      struct coh901318_lli *data)
+{
+	int channel = cohc->id;
+	void __iomem *virtbase = cohc->base->virtbase;
+
+	BUG_ON(readl(virtbase + COH901318_CX_STAT +
+		     COH901318_CX_STAT_SPACING*channel) &
+	       COH901318_CX_STAT_ACTIVE);
+
+	writel(data->src_addr,
+	       virtbase + COH901318_CX_SRC_ADDR +
+	       COH901318_CX_SRC_ADDR_SPACING * channel);
+
+	writel(data->dst_addr, virtbase +
+	       COH901318_CX_DST_ADDR +
+	       COH901318_CX_DST_ADDR_SPACING * channel);
+
+	writel(data->link_addr, virtbase + COH901318_CX_LNK_ADDR +
+	       COH901318_CX_LNK_ADDR_SPACING * channel);
+
+	writel(data->control, virtbase + COH901318_CX_CTRL +
+	       COH901318_CX_CTRL_SPACING * channel);
+
+	return 0;
+}
+static dma_cookie_t
+coh901318_assign_cookie(struct coh901318_chan *cohc,
+			struct coh901318_desc *cohd)
+{
+	dma_cookie_t cookie = cohc->chan.cookie;
+
+	if (++cookie < 0)
+		cookie = 1;
+
+	cohc->chan.cookie = cookie;
+	cohd->desc.cookie = cookie;
+
+	return cookie;
+}
+
+static struct coh901318_desc *
+coh901318_desc_get(struct coh901318_chan *cohc)
+{
+	struct coh901318_desc *desc;
+
+	if (list_empty(&cohc->free)) {
+		/* alloc new desc because we're out of used ones
+		 * TODO: alloc a pile of descs instead of just one,
+		 * avoid many small allocations.
+		 */
+		desc = kmalloc(sizeof(struct coh901318_desc), GFP_NOWAIT);
+		if (desc == NULL)
+			goto out;
+		INIT_LIST_HEAD(&desc->node);
+	} else {
+		/* Reuse an old desc. */
+		desc = list_first_entry(&cohc->free,
+					struct coh901318_desc,
+					node);
+		list_del(&desc->node);
+	}
+
+ out:
+	return desc;
+}
+
+static void
+coh901318_desc_free(struct coh901318_chan *cohc, struct coh901318_desc *cohd)
+{
+	list_add_tail(&cohd->node, &cohc->free);
+}
+
+/* call with irq lock held */
+static void
+coh901318_desc_submit(struct coh901318_chan *cohc, struct coh901318_desc *desc)
+{
+	list_add_tail(&desc->node, &cohc->active);
+
+	BUG_ON(cohc->pending_irqs != 0);
+
+	cohc->pending_irqs = desc->pending_irqs;
+}
+
+static struct coh901318_desc *
+coh901318_first_active_get(struct coh901318_chan *cohc)
+{
+	struct coh901318_desc *d;
+
+	if (list_empty(&cohc->active))
+		return NULL;
+
+	d = list_first_entry(&cohc->active,
+			     struct coh901318_desc,
+			     node);
+	return d;
+}
+
+static void
+coh901318_desc_remove(struct coh901318_desc *cohd)
+{
+	list_del(&cohd->node);
+}
+
+static void
+coh901318_desc_queue(struct coh901318_chan *cohc, struct coh901318_desc *desc)
+{
+	list_add_tail(&desc->node, &cohc->queue);
+}
+
+static struct coh901318_desc *
+coh901318_first_queued(struct coh901318_chan *cohc)
+{
+	struct coh901318_desc *d;
+
+	if (list_empty(&cohc->queue))
+		return NULL;
+
+	d = list_first_entry(&cohc->queue,
+			     struct coh901318_desc,
+			     node);
+	return d;
+}
+
+/*
+ * DMA start/stop controls
+ */
+u32 coh901318_get_bytes_left(struct dma_chan *chan)
+{
+	unsigned long flags;
+	u32 ret;
+	struct coh901318_chan *cohc = to_coh901318_chan(chan);
+
+	spin_lock_irqsave(&cohc->lock, flags);
+
+	/* Read transfer count value */
+	ret = readl(cohc->base->virtbase +
+		    COH901318_CX_CTRL+COH901318_CX_CTRL_SPACING *
+		    cohc->id) & COH901318_CX_CTRL_TC_VALUE_MASK;
+
+	spin_unlock_irqrestore(&cohc->lock, flags);
+
+	return ret;
+}
+EXPORT_SYMBOL(coh901318_get_bytes_left);
+
+
+/* Stops a transfer without losing data. Enables power save.
+   Use this function in conjunction with coh901318_continue(..)
+*/
+void coh901318_stop(struct dma_chan *chan)
+{
+	u32 val;
+	unsigned long flags;
+	struct coh901318_chan *cohc = to_coh901318_chan(chan);
+	int channel = cohc->id;
+	void __iomem *virtbase = cohc->base->virtbase;
+
+	spin_lock_irqsave(&cohc->lock, flags);
+
+	/* Disable channel in HW */
+	val = readl(virtbase + COH901318_CX_CFG +
+		    COH901318_CX_CFG_SPACING * channel);
+
+	/* Stopping infinit transfer */
+	if ((val & COH901318_CX_CTRL_TC_ENABLE) == 0 &&
+	    (val & COH901318_CX_CFG_CH_ENABLE))
+		cohc->stopped = 1;
+
+
+	val &= ~COH901318_CX_CFG_CH_ENABLE;
+	/* Enable twice, HW bug work around */
+	writel(val, virtbase + COH901318_CX_CFG +
+	       COH901318_CX_CFG_SPACING * channel);
+	writel(val, virtbase + COH901318_CX_CFG +
+	       COH901318_CX_CFG_SPACING * channel);
+
+	/* Spin-wait for it to actually go inactive */
+	while (readl(virtbase + COH901318_CX_STAT+COH901318_CX_STAT_SPACING *
+		     channel) & COH901318_CX_STAT_ACTIVE)
+		cpu_relax();
+
+	/* Check if we stopped an active job */
+	if ((readl(virtbase + COH901318_CX_CTRL+COH901318_CX_CTRL_SPACING *
+		   channel) & COH901318_CX_CTRL_TC_VALUE_MASK) > 0)
+		cohc->stopped = 1;
+
+	enable_powersave(cohc);
+
+	spin_unlock_irqrestore(&cohc->lock, flags);
+}
+EXPORT_SYMBOL(coh901318_stop);
+
+/* Continues a transfer that has been stopped via 300_dma_stop(..).
+   Power save is handled.
+*/
+void coh901318_continue(struct dma_chan *chan)
+{
+	u32 val;
+	unsigned long flags;
+	struct coh901318_chan *cohc = to_coh901318_chan(chan);
+	int channel = cohc->id;
+
+	spin_lock_irqsave(&cohc->lock, flags);
+
+	disable_powersave(cohc);
+
+	if (cohc->stopped) {
+		/* Enable channel in HW */
+		val = readl(cohc->base->virtbase + COH901318_CX_CFG +
+			    COH901318_CX_CFG_SPACING * channel);
+
+		val |= COH901318_CX_CFG_CH_ENABLE;
+
+		writel(val, cohc->base->virtbase + COH901318_CX_CFG +
+		       COH901318_CX_CFG_SPACING*channel);
+
+		cohc->stopped = 0;
+	}
+
+	spin_unlock_irqrestore(&cohc->lock, flags);
+}
+EXPORT_SYMBOL(coh901318_continue);
+
+bool coh901318_filter_id(struct dma_chan *chan, void *chan_id)
+{
+	unsigned int ch_nr = (unsigned int) chan_id;
+
+	if (ch_nr == to_coh901318_chan(chan)->id)
+		return true;
+
+	return false;
+}
+EXPORT_SYMBOL(coh901318_filter_id);
+
+/*
+ * DMA channel allocation
+ */
+static int coh901318_config(struct coh901318_chan *cohc,
+			    struct coh901318_params *param)
+{
+	unsigned long flags;
+	const struct coh901318_params *p;
+	int channel = cohc->id;
+	void __iomem *virtbase = cohc->base->virtbase;
+
+	spin_lock_irqsave(&cohc->lock, flags);
+
+	if (param)
+		p = param;
+	else
+		p = &cohc->base->platform->chan_conf[channel].param;
+
+	/* Clear any pending BE or TC interrupt */
+	if (channel < 32) {
+		writel(1 << channel, virtbase + COH901318_BE_INT_CLEAR1);
+		writel(1 << channel, virtbase + COH901318_TC_INT_CLEAR1);
+	} else {
+		writel(1 << (channel - 32), virtbase +
+		       COH901318_BE_INT_CLEAR2);
+		writel(1 << (channel - 32), virtbase +
+		       COH901318_TC_INT_CLEAR2);
+	}
+
+	coh901318_set_conf(cohc, p->config);
+	coh901318_set_ctrl(cohc, p->ctrl_lli_last);
+
+	spin_unlock_irqrestore(&cohc->lock, flags);
+
+	return 0;
+}
+
+/* must lock when calling this function
+ * start queued jobs, if any
+ * TODO: start all queued jobs in one go
+ *
+ * Returns descriptor if queued job is started otherwise NULL.
+ * If the queue is empty NULL is returned.
+ */
+static struct coh901318_desc *coh901318_queue_start(struct coh901318_chan *cohc)
+{
+	struct coh901318_desc *cohd_que;
+
+	/* start queued jobs, if any
+	 * TODO: transmit all queued jobs in one go
+	 */
+	cohd_que = coh901318_first_queued(cohc);
+
+	if (cohd_que != NULL) {
+		/* Remove from queue */
+		coh901318_desc_remove(cohd_que);
+		/* initiate DMA job */
+		cohc->busy = 1;
+
+		coh901318_desc_submit(cohc, cohd_que);
+
+		coh901318_prep_linked_list(cohc, cohd_que->data);
+
+		/* start dma job */
+		coh901318_start(cohc);
+
+	}
+
+	return cohd_que;
+}
+
+static void dma_tasklet(unsigned long data)
+{
+	struct coh901318_chan *cohc = (struct coh901318_chan *) data;
+	struct coh901318_desc *cohd_fin;
+	unsigned long flags;
+	dma_async_tx_callback callback;
+	void *callback_param;
+
+	spin_lock_irqsave(&cohc->lock, flags);
+
+	/* get first active entry from list */
+	cohd_fin = coh901318_first_active_get(cohc);
+
+	BUG_ON(cohd_fin->pending_irqs == 0);
+
+	if (cohd_fin == NULL)
+		goto err;
+
+	cohd_fin->pending_irqs--;
+	cohc->completed = cohd_fin->desc.cookie;
+
+	BUG_ON(cohc->nbr_active_done && cohd_fin == NULL);
+
+	if (cohc->nbr_active_done == 0)
+		return;
+
+	if (!cohd_fin->pending_irqs) {
+		/* release the lli allocation*/
+		coh901318_lli_free(&cohc->base->pool, &cohd_fin->data);
+	}
+
+	dev_vdbg(COHC_2_DEV(cohc), "[%s] chan_id %d pending_irqs %d"
+		 " nbr_active_done %ld\n", __func__,
+		 cohc->id, cohc->pending_irqs, cohc->nbr_active_done);
+
+	/* callback to client */
+	callback = cohd_fin->desc.callback;
+	callback_param = cohd_fin->desc.callback_param;
+
+	if (!cohd_fin->pending_irqs) {
+		coh901318_desc_remove(cohd_fin);
+
+		/* return desc to free-list */
+		coh901318_desc_free(cohc, cohd_fin);
+	}
+
+	if (cohc->nbr_active_done)
+		cohc->nbr_active_done--;
+
+	if (cohc->nbr_active_done) {
+		if (cohc_chan_conf(cohc)->priority_high)
+			tasklet_hi_schedule(&cohc->tasklet);
+		else
+			tasklet_schedule(&cohc->tasklet);
+	}
+	spin_unlock_irqrestore(&cohc->lock, flags);
+
+	if (callback)
+		callback(callback_param);
+
+	return;
+
+ err:
+	spin_unlock_irqrestore(&cohc->lock, flags);
+	dev_err(COHC_2_DEV(cohc), "[%s] No active dma desc\n", __func__);
+}
+
+
+/* called from interrupt context */
+static void dma_tc_handle(struct coh901318_chan *cohc)
+{
+	BUG_ON(!cohc->allocated && (list_empty(&cohc->active) ||
+				    list_empty(&cohc->queue)));
+
+	if (!cohc->allocated)
+		return;
+
+	BUG_ON(cohc->pending_irqs == 0);
+
+	cohc->pending_irqs--;
+	cohc->nbr_active_done++;
+
+	if (cohc->pending_irqs == 0 && coh901318_queue_start(cohc) == NULL)
+		cohc->busy = 0;
+
+	BUG_ON(list_empty(&cohc->active));
+
+	if (cohc_chan_conf(cohc)->priority_high)
+		tasklet_hi_schedule(&cohc->tasklet);
+	else
+		tasklet_schedule(&cohc->tasklet);
+}
+
+
+static irqreturn_t dma_irq_handler(int irq, void *dev_id)
+{
+	u32 status1;
+	u32 status2;
+	int i;
+	int ch;
+	struct coh901318_base *base  = dev_id;
+	struct coh901318_chan *cohc;
+	void __iomem *virtbase = base->virtbase;
+
+	status1 = readl(virtbase + COH901318_INT_STATUS1);
+	status2 = readl(virtbase + COH901318_INT_STATUS2);
+
+	if (unlikely(status1 == 0 && status2 == 0)) {
+		dev_warn(base->dev, "spurious DMA IRQ from no channel!\n");
+		return IRQ_HANDLED;
+	}
+
+	/* TODO: consider handle IRQ in tasklet here to
+	 *       minimize interrupt latency */
+
+	/* Check the first 32 DMA channels for IRQ */
+	while (status1) {
+		/* Find first bit set, return as a number. */
+		i = ffs(status1) - 1;
+		ch = i;
+
+		cohc = &base->chans[ch];
+		spin_lock(&cohc->lock);
+
+		/* Mask off this bit */
+		status1 &= ~(1 << i);
+		/* Check the individual channel bits */
+		if (test_bit(i, virtbase + COH901318_BE_INT_STATUS1)) {
+			dev_crit(COHC_2_DEV(cohc),
+				 "DMA bus error on channel %d!\n", ch);
+			BUG_ON(1);
+			/* Clear BE interrupt */
+			__set_bit(i, virtbase + COH901318_BE_INT_CLEAR1);
+		} else {
+			/* Caused by TC, really? */
+			if (unlikely(!test_bit(i, virtbase +
+					       COH901318_TC_INT_STATUS1))) {
+				dev_warn(COHC_2_DEV(cohc),
+					 "ignoring interrupt not caused by terminal count on channel %d\n", ch);
+				/* Clear TC interrupt */
+				BUG_ON(1);
+				__set_bit(i, virtbase + COH901318_TC_INT_CLEAR1);
+			} else {
+				/* Enable powersave if transfer has finished */
+				if (!(readl(virtbase + COH901318_CX_STAT +
+					    COH901318_CX_STAT_SPACING*ch) &
+				      COH901318_CX_STAT_ENABLED)) {
+					enable_powersave(cohc);
+				}
+
+				/* Must clear TC interrupt before calling
+				 * dma_tc_handle
+				 * in case tc_handle initate a new dma job
+				 */
+				__set_bit(i, virtbase + COH901318_TC_INT_CLEAR1);
+
+				dma_tc_handle(cohc);
+			}
+		}
+		spin_unlock(&cohc->lock);
+	}
+
+	/* Check the remaining 32 DMA channels for IRQ */
+	while (status2) {
+		/* Find first bit set, return as a number. */
+		i = ffs(status2) - 1;
+		ch = i + 32;
+		cohc = &base->chans[ch];
+		spin_lock(&cohc->lock);
+
+		/* Mask off this bit */
+		status2 &= ~(1 << i);
+		/* Check the individual channel bits */
+		if (test_bit(i, virtbase + COH901318_BE_INT_STATUS2)) {
+			dev_crit(COHC_2_DEV(cohc),
+				 "DMA bus error on channel %d!\n", ch);
+			/* Clear BE interrupt */
+			BUG_ON(1);
+			__set_bit(i, virtbase + COH901318_BE_INT_CLEAR2);
+		} else {
+			/* Caused by TC, really? */
+			if (unlikely(!test_bit(i, virtbase +
+					       COH901318_TC_INT_STATUS2))) {
+				dev_warn(COHC_2_DEV(cohc),
+					 "ignoring interrupt not caused by terminal count on channel %d\n", ch);
+				/* Clear TC interrupt */
+				__set_bit(i, virtbase + COH901318_TC_INT_CLEAR2);
+				BUG_ON(1);
+			} else {
+				/* Enable powersave if transfer has finished */
+				if (!(readl(virtbase + COH901318_CX_STAT +
+					    COH901318_CX_STAT_SPACING*ch) &
+				      COH901318_CX_STAT_ENABLED)) {
+					enable_powersave(cohc);
+				}
+				/* Must clear TC interrupt before calling
+				 * dma_tc_handle
+				 * in case tc_handle initate a new dma job
+				 */
+				__set_bit(i, virtbase + COH901318_TC_INT_CLEAR2);
+
+				dma_tc_handle(cohc);
+			}
+		}
+		spin_unlock(&cohc->lock);
+	}
+
+	return IRQ_HANDLED;
+}
+
+static int coh901318_alloc_chan_resources(struct dma_chan *chan)
+{
+	struct coh901318_chan	*cohc = to_coh901318_chan(chan);
+
+	dev_vdbg(COHC_2_DEV(cohc), "[%s] DMA channel %d\n",
+		 __func__, cohc->id);
+
+	if (chan->client_count > 1)
+		return -EBUSY;
+
+	coh901318_config(cohc, NULL);
+
+	cohc->allocated = 1;
+	cohc->completed = chan->cookie = 1;
+
+	return 1;
+}
+
+static void
+coh901318_free_chan_resources(struct dma_chan *chan)
+{
+	struct coh901318_chan	*cohc = to_coh901318_chan(chan);
+	int channel = cohc->id;
+	unsigned long flags;
+
+	spin_lock_irqsave(&cohc->lock, flags);
+
+	/* Disable HW */
+	writel(0x00000000U, cohc->base->virtbase + COH901318_CX_CFG +
+	       COH901318_CX_CFG_SPACING*channel);
+	writel(0x00000000U, cohc->base->virtbase + COH901318_CX_CTRL +
+	       COH901318_CX_CTRL_SPACING*channel);
+
+	cohc->allocated = 0;
+
+	spin_unlock_irqrestore(&cohc->lock, flags);
+
+	chan->device->device_terminate_all(chan);
+}
+
+
+static dma_cookie_t
+coh901318_tx_submit(struct dma_async_tx_descriptor *tx)
+{
+	struct coh901318_desc *cohd = container_of(tx, struct coh901318_desc,
+						   desc);
+	struct coh901318_chan *cohc = to_coh901318_chan(tx->chan);
+	unsigned long flags;
+
+	spin_lock_irqsave(&cohc->lock, flags);
+
+	tx->cookie = coh901318_assign_cookie(cohc, cohd);
+
+	coh901318_desc_queue(cohc, cohd);
+
+	spin_unlock_irqrestore(&cohc->lock, flags);
+
+	return tx->cookie;
+}
+
+static struct dma_async_tx_descriptor *
+coh901318_prep_memcpy(struct dma_chan *chan, dma_addr_t dest, dma_addr_t src,
+		      size_t size, unsigned long flags)
+{
+	struct coh901318_lli *data;
+	struct coh901318_desc *cohd;
+	unsigned long flg;
+	struct coh901318_chan *cohc = to_coh901318_chan(chan);
+	int lli_len;
+	u32 ctrl_last = cohc_chan_param(cohc)->ctrl_lli_last;
+
+	spin_lock_irqsave(&cohc->lock, flg);
+
+	dev_vdbg(COHC_2_DEV(cohc),
+		 "[%s] channel %d src 0x%x dest 0x%x size %d\n",
+		 __func__, cohc->id, src, dest, size);
+
+	if (flags & DMA_PREP_INTERRUPT)
+		/* Trigger interrupt after last lli */
+		ctrl_last |= COH901318_CX_CTRL_TC_IRQ_ENABLE;
+
+	lli_len = size >> MAX_DMA_PACKET_SIZE_SHIFT;
+	if ((lli_len << MAX_DMA_PACKET_SIZE_SHIFT) < size)
+		lli_len++;
+
+	data = coh901318_lli_alloc(&cohc->base->pool, lli_len);
+
+	if (data == NULL)
+		goto err;
+
+	cohd = coh901318_desc_get(cohc);
+	cohd->sg = NULL;
+	cohd->sg_len = 0;
+	cohd->data = data;
+
+	cohd->pending_irqs =
+		coh901318_lli_fill_memcpy(
+				&cohc->base->pool, data, src, size, dest,
+				cohc_chan_param(cohc)->ctrl_lli_chained,
+				ctrl_last);
+	cohd->flags = flags;
+
+	COH_DBG(coh901318_list_print(cohc, data));
+
+	dma_async_tx_descriptor_init(&cohd->desc, chan);
+
+	cohd->desc.tx_submit = coh901318_tx_submit;
+
+	spin_unlock_irqrestore(&cohc->lock, flg);
+
+	return &cohd->desc;
+ err:
+	spin_unlock_irqrestore(&cohc->lock, flg);
+	return NULL;
+}
+
+static struct dma_async_tx_descriptor *
+coh901318_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
+			unsigned int sg_len, enum dma_data_direction direction,
+			unsigned long flags)
+{
+	struct coh901318_chan *cohc = to_coh901318_chan(chan);
+	struct coh901318_lli *data;
+	struct coh901318_desc *cohd;
+	struct scatterlist *sg;
+	int len = 0;
+	int size;
+	int i;
+	u32 ctrl_chained = cohc_chan_param(cohc)->ctrl_lli_chained;
+	u32 ctrl = cohc_chan_param(cohc)->ctrl_lli;
+	u32 ctrl_last = cohc_chan_param(cohc)->ctrl_lli_last;
+	unsigned long flg;
+
+	if (!sgl)
+		goto out;
+	if (sgl->length == 0)
+		goto out;
+
+	spin_lock_irqsave(&cohc->lock, flg);
+
+	dev_vdbg(COHC_2_DEV(cohc), "[%s] sg_len %d dir %d\n",
+		 __func__, sg_len, direction);
+
+	if (flags & DMA_PREP_INTERRUPT)
+		/* Trigger interrupt after last lli */
+		ctrl_last |= COH901318_CX_CTRL_TC_IRQ_ENABLE;
+
+	cohd = coh901318_desc_get(cohc);
+	cohd->sg = NULL;
+	cohd->sg_len = 0;
+	cohd->dir = direction;
+
+	if (direction == DMA_TO_DEVICE) {
+		u32 tx_flags = COH901318_CX_CTRL_PRDD_SOURCE |
+			COH901318_CX_CTRL_SRC_ADDR_INC_ENABLE;
+
+		ctrl_chained |= tx_flags;
+		ctrl_last |= tx_flags;
+		ctrl |= tx_flags;
+	} else if (direction == DMA_FROM_DEVICE) {
+		u32 rx_flags = COH901318_CX_CTRL_PRDD_DEST |
+			COH901318_CX_CTRL_DST_ADDR_INC_ENABLE;
+
+		ctrl_chained |= rx_flags;
+		ctrl_last |= rx_flags;
+		ctrl |= rx_flags;
+	} else
+		goto err_direction;
+
+	dma_async_tx_descriptor_init(&cohd->desc, chan);
+
+	cohd->desc.tx_submit = coh901318_tx_submit;
+
+
+	/* The dma only supports transmitting packages up to
+	 * MAX_DMA_PACKET_SIZE. Calculate to total number of
+	 * dma elemts required to send the entire sg list
+	 */
+	for_each_sg(sgl, sg, sg_len, i) {
+		unsigned int factor;
+		size = sg_dma_len(sg);
+
+		if (size <= MAX_DMA_PACKET_SIZE) {
+			len++;
+			continue;
+		}
+
+		factor = size >> MAX_DMA_PACKET_SIZE_SHIFT;
+		if ((factor << MAX_DMA_PACKET_SIZE_SHIFT) < size)
+			factor++;
+
+		len += factor;
+	}
+
+	data = coh901318_lli_alloc(&cohc->base->pool, len);
+
+	if (data == NULL)
+		goto err_dma_alloc;
+
+	/* initiate allocated data list */
+	cohd->pending_irqs =
+		coh901318_lli_fill_sg(&cohc->base->pool, data, sgl, sg_len,
+				      cohc_dev_addr(cohc),
+				      ctrl_chained,
+				      ctrl,
+				      ctrl_last,
+				      direction, COH901318_CX_CTRL_TC_IRQ_ENABLE);
+	cohd->data = data;
+
+	cohd->flags = flags;
+
+	COH_DBG(coh901318_list_print(cohc, data));
+
+	spin_unlock_irqrestore(&cohc->lock, flg);
+
+	return &cohd->desc;
+ err_dma_alloc:
+ err_direction:
+	coh901318_desc_remove(cohd);
+	coh901318_desc_free(cohc, cohd);
+	spin_unlock_irqrestore(&cohc->lock, flg);
+ out:
+	return NULL;
+}
+
+static enum dma_status
+coh901318_is_tx_complete(struct dma_chan *chan,
+			 dma_cookie_t cookie, dma_cookie_t *done,
+			 dma_cookie_t *used)
+{
+	struct coh901318_chan *cohc = to_coh901318_chan(chan);
+	dma_cookie_t last_used;
+	dma_cookie_t last_complete;
+	int ret;
+
+	last_complete = cohc->completed;
+	last_used = chan->cookie;
+
+	ret = dma_async_is_complete(cookie, last_complete, last_used);
+
+	if (done)
+		*done = last_complete;
+	if (used)
+		*used = last_used;
+
+	return ret;
+}
+
+static void
+coh901318_issue_pending(struct dma_chan *chan)
+{
+	struct coh901318_chan *cohc = to_coh901318_chan(chan);
+	unsigned long flags;
+
+	spin_lock_irqsave(&cohc->lock, flags);
+
+	/* Busy means that pending jobs are already being processed */
+	if (!cohc->busy)
+		coh901318_queue_start(cohc);
+
+	spin_unlock_irqrestore(&cohc->lock, flags);
+}
+
+static void
+coh901318_terminate_all(struct dma_chan *chan)
+{
+	unsigned long flags;
+	struct coh901318_chan *cohc = to_coh901318_chan(chan);
+	struct coh901318_desc *cohd;
+	void __iomem *virtbase = cohc->base->virtbase;
+
+	coh901318_stop(chan);
+
+	spin_lock_irqsave(&cohc->lock, flags);
+
+	/* Clear any pending BE or TC interrupt */
+	if (cohc->id < 32) {
+		writel(1 << cohc->id, virtbase + COH901318_BE_INT_CLEAR1);
+		writel(1 << cohc->id, virtbase + COH901318_TC_INT_CLEAR1);
+	} else {
+		writel(1 << (cohc->id - 32), virtbase +
+		       COH901318_BE_INT_CLEAR2);
+		writel(1 << (cohc->id - 32), virtbase +
+		       COH901318_TC_INT_CLEAR2);
+	}
+
+	enable_powersave(cohc);
+
+	while ((cohd = coh901318_first_active_get(cohc))) {
+		/* release the lli allocation*/
+		coh901318_lli_free(&cohc->base->pool, &cohd->data);
+
+		coh901318_desc_remove(cohd);
+
+		/* return desc to free-list */
+		coh901318_desc_free(cohc, cohd);
+	}
+
+	while ((cohd = coh901318_first_queued(cohc))) {
+		/* release the lli allocation*/
+		coh901318_lli_free(&cohc->base->pool, &cohd->data);
+
+		coh901318_desc_remove(cohd);
+
+		/* return desc to free-list */
+		coh901318_desc_free(cohc, cohd);
+	}
+
+
+	cohc->nbr_active_done = 0;
+	cohc->busy = 0;
+	cohc->pending_irqs = 0;
+
+	spin_unlock_irqrestore(&cohc->lock, flags);
+}
+void coh901318_base_init(struct dma_device *dma, const int *pick_chans,
+			 struct coh901318_base *base)
+{
+	int chans_i;
+	int i = 0;
+	struct coh901318_chan *cohc;
+
+	INIT_LIST_HEAD(&dma->channels);
+
+	for (chans_i = 0; pick_chans[chans_i] != -1; chans_i += 2) {
+		for (i = pick_chans[chans_i]; i <= pick_chans[chans_i+1]; i++) {
+			cohc = &base->chans[i];
+
+			cohc->base = base;
+			cohc->chan.device = dma;
+			cohc->id = i;
+
+			/* TODO: do we really need this lock if only one
+			 * client is connected to each channel?
+			 */
+
+			spin_lock_init(&cohc->lock);
+
+			cohc->pending_irqs = 0;
+			cohc->nbr_active_done = 0;
+			cohc->busy = 0;
+			INIT_LIST_HEAD(&cohc->free);
+			INIT_LIST_HEAD(&cohc->active);
+			INIT_LIST_HEAD(&cohc->queue);
+
+			tasklet_init(&cohc->tasklet, dma_tasklet,
+				     (unsigned long) cohc);
+
+			list_add_tail(&cohc->chan.device_node,
+				      &dma->channels);
+		}
+	}
+}
+
+static int __init coh901318_probe(struct platform_device *pdev)
+{
+	int err = 0;
+	struct coh901318_platform *pdata;
+	struct coh901318_base *base;
+	int irq;
+	struct resource *io;
+
+	io = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	if (!io)
+		goto err_get_resource;
+
+	/* Map DMA controller registers to virtual memory */
+	if (request_mem_region(io->start,
+			       resource_size(io),
+			       pdev->dev.driver->name) == NULL) {
+		err = -EBUSY;
+		goto err_request_mem;
+	}
+
+	pdata = pdev->dev.platform_data;
+	if (!pdata)
+		goto err_no_platformdata;
+
+	base = kmalloc(ALIGN(sizeof(struct coh901318_base), 4) +
+		       pdata->max_channels *
+		       sizeof(struct coh901318_chan),
+		       GFP_KERNEL);
+	if (!base)
+		goto err_alloc_coh_dma_channels;
+
+	base->chans = ((void *)base) + ALIGN(sizeof(struct coh901318_base), 4);
+
+	base->virtbase = ioremap(io->start, resource_size(io));
+	if (!base->virtbase) {
+		err = -ENOMEM;
+		goto err_no_ioremap;
+	}
+
+	base->dev = &pdev->dev;
+	base->platform = pdata;
+	spin_lock_init(&base->pm.lock);
+	base->pm.started_channels = 0;
+
+	COH901318_DEBUGFS_ASSIGN(debugfs_dma_base, base);
+
+	platform_set_drvdata(pdev, base);
+
+	irq = platform_get_irq(pdev, 0);
+	if (irq < 0)
+		goto err_no_irq;
+
+	err = request_irq(irq, dma_irq_handler, IRQF_DISABLED,
+			  "coh901318", base);
+	if (err) {
+		dev_crit(&pdev->dev,
+			 "Cannot allocate IRQ for DMA controller!\n");
+		goto err_request_irq;
+	}
+
+	err = coh901318_pool_create(&base->pool, &pdev->dev,
+				    sizeof(struct coh901318_lli),
+				    32);
+	if (err)
+		goto err_pool_create;
+
+	/* init channels for device transfers */
+	coh901318_base_init(&base->dma_slave,  base->platform->chans_slave,
+			    base);
+
+	dma_cap_zero(base->dma_slave.cap_mask);
+	dma_cap_set(DMA_SLAVE, base->dma_slave.cap_mask);
+
+	base->dma_slave.device_alloc_chan_resources = coh901318_alloc_chan_resources;
+	base->dma_slave.device_free_chan_resources = coh901318_free_chan_resources;
+	base->dma_slave.device_prep_slave_sg = coh901318_prep_slave_sg;
+	base->dma_slave.device_is_tx_complete = coh901318_is_tx_complete;
+	base->dma_slave.device_issue_pending = coh901318_issue_pending;
+	base->dma_slave.device_terminate_all = coh901318_terminate_all;
+	base->dma_slave.dev = &pdev->dev;
+
+	err = dma_async_device_register(&base->dma_slave);
+
+	if (err)
+		goto err_register_slave;
+
+	/* init channels for memcpy */
+	coh901318_base_init(&base->dma_memcpy, base->platform->chans_memcpy,
+			    base);
+
+	dma_cap_zero(base->dma_memcpy.cap_mask);
+	dma_cap_set(DMA_MEMCPY, base->dma_memcpy.cap_mask);
+
+	base->dma_memcpy.device_alloc_chan_resources = coh901318_alloc_chan_resources;
+	base->dma_memcpy.device_free_chan_resources = coh901318_free_chan_resources;
+	base->dma_memcpy.device_prep_dma_memcpy = coh901318_prep_memcpy;
+	base->dma_memcpy.device_is_tx_complete = coh901318_is_tx_complete;
+	base->dma_memcpy.device_issue_pending = coh901318_issue_pending;
+	base->dma_memcpy.device_terminate_all = coh901318_terminate_all;
+	base->dma_memcpy.dev = &pdev->dev;
+	err = dma_async_device_register(&base->dma_memcpy);
+
+	if (err)
+		goto err_register_memcpy;
+
+	dev_dbg(&pdev->dev, "Initialized COH901318 DMA on virtual base 0x%08x\n",
+		(u32) base->virtbase);
+
+	return err;
+
+ err_register_memcpy:
+	dma_async_device_unregister(&base->dma_slave);
+ err_register_slave:
+	coh901318_pool_destroy(&base->pool);
+ err_pool_create:
+	free_irq(platform_get_irq(pdev, 0), base);
+ err_request_irq:
+ err_no_irq:
+	iounmap(base->virtbase);
+ err_no_ioremap:
+	kfree(base);
+ err_alloc_coh_dma_channels:
+ err_no_platformdata:
+	release_mem_region(pdev->resource->start,
+			   resource_size(pdev->resource));
+ err_request_mem:
+ err_get_resource:
+	return err;
+}
+
+static int __exit coh901318_remove(struct platform_device *pdev)
+{
+	struct coh901318_base *base = platform_get_drvdata(pdev);
+
+	dma_async_device_unregister(&base->dma_memcpy);
+	dma_async_device_unregister(&base->dma_slave);
+	coh901318_pool_destroy(&base->pool);
+	free_irq(platform_get_irq(pdev, 0), base);
+	iounmap(base->virtbase);
+	kfree(base);
+	release_mem_region(pdev->resource->start,
+			   resource_size(pdev->resource));
+	return 0;
+}
+
+
+static struct platform_driver coh901318_driver = {
+	.remove = __exit_p(coh901318_remove),
+	.driver = {
+		.name	= "coh901318",
+	},
+};
+
+int __init coh901318_init(void)
+{
+	return platform_driver_probe(&coh901318_driver, coh901318_probe);
+}
+subsys_initcall(coh901318_init);
+
+void __exit coh901318_exit(void)
+{
+	platform_driver_unregister(&coh901318_driver);
+}
+module_exit(coh901318_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Per Friden");
diff --git a/drivers/dma/coh901318_lli.c b/drivers/dma/coh901318_lli.c
new file mode 100644
index 000000000000..f5120f238a4d
--- /dev/null
+++ b/drivers/dma/coh901318_lli.c
@@ -0,0 +1,318 @@
+/*
+ * driver/dma/coh901318_lli.c
+ *
+ * Copyright (C) 2007-2009 ST-Ericsson
+ * License terms: GNU General Public License (GPL) version 2
+ * Support functions for handling lli for dma
+ * Author: Per Friden <per.friden@stericsson.com>
+ */
+
+#include <linux/dma-mapping.h>
+#include <linux/spinlock.h>
+#include <linux/dmapool.h>
+#include <linux/memory.h>
+#include <mach/coh901318.h>
+
+#include "coh901318_lli.h"
+
+#if (defined(CONFIG_DEBUG_FS) && defined(CONFIG_U300_DEBUG))
+#define DEBUGFS_POOL_COUNTER_RESET(pool) (pool->debugfs_pool_counter = 0)
+#define DEBUGFS_POOL_COUNTER_ADD(pool, add) (pool->debugfs_pool_counter += add)
+#else
+#define DEBUGFS_POOL_COUNTER_RESET(pool)
+#define DEBUGFS_POOL_COUNTER_ADD(pool, add)
+#endif
+
+static struct coh901318_lli *
+coh901318_lli_next(struct coh901318_lli *data)
+{
+	if (data == NULL || data->link_addr == 0)
+		return NULL;
+
+	return (struct coh901318_lli *) data->virt_link_addr;
+}
+
+int coh901318_pool_create(struct coh901318_pool *pool,
+			  struct device *dev,
+			  size_t size, size_t align)
+{
+	spin_lock_init(&pool->lock);
+	pool->dev = dev;
+	pool->dmapool = dma_pool_create("lli_pool", dev, size, align, 0);
+
+	DEBUGFS_POOL_COUNTER_RESET(pool);
+	return 0;
+}
+
+int coh901318_pool_destroy(struct coh901318_pool *pool)
+{
+
+	dma_pool_destroy(pool->dmapool);
+	return 0;
+}
+
+struct coh901318_lli *
+coh901318_lli_alloc(struct coh901318_pool *pool, unsigned int len)
+{
+	int i;
+	struct coh901318_lli *head;
+	struct coh901318_lli *lli;
+	struct coh901318_lli *lli_prev;
+	dma_addr_t phy;
+
+	if (len == 0)
+		goto err;
+
+	spin_lock(&pool->lock);
+
+	head = dma_pool_alloc(pool->dmapool, GFP_NOWAIT, &phy);
+
+	if (head == NULL)
+		goto err;
+
+	DEBUGFS_POOL_COUNTER_ADD(pool, 1);
+
+	lli = head;
+	lli->phy_this = phy;
+
+	for (i = 1; i < len; i++) {
+		lli_prev = lli;
+
+		lli = dma_pool_alloc(pool->dmapool, GFP_NOWAIT, &phy);
+
+		if (lli == NULL)
+			goto err_clean_up;
+
+		DEBUGFS_POOL_COUNTER_ADD(pool, 1);
+		lli->phy_this = phy;
+
+		lli_prev->link_addr = phy;
+		lli_prev->virt_link_addr = lli;
+	}
+
+	lli->link_addr = 0x00000000U;
+
+	spin_unlock(&pool->lock);
+
+	return head;
+
+ err:
+	spin_unlock(&pool->lock);
+	return NULL;
+
+ err_clean_up:
+	lli_prev->link_addr = 0x00000000U;
+	spin_unlock(&pool->lock);
+	coh901318_lli_free(pool, &head);
+	return NULL;
+}
+
+void coh901318_lli_free(struct coh901318_pool *pool,
+			struct coh901318_lli **lli)
+{
+	struct coh901318_lli *l;
+	struct coh901318_lli *next;
+
+	if (lli == NULL)
+		return;
+
+	l = *lli;
+
+	if (l == NULL)
+		return;
+
+	spin_lock(&pool->lock);
+
+	while (l->link_addr) {
+		next = l->virt_link_addr;
+		dma_pool_free(pool->dmapool, l, l->phy_this);
+		DEBUGFS_POOL_COUNTER_ADD(pool, -1);
+		l = next;
+	}
+	dma_pool_free(pool->dmapool, l, l->phy_this);
+	DEBUGFS_POOL_COUNTER_ADD(pool, -1);
+
+	spin_unlock(&pool->lock);
+	*lli = NULL;
+}
+
+int
+coh901318_lli_fill_memcpy(struct coh901318_pool *pool,
+			  struct coh901318_lli *lli,
+			  dma_addr_t source, unsigned int size,
+			  dma_addr_t destination, u32 ctrl_chained,
+			  u32 ctrl_eom)
+{
+	int s = size;
+	dma_addr_t src = source;
+	dma_addr_t dst = destination;
+
+	lli->src_addr = src;
+	lli->dst_addr = dst;
+
+	while (lli->link_addr) {
+		lli->control = ctrl_chained | MAX_DMA_PACKET_SIZE;
+		lli->src_addr = src;
+		lli->dst_addr = dst;
+
+		s -= MAX_DMA_PACKET_SIZE;
+		lli = coh901318_lli_next(lli);
+
+		src += MAX_DMA_PACKET_SIZE;
+		dst += MAX_DMA_PACKET_SIZE;
+	}
+
+	lli->control = ctrl_eom | s;
+	lli->src_addr = src;
+	lli->dst_addr = dst;
+
+	/* One irq per single transfer */
+	return 1;
+}
+
+int
+coh901318_lli_fill_single(struct coh901318_pool *pool,
+			  struct coh901318_lli *lli,
+			  dma_addr_t buf, unsigned int size,
+			  dma_addr_t dev_addr, u32 ctrl_chained, u32 ctrl_eom,
+			  enum dma_data_direction dir)
+{
+	int s = size;
+	dma_addr_t src;
+	dma_addr_t dst;
+
+
+	if (dir == DMA_TO_DEVICE) {
+		src = buf;
+		dst = dev_addr;
+
+	} else if (dir == DMA_FROM_DEVICE) {
+
+		src = dev_addr;
+		dst = buf;
+	} else {
+		return -EINVAL;
+	}
+
+	while (lli->link_addr) {
+		size_t block_size = MAX_DMA_PACKET_SIZE;
+		lli->control = ctrl_chained | MAX_DMA_PACKET_SIZE;
+
+		/* If we are on the next-to-final block and there will
+		 * be less than half a DMA packet left for the last
+		 * block, then we want to make this block a little
+		 * smaller to balance the sizes. This is meant to
+		 * avoid too small transfers if the buffer size is
+		 * (MAX_DMA_PACKET_SIZE*N + 1) */
+		if (s < (MAX_DMA_PACKET_SIZE + MAX_DMA_PACKET_SIZE/2))
+			block_size = MAX_DMA_PACKET_SIZE/2;
+
+		s -= block_size;
+		lli->src_addr = src;
+		lli->dst_addr = dst;
+
+		lli = coh901318_lli_next(lli);
+
+		if (dir == DMA_TO_DEVICE)
+			src += block_size;
+		else if (dir == DMA_FROM_DEVICE)
+			dst += block_size;
+	}
+
+	lli->control = ctrl_eom | s;
+	lli->src_addr = src;
+	lli->dst_addr = dst;
+
+	/* One irq per single transfer */
+	return 1;
+}
+
+int
+coh901318_lli_fill_sg(struct coh901318_pool *pool,
+		      struct coh901318_lli *lli,
+		      struct scatterlist *sgl, unsigned int nents,
+		      dma_addr_t dev_addr, u32 ctrl_chained, u32 ctrl,
+		      u32 ctrl_last,
+		      enum dma_data_direction dir, u32 ctrl_irq_mask)
+{
+	int i;
+	struct scatterlist *sg;
+	u32 ctrl_sg;
+	dma_addr_t src = 0;
+	dma_addr_t dst = 0;
+	int nbr_of_irq = 0;
+	u32 bytes_to_transfer;
+	u32 elem_size;
+
+	if (lli == NULL)
+		goto err;
+
+	spin_lock(&pool->lock);
+
+	if (dir == DMA_TO_DEVICE)
+		dst = dev_addr;
+	else if (dir == DMA_FROM_DEVICE)
+		src = dev_addr;
+	else
+		goto err;
+
+	for_each_sg(sgl, sg, nents, i) {
+		if (sg_is_chain(sg)) {
+			/* sg continues to the next sg-element don't
+			 * send ctrl_finish until the last
+			 * sg-element in the chain
+			 */
+			ctrl_sg = ctrl_chained;
+		} else if (i == nents - 1)
+			ctrl_sg = ctrl_last;
+		else
+			ctrl_sg = ctrl ? ctrl : ctrl_last;
+
+
+		if ((ctrl_sg & ctrl_irq_mask))
+			nbr_of_irq++;
+
+		if (dir == DMA_TO_DEVICE)
+			/* increment source address */
+			src = sg_dma_address(sg);
+		else
+			/* increment destination address */
+			dst =  sg_dma_address(sg);
+
+		bytes_to_transfer = sg_dma_len(sg);
+
+		while (bytes_to_transfer) {
+			u32 val;
+
+			if (bytes_to_transfer > MAX_DMA_PACKET_SIZE) {
+				elem_size = MAX_DMA_PACKET_SIZE;
+				val = ctrl_chained;
+			} else {
+				elem_size = bytes_to_transfer;
+				val = ctrl_sg;
+			}
+
+			lli->control = val | elem_size;
+			lli->src_addr = src;
+			lli->dst_addr = dst;
+
+			if (dir == DMA_FROM_DEVICE)
+				dst += elem_size;
+			else
+				src += elem_size;
+
+			BUG_ON(lli->link_addr & 3);
+
+			bytes_to_transfer -= elem_size;
+			lli = coh901318_lli_next(lli);
+		}
+
+	}
+	spin_unlock(&pool->lock);
+
+	/* There can be many IRQs per sg transfer */
+	return nbr_of_irq;
+ err:
+	spin_unlock(&pool->lock);
+	return -EINVAL;
+}
diff --git a/drivers/dma/coh901318_lli.h b/drivers/dma/coh901318_lli.h
new file mode 100644
index 000000000000..7bf713b79c6b
--- /dev/null
+++ b/drivers/dma/coh901318_lli.h
@@ -0,0 +1,124 @@
+/*
+ * driver/dma/coh901318_lli.h
+ *
+ * Copyright (C) 2007-2009 ST-Ericsson
+ * License terms: GNU General Public License (GPL) version 2
+ * Support functions for handling lli for coh901318
+ * Author: Per Friden <per.friden@stericsson.com>
+ */
+
+#ifndef COH901318_LLI_H
+#define COH901318_LLI_H
+
+#include <mach/coh901318.h>
+
+struct device;
+
+struct coh901318_pool {
+	spinlock_t lock;
+	struct dma_pool *dmapool;
+	struct device *dev;
+
+#ifdef CONFIG_DEBUG_FS
+	int debugfs_pool_counter;
+#endif
+};
+
+struct device;
+/**
+ * coh901318_pool_create() - Creates an dma pool for lli:s
+ * @pool: pool handle
+ * @dev: dma device
+ * @lli_nbr: number of lli:s in the pool
+ * @algin: adress alignemtn of lli:s
+ * returns 0 on success otherwise none zero
+ */
+int coh901318_pool_create(struct coh901318_pool *pool,
+			  struct device *dev,
+			  size_t lli_nbr, size_t align);
+
+/**
+ * coh901318_pool_destroy() - Destroys the dma pool
+ * @pool: pool handle
+ * returns 0 on success otherwise none zero
+ */
+int coh901318_pool_destroy(struct coh901318_pool *pool);
+
+/**
+ * coh901318_lli_alloc() - Allocates a linked list
+ *
+ * @pool: pool handle
+ * @len: length to list
+ * return: none NULL if success otherwise NULL
+ */
+struct coh901318_lli *
+coh901318_lli_alloc(struct coh901318_pool *pool,
+		    unsigned int len);
+
+/**
+ * coh901318_lli_free() - Returns the linked list items to the pool
+ * @pool: pool handle
+ * @lli: reference to lli pointer to be freed
+ */
+void coh901318_lli_free(struct coh901318_pool *pool,
+			struct coh901318_lli **lli);
+
+/**
+ * coh901318_lli_fill_memcpy() - Prepares the lli:s for dma memcpy
+ * @pool: pool handle
+ * @lli: allocated lli
+ * @src: src address
+ * @size: transfer size
+ * @dst: destination address
+ * @ctrl_chained: ctrl for chained lli
+ * @ctrl_last: ctrl for the last lli
+ * returns number of CPU interrupts for the lli, negative on error.
+ */
+int
+coh901318_lli_fill_memcpy(struct coh901318_pool *pool,
+			  struct coh901318_lli *lli,
+			  dma_addr_t src, unsigned int size,
+			  dma_addr_t dst, u32 ctrl_chained, u32 ctrl_last);
+
+/**
+ * coh901318_lli_fill_single() - Prepares the lli:s for dma single transfer
+ * @pool: pool handle
+ * @lli: allocated lli
+ * @buf: transfer buffer
+ * @size: transfer size
+ * @dev_addr: address of periphal
+ * @ctrl_chained: ctrl for chained lli
+ * @ctrl_last: ctrl for the last lli
+ * @dir: direction of transfer (to or from device)
+ * returns number of CPU interrupts for the lli, negative on error.
+ */
+int
+coh901318_lli_fill_single(struct coh901318_pool *pool,
+			  struct coh901318_lli *lli,
+			  dma_addr_t buf, unsigned int size,
+			  dma_addr_t dev_addr, u32 ctrl_chained, u32 ctrl_last,
+			  enum dma_data_direction dir);
+
+/**
+ * coh901318_lli_fill_single() - Prepares the lli:s for dma scatter list transfer
+ * @pool: pool handle
+ * @lli: allocated lli
+ * @sg: scatter gather list
+ * @nents: number of entries in sg
+ * @dev_addr: address of periphal
+ * @ctrl_chained: ctrl for chained lli
+ * @ctrl: ctrl of middle lli
+ * @ctrl_last: ctrl for the last lli
+ * @dir: direction of transfer (to or from device)
+ * @ctrl_irq_mask: ctrl mask for CPU interrupt
+ * returns number of CPU interrupts for the lli, negative on error.
+ */
+int
+coh901318_lli_fill_sg(struct coh901318_pool *pool,
+		      struct coh901318_lli *lli,
+		      struct scatterlist *sg, unsigned int nents,
+		      dma_addr_t dev_addr, u32 ctrl_chained,
+		      u32 ctrl, u32 ctrl_last,
+		      enum dma_data_direction dir, u32 ctrl_irq_mask);
+
+#endif /* COH901318_LLI_H */
diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
index 8f99354082ce..6f51a0a7a8bb 100644
--- a/drivers/dma/dmaengine.c
+++ b/drivers/dma/dmaengine.c
@@ -326,14 +326,7 @@ arch_initcall(dma_channel_table_init);
  */
 struct dma_chan *dma_find_channel(enum dma_transaction_type tx_type)
 {
-	struct dma_chan *chan;
-	int cpu;
-
-	cpu = get_cpu();
-	chan = per_cpu_ptr(channel_table[tx_type], cpu)->chan;
-	put_cpu();
-
-	return chan;
+	return this_cpu_read(channel_table[tx_type]->chan);
 }
 EXPORT_SYMBOL(dma_find_channel);
 
@@ -857,7 +850,6 @@ dma_async_memcpy_buf_to_buf(struct dma_chan *chan, void *dest,
 	struct dma_async_tx_descriptor *tx;
 	dma_addr_t dma_dest, dma_src;
 	dma_cookie_t cookie;
-	int cpu;
 	unsigned long flags;
 
 	dma_src = dma_map_single(dev->dev, src, len, DMA_TO_DEVICE);
@@ -876,10 +868,10 @@ dma_async_memcpy_buf_to_buf(struct dma_chan *chan, void *dest,
 	tx->callback = NULL;
 	cookie = tx->tx_submit(tx);
 
-	cpu = get_cpu();
-	per_cpu_ptr(chan->local, cpu)->bytes_transferred += len;
-	per_cpu_ptr(chan->local, cpu)->memcpy_count++;
-	put_cpu();
+	preempt_disable();
+	__this_cpu_add(chan->local->bytes_transferred, len);
+	__this_cpu_inc(chan->local->memcpy_count);
+	preempt_enable();
 
 	return cookie;
 }
@@ -906,7 +898,6 @@ dma_async_memcpy_buf_to_pg(struct dma_chan *chan, struct page *page,
 	struct dma_async_tx_descriptor *tx;
 	dma_addr_t dma_dest, dma_src;
 	dma_cookie_t cookie;
-	int cpu;
 	unsigned long flags;
 
 	dma_src = dma_map_single(dev->dev, kdata, len, DMA_TO_DEVICE);
@@ -923,10 +914,10 @@ dma_async_memcpy_buf_to_pg(struct dma_chan *chan, struct page *page,
 	tx->callback = NULL;
 	cookie = tx->tx_submit(tx);
 
-	cpu = get_cpu();
-	per_cpu_ptr(chan->local, cpu)->bytes_transferred += len;
-	per_cpu_ptr(chan->local, cpu)->memcpy_count++;
-	put_cpu();
+	preempt_disable();
+	__this_cpu_add(chan->local->bytes_transferred, len);
+	__this_cpu_inc(chan->local->memcpy_count);
+	preempt_enable();
 
 	return cookie;
 }
@@ -955,7 +946,6 @@ dma_async_memcpy_pg_to_pg(struct dma_chan *chan, struct page *dest_pg,
 	struct dma_async_tx_descriptor *tx;
 	dma_addr_t dma_dest, dma_src;
 	dma_cookie_t cookie;
-	int cpu;
 	unsigned long flags;
 
 	dma_src = dma_map_page(dev->dev, src_pg, src_off, len, DMA_TO_DEVICE);
@@ -973,10 +963,10 @@ dma_async_memcpy_pg_to_pg(struct dma_chan *chan, struct page *dest_pg,
 	tx->callback = NULL;
 	cookie = tx->tx_submit(tx);
 
-	cpu = get_cpu();
-	per_cpu_ptr(chan->local, cpu)->bytes_transferred += len;
-	per_cpu_ptr(chan->local, cpu)->memcpy_count++;
-	put_cpu();
+	preempt_disable();
+	__this_cpu_add(chan->local->bytes_transferred, len);
+	__this_cpu_inc(chan->local->memcpy_count);
+	preempt_enable();
 
 	return cookie;
 }
diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c
index a32a4cf7b1e0..8b905161fbf4 100644
--- a/drivers/dma/dmatest.c
+++ b/drivers/dma/dmatest.c
@@ -298,10 +298,6 @@ static int dmatest_func(void *data)
 
 		total_tests++;
 
-		len = dmatest_random() % test_buf_size + 1;
-		src_off = dmatest_random() % (test_buf_size - len + 1);
-		dst_off = dmatest_random() % (test_buf_size - len + 1);
-
 		/* honor alignment restrictions */
 		if (thread->type == DMA_MEMCPY)
 			align = dev->copy_align;
@@ -310,7 +306,19 @@ static int dmatest_func(void *data)
 		else if (thread->type == DMA_PQ)
 			align = dev->pq_align;
 
+		if (1 << align > test_buf_size) {
+			pr_err("%u-byte buffer too small for %d-byte alignment\n",
+			       test_buf_size, 1 << align);
+			break;
+		}
+
+		len = dmatest_random() % test_buf_size + 1;
 		len = (len >> align) << align;
+		if (!len)
+			len = 1 << align;
+		src_off = dmatest_random() % (test_buf_size - len + 1);
+		dst_off = dmatest_random() % (test_buf_size - len + 1);
+
 		src_off = (src_off >> align) << align;
 		dst_off = (dst_off >> align) << align;
 
diff --git a/drivers/dma/dw_dmac.c b/drivers/dma/dw_dmac.c
index 2eea823516a7..d28369f7afd2 100644
--- a/drivers/dma/dw_dmac.c
+++ b/drivers/dma/dw_dmac.c
@@ -1270,8 +1270,6 @@ static int __init dw_probe(struct platform_device *pdev)
 		goto err_kfree;
 	}
 
-	memset(dw, 0, sizeof *dw);
-
 	dw->regs = ioremap(io->start, DW_REGLEN);
 	if (!dw->regs) {
 		err = -ENOMEM;
@@ -1427,7 +1425,7 @@ static int dw_resume_noirq(struct device *dev)
 	return 0;
 }
 
-static struct dev_pm_ops dw_dev_pm_ops = {
+static const struct dev_pm_ops dw_dev_pm_ops = {
 	.suspend_noirq = dw_suspend_noirq,
 	.resume_noirq = dw_resume_noirq,
 };
diff --git a/drivers/dma/ioat/dma.c b/drivers/dma/ioat/dma.c
index c524d36d3c2e..dcc4ab78b32b 100644
--- a/drivers/dma/ioat/dma.c
+++ b/drivers/dma/ioat/dma.c
@@ -1032,7 +1032,7 @@ int __devinit ioat_probe(struct ioatdma_device *device)
 	dma->dev = &pdev->dev;
 
 	if (!dma->chancnt) {
-		dev_err(dev, "zero channels detected\n");
+		dev_err(dev, "channel enumeration error\n");
 		goto err_setup_interrupts;
 	}
 
diff --git a/drivers/dma/ioat/dma.h b/drivers/dma/ioat/dma.h
index 45edde996480..bbc3e78ef333 100644
--- a/drivers/dma/ioat/dma.h
+++ b/drivers/dma/ioat/dma.h
@@ -60,6 +60,7 @@
  * @dca: direct cache access context
  * @intr_quirk: interrupt setup quirk (for ioat_v1 devices)
  * @enumerate_channels: hw version specific channel enumeration
+ * @reset_hw: hw version specific channel (re)initialization
  * @cleanup_tasklet: select between the v2 and v3 cleanup routines
  * @timer_fn: select between the v2 and v3 timer watchdog routines
  * @self_test: hardware version specific self test for each supported op type
@@ -78,6 +79,7 @@ struct ioatdma_device {
 	struct dca_provider *dca;
 	void (*intr_quirk)(struct ioatdma_device *device);
 	int (*enumerate_channels)(struct ioatdma_device *device);
+	int (*reset_hw)(struct ioat_chan_common *chan);
 	void (*cleanup_tasklet)(unsigned long data);
 	void (*timer_fn)(unsigned long data);
 	int (*self_test)(struct ioatdma_device *device);
@@ -264,6 +266,22 @@ static inline void ioat_suspend(struct ioat_chan_common *chan)
 	writeb(IOAT_CHANCMD_SUSPEND, chan->reg_base + IOAT_CHANCMD_OFFSET(ver));
 }
 
+static inline void ioat_reset(struct ioat_chan_common *chan)
+{
+	u8 ver = chan->device->version;
+
+	writeb(IOAT_CHANCMD_RESET, chan->reg_base + IOAT_CHANCMD_OFFSET(ver));
+}
+
+static inline bool ioat_reset_pending(struct ioat_chan_common *chan)
+{
+	u8 ver = chan->device->version;
+	u8 cmd;
+
+	cmd = readb(chan->reg_base + IOAT_CHANCMD_OFFSET(ver));
+	return (cmd & IOAT_CHANCMD_RESET) == IOAT_CHANCMD_RESET;
+}
+
 static inline void ioat_set_chainaddr(struct ioat_dma_chan *ioat, u64 addr)
 {
 	struct ioat_chan_common *chan = &ioat->base;
diff --git a/drivers/dma/ioat/dma_v2.c b/drivers/dma/ioat/dma_v2.c
index 8f1f7f05deaa..5f7a500e18d0 100644
--- a/drivers/dma/ioat/dma_v2.c
+++ b/drivers/dma/ioat/dma_v2.c
@@ -239,20 +239,50 @@ void __ioat2_restart_chan(struct ioat2_dma_chan *ioat)
 		__ioat2_start_null_desc(ioat);
 }
 
-static void ioat2_restart_channel(struct ioat2_dma_chan *ioat)
+int ioat2_quiesce(struct ioat_chan_common *chan, unsigned long tmo)
 {
-	struct ioat_chan_common *chan = &ioat->base;
-	unsigned long phys_complete;
+	unsigned long end = jiffies + tmo;
+	int err = 0;
 	u32 status;
 
 	status = ioat_chansts(chan);
 	if (is_ioat_active(status) || is_ioat_idle(status))
 		ioat_suspend(chan);
 	while (is_ioat_active(status) || is_ioat_idle(status)) {
+		if (end && time_after(jiffies, end)) {
+			err = -ETIMEDOUT;
+			break;
+		}
 		status = ioat_chansts(chan);
 		cpu_relax();
 	}
 
+	return err;
+}
+
+int ioat2_reset_sync(struct ioat_chan_common *chan, unsigned long tmo)
+{
+	unsigned long end = jiffies + tmo;
+	int err = 0;
+
+	ioat_reset(chan);
+	while (ioat_reset_pending(chan)) {
+		if (end && time_after(jiffies, end)) {
+			err = -ETIMEDOUT;
+			break;
+		}
+		cpu_relax();
+	}
+
+	return err;
+}
+
+static void ioat2_restart_channel(struct ioat2_dma_chan *ioat)
+{
+	struct ioat_chan_common *chan = &ioat->base;
+	unsigned long phys_complete;
+
+	ioat2_quiesce(chan, 0);
 	if (ioat_cleanup_preamble(chan, &phys_complete))
 		__cleanup(ioat, phys_complete);
 
@@ -318,6 +348,19 @@ void ioat2_timer_event(unsigned long data)
 	spin_unlock_bh(&chan->cleanup_lock);
 }
 
+static int ioat2_reset_hw(struct ioat_chan_common *chan)
+{
+	/* throw away whatever the channel was doing and get it initialized */
+	u32 chanerr;
+
+	ioat2_quiesce(chan, msecs_to_jiffies(100));
+
+	chanerr = readl(chan->reg_base + IOAT_CHANERR_OFFSET);
+	writel(chanerr, chan->reg_base + IOAT_CHANERR_OFFSET);
+
+	return ioat2_reset_sync(chan, msecs_to_jiffies(200));
+}
+
 /**
  * ioat2_enumerate_channels - find and initialize the device's channels
  * @device: the device to be enumerated
@@ -360,6 +403,10 @@ int ioat2_enumerate_channels(struct ioatdma_device *device)
 				  (unsigned long) ioat);
 		ioat->xfercap_log = xfercap_log;
 		spin_lock_init(&ioat->ring_lock);
+		if (device->reset_hw(&ioat->base)) {
+			i = 0;
+			break;
+		}
 	}
 	dma->chancnt = i;
 	return i;
@@ -467,7 +514,6 @@ int ioat2_alloc_chan_resources(struct dma_chan *c)
 	struct ioat2_dma_chan *ioat = to_ioat2_chan(c);
 	struct ioat_chan_common *chan = &ioat->base;
 	struct ioat_ring_ent **ring;
-	u32 chanerr;
 	int order;
 
 	/* have we already been set up? */
@@ -477,12 +523,6 @@ int ioat2_alloc_chan_resources(struct dma_chan *c)
 	/* Setup register to interrupt and write completion status on error */
 	writew(IOAT_CHANCTRL_RUN, chan->reg_base + IOAT_CHANCTRL_OFFSET);
 
-	chanerr = readl(chan->reg_base + IOAT_CHANERR_OFFSET);
-	if (chanerr) {
-		dev_err(to_dev(chan), "CHANERR = %x, clearing\n", chanerr);
-		writel(chanerr, chan->reg_base + IOAT_CHANERR_OFFSET);
-	}
-
 	/* allocate a completion writeback area */
 	/* doing 2 32bit writes to mmio since 1 64b write doesn't work */
 	chan->completion = pci_pool_alloc(chan->device->completion_pool,
@@ -746,13 +786,7 @@ void ioat2_free_chan_resources(struct dma_chan *c)
 	tasklet_disable(&chan->cleanup_task);
 	del_timer_sync(&chan->timer);
 	device->cleanup_tasklet((unsigned long) ioat);
-
-	/* Delay 100ms after reset to allow internal DMA logic to quiesce
-	 * before removing DMA descriptor resources.
-	 */
-	writeb(IOAT_CHANCMD_RESET,
-	       chan->reg_base + IOAT_CHANCMD_OFFSET(chan->device->version));
-	mdelay(100);
+	device->reset_hw(chan);
 
 	spin_lock_bh(&ioat->ring_lock);
 	descs = ioat2_ring_space(ioat);
@@ -839,6 +873,7 @@ int __devinit ioat2_dma_probe(struct ioatdma_device *device, int dca)
 	int err;
 
 	device->enumerate_channels = ioat2_enumerate_channels;
+	device->reset_hw = ioat2_reset_hw;
 	device->cleanup_tasklet = ioat2_cleanup_tasklet;
 	device->timer_fn = ioat2_timer_event;
 	device->self_test = ioat_dma_self_test;
diff --git a/drivers/dma/ioat/dma_v2.h b/drivers/dma/ioat/dma_v2.h
index 1d849ef74d5f..3afad8da43cc 100644
--- a/drivers/dma/ioat/dma_v2.h
+++ b/drivers/dma/ioat/dma_v2.h
@@ -185,6 +185,8 @@ bool reshape_ring(struct ioat2_dma_chan *ioat, int order);
 void __ioat2_issue_pending(struct ioat2_dma_chan *ioat);
 void ioat2_cleanup_tasklet(unsigned long data);
 void ioat2_timer_event(unsigned long data);
+int ioat2_quiesce(struct ioat_chan_common *chan, unsigned long tmo);
+int ioat2_reset_sync(struct ioat_chan_common *chan, unsigned long tmo);
 extern struct kobj_type ioat2_ktype;
 extern struct kmem_cache *ioat2_cache;
 #endif /* IOATDMA_V2_H */
diff --git a/drivers/dma/ioat/dma_v3.c b/drivers/dma/ioat/dma_v3.c
index 42f6f10fb0cc..9908c9e94b2d 100644
--- a/drivers/dma/ioat/dma_v3.c
+++ b/drivers/dma/ioat/dma_v3.c
@@ -650,9 +650,11 @@ __ioat3_prep_pq_lock(struct dma_chan *c, enum sum_check_flags *result,
 
 	num_descs = ioat2_xferlen_to_descs(ioat, len);
 	/* we need 2x the number of descriptors to cover greater than 3
-	 * sources
+	 * sources (we need 1 extra source in the q-only continuation
+	 * case and 3 extra sources in the p+q continuation case.
 	 */
-	if (src_cnt > 3 || flags & DMA_PREP_CONTINUE) {
+	if (src_cnt + dmaf_p_disabled_continue(flags) > 3 ||
+	    (dmaf_continue(flags) && !dmaf_p_disabled_continue(flags))) {
 		with_ext = 1;
 		num_descs *= 2;
 	} else
@@ -1128,6 +1130,45 @@ static int __devinit ioat3_dma_self_test(struct ioatdma_device *device)
 	return 0;
 }
 
+static int ioat3_reset_hw(struct ioat_chan_common *chan)
+{
+	/* throw away whatever the channel was doing and get it
+	 * initialized, with ioat3 specific workarounds
+	 */
+	struct ioatdma_device *device = chan->device;
+	struct pci_dev *pdev = device->pdev;
+	u32 chanerr;
+	u16 dev_id;
+	int err;
+
+	ioat2_quiesce(chan, msecs_to_jiffies(100));
+
+	chanerr = readl(chan->reg_base + IOAT_CHANERR_OFFSET);
+	writel(chanerr, chan->reg_base + IOAT_CHANERR_OFFSET);
+
+	/* -= IOAT ver.3 workarounds =- */
+	/* Write CHANERRMSK_INT with 3E07h to mask out the errors
+	 * that can cause stability issues for IOAT ver.3, and clear any
+	 * pending errors
+	 */
+	pci_write_config_dword(pdev, IOAT_PCI_CHANERRMASK_INT_OFFSET, 0x3e07);
+	err = pci_read_config_dword(pdev, IOAT_PCI_CHANERR_INT_OFFSET, &chanerr);
+	if (err) {
+		dev_err(&pdev->dev, "channel error register unreachable\n");
+		return err;
+	}
+	pci_write_config_dword(pdev, IOAT_PCI_CHANERR_INT_OFFSET, chanerr);
+
+	/* Clear DMAUNCERRSTS Cfg-Reg Parity Error status bit
+	 * (workaround for spurious config parity error after restart)
+	 */
+	pci_read_config_word(pdev, IOAT_PCI_DEVICE_ID_OFFSET, &dev_id);
+	if (dev_id == PCI_DEVICE_ID_INTEL_IOAT_TBG0)
+		pci_write_config_dword(pdev, IOAT_PCI_DMAUNCERRSTS_OFFSET, 0x10);
+
+	return ioat2_reset_sync(chan, msecs_to_jiffies(200));
+}
+
 int __devinit ioat3_dma_probe(struct ioatdma_device *device, int dca)
 {
 	struct pci_dev *pdev = device->pdev;
@@ -1137,10 +1178,10 @@ int __devinit ioat3_dma_probe(struct ioatdma_device *device, int dca)
 	struct ioat_chan_common *chan;
 	bool is_raid_device = false;
 	int err;
-	u16 dev_id;
 	u32 cap;
 
 	device->enumerate_channels = ioat2_enumerate_channels;
+	device->reset_hw = ioat3_reset_hw;
 	device->self_test = ioat3_dma_self_test;
 	dma = &device->common;
 	dma->device_prep_dma_memcpy = ioat2_dma_prep_memcpy_lock;
@@ -1216,19 +1257,6 @@ int __devinit ioat3_dma_probe(struct ioatdma_device *device, int dca)
 	dma->device_prep_dma_xor_val = NULL;
 	#endif
 
-	/* -= IOAT ver.3 workarounds =- */
-	/* Write CHANERRMSK_INT with 3E07h to mask out the errors
-	 * that can cause stability issues for IOAT ver.3
-	 */
-	pci_write_config_dword(pdev, IOAT_PCI_CHANERRMASK_INT_OFFSET, 0x3e07);
-
-	/* Clear DMAUNCERRSTS Cfg-Reg Parity Error status bit
-	 * (workaround for spurious config parity error after restart)
-	 */
-	pci_read_config_word(pdev, IOAT_PCI_DEVICE_ID_OFFSET, &dev_id);
-	if (dev_id == PCI_DEVICE_ID_INTEL_IOAT_TBG0)
-		pci_write_config_dword(pdev, IOAT_PCI_DMAUNCERRSTS_OFFSET, 0x10);
-
 	err = ioat_probe(device);
 	if (err)
 		return err;
diff --git a/drivers/dma/ioat/registers.h b/drivers/dma/ioat/registers.h
index f015ec196700..e8ae63baf588 100644
--- a/drivers/dma/ioat/registers.h
+++ b/drivers/dma/ioat/registers.h
@@ -27,6 +27,7 @@
 
 #define IOAT_PCI_DEVICE_ID_OFFSET		0x02
 #define IOAT_PCI_DMAUNCERRSTS_OFFSET		0x148
+#define IOAT_PCI_CHANERR_INT_OFFSET		0x180
 #define IOAT_PCI_CHANERRMASK_INT_OFFSET		0x184
 
 /* MMIO Device Registers */
diff --git a/drivers/dma/iop-adma.c b/drivers/dma/iop-adma.c
index 645ca8d54ec4..ca6e6a0cb793 100644
--- a/drivers/dma/iop-adma.c
+++ b/drivers/dma/iop-adma.c
@@ -1470,7 +1470,7 @@ static int __devinit iop_adma_probe(struct platform_device *pdev)
 		return -ENODEV;
 
 	if (!devm_request_mem_region(&pdev->dev, res->start,
-				res->end - res->start, pdev->name))
+				resource_size(res), pdev->name))
 		return -EBUSY;
 
 	adev = kzalloc(sizeof(*adev), GFP_KERNEL);
@@ -1542,7 +1542,7 @@ static int __devinit iop_adma_probe(struct platform_device *pdev)
 	iop_chan->device = adev;
 
 	iop_chan->mmr_base = devm_ioremap(&pdev->dev, res->start,
-					res->end - res->start);
+					resource_size(res));
 	if (!iop_chan->mmr_base) {
 		ret = -ENOMEM;
 		goto err_free_iop_chan;
diff --git a/drivers/dma/ppc4xx/Makefile b/drivers/dma/ppc4xx/Makefile
new file mode 100644
index 000000000000..b3d259b3e52a
--- /dev/null
+++ b/drivers/dma/ppc4xx/Makefile
@@ -0,0 +1 @@
+obj-$(CONFIG_AMCC_PPC440SPE_ADMA) += adma.o
diff --git a/drivers/dma/ppc4xx/adma.c b/drivers/dma/ppc4xx/adma.c
new file mode 100644
index 000000000000..0a3478e910f0
--- /dev/null
+++ b/drivers/dma/ppc4xx/adma.c
@@ -0,0 +1,5027 @@
+/*
+ * Copyright (C) 2006-2009 DENX Software Engineering.
+ *
+ * Author: Yuri Tikhonov <yur@emcraft.com>
+ *
+ * Further porting to arch/powerpc by
+ * 	Anatolij Gustschin <agust@denx.de>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2 of the License, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc., 59
+ * Temple Place - Suite 330, Boston, MA  02111-1307, USA.
+ *
+ * The full GNU General Public License is included in this distribution in the
+ * file called COPYING.
+ */
+
+/*
+ * This driver supports the asynchrounous DMA copy and RAID engines available
+ * on the AMCC PPC440SPe Processors.
+ * Based on the Intel Xscale(R) family of I/O Processors (IOP 32x, 33x, 134x)
+ * ADMA driver written by D.Williams.
+ */
+
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/async_tx.h>
+#include <linux/delay.h>
+#include <linux/dma-mapping.h>
+#include <linux/spinlock.h>
+#include <linux/interrupt.h>
+#include <linux/uaccess.h>
+#include <linux/proc_fs.h>
+#include <linux/of.h>
+#include <linux/of_platform.h>
+#include <asm/dcr.h>
+#include <asm/dcr-regs.h>
+#include "adma.h"
+
+enum ppc_adma_init_code {
+	PPC_ADMA_INIT_OK = 0,
+	PPC_ADMA_INIT_MEMRES,
+	PPC_ADMA_INIT_MEMREG,
+	PPC_ADMA_INIT_ALLOC,
+	PPC_ADMA_INIT_COHERENT,
+	PPC_ADMA_INIT_CHANNEL,
+	PPC_ADMA_INIT_IRQ1,
+	PPC_ADMA_INIT_IRQ2,
+	PPC_ADMA_INIT_REGISTER
+};
+
+static char *ppc_adma_errors[] = {
+	[PPC_ADMA_INIT_OK] = "ok",
+	[PPC_ADMA_INIT_MEMRES] = "failed to get memory resource",
+	[PPC_ADMA_INIT_MEMREG] = "failed to request memory region",
+	[PPC_ADMA_INIT_ALLOC] = "failed to allocate memory for adev "
+				"structure",
+	[PPC_ADMA_INIT_COHERENT] = "failed to allocate coherent memory for "
+				   "hardware descriptors",
+	[PPC_ADMA_INIT_CHANNEL] = "failed to allocate memory for channel",
+	[PPC_ADMA_INIT_IRQ1] = "failed to request first irq",
+	[PPC_ADMA_INIT_IRQ2] = "failed to request second irq",
+	[PPC_ADMA_INIT_REGISTER] = "failed to register dma async device",
+};
+
+static enum ppc_adma_init_code
+ppc440spe_adma_devices[PPC440SPE_ADMA_ENGINES_NUM];
+
+struct ppc_dma_chan_ref {
+	struct dma_chan *chan;
+	struct list_head node;
+};
+
+/* The list of channels exported by ppc440spe ADMA */
+struct list_head
+ppc440spe_adma_chan_list = LIST_HEAD_INIT(ppc440spe_adma_chan_list);
+
+/* This flag is set when want to refetch the xor chain in the interrupt
+ * handler
+ */
+static u32 do_xor_refetch;
+
+/* Pointer to DMA0, DMA1 CP/CS FIFO */
+static void *ppc440spe_dma_fifo_buf;
+
+/* Pointers to last submitted to DMA0, DMA1 CDBs */
+static struct ppc440spe_adma_desc_slot *chan_last_sub[3];
+static struct ppc440spe_adma_desc_slot *chan_first_cdb[3];
+
+/* Pointer to last linked and submitted xor CB */
+static struct ppc440spe_adma_desc_slot *xor_last_linked;
+static struct ppc440spe_adma_desc_slot *xor_last_submit;
+
+/* This array is used in data-check operations for storing a pattern */
+static char ppc440spe_qword[16];
+
+static atomic_t ppc440spe_adma_err_irq_ref;
+static dcr_host_t ppc440spe_mq_dcr_host;
+static unsigned int ppc440spe_mq_dcr_len;
+
+/* Since RXOR operations use the common register (MQ0_CF2H) for setting-up
+ * the block size in transactions, then we do not allow to activate more than
+ * only one RXOR transactions simultaneously. So use this var to store
+ * the information about is RXOR currently active (PPC440SPE_RXOR_RUN bit is
+ * set) or not (PPC440SPE_RXOR_RUN is clear).
+ */
+static unsigned long ppc440spe_rxor_state;
+
+/* These are used in enable & check routines
+ */
+static u32 ppc440spe_r6_enabled;
+static struct ppc440spe_adma_chan *ppc440spe_r6_tchan;
+static struct completion ppc440spe_r6_test_comp;
+
+static int ppc440spe_adma_dma2rxor_prep_src(
+		struct ppc440spe_adma_desc_slot *desc,
+		struct ppc440spe_rxor *cursor, int index,
+		int src_cnt, u32 addr);
+static void ppc440spe_adma_dma2rxor_set_src(
+		struct ppc440spe_adma_desc_slot *desc,
+		int index, dma_addr_t addr);
+static void ppc440spe_adma_dma2rxor_set_mult(
+		struct ppc440spe_adma_desc_slot *desc,
+		int index, u8 mult);
+
+#ifdef ADMA_LL_DEBUG
+#define ADMA_LL_DBG(x) ({ if (1) x; 0; })
+#else
+#define ADMA_LL_DBG(x) ({ if (0) x; 0; })
+#endif
+
+static void print_cb(struct ppc440spe_adma_chan *chan, void *block)
+{
+	struct dma_cdb *cdb;
+	struct xor_cb *cb;
+	int i;
+
+	switch (chan->device->id) {
+	case 0:
+	case 1:
+		cdb = block;
+
+		pr_debug("CDB at %p [%d]:\n"
+			"\t attr 0x%02x opc 0x%02x cnt 0x%08x\n"
+			"\t sg1u 0x%08x sg1l 0x%08x\n"
+			"\t sg2u 0x%08x sg2l 0x%08x\n"
+			"\t sg3u 0x%08x sg3l 0x%08x\n",
+			cdb, chan->device->id,
+			cdb->attr, cdb->opc, le32_to_cpu(cdb->cnt),
+			le32_to_cpu(cdb->sg1u), le32_to_cpu(cdb->sg1l),
+			le32_to_cpu(cdb->sg2u), le32_to_cpu(cdb->sg2l),
+			le32_to_cpu(cdb->sg3u), le32_to_cpu(cdb->sg3l)
+		);
+		break;
+	case 2:
+		cb = block;
+
+		pr_debug("CB at %p [%d]:\n"
+			"\t cbc 0x%08x cbbc 0x%08x cbs 0x%08x\n"
+			"\t cbtah 0x%08x cbtal 0x%08x\n"
+			"\t cblah 0x%08x cblal 0x%08x\n",
+			cb, chan->device->id,
+			cb->cbc, cb->cbbc, cb->cbs,
+			cb->cbtah, cb->cbtal,
+			cb->cblah, cb->cblal);
+		for (i = 0; i < 16; i++) {
+			if (i && !cb->ops[i].h && !cb->ops[i].l)
+				continue;
+			pr_debug("\t ops[%2d]: h 0x%08x l 0x%08x\n",
+				i, cb->ops[i].h, cb->ops[i].l);
+		}
+		break;
+	}
+}
+
+static void print_cb_list(struct ppc440spe_adma_chan *chan,
+			  struct ppc440spe_adma_desc_slot *iter)
+{
+	for (; iter; iter = iter->hw_next)
+		print_cb(chan, iter->hw_desc);
+}
+
+static void prep_dma_xor_dbg(int id, dma_addr_t dst, dma_addr_t *src,
+			     unsigned int src_cnt)
+{
+	int i;
+
+	pr_debug("\n%s(%d):\nsrc: ", __func__, id);
+	for (i = 0; i < src_cnt; i++)
+		pr_debug("\t0x%016llx ", src[i]);
+	pr_debug("dst:\n\t0x%016llx\n", dst);
+}
+
+static void prep_dma_pq_dbg(int id, dma_addr_t *dst, dma_addr_t *src,
+			    unsigned int src_cnt)
+{
+	int i;
+
+	pr_debug("\n%s(%d):\nsrc: ", __func__, id);
+	for (i = 0; i < src_cnt; i++)
+		pr_debug("\t0x%016llx ", src[i]);
+	pr_debug("dst: ");
+	for (i = 0; i < 2; i++)
+		pr_debug("\t0x%016llx ", dst[i]);
+}
+
+static void prep_dma_pqzero_sum_dbg(int id, dma_addr_t *src,
+				    unsigned int src_cnt,
+				    const unsigned char *scf)
+{
+	int i;
+
+	pr_debug("\n%s(%d):\nsrc(coef): ", __func__, id);
+	if (scf) {
+		for (i = 0; i < src_cnt; i++)
+			pr_debug("\t0x%016llx(0x%02x) ", src[i], scf[i]);
+	} else {
+		for (i = 0; i < src_cnt; i++)
+			pr_debug("\t0x%016llx(no) ", src[i]);
+	}
+
+	pr_debug("dst: ");
+	for (i = 0; i < 2; i++)
+		pr_debug("\t0x%016llx ", src[src_cnt + i]);
+}
+
+/******************************************************************************
+ * Command (Descriptor) Blocks low-level routines
+ ******************************************************************************/
+/**
+ * ppc440spe_desc_init_interrupt - initialize the descriptor for INTERRUPT
+ * pseudo operation
+ */
+static void ppc440spe_desc_init_interrupt(struct ppc440spe_adma_desc_slot *desc,
+					  struct ppc440spe_adma_chan *chan)
+{
+	struct xor_cb *p;
+
+	switch (chan->device->id) {
+	case PPC440SPE_XOR_ID:
+		p = desc->hw_desc;
+		memset(desc->hw_desc, 0, sizeof(struct xor_cb));
+		/* NOP with Command Block Complete Enable */
+		p->cbc = XOR_CBCR_CBCE_BIT;
+		break;
+	case PPC440SPE_DMA0_ID:
+	case PPC440SPE_DMA1_ID:
+		memset(desc->hw_desc, 0, sizeof(struct dma_cdb));
+		/* NOP with interrupt */
+		set_bit(PPC440SPE_DESC_INT, &desc->flags);
+		break;
+	default:
+		printk(KERN_ERR "Unsupported id %d in %s\n", chan->device->id,
+				__func__);
+		break;
+	}
+}
+
+/**
+ * ppc440spe_desc_init_null_xor - initialize the descriptor for NULL XOR
+ * pseudo operation
+ */
+static void ppc440spe_desc_init_null_xor(struct ppc440spe_adma_desc_slot *desc)
+{
+	memset(desc->hw_desc, 0, sizeof(struct xor_cb));
+	desc->hw_next = NULL;
+	desc->src_cnt = 0;
+	desc->dst_cnt = 1;
+}
+
+/**
+ * ppc440spe_desc_init_xor - initialize the descriptor for XOR operation
+ */
+static void ppc440spe_desc_init_xor(struct ppc440spe_adma_desc_slot *desc,
+					 int src_cnt, unsigned long flags)
+{
+	struct xor_cb *hw_desc = desc->hw_desc;
+
+	memset(desc->hw_desc, 0, sizeof(struct xor_cb));
+	desc->hw_next = NULL;
+	desc->src_cnt = src_cnt;
+	desc->dst_cnt = 1;
+
+	hw_desc->cbc = XOR_CBCR_TGT_BIT | src_cnt;
+	if (flags & DMA_PREP_INTERRUPT)
+		/* Enable interrupt on completion */
+		hw_desc->cbc |= XOR_CBCR_CBCE_BIT;
+}
+
+/**
+ * ppc440spe_desc_init_dma2pq - initialize the descriptor for PQ
+ * operation in DMA2 controller
+ */
+static void ppc440spe_desc_init_dma2pq(struct ppc440spe_adma_desc_slot *desc,
+		int dst_cnt, int src_cnt, unsigned long flags)
+{
+	struct xor_cb *hw_desc = desc->hw_desc;
+
+	memset(desc->hw_desc, 0, sizeof(struct xor_cb));
+	desc->hw_next = NULL;
+	desc->src_cnt = src_cnt;
+	desc->dst_cnt = dst_cnt;
+	memset(desc->reverse_flags, 0, sizeof(desc->reverse_flags));
+	desc->descs_per_op = 0;
+
+	hw_desc->cbc = XOR_CBCR_TGT_BIT;
+	if (flags & DMA_PREP_INTERRUPT)
+		/* Enable interrupt on completion */
+		hw_desc->cbc |= XOR_CBCR_CBCE_BIT;
+}
+
+#define DMA_CTRL_FLAGS_LAST	DMA_PREP_FENCE
+#define DMA_PREP_ZERO_P		(DMA_CTRL_FLAGS_LAST << 1)
+#define DMA_PREP_ZERO_Q		(DMA_PREP_ZERO_P << 1)
+
+/**
+ * ppc440spe_desc_init_dma01pq - initialize the descriptors for PQ operation
+ * with DMA0/1
+ */
+static void ppc440spe_desc_init_dma01pq(struct ppc440spe_adma_desc_slot *desc,
+				int dst_cnt, int src_cnt, unsigned long flags,
+				unsigned long op)
+{
+	struct dma_cdb *hw_desc;
+	struct ppc440spe_adma_desc_slot *iter;
+	u8 dopc;
+
+	/* Common initialization of a PQ descriptors chain */
+	set_bits(op, &desc->flags);
+	desc->src_cnt = src_cnt;
+	desc->dst_cnt = dst_cnt;
+
+	/* WXOR MULTICAST if both P and Q are being computed
+	 * MV_SG1_SG2 if Q only
+	 */
+	dopc = (desc->dst_cnt == DMA_DEST_MAX_NUM) ?
+		DMA_CDB_OPC_MULTICAST : DMA_CDB_OPC_MV_SG1_SG2;
+
+	list_for_each_entry(iter, &desc->group_list, chain_node) {
+		hw_desc = iter->hw_desc;
+		memset(iter->hw_desc, 0, sizeof(struct dma_cdb));
+
+		if (likely(!list_is_last(&iter->chain_node,
+				&desc->group_list))) {
+			/* set 'next' pointer */
+			iter->hw_next = list_entry(iter->chain_node.next,
+				struct ppc440spe_adma_desc_slot, chain_node);
+			clear_bit(PPC440SPE_DESC_INT, &iter->flags);
+		} else {
+			/* this is the last descriptor.
+			 * this slot will be pasted from ADMA level
+			 * each time it wants to configure parameters
+			 * of the transaction (src, dst, ...)
+			 */
+			iter->hw_next = NULL;
+			if (flags & DMA_PREP_INTERRUPT)
+				set_bit(PPC440SPE_DESC_INT, &iter->flags);
+			else
+				clear_bit(PPC440SPE_DESC_INT, &iter->flags);
+		}
+	}
+
+	/* Set OPS depending on WXOR/RXOR type of operation */
+	if (!test_bit(PPC440SPE_DESC_RXOR, &desc->flags)) {
+		/* This is a WXOR only chain:
+		 * - first descriptors are for zeroing destinations
+		 *   if PPC440SPE_ZERO_P/Q set;
+		 * - descriptors remained are for GF-XOR operations.
+		 */
+		iter = list_first_entry(&desc->group_list,
+					struct ppc440spe_adma_desc_slot,
+					chain_node);
+
+		if (test_bit(PPC440SPE_ZERO_P, &desc->flags)) {
+			hw_desc = iter->hw_desc;
+			hw_desc->opc = DMA_CDB_OPC_MV_SG1_SG2;
+			iter = list_first_entry(&iter->chain_node,
+					struct ppc440spe_adma_desc_slot,
+					chain_node);
+		}
+
+		if (test_bit(PPC440SPE_ZERO_Q, &desc->flags)) {
+			hw_desc = iter->hw_desc;
+			hw_desc->opc = DMA_CDB_OPC_MV_SG1_SG2;
+			iter = list_first_entry(&iter->chain_node,
+					struct ppc440spe_adma_desc_slot,
+					chain_node);
+		}
+
+		list_for_each_entry_from(iter, &desc->group_list, chain_node) {
+			hw_desc = iter->hw_desc;
+			hw_desc->opc = dopc;
+		}
+	} else {
+		/* This is either RXOR-only or mixed RXOR/WXOR */
+
+		/* The first 1 or 2 slots in chain are always RXOR,
+		 * if need to calculate P & Q, then there are two
+		 * RXOR slots; if only P or only Q, then there is one
+		 */
+		iter = list_first_entry(&desc->group_list,
+					struct ppc440spe_adma_desc_slot,
+					chain_node);
+		hw_desc = iter->hw_desc;
+		hw_desc->opc = DMA_CDB_OPC_MV_SG1_SG2;
+
+		if (desc->dst_cnt == DMA_DEST_MAX_NUM) {
+			iter = list_first_entry(&iter->chain_node,
+						struct ppc440spe_adma_desc_slot,
+						chain_node);
+			hw_desc = iter->hw_desc;
+			hw_desc->opc = DMA_CDB_OPC_MV_SG1_SG2;
+		}
+
+		/* The remaining descs (if any) are WXORs */
+		if (test_bit(PPC440SPE_DESC_WXOR, &desc->flags)) {
+			iter = list_first_entry(&iter->chain_node,
+						struct ppc440spe_adma_desc_slot,
+						chain_node);
+			list_for_each_entry_from(iter, &desc->group_list,
+						chain_node) {
+				hw_desc = iter->hw_desc;
+				hw_desc->opc = dopc;
+			}
+		}
+	}
+}
+
+/**
+ * ppc440spe_desc_init_dma01pqzero_sum - initialize the descriptor
+ * for PQ_ZERO_SUM operation
+ */
+static void ppc440spe_desc_init_dma01pqzero_sum(
+				struct ppc440spe_adma_desc_slot *desc,
+				int dst_cnt, int src_cnt)
+{
+	struct dma_cdb *hw_desc;
+	struct ppc440spe_adma_desc_slot *iter;
+	int i = 0;
+	u8 dopc = (dst_cnt == 2) ? DMA_CDB_OPC_MULTICAST :
+				   DMA_CDB_OPC_MV_SG1_SG2;
+	/*
+	 * Initialize starting from 2nd or 3rd descriptor dependent
+	 * on dst_cnt. First one or two slots are for cloning P
+	 * and/or Q to chan->pdest and/or chan->qdest as we have
+	 * to preserve original P/Q.
+	 */
+	iter = list_first_entry(&desc->group_list,
+				struct ppc440spe_adma_desc_slot, chain_node);
+	iter = list_entry(iter->chain_node.next,
+			  struct ppc440spe_adma_desc_slot, chain_node);
+
+	if (dst_cnt > 1) {
+		iter = list_entry(iter->chain_node.next,
+				  struct ppc440spe_adma_desc_slot, chain_node);
+	}
+	/* initialize each source descriptor in chain */
+	list_for_each_entry_from(iter, &desc->group_list, chain_node) {
+		hw_desc = iter->hw_desc;
+		memset(iter->hw_desc, 0, sizeof(struct dma_cdb));
+		iter->src_cnt = 0;
+		iter->dst_cnt = 0;
+
+		/* This is a ZERO_SUM operation:
+		 * - <src_cnt> descriptors starting from 2nd or 3rd
+		 *   descriptor are for GF-XOR operations;
+		 * - remaining <dst_cnt> descriptors are for checking the result
+		 */
+		if (i++ < src_cnt)
+			/* MV_SG1_SG2 if only Q is being verified
+			 * MULTICAST if both P and Q are being verified
+			 */
+			hw_desc->opc = dopc;
+		else
+			/* DMA_CDB_OPC_DCHECK128 operation */
+			hw_desc->opc = DMA_CDB_OPC_DCHECK128;
+
+		if (likely(!list_is_last(&iter->chain_node,
+					 &desc->group_list))) {
+			/* set 'next' pointer */
+			iter->hw_next = list_entry(iter->chain_node.next,
+						struct ppc440spe_adma_desc_slot,
+						chain_node);
+		} else {
+			/* this is the last descriptor.
+			 * this slot will be pasted from ADMA level
+			 * each time it wants to configure parameters
+			 * of the transaction (src, dst, ...)
+			 */
+			iter->hw_next = NULL;
+			/* always enable interrupt generation since we get
+			 * the status of pqzero from the handler
+			 */
+			set_bit(PPC440SPE_DESC_INT, &iter->flags);
+		}
+	}
+	desc->src_cnt = src_cnt;
+	desc->dst_cnt = dst_cnt;
+}
+
+/**
+ * ppc440spe_desc_init_memcpy - initialize the descriptor for MEMCPY operation
+ */
+static void ppc440spe_desc_init_memcpy(struct ppc440spe_adma_desc_slot *desc,
+					unsigned long flags)
+{
+	struct dma_cdb *hw_desc = desc->hw_desc;
+
+	memset(desc->hw_desc, 0, sizeof(struct dma_cdb));
+	desc->hw_next = NULL;
+	desc->src_cnt = 1;
+	desc->dst_cnt = 1;
+
+	if (flags & DMA_PREP_INTERRUPT)
+		set_bit(PPC440SPE_DESC_INT, &desc->flags);
+	else
+		clear_bit(PPC440SPE_DESC_INT, &desc->flags);
+
+	hw_desc->opc = DMA_CDB_OPC_MV_SG1_SG2;
+}
+
+/**
+ * ppc440spe_desc_init_memset - initialize the descriptor for MEMSET operation
+ */
+static void ppc440spe_desc_init_memset(struct ppc440spe_adma_desc_slot *desc,
+					int value, unsigned long flags)
+{
+	struct dma_cdb *hw_desc = desc->hw_desc;
+
+	memset(desc->hw_desc, 0, sizeof(struct dma_cdb));
+	desc->hw_next = NULL;
+	desc->src_cnt = 1;
+	desc->dst_cnt = 1;
+
+	if (flags & DMA_PREP_INTERRUPT)
+		set_bit(PPC440SPE_DESC_INT, &desc->flags);
+	else
+		clear_bit(PPC440SPE_DESC_INT, &desc->flags);
+
+	hw_desc->sg1u = hw_desc->sg1l = cpu_to_le32((u32)value);
+	hw_desc->sg3u = hw_desc->sg3l = cpu_to_le32((u32)value);
+	hw_desc->opc = DMA_CDB_OPC_DFILL128;
+}
+
+/**
+ * ppc440spe_desc_set_src_addr - set source address into the descriptor
+ */
+static void ppc440spe_desc_set_src_addr(struct ppc440spe_adma_desc_slot *desc,
+					struct ppc440spe_adma_chan *chan,
+					int src_idx, dma_addr_t addrh,
+					dma_addr_t addrl)
+{
+	struct dma_cdb *dma_hw_desc;
+	struct xor_cb *xor_hw_desc;
+	phys_addr_t addr64, tmplow, tmphi;
+
+	switch (chan->device->id) {
+	case PPC440SPE_DMA0_ID:
+	case PPC440SPE_DMA1_ID:
+		if (!addrh) {
+			addr64 = addrl;
+			tmphi = (addr64 >> 32);
+			tmplow = (addr64 & 0xFFFFFFFF);
+		} else {
+			tmphi = addrh;
+			tmplow = addrl;
+		}
+		dma_hw_desc = desc->hw_desc;
+		dma_hw_desc->sg1l = cpu_to_le32((u32)tmplow);
+		dma_hw_desc->sg1u |= cpu_to_le32((u32)tmphi);
+		break;
+	case PPC440SPE_XOR_ID:
+		xor_hw_desc = desc->hw_desc;
+		xor_hw_desc->ops[src_idx].l = addrl;
+		xor_hw_desc->ops[src_idx].h |= addrh;
+		break;
+	}
+}
+
+/**
+ * ppc440spe_desc_set_src_mult - set source address mult into the descriptor
+ */
+static void ppc440spe_desc_set_src_mult(struct ppc440spe_adma_desc_slot *desc,
+			struct ppc440spe_adma_chan *chan, u32 mult_index,
+			int sg_index, unsigned char mult_value)
+{
+	struct dma_cdb *dma_hw_desc;
+	struct xor_cb *xor_hw_desc;
+	u32 *psgu;
+
+	switch (chan->device->id) {
+	case PPC440SPE_DMA0_ID:
+	case PPC440SPE_DMA1_ID:
+		dma_hw_desc = desc->hw_desc;
+
+		switch (sg_index) {
+		/* for RXOR operations set multiplier
+		 * into source cued address
+		 */
+		case DMA_CDB_SG_SRC:
+			psgu = &dma_hw_desc->sg1u;
+			break;
+		/* for WXOR operations set multiplier
+		 * into destination cued address(es)
+		 */
+		case DMA_CDB_SG_DST1:
+			psgu = &dma_hw_desc->sg2u;
+			break;
+		case DMA_CDB_SG_DST2:
+			psgu = &dma_hw_desc->sg3u;
+			break;
+		default:
+			BUG();
+		}
+
+		*psgu |= cpu_to_le32(mult_value << mult_index);
+		break;
+	case PPC440SPE_XOR_ID:
+		xor_hw_desc = desc->hw_desc;
+		break;
+	default:
+		BUG();
+	}
+}
+
+/**
+ * ppc440spe_desc_set_dest_addr - set destination address into the descriptor
+ */
+static void ppc440spe_desc_set_dest_addr(struct ppc440spe_adma_desc_slot *desc,
+				struct ppc440spe_adma_chan *chan,
+				dma_addr_t addrh, dma_addr_t addrl,
+				u32 dst_idx)
+{
+	struct dma_cdb *dma_hw_desc;
+	struct xor_cb *xor_hw_desc;
+	phys_addr_t addr64, tmphi, tmplow;
+	u32 *psgu, *psgl;
+
+	switch (chan->device->id) {
+	case PPC440SPE_DMA0_ID:
+	case PPC440SPE_DMA1_ID:
+		if (!addrh) {
+			addr64 = addrl;
+			tmphi = (addr64 >> 32);
+			tmplow = (addr64 & 0xFFFFFFFF);
+		} else {
+			tmphi = addrh;
+			tmplow = addrl;
+		}
+		dma_hw_desc = desc->hw_desc;
+
+		psgu = dst_idx ? &dma_hw_desc->sg3u : &dma_hw_desc->sg2u;
+		psgl = dst_idx ? &dma_hw_desc->sg3l : &dma_hw_desc->sg2l;
+
+		*psgl = cpu_to_le32((u32)tmplow);
+		*psgu |= cpu_to_le32((u32)tmphi);
+		break;
+	case PPC440SPE_XOR_ID:
+		xor_hw_desc = desc->hw_desc;
+		xor_hw_desc->cbtal = addrl;
+		xor_hw_desc->cbtah |= addrh;
+		break;
+	}
+}
+
+/**
+ * ppc440spe_desc_set_byte_count - set number of data bytes involved
+ * into the operation
+ */
+static void ppc440spe_desc_set_byte_count(struct ppc440spe_adma_desc_slot *desc,
+				struct ppc440spe_adma_chan *chan,
+				u32 byte_count)
+{
+	struct dma_cdb *dma_hw_desc;
+	struct xor_cb *xor_hw_desc;
+
+	switch (chan->device->id) {
+	case PPC440SPE_DMA0_ID:
+	case PPC440SPE_DMA1_ID:
+		dma_hw_desc = desc->hw_desc;
+		dma_hw_desc->cnt = cpu_to_le32(byte_count);
+		break;
+	case PPC440SPE_XOR_ID:
+		xor_hw_desc = desc->hw_desc;
+		xor_hw_desc->cbbc = byte_count;
+		break;
+	}
+}
+
+/**
+ * ppc440spe_desc_set_rxor_block_size - set RXOR block size
+ */
+static inline void ppc440spe_desc_set_rxor_block_size(u32 byte_count)
+{
+	/* assume that byte_count is aligned on the 512-boundary;
+	 * thus write it directly to the register (bits 23:31 are
+	 * reserved there).
+	 */
+	dcr_write(ppc440spe_mq_dcr_host, DCRN_MQ0_CF2H, byte_count);
+}
+
+/**
+ * ppc440spe_desc_set_dcheck - set CHECK pattern
+ */
+static void ppc440spe_desc_set_dcheck(struct ppc440spe_adma_desc_slot *desc,
+				struct ppc440spe_adma_chan *chan, u8 *qword)
+{
+	struct dma_cdb *dma_hw_desc;
+
+	switch (chan->device->id) {
+	case PPC440SPE_DMA0_ID:
+	case PPC440SPE_DMA1_ID:
+		dma_hw_desc = desc->hw_desc;
+		iowrite32(qword[0], &dma_hw_desc->sg3l);
+		iowrite32(qword[4], &dma_hw_desc->sg3u);
+		iowrite32(qword[8], &dma_hw_desc->sg2l);
+		iowrite32(qword[12], &dma_hw_desc->sg2u);
+		break;
+	default:
+		BUG();
+	}
+}
+
+/**
+ * ppc440spe_xor_set_link - set link address in xor CB
+ */
+static void ppc440spe_xor_set_link(struct ppc440spe_adma_desc_slot *prev_desc,
+				struct ppc440spe_adma_desc_slot *next_desc)
+{
+	struct xor_cb *xor_hw_desc = prev_desc->hw_desc;
+
+	if (unlikely(!next_desc || !(next_desc->phys))) {
+		printk(KERN_ERR "%s: next_desc=0x%p; next_desc->phys=0x%llx\n",
+			__func__, next_desc,
+			next_desc ? next_desc->phys : 0);
+		BUG();
+	}
+
+	xor_hw_desc->cbs = 0;
+	xor_hw_desc->cblal = next_desc->phys;
+	xor_hw_desc->cblah = 0;
+	xor_hw_desc->cbc |= XOR_CBCR_LNK_BIT;
+}
+
+/**
+ * ppc440spe_desc_set_link - set the address of descriptor following this
+ * descriptor in chain
+ */
+static void ppc440spe_desc_set_link(struct ppc440spe_adma_chan *chan,
+				struct ppc440spe_adma_desc_slot *prev_desc,
+				struct ppc440spe_adma_desc_slot *next_desc)
+{
+	unsigned long flags;
+	struct ppc440spe_adma_desc_slot *tail = next_desc;
+
+	if (unlikely(!prev_desc || !next_desc ||
+		(prev_desc->hw_next && prev_desc->hw_next != next_desc))) {
+		/* If previous next is overwritten something is wrong.
+		 * though we may refetch from append to initiate list
+		 * processing; in this case - it's ok.
+		 */
+		printk(KERN_ERR "%s: prev_desc=0x%p; next_desc=0x%p; "
+			"prev->hw_next=0x%p\n", __func__, prev_desc,
+			next_desc, prev_desc ? prev_desc->hw_next : 0);
+		BUG();
+	}
+
+	local_irq_save(flags);
+
+	/* do s/w chaining both for DMA and XOR descriptors */
+	prev_desc->hw_next = next_desc;
+
+	switch (chan->device->id) {
+	case PPC440SPE_DMA0_ID:
+	case PPC440SPE_DMA1_ID:
+		break;
+	case PPC440SPE_XOR_ID:
+		/* bind descriptor to the chain */
+		while (tail->hw_next)
+			tail = tail->hw_next;
+		xor_last_linked = tail;
+
+		if (prev_desc == xor_last_submit)
+			/* do not link to the last submitted CB */
+			break;
+		ppc440spe_xor_set_link(prev_desc, next_desc);
+		break;
+	}
+
+	local_irq_restore(flags);
+}
+
+/**
+ * ppc440spe_desc_get_src_addr - extract the source address from the descriptor
+ */
+static u32 ppc440spe_desc_get_src_addr(struct ppc440spe_adma_desc_slot *desc,
+				struct ppc440spe_adma_chan *chan, int src_idx)
+{
+	struct dma_cdb *dma_hw_desc;
+	struct xor_cb *xor_hw_desc;
+
+	switch (chan->device->id) {
+	case PPC440SPE_DMA0_ID:
+	case PPC440SPE_DMA1_ID:
+		dma_hw_desc = desc->hw_desc;
+		/* May have 0, 1, 2, or 3 sources */
+		switch (dma_hw_desc->opc) {
+		case DMA_CDB_OPC_NO_OP:
+		case DMA_CDB_OPC_DFILL128:
+			return 0;
+		case DMA_CDB_OPC_DCHECK128:
+			if (unlikely(src_idx)) {
+				printk(KERN_ERR "%s: try to get %d source for"
+				    " DCHECK128\n", __func__, src_idx);
+				BUG();
+			}
+			return le32_to_cpu(dma_hw_desc->sg1l);
+		case DMA_CDB_OPC_MULTICAST:
+		case DMA_CDB_OPC_MV_SG1_SG2:
+			if (unlikely(src_idx > 2)) {
+				printk(KERN_ERR "%s: try to get %d source from"
+				    " DMA descr\n", __func__, src_idx);
+				BUG();
+			}
+			if (src_idx) {
+				if (le32_to_cpu(dma_hw_desc->sg1u) &
+				    DMA_CUED_XOR_WIN_MSK) {
+					u8 region;
+
+					if (src_idx == 1)
+						return le32_to_cpu(
+						    dma_hw_desc->sg1l) +
+							desc->unmap_len;
+
+					region = (le32_to_cpu(
+					    dma_hw_desc->sg1u)) >>
+						DMA_CUED_REGION_OFF;
+
+					region &= DMA_CUED_REGION_MSK;
+					switch (region) {
+					case DMA_RXOR123:
+						return le32_to_cpu(
+						    dma_hw_desc->sg1l) +
+							(desc->unmap_len << 1);
+					case DMA_RXOR124:
+						return le32_to_cpu(
+						    dma_hw_desc->sg1l) +
+							(desc->unmap_len * 3);
+					case DMA_RXOR125:
+						return le32_to_cpu(
+						    dma_hw_desc->sg1l) +
+							(desc->unmap_len << 2);
+					default:
+						printk(KERN_ERR
+						    "%s: try to"
+						    " get src3 for region %02x"
+						    "PPC440SPE_DESC_RXOR12?\n",
+						    __func__, region);
+						BUG();
+					}
+				} else {
+					printk(KERN_ERR
+						"%s: try to get %d"
+						" source for non-cued descr\n",
+						__func__, src_idx);
+					BUG();
+				}
+			}
+			return le32_to_cpu(dma_hw_desc->sg1l);
+		default:
+			printk(KERN_ERR "%s: unknown OPC 0x%02x\n",
+				__func__, dma_hw_desc->opc);
+			BUG();
+		}
+		return le32_to_cpu(dma_hw_desc->sg1l);
+	case PPC440SPE_XOR_ID:
+		/* May have up to 16 sources */
+		xor_hw_desc = desc->hw_desc;
+		return xor_hw_desc->ops[src_idx].l;
+	}
+	return 0;
+}
+
+/**
+ * ppc440spe_desc_get_dest_addr - extract the destination address from the
+ * descriptor
+ */
+static u32 ppc440spe_desc_get_dest_addr(struct ppc440spe_adma_desc_slot *desc,
+				struct ppc440spe_adma_chan *chan, int idx)
+{
+	struct dma_cdb *dma_hw_desc;
+	struct xor_cb *xor_hw_desc;
+
+	switch (chan->device->id) {
+	case PPC440SPE_DMA0_ID:
+	case PPC440SPE_DMA1_ID:
+		dma_hw_desc = desc->hw_desc;
+
+		if (likely(!idx))
+			return le32_to_cpu(dma_hw_desc->sg2l);
+		return le32_to_cpu(dma_hw_desc->sg3l);
+	case PPC440SPE_XOR_ID:
+		xor_hw_desc = desc->hw_desc;
+		return xor_hw_desc->cbtal;
+	}
+	return 0;
+}
+
+/**
+ * ppc440spe_desc_get_src_num - extract the number of source addresses from
+ * the descriptor
+ */
+static u32 ppc440spe_desc_get_src_num(struct ppc440spe_adma_desc_slot *desc,
+				struct ppc440spe_adma_chan *chan)
+{
+	struct dma_cdb *dma_hw_desc;
+	struct xor_cb *xor_hw_desc;
+
+	switch (chan->device->id) {
+	case PPC440SPE_DMA0_ID:
+	case PPC440SPE_DMA1_ID:
+		dma_hw_desc = desc->hw_desc;
+
+		switch (dma_hw_desc->opc) {
+		case DMA_CDB_OPC_NO_OP:
+		case DMA_CDB_OPC_DFILL128:
+			return 0;
+		case DMA_CDB_OPC_DCHECK128:
+			return 1;
+		case DMA_CDB_OPC_MV_SG1_SG2:
+		case DMA_CDB_OPC_MULTICAST:
+			/*
+			 * Only for RXOR operations we have more than
+			 * one source
+			 */
+			if (le32_to_cpu(dma_hw_desc->sg1u) &
+			    DMA_CUED_XOR_WIN_MSK) {
+				/* RXOR op, there are 2 or 3 sources */
+				if (((le32_to_cpu(dma_hw_desc->sg1u) >>
+				    DMA_CUED_REGION_OFF) &
+				      DMA_CUED_REGION_MSK) == DMA_RXOR12) {
+					/* RXOR 1-2 */
+					return 2;
+				} else {
+					/* RXOR 1-2-3/1-2-4/1-2-5 */
+					return 3;
+				}
+			}
+			return 1;
+		default:
+			printk(KERN_ERR "%s: unknown OPC 0x%02x\n",
+				__func__, dma_hw_desc->opc);
+			BUG();
+		}
+	case PPC440SPE_XOR_ID:
+		/* up to 16 sources */
+		xor_hw_desc = desc->hw_desc;
+		return xor_hw_desc->cbc & XOR_CDCR_OAC_MSK;
+	default:
+		BUG();
+	}
+	return 0;
+}
+
+/**
+ * ppc440spe_desc_get_dst_num - get the number of destination addresses in
+ * this descriptor
+ */
+static u32 ppc440spe_desc_get_dst_num(struct ppc440spe_adma_desc_slot *desc,
+				struct ppc440spe_adma_chan *chan)
+{
+	struct dma_cdb *dma_hw_desc;
+
+	switch (chan->device->id) {
+	case PPC440SPE_DMA0_ID:
+	case PPC440SPE_DMA1_ID:
+		/* May be 1 or 2 destinations */
+		dma_hw_desc = desc->hw_desc;
+		switch (dma_hw_desc->opc) {
+		case DMA_CDB_OPC_NO_OP:
+		case DMA_CDB_OPC_DCHECK128:
+			return 0;
+		case DMA_CDB_OPC_MV_SG1_SG2:
+		case DMA_CDB_OPC_DFILL128:
+			return 1;
+		case DMA_CDB_OPC_MULTICAST:
+			if (desc->dst_cnt == 2)
+				return 2;
+			else
+				return 1;
+		default:
+			printk(KERN_ERR "%s: unknown OPC 0x%02x\n",
+				__func__, dma_hw_desc->opc);
+			BUG();
+		}
+	case PPC440SPE_XOR_ID:
+		/* Always only 1 destination */
+		return 1;
+	default:
+		BUG();
+	}
+	return 0;
+}
+
+/**
+ * ppc440spe_desc_get_link - get the address of the descriptor that
+ * follows this one
+ */
+static inline u32 ppc440spe_desc_get_link(struct ppc440spe_adma_desc_slot *desc,
+					struct ppc440spe_adma_chan *chan)
+{
+	if (!desc->hw_next)
+		return 0;
+
+	return desc->hw_next->phys;
+}
+
+/**
+ * ppc440spe_desc_is_aligned - check alignment
+ */
+static inline int ppc440spe_desc_is_aligned(
+	struct ppc440spe_adma_desc_slot *desc, int num_slots)
+{
+	return (desc->idx & (num_slots - 1)) ? 0 : 1;
+}
+
+/**
+ * ppc440spe_chan_xor_slot_count - get the number of slots necessary for
+ * XOR operation
+ */
+static int ppc440spe_chan_xor_slot_count(size_t len, int src_cnt,
+			int *slots_per_op)
+{
+	int slot_cnt;
+
+	/* each XOR descriptor provides up to 16 source operands */
+	slot_cnt = *slots_per_op = (src_cnt + XOR_MAX_OPS - 1)/XOR_MAX_OPS;
+
+	if (likely(len <= PPC440SPE_ADMA_XOR_MAX_BYTE_COUNT))
+		return slot_cnt;
+
+	printk(KERN_ERR "%s: len %d > max %d !!\n",
+		__func__, len, PPC440SPE_ADMA_XOR_MAX_BYTE_COUNT);
+	BUG();
+	return slot_cnt;
+}
+
+/**
+ * ppc440spe_dma2_pq_slot_count - get the number of slots necessary for
+ * DMA2 PQ operation
+ */
+static int ppc440spe_dma2_pq_slot_count(dma_addr_t *srcs,
+		int src_cnt, size_t len)
+{
+	signed long long order = 0;
+	int state = 0;
+	int addr_count = 0;
+	int i;
+	for (i = 1; i < src_cnt; i++) {
+		dma_addr_t cur_addr = srcs[i];
+		dma_addr_t old_addr = srcs[i-1];
+		switch (state) {
+		case 0:
+			if (cur_addr == old_addr + len) {
+				/* direct RXOR */
+				order = 1;
+				state = 1;
+				if (i == src_cnt-1)
+					addr_count++;
+			} else if (old_addr == cur_addr + len) {
+				/* reverse RXOR */
+				order = -1;
+				state = 1;
+				if (i == src_cnt-1)
+					addr_count++;
+			} else {
+				state = 3;
+			}
+			break;
+		case 1:
+			if (i == src_cnt-2 || (order == -1
+				&& cur_addr != old_addr - len)) {
+				order = 0;
+				state = 0;
+				addr_count++;
+			} else if (cur_addr == old_addr + len*order) {
+				state = 2;
+				if (i == src_cnt-1)
+					addr_count++;
+			} else if (cur_addr == old_addr + 2*len) {
+				state = 2;
+				if (i == src_cnt-1)
+					addr_count++;
+			} else if (cur_addr == old_addr + 3*len) {
+				state = 2;
+				if (i == src_cnt-1)
+					addr_count++;
+			} else {
+				order = 0;
+				state = 0;
+				addr_count++;
+			}
+			break;
+		case 2:
+			order = 0;
+			state = 0;
+			addr_count++;
+				break;
+		}
+		if (state == 3)
+			break;
+	}
+	if (src_cnt <= 1 || (state != 1 && state != 2)) {
+		pr_err("%s: src_cnt=%d, state=%d, addr_count=%d, order=%lld\n",
+			__func__, src_cnt, state, addr_count, order);
+		for (i = 0; i < src_cnt; i++)
+			pr_err("\t[%d] 0x%llx \n", i, srcs[i]);
+		BUG();
+	}
+
+	return (addr_count + XOR_MAX_OPS - 1) / XOR_MAX_OPS;
+}
+
+
+/******************************************************************************
+ * ADMA channel low-level routines
+ ******************************************************************************/
+
+static u32
+ppc440spe_chan_get_current_descriptor(struct ppc440spe_adma_chan *chan);
+static void ppc440spe_chan_append(struct ppc440spe_adma_chan *chan);
+
+/**
+ * ppc440spe_adma_device_clear_eot_status - interrupt ack to XOR or DMA engine
+ */
+static void ppc440spe_adma_device_clear_eot_status(
+					struct ppc440spe_adma_chan *chan)
+{
+	struct dma_regs *dma_reg;
+	struct xor_regs *xor_reg;
+	u8 *p = chan->device->dma_desc_pool_virt;
+	struct dma_cdb *cdb;
+	u32 rv, i;
+
+	switch (chan->device->id) {
+	case PPC440SPE_DMA0_ID:
+	case PPC440SPE_DMA1_ID:
+		/* read FIFO to ack */
+		dma_reg = chan->device->dma_reg;
+		while ((rv = ioread32(&dma_reg->csfpl))) {
+			i = rv & DMA_CDB_ADDR_MSK;
+			cdb = (struct dma_cdb *)&p[i -
+			    (u32)chan->device->dma_desc_pool];
+
+			/* Clear opcode to ack. This is necessary for
+			 * ZeroSum operations only
+			 */
+			cdb->opc = 0;
+
+			if (test_bit(PPC440SPE_RXOR_RUN,
+			    &ppc440spe_rxor_state)) {
+				/* probably this is a completed RXOR op,
+				 * get pointer to CDB using the fact that
+				 * physical and virtual addresses of CDB
+				 * in pools have the same offsets
+				 */
+				if (le32_to_cpu(cdb->sg1u) &
+				    DMA_CUED_XOR_BASE) {
+					/* this is a RXOR */
+					clear_bit(PPC440SPE_RXOR_RUN,
+						  &ppc440spe_rxor_state);
+				}
+			}
+
+			if (rv & DMA_CDB_STATUS_MSK) {
+				/* ZeroSum check failed
+				 */
+				struct ppc440spe_adma_desc_slot *iter;
+				dma_addr_t phys = rv & ~DMA_CDB_MSK;
+
+				/*
+				 * Update the status of corresponding
+				 * descriptor.
+				 */
+				list_for_each_entry(iter, &chan->chain,
+				    chain_node) {
+					if (iter->phys == phys)
+						break;
+				}
+				/*
+				 * if cannot find the corresponding
+				 * slot it's a bug
+				 */
+				BUG_ON(&iter->chain_node == &chan->chain);
+
+				if (iter->xor_check_result) {
+					if (test_bit(PPC440SPE_DESC_PCHECK,
+						     &iter->flags)) {
+						*iter->xor_check_result |=
+							SUM_CHECK_P_RESULT;
+					} else
+					if (test_bit(PPC440SPE_DESC_QCHECK,
+						     &iter->flags)) {
+						*iter->xor_check_result |=
+							SUM_CHECK_Q_RESULT;
+					} else
+						BUG();
+				}
+			}
+		}
+
+		rv = ioread32(&dma_reg->dsts);
+		if (rv) {
+			pr_err("DMA%d err status: 0x%x\n",
+			       chan->device->id, rv);
+			/* write back to clear */
+			iowrite32(rv, &dma_reg->dsts);
+		}
+		break;
+	case PPC440SPE_XOR_ID:
+		/* reset status bits to ack */
+		xor_reg = chan->device->xor_reg;
+		rv = ioread32be(&xor_reg->sr);
+		iowrite32be(rv, &xor_reg->sr);
+
+		if (rv & (XOR_IE_ICBIE_BIT|XOR_IE_ICIE_BIT|XOR_IE_RPTIE_BIT)) {
+			if (rv & XOR_IE_RPTIE_BIT) {
+				/* Read PLB Timeout Error.
+				 * Try to resubmit the CB
+				 */
+				u32 val = ioread32be(&xor_reg->ccbalr);
+
+				iowrite32be(val, &xor_reg->cblalr);
+
+				val = ioread32be(&xor_reg->crsr);
+				iowrite32be(val | XOR_CRSR_XAE_BIT,
+					    &xor_reg->crsr);
+			} else
+				pr_err("XOR ERR 0x%x status\n", rv);
+			break;
+		}
+
+		/*  if the XORcore is idle, but there are unprocessed CBs
+		 * then refetch the s/w chain here
+		 */
+		if (!(ioread32be(&xor_reg->sr) & XOR_SR_XCP_BIT) &&
+		    do_xor_refetch)
+			ppc440spe_chan_append(chan);
+		break;
+	}
+}
+
+/**
+ * ppc440spe_chan_is_busy - get the channel status
+ */
+static int ppc440spe_chan_is_busy(struct ppc440spe_adma_chan *chan)
+{
+	struct dma_regs *dma_reg;
+	struct xor_regs *xor_reg;
+	int busy = 0;
+
+	switch (chan->device->id) {
+	case PPC440SPE_DMA0_ID:
+	case PPC440SPE_DMA1_ID:
+		dma_reg = chan->device->dma_reg;
+		/*  if command FIFO's head and tail pointers are equal and
+		 * status tail is the same as command, then channel is free
+		 */
+		if (ioread16(&dma_reg->cpfhp) != ioread16(&dma_reg->cpftp) ||
+		    ioread16(&dma_reg->cpftp) != ioread16(&dma_reg->csftp))
+			busy = 1;
+		break;
+	case PPC440SPE_XOR_ID:
+		/* use the special status bit for the XORcore
+		 */
+		xor_reg = chan->device->xor_reg;
+		busy = (ioread32be(&xor_reg->sr) & XOR_SR_XCP_BIT) ? 1 : 0;
+		break;
+	}
+
+	return busy;
+}
+
+/**
+ * ppc440spe_chan_set_first_xor_descriptor -  init XORcore chain
+ */
+static void ppc440spe_chan_set_first_xor_descriptor(
+				struct ppc440spe_adma_chan *chan,
+				struct ppc440spe_adma_desc_slot *next_desc)
+{
+	struct xor_regs *xor_reg = chan->device->xor_reg;
+
+	if (ioread32be(&xor_reg->sr) & XOR_SR_XCP_BIT)
+		printk(KERN_INFO "%s: Warn: XORcore is running "
+			"when try to set the first CDB!\n",
+			__func__);
+
+	xor_last_submit = xor_last_linked = next_desc;
+
+	iowrite32be(XOR_CRSR_64BA_BIT, &xor_reg->crsr);
+
+	iowrite32be(next_desc->phys, &xor_reg->cblalr);
+	iowrite32be(0, &xor_reg->cblahr);
+	iowrite32be(ioread32be(&xor_reg->cbcr) | XOR_CBCR_LNK_BIT,
+		    &xor_reg->cbcr);
+
+	chan->hw_chain_inited = 1;
+}
+
+/**
+ * ppc440spe_dma_put_desc - put DMA0,1 descriptor to FIFO.
+ * called with irqs disabled
+ */
+static void ppc440spe_dma_put_desc(struct ppc440spe_adma_chan *chan,
+		struct ppc440spe_adma_desc_slot *desc)
+{
+	u32 pcdb;
+	struct dma_regs *dma_reg = chan->device->dma_reg;
+
+	pcdb = desc->phys;
+	if (!test_bit(PPC440SPE_DESC_INT, &desc->flags))
+		pcdb |= DMA_CDB_NO_INT;
+
+	chan_last_sub[chan->device->id] = desc;
+
+	ADMA_LL_DBG(print_cb(chan, desc->hw_desc));
+
+	iowrite32(pcdb, &dma_reg->cpfpl);
+}
+
+/**
+ * ppc440spe_chan_append - update the h/w chain in the channel
+ */
+static void ppc440spe_chan_append(struct ppc440spe_adma_chan *chan)
+{
+	struct xor_regs *xor_reg;
+	struct ppc440spe_adma_desc_slot *iter;
+	struct xor_cb *xcb;
+	u32 cur_desc;
+	unsigned long flags;
+
+	local_irq_save(flags);
+
+	switch (chan->device->id) {
+	case PPC440SPE_DMA0_ID:
+	case PPC440SPE_DMA1_ID:
+		cur_desc = ppc440spe_chan_get_current_descriptor(chan);
+
+		if (likely(cur_desc)) {
+			iter = chan_last_sub[chan->device->id];
+			BUG_ON(!iter);
+		} else {
+			/* first peer */
+			iter = chan_first_cdb[chan->device->id];
+			BUG_ON(!iter);
+			ppc440spe_dma_put_desc(chan, iter);
+			chan->hw_chain_inited = 1;
+		}
+
+		/* is there something new to append */
+		if (!iter->hw_next)
+			break;
+
+		/* flush descriptors from the s/w queue to fifo */
+		list_for_each_entry_continue(iter, &chan->chain, chain_node) {
+			ppc440spe_dma_put_desc(chan, iter);
+			if (!iter->hw_next)
+				break;
+		}
+		break;
+	case PPC440SPE_XOR_ID:
+		/* update h/w links and refetch */
+		if (!xor_last_submit->hw_next)
+			break;
+
+		xor_reg = chan->device->xor_reg;
+		/* the last linked CDB has to generate an interrupt
+		 * that we'd be able to append the next lists to h/w
+		 * regardless of the XOR engine state at the moment of
+		 * appending of these next lists
+		 */
+		xcb = xor_last_linked->hw_desc;
+		xcb->cbc |= XOR_CBCR_CBCE_BIT;
+
+		if (!(ioread32be(&xor_reg->sr) & XOR_SR_XCP_BIT)) {
+			/* XORcore is idle. Refetch now */
+			do_xor_refetch = 0;
+			ppc440spe_xor_set_link(xor_last_submit,
+				xor_last_submit->hw_next);
+
+			ADMA_LL_DBG(print_cb_list(chan,
+				xor_last_submit->hw_next));
+
+			xor_last_submit = xor_last_linked;
+			iowrite32be(ioread32be(&xor_reg->crsr) |
+				    XOR_CRSR_RCBE_BIT | XOR_CRSR_64BA_BIT,
+				    &xor_reg->crsr);
+		} else {
+			/* XORcore is running. Refetch later in the handler */
+			do_xor_refetch = 1;
+		}
+
+		break;
+	}
+
+	local_irq_restore(flags);
+}
+
+/**
+ * ppc440spe_chan_get_current_descriptor - get the currently executed descriptor
+ */
+static u32
+ppc440spe_chan_get_current_descriptor(struct ppc440spe_adma_chan *chan)
+{
+	struct dma_regs *dma_reg;
+	struct xor_regs *xor_reg;
+
+	if (unlikely(!chan->hw_chain_inited))
+		/* h/w descriptor chain is not initialized yet */
+		return 0;
+
+	switch (chan->device->id) {
+	case PPC440SPE_DMA0_ID:
+	case PPC440SPE_DMA1_ID:
+		dma_reg = chan->device->dma_reg;
+		return ioread32(&dma_reg->acpl) & (~DMA_CDB_MSK);
+	case PPC440SPE_XOR_ID:
+		xor_reg = chan->device->xor_reg;
+		return ioread32be(&xor_reg->ccbalr);
+	}
+	return 0;
+}
+
+/**
+ * ppc440spe_chan_run - enable the channel
+ */
+static void ppc440spe_chan_run(struct ppc440spe_adma_chan *chan)
+{
+	struct xor_regs *xor_reg;
+
+	switch (chan->device->id) {
+	case PPC440SPE_DMA0_ID:
+	case PPC440SPE_DMA1_ID:
+		/* DMAs are always enabled, do nothing */
+		break;
+	case PPC440SPE_XOR_ID:
+		/* drain write buffer */
+		xor_reg = chan->device->xor_reg;
+
+		/* fetch descriptor pointed to in <link> */
+		iowrite32be(XOR_CRSR_64BA_BIT | XOR_CRSR_XAE_BIT,
+			    &xor_reg->crsr);
+		break;
+	}
+}
+
+/******************************************************************************
+ * ADMA device level
+ ******************************************************************************/
+
+static void ppc440spe_chan_start_null_xor(struct ppc440spe_adma_chan *chan);
+static int ppc440spe_adma_alloc_chan_resources(struct dma_chan *chan);
+
+static dma_cookie_t
+ppc440spe_adma_tx_submit(struct dma_async_tx_descriptor *tx);
+
+static void ppc440spe_adma_set_dest(struct ppc440spe_adma_desc_slot *tx,
+				    dma_addr_t addr, int index);
+static void
+ppc440spe_adma_memcpy_xor_set_src(struct ppc440spe_adma_desc_slot *tx,
+				  dma_addr_t addr, int index);
+
+static void
+ppc440spe_adma_pq_set_dest(struct ppc440spe_adma_desc_slot *tx,
+			   dma_addr_t *paddr, unsigned long flags);
+static void
+ppc440spe_adma_pq_set_src(struct ppc440spe_adma_desc_slot *tx,
+			  dma_addr_t addr, int index);
+static void
+ppc440spe_adma_pq_set_src_mult(struct ppc440spe_adma_desc_slot *tx,
+			       unsigned char mult, int index, int dst_pos);
+static void
+ppc440spe_adma_pqzero_sum_set_dest(struct ppc440spe_adma_desc_slot *tx,
+				   dma_addr_t paddr, dma_addr_t qaddr);
+
+static struct page *ppc440spe_rxor_srcs[32];
+
+/**
+ * ppc440spe_can_rxor - check if the operands may be processed with RXOR
+ */
+static int ppc440spe_can_rxor(struct page **srcs, int src_cnt, size_t len)
+{
+	int i, order = 0, state = 0;
+	int idx = 0;
+
+	if (unlikely(!(src_cnt > 1)))
+		return 0;
+
+	BUG_ON(src_cnt > ARRAY_SIZE(ppc440spe_rxor_srcs));
+
+	/* Skip holes in the source list before checking */
+	for (i = 0; i < src_cnt; i++) {
+		if (!srcs[i])
+			continue;
+		ppc440spe_rxor_srcs[idx++] = srcs[i];
+	}
+	src_cnt = idx;
+
+	for (i = 1; i < src_cnt; i++) {
+		char *cur_addr = page_address(ppc440spe_rxor_srcs[i]);
+		char *old_addr = page_address(ppc440spe_rxor_srcs[i - 1]);
+
+		switch (state) {
+		case 0:
+			if (cur_addr == old_addr + len) {
+				/* direct RXOR */
+				order = 1;
+				state = 1;
+			} else if (old_addr == cur_addr + len) {
+				/* reverse RXOR */
+				order = -1;
+				state = 1;
+			} else
+				goto out;
+			break;
+		case 1:
+			if ((i == src_cnt - 2) ||
+			    (order == -1 && cur_addr != old_addr - len)) {
+				order = 0;
+				state = 0;
+			} else if ((cur_addr == old_addr + len * order) ||
+				   (cur_addr == old_addr + 2 * len) ||
+				   (cur_addr == old_addr + 3 * len)) {
+				state = 2;
+			} else {
+				order = 0;
+				state = 0;
+			}
+			break;
+		case 2:
+			order = 0;
+			state = 0;
+			break;
+		}
+	}
+
+out:
+	if (state == 1 || state == 2)
+		return 1;
+
+	return 0;
+}
+
+/**
+ * ppc440spe_adma_device_estimate - estimate the efficiency of processing
+ *	the operation given on this channel. It's assumed that 'chan' is
+ *	capable to process 'cap' type of operation.
+ * @chan: channel to use
+ * @cap: type of transaction
+ * @dst_lst: array of destination pointers
+ * @dst_cnt: number of destination operands
+ * @src_lst: array of source pointers
+ * @src_cnt: number of source operands
+ * @src_sz: size of each source operand
+ */
+static int ppc440spe_adma_estimate(struct dma_chan *chan,
+	enum dma_transaction_type cap, struct page **dst_lst, int dst_cnt,
+	struct page **src_lst, int src_cnt, size_t src_sz)
+{
+	int ef = 1;
+
+	if (cap == DMA_PQ || cap == DMA_PQ_VAL) {
+		/* If RAID-6 capabilities were not activated don't try
+		 * to use them
+		 */
+		if (unlikely(!ppc440spe_r6_enabled))
+			return -1;
+	}
+	/*  In the current implementation of ppc440spe ADMA driver it
+	 * makes sense to pick out only pq case, because it may be
+	 * processed:
+	 * (1) either using Biskup method on DMA2;
+	 * (2) or on DMA0/1.
+	 *  Thus we give a favour to (1) if the sources are suitable;
+	 * else let it be processed on one of the DMA0/1 engines.
+	 *  In the sum_product case where destination is also the
+	 * source process it on DMA0/1 only.
+	 */
+	if (cap == DMA_PQ && chan->chan_id == PPC440SPE_XOR_ID) {
+
+		if (dst_cnt == 1 && src_cnt == 2 && dst_lst[0] == src_lst[1])
+			ef = 0; /* sum_product case, process on DMA0/1 */
+		else if (ppc440spe_can_rxor(src_lst, src_cnt, src_sz))
+			ef = 3; /* override (DMA0/1 + idle) */
+		else
+			ef = 0; /* can't process on DMA2 if !rxor */
+	}
+
+	/* channel idleness increases the priority */
+	if (likely(ef) &&
+	    !ppc440spe_chan_is_busy(to_ppc440spe_adma_chan(chan)))
+		ef++;
+
+	return ef;
+}
+
+struct dma_chan *
+ppc440spe_async_tx_find_best_channel(enum dma_transaction_type cap,
+	struct page **dst_lst, int dst_cnt, struct page **src_lst,
+	int src_cnt, size_t src_sz)
+{
+	struct dma_chan *best_chan = NULL;
+	struct ppc_dma_chan_ref *ref;
+	int best_rank = -1;
+
+	if (unlikely(!src_sz))
+		return NULL;
+	if (src_sz > PAGE_SIZE) {
+		/*
+		 * should a user of the api ever pass > PAGE_SIZE requests
+		 * we sort out cases where temporary page-sized buffers
+		 * are used.
+		 */
+		switch (cap) {
+		case DMA_PQ:
+			if (src_cnt == 1 && dst_lst[1] == src_lst[0])
+				return NULL;
+			if (src_cnt == 2 && dst_lst[1] == src_lst[1])
+				return NULL;
+			break;
+		case DMA_PQ_VAL:
+		case DMA_XOR_VAL:
+			return NULL;
+		default:
+			break;
+		}
+	}
+
+	list_for_each_entry(ref, &ppc440spe_adma_chan_list, node) {
+		if (dma_has_cap(cap, ref->chan->device->cap_mask)) {
+			int rank;
+
+			rank = ppc440spe_adma_estimate(ref->chan, cap, dst_lst,
+					dst_cnt, src_lst, src_cnt, src_sz);
+			if (rank > best_rank) {
+				best_rank = rank;
+				best_chan = ref->chan;
+			}
+		}
+	}
+
+	return best_chan;
+}
+EXPORT_SYMBOL_GPL(ppc440spe_async_tx_find_best_channel);
+
+/**
+ * ppc440spe_get_group_entry - get group entry with index idx
+ * @tdesc: is the last allocated slot in the group.
+ */
+static struct ppc440spe_adma_desc_slot *
+ppc440spe_get_group_entry(struct ppc440spe_adma_desc_slot *tdesc, u32 entry_idx)
+{
+	struct ppc440spe_adma_desc_slot *iter = tdesc->group_head;
+	int i = 0;
+
+	if (entry_idx < 0 || entry_idx >= (tdesc->src_cnt + tdesc->dst_cnt)) {
+		printk("%s: entry_idx %d, src_cnt %d, dst_cnt %d\n",
+			__func__, entry_idx, tdesc->src_cnt, tdesc->dst_cnt);
+		BUG();
+	}
+
+	list_for_each_entry(iter, &tdesc->group_list, chain_node) {
+		if (i++ == entry_idx)
+			break;
+	}
+	return iter;
+}
+
+/**
+ * ppc440spe_adma_free_slots - flags descriptor slots for reuse
+ * @slot: Slot to free
+ * Caller must hold &ppc440spe_chan->lock while calling this function
+ */
+static void ppc440spe_adma_free_slots(struct ppc440spe_adma_desc_slot *slot,
+				      struct ppc440spe_adma_chan *chan)
+{
+	int stride = slot->slots_per_op;
+
+	while (stride--) {
+		slot->slots_per_op = 0;
+		slot = list_entry(slot->slot_node.next,
+				struct ppc440spe_adma_desc_slot,
+				slot_node);
+	}
+}
+
+static void ppc440spe_adma_unmap(struct ppc440spe_adma_chan *chan,
+				 struct ppc440spe_adma_desc_slot *desc)
+{
+	u32 src_cnt, dst_cnt;
+	dma_addr_t addr;
+
+	/*
+	 * get the number of sources & destination
+	 * included in this descriptor and unmap
+	 * them all
+	 */
+	src_cnt = ppc440spe_desc_get_src_num(desc, chan);
+	dst_cnt = ppc440spe_desc_get_dst_num(desc, chan);
+
+	/* unmap destinations */
+	if (!(desc->async_tx.flags & DMA_COMPL_SKIP_DEST_UNMAP)) {
+		while (dst_cnt--) {
+			addr = ppc440spe_desc_get_dest_addr(
+				desc, chan, dst_cnt);
+			dma_unmap_page(chan->device->dev,
+					addr, desc->unmap_len,
+					DMA_FROM_DEVICE);
+		}
+	}
+
+	/* unmap sources */
+	if (!(desc->async_tx.flags & DMA_COMPL_SKIP_SRC_UNMAP)) {
+		while (src_cnt--) {
+			addr = ppc440spe_desc_get_src_addr(
+				desc, chan, src_cnt);
+			dma_unmap_page(chan->device->dev,
+					addr, desc->unmap_len,
+					DMA_TO_DEVICE);
+		}
+	}
+}
+
+/**
+ * ppc440spe_adma_run_tx_complete_actions - call functions to be called
+ * upon completion
+ */
+static dma_cookie_t ppc440spe_adma_run_tx_complete_actions(
+		struct ppc440spe_adma_desc_slot *desc,
+		struct ppc440spe_adma_chan *chan,
+		dma_cookie_t cookie)
+{
+	int i;
+
+	BUG_ON(desc->async_tx.cookie < 0);
+	if (desc->async_tx.cookie > 0) {
+		cookie = desc->async_tx.cookie;
+		desc->async_tx.cookie = 0;
+
+		/* call the callback (must not sleep or submit new
+		 * operations to this channel)
+		 */
+		if (desc->async_tx.callback)
+			desc->async_tx.callback(
+				desc->async_tx.callback_param);
+
+		/* unmap dma addresses
+		 * (unmap_single vs unmap_page?)
+		 *
+		 * actually, ppc's dma_unmap_page() functions are empty, so
+		 * the following code is just for the sake of completeness
+		 */
+		if (chan && chan->needs_unmap && desc->group_head &&
+		     desc->unmap_len) {
+			struct ppc440spe_adma_desc_slot *unmap =
+							desc->group_head;
+			/* assume 1 slot per op always */
+			u32 slot_count = unmap->slot_cnt;
+
+			/* Run through the group list and unmap addresses */
+			for (i = 0; i < slot_count; i++) {
+				BUG_ON(!unmap);
+				ppc440spe_adma_unmap(chan, unmap);
+				unmap = unmap->hw_next;
+			}
+		}
+	}
+
+	/* run dependent operations */
+	dma_run_dependencies(&desc->async_tx);
+
+	return cookie;
+}
+
+/**
+ * ppc440spe_adma_clean_slot - clean up CDB slot (if ack is set)
+ */
+static int ppc440spe_adma_clean_slot(struct ppc440spe_adma_desc_slot *desc,
+		struct ppc440spe_adma_chan *chan)
+{
+	/* the client is allowed to attach dependent operations
+	 * until 'ack' is set
+	 */
+	if (!async_tx_test_ack(&desc->async_tx))
+		return 0;
+
+	/* leave the last descriptor in the chain
+	 * so we can append to it
+	 */
+	if (list_is_last(&desc->chain_node, &chan->chain) ||
+	    desc->phys == ppc440spe_chan_get_current_descriptor(chan))
+		return 1;
+
+	if (chan->device->id != PPC440SPE_XOR_ID) {
+		/* our DMA interrupt handler clears opc field of
+		 * each processed descriptor. For all types of
+		 * operations except for ZeroSum we do not actually
+		 * need ack from the interrupt handler. ZeroSum is a
+		 * special case since the result of this operation
+		 * is available from the handler only, so if we see
+		 * such type of descriptor (which is unprocessed yet)
+		 * then leave it in chain.
+		 */
+		struct dma_cdb *cdb = desc->hw_desc;
+		if (cdb->opc == DMA_CDB_OPC_DCHECK128)
+			return 1;
+	}
+
+	dev_dbg(chan->device->common.dev, "\tfree slot %llx: %d stride: %d\n",
+		desc->phys, desc->idx, desc->slots_per_op);
+
+	list_del(&desc->chain_node);
+	ppc440spe_adma_free_slots(desc, chan);
+	return 0;
+}
+
+/**
+ * __ppc440spe_adma_slot_cleanup - this is the common clean-up routine
+ *	which runs through the channel CDBs list until reach the descriptor
+ *	currently processed. When routine determines that all CDBs of group
+ *	are completed then corresponding callbacks (if any) are called and slots
+ *	are freed.
+ */
+static void __ppc440spe_adma_slot_cleanup(struct ppc440spe_adma_chan *chan)
+{
+	struct ppc440spe_adma_desc_slot *iter, *_iter, *group_start = NULL;
+	dma_cookie_t cookie = 0;
+	u32 current_desc = ppc440spe_chan_get_current_descriptor(chan);
+	int busy = ppc440spe_chan_is_busy(chan);
+	int seen_current = 0, slot_cnt = 0, slots_per_op = 0;
+
+	dev_dbg(chan->device->common.dev, "ppc440spe adma%d: %s\n",
+		chan->device->id, __func__);
+
+	if (!current_desc) {
+		/*  There were no transactions yet, so
+		 * nothing to clean
+		 */
+		return;
+	}
+
+	/* free completed slots from the chain starting with
+	 * the oldest descriptor
+	 */
+	list_for_each_entry_safe(iter, _iter, &chan->chain,
+					chain_node) {
+		dev_dbg(chan->device->common.dev, "\tcookie: %d slot: %d "
+		    "busy: %d this_desc: %#llx next_desc: %#x "
+		    "cur: %#x ack: %d\n",
+		    iter->async_tx.cookie, iter->idx, busy, iter->phys,
+		    ppc440spe_desc_get_link(iter, chan), current_desc,
+		    async_tx_test_ack(&iter->async_tx));
+		prefetch(_iter);
+		prefetch(&_iter->async_tx);
+
+		/* do not advance past the current descriptor loaded into the
+		 * hardware channel,subsequent descriptors are either in process
+		 * or have not been submitted
+		 */
+		if (seen_current)
+			break;
+
+		/* stop the search if we reach the current descriptor and the
+		 * channel is busy, or if it appears that the current descriptor
+		 * needs to be re-read (i.e. has been appended to)
+		 */
+		if (iter->phys == current_desc) {
+			BUG_ON(seen_current++);
+			if (busy || ppc440spe_desc_get_link(iter, chan)) {
+				/* not all descriptors of the group have
+				 * been completed; exit.
+				 */
+				break;
+			}
+		}
+
+		/* detect the start of a group transaction */
+		if (!slot_cnt && !slots_per_op) {
+			slot_cnt = iter->slot_cnt;
+			slots_per_op = iter->slots_per_op;
+			if (slot_cnt <= slots_per_op) {
+				slot_cnt = 0;
+				slots_per_op = 0;
+			}
+		}
+
+		if (slot_cnt) {
+			if (!group_start)
+				group_start = iter;
+			slot_cnt -= slots_per_op;
+		}
+
+		/* all the members of a group are complete */
+		if (slots_per_op != 0 && slot_cnt == 0) {
+			struct ppc440spe_adma_desc_slot *grp_iter, *_grp_iter;
+			int end_of_chain = 0;
+
+			/* clean up the group */
+			slot_cnt = group_start->slot_cnt;
+			grp_iter = group_start;
+			list_for_each_entry_safe_from(grp_iter, _grp_iter,
+				&chan->chain, chain_node) {
+
+				cookie = ppc440spe_adma_run_tx_complete_actions(
+					grp_iter, chan, cookie);
+
+				slot_cnt -= slots_per_op;
+				end_of_chain = ppc440spe_adma_clean_slot(
+				    grp_iter, chan);
+				if (end_of_chain && slot_cnt) {
+					/* Should wait for ZeroSum completion */
+					if (cookie > 0)
+						chan->completed_cookie = cookie;
+					return;
+				}
+
+				if (slot_cnt == 0 || end_of_chain)
+					break;
+			}
+
+			/* the group should be complete at this point */
+			BUG_ON(slot_cnt);
+
+			slots_per_op = 0;
+			group_start = NULL;
+			if (end_of_chain)
+				break;
+			else
+				continue;
+		} else if (slots_per_op) /* wait for group completion */
+			continue;
+
+		cookie = ppc440spe_adma_run_tx_complete_actions(iter, chan,
+		    cookie);
+
+		if (ppc440spe_adma_clean_slot(iter, chan))
+			break;
+	}
+
+	BUG_ON(!seen_current);
+
+	if (cookie > 0) {
+		chan->completed_cookie = cookie;
+		pr_debug("\tcompleted cookie %d\n", cookie);
+	}
+
+}
+
+/**
+ * ppc440spe_adma_tasklet - clean up watch-dog initiator
+ */
+static void ppc440spe_adma_tasklet(unsigned long data)
+{
+	struct ppc440spe_adma_chan *chan = (struct ppc440spe_adma_chan *) data;
+
+	spin_lock_nested(&chan->lock, SINGLE_DEPTH_NESTING);
+	__ppc440spe_adma_slot_cleanup(chan);
+	spin_unlock(&chan->lock);
+}
+
+/**
+ * ppc440spe_adma_slot_cleanup - clean up scheduled initiator
+ */
+static void ppc440spe_adma_slot_cleanup(struct ppc440spe_adma_chan *chan)
+{
+	spin_lock_bh(&chan->lock);
+	__ppc440spe_adma_slot_cleanup(chan);
+	spin_unlock_bh(&chan->lock);
+}
+
+/**
+ * ppc440spe_adma_alloc_slots - allocate free slots (if any)
+ */
+static struct ppc440spe_adma_desc_slot *ppc440spe_adma_alloc_slots(
+		struct ppc440spe_adma_chan *chan, int num_slots,
+		int slots_per_op)
+{
+	struct ppc440spe_adma_desc_slot *iter = NULL, *_iter;
+	struct ppc440spe_adma_desc_slot *alloc_start = NULL;
+	struct list_head chain = LIST_HEAD_INIT(chain);
+	int slots_found, retry = 0;
+
+
+	BUG_ON(!num_slots || !slots_per_op);
+	/* start search from the last allocated descrtiptor
+	 * if a contiguous allocation can not be found start searching
+	 * from the beginning of the list
+	 */
+retry:
+	slots_found = 0;
+	if (retry == 0)
+		iter = chan->last_used;
+	else
+		iter = list_entry(&chan->all_slots,
+				  struct ppc440spe_adma_desc_slot,
+				  slot_node);
+	list_for_each_entry_safe_continue(iter, _iter, &chan->all_slots,
+	    slot_node) {
+		prefetch(_iter);
+		prefetch(&_iter->async_tx);
+		if (iter->slots_per_op) {
+			slots_found = 0;
+			continue;
+		}
+
+		/* start the allocation if the slot is correctly aligned */
+		if (!slots_found++)
+			alloc_start = iter;
+
+		if (slots_found == num_slots) {
+			struct ppc440spe_adma_desc_slot *alloc_tail = NULL;
+			struct ppc440spe_adma_desc_slot *last_used = NULL;
+
+			iter = alloc_start;
+			while (num_slots) {
+				int i;
+				/* pre-ack all but the last descriptor */
+				if (num_slots != slots_per_op)
+					async_tx_ack(&iter->async_tx);
+
+				list_add_tail(&iter->chain_node, &chain);
+				alloc_tail = iter;
+				iter->async_tx.cookie = 0;
+				iter->hw_next = NULL;
+				iter->flags = 0;
+				iter->slot_cnt = num_slots;
+				iter->xor_check_result = NULL;
+				for (i = 0; i < slots_per_op; i++) {
+					iter->slots_per_op = slots_per_op - i;
+					last_used = iter;
+					iter = list_entry(iter->slot_node.next,
+						struct ppc440spe_adma_desc_slot,
+						slot_node);
+				}
+				num_slots -= slots_per_op;
+			}
+			alloc_tail->group_head = alloc_start;
+			alloc_tail->async_tx.cookie = -EBUSY;
+			list_splice(&chain, &alloc_tail->group_list);
+			chan->last_used = last_used;
+			return alloc_tail;
+		}
+	}
+	if (!retry++)
+		goto retry;
+
+	/* try to free some slots if the allocation fails */
+	tasklet_schedule(&chan->irq_tasklet);
+	return NULL;
+}
+
+/**
+ * ppc440spe_adma_alloc_chan_resources -  allocate pools for CDB slots
+ */
+static int ppc440spe_adma_alloc_chan_resources(struct dma_chan *chan)
+{
+	struct ppc440spe_adma_chan *ppc440spe_chan;
+	struct ppc440spe_adma_desc_slot *slot = NULL;
+	char *hw_desc;
+	int i, db_sz;
+	int init;
+
+	ppc440spe_chan = to_ppc440spe_adma_chan(chan);
+	init = ppc440spe_chan->slots_allocated ? 0 : 1;
+	chan->chan_id = ppc440spe_chan->device->id;
+
+	/* Allocate descriptor slots */
+	i = ppc440spe_chan->slots_allocated;
+	if (ppc440spe_chan->device->id != PPC440SPE_XOR_ID)
+		db_sz = sizeof(struct dma_cdb);
+	else
+		db_sz = sizeof(struct xor_cb);
+
+	for (; i < (ppc440spe_chan->device->pool_size / db_sz); i++) {
+		slot = kzalloc(sizeof(struct ppc440spe_adma_desc_slot),
+			       GFP_KERNEL);
+		if (!slot) {
+			printk(KERN_INFO "SPE ADMA Channel only initialized"
+				" %d descriptor slots", i--);
+			break;
+		}
+
+		hw_desc = (char *) ppc440spe_chan->device->dma_desc_pool_virt;
+		slot->hw_desc = (void *) &hw_desc[i * db_sz];
+		dma_async_tx_descriptor_init(&slot->async_tx, chan);
+		slot->async_tx.tx_submit = ppc440spe_adma_tx_submit;
+		INIT_LIST_HEAD(&slot->chain_node);
+		INIT_LIST_HEAD(&slot->slot_node);
+		INIT_LIST_HEAD(&slot->group_list);
+		slot->phys = ppc440spe_chan->device->dma_desc_pool + i * db_sz;
+		slot->idx = i;
+
+		spin_lock_bh(&ppc440spe_chan->lock);
+		ppc440spe_chan->slots_allocated++;
+		list_add_tail(&slot->slot_node, &ppc440spe_chan->all_slots);
+		spin_unlock_bh(&ppc440spe_chan->lock);
+	}
+
+	if (i && !ppc440spe_chan->last_used) {
+		ppc440spe_chan->last_used =
+			list_entry(ppc440spe_chan->all_slots.next,
+				struct ppc440spe_adma_desc_slot,
+				slot_node);
+	}
+
+	dev_dbg(ppc440spe_chan->device->common.dev,
+		"ppc440spe adma%d: allocated %d descriptor slots\n",
+		ppc440spe_chan->device->id, i);
+
+	/* initialize the channel and the chain with a null operation */
+	if (init) {
+		switch (ppc440spe_chan->device->id) {
+		case PPC440SPE_DMA0_ID:
+		case PPC440SPE_DMA1_ID:
+			ppc440spe_chan->hw_chain_inited = 0;
+			/* Use WXOR for self-testing */
+			if (!ppc440spe_r6_tchan)
+				ppc440spe_r6_tchan = ppc440spe_chan;
+			break;
+		case PPC440SPE_XOR_ID:
+			ppc440spe_chan_start_null_xor(ppc440spe_chan);
+			break;
+		default:
+			BUG();
+		}
+		ppc440spe_chan->needs_unmap = 1;
+	}
+
+	return (i > 0) ? i : -ENOMEM;
+}
+
+/**
+ * ppc440spe_desc_assign_cookie - assign a cookie
+ */
+static dma_cookie_t ppc440spe_desc_assign_cookie(
+		struct ppc440spe_adma_chan *chan,
+		struct ppc440spe_adma_desc_slot *desc)
+{
+	dma_cookie_t cookie = chan->common.cookie;
+
+	cookie++;
+	if (cookie < 0)
+		cookie = 1;
+	chan->common.cookie = desc->async_tx.cookie = cookie;
+	return cookie;
+}
+
+/**
+ * ppc440spe_rxor_set_region_data -
+ */
+static void ppc440spe_rxor_set_region(struct ppc440spe_adma_desc_slot *desc,
+	u8 xor_arg_no, u32 mask)
+{
+	struct xor_cb *xcb = desc->hw_desc;
+
+	xcb->ops[xor_arg_no].h |= mask;
+}
+
+/**
+ * ppc440spe_rxor_set_src -
+ */
+static void ppc440spe_rxor_set_src(struct ppc440spe_adma_desc_slot *desc,
+	u8 xor_arg_no, dma_addr_t addr)
+{
+	struct xor_cb *xcb = desc->hw_desc;
+
+	xcb->ops[xor_arg_no].h |= DMA_CUED_XOR_BASE;
+	xcb->ops[xor_arg_no].l = addr;
+}
+
+/**
+ * ppc440spe_rxor_set_mult -
+ */
+static void ppc440spe_rxor_set_mult(struct ppc440spe_adma_desc_slot *desc,
+	u8 xor_arg_no, u8 idx, u8 mult)
+{
+	struct xor_cb *xcb = desc->hw_desc;
+
+	xcb->ops[xor_arg_no].h |= mult << (DMA_CUED_MULT1_OFF + idx * 8);
+}
+
+/**
+ * ppc440spe_adma_check_threshold - append CDBs to h/w chain if threshold
+ *	has been achieved
+ */
+static void ppc440spe_adma_check_threshold(struct ppc440spe_adma_chan *chan)
+{
+	dev_dbg(chan->device->common.dev, "ppc440spe adma%d: pending: %d\n",
+		chan->device->id, chan->pending);
+
+	if (chan->pending >= PPC440SPE_ADMA_THRESHOLD) {
+		chan->pending = 0;
+		ppc440spe_chan_append(chan);
+	}
+}
+
+/**
+ * ppc440spe_adma_tx_submit - submit new descriptor group to the channel
+ *	(it's not necessary that descriptors will be submitted to the h/w
+ *	chains too right now)
+ */
+static dma_cookie_t ppc440spe_adma_tx_submit(struct dma_async_tx_descriptor *tx)
+{
+	struct ppc440spe_adma_desc_slot *sw_desc;
+	struct ppc440spe_adma_chan *chan = to_ppc440spe_adma_chan(tx->chan);
+	struct ppc440spe_adma_desc_slot *group_start, *old_chain_tail;
+	int slot_cnt;
+	int slots_per_op;
+	dma_cookie_t cookie;
+
+	sw_desc = tx_to_ppc440spe_adma_slot(tx);
+
+	group_start = sw_desc->group_head;
+	slot_cnt = group_start->slot_cnt;
+	slots_per_op = group_start->slots_per_op;
+
+	spin_lock_bh(&chan->lock);
+
+	cookie = ppc440spe_desc_assign_cookie(chan, sw_desc);
+
+	if (unlikely(list_empty(&chan->chain))) {
+		/* first peer */
+		list_splice_init(&sw_desc->group_list, &chan->chain);
+		chan_first_cdb[chan->device->id] = group_start;
+	} else {
+		/* isn't first peer, bind CDBs to chain */
+		old_chain_tail = list_entry(chan->chain.prev,
+					struct ppc440spe_adma_desc_slot,
+					chain_node);
+		list_splice_init(&sw_desc->group_list,
+		    &old_chain_tail->chain_node);
+		/* fix up the hardware chain */
+		ppc440spe_desc_set_link(chan, old_chain_tail, group_start);
+	}
+
+	/* increment the pending count by the number of operations */
+	chan->pending += slot_cnt / slots_per_op;
+	ppc440spe_adma_check_threshold(chan);
+	spin_unlock_bh(&chan->lock);
+
+	dev_dbg(chan->device->common.dev,
+		"ppc440spe adma%d: %s cookie: %d slot: %d tx %p\n",
+		chan->device->id, __func__,
+		sw_desc->async_tx.cookie, sw_desc->idx, sw_desc);
+
+	return cookie;
+}
+
+/**
+ * ppc440spe_adma_prep_dma_interrupt - prepare CDB for a pseudo DMA operation
+ */
+static struct dma_async_tx_descriptor *ppc440spe_adma_prep_dma_interrupt(
+		struct dma_chan *chan, unsigned long flags)
+{
+	struct ppc440spe_adma_chan *ppc440spe_chan;
+	struct ppc440spe_adma_desc_slot *sw_desc, *group_start;
+	int slot_cnt, slots_per_op;
+
+	ppc440spe_chan = to_ppc440spe_adma_chan(chan);
+
+	dev_dbg(ppc440spe_chan->device->common.dev,
+		"ppc440spe adma%d: %s\n", ppc440spe_chan->device->id,
+		__func__);
+
+	spin_lock_bh(&ppc440spe_chan->lock);
+	slot_cnt = slots_per_op = 1;
+	sw_desc = ppc440spe_adma_alloc_slots(ppc440spe_chan, slot_cnt,
+			slots_per_op);
+	if (sw_desc) {
+		group_start = sw_desc->group_head;
+		ppc440spe_desc_init_interrupt(group_start, ppc440spe_chan);
+		group_start->unmap_len = 0;
+		sw_desc->async_tx.flags = flags;
+	}
+	spin_unlock_bh(&ppc440spe_chan->lock);
+
+	return sw_desc ? &sw_desc->async_tx : NULL;
+}
+
+/**
+ * ppc440spe_adma_prep_dma_memcpy - prepare CDB for a MEMCPY operation
+ */
+static struct dma_async_tx_descriptor *ppc440spe_adma_prep_dma_memcpy(
+		struct dma_chan *chan, dma_addr_t dma_dest,
+		dma_addr_t dma_src, size_t len, unsigned long flags)
+{
+	struct ppc440spe_adma_chan *ppc440spe_chan;
+	struct ppc440spe_adma_desc_slot *sw_desc, *group_start;
+	int slot_cnt, slots_per_op;
+
+	ppc440spe_chan = to_ppc440spe_adma_chan(chan);
+
+	if (unlikely(!len))
+		return NULL;
+
+	BUG_ON(unlikely(len > PPC440SPE_ADMA_DMA_MAX_BYTE_COUNT));
+
+	spin_lock_bh(&ppc440spe_chan->lock);
+
+	dev_dbg(ppc440spe_chan->device->common.dev,
+		"ppc440spe adma%d: %s len: %u int_en %d\n",
+		ppc440spe_chan->device->id, __func__, len,
+		flags & DMA_PREP_INTERRUPT ? 1 : 0);
+	slot_cnt = slots_per_op = 1;
+	sw_desc = ppc440spe_adma_alloc_slots(ppc440spe_chan, slot_cnt,
+		slots_per_op);
+	if (sw_desc) {
+		group_start = sw_desc->group_head;
+		ppc440spe_desc_init_memcpy(group_start, flags);
+		ppc440spe_adma_set_dest(group_start, dma_dest, 0);
+		ppc440spe_adma_memcpy_xor_set_src(group_start, dma_src, 0);
+		ppc440spe_desc_set_byte_count(group_start, ppc440spe_chan, len);
+		sw_desc->unmap_len = len;
+		sw_desc->async_tx.flags = flags;
+	}
+	spin_unlock_bh(&ppc440spe_chan->lock);
+
+	return sw_desc ? &sw_desc->async_tx : NULL;
+}
+
+/**
+ * ppc440spe_adma_prep_dma_memset - prepare CDB for a MEMSET operation
+ */
+static struct dma_async_tx_descriptor *ppc440spe_adma_prep_dma_memset(
+		struct dma_chan *chan, dma_addr_t dma_dest, int value,
+		size_t len, unsigned long flags)
+{
+	struct ppc440spe_adma_chan *ppc440spe_chan;
+	struct ppc440spe_adma_desc_slot *sw_desc, *group_start;
+	int slot_cnt, slots_per_op;
+
+	ppc440spe_chan = to_ppc440spe_adma_chan(chan);
+
+	if (unlikely(!len))
+		return NULL;
+
+	BUG_ON(unlikely(len > PPC440SPE_ADMA_DMA_MAX_BYTE_COUNT));
+
+	spin_lock_bh(&ppc440spe_chan->lock);
+
+	dev_dbg(ppc440spe_chan->device->common.dev,
+		"ppc440spe adma%d: %s cal: %u len: %u int_en %d\n",
+		ppc440spe_chan->device->id, __func__, value, len,
+		flags & DMA_PREP_INTERRUPT ? 1 : 0);
+
+	slot_cnt = slots_per_op = 1;
+	sw_desc = ppc440spe_adma_alloc_slots(ppc440spe_chan, slot_cnt,
+		slots_per_op);
+	if (sw_desc) {
+		group_start = sw_desc->group_head;
+		ppc440spe_desc_init_memset(group_start, value, flags);
+		ppc440spe_adma_set_dest(group_start, dma_dest, 0);
+		ppc440spe_desc_set_byte_count(group_start, ppc440spe_chan, len);
+		sw_desc->unmap_len = len;
+		sw_desc->async_tx.flags = flags;
+	}
+	spin_unlock_bh(&ppc440spe_chan->lock);
+
+	return sw_desc ? &sw_desc->async_tx : NULL;
+}
+
+/**
+ * ppc440spe_adma_prep_dma_xor - prepare CDB for a XOR operation
+ */
+static struct dma_async_tx_descriptor *ppc440spe_adma_prep_dma_xor(
+		struct dma_chan *chan, dma_addr_t dma_dest,
+		dma_addr_t *dma_src, u32 src_cnt, size_t len,
+		unsigned long flags)
+{
+	struct ppc440spe_adma_chan *ppc440spe_chan;
+	struct ppc440spe_adma_desc_slot *sw_desc, *group_start;
+	int slot_cnt, slots_per_op;
+
+	ppc440spe_chan = to_ppc440spe_adma_chan(chan);
+
+	ADMA_LL_DBG(prep_dma_xor_dbg(ppc440spe_chan->device->id,
+				     dma_dest, dma_src, src_cnt));
+	if (unlikely(!len))
+		return NULL;
+	BUG_ON(unlikely(len > PPC440SPE_ADMA_XOR_MAX_BYTE_COUNT));
+
+	dev_dbg(ppc440spe_chan->device->common.dev,
+		"ppc440spe adma%d: %s src_cnt: %d len: %u int_en: %d\n",
+		ppc440spe_chan->device->id, __func__, src_cnt, len,
+		flags & DMA_PREP_INTERRUPT ? 1 : 0);
+
+	spin_lock_bh(&ppc440spe_chan->lock);
+	slot_cnt = ppc440spe_chan_xor_slot_count(len, src_cnt, &slots_per_op);
+	sw_desc = ppc440spe_adma_alloc_slots(ppc440spe_chan, slot_cnt,
+			slots_per_op);
+	if (sw_desc) {
+		group_start = sw_desc->group_head;
+		ppc440spe_desc_init_xor(group_start, src_cnt, flags);
+		ppc440spe_adma_set_dest(group_start, dma_dest, 0);
+		while (src_cnt--)
+			ppc440spe_adma_memcpy_xor_set_src(group_start,
+				dma_src[src_cnt], src_cnt);
+		ppc440spe_desc_set_byte_count(group_start, ppc440spe_chan, len);
+		sw_desc->unmap_len = len;
+		sw_desc->async_tx.flags = flags;
+	}
+	spin_unlock_bh(&ppc440spe_chan->lock);
+
+	return sw_desc ? &sw_desc->async_tx : NULL;
+}
+
+static inline void
+ppc440spe_desc_set_xor_src_cnt(struct ppc440spe_adma_desc_slot *desc,
+				int src_cnt);
+static void ppc440spe_init_rxor_cursor(struct ppc440spe_rxor *cursor);
+
+/**
+ * ppc440spe_adma_init_dma2rxor_slot -
+ */
+static void ppc440spe_adma_init_dma2rxor_slot(
+		struct ppc440spe_adma_desc_slot *desc,
+		dma_addr_t *src, int src_cnt)
+{
+	int i;
+
+	/* initialize CDB */
+	for (i = 0; i < src_cnt; i++) {
+		ppc440spe_adma_dma2rxor_prep_src(desc, &desc->rxor_cursor, i,
+						 desc->src_cnt, (u32)src[i]);
+	}
+}
+
+/**
+ * ppc440spe_dma01_prep_mult -
+ * for Q operation where destination is also the source
+ */
+static struct ppc440spe_adma_desc_slot *ppc440spe_dma01_prep_mult(
+		struct ppc440spe_adma_chan *ppc440spe_chan,
+		dma_addr_t *dst, int dst_cnt, dma_addr_t *src, int src_cnt,
+		const unsigned char *scf, size_t len, unsigned long flags)
+{
+	struct ppc440spe_adma_desc_slot *sw_desc = NULL;
+	unsigned long op = 0;
+	int slot_cnt;
+
+	set_bit(PPC440SPE_DESC_WXOR, &op);
+	slot_cnt = 2;
+
+	spin_lock_bh(&ppc440spe_chan->lock);
+
+	/* use WXOR, each descriptor occupies one slot */
+	sw_desc = ppc440spe_adma_alloc_slots(ppc440spe_chan, slot_cnt, 1);
+	if (sw_desc) {
+		struct ppc440spe_adma_chan *chan;
+		struct ppc440spe_adma_desc_slot *iter;
+		struct dma_cdb *hw_desc;
+
+		chan = to_ppc440spe_adma_chan(sw_desc->async_tx.chan);
+		set_bits(op, &sw_desc->flags);
+		sw_desc->src_cnt = src_cnt;
+		sw_desc->dst_cnt = dst_cnt;
+		/* First descriptor, zero data in the destination and copy it
+		 * to q page using MULTICAST transfer.
+		 */
+		iter = list_first_entry(&sw_desc->group_list,
+					struct ppc440spe_adma_desc_slot,
+					chain_node);
+		memset(iter->hw_desc, 0, sizeof(struct dma_cdb));
+		/* set 'next' pointer */
+		iter->hw_next = list_entry(iter->chain_node.next,
+					   struct ppc440spe_adma_desc_slot,
+					   chain_node);
+		clear_bit(PPC440SPE_DESC_INT, &iter->flags);
+		hw_desc = iter->hw_desc;
+		hw_desc->opc = DMA_CDB_OPC_MULTICAST;
+
+		ppc440spe_desc_set_dest_addr(iter, chan,
+					     DMA_CUED_XOR_BASE, dst[0], 0);
+		ppc440spe_desc_set_dest_addr(iter, chan, 0, dst[1], 1);
+		ppc440spe_desc_set_src_addr(iter, chan, 0, DMA_CUED_XOR_HB,
+					    src[0]);
+		ppc440spe_desc_set_byte_count(iter, ppc440spe_chan, len);
+		iter->unmap_len = len;
+
+		/*
+		 * Second descriptor, multiply data from the q page
+		 * and store the result in real destination.
+		 */
+		iter = list_first_entry(&iter->chain_node,
+					struct ppc440spe_adma_desc_slot,
+					chain_node);
+		memset(iter->hw_desc, 0, sizeof(struct dma_cdb));
+		iter->hw_next = NULL;
+		if (flags & DMA_PREP_INTERRUPT)
+			set_bit(PPC440SPE_DESC_INT, &iter->flags);
+		else
+			clear_bit(PPC440SPE_DESC_INT, &iter->flags);
+
+		hw_desc = iter->hw_desc;
+		hw_desc->opc = DMA_CDB_OPC_MV_SG1_SG2;
+		ppc440spe_desc_set_src_addr(iter, chan, 0,
+					    DMA_CUED_XOR_HB, dst[1]);
+		ppc440spe_desc_set_dest_addr(iter, chan,
+					     DMA_CUED_XOR_BASE, dst[0], 0);
+
+		ppc440spe_desc_set_src_mult(iter, chan, DMA_CUED_MULT1_OFF,
+					    DMA_CDB_SG_DST1, scf[0]);
+		ppc440spe_desc_set_byte_count(iter, ppc440spe_chan, len);
+		iter->unmap_len = len;
+		sw_desc->async_tx.flags = flags;
+	}
+
+	spin_unlock_bh(&ppc440spe_chan->lock);
+
+	return sw_desc;
+}
+
+/**
+ * ppc440spe_dma01_prep_sum_product -
+ * Dx = A*(P+Pxy) + B*(Q+Qxy) operation where destination is also
+ * the source.
+ */
+static struct ppc440spe_adma_desc_slot *ppc440spe_dma01_prep_sum_product(
+		struct ppc440spe_adma_chan *ppc440spe_chan,
+		dma_addr_t *dst, dma_addr_t *src, int src_cnt,
+		const unsigned char *scf, size_t len, unsigned long flags)
+{
+	struct ppc440spe_adma_desc_slot *sw_desc = NULL;
+	unsigned long op = 0;
+	int slot_cnt;
+
+	set_bit(PPC440SPE_DESC_WXOR, &op);
+	slot_cnt = 3;
+
+	spin_lock_bh(&ppc440spe_chan->lock);
+
+	/* WXOR, each descriptor occupies one slot */
+	sw_desc = ppc440spe_adma_alloc_slots(ppc440spe_chan, slot_cnt, 1);
+	if (sw_desc) {
+		struct ppc440spe_adma_chan *chan;
+		struct ppc440spe_adma_desc_slot *iter;
+		struct dma_cdb *hw_desc;
+
+		chan = to_ppc440spe_adma_chan(sw_desc->async_tx.chan);
+		set_bits(op, &sw_desc->flags);
+		sw_desc->src_cnt = src_cnt;
+		sw_desc->dst_cnt = 1;
+		/* 1st descriptor, src[1] data to q page and zero destination */
+		iter = list_first_entry(&sw_desc->group_list,
+					struct ppc440spe_adma_desc_slot,
+					chain_node);
+		memset(iter->hw_desc, 0, sizeof(struct dma_cdb));
+		iter->hw_next = list_entry(iter->chain_node.next,
+					   struct ppc440spe_adma_desc_slot,
+					   chain_node);
+		clear_bit(PPC440SPE_DESC_INT, &iter->flags);
+		hw_desc = iter->hw_desc;
+		hw_desc->opc = DMA_CDB_OPC_MULTICAST;
+
+		ppc440spe_desc_set_dest_addr(iter, chan, DMA_CUED_XOR_BASE,
+					     *dst, 0);
+		ppc440spe_desc_set_dest_addr(iter, chan, 0,
+					     ppc440spe_chan->qdest, 1);
+		ppc440spe_desc_set_src_addr(iter, chan, 0, DMA_CUED_XOR_HB,
+					    src[1]);
+		ppc440spe_desc_set_byte_count(iter, ppc440spe_chan, len);
+		iter->unmap_len = len;
+
+		/* 2nd descriptor, multiply src[1] data and store the
+		 * result in destination */
+		iter = list_first_entry(&iter->chain_node,
+					struct ppc440spe_adma_desc_slot,
+					chain_node);
+		memset(iter->hw_desc, 0, sizeof(struct dma_cdb));
+		/* set 'next' pointer */
+		iter->hw_next = list_entry(iter->chain_node.next,
+					   struct ppc440spe_adma_desc_slot,
+					   chain_node);
+		if (flags & DMA_PREP_INTERRUPT)
+			set_bit(PPC440SPE_DESC_INT, &iter->flags);
+		else
+			clear_bit(PPC440SPE_DESC_INT, &iter->flags);
+
+		hw_desc = iter->hw_desc;
+		hw_desc->opc = DMA_CDB_OPC_MV_SG1_SG2;
+		ppc440spe_desc_set_src_addr(iter, chan, 0, DMA_CUED_XOR_HB,
+					    ppc440spe_chan->qdest);
+		ppc440spe_desc_set_dest_addr(iter, chan, DMA_CUED_XOR_BASE,
+					     *dst, 0);
+		ppc440spe_desc_set_src_mult(iter, chan,	DMA_CUED_MULT1_OFF,
+					    DMA_CDB_SG_DST1, scf[1]);
+		ppc440spe_desc_set_byte_count(iter, ppc440spe_chan, len);
+		iter->unmap_len = len;
+
+		/*
+		 * 3rd descriptor, multiply src[0] data and xor it
+		 * with destination
+		 */
+		iter = list_first_entry(&iter->chain_node,
+					struct ppc440spe_adma_desc_slot,
+					chain_node);
+		memset(iter->hw_desc, 0, sizeof(struct dma_cdb));
+		iter->hw_next = NULL;
+		if (flags & DMA_PREP_INTERRUPT)
+			set_bit(PPC440SPE_DESC_INT, &iter->flags);
+		else
+			clear_bit(PPC440SPE_DESC_INT, &iter->flags);
+
+		hw_desc = iter->hw_desc;
+		hw_desc->opc = DMA_CDB_OPC_MV_SG1_SG2;
+		ppc440spe_desc_set_src_addr(iter, chan, 0, DMA_CUED_XOR_HB,
+					    src[0]);
+		ppc440spe_desc_set_dest_addr(iter, chan, DMA_CUED_XOR_BASE,
+					     *dst, 0);
+		ppc440spe_desc_set_src_mult(iter, chan, DMA_CUED_MULT1_OFF,
+					    DMA_CDB_SG_DST1, scf[0]);
+		ppc440spe_desc_set_byte_count(iter, ppc440spe_chan, len);
+		iter->unmap_len = len;
+		sw_desc->async_tx.flags = flags;
+	}
+
+	spin_unlock_bh(&ppc440spe_chan->lock);
+
+	return sw_desc;
+}
+
+static struct ppc440spe_adma_desc_slot *ppc440spe_dma01_prep_pq(
+		struct ppc440spe_adma_chan *ppc440spe_chan,
+		dma_addr_t *dst, int dst_cnt, dma_addr_t *src, int src_cnt,
+		const unsigned char *scf, size_t len, unsigned long flags)
+{
+	int slot_cnt;
+	struct ppc440spe_adma_desc_slot *sw_desc = NULL, *iter;
+	unsigned long op = 0;
+	unsigned char mult = 1;
+
+	pr_debug("%s: dst_cnt %d, src_cnt %d, len %d\n",
+		 __func__, dst_cnt, src_cnt, len);
+	/*  select operations WXOR/RXOR depending on the
+	 * source addresses of operators and the number
+	 * of destinations (RXOR support only Q-parity calculations)
+	 */
+	set_bit(PPC440SPE_DESC_WXOR, &op);
+	if (!test_and_set_bit(PPC440SPE_RXOR_RUN, &ppc440spe_rxor_state)) {
+		/* no active RXOR;
+		 * do RXOR if:
+		 * - there are more than 1 source,
+		 * - len is aligned on 512-byte boundary,
+		 * - source addresses fit to one of 4 possible regions.
+		 */
+		if (src_cnt > 1 &&
+		    !(len & MQ0_CF2H_RXOR_BS_MASK) &&
+		    (src[0] + len) == src[1]) {
+			/* may do RXOR R1 R2 */
+			set_bit(PPC440SPE_DESC_RXOR, &op);
+			if (src_cnt != 2) {
+				/* may try to enhance region of RXOR */
+				if ((src[1] + len) == src[2]) {
+					/* do RXOR R1 R2 R3 */
+					set_bit(PPC440SPE_DESC_RXOR123,
+						&op);
+				} else if ((src[1] + len * 2) == src[2]) {
+					/* do RXOR R1 R2 R4 */
+					set_bit(PPC440SPE_DESC_RXOR124, &op);
+				} else if ((src[1] + len * 3) == src[2]) {
+					/* do RXOR R1 R2 R5 */
+					set_bit(PPC440SPE_DESC_RXOR125,
+						&op);
+				} else {
+					/* do RXOR R1 R2 */
+					set_bit(PPC440SPE_DESC_RXOR12,
+						&op);
+				}
+			} else {
+				/* do RXOR R1 R2 */
+				set_bit(PPC440SPE_DESC_RXOR12, &op);
+			}
+		}
+
+		if (!test_bit(PPC440SPE_DESC_RXOR, &op)) {
+			/* can not do this operation with RXOR */
+			clear_bit(PPC440SPE_RXOR_RUN,
+				&ppc440spe_rxor_state);
+		} else {
+			/* can do; set block size right now */
+			ppc440spe_desc_set_rxor_block_size(len);
+		}
+	}
+
+	/* Number of necessary slots depends on operation type selected */
+	if (!test_bit(PPC440SPE_DESC_RXOR, &op)) {
+		/*  This is a WXOR only chain. Need descriptors for each
+		 * source to GF-XOR them with WXOR, and need descriptors
+		 * for each destination to zero them with WXOR
+		 */
+		slot_cnt = src_cnt;
+
+		if (flags & DMA_PREP_ZERO_P) {
+			slot_cnt++;
+			set_bit(PPC440SPE_ZERO_P, &op);
+		}
+		if (flags & DMA_PREP_ZERO_Q) {
+			slot_cnt++;
+			set_bit(PPC440SPE_ZERO_Q, &op);
+		}
+	} else {
+		/*  Need 1/2 descriptor for RXOR operation, and
+		 * need (src_cnt - (2 or 3)) for WXOR of sources
+		 * remained (if any)
+		 */
+		slot_cnt = dst_cnt;
+
+		if (flags & DMA_PREP_ZERO_P)
+			set_bit(PPC440SPE_ZERO_P, &op);
+		if (flags & DMA_PREP_ZERO_Q)
+			set_bit(PPC440SPE_ZERO_Q, &op);
+
+		if (test_bit(PPC440SPE_DESC_RXOR12, &op))
+			slot_cnt += src_cnt - 2;
+		else
+			slot_cnt += src_cnt - 3;
+
+		/*  Thus we have either RXOR only chain or
+		 * mixed RXOR/WXOR
+		 */
+		if (slot_cnt == dst_cnt)
+			/* RXOR only chain */
+			clear_bit(PPC440SPE_DESC_WXOR, &op);
+	}
+
+	spin_lock_bh(&ppc440spe_chan->lock);
+	/* for both RXOR/WXOR each descriptor occupies one slot */
+	sw_desc = ppc440spe_adma_alloc_slots(ppc440spe_chan, slot_cnt, 1);
+	if (sw_desc) {
+		ppc440spe_desc_init_dma01pq(sw_desc, dst_cnt, src_cnt,
+				flags, op);
+
+		/* setup dst/src/mult */
+		pr_debug("%s: set dst descriptor 0, 1: 0x%016llx, 0x%016llx\n",
+			 __func__, dst[0], dst[1]);
+		ppc440spe_adma_pq_set_dest(sw_desc, dst, flags);
+		while (src_cnt--) {
+			ppc440spe_adma_pq_set_src(sw_desc, src[src_cnt],
+						  src_cnt);
+
+			/* NOTE: "Multi = 0 is equivalent to = 1" as it
+			 * stated in 440SPSPe_RAID6_Addendum_UM_1_17.pdf
+			 * doesn't work for RXOR with DMA0/1! Instead, multi=0
+			 * leads to zeroing source data after RXOR.
+			 * So, for P case set-up mult=1 explicitly.
+			 */
+			if (!(flags & DMA_PREP_PQ_DISABLE_Q))
+				mult = scf[src_cnt];
+			ppc440spe_adma_pq_set_src_mult(sw_desc,
+				mult, src_cnt,  dst_cnt - 1);
+		}
+
+		/* Setup byte count foreach slot just allocated */
+		sw_desc->async_tx.flags = flags;
+		list_for_each_entry(iter, &sw_desc->group_list,
+				chain_node) {
+			ppc440spe_desc_set_byte_count(iter,
+				ppc440spe_chan, len);
+			iter->unmap_len = len;
+		}
+	}
+	spin_unlock_bh(&ppc440spe_chan->lock);
+
+	return sw_desc;
+}
+
+static struct ppc440spe_adma_desc_slot *ppc440spe_dma2_prep_pq(
+		struct ppc440spe_adma_chan *ppc440spe_chan,
+		dma_addr_t *dst, int dst_cnt, dma_addr_t *src, int src_cnt,
+		const unsigned char *scf, size_t len, unsigned long flags)
+{
+	int slot_cnt, descs_per_op;
+	struct ppc440spe_adma_desc_slot *sw_desc = NULL, *iter;
+	unsigned long op = 0;
+	unsigned char mult = 1;
+
+	BUG_ON(!dst_cnt);
+	/*pr_debug("%s: dst_cnt %d, src_cnt %d, len %d\n",
+		 __func__, dst_cnt, src_cnt, len);*/
+
+	spin_lock_bh(&ppc440spe_chan->lock);
+	descs_per_op = ppc440spe_dma2_pq_slot_count(src, src_cnt, len);
+	if (descs_per_op < 0) {
+		spin_unlock_bh(&ppc440spe_chan->lock);
+		return NULL;
+	}
+
+	/* depending on number of sources we have 1 or 2 RXOR chains */
+	slot_cnt = descs_per_op * dst_cnt;
+
+	sw_desc = ppc440spe_adma_alloc_slots(ppc440spe_chan, slot_cnt, 1);
+	if (sw_desc) {
+		op = slot_cnt;
+		sw_desc->async_tx.flags = flags;
+		list_for_each_entry(iter, &sw_desc->group_list, chain_node) {
+			ppc440spe_desc_init_dma2pq(iter, dst_cnt, src_cnt,
+				--op ? 0 : flags);
+			ppc440spe_desc_set_byte_count(iter, ppc440spe_chan,
+				len);
+			iter->unmap_len = len;
+
+			ppc440spe_init_rxor_cursor(&(iter->rxor_cursor));
+			iter->rxor_cursor.len = len;
+			iter->descs_per_op = descs_per_op;
+		}
+		op = 0;
+		list_for_each_entry(iter, &sw_desc->group_list, chain_node) {
+			op++;
+			if (op % descs_per_op == 0)
+				ppc440spe_adma_init_dma2rxor_slot(iter, src,
+								  src_cnt);
+			if (likely(!list_is_last(&iter->chain_node,
+						 &sw_desc->group_list))) {
+				/* set 'next' pointer */
+				iter->hw_next =
+					list_entry(iter->chain_node.next,
+						struct ppc440spe_adma_desc_slot,
+						chain_node);
+				ppc440spe_xor_set_link(iter, iter->hw_next);
+			} else {
+				/* this is the last descriptor. */
+				iter->hw_next = NULL;
+			}
+		}
+
+		/* fixup head descriptor */
+		sw_desc->dst_cnt = dst_cnt;
+		if (flags & DMA_PREP_ZERO_P)
+			set_bit(PPC440SPE_ZERO_P, &sw_desc->flags);
+		if (flags & DMA_PREP_ZERO_Q)
+			set_bit(PPC440SPE_ZERO_Q, &sw_desc->flags);
+
+		/* setup dst/src/mult */
+		ppc440spe_adma_pq_set_dest(sw_desc, dst, flags);
+
+		while (src_cnt--) {
+			/* handle descriptors (if dst_cnt == 2) inside
+			 * the ppc440spe_adma_pq_set_srcxxx() functions
+			 */
+			ppc440spe_adma_pq_set_src(sw_desc, src[src_cnt],
+						  src_cnt);
+			if (!(flags & DMA_PREP_PQ_DISABLE_Q))
+				mult = scf[src_cnt];
+			ppc440spe_adma_pq_set_src_mult(sw_desc,
+					mult, src_cnt, dst_cnt - 1);
+		}
+	}
+	spin_unlock_bh(&ppc440spe_chan->lock);
+	ppc440spe_desc_set_rxor_block_size(len);
+	return sw_desc;
+}
+
+/**
+ * ppc440spe_adma_prep_dma_pq - prepare CDB (group) for a GF-XOR operation
+ */
+static struct dma_async_tx_descriptor *ppc440spe_adma_prep_dma_pq(
+		struct dma_chan *chan, dma_addr_t *dst, dma_addr_t *src,
+		unsigned int src_cnt, const unsigned char *scf,
+		size_t len, unsigned long flags)
+{
+	struct ppc440spe_adma_chan *ppc440spe_chan;
+	struct ppc440spe_adma_desc_slot *sw_desc = NULL;
+	int dst_cnt = 0;
+
+	ppc440spe_chan = to_ppc440spe_adma_chan(chan);
+
+	ADMA_LL_DBG(prep_dma_pq_dbg(ppc440spe_chan->device->id,
+				    dst, src, src_cnt));
+	BUG_ON(!len);
+	BUG_ON(unlikely(len > PPC440SPE_ADMA_XOR_MAX_BYTE_COUNT));
+	BUG_ON(!src_cnt);
+
+	if (src_cnt == 1 && dst[1] == src[0]) {
+		dma_addr_t dest[2];
+
+		/* dst[1] is real destination (Q) */
+		dest[0] = dst[1];
+		/* this is the page to multicast source data to */
+		dest[1] = ppc440spe_chan->qdest;
+		sw_desc = ppc440spe_dma01_prep_mult(ppc440spe_chan,
+				dest, 2, src, src_cnt, scf, len, flags);
+		return sw_desc ? &sw_desc->async_tx : NULL;
+	}
+
+	if (src_cnt == 2 && dst[1] == src[1]) {
+		sw_desc = ppc440spe_dma01_prep_sum_product(ppc440spe_chan,
+					&dst[1], src, 2, scf, len, flags);
+		return sw_desc ? &sw_desc->async_tx : NULL;
+	}
+
+	if (!(flags & DMA_PREP_PQ_DISABLE_P)) {
+		BUG_ON(!dst[0]);
+		dst_cnt++;
+		flags |= DMA_PREP_ZERO_P;
+	}
+
+	if (!(flags & DMA_PREP_PQ_DISABLE_Q)) {
+		BUG_ON(!dst[1]);
+		dst_cnt++;
+		flags |= DMA_PREP_ZERO_Q;
+	}
+
+	BUG_ON(!dst_cnt);
+
+	dev_dbg(ppc440spe_chan->device->common.dev,
+		"ppc440spe adma%d: %s src_cnt: %d len: %u int_en: %d\n",
+		ppc440spe_chan->device->id, __func__, src_cnt, len,
+		flags & DMA_PREP_INTERRUPT ? 1 : 0);
+
+	switch (ppc440spe_chan->device->id) {
+	case PPC440SPE_DMA0_ID:
+	case PPC440SPE_DMA1_ID:
+		sw_desc = ppc440spe_dma01_prep_pq(ppc440spe_chan,
+				dst, dst_cnt, src, src_cnt, scf,
+				len, flags);
+		break;
+
+	case PPC440SPE_XOR_ID:
+		sw_desc = ppc440spe_dma2_prep_pq(ppc440spe_chan,
+				dst, dst_cnt, src, src_cnt, scf,
+				len, flags);
+		break;
+	}
+
+	return sw_desc ? &sw_desc->async_tx : NULL;
+}
+
+/**
+ * ppc440spe_adma_prep_dma_pqzero_sum - prepare CDB group for
+ * a PQ_ZERO_SUM operation
+ */
+static struct dma_async_tx_descriptor *ppc440spe_adma_prep_dma_pqzero_sum(
+		struct dma_chan *chan, dma_addr_t *pq, dma_addr_t *src,
+		unsigned int src_cnt, const unsigned char *scf, size_t len,
+		enum sum_check_flags *pqres, unsigned long flags)
+{
+	struct ppc440spe_adma_chan *ppc440spe_chan;
+	struct ppc440spe_adma_desc_slot *sw_desc, *iter;
+	dma_addr_t pdest, qdest;
+	int slot_cnt, slots_per_op, idst, dst_cnt;
+
+	ppc440spe_chan = to_ppc440spe_adma_chan(chan);
+
+	if (flags & DMA_PREP_PQ_DISABLE_P)
+		pdest = 0;
+	else
+		pdest = pq[0];
+
+	if (flags & DMA_PREP_PQ_DISABLE_Q)
+		qdest = 0;
+	else
+		qdest = pq[1];
+
+	ADMA_LL_DBG(prep_dma_pqzero_sum_dbg(ppc440spe_chan->device->id,
+					    src, src_cnt, scf));
+
+	/* Always use WXOR for P/Q calculations (two destinations).
+	 * Need 1 or 2 extra slots to verify results are zero.
+	 */
+	idst = dst_cnt = (pdest && qdest) ? 2 : 1;
+
+	/* One additional slot per destination to clone P/Q
+	 * before calculation (we have to preserve destinations).
+	 */
+	slot_cnt = src_cnt + dst_cnt * 2;
+	slots_per_op = 1;
+
+	spin_lock_bh(&ppc440spe_chan->lock);
+	sw_desc = ppc440spe_adma_alloc_slots(ppc440spe_chan, slot_cnt,
+					     slots_per_op);
+	if (sw_desc) {
+		ppc440spe_desc_init_dma01pqzero_sum(sw_desc, dst_cnt, src_cnt);
+
+		/* Setup byte count for each slot just allocated */
+		sw_desc->async_tx.flags = flags;
+		list_for_each_entry(iter, &sw_desc->group_list, chain_node) {
+			ppc440spe_desc_set_byte_count(iter, ppc440spe_chan,
+						      len);
+			iter->unmap_len = len;
+		}
+
+		if (pdest) {
+			struct dma_cdb *hw_desc;
+			struct ppc440spe_adma_chan *chan;
+
+			iter = sw_desc->group_head;
+			chan = to_ppc440spe_adma_chan(iter->async_tx.chan);
+			memset(iter->hw_desc, 0, sizeof(struct dma_cdb));
+			iter->hw_next = list_entry(iter->chain_node.next,
+						struct ppc440spe_adma_desc_slot,
+						chain_node);
+			hw_desc = iter->hw_desc;
+			hw_desc->opc = DMA_CDB_OPC_MV_SG1_SG2;
+			iter->src_cnt = 0;
+			iter->dst_cnt = 0;
+			ppc440spe_desc_set_dest_addr(iter, chan, 0,
+						     ppc440spe_chan->pdest, 0);
+			ppc440spe_desc_set_src_addr(iter, chan, 0, 0, pdest);
+			ppc440spe_desc_set_byte_count(iter, ppc440spe_chan,
+						      len);
+			iter->unmap_len = 0;
+			/* override pdest to preserve original P */
+			pdest = ppc440spe_chan->pdest;
+		}
+		if (qdest) {
+			struct dma_cdb *hw_desc;
+			struct ppc440spe_adma_chan *chan;
+
+			iter = list_first_entry(&sw_desc->group_list,
+						struct ppc440spe_adma_desc_slot,
+						chain_node);
+			chan = to_ppc440spe_adma_chan(iter->async_tx.chan);
+
+			if (pdest) {
+				iter = list_entry(iter->chain_node.next,
+						struct ppc440spe_adma_desc_slot,
+						chain_node);
+			}
+
+			memset(iter->hw_desc, 0, sizeof(struct dma_cdb));
+			iter->hw_next = list_entry(iter->chain_node.next,
+						struct ppc440spe_adma_desc_slot,
+						chain_node);
+			hw_desc = iter->hw_desc;
+			hw_desc->opc = DMA_CDB_OPC_MV_SG1_SG2;
+			iter->src_cnt = 0;
+			iter->dst_cnt = 0;
+			ppc440spe_desc_set_dest_addr(iter, chan, 0,
+						     ppc440spe_chan->qdest, 0);
+			ppc440spe_desc_set_src_addr(iter, chan, 0, 0, qdest);
+			ppc440spe_desc_set_byte_count(iter, ppc440spe_chan,
+						      len);
+			iter->unmap_len = 0;
+			/* override qdest to preserve original Q */
+			qdest = ppc440spe_chan->qdest;
+		}
+
+		/* Setup destinations for P/Q ops */
+		ppc440spe_adma_pqzero_sum_set_dest(sw_desc, pdest, qdest);
+
+		/* Setup zero QWORDs into DCHECK CDBs */
+		idst = dst_cnt;
+		list_for_each_entry_reverse(iter, &sw_desc->group_list,
+					    chain_node) {
+			/*
+			 * The last CDB corresponds to Q-parity check,
+			 * the one before last CDB corresponds
+			 * P-parity check
+			 */
+			if (idst == DMA_DEST_MAX_NUM) {
+				if (idst == dst_cnt) {
+					set_bit(PPC440SPE_DESC_QCHECK,
+						&iter->flags);
+				} else {
+					set_bit(PPC440SPE_DESC_PCHECK,
+						&iter->flags);
+				}
+			} else {
+				if (qdest) {
+					set_bit(PPC440SPE_DESC_QCHECK,
+						&iter->flags);
+				} else {
+					set_bit(PPC440SPE_DESC_PCHECK,
+						&iter->flags);
+				}
+			}
+			iter->xor_check_result = pqres;
+
+			/*
+			 * set it to zero, if check fail then result will
+			 * be updated
+			 */
+			*iter->xor_check_result = 0;
+			ppc440spe_desc_set_dcheck(iter, ppc440spe_chan,
+				ppc440spe_qword);
+
+			if (!(--dst_cnt))
+				break;
+		}
+
+		/* Setup sources and mults for P/Q ops */
+		list_for_each_entry_continue_reverse(iter, &sw_desc->group_list,
+						     chain_node) {
+			struct ppc440spe_adma_chan *chan;
+			u32 mult_dst;
+
+			chan = to_ppc440spe_adma_chan(iter->async_tx.chan);
+			ppc440spe_desc_set_src_addr(iter, chan, 0,
+						    DMA_CUED_XOR_HB,
+						    src[src_cnt - 1]);
+			if (qdest) {
+				mult_dst = (dst_cnt - 1) ? DMA_CDB_SG_DST2 :
+							   DMA_CDB_SG_DST1;
+				ppc440spe_desc_set_src_mult(iter, chan,
+							    DMA_CUED_MULT1_OFF,
+							    mult_dst,
+							    scf[src_cnt - 1]);
+			}
+			if (!(--src_cnt))
+				break;
+		}
+	}
+	spin_unlock_bh(&ppc440spe_chan->lock);
+	return sw_desc ? &sw_desc->async_tx : NULL;
+}
+
+/**
+ * ppc440spe_adma_prep_dma_xor_zero_sum - prepare CDB group for
+ * XOR ZERO_SUM operation
+ */
+static struct dma_async_tx_descriptor *ppc440spe_adma_prep_dma_xor_zero_sum(
+		struct dma_chan *chan, dma_addr_t *src, unsigned int src_cnt,
+		size_t len, enum sum_check_flags *result, unsigned long flags)
+{
+	struct dma_async_tx_descriptor *tx;
+	dma_addr_t pq[2];
+
+	/* validate P, disable Q */
+	pq[0] = src[0];
+	pq[1] = 0;
+	flags |= DMA_PREP_PQ_DISABLE_Q;
+
+	tx = ppc440spe_adma_prep_dma_pqzero_sum(chan, pq, &src[1],
+						src_cnt - 1, 0, len,
+						result, flags);
+	return tx;
+}
+
+/**
+ * ppc440spe_adma_set_dest - set destination address into descriptor
+ */
+static void ppc440spe_adma_set_dest(struct ppc440spe_adma_desc_slot *sw_desc,
+		dma_addr_t addr, int index)
+{
+	struct ppc440spe_adma_chan *chan;
+
+	BUG_ON(index >= sw_desc->dst_cnt);
+
+	chan = to_ppc440spe_adma_chan(sw_desc->async_tx.chan);
+
+	switch (chan->device->id) {
+	case PPC440SPE_DMA0_ID:
+	case PPC440SPE_DMA1_ID:
+		/* to do: support transfers lengths >
+		 * PPC440SPE_ADMA_DMA/XOR_MAX_BYTE_COUNT
+		 */
+		ppc440spe_desc_set_dest_addr(sw_desc->group_head,
+			chan, 0, addr, index);
+		break;
+	case PPC440SPE_XOR_ID:
+		sw_desc = ppc440spe_get_group_entry(sw_desc, index);
+		ppc440spe_desc_set_dest_addr(sw_desc,
+			chan, 0, addr, index);
+		break;
+	}
+}
+
+static void ppc440spe_adma_pq_zero_op(struct ppc440spe_adma_desc_slot *iter,
+		struct ppc440spe_adma_chan *chan, dma_addr_t addr)
+{
+	/*  To clear destinations update the descriptor
+	 * (P or Q depending on index) as follows:
+	 * addr is destination (0 corresponds to SG2):
+	 */
+	ppc440spe_desc_set_dest_addr(iter, chan, DMA_CUED_XOR_BASE, addr, 0);
+
+	/* ... and the addr is source: */
+	ppc440spe_desc_set_src_addr(iter, chan, 0, DMA_CUED_XOR_HB, addr);
+
+	/* addr is always SG2 then the mult is always DST1 */
+	ppc440spe_desc_set_src_mult(iter, chan, DMA_CUED_MULT1_OFF,
+				    DMA_CDB_SG_DST1, 1);
+}
+
+/**
+ * ppc440spe_adma_pq_set_dest - set destination address into descriptor
+ * for the PQXOR operation
+ */
+static void ppc440spe_adma_pq_set_dest(struct ppc440spe_adma_desc_slot *sw_desc,
+		dma_addr_t *addrs, unsigned long flags)
+{
+	struct ppc440spe_adma_desc_slot *iter;
+	struct ppc440spe_adma_chan *chan;
+	dma_addr_t paddr, qaddr;
+	dma_addr_t addr = 0, ppath, qpath;
+	int index = 0, i;
+
+	chan = to_ppc440spe_adma_chan(sw_desc->async_tx.chan);
+
+	if (flags & DMA_PREP_PQ_DISABLE_P)
+		paddr = 0;
+	else
+		paddr = addrs[0];
+
+	if (flags & DMA_PREP_PQ_DISABLE_Q)
+		qaddr = 0;
+	else
+		qaddr = addrs[1];
+
+	if (!paddr || !qaddr)
+		addr = paddr ? paddr : qaddr;
+
+	switch (chan->device->id) {
+	case PPC440SPE_DMA0_ID:
+	case PPC440SPE_DMA1_ID:
+		/* walk through the WXOR source list and set P/Q-destinations
+		 * for each slot:
+		 */
+		if (!test_bit(PPC440SPE_DESC_RXOR, &sw_desc->flags)) {
+			/* This is WXOR-only chain; may have 1/2 zero descs */
+			if (test_bit(PPC440SPE_ZERO_P, &sw_desc->flags))
+				index++;
+			if (test_bit(PPC440SPE_ZERO_Q, &sw_desc->flags))
+				index++;
+
+			iter = ppc440spe_get_group_entry(sw_desc, index);
+			if (addr) {
+				/* one destination */
+				list_for_each_entry_from(iter,
+					&sw_desc->group_list, chain_node)
+					ppc440spe_desc_set_dest_addr(iter, chan,
+						DMA_CUED_XOR_BASE, addr, 0);
+			} else {
+				/* two destinations */
+				list_for_each_entry_from(iter,
+					&sw_desc->group_list, chain_node) {
+					ppc440spe_desc_set_dest_addr(iter, chan,
+						DMA_CUED_XOR_BASE, paddr, 0);
+					ppc440spe_desc_set_dest_addr(iter, chan,
+						DMA_CUED_XOR_BASE, qaddr, 1);
+				}
+			}
+
+			if (index) {
+				/*  To clear destinations update the descriptor
+				 * (1st,2nd, or both depending on flags)
+				 */
+				index = 0;
+				if (test_bit(PPC440SPE_ZERO_P,
+						&sw_desc->flags)) {
+					iter = ppc440spe_get_group_entry(
+							sw_desc, index++);
+					ppc440spe_adma_pq_zero_op(iter, chan,
+							paddr);
+				}
+
+				if (test_bit(PPC440SPE_ZERO_Q,
+						&sw_desc->flags)) {
+					iter = ppc440spe_get_group_entry(
+							sw_desc, index++);
+					ppc440spe_adma_pq_zero_op(iter, chan,
+							qaddr);
+				}
+
+				return;
+			}
+		} else {
+			/* This is RXOR-only or RXOR/WXOR mixed chain */
+
+			/* If we want to include destination into calculations,
+			 * then make dest addresses cued with mult=1 (XOR).
+			 */
+			ppath = test_bit(PPC440SPE_ZERO_P, &sw_desc->flags) ?
+					DMA_CUED_XOR_HB :
+					DMA_CUED_XOR_BASE |
+						(1 << DMA_CUED_MULT1_OFF);
+			qpath = test_bit(PPC440SPE_ZERO_Q, &sw_desc->flags) ?
+					DMA_CUED_XOR_HB :
+					DMA_CUED_XOR_BASE |
+						(1 << DMA_CUED_MULT1_OFF);
+
+			/* Setup destination(s) in RXOR slot(s) */
+			iter = ppc440spe_get_group_entry(sw_desc, index++);
+			ppc440spe_desc_set_dest_addr(iter, chan,
+						paddr ? ppath : qpath,
+						paddr ? paddr : qaddr, 0);
+			if (!addr) {
+				/* two destinations */
+				iter = ppc440spe_get_group_entry(sw_desc,
+								 index++);
+				ppc440spe_desc_set_dest_addr(iter, chan,
+						qpath, qaddr, 0);
+			}
+
+			if (test_bit(PPC440SPE_DESC_WXOR, &sw_desc->flags)) {
+				/* Setup destination(s) in remaining WXOR
+				 * slots
+				 */
+				iter = ppc440spe_get_group_entry(sw_desc,
+								 index);
+				if (addr) {
+					/* one destination */
+					list_for_each_entry_from(iter,
+					    &sw_desc->group_list,
+					    chain_node)
+						ppc440spe_desc_set_dest_addr(
+							iter, chan,
+							DMA_CUED_XOR_BASE,
+							addr, 0);
+
+				} else {
+					/* two destinations */
+					list_for_each_entry_from(iter,
+					    &sw_desc->group_list,
+					    chain_node) {
+						ppc440spe_desc_set_dest_addr(
+							iter, chan,
+							DMA_CUED_XOR_BASE,
+							paddr, 0);
+						ppc440spe_desc_set_dest_addr(
+							iter, chan,
+							DMA_CUED_XOR_BASE,
+							qaddr, 1);
+					}
+				}
+			}
+
+		}
+		break;
+
+	case PPC440SPE_XOR_ID:
+		/* DMA2 descriptors have only 1 destination, so there are
+		 * two chains - one for each dest.
+		 * If we want to include destination into calculations,
+		 * then make dest addresses cued with mult=1 (XOR).
+		 */
+		ppath = test_bit(PPC440SPE_ZERO_P, &sw_desc->flags) ?
+				DMA_CUED_XOR_HB :
+				DMA_CUED_XOR_BASE |
+					(1 << DMA_CUED_MULT1_OFF);
+
+		qpath = test_bit(PPC440SPE_ZERO_Q, &sw_desc->flags) ?
+				DMA_CUED_XOR_HB :
+				DMA_CUED_XOR_BASE |
+					(1 << DMA_CUED_MULT1_OFF);
+
+		iter = ppc440spe_get_group_entry(sw_desc, 0);
+		for (i = 0; i < sw_desc->descs_per_op; i++) {
+			ppc440spe_desc_set_dest_addr(iter, chan,
+				paddr ? ppath : qpath,
+				paddr ? paddr : qaddr, 0);
+			iter = list_entry(iter->chain_node.next,
+					  struct ppc440spe_adma_desc_slot,
+					  chain_node);
+		}
+
+		if (!addr) {
+			/* Two destinations; setup Q here */
+			iter = ppc440spe_get_group_entry(sw_desc,
+				sw_desc->descs_per_op);
+			for (i = 0; i < sw_desc->descs_per_op; i++) {
+				ppc440spe_desc_set_dest_addr(iter,
+					chan, qpath, qaddr, 0);
+				iter = list_entry(iter->chain_node.next,
+						struct ppc440spe_adma_desc_slot,
+						chain_node);
+			}
+		}
+
+		break;
+	}
+}
+
+/**
+ * ppc440spe_adma_pq_zero_sum_set_dest - set destination address into descriptor
+ * for the PQ_ZERO_SUM operation
+ */
+static void ppc440spe_adma_pqzero_sum_set_dest(
+		struct ppc440spe_adma_desc_slot *sw_desc,
+		dma_addr_t paddr, dma_addr_t qaddr)
+{
+	struct ppc440spe_adma_desc_slot *iter, *end;
+	struct ppc440spe_adma_chan *chan;
+	dma_addr_t addr = 0;
+	int idx;
+
+	chan = to_ppc440spe_adma_chan(sw_desc->async_tx.chan);
+
+	/* walk through the WXOR source list and set P/Q-destinations
+	 * for each slot
+	 */
+	idx = (paddr && qaddr) ? 2 : 1;
+	/* set end */
+	list_for_each_entry_reverse(end, &sw_desc->group_list,
+				    chain_node) {
+		if (!(--idx))
+			break;
+	}
+	/* set start */
+	idx = (paddr && qaddr) ? 2 : 1;
+	iter = ppc440spe_get_group_entry(sw_desc, idx);
+
+	if (paddr && qaddr) {
+		/* two destinations */
+		list_for_each_entry_from(iter, &sw_desc->group_list,
+					 chain_node) {
+			if (unlikely(iter == end))
+				break;
+			ppc440spe_desc_set_dest_addr(iter, chan,
+						DMA_CUED_XOR_BASE, paddr, 0);
+			ppc440spe_desc_set_dest_addr(iter, chan,
+						DMA_CUED_XOR_BASE, qaddr, 1);
+		}
+	} else {
+		/* one destination */
+		addr = paddr ? paddr : qaddr;
+		list_for_each_entry_from(iter, &sw_desc->group_list,
+					 chain_node) {
+			if (unlikely(iter == end))
+				break;
+			ppc440spe_desc_set_dest_addr(iter, chan,
+						DMA_CUED_XOR_BASE, addr, 0);
+		}
+	}
+
+	/*  The remaining descriptors are DATACHECK. These have no need in
+	 * destination. Actually, these destinations are used there
+	 * as sources for check operation. So, set addr as source.
+	 */
+	ppc440spe_desc_set_src_addr(end, chan, 0, 0, addr ? addr : paddr);
+
+	if (!addr) {
+		end = list_entry(end->chain_node.next,
+				 struct ppc440spe_adma_desc_slot, chain_node);
+		ppc440spe_desc_set_src_addr(end, chan, 0, 0, qaddr);
+	}
+}
+
+/**
+ * ppc440spe_desc_set_xor_src_cnt - set source count into descriptor
+ */
+static inline void ppc440spe_desc_set_xor_src_cnt(
+			struct ppc440spe_adma_desc_slot *desc,
+			int src_cnt)
+{
+	struct xor_cb *hw_desc = desc->hw_desc;
+
+	hw_desc->cbc &= ~XOR_CDCR_OAC_MSK;
+	hw_desc->cbc |= src_cnt;
+}
+
+/**
+ * ppc440spe_adma_pq_set_src - set source address into descriptor
+ */
+static void ppc440spe_adma_pq_set_src(struct ppc440spe_adma_desc_slot *sw_desc,
+		dma_addr_t addr, int index)
+{
+	struct ppc440spe_adma_chan *chan;
+	dma_addr_t haddr = 0;
+	struct ppc440spe_adma_desc_slot *iter = NULL;
+
+	chan = to_ppc440spe_adma_chan(sw_desc->async_tx.chan);
+
+	switch (chan->device->id) {
+	case PPC440SPE_DMA0_ID:
+	case PPC440SPE_DMA1_ID:
+		/* DMA0,1 may do: WXOR, RXOR, RXOR+WXORs chain
+		 */
+		if (test_bit(PPC440SPE_DESC_RXOR, &sw_desc->flags)) {
+			/* RXOR-only or RXOR/WXOR operation */
+			int iskip = test_bit(PPC440SPE_DESC_RXOR12,
+				&sw_desc->flags) ?  2 : 3;
+
+			if (index == 0) {
+				/* 1st slot (RXOR) */
+				/* setup sources region (R1-2-3, R1-2-4,
+				 * or R1-2-5)
+				 */
+				if (test_bit(PPC440SPE_DESC_RXOR12,
+						&sw_desc->flags))
+					haddr = DMA_RXOR12 <<
+						DMA_CUED_REGION_OFF;
+				else if (test_bit(PPC440SPE_DESC_RXOR123,
+				    &sw_desc->flags))
+					haddr = DMA_RXOR123 <<
+						DMA_CUED_REGION_OFF;
+				else if (test_bit(PPC440SPE_DESC_RXOR124,
+				    &sw_desc->flags))
+					haddr = DMA_RXOR124 <<
+						DMA_CUED_REGION_OFF;
+				else if (test_bit(PPC440SPE_DESC_RXOR125,
+				    &sw_desc->flags))
+					haddr = DMA_RXOR125 <<
+						DMA_CUED_REGION_OFF;
+				else
+					BUG();
+				haddr |= DMA_CUED_XOR_BASE;
+				iter = ppc440spe_get_group_entry(sw_desc, 0);
+			} else if (index < iskip) {
+				/* 1st slot (RXOR)
+				 * shall actually set source address only once
+				 * instead of first <iskip>
+				 */
+				iter = NULL;
+			} else {
+				/* 2nd/3d and next slots (WXOR);
+				 * skip first slot with RXOR
+				 */
+				haddr = DMA_CUED_XOR_HB;
+				iter = ppc440spe_get_group_entry(sw_desc,
+				    index - iskip + sw_desc->dst_cnt);
+			}
+		} else {
+			int znum = 0;
+
+			/* WXOR-only operation; skip first slots with
+			 * zeroing destinations
+			 */
+			if (test_bit(PPC440SPE_ZERO_P, &sw_desc->flags))
+				znum++;
+			if (test_bit(PPC440SPE_ZERO_Q, &sw_desc->flags))
+				znum++;
+
+			haddr = DMA_CUED_XOR_HB;
+			iter = ppc440spe_get_group_entry(sw_desc,
+					index + znum);
+		}
+
+		if (likely(iter)) {
+			ppc440spe_desc_set_src_addr(iter, chan, 0, haddr, addr);
+
+			if (!index &&
+			    test_bit(PPC440SPE_DESC_RXOR, &sw_desc->flags) &&
+			    sw_desc->dst_cnt == 2) {
+				/* if we have two destinations for RXOR, then
+				 * setup source in the second descr too
+				 */
+				iter = ppc440spe_get_group_entry(sw_desc, 1);
+				ppc440spe_desc_set_src_addr(iter, chan, 0,
+					haddr, addr);
+			}
+		}
+		break;
+
+	case PPC440SPE_XOR_ID:
+		/* DMA2 may do Biskup */
+		iter = sw_desc->group_head;
+		if (iter->dst_cnt == 2) {
+			/* both P & Q calculations required; set P src here */
+			ppc440spe_adma_dma2rxor_set_src(iter, index, addr);
+
+			/* this is for Q */
+			iter = ppc440spe_get_group_entry(sw_desc,
+				sw_desc->descs_per_op);
+		}
+		ppc440spe_adma_dma2rxor_set_src(iter, index, addr);
+		break;
+	}
+}
+
+/**
+ * ppc440spe_adma_memcpy_xor_set_src - set source address into descriptor
+ */
+static void ppc440spe_adma_memcpy_xor_set_src(
+		struct ppc440spe_adma_desc_slot *sw_desc,
+		dma_addr_t addr, int index)
+{
+	struct ppc440spe_adma_chan *chan;
+
+	chan = to_ppc440spe_adma_chan(sw_desc->async_tx.chan);
+	sw_desc = sw_desc->group_head;
+
+	if (likely(sw_desc))
+		ppc440spe_desc_set_src_addr(sw_desc, chan, index, 0, addr);
+}
+
+/**
+ * ppc440spe_adma_dma2rxor_inc_addr  -
+ */
+static void ppc440spe_adma_dma2rxor_inc_addr(
+		struct ppc440spe_adma_desc_slot *desc,
+		struct ppc440spe_rxor *cursor, int index, int src_cnt)
+{
+	cursor->addr_count++;
+	if (index == src_cnt - 1) {
+		ppc440spe_desc_set_xor_src_cnt(desc, cursor->addr_count);
+	} else if (cursor->addr_count == XOR_MAX_OPS) {
+		ppc440spe_desc_set_xor_src_cnt(desc, cursor->addr_count);
+		cursor->addr_count = 0;
+		cursor->desc_count++;
+	}
+}
+
+/**
+ * ppc440spe_adma_dma2rxor_prep_src - setup RXOR types in DMA2 CDB
+ */
+static int ppc440spe_adma_dma2rxor_prep_src(
+		struct ppc440spe_adma_desc_slot *hdesc,
+		struct ppc440spe_rxor *cursor, int index,
+		int src_cnt, u32 addr)
+{
+	int rval = 0;
+	u32 sign;
+	struct ppc440spe_adma_desc_slot *desc = hdesc;
+	int i;
+
+	for (i = 0; i < cursor->desc_count; i++) {
+		desc = list_entry(hdesc->chain_node.next,
+				  struct ppc440spe_adma_desc_slot,
+				  chain_node);
+	}
+
+	switch (cursor->state) {
+	case 0:
+		if (addr == cursor->addrl + cursor->len) {
+			/* direct RXOR */
+			cursor->state = 1;
+			cursor->xor_count++;
+			if (index == src_cnt-1) {
+				ppc440spe_rxor_set_region(desc,
+					cursor->addr_count,
+					DMA_RXOR12 << DMA_CUED_REGION_OFF);
+				ppc440spe_adma_dma2rxor_inc_addr(
+					desc, cursor, index, src_cnt);
+			}
+		} else if (cursor->addrl == addr + cursor->len) {
+			/* reverse RXOR */
+			cursor->state = 1;
+			cursor->xor_count++;
+			set_bit(cursor->addr_count, &desc->reverse_flags[0]);
+			if (index == src_cnt-1) {
+				ppc440spe_rxor_set_region(desc,
+					cursor->addr_count,
+					DMA_RXOR12 << DMA_CUED_REGION_OFF);
+				ppc440spe_adma_dma2rxor_inc_addr(
+					desc, cursor, index, src_cnt);
+			}
+		} else {
+			printk(KERN_ERR "Cannot build "
+				"DMA2 RXOR command block.\n");
+			BUG();
+		}
+		break;
+	case 1:
+		sign = test_bit(cursor->addr_count,
+				desc->reverse_flags)
+			? -1 : 1;
+		if (index == src_cnt-2 || (sign == -1
+			&& addr != cursor->addrl - 2*cursor->len)) {
+			cursor->state = 0;
+			cursor->xor_count = 1;
+			cursor->addrl = addr;
+			ppc440spe_rxor_set_region(desc,
+				cursor->addr_count,
+				DMA_RXOR12 << DMA_CUED_REGION_OFF);
+			ppc440spe_adma_dma2rxor_inc_addr(
+				desc, cursor, index, src_cnt);
+		} else if (addr == cursor->addrl + 2*sign*cursor->len) {
+			cursor->state = 2;
+			cursor->xor_count = 0;
+			ppc440spe_rxor_set_region(desc,
+				cursor->addr_count,
+				DMA_RXOR123 << DMA_CUED_REGION_OFF);
+			if (index == src_cnt-1) {
+				ppc440spe_adma_dma2rxor_inc_addr(
+					desc, cursor, index, src_cnt);
+			}
+		} else if (addr == cursor->addrl + 3*cursor->len) {
+			cursor->state = 2;
+			cursor->xor_count = 0;
+			ppc440spe_rxor_set_region(desc,
+				cursor->addr_count,
+				DMA_RXOR124 << DMA_CUED_REGION_OFF);
+			if (index == src_cnt-1) {
+				ppc440spe_adma_dma2rxor_inc_addr(
+					desc, cursor, index, src_cnt);
+			}
+		} else if (addr == cursor->addrl + 4*cursor->len) {
+			cursor->state = 2;
+			cursor->xor_count = 0;
+			ppc440spe_rxor_set_region(desc,
+				cursor->addr_count,
+				DMA_RXOR125 << DMA_CUED_REGION_OFF);
+			if (index == src_cnt-1) {
+				ppc440spe_adma_dma2rxor_inc_addr(
+					desc, cursor, index, src_cnt);
+			}
+		} else {
+			cursor->state = 0;
+			cursor->xor_count = 1;
+			cursor->addrl = addr;
+			ppc440spe_rxor_set_region(desc,
+				cursor->addr_count,
+				DMA_RXOR12 << DMA_CUED_REGION_OFF);
+			ppc440spe_adma_dma2rxor_inc_addr(
+				desc, cursor, index, src_cnt);
+		}
+		break;
+	case 2:
+		cursor->state = 0;
+		cursor->addrl = addr;
+		cursor->xor_count++;
+		if (index) {
+			ppc440spe_adma_dma2rxor_inc_addr(
+				desc, cursor, index, src_cnt);
+		}
+		break;
+	}
+
+	return rval;
+}
+
+/**
+ * ppc440spe_adma_dma2rxor_set_src - set RXOR source address; it's assumed that
+ *	ppc440spe_adma_dma2rxor_prep_src() has already done prior this call
+ */
+static void ppc440spe_adma_dma2rxor_set_src(
+		struct ppc440spe_adma_desc_slot *desc,
+		int index, dma_addr_t addr)
+{
+	struct xor_cb *xcb = desc->hw_desc;
+	int k = 0, op = 0, lop = 0;
+
+	/* get the RXOR operand which corresponds to index addr */
+	while (op <= index) {
+		lop = op;
+		if (k == XOR_MAX_OPS) {
+			k = 0;
+			desc = list_entry(desc->chain_node.next,
+				struct ppc440spe_adma_desc_slot, chain_node);
+			xcb = desc->hw_desc;
+
+		}
+		if ((xcb->ops[k++].h & (DMA_RXOR12 << DMA_CUED_REGION_OFF)) ==
+		    (DMA_RXOR12 << DMA_CUED_REGION_OFF))
+			op += 2;
+		else
+			op += 3;
+	}
+
+	BUG_ON(k < 1);
+
+	if (test_bit(k-1, desc->reverse_flags)) {
+		/* reverse operand order; put last op in RXOR group */
+		if (index == op - 1)
+			ppc440spe_rxor_set_src(desc, k - 1, addr);
+	} else {
+		/* direct operand order; put first op in RXOR group */
+		if (index == lop)
+			ppc440spe_rxor_set_src(desc, k - 1, addr);
+	}
+}
+
+/**
+ * ppc440spe_adma_dma2rxor_set_mult - set RXOR multipliers; it's assumed that
+ *	ppc440spe_adma_dma2rxor_prep_src() has already done prior this call
+ */
+static void ppc440spe_adma_dma2rxor_set_mult(
+		struct ppc440spe_adma_desc_slot *desc,
+		int index, u8 mult)
+{
+	struct xor_cb *xcb = desc->hw_desc;
+	int k = 0, op = 0, lop = 0;
+
+	/* get the RXOR operand which corresponds to index mult */
+	while (op <= index) {
+		lop = op;
+		if (k == XOR_MAX_OPS) {
+			k = 0;
+			desc = list_entry(desc->chain_node.next,
+					  struct ppc440spe_adma_desc_slot,
+					  chain_node);
+			xcb = desc->hw_desc;
+
+		}
+		if ((xcb->ops[k++].h & (DMA_RXOR12 << DMA_CUED_REGION_OFF)) ==
+		    (DMA_RXOR12 << DMA_CUED_REGION_OFF))
+			op += 2;
+		else
+			op += 3;
+	}
+
+	BUG_ON(k < 1);
+	if (test_bit(k-1, desc->reverse_flags)) {
+		/* reverse order */
+		ppc440spe_rxor_set_mult(desc, k - 1, op - index - 1, mult);
+	} else {
+		/* direct order */
+		ppc440spe_rxor_set_mult(desc, k - 1, index - lop, mult);
+	}
+}
+
+/**
+ * ppc440spe_init_rxor_cursor -
+ */
+static void ppc440spe_init_rxor_cursor(struct ppc440spe_rxor *cursor)
+{
+	memset(cursor, 0, sizeof(struct ppc440spe_rxor));
+	cursor->state = 2;
+}
+
+/**
+ * ppc440spe_adma_pq_set_src_mult - set multiplication coefficient into
+ * descriptor for the PQXOR operation
+ */
+static void ppc440spe_adma_pq_set_src_mult(
+		struct ppc440spe_adma_desc_slot *sw_desc,
+		unsigned char mult, int index, int dst_pos)
+{
+	struct ppc440spe_adma_chan *chan;
+	u32 mult_idx, mult_dst;
+	struct ppc440spe_adma_desc_slot *iter = NULL, *iter1 = NULL;
+
+	chan = to_ppc440spe_adma_chan(sw_desc->async_tx.chan);
+
+	switch (chan->device->id) {
+	case PPC440SPE_DMA0_ID:
+	case PPC440SPE_DMA1_ID:
+		if (test_bit(PPC440SPE_DESC_RXOR, &sw_desc->flags)) {
+			int region = test_bit(PPC440SPE_DESC_RXOR12,
+					&sw_desc->flags) ? 2 : 3;
+
+			if (index < region) {
+				/* RXOR multipliers */
+				iter = ppc440spe_get_group_entry(sw_desc,
+					sw_desc->dst_cnt - 1);
+				if (sw_desc->dst_cnt == 2)
+					iter1 = ppc440spe_get_group_entry(
+							sw_desc, 0);
+
+				mult_idx = DMA_CUED_MULT1_OFF + (index << 3);
+				mult_dst = DMA_CDB_SG_SRC;
+			} else {
+				/* WXOR multiplier */
+				iter = ppc440spe_get_group_entry(sw_desc,
+							index - region +
+							sw_desc->dst_cnt);
+				mult_idx = DMA_CUED_MULT1_OFF;
+				mult_dst = dst_pos ? DMA_CDB_SG_DST2 :
+						     DMA_CDB_SG_DST1;
+			}
+		} else {
+			int znum = 0;
+
+			/* WXOR-only;
+			 * skip first slots with destinations (if ZERO_DST has
+			 * place)
+			 */
+			if (test_bit(PPC440SPE_ZERO_P, &sw_desc->flags))
+				znum++;
+			if (test_bit(PPC440SPE_ZERO_Q, &sw_desc->flags))
+				znum++;
+
+			iter = ppc440spe_get_group_entry(sw_desc, index + znum);
+			mult_idx = DMA_CUED_MULT1_OFF;
+			mult_dst = dst_pos ? DMA_CDB_SG_DST2 : DMA_CDB_SG_DST1;
+		}
+
+		if (likely(iter)) {
+			ppc440spe_desc_set_src_mult(iter, chan,
+				mult_idx, mult_dst, mult);
+
+			if (unlikely(iter1)) {
+				/* if we have two destinations for RXOR, then
+				 * we've just set Q mult. Set-up P now.
+				 */
+				ppc440spe_desc_set_src_mult(iter1, chan,
+					mult_idx, mult_dst, 1);
+			}
+
+		}
+		break;
+
+	case PPC440SPE_XOR_ID:
+		iter = sw_desc->group_head;
+		if (sw_desc->dst_cnt == 2) {
+			/* both P & Q calculations required; set P mult here */
+			ppc440spe_adma_dma2rxor_set_mult(iter, index, 1);
+
+			/* and then set Q mult */
+			iter = ppc440spe_get_group_entry(sw_desc,
+			       sw_desc->descs_per_op);
+		}
+		ppc440spe_adma_dma2rxor_set_mult(iter, index, mult);
+		break;
+	}
+}
+
+/**
+ * ppc440spe_adma_free_chan_resources - free the resources allocated
+ */
+static void ppc440spe_adma_free_chan_resources(struct dma_chan *chan)
+{
+	struct ppc440spe_adma_chan *ppc440spe_chan;
+	struct ppc440spe_adma_desc_slot *iter, *_iter;
+	int in_use_descs = 0;
+
+	ppc440spe_chan = to_ppc440spe_adma_chan(chan);
+	ppc440spe_adma_slot_cleanup(ppc440spe_chan);
+
+	spin_lock_bh(&ppc440spe_chan->lock);
+	list_for_each_entry_safe(iter, _iter, &ppc440spe_chan->chain,
+					chain_node) {
+		in_use_descs++;
+		list_del(&iter->chain_node);
+	}
+	list_for_each_entry_safe_reverse(iter, _iter,
+			&ppc440spe_chan->all_slots, slot_node) {
+		list_del(&iter->slot_node);
+		kfree(iter);
+		ppc440spe_chan->slots_allocated--;
+	}
+	ppc440spe_chan->last_used = NULL;
+
+	dev_dbg(ppc440spe_chan->device->common.dev,
+		"ppc440spe adma%d %s slots_allocated %d\n",
+		ppc440spe_chan->device->id,
+		__func__, ppc440spe_chan->slots_allocated);
+	spin_unlock_bh(&ppc440spe_chan->lock);
+
+	/* one is ok since we left it on there on purpose */
+	if (in_use_descs > 1)
+		printk(KERN_ERR "SPE: Freeing %d in use descriptors!\n",
+			in_use_descs - 1);
+}
+
+/**
+ * ppc440spe_adma_is_complete - poll the status of an ADMA transaction
+ * @chan: ADMA channel handle
+ * @cookie: ADMA transaction identifier
+ */
+static enum dma_status ppc440spe_adma_is_complete(struct dma_chan *chan,
+	dma_cookie_t cookie, dma_cookie_t *done, dma_cookie_t *used)
+{
+	struct ppc440spe_adma_chan *ppc440spe_chan;
+	dma_cookie_t last_used;
+	dma_cookie_t last_complete;
+	enum dma_status ret;
+
+	ppc440spe_chan = to_ppc440spe_adma_chan(chan);
+	last_used = chan->cookie;
+	last_complete = ppc440spe_chan->completed_cookie;
+
+	if (done)
+		*done = last_complete;
+	if (used)
+		*used = last_used;
+
+	ret = dma_async_is_complete(cookie, last_complete, last_used);
+	if (ret == DMA_SUCCESS)
+		return ret;
+
+	ppc440spe_adma_slot_cleanup(ppc440spe_chan);
+
+	last_used = chan->cookie;
+	last_complete = ppc440spe_chan->completed_cookie;
+
+	if (done)
+		*done = last_complete;
+	if (used)
+		*used = last_used;
+
+	return dma_async_is_complete(cookie, last_complete, last_used);
+}
+
+/**
+ * ppc440spe_adma_eot_handler - end of transfer interrupt handler
+ */
+static irqreturn_t ppc440spe_adma_eot_handler(int irq, void *data)
+{
+	struct ppc440spe_adma_chan *chan = data;
+
+	dev_dbg(chan->device->common.dev,
+		"ppc440spe adma%d: %s\n", chan->device->id, __func__);
+
+	tasklet_schedule(&chan->irq_tasklet);
+	ppc440spe_adma_device_clear_eot_status(chan);
+
+	return IRQ_HANDLED;
+}
+
+/**
+ * ppc440spe_adma_err_handler - DMA error interrupt handler;
+ *	do the same things as a eot handler
+ */
+static irqreturn_t ppc440spe_adma_err_handler(int irq, void *data)
+{
+	struct ppc440spe_adma_chan *chan = data;
+
+	dev_dbg(chan->device->common.dev,
+		"ppc440spe adma%d: %s\n", chan->device->id, __func__);
+
+	tasklet_schedule(&chan->irq_tasklet);
+	ppc440spe_adma_device_clear_eot_status(chan);
+
+	return IRQ_HANDLED;
+}
+
+/**
+ * ppc440spe_test_callback - called when test operation has been done
+ */
+static void ppc440spe_test_callback(void *unused)
+{
+	complete(&ppc440spe_r6_test_comp);
+}
+
+/**
+ * ppc440spe_adma_issue_pending - flush all pending descriptors to h/w
+ */
+static void ppc440spe_adma_issue_pending(struct dma_chan *chan)
+{
+	struct ppc440spe_adma_chan *ppc440spe_chan;
+
+	ppc440spe_chan = to_ppc440spe_adma_chan(chan);
+	dev_dbg(ppc440spe_chan->device->common.dev,
+		"ppc440spe adma%d: %s %d \n", ppc440spe_chan->device->id,
+		__func__, ppc440spe_chan->pending);
+
+	if (ppc440spe_chan->pending) {
+		ppc440spe_chan->pending = 0;
+		ppc440spe_chan_append(ppc440spe_chan);
+	}
+}
+
+/**
+ * ppc440spe_chan_start_null_xor - initiate the first XOR operation (DMA engines
+ *	use FIFOs (as opposite to chains used in XOR) so this is a XOR
+ *	specific operation)
+ */
+static void ppc440spe_chan_start_null_xor(struct ppc440spe_adma_chan *chan)
+{
+	struct ppc440spe_adma_desc_slot *sw_desc, *group_start;
+	dma_cookie_t cookie;
+	int slot_cnt, slots_per_op;
+
+	dev_dbg(chan->device->common.dev,
+		"ppc440spe adma%d: %s\n", chan->device->id, __func__);
+
+	spin_lock_bh(&chan->lock);
+	slot_cnt = ppc440spe_chan_xor_slot_count(0, 2, &slots_per_op);
+	sw_desc = ppc440spe_adma_alloc_slots(chan, slot_cnt, slots_per_op);
+	if (sw_desc) {
+		group_start = sw_desc->group_head;
+		list_splice_init(&sw_desc->group_list, &chan->chain);
+		async_tx_ack(&sw_desc->async_tx);
+		ppc440spe_desc_init_null_xor(group_start);
+
+		cookie = chan->common.cookie;
+		cookie++;
+		if (cookie <= 1)
+			cookie = 2;
+
+		/* initialize the completed cookie to be less than
+		 * the most recently used cookie
+		 */
+		chan->completed_cookie = cookie - 1;
+		chan->common.cookie = sw_desc->async_tx.cookie = cookie;
+
+		/* channel should not be busy */
+		BUG_ON(ppc440spe_chan_is_busy(chan));
+
+		/* set the descriptor address */
+		ppc440spe_chan_set_first_xor_descriptor(chan, sw_desc);
+
+		/* run the descriptor */
+		ppc440spe_chan_run(chan);
+	} else
+		printk(KERN_ERR "ppc440spe adma%d"
+			" failed to allocate null descriptor\n",
+			chan->device->id);
+	spin_unlock_bh(&chan->lock);
+}
+
+/**
+ * ppc440spe_test_raid6 - test are RAID-6 capabilities enabled successfully.
+ *	For this we just perform one WXOR operation with the same source
+ *	and destination addresses, the GF-multiplier is 1; so if RAID-6
+ *	capabilities are enabled then we'll get src/dst filled with zero.
+ */
+static int ppc440spe_test_raid6(struct ppc440spe_adma_chan *chan)
+{
+	struct ppc440spe_adma_desc_slot *sw_desc, *iter;
+	struct page *pg;
+	char *a;
+	dma_addr_t dma_addr, addrs[2];
+	unsigned long op = 0;
+	int rval = 0;
+
+	set_bit(PPC440SPE_DESC_WXOR, &op);
+
+	pg = alloc_page(GFP_KERNEL);
+	if (!pg)
+		return -ENOMEM;
+
+	spin_lock_bh(&chan->lock);
+	sw_desc = ppc440spe_adma_alloc_slots(chan, 1, 1);
+	if (sw_desc) {
+		/* 1 src, 1 dsr, int_ena, WXOR */
+		ppc440spe_desc_init_dma01pq(sw_desc, 1, 1, 1, op);
+		list_for_each_entry(iter, &sw_desc->group_list, chain_node) {
+			ppc440spe_desc_set_byte_count(iter, chan, PAGE_SIZE);
+			iter->unmap_len = PAGE_SIZE;
+		}
+	} else {
+		rval = -EFAULT;
+		spin_unlock_bh(&chan->lock);
+		goto exit;
+	}
+	spin_unlock_bh(&chan->lock);
+
+	/* Fill the test page with ones */
+	memset(page_address(pg), 0xFF, PAGE_SIZE);
+	dma_addr = dma_map_page(chan->device->dev, pg, 0,
+				PAGE_SIZE, DMA_BIDIRECTIONAL);
+
+	/* Setup addresses */
+	ppc440spe_adma_pq_set_src(sw_desc, dma_addr, 0);
+	ppc440spe_adma_pq_set_src_mult(sw_desc, 1, 0, 0);
+	addrs[0] = dma_addr;
+	addrs[1] = 0;
+	ppc440spe_adma_pq_set_dest(sw_desc, addrs, DMA_PREP_PQ_DISABLE_Q);
+
+	async_tx_ack(&sw_desc->async_tx);
+	sw_desc->async_tx.callback = ppc440spe_test_callback;
+	sw_desc->async_tx.callback_param = NULL;
+
+	init_completion(&ppc440spe_r6_test_comp);
+
+	ppc440spe_adma_tx_submit(&sw_desc->async_tx);
+	ppc440spe_adma_issue_pending(&chan->common);
+
+	wait_for_completion(&ppc440spe_r6_test_comp);
+
+	/* Now check if the test page is zeroed */
+	a = page_address(pg);
+	if ((*(u32 *)a) == 0 && memcmp(a, a+4, PAGE_SIZE-4) == 0) {
+		/* page is zero - RAID-6 enabled */
+		rval = 0;
+	} else {
+		/* RAID-6 was not enabled */
+		rval = -EINVAL;
+	}
+exit:
+	__free_page(pg);
+	return rval;
+}
+
+static void ppc440spe_adma_init_capabilities(struct ppc440spe_adma_device *adev)
+{
+	switch (adev->id) {
+	case PPC440SPE_DMA0_ID:
+	case PPC440SPE_DMA1_ID:
+		dma_cap_set(DMA_MEMCPY, adev->common.cap_mask);
+		dma_cap_set(DMA_INTERRUPT, adev->common.cap_mask);
+		dma_cap_set(DMA_MEMSET, adev->common.cap_mask);
+		dma_cap_set(DMA_PQ, adev->common.cap_mask);
+		dma_cap_set(DMA_PQ_VAL, adev->common.cap_mask);
+		dma_cap_set(DMA_XOR_VAL, adev->common.cap_mask);
+		break;
+	case PPC440SPE_XOR_ID:
+		dma_cap_set(DMA_XOR, adev->common.cap_mask);
+		dma_cap_set(DMA_PQ, adev->common.cap_mask);
+		dma_cap_set(DMA_INTERRUPT, adev->common.cap_mask);
+		adev->common.cap_mask = adev->common.cap_mask;
+		break;
+	}
+
+	/* Set base routines */
+	adev->common.device_alloc_chan_resources =
+				ppc440spe_adma_alloc_chan_resources;
+	adev->common.device_free_chan_resources =
+				ppc440spe_adma_free_chan_resources;
+	adev->common.device_is_tx_complete = ppc440spe_adma_is_complete;
+	adev->common.device_issue_pending = ppc440spe_adma_issue_pending;
+
+	/* Set prep routines based on capability */
+	if (dma_has_cap(DMA_MEMCPY, adev->common.cap_mask)) {
+		adev->common.device_prep_dma_memcpy =
+			ppc440spe_adma_prep_dma_memcpy;
+	}
+	if (dma_has_cap(DMA_MEMSET, adev->common.cap_mask)) {
+		adev->common.device_prep_dma_memset =
+			ppc440spe_adma_prep_dma_memset;
+	}
+	if (dma_has_cap(DMA_XOR, adev->common.cap_mask)) {
+		adev->common.max_xor = XOR_MAX_OPS;
+		adev->common.device_prep_dma_xor =
+			ppc440spe_adma_prep_dma_xor;
+	}
+	if (dma_has_cap(DMA_PQ, adev->common.cap_mask)) {
+		switch (adev->id) {
+		case PPC440SPE_DMA0_ID:
+			dma_set_maxpq(&adev->common,
+				DMA0_FIFO_SIZE / sizeof(struct dma_cdb), 0);
+			break;
+		case PPC440SPE_DMA1_ID:
+			dma_set_maxpq(&adev->common,
+				DMA1_FIFO_SIZE / sizeof(struct dma_cdb), 0);
+			break;
+		case PPC440SPE_XOR_ID:
+			adev->common.max_pq = XOR_MAX_OPS * 3;
+			break;
+		}
+		adev->common.device_prep_dma_pq =
+			ppc440spe_adma_prep_dma_pq;
+	}
+	if (dma_has_cap(DMA_PQ_VAL, adev->common.cap_mask)) {
+		switch (adev->id) {
+		case PPC440SPE_DMA0_ID:
+			adev->common.max_pq = DMA0_FIFO_SIZE /
+						sizeof(struct dma_cdb);
+			break;
+		case PPC440SPE_DMA1_ID:
+			adev->common.max_pq = DMA1_FIFO_SIZE /
+						sizeof(struct dma_cdb);
+			break;
+		}
+		adev->common.device_prep_dma_pq_val =
+			ppc440spe_adma_prep_dma_pqzero_sum;
+	}
+	if (dma_has_cap(DMA_XOR_VAL, adev->common.cap_mask)) {
+		switch (adev->id) {
+		case PPC440SPE_DMA0_ID:
+			adev->common.max_xor = DMA0_FIFO_SIZE /
+						sizeof(struct dma_cdb);
+			break;
+		case PPC440SPE_DMA1_ID:
+			adev->common.max_xor = DMA1_FIFO_SIZE /
+						sizeof(struct dma_cdb);
+			break;
+		}
+		adev->common.device_prep_dma_xor_val =
+			ppc440spe_adma_prep_dma_xor_zero_sum;
+	}
+	if (dma_has_cap(DMA_INTERRUPT, adev->common.cap_mask)) {
+		adev->common.device_prep_dma_interrupt =
+			ppc440spe_adma_prep_dma_interrupt;
+	}
+	pr_info("%s: AMCC(R) PPC440SP(E) ADMA Engine: "
+	  "( %s%s%s%s%s%s%s)\n",
+	  dev_name(adev->dev),
+	  dma_has_cap(DMA_PQ, adev->common.cap_mask) ? "pq " : "",
+	  dma_has_cap(DMA_PQ_VAL, adev->common.cap_mask) ? "pq_val " : "",
+	  dma_has_cap(DMA_XOR, adev->common.cap_mask) ? "xor " : "",
+	  dma_has_cap(DMA_XOR_VAL, adev->common.cap_mask) ? "xor_val " : "",
+	  dma_has_cap(DMA_MEMCPY, adev->common.cap_mask) ? "memcpy " : "",
+	  dma_has_cap(DMA_MEMSET, adev->common.cap_mask)  ? "memset " : "",
+	  dma_has_cap(DMA_INTERRUPT, adev->common.cap_mask) ? "intr " : "");
+}
+
+static int ppc440spe_adma_setup_irqs(struct ppc440spe_adma_device *adev,
+				     struct ppc440spe_adma_chan *chan,
+				     int *initcode)
+{
+	struct device_node *np;
+	int ret;
+
+	np = container_of(adev->dev, struct of_device, dev)->node;
+	if (adev->id != PPC440SPE_XOR_ID) {
+		adev->err_irq = irq_of_parse_and_map(np, 1);
+		if (adev->err_irq == NO_IRQ) {
+			dev_warn(adev->dev, "no err irq resource?\n");
+			*initcode = PPC_ADMA_INIT_IRQ2;
+			adev->err_irq = -ENXIO;
+		} else
+			atomic_inc(&ppc440spe_adma_err_irq_ref);
+	} else {
+		adev->err_irq = -ENXIO;
+	}
+
+	adev->irq = irq_of_parse_and_map(np, 0);
+	if (adev->irq == NO_IRQ) {
+		dev_err(adev->dev, "no irq resource\n");
+		*initcode = PPC_ADMA_INIT_IRQ1;
+		ret = -ENXIO;
+		goto err_irq_map;
+	}
+	dev_dbg(adev->dev, "irq %d, err irq %d\n",
+		adev->irq, adev->err_irq);
+
+	ret = request_irq(adev->irq, ppc440spe_adma_eot_handler,
+			  0, dev_driver_string(adev->dev), chan);
+	if (ret) {
+		dev_err(adev->dev, "can't request irq %d\n",
+			adev->irq);
+		*initcode = PPC_ADMA_INIT_IRQ1;
+		ret = -EIO;
+		goto err_req1;
+	}
+
+	/* only DMA engines have a separate error IRQ
+	 * so it's Ok if err_irq < 0 in XOR engine case.
+	 */
+	if (adev->err_irq > 0) {
+		/* both DMA engines share common error IRQ */
+		ret = request_irq(adev->err_irq,
+				  ppc440spe_adma_err_handler,
+				  IRQF_SHARED,
+				  dev_driver_string(adev->dev),
+				  chan);
+		if (ret) {
+			dev_err(adev->dev, "can't request irq %d\n",
+				adev->err_irq);
+			*initcode = PPC_ADMA_INIT_IRQ2;
+			ret = -EIO;
+			goto err_req2;
+		}
+	}
+
+	if (adev->id == PPC440SPE_XOR_ID) {
+		/* enable XOR engine interrupts */
+		iowrite32be(XOR_IE_CBCIE_BIT | XOR_IE_ICBIE_BIT |
+			    XOR_IE_ICIE_BIT | XOR_IE_RPTIE_BIT,
+			    &adev->xor_reg->ier);
+	} else {
+		u32 mask, enable;
+
+		np = of_find_compatible_node(NULL, NULL, "ibm,i2o-440spe");
+		if (!np) {
+			pr_err("%s: can't find I2O device tree node\n",
+				__func__);
+			ret = -ENODEV;
+			goto err_req2;
+		}
+		adev->i2o_reg = of_iomap(np, 0);
+		if (!adev->i2o_reg) {
+			pr_err("%s: failed to map I2O registers\n", __func__);
+			of_node_put(np);
+			ret = -EINVAL;
+			goto err_req2;
+		}
+		of_node_put(np);
+		/* Unmask 'CS FIFO Attention' interrupts and
+		 * enable generating interrupts on errors
+		 */
+		enable = (adev->id == PPC440SPE_DMA0_ID) ?
+			 ~(I2O_IOPIM_P0SNE | I2O_IOPIM_P0EM) :
+			 ~(I2O_IOPIM_P1SNE | I2O_IOPIM_P1EM);
+		mask = ioread32(&adev->i2o_reg->iopim) & enable;
+		iowrite32(mask, &adev->i2o_reg->iopim);
+	}
+	return 0;
+
+err_req2:
+	free_irq(adev->irq, chan);
+err_req1:
+	irq_dispose_mapping(adev->irq);
+err_irq_map:
+	if (adev->err_irq > 0) {
+		if (atomic_dec_and_test(&ppc440spe_adma_err_irq_ref))
+			irq_dispose_mapping(adev->err_irq);
+	}
+	return ret;
+}
+
+static void ppc440spe_adma_release_irqs(struct ppc440spe_adma_device *adev,
+					struct ppc440spe_adma_chan *chan)
+{
+	u32 mask, disable;
+
+	if (adev->id == PPC440SPE_XOR_ID) {
+		/* disable XOR engine interrupts */
+		mask = ioread32be(&adev->xor_reg->ier);
+		mask &= ~(XOR_IE_CBCIE_BIT | XOR_IE_ICBIE_BIT |
+			  XOR_IE_ICIE_BIT | XOR_IE_RPTIE_BIT);
+		iowrite32be(mask, &adev->xor_reg->ier);
+	} else {
+		/* disable DMAx engine interrupts */
+		disable = (adev->id == PPC440SPE_DMA0_ID) ?
+			  (I2O_IOPIM_P0SNE | I2O_IOPIM_P0EM) :
+			  (I2O_IOPIM_P1SNE | I2O_IOPIM_P1EM);
+		mask = ioread32(&adev->i2o_reg->iopim) | disable;
+		iowrite32(mask, &adev->i2o_reg->iopim);
+	}
+	free_irq(adev->irq, chan);
+	irq_dispose_mapping(adev->irq);
+	if (adev->err_irq > 0) {
+		free_irq(adev->err_irq, chan);
+		if (atomic_dec_and_test(&ppc440spe_adma_err_irq_ref)) {
+			irq_dispose_mapping(adev->err_irq);
+			iounmap(adev->i2o_reg);
+		}
+	}
+}
+
+/**
+ * ppc440spe_adma_probe - probe the asynch device
+ */
+static int __devinit ppc440spe_adma_probe(struct of_device *ofdev,
+					  const struct of_device_id *match)
+{
+	struct device_node *np = ofdev->node;
+	struct resource res;
+	struct ppc440spe_adma_device *adev;
+	struct ppc440spe_adma_chan *chan;
+	struct ppc_dma_chan_ref *ref, *_ref;
+	int ret = 0, initcode = PPC_ADMA_INIT_OK;
+	const u32 *idx;
+	int len;
+	void *regs;
+	u32 id, pool_size;
+
+	if (of_device_is_compatible(np, "amcc,xor-accelerator")) {
+		id = PPC440SPE_XOR_ID;
+		/* As far as the XOR engine is concerned, it does not
+		 * use FIFOs but uses linked list. So there is no dependency
+		 * between pool size to allocate and the engine configuration.
+		 */
+		pool_size = PAGE_SIZE << 1;
+	} else {
+		/* it is DMA0 or DMA1 */
+		idx = of_get_property(np, "cell-index", &len);
+		if (!idx || (len != sizeof(u32))) {
+			dev_err(&ofdev->dev, "Device node %s has missing "
+				"or invalid cell-index property\n",
+				np->full_name);
+			return -EINVAL;
+		}
+		id = *idx;
+		/* DMA0,1 engines use FIFO to maintain CDBs, so we
+		 * should allocate the pool accordingly to size of this
+		 * FIFO. Thus, the pool size depends on the FIFO depth:
+		 * how much CDBs pointers the FIFO may contain then so
+		 * much CDBs we should provide in the pool.
+		 * That is
+		 *   CDB size = 32B;
+		 *   CDBs number = (DMA0_FIFO_SIZE >> 3);
+		 *   Pool size = CDBs number * CDB size =
+		 *      = (DMA0_FIFO_SIZE >> 3) << 5 = DMA0_FIFO_SIZE << 2.
+		 */
+		pool_size = (id == PPC440SPE_DMA0_ID) ?
+			    DMA0_FIFO_SIZE : DMA1_FIFO_SIZE;
+		pool_size <<= 2;
+	}
+
+	if (of_address_to_resource(np, 0, &res)) {
+		dev_err(&ofdev->dev, "failed to get memory resource\n");
+		initcode = PPC_ADMA_INIT_MEMRES;
+		ret = -ENODEV;
+		goto out;
+	}
+
+	if (!request_mem_region(res.start, resource_size(&res),
+				dev_driver_string(&ofdev->dev))) {
+		dev_err(&ofdev->dev, "failed to request memory region "
+			"(0x%016llx-0x%016llx)\n",
+			(u64)res.start, (u64)res.end);
+		initcode = PPC_ADMA_INIT_MEMREG;
+		ret = -EBUSY;
+		goto out;
+	}
+
+	/* create a device */
+	adev = kzalloc(sizeof(*adev), GFP_KERNEL);
+	if (!adev) {
+		dev_err(&ofdev->dev, "failed to allocate device\n");
+		initcode = PPC_ADMA_INIT_ALLOC;
+		ret = -ENOMEM;
+		goto err_adev_alloc;
+	}
+
+	adev->id = id;
+	adev->pool_size = pool_size;
+	/* allocate coherent memory for hardware descriptors */
+	adev->dma_desc_pool_virt = dma_alloc_coherent(&ofdev->dev,
+					adev->pool_size, &adev->dma_desc_pool,
+					GFP_KERNEL);
+	if (adev->dma_desc_pool_virt == NULL) {
+		dev_err(&ofdev->dev, "failed to allocate %d bytes of coherent "
+			"memory for hardware descriptors\n",
+			adev->pool_size);
+		initcode = PPC_ADMA_INIT_COHERENT;
+		ret = -ENOMEM;
+		goto err_dma_alloc;
+	}
+	dev_dbg(&ofdev->dev, "allocted descriptor pool virt 0x%p phys 0x%llx\n",
+		adev->dma_desc_pool_virt, (u64)adev->dma_desc_pool);
+
+	regs = ioremap(res.start, resource_size(&res));
+	if (!regs) {
+		dev_err(&ofdev->dev, "failed to ioremap regs!\n");
+		goto err_regs_alloc;
+	}
+
+	if (adev->id == PPC440SPE_XOR_ID) {
+		adev->xor_reg = regs;
+		/* Reset XOR */
+		iowrite32be(XOR_CRSR_XASR_BIT, &adev->xor_reg->crsr);
+		iowrite32be(XOR_CRSR_64BA_BIT, &adev->xor_reg->crrr);
+	} else {
+		size_t fifo_size = (adev->id == PPC440SPE_DMA0_ID) ?
+				   DMA0_FIFO_SIZE : DMA1_FIFO_SIZE;
+		adev->dma_reg = regs;
+		/* DMAx_FIFO_SIZE is defined in bytes,
+		 * <fsiz> - is defined in number of CDB pointers (8byte).
+		 * DMA FIFO Length = CSlength + CPlength, where
+		 * CSlength = CPlength = (fsiz + 1) * 8.
+		 */
+		iowrite32(DMA_FIFO_ENABLE | ((fifo_size >> 3) - 2),
+			  &adev->dma_reg->fsiz);
+		/* Configure DMA engine */
+		iowrite32(DMA_CFG_DXEPR_HP | DMA_CFG_DFMPP_HP | DMA_CFG_FALGN,
+			  &adev->dma_reg->cfg);
+		/* Clear Status */
+		iowrite32(~0, &adev->dma_reg->dsts);
+	}
+
+	adev->dev = &ofdev->dev;
+	adev->common.dev = &ofdev->dev;
+	INIT_LIST_HEAD(&adev->common.channels);
+	dev_set_drvdata(&ofdev->dev, adev);
+
+	/* create a channel */
+	chan = kzalloc(sizeof(*chan), GFP_KERNEL);
+	if (!chan) {
+		dev_err(&ofdev->dev, "can't allocate channel structure\n");
+		initcode = PPC_ADMA_INIT_CHANNEL;
+		ret = -ENOMEM;
+		goto err_chan_alloc;
+	}
+
+	spin_lock_init(&chan->lock);
+	INIT_LIST_HEAD(&chan->chain);
+	INIT_LIST_HEAD(&chan->all_slots);
+	chan->device = adev;
+	chan->common.device = &adev->common;
+	list_add_tail(&chan->common.device_node, &adev->common.channels);
+	tasklet_init(&chan->irq_tasklet, ppc440spe_adma_tasklet,
+		     (unsigned long)chan);
+
+	/* allocate and map helper pages for async validation or
+	 * async_mult/async_sum_product operations on DMA0/1.
+	 */
+	if (adev->id != PPC440SPE_XOR_ID) {
+		chan->pdest_page = alloc_page(GFP_KERNEL);
+		chan->qdest_page = alloc_page(GFP_KERNEL);
+		if (!chan->pdest_page ||
+		    !chan->qdest_page) {
+			if (chan->pdest_page)
+				__free_page(chan->pdest_page);
+			if (chan->qdest_page)
+				__free_page(chan->qdest_page);
+			ret = -ENOMEM;
+			goto err_page_alloc;
+		}
+		chan->pdest = dma_map_page(&ofdev->dev, chan->pdest_page, 0,
+					   PAGE_SIZE, DMA_BIDIRECTIONAL);
+		chan->qdest = dma_map_page(&ofdev->dev, chan->qdest_page, 0,
+					   PAGE_SIZE, DMA_BIDIRECTIONAL);
+	}
+
+	ref = kmalloc(sizeof(*ref), GFP_KERNEL);
+	if (ref) {
+		ref->chan = &chan->common;
+		INIT_LIST_HEAD(&ref->node);
+		list_add_tail(&ref->node, &ppc440spe_adma_chan_list);
+	} else {
+		dev_err(&ofdev->dev, "failed to allocate channel reference!\n");
+		ret = -ENOMEM;
+		goto err_ref_alloc;
+	}
+
+	ret = ppc440spe_adma_setup_irqs(adev, chan, &initcode);
+	if (ret)
+		goto err_irq;
+
+	ppc440spe_adma_init_capabilities(adev);
+
+	ret = dma_async_device_register(&adev->common);
+	if (ret) {
+		initcode = PPC_ADMA_INIT_REGISTER;
+		dev_err(&ofdev->dev, "failed to register dma device\n");
+		goto err_dev_reg;
+	}
+
+	goto out;
+
+err_dev_reg:
+	ppc440spe_adma_release_irqs(adev, chan);
+err_irq:
+	list_for_each_entry_safe(ref, _ref, &ppc440spe_adma_chan_list, node) {
+		if (chan == to_ppc440spe_adma_chan(ref->chan)) {
+			list_del(&ref->node);
+			kfree(ref);
+		}
+	}
+err_ref_alloc:
+	if (adev->id != PPC440SPE_XOR_ID) {
+		dma_unmap_page(&ofdev->dev, chan->pdest,
+			       PAGE_SIZE, DMA_BIDIRECTIONAL);
+		dma_unmap_page(&ofdev->dev, chan->qdest,
+			       PAGE_SIZE, DMA_BIDIRECTIONAL);
+		__free_page(chan->pdest_page);
+		__free_page(chan->qdest_page);
+	}
+err_page_alloc:
+	kfree(chan);
+err_chan_alloc:
+	if (adev->id == PPC440SPE_XOR_ID)
+		iounmap(adev->xor_reg);
+	else
+		iounmap(adev->dma_reg);
+err_regs_alloc:
+	dma_free_coherent(adev->dev, adev->pool_size,
+			  adev->dma_desc_pool_virt,
+			  adev->dma_desc_pool);
+err_dma_alloc:
+	kfree(adev);
+err_adev_alloc:
+	release_mem_region(res.start, resource_size(&res));
+out:
+	if (id < PPC440SPE_ADMA_ENGINES_NUM)
+		ppc440spe_adma_devices[id] = initcode;
+
+	return ret;
+}
+
+/**
+ * ppc440spe_adma_remove - remove the asynch device
+ */
+static int __devexit ppc440spe_adma_remove(struct of_device *ofdev)
+{
+	struct ppc440spe_adma_device *adev = dev_get_drvdata(&ofdev->dev);
+	struct device_node *np = ofdev->node;
+	struct resource res;
+	struct dma_chan *chan, *_chan;
+	struct ppc_dma_chan_ref *ref, *_ref;
+	struct ppc440spe_adma_chan *ppc440spe_chan;
+
+	dev_set_drvdata(&ofdev->dev, NULL);
+	if (adev->id < PPC440SPE_ADMA_ENGINES_NUM)
+		ppc440spe_adma_devices[adev->id] = -1;
+
+	dma_async_device_unregister(&adev->common);
+
+	list_for_each_entry_safe(chan, _chan, &adev->common.channels,
+				 device_node) {
+		ppc440spe_chan = to_ppc440spe_adma_chan(chan);
+		ppc440spe_adma_release_irqs(adev, ppc440spe_chan);
+		tasklet_kill(&ppc440spe_chan->irq_tasklet);
+		if (adev->id != PPC440SPE_XOR_ID) {
+			dma_unmap_page(&ofdev->dev, ppc440spe_chan->pdest,
+					PAGE_SIZE, DMA_BIDIRECTIONAL);
+			dma_unmap_page(&ofdev->dev, ppc440spe_chan->qdest,
+					PAGE_SIZE, DMA_BIDIRECTIONAL);
+			__free_page(ppc440spe_chan->pdest_page);
+			__free_page(ppc440spe_chan->qdest_page);
+		}
+		list_for_each_entry_safe(ref, _ref, &ppc440spe_adma_chan_list,
+					 node) {
+			if (ppc440spe_chan ==
+			    to_ppc440spe_adma_chan(ref->chan)) {
+				list_del(&ref->node);
+				kfree(ref);
+			}
+		}
+		list_del(&chan->device_node);
+		kfree(ppc440spe_chan);
+	}
+
+	dma_free_coherent(adev->dev, adev->pool_size,
+			  adev->dma_desc_pool_virt, adev->dma_desc_pool);
+	if (adev->id == PPC440SPE_XOR_ID)
+		iounmap(adev->xor_reg);
+	else
+		iounmap(adev->dma_reg);
+	of_address_to_resource(np, 0, &res);
+	release_mem_region(res.start, resource_size(&res));
+	kfree(adev);
+	return 0;
+}
+
+/*
+ * /sys driver interface to enable h/w RAID-6 capabilities
+ * Files created in e.g. /sys/devices/plb.0/400100100.dma0/driver/
+ * directory are "devices", "enable" and "poly".
+ * "devices" shows available engines.
+ * "enable" is used to enable RAID-6 capabilities or to check
+ * whether these has been activated.
+ * "poly" allows setting/checking used polynomial (for PPC440SPe only).
+ */
+
+static ssize_t show_ppc440spe_devices(struct device_driver *dev, char *buf)
+{
+	ssize_t size = 0;
+	int i;
+
+	for (i = 0; i < PPC440SPE_ADMA_ENGINES_NUM; i++) {
+		if (ppc440spe_adma_devices[i] == -1)
+			continue;
+		size += snprintf(buf + size, PAGE_SIZE - size,
+				 "PPC440SP(E)-ADMA.%d: %s\n", i,
+				 ppc_adma_errors[ppc440spe_adma_devices[i]]);
+	}
+	return size;
+}
+
+static ssize_t show_ppc440spe_r6enable(struct device_driver *dev, char *buf)
+{
+	return snprintf(buf, PAGE_SIZE,
+			"PPC440SP(e) RAID-6 capabilities are %sABLED.\n",
+			ppc440spe_r6_enabled ? "EN" : "DIS");
+}
+
+static ssize_t store_ppc440spe_r6enable(struct device_driver *dev,
+					const char *buf, size_t count)
+{
+	unsigned long val;
+
+	if (!count || count > 11)
+		return -EINVAL;
+
+	if (!ppc440spe_r6_tchan)
+		return -EFAULT;
+
+	/* Write a key */
+	sscanf(buf, "%lx", &val);
+	dcr_write(ppc440spe_mq_dcr_host, DCRN_MQ0_XORBA, val);
+	isync();
+
+	/* Verify whether it really works now */
+	if (ppc440spe_test_raid6(ppc440spe_r6_tchan) == 0) {
+		pr_info("PPC440SP(e) RAID-6 has been activated "
+			"successfully\n");
+		ppc440spe_r6_enabled = 1;
+	} else {
+		pr_info("PPC440SP(e) RAID-6 hasn't been activated!"
+			" Error key ?\n");
+		ppc440spe_r6_enabled = 0;
+	}
+	return count;
+}
+
+static ssize_t show_ppc440spe_r6poly(struct device_driver *dev, char *buf)
+{
+	ssize_t size = 0;
+	u32 reg;
+
+#ifdef CONFIG_440SP
+	/* 440SP has fixed polynomial */
+	reg = 0x4d;
+#else
+	reg = dcr_read(ppc440spe_mq_dcr_host, DCRN_MQ0_CFBHL);
+	reg >>= MQ0_CFBHL_POLY;
+	reg &= 0xFF;
+#endif
+
+	size = snprintf(buf, PAGE_SIZE, "PPC440SP(e) RAID-6 driver "
+			"uses 0x1%02x polynomial.\n", reg);
+	return size;
+}
+
+static ssize_t store_ppc440spe_r6poly(struct device_driver *dev,
+				      const char *buf, size_t count)
+{
+	unsigned long reg, val;
+
+#ifdef CONFIG_440SP
+	/* 440SP uses default 0x14D polynomial only */
+	return -EINVAL;
+#endif
+
+	if (!count || count > 6)
+		return -EINVAL;
+
+	/* e.g., 0x14D or 0x11D */
+	sscanf(buf, "%lx", &val);
+
+	if (val & ~0x1FF)
+		return -EINVAL;
+
+	val &= 0xFF;
+	reg = dcr_read(ppc440spe_mq_dcr_host, DCRN_MQ0_CFBHL);
+	reg &= ~(0xFF << MQ0_CFBHL_POLY);
+	reg |= val << MQ0_CFBHL_POLY;
+	dcr_write(ppc440spe_mq_dcr_host, DCRN_MQ0_CFBHL, reg);
+
+	return count;
+}
+
+static DRIVER_ATTR(devices, S_IRUGO, show_ppc440spe_devices, NULL);
+static DRIVER_ATTR(enable, S_IRUGO | S_IWUSR, show_ppc440spe_r6enable,
+		   store_ppc440spe_r6enable);
+static DRIVER_ATTR(poly, S_IRUGO | S_IWUSR, show_ppc440spe_r6poly,
+		   store_ppc440spe_r6poly);
+
+/*
+ * Common initialisation for RAID engines; allocate memory for
+ * DMAx FIFOs, perform configuration common for all DMA engines.
+ * Further DMA engine specific configuration is done at probe time.
+ */
+static int ppc440spe_configure_raid_devices(void)
+{
+	struct device_node *np;
+	struct resource i2o_res;
+	struct i2o_regs __iomem *i2o_reg;
+	dcr_host_t i2o_dcr_host;
+	unsigned int dcr_base, dcr_len;
+	int i, ret;
+
+	np = of_find_compatible_node(NULL, NULL, "ibm,i2o-440spe");
+	if (!np) {
+		pr_err("%s: can't find I2O device tree node\n",
+			__func__);
+		return -ENODEV;
+	}
+
+	if (of_address_to_resource(np, 0, &i2o_res)) {
+		of_node_put(np);
+		return -EINVAL;
+	}
+
+	i2o_reg = of_iomap(np, 0);
+	if (!i2o_reg) {
+		pr_err("%s: failed to map I2O registers\n", __func__);
+		of_node_put(np);
+		return -EINVAL;
+	}
+
+	/* Get I2O DCRs base */
+	dcr_base = dcr_resource_start(np, 0);
+	dcr_len = dcr_resource_len(np, 0);
+	if (!dcr_base && !dcr_len) {
+		pr_err("%s: can't get DCR registers base/len!\n",
+			np->full_name);
+		of_node_put(np);
+		iounmap(i2o_reg);
+		return -ENODEV;
+	}
+
+	i2o_dcr_host = dcr_map(np, dcr_base, dcr_len);
+	if (!DCR_MAP_OK(i2o_dcr_host)) {
+		pr_err("%s: failed to map DCRs!\n", np->full_name);
+		of_node_put(np);
+		iounmap(i2o_reg);
+		return -ENODEV;
+	}
+	of_node_put(np);
+
+	/* Provide memory regions for DMA's FIFOs: I2O, DMA0 and DMA1 share
+	 * the base address of FIFO memory space.
+	 * Actually we need twice more physical memory than programmed in the
+	 * <fsiz> register (because there are two FIFOs for each DMA: CP and CS)
+	 */
+	ppc440spe_dma_fifo_buf = kmalloc((DMA0_FIFO_SIZE + DMA1_FIFO_SIZE) << 1,
+					 GFP_KERNEL);
+	if (!ppc440spe_dma_fifo_buf) {
+		pr_err("%s: DMA FIFO buffer allocation failed.\n", __func__);
+		iounmap(i2o_reg);
+		dcr_unmap(i2o_dcr_host, dcr_len);
+		return -ENOMEM;
+	}
+
+	/*
+	 * Configure h/w
+	 */
+	/* Reset I2O/DMA */
+	mtdcri(SDR0, DCRN_SDR0_SRST, DCRN_SDR0_SRST_I2ODMA);
+	mtdcri(SDR0, DCRN_SDR0_SRST, 0);
+
+	/* Setup the base address of mmaped registers */
+	dcr_write(i2o_dcr_host, DCRN_I2O0_IBAH, (u32)(i2o_res.start >> 32));
+	dcr_write(i2o_dcr_host, DCRN_I2O0_IBAL, (u32)(i2o_res.start) |
+						I2O_REG_ENABLE);
+	dcr_unmap(i2o_dcr_host, dcr_len);
+
+	/* Setup FIFO memory space base address */
+	iowrite32(0, &i2o_reg->ifbah);
+	iowrite32(((u32)__pa(ppc440spe_dma_fifo_buf)), &i2o_reg->ifbal);
+
+	/* set zero FIFO size for I2O, so the whole
+	 * ppc440spe_dma_fifo_buf is used by DMAs.
+	 * DMAx_FIFOs will be configured while probe.
+	 */
+	iowrite32(0, &i2o_reg->ifsiz);
+	iounmap(i2o_reg);
+
+	/* To prepare WXOR/RXOR functionality we need access to
+	 * Memory Queue Module DCRs (finally it will be enabled
+	 * via /sys interface of the ppc440spe ADMA driver).
+	 */
+	np = of_find_compatible_node(NULL, NULL, "ibm,mq-440spe");
+	if (!np) {
+		pr_err("%s: can't find MQ device tree node\n",
+			__func__);
+		ret = -ENODEV;
+		goto out_free;
+	}
+
+	/* Get MQ DCRs base */
+	dcr_base = dcr_resource_start(np, 0);
+	dcr_len = dcr_resource_len(np, 0);
+	if (!dcr_base && !dcr_len) {
+		pr_err("%s: can't get DCR registers base/len!\n",
+			np->full_name);
+		ret = -ENODEV;
+		goto out_mq;
+	}
+
+	ppc440spe_mq_dcr_host = dcr_map(np, dcr_base, dcr_len);
+	if (!DCR_MAP_OK(ppc440spe_mq_dcr_host)) {
+		pr_err("%s: failed to map DCRs!\n", np->full_name);
+		ret = -ENODEV;
+		goto out_mq;
+	}
+	of_node_put(np);
+	ppc440spe_mq_dcr_len = dcr_len;
+
+	/* Set HB alias */
+	dcr_write(ppc440spe_mq_dcr_host, DCRN_MQ0_BAUH, DMA_CUED_XOR_HB);
+
+	/* Set:
+	 * - LL transaction passing limit to 1;
+	 * - Memory controller cycle limit to 1;
+	 * - Galois Polynomial to 0x14d (default)
+	 */
+	dcr_write(ppc440spe_mq_dcr_host, DCRN_MQ0_CFBHL,
+		  (1 << MQ0_CFBHL_TPLM) | (1 << MQ0_CFBHL_HBCL) |
+		  (PPC440SPE_DEFAULT_POLY << MQ0_CFBHL_POLY));
+
+	atomic_set(&ppc440spe_adma_err_irq_ref, 0);
+	for (i = 0; i < PPC440SPE_ADMA_ENGINES_NUM; i++)
+		ppc440spe_adma_devices[i] = -1;
+
+	return 0;
+
+out_mq:
+	of_node_put(np);
+out_free:
+	kfree(ppc440spe_dma_fifo_buf);
+	return ret;
+}
+
+static struct of_device_id __devinitdata ppc440spe_adma_of_match[] = {
+	{ .compatible	= "ibm,dma-440spe", },
+	{ .compatible	= "amcc,xor-accelerator", },
+	{},
+};
+MODULE_DEVICE_TABLE(of, ppc440spe_adma_of_match);
+
+static struct of_platform_driver ppc440spe_adma_driver = {
+	.match_table = ppc440spe_adma_of_match,
+	.probe = ppc440spe_adma_probe,
+	.remove = __devexit_p(ppc440spe_adma_remove),
+	.driver = {
+		.name = "PPC440SP(E)-ADMA",
+		.owner = THIS_MODULE,
+	},
+};
+
+static __init int ppc440spe_adma_init(void)
+{
+	int ret;
+
+	ret = ppc440spe_configure_raid_devices();
+	if (ret)
+		return ret;
+
+	ret = of_register_platform_driver(&ppc440spe_adma_driver);
+	if (ret) {
+		pr_err("%s: failed to register platform driver\n",
+			__func__);
+		goto out_reg;
+	}
+
+	/* Initialization status */
+	ret = driver_create_file(&ppc440spe_adma_driver.driver,
+				 &driver_attr_devices);
+	if (ret)
+		goto out_dev;
+
+	/* RAID-6 h/w enable entry */
+	ret = driver_create_file(&ppc440spe_adma_driver.driver,
+				 &driver_attr_enable);
+	if (ret)
+		goto out_en;
+
+	/* GF polynomial to use */
+	ret = driver_create_file(&ppc440spe_adma_driver.driver,
+				 &driver_attr_poly);
+	if (!ret)
+		return ret;
+
+	driver_remove_file(&ppc440spe_adma_driver.driver,
+			   &driver_attr_enable);
+out_en:
+	driver_remove_file(&ppc440spe_adma_driver.driver,
+			   &driver_attr_devices);
+out_dev:
+	/* User will not be able to enable h/w RAID-6 */
+	pr_err("%s: failed to create RAID-6 driver interface\n",
+		__func__);
+	of_unregister_platform_driver(&ppc440spe_adma_driver);
+out_reg:
+	dcr_unmap(ppc440spe_mq_dcr_host, ppc440spe_mq_dcr_len);
+	kfree(ppc440spe_dma_fifo_buf);
+	return ret;
+}
+
+static void __exit ppc440spe_adma_exit(void)
+{
+	driver_remove_file(&ppc440spe_adma_driver.driver,
+			   &driver_attr_poly);
+	driver_remove_file(&ppc440spe_adma_driver.driver,
+			   &driver_attr_enable);
+	driver_remove_file(&ppc440spe_adma_driver.driver,
+			   &driver_attr_devices);
+	of_unregister_platform_driver(&ppc440spe_adma_driver);
+	dcr_unmap(ppc440spe_mq_dcr_host, ppc440spe_mq_dcr_len);
+	kfree(ppc440spe_dma_fifo_buf);
+}
+
+arch_initcall(ppc440spe_adma_init);
+module_exit(ppc440spe_adma_exit);
+
+MODULE_AUTHOR("Yuri Tikhonov <yur@emcraft.com>");
+MODULE_DESCRIPTION("PPC440SPE ADMA Engine Driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/dma/ppc4xx/adma.h b/drivers/dma/ppc4xx/adma.h
new file mode 100644
index 000000000000..8ada5a812e3b
--- /dev/null
+++ b/drivers/dma/ppc4xx/adma.h
@@ -0,0 +1,195 @@
+/*
+ * 2006-2009 (C) DENX Software Engineering.
+ *
+ * Author: Yuri Tikhonov <yur@emcraft.com>
+ *
+ * This file is licensed under the terms of the GNU General Public License
+ * version 2.  This program is licensed "as is" without any warranty of
+ * any kind, whether express or implied.
+ */
+
+#ifndef _PPC440SPE_ADMA_H
+#define _PPC440SPE_ADMA_H
+
+#include <linux/types.h>
+#include "dma.h"
+#include "xor.h"
+
+#define to_ppc440spe_adma_chan(chan) \
+		container_of(chan, struct ppc440spe_adma_chan, common)
+#define to_ppc440spe_adma_device(dev) \
+		container_of(dev, struct ppc440spe_adma_device, common)
+#define tx_to_ppc440spe_adma_slot(tx) \
+		container_of(tx, struct ppc440spe_adma_desc_slot, async_tx)
+
+/* Default polynomial (for 440SP is only available) */
+#define PPC440SPE_DEFAULT_POLY	0x4d
+
+#define PPC440SPE_ADMA_ENGINES_NUM	(XOR_ENGINES_NUM + DMA_ENGINES_NUM)
+
+#define PPC440SPE_ADMA_WATCHDOG_MSEC	3
+#define PPC440SPE_ADMA_THRESHOLD	1
+
+#define PPC440SPE_DMA0_ID	0
+#define PPC440SPE_DMA1_ID	1
+#define PPC440SPE_XOR_ID	2
+
+#define PPC440SPE_ADMA_DMA_MAX_BYTE_COUNT	0xFFFFFFUL
+/* this is the XOR_CBBCR width */
+#define PPC440SPE_ADMA_XOR_MAX_BYTE_COUNT	(1 << 31)
+#define PPC440SPE_ADMA_ZERO_SUM_MAX_BYTE_COUNT PPC440SPE_ADMA_XOR_MAX_BYTE_COUNT
+
+#define PPC440SPE_RXOR_RUN	0
+
+#define MQ0_CF2H_RXOR_BS_MASK	0x1FF
+
+#undef ADMA_LL_DEBUG
+
+/**
+ * struct ppc440spe_adma_device - internal representation of an ADMA device
+ * @dev: device
+ * @dma_reg: base for DMAx register access
+ * @xor_reg: base for XOR register access
+ * @i2o_reg: base for I2O register access
+ * @id: HW ADMA Device selector
+ * @dma_desc_pool_virt: base of DMA descriptor region (CPU address)
+ * @dma_desc_pool: base of DMA descriptor region (DMA address)
+ * @pool_size: size of the pool
+ * @irq: DMAx or XOR irq number
+ * @err_irq: DMAx error irq number
+ * @common: embedded struct dma_device
+ */
+struct ppc440spe_adma_device {
+	struct device *dev;
+	struct dma_regs __iomem *dma_reg;
+	struct xor_regs __iomem *xor_reg;
+	struct i2o_regs __iomem *i2o_reg;
+	int id;
+	void *dma_desc_pool_virt;
+	dma_addr_t dma_desc_pool;
+	size_t pool_size;
+	int irq;
+	int err_irq;
+	struct dma_device common;
+};
+
+/**
+ * struct ppc440spe_adma_chan - internal representation of an ADMA channel
+ * @lock: serializes enqueue/dequeue operations to the slot pool
+ * @device: parent device
+ * @chain: device chain view of the descriptors
+ * @common: common dmaengine channel object members
+ * @all_slots: complete domain of slots usable by the channel
+ * @pending: allows batching of hardware operations
+ * @completed_cookie: identifier for the most recently completed operation
+ * @slots_allocated: records the actual size of the descriptor slot pool
+ * @hw_chain_inited: h/w descriptor chain initialization flag
+ * @irq_tasklet: bottom half where ppc440spe_adma_slot_cleanup runs
+ * @needs_unmap: if buffers should not be unmapped upon final processing
+ * @pdest_page: P destination page for async validate operation
+ * @qdest_page: Q destination page for async validate operation
+ * @pdest: P dma addr for async validate operation
+ * @qdest: Q dma addr for async validate operation
+ */
+struct ppc440spe_adma_chan {
+	spinlock_t lock;
+	struct ppc440spe_adma_device *device;
+	struct list_head chain;
+	struct dma_chan common;
+	struct list_head all_slots;
+	struct ppc440spe_adma_desc_slot *last_used;
+	int pending;
+	dma_cookie_t completed_cookie;
+	int slots_allocated;
+	int hw_chain_inited;
+	struct tasklet_struct irq_tasklet;
+	u8 needs_unmap;
+	struct page *pdest_page;
+	struct page *qdest_page;
+	dma_addr_t pdest;
+	dma_addr_t qdest;
+};
+
+struct ppc440spe_rxor {
+	u32 addrl;
+	u32 addrh;
+	int len;
+	int xor_count;
+	int addr_count;
+	int desc_count;
+	int state;
+};
+
+/**
+ * struct ppc440spe_adma_desc_slot - PPC440SPE-ADMA software descriptor
+ * @phys: hardware address of the hardware descriptor chain
+ * @group_head: first operation in a transaction
+ * @hw_next: pointer to the next descriptor in chain
+ * @async_tx: support for the async_tx api
+ * @slot_node: node on the iop_adma_chan.all_slots list
+ * @chain_node: node on the op_adma_chan.chain list
+ * @group_list: list of slots that make up a multi-descriptor transaction
+ *              for example transfer lengths larger than the supported hw max
+ * @unmap_len: transaction bytecount
+ * @hw_desc: virtual address of the hardware descriptor chain
+ * @stride: currently chained or not
+ * @idx: pool index
+ * @slot_cnt: total slots used in an transaction (group of operations)
+ * @src_cnt: number of sources set in this descriptor
+ * @dst_cnt: number of destinations set in the descriptor
+ * @slots_per_op: number of slots per operation
+ * @descs_per_op: number of slot per P/Q operation see comment
+ *                for ppc440spe_prep_dma_pqxor function
+ * @flags: desc state/type
+ * @reverse_flags: 1 if a corresponding rxor address uses reversed address order
+ * @xor_check_result: result of zero sum
+ * @crc32_result: result crc calculation
+ */
+struct ppc440spe_adma_desc_slot {
+	dma_addr_t phys;
+	struct ppc440spe_adma_desc_slot *group_head;
+	struct ppc440spe_adma_desc_slot *hw_next;
+	struct dma_async_tx_descriptor async_tx;
+	struct list_head slot_node;
+	struct list_head chain_node; /* node in channel ops list */
+	struct list_head group_list; /* list */
+	unsigned int unmap_len;
+	void *hw_desc;
+	u16 stride;
+	u16 idx;
+	u16 slot_cnt;
+	u8 src_cnt;
+	u8 dst_cnt;
+	u8 slots_per_op;
+	u8 descs_per_op;
+	unsigned long flags;
+	unsigned long reverse_flags[8];
+
+#define PPC440SPE_DESC_INT	0	/* generate interrupt on complete */
+#define PPC440SPE_ZERO_P	1	/* clear P destionaion */
+#define PPC440SPE_ZERO_Q	2	/* clear Q destination */
+#define PPC440SPE_COHERENT	3	/* src/dst are coherent */
+
+#define PPC440SPE_DESC_WXOR	4	/* WXORs are in chain */
+#define PPC440SPE_DESC_RXOR	5	/* RXOR is in chain */
+
+#define PPC440SPE_DESC_RXOR123	8	/* CDB for RXOR123 operation */
+#define PPC440SPE_DESC_RXOR124	9	/* CDB for RXOR124 operation */
+#define PPC440SPE_DESC_RXOR125	10	/* CDB for RXOR125 operation */
+#define PPC440SPE_DESC_RXOR12	11	/* CDB for RXOR12 operation */
+#define PPC440SPE_DESC_RXOR_REV	12	/* CDB has srcs in reversed order */
+
+#define PPC440SPE_DESC_PCHECK	13
+#define PPC440SPE_DESC_QCHECK	14
+
+#define PPC440SPE_DESC_RXOR_MSK	0x3
+
+	struct ppc440spe_rxor rxor_cursor;
+
+	union {
+		u32 *xor_check_result;
+		u32 *crc32_result;
+	};
+};
+
+#endif /* _PPC440SPE_ADMA_H */
diff --git a/drivers/dma/ppc4xx/dma.h b/drivers/dma/ppc4xx/dma.h
new file mode 100644
index 000000000000..bcde2df2f373
--- /dev/null
+++ b/drivers/dma/ppc4xx/dma.h
@@ -0,0 +1,223 @@
+/*
+ * 440SPe's DMA engines support header file
+ *
+ * 2006-2009 (C) DENX Software Engineering.
+ *
+ * Author: Yuri Tikhonov <yur@emcraft.com>
+ *
+ * This file is licensed under the term of  the GNU General Public License
+ * version 2. The program licensed "as is" without any warranty of any
+ * kind, whether express or implied.
+ */
+
+#ifndef	_PPC440SPE_DMA_H
+#define _PPC440SPE_DMA_H
+
+#include <linux/types.h>
+
+/* Number of elements in the array with statical CDBs */
+#define	MAX_STAT_DMA_CDBS	16
+/* Number of DMA engines available on the contoller */
+#define DMA_ENGINES_NUM		2
+
+/* Maximum h/w supported number of destinations */
+#define DMA_DEST_MAX_NUM	2
+
+/* FIFO's params */
+#define DMA0_FIFO_SIZE		0x1000
+#define DMA1_FIFO_SIZE		0x1000
+#define DMA_FIFO_ENABLE		(1<<12)
+
+/* DMA Configuration Register. Data Transfer Engine PLB Priority: */
+#define DMA_CFG_DXEPR_LP	(0<<26)
+#define DMA_CFG_DXEPR_HP	(3<<26)
+#define DMA_CFG_DXEPR_HHP	(2<<26)
+#define DMA_CFG_DXEPR_HHHP	(1<<26)
+
+/* DMA Configuration Register. DMA FIFO Manager PLB Priority: */
+#define DMA_CFG_DFMPP_LP	(0<<23)
+#define DMA_CFG_DFMPP_HP	(3<<23)
+#define DMA_CFG_DFMPP_HHP	(2<<23)
+#define DMA_CFG_DFMPP_HHHP	(1<<23)
+
+/* DMA Configuration Register. Force 64-byte Alignment */
+#define DMA_CFG_FALGN		(1 << 19)
+
+/*UIC0:*/
+#define D0CPF_INT		(1<<12)
+#define D0CSF_INT		(1<<11)
+#define D1CPF_INT		(1<<10)
+#define D1CSF_INT		(1<<9)
+/*UIC1:*/
+#define DMAE_INT		(1<<9)
+
+/* I2O IOP Interrupt Mask Register */
+#define I2O_IOPIM_P0SNE		(1<<3)
+#define I2O_IOPIM_P0EM		(1<<5)
+#define I2O_IOPIM_P1SNE		(1<<6)
+#define I2O_IOPIM_P1EM		(1<<8)
+
+/* DMA CDB fields */
+#define DMA_CDB_MSK		(0xF)
+#define DMA_CDB_64B_ADDR	(1<<2)
+#define DMA_CDB_NO_INT		(1<<3)
+#define DMA_CDB_STATUS_MSK	(0x3)
+#define DMA_CDB_ADDR_MSK	(0xFFFFFFF0)
+
+/* DMA CDB OpCodes */
+#define DMA_CDB_OPC_NO_OP	(0x00)
+#define DMA_CDB_OPC_MV_SG1_SG2	(0x01)
+#define DMA_CDB_OPC_MULTICAST	(0x05)
+#define DMA_CDB_OPC_DFILL128	(0x24)
+#define DMA_CDB_OPC_DCHECK128	(0x23)
+
+#define DMA_CUED_XOR_BASE	(0x10000000)
+#define DMA_CUED_XOR_HB		(0x00000008)
+
+#ifdef CONFIG_440SP
+#define DMA_CUED_MULT1_OFF	0
+#define DMA_CUED_MULT2_OFF	8
+#define DMA_CUED_MULT3_OFF	16
+#define DMA_CUED_REGION_OFF	24
+#define DMA_CUED_XOR_WIN_MSK	(0xFC000000)
+#else
+#define DMA_CUED_MULT1_OFF	2
+#define DMA_CUED_MULT2_OFF	10
+#define DMA_CUED_MULT3_OFF	18
+#define DMA_CUED_REGION_OFF	26
+#define DMA_CUED_XOR_WIN_MSK	(0xF0000000)
+#endif
+
+#define DMA_CUED_REGION_MSK	0x3
+#define DMA_RXOR123		0x0
+#define DMA_RXOR124		0x1
+#define DMA_RXOR125		0x2
+#define DMA_RXOR12		0x3
+
+/* S/G addresses */
+#define DMA_CDB_SG_SRC		1
+#define DMA_CDB_SG_DST1		2
+#define DMA_CDB_SG_DST2		3
+
+/*
+ * DMAx engines Command Descriptor Block Type
+ */
+struct dma_cdb {
+	/*
+	 * Basic CDB structure (Table 20-17, p.499, 440spe_um_1_22.pdf)
+	 */
+	u8	pad0[2];        /* reserved */
+	u8	attr;		/* attributes */
+	u8	opc;		/* opcode */
+	u32	sg1u;		/* upper SG1 address */
+	u32	sg1l;		/* lower SG1 address */
+	u32	cnt;		/* SG count, 3B used */
+	u32	sg2u;		/* upper SG2 address */
+	u32	sg2l;		/* lower SG2 address */
+	u32	sg3u;		/* upper SG3 address */
+	u32	sg3l;		/* lower SG3 address */
+};
+
+/*
+ * DMAx hardware registers (p.515 in 440SPe UM 1.22)
+ */
+struct dma_regs {
+	u32	cpfpl;
+	u32	cpfph;
+	u32	csfpl;
+	u32	csfph;
+	u32	dsts;
+	u32	cfg;
+	u8	pad0[0x8];
+	u16	cpfhp;
+	u16	cpftp;
+	u16	csfhp;
+	u16	csftp;
+	u8	pad1[0x8];
+	u32	acpl;
+	u32	acph;
+	u32	s1bpl;
+	u32	s1bph;
+	u32	s2bpl;
+	u32	s2bph;
+	u32	s3bpl;
+	u32	s3bph;
+	u8	pad2[0x10];
+	u32	earl;
+	u32	earh;
+	u8	pad3[0x8];
+	u32	seat;
+	u32	sead;
+	u32	op;
+	u32	fsiz;
+};
+
+/*
+ * I2O hardware registers (p.528 in 440SPe UM 1.22)
+ */
+struct i2o_regs {
+	u32	ists;
+	u32	iseat;
+	u32	isead;
+	u8	pad0[0x14];
+	u32	idbel;
+	u8	pad1[0xc];
+	u32	ihis;
+	u32	ihim;
+	u8	pad2[0x8];
+	u32	ihiq;
+	u32	ihoq;
+	u8	pad3[0x8];
+	u32	iopis;
+	u32	iopim;
+	u32	iopiq;
+	u8	iopoq;
+	u8	pad4[3];
+	u16	iiflh;
+	u16	iiflt;
+	u16	iiplh;
+	u16	iiplt;
+	u16	ioflh;
+	u16	ioflt;
+	u16	ioplh;
+	u16	ioplt;
+	u32	iidc;
+	u32	ictl;
+	u32	ifcpp;
+	u8	pad5[0x4];
+	u16	mfac0;
+	u16	mfac1;
+	u16	mfac2;
+	u16	mfac3;
+	u16	mfac4;
+	u16	mfac5;
+	u16	mfac6;
+	u16	mfac7;
+	u16	ifcfh;
+	u16	ifcht;
+	u8	pad6[0x4];
+	u32	iifmc;
+	u32	iodb;
+	u32	iodbc;
+	u32	ifbal;
+	u32	ifbah;
+	u32	ifsiz;
+	u32	ispd0;
+	u32	ispd1;
+	u32	ispd2;
+	u32	ispd3;
+	u32	ihipl;
+	u32	ihiph;
+	u32	ihopl;
+	u32	ihoph;
+	u32	iiipl;
+	u32	iiiph;
+	u32	iiopl;
+	u32	iioph;
+	u32	ifcpl;
+	u32	ifcph;
+	u8	pad7[0x8];
+	u32	iopt;
+};
+
+#endif /* _PPC440SPE_DMA_H */
diff --git a/drivers/dma/ppc4xx/xor.h b/drivers/dma/ppc4xx/xor.h
new file mode 100644
index 000000000000..daed7384daac
--- /dev/null
+++ b/drivers/dma/ppc4xx/xor.h
@@ -0,0 +1,110 @@
+/*
+ * 440SPe's XOR engines support header file
+ *
+ * 2006-2009 (C) DENX Software Engineering.
+ *
+ * Author: Yuri Tikhonov <yur@emcraft.com>
+ *
+ * This file is licensed under the term of  the GNU General Public License
+ * version 2. The program licensed "as is" without any warranty of any
+ * kind, whether express or implied.
+ */
+
+#ifndef _PPC440SPE_XOR_H
+#define _PPC440SPE_XOR_H
+
+#include <linux/types.h>
+
+/* Number of XOR engines available on the contoller */
+#define XOR_ENGINES_NUM		1
+
+/* Number of operands supported in the h/w */
+#define XOR_MAX_OPS		16
+
+/*
+ * XOR Command Block Control Register bits
+ */
+#define XOR_CBCR_LNK_BIT        (1<<31) /* link present */
+#define XOR_CBCR_TGT_BIT        (1<<30) /* target present */
+#define XOR_CBCR_CBCE_BIT       (1<<29) /* command block compete enable */
+#define XOR_CBCR_RNZE_BIT       (1<<28) /* result not zero enable */
+#define XOR_CBCR_XNOR_BIT       (1<<15) /* XOR/XNOR */
+#define XOR_CDCR_OAC_MSK        (0x7F)  /* operand address count */
+
+/*
+ * XORCore Status Register bits
+ */
+#define XOR_SR_XCP_BIT		(1<<31)	/* core processing */
+#define XOR_SR_ICB_BIT		(1<<17)	/* invalid CB */
+#define XOR_SR_IC_BIT		(1<<16)	/* invalid command */
+#define XOR_SR_IPE_BIT		(1<<15)	/* internal parity error */
+#define XOR_SR_RNZ_BIT		(1<<2)	/* result not Zero */
+#define XOR_SR_CBC_BIT		(1<<1)	/* CB complete */
+#define XOR_SR_CBLC_BIT		(1<<0)	/* CB list complete */
+
+/*
+ * XORCore Control Set and Reset Register bits
+ */
+#define XOR_CRSR_XASR_BIT	(1<<31)	/* soft reset */
+#define XOR_CRSR_XAE_BIT	(1<<30)	/* enable */
+#define XOR_CRSR_RCBE_BIT	(1<<29)	/* refetch CB enable */
+#define XOR_CRSR_PAUS_BIT	(1<<28)	/* pause */
+#define XOR_CRSR_64BA_BIT	(1<<27) /* 64/32 CB format */
+#define XOR_CRSR_CLP_BIT	(1<<25)	/* continue list processing */
+
+/*
+ * XORCore Interrupt Enable Register
+ */
+#define XOR_IE_ICBIE_BIT	(1<<17)	/* Invalid Command Block IRQ Enable */
+#define XOR_IE_ICIE_BIT		(1<<16)	/* Invalid Command IRQ Enable */
+#define XOR_IE_RPTIE_BIT	(1<<14)	/* Read PLB Timeout Error IRQ Enable */
+#define XOR_IE_CBCIE_BIT	(1<<1)	/* CB complete interrupt enable */
+#define XOR_IE_CBLCI_BIT	(1<<0)	/* CB list complete interrupt enable */
+
+/*
+ * XOR Accelerator engine Command Block Type
+ */
+struct xor_cb {
+	/*
+	 * Basic 64-bit format XOR CB (Table 19-1, p.463, 440spe_um_1_22.pdf)
+	 */
+	u32	cbc;		/* control */
+	u32	cbbc;		/* byte count */
+	u32	cbs;		/* status */
+	u8	pad0[4];	/* reserved */
+	u32	cbtah;		/* target address high */
+	u32	cbtal;		/* target address low */
+	u32	cblah;		/* link address high */
+	u32	cblal;		/* link address low */
+	struct {
+		u32 h;
+		u32 l;
+	} __attribute__ ((packed)) ops[16];
+} __attribute__ ((packed));
+
+/*
+ * XOR hardware registers Table 19-3, UM 1.22
+ */
+struct xor_regs {
+	u32	op_ar[16][2];	/* operand address[0]-high,[1]-low registers */
+	u8	pad0[352];	/* reserved */
+	u32	cbcr;		/* CB control register */
+	u32	cbbcr;		/* CB byte count register */
+	u32	cbsr;		/* CB status register */
+	u8	pad1[4];	/* reserved */
+	u32	cbtahr;		/* operand target address high register */
+	u32	cbtalr;		/* operand target address low register */
+	u32	cblahr;		/* CB link address high register */
+	u32	cblalr;		/* CB link address low register */
+	u32	crsr;		/* control set register */
+	u32	crrr;		/* control reset register */
+	u32	ccbahr;		/* current CB address high register */
+	u32	ccbalr;		/* current CB address low register */
+	u32	plbr;		/* PLB configuration register */
+	u32	ier;		/* interrupt enable register */
+	u32	pecr;		/* parity error count register */
+	u32	sr;		/* status register */
+	u32	revidr;		/* revision ID register */
+};
+
+#endif /* _PPC440SPE_XOR_H */
diff --git a/drivers/dma/shdma.c b/drivers/dma/shdma.c
index 034ecf0ace03..d10cc899c460 100644
--- a/drivers/dma/shdma.c
+++ b/drivers/dma/shdma.c
@@ -23,16 +23,19 @@
 #include <linux/dmaengine.h>
 #include <linux/delay.h>
 #include <linux/dma-mapping.h>
-#include <linux/dmapool.h>
 #include <linux/platform_device.h>
 #include <cpu/dma.h>
 #include <asm/dma-sh.h>
 #include "shdma.h"
 
 /* DMA descriptor control */
-#define DESC_LAST	(-1)
-#define DESC_COMP	(1)
-#define DESC_NCOMP	(0)
+enum sh_dmae_desc_status {
+	DESC_IDLE,
+	DESC_PREPARED,
+	DESC_SUBMITTED,
+	DESC_COMPLETED,	/* completed, have to call callback */
+	DESC_WAITING,	/* callback called, waiting for ack / re-submit */
+};
 
 #define NR_DESCS_PER_CHANNEL 32
 /*
@@ -45,6 +48,8 @@
  */
 #define RS_DEFAULT  (RS_DUAL)
 
+static void sh_dmae_chan_ld_cleanup(struct sh_dmae_chan *sh_chan, bool all);
+
 #define SH_DMAC_CHAN_BASE(id) (dma_base_addr[id])
 static void sh_dmae_writel(struct sh_dmae_chan *sh_dc, u32 data, u32 reg)
 {
@@ -80,17 +85,17 @@ static int sh_dmae_rst(int id)
 	unsigned short dmaor;
 
 	sh_dmae_ctl_stop(id);
-	dmaor = (dmaor_read_reg(id)|DMAOR_INIT);
+	dmaor = dmaor_read_reg(id) | DMAOR_INIT;
 
 	dmaor_write_reg(id, dmaor);
-	if ((dmaor_read_reg(id) & (DMAOR_AE | DMAOR_NMIF))) {
+	if (dmaor_read_reg(id) & (DMAOR_AE | DMAOR_NMIF)) {
 		pr_warning(KERN_ERR "dma-sh: Can't initialize DMAOR.\n");
 		return -EINVAL;
 	}
 	return 0;
 }
 
-static int dmae_is_idle(struct sh_dmae_chan *sh_chan)
+static int dmae_is_busy(struct sh_dmae_chan *sh_chan)
 {
 	u32 chcr = sh_dmae_readl(sh_chan, CHCR);
 	if (chcr & CHCR_DE) {
@@ -106,19 +111,18 @@ static inline unsigned int calc_xmit_shift(struct sh_dmae_chan *sh_chan)
 	return ts_shift[(chcr & CHCR_TS_MASK) >> CHCR_TS_SHIFT];
 }
 
-static void dmae_set_reg(struct sh_dmae_chan *sh_chan, struct sh_dmae_regs hw)
+static void dmae_set_reg(struct sh_dmae_chan *sh_chan, struct sh_dmae_regs *hw)
 {
-	sh_dmae_writel(sh_chan, hw.sar, SAR);
-	sh_dmae_writel(sh_chan, hw.dar, DAR);
-	sh_dmae_writel(sh_chan,
-		(hw.tcr >> calc_xmit_shift(sh_chan)), TCR);
+	sh_dmae_writel(sh_chan, hw->sar, SAR);
+	sh_dmae_writel(sh_chan, hw->dar, DAR);
+	sh_dmae_writel(sh_chan, hw->tcr >> calc_xmit_shift(sh_chan), TCR);
 }
 
 static void dmae_start(struct sh_dmae_chan *sh_chan)
 {
 	u32 chcr = sh_dmae_readl(sh_chan, CHCR);
 
-	chcr |= (CHCR_DE|CHCR_IE);
+	chcr |= CHCR_DE | CHCR_IE;
 	sh_dmae_writel(sh_chan, chcr, CHCR);
 }
 
@@ -132,7 +136,7 @@ static void dmae_halt(struct sh_dmae_chan *sh_chan)
 
 static int dmae_set_chcr(struct sh_dmae_chan *sh_chan, u32 val)
 {
-	int ret = dmae_is_idle(sh_chan);
+	int ret = dmae_is_busy(sh_chan);
 	/* When DMA was working, can not set data to CHCR */
 	if (ret)
 		return ret;
@@ -149,7 +153,7 @@ static int dmae_set_dmars(struct sh_dmae_chan *sh_chan, u16 val)
 {
 	u32 addr;
 	int shift = 0;
-	int ret = dmae_is_idle(sh_chan);
+	int ret = dmae_is_busy(sh_chan);
 	if (ret)
 		return ret;
 
@@ -185,8 +189,9 @@ static int dmae_set_dmars(struct sh_dmae_chan *sh_chan, u16 val)
 
 static dma_cookie_t sh_dmae_tx_submit(struct dma_async_tx_descriptor *tx)
 {
-	struct sh_desc *desc = tx_to_sh_desc(tx);
+	struct sh_desc *desc = tx_to_sh_desc(tx), *chunk, *last = desc, *c;
 	struct sh_dmae_chan *sh_chan = to_sh_chan(tx->chan);
+	dma_async_tx_callback callback = tx->callback;
 	dma_cookie_t cookie;
 
 	spin_lock_bh(&sh_chan->desc_lock);
@@ -196,45 +201,53 @@ static dma_cookie_t sh_dmae_tx_submit(struct dma_async_tx_descriptor *tx)
 	if (cookie < 0)
 		cookie = 1;
 
-	/* If desc only in the case of 1 */
-	if (desc->async_tx.cookie != -EBUSY)
-		desc->async_tx.cookie = cookie;
-	sh_chan->common.cookie = desc->async_tx.cookie;
+	sh_chan->common.cookie = cookie;
+	tx->cookie = cookie;
+
+	/* Mark all chunks of this descriptor as submitted, move to the queue */
+	list_for_each_entry_safe(chunk, c, desc->node.prev, node) {
+		/*
+		 * All chunks are on the global ld_free, so, we have to find
+		 * the end of the chain ourselves
+		 */
+		if (chunk != desc && (chunk->mark == DESC_IDLE ||
+				      chunk->async_tx.cookie > 0 ||
+				      chunk->async_tx.cookie == -EBUSY ||
+				      &chunk->node == &sh_chan->ld_free))
+			break;
+		chunk->mark = DESC_SUBMITTED;
+		/* Callback goes to the last chunk */
+		chunk->async_tx.callback = NULL;
+		chunk->cookie = cookie;
+		list_move_tail(&chunk->node, &sh_chan->ld_queue);
+		last = chunk;
+	}
+
+	last->async_tx.callback = callback;
+	last->async_tx.callback_param = tx->callback_param;
 
-	list_splice_init(&desc->tx_list, sh_chan->ld_queue.prev);
+	dev_dbg(sh_chan->dev, "submit #%d@%p on %d: %x[%d] -> %x\n",
+		tx->cookie, &last->async_tx, sh_chan->id,
+		desc->hw.sar, desc->hw.tcr, desc->hw.dar);
 
 	spin_unlock_bh(&sh_chan->desc_lock);
 
 	return cookie;
 }
 
+/* Called with desc_lock held */
 static struct sh_desc *sh_dmae_get_desc(struct sh_dmae_chan *sh_chan)
 {
-	struct sh_desc *desc, *_desc, *ret = NULL;
+	struct sh_desc *desc;
 
-	spin_lock_bh(&sh_chan->desc_lock);
-	list_for_each_entry_safe(desc, _desc, &sh_chan->ld_free, node) {
-		if (async_tx_test_ack(&desc->async_tx)) {
+	list_for_each_entry(desc, &sh_chan->ld_free, node)
+		if (desc->mark != DESC_PREPARED) {
+			BUG_ON(desc->mark != DESC_IDLE);
 			list_del(&desc->node);
-			ret = desc;
-			break;
+			return desc;
 		}
-	}
-	spin_unlock_bh(&sh_chan->desc_lock);
-
-	return ret;
-}
-
-static void sh_dmae_put_desc(struct sh_dmae_chan *sh_chan, struct sh_desc *desc)
-{
-	if (desc) {
-		spin_lock_bh(&sh_chan->desc_lock);
-
-		list_splice_init(&desc->tx_list, &sh_chan->ld_free);
-		list_add(&desc->node, &sh_chan->ld_free);
 
-		spin_unlock_bh(&sh_chan->desc_lock);
-	}
+	return NULL;
 }
 
 static int sh_dmae_alloc_chan_resources(struct dma_chan *chan)
@@ -253,11 +266,10 @@ static int sh_dmae_alloc_chan_resources(struct dma_chan *chan)
 		dma_async_tx_descriptor_init(&desc->async_tx,
 					&sh_chan->common);
 		desc->async_tx.tx_submit = sh_dmae_tx_submit;
-		desc->async_tx.flags = DMA_CTRL_ACK;
-		INIT_LIST_HEAD(&desc->tx_list);
-		sh_dmae_put_desc(sh_chan, desc);
+		desc->mark = DESC_IDLE;
 
 		spin_lock_bh(&sh_chan->desc_lock);
+		list_add(&desc->node, &sh_chan->ld_free);
 		sh_chan->descs_allocated++;
 	}
 	spin_unlock_bh(&sh_chan->desc_lock);
@@ -274,7 +286,10 @@ static void sh_dmae_free_chan_resources(struct dma_chan *chan)
 	struct sh_desc *desc, *_desc;
 	LIST_HEAD(list);
 
-	BUG_ON(!list_empty(&sh_chan->ld_queue));
+	/* Prepared and not submitted descriptors can still be on the queue */
+	if (!list_empty(&sh_chan->ld_queue))
+		sh_dmae_chan_ld_cleanup(sh_chan, true);
+
 	spin_lock_bh(&sh_chan->desc_lock);
 
 	list_splice_init(&sh_chan->ld_free, &list);
@@ -293,6 +308,8 @@ static struct dma_async_tx_descriptor *sh_dmae_prep_memcpy(
 	struct sh_dmae_chan *sh_chan;
 	struct sh_desc *first = NULL, *prev = NULL, *new;
 	size_t copy_size;
+	LIST_HEAD(tx_list);
+	int chunks = (len + SH_DMA_TCR_MAX) / (SH_DMA_TCR_MAX + 1);
 
 	if (!chan)
 		return NULL;
@@ -302,108 +319,189 @@ static struct dma_async_tx_descriptor *sh_dmae_prep_memcpy(
 
 	sh_chan = to_sh_chan(chan);
 
+	/* Have to lock the whole loop to protect against concurrent release */
+	spin_lock_bh(&sh_chan->desc_lock);
+
+	/*
+	 * Chaining:
+	 * first descriptor is what user is dealing with in all API calls, its
+	 *	cookie is at first set to -EBUSY, at tx-submit to a positive
+	 *	number
+	 * if more than one chunk is needed further chunks have cookie = -EINVAL
+	 * the last chunk, if not equal to the first, has cookie = -ENOSPC
+	 * all chunks are linked onto the tx_list head with their .node heads
+	 *	only during this function, then they are immediately spliced
+	 *	back onto the free list in form of a chain
+	 */
 	do {
-		/* Allocate the link descriptor from DMA pool */
+		/* Allocate the link descriptor from the free list */
 		new = sh_dmae_get_desc(sh_chan);
 		if (!new) {
 			dev_err(sh_chan->dev,
-					"No free memory for link descriptor\n");
-			goto err_get_desc;
+				"No free memory for link descriptor\n");
+			list_for_each_entry(new, &tx_list, node)
+				new->mark = DESC_IDLE;
+			list_splice(&tx_list, &sh_chan->ld_free);
+			spin_unlock_bh(&sh_chan->desc_lock);
+			return NULL;
 		}
 
-		copy_size = min(len, (size_t)SH_DMA_TCR_MAX);
+		copy_size = min(len, (size_t)SH_DMA_TCR_MAX + 1);
 
 		new->hw.sar = dma_src;
 		new->hw.dar = dma_dest;
 		new->hw.tcr = copy_size;
-		if (!first)
+		if (!first) {
+			/* First desc */
+			new->async_tx.cookie = -EBUSY;
 			first = new;
+		} else {
+			/* Other desc - invisible to the user */
+			new->async_tx.cookie = -EINVAL;
+		}
 
-		new->mark = DESC_NCOMP;
-		async_tx_ack(&new->async_tx);
+		dev_dbg(sh_chan->dev,
+			"chaining %u of %u with %p, dst %x, cookie %d\n",
+			copy_size, len, &new->async_tx, dma_dest,
+			new->async_tx.cookie);
+
+		new->mark = DESC_PREPARED;
+		new->async_tx.flags = flags;
+		new->chunks = chunks--;
 
 		prev = new;
 		len -= copy_size;
 		dma_src += copy_size;
 		dma_dest += copy_size;
 		/* Insert the link descriptor to the LD ring */
-		list_add_tail(&new->node, &first->tx_list);
+		list_add_tail(&new->node, &tx_list);
 	} while (len);
 
-	new->async_tx.flags = flags; /* client is in control of this ack */
-	new->async_tx.cookie = -EBUSY; /* Last desc */
+	if (new != first)
+		new->async_tx.cookie = -ENOSPC;
 
-	return &first->async_tx;
+	/* Put them back on the free list, so, they don't get lost */
+	list_splice_tail(&tx_list, &sh_chan->ld_free);
 
-err_get_desc:
-	sh_dmae_put_desc(sh_chan, first);
-	return NULL;
+	spin_unlock_bh(&sh_chan->desc_lock);
 
+	return &first->async_tx;
 }
 
-/*
- * sh_chan_ld_cleanup - Clean up link descriptors
- *
- * This function clean up the ld_queue of DMA channel.
- */
-static void sh_dmae_chan_ld_cleanup(struct sh_dmae_chan *sh_chan)
+static dma_async_tx_callback __ld_cleanup(struct sh_dmae_chan *sh_chan, bool all)
 {
 	struct sh_desc *desc, *_desc;
+	/* Is the "exposed" head of a chain acked? */
+	bool head_acked = false;
+	dma_cookie_t cookie = 0;
+	dma_async_tx_callback callback = NULL;
+	void *param = NULL;
 
 	spin_lock_bh(&sh_chan->desc_lock);
 	list_for_each_entry_safe(desc, _desc, &sh_chan->ld_queue, node) {
-		dma_async_tx_callback callback;
-		void *callback_param;
-
-		/* non send data */
-		if (desc->mark == DESC_NCOMP)
+		struct dma_async_tx_descriptor *tx = &desc->async_tx;
+
+		BUG_ON(tx->cookie > 0 && tx->cookie != desc->cookie);
+		BUG_ON(desc->mark != DESC_SUBMITTED &&
+		       desc->mark != DESC_COMPLETED &&
+		       desc->mark != DESC_WAITING);
+
+		/*
+		 * queue is ordered, and we use this loop to (1) clean up all
+		 * completed descriptors, and to (2) update descriptor flags of
+		 * any chunks in a (partially) completed chain
+		 */
+		if (!all && desc->mark == DESC_SUBMITTED &&
+		    desc->cookie != cookie)
 			break;
 
-		/* send data sesc */
-		callback = desc->async_tx.callback;
-		callback_param = desc->async_tx.callback_param;
+		if (tx->cookie > 0)
+			cookie = tx->cookie;
 
-		/* Remove from ld_queue list */
-		list_splice_init(&desc->tx_list, &sh_chan->ld_free);
+		if (desc->mark == DESC_COMPLETED && desc->chunks == 1) {
+			BUG_ON(sh_chan->completed_cookie != desc->cookie - 1);
+			sh_chan->completed_cookie = desc->cookie;
+		}
 
-		dev_dbg(sh_chan->dev, "link descriptor %p will be recycle.\n",
-				desc);
+		/* Call callback on the last chunk */
+		if (desc->mark == DESC_COMPLETED && tx->callback) {
+			desc->mark = DESC_WAITING;
+			callback = tx->callback;
+			param = tx->callback_param;
+			dev_dbg(sh_chan->dev, "descriptor #%d@%p on %d callback\n",
+				tx->cookie, tx, sh_chan->id);
+			BUG_ON(desc->chunks != 1);
+			break;
+		}
 
-		list_move(&desc->node, &sh_chan->ld_free);
-		/* Run the link descriptor callback function */
-		if (callback) {
-			spin_unlock_bh(&sh_chan->desc_lock);
-			dev_dbg(sh_chan->dev, "link descriptor %p callback\n",
-					desc);
-			callback(callback_param);
-			spin_lock_bh(&sh_chan->desc_lock);
+		if (tx->cookie > 0 || tx->cookie == -EBUSY) {
+			if (desc->mark == DESC_COMPLETED) {
+				BUG_ON(tx->cookie < 0);
+				desc->mark = DESC_WAITING;
+			}
+			head_acked = async_tx_test_ack(tx);
+		} else {
+			switch (desc->mark) {
+			case DESC_COMPLETED:
+				desc->mark = DESC_WAITING;
+				/* Fall through */
+			case DESC_WAITING:
+				if (head_acked)
+					async_tx_ack(&desc->async_tx);
+			}
+		}
+
+		dev_dbg(sh_chan->dev, "descriptor %p #%d completed.\n",
+			tx, tx->cookie);
+
+		if (((desc->mark == DESC_COMPLETED ||
+		      desc->mark == DESC_WAITING) &&
+		     async_tx_test_ack(&desc->async_tx)) || all) {
+			/* Remove from ld_queue list */
+			desc->mark = DESC_IDLE;
+			list_move(&desc->node, &sh_chan->ld_free);
 		}
 	}
 	spin_unlock_bh(&sh_chan->desc_lock);
+
+	if (callback)
+		callback(param);
+
+	return callback;
+}
+
+/*
+ * sh_chan_ld_cleanup - Clean up link descriptors
+ *
+ * This function cleans up the ld_queue of DMA channel.
+ */
+static void sh_dmae_chan_ld_cleanup(struct sh_dmae_chan *sh_chan, bool all)
+{
+	while (__ld_cleanup(sh_chan, all))
+		;
 }
 
 static void sh_chan_xfer_ld_queue(struct sh_dmae_chan *sh_chan)
 {
-	struct list_head *ld_node;
-	struct sh_dmae_regs hw;
+	struct sh_desc *sd;
 
+	spin_lock_bh(&sh_chan->desc_lock);
 	/* DMA work check */
-	if (dmae_is_idle(sh_chan))
+	if (dmae_is_busy(sh_chan)) {
+		spin_unlock_bh(&sh_chan->desc_lock);
 		return;
+	}
 
 	/* Find the first un-transfer desciptor */
-	for (ld_node = sh_chan->ld_queue.next;
-		(ld_node != &sh_chan->ld_queue)
-			&& (to_sh_desc(ld_node)->mark == DESC_COMP);
-		ld_node = ld_node->next)
-		cpu_relax();
-
-	if (ld_node != &sh_chan->ld_queue) {
-		/* Get the ld start address from ld_queue */
-		hw = to_sh_desc(ld_node)->hw;
-		dmae_set_reg(sh_chan, hw);
-		dmae_start(sh_chan);
-	}
+	list_for_each_entry(sd, &sh_chan->ld_queue, node)
+		if (sd->mark == DESC_SUBMITTED) {
+			/* Get the ld start address from ld_queue */
+			dmae_set_reg(sh_chan, &sd->hw);
+			dmae_start(sh_chan);
+			break;
+		}
+
+	spin_unlock_bh(&sh_chan->desc_lock);
 }
 
 static void sh_dmae_memcpy_issue_pending(struct dma_chan *chan)
@@ -421,12 +519,11 @@ static enum dma_status sh_dmae_is_complete(struct dma_chan *chan,
 	dma_cookie_t last_used;
 	dma_cookie_t last_complete;
 
-	sh_dmae_chan_ld_cleanup(sh_chan);
+	sh_dmae_chan_ld_cleanup(sh_chan, false);
 
 	last_used = chan->cookie;
 	last_complete = sh_chan->completed_cookie;
-	if (last_complete == -EBUSY)
-		last_complete = last_used;
+	BUG_ON(last_complete < 0);
 
 	if (done)
 		*done = last_complete;
@@ -481,11 +578,13 @@ static irqreturn_t sh_dmae_err(int irq, void *data)
 		err = sh_dmae_rst(0);
 		if (err)
 			return err;
+#ifdef SH_DMAC_BASE1
 		if (shdev->pdata.mode & SHDMA_DMAOR1) {
 			err = sh_dmae_rst(1);
 			if (err)
 				return err;
 		}
+#endif
 		disable_irq(irq);
 		return IRQ_HANDLED;
 	}
@@ -495,34 +594,25 @@ static irqreturn_t sh_dmae_err(int irq, void *data)
 static void dmae_do_tasklet(unsigned long data)
 {
 	struct sh_dmae_chan *sh_chan = (struct sh_dmae_chan *)data;
-	struct sh_desc *desc, *_desc, *cur_desc = NULL;
+	struct sh_desc *desc;
 	u32 sar_buf = sh_dmae_readl(sh_chan, SAR);
-	list_for_each_entry_safe(desc, _desc,
-					&sh_chan->ld_queue, node) {
-		if ((desc->hw.sar + desc->hw.tcr) == sar_buf) {
-			cur_desc = desc;
-			break;
-		}
-	}
 
-	if (cur_desc) {
-		switch (cur_desc->async_tx.cookie) {
-		case 0: /* other desc data */
-			break;
-		case -EBUSY: /* last desc */
-		sh_chan->completed_cookie =
-				cur_desc->async_tx.cookie;
-			break;
-		default: /* first desc ( 0 < )*/
-			sh_chan->completed_cookie =
-				cur_desc->async_tx.cookie - 1;
+	spin_lock(&sh_chan->desc_lock);
+	list_for_each_entry(desc, &sh_chan->ld_queue, node) {
+		if ((desc->hw.sar + desc->hw.tcr) == sar_buf &&
+		    desc->mark == DESC_SUBMITTED) {
+			dev_dbg(sh_chan->dev, "done #%d@%p dst %u\n",
+				desc->async_tx.cookie, &desc->async_tx,
+				desc->hw.dar);
+			desc->mark = DESC_COMPLETED;
 			break;
 		}
-		cur_desc->mark = DESC_COMP;
 	}
+	spin_unlock(&sh_chan->desc_lock);
+
 	/* Next desc */
 	sh_chan_xfer_ld_queue(sh_chan);
-	sh_dmae_chan_ld_cleanup(sh_chan);
+	sh_dmae_chan_ld_cleanup(sh_chan, false);
 }
 
 static unsigned int get_dmae_irq(unsigned int id)
@@ -543,8 +633,8 @@ static int __devinit sh_dmae_chan_probe(struct sh_dmae_device *shdev, int id)
 	/* alloc channel */
 	new_sh_chan = kzalloc(sizeof(struct sh_dmae_chan), GFP_KERNEL);
 	if (!new_sh_chan) {
-		dev_err(shdev->common.dev, "No free memory for allocating "
-				"dma channels!\n");
+		dev_err(shdev->common.dev,
+			"No free memory for allocating dma channels!\n");
 		return -ENOMEM;
 	}
 
@@ -586,8 +676,8 @@ static int __devinit sh_dmae_chan_probe(struct sh_dmae_device *shdev, int id)
 			"sh-dmae%d", new_sh_chan->id);
 
 	/* set up channel irq */
-	err = request_irq(irq, &sh_dmae_interrupt,
-		irqflags, new_sh_chan->dev_id, new_sh_chan);
+	err = request_irq(irq, &sh_dmae_interrupt, irqflags,
+			  new_sh_chan->dev_id, new_sh_chan);
 	if (err) {
 		dev_err(shdev->common.dev, "DMA channel %d request_irq error "
 			"with return %d\n", id, err);
@@ -676,6 +766,8 @@ static int __init sh_dmae_probe(struct platform_device *pdev)
 	shdev->common.device_is_tx_complete = sh_dmae_is_complete;
 	shdev->common.device_issue_pending = sh_dmae_memcpy_issue_pending;
 	shdev->common.dev = &pdev->dev;
+	/* Default transfer size of 32 bytes requires 32-byte alignment */
+	shdev->common.copy_align = 5;
 
 #if defined(CONFIG_CPU_SH4)
 	/* Non Mix IRQ mode SH7722/SH7730 etc... */
@@ -688,8 +780,8 @@ static int __init sh_dmae_probe(struct platform_device *pdev)
 	}
 
 	for (ecnt = 0 ; ecnt < ARRAY_SIZE(eirq); ecnt++) {
-		err = request_irq(eirq[ecnt], sh_dmae_err,
-			irqflags, "DMAC Address Error", shdev);
+		err = request_irq(eirq[ecnt], sh_dmae_err, irqflags,
+				  "DMAC Address Error", shdev);
 		if (err) {
 			dev_err(&pdev->dev, "DMA device request_irq"
 				"error (irq %d) with return %d\n",
diff --git a/drivers/dma/shdma.h b/drivers/dma/shdma.h
index 2b4bc15a2c0a..108f1cffb6f5 100644
--- a/drivers/dma/shdma.h
+++ b/drivers/dma/shdma.h
@@ -13,9 +13,9 @@
 #ifndef __DMA_SHDMA_H
 #define __DMA_SHDMA_H
 
-#include <linux/device.h>
-#include <linux/dmapool.h>
 #include <linux/dmaengine.h>
+#include <linux/interrupt.h>
+#include <linux/list.h>
 
 #define SH_DMA_TCR_MAX 0x00FFFFFF	/* 16MB */
 
@@ -26,24 +26,27 @@ struct sh_dmae_regs {
 };
 
 struct sh_desc {
-	struct list_head tx_list;
 	struct sh_dmae_regs hw;
 	struct list_head node;
 	struct dma_async_tx_descriptor async_tx;
+	dma_cookie_t cookie;
+	int chunks;
 	int mark;
 };
 
+struct device;
+
 struct sh_dmae_chan {
 	dma_cookie_t completed_cookie;	/* The maximum cookie completed */
-	spinlock_t desc_lock;			/* Descriptor operation lock */
-	struct list_head ld_queue;		/* Link descriptors queue */
-	struct list_head ld_free;		/* Link descriptors free */
-	struct dma_chan common;			/* DMA common channel */
-	struct device *dev;				/* Channel device */
+	spinlock_t desc_lock;		/* Descriptor operation lock */
+	struct list_head ld_queue;	/* Link descriptors queue */
+	struct list_head ld_free;	/* Link descriptors free */
+	struct dma_chan common;		/* DMA common channel */
+	struct device *dev;		/* Channel device */
 	struct tasklet_struct tasklet;	/* Tasklet */
-	int descs_allocated;			/* desc count */
+	int descs_allocated;		/* desc count */
 	int id;				/* Raw id of this channel */
-	char dev_id[16];	/* unique name per DMAC of channel */
+	char dev_id[16];		/* unique name per DMAC of channel */
 
 	/* Set chcr */
 	int (*set_chcr)(struct sh_dmae_chan *sh_chan, u32 regs);
diff --git a/drivers/dma/txx9dmac.c b/drivers/dma/txx9dmac.c
index fb6bb64e8861..3ebc61067e54 100644
--- a/drivers/dma/txx9dmac.c
+++ b/drivers/dma/txx9dmac.c
@@ -1313,7 +1313,7 @@ static int txx9dmac_resume_noirq(struct device *dev)
 
 }
 
-static struct dev_pm_ops txx9dmac_dev_pm_ops = {
+static const struct dev_pm_ops txx9dmac_dev_pm_ops = {
 	.suspend_noirq = txx9dmac_suspend_noirq,
 	.resume_noirq = txx9dmac_resume_noirq,
 };
diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
index a38831c82649..000dc67b85b7 100644
--- a/drivers/edac/amd64_edac.c
+++ b/drivers/edac/amd64_edac.c
@@ -13,32 +13,56 @@ module_param(report_gart_errors, int, 0644);
 static int ecc_enable_override;
 module_param(ecc_enable_override, int, 0644);
 
+static struct msr *msrs;
+
 /* Lookup table for all possible MC control instances */
 struct amd64_pvt;
 static struct mem_ctl_info *mci_lookup[EDAC_MAX_NUMNODES];
 static struct amd64_pvt *pvt_lookup[EDAC_MAX_NUMNODES];
 
 /*
- * See F2x80 for K8 and F2x[1,0]80 for Fam10 and later. The table below is only
- * for DDR2 DRAM mapping.
+ * Address to DRAM bank mapping: see F2x80 for K8 and F2x[1,0]80 for Fam10 and
+ * later.
  */
-u32 revf_quad_ddr2_shift[] = {
-	0,	/* 0000b NULL DIMM (128mb) */
-	28,	/* 0001b 256mb */
-	29,	/* 0010b 512mb */
-	29,	/* 0011b 512mb */
-	29,	/* 0100b 512mb */
-	30,	/* 0101b 1gb */
-	30,	/* 0110b 1gb */
-	31,	/* 0111b 2gb */
-	31,	/* 1000b 2gb */
-	32,	/* 1001b 4gb */
-	32,	/* 1010b 4gb */
-	33,	/* 1011b 8gb */
-	0,	/* 1100b future */
-	0,	/* 1101b future */
-	0,	/* 1110b future */
-	0	/* 1111b future */
+static int ddr2_dbam_revCG[] = {
+			   [0]		= 32,
+			   [1]		= 64,
+			   [2]		= 128,
+			   [3]		= 256,
+			   [4]		= 512,
+			   [5]		= 1024,
+			   [6]		= 2048,
+};
+
+static int ddr2_dbam_revD[] = {
+			   [0]		= 32,
+			   [1]		= 64,
+			   [2 ... 3]	= 128,
+			   [4]		= 256,
+			   [5]		= 512,
+			   [6]		= 256,
+			   [7]		= 512,
+			   [8 ... 9]	= 1024,
+			   [10]		= 2048,
+};
+
+static int ddr2_dbam[] = { [0]		= 128,
+			   [1]		= 256,
+			   [2 ... 4]	= 512,
+			   [5 ... 6]	= 1024,
+			   [7 ... 8]	= 2048,
+			   [9 ... 10]	= 4096,
+			   [11]		= 8192,
+};
+
+static int ddr3_dbam[] = { [0]		= -1,
+			   [1]		= 256,
+			   [2]		= 512,
+			   [3 ... 4]	= -1,
+			   [5 ... 6]	= 1024,
+			   [7 ... 8]	= 2048,
+			   [9 ... 10]	= 4096,
+			   [11]	= 8192,
 };
 
 /*
@@ -164,18 +188,16 @@ static int amd64_get_scrub_rate(struct mem_ctl_info *mci, u32 *bw)
 {
 	struct amd64_pvt *pvt = mci->pvt_info;
 	u32 scrubval = 0;
-	int status = -1, i, ret = 0;
+	int status = -1, i;
 
-	ret = pci_read_config_dword(pvt->misc_f3_ctl, K8_SCRCTRL, &scrubval);
-	if (ret)
-		debugf0("Reading K8_SCRCTRL failed\n");
+	amd64_read_pci_cfg(pvt->misc_f3_ctl, K8_SCRCTRL, &scrubval);
 
 	scrubval = scrubval & 0x001F;
 
 	edac_printk(KERN_DEBUG, EDAC_MC,
 		    "pci-read, sdram scrub control value: %d \n", scrubval);
 
-	for (i = 0; ARRAY_SIZE(scrubrates); i++) {
+	for (i = 0; i < ARRAY_SIZE(scrubrates); i++) {
 		if (scrubrates[i].scrubval == scrubval) {
 			*bw = scrubrates[i].bandwidth;
 			status = 0;
@@ -189,7 +211,7 @@ static int amd64_get_scrub_rate(struct mem_ctl_info *mci, u32 *bw)
 /* Map from a CSROW entry to the mask entry that operates on it */
 static inline u32 amd64_map_to_dcs_mask(struct amd64_pvt *pvt, int csrow)
 {
-	if (boot_cpu_data.x86 == 0xf && pvt->ext_model < OPTERON_CPU_REV_F)
+	if (boot_cpu_data.x86 == 0xf && pvt->ext_model < K8_REV_F)
 		return csrow;
 	else
 		return csrow >> 1;
@@ -437,7 +459,7 @@ int amd64_get_dram_hole_info(struct mem_ctl_info *mci, u64 *hole_base,
 	u64 base;
 
 	/* only revE and later have the DRAM Hole Address Register */
-	if (boot_cpu_data.x86 == 0xf && pvt->ext_model < OPTERON_CPU_REV_E) {
+	if (boot_cpu_data.x86 == 0xf && pvt->ext_model < K8_REV_E) {
 		debugf1("  revision %d for node %d does not support DHAR\n",
 			pvt->ext_model, pvt->mc_node_id);
 		return 1;
@@ -743,21 +765,6 @@ static void find_csrow_limits(struct mem_ctl_info *mci, int csrow,
 	*input_addr_max = base | mask | pvt->dcs_mask_notused;
 }
 
-/*
- * Extract error address from MCA NB Address Low (section 3.6.4.5) and MCA NB
- * Address High (section 3.6.4.6) register values and return the result. Address
- * is located in the info structure (nbeah and nbeal), the encoding is device
- * specific.
- */
-static u64 extract_error_address(struct mem_ctl_info *mci,
-				 struct err_regs *info)
-{
-	struct amd64_pvt *pvt = mci->pvt_info;
-
-	return pvt->ops->get_error_address(mci, info);
-}
-
-
 /* Map the Error address to a PAGE and PAGE OFFSET. */
 static inline void error_address_to_page_and_offset(u64 error_address,
 						    u32 *page, u32 *offset)
@@ -787,7 +794,7 @@ static int sys_addr_to_csrow(struct mem_ctl_info *mci, u64 sys_addr)
 	return csrow;
 }
 
-static int get_channel_from_ecc_syndrome(unsigned short syndrome);
+static int get_channel_from_ecc_syndrome(struct mem_ctl_info *, u16);
 
 static void amd64_cpu_display_info(struct amd64_pvt *pvt)
 {
@@ -797,7 +804,7 @@ static void amd64_cpu_display_info(struct amd64_pvt *pvt)
 		edac_printk(KERN_DEBUG, EDAC_MC, "F10h CPU detected\n");
 	else if (boot_cpu_data.x86 == 0xf)
 		edac_printk(KERN_DEBUG, EDAC_MC, "%s detected\n",
-			(pvt->ext_model >= OPTERON_CPU_REV_F) ?
+			(pvt->ext_model >= K8_REV_F) ?
 			"Rev F or later" : "Rev E or earlier");
 	else
 		/* we'll hardly ever ever get here */
@@ -813,7 +820,7 @@ static enum edac_type amd64_determine_edac_cap(struct amd64_pvt *pvt)
 	int bit;
 	enum dev_type edac_cap = EDAC_FLAG_NONE;
 
-	bit = (boot_cpu_data.x86 > 0xf || pvt->ext_model >= OPTERON_CPU_REV_F)
+	bit = (boot_cpu_data.x86 > 0xf || pvt->ext_model >= K8_REV_F)
 		? 19
 		: 17;
 
@@ -824,111 +831,86 @@ static enum edac_type amd64_determine_edac_cap(struct amd64_pvt *pvt)
 }
 
 
-static void f10_debug_display_dimm_sizes(int ctrl, struct amd64_pvt *pvt,
-					 int ganged);
+static void amd64_debug_display_dimm_sizes(int ctrl, struct amd64_pvt *pvt);
+
+static void amd64_dump_dramcfg_low(u32 dclr, int chan)
+{
+	debugf1("F2x%d90 (DRAM Cfg Low): 0x%08x\n", chan, dclr);
+
+	debugf1("  DIMM type: %sbuffered; all DIMMs support ECC: %s\n",
+		(dclr & BIT(16)) ?  "un" : "",
+		(dclr & BIT(19)) ? "yes" : "no");
+
+	debugf1("  PAR/ERR parity: %s\n",
+		(dclr & BIT(8)) ?  "enabled" : "disabled");
+
+	debugf1("  DCT 128bit mode width: %s\n",
+		(dclr & BIT(11)) ?  "128b" : "64b");
+
+	debugf1("  x4 logical DIMMs present: L0: %s L1: %s L2: %s L3: %s\n",
+		(dclr & BIT(12)) ?  "yes" : "no",
+		(dclr & BIT(13)) ?  "yes" : "no",
+		(dclr & BIT(14)) ?  "yes" : "no",
+		(dclr & BIT(15)) ?  "yes" : "no");
+}
 
 /* Display and decode various NB registers for debug purposes. */
 static void amd64_dump_misc_regs(struct amd64_pvt *pvt)
 {
 	int ganged;
 
-	debugf1("  nbcap:0x%8.08x DctDualCap=%s DualNode=%s 8-Node=%s\n",
-		pvt->nbcap,
-		(pvt->nbcap & K8_NBCAP_DCT_DUAL) ? "True" : "False",
-		(pvt->nbcap & K8_NBCAP_DUAL_NODE) ? "True" : "False",
-		(pvt->nbcap & K8_NBCAP_8_NODE) ? "True" : "False");
-	debugf1("    ECC Capable=%s   ChipKill Capable=%s\n",
-		(pvt->nbcap & K8_NBCAP_SECDED) ? "True" : "False",
-		(pvt->nbcap & K8_NBCAP_CHIPKILL) ? "True" : "False");
-	debugf1("  DramCfg0-low=0x%08x DIMM-ECC=%s Parity=%s Width=%s\n",
-		pvt->dclr0,
-		(pvt->dclr0 & BIT(19)) ?  "Enabled" : "Disabled",
-		(pvt->dclr0 & BIT(8)) ?  "Enabled" : "Disabled",
-		(pvt->dclr0 & BIT(11)) ?  "128b" : "64b");
-	debugf1("    DIMM x4 Present: L0=%s L1=%s L2=%s L3=%s  DIMM Type=%s\n",
-		(pvt->dclr0 & BIT(12)) ?  "Y" : "N",
-		(pvt->dclr0 & BIT(13)) ?  "Y" : "N",
-		(pvt->dclr0 & BIT(14)) ?  "Y" : "N",
-		(pvt->dclr0 & BIT(15)) ?  "Y" : "N",
-		(pvt->dclr0 & BIT(16)) ?  "UN-Buffered" : "Buffered");
-
-
-	debugf1("  online-spare: 0x%8.08x\n", pvt->online_spare);
+	debugf1("F3xE8 (NB Cap): 0x%08x\n", pvt->nbcap);
 
-	if (boot_cpu_data.x86 == 0xf) {
-		debugf1("  dhar: 0x%8.08x Base=0x%08x Offset=0x%08x\n",
-			pvt->dhar, dhar_base(pvt->dhar),
-			k8_dhar_offset(pvt->dhar));
-		debugf1("      DramHoleValid=%s\n",
-			(pvt->dhar & DHAR_VALID) ?  "True" : "False");
+	debugf1("  NB two channel DRAM capable: %s\n",
+		(pvt->nbcap & K8_NBCAP_DCT_DUAL) ? "yes" : "no");
 
-		debugf1("  dbam-dkt: 0x%8.08x\n", pvt->dbam0);
+	debugf1("  ECC capable: %s, ChipKill ECC capable: %s\n",
+		(pvt->nbcap & K8_NBCAP_SECDED) ? "yes" : "no",
+		(pvt->nbcap & K8_NBCAP_CHIPKILL) ? "yes" : "no");
 
-		/* everything below this point is Fam10h and above */
-		return;
+	amd64_dump_dramcfg_low(pvt->dclr0, 0);
 
-	} else {
-		debugf1("  dhar: 0x%8.08x Base=0x%08x Offset=0x%08x\n",
-			pvt->dhar, dhar_base(pvt->dhar),
-			f10_dhar_offset(pvt->dhar));
-		debugf1("    DramMemHoistValid=%s DramHoleValid=%s\n",
-			(pvt->dhar & F10_DRAM_MEM_HOIST_VALID) ?
-			"True" : "False",
-			(pvt->dhar & DHAR_VALID) ?
-			"True" : "False");
-	}
+	debugf1("F3xB0 (Online Spare): 0x%08x\n", pvt->online_spare);
 
-	/* Only if NOT ganged does dcl1 have valid info */
-	if (!dct_ganging_enabled(pvt)) {
-		debugf1("  DramCfg1-low=0x%08x DIMM-ECC=%s Parity=%s "
-			"Width=%s\n", pvt->dclr1,
-			(pvt->dclr1 & BIT(19)) ?  "Enabled" : "Disabled",
-			(pvt->dclr1 & BIT(8)) ?  "Enabled" : "Disabled",
-			(pvt->dclr1 & BIT(11)) ?  "128b" : "64b");
-		debugf1("    DIMM x4 Present: L0=%s L1=%s L2=%s L3=%s  "
-			"DIMM Type=%s\n",
-			(pvt->dclr1 & BIT(12)) ?  "Y" : "N",
-			(pvt->dclr1 & BIT(13)) ?  "Y" : "N",
-			(pvt->dclr1 & BIT(14)) ?  "Y" : "N",
-			(pvt->dclr1 & BIT(15)) ?  "Y" : "N",
-			(pvt->dclr1 & BIT(16)) ?  "UN-Buffered" : "Buffered");
+	debugf1("F1xF0 (DRAM Hole Address): 0x%08x, base: 0x%08x, "
+			"offset: 0x%08x\n",
+			pvt->dhar,
+			dhar_base(pvt->dhar),
+			(boot_cpu_data.x86 == 0xf) ? k8_dhar_offset(pvt->dhar)
+						   : f10_dhar_offset(pvt->dhar));
+
+	debugf1("  DramHoleValid: %s\n",
+		(pvt->dhar & DHAR_VALID) ? "yes" : "no");
+
+	/* everything below this point is Fam10h and above */
+	if (boot_cpu_data.x86 == 0xf) {
+		amd64_debug_display_dimm_sizes(0, pvt);
+		return;
 	}
 
+	/* Only if NOT ganged does dclr1 have valid info */
+	if (!dct_ganging_enabled(pvt))
+		amd64_dump_dramcfg_low(pvt->dclr1, 1);
+
 	/*
 	 * Determine if ganged and then dump memory sizes for first controller,
 	 * and if NOT ganged dump info for 2nd controller.
 	 */
 	ganged = dct_ganging_enabled(pvt);
 
-	f10_debug_display_dimm_sizes(0, pvt, ganged);
+	amd64_debug_display_dimm_sizes(0, pvt);
 
 	if (!ganged)
-		f10_debug_display_dimm_sizes(1, pvt, ganged);
+		amd64_debug_display_dimm_sizes(1, pvt);
 }
 
 /* Read in both of DBAM registers */
 static void amd64_read_dbam_reg(struct amd64_pvt *pvt)
 {
-	int err = 0;
-	unsigned int reg;
+	amd64_read_pci_cfg(pvt->dram_f2_ctl, DBAM0, &pvt->dbam0);
 
-	reg = DBAM0;
-	err = pci_read_config_dword(pvt->dram_f2_ctl, reg, &pvt->dbam0);
-	if (err)
-		goto err_reg;
-
-	if (boot_cpu_data.x86 >= 0x10) {
-		reg = DBAM1;
-		err = pci_read_config_dword(pvt->dram_f2_ctl, reg, &pvt->dbam1);
-
-		if (err)
-			goto err_reg;
-	}
-
-	return;
-
-err_reg:
-	debugf0("Error reading F2x%03x.\n", reg);
+	if (boot_cpu_data.x86 >= 0x10)
+		amd64_read_pci_cfg(pvt->dram_f2_ctl, DBAM1, &pvt->dbam1);
 }
 
 /*
@@ -963,7 +945,7 @@ err_reg:
 static void amd64_set_dct_base_and_mask(struct amd64_pvt *pvt)
 {
 
-	if (boot_cpu_data.x86 == 0xf && pvt->ext_model < OPTERON_CPU_REV_F) {
+	if (boot_cpu_data.x86 == 0xf && pvt->ext_model < K8_REV_F) {
 		pvt->dcsb_base		= REV_E_DCSB_BASE_BITS;
 		pvt->dcsm_mask		= REV_E_DCSM_MASK_BITS;
 		pvt->dcs_mask_notused	= REV_E_DCS_NOTUSED_BITS;
@@ -991,28 +973,21 @@ static void amd64_set_dct_base_and_mask(struct amd64_pvt *pvt)
  */
 static void amd64_read_dct_base_mask(struct amd64_pvt *pvt)
 {
-	int cs, reg, err = 0;
+	int cs, reg;
 
 	amd64_set_dct_base_and_mask(pvt);
 
 	for (cs = 0; cs < pvt->cs_count; cs++) {
 		reg = K8_DCSB0 + (cs * 4);
-		err = pci_read_config_dword(pvt->dram_f2_ctl, reg,
-						&pvt->dcsb0[cs]);
-		if (unlikely(err))
-			debugf0("Reading K8_DCSB0[%d] failed\n", cs);
-		else
+		if (!amd64_read_pci_cfg(pvt->dram_f2_ctl, reg, &pvt->dcsb0[cs]))
 			debugf0("  DCSB0[%d]=0x%08x reg: F2x%x\n",
 				cs, pvt->dcsb0[cs], reg);
 
 		/* If DCT are NOT ganged, then read in DCT1's base */
 		if (boot_cpu_data.x86 >= 0x10 && !dct_ganging_enabled(pvt)) {
 			reg = F10_DCSB1 + (cs * 4);
-			err = pci_read_config_dword(pvt->dram_f2_ctl, reg,
-							&pvt->dcsb1[cs]);
-			if (unlikely(err))
-				debugf0("Reading F10_DCSB1[%d] failed\n", cs);
-			else
+			if (!amd64_read_pci_cfg(pvt->dram_f2_ctl, reg,
+						&pvt->dcsb1[cs]))
 				debugf0("  DCSB1[%d]=0x%08x reg: F2x%x\n",
 					cs, pvt->dcsb1[cs], reg);
 		} else {
@@ -1022,26 +997,20 @@ static void amd64_read_dct_base_mask(struct amd64_pvt *pvt)
 
 	for (cs = 0; cs < pvt->num_dcsm; cs++) {
 		reg = K8_DCSM0 + (cs * 4);
-		err = pci_read_config_dword(pvt->dram_f2_ctl, reg,
-					&pvt->dcsm0[cs]);
-		if (unlikely(err))
-			debugf0("Reading K8_DCSM0 failed\n");
-		else
+		if (!amd64_read_pci_cfg(pvt->dram_f2_ctl, reg, &pvt->dcsm0[cs]))
 			debugf0("    DCSM0[%d]=0x%08x reg: F2x%x\n",
 				cs, pvt->dcsm0[cs], reg);
 
 		/* If DCT are NOT ganged, then read in DCT1's mask */
 		if (boot_cpu_data.x86 >= 0x10 && !dct_ganging_enabled(pvt)) {
 			reg = F10_DCSM1 + (cs * 4);
-			err = pci_read_config_dword(pvt->dram_f2_ctl, reg,
-					&pvt->dcsm1[cs]);
-			if (unlikely(err))
-				debugf0("Reading F10_DCSM1[%d] failed\n", cs);
-			else
+			if (!amd64_read_pci_cfg(pvt->dram_f2_ctl, reg,
+						&pvt->dcsm1[cs]))
 				debugf0("    DCSM1[%d]=0x%08x reg: F2x%x\n",
 					cs, pvt->dcsm1[cs], reg);
-		} else
+		} else {
 			pvt->dcsm1[cs] = 0;
+		}
 	}
 }
 
@@ -1049,18 +1018,16 @@ static enum mem_type amd64_determine_memory_type(struct amd64_pvt *pvt)
 {
 	enum mem_type type;
 
-	if (boot_cpu_data.x86 >= 0x10 || pvt->ext_model >= OPTERON_CPU_REV_F) {
-		/* Rev F and later */
-		type = (pvt->dclr0 & BIT(16)) ? MEM_DDR2 : MEM_RDDR2;
+	if (boot_cpu_data.x86 >= 0x10 || pvt->ext_model >= K8_REV_F) {
+		if (pvt->dchr0 & DDR3_MODE)
+			type = (pvt->dclr0 & BIT(16)) ?	MEM_DDR3 : MEM_RDDR3;
+		else
+			type = (pvt->dclr0 & BIT(16)) ? MEM_DDR2 : MEM_RDDR2;
 	} else {
-		/* Rev E and earlier */
 		type = (pvt->dclr0 & BIT(18)) ? MEM_DDR : MEM_RDDR;
 	}
 
-	debugf1("  Memory type is: %s\n",
-		(type == MEM_DDR2) ? "MEM_DDR2" :
-		(type == MEM_RDDR2) ? "MEM_RDDR2" :
-		(type == MEM_DDR) ? "MEM_DDR" : "MEM_RDDR");
+	debugf1("  Memory type is: %s\n", edac_mem_types[type]);
 
 	return type;
 }
@@ -1078,11 +1045,11 @@ static int k8_early_channel_count(struct amd64_pvt *pvt)
 {
 	int flag, err = 0;
 
-	err = pci_read_config_dword(pvt->dram_f2_ctl, F10_DCLR_0, &pvt->dclr0);
+	err = amd64_read_pci_cfg(pvt->dram_f2_ctl, F10_DCLR_0, &pvt->dclr0);
 	if (err)
 		return err;
 
-	if ((boot_cpu_data.x86_model >> 4) >= OPTERON_CPU_REV_F) {
+	if ((boot_cpu_data.x86_model >> 4) >= K8_REV_F) {
 		/* RevF (NPT) and later */
 		flag = pvt->dclr0 & F10_WIDTH_128;
 	} else {
@@ -1114,22 +1081,15 @@ static void k8_read_dram_base_limit(struct amd64_pvt *pvt, int dram)
 {
 	u32 low;
 	u32 off = dram << 3;	/* 8 bytes between DRAM entries */
-	int err;
 
-	err = pci_read_config_dword(pvt->addr_f1_ctl,
-				    K8_DRAM_BASE_LOW + off, &low);
-	if (err)
-		debugf0("Reading K8_DRAM_BASE_LOW failed\n");
+	amd64_read_pci_cfg(pvt->addr_f1_ctl, K8_DRAM_BASE_LOW + off, &low);
 
 	/* Extract parts into separate data entries */
 	pvt->dram_base[dram] = ((u64) low & 0xFFFF0000) << 8;
 	pvt->dram_IntlvEn[dram] = (low >> 8) & 0x7;
 	pvt->dram_rw_en[dram] = (low & 0x3);
 
-	err = pci_read_config_dword(pvt->addr_f1_ctl,
-				    K8_DRAM_LIMIT_LOW + off, &low);
-	if (err)
-		debugf0("Reading K8_DRAM_LIMIT_LOW failed\n");
+	amd64_read_pci_cfg(pvt->addr_f1_ctl, K8_DRAM_LIMIT_LOW + off, &low);
 
 	/*
 	 * Extract parts into separate data entries. Limit is the HIGHEST memory
@@ -1142,7 +1102,7 @@ static void k8_read_dram_base_limit(struct amd64_pvt *pvt, int dram)
 
 static void k8_map_sysaddr_to_csrow(struct mem_ctl_info *mci,
 					struct err_regs *info,
-					u64 SystemAddress)
+					u64 sys_addr)
 {
 	struct mem_ctl_info *src_mci;
 	unsigned short syndrome;
@@ -1155,7 +1115,7 @@ static void k8_map_sysaddr_to_csrow(struct mem_ctl_info *mci,
 
 	/* CHIPKILL enabled */
 	if (info->nbcfg & K8_NBCFG_CHIPKILL) {
-		channel = get_channel_from_ecc_syndrome(syndrome);
+		channel = get_channel_from_ecc_syndrome(mci, syndrome);
 		if (channel < 0) {
 			/*
 			 * Syndrome didn't map, so we don't know which of the
@@ -1177,64 +1137,46 @@ static void k8_map_sysaddr_to_csrow(struct mem_ctl_info *mci,
 		 * was obtained from email communication with someone at AMD.
 		 * (Wish the email was placed in this comment - norsk)
 		 */
-		channel = ((SystemAddress & BIT(3)) != 0);
+		channel = ((sys_addr & BIT(3)) != 0);
 	}
 
 	/*
 	 * Find out which node the error address belongs to. This may be
 	 * different from the node that detected the error.
 	 */
-	src_mci = find_mc_by_sys_addr(mci, SystemAddress);
+	src_mci = find_mc_by_sys_addr(mci, sys_addr);
 	if (!src_mci) {
 		amd64_mc_printk(mci, KERN_ERR,
 			     "failed to map error address 0x%lx to a node\n",
-			     (unsigned long)SystemAddress);
+			     (unsigned long)sys_addr);
 		edac_mc_handle_ce_no_info(mci, EDAC_MOD_STR);
 		return;
 	}
 
-	/* Now map the SystemAddress to a CSROW */
-	csrow = sys_addr_to_csrow(src_mci, SystemAddress);
+	/* Now map the sys_addr to a CSROW */
+	csrow = sys_addr_to_csrow(src_mci, sys_addr);
 	if (csrow < 0) {
 		edac_mc_handle_ce_no_info(src_mci, EDAC_MOD_STR);
 	} else {
-		error_address_to_page_and_offset(SystemAddress, &page, &offset);
+		error_address_to_page_and_offset(sys_addr, &page, &offset);
 
 		edac_mc_handle_ce(src_mci, page, offset, syndrome, csrow,
 				  channel, EDAC_MOD_STR);
 	}
 }
 
-/*
- * determrine the number of PAGES in for this DIMM's size based on its DRAM
- * Address Mapping.
- *
- * First step is to calc the number of bits to shift a value of 1 left to
- * indicate show many pages. Start with the DBAM value as the starting bits,
- * then proceed to adjust those shift bits, based on CPU rev and the table.
- * See BKDG on the DBAM
- */
-static int k8_dbam_map_to_pages(struct amd64_pvt *pvt, int dram_map)
+static int k8_dbam_to_chip_select(struct amd64_pvt *pvt, int cs_mode)
 {
-	int nr_pages;
-
-	if (pvt->ext_model >= OPTERON_CPU_REV_F) {
-		nr_pages = 1 << (revf_quad_ddr2_shift[dram_map] - PAGE_SHIFT);
-	} else {
-		/*
-		 * RevE and less section; this line is tricky. It collapses the
-		 * table used by RevD and later to one that matches revisions CG
-		 * and earlier.
-		 */
-		dram_map -= (pvt->ext_model >= OPTERON_CPU_REV_D) ?
-				(dram_map > 8 ? 4 : (dram_map > 5 ?
-				3 : (dram_map > 2 ? 1 : 0))) : 0;
+	int *dbam_map;
 
-		/* 25 shift is 32MiB minimum DIMM size in RevE and prior */
-		nr_pages = 1 << (dram_map + 25 - PAGE_SHIFT);
-	}
+	if (pvt->ext_model >= K8_REV_F)
+		dbam_map = ddr2_dbam;
+	else if (pvt->ext_model >= K8_REV_D)
+		dbam_map = ddr2_dbam_revD;
+	else
+		dbam_map = ddr2_dbam_revCG;
 
-	return nr_pages;
+	return dbam_map[cs_mode];
 }
 
 /*
@@ -1248,34 +1190,24 @@ static int k8_dbam_map_to_pages(struct amd64_pvt *pvt, int dram_map)
 static int f10_early_channel_count(struct amd64_pvt *pvt)
 {
 	int dbams[] = { DBAM0, DBAM1 };
-	int err = 0, channels = 0;
-	int i, j;
+	int i, j, channels = 0;
 	u32 dbam;
 
-	err = pci_read_config_dword(pvt->dram_f2_ctl, F10_DCLR_0, &pvt->dclr0);
-	if (err)
-		goto err_reg;
-
-	err = pci_read_config_dword(pvt->dram_f2_ctl, F10_DCLR_1, &pvt->dclr1);
-	if (err)
-		goto err_reg;
-
 	/* If we are in 128 bit mode, then we are using 2 channels */
 	if (pvt->dclr0 & F10_WIDTH_128) {
-		debugf0("Data WIDTH is 128 bits - 2 channels\n");
 		channels = 2;
 		return channels;
 	}
 
 	/*
-	 * Need to check if in UN-ganged mode: In such, there are 2 channels,
-	 * but they are NOT in 128 bit mode and thus the above 'dcl0' status bit
-	 * will be OFF.
+	 * Need to check if in unganged mode: In such, there are 2 channels,
+	 * but they are not in 128 bit mode and thus the above 'dclr0' status
+	 * bit will be OFF.
 	 *
 	 * Need to check DCT0[0] and DCT1[0] to see if only one of them has
 	 * their CSEnable bit on. If so, then SINGLE DIMM case.
 	 */
-	debugf0("Data WIDTH is NOT 128 bits - need more decoding\n");
+	debugf0("Data width is not 128 bits - need more decoding\n");
 
 	/*
 	 * Check DRAM Bank Address Mapping values for each DIMM to see if there
@@ -1283,8 +1215,7 @@ static int f10_early_channel_count(struct amd64_pvt *pvt)
 	 * both controllers since DIMMs can be placed in either one.
 	 */
 	for (i = 0; i < ARRAY_SIZE(dbams); i++) {
-		err = pci_read_config_dword(pvt->dram_f2_ctl, dbams[i], &dbam);
-		if (err)
+		if (amd64_read_pci_cfg(pvt->dram_f2_ctl, dbams[i], &dbam))
 			goto err_reg;
 
 		for (j = 0; j < 4; j++) {
@@ -1295,6 +1226,9 @@ static int f10_early_channel_count(struct amd64_pvt *pvt)
 		}
 	}
 
+	if (channels > 2)
+		channels = 2;
+
 	debugf0("MCT channel count: %d\n", channels);
 
 	return channels;
@@ -1304,9 +1238,16 @@ err_reg:
 
 }
 
-static int f10_dbam_map_to_pages(struct amd64_pvt *pvt, int dram_map)
+static int f10_dbam_to_chip_select(struct amd64_pvt *pvt, int cs_mode)
 {
-	return 1 << (revf_quad_ddr2_shift[dram_map] - PAGE_SHIFT);
+	int *dbam_map;
+
+	if (pvt->dchr0 & DDR3_MODE || pvt->dchr1 & DDR3_MODE)
+		dbam_map = ddr3_dbam;
+	else
+		dbam_map = ddr2_dbam;
+
+	return dbam_map[cs_mode];
 }
 
 /* Enable extended configuration access via 0xCF8 feature */
@@ -1314,7 +1255,7 @@ static void amd64_setup(struct amd64_pvt *pvt)
 {
 	u32 reg;
 
-	pci_read_config_dword(pvt->misc_f3_ctl, F10_NB_CFG_HIGH, &reg);
+	amd64_read_pci_cfg(pvt->misc_f3_ctl, F10_NB_CFG_HIGH, &reg);
 
 	pvt->flags.cf8_extcfg = !!(reg & F10_NB_CFG_LOW_ENABLE_EXT_CFG);
 	reg |= F10_NB_CFG_LOW_ENABLE_EXT_CFG;
@@ -1326,7 +1267,7 @@ static void amd64_teardown(struct amd64_pvt *pvt)
 {
 	u32 reg;
 
-	pci_read_config_dword(pvt->misc_f3_ctl, F10_NB_CFG_HIGH, &reg);
+	amd64_read_pci_cfg(pvt->misc_f3_ctl, F10_NB_CFG_HIGH, &reg);
 
 	reg &= ~F10_NB_CFG_LOW_ENABLE_EXT_CFG;
 	if (pvt->flags.cf8_extcfg)
@@ -1355,10 +1296,10 @@ static void f10_read_dram_base_limit(struct amd64_pvt *pvt, int dram)
 	high_offset = F10_DRAM_BASE_HIGH + (dram << 3);
 
 	/* read the 'raw' DRAM BASE Address register */
-	pci_read_config_dword(pvt->addr_f1_ctl, low_offset, &low_base);
+	amd64_read_pci_cfg(pvt->addr_f1_ctl, low_offset, &low_base);
 
 	/* Read from the ECS data register */
-	pci_read_config_dword(pvt->addr_f1_ctl, high_offset, &high_base);
+	amd64_read_pci_cfg(pvt->addr_f1_ctl, high_offset, &high_base);
 
 	/* Extract parts into separate data entries */
 	pvt->dram_rw_en[dram] = (low_base & 0x3);
@@ -1375,13 +1316,10 @@ static void f10_read_dram_base_limit(struct amd64_pvt *pvt, int dram)
 	high_offset = F10_DRAM_LIMIT_HIGH + (dram << 3);
 
 	/* read the 'raw' LIMIT registers */
-	pci_read_config_dword(pvt->addr_f1_ctl, low_offset, &low_limit);
+	amd64_read_pci_cfg(pvt->addr_f1_ctl, low_offset, &low_limit);
 
 	/* Read from the ECS data register for the HIGH portion */
-	pci_read_config_dword(pvt->addr_f1_ctl, high_offset, &high_limit);
-
-	debugf0("  HW Regs: BASE=0x%08x-%08x      LIMIT=  0x%08x-%08x\n",
-		high_base, low_base, high_limit, low_limit);
+	amd64_read_pci_cfg(pvt->addr_f1_ctl, high_offset, &high_limit);
 
 	pvt->dram_DstNode[dram] = (low_limit & 0x7);
 	pvt->dram_IntlvSel[dram] = (low_limit >> 8) & 0x7;
@@ -1397,32 +1335,35 @@ static void f10_read_dram_base_limit(struct amd64_pvt *pvt, int dram)
 
 static void f10_read_dram_ctl_register(struct amd64_pvt *pvt)
 {
-	int err = 0;
 
-	err = pci_read_config_dword(pvt->dram_f2_ctl, F10_DCTL_SEL_LOW,
-				    &pvt->dram_ctl_select_low);
-	if (err) {
-		debugf0("Reading F10_DCTL_SEL_LOW failed\n");
-	} else {
-		debugf0("DRAM_DCTL_SEL_LOW=0x%x  DctSelBaseAddr=0x%x\n",
-			pvt->dram_ctl_select_low, dct_sel_baseaddr(pvt));
-
-		debugf0("  DRAM DCTs are=%s DRAM Is=%s DRAM-Ctl-"
-				"sel-hi-range=%s\n",
-			(dct_ganging_enabled(pvt) ? "GANGED" : "NOT GANGED"),
-			(dct_dram_enabled(pvt) ? "Enabled"   : "Disabled"),
-			(dct_high_range_enabled(pvt) ? "Enabled" : "Disabled"));
-
-		debugf0("  DctDatIntLv=%s MemCleared=%s DctSelIntLvAddr=0x%x\n",
-			(dct_data_intlv_enabled(pvt) ? "Enabled" : "Disabled"),
-			(dct_memory_cleared(pvt) ? "True " : "False "),
+	if (!amd64_read_pci_cfg(pvt->dram_f2_ctl, F10_DCTL_SEL_LOW,
+				&pvt->dram_ctl_select_low)) {
+		debugf0("F2x110 (DCTL Sel. Low): 0x%08x, "
+			"High range addresses at: 0x%x\n",
+			pvt->dram_ctl_select_low,
+			dct_sel_baseaddr(pvt));
+
+		debugf0("  DCT mode: %s, All DCTs on: %s\n",
+			(dct_ganging_enabled(pvt) ? "ganged" : "unganged"),
+			(dct_dram_enabled(pvt) ? "yes"   : "no"));
+
+		if (!dct_ganging_enabled(pvt))
+			debugf0("  Address range split per DCT: %s\n",
+				(dct_high_range_enabled(pvt) ? "yes" : "no"));
+
+		debugf0("  DCT data interleave for ECC: %s, "
+			"DRAM cleared since last warm reset: %s\n",
+			(dct_data_intlv_enabled(pvt) ? "enabled" : "disabled"),
+			(dct_memory_cleared(pvt) ? "yes" : "no"));
+
+		debugf0("  DCT channel interleave: %s, "
+			"DCT interleave bits selector: 0x%x\n",
+			(dct_interleave_enabled(pvt) ? "enabled" : "disabled"),
 			dct_sel_interleave_addr(pvt));
 	}
 
-	err = pci_read_config_dword(pvt->dram_f2_ctl, F10_DCTL_SEL_HIGH,
-				    &pvt->dram_ctl_select_high);
-	if (err)
-		debugf0("Reading F10_DCTL_SEL_HIGH failed\n");
+	amd64_read_pci_cfg(pvt->dram_f2_ctl, F10_DCTL_SEL_HIGH,
+			   &pvt->dram_ctl_select_high);
 }
 
 /*
@@ -1706,10 +1647,11 @@ static int f10_translate_sysaddr_to_cs(struct amd64_pvt *pvt, u64 sys_addr,
 }
 
 /*
- * This the F10h reference code from AMD to map a @sys_addr to NodeID,
- * CSROW, Channel.
+ * For reference see "2.8.5 Routing DRAM Requests" in F10 BKDG. This code maps
+ * a @sys_addr to NodeID, DCT (channel) and chip select (CSROW).
  *
- * The @sys_addr is usually an error address received from the hardware.
+ * The @sys_addr is usually an error address received from the hardware
+ * (MCX_ADDR).
  */
 static void f10_map_sysaddr_to_csrow(struct mem_ctl_info *mci,
 				     struct err_regs *info,
@@ -1722,133 +1664,80 @@ static void f10_map_sysaddr_to_csrow(struct mem_ctl_info *mci,
 
 	csrow = f10_translate_sysaddr_to_cs(pvt, sys_addr, &nid, &chan);
 
-	if (csrow >= 0) {
-		error_address_to_page_and_offset(sys_addr, &page, &offset);
-
-		syndrome  = HIGH_SYNDROME(info->nbsl) << 8;
-		syndrome |= LOW_SYNDROME(info->nbsh);
-
-		/*
-		 * Is CHIPKILL on? If so, then we can attempt to use the
-		 * syndrome to isolate which channel the error was on.
-		 */
-		if (pvt->nbcfg & K8_NBCFG_CHIPKILL)
-			chan = get_channel_from_ecc_syndrome(syndrome);
-
-		if (chan >= 0) {
-			edac_mc_handle_ce(mci, page, offset, syndrome,
-					csrow, chan, EDAC_MOD_STR);
-		} else {
-			/*
-			 * Channel unknown, report all channels on this
-			 * CSROW as failed.
-			 */
-			for (chan = 0; chan < mci->csrows[csrow].nr_channels;
-								chan++) {
-					edac_mc_handle_ce(mci, page, offset,
-							syndrome,
-							csrow, chan,
-							EDAC_MOD_STR);
-			}
-		}
-
-	} else {
+	if (csrow < 0) {
 		edac_mc_handle_ce_no_info(mci, EDAC_MOD_STR);
+		return;
 	}
-}
 
-/*
- * Input (@index) is the DBAM DIMM value (1 of 4) used as an index into a shift
- * table (revf_quad_ddr2_shift) which starts at 128MB DIMM size. Index of 0
- * indicates an empty DIMM slot, as reported by Hardware on empty slots.
- *
- * Normalize to 128MB by subracting 27 bit shift.
- */
-static int map_dbam_to_csrow_size(int index)
-{
-	int mega_bytes = 0;
+	error_address_to_page_and_offset(sys_addr, &page, &offset);
 
-	if (index > 0 && index <= DBAM_MAX_VALUE)
-		mega_bytes = ((128 << (revf_quad_ddr2_shift[index]-27)));
+	syndrome  = HIGH_SYNDROME(info->nbsl) << 8;
+	syndrome |= LOW_SYNDROME(info->nbsh);
+
+	/*
+	 * We need the syndromes for channel detection only when we're
+	 * ganged. Otherwise @chan should already contain the channel at
+	 * this point.
+	 */
+	if (dct_ganging_enabled(pvt) && pvt->nbcfg & K8_NBCFG_CHIPKILL)
+		chan = get_channel_from_ecc_syndrome(mci, syndrome);
 
-	return mega_bytes;
+	if (chan >= 0)
+		edac_mc_handle_ce(mci, page, offset, syndrome, csrow, chan,
+				  EDAC_MOD_STR);
+	else
+		/*
+		 * Channel unknown, report all channels on this CSROW as failed.
+		 */
+		for (chan = 0; chan < mci->csrows[csrow].nr_channels; chan++)
+			edac_mc_handle_ce(mci, page, offset, syndrome,
+					  csrow, chan, EDAC_MOD_STR);
 }
 
 /*
- * debug routine to display the memory sizes of a DIMM (ganged or not) and it
+ * debug routine to display the memory sizes of all logical DIMMs and its
  * CSROWs as well
  */
-static void f10_debug_display_dimm_sizes(int ctrl, struct amd64_pvt *pvt,
-					 int ganged)
+static void amd64_debug_display_dimm_sizes(int ctrl, struct amd64_pvt *pvt)
 {
-	int dimm, size0, size1;
+	int dimm, size0, size1, factor = 0;
 	u32 dbam;
 	u32 *dcsb;
 
-	debugf1("  dbam%d: 0x%8.08x  CSROW is %s\n", ctrl,
-			ctrl ? pvt->dbam1 : pvt->dbam0,
-			ganged ? "GANGED - dbam1 not used" : "NON-GANGED");
+	if (boot_cpu_data.x86 == 0xf) {
+		if (pvt->dclr0 & F10_WIDTH_128)
+			factor = 1;
+
+		/* K8 families < revF not supported yet */
+	       if (pvt->ext_model < K8_REV_F)
+			return;
+	       else
+		       WARN_ON(ctrl != 0);
+	}
+
+	debugf1("F2x%d80 (DRAM Bank Address Mapping): 0x%08x\n",
+		ctrl, ctrl ? pvt->dbam1 : pvt->dbam0);
 
 	dbam = ctrl ? pvt->dbam1 : pvt->dbam0;
 	dcsb = ctrl ? pvt->dcsb1 : pvt->dcsb0;
 
+	edac_printk(KERN_DEBUG, EDAC_MC, "DCT%d chip selects:\n", ctrl);
+
 	/* Dump memory sizes for DIMM and its CSROWs */
 	for (dimm = 0; dimm < 4; dimm++) {
 
 		size0 = 0;
 		if (dcsb[dimm*2] & K8_DCSB_CS_ENABLE)
-			size0 = map_dbam_to_csrow_size(DBAM_DIMM(dimm, dbam));
+			size0 = pvt->ops->dbam_to_cs(pvt, DBAM_DIMM(dimm, dbam));
 
 		size1 = 0;
 		if (dcsb[dimm*2 + 1] & K8_DCSB_CS_ENABLE)
-			size1 = map_dbam_to_csrow_size(DBAM_DIMM(dimm, dbam));
-
-		debugf1("     CTRL-%d DIMM-%d=%5dMB   CSROW-%d=%5dMB "
-				"CSROW-%d=%5dMB\n",
-				ctrl,
-				dimm,
-				size0 + size1,
-				dimm * 2,
-				size0,
-				dimm * 2 + 1,
-				size1);
-	}
-}
-
-/*
- * Very early hardware probe on pci_probe thread to determine if this module
- * supports the hardware.
- *
- * Return:
- *      0 for OK
- *      1 for error
- */
-static int f10_probe_valid_hardware(struct amd64_pvt *pvt)
-{
-	int ret = 0;
-
-	/*
-	 * If we are on a DDR3 machine, we don't know yet if
-	 * we support that properly at this time
-	 */
-	if ((pvt->dchr0 & F10_DCHR_Ddr3Mode) ||
-	    (pvt->dchr1 & F10_DCHR_Ddr3Mode)) {
-
-		amd64_printk(KERN_WARNING,
-			"%s() This machine is running with DDR3 memory. "
-			"This is not currently supported. "
-			"DCHR0=0x%x DCHR1=0x%x\n",
-			__func__, pvt->dchr0, pvt->dchr1);
-
-		amd64_printk(KERN_WARNING,
-			"   Contact '%s' module MAINTAINER to help add"
-			" support.\n",
-			EDAC_MOD_STR);
-
-		ret = 1;
+			size1 = pvt->ops->dbam_to_cs(pvt, DBAM_DIMM(dimm, dbam));
 
+		edac_printk(KERN_DEBUG, EDAC_MC, " %d: %5dMB %d: %5dMB\n",
+			    dimm * 2,     size0 << factor,
+			    dimm * 2 + 1, size1 << factor);
 	}
-	return ret;
 }
 
 /*
@@ -1868,11 +1757,11 @@ static struct amd64_family_type amd64_family_types[] = {
 		.addr_f1_ctl = PCI_DEVICE_ID_AMD_K8_NB_ADDRMAP,
 		.misc_f3_ctl = PCI_DEVICE_ID_AMD_K8_NB_MISC,
 		.ops = {
-			.early_channel_count = k8_early_channel_count,
-			.get_error_address = k8_get_error_address,
-			.read_dram_base_limit = k8_read_dram_base_limit,
-			.map_sysaddr_to_csrow = k8_map_sysaddr_to_csrow,
-			.dbam_map_to_pages = k8_dbam_map_to_pages,
+			.early_channel_count	= k8_early_channel_count,
+			.get_error_address	= k8_get_error_address,
+			.read_dram_base_limit	= k8_read_dram_base_limit,
+			.map_sysaddr_to_csrow	= k8_map_sysaddr_to_csrow,
+			.dbam_to_cs		= k8_dbam_to_chip_select,
 		}
 	},
 	[F10_CPUS] = {
@@ -1880,13 +1769,12 @@ static struct amd64_family_type amd64_family_types[] = {
 		.addr_f1_ctl = PCI_DEVICE_ID_AMD_10H_NB_MAP,
 		.misc_f3_ctl = PCI_DEVICE_ID_AMD_10H_NB_MISC,
 		.ops = {
-			.probe_valid_hardware = f10_probe_valid_hardware,
-			.early_channel_count = f10_early_channel_count,
-			.get_error_address = f10_get_error_address,
-			.read_dram_base_limit = f10_read_dram_base_limit,
-			.read_dram_ctl_register = f10_read_dram_ctl_register,
-			.map_sysaddr_to_csrow = f10_map_sysaddr_to_csrow,
-			.dbam_map_to_pages = f10_dbam_map_to_pages,
+			.early_channel_count	= f10_early_channel_count,
+			.get_error_address	= f10_get_error_address,
+			.read_dram_base_limit	= f10_read_dram_base_limit,
+			.read_dram_ctl_register	= f10_read_dram_ctl_register,
+			.map_sysaddr_to_csrow	= f10_map_sysaddr_to_csrow,
+			.dbam_to_cs		= f10_dbam_to_chip_select,
 		}
 	},
 	[F11_CPUS] = {
@@ -1894,13 +1782,12 @@ static struct amd64_family_type amd64_family_types[] = {
 		.addr_f1_ctl = PCI_DEVICE_ID_AMD_11H_NB_MAP,
 		.misc_f3_ctl = PCI_DEVICE_ID_AMD_11H_NB_MISC,
 		.ops = {
-			.probe_valid_hardware = f10_probe_valid_hardware,
-			.early_channel_count = f10_early_channel_count,
-			.get_error_address = f10_get_error_address,
-			.read_dram_base_limit = f10_read_dram_base_limit,
-			.read_dram_ctl_register = f10_read_dram_ctl_register,
-			.map_sysaddr_to_csrow = f10_map_sysaddr_to_csrow,
-			.dbam_map_to_pages = f10_dbam_map_to_pages,
+			.early_channel_count	= f10_early_channel_count,
+			.get_error_address	= f10_get_error_address,
+			.read_dram_base_limit	= f10_read_dram_base_limit,
+			.read_dram_ctl_register	= f10_read_dram_ctl_register,
+			.map_sysaddr_to_csrow	= f10_map_sysaddr_to_csrow,
+			.dbam_to_cs		= f10_dbam_to_chip_select,
 		}
 	},
 };
@@ -1923,142 +1810,170 @@ static struct pci_dev *pci_get_related_function(unsigned int vendor,
 }
 
 /*
- * syndrome mapping table for ECC ChipKill devices
- *
- * The comment in each row is the token (nibble) number that is in error.
- * The least significant nibble of the syndrome is the mask for the bits
- * that are in error (need to be toggled) for the particular nibble.
- *
- * Each row contains 16 entries.
- * The first entry (0th) is the channel number for that row of syndromes.
- * The remaining 15 entries are the syndromes for the respective Error
- * bit mask index.
- *
- * 1st index entry is 0x0001 mask, indicating that the rightmost bit is the
- * bit in error.
- * The 2nd index entry is 0x0010 that the second bit is damaged.
- * The 3rd index entry is 0x0011 indicating that the rightmost 2 bits
- * are damaged.
- * Thus so on until index 15, 0x1111, whose entry has the syndrome
- * indicating that all 4 bits are damaged.
- *
- * A search is performed on this table looking for a given syndrome.
+ * These are tables of eigenvectors (one per line) which can be used for the
+ * construction of the syndrome tables. The modified syndrome search algorithm
+ * uses those to find the symbol in error and thus the DIMM.
  *
- * See the AMD documentation for ECC syndromes. This ECC table is valid
- * across all the versions of the AMD64 processors.
- *
- * A fast lookup is to use the LAST four bits of the 16-bit syndrome as a
- * COLUMN index, then search all ROWS of that column, looking for a match
- * with the input syndrome. The ROW value will be the token number.
- *
- * The 0'th entry on that row, can be returned as the CHANNEL (0 or 1) of this
- * error.
+ * Algorithm courtesy of Ross LaFetra from AMD.
  */
-#define NUMBER_ECC_ROWS  36
-static const unsigned short ecc_chipkill_syndromes[NUMBER_ECC_ROWS][16] = {
-	/* Channel 0 syndromes */
-	{/*0*/  0, 0xe821, 0x7c32, 0x9413, 0xbb44, 0x5365, 0xc776, 0x2f57,
-	   0xdd88, 0x35a9, 0xa1ba, 0x499b, 0x66cc, 0x8eed, 0x1afe, 0xf2df },
-	{/*1*/  0, 0x5d31, 0xa612, 0xfb23, 0x9584, 0xc8b5, 0x3396, 0x6ea7,
-	   0xeac8, 0xb7f9, 0x4cda, 0x11eb, 0x7f4c, 0x227d, 0xd95e, 0x846f },
-	{/*2*/  0, 0x0001, 0x0002, 0x0003, 0x0004, 0x0005, 0x0006, 0x0007,
-	   0x0008, 0x0009, 0x000a, 0x000b, 0x000c, 0x000d, 0x000e, 0x000f },
-	{/*3*/  0, 0x2021, 0x3032, 0x1013, 0x4044, 0x6065, 0x7076, 0x5057,
-	   0x8088, 0xa0a9, 0xb0ba, 0x909b, 0xc0cc, 0xe0ed, 0xf0fe, 0xd0df },
-	{/*4*/  0, 0x5041, 0xa082, 0xf0c3, 0x9054, 0xc015, 0x30d6, 0x6097,
-	   0xe0a8, 0xb0e9, 0x402a, 0x106b, 0x70fc, 0x20bd, 0xd07e, 0x803f },
-	{/*5*/  0, 0xbe21, 0xd732, 0x6913, 0x2144, 0x9f65, 0xf676, 0x4857,
-	   0x3288, 0x8ca9, 0xe5ba, 0x5b9b, 0x13cc, 0xaded, 0xc4fe, 0x7adf },
-	{/*6*/  0, 0x4951, 0x8ea2, 0xc7f3, 0x5394, 0x1ac5, 0xdd36, 0x9467,
-	   0xa1e8, 0xe8b9, 0x2f4a, 0x661b, 0xf27c, 0xbb2d, 0x7cde, 0x358f },
-	{/*7*/  0, 0x74e1, 0x9872, 0xec93, 0xd6b4, 0xa255, 0x4ec6, 0x3a27,
-	   0x6bd8, 0x1f39, 0xf3aa, 0x874b, 0xbd6c, 0xc98d, 0x251e, 0x51ff },
-	{/*8*/  0, 0x15c1, 0x2a42, 0x3f83, 0xcef4, 0xdb35, 0xe4b6, 0xf177,
-	   0x4758, 0x5299, 0x6d1a, 0x78db, 0x89ac, 0x9c6d, 0xa3ee, 0xb62f },
-	{/*9*/  0, 0x3d01, 0x1602, 0x2b03, 0x8504, 0xb805, 0x9306, 0xae07,
-	   0xca08, 0xf709, 0xdc0a, 0xe10b, 0x4f0c, 0x720d, 0x590e, 0x640f },
-	{/*a*/  0, 0x9801, 0xec02, 0x7403, 0x6b04, 0xf305, 0x8706, 0x1f07,
-	   0xbd08, 0x2509, 0x510a, 0xc90b, 0xd60c, 0x4e0d, 0x3a0e, 0xa20f },
-	{/*b*/  0, 0xd131, 0x6212, 0xb323, 0x3884, 0xe9b5, 0x5a96, 0x8ba7,
-	   0x1cc8, 0xcdf9, 0x7eda, 0xafeb, 0x244c, 0xf57d, 0x465e, 0x976f },
-	{/*c*/  0, 0xe1d1, 0x7262, 0x93b3, 0xb834, 0x59e5, 0xca56, 0x2b87,
-	   0xdc18, 0x3dc9, 0xae7a, 0x4fab, 0x542c, 0x85fd, 0x164e, 0xf79f },
-	{/*d*/  0, 0x6051, 0xb0a2, 0xd0f3, 0x1094, 0x70c5, 0xa036, 0xc067,
-	   0x20e8, 0x40b9, 0x904a, 0x601b, 0x307c, 0x502d, 0x80de, 0xe08f },
-	{/*e*/  0, 0xa4c1, 0xf842, 0x5c83, 0xe6f4, 0x4235, 0x1eb6, 0xba77,
-	   0x7b58, 0xdf99, 0x831a, 0x27db, 0x9dac, 0x396d, 0x65ee, 0xc12f },
-	{/*f*/  0, 0x11c1, 0x2242, 0x3383, 0xc8f4, 0xd935, 0xeab6, 0xfb77,
-	   0x4c58, 0x5d99, 0x6e1a, 0x7fdb, 0x84ac, 0x956d, 0xa6ee, 0xb72f },
-
-	/* Channel 1 syndromes */
-	{/*10*/ 1, 0x45d1, 0x8a62, 0xcfb3, 0x5e34, 0x1be5, 0xd456, 0x9187,
-	   0xa718, 0xe2c9, 0x2d7a, 0x68ab, 0xf92c, 0xbcfd, 0x734e, 0x369f },
-	{/*11*/ 1, 0x63e1, 0xb172, 0xd293, 0x14b4, 0x7755, 0xa5c6, 0xc627,
-	   0x28d8, 0x4b39, 0x99aa, 0xfa4b, 0x3c6c, 0x5f8d, 0x8d1e, 0xeeff },
-	{/*12*/ 1, 0xb741, 0xd982, 0x6ec3, 0x2254, 0x9515, 0xfbd6, 0x4c97,
-	   0x33a8, 0x84e9, 0xea2a, 0x5d6b, 0x11fc, 0xa6bd, 0xc87e, 0x7f3f },
-	{/*13*/ 1, 0xdd41, 0x6682, 0xbbc3, 0x3554, 0xe815, 0x53d6, 0xce97,
-	   0x1aa8, 0xc7e9, 0x7c2a, 0xa1fb, 0x2ffc, 0xf2bd, 0x497e, 0x943f },
-	{/*14*/ 1, 0x2bd1, 0x3d62, 0x16b3, 0x4f34, 0x64e5, 0x7256, 0x5987,
-	   0x8518, 0xaec9, 0xb87a, 0x93ab, 0xca2c, 0xe1fd, 0xf74e, 0xdc9f },
-	{/*15*/ 1, 0x83c1, 0xc142, 0x4283, 0xa4f4, 0x2735, 0x65b6, 0xe677,
-	   0xf858, 0x7b99, 0x391a, 0xbadb, 0x5cac, 0xdf6d, 0x9dee, 0x1e2f },
-	{/*16*/ 1, 0x8fd1, 0xc562, 0x4ab3, 0xa934, 0x26e5, 0x6c56, 0xe387,
-	   0xfe18, 0x71c9, 0x3b7a, 0xb4ab, 0x572c, 0xd8fd, 0x924e, 0x1d9f },
-	{/*17*/ 1, 0x4791, 0x89e2, 0xce73, 0x5264, 0x15f5, 0xdb86, 0x9c17,
-	   0xa3b8, 0xe429, 0x2a5a, 0x6dcb, 0xf1dc, 0xb64d, 0x783e, 0x3faf },
-	{/*18*/ 1, 0x5781, 0xa9c2, 0xfe43, 0x92a4, 0xc525, 0x3b66, 0x6ce7,
-	   0xe3f8, 0xb479, 0x4a3a, 0x1dbb, 0x715c, 0x26dd, 0xd89e, 0x8f1f },
-	{/*19*/ 1, 0xbf41, 0xd582, 0x6ac3, 0x2954, 0x9615, 0xfcd6, 0x4397,
-	   0x3ea8, 0x81e9, 0xeb2a, 0x546b, 0x17fc, 0xa8bd, 0xc27e, 0x7d3f },
-	{/*1a*/ 1, 0x9891, 0xe1e2, 0x7273, 0x6464, 0xf7f5, 0x8586, 0x1617,
-	   0xb8b8, 0x2b29, 0x595a, 0xcacb, 0xdcdc, 0x4f4d, 0x3d3e, 0xaeaf },
-	{/*1b*/ 1, 0xcce1, 0x4472, 0x8893, 0xfdb4, 0x3f55, 0xb9c6, 0x7527,
-	   0x56d8, 0x9a39, 0x12aa, 0xde4b, 0xab6c, 0x678d, 0xef1e, 0x23ff },
-	{/*1c*/ 1, 0xa761, 0xf9b2, 0x5ed3, 0xe214, 0x4575, 0x1ba6, 0xbcc7,
-	   0x7328, 0xd449, 0x8a9a, 0x2dfb, 0x913c, 0x365d, 0x688e, 0xcfef },
-	{/*1d*/ 1, 0xff61, 0x55b2, 0xaad3, 0x7914, 0x8675, 0x2ca6, 0xd3c7,
-	   0x9e28, 0x6149, 0xcb9a, 0x34fb, 0xe73c, 0x185d, 0xb28e, 0x4def },
-	{/*1e*/ 1, 0x5451, 0xa8a2, 0xfcf3, 0x9694, 0xc2c5, 0x3e36, 0x6a67,
-	   0xebe8, 0xbfb9, 0x434a, 0x171b, 0x7d7c, 0x292d, 0xd5de, 0x818f },
-	{/*1f*/ 1, 0x6fc1, 0xb542, 0xda83, 0x19f4, 0x7635, 0xacb6, 0xc377,
-	   0x2e58, 0x4199, 0x9b1a, 0xf4db, 0x37ac, 0x586d, 0x82ee, 0xed2f },
-
-	/* ECC bits are also in the set of tokens and they too can go bad
-	 * first 2 cover channel 0, while the second 2 cover channel 1
-	 */
-	{/*20*/ 0, 0xbe01, 0xd702, 0x6903, 0x2104, 0x9f05, 0xf606, 0x4807,
-	   0x3208, 0x8c09, 0xe50a, 0x5b0b, 0x130c, 0xad0d, 0xc40e, 0x7a0f },
-	{/*21*/ 0, 0x4101, 0x8202, 0xc303, 0x5804, 0x1905, 0xda06, 0x9b07,
-	   0xac08, 0xed09, 0x2e0a, 0x6f0b, 0x640c, 0xb50d, 0x760e, 0x370f },
-	{/*22*/ 1, 0xc441, 0x4882, 0x8cc3, 0xf654, 0x3215, 0xbed6, 0x7a97,
-	   0x5ba8, 0x9fe9, 0x132a, 0xd76b, 0xadfc, 0x69bd, 0xe57e, 0x213f },
-	{/*23*/ 1, 0x7621, 0x9b32, 0xed13, 0xda44, 0xac65, 0x4176, 0x3757,
-	   0x6f88, 0x19a9, 0xf4ba, 0x829b, 0xb5cc, 0xc3ed, 0x2efe, 0x58df }
+static u16 x4_vectors[] = {
+	0x2f57, 0x1afe, 0x66cc, 0xdd88,
+	0x11eb, 0x3396, 0x7f4c, 0xeac8,
+	0x0001, 0x0002, 0x0004, 0x0008,
+	0x1013, 0x3032, 0x4044, 0x8088,
+	0x106b, 0x30d6, 0x70fc, 0xe0a8,
+	0x4857, 0xc4fe, 0x13cc, 0x3288,
+	0x1ac5, 0x2f4a, 0x5394, 0xa1e8,
+	0x1f39, 0x251e, 0xbd6c, 0x6bd8,
+	0x15c1, 0x2a42, 0x89ac, 0x4758,
+	0x2b03, 0x1602, 0x4f0c, 0xca08,
+	0x1f07, 0x3a0e, 0x6b04, 0xbd08,
+	0x8ba7, 0x465e, 0x244c, 0x1cc8,
+	0x2b87, 0x164e, 0x642c, 0xdc18,
+	0x40b9, 0x80de, 0x1094, 0x20e8,
+	0x27db, 0x1eb6, 0x9dac, 0x7b58,
+	0x11c1, 0x2242, 0x84ac, 0x4c58,
+	0x1be5, 0x2d7a, 0x5e34, 0xa718,
+	0x4b39, 0x8d1e, 0x14b4, 0x28d8,
+	0x4c97, 0xc87e, 0x11fc, 0x33a8,
+	0x8e97, 0x497e, 0x2ffc, 0x1aa8,
+	0x16b3, 0x3d62, 0x4f34, 0x8518,
+	0x1e2f, 0x391a, 0x5cac, 0xf858,
+	0x1d9f, 0x3b7a, 0x572c, 0xfe18,
+	0x15f5, 0x2a5a, 0x5264, 0xa3b8,
+	0x1dbb, 0x3b66, 0x715c, 0xe3f8,
+	0x4397, 0xc27e, 0x17fc, 0x3ea8,
+	0x1617, 0x3d3e, 0x6464, 0xb8b8,
+	0x23ff, 0x12aa, 0xab6c, 0x56d8,
+	0x2dfb, 0x1ba6, 0x913c, 0x7328,
+	0x185d, 0x2ca6, 0x7914, 0x9e28,
+	0x171b, 0x3e36, 0x7d7c, 0xebe8,
+	0x4199, 0x82ee, 0x19f4, 0x2e58,
+	0x4807, 0xc40e, 0x130c, 0x3208,
+	0x1905, 0x2e0a, 0x5804, 0xac08,
+	0x213f, 0x132a, 0xadfc, 0x5ba8,
+	0x19a9, 0x2efe, 0xb5cc, 0x6f88,
 };
 
-/*
- * Given the syndrome argument, scan each of the channel tables for a syndrome
- * match. Depending on which table it is found, return the channel number.
- */
-static int get_channel_from_ecc_syndrome(unsigned short syndrome)
+static u16 x8_vectors[] = {
+	0x0145, 0x028a, 0x2374, 0x43c8, 0xa1f0, 0x0520, 0x0a40, 0x1480,
+	0x0211, 0x0422, 0x0844, 0x1088, 0x01b0, 0x44e0, 0x23c0, 0xed80,
+	0x1011, 0x0116, 0x022c, 0x0458, 0x08b0, 0x8c60, 0x2740, 0x4e80,
+	0x0411, 0x0822, 0x1044, 0x0158, 0x02b0, 0x2360, 0x46c0, 0xab80,
+	0x0811, 0x1022, 0x012c, 0x0258, 0x04b0, 0x4660, 0x8cc0, 0x2780,
+	0x2071, 0x40e2, 0xa0c4, 0x0108, 0x0210, 0x0420, 0x0840, 0x1080,
+	0x4071, 0x80e2, 0x0104, 0x0208, 0x0410, 0x0820, 0x1040, 0x2080,
+	0x8071, 0x0102, 0x0204, 0x0408, 0x0810, 0x1020, 0x2040, 0x4080,
+	0x019d, 0x03d6, 0x136c, 0x2198, 0x50b0, 0xb2e0, 0x0740, 0x0e80,
+	0x0189, 0x03ea, 0x072c, 0x0e58, 0x1cb0, 0x56e0, 0x37c0, 0xf580,
+	0x01fd, 0x0376, 0x06ec, 0x0bb8, 0x1110, 0x2220, 0x4440, 0x8880,
+	0x0163, 0x02c6, 0x1104, 0x0758, 0x0eb0, 0x2be0, 0x6140, 0xc280,
+	0x02fd, 0x01c6, 0x0b5c, 0x1108, 0x07b0, 0x25a0, 0x8840, 0x6180,
+	0x0801, 0x012e, 0x025c, 0x04b8, 0x1370, 0x26e0, 0x57c0, 0xb580,
+	0x0401, 0x0802, 0x015c, 0x02b8, 0x22b0, 0x13e0, 0x7140, 0xe280,
+	0x0201, 0x0402, 0x0804, 0x01b8, 0x11b0, 0x31a0, 0x8040, 0x7180,
+	0x0101, 0x0202, 0x0404, 0x0808, 0x1010, 0x2020, 0x4040, 0x8080,
+	0x0001, 0x0002, 0x0004, 0x0008, 0x0010, 0x0020, 0x0040, 0x0080,
+	0x0100, 0x0200, 0x0400, 0x0800, 0x1000, 0x2000, 0x4000, 0x8000,
+};
+
+static int decode_syndrome(u16 syndrome, u16 *vectors, int num_vecs,
+				 int v_dim)
 {
-	int row;
-	int column;
+	unsigned int i, err_sym;
+
+	for (err_sym = 0; err_sym < num_vecs / v_dim; err_sym++) {
+		u16 s = syndrome;
+		int v_idx =  err_sym * v_dim;
+		int v_end = (err_sym + 1) * v_dim;
+
+		/* walk over all 16 bits of the syndrome */
+		for (i = 1; i < (1U << 16); i <<= 1) {
 
-	/* Determine column to scan */
-	column = syndrome & 0xF;
+			/* if bit is set in that eigenvector... */
+			if (v_idx < v_end && vectors[v_idx] & i) {
+				u16 ev_comp = vectors[v_idx++];
 
-	/* Scan all rows, looking for syndrome, or end of table */
-	for (row = 0; row < NUMBER_ECC_ROWS; row++) {
-		if (ecc_chipkill_syndromes[row][column] == syndrome)
-			return ecc_chipkill_syndromes[row][0];
+				/* ... and bit set in the modified syndrome, */
+				if (s & i) {
+					/* remove it. */
+					s ^= ev_comp;
+
+					if (!s)
+						return err_sym;
+				}
+
+			} else if (s & i)
+				/* can't get to zero, move to next symbol */
+				break;
+		}
 	}
 
 	debugf0("syndrome(%x) not found\n", syndrome);
 	return -1;
 }
 
+static int map_err_sym_to_channel(int err_sym, int sym_size)
+{
+	if (sym_size == 4)
+		switch (err_sym) {
+		case 0x20:
+		case 0x21:
+			return 0;
+			break;
+		case 0x22:
+		case 0x23:
+			return 1;
+			break;
+		default:
+			return err_sym >> 4;
+			break;
+		}
+	/* x8 symbols */
+	else
+		switch (err_sym) {
+		/* imaginary bits not in a DIMM */
+		case 0x10:
+			WARN(1, KERN_ERR "Invalid error symbol: 0x%x\n",
+					  err_sym);
+			return -1;
+			break;
+
+		case 0x11:
+			return 0;
+			break;
+		case 0x12:
+			return 1;
+			break;
+		default:
+			return err_sym >> 3;
+			break;
+		}
+	return -1;
+}
+
+static int get_channel_from_ecc_syndrome(struct mem_ctl_info *mci, u16 syndrome)
+{
+	struct amd64_pvt *pvt = mci->pvt_info;
+	u32 value = 0;
+	int err_sym = 0;
+
+	amd64_read_pci_cfg(pvt->misc_f3_ctl, 0x180, &value);
+
+	/* F3x180[EccSymbolSize]=1, x8 symbols */
+	if (boot_cpu_data.x86 == 0x10 &&
+	    boot_cpu_data.x86_model > 7 &&
+	    value & BIT(25)) {
+		err_sym = decode_syndrome(syndrome, x8_vectors,
+					  ARRAY_SIZE(x8_vectors), 8);
+		return map_err_sym_to_channel(err_sym, 8);
+	} else {
+		err_sym = decode_syndrome(syndrome, x4_vectors,
+					  ARRAY_SIZE(x4_vectors), 4);
+		return map_err_sym_to_channel(err_sym, 4);
+	}
+}
+
 /*
  * Check for valid error in the NB Status High register. If so, proceed to read
  * NB Status Low, NB Address Low and NB Address High registers and store data
@@ -2073,40 +1988,24 @@ static int amd64_get_error_info_regs(struct mem_ctl_info *mci,
 {
 	struct amd64_pvt *pvt;
 	struct pci_dev *misc_f3_ctl;
-	int err = 0;
 
 	pvt = mci->pvt_info;
 	misc_f3_ctl = pvt->misc_f3_ctl;
 
-	err = pci_read_config_dword(misc_f3_ctl, K8_NBSH, &regs->nbsh);
-	if (err)
-		goto err_reg;
+	if (amd64_read_pci_cfg(misc_f3_ctl, K8_NBSH, &regs->nbsh))
+		return 0;
 
 	if (!(regs->nbsh & K8_NBSH_VALID_BIT))
 		return 0;
 
 	/* valid error, read remaining error information registers */
-	err = pci_read_config_dword(misc_f3_ctl, K8_NBSL, &regs->nbsl);
-	if (err)
-		goto err_reg;
-
-	err = pci_read_config_dword(misc_f3_ctl, K8_NBEAL, &regs->nbeal);
-	if (err)
-		goto err_reg;
-
-	err = pci_read_config_dword(misc_f3_ctl, K8_NBEAH, &regs->nbeah);
-	if (err)
-		goto err_reg;
-
-	err = pci_read_config_dword(misc_f3_ctl, K8_NBCFG, &regs->nbcfg);
-	if (err)
-		goto err_reg;
+	if (amd64_read_pci_cfg(misc_f3_ctl, K8_NBSL, &regs->nbsl) ||
+	    amd64_read_pci_cfg(misc_f3_ctl, K8_NBEAL, &regs->nbeal) ||
+	    amd64_read_pci_cfg(misc_f3_ctl, K8_NBEAH, &regs->nbeah) ||
+	    amd64_read_pci_cfg(misc_f3_ctl, K8_NBCFG, &regs->nbcfg))
+		return 0;
 
 	return 1;
-
-err_reg:
-	debugf0("Reading error info register failed\n");
-	return 0;
 }
 
 /*
@@ -2184,7 +2083,7 @@ static void amd64_handle_ce(struct mem_ctl_info *mci,
 			    struct err_regs *info)
 {
 	struct amd64_pvt *pvt = mci->pvt_info;
-	u64 SystemAddress;
+	u64 sys_addr;
 
 	/* Ensure that the Error Address is VALID */
 	if ((info->nbsh & K8_NBSH_VALID_ERROR_ADDR) == 0) {
@@ -2194,22 +2093,23 @@ static void amd64_handle_ce(struct mem_ctl_info *mci,
 		return;
 	}
 
-	SystemAddress = extract_error_address(mci, info);
+	sys_addr = pvt->ops->get_error_address(mci, info);
 
 	amd64_mc_printk(mci, KERN_ERR,
-		"CE ERROR_ADDRESS= 0x%llx\n", SystemAddress);
+		"CE ERROR_ADDRESS= 0x%llx\n", sys_addr);
 
-	pvt->ops->map_sysaddr_to_csrow(mci, info, SystemAddress);
+	pvt->ops->map_sysaddr_to_csrow(mci, info, sys_addr);
 }
 
 /* Handle any Un-correctable Errors (UEs) */
 static void amd64_handle_ue(struct mem_ctl_info *mci,
 			    struct err_regs *info)
 {
+	struct amd64_pvt *pvt = mci->pvt_info;
+	struct mem_ctl_info *log_mci, *src_mci = NULL;
 	int csrow;
-	u64 SystemAddress;
+	u64 sys_addr;
 	u32 page, offset;
-	struct mem_ctl_info *log_mci, *src_mci = NULL;
 
 	log_mci = mci;
 
@@ -2220,31 +2120,31 @@ static void amd64_handle_ue(struct mem_ctl_info *mci,
 		return;
 	}
 
-	SystemAddress = extract_error_address(mci, info);
+	sys_addr = pvt->ops->get_error_address(mci, info);
 
 	/*
 	 * Find out which node the error address belongs to. This may be
 	 * different from the node that detected the error.
 	 */
-	src_mci = find_mc_by_sys_addr(mci, SystemAddress);
+	src_mci = find_mc_by_sys_addr(mci, sys_addr);
 	if (!src_mci) {
 		amd64_mc_printk(mci, KERN_CRIT,
 			"ERROR ADDRESS (0x%lx) value NOT mapped to a MC\n",
-			(unsigned long)SystemAddress);
+			(unsigned long)sys_addr);
 		edac_mc_handle_ue_no_info(log_mci, EDAC_MOD_STR);
 		return;
 	}
 
 	log_mci = src_mci;
 
-	csrow = sys_addr_to_csrow(log_mci, SystemAddress);
+	csrow = sys_addr_to_csrow(log_mci, sys_addr);
 	if (csrow < 0) {
 		amd64_mc_printk(mci, KERN_CRIT,
 			"ERROR_ADDRESS (0x%lx) value NOT mapped to 'csrow'\n",
-			(unsigned long)SystemAddress);
+			(unsigned long)sys_addr);
 		edac_mc_handle_ue_no_info(log_mci, EDAC_MOD_STR);
 	} else {
-		error_address_to_page_and_offset(SystemAddress, &page, &offset);
+		error_address_to_page_and_offset(sys_addr, &page, &offset);
 		edac_mc_handle_ue(log_mci, page, offset, csrow, EDAC_MOD_STR);
 	}
 }
@@ -2384,30 +2284,26 @@ static void amd64_free_mc_sibling_devices(struct amd64_pvt *pvt)
 static void amd64_read_mc_registers(struct amd64_pvt *pvt)
 {
 	u64 msr_val;
-	int dram, err = 0;
+	int dram;
 
 	/*
 	 * Retrieve TOP_MEM and TOP_MEM2; no masking off of reserved bits since
 	 * those are Read-As-Zero
 	 */
-	rdmsrl(MSR_K8_TOP_MEM1, msr_val);
-	pvt->top_mem = msr_val >> 23;
-	debugf0("  TOP_MEM=0x%08llx\n", pvt->top_mem);
+	rdmsrl(MSR_K8_TOP_MEM1, pvt->top_mem);
+	debugf0("  TOP_MEM:  0x%016llx\n", pvt->top_mem);
 
 	/* check first whether TOP_MEM2 is enabled */
 	rdmsrl(MSR_K8_SYSCFG, msr_val);
 	if (msr_val & (1U << 21)) {
-		rdmsrl(MSR_K8_TOP_MEM2, msr_val);
-		pvt->top_mem2 = msr_val >> 23;
-		debugf0("  TOP_MEM2=0x%08llx\n", pvt->top_mem2);
+		rdmsrl(MSR_K8_TOP_MEM2, pvt->top_mem2);
+		debugf0("  TOP_MEM2: 0x%016llx\n", pvt->top_mem2);
 	} else
 		debugf0("  TOP_MEM2 disabled.\n");
 
 	amd64_cpu_display_info(pvt);
 
-	err = pci_read_config_dword(pvt->misc_f3_ctl, K8_NBCAP, &pvt->nbcap);
-	if (err)
-		goto err_reg;
+	amd64_read_pci_cfg(pvt->misc_f3_ctl, K8_NBCAP, &pvt->nbcap);
 
 	if (pvt->ops->read_dram_ctl_register)
 		pvt->ops->read_dram_ctl_register(pvt);
@@ -2425,13 +2321,12 @@ static void amd64_read_mc_registers(struct amd64_pvt *pvt)
 		 * debug output block away.
 		 */
 		if (pvt->dram_rw_en[dram] != 0) {
-			debugf1("  DRAM_BASE[%d]: 0x%8.08x-%8.08x "
-				"DRAM_LIMIT:  0x%8.08x-%8.08x\n",
+			debugf1("  DRAM-BASE[%d]: 0x%016llx "
+				"DRAM-LIMIT:  0x%016llx\n",
 				dram,
-				(u32)(pvt->dram_base[dram] >> 32),
-				(u32)(pvt->dram_base[dram] & 0xFFFFFFFF),
-				(u32)(pvt->dram_limit[dram] >> 32),
-				(u32)(pvt->dram_limit[dram] & 0xFFFFFFFF));
+				pvt->dram_base[dram],
+				pvt->dram_limit[dram]);
+
 			debugf1("        IntlvEn=%s %s %s "
 				"IntlvSel=%d DstNode=%d\n",
 				pvt->dram_IntlvEn[dram] ?
@@ -2445,44 +2340,20 @@ static void amd64_read_mc_registers(struct amd64_pvt *pvt)
 
 	amd64_read_dct_base_mask(pvt);
 
-	err = pci_read_config_dword(pvt->addr_f1_ctl, K8_DHAR, &pvt->dhar);
-	if (err)
-		goto err_reg;
-
+	amd64_read_pci_cfg(pvt->addr_f1_ctl, K8_DHAR, &pvt->dhar);
 	amd64_read_dbam_reg(pvt);
 
-	err = pci_read_config_dword(pvt->misc_f3_ctl,
-				F10_ONLINE_SPARE, &pvt->online_spare);
-	if (err)
-		goto err_reg;
+	amd64_read_pci_cfg(pvt->misc_f3_ctl,
+			   F10_ONLINE_SPARE, &pvt->online_spare);
 
-	err = pci_read_config_dword(pvt->dram_f2_ctl, F10_DCLR_0, &pvt->dclr0);
-	if (err)
-		goto err_reg;
-
-	err = pci_read_config_dword(pvt->dram_f2_ctl, F10_DCHR_0, &pvt->dchr0);
-	if (err)
-		goto err_reg;
+	amd64_read_pci_cfg(pvt->dram_f2_ctl, F10_DCLR_0, &pvt->dclr0);
+	amd64_read_pci_cfg(pvt->dram_f2_ctl, F10_DCHR_0, &pvt->dchr0);
 
-	if (!dct_ganging_enabled(pvt)) {
-		err = pci_read_config_dword(pvt->dram_f2_ctl, F10_DCLR_1,
-						&pvt->dclr1);
-		if (err)
-			goto err_reg;
-
-		err = pci_read_config_dword(pvt->dram_f2_ctl, F10_DCHR_1,
-						&pvt->dchr1);
-		if (err)
-			goto err_reg;
+	if (!dct_ganging_enabled(pvt) && boot_cpu_data.x86 >= 0x10) {
+		amd64_read_pci_cfg(pvt->dram_f2_ctl, F10_DCLR_1, &pvt->dclr1);
+		amd64_read_pci_cfg(pvt->dram_f2_ctl, F10_DCHR_1, &pvt->dchr1);
 	}
-
 	amd64_dump_misc_regs(pvt);
-
-	return;
-
-err_reg:
-	debugf0("Reading an MC register failed\n");
-
 }
 
 /*
@@ -2521,7 +2392,7 @@ err_reg:
  */
 static u32 amd64_csrow_nr_pages(int csrow_nr, struct amd64_pvt *pvt)
 {
-	u32 dram_map, nr_pages;
+	u32 cs_mode, nr_pages;
 
 	/*
 	 * The math on this doesn't look right on the surface because x/2*4 can
@@ -2530,9 +2401,9 @@ static u32 amd64_csrow_nr_pages(int csrow_nr, struct amd64_pvt *pvt)
 	 * number of bits to shift the DBAM register to extract the proper CSROW
 	 * field.
 	 */
-	dram_map = (pvt->dbam0 >> ((csrow_nr / 2) * 4)) & 0xF;
+	cs_mode = (pvt->dbam0 >> ((csrow_nr / 2) * 4)) & 0xF;
 
-	nr_pages = pvt->ops->dbam_map_to_pages(pvt, dram_map);
+	nr_pages = pvt->ops->dbam_to_cs(pvt, cs_mode) << (20 - PAGE_SHIFT);
 
 	/*
 	 * If dual channel then double the memory size of single channel.
@@ -2540,7 +2411,7 @@ static u32 amd64_csrow_nr_pages(int csrow_nr, struct amd64_pvt *pvt)
 	 */
 	nr_pages <<= (pvt->channel_count - 1);
 
-	debugf0("  (csrow=%d) DBAM map index= %d\n", csrow_nr, dram_map);
+	debugf0("  (csrow=%d) DBAM map index= %d\n", csrow_nr, cs_mode);
 	debugf0("    nr_pages= %u  channel-count = %d\n",
 		nr_pages, pvt->channel_count);
 
@@ -2556,13 +2427,11 @@ static int amd64_init_csrows(struct mem_ctl_info *mci)
 	struct csrow_info *csrow;
 	struct amd64_pvt *pvt;
 	u64 input_addr_min, input_addr_max, sys_addr;
-	int i, err = 0, empty = 1;
+	int i, empty = 1;
 
 	pvt = mci->pvt_info;
 
-	err = pci_read_config_dword(pvt->misc_f3_ctl, K8_NBCFG, &pvt->nbcfg);
-	if (err)
-		debugf0("Reading K8_NBCFG failed\n");
+	amd64_read_pci_cfg(pvt->misc_f3_ctl, K8_NBCFG, &pvt->nbcfg);
 
 	debugf0("NBCFG= 0x%x  CHIPKILL= %s DRAM ECC= %s\n", pvt->nbcfg,
 		(pvt->nbcfg & K8_NBCFG_CHIPKILL) ? "Enabled" : "Disabled",
@@ -2618,6 +2487,90 @@ static int amd64_init_csrows(struct mem_ctl_info *mci)
 	return empty;
 }
 
+/* get all cores on this DCT */
+static void get_cpus_on_this_dct_cpumask(struct cpumask *mask, int nid)
+{
+	int cpu;
+
+	for_each_online_cpu(cpu)
+		if (amd_get_nb_id(cpu) == nid)
+			cpumask_set_cpu(cpu, mask);
+}
+
+/* check MCG_CTL on all the cpus on this node */
+static bool amd64_nb_mce_bank_enabled_on_node(int nid)
+{
+	cpumask_var_t mask;
+	int cpu, nbe;
+	bool ret = false;
+
+	if (!zalloc_cpumask_var(&mask, GFP_KERNEL)) {
+		amd64_printk(KERN_WARNING, "%s: error allocating mask\n",
+			     __func__);
+		return false;
+	}
+
+	get_cpus_on_this_dct_cpumask(mask, nid);
+
+	rdmsr_on_cpus(mask, MSR_IA32_MCG_CTL, msrs);
+
+	for_each_cpu(cpu, mask) {
+		struct msr *reg = per_cpu_ptr(msrs, cpu);
+		nbe = reg->l & K8_MSR_MCGCTL_NBE;
+
+		debugf0("core: %u, MCG_CTL: 0x%llx, NB MSR is %s\n",
+			cpu, reg->q,
+			(nbe ? "enabled" : "disabled"));
+
+		if (!nbe)
+			goto out;
+	}
+	ret = true;
+
+out:
+	free_cpumask_var(mask);
+	return ret;
+}
+
+static int amd64_toggle_ecc_err_reporting(struct amd64_pvt *pvt, bool on)
+{
+	cpumask_var_t cmask;
+	int cpu;
+
+	if (!zalloc_cpumask_var(&cmask, GFP_KERNEL)) {
+		amd64_printk(KERN_WARNING, "%s: error allocating mask\n",
+			     __func__);
+		return false;
+	}
+
+	get_cpus_on_this_dct_cpumask(cmask, pvt->mc_node_id);
+
+	rdmsr_on_cpus(cmask, MSR_IA32_MCG_CTL, msrs);
+
+	for_each_cpu(cpu, cmask) {
+
+		struct msr *reg = per_cpu_ptr(msrs, cpu);
+
+		if (on) {
+			if (reg->l & K8_MSR_MCGCTL_NBE)
+				pvt->flags.ecc_report = 1;
+
+			reg->l |= K8_MSR_MCGCTL_NBE;
+		} else {
+			/*
+			 * Turn off ECC reporting only when it was off before
+			 */
+			if (!pvt->flags.ecc_report)
+				reg->l &= ~K8_MSR_MCGCTL_NBE;
+		}
+	}
+	wrmsr_on_cpus(cmask, MSR_IA32_MCG_CTL, msrs);
+
+	free_cpumask_var(cmask);
+
+	return 0;
+}
+
 /*
  * Only if 'ecc_enable_override' is set AND BIOS had ECC disabled, do "we"
  * enable it.
@@ -2625,24 +2578,16 @@ static int amd64_init_csrows(struct mem_ctl_info *mci)
 static void amd64_enable_ecc_error_reporting(struct mem_ctl_info *mci)
 {
 	struct amd64_pvt *pvt = mci->pvt_info;
-	const cpumask_t *cpumask = cpumask_of_node(pvt->mc_node_id);
-	int cpu, idx = 0, err = 0;
-	struct msr msrs[cpumask_weight(cpumask)];
-	u32 value;
-	u32 mask = K8_NBCTL_CECCEn | K8_NBCTL_UECCEn;
+	u32 value, mask = K8_NBCTL_CECCEn | K8_NBCTL_UECCEn;
 
 	if (!ecc_enable_override)
 		return;
 
-	memset(msrs, 0, sizeof(msrs));
-
 	amd64_printk(KERN_WARNING,
 		"'ecc_enable_override' parameter is active, "
 		"Enabling AMD ECC hardware now: CAUTION\n");
 
-	err = pci_read_config_dword(pvt->misc_f3_ctl, K8_NBCTL, &value);
-	if (err)
-		debugf0("Reading K8_NBCTL failed\n");
+	amd64_read_pci_cfg(pvt->misc_f3_ctl, K8_NBCTL, &value);
 
 	/* turn on UECCn and CECCEn bits */
 	pvt->old_nbctl = value & mask;
@@ -2651,20 +2596,11 @@ static void amd64_enable_ecc_error_reporting(struct mem_ctl_info *mci)
 	value |= mask;
 	pci_write_config_dword(pvt->misc_f3_ctl, K8_NBCTL, value);
 
-	rdmsr_on_cpus(cpumask, K8_MSR_MCGCTL, msrs);
-
-	for_each_cpu(cpu, cpumask) {
-		if (msrs[idx].l & K8_MSR_MCGCTL_NBE)
-			set_bit(idx, &pvt->old_mcgctl);
-
-		msrs[idx].l |= K8_MSR_MCGCTL_NBE;
-		idx++;
-	}
-	wrmsr_on_cpus(cpumask, K8_MSR_MCGCTL, msrs);
+	if (amd64_toggle_ecc_err_reporting(pvt, ON))
+		amd64_printk(KERN_WARNING, "Error enabling ECC reporting over "
+					   "MCGCTL!\n");
 
-	err = pci_read_config_dword(pvt->misc_f3_ctl, K8_NBCFG, &value);
-	if (err)
-		debugf0("Reading K8_NBCFG failed\n");
+	amd64_read_pci_cfg(pvt->misc_f3_ctl, K8_NBCFG, &value);
 
 	debugf0("NBCFG(1)= 0x%x  CHIPKILL= %s ECC_ENABLE= %s\n", value,
 		(value & K8_NBCFG_CHIPKILL) ? "Enabled" : "Disabled",
@@ -2679,9 +2615,7 @@ static void amd64_enable_ecc_error_reporting(struct mem_ctl_info *mci)
 		value |= K8_NBCFG_ECC_ENABLE;
 		pci_write_config_dword(pvt->misc_f3_ctl, K8_NBCFG, value);
 
-		err = pci_read_config_dword(pvt->misc_f3_ctl, K8_NBCFG, &value);
-		if (err)
-			debugf0("Reading K8_NBCFG failed\n");
+		amd64_read_pci_cfg(pvt->misc_f3_ctl, K8_NBCFG, &value);
 
 		if (!(value & K8_NBCFG_ECC_ENABLE)) {
 			amd64_printk(KERN_WARNING,
@@ -2701,86 +2635,21 @@ static void amd64_enable_ecc_error_reporting(struct mem_ctl_info *mci)
 
 static void amd64_restore_ecc_error_reporting(struct amd64_pvt *pvt)
 {
-	const cpumask_t *cpumask = cpumask_of_node(pvt->mc_node_id);
-	int cpu, idx = 0, err = 0;
-	struct msr msrs[cpumask_weight(cpumask)];
-	u32 value;
-	u32 mask = K8_NBCTL_CECCEn | K8_NBCTL_UECCEn;
+	u32 value, mask = K8_NBCTL_CECCEn | K8_NBCTL_UECCEn;
 
 	if (!pvt->nbctl_mcgctl_saved)
 		return;
 
-	memset(msrs, 0, sizeof(msrs));
-
-	err = pci_read_config_dword(pvt->misc_f3_ctl, K8_NBCTL, &value);
-	if (err)
-		debugf0("Reading K8_NBCTL failed\n");
+	amd64_read_pci_cfg(pvt->misc_f3_ctl, K8_NBCTL, &value);
 	value &= ~mask;
 	value |= pvt->old_nbctl;
 
 	/* restore the NB Enable MCGCTL bit */
 	pci_write_config_dword(pvt->misc_f3_ctl, K8_NBCTL, value);
 
-	rdmsr_on_cpus(cpumask, K8_MSR_MCGCTL, msrs);
-
-	for_each_cpu(cpu, cpumask) {
-		msrs[idx].l &= ~K8_MSR_MCGCTL_NBE;
-		msrs[idx].l |=
-			test_bit(idx, &pvt->old_mcgctl) << K8_MSR_MCGCTL_NBE;
-		idx++;
-	}
-
-	wrmsr_on_cpus(cpumask, K8_MSR_MCGCTL, msrs);
-}
-
-/* get all cores on this DCT */
-static void get_cpus_on_this_dct_cpumask(cpumask_t *mask, int nid)
-{
-	int cpu;
-
-	for_each_online_cpu(cpu)
-		if (amd_get_nb_id(cpu) == nid)
-			cpumask_set_cpu(cpu, mask);
-}
-
-/* check MCG_CTL on all the cpus on this node */
-static bool amd64_nb_mce_bank_enabled_on_node(int nid)
-{
-	cpumask_t mask;
-	struct msr *msrs;
-	int cpu, nbe, idx = 0;
-	bool ret = false;
-
-	cpumask_clear(&mask);
-
-	get_cpus_on_this_dct_cpumask(&mask, nid);
-
-	msrs = kzalloc(sizeof(struct msr) * cpumask_weight(&mask), GFP_KERNEL);
-	if (!msrs) {
-		amd64_printk(KERN_WARNING, "%s: error allocating msrs\n",
-			      __func__);
-		 return false;
-	}
-
-	rdmsr_on_cpus(&mask, MSR_IA32_MCG_CTL, msrs);
-
-	for_each_cpu(cpu, &mask) {
-		nbe = msrs[idx].l & K8_MSR_MCGCTL_NBE;
-
-		debugf0("core: %u, MCG_CTL: 0x%llx, NB MSR is %s\n",
-			cpu, msrs[idx].q,
-			(nbe ? "enabled" : "disabled"));
-
-		if (!nbe)
-			goto out;
-
-		idx++;
-	}
-	ret = true;
-
-out:
-	kfree(msrs);
-	return ret;
+	if (amd64_toggle_ecc_err_reporting(pvt, OFF))
+		amd64_printk(KERN_WARNING, "Error restoring ECC reporting over "
+					   "MCGCTL!\n");
 }
 
 /*
@@ -2797,13 +2666,10 @@ static const char *ecc_warning =
 static int amd64_check_ecc_enabled(struct amd64_pvt *pvt)
 {
 	u32 value;
-	int err = 0;
 	u8 ecc_enabled = 0;
 	bool nb_mce_en = false;
 
-	err = pci_read_config_dword(pvt->misc_f3_ctl, K8_NBCFG, &value);
-	if (err)
-		debugf0("Reading K8_NBCTL failed\n");
+	amd64_read_pci_cfg(pvt->misc_f3_ctl, K8_NBCFG, &value);
 
 	ecc_enabled = !!(value & K8_NBCFG_ECC_ENABLE);
 	if (!ecc_enabled)
@@ -2824,9 +2690,8 @@ static int amd64_check_ecc_enabled(struct amd64_pvt *pvt)
 			amd64_printk(KERN_WARNING, "%s", ecc_warning);
 			return -ENODEV;
 		}
-	} else
-		/* CLEAR the override, since BIOS controlled it */
 		ecc_enable_override = 0;
+	}
 
 	return 0;
 }
@@ -2909,7 +2774,6 @@ static int amd64_probe_one_instance(struct pci_dev *dram_f2_ctl,
 	pvt->ext_model		= boot_cpu_data.x86_model >> 4;
 	pvt->mc_type_index	= mc_type_index;
 	pvt->ops		= family_ops(mc_type_index);
-	pvt->old_mcgctl		= 0;
 
 	/*
 	 * We have the dram_f2_ctl device as an argument, now go reserve its
@@ -2959,17 +2823,10 @@ static int amd64_init_2nd_stage(struct amd64_pvt *pvt)
 {
 	int node_id = pvt->mc_node_id;
 	struct mem_ctl_info *mci;
-	int ret, err = 0;
+	int ret = -ENODEV;
 
 	amd64_read_mc_registers(pvt);
 
-	ret = -ENODEV;
-	if (pvt->ops->probe_valid_hardware) {
-		err = pvt->ops->probe_valid_hardware(pvt);
-		if (err)
-			goto err_exit;
-	}
-
 	/*
 	 * We need to determine how many memory channels there are. Then use
 	 * that information for calculating the size of the dynamic instance
@@ -3071,16 +2928,15 @@ static void __devexit amd64_remove_one_instance(struct pci_dev *pdev)
 
 	amd64_free_mc_sibling_devices(pvt);
 
-	kfree(pvt);
-	mci->pvt_info = NULL;
-
-	mci_lookup[pvt->mc_node_id] = NULL;
-
 	/* unregister from EDAC MCE */
 	amd_report_gart_errors(false);
 	amd_unregister_ecc_decoder(amd64_decode_bus_error);
 
 	/* Free the EDAC CORE resources */
+	mci->pvt_info = NULL;
+	mci_lookup[pvt->mc_node_id] = NULL;
+
+	kfree(pvt);
 	edac_mc_free(mci);
 }
 
@@ -3157,23 +3013,29 @@ static void amd64_setup_pci_device(void)
 static int __init amd64_edac_init(void)
 {
 	int nb, err = -ENODEV;
+	bool load_ok = false;
 
 	edac_printk(KERN_INFO, EDAC_MOD_STR, EDAC_AMD64_VERSION "\n");
 
 	opstate_init();
 
 	if (cache_k8_northbridges() < 0)
-		return err;
+		goto err_ret;
+
+	msrs = msrs_alloc();
+	if (!msrs)
+		goto err_ret;
 
 	err = pci_register_driver(&amd64_pci_driver);
 	if (err)
-		return err;
+		goto err_pci;
 
 	/*
 	 * At this point, the array 'pvt_lookup[]' contains pointers to alloc'd
 	 * amd64_pvt structs. These will be used in the 2nd stage init function
 	 * to finish initialization of the MC instances.
 	 */
+	err = -ENODEV;
 	for (nb = 0; nb < num_k8_northbridges; nb++) {
 		if (!pvt_lookup[nb])
 			continue;
@@ -3181,16 +3043,21 @@ static int __init amd64_edac_init(void)
 		err = amd64_init_2nd_stage(pvt_lookup[nb]);
 		if (err)
 			goto err_2nd_stage;
-	}
 
-	amd64_setup_pci_device();
+		load_ok = true;
+	}
 
-	return 0;
+	if (load_ok) {
+		amd64_setup_pci_device();
+		return 0;
+	}
 
 err_2nd_stage:
-	debugf0("2nd stage failed\n");
 	pci_unregister_driver(&amd64_pci_driver);
-
+err_pci:
+	msrs_free(msrs);
+	msrs = NULL;
+err_ret:
 	return err;
 }
 
@@ -3200,6 +3067,9 @@ static void __exit amd64_edac_exit(void)
 		edac_pci_release_generic_ctl(amd64_ctl_pci);
 
 	pci_unregister_driver(&amd64_pci_driver);
+
+	msrs_free(msrs);
+	msrs = NULL;
 }
 
 module_init(amd64_edac_init);
diff --git a/drivers/edac/amd64_edac.h b/drivers/edac/amd64_edac.h
index c6f359a85207..41bc561e5981 100644
--- a/drivers/edac/amd64_edac.h
+++ b/drivers/edac/amd64_edac.h
@@ -129,24 +129,22 @@
  *         sections 3.5.4 and 3.5.5 for more information.
  */
 
-#define EDAC_AMD64_VERSION		" Ver: 3.2.0 " __DATE__
+#define EDAC_AMD64_VERSION		" Ver: 3.3.0 " __DATE__
 #define EDAC_MOD_STR			"amd64_edac"
 
 #define EDAC_MAX_NUMNODES		8
 
 /* Extended Model from CPUID, for CPU Revision numbers */
-#define OPTERON_CPU_LE_REV_C		0
-#define OPTERON_CPU_REV_D		1
-#define OPTERON_CPU_REV_E		2
-
-/* NPT processors have the following Extended Models */
-#define OPTERON_CPU_REV_F		4
-#define OPTERON_CPU_REV_FA		5
+#define K8_REV_D			1
+#define K8_REV_E			2
+#define K8_REV_F			4
 
 /* Hardware limit on ChipSelect rows per MC and processors per system */
 #define MAX_CS_COUNT			8
 #define DRAM_REG_COUNT			8
 
+#define ON true
+#define OFF false
 
 /*
  * PCI-defined configuration space registers
@@ -241,7 +239,7 @@
 #define F10_DCHR_1			0x194
 
 #define F10_DCHR_FOUR_RANK_DIMM		BIT(18)
-#define F10_DCHR_Ddr3Mode		BIT(8)
+#define DDR3_MODE			BIT(8)
 #define F10_DCHR_MblMode		BIT(6)
 
 
@@ -382,14 +380,9 @@ enum {
 #define K8_NBCAP_CORES			(BIT(12)|BIT(13))
 #define K8_NBCAP_CHIPKILL		BIT(4)
 #define K8_NBCAP_SECDED			BIT(3)
-#define K8_NBCAP_8_NODE			BIT(2)
-#define K8_NBCAP_DUAL_NODE		BIT(1)
 #define K8_NBCAP_DCT_DUAL		BIT(0)
 
-/*
- * MSR Regs
- */
-#define K8_MSR_MCGCTL			0x017b
+/* MSRs */
 #define K8_MSR_MCGCTL_NBE		BIT(4)
 
 #define K8_MSR_MC4CTL			0x0410
@@ -487,7 +480,6 @@ struct amd64_pvt {
 	/* Save old hw registers' values before we modified them */
 	u32 nbctl_mcgctl_saved;		/* When true, following 2 are valid */
 	u32 old_nbctl;
-	unsigned long old_mcgctl;	/* per core on this node */
 
 	/* MC Type Index value: socket F vs Family 10h */
 	u32 mc_type_index;
@@ -495,6 +487,7 @@ struct amd64_pvt {
 	/* misc settings */
 	struct flags {
 		unsigned long cf8_extcfg:1;
+		unsigned long ecc_report:1;
 	} flags;
 };
 
@@ -504,7 +497,6 @@ struct scrubrate {
 };
 
 extern struct scrubrate scrubrates[23];
-extern u32 revf_quad_ddr2_shift[16];
 extern const char *tt_msgs[4];
 extern const char *ll_msgs[4];
 extern const char *rrrr_msgs[16];
@@ -534,17 +526,15 @@ extern struct mcidev_sysfs_attribute amd64_dbg_attrs[NUM_DBG_ATTRS],
  * functions and per device encoding/decoding logic.
  */
 struct low_ops {
-	int (*probe_valid_hardware)(struct amd64_pvt *pvt);
-	int (*early_channel_count)(struct amd64_pvt *pvt);
-
-	u64 (*get_error_address)(struct mem_ctl_info *mci,
-			struct err_regs *info);
-	void (*read_dram_base_limit)(struct amd64_pvt *pvt, int dram);
-	void (*read_dram_ctl_register)(struct amd64_pvt *pvt);
-	void (*map_sysaddr_to_csrow)(struct mem_ctl_info *mci,
-					struct err_regs *info,
-					u64 SystemAddr);
-	int (*dbam_map_to_pages)(struct amd64_pvt *pvt, int dram_map);
+	int (*early_channel_count)	(struct amd64_pvt *pvt);
+
+	u64 (*get_error_address)	(struct mem_ctl_info *mci,
+					 struct err_regs *info);
+	void (*read_dram_base_limit)	(struct amd64_pvt *pvt, int dram);
+	void (*read_dram_ctl_register)	(struct amd64_pvt *pvt);
+	void (*map_sysaddr_to_csrow)	(struct mem_ctl_info *mci,
+					 struct err_regs *info, u64 SystemAddr);
+	int (*dbam_to_cs)		(struct amd64_pvt *pvt, int cs_mode);
 };
 
 struct amd64_family_type {
@@ -566,6 +556,22 @@ static inline struct low_ops *family_ops(int index)
 	return &amd64_family_types[index].ops;
 }
 
+static inline int amd64_read_pci_cfg_dword(struct pci_dev *pdev, int offset,
+					   u32 *val, const char *func)
+{
+	int err = 0;
+
+	err = pci_read_config_dword(pdev, offset, val);
+	if (err)
+		amd64_printk(KERN_WARNING, "%s: error reading F%dx%x.\n",
+			     func, PCI_FUNC(pdev->devfn), offset);
+
+	return err;
+}
+
+#define amd64_read_pci_cfg(pdev, offset, val)	\
+	amd64_read_pci_cfg_dword(pdev, offset, val, __func__)
+
 /*
  * For future CPU versions, verify the following as new 'slow' rates appear and
  * modify the necessary skip values for the supported CPU.
diff --git a/drivers/edac/edac_core.h b/drivers/edac/edac_core.h
index 12f355cafdbe..001b2e797fb3 100644
--- a/drivers/edac/edac_core.h
+++ b/drivers/edac/edac_core.h
@@ -74,6 +74,7 @@
 
 #ifdef CONFIG_EDAC_DEBUG
 extern int edac_debug_level;
+extern const char *edac_mem_types[];
 
 #ifndef CONFIG_EDAC_DEBUG_VERBOSE
 #define edac_debug_printk(level, fmt, arg...)                           \
diff --git a/drivers/edac/edac_mc.c b/drivers/edac/edac_mc.c
index b629c41756f0..3630308e7b81 100644
--- a/drivers/edac/edac_mc.c
+++ b/drivers/edac/edac_mc.c
@@ -76,6 +76,30 @@ static void edac_mc_dump_mci(struct mem_ctl_info *mci)
 	debugf3("\tpvt_info = %p\n\n", mci->pvt_info);
 }
 
+/*
+ * keep those in sync with the enum mem_type
+ */
+const char *edac_mem_types[] = {
+	"Empty csrow",
+	"Reserved csrow type",
+	"Unknown csrow type",
+	"Fast page mode RAM",
+	"Extended data out RAM",
+	"Burst Extended data out RAM",
+	"Single data rate SDRAM",
+	"Registered single data rate SDRAM",
+	"Double data rate SDRAM",
+	"Registered Double data rate SDRAM",
+	"Rambus DRAM",
+	"Unbuffered DDR2 RAM",
+	"Fully buffered DDR2",
+	"Registered DDR2 RAM",
+	"Rambus XDR",
+	"Unbuffered DDR3 RAM",
+	"Registered DDR3 RAM",
+};
+EXPORT_SYMBOL_GPL(edac_mem_types);
+
 #endif				/* CONFIG_EDAC_DEBUG */
 
 /* 'ptr' points to a possibly unaligned item X such that sizeof(X) is 'size'.
diff --git a/drivers/edac/edac_mce_amd.c b/drivers/edac/edac_mce_amd.c
index 689cc6a6214d..8fc91a019620 100644
--- a/drivers/edac/edac_mce_amd.c
+++ b/drivers/edac/edac_mce_amd.c
@@ -299,6 +299,12 @@ void amd_decode_nb_mce(int node_id, struct err_regs *regs, int handle_errors)
 	if (!handle_errors)
 		return;
 
+	/*
+	 * GART TLB error reporting is disabled by default. Bail out early.
+	 */
+	if (TLB_ERROR(ec) && !report_gart_errors)
+		return;
+
 	pr_emerg(" Northbridge Error, node %d", node_id);
 
 	/*
@@ -306,14 +312,13 @@ void amd_decode_nb_mce(int node_id, struct err_regs *regs, int handle_errors)
 	 * value encoding has changed so interpret those differently
 	 */
 	if ((boot_cpu_data.x86 == 0x10) &&
-	    (boot_cpu_data.x86_model > 8)) {
+	    (boot_cpu_data.x86_model > 7)) {
 		if (regs->nbsh & K8_NBSH_ERR_CPU_VAL)
 			pr_cont(", core: %u\n", (u8)(regs->nbsh & 0xf));
 	} else {
-		pr_cont(", core: %d\n", ilog2((regs->nbsh & 0xf)));
+		pr_cont(", core: %d\n", fls((regs->nbsh & 0xf) - 1));
 	}
 
-
 	pr_emerg("%s.\n", EXT_ERR_MSG(xec));
 
 	if (BUS_ERROR(ec) && nb_bus_decoder)
@@ -333,21 +338,6 @@ static void amd_decode_fr_mce(u64 mc5_status)
 static inline void amd_decode_err_code(unsigned int ec)
 {
 	if (TLB_ERROR(ec)) {
-		/*
-		 * GART errors are intended to help graphics driver developers
-		 * to detect bad GART PTEs. It is recommended by AMD to disable
-		 * GART table walk error reporting by default[1] (currently
-		 * being disabled in mce_cpu_quirks()) and according to the
-		 * comment in mce_cpu_quirks(), such GART errors can be
-		 * incorrectly triggered. We may see these errors anyway and
-		 * unless requested by the user, they won't be reported.
-		 *
-		 * [1] section 13.10.1 on BIOS and Kernel Developers Guide for
-		 *     AMD NPT family 0Fh processors
-		 */
-		if (!report_gart_errors)
-			return;
-
 		pr_emerg(" Transaction: %s, Cache Level %s\n",
 			 TT_MSG(ec), LL_MSG(ec));
 	} else if (MEM_ERROR(ec)) {
diff --git a/drivers/edac/edac_pci_sysfs.c b/drivers/edac/edac_pci_sysfs.c
index 422728cfe994..fb60a877d768 100644
--- a/drivers/edac/edac_pci_sysfs.c
+++ b/drivers/edac/edac_pci_sysfs.c
@@ -534,8 +534,6 @@ static void edac_pci_dev_parity_clear(struct pci_dev *dev)
 {
 	u8 header_type;
 
-	debugf0("%s()\n", __func__);
-
 	get_pci_parity_status(dev, 0);
 
 	/* read the device TYPE, looking for bridges */
diff --git a/drivers/edac/i5000_edac.c b/drivers/edac/i5000_edac.c
index 77a9579d7167..adc10a2ac5f6 100644
--- a/drivers/edac/i5000_edac.c
+++ b/drivers/edac/i5000_edac.c
@@ -577,7 +577,13 @@ static void i5000_process_nonfatal_error_info(struct mem_ctl_info *mci,
 		debugf0("\tUncorrected bits= 0x%x\n", ue_errors);
 
 		branch = EXTRACT_FBDCHAN_INDX(info->ferr_nf_fbd);
-		channel = branch;
+
+		/*
+		 * According with i5000 datasheet, bit 28 has no significance
+		 * for errors M4Err-M12Err and M17Err-M21Err, on FERR_NF_FBD
+		 */
+		channel = branch & 2;
+
 		bank = NREC_BANK(info->nrecmema);
 		rank = NREC_RANK(info->nrecmema);
 		rdwr = NREC_RDWR(info->nrecmema);
diff --git a/drivers/edac/i5100_edac.c b/drivers/edac/i5100_edac.c
index 22db05a67bfb..7785d8ffa404 100644
--- a/drivers/edac/i5100_edac.c
+++ b/drivers/edac/i5100_edac.c
@@ -9,6 +9,11 @@
  * Intel 5100X Chipset Memory Controller Hub (MCH) - Datasheet
  *      http://download.intel.com/design/chipsets/datashts/318378.pdf
  *
+ * The intel 5100 has two independent channels. EDAC core currently
+ * can not reflect this configuration so instead the chip-select
+ * rows for each respective channel are layed out one after another,
+ * the first half belonging to channel 0, the second half belonging
+ * to channel 1.
  */
 #include <linux/module.h>
 #include <linux/init.h>
@@ -25,6 +30,8 @@
 
 /* device 16, func 1 */
 #define I5100_MC		0x40	/* Memory Control Register */
+#define 	I5100_MC_SCRBEN_MASK	(1 << 7)
+#define 	I5100_MC_SCRBDONE_MASK	(1 << 4)
 #define I5100_MS		0x44	/* Memory Status Register */
 #define I5100_SPDDATA		0x48	/* Serial Presence Detect Status Reg */
 #define I5100_SPDCMD		0x4c	/* Serial Presence Detect Command Reg */
@@ -72,11 +79,21 @@
 
 /* bit field accessors */
 
+static inline u32 i5100_mc_scrben(u32 mc)
+{
+	return mc >> 7 & 1;
+}
+
 static inline u32 i5100_mc_errdeten(u32 mc)
 {
 	return mc >> 5 & 1;
 }
 
+static inline u32 i5100_mc_scrbdone(u32 mc)
+{
+	return mc >> 4 & 1;
+}
+
 static inline u16 i5100_spddata_rdo(u16 a)
 {
 	return a >> 15 & 1;
@@ -265,42 +282,43 @@ static inline u32 i5100_recmemb_ras(u32 a)
 }
 
 /* some generic limits */
-#define I5100_MAX_RANKS_PER_CTLR	6
-#define I5100_MAX_CTLRS			2
+#define I5100_MAX_RANKS_PER_CHAN	6
+#define I5100_CHANNELS			    2
 #define I5100_MAX_RANKS_PER_DIMM	4
 #define I5100_DIMM_ADDR_LINES		(6 - 3)	/* 64 bits / 8 bits per byte */
-#define I5100_MAX_DIMM_SLOTS_PER_CTLR	4
+#define I5100_MAX_DIMM_SLOTS_PER_CHAN	4
 #define I5100_MAX_RANK_INTERLEAVE	4
 #define I5100_MAX_DMIRS			5
+#define I5100_SCRUB_REFRESH_RATE	(5 * 60 * HZ)
 
 struct i5100_priv {
 	/* ranks on each dimm -- 0 maps to not present -- obtained via SPD */
-	int dimm_numrank[I5100_MAX_CTLRS][I5100_MAX_DIMM_SLOTS_PER_CTLR];
+	int dimm_numrank[I5100_CHANNELS][I5100_MAX_DIMM_SLOTS_PER_CHAN];
 
 	/*
 	 * mainboard chip select map -- maps i5100 chip selects to
 	 * DIMM slot chip selects.  In the case of only 4 ranks per
-	 * controller, the mapping is fairly obvious but not unique.
-	 * we map -1 -> NC and assume both controllers use the same
+	 * channel, the mapping is fairly obvious but not unique.
+	 * we map -1 -> NC and assume both channels use the same
 	 * map...
 	 *
 	 */
-	int dimm_csmap[I5100_MAX_DIMM_SLOTS_PER_CTLR][I5100_MAX_RANKS_PER_DIMM];
+	int dimm_csmap[I5100_MAX_DIMM_SLOTS_PER_CHAN][I5100_MAX_RANKS_PER_DIMM];
 
 	/* memory interleave range */
 	struct {
 		u64	 limit;
 		unsigned way[2];
-	} mir[I5100_MAX_CTLRS];
+	} mir[I5100_CHANNELS];
 
 	/* adjusted memory interleave range register */
-	unsigned amir[I5100_MAX_CTLRS];
+	unsigned amir[I5100_CHANNELS];
 
 	/* dimm interleave range */
 	struct {
 		unsigned rank[I5100_MAX_RANK_INTERLEAVE];
 		u64	 limit;
-	} dmir[I5100_MAX_CTLRS][I5100_MAX_DMIRS];
+	} dmir[I5100_CHANNELS][I5100_MAX_DMIRS];
 
 	/* memory technology registers... */
 	struct {
@@ -310,30 +328,33 @@ struct i5100_priv {
 		unsigned numbank;	/* 2 or 3 lines */
 		unsigned numrow;	/* 13 .. 16 lines */
 		unsigned numcol;	/* 11 .. 12 lines */
-	} mtr[I5100_MAX_CTLRS][I5100_MAX_RANKS_PER_CTLR];
+	} mtr[I5100_CHANNELS][I5100_MAX_RANKS_PER_CHAN];
 
 	u64 tolm;		/* top of low memory in bytes */
-	unsigned ranksperctlr;	/* number of ranks per controller */
+	unsigned ranksperchan;	/* number of ranks per channel */
 
 	struct pci_dev *mc;	/* device 16 func 1 */
 	struct pci_dev *ch0mm;	/* device 21 func 0 */
 	struct pci_dev *ch1mm;	/* device 22 func 0 */
+
+	struct delayed_work i5100_scrubbing;
+	int scrub_enable;
 };
 
-/* map a rank/ctlr to a slot number on the mainboard */
+/* map a rank/chan to a slot number on the mainboard */
 static int i5100_rank_to_slot(const struct mem_ctl_info *mci,
-			      int ctlr, int rank)
+			      int chan, int rank)
 {
 	const struct i5100_priv *priv = mci->pvt_info;
 	int i;
 
-	for (i = 0; i < I5100_MAX_DIMM_SLOTS_PER_CTLR; i++) {
+	for (i = 0; i < I5100_MAX_DIMM_SLOTS_PER_CHAN; i++) {
 		int j;
-		const int numrank = priv->dimm_numrank[ctlr][i];
+		const int numrank = priv->dimm_numrank[chan][i];
 
 		for (j = 0; j < numrank; j++)
 			if (priv->dimm_csmap[i][j] == rank)
-				return i * 2 + ctlr;
+				return i * 2 + chan;
 	}
 
 	return -1;
@@ -374,32 +395,32 @@ static const char *i5100_err_msg(unsigned err)
 	return "none";
 }
 
-/* convert csrow index into a rank (per controller -- 0..5) */
+/* convert csrow index into a rank (per channel -- 0..5) */
 static int i5100_csrow_to_rank(const struct mem_ctl_info *mci, int csrow)
 {
 	const struct i5100_priv *priv = mci->pvt_info;
 
-	return csrow % priv->ranksperctlr;
+	return csrow % priv->ranksperchan;
 }
 
-/* convert csrow index into a controller (0..1) */
-static int i5100_csrow_to_cntlr(const struct mem_ctl_info *mci, int csrow)
+/* convert csrow index into a channel (0..1) */
+static int i5100_csrow_to_chan(const struct mem_ctl_info *mci, int csrow)
 {
 	const struct i5100_priv *priv = mci->pvt_info;
 
-	return csrow / priv->ranksperctlr;
+	return csrow / priv->ranksperchan;
 }
 
 static unsigned i5100_rank_to_csrow(const struct mem_ctl_info *mci,
-				    int ctlr, int rank)
+				    int chan, int rank)
 {
 	const struct i5100_priv *priv = mci->pvt_info;
 
-	return ctlr * priv->ranksperctlr + rank;
+	return chan * priv->ranksperchan + rank;
 }
 
 static void i5100_handle_ce(struct mem_ctl_info *mci,
-			    int ctlr,
+			    int chan,
 			    unsigned bank,
 			    unsigned rank,
 			    unsigned long syndrome,
@@ -407,12 +428,12 @@ static void i5100_handle_ce(struct mem_ctl_info *mci,
 			    unsigned ras,
 			    const char *msg)
 {
-	const int csrow = i5100_rank_to_csrow(mci, ctlr, rank);
+	const int csrow = i5100_rank_to_csrow(mci, chan, rank);
 
 	printk(KERN_ERR
-		"CE ctlr %d, bank %u, rank %u, syndrome 0x%lx, "
+		"CE chan %d, bank %u, rank %u, syndrome 0x%lx, "
 		"cas %u, ras %u, csrow %u, label \"%s\": %s\n",
-		ctlr, bank, rank, syndrome, cas, ras,
+		chan, bank, rank, syndrome, cas, ras,
 		csrow, mci->csrows[csrow].channels[0].label, msg);
 
 	mci->ce_count++;
@@ -421,7 +442,7 @@ static void i5100_handle_ce(struct mem_ctl_info *mci,
 }
 
 static void i5100_handle_ue(struct mem_ctl_info *mci,
-			    int ctlr,
+			    int chan,
 			    unsigned bank,
 			    unsigned rank,
 			    unsigned long syndrome,
@@ -429,23 +450,23 @@ static void i5100_handle_ue(struct mem_ctl_info *mci,
 			    unsigned ras,
 			    const char *msg)
 {
-	const int csrow = i5100_rank_to_csrow(mci, ctlr, rank);
+	const int csrow = i5100_rank_to_csrow(mci, chan, rank);
 
 	printk(KERN_ERR
-		"UE ctlr %d, bank %u, rank %u, syndrome 0x%lx, "
+		"UE chan %d, bank %u, rank %u, syndrome 0x%lx, "
 		"cas %u, ras %u, csrow %u, label \"%s\": %s\n",
-		ctlr, bank, rank, syndrome, cas, ras,
+		chan, bank, rank, syndrome, cas, ras,
 		csrow, mci->csrows[csrow].channels[0].label, msg);
 
 	mci->ue_count++;
 	mci->csrows[csrow].ue_count++;
 }
 
-static void i5100_read_log(struct mem_ctl_info *mci, int ctlr,
+static void i5100_read_log(struct mem_ctl_info *mci, int chan,
 			   u32 ferr, u32 nerr)
 {
 	struct i5100_priv *priv = mci->pvt_info;
-	struct pci_dev *pdev = (ctlr) ? priv->ch1mm : priv->ch0mm;
+	struct pci_dev *pdev = (chan) ? priv->ch1mm : priv->ch0mm;
 	u32 dw;
 	u32 dw2;
 	unsigned syndrome = 0;
@@ -484,7 +505,7 @@ static void i5100_read_log(struct mem_ctl_info *mci, int ctlr,
 		else
 			msg = i5100_err_msg(nerr);
 
-		i5100_handle_ce(mci, ctlr, bank, rank, syndrome, cas, ras, msg);
+		i5100_handle_ce(mci, chan, bank, rank, syndrome, cas, ras, msg);
 	}
 
 	if (i5100_validlog_nrecmemvalid(dw)) {
@@ -506,7 +527,7 @@ static void i5100_read_log(struct mem_ctl_info *mci, int ctlr,
 		else
 			msg = i5100_err_msg(nerr);
 
-		i5100_handle_ue(mci, ctlr, bank, rank, syndrome, cas, ras, msg);
+		i5100_handle_ue(mci, chan, bank, rank, syndrome, cas, ras, msg);
 	}
 
 	pci_write_config_dword(pdev, I5100_VALIDLOG, dw);
@@ -534,6 +555,80 @@ static void i5100_check_error(struct mem_ctl_info *mci)
 	}
 }
 
+/* The i5100 chipset will scrub the entire memory once, then
+ * set a done bit. Continuous scrubbing is achieved by enqueing
+ * delayed work to a workqueue, checking every few minutes if
+ * the scrubbing has completed and if so reinitiating it.
+ */
+
+static void i5100_refresh_scrubbing(struct work_struct *work)
+{
+	struct delayed_work *i5100_scrubbing = container_of(work,
+							    struct delayed_work,
+							    work);
+	struct i5100_priv *priv = container_of(i5100_scrubbing,
+					       struct i5100_priv,
+					       i5100_scrubbing);
+	u32 dw;
+
+	pci_read_config_dword(priv->mc, I5100_MC, &dw);
+
+	if (priv->scrub_enable) {
+
+		pci_read_config_dword(priv->mc, I5100_MC, &dw);
+
+		if (i5100_mc_scrbdone(dw)) {
+			dw |= I5100_MC_SCRBEN_MASK;
+			pci_write_config_dword(priv->mc, I5100_MC, dw);
+			pci_read_config_dword(priv->mc, I5100_MC, &dw);
+		}
+
+		schedule_delayed_work(&(priv->i5100_scrubbing),
+				      I5100_SCRUB_REFRESH_RATE);
+	}
+}
+/*
+ * The bandwidth is based on experimentation, feel free to refine it.
+ */
+static int i5100_set_scrub_rate(struct mem_ctl_info *mci,
+				       u32 *bandwidth)
+{
+	struct i5100_priv *priv = mci->pvt_info;
+	u32 dw;
+
+	pci_read_config_dword(priv->mc, I5100_MC, &dw);
+	if (*bandwidth) {
+		priv->scrub_enable = 1;
+		dw |= I5100_MC_SCRBEN_MASK;
+		schedule_delayed_work(&(priv->i5100_scrubbing),
+				      I5100_SCRUB_REFRESH_RATE);
+	} else {
+		priv->scrub_enable = 0;
+		dw &= ~I5100_MC_SCRBEN_MASK;
+		cancel_delayed_work(&(priv->i5100_scrubbing));
+	}
+	pci_write_config_dword(priv->mc, I5100_MC, dw);
+
+	pci_read_config_dword(priv->mc, I5100_MC, &dw);
+
+	*bandwidth = 5900000 * i5100_mc_scrben(dw);
+
+	return 0;
+}
+
+static int i5100_get_scrub_rate(struct mem_ctl_info *mci,
+				u32 *bandwidth)
+{
+	struct i5100_priv *priv = mci->pvt_info;
+	u32 dw;
+
+	pci_read_config_dword(priv->mc, I5100_MC, &dw);
+
+	*bandwidth = 5900000 * i5100_mc_scrben(dw);
+
+	return 0;
+}
+
 static struct pci_dev *pci_get_device_func(unsigned vendor,
 					   unsigned device,
 					   unsigned func)
@@ -557,19 +652,19 @@ static unsigned long __devinit i5100_npages(struct mem_ctl_info *mci,
 					    int csrow)
 {
 	struct i5100_priv *priv = mci->pvt_info;
-	const unsigned ctlr_rank = i5100_csrow_to_rank(mci, csrow);
-	const unsigned ctlr = i5100_csrow_to_cntlr(mci, csrow);
+	const unsigned chan_rank = i5100_csrow_to_rank(mci, csrow);
+	const unsigned chan = i5100_csrow_to_chan(mci, csrow);
 	unsigned addr_lines;
 
 	/* dimm present? */
-	if (!priv->mtr[ctlr][ctlr_rank].present)
+	if (!priv->mtr[chan][chan_rank].present)
 		return 0ULL;
 
 	addr_lines =
 		I5100_DIMM_ADDR_LINES +
-		priv->mtr[ctlr][ctlr_rank].numcol +
-		priv->mtr[ctlr][ctlr_rank].numrow +
-		priv->mtr[ctlr][ctlr_rank].numbank;
+		priv->mtr[chan][chan_rank].numcol +
+		priv->mtr[chan][chan_rank].numrow +
+		priv->mtr[chan][chan_rank].numbank;
 
 	return (unsigned long)
 		((unsigned long long) (1ULL << addr_lines) / PAGE_SIZE);
@@ -581,11 +676,11 @@ static void __devinit i5100_init_mtr(struct mem_ctl_info *mci)
 	struct pci_dev *mms[2] = { priv->ch0mm, priv->ch1mm };
 	int i;
 
-	for (i = 0; i < I5100_MAX_CTLRS; i++) {
+	for (i = 0; i < I5100_CHANNELS; i++) {
 		int j;
 		struct pci_dev *pdev = mms[i];
 
-		for (j = 0; j < I5100_MAX_RANKS_PER_CTLR; j++) {
+		for (j = 0; j < I5100_MAX_RANKS_PER_CHAN; j++) {
 			const unsigned addr =
 				(j < 4) ? I5100_MTR_0 + j * 2 :
 					  I5100_MTR_4 + (j - 4) * 2;
@@ -644,7 +739,6 @@ static int i5100_read_spd_byte(const struct mem_ctl_info *mci,
  * fill dimm chip select map
  *
  * FIXME:
- *   o only valid for 4 ranks per controller
  *   o not the only way to may chip selects to dimm slots
  *   o investigate if there is some way to obtain this map from the bios
  */
@@ -653,9 +747,7 @@ static void __devinit i5100_init_dimm_csmap(struct mem_ctl_info *mci)
 	struct i5100_priv *priv = mci->pvt_info;
 	int i;
 
-	WARN_ON(priv->ranksperctlr != 4);
-
-	for (i = 0; i < I5100_MAX_DIMM_SLOTS_PER_CTLR; i++) {
+	for (i = 0; i < I5100_MAX_DIMM_SLOTS_PER_CHAN; i++) {
 		int j;
 
 		for (j = 0; j < I5100_MAX_RANKS_PER_DIMM; j++)
@@ -663,12 +755,21 @@ static void __devinit i5100_init_dimm_csmap(struct mem_ctl_info *mci)
 	}
 
 	/* only 2 chip selects per slot... */
-	priv->dimm_csmap[0][0] = 0;
-	priv->dimm_csmap[0][1] = 3;
-	priv->dimm_csmap[1][0] = 1;
-	priv->dimm_csmap[1][1] = 2;
-	priv->dimm_csmap[2][0] = 2;
-	priv->dimm_csmap[3][0] = 3;
+	if (priv->ranksperchan == 4) {
+		priv->dimm_csmap[0][0] = 0;
+		priv->dimm_csmap[0][1] = 3;
+		priv->dimm_csmap[1][0] = 1;
+		priv->dimm_csmap[1][1] = 2;
+		priv->dimm_csmap[2][0] = 2;
+		priv->dimm_csmap[3][0] = 3;
+	} else {
+		priv->dimm_csmap[0][0] = 0;
+		priv->dimm_csmap[0][1] = 1;
+		priv->dimm_csmap[1][0] = 2;
+		priv->dimm_csmap[1][1] = 3;
+		priv->dimm_csmap[2][0] = 4;
+		priv->dimm_csmap[2][1] = 5;
+	}
 }
 
 static void __devinit i5100_init_dimm_layout(struct pci_dev *pdev,
@@ -677,10 +778,10 @@ static void __devinit i5100_init_dimm_layout(struct pci_dev *pdev,
 	struct i5100_priv *priv = mci->pvt_info;
 	int i;
 
-	for (i = 0; i < I5100_MAX_CTLRS; i++) {
+	for (i = 0; i < I5100_CHANNELS; i++) {
 		int j;
 
-		for (j = 0; j < I5100_MAX_DIMM_SLOTS_PER_CTLR; j++) {
+		for (j = 0; j < I5100_MAX_DIMM_SLOTS_PER_CHAN; j++) {
 			u8 rank;
 
 			if (i5100_read_spd_byte(mci, i, j, 5, &rank) < 0)
@@ -720,7 +821,7 @@ static void __devinit i5100_init_interleaving(struct pci_dev *pdev,
 	pci_read_config_word(pdev, I5100_AMIR_1, &w);
 	priv->amir[1] = w;
 
-	for (i = 0; i < I5100_MAX_CTLRS; i++) {
+	for (i = 0; i < I5100_CHANNELS; i++) {
 		int j;
 
 		for (j = 0; j < 5; j++) {
@@ -747,7 +848,7 @@ static void __devinit i5100_init_csrows(struct mem_ctl_info *mci)
 
 	for (i = 0; i < mci->nr_csrows; i++) {
 		const unsigned long npages = i5100_npages(mci, i);
-		const unsigned cntlr = i5100_csrow_to_cntlr(mci, i);
+		const unsigned chan = i5100_csrow_to_chan(mci, i);
 		const unsigned rank = i5100_csrow_to_rank(mci, i);
 
 		if (!npages)
@@ -765,7 +866,7 @@ static void __devinit i5100_init_csrows(struct mem_ctl_info *mci)
 		mci->csrows[i].grain = 32;
 		mci->csrows[i].csrow_idx = i;
 		mci->csrows[i].dtype =
-			(priv->mtr[cntlr][rank].width == 4) ? DEV_X4 : DEV_X8;
+			(priv->mtr[chan][rank].width == 4) ? DEV_X4 : DEV_X8;
 		mci->csrows[i].ue_count = 0;
 		mci->csrows[i].ce_count = 0;
 		mci->csrows[i].mtype = MEM_RDDR2;
@@ -777,7 +878,7 @@ static void __devinit i5100_init_csrows(struct mem_ctl_info *mci)
 		mci->csrows[i].channels[0].csrow = mci->csrows + i;
 		snprintf(mci->csrows[i].channels[0].label,
 			 sizeof(mci->csrows[i].channels[0].label),
-			 "DIMM%u", i5100_rank_to_slot(mci, cntlr, rank));
+			 "DIMM%u", i5100_rank_to_slot(mci, chan, rank));
 
 		total_pages += npages;
 	}
@@ -815,13 +916,6 @@ static int __devinit i5100_init_one(struct pci_dev *pdev,
 	pci_read_config_dword(pdev, I5100_MS, &dw);
 	ranksperch = !!(dw & (1 << 8)) * 2 + 4;
 
-	if (ranksperch != 4) {
-		/* FIXME: get 6 ranks / controller to work - need hw... */
-		printk(KERN_INFO "i5100_edac: unsupported configuration.\n");
-		ret = -ENODEV;
-		goto bail_pdev;
-	}
-
 	/* enable error reporting... */
 	pci_read_config_dword(pdev, I5100_EMASK_MEM, &dw);
 	dw &= ~I5100_FERR_NF_MEM_ANY_MASK;
@@ -864,11 +958,21 @@ static int __devinit i5100_init_one(struct pci_dev *pdev,
 	mci->dev = &pdev->dev;
 
 	priv = mci->pvt_info;
-	priv->ranksperctlr = ranksperch;
+	priv->ranksperchan = ranksperch;
 	priv->mc = pdev;
 	priv->ch0mm = ch0mm;
 	priv->ch1mm = ch1mm;
 
+	INIT_DELAYED_WORK(&(priv->i5100_scrubbing), i5100_refresh_scrubbing);
+
+	/* If scrubbing was already enabled by the bios, start maintaining it */
+	pci_read_config_dword(pdev, I5100_MC, &dw);
+	if (i5100_mc_scrben(dw)) {
+		priv->scrub_enable = 1;
+		schedule_delayed_work(&(priv->i5100_scrubbing),
+				      I5100_SCRUB_REFRESH_RATE);
+	}
+
 	i5100_init_dimm_layout(pdev, mci);
 	i5100_init_interleaving(pdev, mci);
 
@@ -882,6 +986,8 @@ static int __devinit i5100_init_one(struct pci_dev *pdev,
 	mci->ctl_page_to_phys = NULL;
 
 	mci->edac_check = i5100_check_error;
+	mci->set_sdram_scrub_rate = i5100_set_scrub_rate;
+	mci->get_sdram_scrub_rate = i5100_get_scrub_rate;
 
 	i5100_init_csrows(mci);
 
@@ -897,12 +1003,14 @@ static int __devinit i5100_init_one(struct pci_dev *pdev,
 
 	if (edac_mc_add_mc(mci)) {
 		ret = -ENODEV;
-		goto bail_mc;
+		goto bail_scrub;
 	}
 
 	return ret;
 
-bail_mc:
+bail_scrub:
+	priv->scrub_enable = 0;
+	cancel_delayed_work_sync(&(priv->i5100_scrubbing));
 	edac_mc_free(mci);
 
 bail_disable_ch1:
@@ -935,6 +1043,10 @@ static void __devexit i5100_remove_one(struct pci_dev *pdev)
 		return;
 
 	priv = mci->pvt_info;
+
+	priv->scrub_enable = 0;
+	cancel_delayed_work_sync(&(priv->i5100_scrubbing));
+
 	pci_disable_device(pdev);
 	pci_disable_device(priv->ch0mm);
 	pci_disable_device(priv->ch1mm);
diff --git a/drivers/firewire/Kconfig b/drivers/firewire/Kconfig
index 13efcd362072..a9371b36a9b9 100644
--- a/drivers/firewire/Kconfig
+++ b/drivers/firewire/Kconfig
@@ -1,5 +1,10 @@
+menu "IEEE 1394 (FireWire) support"
+	depends on PCI || BROKEN
+	# firewire-core does not depend on PCI but is
+	# not useful without PCI controller driver
+
 comment "You can enable one or both FireWire driver stacks."
-comment "See the help texts for more information."
+comment "The newer stack is recommended."
 
 config FIREWIRE
 	tristate "FireWire driver stack"
@@ -15,16 +20,6 @@ config FIREWIRE
 	  To compile this driver as a module, say M here: the module will be
 	  called firewire-core.
 
-	  This module functionally replaces ieee1394, raw1394, and video1394.
-	  To access it from application programs, you generally need at least
-	  libraw1394 v2.  IIDC/DCAM applications need libdc1394 v2.
-	  No libraries are required to access storage devices through the
-	  firewire-sbp2 driver.
-
-	  NOTE:
-	  FireWire audio devices currently require the old drivers (ieee1394,
-	  ohci1394, raw1394).
-
 config FIREWIRE_OHCI
 	tristate "OHCI-1394 controllers"
 	depends on PCI && FIREWIRE
@@ -34,22 +29,7 @@ config FIREWIRE_OHCI
 	  is the only chipset in use, so say Y here.
 
 	  To compile this driver as a module, say M here:  The module will be
-	  called firewire-ohci.  It replaces ohci1394 of the classic IEEE 1394
-	  stack.
-
-	  NOTE:
-	  If you want to install firewire-ohci and ohci1394 together, you
-	  should configure them only as modules and blacklist the driver(s)
-	  which you don't want to have auto-loaded.  Add either
-
-	      blacklist firewire-ohci
-	  or
-	      blacklist ohci1394
-	      blacklist video1394
-	      blacklist dv1394
-
-	  to /etc/modprobe.conf or /etc/modprobe.d/* and update modprobe.conf
-	  depending on your distribution.
+	  called firewire-ohci.
 
 config FIREWIRE_OHCI_DEBUG
 	bool
@@ -66,8 +46,7 @@ config FIREWIRE_SBP2
 	  like scanners.
 
 	  To compile this driver as a module, say M here:  The module will be
-	  called firewire-sbp2.  It replaces sbp2 of the classic IEEE 1394
-	  stack.
+	  called firewire-sbp2.
 
 	  You should also enable support for disks, CD-ROMs, etc. in the SCSI
 	  configuration section.
@@ -83,5 +62,8 @@ config FIREWIRE_NET
 	  NOTE, this driver is not stable yet!
 
 	  To compile this driver as a module, say M here:  The module will be
-	  called firewire-net.  It replaces eth1394 of the classic IEEE 1394
-	  stack.
+	  called firewire-net.
+
+source "drivers/ieee1394/Kconfig"
+
+endmenu
diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c
index 231e6ee5ba43..e6d63849e78e 100644
--- a/drivers/firewire/core-cdev.c
+++ b/drivers/firewire/core-cdev.c
@@ -601,8 +601,9 @@ static void release_request(struct client *client,
 	struct inbound_transaction_resource *r = container_of(resource,
 			struct inbound_transaction_resource, resource);
 
-	fw_send_response(client->device->card, r->request,
-			 RCODE_CONFLICT_ERROR);
+	if (r->request)
+		fw_send_response(client->device->card, r->request,
+				 RCODE_CONFLICT_ERROR);
 	kfree(r);
 }
 
@@ -645,7 +646,8 @@ static void handle_request(struct fw_card *card, struct fw_request *request,
  failed:
 	kfree(r);
 	kfree(e);
-	fw_send_response(card, request, RCODE_CONFLICT_ERROR);
+	if (request)
+		fw_send_response(card, request, RCODE_CONFLICT_ERROR);
 }
 
 static void release_address_handler(struct client *client,
@@ -715,15 +717,18 @@ static int ioctl_send_response(struct client *client, void *buffer)
 
 	r = container_of(resource, struct inbound_transaction_resource,
 			 resource);
-	if (request->length < r->length)
-		r->length = request->length;
-
-	if (copy_from_user(r->data, u64_to_uptr(request->data), r->length)) {
-		ret = -EFAULT;
-		goto out;
+	if (r->request) {
+		if (request->length < r->length)
+			r->length = request->length;
+		if (copy_from_user(r->data, u64_to_uptr(request->data),
+				   r->length)) {
+			ret = -EFAULT;
+			kfree(r->request);
+			goto out;
+		}
+		fw_send_response(client->device->card, r->request,
+				 request->rcode);
 	}
-
-	fw_send_response(client->device->card, r->request, request->rcode);
  out:
 	kfree(r);
 
diff --git a/drivers/firewire/core-topology.c b/drivers/firewire/core-topology.c
index 9a5f38c80b0e..93ec64cdeef7 100644
--- a/drivers/firewire/core-topology.c
+++ b/drivers/firewire/core-topology.c
@@ -183,7 +183,7 @@ static inline struct fw_node *fw_node(struct list_head *l)
  * This function builds the tree representation of the topology given
  * by the self IDs from the latest bus reset.  During the construction
  * of the tree, the function checks that the self IDs are valid and
- * internally consistent.  On succcess this function returns the
+ * internally consistent.  On success this function returns the
  * fw_node corresponding to the local card otherwise NULL.
  */
 static struct fw_node *build_tree(struct fw_card *card,
diff --git a/drivers/firewire/core-transaction.c b/drivers/firewire/core-transaction.c
index 842739df23e2..495849eb13cc 100644
--- a/drivers/firewire/core-transaction.c
+++ b/drivers/firewire/core-transaction.c
@@ -432,14 +432,20 @@ static struct fw_address_handler *lookup_overlapping_address_handler(
 	return NULL;
 }
 
+static bool is_enclosing_handler(struct fw_address_handler *handler,
+				 unsigned long long offset, size_t length)
+{
+	return handler->offset <= offset &&
+		offset + length <= handler->offset + handler->length;
+}
+
 static struct fw_address_handler *lookup_enclosing_address_handler(
 	struct list_head *list, unsigned long long offset, size_t length)
 {
 	struct fw_address_handler *handler;
 
 	list_for_each_entry(handler, list, link) {
-		if (handler->offset <= offset &&
-		    offset + length <= handler->offset + handler->length)
+		if (is_enclosing_handler(handler, offset, length))
 			return handler;
 	}
 
@@ -465,6 +471,12 @@ const struct fw_address_region fw_unit_space_region =
 	{ .start = 0xfffff0000900ULL, .end = 0x1000000000000ULL, };
 #endif  /*  0  */
 
+static bool is_in_fcp_region(u64 offset, size_t length)
+{
+	return offset >= (CSR_REGISTER_BASE | CSR_FCP_COMMAND) &&
+		offset + length <= (CSR_REGISTER_BASE | CSR_FCP_END);
+}
+
 /**
  * fw_core_add_address_handler - register for incoming requests
  * @handler: callback
@@ -477,8 +489,11 @@ const struct fw_address_region fw_unit_space_region =
  * give the details of the particular request.
  *
  * Return value:  0 on success, non-zero otherwise.
+ *
  * The start offset of the handler's address region is determined by
  * fw_core_add_address_handler() and is returned in handler->offset.
+ *
+ * Address allocations are exclusive, except for the FCP registers.
  */
 int fw_core_add_address_handler(struct fw_address_handler *handler,
 				const struct fw_address_region *region)
@@ -498,10 +513,12 @@ int fw_core_add_address_handler(struct fw_address_handler *handler,
 
 	handler->offset = region->start;
 	while (handler->offset + handler->length <= region->end) {
-		other =
-		    lookup_overlapping_address_handler(&address_handler_list,
-						       handler->offset,
-						       handler->length);
+		if (is_in_fcp_region(handler->offset, handler->length))
+			other = NULL;
+		else
+			other = lookup_overlapping_address_handler
+					(&address_handler_list,
+					 handler->offset, handler->length);
 		if (other != NULL) {
 			handler->offset += other->length;
 		} else {
@@ -668,6 +685,9 @@ static struct fw_request *allocate_request(struct fw_packet *p)
 void fw_send_response(struct fw_card *card,
 		      struct fw_request *request, int rcode)
 {
+	if (WARN_ONCE(!request, "invalid for FCP address handlers"))
+		return;
+
 	/* unified transaction or broadcast transaction: don't respond */
 	if (request->ack != ACK_PENDING ||
 	    HEADER_DESTINATION_IS_BROADCAST(request->request_header[0])) {
@@ -686,26 +706,15 @@ void fw_send_response(struct fw_card *card,
 }
 EXPORT_SYMBOL(fw_send_response);
 
-void fw_core_handle_request(struct fw_card *card, struct fw_packet *p)
+static void handle_exclusive_region_request(struct fw_card *card,
+					    struct fw_packet *p,
+					    struct fw_request *request,
+					    unsigned long long offset)
 {
 	struct fw_address_handler *handler;
-	struct fw_request *request;
-	unsigned long long offset;
 	unsigned long flags;
 	int tcode, destination, source;
 
-	if (p->ack != ACK_PENDING && p->ack != ACK_COMPLETE)
-		return;
-
-	request = allocate_request(p);
-	if (request == NULL) {
-		/* FIXME: send statically allocated busy packet. */
-		return;
-	}
-
-	offset      =
-		((unsigned long long)
-		 HEADER_GET_OFFSET_HIGH(p->header[1]) << 32) | p->header[2];
 	tcode       = HEADER_GET_TCODE(p->header[0]);
 	destination = HEADER_GET_DESTINATION(p->header[0]);
 	source      = HEADER_GET_SOURCE(p->header[1]);
@@ -732,6 +741,73 @@ void fw_core_handle_request(struct fw_card *card, struct fw_packet *p)
 					  request->data, request->length,
 					  handler->callback_data);
 }
+
+static void handle_fcp_region_request(struct fw_card *card,
+				      struct fw_packet *p,
+				      struct fw_request *request,
+				      unsigned long long offset)
+{
+	struct fw_address_handler *handler;
+	unsigned long flags;
+	int tcode, destination, source;
+
+	if ((offset != (CSR_REGISTER_BASE | CSR_FCP_COMMAND) &&
+	     offset != (CSR_REGISTER_BASE | CSR_FCP_RESPONSE)) ||
+	    request->length > 0x200) {
+		fw_send_response(card, request, RCODE_ADDRESS_ERROR);
+
+		return;
+	}
+
+	tcode       = HEADER_GET_TCODE(p->header[0]);
+	destination = HEADER_GET_DESTINATION(p->header[0]);
+	source      = HEADER_GET_SOURCE(p->header[1]);
+
+	if (tcode != TCODE_WRITE_QUADLET_REQUEST &&
+	    tcode != TCODE_WRITE_BLOCK_REQUEST) {
+		fw_send_response(card, request, RCODE_TYPE_ERROR);
+
+		return;
+	}
+
+	spin_lock_irqsave(&address_handler_lock, flags);
+	list_for_each_entry(handler, &address_handler_list, link) {
+		if (is_enclosing_handler(handler, offset, request->length))
+			handler->address_callback(card, NULL, tcode,
+						  destination, source,
+						  p->generation, p->speed,
+						  offset, request->data,
+						  request->length,
+						  handler->callback_data);
+	}
+	spin_unlock_irqrestore(&address_handler_lock, flags);
+
+	fw_send_response(card, request, RCODE_COMPLETE);
+}
+
+void fw_core_handle_request(struct fw_card *card, struct fw_packet *p)
+{
+	struct fw_request *request;
+	unsigned long long offset;
+
+	if (p->ack != ACK_PENDING && p->ack != ACK_COMPLETE)
+		return;
+
+	request = allocate_request(p);
+	if (request == NULL) {
+		/* FIXME: send statically allocated busy packet. */
+		return;
+	}
+
+	offset = ((u64)HEADER_GET_OFFSET_HIGH(p->header[1]) << 32) |
+		p->header[2];
+
+	if (!is_in_fcp_region(offset, request->length))
+		handle_exclusive_region_request(card, p, request, offset);
+	else
+		handle_fcp_region_request(card, p, request, offset);
+
+}
 EXPORT_SYMBOL(fw_core_handle_request);
 
 void fw_core_handle_response(struct fw_card *card, struct fw_packet *p)
diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
index ae4556f0c0c1..a61571c63c59 100644
--- a/drivers/firewire/ohci.c
+++ b/drivers/firewire/ohci.c
@@ -2218,8 +2218,14 @@ static int ohci_queue_iso_receive_dualbuffer(struct fw_iso_context *base,
 	page     = payload >> PAGE_SHIFT;
 	offset   = payload & ~PAGE_MASK;
 	rest     = p->payload_length;
+	/*
+	 * The controllers I've tested have not worked correctly when
+	 * second_req_count is zero.  Rather than do something we know won't
+	 * work, return an error
+	 */
+	if (rest == 0)
+		return -EINVAL;
 
-	/* FIXME: make packet-per-buffer/dual-buffer a context option */
 	while (rest > 0) {
 		d = context_get_descriptors(&ctx->context,
 					    z + header_z, &d_bus);
@@ -2271,7 +2277,7 @@ static int ohci_queue_iso_receive_packet_per_buffer(struct fw_iso_context *base,
 					unsigned long payload)
 {
 	struct iso_context *ctx = container_of(base, struct iso_context, base);
-	struct descriptor *d = NULL, *pd = NULL;
+	struct descriptor *d, *pd;
 	struct fw_iso_packet *p = packet;
 	dma_addr_t d_bus, page_bus;
 	u32 z, header_z, rest;
@@ -2309,8 +2315,9 @@ static int ohci_queue_iso_receive_packet_per_buffer(struct fw_iso_context *base,
 		d->data_address = cpu_to_le32(d_bus + (z * sizeof(*d)));
 
 		rest = payload_per_buffer;
+		pd = d;
 		for (j = 1; j < z; j++) {
-			pd = d + j;
+			pd++;
 			pd->control = cpu_to_le16(DESCRIPTOR_STATUS |
 						  DESCRIPTOR_INPUT_MORE);
 
@@ -2462,7 +2469,10 @@ static int __devinit pci_probe(struct pci_dev *dev,
 	}
 
 	version = reg_read(ohci, OHCI1394_Version) & 0x00ff00ff;
+#if 0
+	/* FIXME: make it a context option or remove dual-buffer mode */
 	ohci->use_dualbuffer = version >= OHCI_VERSION_1_1;
+#endif
 
 	/* dual-buffer mode is broken if more than one IR context is active */
 	if (dev->vendor == PCI_VENDOR_ID_AGERE &&
diff --git a/drivers/firmware/Kconfig b/drivers/firmware/Kconfig
index ebb9e51deb0c..1b03ba1d0834 100644
--- a/drivers/firmware/Kconfig
+++ b/drivers/firmware/Kconfig
@@ -7,7 +7,7 @@ menu "Firmware Drivers"
 
 config EDD
 	tristate "BIOS Enhanced Disk Drive calls determine boot disk"
-	depends on !IA64
+	depends on X86
 	help
 	  Say Y or M here if you want to enable BIOS Enhanced Disk Drive
 	  Services real mode BIOS calls to determine which disk
@@ -28,7 +28,7 @@ config EDD_OFF
 
 config FIRMWARE_MEMMAP
     bool "Add firmware-provided memory map to sysfs" if EMBEDDED
-    default (X86_64 || X86_32)
+    default X86
     help
       Add the firmware-provided (unmodified) memory map to /sys/firmware/memmap.
       That memory map is used for example by kexec to set up parameter area
diff --git a/drivers/firmware/dell_rbu.c b/drivers/firmware/dell_rbu.c
index b4704e150b28..b3a0cf57442e 100644
--- a/drivers/firmware/dell_rbu.c
+++ b/drivers/firmware/dell_rbu.c
@@ -544,9 +544,12 @@ static void callbackfn_rbu(const struct firmware *fw, void *context)
 {
 	rbu_data.entry_created = 0;
 
-	if (!fw || !fw->size)
+	if (!fw)
 		return;
 
+	if (!fw->size)
+		goto out;
+
 	spin_lock(&rbu_data.lock);
 	if (!strcmp(image_type, "mono")) {
 		if (!img_update_realloc(fw->size))
@@ -568,6 +571,8 @@ static void callbackfn_rbu(const struct firmware *fw, void *context)
 	} else
 		pr_debug("invalid image type specified.\n");
 	spin_unlock(&rbu_data.lock);
+ out:
+	release_firmware(fw);
 }
 
 static ssize_t read_rbu_image_type(struct kobject *kobj,
@@ -615,7 +620,7 @@ static ssize_t write_rbu_image_type(struct kobject *kobj,
 			spin_unlock(&rbu_data.lock);
 			req_firm_rc = request_firmware_nowait(THIS_MODULE,
 				FW_ACTION_NOHOTPLUG, "dell_rbu",
-				&rbu_device->dev, &context,
+				&rbu_device->dev, GFP_KERNEL, &context,
 				callbackfn_rbu);
 			if (req_firm_rc) {
 				printk(KERN_ERR
diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
index 938100f14b16..31b983d9462c 100644
--- a/drivers/firmware/dmi_scan.c
+++ b/drivers/firmware/dmi_scan.c
@@ -169,10 +169,7 @@ static void __init dmi_save_uuid(const struct dmi_header *dm, int slot, int inde
 	if (!s)
 		return;
 
-	sprintf(s,
-		"%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-%02X%02X%02X%02X%02X%02X",
-		d[0], d[1], d[2], d[3], d[4], d[5], d[6], d[7],
-		d[8], d[9], d[10], d[11], d[12], d[13], d[14], d[15]);
+	sprintf(s, "%pUB", d);
 
         dmi_ident[slot] = s;
 }
@@ -429,7 +426,7 @@ static bool dmi_matches(const struct dmi_system_id *dmi)
 	for (i = 0; i < ARRAY_SIZE(dmi->matches); i++) {
 		int s = dmi->matches[i].slot;
 		if (s == DMI_NONE)
-			continue;
+			break;
 		if (dmi_ident[s]
 		    && strstr(dmi_ident[s], dmi->matches[i].substr))
 			continue;
@@ -440,6 +437,15 @@ static bool dmi_matches(const struct dmi_system_id *dmi)
 }
 
 /**
+ *	dmi_is_end_of_table - check for end-of-table marker
+ *	@dmi: pointer to the dmi_system_id structure to check
+ */
+static bool dmi_is_end_of_table(const struct dmi_system_id *dmi)
+{
+	return dmi->matches[0].slot == DMI_NONE;
+}
+
+/**
  *	dmi_check_system - check system DMI data
  *	@list: array of dmi_system_id structures to match against
  *		All non-null elements of the list must match
@@ -457,7 +463,7 @@ int dmi_check_system(const struct dmi_system_id *list)
 	int count = 0;
 	const struct dmi_system_id *d;
 
-	for (d = list; d->ident; d++)
+	for (d = list; !dmi_is_end_of_table(d); d++)
 		if (dmi_matches(d)) {
 			count++;
 			if (d->callback && d->callback(d))
@@ -484,7 +490,7 @@ const struct dmi_system_id *dmi_first_match(const struct dmi_system_id *list)
 {
 	const struct dmi_system_id *d;
 
-	for (d = list; d->ident; d++)
+	for (d = list; !dmi_is_end_of_table(d); d++)
 		if (dmi_matches(d))
 			return d;
 
diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
index 2ad0128c63c6..1f1d88ae68d6 100644
--- a/drivers/gpio/Kconfig
+++ b/drivers/gpio/Kconfig
@@ -172,8 +172,27 @@ config GPIO_ADP5520
 	  To compile this driver as a module, choose M here: the module will
 	  be called adp5520-gpio.
 
+config GPIO_ADP5588
+	tristate "ADP5588 I2C GPIO expander"
+	depends on I2C
+	help
+	  This option enables support for 18 GPIOs found
+	  on Analog Devices ADP5588 GPIO Expanders.
+	  To compile this driver as a module, choose M here: the module will be
+	  called adp5588-gpio.
+
 comment "PCI GPIO expanders:"
 
+config GPIO_CS5535
+	tristate "AMD CS5535/CS5536 GPIO support"
+	depends on PCI && !CS5535_GPIO
+	help
+	  The AMD CS5535 and CS5536 southbridges support 28 GPIO pins that
+	  can be used for quite a number of things.  The CS5535/6 is found on
+	  AMD Geode and Lemote Yeeloong devices.
+
+	  If unsure, say N.
+
 config GPIO_BT8XX
 	tristate "BT8XX GPIO abuser"
 	depends on PCI && VIDEO_BT848=n
@@ -196,6 +215,12 @@ config GPIO_LANGWELL
 	help
 	  Say Y here to support Intel Moorestown platform GPIO.
 
+config GPIO_TIMBERDALE
+	bool "Support for timberdale GPIO IP"
+	depends on MFD_TIMBERDALE && GPIOLIB && HAS_IOMEM
+	---help---
+	Add support for the GPIO IP in the timberdale FPGA.
+
 comment "SPI GPIO expanders:"
 
 config GPIO_MAX7301
diff --git a/drivers/gpio/Makefile b/drivers/gpio/Makefile
index 00a532c9a1e2..48687238edb1 100644
--- a/drivers/gpio/Makefile
+++ b/drivers/gpio/Makefile
@@ -5,6 +5,7 @@ ccflags-$(CONFIG_DEBUG_GPIO)	+= -DDEBUG
 obj-$(CONFIG_GPIOLIB)		+= gpiolib.o
 
 obj-$(CONFIG_GPIO_ADP5520)	+= adp5520-gpio.o
+obj-$(CONFIG_GPIO_ADP5588)	+= adp5588-gpio.o
 obj-$(CONFIG_GPIO_LANGWELL)	+= langwell_gpio.o
 obj-$(CONFIG_GPIO_MAX7301)	+= max7301.o
 obj-$(CONFIG_GPIO_MAX732X)	+= max732x.o
@@ -13,9 +14,11 @@ obj-$(CONFIG_GPIO_MCP23S08)	+= mcp23s08.o
 obj-$(CONFIG_GPIO_PCA953X)	+= pca953x.o
 obj-$(CONFIG_GPIO_PCF857X)	+= pcf857x.o
 obj-$(CONFIG_GPIO_PL061)	+= pl061.o
+obj-$(CONFIG_GPIO_TIMBERDALE)	+= timbgpio.o
 obj-$(CONFIG_GPIO_TWL4030)	+= twl4030-gpio.o
 obj-$(CONFIG_GPIO_UCB1400)	+= ucb1400_gpio.o
 obj-$(CONFIG_GPIO_XILINX)	+= xilinx_gpio.o
+obj-$(CONFIG_GPIO_CS5535)	+= cs5535-gpio.o
 obj-$(CONFIG_GPIO_BT8XX)	+= bt8xxgpio.o
 obj-$(CONFIG_GPIO_VR41XX)	+= vr41xx_giu.o
 obj-$(CONFIG_GPIO_WM831X)	+= wm831x-gpio.o
diff --git a/drivers/gpio/adp5520-gpio.c b/drivers/gpio/adp5520-gpio.c
index ad05bbc7ffd5..0f93105873cd 100644
--- a/drivers/gpio/adp5520-gpio.c
+++ b/drivers/gpio/adp5520-gpio.c
@@ -34,9 +34,9 @@ static int adp5520_gpio_get_value(struct gpio_chip *chip, unsigned off)
 	 */
 
 	if (test_bit(off, &dev->output))
-		adp5520_read(dev->master, GPIO_OUT, &reg_val);
+		adp5520_read(dev->master, ADP5520_GPIO_OUT, &reg_val);
 	else
-		adp5520_read(dev->master, GPIO_IN, &reg_val);
+		adp5520_read(dev->master, ADP5520_GPIO_IN, &reg_val);
 
 	return !!(reg_val & dev->lut[off]);
 }
@@ -48,9 +48,9 @@ static void adp5520_gpio_set_value(struct gpio_chip *chip,
 	dev = container_of(chip, struct adp5520_gpio, gpio_chip);
 
 	if (val)
-		adp5520_set_bits(dev->master, GPIO_OUT, dev->lut[off]);
+		adp5520_set_bits(dev->master, ADP5520_GPIO_OUT, dev->lut[off]);
 	else
-		adp5520_clr_bits(dev->master, GPIO_OUT, dev->lut[off]);
+		adp5520_clr_bits(dev->master, ADP5520_GPIO_OUT, dev->lut[off]);
 }
 
 static int adp5520_gpio_direction_input(struct gpio_chip *chip, unsigned off)
@@ -60,7 +60,8 @@ static int adp5520_gpio_direction_input(struct gpio_chip *chip, unsigned off)
 
 	clear_bit(off, &dev->output);
 
-	return adp5520_clr_bits(dev->master, GPIO_CFG_2, dev->lut[off]);
+	return adp5520_clr_bits(dev->master, ADP5520_GPIO_CFG_2,
+				dev->lut[off]);
 }
 
 static int adp5520_gpio_direction_output(struct gpio_chip *chip,
@@ -73,18 +74,21 @@ static int adp5520_gpio_direction_output(struct gpio_chip *chip,
 	set_bit(off, &dev->output);
 
 	if (val)
-		ret |= adp5520_set_bits(dev->master, GPIO_OUT, dev->lut[off]);
+		ret |= adp5520_set_bits(dev->master, ADP5520_GPIO_OUT,
+					dev->lut[off]);
 	else
-		ret |= adp5520_clr_bits(dev->master, GPIO_OUT, dev->lut[off]);
+		ret |= adp5520_clr_bits(dev->master, ADP5520_GPIO_OUT,
+					dev->lut[off]);
 
-	ret |= adp5520_set_bits(dev->master, GPIO_CFG_2, dev->lut[off]);
+	ret |= adp5520_set_bits(dev->master, ADP5520_GPIO_CFG_2,
+					dev->lut[off]);
 
 	return ret;
 }
 
 static int __devinit adp5520_gpio_probe(struct platform_device *pdev)
 {
-	struct adp5520_gpio_platfrom_data *pdata = pdev->dev.platform_data;
+	struct adp5520_gpio_platform_data *pdata = pdev->dev.platform_data;
 	struct adp5520_gpio *dev;
 	struct gpio_chip *gc;
 	int ret, i, gpios;
@@ -129,20 +133,20 @@ static int __devinit adp5520_gpio_probe(struct platform_device *pdev)
 	gc->label = pdev->name;
 	gc->owner = THIS_MODULE;
 
-	ret = adp5520_clr_bits(dev->master, GPIO_CFG_1,
+	ret = adp5520_clr_bits(dev->master, ADP5520_GPIO_CFG_1,
 		pdata->gpio_en_mask);
 
-	if (pdata->gpio_en_mask & GPIO_C3)
-		ctl_mask |= C3_MODE;
+	if (pdata->gpio_en_mask & ADP5520_GPIO_C3)
+		ctl_mask |= ADP5520_C3_MODE;
 
-	if (pdata->gpio_en_mask & GPIO_R3)
-		ctl_mask |= R3_MODE;
+	if (pdata->gpio_en_mask & ADP5520_GPIO_R3)
+		ctl_mask |= ADP5520_R3_MODE;
 
 	if (ctl_mask)
-		ret = adp5520_set_bits(dev->master, LED_CONTROL,
+		ret = adp5520_set_bits(dev->master, ADP5520_LED_CONTROL,
 			ctl_mask);
 
-	ret |= adp5520_set_bits(dev->master, GPIO_PULLUP,
+	ret |= adp5520_set_bits(dev->master, ADP5520_GPIO_PULLUP,
 		pdata->gpio_pullup_mask);
 
 	if (ret) {
diff --git a/drivers/gpio/adp5588-gpio.c b/drivers/gpio/adp5588-gpio.c
new file mode 100644
index 000000000000..afc097a16b33
--- /dev/null
+++ b/drivers/gpio/adp5588-gpio.c
@@ -0,0 +1,266 @@
+/*
+ * GPIO Chip driver for Analog Devices
+ * ADP5588 I/O Expander and QWERTY Keypad Controller
+ *
+ * Copyright 2009 Analog Devices Inc.
+ *
+ * Licensed under the GPL-2 or later.
+ */
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/i2c.h>
+#include <linux/gpio.h>
+
+#include <linux/i2c/adp5588.h>
+
+#define DRV_NAME		"adp5588-gpio"
+#define MAXGPIO			18
+#define ADP_BANK(offs)		((offs) >> 3)
+#define ADP_BIT(offs)		(1u << ((offs) & 0x7))
+
+struct adp5588_gpio {
+	struct i2c_client *client;
+	struct gpio_chip gpio_chip;
+	struct mutex lock;	/* protect cached dir, dat_out */
+	unsigned gpio_start;
+	uint8_t dat_out[3];
+	uint8_t dir[3];
+};
+
+static int adp5588_gpio_read(struct i2c_client *client, u8 reg)
+{
+	int ret = i2c_smbus_read_byte_data(client, reg);
+
+	if (ret < 0)
+		dev_err(&client->dev, "Read Error\n");
+
+	return ret;
+}
+
+static int adp5588_gpio_write(struct i2c_client *client, u8 reg, u8 val)
+{
+	int ret = i2c_smbus_write_byte_data(client, reg, val);
+
+	if (ret < 0)
+		dev_err(&client->dev, "Write Error\n");
+
+	return ret;
+}
+
+static int adp5588_gpio_get_value(struct gpio_chip *chip, unsigned off)
+{
+	struct adp5588_gpio *dev =
+	    container_of(chip, struct adp5588_gpio, gpio_chip);
+
+	return !!(adp5588_gpio_read(dev->client, GPIO_DAT_STAT1 + ADP_BANK(off))
+		  & ADP_BIT(off));
+}
+
+static void adp5588_gpio_set_value(struct gpio_chip *chip,
+				   unsigned off, int val)
+{
+	unsigned bank, bit;
+	struct adp5588_gpio *dev =
+	    container_of(chip, struct adp5588_gpio, gpio_chip);
+
+	bank = ADP_BANK(off);
+	bit = ADP_BIT(off);
+
+	mutex_lock(&dev->lock);
+	if (val)
+		dev->dat_out[bank] |= bit;
+	else
+		dev->dat_out[bank] &= ~bit;
+
+	adp5588_gpio_write(dev->client, GPIO_DAT_OUT1 + bank,
+			   dev->dat_out[bank]);
+	mutex_unlock(&dev->lock);
+}
+
+static int adp5588_gpio_direction_input(struct gpio_chip *chip, unsigned off)
+{
+	int ret;
+	unsigned bank;
+	struct adp5588_gpio *dev =
+	    container_of(chip, struct adp5588_gpio, gpio_chip);
+
+	bank = ADP_BANK(off);
+
+	mutex_lock(&dev->lock);
+	dev->dir[bank] &= ~ADP_BIT(off);
+	ret = adp5588_gpio_write(dev->client, GPIO_DIR1 + bank, dev->dir[bank]);
+	mutex_unlock(&dev->lock);
+
+	return ret;
+}
+
+static int adp5588_gpio_direction_output(struct gpio_chip *chip,
+					 unsigned off, int val)
+{
+	int ret;
+	unsigned bank, bit;
+	struct adp5588_gpio *dev =
+	    container_of(chip, struct adp5588_gpio, gpio_chip);
+
+	bank = ADP_BANK(off);
+	bit = ADP_BIT(off);
+
+	mutex_lock(&dev->lock);
+	dev->dir[bank] |= bit;
+
+	if (val)
+		dev->dat_out[bank] |= bit;
+	else
+		dev->dat_out[bank] &= ~bit;
+
+	ret = adp5588_gpio_write(dev->client, GPIO_DAT_OUT1 + bank,
+				 dev->dat_out[bank]);
+	ret |= adp5588_gpio_write(dev->client, GPIO_DIR1 + bank,
+				 dev->dir[bank]);
+	mutex_unlock(&dev->lock);
+
+	return ret;
+}
+
+static int __devinit adp5588_gpio_probe(struct i2c_client *client,
+					const struct i2c_device_id *id)
+{
+	struct adp5588_gpio_platform_data *pdata = client->dev.platform_data;
+	struct adp5588_gpio *dev;
+	struct gpio_chip *gc;
+	int ret, i, revid;
+
+	if (pdata == NULL) {
+		dev_err(&client->dev, "missing platform data\n");
+		return -ENODEV;
+	}
+
+	if (!i2c_check_functionality(client->adapter,
+					I2C_FUNC_SMBUS_BYTE_DATA)) {
+		dev_err(&client->dev, "SMBUS Byte Data not Supported\n");
+		return -EIO;
+	}
+
+	dev = kzalloc(sizeof(*dev), GFP_KERNEL);
+	if (dev == NULL) {
+		dev_err(&client->dev, "failed to alloc memory\n");
+		return -ENOMEM;
+	}
+
+	dev->client = client;
+
+	gc = &dev->gpio_chip;
+	gc->direction_input = adp5588_gpio_direction_input;
+	gc->direction_output = adp5588_gpio_direction_output;
+	gc->get = adp5588_gpio_get_value;
+	gc->set = adp5588_gpio_set_value;
+	gc->can_sleep = 1;
+
+	gc->base = pdata->gpio_start;
+	gc->ngpio = MAXGPIO;
+	gc->label = client->name;
+	gc->owner = THIS_MODULE;
+
+	mutex_init(&dev->lock);
+
+
+	ret = adp5588_gpio_read(dev->client, DEV_ID);
+	if (ret < 0)
+		goto err;
+
+	revid = ret & ADP5588_DEVICE_ID_MASK;
+
+	for (i = 0, ret = 0; i <= ADP_BANK(MAXGPIO); i++) {
+		dev->dat_out[i] = adp5588_gpio_read(client, GPIO_DAT_OUT1 + i);
+		dev->dir[i] = adp5588_gpio_read(client, GPIO_DIR1 + i);
+		ret |= adp5588_gpio_write(client, KP_GPIO1 + i, 0);
+		ret |= adp5588_gpio_write(client, GPIO_PULL1 + i,
+				(pdata->pullup_dis_mask >> (8 * i)) & 0xFF);
+
+		if (ret)
+			goto err;
+	}
+
+	ret = gpiochip_add(&dev->gpio_chip);
+	if (ret)
+		goto err;
+
+	dev_info(&client->dev, "gpios %d..%d on a %s Rev. %d\n",
+			gc->base, gc->base + gc->ngpio - 1,
+			client->name, revid);
+
+	if (pdata->setup) {
+		ret = pdata->setup(client, gc->base, gc->ngpio, pdata->context);
+		if (ret < 0)
+			dev_warn(&client->dev, "setup failed, %d\n", ret);
+	}
+
+	i2c_set_clientdata(client, dev);
+	return 0;
+
+err:
+	kfree(dev);
+	return ret;
+}
+
+static int __devexit adp5588_gpio_remove(struct i2c_client *client)
+{
+	struct adp5588_gpio_platform_data *pdata = client->dev.platform_data;
+	struct adp5588_gpio *dev = i2c_get_clientdata(client);
+	int ret;
+
+	if (pdata->teardown) {
+		ret = pdata->teardown(client,
+				      dev->gpio_chip.base, dev->gpio_chip.ngpio,
+				      pdata->context);
+		if (ret < 0) {
+			dev_err(&client->dev, "teardown failed %d\n", ret);
+			return ret;
+		}
+	}
+
+	ret = gpiochip_remove(&dev->gpio_chip);
+	if (ret) {
+		dev_err(&client->dev, "gpiochip_remove failed %d\n", ret);
+		return ret;
+	}
+
+	kfree(dev);
+	return 0;
+}
+
+static const struct i2c_device_id adp5588_gpio_id[] = {
+	{DRV_NAME, 0},
+	{}
+};
+
+MODULE_DEVICE_TABLE(i2c, adp5588_gpio_id);
+
+static struct i2c_driver adp5588_gpio_driver = {
+	.driver = {
+		   .name = DRV_NAME,
+		   },
+	.probe = adp5588_gpio_probe,
+	.remove = __devexit_p(adp5588_gpio_remove),
+	.id_table = adp5588_gpio_id,
+};
+
+static int __init adp5588_gpio_init(void)
+{
+	return i2c_add_driver(&adp5588_gpio_driver);
+}
+
+module_init(adp5588_gpio_init);
+
+static void __exit adp5588_gpio_exit(void)
+{
+	i2c_del_driver(&adp5588_gpio_driver);
+}
+
+module_exit(adp5588_gpio_exit);
+
+MODULE_AUTHOR("Michael Hennerich <hennerich@blackfin.uclinux.org>");
+MODULE_DESCRIPTION("GPIO ADP5588 Driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/gpio/cs5535-gpio.c b/drivers/gpio/cs5535-gpio.c
new file mode 100644
index 000000000000..0fdbe94f24a3
--- /dev/null
+++ b/drivers/gpio/cs5535-gpio.c
@@ -0,0 +1,355 @@
+/*
+ * AMD CS5535/CS5536 GPIO driver
+ * Copyright (C) 2006  Advanced Micro Devices, Inc.
+ * Copyright (C) 2007-2009  Andres Salomon <dilinger@collabora.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public License
+ * as published by the Free Software Foundation.
+ */
+
+#include <linux/kernel.h>
+#include <linux/spinlock.h>
+#include <linux/module.h>
+#include <linux/pci.h>
+#include <linux/gpio.h>
+#include <linux/io.h>
+#include <linux/cs5535.h>
+
+#define DRV_NAME "cs5535-gpio"
+#define GPIO_BAR 1
+
+/*
+ * Some GPIO pins
+ *  31-29,23 : reserved (always mask out)
+ *  28       : Power Button
+ *  26       : PME#
+ *  22-16    : LPC
+ *  14,15    : SMBus
+ *  9,8      : UART1
+ *  7        : PCI INTB
+ *  3,4      : UART2/DDC
+ *  2        : IDE_IRQ0
+ *  1        : AC_BEEP
+ *  0        : PCI INTA
+ *
+ * If a mask was not specified, allow all except
+ * reserved and Power Button
+ */
+#define GPIO_DEFAULT_MASK 0x0F7FFFFF
+
+static ulong mask = GPIO_DEFAULT_MASK;
+module_param_named(mask, mask, ulong, 0444);
+MODULE_PARM_DESC(mask, "GPIO channel mask.");
+
+static struct cs5535_gpio_chip {
+	struct gpio_chip chip;
+	resource_size_t base;
+
+	struct pci_dev *pdev;
+	spinlock_t lock;
+} cs5535_gpio_chip;
+
+/*
+ * The CS5535/CS5536 GPIOs support a number of extra features not defined
+ * by the gpio_chip API, so these are exported.  For a full list of the
+ * registers, see include/linux/cs5535.h.
+ */
+
+static void __cs5535_gpio_set(struct cs5535_gpio_chip *chip, unsigned offset,
+		unsigned int reg)
+{
+	if (offset < 16)
+		/* low bank register */
+		outl(1 << offset, chip->base + reg);
+	else
+		/* high bank register */
+		outl(1 << (offset - 16), chip->base + 0x80 + reg);
+}
+
+void cs5535_gpio_set(unsigned offset, unsigned int reg)
+{
+	struct cs5535_gpio_chip *chip = &cs5535_gpio_chip;
+	unsigned long flags;
+
+	spin_lock_irqsave(&chip->lock, flags);
+	__cs5535_gpio_set(chip, offset, reg);
+	spin_unlock_irqrestore(&chip->lock, flags);
+}
+EXPORT_SYMBOL_GPL(cs5535_gpio_set);
+
+static void __cs5535_gpio_clear(struct cs5535_gpio_chip *chip, unsigned offset,
+		unsigned int reg)
+{
+	if (offset < 16)
+		/* low bank register */
+		outl(1 << (offset + 16), chip->base + reg);
+	else
+		/* high bank register */
+		outl(1 << offset, chip->base + 0x80 + reg);
+}
+
+void cs5535_gpio_clear(unsigned offset, unsigned int reg)
+{
+	struct cs5535_gpio_chip *chip = &cs5535_gpio_chip;
+	unsigned long flags;
+
+	spin_lock_irqsave(&chip->lock, flags);
+	__cs5535_gpio_clear(chip, offset, reg);
+	spin_unlock_irqrestore(&chip->lock, flags);
+}
+EXPORT_SYMBOL_GPL(cs5535_gpio_clear);
+
+int cs5535_gpio_isset(unsigned offset, unsigned int reg)
+{
+	struct cs5535_gpio_chip *chip = &cs5535_gpio_chip;
+	unsigned long flags;
+	long val;
+
+	spin_lock_irqsave(&chip->lock, flags);
+	if (offset < 16)
+		/* low bank register */
+		val = inl(chip->base + reg);
+	else {
+		/* high bank register */
+		val = inl(chip->base + 0x80 + reg);
+		offset -= 16;
+	}
+	spin_unlock_irqrestore(&chip->lock, flags);
+
+	return (val & (1 << offset)) ? 1 : 0;
+}
+EXPORT_SYMBOL_GPL(cs5535_gpio_isset);
+
+/*
+ * Generic gpio_chip API support.
+ */
+
+static int chip_gpio_request(struct gpio_chip *c, unsigned offset)
+{
+	struct cs5535_gpio_chip *chip = (struct cs5535_gpio_chip *) c;
+	unsigned long flags;
+
+	spin_lock_irqsave(&chip->lock, flags);
+
+	/* check if this pin is available */
+	if ((mask & (1 << offset)) == 0) {
+		dev_info(&chip->pdev->dev,
+			"pin %u is not available (check mask)\n", offset);
+		spin_unlock_irqrestore(&chip->lock, flags);
+		return -EINVAL;
+	}
+
+	/* disable output aux 1 & 2 on this pin */
+	__cs5535_gpio_clear(chip, offset, GPIO_OUTPUT_AUX1);
+	__cs5535_gpio_clear(chip, offset, GPIO_OUTPUT_AUX2);
+
+	/* disable input aux 1 on this pin */
+	__cs5535_gpio_clear(chip, offset, GPIO_INPUT_AUX1);
+
+	spin_unlock_irqrestore(&chip->lock, flags);
+
+	return 0;
+}
+
+static int chip_gpio_get(struct gpio_chip *chip, unsigned offset)
+{
+	return cs5535_gpio_isset(offset, GPIO_OUTPUT_VAL);
+}
+
+static void chip_gpio_set(struct gpio_chip *chip, unsigned offset, int val)
+{
+	if (val)
+		cs5535_gpio_set(offset, GPIO_OUTPUT_VAL);
+	else
+		cs5535_gpio_clear(offset, GPIO_OUTPUT_VAL);
+}
+
+static int chip_direction_input(struct gpio_chip *c, unsigned offset)
+{
+	struct cs5535_gpio_chip *chip = (struct cs5535_gpio_chip *) c;
+	unsigned long flags;
+
+	spin_lock_irqsave(&chip->lock, flags);
+	__cs5535_gpio_set(chip, offset, GPIO_INPUT_ENABLE);
+	spin_unlock_irqrestore(&chip->lock, flags);
+
+	return 0;
+}
+
+static int chip_direction_output(struct gpio_chip *c, unsigned offset, int val)
+{
+	struct cs5535_gpio_chip *chip = (struct cs5535_gpio_chip *) c;
+	unsigned long flags;
+
+	spin_lock_irqsave(&chip->lock, flags);
+
+	__cs5535_gpio_set(chip, offset, GPIO_OUTPUT_ENABLE);
+	if (val)
+		__cs5535_gpio_set(chip, offset, GPIO_OUTPUT_VAL);
+	else
+		__cs5535_gpio_clear(chip, offset, GPIO_OUTPUT_VAL);
+
+	spin_unlock_irqrestore(&chip->lock, flags);
+
+	return 0;
+}
+
+static char *cs5535_gpio_names[] = {
+	"GPIO0", "GPIO1", "GPIO2", "GPIO3",
+	"GPIO4", "GPIO5", "GPIO6", "GPIO7",
+	"GPIO8", "GPIO9", "GPIO10", "GPIO11",
+	"GPIO12", "GPIO13", "GPIO14", "GPIO15",
+	"GPIO16", "GPIO17", "GPIO18", "GPIO19",
+	"GPIO20", "GPIO21", "GPIO22", NULL,
+	"GPIO24", "GPIO25", "GPIO26", "GPIO27",
+	"GPIO28", NULL, NULL, NULL,
+};
+
+static struct cs5535_gpio_chip cs5535_gpio_chip = {
+	.chip = {
+		.owner = THIS_MODULE,
+		.label = DRV_NAME,
+
+		.base = 0,
+		.ngpio = 32,
+		.names = cs5535_gpio_names,
+		.request = chip_gpio_request,
+
+		.get = chip_gpio_get,
+		.set = chip_gpio_set,
+
+		.direction_input = chip_direction_input,
+		.direction_output = chip_direction_output,
+	},
+};
+
+static int __init cs5535_gpio_probe(struct pci_dev *pdev,
+		const struct pci_device_id *pci_id)
+{
+	int err;
+	ulong mask_orig = mask;
+
+	/* There are two ways to get the GPIO base address; one is by
+	 * fetching it from MSR_LBAR_GPIO, the other is by reading the
+	 * PCI BAR info.  The latter method is easier (especially across
+	 * different architectures), so we'll stick with that for now.  If
+	 * it turns out to be unreliable in the face of crappy BIOSes, we
+	 * can always go back to using MSRs.. */
+
+	err = pci_enable_device_io(pdev);
+	if (err) {
+		dev_err(&pdev->dev, "can't enable device IO\n");
+		goto done;
+	}
+
+	err = pci_request_region(pdev, GPIO_BAR, DRV_NAME);
+	if (err) {
+		dev_err(&pdev->dev, "can't alloc PCI BAR #%d\n", GPIO_BAR);
+		goto done;
+	}
+
+	/* set up the driver-specific struct */
+	cs5535_gpio_chip.base = pci_resource_start(pdev, GPIO_BAR);
+	cs5535_gpio_chip.pdev = pdev;
+	spin_lock_init(&cs5535_gpio_chip.lock);
+
+	dev_info(&pdev->dev, "allocated PCI BAR #%d: base 0x%llx\n", GPIO_BAR,
+			(unsigned long long) cs5535_gpio_chip.base);
+
+	/* mask out reserved pins */
+	mask &= 0x1F7FFFFF;
+
+	/* do not allow pin 28, Power Button, as there's special handling
+	 * in the PMC needed. (note 12, p. 48) */
+	mask &= ~(1 << 28);
+
+	if (mask_orig != mask)
+		dev_info(&pdev->dev, "mask changed from 0x%08lX to 0x%08lX\n",
+				mask_orig, mask);
+
+	/* finally, register with the generic GPIO API */
+	err = gpiochip_add(&cs5535_gpio_chip.chip);
+	if (err)
+		goto release_region;
+
+	dev_info(&pdev->dev, DRV_NAME ": GPIO support successfully loaded.\n");
+	return 0;
+
+release_region:
+	pci_release_region(pdev, GPIO_BAR);
+done:
+	return err;
+}
+
+static void __exit cs5535_gpio_remove(struct pci_dev *pdev)
+{
+	int err;
+
+	err = gpiochip_remove(&cs5535_gpio_chip.chip);
+	if (err) {
+		/* uhh? */
+		dev_err(&pdev->dev, "unable to remove gpio_chip?\n");
+	}
+	pci_release_region(pdev, GPIO_BAR);
+}
+
+static struct pci_device_id cs5535_gpio_pci_tbl[] = {
+	{ PCI_DEVICE(PCI_VENDOR_ID_NS, PCI_DEVICE_ID_NS_CS5535_ISA) },
+	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_CS5536_ISA) },
+	{ 0, },
+};
+MODULE_DEVICE_TABLE(pci, cs5535_gpio_pci_tbl);
+
+/*
+ * We can't use the standard PCI driver registration stuff here, since
+ * that allows only one driver to bind to each PCI device (and we want
+ * multiple drivers to be able to bind to the device).  Instead, manually
+ * scan for the PCI device, request a single region, and keep track of the
+ * devices that we're using.
+ */
+
+static int __init cs5535_gpio_scan_pci(void)
+{
+	struct pci_dev *pdev;
+	int err = -ENODEV;
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(cs5535_gpio_pci_tbl); i++) {
+		pdev = pci_get_device(cs5535_gpio_pci_tbl[i].vendor,
+				cs5535_gpio_pci_tbl[i].device, NULL);
+		if (pdev) {
+			err = cs5535_gpio_probe(pdev, &cs5535_gpio_pci_tbl[i]);
+			if (err)
+				pci_dev_put(pdev);
+
+			/* we only support a single CS5535/6 southbridge */
+			break;
+		}
+	}
+
+	return err;
+}
+
+static void __exit cs5535_gpio_free_pci(void)
+{
+	cs5535_gpio_remove(cs5535_gpio_chip.pdev);
+	pci_dev_put(cs5535_gpio_chip.pdev);
+}
+
+static int __init cs5535_gpio_init(void)
+{
+	return cs5535_gpio_scan_pci();
+}
+
+static void __exit cs5535_gpio_exit(void)
+{
+	cs5535_gpio_free_pci();
+}
+
+module_init(cs5535_gpio_init);
+module_exit(cs5535_gpio_exit);
+
+MODULE_AUTHOR("Andres Salomon <dilinger@collabora.co.uk>");
+MODULE_DESCRIPTION("AMD CS5535/CS5536 GPIO driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 50de0f5750d8..350842ad3632 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -53,6 +53,7 @@ struct gpio_desc {
 #define FLAG_SYSFS	4	/* exported via /sys/class/gpio/control */
 #define FLAG_TRIG_FALL	5	/* trigger on falling edge */
 #define FLAG_TRIG_RISE	6	/* trigger on rising edge */
+#define FLAG_ACTIVE_LOW	7	/* sysfs value has active low */
 
 #define PDESC_ID_SHIFT	16	/* add new flags before this one */
 
@@ -210,6 +211,11 @@ static DEFINE_MUTEX(sysfs_lock);
  *      * configures behavior of poll(2) on /value
  *      * available only if pin can generate IRQs on input
  *      * is read/write as "none", "falling", "rising", or "both"
+ *   /active_low
+ *      * configures polarity of /value
+ *      * is read/write as zero/nonzero
+ *      * also affects existing and subsequent "falling" and "rising"
+ *        /edge configuration
  */
 
 static ssize_t gpio_direction_show(struct device *dev,
@@ -255,7 +261,7 @@ static ssize_t gpio_direction_store(struct device *dev,
 	return status ? : size;
 }
 
-static const DEVICE_ATTR(direction, 0644,
+static /* const */ DEVICE_ATTR(direction, 0644,
 		gpio_direction_show, gpio_direction_store);
 
 static ssize_t gpio_value_show(struct device *dev,
@@ -267,10 +273,17 @@ static ssize_t gpio_value_show(struct device *dev,
 
 	mutex_lock(&sysfs_lock);
 
-	if (!test_bit(FLAG_EXPORT, &desc->flags))
+	if (!test_bit(FLAG_EXPORT, &desc->flags)) {
 		status = -EIO;
-	else
-		status = sprintf(buf, "%d\n", !!gpio_get_value_cansleep(gpio));
+	} else {
+		int value;
+
+		value = !!gpio_get_value_cansleep(gpio);
+		if (test_bit(FLAG_ACTIVE_LOW, &desc->flags))
+			value = !value;
+
+		status = sprintf(buf, "%d\n", value);
+	}
 
 	mutex_unlock(&sysfs_lock);
 	return status;
@@ -294,6 +307,8 @@ static ssize_t gpio_value_store(struct device *dev,
 
 		status = strict_strtol(buf, 0, &value);
 		if (status == 0) {
+			if (test_bit(FLAG_ACTIVE_LOW, &desc->flags))
+				value = !value;
 			gpio_set_value_cansleep(gpio, value != 0);
 			status = size;
 		}
@@ -303,7 +318,7 @@ static ssize_t gpio_value_store(struct device *dev,
 	return status;
 }
 
-static /*const*/ DEVICE_ATTR(value, 0644,
+static const DEVICE_ATTR(value, 0644,
 		gpio_value_show, gpio_value_store);
 
 static irqreturn_t gpio_sysfs_irq(int irq, void *priv)
@@ -352,9 +367,11 @@ static int gpio_setup_irq(struct gpio_desc *desc, struct device *dev,
 
 	irq_flags = IRQF_SHARED;
 	if (test_bit(FLAG_TRIG_FALL, &gpio_flags))
-		irq_flags |= IRQF_TRIGGER_FALLING;
+		irq_flags |= test_bit(FLAG_ACTIVE_LOW, &desc->flags) ?
+			IRQF_TRIGGER_RISING : IRQF_TRIGGER_FALLING;
 	if (test_bit(FLAG_TRIG_RISE, &gpio_flags))
-		irq_flags |= IRQF_TRIGGER_RISING;
+		irq_flags |= test_bit(FLAG_ACTIVE_LOW, &desc->flags) ?
+			IRQF_TRIGGER_FALLING : IRQF_TRIGGER_RISING;
 
 	if (!pdesc) {
 		pdesc = kmalloc(sizeof(*pdesc), GFP_KERNEL);
@@ -475,9 +492,79 @@ found:
 
 static DEVICE_ATTR(edge, 0644, gpio_edge_show, gpio_edge_store);
 
+static int sysfs_set_active_low(struct gpio_desc *desc, struct device *dev,
+				int value)
+{
+	int			status = 0;
+
+	if (!!test_bit(FLAG_ACTIVE_LOW, &desc->flags) == !!value)
+		return 0;
+
+	if (value)
+		set_bit(FLAG_ACTIVE_LOW, &desc->flags);
+	else
+		clear_bit(FLAG_ACTIVE_LOW, &desc->flags);
+
+	/* reconfigure poll(2) support if enabled on one edge only */
+	if (dev != NULL && (!!test_bit(FLAG_TRIG_RISE, &desc->flags) ^
+				!!test_bit(FLAG_TRIG_FALL, &desc->flags))) {
+		unsigned long trigger_flags = desc->flags & GPIO_TRIGGER_MASK;
+
+		gpio_setup_irq(desc, dev, 0);
+		status = gpio_setup_irq(desc, dev, trigger_flags);
+	}
+
+	return status;
+}
+
+static ssize_t gpio_active_low_show(struct device *dev,
+		struct device_attribute *attr, char *buf)
+{
+	const struct gpio_desc	*desc = dev_get_drvdata(dev);
+	ssize_t			status;
+
+	mutex_lock(&sysfs_lock);
+
+	if (!test_bit(FLAG_EXPORT, &desc->flags))
+		status = -EIO;
+	else
+		status = sprintf(buf, "%d\n",
+				!!test_bit(FLAG_ACTIVE_LOW, &desc->flags));
+
+	mutex_unlock(&sysfs_lock);
+
+	return status;
+}
+
+static ssize_t gpio_active_low_store(struct device *dev,
+		struct device_attribute *attr, const char *buf, size_t size)
+{
+	struct gpio_desc	*desc = dev_get_drvdata(dev);
+	ssize_t			status;
+
+	mutex_lock(&sysfs_lock);
+
+	if (!test_bit(FLAG_EXPORT, &desc->flags)) {
+		status = -EIO;
+	} else {
+		long		value;
+
+		status = strict_strtol(buf, 0, &value);
+		if (status == 0)
+			status = sysfs_set_active_low(desc, dev, value != 0);
+	}
+
+	mutex_unlock(&sysfs_lock);
+
+	return status ? : size;
+}
+
+static const DEVICE_ATTR(active_low, 0644,
+		gpio_active_low_show, gpio_active_low_store);
+
 static const struct attribute *gpio_attrs[] = {
-	&dev_attr_direction.attr,
 	&dev_attr_value.attr,
+	&dev_attr_active_low.attr,
 	NULL,
 };
 
@@ -662,12 +749,12 @@ int gpio_export(unsigned gpio, bool direction_may_change)
 		dev = device_create(&gpio_class, desc->chip->dev, MKDEV(0, 0),
 				desc, ioname ? ioname : "gpio%d", gpio);
 		if (!IS_ERR(dev)) {
-			if (direction_may_change)
-				status = sysfs_create_group(&dev->kobj,
+			status = sysfs_create_group(&dev->kobj,
 						&gpio_attr_group);
-			else
+
+			if (!status && direction_may_change)
 				status = device_create_file(dev,
-						&dev_attr_value);
+						&dev_attr_direction);
 
 			if (!status && gpio_to_irq(gpio) >= 0
 					&& (direction_may_change
@@ -744,6 +831,53 @@ done:
 }
 EXPORT_SYMBOL_GPL(gpio_export_link);
 
+
+/**
+ * gpio_sysfs_set_active_low - set the polarity of gpio sysfs value
+ * @gpio: gpio to change
+ * @value: non-zero to use active low, i.e. inverted values
+ *
+ * Set the polarity of /sys/class/gpio/gpioN/value sysfs attribute.
+ * The GPIO does not have to be exported yet.  If poll(2) support has
+ * been enabled for either rising or falling edge, it will be
+ * reconfigured to follow the new polarity.
+ *
+ * Returns zero on success, else an error.
+ */
+int gpio_sysfs_set_active_low(unsigned gpio, int value)
+{
+	struct gpio_desc	*desc;
+	struct device		*dev = NULL;
+	int			status = -EINVAL;
+
+	if (!gpio_is_valid(gpio))
+		goto done;
+
+	mutex_lock(&sysfs_lock);
+
+	desc = &gpio_desc[gpio];
+
+	if (test_bit(FLAG_EXPORT, &desc->flags)) {
+		dev = class_find_device(&gpio_class, NULL, desc, match_export);
+		if (dev == NULL) {
+			status = -ENODEV;
+			goto unlock;
+		}
+	}
+
+	status = sysfs_set_active_low(desc, dev, value);
+
+unlock:
+	mutex_unlock(&sysfs_lock);
+
+done:
+	if (status)
+		pr_debug("%s: gpio%d status %d\n", __func__, gpio, status);
+
+	return status;
+}
+EXPORT_SYMBOL_GPL(gpio_sysfs_set_active_low);
+
 /**
  * gpio_unexport - reverse effect of gpio_export()
  * @gpio: gpio to make unavailable
@@ -1094,6 +1228,7 @@ void gpio_free(unsigned gpio)
 		}
 		desc_set_label(desc, NULL);
 		module_put(desc->chip->owner);
+		clear_bit(FLAG_ACTIVE_LOW, &desc->flags);
 		clear_bit(FLAG_REQUESTED, &desc->flags);
 	} else
 		WARN_ON(extra_checks);
diff --git a/drivers/gpio/langwell_gpio.c b/drivers/gpio/langwell_gpio.c
index 4baf3d7d0f8e..6c0ebbdc659e 100644
--- a/drivers/gpio/langwell_gpio.c
+++ b/drivers/gpio/langwell_gpio.c
@@ -123,7 +123,7 @@ static int lnw_irq_type(unsigned irq, unsigned type)
 	void __iomem *grer = (void __iomem *)(&lnw->reg_base->GRER[reg]);
 	void __iomem *gfer = (void __iomem *)(&lnw->reg_base->GFER[reg]);
 
-	if (gpio < 0 || gpio > lnw->chip.ngpio)
+	if (gpio >= lnw->chip.ngpio)
 		return -EINVAL;
 	spin_lock_irqsave(&lnw->lock, flags);
 	if (type & IRQ_TYPE_EDGE_RISING)
diff --git a/drivers/gpio/timbgpio.c b/drivers/gpio/timbgpio.c
new file mode 100644
index 000000000000..a4d344ba8e5c
--- /dev/null
+++ b/drivers/gpio/timbgpio.c
@@ -0,0 +1,342 @@
+/*
+ * timbgpio.c timberdale FPGA GPIO driver
+ * Copyright (c) 2009 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+/* Supports:
+ * Timberdale FPGA GPIO
+ */
+
+#include <linux/module.h>
+#include <linux/gpio.h>
+#include <linux/platform_device.h>
+#include <linux/io.h>
+#include <linux/timb_gpio.h>
+#include <linux/interrupt.h>
+
+#define DRIVER_NAME "timb-gpio"
+
+#define TGPIOVAL	0x00
+#define TGPIODIR	0x04
+#define TGPIO_IER	0x08
+#define TGPIO_ISR	0x0c
+#define TGPIO_IPR	0x10
+#define TGPIO_ICR	0x14
+#define TGPIO_FLR	0x18
+#define TGPIO_LVR	0x1c
+
+struct timbgpio {
+	void __iomem		*membase;
+	spinlock_t		lock; /* mutual exclusion */
+	struct gpio_chip	gpio;
+	int			irq_base;
+};
+
+static int timbgpio_update_bit(struct gpio_chip *gpio, unsigned index,
+	unsigned offset, bool enabled)
+{
+	struct timbgpio *tgpio = container_of(gpio, struct timbgpio, gpio);
+	u32 reg;
+
+	spin_lock(&tgpio->lock);
+	reg = ioread32(tgpio->membase + offset);
+
+	if (enabled)
+		reg |= (1 << index);
+	else
+		reg &= ~(1 << index);
+
+	iowrite32(reg, tgpio->membase + offset);
+	spin_unlock(&tgpio->lock);
+
+	return 0;
+}
+
+static int timbgpio_gpio_direction_input(struct gpio_chip *gpio, unsigned nr)
+{
+	return timbgpio_update_bit(gpio, nr, TGPIODIR, true);
+}
+
+static int timbgpio_gpio_get(struct gpio_chip *gpio, unsigned nr)
+{
+	struct timbgpio *tgpio = container_of(gpio, struct timbgpio, gpio);
+	u32 value;
+
+	value = ioread32(tgpio->membase + TGPIOVAL);
+	return (value & (1 << nr)) ? 1 : 0;
+}
+
+static int timbgpio_gpio_direction_output(struct gpio_chip *gpio,
+						unsigned nr, int val)
+{
+	return timbgpio_update_bit(gpio, nr, TGPIODIR, false);
+}
+
+static void timbgpio_gpio_set(struct gpio_chip *gpio,
+				unsigned nr, int val)
+{
+	timbgpio_update_bit(gpio, nr, TGPIOVAL, val != 0);
+}
+
+static int timbgpio_to_irq(struct gpio_chip *gpio, unsigned offset)
+{
+	struct timbgpio *tgpio = container_of(gpio, struct timbgpio, gpio);
+
+	if (tgpio->irq_base <= 0)
+		return -EINVAL;
+
+	return tgpio->irq_base + offset;
+}
+
+/*
+ * GPIO IRQ
+ */
+static void timbgpio_irq_disable(unsigned irq)
+{
+	struct timbgpio *tgpio = get_irq_chip_data(irq);
+	int offset = irq - tgpio->irq_base;
+
+	timbgpio_update_bit(&tgpio->gpio, offset, TGPIO_IER, 0);
+}
+
+static void timbgpio_irq_enable(unsigned irq)
+{
+	struct timbgpio *tgpio = get_irq_chip_data(irq);
+	int offset = irq - tgpio->irq_base;
+
+	timbgpio_update_bit(&tgpio->gpio, offset, TGPIO_IER, 1);
+}
+
+static int timbgpio_irq_type(unsigned irq, unsigned trigger)
+{
+	struct timbgpio *tgpio = get_irq_chip_data(irq);
+	int offset = irq - tgpio->irq_base;
+	unsigned long flags;
+	u32 lvr, flr;
+
+	if (offset < 0 || offset > tgpio->gpio.ngpio)
+		return -EINVAL;
+
+	spin_lock_irqsave(&tgpio->lock, flags);
+
+	lvr = ioread32(tgpio->membase + TGPIO_LVR);
+	flr = ioread32(tgpio->membase + TGPIO_FLR);
+
+	if (trigger & (IRQ_TYPE_LEVEL_HIGH | IRQ_TYPE_LEVEL_LOW)) {
+		flr &= ~(1 << offset);
+		if (trigger & IRQ_TYPE_LEVEL_HIGH)
+			lvr |= 1 << offset;
+		else
+			lvr &= ~(1 << offset);
+	}
+
+	if ((trigger & IRQ_TYPE_EDGE_BOTH) == IRQ_TYPE_EDGE_BOTH)
+		return -EINVAL;
+	else {
+		flr |= 1 << offset;
+		/* opposite compared to the datasheet, but it mirrors the
+		 * reality
+		 */
+		if (trigger & IRQ_TYPE_EDGE_FALLING)
+			lvr |= 1 << offset;
+		else
+			lvr &= ~(1 << offset);
+	}
+
+	iowrite32(lvr, tgpio->membase + TGPIO_LVR);
+	iowrite32(flr, tgpio->membase + TGPIO_FLR);
+	iowrite32(1 << offset, tgpio->membase + TGPIO_ICR);
+	spin_unlock_irqrestore(&tgpio->lock, flags);
+
+	return 0;
+}
+
+static void timbgpio_irq(unsigned int irq, struct irq_desc *desc)
+{
+	struct timbgpio *tgpio = get_irq_data(irq);
+	unsigned long ipr;
+	int offset;
+
+	desc->chip->ack(irq);
+	ipr = ioread32(tgpio->membase + TGPIO_IPR);
+	iowrite32(ipr, tgpio->membase + TGPIO_ICR);
+
+	for_each_bit(offset, &ipr, tgpio->gpio.ngpio)
+		generic_handle_irq(timbgpio_to_irq(&tgpio->gpio, offset));
+}
+
+static struct irq_chip timbgpio_irqchip = {
+	.name		= "GPIO",
+	.enable		= timbgpio_irq_enable,
+	.disable	= timbgpio_irq_disable,
+	.set_type	= timbgpio_irq_type,
+};
+
+static int __devinit timbgpio_probe(struct platform_device *pdev)
+{
+	int err, i;
+	struct gpio_chip *gc;
+	struct timbgpio *tgpio;
+	struct resource *iomem;
+	struct timbgpio_platform_data *pdata = pdev->dev.platform_data;
+	int irq = platform_get_irq(pdev, 0);
+
+	if (!pdata || pdata->nr_pins > 32) {
+		err = -EINVAL;
+		goto err_mem;
+	}
+
+	iomem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	if (!iomem) {
+		err = -EINVAL;
+		goto err_mem;
+	}
+
+	tgpio = kzalloc(sizeof(*tgpio), GFP_KERNEL);
+	if (!tgpio) {
+		err = -EINVAL;
+		goto err_mem;
+	}
+	tgpio->irq_base = pdata->irq_base;
+
+	spin_lock_init(&tgpio->lock);
+
+	if (!request_mem_region(iomem->start, resource_size(iomem),
+		DRIVER_NAME)) {
+		err = -EBUSY;
+		goto err_request;
+	}
+
+	tgpio->membase = ioremap(iomem->start, resource_size(iomem));
+	if (!tgpio->membase) {
+		err = -ENOMEM;
+		goto err_ioremap;
+	}
+
+	gc = &tgpio->gpio;
+
+	gc->label = dev_name(&pdev->dev);
+	gc->owner = THIS_MODULE;
+	gc->dev = &pdev->dev;
+	gc->direction_input = timbgpio_gpio_direction_input;
+	gc->get = timbgpio_gpio_get;
+	gc->direction_output = timbgpio_gpio_direction_output;
+	gc->set = timbgpio_gpio_set;
+	gc->to_irq = (irq >= 0 && tgpio->irq_base > 0) ? timbgpio_to_irq : NULL;
+	gc->dbg_show = NULL;
+	gc->base = pdata->gpio_base;
+	gc->ngpio = pdata->nr_pins;
+	gc->can_sleep = 0;
+
+	err = gpiochip_add(gc);
+	if (err)
+		goto err_chipadd;
+
+	platform_set_drvdata(pdev, tgpio);
+
+	/* make sure to disable interrupts */
+	iowrite32(0x0, tgpio->membase + TGPIO_IER);
+
+	if (irq < 0 || tgpio->irq_base <= 0)
+		return 0;
+
+	for (i = 0; i < pdata->nr_pins; i++) {
+		set_irq_chip_and_handler_name(tgpio->irq_base + i,
+			&timbgpio_irqchip, handle_simple_irq, "mux");
+		set_irq_chip_data(tgpio->irq_base + i, tgpio);
+#ifdef CONFIG_ARM
+		set_irq_flags(tgpio->irq_base + i, IRQF_VALID | IRQF_PROBE);
+#endif
+	}
+
+	set_irq_data(irq, tgpio);
+	set_irq_chained_handler(irq, timbgpio_irq);
+
+	return 0;
+
+err_chipadd:
+	iounmap(tgpio->membase);
+err_ioremap:
+	release_mem_region(iomem->start, resource_size(iomem));
+err_request:
+	kfree(tgpio);
+err_mem:
+	printk(KERN_ERR DRIVER_NAME": Failed to register GPIOs: %d\n", err);
+
+	return err;
+}
+
+static int __devexit timbgpio_remove(struct platform_device *pdev)
+{
+	int err;
+	struct timbgpio_platform_data *pdata = pdev->dev.platform_data;
+	struct timbgpio *tgpio = platform_get_drvdata(pdev);
+	struct resource *iomem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	int irq = platform_get_irq(pdev, 0);
+
+	if (irq >= 0 && tgpio->irq_base > 0) {
+		int i;
+		for (i = 0; i < pdata->nr_pins; i++) {
+			set_irq_chip(tgpio->irq_base + i, NULL);
+			set_irq_chip_data(tgpio->irq_base + i, NULL);
+		}
+
+		set_irq_handler(irq, NULL);
+		set_irq_data(irq, NULL);
+	}
+
+	err = gpiochip_remove(&tgpio->gpio);
+	if (err)
+		printk(KERN_ERR DRIVER_NAME": failed to remove gpio_chip\n");
+
+	iounmap(tgpio->membase);
+	release_mem_region(iomem->start, resource_size(iomem));
+	kfree(tgpio);
+
+	platform_set_drvdata(pdev, NULL);
+
+	return 0;
+}
+
+static struct platform_driver timbgpio_platform_driver = {
+	.driver = {
+		.name	= DRIVER_NAME,
+		.owner	= THIS_MODULE,
+	},
+	.probe		= timbgpio_probe,
+	.remove		= timbgpio_remove,
+};
+
+/*--------------------------------------------------------------------------*/
+
+static int __init timbgpio_init(void)
+{
+	return platform_driver_register(&timbgpio_platform_driver);
+}
+
+static void __exit timbgpio_exit(void)
+{
+	platform_driver_unregister(&timbgpio_platform_driver);
+}
+
+module_init(timbgpio_init);
+module_exit(timbgpio_exit);
+
+MODULE_DESCRIPTION("Timberdale GPIO driver");
+MODULE_LICENSE("GPL v2");
+MODULE_AUTHOR("Mocean Laboratories");
+MODULE_ALIAS("platform:"DRIVER_NAME);
+
diff --git a/drivers/gpio/twl4030-gpio.c b/drivers/gpio/twl4030-gpio.c
index 49384a7c5492..7fe881e2bdfb 100644
--- a/drivers/gpio/twl4030-gpio.c
+++ b/drivers/gpio/twl4030-gpio.c
@@ -34,7 +34,7 @@
 #include <linux/platform_device.h>
 #include <linux/slab.h>
 
-#include <linux/i2c/twl4030.h>
+#include <linux/i2c/twl.h>
 
 
 /*
@@ -80,7 +80,7 @@ static unsigned int gpio_usage_count;
  */
 static inline int gpio_twl4030_write(u8 address, u8 data)
 {
-	return twl4030_i2c_write_u8(TWL4030_MODULE_GPIO, data, address);
+	return twl_i2c_write_u8(TWL4030_MODULE_GPIO, data, address);
 }
 
 /*----------------------------------------------------------------------*/
@@ -117,7 +117,7 @@ static inline int gpio_twl4030_read(u8 address)
 	u8 data;
 	int ret = 0;
 
-	ret = twl4030_i2c_read_u8(TWL4030_MODULE_GPIO, &data, address);
+	ret = twl_i2c_read_u8(TWL4030_MODULE_GPIO, &data, address);
 	return (ret < 0) ? ret : data;
 }
 
@@ -142,7 +142,7 @@ static void twl4030_led_set_value(int led, int value)
 		cached_leden &= ~mask;
 	else
 		cached_leden |= mask;
-	status = twl4030_i2c_write_u8(TWL4030_MODULE_LED, cached_leden,
+	status = twl_i2c_write_u8(TWL4030_MODULE_LED, cached_leden,
 			TWL4030_LED_LEDEN);
 	mutex_unlock(&gpio_lock);
 }
@@ -223,23 +223,23 @@ static int twl_request(struct gpio_chip *chip, unsigned offset)
 		}
 
 		/* initialize PWM to always-drive */
-		status = twl4030_i2c_write_u8(module, 0x7f,
+		status = twl_i2c_write_u8(module, 0x7f,
 				TWL4030_PWMx_PWMxOFF);
 		if (status < 0)
 			goto done;
-		status = twl4030_i2c_write_u8(module, 0x7f,
+		status = twl_i2c_write_u8(module, 0x7f,
 				TWL4030_PWMx_PWMxON);
 		if (status < 0)
 			goto done;
 
 		/* init LED to not-driven (high) */
 		module = TWL4030_MODULE_LED;
-		status = twl4030_i2c_read_u8(module, &cached_leden,
+		status = twl_i2c_read_u8(module, &cached_leden,
 				TWL4030_LED_LEDEN);
 		if (status < 0)
 			goto done;
 		cached_leden &= ~ledclr_mask;
-		status = twl4030_i2c_write_u8(module, cached_leden,
+		status = twl_i2c_write_u8(module, cached_leden,
 				TWL4030_LED_LEDEN);
 		if (status < 0)
 			goto done;
@@ -370,7 +370,7 @@ static int __devinit gpio_twl4030_pulls(u32 ups, u32 downs)
 		message[i] = bit_mask;
 	}
 
-	return twl4030_i2c_write(TWL4030_MODULE_GPIO, message,
+	return twl_i2c_write(TWL4030_MODULE_GPIO, message,
 				REG_GPIOPUPDCTR1, 5);
 }
 
@@ -387,7 +387,7 @@ static int __devinit gpio_twl4030_debounce(u32 debounce, u8 mmc_cd)
 	debounce >>= 8;
 	message[3] = (debounce & 0x03);
 
-	return twl4030_i2c_write(TWL4030_MODULE_GPIO, message,
+	return twl_i2c_write(TWL4030_MODULE_GPIO, message,
 				REG_GPIO_DEBEN1, 3);
 }
 
diff --git a/drivers/gpio/wm831x-gpio.c b/drivers/gpio/wm831x-gpio.c
index f9c09a54ec7f..b4468b616890 100644
--- a/drivers/gpio/wm831x-gpio.c
+++ b/drivers/gpio/wm831x-gpio.c
@@ -22,8 +22,7 @@
 #include <linux/mfd/wm831x/core.h>
 #include <linux/mfd/wm831x/pdata.h>
 #include <linux/mfd/wm831x/gpio.h>
-
-#define WM831X_GPIO_MAX 16
+#include <linux/mfd/wm831x/irq.h>
 
 struct wm831x_gpio {
 	struct wm831x *wm831x;
@@ -80,6 +79,17 @@ static void wm831x_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
 			value << offset);
 }
 
+static int wm831x_gpio_to_irq(struct gpio_chip *chip, unsigned offset)
+{
+	struct wm831x_gpio *wm831x_gpio = to_wm831x_gpio(chip);
+	struct wm831x *wm831x = wm831x_gpio->wm831x;
+
+	if (!wm831x->irq_base)
+		return -EINVAL;
+
+	return wm831x->irq_base + WM831X_IRQ_GPIO_1 + offset;
+}
+
 #ifdef CONFIG_DEBUG_FS
 static void wm831x_gpio_dbg_show(struct seq_file *s, struct gpio_chip *chip)
 {
@@ -175,6 +185,7 @@ static struct gpio_chip template_chip = {
 	.get			= wm831x_gpio_get,
 	.direction_output	= wm831x_gpio_direction_out,
 	.set			= wm831x_gpio_set,
+	.to_irq			= wm831x_gpio_to_irq,
 	.dbg_show		= wm831x_gpio_dbg_show,
 	.can_sleep		= 1,
 };
@@ -192,7 +203,7 @@ static int __devinit wm831x_gpio_probe(struct platform_device *pdev)
 
 	wm831x_gpio->wm831x = wm831x;
 	wm831x_gpio->gpio_chip = template_chip;
-	wm831x_gpio->gpio_chip.ngpio = WM831X_GPIO_MAX;
+	wm831x_gpio->gpio_chip.ngpio = wm831x->num_gpio;
 	wm831x_gpio->gpio_chip.dev = &pdev->dev;
 	if (pdata && pdata->gpio_base)
 		wm831x_gpio->gpio_chip.base = pdata->gpio_base;
diff --git a/drivers/gpu/drm/Makefile b/drivers/gpu/drm/Makefile
index 3c8827a7aabd..39c5aa75b8f1 100644
--- a/drivers/gpu/drm/Makefile
+++ b/drivers/gpu/drm/Makefile
@@ -15,7 +15,7 @@ drm-y       :=	drm_auth.o drm_bufs.o drm_cache.o \
 
 drm-$(CONFIG_COMPAT) += drm_ioc32.o
 
-drm_kms_helper-y := drm_fb_helper.o drm_crtc_helper.o
+drm_kms_helper-y := drm_fb_helper.o drm_crtc_helper.o drm_dp_i2c_helper.o
 
 obj-$(CONFIG_DRM_KMS_HELPER) += drm_kms_helper.o
 
@@ -30,4 +30,7 @@ obj-$(CONFIG_DRM_I830)	+= i830/
 obj-$(CONFIG_DRM_I915)  += i915/
 obj-$(CONFIG_DRM_SIS)   += sis/
 obj-$(CONFIG_DRM_SAVAGE)+= savage/
+obj-$(CONFIG_DRM_VMWGFX)+= vmwgfx/
 obj-$(CONFIG_DRM_VIA)	+=via/
+obj-$(CONFIG_DRM_NOUVEAU) +=nouveau/
+obj-y			+= i2c/
diff --git a/drivers/gpu/drm/ati_pcigart.c b/drivers/gpu/drm/ati_pcigart.c
index 628eae3e9b83..a1fce68e3bbe 100644
--- a/drivers/gpu/drm/ati_pcigart.c
+++ b/drivers/gpu/drm/ati_pcigart.c
@@ -39,8 +39,7 @@ static int drm_ati_alloc_pcigart_table(struct drm_device *dev,
 				       struct drm_ati_pcigart_info *gart_info)
 {
 	gart_info->table_handle = drm_pci_alloc(dev, gart_info->table_size,
-						PAGE_SIZE,
-						gart_info->table_mask);
+						PAGE_SIZE);
 	if (gart_info->table_handle == NULL)
 		return -ENOMEM;
 
@@ -112,6 +111,13 @@ int drm_ati_pcigart_init(struct drm_device *dev, struct drm_ati_pcigart_info *ga
 	if (gart_info->gart_table_location == DRM_ATI_GART_MAIN) {
 		DRM_DEBUG("PCI: no table in VRAM: using normal RAM\n");
 
+		if (pci_set_dma_mask(dev->pdev, gart_info->table_mask)) {
+			DRM_ERROR("fail to set dma mask to 0x%Lx\n",
+				  gart_info->table_mask);
+			ret = 1;
+			goto done;
+		}
+
 		ret = drm_ati_alloc_pcigart_table(dev, gart_info);
 		if (ret) {
 			DRM_ERROR("cannot allocate PCI GART page!\n");
diff --git a/drivers/gpu/drm/drm_bufs.c b/drivers/gpu/drm/drm_bufs.c
index 3d09e304f6f4..8417cc4c43f1 100644
--- a/drivers/gpu/drm/drm_bufs.c
+++ b/drivers/gpu/drm/drm_bufs.c
@@ -326,7 +326,7 @@ static int drm_addmap_core(struct drm_device * dev, resource_size_t offset,
 		 * As we're limiting the address to 2^32-1 (or less),
 		 * casting it down to 32 bits is no problem, but we
 		 * need to point to a 64bit variable first. */
-		dmah = drm_pci_alloc(dev, map->size, map->size, 0xffffffffUL);
+		dmah = drm_pci_alloc(dev, map->size, map->size);
 		if (!dmah) {
 			kfree(map);
 			return -ENOMEM;
@@ -885,7 +885,7 @@ int drm_addbufs_pci(struct drm_device * dev, struct drm_buf_desc * request)
 
 	while (entry->buf_count < count) {
 
-		dmah = drm_pci_alloc(dev, PAGE_SIZE << page_order, 0x1000, 0xfffffffful);
+		dmah = drm_pci_alloc(dev, PAGE_SIZE << page_order, 0x1000);
 
 		if (!dmah) {
 			/* Set count correctly so we free the proper amount. */
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index 5cae0b3eee9b..d91fb8c0b7b3 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -125,6 +125,15 @@ static struct drm_prop_enum_list drm_tv_subconnector_enum_list[] =
 DRM_ENUM_NAME_FN(drm_get_tv_subconnector_name,
 		 drm_tv_subconnector_enum_list)
 
+static struct drm_prop_enum_list drm_dirty_info_enum_list[] = {
+	{ DRM_MODE_DIRTY_OFF,      "Off"      },
+	{ DRM_MODE_DIRTY_ON,       "On"       },
+	{ DRM_MODE_DIRTY_ANNOTATE, "Annotate" },
+};
+
+DRM_ENUM_NAME_FN(drm_get_dirty_info_name,
+		 drm_dirty_info_enum_list)
+
 struct drm_conn_prop_enum_list {
 	int type;
 	char *name;
@@ -149,6 +158,7 @@ static struct drm_conn_prop_enum_list drm_connector_enum_list[] =
 	{ DRM_MODE_CONNECTOR_HDMIA, "HDMI Type A", 0 },
 	{ DRM_MODE_CONNECTOR_HDMIB, "HDMI Type B", 0 },
 	{ DRM_MODE_CONNECTOR_TV, "TV", 0 },
+	{ DRM_MODE_CONNECTOR_eDP, "Embedded DisplayPort", 0 },
 };
 
 static struct drm_prop_enum_list drm_encoder_enum_list[] =
@@ -247,7 +257,8 @@ static void drm_mode_object_put(struct drm_device *dev,
 	mutex_unlock(&dev->mode_config.idr_mutex);
 }
 
-void *drm_mode_object_find(struct drm_device *dev, uint32_t id, uint32_t type)
+struct drm_mode_object *drm_mode_object_find(struct drm_device *dev,
+		uint32_t id, uint32_t type)
 {
 	struct drm_mode_object *obj = NULL;
 
@@ -272,7 +283,7 @@ EXPORT_SYMBOL(drm_mode_object_find);
  * functions & device file and adds it to the master fd list.
  *
  * RETURNS:
- * Zero on success, error code on falure.
+ * Zero on success, error code on failure.
  */
 int drm_framebuffer_init(struct drm_device *dev, struct drm_framebuffer *fb,
 			 const struct drm_framebuffer_funcs *funcs)
@@ -802,6 +813,36 @@ int drm_mode_create_dithering_property(struct drm_device *dev)
 EXPORT_SYMBOL(drm_mode_create_dithering_property);
 
 /**
+ * drm_mode_create_dirty_property - create dirty property
+ * @dev: DRM device
+ *
+ * Called by a driver the first time it's needed, must be attached to desired
+ * connectors.
+ */
+int drm_mode_create_dirty_info_property(struct drm_device *dev)
+{
+	struct drm_property *dirty_info;
+	int i;
+
+	if (dev->mode_config.dirty_info_property)
+		return 0;
+
+	dirty_info =
+		drm_property_create(dev, DRM_MODE_PROP_ENUM |
+				    DRM_MODE_PROP_IMMUTABLE,
+				    "dirty",
+				    ARRAY_SIZE(drm_dirty_info_enum_list));
+	for (i = 0; i < ARRAY_SIZE(drm_dirty_info_enum_list); i++)
+		drm_property_add_enum(dirty_info, i,
+				      drm_dirty_info_enum_list[i].type,
+				      drm_dirty_info_enum_list[i].name);
+	dev->mode_config.dirty_info_property = dirty_info;
+
+	return 0;
+}
+EXPORT_SYMBOL(drm_mode_create_dirty_info_property);
+
+/**
  * drm_mode_config_init - initialize DRM mode_configuration structure
  * @dev: DRM device
  *
@@ -1753,6 +1794,71 @@ out:
 	return ret;
 }
 
+int drm_mode_dirtyfb_ioctl(struct drm_device *dev,
+			   void *data, struct drm_file *file_priv)
+{
+	struct drm_clip_rect __user *clips_ptr;
+	struct drm_clip_rect *clips = NULL;
+	struct drm_mode_fb_dirty_cmd *r = data;
+	struct drm_mode_object *obj;
+	struct drm_framebuffer *fb;
+	unsigned flags;
+	int num_clips;
+	int ret = 0;
+
+	mutex_lock(&dev->mode_config.mutex);
+	obj = drm_mode_object_find(dev, r->fb_id, DRM_MODE_OBJECT_FB);
+	if (!obj) {
+		DRM_ERROR("invalid framebuffer id\n");
+		ret = -EINVAL;
+		goto out_err1;
+	}
+	fb = obj_to_fb(obj);
+
+	num_clips = r->num_clips;
+	clips_ptr = (struct drm_clip_rect *)(unsigned long)r->clips_ptr;
+
+	if (!num_clips != !clips_ptr) {
+		ret = -EINVAL;
+		goto out_err1;
+	}
+
+	flags = DRM_MODE_FB_DIRTY_FLAGS & r->flags;
+
+	/* If userspace annotates copy, clips must come in pairs */
+	if (flags & DRM_MODE_FB_DIRTY_ANNOTATE_COPY && (num_clips % 2)) {
+		ret = -EINVAL;
+		goto out_err1;
+	}
+
+	if (num_clips && clips_ptr) {
+		clips = kzalloc(num_clips * sizeof(*clips), GFP_KERNEL);
+		if (!clips) {
+			ret = -ENOMEM;
+			goto out_err1;
+		}
+
+		ret = copy_from_user(clips, clips_ptr,
+				     num_clips * sizeof(*clips));
+		if (ret)
+			goto out_err2;
+	}
+
+	if (fb->funcs->dirty) {
+		ret = fb->funcs->dirty(fb, flags, r->color, clips, num_clips);
+	} else {
+		ret = -ENOSYS;
+		goto out_err2;
+	}
+
+out_err2:
+	kfree(clips);
+out_err1:
+	mutex_unlock(&dev->mode_config.mutex);
+	return ret;
+}
+
+
 /**
  * drm_fb_release - remove and free the FBs on this file
  * @filp: file * from the ioctl
@@ -2328,7 +2434,7 @@ int drm_mode_connector_property_set_ioctl(struct drm_device *dev,
 	} else if (connector->funcs->set_property)
 		ret = connector->funcs->set_property(connector, property, out_resp->value);
 
-	/* store the property value if succesful */
+	/* store the property value if successful */
 	if (!ret)
 		drm_connector_property_set_value(connector, property, out_resp->value);
 out:
@@ -2478,3 +2584,72 @@ out:
 	mutex_unlock(&dev->mode_config.mutex);
 	return ret;
 }
+
+int drm_mode_page_flip_ioctl(struct drm_device *dev,
+			     void *data, struct drm_file *file_priv)
+{
+	struct drm_mode_crtc_page_flip *page_flip = data;
+	struct drm_mode_object *obj;
+	struct drm_crtc *crtc;
+	struct drm_framebuffer *fb;
+	struct drm_pending_vblank_event *e = NULL;
+	unsigned long flags;
+	int ret = -EINVAL;
+
+	if (page_flip->flags & ~DRM_MODE_PAGE_FLIP_FLAGS ||
+	    page_flip->reserved != 0)
+		return -EINVAL;
+
+	mutex_lock(&dev->mode_config.mutex);
+	obj = drm_mode_object_find(dev, page_flip->crtc_id, DRM_MODE_OBJECT_CRTC);
+	if (!obj)
+		goto out;
+	crtc = obj_to_crtc(obj);
+
+	if (crtc->funcs->page_flip == NULL)
+		goto out;
+
+	obj = drm_mode_object_find(dev, page_flip->fb_id, DRM_MODE_OBJECT_FB);
+	if (!obj)
+		goto out;
+	fb = obj_to_fb(obj);
+
+	if (page_flip->flags & DRM_MODE_PAGE_FLIP_EVENT) {
+		ret = -ENOMEM;
+		spin_lock_irqsave(&dev->event_lock, flags);
+		if (file_priv->event_space < sizeof e->event) {
+			spin_unlock_irqrestore(&dev->event_lock, flags);
+			goto out;
+		}
+		file_priv->event_space -= sizeof e->event;
+		spin_unlock_irqrestore(&dev->event_lock, flags);
+
+		e = kzalloc(sizeof *e, GFP_KERNEL);
+		if (e == NULL) {
+			spin_lock_irqsave(&dev->event_lock, flags);
+			file_priv->event_space += sizeof e->event;
+			spin_unlock_irqrestore(&dev->event_lock, flags);
+			goto out;
+		}
+
+		e->event.base.type = DRM_EVENT_FLIP_COMPLETE;
+		e->event.base.length = sizeof e->event;
+		e->event.user_data = page_flip->user_data;
+		e->base.event = &e->event.base;
+		e->base.file_priv = file_priv;
+		e->base.destroy =
+			(void (*) (struct drm_pending_event *)) kfree;
+	}
+
+	ret = crtc->funcs->page_flip(crtc, fb, e);
+	if (ret) {
+		spin_lock_irqsave(&dev->event_lock, flags);
+		file_priv->event_space += sizeof e->event;
+		spin_unlock_irqrestore(&dev->event_lock, flags);
+		kfree(e);
+	}
+
+out:
+	mutex_unlock(&dev->mode_config.mutex);
+	return ret;
+}
diff --git a/drivers/gpu/drm/drm_crtc_helper.c b/drivers/gpu/drm/drm_crtc_helper.c
index bbfd110a7168..7d0f00a935fa 100644
--- a/drivers/gpu/drm/drm_crtc_helper.c
+++ b/drivers/gpu/drm/drm_crtc_helper.c
@@ -109,7 +109,7 @@ int drm_helper_probe_single_connector_modes(struct drm_connector *connector,
 
 	count = (*connector_funcs->get_modes)(connector);
 	if (!count) {
-		count = drm_add_modes_noedid(connector, 800, 600);
+		count = drm_add_modes_noedid(connector, 1024, 768);
 		if (!count)
 			return 0;
 	}
@@ -216,7 +216,7 @@ bool drm_helper_crtc_in_use(struct drm_crtc *crtc)
 EXPORT_SYMBOL(drm_helper_crtc_in_use);
 
 /**
- * drm_disable_unused_functions - disable unused objects
+ * drm_helper_disable_unused_functions - disable unused objects
  * @dev: DRM device
  *
  * LOCKING:
@@ -702,7 +702,7 @@ bool drm_crtc_helper_set_mode(struct drm_crtc *crtc,
 		if (encoder->crtc != crtc)
 			continue;
 
-		DRM_INFO("%s: set mode %s %x\n", drm_get_encoder_name(encoder),
+		DRM_DEBUG("%s: set mode %s %x\n", drm_get_encoder_name(encoder),
 			 mode->name, mode->base.id);
 		encoder_funcs = encoder->helper_private;
 		encoder_funcs->mode_set(encoder, mode, adjusted_mode);
@@ -1020,6 +1020,9 @@ bool drm_helper_initial_config(struct drm_device *dev)
 {
 	int count = 0;
 
+	/* disable all the possible outputs/crtcs before entering KMS mode */
+	drm_helper_disable_unused_functions(dev);
+
 	drm_fb_helper_parse_command_line(dev);
 
 	count = drm_helper_probe_connector_modes(dev,
@@ -1029,7 +1032,8 @@ bool drm_helper_initial_config(struct drm_device *dev)
 	/*
 	 * we shouldn't end up with no modes here.
 	 */
-	WARN(!count, "No connectors reported connected with modes\n");
+	if (count == 0)
+		printk(KERN_INFO "No connectors reported connected with modes\n");
 
 	drm_setup_crtcs(dev);
 
@@ -1159,6 +1163,9 @@ EXPORT_SYMBOL(drm_helper_mode_fill_fb_struct);
 int drm_helper_resume_force_mode(struct drm_device *dev)
 {
 	struct drm_crtc *crtc;
+	struct drm_encoder *encoder;
+	struct drm_encoder_helper_funcs *encoder_funcs;
+	struct drm_crtc_helper_funcs *crtc_funcs;
 	int ret;
 
 	list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
@@ -1171,6 +1178,25 @@ int drm_helper_resume_force_mode(struct drm_device *dev)
 
 		if (ret == false)
 			DRM_ERROR("failed to set mode on crtc %p\n", crtc);
+
+		/* Turn off outputs that were already powered off */
+		if (drm_helper_choose_crtc_dpms(crtc)) {
+			list_for_each_entry(encoder, &dev->mode_config.encoder_list, head) {
+
+				if(encoder->crtc != crtc)
+					continue;
+
+				encoder_funcs = encoder->helper_private;
+				if (encoder_funcs->dpms)
+					(*encoder_funcs->dpms) (encoder,
+								drm_helper_choose_encoder_dpms(encoder));
+
+				crtc_funcs = crtc->helper_private;
+				if (crtc_funcs->dpms)
+					(*crtc_funcs->dpms) (crtc,
+							     drm_helper_choose_crtc_dpms(crtc));
+			}
+		}
 	}
 	/* disable the unused connectors while restoring the modesetting */
 	drm_helper_disable_unused_functions(dev);
diff --git a/drivers/gpu/drm/i915/intel_dp_i2c.c b/drivers/gpu/drm/drm_dp_i2c_helper.c
index a63b6f57d2d4..548887c8506f 100644
--- a/drivers/gpu/drm/i915/intel_dp_i2c.c
+++ b/drivers/gpu/drm/drm_dp_i2c_helper.c
@@ -28,84 +28,20 @@
 #include <linux/errno.h>
 #include <linux/sched.h>
 #include <linux/i2c.h>
-#include "intel_dp.h"
+#include "drm_dp_helper.h"
 #include "drmP.h"
 
 /* Run a single AUX_CH I2C transaction, writing/reading data as necessary */
-
-#define MODE_I2C_START	1
-#define MODE_I2C_WRITE	2
-#define MODE_I2C_READ	4
-#define MODE_I2C_STOP	8
-
 static int
 i2c_algo_dp_aux_transaction(struct i2c_adapter *adapter, int mode,
 			    uint8_t write_byte, uint8_t *read_byte)
 {
 	struct i2c_algo_dp_aux_data *algo_data = adapter->algo_data;
-	uint16_t address = algo_data->address;
-	uint8_t msg[5];
-	uint8_t reply[2];
-	int msg_bytes;
-	int reply_bytes;
 	int ret;
-
-	/* Set up the command byte */
-	if (mode & MODE_I2C_READ)
-		msg[0] = AUX_I2C_READ << 4;
-	else
-		msg[0] = AUX_I2C_WRITE << 4;
-
-	if (!(mode & MODE_I2C_STOP))
-		msg[0] |= AUX_I2C_MOT << 4;
-
-	msg[1] = address >> 8;
-	msg[2] = address;
-
-	switch (mode) {
-	case MODE_I2C_WRITE:
-		msg[3] = 0;
-		msg[4] = write_byte;
-		msg_bytes = 5;
-		reply_bytes = 1;
-		break;
-	case MODE_I2C_READ:
-		msg[3] = 0;
-		msg_bytes = 4;
-		reply_bytes = 2;
-		break;
-	default:
-		msg_bytes = 3;
-		reply_bytes = 1;
-		break;
-	}
-
-	for (;;) {
-		ret = (*algo_data->aux_ch)(adapter,
-					   msg, msg_bytes,
-					   reply, reply_bytes);
-		if (ret < 0) {
-			DRM_DEBUG("aux_ch failed %d\n", ret);
-			return ret;
-		}
-		switch (reply[0] & AUX_I2C_REPLY_MASK) {
-		case AUX_I2C_REPLY_ACK:
-			if (mode == MODE_I2C_READ) {
-				*read_byte = reply[1];
-			}
-			return reply_bytes - 1;
-		case AUX_I2C_REPLY_NACK:
-			DRM_DEBUG("aux_ch nack\n");
-			return -EREMOTEIO;
-		case AUX_I2C_REPLY_DEFER:
-			DRM_DEBUG("aux_ch defer\n");
-			udelay(100);
-			break;
-		default:
-			DRM_ERROR("aux_ch invalid reply 0x%02x\n", reply[0]);
-			return -EREMOTEIO;
-		}
-	}
+	
+	ret = (*algo_data->aux_ch)(adapter, mode,
+				   write_byte, read_byte);
+	return ret;
 }
 
 /*
@@ -224,7 +160,7 @@ i2c_algo_dp_aux_xfer(struct i2c_adapter *adapter,
 	if (ret >= 0)
 		ret = num;
 	i2c_algo_dp_aux_stop(adapter, reading);
-	DRM_DEBUG("dp_aux_xfer return %d\n", ret);
+	DRM_DEBUG_KMS("dp_aux_xfer return %d\n", ret);
 	return ret;
 }
 
diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index a75ca63deea6..766c46875a20 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -145,6 +145,8 @@ static struct drm_ioctl_desc drm_ioctls[] = {
 	DRM_IOCTL_DEF(DRM_IOCTL_MODE_GETFB, drm_mode_getfb, DRM_MASTER|DRM_CONTROL_ALLOW),
 	DRM_IOCTL_DEF(DRM_IOCTL_MODE_ADDFB, drm_mode_addfb, DRM_MASTER|DRM_CONTROL_ALLOW),
 	DRM_IOCTL_DEF(DRM_IOCTL_MODE_RMFB, drm_mode_rmfb, DRM_MASTER|DRM_CONTROL_ALLOW),
+	DRM_IOCTL_DEF(DRM_IOCTL_MODE_PAGE_FLIP, drm_mode_page_flip_ioctl, DRM_MASTER|DRM_CONTROL_ALLOW),
+	DRM_IOCTL_DEF(DRM_IOCTL_MODE_DIRTYFB, drm_mode_dirtyfb_ioctl, DRM_MASTER|DRM_CONTROL_ALLOW)
 };
 
 #define DRM_CORE_IOCTL_COUNT	ARRAY_SIZE( drm_ioctls )
@@ -366,6 +368,29 @@ module_init(drm_core_init);
 module_exit(drm_core_exit);
 
 /**
+ * Copy and IOCTL return string to user space
+ */
+static int drm_copy_field(char *buf, size_t *buf_len, const char *value)
+{
+	int len;
+
+	/* don't overflow userbuf */
+	len = strlen(value);
+	if (len > *buf_len)
+		len = *buf_len;
+
+	/* let userspace know exact length of driver value (which could be
+	 * larger than the userspace-supplied buffer) */
+	*buf_len = strlen(value);
+
+	/* finally, try filling in the userbuf */
+	if (len && buf)
+		if (copy_to_user(buf, value, len))
+			return -EFAULT;
+	return 0;
+}
+
+/**
  * Get version information
  *
  * \param inode device inode.
@@ -380,16 +405,21 @@ static int drm_version(struct drm_device *dev, void *data,
 		       struct drm_file *file_priv)
 {
 	struct drm_version *version = data;
-	int len;
+	int err;
 
 	version->version_major = dev->driver->major;
 	version->version_minor = dev->driver->minor;
 	version->version_patchlevel = dev->driver->patchlevel;
-	DRM_COPY(version->name, dev->driver->name);
-	DRM_COPY(version->date, dev->driver->date);
-	DRM_COPY(version->desc, dev->driver->desc);
-
-	return 0;
+	err = drm_copy_field(version->name, &version->name_len,
+			dev->driver->name);
+	if (!err)
+		err = drm_copy_field(version->date, &version->date_len,
+				dev->driver->date);
+	if (!err)
+		err = drm_copy_field(version->desc, &version->desc_len,
+				dev->driver->desc);
+
+	return err;
 }
 
 /**
@@ -404,11 +434,11 @@ static int drm_version(struct drm_device *dev, void *data,
  * Looks up the ioctl function in the ::ioctls table, checking for root
  * previleges if so required, and dispatches to the respective function.
  */
-int drm_ioctl(struct inode *inode, struct file *filp,
+long drm_ioctl(struct file *filp,
 	      unsigned int cmd, unsigned long arg)
 {
 	struct drm_file *file_priv = filp->private_data;
-	struct drm_device *dev = file_priv->minor->dev;
+	struct drm_device *dev;
 	struct drm_ioctl_desc *ioctl;
 	drm_ioctl_t *func;
 	unsigned int nr = DRM_IOCTL_NR(cmd);
@@ -416,6 +446,7 @@ int drm_ioctl(struct inode *inode, struct file *filp,
 	char stack_kdata[128];
 	char *kdata = NULL;
 
+	dev = file_priv->minor->dev;
 	atomic_inc(&dev->ioctl_count);
 	atomic_inc(&dev->counts[_DRM_STAT_IOCTLS]);
 	++file_priv->ioctl_count;
@@ -471,7 +502,13 @@ int drm_ioctl(struct inode *inode, struct file *filp,
 				goto err_i1;
 			}
 		}
-		retcode = func(dev, kdata, file_priv);
+		if (ioctl->flags & DRM_UNLOCKED)
+			retcode = func(dev, kdata, file_priv);
+		else {
+			lock_kernel();
+			retcode = func(dev, kdata, file_priv);
+			unlock_kernel();
+		}
 
 		if (cmd & IOC_OUT) {
 			if (copy_to_user((void __user *)arg, kdata,
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index b54ba63d506e..defcaf108460 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -123,18 +123,20 @@ static const u8 edid_header[] = {
  */
 static bool edid_is_valid(struct edid *edid)
 {
-	int i;
+	int i, score = 0;
 	u8 csum = 0;
 	u8 *raw_edid = (u8 *)edid;
 
-	if (memcmp(edid->header, edid_header, sizeof(edid_header)))
-		goto bad;
-	if (edid->version != 1) {
-		DRM_ERROR("EDID has major version %d, instead of 1\n", edid->version);
+	for (i = 0; i < sizeof(edid_header); i++)
+		if (raw_edid[i] == edid_header[i])
+			score++;
+
+	if (score == 8) ;
+	else if (score >= 6) {
+		DRM_DEBUG("Fixing EDID header, your hardware may be failing\n");
+		memcpy(raw_edid, edid_header, sizeof(edid_header));
+	} else
 		goto bad;
-	}
-	if (edid->revision > 4)
-		DRM_DEBUG("EDID minor > 4, assuming backward compatibility\n");
 
 	for (i = 0; i < EDID_LENGTH; i++)
 		csum += raw_edid[i];
@@ -143,6 +145,14 @@ static bool edid_is_valid(struct edid *edid)
 		goto bad;
 	}
 
+	if (edid->version != 1) {
+		DRM_ERROR("EDID has major version %d, instead of 1\n", edid->version);
+		goto bad;
+	}
+
+	if (edid->revision > 4)
+		DRM_DEBUG("EDID minor > 4, assuming backward compatibility\n");
+
 	return 1;
 
 bad:
@@ -481,16 +491,17 @@ static struct drm_display_mode drm_dmt_modes[] = {
 		   3048, 3536, 0, 1600, 1603, 1609, 1682, 0,
 		   DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_PVSYNC) },
 };
+static const int drm_num_dmt_modes =
+	sizeof(drm_dmt_modes) / sizeof(struct drm_display_mode);
 
 static struct drm_display_mode *drm_find_dmt(struct drm_device *dev,
 			int hsize, int vsize, int fresh)
 {
-	int i, count;
+	int i;
 	struct drm_display_mode *ptr, *mode;
 
-	count = sizeof(drm_dmt_modes) / sizeof(struct drm_display_mode);
 	mode = NULL;
-	for (i = 0; i < count; i++) {
+	for (i = 0; i < drm_num_dmt_modes; i++) {
 		ptr = &drm_dmt_modes[i];
 		if (hsize == ptr->hdisplay &&
 			vsize == ptr->vdisplay &&
@@ -834,8 +845,169 @@ static int add_standard_modes(struct drm_connector *connector, struct edid *edid
 	return modes;
 }
 
+/*
+ * XXX fix this for:
+ * - GTF secondary curve formula
+ * - EDID 1.4 range offsets
+ * - CVT extended bits
+ */
+static bool
+mode_in_range(struct drm_display_mode *mode, struct detailed_timing *timing)
+{
+	struct detailed_data_monitor_range *range;
+	int hsync, vrefresh;
+
+	range = &timing->data.other_data.data.range;
+
+	hsync = drm_mode_hsync(mode);
+	vrefresh = drm_mode_vrefresh(mode);
+
+	if (hsync < range->min_hfreq_khz || hsync > range->max_hfreq_khz)
+		return false;
+
+	if (vrefresh < range->min_vfreq || vrefresh > range->max_vfreq)
+		return false;
+
+	if (range->pixel_clock_mhz && range->pixel_clock_mhz != 0xff) {
+		/* be forgiving since it's in units of 10MHz */
+		int max_clock = range->pixel_clock_mhz * 10 + 9;
+		max_clock *= 1000;
+		if (mode->clock > max_clock)
+			return false;
+	}
+
+	return true;
+}
+
+/*
+ * XXX If drm_dmt_modes ever regrows the CVT-R modes (and it will) this will
+ * need to account for them.
+ */
+static int drm_gtf_modes_for_range(struct drm_connector *connector,
+				   struct detailed_timing *timing)
+{
+	int i, modes = 0;
+	struct drm_display_mode *newmode;
+	struct drm_device *dev = connector->dev;
+
+	for (i = 0; i < drm_num_dmt_modes; i++) {
+		if (mode_in_range(drm_dmt_modes + i, timing)) {
+			newmode = drm_mode_duplicate(dev, &drm_dmt_modes[i]);
+			if (newmode) {
+				drm_mode_probed_add(connector, newmode);
+				modes++;
+			}
+		}
+	}
+
+	return modes;
+}
+
+static int drm_cvt_modes(struct drm_connector *connector,
+			 struct detailed_timing *timing)
+{
+	int i, j, modes = 0;
+	struct drm_display_mode *newmode;
+	struct drm_device *dev = connector->dev;
+	struct cvt_timing *cvt;
+	const int rates[] = { 60, 85, 75, 60, 50 };
+	const u8 empty[3] = { 0, 0, 0 };
+
+	for (i = 0; i < 4; i++) {
+		int uninitialized_var(width), height;
+		cvt = &(timing->data.other_data.data.cvt[i]);
+
+		if (!memcmp(cvt->code, empty, 3))
+			continue;
+
+		height = (cvt->code[0] + ((cvt->code[1] & 0xf0) << 4) + 1) * 2;
+		switch (cvt->code[1] & 0x0c) {
+		case 0x00:
+			width = height * 4 / 3;
+			break;
+		case 0x04:
+			width = height * 16 / 9;
+			break;
+		case 0x08:
+			width = height * 16 / 10;
+			break;
+		case 0x0c:
+			width = height * 15 / 9;
+			break;
+		}
+
+		for (j = 1; j < 5; j++) {
+			if (cvt->code[2] & (1 << j)) {
+				newmode = drm_cvt_mode(dev, width, height,
+						       rates[j], j == 0,
+						       false, false);
+				if (newmode) {
+					drm_mode_probed_add(connector, newmode);
+					modes++;
+				}
+			}
+		}
+	}
+
+	return modes;
+}
+
+static int add_detailed_modes(struct drm_connector *connector,
+			      struct detailed_timing *timing,
+			      struct edid *edid, u32 quirks, int preferred)
+{
+	int i, modes = 0;
+	struct detailed_non_pixel *data = &timing->data.other_data;
+	int timing_level = standard_timing_level(edid);
+	int gtf = (edid->features & DRM_EDID_FEATURE_DEFAULT_GTF);
+	struct drm_display_mode *newmode;
+	struct drm_device *dev = connector->dev;
+
+	if (timing->pixel_clock) {
+		newmode = drm_mode_detailed(dev, edid, timing, quirks);
+		if (!newmode)
+			return 0;
+
+		if (preferred)
+			newmode->type |= DRM_MODE_TYPE_PREFERRED;
+
+		drm_mode_probed_add(connector, newmode);
+		return 1;
+	}
+
+	/* other timing types */
+	switch (data->type) {
+	case EDID_DETAIL_MONITOR_RANGE:
+		if (gtf)
+			modes += drm_gtf_modes_for_range(connector, timing);
+		break;
+	case EDID_DETAIL_STD_MODES:
+		/* Six modes per detailed section */
+		for (i = 0; i < 6; i++) {
+			struct std_timing *std;
+			struct drm_display_mode *newmode;
+
+			std = &data->data.timings[i];
+			newmode = drm_mode_std(dev, std, edid->revision,
+					       timing_level);
+			if (newmode) {
+				drm_mode_probed_add(connector, newmode);
+				modes++;
+			}
+		}
+		break;
+	case EDID_DETAIL_CVT_3BYTE:
+		modes += drm_cvt_modes(connector, timing);
+		break;
+	default:
+		break;
+	}
+
+	return modes;
+}
+
 /**
- * add_detailed_modes - get detailed mode info from EDID data
+ * add_detailed_info - get detailed mode info from EDID data
  * @connector: attached connector
  * @edid: EDID block to scan
  * @quirks: quirks to apply
@@ -846,67 +1018,24 @@ static int add_standard_modes(struct drm_connector *connector, struct edid *edid
 static int add_detailed_info(struct drm_connector *connector,
 			     struct edid *edid, u32 quirks)
 {
-	struct drm_device *dev = connector->dev;
-	int i, j, modes = 0;
-	int timing_level;
-
-	timing_level = standard_timing_level(edid);
+	int i, modes = 0;
 
 	for (i = 0; i < EDID_DETAILED_TIMINGS; i++) {
 		struct detailed_timing *timing = &edid->detailed_timings[i];
-		struct detailed_non_pixel *data = &timing->data.other_data;
-		struct drm_display_mode *newmode;
+		int preferred = (i == 0) && (edid->features & DRM_EDID_FEATURE_PREFERRED_TIMING);
 
-		/* X server check is version 1.1 or higher */
-		if (edid->version == 1 && edid->revision >= 1 &&
-		    !timing->pixel_clock) {
-			/* Other timing or info */
-			switch (data->type) {
-			case EDID_DETAIL_MONITOR_SERIAL:
-				break;
-			case EDID_DETAIL_MONITOR_STRING:
-				break;
-			case EDID_DETAIL_MONITOR_RANGE:
-				/* Get monitor range data */
-				break;
-			case EDID_DETAIL_MONITOR_NAME:
-				break;
-			case EDID_DETAIL_MONITOR_CPDATA:
-				break;
-			case EDID_DETAIL_STD_MODES:
-				for (j = 0; j < 6; i++) {
-					struct std_timing *std;
-					struct drm_display_mode *newmode;
-
-					std = &data->data.timings[j];
-					newmode = drm_mode_std(dev, std,
-							       edid->revision,
-							       timing_level);
-					if (newmode) {
-						drm_mode_probed_add(connector, newmode);
-						modes++;
-					}
-				}
-				break;
-			default:
-				break;
-			}
-		} else {
-			newmode = drm_mode_detailed(dev, edid, timing, quirks);
-			if (!newmode)
-				continue;
-
-			/* First detailed mode is preferred */
-			if (i == 0 && (edid->features & DRM_EDID_FEATURE_PREFERRED_TIMING))
-				newmode->type |= DRM_MODE_TYPE_PREFERRED;
-			drm_mode_probed_add(connector, newmode);
+		/* In 1.0, only timings are allowed */
+		if (!timing->pixel_clock && edid->version == 1 &&
+			edid->revision == 0)
+			continue;
 
-			modes++;
-		}
+		modes += add_detailed_modes(connector, timing, edid, quirks,
+					    preferred);
 	}
 
 	return modes;
 }
+
 /**
  * add_detailed_mode_eedid - get detailed mode info from addtional timing
  * 			EDID block
@@ -920,12 +1049,9 @@ static int add_detailed_info(struct drm_connector *connector,
 static int add_detailed_info_eedid(struct drm_connector *connector,
 			     struct edid *edid, u32 quirks)
 {
-	struct drm_device *dev = connector->dev;
-	int i, j, modes = 0;
+	int i, modes = 0;
 	char *edid_ext = NULL;
 	struct detailed_timing *timing;
-	struct detailed_non_pixel *data;
-	struct drm_display_mode *newmode;
 	int edid_ext_num;
 	int start_offset, end_offset;
 	int timing_level;
@@ -976,51 +1102,7 @@ static int add_detailed_info_eedid(struct drm_connector *connector,
 	for (i = start_offset; i < end_offset;
 			i += sizeof(struct detailed_timing)) {
 		timing = (struct detailed_timing *)(edid_ext + i);
-		data = &timing->data.other_data;
-		/* Detailed mode timing */
-		if (timing->pixel_clock) {
-			newmode = drm_mode_detailed(dev, edid, timing, quirks);
-			if (!newmode)
-				continue;
-
-			drm_mode_probed_add(connector, newmode);
-
-			modes++;
-			continue;
-		}
-
-		/* Other timing or info */
-		switch (data->type) {
-		case EDID_DETAIL_MONITOR_SERIAL:
-			break;
-		case EDID_DETAIL_MONITOR_STRING:
-			break;
-		case EDID_DETAIL_MONITOR_RANGE:
-			/* Get monitor range data */
-			break;
-		case EDID_DETAIL_MONITOR_NAME:
-			break;
-		case EDID_DETAIL_MONITOR_CPDATA:
-			break;
-		case EDID_DETAIL_STD_MODES:
-			/* Five modes per detailed section */
-			for (j = 0; j < 5; i++) {
-				struct std_timing *std;
-				struct drm_display_mode *newmode;
-
-				std = &data->data.timings[j];
-				newmode = drm_mode_std(dev, std,
-						       edid->revision,
-						       timing_level);
-				if (newmode) {
-					drm_mode_probed_add(connector, newmode);
-					modes++;
-				}
-			}
-			break;
-		default:
-			break;
-		}
+		modes += add_detailed_modes(connector, timing, edid, quirks, 0);
 	}
 
 	return modes;
@@ -1066,19 +1148,19 @@ static int drm_ddc_read_edid(struct drm_connector *connector,
 			     struct i2c_adapter *adapter,
 			     char *buf, int len)
 {
-	int ret;
+	int i;
 
-	ret = drm_do_probe_ddc_edid(adapter, buf, len);
-	if (ret != 0) {
-		goto end;
-	}
-	if (!edid_is_valid((struct edid *)buf)) {
-		dev_warn(&connector->dev->pdev->dev, "%s: EDID invalid.\n",
-			 drm_get_connector_name(connector));
-		ret = -1;
+	for (i = 0; i < 4; i++) {
+		if (drm_do_probe_ddc_edid(adapter, buf, len))
+			return -1;
+		if (edid_is_valid((struct edid *)buf))
+			return 0;
 	}
-end:
-	return ret;
+
+	/* repeated checksum failures; warn, but carry on */
+	dev_warn(&connector->dev->pdev->dev, "%s: EDID invalid.\n",
+		 drm_get_connector_name(connector));
+	return -1;
 }
 
 /**
@@ -1296,6 +1378,8 @@ int drm_add_modes_noedid(struct drm_connector *connector,
 					ptr->vdisplay > vdisplay)
 				continue;
 		}
+		if (drm_mode_vrefresh(ptr) > 61)
+			continue;
 		mode = drm_mode_duplicate(dev, ptr);
 		if (mode) {
 			drm_mode_probed_add(connector, mode);
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index 65ef011fa8ba..1c2b7d44ec05 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -156,7 +156,7 @@ static bool drm_fb_helper_connector_parse_command_line(struct drm_connector *con
 			force = DRM_FORCE_ON;
 			break;
 		case 'D':
-			if ((connector->connector_type != DRM_MODE_CONNECTOR_DVII) ||
+			if ((connector->connector_type != DRM_MODE_CONNECTOR_DVII) &&
 			    (connector->connector_type != DRM_MODE_CONNECTOR_HDMIB))
 				force = DRM_FORCE_ON;
 			else
@@ -373,11 +373,9 @@ static void drm_fb_helper_off(struct fb_info *info, int dpms_mode)
 					mutex_unlock(&dev->mode_config.mutex);
 				}
 			}
-			if (dpms_mode == DRM_MODE_DPMS_OFF) {
-				mutex_lock(&dev->mode_config.mutex);
-				crtc_funcs->dpms(crtc, dpms_mode);
-				mutex_unlock(&dev->mode_config.mutex);
-			}
+			mutex_lock(&dev->mode_config.mutex);
+			crtc_funcs->dpms(crtc, DRM_MODE_DPMS_OFF);
+			mutex_unlock(&dev->mode_config.mutex);
 		}
 	}
 }
@@ -385,18 +383,23 @@ static void drm_fb_helper_off(struct fb_info *info, int dpms_mode)
 int drm_fb_helper_blank(int blank, struct fb_info *info)
 {
 	switch (blank) {
+	/* Display: On; HSync: On, VSync: On */
 	case FB_BLANK_UNBLANK:
 		drm_fb_helper_on(info);
 		break;
+	/* Display: Off; HSync: On, VSync: On */
 	case FB_BLANK_NORMAL:
-		drm_fb_helper_off(info, DRM_MODE_DPMS_STANDBY);
+		drm_fb_helper_off(info, DRM_MODE_DPMS_ON);
 		break;
+	/* Display: Off; HSync: Off, VSync: On */
 	case FB_BLANK_HSYNC_SUSPEND:
 		drm_fb_helper_off(info, DRM_MODE_DPMS_STANDBY);
 		break;
+	/* Display: Off; HSync: On, VSync: Off */
 	case FB_BLANK_VSYNC_SUSPEND:
 		drm_fb_helper_off(info, DRM_MODE_DPMS_SUSPEND);
 		break;
+	/* Display: Off; HSync: Off, VSync: Off */
 	case FB_BLANK_POWERDOWN:
 		drm_fb_helper_off(info, DRM_MODE_DPMS_OFF);
 		break;
@@ -603,11 +606,10 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var,
 		return -EINVAL;
 
 	/* Need to resize the fb object !!! */
-	if (var->xres > fb->width || var->yres > fb->height) {
-		DRM_ERROR("Requested width/height is greater than current fb "
-			   "object %dx%d > %dx%d\n", var->xres, var->yres,
-			   fb->width, fb->height);
-		DRM_ERROR("Need resizing code.\n");
+	if (var->bits_per_pixel > fb->bits_per_pixel || var->xres > fb->width || var->yres > fb->height) {
+		DRM_DEBUG("fb userspace requested width/height/bpp is greater than current fb "
+			  "object %dx%d-%d > %dx%d-%d\n", var->xres, var->yres, var->bits_per_pixel,
+			  fb->width, fb->height, fb->bits_per_pixel);
 		return -EINVAL;
 	}
 
@@ -905,8 +907,13 @@ int drm_fb_helper_single_fb_probe(struct drm_device *dev,
 
 	if (new_fb) {
 		info->var.pixclock = 0;
-		if (register_framebuffer(info) < 0)
+		ret = fb_alloc_cmap(&info->cmap, modeset->crtc->gamma_size, 0);
+		if (ret)
+			return ret;
+		if (register_framebuffer(info) < 0) {
+			fb_dealloc_cmap(&info->cmap);
 			return -EINVAL;
+		}
 	} else {
 		drm_fb_helper_set_par(info);
 	}
@@ -936,6 +943,7 @@ void drm_fb_helper_free(struct drm_fb_helper *helper)
 		unregister_sysrq_key('v', &sysrq_drm_fb_helper_restore_op);
 	}
 	drm_fb_helper_crtc_free(helper);
+	fb_dealloc_cmap(&helper->fb->fbdev->cmap);
 }
 EXPORT_SYMBOL(drm_fb_helper_free);
 
diff --git a/drivers/gpu/drm/drm_fops.c b/drivers/gpu/drm/drm_fops.c
index 251bc0e3b5ec..08d14df3bb42 100644
--- a/drivers/gpu/drm/drm_fops.c
+++ b/drivers/gpu/drm/drm_fops.c
@@ -257,6 +257,9 @@ static int drm_open_helper(struct inode *inode, struct file *filp,
 
 	INIT_LIST_HEAD(&priv->lhead);
 	INIT_LIST_HEAD(&priv->fbs);
+	INIT_LIST_HEAD(&priv->event_list);
+	init_waitqueue_head(&priv->event_wait);
+	priv->event_space = 4096; /* set aside 4k for event buffer */
 
 	if (dev->driver->driver_features & DRIVER_GEM)
 		drm_gem_open(dev, priv);
@@ -297,6 +300,18 @@ static int drm_open_helper(struct inode *inode, struct file *filp,
 				goto out_free;
 			}
 		}
+		mutex_lock(&dev->struct_mutex);
+		if (dev->driver->master_set) {
+			ret = dev->driver->master_set(dev, priv, true);
+			if (ret) {
+				/* drop both references if this fails */
+				drm_master_put(&priv->minor->master);
+				drm_master_put(&priv->master);
+				mutex_unlock(&dev->struct_mutex);
+				goto out_free;
+			}
+		}
+		mutex_unlock(&dev->struct_mutex);
 	} else {
 		/* get a reference to the master */
 		priv->master = drm_master_get(priv->minor->master);
@@ -413,6 +428,30 @@ static void drm_master_release(struct drm_device *dev, struct file *filp)
 	}
 }
 
+static void drm_events_release(struct drm_file *file_priv)
+{
+	struct drm_device *dev = file_priv->minor->dev;
+	struct drm_pending_event *e, *et;
+	struct drm_pending_vblank_event *v, *vt;
+	unsigned long flags;
+
+	spin_lock_irqsave(&dev->event_lock, flags);
+
+	/* Remove pending flips */
+	list_for_each_entry_safe(v, vt, &dev->vblank_event_list, base.link)
+		if (v->base.file_priv == file_priv) {
+			list_del(&v->base.link);
+			drm_vblank_put(dev, v->pipe);
+			v->base.destroy(&v->base);
+		}
+
+	/* Remove unconsumed events */
+	list_for_each_entry_safe(e, et, &file_priv->event_list, link)
+		e->destroy(e);
+
+	spin_unlock_irqrestore(&dev->event_lock, flags);
+}
+
 /**
  * Release file.
  *
@@ -451,6 +490,8 @@ int drm_release(struct inode *inode, struct file *filp)
 	if (file_priv->minor->master)
 		drm_master_release(dev, filp);
 
+	drm_events_release(file_priv);
+
 	if (dev->driver->driver_features & DRIVER_GEM)
 		drm_gem_release(dev, file_priv);
 
@@ -504,6 +545,8 @@ int drm_release(struct inode *inode, struct file *filp)
 
 		if (file_priv->minor->master == file_priv->master) {
 			/* drop the reference held my the minor */
+			if (dev->driver->master_drop)
+				dev->driver->master_drop(dev, file_priv, true);
 			drm_master_put(&file_priv->minor->master);
 		}
 	}
@@ -544,9 +587,74 @@ int drm_release(struct inode *inode, struct file *filp)
 }
 EXPORT_SYMBOL(drm_release);
 
-/** No-op. */
+static bool
+drm_dequeue_event(struct drm_file *file_priv,
+		  size_t total, size_t max, struct drm_pending_event **out)
+{
+	struct drm_device *dev = file_priv->minor->dev;
+	struct drm_pending_event *e;
+	unsigned long flags;
+	bool ret = false;
+
+	spin_lock_irqsave(&dev->event_lock, flags);
+
+	*out = NULL;
+	if (list_empty(&file_priv->event_list))
+		goto out;
+	e = list_first_entry(&file_priv->event_list,
+			     struct drm_pending_event, link);
+	if (e->event->length + total > max)
+		goto out;
+
+	file_priv->event_space += e->event->length;
+	list_del(&e->link);
+	*out = e;
+	ret = true;
+
+out:
+	spin_unlock_irqrestore(&dev->event_lock, flags);
+	return ret;
+}
+
+ssize_t drm_read(struct file *filp, char __user *buffer,
+		 size_t count, loff_t *offset)
+{
+	struct drm_file *file_priv = filp->private_data;
+	struct drm_pending_event *e;
+	size_t total;
+	ssize_t ret;
+
+	ret = wait_event_interruptible(file_priv->event_wait,
+				       !list_empty(&file_priv->event_list));
+	if (ret < 0)
+		return ret;
+
+	total = 0;
+	while (drm_dequeue_event(file_priv, total, count, &e)) {
+		if (copy_to_user(buffer + total,
+				 e->event, e->event->length)) {
+			total = -EFAULT;
+			break;
+		}
+
+		total += e->event->length;
+		e->destroy(e);
+	}
+
+	return total;
+}
+EXPORT_SYMBOL(drm_read);
+
 unsigned int drm_poll(struct file *filp, struct poll_table_struct *wait)
 {
-	return 0;
+	struct drm_file *file_priv = filp->private_data;
+	unsigned int mask = 0;
+
+	poll_wait(filp, &file_priv->event_wait, wait);
+
+	if (!list_empty(&file_priv->event_list))
+		mask |= POLLIN | POLLRDNORM;
+
+	return mask;
 }
 EXPORT_SYMBOL(drm_poll);
diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
index 282d9fdf9f4e..d61d185cf040 100644
--- a/drivers/gpu/drm/drm_ioc32.c
+++ b/drivers/gpu/drm/drm_ioc32.c
@@ -104,7 +104,7 @@ static int compat_drm_version(struct file *file, unsigned int cmd,
 			  &version->desc))
 		return -EFAULT;
 
-	err = drm_ioctl(file->f_path.dentry->d_inode, file,
+	err = drm_ioctl(file,
 			DRM_IOCTL_VERSION, (unsigned long)version);
 	if (err)
 		return err;
@@ -145,8 +145,7 @@ static int compat_drm_getunique(struct file *file, unsigned int cmd,
 			  &u->unique))
 		return -EFAULT;
 
-	err = drm_ioctl(file->f_path.dentry->d_inode, file,
-			DRM_IOCTL_GET_UNIQUE, (unsigned long)u);
+	err = drm_ioctl(file, DRM_IOCTL_GET_UNIQUE, (unsigned long)u);
 	if (err)
 		return err;
 
@@ -174,8 +173,7 @@ static int compat_drm_setunique(struct file *file, unsigned int cmd,
 			  &u->unique))
 		return -EFAULT;
 
-	return drm_ioctl(file->f_path.dentry->d_inode, file,
-			 DRM_IOCTL_SET_UNIQUE, (unsigned long)u);
+	return drm_ioctl(file, DRM_IOCTL_SET_UNIQUE, (unsigned long)u);
 }
 
 typedef struct drm_map32 {
@@ -205,8 +203,7 @@ static int compat_drm_getmap(struct file *file, unsigned int cmd,
 	if (__put_user(idx, &map->offset))
 		return -EFAULT;
 
-	err = drm_ioctl(file->f_path.dentry->d_inode, file,
-			DRM_IOCTL_GET_MAP, (unsigned long)map);
+	err = drm_ioctl(file, DRM_IOCTL_GET_MAP, (unsigned long)map);
 	if (err)
 		return err;
 
@@ -246,8 +243,7 @@ static int compat_drm_addmap(struct file *file, unsigned int cmd,
 	    || __put_user(m32.flags, &map->flags))
 		return -EFAULT;
 
-	err = drm_ioctl(file->f_path.dentry->d_inode, file,
-			DRM_IOCTL_ADD_MAP, (unsigned long)map);
+	err = drm_ioctl(file, DRM_IOCTL_ADD_MAP, (unsigned long)map);
 	if (err)
 		return err;
 
@@ -284,8 +280,7 @@ static int compat_drm_rmmap(struct file *file, unsigned int cmd,
 	if (__put_user((void *)(unsigned long)handle, &map->handle))
 		return -EFAULT;
 
-	return drm_ioctl(file->f_path.dentry->d_inode, file,
-			 DRM_IOCTL_RM_MAP, (unsigned long)map);
+	return drm_ioctl(file, DRM_IOCTL_RM_MAP, (unsigned long)map);
 }
 
 typedef struct drm_client32 {
@@ -314,8 +309,7 @@ static int compat_drm_getclient(struct file *file, unsigned int cmd,
 	if (__put_user(idx, &client->idx))
 		return -EFAULT;
 
-	err = drm_ioctl(file->f_path.dentry->d_inode, file,
-			DRM_IOCTL_GET_CLIENT, (unsigned long)client);
+	err = drm_ioctl(file, DRM_IOCTL_GET_CLIENT, (unsigned long)client);
 	if (err)
 		return err;
 
@@ -351,8 +345,7 @@ static int compat_drm_getstats(struct file *file, unsigned int cmd,
 	if (!access_ok(VERIFY_WRITE, stats, sizeof(*stats)))
 		return -EFAULT;
 
-	err = drm_ioctl(file->f_path.dentry->d_inode, file,
-			DRM_IOCTL_GET_STATS, (unsigned long)stats);
+	err = drm_ioctl(file, DRM_IOCTL_GET_STATS, (unsigned long)stats);
 	if (err)
 		return err;
 
@@ -395,8 +388,7 @@ static int compat_drm_addbufs(struct file *file, unsigned int cmd,
 	    || __put_user(agp_start, &buf->agp_start))
 		return -EFAULT;
 
-	err = drm_ioctl(file->f_path.dentry->d_inode, file,
-			DRM_IOCTL_ADD_BUFS, (unsigned long)buf);
+	err = drm_ioctl(file, DRM_IOCTL_ADD_BUFS, (unsigned long)buf);
 	if (err)
 		return err;
 
@@ -427,8 +419,7 @@ static int compat_drm_markbufs(struct file *file, unsigned int cmd,
 	    || __put_user(b32.high_mark, &buf->high_mark))
 		return -EFAULT;
 
-	return drm_ioctl(file->f_path.dentry->d_inode, file,
-			 DRM_IOCTL_MARK_BUFS, (unsigned long)buf);
+	return drm_ioctl(file, DRM_IOCTL_MARK_BUFS, (unsigned long)buf);
 }
 
 typedef struct drm_buf_info32 {
@@ -469,8 +460,7 @@ static int compat_drm_infobufs(struct file *file, unsigned int cmd,
 	    || __put_user(list, &request->list))
 		return -EFAULT;
 
-	err = drm_ioctl(file->f_path.dentry->d_inode, file,
-			DRM_IOCTL_INFO_BUFS, (unsigned long)request);
+	err = drm_ioctl(file, DRM_IOCTL_INFO_BUFS, (unsigned long)request);
 	if (err)
 		return err;
 
@@ -531,8 +521,7 @@ static int compat_drm_mapbufs(struct file *file, unsigned int cmd,
 	    || __put_user(list, &request->list))
 		return -EFAULT;
 
-	err = drm_ioctl(file->f_path.dentry->d_inode, file,
-			DRM_IOCTL_MAP_BUFS, (unsigned long)request);
+	err = drm_ioctl(file, DRM_IOCTL_MAP_BUFS, (unsigned long)request);
 	if (err)
 		return err;
 
@@ -578,8 +567,7 @@ static int compat_drm_freebufs(struct file *file, unsigned int cmd,
 			  &request->list))
 		return -EFAULT;
 
-	return drm_ioctl(file->f_path.dentry->d_inode, file,
-			 DRM_IOCTL_FREE_BUFS, (unsigned long)request);
+	return drm_ioctl(file, DRM_IOCTL_FREE_BUFS, (unsigned long)request);
 }
 
 typedef struct drm_ctx_priv_map32 {
@@ -605,8 +593,7 @@ static int compat_drm_setsareactx(struct file *file, unsigned int cmd,
 			  &request->handle))
 		return -EFAULT;
 
-	return drm_ioctl(file->f_path.dentry->d_inode, file,
-			 DRM_IOCTL_SET_SAREA_CTX, (unsigned long)request);
+	return drm_ioctl(file, DRM_IOCTL_SET_SAREA_CTX, (unsigned long)request);
 }
 
 static int compat_drm_getsareactx(struct file *file, unsigned int cmd,
@@ -628,8 +615,7 @@ static int compat_drm_getsareactx(struct file *file, unsigned int cmd,
 	if (__put_user(ctx_id, &request->ctx_id))
 		return -EFAULT;
 
-	err = drm_ioctl(file->f_path.dentry->d_inode, file,
-			DRM_IOCTL_GET_SAREA_CTX, (unsigned long)request);
+	err = drm_ioctl(file, DRM_IOCTL_GET_SAREA_CTX, (unsigned long)request);
 	if (err)
 		return err;
 
@@ -664,8 +650,7 @@ static int compat_drm_resctx(struct file *file, unsigned int cmd,
 			  &res->contexts))
 		return -EFAULT;
 
-	err = drm_ioctl(file->f_path.dentry->d_inode, file,
-			DRM_IOCTL_RES_CTX, (unsigned long)res);
+	err = drm_ioctl(file, DRM_IOCTL_RES_CTX, (unsigned long)res);
 	if (err)
 		return err;
 
@@ -718,8 +703,7 @@ static int compat_drm_dma(struct file *file, unsigned int cmd,
 			  &d->request_sizes))
 		return -EFAULT;
 
-	err = drm_ioctl(file->f_path.dentry->d_inode, file,
-			DRM_IOCTL_DMA, (unsigned long)d);
+	err = drm_ioctl(file, DRM_IOCTL_DMA, (unsigned long)d);
 	if (err)
 		return err;
 
@@ -751,8 +735,7 @@ static int compat_drm_agp_enable(struct file *file, unsigned int cmd,
 	if (put_user(m32.mode, &mode->mode))
 		return -EFAULT;
 
-	return drm_ioctl(file->f_path.dentry->d_inode, file,
-			 DRM_IOCTL_AGP_ENABLE, (unsigned long)mode);
+	return drm_ioctl(file, DRM_IOCTL_AGP_ENABLE, (unsigned long)mode);
 }
 
 typedef struct drm_agp_info32 {
@@ -781,8 +764,7 @@ static int compat_drm_agp_info(struct file *file, unsigned int cmd,
 	if (!access_ok(VERIFY_WRITE, info, sizeof(*info)))
 		return -EFAULT;
 
-	err = drm_ioctl(file->f_path.dentry->d_inode, file,
-			DRM_IOCTL_AGP_INFO, (unsigned long)info);
+	err = drm_ioctl(file, DRM_IOCTL_AGP_INFO, (unsigned long)info);
 	if (err)
 		return err;
 
@@ -827,16 +809,14 @@ static int compat_drm_agp_alloc(struct file *file, unsigned int cmd,
 	    || __put_user(req32.type, &request->type))
 		return -EFAULT;
 
-	err = drm_ioctl(file->f_path.dentry->d_inode, file,
-			DRM_IOCTL_AGP_ALLOC, (unsigned long)request);
+	err = drm_ioctl(file, DRM_IOCTL_AGP_ALLOC, (unsigned long)request);
 	if (err)
 		return err;
 
 	if (__get_user(req32.handle, &request->handle)
 	    || __get_user(req32.physical, &request->physical)
 	    || copy_to_user(argp, &req32, sizeof(req32))) {
-		drm_ioctl(file->f_path.dentry->d_inode, file,
-			  DRM_IOCTL_AGP_FREE, (unsigned long)request);
+		drm_ioctl(file, DRM_IOCTL_AGP_FREE, (unsigned long)request);
 		return -EFAULT;
 	}
 
@@ -856,8 +836,7 @@ static int compat_drm_agp_free(struct file *file, unsigned int cmd,
 	    || __put_user(handle, &request->handle))
 		return -EFAULT;
 
-	return drm_ioctl(file->f_path.dentry->d_inode, file,
-			 DRM_IOCTL_AGP_FREE, (unsigned long)request);
+	return drm_ioctl(file, DRM_IOCTL_AGP_FREE, (unsigned long)request);
 }
 
 typedef struct drm_agp_binding32 {
@@ -881,8 +860,7 @@ static int compat_drm_agp_bind(struct file *file, unsigned int cmd,
 	    || __put_user(req32.offset, &request->offset))
 		return -EFAULT;
 
-	return drm_ioctl(file->f_path.dentry->d_inode, file,
-			 DRM_IOCTL_AGP_BIND, (unsigned long)request);
+	return drm_ioctl(file, DRM_IOCTL_AGP_BIND, (unsigned long)request);
 }
 
 static int compat_drm_agp_unbind(struct file *file, unsigned int cmd,
@@ -898,8 +876,7 @@ static int compat_drm_agp_unbind(struct file *file, unsigned int cmd,
 	    || __put_user(handle, &request->handle))
 		return -EFAULT;
 
-	return drm_ioctl(file->f_path.dentry->d_inode, file,
-			 DRM_IOCTL_AGP_UNBIND, (unsigned long)request);
+	return drm_ioctl(file, DRM_IOCTL_AGP_UNBIND, (unsigned long)request);
 }
 #endif				/* __OS_HAS_AGP */
 
@@ -923,8 +900,7 @@ static int compat_drm_sg_alloc(struct file *file, unsigned int cmd,
 	    || __put_user(x, &request->size))
 		return -EFAULT;
 
-	err = drm_ioctl(file->f_path.dentry->d_inode, file,
-			DRM_IOCTL_SG_ALLOC, (unsigned long)request);
+	err = drm_ioctl(file, DRM_IOCTL_SG_ALLOC, (unsigned long)request);
 	if (err)
 		return err;
 
@@ -950,8 +926,7 @@ static int compat_drm_sg_free(struct file *file, unsigned int cmd,
 	    || __put_user(x << PAGE_SHIFT, &request->handle))
 		return -EFAULT;
 
-	return drm_ioctl(file->f_path.dentry->d_inode, file,
-			 DRM_IOCTL_SG_FREE, (unsigned long)request);
+	return drm_ioctl(file, DRM_IOCTL_SG_FREE, (unsigned long)request);
 }
 
 #if defined(CONFIG_X86) || defined(CONFIG_IA64)
@@ -981,8 +956,7 @@ static int compat_drm_update_draw(struct file *file, unsigned int cmd,
 	    __put_user(update32.data, &request->data))
 		return -EFAULT;
 
-	err = drm_ioctl(file->f_path.dentry->d_inode, file,
-			DRM_IOCTL_UPDATE_DRAW, (unsigned long)request);
+	err = drm_ioctl(file, DRM_IOCTL_UPDATE_DRAW, (unsigned long)request);
 	return err;
 }
 #endif
@@ -1023,8 +997,7 @@ static int compat_drm_wait_vblank(struct file *file, unsigned int cmd,
 	    || __put_user(req32.request.signal, &request->request.signal))
 		return -EFAULT;
 
-	err = drm_ioctl(file->f_path.dentry->d_inode, file,
-			DRM_IOCTL_WAIT_VBLANK, (unsigned long)request);
+	err = drm_ioctl(file, DRM_IOCTL_WAIT_VBLANK, (unsigned long)request);
 	if (err)
 		return err;
 
@@ -1094,16 +1067,14 @@ long drm_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 	 * than always failing.
 	 */
 	if (nr >= ARRAY_SIZE(drm_compat_ioctls))
-		return drm_ioctl(filp->f_dentry->d_inode, filp, cmd, arg);
+		return drm_ioctl(filp, cmd, arg);
 
 	fn = drm_compat_ioctls[nr];
 
-	lock_kernel();		/* XXX for now */
 	if (fn != NULL)
 		ret = (*fn) (filp, cmd, arg);
 	else
-		ret = drm_ioctl(filp->f_path.dentry->d_inode, filp, cmd, arg);
-	unlock_kernel();
+		ret = drm_ioctl(filp, cmd, arg);
 
 	return ret;
 }
diff --git a/drivers/gpu/drm/drm_irq.c b/drivers/gpu/drm/drm_irq.c
index 0a6f0b3bdc78..b98384dbd9a7 100644
--- a/drivers/gpu/drm/drm_irq.c
+++ b/drivers/gpu/drm/drm_irq.c
@@ -115,6 +115,7 @@ void drm_vblank_cleanup(struct drm_device *dev)
 
 	dev->num_crtcs = 0;
 }
+EXPORT_SYMBOL(drm_vblank_cleanup);
 
 int drm_vblank_init(struct drm_device *dev, int num_crtcs)
 {
@@ -163,7 +164,6 @@ int drm_vblank_init(struct drm_device *dev, int num_crtcs)
 	}
 
 	dev->vblank_disable_allowed = 0;
-
 	return 0;
 
 err:
@@ -429,15 +429,21 @@ int drm_vblank_get(struct drm_device *dev, int crtc)
 
 	spin_lock_irqsave(&dev->vbl_lock, irqflags);
 	/* Going from 0->1 means we have to enable interrupts again */
-	if (atomic_add_return(1, &dev->vblank_refcount[crtc]) == 1 &&
-	    !dev->vblank_enabled[crtc]) {
-		ret = dev->driver->enable_vblank(dev, crtc);
-		DRM_DEBUG("enabling vblank on crtc %d, ret: %d\n", crtc, ret);
-		if (ret)
+	if (atomic_add_return(1, &dev->vblank_refcount[crtc]) == 1) {
+		if (!dev->vblank_enabled[crtc]) {
+			ret = dev->driver->enable_vblank(dev, crtc);
+			DRM_DEBUG("enabling vblank on crtc %d, ret: %d\n", crtc, ret);
+			if (ret)
+				atomic_dec(&dev->vblank_refcount[crtc]);
+			else {
+				dev->vblank_enabled[crtc] = 1;
+				drm_update_vblank_count(dev, crtc);
+			}
+		}
+	} else {
+		if (!dev->vblank_enabled[crtc]) {
 			atomic_dec(&dev->vblank_refcount[crtc]);
-		else {
-			dev->vblank_enabled[crtc] = 1;
-			drm_update_vblank_count(dev, crtc);
+			ret = -EINVAL;
 		}
 	}
 	spin_unlock_irqrestore(&dev->vbl_lock, irqflags);
@@ -464,6 +470,18 @@ void drm_vblank_put(struct drm_device *dev, int crtc)
 }
 EXPORT_SYMBOL(drm_vblank_put);
 
+void drm_vblank_off(struct drm_device *dev, int crtc)
+{
+	unsigned long irqflags;
+
+	spin_lock_irqsave(&dev->vbl_lock, irqflags);
+	DRM_WAKEUP(&dev->vbl_queue[crtc]);
+	dev->vblank_enabled[crtc] = 0;
+	dev->last_vblank[crtc] = dev->driver->get_vblank_counter(dev, crtc);
+	spin_unlock_irqrestore(&dev->vbl_lock, irqflags);
+}
+EXPORT_SYMBOL(drm_vblank_off);
+
 /**
  * drm_vblank_pre_modeset - account for vblanks across mode sets
  * @dev: DRM device
@@ -475,6 +493,9 @@ EXPORT_SYMBOL(drm_vblank_put);
  */
 void drm_vblank_pre_modeset(struct drm_device *dev, int crtc)
 {
+	/* vblank is not initialized (IRQ not installed ?) */
+	if (!dev->num_crtcs)
+		return;
 	/*
 	 * To avoid all the problems that might happen if interrupts
 	 * were enabled/disabled around or between these calls, we just
@@ -550,6 +571,63 @@ out:
 	return ret;
 }
 
+static int drm_queue_vblank_event(struct drm_device *dev, int pipe,
+				  union drm_wait_vblank *vblwait,
+				  struct drm_file *file_priv)
+{
+	struct drm_pending_vblank_event *e;
+	struct timeval now;
+	unsigned long flags;
+	unsigned int seq;
+
+	e = kzalloc(sizeof *e, GFP_KERNEL);
+	if (e == NULL)
+		return -ENOMEM;
+
+	e->pipe = pipe;
+	e->event.base.type = DRM_EVENT_VBLANK;
+	e->event.base.length = sizeof e->event;
+	e->event.user_data = vblwait->request.signal;
+	e->base.event = &e->event.base;
+	e->base.file_priv = file_priv;
+	e->base.destroy = (void (*) (struct drm_pending_event *)) kfree;
+
+	do_gettimeofday(&now);
+	spin_lock_irqsave(&dev->event_lock, flags);
+
+	if (file_priv->event_space < sizeof e->event) {
+		spin_unlock_irqrestore(&dev->event_lock, flags);
+		kfree(e);
+		return -ENOMEM;
+	}
+
+	file_priv->event_space -= sizeof e->event;
+	seq = drm_vblank_count(dev, pipe);
+	if ((vblwait->request.type & _DRM_VBLANK_NEXTONMISS) &&
+	    (seq - vblwait->request.sequence) <= (1 << 23)) {
+		vblwait->request.sequence = seq + 1;
+		vblwait->reply.sequence = vblwait->request.sequence;
+	}
+
+	DRM_DEBUG("event on vblank count %d, current %d, crtc %d\n",
+		  vblwait->request.sequence, seq, pipe);
+
+	e->event.sequence = vblwait->request.sequence;
+	if ((seq - vblwait->request.sequence) <= (1 << 23)) {
+		e->event.tv_sec = now.tv_sec;
+		e->event.tv_usec = now.tv_usec;
+		drm_vblank_put(dev, e->pipe);
+		list_add_tail(&e->base.link, &e->base.file_priv->event_list);
+		wake_up_interruptible(&e->base.file_priv->event_wait);
+	} else {
+		list_add_tail(&e->base.link, &dev->vblank_event_list);
+	}
+
+	spin_unlock_irqrestore(&dev->event_lock, flags);
+
+	return 0;
+}
+
 /**
  * Wait for VBLANK.
  *
@@ -609,6 +687,9 @@ int drm_wait_vblank(struct drm_device *dev, void *data,
 		goto done;
 	}
 
+	if (flags & _DRM_VBLANK_EVENT)
+		return drm_queue_vblank_event(dev, crtc, vblwait, file_priv);
+
 	if ((flags & _DRM_VBLANK_NEXTONMISS) &&
 	    (seq - vblwait->request.sequence) <= (1<<23)) {
 		vblwait->request.sequence = seq + 1;
@@ -641,6 +722,38 @@ done:
 	return ret;
 }
 
+void drm_handle_vblank_events(struct drm_device *dev, int crtc)
+{
+	struct drm_pending_vblank_event *e, *t;
+	struct timeval now;
+	unsigned long flags;
+	unsigned int seq;
+
+	do_gettimeofday(&now);
+	seq = drm_vblank_count(dev, crtc);
+
+	spin_lock_irqsave(&dev->event_lock, flags);
+
+	list_for_each_entry_safe(e, t, &dev->vblank_event_list, base.link) {
+		if (e->pipe != crtc)
+			continue;
+		if ((seq - e->event.sequence) > (1<<23))
+			continue;
+
+		DRM_DEBUG("vblank event on %d, current %d\n",
+			  e->event.sequence, seq);
+
+		e->event.sequence = seq;
+		e->event.tv_sec = now.tv_sec;
+		e->event.tv_usec = now.tv_usec;
+		drm_vblank_put(dev, e->pipe);
+		list_move_tail(&e->base.link, &e->base.file_priv->event_list);
+		wake_up_interruptible(&e->base.file_priv->event_wait);
+	}
+
+	spin_unlock_irqrestore(&dev->event_lock, flags);
+}
+
 /**
  * drm_handle_vblank - handle a vblank event
  * @dev: DRM device
@@ -651,7 +764,11 @@ done:
  */
 void drm_handle_vblank(struct drm_device *dev, int crtc)
 {
+	if (!dev->num_crtcs)
+		return;
+
 	atomic_inc(&dev->_vblank_count[crtc]);
 	DRM_WAKEUP(&dev->vbl_queue[crtc]);
+	drm_handle_vblank_events(dev, crtc);
 }
 EXPORT_SYMBOL(drm_handle_vblank);
diff --git a/drivers/gpu/drm/drm_mm.c b/drivers/gpu/drm/drm_mm.c
index 97dc5a4f0de4..cdec32977129 100644
--- a/drivers/gpu/drm/drm_mm.c
+++ b/drivers/gpu/drm/drm_mm.c
@@ -226,6 +226,44 @@ struct drm_mm_node *drm_mm_get_block_generic(struct drm_mm_node *node,
 }
 EXPORT_SYMBOL(drm_mm_get_block_generic);
 
+struct drm_mm_node *drm_mm_get_block_range_generic(struct drm_mm_node *node,
+						unsigned long size,
+						unsigned alignment,
+						unsigned long start,
+						unsigned long end,
+						int atomic)
+{
+	struct drm_mm_node *align_splitoff = NULL;
+	unsigned tmp = 0;
+	unsigned wasted = 0;
+
+	if (node->start < start)
+		wasted += start - node->start;
+	if (alignment)
+		tmp = ((node->start + wasted) % alignment);
+
+	if (tmp)
+		wasted += alignment - tmp;
+	if (wasted) {
+		align_splitoff = drm_mm_split_at_start(node, wasted, atomic);
+		if (unlikely(align_splitoff == NULL))
+			return NULL;
+	}
+
+	if (node->size == size) {
+		list_del_init(&node->fl_entry);
+		node->free = 0;
+	} else {
+		node = drm_mm_split_at_start(node, size, atomic);
+	}
+
+	if (align_splitoff)
+		drm_mm_put_block(align_splitoff);
+
+	return node;
+}
+EXPORT_SYMBOL(drm_mm_get_block_range_generic);
+
 /*
  * Put a block. Merge with the previous and / or next block if they are free.
  * Otherwise add to the free stack.
@@ -320,7 +358,7 @@ struct drm_mm_node *drm_mm_search_free(const struct drm_mm *mm,
 		if (entry->size >= size + wasted) {
 			if (!best_match)
 				return entry;
-			if (size < best_size) {
+			if (entry->size < best_size) {
 				best = entry;
 				best_size = entry->size;
 			}
@@ -331,6 +369,56 @@ struct drm_mm_node *drm_mm_search_free(const struct drm_mm *mm,
 }
 EXPORT_SYMBOL(drm_mm_search_free);
 
+struct drm_mm_node *drm_mm_search_free_in_range(const struct drm_mm *mm,
+						unsigned long size,
+						unsigned alignment,
+						unsigned long start,
+						unsigned long end,
+						int best_match)
+{
+	struct list_head *list;
+	const struct list_head *free_stack = &mm->fl_entry;
+	struct drm_mm_node *entry;
+	struct drm_mm_node *best;
+	unsigned long best_size;
+	unsigned wasted;
+
+	best = NULL;
+	best_size = ~0UL;
+
+	list_for_each(list, free_stack) {
+		entry = list_entry(list, struct drm_mm_node, fl_entry);
+		wasted = 0;
+
+		if (entry->size < size)
+			continue;
+
+		if (entry->start > end || (entry->start+entry->size) < start)
+			continue;
+
+		if (entry->start < start)
+			wasted += start - entry->start;
+
+		if (alignment) {
+			register unsigned tmp = (entry->start + wasted) % alignment;
+			if (tmp)
+				wasted += alignment - tmp;
+		}
+
+		if (entry->size >= size + wasted) {
+			if (!best_match)
+				return entry;
+			if (entry->size < best_size) {
+				best = entry;
+				best_size = entry->size;
+			}
+		}
+	}
+
+	return best;
+}
+EXPORT_SYMBOL(drm_mm_search_free_in_range);
+
 int drm_mm_clean(struct drm_mm * mm)
 {
 	struct list_head *head = &mm->ml_entry;
@@ -381,6 +469,26 @@ void drm_mm_takedown(struct drm_mm * mm)
 }
 EXPORT_SYMBOL(drm_mm_takedown);
 
+void drm_mm_debug_table(struct drm_mm *mm, const char *prefix)
+{
+	struct drm_mm_node *entry;
+	int total_used = 0, total_free = 0, total = 0;
+
+	list_for_each_entry(entry, &mm->ml_entry, ml_entry) {
+		printk(KERN_DEBUG "%s 0x%08lx-0x%08lx: %8ld: %s\n",
+			prefix, entry->start, entry->start + entry->size,
+			entry->size, entry->free ? "free" : "used");
+		total += entry->size;
+		if (entry->free)
+			total_free += entry->size;
+		else
+			total_used += entry->size;
+	}
+	printk(KERN_DEBUG "%s total: %d, used %d free %d\n", prefix, total,
+		total_used, total_free);
+}
+EXPORT_SYMBOL(drm_mm_debug_table);
+
 #if defined(CONFIG_DEBUG_FS)
 int drm_mm_dump_table(struct seq_file *m, struct drm_mm *mm)
 {
@@ -395,7 +503,7 @@ int drm_mm_dump_table(struct seq_file *m, struct drm_mm *mm)
 		else
 			total_used += entry->size;
 	}
-	seq_printf(m, "total: %d, used %d free %d\n", total, total_free, total_used);
+	seq_printf(m, "total: %d, used %d free %d\n", total, total_used, total_free);
 	return 0;
 }
 EXPORT_SYMBOL(drm_mm_dump_table);
diff --git a/drivers/gpu/drm/drm_modes.c b/drivers/gpu/drm/drm_modes.c
index 51f677215f1d..76d63394c776 100644
--- a/drivers/gpu/drm/drm_modes.c
+++ b/drivers/gpu/drm/drm_modes.c
@@ -1,9 +1,4 @@
 /*
- * The list_sort function is (presumably) licensed under the GPL (see the
- * top level "COPYING" file for details).
- *
- * The remainder of this file is:
- *
  * Copyright © 1997-2003 by The XFree86 Project, Inc.
  * Copyright © 2007 Dave Airlie
  * Copyright © 2007-2008 Intel Corporation
@@ -36,6 +31,7 @@
  */
 
 #include <linux/list.h>
+#include <linux/list_sort.h>
 #include "drmP.h"
 #include "drm.h"
 #include "drm_crtc.h"
@@ -553,6 +549,32 @@ int drm_mode_height(struct drm_display_mode *mode)
 }
 EXPORT_SYMBOL(drm_mode_height);
 
+/** drm_mode_hsync - get the hsync of a mode
+ * @mode: mode
+ *
+ * LOCKING:
+ * None.
+ *
+ * Return @modes's hsync rate in kHz, rounded to the nearest int.
+ */
+int drm_mode_hsync(struct drm_display_mode *mode)
+{
+	unsigned int calc_val;
+
+	if (mode->hsync)
+		return mode->hsync;
+
+	if (mode->htotal < 0)
+		return 0;
+
+	calc_val = (mode->clock * 1000) / mode->htotal; /* hsync in Hz */
+	calc_val += 500;				/* round to 1000Hz */
+	calc_val /= 1000;				/* truncate to kHz */
+
+	return calc_val;
+}
+EXPORT_SYMBOL(drm_mode_hsync);
+
 /**
  * drm_mode_vrefresh - get the vrefresh of a mode
  * @mode: mode
@@ -560,7 +582,7 @@ EXPORT_SYMBOL(drm_mode_height);
  * LOCKING:
  * None.
  *
- * Return @mode's vrefresh rate or calculate it if necessary.
+ * Return @mode's vrefresh rate in Hz or calculate it if necessary.
  *
  * FIXME: why is this needed?  shouldn't vrefresh be set already?
  *
@@ -829,6 +851,7 @@ EXPORT_SYMBOL(drm_mode_prune_invalid);
 
 /**
  * drm_mode_compare - compare modes for favorability
+ * @priv: unused
  * @lh_a: list_head for first mode
  * @lh_b: list_head for second mode
  *
@@ -842,7 +865,7 @@ EXPORT_SYMBOL(drm_mode_prune_invalid);
  * Negative if @lh_a is better than @lh_b, zero if they're equivalent, or
  * positive if @lh_b is better than @lh_a.
  */
-static int drm_mode_compare(struct list_head *lh_a, struct list_head *lh_b)
+static int drm_mode_compare(void *priv, struct list_head *lh_a, struct list_head *lh_b)
 {
 	struct drm_display_mode *a = list_entry(lh_a, struct drm_display_mode, head);
 	struct drm_display_mode *b = list_entry(lh_b, struct drm_display_mode, head);
@@ -859,85 +882,6 @@ static int drm_mode_compare(struct list_head *lh_a, struct list_head *lh_b)
 	return diff;
 }
 
-/* FIXME: what we don't have a list sort function? */
-/* list sort from Mark J Roberts (mjr@znex.org) */
-void list_sort(struct list_head *head,
-	       int (*cmp)(struct list_head *a, struct list_head *b))
-{
-	struct list_head *p, *q, *e, *list, *tail, *oldhead;
-	int insize, nmerges, psize, qsize, i;
-
-	list = head->next;
-	list_del(head);
-	insize = 1;
-	for (;;) {
-		p = oldhead = list;
-		list = tail = NULL;
-		nmerges = 0;
-
-		while (p) {
-			nmerges++;
-			q = p;
-			psize = 0;
-			for (i = 0; i < insize; i++) {
-				psize++;
-				q = q->next == oldhead ? NULL : q->next;
-				if (!q)
-					break;
-			}
-
-			qsize = insize;
-			while (psize > 0 || (qsize > 0 && q)) {
-				if (!psize) {
-					e = q;
-					q = q->next;
-					qsize--;
-					if (q == oldhead)
-						q = NULL;
-				} else if (!qsize || !q) {
-					e = p;
-					p = p->next;
-					psize--;
-					if (p == oldhead)
-						p = NULL;
-				} else if (cmp(p, q) <= 0) {
-					e = p;
-					p = p->next;
-					psize--;
-					if (p == oldhead)
-						p = NULL;
-				} else {
-					e = q;
-					q = q->next;
-					qsize--;
-					if (q == oldhead)
-						q = NULL;
-				}
-				if (tail)
-					tail->next = e;
-				else
-					list = e;
-				e->prev = tail;
-				tail = e;
-			}
-			p = q;
-		}
-
-		tail->next = list;
-		list->prev = tail;
-
-		if (nmerges <= 1)
-			break;
-
-		insize *= 2;
-	}
-
-	head->next = list;
-	head->prev = list->prev;
-	list->prev->next = head;
-	list->prev = head;
-}
-
 /**
  * drm_mode_sort - sort mode list
  * @mode_list: list to sort
@@ -949,7 +893,7 @@ void list_sort(struct list_head *head,
  */
 void drm_mode_sort(struct list_head *mode_list)
 {
-	list_sort(mode_list, drm_mode_compare);
+	list_sort(NULL, mode_list, drm_mode_compare);
 }
 EXPORT_SYMBOL(drm_mode_sort);
 
diff --git a/drivers/gpu/drm/drm_pci.c b/drivers/gpu/drm/drm_pci.c
index 577094fb1995..e68ebf92fa2a 100644
--- a/drivers/gpu/drm/drm_pci.c
+++ b/drivers/gpu/drm/drm_pci.c
@@ -47,8 +47,7 @@
 /**
  * \brief Allocate a PCI consistent memory block, for DMA.
  */
-drm_dma_handle_t *drm_pci_alloc(struct drm_device * dev, size_t size, size_t align,
-				dma_addr_t maxaddr)
+drm_dma_handle_t *drm_pci_alloc(struct drm_device * dev, size_t size, size_t align)
 {
 	drm_dma_handle_t *dmah;
 #if 1
@@ -63,11 +62,6 @@ drm_dma_handle_t *drm_pci_alloc(struct drm_device * dev, size_t size, size_t ali
 	if (align > size)
 		return NULL;
 
-	if (pci_set_dma_mask(dev->pdev, maxaddr) != 0) {
-		DRM_ERROR("Setting pci dma mask failed\n");
-		return NULL;
-	}
-
 	dmah = kmalloc(sizeof(drm_dma_handle_t), GFP_KERNEL);
 	if (!dmah)
 		return NULL;
diff --git a/drivers/gpu/drm/drm_stub.c b/drivers/gpu/drm/drm_stub.c
index 55bb8a82d612..ad73e141afdb 100644
--- a/drivers/gpu/drm/drm_stub.c
+++ b/drivers/gpu/drm/drm_stub.c
@@ -128,6 +128,7 @@ struct drm_master *drm_master_get(struct drm_master *master)
 	kref_get(&master->refcount);
 	return master;
 }
+EXPORT_SYMBOL(drm_master_get);
 
 static void drm_master_destroy(struct kref *kref)
 {
@@ -170,10 +171,13 @@ void drm_master_put(struct drm_master **master)
 	kref_put(&(*master)->refcount, drm_master_destroy);
 	*master = NULL;
 }
+EXPORT_SYMBOL(drm_master_put);
 
 int drm_setmaster_ioctl(struct drm_device *dev, void *data,
 			struct drm_file *file_priv)
 {
+	int ret = 0;
+
 	if (file_priv->is_master)
 		return 0;
 
@@ -188,6 +192,13 @@ int drm_setmaster_ioctl(struct drm_device *dev, void *data,
 		mutex_lock(&dev->struct_mutex);
 		file_priv->minor->master = drm_master_get(file_priv->master);
 		file_priv->is_master = 1;
+		if (dev->driver->master_set) {
+			ret = dev->driver->master_set(dev, file_priv, false);
+			if (unlikely(ret != 0)) {
+				file_priv->is_master = 0;
+				drm_master_put(&file_priv->minor->master);
+			}
+		}
 		mutex_unlock(&dev->struct_mutex);
 	}
 
@@ -204,6 +215,8 @@ int drm_dropmaster_ioctl(struct drm_device *dev, void *data,
 		return -EINVAL;
 
 	mutex_lock(&dev->struct_mutex);
+	if (dev->driver->master_drop)
+		dev->driver->master_drop(dev, file_priv, false);
 	drm_master_put(&file_priv->minor->master);
 	file_priv->is_master = 0;
 	mutex_unlock(&dev->struct_mutex);
@@ -220,9 +233,11 @@ static int drm_fill_in_dev(struct drm_device * dev, struct pci_dev *pdev,
 	INIT_LIST_HEAD(&dev->ctxlist);
 	INIT_LIST_HEAD(&dev->vmalist);
 	INIT_LIST_HEAD(&dev->maplist);
+	INIT_LIST_HEAD(&dev->vblank_event_list);
 
 	spin_lock_init(&dev->count_lock);
 	spin_lock_init(&dev->drw_lock);
+	spin_lock_init(&dev->event_lock);
 	init_timer(&dev->timer);
 	mutex_init(&dev->struct_mutex);
 	mutex_init(&dev->ctxlist_mutex);
diff --git a/drivers/gpu/drm/i2c/Makefile b/drivers/gpu/drm/i2c/Makefile
new file mode 100644
index 000000000000..6d2abaf35ba2
--- /dev/null
+++ b/drivers/gpu/drm/i2c/Makefile
@@ -0,0 +1,4 @@
+ccflags-y := -Iinclude/drm
+
+ch7006-y := ch7006_drv.o ch7006_mode.o
+obj-$(CONFIG_DRM_I2C_CH7006) += ch7006.o
diff --git a/drivers/gpu/drm/i2c/ch7006_drv.c b/drivers/gpu/drm/i2c/ch7006_drv.c
new file mode 100644
index 000000000000..81681a07a806
--- /dev/null
+++ b/drivers/gpu/drm/i2c/ch7006_drv.c
@@ -0,0 +1,536 @@
+/*
+ * Copyright (C) 2009 Francisco Jerez.
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial
+ * portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE COPYRIGHT OWNER(S) AND/OR ITS SUPPLIERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
+#include "ch7006_priv.h"
+
+/* DRM encoder functions */
+
+static void ch7006_encoder_set_config(struct drm_encoder *encoder,
+				      void *params)
+{
+	struct ch7006_priv *priv = to_ch7006_priv(encoder);
+
+	priv->params = params;
+}
+
+static void ch7006_encoder_destroy(struct drm_encoder *encoder)
+{
+	struct ch7006_priv *priv = to_ch7006_priv(encoder);
+
+	drm_property_destroy(encoder->dev, priv->scale_property);
+
+	kfree(priv);
+	to_encoder_slave(encoder)->slave_priv = NULL;
+
+	drm_i2c_encoder_destroy(encoder);
+}
+
+static void  ch7006_encoder_dpms(struct drm_encoder *encoder, int mode)
+{
+	struct i2c_client *client = drm_i2c_encoder_get_client(encoder);
+	struct ch7006_priv *priv = to_ch7006_priv(encoder);
+	struct ch7006_state *state = &priv->state;
+
+	ch7006_dbg(client, "\n");
+
+	if (mode == priv->last_dpms)
+		return;
+	priv->last_dpms = mode;
+
+	ch7006_setup_power_state(encoder);
+
+	ch7006_load_reg(client, state, CH7006_POWER);
+}
+
+static void ch7006_encoder_save(struct drm_encoder *encoder)
+{
+	struct i2c_client *client = drm_i2c_encoder_get_client(encoder);
+	struct ch7006_priv *priv = to_ch7006_priv(encoder);
+
+	ch7006_dbg(client, "\n");
+
+	ch7006_state_save(client, &priv->saved_state);
+}
+
+static void ch7006_encoder_restore(struct drm_encoder *encoder)
+{
+	struct i2c_client *client = drm_i2c_encoder_get_client(encoder);
+	struct ch7006_priv *priv = to_ch7006_priv(encoder);
+
+	ch7006_dbg(client, "\n");
+
+	ch7006_state_load(client, &priv->saved_state);
+}
+
+static bool ch7006_encoder_mode_fixup(struct drm_encoder *encoder,
+				      struct drm_display_mode *mode,
+				      struct drm_display_mode *adjusted_mode)
+{
+	struct ch7006_priv *priv = to_ch7006_priv(encoder);
+
+	/* The ch7006 is painfully picky with the input timings so no
+	 * custom modes for now... */
+
+	priv->mode = ch7006_lookup_mode(encoder, mode);
+
+	return !!priv->mode;
+}
+
+static int ch7006_encoder_mode_valid(struct drm_encoder *encoder,
+				     struct drm_display_mode *mode)
+{
+	if (ch7006_lookup_mode(encoder, mode))
+		return MODE_OK;
+	else
+		return MODE_BAD;
+}
+
+static void ch7006_encoder_mode_set(struct drm_encoder *encoder,
+				     struct drm_display_mode *drm_mode,
+				     struct drm_display_mode *adjusted_mode)
+{
+	struct i2c_client *client = drm_i2c_encoder_get_client(encoder);
+	struct ch7006_priv *priv = to_ch7006_priv(encoder);
+	struct ch7006_encoder_params *params = priv->params;
+	struct ch7006_state *state = &priv->state;
+	uint8_t *regs = state->regs;
+	struct ch7006_mode *mode = priv->mode;
+	struct ch7006_tv_norm_info *norm = &ch7006_tv_norms[priv->norm];
+	int start_active;
+
+	ch7006_dbg(client, "\n");
+
+	regs[CH7006_DISPMODE] = norm->dispmode | mode->dispmode;
+	regs[CH7006_BWIDTH] = 0;
+	regs[CH7006_INPUT_FORMAT] = bitf(CH7006_INPUT_FORMAT_FORMAT,
+					 params->input_format);
+
+	regs[CH7006_CLKMODE] = CH7006_CLKMODE_SUBC_LOCK
+		| bitf(CH7006_CLKMODE_XCM, params->xcm)
+		| bitf(CH7006_CLKMODE_PCM, params->pcm);
+	if (params->clock_mode)
+		regs[CH7006_CLKMODE] |= CH7006_CLKMODE_MASTER;
+	if (params->clock_edge)
+		regs[CH7006_CLKMODE] |= CH7006_CLKMODE_POS_EDGE;
+
+	start_active = (drm_mode->htotal & ~0x7) - (drm_mode->hsync_start & ~0x7);
+	regs[CH7006_POV] = bitf(CH7006_POV_START_ACTIVE_8, start_active);
+	regs[CH7006_START_ACTIVE] = bitf(CH7006_START_ACTIVE_0, start_active);
+
+	regs[CH7006_INPUT_SYNC] = 0;
+	if (params->sync_direction)
+		regs[CH7006_INPUT_SYNC] |= CH7006_INPUT_SYNC_OUTPUT;
+	if (params->sync_encoding)
+		regs[CH7006_INPUT_SYNC] |= CH7006_INPUT_SYNC_EMBEDDED;
+	if (drm_mode->flags & DRM_MODE_FLAG_PVSYNC)
+		regs[CH7006_INPUT_SYNC] |= CH7006_INPUT_SYNC_PVSYNC;
+	if (drm_mode->flags & DRM_MODE_FLAG_PHSYNC)
+		regs[CH7006_INPUT_SYNC] |= CH7006_INPUT_SYNC_PHSYNC;
+
+	regs[CH7006_DETECT] = 0;
+	regs[CH7006_BCLKOUT] = 0;
+
+	regs[CH7006_SUBC_INC3] = 0;
+	if (params->pout_level)
+		regs[CH7006_SUBC_INC3] |= CH7006_SUBC_INC3_POUT_3_3V;
+
+	regs[CH7006_SUBC_INC4] = 0;
+	if (params->active_detect)
+		regs[CH7006_SUBC_INC4] |= CH7006_SUBC_INC4_DS_INPUT;
+
+	regs[CH7006_PLL_CONTROL] = priv->saved_state.regs[CH7006_PLL_CONTROL];
+
+	ch7006_setup_levels(encoder);
+	ch7006_setup_subcarrier(encoder);
+	ch7006_setup_pll(encoder);
+	ch7006_setup_power_state(encoder);
+	ch7006_setup_properties(encoder);
+
+	ch7006_state_load(client, state);
+}
+
+static enum drm_connector_status ch7006_encoder_detect(struct drm_encoder *encoder,
+						       struct drm_connector *connector)
+{
+	struct i2c_client *client = drm_i2c_encoder_get_client(encoder);
+	struct ch7006_priv *priv = to_ch7006_priv(encoder);
+	struct ch7006_state *state = &priv->state;
+	int det;
+
+	ch7006_dbg(client, "\n");
+
+	ch7006_save_reg(client, state, CH7006_DETECT);
+	ch7006_save_reg(client, state, CH7006_POWER);
+	ch7006_save_reg(client, state, CH7006_CLKMODE);
+
+	ch7006_write(client, CH7006_POWER, CH7006_POWER_RESET |
+					   bitfs(CH7006_POWER_LEVEL, NORMAL));
+	ch7006_write(client, CH7006_CLKMODE, CH7006_CLKMODE_MASTER);
+
+	ch7006_write(client, CH7006_DETECT, CH7006_DETECT_SENSE);
+
+	ch7006_write(client, CH7006_DETECT, 0);
+
+	det = ch7006_read(client, CH7006_DETECT);
+
+	ch7006_load_reg(client, state, CH7006_CLKMODE);
+	ch7006_load_reg(client, state, CH7006_POWER);
+	ch7006_load_reg(client, state, CH7006_DETECT);
+
+	if ((det & (CH7006_DETECT_SVIDEO_Y_TEST|
+		    CH7006_DETECT_SVIDEO_C_TEST|
+		    CH7006_DETECT_CVBS_TEST)) == 0)
+		priv->subconnector = DRM_MODE_SUBCONNECTOR_SCART;
+	else if ((det & (CH7006_DETECT_SVIDEO_Y_TEST|
+			 CH7006_DETECT_SVIDEO_C_TEST)) == 0)
+		priv->subconnector = DRM_MODE_SUBCONNECTOR_SVIDEO;
+	else if ((det & CH7006_DETECT_CVBS_TEST) == 0)
+		priv->subconnector = DRM_MODE_SUBCONNECTOR_Composite;
+	else
+		priv->subconnector = DRM_MODE_SUBCONNECTOR_Unknown;
+
+	drm_connector_property_set_value(connector,
+			encoder->dev->mode_config.tv_subconnector_property,
+							priv->subconnector);
+
+	return priv->subconnector ? connector_status_connected :
+					connector_status_disconnected;
+}
+
+static int ch7006_encoder_get_modes(struct drm_encoder *encoder,
+				    struct drm_connector *connector)
+{
+	struct ch7006_priv *priv = to_ch7006_priv(encoder);
+	struct ch7006_mode *mode;
+	int n = 0;
+
+	for (mode = ch7006_modes; mode->mode.clock; mode++) {
+		if (~mode->valid_scales & 1<<priv->scale ||
+		    ~mode->valid_norms & 1<<priv->norm)
+			continue;
+
+		drm_mode_probed_add(connector,
+				drm_mode_duplicate(encoder->dev, &mode->mode));
+
+		n++;
+	}
+
+	return n;
+}
+
+static int ch7006_encoder_create_resources(struct drm_encoder *encoder,
+					   struct drm_connector *connector)
+{
+	struct ch7006_priv *priv = to_ch7006_priv(encoder);
+	struct drm_device *dev = encoder->dev;
+	struct drm_mode_config *conf = &dev->mode_config;
+
+	drm_mode_create_tv_properties(dev, NUM_TV_NORMS, ch7006_tv_norm_names);
+
+	priv->scale_property = drm_property_create(dev, DRM_MODE_PROP_RANGE,
+						   "scale", 2);
+	priv->scale_property->values[0] = 0;
+	priv->scale_property->values[1] = 2;
+
+	drm_connector_attach_property(connector, conf->tv_select_subconnector_property,
+				      priv->select_subconnector);
+	drm_connector_attach_property(connector, conf->tv_subconnector_property,
+				      priv->subconnector);
+	drm_connector_attach_property(connector, conf->tv_left_margin_property,
+				      priv->hmargin);
+	drm_connector_attach_property(connector, conf->tv_bottom_margin_property,
+				      priv->vmargin);
+	drm_connector_attach_property(connector, conf->tv_mode_property,
+				      priv->norm);
+	drm_connector_attach_property(connector, conf->tv_brightness_property,
+				      priv->brightness);
+	drm_connector_attach_property(connector, conf->tv_contrast_property,
+				      priv->contrast);
+	drm_connector_attach_property(connector, conf->tv_flicker_reduction_property,
+				      priv->flicker);
+	drm_connector_attach_property(connector, priv->scale_property,
+				      priv->scale);
+
+	return 0;
+}
+
+static int ch7006_encoder_set_property(struct drm_encoder *encoder,
+				       struct drm_connector *connector,
+				       struct drm_property *property,
+				       uint64_t val)
+{
+	struct i2c_client *client = drm_i2c_encoder_get_client(encoder);
+	struct ch7006_priv *priv = to_ch7006_priv(encoder);
+	struct ch7006_state *state = &priv->state;
+	struct drm_mode_config *conf = &encoder->dev->mode_config;
+	struct drm_crtc *crtc = encoder->crtc;
+	bool modes_changed = false;
+
+	ch7006_dbg(client, "\n");
+
+	if (property == conf->tv_select_subconnector_property) {
+		priv->select_subconnector = val;
+
+		ch7006_setup_power_state(encoder);
+
+		ch7006_load_reg(client, state, CH7006_POWER);
+
+	} else if (property == conf->tv_left_margin_property) {
+		priv->hmargin = val;
+
+		ch7006_setup_properties(encoder);
+
+		ch7006_load_reg(client, state, CH7006_POV);
+		ch7006_load_reg(client, state, CH7006_HPOS);
+
+	} else if (property == conf->tv_bottom_margin_property) {
+		priv->vmargin = val;
+
+		ch7006_setup_properties(encoder);
+
+		ch7006_load_reg(client, state, CH7006_POV);
+		ch7006_load_reg(client, state, CH7006_VPOS);
+
+	} else if (property == conf->tv_mode_property) {
+		if (connector->dpms != DRM_MODE_DPMS_OFF)
+			return -EINVAL;
+
+		priv->norm = val;
+
+		modes_changed = true;
+
+	} else if (property == conf->tv_brightness_property) {
+		priv->brightness = val;
+
+		ch7006_setup_levels(encoder);
+
+		ch7006_load_reg(client, state, CH7006_BLACK_LEVEL);
+
+	} else if (property == conf->tv_contrast_property) {
+		priv->contrast = val;
+
+		ch7006_setup_properties(encoder);
+
+		ch7006_load_reg(client, state, CH7006_CONTRAST);
+
+	} else if (property == conf->tv_flicker_reduction_property) {
+		priv->flicker = val;
+
+		ch7006_setup_properties(encoder);
+
+		ch7006_load_reg(client, state, CH7006_FFILTER);
+
+	} else if (property == priv->scale_property) {
+		if (connector->dpms != DRM_MODE_DPMS_OFF)
+			return -EINVAL;
+
+		priv->scale = val;
+
+		modes_changed = true;
+
+	} else {
+		return -EINVAL;
+	}
+
+	if (modes_changed) {
+		drm_helper_probe_single_connector_modes(connector, 0, 0);
+
+		/* Disable the crtc to ensure a full modeset is
+		 * performed whenever it's turned on again. */
+		if (crtc) {
+			struct drm_mode_set modeset = {
+				.crtc = crtc,
+			};
+
+			crtc->funcs->set_config(&modeset);
+		}
+	}
+
+	return 0;
+}
+
+static struct drm_encoder_slave_funcs ch7006_encoder_funcs = {
+	.set_config = ch7006_encoder_set_config,
+	.destroy = ch7006_encoder_destroy,
+	.dpms = ch7006_encoder_dpms,
+	.save = ch7006_encoder_save,
+	.restore = ch7006_encoder_restore,
+	.mode_fixup = ch7006_encoder_mode_fixup,
+	.mode_valid = ch7006_encoder_mode_valid,
+	.mode_set = ch7006_encoder_mode_set,
+	.detect = ch7006_encoder_detect,
+	.get_modes = ch7006_encoder_get_modes,
+	.create_resources = ch7006_encoder_create_resources,
+	.set_property = ch7006_encoder_set_property,
+};
+
+
+/* I2C driver functions */
+
+static int ch7006_probe(struct i2c_client *client, const struct i2c_device_id *id)
+{
+	uint8_t addr = CH7006_VERSION_ID;
+	uint8_t val;
+	int ret;
+
+	ch7006_dbg(client, "\n");
+
+	ret = i2c_master_send(client, &addr, sizeof(addr));
+	if (ret < 0)
+		goto fail;
+
+	ret = i2c_master_recv(client, &val, sizeof(val));
+	if (ret < 0)
+		goto fail;
+
+	ch7006_info(client, "Detected version ID: %x\n", val);
+
+	/* I don't know what this is for, but otherwise I get no
+	 * signal.
+	 */
+	ch7006_write(client, 0x3d, 0x0);
+
+	return 0;
+
+fail:
+	ch7006_err(client, "Error %d reading version ID\n", ret);
+
+	return -ENODEV;
+}
+
+static int ch7006_remove(struct i2c_client *client)
+{
+	ch7006_dbg(client, "\n");
+
+	return 0;
+}
+
+static int ch7006_encoder_init(struct i2c_client *client,
+			       struct drm_device *dev,
+			       struct drm_encoder_slave *encoder)
+{
+	struct ch7006_priv *priv;
+	int i;
+
+	ch7006_dbg(client, "\n");
+
+	priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+	if (!priv)
+		return -ENOMEM;
+
+	encoder->slave_priv = priv;
+	encoder->slave_funcs = &ch7006_encoder_funcs;
+
+	priv->norm = TV_NORM_PAL;
+	priv->select_subconnector = DRM_MODE_SUBCONNECTOR_Automatic;
+	priv->subconnector = DRM_MODE_SUBCONNECTOR_Unknown;
+	priv->scale = 1;
+	priv->contrast = 50;
+	priv->brightness = 50;
+	priv->flicker = 50;
+	priv->hmargin = 50;
+	priv->vmargin = 50;
+	priv->last_dpms = -1;
+
+	if (ch7006_tv_norm) {
+		for (i = 0; i < NUM_TV_NORMS; i++) {
+			if (!strcmp(ch7006_tv_norm_names[i], ch7006_tv_norm)) {
+				priv->norm = i;
+				break;
+			}
+		}
+
+		if (i == NUM_TV_NORMS)
+			ch7006_err(client, "Invalid TV norm setting \"%s\".\n",
+				   ch7006_tv_norm);
+	}
+
+	if (ch7006_scale >= 0 && ch7006_scale <= 2)
+		priv->scale = ch7006_scale;
+	else
+		ch7006_err(client, "Invalid scale setting \"%d\".\n",
+			   ch7006_scale);
+
+	return 0;
+}
+
+static struct i2c_device_id ch7006_ids[] = {
+	{ "ch7006", 0 },
+	{ }
+};
+MODULE_DEVICE_TABLE(i2c, ch7006_ids);
+
+static struct drm_i2c_encoder_driver ch7006_driver = {
+	.i2c_driver = {
+		.probe = ch7006_probe,
+		.remove = ch7006_remove,
+
+		.driver = {
+			.name = "ch7006",
+		},
+
+		.id_table = ch7006_ids,
+	},
+
+	.encoder_init = ch7006_encoder_init,
+};
+
+
+/* Module initialization */
+
+static int __init ch7006_init(void)
+{
+	return drm_i2c_encoder_register(THIS_MODULE, &ch7006_driver);
+}
+
+static void __exit ch7006_exit(void)
+{
+	drm_i2c_encoder_unregister(&ch7006_driver);
+}
+
+int ch7006_debug;
+module_param_named(debug, ch7006_debug, int, 0600);
+MODULE_PARM_DESC(debug, "Enable debug output.");
+
+char *ch7006_tv_norm;
+module_param_named(tv_norm, ch7006_tv_norm, charp, 0600);
+MODULE_PARM_DESC(tv_norm, "Default TV norm.\n"
+		 "\t\tSupported: PAL, PAL-M, PAL-N, PAL-Nc, PAL-60, NTSC-M, NTSC-J.\n"
+		 "\t\tDefault: PAL");
+
+int ch7006_scale = 1;
+module_param_named(scale, ch7006_scale, int, 0600);
+MODULE_PARM_DESC(scale, "Default scale.\n"
+		 "\t\tSupported: 0 -> Select video modes with a higher blanking ratio.\n"
+		 "\t\t\t1 -> Select default video modes.\n"
+		 "\t\t\t2 -> Select video modes with a lower blanking ratio.");
+
+MODULE_AUTHOR("Francisco Jerez <currojerez@riseup.net>");
+MODULE_DESCRIPTION("Chrontel ch7006 TV encoder driver");
+MODULE_LICENSE("GPL and additional rights");
+
+module_init(ch7006_init);
+module_exit(ch7006_exit);
diff --git a/drivers/gpu/drm/i2c/ch7006_mode.c b/drivers/gpu/drm/i2c/ch7006_mode.c
new file mode 100644
index 000000000000..e447dfb63890
--- /dev/null
+++ b/drivers/gpu/drm/i2c/ch7006_mode.c
@@ -0,0 +1,468 @@
+/*
+ * Copyright (C) 2009 Francisco Jerez.
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial
+ * portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE COPYRIGHT OWNER(S) AND/OR ITS SUPPLIERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
+#include "ch7006_priv.h"
+
+char *ch7006_tv_norm_names[] = {
+	[TV_NORM_PAL] = "PAL",
+	[TV_NORM_PAL_M] = "PAL-M",
+	[TV_NORM_PAL_N] = "PAL-N",
+	[TV_NORM_PAL_NC] = "PAL-Nc",
+	[TV_NORM_PAL_60] = "PAL-60",
+	[TV_NORM_NTSC_M] = "NTSC-M",
+	[TV_NORM_NTSC_J] = "NTSC-J",
+};
+
+#define NTSC_LIKE_TIMINGS .vrefresh = 60 * fixed1/1.001,		\
+		.vdisplay = 480,					\
+		.vtotal = 525,						\
+		.hvirtual = 660
+
+#define PAL_LIKE_TIMINGS .vrefresh = 50 * fixed1,		\
+		.vdisplay = 576,				\
+		.vtotal = 625,					\
+		.hvirtual = 810
+
+struct ch7006_tv_norm_info ch7006_tv_norms[] = {
+	[TV_NORM_NTSC_M] = {
+		NTSC_LIKE_TIMINGS,
+		.black_level = 0.339 * fixed1,
+		.subc_freq = 3579545 * fixed1,
+		.dispmode = bitfs(CH7006_DISPMODE_OUTPUT_STD, NTSC),
+		.voffset = 0,
+	},
+	[TV_NORM_NTSC_J] = {
+		NTSC_LIKE_TIMINGS,
+		.black_level = 0.286 * fixed1,
+		.subc_freq = 3579545 * fixed1,
+		.dispmode = bitfs(CH7006_DISPMODE_OUTPUT_STD, NTSC_J),
+		.voffset = 0,
+	},
+	[TV_NORM_PAL] = {
+		PAL_LIKE_TIMINGS,
+		.black_level = 0.3 * fixed1,
+		.subc_freq = 4433618.75 * fixed1,
+		.dispmode = bitfs(CH7006_DISPMODE_OUTPUT_STD, PAL),
+		.voffset = 0,
+	},
+	[TV_NORM_PAL_M] = {
+		NTSC_LIKE_TIMINGS,
+		.black_level = 0.339 * fixed1,
+		.subc_freq = 3575611.433 * fixed1,
+		.dispmode = bitfs(CH7006_DISPMODE_OUTPUT_STD, PAL_M),
+		.voffset = 16,
+	},
+
+	/* The following modes seem to work right but they're
+	 * undocumented */
+
+	[TV_NORM_PAL_N] = {
+		PAL_LIKE_TIMINGS,
+		.black_level = 0.339 * fixed1,
+		.subc_freq = 4433618.75 * fixed1,
+		.dispmode = bitfs(CH7006_DISPMODE_OUTPUT_STD, PAL),
+		.voffset = 0,
+	},
+	[TV_NORM_PAL_NC] = {
+		PAL_LIKE_TIMINGS,
+		.black_level = 0.3 * fixed1,
+		.subc_freq = 3582056.25 * fixed1,
+		.dispmode = bitfs(CH7006_DISPMODE_OUTPUT_STD, PAL),
+		.voffset = 0,
+	},
+	[TV_NORM_PAL_60] = {
+		NTSC_LIKE_TIMINGS,
+		.black_level = 0.3 * fixed1,
+		.subc_freq = 4433618.75 * fixed1,
+		.dispmode = bitfs(CH7006_DISPMODE_OUTPUT_STD, PAL_M),
+		.voffset = 16,
+	},
+};
+
+#define __MODE(f, hd, vd, ht, vt, hsynp, vsynp,				\
+	       subc, scale, scale_mask, norm_mask, e_hd, e_vd) {	\
+		.mode = {						\
+			.name = #hd "x" #vd,				\
+			.status = 0,					\
+			.type = DRM_MODE_TYPE_DRIVER,			\
+			.clock = f,					\
+			.hdisplay = hd,					\
+			.hsync_start = e_hd + 16,			\
+			.hsync_end = e_hd + 80,				\
+			.htotal = ht,					\
+			.hskew = 0,					\
+			.vdisplay = vd,					\
+			.vsync_start = vd + 10,				\
+			.vsync_end = vd + 26,				\
+			.vtotal = vt,					\
+			.vscan = 0,					\
+			.flags = DRM_MODE_FLAG_##hsynp##HSYNC |		\
+				DRM_MODE_FLAG_##vsynp##VSYNC,		\
+			.vrefresh = 0,					\
+		},							\
+		.enc_hdisp = e_hd,					\
+		.enc_vdisp = e_vd,					\
+		.subc_coeff = subc * fixed1,				\
+		.dispmode = bitfs(CH7006_DISPMODE_SCALING_RATIO, scale) | \
+			    bitfs(CH7006_DISPMODE_INPUT_RES, e_hd##x##e_vd), \
+		.valid_scales = scale_mask,				\
+		.valid_norms = norm_mask				\
+	 }
+
+#define MODE(f, hd, vd, ht, vt, hsynp, vsynp,				\
+	     subc, scale, scale_mask, norm_mask)			\
+	__MODE(f, hd, vd, ht, vt, hsynp, vsynp, subc, scale,		\
+	       scale_mask, norm_mask, hd, vd)
+
+#define NTSC_LIKE (1 << TV_NORM_NTSC_M | 1 << TV_NORM_NTSC_J |		\
+		   1 << TV_NORM_PAL_M | 1 << TV_NORM_PAL_60)
+
+#define PAL_LIKE (1 << TV_NORM_PAL | 1 << TV_NORM_PAL_N | 1 << TV_NORM_PAL_NC)
+
+struct ch7006_mode ch7006_modes[] = {
+	MODE(21000, 512, 384, 840, 500, N, N, 181.797557582, 5_4, 0x6, PAL_LIKE),
+	MODE(26250, 512, 384, 840, 625, N, N, 145.438046066, 1_1, 0x1, PAL_LIKE),
+	MODE(20140, 512, 384, 800, 420, N, N, 213.257083791, 5_4, 0x4, NTSC_LIKE),
+	MODE(24671, 512, 384, 784, 525, N, N, 174.0874153, 1_1, 0x3, NTSC_LIKE),
+	MODE(28125, 720, 400, 1125, 500, N, N, 135.742176298, 5_4, 0x6, PAL_LIKE),
+	MODE(34875, 720, 400, 1116, 625, N, N, 109.469496898, 1_1, 0x1, PAL_LIKE),
+	MODE(23790, 720, 400, 945, 420, N, N, 160.475642016, 5_4, 0x4, NTSC_LIKE),
+	MODE(29455, 720, 400, 936, 525, N, N, 129.614941843, 1_1, 0x3, NTSC_LIKE),
+	MODE(25000, 640, 400, 1000, 500, N, N, 152.709948279, 5_4, 0x6, PAL_LIKE),
+	MODE(31500, 640, 400, 1008, 625, N, N, 121.198371646, 1_1, 0x1, PAL_LIKE),
+	MODE(21147, 640, 400, 840, 420, N, N, 180.535097338, 5_4, 0x4, NTSC_LIKE),
+	MODE(26434, 640, 400, 840, 525, N, N, 144.42807787, 1_1, 0x2, NTSC_LIKE),
+	MODE(30210, 640, 400, 840, 600, N, N, 126.374568276, 7_8, 0x1, NTSC_LIKE),
+	MODE(21000, 640, 480, 840, 500, N, N, 181.797557582, 5_4, 0x4, PAL_LIKE),
+	MODE(26250, 640, 480, 840, 625, N, N, 145.438046066, 1_1, 0x2, PAL_LIKE),
+	MODE(31500, 640, 480, 840, 750, N, N, 121.198371646, 5_6, 0x1, PAL_LIKE),
+	MODE(24671, 640, 480, 784, 525, N, N, 174.0874153, 1_1, 0x4, NTSC_LIKE),
+	MODE(28196, 640, 480, 784, 600, N, N, 152.326488422, 7_8, 0x2, NTSC_LIKE),
+	MODE(30210, 640, 480, 800, 630, N, N, 142.171389101, 5_6, 0x1, NTSC_LIKE),
+	__MODE(29500, 720, 576, 944, 625, P, P, 145.592111636, 1_1, 0x7, PAL_LIKE, 800, 600),
+	MODE(36000, 800, 600, 960, 750, P, P, 119.304647022, 5_6, 0x6, PAL_LIKE),
+	MODE(39000, 800, 600, 936, 836, P, P, 110.127366499, 3_4, 0x1, PAL_LIKE),
+	MODE(39273, 800, 600, 1040, 630, P, P, 145.816809399, 5_6, 0x4, NTSC_LIKE),
+	MODE(43636, 800, 600, 1040, 700, P, P, 131.235128487, 3_4, 0x2, NTSC_LIKE),
+	MODE(47832, 800, 600, 1064, 750, P, P, 119.723275165, 7_10, 0x1, NTSC_LIKE),
+	{}
+};
+
+struct ch7006_mode *ch7006_lookup_mode(struct drm_encoder *encoder,
+				       struct drm_display_mode *drm_mode)
+{
+	struct ch7006_priv *priv = to_ch7006_priv(encoder);
+	struct ch7006_mode *mode;
+
+	for (mode = ch7006_modes; mode->mode.clock; mode++) {
+
+		if (~mode->valid_norms & 1<<priv->norm)
+			continue;
+
+		if (mode->mode.hdisplay != drm_mode->hdisplay ||
+		    mode->mode.vdisplay != drm_mode->vdisplay ||
+		    mode->mode.vtotal != drm_mode->vtotal ||
+		    mode->mode.htotal != drm_mode->htotal ||
+		    mode->mode.clock != drm_mode->clock)
+			continue;
+
+		return mode;
+	}
+
+	return NULL;
+}
+
+/* Some common HW state calculation code */
+
+void ch7006_setup_levels(struct drm_encoder *encoder)
+{
+	struct i2c_client *client = drm_i2c_encoder_get_client(encoder);
+	struct ch7006_priv *priv = to_ch7006_priv(encoder);
+	uint8_t *regs = priv->state.regs;
+	struct ch7006_tv_norm_info *norm = &ch7006_tv_norms[priv->norm];
+	int gain;
+	int black_level;
+
+	/* Set DAC_GAIN if the voltage drop between white and black is
+	 * high enough. */
+	if (norm->black_level < 339*fixed1/1000) {
+		gain = 76;
+
+		regs[CH7006_INPUT_FORMAT] |= CH7006_INPUT_FORMAT_DAC_GAIN;
+	} else {
+		gain = 71;
+
+		regs[CH7006_INPUT_FORMAT] &= ~CH7006_INPUT_FORMAT_DAC_GAIN;
+	}
+
+	black_level = round_fixed(norm->black_level*26625)/gain;
+
+	/* Correct it with the specified brightness. */
+	black_level = interpolate(90, black_level, 208, priv->brightness);
+
+	regs[CH7006_BLACK_LEVEL] = bitf(CH7006_BLACK_LEVEL_0, black_level);
+
+	ch7006_dbg(client, "black level: %d\n", black_level);
+}
+
+void ch7006_setup_subcarrier(struct drm_encoder *encoder)
+{
+	struct i2c_client *client = drm_i2c_encoder_get_client(encoder);
+	struct ch7006_priv *priv = to_ch7006_priv(encoder);
+	struct ch7006_state *state = &priv->state;
+	struct ch7006_tv_norm_info *norm = &ch7006_tv_norms[priv->norm];
+	struct ch7006_mode *mode = priv->mode;
+	uint32_t subc_inc;
+
+	subc_inc = round_fixed((mode->subc_coeff >> 8)
+			       * (norm->subc_freq >> 24));
+
+	setbitf(state, CH7006_SUBC_INC0, 28, subc_inc);
+	setbitf(state, CH7006_SUBC_INC1, 24, subc_inc);
+	setbitf(state, CH7006_SUBC_INC2, 20, subc_inc);
+	setbitf(state, CH7006_SUBC_INC3, 16, subc_inc);
+	setbitf(state, CH7006_SUBC_INC4, 12, subc_inc);
+	setbitf(state, CH7006_SUBC_INC5, 8, subc_inc);
+	setbitf(state, CH7006_SUBC_INC6, 4, subc_inc);
+	setbitf(state, CH7006_SUBC_INC7, 0, subc_inc);
+
+	ch7006_dbg(client, "subcarrier inc: %u\n", subc_inc);
+}
+
+void ch7006_setup_pll(struct drm_encoder *encoder)
+{
+	struct i2c_client *client = drm_i2c_encoder_get_client(encoder);
+	struct ch7006_priv *priv = to_ch7006_priv(encoder);
+	uint8_t *regs = priv->state.regs;
+	struct ch7006_mode *mode = priv->mode;
+	int n, best_n = 0;
+	int m, best_m = 0;
+	int freq, best_freq = 0;
+
+	for (n = 0; n < CH7006_MAXN; n++) {
+		for (m = 0; m < CH7006_MAXM; m++) {
+			freq = CH7006_FREQ0*(n+2)/(m+2);
+
+			if (abs(freq - mode->mode.clock) <
+			    abs(best_freq - mode->mode.clock)) {
+				best_freq = freq;
+				best_n = n;
+				best_m = m;
+			}
+		}
+	}
+
+	regs[CH7006_PLLOV] = bitf(CH7006_PLLOV_N_8, best_n) |
+		bitf(CH7006_PLLOV_M_8, best_m);
+
+	regs[CH7006_PLLM] = bitf(CH7006_PLLM_0, best_m);
+	regs[CH7006_PLLN] = bitf(CH7006_PLLN_0, best_n);
+
+	if (best_n < 108)
+		regs[CH7006_PLL_CONTROL] |= CH7006_PLL_CONTROL_CAPACITOR;
+	else
+		regs[CH7006_PLL_CONTROL] &= ~CH7006_PLL_CONTROL_CAPACITOR;
+
+	ch7006_dbg(client, "n=%d m=%d f=%d c=%d\n",
+		   best_n, best_m, best_freq, best_n < 108);
+}
+
+void ch7006_setup_power_state(struct drm_encoder *encoder)
+{
+	struct ch7006_priv *priv = to_ch7006_priv(encoder);
+	uint8_t *power = &priv->state.regs[CH7006_POWER];
+	int subconnector;
+
+	subconnector = priv->select_subconnector ? priv->select_subconnector :
+							priv->subconnector;
+
+	*power = CH7006_POWER_RESET;
+
+	if (priv->last_dpms == DRM_MODE_DPMS_ON) {
+		switch (subconnector) {
+		case DRM_MODE_SUBCONNECTOR_SVIDEO:
+			*power |= bitfs(CH7006_POWER_LEVEL, CVBS_OFF);
+			break;
+		case DRM_MODE_SUBCONNECTOR_Composite:
+			*power |= bitfs(CH7006_POWER_LEVEL, SVIDEO_OFF);
+			break;
+		case DRM_MODE_SUBCONNECTOR_SCART:
+			*power |= bitfs(CH7006_POWER_LEVEL, NORMAL) |
+				CH7006_POWER_SCART;
+			break;
+		}
+
+	} else {
+		*power |= bitfs(CH7006_POWER_LEVEL, FULL_POWER_OFF);
+	}
+}
+
+void ch7006_setup_properties(struct drm_encoder *encoder)
+{
+	struct i2c_client *client = drm_i2c_encoder_get_client(encoder);
+	struct ch7006_priv *priv = to_ch7006_priv(encoder);
+	struct ch7006_state *state = &priv->state;
+	struct ch7006_tv_norm_info *norm = &ch7006_tv_norms[priv->norm];
+	struct ch7006_mode *ch_mode = priv->mode;
+	struct drm_display_mode *mode = &ch_mode->mode;
+	uint8_t *regs = state->regs;
+	int flicker, contrast, hpos, vpos;
+	uint64_t scale, aspect;
+
+	flicker = interpolate(0, 2, 3, priv->flicker);
+	regs[CH7006_FFILTER] = bitf(CH7006_FFILTER_TEXT, flicker) |
+		bitf(CH7006_FFILTER_LUMA, flicker) |
+		bitf(CH7006_FFILTER_CHROMA, 1);
+
+	contrast = interpolate(0, 5, 7, priv->contrast);
+	regs[CH7006_CONTRAST] = bitf(CH7006_CONTRAST_0, contrast);
+
+	scale = norm->vtotal*fixed1;
+	do_div(scale, mode->vtotal);
+
+	aspect = ch_mode->enc_hdisp*fixed1;
+	do_div(aspect, ch_mode->enc_vdisp);
+
+	hpos = round_fixed((norm->hvirtual * aspect - mode->hdisplay * scale)
+			   * priv->hmargin * mode->vtotal) / norm->vtotal / 100 / 4;
+
+	setbitf(state, CH7006_POV, HPOS_8, hpos);
+	setbitf(state, CH7006_HPOS, 0, hpos);
+
+	vpos = max(0, norm->vdisplay - round_fixed(mode->vdisplay*scale)
+		   + norm->voffset) * priv->vmargin / 100 / 2;
+
+	setbitf(state, CH7006_POV, VPOS_8, vpos);
+	setbitf(state, CH7006_VPOS, 0, vpos);
+
+	ch7006_dbg(client, "hpos: %d, vpos: %d\n", hpos, vpos);
+}
+
+/* HW access functions */
+
+void ch7006_write(struct i2c_client *client, uint8_t addr, uint8_t val)
+{
+	uint8_t buf[] = {addr, val};
+	int ret;
+
+	ret = i2c_master_send(client, buf, ARRAY_SIZE(buf));
+	if (ret < 0)
+		ch7006_err(client, "Error %d writing to subaddress 0x%x\n",
+			   ret, addr);
+}
+
+uint8_t ch7006_read(struct i2c_client *client, uint8_t addr)
+{
+	uint8_t val;
+	int ret;
+
+	ret = i2c_master_send(client, &addr, sizeof(addr));
+	if (ret < 0)
+		goto fail;
+
+	ret = i2c_master_recv(client, &val, sizeof(val));
+	if (ret < 0)
+		goto fail;
+
+	return val;
+
+fail:
+	ch7006_err(client, "Error %d reading from subaddress 0x%x\n",
+		   ret, addr);
+	return 0;
+}
+
+void ch7006_state_load(struct i2c_client *client,
+		       struct ch7006_state *state)
+{
+	ch7006_load_reg(client, state, CH7006_POWER);
+
+	ch7006_load_reg(client, state, CH7006_DISPMODE);
+	ch7006_load_reg(client, state, CH7006_FFILTER);
+	ch7006_load_reg(client, state, CH7006_BWIDTH);
+	ch7006_load_reg(client, state, CH7006_INPUT_FORMAT);
+	ch7006_load_reg(client, state, CH7006_CLKMODE);
+	ch7006_load_reg(client, state, CH7006_START_ACTIVE);
+	ch7006_load_reg(client, state, CH7006_POV);
+	ch7006_load_reg(client, state, CH7006_BLACK_LEVEL);
+	ch7006_load_reg(client, state, CH7006_HPOS);
+	ch7006_load_reg(client, state, CH7006_VPOS);
+	ch7006_load_reg(client, state, CH7006_INPUT_SYNC);
+	ch7006_load_reg(client, state, CH7006_DETECT);
+	ch7006_load_reg(client, state, CH7006_CONTRAST);
+	ch7006_load_reg(client, state, CH7006_PLLOV);
+	ch7006_load_reg(client, state, CH7006_PLLM);
+	ch7006_load_reg(client, state, CH7006_PLLN);
+	ch7006_load_reg(client, state, CH7006_BCLKOUT);
+	ch7006_load_reg(client, state, CH7006_SUBC_INC0);
+	ch7006_load_reg(client, state, CH7006_SUBC_INC1);
+	ch7006_load_reg(client, state, CH7006_SUBC_INC2);
+	ch7006_load_reg(client, state, CH7006_SUBC_INC3);
+	ch7006_load_reg(client, state, CH7006_SUBC_INC4);
+	ch7006_load_reg(client, state, CH7006_SUBC_INC5);
+	ch7006_load_reg(client, state, CH7006_SUBC_INC6);
+	ch7006_load_reg(client, state, CH7006_SUBC_INC7);
+	ch7006_load_reg(client, state, CH7006_PLL_CONTROL);
+	ch7006_load_reg(client, state, CH7006_CALC_SUBC_INC0);
+}
+
+void ch7006_state_save(struct i2c_client *client,
+		       struct ch7006_state *state)
+{
+	ch7006_save_reg(client, state, CH7006_POWER);
+
+	ch7006_save_reg(client, state, CH7006_DISPMODE);
+	ch7006_save_reg(client, state, CH7006_FFILTER);
+	ch7006_save_reg(client, state, CH7006_BWIDTH);
+	ch7006_save_reg(client, state, CH7006_INPUT_FORMAT);
+	ch7006_save_reg(client, state, CH7006_CLKMODE);
+	ch7006_save_reg(client, state, CH7006_START_ACTIVE);
+	ch7006_save_reg(client, state, CH7006_POV);
+	ch7006_save_reg(client, state, CH7006_BLACK_LEVEL);
+	ch7006_save_reg(client, state, CH7006_HPOS);
+	ch7006_save_reg(client, state, CH7006_VPOS);
+	ch7006_save_reg(client, state, CH7006_INPUT_SYNC);
+	ch7006_save_reg(client, state, CH7006_DETECT);
+	ch7006_save_reg(client, state, CH7006_CONTRAST);
+	ch7006_save_reg(client, state, CH7006_PLLOV);
+	ch7006_save_reg(client, state, CH7006_PLLM);
+	ch7006_save_reg(client, state, CH7006_PLLN);
+	ch7006_save_reg(client, state, CH7006_BCLKOUT);
+	ch7006_save_reg(client, state, CH7006_SUBC_INC0);
+	ch7006_save_reg(client, state, CH7006_SUBC_INC1);
+	ch7006_save_reg(client, state, CH7006_SUBC_INC2);
+	ch7006_save_reg(client, state, CH7006_SUBC_INC3);
+	ch7006_save_reg(client, state, CH7006_SUBC_INC4);
+	ch7006_save_reg(client, state, CH7006_SUBC_INC5);
+	ch7006_save_reg(client, state, CH7006_SUBC_INC6);
+	ch7006_save_reg(client, state, CH7006_SUBC_INC7);
+	ch7006_save_reg(client, state, CH7006_PLL_CONTROL);
+	ch7006_save_reg(client, state, CH7006_CALC_SUBC_INC0);
+
+	state->regs[CH7006_FFILTER] = (state->regs[CH7006_FFILTER] & 0xf0) |
+		(state->regs[CH7006_FFILTER] & 0x0c) >> 2 |
+		(state->regs[CH7006_FFILTER] & 0x03) << 2;
+}
diff --git a/drivers/gpu/drm/i2c/ch7006_priv.h b/drivers/gpu/drm/i2c/ch7006_priv.h
new file mode 100644
index 000000000000..b06d3d93d8ac
--- /dev/null
+++ b/drivers/gpu/drm/i2c/ch7006_priv.h
@@ -0,0 +1,344 @@
+/*
+ * Copyright (C) 2009 Francisco Jerez.
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial
+ * portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE COPYRIGHT OWNER(S) AND/OR ITS SUPPLIERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
+#ifndef __DRM_I2C_CH7006_PRIV_H__
+#define __DRM_I2C_CH7006_PRIV_H__
+
+#include "drmP.h"
+#include "drm_crtc_helper.h"
+#include "drm_encoder_slave.h"
+#include "i2c/ch7006.h"
+
+typedef int64_t fixed;
+#define fixed1 (1LL << 32)
+
+enum ch7006_tv_norm {
+	TV_NORM_PAL,
+	TV_NORM_PAL_M,
+	TV_NORM_PAL_N,
+	TV_NORM_PAL_NC,
+	TV_NORM_PAL_60,
+	TV_NORM_NTSC_M,
+	TV_NORM_NTSC_J,
+	NUM_TV_NORMS
+};
+
+struct ch7006_tv_norm_info {
+	fixed vrefresh;
+	int vdisplay;
+	int vtotal;
+	int hvirtual;
+
+	fixed subc_freq;
+	fixed black_level;
+
+	uint32_t dispmode;
+	int voffset;
+};
+
+struct ch7006_mode {
+	struct drm_display_mode mode;
+
+	int enc_hdisp;
+	int enc_vdisp;
+
+	fixed subc_coeff;
+	uint32_t dispmode;
+
+	uint32_t valid_scales;
+	uint32_t valid_norms;
+};
+
+struct ch7006_state {
+	uint8_t regs[0x26];
+};
+
+struct ch7006_priv {
+	struct ch7006_encoder_params *params;
+	struct ch7006_mode *mode;
+
+	struct ch7006_state state;
+	struct ch7006_state saved_state;
+
+	struct drm_property *scale_property;
+
+	int select_subconnector;
+	int subconnector;
+	int hmargin;
+	int vmargin;
+	enum ch7006_tv_norm norm;
+	int brightness;
+	int contrast;
+	int flicker;
+	int scale;
+
+	int last_dpms;
+};
+
+#define to_ch7006_priv(x) \
+	((struct ch7006_priv *)to_encoder_slave(x)->slave_priv)
+
+extern int ch7006_debug;
+extern char *ch7006_tv_norm;
+extern int ch7006_scale;
+
+extern char *ch7006_tv_norm_names[];
+extern struct ch7006_tv_norm_info ch7006_tv_norms[];
+extern struct ch7006_mode ch7006_modes[];
+
+struct ch7006_mode *ch7006_lookup_mode(struct drm_encoder *encoder,
+				       struct drm_display_mode *drm_mode);
+
+void ch7006_setup_levels(struct drm_encoder *encoder);
+void ch7006_setup_subcarrier(struct drm_encoder *encoder);
+void ch7006_setup_pll(struct drm_encoder *encoder);
+void ch7006_setup_power_state(struct drm_encoder *encoder);
+void ch7006_setup_properties(struct drm_encoder *encoder);
+
+void ch7006_write(struct i2c_client *client, uint8_t addr, uint8_t val);
+uint8_t ch7006_read(struct i2c_client *client, uint8_t addr);
+
+void ch7006_state_load(struct i2c_client *client,
+		       struct ch7006_state *state);
+void ch7006_state_save(struct i2c_client *client,
+		       struct ch7006_state *state);
+
+/* Some helper macros */
+
+#define ch7006_dbg(client, format, ...) do {				\
+		if (ch7006_debug)					\
+			dev_printk(KERN_DEBUG, &client->dev,		\
+				   "%s: " format, __func__, ## __VA_ARGS__); \
+	} while (0)
+#define ch7006_info(client, format, ...) \
+				dev_info(&client->dev, format, __VA_ARGS__)
+#define ch7006_err(client, format, ...) \
+				dev_err(&client->dev, format, __VA_ARGS__)
+
+#define __mask(src, bitfield) \
+		(((2 << (1 ? bitfield)) - 1) & ~((1 << (0 ? bitfield)) - 1))
+#define mask(bitfield) __mask(bitfield)
+
+#define __bitf(src, bitfield, x) \
+		(((x) >> (src) << (0 ? bitfield)) &  __mask(src, bitfield))
+#define bitf(bitfield, x) __bitf(bitfield, x)
+#define bitfs(bitfield, s) __bitf(bitfield, bitfield##_##s)
+#define setbitf(state, reg, bitfield, x)				\
+	state->regs[reg] = (state->regs[reg] & ~mask(reg##_##bitfield))	\
+		| bitf(reg##_##bitfield, x)
+
+#define __unbitf(src, bitfield, x) \
+		((x & __mask(src, bitfield)) >> (0 ? bitfield) << (src))
+#define unbitf(bitfield, x) __unbitf(bitfield, x)
+
+static inline int interpolate(int y0, int y1, int y2, int x)
+{
+	return y1 + (x < 50 ? y1 - y0 : y2 - y1) * (x - 50) / 50;
+}
+
+static inline int32_t round_fixed(fixed x)
+{
+	return (x + fixed1/2) >> 32;
+}
+
+#define ch7006_load_reg(client, state, reg) ch7006_write(client, reg, state->regs[reg])
+#define ch7006_save_reg(client, state, reg) state->regs[reg] = ch7006_read(client, reg)
+
+/* Fixed hardware specs */
+
+#define CH7006_FREQ0				14318
+#define CH7006_MAXN				650
+#define CH7006_MAXM				315
+
+/* Register definitions */
+
+#define CH7006_DISPMODE				0x00
+#define CH7006_DISPMODE_INPUT_RES		0, 7:5
+#define CH7006_DISPMODE_INPUT_RES_512x384	0x0
+#define CH7006_DISPMODE_INPUT_RES_720x400	0x1
+#define CH7006_DISPMODE_INPUT_RES_640x400	0x2
+#define CH7006_DISPMODE_INPUT_RES_640x480	0x3
+#define CH7006_DISPMODE_INPUT_RES_800x600	0x4
+#define CH7006_DISPMODE_INPUT_RES_NATIVE	0x5
+#define CH7006_DISPMODE_OUTPUT_STD		0, 4:3
+#define CH7006_DISPMODE_OUTPUT_STD_PAL		0x0
+#define CH7006_DISPMODE_OUTPUT_STD_NTSC		0x1
+#define CH7006_DISPMODE_OUTPUT_STD_PAL_M	0x2
+#define CH7006_DISPMODE_OUTPUT_STD_NTSC_J	0x3
+#define CH7006_DISPMODE_SCALING_RATIO		0, 2:0
+#define CH7006_DISPMODE_SCALING_RATIO_5_4	0x0
+#define CH7006_DISPMODE_SCALING_RATIO_1_1	0x1
+#define CH7006_DISPMODE_SCALING_RATIO_7_8	0x2
+#define CH7006_DISPMODE_SCALING_RATIO_5_6	0x3
+#define CH7006_DISPMODE_SCALING_RATIO_3_4	0x4
+#define CH7006_DISPMODE_SCALING_RATIO_7_10	0x5
+
+#define CH7006_FFILTER				0x01
+#define CH7006_FFILTER_TEXT			0, 5:4
+#define CH7006_FFILTER_LUMA			0, 3:2
+#define CH7006_FFILTER_CHROMA			0, 1:0
+#define CH7006_FFILTER_CHROMA_NO_DCRAWL		0x3
+
+#define CH7006_BWIDTH				0x03
+#define CH7006_BWIDTH_5L_FFILER			(1 << 7)
+#define CH7006_BWIDTH_CVBS_NO_CHROMA		(1 << 6)
+#define CH7006_BWIDTH_CHROMA			0, 5:4
+#define CH7006_BWIDTH_SVIDEO_YPEAK		(1 << 3)
+#define CH7006_BWIDTH_SVIDEO_LUMA		0, 2:1
+#define CH7006_BWIDTH_CVBS_LUMA			0, 0:0
+
+#define CH7006_INPUT_FORMAT			0x04
+#define CH7006_INPUT_FORMAT_DAC_GAIN		(1 << 6)
+#define CH7006_INPUT_FORMAT_RGB_PASS_THROUGH	(1 << 5)
+#define CH7006_INPUT_FORMAT_FORMAT		0, 3:0
+#define CH7006_INPUT_FORMAT_FORMAT_RGB16	0x0
+#define CH7006_INPUT_FORMAT_FORMAT_YCrCb24m16	0x1
+#define CH7006_INPUT_FORMAT_FORMAT_RGB24m16	0x2
+#define CH7006_INPUT_FORMAT_FORMAT_RGB15	0x3
+#define CH7006_INPUT_FORMAT_FORMAT_RGB24m12C	0x4
+#define CH7006_INPUT_FORMAT_FORMAT_RGB24m12I	0x5
+#define CH7006_INPUT_FORMAT_FORMAT_RGB24m8	0x6
+#define CH7006_INPUT_FORMAT_FORMAT_RGB16m8	0x7
+#define CH7006_INPUT_FORMAT_FORMAT_RGB15m8	0x8
+#define CH7006_INPUT_FORMAT_FORMAT_YCrCb24m8	0x9
+
+#define CH7006_CLKMODE				0x06
+#define CH7006_CLKMODE_SUBC_LOCK		(1 << 7)
+#define CH7006_CLKMODE_MASTER			(1 << 6)
+#define CH7006_CLKMODE_POS_EDGE			(1 << 4)
+#define CH7006_CLKMODE_XCM			0, 3:2
+#define CH7006_CLKMODE_PCM			0, 1:0
+
+#define CH7006_START_ACTIVE			0x07
+#define CH7006_START_ACTIVE_0			0, 7:0
+
+#define CH7006_POV				0x08
+#define CH7006_POV_START_ACTIVE_8		8, 2:2
+#define CH7006_POV_HPOS_8			8, 1:1
+#define CH7006_POV_VPOS_8			8, 0:0
+
+#define CH7006_BLACK_LEVEL			0x09
+#define CH7006_BLACK_LEVEL_0			0, 7:0
+
+#define CH7006_HPOS				0x0a
+#define CH7006_HPOS_0				0, 7:0
+
+#define CH7006_VPOS				0x0b
+#define CH7006_VPOS_0				0, 7:0
+
+#define CH7006_INPUT_SYNC			0x0d
+#define CH7006_INPUT_SYNC_EMBEDDED		(1 << 3)
+#define CH7006_INPUT_SYNC_OUTPUT		(1 << 2)
+#define CH7006_INPUT_SYNC_PVSYNC		(1 << 1)
+#define CH7006_INPUT_SYNC_PHSYNC		(1 << 0)
+
+#define CH7006_POWER				0x0e
+#define CH7006_POWER_SCART			(1 << 4)
+#define CH7006_POWER_RESET			(1 << 3)
+#define CH7006_POWER_LEVEL			0, 2:0
+#define CH7006_POWER_LEVEL_CVBS_OFF		0x0
+#define CH7006_POWER_LEVEL_POWER_OFF		0x1
+#define CH7006_POWER_LEVEL_SVIDEO_OFF		0x2
+#define CH7006_POWER_LEVEL_NORMAL		0x3
+#define CH7006_POWER_LEVEL_FULL_POWER_OFF	0x4
+
+#define CH7006_DETECT				0x10
+#define CH7006_DETECT_SVIDEO_Y_TEST		(1 << 3)
+#define CH7006_DETECT_SVIDEO_C_TEST		(1 << 2)
+#define CH7006_DETECT_CVBS_TEST			(1 << 1)
+#define CH7006_DETECT_SENSE			(1 << 0)
+
+#define CH7006_CONTRAST				0x11
+#define CH7006_CONTRAST_0			0, 2:0
+
+#define CH7006_PLLOV	 			0x13
+#define CH7006_PLLOV_N_8	 		8, 2:1
+#define CH7006_PLLOV_M_8	 		8, 0:0
+
+#define CH7006_PLLM	 			0x14
+#define CH7006_PLLM_0	 			0, 7:0
+
+#define CH7006_PLLN	 			0x15
+#define CH7006_PLLN_0	 			0, 7:0
+
+#define CH7006_BCLKOUT	 			0x17
+
+#define CH7006_SUBC_INC0			0x18
+#define CH7006_SUBC_INC0_28			28, 3:0
+
+#define CH7006_SUBC_INC1			0x19
+#define CH7006_SUBC_INC1_24			24, 3:0
+
+#define CH7006_SUBC_INC2			0x1a
+#define CH7006_SUBC_INC2_20			20, 3:0
+
+#define CH7006_SUBC_INC3			0x1b
+#define CH7006_SUBC_INC3_GPIO1_VAL		(1 << 7)
+#define CH7006_SUBC_INC3_GPIO0_VAL		(1 << 6)
+#define CH7006_SUBC_INC3_POUT_3_3V		(1 << 5)
+#define CH7006_SUBC_INC3_POUT_INV		(1 << 4)
+#define CH7006_SUBC_INC3_16			16, 3:0
+
+#define CH7006_SUBC_INC4			0x1c
+#define CH7006_SUBC_INC4_GPIO1_IN		(1 << 7)
+#define CH7006_SUBC_INC4_GPIO0_IN		(1 << 6)
+#define CH7006_SUBC_INC4_DS_INPUT		(1 << 4)
+#define CH7006_SUBC_INC4_12			12, 3:0
+
+#define CH7006_SUBC_INC5			0x1d
+#define CH7006_SUBC_INC5_8			8, 3:0
+
+#define CH7006_SUBC_INC6			0x1e
+#define CH7006_SUBC_INC6_4			4, 3:0
+
+#define CH7006_SUBC_INC7			0x1f
+#define CH7006_SUBC_INC7_0			0, 3:0
+
+#define CH7006_PLL_CONTROL			0x20
+#define CH7006_PLL_CONTROL_CPI			(1 << 5)
+#define CH7006_PLL_CONTROL_CAPACITOR		(1 << 4)
+#define CH7006_PLL_CONTROL_7STAGES		(1 << 3)
+#define CH7006_PLL_CONTROL_DIGITAL_5V		(1 << 2)
+#define CH7006_PLL_CONTROL_ANALOG_5V		(1 << 1)
+#define CH7006_PLL_CONTROL_MEMORY_5V		(1 << 0)
+
+#define CH7006_CALC_SUBC_INC0			0x21
+#define CH7006_CALC_SUBC_INC0_24		24, 4:3
+#define CH7006_CALC_SUBC_INC0_HYST		0, 2:1
+#define CH7006_CALC_SUBC_INC0_AUTO		(1 << 0)
+
+#define CH7006_CALC_SUBC_INC1			0x22
+#define CH7006_CALC_SUBC_INC1_16		16, 7:0
+
+#define CH7006_CALC_SUBC_INC2			0x23
+#define CH7006_CALC_SUBC_INC2_8			8, 7:0
+
+#define CH7006_CALC_SUBC_INC3			0x24
+#define CH7006_CALC_SUBC_INC3_0			0, 7:0
+
+#define CH7006_VERSION_ID			0x25
+
+#endif
diff --git a/drivers/gpu/drm/i810/i810_dma.c b/drivers/gpu/drm/i810/i810_dma.c
index 7d1d88cdf2dc..de32d22a8c39 100644
--- a/drivers/gpu/drm/i810/i810_dma.c
+++ b/drivers/gpu/drm/i810/i810_dma.c
@@ -115,7 +115,7 @@ static int i810_mmap_buffers(struct file *filp, struct vm_area_struct *vma)
 static const struct file_operations i810_buffer_fops = {
 	.open = drm_open,
 	.release = drm_release,
-	.ioctl = drm_ioctl,
+	.unlocked_ioctl = drm_ioctl,
 	.mmap = i810_mmap_buffers,
 	.fasync = drm_fasync,
 };
diff --git a/drivers/gpu/drm/i810/i810_drv.c b/drivers/gpu/drm/i810/i810_drv.c
index fabb9a817966..c1e02752e023 100644
--- a/drivers/gpu/drm/i810/i810_drv.c
+++ b/drivers/gpu/drm/i810/i810_drv.c
@@ -59,7 +59,7 @@ static struct drm_driver driver = {
 		 .owner = THIS_MODULE,
 		 .open = drm_open,
 		 .release = drm_release,
-		 .ioctl = drm_ioctl,
+		 .unlocked_ioctl = drm_ioctl,
 		 .mmap = drm_mmap,
 		 .poll = drm_poll,
 		 .fasync = drm_fasync,
diff --git a/drivers/gpu/drm/i830/i830_dma.c b/drivers/gpu/drm/i830/i830_dma.c
index 877bf6cb14a4..06bd732e6463 100644
--- a/drivers/gpu/drm/i830/i830_dma.c
+++ b/drivers/gpu/drm/i830/i830_dma.c
@@ -117,7 +117,7 @@ static int i830_mmap_buffers(struct file *filp, struct vm_area_struct *vma)
 static const struct file_operations i830_buffer_fops = {
 	.open = drm_open,
 	.release = drm_release,
-	.ioctl = drm_ioctl,
+	.unlocked_ioctl = drm_ioctl,
 	.mmap = i830_mmap_buffers,
 	.fasync = drm_fasync,
 };
diff --git a/drivers/gpu/drm/i830/i830_drv.c b/drivers/gpu/drm/i830/i830_drv.c
index 389597e4a623..44f990bed8f4 100644
--- a/drivers/gpu/drm/i830/i830_drv.c
+++ b/drivers/gpu/drm/i830/i830_drv.c
@@ -70,7 +70,7 @@ static struct drm_driver driver = {
 		 .owner = THIS_MODULE,
 		 .open = drm_open,
 		 .release = drm_release,
-		 .ioctl = drm_ioctl,
+		 .unlocked_ioctl = drm_ioctl,
 		 .mmap = drm_mmap,
 		 .poll = drm_poll,
 		 .fasync = drm_fasync,
diff --git a/drivers/gpu/drm/i915/Makefile b/drivers/gpu/drm/i915/Makefile
index fa7b9be096bc..9929f84ec3e1 100644
--- a/drivers/gpu/drm/i915/Makefile
+++ b/drivers/gpu/drm/i915/Makefile
@@ -15,7 +15,6 @@ i915-y := i915_drv.o i915_dma.o i915_irq.o i915_mem.o \
 	  intel_lvds.o \
 	  intel_bios.o \
 	  intel_dp.o \
-	  intel_dp_i2c.o \
 	  intel_hdmi.o \
 	  intel_sdvo.o \
 	  intel_modes.o \
@@ -23,6 +22,7 @@ i915-y := i915_drv.o i915_dma.o i915_irq.o i915_mem.o \
 	  intel_fb.o \
 	  intel_tv.o \
 	  intel_dvo.o \
+	  intel_overlay.o \
 	  dvo_ch7xxx.o \
 	  dvo_ch7017.o \
 	  dvo_ivch.o \
diff --git a/drivers/gpu/drm/i915/dvo_ch7017.c b/drivers/gpu/drm/i915/dvo_ch7017.c
index 621815b531db..1184c14ba87d 100644
--- a/drivers/gpu/drm/i915/dvo_ch7017.c
+++ b/drivers/gpu/drm/i915/dvo_ch7017.c
@@ -249,7 +249,8 @@ static bool ch7017_init(struct intel_dvo_device *dvo,
 	if (val != CH7017_DEVICE_ID_VALUE &&
 	    val != CH7018_DEVICE_ID_VALUE &&
 	    val != CH7019_DEVICE_ID_VALUE) {
-		DRM_DEBUG("ch701x not detected, got %d: from %s Slave %d.\n",
+		DRM_DEBUG_KMS("ch701x not detected, got %d: from %s "
+				"Slave %d.\n",
 			  val, i2cbus->adapter.name,dvo->slave_addr);
 		goto fail;
 	}
@@ -284,7 +285,7 @@ static void ch7017_mode_set(struct intel_dvo_device *dvo,
 	uint8_t horizontal_active_pixel_output, vertical_active_line_output;
 	uint8_t active_input_line_output;
 
-	DRM_DEBUG("Registers before mode setting\n");
+	DRM_DEBUG_KMS("Registers before mode setting\n");
 	ch7017_dump_regs(dvo);
 
 	/* LVDS PLL settings from page 75 of 7017-7017ds.pdf*/
@@ -346,7 +347,7 @@ static void ch7017_mode_set(struct intel_dvo_device *dvo,
 	/* Turn the LVDS back on with new settings. */
 	ch7017_write(dvo, CH7017_LVDS_POWER_DOWN, lvds_power_down);
 
-	DRM_DEBUG("Registers after mode setting\n");
+	DRM_DEBUG_KMS("Registers after mode setting\n");
 	ch7017_dump_regs(dvo);
 }
 
@@ -386,7 +387,7 @@ static void ch7017_dump_regs(struct intel_dvo_device *dvo)
 #define DUMP(reg)					\
 do {							\
 	ch7017_read(dvo, reg, &val);			\
-	DRM_DEBUG(#reg ": %02x\n", val);		\
+	DRM_DEBUG_KMS(#reg ": %02x\n", val);		\
 } while (0)
 
 	DUMP(CH7017_HORIZONTAL_ACTIVE_PIXEL_INPUT);
diff --git a/drivers/gpu/drm/i915/dvo_ch7xxx.c b/drivers/gpu/drm/i915/dvo_ch7xxx.c
index a9b896289680..d56ff5cc22b2 100644
--- a/drivers/gpu/drm/i915/dvo_ch7xxx.c
+++ b/drivers/gpu/drm/i915/dvo_ch7xxx.c
@@ -152,7 +152,7 @@ static bool ch7xxx_readb(struct intel_dvo_device *dvo, int addr, uint8_t *ch)
 	};
 
 	if (!ch7xxx->quiet) {
-		DRM_DEBUG("Unable to read register 0x%02x from %s:%02x.\n",
+		DRM_DEBUG_KMS("Unable to read register 0x%02x from %s:%02x.\n",
 			  addr, i2cbus->adapter.name, dvo->slave_addr);
 	}
 	return false;
@@ -179,7 +179,7 @@ static bool ch7xxx_writeb(struct intel_dvo_device *dvo, int addr, uint8_t ch)
 		return true;
 
 	if (!ch7xxx->quiet) {
-		DRM_DEBUG("Unable to write register 0x%02x to %s:%d.\n",
+		DRM_DEBUG_KMS("Unable to write register 0x%02x to %s:%d.\n",
 			  addr, i2cbus->adapter.name, dvo->slave_addr);
 	}
 
@@ -207,7 +207,8 @@ static bool ch7xxx_init(struct intel_dvo_device *dvo,
 
 	name = ch7xxx_get_id(vendor);
 	if (!name) {
-		DRM_DEBUG("ch7xxx not detected; got 0x%02x from %s slave %d.\n",
+		DRM_DEBUG_KMS("ch7xxx not detected; got 0x%02x from %s "
+				"slave %d.\n",
 			  vendor, adapter->name, dvo->slave_addr);
 		goto out;
 	}
@@ -217,13 +218,14 @@ static bool ch7xxx_init(struct intel_dvo_device *dvo,
 		goto out;
 
 	if (device != CH7xxx_DID) {
-		DRM_DEBUG("ch7xxx not detected; got 0x%02x from %s slave %d.\n",
+		DRM_DEBUG_KMS("ch7xxx not detected; got 0x%02x from %s "
+				"slave %d.\n",
 			  vendor, adapter->name, dvo->slave_addr);
 		goto out;
 	}
 
 	ch7xxx->quiet = false;
-	DRM_DEBUG("Detected %s chipset, vendor/device ID 0x%02x/0x%02x\n",
+	DRM_DEBUG_KMS("Detected %s chipset, vendor/device ID 0x%02x/0x%02x\n",
 		  name, vendor, device);
 	return true;
 out:
@@ -315,8 +317,8 @@ static void ch7xxx_dump_regs(struct intel_dvo_device *dvo)
 
 	for (i = 0; i < CH7xxx_NUM_REGS; i++) {
 		if ((i % 8) == 0 )
-			DRM_DEBUG("\n %02X: ", i);
-		DRM_DEBUG("%02X ", ch7xxx->mode_reg.regs[i]);
+			DRM_LOG_KMS("\n %02X: ", i);
+		DRM_LOG_KMS("%02X ", ch7xxx->mode_reg.regs[i]);
 	}
 }
 
diff --git a/drivers/gpu/drm/i915/dvo_ivch.c b/drivers/gpu/drm/i915/dvo_ivch.c
index aa176f9921fe..24169e528f0f 100644
--- a/drivers/gpu/drm/i915/dvo_ivch.c
+++ b/drivers/gpu/drm/i915/dvo_ivch.c
@@ -202,7 +202,8 @@ static bool ivch_read(struct intel_dvo_device *dvo, int addr, uint16_t *data)
 	};
 
 	if (!priv->quiet) {
-		DRM_DEBUG("Unable to read register 0x%02x from %s:%02x.\n",
+		DRM_DEBUG_KMS("Unable to read register 0x%02x from "
+				"%s:%02x.\n",
 			  addr, i2cbus->adapter.name, dvo->slave_addr);
 	}
 	return false;
@@ -230,7 +231,7 @@ static bool ivch_write(struct intel_dvo_device *dvo, int addr, uint16_t data)
 		return true;
 
 	if (!priv->quiet) {
-		DRM_DEBUG("Unable to write register 0x%02x to %s:%d.\n",
+		DRM_DEBUG_KMS("Unable to write register 0x%02x to %s:%d.\n",
 			  addr, i2cbus->adapter.name, dvo->slave_addr);
 	}
 
@@ -261,7 +262,7 @@ static bool ivch_init(struct intel_dvo_device *dvo,
 	 * the address it's responding on.
 	 */
 	if ((temp & VR00_BASE_ADDRESS_MASK) != dvo->slave_addr) {
-		DRM_DEBUG("ivch detect failed due to address mismatch "
+		DRM_DEBUG_KMS("ivch detect failed due to address mismatch "
 			  "(%d vs %d)\n",
 			  (temp & VR00_BASE_ADDRESS_MASK), dvo->slave_addr);
 		goto out;
@@ -367,41 +368,41 @@ static void ivch_dump_regs(struct intel_dvo_device *dvo)
 	uint16_t val;
 
 	ivch_read(dvo, VR00, &val);
-	DRM_DEBUG("VR00: 0x%04x\n", val);
+	DRM_LOG_KMS("VR00: 0x%04x\n", val);
 	ivch_read(dvo, VR01, &val);
-	DRM_DEBUG("VR01: 0x%04x\n", val);
+	DRM_LOG_KMS("VR01: 0x%04x\n", val);
 	ivch_read(dvo, VR30, &val);
-	DRM_DEBUG("VR30: 0x%04x\n", val);
+	DRM_LOG_KMS("VR30: 0x%04x\n", val);
 	ivch_read(dvo, VR40, &val);
-	DRM_DEBUG("VR40: 0x%04x\n", val);
+	DRM_LOG_KMS("VR40: 0x%04x\n", val);
 
 	/* GPIO registers */
 	ivch_read(dvo, VR80, &val);
-	DRM_DEBUG("VR80: 0x%04x\n", val);
+	DRM_LOG_KMS("VR80: 0x%04x\n", val);
 	ivch_read(dvo, VR81, &val);
-	DRM_DEBUG("VR81: 0x%04x\n", val);
+	DRM_LOG_KMS("VR81: 0x%04x\n", val);
 	ivch_read(dvo, VR82, &val);
-	DRM_DEBUG("VR82: 0x%04x\n", val);
+	DRM_LOG_KMS("VR82: 0x%04x\n", val);
 	ivch_read(dvo, VR83, &val);
-	DRM_DEBUG("VR83: 0x%04x\n", val);
+	DRM_LOG_KMS("VR83: 0x%04x\n", val);
 	ivch_read(dvo, VR84, &val);
-	DRM_DEBUG("VR84: 0x%04x\n", val);
+	DRM_LOG_KMS("VR84: 0x%04x\n", val);
 	ivch_read(dvo, VR85, &val);
-	DRM_DEBUG("VR85: 0x%04x\n", val);
+	DRM_LOG_KMS("VR85: 0x%04x\n", val);
 	ivch_read(dvo, VR86, &val);
-	DRM_DEBUG("VR86: 0x%04x\n", val);
+	DRM_LOG_KMS("VR86: 0x%04x\n", val);
 	ivch_read(dvo, VR87, &val);
-	DRM_DEBUG("VR87: 0x%04x\n", val);
+	DRM_LOG_KMS("VR87: 0x%04x\n", val);
 	ivch_read(dvo, VR88, &val);
-	DRM_DEBUG("VR88: 0x%04x\n", val);
+	DRM_LOG_KMS("VR88: 0x%04x\n", val);
 
 	/* Scratch register 0 - AIM Panel type */
 	ivch_read(dvo, VR8E, &val);
-	DRM_DEBUG("VR8E: 0x%04x\n", val);
+	DRM_LOG_KMS("VR8E: 0x%04x\n", val);
 
 	/* Scratch register 1 - Status register */
 	ivch_read(dvo, VR8F, &val);
-	DRM_DEBUG("VR8F: 0x%04x\n", val);
+	DRM_LOG_KMS("VR8F: 0x%04x\n", val);
 }
 
 static void ivch_save(struct intel_dvo_device *dvo)
diff --git a/drivers/gpu/drm/i915/dvo_sil164.c b/drivers/gpu/drm/i915/dvo_sil164.c
index e1c1f7341e5c..0001c13f0a80 100644
--- a/drivers/gpu/drm/i915/dvo_sil164.c
+++ b/drivers/gpu/drm/i915/dvo_sil164.c
@@ -105,7 +105,7 @@ static bool sil164_readb(struct intel_dvo_device *dvo, int addr, uint8_t *ch)
 	};
 
 	if (!sil->quiet) {
-		DRM_DEBUG("Unable to read register 0x%02x from %s:%02x.\n",
+		DRM_DEBUG_KMS("Unable to read register 0x%02x from %s:%02x.\n",
 			  addr, i2cbus->adapter.name, dvo->slave_addr);
 	}
 	return false;
@@ -131,7 +131,7 @@ static bool sil164_writeb(struct intel_dvo_device *dvo, int addr, uint8_t ch)
 		return true;
 
 	if (!sil->quiet) {
-		DRM_DEBUG("Unable to write register 0x%02x to %s:%d.\n",
+		DRM_DEBUG_KMS("Unable to write register 0x%02x to %s:%d.\n",
 			  addr, i2cbus->adapter.name, dvo->slave_addr);
 	}
 
@@ -158,7 +158,7 @@ static bool sil164_init(struct intel_dvo_device *dvo,
 		goto out;
 
 	if (ch != (SIL164_VID & 0xff)) {
-		DRM_DEBUG("sil164 not detected got %d: from %s Slave %d.\n",
+		DRM_DEBUG_KMS("sil164 not detected got %d: from %s Slave %d.\n",
 			  ch, adapter->name, dvo->slave_addr);
 		goto out;
 	}
@@ -167,13 +167,13 @@ static bool sil164_init(struct intel_dvo_device *dvo,
 		goto out;
 
 	if (ch != (SIL164_DID & 0xff)) {
-		DRM_DEBUG("sil164 not detected got %d: from %s Slave %d.\n",
+		DRM_DEBUG_KMS("sil164 not detected got %d: from %s Slave %d.\n",
 			  ch, adapter->name, dvo->slave_addr);
 		goto out;
 	}
 	sil->quiet = false;
 
-	DRM_DEBUG("init sil164 dvo controller successfully!\n");
+	DRM_DEBUG_KMS("init sil164 dvo controller successfully!\n");
 	return true;
 
 out:
@@ -241,15 +241,15 @@ static void sil164_dump_regs(struct intel_dvo_device *dvo)
 	uint8_t val;
 
 	sil164_readb(dvo, SIL164_FREQ_LO, &val);
-	DRM_DEBUG("SIL164_FREQ_LO: 0x%02x\n", val);
+	DRM_LOG_KMS("SIL164_FREQ_LO: 0x%02x\n", val);
 	sil164_readb(dvo, SIL164_FREQ_HI, &val);
-	DRM_DEBUG("SIL164_FREQ_HI: 0x%02x\n", val);
+	DRM_LOG_KMS("SIL164_FREQ_HI: 0x%02x\n", val);
 	sil164_readb(dvo, SIL164_REG8, &val);
-	DRM_DEBUG("SIL164_REG8: 0x%02x\n", val);
+	DRM_LOG_KMS("SIL164_REG8: 0x%02x\n", val);
 	sil164_readb(dvo, SIL164_REG9, &val);
-	DRM_DEBUG("SIL164_REG9: 0x%02x\n", val);
+	DRM_LOG_KMS("SIL164_REG9: 0x%02x\n", val);
 	sil164_readb(dvo, SIL164_REGC, &val);
-	DRM_DEBUG("SIL164_REGC: 0x%02x\n", val);
+	DRM_LOG_KMS("SIL164_REGC: 0x%02x\n", val);
 }
 
 static void sil164_save(struct intel_dvo_device *dvo)
diff --git a/drivers/gpu/drm/i915/dvo_tfp410.c b/drivers/gpu/drm/i915/dvo_tfp410.c
index 9ecc907384ec..c7c391bc116a 100644
--- a/drivers/gpu/drm/i915/dvo_tfp410.c
+++ b/drivers/gpu/drm/i915/dvo_tfp410.c
@@ -130,7 +130,7 @@ static bool tfp410_readb(struct intel_dvo_device *dvo, int addr, uint8_t *ch)
 	};
 
 	if (!tfp->quiet) {
-		DRM_DEBUG("Unable to read register 0x%02x from %s:%02x.\n",
+		DRM_DEBUG_KMS("Unable to read register 0x%02x from %s:%02x.\n",
 			  addr, i2cbus->adapter.name, dvo->slave_addr);
 	}
 	return false;
@@ -156,7 +156,7 @@ static bool tfp410_writeb(struct intel_dvo_device *dvo, int addr, uint8_t ch)
 		return true;
 
 	if (!tfp->quiet) {
-		DRM_DEBUG("Unable to write register 0x%02x to %s:%d.\n",
+		DRM_DEBUG_KMS("Unable to write register 0x%02x to %s:%d.\n",
 			  addr, i2cbus->adapter.name, dvo->slave_addr);
 	}
 
@@ -191,13 +191,15 @@ static bool tfp410_init(struct intel_dvo_device *dvo,
 	tfp->quiet = true;
 
 	if ((id = tfp410_getid(dvo, TFP410_VID_LO)) != TFP410_VID) {
-		DRM_DEBUG("tfp410 not detected got VID %X: from %s Slave %d.\n",
+		DRM_DEBUG_KMS("tfp410 not detected got VID %X: from %s "
+				"Slave %d.\n",
 			  id, adapter->name, dvo->slave_addr);
 		goto out;
 	}
 
 	if ((id = tfp410_getid(dvo, TFP410_DID_LO)) != TFP410_DID) {
-		DRM_DEBUG("tfp410 not detected got DID %X: from %s Slave %d.\n",
+		DRM_DEBUG_KMS("tfp410 not detected got DID %X: from %s "
+				"Slave %d.\n",
 			  id, adapter->name, dvo->slave_addr);
 		goto out;
 	}
@@ -262,33 +264,33 @@ static void tfp410_dump_regs(struct intel_dvo_device *dvo)
 	uint8_t val, val2;
 
 	tfp410_readb(dvo, TFP410_REV, &val);
-	DRM_DEBUG("TFP410_REV: 0x%02X\n", val);
+	DRM_LOG_KMS("TFP410_REV: 0x%02X\n", val);
 	tfp410_readb(dvo, TFP410_CTL_1, &val);
-	DRM_DEBUG("TFP410_CTL1: 0x%02X\n", val);
+	DRM_LOG_KMS("TFP410_CTL1: 0x%02X\n", val);
 	tfp410_readb(dvo, TFP410_CTL_2, &val);
-	DRM_DEBUG("TFP410_CTL2: 0x%02X\n", val);
+	DRM_LOG_KMS("TFP410_CTL2: 0x%02X\n", val);
 	tfp410_readb(dvo, TFP410_CTL_3, &val);
-	DRM_DEBUG("TFP410_CTL3: 0x%02X\n", val);
+	DRM_LOG_KMS("TFP410_CTL3: 0x%02X\n", val);
 	tfp410_readb(dvo, TFP410_USERCFG, &val);
-	DRM_DEBUG("TFP410_USERCFG: 0x%02X\n", val);
+	DRM_LOG_KMS("TFP410_USERCFG: 0x%02X\n", val);
 	tfp410_readb(dvo, TFP410_DE_DLY, &val);
-	DRM_DEBUG("TFP410_DE_DLY: 0x%02X\n", val);
+	DRM_LOG_KMS("TFP410_DE_DLY: 0x%02X\n", val);
 	tfp410_readb(dvo, TFP410_DE_CTL, &val);
-	DRM_DEBUG("TFP410_DE_CTL: 0x%02X\n", val);
+	DRM_LOG_KMS("TFP410_DE_CTL: 0x%02X\n", val);
 	tfp410_readb(dvo, TFP410_DE_TOP, &val);
-	DRM_DEBUG("TFP410_DE_TOP: 0x%02X\n", val);
+	DRM_LOG_KMS("TFP410_DE_TOP: 0x%02X\n", val);
 	tfp410_readb(dvo, TFP410_DE_CNT_LO, &val);
 	tfp410_readb(dvo, TFP410_DE_CNT_HI, &val2);
-	DRM_DEBUG("TFP410_DE_CNT: 0x%02X%02X\n", val2, val);
+	DRM_LOG_KMS("TFP410_DE_CNT: 0x%02X%02X\n", val2, val);
 	tfp410_readb(dvo, TFP410_DE_LIN_LO, &val);
 	tfp410_readb(dvo, TFP410_DE_LIN_HI, &val2);
-	DRM_DEBUG("TFP410_DE_LIN: 0x%02X%02X\n", val2, val);
+	DRM_LOG_KMS("TFP410_DE_LIN: 0x%02X%02X\n", val2, val);
 	tfp410_readb(dvo, TFP410_H_RES_LO, &val);
 	tfp410_readb(dvo, TFP410_H_RES_HI, &val2);
-	DRM_DEBUG("TFP410_H_RES: 0x%02X%02X\n", val2, val);
+	DRM_LOG_KMS("TFP410_H_RES: 0x%02X%02X\n", val2, val);
 	tfp410_readb(dvo, TFP410_V_RES_LO, &val);
 	tfp410_readb(dvo, TFP410_V_RES_HI, &val2);
-	DRM_DEBUG("TFP410_V_RES: 0x%02X%02X\n", val2, val);
+	DRM_LOG_KMS("TFP410_V_RES: 0x%02X%02X\n", val2, val);
 }
 
 static void tfp410_save(struct intel_dvo_device *dvo)
diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
index 26bf0552b3cb..9c9998c4dceb 100644
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -27,6 +27,7 @@
  */
 
 #include <linux/seq_file.h>
+#include <linux/debugfs.h>
 #include "drmP.h"
 #include "drm.h"
 #include "i915_drm.h"
@@ -96,13 +97,14 @@ static int i915_gem_object_list_info(struct seq_file *m, void *data)
 	{
 		struct drm_gem_object *obj = obj_priv->obj;
 
-		seq_printf(m, "    %p: %s %8zd %08x %08x %d %s",
+		seq_printf(m, "    %p: %s %8zd %08x %08x %d%s%s",
 			   obj,
 			   get_pin_flag(obj_priv),
 			   obj->size,
 			   obj->read_domains, obj->write_domain,
 			   obj_priv->last_rendering_seqno,
-			   obj_priv->dirty ? "dirty" : "");
+			   obj_priv->dirty ? " dirty" : "",
+			   obj_priv->madv == I915_MADV_DONTNEED ? " purgeable" : "");
 
 		if (obj->name)
 			seq_printf(m, " (name: %d)", obj->name);
@@ -160,7 +162,7 @@ static int i915_interrupt_info(struct seq_file *m, void *data)
 	struct drm_device *dev = node->minor->dev;
 	drm_i915_private_t *dev_priv = dev->dev_private;
 
-	if (!IS_IGDNG(dev)) {
+	if (!IS_IRONLAKE(dev)) {
 		seq_printf(m, "Interrupt enable:    %08x\n",
 			   I915_READ(IER));
 		seq_printf(m, "Interrupt identity:  %08x\n",
@@ -270,7 +272,7 @@ static void i915_dump_pages(struct seq_file *m, struct page **pages, int page_co
 		mem = kmap_atomic(pages[page], KM_USER0);
 		for (i = 0; i < PAGE_SIZE; i += 4)
 			seq_printf(m, "%08x :  %08x\n", i, mem[i / 4]);
-		kunmap_atomic(pages[page], KM_USER0);
+		kunmap_atomic(mem, KM_USER0);
 	}
 }
 
@@ -384,37 +386,111 @@ out:
 	return 0;
 }
 
-static int i915_registers_info(struct seq_file *m, void *data) {
-	struct drm_info_node *node = (struct drm_info_node *) m->private;
-	struct drm_device *dev = node->minor->dev;
+static int
+i915_wedged_open(struct inode *inode,
+		 struct file *filp)
+{
+	filp->private_data = inode->i_private;
+	return 0;
+}
+
+static ssize_t
+i915_wedged_read(struct file *filp,
+		 char __user *ubuf,
+		 size_t max,
+		 loff_t *ppos)
+{
+	struct drm_device *dev = filp->private_data;
 	drm_i915_private_t *dev_priv = dev->dev_private;
-	uint32_t reg;
-
-#define DUMP_RANGE(start, end) \
-	for (reg=start; reg < end; reg += 4) \
-	seq_printf(m, "%08x\t%08x\n", reg, I915_READ(reg));
-
-	DUMP_RANGE(0x00000, 0x00fff);   /* VGA registers */
-	DUMP_RANGE(0x02000, 0x02fff);   /* instruction, memory, interrupt control registers */
-	DUMP_RANGE(0x03000, 0x031ff);   /* FENCE and PPGTT control registers */
-	DUMP_RANGE(0x03200, 0x03fff);   /* frame buffer compression registers */
-	DUMP_RANGE(0x05000, 0x05fff);   /* I/O control registers */
-	DUMP_RANGE(0x06000, 0x06fff);   /* clock control registers */
-	DUMP_RANGE(0x07000, 0x07fff);   /* 3D internal debug registers */
-	DUMP_RANGE(0x07400, 0x088ff);   /* GPE debug registers */
-	DUMP_RANGE(0x0a000, 0x0afff);   /* display palette registers */
-	DUMP_RANGE(0x10000, 0x13fff);   /* MMIO MCHBAR */
-	DUMP_RANGE(0x30000, 0x3ffff);   /* overlay registers */
-	DUMP_RANGE(0x60000, 0x6ffff);   /* display engine pipeline registers */
-	DUMP_RANGE(0x70000, 0x72fff);   /* display and cursor registers */
-	DUMP_RANGE(0x73000, 0x73fff);   /* performance counters */
+	char buf[80];
+	int len;
+
+	len = snprintf(buf, sizeof (buf),
+		       "wedged :  %d\n",
+		       atomic_read(&dev_priv->mm.wedged));
+
+	return simple_read_from_buffer(ubuf, max, ppos, buf, len);
+}
+
+static ssize_t
+i915_wedged_write(struct file *filp,
+		  const char __user *ubuf,
+		  size_t cnt,
+		  loff_t *ppos)
+{
+	struct drm_device *dev = filp->private_data;
+	drm_i915_private_t *dev_priv = dev->dev_private;
+	char buf[20];
+	int val = 1;
+
+	if (cnt > 0) {
+		if (cnt > sizeof (buf) - 1)
+			return -EINVAL;
+
+		if (copy_from_user(buf, ubuf, cnt))
+			return -EFAULT;
+		buf[cnt] = 0;
+
+		val = simple_strtoul(buf, NULL, 0);
+	}
+
+	DRM_INFO("Manually setting wedged to %d\n", val);
+
+	atomic_set(&dev_priv->mm.wedged, val);
+	if (val) {
+		DRM_WAKEUP(&dev_priv->irq_queue);
+		queue_work(dev_priv->wq, &dev_priv->error_work);
+	}
+
+	return cnt;
+}
+
+static const struct file_operations i915_wedged_fops = {
+	.owner = THIS_MODULE,
+	.open = i915_wedged_open,
+	.read = i915_wedged_read,
+	.write = i915_wedged_write,
+};
+
+/* As the drm_debugfs_init() routines are called before dev->dev_private is
+ * allocated we need to hook into the minor for release. */
+static int
+drm_add_fake_info_node(struct drm_minor *minor,
+		       struct dentry *ent,
+		       const void *key)
+{
+	struct drm_info_node *node;
+
+	node = kmalloc(sizeof(struct drm_info_node), GFP_KERNEL);
+	if (node == NULL) {
+		debugfs_remove(ent);
+		return -ENOMEM;
+	}
+
+	node->minor = minor;
+	node->dent = ent;
+	node->info_ent = (void *) key;
+	list_add(&node->list, &minor->debugfs_nodes.list);
 
 	return 0;
 }
 
+static int i915_wedged_create(struct dentry *root, struct drm_minor *minor)
+{
+	struct drm_device *dev = minor->dev;
+	struct dentry *ent;
+
+	ent = debugfs_create_file("i915_wedged",
+				  S_IRUGO | S_IWUSR,
+				  root, dev,
+				  &i915_wedged_fops);
+	if (IS_ERR(ent))
+		return PTR_ERR(ent);
+
+	return drm_add_fake_info_node(minor, ent, &i915_wedged_fops);
+}
 
 static struct drm_info_list i915_debugfs_list[] = {
-	{"i915_regs", i915_registers_info, 0},
 	{"i915_gem_active", i915_gem_object_list_info, 0, (void *) ACTIVE_LIST},
 	{"i915_gem_flushing", i915_gem_object_list_info, 0, (void *) FLUSHING_LIST},
 	{"i915_gem_inactive", i915_gem_object_list_info, 0, (void *) INACTIVE_LIST},
@@ -432,6 +508,12 @@ static struct drm_info_list i915_debugfs_list[] = {
 
 int i915_debugfs_init(struct drm_minor *minor)
 {
+	int ret;
+
+	ret = i915_wedged_create(minor->debugfs_root, minor);
+	if (ret)
+		return ret;
+
 	return drm_debugfs_create_files(i915_debugfs_list,
 					I915_DEBUGFS_ENTRIES,
 					minor->debugfs_root, minor);
@@ -441,7 +523,8 @@ void i915_debugfs_cleanup(struct drm_minor *minor)
 {
 	drm_debugfs_remove_files(i915_debugfs_list,
 				 I915_DEBUGFS_ENTRIES, minor);
+	drm_debugfs_remove_files((struct drm_info_list *) &i915_wedged_fops,
+				 1, minor);
 }
 
 #endif /* CONFIG_DEBUG_FS */
-
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index e5b138be45fa..e660ac07f3b2 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -123,7 +123,7 @@ static int i915_init_phys_hws(struct drm_device *dev)
 	drm_i915_private_t *dev_priv = dev->dev_private;
 	/* Program Hardware Status Page */
 	dev_priv->status_page_dmah =
-		drm_pci_alloc(dev, PAGE_SIZE, PAGE_SIZE, 0xffffffff);
+		drm_pci_alloc(dev, PAGE_SIZE, PAGE_SIZE);
 
 	if (!dev_priv->status_page_dmah) {
 		DRM_ERROR("Can not allocate hardware status page\n");
@@ -134,6 +134,10 @@ static int i915_init_phys_hws(struct drm_device *dev)
 
 	memset(dev_priv->hw_status_page, 0, PAGE_SIZE);
 
+	if (IS_I965G(dev))
+		dev_priv->dma_status_page |= (dev_priv->dma_status_page >> 28) &
+					     0xf0;
+
 	I915_WRITE(HWS_PGA, dev_priv->dma_status_page);
 	DRM_DEBUG_DRIVER("Enabled hardware status page\n");
 	return 0;
@@ -807,9 +811,19 @@ static int i915_getparam(struct drm_device *dev, void *data,
 	case I915_PARAM_NUM_FENCES_AVAIL:
 		value = dev_priv->num_fence_regs - dev_priv->fence_reg_start;
 		break;
+	case I915_PARAM_HAS_OVERLAY:
+		value = dev_priv->overlay ? 1 : 0;
+		break;
+	case I915_PARAM_HAS_PAGEFLIPPING:
+		value = 1;
+		break;
+	case I915_PARAM_HAS_EXECBUF2:
+		/* depends on GEM */
+		value = dev_priv->has_gem;
+		break;
 	default:
 		DRM_DEBUG_DRIVER("Unknown parameter %d\n",
-					param->param);
+				 param->param);
 		return -EINVAL;
 	}
 
@@ -962,7 +976,7 @@ static int i915_probe_agp(struct drm_device *dev, uint32_t *aperture_size,
 	 * Some of the preallocated space is taken by the GTT
 	 * and popup.  GTT is 1K per MB of aperture size, and popup is 4K.
 	 */
-	if (IS_G4X(dev) || IS_IGD(dev) || IS_IGDNG(dev))
+	if (IS_G4X(dev) || IS_PINEVIEW(dev) || IS_IRONLAKE(dev))
 		overhead = 4096;
 	else
 		overhead = (*aperture_size / 1024) + 4096;
@@ -1048,7 +1062,7 @@ static unsigned long i915_gtt_to_phys(struct drm_device *dev,
 	int gtt_offset, gtt_size;
 
 	if (IS_I965G(dev)) {
-		if (IS_G4X(dev) || IS_IGDNG(dev)) {
+		if (IS_G4X(dev) || IS_IRONLAKE(dev)) {
 			gtt_offset = 2*1024*1024;
 			gtt_size = 2*1024*1024;
 		} else {
@@ -1070,7 +1084,7 @@ static unsigned long i915_gtt_to_phys(struct drm_device *dev,
 
 	entry = *(volatile u32 *)(gtt + (gtt_addr / 1024));
 
-	DRM_DEBUG("GTT addr: 0x%08lx, PTE: 0x%08lx\n", gtt_addr, entry);
+	DRM_DEBUG_DRIVER("GTT addr: 0x%08lx, PTE: 0x%08lx\n", gtt_addr, entry);
 
 	/* Mask out these reserved bits on this hardware. */
 	if (!IS_I9XX(dev) || IS_I915G(dev) || IS_I915GM(dev) ||
@@ -1096,7 +1110,7 @@ static unsigned long i915_gtt_to_phys(struct drm_device *dev,
 	phys =(entry & PTE_ADDRESS_MASK) |
 		((uint64_t)(entry & PTE_ADDRESS_MASK_HIGH) << (32 - 4));
 
-	DRM_DEBUG("GTT addr: 0x%08lx, phys addr: 0x%08lx\n", gtt_addr, phys);
+	DRM_DEBUG_DRIVER("GTT addr: 0x%08lx, phys addr: 0x%08lx\n", gtt_addr, phys);
 
 	return phys;
 }
@@ -1111,7 +1125,8 @@ static void i915_setup_compression(struct drm_device *dev, int size)
 {
 	struct drm_i915_private *dev_priv = dev->dev_private;
 	struct drm_mm_node *compressed_fb, *compressed_llb;
-	unsigned long cfb_base, ll_base;
+	unsigned long cfb_base;
+	unsigned long ll_base = 0;
 
 	/* Leave 1M for line length buffer & misc. */
 	compressed_fb = drm_mm_search_free(&dev_priv->vram, size, 4096, 0);
@@ -1194,14 +1209,6 @@ static int i915_load_modeset_init(struct drm_device *dev,
 	dev->mode_config.fb_base = drm_get_resource_start(dev, fb_bar) &
 		0xff000000;
 
-	if (IS_MOBILE(dev) || IS_I9XX(dev))
-		dev_priv->cursor_needs_physical = true;
-	else
-		dev_priv->cursor_needs_physical = false;
-
-	if (IS_I965G(dev) || IS_G33(dev))
-		dev_priv->cursor_needs_physical = false;
-
 	/* Basic memrange allocator for stolen space (aka vram) */
 	drm_mm_init(&dev_priv->vram, 0, prealloc_size);
 	DRM_INFO("set up %ldM of stolen space\n", prealloc_size / (1024*1024));
@@ -1251,6 +1258,8 @@ static int i915_load_modeset_init(struct drm_device *dev,
 	if (ret)
 		goto destroy_ringbuffer;
 
+	intel_modeset_init(dev);
+
 	ret = drm_irq_install(dev);
 	if (ret)
 		goto destroy_ringbuffer;
@@ -1265,8 +1274,6 @@ static int i915_load_modeset_init(struct drm_device *dev,
 
 	I915_WRITE(INSTPM, (1 << 5) | (1 << 21));
 
-	intel_modeset_init(dev);
-
 	drm_helper_initial_config(dev);
 
 	return 0;
@@ -1306,7 +1313,7 @@ static void i915_get_mem_freq(struct drm_device *dev)
 	drm_i915_private_t *dev_priv = dev->dev_private;
 	u32 tmp;
 
-	if (!IS_IGD(dev))
+	if (!IS_PINEVIEW(dev))
 		return;
 
 	tmp = I915_READ(CLKCFG);
@@ -1354,7 +1361,7 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
 {
 	struct drm_i915_private *dev_priv = dev->dev_private;
 	resource_size_t base, size;
-	int ret = 0, mmio_bar = IS_I9XX(dev) ? 0 : 1;
+	int ret = 0, mmio_bar;
 	uint32_t agp_size, prealloc_size, prealloc_start;
 
 	/* i915 has 4 more counters */
@@ -1370,8 +1377,10 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
 
 	dev->dev_private = (void *)dev_priv;
 	dev_priv->dev = dev;
+	dev_priv->info = (struct intel_device_info *) flags;
 
 	/* Add register map (needed for suspend/resume) */
+	mmio_bar = IS_I9XX(dev) ? 0 : 1;
 	base = drm_get_resource_start(dev, mmio_bar);
 	size = drm_get_resource_len(dev, mmio_bar);
 
@@ -1413,7 +1422,7 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
 	if (ret)
 		goto out_iomapfree;
 
-	dev_priv->wq = create_workqueue("i915");
+	dev_priv->wq = create_singlethread_workqueue("i915");
 	if (dev_priv->wq == NULL) {
 		DRM_ERROR("Failed to create our workqueue.\n");
 		ret = -ENOMEM;
@@ -1434,7 +1443,7 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
 
 	dev->driver->get_vblank_counter = i915_get_vblank_counter;
 	dev->max_vblank_count = 0xffffff; /* only 24 bits of frame count */
-	if (IS_G4X(dev) || IS_IGDNG(dev)) {
+	if (IS_G4X(dev) || IS_IRONLAKE(dev)) {
 		dev->max_vblank_count = 0xffffffff; /* full 32 bit counter */
 		dev->driver->get_vblank_counter = gm45_get_vblank_counter;
 	}
@@ -1489,9 +1498,7 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
 	}
 
 	/* Must be done after probing outputs */
-	/* FIXME: verify on IGDNG */
-	if (!IS_IGDNG(dev))
-		intel_opregion_init(dev, 0);
+	intel_opregion_init(dev, 0);
 
 	setup_timer(&dev_priv->hangcheck_timer, i915_hangcheck_elapsed,
 		    (unsigned long) dev);
@@ -1525,6 +1532,15 @@ int i915_driver_unload(struct drm_device *dev)
 	}
 
 	if (drm_core_check_feature(dev, DRIVER_MODESET)) {
+		/*
+		 * free the memory space allocated for the child device
+		 * config parsed from VBT
+		 */
+		if (dev_priv->child_dev && dev_priv->child_dev_num) {
+			kfree(dev_priv->child_dev);
+			dev_priv->child_dev = NULL;
+			dev_priv->child_dev_num = 0;
+		}
 		drm_irq_uninstall(dev);
 		vga_client_register(dev->pdev, NULL, NULL, NULL);
 	}
@@ -1535,8 +1551,7 @@ int i915_driver_unload(struct drm_device *dev)
 	if (dev_priv->regs != NULL)
 		iounmap(dev_priv->regs);
 
-	if (!IS_IGDNG(dev))
-		intel_opregion_free(dev, 0);
+	intel_opregion_free(dev, 0);
 
 	if (drm_core_check_feature(dev, DRIVER_MODESET)) {
 		intel_modeset_cleanup(dev);
@@ -1548,6 +1563,8 @@ int i915_driver_unload(struct drm_device *dev)
 		mutex_unlock(&dev->struct_mutex);
 		drm_mm_takedown(&dev_priv->vram);
 		i915_gem_lastclose(dev);
+
+		intel_cleanup_overlay(dev);
 	}
 
 	pci_dev_put(dev_priv->bridge_dev);
@@ -1638,6 +1655,7 @@ struct drm_ioctl_desc i915_ioctls[] = {
 	DRM_IOCTL_DEF(DRM_I915_HWS_ADDR, i915_set_status_page, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY),
 	DRM_IOCTL_DEF(DRM_I915_GEM_INIT, i915_gem_init_ioctl, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY),
 	DRM_IOCTL_DEF(DRM_I915_GEM_EXECBUFFER, i915_gem_execbuffer, DRM_AUTH),
+	DRM_IOCTL_DEF(DRM_I915_GEM_EXECBUFFER2, i915_gem_execbuffer2, DRM_AUTH),
 	DRM_IOCTL_DEF(DRM_I915_GEM_PIN, i915_gem_pin_ioctl, DRM_AUTH|DRM_ROOT_ONLY),
 	DRM_IOCTL_DEF(DRM_I915_GEM_UNPIN, i915_gem_unpin_ioctl, DRM_AUTH|DRM_ROOT_ONLY),
 	DRM_IOCTL_DEF(DRM_I915_GEM_BUSY, i915_gem_busy_ioctl, DRM_AUTH),
@@ -1656,6 +1674,8 @@ struct drm_ioctl_desc i915_ioctls[] = {
 	DRM_IOCTL_DEF(DRM_I915_GEM_GET_APERTURE, i915_gem_get_aperture_ioctl, 0),
 	DRM_IOCTL_DEF(DRM_I915_GET_PIPE_FROM_CRTC_ID, intel_get_pipe_from_crtc_id, 0),
 	DRM_IOCTL_DEF(DRM_I915_GEM_MADVISE, i915_gem_madvise_ioctl, 0),
+	DRM_IOCTL_DEF(DRM_I915_OVERLAY_PUT_IMAGE, intel_overlay_put_image, DRM_MASTER|DRM_CONTROL_ALLOW),
+	DRM_IOCTL_DEF(DRM_I915_OVERLAY_ATTRS, intel_overlay_attrs, DRM_MASTER|DRM_CONTROL_ALLOW),
 };
 
 int i915_max_ioctl = DRM_ARRAY_SIZE(i915_ioctls);
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 7f436ec075f6..46d88965852a 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -33,7 +33,6 @@
 #include "i915_drm.h"
 #include "i915_drv.h"
 
-#include "drm_pciids.h"
 #include <linux/console.h>
 #include "drm_crtc_helper.h"
 
@@ -46,10 +45,129 @@ module_param_named(fbpercrtc, i915_fbpercrtc, int, 0400);
 unsigned int i915_powersave = 1;
 module_param_named(powersave, i915_powersave, int, 0400);
 
+unsigned int i915_lvds_downclock = 0;
+module_param_named(lvds_downclock, i915_lvds_downclock, int, 0400);
+
 static struct drm_driver driver;
 
-static struct pci_device_id pciidlist[] = {
-	i915_PCI_IDS
+#define INTEL_VGA_DEVICE(id, info) {		\
+	.class = PCI_CLASS_DISPLAY_VGA << 8,	\
+	.class_mask = 0xffff00,			\
+	.vendor = 0x8086,			\
+	.device = id,				\
+	.subvendor = PCI_ANY_ID,		\
+	.subdevice = PCI_ANY_ID,		\
+	.driver_data = (unsigned long) info }
+
+const static struct intel_device_info intel_i830_info = {
+	.is_i8xx = 1, .is_mobile = 1, .cursor_needs_physical = 1,
+};
+
+const static struct intel_device_info intel_845g_info = {
+	.is_i8xx = 1,
+};
+
+const static struct intel_device_info intel_i85x_info = {
+	.is_i8xx = 1, .is_mobile = 1, .cursor_needs_physical = 1,
+};
+
+const static struct intel_device_info intel_i865g_info = {
+	.is_i8xx = 1,
+};
+
+const static struct intel_device_info intel_i915g_info = {
+	.is_i915g = 1, .is_i9xx = 1, .cursor_needs_physical = 1,
+};
+const static struct intel_device_info intel_i915gm_info = {
+	.is_i9xx = 1,  .is_mobile = 1, .has_fbc = 1,
+	.cursor_needs_physical = 1,
+};
+const static struct intel_device_info intel_i945g_info = {
+	.is_i9xx = 1, .has_hotplug = 1, .cursor_needs_physical = 1,
+};
+const static struct intel_device_info intel_i945gm_info = {
+	.is_i945gm = 1, .is_i9xx = 1, .is_mobile = 1, .has_fbc = 1,
+	.has_hotplug = 1, .cursor_needs_physical = 1,
+};
+
+const static struct intel_device_info intel_i965g_info = {
+	.is_i965g = 1, .is_i9xx = 1, .has_hotplug = 1,
+};
+
+const static struct intel_device_info intel_i965gm_info = {
+	.is_i965g = 1, .is_mobile = 1, .is_i965gm = 1, .is_i9xx = 1,
+	.is_mobile = 1, .has_fbc = 1, .has_rc6 = 1,
+	.has_hotplug = 1,
+};
+
+const static struct intel_device_info intel_g33_info = {
+	.is_g33 = 1, .is_i9xx = 1, .need_gfx_hws = 1,
+	.has_hotplug = 1,
+};
+
+const static struct intel_device_info intel_g45_info = {
+	.is_i965g = 1, .is_g4x = 1, .is_i9xx = 1, .need_gfx_hws = 1,
+	.has_pipe_cxsr = 1,
+	.has_hotplug = 1,
+};
+
+const static struct intel_device_info intel_gm45_info = {
+	.is_i965g = 1, .is_mobile = 1, .is_g4x = 1, .is_i9xx = 1,
+	.is_mobile = 1, .need_gfx_hws = 1, .has_fbc = 1, .has_rc6 = 1,
+	.has_pipe_cxsr = 1,
+	.has_hotplug = 1,
+};
+
+const static struct intel_device_info intel_pineview_info = {
+	.is_g33 = 1, .is_pineview = 1, .is_mobile = 1, .is_i9xx = 1,
+	.has_pipe_cxsr = 1,
+	.has_hotplug = 1,
+};
+
+const static struct intel_device_info intel_ironlake_d_info = {
+	.is_ironlake = 1, .is_i965g = 1, .is_i9xx = 1, .need_gfx_hws = 1,
+	.has_pipe_cxsr = 1,
+	.has_hotplug = 1,
+};
+
+const static struct intel_device_info intel_ironlake_m_info = {
+	.is_ironlake = 1, .is_mobile = 1, .is_i965g = 1, .is_i9xx = 1,
+	.need_gfx_hws = 1, .has_rc6 = 1,
+	.has_hotplug = 1,
+};
+
+const static struct pci_device_id pciidlist[] = {
+	INTEL_VGA_DEVICE(0x3577, &intel_i830_info),
+	INTEL_VGA_DEVICE(0x2562, &intel_845g_info),
+	INTEL_VGA_DEVICE(0x3582, &intel_i85x_info),
+	INTEL_VGA_DEVICE(0x35e8, &intel_i85x_info),
+	INTEL_VGA_DEVICE(0x2572, &intel_i865g_info),
+	INTEL_VGA_DEVICE(0x2582, &intel_i915g_info),
+	INTEL_VGA_DEVICE(0x258a, &intel_i915g_info),
+	INTEL_VGA_DEVICE(0x2592, &intel_i915gm_info),
+	INTEL_VGA_DEVICE(0x2772, &intel_i945g_info),
+	INTEL_VGA_DEVICE(0x27a2, &intel_i945gm_info),
+	INTEL_VGA_DEVICE(0x27ae, &intel_i945gm_info),
+	INTEL_VGA_DEVICE(0x2972, &intel_i965g_info),
+	INTEL_VGA_DEVICE(0x2982, &intel_i965g_info),
+	INTEL_VGA_DEVICE(0x2992, &intel_i965g_info),
+	INTEL_VGA_DEVICE(0x29a2, &intel_i965g_info),
+	INTEL_VGA_DEVICE(0x29b2, &intel_g33_info),
+	INTEL_VGA_DEVICE(0x29c2, &intel_g33_info),
+	INTEL_VGA_DEVICE(0x29d2, &intel_g33_info),
+	INTEL_VGA_DEVICE(0x2a02, &intel_i965gm_info),
+	INTEL_VGA_DEVICE(0x2a12, &intel_i965gm_info),
+	INTEL_VGA_DEVICE(0x2a42, &intel_gm45_info),
+	INTEL_VGA_DEVICE(0x2e02, &intel_g45_info),
+	INTEL_VGA_DEVICE(0x2e12, &intel_g45_info),
+	INTEL_VGA_DEVICE(0x2e22, &intel_g45_info),
+	INTEL_VGA_DEVICE(0x2e32, &intel_g45_info),
+	INTEL_VGA_DEVICE(0x2e42, &intel_g45_info),
+	INTEL_VGA_DEVICE(0xa001, &intel_pineview_info),
+	INTEL_VGA_DEVICE(0xa011, &intel_pineview_info),
+	INTEL_VGA_DEVICE(0x0042, &intel_ironlake_d_info),
+	INTEL_VGA_DEVICE(0x0046, &intel_ironlake_m_info),
+	{0, 0, 0}
 };
 
 #if defined(CONFIG_DRM_I915_KMS)
@@ -284,6 +402,52 @@ i915_pci_resume(struct pci_dev *pdev)
 	return i915_resume(dev);
 }
 
+static int
+i915_pm_suspend(struct device *dev)
+{
+	return i915_pci_suspend(to_pci_dev(dev), PMSG_SUSPEND);
+}
+
+static int
+i915_pm_resume(struct device *dev)
+{
+	return i915_pci_resume(to_pci_dev(dev));
+}
+
+static int
+i915_pm_freeze(struct device *dev)
+{
+	return i915_pci_suspend(to_pci_dev(dev), PMSG_FREEZE);
+}
+
+static int
+i915_pm_thaw(struct device *dev)
+{
+	/* thaw during hibernate, do nothing! */
+	return 0;
+}
+
+static int
+i915_pm_poweroff(struct device *dev)
+{
+	return i915_pci_suspend(to_pci_dev(dev), PMSG_HIBERNATE);
+}
+
+static int
+i915_pm_restore(struct device *dev)
+{
+	return i915_pci_resume(to_pci_dev(dev));
+}
+
+const struct dev_pm_ops i915_pm_ops = {
+     .suspend = i915_pm_suspend,
+     .resume = i915_pm_resume,
+     .freeze = i915_pm_freeze,
+     .thaw = i915_pm_thaw,
+     .poweroff = i915_pm_poweroff,
+     .restore = i915_pm_restore,
+};
+
 static struct vm_operations_struct i915_gem_vm_ops = {
 	.fault = i915_gem_fault,
 	.open = drm_gem_vm_open,
@@ -303,8 +467,11 @@ static struct drm_driver driver = {
 	.lastclose = i915_driver_lastclose,
 	.preclose = i915_driver_preclose,
 	.postclose = i915_driver_postclose,
+
+	/* Used in place of i915_pm_ops for non-DRIVER_MODESET */
 	.suspend = i915_suspend,
 	.resume = i915_resume,
+
 	.device_is_agp = i915_driver_device_is_agp,
 	.enable_vblank = i915_enable_vblank,
 	.disable_vblank = i915_disable_vblank,
@@ -329,10 +496,11 @@ static struct drm_driver driver = {
 		 .owner = THIS_MODULE,
 		 .open = drm_open,
 		 .release = drm_release,
-		 .ioctl = drm_ioctl,
+		 .unlocked_ioctl = drm_ioctl,
 		 .mmap = drm_gem_mmap,
 		 .poll = drm_poll,
 		 .fasync = drm_fasync,
+		 .read = drm_read,
 #ifdef CONFIG_COMPAT
 		 .compat_ioctl = i915_compat_ioctl,
 #endif
@@ -343,10 +511,7 @@ static struct drm_driver driver = {
 		 .id_table = pciidlist,
 		 .probe = i915_pci_probe,
 		 .remove = i915_pci_remove,
-#ifdef CONFIG_PM
-		 .resume = i915_pci_resume,
-		 .suspend = i915_pci_suspend,
-#endif
+		 .driver.pm = &i915_pm_ops,
 	},
 
 	.name = DRIVER_NAME,
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index a725f6591192..2c1669488b5a 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -170,9 +170,33 @@ struct drm_i915_display_funcs {
 	/* clock gating init */
 };
 
+struct intel_overlay;
+
+struct intel_device_info {
+	u8 is_mobile : 1;
+	u8 is_i8xx : 1;
+	u8 is_i915g : 1;
+	u8 is_i9xx : 1;
+	u8 is_i945gm : 1;
+	u8 is_i965g : 1;
+	u8 is_i965gm : 1;
+	u8 is_g33 : 1;
+	u8 need_gfx_hws : 1;
+	u8 is_g4x : 1;
+	u8 is_pineview : 1;
+	u8 is_ironlake : 1;
+	u8 has_fbc : 1;
+	u8 has_rc6 : 1;
+	u8 has_pipe_cxsr : 1;
+	u8 has_hotplug : 1;
+	u8 cursor_needs_physical : 1;
+};
+
 typedef struct drm_i915_private {
 	struct drm_device *dev;
 
+	const struct intel_device_info *info;
+
 	int has_gem;
 
 	void __iomem *regs;
@@ -187,6 +211,7 @@ typedef struct drm_i915_private {
 	unsigned int status_gfx_addr;
 	drm_local_map_t hws_map;
 	struct drm_gem_object *hws_obj;
+	struct drm_gem_object *pwrctx;
 
 	struct resource mch_res;
 
@@ -206,11 +231,13 @@ typedef struct drm_i915_private {
 	/** Cached value of IMR to avoid reads in updating the bitfield */
 	u32 irq_mask_reg;
 	u32 pipestat[2];
-	/** splitted irq regs for graphics and display engine on IGDNG,
+	/** splitted irq regs for graphics and display engine on Ironlake,
 	    irq_mask_reg is still used for display irq. */
 	u32 gt_irq_mask_reg;
 	u32 gt_irq_enable_reg;
 	u32 de_irq_enable_reg;
+	u32 pch_irq_mask_reg;
+	u32 pch_irq_enable_reg;
 
 	u32 hotplug_supported_mask;
 	struct work_struct hotplug_work;
@@ -227,8 +254,6 @@ typedef struct drm_i915_private {
 	int hangcheck_count;
 	uint32_t last_acthd;
 
-	bool cursor_needs_physical;
-
 	struct drm_mm vram;
 
 	unsigned long cfb_size;
@@ -240,6 +265,9 @@ typedef struct drm_i915_private {
 
 	struct intel_opregion opregion;
 
+	/* overlay */
+	struct intel_overlay *overlay;
+
 	/* LVDS info */
 	int backlight_duty_cycle;  /* restore backlight to this value */
 	bool panel_wants_dither;
@@ -255,10 +283,11 @@ typedef struct drm_i915_private {
 	unsigned int lvds_use_ssc:1;
 	unsigned int edp_support:1;
 	int lvds_ssc_freq;
+	int edp_bpp;
 
 	struct notifier_block lid_notifier;
 
-	int crt_ddc_bus; /* -1 = unknown, else GPIO to use for CRT DDC */
+	int crt_ddc_bus; /* 0 = unknown, else GPIO to use for CRT DDC */
 	struct drm_i915_fence_reg fence_regs[16]; /* assume 965 */
 	int fence_reg_start; /* 4 if userland hasn't ioctl'd us yet */
 	int num_fence_regs; /* 8 on pre-965, 16 otherwise */
@@ -279,7 +308,6 @@ typedef struct drm_i915_private {
 	u32 saveDSPACNTR;
 	u32 saveDSPBCNTR;
 	u32 saveDSPARB;
-	u32 saveRENDERSTANDBY;
 	u32 saveHWS;
 	u32 savePIPEACONF;
 	u32 savePIPEBCONF;
@@ -374,8 +402,6 @@ typedef struct drm_i915_private {
 	u32 saveFDI_RXA_IMR;
 	u32 saveFDI_RXB_IMR;
 	u32 saveCACHE_MODE_0;
-	u32 saveD_STATE;
-	u32 saveDSPCLK_GATE_D;
 	u32 saveMI_ARB_STATE;
 	u32 saveSWF0[16];
 	u32 saveSWF1[16];
@@ -539,13 +565,22 @@ typedef struct drm_i915_private {
 	/* indicate whether the LVDS_BORDER should be enabled or not */
 	unsigned int lvds_border_bits;
 
+	struct drm_crtc *plane_to_crtc_mapping[2];
+	struct drm_crtc *pipe_to_crtc_mapping[2];
+	wait_queue_head_t pending_flip_queue;
+
 	/* Reclocking support */
 	bool render_reclock_avail;
 	bool lvds_downclock_avail;
+	/* indicates the reduced downclock for LVDS*/
+	int lvds_downclock;
 	struct work_struct idle_work;
 	struct timer_list idle_timer;
 	bool busy;
 	u16 orig_clock;
+	int child_dev_num;
+	struct child_device_config *child_dev;
+	struct drm_connector *int_lvds_connector;
 } drm_i915_private_t;
 
 /** driver private structure attached to each drm_gem_object */
@@ -638,6 +673,13 @@ struct drm_i915_gem_object {
 	 * Advice: are the backing pages purgeable?
 	 */
 	int madv;
+
+	/**
+	 * Number of crtcs where this object is currently the fb, but
+	 * will be page flipped away on the next vblank.  When it
+	 * reaches 0, dev_priv->pending_flip_queue will be woken up.
+	 */
+	atomic_t pending_flip;
 };
 
 /**
@@ -681,6 +723,7 @@ extern struct drm_ioctl_desc i915_ioctls[];
 extern int i915_max_ioctl;
 extern unsigned int i915_fbpercrtc;
 extern unsigned int i915_powersave;
+extern unsigned int i915_lvds_downclock;
 
 extern void i915_save_display(struct drm_device *dev);
 extern void i915_restore_display(struct drm_device *dev);
@@ -738,6 +781,8 @@ i915_enable_pipestat(drm_i915_private_t *dev_priv, int pipe, u32 mask);
 void
 i915_disable_pipestat(drm_i915_private_t *dev_priv, int pipe, u32 mask);
 
+void intel_enable_asle (struct drm_device *dev);
+
 
 /* i915_mem.c */
 extern int i915_mem_alloc(struct drm_device *dev, void *data,
@@ -770,6 +815,8 @@ int i915_gem_sw_finish_ioctl(struct drm_device *dev, void *data,
 			     struct drm_file *file_priv);
 int i915_gem_execbuffer(struct drm_device *dev, void *data,
 			struct drm_file *file_priv);
+int i915_gem_execbuffer2(struct drm_device *dev, void *data,
+			 struct drm_file *file_priv);
 int i915_gem_pin_ioctl(struct drm_device *dev, void *data,
 		       struct drm_file *file_priv);
 int i915_gem_unpin_ioctl(struct drm_device *dev, void *data,
@@ -813,9 +860,13 @@ void i915_gem_cleanup_ringbuffer(struct drm_device *dev);
 int i915_gem_do_init(struct drm_device *dev, unsigned long start,
 		     unsigned long end);
 int i915_gem_idle(struct drm_device *dev);
+uint32_t i915_add_request(struct drm_device *dev, struct drm_file *file_priv,
+			  uint32_t flush_domains);
+int i915_do_wait_request(struct drm_device *dev, uint32_t seqno, int interruptible);
 int i915_gem_fault(struct vm_area_struct *vma, struct vm_fault *vmf);
 int i915_gem_object_set_to_gtt_domain(struct drm_gem_object *obj,
 				      int write);
+int i915_gem_object_set_to_display_plane(struct drm_gem_object *obj);
 int i915_gem_attach_phys_object(struct drm_device *dev,
 				struct drm_gem_object *obj, int id);
 void i915_gem_detach_phys_object(struct drm_device *dev,
@@ -824,6 +875,7 @@ void i915_gem_free_all_phys_object(struct drm_device *dev);
 int i915_gem_object_get_pages(struct drm_gem_object *obj);
 void i915_gem_object_put_pages(struct drm_gem_object *obj);
 void i915_gem_release(struct drm_device * dev, struct drm_file *file_priv);
+void i915_gem_object_flush_write_domain(struct drm_gem_object *obj);
 
 void i915_gem_shrinker_init(void);
 void i915_gem_shrinker_exit(void);
@@ -832,6 +884,9 @@ void i915_gem_shrinker_exit(void);
 void i915_gem_detect_bit_6_swizzle(struct drm_device *dev);
 void i915_gem_object_do_bit_17_swizzle(struct drm_gem_object *obj);
 void i915_gem_object_save_bit_17_swizzle(struct drm_gem_object *obj);
+bool i915_tiling_ok(struct drm_device *dev, int stride, int size,
+		    int tiling_mode);
+bool i915_obj_fenceable(struct drm_device *dev, struct drm_gem_object *obj);
 
 /* i915_gem_debug.c */
 void i915_gem_dump_object(struct drm_gem_object *obj, int len,
@@ -863,11 +918,13 @@ extern int i915_restore_state(struct drm_device *dev);
 extern int intel_opregion_init(struct drm_device *dev, int resume);
 extern void intel_opregion_free(struct drm_device *dev, int suspend);
 extern void opregion_asle_intr(struct drm_device *dev);
+extern void ironlake_opregion_gse_intr(struct drm_device *dev);
 extern void opregion_enable_asle(struct drm_device *dev);
 #else
 static inline int intel_opregion_init(struct drm_device *dev, int resume) { return 0; }
 static inline void intel_opregion_free(struct drm_device *dev, int suspend) { return; }
 static inline void opregion_asle_intr(struct drm_device *dev) { return; }
+static inline void ironlake_opregion_gse_intr(struct drm_device *dev) { return; }
 static inline void opregion_enable_asle(struct drm_device *dev) { return; }
 #endif
 
@@ -952,85 +1009,52 @@ extern void g4x_disable_fbc(struct drm_device *dev);
 extern int i915_wrap_ring(struct drm_device * dev);
 extern int i915_wait_ring(struct drm_device * dev, int n, const char *caller);
 
-#define IS_I830(dev) ((dev)->pci_device == 0x3577)
-#define IS_845G(dev) ((dev)->pci_device == 0x2562)
-#define IS_I85X(dev) ((dev)->pci_device == 0x3582)
-#define IS_I855(dev) ((dev)->pci_device == 0x3582)
-#define IS_I865G(dev) ((dev)->pci_device == 0x2572)
-
-#define IS_I915G(dev) ((dev)->pci_device == 0x2582 || (dev)->pci_device == 0x258a)
-#define IS_I915GM(dev) ((dev)->pci_device == 0x2592)
-#define IS_I945G(dev) ((dev)->pci_device == 0x2772)
-#define IS_I945GM(dev) ((dev)->pci_device == 0x27A2 ||\
-		        (dev)->pci_device == 0x27AE)
-#define IS_I965G(dev) ((dev)->pci_device == 0x2972 || \
-		       (dev)->pci_device == 0x2982 || \
-		       (dev)->pci_device == 0x2992 || \
-		       (dev)->pci_device == 0x29A2 || \
-		       (dev)->pci_device == 0x2A02 || \
-		       (dev)->pci_device == 0x2A12 || \
-		       (dev)->pci_device == 0x2A42 || \
-		       (dev)->pci_device == 0x2E02 || \
-		       (dev)->pci_device == 0x2E12 || \
-		       (dev)->pci_device == 0x2E22 || \
-		       (dev)->pci_device == 0x2E32 || \
-		       (dev)->pci_device == 0x2E42 || \
-		       (dev)->pci_device == 0x0042 || \
-		       (dev)->pci_device == 0x0046)
-
-#define IS_I965GM(dev) ((dev)->pci_device == 0x2A02 || \
-			(dev)->pci_device == 0x2A12)
-
-#define IS_GM45(dev) ((dev)->pci_device == 0x2A42)
-
-#define IS_G4X(dev) ((dev)->pci_device == 0x2E02 || \
-		     (dev)->pci_device == 0x2E12 || \
-		     (dev)->pci_device == 0x2E22 || \
-		     (dev)->pci_device == 0x2E32 || \
-		     (dev)->pci_device == 0x2E42 || \
-		     IS_GM45(dev))
-
-#define IS_IGDG(dev) ((dev)->pci_device == 0xa001)
-#define IS_IGDGM(dev) ((dev)->pci_device == 0xa011)
-#define IS_IGD(dev) (IS_IGDG(dev) || IS_IGDGM(dev))
-
-#define IS_G33(dev)    ((dev)->pci_device == 0x29C2 ||	\
-			(dev)->pci_device == 0x29B2 ||	\
-			(dev)->pci_device == 0x29D2 ||  \
-			(IS_IGD(dev)))
-
-#define IS_IGDNG_D(dev)	((dev)->pci_device == 0x0042)
-#define IS_IGDNG_M(dev)	((dev)->pci_device == 0x0046)
-#define IS_IGDNG(dev)	(IS_IGDNG_D(dev) || IS_IGDNG_M(dev))
-
-#define IS_I9XX(dev) (IS_I915G(dev) || IS_I915GM(dev) || IS_I945G(dev) || \
-		      IS_I945GM(dev) || IS_I965G(dev) || IS_G33(dev) || \
-		      IS_IGDNG(dev))
-
-#define IS_MOBILE(dev) (IS_I830(dev) || IS_I85X(dev) || IS_I915GM(dev) || \
-			IS_I945GM(dev) || IS_I965GM(dev) || IS_GM45(dev) || \
-			IS_IGD(dev) || IS_IGDNG_M(dev))
-
-#define I915_NEED_GFX_HWS(dev) (IS_G33(dev) || IS_GM45(dev) || IS_G4X(dev) || \
-				IS_IGDNG(dev))
+#define INTEL_INFO(dev)	(((struct drm_i915_private *) (dev)->dev_private)->info)
+
+#define IS_I830(dev)		((dev)->pci_device == 0x3577)
+#define IS_845G(dev)		((dev)->pci_device == 0x2562)
+#define IS_I85X(dev)		((dev)->pci_device == 0x3582)
+#define IS_I865G(dev)		((dev)->pci_device == 0x2572)
+#define IS_I8XX(dev)		(INTEL_INFO(dev)->is_i8xx)
+#define IS_I915G(dev)		(INTEL_INFO(dev)->is_i915g)
+#define IS_I915GM(dev)		((dev)->pci_device == 0x2592)
+#define IS_I945G(dev)		((dev)->pci_device == 0x2772)
+#define IS_I945GM(dev)		(INTEL_INFO(dev)->is_i945gm)
+#define IS_I965G(dev)		(INTEL_INFO(dev)->is_i965g)
+#define IS_I965GM(dev)		(INTEL_INFO(dev)->is_i965gm)
+#define IS_GM45(dev)		((dev)->pci_device == 0x2A42)
+#define IS_G4X(dev)		(INTEL_INFO(dev)->is_g4x)
+#define IS_PINEVIEW_G(dev)	((dev)->pci_device == 0xa001)
+#define IS_PINEVIEW_M(dev)	((dev)->pci_device == 0xa011)
+#define IS_PINEVIEW(dev)	(INTEL_INFO(dev)->is_pineview)
+#define IS_G33(dev)		(INTEL_INFO(dev)->is_g33)
+#define IS_IRONLAKE_D(dev)	((dev)->pci_device == 0x0042)
+#define IS_IRONLAKE_M(dev)	((dev)->pci_device == 0x0046)
+#define IS_IRONLAKE(dev)	(INTEL_INFO(dev)->is_ironlake)
+#define IS_I9XX(dev)		(INTEL_INFO(dev)->is_i9xx)
+#define IS_MOBILE(dev)		(INTEL_INFO(dev)->is_mobile)
+
+#define I915_NEED_GFX_HWS(dev)	(INTEL_INFO(dev)->need_gfx_hws)
+
 /* With the 945 and later, Y tiling got adjusted so that it was 32 128-byte
  * rows, which changed the alignment requirements and fence programming.
  */
 #define HAS_128_BYTE_Y_TILING(dev) (IS_I9XX(dev) && !(IS_I915G(dev) || \
 						      IS_I915GM(dev)))
-#define SUPPORTS_INTEGRATED_HDMI(dev)	(IS_G4X(dev) || IS_IGDNG(dev))
-#define SUPPORTS_INTEGRATED_DP(dev)	(IS_G4X(dev) || IS_IGDNG(dev))
-#define SUPPORTS_EDP(dev)		(IS_IGDNG_M(dev))
-#define I915_HAS_HOTPLUG(dev) (IS_I945G(dev) || IS_I945GM(dev) || IS_G33(dev) || IS_I965G(dev))
+#define SUPPORTS_DIGITAL_OUTPUTS(dev)	(IS_I9XX(dev) && !IS_PINEVIEW(dev))
+#define SUPPORTS_INTEGRATED_HDMI(dev)	(IS_G4X(dev) || IS_IRONLAKE(dev))
+#define SUPPORTS_INTEGRATED_DP(dev)	(IS_G4X(dev) || IS_IRONLAKE(dev))
+#define SUPPORTS_EDP(dev)		(IS_IRONLAKE_M(dev))
+#define SUPPORTS_TV(dev)		(IS_I9XX(dev) && IS_MOBILE(dev) && \
+					!IS_IRONLAKE(dev) && !IS_PINEVIEW(dev))
+#define I915_HAS_HOTPLUG(dev)		 (INTEL_INFO(dev)->has_hotplug)
 /* dsparb controlled by hw only */
-#define DSPARB_HWCONTROL(dev) (IS_G4X(dev) || IS_IGDNG(dev))
-
-#define HAS_FW_BLC(dev) (IS_I9XX(dev) || IS_G4X(dev) || IS_IGDNG(dev))
-#define HAS_PIPE_CXSR(dev) (IS_G4X(dev) || IS_IGDNG(dev))
-#define I915_HAS_FBC(dev) (IS_MOBILE(dev) && \
-			   (IS_I9XX(dev) || IS_GM45(dev)) && \
-			   !IS_IGD(dev) && \
-			   !IS_IGDNG(dev))
+#define DSPARB_HWCONTROL(dev) (IS_G4X(dev) || IS_IRONLAKE(dev))
+
+#define HAS_FW_BLC(dev) (IS_I9XX(dev) || IS_G4X(dev) || IS_IRONLAKE(dev))
+#define HAS_PIPE_CXSR(dev) (INTEL_INFO(dev)->has_pipe_cxsr)
+#define I915_HAS_FBC(dev) (INTEL_INFO(dev)->has_fbc)
+#define I915_HAS_RC6(dev) (INTEL_INFO(dev)->has_rc6)
 
 #define PRIMARY_RINGBUFFER_SIZE         (128*1024)
 
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index abfc27b0c2ea..0c67924ca80c 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1288,6 +1288,7 @@ i915_gem_create_mmap_offset(struct drm_gem_object *obj)
 	list->hash.key = list->file_offset_node->start;
 	if (drm_ht_insert_item(&mm->offset_hash, &list->hash)) {
 		DRM_ERROR("failed to add to map hash\n");
+		ret = -ENOMEM;
 		goto out_free_mm;
 	}
 
@@ -1309,7 +1310,7 @@ out_free_list:
  * i915_gem_release_mmap - remove physical page mappings
  * @obj: obj in question
  *
- * Preserve the reservation of the mmaping with the DRM core code, but
+ * Preserve the reservation of the mmapping with the DRM core code, but
  * relinquish ownership of the pages back to the system.
  *
  * It is vital that we remove the page mapping if we have mapped a tiled
@@ -1583,7 +1584,7 @@ i915_gem_object_move_to_inactive(struct drm_gem_object *obj)
  *
  * Returned sequence numbers are nonzero on success.
  */
-static uint32_t
+uint32_t
 i915_add_request(struct drm_device *dev, struct drm_file *file_priv,
 		 uint32_t flush_domains)
 {
@@ -1617,7 +1618,7 @@ i915_add_request(struct drm_device *dev, struct drm_file *file_priv,
 	OUT_RING(MI_USER_INTERRUPT);
 	ADVANCE_LP_RING();
 
-	DRM_DEBUG("%d\n", seqno);
+	DRM_DEBUG_DRIVER("%d\n", seqno);
 
 	request->seqno = seqno;
 	request->emitted_jiffies = jiffies;
@@ -1820,12 +1821,8 @@ i915_gem_retire_work_handler(struct work_struct *work)
 	mutex_unlock(&dev->struct_mutex);
 }
 
-/**
- * Waits for a sequence number to be signaled, and cleans up the
- * request and object lists appropriately for that event.
- */
-static int
-i915_wait_request(struct drm_device *dev, uint32_t seqno)
+int
+i915_do_wait_request(struct drm_device *dev, uint32_t seqno, int interruptible)
 {
 	drm_i915_private_t *dev_priv = dev->dev_private;
 	u32 ier;
@@ -1837,7 +1834,7 @@ i915_wait_request(struct drm_device *dev, uint32_t seqno)
 		return -EIO;
 
 	if (!i915_seqno_passed(i915_get_gem_seqno(dev), seqno)) {
-		if (IS_IGDNG(dev))
+		if (IS_IRONLAKE(dev))
 			ier = I915_READ(DEIER) | I915_READ(GTIER);
 		else
 			ier = I915_READ(IER);
@@ -1852,10 +1849,15 @@ i915_wait_request(struct drm_device *dev, uint32_t seqno)
 
 		dev_priv->mm.waiting_gem_seqno = seqno;
 		i915_user_irq_get(dev);
-		ret = wait_event_interruptible(dev_priv->irq_queue,
-					       i915_seqno_passed(i915_get_gem_seqno(dev),
-								 seqno) ||
-					       atomic_read(&dev_priv->mm.wedged));
+		if (interruptible)
+			ret = wait_event_interruptible(dev_priv->irq_queue,
+				i915_seqno_passed(i915_get_gem_seqno(dev), seqno) ||
+				atomic_read(&dev_priv->mm.wedged));
+		else
+			wait_event(dev_priv->irq_queue,
+				i915_seqno_passed(i915_get_gem_seqno(dev), seqno) ||
+				atomic_read(&dev_priv->mm.wedged));
+
 		i915_user_irq_put(dev);
 		dev_priv->mm.waiting_gem_seqno = 0;
 
@@ -1879,6 +1881,16 @@ i915_wait_request(struct drm_device *dev, uint32_t seqno)
 	return ret;
 }
 
+/**
+ * Waits for a sequence number to be signaled, and cleans up the
+ * request and object lists appropriately for that event.
+ */
+static int
+i915_wait_request(struct drm_device *dev, uint32_t seqno)
+{
+	return i915_do_wait_request(dev, seqno, 1);
+}
+
 static void
 i915_gem_flush(struct drm_device *dev,
 	       uint32_t invalidate_domains,
@@ -1947,7 +1959,7 @@ i915_gem_flush(struct drm_device *dev,
 #endif
 		BEGIN_LP_RING(2);
 		OUT_RING(cmd);
-		OUT_RING(0); /* noop */
+		OUT_RING(MI_NOOP);
 		ADVANCE_LP_RING();
 	}
 }
@@ -2009,9 +2021,6 @@ i915_gem_object_unbind(struct drm_gem_object *obj)
 	/* blow away mappings if mapped through GTT */
 	i915_gem_release_mmap(obj);
 
-	if (obj_priv->fence_reg != I915_FENCE_REG_NONE)
-		i915_gem_clear_fence_reg(obj);
-
 	/* Move the object to the CPU domain to ensure that
 	 * any possible CPU writes while it's not in the GTT
 	 * are flushed when we go to remap it. This will
@@ -2027,6 +2036,10 @@ i915_gem_object_unbind(struct drm_gem_object *obj)
 
 	BUG_ON(obj_priv->active);
 
+	/* release the fence reg _after_ flushing */
+	if (obj_priv->fence_reg != I915_FENCE_REG_NONE)
+		i915_gem_clear_fence_reg(obj);
+
 	if (obj_priv->agp_mem != NULL) {
 		drm_unbind_agp(obj_priv->agp_mem);
 		drm_free_agp(obj_priv->agp_mem, obj->size / PAGE_SIZE);
@@ -2569,9 +2582,6 @@ i915_gem_object_bind_to_gtt(struct drm_gem_object *obj, unsigned alignment)
 	bool retry_alloc = false;
 	int ret;
 
-	if (dev_priv->mm.suspended)
-		return -EBUSY;
-
 	if (obj_priv->madv != I915_MADV_WILLNEED) {
 		DRM_ERROR("Attempting to bind a purgeable object\n");
 		return -EINVAL;
@@ -2760,6 +2770,22 @@ i915_gem_object_flush_cpu_write_domain(struct drm_gem_object *obj)
 					    old_write_domain);
 }
 
+void
+i915_gem_object_flush_write_domain(struct drm_gem_object *obj)
+{
+	switch (obj->write_domain) {
+	case I915_GEM_DOMAIN_GTT:
+		i915_gem_object_flush_gtt_write_domain(obj);
+		break;
+	case I915_GEM_DOMAIN_CPU:
+		i915_gem_object_flush_cpu_write_domain(obj);
+		break;
+	default:
+		i915_gem_object_flush_gpu_write_domain(obj);
+		break;
+	}
+}
+
 /**
  * Moves a single object to the GTT read, and possibly write domain.
  *
@@ -2811,6 +2837,57 @@ i915_gem_object_set_to_gtt_domain(struct drm_gem_object *obj, int write)
 	return 0;
 }
 
+/*
+ * Prepare buffer for display plane. Use uninterruptible for possible flush
+ * wait, as in modesetting process we're not supposed to be interrupted.
+ */
+int
+i915_gem_object_set_to_display_plane(struct drm_gem_object *obj)
+{
+	struct drm_device *dev = obj->dev;
+	struct drm_i915_gem_object *obj_priv = obj->driver_private;
+	uint32_t old_write_domain, old_read_domains;
+	int ret;
+
+	/* Not valid to be called on unbound objects. */
+	if (obj_priv->gtt_space == NULL)
+		return -EINVAL;
+
+	i915_gem_object_flush_gpu_write_domain(obj);
+
+	/* Wait on any GPU rendering and flushing to occur. */
+	if (obj_priv->active) {
+#if WATCH_BUF
+		DRM_INFO("%s: object %p wait for seqno %08x\n",
+			  __func__, obj, obj_priv->last_rendering_seqno);
+#endif
+		ret = i915_do_wait_request(dev, obj_priv->last_rendering_seqno, 0);
+		if (ret != 0)
+			return ret;
+	}
+
+	old_write_domain = obj->write_domain;
+	old_read_domains = obj->read_domains;
+
+	obj->read_domains &= I915_GEM_DOMAIN_GTT;
+
+	i915_gem_object_flush_cpu_write_domain(obj);
+
+	/* It should now be out of any other write domains, and we can update
+	 * the domain values for our changes.
+	 */
+	BUG_ON((obj->write_domain & ~I915_GEM_DOMAIN_GTT) != 0);
+	obj->read_domains |= I915_GEM_DOMAIN_GTT;
+	obj->write_domain = I915_GEM_DOMAIN_GTT;
+	obj_priv->dirty = 1;
+
+	trace_i915_gem_object_change_domain(obj,
+					    old_read_domains,
+					    old_write_domain);
+
+	return 0;
+}
+
 /**
  * Moves a single object to the CPU read, and possibly write domain.
  *
@@ -3170,7 +3247,7 @@ i915_gem_object_set_cpu_read_domain_range(struct drm_gem_object *obj,
 static int
 i915_gem_object_pin_and_relocate(struct drm_gem_object *obj,
 				 struct drm_file *file_priv,
-				 struct drm_i915_gem_exec_object *entry,
+				 struct drm_i915_gem_exec_object2 *entry,
 				 struct drm_i915_gem_relocation_entry *relocs)
 {
 	struct drm_device *dev = obj->dev;
@@ -3178,12 +3255,35 @@ i915_gem_object_pin_and_relocate(struct drm_gem_object *obj,
 	struct drm_i915_gem_object *obj_priv = obj->driver_private;
 	int i, ret;
 	void __iomem *reloc_page;
+	bool need_fence;
+
+	need_fence = entry->flags & EXEC_OBJECT_NEEDS_FENCE &&
+	             obj_priv->tiling_mode != I915_TILING_NONE;
+
+	/* Check fence reg constraints and rebind if necessary */
+	if (need_fence && !i915_obj_fenceable(dev, obj))
+		i915_gem_object_unbind(obj);
 
 	/* Choose the GTT offset for our buffer and put it there. */
 	ret = i915_gem_object_pin(obj, (uint32_t) entry->alignment);
 	if (ret)
 		return ret;
 
+	/*
+	 * Pre-965 chips need a fence register set up in order to
+	 * properly handle blits to/from tiled surfaces.
+	 */
+	if (need_fence) {
+		ret = i915_gem_object_get_fence_reg(obj);
+		if (ret != 0) {
+			if (ret != -EBUSY && ret != -ERESTARTSYS)
+				DRM_ERROR("Failure to install fence: %d\n",
+					  ret);
+			i915_gem_object_unpin(obj);
+			return ret;
+		}
+	}
+
 	entry->offset = obj_priv->gtt_offset;
 
 	/* Apply the relocations, using the GTT aperture to avoid cache
@@ -3345,7 +3445,7 @@ i915_gem_object_pin_and_relocate(struct drm_gem_object *obj,
  */
 static int
 i915_dispatch_gem_execbuffer(struct drm_device *dev,
-			      struct drm_i915_gem_execbuffer *exec,
+			      struct drm_i915_gem_execbuffer2 *exec,
 			      struct drm_clip_rect *cliprects,
 			      uint64_t exec_offset)
 {
@@ -3435,7 +3535,7 @@ i915_gem_ring_throttle(struct drm_device *dev, struct drm_file *file_priv)
 }
 
 static int
-i915_gem_get_relocs_from_user(struct drm_i915_gem_exec_object *exec_list,
+i915_gem_get_relocs_from_user(struct drm_i915_gem_exec_object2 *exec_list,
 			      uint32_t buffer_count,
 			      struct drm_i915_gem_relocation_entry **relocs)
 {
@@ -3450,8 +3550,10 @@ i915_gem_get_relocs_from_user(struct drm_i915_gem_exec_object *exec_list,
 	}
 
 	*relocs = drm_calloc_large(reloc_count, sizeof(**relocs));
-	if (*relocs == NULL)
+	if (*relocs == NULL) {
+		DRM_ERROR("failed to alloc relocs, count %d\n", reloc_count);
 		return -ENOMEM;
+	}
 
 	for (i = 0; i < buffer_count; i++) {
 		struct drm_i915_gem_relocation_entry __user *user_relocs;
@@ -3475,7 +3577,7 @@ i915_gem_get_relocs_from_user(struct drm_i915_gem_exec_object *exec_list,
 }
 
 static int
-i915_gem_put_relocs_to_user(struct drm_i915_gem_exec_object *exec_list,
+i915_gem_put_relocs_to_user(struct drm_i915_gem_exec_object2 *exec_list,
 			    uint32_t buffer_count,
 			    struct drm_i915_gem_relocation_entry *relocs)
 {
@@ -3508,7 +3610,7 @@ err:
 }
 
 static int
-i915_gem_check_execbuffer (struct drm_i915_gem_execbuffer *exec,
+i915_gem_check_execbuffer (struct drm_i915_gem_execbuffer2 *exec,
 			   uint64_t exec_offset)
 {
 	uint32_t exec_start, exec_len;
@@ -3525,22 +3627,57 @@ i915_gem_check_execbuffer (struct drm_i915_gem_execbuffer *exec,
 	return 0;
 }
 
+static int
+i915_gem_wait_for_pending_flip(struct drm_device *dev,
+			       struct drm_gem_object **object_list,
+			       int count)
+{
+	drm_i915_private_t *dev_priv = dev->dev_private;
+	struct drm_i915_gem_object *obj_priv;
+	DEFINE_WAIT(wait);
+	int i, ret = 0;
+
+	for (;;) {
+		prepare_to_wait(&dev_priv->pending_flip_queue,
+				&wait, TASK_INTERRUPTIBLE);
+		for (i = 0; i < count; i++) {
+			obj_priv = object_list[i]->driver_private;
+			if (atomic_read(&obj_priv->pending_flip) > 0)
+				break;
+		}
+		if (i == count)
+			break;
+
+		if (!signal_pending(current)) {
+			mutex_unlock(&dev->struct_mutex);
+			schedule();
+			mutex_lock(&dev->struct_mutex);
+			continue;
+		}
+		ret = -ERESTARTSYS;
+		break;
+	}
+	finish_wait(&dev_priv->pending_flip_queue, &wait);
+
+	return ret;
+}
+
 int
-i915_gem_execbuffer(struct drm_device *dev, void *data,
-		    struct drm_file *file_priv)
+i915_gem_do_execbuffer(struct drm_device *dev, void *data,
+		       struct drm_file *file_priv,
+		       struct drm_i915_gem_execbuffer2 *args,
+		       struct drm_i915_gem_exec_object2 *exec_list)
 {
 	drm_i915_private_t *dev_priv = dev->dev_private;
-	struct drm_i915_gem_execbuffer *args = data;
-	struct drm_i915_gem_exec_object *exec_list = NULL;
 	struct drm_gem_object **object_list = NULL;
 	struct drm_gem_object *batch_obj;
 	struct drm_i915_gem_object *obj_priv;
 	struct drm_clip_rect *cliprects = NULL;
 	struct drm_i915_gem_relocation_entry *relocs;
-	int ret, ret2, i, pinned = 0;
+	int ret = 0, ret2, i, pinned = 0;
 	uint64_t exec_offset;
 	uint32_t seqno, flush_domains, reloc_index;
-	int pin_tries;
+	int pin_tries, flips;
 
 #if WATCH_EXEC
 	DRM_INFO("buffers_ptr %d buffer_count %d len %08x\n",
@@ -3551,25 +3688,13 @@ i915_gem_execbuffer(struct drm_device *dev, void *data,
 		DRM_ERROR("execbuf with %d buffers\n", args->buffer_count);
 		return -EINVAL;
 	}
-	/* Copy in the exec list from userland */
-	exec_list = drm_calloc_large(sizeof(*exec_list), args->buffer_count);
-	object_list = drm_calloc_large(sizeof(*object_list), args->buffer_count);
-	if (exec_list == NULL || object_list == NULL) {
-		DRM_ERROR("Failed to allocate exec or object list "
-			  "for %d buffers\n",
+	object_list = drm_malloc_ab(sizeof(*object_list), args->buffer_count);
+	if (object_list == NULL) {
+		DRM_ERROR("Failed to allocate object list for %d buffers\n",
 			  args->buffer_count);
 		ret = -ENOMEM;
 		goto pre_mutex_err;
 	}
-	ret = copy_from_user(exec_list,
-			     (struct drm_i915_relocation_entry __user *)
-			     (uintptr_t) args->buffers_ptr,
-			     sizeof(*exec_list) * args->buffer_count);
-	if (ret != 0) {
-		DRM_ERROR("copy %d exec entries failed %d\n",
-			  args->buffer_count, ret);
-		goto pre_mutex_err;
-	}
 
 	if (args->num_cliprects != 0) {
 		cliprects = kcalloc(args->num_cliprects, sizeof(*cliprects),
@@ -3598,20 +3723,19 @@ i915_gem_execbuffer(struct drm_device *dev, void *data,
 	i915_verify_inactive(dev, __FILE__, __LINE__);
 
 	if (atomic_read(&dev_priv->mm.wedged)) {
-		DRM_ERROR("Execbuf while wedged\n");
 		mutex_unlock(&dev->struct_mutex);
 		ret = -EIO;
 		goto pre_mutex_err;
 	}
 
 	if (dev_priv->mm.suspended) {
-		DRM_ERROR("Execbuf while VT-switched.\n");
 		mutex_unlock(&dev->struct_mutex);
 		ret = -EBUSY;
 		goto pre_mutex_err;
 	}
 
 	/* Look up object handles */
+	flips = 0;
 	for (i = 0; i < args->buffer_count; i++) {
 		object_list[i] = drm_gem_object_lookup(dev, file_priv,
 						       exec_list[i].handle);
@@ -3630,6 +3754,14 @@ i915_gem_execbuffer(struct drm_device *dev, void *data,
 			goto err;
 		}
 		obj_priv->in_execbuffer = true;
+		flips += atomic_read(&obj_priv->pending_flip);
+	}
+
+	if (flips > 0) {
+		ret = i915_gem_wait_for_pending_flip(dev, object_list,
+						     args->buffer_count);
+		if (ret)
+			goto err;
 	}
 
 	/* Pin and relocate */
@@ -3814,20 +3946,6 @@ err:
 
 	mutex_unlock(&dev->struct_mutex);
 
-	if (!ret) {
-		/* Copy the new buffer offsets back to the user's exec list. */
-		ret = copy_to_user((struct drm_i915_relocation_entry __user *)
-				   (uintptr_t) args->buffers_ptr,
-				   exec_list,
-				   sizeof(*exec_list) * args->buffer_count);
-		if (ret) {
-			ret = -EFAULT;
-			DRM_ERROR("failed to copy %d exec entries "
-				  "back to user (%d)\n",
-				  args->buffer_count, ret);
-		}
-	}
-
 	/* Copy the updated relocations out regardless of current error
 	 * state.  Failure to update the relocs would mean that the next
 	 * time userland calls execbuf, it would do so with presumed offset
@@ -3844,12 +3962,156 @@ err:
 
 pre_mutex_err:
 	drm_free_large(object_list);
-	drm_free_large(exec_list);
 	kfree(cliprects);
 
 	return ret;
 }
 
+/*
+ * Legacy execbuffer just creates an exec2 list from the original exec object
+ * list array and passes it to the real function.
+ */
+int
+i915_gem_execbuffer(struct drm_device *dev, void *data,
+		    struct drm_file *file_priv)
+{
+	struct drm_i915_gem_execbuffer *args = data;
+	struct drm_i915_gem_execbuffer2 exec2;
+	struct drm_i915_gem_exec_object *exec_list = NULL;
+	struct drm_i915_gem_exec_object2 *exec2_list = NULL;
+	int ret, i;
+
+#if WATCH_EXEC
+	DRM_INFO("buffers_ptr %d buffer_count %d len %08x\n",
+		  (int) args->buffers_ptr, args->buffer_count, args->batch_len);
+#endif
+
+	if (args->buffer_count < 1) {
+		DRM_ERROR("execbuf with %d buffers\n", args->buffer_count);
+		return -EINVAL;
+	}
+
+	/* Copy in the exec list from userland */
+	exec_list = drm_malloc_ab(sizeof(*exec_list), args->buffer_count);
+	exec2_list = drm_malloc_ab(sizeof(*exec2_list), args->buffer_count);
+	if (exec_list == NULL || exec2_list == NULL) {
+		DRM_ERROR("Failed to allocate exec list for %d buffers\n",
+			  args->buffer_count);
+		drm_free_large(exec_list);
+		drm_free_large(exec2_list);
+		return -ENOMEM;
+	}
+	ret = copy_from_user(exec_list,
+			     (struct drm_i915_relocation_entry __user *)
+			     (uintptr_t) args->buffers_ptr,
+			     sizeof(*exec_list) * args->buffer_count);
+	if (ret != 0) {
+		DRM_ERROR("copy %d exec entries failed %d\n",
+			  args->buffer_count, ret);
+		drm_free_large(exec_list);
+		drm_free_large(exec2_list);
+		return -EFAULT;
+	}
+
+	for (i = 0; i < args->buffer_count; i++) {
+		exec2_list[i].handle = exec_list[i].handle;
+		exec2_list[i].relocation_count = exec_list[i].relocation_count;
+		exec2_list[i].relocs_ptr = exec_list[i].relocs_ptr;
+		exec2_list[i].alignment = exec_list[i].alignment;
+		exec2_list[i].offset = exec_list[i].offset;
+		if (!IS_I965G(dev))
+			exec2_list[i].flags = EXEC_OBJECT_NEEDS_FENCE;
+		else
+			exec2_list[i].flags = 0;
+	}
+
+	exec2.buffers_ptr = args->buffers_ptr;
+	exec2.buffer_count = args->buffer_count;
+	exec2.batch_start_offset = args->batch_start_offset;
+	exec2.batch_len = args->batch_len;
+	exec2.DR1 = args->DR1;
+	exec2.DR4 = args->DR4;
+	exec2.num_cliprects = args->num_cliprects;
+	exec2.cliprects_ptr = args->cliprects_ptr;
+	exec2.flags = 0;
+
+	ret = i915_gem_do_execbuffer(dev, data, file_priv, &exec2, exec2_list);
+	if (!ret) {
+		/* Copy the new buffer offsets back to the user's exec list. */
+		for (i = 0; i < args->buffer_count; i++)
+			exec_list[i].offset = exec2_list[i].offset;
+		/* ... and back out to userspace */
+		ret = copy_to_user((struct drm_i915_relocation_entry __user *)
+				   (uintptr_t) args->buffers_ptr,
+				   exec_list,
+				   sizeof(*exec_list) * args->buffer_count);
+		if (ret) {
+			ret = -EFAULT;
+			DRM_ERROR("failed to copy %d exec entries "
+				  "back to user (%d)\n",
+				  args->buffer_count, ret);
+		}
+	}
+
+	drm_free_large(exec_list);
+	drm_free_large(exec2_list);
+	return ret;
+}
+
+int
+i915_gem_execbuffer2(struct drm_device *dev, void *data,
+		     struct drm_file *file_priv)
+{
+	struct drm_i915_gem_execbuffer2 *args = data;
+	struct drm_i915_gem_exec_object2 *exec2_list = NULL;
+	int ret;
+
+#if WATCH_EXEC
+	DRM_INFO("buffers_ptr %d buffer_count %d len %08x\n",
+		  (int) args->buffers_ptr, args->buffer_count, args->batch_len);
+#endif
+
+	if (args->buffer_count < 1) {
+		DRM_ERROR("execbuf2 with %d buffers\n", args->buffer_count);
+		return -EINVAL;
+	}
+
+	exec2_list = drm_malloc_ab(sizeof(*exec2_list), args->buffer_count);
+	if (exec2_list == NULL) {
+		DRM_ERROR("Failed to allocate exec list for %d buffers\n",
+			  args->buffer_count);
+		return -ENOMEM;
+	}
+	ret = copy_from_user(exec2_list,
+			     (struct drm_i915_relocation_entry __user *)
+			     (uintptr_t) args->buffers_ptr,
+			     sizeof(*exec2_list) * args->buffer_count);
+	if (ret != 0) {
+		DRM_ERROR("copy %d exec entries failed %d\n",
+			  args->buffer_count, ret);
+		drm_free_large(exec2_list);
+		return -EFAULT;
+	}
+
+	ret = i915_gem_do_execbuffer(dev, data, file_priv, args, exec2_list);
+	if (!ret) {
+		/* Copy the new buffer offsets back to the user's exec list. */
+		ret = copy_to_user((struct drm_i915_relocation_entry __user *)
+				   (uintptr_t) args->buffers_ptr,
+				   exec2_list,
+				   sizeof(*exec2_list) * args->buffer_count);
+		if (ret) {
+			ret = -EFAULT;
+			DRM_ERROR("failed to copy %d exec entries "
+				  "back to user (%d)\n",
+				  args->buffer_count, ret);
+		}
+	}
+
+	drm_free_large(exec2_list);
+	return ret;
+}
+
 int
 i915_gem_object_pin(struct drm_gem_object *obj, uint32_t alignment)
 {
@@ -3863,19 +4125,7 @@ i915_gem_object_pin(struct drm_gem_object *obj, uint32_t alignment)
 		if (ret)
 			return ret;
 	}
-	/*
-	 * Pre-965 chips need a fence register set up in order to
-	 * properly handle tiled surfaces.
-	 */
-	if (!IS_I965G(dev) && obj_priv->tiling_mode != I915_TILING_NONE) {
-		ret = i915_gem_object_get_fence_reg(obj);
-		if (ret != 0) {
-			if (ret != -EBUSY && ret != -ERESTARTSYS)
-				DRM_ERROR("Failure to install fence: %d\n",
-					  ret);
-			return ret;
-		}
-	}
+
 	obj_priv->pin_count++;
 
 	/* If the object is not active and not pending a flush,
@@ -4356,7 +4606,7 @@ i915_gem_init_hws(struct drm_device *dev)
 	memset(dev_priv->hw_status_page, 0, PAGE_SIZE);
 	I915_WRITE(HWS_PGA, dev_priv->status_gfx_addr);
 	I915_READ(HWS_PGA); /* posting read */
-	DRM_DEBUG("hws offset: 0x%08x\n", dev_priv->status_gfx_addr);
+	DRM_DEBUG_DRIVER("hws offset: 0x%08x\n", dev_priv->status_gfx_addr);
 
 	return 0;
 }
@@ -4614,8 +4864,8 @@ i915_gem_load(struct drm_device *dev)
 			for (i = 0; i < 8; i++)
 				I915_WRITE(FENCE_REG_945_8 + (i * 4), 0);
 	}
-
 	i915_gem_detect_bit_6_swizzle(dev);
+	init_waitqueue_head(&dev_priv->pending_flip_queue);
 }
 
 /*
@@ -4638,7 +4888,7 @@ int i915_gem_init_phys_object(struct drm_device *dev,
 
 	phys_obj->id = id;
 
-	phys_obj->handle = drm_pci_alloc(dev, size, 0, 0xffffffff);
+	phys_obj->handle = drm_pci_alloc(dev, size, 0);
 	if (!phys_obj->handle) {
 		ret = -ENOMEM;
 		goto kfree_obj;
@@ -4790,7 +5040,7 @@ i915_gem_phys_pwrite(struct drm_device *dev, struct drm_gem_object *obj,
 	user_data = (char __user *) (uintptr_t) args->data_ptr;
 	obj_addr = obj_priv->phys_obj->handle->vaddr + args->offset;
 
-	DRM_DEBUG("obj_addr %p, %lld\n", obj_addr, args->size);
+	DRM_DEBUG_DRIVER("obj_addr %p, %lld\n", obj_addr, args->size);
 	ret = copy_from_user(obj_addr, user_data, args->size);
 	if (ret)
 		return -EFAULT;
diff --git a/drivers/gpu/drm/i915/i915_gem_tiling.c b/drivers/gpu/drm/i915/i915_gem_tiling.c
index 200e398453ca..df278b2685bf 100644
--- a/drivers/gpu/drm/i915/i915_gem_tiling.c
+++ b/drivers/gpu/drm/i915/i915_gem_tiling.c
@@ -121,7 +121,7 @@ intel_alloc_mchbar_resource(struct drm_device *dev)
 				     0,   pcibios_align_resource,
 				     dev_priv->bridge_dev);
 	if (ret) {
-		DRM_DEBUG("failed bus alloc: %d\n", ret);
+		DRM_DEBUG_DRIVER("failed bus alloc: %d\n", ret);
 		dev_priv->mch_res.start = 0;
 		goto out;
 	}
@@ -209,8 +209,8 @@ i915_gem_detect_bit_6_swizzle(struct drm_device *dev)
 	uint32_t swizzle_y = I915_BIT_6_SWIZZLE_UNKNOWN;
 	bool need_disable;
 
-	if (IS_IGDNG(dev)) {
-		/* On IGDNG whatever DRAM config, GPU always do
+	if (IS_IRONLAKE(dev)) {
+		/* On Ironlake whatever DRAM config, GPU always do
 		 * same swizzling setup.
 		 */
 		swizzle_x = I915_BIT_6_SWIZZLE_9_10;
@@ -304,35 +304,39 @@ i915_gem_detect_bit_6_swizzle(struct drm_device *dev)
 
 
 /**
- * Returns the size of the fence for a tiled object of the given size.
+ * Returns whether an object is currently fenceable.  If not, it may need
+ * to be unbound and have its pitch adjusted.
  */
-static int
-i915_get_fence_size(struct drm_device *dev, int size)
+bool
+i915_obj_fenceable(struct drm_device *dev, struct drm_gem_object *obj)
 {
-	int i;
-	int start;
+	struct drm_i915_gem_object *obj_priv = obj->driver_private;
 
 	if (IS_I965G(dev)) {
 		/* The 965 can have fences at any page boundary. */
-		return ALIGN(size, 4096);
+		if (obj->size & 4095)
+			return false;
+		return true;
+	} else if (IS_I9XX(dev)) {
+		if (obj_priv->gtt_offset & ~I915_FENCE_START_MASK)
+			return false;
 	} else {
-		/* Align the size to a power of two greater than the smallest
-		 * fence size.
-		 */
-		if (IS_I9XX(dev))
-			start = 1024 * 1024;
-		else
-			start = 512 * 1024;
+		if (obj_priv->gtt_offset & ~I830_FENCE_START_MASK)
+			return false;
+	}
 
-		for (i = start; i < size; i <<= 1)
-			;
+	/* Power of two sized... */
+	if (obj->size & (obj->size - 1))
+		return false;
 
-		return i;
-	}
+	/* Objects must be size aligned as well */
+	if (obj_priv->gtt_offset & (obj->size - 1))
+		return false;
+	return true;
 }
 
 /* Check pitch constriants for all chips & tiling formats */
-static bool
+bool
 i915_tiling_ok(struct drm_device *dev, int stride, int size, int tiling_mode)
 {
 	int tile_width;
@@ -384,12 +388,6 @@ i915_tiling_ok(struct drm_device *dev, int stride, int size, int tiling_mode)
 	if (stride & (stride - 1))
 		return false;
 
-	/* We don't 0handle the aperture area covered by the fence being bigger
-	 * than the object size.
-	 */
-	if (i915_get_fence_size(dev, size) != size)
-		return false;
-
 	return true;
 }
 
diff --git a/drivers/gpu/drm/i915/i915_ioc32.c b/drivers/gpu/drm/i915/i915_ioc32.c
index 1fe68a251b75..13b028994b2b 100644
--- a/drivers/gpu/drm/i915/i915_ioc32.c
+++ b/drivers/gpu/drm/i915/i915_ioc32.c
@@ -66,8 +66,7 @@ static int compat_i915_batchbuffer(struct file *file, unsigned int cmd,
 			  &batchbuffer->cliprects))
 		return -EFAULT;
 
-	return drm_ioctl(file->f_path.dentry->d_inode, file,
-			 DRM_IOCTL_I915_BATCHBUFFER,
+	return drm_ioctl(file, DRM_IOCTL_I915_BATCHBUFFER,
 			 (unsigned long)batchbuffer);
 }
 
@@ -102,8 +101,8 @@ static int compat_i915_cmdbuffer(struct file *file, unsigned int cmd,
 			  &cmdbuffer->cliprects))
 		return -EFAULT;
 
-	return drm_ioctl(file->f_path.dentry->d_inode, file,
-			 DRM_IOCTL_I915_CMDBUFFER, (unsigned long)cmdbuffer);
+	return drm_ioctl(file, DRM_IOCTL_I915_CMDBUFFER,
+			 (unsigned long)cmdbuffer);
 }
 
 typedef struct drm_i915_irq_emit32 {
@@ -125,8 +124,8 @@ static int compat_i915_irq_emit(struct file *file, unsigned int cmd,
 			  &request->irq_seq))
 		return -EFAULT;
 
-	return drm_ioctl(file->f_path.dentry->d_inode, file,
-			 DRM_IOCTL_I915_IRQ_EMIT, (unsigned long)request);
+	return drm_ioctl(file, DRM_IOCTL_I915_IRQ_EMIT,
+			 (unsigned long)request);
 }
 typedef struct drm_i915_getparam32 {
 	int param;
@@ -149,8 +148,8 @@ static int compat_i915_getparam(struct file *file, unsigned int cmd,
 			  &request->value))
 		return -EFAULT;
 
-	return drm_ioctl(file->f_path.dentry->d_inode, file,
-			 DRM_IOCTL_I915_GETPARAM, (unsigned long)request);
+	return drm_ioctl(file, DRM_IOCTL_I915_GETPARAM,
+			 (unsigned long)request);
 }
 
 typedef struct drm_i915_mem_alloc32 {
@@ -178,8 +177,8 @@ static int compat_i915_alloc(struct file *file, unsigned int cmd,
 			  &request->region_offset))
 		return -EFAULT;
 
-	return drm_ioctl(file->f_path.dentry->d_inode, file,
-			 DRM_IOCTL_I915_ALLOC, (unsigned long)request);
+	return drm_ioctl(file, DRM_IOCTL_I915_ALLOC,
+			 (unsigned long)request);
 }
 
 drm_ioctl_compat_t *i915_compat_ioctls[] = {
@@ -211,12 +210,10 @@ long i915_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 	if (nr < DRM_COMMAND_BASE + DRM_ARRAY_SIZE(i915_compat_ioctls))
 		fn = i915_compat_ioctls[nr - DRM_COMMAND_BASE];
 
-	lock_kernel();		/* XXX for now */
 	if (fn != NULL)
 		ret = (*fn) (filp, cmd, arg);
 	else
-		ret = drm_ioctl(filp->f_path.dentry->d_inode, filp, cmd, arg);
-	unlock_kernel();
+		ret = drm_ioctl(filp, cmd, arg);
 
 	return ret;
 }
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index aa7fd82aa6eb..89a071a3e6fb 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -43,10 +43,13 @@
  * we leave them always unmasked in IMR and then control enabling them through
  * PIPESTAT alone.
  */
-#define I915_INTERRUPT_ENABLE_FIX (I915_ASLE_INTERRUPT |		 \
-				   I915_DISPLAY_PIPE_A_EVENT_INTERRUPT | \
-				   I915_DISPLAY_PIPE_B_EVENT_INTERRUPT | \
-				   I915_RENDER_COMMAND_PARSER_ERROR_INTERRUPT)
+#define I915_INTERRUPT_ENABLE_FIX			\
+	(I915_ASLE_INTERRUPT |				\
+	 I915_DISPLAY_PIPE_A_EVENT_INTERRUPT |		\
+	 I915_DISPLAY_PIPE_B_EVENT_INTERRUPT |		\
+	 I915_DISPLAY_PLANE_A_FLIP_PENDING_INTERRUPT |	\
+	 I915_DISPLAY_PLANE_B_FLIP_PENDING_INTERRUPT |	\
+	 I915_RENDER_COMMAND_PARSER_ERROR_INTERRUPT)
 
 /** Interrupts that we mask and unmask at runtime. */
 #define I915_INTERRUPT_ENABLE_VAR (I915_USER_INTERRUPT)
@@ -61,7 +64,7 @@
 					 DRM_I915_VBLANK_PIPE_B)
 
 void
-igdng_enable_graphics_irq(drm_i915_private_t *dev_priv, u32 mask)
+ironlake_enable_graphics_irq(drm_i915_private_t *dev_priv, u32 mask)
 {
 	if ((dev_priv->gt_irq_mask_reg & mask) != 0) {
 		dev_priv->gt_irq_mask_reg &= ~mask;
@@ -71,7 +74,7 @@ igdng_enable_graphics_irq(drm_i915_private_t *dev_priv, u32 mask)
 }
 
 static inline void
-igdng_disable_graphics_irq(drm_i915_private_t *dev_priv, u32 mask)
+ironlake_disable_graphics_irq(drm_i915_private_t *dev_priv, u32 mask)
 {
 	if ((dev_priv->gt_irq_mask_reg & mask) != mask) {
 		dev_priv->gt_irq_mask_reg |= mask;
@@ -82,7 +85,7 @@ igdng_disable_graphics_irq(drm_i915_private_t *dev_priv, u32 mask)
 
 /* For display hotplug interrupt */
 void
-igdng_enable_display_irq(drm_i915_private_t *dev_priv, u32 mask)
+ironlake_enable_display_irq(drm_i915_private_t *dev_priv, u32 mask)
 {
 	if ((dev_priv->irq_mask_reg & mask) != 0) {
 		dev_priv->irq_mask_reg &= ~mask;
@@ -92,7 +95,7 @@ igdng_enable_display_irq(drm_i915_private_t *dev_priv, u32 mask)
 }
 
 static inline void
-igdng_disable_display_irq(drm_i915_private_t *dev_priv, u32 mask)
+ironlake_disable_display_irq(drm_i915_private_t *dev_priv, u32 mask)
 {
 	if ((dev_priv->irq_mask_reg & mask) != mask) {
 		dev_priv->irq_mask_reg |= mask;
@@ -157,6 +160,20 @@ i915_disable_pipestat(drm_i915_private_t *dev_priv, int pipe, u32 mask)
 }
 
 /**
+ * intel_enable_asle - enable ASLE interrupt for OpRegion
+ */
+void intel_enable_asle (struct drm_device *dev)
+{
+	drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+
+	if (IS_IRONLAKE(dev))
+		ironlake_enable_display_irq(dev_priv, DE_GSE);
+	else
+		i915_enable_pipestat(dev_priv, 1,
+				     I915_LEGACY_BLC_EVENT_ENABLE);
+}
+
+/**
  * i915_pipe_enabled - check if a pipe is enabled
  * @dev: DRM device
  * @pipe: pipe to check
@@ -191,7 +208,8 @@ u32 i915_get_vblank_counter(struct drm_device *dev, int pipe)
 	low_frame = pipe ? PIPEBFRAMEPIXEL : PIPEAFRAMEPIXEL;
 
 	if (!i915_pipe_enabled(dev, pipe)) {
-		DRM_DEBUG("trying to get vblank count for disabled pipe %d\n", pipe);
+		DRM_DEBUG_DRIVER("trying to get vblank count for disabled "
+				"pipe %d\n", pipe);
 		return 0;
 	}
 
@@ -220,7 +238,8 @@ u32 gm45_get_vblank_counter(struct drm_device *dev, int pipe)
 	int reg = pipe ? PIPEB_FRMCOUNT_GM45 : PIPEA_FRMCOUNT_GM45;
 
 	if (!i915_pipe_enabled(dev, pipe)) {
-		DRM_DEBUG("trying to get vblank count for disabled pipe %d\n", pipe);
+		DRM_DEBUG_DRIVER("trying to get vblank count for disabled "
+					"pipe %d\n", pipe);
 		return 0;
 	}
 
@@ -250,12 +269,11 @@ static void i915_hotplug_work_func(struct work_struct *work)
 	drm_sysfs_hotplug_event(dev);
 }
 
-irqreturn_t igdng_irq_handler(struct drm_device *dev)
+irqreturn_t ironlake_irq_handler(struct drm_device *dev)
 {
 	drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
 	int ret = IRQ_NONE;
-	u32 de_iir, gt_iir, de_ier;
-	u32 new_de_iir, new_gt_iir;
+	u32 de_iir, gt_iir, de_ier, pch_iir;
 	struct drm_i915_master_private *master_priv;
 
 	/* disable master interrupt before clearing iir  */
@@ -265,36 +283,44 @@ irqreturn_t igdng_irq_handler(struct drm_device *dev)
 
 	de_iir = I915_READ(DEIIR);
 	gt_iir = I915_READ(GTIIR);
+	pch_iir = I915_READ(SDEIIR);
 
-	for (;;) {
-		if (de_iir == 0 && gt_iir == 0)
-			break;
+	if (de_iir == 0 && gt_iir == 0 && pch_iir == 0)
+		goto done;
 
-		ret = IRQ_HANDLED;
+	ret = IRQ_HANDLED;
 
-		I915_WRITE(DEIIR, de_iir);
-		new_de_iir = I915_READ(DEIIR);
-		I915_WRITE(GTIIR, gt_iir);
-		new_gt_iir = I915_READ(GTIIR);
+	if (dev->primary->master) {
+		master_priv = dev->primary->master->driver_priv;
+		if (master_priv->sarea_priv)
+			master_priv->sarea_priv->last_dispatch =
+				READ_BREADCRUMB(dev_priv);
+	}
 
-		if (dev->primary->master) {
-			master_priv = dev->primary->master->driver_priv;
-			if (master_priv->sarea_priv)
-				master_priv->sarea_priv->last_dispatch =
-					READ_BREADCRUMB(dev_priv);
-		}
+	if (gt_iir & GT_USER_INTERRUPT) {
+		u32 seqno = i915_get_gem_seqno(dev);
+		dev_priv->mm.irq_gem_seqno = seqno;
+		trace_i915_gem_request_complete(dev, seqno);
+		DRM_WAKEUP(&dev_priv->irq_queue);
+		dev_priv->hangcheck_count = 0;
+		mod_timer(&dev_priv->hangcheck_timer, jiffies + DRM_I915_HANGCHECK_PERIOD);
+	}
 
-		if (gt_iir & GT_USER_INTERRUPT) {
-			u32 seqno = i915_get_gem_seqno(dev);
-			dev_priv->mm.irq_gem_seqno = seqno;
-			trace_i915_gem_request_complete(dev, seqno);
-			DRM_WAKEUP(&dev_priv->irq_queue);
-		}
+	if (de_iir & DE_GSE)
+		ironlake_opregion_gse_intr(dev);
 
-		de_iir = new_de_iir;
-		gt_iir = new_gt_iir;
+	/* check event from PCH */
+	if ((de_iir & DE_PCH_EVENT) &&
+	    (pch_iir & SDE_HOTPLUG_MASK)) {
+		queue_work(dev_priv->wq, &dev_priv->hotplug_work);
 	}
 
+	/* should clear PCH hotplug event before clear CPU irq */
+	I915_WRITE(SDEIIR, pch_iir);
+	I915_WRITE(GTIIR, gt_iir);
+	I915_WRITE(DEIIR, de_iir);
+
+done:
 	I915_WRITE(DEIER, de_ier);
 	(void)I915_READ(DEIER);
 
@@ -317,19 +343,19 @@ static void i915_error_work_func(struct work_struct *work)
 	char *reset_event[] = { "RESET=1", NULL };
 	char *reset_done_event[] = { "ERROR=0", NULL };
 
-	DRM_DEBUG("generating error event\n");
+	DRM_DEBUG_DRIVER("generating error event\n");
 	kobject_uevent_env(&dev->primary->kdev.kobj, KOBJ_CHANGE, error_event);
 
 	if (atomic_read(&dev_priv->mm.wedged)) {
 		if (IS_I965G(dev)) {
-			DRM_DEBUG("resetting chip\n");
+			DRM_DEBUG_DRIVER("resetting chip\n");
 			kobject_uevent_env(&dev->primary->kdev.kobj, KOBJ_CHANGE, reset_event);
 			if (!i965_reset(dev, GDRST_RENDER)) {
 				atomic_set(&dev_priv->mm.wedged, 0);
 				kobject_uevent_env(&dev->primary->kdev.kobj, KOBJ_CHANGE, reset_done_event);
 			}
 		} else {
-			printk("reboot required\n");
+			DRM_DEBUG_DRIVER("reboot required\n");
 		}
 	}
 }
@@ -355,7 +381,7 @@ static void i915_capture_error_state(struct drm_device *dev)
 
 	error = kmalloc(sizeof(*error), GFP_ATOMIC);
 	if (!error) {
-		DRM_DEBUG("out ot memory, not capturing error state\n");
+		DRM_DEBUG_DRIVER("out ot memory, not capturing error state\n");
 		goto out;
 	}
 
@@ -512,7 +538,6 @@ static void i915_handle_error(struct drm_device *dev, bool wedged)
 		/*
 		 * Wakeup waiting processes so they don't hang
 		 */
-		printk("i915: Waking up sleeping processes\n");
 		DRM_WAKEUP(&dev_priv->irq_queue);
 	}
 
@@ -535,8 +560,8 @@ irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
 
 	atomic_inc(&dev_priv->irq_received);
 
-	if (IS_IGDNG(dev))
-		return igdng_irq_handler(dev);
+	if (IS_IRONLAKE(dev))
+		return ironlake_irq_handler(dev);
 
 	iir = I915_READ(IIR);
 
@@ -568,14 +593,14 @@ irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
 		 */
 		if (pipea_stats & 0x8000ffff) {
 			if (pipea_stats &  PIPE_FIFO_UNDERRUN_STATUS)
-				DRM_DEBUG("pipe a underrun\n");
+				DRM_DEBUG_DRIVER("pipe a underrun\n");
 			I915_WRITE(PIPEASTAT, pipea_stats);
 			irq_received = 1;
 		}
 
 		if (pipeb_stats & 0x8000ffff) {
 			if (pipeb_stats &  PIPE_FIFO_UNDERRUN_STATUS)
-				DRM_DEBUG("pipe b underrun\n");
+				DRM_DEBUG_DRIVER("pipe b underrun\n");
 			I915_WRITE(PIPEBSTAT, pipeb_stats);
 			irq_received = 1;
 		}
@@ -591,7 +616,7 @@ irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
 		    (iir & I915_DISPLAY_PORT_INTERRUPT)) {
 			u32 hotplug_status = I915_READ(PORT_HOTPLUG_STAT);
 
-			DRM_DEBUG("hotplug event received, stat 0x%08x\n",
+			DRM_DEBUG_DRIVER("hotplug event received, stat 0x%08x\n",
 				  hotplug_status);
 			if (hotplug_status & dev_priv->hotplug_supported_mask)
 				queue_work(dev_priv->wq,
@@ -599,27 +624,6 @@ irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
 
 			I915_WRITE(PORT_HOTPLUG_STAT, hotplug_status);
 			I915_READ(PORT_HOTPLUG_STAT);
-
-			/* EOS interrupts occurs */
-			if (IS_IGD(dev) &&
-				(hotplug_status & CRT_EOS_INT_STATUS)) {
-				u32 temp;
-
-				DRM_DEBUG("EOS interrupt occurs\n");
-				/* status is already cleared */
-				temp = I915_READ(ADPA);
-				temp &= ~ADPA_DAC_ENABLE;
-				I915_WRITE(ADPA, temp);
-
-				temp = I915_READ(PORT_HOTPLUG_EN);
-				temp &= ~CRT_EOS_INT_EN;
-				I915_WRITE(PORT_HOTPLUG_EN, temp);
-
-				temp = I915_READ(PORT_HOTPLUG_STAT);
-				if (temp & CRT_EOS_INT_STATUS)
-					I915_WRITE(PORT_HOTPLUG_STAT,
-						CRT_EOS_INT_STATUS);
-			}
 		}
 
 		I915_WRITE(IIR, iir);
@@ -641,14 +645,22 @@ irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
 			mod_timer(&dev_priv->hangcheck_timer, jiffies + DRM_I915_HANGCHECK_PERIOD);
 		}
 
+		if (iir & I915_DISPLAY_PLANE_A_FLIP_PENDING_INTERRUPT)
+			intel_prepare_page_flip(dev, 0);
+
+		if (iir & I915_DISPLAY_PLANE_B_FLIP_PENDING_INTERRUPT)
+			intel_prepare_page_flip(dev, 1);
+
 		if (pipea_stats & vblank_status) {
 			vblank++;
 			drm_handle_vblank(dev, 0);
+			intel_finish_page_flip(dev, 0);
 		}
 
 		if (pipeb_stats & vblank_status) {
 			vblank++;
 			drm_handle_vblank(dev, 1);
+			intel_finish_page_flip(dev, 1);
 		}
 
 		if ((pipeb_stats & I915_LEGACY_BLC_EVENT_STATUS) ||
@@ -684,7 +696,7 @@ static int i915_emit_irq(struct drm_device * dev)
 
 	i915_kernel_lost_context(dev);
 
-	DRM_DEBUG("\n");
+	DRM_DEBUG_DRIVER("\n");
 
 	dev_priv->counter++;
 	if (dev_priv->counter > 0x7FFFFFFFUL)
@@ -709,8 +721,8 @@ void i915_user_irq_get(struct drm_device *dev)
 
 	spin_lock_irqsave(&dev_priv->user_irq_lock, irqflags);
 	if (dev->irq_enabled && (++dev_priv->user_irq_refcount == 1)) {
-		if (IS_IGDNG(dev))
-			igdng_enable_graphics_irq(dev_priv, GT_USER_INTERRUPT);
+		if (IS_IRONLAKE(dev))
+			ironlake_enable_graphics_irq(dev_priv, GT_USER_INTERRUPT);
 		else
 			i915_enable_irq(dev_priv, I915_USER_INTERRUPT);
 	}
@@ -725,8 +737,8 @@ void i915_user_irq_put(struct drm_device *dev)
 	spin_lock_irqsave(&dev_priv->user_irq_lock, irqflags);
 	BUG_ON(dev->irq_enabled && dev_priv->user_irq_refcount <= 0);
 	if (dev->irq_enabled && (--dev_priv->user_irq_refcount == 0)) {
-		if (IS_IGDNG(dev))
-			igdng_disable_graphics_irq(dev_priv, GT_USER_INTERRUPT);
+		if (IS_IRONLAKE(dev))
+			ironlake_disable_graphics_irq(dev_priv, GT_USER_INTERRUPT);
 		else
 			i915_disable_irq(dev_priv, I915_USER_INTERRUPT);
 	}
@@ -749,7 +761,7 @@ static int i915_wait_irq(struct drm_device * dev, int irq_nr)
 	struct drm_i915_master_private *master_priv = dev->primary->master->driver_priv;
 	int ret = 0;
 
-	DRM_DEBUG("irq_nr=%d breadcrumb=%d\n", irq_nr,
+	DRM_DEBUG_DRIVER("irq_nr=%d breadcrumb=%d\n", irq_nr,
 		  READ_BREADCRUMB(dev_priv));
 
 	if (READ_BREADCRUMB(dev_priv) >= irq_nr) {
@@ -832,7 +844,7 @@ int i915_enable_vblank(struct drm_device *dev, int pipe)
 	if (!(pipeconf & PIPEACONF_ENABLE))
 		return -EINVAL;
 
-	if (IS_IGDNG(dev))
+	if (IS_IRONLAKE(dev))
 		return 0;
 
 	spin_lock_irqsave(&dev_priv->user_irq_lock, irqflags);
@@ -854,7 +866,7 @@ void i915_disable_vblank(struct drm_device *dev, int pipe)
 	drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
 	unsigned long irqflags;
 
-	if (IS_IGDNG(dev))
+	if (IS_IRONLAKE(dev))
 		return;
 
 	spin_lock_irqsave(&dev_priv->user_irq_lock, irqflags);
@@ -868,7 +880,7 @@ void i915_enable_interrupt (struct drm_device *dev)
 {
 	struct drm_i915_private *dev_priv = dev->dev_private;
 
-	if (!IS_IGDNG(dev))
+	if (!IS_IRONLAKE(dev))
 		opregion_enable_asle(dev);
 	dev_priv->irq_enabled = 1;
 }
@@ -976,7 +988,7 @@ void i915_hangcheck_elapsed(unsigned long data)
 
 /* drm_dma.h hooks
 */
-static void igdng_irq_preinstall(struct drm_device *dev)
+static void ironlake_irq_preinstall(struct drm_device *dev)
 {
 	drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
 
@@ -992,14 +1004,21 @@ static void igdng_irq_preinstall(struct drm_device *dev)
 	I915_WRITE(GTIMR, 0xffffffff);
 	I915_WRITE(GTIER, 0x0);
 	(void) I915_READ(GTIER);
+
+	/* south display irq */
+	I915_WRITE(SDEIMR, 0xffffffff);
+	I915_WRITE(SDEIER, 0x0);
+	(void) I915_READ(SDEIER);
 }
 
-static int igdng_irq_postinstall(struct drm_device *dev)
+static int ironlake_irq_postinstall(struct drm_device *dev)
 {
 	drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
 	/* enable kind of interrupts always enabled */
-	u32 display_mask = DE_MASTER_IRQ_CONTROL /*| DE_PCH_EVENT */;
+	u32 display_mask = DE_MASTER_IRQ_CONTROL | DE_GSE | DE_PCH_EVENT;
 	u32 render_mask = GT_USER_INTERRUPT;
+	u32 hotplug_mask = SDE_CRT_HOTPLUG | SDE_PORTB_HOTPLUG |
+			   SDE_PORTC_HOTPLUG | SDE_PORTD_HOTPLUG;
 
 	dev_priv->irq_mask_reg = ~display_mask;
 	dev_priv->de_irq_enable_reg = display_mask;
@@ -1019,6 +1038,14 @@ static int igdng_irq_postinstall(struct drm_device *dev)
 	I915_WRITE(GTIER, dev_priv->gt_irq_enable_reg);
 	(void) I915_READ(GTIER);
 
+	dev_priv->pch_irq_mask_reg = ~hotplug_mask;
+	dev_priv->pch_irq_enable_reg = hotplug_mask;
+
+	I915_WRITE(SDEIIR, I915_READ(SDEIIR));
+	I915_WRITE(SDEIMR, dev_priv->pch_irq_mask_reg);
+	I915_WRITE(SDEIER, dev_priv->pch_irq_enable_reg);
+	(void) I915_READ(SDEIER);
+
 	return 0;
 }
 
@@ -1031,8 +1058,8 @@ void i915_driver_irq_preinstall(struct drm_device * dev)
 	INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func);
 	INIT_WORK(&dev_priv->error_work, i915_error_work_func);
 
-	if (IS_IGDNG(dev)) {
-		igdng_irq_preinstall(dev);
+	if (IS_IRONLAKE(dev)) {
+		ironlake_irq_preinstall(dev);
 		return;
 	}
 
@@ -1049,6 +1076,10 @@ void i915_driver_irq_preinstall(struct drm_device * dev)
 	(void) I915_READ(IER);
 }
 
+/*
+ * Must be called after intel_modeset_init or hotplug interrupts won't be
+ * enabled correctly.
+ */
 int i915_driver_irq_postinstall(struct drm_device *dev)
 {
 	drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
@@ -1059,8 +1090,8 @@ int i915_driver_irq_postinstall(struct drm_device *dev)
 
 	dev_priv->vblank_pipe = DRM_I915_VBLANK_PIPE_A | DRM_I915_VBLANK_PIPE_B;
 
-	if (IS_IGDNG(dev))
-		return igdng_irq_postinstall(dev);
+	if (IS_IRONLAKE(dev))
+		return ironlake_irq_postinstall(dev);
 
 	/* Unmask the interrupts that we always want on. */
 	dev_priv->irq_mask_reg = ~I915_INTERRUPT_ENABLE_FIX;
@@ -1071,19 +1102,23 @@ int i915_driver_irq_postinstall(struct drm_device *dev)
 	if (I915_HAS_HOTPLUG(dev)) {
 		u32 hotplug_en = I915_READ(PORT_HOTPLUG_EN);
 
-		/* Leave other bits alone */
-		hotplug_en |= HOTPLUG_EN_MASK;
+		/* Note HDMI and DP share bits */
+		if (dev_priv->hotplug_supported_mask & HDMIB_HOTPLUG_INT_STATUS)
+			hotplug_en |= HDMIB_HOTPLUG_INT_EN;
+		if (dev_priv->hotplug_supported_mask & HDMIC_HOTPLUG_INT_STATUS)
+			hotplug_en |= HDMIC_HOTPLUG_INT_EN;
+		if (dev_priv->hotplug_supported_mask & HDMID_HOTPLUG_INT_STATUS)
+			hotplug_en |= HDMID_HOTPLUG_INT_EN;
+		if (dev_priv->hotplug_supported_mask & SDVOC_HOTPLUG_INT_STATUS)
+			hotplug_en |= SDVOC_HOTPLUG_INT_EN;
+		if (dev_priv->hotplug_supported_mask & SDVOB_HOTPLUG_INT_STATUS)
+			hotplug_en |= SDVOB_HOTPLUG_INT_EN;
+		if (dev_priv->hotplug_supported_mask & CRT_HOTPLUG_INT_STATUS)
+			hotplug_en |= CRT_HOTPLUG_INT_EN;
+		/* Ignore TV since it's buggy */
+
 		I915_WRITE(PORT_HOTPLUG_EN, hotplug_en);
 
-		dev_priv->hotplug_supported_mask = CRT_HOTPLUG_INT_STATUS |
-			TV_HOTPLUG_INT_STATUS | SDVOC_HOTPLUG_INT_STATUS |
-			SDVOB_HOTPLUG_INT_STATUS;
-		if (IS_G4X(dev)) {
-			dev_priv->hotplug_supported_mask |=
-				HDMIB_HOTPLUG_INT_STATUS |
-				HDMIC_HOTPLUG_INT_STATUS |
-				HDMID_HOTPLUG_INT_STATUS;
-		}
 		/* Enable in IER... */
 		enable_mask |= I915_DISPLAY_PORT_INTERRUPT;
 		/* and unmask in IMR */
@@ -1120,7 +1155,7 @@ int i915_driver_irq_postinstall(struct drm_device *dev)
 	return 0;
 }
 
-static void igdng_irq_uninstall(struct drm_device *dev)
+static void ironlake_irq_uninstall(struct drm_device *dev)
 {
 	drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
 	I915_WRITE(HWSTAM, 0xffffffff);
@@ -1143,8 +1178,8 @@ void i915_driver_irq_uninstall(struct drm_device * dev)
 
 	dev_priv->vblank_pipe = 0;
 
-	if (IS_IGDNG(dev)) {
-		igdng_irq_uninstall(dev);
+	if (IS_IRONLAKE(dev)) {
+		ironlake_irq_uninstall(dev);
 		return;
 	}
 
diff --git a/drivers/gpu/drm/i915/i915_opregion.c b/drivers/gpu/drm/i915/i915_opregion.c
index 2d5193556d3f..7cc8410239cb 100644
--- a/drivers/gpu/drm/i915/i915_opregion.c
+++ b/drivers/gpu/drm/i915/i915_opregion.c
@@ -118,6 +118,10 @@ struct opregion_asle {
 #define ASLE_BACKLIGHT_FAIL    (2<<12)
 #define ASLE_PFIT_FAIL         (2<<14)
 #define ASLE_PWM_FREQ_FAIL     (2<<16)
+#define ASLE_ALS_ILLUM_FAILED	(1<<10)
+#define ASLE_BACKLIGHT_FAILED	(1<<12)
+#define ASLE_PFIT_FAILED	(1<<14)
+#define ASLE_PWM_FREQ_FAILED	(1<<16)
 
 /* ASLE backlight brightness to set */
 #define ASLE_BCLP_VALID                (1<<31)
@@ -163,7 +167,7 @@ static u32 asle_set_backlight(struct drm_device *dev, u32 bclp)
 	if (IS_I965G(dev) && (blc_pwm_ctl2 & BLM_COMBINATION_MODE))
 		pci_write_config_dword(dev->pdev, PCI_LBPC, bclp);
 	else {
-		if (IS_IGD(dev)) {
+		if (IS_PINEVIEW(dev)) {
 			blc_pwm_ctl &= ~(BACKLIGHT_DUTY_CYCLE_MASK - 1);
 			max_backlight = (blc_pwm_ctl & BACKLIGHT_MODULATION_FREQ_MASK) >> 
 					BACKLIGHT_MODULATION_FREQ_SHIFT;
@@ -224,7 +228,7 @@ void opregion_asle_intr(struct drm_device *dev)
 	asle_req = asle->aslc & ASLE_REQ_MSK;
 
 	if (!asle_req) {
-		DRM_DEBUG("non asle set request??\n");
+		DRM_DEBUG_DRIVER("non asle set request??\n");
 		return;
 	}
 
@@ -243,6 +247,73 @@ void opregion_asle_intr(struct drm_device *dev)
 	asle->aslc = asle_stat;
 }
 
+static u32 asle_set_backlight_ironlake(struct drm_device *dev, u32 bclp)
+{
+	struct drm_i915_private *dev_priv = dev->dev_private;
+	struct opregion_asle *asle = dev_priv->opregion.asle;
+	u32 cpu_pwm_ctl, pch_pwm_ctl2;
+	u32 max_backlight, level;
+
+	if (!(bclp & ASLE_BCLP_VALID))
+		return ASLE_BACKLIGHT_FAILED;
+
+	bclp &= ASLE_BCLP_MSK;
+	if (bclp < 0 || bclp > 255)
+		return ASLE_BACKLIGHT_FAILED;
+
+	cpu_pwm_ctl = I915_READ(BLC_PWM_CPU_CTL);
+	pch_pwm_ctl2 = I915_READ(BLC_PWM_PCH_CTL2);
+	/* get the max PWM frequency */
+	max_backlight = (pch_pwm_ctl2 >> 16) & BACKLIGHT_DUTY_CYCLE_MASK;
+	/* calculate the expected PMW frequency */
+	level = (bclp * max_backlight) / 255;
+	/* reserve the high 16 bits */
+	cpu_pwm_ctl &= ~(BACKLIGHT_DUTY_CYCLE_MASK);
+	/* write the updated PWM frequency */
+	I915_WRITE(BLC_PWM_CPU_CTL, cpu_pwm_ctl | level);
+
+	asle->cblv = (bclp*0x64)/0xff | ASLE_CBLV_VALID;
+
+	return 0;
+}
+
+void ironlake_opregion_gse_intr(struct drm_device *dev)
+{
+	struct drm_i915_private *dev_priv = dev->dev_private;
+	struct opregion_asle *asle = dev_priv->opregion.asle;
+	u32 asle_stat = 0;
+	u32 asle_req;
+
+	if (!asle)
+		return;
+
+	asle_req = asle->aslc & ASLE_REQ_MSK;
+
+	if (!asle_req) {
+		DRM_DEBUG_DRIVER("non asle set request??\n");
+		return;
+	}
+
+	if (asle_req & ASLE_SET_ALS_ILLUM) {
+		DRM_DEBUG_DRIVER("Illum is not supported\n");
+		asle_stat |= ASLE_ALS_ILLUM_FAILED;
+	}
+
+	if (asle_req & ASLE_SET_BACKLIGHT)
+		asle_stat |= asle_set_backlight_ironlake(dev, asle->bclp);
+
+	if (asle_req & ASLE_SET_PFIT) {
+		DRM_DEBUG_DRIVER("Pfit is not supported\n");
+		asle_stat |= ASLE_PFIT_FAILED;
+	}
+
+	if (asle_req & ASLE_SET_PWM_FREQ) {
+		DRM_DEBUG_DRIVER("PWM freq is not supported\n");
+		asle_stat |= ASLE_PWM_FREQ_FAILED;
+	}
+
+	asle->aslc = asle_stat;
+}
 #define ASLE_ALS_EN    (1<<0)
 #define ASLE_BLC_EN    (1<<1)
 #define ASLE_PFIT_EN   (1<<2)
@@ -258,8 +329,7 @@ void opregion_enable_asle(struct drm_device *dev)
 			unsigned long irqflags;
 
 			spin_lock_irqsave(&dev_priv->user_irq_lock, irqflags);
-			i915_enable_pipestat(dev_priv, 1,
-					     I915_LEGACY_BLC_EVENT_ENABLE);
+			intel_enable_asle(dev);
 			spin_unlock_irqrestore(&dev_priv->user_irq_lock,
 					       irqflags);
 		}
@@ -361,9 +431,9 @@ int intel_opregion_init(struct drm_device *dev, int resume)
 	int err = 0;
 
 	pci_read_config_dword(dev->pdev, PCI_ASLS, &asls);
-	DRM_DEBUG("graphic opregion physical addr: 0x%x\n", asls);
+	DRM_DEBUG_DRIVER("graphic opregion physical addr: 0x%x\n", asls);
 	if (asls == 0) {
-		DRM_DEBUG("ACPI OpRegion not supported!\n");
+		DRM_DEBUG_DRIVER("ACPI OpRegion not supported!\n");
 		return -ENOTSUPP;
 	}
 
@@ -373,30 +443,30 @@ int intel_opregion_init(struct drm_device *dev, int resume)
 
 	opregion->header = base;
 	if (memcmp(opregion->header->signature, OPREGION_SIGNATURE, 16)) {
-		DRM_DEBUG("opregion signature mismatch\n");
+		DRM_DEBUG_DRIVER("opregion signature mismatch\n");
 		err = -EINVAL;
 		goto err_out;
 	}
 
 	mboxes = opregion->header->mboxes;
 	if (mboxes & MBOX_ACPI) {
-		DRM_DEBUG("Public ACPI methods supported\n");
+		DRM_DEBUG_DRIVER("Public ACPI methods supported\n");
 		opregion->acpi = base + OPREGION_ACPI_OFFSET;
 		if (drm_core_check_feature(dev, DRIVER_MODESET))
 			intel_didl_outputs(dev);
 	} else {
-		DRM_DEBUG("Public ACPI methods not supported\n");
+		DRM_DEBUG_DRIVER("Public ACPI methods not supported\n");
 		err = -ENOTSUPP;
 		goto err_out;
 	}
 	opregion->enabled = 1;
 
 	if (mboxes & MBOX_SWSCI) {
-		DRM_DEBUG("SWSCI supported\n");
+		DRM_DEBUG_DRIVER("SWSCI supported\n");
 		opregion->swsci = base + OPREGION_SWSCI_OFFSET;
 	}
 	if (mboxes & MBOX_ASLE) {
-		DRM_DEBUG("ASLE supported\n");
+		DRM_DEBUG_DRIVER("ASLE supported\n");
 		opregion->asle = base + OPREGION_ASLE_OFFSET;
 		opregion_enable_asle(dev);
 	}
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 1687edf68795..847006c5218e 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -140,6 +140,7 @@
 #define MI_NOOP			MI_INSTR(0, 0)
 #define MI_USER_INTERRUPT	MI_INSTR(0x02, 0)
 #define MI_WAIT_FOR_EVENT       MI_INSTR(0x03, 0)
+#define   MI_WAIT_FOR_OVERLAY_FLIP	(1<<16)
 #define   MI_WAIT_FOR_PLANE_B_FLIP      (1<<6)
 #define   MI_WAIT_FOR_PLANE_A_FLIP      (1<<2)
 #define   MI_WAIT_FOR_PLANE_A_SCANLINES (1<<1)
@@ -151,7 +152,13 @@
 #define   MI_END_SCENE		(1 << 4) /* flush binner and incr scene count */
 #define MI_BATCH_BUFFER_END	MI_INSTR(0x0a, 0)
 #define MI_REPORT_HEAD		MI_INSTR(0x07, 0)
+#define MI_OVERLAY_FLIP		MI_INSTR(0x11,0)
+#define   MI_OVERLAY_CONTINUE	(0x0<<21)
+#define   MI_OVERLAY_ON		(0x1<<21)
+#define   MI_OVERLAY_OFF	(0x2<<21)
 #define MI_LOAD_SCAN_LINES_INCL MI_INSTR(0x12, 0)
+#define MI_DISPLAY_FLIP		MI_INSTR(0x14, 2)
+#define   MI_DISPLAY_FLIP_PLANE(n) ((n) << 20)
 #define MI_STORE_DWORD_IMM	MI_INSTR(0x20, 1)
 #define   MI_MEM_VIRTUAL	(1 << 22) /* 965+ only */
 #define MI_STORE_DWORD_INDEX	MI_INSTR(0x21, 1)
@@ -260,6 +267,8 @@
 #define HWS_PGA		0x02080
 #define HWS_ADDRESS_MASK	0xfffff000
 #define HWS_START_ADDRESS_SHIFT	4
+#define PWRCTXA		0x2088 /* 965GM+ only */
+#define   PWRCTX_EN	(1<<0)
 #define IPEIR		0x02088
 #define IPEHR		0x0208c
 #define INSTDONE	0x02090
@@ -405,6 +414,13 @@
 # define GPIO_DATA_VAL_IN		(1 << 12)
 # define GPIO_DATA_PULLUP_DISABLE	(1 << 13)
 
+#define GMBUS0			0x5100
+#define GMBUS1			0x5104
+#define GMBUS2			0x5108
+#define GMBUS3			0x510c
+#define GMBUS4			0x5110
+#define GMBUS5			0x5120
+
 /*
  * Clock control & power management
  */
@@ -435,7 +451,7 @@
 #define   DPLLB_LVDS_P2_CLOCK_DIV_7	(1 << 24) /* i915 */
 #define   DPLL_P2_CLOCK_DIV_MASK	0x03000000 /* i915 */
 #define   DPLL_FPA01_P1_POST_DIV_MASK	0x00ff0000 /* i915 */
-#define   DPLL_FPA01_P1_POST_DIV_MASK_IGD	0x00ff8000 /* IGD */
+#define   DPLL_FPA01_P1_POST_DIV_MASK_PINEVIEW	0x00ff8000 /* Pineview */
 
 #define I915_FIFO_UNDERRUN_STATUS		(1UL<<31)
 #define I915_CRC_ERROR_ENABLE			(1UL<<29)
@@ -512,7 +528,7 @@
  */
 #define   DPLL_FPA01_P1_POST_DIV_MASK_I830_LVDS	0x003f0000
 #define   DPLL_FPA01_P1_POST_DIV_SHIFT	16
-#define   DPLL_FPA01_P1_POST_DIV_SHIFT_IGD 15
+#define   DPLL_FPA01_P1_POST_DIV_SHIFT_PINEVIEW 15
 /* i830, required in DVO non-gang */
 #define   PLL_P2_DIVIDE_BY_4		(1 << 23)
 #define   PLL_P1_DIVIDE_BY_TWO		(1 << 21) /* i830 */
@@ -522,7 +538,7 @@
 #define   PLLB_REF_INPUT_SPREADSPECTRUMIN (3 << 13)
 #define   PLL_REF_INPUT_MASK		(3 << 13)
 #define   PLL_LOAD_PULSE_PHASE_SHIFT		9
-/* IGDNG */
+/* Ironlake */
 # define PLL_REF_SDVO_HDMI_MULTIPLIER_SHIFT     9
 # define PLL_REF_SDVO_HDMI_MULTIPLIER_MASK      (7 << 9)
 # define PLL_REF_SDVO_HDMI_MULTIPLIER(x)	(((x)-1) << 9)
@@ -586,12 +602,12 @@
 #define FPB0	0x06048
 #define FPB1	0x0604c
 #define   FP_N_DIV_MASK		0x003f0000
-#define   FP_N_IGD_DIV_MASK	0x00ff0000
+#define   FP_N_PINEVIEW_DIV_MASK	0x00ff0000
 #define   FP_N_DIV_SHIFT		16
 #define   FP_M1_DIV_MASK	0x00003f00
 #define   FP_M1_DIV_SHIFT		 8
 #define   FP_M2_DIV_MASK	0x0000003f
-#define   FP_M2_IGD_DIV_MASK	0x000000ff
+#define   FP_M2_PINEVIEW_DIV_MASK	0x000000ff
 #define   FP_M2_DIV_SHIFT		 0
 #define DPLL_TEST	0x606c
 #define   DPLLB_TEST_SDVO_DIV_1		(0 << 22)
@@ -769,7 +785,8 @@
 
 /** GM965 GM45 render standby register */
 #define MCHBAR_RENDER_STANDBY	0x111B8
-
+#define   RCX_SW_EXIT		(1<<23)
+#define   RSX_STATUS_MASK	0x00700000
 #define PEG_BAND_GAP_DATA	0x14d68
 
 /*
@@ -844,7 +861,6 @@
 #define   SDVOB_HOTPLUG_INT_EN			(1 << 26)
 #define   SDVOC_HOTPLUG_INT_EN			(1 << 25)
 #define   TV_HOTPLUG_INT_EN			(1 << 18)
-#define   CRT_EOS_INT_EN			(1 << 10)
 #define   CRT_HOTPLUG_INT_EN			(1 << 9)
 #define   CRT_HOTPLUG_FORCE_DETECT		(1 << 3)
 #define CRT_HOTPLUG_ACTIVATION_PERIOD_32	(0 << 8)
@@ -863,14 +879,6 @@
 #define CRT_HOTPLUG_DETECT_VOLTAGE_475MV	(1 << 2)
 #define CRT_HOTPLUG_MASK			(0x3fc) /* Bits 9-2 */
 #define CRT_FORCE_HOTPLUG_MASK			0xfffffe1f
-#define HOTPLUG_EN_MASK (HDMIB_HOTPLUG_INT_EN | \
-			 HDMIC_HOTPLUG_INT_EN |	  \
-			 HDMID_HOTPLUG_INT_EN |	  \
-			 SDVOB_HOTPLUG_INT_EN |	  \
-			 SDVOC_HOTPLUG_INT_EN |	  \
-			 TV_HOTPLUG_INT_EN |	  \
-			 CRT_HOTPLUG_INT_EN)
-
 
 #define PORT_HOTPLUG_STAT	0x61114
 #define   HDMIB_HOTPLUG_INT_STATUS		(1 << 29)
@@ -879,7 +887,6 @@
 #define   DPC_HOTPLUG_INT_STATUS		(1 << 28)
 #define   HDMID_HOTPLUG_INT_STATUS		(1 << 27)
 #define   DPD_HOTPLUG_INT_STATUS		(1 << 27)
-#define   CRT_EOS_INT_STATUS			(1 << 12)
 #define   CRT_HOTPLUG_INT_STATUS		(1 << 11)
 #define   TV_HOTPLUG_INT_STATUS			(1 << 10)
 #define   CRT_HOTPLUG_MONITOR_MASK		(3 << 8)
@@ -968,6 +975,8 @@
 #define   LVDS_PORT_EN			(1 << 31)
 /* Selects pipe B for LVDS data.  Must be set on pre-965. */
 #define   LVDS_PIPEB_SELECT		(1 << 30)
+/* LVDS dithering flag on 965/g4x platform */
+#define   LVDS_ENABLE_DITHER		(1 << 25)
 /* Enable border for unscaled (or aspect-scaled) display */
 #define   LVDS_BORDER_ENABLE		(1 << 15)
 /*
@@ -1620,7 +1629,7 @@
 #define   DP_CLOCK_OUTPUT_ENABLE	(1 << 13)
 
 #define   DP_SCRAMBLING_DISABLE		(1 << 12)
-#define   DP_SCRAMBLING_DISABLE_IGDNG	(1 << 7)
+#define   DP_SCRAMBLING_DISABLE_IRONLAKE	(1 << 7)
 
 /** limit RGB values to avoid confusing TVs */
 #define   DP_COLOR_RANGE_16_235		(1 << 8)
@@ -1737,6 +1746,8 @@
 
 /* Display & cursor control */
 
+/* dithering flag on Ironlake */
+#define PIPE_ENABLE_DITHER	(1 << 4)
 /* Pipe A */
 #define PIPEADSL		0x70000
 #define PIPEACONF		0x70008
@@ -1804,11 +1815,11 @@
 #define   DSPFW_PLANEB_SHIFT	8
 #define DSPFW2			0x70038
 #define   DSPFW_CURSORA_MASK	0x00003f00
-#define   DSPFW_CURSORA_SHIFT	16
+#define   DSPFW_CURSORA_SHIFT	8
 #define DSPFW3			0x7003c
 #define   DSPFW_HPLL_SR_EN	(1<<31)
 #define   DSPFW_CURSOR_SR_SHIFT	24
-#define   IGD_SELF_REFRESH_EN	(1<<30)
+#define   PINEVIEW_SELF_REFRESH_EN	(1<<30)
 
 /* FIFO watermark sizes etc */
 #define G4X_FIFO_LINE_SIZE	64
@@ -1824,16 +1835,16 @@
 #define G4X_MAX_WM		0x3f
 #define I915_MAX_WM		0x3f
 
-#define IGD_DISPLAY_FIFO	512 /* in 64byte unit */
-#define IGD_FIFO_LINE_SIZE	64
-#define IGD_MAX_WM		0x1ff
-#define IGD_DFT_WM		0x3f
-#define IGD_DFT_HPLLOFF_WM	0
-#define IGD_GUARD_WM		10
-#define IGD_CURSOR_FIFO		64
-#define IGD_CURSOR_MAX_WM	0x3f
-#define IGD_CURSOR_DFT_WM	0
-#define IGD_CURSOR_GUARD_WM	5
+#define PINEVIEW_DISPLAY_FIFO	512 /* in 64byte unit */
+#define PINEVIEW_FIFO_LINE_SIZE	64
+#define PINEVIEW_MAX_WM		0x1ff
+#define PINEVIEW_DFT_WM		0x3f
+#define PINEVIEW_DFT_HPLLOFF_WM	0
+#define PINEVIEW_GUARD_WM		10
+#define PINEVIEW_CURSOR_FIFO		64
+#define PINEVIEW_CURSOR_MAX_WM	0x3f
+#define PINEVIEW_CURSOR_DFT_WM	0
+#define PINEVIEW_CURSOR_GUARD_WM	5
 
 /*
  * The two pipe frame counter registers are not synchronized, so
@@ -1907,6 +1918,7 @@
 #define   DISPPLANE_16BPP			(0x5<<26)
 #define   DISPPLANE_32BPP_NO_ALPHA		(0x6<<26)
 #define   DISPPLANE_32BPP			(0x7<<26)
+#define   DISPPLANE_32BPP_30BIT_NO_ALPHA	(0xa<<26)
 #define   DISPPLANE_STEREO_ENABLE		(1<<25)
 #define   DISPPLANE_STEREO_DISABLE		0
 #define   DISPPLANE_SEL_PIPE_MASK		(1<<24)
@@ -1918,7 +1930,7 @@
 #define   DISPPLANE_NO_LINE_DOUBLE		0
 #define   DISPPLANE_STEREO_POLARITY_FIRST	0
 #define   DISPPLANE_STEREO_POLARITY_SECOND	(1<<18)
-#define   DISPPLANE_TRICKLE_FEED_DISABLE	(1<<14) /* IGDNG */
+#define   DISPPLANE_TRICKLE_FEED_DISABLE	(1<<14) /* Ironlake */
 #define   DISPPLANE_TILED			(1<<10)
 #define DSPAADDR		0x70184
 #define DSPASTRIDE		0x70188
@@ -1971,7 +1983,7 @@
 # define VGA_2X_MODE				(1 << 30)
 # define VGA_PIPE_B_SELECT			(1 << 29)
 
-/* IGDNG */
+/* Ironlake */
 
 #define CPU_VGACNTRL	0x41000
 
@@ -2117,6 +2129,7 @@
 #define SDE_PORTC_HOTPLUG       (1 << 9)
 #define SDE_PORTB_HOTPLUG       (1 << 8)
 #define SDE_SDVOB_HOTPLUG       (1 << 6)
+#define SDE_HOTPLUG_MASK	(0xf << 8)
 
 #define SDEISR  0xc4000
 #define SDEIMR  0xc4004
@@ -2157,6 +2170,13 @@
 #define PCH_GPIOE               0xc5020
 #define PCH_GPIOF               0xc5024
 
+#define PCH_GMBUS0		0xc5100
+#define PCH_GMBUS1		0xc5104
+#define PCH_GMBUS2		0xc5108
+#define PCH_GMBUS3		0xc510c
+#define PCH_GMBUS4		0xc5110
+#define PCH_GMBUS5		0xc5120
+
 #define PCH_DPLL_A              0xc6014
 #define PCH_DPLL_B              0xc6018
 
@@ -2292,7 +2312,7 @@
 #define  FDI_DP_PORT_WIDTH_X3           (2<<19)
 #define  FDI_DP_PORT_WIDTH_X4           (3<<19)
 #define  FDI_TX_ENHANCE_FRAME_ENABLE    (1<<18)
-/* IGDNG: hardwired to 1 */
+/* Ironlake: hardwired to 1 */
 #define  FDI_TX_PLL_ENABLE              (1<<14)
 /* both Tx and Rx */
 #define  FDI_SCRAMBLING_ENABLE          (0<<7)
diff --git a/drivers/gpu/drm/i915/i915_suspend.c b/drivers/gpu/drm/i915/i915_suspend.c
index 6eec8171a44e..a3b90c9561dc 100644
--- a/drivers/gpu/drm/i915/i915_suspend.c
+++ b/drivers/gpu/drm/i915/i915_suspend.c
@@ -27,14 +27,14 @@
 #include "drmP.h"
 #include "drm.h"
 #include "i915_drm.h"
-#include "i915_drv.h"
+#include "intel_drv.h"
 
 static bool i915_pipe_enabled(struct drm_device *dev, enum pipe pipe)
 {
 	struct drm_i915_private *dev_priv = dev->dev_private;
 	u32	dpll_reg;
 
-	if (IS_IGDNG(dev)) {
+	if (IS_IRONLAKE(dev)) {
 		dpll_reg = (pipe == PIPE_A) ? PCH_DPLL_A: PCH_DPLL_B;
 	} else {
 		dpll_reg = (pipe == PIPE_A) ? DPLL_A: DPLL_B;
@@ -53,7 +53,7 @@ static void i915_save_palette(struct drm_device *dev, enum pipe pipe)
 	if (!i915_pipe_enabled(dev, pipe))
 		return;
 
-	if (IS_IGDNG(dev))
+	if (IS_IRONLAKE(dev))
 		reg = (pipe == PIPE_A) ? LGC_PALETTE_A : LGC_PALETTE_B;
 
 	if (pipe == PIPE_A)
@@ -75,7 +75,7 @@ static void i915_restore_palette(struct drm_device *dev, enum pipe pipe)
 	if (!i915_pipe_enabled(dev, pipe))
 		return;
 
-	if (IS_IGDNG(dev))
+	if (IS_IRONLAKE(dev))
 		reg = (pipe == PIPE_A) ? LGC_PALETTE_A : LGC_PALETTE_B;
 
 	if (pipe == PIPE_A)
@@ -239,7 +239,7 @@ static void i915_save_modeset_reg(struct drm_device *dev)
 	if (drm_core_check_feature(dev, DRIVER_MODESET))
 		return;
 
-	if (IS_IGDNG(dev)) {
+	if (IS_IRONLAKE(dev)) {
 		dev_priv->savePCH_DREF_CONTROL = I915_READ(PCH_DREF_CONTROL);
 		dev_priv->saveDISP_ARB_CTL = I915_READ(DISP_ARB_CTL);
 	}
@@ -247,7 +247,7 @@ static void i915_save_modeset_reg(struct drm_device *dev)
 	/* Pipe & plane A info */
 	dev_priv->savePIPEACONF = I915_READ(PIPEACONF);
 	dev_priv->savePIPEASRC = I915_READ(PIPEASRC);
-	if (IS_IGDNG(dev)) {
+	if (IS_IRONLAKE(dev)) {
 		dev_priv->saveFPA0 = I915_READ(PCH_FPA0);
 		dev_priv->saveFPA1 = I915_READ(PCH_FPA1);
 		dev_priv->saveDPLL_A = I915_READ(PCH_DPLL_A);
@@ -256,7 +256,7 @@ static void i915_save_modeset_reg(struct drm_device *dev)
 		dev_priv->saveFPA1 = I915_READ(FPA1);
 		dev_priv->saveDPLL_A = I915_READ(DPLL_A);
 	}
-	if (IS_I965G(dev) && !IS_IGDNG(dev))
+	if (IS_I965G(dev) && !IS_IRONLAKE(dev))
 		dev_priv->saveDPLL_A_MD = I915_READ(DPLL_A_MD);
 	dev_priv->saveHTOTAL_A = I915_READ(HTOTAL_A);
 	dev_priv->saveHBLANK_A = I915_READ(HBLANK_A);
@@ -264,10 +264,10 @@ static void i915_save_modeset_reg(struct drm_device *dev)
 	dev_priv->saveVTOTAL_A = I915_READ(VTOTAL_A);
 	dev_priv->saveVBLANK_A = I915_READ(VBLANK_A);
 	dev_priv->saveVSYNC_A = I915_READ(VSYNC_A);
-	if (!IS_IGDNG(dev))
+	if (!IS_IRONLAKE(dev))
 		dev_priv->saveBCLRPAT_A = I915_READ(BCLRPAT_A);
 
-	if (IS_IGDNG(dev)) {
+	if (IS_IRONLAKE(dev)) {
 		dev_priv->savePIPEA_DATA_M1 = I915_READ(PIPEA_DATA_M1);
 		dev_priv->savePIPEA_DATA_N1 = I915_READ(PIPEA_DATA_N1);
 		dev_priv->savePIPEA_LINK_M1 = I915_READ(PIPEA_LINK_M1);
@@ -304,7 +304,7 @@ static void i915_save_modeset_reg(struct drm_device *dev)
 	/* Pipe & plane B info */
 	dev_priv->savePIPEBCONF = I915_READ(PIPEBCONF);
 	dev_priv->savePIPEBSRC = I915_READ(PIPEBSRC);
-	if (IS_IGDNG(dev)) {
+	if (IS_IRONLAKE(dev)) {
 		dev_priv->saveFPB0 = I915_READ(PCH_FPB0);
 		dev_priv->saveFPB1 = I915_READ(PCH_FPB1);
 		dev_priv->saveDPLL_B = I915_READ(PCH_DPLL_B);
@@ -313,7 +313,7 @@ static void i915_save_modeset_reg(struct drm_device *dev)
 		dev_priv->saveFPB1 = I915_READ(FPB1);
 		dev_priv->saveDPLL_B = I915_READ(DPLL_B);
 	}
-	if (IS_I965G(dev) && !IS_IGDNG(dev))
+	if (IS_I965G(dev) && !IS_IRONLAKE(dev))
 		dev_priv->saveDPLL_B_MD = I915_READ(DPLL_B_MD);
 	dev_priv->saveHTOTAL_B = I915_READ(HTOTAL_B);
 	dev_priv->saveHBLANK_B = I915_READ(HBLANK_B);
@@ -321,10 +321,10 @@ static void i915_save_modeset_reg(struct drm_device *dev)
 	dev_priv->saveVTOTAL_B = I915_READ(VTOTAL_B);
 	dev_priv->saveVBLANK_B = I915_READ(VBLANK_B);
 	dev_priv->saveVSYNC_B = I915_READ(VSYNC_B);
-	if (!IS_IGDNG(dev))
+	if (!IS_IRONLAKE(dev))
 		dev_priv->saveBCLRPAT_B = I915_READ(BCLRPAT_B);
 
-	if (IS_IGDNG(dev)) {
+	if (IS_IRONLAKE(dev)) {
 		dev_priv->savePIPEB_DATA_M1 = I915_READ(PIPEB_DATA_M1);
 		dev_priv->savePIPEB_DATA_N1 = I915_READ(PIPEB_DATA_N1);
 		dev_priv->savePIPEB_LINK_M1 = I915_READ(PIPEB_LINK_M1);
@@ -369,7 +369,7 @@ static void i915_restore_modeset_reg(struct drm_device *dev)
 	if (drm_core_check_feature(dev, DRIVER_MODESET))
 		return;
 
-	if (IS_IGDNG(dev)) {
+	if (IS_IRONLAKE(dev)) {
 		dpll_a_reg = PCH_DPLL_A;
 		dpll_b_reg = PCH_DPLL_B;
 		fpa0_reg = PCH_FPA0;
@@ -385,7 +385,7 @@ static void i915_restore_modeset_reg(struct drm_device *dev)
 		fpb1_reg = FPB1;
 	}
 
-	if (IS_IGDNG(dev)) {
+	if (IS_IRONLAKE(dev)) {
 		I915_WRITE(PCH_DREF_CONTROL, dev_priv->savePCH_DREF_CONTROL);
 		I915_WRITE(DISP_ARB_CTL, dev_priv->saveDISP_ARB_CTL);
 	}
@@ -402,7 +402,7 @@ static void i915_restore_modeset_reg(struct drm_device *dev)
 	/* Actually enable it */
 	I915_WRITE(dpll_a_reg, dev_priv->saveDPLL_A);
 	DRM_UDELAY(150);
-	if (IS_I965G(dev) && !IS_IGDNG(dev))
+	if (IS_I965G(dev) && !IS_IRONLAKE(dev))
 		I915_WRITE(DPLL_A_MD, dev_priv->saveDPLL_A_MD);
 	DRM_UDELAY(150);
 
@@ -413,10 +413,10 @@ static void i915_restore_modeset_reg(struct drm_device *dev)
 	I915_WRITE(VTOTAL_A, dev_priv->saveVTOTAL_A);
 	I915_WRITE(VBLANK_A, dev_priv->saveVBLANK_A);
 	I915_WRITE(VSYNC_A, dev_priv->saveVSYNC_A);
-	if (!IS_IGDNG(dev))
+	if (!IS_IRONLAKE(dev))
 		I915_WRITE(BCLRPAT_A, dev_priv->saveBCLRPAT_A);
 
-	if (IS_IGDNG(dev)) {
+	if (IS_IRONLAKE(dev)) {
 		I915_WRITE(PIPEA_DATA_M1, dev_priv->savePIPEA_DATA_M1);
 		I915_WRITE(PIPEA_DATA_N1, dev_priv->savePIPEA_DATA_N1);
 		I915_WRITE(PIPEA_LINK_M1, dev_priv->savePIPEA_LINK_M1);
@@ -467,7 +467,7 @@ static void i915_restore_modeset_reg(struct drm_device *dev)
 	/* Actually enable it */
 	I915_WRITE(dpll_b_reg, dev_priv->saveDPLL_B);
 	DRM_UDELAY(150);
-	if (IS_I965G(dev) && !IS_IGDNG(dev))
+	if (IS_I965G(dev) && !IS_IRONLAKE(dev))
 		I915_WRITE(DPLL_B_MD, dev_priv->saveDPLL_B_MD);
 	DRM_UDELAY(150);
 
@@ -478,10 +478,10 @@ static void i915_restore_modeset_reg(struct drm_device *dev)
 	I915_WRITE(VTOTAL_B, dev_priv->saveVTOTAL_B);
 	I915_WRITE(VBLANK_B, dev_priv->saveVBLANK_B);
 	I915_WRITE(VSYNC_B, dev_priv->saveVSYNC_B);
-	if (!IS_IGDNG(dev))
+	if (!IS_IRONLAKE(dev))
 		I915_WRITE(BCLRPAT_B, dev_priv->saveBCLRPAT_B);
 
-	if (IS_IGDNG(dev)) {
+	if (IS_IRONLAKE(dev)) {
 		I915_WRITE(PIPEB_DATA_M1, dev_priv->savePIPEB_DATA_M1);
 		I915_WRITE(PIPEB_DATA_N1, dev_priv->savePIPEB_DATA_N1);
 		I915_WRITE(PIPEB_LINK_M1, dev_priv->savePIPEB_LINK_M1);
@@ -546,14 +546,14 @@ void i915_save_display(struct drm_device *dev)
 		dev_priv->saveCURSIZE = I915_READ(CURSIZE);
 
 	/* CRT state */
-	if (IS_IGDNG(dev)) {
+	if (IS_IRONLAKE(dev)) {
 		dev_priv->saveADPA = I915_READ(PCH_ADPA);
 	} else {
 		dev_priv->saveADPA = I915_READ(ADPA);
 	}
 
 	/* LVDS state */
-	if (IS_IGDNG(dev)) {
+	if (IS_IRONLAKE(dev)) {
 		dev_priv->savePP_CONTROL = I915_READ(PCH_PP_CONTROL);
 		dev_priv->saveBLC_PWM_CTL = I915_READ(BLC_PWM_PCH_CTL1);
 		dev_priv->saveBLC_PWM_CTL2 = I915_READ(BLC_PWM_PCH_CTL2);
@@ -571,10 +571,10 @@ void i915_save_display(struct drm_device *dev)
 			dev_priv->saveLVDS = I915_READ(LVDS);
 	}
 
-	if (!IS_I830(dev) && !IS_845G(dev) && !IS_IGDNG(dev))
+	if (!IS_I830(dev) && !IS_845G(dev) && !IS_IRONLAKE(dev))
 		dev_priv->savePFIT_CONTROL = I915_READ(PFIT_CONTROL);
 
-	if (IS_IGDNG(dev)) {
+	if (IS_IRONLAKE(dev)) {
 		dev_priv->savePP_ON_DELAYS = I915_READ(PCH_PP_ON_DELAYS);
 		dev_priv->savePP_OFF_DELAYS = I915_READ(PCH_PP_OFF_DELAYS);
 		dev_priv->savePP_DIVISOR = I915_READ(PCH_PP_DIVISOR);
@@ -614,7 +614,7 @@ void i915_save_display(struct drm_device *dev)
 	dev_priv->saveVGA0 = I915_READ(VGA0);
 	dev_priv->saveVGA1 = I915_READ(VGA1);
 	dev_priv->saveVGA_PD = I915_READ(VGA_PD);
-	if (IS_IGDNG(dev))
+	if (IS_IRONLAKE(dev))
 		dev_priv->saveVGACNTRL = I915_READ(CPU_VGACNTRL);
 	else
 		dev_priv->saveVGACNTRL = I915_READ(VGACNTRL);
@@ -656,24 +656,24 @@ void i915_restore_display(struct drm_device *dev)
 		I915_WRITE(CURSIZE, dev_priv->saveCURSIZE);
 
 	/* CRT state */
-	if (IS_IGDNG(dev))
+	if (IS_IRONLAKE(dev))
 		I915_WRITE(PCH_ADPA, dev_priv->saveADPA);
 	else
 		I915_WRITE(ADPA, dev_priv->saveADPA);
 
 	/* LVDS state */
-	if (IS_I965G(dev) && !IS_IGDNG(dev))
+	if (IS_I965G(dev) && !IS_IRONLAKE(dev))
 		I915_WRITE(BLC_PWM_CTL2, dev_priv->saveBLC_PWM_CTL2);
 
-	if (IS_IGDNG(dev)) {
+	if (IS_IRONLAKE(dev)) {
 		I915_WRITE(PCH_LVDS, dev_priv->saveLVDS);
 	} else if (IS_MOBILE(dev) && !IS_I830(dev))
 		I915_WRITE(LVDS, dev_priv->saveLVDS);
 
-	if (!IS_I830(dev) && !IS_845G(dev) && !IS_IGDNG(dev))
+	if (!IS_I830(dev) && !IS_845G(dev) && !IS_IRONLAKE(dev))
 		I915_WRITE(PFIT_CONTROL, dev_priv->savePFIT_CONTROL);
 
-	if (IS_IGDNG(dev)) {
+	if (IS_IRONLAKE(dev)) {
 		I915_WRITE(BLC_PWM_PCH_CTL1, dev_priv->saveBLC_PWM_CTL);
 		I915_WRITE(BLC_PWM_PCH_CTL2, dev_priv->saveBLC_PWM_CTL2);
 		I915_WRITE(BLC_PWM_CPU_CTL, dev_priv->saveBLC_CPU_PWM_CTL);
@@ -713,7 +713,7 @@ void i915_restore_display(struct drm_device *dev)
 	}
 
 	/* VGA state */
-	if (IS_IGDNG(dev))
+	if (IS_IRONLAKE(dev))
 		I915_WRITE(CPU_VGACNTRL, dev_priv->saveVGACNTRL);
 	else
 		I915_WRITE(VGACNTRL, dev_priv->saveVGACNTRL);
@@ -732,17 +732,13 @@ int i915_save_state(struct drm_device *dev)
 
 	pci_read_config_byte(dev->pdev, LBB, &dev_priv->saveLBB);
 
-	/* Render Standby */
-	if (IS_I965G(dev) && IS_MOBILE(dev))
-		dev_priv->saveRENDERSTANDBY = I915_READ(MCHBAR_RENDER_STANDBY);
-
 	/* Hardware status page */
 	dev_priv->saveHWS = I915_READ(HWS_PGA);
 
 	i915_save_display(dev);
 
 	/* Interrupt state */
-	if (IS_IGDNG(dev)) {
+	if (IS_IRONLAKE(dev)) {
 		dev_priv->saveDEIER = I915_READ(DEIER);
 		dev_priv->saveDEIMR = I915_READ(DEIMR);
 		dev_priv->saveGTIER = I915_READ(GTIER);
@@ -754,10 +750,6 @@ int i915_save_state(struct drm_device *dev)
 		dev_priv->saveIMR = I915_READ(IMR);
 	}
 
-	/* Clock gating state */
-	dev_priv->saveD_STATE = I915_READ(D_STATE);
-	dev_priv->saveDSPCLK_GATE_D = I915_READ(DSPCLK_GATE_D); /* Not sure about this */
-
 	/* Cache mode state */
 	dev_priv->saveCACHE_MODE_0 = I915_READ(CACHE_MODE_0);
 
@@ -795,10 +787,6 @@ int i915_restore_state(struct drm_device *dev)
 
 	pci_write_config_byte(dev->pdev, LBB, dev_priv->saveLBB);
 
-	/* Render Standby */
-	if (IS_I965G(dev) && IS_MOBILE(dev))
-		I915_WRITE(MCHBAR_RENDER_STANDBY, dev_priv->saveRENDERSTANDBY);
-
 	/* Hardware status page */
 	I915_WRITE(HWS_PGA, dev_priv->saveHWS);
 
@@ -817,7 +805,7 @@ int i915_restore_state(struct drm_device *dev)
 	i915_restore_display(dev);
 
 	/* Interrupt state */
-	if (IS_IGDNG(dev)) {
+	if (IS_IRONLAKE(dev)) {
 		I915_WRITE(DEIER, dev_priv->saveDEIER);
 		I915_WRITE(DEIMR, dev_priv->saveDEIMR);
 		I915_WRITE(GTIER, dev_priv->saveGTIER);
@@ -830,8 +818,7 @@ int i915_restore_state(struct drm_device *dev)
 	}
 
 	/* Clock gating state */
-	I915_WRITE (D_STATE, dev_priv->saveD_STATE);
-	I915_WRITE (DSPCLK_GATE_D, dev_priv->saveDSPCLK_GATE_D);
+	intel_init_clock_gating(dev);
 
 	/* Cache mode state */
 	I915_WRITE (CACHE_MODE_0, dev_priv->saveCACHE_MODE_0 | 0xffff0000);
@@ -846,6 +833,9 @@ int i915_restore_state(struct drm_device *dev)
 	for (i = 0; i < 3; i++)
 		I915_WRITE(SWF30 + (i << 2), dev_priv->saveSWF2[i]);
 
+	/* I2C state */
+	intel_i2c_reset_gmbus(dev);
+
 	return 0;
 }
 
diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
index 96cd256e60e6..15fbc1b5a83e 100644
--- a/drivers/gpu/drm/i915/intel_bios.c
+++ b/drivers/gpu/drm/i915/intel_bios.c
@@ -33,6 +33,8 @@
 #define	SLAVE_ADDR1	0x70
 #define	SLAVE_ADDR2	0x72
 
+static int panel_type;
+
 static void *
 find_section(struct bdb_header *bdb, int section_id)
 {
@@ -114,6 +116,8 @@ parse_lfp_panel_data(struct drm_i915_private *dev_priv,
 	struct lvds_dvo_timing *dvo_timing;
 	struct drm_display_mode *panel_fixed_mode;
 	int lfp_data_size, dvo_timing_offset;
+	int i, temp_downclock;
+	struct drm_display_mode *temp_mode;
 
 	/* Defaults if we can't find VBT info */
 	dev_priv->lvds_dither = 0;
@@ -126,6 +130,7 @@ parse_lfp_panel_data(struct drm_i915_private *dev_priv,
 	dev_priv->lvds_dither = lvds_options->pixel_dither;
 	if (lvds_options->panel_type == 0xff)
 		return;
+	panel_type = lvds_options->panel_type;
 
 	lvds_lfp_data = find_section(bdb, BDB_LVDS_LFP_DATA);
 	if (!lvds_lfp_data)
@@ -159,9 +164,50 @@ parse_lfp_panel_data(struct drm_i915_private *dev_priv,
 
 	dev_priv->lfp_lvds_vbt_mode = panel_fixed_mode;
 
-	DRM_DEBUG("Found panel mode in BIOS VBT tables:\n");
+	DRM_DEBUG_KMS("Found panel mode in BIOS VBT tables:\n");
 	drm_mode_debug_printmodeline(panel_fixed_mode);
 
+	temp_mode = kzalloc(sizeof(*temp_mode), GFP_KERNEL);
+	temp_downclock = panel_fixed_mode->clock;
+	/*
+	 * enumerate the LVDS panel timing info entry in VBT to check whether
+	 * the LVDS downclock is found.
+	 */
+	for (i = 0; i < 16; i++) {
+		entry = (struct bdb_lvds_lfp_data_entry *)
+			((uint8_t *)lvds_lfp_data->data + (lfp_data_size * i));
+		dvo_timing = (struct lvds_dvo_timing *)
+			((unsigned char *)entry + dvo_timing_offset);
+
+		fill_detail_timing_data(temp_mode, dvo_timing);
+
+		if (temp_mode->hdisplay == panel_fixed_mode->hdisplay &&
+		temp_mode->hsync_start == panel_fixed_mode->hsync_start &&
+		temp_mode->hsync_end == panel_fixed_mode->hsync_end &&
+		temp_mode->htotal == panel_fixed_mode->htotal &&
+		temp_mode->vdisplay == panel_fixed_mode->vdisplay &&
+		temp_mode->vsync_start == panel_fixed_mode->vsync_start &&
+		temp_mode->vsync_end == panel_fixed_mode->vsync_end &&
+		temp_mode->vtotal == panel_fixed_mode->vtotal &&
+		temp_mode->clock < temp_downclock) {
+			/*
+			 * downclock is already found. But we expect
+			 * to find the lower downclock.
+			 */
+			temp_downclock = temp_mode->clock;
+		}
+		/* clear it to zero */
+		memset(temp_mode, 0, sizeof(*temp_mode));
+	}
+	kfree(temp_mode);
+	if (temp_downclock < panel_fixed_mode->clock &&
+	    i915_lvds_downclock) {
+		dev_priv->lvds_downclock_avail = 1;
+		dev_priv->lvds_downclock = temp_downclock;
+		DRM_DEBUG_KMS("LVDS downclock is found in VBT. ",
+				"Normal Clock %dKHz, downclock %dKHz\n",
+				temp_downclock, panel_fixed_mode->clock);
+	}
 	return;
 }
 
@@ -217,7 +263,7 @@ parse_general_features(struct drm_i915_private *dev_priv,
 			if (IS_I85X(dev_priv->dev))
 				dev_priv->lvds_ssc_freq =
 					general->ssc_freq ? 66 : 48;
-			else if (IS_IGDNG(dev_priv->dev))
+			else if (IS_IRONLAKE(dev_priv->dev))
 				dev_priv->lvds_ssc_freq =
 					general->ssc_freq ? 100 : 120;
 			else
@@ -241,22 +287,18 @@ parse_general_definitions(struct drm_i915_private *dev_priv,
 		GPIOF,
 	};
 
-	/* Set sensible defaults in case we can't find the general block
-	   or it is the wrong chipset */
-	dev_priv->crt_ddc_bus = -1;
-
 	general = find_section(bdb, BDB_GENERAL_DEFINITIONS);
 	if (general) {
 		u16 block_size = get_blocksize(general);
 		if (block_size >= sizeof(*general)) {
 			int bus_pin = general->crt_ddc_gmbus_pin;
-			DRM_DEBUG("crt_ddc_bus_pin: %d\n", bus_pin);
+			DRM_DEBUG_KMS("crt_ddc_bus_pin: %d\n", bus_pin);
 			if ((bus_pin >= 1) && (bus_pin <= 6)) {
 				dev_priv->crt_ddc_bus =
 					crt_bus_map_table[bus_pin-1];
 			}
 		} else {
-			DRM_DEBUG("BDB_GD too small (%d). Invalid.\n",
+			DRM_DEBUG_KMS("BDB_GD too small (%d). Invalid.\n",
 				  block_size);
 		}
 	}
@@ -274,7 +316,7 @@ parse_sdvo_device_mapping(struct drm_i915_private *dev_priv,
 
 	p_defs = find_section(bdb, BDB_GENERAL_DEFINITIONS);
 	if (!p_defs) {
-		DRM_DEBUG("No general definition block is found\n");
+		DRM_DEBUG_KMS("No general definition block is found\n");
 		return;
 	}
 	/* judge whether the size of child device meets the requirements.
@@ -284,7 +326,7 @@ parse_sdvo_device_mapping(struct drm_i915_private *dev_priv,
 	 */
 	if (p_defs->child_dev_size != sizeof(*p_child)) {
 		/* different child dev size . Ignore it */
-		DRM_DEBUG("different child size is found. Invalid.\n");
+		DRM_DEBUG_KMS("different child size is found. Invalid.\n");
 		return;
 	}
 	/* get the block size of general definitions */
@@ -310,11 +352,11 @@ parse_sdvo_device_mapping(struct drm_i915_private *dev_priv,
 		if (p_child->dvo_port != DEVICE_PORT_DVOB &&
 			p_child->dvo_port != DEVICE_PORT_DVOC) {
 			/* skip the incorrect SDVO port */
-			DRM_DEBUG("Incorrect SDVO port. Skip it \n");
+			DRM_DEBUG_KMS("Incorrect SDVO port. Skip it \n");
 			continue;
 		}
-		DRM_DEBUG("the SDVO device with slave addr %2x is found on "
-				"%s port\n",
+		DRM_DEBUG_KMS("the SDVO device with slave addr %2x is found on"
+				" %s port\n",
 				p_child->slave_addr,
 				(p_child->dvo_port == DEVICE_PORT_DVOB) ?
 					"SDVOB" : "SDVOC");
@@ -325,21 +367,21 @@ parse_sdvo_device_mapping(struct drm_i915_private *dev_priv,
 			p_mapping->dvo_wiring = p_child->dvo_wiring;
 			p_mapping->initialized = 1;
 		} else {
-			DRM_DEBUG("Maybe one SDVO port is shared by "
+			DRM_DEBUG_KMS("Maybe one SDVO port is shared by "
 					 "two SDVO device.\n");
 		}
 		if (p_child->slave2_addr) {
 			/* Maybe this is a SDVO device with multiple inputs */
 			/* And the mapping info is not added */
-			DRM_DEBUG("there exists the slave2_addr. Maybe this "
-				"is a SDVO device with multiple inputs.\n");
+			DRM_DEBUG_KMS("there exists the slave2_addr. Maybe this"
+				" is a SDVO device with multiple inputs.\n");
 		}
 		count++;
 	}
 
 	if (!count) {
 		/* No SDVO device info is found */
-		DRM_DEBUG("No SDVO device info is found in VBT\n");
+		DRM_DEBUG_KMS("No SDVO device info is found in VBT\n");
 	}
 	return;
 }
@@ -366,6 +408,98 @@ parse_driver_features(struct drm_i915_private *dev_priv,
 		dev_priv->render_reclock_avail = true;
 }
 
+static void
+parse_edp(struct drm_i915_private *dev_priv, struct bdb_header *bdb)
+{
+	struct bdb_edp *edp;
+
+	edp = find_section(bdb, BDB_EDP);
+	if (!edp) {
+		if (SUPPORTS_EDP(dev_priv->dev) && dev_priv->edp_support) {
+			DRM_DEBUG_KMS("No eDP BDB found but eDP panel supported,\
+				       assume 18bpp panel color depth.\n");
+			dev_priv->edp_bpp = 18;
+		}
+		return;
+	}
+
+	switch ((edp->color_depth >> (panel_type * 2)) & 3) {
+	case EDP_18BPP:
+		dev_priv->edp_bpp = 18;
+		break;
+	case EDP_24BPP:
+		dev_priv->edp_bpp = 24;
+		break;
+	case EDP_30BPP:
+		dev_priv->edp_bpp = 30;
+		break;
+	}
+}
+
+static void
+parse_device_mapping(struct drm_i915_private *dev_priv,
+		       struct bdb_header *bdb)
+{
+	struct bdb_general_definitions *p_defs;
+	struct child_device_config *p_child, *child_dev_ptr;
+	int i, child_device_num, count;
+	u16	block_size;
+
+	p_defs = find_section(bdb, BDB_GENERAL_DEFINITIONS);
+	if (!p_defs) {
+		DRM_DEBUG_KMS("No general definition block is found\n");
+		return;
+	}
+	/* judge whether the size of child device meets the requirements.
+	 * If the child device size obtained from general definition block
+	 * is different with sizeof(struct child_device_config), skip the
+	 * parsing of sdvo device info
+	 */
+	if (p_defs->child_dev_size != sizeof(*p_child)) {
+		/* different child dev size . Ignore it */
+		DRM_DEBUG_KMS("different child size is found. Invalid.\n");
+		return;
+	}
+	/* get the block size of general definitions */
+	block_size = get_blocksize(p_defs);
+	/* get the number of child device */
+	child_device_num = (block_size - sizeof(*p_defs)) /
+				sizeof(*p_child);
+	count = 0;
+	/* get the number of child device that is present */
+	for (i = 0; i < child_device_num; i++) {
+		p_child = &(p_defs->devices[i]);
+		if (!p_child->device_type) {
+			/* skip the device block if device type is invalid */
+			continue;
+		}
+		count++;
+	}
+	if (!count) {
+		DRM_DEBUG_KMS("no child dev is parsed from VBT \n");
+		return;
+	}
+	dev_priv->child_dev = kzalloc(sizeof(*p_child) * count, GFP_KERNEL);
+	if (!dev_priv->child_dev) {
+		DRM_DEBUG_KMS("No memory space for child device\n");
+		return;
+	}
+
+	dev_priv->child_dev_num = count;
+	count = 0;
+	for (i = 0; i < child_device_num; i++) {
+		p_child = &(p_defs->devices[i]);
+		if (!p_child->device_type) {
+			/* skip the device block if device type is invalid */
+			continue;
+		}
+		child_dev_ptr = dev_priv->child_dev + count;
+		count++;
+		memcpy((void *)child_dev_ptr, (void *)p_child,
+					sizeof(*p_child));
+	}
+	return;
+}
 /**
  * intel_init_bios - initialize VBIOS settings & find VBT
  * @dev: DRM device
@@ -417,7 +551,9 @@ intel_init_bios(struct drm_device *dev)
 	parse_lfp_panel_data(dev_priv, bdb);
 	parse_sdvo_panel_data(dev_priv, bdb);
 	parse_sdvo_device_mapping(dev_priv, bdb);
+	parse_device_mapping(dev_priv, bdb);
 	parse_driver_features(dev_priv, bdb);
+	parse_edp(dev_priv, bdb);
 
 	pci_unmap_rom(pdev, bios);
 
diff --git a/drivers/gpu/drm/i915/intel_bios.h b/drivers/gpu/drm/i915/intel_bios.h
index 0f8e5f69ac7a..4c18514f6f80 100644
--- a/drivers/gpu/drm/i915/intel_bios.h
+++ b/drivers/gpu/drm/i915/intel_bios.h
@@ -98,6 +98,7 @@ struct vbios_data {
 #define BDB_SDVO_LVDS_PNP_IDS	 24
 #define BDB_SDVO_LVDS_POWER_SEQ	 25
 #define BDB_TV_OPTIONS		 26
+#define BDB_EDP			 27
 #define BDB_LVDS_OPTIONS	 40
 #define BDB_LVDS_LFP_DATA_PTRS	 41
 #define BDB_LVDS_LFP_DATA	 42
@@ -426,6 +427,45 @@ struct bdb_driver_features {
 	u8 custom_vbt_version;
 } __attribute__((packed));
 
+#define EDP_18BPP	0
+#define EDP_24BPP	1
+#define EDP_30BPP	2
+#define EDP_RATE_1_62	0
+#define EDP_RATE_2_7	1
+#define EDP_LANE_1	0
+#define EDP_LANE_2	1
+#define EDP_LANE_4	3
+#define EDP_PREEMPHASIS_NONE	0
+#define EDP_PREEMPHASIS_3_5dB	1
+#define EDP_PREEMPHASIS_6dB	2
+#define EDP_PREEMPHASIS_9_5dB	3
+#define EDP_VSWING_0_4V		0
+#define EDP_VSWING_0_6V		1
+#define EDP_VSWING_0_8V		2
+#define EDP_VSWING_1_2V		3
+
+struct edp_power_seq {
+	u16 t3;
+	u16 t7;
+	u16 t9;
+	u16 t10;
+	u16 t12;
+} __attribute__ ((packed));
+
+struct edp_link_params {
+	u8 rate:4;
+	u8 lanes:4;
+	u8 preemphasis:4;
+	u8 vswing:4;
+} __attribute__ ((packed));
+
+struct bdb_edp {
+	struct edp_power_seq power_seqs[16];
+	u32 color_depth;
+	u32 sdrrs_msa_timing_delay;
+	struct edp_link_params link_params[16];
+} __attribute__ ((packed));
+
 bool intel_init_bios(struct drm_device *dev);
 
 /*
@@ -549,4 +589,21 @@ bool intel_init_bios(struct drm_device *dev);
 #define   SWF14_APM_STANDBY	0x1
 #define   SWF14_APM_RESTORE	0x0
 
+/* Add the device class for LFP, TV, HDMI */
+#define	 DEVICE_TYPE_INT_LFP	0x1022
+#define	 DEVICE_TYPE_INT_TV	0x1009
+#define	 DEVICE_TYPE_HDMI	0x60D2
+#define	 DEVICE_TYPE_DP		0x68C6
+#define	 DEVICE_TYPE_eDP	0x78C6
+
+/* define the DVO port for HDMI output type */
+#define		DVO_B		1
+#define		DVO_C		2
+#define		DVO_D		3
+
+/* define the PORT for DP output type */
+#define		PORT_IDPB	7
+#define		PORT_IDPC	8
+#define		PORT_IDPD	9
+
 #endif /* _I830_BIOS_H_ */
diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
index e5051446c48e..ddefc871edfe 100644
--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -39,7 +39,7 @@ static void intel_crt_dpms(struct drm_encoder *encoder, int mode)
 	struct drm_i915_private *dev_priv = dev->dev_private;
 	u32 temp, reg;
 
-	if (IS_IGDNG(dev))
+	if (IS_IRONLAKE(dev))
 		reg = PCH_ADPA;
 	else
 		reg = ADPA;
@@ -64,34 +64,6 @@ static void intel_crt_dpms(struct drm_encoder *encoder, int mode)
 	}
 
 	I915_WRITE(reg, temp);
-
-	if (IS_IGD(dev)) {
-		if (mode == DRM_MODE_DPMS_OFF) {
-			/* turn off DAC */
-			temp = I915_READ(PORT_HOTPLUG_EN);
-			temp &= ~CRT_EOS_INT_EN;
-			I915_WRITE(PORT_HOTPLUG_EN, temp);
-
-			temp = I915_READ(PORT_HOTPLUG_STAT);
-			if (temp & CRT_EOS_INT_STATUS)
-				I915_WRITE(PORT_HOTPLUG_STAT,
-					CRT_EOS_INT_STATUS);
-		} else {
-			/* turn on DAC. EOS interrupt must be enabled after DAC
-			 * is enabled, so it sounds not good to enable it in
-			 * i915_driver_irq_postinstall()
-			 * wait 12.5ms after DAC is enabled
-			 */
-			msleep(13);
-			temp = I915_READ(PORT_HOTPLUG_STAT);
-			if (temp & CRT_EOS_INT_STATUS)
-				I915_WRITE(PORT_HOTPLUG_STAT,
-					CRT_EOS_INT_STATUS);
-			temp = I915_READ(PORT_HOTPLUG_EN);
-			temp |= CRT_EOS_INT_EN;
-			I915_WRITE(PORT_HOTPLUG_EN, temp);
-		}
-	}
 }
 
 static int intel_crt_mode_valid(struct drm_connector *connector,
@@ -141,7 +113,7 @@ static void intel_crt_mode_set(struct drm_encoder *encoder,
 	else
 		dpll_md_reg = DPLL_B_MD;
 
-	if (IS_IGDNG(dev))
+	if (IS_IRONLAKE(dev))
 		adpa_reg = PCH_ADPA;
 	else
 		adpa_reg = ADPA;
@@ -150,7 +122,7 @@ static void intel_crt_mode_set(struct drm_encoder *encoder,
 	 * Disable separate mode multiplier used when cloning SDVO to CRT
 	 * XXX this needs to be adjusted when we really are cloning
 	 */
-	if (IS_I965G(dev) && !IS_IGDNG(dev)) {
+	if (IS_I965G(dev) && !IS_IRONLAKE(dev)) {
 		dpll_md = I915_READ(dpll_md_reg);
 		I915_WRITE(dpll_md_reg,
 			   dpll_md & ~DPLL_MD_UDI_MULTIPLIER_MASK);
@@ -164,18 +136,18 @@ static void intel_crt_mode_set(struct drm_encoder *encoder,
 
 	if (intel_crtc->pipe == 0) {
 		adpa |= ADPA_PIPE_A_SELECT;
-		if (!IS_IGDNG(dev))
+		if (!IS_IRONLAKE(dev))
 			I915_WRITE(BCLRPAT_A, 0);
 	} else {
 		adpa |= ADPA_PIPE_B_SELECT;
-		if (!IS_IGDNG(dev))
+		if (!IS_IRONLAKE(dev))
 			I915_WRITE(BCLRPAT_B, 0);
 	}
 
 	I915_WRITE(adpa_reg, adpa);
 }
 
-static bool intel_igdng_crt_detect_hotplug(struct drm_connector *connector)
+static bool intel_ironlake_crt_detect_hotplug(struct drm_connector *connector)
 {
 	struct drm_device *dev = connector->dev;
 	struct drm_i915_private *dev_priv = dev->dev_private;
@@ -194,7 +166,7 @@ static bool intel_igdng_crt_detect_hotplug(struct drm_connector *connector)
 			ADPA_CRT_HOTPLUG_ENABLE |
 			ADPA_CRT_HOTPLUG_FORCE_TRIGGER);
 
-	DRM_DEBUG("pch crt adpa 0x%x", adpa);
+	DRM_DEBUG_KMS("pch crt adpa 0x%x", adpa);
 	I915_WRITE(PCH_ADPA, adpa);
 
 	while ((I915_READ(PCH_ADPA) & ADPA_CRT_HOTPLUG_FORCE_TRIGGER) != 0)
@@ -227,8 +199,8 @@ static bool intel_crt_detect_hotplug(struct drm_connector *connector)
 	u32 hotplug_en;
 	int i, tries = 0;
 
-	if (IS_IGDNG(dev))
-		return intel_igdng_crt_detect_hotplug(connector);
+	if (IS_IRONLAKE(dev))
+		return intel_ironlake_crt_detect_hotplug(connector);
 
 	/*
 	 * On 4 series desktop, CRT detect sequence need to be done twice
@@ -549,12 +521,12 @@ void intel_crt_init(struct drm_device *dev)
 					  &intel_output->enc);
 
 	/* Set up the DDC bus. */
-	if (IS_IGDNG(dev))
+	if (IS_IRONLAKE(dev))
 		i2c_reg = PCH_GPIOA;
 	else {
 		i2c_reg = GPIOA;
 		/* Use VBT information for CRT DDC if available */
-		if (dev_priv->crt_ddc_bus != -1)
+		if (dev_priv->crt_ddc_bus != 0)
 			i2c_reg = dev_priv->crt_ddc_bus;
 	}
 	intel_output->ddc_bus = intel_i2c_create(dev, i2c_reg, "CRTDDC_A");
@@ -576,4 +548,6 @@ void intel_crt_init(struct drm_device *dev)
 	drm_connector_helper_add(connector, &intel_crt_connector_helper_funcs);
 
 	drm_sysfs_connector_add(connector);
+
+	dev_priv->hotplug_supported_mask |= CRT_HOTPLUG_INT_STATUS;
 }
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 099f420de57a..45da78ef4a92 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -32,7 +32,7 @@
 #include "intel_drv.h"
 #include "i915_drm.h"
 #include "i915_drv.h"
-#include "intel_dp.h"
+#include "drm_dp_helper.h"
 
 #include "drm_crtc_helper.h"
 
@@ -70,8 +70,6 @@ struct intel_limit {
     intel_p2_t	    p2;
     bool (* find_pll)(const intel_limit_t *, struct drm_crtc *,
 		      int, int, intel_clock_t *);
-    bool (* find_reduced_pll)(const intel_limit_t *, struct drm_crtc *,
-			      int, int, intel_clock_t *);
 };
 
 #define I8XX_DOT_MIN		  25000
@@ -102,32 +100,32 @@ struct intel_limit {
 #define I9XX_DOT_MAX		 400000
 #define I9XX_VCO_MIN		1400000
 #define I9XX_VCO_MAX		2800000
-#define IGD_VCO_MIN		1700000
-#define IGD_VCO_MAX		3500000
+#define PINEVIEW_VCO_MIN		1700000
+#define PINEVIEW_VCO_MAX		3500000
 #define I9XX_N_MIN		      1
 #define I9XX_N_MAX		      6
-/* IGD's Ncounter is a ring counter */
-#define IGD_N_MIN		      3
-#define IGD_N_MAX		      6
+/* Pineview's Ncounter is a ring counter */
+#define PINEVIEW_N_MIN		      3
+#define PINEVIEW_N_MAX		      6
 #define I9XX_M_MIN		     70
 #define I9XX_M_MAX		    120
-#define IGD_M_MIN		      2
-#define IGD_M_MAX		    256
+#define PINEVIEW_M_MIN		      2
+#define PINEVIEW_M_MAX		    256
 #define I9XX_M1_MIN		     10
 #define I9XX_M1_MAX		     22
 #define I9XX_M2_MIN		      5
 #define I9XX_M2_MAX		      9
-/* IGD M1 is reserved, and must be 0 */
-#define IGD_M1_MIN		      0
-#define IGD_M1_MAX		      0
-#define IGD_M2_MIN		      0
-#define IGD_M2_MAX		      254
+/* Pineview M1 is reserved, and must be 0 */
+#define PINEVIEW_M1_MIN		      0
+#define PINEVIEW_M1_MAX		      0
+#define PINEVIEW_M2_MIN		      0
+#define PINEVIEW_M2_MAX		      254
 #define I9XX_P_SDVO_DAC_MIN	      5
 #define I9XX_P_SDVO_DAC_MAX	     80
 #define I9XX_P_LVDS_MIN		      7
 #define I9XX_P_LVDS_MAX		     98
-#define IGD_P_LVDS_MIN		      7
-#define IGD_P_LVDS_MAX		     112
+#define PINEVIEW_P_LVDS_MIN		      7
+#define PINEVIEW_P_LVDS_MAX		     112
 #define I9XX_P1_MIN		      1
 #define I9XX_P1_MAX		      8
 #define I9XX_P2_SDVO_DAC_SLOW		     10
@@ -234,53 +232,55 @@ struct intel_limit {
 #define G4X_P2_DISPLAY_PORT_FAST           10
 #define G4X_P2_DISPLAY_PORT_LIMIT          0
 
-/* IGDNG */
+/* Ironlake */
 /* as we calculate clock using (register_value + 2) for
    N/M1/M2, so here the range value for them is (actual_value-2).
  */
-#define IGDNG_DOT_MIN         25000
-#define IGDNG_DOT_MAX         350000
-#define IGDNG_VCO_MIN         1760000
-#define IGDNG_VCO_MAX         3510000
-#define IGDNG_N_MIN           1
-#define IGDNG_N_MAX           5
-#define IGDNG_M_MIN           79
-#define IGDNG_M_MAX           118
-#define IGDNG_M1_MIN          12
-#define IGDNG_M1_MAX          23
-#define IGDNG_M2_MIN          5
-#define IGDNG_M2_MAX          9
-#define IGDNG_P_SDVO_DAC_MIN  5
-#define IGDNG_P_SDVO_DAC_MAX  80
-#define IGDNG_P_LVDS_MIN      28
-#define IGDNG_P_LVDS_MAX      112
-#define IGDNG_P1_MIN          1
-#define IGDNG_P1_MAX          8
-#define IGDNG_P2_SDVO_DAC_SLOW 10
-#define IGDNG_P2_SDVO_DAC_FAST 5
-#define IGDNG_P2_LVDS_SLOW    14 /* single channel */
-#define IGDNG_P2_LVDS_FAST    7  /* double channel */
-#define IGDNG_P2_DOT_LIMIT    225000 /* 225Mhz */
+#define IRONLAKE_DOT_MIN         25000
+#define IRONLAKE_DOT_MAX         350000
+#define IRONLAKE_VCO_MIN         1760000
+#define IRONLAKE_VCO_MAX         3510000
+#define IRONLAKE_N_MIN           1
+#define IRONLAKE_N_MAX           6
+#define IRONLAKE_M_MIN           79
+#define IRONLAKE_M_MAX           127
+#define IRONLAKE_M1_MIN          12
+#define IRONLAKE_M1_MAX          22
+#define IRONLAKE_M2_MIN          5
+#define IRONLAKE_M2_MAX          9
+#define IRONLAKE_P_SDVO_DAC_MIN  5
+#define IRONLAKE_P_SDVO_DAC_MAX  80
+#define IRONLAKE_P_LVDS_MIN      28
+#define IRONLAKE_P_LVDS_MAX      112
+#define IRONLAKE_P1_MIN          1
+#define IRONLAKE_P1_MAX          8
+#define IRONLAKE_P2_SDVO_DAC_SLOW 10
+#define IRONLAKE_P2_SDVO_DAC_FAST 5
+#define IRONLAKE_P2_LVDS_SLOW    14 /* single channel */
+#define IRONLAKE_P2_LVDS_FAST    7  /* double channel */
+#define IRONLAKE_P2_DOT_LIMIT    225000 /* 225Mhz */
+
+#define IRONLAKE_P_DISPLAY_PORT_MIN	10
+#define IRONLAKE_P_DISPLAY_PORT_MAX	20
+#define IRONLAKE_P2_DISPLAY_PORT_FAST	10
+#define IRONLAKE_P2_DISPLAY_PORT_SLOW	10
+#define IRONLAKE_P2_DISPLAY_PORT_LIMIT	0
+#define IRONLAKE_P1_DISPLAY_PORT_MIN	1
+#define IRONLAKE_P1_DISPLAY_PORT_MAX	2
 
 static bool
 intel_find_best_PLL(const intel_limit_t *limit, struct drm_crtc *crtc,
 		    int target, int refclk, intel_clock_t *best_clock);
 static bool
-intel_find_best_reduced_PLL(const intel_limit_t *limit, struct drm_crtc *crtc,
-			    int target, int refclk, intel_clock_t *best_clock);
-static bool
 intel_g4x_find_best_PLL(const intel_limit_t *limit, struct drm_crtc *crtc,
 			int target, int refclk, intel_clock_t *best_clock);
-static bool
-intel_igdng_find_best_PLL(const intel_limit_t *limit, struct drm_crtc *crtc,
-			int target, int refclk, intel_clock_t *best_clock);
 
 static bool
 intel_find_pll_g4x_dp(const intel_limit_t *, struct drm_crtc *crtc,
 		      int target, int refclk, intel_clock_t *best_clock);
 static bool
-intel_find_pll_igdng_dp(const intel_limit_t *, struct drm_crtc *crtc,
-		      int target, int refclk, intel_clock_t *best_clock);
+intel_find_pll_ironlake_dp(const intel_limit_t *, struct drm_crtc *crtc,
+			   int target, int refclk, intel_clock_t *best_clock);
 
 static const intel_limit_t intel_limits_i8xx_dvo = {
         .dot = { .min = I8XX_DOT_MIN,		.max = I8XX_DOT_MAX },
@@ -294,7 +294,6 @@ static const intel_limit_t intel_limits_i8xx_dvo = {
 	.p2  = { .dot_limit = I8XX_P2_SLOW_LIMIT,
 		 .p2_slow = I8XX_P2_SLOW,	.p2_fast = I8XX_P2_FAST },
 	.find_pll = intel_find_best_PLL,
-	.find_reduced_pll = intel_find_best_reduced_PLL,
 };
 
 static const intel_limit_t intel_limits_i8xx_lvds = {
@@ -309,7 +308,6 @@ static const intel_limit_t intel_limits_i8xx_lvds = {
 	.p2  = { .dot_limit = I8XX_P2_SLOW_LIMIT,
 		 .p2_slow = I8XX_P2_LVDS_SLOW,	.p2_fast = I8XX_P2_LVDS_FAST },
 	.find_pll = intel_find_best_PLL,
-	.find_reduced_pll = intel_find_best_reduced_PLL,
 };
 	
 static const intel_limit_t intel_limits_i9xx_sdvo = {
@@ -324,7 +322,6 @@ static const intel_limit_t intel_limits_i9xx_sdvo = {
 	.p2  = { .dot_limit = I9XX_P2_SDVO_DAC_SLOW_LIMIT,
 		 .p2_slow = I9XX_P2_SDVO_DAC_SLOW,	.p2_fast = I9XX_P2_SDVO_DAC_FAST },
 	.find_pll = intel_find_best_PLL,
-	.find_reduced_pll = intel_find_best_reduced_PLL,
 };
 
 static const intel_limit_t intel_limits_i9xx_lvds = {
@@ -342,7 +339,6 @@ static const intel_limit_t intel_limits_i9xx_lvds = {
 	.p2  = { .dot_limit = I9XX_P2_LVDS_SLOW_LIMIT,
 		 .p2_slow = I9XX_P2_LVDS_SLOW,	.p2_fast = I9XX_P2_LVDS_FAST },
 	.find_pll = intel_find_best_PLL,
-	.find_reduced_pll = intel_find_best_reduced_PLL,
 };
 
     /* below parameter and function is for G4X Chipset Family*/
@@ -360,7 +356,6 @@ static const intel_limit_t intel_limits_g4x_sdvo = {
 		 .p2_fast = G4X_P2_SDVO_FAST
 	},
 	.find_pll = intel_g4x_find_best_PLL,
-	.find_reduced_pll = intel_g4x_find_best_PLL,
 };
 
 static const intel_limit_t intel_limits_g4x_hdmi = {
@@ -377,7 +372,6 @@ static const intel_limit_t intel_limits_g4x_hdmi = {
 		 .p2_fast = G4X_P2_HDMI_DAC_FAST
 	},
 	.find_pll = intel_g4x_find_best_PLL,
-	.find_reduced_pll = intel_g4x_find_best_PLL,
 };
 
 static const intel_limit_t intel_limits_g4x_single_channel_lvds = {
@@ -402,7 +396,6 @@ static const intel_limit_t intel_limits_g4x_single_channel_lvds = {
 		 .p2_fast = G4X_P2_SINGLE_CHANNEL_LVDS_FAST
 	},
 	.find_pll = intel_g4x_find_best_PLL,
-	.find_reduced_pll = intel_g4x_find_best_PLL,
 };
 
 static const intel_limit_t intel_limits_g4x_dual_channel_lvds = {
@@ -427,7 +420,6 @@ static const intel_limit_t intel_limits_g4x_dual_channel_lvds = {
 		 .p2_fast = G4X_P2_DUAL_CHANNEL_LVDS_FAST
 	},
 	.find_pll = intel_g4x_find_best_PLL,
-	.find_reduced_pll = intel_g4x_find_best_PLL,
 };
 
 static const intel_limit_t intel_limits_g4x_display_port = {
@@ -453,74 +445,98 @@ static const intel_limit_t intel_limits_g4x_display_port = {
         .find_pll = intel_find_pll_g4x_dp,
 };
 
-static const intel_limit_t intel_limits_igd_sdvo = {
+static const intel_limit_t intel_limits_pineview_sdvo = {
         .dot = { .min = I9XX_DOT_MIN,		.max = I9XX_DOT_MAX},
-        .vco = { .min = IGD_VCO_MIN,		.max = IGD_VCO_MAX },
-        .n   = { .min = IGD_N_MIN,		.max = IGD_N_MAX },
-        .m   = { .min = IGD_M_MIN,		.max = IGD_M_MAX },
-        .m1  = { .min = IGD_M1_MIN,		.max = IGD_M1_MAX },
-        .m2  = { .min = IGD_M2_MIN,		.max = IGD_M2_MAX },
+        .vco = { .min = PINEVIEW_VCO_MIN,		.max = PINEVIEW_VCO_MAX },
+        .n   = { .min = PINEVIEW_N_MIN,		.max = PINEVIEW_N_MAX },
+        .m   = { .min = PINEVIEW_M_MIN,		.max = PINEVIEW_M_MAX },
+        .m1  = { .min = PINEVIEW_M1_MIN,		.max = PINEVIEW_M1_MAX },
+        .m2  = { .min = PINEVIEW_M2_MIN,		.max = PINEVIEW_M2_MAX },
         .p   = { .min = I9XX_P_SDVO_DAC_MIN,    .max = I9XX_P_SDVO_DAC_MAX },
         .p1  = { .min = I9XX_P1_MIN,		.max = I9XX_P1_MAX },
 	.p2  = { .dot_limit = I9XX_P2_SDVO_DAC_SLOW_LIMIT,
 		 .p2_slow = I9XX_P2_SDVO_DAC_SLOW,	.p2_fast = I9XX_P2_SDVO_DAC_FAST },
 	.find_pll = intel_find_best_PLL,
-	.find_reduced_pll = intel_find_best_reduced_PLL,
 };
 
-static const intel_limit_t intel_limits_igd_lvds = {
+static const intel_limit_t intel_limits_pineview_lvds = {
         .dot = { .min = I9XX_DOT_MIN,		.max = I9XX_DOT_MAX },
-        .vco = { .min = IGD_VCO_MIN,		.max = IGD_VCO_MAX },
-        .n   = { .min = IGD_N_MIN,		.max = IGD_N_MAX },
-        .m   = { .min = IGD_M_MIN,		.max = IGD_M_MAX },
-        .m1  = { .min = IGD_M1_MIN,		.max = IGD_M1_MAX },
-        .m2  = { .min = IGD_M2_MIN,		.max = IGD_M2_MAX },
-        .p   = { .min = IGD_P_LVDS_MIN,	.max = IGD_P_LVDS_MAX },
+        .vco = { .min = PINEVIEW_VCO_MIN,		.max = PINEVIEW_VCO_MAX },
+        .n   = { .min = PINEVIEW_N_MIN,		.max = PINEVIEW_N_MAX },
+        .m   = { .min = PINEVIEW_M_MIN,		.max = PINEVIEW_M_MAX },
+        .m1  = { .min = PINEVIEW_M1_MIN,		.max = PINEVIEW_M1_MAX },
+        .m2  = { .min = PINEVIEW_M2_MIN,		.max = PINEVIEW_M2_MAX },
+        .p   = { .min = PINEVIEW_P_LVDS_MIN,	.max = PINEVIEW_P_LVDS_MAX },
         .p1  = { .min = I9XX_P1_MIN,		.max = I9XX_P1_MAX },
-	/* IGD only supports single-channel mode. */
+	/* Pineview only supports single-channel mode. */
 	.p2  = { .dot_limit = I9XX_P2_LVDS_SLOW_LIMIT,
 		 .p2_slow = I9XX_P2_LVDS_SLOW,	.p2_fast = I9XX_P2_LVDS_SLOW },
 	.find_pll = intel_find_best_PLL,
-	.find_reduced_pll = intel_find_best_reduced_PLL,
 };
 
-static const intel_limit_t intel_limits_igdng_sdvo = {
-	.dot = { .min = IGDNG_DOT_MIN,          .max = IGDNG_DOT_MAX },
-	.vco = { .min = IGDNG_VCO_MIN,          .max = IGDNG_VCO_MAX },
-	.n   = { .min = IGDNG_N_MIN,            .max = IGDNG_N_MAX },
-	.m   = { .min = IGDNG_M_MIN,            .max = IGDNG_M_MAX },
-	.m1  = { .min = IGDNG_M1_MIN,           .max = IGDNG_M1_MAX },
-	.m2  = { .min = IGDNG_M2_MIN,           .max = IGDNG_M2_MAX },
-	.p   = { .min = IGDNG_P_SDVO_DAC_MIN,   .max = IGDNG_P_SDVO_DAC_MAX },
-	.p1  = { .min = IGDNG_P1_MIN,           .max = IGDNG_P1_MAX },
-	.p2  = { .dot_limit = IGDNG_P2_DOT_LIMIT,
-		 .p2_slow = IGDNG_P2_SDVO_DAC_SLOW,
-		 .p2_fast = IGDNG_P2_SDVO_DAC_FAST },
-	.find_pll = intel_igdng_find_best_PLL,
+static const intel_limit_t intel_limits_ironlake_sdvo = {
+	.dot = { .min = IRONLAKE_DOT_MIN,          .max = IRONLAKE_DOT_MAX },
+	.vco = { .min = IRONLAKE_VCO_MIN,          .max = IRONLAKE_VCO_MAX },
+	.n   = { .min = IRONLAKE_N_MIN,            .max = IRONLAKE_N_MAX },
+	.m   = { .min = IRONLAKE_M_MIN,            .max = IRONLAKE_M_MAX },
+	.m1  = { .min = IRONLAKE_M1_MIN,           .max = IRONLAKE_M1_MAX },
+	.m2  = { .min = IRONLAKE_M2_MIN,           .max = IRONLAKE_M2_MAX },
+	.p   = { .min = IRONLAKE_P_SDVO_DAC_MIN,   .max = IRONLAKE_P_SDVO_DAC_MAX },
+	.p1  = { .min = IRONLAKE_P1_MIN,           .max = IRONLAKE_P1_MAX },
+	.p2  = { .dot_limit = IRONLAKE_P2_DOT_LIMIT,
+		 .p2_slow = IRONLAKE_P2_SDVO_DAC_SLOW,
+		 .p2_fast = IRONLAKE_P2_SDVO_DAC_FAST },
+	.find_pll = intel_g4x_find_best_PLL,
 };
 
-static const intel_limit_t intel_limits_igdng_lvds = {
-	.dot = { .min = IGDNG_DOT_MIN,          .max = IGDNG_DOT_MAX },
-	.vco = { .min = IGDNG_VCO_MIN,          .max = IGDNG_VCO_MAX },
-	.n   = { .min = IGDNG_N_MIN,            .max = IGDNG_N_MAX },
-	.m   = { .min = IGDNG_M_MIN,            .max = IGDNG_M_MAX },
-	.m1  = { .min = IGDNG_M1_MIN,           .max = IGDNG_M1_MAX },
-	.m2  = { .min = IGDNG_M2_MIN,           .max = IGDNG_M2_MAX },
-	.p   = { .min = IGDNG_P_LVDS_MIN,       .max = IGDNG_P_LVDS_MAX },
-	.p1  = { .min = IGDNG_P1_MIN,           .max = IGDNG_P1_MAX },
-	.p2  = { .dot_limit = IGDNG_P2_DOT_LIMIT,
-		 .p2_slow = IGDNG_P2_LVDS_SLOW,
-		 .p2_fast = IGDNG_P2_LVDS_FAST },
-	.find_pll = intel_igdng_find_best_PLL,
+static const intel_limit_t intel_limits_ironlake_lvds = {
+	.dot = { .min = IRONLAKE_DOT_MIN,          .max = IRONLAKE_DOT_MAX },
+	.vco = { .min = IRONLAKE_VCO_MIN,          .max = IRONLAKE_VCO_MAX },
+	.n   = { .min = IRONLAKE_N_MIN,            .max = IRONLAKE_N_MAX },
+	.m   = { .min = IRONLAKE_M_MIN,            .max = IRONLAKE_M_MAX },
+	.m1  = { .min = IRONLAKE_M1_MIN,           .max = IRONLAKE_M1_MAX },
+	.m2  = { .min = IRONLAKE_M2_MIN,           .max = IRONLAKE_M2_MAX },
+	.p   = { .min = IRONLAKE_P_LVDS_MIN,       .max = IRONLAKE_P_LVDS_MAX },
+	.p1  = { .min = IRONLAKE_P1_MIN,           .max = IRONLAKE_P1_MAX },
+	.p2  = { .dot_limit = IRONLAKE_P2_DOT_LIMIT,
+		 .p2_slow = IRONLAKE_P2_LVDS_SLOW,
+		 .p2_fast = IRONLAKE_P2_LVDS_FAST },
+	.find_pll = intel_g4x_find_best_PLL,
 };
 
-static const intel_limit_t *intel_igdng_limit(struct drm_crtc *crtc)
+static const intel_limit_t intel_limits_ironlake_display_port = {
+        .dot = { .min = IRONLAKE_DOT_MIN,
+                 .max = IRONLAKE_DOT_MAX },
+        .vco = { .min = IRONLAKE_VCO_MIN,
+                 .max = IRONLAKE_VCO_MAX},
+        .n   = { .min = IRONLAKE_N_MIN,
+                 .max = IRONLAKE_N_MAX },
+        .m   = { .min = IRONLAKE_M_MIN,
+                 .max = IRONLAKE_M_MAX },
+        .m1  = { .min = IRONLAKE_M1_MIN,
+                 .max = IRONLAKE_M1_MAX },
+        .m2  = { .min = IRONLAKE_M2_MIN,
+                 .max = IRONLAKE_M2_MAX },
+        .p   = { .min = IRONLAKE_P_DISPLAY_PORT_MIN,
+                 .max = IRONLAKE_P_DISPLAY_PORT_MAX },
+        .p1  = { .min = IRONLAKE_P1_DISPLAY_PORT_MIN,
+                 .max = IRONLAKE_P1_DISPLAY_PORT_MAX},
+        .p2  = { .dot_limit = IRONLAKE_P2_DISPLAY_PORT_LIMIT,
+                 .p2_slow = IRONLAKE_P2_DISPLAY_PORT_SLOW,
+                 .p2_fast = IRONLAKE_P2_DISPLAY_PORT_FAST },
+        .find_pll = intel_find_pll_ironlake_dp,
+};
+
+static const intel_limit_t *intel_ironlake_limit(struct drm_crtc *crtc)
 {
 	const intel_limit_t *limit;
 	if (intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS))
-		limit = &intel_limits_igdng_lvds;
+		limit = &intel_limits_ironlake_lvds;
+	else if (intel_pipe_has_type(crtc, INTEL_OUTPUT_DISPLAYPORT) ||
+			HAS_eDP)
+		limit = &intel_limits_ironlake_display_port;
 	else
-		limit = &intel_limits_igdng_sdvo;
+		limit = &intel_limits_ironlake_sdvo;
 
 	return limit;
 }
@@ -557,20 +573,20 @@ static const intel_limit_t *intel_limit(struct drm_crtc *crtc)
 	struct drm_device *dev = crtc->dev;
 	const intel_limit_t *limit;
 
-	if (IS_IGDNG(dev))
-		limit = intel_igdng_limit(crtc);
+	if (IS_IRONLAKE(dev))
+		limit = intel_ironlake_limit(crtc);
 	else if (IS_G4X(dev)) {
 		limit = intel_g4x_limit(crtc);
-	} else if (IS_I9XX(dev) && !IS_IGD(dev)) {
+	} else if (IS_I9XX(dev) && !IS_PINEVIEW(dev)) {
 		if (intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS))
 			limit = &intel_limits_i9xx_lvds;
 		else
 			limit = &intel_limits_i9xx_sdvo;
-	} else if (IS_IGD(dev)) {
+	} else if (IS_PINEVIEW(dev)) {
 		if (intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS))
-			limit = &intel_limits_igd_lvds;
+			limit = &intel_limits_pineview_lvds;
 		else
-			limit = &intel_limits_igd_sdvo;
+			limit = &intel_limits_pineview_sdvo;
 	} else {
 		if (intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS))
 			limit = &intel_limits_i8xx_lvds;
@@ -580,8 +596,8 @@ static const intel_limit_t *intel_limit(struct drm_crtc *crtc)
 	return limit;
 }
 
-/* m1 is reserved as 0 in IGD, n is a ring counter */
-static void igd_clock(int refclk, intel_clock_t *clock)
+/* m1 is reserved as 0 in Pineview, n is a ring counter */
+static void pineview_clock(int refclk, intel_clock_t *clock)
 {
 	clock->m = clock->m2 + 2;
 	clock->p = clock->p1 * clock->p2;
@@ -591,8 +607,8 @@ static void igd_clock(int refclk, intel_clock_t *clock)
 
 static void intel_clock(struct drm_device *dev, int refclk, intel_clock_t *clock)
 {
-	if (IS_IGD(dev)) {
-		igd_clock(refclk, clock);
+	if (IS_PINEVIEW(dev)) {
+		pineview_clock(refclk, clock);
 		return;
 	}
 	clock->m = 5 * (clock->m1 + 2) + (clock->m2 + 2);
@@ -657,7 +673,7 @@ static bool intel_PLL_is_valid(struct drm_crtc *crtc, intel_clock_t *clock)
 		INTELPllInvalid ("m2 out of range\n");
 	if (clock->m1  < limit->m1.min  || limit->m1.max  < clock->m1)
 		INTELPllInvalid ("m1 out of range\n");
-	if (clock->m1 <= clock->m2 && !IS_IGD(dev))
+	if (clock->m1 <= clock->m2 && !IS_PINEVIEW(dev))
 		INTELPllInvalid ("m1 <= m2\n");
 	if (clock->m   < limit->m.min   || limit->m.max   < clock->m)
 		INTELPllInvalid ("m out of range\n");
@@ -706,16 +722,17 @@ intel_find_best_PLL(const intel_limit_t *limit, struct drm_crtc *crtc,
 
 	memset (best_clock, 0, sizeof (*best_clock));
 
-	for (clock.p1 = limit->p1.max; clock.p1 >= limit->p1.min; clock.p1--) {
-		for (clock.m1 = limit->m1.min; clock.m1 <= limit->m1.max;
-		     clock.m1++) {
-			for (clock.m2 = limit->m2.min;
-			     clock.m2 <= limit->m2.max; clock.m2++) {
-				/* m1 is always 0 in IGD */
-				if (clock.m2 >= clock.m1 && !IS_IGD(dev))
-					break;
-				for (clock.n = limit->n.min;
-				     clock.n <= limit->n.max; clock.n++) {
+	for (clock.m1 = limit->m1.min; clock.m1 <= limit->m1.max;
+	     clock.m1++) {
+		for (clock.m2 = limit->m2.min;
+		     clock.m2 <= limit->m2.max; clock.m2++) {
+			/* m1 is always 0 in Pineview */
+			if (clock.m2 >= clock.m1 && !IS_PINEVIEW(dev))
+				break;
+			for (clock.n = limit->n.min;
+			     clock.n <= limit->n.max; clock.n++) {
+				for (clock.p1 = limit->p1.min;
+					clock.p1 <= limit->p1.max; clock.p1++) {
 					int this_err;
 
 					intel_clock(dev, refclk, &clock);
@@ -736,46 +753,6 @@ intel_find_best_PLL(const intel_limit_t *limit, struct drm_crtc *crtc,
 	return (err != target);
 }
 
-
-static bool
-intel_find_best_reduced_PLL(const intel_limit_t *limit, struct drm_crtc *crtc,
-			    int target, int refclk, intel_clock_t *best_clock)
-
-{
-	struct drm_device *dev = crtc->dev;
-	intel_clock_t clock;
-	int err = target;
-	bool found = false;
-
-	memcpy(&clock, best_clock, sizeof(intel_clock_t));
-
-	for (clock.m1 = limit->m1.min; clock.m1 <= limit->m1.max; clock.m1++) {
-		for (clock.m2 = limit->m2.min; clock.m2 <= limit->m2.max; clock.m2++) {
-			/* m1 is always 0 in IGD */
-			if (clock.m2 >= clock.m1 && !IS_IGD(dev))
-				break;
-			for (clock.n = limit->n.min; clock.n <= limit->n.max;
-			     clock.n++) {
-				int this_err;
-
-				intel_clock(dev, refclk, &clock);
-
-				if (!intel_PLL_is_valid(crtc, &clock))
-					continue;
-
-				this_err = abs(clock.dot - target);
-				if (this_err < err) {
-					*best_clock = clock;
-					err = this_err;
-					found = true;
-				}
-			}
-		}
-	}
-
-	return found;
-}
-
 static bool
 intel_g4x_find_best_PLL(const intel_limit_t *limit, struct drm_crtc *crtc,
 			int target, int refclk, intel_clock_t *best_clock)
@@ -790,7 +767,13 @@ intel_g4x_find_best_PLL(const intel_limit_t *limit, struct drm_crtc *crtc,
 	found = false;
 
 	if (intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS)) {
-		if ((I915_READ(LVDS) & LVDS_CLKB_POWER_MASK) ==
+		int lvds_reg;
+
+		if (IS_IRONLAKE(dev))
+			lvds_reg = PCH_LVDS;
+		else
+			lvds_reg = LVDS;
+		if ((I915_READ(lvds_reg) & LVDS_CLKB_POWER_MASK) ==
 		    LVDS_CLKB_POWER_UP)
 			clock.p2 = limit->p2.p2_fast;
 		else
@@ -833,11 +816,16 @@ intel_g4x_find_best_PLL(const intel_limit_t *limit, struct drm_crtc *crtc,
 }
 
 static bool
-intel_find_pll_igdng_dp(const intel_limit_t *limit, struct drm_crtc *crtc,
-		      int target, int refclk, intel_clock_t *best_clock)
+intel_find_pll_ironlake_dp(const intel_limit_t *limit, struct drm_crtc *crtc,
+			   int target, int refclk, intel_clock_t *best_clock)
 {
 	struct drm_device *dev = crtc->dev;
 	intel_clock_t clock;
+
+	/* return directly when it is eDP */
+	if (HAS_eDP)
+		return true;
+
 	if (target < 200000) {
 		clock.n = 1;
 		clock.p1 = 2;
@@ -856,68 +844,6 @@ intel_find_pll_igdng_dp(const intel_limit_t *limit, struct drm_crtc *crtc,
 	return true;
 }
 
-static bool
-intel_igdng_find_best_PLL(const intel_limit_t *limit, struct drm_crtc *crtc,
-			int target, int refclk, intel_clock_t *best_clock)
-{
-	struct drm_device *dev = crtc->dev;
-	struct drm_i915_private *dev_priv = dev->dev_private;
-	intel_clock_t clock;
-	int err_most = 47;
-	int err_min = 10000;
-
-	/* eDP has only 2 clock choice, no n/m/p setting */
-	if (HAS_eDP)
-		return true;
-
-	if (intel_pipe_has_type(crtc, INTEL_OUTPUT_DISPLAYPORT))
-		return intel_find_pll_igdng_dp(limit, crtc, target,
-					       refclk, best_clock);
-
-	if (intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS)) {
-		if ((I915_READ(PCH_LVDS) & LVDS_CLKB_POWER_MASK) ==
-		    LVDS_CLKB_POWER_UP)
-			clock.p2 = limit->p2.p2_fast;
-		else
-			clock.p2 = limit->p2.p2_slow;
-	} else {
-		if (target < limit->p2.dot_limit)
-			clock.p2 = limit->p2.p2_slow;
-		else
-			clock.p2 = limit->p2.p2_fast;
-	}
-
-	memset(best_clock, 0, sizeof(*best_clock));
-	for (clock.p1 = limit->p1.max; clock.p1 >= limit->p1.min; clock.p1--) {
-		/* based on hardware requriment prefer smaller n to precision */
-		for (clock.n = limit->n.min; clock.n <= limit->n.max; clock.n++) {
-			/* based on hardware requirment prefere larger m1,m2 */
-			for (clock.m1 = limit->m1.max;
-			     clock.m1 >= limit->m1.min; clock.m1--) {
-				for (clock.m2 = limit->m2.max;
-				     clock.m2 >= limit->m2.min; clock.m2--) {
-					int this_err;
-
-					intel_clock(dev, refclk, &clock);
-					if (!intel_PLL_is_valid(crtc, &clock))
-						continue;
-					this_err = abs((10000 - (target*10000/clock.dot)));
-					if (this_err < err_most) {
-						*best_clock = clock;
-						/* found on first matching */
-						goto out;
-					} else if (this_err < err_min) {
-						*best_clock = clock;
-						err_min = this_err;
-					}
-				}
-			}
-		}
-	}
-out:
-	return true;
-}
-
 /* DisplayPort has only two frequencies, 162MHz and 270MHz */
 static bool
 intel_find_pll_g4x_dp(const intel_limit_t *limit, struct drm_crtc *crtc,
@@ -949,7 +875,7 @@ void
 intel_wait_for_vblank(struct drm_device *dev)
 {
 	/* Wait for 20ms, i.e. one cycle at 50hz. */
-	mdelay(20);
+	msleep(20);
 }
 
 /* Parameters have changed, update FBC info */
@@ -994,7 +920,7 @@ static void i8xx_enable_fbc(struct drm_crtc *crtc, unsigned long interval)
 		fbc_ctl |= dev_priv->cfb_fence;
 	I915_WRITE(FBC_CONTROL, fbc_ctl);
 
-	DRM_DEBUG("enabled FBC, pitch %ld, yoff %d, plane %d, ",
+	DRM_DEBUG_KMS("enabled FBC, pitch %ld, yoff %d, plane %d, ",
 		  dev_priv->cfb_pitch, crtc->y, dev_priv->cfb_plane);
 }
 
@@ -1017,7 +943,7 @@ void i8xx_disable_fbc(struct drm_device *dev)
 
 	intel_wait_for_vblank(dev);
 
-	DRM_DEBUG("disabled FBC\n");
+	DRM_DEBUG_KMS("disabled FBC\n");
 }
 
 static bool i8xx_fbc_enabled(struct drm_crtc *crtc)
@@ -1062,7 +988,7 @@ static void g4x_enable_fbc(struct drm_crtc *crtc, unsigned long interval)
 	/* enable it... */
 	I915_WRITE(DPFC_CONTROL, I915_READ(DPFC_CONTROL) | DPFC_CTL_EN);
 
-	DRM_DEBUG("enabled fbc on plane %d\n", intel_crtc->plane);
+	DRM_DEBUG_KMS("enabled fbc on plane %d\n", intel_crtc->plane);
 }
 
 void g4x_disable_fbc(struct drm_device *dev)
@@ -1076,7 +1002,7 @@ void g4x_disable_fbc(struct drm_device *dev)
 	I915_WRITE(DPFC_CONTROL, dpfc_ctl);
 	intel_wait_for_vblank(dev);
 
-	DRM_DEBUG("disabled FBC\n");
+	DRM_DEBUG_KMS("disabled FBC\n");
 }
 
 static bool g4x_fbc_enabled(struct drm_crtc *crtc)
@@ -1141,25 +1067,27 @@ static void intel_update_fbc(struct drm_crtc *crtc,
 	 *   - going to an unsupported config (interlace, pixel multiply, etc.)
 	 */
 	if (intel_fb->obj->size > dev_priv->cfb_size) {
-		DRM_DEBUG("framebuffer too large, disabling compression\n");
+		DRM_DEBUG_KMS("framebuffer too large, disabling "
+				"compression\n");
 		goto out_disable;
 	}
 	if ((mode->flags & DRM_MODE_FLAG_INTERLACE) ||
 	    (mode->flags & DRM_MODE_FLAG_DBLSCAN)) {
-		DRM_DEBUG("mode incompatible with compression, disabling\n");
+		DRM_DEBUG_KMS("mode incompatible with compression, "
+				"disabling\n");
 		goto out_disable;
 	}
 	if ((mode->hdisplay > 2048) ||
 	    (mode->vdisplay > 1536)) {
-		DRM_DEBUG("mode too large for compression, disabling\n");
+		DRM_DEBUG_KMS("mode too large for compression, disabling\n");
 		goto out_disable;
 	}
 	if ((IS_I915GM(dev) || IS_I945GM(dev)) && plane != 0) {
-		DRM_DEBUG("plane not 0, disabling compression\n");
+		DRM_DEBUG_KMS("plane not 0, disabling compression\n");
 		goto out_disable;
 	}
 	if (obj_priv->tiling_mode != I915_TILING_X) {
-		DRM_DEBUG("framebuffer not tiled, disabling compression\n");
+		DRM_DEBUG_KMS("framebuffer not tiled, disabling compression\n");
 		goto out_disable;
 	}
 
@@ -1181,13 +1109,57 @@ static void intel_update_fbc(struct drm_crtc *crtc,
 	return;
 
 out_disable:
-	DRM_DEBUG("unsupported config, disabling FBC\n");
+	DRM_DEBUG_KMS("unsupported config, disabling FBC\n");
 	/* Multiple disables should be harmless */
 	if (dev_priv->display.fbc_enabled(crtc))
 		dev_priv->display.disable_fbc(dev);
 }
 
 static int
+intel_pin_and_fence_fb_obj(struct drm_device *dev, struct drm_gem_object *obj)
+{
+	struct drm_i915_gem_object *obj_priv = obj->driver_private;
+	u32 alignment;
+	int ret;
+
+	switch (obj_priv->tiling_mode) {
+	case I915_TILING_NONE:
+		alignment = 64 * 1024;
+		break;
+	case I915_TILING_X:
+		/* pin() will align the object as required by fence */
+		alignment = 0;
+		break;
+	case I915_TILING_Y:
+		/* FIXME: Is this true? */
+		DRM_ERROR("Y tiled not allowed for scan out buffers\n");
+		return -EINVAL;
+	default:
+		BUG();
+	}
+
+	ret = i915_gem_object_pin(obj, alignment);
+	if (ret != 0)
+		return ret;
+
+	/* Install a fence for tiled scan-out. Pre-i965 always needs a
+	 * fence, whereas 965+ only requires a fence if using
+	 * framebuffer compression.  For simplicity, we always install
+	 * a fence as the cost is not that onerous.
+	 */
+	if (obj_priv->fence_reg == I915_FENCE_REG_NONE &&
+	    obj_priv->tiling_mode != I915_TILING_NONE) {
+		ret = i915_gem_object_get_fence_reg(obj);
+		if (ret != 0) {
+			i915_gem_object_unpin(obj);
+			return ret;
+		}
+	}
+
+	return 0;
+}
+
+static int
 intel_pipe_set_base(struct drm_crtc *crtc, int x, int y,
 		    struct drm_framebuffer *old_fb)
 {
@@ -1206,12 +1178,12 @@ intel_pipe_set_base(struct drm_crtc *crtc, int x, int y,
 	int dspstride = (plane == 0) ? DSPASTRIDE : DSPBSTRIDE;
 	int dsptileoff = (plane == 0 ? DSPATILEOFF : DSPBTILEOFF);
 	int dspcntr_reg = (plane == 0) ? DSPACNTR : DSPBCNTR;
-	u32 dspcntr, alignment;
+	u32 dspcntr;
 	int ret;
 
 	/* no fb bound */
 	if (!crtc->fb) {
-		DRM_DEBUG("No FB bound\n");
+		DRM_DEBUG_KMS("No FB bound\n");
 		return 0;
 	}
 
@@ -1228,50 +1200,20 @@ intel_pipe_set_base(struct drm_crtc *crtc, int x, int y,
 	obj = intel_fb->obj;
 	obj_priv = obj->driver_private;
 
-	switch (obj_priv->tiling_mode) {
-	case I915_TILING_NONE:
-		alignment = 64 * 1024;
-		break;
-	case I915_TILING_X:
-		/* pin() will align the object as required by fence */
-		alignment = 0;
-		break;
-	case I915_TILING_Y:
-		/* FIXME: Is this true? */
-		DRM_ERROR("Y tiled not allowed for scan out buffers\n");
-		return -EINVAL;
-	default:
-		BUG();
-	}
-
 	mutex_lock(&dev->struct_mutex);
-	ret = i915_gem_object_pin(obj, alignment);
+	ret = intel_pin_and_fence_fb_obj(dev, obj);
 	if (ret != 0) {
 		mutex_unlock(&dev->struct_mutex);
 		return ret;
 	}
 
-	ret = i915_gem_object_set_to_gtt_domain(obj, 1);
+	ret = i915_gem_object_set_to_display_plane(obj);
 	if (ret != 0) {
 		i915_gem_object_unpin(obj);
 		mutex_unlock(&dev->struct_mutex);
 		return ret;
 	}
 
-	/* Install a fence for tiled scan-out. Pre-i965 always needs a fence,
-	 * whereas 965+ only requires a fence if using framebuffer compression.
-	 * For simplicity, we always install a fence as the cost is not that onerous.
-	 */
-	if (obj_priv->fence_reg == I915_FENCE_REG_NONE &&
-	    obj_priv->tiling_mode != I915_TILING_NONE) {
-		ret = i915_gem_object_get_fence_reg(obj);
-		if (ret != 0) {
-			i915_gem_object_unpin(obj);
-			mutex_unlock(&dev->struct_mutex);
-			return ret;
-		}
-	}
-
 	dspcntr = I915_READ(dspcntr_reg);
 	/* Mask out pixel format bits in case we change it */
 	dspcntr &= ~DISPPLANE_PIXFORMAT_MASK;
@@ -1287,7 +1229,10 @@ intel_pipe_set_base(struct drm_crtc *crtc, int x, int y,
 		break;
 	case 24:
 	case 32:
-		dspcntr |= DISPPLANE_32BPP_NO_ALPHA;
+		if (crtc->fb->depth == 30)
+			dspcntr |= DISPPLANE_32BPP_30BIT_NO_ALPHA;
+		else
+			dspcntr |= DISPPLANE_32BPP_NO_ALPHA;
 		break;
 	default:
 		DRM_ERROR("Unknown color depth\n");
@@ -1302,7 +1247,7 @@ intel_pipe_set_base(struct drm_crtc *crtc, int x, int y,
 			dspcntr &= ~DISPPLANE_TILED;
 	}
 
-	if (IS_IGDNG(dev))
+	if (IS_IRONLAKE(dev))
 		/* must disable */
 		dspcntr |= DISPPLANE_TRICKLE_FEED_DISABLE;
 
@@ -1311,7 +1256,7 @@ intel_pipe_set_base(struct drm_crtc *crtc, int x, int y,
 	Start = obj_priv->gtt_offset;
 	Offset = y * crtc->fb->pitch + x * (crtc->fb->bits_per_pixel / 8);
 
-	DRM_DEBUG("Writing base %08lX %08lX %d %d\n", Start, Offset, x, y);
+	DRM_DEBUG_KMS("Writing base %08lX %08lX %d %d\n", Start, Offset, x, y);
 	I915_WRITE(dspstride, crtc->fb->pitch);
 	if (IS_I965G(dev)) {
 		I915_WRITE(dspbase, Offset);
@@ -1363,7 +1308,7 @@ static void i915_disable_vga (struct drm_device *dev)
 	u8 sr1;
 	u32 vga_reg;
 
-	if (IS_IGDNG(dev))
+	if (IS_IRONLAKE(dev))
 		vga_reg = CPU_VGACNTRL;
 	else
 		vga_reg = VGACNTRL;
@@ -1379,19 +1324,19 @@ static void i915_disable_vga (struct drm_device *dev)
 	I915_WRITE(vga_reg, VGA_DISP_DISABLE);
 }
 
-static void igdng_disable_pll_edp (struct drm_crtc *crtc)
+static void ironlake_disable_pll_edp (struct drm_crtc *crtc)
 {
 	struct drm_device *dev = crtc->dev;
 	struct drm_i915_private *dev_priv = dev->dev_private;
 	u32 dpa_ctl;
 
-	DRM_DEBUG("\n");
+	DRM_DEBUG_KMS("\n");
 	dpa_ctl = I915_READ(DP_A);
 	dpa_ctl &= ~DP_PLL_ENABLE;
 	I915_WRITE(DP_A, dpa_ctl);
 }
 
-static void igdng_enable_pll_edp (struct drm_crtc *crtc)
+static void ironlake_enable_pll_edp (struct drm_crtc *crtc)
 {
 	struct drm_device *dev = crtc->dev;
 	struct drm_i915_private *dev_priv = dev->dev_private;
@@ -1404,13 +1349,13 @@ static void igdng_enable_pll_edp (struct drm_crtc *crtc)
 }
 
 
-static void igdng_set_pll_edp (struct drm_crtc *crtc, int clock)
+static void ironlake_set_pll_edp (struct drm_crtc *crtc, int clock)
 {
 	struct drm_device *dev = crtc->dev;
 	struct drm_i915_private *dev_priv = dev->dev_private;
 	u32 dpa_ctl;
 
-	DRM_DEBUG("eDP PLL enable for clock %d\n", clock);
+	DRM_DEBUG_KMS("eDP PLL enable for clock %d\n", clock);
 	dpa_ctl = I915_READ(DP_A);
 	dpa_ctl &= ~DP_PLL_FREQ_MASK;
 
@@ -1440,7 +1385,7 @@ static void igdng_set_pll_edp (struct drm_crtc *crtc, int clock)
 	udelay(500);
 }
 
-static void igdng_crtc_dpms(struct drm_crtc *crtc, int mode)
+static void ironlake_crtc_dpms(struct drm_crtc *crtc, int mode)
 {
 	struct drm_device *dev = crtc->dev;
 	struct drm_i915_private *dev_priv = dev->dev_private;
@@ -1473,6 +1418,10 @@ static void igdng_crtc_dpms(struct drm_crtc *crtc, int mode)
 	int trans_vsync_reg = (pipe == 0) ? TRANS_VSYNC_A : TRANS_VSYNC_B;
 	u32 temp;
 	int tries = 5, j, n;
+	u32 pipe_bpc;
+
+	temp = I915_READ(pipeconf_reg);
+	pipe_bpc = temp & PIPE_BPC_MASK;
 
 	/* XXX: When our outputs are all unaware of DPMS modes other than off
 	 * and on, we should map those modes to DRM_MODE_DPMS_OFF in the CRTC.
@@ -1481,10 +1430,19 @@ static void igdng_crtc_dpms(struct drm_crtc *crtc, int mode)
 	case DRM_MODE_DPMS_ON:
 	case DRM_MODE_DPMS_STANDBY:
 	case DRM_MODE_DPMS_SUSPEND:
-		DRM_DEBUG("crtc %d dpms on\n", pipe);
+		DRM_DEBUG_KMS("crtc %d dpms on\n", pipe);
+
+		if (intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS)) {
+			temp = I915_READ(PCH_LVDS);
+			if ((temp & LVDS_PORT_EN) == 0) {
+				I915_WRITE(PCH_LVDS, temp | LVDS_PORT_EN);
+				POSTING_READ(PCH_LVDS);
+			}
+		}
+
 		if (HAS_eDP) {
 			/* enable eDP PLL */
-			igdng_enable_pll_edp(crtc);
+			ironlake_enable_pll_edp(crtc);
 		} else {
 			/* enable PCH DPLL */
 			temp = I915_READ(pch_dpll_reg);
@@ -1495,13 +1453,19 @@ static void igdng_crtc_dpms(struct drm_crtc *crtc, int mode)
 
 			/* enable PCH FDI RX PLL, wait warmup plus DMI latency */
 			temp = I915_READ(fdi_rx_reg);
+			/*
+			 * make the BPC in FDI Rx be consistent with that in
+			 * pipeconf reg.
+			 */
+			temp &= ~(0x7 << 16);
+			temp |= (pipe_bpc << 11);
 			I915_WRITE(fdi_rx_reg, temp | FDI_RX_PLL_ENABLE |
 					FDI_SEL_PCDCLK |
 					FDI_DP_PORT_WIDTH_X4); /* default 4 lanes */
 			I915_READ(fdi_rx_reg);
 			udelay(200);
 
-			/* Enable CPU FDI TX PLL, always on for IGDNG */
+			/* Enable CPU FDI TX PLL, always on for Ironlake */
 			temp = I915_READ(fdi_tx_reg);
 			if ((temp & FDI_TX_PLL_ENABLE) == 0) {
 				I915_WRITE(fdi_tx_reg, temp | FDI_TX_PLL_ENABLE);
@@ -1568,12 +1532,13 @@ static void igdng_crtc_dpms(struct drm_crtc *crtc, int mode)
 			udelay(150);
 
 			temp = I915_READ(fdi_rx_iir_reg);
-			DRM_DEBUG("FDI_RX_IIR 0x%x\n", temp);
+			DRM_DEBUG_KMS("FDI_RX_IIR 0x%x\n", temp);
 
 			if ((temp & FDI_RX_BIT_LOCK) == 0) {
 				for (j = 0; j < tries; j++) {
 					temp = I915_READ(fdi_rx_iir_reg);
-					DRM_DEBUG("FDI_RX_IIR 0x%x\n", temp);
+					DRM_DEBUG_KMS("FDI_RX_IIR 0x%x\n",
+								temp);
 					if (temp & FDI_RX_BIT_LOCK)
 						break;
 					udelay(200);
@@ -1582,11 +1547,11 @@ static void igdng_crtc_dpms(struct drm_crtc *crtc, int mode)
 					I915_WRITE(fdi_rx_iir_reg,
 							temp | FDI_RX_BIT_LOCK);
 				else
-					DRM_DEBUG("train 1 fail\n");
+					DRM_DEBUG_KMS("train 1 fail\n");
 			} else {
 				I915_WRITE(fdi_rx_iir_reg,
 						temp | FDI_RX_BIT_LOCK);
-				DRM_DEBUG("train 1 ok 2!\n");
+				DRM_DEBUG_KMS("train 1 ok 2!\n");
 			}
 			temp = I915_READ(fdi_tx_reg);
 			temp &= ~FDI_LINK_TRAIN_NONE;
@@ -1601,12 +1566,13 @@ static void igdng_crtc_dpms(struct drm_crtc *crtc, int mode)
 			udelay(150);
 
 			temp = I915_READ(fdi_rx_iir_reg);
-			DRM_DEBUG("FDI_RX_IIR 0x%x\n", temp);
+			DRM_DEBUG_KMS("FDI_RX_IIR 0x%x\n", temp);
 
 			if ((temp & FDI_RX_SYMBOL_LOCK) == 0) {
 				for (j = 0; j < tries; j++) {
 					temp = I915_READ(fdi_rx_iir_reg);
-					DRM_DEBUG("FDI_RX_IIR 0x%x\n", temp);
+					DRM_DEBUG_KMS("FDI_RX_IIR 0x%x\n",
+								temp);
 					if (temp & FDI_RX_SYMBOL_LOCK)
 						break;
 					udelay(200);
@@ -1614,15 +1580,15 @@ static void igdng_crtc_dpms(struct drm_crtc *crtc, int mode)
 				if (j != tries) {
 					I915_WRITE(fdi_rx_iir_reg,
 							temp | FDI_RX_SYMBOL_LOCK);
-					DRM_DEBUG("train 2 ok 1!\n");
+					DRM_DEBUG_KMS("train 2 ok 1!\n");
 				} else
-					DRM_DEBUG("train 2 fail\n");
+					DRM_DEBUG_KMS("train 2 fail\n");
 			} else {
 				I915_WRITE(fdi_rx_iir_reg,
 						temp | FDI_RX_SYMBOL_LOCK);
-				DRM_DEBUG("train 2 ok 2!\n");
+				DRM_DEBUG_KMS("train 2 ok 2!\n");
 			}
-			DRM_DEBUG("train done\n");
+			DRM_DEBUG_KMS("train done\n");
 
 			/* set transcoder timing */
 			I915_WRITE(trans_htot_reg, I915_READ(cpu_htot_reg));
@@ -1635,6 +1601,12 @@ static void igdng_crtc_dpms(struct drm_crtc *crtc, int mode)
 
 			/* enable PCH transcoder */
 			temp = I915_READ(transconf_reg);
+			/*
+			 * make the BPC in transcoder be consistent with
+			 * that in pipeconf reg.
+			 */
+			temp &= ~PIPE_BPC_MASK;
+			temp |= pipe_bpc;
 			I915_WRITE(transconf_reg, temp | TRANS_ENABLE);
 			I915_READ(transconf_reg);
 
@@ -1664,9 +1636,7 @@ static void igdng_crtc_dpms(struct drm_crtc *crtc, int mode)
 
 	break;
 	case DRM_MODE_DPMS_OFF:
-		DRM_DEBUG("crtc %d dpms off\n", pipe);
-
-		i915_disable_vga(dev);
+		DRM_DEBUG_KMS("crtc %d dpms off\n", pipe);
 
 		/* Disable display plane */
 		temp = I915_READ(dspcntr_reg);
@@ -1677,6 +1647,8 @@ static void igdng_crtc_dpms(struct drm_crtc *crtc, int mode)
 			I915_READ(dspbase_reg);
 		}
 
+		i915_disable_vga(dev);
+
 		/* disable cpu pipe, disable after all planes disabled */
 		temp = I915_READ(pipeconf_reg);
 		if ((temp & PIPEACONF_ENABLE) != 0) {
@@ -1690,16 +1662,23 @@ static void igdng_crtc_dpms(struct drm_crtc *crtc, int mode)
 					udelay(500);
 					continue;
 				} else {
-					DRM_DEBUG("pipe %d off delay\n", pipe);
+					DRM_DEBUG_KMS("pipe %d off delay\n",
+								pipe);
 					break;
 				}
 			}
 		} else
-			DRM_DEBUG("crtc %d is disabled\n", pipe);
+			DRM_DEBUG_KMS("crtc %d is disabled\n", pipe);
 
-		if (HAS_eDP) {
-			igdng_disable_pll_edp(crtc);
+		udelay(100);
+
+		/* Disable PF */
+		temp = I915_READ(pf_ctl_reg);
+		if ((temp & PF_ENABLE) != 0) {
+			I915_WRITE(pf_ctl_reg, temp & ~PF_ENABLE);
+			I915_READ(pf_ctl_reg);
 		}
+		I915_WRITE(pf_win_size, 0);
 
 		/* disable CPU FDI tx and PCH FDI rx */
 		temp = I915_READ(fdi_tx_reg);
@@ -1707,6 +1686,9 @@ static void igdng_crtc_dpms(struct drm_crtc *crtc, int mode)
 		I915_READ(fdi_tx_reg);
 
 		temp = I915_READ(fdi_rx_reg);
+		/* BPC in FDI rx is consistent with that in pipeconf */
+		temp &= ~(0x07 << 16);
+		temp |= (pipe_bpc << 11);
 		I915_WRITE(fdi_rx_reg, temp & ~FDI_RX_ENABLE);
 		I915_READ(fdi_rx_reg);
 
@@ -1725,6 +1707,13 @@ static void igdng_crtc_dpms(struct drm_crtc *crtc, int mode)
 
 		udelay(100);
 
+		if (intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS)) {
+			temp = I915_READ(PCH_LVDS);
+			I915_WRITE(PCH_LVDS, temp & ~LVDS_PORT_EN);
+			I915_READ(PCH_LVDS);
+			udelay(100);
+		}
+
 		/* disable PCH transcoder */
 		temp = I915_READ(transconf_reg);
 		if ((temp & TRANS_ENABLE) != 0) {
@@ -1738,11 +1727,19 @@ static void igdng_crtc_dpms(struct drm_crtc *crtc, int mode)
 					udelay(500);
 					continue;
 				} else {
-					DRM_DEBUG("transcoder %d off delay\n", pipe);
+					DRM_DEBUG_KMS("transcoder %d off "
+							"delay\n", pipe);
 					break;
 				}
 			}
 		}
+		temp = I915_READ(transconf_reg);
+		/* BPC in transcoder is consistent with that in pipeconf */
+		temp &= ~PIPE_BPC_MASK;
+		temp |= pipe_bpc;
+		I915_WRITE(transconf_reg, temp);
+		I915_READ(transconf_reg);
+		udelay(100);
 
 		/* disable PCH DPLL */
 		temp = I915_READ(pch_dpll_reg);
@@ -1751,14 +1748,20 @@ static void igdng_crtc_dpms(struct drm_crtc *crtc, int mode)
 			I915_READ(pch_dpll_reg);
 		}
 
-		temp = I915_READ(fdi_rx_reg);
-		if ((temp & FDI_RX_PLL_ENABLE) != 0) {
-			temp &= ~FDI_SEL_PCDCLK;
-			temp &= ~FDI_RX_PLL_ENABLE;
-			I915_WRITE(fdi_rx_reg, temp);
-			I915_READ(fdi_rx_reg);
+		if (HAS_eDP) {
+			ironlake_disable_pll_edp(crtc);
 		}
 
+		temp = I915_READ(fdi_rx_reg);
+		temp &= ~FDI_SEL_PCDCLK;
+		I915_WRITE(fdi_rx_reg, temp);
+		I915_READ(fdi_rx_reg);
+
+		temp = I915_READ(fdi_rx_reg);
+		temp &= ~FDI_RX_PLL_ENABLE;
+		I915_WRITE(fdi_rx_reg, temp);
+		I915_READ(fdi_rx_reg);
+
 		/* Disable CPU FDI TX PLL */
 		temp = I915_READ(fdi_tx_reg);
 		if ((temp & FDI_TX_PLL_ENABLE) != 0) {
@@ -1767,20 +1770,43 @@ static void igdng_crtc_dpms(struct drm_crtc *crtc, int mode)
 			udelay(100);
 		}
 
-		/* Disable PF */
-		temp = I915_READ(pf_ctl_reg);
-		if ((temp & PF_ENABLE) != 0) {
-			I915_WRITE(pf_ctl_reg, temp & ~PF_ENABLE);
-			I915_READ(pf_ctl_reg);
-		}
-		I915_WRITE(pf_win_size, 0);
-
 		/* Wait for the clocks to turn off. */
-		udelay(150);
+		udelay(100);
 		break;
 	}
 }
 
+static void intel_crtc_dpms_overlay(struct intel_crtc *intel_crtc, bool enable)
+{
+	struct intel_overlay *overlay;
+	int ret;
+
+	if (!enable && intel_crtc->overlay) {
+		overlay = intel_crtc->overlay;
+		mutex_lock(&overlay->dev->struct_mutex);
+		for (;;) {
+			ret = intel_overlay_switch_off(overlay);
+			if (ret == 0)
+				break;
+
+			ret = intel_overlay_recover_from_interrupt(overlay, 0);
+			if (ret != 0) {
+				/* overlay doesn't react anymore. Usually
+				 * results in a black screen and an unkillable
+				 * X server. */
+				BUG();
+				overlay->hw_wedged = HW_WEDGED;
+				break;
+			}
+		}
+		mutex_unlock(&overlay->dev->struct_mutex);
+	}
+	/* Let userspace switch the overlay on again. In most cases userspace
+	 * has to recompute where to put it anyway. */
+
+	return;
+}
+
 static void i9xx_crtc_dpms(struct drm_crtc *crtc, int mode)
 {
 	struct drm_device *dev = crtc->dev;
@@ -1839,12 +1865,14 @@ static void i9xx_crtc_dpms(struct drm_crtc *crtc, int mode)
 			intel_update_fbc(crtc, &crtc->mode);
 
 		/* Give the overlay scaler a chance to enable if it's on this pipe */
-		//intel_crtc_dpms_video(crtc, true); TODO
+		intel_crtc_dpms_overlay(intel_crtc, true);
 	break;
 	case DRM_MODE_DPMS_OFF:
 		intel_update_watermarks(dev);
+
 		/* Give the overlay scaler a chance to disable if it's on this pipe */
-		//intel_crtc_dpms_video(crtc, FALSE); TODO
+		intel_crtc_dpms_overlay(intel_crtc, false);
+		drm_vblank_off(dev, pipe);
 
 		if (dev_priv->cfb_plane == plane &&
 		    dev_priv->display.disable_fbc)
@@ -1963,7 +1991,7 @@ static bool intel_crtc_mode_fixup(struct drm_crtc *crtc,
 				  struct drm_display_mode *adjusted_mode)
 {
 	struct drm_device *dev = crtc->dev;
-	if (IS_IGDNG(dev)) {
+	if (IS_IRONLAKE(dev)) {
 		/* FDI link clock is fixed at 2.7G */
 		if (mode->clock * 3 > 27000 * 4)
 			return MODE_CLOCK_HIGH;
@@ -2039,7 +2067,7 @@ static int i830_get_display_clock_speed(struct drm_device *dev)
  * Return the pipe currently connected to the panel fitter,
  * or -1 if the panel fitter is not present or not in use
  */
-static int intel_panel_fitter_pipe (struct drm_device *dev)
+int intel_panel_fitter_pipe (struct drm_device *dev)
 {
 	struct drm_i915_private *dev_priv = dev->dev_private;
 	u32  pfit_control;
@@ -2083,9 +2111,8 @@ fdi_reduce_ratio(u32 *num, u32 *den)
 #define LINK_N 0x80000
 
 static void
-igdng_compute_m_n(int bits_per_pixel, int nlanes,
-		int pixel_clock, int link_clock,
-		struct fdi_m_n *m_n)
+ironlake_compute_m_n(int bits_per_pixel, int nlanes, int pixel_clock,
+		     int link_clock, struct fdi_m_n *m_n)
 {
 	u64 temp;
 
@@ -2113,34 +2140,34 @@ struct intel_watermark_params {
 	unsigned long cacheline_size;
 };
 
-/* IGD has different values for various configs */
-static struct intel_watermark_params igd_display_wm = {
-	IGD_DISPLAY_FIFO,
-	IGD_MAX_WM,
-	IGD_DFT_WM,
-	IGD_GUARD_WM,
-	IGD_FIFO_LINE_SIZE
+/* Pineview has different values for various configs */
+static struct intel_watermark_params pineview_display_wm = {
+	PINEVIEW_DISPLAY_FIFO,
+	PINEVIEW_MAX_WM,
+	PINEVIEW_DFT_WM,
+	PINEVIEW_GUARD_WM,
+	PINEVIEW_FIFO_LINE_SIZE
 };
-static struct intel_watermark_params igd_display_hplloff_wm = {
-	IGD_DISPLAY_FIFO,
-	IGD_MAX_WM,
-	IGD_DFT_HPLLOFF_WM,
-	IGD_GUARD_WM,
-	IGD_FIFO_LINE_SIZE
+static struct intel_watermark_params pineview_display_hplloff_wm = {
+	PINEVIEW_DISPLAY_FIFO,
+	PINEVIEW_MAX_WM,
+	PINEVIEW_DFT_HPLLOFF_WM,
+	PINEVIEW_GUARD_WM,
+	PINEVIEW_FIFO_LINE_SIZE
 };
-static struct intel_watermark_params igd_cursor_wm = {
-	IGD_CURSOR_FIFO,
-	IGD_CURSOR_MAX_WM,
-	IGD_CURSOR_DFT_WM,
-	IGD_CURSOR_GUARD_WM,
-	IGD_FIFO_LINE_SIZE,
+static struct intel_watermark_params pineview_cursor_wm = {
+	PINEVIEW_CURSOR_FIFO,
+	PINEVIEW_CURSOR_MAX_WM,
+	PINEVIEW_CURSOR_DFT_WM,
+	PINEVIEW_CURSOR_GUARD_WM,
+	PINEVIEW_FIFO_LINE_SIZE,
 };
-static struct intel_watermark_params igd_cursor_hplloff_wm = {
-	IGD_CURSOR_FIFO,
-	IGD_CURSOR_MAX_WM,
-	IGD_CURSOR_DFT_WM,
-	IGD_CURSOR_GUARD_WM,
-	IGD_FIFO_LINE_SIZE
+static struct intel_watermark_params pineview_cursor_hplloff_wm = {
+	PINEVIEW_CURSOR_FIFO,
+	PINEVIEW_CURSOR_MAX_WM,
+	PINEVIEW_CURSOR_DFT_WM,
+	PINEVIEW_CURSOR_GUARD_WM,
+	PINEVIEW_FIFO_LINE_SIZE
 };
 static struct intel_watermark_params g4x_wm_info = {
 	G4X_FIFO_SIZE,
@@ -2213,11 +2240,11 @@ static unsigned long intel_calculate_wm(unsigned long clock_in_khz,
 		1000;
 	entries_required /= wm->cacheline_size;
 
-	DRM_DEBUG("FIFO entries required for mode: %d\n", entries_required);
+	DRM_DEBUG_KMS("FIFO entries required for mode: %d\n", entries_required);
 
 	wm_size = wm->fifo_size - (entries_required + wm->guard_size);
 
-	DRM_DEBUG("FIFO watermark level: %d\n", wm_size);
+	DRM_DEBUG_KMS("FIFO watermark level: %d\n", wm_size);
 
 	/* Don't promote wm_size to unsigned... */
 	if (wm_size > (long)wm->max_wm)
@@ -2279,50 +2306,50 @@ static struct cxsr_latency *intel_get_cxsr_latency(int is_desktop, int fsb,
 			return latency;
 	}
 
-	DRM_DEBUG("Unknown FSB/MEM found, disable CxSR\n");
+	DRM_DEBUG_KMS("Unknown FSB/MEM found, disable CxSR\n");
 
 	return NULL;
 }
 
-static void igd_disable_cxsr(struct drm_device *dev)
+static void pineview_disable_cxsr(struct drm_device *dev)
 {
 	struct drm_i915_private *dev_priv = dev->dev_private;
 	u32 reg;
 
 	/* deactivate cxsr */
 	reg = I915_READ(DSPFW3);
-	reg &= ~(IGD_SELF_REFRESH_EN);
+	reg &= ~(PINEVIEW_SELF_REFRESH_EN);
 	I915_WRITE(DSPFW3, reg);
 	DRM_INFO("Big FIFO is disabled\n");
 }
 
-static void igd_enable_cxsr(struct drm_device *dev, unsigned long clock,
-			    int pixel_size)
+static void pineview_enable_cxsr(struct drm_device *dev, unsigned long clock,
+				 int pixel_size)
 {
 	struct drm_i915_private *dev_priv = dev->dev_private;
 	u32 reg;
 	unsigned long wm;
 	struct cxsr_latency *latency;
 
-	latency = intel_get_cxsr_latency(IS_IGDG(dev), dev_priv->fsb_freq,
+	latency = intel_get_cxsr_latency(IS_PINEVIEW_G(dev), dev_priv->fsb_freq,
 		dev_priv->mem_freq);
 	if (!latency) {
-		DRM_DEBUG("Unknown FSB/MEM found, disable CxSR\n");
-		igd_disable_cxsr(dev);
+		DRM_DEBUG_KMS("Unknown FSB/MEM found, disable CxSR\n");
+		pineview_disable_cxsr(dev);
 		return;
 	}
 
 	/* Display SR */
-	wm = intel_calculate_wm(clock, &igd_display_wm, pixel_size,
+	wm = intel_calculate_wm(clock, &pineview_display_wm, pixel_size,
 				latency->display_sr);
 	reg = I915_READ(DSPFW1);
 	reg &= 0x7fffff;
 	reg |= wm << 23;
 	I915_WRITE(DSPFW1, reg);
-	DRM_DEBUG("DSPFW1 register is %x\n", reg);
+	DRM_DEBUG_KMS("DSPFW1 register is %x\n", reg);
 
 	/* cursor SR */
-	wm = intel_calculate_wm(clock, &igd_cursor_wm, pixel_size,
+	wm = intel_calculate_wm(clock, &pineview_cursor_wm, pixel_size,
 				latency->cursor_sr);
 	reg = I915_READ(DSPFW3);
 	reg &= ~(0x3f << 24);
@@ -2330,7 +2357,7 @@ static void igd_enable_cxsr(struct drm_device *dev, unsigned long clock,
 	I915_WRITE(DSPFW3, reg);
 
 	/* Display HPLL off SR */
-	wm = intel_calculate_wm(clock, &igd_display_hplloff_wm,
+	wm = intel_calculate_wm(clock, &pineview_display_hplloff_wm,
 		latency->display_hpll_disable, I915_FIFO_LINE_SIZE);
 	reg = I915_READ(DSPFW3);
 	reg &= 0xfffffe00;
@@ -2338,17 +2365,17 @@ static void igd_enable_cxsr(struct drm_device *dev, unsigned long clock,
 	I915_WRITE(DSPFW3, reg);
 
 	/* cursor HPLL off SR */
-	wm = intel_calculate_wm(clock, &igd_cursor_hplloff_wm, pixel_size,
+	wm = intel_calculate_wm(clock, &pineview_cursor_hplloff_wm, pixel_size,
 				latency->cursor_hpll_disable);
 	reg = I915_READ(DSPFW3);
 	reg &= ~(0x3f << 16);
 	reg |= (wm & 0x3f) << 16;
 	I915_WRITE(DSPFW3, reg);
-	DRM_DEBUG("DSPFW3 register is %x\n", reg);
+	DRM_DEBUG_KMS("DSPFW3 register is %x\n", reg);
 
 	/* activate cxsr */
 	reg = I915_READ(DSPFW3);
-	reg |= IGD_SELF_REFRESH_EN;
+	reg |= PINEVIEW_SELF_REFRESH_EN;
 	I915_WRITE(DSPFW3, reg);
 
 	DRM_INFO("Big FIFO is enabled\n");
@@ -2370,7 +2397,7 @@ static void igd_enable_cxsr(struct drm_device *dev, unsigned long clock,
  * A value of 5us seems to be a good balance; safe for very low end
  * platforms but not overly aggressive on lower latency configs.
  */
-const static int latency_ns = 5000;
+static const int latency_ns = 5000;
 
 static int i9xx_get_fifo_size(struct drm_device *dev, int plane)
 {
@@ -2384,8 +2411,8 @@ static int i9xx_get_fifo_size(struct drm_device *dev, int plane)
 		size = ((dsparb >> DSPARB_CSTART_SHIFT) & 0x7f) -
 			(dsparb & 0x7f);
 
-	DRM_DEBUG("FIFO size - (0x%08x) %s: %d\n", dsparb, plane ? "B" : "A",
-		  size);
+	DRM_DEBUG_KMS("FIFO size - (0x%08x) %s: %d\n", dsparb,
+			plane ? "B" : "A", size);
 
 	return size;
 }
@@ -2403,8 +2430,8 @@ static int i85x_get_fifo_size(struct drm_device *dev, int plane)
 			(dsparb & 0x1ff);
 	size >>= 1; /* Convert to cachelines */
 
-	DRM_DEBUG("FIFO size - (0x%08x) %s: %d\n", dsparb, plane ? "B" : "A",
-		  size);
+	DRM_DEBUG_KMS("FIFO size - (0x%08x) %s: %d\n", dsparb,
+			plane ? "B" : "A", size);
 
 	return size;
 }
@@ -2418,7 +2445,8 @@ static int i845_get_fifo_size(struct drm_device *dev, int plane)
 	size = dsparb & 0x7f;
 	size >>= 2; /* Convert to cachelines */
 
-	DRM_DEBUG("FIFO size - (0x%08x) %s: %d\n", dsparb, plane ? "B" : "A",
+	DRM_DEBUG_KMS("FIFO size - (0x%08x) %s: %d\n", dsparb,
+			plane ? "B" : "A",
 		  size);
 
 	return size;
@@ -2433,8 +2461,8 @@ static int i830_get_fifo_size(struct drm_device *dev, int plane)
 	size = dsparb & 0x7f;
 	size >>= 1; /* Convert to cachelines */
 
-	DRM_DEBUG("FIFO size - (0x%08x) %s: %d\n", dsparb, plane ? "B" : "A",
-		  size);
+	DRM_DEBUG_KMS("FIFO size - (0x%08x) %s: %d\n", dsparb,
+			plane ? "B" : "A", size);
 
 	return size;
 }
@@ -2480,7 +2508,7 @@ static void g4x_update_wm(struct drm_device *dev,  int planea_clock,
 	/* Calc sr entries for one plane configs */
 	if (sr_hdisplay && (!planea_clock || !planeb_clock)) {
 		/* self-refresh has much higher latency */
-		const static int sr_latency_ns = 12000;
+		static const int sr_latency_ns = 12000;
 
 		sr_clock = planea_clock ? planea_clock : planeb_clock;
 		line_time_us = ((sr_hdisplay * 1000) / sr_clock);
@@ -2509,15 +2537,39 @@ static void g4x_update_wm(struct drm_device *dev,  int planea_clock,
 		   (cursor_sr << DSPFW_CURSOR_SR_SHIFT));
 }
 
-static void i965_update_wm(struct drm_device *dev, int unused, int unused2,
-			   int unused3, int unused4)
+static void i965_update_wm(struct drm_device *dev, int planea_clock,
+			   int planeb_clock, int sr_hdisplay, int pixel_size)
 {
 	struct drm_i915_private *dev_priv = dev->dev_private;
+	unsigned long line_time_us;
+	int sr_clock, sr_entries, srwm = 1;
+
+	/* Calc sr entries for one plane configs */
+	if (sr_hdisplay && (!planea_clock || !planeb_clock)) {
+		/* self-refresh has much higher latency */
+		static const int sr_latency_ns = 12000;
+
+		sr_clock = planea_clock ? planea_clock : planeb_clock;
+		line_time_us = ((sr_hdisplay * 1000) / sr_clock);
+
+		/* Use ns/us then divide to preserve precision */
+		sr_entries = (((sr_latency_ns / line_time_us) + 1) *
+			      pixel_size * sr_hdisplay) / 1000;
+		sr_entries = roundup(sr_entries / I915_FIFO_LINE_SIZE, 1);
+		DRM_DEBUG("self-refresh entries: %d\n", sr_entries);
+		srwm = I945_FIFO_SIZE - sr_entries;
+		if (srwm < 0)
+			srwm = 1;
+		srwm &= 0x3f;
+		I915_WRITE(FW_BLC_SELF, FW_BLC_SELF_EN);
+	}
 
-	DRM_DEBUG("Setting FIFO watermarks - A: 8, B: 8, C: 8, SR 8\n");
+	DRM_DEBUG_KMS("Setting FIFO watermarks - A: 8, B: 8, C: 8, SR %d\n",
+		      srwm);
 
 	/* 965 has limitations... */
-	I915_WRITE(DSPFW1, (8 << 16) | (8 << 8) | (8 << 0));
+	I915_WRITE(DSPFW1, (srwm << DSPFW_SR_SHIFT) | (8 << 16) | (8 << 8) |
+		   (8 << 0));
 	I915_WRITE(DSPFW2, (8 << 8) | (8 << 0));
 }
 
@@ -2553,7 +2605,7 @@ static void i9xx_update_wm(struct drm_device *dev, int planea_clock,
 				       pixel_size, latency_ns);
 	planeb_wm = intel_calculate_wm(planeb_clock, &planeb_params,
 				       pixel_size, latency_ns);
-	DRM_DEBUG("FIFO watermarks - A: %d, B: %d\n", planea_wm, planeb_wm);
+	DRM_DEBUG_KMS("FIFO watermarks - A: %d, B: %d\n", planea_wm, planeb_wm);
 
 	/*
 	 * Overlay gets an aggressive default since video jitter is bad.
@@ -2564,7 +2616,7 @@ static void i9xx_update_wm(struct drm_device *dev, int planea_clock,
 	if (HAS_FW_BLC(dev) && sr_hdisplay &&
 	    (!planea_clock || !planeb_clock)) {
 		/* self-refresh has much higher latency */
-		const static int sr_latency_ns = 6000;
+		static const int sr_latency_ns = 6000;
 
 		sr_clock = planea_clock ? planea_clock : planeb_clock;
 		line_time_us = ((sr_hdisplay * 1000) / sr_clock);
@@ -2573,14 +2625,14 @@ static void i9xx_update_wm(struct drm_device *dev, int planea_clock,
 		sr_entries = (((sr_latency_ns / line_time_us) + 1) *
 			      pixel_size * sr_hdisplay) / 1000;
 		sr_entries = roundup(sr_entries / cacheline_size, 1);
-		DRM_DEBUG("self-refresh entries: %d\n", sr_entries);
+		DRM_DEBUG_KMS("self-refresh entries: %d\n", sr_entries);
 		srwm = total_size - sr_entries;
 		if (srwm < 0)
 			srwm = 1;
 		I915_WRITE(FW_BLC_SELF, FW_BLC_SELF_EN | (srwm & 0x3f));
 	}
 
-	DRM_DEBUG("Setting FIFO watermarks - A: %d, B: %d, C: %d, SR %d\n",
+	DRM_DEBUG_KMS("Setting FIFO watermarks - A: %d, B: %d, C: %d, SR %d\n",
 		  planea_wm, planeb_wm, cwm, srwm);
 
 	fwater_lo = ((planeb_wm & 0x3f) << 16) | (planea_wm & 0x3f);
@@ -2607,7 +2659,7 @@ static void i830_update_wm(struct drm_device *dev, int planea_clock, int unused,
 				       pixel_size, latency_ns);
 	fwater_lo |= (3<<8) | planea_wm;
 
-	DRM_DEBUG("Setting FIFO watermarks - A: %d\n", planea_wm);
+	DRM_DEBUG_KMS("Setting FIFO watermarks - A: %d\n", planea_wm);
 
 	I915_WRITE(FW_BLC, fwater_lo);
 }
@@ -2661,11 +2713,11 @@ static void intel_update_watermarks(struct drm_device *dev)
 		if (crtc->enabled) {
 			enabled++;
 			if (intel_crtc->plane == 0) {
-				DRM_DEBUG("plane A (pipe %d) clock: %d\n",
+				DRM_DEBUG_KMS("plane A (pipe %d) clock: %d\n",
 					  intel_crtc->pipe, crtc->mode.clock);
 				planea_clock = crtc->mode.clock;
 			} else {
-				DRM_DEBUG("plane B (pipe %d) clock: %d\n",
+				DRM_DEBUG_KMS("plane B (pipe %d) clock: %d\n",
 					  intel_crtc->pipe, crtc->mode.clock);
 				planeb_clock = crtc->mode.clock;
 			}
@@ -2682,10 +2734,10 @@ static void intel_update_watermarks(struct drm_device *dev)
 		return;
 
 	/* Single plane configs can enable self refresh */
-	if (enabled == 1 && IS_IGD(dev))
-		igd_enable_cxsr(dev, sr_clock, pixel_size);
-	else if (IS_IGD(dev))
-		igd_disable_cxsr(dev);
+	if (enabled == 1 && IS_PINEVIEW(dev))
+		pineview_enable_cxsr(dev, sr_clock, pixel_size);
+	else if (IS_PINEVIEW(dev))
+		pineview_disable_cxsr(dev);
 
 	dev_priv->display.update_wm(dev, planea_clock, planeb_clock,
 				    sr_hdisplay, pixel_size);
@@ -2779,10 +2831,11 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
 
 	if (is_lvds && dev_priv->lvds_use_ssc && num_outputs < 2) {
 		refclk = dev_priv->lvds_ssc_freq * 1000;
-		DRM_DEBUG("using SSC reference clock of %d MHz\n", refclk / 1000);
+		DRM_DEBUG_KMS("using SSC reference clock of %d MHz\n",
+					refclk / 1000);
 	} else if (IS_I9XX(dev)) {
 		refclk = 96000;
-		if (IS_IGDNG(dev))
+		if (IS_IRONLAKE(dev))
 			refclk = 120000; /* 120Mhz refclk */
 	} else {
 		refclk = 48000;
@@ -2802,14 +2855,23 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
 		return -EINVAL;
 	}
 
-	if (limit->find_reduced_pll && dev_priv->lvds_downclock_avail) {
-		memcpy(&reduced_clock, &clock, sizeof(intel_clock_t));
-		has_reduced_clock = limit->find_reduced_pll(limit, crtc,
-							    (adjusted_mode->clock*3/4),
+	if (is_lvds && dev_priv->lvds_downclock_avail) {
+		has_reduced_clock = limit->find_pll(limit, crtc,
+							    dev_priv->lvds_downclock,
 							    refclk,
 							    &reduced_clock);
+		if (has_reduced_clock && (clock.p != reduced_clock.p)) {
+			/*
+			 * If the different P is found, it means that we can't
+			 * switch the display clock by using the FP0/FP1.
+			 * In such case we will disable the LVDS downclock
+			 * feature.
+			 */
+			DRM_DEBUG_KMS("Different P is found for "
+						"LVDS clock/downclock\n");
+			has_reduced_clock = 0;
+		}
 	}
-
 	/* SDVO TV has fixed PLL values depend on its clock range,
 	   this mirrors vbios setting. */
 	if (is_sdvo && is_tv) {
@@ -2831,7 +2893,7 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
 	}
 
 	/* FDI link */
-	if (IS_IGDNG(dev)) {
+	if (IS_IRONLAKE(dev)) {
 		int lane, link_bw, bpp;
 		/* eDP doesn't require FDI link, so just set DP M/N
 		   according to current link config */
@@ -2854,6 +2916,33 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
 
 		/* determine panel color depth */
 		temp = I915_READ(pipeconf_reg);
+		temp &= ~PIPE_BPC_MASK;
+		if (is_lvds) {
+			int lvds_reg = I915_READ(PCH_LVDS);
+			/* the BPC will be 6 if it is 18-bit LVDS panel */
+			if ((lvds_reg & LVDS_A3_POWER_MASK) == LVDS_A3_POWER_UP)
+				temp |= PIPE_8BPC;
+			else
+				temp |= PIPE_6BPC;
+		} else if (is_edp) {
+			switch (dev_priv->edp_bpp/3) {
+			case 8:
+				temp |= PIPE_8BPC;
+				break;
+			case 10:
+				temp |= PIPE_10BPC;
+				break;
+			case 6:
+				temp |= PIPE_6BPC;
+				break;
+			case 12:
+				temp |= PIPE_12BPC;
+				break;
+			}
+		} else
+			temp |= PIPE_8BPC;
+		I915_WRITE(pipeconf_reg, temp);
+		I915_READ(pipeconf_reg);
 
 		switch (temp & PIPE_BPC_MASK) {
 		case PIPE_8BPC:
@@ -2873,8 +2962,7 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
 			bpp = 24;
 		}
 
-		igdng_compute_m_n(bpp, lane, target_clock,
-				  link_bw, &m_n);
+		ironlake_compute_m_n(bpp, lane, target_clock, link_bw, &m_n);
 	}
 
 	/* Ironlake: try to setup display ref clock before DPLL
@@ -2882,7 +2970,7 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
 	 * PCH B stepping, previous chipset stepping should be
 	 * ignoring this setting.
 	 */
-	if (IS_IGDNG(dev)) {
+	if (IS_IRONLAKE(dev)) {
 		temp = I915_READ(PCH_DREF_CONTROL);
 		/* Always enable nonspread source */
 		temp &= ~DREF_NONSPREAD_SOURCE_MASK;
@@ -2917,7 +3005,7 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
 		}
 	}
 
-	if (IS_IGD(dev)) {
+	if (IS_PINEVIEW(dev)) {
 		fp = (1 << clock.n) << 16 | clock.m1 << 8 | clock.m2;
 		if (has_reduced_clock)
 			fp2 = (1 << reduced_clock.n) << 16 |
@@ -2929,7 +3017,7 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
 				reduced_clock.m2;
 	}
 
-	if (!IS_IGDNG(dev))
+	if (!IS_IRONLAKE(dev))
 		dpll = DPLL_VGA_MODE_DIS;
 
 	if (IS_I9XX(dev)) {
@@ -2942,19 +3030,19 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
 			sdvo_pixel_multiply = adjusted_mode->clock / mode->clock;
 			if (IS_I945G(dev) || IS_I945GM(dev) || IS_G33(dev))
 				dpll |= (sdvo_pixel_multiply - 1) << SDVO_MULTIPLIER_SHIFT_HIRES;
-			else if (IS_IGDNG(dev))
+			else if (IS_IRONLAKE(dev))
 				dpll |= (sdvo_pixel_multiply - 1) << PLL_REF_SDVO_HDMI_MULTIPLIER_SHIFT;
 		}
 		if (is_dp)
 			dpll |= DPLL_DVO_HIGH_SPEED;
 
 		/* compute bitmask from p1 value */
-		if (IS_IGD(dev))
-			dpll |= (1 << (clock.p1 - 1)) << DPLL_FPA01_P1_POST_DIV_SHIFT_IGD;
+		if (IS_PINEVIEW(dev))
+			dpll |= (1 << (clock.p1 - 1)) << DPLL_FPA01_P1_POST_DIV_SHIFT_PINEVIEW;
 		else {
 			dpll |= (1 << (clock.p1 - 1)) << DPLL_FPA01_P1_POST_DIV_SHIFT;
 			/* also FPA1 */
-			if (IS_IGDNG(dev))
+			if (IS_IRONLAKE(dev))
 				dpll |= (1 << (clock.p1 - 1)) << DPLL_FPA1_P1_POST_DIV_SHIFT;
 			if (IS_G4X(dev) && has_reduced_clock)
 				dpll |= (1 << (reduced_clock.p1 - 1)) << DPLL_FPA1_P1_POST_DIV_SHIFT;
@@ -2973,7 +3061,7 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
 			dpll |= DPLLB_LVDS_P2_CLOCK_DIV_14;
 			break;
 		}
-		if (IS_I965G(dev) && !IS_IGDNG(dev))
+		if (IS_I965G(dev) && !IS_IRONLAKE(dev))
 			dpll |= (6 << PLL_LOAD_PULSE_PHASE_SHIFT);
 	} else {
 		if (is_lvds) {
@@ -3005,9 +3093,9 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
 	/* Set up the display plane register */
 	dspcntr = DISPPLANE_GAMMA_ENABLE;
 
-	/* IGDNG's plane is forced to pipe, bit 24 is to
+	/* Ironlake's plane is forced to pipe, bit 24 is to
 	   enable color space conversion */
-	if (!IS_IGDNG(dev)) {
+	if (!IS_IRONLAKE(dev)) {
 		if (pipe == 0)
 			dspcntr &= ~DISPPLANE_SEL_PIPE_MASK;
 		else
@@ -3034,20 +3122,20 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
 
 
 	/* Disable the panel fitter if it was on our pipe */
-	if (!IS_IGDNG(dev) && intel_panel_fitter_pipe(dev) == pipe)
+	if (!IS_IRONLAKE(dev) && intel_panel_fitter_pipe(dev) == pipe)
 		I915_WRITE(PFIT_CONTROL, 0);
 
-	DRM_DEBUG("Mode for pipe %c:\n", pipe == 0 ? 'A' : 'B');
+	DRM_DEBUG_KMS("Mode for pipe %c:\n", pipe == 0 ? 'A' : 'B');
 	drm_mode_debug_printmodeline(mode);
 
-	/* assign to IGDNG registers */
-	if (IS_IGDNG(dev)) {
+	/* assign to Ironlake registers */
+	if (IS_IRONLAKE(dev)) {
 		fp_reg = pch_fp_reg;
 		dpll_reg = pch_dpll_reg;
 	}
 
 	if (is_edp) {
-		igdng_disable_pll_edp(crtc);
+		ironlake_disable_pll_edp(crtc);
 	} else if ((dpll & DPLL_VCO_ENABLE)) {
 		I915_WRITE(fp_reg, fp);
 		I915_WRITE(dpll_reg, dpll & ~DPLL_VCO_ENABLE);
@@ -3062,7 +3150,7 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
 	if (is_lvds) {
 		u32 lvds;
 
-		if (IS_IGDNG(dev))
+		if (IS_IRONLAKE(dev))
 			lvds_reg = PCH_LVDS;
 
 		lvds = I915_READ(lvds_reg);
@@ -3081,7 +3169,20 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
 		 * appropriately here, but we need to look more thoroughly into how
 		 * panels behave in the two modes.
 		 */
-
+		/* set the dithering flag */
+		if (IS_I965G(dev)) {
+			if (dev_priv->lvds_dither) {
+				if (IS_IRONLAKE(dev))
+					pipeconf |= PIPE_ENABLE_DITHER;
+				else
+					lvds |= LVDS_ENABLE_DITHER;
+			} else {
+				if (IS_IRONLAKE(dev))
+					pipeconf &= ~PIPE_ENABLE_DITHER;
+				else
+					lvds &= ~LVDS_ENABLE_DITHER;
+			}
+		}
 		I915_WRITE(lvds_reg, lvds);
 		I915_READ(lvds_reg);
 	}
@@ -3095,7 +3196,7 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
 		/* Wait for the clocks to stabilize. */
 		udelay(150);
 
-		if (IS_I965G(dev) && !IS_IGDNG(dev)) {
+		if (IS_I965G(dev) && !IS_IRONLAKE(dev)) {
 			if (is_sdvo) {
 				sdvo_pixel_multiply = adjusted_mode->clock / mode->clock;
 				I915_WRITE(dpll_md_reg, (0 << DPLL_MD_UDI_DIVIDER_SHIFT) |
@@ -3115,14 +3216,14 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
 		I915_WRITE(fp_reg + 4, fp2);
 		intel_crtc->lowfreq_avail = true;
 		if (HAS_PIPE_CXSR(dev)) {
-			DRM_DEBUG("enabling CxSR downclocking\n");
+			DRM_DEBUG_KMS("enabling CxSR downclocking\n");
 			pipeconf |= PIPECONF_CXSR_DOWNCLOCK;
 		}
 	} else {
 		I915_WRITE(fp_reg + 4, fp);
 		intel_crtc->lowfreq_avail = false;
 		if (HAS_PIPE_CXSR(dev)) {
-			DRM_DEBUG("disabling CxSR downclocking\n");
+			DRM_DEBUG_KMS("disabling CxSR downclocking\n");
 			pipeconf &= ~PIPECONF_CXSR_DOWNCLOCK;
 		}
 	}
@@ -3142,21 +3243,21 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
 	/* pipesrc and dspsize control the size that is scaled from, which should
 	 * always be the user's requested size.
 	 */
-	if (!IS_IGDNG(dev)) {
+	if (!IS_IRONLAKE(dev)) {
 		I915_WRITE(dspsize_reg, ((mode->vdisplay - 1) << 16) |
 				(mode->hdisplay - 1));
 		I915_WRITE(dsppos_reg, 0);
 	}
 	I915_WRITE(pipesrc_reg, ((mode->hdisplay - 1) << 16) | (mode->vdisplay - 1));
 
-	if (IS_IGDNG(dev)) {
+	if (IS_IRONLAKE(dev)) {
 		I915_WRITE(data_m1_reg, TU_SIZE(m_n.tu) | m_n.gmch_m);
 		I915_WRITE(data_n1_reg, TU_SIZE(m_n.tu) | m_n.gmch_n);
 		I915_WRITE(link_m1_reg, m_n.link_m);
 		I915_WRITE(link_n1_reg, m_n.link_n);
 
 		if (is_edp) {
-			igdng_set_pll_edp(crtc, adjusted_mode->clock);
+			ironlake_set_pll_edp(crtc, adjusted_mode->clock);
 		} else {
 			/* enable FDI RX PLL too */
 			temp = I915_READ(fdi_rx_reg);
@@ -3170,7 +3271,7 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
 
 	intel_wait_for_vblank(dev);
 
-	if (IS_IGDNG(dev)) {
+	if (IS_IRONLAKE(dev)) {
 		/* enable address swizzle for tiling buffer */
 		temp = I915_READ(DISP_ARB_CTL);
 		I915_WRITE(DISP_ARB_CTL, temp | DISP_TILE_SURFACE_SWIZZLING);
@@ -3204,8 +3305,8 @@ void intel_crtc_load_lut(struct drm_crtc *crtc)
 	if (!crtc->enabled)
 		return;
 
-	/* use legacy palette for IGDNG */
-	if (IS_IGDNG(dev))
+	/* use legacy palette for Ironlake */
+	if (IS_IRONLAKE(dev))
 		palreg = (intel_crtc->pipe == 0) ? LGC_PALETTE_A :
 						   LGC_PALETTE_B;
 
@@ -3234,11 +3335,11 @@ static int intel_crtc_cursor_set(struct drm_crtc *crtc,
 	size_t addr;
 	int ret;
 
-	DRM_DEBUG("\n");
+	DRM_DEBUG_KMS("\n");
 
 	/* if we want to turn off the cursor ignore width and height */
 	if (!handle) {
-		DRM_DEBUG("cursor off\n");
+		DRM_DEBUG_KMS("cursor off\n");
 		if (IS_MOBILE(dev) || IS_I9XX(dev)) {
 			temp &= ~(CURSOR_MODE | MCURSOR_GAMMA_ENABLE);
 			temp |= CURSOR_MODE_DISABLE;
@@ -3271,7 +3372,7 @@ static int intel_crtc_cursor_set(struct drm_crtc *crtc,
 
 	/* we only need to pin inside GTT if cursor is non-phy */
 	mutex_lock(&dev->struct_mutex);
-	if (!dev_priv->cursor_needs_physical) {
+	if (!dev_priv->info->cursor_needs_physical) {
 		ret = i915_gem_object_pin(bo, PAGE_SIZE);
 		if (ret) {
 			DRM_ERROR("failed to pin cursor bo\n");
@@ -3306,7 +3407,7 @@ static int intel_crtc_cursor_set(struct drm_crtc *crtc,
 	I915_WRITE(base, addr);
 
 	if (intel_crtc->cursor_bo) {
-		if (dev_priv->cursor_needs_physical) {
+		if (dev_priv->info->cursor_needs_physical) {
 			if (intel_crtc->cursor_bo != bo)
 				i915_gem_detach_phys_object(dev, intel_crtc->cursor_bo);
 		} else
@@ -3546,18 +3647,18 @@ static int intel_crtc_clock_get(struct drm_device *dev, struct drm_crtc *crtc)
 		fp = I915_READ((pipe == 0) ? FPA1 : FPB1);
 
 	clock.m1 = (fp & FP_M1_DIV_MASK) >> FP_M1_DIV_SHIFT;
-	if (IS_IGD(dev)) {
-		clock.n = ffs((fp & FP_N_IGD_DIV_MASK) >> FP_N_DIV_SHIFT) - 1;
-		clock.m2 = (fp & FP_M2_IGD_DIV_MASK) >> FP_M2_DIV_SHIFT;
+	if (IS_PINEVIEW(dev)) {
+		clock.n = ffs((fp & FP_N_PINEVIEW_DIV_MASK) >> FP_N_DIV_SHIFT) - 1;
+		clock.m2 = (fp & FP_M2_PINEVIEW_DIV_MASK) >> FP_M2_DIV_SHIFT;
 	} else {
 		clock.n = (fp & FP_N_DIV_MASK) >> FP_N_DIV_SHIFT;
 		clock.m2 = (fp & FP_M2_DIV_MASK) >> FP_M2_DIV_SHIFT;
 	}
 
 	if (IS_I9XX(dev)) {
-		if (IS_IGD(dev))
-			clock.p1 = ffs((dpll & DPLL_FPA01_P1_POST_DIV_MASK_IGD) >>
-				DPLL_FPA01_P1_POST_DIV_SHIFT_IGD);
+		if (IS_PINEVIEW(dev))
+			clock.p1 = ffs((dpll & DPLL_FPA01_P1_POST_DIV_MASK_PINEVIEW) >>
+				DPLL_FPA01_P1_POST_DIV_SHIFT_PINEVIEW);
 		else
 			clock.p1 = ffs((dpll & DPLL_FPA01_P1_POST_DIV_MASK) >>
 			       DPLL_FPA01_P1_POST_DIV_SHIFT);
@@ -3572,7 +3673,7 @@ static int intel_crtc_clock_get(struct drm_device *dev, struct drm_crtc *crtc)
 				7 : 14;
 			break;
 		default:
-			DRM_DEBUG("Unknown DPLL mode %08x in programmed "
+			DRM_DEBUG_KMS("Unknown DPLL mode %08x in programmed "
 				  "mode\n", (int)(dpll & DPLL_MODE_MASK));
 			return 0;
 		}
@@ -3658,132 +3759,13 @@ static void intel_gpu_idle_timer(unsigned long arg)
 	struct drm_device *dev = (struct drm_device *)arg;
 	drm_i915_private_t *dev_priv = dev->dev_private;
 
-	DRM_DEBUG("idle timer fired, downclocking\n");
+	DRM_DEBUG_DRIVER("idle timer fired, downclocking\n");
 
 	dev_priv->busy = false;
 
 	queue_work(dev_priv->wq, &dev_priv->idle_work);
 }
 
-void intel_increase_renderclock(struct drm_device *dev, bool schedule)
-{
-	drm_i915_private_t *dev_priv = dev->dev_private;
-
-	if (IS_IGDNG(dev))
-		return;
-
-	if (!dev_priv->render_reclock_avail) {
-		DRM_DEBUG("not reclocking render clock\n");
-		return;
-	}
-
-	/* Restore render clock frequency to original value */
-	if (IS_G4X(dev) || IS_I9XX(dev))
-		pci_write_config_word(dev->pdev, GCFGC, dev_priv->orig_clock);
-	else if (IS_I85X(dev))
-		pci_write_config_word(dev->pdev, HPLLCC, dev_priv->orig_clock);
-	DRM_DEBUG("increasing render clock frequency\n");
-
-	/* Schedule downclock */
-	if (schedule)
-		mod_timer(&dev_priv->idle_timer, jiffies +
-			  msecs_to_jiffies(GPU_IDLE_TIMEOUT));
-}
-
-void intel_decrease_renderclock(struct drm_device *dev)
-{
-	drm_i915_private_t *dev_priv = dev->dev_private;
-
-	if (IS_IGDNG(dev))
-		return;
-
-	if (!dev_priv->render_reclock_avail) {
-		DRM_DEBUG("not reclocking render clock\n");
-		return;
-	}
-
-	if (IS_G4X(dev)) {
-		u16 gcfgc;
-
-		/* Adjust render clock... */
-		pci_read_config_word(dev->pdev, GCFGC, &gcfgc);
-
-		/* Down to minimum... */
-		gcfgc &= ~GM45_GC_RENDER_CLOCK_MASK;
-		gcfgc |= GM45_GC_RENDER_CLOCK_266_MHZ;
-
-		pci_write_config_word(dev->pdev, GCFGC, gcfgc);
-	} else if (IS_I965G(dev)) {
-		u16 gcfgc;
-
-		/* Adjust render clock... */
-		pci_read_config_word(dev->pdev, GCFGC, &gcfgc);
-
-		/* Down to minimum... */
-		gcfgc &= ~I965_GC_RENDER_CLOCK_MASK;
-		gcfgc |= I965_GC_RENDER_CLOCK_267_MHZ;
-
-		pci_write_config_word(dev->pdev, GCFGC, gcfgc);
-	} else if (IS_I945G(dev) || IS_I945GM(dev)) {
-		u16 gcfgc;
-
-		/* Adjust render clock... */
-		pci_read_config_word(dev->pdev, GCFGC, &gcfgc);
-
-		/* Down to minimum... */
-		gcfgc &= ~I945_GC_RENDER_CLOCK_MASK;
-		gcfgc |= I945_GC_RENDER_CLOCK_166_MHZ;
-
-		pci_write_config_word(dev->pdev, GCFGC, gcfgc);
-	} else if (IS_I915G(dev)) {
-		u16 gcfgc;
-
-		/* Adjust render clock... */
-		pci_read_config_word(dev->pdev, GCFGC, &gcfgc);
-
-		/* Down to minimum... */
-		gcfgc &= ~I915_GC_RENDER_CLOCK_MASK;
-		gcfgc |= I915_GC_RENDER_CLOCK_166_MHZ;
-
-		pci_write_config_word(dev->pdev, GCFGC, gcfgc);
-	} else if (IS_I85X(dev)) {
-		u16 hpllcc;
-
-		/* Adjust render clock... */
-		pci_read_config_word(dev->pdev, HPLLCC, &hpllcc);
-
-		/* Up to maximum... */
-		hpllcc &= ~GC_CLOCK_CONTROL_MASK;
-		hpllcc |= GC_CLOCK_133_200;
-
-		pci_write_config_word(dev->pdev, HPLLCC, hpllcc);
-	}
-	DRM_DEBUG("decreasing render clock frequency\n");
-}
-
-/* Note that no increase function is needed for this - increase_renderclock()
- *  will also rewrite these bits
- */
-void intel_decrease_displayclock(struct drm_device *dev)
-{
-	if (IS_IGDNG(dev))
-		return;
-
-	if (IS_I945G(dev) || IS_I945GM(dev) || IS_I915G(dev) ||
-	    IS_I915GM(dev)) {
-		u16 gcfgc;
-
-		/* Adjust render clock... */
-		pci_read_config_word(dev->pdev, GCFGC, &gcfgc);
-
-		/* Down to minimum... */
-		gcfgc &= ~0xf0;
-		gcfgc |= 0x80;
-
-		pci_write_config_word(dev->pdev, GCFGC, gcfgc);
-	}
-}
-
 #define CRTC_IDLE_TIMEOUT 1000 /* ms */
 
 static void intel_crtc_idle_timer(unsigned long arg)
@@ -3792,7 +3774,7 @@ static void intel_crtc_idle_timer(unsigned long arg)
 	struct drm_crtc *crtc = &intel_crtc->base;
 	drm_i915_private_t *dev_priv = crtc->dev->dev_private;
 
-	DRM_DEBUG("idle timer fired, downclocking\n");
+	DRM_DEBUG_DRIVER("idle timer fired, downclocking\n");
 
 	intel_crtc->busy = false;
 
@@ -3808,14 +3790,14 @@ static void intel_increase_pllclock(struct drm_crtc *crtc, bool schedule)
 	int dpll_reg = (pipe == 0) ? DPLL_A : DPLL_B;
 	int dpll = I915_READ(dpll_reg);
 
-	if (IS_IGDNG(dev))
+	if (IS_IRONLAKE(dev))
 		return;
 
 	if (!dev_priv->lvds_downclock_avail)
 		return;
 
 	if (!HAS_PIPE_CXSR(dev) && (dpll & DISPLAY_RATE_SELECT_FPA1)) {
-		DRM_DEBUG("upclocking LVDS\n");
+		DRM_DEBUG_DRIVER("upclocking LVDS\n");
 
 		/* Unlock panel regs */
 		I915_WRITE(PP_CONTROL, I915_READ(PP_CONTROL) | (0xabcd << 16));
@@ -3826,7 +3808,7 @@ static void intel_increase_pllclock(struct drm_crtc *crtc, bool schedule)
 		intel_wait_for_vblank(dev);
 		dpll = I915_READ(dpll_reg);
 		if (dpll & DISPLAY_RATE_SELECT_FPA1)
-			DRM_DEBUG("failed to upclock LVDS!\n");
+			DRM_DEBUG_DRIVER("failed to upclock LVDS!\n");
 
 		/* ...and lock them again */
 		I915_WRITE(PP_CONTROL, I915_READ(PP_CONTROL) & 0x3);
@@ -3847,7 +3829,7 @@ static void intel_decrease_pllclock(struct drm_crtc *crtc)
 	int dpll_reg = (pipe == 0) ? DPLL_A : DPLL_B;
 	int dpll = I915_READ(dpll_reg);
 
-	if (IS_IGDNG(dev))
+	if (IS_IRONLAKE(dev))
 		return;
 
 	if (!dev_priv->lvds_downclock_avail)
@@ -3858,7 +3840,7 @@ static void intel_decrease_pllclock(struct drm_crtc *crtc)
 	 * the manual case.
 	 */
 	if (!HAS_PIPE_CXSR(dev) && intel_crtc->lowfreq_avail) {
-		DRM_DEBUG("downclocking LVDS\n");
+		DRM_DEBUG_DRIVER("downclocking LVDS\n");
 
 		/* Unlock panel regs */
 		I915_WRITE(PP_CONTROL, I915_READ(PP_CONTROL) | (0xabcd << 16));
@@ -3869,7 +3851,7 @@ static void intel_decrease_pllclock(struct drm_crtc *crtc)
 		intel_wait_for_vblank(dev);
 		dpll = I915_READ(dpll_reg);
 		if (!(dpll & DISPLAY_RATE_SELECT_FPA1))
-			DRM_DEBUG("failed to downclock LVDS!\n");
+			DRM_DEBUG_DRIVER("failed to downclock LVDS!\n");
 
 		/* ...and lock them again */
 		I915_WRITE(PP_CONTROL, I915_READ(PP_CONTROL) & 0x3);
@@ -3897,12 +3879,6 @@ static void intel_idle_update(struct work_struct *work)
 
 	mutex_lock(&dev->struct_mutex);
 
-	/* GPU isn't processing, downclock it. */
-	if (!dev_priv->busy) {
-		intel_decrease_renderclock(dev);
-		intel_decrease_displayclock(dev);
-	}
-
 	list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
 		/* Skip inactive CRTCs */
 		if (!crtc->fb)
@@ -3936,8 +3912,11 @@ void intel_mark_busy(struct drm_device *dev, struct drm_gem_object *obj)
 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
 		return;
 
-	dev_priv->busy = true;
-	intel_increase_renderclock(dev, true);
+	if (!dev_priv->busy)
+		dev_priv->busy = true;
+	else
+		mod_timer(&dev_priv->idle_timer, jiffies +
+			  msecs_to_jiffies(GPU_IDLE_TIMEOUT));
 
 	list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
 		if (!crtc->fb)
@@ -3967,6 +3946,158 @@ static void intel_crtc_destroy(struct drm_crtc *crtc)
 	kfree(intel_crtc);
 }
 
+struct intel_unpin_work {
+	struct work_struct work;
+	struct drm_device *dev;
+	struct drm_gem_object *obj;
+	struct drm_pending_vblank_event *event;
+	int pending;
+};
+
+static void intel_unpin_work_fn(struct work_struct *__work)
+{
+	struct intel_unpin_work *work =
+		container_of(__work, struct intel_unpin_work, work);
+
+	mutex_lock(&work->dev->struct_mutex);
+	i915_gem_object_unpin(work->obj);
+	drm_gem_object_unreference(work->obj);
+	mutex_unlock(&work->dev->struct_mutex);
+	kfree(work);
+}
+
+void intel_finish_page_flip(struct drm_device *dev, int pipe)
+{
+	drm_i915_private_t *dev_priv = dev->dev_private;
+	struct drm_crtc *crtc = dev_priv->pipe_to_crtc_mapping[pipe];
+	struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
+	struct intel_unpin_work *work;
+	struct drm_i915_gem_object *obj_priv;
+	struct drm_pending_vblank_event *e;
+	struct timeval now;
+	unsigned long flags;
+
+	/* Ignore early vblank irqs */
+	if (intel_crtc == NULL)
+		return;
+
+	spin_lock_irqsave(&dev->event_lock, flags);
+	work = intel_crtc->unpin_work;
+	if (work == NULL || !work->pending) {
+		spin_unlock_irqrestore(&dev->event_lock, flags);
+		return;
+	}
+
+	intel_crtc->unpin_work = NULL;
+	drm_vblank_put(dev, intel_crtc->pipe);
+
+	if (work->event) {
+		e = work->event;
+		do_gettimeofday(&now);
+		e->event.sequence = drm_vblank_count(dev, intel_crtc->pipe);
+		e->event.tv_sec = now.tv_sec;
+		e->event.tv_usec = now.tv_usec;
+		list_add_tail(&e->base.link,
+			      &e->base.file_priv->event_list);
+		wake_up_interruptible(&e->base.file_priv->event_wait);
+	}
+
+	spin_unlock_irqrestore(&dev->event_lock, flags);
+
+	obj_priv = work->obj->driver_private;
+	if (atomic_dec_and_test(&obj_priv->pending_flip))
+		DRM_WAKEUP(&dev_priv->pending_flip_queue);
+	schedule_work(&work->work);
+}
+
+void intel_prepare_page_flip(struct drm_device *dev, int plane)
+{
+	drm_i915_private_t *dev_priv = dev->dev_private;
+	struct intel_crtc *intel_crtc =
+		to_intel_crtc(dev_priv->plane_to_crtc_mapping[plane]);
+	unsigned long flags;
+
+	spin_lock_irqsave(&dev->event_lock, flags);
+	if (intel_crtc->unpin_work)
+		intel_crtc->unpin_work->pending = 1;
+	spin_unlock_irqrestore(&dev->event_lock, flags);
+}
+
+static int intel_crtc_page_flip(struct drm_crtc *crtc,
+				struct drm_framebuffer *fb,
+				struct drm_pending_vblank_event *event)
+{
+	struct drm_device *dev = crtc->dev;
+	struct drm_i915_private *dev_priv = dev->dev_private;
+	struct intel_framebuffer *intel_fb;
+	struct drm_i915_gem_object *obj_priv;
+	struct drm_gem_object *obj;
+	struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
+	struct intel_unpin_work *work;
+	unsigned long flags;
+	int ret;
+	RING_LOCALS;
+
+	work = kzalloc(sizeof *work, GFP_KERNEL);
+	if (work == NULL)
+		return -ENOMEM;
+
+	mutex_lock(&dev->struct_mutex);
+
+	work->event = event;
+	work->dev = crtc->dev;
+	intel_fb = to_intel_framebuffer(crtc->fb);
+	work->obj = intel_fb->obj;
+	INIT_WORK(&work->work, intel_unpin_work_fn);
+
+	/* We borrow the event spin lock for protecting unpin_work */
+	spin_lock_irqsave(&dev->event_lock, flags);
+	if (intel_crtc->unpin_work) {
+		spin_unlock_irqrestore(&dev->event_lock, flags);
+		kfree(work);
+		mutex_unlock(&dev->struct_mutex);
+		return -EBUSY;
+	}
+	intel_crtc->unpin_work = work;
+	spin_unlock_irqrestore(&dev->event_lock, flags);
+
+	intel_fb = to_intel_framebuffer(fb);
+	obj = intel_fb->obj;
+
+	ret = intel_pin_and_fence_fb_obj(dev, obj);
+	if (ret != 0) {
+		kfree(work);
+		mutex_unlock(&dev->struct_mutex);
+		return ret;
+	}
+
+	/* Reference the old fb object for the scheduled work. */
+	drm_gem_object_reference(work->obj);
+
+	crtc->fb = fb;
+	i915_gem_object_flush_write_domain(obj);
+	drm_vblank_get(dev, intel_crtc->pipe);
+	obj_priv = obj->driver_private;
+	atomic_inc(&obj_priv->pending_flip);
+
+	BEGIN_LP_RING(4);
+	OUT_RING(MI_DISPLAY_FLIP |
+		 MI_DISPLAY_FLIP_PLANE(intel_crtc->plane));
+	OUT_RING(fb->pitch);
+	if (IS_I965G(dev)) {
+		OUT_RING(obj_priv->gtt_offset | obj_priv->tiling_mode);
+		OUT_RING((fb->width << 16) | fb->height);
+	} else {
+		OUT_RING(obj_priv->gtt_offset);
+		OUT_RING(MI_NOOP);
+	}
+	ADVANCE_LP_RING();
+
+	mutex_unlock(&dev->struct_mutex);
+
+	return 0;
+}
+
 static const struct drm_crtc_helper_funcs intel_helper_funcs = {
 	.dpms = intel_crtc_dpms,
 	.mode_fixup = intel_crtc_mode_fixup,
@@ -3983,11 +4114,13 @@ static const struct drm_crtc_funcs intel_crtc_funcs = {
 	.gamma_set = intel_crtc_gamma_set,
 	.set_config = drm_crtc_helper_set_config,
 	.destroy = intel_crtc_destroy,
+	.page_flip = intel_crtc_page_flip,
 };
 
 
 static void intel_crtc_init(struct drm_device *dev, int pipe)
 {
+	drm_i915_private_t *dev_priv = dev->dev_private;
 	struct intel_crtc *intel_crtc;
 	int i;
 
@@ -4010,10 +4143,15 @@ static void intel_crtc_init(struct drm_device *dev, int pipe)
 	intel_crtc->pipe = pipe;
 	intel_crtc->plane = pipe;
 	if (IS_MOBILE(dev) && (IS_I9XX(dev) && !IS_I965G(dev))) {
-		DRM_DEBUG("swapping pipes & planes for FBC\n");
+		DRM_DEBUG_KMS("swapping pipes & planes for FBC\n");
 		intel_crtc->plane = ((pipe == 0) ? 1 : 0);
 	}
 
+	BUG_ON(pipe >= ARRAY_SIZE(dev_priv->plane_to_crtc_mapping) ||
+	       dev_priv->plane_to_crtc_mapping[intel_crtc->plane] != NULL);
+	dev_priv->plane_to_crtc_mapping[intel_crtc->plane] = &intel_crtc->base;
+	dev_priv->pipe_to_crtc_mapping[intel_crtc->pipe] = &intel_crtc->base;
+
 	intel_crtc->cursor_addr = 0;
 	intel_crtc->dpms_mode = DRM_MODE_DPMS_OFF;
 	drm_crtc_helper_add(&intel_crtc->base, &intel_helper_funcs);
@@ -4090,7 +4228,7 @@ static void intel_setup_outputs(struct drm_device *dev)
 	if (IS_MOBILE(dev) && !IS_I830(dev))
 		intel_lvds_init(dev);
 
-	if (IS_IGDNG(dev)) {
+	if (IS_IRONLAKE(dev)) {
 		int found;
 
 		if (IS_MOBILE(dev) && (I915_READ(DP_A) & DP_DETECTED))
@@ -4118,37 +4256,51 @@ static void intel_setup_outputs(struct drm_device *dev)
 		if (I915_READ(PCH_DP_D) & DP_DETECTED)
 			intel_dp_init(dev, PCH_DP_D);
 
-	} else if (IS_I9XX(dev)) {
+	} else if (SUPPORTS_DIGITAL_OUTPUTS(dev)) {
 		bool found = false;
 
 		if (I915_READ(SDVOB) & SDVO_DETECTED) {
+			DRM_DEBUG_KMS("probing SDVOB\n");
 			found = intel_sdvo_init(dev, SDVOB);
-			if (!found && SUPPORTS_INTEGRATED_HDMI(dev))
+			if (!found && SUPPORTS_INTEGRATED_HDMI(dev)) {
+				DRM_DEBUG_KMS("probing HDMI on SDVOB\n");
 				intel_hdmi_init(dev, SDVOB);
+			}
 
-			if (!found && SUPPORTS_INTEGRATED_DP(dev))
+			if (!found && SUPPORTS_INTEGRATED_DP(dev)) {
+				DRM_DEBUG_KMS("probing DP_B\n");
 				intel_dp_init(dev, DP_B);
+			}
 		}
 
 		/* Before G4X SDVOC doesn't have its own detect register */
 
-		if (I915_READ(SDVOB) & SDVO_DETECTED)
+		if (I915_READ(SDVOB) & SDVO_DETECTED) {
+			DRM_DEBUG_KMS("probing SDVOC\n");
 			found = intel_sdvo_init(dev, SDVOC);
+		}
 
 		if (!found && (I915_READ(SDVOC) & SDVO_DETECTED)) {
 
-			if (SUPPORTS_INTEGRATED_HDMI(dev))
+			if (SUPPORTS_INTEGRATED_HDMI(dev)) {
+				DRM_DEBUG_KMS("probing HDMI on SDVOC\n");
 				intel_hdmi_init(dev, SDVOC);
-			if (SUPPORTS_INTEGRATED_DP(dev))
+			}
+			if (SUPPORTS_INTEGRATED_DP(dev)) {
+				DRM_DEBUG_KMS("probing DP_C\n");
 				intel_dp_init(dev, DP_C);
+			}
 		}
 
-		if (SUPPORTS_INTEGRATED_DP(dev) && (I915_READ(DP_D) & DP_DETECTED))
+		if (SUPPORTS_INTEGRATED_DP(dev) &&
+		    (I915_READ(DP_D) & DP_DETECTED)) {
+			DRM_DEBUG_KMS("probing DP_D\n");
 			intel_dp_init(dev, DP_D);
-	} else
+		}
+	} else if (IS_I8XX(dev))
 		intel_dvo_init(dev);
 
-	if (IS_I9XX(dev) && IS_MOBILE(dev) && !IS_IGDNG(dev))
+	if (SUPPORTS_TV(dev))
 		intel_tv_init(dev);
 
 	list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
@@ -4249,6 +4401,42 @@ static const struct drm_mode_config_funcs intel_mode_funcs = {
 	.fb_changed = intelfb_probe,
 };
 
+static struct drm_gem_object *
+intel_alloc_power_context(struct drm_device *dev)
+{
+	struct drm_gem_object *pwrctx;
+	int ret;
+
+	pwrctx = drm_gem_object_alloc(dev, 4096);
+	if (!pwrctx) {
+		DRM_DEBUG("failed to alloc power context, RC6 disabled\n");
+		return NULL;
+	}
+
+	mutex_lock(&dev->struct_mutex);
+	ret = i915_gem_object_pin(pwrctx, 4096);
+	if (ret) {
+		DRM_ERROR("failed to pin power context: %d\n", ret);
+		goto err_unref;
+	}
+
+	ret = i915_gem_object_set_to_gtt_domain(pwrctx, 1);
+	if (ret) {
+		DRM_ERROR("failed to set-domain on power context: %d\n", ret);
+		goto err_unpin;
+	}
+	mutex_unlock(&dev->struct_mutex);
+
+	return pwrctx;
+
+err_unpin:
+	i915_gem_object_unpin(pwrctx);
+err_unref:
+	drm_gem_object_unreference(pwrctx);
+	mutex_unlock(&dev->struct_mutex);
+	return NULL;
+}
+
 void intel_init_clock_gating(struct drm_device *dev)
 {
 	struct drm_i915_private *dev_priv = dev->dev_private;
@@ -4257,7 +4445,7 @@ void intel_init_clock_gating(struct drm_device *dev)
 	 * Disable clock gating reported to work incorrectly according to the
 	 * specs, but enable as much else as we can.
 	 */
-	if (IS_IGDNG(dev)) {
+	if (IS_IRONLAKE(dev)) {
 		return;
 	} else if (IS_G4X(dev)) {
 		uint32_t dspclk_gate;
@@ -4291,11 +4479,37 @@ void intel_init_clock_gating(struct drm_device *dev)
 		dstate |= DSTATE_PLL_D3_OFF | DSTATE_GFX_CLOCK_GATING |
 			DSTATE_DOT_CLOCK_GATING;
 		I915_WRITE(D_STATE, dstate);
-	} else if (IS_I855(dev) || IS_I865G(dev)) {
+	} else if (IS_I85X(dev) || IS_I865G(dev)) {
 		I915_WRITE(RENCLK_GATE_D1, SV_CLOCK_GATE_DISABLE);
 	} else if (IS_I830(dev)) {
 		I915_WRITE(DSPCLK_GATE_D, OVRUNIT_CLOCK_GATE_DISABLE);
 	}
+
+	/*
+	 * GPU can automatically power down the render unit if given a page
+	 * to save state.
+	 */
+	if (I915_HAS_RC6(dev) && drm_core_check_feature(dev, DRIVER_MODESET)) {
+		struct drm_i915_gem_object *obj_priv = NULL;
+
+		if (dev_priv->pwrctx) {
+			obj_priv = dev_priv->pwrctx->driver_private;
+		} else {
+			struct drm_gem_object *pwrctx;
+
+			pwrctx = intel_alloc_power_context(dev);
+			if (pwrctx) {
+				dev_priv->pwrctx = pwrctx;
+				obj_priv = pwrctx->driver_private;
+			}
+		}
+
+		if (obj_priv) {
+			I915_WRITE(PWRCTXA, obj_priv->gtt_offset | PWRCTX_EN);
+			I915_WRITE(MCHBAR_RENDER_STANDBY,
+				   I915_READ(MCHBAR_RENDER_STANDBY) & ~RCX_SW_EXIT);
+		}
+	}
 }
 
 /* Set up chip specific display functions */
@@ -4304,8 +4518,8 @@ static void intel_init_display(struct drm_device *dev)
 	struct drm_i915_private *dev_priv = dev->dev_private;
 
 	/* We always want a DPMS function */
-	if (IS_IGDNG(dev))
-		dev_priv->display.dpms = igdng_crtc_dpms;
+	if (IS_IRONLAKE(dev))
+		dev_priv->display.dpms = ironlake_crtc_dpms;
 	else
 		dev_priv->display.dpms = i9xx_crtc_dpms;
 
@@ -4324,13 +4538,13 @@ static void intel_init_display(struct drm_device *dev)
 	}
 
 	/* Returns the core display clock speed */
-	if (IS_I945G(dev))
+	if (IS_I945G(dev) || (IS_G33(dev) && ! IS_PINEVIEW_M(dev)))
 		dev_priv->display.get_display_clock_speed =
 			i945_get_display_clock_speed;
 	else if (IS_I915G(dev))
 		dev_priv->display.get_display_clock_speed =
 			i915_get_display_clock_speed;
-	else if (IS_I945GM(dev) || IS_845G(dev) || IS_IGDGM(dev))
+	else if (IS_I945GM(dev) || IS_845G(dev) || IS_PINEVIEW_M(dev))
 		dev_priv->display.get_display_clock_speed =
 			i9xx_misc_get_display_clock_speed;
 	else if (IS_I915GM(dev))
@@ -4339,7 +4553,7 @@ static void intel_init_display(struct drm_device *dev)
 	else if (IS_I865G(dev))
 		dev_priv->display.get_display_clock_speed =
 			i865_get_display_clock_speed;
-	else if (IS_I855(dev))
+	else if (IS_I85X(dev))
 		dev_priv->display.get_display_clock_speed =
 			i855_get_display_clock_speed;
 	else /* 852, 830 */
@@ -4347,7 +4561,7 @@ static void intel_init_display(struct drm_device *dev)
 			i830_get_display_clock_speed;
 
 	/* For FIFO watermark updates */
-	if (IS_IGDNG(dev))
+	if (IS_IRONLAKE(dev))
 		dev_priv->display.update_wm = NULL;
 	else if (IS_G4X(dev))
 		dev_priv->display.update_wm = g4x_update_wm;
@@ -4403,7 +4617,7 @@ void intel_modeset_init(struct drm_device *dev)
 		num_pipe = 2;
 	else
 		num_pipe = 1;
-	DRM_DEBUG("%d display pipe%s available.\n",
+	DRM_DEBUG_KMS("%d display pipe%s available.\n",
 		  num_pipe, num_pipe > 1 ? "s" : "");
 
 	if (IS_I85X(dev))
@@ -4422,6 +4636,15 @@ void intel_modeset_init(struct drm_device *dev)
 	INIT_WORK(&dev_priv->idle_work, intel_idle_update);
 	setup_timer(&dev_priv->idle_timer, intel_gpu_idle_timer,
 		    (unsigned long)dev);
+
+	intel_setup_overlay(dev);
+
+	if (IS_PINEVIEW(dev) && !intel_get_cxsr_latency(IS_PINEVIEW_G(dev),
+							dev_priv->fsb_freq,
+							dev_priv->mem_freq))
+		DRM_INFO("failed to find known CxSR latency "
+			 "(found fsb freq %d, mem freq %d), disabling CxSR\n",
+			 dev_priv->fsb_freq, dev_priv->mem_freq);
 }
 
 void intel_modeset_cleanup(struct drm_device *dev)
@@ -4442,14 +4665,23 @@ void intel_modeset_cleanup(struct drm_device *dev)
 		del_timer_sync(&intel_crtc->idle_timer);
 	}
 
-	intel_increase_renderclock(dev, false);
 	del_timer_sync(&dev_priv->idle_timer);
 
-	mutex_unlock(&dev->struct_mutex);
-
 	if (dev_priv->display.disable_fbc)
 		dev_priv->display.disable_fbc(dev);
 
+	if (dev_priv->pwrctx) {
+		struct drm_i915_gem_object *obj_priv;
+
+		obj_priv = dev_priv->pwrctx->driver_private;
+		I915_WRITE(PWRCTXA, obj_priv->gtt_offset &~ PWRCTX_EN);
+		I915_READ(PWRCTXA);
+		i915_gem_object_unpin(dev_priv->pwrctx);
+		drm_gem_object_unreference(dev_priv->pwrctx);
+	}
+
+	mutex_unlock(&dev->struct_mutex);
+
 	drm_mode_config_cleanup(dev);
 }
 
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index d83447557f9b..439506cefc14 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -33,7 +33,8 @@
 #include "intel_drv.h"
 #include "i915_drm.h"
 #include "i915_drv.h"
-#include "intel_dp.h"
+#include "drm_dp_helper.h"
+
 
 #define DP_LINK_STATUS_SIZE	6
 #define DP_LINK_CHECK_TIMEOUT	(10 * 1000)
@@ -124,9 +125,15 @@ intel_dp_link_clock(uint8_t link_bw)
 
 /* I think this is a fiction */
 static int
-intel_dp_link_required(int pixel_clock)
+intel_dp_link_required(struct drm_device *dev,
+		       struct intel_output *intel_output, int pixel_clock)
 {
-	return pixel_clock * 3;
+	struct drm_i915_private *dev_priv = dev->dev_private;
+
+	if (IS_eDP(intel_output))
+		return (pixel_clock * dev_priv->edp_bpp) / 8;
+	else
+		return pixel_clock * 3;
 }
 
 static int
@@ -137,7 +144,8 @@ intel_dp_mode_valid(struct drm_connector *connector,
 	int max_link_clock = intel_dp_link_clock(intel_dp_max_link_bw(intel_output));
 	int max_lanes = intel_dp_max_lane_count(intel_output);
 
-	if (intel_dp_link_required(mode->clock) > max_link_clock * max_lanes)
+	if (intel_dp_link_required(connector->dev, intel_output, mode->clock)
+			> max_link_clock * max_lanes)
 		return MODE_CLOCK_HIGH;
 
 	if (mode->clock < 10000)
@@ -223,8 +231,8 @@ intel_dp_aux_ch(struct intel_output *intel_output,
 	 */
 	if (IS_eDP(intel_output))
 		aux_clock_divider = 225; /* eDP input clock at 450Mhz */
-	else if (IS_IGDNG(dev))
-		aux_clock_divider = 62; /* IGDNG: input clock fixed at 125Mhz */
+	else if (IS_IRONLAKE(dev))
+		aux_clock_divider = 62; /* IRL input clock fixed at 125Mhz */
 	else
 		aux_clock_divider = intel_hrawclk(dev) / 2;
 
@@ -282,7 +290,7 @@ intel_dp_aux_ch(struct intel_output *intel_output,
 	/* Timeouts occur when the device isn't connected, so they're
 	 * "normal" -- don't fill the kernel log with these */
 	if (status & DP_AUX_CH_CTL_TIME_OUT_ERROR) {
-		DRM_DEBUG("dp_aux_ch timeout status 0x%08x\n", status);
+		DRM_DEBUG_KMS("dp_aux_ch timeout status 0x%08x\n", status);
 		return -ETIMEDOUT;
 	}
 
@@ -382,17 +390,77 @@ intel_dp_aux_native_read(struct intel_output *intel_output,
 }
 
 static int
-intel_dp_i2c_aux_ch(struct i2c_adapter *adapter,
-		    uint8_t *send, int send_bytes,
-		    uint8_t *recv, int recv_bytes)
+intel_dp_i2c_aux_ch(struct i2c_adapter *adapter, int mode,
+		    uint8_t write_byte, uint8_t *read_byte)
 {
+	struct i2c_algo_dp_aux_data *algo_data = adapter->algo_data;
 	struct intel_dp_priv *dp_priv = container_of(adapter,
 						     struct intel_dp_priv,
 						     adapter);
 	struct intel_output *intel_output = dp_priv->intel_output;
+	uint16_t address = algo_data->address;
+	uint8_t msg[5];
+	uint8_t reply[2];
+	int msg_bytes;
+	int reply_bytes;
+	int ret;
+
+	/* Set up the command byte */
+	if (mode & MODE_I2C_READ)
+		msg[0] = AUX_I2C_READ << 4;
+	else
+		msg[0] = AUX_I2C_WRITE << 4;
+
+	if (!(mode & MODE_I2C_STOP))
+		msg[0] |= AUX_I2C_MOT << 4;
+
+	msg[1] = address >> 8;
+	msg[2] = address;
+
+	switch (mode) {
+	case MODE_I2C_WRITE:
+		msg[3] = 0;
+		msg[4] = write_byte;
+		msg_bytes = 5;
+		reply_bytes = 1;
+		break;
+	case MODE_I2C_READ:
+		msg[3] = 0;
+		msg_bytes = 4;
+		reply_bytes = 2;
+		break;
+	default:
+		msg_bytes = 3;
+		reply_bytes = 1;
+		break;
+	}
 
-	return intel_dp_aux_ch(intel_output,
-			       send, send_bytes, recv, recv_bytes);
+	for (;;) {
+	  ret = intel_dp_aux_ch(intel_output,
+				msg, msg_bytes,
+				reply, reply_bytes);
+		if (ret < 0) {
+			DRM_DEBUG_KMS("aux_ch failed %d\n", ret);
+			return ret;
+		}
+		switch (reply[0] & AUX_I2C_REPLY_MASK) {
+		case AUX_I2C_REPLY_ACK:
+			if (mode == MODE_I2C_READ) {
+				*read_byte = reply[1];
+			}
+			return reply_bytes - 1;
+		case AUX_I2C_REPLY_NACK:
+			DRM_DEBUG_KMS("aux_ch nack\n");
+			return -EREMOTEIO;
+		case AUX_I2C_REPLY_DEFER:
+			DRM_DEBUG_KMS("aux_ch defer\n");
+			udelay(100);
+			break;
+		default:
+			DRM_ERROR("aux_ch invalid reply 0x%02x\n", reply[0]);
+			return -EREMOTEIO;
+		}
+	}
 }
 
 static int
@@ -431,11 +499,13 @@ intel_dp_mode_fixup(struct drm_encoder *encoder, struct drm_display_mode *mode,
 		for (clock = 0; clock <= max_clock; clock++) {
 			int link_avail = intel_dp_link_clock(bws[clock]) * lane_count;
 
-			if (intel_dp_link_required(mode->clock) <= link_avail) {
+			if (intel_dp_link_required(encoder->dev, intel_output, mode->clock)
+					<= link_avail) {
 				dp_priv->link_bw = bws[clock];
 				dp_priv->lane_count = lane_count;
 				adjusted_mode->clock = intel_dp_link_clock(dp_priv->link_bw);
-				DRM_DEBUG("Display port link bw %02x lane count %d clock %d\n",
+				DRM_DEBUG_KMS("Display port link bw %02x lane "
+						"count %d clock %d\n",
 				       dp_priv->link_bw, dp_priv->lane_count,
 				       adjusted_mode->clock);
 				return true;
@@ -514,7 +584,7 @@ intel_dp_set_m_n(struct drm_crtc *crtc, struct drm_display_mode *mode,
 	intel_dp_compute_m_n(3, lane_count,
 			     mode->clock, adjusted_mode->clock, &m_n);
 
-	if (IS_IGDNG(dev)) {
+	if (IS_IRONLAKE(dev)) {
 		if (intel_crtc->pipe == 0) {
 			I915_WRITE(TRANSA_DATA_M1,
 				   ((m_n.tu - 1) << PIPE_GMCH_DATA_M_TU_SIZE_SHIFT) |
@@ -606,23 +676,23 @@ intel_dp_mode_set(struct drm_encoder *encoder, struct drm_display_mode *mode,
 	}
 }
 
-static void igdng_edp_backlight_on (struct drm_device *dev)
+static void ironlake_edp_backlight_on (struct drm_device *dev)
 {
 	struct drm_i915_private *dev_priv = dev->dev_private;
 	u32 pp;
 
-	DRM_DEBUG("\n");
+	DRM_DEBUG_KMS("\n");
 	pp = I915_READ(PCH_PP_CONTROL);
 	pp |= EDP_BLC_ENABLE;
 	I915_WRITE(PCH_PP_CONTROL, pp);
 }
 
-static void igdng_edp_backlight_off (struct drm_device *dev)
+static void ironlake_edp_backlight_off (struct drm_device *dev)
 {
 	struct drm_i915_private *dev_priv = dev->dev_private;
 	u32 pp;
 
-	DRM_DEBUG("\n");
+	DRM_DEBUG_KMS("\n");
 	pp = I915_READ(PCH_PP_CONTROL);
 	pp &= ~EDP_BLC_ENABLE;
 	I915_WRITE(PCH_PP_CONTROL, pp);
@@ -641,13 +711,13 @@ intel_dp_dpms(struct drm_encoder *encoder, int mode)
 		if (dp_reg & DP_PORT_EN) {
 			intel_dp_link_down(intel_output, dp_priv->DP);
 			if (IS_eDP(intel_output))
-				igdng_edp_backlight_off(dev);
+				ironlake_edp_backlight_off(dev);
 		}
 	} else {
 		if (!(dp_reg & DP_PORT_EN)) {
 			intel_dp_link_train(intel_output, dp_priv->DP, dp_priv->link_configuration);
 			if (IS_eDP(intel_output))
-				igdng_edp_backlight_on(dev);
+				ironlake_edp_backlight_on(dev);
 		}
 	}
 	dp_priv->dpms_mode = mode;
@@ -1010,7 +1080,7 @@ intel_dp_link_down(struct intel_output *intel_output, uint32_t DP)
 	struct drm_i915_private *dev_priv = dev->dev_private;
 	struct intel_dp_priv *dp_priv = intel_output->dev_priv;
 
-	DRM_DEBUG("\n");
+	DRM_DEBUG_KMS("\n");
 
 	if (IS_eDP(intel_output)) {
 		DP &= ~DP_PLL_ENABLE;
@@ -1071,7 +1141,7 @@ intel_dp_check_link_status(struct intel_output *intel_output)
 }
 
 static enum drm_connector_status
-igdng_dp_detect(struct drm_connector *connector)
+ironlake_dp_detect(struct drm_connector *connector)
 {
 	struct intel_output *intel_output = to_intel_output(connector);
 	struct intel_dp_priv *dp_priv = intel_output->dev_priv;
@@ -1106,8 +1176,8 @@ intel_dp_detect(struct drm_connector *connector)
 
 	dp_priv->has_audio = false;
 
-	if (IS_IGDNG(dev))
-		return igdng_dp_detect(connector);
+	if (IS_IRONLAKE(dev))
+		return ironlake_dp_detect(connector);
 
 	temp = I915_READ(PORT_HOTPLUG_EN);
 
@@ -1254,18 +1324,17 @@ intel_dp_init(struct drm_device *dev, int output_reg)
 	else
 		intel_output->type = INTEL_OUTPUT_DISPLAYPORT;
 
-	if (output_reg == DP_B)
+	if (output_reg == DP_B || output_reg == PCH_DP_B)
 		intel_output->clone_mask = (1 << INTEL_DP_B_CLONE_BIT);
-	else if (output_reg == DP_C)
+	else if (output_reg == DP_C || output_reg == PCH_DP_C)
 		intel_output->clone_mask = (1 << INTEL_DP_C_CLONE_BIT);
-	else if (output_reg == DP_D)
+	else if (output_reg == DP_D || output_reg == PCH_DP_D)
 		intel_output->clone_mask = (1 << INTEL_DP_D_CLONE_BIT);
 
-	if (IS_eDP(intel_output)) {
-		intel_output->crtc_mask = (1 << 1);
+	if (IS_eDP(intel_output))
 		intel_output->clone_mask = (1 << INTEL_EDP_CLONE_BIT);
-	} else
-		intel_output->crtc_mask = (1 << 0) | (1 << 1);
+
+	intel_output->crtc_mask = (1 << 0) | (1 << 1);
 	connector->interlace_allowed = true;
 	connector->doublescan_allowed = 0;
 
@@ -1290,14 +1359,20 @@ intel_dp_init(struct drm_device *dev, int output_reg)
 			break;
 		case DP_B:
 		case PCH_DP_B:
+			dev_priv->hotplug_supported_mask |=
+				HDMIB_HOTPLUG_INT_STATUS;
 			name = "DPDDC-B";
 			break;
 		case DP_C:
 		case PCH_DP_C:
+			dev_priv->hotplug_supported_mask |=
+				HDMIC_HOTPLUG_INT_STATUS;
 			name = "DPDDC-C";
 			break;
 		case DP_D:
 		case PCH_DP_D:
+			dev_priv->hotplug_supported_mask |=
+				HDMID_HOTPLUG_INT_STATUS;
 			name = "DPDDC-D";
 			break;
 	}
diff --git a/drivers/gpu/drm/i915/intel_dp.h b/drivers/gpu/drm/i915/intel_dp.h
deleted file mode 100644
index 2b38054d3b6d..000000000000
--- a/drivers/gpu/drm/i915/intel_dp.h
+++ /dev/null
@@ -1,144 +0,0 @@
-/*
- * Copyright © 2008 Keith Packard
- *
- * Permission to use, copy, modify, distribute, and sell this software and its
- * documentation for any purpose is hereby granted without fee, provided that
- * the above copyright notice appear in all copies and that both that copyright
- * notice and this permission notice appear in supporting documentation, and
- * that the name of the copyright holders not be used in advertising or
- * publicity pertaining to distribution of the software without specific,
- * written prior permission.  The copyright holders make no representations
- * about the suitability of this software for any purpose.  It is provided "as
- * is" without express or implied warranty.
- *
- * THE COPYRIGHT HOLDERS DISCLAIM ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
- * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
- * EVENT SHALL THE COPYRIGHT HOLDERS BE LIABLE FOR ANY SPECIAL, INDIRECT OR
- * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
- * DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
- * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
- * OF THIS SOFTWARE.
- */
-
-#ifndef _INTEL_DP_H_
-#define _INTEL_DP_H_
-
-/* From the VESA DisplayPort spec */
-
-#define AUX_NATIVE_WRITE	0x8
-#define AUX_NATIVE_READ		0x9
-#define AUX_I2C_WRITE		0x0
-#define AUX_I2C_READ		0x1
-#define AUX_I2C_STATUS		0x2
-#define AUX_I2C_MOT		0x4
-
-#define AUX_NATIVE_REPLY_ACK	(0x0 << 4)
-#define AUX_NATIVE_REPLY_NACK	(0x1 << 4)
-#define AUX_NATIVE_REPLY_DEFER	(0x2 << 4)
-#define AUX_NATIVE_REPLY_MASK	(0x3 << 4)
-
-#define AUX_I2C_REPLY_ACK	(0x0 << 6)
-#define AUX_I2C_REPLY_NACK	(0x1 << 6)
-#define AUX_I2C_REPLY_DEFER	(0x2 << 6)
-#define AUX_I2C_REPLY_MASK	(0x3 << 6)
-
-/* AUX CH addresses */
-#define	DP_LINK_BW_SET		0x100
-# define DP_LINK_BW_1_62		    0x06
-# define DP_LINK_BW_2_7			    0x0a
-
-#define DP_LANE_COUNT_SET	0x101
-# define DP_LANE_COUNT_MASK		    0x0f
-# define DP_LANE_COUNT_ENHANCED_FRAME_EN    (1 << 7)
-
-#define DP_TRAINING_PATTERN_SET	0x102
-
-# define DP_TRAINING_PATTERN_DISABLE	    0
-# define DP_TRAINING_PATTERN_1		    1
-# define DP_TRAINING_PATTERN_2		    2
-# define DP_TRAINING_PATTERN_MASK	    0x3
-
-# define DP_LINK_QUAL_PATTERN_DISABLE	    (0 << 2)
-# define DP_LINK_QUAL_PATTERN_D10_2	    (1 << 2)
-# define DP_LINK_QUAL_PATTERN_ERROR_RATE    (2 << 2)
-# define DP_LINK_QUAL_PATTERN_PRBS7	    (3 << 2)
-# define DP_LINK_QUAL_PATTERN_MASK	    (3 << 2)
-
-# define DP_RECOVERED_CLOCK_OUT_EN	    (1 << 4)
-# define DP_LINK_SCRAMBLING_DISABLE	    (1 << 5)
-
-# define DP_SYMBOL_ERROR_COUNT_BOTH	    (0 << 6)
-# define DP_SYMBOL_ERROR_COUNT_DISPARITY    (1 << 6)
-# define DP_SYMBOL_ERROR_COUNT_SYMBOL	    (2 << 6)
-# define DP_SYMBOL_ERROR_COUNT_MASK	    (3 << 6)
-
-#define DP_TRAINING_LANE0_SET		    0x103
-#define DP_TRAINING_LANE1_SET		    0x104
-#define DP_TRAINING_LANE2_SET		    0x105
-#define DP_TRAINING_LANE3_SET		    0x106
-
-# define DP_TRAIN_VOLTAGE_SWING_MASK	    0x3
-# define DP_TRAIN_VOLTAGE_SWING_SHIFT	    0
-# define DP_TRAIN_MAX_SWING_REACHED	    (1 << 2)
-# define DP_TRAIN_VOLTAGE_SWING_400	    (0 << 0)
-# define DP_TRAIN_VOLTAGE_SWING_600	    (1 << 0)
-# define DP_TRAIN_VOLTAGE_SWING_800	    (2 << 0)
-# define DP_TRAIN_VOLTAGE_SWING_1200	    (3 << 0)
-
-# define DP_TRAIN_PRE_EMPHASIS_MASK	    (3 << 3)
-# define DP_TRAIN_PRE_EMPHASIS_0	    (0 << 3)
-# define DP_TRAIN_PRE_EMPHASIS_3_5	    (1 << 3)
-# define DP_TRAIN_PRE_EMPHASIS_6	    (2 << 3)
-# define DP_TRAIN_PRE_EMPHASIS_9_5	    (3 << 3)
-
-# define DP_TRAIN_PRE_EMPHASIS_SHIFT	    3
-# define DP_TRAIN_MAX_PRE_EMPHASIS_REACHED  (1 << 5)
-
-#define DP_DOWNSPREAD_CTRL		    0x107
-# define DP_SPREAD_AMP_0_5		    (1 << 4)
-
-#define DP_MAIN_LINK_CHANNEL_CODING_SET	    0x108
-# define DP_SET_ANSI_8B10B		    (1 << 0)
-
-#define DP_LANE0_1_STATUS		    0x202
-#define DP_LANE2_3_STATUS		    0x203
-
-# define DP_LANE_CR_DONE		    (1 << 0)
-# define DP_LANE_CHANNEL_EQ_DONE	    (1 << 1)
-# define DP_LANE_SYMBOL_LOCKED		    (1 << 2)
-
-#define DP_LANE_ALIGN_STATUS_UPDATED	    0x204
-
-#define DP_INTERLANE_ALIGN_DONE		    (1 << 0)
-#define DP_DOWNSTREAM_PORT_STATUS_CHANGED   (1 << 6)
-#define DP_LINK_STATUS_UPDATED		    (1 << 7)
-
-#define DP_SINK_STATUS			    0x205
-
-#define DP_RECEIVE_PORT_0_STATUS	    (1 << 0)
-#define DP_RECEIVE_PORT_1_STATUS	    (1 << 1)
-
-#define DP_ADJUST_REQUEST_LANE0_1	    0x206
-#define DP_ADJUST_REQUEST_LANE2_3	    0x207
-
-#define DP_ADJUST_VOLTAGE_SWING_LANE0_MASK  0x03
-#define DP_ADJUST_VOLTAGE_SWING_LANE0_SHIFT 0
-#define DP_ADJUST_PRE_EMPHASIS_LANE0_MASK   0x0c
-#define DP_ADJUST_PRE_EMPHASIS_LANE0_SHIFT  2
-#define DP_ADJUST_VOLTAGE_SWING_LANE1_MASK  0x30
-#define DP_ADJUST_VOLTAGE_SWING_LANE1_SHIFT 4
-#define DP_ADJUST_PRE_EMPHASIS_LANE1_MASK   0xc0
-#define DP_ADJUST_PRE_EMPHASIS_LANE1_SHIFT  6
-
-struct i2c_algo_dp_aux_data {
-	bool running;
-	u16 address;
-	int (*aux_ch) (struct i2c_adapter *adapter,
-		       uint8_t *send, int send_bytes,
-		       uint8_t *recv, int recv_bytes);
-};
-
-int
-i2c_dp_aux_add_bus(struct i2c_adapter *adapter);
-
-#endif /* _INTEL_DP_H_ */
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index ef61fe9507e2..a51573da1ff6 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -110,6 +110,32 @@ struct intel_output {
 	int clone_mask;
 };
 
+struct intel_crtc;
+struct intel_overlay {
+	struct drm_device *dev;
+	struct intel_crtc *crtc;
+	struct drm_i915_gem_object *vid_bo;
+	struct drm_i915_gem_object *old_vid_bo;
+	int active;
+	int pfit_active;
+	u32 pfit_vscale_ratio; /* shifted-point number, (1<<12) == 1.0 */
+	u32 color_key;
+	u32 brightness, contrast, saturation;
+	u32 old_xscale, old_yscale;
+	/* register access */
+	u32 flip_addr;
+	struct drm_i915_gem_object *reg_bo;
+	void *virt_addr;
+	/* flip handling */
+	uint32_t last_flip_req;
+	int hw_wedged;
+#define HW_WEDGED		1
+#define NEEDS_WAIT_FOR_FLIP	2
+#define RELEASE_OLD_VID		3
+#define SWITCH_OFF_STAGE_1	4
+#define SWITCH_OFF_STAGE_2	5
+};
+
 struct intel_crtc {
 	struct drm_crtc base;
 	enum pipe pipe;
@@ -121,6 +147,8 @@ struct intel_crtc {
 	bool busy; /* is scanout buffer being updated frequently? */
 	struct timer_list idle_timer;
 	bool lowfreq_avail;
+	struct intel_overlay *overlay;
+	struct intel_unpin_work *unpin_work;
 };
 
 #define to_intel_crtc(x) container_of(x, struct intel_crtc, base)
@@ -134,6 +162,8 @@ void intel_i2c_destroy(struct i2c_adapter *adapter);
 int intel_ddc_get_modes(struct intel_output *intel_output);
 extern bool intel_ddc_probe(struct intel_output *intel_output);
 void intel_i2c_quirk_set(struct drm_device *dev, bool enable);
+void intel_i2c_reset_gmbus(struct drm_device *dev);
+
 extern void intel_crt_init(struct drm_device *dev);
 extern void intel_hdmi_init(struct drm_device *dev, int sdvox_reg);
 extern bool intel_sdvo_init(struct drm_device *dev, int output_device);
@@ -148,6 +178,7 @@ intel_dp_set_m_n(struct drm_crtc *crtc, struct drm_display_mode *mode,
 extern void intel_edp_link_config (struct intel_output *, int *, int *);
 
 
+extern int intel_panel_fitter_pipe (struct drm_device *dev);
 extern void intel_crtc_load_lut(struct drm_crtc *crtc);
 extern void intel_encoder_prepare (struct drm_encoder *encoder);
 extern void intel_encoder_commit (struct drm_encoder *encoder);
@@ -177,10 +208,23 @@ extern void intel_crtc_fb_gamma_set(struct drm_crtc *crtc, u16 red, u16 green,
 				    u16 blue, int regno);
 extern void intel_crtc_fb_gamma_get(struct drm_crtc *crtc, u16 *red, u16 *green,
 				    u16 *blue, int regno);
+extern void intel_init_clock_gating(struct drm_device *dev);
 
 extern int intel_framebuffer_create(struct drm_device *dev,
 				    struct drm_mode_fb_cmd *mode_cmd,
 				    struct drm_framebuffer **fb,
 				    struct drm_gem_object *obj);
 
+extern void intel_prepare_page_flip(struct drm_device *dev, int plane);
+extern void intel_finish_page_flip(struct drm_device *dev, int pipe);
+
+extern void intel_setup_overlay(struct drm_device *dev);
+extern void intel_cleanup_overlay(struct drm_device *dev);
+extern int intel_overlay_switch_off(struct intel_overlay *overlay);
+extern int intel_overlay_recover_from_interrupt(struct intel_overlay *overlay,
+						int interruptible);
+extern int intel_overlay_put_image(struct drm_device *dev, void *data,
+				   struct drm_file *file_priv);
+extern int intel_overlay_attrs(struct drm_device *dev, void *data,
+			       struct drm_file *file_priv);
 #endif /* __INTEL_DRV_H__ */
diff --git a/drivers/gpu/drm/i915/intel_fb.c b/drivers/gpu/drm/i915/intel_fb.c
index 2b0fe54cd92c..371d753e362b 100644
--- a/drivers/gpu/drm/i915/intel_fb.c
+++ b/drivers/gpu/drm/i915/intel_fb.c
@@ -70,7 +70,7 @@ static struct drm_fb_helper_funcs intel_fb_helper_funcs = {
 
 
 /**
- * Curretly it is assumed that the old framebuffer is reused.
+ * Currently it is assumed that the old framebuffer is reused.
  *
  * LOCKING
  * caller should hold the mode config lock.
@@ -230,8 +230,9 @@ static int intelfb_create(struct drm_device *dev, uint32_t fb_width,
 	par->intel_fb = intel_fb;
 
 	/* To allow resizeing without swapping buffers */
-	DRM_DEBUG("allocated %dx%d fb: 0x%08x, bo %p\n", intel_fb->base.width,
-		  intel_fb->base.height, obj_priv->gtt_offset, fbo);
+	DRM_DEBUG_KMS("allocated %dx%d fb: 0x%08x, bo %p\n",
+			intel_fb->base.width, intel_fb->base.height,
+			obj_priv->gtt_offset, fbo);
 
 	mutex_unlock(&dev->struct_mutex);
 	return 0;
@@ -249,7 +250,7 @@ int intelfb_probe(struct drm_device *dev)
 {
 	int ret;
 
-	DRM_DEBUG("\n");
+	DRM_DEBUG_KMS("\n");
 	ret = drm_fb_helper_single_fb_probe(dev, 32, intelfb_create);
 	return ret;
 }
diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c
index c33451aec1bd..0e268deed761 100644
--- a/drivers/gpu/drm/i915/intel_hdmi.c
+++ b/drivers/gpu/drm/i915/intel_hdmi.c
@@ -82,7 +82,7 @@ static void intel_hdmi_dpms(struct drm_encoder *encoder, int mode)
 	/* HW workaround, need to toggle enable bit off and on for 12bpc, but
 	 * we do this anyway which shows more stable in testing.
 	 */
-	if (IS_IGDNG(dev)) {
+	if (IS_IRONLAKE(dev)) {
 		I915_WRITE(hdmi_priv->sdvox_reg, temp & ~SDVO_ENABLE);
 		POSTING_READ(hdmi_priv->sdvox_reg);
 	}
@@ -99,7 +99,7 @@ static void intel_hdmi_dpms(struct drm_encoder *encoder, int mode)
 	/* HW workaround, need to write this twice for issue that may result
 	 * in first write getting masked.
 	 */
-	if (IS_IGDNG(dev)) {
+	if (IS_IRONLAKE(dev)) {
 		I915_WRITE(hdmi_priv->sdvox_reg, temp);
 		POSTING_READ(hdmi_priv->sdvox_reg);
 	}
@@ -225,7 +225,6 @@ static const struct drm_encoder_funcs intel_hdmi_enc_funcs = {
 	.destroy = intel_hdmi_enc_destroy,
 };
 
-
 void intel_hdmi_init(struct drm_device *dev, int sdvox_reg)
 {
 	struct drm_i915_private *dev_priv = dev->dev_private;
@@ -254,21 +253,26 @@ void intel_hdmi_init(struct drm_device *dev, int sdvox_reg)
 	if (sdvox_reg == SDVOB) {
 		intel_output->clone_mask = (1 << INTEL_HDMIB_CLONE_BIT);
 		intel_output->ddc_bus = intel_i2c_create(dev, GPIOE, "HDMIB");
+		dev_priv->hotplug_supported_mask |= HDMIB_HOTPLUG_INT_STATUS;
 	} else if (sdvox_reg == SDVOC) {
 		intel_output->clone_mask = (1 << INTEL_HDMIC_CLONE_BIT);
 		intel_output->ddc_bus = intel_i2c_create(dev, GPIOD, "HDMIC");
+		dev_priv->hotplug_supported_mask |= HDMIC_HOTPLUG_INT_STATUS;
 	} else if (sdvox_reg == HDMIB) {
 		intel_output->clone_mask = (1 << INTEL_HDMID_CLONE_BIT);
 		intel_output->ddc_bus = intel_i2c_create(dev, PCH_GPIOE,
 								"HDMIB");
+		dev_priv->hotplug_supported_mask |= HDMIB_HOTPLUG_INT_STATUS;
 	} else if (sdvox_reg == HDMIC) {
 		intel_output->clone_mask = (1 << INTEL_HDMIE_CLONE_BIT);
 		intel_output->ddc_bus = intel_i2c_create(dev, PCH_GPIOD,
 								"HDMIC");
+		dev_priv->hotplug_supported_mask |= HDMIC_HOTPLUG_INT_STATUS;
 	} else if (sdvox_reg == HDMID) {
 		intel_output->clone_mask = (1 << INTEL_HDMIF_CLONE_BIT);
 		intel_output->ddc_bus = intel_i2c_create(dev, PCH_GPIOF,
 								"HDMID");
+		dev_priv->hotplug_supported_mask |= HDMID_HOTPLUG_INT_STATUS;
 	}
 	if (!intel_output->ddc_bus)
 		goto err_connector;
diff --git a/drivers/gpu/drm/i915/intel_i2c.c b/drivers/gpu/drm/i915/intel_i2c.c
index c7eab724c418..8673c735b8ab 100644
--- a/drivers/gpu/drm/i915/intel_i2c.c
+++ b/drivers/gpu/drm/i915/intel_i2c.c
@@ -39,7 +39,7 @@ void intel_i2c_quirk_set(struct drm_device *dev, bool enable)
 	struct drm_i915_private *dev_priv = dev->dev_private;
 
 	/* When using bit bashing for I2C, this bit needs to be set to 1 */
-	if (!IS_IGD(dev))
+	if (!IS_PINEVIEW(dev))
 		return;
 	if (enable)
 		I915_WRITE(DSPCLK_GATE_D,
@@ -118,6 +118,23 @@ static void set_data(void *data, int state_high)
 	udelay(I2C_RISEFALL_TIME); /* wait for the line to change state */
 }
 
+/* Clears the GMBUS setup.  Our driver doesn't make use of the GMBUS I2C
+ * engine, but if the BIOS leaves it enabled, then that can break our use
+ * of the bit-banging I2C interfaces.  This is notably the case with the
+ * Mac Mini in EFI mode.
+ */
+void
+intel_i2c_reset_gmbus(struct drm_device *dev)
+{
+	struct drm_i915_private *dev_priv = dev->dev_private;
+
+	if (IS_IRONLAKE(dev)) {
+		I915_WRITE(PCH_GMBUS0, 0);
+	} else {
+		I915_WRITE(GMBUS0, 0);
+	}
+}
+
 /**
  * intel_i2c_create - instantiate an Intel i2c bus using the specified GPIO reg
  * @dev: DRM device
@@ -168,6 +185,8 @@ struct i2c_adapter *intel_i2c_create(struct drm_device *dev, const u32 reg,
 	if(i2c_bit_add_bus(&chan->adapter))
 		goto out_free;
 
+	intel_i2c_reset_gmbus(dev);
+
 	/* JJJ:  raise SCL and SDA? */
 	intel_i2c_quirk_set(dev, true);
 	set_data(chan, 1);
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index 05598ae10c4b..aa74e59bec61 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -56,7 +56,7 @@ static void intel_lvds_set_backlight(struct drm_device *dev, int level)
 	struct drm_i915_private *dev_priv = dev->dev_private;
 	u32 blc_pwm_ctl, reg;
 
-	if (IS_IGDNG(dev))
+	if (IS_IRONLAKE(dev))
 		reg = BLC_PWM_CPU_CTL;
 	else
 		reg = BLC_PWM_CTL;
@@ -74,7 +74,7 @@ static u32 intel_lvds_get_max_backlight(struct drm_device *dev)
 	struct drm_i915_private *dev_priv = dev->dev_private;
 	u32 reg;
 
-	if (IS_IGDNG(dev))
+	if (IS_IRONLAKE(dev))
 		reg = BLC_PWM_PCH_CTL2;
 	else
 		reg = BLC_PWM_CTL;
@@ -91,7 +91,7 @@ static void intel_lvds_set_power(struct drm_device *dev, bool on)
 	struct drm_i915_private *dev_priv = dev->dev_private;
 	u32 pp_status, ctl_reg, status_reg;
 
-	if (IS_IGDNG(dev)) {
+	if (IS_IRONLAKE(dev)) {
 		ctl_reg = PCH_PP_CONTROL;
 		status_reg = PCH_PP_STATUS;
 	} else {
@@ -137,7 +137,7 @@ static void intel_lvds_save(struct drm_connector *connector)
 	u32 pp_on_reg, pp_off_reg, pp_ctl_reg, pp_div_reg;
 	u32 pwm_ctl_reg;
 
-	if (IS_IGDNG(dev)) {
+	if (IS_IRONLAKE(dev)) {
 		pp_on_reg = PCH_PP_ON_DELAYS;
 		pp_off_reg = PCH_PP_OFF_DELAYS;
 		pp_ctl_reg = PCH_PP_CONTROL;
@@ -174,7 +174,7 @@ static void intel_lvds_restore(struct drm_connector *connector)
 	u32 pp_on_reg, pp_off_reg, pp_ctl_reg, pp_div_reg;
 	u32 pwm_ctl_reg;
 
-	if (IS_IGDNG(dev)) {
+	if (IS_IRONLAKE(dev)) {
 		pp_on_reg = PCH_PP_ON_DELAYS;
 		pp_off_reg = PCH_PP_OFF_DELAYS;
 		pp_ctl_reg = PCH_PP_CONTROL;
@@ -297,7 +297,7 @@ static bool intel_lvds_mode_fixup(struct drm_encoder *encoder,
 	}
 
 	/* full screen scale for now */
-	if (IS_IGDNG(dev))
+	if (IS_IRONLAKE(dev))
 		goto out;
 
 	/* 965+ wants fuzzy fitting */
@@ -327,7 +327,7 @@ static bool intel_lvds_mode_fixup(struct drm_encoder *encoder,
 	 * to register description and PRM.
 	 * Change the value here to see the borders for debugging
 	 */
-	if (!IS_IGDNG(dev)) {
+	if (!IS_IRONLAKE(dev)) {
 		I915_WRITE(BCLRPAT_A, 0);
 		I915_WRITE(BCLRPAT_B, 0);
 	}
@@ -548,7 +548,7 @@ static void intel_lvds_prepare(struct drm_encoder *encoder)
 	struct drm_i915_private *dev_priv = dev->dev_private;
 	u32 reg;
 
-	if (IS_IGDNG(dev))
+	if (IS_IRONLAKE(dev))
 		reg = BLC_PWM_CPU_CTL;
 	else
 		reg = BLC_PWM_CTL;
@@ -587,7 +587,7 @@ static void intel_lvds_mode_set(struct drm_encoder *encoder,
 	 * settings.
 	 */
 
-	if (IS_IGDNG(dev))
+	if (IS_IRONLAKE(dev))
 		return;
 
 	/*
@@ -602,12 +602,33 @@ static void intel_lvds_mode_set(struct drm_encoder *encoder,
 /* Some lid devices report incorrect lid status, assume they're connected */
 static const struct dmi_system_id bad_lid_status[] = {
 	{
+		.ident = "Compaq nx9020",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+			DMI_MATCH(DMI_BOARD_NAME, "3084"),
+		},
+	},
+	{
+		.ident = "Samsung SX20S",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Phoenix Technologies LTD"),
+			DMI_MATCH(DMI_BOARD_NAME, "SX20S"),
+		},
+	},
+	{
 		.ident = "Aspire One",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "Aspire one"),
 		},
 	},
+	{
+		.ident = "PC-81005",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "MALATA"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "PC-81005"),
+		},
+	},
 	{ }
 };
 
@@ -679,7 +700,14 @@ static int intel_lid_notify(struct notifier_block *nb, unsigned long val,
 	struct drm_i915_private *dev_priv =
 		container_of(nb, struct drm_i915_private, lid_notifier);
 	struct drm_device *dev = dev_priv->dev;
+	struct drm_connector *connector = dev_priv->int_lvds_connector;
 
+	/*
+	 * check and update the status of LVDS connector after receiving
+	 * the LID nofication event.
+	 */
+	if (connector)
+		connector->status = connector->funcs->detect(connector);
 	if (!acpi_lid_open()) {
 		dev_priv->modeset_on_lid = 1;
 		return NOTIFY_OK;
@@ -854,64 +882,101 @@ static const struct dmi_system_id intel_no_lvds[] = {
 	{ }	/* terminating entry */
 };
 
-#ifdef CONFIG_ACPI
-/*
- * check_lid_device -- check whether @handle is an ACPI LID device.
- * @handle: ACPI device handle
- * @level : depth in the ACPI namespace tree
- * @context: the number of LID device when we find the device
- * @rv: a return value to fill if desired (Not use)
+/**
+ * intel_find_lvds_downclock - find the reduced downclock for LVDS in EDID
+ * @dev: drm device
+ * @connector: LVDS connector
+ *
+ * Find the reduced downclock for LVDS in EDID.
  */
-static acpi_status
-check_lid_device(acpi_handle handle, u32 level, void *context,
-			void **return_value)
+static void intel_find_lvds_downclock(struct drm_device *dev,
+				struct drm_connector *connector)
 {
-	struct acpi_device *acpi_dev;
-	int *lid_present = context;
-
-	acpi_dev = NULL;
-	/* Get the acpi device for device handle */
-	if (acpi_bus_get_device(handle, &acpi_dev) || !acpi_dev) {
-		/* If there is no ACPI device for handle, return */
-		return AE_OK;
-	}
+	struct drm_i915_private *dev_priv = dev->dev_private;
+	struct drm_display_mode *scan, *panel_fixed_mode;
+	int temp_downclock;
 
-	if (!strncmp(acpi_device_hid(acpi_dev), "PNP0C0D", 7))
-		*lid_present = 1;
+	panel_fixed_mode = dev_priv->panel_fixed_mode;
+	temp_downclock = panel_fixed_mode->clock;
 
-	return AE_OK;
+	mutex_lock(&dev->mode_config.mutex);
+	list_for_each_entry(scan, &connector->probed_modes, head) {
+		/*
+		 * If one mode has the same resolution with the fixed_panel
+		 * mode while they have the different refresh rate, it means
+		 * that the reduced downclock is found for the LVDS. In such
+		 * case we can set the different FPx0/1 to dynamically select
+		 * between low and high frequency.
+		 */
+		if (scan->hdisplay == panel_fixed_mode->hdisplay &&
+			scan->hsync_start == panel_fixed_mode->hsync_start &&
+			scan->hsync_end == panel_fixed_mode->hsync_end &&
+			scan->htotal == panel_fixed_mode->htotal &&
+			scan->vdisplay == panel_fixed_mode->vdisplay &&
+			scan->vsync_start == panel_fixed_mode->vsync_start &&
+			scan->vsync_end == panel_fixed_mode->vsync_end &&
+			scan->vtotal == panel_fixed_mode->vtotal) {
+			if (scan->clock < temp_downclock) {
+				/*
+				 * The downclock is already found. But we
+				 * expect to find the lower downclock.
+				 */
+				temp_downclock = scan->clock;
+			}
+		}
+	}
+	mutex_unlock(&dev->mode_config.mutex);
+	if (temp_downclock < panel_fixed_mode->clock &&
+	    i915_lvds_downclock) {
+		/* We found the downclock for LVDS. */
+		dev_priv->lvds_downclock_avail = 1;
+		dev_priv->lvds_downclock = temp_downclock;
+		DRM_DEBUG_KMS("LVDS downclock is found in EDID. "
+				"Normal clock %dKhz, downclock %dKhz\n",
+				panel_fixed_mode->clock, temp_downclock);
+	}
+	return;
 }
 
-/**
- * check whether there exists the ACPI LID device by enumerating the ACPI
- * device tree.
+/*
+ * Enumerate the child dev array parsed from VBT to check whether
+ * the LVDS is present.
+ * If it is present, return 1.
+ * If it is not present, return false.
+ * If no child dev is parsed from VBT, it assumes that the LVDS is present.
+ * Note: The addin_offset should also be checked for LVDS panel.
+ * Only when it is non-zero, it is assumed that it is present.
  */
-static int intel_lid_present(void)
+static int lvds_is_present_in_vbt(struct drm_device *dev)
 {
-	int lid_present = 0;
+	struct drm_i915_private *dev_priv = dev->dev_private;
+	struct child_device_config *p_child;
+	int i, ret;
 
-	if (acpi_disabled) {
-		/* If ACPI is disabled, there is no ACPI device tree to
-		 * check, so assume the LID device would have been present.
-		 */
+	if (!dev_priv->child_dev_num)
 		return 1;
-	}
 
-	acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT,
-				ACPI_UINT32_MAX,
-				check_lid_device, &lid_present, NULL);
+	ret = 0;
+	for (i = 0; i < dev_priv->child_dev_num; i++) {
+		p_child = dev_priv->child_dev + i;
+		/*
+		 * If the device type is not LFP, continue.
+		 * If the device type is 0x22, it is also regarded as LFP.
+		 */
+		if (p_child->device_type != DEVICE_TYPE_INT_LFP &&
+			p_child->device_type != DEVICE_TYPE_LFP)
+			continue;
 
-	return lid_present;
-}
-#else
-static int intel_lid_present(void)
-{
-	/* In the absence of ACPI built in, assume that the LID device would
-	 * have been present.
-	 */
-	return 1;
+		/* The addin_offset should be checked. Only when it is
+		 * non-zero, it is regarded as present.
+		 */
+		if (p_child->addin_offset) {
+			ret = 1;
+			break;
+		}
+	}
+	return ret;
 }
-#endif
 
 /**
  * intel_lvds_init - setup LVDS connectors on this device
@@ -936,21 +1001,16 @@ void intel_lvds_init(struct drm_device *dev)
 	if (dmi_check_system(intel_no_lvds))
 		return;
 
-	/* Assume that any device without an ACPI LID device also doesn't
-	 * have an integrated LVDS.  We would be better off parsing the BIOS
-	 * to get a reliable indicator, but that code isn't written yet.
-	 *
-	 * In the case of all-in-one desktops using LVDS that we've seen,
-	 * they're using SDVO LVDS.
-	 */
-	if (!intel_lid_present())
+	if (!lvds_is_present_in_vbt(dev)) {
+		DRM_DEBUG_KMS("LVDS is not present in VBT\n");
 		return;
+	}
 
-	if (IS_IGDNG(dev)) {
+	if (IS_IRONLAKE(dev)) {
 		if ((I915_READ(PCH_LVDS) & LVDS_DETECTED) == 0)
 			return;
 		if (dev_priv->edp_support) {
-			DRM_DEBUG("disable LVDS for eDP support\n");
+			DRM_DEBUG_KMS("disable LVDS for eDP support\n");
 			return;
 		}
 		gpio = PCH_GPIOC;
@@ -1023,6 +1083,7 @@ void intel_lvds_init(struct drm_device *dev)
 			dev_priv->panel_fixed_mode =
 				drm_mode_duplicate(dev, scan);
 			mutex_unlock(&dev->mode_config.mutex);
+			intel_find_lvds_downclock(dev, connector);
 			goto out;
 		}
 		mutex_unlock(&dev->mode_config.mutex);
@@ -1047,8 +1108,8 @@ void intel_lvds_init(struct drm_device *dev)
 	 * correct mode.
 	 */
 
-	/* IGDNG: FIXME if still fail, not try pipe mode now */
-	if (IS_IGDNG(dev))
+	/* Ironlake: FIXME if still fail, not try pipe mode now */
+	if (IS_IRONLAKE(dev))
 		goto failed;
 
 	lvds = I915_READ(LVDS);
@@ -1069,7 +1130,7 @@ void intel_lvds_init(struct drm_device *dev)
 		goto failed;
 
 out:
-	if (IS_IGDNG(dev)) {
+	if (IS_IRONLAKE(dev)) {
 		u32 pwm;
 		/* make sure PWM is enabled */
 		pwm = I915_READ(BLC_PWM_CPU_CTL2);
@@ -1082,9 +1143,11 @@ out:
 	}
 	dev_priv->lid_notifier.notifier_call = intel_lid_notify;
 	if (acpi_lid_notifier_register(&dev_priv->lid_notifier)) {
-		DRM_DEBUG("lid notifier registration failed\n");
+		DRM_DEBUG_KMS("lid notifier registration failed\n");
 		dev_priv->lid_notifier.notifier_call = NULL;
 	}
+	/* keep the LVDS connector */
+	dev_priv->int_lvds_connector = connector;
 	drm_sysfs_connector_add(connector);
 	return;
 
@@ -1093,5 +1156,6 @@ failed:
 	if (intel_output->ddc_bus)
 		intel_i2c_destroy(intel_output->ddc_bus);
 	drm_connector_cleanup(connector);
+	drm_encoder_cleanup(encoder);
 	kfree(intel_output);
 }
diff --git a/drivers/gpu/drm/i915/intel_overlay.c b/drivers/gpu/drm/i915/intel_overlay.c
new file mode 100644
index 000000000000..2639591c72e9
--- /dev/null
+++ b/drivers/gpu/drm/i915/intel_overlay.c
@@ -0,0 +1,1416 @@
+/*
+ * Copyright © 2009
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ *
+ * Authors:
+ *    Daniel Vetter <daniel@ffwll.ch>
+ *
+ * Derived from Xorg ddx, xf86-video-intel, src/i830_video.c
+ */
+#include "drmP.h"
+#include "drm.h"
+#include "i915_drm.h"
+#include "i915_drv.h"
+#include "i915_reg.h"
+#include "intel_drv.h"
+
+/* Limits for overlay size. According to intel doc, the real limits are:
+ * Y width: 4095, UV width (planar): 2047, Y height: 2047,
+ * UV width (planar): * 1023. But the xorg thinks 2048 for height and width. Use
+ * the mininum of both.  */
+#define IMAGE_MAX_WIDTH		2048
+#define IMAGE_MAX_HEIGHT	2046 /* 2 * 1023 */
+/* on 830 and 845 these large limits result in the card hanging */
+#define IMAGE_MAX_WIDTH_LEGACY	1024
+#define IMAGE_MAX_HEIGHT_LEGACY	1088
+
+/* overlay register definitions */
+/* OCMD register */
+#define OCMD_TILED_SURFACE	(0x1<<19)
+#define OCMD_MIRROR_MASK	(0x3<<17)
+#define OCMD_MIRROR_MODE	(0x3<<17)
+#define OCMD_MIRROR_HORIZONTAL	(0x1<<17)
+#define OCMD_MIRROR_VERTICAL	(0x2<<17)
+#define OCMD_MIRROR_BOTH	(0x3<<17)
+#define OCMD_BYTEORDER_MASK	(0x3<<14) /* zero for YUYV or FOURCC YUY2 */
+#define OCMD_UV_SWAP		(0x1<<14) /* YVYU */
+#define OCMD_Y_SWAP		(0x2<<14) /* UYVY or FOURCC UYVY */
+#define OCMD_Y_AND_UV_SWAP	(0x3<<14) /* VYUY */
+#define OCMD_SOURCE_FORMAT_MASK (0xf<<10)
+#define OCMD_RGB_888		(0x1<<10) /* not in i965 Intel docs */
+#define OCMD_RGB_555		(0x2<<10) /* not in i965 Intel docs */
+#define OCMD_RGB_565		(0x3<<10) /* not in i965 Intel docs */
+#define OCMD_YUV_422_PACKED	(0x8<<10)
+#define OCMD_YUV_411_PACKED	(0x9<<10) /* not in i965 Intel docs */
+#define OCMD_YUV_420_PLANAR	(0xc<<10)
+#define OCMD_YUV_422_PLANAR	(0xd<<10)
+#define OCMD_YUV_410_PLANAR	(0xe<<10) /* also 411 */
+#define OCMD_TVSYNCFLIP_PARITY	(0x1<<9)
+#define OCMD_TVSYNCFLIP_ENABLE	(0x1<<7)
+#define OCMD_BUF_TYPE_MASK	(Ox1<<5)
+#define OCMD_BUF_TYPE_FRAME	(0x0<<5)
+#define OCMD_BUF_TYPE_FIELD	(0x1<<5)
+#define OCMD_TEST_MODE		(0x1<<4)
+#define OCMD_BUFFER_SELECT	(0x3<<2)
+#define OCMD_BUFFER0		(0x0<<2)
+#define OCMD_BUFFER1		(0x1<<2)
+#define OCMD_FIELD_SELECT	(0x1<<2)
+#define OCMD_FIELD0		(0x0<<1)
+#define OCMD_FIELD1		(0x1<<1)
+#define OCMD_ENABLE		(0x1<<0)
+
+/* OCONFIG register */
+#define OCONF_PIPE_MASK		(0x1<<18)
+#define OCONF_PIPE_A		(0x0<<18)
+#define OCONF_PIPE_B		(0x1<<18)
+#define OCONF_GAMMA2_ENABLE	(0x1<<16)
+#define OCONF_CSC_MODE_BT601	(0x0<<5)
+#define OCONF_CSC_MODE_BT709	(0x1<<5)
+#define OCONF_CSC_BYPASS	(0x1<<4)
+#define OCONF_CC_OUT_8BIT	(0x1<<3)
+#define OCONF_TEST_MODE		(0x1<<2)
+#define OCONF_THREE_LINE_BUFFER	(0x1<<0)
+#define OCONF_TWO_LINE_BUFFER	(0x0<<0)
+
+/* DCLRKM (dst-key) register */
+#define DST_KEY_ENABLE		(0x1<<31)
+#define CLK_RGB24_MASK		0x0
+#define CLK_RGB16_MASK		0x070307
+#define CLK_RGB15_MASK		0x070707
+#define CLK_RGB8I_MASK		0xffffff
+
+#define RGB16_TO_COLORKEY(c) \
+	(((c & 0xF800) << 8) | ((c & 0x07E0) << 5) | ((c & 0x001F) << 3))
+#define RGB15_TO_COLORKEY(c) \
+	(((c & 0x7c00) << 9) | ((c & 0x03E0) << 6) | ((c & 0x001F) << 3))
+
+/* overlay flip addr flag */
+#define OFC_UPDATE		0x1
+
+/* polyphase filter coefficients */
+#define N_HORIZ_Y_TAPS          5
+#define N_VERT_Y_TAPS           3
+#define N_HORIZ_UV_TAPS         3
+#define N_VERT_UV_TAPS          3
+#define N_PHASES                17
+#define MAX_TAPS                5
+
+/* memory bufferd overlay registers */
+struct overlay_registers {
+    u32 OBUF_0Y;
+    u32 OBUF_1Y;
+    u32 OBUF_0U;
+    u32 OBUF_0V;
+    u32 OBUF_1U;
+    u32 OBUF_1V;
+    u32 OSTRIDE;
+    u32 YRGB_VPH;
+    u32 UV_VPH;
+    u32 HORZ_PH;
+    u32 INIT_PHS;
+    u32 DWINPOS;
+    u32 DWINSZ;
+    u32 SWIDTH;
+    u32 SWIDTHSW;
+    u32 SHEIGHT;
+    u32 YRGBSCALE;
+    u32 UVSCALE;
+    u32 OCLRC0;
+    u32 OCLRC1;
+    u32 DCLRKV;
+    u32 DCLRKM;
+    u32 SCLRKVH;
+    u32 SCLRKVL;
+    u32 SCLRKEN;
+    u32 OCONFIG;
+    u32 OCMD;
+    u32 RESERVED1; /* 0x6C */
+    u32 OSTART_0Y;
+    u32 OSTART_1Y;
+    u32 OSTART_0U;
+    u32 OSTART_0V;
+    u32 OSTART_1U;
+    u32 OSTART_1V;
+    u32 OTILEOFF_0Y;
+    u32 OTILEOFF_1Y;
+    u32 OTILEOFF_0U;
+    u32 OTILEOFF_0V;
+    u32 OTILEOFF_1U;
+    u32 OTILEOFF_1V;
+    u32 FASTHSCALE; /* 0xA0 */
+    u32 UVSCALEV; /* 0xA4 */
+    u32 RESERVEDC[(0x200 - 0xA8) / 4]; /* 0xA8 - 0x1FC */
+    u16 Y_VCOEFS[N_VERT_Y_TAPS * N_PHASES]; /* 0x200 */
+    u16 RESERVEDD[0x100 / 2 - N_VERT_Y_TAPS * N_PHASES];
+    u16 Y_HCOEFS[N_HORIZ_Y_TAPS * N_PHASES]; /* 0x300 */
+    u16 RESERVEDE[0x200 / 2 - N_HORIZ_Y_TAPS * N_PHASES];
+    u16 UV_VCOEFS[N_VERT_UV_TAPS * N_PHASES]; /* 0x500 */
+    u16 RESERVEDF[0x100 / 2 - N_VERT_UV_TAPS * N_PHASES];
+    u16 UV_HCOEFS[N_HORIZ_UV_TAPS * N_PHASES]; /* 0x600 */
+    u16 RESERVEDG[0x100 / 2 - N_HORIZ_UV_TAPS * N_PHASES];
+};
+
+/* overlay flip addr flag */
+#define OFC_UPDATE		0x1
+
+#define OVERLAY_NONPHYSICAL(dev) (IS_G33(dev) || IS_I965G(dev))
+#define OVERLAY_EXISTS(dev) (!IS_G4X(dev) && !IS_IRONLAKE(dev))
+
+
+static struct overlay_registers *intel_overlay_map_regs_atomic(struct intel_overlay *overlay)
+{
+        drm_i915_private_t *dev_priv = overlay->dev->dev_private;
+	struct overlay_registers *regs;
+
+	/* no recursive mappings */
+	BUG_ON(overlay->virt_addr);
+
+	if (OVERLAY_NONPHYSICAL(overlay->dev)) {
+		regs = io_mapping_map_atomic_wc(dev_priv->mm.gtt_mapping,
+				overlay->reg_bo->gtt_offset);
+
+		if (!regs) {
+			DRM_ERROR("failed to map overlay regs in GTT\n");
+			return NULL;
+		}
+	} else
+		regs = overlay->reg_bo->phys_obj->handle->vaddr;
+
+	return overlay->virt_addr = regs;
+}
+
+static void intel_overlay_unmap_regs_atomic(struct intel_overlay *overlay)
+{
+	struct drm_device *dev = overlay->dev;
+        drm_i915_private_t *dev_priv = dev->dev_private;
+
+	if (OVERLAY_NONPHYSICAL(overlay->dev))
+		io_mapping_unmap_atomic(overlay->virt_addr);
+
+	overlay->virt_addr = NULL;
+
+	I915_READ(OVADD); /* flush wc cashes */
+
+	return;
+}
+
+/* overlay needs to be disable in OCMD reg */
+static int intel_overlay_on(struct intel_overlay *overlay)
+{
+	struct drm_device *dev = overlay->dev;
+        drm_i915_private_t *dev_priv = dev->dev_private;
+	int ret;
+	RING_LOCALS;
+
+	BUG_ON(overlay->active);
+
+	overlay->active = 1;
+	overlay->hw_wedged = NEEDS_WAIT_FOR_FLIP;
+
+	BEGIN_LP_RING(6);
+	OUT_RING(MI_FLUSH);
+	OUT_RING(MI_NOOP);
+	OUT_RING(MI_OVERLAY_FLIP | MI_OVERLAY_ON);
+	OUT_RING(overlay->flip_addr | OFC_UPDATE);
+	OUT_RING(MI_WAIT_FOR_EVENT | MI_WAIT_FOR_OVERLAY_FLIP);
+	OUT_RING(MI_NOOP);
+	ADVANCE_LP_RING();
+
+	overlay->last_flip_req = i915_add_request(dev, NULL, 0);
+	if (overlay->last_flip_req == 0)
+		return -ENOMEM;
+
+	ret = i915_do_wait_request(dev, overlay->last_flip_req, 1);
+	if (ret != 0)
+		return ret;
+
+	overlay->hw_wedged = 0;
+	overlay->last_flip_req = 0;
+	return 0;
+}
+
+/* overlay needs to be enabled in OCMD reg */
+static void intel_overlay_continue(struct intel_overlay *overlay,
+			    bool load_polyphase_filter)
+{
+	struct drm_device *dev = overlay->dev;
+        drm_i915_private_t *dev_priv = dev->dev_private;
+	u32 flip_addr = overlay->flip_addr;
+	u32 tmp;
+	RING_LOCALS;
+
+	BUG_ON(!overlay->active);
+
+	if (load_polyphase_filter)
+		flip_addr |= OFC_UPDATE;
+
+	/* check for underruns */
+	tmp = I915_READ(DOVSTA);
+	if (tmp & (1 << 17))
+		DRM_DEBUG("overlay underrun, DOVSTA: %x\n", tmp);
+
+	BEGIN_LP_RING(4);
+	OUT_RING(MI_FLUSH);
+	OUT_RING(MI_NOOP);
+	OUT_RING(MI_OVERLAY_FLIP | MI_OVERLAY_CONTINUE);
+	OUT_RING(flip_addr);
+        ADVANCE_LP_RING();
+
+	overlay->last_flip_req = i915_add_request(dev, NULL, 0);
+}
+
+static int intel_overlay_wait_flip(struct intel_overlay *overlay)
+{
+	struct drm_device *dev = overlay->dev;
+        drm_i915_private_t *dev_priv = dev->dev_private;
+	int ret;
+	u32 tmp;
+	RING_LOCALS;
+
+	if (overlay->last_flip_req != 0) {
+		ret = i915_do_wait_request(dev, overlay->last_flip_req, 1);
+		if (ret == 0) {
+			overlay->last_flip_req = 0;
+
+			tmp = I915_READ(ISR);
+
+			if (!(tmp & I915_OVERLAY_PLANE_FLIP_PENDING_INTERRUPT))
+				return 0;
+		}
+	}
+
+	/* synchronous slowpath */
+	overlay->hw_wedged = RELEASE_OLD_VID;
+
+	BEGIN_LP_RING(2);
+        OUT_RING(MI_WAIT_FOR_EVENT | MI_WAIT_FOR_OVERLAY_FLIP);
+        OUT_RING(MI_NOOP);
+        ADVANCE_LP_RING();
+
+	overlay->last_flip_req = i915_add_request(dev, NULL, 0);
+	if (overlay->last_flip_req == 0)
+		return -ENOMEM;
+
+	ret = i915_do_wait_request(dev, overlay->last_flip_req, 1);
+	if (ret != 0)
+		return ret;
+
+	overlay->hw_wedged = 0;
+	overlay->last_flip_req = 0;
+	return 0;
+}
+
+/* overlay needs to be disabled in OCMD reg */
+static int intel_overlay_off(struct intel_overlay *overlay)
+{
+	u32 flip_addr = overlay->flip_addr;
+	struct drm_device *dev = overlay->dev;
+        drm_i915_private_t *dev_priv = dev->dev_private;
+	int ret;
+	RING_LOCALS;
+
+	BUG_ON(!overlay->active);
+
+	/* According to intel docs the overlay hw may hang (when switching
+	 * off) without loading the filter coeffs. It is however unclear whether
+	 * this applies to the disabling of the overlay or to the switching off
+	 * of the hw. Do it in both cases */
+	flip_addr |= OFC_UPDATE;
+
+	/* wait for overlay to go idle */
+	overlay->hw_wedged = SWITCH_OFF_STAGE_1;
+
+	BEGIN_LP_RING(6);
+	OUT_RING(MI_FLUSH);
+	OUT_RING(MI_NOOP);
+	OUT_RING(MI_OVERLAY_FLIP | MI_OVERLAY_CONTINUE);
+	OUT_RING(flip_addr);
+        OUT_RING(MI_WAIT_FOR_EVENT | MI_WAIT_FOR_OVERLAY_FLIP);
+        OUT_RING(MI_NOOP);
+        ADVANCE_LP_RING();
+
+	overlay->last_flip_req = i915_add_request(dev, NULL, 0);
+	if (overlay->last_flip_req == 0)
+		return -ENOMEM;
+
+	ret = i915_do_wait_request(dev, overlay->last_flip_req, 1);
+	if (ret != 0)
+		return ret;
+
+	/* turn overlay off */
+	overlay->hw_wedged = SWITCH_OFF_STAGE_2;
+
+	BEGIN_LP_RING(6);
+        OUT_RING(MI_FLUSH);
+        OUT_RING(MI_NOOP);
+        OUT_RING(MI_OVERLAY_FLIP | MI_OVERLAY_OFF);
+	OUT_RING(flip_addr);
+        OUT_RING(MI_WAIT_FOR_EVENT | MI_WAIT_FOR_OVERLAY_FLIP);
+        OUT_RING(MI_NOOP);
+	ADVANCE_LP_RING();
+
+	overlay->last_flip_req = i915_add_request(dev, NULL, 0);
+	if (overlay->last_flip_req == 0)
+		return -ENOMEM;
+
+	ret = i915_do_wait_request(dev, overlay->last_flip_req, 1);
+	if (ret != 0)
+		return ret;
+
+	overlay->hw_wedged = 0;
+	overlay->last_flip_req = 0;
+	return ret;
+}
+
+static void intel_overlay_off_tail(struct intel_overlay *overlay)
+{
+	struct drm_gem_object *obj;
+
+	/* never have the overlay hw on without showing a frame */
+	BUG_ON(!overlay->vid_bo);
+	obj = overlay->vid_bo->obj;
+
+	i915_gem_object_unpin(obj);
+	drm_gem_object_unreference(obj);
+	overlay->vid_bo = NULL;
+
+	overlay->crtc->overlay = NULL;
+	overlay->crtc = NULL;
+	overlay->active = 0;
+}
+
+/* recover from an interruption due to a signal
+ * We have to be careful not to repeat work forever an make forward progess. */
+int intel_overlay_recover_from_interrupt(struct intel_overlay *overlay,
+					 int interruptible)
+{
+	struct drm_device *dev = overlay->dev;
+        drm_i915_private_t *dev_priv = dev->dev_private;
+	struct drm_gem_object *obj;
+	u32 flip_addr;
+	int ret;
+	RING_LOCALS;
+
+	if (overlay->hw_wedged == HW_WEDGED)
+		return -EIO;
+
+	if (overlay->last_flip_req == 0) {
+		overlay->last_flip_req = i915_add_request(dev, NULL, 0);
+		if (overlay->last_flip_req == 0)
+			return -ENOMEM;
+	}
+
+	ret = i915_do_wait_request(dev, overlay->last_flip_req, interruptible);
+	if (ret != 0)
+		return ret;
+
+	switch (overlay->hw_wedged) {
+		case RELEASE_OLD_VID:
+			obj = overlay->old_vid_bo->obj;
+			i915_gem_object_unpin(obj);
+			drm_gem_object_unreference(obj);
+			overlay->old_vid_bo = NULL;
+			break;
+		case SWITCH_OFF_STAGE_1:
+			flip_addr = overlay->flip_addr;
+			flip_addr |= OFC_UPDATE;
+
+			overlay->hw_wedged = SWITCH_OFF_STAGE_2;
+
+			BEGIN_LP_RING(6);
+			OUT_RING(MI_FLUSH);
+			OUT_RING(MI_NOOP);
+			OUT_RING(MI_OVERLAY_FLIP | MI_OVERLAY_OFF);
+			OUT_RING(flip_addr);
+			OUT_RING(MI_WAIT_FOR_EVENT | MI_WAIT_FOR_OVERLAY_FLIP);
+			OUT_RING(MI_NOOP);
+			ADVANCE_LP_RING();
+
+			overlay->last_flip_req = i915_add_request(dev, NULL, 0);
+			if (overlay->last_flip_req == 0)
+				return -ENOMEM;
+
+			ret = i915_do_wait_request(dev, overlay->last_flip_req,
+					interruptible);
+			if (ret != 0)
+				return ret;
+
+		case SWITCH_OFF_STAGE_2:
+			intel_overlay_off_tail(overlay);
+			break;
+		default:
+			BUG_ON(overlay->hw_wedged != NEEDS_WAIT_FOR_FLIP);
+	}
+
+	overlay->hw_wedged = 0;
+	overlay->last_flip_req = 0;
+	return 0;
+}
+
+/* Wait for pending overlay flip and release old frame.
+ * Needs to be called before the overlay register are changed
+ * via intel_overlay_(un)map_regs_atomic */
+static int intel_overlay_release_old_vid(struct intel_overlay *overlay)
+{
+	int ret;
+	struct drm_gem_object *obj;
+
+	/* only wait if there is actually an old frame to release to
+	 * guarantee forward progress */
+	if (!overlay->old_vid_bo)
+		return 0;
+
+	ret = intel_overlay_wait_flip(overlay);
+	if (ret != 0)
+		return ret;
+
+	obj = overlay->old_vid_bo->obj;
+	i915_gem_object_unpin(obj);
+	drm_gem_object_unreference(obj);
+	overlay->old_vid_bo = NULL;
+
+	return 0;
+}
+
+struct put_image_params {
+	int format;
+	short dst_x;
+	short dst_y;
+	short dst_w;
+	short dst_h;
+	short src_w;
+	short src_scan_h;
+	short src_scan_w;
+	short src_h;
+	short stride_Y;
+	short stride_UV;
+	int offset_Y;
+	int offset_U;
+	int offset_V;
+};
+
+static int packed_depth_bytes(u32 format)
+{
+	switch (format & I915_OVERLAY_DEPTH_MASK) {
+		case I915_OVERLAY_YUV422:
+			return 4;
+		case I915_OVERLAY_YUV411:
+			/* return 6; not implemented */
+		default:
+			return -EINVAL;
+	}
+}
+
+static int packed_width_bytes(u32 format, short width)
+{
+	switch (format & I915_OVERLAY_DEPTH_MASK) {
+		case I915_OVERLAY_YUV422:
+			return width << 1;
+		default:
+			return -EINVAL;
+	}
+}
+
+static int uv_hsubsampling(u32 format)
+{
+	switch (format & I915_OVERLAY_DEPTH_MASK) {
+		case I915_OVERLAY_YUV422:
+		case I915_OVERLAY_YUV420:
+			return 2;
+		case I915_OVERLAY_YUV411:
+		case I915_OVERLAY_YUV410:
+			return 4;
+		default:
+			return -EINVAL;
+	}
+}
+
+static int uv_vsubsampling(u32 format)
+{
+	switch (format & I915_OVERLAY_DEPTH_MASK) {
+		case I915_OVERLAY_YUV420:
+		case I915_OVERLAY_YUV410:
+			return 2;
+		case I915_OVERLAY_YUV422:
+		case I915_OVERLAY_YUV411:
+			return 1;
+		default:
+			return -EINVAL;
+	}
+}
+
+static u32 calc_swidthsw(struct drm_device *dev, u32 offset, u32 width)
+{
+	u32 mask, shift, ret;
+	if (IS_I9XX(dev)) {
+		mask = 0x3f;
+		shift = 6;
+	} else {
+		mask = 0x1f;
+		shift = 5;
+	}
+	ret = ((offset + width + mask) >> shift) - (offset >> shift);
+	if (IS_I9XX(dev))
+		ret <<= 1;
+	ret -=1;
+	return ret << 2;
+}
+
+static const u16 y_static_hcoeffs[N_HORIZ_Y_TAPS * N_PHASES] = {
+	0x3000, 0xb4a0, 0x1930, 0x1920, 0xb4a0,
+	0x3000, 0xb500, 0x19d0, 0x1880, 0xb440,
+	0x3000, 0xb540, 0x1a88, 0x2f80, 0xb3e0,
+	0x3000, 0xb580, 0x1b30, 0x2e20, 0xb380,
+	0x3000, 0xb5c0, 0x1bd8, 0x2cc0, 0xb320,
+	0x3020, 0xb5e0, 0x1c60, 0x2b80, 0xb2c0,
+	0x3020, 0xb5e0, 0x1cf8, 0x2a20, 0xb260,
+	0x3020, 0xb5e0, 0x1d80, 0x28e0, 0xb200,
+	0x3020, 0xb5c0, 0x1e08, 0x3f40, 0xb1c0,
+	0x3020, 0xb580, 0x1e78, 0x3ce0, 0xb160,
+	0x3040, 0xb520, 0x1ed8, 0x3aa0, 0xb120,
+	0x3040, 0xb4a0, 0x1f30, 0x3880, 0xb0e0,
+	0x3040, 0xb400, 0x1f78, 0x3680, 0xb0a0,
+	0x3020, 0xb340, 0x1fb8, 0x34a0, 0xb060,
+	0x3020, 0xb240, 0x1fe0, 0x32e0, 0xb040,
+	0x3020, 0xb140, 0x1ff8, 0x3160, 0xb020,
+	0xb000, 0x3000, 0x0800, 0x3000, 0xb000};
+static const u16 uv_static_hcoeffs[N_HORIZ_UV_TAPS * N_PHASES] = {
+	0x3000, 0x1800, 0x1800, 0xb000, 0x18d0, 0x2e60,
+	0xb000, 0x1990, 0x2ce0, 0xb020, 0x1a68, 0x2b40,
+	0xb040, 0x1b20, 0x29e0, 0xb060, 0x1bd8, 0x2880,
+	0xb080, 0x1c88, 0x3e60, 0xb0a0, 0x1d28, 0x3c00,
+	0xb0c0, 0x1db8, 0x39e0, 0xb0e0, 0x1e40, 0x37e0,
+	0xb100, 0x1eb8, 0x3620, 0xb100, 0x1f18, 0x34a0,
+	0xb100, 0x1f68, 0x3360, 0xb0e0, 0x1fa8, 0x3240,
+	0xb0c0, 0x1fe0, 0x3140, 0xb060, 0x1ff0, 0x30a0,
+	0x3000, 0x0800, 0x3000};
+
+static void update_polyphase_filter(struct overlay_registers *regs)
+{
+	memcpy(regs->Y_HCOEFS, y_static_hcoeffs, sizeof(y_static_hcoeffs));
+	memcpy(regs->UV_HCOEFS, uv_static_hcoeffs, sizeof(uv_static_hcoeffs));
+}
+
+static bool update_scaling_factors(struct intel_overlay *overlay,
+				   struct overlay_registers *regs,
+				   struct put_image_params *params)
+{
+	/* fixed point with a 12 bit shift */
+	u32 xscale, yscale, xscale_UV, yscale_UV;
+#define FP_SHIFT 12
+#define FRACT_MASK 0xfff
+	bool scale_changed = false;
+	int uv_hscale = uv_hsubsampling(params->format);
+	int uv_vscale = uv_vsubsampling(params->format);
+
+	if (params->dst_w > 1)
+		xscale = ((params->src_scan_w - 1) << FP_SHIFT)
+			/(params->dst_w);
+	else
+		xscale = 1 << FP_SHIFT;
+
+	if (params->dst_h > 1)
+		yscale = ((params->src_scan_h - 1) << FP_SHIFT)
+			/(params->dst_h);
+	else
+		yscale = 1 << FP_SHIFT;
+
+	/*if (params->format & I915_OVERLAY_YUV_PLANAR) {*/
+		xscale_UV = xscale/uv_hscale;
+		yscale_UV = yscale/uv_vscale;
+		/* make the Y scale to UV scale ratio an exact multiply */
+		xscale = xscale_UV * uv_hscale;
+		yscale = yscale_UV * uv_vscale;
+	/*} else {
+		xscale_UV = 0;
+		yscale_UV = 0;
+	}*/
+
+	if (xscale != overlay->old_xscale || yscale != overlay->old_yscale)
+		scale_changed = true;
+	overlay->old_xscale = xscale;
+	overlay->old_yscale = yscale;
+
+	regs->YRGBSCALE = ((yscale & FRACT_MASK) << 20)
+		| ((xscale >> FP_SHIFT) << 16)
+		| ((xscale & FRACT_MASK) << 3);
+	regs->UVSCALE = ((yscale_UV & FRACT_MASK) << 20)
+		| ((xscale_UV >> FP_SHIFT) << 16)
+		| ((xscale_UV & FRACT_MASK) << 3);
+	regs->UVSCALEV = ((yscale >> FP_SHIFT) << 16)
+		| ((yscale_UV >> FP_SHIFT) << 0);
+
+	if (scale_changed)
+		update_polyphase_filter(regs);
+
+	return scale_changed;
+}
+
+static void update_colorkey(struct intel_overlay *overlay,
+			    struct overlay_registers *regs)
+{
+	u32 key = overlay->color_key;
+	switch (overlay->crtc->base.fb->bits_per_pixel) {
+		case 8:
+			regs->DCLRKV = 0;
+			regs->DCLRKM = CLK_RGB8I_MASK | DST_KEY_ENABLE;
+		case 16:
+			if (overlay->crtc->base.fb->depth == 15) {
+				regs->DCLRKV = RGB15_TO_COLORKEY(key);
+				regs->DCLRKM = CLK_RGB15_MASK | DST_KEY_ENABLE;
+			} else {
+				regs->DCLRKV = RGB16_TO_COLORKEY(key);
+				regs->DCLRKM = CLK_RGB16_MASK | DST_KEY_ENABLE;
+			}
+		case 24:
+		case 32:
+			regs->DCLRKV = key;
+			regs->DCLRKM = CLK_RGB24_MASK | DST_KEY_ENABLE;
+	}
+}
+
+static u32 overlay_cmd_reg(struct put_image_params *params)
+{
+	u32 cmd = OCMD_ENABLE | OCMD_BUF_TYPE_FRAME | OCMD_BUFFER0;
+
+	if (params->format & I915_OVERLAY_YUV_PLANAR) {
+		switch (params->format & I915_OVERLAY_DEPTH_MASK) {
+			case I915_OVERLAY_YUV422:
+				cmd |= OCMD_YUV_422_PLANAR;
+				break;
+			case I915_OVERLAY_YUV420:
+				cmd |= OCMD_YUV_420_PLANAR;
+				break;
+			case I915_OVERLAY_YUV411:
+			case I915_OVERLAY_YUV410:
+				cmd |= OCMD_YUV_410_PLANAR;
+				break;
+		}
+	} else { /* YUV packed */
+		switch (params->format & I915_OVERLAY_DEPTH_MASK) {
+			case I915_OVERLAY_YUV422:
+				cmd |= OCMD_YUV_422_PACKED;
+				break;
+			case I915_OVERLAY_YUV411:
+				cmd |= OCMD_YUV_411_PACKED;
+				break;
+		}
+
+		switch (params->format & I915_OVERLAY_SWAP_MASK) {
+			case I915_OVERLAY_NO_SWAP:
+				break;
+			case I915_OVERLAY_UV_SWAP:
+				cmd |= OCMD_UV_SWAP;
+				break;
+			case I915_OVERLAY_Y_SWAP:
+				cmd |= OCMD_Y_SWAP;
+				break;
+			case I915_OVERLAY_Y_AND_UV_SWAP:
+				cmd |= OCMD_Y_AND_UV_SWAP;
+				break;
+		}
+	}
+
+	return cmd;
+}
+
+int intel_overlay_do_put_image(struct intel_overlay *overlay,
+			       struct drm_gem_object *new_bo,
+			       struct put_image_params *params)
+{
+	int ret, tmp_width;
+	struct overlay_registers *regs;
+	bool scale_changed = false;
+	struct drm_i915_gem_object *bo_priv = new_bo->driver_private;
+	struct drm_device *dev = overlay->dev;
+
+	BUG_ON(!mutex_is_locked(&dev->struct_mutex));
+	BUG_ON(!mutex_is_locked(&dev->mode_config.mutex));
+	BUG_ON(!overlay);
+
+	ret = intel_overlay_release_old_vid(overlay);
+	if (ret != 0)
+		return ret;
+
+	ret = i915_gem_object_pin(new_bo, PAGE_SIZE);
+	if (ret != 0)
+		return ret;
+
+	ret = i915_gem_object_set_to_gtt_domain(new_bo, 0);
+	if (ret != 0)
+		goto out_unpin;
+
+	if (!overlay->active) {
+		regs = intel_overlay_map_regs_atomic(overlay);
+		if (!regs) {
+			ret = -ENOMEM;
+			goto out_unpin;
+		}
+		regs->OCONFIG = OCONF_CC_OUT_8BIT;
+		if (IS_I965GM(overlay->dev))
+			regs->OCONFIG |= OCONF_CSC_MODE_BT709;
+		regs->OCONFIG |= overlay->crtc->pipe == 0 ?
+			OCONF_PIPE_A : OCONF_PIPE_B;
+		intel_overlay_unmap_regs_atomic(overlay);
+
+		ret = intel_overlay_on(overlay);
+		if (ret != 0)
+			goto out_unpin;
+	}
+
+	regs = intel_overlay_map_regs_atomic(overlay);
+	if (!regs) {
+		ret = -ENOMEM;
+		goto out_unpin;
+	}
+
+	regs->DWINPOS = (params->dst_y << 16) | params->dst_x;
+	regs->DWINSZ = (params->dst_h << 16) | params->dst_w;
+
+	if (params->format & I915_OVERLAY_YUV_PACKED)
+		tmp_width = packed_width_bytes(params->format, params->src_w);
+	else
+		tmp_width = params->src_w;
+
+	regs->SWIDTH = params->src_w;
+	regs->SWIDTHSW = calc_swidthsw(overlay->dev,
+			params->offset_Y, tmp_width);
+	regs->SHEIGHT = params->src_h;
+	regs->OBUF_0Y = bo_priv->gtt_offset + params-> offset_Y;
+	regs->OSTRIDE = params->stride_Y;
+
+	if (params->format & I915_OVERLAY_YUV_PLANAR) {
+		int uv_hscale = uv_hsubsampling(params->format);
+		int uv_vscale = uv_vsubsampling(params->format);
+		u32 tmp_U, tmp_V;
+		regs->SWIDTH |= (params->src_w/uv_hscale) << 16;
+		tmp_U = calc_swidthsw(overlay->dev, params->offset_U,
+				params->src_w/uv_hscale);
+		tmp_V = calc_swidthsw(overlay->dev, params->offset_V,
+				params->src_w/uv_hscale);
+		regs->SWIDTHSW |= max_t(u32, tmp_U, tmp_V) << 16;
+		regs->SHEIGHT |= (params->src_h/uv_vscale) << 16;
+		regs->OBUF_0U = bo_priv->gtt_offset + params->offset_U;
+		regs->OBUF_0V = bo_priv->gtt_offset + params->offset_V;
+		regs->OSTRIDE |= params->stride_UV << 16;
+	}
+
+	scale_changed = update_scaling_factors(overlay, regs, params);
+
+	update_colorkey(overlay, regs);
+
+	regs->OCMD = overlay_cmd_reg(params);
+
+	intel_overlay_unmap_regs_atomic(overlay);
+
+	intel_overlay_continue(overlay, scale_changed);
+
+	overlay->old_vid_bo = overlay->vid_bo;
+	overlay->vid_bo = new_bo->driver_private;
+
+	return 0;
+
+out_unpin:
+	i915_gem_object_unpin(new_bo);
+	return ret;
+}
+
+int intel_overlay_switch_off(struct intel_overlay *overlay)
+{
+	int ret;
+	struct overlay_registers *regs;
+	struct drm_device *dev = overlay->dev;
+
+	BUG_ON(!mutex_is_locked(&dev->struct_mutex));
+	BUG_ON(!mutex_is_locked(&dev->mode_config.mutex));
+
+	if (overlay->hw_wedged) {
+		ret = intel_overlay_recover_from_interrupt(overlay, 1);
+		if (ret != 0)
+			return ret;
+	}
+
+	if (!overlay->active)
+		return 0;
+
+	ret = intel_overlay_release_old_vid(overlay);
+	if (ret != 0)
+		return ret;
+
+	regs = intel_overlay_map_regs_atomic(overlay);
+	regs->OCMD = 0;
+	intel_overlay_unmap_regs_atomic(overlay);
+
+	ret = intel_overlay_off(overlay);
+	if (ret != 0)
+		return ret;
+
+	intel_overlay_off_tail(overlay);
+
+	return 0;
+}
+
+static int check_overlay_possible_on_crtc(struct intel_overlay *overlay,
+					  struct intel_crtc *crtc)
+{
+        drm_i915_private_t *dev_priv = overlay->dev->dev_private;
+	u32 pipeconf;
+	int pipeconf_reg = (crtc->pipe == 0) ? PIPEACONF : PIPEBCONF;
+
+	if (!crtc->base.enabled || crtc->dpms_mode != DRM_MODE_DPMS_ON)
+		return -EINVAL;
+
+	pipeconf = I915_READ(pipeconf_reg);
+
+	/* can't use the overlay with double wide pipe */
+	if (!IS_I965G(overlay->dev) && pipeconf & PIPEACONF_DOUBLE_WIDE)
+		return -EINVAL;
+
+	return 0;
+}
+
+static void update_pfit_vscale_ratio(struct intel_overlay *overlay)
+{
+	struct drm_device *dev = overlay->dev;
+        drm_i915_private_t *dev_priv = dev->dev_private;
+	u32 ratio;
+	u32 pfit_control = I915_READ(PFIT_CONTROL);
+
+	/* XXX: This is not the same logic as in the xorg driver, but more in
+	 * line with the intel documentation for the i965 */
+	if (!IS_I965G(dev) && (pfit_control & VERT_AUTO_SCALE)) {
+		ratio = I915_READ(PFIT_AUTO_RATIOS) >> PFIT_VERT_SCALE_SHIFT;
+	} else { /* on i965 use the PGM reg to read out the autoscaler values */
+		ratio = I915_READ(PFIT_PGM_RATIOS);
+		if (IS_I965G(dev))
+			ratio >>= PFIT_VERT_SCALE_SHIFT_965;
+		else
+			ratio >>= PFIT_VERT_SCALE_SHIFT;
+	}
+
+	overlay->pfit_vscale_ratio = ratio;
+}
+
+static int check_overlay_dst(struct intel_overlay *overlay,
+			     struct drm_intel_overlay_put_image *rec)
+{
+	struct drm_display_mode *mode = &overlay->crtc->base.mode;
+
+	if ((rec->dst_x < mode->crtc_hdisplay)
+	    && (rec->dst_x + rec->dst_width
+		    <= mode->crtc_hdisplay)
+	    && (rec->dst_y < mode->crtc_vdisplay)
+	    && (rec->dst_y + rec->dst_height
+		    <= mode->crtc_vdisplay))
+		return 0;
+	else
+		return -EINVAL;
+}
+
+static int check_overlay_scaling(struct put_image_params *rec)
+{
+	u32 tmp;
+
+	/* downscaling limit is 8.0 */
+	tmp = ((rec->src_scan_h << 16) / rec->dst_h) >> 16;
+	if (tmp > 7)
+		return -EINVAL;
+	tmp = ((rec->src_scan_w << 16) / rec->dst_w) >> 16;
+	if (tmp > 7)
+		return -EINVAL;
+
+	return 0;
+}
+
+static int check_overlay_src(struct drm_device *dev,
+			     struct drm_intel_overlay_put_image *rec,
+			     struct drm_gem_object *new_bo)
+{
+	u32 stride_mask;
+	int depth;
+	int uv_hscale = uv_hsubsampling(rec->flags);
+	int uv_vscale = uv_vsubsampling(rec->flags);
+	size_t tmp;
+
+	/* check src dimensions */
+	if (IS_845G(dev) || IS_I830(dev)) {
+		if (rec->src_height > IMAGE_MAX_HEIGHT_LEGACY
+		    || rec->src_width > IMAGE_MAX_WIDTH_LEGACY)
+			return -EINVAL;
+	} else {
+		if (rec->src_height > IMAGE_MAX_HEIGHT
+		    || rec->src_width > IMAGE_MAX_WIDTH)
+			return -EINVAL;
+	}
+	/* better safe than sorry, use 4 as the maximal subsampling ratio */
+	if (rec->src_height < N_VERT_Y_TAPS*4
+	    || rec->src_width < N_HORIZ_Y_TAPS*4)
+		return -EINVAL;
+
+	/* check alingment constrains */
+	switch (rec->flags & I915_OVERLAY_TYPE_MASK) {
+		case I915_OVERLAY_RGB:
+			/* not implemented */
+			return -EINVAL;
+		case I915_OVERLAY_YUV_PACKED:
+			depth = packed_depth_bytes(rec->flags);
+			if (uv_vscale != 1)
+				return -EINVAL;
+			if (depth < 0)
+				return depth;
+			/* ignore UV planes */
+			rec->stride_UV = 0;
+			rec->offset_U = 0;
+			rec->offset_V = 0;
+			/* check pixel alignment */
+			if (rec->offset_Y % depth)
+				return -EINVAL;
+			break;
+		case I915_OVERLAY_YUV_PLANAR:
+			if (uv_vscale < 0 || uv_hscale < 0)
+				return -EINVAL;
+			/* no offset restrictions for planar formats */
+			break;
+		default:
+			return -EINVAL;
+	}
+
+	if (rec->src_width % uv_hscale)
+		return -EINVAL;
+
+	/* stride checking */
+	stride_mask = 63;
+
+	if (rec->stride_Y & stride_mask || rec->stride_UV & stride_mask)
+		return -EINVAL;
+	if (IS_I965G(dev) && rec->stride_Y < 512)
+		return -EINVAL;
+
+	tmp = (rec->flags & I915_OVERLAY_TYPE_MASK) == I915_OVERLAY_YUV_PLANAR ?
+		4 : 8;
+	if (rec->stride_Y > tmp*1024 || rec->stride_UV > 2*1024)
+		return -EINVAL;
+
+	/* check buffer dimensions */
+	switch (rec->flags & I915_OVERLAY_TYPE_MASK) {
+		case I915_OVERLAY_RGB:
+		case I915_OVERLAY_YUV_PACKED:
+			/* always 4 Y values per depth pixels */
+			if (packed_width_bytes(rec->flags, rec->src_width)
+					> rec->stride_Y)
+				return -EINVAL;
+
+			tmp = rec->stride_Y*rec->src_height;
+			if (rec->offset_Y + tmp > new_bo->size)
+				return -EINVAL;
+			break;
+		case I915_OVERLAY_YUV_PLANAR:
+			if (rec->src_width > rec->stride_Y)
+				return -EINVAL;
+			if (rec->src_width/uv_hscale > rec->stride_UV)
+				return -EINVAL;
+
+			tmp = rec->stride_Y*rec->src_height;
+			if (rec->offset_Y + tmp > new_bo->size)
+				return -EINVAL;
+			tmp = rec->stride_UV*rec->src_height;
+			tmp /= uv_vscale;
+			if (rec->offset_U + tmp > new_bo->size
+			    || rec->offset_V + tmp > new_bo->size)
+				return -EINVAL;
+			break;
+	}
+
+	return 0;
+}
+
+int intel_overlay_put_image(struct drm_device *dev, void *data,
+                            struct drm_file *file_priv)
+{
+	struct drm_intel_overlay_put_image *put_image_rec = data;
+	drm_i915_private_t *dev_priv = dev->dev_private;
+	struct intel_overlay *overlay;
+	struct drm_mode_object *drmmode_obj;
+	struct intel_crtc *crtc;
+	struct drm_gem_object *new_bo;
+	struct put_image_params *params;
+	int ret;
+
+	if (!dev_priv) {
+		DRM_ERROR("called with no initialization\n");
+		return -EINVAL;
+	}
+
+	overlay = dev_priv->overlay;
+	if (!overlay) {
+		DRM_DEBUG("userspace bug: no overlay\n");
+		return -ENODEV;
+	}
+
+	if (!(put_image_rec->flags & I915_OVERLAY_ENABLE)) {
+		mutex_lock(&dev->mode_config.mutex);
+		mutex_lock(&dev->struct_mutex);
+
+		ret = intel_overlay_switch_off(overlay);
+
+		mutex_unlock(&dev->struct_mutex);
+		mutex_unlock(&dev->mode_config.mutex);
+
+		return ret;
+	}
+
+	params = kmalloc(sizeof(struct put_image_params), GFP_KERNEL);
+	if (!params)
+		return -ENOMEM;
+
+	drmmode_obj = drm_mode_object_find(dev, put_image_rec->crtc_id,
+                        DRM_MODE_OBJECT_CRTC);
+	if (!drmmode_obj)
+		return -ENOENT;
+	crtc = to_intel_crtc(obj_to_crtc(drmmode_obj));
+
+	new_bo = drm_gem_object_lookup(dev, file_priv,
+			put_image_rec->bo_handle);
+	if (!new_bo)
+		return -ENOENT;
+
+	mutex_lock(&dev->mode_config.mutex);
+	mutex_lock(&dev->struct_mutex);
+
+	if (overlay->hw_wedged) {
+		ret = intel_overlay_recover_from_interrupt(overlay, 1);
+		if (ret != 0)
+			goto out_unlock;
+	}
+
+	if (overlay->crtc != crtc) {
+		struct drm_display_mode *mode = &crtc->base.mode;
+		ret = intel_overlay_switch_off(overlay);
+		if (ret != 0)
+			goto out_unlock;
+
+		ret = check_overlay_possible_on_crtc(overlay, crtc);
+		if (ret != 0)
+			goto out_unlock;
+
+		overlay->crtc = crtc;
+		crtc->overlay = overlay;
+
+		if (intel_panel_fitter_pipe(dev) == crtc->pipe
+		    /* and line to wide, i.e. one-line-mode */
+		    && mode->hdisplay > 1024) {
+			overlay->pfit_active = 1;
+			update_pfit_vscale_ratio(overlay);
+		} else
+			overlay->pfit_active = 0;
+	}
+
+	ret = check_overlay_dst(overlay, put_image_rec);
+	if (ret != 0)
+		goto out_unlock;
+
+	if (overlay->pfit_active) {
+		params->dst_y = ((((u32)put_image_rec->dst_y) << 12) /
+			overlay->pfit_vscale_ratio);
+		/* shifting right rounds downwards, so add 1 */
+		params->dst_h = ((((u32)put_image_rec->dst_height) << 12) /
+			overlay->pfit_vscale_ratio) + 1;
+	} else {
+		params->dst_y = put_image_rec->dst_y;
+		params->dst_h = put_image_rec->dst_height;
+	}
+	params->dst_x = put_image_rec->dst_x;
+	params->dst_w = put_image_rec->dst_width;
+
+	params->src_w = put_image_rec->src_width;
+	params->src_h = put_image_rec->src_height;
+	params->src_scan_w = put_image_rec->src_scan_width;
+	params->src_scan_h = put_image_rec->src_scan_height;
+	if (params->src_scan_h > params->src_h
+	    || params->src_scan_w > params->src_w) {
+		ret = -EINVAL;
+		goto out_unlock;
+	}
+
+	ret = check_overlay_src(dev, put_image_rec, new_bo);
+	if (ret != 0)
+		goto out_unlock;
+	params->format = put_image_rec->flags & ~I915_OVERLAY_FLAGS_MASK;
+	params->stride_Y = put_image_rec->stride_Y;
+	params->stride_UV = put_image_rec->stride_UV;
+	params->offset_Y = put_image_rec->offset_Y;
+	params->offset_U = put_image_rec->offset_U;
+	params->offset_V = put_image_rec->offset_V;
+
+	/* Check scaling after src size to prevent a divide-by-zero. */
+	ret = check_overlay_scaling(params);
+	if (ret != 0)
+		goto out_unlock;
+
+	ret = intel_overlay_do_put_image(overlay, new_bo, params);
+	if (ret != 0)
+		goto out_unlock;
+
+	mutex_unlock(&dev->struct_mutex);
+	mutex_unlock(&dev->mode_config.mutex);
+
+	kfree(params);
+
+	return 0;
+
+out_unlock:
+	mutex_unlock(&dev->struct_mutex);
+	mutex_unlock(&dev->mode_config.mutex);
+	drm_gem_object_unreference(new_bo);
+	kfree(params);
+
+	return ret;
+}
+
+static void update_reg_attrs(struct intel_overlay *overlay,
+			     struct overlay_registers *regs)
+{
+	regs->OCLRC0 = (overlay->contrast << 18) | (overlay->brightness & 0xff);
+	regs->OCLRC1 = overlay->saturation;
+}
+
+static bool check_gamma_bounds(u32 gamma1, u32 gamma2)
+{
+	int i;
+
+	if (gamma1 & 0xff000000 || gamma2 & 0xff000000)
+		return false;
+
+	for (i = 0; i < 3; i++) {
+		if (((gamma1 >> i * 8) & 0xff) >= ((gamma2 >> i*8) & 0xff))
+			return false;
+	}
+
+	return true;
+}
+
+static bool check_gamma5_errata(u32 gamma5)
+{
+	int i;
+
+	for (i = 0; i < 3; i++) {
+		if (((gamma5 >> i*8) & 0xff) == 0x80)
+			return false;
+	}
+
+	return true;
+}
+
+static int check_gamma(struct drm_intel_overlay_attrs *attrs)
+{
+	if (!check_gamma_bounds(0, attrs->gamma0)
+	    || !check_gamma_bounds(attrs->gamma0, attrs->gamma1)
+	    || !check_gamma_bounds(attrs->gamma1, attrs->gamma2)
+	    || !check_gamma_bounds(attrs->gamma2, attrs->gamma3)
+	    || !check_gamma_bounds(attrs->gamma3, attrs->gamma4)
+	    || !check_gamma_bounds(attrs->gamma4, attrs->gamma5)
+	    || !check_gamma_bounds(attrs->gamma5, 0x00ffffff))
+		return -EINVAL;
+	if (!check_gamma5_errata(attrs->gamma5))
+		return -EINVAL;
+	return 0;
+}
+
+int intel_overlay_attrs(struct drm_device *dev, void *data,
+                        struct drm_file *file_priv)
+{
+	struct drm_intel_overlay_attrs *attrs = data;
+        drm_i915_private_t *dev_priv = dev->dev_private;
+	struct intel_overlay *overlay;
+	struct overlay_registers *regs;
+	int ret;
+
+	if (!dev_priv) {
+		DRM_ERROR("called with no initialization\n");
+		return -EINVAL;
+	}
+
+	overlay = dev_priv->overlay;
+	if (!overlay) {
+		DRM_DEBUG("userspace bug: no overlay\n");
+		return -ENODEV;
+	}
+
+	mutex_lock(&dev->mode_config.mutex);
+	mutex_lock(&dev->struct_mutex);
+
+	if (!(attrs->flags & I915_OVERLAY_UPDATE_ATTRS)) {
+		attrs->color_key = overlay->color_key;
+		attrs->brightness = overlay->brightness;
+		attrs->contrast = overlay->contrast;
+		attrs->saturation = overlay->saturation;
+
+		if (IS_I9XX(dev)) {
+			attrs->gamma0 = I915_READ(OGAMC0);
+			attrs->gamma1 = I915_READ(OGAMC1);
+			attrs->gamma2 = I915_READ(OGAMC2);
+			attrs->gamma3 = I915_READ(OGAMC3);
+			attrs->gamma4 = I915_READ(OGAMC4);
+			attrs->gamma5 = I915_READ(OGAMC5);
+		}
+		ret = 0;
+	} else {
+		overlay->color_key = attrs->color_key;
+		if (attrs->brightness >= -128 && attrs->brightness <= 127) {
+			overlay->brightness = attrs->brightness;
+		} else {
+			ret = -EINVAL;
+			goto out_unlock;
+		}
+		if (attrs->contrast <= 255) {
+			overlay->contrast = attrs->contrast;
+		} else {
+			ret = -EINVAL;
+			goto out_unlock;
+		}
+		if (attrs->saturation <= 1023) {
+			overlay->saturation = attrs->saturation;
+		} else {
+			ret = -EINVAL;
+			goto out_unlock;
+		}
+
+		regs = intel_overlay_map_regs_atomic(overlay);
+		if (!regs) {
+			ret = -ENOMEM;
+			goto out_unlock;
+		}
+
+		update_reg_attrs(overlay, regs);
+
+		intel_overlay_unmap_regs_atomic(overlay);
+
+		if (attrs->flags & I915_OVERLAY_UPDATE_GAMMA) {
+			if (!IS_I9XX(dev)) {
+				ret = -EINVAL;
+				goto out_unlock;
+			}
+
+			if (overlay->active) {
+				ret = -EBUSY;
+				goto out_unlock;
+			}
+
+			ret = check_gamma(attrs);
+			if (ret != 0)
+				goto out_unlock;
+
+			I915_WRITE(OGAMC0, attrs->gamma0);
+			I915_WRITE(OGAMC1, attrs->gamma1);
+			I915_WRITE(OGAMC2, attrs->gamma2);
+			I915_WRITE(OGAMC3, attrs->gamma3);
+			I915_WRITE(OGAMC4, attrs->gamma4);
+			I915_WRITE(OGAMC5, attrs->gamma5);
+		}
+		ret = 0;
+	}
+
+out_unlock:
+	mutex_unlock(&dev->struct_mutex);
+	mutex_unlock(&dev->mode_config.mutex);
+
+	return ret;
+}
+
+void intel_setup_overlay(struct drm_device *dev)
+{
+        drm_i915_private_t *dev_priv = dev->dev_private;
+	struct intel_overlay *overlay;
+	struct drm_gem_object *reg_bo;
+	struct overlay_registers *regs;
+	int ret;
+
+	if (!OVERLAY_EXISTS(dev))
+		return;
+
+	overlay = kzalloc(sizeof(struct intel_overlay), GFP_KERNEL);
+	if (!overlay)
+		return;
+	overlay->dev = dev;
+
+	reg_bo = drm_gem_object_alloc(dev, PAGE_SIZE);
+	if (!reg_bo)
+		goto out_free;
+	overlay->reg_bo = reg_bo->driver_private;
+
+	if (OVERLAY_NONPHYSICAL(dev)) {
+		ret = i915_gem_object_pin(reg_bo, PAGE_SIZE);
+		if (ret) {
+                        DRM_ERROR("failed to pin overlay register bo\n");
+                        goto out_free_bo;
+                }
+		overlay->flip_addr = overlay->reg_bo->gtt_offset;
+	} else {
+		ret = i915_gem_attach_phys_object(dev, reg_bo,
+				I915_GEM_PHYS_OVERLAY_REGS);
+                if (ret) {
+                        DRM_ERROR("failed to attach phys overlay regs\n");
+                        goto out_free_bo;
+                }
+		overlay->flip_addr = overlay->reg_bo->phys_obj->handle->busaddr;
+	}
+
+	/* init all values */
+	overlay->color_key = 0x0101fe;
+	overlay->brightness = -19;
+	overlay->contrast = 75;
+	overlay->saturation = 146;
+
+	regs = intel_overlay_map_regs_atomic(overlay);
+	if (!regs)
+		goto out_free_bo;
+
+	memset(regs, 0, sizeof(struct overlay_registers));
+	update_polyphase_filter(regs);
+
+	update_reg_attrs(overlay, regs);
+
+	intel_overlay_unmap_regs_atomic(overlay);
+
+	dev_priv->overlay = overlay;
+	DRM_INFO("initialized overlay support\n");
+	return;
+
+out_free_bo:
+	drm_gem_object_unreference(reg_bo);
+out_free:
+	kfree(overlay);
+	return;
+}
+
+void intel_cleanup_overlay(struct drm_device *dev)
+{
+        drm_i915_private_t *dev_priv = dev->dev_private;
+
+	if (dev_priv->overlay) {
+		/* The bo's should be free'd by the generic code already.
+		 * Furthermore modesetting teardown happens beforehand so the
+		 * hardware should be off already */
+		BUG_ON(dev_priv->overlay->active);
+
+		kfree(dev_priv->overlay);
+	}
+}
diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
index 083bec2e50f9..eaacfd0920df 100644
--- a/drivers/gpu/drm/i915/intel_sdvo.c
+++ b/drivers/gpu/drm/i915/intel_sdvo.c
@@ -36,8 +36,6 @@
 #include "i915_drv.h"
 #include "intel_sdvo_regs.h"
 
-#undef SDVO_DEBUG
-
 static char *tv_format_names[] = {
 	"NTSC_M"   , "NTSC_J"  , "NTSC_443",
 	"PAL_B"    , "PAL_D"   , "PAL_G"   ,
@@ -356,7 +354,6 @@ static const struct _sdvo_cmd_name {
 #define SDVO_NAME(dev_priv) ((dev_priv)->output_device == SDVOB ? "SDVOB" : "SDVOC")
 #define SDVO_PRIV(output)   ((struct intel_sdvo_priv *) (output)->dev_priv)
 
-#ifdef SDVO_DEBUG
 static void intel_sdvo_debug_write(struct intel_output *intel_output, u8 cmd,
 				   void *args, int args_len)
 {
@@ -379,9 +376,6 @@ static void intel_sdvo_debug_write(struct intel_output *intel_output, u8 cmd,
 		DRM_LOG_KMS("(%02X)", cmd);
 	DRM_LOG_KMS("\n");
 }
-#else
-#define intel_sdvo_debug_write(o, c, a, l)
-#endif
 
 static void intel_sdvo_write_cmd(struct intel_output *intel_output, u8 cmd,
 				 void *args, int args_len)
@@ -398,7 +392,6 @@ static void intel_sdvo_write_cmd(struct intel_output *intel_output, u8 cmd,
 	intel_sdvo_write_byte(intel_output, SDVO_I2C_OPCODE, cmd);
 }
 
-#ifdef SDVO_DEBUG
 static const char *cmd_status_names[] = {
 	"Power on",
 	"Success",
@@ -427,9 +420,6 @@ static void intel_sdvo_debug_response(struct intel_output *intel_output,
 		DRM_LOG_KMS("(??? %d)", status);
 	DRM_LOG_KMS("\n");
 }
-#else
-#define intel_sdvo_debug_response(o, r, l, s)
-#endif
 
 static u8 intel_sdvo_read_response(struct intel_output *intel_output,
 				   void *response, int response_len)
@@ -472,14 +462,63 @@ static int intel_sdvo_get_pixel_multiplier(struct drm_display_mode *mode)
 }
 
 /**
- * Don't check status code from this as it switches the bus back to the
- * SDVO chips which defeats the purpose of doing a bus switch in the first
- * place.
+ * Try to read the response after issuie the DDC switch command. But it
+ * is noted that we must do the action of reading response and issuing DDC
+ * switch command in one I2C transaction. Otherwise when we try to start
+ * another I2C transaction after issuing the DDC bus switch, it will be
+ * switched to the internal SDVO register.
  */
 static void intel_sdvo_set_control_bus_switch(struct intel_output *intel_output,
 					      u8 target)
 {
-	intel_sdvo_write_cmd(intel_output, SDVO_CMD_SET_CONTROL_BUS_SWITCH, &target, 1);
+	struct intel_sdvo_priv *sdvo_priv = intel_output->dev_priv;
+	u8 out_buf[2], cmd_buf[2], ret_value[2], ret;
+	struct i2c_msg msgs[] = {
+		{
+			.addr = sdvo_priv->slave_addr >> 1,
+			.flags = 0,
+			.len = 2,
+			.buf = out_buf,
+		},
+		/* the following two are to read the response */
+		{
+			.addr = sdvo_priv->slave_addr >> 1,
+			.flags = 0,
+			.len = 1,
+			.buf = cmd_buf,
+		},
+		{
+			.addr = sdvo_priv->slave_addr >> 1,
+			.flags = I2C_M_RD,
+			.len = 1,
+			.buf = ret_value,
+		},
+	};
+
+	intel_sdvo_debug_write(intel_output, SDVO_CMD_SET_CONTROL_BUS_SWITCH,
+					&target, 1);
+	/* write the DDC switch command argument */
+	intel_sdvo_write_byte(intel_output, SDVO_I2C_ARG_0, target);
+
+	out_buf[0] = SDVO_I2C_OPCODE;
+	out_buf[1] = SDVO_CMD_SET_CONTROL_BUS_SWITCH;
+	cmd_buf[0] = SDVO_I2C_CMD_STATUS;
+	cmd_buf[1] = 0;
+	ret_value[0] = 0;
+	ret_value[1] = 0;
+
+	ret = i2c_transfer(intel_output->i2c_bus, msgs, 3);
+	if (ret != 3) {
+		/* failure in I2C transfer */
+		DRM_DEBUG_KMS("I2c transfer returned %d\n", ret);
+		return;
+	}
+	if (ret_value[0] != SDVO_CMD_STATUS_SUCCESS) {
+		DRM_DEBUG_KMS("DDC switch command returns response %d\n",
+					ret_value[0]);
+		return;
+	}
+	return;
 }
 
 static bool intel_sdvo_set_target_input(struct intel_output *intel_output, bool target_0, bool target_1)
@@ -1589,6 +1628,32 @@ intel_sdvo_hdmi_sink_detect(struct drm_connector *connector, u16 response)
 	edid = drm_get_edid(&intel_output->base,
 			    intel_output->ddc_bus);
 
+	/* This is only applied to SDVO cards with multiple outputs */
+	if (edid == NULL && intel_sdvo_multifunc_encoder(intel_output)) {
+		uint8_t saved_ddc, temp_ddc;
+		saved_ddc = sdvo_priv->ddc_bus;
+		temp_ddc = sdvo_priv->ddc_bus >> 1;
+		/*
+		 * Don't use the 1 as the argument of DDC bus switch to get
+		 * the EDID. It is used for SDVO SPD ROM.
+		 */
+		while(temp_ddc > 1) {
+			sdvo_priv->ddc_bus = temp_ddc;
+			edid = drm_get_edid(&intel_output->base,
+				intel_output->ddc_bus);
+			if (edid) {
+				/*
+				 * When we can get the EDID, maybe it is the
+				 * correct DDC bus. Update it.
+				 */
+				sdvo_priv->ddc_bus = temp_ddc;
+				break;
+			}
+			temp_ddc >>= 1;
+		}
+		if (edid == NULL)
+			sdvo_priv->ddc_bus = saved_ddc;
+	}
 	/* when there is no edid and no monitor is connected with VGA
 	 * port, try to use the CRT ddc to read the EDID for DVI-connector
 	 */
@@ -1627,6 +1692,10 @@ static enum drm_connector_status intel_sdvo_detect(struct drm_connector *connect
 
 	intel_sdvo_write_cmd(intel_output,
 			     SDVO_CMD_GET_ATTACHED_DISPLAYS, NULL, 0);
+	if (sdvo_priv->is_tv) {
+		/* add 30ms delay when the output type is SDVO-TV */
+		mdelay(30);
+	}
 	status = intel_sdvo_read_response(intel_output, &response, 2);
 
 	DRM_DEBUG_KMS("SDVO response %d %d\n", response & 0xff, response >> 8);
@@ -2668,6 +2737,7 @@ static void intel_sdvo_create_enhance_property(struct drm_connector *connector)
 
 bool intel_sdvo_init(struct drm_device *dev, int output_device)
 {
+	struct drm_i915_private *dev_priv = dev->dev_private;
 	struct drm_connector *connector;
 	struct intel_output *intel_output;
 	struct intel_sdvo_priv *sdvo_priv;
@@ -2714,10 +2784,12 @@ bool intel_sdvo_init(struct drm_device *dev, int output_device)
 		intel_output->ddc_bus = intel_i2c_create(dev, GPIOE, "SDVOB DDC BUS");
 		sdvo_priv->analog_ddc_bus = intel_i2c_create(dev, GPIOA,
 						"SDVOB/VGA DDC BUS");
+		dev_priv->hotplug_supported_mask |= SDVOB_HOTPLUG_INT_STATUS;
 	} else {
 		intel_output->ddc_bus = intel_i2c_create(dev, GPIOE, "SDVOC DDC BUS");
 		sdvo_priv->analog_ddc_bus = intel_i2c_create(dev, GPIOA,
 						"SDVOC/VGA DDC BUS");
+		dev_priv->hotplug_supported_mask |= SDVOC_HOTPLUG_INT_STATUS;
 	}
 
 	if (intel_output->ddc_bus == NULL)
@@ -2726,7 +2798,7 @@ bool intel_sdvo_init(struct drm_device *dev, int output_device)
 	/* Wrap with our custom algo which switches to DDC mode */
 	intel_output->ddc_bus->algo = &intel_sdvo_i2c_bit_algo;
 
-	/* In defaut case sdvo lvds is false */
+	/* In default case sdvo lvds is false */
 	intel_sdvo_get_capabilities(intel_output, &sdvo_priv->caps);
 
 	if (intel_sdvo_output_setup(intel_output,
diff --git a/drivers/gpu/drm/i915/intel_tv.c b/drivers/gpu/drm/i915/intel_tv.c
index 9ca917931afb..552ec110b741 100644
--- a/drivers/gpu/drm/i915/intel_tv.c
+++ b/drivers/gpu/drm/i915/intel_tv.c
@@ -1213,20 +1213,17 @@ intel_tv_mode_set(struct drm_encoder *encoder, struct drm_display_mode *mode,
 		tv_ctl |= TV_TRILEVEL_SYNC;
 	if (tv_mode->pal_burst)
 		tv_ctl |= TV_PAL_BURST;
+
 	scctl1 = 0;
-	/* dda1 implies valid video levels */
-	if (tv_mode->dda1_inc) {
+	if (tv_mode->dda1_inc)
 		scctl1 |= TV_SC_DDA1_EN;
-	}
-
 	if (tv_mode->dda2_inc)
 		scctl1 |= TV_SC_DDA2_EN;
-
 	if (tv_mode->dda3_inc)
 		scctl1 |= TV_SC_DDA3_EN;
-
 	scctl1 |= tv_mode->sc_reset;
-	scctl1 |= video_levels->burst << TV_BURST_LEVEL_SHIFT;
+	if (video_levels)
+		scctl1 |= video_levels->burst << TV_BURST_LEVEL_SHIFT;
 	scctl1 |= tv_mode->dda1_inc << TV_SCDDA1_INC_SHIFT;
 
 	scctl2 = tv_mode->dda2_size << TV_SCDDA2_SIZE_SHIFT |
@@ -1416,16 +1413,16 @@ intel_tv_detect_type (struct drm_crtc *crtc, struct intel_output *intel_output)
 	 *  0 0 0 Component
 	 */
 	if ((tv_dac & TVDAC_SENSE_MASK) == (TVDAC_B_SENSE | TVDAC_C_SENSE)) {
-		DRM_DEBUG("Detected Composite TV connection\n");
+		DRM_DEBUG_KMS("Detected Composite TV connection\n");
 		type = DRM_MODE_CONNECTOR_Composite;
 	} else if ((tv_dac & (TVDAC_A_SENSE|TVDAC_B_SENSE)) == TVDAC_A_SENSE) {
-		DRM_DEBUG("Detected S-Video TV connection\n");
+		DRM_DEBUG_KMS("Detected S-Video TV connection\n");
 		type = DRM_MODE_CONNECTOR_SVIDEO;
 	} else if ((tv_dac & TVDAC_SENSE_MASK) == 0) {
-		DRM_DEBUG("Detected Component TV connection\n");
+		DRM_DEBUG_KMS("Detected Component TV connection\n");
 		type = DRM_MODE_CONNECTOR_Component;
 	} else {
-		DRM_DEBUG("No TV connection detected\n");
+		DRM_DEBUG_KMS("No TV connection detected\n");
 		type = -1;
 	}
 
@@ -1702,6 +1699,41 @@ static const struct drm_encoder_funcs intel_tv_enc_funcs = {
 	.destroy = intel_tv_enc_destroy,
 };
 
+/*
+ * Enumerate the child dev array parsed from VBT to check whether
+ * the integrated TV is present.
+ * If it is present, return 1.
+ * If it is not present, return false.
+ * If no child dev is parsed from VBT, it assumes that the TV is present.
+ */
+static int tv_is_present_in_vbt(struct drm_device *dev)
+{
+	struct drm_i915_private *dev_priv = dev->dev_private;
+	struct child_device_config *p_child;
+	int i, ret;
+
+	if (!dev_priv->child_dev_num)
+		return 1;
+
+	ret = 0;
+	for (i = 0; i < dev_priv->child_dev_num; i++) {
+		p_child = dev_priv->child_dev + i;
+		/*
+		 * If the device type is not TV, continue.
+		 */
+		if (p_child->device_type != DEVICE_TYPE_INT_TV &&
+			p_child->device_type != DEVICE_TYPE_TV)
+			continue;
+		/* Only when the addin_offset is non-zero, it is regarded
+		 * as present.
+		 */
+		if (p_child->addin_offset) {
+			ret = 1;
+			break;
+		}
+	}
+	return ret;
+}
 
 void
 intel_tv_init(struct drm_device *dev)
@@ -1717,6 +1749,10 @@ intel_tv_init(struct drm_device *dev)
 	if ((I915_READ(TV_CTL) & TV_FUSE_STATE_MASK) == TV_FUSE_STATE_DISABLED)
 		return;
 
+	if (!tv_is_present_in_vbt(dev)) {
+		DRM_DEBUG_KMS("Integrated TV is not present.\n");
+		return;
+	}
 	/* Even if we have an encoder we may not have a connector */
 	if (!dev_priv->int_tv_support)
 		return;
diff --git a/drivers/gpu/drm/mga/mga_drv.c b/drivers/gpu/drm/mga/mga_drv.c
index 97ee566ef749..ddfe16197b59 100644
--- a/drivers/gpu/drm/mga/mga_drv.c
+++ b/drivers/gpu/drm/mga/mga_drv.c
@@ -68,7 +68,7 @@ static struct drm_driver driver = {
 		.owner = THIS_MODULE,
 		.open = drm_open,
 		.release = drm_release,
-		.ioctl = drm_ioctl,
+		.unlocked_ioctl = drm_ioctl,
 		.mmap = drm_mmap,
 		.poll = drm_poll,
 		.fasync = drm_fasync,
diff --git a/drivers/gpu/drm/mga/mga_ioc32.c b/drivers/gpu/drm/mga/mga_ioc32.c
index 30d00478ddee..c1f877b7bac1 100644
--- a/drivers/gpu/drm/mga/mga_ioc32.c
+++ b/drivers/gpu/drm/mga/mga_ioc32.c
@@ -100,8 +100,7 @@ static int compat_mga_init(struct file *file, unsigned int cmd,
 	if (err)
 		return -EFAULT;
 
-	return drm_ioctl(file->f_path.dentry->d_inode, file,
-			 DRM_IOCTL_MGA_INIT, (unsigned long)init);
+	return drm_ioctl(file, DRM_IOCTL_MGA_INIT, (unsigned long)init);
 }
 
 typedef struct drm_mga_getparam32 {
@@ -125,8 +124,7 @@ static int compat_mga_getparam(struct file *file, unsigned int cmd,
 			  &getparam->value))
 		return -EFAULT;
 
-	return drm_ioctl(file->f_path.dentry->d_inode, file,
-			 DRM_IOCTL_MGA_GETPARAM, (unsigned long)getparam);
+	return drm_ioctl(file, DRM_IOCTL_MGA_GETPARAM, (unsigned long)getparam);
 }
 
 typedef struct drm_mga_drm_bootstrap32 {
@@ -166,8 +164,7 @@ static int compat_mga_dma_bootstrap(struct file *file, unsigned int cmd,
 	    || __put_user(dma_bootstrap32.agp_size, &dma_bootstrap->agp_size))
 		return -EFAULT;
 
-	err = drm_ioctl(file->f_path.dentry->d_inode, file,
-			DRM_IOCTL_MGA_DMA_BOOTSTRAP,
+	err = drm_ioctl(file, DRM_IOCTL_MGA_DMA_BOOTSTRAP,
 			(unsigned long)dma_bootstrap);
 	if (err)
 		return err;
@@ -220,12 +217,10 @@ long mga_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 	if (nr < DRM_COMMAND_BASE + DRM_ARRAY_SIZE(mga_compat_ioctls))
 		fn = mga_compat_ioctls[nr - DRM_COMMAND_BASE];
 
-	lock_kernel();		/* XXX for now */
 	if (fn != NULL)
 		ret = (*fn) (filp, cmd, arg);
 	else
-		ret = drm_ioctl(filp->f_path.dentry->d_inode, filp, cmd, arg);
-	unlock_kernel();
+		ret = drm_ioctl(filp, cmd, arg);
 
 	return ret;
 }
diff --git a/drivers/gpu/drm/nouveau/Kconfig b/drivers/gpu/drm/nouveau/Kconfig
new file mode 100644
index 000000000000..1175429da102
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/Kconfig
@@ -0,0 +1,44 @@
+config DRM_NOUVEAU
+	tristate "Nouveau (nVidia) cards"
+	depends on DRM
+        select FW_LOADER
+	select DRM_KMS_HELPER
+	select DRM_TTM
+	select FB_CFB_FILLRECT
+	select FB_CFB_COPYAREA
+	select FB_CFB_IMAGEBLIT
+	select FB
+	select FRAMEBUFFER_CONSOLE if !EMBEDDED
+	select FB_BACKLIGHT if DRM_NOUVEAU_BACKLIGHT
+	help
+	  Choose this option for open-source nVidia support.
+
+config DRM_NOUVEAU_BACKLIGHT
+	bool "Support for backlight control"
+	depends on DRM_NOUVEAU
+	default y
+	help
+	  Say Y here if you want to control the backlight of your display
+	  (e.g. a laptop panel).
+
+config DRM_NOUVEAU_DEBUG
+	bool "Build in Nouveau's debugfs support"
+	depends on DRM_NOUVEAU && DEBUG_FS
+	default y
+	help
+	  Say Y here if you want Nouveau to output debugging information
+	  via debugfs.
+
+menu "I2C encoder or helper chips"
+     depends on DRM && DRM_KMS_HELPER && I2C
+
+config DRM_I2C_CH7006
+	tristate "Chrontel ch7006 TV encoder"
+	default m if DRM_NOUVEAU
+	help
+	  Support for Chrontel ch7006 and similar TV encoders, found
+	  on some nVidia video cards.
+
+	  This driver is currently only useful if you're also using
+	  the nouveau driver.
+endmenu
diff --git a/drivers/gpu/drm/nouveau/Makefile b/drivers/gpu/drm/nouveau/Makefile
new file mode 100644
index 000000000000..48c290b5da8c
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/Makefile
@@ -0,0 +1,32 @@
+#
+# Makefile for the drm device driver.  This driver provides support for the
+# Direct Rendering Infrastructure (DRI) in XFree86 4.1.0 and higher.
+
+ccflags-y := -Iinclude/drm
+nouveau-y := nouveau_drv.o nouveau_state.o nouveau_channel.o nouveau_mem.o \
+             nouveau_object.o nouveau_irq.o nouveau_notifier.o \
+             nouveau_sgdma.o nouveau_dma.o \
+             nouveau_bo.o nouveau_fence.o nouveau_gem.o nouveau_ttm.o \
+             nouveau_hw.o nouveau_calc.o nouveau_bios.o nouveau_i2c.o \
+             nouveau_display.o nouveau_connector.o nouveau_fbcon.o \
+             nouveau_dp.o nouveau_grctx.o \
+             nv04_timer.o \
+             nv04_mc.o nv40_mc.o nv50_mc.o \
+             nv04_fb.o nv10_fb.o nv40_fb.o \
+             nv04_fifo.o nv10_fifo.o nv40_fifo.o nv50_fifo.o \
+             nv04_graph.o nv10_graph.o nv20_graph.o \
+             nv40_graph.o nv50_graph.o \
+             nv40_grctx.o \
+             nv04_instmem.o nv50_instmem.o \
+             nv50_crtc.o nv50_dac.o nv50_sor.o \
+             nv50_cursor.o nv50_display.o nv50_fbcon.o \
+             nv04_dac.o nv04_dfp.o nv04_tv.o nv17_tv.o nv17_tv_modes.o \
+             nv04_crtc.o nv04_display.o nv04_cursor.o nv04_fbcon.o \
+             nv17_gpio.o
+
+nouveau-$(CONFIG_DRM_NOUVEAU_DEBUG) += nouveau_debugfs.o
+nouveau-$(CONFIG_COMPAT) += nouveau_ioc32.o
+nouveau-$(CONFIG_DRM_NOUVEAU_BACKLIGHT) += nouveau_backlight.o
+nouveau-$(CONFIG_ACPI) += nouveau_acpi.o
+
+obj-$(CONFIG_DRM_NOUVEAU)+= nouveau.o
diff --git a/drivers/gpu/drm/nouveau/nouveau_acpi.c b/drivers/gpu/drm/nouveau/nouveau_acpi.c
new file mode 100644
index 000000000000..1cf488247a16
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nouveau_acpi.c
@@ -0,0 +1,125 @@
+#include <linux/pci.h>
+#include <linux/acpi.h>
+#include <acpi/acpi_drivers.h>
+#include <acpi/acpi_bus.h>
+
+#include "drmP.h"
+#include "drm.h"
+#include "drm_sarea.h"
+#include "drm_crtc_helper.h"
+#include "nouveau_drv.h"
+#include "nouveau_drm.h"
+#include "nv50_display.h"
+
+#define NOUVEAU_DSM_SUPPORTED 0x00
+#define NOUVEAU_DSM_SUPPORTED_FUNCTIONS 0x00
+
+#define NOUVEAU_DSM_ACTIVE 0x01
+#define NOUVEAU_DSM_ACTIVE_QUERY 0x00
+
+#define NOUVEAU_DSM_LED 0x02
+#define NOUVEAU_DSM_LED_STATE 0x00
+#define NOUVEAU_DSM_LED_OFF 0x10
+#define NOUVEAU_DSM_LED_STAMINA 0x11
+#define NOUVEAU_DSM_LED_SPEED 0x12
+
+#define NOUVEAU_DSM_POWER 0x03
+#define NOUVEAU_DSM_POWER_STATE 0x00
+#define NOUVEAU_DSM_POWER_SPEED 0x01
+#define NOUVEAU_DSM_POWER_STAMINA 0x02
+
+static int nouveau_dsm(struct drm_device *dev, int func, int arg, int *result)
+{
+	static char muid[] = {
+		0xA0, 0xA0, 0x95, 0x9D, 0x60, 0x00, 0x48, 0x4D,
+		0xB3, 0x4D, 0x7E, 0x5F, 0xEA, 0x12, 0x9F, 0xD4,
+	};
+
+	struct pci_dev *pdev = dev->pdev;
+	struct acpi_handle *handle;
+	struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL };
+	struct acpi_object_list input;
+	union acpi_object params[4];
+	union acpi_object *obj;
+	int err;
+
+	handle = DEVICE_ACPI_HANDLE(&pdev->dev);
+
+	if (!handle)
+		return -ENODEV;
+
+	input.count = 4;
+	input.pointer = params;
+	params[0].type = ACPI_TYPE_BUFFER;
+	params[0].buffer.length = sizeof(muid);
+	params[0].buffer.pointer = (char *)muid;
+	params[1].type = ACPI_TYPE_INTEGER;
+	params[1].integer.value = 0x00000102;
+	params[2].type = ACPI_TYPE_INTEGER;
+	params[2].integer.value = func;
+	params[3].type = ACPI_TYPE_INTEGER;
+	params[3].integer.value = arg;
+
+	err = acpi_evaluate_object(handle, "_DSM", &input, &output);
+	if (err) {
+		NV_INFO(dev, "failed to evaluate _DSM: %d\n", err);
+		return err;
+	}
+
+	obj = (union acpi_object *)output.pointer;
+
+	if (obj->type == ACPI_TYPE_INTEGER)
+		if (obj->integer.value == 0x80000002)
+			return -ENODEV;
+
+	if (obj->type == ACPI_TYPE_BUFFER) {
+		if (obj->buffer.length == 4 && result) {
+			*result = 0;
+			*result |= obj->buffer.pointer[0];
+			*result |= (obj->buffer.pointer[1] << 8);
+			*result |= (obj->buffer.pointer[2] << 16);
+			*result |= (obj->buffer.pointer[3] << 24);
+		}
+	}
+
+	kfree(output.pointer);
+	return 0;
+}
+
+int nouveau_hybrid_setup(struct drm_device *dev)
+{
+	int result;
+
+	if (nouveau_dsm(dev, NOUVEAU_DSM_ACTIVE, NOUVEAU_DSM_ACTIVE_QUERY,
+								&result))
+		return -ENODEV;
+
+	NV_INFO(dev, "_DSM hardware status gave 0x%x\n", result);
+
+	if (result & 0x1) {	/* Stamina mode - disable the external GPU */
+		nouveau_dsm(dev, NOUVEAU_DSM_LED, NOUVEAU_DSM_LED_STAMINA,
+									NULL);
+		nouveau_dsm(dev, NOUVEAU_DSM_POWER, NOUVEAU_DSM_POWER_STAMINA,
+									NULL);
+	} else {		/* Ensure that the external GPU is enabled */
+		nouveau_dsm(dev, NOUVEAU_DSM_LED, NOUVEAU_DSM_LED_SPEED, NULL);
+		nouveau_dsm(dev, NOUVEAU_DSM_POWER, NOUVEAU_DSM_POWER_SPEED,
+									NULL);
+	}
+
+	return 0;
+}
+
+bool nouveau_dsm_probe(struct drm_device *dev)
+{
+	int support = 0;
+
+	if (nouveau_dsm(dev, NOUVEAU_DSM_SUPPORTED,
+				NOUVEAU_DSM_SUPPORTED_FUNCTIONS, &support))
+		return false;
+
+	if (!support)
+		return false;
+
+	return true;
+}
diff --git a/drivers/gpu/drm/nouveau/nouveau_backlight.c b/drivers/gpu/drm/nouveau/nouveau_backlight.c
new file mode 100644
index 000000000000..20564f8cb0ec
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nouveau_backlight.c
@@ -0,0 +1,155 @@
+/*
+ * Copyright (C) 2009 Red Hat <mjg@redhat.com>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial
+ * portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE COPYRIGHT OWNER(S) AND/OR ITS SUPPLIERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
+/*
+ * Authors:
+ *  Matthew Garrett <mjg@redhat.com>
+ *
+ * Register locations derived from NVClock by Roderick Colenbrander
+ */
+
+#include <linux/backlight.h>
+
+#include "drmP.h"
+#include "nouveau_drv.h"
+#include "nouveau_drm.h"
+#include "nouveau_reg.h"
+
+static int nv40_get_intensity(struct backlight_device *bd)
+{
+	struct drm_device *dev = bl_get_data(bd);
+	int val = (nv_rd32(dev, NV40_PMC_BACKLIGHT) & NV40_PMC_BACKLIGHT_MASK)
+									>> 16;
+
+	return val;
+}
+
+static int nv40_set_intensity(struct backlight_device *bd)
+{
+	struct drm_device *dev = bl_get_data(bd);
+	int val = bd->props.brightness;
+	int reg = nv_rd32(dev, NV40_PMC_BACKLIGHT);
+
+	nv_wr32(dev, NV40_PMC_BACKLIGHT,
+		 (val << 16) | (reg & ~NV40_PMC_BACKLIGHT_MASK));
+
+	return 0;
+}
+
+static struct backlight_ops nv40_bl_ops = {
+	.options = BL_CORE_SUSPENDRESUME,
+	.get_brightness = nv40_get_intensity,
+	.update_status = nv40_set_intensity,
+};
+
+static int nv50_get_intensity(struct backlight_device *bd)
+{
+	struct drm_device *dev = bl_get_data(bd);
+
+	return nv_rd32(dev, NV50_PDISPLAY_SOR_BACKLIGHT);
+}
+
+static int nv50_set_intensity(struct backlight_device *bd)
+{
+	struct drm_device *dev = bl_get_data(bd);
+	int val = bd->props.brightness;
+
+	nv_wr32(dev, NV50_PDISPLAY_SOR_BACKLIGHT,
+		val | NV50_PDISPLAY_SOR_BACKLIGHT_ENABLE);
+	return 0;
+}
+
+static struct backlight_ops nv50_bl_ops = {
+	.options = BL_CORE_SUSPENDRESUME,
+	.get_brightness = nv50_get_intensity,
+	.update_status = nv50_set_intensity,
+};
+
+static int nouveau_nv40_backlight_init(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct backlight_device *bd;
+
+	if (!(nv_rd32(dev, NV40_PMC_BACKLIGHT) & NV40_PMC_BACKLIGHT_MASK))
+		return 0;
+
+	bd = backlight_device_register("nv_backlight", &dev->pdev->dev, dev,
+				       &nv40_bl_ops);
+	if (IS_ERR(bd))
+		return PTR_ERR(bd);
+
+	dev_priv->backlight = bd;
+	bd->props.max_brightness = 31;
+	bd->props.brightness = nv40_get_intensity(bd);
+	backlight_update_status(bd);
+
+	return 0;
+}
+
+static int nouveau_nv50_backlight_init(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct backlight_device *bd;
+
+	if (!nv_rd32(dev, NV50_PDISPLAY_SOR_BACKLIGHT))
+		return 0;
+
+	bd = backlight_device_register("nv_backlight", &dev->pdev->dev, dev,
+				       &nv50_bl_ops);
+	if (IS_ERR(bd))
+		return PTR_ERR(bd);
+
+	dev_priv->backlight = bd;
+	bd->props.max_brightness = 1025;
+	bd->props.brightness = nv50_get_intensity(bd);
+	backlight_update_status(bd);
+	return 0;
+}
+
+int nouveau_backlight_init(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+
+	switch (dev_priv->card_type) {
+	case NV_40:
+		return nouveau_nv40_backlight_init(dev);
+	case NV_50:
+		return nouveau_nv50_backlight_init(dev);
+	default:
+		break;
+	}
+
+	return 0;
+}
+
+void nouveau_backlight_exit(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+
+	if (dev_priv->backlight) {
+		backlight_device_unregister(dev_priv->backlight);
+		dev_priv->backlight = NULL;
+	}
+}
diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.c b/drivers/gpu/drm/nouveau/nouveau_bios.c
new file mode 100644
index 000000000000..ba143972769f
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nouveau_bios.c
@@ -0,0 +1,6078 @@
+/*
+ * Copyright 2005-2006 Erik Waling
+ * Copyright 2006 Stephane Marchesin
+ * Copyright 2007-2009 Stuart Bennett
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+ * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF
+ * OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#include "drmP.h"
+#define NV_DEBUG_NOTRACE
+#include "nouveau_drv.h"
+#include "nouveau_hw.h"
+
+/* these defines are made up */
+#define NV_CIO_CRE_44_HEADA 0x0
+#define NV_CIO_CRE_44_HEADB 0x3
+#define FEATURE_MOBILE 0x10	/* also FEATURE_QUADRO for BMP */
+#define LEGACY_I2C_CRT 0x80
+#define LEGACY_I2C_PANEL 0x81
+#define LEGACY_I2C_TV 0x82
+
+#define EDID1_LEN 128
+
+#define BIOSLOG(sip, fmt, arg...) NV_DEBUG(sip->dev, fmt, ##arg)
+#define LOG_OLD_VALUE(x)
+
+#define ROM16(x) le16_to_cpu(*(uint16_t *)&(x))
+#define ROM32(x) le32_to_cpu(*(uint32_t *)&(x))
+
+struct init_exec {
+	bool execute;
+	bool repeat;
+};
+
+static bool nv_cksum(const uint8_t *data, unsigned int length)
+{
+	/*
+	 * There's a few checksums in the BIOS, so here's a generic checking
+	 * function.
+	 */
+	int i;
+	uint8_t sum = 0;
+
+	for (i = 0; i < length; i++)
+		sum += data[i];
+
+	if (sum)
+		return true;
+
+	return false;
+}
+
+static int
+score_vbios(struct drm_device *dev, const uint8_t *data, const bool writeable)
+{
+	if (!(data[0] == 0x55 && data[1] == 0xAA)) {
+		NV_TRACEWARN(dev, "... BIOS signature not found\n");
+		return 0;
+	}
+
+	if (nv_cksum(data, data[2] * 512)) {
+		NV_TRACEWARN(dev, "... BIOS checksum invalid\n");
+		/* if a ro image is somewhat bad, it's probably all rubbish */
+		return writeable ? 2 : 1;
+	} else
+		NV_TRACE(dev, "... appears to be valid\n");
+
+	return 3;
+}
+
+static void load_vbios_prom(struct drm_device *dev, uint8_t *data)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	uint32_t pci_nv_20, save_pci_nv_20;
+	int pcir_ptr;
+	int i;
+
+	if (dev_priv->card_type >= NV_50)
+		pci_nv_20 = 0x88050;
+	else
+		pci_nv_20 = NV_PBUS_PCI_NV_20;
+
+	/* enable ROM access */
+	save_pci_nv_20 = nvReadMC(dev, pci_nv_20);
+	nvWriteMC(dev, pci_nv_20,
+		  save_pci_nv_20 & ~NV_PBUS_PCI_NV_20_ROM_SHADOW_ENABLED);
+
+	/* bail if no rom signature */
+	if (nv_rd08(dev, NV_PROM_OFFSET) != 0x55 ||
+	    nv_rd08(dev, NV_PROM_OFFSET + 1) != 0xaa)
+		goto out;
+
+	/* additional check (see note below) - read PCI record header */
+	pcir_ptr = nv_rd08(dev, NV_PROM_OFFSET + 0x18) |
+		   nv_rd08(dev, NV_PROM_OFFSET + 0x19) << 8;
+	if (nv_rd08(dev, NV_PROM_OFFSET + pcir_ptr) != 'P' ||
+	    nv_rd08(dev, NV_PROM_OFFSET + pcir_ptr + 1) != 'C' ||
+	    nv_rd08(dev, NV_PROM_OFFSET + pcir_ptr + 2) != 'I' ||
+	    nv_rd08(dev, NV_PROM_OFFSET + pcir_ptr + 3) != 'R')
+		goto out;
+
+	/* on some 6600GT/6800LE prom reads are messed up.  nvclock alleges a
+	 * a good read may be obtained by waiting or re-reading (cargocult: 5x)
+	 * each byte.  we'll hope pramin has something usable instead
+	 */
+	for (i = 0; i < NV_PROM_SIZE; i++)
+		data[i] = nv_rd08(dev, NV_PROM_OFFSET + i);
+
+out:
+	/* disable ROM access */
+	nvWriteMC(dev, pci_nv_20,
+		  save_pci_nv_20 | NV_PBUS_PCI_NV_20_ROM_SHADOW_ENABLED);
+}
+
+static void load_vbios_pramin(struct drm_device *dev, uint8_t *data)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	uint32_t old_bar0_pramin = 0;
+	int i;
+
+	if (dev_priv->card_type >= NV_50) {
+		uint32_t vbios_vram = (nv_rd32(dev, 0x619f04) & ~0xff) << 8;
+
+		if (!vbios_vram)
+			vbios_vram = (nv_rd32(dev, 0x1700) << 16) + 0xf0000;
+
+		old_bar0_pramin = nv_rd32(dev, 0x1700);
+		nv_wr32(dev, 0x1700, vbios_vram >> 16);
+	}
+
+	/* bail if no rom signature */
+	if (nv_rd08(dev, NV_PRAMIN_OFFSET) != 0x55 ||
+	    nv_rd08(dev, NV_PRAMIN_OFFSET + 1) != 0xaa)
+		goto out;
+
+	for (i = 0; i < NV_PROM_SIZE; i++)
+		data[i] = nv_rd08(dev, NV_PRAMIN_OFFSET + i);
+
+out:
+	if (dev_priv->card_type >= NV_50)
+		nv_wr32(dev, 0x1700, old_bar0_pramin);
+}
+
+static void load_vbios_pci(struct drm_device *dev, uint8_t *data)
+{
+	void __iomem *rom = NULL;
+	size_t rom_len;
+	int ret;
+
+	ret = pci_enable_rom(dev->pdev);
+	if (ret)
+		return;
+
+	rom = pci_map_rom(dev->pdev, &rom_len);
+	if (!rom)
+		goto out;
+	memcpy_fromio(data, rom, rom_len);
+	pci_unmap_rom(dev->pdev, rom);
+
+out:
+	pci_disable_rom(dev->pdev);
+}
+
+struct methods {
+	const char desc[8];
+	void (*loadbios)(struct drm_device *, uint8_t *);
+	const bool rw;
+};
+
+static struct methods nv04_methods[] = {
+	{ "PROM", load_vbios_prom, false },
+	{ "PRAMIN", load_vbios_pramin, true },
+	{ "PCIROM", load_vbios_pci, true },
+};
+
+static struct methods nv50_methods[] = {
+	{ "PRAMIN", load_vbios_pramin, true },
+	{ "PROM", load_vbios_prom, false },
+	{ "PCIROM", load_vbios_pci, true },
+};
+
+#define METHODCNT 3
+
+static bool NVShadowVBIOS(struct drm_device *dev, uint8_t *data)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct methods *methods;
+	int i;
+	int testscore = 3;
+	int scores[METHODCNT];
+
+	if (nouveau_vbios) {
+		methods = nv04_methods;
+		for (i = 0; i < METHODCNT; i++)
+			if (!strcasecmp(nouveau_vbios, methods[i].desc))
+				break;
+
+		if (i < METHODCNT) {
+			NV_INFO(dev, "Attempting to use BIOS image from %s\n",
+				methods[i].desc);
+
+			methods[i].loadbios(dev, data);
+			if (score_vbios(dev, data, methods[i].rw))
+				return true;
+		}
+
+		NV_ERROR(dev, "VBIOS source \'%s\' invalid\n", nouveau_vbios);
+	}
+
+	if (dev_priv->card_type < NV_50)
+		methods = nv04_methods;
+	else
+		methods = nv50_methods;
+
+	for (i = 0; i < METHODCNT; i++) {
+		NV_TRACE(dev, "Attempting to load BIOS image from %s\n",
+			 methods[i].desc);
+		data[0] = data[1] = 0;	/* avoid reuse of previous image */
+		methods[i].loadbios(dev, data);
+		scores[i] = score_vbios(dev, data, methods[i].rw);
+		if (scores[i] == testscore)
+			return true;
+	}
+
+	while (--testscore > 0) {
+		for (i = 0; i < METHODCNT; i++) {
+			if (scores[i] == testscore) {
+				NV_TRACE(dev, "Using BIOS image from %s\n",
+					 methods[i].desc);
+				methods[i].loadbios(dev, data);
+				return true;
+			}
+		}
+	}
+
+	NV_ERROR(dev, "No valid BIOS image found\n");
+	return false;
+}
+
+struct init_tbl_entry {
+	char *name;
+	uint8_t id;
+	int (*handler)(struct nvbios *, uint16_t, struct init_exec *);
+};
+
+struct bit_entry {
+	uint8_t id[2];
+	uint16_t length;
+	uint16_t offset;
+};
+
+static int parse_init_table(struct nvbios *, unsigned int, struct init_exec *);
+
+#define MACRO_INDEX_SIZE	2
+#define MACRO_SIZE		8
+#define CONDITION_SIZE		12
+#define IO_FLAG_CONDITION_SIZE	9
+#define IO_CONDITION_SIZE	5
+#define MEM_INIT_SIZE		66
+
+static void still_alive(void)
+{
+#if 0
+	sync();
+	msleep(2);
+#endif
+}
+
+static uint32_t
+munge_reg(struct nvbios *bios, uint32_t reg)
+{
+	struct drm_nouveau_private *dev_priv = bios->dev->dev_private;
+	struct dcb_entry *dcbent = bios->display.output;
+
+	if (dev_priv->card_type < NV_50)
+		return reg;
+
+	if (reg & 0x40000000) {
+		BUG_ON(!dcbent);
+
+		reg += (ffs(dcbent->or) - 1) * 0x800;
+		if ((reg & 0x20000000) && !(dcbent->sorconf.link & 1))
+			reg += 0x00000080;
+	}
+
+	reg &= ~0x60000000;
+	return reg;
+}
+
+static int
+valid_reg(struct nvbios *bios, uint32_t reg)
+{
+	struct drm_nouveau_private *dev_priv = bios->dev->dev_private;
+	struct drm_device *dev = bios->dev;
+
+	/* C51 has misaligned regs on purpose. Marvellous */
+	if (reg & 0x2 || (reg & 0x1 && dev_priv->VBIOS.pub.chip_version != 0x51)) {
+		NV_ERROR(dev, "========== misaligned reg 0x%08X ==========\n",
+			 reg);
+		return 0;
+	}
+	/*
+	 * Warn on C51 regs that have not been verified accessible in
+	 * mmiotracing
+	 */
+	if (reg & 0x1 && dev_priv->VBIOS.pub.chip_version == 0x51 &&
+	    reg != 0x130d && reg != 0x1311 && reg != 0x60081d)
+		NV_WARN(dev, "=== C51 misaligned reg 0x%08X not verified ===\n",
+			reg);
+
+	/* Trust the init scripts on G80 */
+	if (dev_priv->card_type >= NV_50)
+		return 1;
+
+	#define WITHIN(x, y, z) ((x >= y) && (x < y + z))
+	if (WITHIN(reg, NV_PMC_OFFSET, NV_PMC_SIZE))
+		return 1;
+	if (WITHIN(reg, NV_PBUS_OFFSET, NV_PBUS_SIZE))
+		return 1;
+	if (WITHIN(reg, NV_PFIFO_OFFSET, NV_PFIFO_SIZE))
+		return 1;
+	if (dev_priv->VBIOS.pub.chip_version >= 0x30 &&
+	    (WITHIN(reg, 0x4000, 0x600) || reg == 0x00004600))
+		return 1;
+	if (dev_priv->VBIOS.pub.chip_version >= 0x40 &&
+						WITHIN(reg, 0xc000, 0x48))
+		return 1;
+	if (dev_priv->VBIOS.pub.chip_version >= 0x17 && reg == 0x0000d204)
+		return 1;
+	if (dev_priv->VBIOS.pub.chip_version >= 0x40) {
+		if (reg == 0x00011014 || reg == 0x00020328)
+			return 1;
+		if (WITHIN(reg, 0x88000, NV_PBUS_SIZE)) /* new PBUS */
+			return 1;
+	}
+	if (WITHIN(reg, NV_PFB_OFFSET, NV_PFB_SIZE))
+		return 1;
+	if (WITHIN(reg, NV_PEXTDEV_OFFSET, NV_PEXTDEV_SIZE))
+		return 1;
+	if (WITHIN(reg, NV_PCRTC0_OFFSET, NV_PCRTC0_SIZE * 2))
+		return 1;
+	if (WITHIN(reg, NV_PRAMDAC0_OFFSET, NV_PRAMDAC0_SIZE * 2))
+		return 1;
+	if (dev_priv->VBIOS.pub.chip_version >= 0x17 && reg == 0x0070fff0)
+		return 1;
+	if (dev_priv->VBIOS.pub.chip_version == 0x51 &&
+				WITHIN(reg, NV_PRAMIN_OFFSET, NV_PRAMIN_SIZE))
+		return 1;
+	#undef WITHIN
+
+	NV_ERROR(dev, "========== unknown reg 0x%08X ==========\n", reg);
+
+	return 0;
+}
+
+static bool
+valid_idx_port(struct nvbios *bios, uint16_t port)
+{
+	struct drm_nouveau_private *dev_priv = bios->dev->dev_private;
+	struct drm_device *dev = bios->dev;
+
+	/*
+	 * If adding more ports here, the read/write functions below will need
+	 * updating so that the correct mmio range (PRMCIO, PRMDIO, PRMVIO) is
+	 * used for the port in question
+	 */
+	if (dev_priv->card_type < NV_50) {
+		if (port == NV_CIO_CRX__COLOR)
+			return true;
+		if (port == NV_VIO_SRX)
+			return true;
+	} else {
+		if (port == NV_CIO_CRX__COLOR)
+			return true;
+	}
+
+	NV_ERROR(dev, "========== unknown indexed io port 0x%04X ==========\n",
+		 port);
+
+	return false;
+}
+
+static bool
+valid_port(struct nvbios *bios, uint16_t port)
+{
+	struct drm_device *dev = bios->dev;
+
+	/*
+	 * If adding more ports here, the read/write functions below will need
+	 * updating so that the correct mmio range (PRMCIO, PRMDIO, PRMVIO) is
+	 * used for the port in question
+	 */
+	if (port == NV_VIO_VSE2)
+		return true;
+
+	NV_ERROR(dev, "========== unknown io port 0x%04X ==========\n", port);
+
+	return false;
+}
+
+static uint32_t
+bios_rd32(struct nvbios *bios, uint32_t reg)
+{
+	uint32_t data;
+
+	reg = munge_reg(bios, reg);
+	if (!valid_reg(bios, reg))
+		return 0;
+
+	/*
+	 * C51 sometimes uses regs with bit0 set in the address. For these
+	 * cases there should exist a translation in a BIOS table to an IO
+	 * port address which the BIOS uses for accessing the reg
+	 *
+	 * These only seem to appear for the power control regs to a flat panel,
+	 * and the GPIO regs at 0x60081*.  In C51 mmio traces the normal regs
+	 * for 0x1308 and 0x1310 are used - hence the mask below.  An S3
+	 * suspend-resume mmio trace from a C51 will be required to see if this
+	 * is true for the power microcode in 0x14.., or whether the direct IO
+	 * port access method is needed
+	 */
+	if (reg & 0x1)
+		reg &= ~0x1;
+
+	data = nv_rd32(bios->dev, reg);
+
+	BIOSLOG(bios, "	Read:  Reg: 0x%08X, Data: 0x%08X\n", reg, data);
+
+	return data;
+}
+
+static void
+bios_wr32(struct nvbios *bios, uint32_t reg, uint32_t data)
+{
+	struct drm_nouveau_private *dev_priv = bios->dev->dev_private;
+
+	reg = munge_reg(bios, reg);
+	if (!valid_reg(bios, reg))
+		return;
+
+	/* see note in bios_rd32 */
+	if (reg & 0x1)
+		reg &= 0xfffffffe;
+
+	LOG_OLD_VALUE(bios_rd32(bios, reg));
+	BIOSLOG(bios, "	Write: Reg: 0x%08X, Data: 0x%08X\n", reg, data);
+
+	if (dev_priv->VBIOS.execute) {
+		still_alive();
+		nv_wr32(bios->dev, reg, data);
+	}
+}
+
+static uint8_t
+bios_idxprt_rd(struct nvbios *bios, uint16_t port, uint8_t index)
+{
+	struct drm_nouveau_private *dev_priv = bios->dev->dev_private;
+	struct drm_device *dev = bios->dev;
+	uint8_t data;
+
+	if (!valid_idx_port(bios, port))
+		return 0;
+
+	if (dev_priv->card_type < NV_50) {
+		if (port == NV_VIO_SRX)
+			data = NVReadVgaSeq(dev, bios->state.crtchead, index);
+		else	/* assume NV_CIO_CRX__COLOR */
+			data = NVReadVgaCrtc(dev, bios->state.crtchead, index);
+	} else {
+		uint32_t data32;
+
+		data32 = bios_rd32(bios, NV50_PDISPLAY_VGACRTC(index & ~3));
+		data = (data32 >> ((index & 3) << 3)) & 0xff;
+	}
+
+	BIOSLOG(bios, "	Indexed IO read:  Port: 0x%04X, Index: 0x%02X, "
+		      "Head: 0x%02X, Data: 0x%02X\n",
+		port, index, bios->state.crtchead, data);
+	return data;
+}
+
+static void
+bios_idxprt_wr(struct nvbios *bios, uint16_t port, uint8_t index, uint8_t data)
+{
+	struct drm_nouveau_private *dev_priv = bios->dev->dev_private;
+	struct drm_device *dev = bios->dev;
+
+	if (!valid_idx_port(bios, port))
+		return;
+
+	/*
+	 * The current head is maintained in the nvbios member  state.crtchead.
+	 * We trap changes to CR44 and update the head variable and hence the
+	 * register set written.
+	 * As CR44 only exists on CRTC0, we update crtchead to head0 in advance
+	 * of the write, and to head1 after the write
+	 */
+	if (port == NV_CIO_CRX__COLOR && index == NV_CIO_CRE_44 &&
+	    data != NV_CIO_CRE_44_HEADB)
+		bios->state.crtchead = 0;
+
+	LOG_OLD_VALUE(bios_idxprt_rd(bios, port, index));
+	BIOSLOG(bios, "	Indexed IO write: Port: 0x%04X, Index: 0x%02X, "
+		      "Head: 0x%02X, Data: 0x%02X\n",
+		port, index, bios->state.crtchead, data);
+
+	if (bios->execute && dev_priv->card_type < NV_50) {
+		still_alive();
+		if (port == NV_VIO_SRX)
+			NVWriteVgaSeq(dev, bios->state.crtchead, index, data);
+		else	/* assume NV_CIO_CRX__COLOR */
+			NVWriteVgaCrtc(dev, bios->state.crtchead, index, data);
+	} else
+	if (bios->execute) {
+		uint32_t data32, shift = (index & 3) << 3;
+
+		still_alive();
+
+		data32  = bios_rd32(bios, NV50_PDISPLAY_VGACRTC(index & ~3));
+		data32 &= ~(0xff << shift);
+		data32 |= (data << shift);
+		bios_wr32(bios, NV50_PDISPLAY_VGACRTC(index & ~3), data32);
+	}
+
+	if (port == NV_CIO_CRX__COLOR &&
+	    index == NV_CIO_CRE_44 && data == NV_CIO_CRE_44_HEADB)
+		bios->state.crtchead = 1;
+}
+
+static uint8_t
+bios_port_rd(struct nvbios *bios, uint16_t port)
+{
+	uint8_t data, head = bios->state.crtchead;
+
+	if (!valid_port(bios, port))
+		return 0;
+
+	data = NVReadPRMVIO(bios->dev, head, NV_PRMVIO0_OFFSET + port);
+
+	BIOSLOG(bios, "	IO read:  Port: 0x%04X, Head: 0x%02X, Data: 0x%02X\n",
+		port, head, data);
+
+	return data;
+}
+
+static void
+bios_port_wr(struct nvbios *bios, uint16_t port, uint8_t data)
+{
+	int head = bios->state.crtchead;
+
+	if (!valid_port(bios, port))
+		return;
+
+	LOG_OLD_VALUE(bios_port_rd(bios, port));
+	BIOSLOG(bios, "	IO write: Port: 0x%04X, Head: 0x%02X, Data: 0x%02X\n",
+		port, head, data);
+
+	if (!bios->execute)
+		return;
+
+	still_alive();
+	NVWritePRMVIO(bios->dev, head, NV_PRMVIO0_OFFSET + port, data);
+}
+
+static bool
+io_flag_condition_met(struct nvbios *bios, uint16_t offset, uint8_t cond)
+{
+	/*
+	 * The IO flag condition entry has 2 bytes for the CRTC port; 1 byte
+	 * for the CRTC index; 1 byte for the mask to apply to the value
+	 * retrieved from the CRTC; 1 byte for the shift right to apply to the
+	 * masked CRTC value; 2 bytes for the offset to the flag array, to
+	 * which the shifted value is added; 1 byte for the mask applied to the
+	 * value read from the flag array; and 1 byte for the value to compare
+	 * against the masked byte from the flag table.
+	 */
+
+	uint16_t condptr = bios->io_flag_condition_tbl_ptr + cond * IO_FLAG_CONDITION_SIZE;
+	uint16_t crtcport = ROM16(bios->data[condptr]);
+	uint8_t crtcindex = bios->data[condptr + 2];
+	uint8_t mask = bios->data[condptr + 3];
+	uint8_t shift = bios->data[condptr + 4];
+	uint16_t flagarray = ROM16(bios->data[condptr + 5]);
+	uint8_t flagarraymask = bios->data[condptr + 7];
+	uint8_t cmpval = bios->data[condptr + 8];
+	uint8_t data;
+
+	BIOSLOG(bios, "0x%04X: Port: 0x%04X, Index: 0x%02X, Mask: 0x%02X, "
+		      "Shift: 0x%02X, FlagArray: 0x%04X, FAMask: 0x%02X, "
+		      "Cmpval: 0x%02X\n",
+		offset, crtcport, crtcindex, mask, shift, flagarray, flagarraymask, cmpval);
+
+	data = bios_idxprt_rd(bios, crtcport, crtcindex);
+
+	data = bios->data[flagarray + ((data & mask) >> shift)];
+	data &= flagarraymask;
+
+	BIOSLOG(bios, "0x%04X: Checking if 0x%02X equals 0x%02X\n",
+		offset, data, cmpval);
+
+	return (data == cmpval);
+}
+
+static bool
+bios_condition_met(struct nvbios *bios, uint16_t offset, uint8_t cond)
+{
+	/*
+	 * The condition table entry has 4 bytes for the address of the
+	 * register to check, 4 bytes for a mask to apply to the register and
+	 * 4 for a test comparison value
+	 */
+
+	uint16_t condptr = bios->condition_tbl_ptr + cond * CONDITION_SIZE;
+	uint32_t reg = ROM32(bios->data[condptr]);
+	uint32_t mask = ROM32(bios->data[condptr + 4]);
+	uint32_t cmpval = ROM32(bios->data[condptr + 8]);
+	uint32_t data;
+
+	BIOSLOG(bios, "0x%04X: Cond: 0x%02X, Reg: 0x%08X, Mask: 0x%08X\n",
+		offset, cond, reg, mask);
+
+	data = bios_rd32(bios, reg) & mask;
+
+	BIOSLOG(bios, "0x%04X: Checking if 0x%08X equals 0x%08X\n",
+		offset, data, cmpval);
+
+	return (data == cmpval);
+}
+
+static bool
+io_condition_met(struct nvbios *bios, uint16_t offset, uint8_t cond)
+{
+	/*
+	 * The IO condition entry has 2 bytes for the IO port address; 1 byte
+	 * for the index to write to io_port; 1 byte for the mask to apply to
+	 * the byte read from io_port+1; and 1 byte for the value to compare
+	 * against the masked byte.
+	 */
+
+	uint16_t condptr = bios->io_condition_tbl_ptr + cond * IO_CONDITION_SIZE;
+	uint16_t io_port = ROM16(bios->data[condptr]);
+	uint8_t port_index = bios->data[condptr + 2];
+	uint8_t mask = bios->data[condptr + 3];
+	uint8_t cmpval = bios->data[condptr + 4];
+
+	uint8_t data = bios_idxprt_rd(bios, io_port, port_index) & mask;
+
+	BIOSLOG(bios, "0x%04X: Checking if 0x%02X equals 0x%02X\n",
+		offset, data, cmpval);
+
+	return (data == cmpval);
+}
+
+static int
+nv50_pll_set(struct drm_device *dev, uint32_t reg, uint32_t clk)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	uint32_t reg0 = nv_rd32(dev, reg + 0);
+	uint32_t reg1 = nv_rd32(dev, reg + 4);
+	struct nouveau_pll_vals pll;
+	struct pll_lims pll_limits;
+	int ret;
+
+	ret = get_pll_limits(dev, reg, &pll_limits);
+	if (ret)
+		return ret;
+
+	clk = nouveau_calc_pll_mnp(dev, &pll_limits, clk, &pll);
+	if (!clk)
+		return -ERANGE;
+
+	reg0 = (reg0 & 0xfff8ffff) | (pll.log2P << 16);
+	reg1 = (reg1 & 0xffff0000) | (pll.N1 << 8) | pll.M1;
+
+	if (dev_priv->VBIOS.execute) {
+		still_alive();
+		nv_wr32(dev, reg + 4, reg1);
+		nv_wr32(dev, reg + 0, reg0);
+	}
+
+	return 0;
+}
+
+static int
+setPLL(struct nvbios *bios, uint32_t reg, uint32_t clk)
+{
+	struct drm_device *dev = bios->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	/* clk in kHz */
+	struct pll_lims pll_lim;
+	struct nouveau_pll_vals pllvals;
+	int ret;
+
+	if (dev_priv->card_type >= NV_50)
+		return nv50_pll_set(dev, reg, clk);
+
+	/* high regs (such as in the mac g5 table) are not -= 4 */
+	ret = get_pll_limits(dev, reg > 0x405c ? reg : reg - 4, &pll_lim);
+	if (ret)
+		return ret;
+
+	clk = nouveau_calc_pll_mnp(dev, &pll_lim, clk, &pllvals);
+	if (!clk)
+		return -ERANGE;
+
+	if (bios->execute) {
+		still_alive();
+		nouveau_hw_setpll(dev, reg, &pllvals);
+	}
+
+	return 0;
+}
+
+static int dcb_entry_idx_from_crtchead(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nvbios *bios = &dev_priv->VBIOS;
+
+	/*
+	 * For the results of this function to be correct, CR44 must have been
+	 * set (using bios_idxprt_wr to set crtchead), CR58 set for CR57 = 0,
+	 * and the DCB table parsed, before the script calling the function is
+	 * run.  run_digital_op_script is example of how to do such setup
+	 */
+
+	uint8_t dcb_entry = NVReadVgaCrtc5758(dev, bios->state.crtchead, 0);
+
+	if (dcb_entry > bios->bdcb.dcb.entries) {
+		NV_ERROR(dev, "CR58 doesn't have a valid DCB entry currently "
+				"(%02X)\n", dcb_entry);
+		dcb_entry = 0x7f;	/* unused / invalid marker */
+	}
+
+	return dcb_entry;
+}
+
+static struct nouveau_i2c_chan *
+init_i2c_device_find(struct drm_device *dev, int i2c_index)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct bios_parsed_dcb *bdcb = &dev_priv->VBIOS.bdcb;
+
+	if (i2c_index == 0xff) {
+		/* note: dcb_entry_idx_from_crtchead needs pre-script set-up */
+		int idx = dcb_entry_idx_from_crtchead(dev), shift = 0;
+		int default_indices = bdcb->i2c_default_indices;
+
+		if (idx != 0x7f && bdcb->dcb.entry[idx].i2c_upper_default)
+			shift = 4;
+
+		i2c_index = (default_indices >> shift) & 0xf;
+	}
+	if (i2c_index == 0x80)	/* g80+ */
+		i2c_index = bdcb->i2c_default_indices & 0xf;
+
+	return nouveau_i2c_find(dev, i2c_index);
+}
+
+static uint32_t get_tmds_index_reg(struct drm_device *dev, uint8_t mlv)
+{
+	/*
+	 * For mlv < 0x80, it is an index into a table of TMDS base addresses.
+	 * For mlv == 0x80 use the "or" value of the dcb_entry indexed by
+	 * CR58 for CR57 = 0 to index a table of offsets to the basic
+	 * 0x6808b0 address.
+	 * For mlv == 0x81 use the "or" value of the dcb_entry indexed by
+	 * CR58 for CR57 = 0 to index a table of offsets to the basic
+	 * 0x6808b0 address, and then flip the offset by 8.
+	 */
+
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	const int pramdac_offset[13] = {
+		0, 0, 0x8, 0, 0x2000, 0, 0, 0, 0x2008, 0, 0, 0, 0x2000 };
+	const uint32_t pramdac_table[4] = {
+		0x6808b0, 0x6808b8, 0x6828b0, 0x6828b8 };
+
+	if (mlv >= 0x80) {
+		int dcb_entry, dacoffset;
+
+		/* note: dcb_entry_idx_from_crtchead needs pre-script set-up */
+		dcb_entry = dcb_entry_idx_from_crtchead(dev);
+		if (dcb_entry == 0x7f)
+			return 0;
+		dacoffset = pramdac_offset[
+				dev_priv->VBIOS.bdcb.dcb.entry[dcb_entry].or];
+		if (mlv == 0x81)
+			dacoffset ^= 8;
+		return 0x6808b0 + dacoffset;
+	} else {
+		if (mlv > ARRAY_SIZE(pramdac_table)) {
+			NV_ERROR(dev, "Magic Lookup Value too big (%02X)\n",
+									mlv);
+			return 0;
+		}
+		return pramdac_table[mlv];
+	}
+}
+
+static int
+init_io_restrict_prog(struct nvbios *bios, uint16_t offset,
+		      struct init_exec *iexec)
+{
+	/*
+	 * INIT_IO_RESTRICT_PROG   opcode: 0x32 ('2')
+	 *
+	 * offset      (8  bit): opcode
+	 * offset + 1  (16 bit): CRTC port
+	 * offset + 3  (8  bit): CRTC index
+	 * offset + 4  (8  bit): mask
+	 * offset + 5  (8  bit): shift
+	 * offset + 6  (8  bit): count
+	 * offset + 7  (32 bit): register
+	 * offset + 11 (32 bit): configuration 1
+	 * ...
+	 *
+	 * Starting at offset + 11 there are "count" 32 bit values.
+	 * To find out which value to use read index "CRTC index" on "CRTC
+	 * port", AND this value with "mask" and then bit shift right "shift"
+	 * bits.  Read the appropriate value using this index and write to
+	 * "register"
+	 */
+
+	uint16_t crtcport = ROM16(bios->data[offset + 1]);
+	uint8_t crtcindex = bios->data[offset + 3];
+	uint8_t mask = bios->data[offset + 4];
+	uint8_t shift = bios->data[offset + 5];
+	uint8_t count = bios->data[offset + 6];
+	uint32_t reg = ROM32(bios->data[offset + 7]);
+	uint8_t config;
+	uint32_t configval;
+	int len = 11 + count * 4;
+
+	if (!iexec->execute)
+		return len;
+
+	BIOSLOG(bios, "0x%04X: Port: 0x%04X, Index: 0x%02X, Mask: 0x%02X, "
+		      "Shift: 0x%02X, Count: 0x%02X, Reg: 0x%08X\n",
+		offset, crtcport, crtcindex, mask, shift, count, reg);
+
+	config = (bios_idxprt_rd(bios, crtcport, crtcindex) & mask) >> shift;
+	if (config > count) {
+		NV_ERROR(bios->dev,
+			 "0x%04X: Config 0x%02X exceeds maximal bound 0x%02X\n",
+			 offset, config, count);
+		return 0;
+	}
+
+	configval = ROM32(bios->data[offset + 11 + config * 4]);
+
+	BIOSLOG(bios, "0x%04X: Writing config %02X\n", offset, config);
+
+	bios_wr32(bios, reg, configval);
+
+	return len;
+}
+
+static int
+init_repeat(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
+{
+	/*
+	 * INIT_REPEAT   opcode: 0x33 ('3')
+	 *
+	 * offset      (8 bit): opcode
+	 * offset + 1  (8 bit): count
+	 *
+	 * Execute script following this opcode up to INIT_REPEAT_END
+	 * "count" times
+	 */
+
+	uint8_t count = bios->data[offset + 1];
+	uint8_t i;
+
+	/* no iexec->execute check by design */
+
+	BIOSLOG(bios, "0x%04X: Repeating following segment %d times\n",
+		offset, count);
+
+	iexec->repeat = true;
+
+	/*
+	 * count - 1, as the script block will execute once when we leave this
+	 * opcode -- this is compatible with bios behaviour as:
+	 * a) the block is always executed at least once, even if count == 0
+	 * b) the bios interpreter skips to the op following INIT_END_REPEAT,
+	 * while we don't
+	 */
+	for (i = 0; i < count - 1; i++)
+		parse_init_table(bios, offset + 2, iexec);
+
+	iexec->repeat = false;
+
+	return 2;
+}
+
+static int
+init_io_restrict_pll(struct nvbios *bios, uint16_t offset,
+		     struct init_exec *iexec)
+{
+	/*
+	 * INIT_IO_RESTRICT_PLL   opcode: 0x34 ('4')
+	 *
+	 * offset      (8  bit): opcode
+	 * offset + 1  (16 bit): CRTC port
+	 * offset + 3  (8  bit): CRTC index
+	 * offset + 4  (8  bit): mask
+	 * offset + 5  (8  bit): shift
+	 * offset + 6  (8  bit): IO flag condition index
+	 * offset + 7  (8  bit): count
+	 * offset + 8  (32 bit): register
+	 * offset + 12 (16 bit): frequency 1
+	 * ...
+	 *
+	 * Starting at offset + 12 there are "count" 16 bit frequencies (10kHz).
+	 * Set PLL register "register" to coefficients for frequency n,
+	 * selected by reading index "CRTC index" of "CRTC port" ANDed with
+	 * "mask" and shifted right by "shift".
+	 *
+	 * If "IO flag condition index" > 0, and condition met, double
+	 * frequency before setting it.
+	 */
+
+	uint16_t crtcport = ROM16(bios->data[offset + 1]);
+	uint8_t crtcindex = bios->data[offset + 3];
+	uint8_t mask = bios->data[offset + 4];
+	uint8_t shift = bios->data[offset + 5];
+	int8_t io_flag_condition_idx = bios->data[offset + 6];
+	uint8_t count = bios->data[offset + 7];
+	uint32_t reg = ROM32(bios->data[offset + 8]);
+	uint8_t config;
+	uint16_t freq;
+	int len = 12 + count * 2;
+
+	if (!iexec->execute)
+		return len;
+
+	BIOSLOG(bios, "0x%04X: Port: 0x%04X, Index: 0x%02X, Mask: 0x%02X, "
+		      "Shift: 0x%02X, IO Flag Condition: 0x%02X, "
+		      "Count: 0x%02X, Reg: 0x%08X\n",
+		offset, crtcport, crtcindex, mask, shift,
+		io_flag_condition_idx, count, reg);
+
+	config = (bios_idxprt_rd(bios, crtcport, crtcindex) & mask) >> shift;
+	if (config > count) {
+		NV_ERROR(bios->dev,
+			 "0x%04X: Config 0x%02X exceeds maximal bound 0x%02X\n",
+			 offset, config, count);
+		return 0;
+	}
+
+	freq = ROM16(bios->data[offset + 12 + config * 2]);
+
+	if (io_flag_condition_idx > 0) {
+		if (io_flag_condition_met(bios, offset, io_flag_condition_idx)) {
+			BIOSLOG(bios, "0x%04X: Condition fulfilled -- "
+				      "frequency doubled\n", offset);
+			freq *= 2;
+		} else
+			BIOSLOG(bios, "0x%04X: Condition not fulfilled -- "
+				      "frequency unchanged\n", offset);
+	}
+
+	BIOSLOG(bios, "0x%04X: Reg: 0x%08X, Config: 0x%02X, Freq: %d0kHz\n",
+		offset, reg, config, freq);
+
+	setPLL(bios, reg, freq * 10);
+
+	return len;
+}
+
+static int
+init_end_repeat(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
+{
+	/*
+	 * INIT_END_REPEAT   opcode: 0x36 ('6')
+	 *
+	 * offset      (8 bit): opcode
+	 *
+	 * Marks the end of the block for INIT_REPEAT to repeat
+	 */
+
+	/* no iexec->execute check by design */
+
+	/*
+	 * iexec->repeat flag necessary to go past INIT_END_REPEAT opcode when
+	 * we're not in repeat mode
+	 */
+	if (iexec->repeat)
+		return 0;
+
+	return 1;
+}
+
+static int
+init_copy(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
+{
+	/*
+	 * INIT_COPY   opcode: 0x37 ('7')
+	 *
+	 * offset      (8  bit): opcode
+	 * offset + 1  (32 bit): register
+	 * offset + 5  (8  bit): shift
+	 * offset + 6  (8  bit): srcmask
+	 * offset + 7  (16 bit): CRTC port
+	 * offset + 9  (8 bit): CRTC index
+	 * offset + 10  (8 bit): mask
+	 *
+	 * Read index "CRTC index" on "CRTC port", AND with "mask", OR with
+	 * (REGVAL("register") >> "shift" & "srcmask") and write-back to CRTC
+	 * port
+	 */
+
+	uint32_t reg = ROM32(bios->data[offset + 1]);
+	uint8_t shift = bios->data[offset + 5];
+	uint8_t srcmask = bios->data[offset + 6];
+	uint16_t crtcport = ROM16(bios->data[offset + 7]);
+	uint8_t crtcindex = bios->data[offset + 9];
+	uint8_t mask = bios->data[offset + 10];
+	uint32_t data;
+	uint8_t crtcdata;
+
+	if (!iexec->execute)
+		return 11;
+
+	BIOSLOG(bios, "0x%04X: Reg: 0x%08X, Shift: 0x%02X, SrcMask: 0x%02X, "
+		      "Port: 0x%04X, Index: 0x%02X, Mask: 0x%02X\n",
+		offset, reg, shift, srcmask, crtcport, crtcindex, mask);
+
+	data = bios_rd32(bios, reg);
+
+	if (shift < 0x80)
+		data >>= shift;
+	else
+		data <<= (0x100 - shift);
+
+	data &= srcmask;
+
+	crtcdata  = bios_idxprt_rd(bios, crtcport, crtcindex) & mask;
+	crtcdata |= (uint8_t)data;
+	bios_idxprt_wr(bios, crtcport, crtcindex, crtcdata);
+
+	return 11;
+}
+
+static int
+init_not(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
+{
+	/*
+	 * INIT_NOT   opcode: 0x38 ('8')
+	 *
+	 * offset      (8  bit): opcode
+	 *
+	 * Invert the current execute / no-execute condition (i.e. "else")
+	 */
+	if (iexec->execute)
+		BIOSLOG(bios, "0x%04X: ------ Skipping following commands  ------\n", offset);
+	else
+		BIOSLOG(bios, "0x%04X: ------ Executing following commands ------\n", offset);
+
+	iexec->execute = !iexec->execute;
+	return 1;
+}
+
+static int
+init_io_flag_condition(struct nvbios *bios, uint16_t offset,
+		       struct init_exec *iexec)
+{
+	/*
+	 * INIT_IO_FLAG_CONDITION   opcode: 0x39 ('9')
+	 *
+	 * offset      (8 bit): opcode
+	 * offset + 1  (8 bit): condition number
+	 *
+	 * Check condition "condition number" in the IO flag condition table.
+	 * If condition not met skip subsequent opcodes until condition is
+	 * inverted (INIT_NOT), or we hit INIT_RESUME
+	 */
+
+	uint8_t cond = bios->data[offset + 1];
+
+	if (!iexec->execute)
+		return 2;
+
+	if (io_flag_condition_met(bios, offset, cond))
+		BIOSLOG(bios, "0x%04X: Condition fulfilled -- continuing to execute\n", offset);
+	else {
+		BIOSLOG(bios, "0x%04X: Condition not fulfilled -- skipping following commands\n", offset);
+		iexec->execute = false;
+	}
+
+	return 2;
+}
+
+static int
+init_idx_addr_latched(struct nvbios *bios, uint16_t offset,
+		      struct init_exec *iexec)
+{
+	/*
+	 * INIT_INDEX_ADDRESS_LATCHED   opcode: 0x49 ('I')
+	 *
+	 * offset      (8  bit): opcode
+	 * offset + 1  (32 bit): control register
+	 * offset + 5  (32 bit): data register
+	 * offset + 9  (32 bit): mask
+	 * offset + 13 (32 bit): data
+	 * offset + 17 (8  bit): count
+	 * offset + 18 (8  bit): address 1
+	 * offset + 19 (8  bit): data 1
+	 * ...
+	 *
+	 * For each of "count" address and data pairs, write "data n" to
+	 * "data register", read the current value of "control register",
+	 * and write it back once ANDed with "mask", ORed with "data",
+	 * and ORed with "address n"
+	 */
+
+	uint32_t controlreg = ROM32(bios->data[offset + 1]);
+	uint32_t datareg = ROM32(bios->data[offset + 5]);
+	uint32_t mask = ROM32(bios->data[offset + 9]);
+	uint32_t data = ROM32(bios->data[offset + 13]);
+	uint8_t count = bios->data[offset + 17];
+	int len = 18 + count * 2;
+	uint32_t value;
+	int i;
+
+	if (!iexec->execute)
+		return len;
+
+	BIOSLOG(bios, "0x%04X: ControlReg: 0x%08X, DataReg: 0x%08X, "
+		      "Mask: 0x%08X, Data: 0x%08X, Count: 0x%02X\n",
+		offset, controlreg, datareg, mask, data, count);
+
+	for (i = 0; i < count; i++) {
+		uint8_t instaddress = bios->data[offset + 18 + i * 2];
+		uint8_t instdata = bios->data[offset + 19 + i * 2];
+
+		BIOSLOG(bios, "0x%04X: Address: 0x%02X, Data: 0x%02X\n",
+			offset, instaddress, instdata);
+
+		bios_wr32(bios, datareg, instdata);
+		value  = bios_rd32(bios, controlreg) & mask;
+		value |= data;
+		value |= instaddress;
+		bios_wr32(bios, controlreg, value);
+	}
+
+	return len;
+}
+
+static int
+init_io_restrict_pll2(struct nvbios *bios, uint16_t offset,
+		      struct init_exec *iexec)
+{
+	/*
+	 * INIT_IO_RESTRICT_PLL2   opcode: 0x4A ('J')
+	 *
+	 * offset      (8  bit): opcode
+	 * offset + 1  (16 bit): CRTC port
+	 * offset + 3  (8  bit): CRTC index
+	 * offset + 4  (8  bit): mask
+	 * offset + 5  (8  bit): shift
+	 * offset + 6  (8  bit): count
+	 * offset + 7  (32 bit): register
+	 * offset + 11 (32 bit): frequency 1
+	 * ...
+	 *
+	 * Starting at offset + 11 there are "count" 32 bit frequencies (kHz).
+	 * Set PLL register "register" to coefficients for frequency n,
+	 * selected by reading index "CRTC index" of "CRTC port" ANDed with
+	 * "mask" and shifted right by "shift".
+	 */
+
+	uint16_t crtcport = ROM16(bios->data[offset + 1]);
+	uint8_t crtcindex = bios->data[offset + 3];
+	uint8_t mask = bios->data[offset + 4];
+	uint8_t shift = bios->data[offset + 5];
+	uint8_t count = bios->data[offset + 6];
+	uint32_t reg = ROM32(bios->data[offset + 7]);
+	int len = 11 + count * 4;
+	uint8_t config;
+	uint32_t freq;
+
+	if (!iexec->execute)
+		return len;
+
+	BIOSLOG(bios, "0x%04X: Port: 0x%04X, Index: 0x%02X, Mask: 0x%02X, "
+		      "Shift: 0x%02X, Count: 0x%02X, Reg: 0x%08X\n",
+		offset, crtcport, crtcindex, mask, shift, count, reg);
+
+	if (!reg)
+		return len;
+
+	config = (bios_idxprt_rd(bios, crtcport, crtcindex) & mask) >> shift;
+	if (config > count) {
+		NV_ERROR(bios->dev,
+			 "0x%04X: Config 0x%02X exceeds maximal bound 0x%02X\n",
+			 offset, config, count);
+		return 0;
+	}
+
+	freq = ROM32(bios->data[offset + 11 + config * 4]);
+
+	BIOSLOG(bios, "0x%04X: Reg: 0x%08X, Config: 0x%02X, Freq: %dkHz\n",
+		offset, reg, config, freq);
+
+	setPLL(bios, reg, freq);
+
+	return len;
+}
+
+static int
+init_pll2(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
+{
+	/*
+	 * INIT_PLL2   opcode: 0x4B ('K')
+	 *
+	 * offset      (8  bit): opcode
+	 * offset + 1  (32 bit): register
+	 * offset + 5  (32 bit): freq
+	 *
+	 * Set PLL register "register" to coefficients for frequency "freq"
+	 */
+
+	uint32_t reg = ROM32(bios->data[offset + 1]);
+	uint32_t freq = ROM32(bios->data[offset + 5]);
+
+	if (!iexec->execute)
+		return 9;
+
+	BIOSLOG(bios, "0x%04X: Reg: 0x%04X, Freq: %dkHz\n",
+		offset, reg, freq);
+
+	setPLL(bios, reg, freq);
+	return 9;
+}
+
+static int
+init_i2c_byte(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
+{
+	/*
+	 * INIT_I2C_BYTE   opcode: 0x4C ('L')
+	 *
+	 * offset      (8 bit): opcode
+	 * offset + 1  (8 bit): DCB I2C table entry index
+	 * offset + 2  (8 bit): I2C slave address
+	 * offset + 3  (8 bit): count
+	 * offset + 4  (8 bit): I2C register 1
+	 * offset + 5  (8 bit): mask 1
+	 * offset + 6  (8 bit): data 1
+	 * ...
+	 *
+	 * For each of "count" registers given by "I2C register n" on the device
+	 * addressed by "I2C slave address" on the I2C bus given by
+	 * "DCB I2C table entry index", read the register, AND the result with
+	 * "mask n" and OR it with "data n" before writing it back to the device
+	 */
+
+	uint8_t i2c_index = bios->data[offset + 1];
+	uint8_t i2c_address = bios->data[offset + 2];
+	uint8_t count = bios->data[offset + 3];
+	int len = 4 + count * 3;
+	struct nouveau_i2c_chan *chan;
+	struct i2c_msg msg;
+	int i;
+
+	if (!iexec->execute)
+		return len;
+
+	BIOSLOG(bios, "0x%04X: DCBI2CIndex: 0x%02X, I2CAddress: 0x%02X, "
+		      "Count: 0x%02X\n",
+		offset, i2c_index, i2c_address, count);
+
+	chan = init_i2c_device_find(bios->dev, i2c_index);
+	if (!chan)
+		return 0;
+
+	for (i = 0; i < count; i++) {
+		uint8_t i2c_reg = bios->data[offset + 4 + i * 3];
+		uint8_t mask = bios->data[offset + 5 + i * 3];
+		uint8_t data = bios->data[offset + 6 + i * 3];
+		uint8_t value;
+
+		msg.addr = i2c_address;
+		msg.flags = I2C_M_RD;
+		msg.len = 1;
+		msg.buf = &value;
+		if (i2c_transfer(&chan->adapter, &msg, 1) != 1)
+			return 0;
+
+		BIOSLOG(bios, "0x%04X: I2CReg: 0x%02X, Value: 0x%02X, "
+			      "Mask: 0x%02X, Data: 0x%02X\n",
+			offset, i2c_reg, value, mask, data);
+
+		value = (value & mask) | data;
+
+		if (bios->execute) {
+			msg.addr = i2c_address;
+			msg.flags = 0;
+			msg.len = 1;
+			msg.buf = &value;
+			if (i2c_transfer(&chan->adapter, &msg, 1) != 1)
+				return 0;
+		}
+	}
+
+	return len;
+}
+
+static int
+init_zm_i2c_byte(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
+{
+	/*
+	 * INIT_ZM_I2C_BYTE   opcode: 0x4D ('M')
+	 *
+	 * offset      (8 bit): opcode
+	 * offset + 1  (8 bit): DCB I2C table entry index
+	 * offset + 2  (8 bit): I2C slave address
+	 * offset + 3  (8 bit): count
+	 * offset + 4  (8 bit): I2C register 1
+	 * offset + 5  (8 bit): data 1
+	 * ...
+	 *
+	 * For each of "count" registers given by "I2C register n" on the device
+	 * addressed by "I2C slave address" on the I2C bus given by
+	 * "DCB I2C table entry index", set the register to "data n"
+	 */
+
+	uint8_t i2c_index = bios->data[offset + 1];
+	uint8_t i2c_address = bios->data[offset + 2];
+	uint8_t count = bios->data[offset + 3];
+	int len = 4 + count * 2;
+	struct nouveau_i2c_chan *chan;
+	struct i2c_msg msg;
+	int i;
+
+	if (!iexec->execute)
+		return len;
+
+	BIOSLOG(bios, "0x%04X: DCBI2CIndex: 0x%02X, I2CAddress: 0x%02X, "
+		      "Count: 0x%02X\n",
+		offset, i2c_index, i2c_address, count);
+
+	chan = init_i2c_device_find(bios->dev, i2c_index);
+	if (!chan)
+		return 0;
+
+	for (i = 0; i < count; i++) {
+		uint8_t i2c_reg = bios->data[offset + 4 + i * 2];
+		uint8_t data = bios->data[offset + 5 + i * 2];
+
+		BIOSLOG(bios, "0x%04X: I2CReg: 0x%02X, Data: 0x%02X\n",
+			offset, i2c_reg, data);
+
+		if (bios->execute) {
+			msg.addr = i2c_address;
+			msg.flags = 0;
+			msg.len = 1;
+			msg.buf = &data;
+			if (i2c_transfer(&chan->adapter, &msg, 1) != 1)
+				return 0;
+		}
+	}
+
+	return len;
+}
+
+static int
+init_zm_i2c(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
+{
+	/*
+	 * INIT_ZM_I2C   opcode: 0x4E ('N')
+	 *
+	 * offset      (8 bit): opcode
+	 * offset + 1  (8 bit): DCB I2C table entry index
+	 * offset + 2  (8 bit): I2C slave address
+	 * offset + 3  (8 bit): count
+	 * offset + 4  (8 bit): data 1
+	 * ...
+	 *
+	 * Send "count" bytes ("data n") to the device addressed by "I2C slave
+	 * address" on the I2C bus given by "DCB I2C table entry index"
+	 */
+
+	uint8_t i2c_index = bios->data[offset + 1];
+	uint8_t i2c_address = bios->data[offset + 2];
+	uint8_t count = bios->data[offset + 3];
+	int len = 4 + count;
+	struct nouveau_i2c_chan *chan;
+	struct i2c_msg msg;
+	uint8_t data[256];
+	int i;
+
+	if (!iexec->execute)
+		return len;
+
+	BIOSLOG(bios, "0x%04X: DCBI2CIndex: 0x%02X, I2CAddress: 0x%02X, "
+		      "Count: 0x%02X\n",
+		offset, i2c_index, i2c_address, count);
+
+	chan = init_i2c_device_find(bios->dev, i2c_index);
+	if (!chan)
+		return 0;
+
+	for (i = 0; i < count; i++) {
+		data[i] = bios->data[offset + 4 + i];
+
+		BIOSLOG(bios, "0x%04X: Data: 0x%02X\n", offset, data[i]);
+	}
+
+	if (bios->execute) {
+		msg.addr = i2c_address;
+		msg.flags = 0;
+		msg.len = count;
+		msg.buf = data;
+		if (i2c_transfer(&chan->adapter, &msg, 1) != 1)
+			return 0;
+	}
+
+	return len;
+}
+
+static int
+init_tmds(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
+{
+	/*
+	 * INIT_TMDS   opcode: 0x4F ('O')	(non-canon name)
+	 *
+	 * offset      (8 bit): opcode
+	 * offset + 1  (8 bit): magic lookup value
+	 * offset + 2  (8 bit): TMDS address
+	 * offset + 3  (8 bit): mask
+	 * offset + 4  (8 bit): data
+	 *
+	 * Read the data reg for TMDS address "TMDS address", AND it with mask
+	 * and OR it with data, then write it back
+	 * "magic lookup value" determines which TMDS base address register is
+	 * used -- see get_tmds_index_reg()
+	 */
+
+	uint8_t mlv = bios->data[offset + 1];
+	uint32_t tmdsaddr = bios->data[offset + 2];
+	uint8_t mask = bios->data[offset + 3];
+	uint8_t data = bios->data[offset + 4];
+	uint32_t reg, value;
+
+	if (!iexec->execute)
+		return 5;
+
+	BIOSLOG(bios, "0x%04X: MagicLookupValue: 0x%02X, TMDSAddr: 0x%02X, "
+		      "Mask: 0x%02X, Data: 0x%02X\n",
+		offset, mlv, tmdsaddr, mask, data);
+
+	reg = get_tmds_index_reg(bios->dev, mlv);
+	if (!reg)
+		return 0;
+
+	bios_wr32(bios, reg,
+		  tmdsaddr | NV_PRAMDAC_FP_TMDS_CONTROL_WRITE_DISABLE);
+	value = (bios_rd32(bios, reg + 4) & mask) | data;
+	bios_wr32(bios, reg + 4, value);
+	bios_wr32(bios, reg, tmdsaddr);
+
+	return 5;
+}
+
+static int
+init_zm_tmds_group(struct nvbios *bios, uint16_t offset,
+		   struct init_exec *iexec)
+{
+	/*
+	 * INIT_ZM_TMDS_GROUP   opcode: 0x50 ('P')	(non-canon name)
+	 *
+	 * offset      (8 bit): opcode
+	 * offset + 1  (8 bit): magic lookup value
+	 * offset + 2  (8 bit): count
+	 * offset + 3  (8 bit): addr 1
+	 * offset + 4  (8 bit): data 1
+	 * ...
+	 *
+	 * For each of "count" TMDS address and data pairs write "data n" to
+	 * "addr n".  "magic lookup value" determines which TMDS base address
+	 * register is used -- see get_tmds_index_reg()
+	 */
+
+	uint8_t mlv = bios->data[offset + 1];
+	uint8_t count = bios->data[offset + 2];
+	int len = 3 + count * 2;
+	uint32_t reg;
+	int i;
+
+	if (!iexec->execute)
+		return len;
+
+	BIOSLOG(bios, "0x%04X: MagicLookupValue: 0x%02X, Count: 0x%02X\n",
+		offset, mlv, count);
+
+	reg = get_tmds_index_reg(bios->dev, mlv);
+	if (!reg)
+		return 0;
+
+	for (i = 0; i < count; i++) {
+		uint8_t tmdsaddr = bios->data[offset + 3 + i * 2];
+		uint8_t tmdsdata = bios->data[offset + 4 + i * 2];
+
+		bios_wr32(bios, reg + 4, tmdsdata);
+		bios_wr32(bios, reg, tmdsaddr);
+	}
+
+	return len;
+}
+
+static int
+init_cr_idx_adr_latch(struct nvbios *bios, uint16_t offset,
+		      struct init_exec *iexec)
+{
+	/*
+	 * INIT_CR_INDEX_ADDRESS_LATCHED   opcode: 0x51 ('Q')
+	 *
+	 * offset      (8 bit): opcode
+	 * offset + 1  (8 bit): CRTC index1
+	 * offset + 2  (8 bit): CRTC index2
+	 * offset + 3  (8 bit): baseaddr
+	 * offset + 4  (8 bit): count
+	 * offset + 5  (8 bit): data 1
+	 * ...
+	 *
+	 * For each of "count" address and data pairs, write "baseaddr + n" to
+	 * "CRTC index1" and "data n" to "CRTC index2"
+	 * Once complete, restore initial value read from "CRTC index1"
+	 */
+	uint8_t crtcindex1 = bios->data[offset + 1];
+	uint8_t crtcindex2 = bios->data[offset + 2];
+	uint8_t baseaddr = bios->data[offset + 3];
+	uint8_t count = bios->data[offset + 4];
+	int len = 5 + count;
+	uint8_t oldaddr, data;
+	int i;
+
+	if (!iexec->execute)
+		return len;
+
+	BIOSLOG(bios, "0x%04X: Index1: 0x%02X, Index2: 0x%02X, "
+		      "BaseAddr: 0x%02X, Count: 0x%02X\n",
+		offset, crtcindex1, crtcindex2, baseaddr, count);
+
+	oldaddr = bios_idxprt_rd(bios, NV_CIO_CRX__COLOR, crtcindex1);
+
+	for (i = 0; i < count; i++) {
+		bios_idxprt_wr(bios, NV_CIO_CRX__COLOR, crtcindex1,
+				     baseaddr + i);
+		data = bios->data[offset + 5 + i];
+		bios_idxprt_wr(bios, NV_CIO_CRX__COLOR, crtcindex2, data);
+	}
+
+	bios_idxprt_wr(bios, NV_CIO_CRX__COLOR, crtcindex1, oldaddr);
+
+	return len;
+}
+
+static int
+init_cr(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
+{
+	/*
+	 * INIT_CR   opcode: 0x52 ('R')
+	 *
+	 * offset      (8  bit): opcode
+	 * offset + 1  (8  bit): CRTC index
+	 * offset + 2  (8  bit): mask
+	 * offset + 3  (8  bit): data
+	 *
+	 * Assign the value of at "CRTC index" ANDed with mask and ORed with
+	 * data back to "CRTC index"
+	 */
+
+	uint8_t crtcindex = bios->data[offset + 1];
+	uint8_t mask = bios->data[offset + 2];
+	uint8_t data = bios->data[offset + 3];
+	uint8_t value;
+
+	if (!iexec->execute)
+		return 4;
+
+	BIOSLOG(bios, "0x%04X: Index: 0x%02X, Mask: 0x%02X, Data: 0x%02X\n",
+		offset, crtcindex, mask, data);
+
+	value  = bios_idxprt_rd(bios, NV_CIO_CRX__COLOR, crtcindex) & mask;
+	value |= data;
+	bios_idxprt_wr(bios, NV_CIO_CRX__COLOR, crtcindex, value);
+
+	return 4;
+}
+
+static int
+init_zm_cr(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
+{
+	/*
+	 * INIT_ZM_CR   opcode: 0x53 ('S')
+	 *
+	 * offset      (8 bit): opcode
+	 * offset + 1  (8 bit): CRTC index
+	 * offset + 2  (8 bit): value
+	 *
+	 * Assign "value" to CRTC register with index "CRTC index".
+	 */
+
+	uint8_t crtcindex = ROM32(bios->data[offset + 1]);
+	uint8_t data = bios->data[offset + 2];
+
+	if (!iexec->execute)
+		return 3;
+
+	bios_idxprt_wr(bios, NV_CIO_CRX__COLOR, crtcindex, data);
+
+	return 3;
+}
+
+static int
+init_zm_cr_group(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
+{
+	/*
+	 * INIT_ZM_CR_GROUP   opcode: 0x54 ('T')
+	 *
+	 * offset      (8 bit): opcode
+	 * offset + 1  (8 bit): count
+	 * offset + 2  (8 bit): CRTC index 1
+	 * offset + 3  (8 bit): value 1
+	 * ...
+	 *
+	 * For "count", assign "value n" to CRTC register with index
+	 * "CRTC index n".
+	 */
+
+	uint8_t count = bios->data[offset + 1];
+	int len = 2 + count * 2;
+	int i;
+
+	if (!iexec->execute)
+		return len;
+
+	for (i = 0; i < count; i++)
+		init_zm_cr(bios, offset + 2 + 2 * i - 1, iexec);
+
+	return len;
+}
+
+static int
+init_condition_time(struct nvbios *bios, uint16_t offset,
+		    struct init_exec *iexec)
+{
+	/*
+	 * INIT_CONDITION_TIME   opcode: 0x56 ('V')
+	 *
+	 * offset      (8 bit): opcode
+	 * offset + 1  (8 bit): condition number
+	 * offset + 2  (8 bit): retries / 50
+	 *
+	 * Check condition "condition number" in the condition table.
+	 * Bios code then sleeps for 2ms if the condition is not met, and
+	 * repeats up to "retries" times, but on one C51 this has proved
+	 * insufficient.  In mmiotraces the driver sleeps for 20ms, so we do
+	 * this, and bail after "retries" times, or 2s, whichever is less.
+	 * If still not met after retries, clear execution flag for this table.
+	 */
+
+	uint8_t cond = bios->data[offset + 1];
+	uint16_t retries = bios->data[offset + 2] * 50;
+	unsigned cnt;
+
+	if (!iexec->execute)
+		return 3;
+
+	if (retries > 100)
+		retries = 100;
+
+	BIOSLOG(bios, "0x%04X: Condition: 0x%02X, Retries: 0x%02X\n",
+		offset, cond, retries);
+
+	if (!bios->execute) /* avoid 2s delays when "faking" execution */
+		retries = 1;
+
+	for (cnt = 0; cnt < retries; cnt++) {
+		if (bios_condition_met(bios, offset, cond)) {
+			BIOSLOG(bios, "0x%04X: Condition met, continuing\n",
+								offset);
+			break;
+		} else {
+			BIOSLOG(bios, "0x%04X: "
+				"Condition not met, sleeping for 20ms\n",
+								offset);
+			msleep(20);
+		}
+	}
+
+	if (!bios_condition_met(bios, offset, cond)) {
+		NV_WARN(bios->dev,
+			"0x%04X: Condition still not met after %dms, "
+			"skipping following opcodes\n", offset, 20 * retries);
+		iexec->execute = false;
+	}
+
+	return 3;
+}
+
+static int
+init_zm_reg_sequence(struct nvbios *bios, uint16_t offset,
+		     struct init_exec *iexec)
+{
+	/*
+	 * INIT_ZM_REG_SEQUENCE   opcode: 0x58 ('X')
+	 *
+	 * offset      (8  bit): opcode
+	 * offset + 1  (32 bit): base register
+	 * offset + 5  (8  bit): count
+	 * offset + 6  (32 bit): value 1
+	 * ...
+	 *
+	 * Starting at offset + 6 there are "count" 32 bit values.
+	 * For "count" iterations set "base register" + 4 * current_iteration
+	 * to "value current_iteration"
+	 */
+
+	uint32_t basereg = ROM32(bios->data[offset + 1]);
+	uint32_t count = bios->data[offset + 5];
+	int len = 6 + count * 4;
+	int i;
+
+	if (!iexec->execute)
+		return len;
+
+	BIOSLOG(bios, "0x%04X: BaseReg: 0x%08X, Count: 0x%02X\n",
+		offset, basereg, count);
+
+	for (i = 0; i < count; i++) {
+		uint32_t reg = basereg + i * 4;
+		uint32_t data = ROM32(bios->data[offset + 6 + i * 4]);
+
+		bios_wr32(bios, reg, data);
+	}
+
+	return len;
+}
+
+static int
+init_sub_direct(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
+{
+	/*
+	 * INIT_SUB_DIRECT   opcode: 0x5B ('[')
+	 *
+	 * offset      (8  bit): opcode
+	 * offset + 1  (16 bit): subroutine offset (in bios)
+	 *
+	 * Calls a subroutine that will execute commands until INIT_DONE
+	 * is found.
+	 */
+
+	uint16_t sub_offset = ROM16(bios->data[offset + 1]);
+
+	if (!iexec->execute)
+		return 3;
+
+	BIOSLOG(bios, "0x%04X: Executing subroutine at 0x%04X\n",
+		offset, sub_offset);
+
+	parse_init_table(bios, sub_offset, iexec);
+
+	BIOSLOG(bios, "0x%04X: End of 0x%04X subroutine\n", offset, sub_offset);
+
+	return 3;
+}
+
+static int
+init_copy_nv_reg(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
+{
+	/*
+	 * INIT_COPY_NV_REG   opcode: 0x5F ('_')
+	 *
+	 * offset      (8  bit): opcode
+	 * offset + 1  (32 bit): src reg
+	 * offset + 5  (8  bit): shift
+	 * offset + 6  (32 bit): src mask
+	 * offset + 10 (32 bit): xor
+	 * offset + 14 (32 bit): dst reg
+	 * offset + 18 (32 bit): dst mask
+	 *
+	 * Shift REGVAL("src reg") right by (signed) "shift", AND result with
+	 * "src mask", then XOR with "xor". Write this OR'd with
+	 * (REGVAL("dst reg") AND'd with "dst mask") to "dst reg"
+	 */
+
+	uint32_t srcreg = *((uint32_t *)(&bios->data[offset + 1]));
+	uint8_t shift = bios->data[offset + 5];
+	uint32_t srcmask = *((uint32_t *)(&bios->data[offset + 6]));
+	uint32_t xor = *((uint32_t *)(&bios->data[offset + 10]));
+	uint32_t dstreg = *((uint32_t *)(&bios->data[offset + 14]));
+	uint32_t dstmask = *((uint32_t *)(&bios->data[offset + 18]));
+	uint32_t srcvalue, dstvalue;
+
+	if (!iexec->execute)
+		return 22;
+
+	BIOSLOG(bios, "0x%04X: SrcReg: 0x%08X, Shift: 0x%02X, SrcMask: 0x%08X, "
+		      "Xor: 0x%08X, DstReg: 0x%08X, DstMask: 0x%08X\n",
+		offset, srcreg, shift, srcmask, xor, dstreg, dstmask);
+
+	srcvalue = bios_rd32(bios, srcreg);
+
+	if (shift < 0x80)
+		srcvalue >>= shift;
+	else
+		srcvalue <<= (0x100 - shift);
+
+	srcvalue = (srcvalue & srcmask) ^ xor;
+
+	dstvalue = bios_rd32(bios, dstreg) & dstmask;
+
+	bios_wr32(bios, dstreg, dstvalue | srcvalue);
+
+	return 22;
+}
+
+static int
+init_zm_index_io(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
+{
+	/*
+	 * INIT_ZM_INDEX_IO   opcode: 0x62 ('b')
+	 *
+	 * offset      (8  bit): opcode
+	 * offset + 1  (16 bit): CRTC port
+	 * offset + 3  (8  bit): CRTC index
+	 * offset + 4  (8  bit): data
+	 *
+	 * Write "data" to index "CRTC index" of "CRTC port"
+	 */
+	uint16_t crtcport = ROM16(bios->data[offset + 1]);
+	uint8_t crtcindex = bios->data[offset + 3];
+	uint8_t data = bios->data[offset + 4];
+
+	if (!iexec->execute)
+		return 5;
+
+	bios_idxprt_wr(bios, crtcport, crtcindex, data);
+
+	return 5;
+}
+
+static int
+init_compute_mem(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
+{
+	/*
+	 * INIT_COMPUTE_MEM   opcode: 0x63 ('c')
+	 *
+	 * offset      (8 bit): opcode
+	 *
+	 * This opcode is meant to set NV_PFB_CFG0 (0x100200) appropriately so
+	 * that the hardware can correctly calculate how much VRAM it has
+	 * (and subsequently report that value in NV_PFB_CSTATUS (0x10020C))
+	 *
+	 * The implementation of this opcode in general consists of two parts:
+	 * 1) determination of the memory bus width
+	 * 2) determination of how many of the card's RAM pads have ICs attached
+	 *
+	 * 1) is done by a cunning combination of writes to offsets 0x1c and
+	 * 0x3c in the framebuffer, and seeing whether the written values are
+	 * read back correctly. This then affects bits 4-7 of NV_PFB_CFG0
+	 *
+	 * 2) is done by a cunning combination of writes to an offset slightly
+	 * less than the maximum memory reported by NV_PFB_CSTATUS, then seeing
+	 * if the test pattern can be read back. This then affects bits 12-15 of
+	 * NV_PFB_CFG0
+	 *
+	 * In this context a "cunning combination" may include multiple reads
+	 * and writes to varying locations, often alternating the test pattern
+	 * and 0, doubtless to make sure buffers are filled, residual charges
+	 * on tracks are removed etc.
+	 *
+	 * Unfortunately, the "cunning combination"s mentioned above, and the
+	 * changes to the bits in NV_PFB_CFG0 differ with nearly every bios
+	 * trace I have.
+	 *
+	 * Therefore, we cheat and assume the value of NV_PFB_CFG0 with which
+	 * we started was correct, and use that instead
+	 */
+
+	/* no iexec->execute check by design */
+
+	/*
+	 * This appears to be a NOP on G8x chipsets, both io logs of the VBIOS
+	 * and kmmio traces of the binary driver POSTing the card show nothing
+	 * being done for this opcode.  why is it still listed in the table?!
+	 */
+
+	struct drm_nouveau_private *dev_priv = bios->dev->dev_private;
+
+	if (dev_priv->card_type >= NV_50)
+		return 1;
+
+	/*
+	 * On every card I've seen, this step gets done for us earlier in
+	 * the init scripts
+	uint8_t crdata = bios_idxprt_rd(dev, NV_VIO_SRX, 0x01);
+	bios_idxprt_wr(dev, NV_VIO_SRX, 0x01, crdata | 0x20);
+	 */
+
+	/*
+	 * This also has probably been done in the scripts, but an mmio trace of
+	 * s3 resume shows nvidia doing it anyway (unlike the NV_VIO_SRX write)
+	 */
+	bios_wr32(bios, NV_PFB_REFCTRL, NV_PFB_REFCTRL_VALID_1);
+
+	/* write back the saved configuration value */
+	bios_wr32(bios, NV_PFB_CFG0, bios->state.saved_nv_pfb_cfg0);
+
+	return 1;
+}
+
+static int
+init_reset(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
+{
+	/*
+	 * INIT_RESET   opcode: 0x65 ('e')
+	 *
+	 * offset      (8  bit): opcode
+	 * offset + 1  (32 bit): register
+	 * offset + 5  (32 bit): value1
+	 * offset + 9  (32 bit): value2
+	 *
+	 * Assign "value1" to "register", then assign "value2" to "register"
+	 */
+
+	uint32_t reg = ROM32(bios->data[offset + 1]);
+	uint32_t value1 = ROM32(bios->data[offset + 5]);
+	uint32_t value2 = ROM32(bios->data[offset + 9]);
+	uint32_t pci_nv_19, pci_nv_20;
+
+	/* no iexec->execute check by design */
+
+	pci_nv_19 = bios_rd32(bios, NV_PBUS_PCI_NV_19);
+	bios_wr32(bios, NV_PBUS_PCI_NV_19, 0);
+	bios_wr32(bios, reg, value1);
+
+	udelay(10);
+
+	bios_wr32(bios, reg, value2);
+	bios_wr32(bios, NV_PBUS_PCI_NV_19, pci_nv_19);
+
+	pci_nv_20 = bios_rd32(bios, NV_PBUS_PCI_NV_20);
+	pci_nv_20 &= ~NV_PBUS_PCI_NV_20_ROM_SHADOW_ENABLED;	/* 0xfffffffe */
+	bios_wr32(bios, NV_PBUS_PCI_NV_20, pci_nv_20);
+
+	return 13;
+}
+
+static int
+init_configure_mem(struct nvbios *bios, uint16_t offset,
+		   struct init_exec *iexec)
+{
+	/*
+	 * INIT_CONFIGURE_MEM   opcode: 0x66 ('f')
+	 *
+	 * offset      (8 bit): opcode
+	 *
+	 * Equivalent to INIT_DONE on bios version 3 or greater.
+	 * For early bios versions, sets up the memory registers, using values
+	 * taken from the memory init table
+	 */
+
+	/* no iexec->execute check by design */
+
+	uint16_t meminitoffs = bios->legacy.mem_init_tbl_ptr + MEM_INIT_SIZE * (bios_idxprt_rd(bios, NV_CIO_CRX__COLOR, NV_CIO_CRE_SCRATCH4__INDEX) >> 4);
+	uint16_t seqtbloffs = bios->legacy.sdr_seq_tbl_ptr, meminitdata = meminitoffs + 6;
+	uint32_t reg, data;
+
+	if (bios->major_version > 2)
+		return 0;
+
+	bios_idxprt_wr(bios, NV_VIO_SRX, NV_VIO_SR_CLOCK_INDEX, bios_idxprt_rd(
+		       bios, NV_VIO_SRX, NV_VIO_SR_CLOCK_INDEX) | 0x20);
+
+	if (bios->data[meminitoffs] & 1)
+		seqtbloffs = bios->legacy.ddr_seq_tbl_ptr;
+
+	for (reg = ROM32(bios->data[seqtbloffs]);
+	     reg != 0xffffffff;
+	     reg = ROM32(bios->data[seqtbloffs += 4])) {
+
+		switch (reg) {
+		case NV_PFB_PRE:
+			data = NV_PFB_PRE_CMD_PRECHARGE;
+			break;
+		case NV_PFB_PAD:
+			data = NV_PFB_PAD_CKE_NORMAL;
+			break;
+		case NV_PFB_REF:
+			data = NV_PFB_REF_CMD_REFRESH;
+			break;
+		default:
+			data = ROM32(bios->data[meminitdata]);
+			meminitdata += 4;
+			if (data == 0xffffffff)
+				continue;
+		}
+
+		bios_wr32(bios, reg, data);
+	}
+
+	return 1;
+}
+
+static int
+init_configure_clk(struct nvbios *bios, uint16_t offset,
+		   struct init_exec *iexec)
+{
+	/*
+	 * INIT_CONFIGURE_CLK   opcode: 0x67 ('g')
+	 *
+	 * offset      (8 bit): opcode
+	 *
+	 * Equivalent to INIT_DONE on bios version 3 or greater.
+	 * For early bios versions, sets up the NVClk and MClk PLLs, using
+	 * values taken from the memory init table
+	 */
+
+	/* no iexec->execute check by design */
+
+	uint16_t meminitoffs = bios->legacy.mem_init_tbl_ptr + MEM_INIT_SIZE * (bios_idxprt_rd(bios, NV_CIO_CRX__COLOR, NV_CIO_CRE_SCRATCH4__INDEX) >> 4);
+	int clock;
+
+	if (bios->major_version > 2)
+		return 0;
+
+	clock = ROM16(bios->data[meminitoffs + 4]) * 10;
+	setPLL(bios, NV_PRAMDAC_NVPLL_COEFF, clock);
+
+	clock = ROM16(bios->data[meminitoffs + 2]) * 10;
+	if (bios->data[meminitoffs] & 1) /* DDR */
+		clock *= 2;
+	setPLL(bios, NV_PRAMDAC_MPLL_COEFF, clock);
+
+	return 1;
+}
+
+static int
+init_configure_preinit(struct nvbios *bios, uint16_t offset,
+		       struct init_exec *iexec)
+{
+	/*
+	 * INIT_CONFIGURE_PREINIT   opcode: 0x68 ('h')
+	 *
+	 * offset      (8 bit): opcode
+	 *
+	 * Equivalent to INIT_DONE on bios version 3 or greater.
+	 * For early bios versions, does early init, loading ram and crystal
+	 * configuration from straps into CR3C
+	 */
+
+	/* no iexec->execute check by design */
+
+	uint32_t straps = bios_rd32(bios, NV_PEXTDEV_BOOT_0);
+	uint8_t cr3c = ((straps << 2) & 0xf0) | (straps & (1 << 6));
+
+	if (bios->major_version > 2)
+		return 0;
+
+	bios_idxprt_wr(bios, NV_CIO_CRX__COLOR,
+			     NV_CIO_CRE_SCRATCH4__INDEX, cr3c);
+
+	return 1;
+}
+
+static int
+init_io(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
+{
+	/*
+	 * INIT_IO   opcode: 0x69 ('i')
+	 *
+	 * offset      (8  bit): opcode
+	 * offset + 1  (16 bit): CRTC port
+	 * offset + 3  (8  bit): mask
+	 * offset + 4  (8  bit): data
+	 *
+	 * Assign ((IOVAL("crtc port") & "mask") | "data") to "crtc port"
+	 */
+
+	struct drm_nouveau_private *dev_priv = bios->dev->dev_private;
+	uint16_t crtcport = ROM16(bios->data[offset + 1]);
+	uint8_t mask = bios->data[offset + 3];
+	uint8_t data = bios->data[offset + 4];
+
+	if (!iexec->execute)
+		return 5;
+
+	BIOSLOG(bios, "0x%04X: Port: 0x%04X, Mask: 0x%02X, Data: 0x%02X\n",
+		offset, crtcport, mask, data);
+
+	/*
+	 * I have no idea what this does, but NVIDIA do this magic sequence
+	 * in the places where this INIT_IO happens..
+	 */
+	if (dev_priv->card_type >= NV_50 && crtcport == 0x3c3 && data == 1) {
+		int i;
+
+		bios_wr32(bios, 0x614100, (bios_rd32(
+			  bios, 0x614100) & 0x0fffffff) | 0x00800000);
+
+		bios_wr32(bios, 0x00e18c, bios_rd32(
+			  bios, 0x00e18c) | 0x00020000);
+
+		bios_wr32(bios, 0x614900, (bios_rd32(
+			  bios, 0x614900) & 0x0fffffff) | 0x00800000);
+
+		bios_wr32(bios, 0x000200, bios_rd32(
+			  bios, 0x000200) & ~0x40000000);
+
+		mdelay(10);
+
+		bios_wr32(bios, 0x00e18c, bios_rd32(
+			  bios, 0x00e18c) & ~0x00020000);
+
+		bios_wr32(bios, 0x000200, bios_rd32(
+			  bios, 0x000200) | 0x40000000);
+
+		bios_wr32(bios, 0x614100, 0x00800018);
+		bios_wr32(bios, 0x614900, 0x00800018);
+
+		mdelay(10);
+
+		bios_wr32(bios, 0x614100, 0x10000018);
+		bios_wr32(bios, 0x614900, 0x10000018);
+
+		for (i = 0; i < 3; i++)
+			bios_wr32(bios, 0x614280 + (i*0x800), bios_rd32(
+				  bios, 0x614280 + (i*0x800)) & 0xf0f0f0f0);
+
+		for (i = 0; i < 2; i++)
+			bios_wr32(bios, 0x614300 + (i*0x800), bios_rd32(
+				  bios, 0x614300 + (i*0x800)) & 0xfffff0f0);
+
+		for (i = 0; i < 3; i++)
+			bios_wr32(bios, 0x614380 + (i*0x800), bios_rd32(
+				  bios, 0x614380 + (i*0x800)) & 0xfffff0f0);
+
+		for (i = 0; i < 2; i++)
+			bios_wr32(bios, 0x614200 + (i*0x800), bios_rd32(
+				  bios, 0x614200 + (i*0x800)) & 0xfffffff0);
+
+		for (i = 0; i < 2; i++)
+			bios_wr32(bios, 0x614108 + (i*0x800), bios_rd32(
+				  bios, 0x614108 + (i*0x800)) & 0x0fffffff);
+		return 5;
+	}
+
+	bios_port_wr(bios, crtcport, (bios_port_rd(bios, crtcport) & mask) |
+									data);
+	return 5;
+}
+
+static int
+init_sub(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
+{
+	/*
+	 * INIT_SUB   opcode: 0x6B ('k')
+	 *
+	 * offset      (8 bit): opcode
+	 * offset + 1  (8 bit): script number
+	 *
+	 * Execute script number "script number", as a subroutine
+	 */
+
+	uint8_t sub = bios->data[offset + 1];
+
+	if (!iexec->execute)
+		return 2;
+
+	BIOSLOG(bios, "0x%04X: Calling script %d\n", offset, sub);
+
+	parse_init_table(bios,
+			 ROM16(bios->data[bios->init_script_tbls_ptr + sub * 2]),
+			 iexec);
+
+	BIOSLOG(bios, "0x%04X: End of script %d\n", offset, sub);
+
+	return 2;
+}
+
+static int
+init_ram_condition(struct nvbios *bios, uint16_t offset,
+		   struct init_exec *iexec)
+{
+	/*
+	 * INIT_RAM_CONDITION   opcode: 0x6D ('m')
+	 *
+	 * offset      (8 bit): opcode
+	 * offset + 1  (8 bit): mask
+	 * offset + 2  (8 bit): cmpval
+	 *
+	 * Test if (NV_PFB_BOOT_0 & "mask") equals "cmpval".
+	 * If condition not met skip subsequent opcodes until condition is
+	 * inverted (INIT_NOT), or we hit INIT_RESUME
+	 */
+
+	uint8_t mask = bios->data[offset + 1];
+	uint8_t cmpval = bios->data[offset + 2];
+	uint8_t data;
+
+	if (!iexec->execute)
+		return 3;
+
+	data = bios_rd32(bios, NV_PFB_BOOT_0) & mask;
+
+	BIOSLOG(bios, "0x%04X: Checking if 0x%08X equals 0x%08X\n",
+		offset, data, cmpval);
+
+	if (data == cmpval)
+		BIOSLOG(bios, "0x%04X: Condition fulfilled -- continuing to execute\n", offset);
+	else {
+		BIOSLOG(bios, "0x%04X: Condition not fulfilled -- skipping following commands\n", offset);
+		iexec->execute = false;
+	}
+
+	return 3;
+}
+
+static int
+init_nv_reg(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
+{
+	/*
+	 * INIT_NV_REG   opcode: 0x6E ('n')
+	 *
+	 * offset      (8  bit): opcode
+	 * offset + 1  (32 bit): register
+	 * offset + 5  (32 bit): mask
+	 * offset + 9  (32 bit): data
+	 *
+	 * Assign ((REGVAL("register") & "mask") | "data") to "register"
+	 */
+
+	uint32_t reg = ROM32(bios->data[offset + 1]);
+	uint32_t mask = ROM32(bios->data[offset + 5]);
+	uint32_t data = ROM32(bios->data[offset + 9]);
+
+	if (!iexec->execute)
+		return 13;
+
+	BIOSLOG(bios, "0x%04X: Reg: 0x%08X, Mask: 0x%08X, Data: 0x%08X\n",
+		offset, reg, mask, data);
+
+	bios_wr32(bios, reg, (bios_rd32(bios, reg) & mask) | data);
+
+	return 13;
+}
+
+static int
+init_macro(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
+{
+	/*
+	 * INIT_MACRO   opcode: 0x6F ('o')
+	 *
+	 * offset      (8 bit): opcode
+	 * offset + 1  (8 bit): macro number
+	 *
+	 * Look up macro index "macro number" in the macro index table.
+	 * The macro index table entry has 1 byte for the index in the macro
+	 * table, and 1 byte for the number of times to repeat the macro.
+	 * The macro table entry has 4 bytes for the register address and
+	 * 4 bytes for the value to write to that register
+	 */
+
+	uint8_t macro_index_tbl_idx = bios->data[offset + 1];
+	uint16_t tmp = bios->macro_index_tbl_ptr + (macro_index_tbl_idx * MACRO_INDEX_SIZE);
+	uint8_t macro_tbl_idx = bios->data[tmp];
+	uint8_t count = bios->data[tmp + 1];
+	uint32_t reg, data;
+	int i;
+
+	if (!iexec->execute)
+		return 2;
+
+	BIOSLOG(bios, "0x%04X: Macro: 0x%02X, MacroTableIndex: 0x%02X, "
+		      "Count: 0x%02X\n",
+		offset, macro_index_tbl_idx, macro_tbl_idx, count);
+
+	for (i = 0; i < count; i++) {
+		uint16_t macroentryptr = bios->macro_tbl_ptr + (macro_tbl_idx + i) * MACRO_SIZE;
+
+		reg = ROM32(bios->data[macroentryptr]);
+		data = ROM32(bios->data[macroentryptr + 4]);
+
+		bios_wr32(bios, reg, data);
+	}
+
+	return 2;
+}
+
+static int
+init_done(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
+{
+	/*
+	 * INIT_DONE   opcode: 0x71 ('q')
+	 *
+	 * offset      (8  bit): opcode
+	 *
+	 * End the current script
+	 */
+
+	/* mild retval abuse to stop parsing this table */
+	return 0;
+}
+
+static int
+init_resume(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
+{
+	/*
+	 * INIT_RESUME   opcode: 0x72 ('r')
+	 *
+	 * offset      (8  bit): opcode
+	 *
+	 * End the current execute / no-execute condition
+	 */
+
+	if (iexec->execute)
+		return 1;
+
+	iexec->execute = true;
+	BIOSLOG(bios, "0x%04X: ---- Executing following commands ----\n", offset);
+
+	return 1;
+}
+
+static int
+init_time(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
+{
+	/*
+	 * INIT_TIME   opcode: 0x74 ('t')
+	 *
+	 * offset      (8  bit): opcode
+	 * offset + 1  (16 bit): time
+	 *
+	 * Sleep for "time" microseconds.
+	 */
+
+	unsigned time = ROM16(bios->data[offset + 1]);
+
+	if (!iexec->execute)
+		return 3;
+
+	BIOSLOG(bios, "0x%04X: Sleeping for 0x%04X microseconds\n",
+		offset, time);
+
+	if (time < 1000)
+		udelay(time);
+	else
+		msleep((time + 900) / 1000);
+
+	return 3;
+}
+
+static int
+init_condition(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
+{
+	/*
+	 * INIT_CONDITION   opcode: 0x75 ('u')
+	 *
+	 * offset      (8 bit): opcode
+	 * offset + 1  (8 bit): condition number
+	 *
+	 * Check condition "condition number" in the condition table.
+	 * If condition not met skip subsequent opcodes until condition is
+	 * inverted (INIT_NOT), or we hit INIT_RESUME
+	 */
+
+	uint8_t cond = bios->data[offset + 1];
+
+	if (!iexec->execute)
+		return 2;
+
+	BIOSLOG(bios, "0x%04X: Condition: 0x%02X\n", offset, cond);
+
+	if (bios_condition_met(bios, offset, cond))
+		BIOSLOG(bios, "0x%04X: Condition fulfilled -- continuing to execute\n", offset);
+	else {
+		BIOSLOG(bios, "0x%04X: Condition not fulfilled -- skipping following commands\n", offset);
+		iexec->execute = false;
+	}
+
+	return 2;
+}
+
+static int
+init_io_condition(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
+{
+	/*
+	 * INIT_IO_CONDITION  opcode: 0x76
+	 *
+	 * offset      (8 bit): opcode
+	 * offset + 1  (8 bit): condition number
+	 *
+	 * Check condition "condition number" in the io condition table.
+	 * If condition not met skip subsequent opcodes until condition is
+	 * inverted (INIT_NOT), or we hit INIT_RESUME
+	 */
+
+	uint8_t cond = bios->data[offset + 1];
+
+	if (!iexec->execute)
+		return 2;
+
+	BIOSLOG(bios, "0x%04X: IO condition: 0x%02X\n", offset, cond);
+
+	if (io_condition_met(bios, offset, cond))
+		BIOSLOG(bios, "0x%04X: Condition fulfilled -- continuing to execute\n", offset);
+	else {
+		BIOSLOG(bios, "0x%04X: Condition not fulfilled -- skipping following commands\n", offset);
+		iexec->execute = false;
+	}
+
+	return 2;
+}
+
+static int
+init_index_io(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
+{
+	/*
+	 * INIT_INDEX_IO   opcode: 0x78 ('x')
+	 *
+	 * offset      (8  bit): opcode
+	 * offset + 1  (16 bit): CRTC port
+	 * offset + 3  (8  bit): CRTC index
+	 * offset + 4  (8  bit): mask
+	 * offset + 5  (8  bit): data
+	 *
+	 * Read value at index "CRTC index" on "CRTC port", AND with "mask",
+	 * OR with "data", write-back
+	 */
+
+	uint16_t crtcport = ROM16(bios->data[offset + 1]);
+	uint8_t crtcindex = bios->data[offset + 3];
+	uint8_t mask = bios->data[offset + 4];
+	uint8_t data = bios->data[offset + 5];
+	uint8_t value;
+
+	if (!iexec->execute)
+		return 6;
+
+	BIOSLOG(bios, "0x%04X: Port: 0x%04X, Index: 0x%02X, Mask: 0x%02X, "
+		      "Data: 0x%02X\n",
+		offset, crtcport, crtcindex, mask, data);
+
+	value = (bios_idxprt_rd(bios, crtcport, crtcindex) & mask) | data;
+	bios_idxprt_wr(bios, crtcport, crtcindex, value);
+
+	return 6;
+}
+
+static int
+init_pll(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
+{
+	/*
+	 * INIT_PLL   opcode: 0x79 ('y')
+	 *
+	 * offset      (8  bit): opcode
+	 * offset + 1  (32 bit): register
+	 * offset + 5  (16 bit): freq
+	 *
+	 * Set PLL register "register" to coefficients for frequency (10kHz)
+	 * "freq"
+	 */
+
+	uint32_t reg = ROM32(bios->data[offset + 1]);
+	uint16_t freq = ROM16(bios->data[offset + 5]);
+
+	if (!iexec->execute)
+		return 7;
+
+	BIOSLOG(bios, "0x%04X: Reg: 0x%08X, Freq: %d0kHz\n", offset, reg, freq);
+
+	setPLL(bios, reg, freq * 10);
+
+	return 7;
+}
+
+static int
+init_zm_reg(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
+{
+	/*
+	 * INIT_ZM_REG   opcode: 0x7A ('z')
+	 *
+	 * offset      (8  bit): opcode
+	 * offset + 1  (32 bit): register
+	 * offset + 5  (32 bit): value
+	 *
+	 * Assign "value" to "register"
+	 */
+
+	uint32_t reg = ROM32(bios->data[offset + 1]);
+	uint32_t value = ROM32(bios->data[offset + 5]);
+
+	if (!iexec->execute)
+		return 9;
+
+	if (reg == 0x000200)
+		value |= 1;
+
+	bios_wr32(bios, reg, value);
+
+	return 9;
+}
+
+static int
+init_ram_restrict_pll(struct nvbios *bios, uint16_t offset,
+		      struct init_exec *iexec)
+{
+	/*
+	 * INIT_RAM_RESTRICT_PLL   opcode: 0x87 ('')
+	 *
+	 * offset      (8 bit): opcode
+	 * offset + 1  (8 bit): PLL type
+	 * offset + 2 (32 bit): frequency 0
+	 *
+	 * Uses the RAMCFG strap of PEXTDEV_BOOT as an index into the table at
+	 * ram_restrict_table_ptr.  The value read from there is used to select
+	 * a frequency from the table starting at 'frequency 0' to be
+	 * programmed into the PLL corresponding to 'type'.
+	 *
+	 * The PLL limits table on cards using this opcode has a mapping of
+	 * 'type' to the relevant registers.
+	 */
+
+	struct drm_device *dev = bios->dev;
+	uint32_t strap = (bios_rd32(bios, NV_PEXTDEV_BOOT_0) & 0x0000003c) >> 2;
+	uint8_t index = bios->data[bios->ram_restrict_tbl_ptr + strap];
+	uint8_t type = bios->data[offset + 1];
+	uint32_t freq = ROM32(bios->data[offset + 2 + (index * 4)]);
+	uint8_t *pll_limits = &bios->data[bios->pll_limit_tbl_ptr], *entry;
+	int len = 2 + bios->ram_restrict_group_count * 4;
+	int i;
+
+	if (!iexec->execute)
+		return len;
+
+	if (!bios->pll_limit_tbl_ptr || (pll_limits[0] & 0xf0) != 0x30) {
+		NV_ERROR(dev, "PLL limits table not version 3.x\n");
+		return len; /* deliberate, allow default clocks to remain */
+	}
+
+	entry = pll_limits + pll_limits[1];
+	for (i = 0; i < pll_limits[3]; i++, entry += pll_limits[2]) {
+		if (entry[0] == type) {
+			uint32_t reg = ROM32(entry[3]);
+
+			BIOSLOG(bios, "0x%04X: "
+				      "Type %02x Reg 0x%08x Freq %dKHz\n",
+				offset, type, reg, freq);
+
+			setPLL(bios, reg, freq);
+			return len;
+		}
+	}
+
+	NV_ERROR(dev, "PLL type 0x%02x not found in PLL limits table", type);
+	return len;
+}
+
+static int
+init_8c(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
+{
+	/*
+	 * INIT_8C   opcode: 0x8C ('')
+	 *
+	 * NOP so far....
+	 *
+	 */
+
+	return 1;
+}
+
+static int
+init_8d(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
+{
+	/*
+	 * INIT_8D   opcode: 0x8D ('')
+	 *
+	 * NOP so far....
+	 *
+	 */
+
+	return 1;
+}
+
+static int
+init_gpio(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
+{
+	/*
+	 * INIT_GPIO   opcode: 0x8E ('')
+	 *
+	 * offset      (8 bit): opcode
+	 *
+	 * Loop over all entries in the DCB GPIO table, and initialise
+	 * each GPIO according to various values listed in each entry
+	 */
+
+	const uint32_t nv50_gpio_reg[4] = { 0xe104, 0xe108, 0xe280, 0xe284 };
+	const uint32_t nv50_gpio_ctl[2] = { 0xe100, 0xe28c };
+	const uint8_t *gpio_table = &bios->data[bios->bdcb.gpio_table_ptr];
+	const uint8_t *gpio_entry;
+	int i;
+
+	if (!iexec->execute)
+		return 1;
+
+	if (bios->bdcb.version != 0x40) {
+		NV_ERROR(bios->dev, "DCB table not version 4.0\n");
+		return 0;
+	}
+
+	if (!bios->bdcb.gpio_table_ptr) {
+		NV_WARN(bios->dev, "Invalid pointer to INIT_8E table\n");
+		return 0;
+	}
+
+	gpio_entry = gpio_table + gpio_table[1];
+	for (i = 0; i < gpio_table[2]; i++, gpio_entry += gpio_table[3]) {
+		uint32_t entry = ROM32(gpio_entry[0]), r, s, v;
+		int line = (entry & 0x0000001f);
+
+		BIOSLOG(bios, "0x%04X: Entry: 0x%08X\n", offset, entry);
+
+		if ((entry & 0x0000ff00) == 0x0000ff00)
+			continue;
+
+		r = nv50_gpio_reg[line >> 3];
+		s = (line & 0x07) << 2;
+		v = bios_rd32(bios, r) & ~(0x00000003 << s);
+		if (entry & 0x01000000)
+			v |= (((entry & 0x60000000) >> 29) ^ 2) << s;
+		else
+			v |= (((entry & 0x18000000) >> 27) ^ 2) << s;
+		bios_wr32(bios, r, v);
+
+		r = nv50_gpio_ctl[line >> 4];
+		s = (line & 0x0f);
+		v = bios_rd32(bios, r) & ~(0x00010001 << s);
+		switch ((entry & 0x06000000) >> 25) {
+		case 1:
+			v |= (0x00000001 << s);
+			break;
+		case 2:
+			v |= (0x00010000 << s);
+			break;
+		default:
+			break;
+		}
+		bios_wr32(bios, r, v);
+	}
+
+	return 1;
+}
+
+static int
+init_ram_restrict_zm_reg_group(struct nvbios *bios, uint16_t offset,
+			       struct init_exec *iexec)
+{
+	/*
+	 * INIT_RAM_RESTRICT_ZM_REG_GROUP   opcode: 0x8F ('')
+	 *
+	 * offset      (8  bit): opcode
+	 * offset + 1  (32 bit): reg
+	 * offset + 5  (8  bit): regincrement
+	 * offset + 6  (8  bit): count
+	 * offset + 7  (32 bit): value 1,1
+	 * ...
+	 *
+	 * Use the RAMCFG strap of PEXTDEV_BOOT as an index into the table at
+	 * ram_restrict_table_ptr. The value read from here is 'n', and
+	 * "value 1,n" gets written to "reg". This repeats "count" times and on
+	 * each iteration 'm', "reg" increases by "regincrement" and
+	 * "value m,n" is used. The extent of n is limited by a number read
+	 * from the 'M' BIT table, herein called "blocklen"
+	 */
+
+	uint32_t reg = ROM32(bios->data[offset + 1]);
+	uint8_t regincrement = bios->data[offset + 5];
+	uint8_t count = bios->data[offset + 6];
+	uint32_t strap_ramcfg, data;
+	/* previously set by 'M' BIT table */
+	uint16_t blocklen = bios->ram_restrict_group_count * 4;
+	int len = 7 + count * blocklen;
+	uint8_t index;
+	int i;
+
+
+	if (!iexec->execute)
+		return len;
+
+	if (!blocklen) {
+		NV_ERROR(bios->dev,
+			 "0x%04X: Zero block length - has the M table "
+			 "been parsed?\n", offset);
+		return 0;
+	}
+
+	strap_ramcfg = (bios_rd32(bios, NV_PEXTDEV_BOOT_0) >> 2) & 0xf;
+	index = bios->data[bios->ram_restrict_tbl_ptr + strap_ramcfg];
+
+	BIOSLOG(bios, "0x%04X: Reg: 0x%08X, RegIncrement: 0x%02X, "
+		      "Count: 0x%02X, StrapRamCfg: 0x%02X, Index: 0x%02X\n",
+		offset, reg, regincrement, count, strap_ramcfg, index);
+
+	for (i = 0; i < count; i++) {
+		data = ROM32(bios->data[offset + 7 + index * 4 + blocklen * i]);
+
+		bios_wr32(bios, reg, data);
+
+		reg += regincrement;
+	}
+
+	return len;
+}
+
+static int
+init_copy_zm_reg(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
+{
+	/*
+	 * INIT_COPY_ZM_REG   opcode: 0x90 ('')
+	 *
+	 * offset      (8  bit): opcode
+	 * offset + 1  (32 bit): src reg
+	 * offset + 5  (32 bit): dst reg
+	 *
+	 * Put contents of "src reg" into "dst reg"
+	 */
+
+	uint32_t srcreg = ROM32(bios->data[offset + 1]);
+	uint32_t dstreg = ROM32(bios->data[offset + 5]);
+
+	if (!iexec->execute)
+		return 9;
+
+	bios_wr32(bios, dstreg, bios_rd32(bios, srcreg));
+
+	return 9;
+}
+
+static int
+init_zm_reg_group_addr_latched(struct nvbios *bios, uint16_t offset,
+			       struct init_exec *iexec)
+{
+	/*
+	 * INIT_ZM_REG_GROUP_ADDRESS_LATCHED   opcode: 0x91 ('')
+	 *
+	 * offset      (8  bit): opcode
+	 * offset + 1  (32 bit): dst reg
+	 * offset + 5  (8  bit): count
+	 * offset + 6  (32 bit): data 1
+	 * ...
+	 *
+	 * For each of "count" values write "data n" to "dst reg"
+	 */
+
+	uint32_t reg = ROM32(bios->data[offset + 1]);
+	uint8_t count = bios->data[offset + 5];
+	int len = 6 + count * 4;
+	int i;
+
+	if (!iexec->execute)
+		return len;
+
+	for (i = 0; i < count; i++) {
+		uint32_t data = ROM32(bios->data[offset + 6 + 4 * i]);
+		bios_wr32(bios, reg, data);
+	}
+
+	return len;
+}
+
+static int
+init_reserved(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
+{
+	/*
+	 * INIT_RESERVED   opcode: 0x92 ('')
+	 *
+	 * offset      (8 bit): opcode
+	 *
+	 * Seemingly does nothing
+	 */
+
+	return 1;
+}
+
+static int
+init_96(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
+{
+	/*
+	 * INIT_96   opcode: 0x96 ('')
+	 *
+	 * offset      (8  bit): opcode
+	 * offset + 1  (32 bit): sreg
+	 * offset + 5  (8  bit): sshift
+	 * offset + 6  (8  bit): smask
+	 * offset + 7  (8  bit): index
+	 * offset + 8  (32 bit): reg
+	 * offset + 12 (32 bit): mask
+	 * offset + 16 (8  bit): shift
+	 *
+	 */
+
+	uint16_t xlatptr = bios->init96_tbl_ptr + (bios->data[offset + 7] * 2);
+	uint32_t reg = ROM32(bios->data[offset + 8]);
+	uint32_t mask = ROM32(bios->data[offset + 12]);
+	uint32_t val;
+
+	val = bios_rd32(bios, ROM32(bios->data[offset + 1]));
+	if (bios->data[offset + 5] < 0x80)
+		val >>= bios->data[offset + 5];
+	else
+		val <<= (0x100 - bios->data[offset + 5]);
+	val &= bios->data[offset + 6];
+
+	val   = bios->data[ROM16(bios->data[xlatptr]) + val];
+	val <<= bios->data[offset + 16];
+
+	if (!iexec->execute)
+		return 17;
+
+	bios_wr32(bios, reg, (bios_rd32(bios, reg) & mask) | val);
+	return 17;
+}
+
+static int
+init_97(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
+{
+	/*
+	 * INIT_97   opcode: 0x97 ('')
+	 *
+	 * offset      (8  bit): opcode
+	 * offset + 1  (32 bit): register
+	 * offset + 5  (32 bit): mask
+	 * offset + 9  (32 bit): value
+	 *
+	 * Adds "value" to "register" preserving the fields specified
+	 * by "mask"
+	 */
+
+	uint32_t reg = ROM32(bios->data[offset + 1]);
+	uint32_t mask = ROM32(bios->data[offset + 5]);
+	uint32_t add = ROM32(bios->data[offset + 9]);
+	uint32_t val;
+
+	val = bios_rd32(bios, reg);
+	val = (val & mask) | ((val + add) & ~mask);
+
+	if (!iexec->execute)
+		return 13;
+
+	bios_wr32(bios, reg, val);
+	return 13;
+}
+
+static int
+init_auxch(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
+{
+	/*
+	 * INIT_AUXCH   opcode: 0x98 ('')
+	 *
+	 * offset      (8  bit): opcode
+	 * offset + 1  (32 bit): address
+	 * offset + 5  (8  bit): count
+	 * offset + 6  (8  bit): mask 0
+	 * offset + 7  (8  bit): data 0
+	 *  ...
+	 *
+	 */
+
+	struct drm_device *dev = bios->dev;
+	struct nouveau_i2c_chan *auxch;
+	uint32_t addr = ROM32(bios->data[offset + 1]);
+	uint8_t count = bios->data[offset + 5];
+	int len = 6 + count * 2;
+	int ret, i;
+
+	if (!bios->display.output) {
+		NV_ERROR(dev, "INIT_AUXCH: no active output\n");
+		return 0;
+	}
+
+	auxch = init_i2c_device_find(dev, bios->display.output->i2c_index);
+	if (!auxch) {
+		NV_ERROR(dev, "INIT_AUXCH: couldn't get auxch %d\n",
+			 bios->display.output->i2c_index);
+		return 0;
+	}
+
+	if (!iexec->execute)
+		return len;
+
+	offset += 6;
+	for (i = 0; i < count; i++, offset += 2) {
+		uint8_t data;
+
+		ret = nouveau_dp_auxch(auxch, 9, addr, &data, 1);
+		if (ret) {
+			NV_ERROR(dev, "INIT_AUXCH: rd auxch fail %d\n", ret);
+			return 0;
+		}
+
+		data &= bios->data[offset + 0];
+		data |= bios->data[offset + 1];
+
+		ret = nouveau_dp_auxch(auxch, 8, addr, &data, 1);
+		if (ret) {
+			NV_ERROR(dev, "INIT_AUXCH: wr auxch fail %d\n", ret);
+			return 0;
+		}
+	}
+
+	return len;
+}
+
+static int
+init_zm_auxch(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
+{
+	/*
+	 * INIT_ZM_AUXCH   opcode: 0x99 ('')
+	 *
+	 * offset      (8  bit): opcode
+	 * offset + 1  (32 bit): address
+	 * offset + 5  (8  bit): count
+	 * offset + 6  (8  bit): data 0
+	 *  ...
+	 *
+	 */
+
+	struct drm_device *dev = bios->dev;
+	struct nouveau_i2c_chan *auxch;
+	uint32_t addr = ROM32(bios->data[offset + 1]);
+	uint8_t count = bios->data[offset + 5];
+	int len = 6 + count;
+	int ret, i;
+
+	if (!bios->display.output) {
+		NV_ERROR(dev, "INIT_ZM_AUXCH: no active output\n");
+		return 0;
+	}
+
+	auxch = init_i2c_device_find(dev, bios->display.output->i2c_index);
+	if (!auxch) {
+		NV_ERROR(dev, "INIT_ZM_AUXCH: couldn't get auxch %d\n",
+			 bios->display.output->i2c_index);
+		return 0;
+	}
+
+	if (!iexec->execute)
+		return len;
+
+	offset += 6;
+	for (i = 0; i < count; i++, offset++) {
+		ret = nouveau_dp_auxch(auxch, 8, addr, &bios->data[offset], 1);
+		if (ret) {
+			NV_ERROR(dev, "INIT_ZM_AUXCH: wr auxch fail %d\n", ret);
+			return 0;
+		}
+	}
+
+	return len;
+}
+
+static struct init_tbl_entry itbl_entry[] = {
+	/* command name                       , id  , length  , offset  , mult    , command handler                 */
+	/* INIT_PROG (0x31, 15, 10, 4) removed due to no example of use */
+	{ "INIT_IO_RESTRICT_PROG"             , 0x32, init_io_restrict_prog           },
+	{ "INIT_REPEAT"                       , 0x33, init_repeat                     },
+	{ "INIT_IO_RESTRICT_PLL"              , 0x34, init_io_restrict_pll            },
+	{ "INIT_END_REPEAT"                   , 0x36, init_end_repeat                 },
+	{ "INIT_COPY"                         , 0x37, init_copy                       },
+	{ "INIT_NOT"                          , 0x38, init_not                        },
+	{ "INIT_IO_FLAG_CONDITION"            , 0x39, init_io_flag_condition          },
+	{ "INIT_INDEX_ADDRESS_LATCHED"        , 0x49, init_idx_addr_latched           },
+	{ "INIT_IO_RESTRICT_PLL2"             , 0x4A, init_io_restrict_pll2           },
+	{ "INIT_PLL2"                         , 0x4B, init_pll2                       },
+	{ "INIT_I2C_BYTE"                     , 0x4C, init_i2c_byte                   },
+	{ "INIT_ZM_I2C_BYTE"                  , 0x4D, init_zm_i2c_byte                },
+	{ "INIT_ZM_I2C"                       , 0x4E, init_zm_i2c                     },
+	{ "INIT_TMDS"                         , 0x4F, init_tmds                       },
+	{ "INIT_ZM_TMDS_GROUP"                , 0x50, init_zm_tmds_group              },
+	{ "INIT_CR_INDEX_ADDRESS_LATCHED"     , 0x51, init_cr_idx_adr_latch           },
+	{ "INIT_CR"                           , 0x52, init_cr                         },
+	{ "INIT_ZM_CR"                        , 0x53, init_zm_cr                      },
+	{ "INIT_ZM_CR_GROUP"                  , 0x54, init_zm_cr_group                },
+	{ "INIT_CONDITION_TIME"               , 0x56, init_condition_time             },
+	{ "INIT_ZM_REG_SEQUENCE"              , 0x58, init_zm_reg_sequence            },
+	/* INIT_INDIRECT_REG (0x5A, 7, 0, 0) removed due to no example of use */
+	{ "INIT_SUB_DIRECT"                   , 0x5B, init_sub_direct                 },
+	{ "INIT_COPY_NV_REG"                  , 0x5F, init_copy_nv_reg                },
+	{ "INIT_ZM_INDEX_IO"                  , 0x62, init_zm_index_io                },
+	{ "INIT_COMPUTE_MEM"                  , 0x63, init_compute_mem                },
+	{ "INIT_RESET"                        , 0x65, init_reset                      },
+	{ "INIT_CONFIGURE_MEM"                , 0x66, init_configure_mem              },
+	{ "INIT_CONFIGURE_CLK"                , 0x67, init_configure_clk              },
+	{ "INIT_CONFIGURE_PREINIT"            , 0x68, init_configure_preinit          },
+	{ "INIT_IO"                           , 0x69, init_io                         },
+	{ "INIT_SUB"                          , 0x6B, init_sub                        },
+	{ "INIT_RAM_CONDITION"                , 0x6D, init_ram_condition              },
+	{ "INIT_NV_REG"                       , 0x6E, init_nv_reg                     },
+	{ "INIT_MACRO"                        , 0x6F, init_macro                      },
+	{ "INIT_DONE"                         , 0x71, init_done                       },
+	{ "INIT_RESUME"                       , 0x72, init_resume                     },
+	/* INIT_RAM_CONDITION2 (0x73, 9, 0, 0) removed due to no example of use */
+	{ "INIT_TIME"                         , 0x74, init_time                       },
+	{ "INIT_CONDITION"                    , 0x75, init_condition                  },
+	{ "INIT_IO_CONDITION"                 , 0x76, init_io_condition               },
+	{ "INIT_INDEX_IO"                     , 0x78, init_index_io                   },
+	{ "INIT_PLL"                          , 0x79, init_pll                        },
+	{ "INIT_ZM_REG"                       , 0x7A, init_zm_reg                     },
+	{ "INIT_RAM_RESTRICT_PLL"             , 0x87, init_ram_restrict_pll           },
+	{ "INIT_8C"                           , 0x8C, init_8c                         },
+	{ "INIT_8D"                           , 0x8D, init_8d                         },
+	{ "INIT_GPIO"                         , 0x8E, init_gpio                       },
+	{ "INIT_RAM_RESTRICT_ZM_REG_GROUP"    , 0x8F, init_ram_restrict_zm_reg_group  },
+	{ "INIT_COPY_ZM_REG"                  , 0x90, init_copy_zm_reg                },
+	{ "INIT_ZM_REG_GROUP_ADDRESS_LATCHED" , 0x91, init_zm_reg_group_addr_latched  },
+	{ "INIT_RESERVED"                     , 0x92, init_reserved                   },
+	{ "INIT_96"                           , 0x96, init_96                         },
+	{ "INIT_97"                           , 0x97, init_97                         },
+	{ "INIT_AUXCH"                        , 0x98, init_auxch                      },
+	{ "INIT_ZM_AUXCH"                     , 0x99, init_zm_auxch                   },
+	{ NULL                                , 0   , NULL                            }
+};
+
+#define MAX_TABLE_OPS 1000
+
+static int
+parse_init_table(struct nvbios *bios, unsigned int offset,
+		 struct init_exec *iexec)
+{
+	/*
+	 * Parses all commands in an init table.
+	 *
+	 * We start out executing all commands found in the init table. Some
+	 * opcodes may change the status of iexec->execute to SKIP, which will
+	 * cause the following opcodes to perform no operation until the value
+	 * is changed back to EXECUTE.
+	 */
+
+	int count = 0, i, res;
+	uint8_t id;
+
+	/*
+	 * Loop until INIT_DONE causes us to break out of the loop
+	 * (or until offset > bios length just in case... )
+	 * (and no more than MAX_TABLE_OPS iterations, just in case... )
+	 */
+	while ((offset < bios->length) && (count++ < MAX_TABLE_OPS)) {
+		id = bios->data[offset];
+
+		/* Find matching id in itbl_entry */
+		for (i = 0; itbl_entry[i].name && (itbl_entry[i].id != id); i++)
+			;
+
+		if (itbl_entry[i].name) {
+			BIOSLOG(bios, "0x%04X: [ (0x%02X) - %s ]\n",
+				offset, itbl_entry[i].id, itbl_entry[i].name);
+
+			/* execute eventual command handler */
+			res = (*itbl_entry[i].handler)(bios, offset, iexec);
+			if (!res)
+				break;
+			/*
+			 * Add the offset of the current command including all data
+			 * of that command. The offset will then be pointing on the
+			 * next op code.
+			 */
+			offset += res;
+		} else {
+			NV_ERROR(bios->dev,
+				 "0x%04X: Init table command not found: "
+				 "0x%02X\n", offset, id);
+			return -ENOENT;
+		}
+	}
+
+	if (offset >= bios->length)
+		NV_WARN(bios->dev,
+			"Offset 0x%04X greater than known bios image length.  "
+			"Corrupt image?\n", offset);
+	if (count >= MAX_TABLE_OPS)
+		NV_WARN(bios->dev,
+			"More than %d opcodes to a table is unlikely, "
+			"is the bios image corrupt?\n", MAX_TABLE_OPS);
+
+	return 0;
+}
+
+static void
+parse_init_tables(struct nvbios *bios)
+{
+	/* Loops and calls parse_init_table() for each present table. */
+
+	int i = 0;
+	uint16_t table;
+	struct init_exec iexec = {true, false};
+
+	if (bios->old_style_init) {
+		if (bios->init_script_tbls_ptr)
+			parse_init_table(bios, bios->init_script_tbls_ptr, &iexec);
+		if (bios->extra_init_script_tbl_ptr)
+			parse_init_table(bios, bios->extra_init_script_tbl_ptr, &iexec);
+
+		return;
+	}
+
+	while ((table = ROM16(bios->data[bios->init_script_tbls_ptr + i]))) {
+		NV_INFO(bios->dev,
+			"Parsing VBIOS init table %d at offset 0x%04X\n",
+			i / 2, table);
+		BIOSLOG(bios, "0x%04X: ------ Executing following commands ------\n", table);
+
+		parse_init_table(bios, table, &iexec);
+		i += 2;
+	}
+}
+
+static uint16_t clkcmptable(struct nvbios *bios, uint16_t clktable, int pxclk)
+{
+	int compare_record_len, i = 0;
+	uint16_t compareclk, scriptptr = 0;
+
+	if (bios->major_version < 5) /* pre BIT */
+		compare_record_len = 3;
+	else
+		compare_record_len = 4;
+
+	do {
+		compareclk = ROM16(bios->data[clktable + compare_record_len * i]);
+		if (pxclk >= compareclk * 10) {
+			if (bios->major_version < 5) {
+				uint8_t tmdssub = bios->data[clktable + 2 + compare_record_len * i];
+				scriptptr = ROM16(bios->data[bios->init_script_tbls_ptr + tmdssub * 2]);
+			} else
+				scriptptr = ROM16(bios->data[clktable + 2 + compare_record_len * i]);
+			break;
+		}
+		i++;
+	} while (compareclk);
+
+	return scriptptr;
+}
+
+static void
+run_digital_op_script(struct drm_device *dev, uint16_t scriptptr,
+		      struct dcb_entry *dcbent, int head, bool dl)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nvbios *bios = &dev_priv->VBIOS;
+	struct init_exec iexec = {true, false};
+
+	NV_TRACE(dev, "0x%04X: Parsing digital output script table\n",
+		 scriptptr);
+	bios_idxprt_wr(bios, NV_CIO_CRX__COLOR, NV_CIO_CRE_44,
+		       head ? NV_CIO_CRE_44_HEADB : NV_CIO_CRE_44_HEADA);
+	/* note: if dcb entries have been merged, index may be misleading */
+	NVWriteVgaCrtc5758(dev, head, 0, dcbent->index);
+	parse_init_table(bios, scriptptr, &iexec);
+
+	nv04_dfp_bind_head(dev, dcbent, head, dl);
+}
+
+static int call_lvds_manufacturer_script(struct drm_device *dev, struct dcb_entry *dcbent, int head, enum LVDS_script script)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nvbios *bios = &dev_priv->VBIOS;
+	uint8_t sub = bios->data[bios->fp.xlated_entry + script] + (bios->fp.link_c_increment && dcbent->or & OUTPUT_C ? 1 : 0);
+	uint16_t scriptofs = ROM16(bios->data[bios->init_script_tbls_ptr + sub * 2]);
+
+	if (!bios->fp.xlated_entry || !sub || !scriptofs)
+		return -EINVAL;
+
+	run_digital_op_script(dev, scriptofs, dcbent, head, bios->fp.dual_link);
+
+	if (script == LVDS_PANEL_OFF) {
+		/* off-on delay in ms */
+		msleep(ROM16(bios->data[bios->fp.xlated_entry + 7]));
+	}
+#ifdef __powerpc__
+	/* Powerbook specific quirks */
+	if (script == LVDS_RESET && ((dev->pci_device & 0xffff) == 0x0179 || (dev->pci_device & 0xffff) == 0x0329))
+		nv_write_tmds(dev, dcbent->or, 0, 0x02, 0x72);
+	if ((dev->pci_device & 0xffff) == 0x0179 || (dev->pci_device & 0xffff) == 0x0189 || (dev->pci_device & 0xffff) == 0x0329) {
+		if (script == LVDS_PANEL_ON) {
+			bios_wr32(bios, NV_PBUS_DEBUG_DUALHEAD_CTL, bios_rd32(bios, NV_PBUS_DEBUG_DUALHEAD_CTL) | (1 << 31));
+			bios_wr32(bios, NV_PCRTC_GPIO_EXT, bios_rd32(bios, NV_PCRTC_GPIO_EXT) | 1);
+		}
+		if (script == LVDS_PANEL_OFF) {
+			bios_wr32(bios, NV_PBUS_DEBUG_DUALHEAD_CTL, bios_rd32(bios, NV_PBUS_DEBUG_DUALHEAD_CTL) & ~(1 << 31));
+			bios_wr32(bios, NV_PCRTC_GPIO_EXT, bios_rd32(bios, NV_PCRTC_GPIO_EXT) & ~3);
+		}
+	}
+#endif
+
+	return 0;
+}
+
+static int run_lvds_table(struct drm_device *dev, struct dcb_entry *dcbent, int head, enum LVDS_script script, int pxclk)
+{
+	/*
+	 * The BIT LVDS table's header has the information to setup the
+	 * necessary registers. Following the standard 4 byte header are:
+	 * A bitmask byte and a dual-link transition pxclk value for use in
+	 * selecting the init script when not using straps; 4 script pointers
+	 * for panel power, selected by output and on/off; and 8 table pointers
+	 * for panel init, the needed one determined by output, and bits in the
+	 * conf byte. These tables are similar to the TMDS tables, consisting
+	 * of a list of pxclks and script pointers.
+	 */
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nvbios *bios = &dev_priv->VBIOS;
+	unsigned int outputset = (dcbent->or == 4) ? 1 : 0;
+	uint16_t scriptptr = 0, clktable;
+	uint8_t clktableptr = 0;
+
+	/*
+	 * For now we assume version 3.0 table - g80 support will need some
+	 * changes
+	 */
+
+	switch (script) {
+	case LVDS_INIT:
+		return -ENOSYS;
+	case LVDS_BACKLIGHT_ON:
+	case LVDS_PANEL_ON:
+		scriptptr = ROM16(bios->data[bios->fp.lvdsmanufacturerpointer + 7 + outputset * 2]);
+		break;
+	case LVDS_BACKLIGHT_OFF:
+	case LVDS_PANEL_OFF:
+		scriptptr = ROM16(bios->data[bios->fp.lvdsmanufacturerpointer + 11 + outputset * 2]);
+		break;
+	case LVDS_RESET:
+		if (dcbent->lvdsconf.use_straps_for_mode) {
+			if (bios->fp.dual_link)
+				clktableptr += 2;
+			if (bios->fp.BITbit1)
+				clktableptr++;
+		} else {
+			/* using EDID */
+			uint8_t fallback = bios->data[bios->fp.lvdsmanufacturerpointer + 4];
+			int fallbackcmpval = (dcbent->or == 4) ? 4 : 1;
+
+			if (bios->fp.dual_link) {
+				clktableptr += 2;
+				fallbackcmpval *= 2;
+			}
+			if (fallbackcmpval & fallback)
+				clktableptr++;
+		}
+
+		/* adding outputset * 8 may not be correct */
+		clktable = ROM16(bios->data[bios->fp.lvdsmanufacturerpointer + 15 + clktableptr * 2 + outputset * 8]);
+		if (!clktable) {
+			NV_ERROR(dev, "Pixel clock comparison table not found\n");
+			return -ENOENT;
+		}
+		scriptptr = clkcmptable(bios, clktable, pxclk);
+	}
+
+	if (!scriptptr) {
+		NV_ERROR(dev, "LVDS output init script not found\n");
+		return -ENOENT;
+	}
+	run_digital_op_script(dev, scriptptr, dcbent, head, bios->fp.dual_link);
+
+	return 0;
+}
+
+int call_lvds_script(struct drm_device *dev, struct dcb_entry *dcbent, int head, enum LVDS_script script, int pxclk)
+{
+	/*
+	 * LVDS operations are multiplexed in an effort to present a single API
+	 * which works with two vastly differing underlying structures.
+	 * This acts as the demux
+	 */
+
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nvbios *bios = &dev_priv->VBIOS;
+	uint8_t lvds_ver = bios->data[bios->fp.lvdsmanufacturerpointer];
+	uint32_t sel_clk_binding, sel_clk;
+	int ret;
+
+	if (bios->fp.last_script_invoc == (script << 1 | head) || !lvds_ver ||
+	    (lvds_ver >= 0x30 && script == LVDS_INIT))
+		return 0;
+
+	if (!bios->fp.lvds_init_run) {
+		bios->fp.lvds_init_run = true;
+		call_lvds_script(dev, dcbent, head, LVDS_INIT, pxclk);
+	}
+
+	if (script == LVDS_PANEL_ON && bios->fp.reset_after_pclk_change)
+		call_lvds_script(dev, dcbent, head, LVDS_RESET, pxclk);
+	if (script == LVDS_RESET && bios->fp.power_off_for_reset)
+		call_lvds_script(dev, dcbent, head, LVDS_PANEL_OFF, pxclk);
+
+	NV_TRACE(dev, "Calling LVDS script %d:\n", script);
+
+	/* don't let script change pll->head binding */
+	sel_clk_binding = bios_rd32(bios, NV_PRAMDAC_SEL_CLK) & 0x50000;
+
+	if (lvds_ver < 0x30)
+		ret = call_lvds_manufacturer_script(dev, dcbent, head, script);
+	else
+		ret = run_lvds_table(dev, dcbent, head, script, pxclk);
+
+	bios->fp.last_script_invoc = (script << 1 | head);
+
+	sel_clk = NVReadRAMDAC(dev, 0, NV_PRAMDAC_SEL_CLK) & ~0x50000;
+	NVWriteRAMDAC(dev, 0, NV_PRAMDAC_SEL_CLK, sel_clk | sel_clk_binding);
+	/* some scripts set a value in NV_PBUS_POWERCTRL_2 and break video overlay */
+	nvWriteMC(dev, NV_PBUS_POWERCTRL_2, 0);
+
+	return ret;
+}
+
+struct lvdstableheader {
+	uint8_t lvds_ver, headerlen, recordlen;
+};
+
+static int parse_lvds_manufacturer_table_header(struct drm_device *dev, struct nvbios *bios, struct lvdstableheader *lth)
+{
+	/*
+	 * BMP version (0xa) LVDS table has a simple header of version and
+	 * record length. The BIT LVDS table has the typical BIT table header:
+	 * version byte, header length byte, record length byte, and a byte for
+	 * the maximum number of records that can be held in the table.
+	 */
+
+	uint8_t lvds_ver, headerlen, recordlen;
+
+	memset(lth, 0, sizeof(struct lvdstableheader));
+
+	if (bios->fp.lvdsmanufacturerpointer == 0x0) {
+		NV_ERROR(dev, "Pointer to LVDS manufacturer table invalid\n");
+		return -EINVAL;
+	}
+
+	lvds_ver = bios->data[bios->fp.lvdsmanufacturerpointer];
+
+	switch (lvds_ver) {
+	case 0x0a:	/* pre NV40 */
+		headerlen = 2;
+		recordlen = bios->data[bios->fp.lvdsmanufacturerpointer + 1];
+		break;
+	case 0x30:	/* NV4x */
+		headerlen = bios->data[bios->fp.lvdsmanufacturerpointer + 1];
+		if (headerlen < 0x1f) {
+			NV_ERROR(dev, "LVDS table header not understood\n");
+			return -EINVAL;
+		}
+		recordlen = bios->data[bios->fp.lvdsmanufacturerpointer + 2];
+		break;
+	case 0x40:	/* G80/G90 */
+		headerlen = bios->data[bios->fp.lvdsmanufacturerpointer + 1];
+		if (headerlen < 0x7) {
+			NV_ERROR(dev, "LVDS table header not understood\n");
+			return -EINVAL;
+		}
+		recordlen = bios->data[bios->fp.lvdsmanufacturerpointer + 2];
+		break;
+	default:
+		NV_ERROR(dev,
+			 "LVDS table revision %d.%d not currently supported\n",
+			 lvds_ver >> 4, lvds_ver & 0xf);
+		return -ENOSYS;
+	}
+
+	lth->lvds_ver = lvds_ver;
+	lth->headerlen = headerlen;
+	lth->recordlen = recordlen;
+
+	return 0;
+}
+
+static int
+get_fp_strap(struct drm_device *dev, struct nvbios *bios)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+
+	/*
+	 * The fp strap is normally dictated by the "User Strap" in
+	 * PEXTDEV_BOOT_0[20:16], but on BMP cards when bit 2 of the
+	 * Internal_Flags struct at 0x48 is set, the user strap gets overriden
+	 * by the PCI subsystem ID during POST, but not before the previous user
+	 * strap has been committed to CR58 for CR57=0xf on head A, which may be
+	 * read and used instead
+	 */
+
+	if (bios->major_version < 5 && bios->data[0x48] & 0x4)
+		return NVReadVgaCrtc5758(dev, 0, 0xf) & 0xf;
+
+	if (dev_priv->card_type >= NV_50)
+		return (bios_rd32(bios, NV_PEXTDEV_BOOT_0) >> 24) & 0xf;
+	else
+		return (bios_rd32(bios, NV_PEXTDEV_BOOT_0) >> 16) & 0xf;
+}
+
+static int parse_fp_mode_table(struct drm_device *dev, struct nvbios *bios)
+{
+	uint8_t *fptable;
+	uint8_t fptable_ver, headerlen = 0, recordlen, fpentries = 0xf, fpindex;
+	int ret, ofs, fpstrapping;
+	struct lvdstableheader lth;
+
+	if (bios->fp.fptablepointer == 0x0) {
+		/* Apple cards don't have the fp table; the laptops use DDC */
+		/* The table is also missing on some x86 IGPs */
+#ifndef __powerpc__
+		NV_ERROR(dev, "Pointer to flat panel table invalid\n");
+#endif
+		bios->pub.digital_min_front_porch = 0x4b;
+		return 0;
+	}
+
+	fptable = &bios->data[bios->fp.fptablepointer];
+	fptable_ver = fptable[0];
+
+	switch (fptable_ver) {
+	/*
+	 * BMP version 0x5.0x11 BIOSen have version 1 like tables, but no
+	 * version field, and miss one of the spread spectrum/PWM bytes.
+	 * This could affect early GF2Go parts (not seen any appropriate ROMs
+	 * though). Here we assume that a version of 0x05 matches this case
+	 * (combining with a BMP version check would be better), as the
+	 * common case for the panel type field is 0x0005, and that is in
+	 * fact what we are reading the first byte of.
+	 */
+	case 0x05:	/* some NV10, 11, 15, 16 */
+		recordlen = 42;
+		ofs = -1;
+		break;
+	case 0x10:	/* some NV15/16, and NV11+ */
+		recordlen = 44;
+		ofs = 0;
+		break;
+	case 0x20:	/* NV40+ */
+		headerlen = fptable[1];
+		recordlen = fptable[2];
+		fpentries = fptable[3];
+		/*
+		 * fptable[4] is the minimum
+		 * RAMDAC_FP_HCRTC -> RAMDAC_FP_HSYNC_START gap
+		 */
+		bios->pub.digital_min_front_porch = fptable[4];
+		ofs = -7;
+		break;
+	default:
+		NV_ERROR(dev,
+			 "FP table revision %d.%d not currently supported\n",
+			 fptable_ver >> 4, fptable_ver & 0xf);
+		return -ENOSYS;
+	}
+
+	if (!bios->is_mobile) /* !mobile only needs digital_min_front_porch */
+		return 0;
+
+	ret = parse_lvds_manufacturer_table_header(dev, bios, &lth);
+	if (ret)
+		return ret;
+
+	if (lth.lvds_ver == 0x30 || lth.lvds_ver == 0x40) {
+		bios->fp.fpxlatetableptr = bios->fp.lvdsmanufacturerpointer +
+							lth.headerlen + 1;
+		bios->fp.xlatwidth = lth.recordlen;
+	}
+	if (bios->fp.fpxlatetableptr == 0x0) {
+		NV_ERROR(dev, "Pointer to flat panel xlat table invalid\n");
+		return -EINVAL;
+	}
+
+	fpstrapping = get_fp_strap(dev, bios);
+
+	fpindex = bios->data[bios->fp.fpxlatetableptr +
+					fpstrapping * bios->fp.xlatwidth];
+
+	if (fpindex > fpentries) {
+		NV_ERROR(dev, "Bad flat panel table index\n");
+		return -ENOENT;
+	}
+
+	/* nv4x cards need both a strap value and fpindex of 0xf to use DDC */
+	if (lth.lvds_ver > 0x10)
+		bios->pub.fp_no_ddc = fpstrapping != 0xf || fpindex != 0xf;
+
+	/*
+	 * If either the strap or xlated fpindex value are 0xf there is no
+	 * panel using a strap-derived bios mode present.  this condition
+	 * includes, but is different from, the DDC panel indicator above
+	 */
+	if (fpstrapping == 0xf || fpindex == 0xf)
+		return 0;
+
+	bios->fp.mode_ptr = bios->fp.fptablepointer + headerlen +
+			    recordlen * fpindex + ofs;
+
+	NV_TRACE(dev, "BIOS FP mode: %dx%d (%dkHz pixel clock)\n",
+		 ROM16(bios->data[bios->fp.mode_ptr + 11]) + 1,
+		 ROM16(bios->data[bios->fp.mode_ptr + 25]) + 1,
+		 ROM16(bios->data[bios->fp.mode_ptr + 7]) * 10);
+
+	return 0;
+}
+
+bool nouveau_bios_fp_mode(struct drm_device *dev, struct drm_display_mode *mode)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nvbios *bios = &dev_priv->VBIOS;
+	uint8_t *mode_entry = &bios->data[bios->fp.mode_ptr];
+
+	if (!mode)	/* just checking whether we can produce a mode */
+		return bios->fp.mode_ptr;
+
+	memset(mode, 0, sizeof(struct drm_display_mode));
+	/*
+	 * For version 1.0 (version in byte 0):
+	 * bytes 1-2 are "panel type", including bits on whether Colour/mono,
+	 * single/dual link, and type (TFT etc.)
+	 * bytes 3-6 are bits per colour in RGBX
+	 */
+	mode->clock = ROM16(mode_entry[7]) * 10;
+	/* bytes 9-10 is HActive */
+	mode->hdisplay = ROM16(mode_entry[11]) + 1;
+	/*
+	 * bytes 13-14 is HValid Start
+	 * bytes 15-16 is HValid End
+	 */
+	mode->hsync_start = ROM16(mode_entry[17]) + 1;
+	mode->hsync_end = ROM16(mode_entry[19]) + 1;
+	mode->htotal = ROM16(mode_entry[21]) + 1;
+	/* bytes 23-24, 27-30 similarly, but vertical */
+	mode->vdisplay = ROM16(mode_entry[25]) + 1;
+	mode->vsync_start = ROM16(mode_entry[31]) + 1;
+	mode->vsync_end = ROM16(mode_entry[33]) + 1;
+	mode->vtotal = ROM16(mode_entry[35]) + 1;
+	mode->flags |= (mode_entry[37] & 0x10) ?
+			DRM_MODE_FLAG_PHSYNC : DRM_MODE_FLAG_NHSYNC;
+	mode->flags |= (mode_entry[37] & 0x1) ?
+			DRM_MODE_FLAG_PVSYNC : DRM_MODE_FLAG_NVSYNC;
+	/*
+	 * bytes 38-39 relate to spread spectrum settings
+	 * bytes 40-43 are something to do with PWM
+	 */
+
+	mode->status = MODE_OK;
+	mode->type = DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED;
+	drm_mode_set_name(mode);
+	return bios->fp.mode_ptr;
+}
+
+int nouveau_bios_parse_lvds_table(struct drm_device *dev, int pxclk, bool *dl, bool *if_is_24bit)
+{
+	/*
+	 * The LVDS table header is (mostly) described in
+	 * parse_lvds_manufacturer_table_header(): the BIT header additionally
+	 * contains the dual-link transition pxclk (in 10s kHz), at byte 5 - if
+	 * straps are not being used for the panel, this specifies the frequency
+	 * at which modes should be set up in the dual link style.
+	 *
+	 * Following the header, the BMP (ver 0xa) table has several records,
+	 * indexed by a seperate xlat table, indexed in turn by the fp strap in
+	 * EXTDEV_BOOT. Each record had a config byte, followed by 6 script
+	 * numbers for use by INIT_SUB which controlled panel init and power,
+	 * and finally a dword of ms to sleep between power off and on
+	 * operations.
+	 *
+	 * In the BIT versions, the table following the header serves as an
+	 * integrated config and xlat table: the records in the table are
+	 * indexed by the FP strap nibble in EXTDEV_BOOT, and each record has
+	 * two bytes - the first as a config byte, the second for indexing the
+	 * fp mode table pointed to by the BIT 'D' table
+	 *
+	 * DDC is not used until after card init, so selecting the correct table
+	 * entry and setting the dual link flag for EDID equipped panels,
+	 * requiring tests against the native-mode pixel clock, cannot be done
+	 * until later, when this function should be called with non-zero pxclk
+	 */
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nvbios *bios = &dev_priv->VBIOS;
+	int fpstrapping = get_fp_strap(dev, bios), lvdsmanufacturerindex = 0;
+	struct lvdstableheader lth;
+	uint16_t lvdsofs;
+	int ret, chip_version = bios->pub.chip_version;
+
+	ret = parse_lvds_manufacturer_table_header(dev, bios, &lth);
+	if (ret)
+		return ret;
+
+	switch (lth.lvds_ver) {
+	case 0x0a:	/* pre NV40 */
+		lvdsmanufacturerindex = bios->data[
+					bios->fp.fpxlatemanufacturertableptr +
+					fpstrapping];
+
+		/* we're done if this isn't the EDID panel case */
+		if (!pxclk)
+			break;
+
+		if (chip_version < 0x25) {
+			/* nv17 behaviour
+			 *
+			 * It seems the old style lvds script pointer is reused
+			 * to select 18/24 bit colour depth for EDID panels.
+			 */
+			lvdsmanufacturerindex =
+				(bios->legacy.lvds_single_a_script_ptr & 1) ?
+									2 : 0;
+			if (pxclk >= bios->fp.duallink_transition_clk)
+				lvdsmanufacturerindex++;
+		} else if (chip_version < 0x30) {
+			/* nv28 behaviour (off-chip encoder)
+			 *
+			 * nv28 does a complex dance of first using byte 121 of
+			 * the EDID to choose the lvdsmanufacturerindex, then
+			 * later attempting to match the EDID manufacturer and
+			 * product IDs in a table (signature 'pidt' (panel id
+			 * table?)), setting an lvdsmanufacturerindex of 0 and
+			 * an fp strap of the match index (or 0xf if none)
+			 */
+			lvdsmanufacturerindex = 0;
+		} else {
+			/* nv31, nv34 behaviour */
+			lvdsmanufacturerindex = 0;
+			if (pxclk >= bios->fp.duallink_transition_clk)
+				lvdsmanufacturerindex = 2;
+			if (pxclk >= 140000)
+				lvdsmanufacturerindex = 3;
+		}
+
+		/*
+		 * nvidia set the high nibble of (cr57=f, cr58) to
+		 * lvdsmanufacturerindex in this case; we don't
+		 */
+		break;
+	case 0x30:	/* NV4x */
+	case 0x40:	/* G80/G90 */
+		lvdsmanufacturerindex = fpstrapping;
+		break;
+	default:
+		NV_ERROR(dev, "LVDS table revision not currently supported\n");
+		return -ENOSYS;
+	}
+
+	lvdsofs = bios->fp.xlated_entry = bios->fp.lvdsmanufacturerpointer + lth.headerlen + lth.recordlen * lvdsmanufacturerindex;
+	switch (lth.lvds_ver) {
+	case 0x0a:
+		bios->fp.power_off_for_reset = bios->data[lvdsofs] & 1;
+		bios->fp.reset_after_pclk_change = bios->data[lvdsofs] & 2;
+		bios->fp.dual_link = bios->data[lvdsofs] & 4;
+		bios->fp.link_c_increment = bios->data[lvdsofs] & 8;
+		*if_is_24bit = bios->data[lvdsofs] & 16;
+		break;
+	case 0x30:
+		/*
+		 * My money would be on there being a 24 bit interface bit in
+		 * this table, but I have no example of a laptop bios with a
+		 * 24 bit panel to confirm that. Hence we shout loudly if any
+		 * bit other than bit 0 is set (I've not even seen bit 1)
+		 */
+		if (bios->data[lvdsofs] > 1)
+			NV_ERROR(dev,
+				 "You have a very unusual laptop display; please report it\n");
+		/*
+		 * No sign of the "power off for reset" or "reset for panel
+		 * on" bits, but it's safer to assume we should
+		 */
+		bios->fp.power_off_for_reset = true;
+		bios->fp.reset_after_pclk_change = true;
+		/*
+		 * It's ok lvdsofs is wrong for nv4x edid case; dual_link is
+		 * over-written, and BITbit1 isn't used
+		 */
+		bios->fp.dual_link = bios->data[lvdsofs] & 1;
+		bios->fp.BITbit1 = bios->data[lvdsofs] & 2;
+		bios->fp.duallink_transition_clk = ROM16(bios->data[bios->fp.lvdsmanufacturerpointer + 5]) * 10;
+		break;
+	case 0x40:
+		bios->fp.dual_link = bios->data[lvdsofs] & 1;
+		bios->fp.if_is_24bit = bios->data[lvdsofs] & 2;
+		bios->fp.strapless_is_24bit = bios->data[bios->fp.lvdsmanufacturerpointer + 4];
+		bios->fp.duallink_transition_clk = ROM16(bios->data[bios->fp.lvdsmanufacturerpointer + 5]) * 10;
+		break;
+	}
+
+	/* set dual_link flag for EDID case */
+	if (pxclk && (chip_version < 0x25 || chip_version > 0x28))
+		bios->fp.dual_link = (pxclk >= bios->fp.duallink_transition_clk);
+
+	*dl = bios->fp.dual_link;
+
+	return 0;
+}
+
+static uint8_t *
+bios_output_config_match(struct drm_device *dev, struct dcb_entry *dcbent,
+			 uint16_t record, int record_len, int record_nr)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nvbios *bios = &dev_priv->VBIOS;
+	uint32_t entry;
+	uint16_t table;
+	int i, v;
+
+	for (i = 0; i < record_nr; i++, record += record_len) {
+		table = ROM16(bios->data[record]);
+		if (!table)
+			continue;
+		entry = ROM32(bios->data[table]);
+
+		v = (entry & 0x000f0000) >> 16;
+		if (!(v & dcbent->or))
+			continue;
+
+		v = (entry & 0x000000f0) >> 4;
+		if (v != dcbent->location)
+			continue;
+
+		v = (entry & 0x0000000f);
+		if (v != dcbent->type)
+			continue;
+
+		return &bios->data[table];
+	}
+
+	return NULL;
+}
+
+void *
+nouveau_bios_dp_table(struct drm_device *dev, struct dcb_entry *dcbent,
+		      int *length)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nvbios *bios = &dev_priv->VBIOS;
+	uint8_t *table;
+
+	if (!bios->display.dp_table_ptr) {
+		NV_ERROR(dev, "No pointer to DisplayPort table\n");
+		return NULL;
+	}
+	table = &bios->data[bios->display.dp_table_ptr];
+
+	if (table[0] != 0x21) {
+		NV_ERROR(dev, "DisplayPort table version 0x%02x unknown\n",
+			 table[0]);
+		return NULL;
+	}
+
+	*length = table[4];
+	return bios_output_config_match(dev, dcbent,
+					bios->display.dp_table_ptr + table[1],
+					table[2], table[3]);
+}
+
+int
+nouveau_bios_run_display_table(struct drm_device *dev, struct dcb_entry *dcbent,
+			       uint32_t sub, int pxclk)
+{
+	/*
+	 * The display script table is located by the BIT 'U' table.
+	 *
+	 * It contains an array of pointers to various tables describing
+	 * a particular output type.  The first 32-bits of the output
+	 * tables contains similar information to a DCB entry, and is
+	 * used to decide whether that particular table is suitable for
+	 * the output you want to access.
+	 *
+	 * The "record header length" field here seems to indicate the
+	 * offset of the first configuration entry in the output tables.
+	 * This is 10 on most cards I've seen, but 12 has been witnessed
+	 * on DP cards, and there's another script pointer within the
+	 * header.
+	 *
+	 * offset + 0   ( 8 bits): version
+	 * offset + 1   ( 8 bits): header length
+	 * offset + 2   ( 8 bits): record length
+	 * offset + 3   ( 8 bits): number of records
+	 * offset + 4   ( 8 bits): record header length
+	 * offset + 5   (16 bits): pointer to first output script table
+	 */
+
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct init_exec iexec = {true, false};
+	struct nvbios *bios = &dev_priv->VBIOS;
+	uint8_t *table = &bios->data[bios->display.script_table_ptr];
+	uint8_t *otable = NULL;
+	uint16_t script;
+	int i = 0;
+
+	if (!bios->display.script_table_ptr) {
+		NV_ERROR(dev, "No pointer to output script table\n");
+		return 1;
+	}
+
+	/*
+	 * Nothing useful has been in any of the pre-2.0 tables I've seen,
+	 * so until they are, we really don't need to care.
+	 */
+	if (table[0] < 0x20)
+		return 1;
+
+	if (table[0] != 0x20 && table[0] != 0x21) {
+		NV_ERROR(dev, "Output script table version 0x%02x unknown\n",
+			 table[0]);
+		return 1;
+	}
+
+	/*
+	 * The output script tables describing a particular output type
+	 * look as follows:
+	 *
+	 * offset + 0   (32 bits): output this table matches (hash of DCB)
+	 * offset + 4   ( 8 bits): unknown
+	 * offset + 5   ( 8 bits): number of configurations
+	 * offset + 6   (16 bits): pointer to some script
+	 * offset + 8   (16 bits): pointer to some script
+	 *
+	 * headerlen == 10
+	 * offset + 10           : configuration 0
+	 *
+	 * headerlen == 12
+	 * offset + 10           : pointer to some script
+	 * offset + 12           : configuration 0
+	 *
+	 * Each config entry is as follows:
+	 *
+	 * offset + 0   (16 bits): unknown, assumed to be a match value
+	 * offset + 2   (16 bits): pointer to script table (clock set?)
+	 * offset + 4   (16 bits): pointer to script table (reset?)
+	 *
+	 * There doesn't appear to be a count value to say how many
+	 * entries exist in each script table, instead, a 0 value in
+	 * the first 16-bit word seems to indicate both the end of the
+	 * list and the default entry.  The second 16-bit word in the
+	 * script tables is a pointer to the script to execute.
+	 */
+
+	NV_DEBUG_KMS(dev, "Searching for output entry for %d %d %d\n",
+			dcbent->type, dcbent->location, dcbent->or);
+	otable = bios_output_config_match(dev, dcbent, table[1] +
+					  bios->display.script_table_ptr,
+					  table[2], table[3]);
+	if (!otable) {
+		NV_ERROR(dev, "Couldn't find matching output script table\n");
+		return 1;
+	}
+
+	if (pxclk < -2 || pxclk > 0) {
+		/* Try to find matching script table entry */
+		for (i = 0; i < otable[5]; i++) {
+			if (ROM16(otable[table[4] + i*6]) == sub)
+				break;
+		}
+
+		if (i == otable[5]) {
+			NV_ERROR(dev, "Table 0x%04x not found for %d/%d, "
+				      "using first\n",
+				 sub, dcbent->type, dcbent->or);
+			i = 0;
+		}
+	}
+
+	bios->display.output = dcbent;
+
+	if (pxclk == 0) {
+		script = ROM16(otable[6]);
+		if (!script) {
+			NV_DEBUG_KMS(dev, "output script 0 not found\n");
+			return 1;
+		}
+
+		NV_TRACE(dev, "0x%04X: parsing output script 0\n", script);
+		parse_init_table(bios, script, &iexec);
+	} else
+	if (pxclk == -1) {
+		script = ROM16(otable[8]);
+		if (!script) {
+			NV_DEBUG_KMS(dev, "output script 1 not found\n");
+			return 1;
+		}
+
+		NV_TRACE(dev, "0x%04X: parsing output script 1\n", script);
+		parse_init_table(bios, script, &iexec);
+	} else
+	if (pxclk == -2) {
+		if (table[4] >= 12)
+			script = ROM16(otable[10]);
+		else
+			script = 0;
+		if (!script) {
+			NV_DEBUG_KMS(dev, "output script 2 not found\n");
+			return 1;
+		}
+
+		NV_TRACE(dev, "0x%04X: parsing output script 2\n", script);
+		parse_init_table(bios, script, &iexec);
+	} else
+	if (pxclk > 0) {
+		script = ROM16(otable[table[4] + i*6 + 2]);
+		if (script)
+			script = clkcmptable(bios, script, pxclk);
+		if (!script) {
+			NV_ERROR(dev, "clock script 0 not found\n");
+			return 1;
+		}
+
+		NV_TRACE(dev, "0x%04X: parsing clock script 0\n", script);
+		parse_init_table(bios, script, &iexec);
+	} else
+	if (pxclk < 0) {
+		script = ROM16(otable[table[4] + i*6 + 4]);
+		if (script)
+			script = clkcmptable(bios, script, -pxclk);
+		if (!script) {
+			NV_DEBUG_KMS(dev, "clock script 1 not found\n");
+			return 1;
+		}
+
+		NV_TRACE(dev, "0x%04X: parsing clock script 1\n", script);
+		parse_init_table(bios, script, &iexec);
+	}
+
+	return 0;
+}
+
+
+int run_tmds_table(struct drm_device *dev, struct dcb_entry *dcbent, int head, int pxclk)
+{
+	/*
+	 * the pxclk parameter is in kHz
+	 *
+	 * This runs the TMDS regs setting code found on BIT bios cards
+	 *
+	 * For ffs(or) == 1 use the first table, for ffs(or) == 2 and
+	 * ffs(or) == 3, use the second.
+	 */
+
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nvbios *bios = &dev_priv->VBIOS;
+	int cv = bios->pub.chip_version;
+	uint16_t clktable = 0, scriptptr;
+	uint32_t sel_clk_binding, sel_clk;
+
+	/* pre-nv17 off-chip tmds uses scripts, post nv17 doesn't */
+	if (cv >= 0x17 && cv != 0x1a && cv != 0x20 &&
+	    dcbent->location != DCB_LOC_ON_CHIP)
+		return 0;
+
+	switch (ffs(dcbent->or)) {
+	case 1:
+		clktable = bios->tmds.output0_script_ptr;
+		break;
+	case 2:
+	case 3:
+		clktable = bios->tmds.output1_script_ptr;
+		break;
+	}
+
+	if (!clktable) {
+		NV_ERROR(dev, "Pixel clock comparison table not found\n");
+		return -EINVAL;
+	}
+
+	scriptptr = clkcmptable(bios, clktable, pxclk);
+
+	if (!scriptptr) {
+		NV_ERROR(dev, "TMDS output init script not found\n");
+		return -ENOENT;
+	}
+
+	/* don't let script change pll->head binding */
+	sel_clk_binding = bios_rd32(bios, NV_PRAMDAC_SEL_CLK) & 0x50000;
+	run_digital_op_script(dev, scriptptr, dcbent, head, pxclk >= 165000);
+	sel_clk = NVReadRAMDAC(dev, 0, NV_PRAMDAC_SEL_CLK) & ~0x50000;
+	NVWriteRAMDAC(dev, 0, NV_PRAMDAC_SEL_CLK, sel_clk | sel_clk_binding);
+
+	return 0;
+}
+
+int get_pll_limits(struct drm_device *dev, uint32_t limit_match, struct pll_lims *pll_lim)
+{
+	/*
+	 * PLL limits table
+	 *
+	 * Version 0x10: NV30, NV31
+	 * One byte header (version), one record of 24 bytes
+	 * Version 0x11: NV36 - Not implemented
+	 * Seems to have same record style as 0x10, but 3 records rather than 1
+	 * Version 0x20: Found on Geforce 6 cards
+	 * Trivial 4 byte BIT header. 31 (0x1f) byte record length
+	 * Version 0x21: Found on Geforce 7, 8 and some Geforce 6 cards
+	 * 5 byte header, fifth byte of unknown purpose. 35 (0x23) byte record
+	 * length in general, some (integrated) have an extra configuration byte
+	 * Version 0x30: Found on Geforce 8, separates the register mapping
+	 * from the limits tables.
+	 */
+
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nvbios *bios = &dev_priv->VBIOS;
+	int cv = bios->pub.chip_version, pllindex = 0;
+	uint8_t pll_lim_ver = 0, headerlen = 0, recordlen = 0, entries = 0;
+	uint32_t crystal_strap_mask, crystal_straps;
+
+	if (!bios->pll_limit_tbl_ptr) {
+		if (cv == 0x30 || cv == 0x31 || cv == 0x35 || cv == 0x36 ||
+		    cv >= 0x40) {
+			NV_ERROR(dev, "Pointer to PLL limits table invalid\n");
+			return -EINVAL;
+		}
+	} else
+		pll_lim_ver = bios->data[bios->pll_limit_tbl_ptr];
+
+	crystal_strap_mask = 1 << 6;
+	/* open coded dev->twoHeads test */
+	if (cv > 0x10 && cv != 0x15 && cv != 0x1a && cv != 0x20)
+		crystal_strap_mask |= 1 << 22;
+	crystal_straps = nvReadEXTDEV(dev, NV_PEXTDEV_BOOT_0) &
+							crystal_strap_mask;
+
+	switch (pll_lim_ver) {
+	/*
+	 * We use version 0 to indicate a pre limit table bios (single stage
+	 * pll) and load the hard coded limits instead.
+	 */
+	case 0:
+		break;
+	case 0x10:
+	case 0x11:
+		/*
+		 * Strictly v0x11 has 3 entries, but the last two don't seem
+		 * to get used.
+		 */
+		headerlen = 1;
+		recordlen = 0x18;
+		entries = 1;
+		pllindex = 0;
+		break;
+	case 0x20:
+	case 0x21:
+	case 0x30:
+	case 0x40:
+		headerlen = bios->data[bios->pll_limit_tbl_ptr + 1];
+		recordlen = bios->data[bios->pll_limit_tbl_ptr + 2];
+		entries = bios->data[bios->pll_limit_tbl_ptr + 3];
+		break;
+	default:
+		NV_ERROR(dev, "PLL limits table revision 0x%X not currently "
+				"supported\n", pll_lim_ver);
+		return -ENOSYS;
+	}
+
+	/* initialize all members to zero */
+	memset(pll_lim, 0, sizeof(struct pll_lims));
+
+	if (pll_lim_ver == 0x10 || pll_lim_ver == 0x11) {
+		uint8_t *pll_rec = &bios->data[bios->pll_limit_tbl_ptr + headerlen + recordlen * pllindex];
+
+		pll_lim->vco1.minfreq = ROM32(pll_rec[0]);
+		pll_lim->vco1.maxfreq = ROM32(pll_rec[4]);
+		pll_lim->vco2.minfreq = ROM32(pll_rec[8]);
+		pll_lim->vco2.maxfreq = ROM32(pll_rec[12]);
+		pll_lim->vco1.min_inputfreq = ROM32(pll_rec[16]);
+		pll_lim->vco2.min_inputfreq = ROM32(pll_rec[20]);
+		pll_lim->vco1.max_inputfreq = pll_lim->vco2.max_inputfreq = INT_MAX;
+
+		/* these values taken from nv30/31/36 */
+		pll_lim->vco1.min_n = 0x1;
+		if (cv == 0x36)
+			pll_lim->vco1.min_n = 0x5;
+		pll_lim->vco1.max_n = 0xff;
+		pll_lim->vco1.min_m = 0x1;
+		pll_lim->vco1.max_m = 0xd;
+		pll_lim->vco2.min_n = 0x4;
+		/*
+		 * On nv30, 31, 36 (i.e. all cards with two stage PLLs with this
+		 * table version (apart from nv35)), N2 is compared to
+		 * maxN2 (0x46) and 10 * maxM2 (0x4), so set maxN2 to 0x28 and
+		 * save a comparison
+		 */
+		pll_lim->vco2.max_n = 0x28;
+		if (cv == 0x30 || cv == 0x35)
+			/* only 5 bits available for N2 on nv30/35 */
+			pll_lim->vco2.max_n = 0x1f;
+		pll_lim->vco2.min_m = 0x1;
+		pll_lim->vco2.max_m = 0x4;
+		pll_lim->max_log2p = 0x7;
+		pll_lim->max_usable_log2p = 0x6;
+	} else if (pll_lim_ver == 0x20 || pll_lim_ver == 0x21) {
+		uint16_t plloffs = bios->pll_limit_tbl_ptr + headerlen;
+		uint32_t reg = 0; /* default match */
+		uint8_t *pll_rec;
+		int i;
+
+		/*
+		 * First entry is default match, if nothing better. warn if
+		 * reg field nonzero
+		 */
+		if (ROM32(bios->data[plloffs]))
+			NV_WARN(dev, "Default PLL limit entry has non-zero "
+				       "register field\n");
+
+		if (limit_match > MAX_PLL_TYPES)
+			/* we've been passed a reg as the match */
+			reg = limit_match;
+		else /* limit match is a pll type */
+			for (i = 1; i < entries && !reg; i++) {
+				uint32_t cmpreg = ROM32(bios->data[plloffs + recordlen * i]);
+
+				if (limit_match == NVPLL &&
+				    (cmpreg == NV_PRAMDAC_NVPLL_COEFF || cmpreg == 0x4000))
+					reg = cmpreg;
+				if (limit_match == MPLL &&
+				    (cmpreg == NV_PRAMDAC_MPLL_COEFF || cmpreg == 0x4020))
+					reg = cmpreg;
+				if (limit_match == VPLL1 &&
+				    (cmpreg == NV_PRAMDAC_VPLL_COEFF || cmpreg == 0x4010))
+					reg = cmpreg;
+				if (limit_match == VPLL2 &&
+				    (cmpreg == NV_RAMDAC_VPLL2 || cmpreg == 0x4018))
+					reg = cmpreg;
+			}
+
+		for (i = 1; i < entries; i++)
+			if (ROM32(bios->data[plloffs + recordlen * i]) == reg) {
+				pllindex = i;
+				break;
+			}
+
+		pll_rec = &bios->data[plloffs + recordlen * pllindex];
+
+		BIOSLOG(bios, "Loading PLL limits for reg 0x%08x\n",
+			pllindex ? reg : 0);
+
+		/*
+		 * Frequencies are stored in tables in MHz, kHz are more
+		 * useful, so we convert.
+		 */
+
+		/* What output frequencies can each VCO generate? */
+		pll_lim->vco1.minfreq = ROM16(pll_rec[4]) * 1000;
+		pll_lim->vco1.maxfreq = ROM16(pll_rec[6]) * 1000;
+		pll_lim->vco2.minfreq = ROM16(pll_rec[8]) * 1000;
+		pll_lim->vco2.maxfreq = ROM16(pll_rec[10]) * 1000;
+
+		/* What input frequencies they accept (past the m-divider)? */
+		pll_lim->vco1.min_inputfreq = ROM16(pll_rec[12]) * 1000;
+		pll_lim->vco2.min_inputfreq = ROM16(pll_rec[14]) * 1000;
+		pll_lim->vco1.max_inputfreq = ROM16(pll_rec[16]) * 1000;
+		pll_lim->vco2.max_inputfreq = ROM16(pll_rec[18]) * 1000;
+
+		/* What values are accepted as multiplier and divider? */
+		pll_lim->vco1.min_n = pll_rec[20];
+		pll_lim->vco1.max_n = pll_rec[21];
+		pll_lim->vco1.min_m = pll_rec[22];
+		pll_lim->vco1.max_m = pll_rec[23];
+		pll_lim->vco2.min_n = pll_rec[24];
+		pll_lim->vco2.max_n = pll_rec[25];
+		pll_lim->vco2.min_m = pll_rec[26];
+		pll_lim->vco2.max_m = pll_rec[27];
+
+		pll_lim->max_usable_log2p = pll_lim->max_log2p = pll_rec[29];
+		if (pll_lim->max_log2p > 0x7)
+			/* pll decoding in nv_hw.c assumes never > 7 */
+			NV_WARN(dev, "Max log2 P value greater than 7 (%d)\n",
+				pll_lim->max_log2p);
+		if (cv < 0x60)
+			pll_lim->max_usable_log2p = 0x6;
+		pll_lim->log2p_bias = pll_rec[30];
+
+		if (recordlen > 0x22)
+			pll_lim->refclk = ROM32(pll_rec[31]);
+
+		if (recordlen > 0x23 && pll_rec[35])
+			NV_WARN(dev,
+				"Bits set in PLL configuration byte (%x)\n",
+				pll_rec[35]);
+
+		/* C51 special not seen elsewhere */
+		if (cv == 0x51 && !pll_lim->refclk) {
+			uint32_t sel_clk = bios_rd32(bios, NV_PRAMDAC_SEL_CLK);
+
+			if (((limit_match == NV_PRAMDAC_VPLL_COEFF || limit_match == VPLL1) && sel_clk & 0x20) ||
+			    ((limit_match == NV_RAMDAC_VPLL2 || limit_match == VPLL2) && sel_clk & 0x80)) {
+				if (bios_idxprt_rd(bios, NV_CIO_CRX__COLOR, NV_CIO_CRE_CHIP_ID_INDEX) < 0xa3)
+					pll_lim->refclk = 200000;
+				else
+					pll_lim->refclk = 25000;
+			}
+		}
+	} else if (pll_lim_ver == 0x30) { /* ver 0x30 */
+		uint8_t *entry = &bios->data[bios->pll_limit_tbl_ptr + headerlen];
+		uint8_t *record = NULL;
+		int i;
+
+		BIOSLOG(bios, "Loading PLL limits for register 0x%08x\n",
+			limit_match);
+
+		for (i = 0; i < entries; i++, entry += recordlen) {
+			if (ROM32(entry[3]) == limit_match) {
+				record = &bios->data[ROM16(entry[1])];
+				break;
+			}
+		}
+
+		if (!record) {
+			NV_ERROR(dev, "Register 0x%08x not found in PLL "
+				 "limits table", limit_match);
+			return -ENOENT;
+		}
+
+		pll_lim->vco1.minfreq = ROM16(record[0]) * 1000;
+		pll_lim->vco1.maxfreq = ROM16(record[2]) * 1000;
+		pll_lim->vco2.minfreq = ROM16(record[4]) * 1000;
+		pll_lim->vco2.maxfreq = ROM16(record[6]) * 1000;
+		pll_lim->vco1.min_inputfreq = ROM16(record[8]) * 1000;
+		pll_lim->vco2.min_inputfreq = ROM16(record[10]) * 1000;
+		pll_lim->vco1.max_inputfreq = ROM16(record[12]) * 1000;
+		pll_lim->vco2.max_inputfreq = ROM16(record[14]) * 1000;
+		pll_lim->vco1.min_n = record[16];
+		pll_lim->vco1.max_n = record[17];
+		pll_lim->vco1.min_m = record[18];
+		pll_lim->vco1.max_m = record[19];
+		pll_lim->vco2.min_n = record[20];
+		pll_lim->vco2.max_n = record[21];
+		pll_lim->vco2.min_m = record[22];
+		pll_lim->vco2.max_m = record[23];
+		pll_lim->max_usable_log2p = pll_lim->max_log2p = record[25];
+		pll_lim->log2p_bias = record[27];
+		pll_lim->refclk = ROM32(record[28]);
+	} else if (pll_lim_ver) { /* ver 0x40 */
+		uint8_t *entry = &bios->data[bios->pll_limit_tbl_ptr + headerlen];
+		uint8_t *record = NULL;
+		int i;
+
+		BIOSLOG(bios, "Loading PLL limits for register 0x%08x\n",
+			limit_match);
+
+		for (i = 0; i < entries; i++, entry += recordlen) {
+			if (ROM32(entry[3]) == limit_match) {
+				record = &bios->data[ROM16(entry[1])];
+				break;
+			}
+		}
+
+		if (!record) {
+			NV_ERROR(dev, "Register 0x%08x not found in PLL "
+				 "limits table", limit_match);
+			return -ENOENT;
+		}
+
+		pll_lim->vco1.minfreq = ROM16(record[0]) * 1000;
+		pll_lim->vco1.maxfreq = ROM16(record[2]) * 1000;
+		pll_lim->vco1.min_inputfreq = ROM16(record[4]) * 1000;
+		pll_lim->vco1.max_inputfreq = ROM16(record[6]) * 1000;
+		pll_lim->vco1.min_m = record[8];
+		pll_lim->vco1.max_m = record[9];
+		pll_lim->vco1.min_n = record[10];
+		pll_lim->vco1.max_n = record[11];
+		pll_lim->min_p = record[12];
+		pll_lim->max_p = record[13];
+		/* where did this go to?? */
+		if (limit_match == 0x00614100 || limit_match == 0x00614900)
+			pll_lim->refclk = 27000;
+		else
+			pll_lim->refclk = 100000;
+	}
+
+	/*
+	 * By now any valid limit table ought to have set a max frequency for
+	 * vco1, so if it's zero it's either a pre limit table bios, or one
+	 * with an empty limit table (seen on nv18)
+	 */
+	if (!pll_lim->vco1.maxfreq) {
+		pll_lim->vco1.minfreq = bios->fminvco;
+		pll_lim->vco1.maxfreq = bios->fmaxvco;
+		pll_lim->vco1.min_inputfreq = 0;
+		pll_lim->vco1.max_inputfreq = INT_MAX;
+		pll_lim->vco1.min_n = 0x1;
+		pll_lim->vco1.max_n = 0xff;
+		pll_lim->vco1.min_m = 0x1;
+		if (crystal_straps == 0) {
+			/* nv05 does this, nv11 doesn't, nv10 unknown */
+			if (cv < 0x11)
+				pll_lim->vco1.min_m = 0x7;
+			pll_lim->vco1.max_m = 0xd;
+		} else {
+			if (cv < 0x11)
+				pll_lim->vco1.min_m = 0x8;
+			pll_lim->vco1.max_m = 0xe;
+		}
+		if (cv < 0x17 || cv == 0x1a || cv == 0x20)
+			pll_lim->max_log2p = 4;
+		else
+			pll_lim->max_log2p = 5;
+		pll_lim->max_usable_log2p = pll_lim->max_log2p;
+	}
+
+	if (!pll_lim->refclk)
+		switch (crystal_straps) {
+		case 0:
+			pll_lim->refclk = 13500;
+			break;
+		case (1 << 6):
+			pll_lim->refclk = 14318;
+			break;
+		case (1 << 22):
+			pll_lim->refclk = 27000;
+			break;
+		case (1 << 22 | 1 << 6):
+			pll_lim->refclk = 25000;
+			break;
+		}
+
+#if 0 /* for easy debugging */
+	ErrorF("pll.vco1.minfreq: %d\n", pll_lim->vco1.minfreq);
+	ErrorF("pll.vco1.maxfreq: %d\n", pll_lim->vco1.maxfreq);
+	ErrorF("pll.vco2.minfreq: %d\n", pll_lim->vco2.minfreq);
+	ErrorF("pll.vco2.maxfreq: %d\n", pll_lim->vco2.maxfreq);
+
+	ErrorF("pll.vco1.min_inputfreq: %d\n", pll_lim->vco1.min_inputfreq);
+	ErrorF("pll.vco1.max_inputfreq: %d\n", pll_lim->vco1.max_inputfreq);
+	ErrorF("pll.vco2.min_inputfreq: %d\n", pll_lim->vco2.min_inputfreq);
+	ErrorF("pll.vco2.max_inputfreq: %d\n", pll_lim->vco2.max_inputfreq);
+
+	ErrorF("pll.vco1.min_n: %d\n", pll_lim->vco1.min_n);
+	ErrorF("pll.vco1.max_n: %d\n", pll_lim->vco1.max_n);
+	ErrorF("pll.vco1.min_m: %d\n", pll_lim->vco1.min_m);
+	ErrorF("pll.vco1.max_m: %d\n", pll_lim->vco1.max_m);
+	ErrorF("pll.vco2.min_n: %d\n", pll_lim->vco2.min_n);
+	ErrorF("pll.vco2.max_n: %d\n", pll_lim->vco2.max_n);
+	ErrorF("pll.vco2.min_m: %d\n", pll_lim->vco2.min_m);
+	ErrorF("pll.vco2.max_m: %d\n", pll_lim->vco2.max_m);
+
+	ErrorF("pll.max_log2p: %d\n", pll_lim->max_log2p);
+	ErrorF("pll.log2p_bias: %d\n", pll_lim->log2p_bias);
+
+	ErrorF("pll.refclk: %d\n", pll_lim->refclk);
+#endif
+
+	return 0;
+}
+
+static void parse_bios_version(struct drm_device *dev, struct nvbios *bios, uint16_t offset)
+{
+	/*
+	 * offset + 0  (8 bits): Micro version
+	 * offset + 1  (8 bits): Minor version
+	 * offset + 2  (8 bits): Chip version
+	 * offset + 3  (8 bits): Major version
+	 */
+
+	bios->major_version = bios->data[offset + 3];
+	bios->pub.chip_version = bios->data[offset + 2];
+	NV_TRACE(dev, "Bios version %02x.%02x.%02x.%02x\n",
+		 bios->data[offset + 3], bios->data[offset + 2],
+		 bios->data[offset + 1], bios->data[offset]);
+}
+
+static void parse_script_table_pointers(struct nvbios *bios, uint16_t offset)
+{
+	/*
+	 * Parses the init table segment for pointers used in script execution.
+	 *
+	 * offset + 0  (16 bits): init script tables pointer
+	 * offset + 2  (16 bits): macro index table pointer
+	 * offset + 4  (16 bits): macro table pointer
+	 * offset + 6  (16 bits): condition table pointer
+	 * offset + 8  (16 bits): io condition table pointer
+	 * offset + 10 (16 bits): io flag condition table pointer
+	 * offset + 12 (16 bits): init function table pointer
+	 */
+
+	bios->init_script_tbls_ptr = ROM16(bios->data[offset]);
+	bios->macro_index_tbl_ptr = ROM16(bios->data[offset + 2]);
+	bios->macro_tbl_ptr = ROM16(bios->data[offset + 4]);
+	bios->condition_tbl_ptr = ROM16(bios->data[offset + 6]);
+	bios->io_condition_tbl_ptr = ROM16(bios->data[offset + 8]);
+	bios->io_flag_condition_tbl_ptr = ROM16(bios->data[offset + 10]);
+	bios->init_function_tbl_ptr = ROM16(bios->data[offset + 12]);
+}
+
+static int parse_bit_A_tbl_entry(struct drm_device *dev, struct nvbios *bios, struct bit_entry *bitentry)
+{
+	/*
+	 * Parses the load detect values for g80 cards.
+	 *
+	 * offset + 0 (16 bits): loadval table pointer
+	 */
+
+	uint16_t load_table_ptr;
+	uint8_t version, headerlen, entrylen, num_entries;
+
+	if (bitentry->length != 3) {
+		NV_ERROR(dev, "Do not understand BIT A table\n");
+		return -EINVAL;
+	}
+
+	load_table_ptr = ROM16(bios->data[bitentry->offset]);
+
+	if (load_table_ptr == 0x0) {
+		NV_ERROR(dev, "Pointer to BIT loadval table invalid\n");
+		return -EINVAL;
+	}
+
+	version = bios->data[load_table_ptr];
+
+	if (version != 0x10) {
+		NV_ERROR(dev, "BIT loadval table version %d.%d not supported\n",
+			 version >> 4, version & 0xF);
+		return -ENOSYS;
+	}
+
+	headerlen = bios->data[load_table_ptr + 1];
+	entrylen = bios->data[load_table_ptr + 2];
+	num_entries = bios->data[load_table_ptr + 3];
+
+	if (headerlen != 4 || entrylen != 4 || num_entries != 2) {
+		NV_ERROR(dev, "Do not understand BIT loadval table\n");
+		return -EINVAL;
+	}
+
+	/* First entry is normal dac, 2nd tv-out perhaps? */
+	bios->pub.dactestval = ROM32(bios->data[load_table_ptr + headerlen]) & 0x3ff;
+
+	return 0;
+}
+
+static int parse_bit_C_tbl_entry(struct drm_device *dev, struct nvbios *bios, struct bit_entry *bitentry)
+{
+	/*
+	 * offset + 8  (16 bits): PLL limits table pointer
+	 *
+	 * There's more in here, but that's unknown.
+	 */
+
+	if (bitentry->length < 10) {
+		NV_ERROR(dev, "Do not understand BIT C table\n");
+		return -EINVAL;
+	}
+
+	bios->pll_limit_tbl_ptr = ROM16(bios->data[bitentry->offset + 8]);
+
+	return 0;
+}
+
+static int parse_bit_display_tbl_entry(struct drm_device *dev, struct nvbios *bios, struct bit_entry *bitentry)
+{
+	/*
+	 * Parses the flat panel table segment that the bit entry points to.
+	 * Starting at bitentry->offset:
+	 *
+	 * offset + 0  (16 bits): ??? table pointer - seems to have 18 byte
+	 * records beginning with a freq.
+	 * offset + 2  (16 bits): mode table pointer
+	 */
+
+	if (bitentry->length != 4) {
+		NV_ERROR(dev, "Do not understand BIT display table\n");
+		return -EINVAL;
+	}
+
+	bios->fp.fptablepointer = ROM16(bios->data[bitentry->offset + 2]);
+
+	return 0;
+}
+
+static int parse_bit_init_tbl_entry(struct drm_device *dev, struct nvbios *bios, struct bit_entry *bitentry)
+{
+	/*
+	 * Parses the init table segment that the bit entry points to.
+	 *
+	 * See parse_script_table_pointers for layout
+	 */
+
+	if (bitentry->length < 14) {
+		NV_ERROR(dev, "Do not understand init table\n");
+		return -EINVAL;
+	}
+
+	parse_script_table_pointers(bios, bitentry->offset);
+
+	if (bitentry->length >= 16)
+		bios->some_script_ptr = ROM16(bios->data[bitentry->offset + 14]);
+	if (bitentry->length >= 18)
+		bios->init96_tbl_ptr = ROM16(bios->data[bitentry->offset + 16]);
+
+	return 0;
+}
+
+static int parse_bit_i_tbl_entry(struct drm_device *dev, struct nvbios *bios, struct bit_entry *bitentry)
+{
+	/*
+	 * BIT 'i' (info?) table
+	 *
+	 * offset + 0  (32 bits): BIOS version dword (as in B table)
+	 * offset + 5  (8  bits): BIOS feature byte (same as for BMP?)
+	 * offset + 13 (16 bits): pointer to table containing DAC load
+	 * detection comparison values
+	 *
+	 * There's other things in the table, purpose unknown
+	 */
+
+	uint16_t daccmpoffset;
+	uint8_t dacver, dacheaderlen;
+
+	if (bitentry->length < 6) {
+		NV_ERROR(dev, "BIT i table too short for needed information\n");
+		return -EINVAL;
+	}
+
+	parse_bios_version(dev, bios, bitentry->offset);
+
+	/*
+	 * bit 4 seems to indicate a mobile bios (doesn't suffer from BMP's
+	 * Quadro identity crisis), other bits possibly as for BMP feature byte
+	 */
+	bios->feature_byte = bios->data[bitentry->offset + 5];
+	bios->is_mobile = bios->feature_byte & FEATURE_MOBILE;
+
+	if (bitentry->length < 15) {
+		NV_WARN(dev, "BIT i table not long enough for DAC load "
+			       "detection comparison table\n");
+		return -EINVAL;
+	}
+
+	daccmpoffset = ROM16(bios->data[bitentry->offset + 13]);
+
+	/* doesn't exist on g80 */
+	if (!daccmpoffset)
+		return 0;
+
+	/*
+	 * The first value in the table, following the header, is the
+	 * comparison value, the second entry is a comparison value for
+	 * TV load detection.
+	 */
+
+	dacver = bios->data[daccmpoffset];
+	dacheaderlen = bios->data[daccmpoffset + 1];
+
+	if (dacver != 0x00 && dacver != 0x10) {
+		NV_WARN(dev, "DAC load detection comparison table version "
+			       "%d.%d not known\n", dacver >> 4, dacver & 0xf);
+		return -ENOSYS;
+	}
+
+	bios->pub.dactestval = ROM32(bios->data[daccmpoffset + dacheaderlen]);
+	bios->pub.tvdactestval = ROM32(bios->data[daccmpoffset + dacheaderlen + 4]);
+
+	return 0;
+}
+
+static int parse_bit_lvds_tbl_entry(struct drm_device *dev, struct nvbios *bios, struct bit_entry *bitentry)
+{
+	/*
+	 * Parses the LVDS table segment that the bit entry points to.
+	 * Starting at bitentry->offset:
+	 *
+	 * offset + 0  (16 bits): LVDS strap xlate table pointer
+	 */
+
+	if (bitentry->length != 2) {
+		NV_ERROR(dev, "Do not understand BIT LVDS table\n");
+		return -EINVAL;
+	}
+
+	/*
+	 * No idea if it's still called the LVDS manufacturer table, but
+	 * the concept's close enough.
+	 */
+	bios->fp.lvdsmanufacturerpointer = ROM16(bios->data[bitentry->offset]);
+
+	return 0;
+}
+
+static int
+parse_bit_M_tbl_entry(struct drm_device *dev, struct nvbios *bios,
+		      struct bit_entry *bitentry)
+{
+	/*
+	 * offset + 2  (8  bits): number of options in an
+	 * 	INIT_RAM_RESTRICT_ZM_REG_GROUP opcode option set
+	 * offset + 3  (16 bits): pointer to strap xlate table for RAM
+	 * 	restrict option selection
+	 *
+	 * There's a bunch of bits in this table other than the RAM restrict
+	 * stuff that we don't use - their use currently unknown
+	 */
+
+	/*
+	 * Older bios versions don't have a sufficiently long table for
+	 * what we want
+	 */
+	if (bitentry->length < 0x5)
+		return 0;
+
+	if (bitentry->id[1] < 2) {
+		bios->ram_restrict_group_count = bios->data[bitentry->offset + 2];
+		bios->ram_restrict_tbl_ptr = ROM16(bios->data[bitentry->offset + 3]);
+	} else {
+		bios->ram_restrict_group_count = bios->data[bitentry->offset + 0];
+		bios->ram_restrict_tbl_ptr = ROM16(bios->data[bitentry->offset + 1]);
+	}
+
+	return 0;
+}
+
+static int parse_bit_tmds_tbl_entry(struct drm_device *dev, struct nvbios *bios, struct bit_entry *bitentry)
+{
+	/*
+	 * Parses the pointer to the TMDS table
+	 *
+	 * Starting at bitentry->offset:
+	 *
+	 * offset + 0  (16 bits): TMDS table pointer
+	 *
+	 * The TMDS table is typically found just before the DCB table, with a
+	 * characteristic signature of 0x11,0x13 (1.1 being version, 0x13 being
+	 * length?)
+	 *
+	 * At offset +7 is a pointer to a script, which I don't know how to
+	 * run yet.
+	 * At offset +9 is a pointer to another script, likewise
+	 * Offset +11 has a pointer to a table where the first word is a pxclk
+	 * frequency and the second word a pointer to a script, which should be
+	 * run if the comparison pxclk frequency is less than the pxclk desired.
+	 * This repeats for decreasing comparison frequencies
+	 * Offset +13 has a pointer to a similar table
+	 * The selection of table (and possibly +7/+9 script) is dictated by
+	 * "or" from the DCB.
+	 */
+
+	uint16_t tmdstableptr, script1, script2;
+
+	if (bitentry->length != 2) {
+		NV_ERROR(dev, "Do not understand BIT TMDS table\n");
+		return -EINVAL;
+	}
+
+	tmdstableptr = ROM16(bios->data[bitentry->offset]);
+
+	if (tmdstableptr == 0x0) {
+		NV_ERROR(dev, "Pointer to TMDS table invalid\n");
+		return -EINVAL;
+	}
+
+	/* nv50+ has v2.0, but we don't parse it atm */
+	if (bios->data[tmdstableptr] != 0x11) {
+		NV_WARN(dev,
+			"TMDS table revision %d.%d not currently supported\n",
+			bios->data[tmdstableptr] >> 4, bios->data[tmdstableptr] & 0xf);
+		return -ENOSYS;
+	}
+
+	/*
+	 * These two scripts are odd: they don't seem to get run even when
+	 * they are not stubbed.
+	 */
+	script1 = ROM16(bios->data[tmdstableptr + 7]);
+	script2 = ROM16(bios->data[tmdstableptr + 9]);
+	if (bios->data[script1] != 'q' || bios->data[script2] != 'q')
+		NV_WARN(dev, "TMDS table script pointers not stubbed\n");
+
+	bios->tmds.output0_script_ptr = ROM16(bios->data[tmdstableptr + 11]);
+	bios->tmds.output1_script_ptr = ROM16(bios->data[tmdstableptr + 13]);
+
+	return 0;
+}
+
+static int
+parse_bit_U_tbl_entry(struct drm_device *dev, struct nvbios *bios,
+		      struct bit_entry *bitentry)
+{
+	/*
+	 * Parses the pointer to the G80 output script tables
+	 *
+	 * Starting at bitentry->offset:
+	 *
+	 * offset + 0  (16 bits): output script table pointer
+	 */
+
+	uint16_t outputscripttableptr;
+
+	if (bitentry->length != 3) {
+		NV_ERROR(dev, "Do not understand BIT U table\n");
+		return -EINVAL;
+	}
+
+	outputscripttableptr = ROM16(bios->data[bitentry->offset]);
+	bios->display.script_table_ptr = outputscripttableptr;
+	return 0;
+}
+
+static int
+parse_bit_displayport_tbl_entry(struct drm_device *dev, struct nvbios *bios,
+				struct bit_entry *bitentry)
+{
+	bios->display.dp_table_ptr = ROM16(bios->data[bitentry->offset]);
+	return 0;
+}
+
+struct bit_table {
+	const char id;
+	int (* const parse_fn)(struct drm_device *, struct nvbios *, struct bit_entry *);
+};
+
+#define BIT_TABLE(id, funcid) ((struct bit_table){ id, parse_bit_##funcid##_tbl_entry })
+
+static int
+parse_bit_table(struct nvbios *bios, const uint16_t bitoffset,
+		struct bit_table *table)
+{
+	struct drm_device *dev = bios->dev;
+	uint8_t maxentries = bios->data[bitoffset + 4];
+	int i, offset;
+	struct bit_entry bitentry;
+
+	for (i = 0, offset = bitoffset + 6; i < maxentries; i++, offset += 6) {
+		bitentry.id[0] = bios->data[offset];
+
+		if (bitentry.id[0] != table->id)
+			continue;
+
+		bitentry.id[1] = bios->data[offset + 1];
+		bitentry.length = ROM16(bios->data[offset + 2]);
+		bitentry.offset = ROM16(bios->data[offset + 4]);
+
+		return table->parse_fn(dev, bios, &bitentry);
+	}
+
+	NV_INFO(dev, "BIT table '%c' not found\n", table->id);
+	return -ENOSYS;
+}
+
+static int
+parse_bit_structure(struct nvbios *bios, const uint16_t bitoffset)
+{
+	int ret;
+
+	/*
+	 * The only restriction on parsing order currently is having 'i' first
+	 * for use of bios->*_version or bios->feature_byte while parsing;
+	 * functions shouldn't be actually *doing* anything apart from pulling
+	 * data from the image into the bios struct, thus no interdependencies
+	 */
+	ret = parse_bit_table(bios, bitoffset, &BIT_TABLE('i', i));
+	if (ret) /* info? */
+		return ret;
+	if (bios->major_version >= 0x60) /* g80+ */
+		parse_bit_table(bios, bitoffset, &BIT_TABLE('A', A));
+	ret = parse_bit_table(bios, bitoffset, &BIT_TABLE('C', C));
+	if (ret)
+		return ret;
+	parse_bit_table(bios, bitoffset, &BIT_TABLE('D', display));
+	ret = parse_bit_table(bios, bitoffset, &BIT_TABLE('I', init));
+	if (ret)
+		return ret;
+	parse_bit_table(bios, bitoffset, &BIT_TABLE('M', M)); /* memory? */
+	parse_bit_table(bios, bitoffset, &BIT_TABLE('L', lvds));
+	parse_bit_table(bios, bitoffset, &BIT_TABLE('T', tmds));
+	parse_bit_table(bios, bitoffset, &BIT_TABLE('U', U));
+	parse_bit_table(bios, bitoffset, &BIT_TABLE('d', displayport));
+
+	return 0;
+}
+
+static int parse_bmp_structure(struct drm_device *dev, struct nvbios *bios, unsigned int offset)
+{
+	/*
+	 * Parses the BMP structure for useful things, but does not act on them
+	 *
+	 * offset +   5: BMP major version
+	 * offset +   6: BMP minor version
+	 * offset +   9: BMP feature byte
+	 * offset +  10: BCD encoded BIOS version
+	 *
+	 * offset +  18: init script table pointer (for bios versions < 5.10h)
+	 * offset +  20: extra init script table pointer (for bios
+	 * versions < 5.10h)
+	 *
+	 * offset +  24: memory init table pointer (used on early bios versions)
+	 * offset +  26: SDR memory sequencing setup data table
+	 * offset +  28: DDR memory sequencing setup data table
+	 *
+	 * offset +  54: index of I2C CRTC pair to use for CRT output
+	 * offset +  55: index of I2C CRTC pair to use for TV output
+	 * offset +  56: index of I2C CRTC pair to use for flat panel output
+	 * offset +  58: write CRTC index for I2C pair 0
+	 * offset +  59: read CRTC index for I2C pair 0
+	 * offset +  60: write CRTC index for I2C pair 1
+	 * offset +  61: read CRTC index for I2C pair 1
+	 *
+	 * offset +  67: maximum internal PLL frequency (single stage PLL)
+	 * offset +  71: minimum internal PLL frequency (single stage PLL)
+	 *
+	 * offset +  75: script table pointers, as described in
+	 * parse_script_table_pointers
+	 *
+	 * offset +  89: TMDS single link output A table pointer
+	 * offset +  91: TMDS single link output B table pointer
+	 * offset +  95: LVDS single link output A table pointer
+	 * offset + 105: flat panel timings table pointer
+	 * offset + 107: flat panel strapping translation table pointer
+	 * offset + 117: LVDS manufacturer panel config table pointer
+	 * offset + 119: LVDS manufacturer strapping translation table pointer
+	 *
+	 * offset + 142: PLL limits table pointer
+	 *
+	 * offset + 156: minimum pixel clock for LVDS dual link
+	 */
+
+	uint8_t *bmp = &bios->data[offset], bmp_version_major, bmp_version_minor;
+	uint16_t bmplength;
+	uint16_t legacy_scripts_offset, legacy_i2c_offset;
+
+	/* load needed defaults in case we can't parse this info */
+	bios->bdcb.dcb.i2c[0].write = NV_CIO_CRE_DDC_WR__INDEX;
+	bios->bdcb.dcb.i2c[0].read = NV_CIO_CRE_DDC_STATUS__INDEX;
+	bios->bdcb.dcb.i2c[1].write = NV_CIO_CRE_DDC0_WR__INDEX;
+	bios->bdcb.dcb.i2c[1].read = NV_CIO_CRE_DDC0_STATUS__INDEX;
+	bios->pub.digital_min_front_porch = 0x4b;
+	bios->fmaxvco = 256000;
+	bios->fminvco = 128000;
+	bios->fp.duallink_transition_clk = 90000;
+
+	bmp_version_major = bmp[5];
+	bmp_version_minor = bmp[6];
+
+	NV_TRACE(dev, "BMP version %d.%d\n",
+		 bmp_version_major, bmp_version_minor);
+
+	/*
+	 * Make sure that 0x36 is blank and can't be mistaken for a DCB
+	 * pointer on early versions
+	 */
+	if (bmp_version_major < 5)
+		*(uint16_t *)&bios->data[0x36] = 0;
+
+	/*
+	 * Seems that the minor version was 1 for all major versions prior
+	 * to 5. Version 6 could theoretically exist, but I suspect BIT
+	 * happened instead.
+	 */
+	if ((bmp_version_major < 5 && bmp_version_minor != 1) || bmp_version_major > 5) {
+		NV_ERROR(dev, "You have an unsupported BMP version. "
+				"Please send in your bios\n");
+		return -ENOSYS;
+	}
+
+	if (bmp_version_major == 0)
+		/* nothing that's currently useful in this version */
+		return 0;
+	else if (bmp_version_major == 1)
+		bmplength = 44; /* exact for 1.01 */
+	else if (bmp_version_major == 2)
+		bmplength = 48; /* exact for 2.01 */
+	else if (bmp_version_major == 3)
+		bmplength = 54;
+		/* guessed - mem init tables added in this version */
+	else if (bmp_version_major == 4 || bmp_version_minor < 0x1)
+		/* don't know if 5.0 exists... */
+		bmplength = 62;
+		/* guessed - BMP I2C indices added in version 4*/
+	else if (bmp_version_minor < 0x6)
+		bmplength = 67; /* exact for 5.01 */
+	else if (bmp_version_minor < 0x10)
+		bmplength = 75; /* exact for 5.06 */
+	else if (bmp_version_minor == 0x10)
+		bmplength = 89; /* exact for 5.10h */
+	else if (bmp_version_minor < 0x14)
+		bmplength = 118; /* exact for 5.11h */
+	else if (bmp_version_minor < 0x24)
+		/*
+		 * Not sure of version where pll limits came in;
+		 * certainly exist by 0x24 though.
+		 */
+		/* length not exact: this is long enough to get lvds members */
+		bmplength = 123;
+	else if (bmp_version_minor < 0x27)
+		/*
+		 * Length not exact: this is long enough to get pll limit
+		 * member
+		 */
+		bmplength = 144;
+	else
+		/*
+		 * Length not exact: this is long enough to get dual link
+		 * transition clock.
+		 */
+		bmplength = 158;
+
+	/* checksum */
+	if (nv_cksum(bmp, 8)) {
+		NV_ERROR(dev, "Bad BMP checksum\n");
+		return -EINVAL;
+	}
+
+	/*
+	 * Bit 4 seems to indicate either a mobile bios or a quadro card --
+	 * mobile behaviour consistent (nv11+), quadro only seen nv18gl-nv36gl
+	 * (not nv10gl), bit 5 that the flat panel tables are present, and
+	 * bit 6 a tv bios.
+	 */
+	bios->feature_byte = bmp[9];
+
+	parse_bios_version(dev, bios, offset + 10);
+
+	if (bmp_version_major < 5 || bmp_version_minor < 0x10)
+		bios->old_style_init = true;
+	legacy_scripts_offset = 18;
+	if (bmp_version_major < 2)
+		legacy_scripts_offset -= 4;
+	bios->init_script_tbls_ptr = ROM16(bmp[legacy_scripts_offset]);
+	bios->extra_init_script_tbl_ptr = ROM16(bmp[legacy_scripts_offset + 2]);
+
+	if (bmp_version_major > 2) {	/* appears in BMP 3 */
+		bios->legacy.mem_init_tbl_ptr = ROM16(bmp[24]);
+		bios->legacy.sdr_seq_tbl_ptr = ROM16(bmp[26]);
+		bios->legacy.ddr_seq_tbl_ptr = ROM16(bmp[28]);
+	}
+
+	legacy_i2c_offset = 0x48;	/* BMP version 2 & 3 */
+	if (bmplength > 61)
+		legacy_i2c_offset = offset + 54;
+	bios->legacy.i2c_indices.crt = bios->data[legacy_i2c_offset];
+	bios->legacy.i2c_indices.tv = bios->data[legacy_i2c_offset + 1];
+	bios->legacy.i2c_indices.panel = bios->data[legacy_i2c_offset + 2];
+	bios->bdcb.dcb.i2c[0].write = bios->data[legacy_i2c_offset + 4];
+	bios->bdcb.dcb.i2c[0].read = bios->data[legacy_i2c_offset + 5];
+	bios->bdcb.dcb.i2c[1].write = bios->data[legacy_i2c_offset + 6];
+	bios->bdcb.dcb.i2c[1].read = bios->data[legacy_i2c_offset + 7];
+
+	if (bmplength > 74) {
+		bios->fmaxvco = ROM32(bmp[67]);
+		bios->fminvco = ROM32(bmp[71]);
+	}
+	if (bmplength > 88)
+		parse_script_table_pointers(bios, offset + 75);
+	if (bmplength > 94) {
+		bios->tmds.output0_script_ptr = ROM16(bmp[89]);
+		bios->tmds.output1_script_ptr = ROM16(bmp[91]);
+		/*
+		 * Never observed in use with lvds scripts, but is reused for
+		 * 18/24 bit panel interface default for EDID equipped panels
+		 * (if_is_24bit not set directly to avoid any oscillation).
+		 */
+		bios->legacy.lvds_single_a_script_ptr = ROM16(bmp[95]);
+	}
+	if (bmplength > 108) {
+		bios->fp.fptablepointer = ROM16(bmp[105]);
+		bios->fp.fpxlatetableptr = ROM16(bmp[107]);
+		bios->fp.xlatwidth = 1;
+	}
+	if (bmplength > 120) {
+		bios->fp.lvdsmanufacturerpointer = ROM16(bmp[117]);
+		bios->fp.fpxlatemanufacturertableptr = ROM16(bmp[119]);
+	}
+	if (bmplength > 143)
+		bios->pll_limit_tbl_ptr = ROM16(bmp[142]);
+
+	if (bmplength > 157)
+		bios->fp.duallink_transition_clk = ROM16(bmp[156]) * 10;
+
+	return 0;
+}
+
+static uint16_t findstr(uint8_t *data, int n, const uint8_t *str, int len)
+{
+	int i, j;
+
+	for (i = 0; i <= (n - len); i++) {
+		for (j = 0; j < len; j++)
+			if (data[i + j] != str[j])
+				break;
+		if (j == len)
+			return i;
+	}
+
+	return 0;
+}
+
+static int
+read_dcb_i2c_entry(struct drm_device *dev, int dcb_version, uint8_t *i2ctable, int index, struct dcb_i2c_entry *i2c)
+{
+	uint8_t dcb_i2c_ver = dcb_version, headerlen = 0, entry_len = 4;
+	int i2c_entries = DCB_MAX_NUM_I2C_ENTRIES;
+	int recordoffset = 0, rdofs = 1, wrofs = 0;
+	uint8_t port_type = 0;
+
+	if (!i2ctable)
+		return -EINVAL;
+
+	if (dcb_version >= 0x30) {
+		if (i2ctable[0] != dcb_version) /* necessary? */
+			NV_WARN(dev,
+				"DCB I2C table version mismatch (%02X vs %02X)\n",
+				i2ctable[0], dcb_version);
+		dcb_i2c_ver = i2ctable[0];
+		headerlen = i2ctable[1];
+		if (i2ctable[2] <= DCB_MAX_NUM_I2C_ENTRIES)
+			i2c_entries = i2ctable[2];
+		else
+			NV_WARN(dev,
+				"DCB I2C table has more entries than indexable "
+				"(%d entries, max index 15)\n", i2ctable[2]);
+		entry_len = i2ctable[3];
+		/* [4] is i2c_default_indices, read in parse_dcb_table() */
+	}
+	/*
+	 * It's your own fault if you call this function on a DCB 1.1 BIOS --
+	 * the test below is for DCB 1.2
+	 */
+	if (dcb_version < 0x14) {
+		recordoffset = 2;
+		rdofs = 0;
+		wrofs = 1;
+	}
+
+	if (index == 0xf)
+		return 0;
+	if (index > i2c_entries) {
+		NV_ERROR(dev, "DCB I2C index too big (%d > %d)\n",
+			 index, i2ctable[2]);
+		return -ENOENT;
+	}
+	if (i2ctable[headerlen + entry_len * index + 3] == 0xff) {
+		NV_ERROR(dev, "DCB I2C entry invalid\n");
+		return -EINVAL;
+	}
+
+	if (dcb_i2c_ver >= 0x30) {
+		port_type = i2ctable[headerlen + recordoffset + 3 + entry_len * index];
+
+		/*
+		 * Fixup for chips using same address offset for read and
+		 * write.
+		 */
+		if (port_type == 4)	/* seen on C51 */
+			rdofs = wrofs = 1;
+		if (port_type >= 5)	/* G80+ */
+			rdofs = wrofs = 0;
+	}
+
+	if (dcb_i2c_ver >= 0x40 && port_type != 5 && port_type != 6)
+		NV_WARN(dev, "DCB I2C table has port type %d\n", port_type);
+
+	i2c->port_type = port_type;
+	i2c->read = i2ctable[headerlen + recordoffset + rdofs + entry_len * index];
+	i2c->write = i2ctable[headerlen + recordoffset + wrofs + entry_len * index];
+
+	return 0;
+}
+
+static struct dcb_gpio_entry *
+new_gpio_entry(struct nvbios *bios)
+{
+	struct parsed_dcb_gpio *gpio = &bios->bdcb.gpio;
+
+	return &gpio->entry[gpio->entries++];
+}
+
+struct dcb_gpio_entry *
+nouveau_bios_gpio_entry(struct drm_device *dev, enum dcb_gpio_tag tag)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nvbios *bios = &dev_priv->VBIOS;
+	int i;
+
+	for (i = 0; i < bios->bdcb.gpio.entries; i++) {
+		if (bios->bdcb.gpio.entry[i].tag != tag)
+			continue;
+
+		return &bios->bdcb.gpio.entry[i];
+	}
+
+	return NULL;
+}
+
+static void
+parse_dcb30_gpio_entry(struct nvbios *bios, uint16_t offset)
+{
+	struct dcb_gpio_entry *gpio;
+	uint16_t ent = ROM16(bios->data[offset]);
+	uint8_t line = ent & 0x1f,
+		tag = ent >> 5 & 0x3f,
+		flags = ent >> 11 & 0x1f;
+
+	if (tag == 0x3f)
+		return;
+
+	gpio = new_gpio_entry(bios);
+
+	gpio->tag = tag;
+	gpio->line = line;
+	gpio->invert = flags != 4;
+}
+
+static void
+parse_dcb40_gpio_entry(struct nvbios *bios, uint16_t offset)
+{
+	struct dcb_gpio_entry *gpio;
+	uint32_t ent = ROM32(bios->data[offset]);
+	uint8_t line = ent & 0x1f,
+		tag = ent >> 8 & 0xff;
+
+	if (tag == 0xff)
+		return;
+
+	gpio = new_gpio_entry(bios);
+
+	/* Currently unused, we may need more fields parsed at some
+	 * point. */
+	gpio->tag = tag;
+	gpio->line = line;
+}
+
+static void
+parse_dcb_gpio_table(struct nvbios *bios)
+{
+	struct drm_device *dev = bios->dev;
+	uint16_t gpio_table_ptr = bios->bdcb.gpio_table_ptr;
+	uint8_t *gpio_table = &bios->data[gpio_table_ptr];
+	int header_len = gpio_table[1],
+	    entries = gpio_table[2],
+	    entry_len = gpio_table[3];
+	void (*parse_entry)(struct nvbios *, uint16_t) = NULL;
+	int i;
+
+	if (bios->bdcb.version >= 0x40) {
+		if (gpio_table_ptr && entry_len != 4) {
+			NV_WARN(dev, "Invalid DCB GPIO table entry length.\n");
+			return;
+		}
+
+		parse_entry = parse_dcb40_gpio_entry;
+
+	} else if (bios->bdcb.version >= 0x30) {
+		if (gpio_table_ptr && entry_len != 2) {
+			NV_WARN(dev, "Invalid DCB GPIO table entry length.\n");
+			return;
+		}
+
+		parse_entry = parse_dcb30_gpio_entry;
+
+	} else if (bios->bdcb.version >= 0x22) {
+		/*
+		 * DCBs older than v3.0 don't really have a GPIO
+		 * table, instead they keep some GPIO info at fixed
+		 * locations.
+		 */
+		uint16_t dcbptr = ROM16(bios->data[0x36]);
+		uint8_t *tvdac_gpio = &bios->data[dcbptr - 5];
+
+		if (tvdac_gpio[0] & 1) {
+			struct dcb_gpio_entry *gpio = new_gpio_entry(bios);
+
+			gpio->tag = DCB_GPIO_TVDAC0;
+			gpio->line = tvdac_gpio[1] >> 4;
+			gpio->invert = tvdac_gpio[0] & 2;
+		}
+	}
+
+	if (!gpio_table_ptr)
+		return;
+
+	if (entries > DCB_MAX_NUM_GPIO_ENTRIES) {
+		NV_WARN(dev, "Too many entries in the DCB GPIO table.\n");
+		entries = DCB_MAX_NUM_GPIO_ENTRIES;
+	}
+
+	for (i = 0; i < entries; i++)
+		parse_entry(bios, gpio_table_ptr + header_len + entry_len * i);
+}
+
+struct dcb_connector_table_entry *
+nouveau_bios_connector_entry(struct drm_device *dev, int index)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nvbios *bios = &dev_priv->VBIOS;
+	struct dcb_connector_table_entry *cte;
+
+	if (index >= bios->bdcb.connector.entries)
+		return NULL;
+
+	cte = &bios->bdcb.connector.entry[index];
+	if (cte->type == 0xff)
+		return NULL;
+
+	return cte;
+}
+
+static void
+parse_dcb_connector_table(struct nvbios *bios)
+{
+	struct drm_device *dev = bios->dev;
+	struct dcb_connector_table *ct = &bios->bdcb.connector;
+	struct dcb_connector_table_entry *cte;
+	uint8_t *conntab = &bios->data[bios->bdcb.connector_table_ptr];
+	uint8_t *entry;
+	int i;
+
+	if (!bios->bdcb.connector_table_ptr) {
+		NV_DEBUG_KMS(dev, "No DCB connector table present\n");
+		return;
+	}
+
+	NV_INFO(dev, "DCB connector table: VHER 0x%02x %d %d %d\n",
+		conntab[0], conntab[1], conntab[2], conntab[3]);
+	if ((conntab[0] != 0x30 && conntab[0] != 0x40) ||
+	    (conntab[3] != 2 && conntab[3] != 4)) {
+		NV_ERROR(dev, "  Unknown!  Please report.\n");
+		return;
+	}
+
+	ct->entries = conntab[2];
+
+	entry = conntab + conntab[1];
+	cte = &ct->entry[0];
+	for (i = 0; i < conntab[2]; i++, entry += conntab[3], cte++) {
+		if (conntab[3] == 2)
+			cte->entry = ROM16(entry[0]);
+		else
+			cte->entry = ROM32(entry[0]);
+		cte->type  = (cte->entry & 0x000000ff) >> 0;
+		cte->index = (cte->entry & 0x00000f00) >> 8;
+		switch (cte->entry & 0x00033000) {
+		case 0x00001000:
+			cte->gpio_tag = 0x07;
+			break;
+		case 0x00002000:
+			cte->gpio_tag = 0x08;
+			break;
+		case 0x00010000:
+			cte->gpio_tag = 0x51;
+			break;
+		case 0x00020000:
+			cte->gpio_tag = 0x52;
+			break;
+		default:
+			cte->gpio_tag = 0xff;
+			break;
+		}
+
+		if (cte->type == 0xff)
+			continue;
+
+		NV_INFO(dev, "  %d: 0x%08x: type 0x%02x idx %d tag 0x%02x\n",
+			i, cte->entry, cte->type, cte->index, cte->gpio_tag);
+	}
+}
+
+static struct dcb_entry *new_dcb_entry(struct parsed_dcb *dcb)
+{
+	struct dcb_entry *entry = &dcb->entry[dcb->entries];
+
+	memset(entry, 0, sizeof(struct dcb_entry));
+	entry->index = dcb->entries++;
+
+	return entry;
+}
+
+static void fabricate_vga_output(struct parsed_dcb *dcb, int i2c, int heads)
+{
+	struct dcb_entry *entry = new_dcb_entry(dcb);
+
+	entry->type = 0;
+	entry->i2c_index = i2c;
+	entry->heads = heads;
+	entry->location = DCB_LOC_ON_CHIP;
+	/* "or" mostly unused in early gen crt modesetting, 0 is fine */
+}
+
+static void fabricate_dvi_i_output(struct parsed_dcb *dcb, bool twoHeads)
+{
+	struct dcb_entry *entry = new_dcb_entry(dcb);
+
+	entry->type = 2;
+	entry->i2c_index = LEGACY_I2C_PANEL;
+	entry->heads = twoHeads ? 3 : 1;
+	entry->location = !DCB_LOC_ON_CHIP;	/* ie OFF CHIP */
+	entry->or = 1;	/* means |0x10 gets set on CRE_LCD__INDEX */
+	entry->duallink_possible = false; /* SiI164 and co. are single link */
+
+#if 0
+	/*
+	 * For dvi-a either crtc probably works, but my card appears to only
+	 * support dvi-d.  "nvidia" still attempts to program it for dvi-a,
+	 * doing the full fp output setup (program 0x6808.. fp dimension regs,
+	 * setting 0x680848 to 0x10000111 to enable, maybe setting 0x680880);
+	 * the monitor picks up the mode res ok and lights up, but no pixel
+	 * data appears, so the board manufacturer probably connected up the
+	 * sync lines, but missed the video traces / components
+	 *
+	 * with this introduction, dvi-a left as an exercise for the reader.
+	 */
+	fabricate_vga_output(dcb, LEGACY_I2C_PANEL, entry->heads);
+#endif
+}
+
+static void fabricate_tv_output(struct parsed_dcb *dcb, bool twoHeads)
+{
+	struct dcb_entry *entry = new_dcb_entry(dcb);
+
+	entry->type = 1;
+	entry->i2c_index = LEGACY_I2C_TV;
+	entry->heads = twoHeads ? 3 : 1;
+	entry->location = !DCB_LOC_ON_CHIP;	/* ie OFF CHIP */
+}
+
+static bool
+parse_dcb20_entry(struct drm_device *dev, struct bios_parsed_dcb *bdcb,
+		  uint32_t conn, uint32_t conf, struct dcb_entry *entry)
+{
+	entry->type = conn & 0xf;
+	entry->i2c_index = (conn >> 4) & 0xf;
+	entry->heads = (conn >> 8) & 0xf;
+	if (bdcb->version >= 0x40)
+		entry->connector = (conn >> 12) & 0xf;
+	entry->bus = (conn >> 16) & 0xf;
+	entry->location = (conn >> 20) & 0x3;
+	entry->or = (conn >> 24) & 0xf;
+	/*
+	 * Normal entries consist of a single bit, but dual link has the
+	 * next most significant bit set too
+	 */
+	entry->duallink_possible =
+			((1 << (ffs(entry->or) - 1)) * 3 == entry->or);
+
+	switch (entry->type) {
+	case OUTPUT_ANALOG:
+		/*
+		 * Although the rest of a CRT conf dword is usually
+		 * zeros, mac biosen have stuff there so we must mask
+		 */
+		entry->crtconf.maxfreq = (bdcb->version < 0x30) ?
+					 (conf & 0xffff) * 10 :
+					 (conf & 0xff) * 10000;
+		break;
+	case OUTPUT_LVDS:
+		{
+		uint32_t mask;
+		if (conf & 0x1)
+			entry->lvdsconf.use_straps_for_mode = true;
+		if (bdcb->version < 0x22) {
+			mask = ~0xd;
+			/*
+			 * The laptop in bug 14567 lies and claims to not use
+			 * straps when it does, so assume all DCB 2.0 laptops
+			 * use straps, until a broken EDID using one is produced
+			 */
+			entry->lvdsconf.use_straps_for_mode = true;
+			/*
+			 * Both 0x4 and 0x8 show up in v2.0 tables; assume they
+			 * mean the same thing (probably wrong, but might work)
+			 */
+			if (conf & 0x4 || conf & 0x8)
+				entry->lvdsconf.use_power_scripts = true;
+		} else {
+			mask = ~0x5;
+			if (conf & 0x4)
+				entry->lvdsconf.use_power_scripts = true;
+		}
+		if (conf & mask) {
+			/*
+			 * Until we even try to use these on G8x, it's
+			 * useless reporting unknown bits.  They all are.
+			 */
+			if (bdcb->version >= 0x40)
+				break;
+
+			NV_ERROR(dev, "Unknown LVDS configuration bits, "
+				      "please report\n");
+		}
+		break;
+		}
+	case OUTPUT_TV:
+	{
+		if (bdcb->version >= 0x30)
+			entry->tvconf.has_component_output = conf & (0x8 << 4);
+		else
+			entry->tvconf.has_component_output = false;
+
+		break;
+	}
+	case OUTPUT_DP:
+		entry->dpconf.sor.link = (conf & 0x00000030) >> 4;
+		entry->dpconf.link_bw = (conf & 0x00e00000) >> 21;
+		switch ((conf & 0x0f000000) >> 24) {
+		case 0xf:
+			entry->dpconf.link_nr = 4;
+			break;
+		case 0x3:
+			entry->dpconf.link_nr = 2;
+			break;
+		default:
+			entry->dpconf.link_nr = 1;
+			break;
+		}
+		break;
+	case OUTPUT_TMDS:
+		entry->tmdsconf.sor.link = (conf & 0x00000030) >> 4;
+		break;
+	case 0xe:
+		/* weird g80 mobile type that "nv" treats as a terminator */
+		bdcb->dcb.entries--;
+		return false;
+	}
+
+	/* unsure what DCB version introduces this, 3.0? */
+	if (conf & 0x100000)
+		entry->i2c_upper_default = true;
+
+	return true;
+}
+
+static bool
+parse_dcb15_entry(struct drm_device *dev, struct parsed_dcb *dcb,
+		  uint32_t conn, uint32_t conf, struct dcb_entry *entry)
+{
+	if (conn != 0xf0003f00 && conn != 0xf2247f10 && conn != 0xf2204001 &&
+	    conn != 0xf2204301 && conn != 0xf2204311 && conn != 0xf2208001 &&
+	    conn != 0xf2244001 && conn != 0xf2244301 && conn != 0xf2244311 &&
+	    conn != 0xf4204011 && conn != 0xf4208011 && conn != 0xf4248011 &&
+	    conn != 0xf2045ff2 && conn != 0xf2045f14 && conn != 0xf207df14 &&
+	    conn != 0xf2205004 && conn != 0xf2209004) {
+		NV_ERROR(dev, "Unknown DCB 1.5 entry, please report\n");
+
+		/* cause output setting to fail for !TV, so message is seen */
+		if ((conn & 0xf) != 0x1)
+			dcb->entries = 0;
+
+		return false;
+	}
+	/* most of the below is a "best guess" atm */
+	entry->type = conn & 0xf;
+	if (entry->type == 2)
+		/* another way of specifying straps based lvds... */
+		entry->type = OUTPUT_LVDS;
+	if (entry->type == 4) { /* digital */
+		if (conn & 0x10)
+			entry->type = OUTPUT_LVDS;
+		else
+			entry->type = OUTPUT_TMDS;
+	}
+	/* what's in bits 5-13? could be some encoder maker thing, in tv case */
+	entry->i2c_index = (conn >> 14) & 0xf;
+	/* raw heads field is in range 0-1, so move to 1-2 */
+	entry->heads = ((conn >> 18) & 0x7) + 1;
+	entry->location = (conn >> 21) & 0xf;
+	/* unused: entry->bus = (conn >> 25) & 0x7; */
+	/* set or to be same as heads -- hopefully safe enough */
+	entry->or = entry->heads;
+	entry->duallink_possible = false;
+
+	switch (entry->type) {
+	case OUTPUT_ANALOG:
+		entry->crtconf.maxfreq = (conf & 0xffff) * 10;
+		break;
+	case OUTPUT_LVDS:
+		/*
+		 * This is probably buried in conn's unknown bits.
+		 * This will upset EDID-ful models, if they exist
+		 */
+		entry->lvdsconf.use_straps_for_mode = true;
+		entry->lvdsconf.use_power_scripts = true;
+		break;
+	case OUTPUT_TMDS:
+		/*
+		 * Invent a DVI-A output, by copying the fields of the DVI-D
+		 * output; reported to work by math_b on an NV20(!).
+		 */
+		fabricate_vga_output(dcb, entry->i2c_index, entry->heads);
+		break;
+	case OUTPUT_TV:
+		entry->tvconf.has_component_output = false;
+		break;
+	}
+
+	return true;
+}
+
+static bool parse_dcb_entry(struct drm_device *dev, struct bios_parsed_dcb *bdcb,
+			    uint32_t conn, uint32_t conf)
+{
+	struct dcb_entry *entry = new_dcb_entry(&bdcb->dcb);
+	bool ret;
+
+	if (bdcb->version >= 0x20)
+		ret = parse_dcb20_entry(dev, bdcb, conn, conf, entry);
+	else
+		ret = parse_dcb15_entry(dev, &bdcb->dcb, conn, conf, entry);
+	if (!ret)
+		return ret;
+
+	read_dcb_i2c_entry(dev, bdcb->version, bdcb->i2c_table,
+			   entry->i2c_index, &bdcb->dcb.i2c[entry->i2c_index]);
+
+	return true;
+}
+
+static
+void merge_like_dcb_entries(struct drm_device *dev, struct parsed_dcb *dcb)
+{
+	/*
+	 * DCB v2.0 lists each output combination separately.
+	 * Here we merge compatible entries to have fewer outputs, with
+	 * more options
+	 */
+
+	int i, newentries = 0;
+
+	for (i = 0; i < dcb->entries; i++) {
+		struct dcb_entry *ient = &dcb->entry[i];
+		int j;
+
+		for (j = i + 1; j < dcb->entries; j++) {
+			struct dcb_entry *jent = &dcb->entry[j];
+
+			if (jent->type == 100) /* already merged entry */
+				continue;
+
+			/* merge heads field when all other fields the same */
+			if (jent->i2c_index == ient->i2c_index &&
+			    jent->type == ient->type &&
+			    jent->location == ient->location &&
+			    jent->or == ient->or) {
+				NV_TRACE(dev, "Merging DCB entries %d and %d\n",
+					 i, j);
+				ient->heads |= jent->heads;
+				jent->type = 100; /* dummy value */
+			}
+		}
+	}
+
+	/* Compact entries merged into others out of dcb */
+	for (i = 0; i < dcb->entries; i++) {
+		if (dcb->entry[i].type == 100)
+			continue;
+
+		if (newentries != i) {
+			dcb->entry[newentries] = dcb->entry[i];
+			dcb->entry[newentries].index = newentries;
+		}
+		newentries++;
+	}
+
+	dcb->entries = newentries;
+}
+
+static int parse_dcb_table(struct drm_device *dev, struct nvbios *bios, bool twoHeads)
+{
+	struct bios_parsed_dcb *bdcb = &bios->bdcb;
+	struct parsed_dcb *dcb;
+	uint16_t dcbptr, i2ctabptr = 0;
+	uint8_t *dcbtable;
+	uint8_t headerlen = 0x4, entries = DCB_MAX_NUM_ENTRIES;
+	bool configblock = true;
+	int recordlength = 8, confofs = 4;
+	int i;
+
+	dcb = bios->pub.dcb = &bdcb->dcb;
+	dcb->entries = 0;
+
+	/* get the offset from 0x36 */
+	dcbptr = ROM16(bios->data[0x36]);
+
+	if (dcbptr == 0x0) {
+		NV_WARN(dev, "No output data (DCB) found in BIOS, "
+			       "assuming a CRT output exists\n");
+		/* this situation likely means a really old card, pre DCB */
+		fabricate_vga_output(dcb, LEGACY_I2C_CRT, 1);
+
+		if (nv04_tv_identify(dev,
+				     bios->legacy.i2c_indices.tv) >= 0)
+			fabricate_tv_output(dcb, twoHeads);
+
+		return 0;
+	}
+
+	dcbtable = &bios->data[dcbptr];
+
+	/* get DCB version */
+	bdcb->version = dcbtable[0];
+	NV_TRACE(dev, "Found Display Configuration Block version %d.%d\n",
+		 bdcb->version >> 4, bdcb->version & 0xf);
+
+	if (bdcb->version >= 0x20) { /* NV17+ */
+		uint32_t sig;
+
+		if (bdcb->version >= 0x30) { /* NV40+ */
+			headerlen = dcbtable[1];
+			entries = dcbtable[2];
+			recordlength = dcbtable[3];
+			i2ctabptr = ROM16(dcbtable[4]);
+			sig = ROM32(dcbtable[6]);
+			bdcb->gpio_table_ptr = ROM16(dcbtable[10]);
+			bdcb->connector_table_ptr = ROM16(dcbtable[20]);
+		} else {
+			i2ctabptr = ROM16(dcbtable[2]);
+			sig = ROM32(dcbtable[4]);
+			headerlen = 8;
+		}
+
+		if (sig != 0x4edcbdcb) {
+			NV_ERROR(dev, "Bad Display Configuration Block "
+					"signature (%08X)\n", sig);
+			return -EINVAL;
+		}
+	} else if (bdcb->version >= 0x15) { /* some NV11 and NV20 */
+		char sig[8] = { 0 };
+
+		strncpy(sig, (char *)&dcbtable[-7], 7);
+		i2ctabptr = ROM16(dcbtable[2]);
+		recordlength = 10;
+		confofs = 6;
+
+		if (strcmp(sig, "DEV_REC")) {
+			NV_ERROR(dev, "Bad Display Configuration Block "
+					"signature (%s)\n", sig);
+			return -EINVAL;
+		}
+	} else {
+		/*
+		 * v1.4 (some NV15/16, NV11+) seems the same as v1.5, but always
+		 * has the same single (crt) entry, even when tv-out present, so
+		 * the conclusion is this version cannot really be used.
+		 * v1.2 tables (some NV6/10, and NV15+) normally have the same
+		 * 5 entries, which are not specific to the card and so no use.
+		 * v1.2 does have an I2C table that read_dcb_i2c_table can
+		 * handle, but cards exist (nv11 in #14821) with a bad i2c table
+		 * pointer, so use the indices parsed in parse_bmp_structure.
+		 * v1.1 (NV5+, maybe some NV4) is entirely unhelpful
+		 */
+		NV_TRACEWARN(dev, "No useful information in BIOS output table; "
+				  "adding all possible outputs\n");
+		fabricate_vga_output(dcb, LEGACY_I2C_CRT, 1);
+
+		/*
+		 * Attempt to detect TV before DVI because the test
+		 * for the former is more accurate and it rules the
+		 * latter out.
+		 */
+		if (nv04_tv_identify(dev,
+				     bios->legacy.i2c_indices.tv) >= 0)
+			fabricate_tv_output(dcb, twoHeads);
+
+		else if (bios->tmds.output0_script_ptr ||
+			 bios->tmds.output1_script_ptr)
+			fabricate_dvi_i_output(dcb, twoHeads);
+
+		return 0;
+	}
+
+	if (!i2ctabptr)
+		NV_WARN(dev, "No pointer to DCB I2C port table\n");
+	else {
+		bdcb->i2c_table = &bios->data[i2ctabptr];
+		if (bdcb->version >= 0x30)
+			bdcb->i2c_default_indices = bdcb->i2c_table[4];
+	}
+
+	parse_dcb_gpio_table(bios);
+	parse_dcb_connector_table(bios);
+
+	if (entries > DCB_MAX_NUM_ENTRIES)
+		entries = DCB_MAX_NUM_ENTRIES;
+
+	for (i = 0; i < entries; i++) {
+		uint32_t connection, config = 0;
+
+		connection = ROM32(dcbtable[headerlen + recordlength * i]);
+		if (configblock)
+			config = ROM32(dcbtable[headerlen + confofs + recordlength * i]);
+
+		/* seen on an NV11 with DCB v1.5 */
+		if (connection == 0x00000000)
+			break;
+
+		/* seen on an NV17 with DCB v2.0 */
+		if (connection == 0xffffffff)
+			break;
+
+		if ((connection & 0x0000000f) == 0x0000000f)
+			continue;
+
+		NV_TRACEWARN(dev, "Raw DCB entry %d: %08x %08x\n",
+			     dcb->entries, connection, config);
+
+		if (!parse_dcb_entry(dev, bdcb, connection, config))
+			break;
+	}
+
+	/*
+	 * apart for v2.1+ not being known for requiring merging, this
+	 * guarantees dcbent->index is the index of the entry in the rom image
+	 */
+	if (bdcb->version < 0x21)
+		merge_like_dcb_entries(dev, dcb);
+
+	return dcb->entries ? 0 : -ENXIO;
+}
+
+static void
+fixup_legacy_connector(struct nvbios *bios)
+{
+	struct bios_parsed_dcb *bdcb = &bios->bdcb;
+	struct parsed_dcb *dcb = &bdcb->dcb;
+	int high = 0, i;
+
+	/*
+	 * DCB 3.0 also has the table in most cases, but there are some cards
+	 * where the table is filled with stub entries, and the DCB entriy
+	 * indices are all 0.  We don't need the connector indices on pre-G80
+	 * chips (yet?) so limit the use to DCB 4.0 and above.
+	 */
+	if (bdcb->version >= 0x40)
+		return;
+
+	/*
+	 * No known connector info before v3.0, so make it up.  the rule here
+	 * is: anything on the same i2c bus is considered to be on the same
+	 * connector.  any output without an associated i2c bus is assigned
+	 * its own unique connector index.
+	 */
+	for (i = 0; i < dcb->entries; i++) {
+		if (dcb->entry[i].i2c_index == 0xf)
+			continue;
+
+		/*
+		 * Ignore the I2C index for on-chip TV-out, as there
+		 * are cards with bogus values (nv31m in bug 23212),
+		 * and it's otherwise useless.
+		 */
+		if (dcb->entry[i].type == OUTPUT_TV &&
+		    dcb->entry[i].location == DCB_LOC_ON_CHIP) {
+			dcb->entry[i].i2c_index = 0xf;
+			continue;
+		}
+
+		dcb->entry[i].connector = dcb->entry[i].i2c_index;
+		if (dcb->entry[i].connector > high)
+			high = dcb->entry[i].connector;
+	}
+
+	for (i = 0; i < dcb->entries; i++) {
+		if (dcb->entry[i].i2c_index != 0xf)
+			continue;
+
+		dcb->entry[i].connector = ++high;
+	}
+}
+
+static void
+fixup_legacy_i2c(struct nvbios *bios)
+{
+	struct parsed_dcb *dcb = &bios->bdcb.dcb;
+	int i;
+
+	for (i = 0; i < dcb->entries; i++) {
+		if (dcb->entry[i].i2c_index == LEGACY_I2C_CRT)
+			dcb->entry[i].i2c_index = bios->legacy.i2c_indices.crt;
+		if (dcb->entry[i].i2c_index == LEGACY_I2C_PANEL)
+			dcb->entry[i].i2c_index = bios->legacy.i2c_indices.panel;
+		if (dcb->entry[i].i2c_index == LEGACY_I2C_TV)
+			dcb->entry[i].i2c_index = bios->legacy.i2c_indices.tv;
+	}
+}
+
+static int load_nv17_hwsq_ucode_entry(struct drm_device *dev, struct nvbios *bios, uint16_t hwsq_offset, int entry)
+{
+	/*
+	 * The header following the "HWSQ" signature has the number of entries,
+	 * and the entry size
+	 *
+	 * An entry consists of a dword to write to the sequencer control reg
+	 * (0x00001304), followed by the ucode bytes, written sequentially,
+	 * starting at reg 0x00001400
+	 */
+
+	uint8_t bytes_to_write;
+	uint16_t hwsq_entry_offset;
+	int i;
+
+	if (bios->data[hwsq_offset] <= entry) {
+		NV_ERROR(dev, "Too few entries in HW sequencer table for "
+				"requested entry\n");
+		return -ENOENT;
+	}
+
+	bytes_to_write = bios->data[hwsq_offset + 1];
+
+	if (bytes_to_write != 36) {
+		NV_ERROR(dev, "Unknown HW sequencer entry size\n");
+		return -EINVAL;
+	}
+
+	NV_TRACE(dev, "Loading NV17 power sequencing microcode\n");
+
+	hwsq_entry_offset = hwsq_offset + 2 + entry * bytes_to_write;
+
+	/* set sequencer control */
+	bios_wr32(bios, 0x00001304, ROM32(bios->data[hwsq_entry_offset]));
+	bytes_to_write -= 4;
+
+	/* write ucode */
+	for (i = 0; i < bytes_to_write; i += 4)
+		bios_wr32(bios, 0x00001400 + i, ROM32(bios->data[hwsq_entry_offset + i + 4]));
+
+	/* twiddle NV_PBUS_DEBUG_4 */
+	bios_wr32(bios, NV_PBUS_DEBUG_4, bios_rd32(bios, NV_PBUS_DEBUG_4) | 0x18);
+
+	return 0;
+}
+
+static int load_nv17_hw_sequencer_ucode(struct drm_device *dev,
+					struct nvbios *bios)
+{
+	/*
+	 * BMP based cards, from NV17, need a microcode loading to correctly
+	 * control the GPIO etc for LVDS panels
+	 *
+	 * BIT based cards seem to do this directly in the init scripts
+	 *
+	 * The microcode entries are found by the "HWSQ" signature.
+	 */
+
+	const uint8_t hwsq_signature[] = { 'H', 'W', 'S', 'Q' };
+	const int sz = sizeof(hwsq_signature);
+	int hwsq_offset;
+
+	hwsq_offset = findstr(bios->data, bios->length, hwsq_signature, sz);
+	if (!hwsq_offset)
+		return 0;
+
+	/* always use entry 0? */
+	return load_nv17_hwsq_ucode_entry(dev, bios, hwsq_offset + sz, 0);
+}
+
+uint8_t *nouveau_bios_embedded_edid(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nvbios *bios = &dev_priv->VBIOS;
+	const uint8_t edid_sig[] = {
+			0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00 };
+	uint16_t offset = 0;
+	uint16_t newoffset;
+	int searchlen = NV_PROM_SIZE;
+
+	if (bios->fp.edid)
+		return bios->fp.edid;
+
+	while (searchlen) {
+		newoffset = findstr(&bios->data[offset], searchlen,
+								edid_sig, 8);
+		if (!newoffset)
+			return NULL;
+		offset += newoffset;
+		if (!nv_cksum(&bios->data[offset], EDID1_LEN))
+			break;
+
+		searchlen -= offset;
+		offset++;
+	}
+
+	NV_TRACE(dev, "Found EDID in BIOS\n");
+
+	return bios->fp.edid = &bios->data[offset];
+}
+
+void
+nouveau_bios_run_init_table(struct drm_device *dev, uint16_t table,
+			    struct dcb_entry *dcbent)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nvbios *bios = &dev_priv->VBIOS;
+	struct init_exec iexec = { true, false };
+
+	bios->display.output = dcbent;
+	parse_init_table(bios, table, &iexec);
+	bios->display.output = NULL;
+}
+
+static bool NVInitVBIOS(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nvbios *bios = &dev_priv->VBIOS;
+
+	memset(bios, 0, sizeof(struct nvbios));
+	bios->dev = dev;
+
+	if (!NVShadowVBIOS(dev, bios->data))
+		return false;
+
+	bios->length = NV_PROM_SIZE;
+	return true;
+}
+
+static int nouveau_parse_vbios_struct(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nvbios *bios = &dev_priv->VBIOS;
+	const uint8_t bit_signature[] = { 0xff, 0xb8, 'B', 'I', 'T' };
+	const uint8_t bmp_signature[] = { 0xff, 0x7f, 'N', 'V', 0x0 };
+	int offset;
+
+	offset = findstr(bios->data, bios->length,
+					bit_signature, sizeof(bit_signature));
+	if (offset) {
+		NV_TRACE(dev, "BIT BIOS found\n");
+		return parse_bit_structure(bios, offset + 6);
+	}
+
+	offset = findstr(bios->data, bios->length,
+					bmp_signature, sizeof(bmp_signature));
+	if (offset) {
+		NV_TRACE(dev, "BMP BIOS found\n");
+		return parse_bmp_structure(dev, bios, offset);
+	}
+
+	NV_ERROR(dev, "No known BIOS signature found\n");
+	return -ENODEV;
+}
+
+int
+nouveau_run_vbios_init(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nvbios *bios = &dev_priv->VBIOS;
+	int i, ret = 0;
+
+	NVLockVgaCrtcs(dev, false);
+	if (nv_two_heads(dev))
+		NVSetOwner(dev, bios->state.crtchead);
+
+	if (bios->major_version < 5)	/* BMP only */
+		load_nv17_hw_sequencer_ucode(dev, bios);
+
+	if (bios->execute) {
+		bios->fp.last_script_invoc = 0;
+		bios->fp.lvds_init_run = false;
+	}
+
+	parse_init_tables(bios);
+
+	/*
+	 * Runs some additional script seen on G8x VBIOSen.  The VBIOS'
+	 * parser will run this right after the init tables, the binary
+	 * driver appears to run it at some point later.
+	 */
+	if (bios->some_script_ptr) {
+		struct init_exec iexec = {true, false};
+
+		NV_INFO(dev, "Parsing VBIOS init table at offset 0x%04X\n",
+			bios->some_script_ptr);
+		parse_init_table(bios, bios->some_script_ptr, &iexec);
+	}
+
+	if (dev_priv->card_type >= NV_50) {
+		for (i = 0; i < bios->bdcb.dcb.entries; i++) {
+			nouveau_bios_run_display_table(dev,
+						       &bios->bdcb.dcb.entry[i],
+						       0, 0);
+		}
+	}
+
+	NVLockVgaCrtcs(dev, true);
+
+	return ret;
+}
+
+static void
+nouveau_bios_i2c_devices_takedown(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nvbios *bios = &dev_priv->VBIOS;
+	struct dcb_i2c_entry *entry;
+	int i;
+
+	entry = &bios->bdcb.dcb.i2c[0];
+	for (i = 0; i < DCB_MAX_NUM_I2C_ENTRIES; i++, entry++)
+		nouveau_i2c_fini(dev, entry);
+}
+
+int
+nouveau_bios_init(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nvbios *bios = &dev_priv->VBIOS;
+	uint32_t saved_nv_pextdev_boot_0;
+	bool was_locked;
+	int ret;
+
+	dev_priv->vbios = &bios->pub;
+
+	if (!NVInitVBIOS(dev))
+		return -ENODEV;
+
+	ret = nouveau_parse_vbios_struct(dev);
+	if (ret)
+		return ret;
+
+	ret = parse_dcb_table(dev, bios, nv_two_heads(dev));
+	if (ret)
+		return ret;
+
+	fixup_legacy_i2c(bios);
+	fixup_legacy_connector(bios);
+
+	if (!bios->major_version)	/* we don't run version 0 bios */
+		return 0;
+
+	/* these will need remembering across a suspend */
+	saved_nv_pextdev_boot_0 = bios_rd32(bios, NV_PEXTDEV_BOOT_0);
+	bios->state.saved_nv_pfb_cfg0 = bios_rd32(bios, NV_PFB_CFG0);
+
+	/* init script execution disabled */
+	bios->execute = false;
+
+	/* ... unless card isn't POSTed already */
+	if (dev_priv->card_type >= NV_10 &&
+	    NVReadVgaCrtc(dev, 0, 0x00) == 0 &&
+	    NVReadVgaCrtc(dev, 0, 0x1a) == 0) {
+		NV_INFO(dev, "Adaptor not initialised\n");
+		if (dev_priv->card_type < NV_50) {
+			NV_ERROR(dev, "Unable to POST this chipset\n");
+			return -ENODEV;
+		}
+
+		NV_INFO(dev, "Running VBIOS init tables\n");
+		bios->execute = true;
+	}
+
+	bios_wr32(bios, NV_PEXTDEV_BOOT_0, saved_nv_pextdev_boot_0);
+
+	ret = nouveau_run_vbios_init(dev);
+	if (ret) {
+		dev_priv->vbios = NULL;
+		return ret;
+	}
+
+	/* feature_byte on BMP is poor, but init always sets CR4B */
+	was_locked = NVLockVgaCrtcs(dev, false);
+	if (bios->major_version < 5)
+		bios->is_mobile = NVReadVgaCrtc(dev, 0, NV_CIO_CRE_4B) & 0x40;
+
+	/* all BIT systems need p_f_m_t for digital_min_front_porch */
+	if (bios->is_mobile || bios->major_version >= 5)
+		ret = parse_fp_mode_table(dev, bios);
+	NVLockVgaCrtcs(dev, was_locked);
+
+	/* allow subsequent scripts to execute */
+	bios->execute = true;
+
+	return 0;
+}
+
+void
+nouveau_bios_takedown(struct drm_device *dev)
+{
+	nouveau_bios_i2c_devices_takedown(dev);
+}
diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.h b/drivers/gpu/drm/nouveau/nouveau_bios.h
new file mode 100644
index 000000000000..058e98c76d89
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nouveau_bios.h
@@ -0,0 +1,290 @@
+/*
+ * Copyright 2007-2008 Nouveau Project
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ */
+
+#ifndef __NOUVEAU_BIOS_H__
+#define __NOUVEAU_BIOS_H__
+
+#include "nvreg.h"
+#include "nouveau_i2c.h"
+
+#define DCB_MAX_NUM_ENTRIES 16
+#define DCB_MAX_NUM_I2C_ENTRIES 16
+#define DCB_MAX_NUM_GPIO_ENTRIES 32
+#define DCB_MAX_NUM_CONNECTOR_ENTRIES 16
+
+#define DCB_LOC_ON_CHIP 0
+
+struct dcb_entry {
+	int index;	/* may not be raw dcb index if merging has happened */
+	uint8_t type;
+	uint8_t i2c_index;
+	uint8_t heads;
+	uint8_t connector;
+	uint8_t bus;
+	uint8_t location;
+	uint8_t or;
+	bool duallink_possible;
+	union {
+		struct sor_conf {
+			int link;
+		} sorconf;
+		struct {
+			int maxfreq;
+		} crtconf;
+		struct {
+			struct sor_conf sor;
+			bool use_straps_for_mode;
+			bool use_power_scripts;
+		} lvdsconf;
+		struct {
+			bool has_component_output;
+		} tvconf;
+		struct {
+			struct sor_conf sor;
+			int link_nr;
+			int link_bw;
+		} dpconf;
+		struct {
+			struct sor_conf sor;
+		} tmdsconf;
+	};
+	bool i2c_upper_default;
+};
+
+struct dcb_i2c_entry {
+	uint8_t port_type;
+	uint8_t read, write;
+	struct nouveau_i2c_chan *chan;
+};
+
+struct parsed_dcb {
+	int entries;
+	struct dcb_entry entry[DCB_MAX_NUM_ENTRIES];
+	struct dcb_i2c_entry i2c[DCB_MAX_NUM_I2C_ENTRIES];
+};
+
+enum dcb_gpio_tag {
+	DCB_GPIO_TVDAC0 = 0xc,
+	DCB_GPIO_TVDAC1 = 0x2d,
+};
+
+struct dcb_gpio_entry {
+	enum dcb_gpio_tag tag;
+	int line;
+	bool invert;
+};
+
+struct parsed_dcb_gpio {
+	int entries;
+	struct dcb_gpio_entry entry[DCB_MAX_NUM_GPIO_ENTRIES];
+};
+
+struct dcb_connector_table_entry {
+	uint32_t entry;
+	uint8_t type;
+	uint8_t index;
+	uint8_t gpio_tag;
+};
+
+struct dcb_connector_table {
+	int entries;
+	struct dcb_connector_table_entry entry[DCB_MAX_NUM_CONNECTOR_ENTRIES];
+};
+
+struct bios_parsed_dcb {
+	uint8_t version;
+
+	struct parsed_dcb dcb;
+
+	uint8_t *i2c_table;
+	uint8_t i2c_default_indices;
+
+	uint16_t gpio_table_ptr;
+	struct parsed_dcb_gpio gpio;
+	uint16_t connector_table_ptr;
+	struct dcb_connector_table connector;
+};
+
+enum nouveau_encoder_type {
+	OUTPUT_ANALOG = 0,
+	OUTPUT_TV = 1,
+	OUTPUT_TMDS = 2,
+	OUTPUT_LVDS = 3,
+	OUTPUT_DP = 6,
+	OUTPUT_ANY = -1
+};
+
+enum nouveau_or {
+	OUTPUT_A = (1 << 0),
+	OUTPUT_B = (1 << 1),
+	OUTPUT_C = (1 << 2)
+};
+
+enum LVDS_script {
+	/* Order *does* matter here */
+	LVDS_INIT = 1,
+	LVDS_RESET,
+	LVDS_BACKLIGHT_ON,
+	LVDS_BACKLIGHT_OFF,
+	LVDS_PANEL_ON,
+	LVDS_PANEL_OFF
+};
+
+/* changing these requires matching changes to reg tables in nv_get_clock */
+#define MAX_PLL_TYPES	4
+enum pll_types {
+	NVPLL,
+	MPLL,
+	VPLL1,
+	VPLL2
+};
+
+struct pll_lims {
+	struct {
+		int minfreq;
+		int maxfreq;
+		int min_inputfreq;
+		int max_inputfreq;
+
+		uint8_t min_m;
+		uint8_t max_m;
+		uint8_t min_n;
+		uint8_t max_n;
+	} vco1, vco2;
+
+	uint8_t max_log2p;
+	/*
+	 * for most pre nv50 cards setting a log2P of 7 (the common max_log2p
+	 * value) is no different to 6 (at least for vplls) so allowing the MNP
+	 * calc to use 7 causes the generated clock to be out by a factor of 2.
+	 * however, max_log2p cannot be fixed-up during parsing as the
+	 * unmodified max_log2p value is still needed for setting mplls, hence
+	 * an additional max_usable_log2p member
+	 */
+	uint8_t max_usable_log2p;
+	uint8_t log2p_bias;
+
+	uint8_t min_p;
+	uint8_t max_p;
+
+	int refclk;
+};
+
+struct nouveau_bios_info {
+	struct parsed_dcb *dcb;
+
+	uint8_t chip_version;
+
+	uint32_t dactestval;
+	uint32_t tvdactestval;
+	uint8_t digital_min_front_porch;
+	bool fp_no_ddc;
+};
+
+struct nvbios {
+	struct drm_device *dev;
+	struct nouveau_bios_info pub;
+
+	uint8_t data[NV_PROM_SIZE];
+	unsigned int length;
+	bool execute;
+
+	uint8_t major_version;
+	uint8_t feature_byte;
+	bool is_mobile;
+
+	uint32_t fmaxvco, fminvco;
+
+	bool old_style_init;
+	uint16_t init_script_tbls_ptr;
+	uint16_t extra_init_script_tbl_ptr;
+	uint16_t macro_index_tbl_ptr;
+	uint16_t macro_tbl_ptr;
+	uint16_t condition_tbl_ptr;
+	uint16_t io_condition_tbl_ptr;
+	uint16_t io_flag_condition_tbl_ptr;
+	uint16_t init_function_tbl_ptr;
+
+	uint16_t pll_limit_tbl_ptr;
+	uint16_t ram_restrict_tbl_ptr;
+	uint8_t ram_restrict_group_count;
+
+	uint16_t some_script_ptr; /* BIT I + 14 */
+	uint16_t init96_tbl_ptr; /* BIT I + 16 */
+
+	struct bios_parsed_dcb bdcb;
+
+	struct {
+		int crtchead;
+		/* these need remembering across suspend */
+		uint32_t saved_nv_pfb_cfg0;
+	} state;
+
+	struct {
+		struct dcb_entry *output;
+		uint16_t script_table_ptr;
+		uint16_t dp_table_ptr;
+	} display;
+
+	struct {
+		uint16_t fptablepointer;	/* also used by tmds */
+		uint16_t fpxlatetableptr;
+		int xlatwidth;
+		uint16_t lvdsmanufacturerpointer;
+		uint16_t fpxlatemanufacturertableptr;
+		uint16_t mode_ptr;
+		uint16_t xlated_entry;
+		bool power_off_for_reset;
+		bool reset_after_pclk_change;
+		bool dual_link;
+		bool link_c_increment;
+		bool BITbit1;
+		bool if_is_24bit;
+		int duallink_transition_clk;
+		uint8_t strapless_is_24bit;
+		uint8_t *edid;
+
+		/* will need resetting after suspend */
+		int last_script_invoc;
+		bool lvds_init_run;
+	} fp;
+
+	struct {
+		uint16_t output0_script_ptr;
+		uint16_t output1_script_ptr;
+	} tmds;
+
+	struct {
+		uint16_t mem_init_tbl_ptr;
+		uint16_t sdr_seq_tbl_ptr;
+		uint16_t ddr_seq_tbl_ptr;
+
+		struct {
+			uint8_t crt, tv, panel;
+		} i2c_indices;
+
+		uint16_t lvds_single_a_script_ptr;
+	} legacy;
+};
+
+#endif
diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c
new file mode 100644
index 000000000000..e342a418d434
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
@@ -0,0 +1,771 @@
+/*
+ * Copyright 2007 Dave Airlied
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * VA LINUX SYSTEMS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ */
+/*
+ * Authors: Dave Airlied <airlied@linux.ie>
+ *	    Ben Skeggs   <darktama@iinet.net.au>
+ *	    Jeremy Kolb  <jkolb@brandeis.edu>
+ */
+
+#include "drmP.h"
+
+#include "nouveau_drm.h"
+#include "nouveau_drv.h"
+#include "nouveau_dma.h"
+
+#include <linux/log2.h>
+
+static void
+nouveau_bo_del_ttm(struct ttm_buffer_object *bo)
+{
+	struct drm_nouveau_private *dev_priv = nouveau_bdev(bo->bdev);
+	struct drm_device *dev = dev_priv->dev;
+	struct nouveau_bo *nvbo = nouveau_bo(bo);
+
+	ttm_bo_kunmap(&nvbo->kmap);
+
+	if (unlikely(nvbo->gem))
+		DRM_ERROR("bo %p still attached to GEM object\n", bo);
+
+	if (nvbo->tile)
+		nv10_mem_expire_tiling(dev, nvbo->tile, NULL);
+
+	spin_lock(&dev_priv->ttm.bo_list_lock);
+	list_del(&nvbo->head);
+	spin_unlock(&dev_priv->ttm.bo_list_lock);
+	kfree(nvbo);
+}
+
+static void
+nouveau_bo_fixup_align(struct drm_device *dev,
+		       uint32_t tile_mode, uint32_t tile_flags,
+		       int *align, int *size)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+
+	/*
+	 * Some of the tile_flags have a periodic structure of N*4096 bytes,
+	 * align to to that as well as the page size. Overallocate memory to
+	 * avoid corruption of other buffer objects.
+	 */
+	if (dev_priv->card_type == NV_50) {
+		uint32_t block_size = nouveau_mem_fb_amount(dev) >> 15;
+		int i;
+
+		switch (tile_flags) {
+		case 0x1800:
+		case 0x2800:
+		case 0x4800:
+		case 0x7a00:
+			*size = roundup(*size, block_size);
+			if (is_power_of_2(block_size)) {
+				*size += 3 * block_size;
+				for (i = 1; i < 10; i++) {
+					*align = 12 * i * block_size;
+					if (!(*align % 65536))
+						break;
+				}
+			} else {
+				*size += 6 * block_size;
+				for (i = 1; i < 10; i++) {
+					*align = 8 * i * block_size;
+					if (!(*align % 65536))
+						break;
+				}
+			}
+			break;
+		default:
+			break;
+		}
+
+	} else {
+		if (tile_mode) {
+			if (dev_priv->chipset >= 0x40) {
+				*align = 65536;
+				*size = roundup(*size, 64 * tile_mode);
+
+			} else if (dev_priv->chipset >= 0x30) {
+				*align = 32768;
+				*size = roundup(*size, 64 * tile_mode);
+
+			} else if (dev_priv->chipset >= 0x20) {
+				*align = 16384;
+				*size = roundup(*size, 64 * tile_mode);
+
+			} else if (dev_priv->chipset >= 0x10) {
+				*align = 16384;
+				*size = roundup(*size, 32 * tile_mode);
+			}
+		}
+	}
+
+	/* ALIGN works only on powers of two. */
+	*size = roundup(*size, PAGE_SIZE);
+
+	if (dev_priv->card_type == NV_50) {
+		*size = roundup(*size, 65536);
+		*align = max(65536, *align);
+	}
+}
+
+int
+nouveau_bo_new(struct drm_device *dev, struct nouveau_channel *chan,
+	       int size, int align, uint32_t flags, uint32_t tile_mode,
+	       uint32_t tile_flags, bool no_vm, bool mappable,
+	       struct nouveau_bo **pnvbo)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_bo *nvbo;
+	int ret = 0;
+
+	nvbo = kzalloc(sizeof(struct nouveau_bo), GFP_KERNEL);
+	if (!nvbo)
+		return -ENOMEM;
+	INIT_LIST_HEAD(&nvbo->head);
+	INIT_LIST_HEAD(&nvbo->entry);
+	nvbo->mappable = mappable;
+	nvbo->no_vm = no_vm;
+	nvbo->tile_mode = tile_mode;
+	nvbo->tile_flags = tile_flags;
+
+	nouveau_bo_fixup_align(dev, tile_mode, tile_flags, &align, &size);
+	align >>= PAGE_SHIFT;
+
+	nvbo->placement.fpfn = 0;
+	nvbo->placement.lpfn = mappable ? dev_priv->fb_mappable_pages : 0;
+	nouveau_bo_placement_set(nvbo, flags);
+
+	nvbo->channel = chan;
+	ret = ttm_bo_init(&dev_priv->ttm.bdev, &nvbo->bo, size,
+			  ttm_bo_type_device, &nvbo->placement, align, 0,
+			  false, NULL, size, nouveau_bo_del_ttm);
+	nvbo->channel = NULL;
+	if (ret) {
+		/* ttm will call nouveau_bo_del_ttm if it fails.. */
+		return ret;
+	}
+
+	spin_lock(&dev_priv->ttm.bo_list_lock);
+	list_add_tail(&nvbo->head, &dev_priv->ttm.bo_list);
+	spin_unlock(&dev_priv->ttm.bo_list_lock);
+	*pnvbo = nvbo;
+	return 0;
+}
+
+void
+nouveau_bo_placement_set(struct nouveau_bo *nvbo, uint32_t memtype)
+{
+	int n = 0;
+
+	if (memtype & TTM_PL_FLAG_VRAM)
+		nvbo->placements[n++] = TTM_PL_FLAG_VRAM | TTM_PL_MASK_CACHING;
+	if (memtype & TTM_PL_FLAG_TT)
+		nvbo->placements[n++] = TTM_PL_FLAG_TT | TTM_PL_MASK_CACHING;
+	if (memtype & TTM_PL_FLAG_SYSTEM)
+		nvbo->placements[n++] = TTM_PL_FLAG_SYSTEM | TTM_PL_MASK_CACHING;
+	nvbo->placement.placement = nvbo->placements;
+	nvbo->placement.busy_placement = nvbo->placements;
+	nvbo->placement.num_placement = n;
+	nvbo->placement.num_busy_placement = n;
+
+	if (nvbo->pin_refcnt) {
+		while (n--)
+			nvbo->placements[n] |= TTM_PL_FLAG_NO_EVICT;
+	}
+}
+
+int
+nouveau_bo_pin(struct nouveau_bo *nvbo, uint32_t memtype)
+{
+	struct drm_nouveau_private *dev_priv = nouveau_bdev(nvbo->bo.bdev);
+	struct ttm_buffer_object *bo = &nvbo->bo;
+	int ret, i;
+
+	if (nvbo->pin_refcnt && !(memtype & (1 << bo->mem.mem_type))) {
+		NV_ERROR(nouveau_bdev(bo->bdev)->dev,
+			 "bo %p pinned elsewhere: 0x%08x vs 0x%08x\n", bo,
+			 1 << bo->mem.mem_type, memtype);
+		return -EINVAL;
+	}
+
+	if (nvbo->pin_refcnt++)
+		return 0;
+
+	ret = ttm_bo_reserve(bo, false, false, false, 0);
+	if (ret)
+		goto out;
+
+	nouveau_bo_placement_set(nvbo, memtype);
+	for (i = 0; i < nvbo->placement.num_placement; i++)
+		nvbo->placements[i] |= TTM_PL_FLAG_NO_EVICT;
+
+	ret = ttm_bo_validate(bo, &nvbo->placement, false, false);
+	if (ret == 0) {
+		switch (bo->mem.mem_type) {
+		case TTM_PL_VRAM:
+			dev_priv->fb_aper_free -= bo->mem.size;
+			break;
+		case TTM_PL_TT:
+			dev_priv->gart_info.aper_free -= bo->mem.size;
+			break;
+		default:
+			break;
+		}
+	}
+	ttm_bo_unreserve(bo);
+out:
+	if (unlikely(ret))
+		nvbo->pin_refcnt--;
+	return ret;
+}
+
+int
+nouveau_bo_unpin(struct nouveau_bo *nvbo)
+{
+	struct drm_nouveau_private *dev_priv = nouveau_bdev(nvbo->bo.bdev);
+	struct ttm_buffer_object *bo = &nvbo->bo;
+	int ret, i;
+
+	if (--nvbo->pin_refcnt)
+		return 0;
+
+	ret = ttm_bo_reserve(bo, false, false, false, 0);
+	if (ret)
+		return ret;
+
+	for (i = 0; i < nvbo->placement.num_placement; i++)
+		nvbo->placements[i] &= ~TTM_PL_FLAG_NO_EVICT;
+
+	ret = ttm_bo_validate(bo, &nvbo->placement, false, false);
+	if (ret == 0) {
+		switch (bo->mem.mem_type) {
+		case TTM_PL_VRAM:
+			dev_priv->fb_aper_free += bo->mem.size;
+			break;
+		case TTM_PL_TT:
+			dev_priv->gart_info.aper_free += bo->mem.size;
+			break;
+		default:
+			break;
+		}
+	}
+
+	ttm_bo_unreserve(bo);
+	return ret;
+}
+
+int
+nouveau_bo_map(struct nouveau_bo *nvbo)
+{
+	int ret;
+
+	ret = ttm_bo_reserve(&nvbo->bo, false, false, false, 0);
+	if (ret)
+		return ret;
+
+	ret = ttm_bo_kmap(&nvbo->bo, 0, nvbo->bo.mem.num_pages, &nvbo->kmap);
+	ttm_bo_unreserve(&nvbo->bo);
+	return ret;
+}
+
+void
+nouveau_bo_unmap(struct nouveau_bo *nvbo)
+{
+	ttm_bo_kunmap(&nvbo->kmap);
+}
+
+u16
+nouveau_bo_rd16(struct nouveau_bo *nvbo, unsigned index)
+{
+	bool is_iomem;
+	u16 *mem = ttm_kmap_obj_virtual(&nvbo->kmap, &is_iomem);
+	mem = &mem[index];
+	if (is_iomem)
+		return ioread16_native((void __force __iomem *)mem);
+	else
+		return *mem;
+}
+
+void
+nouveau_bo_wr16(struct nouveau_bo *nvbo, unsigned index, u16 val)
+{
+	bool is_iomem;
+	u16 *mem = ttm_kmap_obj_virtual(&nvbo->kmap, &is_iomem);
+	mem = &mem[index];
+	if (is_iomem)
+		iowrite16_native(val, (void __force __iomem *)mem);
+	else
+		*mem = val;
+}
+
+u32
+nouveau_bo_rd32(struct nouveau_bo *nvbo, unsigned index)
+{
+	bool is_iomem;
+	u32 *mem = ttm_kmap_obj_virtual(&nvbo->kmap, &is_iomem);
+	mem = &mem[index];
+	if (is_iomem)
+		return ioread32_native((void __force __iomem *)mem);
+	else
+		return *mem;
+}
+
+void
+nouveau_bo_wr32(struct nouveau_bo *nvbo, unsigned index, u32 val)
+{
+	bool is_iomem;
+	u32 *mem = ttm_kmap_obj_virtual(&nvbo->kmap, &is_iomem);
+	mem = &mem[index];
+	if (is_iomem)
+		iowrite32_native(val, (void __force __iomem *)mem);
+	else
+		*mem = val;
+}
+
+static struct ttm_backend *
+nouveau_bo_create_ttm_backend_entry(struct ttm_bo_device *bdev)
+{
+	struct drm_nouveau_private *dev_priv = nouveau_bdev(bdev);
+	struct drm_device *dev = dev_priv->dev;
+
+	switch (dev_priv->gart_info.type) {
+#if __OS_HAS_AGP
+	case NOUVEAU_GART_AGP:
+		return ttm_agp_backend_init(bdev, dev->agp->bridge);
+#endif
+	case NOUVEAU_GART_SGDMA:
+		return nouveau_sgdma_init_ttm(dev);
+	default:
+		NV_ERROR(dev, "Unknown GART type %d\n",
+			 dev_priv->gart_info.type);
+		break;
+	}
+
+	return NULL;
+}
+
+static int
+nouveau_bo_invalidate_caches(struct ttm_bo_device *bdev, uint32_t flags)
+{
+	/* We'll do this from user space. */
+	return 0;
+}
+
+static int
+nouveau_bo_init_mem_type(struct ttm_bo_device *bdev, uint32_t type,
+			 struct ttm_mem_type_manager *man)
+{
+	struct drm_nouveau_private *dev_priv = nouveau_bdev(bdev);
+	struct drm_device *dev = dev_priv->dev;
+
+	switch (type) {
+	case TTM_PL_SYSTEM:
+		man->flags = TTM_MEMTYPE_FLAG_MAPPABLE;
+		man->available_caching = TTM_PL_MASK_CACHING;
+		man->default_caching = TTM_PL_FLAG_CACHED;
+		break;
+	case TTM_PL_VRAM:
+		man->flags = TTM_MEMTYPE_FLAG_FIXED |
+			     TTM_MEMTYPE_FLAG_MAPPABLE |
+			     TTM_MEMTYPE_FLAG_NEEDS_IOREMAP;
+		man->available_caching = TTM_PL_FLAG_UNCACHED |
+					 TTM_PL_FLAG_WC;
+		man->default_caching = TTM_PL_FLAG_WC;
+
+		man->io_addr = NULL;
+		man->io_offset = drm_get_resource_start(dev, 1);
+		man->io_size = drm_get_resource_len(dev, 1);
+		if (man->io_size > nouveau_mem_fb_amount(dev))
+			man->io_size = nouveau_mem_fb_amount(dev);
+
+		man->gpu_offset = dev_priv->vm_vram_base;
+		break;
+	case TTM_PL_TT:
+		switch (dev_priv->gart_info.type) {
+		case NOUVEAU_GART_AGP:
+			man->flags = TTM_MEMTYPE_FLAG_MAPPABLE |
+				     TTM_MEMTYPE_FLAG_NEEDS_IOREMAP;
+			man->available_caching = TTM_PL_FLAG_UNCACHED;
+			man->default_caching = TTM_PL_FLAG_UNCACHED;
+			break;
+		case NOUVEAU_GART_SGDMA:
+			man->flags = TTM_MEMTYPE_FLAG_MAPPABLE |
+				     TTM_MEMTYPE_FLAG_CMA;
+			man->available_caching = TTM_PL_MASK_CACHING;
+			man->default_caching = TTM_PL_FLAG_CACHED;
+			break;
+		default:
+			NV_ERROR(dev, "Unknown GART type: %d\n",
+				 dev_priv->gart_info.type);
+			return -EINVAL;
+		}
+
+		man->io_offset  = dev_priv->gart_info.aper_base;
+		man->io_size    = dev_priv->gart_info.aper_size;
+		man->io_addr   = NULL;
+		man->gpu_offset = dev_priv->vm_gart_base;
+		break;
+	default:
+		NV_ERROR(dev, "Unsupported memory type %u\n", (unsigned)type);
+		return -EINVAL;
+	}
+	return 0;
+}
+
+static void
+nouveau_bo_evict_flags(struct ttm_buffer_object *bo, struct ttm_placement *pl)
+{
+	struct nouveau_bo *nvbo = nouveau_bo(bo);
+
+	switch (bo->mem.mem_type) {
+	case TTM_PL_VRAM:
+		nouveau_bo_placement_set(nvbo, TTM_PL_FLAG_TT |
+					 TTM_PL_FLAG_SYSTEM);
+		break;
+	default:
+		nouveau_bo_placement_set(nvbo, TTM_PL_FLAG_SYSTEM);
+		break;
+	}
+
+	*pl = nvbo->placement;
+}
+
+
+/* GPU-assisted copy using NV_MEMORY_TO_MEMORY_FORMAT, can access
+ * TTM_PL_{VRAM,TT} directly.
+ */
+
+static int
+nouveau_bo_move_accel_cleanup(struct nouveau_channel *chan,
+			      struct nouveau_bo *nvbo, bool evict, bool no_wait,
+			      struct ttm_mem_reg *new_mem)
+{
+	struct nouveau_fence *fence = NULL;
+	int ret;
+
+	ret = nouveau_fence_new(chan, &fence, true);
+	if (ret)
+		return ret;
+
+	ret = ttm_bo_move_accel_cleanup(&nvbo->bo, fence, NULL,
+					evict, no_wait, new_mem);
+	nouveau_fence_unref((void *)&fence);
+	return ret;
+}
+
+static inline uint32_t
+nouveau_bo_mem_ctxdma(struct nouveau_bo *nvbo, struct nouveau_channel *chan,
+		      struct ttm_mem_reg *mem)
+{
+	if (chan == nouveau_bdev(nvbo->bo.bdev)->channel) {
+		if (mem->mem_type == TTM_PL_TT)
+			return NvDmaGART;
+		return NvDmaVRAM;
+	}
+
+	if (mem->mem_type == TTM_PL_TT)
+		return chan->gart_handle;
+	return chan->vram_handle;
+}
+
+static int
+nouveau_bo_move_m2mf(struct ttm_buffer_object *bo, int evict, bool intr,
+		     int no_wait, struct ttm_mem_reg *new_mem)
+{
+	struct nouveau_bo *nvbo = nouveau_bo(bo);
+	struct drm_nouveau_private *dev_priv = nouveau_bdev(bo->bdev);
+	struct ttm_mem_reg *old_mem = &bo->mem;
+	struct nouveau_channel *chan;
+	uint64_t src_offset, dst_offset;
+	uint32_t page_count;
+	int ret;
+
+	chan = nvbo->channel;
+	if (!chan || nvbo->tile_flags || nvbo->no_vm)
+		chan = dev_priv->channel;
+
+	src_offset = old_mem->mm_node->start << PAGE_SHIFT;
+	dst_offset = new_mem->mm_node->start << PAGE_SHIFT;
+	if (chan != dev_priv->channel) {
+		if (old_mem->mem_type == TTM_PL_TT)
+			src_offset += dev_priv->vm_gart_base;
+		else
+			src_offset += dev_priv->vm_vram_base;
+
+		if (new_mem->mem_type == TTM_PL_TT)
+			dst_offset += dev_priv->vm_gart_base;
+		else
+			dst_offset += dev_priv->vm_vram_base;
+	}
+
+	ret = RING_SPACE(chan, 3);
+	if (ret)
+		return ret;
+	BEGIN_RING(chan, NvSubM2MF, NV_MEMORY_TO_MEMORY_FORMAT_DMA_SOURCE, 2);
+	OUT_RING(chan, nouveau_bo_mem_ctxdma(nvbo, chan, old_mem));
+	OUT_RING(chan, nouveau_bo_mem_ctxdma(nvbo, chan, new_mem));
+
+	if (dev_priv->card_type >= NV_50) {
+		ret = RING_SPACE(chan, 4);
+		if (ret)
+			return ret;
+		BEGIN_RING(chan, NvSubM2MF, 0x0200, 1);
+		OUT_RING(chan, 1);
+		BEGIN_RING(chan, NvSubM2MF, 0x021c, 1);
+		OUT_RING(chan, 1);
+	}
+
+	page_count = new_mem->num_pages;
+	while (page_count) {
+		int line_count = (page_count > 2047) ? 2047 : page_count;
+
+		if (dev_priv->card_type >= NV_50) {
+			ret = RING_SPACE(chan, 3);
+			if (ret)
+				return ret;
+			BEGIN_RING(chan, NvSubM2MF, 0x0238, 2);
+			OUT_RING(chan, upper_32_bits(src_offset));
+			OUT_RING(chan, upper_32_bits(dst_offset));
+		}
+		ret = RING_SPACE(chan, 11);
+		if (ret)
+			return ret;
+		BEGIN_RING(chan, NvSubM2MF,
+				 NV_MEMORY_TO_MEMORY_FORMAT_OFFSET_IN, 8);
+		OUT_RING(chan, lower_32_bits(src_offset));
+		OUT_RING(chan, lower_32_bits(dst_offset));
+		OUT_RING(chan, PAGE_SIZE); /* src_pitch */
+		OUT_RING(chan, PAGE_SIZE); /* dst_pitch */
+		OUT_RING(chan, PAGE_SIZE); /* line_length */
+		OUT_RING(chan, line_count);
+		OUT_RING(chan, (1<<8)|(1<<0));
+		OUT_RING(chan, 0);
+		BEGIN_RING(chan, NvSubM2MF, NV_MEMORY_TO_MEMORY_FORMAT_NOP, 1);
+		OUT_RING(chan, 0);
+
+		page_count -= line_count;
+		src_offset += (PAGE_SIZE * line_count);
+		dst_offset += (PAGE_SIZE * line_count);
+	}
+
+	return nouveau_bo_move_accel_cleanup(chan, nvbo, evict, no_wait, new_mem);
+}
+
+static int
+nouveau_bo_move_flipd(struct ttm_buffer_object *bo, bool evict, bool intr,
+		      bool no_wait, struct ttm_mem_reg *new_mem)
+{
+	u32 placement_memtype = TTM_PL_FLAG_TT | TTM_PL_MASK_CACHING;
+	struct ttm_placement placement;
+	struct ttm_mem_reg tmp_mem;
+	int ret;
+
+	placement.fpfn = placement.lpfn = 0;
+	placement.num_placement = placement.num_busy_placement = 1;
+	placement.placement = placement.busy_placement = &placement_memtype;
+
+	tmp_mem = *new_mem;
+	tmp_mem.mm_node = NULL;
+	ret = ttm_bo_mem_space(bo, &placement, &tmp_mem, intr, no_wait);
+	if (ret)
+		return ret;
+
+	ret = ttm_tt_bind(bo->ttm, &tmp_mem);
+	if (ret)
+		goto out;
+
+	ret = nouveau_bo_move_m2mf(bo, true, intr, no_wait, &tmp_mem);
+	if (ret)
+		goto out;
+
+	ret = ttm_bo_move_ttm(bo, evict, no_wait, new_mem);
+out:
+	if (tmp_mem.mm_node) {
+		spin_lock(&bo->bdev->glob->lru_lock);
+		drm_mm_put_block(tmp_mem.mm_node);
+		spin_unlock(&bo->bdev->glob->lru_lock);
+	}
+
+	return ret;
+}
+
+static int
+nouveau_bo_move_flips(struct ttm_buffer_object *bo, bool evict, bool intr,
+		      bool no_wait, struct ttm_mem_reg *new_mem)
+{
+	u32 placement_memtype = TTM_PL_FLAG_TT | TTM_PL_MASK_CACHING;
+	struct ttm_placement placement;
+	struct ttm_mem_reg tmp_mem;
+	int ret;
+
+	placement.fpfn = placement.lpfn = 0;
+	placement.num_placement = placement.num_busy_placement = 1;
+	placement.placement = placement.busy_placement = &placement_memtype;
+
+	tmp_mem = *new_mem;
+	tmp_mem.mm_node = NULL;
+	ret = ttm_bo_mem_space(bo, &placement, &tmp_mem, intr, no_wait);
+	if (ret)
+		return ret;
+
+	ret = ttm_bo_move_ttm(bo, evict, no_wait, &tmp_mem);
+	if (ret)
+		goto out;
+
+	ret = nouveau_bo_move_m2mf(bo, evict, intr, no_wait, new_mem);
+	if (ret)
+		goto out;
+
+out:
+	if (tmp_mem.mm_node) {
+		spin_lock(&bo->bdev->glob->lru_lock);
+		drm_mm_put_block(tmp_mem.mm_node);
+		spin_unlock(&bo->bdev->glob->lru_lock);
+	}
+
+	return ret;
+}
+
+static int
+nouveau_bo_vm_bind(struct ttm_buffer_object *bo, struct ttm_mem_reg *new_mem,
+		   struct nouveau_tile_reg **new_tile)
+{
+	struct drm_nouveau_private *dev_priv = nouveau_bdev(bo->bdev);
+	struct drm_device *dev = dev_priv->dev;
+	struct nouveau_bo *nvbo = nouveau_bo(bo);
+	uint64_t offset;
+	int ret;
+
+	if (nvbo->no_vm || new_mem->mem_type != TTM_PL_VRAM) {
+		/* Nothing to do. */
+		*new_tile = NULL;
+		return 0;
+	}
+
+	offset = new_mem->mm_node->start << PAGE_SHIFT;
+
+	if (dev_priv->card_type == NV_50) {
+		ret = nv50_mem_vm_bind_linear(dev,
+					      offset + dev_priv->vm_vram_base,
+					      new_mem->size, nvbo->tile_flags,
+					      offset);
+		if (ret)
+			return ret;
+
+	} else if (dev_priv->card_type >= NV_10) {
+		*new_tile = nv10_mem_set_tiling(dev, offset, new_mem->size,
+						nvbo->tile_mode);
+	}
+
+	return 0;
+}
+
+static void
+nouveau_bo_vm_cleanup(struct ttm_buffer_object *bo,
+		      struct nouveau_tile_reg *new_tile,
+		      struct nouveau_tile_reg **old_tile)
+{
+	struct drm_nouveau_private *dev_priv = nouveau_bdev(bo->bdev);
+	struct drm_device *dev = dev_priv->dev;
+
+	if (dev_priv->card_type >= NV_10 &&
+	    dev_priv->card_type < NV_50) {
+		if (*old_tile)
+			nv10_mem_expire_tiling(dev, *old_tile, bo->sync_obj);
+
+		*old_tile = new_tile;
+	}
+}
+
+static int
+nouveau_bo_move(struct ttm_buffer_object *bo, bool evict, bool intr,
+		bool no_wait, struct ttm_mem_reg *new_mem)
+{
+	struct drm_nouveau_private *dev_priv = nouveau_bdev(bo->bdev);
+	struct nouveau_bo *nvbo = nouveau_bo(bo);
+	struct ttm_mem_reg *old_mem = &bo->mem;
+	struct nouveau_tile_reg *new_tile = NULL;
+	int ret = 0;
+
+	ret = nouveau_bo_vm_bind(bo, new_mem, &new_tile);
+	if (ret)
+		return ret;
+
+	/* Software copy if the card isn't up and running yet. */
+	if (dev_priv->init_state != NOUVEAU_CARD_INIT_DONE ||
+	    !dev_priv->channel) {
+		ret = ttm_bo_move_memcpy(bo, evict, no_wait, new_mem);
+		goto out;
+	}
+
+	/* Fake bo copy. */
+	if (old_mem->mem_type == TTM_PL_SYSTEM && !bo->ttm) {
+		BUG_ON(bo->mem.mm_node != NULL);
+		bo->mem = *new_mem;
+		new_mem->mm_node = NULL;
+		goto out;
+	}
+
+	/* Hardware assisted copy. */
+	if (new_mem->mem_type == TTM_PL_SYSTEM)
+		ret = nouveau_bo_move_flipd(bo, evict, intr, no_wait, new_mem);
+	else if (old_mem->mem_type == TTM_PL_SYSTEM)
+		ret = nouveau_bo_move_flips(bo, evict, intr, no_wait, new_mem);
+	else
+		ret = nouveau_bo_move_m2mf(bo, evict, intr, no_wait, new_mem);
+
+	if (!ret)
+		goto out;
+
+	/* Fallback to software copy. */
+	ret = ttm_bo_move_memcpy(bo, evict, no_wait, new_mem);
+
+out:
+	if (ret)
+		nouveau_bo_vm_cleanup(bo, NULL, &new_tile);
+	else
+		nouveau_bo_vm_cleanup(bo, new_tile, &nvbo->tile);
+
+	return ret;
+}
+
+static int
+nouveau_bo_verify_access(struct ttm_buffer_object *bo, struct file *filp)
+{
+	return 0;
+}
+
+struct ttm_bo_driver nouveau_bo_driver = {
+	.create_ttm_backend_entry = nouveau_bo_create_ttm_backend_entry,
+	.invalidate_caches = nouveau_bo_invalidate_caches,
+	.init_mem_type = nouveau_bo_init_mem_type,
+	.evict_flags = nouveau_bo_evict_flags,
+	.move = nouveau_bo_move,
+	.verify_access = nouveau_bo_verify_access,
+	.sync_obj_signaled = nouveau_fence_signalled,
+	.sync_obj_wait = nouveau_fence_wait,
+	.sync_obj_flush = nouveau_fence_flush,
+	.sync_obj_unref = nouveau_fence_unref,
+	.sync_obj_ref = nouveau_fence_ref,
+};
+
diff --git a/drivers/gpu/drm/nouveau/nouveau_calc.c b/drivers/gpu/drm/nouveau/nouveau_calc.c
new file mode 100644
index 000000000000..ee2b84504d05
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nouveau_calc.c
@@ -0,0 +1,478 @@
+/*
+ * Copyright 1993-2003 NVIDIA, Corporation
+ * Copyright 2007-2009 Stuart Bennett
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+ * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF
+ * OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#include "drmP.h"
+#include "nouveau_drv.h"
+#include "nouveau_hw.h"
+
+/****************************************************************************\
+*                                                                            *
+* The video arbitration routines calculate some "magic" numbers.  Fixes      *
+* the snow seen when accessing the framebuffer without it.                   *
+* It just works (I hope).                                                    *
+*                                                                            *
+\****************************************************************************/
+
+struct nv_fifo_info {
+	int lwm;
+	int burst;
+};
+
+struct nv_sim_state {
+	int pclk_khz;
+	int mclk_khz;
+	int nvclk_khz;
+	int bpp;
+	int mem_page_miss;
+	int mem_latency;
+	int memory_type;
+	int memory_width;
+	int two_heads;
+};
+
+static void
+nv04_calc_arb(struct nv_fifo_info *fifo, struct nv_sim_state *arb)
+{
+	int pagemiss, cas, width, bpp;
+	int nvclks, mclks, pclks, crtpagemiss;
+	int found, mclk_extra, mclk_loop, cbs, m1, p1;
+	int mclk_freq, pclk_freq, nvclk_freq;
+	int us_m, us_n, us_p, crtc_drain_rate;
+	int cpm_us, us_crt, clwm;
+
+	pclk_freq = arb->pclk_khz;
+	mclk_freq = arb->mclk_khz;
+	nvclk_freq = arb->nvclk_khz;
+	pagemiss = arb->mem_page_miss;
+	cas = arb->mem_latency;
+	width = arb->memory_width >> 6;
+	bpp = arb->bpp;
+	cbs = 128;
+
+	pclks = 2;
+	nvclks = 10;
+	mclks = 13 + cas;
+	mclk_extra = 3;
+	found = 0;
+
+	while (!found) {
+		found = 1;
+
+		mclk_loop = mclks + mclk_extra;
+		us_m = mclk_loop * 1000 * 1000 / mclk_freq;
+		us_n = nvclks * 1000 * 1000 / nvclk_freq;
+		us_p = nvclks * 1000 * 1000 / pclk_freq;
+
+		crtc_drain_rate = pclk_freq * bpp / 8;
+		crtpagemiss = 2;
+		crtpagemiss += 1;
+		cpm_us = crtpagemiss * pagemiss * 1000 * 1000 / mclk_freq;
+		us_crt = cpm_us + us_m + us_n + us_p;
+		clwm = us_crt * crtc_drain_rate / (1000 * 1000);
+		clwm++;
+
+		m1 = clwm + cbs - 512;
+		p1 = m1 * pclk_freq / mclk_freq;
+		p1 = p1 * bpp / 8;
+		if ((p1 < m1 && m1 > 0) || clwm > 519) {
+			found = !mclk_extra;
+			mclk_extra--;
+		}
+		if (clwm < 384)
+			clwm = 384;
+
+		fifo->lwm = clwm;
+		fifo->burst = cbs;
+	}
+}
+
+static void
+nv10_calc_arb(struct nv_fifo_info *fifo, struct nv_sim_state *arb)
+{
+	int fill_rate, drain_rate;
+	int pclks, nvclks, mclks, xclks;
+	int pclk_freq, nvclk_freq, mclk_freq;
+	int fill_lat, extra_lat;
+	int max_burst_o, max_burst_l;
+	int fifo_len, min_lwm, max_lwm;
+	const int burst_lat = 80; /* Maximum allowable latency due
+				   * to the CRTC FIFO burst. (ns) */
+
+	pclk_freq = arb->pclk_khz;
+	nvclk_freq = arb->nvclk_khz;
+	mclk_freq = arb->mclk_khz;
+
+	fill_rate = mclk_freq * arb->memory_width / 8; /* kB/s */
+	drain_rate = pclk_freq * arb->bpp / 8; /* kB/s */
+
+	fifo_len = arb->two_heads ? 1536 : 1024; /* B */
+
+	/* Fixed FIFO refill latency. */
+
+	pclks = 4;	/* lwm detect. */
+
+	nvclks = 3	/* lwm -> sync. */
+		+ 2	/* fbi bus cycles (1 req + 1 busy) */
+		+ 1	/* 2 edge sync.  may be very close to edge so
+			 * just put one. */
+		+ 1	/* fbi_d_rdv_n */
+		+ 1	/* Fbi_d_rdata */
+		+ 1;	/* crtfifo load */
+
+	mclks = 1	/* 2 edge sync.  may be very close to edge so
+			 * just put one. */
+		+ 1	/* arb_hp_req */
+		+ 5	/* tiling pipeline */
+		+ 2	/* latency fifo */
+		+ 2	/* memory request to fbio block */
+		+ 7;	/* data returned from fbio block */
+
+	/* Need to accumulate 256 bits for read */
+	mclks += (arb->memory_type == 0 ? 2 : 1)
+		* arb->memory_width / 32;
+
+	fill_lat = mclks * 1000 * 1000 / mclk_freq   /* minimum mclk latency */
+		+ nvclks * 1000 * 1000 / nvclk_freq  /* nvclk latency */
+		+ pclks * 1000 * 1000 / pclk_freq;   /* pclk latency */
+
+	/* Conditional FIFO refill latency. */
+
+	xclks = 2 * arb->mem_page_miss + mclks /* Extra latency due to
+						* the overlay. */
+		+ 2 * arb->mem_page_miss       /* Extra pagemiss latency. */
+		+ (arb->bpp == 32 ? 8 : 4);    /* Margin of error. */
+
+	extra_lat = xclks * 1000 * 1000 / mclk_freq;
+
+	if (arb->two_heads)
+		/* Account for another CRTC. */
+		extra_lat += fill_lat + extra_lat + burst_lat;
+
+	/* FIFO burst */
+
+	/* Max burst not leading to overflows. */
+	max_burst_o = (1 + fifo_len - extra_lat * drain_rate / (1000 * 1000))
+		* (fill_rate / 1000) / ((fill_rate - drain_rate) / 1000);
+	fifo->burst = min(max_burst_o, 1024);
+
+	/* Max burst value with an acceptable latency. */
+	max_burst_l = burst_lat * fill_rate / (1000 * 1000);
+	fifo->burst = min(max_burst_l, fifo->burst);
+
+	fifo->burst = rounddown_pow_of_two(fifo->burst);
+
+	/* FIFO low watermark */
+
+	min_lwm = (fill_lat + extra_lat) * drain_rate / (1000 * 1000) + 1;
+	max_lwm = fifo_len - fifo->burst
+		+ fill_lat * drain_rate / (1000 * 1000)
+		+ fifo->burst * drain_rate / fill_rate;
+
+	fifo->lwm = min_lwm + 10 * (max_lwm - min_lwm) / 100; /* Empirical. */
+}
+
+static void
+nv04_update_arb(struct drm_device *dev, int VClk, int bpp,
+		int *burst, int *lwm)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nv_fifo_info fifo_data;
+	struct nv_sim_state sim_data;
+	int MClk = nouveau_hw_get_clock(dev, MPLL);
+	int NVClk = nouveau_hw_get_clock(dev, NVPLL);
+	uint32_t cfg1 = nvReadFB(dev, NV_PFB_CFG1);
+
+	sim_data.pclk_khz = VClk;
+	sim_data.mclk_khz = MClk;
+	sim_data.nvclk_khz = NVClk;
+	sim_data.bpp = bpp;
+	sim_data.two_heads = nv_two_heads(dev);
+	if ((dev->pci_device & 0xffff) == 0x01a0 /*CHIPSET_NFORCE*/ ||
+	    (dev->pci_device & 0xffff) == 0x01f0 /*CHIPSET_NFORCE2*/) {
+		uint32_t type;
+
+		pci_read_config_dword(pci_get_bus_and_slot(0, 1), 0x7c, &type);
+
+		sim_data.memory_type = (type >> 12) & 1;
+		sim_data.memory_width = 64;
+		sim_data.mem_latency = 3;
+		sim_data.mem_page_miss = 10;
+	} else {
+		sim_data.memory_type = nvReadFB(dev, NV_PFB_CFG0) & 0x1;
+		sim_data.memory_width = (nvReadEXTDEV(dev, NV_PEXTDEV_BOOT_0) & 0x10) ? 128 : 64;
+		sim_data.mem_latency = cfg1 & 0xf;
+		sim_data.mem_page_miss = ((cfg1 >> 4) & 0xf) + ((cfg1 >> 31) & 0x1);
+	}
+
+	if (dev_priv->card_type == NV_04)
+		nv04_calc_arb(&fifo_data, &sim_data);
+	else
+		nv10_calc_arb(&fifo_data, &sim_data);
+
+	*burst = ilog2(fifo_data.burst >> 4);
+	*lwm = fifo_data.lwm >> 3;
+}
+
+static void
+nv30_update_arb(int *burst, int *lwm)
+{
+	unsigned int fifo_size, burst_size, graphics_lwm;
+
+	fifo_size = 2048;
+	burst_size = 512;
+	graphics_lwm = fifo_size - burst_size;
+
+	*burst = ilog2(burst_size >> 5);
+	*lwm = graphics_lwm >> 3;
+}
+
+void
+nouveau_calc_arb(struct drm_device *dev, int vclk, int bpp, int *burst, int *lwm)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+
+	if (dev_priv->card_type < NV_30)
+		nv04_update_arb(dev, vclk, bpp, burst, lwm);
+	else if ((dev->pci_device & 0xfff0) == 0x0240 /*CHIPSET_C51*/ ||
+		 (dev->pci_device & 0xfff0) == 0x03d0 /*CHIPSET_C512*/) {
+		*burst = 128;
+		*lwm = 0x0480;
+	} else
+		nv30_update_arb(burst, lwm);
+}
+
+static int
+getMNP_single(struct drm_device *dev, struct pll_lims *pll_lim, int clk,
+	      struct nouveau_pll_vals *bestpv)
+{
+	/* Find M, N and P for a single stage PLL
+	 *
+	 * Note that some bioses (NV3x) have lookup tables of precomputed MNP
+	 * values, but we're too lazy to use those atm
+	 *
+	 * "clk" parameter in kHz
+	 * returns calculated clock
+	 */
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	int cv = dev_priv->vbios->chip_version;
+	int minvco = pll_lim->vco1.minfreq, maxvco = pll_lim->vco1.maxfreq;
+	int minM = pll_lim->vco1.min_m, maxM = pll_lim->vco1.max_m;
+	int minN = pll_lim->vco1.min_n, maxN = pll_lim->vco1.max_n;
+	int minU = pll_lim->vco1.min_inputfreq;
+	int maxU = pll_lim->vco1.max_inputfreq;
+	int minP = pll_lim->max_p ? pll_lim->min_p : 0;
+	int maxP = pll_lim->max_p ? pll_lim->max_p : pll_lim->max_usable_log2p;
+	int crystal = pll_lim->refclk;
+	int M, N, thisP, P;
+	int clkP, calcclk;
+	int delta, bestdelta = INT_MAX;
+	int bestclk = 0;
+
+	/* this division verified for nv20, nv18, nv28 (Haiku), and nv34 */
+	/* possibly correlated with introduction of 27MHz crystal */
+	if (dev_priv->card_type < NV_50) {
+		if (cv < 0x17 || cv == 0x1a || cv == 0x20) {
+			if (clk > 250000)
+				maxM = 6;
+			if (clk > 340000)
+				maxM = 2;
+		} else if (cv < 0x40) {
+			if (clk > 150000)
+				maxM = 6;
+			if (clk > 200000)
+				maxM = 4;
+			if (clk > 340000)
+				maxM = 2;
+		}
+	}
+
+	P = pll_lim->max_p ? maxP : (1 << maxP);
+	if ((clk * P) < minvco) {
+		minvco = clk * maxP;
+		maxvco = minvco * 2;
+	}
+
+	if (clk + clk/200 > maxvco)	/* +0.5% */
+		maxvco = clk + clk/200;
+
+	/* NV34 goes maxlog2P->0, NV20 goes 0->maxlog2P */
+	for (thisP = minP; thisP <= maxP; thisP++) {
+		P = pll_lim->max_p ? thisP : (1 << thisP);
+		clkP = clk * P;
+
+		if (clkP < minvco)
+			continue;
+		if (clkP > maxvco)
+			return bestclk;
+
+		for (M = minM; M <= maxM; M++) {
+			if (crystal/M < minU)
+				return bestclk;
+			if (crystal/M > maxU)
+				continue;
+
+			/* add crystal/2 to round better */
+			N = (clkP * M + crystal/2) / crystal;
+
+			if (N < minN)
+				continue;
+			if (N > maxN)
+				break;
+
+			/* more rounding additions */
+			calcclk = ((N * crystal + P/2) / P + M/2) / M;
+			delta = abs(calcclk - clk);
+			/* we do an exhaustive search rather than terminating
+			 * on an optimality condition...
+			 */
+			if (delta < bestdelta) {
+				bestdelta = delta;
+				bestclk = calcclk;
+				bestpv->N1 = N;
+				bestpv->M1 = M;
+				bestpv->log2P = thisP;
+				if (delta == 0)	/* except this one */
+					return bestclk;
+			}
+		}
+	}
+
+	return bestclk;
+}
+
+static int
+getMNP_double(struct drm_device *dev, struct pll_lims *pll_lim, int clk,
+	      struct nouveau_pll_vals *bestpv)
+{
+	/* Find M, N and P for a two stage PLL
+	 *
+	 * Note that some bioses (NV30+) have lookup tables of precomputed MNP
+	 * values, but we're too lazy to use those atm
+	 *
+	 * "clk" parameter in kHz
+	 * returns calculated clock
+	 */
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	int chip_version = dev_priv->vbios->chip_version;
+	int minvco1 = pll_lim->vco1.minfreq, maxvco1 = pll_lim->vco1.maxfreq;
+	int minvco2 = pll_lim->vco2.minfreq, maxvco2 = pll_lim->vco2.maxfreq;
+	int minU1 = pll_lim->vco1.min_inputfreq, minU2 = pll_lim->vco2.min_inputfreq;
+	int maxU1 = pll_lim->vco1.max_inputfreq, maxU2 = pll_lim->vco2.max_inputfreq;
+	int minM1 = pll_lim->vco1.min_m, maxM1 = pll_lim->vco1.max_m;
+	int minN1 = pll_lim->vco1.min_n, maxN1 = pll_lim->vco1.max_n;
+	int minM2 = pll_lim->vco2.min_m, maxM2 = pll_lim->vco2.max_m;
+	int minN2 = pll_lim->vco2.min_n, maxN2 = pll_lim->vco2.max_n;
+	int maxlog2P = pll_lim->max_usable_log2p;
+	int crystal = pll_lim->refclk;
+	bool fixedgain2 = (minM2 == maxM2 && minN2 == maxN2);
+	int M1, N1, M2, N2, log2P;
+	int clkP, calcclk1, calcclk2, calcclkout;
+	int delta, bestdelta = INT_MAX;
+	int bestclk = 0;
+
+	int vco2 = (maxvco2 - maxvco2/200) / 2;
+	for (log2P = 0; clk && log2P < maxlog2P && clk <= (vco2 >> log2P); log2P++)
+		;
+	clkP = clk << log2P;
+
+	if (maxvco2 < clk + clk/200)	/* +0.5% */
+		maxvco2 = clk + clk/200;
+
+	for (M1 = minM1; M1 <= maxM1; M1++) {
+		if (crystal/M1 < minU1)
+			return bestclk;
+		if (crystal/M1 > maxU1)
+			continue;
+
+		for (N1 = minN1; N1 <= maxN1; N1++) {
+			calcclk1 = crystal * N1 / M1;
+			if (calcclk1 < minvco1)
+				continue;
+			if (calcclk1 > maxvco1)
+				break;
+
+			for (M2 = minM2; M2 <= maxM2; M2++) {
+				if (calcclk1/M2 < minU2)
+					break;
+				if (calcclk1/M2 > maxU2)
+					continue;
+
+				/* add calcclk1/2 to round better */
+				N2 = (clkP * M2 + calcclk1/2) / calcclk1;
+				if (N2 < minN2)
+					continue;
+				if (N2 > maxN2)
+					break;
+
+				if (!fixedgain2) {
+					if (chip_version < 0x60)
+						if (N2/M2 < 4 || N2/M2 > 10)
+							continue;
+
+					calcclk2 = calcclk1 * N2 / M2;
+					if (calcclk2 < minvco2)
+						break;
+					if (calcclk2 > maxvco2)
+						continue;
+				} else
+					calcclk2 = calcclk1;
+
+				calcclkout = calcclk2 >> log2P;
+				delta = abs(calcclkout - clk);
+				/* we do an exhaustive search rather than terminating
+				 * on an optimality condition...
+				 */
+				if (delta < bestdelta) {
+					bestdelta = delta;
+					bestclk = calcclkout;
+					bestpv->N1 = N1;
+					bestpv->M1 = M1;
+					bestpv->N2 = N2;
+					bestpv->M2 = M2;
+					bestpv->log2P = log2P;
+					if (delta == 0)	/* except this one */
+						return bestclk;
+				}
+			}
+		}
+	}
+
+	return bestclk;
+}
+
+int
+nouveau_calc_pll_mnp(struct drm_device *dev, struct pll_lims *pll_lim, int clk,
+		     struct nouveau_pll_vals *pv)
+{
+	int outclk;
+
+	if (!pll_lim->vco2.maxfreq)
+		outclk = getMNP_single(dev, pll_lim, clk, pv);
+	else
+		outclk = getMNP_double(dev, pll_lim, clk, pv);
+
+	if (!outclk)
+		NV_ERROR(dev, "Could not find a compatible set of PLL values\n");
+
+	return outclk;
+}
diff --git a/drivers/gpu/drm/nouveau/nouveau_channel.c b/drivers/gpu/drm/nouveau/nouveau_channel.c
new file mode 100644
index 000000000000..343d718a9667
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nouveau_channel.c
@@ -0,0 +1,431 @@
+/*
+ * Copyright 2005-2006 Stephane Marchesin
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * PRECISION INSIGHT AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ */
+
+#include "drmP.h"
+#include "drm.h"
+#include "nouveau_drv.h"
+#include "nouveau_drm.h"
+#include "nouveau_dma.h"
+
+static int
+nouveau_channel_pushbuf_ctxdma_init(struct nouveau_channel *chan)
+{
+	struct drm_device *dev = chan->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_bo *pb = chan->pushbuf_bo;
+	struct nouveau_gpuobj *pushbuf = NULL;
+	uint32_t start = pb->bo.mem.mm_node->start << PAGE_SHIFT;
+	int ret;
+
+	if (pb->bo.mem.mem_type == TTM_PL_TT) {
+		ret = nouveau_gpuobj_gart_dma_new(chan, 0,
+						  dev_priv->gart_info.aper_size,
+						  NV_DMA_ACCESS_RO, &pushbuf,
+						  NULL);
+		chan->pushbuf_base = start;
+	} else
+	if (dev_priv->card_type != NV_04) {
+		ret = nouveau_gpuobj_dma_new(chan, NV_CLASS_DMA_IN_MEMORY, 0,
+					     dev_priv->fb_available_size,
+					     NV_DMA_ACCESS_RO,
+					     NV_DMA_TARGET_VIDMEM, &pushbuf);
+		chan->pushbuf_base = start;
+	} else {
+		/* NV04 cmdbuf hack, from original ddx.. not sure of it's
+		 * exact reason for existing :)  PCI access to cmdbuf in
+		 * VRAM.
+		 */
+		ret = nouveau_gpuobj_dma_new(chan, NV_CLASS_DMA_IN_MEMORY,
+					     drm_get_resource_start(dev, 1),
+					     dev_priv->fb_available_size,
+					     NV_DMA_ACCESS_RO,
+					     NV_DMA_TARGET_PCI, &pushbuf);
+		chan->pushbuf_base = start;
+	}
+
+	ret = nouveau_gpuobj_ref_add(dev, chan, 0, pushbuf, &chan->pushbuf);
+	if (ret) {
+		NV_ERROR(dev, "Error referencing pushbuf ctxdma: %d\n", ret);
+		if (pushbuf != dev_priv->gart_info.sg_ctxdma)
+			nouveau_gpuobj_del(dev, &pushbuf);
+		return ret;
+	}
+
+	return 0;
+}
+
+static struct nouveau_bo *
+nouveau_channel_user_pushbuf_alloc(struct drm_device *dev)
+{
+	struct nouveau_bo *pushbuf = NULL;
+	int location, ret;
+
+	if (nouveau_vram_pushbuf)
+		location = TTM_PL_FLAG_VRAM;
+	else
+		location = TTM_PL_FLAG_TT;
+
+	ret = nouveau_bo_new(dev, NULL, 65536, 0, location, 0, 0x0000, false,
+			     true, &pushbuf);
+	if (ret) {
+		NV_ERROR(dev, "error allocating DMA push buffer: %d\n", ret);
+		return NULL;
+	}
+
+	ret = nouveau_bo_pin(pushbuf, location);
+	if (ret) {
+		NV_ERROR(dev, "error pinning DMA push buffer: %d\n", ret);
+		nouveau_bo_ref(NULL, &pushbuf);
+		return NULL;
+	}
+
+	return pushbuf;
+}
+
+/* allocates and initializes a fifo for user space consumption */
+int
+nouveau_channel_alloc(struct drm_device *dev, struct nouveau_channel **chan_ret,
+		      struct drm_file *file_priv,
+		      uint32_t vram_handle, uint32_t tt_handle)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_pgraph_engine *pgraph = &dev_priv->engine.graph;
+	struct nouveau_fifo_engine *pfifo = &dev_priv->engine.fifo;
+	struct nouveau_channel *chan;
+	int channel, user;
+	int ret;
+
+	/*
+	 * Alright, here is the full story
+	 * Nvidia cards have multiple hw fifo contexts (praise them for that,
+	 * no complicated crash-prone context switches)
+	 * We allocate a new context for each app and let it write to it
+	 * directly (woo, full userspace command submission !)
+	 * When there are no more contexts, you lost
+	 */
+	for (channel = 0; channel < pfifo->channels; channel++) {
+		if (dev_priv->fifos[channel] == NULL)
+			break;
+	}
+
+	/* no more fifos. you lost. */
+	if (channel == pfifo->channels)
+		return -EINVAL;
+
+	dev_priv->fifos[channel] = kzalloc(sizeof(struct nouveau_channel),
+					   GFP_KERNEL);
+	if (!dev_priv->fifos[channel])
+		return -ENOMEM;
+	dev_priv->fifo_alloc_count++;
+	chan = dev_priv->fifos[channel];
+	INIT_LIST_HEAD(&chan->nvsw.vbl_wait);
+	INIT_LIST_HEAD(&chan->fence.pending);
+	chan->dev = dev;
+	chan->id = channel;
+	chan->file_priv = file_priv;
+	chan->vram_handle = vram_handle;
+	chan->gart_handle = tt_handle;
+
+	NV_INFO(dev, "Allocating FIFO number %d\n", channel);
+
+	/* Allocate DMA push buffer */
+	chan->pushbuf_bo = nouveau_channel_user_pushbuf_alloc(dev);
+	if (!chan->pushbuf_bo) {
+		ret = -ENOMEM;
+		NV_ERROR(dev, "pushbuf %d\n", ret);
+		nouveau_channel_free(chan);
+		return ret;
+	}
+
+	nouveau_dma_pre_init(chan);
+
+	/* Locate channel's user control regs */
+	if (dev_priv->card_type < NV_40)
+		user = NV03_USER(channel);
+	else
+	if (dev_priv->card_type < NV_50)
+		user = NV40_USER(channel);
+	else
+		user = NV50_USER(channel);
+
+	chan->user = ioremap(pci_resource_start(dev->pdev, 0) + user,
+								PAGE_SIZE);
+	if (!chan->user) {
+		NV_ERROR(dev, "ioremap of regs failed.\n");
+		nouveau_channel_free(chan);
+		return -ENOMEM;
+	}
+	chan->user_put = 0x40;
+	chan->user_get = 0x44;
+
+	/* Allocate space for per-channel fixed notifier memory */
+	ret = nouveau_notifier_init_channel(chan);
+	if (ret) {
+		NV_ERROR(dev, "ntfy %d\n", ret);
+		nouveau_channel_free(chan);
+		return ret;
+	}
+
+	/* Setup channel's default objects */
+	ret = nouveau_gpuobj_channel_init(chan, vram_handle, tt_handle);
+	if (ret) {
+		NV_ERROR(dev, "gpuobj %d\n", ret);
+		nouveau_channel_free(chan);
+		return ret;
+	}
+
+	/* Create a dma object for the push buffer */
+	ret = nouveau_channel_pushbuf_ctxdma_init(chan);
+	if (ret) {
+		NV_ERROR(dev, "pbctxdma %d\n", ret);
+		nouveau_channel_free(chan);
+		return ret;
+	}
+
+	/* disable the fifo caches */
+	pfifo->reassign(dev, false);
+
+	/* Create a graphics context for new channel */
+	ret = pgraph->create_context(chan);
+	if (ret) {
+		nouveau_channel_free(chan);
+		return ret;
+	}
+
+	/* Construct inital RAMFC for new channel */
+	ret = pfifo->create_context(chan);
+	if (ret) {
+		nouveau_channel_free(chan);
+		return ret;
+	}
+
+	pfifo->reassign(dev, true);
+
+	ret = nouveau_dma_init(chan);
+	if (!ret)
+		ret = nouveau_fence_init(chan);
+	if (ret) {
+		nouveau_channel_free(chan);
+		return ret;
+	}
+
+	nouveau_debugfs_channel_init(chan);
+
+	NV_INFO(dev, "%s: initialised FIFO %d\n", __func__, channel);
+	*chan_ret = chan;
+	return 0;
+}
+
+/* stops a fifo */
+void
+nouveau_channel_free(struct nouveau_channel *chan)
+{
+	struct drm_device *dev = chan->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_pgraph_engine *pgraph = &dev_priv->engine.graph;
+	struct nouveau_fifo_engine *pfifo = &dev_priv->engine.fifo;
+	unsigned long flags;
+	int ret;
+
+	NV_INFO(dev, "%s: freeing fifo %d\n", __func__, chan->id);
+
+	nouveau_debugfs_channel_fini(chan);
+
+	/* Give outstanding push buffers a chance to complete */
+	spin_lock_irqsave(&chan->fence.lock, flags);
+	nouveau_fence_update(chan);
+	spin_unlock_irqrestore(&chan->fence.lock, flags);
+	if (chan->fence.sequence != chan->fence.sequence_ack) {
+		struct nouveau_fence *fence = NULL;
+
+		ret = nouveau_fence_new(chan, &fence, true);
+		if (ret == 0) {
+			ret = nouveau_fence_wait(fence, NULL, false, false);
+			nouveau_fence_unref((void *)&fence);
+		}
+
+		if (ret)
+			NV_ERROR(dev, "Failed to idle channel %d.\n", chan->id);
+	}
+
+	/* Ensure all outstanding fences are signaled.  They should be if the
+	 * above attempts at idling were OK, but if we failed this'll tell TTM
+	 * we're done with the buffers.
+	 */
+	nouveau_fence_fini(chan);
+
+	/* Ensure the channel is no longer active on the GPU */
+	pfifo->reassign(dev, false);
+
+	if (pgraph->channel(dev) == chan) {
+		pgraph->fifo_access(dev, false);
+		pgraph->unload_context(dev);
+		pgraph->fifo_access(dev, true);
+	}
+	pgraph->destroy_context(chan);
+
+	if (pfifo->channel_id(dev) == chan->id) {
+		pfifo->disable(dev);
+		pfifo->unload_context(dev);
+		pfifo->enable(dev);
+	}
+	pfifo->destroy_context(chan);
+
+	pfifo->reassign(dev, true);
+
+	/* Release the channel's resources */
+	nouveau_gpuobj_ref_del(dev, &chan->pushbuf);
+	if (chan->pushbuf_bo) {
+		nouveau_bo_unpin(chan->pushbuf_bo);
+		nouveau_bo_ref(NULL, &chan->pushbuf_bo);
+	}
+	nouveau_gpuobj_channel_takedown(chan);
+	nouveau_notifier_takedown_channel(chan);
+	if (chan->user)
+		iounmap(chan->user);
+
+	dev_priv->fifos[chan->id] = NULL;
+	dev_priv->fifo_alloc_count--;
+	kfree(chan);
+}
+
+/* cleans up all the fifos from file_priv */
+void
+nouveau_channel_cleanup(struct drm_device *dev, struct drm_file *file_priv)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_engine *engine = &dev_priv->engine;
+	int i;
+
+	NV_DEBUG(dev, "clearing FIFO enables from file_priv\n");
+	for (i = 0; i < engine->fifo.channels; i++) {
+		struct nouveau_channel *chan = dev_priv->fifos[i];
+
+		if (chan && chan->file_priv == file_priv)
+			nouveau_channel_free(chan);
+	}
+}
+
+int
+nouveau_channel_owner(struct drm_device *dev, struct drm_file *file_priv,
+		      int channel)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_engine *engine = &dev_priv->engine;
+
+	if (channel >= engine->fifo.channels)
+		return 0;
+	if (dev_priv->fifos[channel] == NULL)
+		return 0;
+
+	return (dev_priv->fifos[channel]->file_priv == file_priv);
+}
+
+/***********************************
+ * ioctls wrapping the functions
+ ***********************************/
+
+static int
+nouveau_ioctl_fifo_alloc(struct drm_device *dev, void *data,
+			 struct drm_file *file_priv)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct drm_nouveau_channel_alloc *init = data;
+	struct nouveau_channel *chan;
+	int ret;
+
+	NOUVEAU_CHECK_INITIALISED_WITH_RETURN;
+
+	if (dev_priv->engine.graph.accel_blocked)
+		return -ENODEV;
+
+	if (init->fb_ctxdma_handle == ~0 || init->tt_ctxdma_handle == ~0)
+		return -EINVAL;
+
+	ret = nouveau_channel_alloc(dev, &chan, file_priv,
+				    init->fb_ctxdma_handle,
+				    init->tt_ctxdma_handle);
+	if (ret)
+		return ret;
+	init->channel  = chan->id;
+
+	init->subchan[0].handle = NvM2MF;
+	if (dev_priv->card_type < NV_50)
+		init->subchan[0].grclass = 0x0039;
+	else
+		init->subchan[0].grclass = 0x5039;
+	init->subchan[1].handle = NvSw;
+	init->subchan[1].grclass = NV_SW;
+	init->nr_subchan = 2;
+
+	/* Named memory object area */
+	ret = drm_gem_handle_create(file_priv, chan->notifier_bo->gem,
+				    &init->notifier_handle);
+	if (ret) {
+		nouveau_channel_free(chan);
+		return ret;
+	}
+
+	return 0;
+}
+
+static int
+nouveau_ioctl_fifo_free(struct drm_device *dev, void *data,
+			struct drm_file *file_priv)
+{
+	struct drm_nouveau_channel_free *cfree = data;
+	struct nouveau_channel *chan;
+
+	NOUVEAU_CHECK_INITIALISED_WITH_RETURN;
+	NOUVEAU_GET_USER_CHANNEL_WITH_RETURN(cfree->channel, file_priv, chan);
+
+	nouveau_channel_free(chan);
+	return 0;
+}
+
+/***********************************
+ * finally, the ioctl table
+ ***********************************/
+
+struct drm_ioctl_desc nouveau_ioctls[] = {
+	DRM_IOCTL_DEF(DRM_NOUVEAU_CARD_INIT, nouveau_ioctl_card_init, DRM_AUTH),
+	DRM_IOCTL_DEF(DRM_NOUVEAU_GETPARAM, nouveau_ioctl_getparam, DRM_AUTH),
+	DRM_IOCTL_DEF(DRM_NOUVEAU_SETPARAM, nouveau_ioctl_setparam, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY),
+	DRM_IOCTL_DEF(DRM_NOUVEAU_CHANNEL_ALLOC, nouveau_ioctl_fifo_alloc, DRM_AUTH),
+	DRM_IOCTL_DEF(DRM_NOUVEAU_CHANNEL_FREE, nouveau_ioctl_fifo_free, DRM_AUTH),
+	DRM_IOCTL_DEF(DRM_NOUVEAU_GROBJ_ALLOC, nouveau_ioctl_grobj_alloc, DRM_AUTH),
+	DRM_IOCTL_DEF(DRM_NOUVEAU_NOTIFIEROBJ_ALLOC, nouveau_ioctl_notifier_alloc, DRM_AUTH),
+	DRM_IOCTL_DEF(DRM_NOUVEAU_GPUOBJ_FREE, nouveau_ioctl_gpuobj_free, DRM_AUTH),
+	DRM_IOCTL_DEF(DRM_NOUVEAU_GEM_NEW, nouveau_gem_ioctl_new, DRM_AUTH),
+	DRM_IOCTL_DEF(DRM_NOUVEAU_GEM_PUSHBUF, nouveau_gem_ioctl_pushbuf, DRM_AUTH),
+	DRM_IOCTL_DEF(DRM_NOUVEAU_GEM_PUSHBUF_CALL, nouveau_gem_ioctl_pushbuf_call, DRM_AUTH),
+	DRM_IOCTL_DEF(DRM_NOUVEAU_GEM_PIN, nouveau_gem_ioctl_pin, DRM_AUTH),
+	DRM_IOCTL_DEF(DRM_NOUVEAU_GEM_UNPIN, nouveau_gem_ioctl_unpin, DRM_AUTH),
+	DRM_IOCTL_DEF(DRM_NOUVEAU_GEM_CPU_PREP, nouveau_gem_ioctl_cpu_prep, DRM_AUTH),
+	DRM_IOCTL_DEF(DRM_NOUVEAU_GEM_CPU_FINI, nouveau_gem_ioctl_cpu_fini, DRM_AUTH),
+	DRM_IOCTL_DEF(DRM_NOUVEAU_GEM_INFO, nouveau_gem_ioctl_info, DRM_AUTH),
+	DRM_IOCTL_DEF(DRM_NOUVEAU_GEM_PUSHBUF_CALL2, nouveau_gem_ioctl_pushbuf_call2, DRM_AUTH),
+};
+
+int nouveau_max_ioctl = DRM_ARRAY_SIZE(nouveau_ioctls);
diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c
new file mode 100644
index 000000000000..5a10deb8bdbd
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
@@ -0,0 +1,824 @@
+/*
+ * Copyright (C) 2008 Maarten Maathuis.
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial
+ * portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE COPYRIGHT OWNER(S) AND/OR ITS SUPPLIERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
+#include "drmP.h"
+#include "drm_edid.h"
+#include "drm_crtc_helper.h"
+#include "nouveau_reg.h"
+#include "nouveau_drv.h"
+#include "nouveau_encoder.h"
+#include "nouveau_crtc.h"
+#include "nouveau_connector.h"
+#include "nouveau_hw.h"
+
+static inline struct drm_encoder_slave_funcs *
+get_slave_funcs(struct nouveau_encoder *enc)
+{
+	return to_encoder_slave(to_drm_encoder(enc))->slave_funcs;
+}
+
+static struct nouveau_encoder *
+find_encoder_by_type(struct drm_connector *connector, int type)
+{
+	struct drm_device *dev = connector->dev;
+	struct nouveau_encoder *nv_encoder;
+	struct drm_mode_object *obj;
+	int i, id;
+
+	for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
+		id = connector->encoder_ids[i];
+		if (!id)
+			break;
+
+		obj = drm_mode_object_find(dev, id, DRM_MODE_OBJECT_ENCODER);
+		if (!obj)
+			continue;
+		nv_encoder = nouveau_encoder(obj_to_encoder(obj));
+
+		if (type == OUTPUT_ANY || nv_encoder->dcb->type == type)
+			return nv_encoder;
+	}
+
+	return NULL;
+}
+
+struct nouveau_connector *
+nouveau_encoder_connector_get(struct nouveau_encoder *encoder)
+{
+	struct drm_device *dev = to_drm_encoder(encoder)->dev;
+	struct drm_connector *drm_connector;
+
+	list_for_each_entry(drm_connector, &dev->mode_config.connector_list, head) {
+		if (drm_connector->encoder == to_drm_encoder(encoder))
+			return nouveau_connector(drm_connector);
+	}
+
+	return NULL;
+}
+
+
+static void
+nouveau_connector_destroy(struct drm_connector *drm_connector)
+{
+	struct nouveau_connector *connector = nouveau_connector(drm_connector);
+	struct drm_device *dev = connector->base.dev;
+
+	NV_DEBUG_KMS(dev, "\n");
+
+	if (!connector)
+		return;
+
+	drm_sysfs_connector_remove(drm_connector);
+	drm_connector_cleanup(drm_connector);
+	kfree(drm_connector);
+}
+
+static void
+nouveau_connector_ddc_prepare(struct drm_connector *connector, int *flags)
+{
+	struct drm_nouveau_private *dev_priv = connector->dev->dev_private;
+
+	if (dev_priv->card_type >= NV_50)
+		return;
+
+	*flags = 0;
+	if (NVLockVgaCrtcs(dev_priv->dev, false))
+		*flags |= 1;
+	if (nv_heads_tied(dev_priv->dev))
+		*flags |= 2;
+
+	if (*flags & 2)
+		NVSetOwner(dev_priv->dev, 0); /* necessary? */
+}
+
+static void
+nouveau_connector_ddc_finish(struct drm_connector *connector, int flags)
+{
+	struct drm_nouveau_private *dev_priv = connector->dev->dev_private;
+
+	if (dev_priv->card_type >= NV_50)
+		return;
+
+	if (flags & 2)
+		NVSetOwner(dev_priv->dev, 4);
+	if (flags & 1)
+		NVLockVgaCrtcs(dev_priv->dev, true);
+}
+
+static struct nouveau_i2c_chan *
+nouveau_connector_ddc_detect(struct drm_connector *connector,
+			     struct nouveau_encoder **pnv_encoder)
+{
+	struct drm_device *dev = connector->dev;
+	uint8_t out_buf[] = { 0x0, 0x0}, buf[2];
+	int ret, flags, i;
+
+	struct i2c_msg msgs[] = {
+		{
+			.addr = 0x50,
+			.flags = 0,
+			.len = 1,
+			.buf = out_buf,
+		},
+		{
+			.addr = 0x50,
+			.flags = I2C_M_RD,
+			.len = 1,
+			.buf = buf,
+		}
+	};
+
+	for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
+		struct nouveau_i2c_chan *i2c = NULL;
+		struct nouveau_encoder *nv_encoder;
+		struct drm_mode_object *obj;
+		int id;
+
+		id = connector->encoder_ids[i];
+		if (!id)
+			break;
+
+		obj = drm_mode_object_find(dev, id, DRM_MODE_OBJECT_ENCODER);
+		if (!obj)
+			continue;
+		nv_encoder = nouveau_encoder(obj_to_encoder(obj));
+
+		if (nv_encoder->dcb->i2c_index < 0xf)
+			i2c = nouveau_i2c_find(dev, nv_encoder->dcb->i2c_index);
+		if (!i2c)
+			continue;
+
+		nouveau_connector_ddc_prepare(connector, &flags);
+		ret = i2c_transfer(&i2c->adapter, msgs, 2);
+		nouveau_connector_ddc_finish(connector, flags);
+
+		if (ret == 2) {
+			*pnv_encoder = nv_encoder;
+			return i2c;
+		}
+	}
+
+	return NULL;
+}
+
+static void
+nouveau_connector_set_encoder(struct drm_connector *connector,
+			      struct nouveau_encoder *nv_encoder)
+{
+	struct nouveau_connector *nv_connector = nouveau_connector(connector);
+	struct drm_nouveau_private *dev_priv = connector->dev->dev_private;
+	struct drm_device *dev = connector->dev;
+
+	if (nv_connector->detected_encoder == nv_encoder)
+		return;
+	nv_connector->detected_encoder = nv_encoder;
+
+	if (nv_encoder->dcb->type == OUTPUT_LVDS ||
+	    nv_encoder->dcb->type == OUTPUT_TMDS) {
+		connector->doublescan_allowed = false;
+		connector->interlace_allowed = false;
+	} else {
+		connector->doublescan_allowed = true;
+		if (dev_priv->card_type == NV_20 ||
+		   (dev_priv->card_type == NV_10 &&
+		    (dev->pci_device & 0x0ff0) != 0x0100 &&
+		    (dev->pci_device & 0x0ff0) != 0x0150))
+			/* HW is broken */
+			connector->interlace_allowed = false;
+		else
+			connector->interlace_allowed = true;
+	}
+
+	if (connector->connector_type == DRM_MODE_CONNECTOR_DVII) {
+		drm_connector_property_set_value(connector,
+			dev->mode_config.dvi_i_subconnector_property,
+			nv_encoder->dcb->type == OUTPUT_TMDS ?
+			DRM_MODE_SUBCONNECTOR_DVID :
+			DRM_MODE_SUBCONNECTOR_DVIA);
+	}
+}
+
+static enum drm_connector_status
+nouveau_connector_detect(struct drm_connector *connector)
+{
+	struct drm_device *dev = connector->dev;
+	struct nouveau_connector *nv_connector = nouveau_connector(connector);
+	struct nouveau_encoder *nv_encoder = NULL;
+	struct nouveau_i2c_chan *i2c;
+	int type, flags;
+
+	if (connector->connector_type == DRM_MODE_CONNECTOR_LVDS)
+		nv_encoder = find_encoder_by_type(connector, OUTPUT_LVDS);
+	if (nv_encoder && nv_connector->native_mode) {
+		nouveau_connector_set_encoder(connector, nv_encoder);
+		return connector_status_connected;
+	}
+
+	i2c = nouveau_connector_ddc_detect(connector, &nv_encoder);
+	if (i2c) {
+		nouveau_connector_ddc_prepare(connector, &flags);
+		nv_connector->edid = drm_get_edid(connector, &i2c->adapter);
+		nouveau_connector_ddc_finish(connector, flags);
+		drm_mode_connector_update_edid_property(connector,
+							nv_connector->edid);
+		if (!nv_connector->edid) {
+			NV_ERROR(dev, "DDC responded, but no EDID for %s\n",
+				 drm_get_connector_name(connector));
+			return connector_status_disconnected;
+		}
+
+		if (nv_encoder->dcb->type == OUTPUT_DP &&
+		    !nouveau_dp_detect(to_drm_encoder(nv_encoder))) {
+			NV_ERROR(dev, "Detected %s, but failed init\n",
+				 drm_get_connector_name(connector));
+			return connector_status_disconnected;
+		}
+
+		/* Override encoder type for DVI-I based on whether EDID
+		 * says the display is digital or analog, both use the
+		 * same i2c channel so the value returned from ddc_detect
+		 * isn't necessarily correct.
+		 */
+		if (connector->connector_type == DRM_MODE_CONNECTOR_DVII) {
+			if (nv_connector->edid->input & DRM_EDID_INPUT_DIGITAL)
+				type = OUTPUT_TMDS;
+			else
+				type = OUTPUT_ANALOG;
+
+			nv_encoder = find_encoder_by_type(connector, type);
+			if (!nv_encoder) {
+				NV_ERROR(dev, "Detected %d encoder on %s, "
+					      "but no object!\n", type,
+					 drm_get_connector_name(connector));
+				return connector_status_disconnected;
+			}
+		}
+
+		nouveau_connector_set_encoder(connector, nv_encoder);
+		return connector_status_connected;
+	}
+
+	nv_encoder = find_encoder_by_type(connector, OUTPUT_ANALOG);
+	if (!nv_encoder)
+		nv_encoder = find_encoder_by_type(connector, OUTPUT_TV);
+	if (nv_encoder) {
+		struct drm_encoder *encoder = to_drm_encoder(nv_encoder);
+		struct drm_encoder_helper_funcs *helper =
+						encoder->helper_private;
+
+		if (helper->detect(encoder, connector) ==
+						connector_status_connected) {
+			nouveau_connector_set_encoder(connector, nv_encoder);
+			return connector_status_connected;
+		}
+
+	}
+
+	return connector_status_disconnected;
+}
+
+static void
+nouveau_connector_force(struct drm_connector *connector)
+{
+	struct drm_device *dev = connector->dev;
+	struct nouveau_encoder *nv_encoder;
+	int type;
+
+	if (connector->connector_type == DRM_MODE_CONNECTOR_DVII) {
+		if (connector->force == DRM_FORCE_ON_DIGITAL)
+			type = OUTPUT_TMDS;
+		else
+			type = OUTPUT_ANALOG;
+	} else
+		type = OUTPUT_ANY;
+
+	nv_encoder = find_encoder_by_type(connector, type);
+	if (!nv_encoder) {
+		NV_ERROR(dev, "can't find encoder to force %s on!\n",
+			 drm_get_connector_name(connector));
+		connector->status = connector_status_disconnected;
+		return;
+	}
+
+	nouveau_connector_set_encoder(connector, nv_encoder);
+}
+
+static int
+nouveau_connector_set_property(struct drm_connector *connector,
+			       struct drm_property *property, uint64_t value)
+{
+	struct nouveau_connector *nv_connector = nouveau_connector(connector);
+	struct nouveau_encoder *nv_encoder = nv_connector->detected_encoder;
+	struct drm_device *dev = connector->dev;
+	int ret;
+
+	/* Scaling mode */
+	if (property == dev->mode_config.scaling_mode_property) {
+		struct nouveau_crtc *nv_crtc = NULL;
+		bool modeset = false;
+
+		switch (value) {
+		case DRM_MODE_SCALE_NONE:
+		case DRM_MODE_SCALE_FULLSCREEN:
+		case DRM_MODE_SCALE_CENTER:
+		case DRM_MODE_SCALE_ASPECT:
+			break;
+		default:
+			return -EINVAL;
+		}
+
+		/* LVDS always needs gpu scaling */
+		if (connector->connector_type == DRM_MODE_CONNECTOR_LVDS &&
+		    value == DRM_MODE_SCALE_NONE)
+			return -EINVAL;
+
+		/* Changing between GPU and panel scaling requires a full
+		 * modeset
+		 */
+		if ((nv_connector->scaling_mode == DRM_MODE_SCALE_NONE) ||
+		    (value == DRM_MODE_SCALE_NONE))
+			modeset = true;
+		nv_connector->scaling_mode = value;
+
+		if (connector->encoder && connector->encoder->crtc)
+			nv_crtc = nouveau_crtc(connector->encoder->crtc);
+		if (!nv_crtc)
+			return 0;
+
+		if (modeset || !nv_crtc->set_scale) {
+			ret = drm_crtc_helper_set_mode(&nv_crtc->base,
+							&nv_crtc->base.mode,
+							nv_crtc->base.x,
+							nv_crtc->base.y, NULL);
+			if (!ret)
+				return -EINVAL;
+		} else {
+			ret = nv_crtc->set_scale(nv_crtc, value, true);
+			if (ret)
+				return ret;
+		}
+
+		return 0;
+	}
+
+	/* Dithering */
+	if (property == dev->mode_config.dithering_mode_property) {
+		struct nouveau_crtc *nv_crtc = NULL;
+
+		if (value == DRM_MODE_DITHERING_ON)
+			nv_connector->use_dithering = true;
+		else
+			nv_connector->use_dithering = false;
+
+		if (connector->encoder && connector->encoder->crtc)
+			nv_crtc = nouveau_crtc(connector->encoder->crtc);
+
+		if (!nv_crtc || !nv_crtc->set_dither)
+			return 0;
+
+		return nv_crtc->set_dither(nv_crtc, nv_connector->use_dithering,
+					   true);
+	}
+
+	if (nv_encoder && nv_encoder->dcb->type == OUTPUT_TV)
+		return get_slave_funcs(nv_encoder)->
+			set_property(to_drm_encoder(nv_encoder), connector, property, value);
+
+	return -EINVAL;
+}
+
+static struct drm_display_mode *
+nouveau_connector_native_mode(struct nouveau_connector *connector)
+{
+	struct drm_device *dev = connector->base.dev;
+	struct drm_display_mode *mode, *largest = NULL;
+	int high_w = 0, high_h = 0, high_v = 0;
+
+	/* Use preferred mode if there is one.. */
+	list_for_each_entry(mode, &connector->base.probed_modes, head) {
+		if (mode->type & DRM_MODE_TYPE_PREFERRED) {
+			NV_DEBUG_KMS(dev, "native mode from preferred\n");
+			return drm_mode_duplicate(dev, mode);
+		}
+	}
+
+	/* Otherwise, take the resolution with the largest width, then height,
+	 * then vertical refresh
+	 */
+	list_for_each_entry(mode, &connector->base.probed_modes, head) {
+		if (mode->hdisplay < high_w)
+			continue;
+
+		if (mode->hdisplay == high_w && mode->vdisplay < high_h)
+			continue;
+
+		if (mode->hdisplay == high_w && mode->vdisplay == high_h &&
+		    mode->vrefresh < high_v)
+			continue;
+
+		high_w = mode->hdisplay;
+		high_h = mode->vdisplay;
+		high_v = mode->vrefresh;
+		largest = mode;
+	}
+
+	NV_DEBUG_KMS(dev, "native mode from largest: %dx%d@%d\n",
+		      high_w, high_h, high_v);
+	return largest ? drm_mode_duplicate(dev, largest) : NULL;
+}
+
+struct moderec {
+	int hdisplay;
+	int vdisplay;
+};
+
+static struct moderec scaler_modes[] = {
+	{ 1920, 1200 },
+	{ 1920, 1080 },
+	{ 1680, 1050 },
+	{ 1600, 1200 },
+	{ 1400, 1050 },
+	{ 1280, 1024 },
+	{ 1280, 960 },
+	{ 1152, 864 },
+	{ 1024, 768 },
+	{ 800, 600 },
+	{ 720, 400 },
+	{ 640, 480 },
+	{ 640, 400 },
+	{ 640, 350 },
+	{}
+};
+
+static int
+nouveau_connector_scaler_modes_add(struct drm_connector *connector)
+{
+	struct nouveau_connector *nv_connector = nouveau_connector(connector);
+	struct drm_display_mode *native = nv_connector->native_mode, *m;
+	struct drm_device *dev = connector->dev;
+	struct moderec *mode = &scaler_modes[0];
+	int modes = 0;
+
+	if (!native)
+		return 0;
+
+	while (mode->hdisplay) {
+		if (mode->hdisplay <= native->hdisplay &&
+		    mode->vdisplay <= native->vdisplay) {
+			m = drm_cvt_mode(dev, mode->hdisplay, mode->vdisplay,
+					 drm_mode_vrefresh(native), false,
+					 false, false);
+			if (!m)
+				continue;
+
+			m->type |= DRM_MODE_TYPE_DRIVER;
+
+			drm_mode_probed_add(connector, m);
+			modes++;
+		}
+
+		mode++;
+	}
+
+	return modes;
+}
+
+static int
+nouveau_connector_get_modes(struct drm_connector *connector)
+{
+	struct drm_device *dev = connector->dev;
+	struct nouveau_connector *nv_connector = nouveau_connector(connector);
+	struct nouveau_encoder *nv_encoder = nv_connector->detected_encoder;
+	int ret = 0;
+
+	/* If we're not LVDS, destroy the previous native mode, the attached
+	 * monitor could have changed.
+	 */
+	if (connector->connector_type != DRM_MODE_CONNECTOR_LVDS &&
+	    nv_connector->native_mode) {
+		drm_mode_destroy(dev, nv_connector->native_mode);
+		nv_connector->native_mode = NULL;
+	}
+
+	if (nv_connector->edid)
+		ret = drm_add_edid_modes(connector, nv_connector->edid);
+
+	/* Find the native mode if this is a digital panel, if we didn't
+	 * find any modes through DDC previously add the native mode to
+	 * the list of modes.
+	 */
+	if (!nv_connector->native_mode)
+		nv_connector->native_mode =
+			nouveau_connector_native_mode(nv_connector);
+	if (ret == 0 && nv_connector->native_mode) {
+		struct drm_display_mode *mode;
+
+		mode = drm_mode_duplicate(dev, nv_connector->native_mode);
+		drm_mode_probed_add(connector, mode);
+		ret = 1;
+	}
+
+	if (nv_encoder->dcb->type == OUTPUT_TV)
+		ret = get_slave_funcs(nv_encoder)->
+			get_modes(to_drm_encoder(nv_encoder), connector);
+
+	if (connector->connector_type == DRM_MODE_CONNECTOR_LVDS)
+		ret += nouveau_connector_scaler_modes_add(connector);
+
+	return ret;
+}
+
+static int
+nouveau_connector_mode_valid(struct drm_connector *connector,
+			     struct drm_display_mode *mode)
+{
+	struct drm_nouveau_private *dev_priv = connector->dev->dev_private;
+	struct nouveau_connector *nv_connector = nouveau_connector(connector);
+	struct nouveau_encoder *nv_encoder = nv_connector->detected_encoder;
+	unsigned min_clock = 25000, max_clock = min_clock;
+	unsigned clock = mode->clock;
+
+	switch (nv_encoder->dcb->type) {
+	case OUTPUT_LVDS:
+		BUG_ON(!nv_connector->native_mode);
+		if (mode->hdisplay > nv_connector->native_mode->hdisplay ||
+		    mode->vdisplay > nv_connector->native_mode->vdisplay)
+			return MODE_PANEL;
+
+		min_clock = 0;
+		max_clock = 400000;
+		break;
+	case OUTPUT_TMDS:
+		if ((dev_priv->card_type >= NV_50 && !nouveau_duallink) ||
+		    (dev_priv->card_type < NV_50 &&
+		     !nv_encoder->dcb->duallink_possible))
+			max_clock = 165000;
+		else
+			max_clock = 330000;
+		break;
+	case OUTPUT_ANALOG:
+		max_clock = nv_encoder->dcb->crtconf.maxfreq;
+		if (!max_clock)
+			max_clock = 350000;
+		break;
+	case OUTPUT_TV:
+		return get_slave_funcs(nv_encoder)->
+			mode_valid(to_drm_encoder(nv_encoder), mode);
+	case OUTPUT_DP:
+		if (nv_encoder->dp.link_bw == DP_LINK_BW_2_7)
+			max_clock = nv_encoder->dp.link_nr * 270000;
+		else
+			max_clock = nv_encoder->dp.link_nr * 162000;
+
+		clock *= 3;
+		break;
+	}
+
+	if (clock < min_clock)
+		return MODE_CLOCK_LOW;
+
+	if (clock > max_clock)
+		return MODE_CLOCK_HIGH;
+
+	return MODE_OK;
+}
+
+static struct drm_encoder *
+nouveau_connector_best_encoder(struct drm_connector *connector)
+{
+	struct nouveau_connector *nv_connector = nouveau_connector(connector);
+
+	if (nv_connector->detected_encoder)
+		return to_drm_encoder(nv_connector->detected_encoder);
+
+	return NULL;
+}
+
+static const struct drm_connector_helper_funcs
+nouveau_connector_helper_funcs = {
+	.get_modes = nouveau_connector_get_modes,
+	.mode_valid = nouveau_connector_mode_valid,
+	.best_encoder = nouveau_connector_best_encoder,
+};
+
+static const struct drm_connector_funcs
+nouveau_connector_funcs = {
+	.dpms = drm_helper_connector_dpms,
+	.save = NULL,
+	.restore = NULL,
+	.detect = nouveau_connector_detect,
+	.destroy = nouveau_connector_destroy,
+	.fill_modes = drm_helper_probe_single_connector_modes,
+	.set_property = nouveau_connector_set_property,
+	.force = nouveau_connector_force
+};
+
+static int
+nouveau_connector_create_lvds(struct drm_device *dev,
+			      struct drm_connector *connector)
+{
+	struct nouveau_connector *nv_connector = nouveau_connector(connector);
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_i2c_chan *i2c = NULL;
+	struct nouveau_encoder *nv_encoder;
+	struct drm_display_mode native, *mode, *temp;
+	bool dummy, if_is_24bit = false;
+	int ret, flags;
+
+	nv_encoder = find_encoder_by_type(connector, OUTPUT_LVDS);
+	if (!nv_encoder)
+		return -ENODEV;
+
+	ret = nouveau_bios_parse_lvds_table(dev, 0, &dummy, &if_is_24bit);
+	if (ret) {
+		NV_ERROR(dev, "Error parsing LVDS table, disabling LVDS\n");
+		return ret;
+	}
+	nv_connector->use_dithering = !if_is_24bit;
+
+	/* Firstly try getting EDID over DDC, if allowed and I2C channel
+	 * is available.
+	 */
+	if (!dev_priv->VBIOS.pub.fp_no_ddc && nv_encoder->dcb->i2c_index < 0xf)
+		i2c = nouveau_i2c_find(dev, nv_encoder->dcb->i2c_index);
+
+	if (i2c) {
+		nouveau_connector_ddc_prepare(connector, &flags);
+		nv_connector->edid = drm_get_edid(connector, &i2c->adapter);
+		nouveau_connector_ddc_finish(connector, flags);
+	}
+
+	/* If no EDID found above, and the VBIOS indicates a hardcoded
+	 * modeline is avalilable for the panel, set it as the panel's
+	 * native mode and exit.
+	 */
+	if (!nv_connector->edid && nouveau_bios_fp_mode(dev, &native) &&
+	     (nv_encoder->dcb->lvdsconf.use_straps_for_mode ||
+	      dev_priv->VBIOS.pub.fp_no_ddc)) {
+		nv_connector->native_mode = drm_mode_duplicate(dev, &native);
+		goto out;
+	}
+
+	/* Still nothing, some VBIOS images have a hardcoded EDID block
+	 * stored for the panel stored in them.
+	 */
+	if (!nv_connector->edid && !nv_connector->native_mode &&
+	    !dev_priv->VBIOS.pub.fp_no_ddc) {
+		nv_connector->edid =
+			(struct edid *)nouveau_bios_embedded_edid(dev);
+	}
+
+	if (!nv_connector->edid)
+		goto out;
+
+	/* We didn't find/use a panel mode from the VBIOS, so parse the EDID
+	 * block and look for the preferred mode there.
+	 */
+	ret = drm_add_edid_modes(connector, nv_connector->edid);
+	if (ret == 0)
+		goto out;
+	nv_connector->detected_encoder = nv_encoder;
+	nv_connector->native_mode = nouveau_connector_native_mode(nv_connector);
+	list_for_each_entry_safe(mode, temp, &connector->probed_modes, head)
+		drm_mode_remove(connector, mode);
+
+out:
+	if (!nv_connector->native_mode) {
+		NV_ERROR(dev, "LVDS present in DCB table, but couldn't "
+			      "determine its native mode.  Disabling.\n");
+		return -ENODEV;
+	}
+
+	drm_mode_connector_update_edid_property(connector, nv_connector->edid);
+	return 0;
+}
+
+int
+nouveau_connector_create(struct drm_device *dev, int index, int type)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_connector *nv_connector = NULL;
+	struct drm_connector *connector;
+	struct drm_encoder *encoder;
+	int ret;
+
+	NV_DEBUG_KMS(dev, "\n");
+
+	nv_connector = kzalloc(sizeof(*nv_connector), GFP_KERNEL);
+	if (!nv_connector)
+		return -ENOMEM;
+	nv_connector->dcb = nouveau_bios_connector_entry(dev, index);
+	connector = &nv_connector->base;
+
+	switch (type) {
+	case DRM_MODE_CONNECTOR_VGA:
+		NV_INFO(dev, "Detected a VGA connector\n");
+		break;
+	case DRM_MODE_CONNECTOR_DVID:
+		NV_INFO(dev, "Detected a DVI-D connector\n");
+		break;
+	case DRM_MODE_CONNECTOR_DVII:
+		NV_INFO(dev, "Detected a DVI-I connector\n");
+		break;
+	case DRM_MODE_CONNECTOR_LVDS:
+		NV_INFO(dev, "Detected a LVDS connector\n");
+		break;
+	case DRM_MODE_CONNECTOR_TV:
+		NV_INFO(dev, "Detected a TV connector\n");
+		break;
+	case DRM_MODE_CONNECTOR_DisplayPort:
+		NV_INFO(dev, "Detected a DisplayPort connector\n");
+		break;
+	default:
+		NV_ERROR(dev, "Unknown connector, this is not good.\n");
+		break;
+	}
+
+	/* defaults, will get overridden in detect() */
+	connector->interlace_allowed = false;
+	connector->doublescan_allowed = false;
+
+	drm_connector_init(dev, connector, &nouveau_connector_funcs, type);
+	drm_connector_helper_add(connector, &nouveau_connector_helper_funcs);
+
+	/* Init DVI-I specific properties */
+	if (type == DRM_MODE_CONNECTOR_DVII) {
+		drm_mode_create_dvi_i_properties(dev);
+		drm_connector_attach_property(connector, dev->mode_config.dvi_i_subconnector_property, 0);
+		drm_connector_attach_property(connector, dev->mode_config.dvi_i_select_subconnector_property, 0);
+	}
+
+	if (type != DRM_MODE_CONNECTOR_LVDS)
+		nv_connector->use_dithering = false;
+
+	if (type == DRM_MODE_CONNECTOR_DVID ||
+	    type == DRM_MODE_CONNECTOR_DVII ||
+	    type == DRM_MODE_CONNECTOR_LVDS ||
+	    type == DRM_MODE_CONNECTOR_DisplayPort) {
+		nv_connector->scaling_mode = DRM_MODE_SCALE_FULLSCREEN;
+
+		drm_connector_attach_property(connector, dev->mode_config.scaling_mode_property,
+					      nv_connector->scaling_mode);
+		drm_connector_attach_property(connector, dev->mode_config.dithering_mode_property,
+					      nv_connector->use_dithering ? DRM_MODE_DITHERING_ON
+					      : DRM_MODE_DITHERING_OFF);
+
+	} else {
+		nv_connector->scaling_mode = DRM_MODE_SCALE_NONE;
+
+		if (type == DRM_MODE_CONNECTOR_VGA  &&
+				dev_priv->card_type >= NV_50) {
+			drm_connector_attach_property(connector,
+					dev->mode_config.scaling_mode_property,
+					nv_connector->scaling_mode);
+		}
+	}
+
+	/* attach encoders */
+	list_for_each_entry(encoder, &dev->mode_config.encoder_list, head) {
+		struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
+
+		if (nv_encoder->dcb->connector != index)
+			continue;
+
+		if (get_slave_funcs(nv_encoder))
+			get_slave_funcs(nv_encoder)->create_resources(encoder, connector);
+
+		drm_mode_connector_attach_encoder(connector, encoder);
+	}
+
+	drm_sysfs_connector_add(connector);
+
+	if (connector->connector_type == DRM_MODE_CONNECTOR_LVDS) {
+		ret = nouveau_connector_create_lvds(dev, connector);
+		if (ret) {
+			connector->funcs->destroy(connector);
+			return ret;
+		}
+	}
+
+	return 0;
+}
diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.h b/drivers/gpu/drm/nouveau/nouveau_connector.h
new file mode 100644
index 000000000000..728b8090e5ff
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nouveau_connector.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2008 Maarten Maathuis.
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial
+ * portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE COPYRIGHT OWNER(S) AND/OR ITS SUPPLIERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
+#ifndef __NOUVEAU_CONNECTOR_H__
+#define __NOUVEAU_CONNECTOR_H__
+
+#include "drm_edid.h"
+#include "nouveau_i2c.h"
+
+struct nouveau_connector {
+	struct drm_connector base;
+
+	struct dcb_connector_table_entry *dcb;
+
+	int scaling_mode;
+	bool use_dithering;
+
+	struct nouveau_encoder *detected_encoder;
+	struct edid *edid;
+	struct drm_display_mode *native_mode;
+};
+
+static inline struct nouveau_connector *nouveau_connector(
+						struct drm_connector *con)
+{
+	return container_of(con, struct nouveau_connector, base);
+}
+
+int nouveau_connector_create(struct drm_device *dev, int i2c_index, int type);
+
+#endif /* __NOUVEAU_CONNECTOR_H__ */
diff --git a/drivers/gpu/drm/nouveau/nouveau_crtc.h b/drivers/gpu/drm/nouveau/nouveau_crtc.h
new file mode 100644
index 000000000000..49fa7b2d257e
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nouveau_crtc.h
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2008 Maarten Maathuis.
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial
+ * portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE COPYRIGHT OWNER(S) AND/OR ITS SUPPLIERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
+#ifndef __NOUVEAU_CRTC_H__
+#define __NOUVEAU_CRTC_H__
+
+struct nouveau_crtc {
+	struct drm_crtc base;
+
+	int index;
+
+	struct drm_display_mode *mode;
+
+	uint32_t dpms_saved_fp_control;
+	uint32_t fp_users;
+	int saturation;
+	int sharpness;
+	int last_dpms;
+
+	struct {
+		int cpp;
+		bool blanked;
+		uint32_t offset;
+		uint32_t tile_flags;
+	} fb;
+
+	struct {
+		struct nouveau_bo *nvbo;
+		bool visible;
+		uint32_t offset;
+		void (*set_offset)(struct nouveau_crtc *, uint32_t offset);
+		void (*set_pos)(struct nouveau_crtc *, int x, int y);
+		void (*hide)(struct nouveau_crtc *, bool update);
+		void (*show)(struct nouveau_crtc *, bool update);
+	} cursor;
+
+	struct {
+		struct nouveau_bo *nvbo;
+		uint16_t r[256];
+		uint16_t g[256];
+		uint16_t b[256];
+		int depth;
+	} lut;
+
+	int (*set_dither)(struct nouveau_crtc *crtc, bool on, bool update);
+	int (*set_scale)(struct nouveau_crtc *crtc, int mode, bool update);
+};
+
+static inline struct nouveau_crtc *nouveau_crtc(struct drm_crtc *crtc)
+{
+	return container_of(crtc, struct nouveau_crtc, base);
+}
+
+static inline struct drm_crtc *to_drm_crtc(struct nouveau_crtc *crtc)
+{
+	return &crtc->base;
+}
+
+int nv50_crtc_create(struct drm_device *dev, int index);
+int nv50_cursor_init(struct nouveau_crtc *);
+void nv50_cursor_fini(struct nouveau_crtc *);
+int nv50_crtc_cursor_set(struct drm_crtc *drm_crtc, struct drm_file *file_priv,
+			 uint32_t buffer_handle, uint32_t width,
+			 uint32_t height);
+int nv50_crtc_cursor_move(struct drm_crtc *drm_crtc, int x, int y);
+
+int nv04_cursor_init(struct nouveau_crtc *);
+
+struct nouveau_connector *
+nouveau_crtc_connector_get(struct nouveau_crtc *crtc);
+
+#endif /* __NOUVEAU_CRTC_H__ */
diff --git a/drivers/gpu/drm/nouveau/nouveau_debugfs.c b/drivers/gpu/drm/nouveau/nouveau_debugfs.c
new file mode 100644
index 000000000000..d79db3698f16
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nouveau_debugfs.c
@@ -0,0 +1,155 @@
+/*
+ * Copyright (C) 2009 Red Hat <bskeggs@redhat.com>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial
+ * portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE COPYRIGHT OWNER(S) AND/OR ITS SUPPLIERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
+/*
+ * Authors:
+ *  Ben Skeggs <bskeggs@redhat.com>
+ */
+
+#include <linux/debugfs.h>
+
+#include "drmP.h"
+#include "nouveau_drv.h"
+
+static int
+nouveau_debugfs_channel_info(struct seq_file *m, void *data)
+{
+	struct drm_info_node *node = (struct drm_info_node *) m->private;
+	struct nouveau_channel *chan = node->info_ent->data;
+
+	seq_printf(m, "channel id    : %d\n", chan->id);
+
+	seq_printf(m, "cpu fifo state:\n");
+	seq_printf(m, "          base: 0x%08x\n", chan->pushbuf_base);
+	seq_printf(m, "           max: 0x%08x\n", chan->dma.max << 2);
+	seq_printf(m, "           cur: 0x%08x\n", chan->dma.cur << 2);
+	seq_printf(m, "           put: 0x%08x\n", chan->dma.put << 2);
+	seq_printf(m, "          free: 0x%08x\n", chan->dma.free << 2);
+
+	seq_printf(m, "gpu fifo state:\n");
+	seq_printf(m, "           get: 0x%08x\n",
+					nvchan_rd32(chan, chan->user_get));
+	seq_printf(m, "           put: 0x%08x\n",
+					nvchan_rd32(chan, chan->user_put));
+
+	seq_printf(m, "last fence    : %d\n", chan->fence.sequence);
+	seq_printf(m, "last signalled: %d\n", chan->fence.sequence_ack);
+	return 0;
+}
+
+int
+nouveau_debugfs_channel_init(struct nouveau_channel *chan)
+{
+	struct drm_nouveau_private *dev_priv = chan->dev->dev_private;
+	struct drm_minor *minor = chan->dev->primary;
+	int ret;
+
+	if (!dev_priv->debugfs.channel_root) {
+		dev_priv->debugfs.channel_root =
+			debugfs_create_dir("channel", minor->debugfs_root);
+		if (!dev_priv->debugfs.channel_root)
+			return -ENOENT;
+	}
+
+	snprintf(chan->debugfs.name, 32, "%d", chan->id);
+	chan->debugfs.info.name = chan->debugfs.name;
+	chan->debugfs.info.show = nouveau_debugfs_channel_info;
+	chan->debugfs.info.driver_features = 0;
+	chan->debugfs.info.data = chan;
+
+	ret = drm_debugfs_create_files(&chan->debugfs.info, 1,
+				       dev_priv->debugfs.channel_root,
+				       chan->dev->primary);
+	if (ret == 0)
+		chan->debugfs.active = true;
+	return ret;
+}
+
+void
+nouveau_debugfs_channel_fini(struct nouveau_channel *chan)
+{
+	struct drm_nouveau_private *dev_priv = chan->dev->dev_private;
+
+	if (!chan->debugfs.active)
+		return;
+
+	drm_debugfs_remove_files(&chan->debugfs.info, 1, chan->dev->primary);
+	chan->debugfs.active = false;
+
+	if (chan == dev_priv->channel) {
+		debugfs_remove(dev_priv->debugfs.channel_root);
+		dev_priv->debugfs.channel_root = NULL;
+	}
+}
+
+static int
+nouveau_debugfs_chipset_info(struct seq_file *m, void *data)
+{
+	struct drm_info_node *node = (struct drm_info_node *) m->private;
+	struct drm_minor *minor = node->minor;
+	struct drm_device *dev = minor->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	uint32_t ppci_0;
+
+	ppci_0 = nv_rd32(dev, dev_priv->chipset >= 0x40 ? 0x88000 : 0x1800);
+
+	seq_printf(m, "PMC_BOOT_0: 0x%08x\n", nv_rd32(dev, NV03_PMC_BOOT_0));
+	seq_printf(m, "PCI ID    : 0x%04x:0x%04x\n",
+		   ppci_0 & 0xffff, ppci_0 >> 16);
+	return 0;
+}
+
+static int
+nouveau_debugfs_memory_info(struct seq_file *m, void *data)
+{
+	struct drm_info_node *node = (struct drm_info_node *) m->private;
+	struct drm_minor *minor = node->minor;
+	struct drm_device *dev = minor->dev;
+
+	seq_printf(m, "VRAM total: %dKiB\n",
+		   (int)(nouveau_mem_fb_amount(dev) >> 10));
+	return 0;
+}
+
+static struct drm_info_list nouveau_debugfs_list[] = {
+	{ "chipset", nouveau_debugfs_chipset_info, 0, NULL },
+	{ "memory", nouveau_debugfs_memory_info, 0, NULL },
+};
+#define NOUVEAU_DEBUGFS_ENTRIES ARRAY_SIZE(nouveau_debugfs_list)
+
+int
+nouveau_debugfs_init(struct drm_minor *minor)
+{
+	drm_debugfs_create_files(nouveau_debugfs_list, NOUVEAU_DEBUGFS_ENTRIES,
+				 minor->debugfs_root, minor);
+	return 0;
+}
+
+void
+nouveau_debugfs_takedown(struct drm_minor *minor)
+{
+	drm_debugfs_remove_files(nouveau_debugfs_list, NOUVEAU_DEBUGFS_ENTRIES,
+				 minor);
+}
diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
new file mode 100644
index 000000000000..dfc94391d71e
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -0,0 +1,115 @@
+/*
+ * Copyright (C) 2008 Maarten Maathuis.
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial
+ * portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE COPYRIGHT OWNER(S) AND/OR ITS SUPPLIERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
+#include "drmP.h"
+#include "drm_crtc_helper.h"
+#include "nouveau_drv.h"
+#include "nouveau_fb.h"
+#include "nouveau_fbcon.h"
+
+static void
+nouveau_user_framebuffer_destroy(struct drm_framebuffer *drm_fb)
+{
+	struct nouveau_framebuffer *fb = nouveau_framebuffer(drm_fb);
+	struct drm_device *dev = drm_fb->dev;
+
+	if (drm_fb->fbdev)
+		nouveau_fbcon_remove(dev, drm_fb);
+
+	if (fb->nvbo) {
+		mutex_lock(&dev->struct_mutex);
+		drm_gem_object_unreference(fb->nvbo->gem);
+		mutex_unlock(&dev->struct_mutex);
+	}
+
+	drm_framebuffer_cleanup(drm_fb);
+	kfree(fb);
+}
+
+static int
+nouveau_user_framebuffer_create_handle(struct drm_framebuffer *drm_fb,
+				       struct drm_file *file_priv,
+				       unsigned int *handle)
+{
+	struct nouveau_framebuffer *fb = nouveau_framebuffer(drm_fb);
+
+	return drm_gem_handle_create(file_priv, fb->nvbo->gem, handle);
+}
+
+static const struct drm_framebuffer_funcs nouveau_framebuffer_funcs = {
+	.destroy = nouveau_user_framebuffer_destroy,
+	.create_handle = nouveau_user_framebuffer_create_handle,
+};
+
+struct drm_framebuffer *
+nouveau_framebuffer_create(struct drm_device *dev, struct nouveau_bo *nvbo,
+			   struct drm_mode_fb_cmd *mode_cmd)
+{
+	struct nouveau_framebuffer *fb;
+	int ret;
+
+	fb = kzalloc(sizeof(struct nouveau_framebuffer), GFP_KERNEL);
+	if (!fb)
+		return NULL;
+
+	ret = drm_framebuffer_init(dev, &fb->base, &nouveau_framebuffer_funcs);
+	if (ret) {
+		kfree(fb);
+		return NULL;
+	}
+
+	drm_helper_mode_fill_fb_struct(&fb->base, mode_cmd);
+
+	fb->nvbo = nvbo;
+	return &fb->base;
+}
+
+static struct drm_framebuffer *
+nouveau_user_framebuffer_create(struct drm_device *dev,
+				struct drm_file *file_priv,
+				struct drm_mode_fb_cmd *mode_cmd)
+{
+	struct drm_framebuffer *fb;
+	struct drm_gem_object *gem;
+
+	gem = drm_gem_object_lookup(dev, file_priv, mode_cmd->handle);
+	if (!gem)
+		return NULL;
+
+	fb = nouveau_framebuffer_create(dev, nouveau_gem_object(gem), mode_cmd);
+	if (!fb) {
+		drm_gem_object_unreference(gem);
+		return NULL;
+	}
+
+	return fb;
+}
+
+const struct drm_mode_config_funcs nouveau_mode_config_funcs = {
+	.fb_create = nouveau_user_framebuffer_create,
+	.fb_changed = nouveau_fbcon_probe,
+};
+
diff --git a/drivers/gpu/drm/nouveau/nouveau_dma.c b/drivers/gpu/drm/nouveau/nouveau_dma.c
new file mode 100644
index 000000000000..7afbe8b40d51
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nouveau_dma.c
@@ -0,0 +1,226 @@
+/*
+ * Copyright (C) 2007 Ben Skeggs.
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial
+ * portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE COPYRIGHT OWNER(S) AND/OR ITS SUPPLIERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
+#include "drmP.h"
+#include "drm.h"
+#include "nouveau_drv.h"
+#include "nouveau_dma.h"
+
+void
+nouveau_dma_pre_init(struct nouveau_channel *chan)
+{
+	chan->dma.max  = (chan->pushbuf_bo->bo.mem.size >> 2) - 2;
+	chan->dma.put  = 0;
+	chan->dma.cur  = chan->dma.put;
+	chan->dma.free = chan->dma.max - chan->dma.cur;
+}
+
+int
+nouveau_dma_init(struct nouveau_channel *chan)
+{
+	struct drm_device *dev = chan->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_gpuobj *m2mf = NULL;
+	struct nouveau_gpuobj *nvsw = NULL;
+	int ret, i;
+
+	/* Create NV_MEMORY_TO_MEMORY_FORMAT for buffer moves */
+	ret = nouveau_gpuobj_gr_new(chan, dev_priv->card_type < NV_50 ?
+				    0x0039 : 0x5039, &m2mf);
+	if (ret)
+		return ret;
+
+	ret = nouveau_gpuobj_ref_add(dev, chan, NvM2MF, m2mf, NULL);
+	if (ret)
+		return ret;
+
+	/* Create an NV_SW object for various sync purposes */
+	ret = nouveau_gpuobj_sw_new(chan, NV_SW, &nvsw);
+	if (ret)
+		return ret;
+
+	ret = nouveau_gpuobj_ref_add(dev, chan, NvSw, nvsw, NULL);
+	if (ret)
+		return ret;
+
+	/* NV_MEMORY_TO_MEMORY_FORMAT requires a notifier object */
+	ret = nouveau_notifier_alloc(chan, NvNotify0, 32, &chan->m2mf_ntfy);
+	if (ret)
+		return ret;
+
+	/* Map push buffer */
+	ret = nouveau_bo_map(chan->pushbuf_bo);
+	if (ret)
+		return ret;
+
+	/* Map M2MF notifier object - fbcon. */
+	if (drm_core_check_feature(dev, DRIVER_MODESET)) {
+		ret = nouveau_bo_map(chan->notifier_bo);
+		if (ret)
+			return ret;
+	}
+
+	/* Insert NOPS for NOUVEAU_DMA_SKIPS */
+	ret = RING_SPACE(chan, NOUVEAU_DMA_SKIPS);
+	if (ret)
+		return ret;
+
+	for (i = 0; i < NOUVEAU_DMA_SKIPS; i++)
+		OUT_RING(chan, 0);
+
+	/* Initialise NV_MEMORY_TO_MEMORY_FORMAT */
+	ret = RING_SPACE(chan, 4);
+	if (ret)
+		return ret;
+	BEGIN_RING(chan, NvSubM2MF, NV_MEMORY_TO_MEMORY_FORMAT_NAME, 1);
+	OUT_RING(chan, NvM2MF);
+	BEGIN_RING(chan, NvSubM2MF, NV_MEMORY_TO_MEMORY_FORMAT_DMA_NOTIFY, 1);
+	OUT_RING(chan, NvNotify0);
+
+	/* Initialise NV_SW */
+	ret = RING_SPACE(chan, 2);
+	if (ret)
+		return ret;
+	BEGIN_RING(chan, NvSubSw, 0, 1);
+	OUT_RING(chan, NvSw);
+
+	/* Sit back and pray the channel works.. */
+	FIRE_RING(chan);
+
+	return 0;
+}
+
+void
+OUT_RINGp(struct nouveau_channel *chan, const void *data, unsigned nr_dwords)
+{
+	bool is_iomem;
+	u32 *mem = ttm_kmap_obj_virtual(&chan->pushbuf_bo->kmap, &is_iomem);
+	mem = &mem[chan->dma.cur];
+	if (is_iomem)
+		memcpy_toio((void __force __iomem *)mem, data, nr_dwords * 4);
+	else
+		memcpy(mem, data, nr_dwords * 4);
+	chan->dma.cur += nr_dwords;
+}
+
+static inline bool
+READ_GET(struct nouveau_channel *chan, uint32_t *get)
+{
+	uint32_t val;
+
+	val = nvchan_rd32(chan, chan->user_get);
+	if (val < chan->pushbuf_base ||
+	    val > chan->pushbuf_base + (chan->dma.max << 2)) {
+		/* meaningless to dma_wait() except to know whether the
+		 * GPU has stalled or not
+		 */
+		*get = val;
+		return false;
+	}
+
+	*get = (val - chan->pushbuf_base) >> 2;
+	return true;
+}
+
+int
+nouveau_dma_wait(struct nouveau_channel *chan, int size)
+{
+	uint32_t get, prev_get = 0, cnt = 0;
+	bool get_valid;
+
+	while (chan->dma.free < size) {
+		/* reset counter as long as GET is still advancing, this is
+		 * to avoid misdetecting a GPU lockup if the GPU happens to
+		 * just be processing an operation that takes a long time
+		 */
+		get_valid = READ_GET(chan, &get);
+		if (get != prev_get) {
+			prev_get = get;
+			cnt = 0;
+		}
+
+		if ((++cnt & 0xff) == 0) {
+			DRM_UDELAY(1);
+			if (cnt > 100000)
+				return -EBUSY;
+		}
+
+		/* loop until we have a usable GET pointer.  the value
+		 * we read from the GPU may be outside the main ring if
+		 * PFIFO is processing a buffer called from the main ring,
+		 * discard these values until something sensible is seen.
+		 *
+		 * the other case we discard GET is while the GPU is fetching
+		 * from the SKIPS area, so the code below doesn't have to deal
+		 * with some fun corner cases.
+		 */
+		if (!get_valid || get < NOUVEAU_DMA_SKIPS)
+			continue;
+
+		if (get <= chan->dma.cur) {
+			/* engine is fetching behind us, or is completely
+			 * idle (GET == PUT) so we have free space up until
+			 * the end of the push buffer
+			 *
+			 * we can only hit that path once per call due to
+			 * looping back to the beginning of the push buffer,
+			 * we'll hit the fetching-ahead-of-us path from that
+			 * point on.
+			 *
+			 * the *one* exception to that rule is if we read
+			 * GET==PUT, in which case the below conditional will
+			 * always succeed and break us out of the wait loop.
+			 */
+			chan->dma.free = chan->dma.max - chan->dma.cur;
+			if (chan->dma.free >= size)
+				break;
+
+			/* not enough space left at the end of the push buffer,
+			 * instruct the GPU to jump back to the start right
+			 * after processing the currently pending commands.
+			 */
+			OUT_RING(chan, chan->pushbuf_base | 0x20000000);
+			WRITE_PUT(NOUVEAU_DMA_SKIPS);
+
+			/* we're now submitting commands at the start of
+			 * the push buffer.
+			 */
+			chan->dma.cur  =
+			chan->dma.put  = NOUVEAU_DMA_SKIPS;
+		}
+
+		/* engine fetching ahead of us, we have space up until the
+		 * current GET pointer.  the "- 1" is to ensure there's
+		 * space left to emit a jump back to the beginning of the
+		 * push buffer if we require it.  we can never get GET == PUT
+		 * here, so this is safe.
+		 */
+		chan->dma.free = get - chan->dma.cur - 1;
+	}
+
+	return 0;
+}
+
diff --git a/drivers/gpu/drm/nouveau/nouveau_dma.h b/drivers/gpu/drm/nouveau/nouveau_dma.h
new file mode 100644
index 000000000000..dabfd655f93e
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nouveau_dma.h
@@ -0,0 +1,159 @@
+/*
+ * Copyright (C) 2007 Ben Skeggs.
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial
+ * portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE COPYRIGHT OWNER(S) AND/OR ITS SUPPLIERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
+#ifndef __NOUVEAU_DMA_H__
+#define __NOUVEAU_DMA_H__
+
+#ifndef NOUVEAU_DMA_DEBUG
+#define NOUVEAU_DMA_DEBUG 0
+#endif
+
+/*
+ * There's a hw race condition where you can't jump to your PUT offset,
+ * to avoid this we jump to offset + SKIPS and fill the difference with
+ * NOPs.
+ *
+ * xf86-video-nv configures the DMA fetch size to 32 bytes, and uses
+ * a SKIPS value of 8.  Lets assume that the race condition is to do
+ * with writing into the fetch area, we configure a fetch size of 128
+ * bytes so we need a larger SKIPS value.
+ */
+#define NOUVEAU_DMA_SKIPS (128 / 4)
+
+/* Hardcoded object assignments to subchannels (subchannel id). */
+enum {
+	NvSubM2MF	= 0,
+	NvSubSw		= 1,
+	NvSub2D		= 2,
+	NvSubCtxSurf2D  = 2,
+	NvSubGdiRect    = 3,
+	NvSubImageBlit  = 4
+};
+
+/* Object handles. */
+enum {
+	NvM2MF		= 0x80000001,
+	NvDmaFB		= 0x80000002,
+	NvDmaTT		= 0x80000003,
+	NvDmaVRAM	= 0x80000004,
+	NvDmaGART	= 0x80000005,
+	NvNotify0       = 0x80000006,
+	Nv2D		= 0x80000007,
+	NvCtxSurf2D	= 0x80000008,
+	NvRop		= 0x80000009,
+	NvImagePatt	= 0x8000000a,
+	NvClipRect	= 0x8000000b,
+	NvGdiRect	= 0x8000000c,
+	NvImageBlit	= 0x8000000d,
+	NvSw		= 0x8000000e,
+
+	/* G80+ display objects */
+	NvEvoVRAM	= 0x01000000,
+	NvEvoFB16	= 0x01000001,
+	NvEvoFB32	= 0x01000002
+};
+
+#define NV_MEMORY_TO_MEMORY_FORMAT                                    0x00000039
+#define NV_MEMORY_TO_MEMORY_FORMAT_NAME                               0x00000000
+#define NV_MEMORY_TO_MEMORY_FORMAT_SET_REF                            0x00000050
+#define NV_MEMORY_TO_MEMORY_FORMAT_NOP                                0x00000100
+#define NV_MEMORY_TO_MEMORY_FORMAT_NOTIFY                             0x00000104
+#define NV_MEMORY_TO_MEMORY_FORMAT_NOTIFY_STYLE_WRITE                 0x00000000
+#define NV_MEMORY_TO_MEMORY_FORMAT_NOTIFY_STYLE_WRITE_LE_AWAKEN       0x00000001
+#define NV_MEMORY_TO_MEMORY_FORMAT_DMA_NOTIFY                         0x00000180
+#define NV_MEMORY_TO_MEMORY_FORMAT_DMA_SOURCE                         0x00000184
+#define NV_MEMORY_TO_MEMORY_FORMAT_OFFSET_IN                          0x0000030c
+
+#define NV50_MEMORY_TO_MEMORY_FORMAT                                  0x00005039
+#define NV50_MEMORY_TO_MEMORY_FORMAT_UNK200                           0x00000200
+#define NV50_MEMORY_TO_MEMORY_FORMAT_UNK21C                           0x0000021c
+#define NV50_MEMORY_TO_MEMORY_FORMAT_OFFSET_IN_HIGH                   0x00000238
+#define NV50_MEMORY_TO_MEMORY_FORMAT_OFFSET_OUT_HIGH                  0x0000023c
+
+static __must_check inline int
+RING_SPACE(struct nouveau_channel *chan, int size)
+{
+	if (chan->dma.free < size) {
+		int ret;
+
+		ret = nouveau_dma_wait(chan, size);
+		if (ret)
+			return ret;
+	}
+
+	chan->dma.free -= size;
+	return 0;
+}
+
+static inline void
+OUT_RING(struct nouveau_channel *chan, int data)
+{
+	if (NOUVEAU_DMA_DEBUG) {
+		NV_INFO(chan->dev, "Ch%d/0x%08x: 0x%08x\n",
+			chan->id, chan->dma.cur << 2, data);
+	}
+
+	nouveau_bo_wr32(chan->pushbuf_bo, chan->dma.cur++, data);
+}
+
+extern void
+OUT_RINGp(struct nouveau_channel *chan, const void *data, unsigned nr_dwords);
+
+static inline void
+BEGIN_RING(struct nouveau_channel *chan, int subc, int mthd, int size)
+{
+	OUT_RING(chan, (subc << 13) | (size << 18) | mthd);
+}
+
+#define WRITE_PUT(val) do {                                                    \
+	DRM_MEMORYBARRIER();                                                   \
+	nouveau_bo_rd32(chan->pushbuf_bo, 0);                                  \
+	nvchan_wr32(chan, chan->user_put, ((val) << 2) + chan->pushbuf_base);  \
+} while (0)
+
+static inline void
+FIRE_RING(struct nouveau_channel *chan)
+{
+	if (NOUVEAU_DMA_DEBUG) {
+		NV_INFO(chan->dev, "Ch%d/0x%08x: PUSH!\n",
+			chan->id, chan->dma.cur << 2);
+	}
+
+	if (chan->dma.cur == chan->dma.put)
+		return;
+	chan->accel_done = true;
+
+	WRITE_PUT(chan->dma.cur);
+	chan->dma.put = chan->dma.cur;
+}
+
+static inline void
+WIND_RING(struct nouveau_channel *chan)
+{
+	chan->dma.cur = chan->dma.put;
+}
+
+#endif
diff --git a/drivers/gpu/drm/nouveau/nouveau_dp.c b/drivers/gpu/drm/nouveau/nouveau_dp.c
new file mode 100644
index 000000000000..9e2926c48579
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nouveau_dp.c
@@ -0,0 +1,569 @@
+/*
+ * Copyright 2009 Red Hat Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * Authors: Ben Skeggs
+ */
+
+#include "drmP.h"
+#include "nouveau_drv.h"
+#include "nouveau_i2c.h"
+#include "nouveau_encoder.h"
+
+static int
+auxch_rd(struct drm_encoder *encoder, int address, uint8_t *buf, int size)
+{
+	struct drm_device *dev = encoder->dev;
+	struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
+	struct nouveau_i2c_chan *auxch;
+	int ret;
+
+	auxch = nouveau_i2c_find(dev, nv_encoder->dcb->i2c_index);
+	if (!auxch)
+		return -ENODEV;
+
+	ret = nouveau_dp_auxch(auxch, 9, address, buf, size);
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+static int
+auxch_wr(struct drm_encoder *encoder, int address, uint8_t *buf, int size)
+{
+	struct drm_device *dev = encoder->dev;
+	struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
+	struct nouveau_i2c_chan *auxch;
+	int ret;
+
+	auxch = nouveau_i2c_find(dev, nv_encoder->dcb->i2c_index);
+	if (!auxch)
+		return -ENODEV;
+
+	ret = nouveau_dp_auxch(auxch, 8, address, buf, size);
+	return ret;
+}
+
+static int
+nouveau_dp_lane_count_set(struct drm_encoder *encoder, uint8_t cmd)
+{
+	struct drm_device *dev = encoder->dev;
+	struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
+	uint32_t tmp;
+	int or = nv_encoder->or, link = !(nv_encoder->dcb->sorconf.link & 1);
+
+	tmp  = nv_rd32(dev, NV50_SOR_DP_CTRL(or, link));
+	tmp &= ~(NV50_SOR_DP_CTRL_ENHANCED_FRAME_ENABLED |
+		 NV50_SOR_DP_CTRL_LANE_MASK);
+	tmp |= ((1 << (cmd & DP_LANE_COUNT_MASK)) - 1) << 16;
+	if (cmd & DP_LANE_COUNT_ENHANCED_FRAME_EN)
+		tmp |= NV50_SOR_DP_CTRL_ENHANCED_FRAME_ENABLED;
+	nv_wr32(dev, NV50_SOR_DP_CTRL(or, link), tmp);
+
+	return auxch_wr(encoder, DP_LANE_COUNT_SET, &cmd, 1);
+}
+
+static int
+nouveau_dp_link_bw_set(struct drm_encoder *encoder, uint8_t cmd)
+{
+	struct drm_device *dev = encoder->dev;
+	struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
+	uint32_t tmp;
+	int reg = 0x614300 + (nv_encoder->or * 0x800);
+
+	tmp  = nv_rd32(dev, reg);
+	tmp &= 0xfff3ffff;
+	if (cmd == DP_LINK_BW_2_7)
+		tmp |= 0x00040000;
+	nv_wr32(dev, reg, tmp);
+
+	return auxch_wr(encoder, DP_LINK_BW_SET, &cmd, 1);
+}
+
+static int
+nouveau_dp_link_train_set(struct drm_encoder *encoder, int pattern)
+{
+	struct drm_device *dev = encoder->dev;
+	struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
+	uint32_t tmp;
+	uint8_t cmd;
+	int or = nv_encoder->or, link = !(nv_encoder->dcb->sorconf.link & 1);
+	int ret;
+
+	tmp  = nv_rd32(dev, NV50_SOR_DP_CTRL(or, link));
+	tmp &= ~NV50_SOR_DP_CTRL_TRAINING_PATTERN;
+	tmp |= (pattern << 24);
+	nv_wr32(dev, NV50_SOR_DP_CTRL(or, link), tmp);
+
+	ret = auxch_rd(encoder, DP_TRAINING_PATTERN_SET, &cmd, 1);
+	if (ret)
+		return ret;
+	cmd &= ~DP_TRAINING_PATTERN_MASK;
+	cmd |= (pattern & DP_TRAINING_PATTERN_MASK);
+	return auxch_wr(encoder, DP_TRAINING_PATTERN_SET, &cmd, 1);
+}
+
+static int
+nouveau_dp_max_voltage_swing(struct drm_encoder *encoder)
+{
+	struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
+	struct drm_device *dev = encoder->dev;
+	struct bit_displayport_encoder_table_entry *dpse;
+	struct bit_displayport_encoder_table *dpe;
+	int i, dpe_headerlen, max_vs = 0;
+
+	dpe = nouveau_bios_dp_table(dev, nv_encoder->dcb, &dpe_headerlen);
+	if (!dpe)
+		return false;
+	dpse = (void *)((char *)dpe + dpe_headerlen);
+
+	for (i = 0; i < dpe_headerlen; i++, dpse++) {
+		if (dpse->vs_level > max_vs)
+			max_vs = dpse->vs_level;
+	}
+
+	return max_vs;
+}
+
+static int
+nouveau_dp_max_pre_emphasis(struct drm_encoder *encoder, int vs)
+{
+	struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
+	struct drm_device *dev = encoder->dev;
+	struct bit_displayport_encoder_table_entry *dpse;
+	struct bit_displayport_encoder_table *dpe;
+	int i, dpe_headerlen, max_pre = 0;
+
+	dpe = nouveau_bios_dp_table(dev, nv_encoder->dcb, &dpe_headerlen);
+	if (!dpe)
+		return false;
+	dpse = (void *)((char *)dpe + dpe_headerlen);
+
+	for (i = 0; i < dpe_headerlen; i++, dpse++) {
+		if (dpse->vs_level != vs)
+			continue;
+
+		if (dpse->pre_level > max_pre)
+			max_pre = dpse->pre_level;
+	}
+
+	return max_pre;
+}
+
+static bool
+nouveau_dp_link_train_adjust(struct drm_encoder *encoder, uint8_t *config)
+{
+	struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
+	struct drm_device *dev = encoder->dev;
+	struct bit_displayport_encoder_table_entry *dpse;
+	struct bit_displayport_encoder_table *dpe;
+	int ret, i, dpe_headerlen, vs = 0, pre = 0;
+	uint8_t request[2];
+
+	dpe = nouveau_bios_dp_table(dev, nv_encoder->dcb, &dpe_headerlen);
+	if (!dpe)
+		return false;
+	dpse = (void *)((char *)dpe + dpe_headerlen);
+
+	ret = auxch_rd(encoder, DP_ADJUST_REQUEST_LANE0_1, request, 2);
+	if (ret)
+		return false;
+
+	NV_DEBUG_KMS(dev, "\t\tadjust 0x%02x 0x%02x\n", request[0], request[1]);
+
+	/* Keep all lanes at the same level.. */
+	for (i = 0; i < nv_encoder->dp.link_nr; i++) {
+		int lane_req = (request[i >> 1] >> ((i & 1) << 2)) & 0xf;
+		int lane_vs = lane_req & 3;
+		int lane_pre = (lane_req >> 2) & 3;
+
+		if (lane_vs > vs)
+			vs = lane_vs;
+		if (lane_pre > pre)
+			pre = lane_pre;
+	}
+
+	if (vs >= nouveau_dp_max_voltage_swing(encoder)) {
+		vs  = nouveau_dp_max_voltage_swing(encoder);
+		vs |= 4;
+	}
+
+	if (pre >= nouveau_dp_max_pre_emphasis(encoder, vs & 3)) {
+		pre  = nouveau_dp_max_pre_emphasis(encoder, vs & 3);
+		pre |= 4;
+	}
+
+	/* Update the configuration for all lanes.. */
+	for (i = 0; i < nv_encoder->dp.link_nr; i++)
+		config[i] = (pre << 3) | vs;
+
+	return true;
+}
+
+static bool
+nouveau_dp_link_train_commit(struct drm_encoder *encoder, uint8_t *config)
+{
+	struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
+	struct drm_device *dev = encoder->dev;
+	struct bit_displayport_encoder_table_entry *dpse;
+	struct bit_displayport_encoder_table *dpe;
+	int or = nv_encoder->or, link = !(nv_encoder->dcb->sorconf.link & 1);
+	int dpe_headerlen, ret, i;
+
+	NV_DEBUG_KMS(dev, "\t\tconfig 0x%02x 0x%02x 0x%02x 0x%02x\n",
+		 config[0], config[1], config[2], config[3]);
+
+	dpe = nouveau_bios_dp_table(dev, nv_encoder->dcb, &dpe_headerlen);
+	if (!dpe)
+		return false;
+	dpse = (void *)((char *)dpe + dpe_headerlen);
+
+	for (i = 0; i < dpe->record_nr; i++, dpse++) {
+		if (dpse->vs_level == (config[0] & 3) &&
+		    dpse->pre_level == ((config[0] >> 3) & 3))
+			break;
+	}
+	BUG_ON(i == dpe->record_nr);
+
+	for (i = 0; i < nv_encoder->dp.link_nr; i++) {
+		const int shift[4] = { 16, 8, 0, 24 };
+		uint32_t mask = 0xff << shift[i];
+		uint32_t reg0, reg1, reg2;
+
+		reg0  = nv_rd32(dev, NV50_SOR_DP_UNK118(or, link)) & ~mask;
+		reg0 |= (dpse->reg0 << shift[i]);
+		reg1  = nv_rd32(dev, NV50_SOR_DP_UNK120(or, link)) & ~mask;
+		reg1 |= (dpse->reg1 << shift[i]);
+		reg2  = nv_rd32(dev, NV50_SOR_DP_UNK130(or, link)) & 0xffff00ff;
+		reg2 |= (dpse->reg2 << 8);
+		nv_wr32(dev, NV50_SOR_DP_UNK118(or, link), reg0);
+		nv_wr32(dev, NV50_SOR_DP_UNK120(or, link), reg1);
+		nv_wr32(dev, NV50_SOR_DP_UNK130(or, link), reg2);
+	}
+
+	ret = auxch_wr(encoder, DP_TRAINING_LANE0_SET, config, 4);
+	if (ret)
+		return false;
+
+	return true;
+}
+
+bool
+nouveau_dp_link_train(struct drm_encoder *encoder)
+{
+	struct drm_device *dev = encoder->dev;
+	struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
+	uint8_t config[4];
+	uint8_t status[3];
+	bool cr_done, cr_max_vs, eq_done;
+	int ret = 0, i, tries, voltage;
+
+	NV_DEBUG_KMS(dev, "link training!!\n");
+train:
+	cr_done = eq_done = false;
+
+	/* set link configuration */
+	NV_DEBUG_KMS(dev, "\tbegin train: bw %d, lanes %d\n",
+		 nv_encoder->dp.link_bw, nv_encoder->dp.link_nr);
+
+	ret = nouveau_dp_link_bw_set(encoder, nv_encoder->dp.link_bw);
+	if (ret)
+		return false;
+
+	config[0] = nv_encoder->dp.link_nr;
+	if (nv_encoder->dp.dpcd_version >= 0x11)
+		config[0] |= DP_LANE_COUNT_ENHANCED_FRAME_EN;
+
+	ret = nouveau_dp_lane_count_set(encoder, config[0]);
+	if (ret)
+		return false;
+
+	/* clock recovery */
+	NV_DEBUG_KMS(dev, "\tbegin cr\n");
+	ret = nouveau_dp_link_train_set(encoder, DP_TRAINING_PATTERN_1);
+	if (ret)
+		goto stop;
+
+	tries = 0;
+	voltage = -1;
+	memset(config, 0x00, sizeof(config));
+	for (;;) {
+		if (!nouveau_dp_link_train_commit(encoder, config))
+			break;
+
+		udelay(100);
+
+		ret = auxch_rd(encoder, DP_LANE0_1_STATUS, status, 2);
+		if (ret)
+			break;
+		NV_DEBUG_KMS(dev, "\t\tstatus: 0x%02x 0x%02x\n",
+			 status[0], status[1]);
+
+		cr_done = true;
+		cr_max_vs = false;
+		for (i = 0; i < nv_encoder->dp.link_nr; i++) {
+			int lane = (status[i >> 1] >> ((i & 1) * 4)) & 0xf;
+
+			if (!(lane & DP_LANE_CR_DONE)) {
+				cr_done = false;
+				if (config[i] & DP_TRAIN_MAX_PRE_EMPHASIS_REACHED)
+					cr_max_vs = true;
+				break;
+			}
+		}
+
+		if ((config[0] & DP_TRAIN_VOLTAGE_SWING_MASK) != voltage) {
+			voltage = config[0] & DP_TRAIN_VOLTAGE_SWING_MASK;
+			tries = 0;
+		}
+
+		if (cr_done || cr_max_vs || (++tries == 5))
+			break;
+
+		if (!nouveau_dp_link_train_adjust(encoder, config))
+			break;
+	}
+
+	if (!cr_done)
+		goto stop;
+
+	/* channel equalisation */
+	NV_DEBUG_KMS(dev, "\tbegin eq\n");
+	ret = nouveau_dp_link_train_set(encoder, DP_TRAINING_PATTERN_2);
+	if (ret)
+		goto stop;
+
+	for (tries = 0; tries <= 5; tries++) {
+		udelay(400);
+
+		ret = auxch_rd(encoder, DP_LANE0_1_STATUS, status, 3);
+		if (ret)
+			break;
+		NV_DEBUG_KMS(dev, "\t\tstatus: 0x%02x 0x%02x\n",
+			 status[0], status[1]);
+
+		eq_done = true;
+		if (!(status[2] & DP_INTERLANE_ALIGN_DONE))
+			eq_done = false;
+
+		for (i = 0; eq_done && i < nv_encoder->dp.link_nr; i++) {
+			int lane = (status[i >> 1] >> ((i & 1) * 4)) & 0xf;
+
+			if (!(lane & DP_LANE_CR_DONE)) {
+				cr_done = false;
+				break;
+			}
+
+			if (!(lane & DP_LANE_CHANNEL_EQ_DONE) ||
+			    !(lane & DP_LANE_SYMBOL_LOCKED)) {
+				eq_done = false;
+				break;
+			}
+		}
+
+		if (eq_done || !cr_done)
+			break;
+
+		if (!nouveau_dp_link_train_adjust(encoder, config) ||
+		    !nouveau_dp_link_train_commit(encoder, config))
+			break;
+	}
+
+stop:
+	/* end link training */
+	ret = nouveau_dp_link_train_set(encoder, DP_TRAINING_PATTERN_DISABLE);
+	if (ret)
+		return false;
+
+	/* retry at a lower setting, if possible */
+	if (!ret && !(eq_done && cr_done)) {
+		NV_DEBUG_KMS(dev, "\twe failed\n");
+		if (nv_encoder->dp.link_bw != DP_LINK_BW_1_62) {
+			NV_DEBUG_KMS(dev, "retry link training at low rate\n");
+			nv_encoder->dp.link_bw = DP_LINK_BW_1_62;
+			goto train;
+		}
+	}
+
+	return eq_done;
+}
+
+bool
+nouveau_dp_detect(struct drm_encoder *encoder)
+{
+	struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
+	struct drm_device *dev = encoder->dev;
+	uint8_t dpcd[4];
+	int ret;
+
+	ret = auxch_rd(encoder, 0x0000, dpcd, 4);
+	if (ret)
+		return false;
+
+	NV_DEBUG_KMS(dev, "encoder: link_bw %d, link_nr %d\n"
+		      "display: link_bw %d, link_nr %d version 0x%02x\n",
+		 nv_encoder->dcb->dpconf.link_bw,
+		 nv_encoder->dcb->dpconf.link_nr,
+		 dpcd[1], dpcd[2] & 0x0f, dpcd[0]);
+
+	nv_encoder->dp.dpcd_version = dpcd[0];
+
+	nv_encoder->dp.link_bw = dpcd[1];
+	if (nv_encoder->dp.link_bw != DP_LINK_BW_1_62 &&
+	    !nv_encoder->dcb->dpconf.link_bw)
+		nv_encoder->dp.link_bw = DP_LINK_BW_1_62;
+
+	nv_encoder->dp.link_nr = dpcd[2] & 0xf;
+	if (nv_encoder->dp.link_nr > nv_encoder->dcb->dpconf.link_nr)
+		nv_encoder->dp.link_nr = nv_encoder->dcb->dpconf.link_nr;
+
+	return true;
+}
+
+int
+nouveau_dp_auxch(struct nouveau_i2c_chan *auxch, int cmd, int addr,
+		 uint8_t *data, int data_nr)
+{
+	struct drm_device *dev = auxch->dev;
+	uint32_t tmp, ctrl, stat = 0, data32[4] = {};
+	int ret = 0, i, index = auxch->rd;
+
+	NV_DEBUG_KMS(dev, "ch %d cmd %d addr 0x%x len %d\n", index, cmd, addr, data_nr);
+
+	tmp = nv_rd32(dev, NV50_AUXCH_CTRL(auxch->rd));
+	nv_wr32(dev, NV50_AUXCH_CTRL(auxch->rd), tmp | 0x00100000);
+	tmp = nv_rd32(dev, NV50_AUXCH_CTRL(auxch->rd));
+	if (!(tmp & 0x01000000)) {
+		NV_ERROR(dev, "expected bit 24 == 1, got 0x%08x\n", tmp);
+		ret = -EIO;
+		goto out;
+	}
+
+	for (i = 0; i < 3; i++) {
+		tmp = nv_rd32(dev, NV50_AUXCH_STAT(auxch->rd));
+		if (tmp & NV50_AUXCH_STAT_STATE_READY)
+			break;
+		udelay(100);
+	}
+
+	if (i == 3) {
+		ret = -EBUSY;
+		goto out;
+	}
+
+	if (!(cmd & 1)) {
+		memcpy(data32, data, data_nr);
+		for (i = 0; i < 4; i++) {
+			NV_DEBUG_KMS(dev, "wr %d: 0x%08x\n", i, data32[i]);
+			nv_wr32(dev, NV50_AUXCH_DATA_OUT(index, i), data32[i]);
+		}
+	}
+
+	nv_wr32(dev, NV50_AUXCH_ADDR(index), addr);
+	ctrl  = nv_rd32(dev, NV50_AUXCH_CTRL(index));
+	ctrl &= ~(NV50_AUXCH_CTRL_CMD | NV50_AUXCH_CTRL_LEN);
+	ctrl |= (cmd << NV50_AUXCH_CTRL_CMD_SHIFT);
+	ctrl |= ((data_nr - 1) << NV50_AUXCH_CTRL_LEN_SHIFT);
+
+	for (;;) {
+		nv_wr32(dev, NV50_AUXCH_CTRL(index), ctrl | 0x80000000);
+		nv_wr32(dev, NV50_AUXCH_CTRL(index), ctrl);
+		nv_wr32(dev, NV50_AUXCH_CTRL(index), ctrl | 0x00010000);
+		if (!nv_wait(NV50_AUXCH_CTRL(index), 0x00010000, 0x00000000)) {
+			NV_ERROR(dev, "expected bit 16 == 0, got 0x%08x\n",
+				 nv_rd32(dev, NV50_AUXCH_CTRL(index)));
+			return -EBUSY;
+		}
+
+		udelay(400);
+
+		stat = nv_rd32(dev, NV50_AUXCH_STAT(index));
+		if ((stat & NV50_AUXCH_STAT_REPLY_AUX) !=
+			    NV50_AUXCH_STAT_REPLY_AUX_DEFER)
+			break;
+	}
+
+	if (cmd & 1) {
+		for (i = 0; i < 4; i++) {
+			data32[i] = nv_rd32(dev, NV50_AUXCH_DATA_IN(index, i));
+			NV_DEBUG_KMS(dev, "rd %d: 0x%08x\n", i, data32[i]);
+		}
+		memcpy(data, data32, data_nr);
+	}
+
+out:
+	tmp = nv_rd32(dev, NV50_AUXCH_CTRL(auxch->rd));
+	nv_wr32(dev, NV50_AUXCH_CTRL(auxch->rd), tmp & ~0x00100000);
+	tmp = nv_rd32(dev, NV50_AUXCH_CTRL(auxch->rd));
+	if (tmp & 0x01000000) {
+		NV_ERROR(dev, "expected bit 24 == 0, got 0x%08x\n", tmp);
+		ret = -EIO;
+	}
+
+	udelay(400);
+
+	return ret ? ret : (stat & NV50_AUXCH_STAT_REPLY);
+}
+
+int
+nouveau_dp_i2c_aux_ch(struct i2c_adapter *adapter, int mode,
+		      uint8_t write_byte, uint8_t *read_byte)
+{
+	struct i2c_algo_dp_aux_data *algo_data = adapter->algo_data;
+	struct nouveau_i2c_chan *auxch = (struct nouveau_i2c_chan *)adapter;
+	struct drm_device *dev = auxch->dev;
+	int ret = 0, cmd, addr = algo_data->address;
+	uint8_t *buf;
+
+	if (mode == MODE_I2C_READ) {
+		cmd = AUX_I2C_READ;
+		buf = read_byte;
+	} else {
+		cmd = (mode & MODE_I2C_READ) ? AUX_I2C_READ : AUX_I2C_WRITE;
+		buf = &write_byte;
+	}
+
+	if (!(mode & MODE_I2C_STOP))
+		cmd |= AUX_I2C_MOT;
+
+	if (mode & MODE_I2C_START)
+		return 1;
+
+	for (;;) {
+		ret = nouveau_dp_auxch(auxch, cmd, addr, buf, 1);
+		if (ret < 0)
+			return ret;
+
+		switch (ret & NV50_AUXCH_STAT_REPLY_I2C) {
+		case NV50_AUXCH_STAT_REPLY_I2C_ACK:
+			return 1;
+		case NV50_AUXCH_STAT_REPLY_I2C_NACK:
+			return -EREMOTEIO;
+		case NV50_AUXCH_STAT_REPLY_I2C_DEFER:
+			udelay(100);
+			break;
+		default:
+			NV_ERROR(dev, "invalid auxch status: 0x%08x\n", ret);
+			return -EREMOTEIO;
+		}
+	}
+}
+
diff --git a/drivers/gpu/drm/nouveau/nouveau_drv.c b/drivers/gpu/drm/nouveau/nouveau_drv.c
new file mode 100644
index 000000000000..06eb993e0883
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nouveau_drv.c
@@ -0,0 +1,409 @@
+/*
+ * Copyright 2005 Stephane Marchesin.
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * VA LINUX SYSTEMS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#include <linux/console.h>
+
+#include "drmP.h"
+#include "drm.h"
+#include "drm_crtc_helper.h"
+#include "nouveau_drv.h"
+#include "nouveau_hw.h"
+#include "nouveau_fb.h"
+#include "nouveau_fbcon.h"
+#include "nv50_display.h"
+
+#include "drm_pciids.h"
+
+MODULE_PARM_DESC(ctxfw, "Use external firmware blob for grctx init (NV40)");
+int nouveau_ctxfw = 0;
+module_param_named(ctxfw, nouveau_ctxfw, int, 0400);
+
+MODULE_PARM_DESC(noagp, "Disable AGP");
+int nouveau_noagp;
+module_param_named(noagp, nouveau_noagp, int, 0400);
+
+MODULE_PARM_DESC(modeset, "Enable kernel modesetting");
+static int nouveau_modeset = -1; /* kms */
+module_param_named(modeset, nouveau_modeset, int, 0400);
+
+MODULE_PARM_DESC(vbios, "Override default VBIOS location");
+char *nouveau_vbios;
+module_param_named(vbios, nouveau_vbios, charp, 0400);
+
+MODULE_PARM_DESC(vram_pushbuf, "Force DMA push buffers to be in VRAM");
+int nouveau_vram_pushbuf;
+module_param_named(vram_pushbuf, nouveau_vram_pushbuf, int, 0400);
+
+MODULE_PARM_DESC(vram_notify, "Force DMA notifiers to be in VRAM");
+int nouveau_vram_notify;
+module_param_named(vram_notify, nouveau_vram_notify, int, 0400);
+
+MODULE_PARM_DESC(duallink, "Allow dual-link TMDS (>=GeForce 8)");
+int nouveau_duallink = 1;
+module_param_named(duallink, nouveau_duallink, int, 0400);
+
+MODULE_PARM_DESC(uscript_lvds, "LVDS output script table ID (>=GeForce 8)");
+int nouveau_uscript_lvds = -1;
+module_param_named(uscript_lvds, nouveau_uscript_lvds, int, 0400);
+
+MODULE_PARM_DESC(uscript_tmds, "TMDS output script table ID (>=GeForce 8)");
+int nouveau_uscript_tmds = -1;
+module_param_named(uscript_tmds, nouveau_uscript_tmds, int, 0400);
+
+MODULE_PARM_DESC(tv_norm, "Default TV norm.\n"
+		 "\t\tSupported: PAL, PAL-M, PAL-N, PAL-Nc, NTSC-M, NTSC-J,\n"
+		 "\t\t\thd480i, hd480p, hd576i, hd576p, hd720p, hd1080i.\n"
+		 "\t\tDefault: PAL\n"
+		 "\t\t*NOTE* Ignored for cards with external TV encoders.");
+char *nouveau_tv_norm;
+module_param_named(tv_norm, nouveau_tv_norm, charp, 0400);
+
+MODULE_PARM_DESC(reg_debug, "Register access debug bitmask:\n"
+		"\t\t0x1 mc, 0x2 video, 0x4 fb, 0x8 extdev,\n"
+		"\t\t0x10 crtc, 0x20 ramdac, 0x40 vgacrtc, 0x80 rmvio,\n"
+		"\t\t0x100 vgaattr, 0x200 EVO (G80+). ");
+int nouveau_reg_debug;
+module_param_named(reg_debug, nouveau_reg_debug, int, 0600);
+
+int nouveau_fbpercrtc;
+#if 0
+module_param_named(fbpercrtc, nouveau_fbpercrtc, int, 0400);
+#endif
+
+static struct pci_device_id pciidlist[] = {
+	{
+		PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID),
+		.class = PCI_BASE_CLASS_DISPLAY << 16,
+		.class_mask  = 0xff << 16,
+	},
+	{
+		PCI_DEVICE(PCI_VENDOR_ID_NVIDIA_SGS, PCI_ANY_ID),
+		.class = PCI_BASE_CLASS_DISPLAY << 16,
+		.class_mask  = 0xff << 16,
+	},
+	{}
+};
+
+MODULE_DEVICE_TABLE(pci, pciidlist);
+
+static struct drm_driver driver;
+
+static int __devinit
+nouveau_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+{
+	return drm_get_dev(pdev, ent, &driver);
+}
+
+static void
+nouveau_pci_remove(struct pci_dev *pdev)
+{
+	struct drm_device *dev = pci_get_drvdata(pdev);
+
+	drm_put_dev(dev);
+}
+
+static int
+nouveau_pci_suspend(struct pci_dev *pdev, pm_message_t pm_state)
+{
+	struct drm_device *dev = pci_get_drvdata(pdev);
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_instmem_engine *pinstmem = &dev_priv->engine.instmem;
+	struct nouveau_pgraph_engine *pgraph = &dev_priv->engine.graph;
+	struct nouveau_fifo_engine *pfifo = &dev_priv->engine.fifo;
+	struct nouveau_channel *chan;
+	struct drm_crtc *crtc;
+	uint32_t fbdev_flags;
+	int ret, i;
+
+	if (!drm_core_check_feature(dev, DRIVER_MODESET))
+		return -ENODEV;
+
+	if (pm_state.event == PM_EVENT_PRETHAW)
+		return 0;
+
+	fbdev_flags = dev_priv->fbdev_info->flags;
+	dev_priv->fbdev_info->flags |= FBINFO_HWACCEL_DISABLED;
+
+	list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
+		struct nouveau_framebuffer *nouveau_fb;
+
+		nouveau_fb = nouveau_framebuffer(crtc->fb);
+		if (!nouveau_fb || !nouveau_fb->nvbo)
+			continue;
+
+		nouveau_bo_unpin(nouveau_fb->nvbo);
+	}
+
+	NV_INFO(dev, "Evicting buffers...\n");
+	ttm_bo_evict_mm(&dev_priv->ttm.bdev, TTM_PL_VRAM);
+
+	NV_INFO(dev, "Idling channels...\n");
+	for (i = 0; i < pfifo->channels; i++) {
+		struct nouveau_fence *fence = NULL;
+
+		chan = dev_priv->fifos[i];
+		if (!chan || (dev_priv->card_type >= NV_50 &&
+			      chan == dev_priv->fifos[0]))
+			continue;
+
+		ret = nouveau_fence_new(chan, &fence, true);
+		if (ret == 0) {
+			ret = nouveau_fence_wait(fence, NULL, false, false);
+			nouveau_fence_unref((void *)&fence);
+		}
+
+		if (ret) {
+			NV_ERROR(dev, "Failed to idle channel %d for suspend\n",
+				 chan->id);
+		}
+	}
+
+	pgraph->fifo_access(dev, false);
+	nouveau_wait_for_idle(dev);
+	pfifo->reassign(dev, false);
+	pfifo->disable(dev);
+	pfifo->unload_context(dev);
+	pgraph->unload_context(dev);
+
+	NV_INFO(dev, "Suspending GPU objects...\n");
+	ret = nouveau_gpuobj_suspend(dev);
+	if (ret) {
+		NV_ERROR(dev, "... failed: %d\n", ret);
+		goto out_abort;
+	}
+
+	ret = pinstmem->suspend(dev);
+	if (ret) {
+		NV_ERROR(dev, "... failed: %d\n", ret);
+		nouveau_gpuobj_suspend_cleanup(dev);
+		goto out_abort;
+	}
+
+	NV_INFO(dev, "And we're gone!\n");
+	pci_save_state(pdev);
+	if (pm_state.event == PM_EVENT_SUSPEND) {
+		pci_disable_device(pdev);
+		pci_set_power_state(pdev, PCI_D3hot);
+	}
+
+	acquire_console_sem();
+	fb_set_suspend(dev_priv->fbdev_info, 1);
+	release_console_sem();
+	dev_priv->fbdev_info->flags = fbdev_flags;
+	return 0;
+
+out_abort:
+	NV_INFO(dev, "Re-enabling acceleration..\n");
+	pfifo->enable(dev);
+	pfifo->reassign(dev, true);
+	pgraph->fifo_access(dev, true);
+	return ret;
+}
+
+static int
+nouveau_pci_resume(struct pci_dev *pdev)
+{
+	struct drm_device *dev = pci_get_drvdata(pdev);
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_engine *engine = &dev_priv->engine;
+	struct drm_crtc *crtc;
+	uint32_t fbdev_flags;
+	int ret, i;
+
+	if (!drm_core_check_feature(dev, DRIVER_MODESET))
+		return -ENODEV;
+
+	fbdev_flags = dev_priv->fbdev_info->flags;
+	dev_priv->fbdev_info->flags |= FBINFO_HWACCEL_DISABLED;
+
+	NV_INFO(dev, "We're back, enabling device...\n");
+	pci_set_power_state(pdev, PCI_D0);
+	pci_restore_state(pdev);
+	if (pci_enable_device(pdev))
+		return -1;
+	pci_set_master(dev->pdev);
+
+	NV_INFO(dev, "POSTing device...\n");
+	ret = nouveau_run_vbios_init(dev);
+	if (ret)
+		return ret;
+
+	if (dev_priv->gart_info.type == NOUVEAU_GART_AGP) {
+		ret = nouveau_mem_init_agp(dev);
+		if (ret) {
+			NV_ERROR(dev, "error reinitialising AGP: %d\n", ret);
+			return ret;
+		}
+	}
+
+	NV_INFO(dev, "Reinitialising engines...\n");
+	engine->instmem.resume(dev);
+	engine->mc.init(dev);
+	engine->timer.init(dev);
+	engine->fb.init(dev);
+	engine->graph.init(dev);
+	engine->fifo.init(dev);
+
+	NV_INFO(dev, "Restoring GPU objects...\n");
+	nouveau_gpuobj_resume(dev);
+
+	nouveau_irq_postinstall(dev);
+
+	/* Re-write SKIPS, they'll have been lost over the suspend */
+	if (nouveau_vram_pushbuf) {
+		struct nouveau_channel *chan;
+		int j;
+
+		for (i = 0; i < dev_priv->engine.fifo.channels; i++) {
+			chan = dev_priv->fifos[i];
+			if (!chan || !chan->pushbuf_bo)
+				continue;
+
+			for (j = 0; j < NOUVEAU_DMA_SKIPS; j++)
+				nouveau_bo_wr32(chan->pushbuf_bo, i, 0);
+		}
+	}
+
+	NV_INFO(dev, "Restoring mode...\n");
+	list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
+		struct nouveau_framebuffer *nouveau_fb;
+
+		nouveau_fb = nouveau_framebuffer(crtc->fb);
+		if (!nouveau_fb || !nouveau_fb->nvbo)
+			continue;
+
+		nouveau_bo_pin(nouveau_fb->nvbo, TTM_PL_FLAG_VRAM);
+	}
+
+	if (dev_priv->card_type < NV_50) {
+		nv04_display_restore(dev);
+		NVLockVgaCrtcs(dev, false);
+	} else
+		nv50_display_init(dev);
+
+	/* Force CLUT to get re-loaded during modeset */
+	list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
+		struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
+
+		nv_crtc->lut.depth = 0;
+	}
+
+	acquire_console_sem();
+	fb_set_suspend(dev_priv->fbdev_info, 0);
+	release_console_sem();
+
+	nouveau_fbcon_zfill(dev);
+
+	drm_helper_resume_force_mode(dev);
+	dev_priv->fbdev_info->flags = fbdev_flags;
+	return 0;
+}
+
+static struct drm_driver driver = {
+	.driver_features =
+		DRIVER_USE_AGP | DRIVER_PCI_DMA | DRIVER_SG |
+		DRIVER_HAVE_IRQ | DRIVER_IRQ_SHARED | DRIVER_GEM,
+	.load = nouveau_load,
+	.firstopen = nouveau_firstopen,
+	.lastclose = nouveau_lastclose,
+	.unload = nouveau_unload,
+	.preclose = nouveau_preclose,
+#if defined(CONFIG_DRM_NOUVEAU_DEBUG)
+	.debugfs_init = nouveau_debugfs_init,
+	.debugfs_cleanup = nouveau_debugfs_takedown,
+#endif
+	.irq_preinstall = nouveau_irq_preinstall,
+	.irq_postinstall = nouveau_irq_postinstall,
+	.irq_uninstall = nouveau_irq_uninstall,
+	.irq_handler = nouveau_irq_handler,
+	.reclaim_buffers = drm_core_reclaim_buffers,
+	.get_map_ofs = drm_core_get_map_ofs,
+	.get_reg_ofs = drm_core_get_reg_ofs,
+	.ioctls = nouveau_ioctls,
+	.fops = {
+		.owner = THIS_MODULE,
+		.open = drm_open,
+		.release = drm_release,
+		.unlocked_ioctl = drm_ioctl,
+		.mmap = nouveau_ttm_mmap,
+		.poll = drm_poll,
+		.fasync = drm_fasync,
+#if defined(CONFIG_COMPAT)
+		.compat_ioctl = nouveau_compat_ioctl,
+#endif
+	},
+	.pci_driver = {
+		.name = DRIVER_NAME,
+		.id_table = pciidlist,
+		.probe = nouveau_pci_probe,
+		.remove = nouveau_pci_remove,
+		.suspend = nouveau_pci_suspend,
+		.resume = nouveau_pci_resume
+	},
+
+	.gem_init_object = nouveau_gem_object_new,
+	.gem_free_object = nouveau_gem_object_del,
+
+	.name = DRIVER_NAME,
+	.desc = DRIVER_DESC,
+#ifdef GIT_REVISION
+	.date = GIT_REVISION,
+#else
+	.date = DRIVER_DATE,
+#endif
+	.major = DRIVER_MAJOR,
+	.minor = DRIVER_MINOR,
+	.patchlevel = DRIVER_PATCHLEVEL,
+};
+
+static int __init nouveau_init(void)
+{
+	driver.num_ioctls = nouveau_max_ioctl;
+
+	if (nouveau_modeset == -1) {
+#ifdef CONFIG_VGA_CONSOLE
+		if (vgacon_text_force())
+			nouveau_modeset = 0;
+		else
+#endif
+			nouveau_modeset = 1;
+	}
+
+	if (nouveau_modeset == 1)
+		driver.driver_features |= DRIVER_MODESET;
+
+	return drm_init(&driver);
+}
+
+static void __exit nouveau_exit(void)
+{
+	drm_exit(&driver);
+}
+
+module_init(nouveau_init);
+module_exit(nouveau_exit);
+
+MODULE_AUTHOR(DRIVER_AUTHOR);
+MODULE_DESCRIPTION(DRIVER_DESC);
+MODULE_LICENSE("GPL and additional rights");
diff --git a/drivers/gpu/drm/nouveau/nouveau_drv.h b/drivers/gpu/drm/nouveau/nouveau_drv.h
new file mode 100644
index 000000000000..026419fe8791
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nouveau_drv.h
@@ -0,0 +1,1345 @@
+/*
+ * Copyright 2005 Stephane Marchesin.
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * VA LINUX SYSTEMS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#ifndef __NOUVEAU_DRV_H__
+#define __NOUVEAU_DRV_H__
+
+#define DRIVER_AUTHOR		"Stephane Marchesin"
+#define DRIVER_EMAIL		"dri-devel@lists.sourceforge.net"
+
+#define DRIVER_NAME		"nouveau"
+#define DRIVER_DESC		"nVidia Riva/TNT/GeForce"
+#define DRIVER_DATE		"20090420"
+
+#define DRIVER_MAJOR		0
+#define DRIVER_MINOR		0
+#define DRIVER_PATCHLEVEL	15
+
+#define NOUVEAU_FAMILY   0x0000FFFF
+#define NOUVEAU_FLAGS    0xFFFF0000
+
+#include "ttm/ttm_bo_api.h"
+#include "ttm/ttm_bo_driver.h"
+#include "ttm/ttm_placement.h"
+#include "ttm/ttm_memory.h"
+#include "ttm/ttm_module.h"
+
+struct nouveau_fpriv {
+	struct ttm_object_file *tfile;
+};
+
+#define DRM_FILE_PAGE_OFFSET (0x100000000ULL >> PAGE_SHIFT)
+
+#include "nouveau_drm.h"
+#include "nouveau_reg.h"
+#include "nouveau_bios.h"
+struct nouveau_grctx;
+
+#define MAX_NUM_DCB_ENTRIES 16
+
+#define NOUVEAU_MAX_CHANNEL_NR 128
+#define NOUVEAU_MAX_TILE_NR 15
+
+#define NV50_VM_MAX_VRAM (2*1024*1024*1024ULL)
+#define NV50_VM_BLOCK    (512*1024*1024ULL)
+#define NV50_VM_VRAM_NR  (NV50_VM_MAX_VRAM / NV50_VM_BLOCK)
+
+struct nouveau_tile_reg {
+	struct nouveau_fence *fence;
+	uint32_t addr;
+	uint32_t size;
+	bool used;
+};
+
+struct nouveau_bo {
+	struct ttm_buffer_object bo;
+	struct ttm_placement placement;
+	u32 placements[3];
+	struct ttm_bo_kmap_obj kmap;
+	struct list_head head;
+
+	/* protected by ttm_bo_reserve() */
+	struct drm_file *reserved_by;
+	struct list_head entry;
+	int pbbo_index;
+
+	struct nouveau_channel *channel;
+
+	bool mappable;
+	bool no_vm;
+
+	uint32_t tile_mode;
+	uint32_t tile_flags;
+	struct nouveau_tile_reg *tile;
+
+	struct drm_gem_object *gem;
+	struct drm_file *cpu_filp;
+	int pin_refcnt;
+};
+
+static inline struct nouveau_bo *
+nouveau_bo(struct ttm_buffer_object *bo)
+{
+	return container_of(bo, struct nouveau_bo, bo);
+}
+
+static inline struct nouveau_bo *
+nouveau_gem_object(struct drm_gem_object *gem)
+{
+	return gem ? gem->driver_private : NULL;
+}
+
+/* TODO: submit equivalent to TTM generic API upstream? */
+static inline void __iomem *
+nvbo_kmap_obj_iovirtual(struct nouveau_bo *nvbo)
+{
+	bool is_iomem;
+	void __iomem *ioptr = (void __force __iomem *)ttm_kmap_obj_virtual(
+						&nvbo->kmap, &is_iomem);
+	WARN_ON_ONCE(ioptr && !is_iomem);
+	return ioptr;
+}
+
+struct mem_block {
+	struct mem_block *next;
+	struct mem_block *prev;
+	uint64_t start;
+	uint64_t size;
+	struct drm_file *file_priv; /* NULL: free, -1: heap, other: real files */
+};
+
+enum nouveau_flags {
+	NV_NFORCE   = 0x10000000,
+	NV_NFORCE2  = 0x20000000
+};
+
+#define NVOBJ_ENGINE_SW		0
+#define NVOBJ_ENGINE_GR		1
+#define NVOBJ_ENGINE_DISPLAY	2
+#define NVOBJ_ENGINE_INT	0xdeadbeef
+
+#define NVOBJ_FLAG_ALLOW_NO_REFS	(1 << 0)
+#define NVOBJ_FLAG_ZERO_ALLOC		(1 << 1)
+#define NVOBJ_FLAG_ZERO_FREE		(1 << 2)
+#define NVOBJ_FLAG_FAKE			(1 << 3)
+struct nouveau_gpuobj {
+	struct list_head list;
+
+	struct nouveau_channel *im_channel;
+	struct mem_block *im_pramin;
+	struct nouveau_bo *im_backing;
+	uint32_t im_backing_start;
+	uint32_t *im_backing_suspend;
+	int im_bound;
+
+	uint32_t flags;
+	int refcount;
+
+	uint32_t engine;
+	uint32_t class;
+
+	void (*dtor)(struct drm_device *, struct nouveau_gpuobj *);
+	void *priv;
+};
+
+struct nouveau_gpuobj_ref {
+	struct list_head list;
+
+	struct nouveau_gpuobj *gpuobj;
+	uint32_t instance;
+
+	struct nouveau_channel *channel;
+	int handle;
+};
+
+struct nouveau_channel {
+	struct drm_device *dev;
+	int id;
+
+	/* owner of this fifo */
+	struct drm_file *file_priv;
+	/* mapping of the fifo itself */
+	struct drm_local_map *map;
+
+	/* mapping of the regs controling the fifo */
+	void __iomem *user;
+	uint32_t user_get;
+	uint32_t user_put;
+
+	/* Fencing */
+	struct {
+		/* lock protects the pending list only */
+		spinlock_t lock;
+		struct list_head pending;
+		uint32_t sequence;
+		uint32_t sequence_ack;
+		uint32_t last_sequence_irq;
+	} fence;
+
+	/* DMA push buffer */
+	struct nouveau_gpuobj_ref *pushbuf;
+	struct nouveau_bo         *pushbuf_bo;
+	uint32_t                   pushbuf_base;
+
+	/* Notifier memory */
+	struct nouveau_bo *notifier_bo;
+	struct mem_block *notifier_heap;
+
+	/* PFIFO context */
+	struct nouveau_gpuobj_ref *ramfc;
+	struct nouveau_gpuobj_ref *cache;
+
+	/* PGRAPH context */
+	/* XXX may be merge 2 pointers as private data ??? */
+	struct nouveau_gpuobj_ref *ramin_grctx;
+	void *pgraph_ctx;
+
+	/* NV50 VM */
+	struct nouveau_gpuobj     *vm_pd;
+	struct nouveau_gpuobj_ref *vm_gart_pt;
+	struct nouveau_gpuobj_ref *vm_vram_pt[NV50_VM_VRAM_NR];
+
+	/* Objects */
+	struct nouveau_gpuobj_ref *ramin; /* Private instmem */
+	struct mem_block          *ramin_heap; /* Private PRAMIN heap */
+	struct nouveau_gpuobj_ref *ramht; /* Hash table */
+	struct list_head           ramht_refs; /* Objects referenced by RAMHT */
+
+	/* GPU object info for stuff used in-kernel (mm_enabled) */
+	uint32_t m2mf_ntfy;
+	uint32_t vram_handle;
+	uint32_t gart_handle;
+	bool accel_done;
+
+	/* Push buffer state (only for drm's channel on !mm_enabled) */
+	struct {
+		int max;
+		int free;
+		int cur;
+		int put;
+		/* access via pushbuf_bo */
+	} dma;
+
+	uint32_t sw_subchannel[8];
+
+	struct {
+		struct nouveau_gpuobj *vblsem;
+		uint32_t vblsem_offset;
+		uint32_t vblsem_rval;
+		struct list_head vbl_wait;
+	} nvsw;
+
+	struct {
+		bool active;
+		char name[32];
+		struct drm_info_list info;
+	} debugfs;
+};
+
+struct nouveau_instmem_engine {
+	void	*priv;
+
+	int	(*init)(struct drm_device *dev);
+	void	(*takedown)(struct drm_device *dev);
+	int	(*suspend)(struct drm_device *dev);
+	void	(*resume)(struct drm_device *dev);
+
+	int	(*populate)(struct drm_device *, struct nouveau_gpuobj *,
+			    uint32_t *size);
+	void	(*clear)(struct drm_device *, struct nouveau_gpuobj *);
+	int	(*bind)(struct drm_device *, struct nouveau_gpuobj *);
+	int	(*unbind)(struct drm_device *, struct nouveau_gpuobj *);
+	void	(*prepare_access)(struct drm_device *, bool write);
+	void	(*finish_access)(struct drm_device *);
+};
+
+struct nouveau_mc_engine {
+	int  (*init)(struct drm_device *dev);
+	void (*takedown)(struct drm_device *dev);
+};
+
+struct nouveau_timer_engine {
+	int      (*init)(struct drm_device *dev);
+	void     (*takedown)(struct drm_device *dev);
+	uint64_t (*read)(struct drm_device *dev);
+};
+
+struct nouveau_fb_engine {
+	int num_tiles;
+
+	int  (*init)(struct drm_device *dev);
+	void (*takedown)(struct drm_device *dev);
+
+	void (*set_region_tiling)(struct drm_device *dev, int i, uint32_t addr,
+				 uint32_t size, uint32_t pitch);
+};
+
+struct nouveau_fifo_engine {
+	void *priv;
+
+	int  channels;
+
+	int  (*init)(struct drm_device *);
+	void (*takedown)(struct drm_device *);
+
+	void (*disable)(struct drm_device *);
+	void (*enable)(struct drm_device *);
+	bool (*reassign)(struct drm_device *, bool enable);
+	bool (*cache_flush)(struct drm_device *dev);
+	bool (*cache_pull)(struct drm_device *dev, bool enable);
+
+	int  (*channel_id)(struct drm_device *);
+
+	int  (*create_context)(struct nouveau_channel *);
+	void (*destroy_context)(struct nouveau_channel *);
+	int  (*load_context)(struct nouveau_channel *);
+	int  (*unload_context)(struct drm_device *);
+};
+
+struct nouveau_pgraph_object_method {
+	int id;
+	int (*exec)(struct nouveau_channel *chan, int grclass, int mthd,
+		      uint32_t data);
+};
+
+struct nouveau_pgraph_object_class {
+	int id;
+	bool software;
+	struct nouveau_pgraph_object_method *methods;
+};
+
+struct nouveau_pgraph_engine {
+	struct nouveau_pgraph_object_class *grclass;
+	bool accel_blocked;
+	void *ctxprog;
+	void *ctxvals;
+	int grctx_size;
+
+	int  (*init)(struct drm_device *);
+	void (*takedown)(struct drm_device *);
+
+	void (*fifo_access)(struct drm_device *, bool);
+
+	struct nouveau_channel *(*channel)(struct drm_device *);
+	int  (*create_context)(struct nouveau_channel *);
+	void (*destroy_context)(struct nouveau_channel *);
+	int  (*load_context)(struct nouveau_channel *);
+	int  (*unload_context)(struct drm_device *);
+
+	void (*set_region_tiling)(struct drm_device *dev, int i, uint32_t addr,
+				  uint32_t size, uint32_t pitch);
+};
+
+struct nouveau_engine {
+	struct nouveau_instmem_engine instmem;
+	struct nouveau_mc_engine      mc;
+	struct nouveau_timer_engine   timer;
+	struct nouveau_fb_engine      fb;
+	struct nouveau_pgraph_engine  graph;
+	struct nouveau_fifo_engine    fifo;
+};
+
+struct nouveau_pll_vals {
+	union {
+		struct {
+#ifdef __BIG_ENDIAN
+			uint8_t N1, M1, N2, M2;
+#else
+			uint8_t M1, N1, M2, N2;
+#endif
+		};
+		struct {
+			uint16_t NM1, NM2;
+		} __attribute__((packed));
+	};
+	int log2P;
+
+	int refclk;
+};
+
+enum nv04_fp_display_regs {
+	FP_DISPLAY_END,
+	FP_TOTAL,
+	FP_CRTC,
+	FP_SYNC_START,
+	FP_SYNC_END,
+	FP_VALID_START,
+	FP_VALID_END
+};
+
+struct nv04_crtc_reg {
+	unsigned char MiscOutReg;     /* */
+	uint8_t CRTC[0x9f];
+	uint8_t CR58[0x10];
+	uint8_t Sequencer[5];
+	uint8_t Graphics[9];
+	uint8_t Attribute[21];
+	unsigned char DAC[768];       /* Internal Colorlookuptable */
+
+	/* PCRTC regs */
+	uint32_t fb_start;
+	uint32_t crtc_cfg;
+	uint32_t cursor_cfg;
+	uint32_t gpio_ext;
+	uint32_t crtc_830;
+	uint32_t crtc_834;
+	uint32_t crtc_850;
+	uint32_t crtc_eng_ctrl;
+
+	/* PRAMDAC regs */
+	uint32_t nv10_cursync;
+	struct nouveau_pll_vals pllvals;
+	uint32_t ramdac_gen_ctrl;
+	uint32_t ramdac_630;
+	uint32_t ramdac_634;
+	uint32_t tv_setup;
+	uint32_t tv_vtotal;
+	uint32_t tv_vskew;
+	uint32_t tv_vsync_delay;
+	uint32_t tv_htotal;
+	uint32_t tv_hskew;
+	uint32_t tv_hsync_delay;
+	uint32_t tv_hsync_delay2;
+	uint32_t fp_horiz_regs[7];
+	uint32_t fp_vert_regs[7];
+	uint32_t dither;
+	uint32_t fp_control;
+	uint32_t dither_regs[6];
+	uint32_t fp_debug_0;
+	uint32_t fp_debug_1;
+	uint32_t fp_debug_2;
+	uint32_t fp_margin_color;
+	uint32_t ramdac_8c0;
+	uint32_t ramdac_a20;
+	uint32_t ramdac_a24;
+	uint32_t ramdac_a34;
+	uint32_t ctv_regs[38];
+};
+
+struct nv04_output_reg {
+	uint32_t output;
+	int head;
+};
+
+struct nv04_mode_state {
+	uint32_t bpp;
+	uint32_t width;
+	uint32_t height;
+	uint32_t interlace;
+	uint32_t repaint0;
+	uint32_t repaint1;
+	uint32_t screen;
+	uint32_t scale;
+	uint32_t dither;
+	uint32_t extra;
+	uint32_t fifo;
+	uint32_t pixel;
+	uint32_t horiz;
+	int arbitration0;
+	int arbitration1;
+	uint32_t pll;
+	uint32_t pllB;
+	uint32_t vpll;
+	uint32_t vpll2;
+	uint32_t vpllB;
+	uint32_t vpll2B;
+	uint32_t pllsel;
+	uint32_t sel_clk;
+	uint32_t general;
+	uint32_t crtcOwner;
+	uint32_t head;
+	uint32_t head2;
+	uint32_t cursorConfig;
+	uint32_t cursor0;
+	uint32_t cursor1;
+	uint32_t cursor2;
+	uint32_t timingH;
+	uint32_t timingV;
+	uint32_t displayV;
+	uint32_t crtcSync;
+
+	struct nv04_crtc_reg crtc_reg[2];
+};
+
+enum nouveau_card_type {
+	NV_04      = 0x00,
+	NV_10      = 0x10,
+	NV_20      = 0x20,
+	NV_30      = 0x30,
+	NV_40      = 0x40,
+	NV_50      = 0x50,
+};
+
+struct drm_nouveau_private {
+	struct drm_device *dev;
+	enum {
+		NOUVEAU_CARD_INIT_DOWN,
+		NOUVEAU_CARD_INIT_DONE,
+		NOUVEAU_CARD_INIT_FAILED
+	} init_state;
+
+	/* the card type, takes NV_* as values */
+	enum nouveau_card_type card_type;
+	/* exact chipset, derived from NV_PMC_BOOT_0 */
+	int chipset;
+	int flags;
+
+	void __iomem *mmio;
+	void __iomem *ramin;
+	uint32_t ramin_size;
+
+	struct workqueue_struct *wq;
+	struct work_struct irq_work;
+
+	struct list_head vbl_waiting;
+
+	struct {
+		struct ttm_global_reference mem_global_ref;
+		struct ttm_bo_global_ref bo_global_ref;
+		struct ttm_bo_device bdev;
+		spinlock_t bo_list_lock;
+		struct list_head bo_list;
+		atomic_t validate_sequence;
+	} ttm;
+
+	struct fb_info *fbdev_info;
+
+	int fifo_alloc_count;
+	struct nouveau_channel *fifos[NOUVEAU_MAX_CHANNEL_NR];
+
+	struct nouveau_engine engine;
+	struct nouveau_channel *channel;
+
+	/* RAMIN configuration, RAMFC, RAMHT and RAMRO offsets */
+	struct nouveau_gpuobj *ramht;
+	uint32_t ramin_rsvd_vram;
+	uint32_t ramht_offset;
+	uint32_t ramht_size;
+	uint32_t ramht_bits;
+	uint32_t ramfc_offset;
+	uint32_t ramfc_size;
+	uint32_t ramro_offset;
+	uint32_t ramro_size;
+
+	/* base physical adresses */
+	uint64_t fb_phys;
+	uint64_t fb_available_size;
+	uint64_t fb_mappable_pages;
+	uint64_t fb_aper_free;
+
+	struct {
+		enum {
+			NOUVEAU_GART_NONE = 0,
+			NOUVEAU_GART_AGP,
+			NOUVEAU_GART_SGDMA
+		} type;
+		uint64_t aper_base;
+		uint64_t aper_size;
+		uint64_t aper_free;
+
+		struct nouveau_gpuobj *sg_ctxdma;
+		struct page *sg_dummy_page;
+		dma_addr_t sg_dummy_bus;
+
+		/* nottm hack */
+		struct drm_ttm_backend *sg_be;
+		unsigned long sg_handle;
+	} gart_info;
+
+	/* nv10-nv40 tiling regions */
+	struct {
+		struct nouveau_tile_reg reg[NOUVEAU_MAX_TILE_NR];
+		spinlock_t lock;
+	} tile;
+
+	/* G8x/G9x virtual address space */
+	uint64_t vm_gart_base;
+	uint64_t vm_gart_size;
+	uint64_t vm_vram_base;
+	uint64_t vm_vram_size;
+	uint64_t vm_end;
+	struct nouveau_gpuobj *vm_vram_pt[NV50_VM_VRAM_NR];
+	int vm_vram_pt_nr;
+
+	/* the mtrr covering the FB */
+	int fb_mtrr;
+
+	struct mem_block *ramin_heap;
+
+	/* context table pointed to be NV_PGRAPH_CHANNEL_CTX_TABLE (0x400780) */
+	uint32_t ctx_table_size;
+	struct nouveau_gpuobj_ref *ctx_table;
+
+	struct list_head gpuobj_list;
+
+	struct nvbios VBIOS;
+	struct nouveau_bios_info *vbios;
+
+	struct nv04_mode_state mode_reg;
+	struct nv04_mode_state saved_reg;
+	uint32_t saved_vga_font[4][16384];
+	uint32_t crtc_owner;
+	uint32_t dac_users[4];
+
+	struct nouveau_suspend_resume {
+		uint32_t fifo_mode;
+		uint32_t graph_ctx_control;
+		uint32_t graph_state;
+		uint32_t *ramin_copy;
+		uint64_t ramin_size;
+	} susres;
+
+	struct backlight_device *backlight;
+	bool acpi_dsm;
+
+	struct nouveau_channel *evo;
+
+	struct {
+		struct dentry *channel_root;
+	} debugfs;
+};
+
+static inline struct drm_nouveau_private *
+nouveau_bdev(struct ttm_bo_device *bd)
+{
+	return container_of(bd, struct drm_nouveau_private, ttm.bdev);
+}
+
+static inline int
+nouveau_bo_ref(struct nouveau_bo *ref, struct nouveau_bo **pnvbo)
+{
+	struct nouveau_bo *prev;
+
+	if (!pnvbo)
+		return -EINVAL;
+	prev = *pnvbo;
+
+	*pnvbo = ref ? nouveau_bo(ttm_bo_reference(&ref->bo)) : NULL;
+	if (prev) {
+		struct ttm_buffer_object *bo = &prev->bo;
+
+		ttm_bo_unref(&bo);
+	}
+
+	return 0;
+}
+
+#define NOUVEAU_CHECK_INITIALISED_WITH_RETURN do {            \
+	struct drm_nouveau_private *nv = dev->dev_private;    \
+	if (nv->init_state != NOUVEAU_CARD_INIT_DONE) {       \
+		NV_ERROR(dev, "called without init\n");       \
+		return -EINVAL;                               \
+	}                                                     \
+} while (0)
+
+#define NOUVEAU_GET_USER_CHANNEL_WITH_RETURN(id, cl, ch) do {    \
+	struct drm_nouveau_private *nv = dev->dev_private;       \
+	if (!nouveau_channel_owner(dev, (cl), (id))) {           \
+		NV_ERROR(dev, "pid %d doesn't own channel %d\n", \
+			 DRM_CURRENTPID, (id));                  \
+		return -EPERM;                                   \
+	}                                                        \
+	(ch) = nv->fifos[(id)];                                  \
+} while (0)
+
+/* nouveau_drv.c */
+extern int nouveau_noagp;
+extern int nouveau_duallink;
+extern int nouveau_uscript_lvds;
+extern int nouveau_uscript_tmds;
+extern int nouveau_vram_pushbuf;
+extern int nouveau_vram_notify;
+extern int nouveau_fbpercrtc;
+extern char *nouveau_tv_norm;
+extern int nouveau_reg_debug;
+extern char *nouveau_vbios;
+extern int nouveau_ctxfw;
+
+/* nouveau_state.c */
+extern void nouveau_preclose(struct drm_device *dev, struct drm_file *);
+extern int  nouveau_load(struct drm_device *, unsigned long flags);
+extern int  nouveau_firstopen(struct drm_device *);
+extern void nouveau_lastclose(struct drm_device *);
+extern int  nouveau_unload(struct drm_device *);
+extern int  nouveau_ioctl_getparam(struct drm_device *, void *data,
+				   struct drm_file *);
+extern int  nouveau_ioctl_setparam(struct drm_device *, void *data,
+				   struct drm_file *);
+extern bool nouveau_wait_until(struct drm_device *, uint64_t timeout,
+			       uint32_t reg, uint32_t mask, uint32_t val);
+extern bool nouveau_wait_for_idle(struct drm_device *);
+extern int  nouveau_card_init(struct drm_device *);
+extern int  nouveau_ioctl_card_init(struct drm_device *, void *data,
+				    struct drm_file *);
+extern int  nouveau_ioctl_suspend(struct drm_device *, void *data,
+				  struct drm_file *);
+extern int  nouveau_ioctl_resume(struct drm_device *, void *data,
+				 struct drm_file *);
+
+/* nouveau_mem.c */
+extern int  nouveau_mem_init_heap(struct mem_block **, uint64_t start,
+				 uint64_t size);
+extern struct mem_block *nouveau_mem_alloc_block(struct mem_block *,
+						 uint64_t size, int align2,
+						 struct drm_file *, int tail);
+extern void nouveau_mem_takedown(struct mem_block **heap);
+extern void nouveau_mem_free_block(struct mem_block *);
+extern uint64_t nouveau_mem_fb_amount(struct drm_device *);
+extern void nouveau_mem_release(struct drm_file *, struct mem_block *heap);
+extern int  nouveau_mem_init(struct drm_device *);
+extern int  nouveau_mem_init_agp(struct drm_device *);
+extern void nouveau_mem_close(struct drm_device *);
+extern struct nouveau_tile_reg *nv10_mem_set_tiling(struct drm_device *dev,
+						    uint32_t addr,
+						    uint32_t size,
+						    uint32_t pitch);
+extern void nv10_mem_expire_tiling(struct drm_device *dev,
+				   struct nouveau_tile_reg *tile,
+				   struct nouveau_fence *fence);
+extern int  nv50_mem_vm_bind_linear(struct drm_device *, uint64_t virt,
+				    uint32_t size, uint32_t flags,
+				    uint64_t phys);
+extern void nv50_mem_vm_unbind(struct drm_device *, uint64_t virt,
+			       uint32_t size);
+
+/* nouveau_notifier.c */
+extern int  nouveau_notifier_init_channel(struct nouveau_channel *);
+extern void nouveau_notifier_takedown_channel(struct nouveau_channel *);
+extern int  nouveau_notifier_alloc(struct nouveau_channel *, uint32_t handle,
+				   int cout, uint32_t *offset);
+extern int  nouveau_notifier_offset(struct nouveau_gpuobj *, uint32_t *);
+extern int  nouveau_ioctl_notifier_alloc(struct drm_device *, void *data,
+					 struct drm_file *);
+extern int  nouveau_ioctl_notifier_free(struct drm_device *, void *data,
+					struct drm_file *);
+
+/* nouveau_channel.c */
+extern struct drm_ioctl_desc nouveau_ioctls[];
+extern int nouveau_max_ioctl;
+extern void nouveau_channel_cleanup(struct drm_device *, struct drm_file *);
+extern int  nouveau_channel_owner(struct drm_device *, struct drm_file *,
+				  int channel);
+extern int  nouveau_channel_alloc(struct drm_device *dev,
+				  struct nouveau_channel **chan,
+				  struct drm_file *file_priv,
+				  uint32_t fb_ctxdma, uint32_t tt_ctxdma);
+extern void nouveau_channel_free(struct nouveau_channel *);
+
+/* nouveau_object.c */
+extern int  nouveau_gpuobj_early_init(struct drm_device *);
+extern int  nouveau_gpuobj_init(struct drm_device *);
+extern void nouveau_gpuobj_takedown(struct drm_device *);
+extern void nouveau_gpuobj_late_takedown(struct drm_device *);
+extern int  nouveau_gpuobj_suspend(struct drm_device *dev);
+extern void nouveau_gpuobj_suspend_cleanup(struct drm_device *dev);
+extern void nouveau_gpuobj_resume(struct drm_device *dev);
+extern int nouveau_gpuobj_channel_init(struct nouveau_channel *,
+				       uint32_t vram_h, uint32_t tt_h);
+extern void nouveau_gpuobj_channel_takedown(struct nouveau_channel *);
+extern int nouveau_gpuobj_new(struct drm_device *, struct nouveau_channel *,
+			      uint32_t size, int align, uint32_t flags,
+			      struct nouveau_gpuobj **);
+extern int nouveau_gpuobj_del(struct drm_device *, struct nouveau_gpuobj **);
+extern int nouveau_gpuobj_ref_add(struct drm_device *, struct nouveau_channel *,
+				  uint32_t handle, struct nouveau_gpuobj *,
+				  struct nouveau_gpuobj_ref **);
+extern int nouveau_gpuobj_ref_del(struct drm_device *,
+				  struct nouveau_gpuobj_ref **);
+extern int nouveau_gpuobj_ref_find(struct nouveau_channel *, uint32_t handle,
+				   struct nouveau_gpuobj_ref **ref_ret);
+extern int nouveau_gpuobj_new_ref(struct drm_device *,
+				  struct nouveau_channel *alloc_chan,
+				  struct nouveau_channel *ref_chan,
+				  uint32_t handle, uint32_t size, int align,
+				  uint32_t flags, struct nouveau_gpuobj_ref **);
+extern int nouveau_gpuobj_new_fake(struct drm_device *,
+				   uint32_t p_offset, uint32_t b_offset,
+				   uint32_t size, uint32_t flags,
+				   struct nouveau_gpuobj **,
+				   struct nouveau_gpuobj_ref**);
+extern int nouveau_gpuobj_dma_new(struct nouveau_channel *, int class,
+				  uint64_t offset, uint64_t size, int access,
+				  int target, struct nouveau_gpuobj **);
+extern int nouveau_gpuobj_gart_dma_new(struct nouveau_channel *,
+				       uint64_t offset, uint64_t size,
+				       int access, struct nouveau_gpuobj **,
+				       uint32_t *o_ret);
+extern int nouveau_gpuobj_gr_new(struct nouveau_channel *, int class,
+				 struct nouveau_gpuobj **);
+extern int nouveau_gpuobj_sw_new(struct nouveau_channel *, int class,
+				 struct nouveau_gpuobj **);
+extern int nouveau_ioctl_grobj_alloc(struct drm_device *, void *data,
+				     struct drm_file *);
+extern int nouveau_ioctl_gpuobj_free(struct drm_device *, void *data,
+				     struct drm_file *);
+
+/* nouveau_irq.c */
+extern irqreturn_t nouveau_irq_handler(DRM_IRQ_ARGS);
+extern void        nouveau_irq_preinstall(struct drm_device *);
+extern int         nouveau_irq_postinstall(struct drm_device *);
+extern void        nouveau_irq_uninstall(struct drm_device *);
+
+/* nouveau_sgdma.c */
+extern int nouveau_sgdma_init(struct drm_device *);
+extern void nouveau_sgdma_takedown(struct drm_device *);
+extern int nouveau_sgdma_get_page(struct drm_device *, uint32_t offset,
+				  uint32_t *page);
+extern struct ttm_backend *nouveau_sgdma_init_ttm(struct drm_device *);
+
+/* nouveau_debugfs.c */
+#if defined(CONFIG_DRM_NOUVEAU_DEBUG)
+extern int  nouveau_debugfs_init(struct drm_minor *);
+extern void nouveau_debugfs_takedown(struct drm_minor *);
+extern int  nouveau_debugfs_channel_init(struct nouveau_channel *);
+extern void nouveau_debugfs_channel_fini(struct nouveau_channel *);
+#else
+static inline int
+nouveau_debugfs_init(struct drm_minor *minor)
+{
+	return 0;
+}
+
+static inline void nouveau_debugfs_takedown(struct drm_minor *minor)
+{
+}
+
+static inline int
+nouveau_debugfs_channel_init(struct nouveau_channel *chan)
+{
+	return 0;
+}
+
+static inline void
+nouveau_debugfs_channel_fini(struct nouveau_channel *chan)
+{
+}
+#endif
+
+/* nouveau_dma.c */
+extern void nouveau_dma_pre_init(struct nouveau_channel *);
+extern int  nouveau_dma_init(struct nouveau_channel *);
+extern int  nouveau_dma_wait(struct nouveau_channel *, int size);
+
+/* nouveau_acpi.c */
+#ifdef CONFIG_ACPI
+extern int nouveau_hybrid_setup(struct drm_device *dev);
+extern bool nouveau_dsm_probe(struct drm_device *dev);
+#else
+static inline int nouveau_hybrid_setup(struct drm_device *dev)
+{
+	return 0;
+}
+static inline bool nouveau_dsm_probe(struct drm_device *dev)
+{
+	return false;
+}
+#endif
+
+/* nouveau_backlight.c */
+#ifdef CONFIG_DRM_NOUVEAU_BACKLIGHT
+extern int nouveau_backlight_init(struct drm_device *);
+extern void nouveau_backlight_exit(struct drm_device *);
+#else
+static inline int nouveau_backlight_init(struct drm_device *dev)
+{
+	return 0;
+}
+
+static inline void nouveau_backlight_exit(struct drm_device *dev) { }
+#endif
+
+/* nouveau_bios.c */
+extern int nouveau_bios_init(struct drm_device *);
+extern void nouveau_bios_takedown(struct drm_device *dev);
+extern int nouveau_run_vbios_init(struct drm_device *);
+extern void nouveau_bios_run_init_table(struct drm_device *, uint16_t table,
+					struct dcb_entry *);
+extern struct dcb_gpio_entry *nouveau_bios_gpio_entry(struct drm_device *,
+						      enum dcb_gpio_tag);
+extern struct dcb_connector_table_entry *
+nouveau_bios_connector_entry(struct drm_device *, int index);
+extern int get_pll_limits(struct drm_device *, uint32_t limit_match,
+			  struct pll_lims *);
+extern int nouveau_bios_run_display_table(struct drm_device *,
+					  struct dcb_entry *,
+					  uint32_t script, int pxclk);
+extern void *nouveau_bios_dp_table(struct drm_device *, struct dcb_entry *,
+				   int *length);
+extern bool nouveau_bios_fp_mode(struct drm_device *, struct drm_display_mode *);
+extern uint8_t *nouveau_bios_embedded_edid(struct drm_device *);
+extern int nouveau_bios_parse_lvds_table(struct drm_device *, int pxclk,
+					 bool *dl, bool *if_is_24bit);
+extern int run_tmds_table(struct drm_device *, struct dcb_entry *,
+			  int head, int pxclk);
+extern int call_lvds_script(struct drm_device *, struct dcb_entry *, int head,
+			    enum LVDS_script, int pxclk);
+
+/* nouveau_ttm.c */
+int nouveau_ttm_global_init(struct drm_nouveau_private *);
+void nouveau_ttm_global_release(struct drm_nouveau_private *);
+int nouveau_ttm_mmap(struct file *, struct vm_area_struct *);
+
+/* nouveau_dp.c */
+int nouveau_dp_auxch(struct nouveau_i2c_chan *auxch, int cmd, int addr,
+		     uint8_t *data, int data_nr);
+bool nouveau_dp_detect(struct drm_encoder *);
+bool nouveau_dp_link_train(struct drm_encoder *);
+
+/* nv04_fb.c */
+extern int  nv04_fb_init(struct drm_device *);
+extern void nv04_fb_takedown(struct drm_device *);
+
+/* nv10_fb.c */
+extern int  nv10_fb_init(struct drm_device *);
+extern void nv10_fb_takedown(struct drm_device *);
+extern void nv10_fb_set_region_tiling(struct drm_device *, int, uint32_t,
+				      uint32_t, uint32_t);
+
+/* nv40_fb.c */
+extern int  nv40_fb_init(struct drm_device *);
+extern void nv40_fb_takedown(struct drm_device *);
+extern void nv40_fb_set_region_tiling(struct drm_device *, int, uint32_t,
+				      uint32_t, uint32_t);
+
+/* nv04_fifo.c */
+extern int  nv04_fifo_init(struct drm_device *);
+extern void nv04_fifo_disable(struct drm_device *);
+extern void nv04_fifo_enable(struct drm_device *);
+extern bool nv04_fifo_reassign(struct drm_device *, bool);
+extern bool nv04_fifo_cache_flush(struct drm_device *);
+extern bool nv04_fifo_cache_pull(struct drm_device *, bool);
+extern int  nv04_fifo_channel_id(struct drm_device *);
+extern int  nv04_fifo_create_context(struct nouveau_channel *);
+extern void nv04_fifo_destroy_context(struct nouveau_channel *);
+extern int  nv04_fifo_load_context(struct nouveau_channel *);
+extern int  nv04_fifo_unload_context(struct drm_device *);
+
+/* nv10_fifo.c */
+extern int  nv10_fifo_init(struct drm_device *);
+extern int  nv10_fifo_channel_id(struct drm_device *);
+extern int  nv10_fifo_create_context(struct nouveau_channel *);
+extern void nv10_fifo_destroy_context(struct nouveau_channel *);
+extern int  nv10_fifo_load_context(struct nouveau_channel *);
+extern int  nv10_fifo_unload_context(struct drm_device *);
+
+/* nv40_fifo.c */
+extern int  nv40_fifo_init(struct drm_device *);
+extern int  nv40_fifo_create_context(struct nouveau_channel *);
+extern void nv40_fifo_destroy_context(struct nouveau_channel *);
+extern int  nv40_fifo_load_context(struct nouveau_channel *);
+extern int  nv40_fifo_unload_context(struct drm_device *);
+
+/* nv50_fifo.c */
+extern int  nv50_fifo_init(struct drm_device *);
+extern void nv50_fifo_takedown(struct drm_device *);
+extern int  nv50_fifo_channel_id(struct drm_device *);
+extern int  nv50_fifo_create_context(struct nouveau_channel *);
+extern void nv50_fifo_destroy_context(struct nouveau_channel *);
+extern int  nv50_fifo_load_context(struct nouveau_channel *);
+extern int  nv50_fifo_unload_context(struct drm_device *);
+
+/* nv04_graph.c */
+extern struct nouveau_pgraph_object_class nv04_graph_grclass[];
+extern int  nv04_graph_init(struct drm_device *);
+extern void nv04_graph_takedown(struct drm_device *);
+extern void nv04_graph_fifo_access(struct drm_device *, bool);
+extern struct nouveau_channel *nv04_graph_channel(struct drm_device *);
+extern int  nv04_graph_create_context(struct nouveau_channel *);
+extern void nv04_graph_destroy_context(struct nouveau_channel *);
+extern int  nv04_graph_load_context(struct nouveau_channel *);
+extern int  nv04_graph_unload_context(struct drm_device *);
+extern void nv04_graph_context_switch(struct drm_device *);
+
+/* nv10_graph.c */
+extern struct nouveau_pgraph_object_class nv10_graph_grclass[];
+extern int  nv10_graph_init(struct drm_device *);
+extern void nv10_graph_takedown(struct drm_device *);
+extern struct nouveau_channel *nv10_graph_channel(struct drm_device *);
+extern int  nv10_graph_create_context(struct nouveau_channel *);
+extern void nv10_graph_destroy_context(struct nouveau_channel *);
+extern int  nv10_graph_load_context(struct nouveau_channel *);
+extern int  nv10_graph_unload_context(struct drm_device *);
+extern void nv10_graph_context_switch(struct drm_device *);
+extern void nv10_graph_set_region_tiling(struct drm_device *, int, uint32_t,
+					 uint32_t, uint32_t);
+
+/* nv20_graph.c */
+extern struct nouveau_pgraph_object_class nv20_graph_grclass[];
+extern struct nouveau_pgraph_object_class nv30_graph_grclass[];
+extern int  nv20_graph_create_context(struct nouveau_channel *);
+extern void nv20_graph_destroy_context(struct nouveau_channel *);
+extern int  nv20_graph_load_context(struct nouveau_channel *);
+extern int  nv20_graph_unload_context(struct drm_device *);
+extern int  nv20_graph_init(struct drm_device *);
+extern void nv20_graph_takedown(struct drm_device *);
+extern int  nv30_graph_init(struct drm_device *);
+extern void nv20_graph_set_region_tiling(struct drm_device *, int, uint32_t,
+					 uint32_t, uint32_t);
+
+/* nv40_graph.c */
+extern struct nouveau_pgraph_object_class nv40_graph_grclass[];
+extern int  nv40_graph_init(struct drm_device *);
+extern void nv40_graph_takedown(struct drm_device *);
+extern struct nouveau_channel *nv40_graph_channel(struct drm_device *);
+extern int  nv40_graph_create_context(struct nouveau_channel *);
+extern void nv40_graph_destroy_context(struct nouveau_channel *);
+extern int  nv40_graph_load_context(struct nouveau_channel *);
+extern int  nv40_graph_unload_context(struct drm_device *);
+extern void nv40_grctx_init(struct nouveau_grctx *);
+extern void nv40_graph_set_region_tiling(struct drm_device *, int, uint32_t,
+					 uint32_t, uint32_t);
+
+/* nv50_graph.c */
+extern struct nouveau_pgraph_object_class nv50_graph_grclass[];
+extern int  nv50_graph_init(struct drm_device *);
+extern void nv50_graph_takedown(struct drm_device *);
+extern void nv50_graph_fifo_access(struct drm_device *, bool);
+extern struct nouveau_channel *nv50_graph_channel(struct drm_device *);
+extern int  nv50_graph_create_context(struct nouveau_channel *);
+extern void nv50_graph_destroy_context(struct nouveau_channel *);
+extern int  nv50_graph_load_context(struct nouveau_channel *);
+extern int  nv50_graph_unload_context(struct drm_device *);
+extern void nv50_graph_context_switch(struct drm_device *);
+
+/* nouveau_grctx.c */
+extern int  nouveau_grctx_prog_load(struct drm_device *);
+extern void nouveau_grctx_vals_load(struct drm_device *,
+				    struct nouveau_gpuobj *);
+extern void nouveau_grctx_fini(struct drm_device *);
+
+/* nv04_instmem.c */
+extern int  nv04_instmem_init(struct drm_device *);
+extern void nv04_instmem_takedown(struct drm_device *);
+extern int  nv04_instmem_suspend(struct drm_device *);
+extern void nv04_instmem_resume(struct drm_device *);
+extern int  nv04_instmem_populate(struct drm_device *, struct nouveau_gpuobj *,
+				  uint32_t *size);
+extern void nv04_instmem_clear(struct drm_device *, struct nouveau_gpuobj *);
+extern int  nv04_instmem_bind(struct drm_device *, struct nouveau_gpuobj *);
+extern int  nv04_instmem_unbind(struct drm_device *, struct nouveau_gpuobj *);
+extern void nv04_instmem_prepare_access(struct drm_device *, bool write);
+extern void nv04_instmem_finish_access(struct drm_device *);
+
+/* nv50_instmem.c */
+extern int  nv50_instmem_init(struct drm_device *);
+extern void nv50_instmem_takedown(struct drm_device *);
+extern int  nv50_instmem_suspend(struct drm_device *);
+extern void nv50_instmem_resume(struct drm_device *);
+extern int  nv50_instmem_populate(struct drm_device *, struct nouveau_gpuobj *,
+				  uint32_t *size);
+extern void nv50_instmem_clear(struct drm_device *, struct nouveau_gpuobj *);
+extern int  nv50_instmem_bind(struct drm_device *, struct nouveau_gpuobj *);
+extern int  nv50_instmem_unbind(struct drm_device *, struct nouveau_gpuobj *);
+extern void nv50_instmem_prepare_access(struct drm_device *, bool write);
+extern void nv50_instmem_finish_access(struct drm_device *);
+
+/* nv04_mc.c */
+extern int  nv04_mc_init(struct drm_device *);
+extern void nv04_mc_takedown(struct drm_device *);
+
+/* nv40_mc.c */
+extern int  nv40_mc_init(struct drm_device *);
+extern void nv40_mc_takedown(struct drm_device *);
+
+/* nv50_mc.c */
+extern int  nv50_mc_init(struct drm_device *);
+extern void nv50_mc_takedown(struct drm_device *);
+
+/* nv04_timer.c */
+extern int  nv04_timer_init(struct drm_device *);
+extern uint64_t nv04_timer_read(struct drm_device *);
+extern void nv04_timer_takedown(struct drm_device *);
+
+extern long nouveau_compat_ioctl(struct file *file, unsigned int cmd,
+				 unsigned long arg);
+
+/* nv04_dac.c */
+extern int nv04_dac_create(struct drm_device *dev, struct dcb_entry *entry);
+extern uint32_t nv17_dac_sample_load(struct drm_encoder *encoder);
+extern int nv04_dac_output_offset(struct drm_encoder *encoder);
+extern void nv04_dac_update_dacclk(struct drm_encoder *encoder, bool enable);
+
+/* nv04_dfp.c */
+extern int nv04_dfp_create(struct drm_device *dev, struct dcb_entry *entry);
+extern int nv04_dfp_get_bound_head(struct drm_device *dev, struct dcb_entry *dcbent);
+extern void nv04_dfp_bind_head(struct drm_device *dev, struct dcb_entry *dcbent,
+			       int head, bool dl);
+extern void nv04_dfp_disable(struct drm_device *dev, int head);
+extern void nv04_dfp_update_fp_control(struct drm_encoder *encoder, int mode);
+
+/* nv04_tv.c */
+extern int nv04_tv_identify(struct drm_device *dev, int i2c_index);
+extern int nv04_tv_create(struct drm_device *dev, struct dcb_entry *entry);
+
+/* nv17_tv.c */
+extern int nv17_tv_create(struct drm_device *dev, struct dcb_entry *entry);
+
+/* nv04_display.c */
+extern int nv04_display_create(struct drm_device *);
+extern void nv04_display_destroy(struct drm_device *);
+extern void nv04_display_restore(struct drm_device *);
+
+/* nv04_crtc.c */
+extern int nv04_crtc_create(struct drm_device *, int index);
+
+/* nouveau_bo.c */
+extern struct ttm_bo_driver nouveau_bo_driver;
+extern int nouveau_bo_new(struct drm_device *, struct nouveau_channel *,
+			  int size, int align, uint32_t flags,
+			  uint32_t tile_mode, uint32_t tile_flags,
+			  bool no_vm, bool mappable, struct nouveau_bo **);
+extern int nouveau_bo_pin(struct nouveau_bo *, uint32_t flags);
+extern int nouveau_bo_unpin(struct nouveau_bo *);
+extern int nouveau_bo_map(struct nouveau_bo *);
+extern void nouveau_bo_unmap(struct nouveau_bo *);
+extern void nouveau_bo_placement_set(struct nouveau_bo *, uint32_t memtype);
+extern u16 nouveau_bo_rd16(struct nouveau_bo *nvbo, unsigned index);
+extern void nouveau_bo_wr16(struct nouveau_bo *nvbo, unsigned index, u16 val);
+extern u32 nouveau_bo_rd32(struct nouveau_bo *nvbo, unsigned index);
+extern void nouveau_bo_wr32(struct nouveau_bo *nvbo, unsigned index, u32 val);
+
+/* nouveau_fence.c */
+struct nouveau_fence;
+extern int nouveau_fence_init(struct nouveau_channel *);
+extern void nouveau_fence_fini(struct nouveau_channel *);
+extern void nouveau_fence_update(struct nouveau_channel *);
+extern int nouveau_fence_new(struct nouveau_channel *, struct nouveau_fence **,
+			     bool emit);
+extern int nouveau_fence_emit(struct nouveau_fence *);
+struct nouveau_channel *nouveau_fence_channel(struct nouveau_fence *);
+extern bool nouveau_fence_signalled(void *obj, void *arg);
+extern int nouveau_fence_wait(void *obj, void *arg, bool lazy, bool intr);
+extern int nouveau_fence_flush(void *obj, void *arg);
+extern void nouveau_fence_unref(void **obj);
+extern void *nouveau_fence_ref(void *obj);
+extern void nouveau_fence_handler(struct drm_device *dev, int channel);
+
+/* nouveau_gem.c */
+extern int nouveau_gem_new(struct drm_device *, struct nouveau_channel *,
+			   int size, int align, uint32_t flags,
+			   uint32_t tile_mode, uint32_t tile_flags,
+			   bool no_vm, bool mappable, struct nouveau_bo **);
+extern int nouveau_gem_object_new(struct drm_gem_object *);
+extern void nouveau_gem_object_del(struct drm_gem_object *);
+extern int nouveau_gem_ioctl_new(struct drm_device *, void *,
+				 struct drm_file *);
+extern int nouveau_gem_ioctl_pushbuf(struct drm_device *, void *,
+				     struct drm_file *);
+extern int nouveau_gem_ioctl_pushbuf_call(struct drm_device *, void *,
+					  struct drm_file *);
+extern int nouveau_gem_ioctl_pushbuf_call2(struct drm_device *, void *,
+					   struct drm_file *);
+extern int nouveau_gem_ioctl_pin(struct drm_device *, void *,
+				 struct drm_file *);
+extern int nouveau_gem_ioctl_unpin(struct drm_device *, void *,
+				   struct drm_file *);
+extern int nouveau_gem_ioctl_tile(struct drm_device *, void *,
+				  struct drm_file *);
+extern int nouveau_gem_ioctl_cpu_prep(struct drm_device *, void *,
+				      struct drm_file *);
+extern int nouveau_gem_ioctl_cpu_fini(struct drm_device *, void *,
+				      struct drm_file *);
+extern int nouveau_gem_ioctl_info(struct drm_device *, void *,
+				  struct drm_file *);
+
+/* nv17_gpio.c */
+int nv17_gpio_get(struct drm_device *dev, enum dcb_gpio_tag tag);
+int nv17_gpio_set(struct drm_device *dev, enum dcb_gpio_tag tag, int state);
+
+#ifndef ioread32_native
+#ifdef __BIG_ENDIAN
+#define ioread16_native ioread16be
+#define iowrite16_native iowrite16be
+#define ioread32_native  ioread32be
+#define iowrite32_native iowrite32be
+#else /* def __BIG_ENDIAN */
+#define ioread16_native ioread16
+#define iowrite16_native iowrite16
+#define ioread32_native  ioread32
+#define iowrite32_native iowrite32
+#endif /* def __BIG_ENDIAN else */
+#endif /* !ioread32_native */
+
+/* channel control reg access */
+static inline u32 nvchan_rd32(struct nouveau_channel *chan, unsigned reg)
+{
+	return ioread32_native(chan->user + reg);
+}
+
+static inline void nvchan_wr32(struct nouveau_channel *chan,
+							unsigned reg, u32 val)
+{
+	iowrite32_native(val, chan->user + reg);
+}
+
+/* register access */
+static inline u32 nv_rd32(struct drm_device *dev, unsigned reg)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	return ioread32_native(dev_priv->mmio + reg);
+}
+
+static inline void nv_wr32(struct drm_device *dev, unsigned reg, u32 val)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	iowrite32_native(val, dev_priv->mmio + reg);
+}
+
+static inline u8 nv_rd08(struct drm_device *dev, unsigned reg)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	return ioread8(dev_priv->mmio + reg);
+}
+
+static inline void nv_wr08(struct drm_device *dev, unsigned reg, u8 val)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	iowrite8(val, dev_priv->mmio + reg);
+}
+
+#define nv_wait(reg, mask, val) \
+	nouveau_wait_until(dev, 2000000000ULL, (reg), (mask), (val))
+
+/* PRAMIN access */
+static inline u32 nv_ri32(struct drm_device *dev, unsigned offset)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	return ioread32_native(dev_priv->ramin + offset);
+}
+
+static inline void nv_wi32(struct drm_device *dev, unsigned offset, u32 val)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	iowrite32_native(val, dev_priv->ramin + offset);
+}
+
+/* object access */
+static inline u32 nv_ro32(struct drm_device *dev, struct nouveau_gpuobj *obj,
+				unsigned index)
+{
+	return nv_ri32(dev, obj->im_pramin->start + index * 4);
+}
+
+static inline void nv_wo32(struct drm_device *dev, struct nouveau_gpuobj *obj,
+				unsigned index, u32 val)
+{
+	nv_wi32(dev, obj->im_pramin->start + index * 4, val);
+}
+
+/*
+ * Logging
+ * Argument d is (struct drm_device *).
+ */
+#define NV_PRINTK(level, d, fmt, arg...) \
+	printk(level "[" DRM_NAME "] " DRIVER_NAME " %s: " fmt, \
+					pci_name(d->pdev), ##arg)
+#ifndef NV_DEBUG_NOTRACE
+#define NV_DEBUG(d, fmt, arg...) do {                                          \
+	if (drm_debug & DRM_UT_DRIVER) {                                       \
+		NV_PRINTK(KERN_DEBUG, d, "%s:%d - " fmt, __func__,             \
+			  __LINE__, ##arg);                                    \
+	}                                                                      \
+} while (0)
+#define NV_DEBUG_KMS(d, fmt, arg...) do {                                      \
+	if (drm_debug & DRM_UT_KMS) {                                          \
+		NV_PRINTK(KERN_DEBUG, d, "%s:%d - " fmt, __func__,             \
+			  __LINE__, ##arg);                                    \
+	}                                                                      \
+} while (0)
+#else
+#define NV_DEBUG(d, fmt, arg...) do {                                          \
+	if (drm_debug & DRM_UT_DRIVER)                                         \
+		NV_PRINTK(KERN_DEBUG, d, fmt, ##arg);                          \
+} while (0)
+#define NV_DEBUG_KMS(d, fmt, arg...) do {                                      \
+	if (drm_debug & DRM_UT_KMS)                                            \
+		NV_PRINTK(KERN_DEBUG, d, fmt, ##arg);                          \
+} while (0)
+#endif
+#define NV_ERROR(d, fmt, arg...) NV_PRINTK(KERN_ERR, d, fmt, ##arg)
+#define NV_INFO(d, fmt, arg...) NV_PRINTK(KERN_INFO, d, fmt, ##arg)
+#define NV_TRACEWARN(d, fmt, arg...) NV_PRINTK(KERN_NOTICE, d, fmt, ##arg)
+#define NV_TRACE(d, fmt, arg...) NV_PRINTK(KERN_INFO, d, fmt, ##arg)
+#define NV_WARN(d, fmt, arg...) NV_PRINTK(KERN_WARNING, d, fmt, ##arg)
+
+/* nouveau_reg_debug bitmask */
+enum {
+	NOUVEAU_REG_DEBUG_MC             = 0x1,
+	NOUVEAU_REG_DEBUG_VIDEO          = 0x2,
+	NOUVEAU_REG_DEBUG_FB             = 0x4,
+	NOUVEAU_REG_DEBUG_EXTDEV         = 0x8,
+	NOUVEAU_REG_DEBUG_CRTC           = 0x10,
+	NOUVEAU_REG_DEBUG_RAMDAC         = 0x20,
+	NOUVEAU_REG_DEBUG_VGACRTC        = 0x40,
+	NOUVEAU_REG_DEBUG_RMVIO          = 0x80,
+	NOUVEAU_REG_DEBUG_VGAATTR        = 0x100,
+	NOUVEAU_REG_DEBUG_EVO            = 0x200,
+};
+
+#define NV_REG_DEBUG(type, dev, fmt, arg...) do { \
+	if (nouveau_reg_debug & NOUVEAU_REG_DEBUG_##type) \
+		NV_PRINTK(KERN_DEBUG, dev, "%s: " fmt, __func__, ##arg); \
+} while (0)
+
+static inline bool
+nv_two_heads(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	const int impl = dev->pci_device & 0x0ff0;
+
+	if (dev_priv->card_type >= NV_10 && impl != 0x0100 &&
+	    impl != 0x0150 && impl != 0x01a0 && impl != 0x0200)
+		return true;
+
+	return false;
+}
+
+static inline bool
+nv_gf4_disp_arch(struct drm_device *dev)
+{
+	return nv_two_heads(dev) && (dev->pci_device & 0x0ff0) != 0x0110;
+}
+
+static inline bool
+nv_two_reg_pll(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	const int impl = dev->pci_device & 0x0ff0;
+
+	if (impl == 0x0310 || impl == 0x0340 || dev_priv->card_type >= NV_40)
+		return true;
+	return false;
+}
+
+#define NV_SW                                                        0x0000506e
+#define NV_SW_DMA_SEMAPHORE                                          0x00000060
+#define NV_SW_SEMAPHORE_OFFSET                                       0x00000064
+#define NV_SW_SEMAPHORE_ACQUIRE                                      0x00000068
+#define NV_SW_SEMAPHORE_RELEASE                                      0x0000006c
+#define NV_SW_DMA_VBLSEM                                             0x0000018c
+#define NV_SW_VBLSEM_OFFSET                                          0x00000400
+#define NV_SW_VBLSEM_RELEASE_VALUE                                   0x00000404
+#define NV_SW_VBLSEM_RELEASE                                         0x00000408
+
+#endif /* __NOUVEAU_DRV_H__ */
diff --git a/drivers/gpu/drm/nouveau/nouveau_encoder.h b/drivers/gpu/drm/nouveau/nouveau_encoder.h
new file mode 100644
index 000000000000..bc4a24029ed1
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nouveau_encoder.h
@@ -0,0 +1,91 @@
+/*
+ * Copyright (C) 2008 Maarten Maathuis.
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial
+ * portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE COPYRIGHT OWNER(S) AND/OR ITS SUPPLIERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
+#ifndef __NOUVEAU_ENCODER_H__
+#define __NOUVEAU_ENCODER_H__
+
+#include "drm_encoder_slave.h"
+#include "nouveau_drv.h"
+
+#define NV_DPMS_CLEARED 0x80
+
+struct nouveau_encoder {
+	struct drm_encoder_slave base;
+
+	struct dcb_entry *dcb;
+	int or;
+
+	struct drm_display_mode mode;
+	int last_dpms;
+
+	struct nv04_output_reg restore;
+
+	void (*disconnect)(struct nouveau_encoder *encoder);
+
+	union {
+		struct {
+			int dpcd_version;
+			int link_nr;
+			int link_bw;
+		} dp;
+	};
+};
+
+static inline struct nouveau_encoder *nouveau_encoder(struct drm_encoder *enc)
+{
+	struct drm_encoder_slave *slave = to_encoder_slave(enc);
+
+	return container_of(slave, struct nouveau_encoder, base);
+}
+
+static inline struct drm_encoder *to_drm_encoder(struct nouveau_encoder *enc)
+{
+	return &enc->base.base;
+}
+
+struct nouveau_connector *
+nouveau_encoder_connector_get(struct nouveau_encoder *encoder);
+int nv50_sor_create(struct drm_device *dev, struct dcb_entry *entry);
+int nv50_dac_create(struct drm_device *dev, struct dcb_entry *entry);
+
+struct bit_displayport_encoder_table {
+	uint32_t match;
+	uint8_t  record_nr;
+	uint8_t  unknown;
+	uint16_t script0;
+	uint16_t script1;
+	uint16_t unknown_table;
+} __attribute__ ((packed));
+
+struct bit_displayport_encoder_table_entry {
+	uint8_t vs_level;
+	uint8_t pre_level;
+	uint8_t reg0;
+	uint8_t reg1;
+	uint8_t reg2;
+} __attribute__ ((packed));
+
+#endif /* __NOUVEAU_ENCODER_H__ */
diff --git a/drivers/gpu/drm/nouveau/nouveau_fb.h b/drivers/gpu/drm/nouveau/nouveau_fb.h
new file mode 100644
index 000000000000..4a3f31aa1949
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nouveau_fb.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2008 Maarten Maathuis.
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial
+ * portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE COPYRIGHT OWNER(S) AND/OR ITS SUPPLIERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
+#ifndef __NOUVEAU_FB_H__
+#define __NOUVEAU_FB_H__
+
+struct nouveau_framebuffer {
+	struct drm_framebuffer base;
+	struct nouveau_bo *nvbo;
+};
+
+static inline struct nouveau_framebuffer *
+nouveau_framebuffer(struct drm_framebuffer *fb)
+{
+	return container_of(fb, struct nouveau_framebuffer, base);
+}
+
+extern const struct drm_mode_config_funcs nouveau_mode_config_funcs;
+
+struct drm_framebuffer *
+nouveau_framebuffer_create(struct drm_device *, struct nouveau_bo *,
+			   struct drm_mode_fb_cmd *);
+
+#endif /* __NOUVEAU_FB_H__ */
diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
new file mode 100644
index 000000000000..0b05c869e0e7
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
@@ -0,0 +1,389 @@
+/*
+ * Copyright © 2007 David Airlie
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ * Authors:
+ *     David Airlie
+ */
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/string.h>
+#include <linux/mm.h>
+#include <linux/tty.h>
+#include <linux/slab.h>
+#include <linux/sysrq.h>
+#include <linux/delay.h>
+#include <linux/fb.h>
+#include <linux/init.h>
+#include <linux/screen_info.h>
+
+#include "drmP.h"
+#include "drm.h"
+#include "drm_crtc.h"
+#include "drm_crtc_helper.h"
+#include "drm_fb_helper.h"
+#include "nouveau_drv.h"
+#include "nouveau_drm.h"
+#include "nouveau_crtc.h"
+#include "nouveau_fb.h"
+#include "nouveau_fbcon.h"
+#include "nouveau_dma.h"
+
+static int
+nouveau_fbcon_sync(struct fb_info *info)
+{
+	struct nouveau_fbcon_par *par = info->par;
+	struct drm_device *dev = par->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_channel *chan = dev_priv->channel;
+	int ret, i;
+
+	if (!chan || !chan->accel_done ||
+	    info->state != FBINFO_STATE_RUNNING ||
+	    info->flags & FBINFO_HWACCEL_DISABLED)
+		return 0;
+
+	if (RING_SPACE(chan, 4)) {
+		nouveau_fbcon_gpu_lockup(info);
+		return 0;
+	}
+
+	BEGIN_RING(chan, 0, 0x0104, 1);
+	OUT_RING(chan, 0);
+	BEGIN_RING(chan, 0, 0x0100, 1);
+	OUT_RING(chan, 0);
+	nouveau_bo_wr32(chan->notifier_bo, chan->m2mf_ntfy + 3, 0xffffffff);
+	FIRE_RING(chan);
+
+	ret = -EBUSY;
+	for (i = 0; i < 100000; i++) {
+		if (!nouveau_bo_rd32(chan->notifier_bo, chan->m2mf_ntfy + 3)) {
+			ret = 0;
+			break;
+		}
+		DRM_UDELAY(1);
+	}
+
+	if (ret) {
+		nouveau_fbcon_gpu_lockup(info);
+		return 0;
+	}
+
+	chan->accel_done = false;
+	return 0;
+}
+
+static struct fb_ops nouveau_fbcon_ops = {
+	.owner = THIS_MODULE,
+	.fb_check_var = drm_fb_helper_check_var,
+	.fb_set_par = drm_fb_helper_set_par,
+	.fb_setcolreg = drm_fb_helper_setcolreg,
+	.fb_fillrect = cfb_fillrect,
+	.fb_copyarea = cfb_copyarea,
+	.fb_imageblit = cfb_imageblit,
+	.fb_sync = nouveau_fbcon_sync,
+	.fb_pan_display = drm_fb_helper_pan_display,
+	.fb_blank = drm_fb_helper_blank,
+	.fb_setcmap = drm_fb_helper_setcmap,
+};
+
+static void nouveau_fbcon_gamma_set(struct drm_crtc *crtc, u16 red, u16 green,
+				    u16 blue, int regno)
+{
+	struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
+
+	nv_crtc->lut.r[regno] = red;
+	nv_crtc->lut.g[regno] = green;
+	nv_crtc->lut.b[regno] = blue;
+}
+
+static void nouveau_fbcon_gamma_get(struct drm_crtc *crtc, u16 *red, u16 *green,
+				    u16 *blue, int regno)
+{
+	struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
+
+	*red = nv_crtc->lut.r[regno];
+	*green = nv_crtc->lut.g[regno];
+	*blue = nv_crtc->lut.b[regno];
+}
+
+static struct drm_fb_helper_funcs nouveau_fbcon_helper_funcs = {
+	.gamma_set = nouveau_fbcon_gamma_set,
+	.gamma_get = nouveau_fbcon_gamma_get
+};
+
+#if defined(__i386__) || defined(__x86_64__)
+static bool
+nouveau_fbcon_has_vesafb_or_efifb(struct drm_device *dev)
+{
+	struct pci_dev *pdev = dev->pdev;
+	int ramin;
+
+	if (screen_info.orig_video_isVGA != VIDEO_TYPE_VLFB &&
+	    screen_info.orig_video_isVGA != VIDEO_TYPE_EFI)
+		return false;
+
+	if (screen_info.lfb_base < pci_resource_start(pdev, 1))
+		goto not_fb;
+
+	if (screen_info.lfb_base + screen_info.lfb_size >=
+	    pci_resource_start(pdev, 1) + pci_resource_len(pdev, 1))
+		goto not_fb;
+
+	return true;
+not_fb:
+	ramin = 2;
+	if (pci_resource_len(pdev, ramin) == 0) {
+		ramin = 3;
+		if (pci_resource_len(pdev, ramin) == 0)
+			return false;
+	}
+
+	if (screen_info.lfb_base < pci_resource_start(pdev, ramin))
+		return false;
+
+	if (screen_info.lfb_base + screen_info.lfb_size >=
+	    pci_resource_start(pdev, ramin) + pci_resource_len(pdev, ramin))
+		return false;
+
+	return true;
+}
+#endif
+
+void
+nouveau_fbcon_zfill(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct fb_info *info = dev_priv->fbdev_info;
+	struct fb_fillrect rect;
+
+	/* Clear the entire fbcon.  The drm will program every connector
+	 * with it's preferred mode.  If the sizes differ, one display will
+	 * quite likely have garbage around the console.
+	 */
+	rect.dx = rect.dy = 0;
+	rect.width = info->var.xres_virtual;
+	rect.height = info->var.yres_virtual;
+	rect.color = 0;
+	rect.rop = ROP_COPY;
+	info->fbops->fb_fillrect(info, &rect);
+}
+
+static int
+nouveau_fbcon_create(struct drm_device *dev, uint32_t fb_width,
+		     uint32_t fb_height, uint32_t surface_width,
+		     uint32_t surface_height, uint32_t surface_depth,
+		     uint32_t surface_bpp, struct drm_framebuffer **pfb)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct fb_info *info;
+	struct nouveau_fbcon_par *par;
+	struct drm_framebuffer *fb;
+	struct nouveau_framebuffer *nouveau_fb;
+	struct nouveau_bo *nvbo;
+	struct drm_mode_fb_cmd mode_cmd;
+	struct device *device = &dev->pdev->dev;
+	int size, ret;
+
+	mode_cmd.width = surface_width;
+	mode_cmd.height = surface_height;
+
+	mode_cmd.bpp = surface_bpp;
+	mode_cmd.pitch = mode_cmd.width * (mode_cmd.bpp >> 3);
+	mode_cmd.pitch = roundup(mode_cmd.pitch, 256);
+	mode_cmd.depth = surface_depth;
+
+	size = mode_cmd.pitch * mode_cmd.height;
+	size = roundup(size, PAGE_SIZE);
+
+	ret = nouveau_gem_new(dev, dev_priv->channel, size, 0, TTM_PL_FLAG_VRAM,
+			      0, 0x0000, false, true, &nvbo);
+	if (ret) {
+		NV_ERROR(dev, "failed to allocate framebuffer\n");
+		goto out;
+	}
+
+	ret = nouveau_bo_pin(nvbo, TTM_PL_FLAG_VRAM);
+	if (ret) {
+		NV_ERROR(dev, "failed to pin fb: %d\n", ret);
+		nouveau_bo_ref(NULL, &nvbo);
+		goto out;
+	}
+
+	ret = nouveau_bo_map(nvbo);
+	if (ret) {
+		NV_ERROR(dev, "failed to map fb: %d\n", ret);
+		nouveau_bo_unpin(nvbo);
+		nouveau_bo_ref(NULL, &nvbo);
+		goto out;
+	}
+
+	mutex_lock(&dev->struct_mutex);
+
+	fb = nouveau_framebuffer_create(dev, nvbo, &mode_cmd);
+	if (!fb) {
+		ret = -ENOMEM;
+		NV_ERROR(dev, "failed to allocate fb.\n");
+		goto out_unref;
+	}
+
+	list_add(&fb->filp_head, &dev->mode_config.fb_kernel_list);
+
+	nouveau_fb = nouveau_framebuffer(fb);
+	*pfb = fb;
+
+	info = framebuffer_alloc(sizeof(struct nouveau_fbcon_par), device);
+	if (!info) {
+		ret = -ENOMEM;
+		goto out_unref;
+	}
+
+	par = info->par;
+	par->helper.funcs = &nouveau_fbcon_helper_funcs;
+	par->helper.dev = dev;
+	ret = drm_fb_helper_init_crtc_count(&par->helper, 2, 4);
+	if (ret)
+		goto out_unref;
+	dev_priv->fbdev_info = info;
+
+	strcpy(info->fix.id, "nouveaufb");
+	info->flags = FBINFO_DEFAULT | FBINFO_HWACCEL_COPYAREA |
+		      FBINFO_HWACCEL_FILLRECT | FBINFO_HWACCEL_IMAGEBLIT;
+	info->fbops = &nouveau_fbcon_ops;
+	info->fix.smem_start = dev->mode_config.fb_base + nvbo->bo.offset -
+			       dev_priv->vm_vram_base;
+	info->fix.smem_len = size;
+
+	info->screen_base = nvbo_kmap_obj_iovirtual(nouveau_fb->nvbo);
+	info->screen_size = size;
+
+	drm_fb_helper_fill_fix(info, fb->pitch, fb->depth);
+	drm_fb_helper_fill_var(info, fb, fb_width, fb_height);
+
+	/* FIXME: we really shouldn't expose mmio space at all */
+	info->fix.mmio_start = pci_resource_start(dev->pdev, 1);
+	info->fix.mmio_len = pci_resource_len(dev->pdev, 1);
+
+	/* Set aperture base/size for vesafb takeover */
+#if defined(__i386__) || defined(__x86_64__)
+	if (nouveau_fbcon_has_vesafb_or_efifb(dev)) {
+		/* Some NVIDIA VBIOS' are stupid and decide to put the
+		 * framebuffer in the middle of the PRAMIN BAR for
+		 * whatever reason.  We need to know the exact lfb_base
+		 * to get vesafb kicked off, and the only reliable way
+		 * we have left is to find out lfb_base the same way
+		 * vesafb did.
+		 */
+		info->aperture_base = screen_info.lfb_base;
+		info->aperture_size = screen_info.lfb_size;
+		if (screen_info.orig_video_isVGA == VIDEO_TYPE_VLFB)
+			info->aperture_size *= 65536;
+	} else
+#endif
+	{
+		info->aperture_base = info->fix.mmio_start;
+		info->aperture_size = info->fix.mmio_len;
+	}
+
+	info->pixmap.size = 64*1024;
+	info->pixmap.buf_align = 8;
+	info->pixmap.access_align = 32;
+	info->pixmap.flags = FB_PIXMAP_SYSTEM;
+	info->pixmap.scan_align = 1;
+
+	fb->fbdev = info;
+
+	par->nouveau_fb = nouveau_fb;
+	par->dev = dev;
+
+	if (dev_priv->channel) {
+		switch (dev_priv->card_type) {
+		case NV_50:
+			nv50_fbcon_accel_init(info);
+			break;
+		default:
+			nv04_fbcon_accel_init(info);
+			break;
+		};
+	}
+
+	nouveau_fbcon_zfill(dev);
+
+	/* To allow resizeing without swapping buffers */
+	NV_INFO(dev, "allocated %dx%d fb: 0x%lx, bo %p\n",
+						nouveau_fb->base.width,
+						nouveau_fb->base.height,
+						nvbo->bo.offset, nvbo);
+
+	mutex_unlock(&dev->struct_mutex);
+	return 0;
+
+out_unref:
+	mutex_unlock(&dev->struct_mutex);
+out:
+	return ret;
+}
+
+int
+nouveau_fbcon_probe(struct drm_device *dev)
+{
+	NV_DEBUG_KMS(dev, "\n");
+
+	return drm_fb_helper_single_fb_probe(dev, 32, nouveau_fbcon_create);
+}
+
+int
+nouveau_fbcon_remove(struct drm_device *dev, struct drm_framebuffer *fb)
+{
+	struct nouveau_framebuffer *nouveau_fb = nouveau_framebuffer(fb);
+	struct fb_info *info;
+
+	if (!fb)
+		return -EINVAL;
+
+	info = fb->fbdev;
+	if (info) {
+		struct nouveau_fbcon_par *par = info->par;
+
+		unregister_framebuffer(info);
+		nouveau_bo_unmap(nouveau_fb->nvbo);
+		mutex_lock(&dev->struct_mutex);
+		drm_gem_object_unreference(nouveau_fb->nvbo->gem);
+		nouveau_fb->nvbo = NULL;
+		mutex_unlock(&dev->struct_mutex);
+		if (par)
+			drm_fb_helper_free(&par->helper);
+		framebuffer_release(info);
+	}
+
+	return 0;
+}
+
+void nouveau_fbcon_gpu_lockup(struct fb_info *info)
+{
+	struct nouveau_fbcon_par *par = info->par;
+	struct drm_device *dev = par->dev;
+
+	NV_ERROR(dev, "GPU lockup - switching to software fbcon\n");
+	info->flags |= FBINFO_HWACCEL_DISABLED;
+}
diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.h b/drivers/gpu/drm/nouveau/nouveau_fbcon.h
new file mode 100644
index 000000000000..462e0b87b4bd
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2008 Maarten Maathuis.
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial
+ * portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE COPYRIGHT OWNER(S) AND/OR ITS SUPPLIERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
+#ifndef __NOUVEAU_FBCON_H__
+#define __NOUVEAU_FBCON_H__
+
+#include "drm_fb_helper.h"
+
+struct nouveau_fbcon_par {
+	struct drm_fb_helper helper;
+	struct drm_device *dev;
+	struct nouveau_framebuffer *nouveau_fb;
+};
+
+int nouveau_fbcon_probe(struct drm_device *dev);
+int nouveau_fbcon_remove(struct drm_device *dev, struct drm_framebuffer *fb);
+void nouveau_fbcon_restore(void);
+void nouveau_fbcon_zfill(struct drm_device *dev);
+
+int nv04_fbcon_accel_init(struct fb_info *info);
+int nv50_fbcon_accel_init(struct fb_info *info);
+
+void nouveau_fbcon_gpu_lockup(struct fb_info *info);
+#endif /* __NV50_FBCON_H__ */
+
diff --git a/drivers/gpu/drm/nouveau/nouveau_fence.c b/drivers/gpu/drm/nouveau/nouveau_fence.c
new file mode 100644
index 000000000000..faddf53ff9ed
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nouveau_fence.c
@@ -0,0 +1,262 @@
+/*
+ * Copyright (C) 2007 Ben Skeggs.
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial
+ * portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE COPYRIGHT OWNER(S) AND/OR ITS SUPPLIERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
+#include "drmP.h"
+#include "drm.h"
+
+#include "nouveau_drv.h"
+#include "nouveau_dma.h"
+
+#define USE_REFCNT (dev_priv->card_type >= NV_10)
+
+struct nouveau_fence {
+	struct nouveau_channel *channel;
+	struct kref refcount;
+	struct list_head entry;
+
+	uint32_t sequence;
+	bool signalled;
+};
+
+static inline struct nouveau_fence *
+nouveau_fence(void *sync_obj)
+{
+	return (struct nouveau_fence *)sync_obj;
+}
+
+static void
+nouveau_fence_del(struct kref *ref)
+{
+	struct nouveau_fence *fence =
+		container_of(ref, struct nouveau_fence, refcount);
+
+	kfree(fence);
+}
+
+void
+nouveau_fence_update(struct nouveau_channel *chan)
+{
+	struct drm_nouveau_private *dev_priv = chan->dev->dev_private;
+	struct list_head *entry, *tmp;
+	struct nouveau_fence *fence;
+	uint32_t sequence;
+
+	if (USE_REFCNT)
+		sequence = nvchan_rd32(chan, 0x48);
+	else
+		sequence = chan->fence.last_sequence_irq;
+
+	if (chan->fence.sequence_ack == sequence)
+		return;
+	chan->fence.sequence_ack = sequence;
+
+	list_for_each_safe(entry, tmp, &chan->fence.pending) {
+		fence = list_entry(entry, struct nouveau_fence, entry);
+
+		sequence = fence->sequence;
+		fence->signalled = true;
+		list_del(&fence->entry);
+		kref_put(&fence->refcount, nouveau_fence_del);
+
+		if (sequence == chan->fence.sequence_ack)
+			break;
+	}
+}
+
+int
+nouveau_fence_new(struct nouveau_channel *chan, struct nouveau_fence **pfence,
+		  bool emit)
+{
+	struct nouveau_fence *fence;
+	int ret = 0;
+
+	fence = kzalloc(sizeof(*fence), GFP_KERNEL);
+	if (!fence)
+		return -ENOMEM;
+	kref_init(&fence->refcount);
+	fence->channel = chan;
+
+	if (emit)
+		ret = nouveau_fence_emit(fence);
+
+	if (ret)
+		nouveau_fence_unref((void *)&fence);
+	*pfence = fence;
+	return ret;
+}
+
+struct nouveau_channel *
+nouveau_fence_channel(struct nouveau_fence *fence)
+{
+	return fence ? fence->channel : NULL;
+}
+
+int
+nouveau_fence_emit(struct nouveau_fence *fence)
+{
+	struct drm_nouveau_private *dev_priv = fence->channel->dev->dev_private;
+	struct nouveau_channel *chan = fence->channel;
+	unsigned long flags;
+	int ret;
+
+	ret = RING_SPACE(chan, 2);
+	if (ret)
+		return ret;
+
+	if (unlikely(chan->fence.sequence == chan->fence.sequence_ack - 1)) {
+		spin_lock_irqsave(&chan->fence.lock, flags);
+		nouveau_fence_update(chan);
+		spin_unlock_irqrestore(&chan->fence.lock, flags);
+
+		BUG_ON(chan->fence.sequence ==
+		       chan->fence.sequence_ack - 1);
+	}
+
+	fence->sequence = ++chan->fence.sequence;
+
+	kref_get(&fence->refcount);
+	spin_lock_irqsave(&chan->fence.lock, flags);
+	list_add_tail(&fence->entry, &chan->fence.pending);
+	spin_unlock_irqrestore(&chan->fence.lock, flags);
+
+	BEGIN_RING(chan, NvSubSw, USE_REFCNT ? 0x0050 : 0x0150, 1);
+	OUT_RING(chan, fence->sequence);
+	FIRE_RING(chan);
+
+	return 0;
+}
+
+void
+nouveau_fence_unref(void **sync_obj)
+{
+	struct nouveau_fence *fence = nouveau_fence(*sync_obj);
+
+	if (fence)
+		kref_put(&fence->refcount, nouveau_fence_del);
+	*sync_obj = NULL;
+}
+
+void *
+nouveau_fence_ref(void *sync_obj)
+{
+	struct nouveau_fence *fence = nouveau_fence(sync_obj);
+
+	kref_get(&fence->refcount);
+	return sync_obj;
+}
+
+bool
+nouveau_fence_signalled(void *sync_obj, void *sync_arg)
+{
+	struct nouveau_fence *fence = nouveau_fence(sync_obj);
+	struct nouveau_channel *chan = fence->channel;
+	unsigned long flags;
+
+	if (fence->signalled)
+		return true;
+
+	spin_lock_irqsave(&chan->fence.lock, flags);
+	nouveau_fence_update(chan);
+	spin_unlock_irqrestore(&chan->fence.lock, flags);
+	return fence->signalled;
+}
+
+int
+nouveau_fence_wait(void *sync_obj, void *sync_arg, bool lazy, bool intr)
+{
+	unsigned long timeout = jiffies + (3 * DRM_HZ);
+	int ret = 0;
+
+	__set_current_state(intr ? TASK_INTERRUPTIBLE : TASK_UNINTERRUPTIBLE);
+
+	while (1) {
+		if (nouveau_fence_signalled(sync_obj, sync_arg))
+			break;
+
+		if (time_after_eq(jiffies, timeout)) {
+			ret = -EBUSY;
+			break;
+		}
+
+		if (lazy)
+			schedule_timeout(1);
+
+		if (intr && signal_pending(current)) {
+			ret = -ERESTARTSYS;
+			break;
+		}
+	}
+
+	__set_current_state(TASK_RUNNING);
+
+	return ret;
+}
+
+int
+nouveau_fence_flush(void *sync_obj, void *sync_arg)
+{
+	return 0;
+}
+
+void
+nouveau_fence_handler(struct drm_device *dev, int channel)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_channel *chan = NULL;
+
+	if (channel >= 0 && channel < dev_priv->engine.fifo.channels)
+		chan = dev_priv->fifos[channel];
+
+	if (chan) {
+		spin_lock_irq(&chan->fence.lock);
+		nouveau_fence_update(chan);
+		spin_unlock_irq(&chan->fence.lock);
+	}
+}
+
+int
+nouveau_fence_init(struct nouveau_channel *chan)
+{
+	INIT_LIST_HEAD(&chan->fence.pending);
+	spin_lock_init(&chan->fence.lock);
+	return 0;
+}
+
+void
+nouveau_fence_fini(struct nouveau_channel *chan)
+{
+	struct list_head *entry, *tmp;
+	struct nouveau_fence *fence;
+
+	list_for_each_safe(entry, tmp, &chan->fence.pending) {
+		fence = list_entry(entry, struct nouveau_fence, entry);
+
+		fence->signalled = true;
+		list_del(&fence->entry);
+		kref_put(&fence->refcount, nouveau_fence_del);
+	}
+}
+
diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c
new file mode 100644
index 000000000000..2009db2426c3
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
@@ -0,0 +1,978 @@
+/*
+ * Copyright (C) 2008 Ben Skeggs.
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial
+ * portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE COPYRIGHT OWNER(S) AND/OR ITS SUPPLIERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+#include "drmP.h"
+#include "drm.h"
+
+#include "nouveau_drv.h"
+#include "nouveau_drm.h"
+#include "nouveau_dma.h"
+
+#define nouveau_gem_pushbuf_sync(chan) 0
+
+int
+nouveau_gem_object_new(struct drm_gem_object *gem)
+{
+	return 0;
+}
+
+void
+nouveau_gem_object_del(struct drm_gem_object *gem)
+{
+	struct nouveau_bo *nvbo = gem->driver_private;
+	struct ttm_buffer_object *bo = &nvbo->bo;
+
+	if (!nvbo)
+		return;
+	nvbo->gem = NULL;
+
+	if (unlikely(nvbo->cpu_filp))
+		ttm_bo_synccpu_write_release(bo);
+
+	if (unlikely(nvbo->pin_refcnt)) {
+		nvbo->pin_refcnt = 1;
+		nouveau_bo_unpin(nvbo);
+	}
+
+	ttm_bo_unref(&bo);
+}
+
+int
+nouveau_gem_new(struct drm_device *dev, struct nouveau_channel *chan,
+		int size, int align, uint32_t flags, uint32_t tile_mode,
+		uint32_t tile_flags, bool no_vm, bool mappable,
+		struct nouveau_bo **pnvbo)
+{
+	struct nouveau_bo *nvbo;
+	int ret;
+
+	ret = nouveau_bo_new(dev, chan, size, align, flags, tile_mode,
+			     tile_flags, no_vm, mappable, pnvbo);
+	if (ret)
+		return ret;
+	nvbo = *pnvbo;
+
+	nvbo->gem = drm_gem_object_alloc(dev, nvbo->bo.mem.size);
+	if (!nvbo->gem) {
+		nouveau_bo_ref(NULL, pnvbo);
+		return -ENOMEM;
+	}
+
+	nvbo->bo.persistant_swap_storage = nvbo->gem->filp;
+	nvbo->gem->driver_private = nvbo;
+	return 0;
+}
+
+static int
+nouveau_gem_info(struct drm_gem_object *gem, struct drm_nouveau_gem_info *rep)
+{
+	struct nouveau_bo *nvbo = nouveau_gem_object(gem);
+
+	if (nvbo->bo.mem.mem_type == TTM_PL_TT)
+		rep->domain = NOUVEAU_GEM_DOMAIN_GART;
+	else
+		rep->domain = NOUVEAU_GEM_DOMAIN_VRAM;
+
+	rep->size = nvbo->bo.mem.num_pages << PAGE_SHIFT;
+	rep->offset = nvbo->bo.offset;
+	rep->map_handle = nvbo->mappable ? nvbo->bo.addr_space_offset : 0;
+	rep->tile_mode = nvbo->tile_mode;
+	rep->tile_flags = nvbo->tile_flags;
+	return 0;
+}
+
+static bool
+nouveau_gem_tile_flags_valid(struct drm_device *dev, uint32_t tile_flags) {
+	switch (tile_flags) {
+	case 0x0000:
+	case 0x1800:
+	case 0x2800:
+	case 0x4800:
+	case 0x7000:
+	case 0x7400:
+	case 0x7a00:
+	case 0xe000:
+		break;
+	default:
+		NV_ERROR(dev, "bad page flags: 0x%08x\n", tile_flags);
+		return false;
+	}
+
+	return true;
+}
+
+int
+nouveau_gem_ioctl_new(struct drm_device *dev, void *data,
+		      struct drm_file *file_priv)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct drm_nouveau_gem_new *req = data;
+	struct nouveau_bo *nvbo = NULL;
+	struct nouveau_channel *chan = NULL;
+	uint32_t flags = 0;
+	int ret = 0;
+
+	NOUVEAU_CHECK_INITIALISED_WITH_RETURN;
+
+	if (unlikely(dev_priv->ttm.bdev.dev_mapping == NULL))
+		dev_priv->ttm.bdev.dev_mapping = dev_priv->dev->dev_mapping;
+
+	if (req->channel_hint) {
+		NOUVEAU_GET_USER_CHANNEL_WITH_RETURN(req->channel_hint,
+						     file_priv, chan);
+	}
+
+	if (req->info.domain & NOUVEAU_GEM_DOMAIN_VRAM)
+		flags |= TTM_PL_FLAG_VRAM;
+	if (req->info.domain & NOUVEAU_GEM_DOMAIN_GART)
+		flags |= TTM_PL_FLAG_TT;
+	if (!flags || req->info.domain & NOUVEAU_GEM_DOMAIN_CPU)
+		flags |= TTM_PL_FLAG_SYSTEM;
+
+	if (!nouveau_gem_tile_flags_valid(dev, req->info.tile_flags))
+		return -EINVAL;
+
+	ret = nouveau_gem_new(dev, chan, req->info.size, req->align, flags,
+			      req->info.tile_mode, req->info.tile_flags, false,
+			      (req->info.domain & NOUVEAU_GEM_DOMAIN_MAPPABLE),
+			      &nvbo);
+	if (ret)
+		return ret;
+
+	ret = nouveau_gem_info(nvbo->gem, &req->info);
+	if (ret)
+		goto out;
+
+	ret = drm_gem_handle_create(file_priv, nvbo->gem, &req->info.handle);
+out:
+	mutex_lock(&dev->struct_mutex);
+	drm_gem_object_handle_unreference(nvbo->gem);
+	mutex_unlock(&dev->struct_mutex);
+
+	if (ret)
+		drm_gem_object_unreference(nvbo->gem);
+	return ret;
+}
+
+static int
+nouveau_gem_set_domain(struct drm_gem_object *gem, uint32_t read_domains,
+		       uint32_t write_domains, uint32_t valid_domains)
+{
+	struct nouveau_bo *nvbo = gem->driver_private;
+	struct ttm_buffer_object *bo = &nvbo->bo;
+	uint64_t flags;
+
+	if (!valid_domains || (!read_domains && !write_domains))
+		return -EINVAL;
+
+	if (write_domains) {
+		if ((valid_domains & NOUVEAU_GEM_DOMAIN_VRAM) &&
+		    (write_domains & NOUVEAU_GEM_DOMAIN_VRAM))
+			flags = TTM_PL_FLAG_VRAM;
+		else
+		if ((valid_domains & NOUVEAU_GEM_DOMAIN_GART) &&
+		    (write_domains & NOUVEAU_GEM_DOMAIN_GART))
+			flags = TTM_PL_FLAG_TT;
+		else
+			return -EINVAL;
+	} else {
+		if ((valid_domains & NOUVEAU_GEM_DOMAIN_VRAM) &&
+		    (read_domains & NOUVEAU_GEM_DOMAIN_VRAM) &&
+		    bo->mem.mem_type == TTM_PL_VRAM)
+			flags = TTM_PL_FLAG_VRAM;
+		else
+		if ((valid_domains & NOUVEAU_GEM_DOMAIN_GART) &&
+		    (read_domains & NOUVEAU_GEM_DOMAIN_GART) &&
+		    bo->mem.mem_type == TTM_PL_TT)
+			flags = TTM_PL_FLAG_TT;
+		else
+		if ((valid_domains & NOUVEAU_GEM_DOMAIN_VRAM) &&
+		    (read_domains & NOUVEAU_GEM_DOMAIN_VRAM))
+			flags = TTM_PL_FLAG_VRAM;
+		else
+			flags = TTM_PL_FLAG_TT;
+	}
+
+	nouveau_bo_placement_set(nvbo, flags);
+	return 0;
+}
+
+struct validate_op {
+	struct list_head vram_list;
+	struct list_head gart_list;
+	struct list_head both_list;
+};
+
+static void
+validate_fini_list(struct list_head *list, struct nouveau_fence *fence)
+{
+	struct list_head *entry, *tmp;
+	struct nouveau_bo *nvbo;
+
+	list_for_each_safe(entry, tmp, list) {
+		nvbo = list_entry(entry, struct nouveau_bo, entry);
+		if (likely(fence)) {
+			struct nouveau_fence *prev_fence;
+
+			spin_lock(&nvbo->bo.lock);
+			prev_fence = nvbo->bo.sync_obj;
+			nvbo->bo.sync_obj = nouveau_fence_ref(fence);
+			spin_unlock(&nvbo->bo.lock);
+			nouveau_fence_unref((void *)&prev_fence);
+		}
+
+		list_del(&nvbo->entry);
+		nvbo->reserved_by = NULL;
+		ttm_bo_unreserve(&nvbo->bo);
+		drm_gem_object_unreference(nvbo->gem);
+	}
+}
+
+static void
+validate_fini(struct validate_op *op, struct nouveau_fence* fence)
+{
+	validate_fini_list(&op->vram_list, fence);
+	validate_fini_list(&op->gart_list, fence);
+	validate_fini_list(&op->both_list, fence);
+}
+
+static int
+validate_init(struct nouveau_channel *chan, struct drm_file *file_priv,
+	      struct drm_nouveau_gem_pushbuf_bo *pbbo,
+	      int nr_buffers, struct validate_op *op)
+{
+	struct drm_device *dev = chan->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	uint32_t sequence;
+	int trycnt = 0;
+	int ret, i;
+
+	sequence = atomic_add_return(1, &dev_priv->ttm.validate_sequence);
+retry:
+	if (++trycnt > 100000) {
+		NV_ERROR(dev, "%s failed and gave up.\n", __func__);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < nr_buffers; i++) {
+		struct drm_nouveau_gem_pushbuf_bo *b = &pbbo[i];
+		struct drm_gem_object *gem;
+		struct nouveau_bo *nvbo;
+
+		gem = drm_gem_object_lookup(dev, file_priv, b->handle);
+		if (!gem) {
+			NV_ERROR(dev, "Unknown handle 0x%08x\n", b->handle);
+			validate_fini(op, NULL);
+			return -EINVAL;
+		}
+		nvbo = gem->driver_private;
+
+		if (nvbo->reserved_by && nvbo->reserved_by == file_priv) {
+			NV_ERROR(dev, "multiple instances of buffer %d on "
+				      "validation list\n", b->handle);
+			validate_fini(op, NULL);
+			return -EINVAL;
+		}
+
+		ret = ttm_bo_reserve(&nvbo->bo, false, false, true, sequence);
+		if (ret) {
+			validate_fini(op, NULL);
+			if (ret == -EAGAIN)
+				ret = ttm_bo_wait_unreserved(&nvbo->bo, false);
+			drm_gem_object_unreference(gem);
+			if (ret)
+				return ret;
+			goto retry;
+		}
+
+		nvbo->reserved_by = file_priv;
+		nvbo->pbbo_index = i;
+		if ((b->valid_domains & NOUVEAU_GEM_DOMAIN_VRAM) &&
+		    (b->valid_domains & NOUVEAU_GEM_DOMAIN_GART))
+			list_add_tail(&nvbo->entry, &op->both_list);
+		else
+		if (b->valid_domains & NOUVEAU_GEM_DOMAIN_VRAM)
+			list_add_tail(&nvbo->entry, &op->vram_list);
+		else
+		if (b->valid_domains & NOUVEAU_GEM_DOMAIN_GART)
+			list_add_tail(&nvbo->entry, &op->gart_list);
+		else {
+			NV_ERROR(dev, "invalid valid domains: 0x%08x\n",
+				 b->valid_domains);
+			validate_fini(op, NULL);
+			return -EINVAL;
+		}
+
+		if (unlikely(atomic_read(&nvbo->bo.cpu_writers) > 0)) {
+			validate_fini(op, NULL);
+
+			if (nvbo->cpu_filp == file_priv) {
+				NV_ERROR(dev, "bo %p mapped by process trying "
+					      "to validate it!\n", nvbo);
+				return -EINVAL;
+			}
+
+			ret = ttm_bo_wait_cpu(&nvbo->bo, false);
+			if (ret)
+				return ret;
+			goto retry;
+		}
+	}
+
+	return 0;
+}
+
+static int
+validate_list(struct nouveau_channel *chan, struct list_head *list,
+	      struct drm_nouveau_gem_pushbuf_bo *pbbo, uint64_t user_pbbo_ptr)
+{
+	struct drm_nouveau_gem_pushbuf_bo __user *upbbo =
+				(void __force __user *)(uintptr_t)user_pbbo_ptr;
+	struct nouveau_bo *nvbo;
+	int ret, relocs = 0;
+
+	list_for_each_entry(nvbo, list, entry) {
+		struct drm_nouveau_gem_pushbuf_bo *b = &pbbo[nvbo->pbbo_index];
+		struct nouveau_fence *prev_fence = nvbo->bo.sync_obj;
+
+		if (prev_fence && nouveau_fence_channel(prev_fence) != chan) {
+			spin_lock(&nvbo->bo.lock);
+			ret = ttm_bo_wait(&nvbo->bo, false, false, false);
+			spin_unlock(&nvbo->bo.lock);
+			if (unlikely(ret))
+				return ret;
+		}
+
+		ret = nouveau_gem_set_domain(nvbo->gem, b->read_domains,
+					     b->write_domains,
+					     b->valid_domains);
+		if (unlikely(ret))
+			return ret;
+
+		nvbo->channel = chan;
+		ret = ttm_bo_validate(&nvbo->bo, &nvbo->placement,
+				      false, false);
+		nvbo->channel = NULL;
+		if (unlikely(ret))
+			return ret;
+
+		if (nvbo->bo.offset == b->presumed_offset &&
+		    ((nvbo->bo.mem.mem_type == TTM_PL_VRAM &&
+		      b->presumed_domain & NOUVEAU_GEM_DOMAIN_VRAM) ||
+		     (nvbo->bo.mem.mem_type == TTM_PL_TT &&
+		      b->presumed_domain & NOUVEAU_GEM_DOMAIN_GART)))
+			continue;
+
+		if (nvbo->bo.mem.mem_type == TTM_PL_TT)
+			b->presumed_domain = NOUVEAU_GEM_DOMAIN_GART;
+		else
+			b->presumed_domain = NOUVEAU_GEM_DOMAIN_VRAM;
+		b->presumed_offset = nvbo->bo.offset;
+		b->presumed_ok = 0;
+		relocs++;
+
+		if (DRM_COPY_TO_USER(&upbbo[nvbo->pbbo_index], b, sizeof(*b)))
+			return -EFAULT;
+	}
+
+	return relocs;
+}
+
+static int
+nouveau_gem_pushbuf_validate(struct nouveau_channel *chan,
+			     struct drm_file *file_priv,
+			     struct drm_nouveau_gem_pushbuf_bo *pbbo,
+			     uint64_t user_buffers, int nr_buffers,
+			     struct validate_op *op, int *apply_relocs)
+{
+	int ret, relocs = 0;
+
+	INIT_LIST_HEAD(&op->vram_list);
+	INIT_LIST_HEAD(&op->gart_list);
+	INIT_LIST_HEAD(&op->both_list);
+
+	if (nr_buffers == 0)
+		return 0;
+
+	ret = validate_init(chan, file_priv, pbbo, nr_buffers, op);
+	if (unlikely(ret))
+		return ret;
+
+	ret = validate_list(chan, &op->vram_list, pbbo, user_buffers);
+	if (unlikely(ret < 0)) {
+		validate_fini(op, NULL);
+		return ret;
+	}
+	relocs += ret;
+
+	ret = validate_list(chan, &op->gart_list, pbbo, user_buffers);
+	if (unlikely(ret < 0)) {
+		validate_fini(op, NULL);
+		return ret;
+	}
+	relocs += ret;
+
+	ret = validate_list(chan, &op->both_list, pbbo, user_buffers);
+	if (unlikely(ret < 0)) {
+		validate_fini(op, NULL);
+		return ret;
+	}
+	relocs += ret;
+
+	*apply_relocs = relocs;
+	return 0;
+}
+
+static inline void *
+u_memcpya(uint64_t user, unsigned nmemb, unsigned size)
+{
+	void *mem;
+	void __user *userptr = (void __force __user *)(uintptr_t)user;
+
+	mem = kmalloc(nmemb * size, GFP_KERNEL);
+	if (!mem)
+		return ERR_PTR(-ENOMEM);
+
+	if (DRM_COPY_FROM_USER(mem, userptr, nmemb * size)) {
+		kfree(mem);
+		return ERR_PTR(-EFAULT);
+	}
+
+	return mem;
+}
+
+static int
+nouveau_gem_pushbuf_reloc_apply(struct nouveau_channel *chan, int nr_bo,
+				struct drm_nouveau_gem_pushbuf_bo *bo,
+				int nr_relocs, uint64_t ptr_relocs,
+				int nr_dwords, int first_dword,
+				uint32_t *pushbuf, bool is_iomem)
+{
+	struct drm_nouveau_gem_pushbuf_reloc *reloc = NULL;
+	struct drm_device *dev = chan->dev;
+	int ret = 0, i;
+
+	reloc = u_memcpya(ptr_relocs, nr_relocs, sizeof(*reloc));
+	if (IS_ERR(reloc))
+		return PTR_ERR(reloc);
+
+	for (i = 0; i < nr_relocs; i++) {
+		struct drm_nouveau_gem_pushbuf_reloc *r = &reloc[i];
+		struct drm_nouveau_gem_pushbuf_bo *b;
+		uint32_t data;
+
+		if (r->bo_index >= nr_bo || r->reloc_index < first_dword ||
+		    r->reloc_index >= first_dword + nr_dwords) {
+			NV_ERROR(dev, "Bad relocation %d\n", i);
+			NV_ERROR(dev, "  bo: %d max %d\n", r->bo_index, nr_bo);
+			NV_ERROR(dev, "  id: %d max %d\n", r->reloc_index, nr_dwords);
+			ret = -EINVAL;
+			break;
+		}
+
+		b = &bo[r->bo_index];
+		if (b->presumed_ok)
+			continue;
+
+		if (r->flags & NOUVEAU_GEM_RELOC_LOW)
+			data = b->presumed_offset + r->data;
+		else
+		if (r->flags & NOUVEAU_GEM_RELOC_HIGH)
+			data = (b->presumed_offset + r->data) >> 32;
+		else
+			data = r->data;
+
+		if (r->flags & NOUVEAU_GEM_RELOC_OR) {
+			if (b->presumed_domain == NOUVEAU_GEM_DOMAIN_GART)
+				data |= r->tor;
+			else
+				data |= r->vor;
+		}
+
+		if (is_iomem)
+			iowrite32_native(data, (void __force __iomem *)
+						&pushbuf[r->reloc_index]);
+		else
+			pushbuf[r->reloc_index] = data;
+	}
+
+	kfree(reloc);
+	return ret;
+}
+
+int
+nouveau_gem_ioctl_pushbuf(struct drm_device *dev, void *data,
+			  struct drm_file *file_priv)
+{
+	struct drm_nouveau_gem_pushbuf *req = data;
+	struct drm_nouveau_gem_pushbuf_bo *bo = NULL;
+	struct nouveau_channel *chan;
+	struct validate_op op;
+	struct nouveau_fence* fence = 0;
+	uint32_t *pushbuf = NULL;
+	int ret = 0, do_reloc = 0, i;
+
+	NOUVEAU_CHECK_INITIALISED_WITH_RETURN;
+	NOUVEAU_GET_USER_CHANNEL_WITH_RETURN(req->channel, file_priv, chan);
+
+	if (req->nr_dwords >= chan->dma.max ||
+	    req->nr_buffers > NOUVEAU_GEM_MAX_BUFFERS ||
+	    req->nr_relocs > NOUVEAU_GEM_MAX_RELOCS) {
+		NV_ERROR(dev, "Pushbuf config exceeds limits:\n");
+		NV_ERROR(dev, "  dwords : %d max %d\n", req->nr_dwords,
+			 chan->dma.max - 1);
+		NV_ERROR(dev, "  buffers: %d max %d\n", req->nr_buffers,
+			 NOUVEAU_GEM_MAX_BUFFERS);
+		NV_ERROR(dev, "  relocs : %d max %d\n", req->nr_relocs,
+			 NOUVEAU_GEM_MAX_RELOCS);
+		return -EINVAL;
+	}
+
+	pushbuf = u_memcpya(req->dwords, req->nr_dwords, sizeof(uint32_t));
+	if (IS_ERR(pushbuf))
+		return PTR_ERR(pushbuf);
+
+	bo = u_memcpya(req->buffers, req->nr_buffers, sizeof(*bo));
+	if (IS_ERR(bo)) {
+		kfree(pushbuf);
+		return PTR_ERR(bo);
+	}
+
+	mutex_lock(&dev->struct_mutex);
+
+	/* Validate buffer list */
+	ret = nouveau_gem_pushbuf_validate(chan, file_priv, bo, req->buffers,
+					   req->nr_buffers, &op, &do_reloc);
+	if (ret)
+		goto out;
+
+	/* Apply any relocations that are required */
+	if (do_reloc) {
+		ret = nouveau_gem_pushbuf_reloc_apply(chan, req->nr_buffers,
+						      bo, req->nr_relocs,
+						      req->relocs,
+						      req->nr_dwords, 0,
+						      pushbuf, false);
+		if (ret)
+			goto out;
+	}
+
+	/* Emit push buffer to the hw
+	 */
+	ret = RING_SPACE(chan, req->nr_dwords);
+	if (ret)
+		goto out;
+
+	OUT_RINGp(chan, pushbuf, req->nr_dwords);
+
+	ret = nouveau_fence_new(chan, &fence, true);
+	if (ret) {
+		NV_ERROR(dev, "error fencing pushbuf: %d\n", ret);
+		WIND_RING(chan);
+		goto out;
+	}
+
+	if (nouveau_gem_pushbuf_sync(chan)) {
+		ret = nouveau_fence_wait(fence, NULL, false, false);
+		if (ret) {
+			for (i = 0; i < req->nr_dwords; i++)
+				NV_ERROR(dev, "0x%08x\n", pushbuf[i]);
+			NV_ERROR(dev, "^^ above push buffer is fail :(\n");
+		}
+	}
+
+out:
+	validate_fini(&op, fence);
+	nouveau_fence_unref((void**)&fence);
+	mutex_unlock(&dev->struct_mutex);
+	kfree(pushbuf);
+	kfree(bo);
+	return ret;
+}
+
+#define PUSHBUF_CAL (dev_priv->card_type >= NV_20)
+
+int
+nouveau_gem_ioctl_pushbuf_call(struct drm_device *dev, void *data,
+			       struct drm_file *file_priv)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct drm_nouveau_gem_pushbuf_call *req = data;
+	struct drm_nouveau_gem_pushbuf_bo *bo = NULL;
+	struct nouveau_channel *chan;
+	struct drm_gem_object *gem;
+	struct nouveau_bo *pbbo;
+	struct validate_op op;
+	struct nouveau_fence* fence = 0;
+	int i, ret = 0, do_reloc = 0;
+
+	NOUVEAU_CHECK_INITIALISED_WITH_RETURN;
+	NOUVEAU_GET_USER_CHANNEL_WITH_RETURN(req->channel, file_priv, chan);
+
+	if (unlikely(req->handle == 0))
+		goto out_next;
+
+	if (req->nr_buffers > NOUVEAU_GEM_MAX_BUFFERS ||
+	    req->nr_relocs > NOUVEAU_GEM_MAX_RELOCS) {
+		NV_ERROR(dev, "Pushbuf config exceeds limits:\n");
+		NV_ERROR(dev, "  buffers: %d max %d\n", req->nr_buffers,
+			 NOUVEAU_GEM_MAX_BUFFERS);
+		NV_ERROR(dev, "  relocs : %d max %d\n", req->nr_relocs,
+			 NOUVEAU_GEM_MAX_RELOCS);
+		return -EINVAL;
+	}
+
+	bo = u_memcpya(req->buffers, req->nr_buffers, sizeof(*bo));
+	if (IS_ERR(bo))
+		return PTR_ERR(bo);
+
+	mutex_lock(&dev->struct_mutex);
+
+	/* Validate buffer list */
+	ret = nouveau_gem_pushbuf_validate(chan, file_priv, bo, req->buffers,
+					   req->nr_buffers, &op, &do_reloc);
+	if (ret) {
+		NV_ERROR(dev, "validate: %d\n", ret);
+		goto out;
+	}
+
+	/* Validate DMA push buffer */
+	gem = drm_gem_object_lookup(dev, file_priv, req->handle);
+	if (!gem) {
+		NV_ERROR(dev, "Unknown pb handle 0x%08x\n", req->handle);
+		ret = -EINVAL;
+		goto out;
+	}
+	pbbo = nouveau_gem_object(gem);
+
+	ret = ttm_bo_reserve(&pbbo->bo, false, false, true,
+			     chan->fence.sequence);
+	if (ret) {
+		NV_ERROR(dev, "resv pb: %d\n", ret);
+		drm_gem_object_unreference(gem);
+		goto out;
+	}
+
+	nouveau_bo_placement_set(pbbo, 1 << chan->pushbuf_bo->bo.mem.mem_type);
+	ret = ttm_bo_validate(&pbbo->bo, &pbbo->placement, false, false);
+	if (ret) {
+		NV_ERROR(dev, "validate pb: %d\n", ret);
+		ttm_bo_unreserve(&pbbo->bo);
+		drm_gem_object_unreference(gem);
+		goto out;
+	}
+
+	list_add_tail(&pbbo->entry, &op.both_list);
+
+	/* If presumed return address doesn't match, we need to map the
+	 * push buffer and fix it..
+	 */
+	if (!PUSHBUF_CAL) {
+		uint32_t retaddy;
+
+		if (chan->dma.free < 4 + NOUVEAU_DMA_SKIPS) {
+			ret = nouveau_dma_wait(chan, 4 + NOUVEAU_DMA_SKIPS);
+			if (ret) {
+				NV_ERROR(dev, "jmp_space: %d\n", ret);
+				goto out;
+			}
+		}
+
+		retaddy  = chan->pushbuf_base + ((chan->dma.cur + 2) << 2);
+		retaddy |= 0x20000000;
+		if (retaddy != req->suffix0) {
+			req->suffix0 = retaddy;
+			do_reloc = 1;
+		}
+	}
+
+	/* Apply any relocations that are required */
+	if (do_reloc) {
+		void *pbvirt;
+		bool is_iomem;
+		ret = ttm_bo_kmap(&pbbo->bo, 0, pbbo->bo.mem.num_pages,
+				  &pbbo->kmap);
+		if (ret) {
+			NV_ERROR(dev, "kmap pb: %d\n", ret);
+			goto out;
+		}
+
+		pbvirt = ttm_kmap_obj_virtual(&pbbo->kmap, &is_iomem);
+		ret = nouveau_gem_pushbuf_reloc_apply(chan, req->nr_buffers, bo,
+						      req->nr_relocs,
+						      req->relocs,
+						      req->nr_dwords,
+						      req->offset / 4,
+						      pbvirt, is_iomem);
+
+		if (!PUSHBUF_CAL) {
+			nouveau_bo_wr32(pbbo,
+					req->offset / 4 + req->nr_dwords - 2,
+					req->suffix0);
+		}
+
+		ttm_bo_kunmap(&pbbo->kmap);
+		if (ret) {
+			NV_ERROR(dev, "reloc apply: %d\n", ret);
+			goto out;
+		}
+	}
+
+	if (PUSHBUF_CAL) {
+		ret = RING_SPACE(chan, 2);
+		if (ret) {
+			NV_ERROR(dev, "cal_space: %d\n", ret);
+			goto out;
+		}
+		OUT_RING(chan, ((pbbo->bo.mem.mm_node->start << PAGE_SHIFT) +
+				  req->offset) | 2);
+		OUT_RING(chan, 0);
+	} else {
+		ret = RING_SPACE(chan, 2 + NOUVEAU_DMA_SKIPS);
+		if (ret) {
+			NV_ERROR(dev, "jmp_space: %d\n", ret);
+			goto out;
+		}
+		OUT_RING(chan, ((pbbo->bo.mem.mm_node->start << PAGE_SHIFT) +
+				  req->offset) | 0x20000000);
+		OUT_RING(chan, 0);
+
+		/* Space the jumps apart with NOPs. */
+		for (i = 0; i < NOUVEAU_DMA_SKIPS; i++)
+			OUT_RING(chan, 0);
+	}
+
+	ret = nouveau_fence_new(chan, &fence, true);
+	if (ret) {
+		NV_ERROR(dev, "error fencing pushbuf: %d\n", ret);
+		WIND_RING(chan);
+		goto out;
+	}
+
+out:
+	validate_fini(&op, fence);
+	nouveau_fence_unref((void**)&fence);
+	mutex_unlock(&dev->struct_mutex);
+	kfree(bo);
+
+out_next:
+	if (PUSHBUF_CAL) {
+		req->suffix0 = 0x00020000;
+		req->suffix1 = 0x00000000;
+	} else {
+		req->suffix0 = 0x20000000 |
+			      (chan->pushbuf_base + ((chan->dma.cur + 2) << 2));
+		req->suffix1 = 0x00000000;
+	}
+
+	return ret;
+}
+
+int
+nouveau_gem_ioctl_pushbuf_call2(struct drm_device *dev, void *data,
+				struct drm_file *file_priv)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct drm_nouveau_gem_pushbuf_call *req = data;
+
+	req->vram_available = dev_priv->fb_aper_free;
+	req->gart_available = dev_priv->gart_info.aper_free;
+
+	return nouveau_gem_ioctl_pushbuf_call(dev, data, file_priv);
+}
+
+static inline uint32_t
+domain_to_ttm(struct nouveau_bo *nvbo, uint32_t domain)
+{
+	uint32_t flags = 0;
+
+	if (domain & NOUVEAU_GEM_DOMAIN_VRAM)
+		flags |= TTM_PL_FLAG_VRAM;
+	if (domain & NOUVEAU_GEM_DOMAIN_GART)
+		flags |= TTM_PL_FLAG_TT;
+
+	return flags;
+}
+
+int
+nouveau_gem_ioctl_pin(struct drm_device *dev, void *data,
+		      struct drm_file *file_priv)
+{
+	struct drm_nouveau_gem_pin *req = data;
+	struct drm_gem_object *gem;
+	struct nouveau_bo *nvbo;
+	int ret = 0;
+
+	NOUVEAU_CHECK_INITIALISED_WITH_RETURN;
+
+	if (drm_core_check_feature(dev, DRIVER_MODESET)) {
+		NV_ERROR(dev, "pin only allowed without kernel modesetting\n");
+		return -EINVAL;
+	}
+
+	if (!DRM_SUSER(DRM_CURPROC))
+		return -EPERM;
+
+	gem = drm_gem_object_lookup(dev, file_priv, req->handle);
+	if (!gem)
+		return -EINVAL;
+	nvbo = nouveau_gem_object(gem);
+
+	ret = nouveau_bo_pin(nvbo, domain_to_ttm(nvbo, req->domain));
+	if (ret)
+		goto out;
+
+	req->offset = nvbo->bo.offset;
+	if (nvbo->bo.mem.mem_type == TTM_PL_TT)
+		req->domain = NOUVEAU_GEM_DOMAIN_GART;
+	else
+		req->domain = NOUVEAU_GEM_DOMAIN_VRAM;
+
+out:
+	mutex_lock(&dev->struct_mutex);
+	drm_gem_object_unreference(gem);
+	mutex_unlock(&dev->struct_mutex);
+
+	return ret;
+}
+
+int
+nouveau_gem_ioctl_unpin(struct drm_device *dev, void *data,
+			struct drm_file *file_priv)
+{
+	struct drm_nouveau_gem_pin *req = data;
+	struct drm_gem_object *gem;
+	int ret;
+
+	NOUVEAU_CHECK_INITIALISED_WITH_RETURN;
+
+	if (drm_core_check_feature(dev, DRIVER_MODESET))
+		return -EINVAL;
+
+	gem = drm_gem_object_lookup(dev, file_priv, req->handle);
+	if (!gem)
+		return -EINVAL;
+
+	ret = nouveau_bo_unpin(nouveau_gem_object(gem));
+
+	mutex_lock(&dev->struct_mutex);
+	drm_gem_object_unreference(gem);
+	mutex_unlock(&dev->struct_mutex);
+
+	return ret;
+}
+
+int
+nouveau_gem_ioctl_cpu_prep(struct drm_device *dev, void *data,
+			   struct drm_file *file_priv)
+{
+	struct drm_nouveau_gem_cpu_prep *req = data;
+	struct drm_gem_object *gem;
+	struct nouveau_bo *nvbo;
+	bool no_wait = !!(req->flags & NOUVEAU_GEM_CPU_PREP_NOWAIT);
+	int ret = -EINVAL;
+
+	NOUVEAU_CHECK_INITIALISED_WITH_RETURN;
+
+	gem = drm_gem_object_lookup(dev, file_priv, req->handle);
+	if (!gem)
+		return ret;
+	nvbo = nouveau_gem_object(gem);
+
+	if (nvbo->cpu_filp) {
+		if (nvbo->cpu_filp == file_priv)
+			goto out;
+
+		ret = ttm_bo_wait_cpu(&nvbo->bo, no_wait);
+		if (ret)
+			goto out;
+	}
+
+	if (req->flags & NOUVEAU_GEM_CPU_PREP_NOBLOCK) {
+		ret = ttm_bo_wait(&nvbo->bo, false, false, no_wait);
+	} else {
+		ret = ttm_bo_synccpu_write_grab(&nvbo->bo, no_wait);
+		if (ret == 0)
+			nvbo->cpu_filp = file_priv;
+	}
+
+out:
+	mutex_lock(&dev->struct_mutex);
+	drm_gem_object_unreference(gem);
+	mutex_unlock(&dev->struct_mutex);
+	return ret;
+}
+
+int
+nouveau_gem_ioctl_cpu_fini(struct drm_device *dev, void *data,
+			   struct drm_file *file_priv)
+{
+	struct drm_nouveau_gem_cpu_prep *req = data;
+	struct drm_gem_object *gem;
+	struct nouveau_bo *nvbo;
+	int ret = -EINVAL;
+
+	NOUVEAU_CHECK_INITIALISED_WITH_RETURN;
+
+	gem = drm_gem_object_lookup(dev, file_priv, req->handle);
+	if (!gem)
+		return ret;
+	nvbo = nouveau_gem_object(gem);
+
+	if (nvbo->cpu_filp != file_priv)
+		goto out;
+	nvbo->cpu_filp = NULL;
+
+	ttm_bo_synccpu_write_release(&nvbo->bo);
+	ret = 0;
+
+out:
+	mutex_lock(&dev->struct_mutex);
+	drm_gem_object_unreference(gem);
+	mutex_unlock(&dev->struct_mutex);
+	return ret;
+}
+
+int
+nouveau_gem_ioctl_info(struct drm_device *dev, void *data,
+		       struct drm_file *file_priv)
+{
+	struct drm_nouveau_gem_info *req = data;
+	struct drm_gem_object *gem;
+	int ret;
+
+	NOUVEAU_CHECK_INITIALISED_WITH_RETURN;
+
+	gem = drm_gem_object_lookup(dev, file_priv, req->handle);
+	if (!gem)
+		return -EINVAL;
+
+	ret = nouveau_gem_info(gem, req);
+	mutex_lock(&dev->struct_mutex);
+	drm_gem_object_unreference(gem);
+	mutex_unlock(&dev->struct_mutex);
+	return ret;
+}
+
diff --git a/drivers/gpu/drm/nouveau/nouveau_grctx.c b/drivers/gpu/drm/nouveau/nouveau_grctx.c
new file mode 100644
index 000000000000..419f4c2b3b89
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nouveau_grctx.c
@@ -0,0 +1,161 @@
+/*
+ * Copyright 2009 Red Hat Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * Authors: Ben Skeggs
+ */
+
+#include <linux/firmware.h>
+
+#include "drmP.h"
+#include "nouveau_drv.h"
+
+struct nouveau_ctxprog {
+	uint32_t signature;
+	uint8_t  version;
+	uint16_t length;
+	uint32_t data[];
+} __attribute__ ((packed));
+
+struct nouveau_ctxvals {
+	uint32_t signature;
+	uint8_t  version;
+	uint32_t length;
+	struct {
+		uint32_t offset;
+		uint32_t value;
+	} data[];
+} __attribute__ ((packed));
+
+int
+nouveau_grctx_prog_load(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_pgraph_engine *pgraph = &dev_priv->engine.graph;
+	const int chipset = dev_priv->chipset;
+	const struct firmware *fw;
+	const struct nouveau_ctxprog *cp;
+	const struct nouveau_ctxvals *cv;
+	char name[32];
+	int ret, i;
+
+	if (pgraph->accel_blocked)
+		return -ENODEV;
+
+	if (!pgraph->ctxprog) {
+		sprintf(name, "nouveau/nv%02x.ctxprog", chipset);
+		ret = request_firmware(&fw, name, &dev->pdev->dev);
+		if (ret) {
+			NV_ERROR(dev, "No ctxprog for NV%02x\n", chipset);
+			return ret;
+		}
+
+		pgraph->ctxprog = kmalloc(fw->size, GFP_KERNEL);
+		if (!pgraph->ctxprog) {
+			NV_ERROR(dev, "OOM copying ctxprog\n");
+			release_firmware(fw);
+			return -ENOMEM;
+		}
+		memcpy(pgraph->ctxprog, fw->data, fw->size);
+
+		cp = pgraph->ctxprog;
+		if (le32_to_cpu(cp->signature) != 0x5043564e ||
+		    cp->version != 0 ||
+		    le16_to_cpu(cp->length) != ((fw->size - 7) / 4)) {
+			NV_ERROR(dev, "ctxprog invalid\n");
+			release_firmware(fw);
+			nouveau_grctx_fini(dev);
+			return -EINVAL;
+		}
+		release_firmware(fw);
+	}
+
+	if (!pgraph->ctxvals) {
+		sprintf(name, "nouveau/nv%02x.ctxvals", chipset);
+		ret = request_firmware(&fw, name, &dev->pdev->dev);
+		if (ret) {
+			NV_ERROR(dev, "No ctxvals for NV%02x\n", chipset);
+			nouveau_grctx_fini(dev);
+			return ret;
+		}
+
+		pgraph->ctxvals = kmalloc(fw->size, GFP_KERNEL);
+		if (!pgraph->ctxprog) {
+			NV_ERROR(dev, "OOM copying ctxprog\n");
+			release_firmware(fw);
+			nouveau_grctx_fini(dev);
+			return -ENOMEM;
+		}
+		memcpy(pgraph->ctxvals, fw->data, fw->size);
+
+		cv = (void *)pgraph->ctxvals;
+		if (le32_to_cpu(cv->signature) != 0x5643564e ||
+		    cv->version != 0 ||
+		    le32_to_cpu(cv->length) != ((fw->size - 9) / 8)) {
+			NV_ERROR(dev, "ctxvals invalid\n");
+			release_firmware(fw);
+			nouveau_grctx_fini(dev);
+			return -EINVAL;
+		}
+		release_firmware(fw);
+	}
+
+	cp = pgraph->ctxprog;
+
+	nv_wr32(dev, NV40_PGRAPH_CTXCTL_UCODE_INDEX, 0);
+	for (i = 0; i < le16_to_cpu(cp->length); i++)
+		nv_wr32(dev, NV40_PGRAPH_CTXCTL_UCODE_DATA,
+			le32_to_cpu(cp->data[i]));
+
+	return 0;
+}
+
+void
+nouveau_grctx_fini(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_pgraph_engine *pgraph = &dev_priv->engine.graph;
+
+	if (pgraph->ctxprog) {
+		kfree(pgraph->ctxprog);
+		pgraph->ctxprog = NULL;
+	}
+
+	if (pgraph->ctxvals) {
+		kfree(pgraph->ctxprog);
+		pgraph->ctxvals = NULL;
+	}
+}
+
+void
+nouveau_grctx_vals_load(struct drm_device *dev, struct nouveau_gpuobj *ctx)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_pgraph_engine *pgraph = &dev_priv->engine.graph;
+	struct nouveau_ctxvals *cv = pgraph->ctxvals;
+	int i;
+
+	if (!cv)
+		return;
+
+	for (i = 0; i < le32_to_cpu(cv->length); i++)
+		nv_wo32(dev, ctx, le32_to_cpu(cv->data[i].offset),
+			le32_to_cpu(cv->data[i].value));
+}
diff --git a/drivers/gpu/drm/nouveau/nouveau_grctx.h b/drivers/gpu/drm/nouveau/nouveau_grctx.h
new file mode 100644
index 000000000000..5d39c4ce8006
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nouveau_grctx.h
@@ -0,0 +1,133 @@
+#ifndef __NOUVEAU_GRCTX_H__
+#define __NOUVEAU_GRCTX_H__
+
+struct nouveau_grctx {
+	struct drm_device *dev;
+
+	enum {
+		NOUVEAU_GRCTX_PROG,
+		NOUVEAU_GRCTX_VALS
+	} mode;
+	void *data;
+
+	uint32_t ctxprog_max;
+	uint32_t ctxprog_len;
+	uint32_t ctxprog_reg;
+	int      ctxprog_label[32];
+	uint32_t ctxvals_pos;
+	uint32_t ctxvals_base;
+};
+
+#ifdef CP_CTX
+static inline void
+cp_out(struct nouveau_grctx *ctx, uint32_t inst)
+{
+	uint32_t *ctxprog = ctx->data;
+
+	if (ctx->mode != NOUVEAU_GRCTX_PROG)
+		return;
+
+	BUG_ON(ctx->ctxprog_len == ctx->ctxprog_max);
+	ctxprog[ctx->ctxprog_len++] = inst;
+}
+
+static inline void
+cp_lsr(struct nouveau_grctx *ctx, uint32_t val)
+{
+	cp_out(ctx, CP_LOAD_SR | val);
+}
+
+static inline void
+cp_ctx(struct nouveau_grctx *ctx, uint32_t reg, uint32_t length)
+{
+	ctx->ctxprog_reg = (reg - 0x00400000) >> 2;
+
+	ctx->ctxvals_base = ctx->ctxvals_pos;
+	ctx->ctxvals_pos = ctx->ctxvals_base + length;
+
+	if (length > (CP_CTX_COUNT >> CP_CTX_COUNT_SHIFT)) {
+		cp_lsr(ctx, length);
+		length = 0;
+	}
+
+	cp_out(ctx, CP_CTX | (length << CP_CTX_COUNT_SHIFT) | ctx->ctxprog_reg);
+}
+
+static inline void
+cp_name(struct nouveau_grctx *ctx, int name)
+{
+	uint32_t *ctxprog = ctx->data;
+	int i;
+
+	if (ctx->mode != NOUVEAU_GRCTX_PROG)
+		return;
+
+	ctx->ctxprog_label[name] = ctx->ctxprog_len;
+	for (i = 0; i < ctx->ctxprog_len; i++) {
+		if ((ctxprog[i] & 0xfff00000) != 0xff400000)
+			continue;
+		if ((ctxprog[i] & CP_BRA_IP) != ((name) << CP_BRA_IP_SHIFT))
+			continue;
+		ctxprog[i] = (ctxprog[i] & 0x00ff00ff) |
+			     (ctx->ctxprog_len << CP_BRA_IP_SHIFT);
+	}
+}
+
+static inline void
+_cp_bra(struct nouveau_grctx *ctx, u32 mod, int flag, int state, int name)
+{
+	int ip = 0;
+
+	if (mod != 2) {
+		ip = ctx->ctxprog_label[name] << CP_BRA_IP_SHIFT;
+		if (ip == 0)
+			ip = 0xff000000 | (name << CP_BRA_IP_SHIFT);
+	}
+
+	cp_out(ctx, CP_BRA | (mod << 18) | ip | flag |
+		    (state ? 0 : CP_BRA_IF_CLEAR));
+}
+#define cp_bra(c,f,s,n) _cp_bra((c), 0, CP_FLAG_##f, CP_FLAG_##f##_##s, n)
+#ifdef CP_BRA_MOD
+#define cp_cal(c,f,s,n) _cp_bra((c), 1, CP_FLAG_##f, CP_FLAG_##f##_##s, n)
+#define cp_ret(c,f,s) _cp_bra((c), 2, CP_FLAG_##f, CP_FLAG_##f##_##s, 0)
+#endif
+
+static inline void
+_cp_wait(struct nouveau_grctx *ctx, int flag, int state)
+{
+	cp_out(ctx, CP_WAIT | flag | (state ? CP_WAIT_SET : 0));
+}
+#define cp_wait(c,f,s) _cp_wait((c), CP_FLAG_##f, CP_FLAG_##f##_##s)
+
+static inline void
+_cp_set(struct nouveau_grctx *ctx, int flag, int state)
+{
+	cp_out(ctx, CP_SET | flag | (state ? CP_SET_1 : 0));
+}
+#define cp_set(c,f,s) _cp_set((c), CP_FLAG_##f, CP_FLAG_##f##_##s)
+
+static inline void
+cp_pos(struct nouveau_grctx *ctx, int offset)
+{
+	ctx->ctxvals_pos = offset;
+	ctx->ctxvals_base = ctx->ctxvals_pos;
+
+	cp_lsr(ctx, ctx->ctxvals_pos);
+	cp_out(ctx, CP_SET_CONTEXT_POINTER);
+}
+
+static inline void
+gr_def(struct nouveau_grctx *ctx, uint32_t reg, uint32_t val)
+{
+	if (ctx->mode != NOUVEAU_GRCTX_VALS)
+		return;
+
+	reg = (reg - 0x00400000) / 4;
+	reg = (reg - ctx->ctxprog_reg) + ctx->ctxvals_base;
+
+	nv_wo32(ctx->dev, ctx->data, reg, val);
+}
+#endif
+
+#endif
diff --git a/drivers/gpu/drm/nouveau/nouveau_hw.c b/drivers/gpu/drm/nouveau/nouveau_hw.c
new file mode 100644
index 000000000000..dc46792a5c96
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nouveau_hw.c
@@ -0,0 +1,1080 @@
+/*
+ * Copyright 2006 Dave Airlie
+ * Copyright 2007 Maarten Maathuis
+ * Copyright 2007-2009 Stuart Bennett
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+ * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF
+ * OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#include "drmP.h"
+#include "nouveau_drv.h"
+#include "nouveau_hw.h"
+
+#define CHIPSET_NFORCE 0x01a0
+#define CHIPSET_NFORCE2 0x01f0
+
+/*
+ * misc hw access wrappers/control functions
+ */
+
+void
+NVWriteVgaSeq(struct drm_device *dev, int head, uint8_t index, uint8_t value)
+{
+	NVWritePRMVIO(dev, head, NV_PRMVIO_SRX, index);
+	NVWritePRMVIO(dev, head, NV_PRMVIO_SR, value);
+}
+
+uint8_t
+NVReadVgaSeq(struct drm_device *dev, int head, uint8_t index)
+{
+	NVWritePRMVIO(dev, head, NV_PRMVIO_SRX, index);
+	return NVReadPRMVIO(dev, head, NV_PRMVIO_SR);
+}
+
+void
+NVWriteVgaGr(struct drm_device *dev, int head, uint8_t index, uint8_t value)
+{
+	NVWritePRMVIO(dev, head, NV_PRMVIO_GRX, index);
+	NVWritePRMVIO(dev, head, NV_PRMVIO_GX, value);
+}
+
+uint8_t
+NVReadVgaGr(struct drm_device *dev, int head, uint8_t index)
+{
+	NVWritePRMVIO(dev, head, NV_PRMVIO_GRX, index);
+	return NVReadPRMVIO(dev, head, NV_PRMVIO_GX);
+}
+
+/* CR44 takes values 0 (head A), 3 (head B) and 4 (heads tied)
+ * it affects only the 8 bit vga io regs, which we access using mmio at
+ * 0xc{0,2}3c*, 0x60{1,3}3*, and 0x68{1,3}3d*
+ * in general, the set value of cr44 does not matter: reg access works as
+ * expected and values can be set for the appropriate head by using a 0x2000
+ * offset as required
+ * however:
+ * a) pre nv40, the head B range of PRMVIO regs at 0xc23c* was not exposed and
+ *    cr44 must be set to 0 or 3 for accessing values on the correct head
+ *    through the common 0xc03c* addresses
+ * b) in tied mode (4) head B is programmed to the values set on head A, and
+ *    access using the head B addresses can have strange results, ergo we leave
+ *    tied mode in init once we know to what cr44 should be restored on exit
+ *
+ * the owner parameter is slightly abused:
+ * 0 and 1 are treated as head values and so the set value is (owner * 3)
+ * other values are treated as literal values to set
+ */
+void
+NVSetOwner(struct drm_device *dev, int owner)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+
+	if (owner == 1)
+		owner *= 3;
+
+	if (dev_priv->chipset == 0x11) {
+		/* This might seem stupid, but the blob does it and
+		 * omitting it often locks the system up.
+		 */
+		NVReadVgaCrtc(dev, 0, NV_CIO_SR_LOCK_INDEX);
+		NVReadVgaCrtc(dev, 1, NV_CIO_SR_LOCK_INDEX);
+	}
+
+	/* CR44 is always changed on CRTC0 */
+	NVWriteVgaCrtc(dev, 0, NV_CIO_CRE_44, owner);
+
+	if (dev_priv->chipset == 0x11) {	/* set me harder */
+		NVWriteVgaCrtc(dev, 0, NV_CIO_CRE_2E, owner);
+		NVWriteVgaCrtc(dev, 0, NV_CIO_CRE_2E, owner);
+	}
+}
+
+void
+NVBlankScreen(struct drm_device *dev, int head, bool blank)
+{
+	unsigned char seq1;
+
+	if (nv_two_heads(dev))
+		NVSetOwner(dev, head);
+
+	seq1 = NVReadVgaSeq(dev, head, NV_VIO_SR_CLOCK_INDEX);
+
+	NVVgaSeqReset(dev, head, true);
+	if (blank)
+		NVWriteVgaSeq(dev, head, NV_VIO_SR_CLOCK_INDEX, seq1 | 0x20);
+	else
+		NVWriteVgaSeq(dev, head, NV_VIO_SR_CLOCK_INDEX, seq1 & ~0x20);
+	NVVgaSeqReset(dev, head, false);
+}
+
+/*
+ * PLL setting
+ */
+
+static int
+powerctrl_1_shift(int chip_version, int reg)
+{
+	int shift = -4;
+
+	if (chip_version < 0x17 || chip_version == 0x1a || chip_version == 0x20)
+		return shift;
+
+	switch (reg) {
+	case NV_RAMDAC_VPLL2:
+		shift += 4;
+	case NV_PRAMDAC_VPLL_COEFF:
+		shift += 4;
+	case NV_PRAMDAC_MPLL_COEFF:
+		shift += 4;
+	case NV_PRAMDAC_NVPLL_COEFF:
+		shift += 4;
+	}
+
+	/*
+	 * the shift for vpll regs is only used for nv3x chips with a single
+	 * stage pll
+	 */
+	if (shift > 4 && (chip_version < 0x32 || chip_version == 0x35 ||
+			  chip_version == 0x36 || chip_version >= 0x40))
+		shift = -4;
+
+	return shift;
+}
+
+static void
+setPLL_single(struct drm_device *dev, uint32_t reg, struct nouveau_pll_vals *pv)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	int chip_version = dev_priv->vbios->chip_version;
+	uint32_t oldpll = NVReadRAMDAC(dev, 0, reg);
+	int oldN = (oldpll >> 8) & 0xff, oldM = oldpll & 0xff;
+	uint32_t pll = (oldpll & 0xfff80000) | pv->log2P << 16 | pv->NM1;
+	uint32_t saved_powerctrl_1 = 0;
+	int shift_powerctrl_1 = powerctrl_1_shift(chip_version, reg);
+
+	if (oldpll == pll)
+		return;	/* already set */
+
+	if (shift_powerctrl_1 >= 0) {
+		saved_powerctrl_1 = nvReadMC(dev, NV_PBUS_POWERCTRL_1);
+		nvWriteMC(dev, NV_PBUS_POWERCTRL_1,
+			(saved_powerctrl_1 & ~(0xf << shift_powerctrl_1)) |
+			1 << shift_powerctrl_1);
+	}
+
+	if (oldM && pv->M1 && (oldN / oldM < pv->N1 / pv->M1))
+		/* upclock -- write new post divider first */
+		NVWriteRAMDAC(dev, 0, reg, pv->log2P << 16 | (oldpll & 0xffff));
+	else
+		/* downclock -- write new NM first */
+		NVWriteRAMDAC(dev, 0, reg, (oldpll & 0xffff0000) | pv->NM1);
+
+	if (chip_version < 0x17 && chip_version != 0x11)
+		/* wait a bit on older chips */
+		msleep(64);
+	NVReadRAMDAC(dev, 0, reg);
+
+	/* then write the other half as well */
+	NVWriteRAMDAC(dev, 0, reg, pll);
+
+	if (shift_powerctrl_1 >= 0)
+		nvWriteMC(dev, NV_PBUS_POWERCTRL_1, saved_powerctrl_1);
+}
+
+static uint32_t
+new_ramdac580(uint32_t reg1, bool ss, uint32_t ramdac580)
+{
+	bool head_a = (reg1 == NV_PRAMDAC_VPLL_COEFF);
+
+	if (ss)	/* single stage pll mode */
+		ramdac580 |= head_a ? NV_RAMDAC_580_VPLL1_ACTIVE :
+				      NV_RAMDAC_580_VPLL2_ACTIVE;
+	else
+		ramdac580 &= head_a ? ~NV_RAMDAC_580_VPLL1_ACTIVE :
+				      ~NV_RAMDAC_580_VPLL2_ACTIVE;
+
+	return ramdac580;
+}
+
+static void
+setPLL_double_highregs(struct drm_device *dev, uint32_t reg1,
+		       struct nouveau_pll_vals *pv)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	int chip_version = dev_priv->vbios->chip_version;
+	bool nv3035 = chip_version == 0x30 || chip_version == 0x35;
+	uint32_t reg2 = reg1 + ((reg1 == NV_RAMDAC_VPLL2) ? 0x5c : 0x70);
+	uint32_t oldpll1 = NVReadRAMDAC(dev, 0, reg1);
+	uint32_t oldpll2 = !nv3035 ? NVReadRAMDAC(dev, 0, reg2) : 0;
+	uint32_t pll1 = (oldpll1 & 0xfff80000) | pv->log2P << 16 | pv->NM1;
+	uint32_t pll2 = (oldpll2 & 0x7fff0000) | 1 << 31 | pv->NM2;
+	uint32_t oldramdac580 = 0, ramdac580 = 0;
+	bool single_stage = !pv->NM2 || pv->N2 == pv->M2;	/* nv41+ only */
+	uint32_t saved_powerctrl_1 = 0, savedc040 = 0;
+	int shift_powerctrl_1 = powerctrl_1_shift(chip_version, reg1);
+
+	/* model specific additions to generic pll1 and pll2 set up above */
+	if (nv3035) {
+		pll1 = (pll1 & 0xfcc7ffff) | (pv->N2 & 0x18) << 21 |
+		       (pv->N2 & 0x7) << 19 | 8 << 4 | (pv->M2 & 7) << 4;
+		pll2 = 0;
+	}
+	if (chip_version > 0x40 && reg1 >= NV_PRAMDAC_VPLL_COEFF) { /* !nv40 */
+		oldramdac580 = NVReadRAMDAC(dev, 0, NV_PRAMDAC_580);
+		ramdac580 = new_ramdac580(reg1, single_stage, oldramdac580);
+		if (oldramdac580 != ramdac580)
+			oldpll1 = ~0;	/* force mismatch */
+		if (single_stage)
+			/* magic value used by nvidia in single stage mode */
+			pll2 |= 0x011f;
+	}
+	if (chip_version > 0x70)
+		/* magic bits set by the blob (but not the bios) on g71-73 */
+		pll1 = (pll1 & 0x7fffffff) | (single_stage ? 0x4 : 0xc) << 28;
+
+	if (oldpll1 == pll1 && oldpll2 == pll2)
+		return;	/* already set */
+
+	if (shift_powerctrl_1 >= 0) {
+		saved_powerctrl_1 = nvReadMC(dev, NV_PBUS_POWERCTRL_1);
+		nvWriteMC(dev, NV_PBUS_POWERCTRL_1,
+			(saved_powerctrl_1 & ~(0xf << shift_powerctrl_1)) |
+			1 << shift_powerctrl_1);
+	}
+
+	if (chip_version >= 0x40) {
+		int shift_c040 = 14;
+
+		switch (reg1) {
+		case NV_PRAMDAC_MPLL_COEFF:
+			shift_c040 += 2;
+		case NV_PRAMDAC_NVPLL_COEFF:
+			shift_c040 += 2;
+		case NV_RAMDAC_VPLL2:
+			shift_c040 += 2;
+		case NV_PRAMDAC_VPLL_COEFF:
+			shift_c040 += 2;
+		}
+
+		savedc040 = nvReadMC(dev, 0xc040);
+		if (shift_c040 != 14)
+			nvWriteMC(dev, 0xc040, savedc040 & ~(3 << shift_c040));
+	}
+
+	if (oldramdac580 != ramdac580)
+		NVWriteRAMDAC(dev, 0, NV_PRAMDAC_580, ramdac580);
+
+	if (!nv3035)
+		NVWriteRAMDAC(dev, 0, reg2, pll2);
+	NVWriteRAMDAC(dev, 0, reg1, pll1);
+
+	if (shift_powerctrl_1 >= 0)
+		nvWriteMC(dev, NV_PBUS_POWERCTRL_1, saved_powerctrl_1);
+	if (chip_version >= 0x40)
+		nvWriteMC(dev, 0xc040, savedc040);
+}
+
+static void
+setPLL_double_lowregs(struct drm_device *dev, uint32_t NMNMreg,
+		      struct nouveau_pll_vals *pv)
+{
+	/* When setting PLLs, there is a merry game of disabling and enabling
+	 * various bits of hardware during the process. This function is a
+	 * synthesis of six nv4x traces, nearly each card doing a subtly
+	 * different thing. With luck all the necessary bits for each card are
+	 * combined herein. Without luck it deviates from each card's formula
+	 * so as to not work on any :)
+	 */
+
+	uint32_t Preg = NMNMreg - 4;
+	bool mpll = Preg == 0x4020;
+	uint32_t oldPval = nvReadMC(dev, Preg);
+	uint32_t NMNM = pv->NM2 << 16 | pv->NM1;
+	uint32_t Pval = (oldPval & (mpll ? ~(0x11 << 16) : ~(1 << 16))) |
+			0xc << 28 | pv->log2P << 16;
+	uint32_t saved4600 = 0;
+	/* some cards have different maskc040s */
+	uint32_t maskc040 = ~(3 << 14), savedc040;
+	bool single_stage = !pv->NM2 || pv->N2 == pv->M2;
+
+	if (nvReadMC(dev, NMNMreg) == NMNM && (oldPval & 0xc0070000) == Pval)
+		return;
+
+	if (Preg == 0x4000)
+		maskc040 = ~0x333;
+	if (Preg == 0x4058)
+		maskc040 = ~(0xc << 24);
+
+	if (mpll) {
+		struct pll_lims pll_lim;
+		uint8_t Pval2;
+
+		if (get_pll_limits(dev, Preg, &pll_lim))
+			return;
+
+		Pval2 = pv->log2P + pll_lim.log2p_bias;
+		if (Pval2 > pll_lim.max_log2p)
+			Pval2 = pll_lim.max_log2p;
+		Pval |= 1 << 28 | Pval2 << 20;
+
+		saved4600 = nvReadMC(dev, 0x4600);
+		nvWriteMC(dev, 0x4600, saved4600 | 8 << 28);
+	}
+	if (single_stage)
+		Pval |= mpll ? 1 << 12 : 1 << 8;
+
+	nvWriteMC(dev, Preg, oldPval | 1 << 28);
+	nvWriteMC(dev, Preg, Pval & ~(4 << 28));
+	if (mpll) {
+		Pval |= 8 << 20;
+		nvWriteMC(dev, 0x4020, Pval & ~(0xc << 28));
+		nvWriteMC(dev, 0x4038, Pval & ~(0xc << 28));
+	}
+
+	savedc040 = nvReadMC(dev, 0xc040);
+	nvWriteMC(dev, 0xc040, savedc040 & maskc040);
+
+	nvWriteMC(dev, NMNMreg, NMNM);
+	if (NMNMreg == 0x4024)
+		nvWriteMC(dev, 0x403c, NMNM);
+
+	nvWriteMC(dev, Preg, Pval);
+	if (mpll) {
+		Pval &= ~(8 << 20);
+		nvWriteMC(dev, 0x4020, Pval);
+		nvWriteMC(dev, 0x4038, Pval);
+		nvWriteMC(dev, 0x4600, saved4600);
+	}
+
+	nvWriteMC(dev, 0xc040, savedc040);
+
+	if (mpll) {
+		nvWriteMC(dev, 0x4020, Pval & ~(1 << 28));
+		nvWriteMC(dev, 0x4038, Pval & ~(1 << 28));
+	}
+}
+
+void
+nouveau_hw_setpll(struct drm_device *dev, uint32_t reg1,
+		  struct nouveau_pll_vals *pv)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	int cv = dev_priv->vbios->chip_version;
+
+	if (cv == 0x30 || cv == 0x31 || cv == 0x35 || cv == 0x36 ||
+	    cv >= 0x40) {
+		if (reg1 > 0x405c)
+			setPLL_double_highregs(dev, reg1, pv);
+		else
+			setPLL_double_lowregs(dev, reg1, pv);
+	} else
+		setPLL_single(dev, reg1, pv);
+}
+
+/*
+ * PLL getting
+ */
+
+static void
+nouveau_hw_decode_pll(struct drm_device *dev, uint32_t reg1, uint32_t pll1,
+		      uint32_t pll2, struct nouveau_pll_vals *pllvals)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+
+	/* to force parsing as single stage (i.e. nv40 vplls) pass pll2 as 0 */
+
+	/* log2P is & 0x7 as never more than 7, and nv30/35 only uses 3 bits */
+	pllvals->log2P = (pll1 >> 16) & 0x7;
+	pllvals->N2 = pllvals->M2 = 1;
+
+	if (reg1 <= 0x405c) {
+		pllvals->NM1 = pll2 & 0xffff;
+		/* single stage NVPLL and VPLLs use 1 << 8, MPLL uses 1 << 12 */
+		if (!(pll1 & 0x1100))
+			pllvals->NM2 = pll2 >> 16;
+	} else {
+		pllvals->NM1 = pll1 & 0xffff;
+		if (nv_two_reg_pll(dev) && pll2 & NV31_RAMDAC_ENABLE_VCO2)
+			pllvals->NM2 = pll2 & 0xffff;
+		else if (dev_priv->chipset == 0x30 || dev_priv->chipset == 0x35) {
+			pllvals->M1 &= 0xf; /* only 4 bits */
+			if (pll1 & NV30_RAMDAC_ENABLE_VCO2) {
+				pllvals->M2 = (pll1 >> 4) & 0x7;
+				pllvals->N2 = ((pll1 >> 21) & 0x18) |
+					      ((pll1 >> 19) & 0x7);
+			}
+		}
+	}
+}
+
+int
+nouveau_hw_get_pllvals(struct drm_device *dev, enum pll_types plltype,
+		       struct nouveau_pll_vals *pllvals)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	const uint32_t nv04_regs[MAX_PLL_TYPES] = { NV_PRAMDAC_NVPLL_COEFF,
+						    NV_PRAMDAC_MPLL_COEFF,
+						    NV_PRAMDAC_VPLL_COEFF,
+						    NV_RAMDAC_VPLL2 };
+	const uint32_t nv40_regs[MAX_PLL_TYPES] = { 0x4000,
+						    0x4020,
+						    NV_PRAMDAC_VPLL_COEFF,
+						    NV_RAMDAC_VPLL2 };
+	uint32_t reg1, pll1, pll2 = 0;
+	struct pll_lims pll_lim;
+	int ret;
+
+	if (dev_priv->card_type < NV_40)
+		reg1 = nv04_regs[plltype];
+	else
+		reg1 = nv40_regs[plltype];
+
+	pll1 = nvReadMC(dev, reg1);
+
+	if (reg1 <= 0x405c)
+		pll2 = nvReadMC(dev, reg1 + 4);
+	else if (nv_two_reg_pll(dev)) {
+		uint32_t reg2 = reg1 + (reg1 == NV_RAMDAC_VPLL2 ? 0x5c : 0x70);
+
+		pll2 = nvReadMC(dev, reg2);
+	}
+
+	if (dev_priv->card_type == 0x40 && reg1 >= NV_PRAMDAC_VPLL_COEFF) {
+		uint32_t ramdac580 = NVReadRAMDAC(dev, 0, NV_PRAMDAC_580);
+
+		/* check whether vpll has been forced into single stage mode */
+		if (reg1 == NV_PRAMDAC_VPLL_COEFF) {
+			if (ramdac580 & NV_RAMDAC_580_VPLL1_ACTIVE)
+				pll2 = 0;
+		} else
+			if (ramdac580 & NV_RAMDAC_580_VPLL2_ACTIVE)
+				pll2 = 0;
+	}
+
+	nouveau_hw_decode_pll(dev, reg1, pll1, pll2, pllvals);
+
+	ret = get_pll_limits(dev, plltype, &pll_lim);
+	if (ret)
+		return ret;
+
+	pllvals->refclk = pll_lim.refclk;
+
+	return 0;
+}
+
+int
+nouveau_hw_pllvals_to_clk(struct nouveau_pll_vals *pv)
+{
+	/* Avoid divide by zero if called at an inappropriate time */
+	if (!pv->M1 || !pv->M2)
+		return 0;
+
+	return pv->N1 * pv->N2 * pv->refclk / (pv->M1 * pv->M2) >> pv->log2P;
+}
+
+int
+nouveau_hw_get_clock(struct drm_device *dev, enum pll_types plltype)
+{
+	struct nouveau_pll_vals pllvals;
+
+	if (plltype == MPLL && (dev->pci_device & 0x0ff0) == CHIPSET_NFORCE) {
+		uint32_t mpllP;
+
+		pci_read_config_dword(pci_get_bus_and_slot(0, 3), 0x6c, &mpllP);
+		if (!mpllP)
+			mpllP = 4;
+
+		return 400000 / mpllP;
+	} else
+	if (plltype == MPLL && (dev->pci_device & 0xff0) == CHIPSET_NFORCE2) {
+		uint32_t clock;
+
+		pci_read_config_dword(pci_get_bus_and_slot(0, 5), 0x4c, &clock);
+		return clock;
+	}
+
+	nouveau_hw_get_pllvals(dev, plltype, &pllvals);
+
+	return nouveau_hw_pllvals_to_clk(&pllvals);
+}
+
+static void
+nouveau_hw_fix_bad_vpll(struct drm_device *dev, int head)
+{
+	/* the vpll on an unused head can come up with a random value, way
+	 * beyond the pll limits.  for some reason this causes the chip to
+	 * lock up when reading the dac palette regs, so set a valid pll here
+	 * when such a condition detected.  only seen on nv11 to date
+	 */
+
+	struct pll_lims pll_lim;
+	struct nouveau_pll_vals pv;
+	uint32_t pllreg = head ? NV_RAMDAC_VPLL2 : NV_PRAMDAC_VPLL_COEFF;
+
+	if (get_pll_limits(dev, head ? VPLL2 : VPLL1, &pll_lim))
+		return;
+	nouveau_hw_get_pllvals(dev, head ? VPLL2 : VPLL1, &pv);
+
+	if (pv.M1 >= pll_lim.vco1.min_m && pv.M1 <= pll_lim.vco1.max_m &&
+	    pv.N1 >= pll_lim.vco1.min_n && pv.N1 <= pll_lim.vco1.max_n &&
+	    pv.log2P <= pll_lim.max_log2p)
+		return;
+
+	NV_WARN(dev, "VPLL %d outwith limits, attempting to fix\n", head + 1);
+
+	/* set lowest clock within static limits */
+	pv.M1 = pll_lim.vco1.max_m;
+	pv.N1 = pll_lim.vco1.min_n;
+	pv.log2P = pll_lim.max_usable_log2p;
+	nouveau_hw_setpll(dev, pllreg, &pv);
+}
+
+/*
+ * vga font save/restore
+ */
+
+static void nouveau_vga_font_io(struct drm_device *dev,
+				void __iomem *iovram,
+				bool save, unsigned plane)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	unsigned i;
+
+	NVWriteVgaSeq(dev, 0, NV_VIO_SR_PLANE_MASK_INDEX, 1 << plane);
+	NVWriteVgaGr(dev, 0, NV_VIO_GX_READ_MAP_INDEX, plane);
+	for (i = 0; i < 16384; i++) {
+		if (save) {
+			dev_priv->saved_vga_font[plane][i] =
+					ioread32_native(iovram + i * 4);
+		} else {
+			iowrite32_native(dev_priv->saved_vga_font[plane][i],
+							iovram + i * 4);
+		}
+	}
+}
+
+void
+nouveau_hw_save_vga_fonts(struct drm_device *dev, bool save)
+{
+	uint8_t misc, gr4, gr5, gr6, seq2, seq4;
+	bool graphicsmode;
+	unsigned plane;
+	void __iomem *iovram;
+
+	if (nv_two_heads(dev))
+		NVSetOwner(dev, 0);
+
+	NVSetEnablePalette(dev, 0, true);
+	graphicsmode = NVReadVgaAttr(dev, 0, NV_CIO_AR_MODE_INDEX) & 1;
+	NVSetEnablePalette(dev, 0, false);
+
+	if (graphicsmode) /* graphics mode => framebuffer => no need to save */
+		return;
+
+	NV_INFO(dev, "%sing VGA fonts\n", save ? "Sav" : "Restor");
+
+	/* map first 64KiB of VRAM, holds VGA fonts etc */
+	iovram = ioremap(pci_resource_start(dev->pdev, 1), 65536);
+	if (!iovram) {
+		NV_ERROR(dev, "Failed to map VRAM, "
+					"cannot save/restore VGA fonts.\n");
+		return;
+	}
+
+	if (nv_two_heads(dev))
+		NVBlankScreen(dev, 1, true);
+	NVBlankScreen(dev, 0, true);
+
+	/* save control regs */
+	misc = NVReadPRMVIO(dev, 0, NV_PRMVIO_MISC__READ);
+	seq2 = NVReadVgaSeq(dev, 0, NV_VIO_SR_PLANE_MASK_INDEX);
+	seq4 = NVReadVgaSeq(dev, 0, NV_VIO_SR_MEM_MODE_INDEX);
+	gr4 = NVReadVgaGr(dev, 0, NV_VIO_GX_READ_MAP_INDEX);
+	gr5 = NVReadVgaGr(dev, 0, NV_VIO_GX_MODE_INDEX);
+	gr6 = NVReadVgaGr(dev, 0, NV_VIO_GX_MISC_INDEX);
+
+	NVWritePRMVIO(dev, 0, NV_PRMVIO_MISC__WRITE, 0x67);
+	NVWriteVgaSeq(dev, 0, NV_VIO_SR_MEM_MODE_INDEX, 0x6);
+	NVWriteVgaGr(dev, 0, NV_VIO_GX_MODE_INDEX, 0x0);
+	NVWriteVgaGr(dev, 0, NV_VIO_GX_MISC_INDEX, 0x5);
+
+	/* store font in planes 0..3 */
+	for (plane = 0; plane < 4; plane++)
+		nouveau_vga_font_io(dev, iovram, save, plane);
+
+	/* restore control regs */
+	NVWritePRMVIO(dev, 0, NV_PRMVIO_MISC__WRITE, misc);
+	NVWriteVgaGr(dev, 0, NV_VIO_GX_READ_MAP_INDEX, gr4);
+	NVWriteVgaGr(dev, 0, NV_VIO_GX_MODE_INDEX, gr5);
+	NVWriteVgaGr(dev, 0, NV_VIO_GX_MISC_INDEX, gr6);
+	NVWriteVgaSeq(dev, 0, NV_VIO_SR_PLANE_MASK_INDEX, seq2);
+	NVWriteVgaSeq(dev, 0, NV_VIO_SR_MEM_MODE_INDEX, seq4);
+
+	if (nv_two_heads(dev))
+		NVBlankScreen(dev, 1, false);
+	NVBlankScreen(dev, 0, false);
+
+	iounmap(iovram);
+}
+
+/*
+ * mode state save/load
+ */
+
+static void
+rd_cio_state(struct drm_device *dev, int head,
+	     struct nv04_crtc_reg *crtcstate, int index)
+{
+	crtcstate->CRTC[index] = NVReadVgaCrtc(dev, head, index);
+}
+
+static void
+wr_cio_state(struct drm_device *dev, int head,
+	     struct nv04_crtc_reg *crtcstate, int index)
+{
+	NVWriteVgaCrtc(dev, head, index, crtcstate->CRTC[index]);
+}
+
+static void
+nv_save_state_ramdac(struct drm_device *dev, int head,
+		     struct nv04_mode_state *state)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nv04_crtc_reg *regp = &state->crtc_reg[head];
+	int i;
+
+	if (dev_priv->card_type >= NV_10)
+		regp->nv10_cursync = NVReadRAMDAC(dev, head, NV_RAMDAC_NV10_CURSYNC);
+
+	nouveau_hw_get_pllvals(dev, head ? VPLL2 : VPLL1, &regp->pllvals);
+	state->pllsel = NVReadRAMDAC(dev, 0, NV_PRAMDAC_PLL_COEFF_SELECT);
+	if (nv_two_heads(dev))
+		state->sel_clk = NVReadRAMDAC(dev, 0, NV_PRAMDAC_SEL_CLK);
+	if (dev_priv->chipset == 0x11)
+		regp->dither = NVReadRAMDAC(dev, head, NV_RAMDAC_DITHER_NV11);
+
+	regp->ramdac_gen_ctrl = NVReadRAMDAC(dev, head, NV_PRAMDAC_GENERAL_CONTROL);
+
+	if (nv_gf4_disp_arch(dev))
+		regp->ramdac_630 = NVReadRAMDAC(dev, head, NV_PRAMDAC_630);
+	if (dev_priv->chipset >= 0x30)
+		regp->ramdac_634 = NVReadRAMDAC(dev, head, NV_PRAMDAC_634);
+
+	regp->tv_setup = NVReadRAMDAC(dev, head, NV_PRAMDAC_TV_SETUP);
+	regp->tv_vtotal = NVReadRAMDAC(dev, head, NV_PRAMDAC_TV_VTOTAL);
+	regp->tv_vskew = NVReadRAMDAC(dev, head, NV_PRAMDAC_TV_VSKEW);
+	regp->tv_vsync_delay = NVReadRAMDAC(dev, head, NV_PRAMDAC_TV_VSYNC_DELAY);
+	regp->tv_htotal = NVReadRAMDAC(dev, head, NV_PRAMDAC_TV_HTOTAL);
+	regp->tv_hskew = NVReadRAMDAC(dev, head, NV_PRAMDAC_TV_HSKEW);
+	regp->tv_hsync_delay = NVReadRAMDAC(dev, head, NV_PRAMDAC_TV_HSYNC_DELAY);
+	regp->tv_hsync_delay2 = NVReadRAMDAC(dev, head, NV_PRAMDAC_TV_HSYNC_DELAY2);
+
+	for (i = 0; i < 7; i++) {
+		uint32_t ramdac_reg = NV_PRAMDAC_FP_VDISPLAY_END + (i * 4);
+		regp->fp_vert_regs[i] = NVReadRAMDAC(dev, head, ramdac_reg);
+		regp->fp_horiz_regs[i] = NVReadRAMDAC(dev, head, ramdac_reg + 0x20);
+	}
+
+	if (nv_gf4_disp_arch(dev)) {
+		regp->dither = NVReadRAMDAC(dev, head, NV_RAMDAC_FP_DITHER);
+		for (i = 0; i < 3; i++) {
+			regp->dither_regs[i] = NVReadRAMDAC(dev, head, NV_PRAMDAC_850 + i * 4);
+			regp->dither_regs[i + 3] = NVReadRAMDAC(dev, head, NV_PRAMDAC_85C + i * 4);
+		}
+	}
+
+	regp->fp_control = NVReadRAMDAC(dev, head, NV_PRAMDAC_FP_TG_CONTROL);
+	regp->fp_debug_0 = NVReadRAMDAC(dev, head, NV_PRAMDAC_FP_DEBUG_0);
+	if (!nv_gf4_disp_arch(dev) && head == 0) {
+		/* early chips don't allow access to PRAMDAC_TMDS_* without
+		 * the head A FPCLK on (nv11 even locks up) */
+		NVWriteRAMDAC(dev, 0, NV_PRAMDAC_FP_DEBUG_0, regp->fp_debug_0 &
+			      ~NV_PRAMDAC_FP_DEBUG_0_PWRDOWN_FPCLK);
+	}
+	regp->fp_debug_1 = NVReadRAMDAC(dev, head, NV_PRAMDAC_FP_DEBUG_1);
+	regp->fp_debug_2 = NVReadRAMDAC(dev, head, NV_PRAMDAC_FP_DEBUG_2);
+
+	regp->fp_margin_color = NVReadRAMDAC(dev, head, NV_PRAMDAC_FP_MARGIN_COLOR);
+
+	if (nv_gf4_disp_arch(dev))
+		regp->ramdac_8c0 = NVReadRAMDAC(dev, head, NV_PRAMDAC_8C0);
+
+	if (dev_priv->card_type == NV_40) {
+		regp->ramdac_a20 = NVReadRAMDAC(dev, head, NV_PRAMDAC_A20);
+		regp->ramdac_a24 = NVReadRAMDAC(dev, head, NV_PRAMDAC_A24);
+		regp->ramdac_a34 = NVReadRAMDAC(dev, head, NV_PRAMDAC_A34);
+
+		for (i = 0; i < 38; i++)
+			regp->ctv_regs[i] = NVReadRAMDAC(dev, head,
+							 NV_PRAMDAC_CTV + 4*i);
+	}
+}
+
+static void
+nv_load_state_ramdac(struct drm_device *dev, int head,
+		     struct nv04_mode_state *state)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nv04_crtc_reg *regp = &state->crtc_reg[head];
+	uint32_t pllreg = head ? NV_RAMDAC_VPLL2 : NV_PRAMDAC_VPLL_COEFF;
+	int i;
+
+	if (dev_priv->card_type >= NV_10)
+		NVWriteRAMDAC(dev, head, NV_RAMDAC_NV10_CURSYNC, regp->nv10_cursync);
+
+	nouveau_hw_setpll(dev, pllreg, &regp->pllvals);
+	NVWriteRAMDAC(dev, 0, NV_PRAMDAC_PLL_COEFF_SELECT, state->pllsel);
+	if (nv_two_heads(dev))
+		NVWriteRAMDAC(dev, 0, NV_PRAMDAC_SEL_CLK, state->sel_clk);
+	if (dev_priv->chipset == 0x11)
+		NVWriteRAMDAC(dev, head, NV_RAMDAC_DITHER_NV11, regp->dither);
+
+	NVWriteRAMDAC(dev, head, NV_PRAMDAC_GENERAL_CONTROL, regp->ramdac_gen_ctrl);
+
+	if (nv_gf4_disp_arch(dev))
+		NVWriteRAMDAC(dev, head, NV_PRAMDAC_630, regp->ramdac_630);
+	if (dev_priv->chipset >= 0x30)
+		NVWriteRAMDAC(dev, head, NV_PRAMDAC_634, regp->ramdac_634);
+
+	NVWriteRAMDAC(dev, head, NV_PRAMDAC_TV_SETUP, regp->tv_setup);
+	NVWriteRAMDAC(dev, head, NV_PRAMDAC_TV_VTOTAL, regp->tv_vtotal);
+	NVWriteRAMDAC(dev, head, NV_PRAMDAC_TV_VSKEW, regp->tv_vskew);
+	NVWriteRAMDAC(dev, head, NV_PRAMDAC_TV_VSYNC_DELAY, regp->tv_vsync_delay);
+	NVWriteRAMDAC(dev, head, NV_PRAMDAC_TV_HTOTAL, regp->tv_htotal);
+	NVWriteRAMDAC(dev, head, NV_PRAMDAC_TV_HSKEW, regp->tv_hskew);
+	NVWriteRAMDAC(dev, head, NV_PRAMDAC_TV_HSYNC_DELAY, regp->tv_hsync_delay);
+	NVWriteRAMDAC(dev, head, NV_PRAMDAC_TV_HSYNC_DELAY2, regp->tv_hsync_delay2);
+
+	for (i = 0; i < 7; i++) {
+		uint32_t ramdac_reg = NV_PRAMDAC_FP_VDISPLAY_END + (i * 4);
+
+		NVWriteRAMDAC(dev, head, ramdac_reg, regp->fp_vert_regs[i]);
+		NVWriteRAMDAC(dev, head, ramdac_reg + 0x20, regp->fp_horiz_regs[i]);
+	}
+
+	if (nv_gf4_disp_arch(dev)) {
+		NVWriteRAMDAC(dev, head, NV_RAMDAC_FP_DITHER, regp->dither);
+		for (i = 0; i < 3; i++) {
+			NVWriteRAMDAC(dev, head, NV_PRAMDAC_850 + i * 4, regp->dither_regs[i]);
+			NVWriteRAMDAC(dev, head, NV_PRAMDAC_85C + i * 4, regp->dither_regs[i + 3]);
+		}
+	}
+
+	NVWriteRAMDAC(dev, head, NV_PRAMDAC_FP_TG_CONTROL, regp->fp_control);
+	NVWriteRAMDAC(dev, head, NV_PRAMDAC_FP_DEBUG_0, regp->fp_debug_0);
+	NVWriteRAMDAC(dev, head, NV_PRAMDAC_FP_DEBUG_1, regp->fp_debug_1);
+	NVWriteRAMDAC(dev, head, NV_PRAMDAC_FP_DEBUG_2, regp->fp_debug_2);
+
+	NVWriteRAMDAC(dev, head, NV_PRAMDAC_FP_MARGIN_COLOR, regp->fp_margin_color);
+
+	if (nv_gf4_disp_arch(dev))
+		NVWriteRAMDAC(dev, head, NV_PRAMDAC_8C0, regp->ramdac_8c0);
+
+	if (dev_priv->card_type == NV_40) {
+		NVWriteRAMDAC(dev, head, NV_PRAMDAC_A20, regp->ramdac_a20);
+		NVWriteRAMDAC(dev, head, NV_PRAMDAC_A24, regp->ramdac_a24);
+		NVWriteRAMDAC(dev, head, NV_PRAMDAC_A34, regp->ramdac_a34);
+
+		for (i = 0; i < 38; i++)
+			NVWriteRAMDAC(dev, head,
+				      NV_PRAMDAC_CTV + 4*i, regp->ctv_regs[i]);
+	}
+}
+
+static void
+nv_save_state_vga(struct drm_device *dev, int head,
+		  struct nv04_mode_state *state)
+{
+	struct nv04_crtc_reg *regp = &state->crtc_reg[head];
+	int i;
+
+	regp->MiscOutReg = NVReadPRMVIO(dev, head, NV_PRMVIO_MISC__READ);
+
+	for (i = 0; i < 25; i++)
+		rd_cio_state(dev, head, regp, i);
+
+	NVSetEnablePalette(dev, head, true);
+	for (i = 0; i < 21; i++)
+		regp->Attribute[i] = NVReadVgaAttr(dev, head, i);
+	NVSetEnablePalette(dev, head, false);
+
+	for (i = 0; i < 9; i++)
+		regp->Graphics[i] = NVReadVgaGr(dev, head, i);
+
+	for (i = 0; i < 5; i++)
+		regp->Sequencer[i] = NVReadVgaSeq(dev, head, i);
+}
+
+static void
+nv_load_state_vga(struct drm_device *dev, int head,
+		  struct nv04_mode_state *state)
+{
+	struct nv04_crtc_reg *regp = &state->crtc_reg[head];
+	int i;
+
+	NVWritePRMVIO(dev, head, NV_PRMVIO_MISC__WRITE, regp->MiscOutReg);
+
+	for (i = 0; i < 5; i++)
+		NVWriteVgaSeq(dev, head, i, regp->Sequencer[i]);
+
+	nv_lock_vga_crtc_base(dev, head, false);
+	for (i = 0; i < 25; i++)
+		wr_cio_state(dev, head, regp, i);
+	nv_lock_vga_crtc_base(dev, head, true);
+
+	for (i = 0; i < 9; i++)
+		NVWriteVgaGr(dev, head, i, regp->Graphics[i]);
+
+	NVSetEnablePalette(dev, head, true);
+	for (i = 0; i < 21; i++)
+		NVWriteVgaAttr(dev, head, i, regp->Attribute[i]);
+	NVSetEnablePalette(dev, head, false);
+}
+
+static void
+nv_save_state_ext(struct drm_device *dev, int head,
+		  struct nv04_mode_state *state)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nv04_crtc_reg *regp = &state->crtc_reg[head];
+	int i;
+
+	rd_cio_state(dev, head, regp, NV_CIO_CRE_LCD__INDEX);
+	rd_cio_state(dev, head, regp, NV_CIO_CRE_RPC0_INDEX);
+	rd_cio_state(dev, head, regp, NV_CIO_CRE_RPC1_INDEX);
+	rd_cio_state(dev, head, regp, NV_CIO_CRE_LSR_INDEX);
+	rd_cio_state(dev, head, regp, NV_CIO_CRE_PIXEL_INDEX);
+	rd_cio_state(dev, head, regp, NV_CIO_CRE_HEB__INDEX);
+	rd_cio_state(dev, head, regp, NV_CIO_CRE_ENH_INDEX);
+
+	rd_cio_state(dev, head, regp, NV_CIO_CRE_FF_INDEX);
+	rd_cio_state(dev, head, regp, NV_CIO_CRE_FFLWM__INDEX);
+	rd_cio_state(dev, head, regp, NV_CIO_CRE_21);
+	if (dev_priv->card_type >= NV_30)
+		rd_cio_state(dev, head, regp, NV_CIO_CRE_47);
+	rd_cio_state(dev, head, regp, NV_CIO_CRE_49);
+	rd_cio_state(dev, head, regp, NV_CIO_CRE_HCUR_ADDR0_INDEX);
+	rd_cio_state(dev, head, regp, NV_CIO_CRE_HCUR_ADDR1_INDEX);
+	rd_cio_state(dev, head, regp, NV_CIO_CRE_HCUR_ADDR2_INDEX);
+	rd_cio_state(dev, head, regp, NV_CIO_CRE_ILACE__INDEX);
+
+	if (dev_priv->card_type >= NV_10) {
+		regp->crtc_830 = NVReadCRTC(dev, head, NV_PCRTC_830);
+		regp->crtc_834 = NVReadCRTC(dev, head, NV_PCRTC_834);
+
+		if (dev_priv->card_type >= NV_30)
+			regp->gpio_ext = NVReadCRTC(dev, head, NV_PCRTC_GPIO_EXT);
+
+		if (dev_priv->card_type == NV_40)
+			regp->crtc_850 = NVReadCRTC(dev, head, NV_PCRTC_850);
+
+		if (nv_two_heads(dev))
+			regp->crtc_eng_ctrl = NVReadCRTC(dev, head, NV_PCRTC_ENGINE_CTRL);
+		regp->cursor_cfg = NVReadCRTC(dev, head, NV_PCRTC_CURSOR_CONFIG);
+	}
+
+	regp->crtc_cfg = NVReadCRTC(dev, head, NV_PCRTC_CONFIG);
+
+	rd_cio_state(dev, head, regp, NV_CIO_CRE_SCRATCH3__INDEX);
+	rd_cio_state(dev, head, regp, NV_CIO_CRE_SCRATCH4__INDEX);
+	if (dev_priv->card_type >= NV_10) {
+		rd_cio_state(dev, head, regp, NV_CIO_CRE_EBR_INDEX);
+		rd_cio_state(dev, head, regp, NV_CIO_CRE_CSB);
+		rd_cio_state(dev, head, regp, NV_CIO_CRE_4B);
+		rd_cio_state(dev, head, regp, NV_CIO_CRE_TVOUT_LATENCY);
+	}
+	/* NV11 and NV20 don't have this, they stop at 0x52. */
+	if (nv_gf4_disp_arch(dev)) {
+		rd_cio_state(dev, head, regp, NV_CIO_CRE_53);
+		rd_cio_state(dev, head, regp, NV_CIO_CRE_54);
+
+		for (i = 0; i < 0x10; i++)
+			regp->CR58[i] = NVReadVgaCrtc5758(dev, head, i);
+		rd_cio_state(dev, head, regp, NV_CIO_CRE_59);
+		rd_cio_state(dev, head, regp, NV_CIO_CRE_5B);
+
+		rd_cio_state(dev, head, regp, NV_CIO_CRE_85);
+		rd_cio_state(dev, head, regp, NV_CIO_CRE_86);
+	}
+
+	regp->fb_start = NVReadCRTC(dev, head, NV_PCRTC_START);
+}
+
+static void
+nv_load_state_ext(struct drm_device *dev, int head,
+		  struct nv04_mode_state *state)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nv04_crtc_reg *regp = &state->crtc_reg[head];
+	uint32_t reg900;
+	int i;
+
+	if (dev_priv->card_type >= NV_10) {
+		if (nv_two_heads(dev))
+			/* setting ENGINE_CTRL (EC) *must* come before
+			 * CIO_CRE_LCD, as writing CRE_LCD sets bits 16 & 17 in
+			 * EC that should not be overwritten by writing stale EC
+			 */
+			NVWriteCRTC(dev, head, NV_PCRTC_ENGINE_CTRL, regp->crtc_eng_ctrl);
+
+		nvWriteVIDEO(dev, NV_PVIDEO_STOP, 1);
+		nvWriteVIDEO(dev, NV_PVIDEO_INTR_EN, 0);
+		nvWriteVIDEO(dev, NV_PVIDEO_OFFSET_BUFF(0), 0);
+		nvWriteVIDEO(dev, NV_PVIDEO_OFFSET_BUFF(1), 0);
+		nvWriteVIDEO(dev, NV_PVIDEO_LIMIT(0), dev_priv->fb_available_size - 1);
+		nvWriteVIDEO(dev, NV_PVIDEO_LIMIT(1), dev_priv->fb_available_size - 1);
+		nvWriteVIDEO(dev, NV_PVIDEO_UVPLANE_LIMIT(0), dev_priv->fb_available_size - 1);
+		nvWriteVIDEO(dev, NV_PVIDEO_UVPLANE_LIMIT(1), dev_priv->fb_available_size - 1);
+		nvWriteMC(dev, NV_PBUS_POWERCTRL_2, 0);
+
+		NVWriteCRTC(dev, head, NV_PCRTC_CURSOR_CONFIG, regp->cursor_cfg);
+		NVWriteCRTC(dev, head, NV_PCRTC_830, regp->crtc_830);
+		NVWriteCRTC(dev, head, NV_PCRTC_834, regp->crtc_834);
+
+		if (dev_priv->card_type >= NV_30)
+			NVWriteCRTC(dev, head, NV_PCRTC_GPIO_EXT, regp->gpio_ext);
+
+		if (dev_priv->card_type == NV_40) {
+			NVWriteCRTC(dev, head, NV_PCRTC_850, regp->crtc_850);
+
+			reg900 = NVReadRAMDAC(dev, head, NV_PRAMDAC_900);
+			if (regp->crtc_cfg == NV_PCRTC_CONFIG_START_ADDRESS_HSYNC)
+				NVWriteRAMDAC(dev, head, NV_PRAMDAC_900, reg900 | 0x10000);
+			else
+				NVWriteRAMDAC(dev, head, NV_PRAMDAC_900, reg900 & ~0x10000);
+		}
+	}
+
+	NVWriteCRTC(dev, head, NV_PCRTC_CONFIG, regp->crtc_cfg);
+
+	wr_cio_state(dev, head, regp, NV_CIO_CRE_RPC0_INDEX);
+	wr_cio_state(dev, head, regp, NV_CIO_CRE_RPC1_INDEX);
+	wr_cio_state(dev, head, regp, NV_CIO_CRE_LSR_INDEX);
+	wr_cio_state(dev, head, regp, NV_CIO_CRE_PIXEL_INDEX);
+	wr_cio_state(dev, head, regp, NV_CIO_CRE_LCD__INDEX);
+	wr_cio_state(dev, head, regp, NV_CIO_CRE_HEB__INDEX);
+	wr_cio_state(dev, head, regp, NV_CIO_CRE_ENH_INDEX);
+	wr_cio_state(dev, head, regp, NV_CIO_CRE_FF_INDEX);
+	wr_cio_state(dev, head, regp, NV_CIO_CRE_FFLWM__INDEX);
+	if (dev_priv->card_type >= NV_30)
+		wr_cio_state(dev, head, regp, NV_CIO_CRE_47);
+
+	wr_cio_state(dev, head, regp, NV_CIO_CRE_49);
+	wr_cio_state(dev, head, regp, NV_CIO_CRE_HCUR_ADDR0_INDEX);
+	wr_cio_state(dev, head, regp, NV_CIO_CRE_HCUR_ADDR1_INDEX);
+	wr_cio_state(dev, head, regp, NV_CIO_CRE_HCUR_ADDR2_INDEX);
+	if (dev_priv->card_type == NV_40)
+		nv_fix_nv40_hw_cursor(dev, head);
+	wr_cio_state(dev, head, regp, NV_CIO_CRE_ILACE__INDEX);
+
+	wr_cio_state(dev, head, regp, NV_CIO_CRE_SCRATCH3__INDEX);
+	wr_cio_state(dev, head, regp, NV_CIO_CRE_SCRATCH4__INDEX);
+	if (dev_priv->card_type >= NV_10) {
+		wr_cio_state(dev, head, regp, NV_CIO_CRE_EBR_INDEX);
+		wr_cio_state(dev, head, regp, NV_CIO_CRE_CSB);
+		wr_cio_state(dev, head, regp, NV_CIO_CRE_4B);
+		wr_cio_state(dev, head, regp, NV_CIO_CRE_TVOUT_LATENCY);
+	}
+	/* NV11 and NV20 stop at 0x52. */
+	if (nv_gf4_disp_arch(dev)) {
+		if (dev_priv->card_type == NV_10) {
+			/* Not waiting for vertical retrace before modifying
+			   CRE_53/CRE_54 causes lockups. */
+			nouveau_wait_until(dev, 650000000, NV_PRMCIO_INP0__COLOR, 0x8, 0x8);
+			nouveau_wait_until(dev, 650000000, NV_PRMCIO_INP0__COLOR, 0x8, 0x0);
+		}
+
+		wr_cio_state(dev, head, regp, NV_CIO_CRE_53);
+		wr_cio_state(dev, head, regp, NV_CIO_CRE_54);
+
+		for (i = 0; i < 0x10; i++)
+			NVWriteVgaCrtc5758(dev, head, i, regp->CR58[i]);
+		wr_cio_state(dev, head, regp, NV_CIO_CRE_59);
+		wr_cio_state(dev, head, regp, NV_CIO_CRE_5B);
+
+		wr_cio_state(dev, head, regp, NV_CIO_CRE_85);
+		wr_cio_state(dev, head, regp, NV_CIO_CRE_86);
+	}
+
+	NVWriteCRTC(dev, head, NV_PCRTC_START, regp->fb_start);
+
+	/* Setting 1 on this value gives you interrupts for every vblank period. */
+	NVWriteCRTC(dev, head, NV_PCRTC_INTR_EN_0, 0);
+	NVWriteCRTC(dev, head, NV_PCRTC_INTR_0, NV_PCRTC_INTR_0_VBLANK);
+}
+
+static void
+nv_save_state_palette(struct drm_device *dev, int head,
+		      struct nv04_mode_state *state)
+{
+	int head_offset = head * NV_PRMDIO_SIZE, i;
+
+	nv_wr08(dev, NV_PRMDIO_PIXEL_MASK + head_offset,
+				NV_PRMDIO_PIXEL_MASK_MASK);
+	nv_wr08(dev, NV_PRMDIO_READ_MODE_ADDRESS + head_offset, 0x0);
+
+	for (i = 0; i < 768; i++) {
+		state->crtc_reg[head].DAC[i] = nv_rd08(dev,
+				NV_PRMDIO_PALETTE_DATA + head_offset);
+	}
+
+	NVSetEnablePalette(dev, head, false);
+}
+
+void
+nouveau_hw_load_state_palette(struct drm_device *dev, int head,
+			      struct nv04_mode_state *state)
+{
+	int head_offset = head * NV_PRMDIO_SIZE, i;
+
+	nv_wr08(dev, NV_PRMDIO_PIXEL_MASK + head_offset,
+				NV_PRMDIO_PIXEL_MASK_MASK);
+	nv_wr08(dev, NV_PRMDIO_WRITE_MODE_ADDRESS + head_offset, 0x0);
+
+	for (i = 0; i < 768; i++) {
+		nv_wr08(dev, NV_PRMDIO_PALETTE_DATA + head_offset,
+				state->crtc_reg[head].DAC[i]);
+	}
+
+	NVSetEnablePalette(dev, head, false);
+}
+
+void nouveau_hw_save_state(struct drm_device *dev, int head,
+			   struct nv04_mode_state *state)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+
+	if (dev_priv->chipset == 0x11)
+		/* NB: no attempt is made to restore the bad pll later on */
+		nouveau_hw_fix_bad_vpll(dev, head);
+	nv_save_state_ramdac(dev, head, state);
+	nv_save_state_vga(dev, head, state);
+	nv_save_state_palette(dev, head, state);
+	nv_save_state_ext(dev, head, state);
+}
+
+void nouveau_hw_load_state(struct drm_device *dev, int head,
+			   struct nv04_mode_state *state)
+{
+	NVVgaProtect(dev, head, true);
+	nv_load_state_ramdac(dev, head, state);
+	nv_load_state_ext(dev, head, state);
+	nouveau_hw_load_state_palette(dev, head, state);
+	nv_load_state_vga(dev, head, state);
+	NVVgaProtect(dev, head, false);
+}
diff --git a/drivers/gpu/drm/nouveau/nouveau_hw.h b/drivers/gpu/drm/nouveau/nouveau_hw.h
new file mode 100644
index 000000000000..869130f83602
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nouveau_hw.h
@@ -0,0 +1,455 @@
+/*
+ * Copyright 2008 Stuart Bennett
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+ * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF
+ * OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#ifndef __NOUVEAU_HW_H__
+#define __NOUVEAU_HW_H__
+
+#include "drmP.h"
+#include "nouveau_drv.h"
+
+#define MASK(field) ( \
+	(0xffffffff >> (31 - ((1 ? field) - (0 ? field)))) << (0 ? field))
+
+#define XLATE(src, srclowbit, outfield) ( \
+	(((src) >> (srclowbit)) << (0 ? outfield)) & MASK(outfield))
+
+void NVWriteVgaSeq(struct drm_device *, int head, uint8_t index, uint8_t value);
+uint8_t NVReadVgaSeq(struct drm_device *, int head, uint8_t index);
+void NVWriteVgaGr(struct drm_device *, int head, uint8_t index, uint8_t value);
+uint8_t NVReadVgaGr(struct drm_device *, int head, uint8_t index);
+void NVSetOwner(struct drm_device *, int owner);
+void NVBlankScreen(struct drm_device *, int head, bool blank);
+void nouveau_hw_setpll(struct drm_device *, uint32_t reg1,
+		       struct nouveau_pll_vals *pv);
+int nouveau_hw_get_pllvals(struct drm_device *, enum pll_types plltype,
+			   struct nouveau_pll_vals *pllvals);
+int nouveau_hw_pllvals_to_clk(struct nouveau_pll_vals *pllvals);
+int nouveau_hw_get_clock(struct drm_device *, enum pll_types plltype);
+void nouveau_hw_save_vga_fonts(struct drm_device *, bool save);
+void nouveau_hw_save_state(struct drm_device *, int head,
+			   struct nv04_mode_state *state);
+void nouveau_hw_load_state(struct drm_device *, int head,
+			   struct nv04_mode_state *state);
+void nouveau_hw_load_state_palette(struct drm_device *, int head,
+				   struct nv04_mode_state *state);
+
+/* nouveau_calc.c */
+extern void nouveau_calc_arb(struct drm_device *, int vclk, int bpp,
+			     int *burst, int *lwm);
+extern int nouveau_calc_pll_mnp(struct drm_device *, struct pll_lims *pll_lim,
+				int clk, struct nouveau_pll_vals *pv);
+
+static inline uint32_t
+nvReadMC(struct drm_device *dev, uint32_t reg)
+{
+	uint32_t val = nv_rd32(dev, reg);
+	NV_REG_DEBUG(MC, dev, "reg %08x val %08x\n", reg, val);
+	return val;
+}
+
+static inline void
+nvWriteMC(struct drm_device *dev, uint32_t reg, uint32_t val)
+{
+	NV_REG_DEBUG(MC, dev, "reg %08x val %08x\n", reg, val);
+	nv_wr32(dev, reg, val);
+}
+
+static inline uint32_t
+nvReadVIDEO(struct drm_device *dev, uint32_t reg)
+{
+	uint32_t val = nv_rd32(dev, reg);
+	NV_REG_DEBUG(VIDEO, dev, "reg %08x val %08x\n", reg, val);
+	return val;
+}
+
+static inline void
+nvWriteVIDEO(struct drm_device *dev, uint32_t reg, uint32_t val)
+{
+	NV_REG_DEBUG(VIDEO, dev, "reg %08x val %08x\n", reg, val);
+	nv_wr32(dev, reg, val);
+}
+
+static inline uint32_t
+nvReadFB(struct drm_device *dev, uint32_t reg)
+{
+	uint32_t val = nv_rd32(dev, reg);
+	NV_REG_DEBUG(FB, dev, "reg %08x val %08x\n", reg, val);
+	return val;
+}
+
+static inline void
+nvWriteFB(struct drm_device *dev, uint32_t reg, uint32_t val)
+{
+	NV_REG_DEBUG(FB, dev, "reg %08x val %08x\n", reg, val);
+	nv_wr32(dev, reg, val);
+}
+
+static inline uint32_t
+nvReadEXTDEV(struct drm_device *dev, uint32_t reg)
+{
+	uint32_t val = nv_rd32(dev, reg);
+	NV_REG_DEBUG(EXTDEV, dev, "reg %08x val %08x\n", reg, val);
+	return val;
+}
+
+static inline void
+nvWriteEXTDEV(struct drm_device *dev, uint32_t reg, uint32_t val)
+{
+	NV_REG_DEBUG(EXTDEV, dev, "reg %08x val %08x\n", reg, val);
+	nv_wr32(dev, reg, val);
+}
+
+static inline uint32_t NVReadCRTC(struct drm_device *dev,
+					int head, uint32_t reg)
+{
+	uint32_t val;
+	if (head)
+		reg += NV_PCRTC0_SIZE;
+	val = nv_rd32(dev, reg);
+	NV_REG_DEBUG(CRTC, dev, "head %d reg %08x val %08x\n", head, reg, val);
+	return val;
+}
+
+static inline void NVWriteCRTC(struct drm_device *dev,
+					int head, uint32_t reg, uint32_t val)
+{
+	if (head)
+		reg += NV_PCRTC0_SIZE;
+	NV_REG_DEBUG(CRTC, dev, "head %d reg %08x val %08x\n", head, reg, val);
+	nv_wr32(dev, reg, val);
+}
+
+static inline uint32_t NVReadRAMDAC(struct drm_device *dev,
+					int head, uint32_t reg)
+{
+	uint32_t val;
+	if (head)
+		reg += NV_PRAMDAC0_SIZE;
+	val = nv_rd32(dev, reg);
+	NV_REG_DEBUG(RAMDAC, dev, "head %d reg %08x val %08x\n",
+							head, reg, val);
+	return val;
+}
+
+static inline void NVWriteRAMDAC(struct drm_device *dev,
+					int head, uint32_t reg, uint32_t val)
+{
+	if (head)
+		reg += NV_PRAMDAC0_SIZE;
+	NV_REG_DEBUG(RAMDAC, dev, "head %d reg %08x val %08x\n",
+							head, reg, val);
+	nv_wr32(dev, reg, val);
+}
+
+static inline uint8_t nv_read_tmds(struct drm_device *dev,
+					int or, int dl, uint8_t address)
+{
+	int ramdac = (or & OUTPUT_C) >> 2;
+
+	NVWriteRAMDAC(dev, ramdac, NV_PRAMDAC_FP_TMDS_CONTROL + dl * 8,
+	NV_PRAMDAC_FP_TMDS_CONTROL_WRITE_DISABLE | address);
+	return NVReadRAMDAC(dev, ramdac, NV_PRAMDAC_FP_TMDS_DATA + dl * 8);
+}
+
+static inline void nv_write_tmds(struct drm_device *dev,
+					int or, int dl, uint8_t address,
+					uint8_t data)
+{
+	int ramdac = (or & OUTPUT_C) >> 2;
+
+	NVWriteRAMDAC(dev, ramdac, NV_PRAMDAC_FP_TMDS_DATA + dl * 8, data);
+	NVWriteRAMDAC(dev, ramdac, NV_PRAMDAC_FP_TMDS_CONTROL + dl * 8, address);
+}
+
+static inline void NVWriteVgaCrtc(struct drm_device *dev,
+					int head, uint8_t index, uint8_t value)
+{
+	NV_REG_DEBUG(VGACRTC, dev, "head %d index 0x%02x data 0x%02x\n",
+							head, index, value);
+	nv_wr08(dev, NV_PRMCIO_CRX__COLOR + head * NV_PRMCIO_SIZE, index);
+	nv_wr08(dev, NV_PRMCIO_CR__COLOR + head * NV_PRMCIO_SIZE, value);
+}
+
+static inline uint8_t NVReadVgaCrtc(struct drm_device *dev,
+					int head, uint8_t index)
+{
+	uint8_t val;
+	nv_wr08(dev, NV_PRMCIO_CRX__COLOR + head * NV_PRMCIO_SIZE, index);
+	val = nv_rd08(dev, NV_PRMCIO_CR__COLOR + head * NV_PRMCIO_SIZE);
+	NV_REG_DEBUG(VGACRTC, dev, "head %d index 0x%02x data 0x%02x\n",
+							head, index, val);
+	return val;
+}
+
+/* CR57 and CR58 are a fun pair of regs. CR57 provides an index (0-0xf) for CR58
+ * I suspect they in fact do nothing, but are merely a way to carry useful
+ * per-head variables around
+ *
+ * Known uses:
+ * CR57		CR58
+ * 0x00		index to the appropriate dcb entry (or 7f for inactive)
+ * 0x02		dcb entry's "or" value (or 00 for inactive)
+ * 0x03		bit0 set for dual link (LVDS, possibly elsewhere too)
+ * 0x08 or 0x09	pxclk in MHz
+ * 0x0f		laptop panel info -	low nibble for PEXTDEV_BOOT_0 strap
+ * 					high nibble for xlat strap value
+ */
+
+static inline void
+NVWriteVgaCrtc5758(struct drm_device *dev, int head, uint8_t index, uint8_t value)
+{
+	NVWriteVgaCrtc(dev, head, NV_CIO_CRE_57, index);
+	NVWriteVgaCrtc(dev, head, NV_CIO_CRE_58, value);
+}
+
+static inline uint8_t NVReadVgaCrtc5758(struct drm_device *dev, int head, uint8_t index)
+{
+	NVWriteVgaCrtc(dev, head, NV_CIO_CRE_57, index);
+	return NVReadVgaCrtc(dev, head, NV_CIO_CRE_58);
+}
+
+static inline uint8_t NVReadPRMVIO(struct drm_device *dev,
+					int head, uint32_t reg)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	uint8_t val;
+
+	/* Only NV4x have two pvio ranges; other twoHeads cards MUST call
+	 * NVSetOwner for the relevant head to be programmed */
+	if (head && dev_priv->card_type == NV_40)
+		reg += NV_PRMVIO_SIZE;
+
+	val = nv_rd08(dev, reg);
+	NV_REG_DEBUG(RMVIO, dev, "head %d reg %08x val %02x\n", head, reg, val);
+	return val;
+}
+
+static inline void NVWritePRMVIO(struct drm_device *dev,
+					int head, uint32_t reg, uint8_t value)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+
+	/* Only NV4x have two pvio ranges; other twoHeads cards MUST call
+	 * NVSetOwner for the relevant head to be programmed */
+	if (head && dev_priv->card_type == NV_40)
+		reg += NV_PRMVIO_SIZE;
+
+	NV_REG_DEBUG(RMVIO, dev, "head %d reg %08x val %02x\n",
+						head, reg, value);
+	nv_wr08(dev, reg, value);
+}
+
+static inline void NVSetEnablePalette(struct drm_device *dev, int head, bool enable)
+{
+	nv_rd08(dev, NV_PRMCIO_INP0__COLOR + head * NV_PRMCIO_SIZE);
+	nv_wr08(dev, NV_PRMCIO_ARX + head * NV_PRMCIO_SIZE, enable ? 0 : 0x20);
+}
+
+static inline bool NVGetEnablePalette(struct drm_device *dev, int head)
+{
+	nv_rd08(dev, NV_PRMCIO_INP0__COLOR + head * NV_PRMCIO_SIZE);
+	return !(nv_rd08(dev, NV_PRMCIO_ARX + head * NV_PRMCIO_SIZE) & 0x20);
+}
+
+static inline void NVWriteVgaAttr(struct drm_device *dev,
+					int head, uint8_t index, uint8_t value)
+{
+	if (NVGetEnablePalette(dev, head))
+		index &= ~0x20;
+	else
+		index |= 0x20;
+
+	nv_rd08(dev, NV_PRMCIO_INP0__COLOR + head * NV_PRMCIO_SIZE);
+	NV_REG_DEBUG(VGAATTR, dev, "head %d index 0x%02x data 0x%02x\n",
+							head, index, value);
+	nv_wr08(dev, NV_PRMCIO_ARX + head * NV_PRMCIO_SIZE, index);
+	nv_wr08(dev, NV_PRMCIO_AR__WRITE + head * NV_PRMCIO_SIZE, value);
+}
+
+static inline uint8_t NVReadVgaAttr(struct drm_device *dev,
+					int head, uint8_t index)
+{
+	uint8_t val;
+	if (NVGetEnablePalette(dev, head))
+		index &= ~0x20;
+	else
+		index |= 0x20;
+
+	nv_rd08(dev, NV_PRMCIO_INP0__COLOR + head * NV_PRMCIO_SIZE);
+	nv_wr08(dev, NV_PRMCIO_ARX + head * NV_PRMCIO_SIZE, index);
+	val = nv_rd08(dev, NV_PRMCIO_AR__READ + head * NV_PRMCIO_SIZE);
+	NV_REG_DEBUG(VGAATTR, dev, "head %d index 0x%02x data 0x%02x\n",
+							head, index, val);
+	return val;
+}
+
+static inline void NVVgaSeqReset(struct drm_device *dev, int head, bool start)
+{
+	NVWriteVgaSeq(dev, head, NV_VIO_SR_RESET_INDEX, start ? 0x1 : 0x3);
+}
+
+static inline void NVVgaProtect(struct drm_device *dev, int head, bool protect)
+{
+	uint8_t seq1 = NVReadVgaSeq(dev, head, NV_VIO_SR_CLOCK_INDEX);
+
+	if (protect) {
+		NVVgaSeqReset(dev, head, true);
+		NVWriteVgaSeq(dev, head, NV_VIO_SR_CLOCK_INDEX, seq1 | 0x20);
+	} else {
+		/* Reenable sequencer, then turn on screen */
+		NVWriteVgaSeq(dev, head, NV_VIO_SR_CLOCK_INDEX, seq1 & ~0x20);   /* reenable display */
+		NVVgaSeqReset(dev, head, false);
+	}
+	NVSetEnablePalette(dev, head, protect);
+}
+
+static inline bool
+nv_heads_tied(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+
+	if (dev_priv->chipset == 0x11)
+		return !!(nvReadMC(dev, NV_PBUS_DEBUG_1) & (1 << 28));
+
+	return NVReadVgaCrtc(dev, 0, NV_CIO_CRE_44) & 0x4;
+}
+
+/* makes cr0-7 on the specified head read-only */
+static inline bool
+nv_lock_vga_crtc_base(struct drm_device *dev, int head, bool lock)
+{
+	uint8_t cr11 = NVReadVgaCrtc(dev, head, NV_CIO_CR_VRE_INDEX);
+	bool waslocked = cr11 & 0x80;
+
+	if (lock)
+		cr11 |= 0x80;
+	else
+		cr11 &= ~0x80;
+	NVWriteVgaCrtc(dev, head, NV_CIO_CR_VRE_INDEX, cr11);
+
+	return waslocked;
+}
+
+static inline void
+nv_lock_vga_crtc_shadow(struct drm_device *dev, int head, int lock)
+{
+	/* shadow lock: connects 0x60?3d? regs to "real" 0x3d? regs
+	 * bit7: unlocks HDT, HBS, HBE, HRS, HRE, HEB
+	 * bit6: seems to have some effect on CR09 (double scan, VBS_9)
+	 * bit5: unlocks HDE
+	 * bit4: unlocks VDE
+	 * bit3: unlocks VDT, OVL, VRS, ?VRE?, VBS, VBE, LSR, EBR
+	 * bit2: same as bit 1 of 0x60?804
+	 * bit0: same as bit 0 of 0x60?804
+	 */
+
+	uint8_t cr21 = lock;
+
+	if (lock < 0)
+		/* 0xfa is generic "unlock all" mask */
+		cr21 = NVReadVgaCrtc(dev, head, NV_CIO_CRE_21) | 0xfa;
+
+	NVWriteVgaCrtc(dev, head, NV_CIO_CRE_21, cr21);
+}
+
+/* renders the extended crtc regs (cr19+) on all crtcs impervious:
+ * immutable and unreadable
+ */
+static inline bool
+NVLockVgaCrtcs(struct drm_device *dev, bool lock)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	bool waslocked = !NVReadVgaCrtc(dev, 0, NV_CIO_SR_LOCK_INDEX);
+
+	NVWriteVgaCrtc(dev, 0, NV_CIO_SR_LOCK_INDEX,
+		       lock ? NV_CIO_SR_LOCK_VALUE : NV_CIO_SR_UNLOCK_RW_VALUE);
+	/* NV11 has independently lockable extended crtcs, except when tied */
+	if (dev_priv->chipset == 0x11 && !nv_heads_tied(dev))
+		NVWriteVgaCrtc(dev, 1, NV_CIO_SR_LOCK_INDEX,
+			       lock ? NV_CIO_SR_LOCK_VALUE :
+				      NV_CIO_SR_UNLOCK_RW_VALUE);
+
+	return waslocked;
+}
+
+/* nv04 cursor max dimensions of 32x32 (A1R5G5B5) */
+#define NV04_CURSOR_SIZE 32
+/* limit nv10 cursors to 64x64 (ARGB8) (we could go to 64x255) */
+#define NV10_CURSOR_SIZE 64
+
+static inline int nv_cursor_width(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+
+	return dev_priv->card_type >= NV_10 ? NV10_CURSOR_SIZE : NV04_CURSOR_SIZE;
+}
+
+static inline void
+nv_fix_nv40_hw_cursor(struct drm_device *dev, int head)
+{
+	/* on some nv40 (such as the "true" (in the NV_PFB_BOOT_0 sense) nv40,
+	 * the gf6800gt) a hardware bug requires a write to PRAMDAC_CURSOR_POS
+	 * for changes to the CRTC CURCTL regs to take effect, whether changing
+	 * the pixmap location, or just showing/hiding the cursor
+	 */
+	uint32_t curpos = NVReadRAMDAC(dev, head, NV_PRAMDAC_CU_START_POS);
+	NVWriteRAMDAC(dev, head, NV_PRAMDAC_CU_START_POS, curpos);
+}
+
+static inline void
+nv_show_cursor(struct drm_device *dev, int head, bool show)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	uint8_t *curctl1 =
+		&dev_priv->mode_reg.crtc_reg[head].CRTC[NV_CIO_CRE_HCUR_ADDR1_INDEX];
+
+	if (show)
+		*curctl1 |= MASK(NV_CIO_CRE_HCUR_ADDR1_ENABLE);
+	else
+		*curctl1 &= ~MASK(NV_CIO_CRE_HCUR_ADDR1_ENABLE);
+	NVWriteVgaCrtc(dev, head, NV_CIO_CRE_HCUR_ADDR1_INDEX, *curctl1);
+
+	if (dev_priv->card_type == NV_40)
+		nv_fix_nv40_hw_cursor(dev, head);
+}
+
+static inline uint32_t
+nv_pitch_align(struct drm_device *dev, uint32_t width, int bpp)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	int mask;
+
+	if (bpp == 15)
+		bpp = 16;
+	if (bpp == 24)
+		bpp = 8;
+
+	/* Alignment requirements taken from the Haiku driver */
+	if (dev_priv->card_type == NV_04)
+		mask = 128 / bpp - 1;
+	else
+		mask = 512 / bpp - 1;
+
+	return (width + mask) & ~mask;
+}
+
+#endif	/* __NOUVEAU_HW_H__ */
diff --git a/drivers/gpu/drm/nouveau/nouveau_i2c.c b/drivers/gpu/drm/nouveau/nouveau_i2c.c
new file mode 100644
index 000000000000..70e994d28122
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nouveau_i2c.c
@@ -0,0 +1,269 @@
+/*
+ * Copyright 2009 Red Hat Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * Authors: Ben Skeggs
+ */
+
+#include "drmP.h"
+#include "nouveau_drv.h"
+#include "nouveau_i2c.h"
+#include "nouveau_hw.h"
+
+static void
+nv04_i2c_setscl(void *data, int state)
+{
+	struct nouveau_i2c_chan *i2c = data;
+	struct drm_device *dev = i2c->dev;
+	uint8_t val;
+
+	val = (NVReadVgaCrtc(dev, 0, i2c->wr) & 0xd0) | (state ? 0x20 : 0);
+	NVWriteVgaCrtc(dev, 0, i2c->wr, val | 0x01);
+}
+
+static void
+nv04_i2c_setsda(void *data, int state)
+{
+	struct nouveau_i2c_chan *i2c = data;
+	struct drm_device *dev = i2c->dev;
+	uint8_t val;
+
+	val = (NVReadVgaCrtc(dev, 0, i2c->wr) & 0xe0) | (state ? 0x10 : 0);
+	NVWriteVgaCrtc(dev, 0, i2c->wr, val | 0x01);
+}
+
+static int
+nv04_i2c_getscl(void *data)
+{
+	struct nouveau_i2c_chan *i2c = data;
+	struct drm_device *dev = i2c->dev;
+
+	return !!(NVReadVgaCrtc(dev, 0, i2c->rd) & 4);
+}
+
+static int
+nv04_i2c_getsda(void *data)
+{
+	struct nouveau_i2c_chan *i2c = data;
+	struct drm_device *dev = i2c->dev;
+
+	return !!(NVReadVgaCrtc(dev, 0, i2c->rd) & 8);
+}
+
+static void
+nv4e_i2c_setscl(void *data, int state)
+{
+	struct nouveau_i2c_chan *i2c = data;
+	struct drm_device *dev = i2c->dev;
+	uint8_t val;
+
+	val = (nv_rd32(dev, i2c->wr) & 0xd0) | (state ? 0x20 : 0);
+	nv_wr32(dev, i2c->wr, val | 0x01);
+}
+
+static void
+nv4e_i2c_setsda(void *data, int state)
+{
+	struct nouveau_i2c_chan *i2c = data;
+	struct drm_device *dev = i2c->dev;
+	uint8_t val;
+
+	val = (nv_rd32(dev, i2c->wr) & 0xe0) | (state ? 0x10 : 0);
+	nv_wr32(dev, i2c->wr, val | 0x01);
+}
+
+static int
+nv4e_i2c_getscl(void *data)
+{
+	struct nouveau_i2c_chan *i2c = data;
+	struct drm_device *dev = i2c->dev;
+
+	return !!((nv_rd32(dev, i2c->rd) >> 16) & 4);
+}
+
+static int
+nv4e_i2c_getsda(void *data)
+{
+	struct nouveau_i2c_chan *i2c = data;
+	struct drm_device *dev = i2c->dev;
+
+	return !!((nv_rd32(dev, i2c->rd) >> 16) & 8);
+}
+
+static int
+nv50_i2c_getscl(void *data)
+{
+	struct nouveau_i2c_chan *i2c = data;
+	struct drm_device *dev = i2c->dev;
+
+	return !!(nv_rd32(dev, i2c->rd) & 1);
+}
+
+
+static int
+nv50_i2c_getsda(void *data)
+{
+	struct nouveau_i2c_chan *i2c = data;
+	struct drm_device *dev = i2c->dev;
+
+	return !!(nv_rd32(dev, i2c->rd) & 2);
+}
+
+static void
+nv50_i2c_setscl(void *data, int state)
+{
+	struct nouveau_i2c_chan *i2c = data;
+	struct drm_device *dev = i2c->dev;
+
+	nv_wr32(dev, i2c->wr, 4 | (i2c->data ? 2 : 0) | (state ? 1 : 0));
+}
+
+static void
+nv50_i2c_setsda(void *data, int state)
+{
+	struct nouveau_i2c_chan *i2c = data;
+	struct drm_device *dev = i2c->dev;
+
+	nv_wr32(dev, i2c->wr,
+			(nv_rd32(dev, i2c->rd) & 1) | 4 | (state ? 2 : 0));
+	i2c->data = state;
+}
+
+static const uint32_t nv50_i2c_port[] = {
+	0x00e138, 0x00e150, 0x00e168, 0x00e180,
+	0x00e254, 0x00e274, 0x00e764, 0x00e780,
+	0x00e79c, 0x00e7b8
+};
+#define NV50_I2C_PORTS ARRAY_SIZE(nv50_i2c_port)
+
+int
+nouveau_i2c_init(struct drm_device *dev, struct dcb_i2c_entry *entry, int index)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_i2c_chan *i2c;
+	int ret;
+
+	if (entry->chan)
+		return -EEXIST;
+
+	if (dev_priv->card_type == NV_50 && entry->read >= NV50_I2C_PORTS) {
+		NV_ERROR(dev, "unknown i2c port %d\n", entry->read);
+		return -EINVAL;
+	}
+
+	i2c = kzalloc(sizeof(*i2c), GFP_KERNEL);
+	if (i2c == NULL)
+		return -ENOMEM;
+
+	switch (entry->port_type) {
+	case 0:
+		i2c->algo.bit.setsda = nv04_i2c_setsda;
+		i2c->algo.bit.setscl = nv04_i2c_setscl;
+		i2c->algo.bit.getsda = nv04_i2c_getsda;
+		i2c->algo.bit.getscl = nv04_i2c_getscl;
+		i2c->rd = entry->read;
+		i2c->wr = entry->write;
+		break;
+	case 4:
+		i2c->algo.bit.setsda = nv4e_i2c_setsda;
+		i2c->algo.bit.setscl = nv4e_i2c_setscl;
+		i2c->algo.bit.getsda = nv4e_i2c_getsda;
+		i2c->algo.bit.getscl = nv4e_i2c_getscl;
+		i2c->rd = 0x600800 + entry->read;
+		i2c->wr = 0x600800 + entry->write;
+		break;
+	case 5:
+		i2c->algo.bit.setsda = nv50_i2c_setsda;
+		i2c->algo.bit.setscl = nv50_i2c_setscl;
+		i2c->algo.bit.getsda = nv50_i2c_getsda;
+		i2c->algo.bit.getscl = nv50_i2c_getscl;
+		i2c->rd = nv50_i2c_port[entry->read];
+		i2c->wr = i2c->rd;
+		break;
+	case 6:
+		i2c->rd = entry->read;
+		i2c->wr = entry->write;
+		break;
+	default:
+		NV_ERROR(dev, "DCB I2C port type %d unknown\n",
+			 entry->port_type);
+		kfree(i2c);
+		return -EINVAL;
+	}
+
+	snprintf(i2c->adapter.name, sizeof(i2c->adapter.name),
+		 "nouveau-%s-%d", pci_name(dev->pdev), index);
+	i2c->adapter.owner = THIS_MODULE;
+	i2c->adapter.dev.parent = &dev->pdev->dev;
+	i2c->dev = dev;
+	i2c_set_adapdata(&i2c->adapter, i2c);
+
+	if (entry->port_type < 6) {
+		i2c->adapter.algo_data = &i2c->algo.bit;
+		i2c->algo.bit.udelay = 40;
+		i2c->algo.bit.timeout = usecs_to_jiffies(5000);
+		i2c->algo.bit.data = i2c;
+		ret = i2c_bit_add_bus(&i2c->adapter);
+	} else {
+		i2c->adapter.algo_data = &i2c->algo.dp;
+		i2c->algo.dp.running = false;
+		i2c->algo.dp.address = 0;
+		i2c->algo.dp.aux_ch = nouveau_dp_i2c_aux_ch;
+		ret = i2c_dp_aux_add_bus(&i2c->adapter);
+	}
+
+	if (ret) {
+		NV_ERROR(dev, "Failed to register i2c %d\n", index);
+		kfree(i2c);
+		return ret;
+	}
+
+	entry->chan = i2c;
+	return 0;
+}
+
+void
+nouveau_i2c_fini(struct drm_device *dev, struct dcb_i2c_entry *entry)
+{
+	if (!entry->chan)
+		return;
+
+	i2c_del_adapter(&entry->chan->adapter);
+	kfree(entry->chan);
+	entry->chan = NULL;
+}
+
+struct nouveau_i2c_chan *
+nouveau_i2c_find(struct drm_device *dev, int index)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nvbios *bios = &dev_priv->VBIOS;
+
+	if (index > DCB_MAX_NUM_I2C_ENTRIES)
+		return NULL;
+
+	if (!bios->bdcb.dcb.i2c[index].chan) {
+		if (nouveau_i2c_init(dev, &bios->bdcb.dcb.i2c[index], index))
+			return NULL;
+	}
+
+	return bios->bdcb.dcb.i2c[index].chan;
+}
+
diff --git a/drivers/gpu/drm/nouveau/nouveau_i2c.h b/drivers/gpu/drm/nouveau/nouveau_i2c.h
new file mode 100644
index 000000000000..c8eaf7a9fcbb
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nouveau_i2c.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright 2009 Red Hat Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#ifndef __NOUVEAU_I2C_H__
+#define __NOUVEAU_I2C_H__
+
+#include <linux/i2c.h>
+#include <linux/i2c-id.h>
+#include <linux/i2c-algo-bit.h>
+#include "drm_dp_helper.h"
+
+struct dcb_i2c_entry;
+
+struct nouveau_i2c_chan {
+	struct i2c_adapter adapter;
+	struct drm_device *dev;
+	union {
+		struct i2c_algo_bit_data bit;
+		struct i2c_algo_dp_aux_data dp;
+	} algo;
+	unsigned rd;
+	unsigned wr;
+	unsigned data;
+};
+
+int nouveau_i2c_init(struct drm_device *, struct dcb_i2c_entry *, int index);
+void nouveau_i2c_fini(struct drm_device *, struct dcb_i2c_entry *);
+struct nouveau_i2c_chan *nouveau_i2c_find(struct drm_device *, int index);
+
+int nouveau_dp_i2c_aux_ch(struct i2c_adapter *, int mode, uint8_t write_byte,
+			  uint8_t *read_byte);
+
+#endif /* __NOUVEAU_I2C_H__ */
diff --git a/drivers/gpu/drm/nouveau/nouveau_ioc32.c b/drivers/gpu/drm/nouveau/nouveau_ioc32.c
new file mode 100644
index 000000000000..475ba810bba3
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nouveau_ioc32.c
@@ -0,0 +1,70 @@
+/**
+ * \file mga_ioc32.c
+ *
+ * 32-bit ioctl compatibility routines for the MGA DRM.
+ *
+ * \author Dave Airlie <airlied@linux.ie> with code from patches by Egbert Eich
+ *
+ *
+ * Copyright (C) Paul Mackerras 2005
+ * Copyright (C) Egbert Eich 2003,2004
+ * Copyright (C) Dave Airlie 2005
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHOR BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+ * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
+ * IN THE SOFTWARE.
+ */
+
+#include <linux/compat.h>
+
+#include "drmP.h"
+#include "drm.h"
+
+#include "nouveau_drv.h"
+
+/**
+ * Called whenever a 32-bit process running under a 64-bit kernel
+ * performs an ioctl on /dev/dri/card<n>.
+ *
+ * \param filp file pointer.
+ * \param cmd command.
+ * \param arg user argument.
+ * \return zero on success or negative number on failure.
+ */
+long nouveau_compat_ioctl(struct file *filp, unsigned int cmd,
+			 unsigned long arg)
+{
+	unsigned int nr = DRM_IOCTL_NR(cmd);
+	drm_ioctl_compat_t *fn = NULL;
+	int ret;
+
+	if (nr < DRM_COMMAND_BASE)
+		return drm_compat_ioctl(filp, cmd, arg);
+
+#if 0
+	if (nr < DRM_COMMAND_BASE + DRM_ARRAY_SIZE(mga_compat_ioctls))
+		fn = nouveau_compat_ioctls[nr - DRM_COMMAND_BASE];
+#endif
+	if (fn != NULL)
+		ret = (*fn)(filp, cmd, arg);
+	else
+		ret = drm_ioctl(filp, cmd, arg);
+
+	return ret;
+}
diff --git a/drivers/gpu/drm/nouveau/nouveau_irq.c b/drivers/gpu/drm/nouveau/nouveau_irq.c
new file mode 100644
index 000000000000..919a619ca7fa
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nouveau_irq.c
@@ -0,0 +1,703 @@
+/*
+ * Copyright (C) 2006 Ben Skeggs.
+ *
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial
+ * portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE COPYRIGHT OWNER(S) AND/OR ITS SUPPLIERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
+/*
+ * Authors:
+ *   Ben Skeggs <darktama@iinet.net.au>
+ */
+
+#include "drmP.h"
+#include "drm.h"
+#include "nouveau_drm.h"
+#include "nouveau_drv.h"
+#include "nouveau_reg.h"
+#include <linux/ratelimit.h>
+
+/* needed for hotplug irq */
+#include "nouveau_connector.h"
+#include "nv50_display.h"
+
+void
+nouveau_irq_preinstall(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+
+	/* Master disable */
+	nv_wr32(dev, NV03_PMC_INTR_EN_0, 0);
+
+	if (dev_priv->card_type == NV_50) {
+		INIT_WORK(&dev_priv->irq_work, nv50_display_irq_handler_bh);
+		INIT_LIST_HEAD(&dev_priv->vbl_waiting);
+	}
+}
+
+int
+nouveau_irq_postinstall(struct drm_device *dev)
+{
+	/* Master enable */
+	nv_wr32(dev, NV03_PMC_INTR_EN_0, NV_PMC_INTR_EN_0_MASTER_ENABLE);
+	return 0;
+}
+
+void
+nouveau_irq_uninstall(struct drm_device *dev)
+{
+	/* Master disable */
+	nv_wr32(dev, NV03_PMC_INTR_EN_0, 0);
+}
+
+static int
+nouveau_call_method(struct nouveau_channel *chan, int class, int mthd, int data)
+{
+	struct drm_nouveau_private *dev_priv = chan->dev->dev_private;
+	struct nouveau_pgraph_object_method *grm;
+	struct nouveau_pgraph_object_class *grc;
+
+	grc = dev_priv->engine.graph.grclass;
+	while (grc->id) {
+		if (grc->id == class)
+			break;
+		grc++;
+	}
+
+	if (grc->id != class || !grc->methods)
+		return -ENOENT;
+
+	grm = grc->methods;
+	while (grm->id) {
+		if (grm->id == mthd)
+			return grm->exec(chan, class, mthd, data);
+		grm++;
+	}
+
+	return -ENOENT;
+}
+
+static bool
+nouveau_fifo_swmthd(struct nouveau_channel *chan, uint32_t addr, uint32_t data)
+{
+	struct drm_device *dev = chan->dev;
+	const int subc = (addr >> 13) & 0x7;
+	const int mthd = addr & 0x1ffc;
+
+	if (mthd == 0x0000) {
+		struct nouveau_gpuobj_ref *ref = NULL;
+
+		if (nouveau_gpuobj_ref_find(chan, data, &ref))
+			return false;
+
+		if (ref->gpuobj->engine != NVOBJ_ENGINE_SW)
+			return false;
+
+		chan->sw_subchannel[subc] = ref->gpuobj->class;
+		nv_wr32(dev, NV04_PFIFO_CACHE1_ENGINE, nv_rd32(dev,
+			NV04_PFIFO_CACHE1_ENGINE) & ~(0xf << subc * 4));
+		return true;
+	}
+
+	/* hw object */
+	if (nv_rd32(dev, NV04_PFIFO_CACHE1_ENGINE) & (1 << (subc*4)))
+		return false;
+
+	if (nouveau_call_method(chan, chan->sw_subchannel[subc], mthd, data))
+		return false;
+
+	return true;
+}
+
+static void
+nouveau_fifo_irq_handler(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_engine *engine = &dev_priv->engine;
+	uint32_t status, reassign;
+	int cnt = 0;
+
+	reassign = nv_rd32(dev, NV03_PFIFO_CACHES) & 1;
+	while ((status = nv_rd32(dev, NV03_PFIFO_INTR_0)) && (cnt++ < 100)) {
+		struct nouveau_channel *chan = NULL;
+		uint32_t chid, get;
+
+		nv_wr32(dev, NV03_PFIFO_CACHES, 0);
+
+		chid = engine->fifo.channel_id(dev);
+		if (chid >= 0 && chid < engine->fifo.channels)
+			chan = dev_priv->fifos[chid];
+		get  = nv_rd32(dev, NV03_PFIFO_CACHE1_GET);
+
+		if (status & NV_PFIFO_INTR_CACHE_ERROR) {
+			uint32_t mthd, data;
+			int ptr;
+
+			/* NV_PFIFO_CACHE1_GET actually goes to 0xffc before
+			 * wrapping on my G80 chips, but CACHE1 isn't big
+			 * enough for this much data.. Tests show that it
+			 * wraps around to the start at GET=0x800.. No clue
+			 * as to why..
+			 */
+			ptr = (get & 0x7ff) >> 2;
+
+			if (dev_priv->card_type < NV_40) {
+				mthd = nv_rd32(dev,
+					NV04_PFIFO_CACHE1_METHOD(ptr));
+				data = nv_rd32(dev,
+					NV04_PFIFO_CACHE1_DATA(ptr));
+			} else {
+				mthd = nv_rd32(dev,
+					NV40_PFIFO_CACHE1_METHOD(ptr));
+				data = nv_rd32(dev,
+					NV40_PFIFO_CACHE1_DATA(ptr));
+			}
+
+			if (!chan || !nouveau_fifo_swmthd(chan, mthd, data)) {
+				NV_INFO(dev, "PFIFO_CACHE_ERROR - Ch %d/%d "
+					     "Mthd 0x%04x Data 0x%08x\n",
+					chid, (mthd >> 13) & 7, mthd & 0x1ffc,
+					data);
+			}
+
+			nv_wr32(dev, NV04_PFIFO_CACHE1_DMA_PUSH, 0);
+			nv_wr32(dev, NV03_PFIFO_INTR_0,
+						NV_PFIFO_INTR_CACHE_ERROR);
+
+			nv_wr32(dev, NV03_PFIFO_CACHE1_PUSH0,
+				nv_rd32(dev, NV03_PFIFO_CACHE1_PUSH0) & ~1);
+			nv_wr32(dev, NV03_PFIFO_CACHE1_GET, get + 4);
+			nv_wr32(dev, NV03_PFIFO_CACHE1_PUSH0,
+				nv_rd32(dev, NV03_PFIFO_CACHE1_PUSH0) | 1);
+			nv_wr32(dev, NV04_PFIFO_CACHE1_HASH, 0);
+
+			nv_wr32(dev, NV04_PFIFO_CACHE1_DMA_PUSH,
+				nv_rd32(dev, NV04_PFIFO_CACHE1_DMA_PUSH) | 1);
+			nv_wr32(dev, NV04_PFIFO_CACHE1_PULL0, 1);
+
+			status &= ~NV_PFIFO_INTR_CACHE_ERROR;
+		}
+
+		if (status & NV_PFIFO_INTR_DMA_PUSHER) {
+			NV_INFO(dev, "PFIFO_DMA_PUSHER - Ch %d\n", chid);
+
+			status &= ~NV_PFIFO_INTR_DMA_PUSHER;
+			nv_wr32(dev, NV03_PFIFO_INTR_0,
+						NV_PFIFO_INTR_DMA_PUSHER);
+
+			nv_wr32(dev, NV04_PFIFO_CACHE1_DMA_STATE, 0x00000000);
+			if (nv_rd32(dev, NV04_PFIFO_CACHE1_DMA_PUT) != get)
+				nv_wr32(dev, NV04_PFIFO_CACHE1_DMA_GET,
+								get + 4);
+		}
+
+		if (status) {
+			NV_INFO(dev, "PFIFO_INTR 0x%08x - Ch %d\n",
+				status, chid);
+			nv_wr32(dev, NV03_PFIFO_INTR_0, status);
+			status = 0;
+		}
+
+		nv_wr32(dev, NV03_PFIFO_CACHES, reassign);
+	}
+
+	if (status) {
+		NV_INFO(dev, "PFIFO still angry after %d spins, halt\n", cnt);
+		nv_wr32(dev, 0x2140, 0);
+		nv_wr32(dev, 0x140, 0);
+	}
+
+	nv_wr32(dev, NV03_PMC_INTR_0, NV_PMC_INTR_0_PFIFO_PENDING);
+}
+
+struct nouveau_bitfield_names {
+	uint32_t mask;
+	const char *name;
+};
+
+static struct nouveau_bitfield_names nstatus_names[] =
+{
+	{ NV04_PGRAPH_NSTATUS_STATE_IN_USE,       "STATE_IN_USE" },
+	{ NV04_PGRAPH_NSTATUS_INVALID_STATE,      "INVALID_STATE" },
+	{ NV04_PGRAPH_NSTATUS_BAD_ARGUMENT,       "BAD_ARGUMENT" },
+	{ NV04_PGRAPH_NSTATUS_PROTECTION_FAULT,   "PROTECTION_FAULT" }
+};
+
+static struct nouveau_bitfield_names nstatus_names_nv10[] =
+{
+	{ NV10_PGRAPH_NSTATUS_STATE_IN_USE,       "STATE_IN_USE" },
+	{ NV10_PGRAPH_NSTATUS_INVALID_STATE,      "INVALID_STATE" },
+	{ NV10_PGRAPH_NSTATUS_BAD_ARGUMENT,       "BAD_ARGUMENT" },
+	{ NV10_PGRAPH_NSTATUS_PROTECTION_FAULT,   "PROTECTION_FAULT" }
+};
+
+static struct nouveau_bitfield_names nsource_names[] =
+{
+	{ NV03_PGRAPH_NSOURCE_NOTIFICATION,       "NOTIFICATION" },
+	{ NV03_PGRAPH_NSOURCE_DATA_ERROR,         "DATA_ERROR" },
+	{ NV03_PGRAPH_NSOURCE_PROTECTION_ERROR,   "PROTECTION_ERROR" },
+	{ NV03_PGRAPH_NSOURCE_RANGE_EXCEPTION,    "RANGE_EXCEPTION" },
+	{ NV03_PGRAPH_NSOURCE_LIMIT_COLOR,        "LIMIT_COLOR" },
+	{ NV03_PGRAPH_NSOURCE_LIMIT_ZETA,         "LIMIT_ZETA" },
+	{ NV03_PGRAPH_NSOURCE_ILLEGAL_MTHD,       "ILLEGAL_MTHD" },
+	{ NV03_PGRAPH_NSOURCE_DMA_R_PROTECTION,   "DMA_R_PROTECTION" },
+	{ NV03_PGRAPH_NSOURCE_DMA_W_PROTECTION,   "DMA_W_PROTECTION" },
+	{ NV03_PGRAPH_NSOURCE_FORMAT_EXCEPTION,   "FORMAT_EXCEPTION" },
+	{ NV03_PGRAPH_NSOURCE_PATCH_EXCEPTION,    "PATCH_EXCEPTION" },
+	{ NV03_PGRAPH_NSOURCE_STATE_INVALID,      "STATE_INVALID" },
+	{ NV03_PGRAPH_NSOURCE_DOUBLE_NOTIFY,      "DOUBLE_NOTIFY" },
+	{ NV03_PGRAPH_NSOURCE_NOTIFY_IN_USE,      "NOTIFY_IN_USE" },
+	{ NV03_PGRAPH_NSOURCE_METHOD_CNT,         "METHOD_CNT" },
+	{ NV03_PGRAPH_NSOURCE_BFR_NOTIFICATION,   "BFR_NOTIFICATION" },
+	{ NV03_PGRAPH_NSOURCE_DMA_VTX_PROTECTION, "DMA_VTX_PROTECTION" },
+	{ NV03_PGRAPH_NSOURCE_DMA_WIDTH_A,        "DMA_WIDTH_A" },
+	{ NV03_PGRAPH_NSOURCE_DMA_WIDTH_B,        "DMA_WIDTH_B" },
+};
+
+static void
+nouveau_print_bitfield_names_(uint32_t value,
+				const struct nouveau_bitfield_names *namelist,
+				const int namelist_len)
+{
+	/*
+	 * Caller must have already printed the KERN_* log level for us.
+	 * Also the caller is responsible for adding the newline.
+	 */
+	int i;
+	for (i = 0; i < namelist_len; ++i) {
+		uint32_t mask = namelist[i].mask;
+		if (value & mask) {
+			printk(" %s", namelist[i].name);
+			value &= ~mask;
+		}
+	}
+	if (value)
+		printk(" (unknown bits 0x%08x)", value);
+}
+#define nouveau_print_bitfield_names(val, namelist) \
+	nouveau_print_bitfield_names_((val), (namelist), ARRAY_SIZE(namelist))
+
+
+static int
+nouveau_graph_chid_from_grctx(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	uint32_t inst;
+	int i;
+
+	if (dev_priv->card_type < NV_40)
+		return dev_priv->engine.fifo.channels;
+	else
+	if (dev_priv->card_type < NV_50) {
+		inst = (nv_rd32(dev, 0x40032c) & 0xfffff) << 4;
+
+		for (i = 0; i < dev_priv->engine.fifo.channels; i++) {
+			struct nouveau_channel *chan = dev_priv->fifos[i];
+
+			if (!chan || !chan->ramin_grctx)
+				continue;
+
+			if (inst == chan->ramin_grctx->instance)
+				break;
+		}
+	} else {
+		inst = (nv_rd32(dev, 0x40032c) & 0xfffff) << 12;
+
+		for (i = 0; i < dev_priv->engine.fifo.channels; i++) {
+			struct nouveau_channel *chan = dev_priv->fifos[i];
+
+			if (!chan || !chan->ramin)
+				continue;
+
+			if (inst == chan->ramin->instance)
+				break;
+		}
+	}
+
+
+	return i;
+}
+
+static int
+nouveau_graph_trapped_channel(struct drm_device *dev, int *channel_ret)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_engine *engine = &dev_priv->engine;
+	int channel;
+
+	if (dev_priv->card_type < NV_10)
+		channel = (nv_rd32(dev, NV04_PGRAPH_TRAPPED_ADDR) >> 24) & 0xf;
+	else
+	if (dev_priv->card_type < NV_40)
+		channel = (nv_rd32(dev, NV04_PGRAPH_TRAPPED_ADDR) >> 20) & 0x1f;
+	else
+		channel = nouveau_graph_chid_from_grctx(dev);
+
+	if (channel >= engine->fifo.channels || !dev_priv->fifos[channel]) {
+		NV_ERROR(dev, "AIII, invalid/inactive channel id %d\n", channel);
+		return -EINVAL;
+	}
+
+	*channel_ret = channel;
+	return 0;
+}
+
+struct nouveau_pgraph_trap {
+	int channel;
+	int class;
+	int subc, mthd, size;
+	uint32_t data, data2;
+	uint32_t nsource, nstatus;
+};
+
+static void
+nouveau_graph_trap_info(struct drm_device *dev,
+			struct nouveau_pgraph_trap *trap)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	uint32_t address;
+
+	trap->nsource = trap->nstatus = 0;
+	if (dev_priv->card_type < NV_50) {
+		trap->nsource = nv_rd32(dev, NV03_PGRAPH_NSOURCE);
+		trap->nstatus = nv_rd32(dev, NV03_PGRAPH_NSTATUS);
+	}
+
+	if (nouveau_graph_trapped_channel(dev, &trap->channel))
+		trap->channel = -1;
+	address = nv_rd32(dev, NV04_PGRAPH_TRAPPED_ADDR);
+
+	trap->mthd = address & 0x1FFC;
+	trap->data = nv_rd32(dev, NV04_PGRAPH_TRAPPED_DATA);
+	if (dev_priv->card_type < NV_10) {
+		trap->subc  = (address >> 13) & 0x7;
+	} else {
+		trap->subc  = (address >> 16) & 0x7;
+		trap->data2 = nv_rd32(dev, NV10_PGRAPH_TRAPPED_DATA_HIGH);
+	}
+
+	if (dev_priv->card_type < NV_10)
+		trap->class = nv_rd32(dev, 0x400180 + trap->subc*4) & 0xFF;
+	else if (dev_priv->card_type < NV_40)
+		trap->class = nv_rd32(dev, 0x400160 + trap->subc*4) & 0xFFF;
+	else if (dev_priv->card_type < NV_50)
+		trap->class = nv_rd32(dev, 0x400160 + trap->subc*4) & 0xFFFF;
+	else
+		trap->class = nv_rd32(dev, 0x400814);
+}
+
+static void
+nouveau_graph_dump_trap_info(struct drm_device *dev, const char *id,
+			     struct nouveau_pgraph_trap *trap)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	uint32_t nsource = trap->nsource, nstatus = trap->nstatus;
+
+	NV_INFO(dev, "%s - nSource:", id);
+	nouveau_print_bitfield_names(nsource, nsource_names);
+	printk(", nStatus:");
+	if (dev_priv->card_type < NV_10)
+		nouveau_print_bitfield_names(nstatus, nstatus_names);
+	else
+		nouveau_print_bitfield_names(nstatus, nstatus_names_nv10);
+	printk("\n");
+
+	NV_INFO(dev, "%s - Ch %d/%d Class 0x%04x Mthd 0x%04x "
+					"Data 0x%08x:0x%08x\n",
+					id, trap->channel, trap->subc,
+					trap->class, trap->mthd,
+					trap->data2, trap->data);
+}
+
+static int
+nouveau_pgraph_intr_swmthd(struct drm_device *dev,
+			   struct nouveau_pgraph_trap *trap)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+
+	if (trap->channel < 0 ||
+	    trap->channel >= dev_priv->engine.fifo.channels ||
+	    !dev_priv->fifos[trap->channel])
+		return -ENODEV;
+
+	return nouveau_call_method(dev_priv->fifos[trap->channel],
+				   trap->class, trap->mthd, trap->data);
+}
+
+static inline void
+nouveau_pgraph_intr_notify(struct drm_device *dev, uint32_t nsource)
+{
+	struct nouveau_pgraph_trap trap;
+	int unhandled = 0;
+
+	nouveau_graph_trap_info(dev, &trap);
+
+	if (nsource & NV03_PGRAPH_NSOURCE_ILLEGAL_MTHD) {
+		if (nouveau_pgraph_intr_swmthd(dev, &trap))
+			unhandled = 1;
+	} else {
+		unhandled = 1;
+	}
+
+	if (unhandled)
+		nouveau_graph_dump_trap_info(dev, "PGRAPH_NOTIFY", &trap);
+}
+
+static DEFINE_RATELIMIT_STATE(nouveau_ratelimit_state, 3 * HZ, 20);
+
+static int nouveau_ratelimit(void)
+{
+	return __ratelimit(&nouveau_ratelimit_state);
+}
+
+
+static inline void
+nouveau_pgraph_intr_error(struct drm_device *dev, uint32_t nsource)
+{
+	struct nouveau_pgraph_trap trap;
+	int unhandled = 0;
+
+	nouveau_graph_trap_info(dev, &trap);
+	trap.nsource = nsource;
+
+	if (nsource & NV03_PGRAPH_NSOURCE_ILLEGAL_MTHD) {
+		if (nouveau_pgraph_intr_swmthd(dev, &trap))
+			unhandled = 1;
+	} else {
+		unhandled = 1;
+	}
+
+	if (unhandled && nouveau_ratelimit())
+		nouveau_graph_dump_trap_info(dev, "PGRAPH_ERROR", &trap);
+}
+
+static inline void
+nouveau_pgraph_intr_context_switch(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_engine *engine = &dev_priv->engine;
+	uint32_t chid;
+
+	chid = engine->fifo.channel_id(dev);
+	NV_DEBUG(dev, "PGRAPH context switch interrupt channel %x\n", chid);
+
+	switch (dev_priv->card_type) {
+	case NV_04:
+		nv04_graph_context_switch(dev);
+		break;
+	case NV_10:
+		nv10_graph_context_switch(dev);
+		break;
+	default:
+		NV_ERROR(dev, "Context switch not implemented\n");
+		break;
+	}
+}
+
+static void
+nouveau_pgraph_irq_handler(struct drm_device *dev)
+{
+	uint32_t status;
+
+	while ((status = nv_rd32(dev, NV03_PGRAPH_INTR))) {
+		uint32_t nsource = nv_rd32(dev, NV03_PGRAPH_NSOURCE);
+
+		if (status & NV_PGRAPH_INTR_NOTIFY) {
+			nouveau_pgraph_intr_notify(dev, nsource);
+
+			status &= ~NV_PGRAPH_INTR_NOTIFY;
+			nv_wr32(dev, NV03_PGRAPH_INTR, NV_PGRAPH_INTR_NOTIFY);
+		}
+
+		if (status & NV_PGRAPH_INTR_ERROR) {
+			nouveau_pgraph_intr_error(dev, nsource);
+
+			status &= ~NV_PGRAPH_INTR_ERROR;
+			nv_wr32(dev, NV03_PGRAPH_INTR, NV_PGRAPH_INTR_ERROR);
+		}
+
+		if (status & NV_PGRAPH_INTR_CONTEXT_SWITCH) {
+			nouveau_pgraph_intr_context_switch(dev);
+
+			status &= ~NV_PGRAPH_INTR_CONTEXT_SWITCH;
+			nv_wr32(dev, NV03_PGRAPH_INTR,
+				 NV_PGRAPH_INTR_CONTEXT_SWITCH);
+		}
+
+		if (status) {
+			NV_INFO(dev, "Unhandled PGRAPH_INTR - 0x%08x\n", status);
+			nv_wr32(dev, NV03_PGRAPH_INTR, status);
+		}
+
+		if ((nv_rd32(dev, NV04_PGRAPH_FIFO) & (1 << 0)) == 0)
+			nv_wr32(dev, NV04_PGRAPH_FIFO, 1);
+	}
+
+	nv_wr32(dev, NV03_PMC_INTR_0, NV_PMC_INTR_0_PGRAPH_PENDING);
+}
+
+static void
+nv50_pgraph_irq_handler(struct drm_device *dev)
+{
+	uint32_t status, nsource;
+
+	status = nv_rd32(dev, NV03_PGRAPH_INTR);
+	nsource = nv_rd32(dev, NV03_PGRAPH_NSOURCE);
+
+	if (status & 0x00000001) {
+		nouveau_pgraph_intr_notify(dev, nsource);
+		status &= ~0x00000001;
+		nv_wr32(dev, NV03_PGRAPH_INTR, 0x00000001);
+	}
+
+	if (status & 0x00000010) {
+		nouveau_pgraph_intr_error(dev, nsource |
+					  NV03_PGRAPH_NSOURCE_ILLEGAL_MTHD);
+
+		status &= ~0x00000010;
+		nv_wr32(dev, NV03_PGRAPH_INTR, 0x00000010);
+	}
+
+	if (status & 0x00001000) {
+		nv_wr32(dev, 0x400500, 0x00000000);
+		nv_wr32(dev, NV03_PGRAPH_INTR, NV_PGRAPH_INTR_CONTEXT_SWITCH);
+		nv_wr32(dev, NV40_PGRAPH_INTR_EN, nv_rd32(dev,
+			NV40_PGRAPH_INTR_EN) & ~NV_PGRAPH_INTR_CONTEXT_SWITCH);
+		nv_wr32(dev, 0x400500, 0x00010001);
+
+		nv50_graph_context_switch(dev);
+
+		status &= ~NV_PGRAPH_INTR_CONTEXT_SWITCH;
+	}
+
+	if (status & 0x00100000) {
+		nouveau_pgraph_intr_error(dev, nsource |
+					  NV03_PGRAPH_NSOURCE_DATA_ERROR);
+
+		status &= ~0x00100000;
+		nv_wr32(dev, NV03_PGRAPH_INTR, 0x00100000);
+	}
+
+	if (status & 0x00200000) {
+		int r;
+
+		nouveau_pgraph_intr_error(dev, nsource |
+					  NV03_PGRAPH_NSOURCE_PROTECTION_ERROR);
+
+		NV_ERROR(dev, "magic set 1:\n");
+		for (r = 0x408900; r <= 0x408910; r += 4)
+			NV_ERROR(dev, "\t0x%08x: 0x%08x\n", r, nv_rd32(dev, r));
+		nv_wr32(dev, 0x408900, nv_rd32(dev, 0x408904) | 0xc0000000);
+		for (r = 0x408e08; r <= 0x408e24; r += 4)
+			NV_ERROR(dev, "\t0x%08x: 0x%08x\n", r, nv_rd32(dev, r));
+		nv_wr32(dev, 0x408e08, nv_rd32(dev, 0x408e08) | 0xc0000000);
+
+		NV_ERROR(dev, "magic set 2:\n");
+		for (r = 0x409900; r <= 0x409910; r += 4)
+			NV_ERROR(dev, "\t0x%08x: 0x%08x\n", r, nv_rd32(dev, r));
+		nv_wr32(dev, 0x409900, nv_rd32(dev, 0x409904) | 0xc0000000);
+		for (r = 0x409e08; r <= 0x409e24; r += 4)
+			NV_ERROR(dev, "\t0x%08x: 0x%08x\n", r, nv_rd32(dev, r));
+		nv_wr32(dev, 0x409e08, nv_rd32(dev, 0x409e08) | 0xc0000000);
+
+		status &= ~0x00200000;
+		nv_wr32(dev, NV03_PGRAPH_NSOURCE, nsource);
+		nv_wr32(dev, NV03_PGRAPH_INTR, 0x00200000);
+	}
+
+	if (status) {
+		NV_INFO(dev, "Unhandled PGRAPH_INTR - 0x%08x\n", status);
+		nv_wr32(dev, NV03_PGRAPH_INTR, status);
+	}
+
+	{
+		const int isb = (1 << 16) | (1 << 0);
+
+		if ((nv_rd32(dev, 0x400500) & isb) != isb)
+			nv_wr32(dev, 0x400500, nv_rd32(dev, 0x400500) | isb);
+		nv_wr32(dev, 0x400824, nv_rd32(dev, 0x400824) & ~(1 << 31));
+	}
+
+	nv_wr32(dev, NV03_PMC_INTR_0, NV_PMC_INTR_0_PGRAPH_PENDING);
+}
+
+static void
+nouveau_crtc_irq_handler(struct drm_device *dev, int crtc)
+{
+	if (crtc & 1)
+		nv_wr32(dev, NV_CRTC0_INTSTAT, NV_CRTC_INTR_VBLANK);
+
+	if (crtc & 2)
+		nv_wr32(dev, NV_CRTC1_INTSTAT, NV_CRTC_INTR_VBLANK);
+}
+
+irqreturn_t
+nouveau_irq_handler(DRM_IRQ_ARGS)
+{
+	struct drm_device *dev = (struct drm_device *)arg;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	uint32_t status, fbdev_flags = 0;
+
+	status = nv_rd32(dev, NV03_PMC_INTR_0);
+	if (!status)
+		return IRQ_NONE;
+
+	if (dev_priv->fbdev_info) {
+		fbdev_flags = dev_priv->fbdev_info->flags;
+		dev_priv->fbdev_info->flags |= FBINFO_HWACCEL_DISABLED;
+	}
+
+	if (status & NV_PMC_INTR_0_PFIFO_PENDING) {
+		nouveau_fifo_irq_handler(dev);
+		status &= ~NV_PMC_INTR_0_PFIFO_PENDING;
+	}
+
+	if (status & NV_PMC_INTR_0_PGRAPH_PENDING) {
+		if (dev_priv->card_type >= NV_50)
+			nv50_pgraph_irq_handler(dev);
+		else
+			nouveau_pgraph_irq_handler(dev);
+
+		status &= ~NV_PMC_INTR_0_PGRAPH_PENDING;
+	}
+
+	if (status & NV_PMC_INTR_0_CRTCn_PENDING) {
+		nouveau_crtc_irq_handler(dev, (status>>24)&3);
+		status &= ~NV_PMC_INTR_0_CRTCn_PENDING;
+	}
+
+	if (status & (NV_PMC_INTR_0_NV50_DISPLAY_PENDING |
+		      NV_PMC_INTR_0_NV50_I2C_PENDING)) {
+		nv50_display_irq_handler(dev);
+		status &= ~(NV_PMC_INTR_0_NV50_DISPLAY_PENDING |
+			    NV_PMC_INTR_0_NV50_I2C_PENDING);
+	}
+
+	if (status)
+		NV_ERROR(dev, "Unhandled PMC INTR status bits 0x%08x\n", status);
+
+	if (dev_priv->fbdev_info)
+		dev_priv->fbdev_info->flags = fbdev_flags;
+
+	return IRQ_HANDLED;
+}
diff --git a/drivers/gpu/drm/nouveau/nouveau_mem.c b/drivers/gpu/drm/nouveau/nouveau_mem.c
new file mode 100644
index 000000000000..fb9bdd6edf1f
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nouveau_mem.c
@@ -0,0 +1,659 @@
+/*
+ * Copyright (C) The Weather Channel, Inc.  2002.  All Rights Reserved.
+ * Copyright 2005 Stephane Marchesin
+ *
+ * The Weather Channel (TM) funded Tungsten Graphics to develop the
+ * initial release of the Radeon 8500 driver under the XFree86 license.
+ * This notice must be preserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS AND/OR THEIR SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ * Authors:
+ *    Keith Whitwell <keith@tungstengraphics.com>
+ */
+
+
+#include "drmP.h"
+#include "drm.h"
+#include "drm_sarea.h"
+#include "nouveau_drv.h"
+
+static struct mem_block *
+split_block(struct mem_block *p, uint64_t start, uint64_t size,
+	    struct drm_file *file_priv)
+{
+	/* Maybe cut off the start of an existing block */
+	if (start > p->start) {
+		struct mem_block *newblock =
+			kmalloc(sizeof(*newblock), GFP_KERNEL);
+		if (!newblock)
+			goto out;
+		newblock->start = start;
+		newblock->size = p->size - (start - p->start);
+		newblock->file_priv = NULL;
+		newblock->next = p->next;
+		newblock->prev = p;
+		p->next->prev = newblock;
+		p->next = newblock;
+		p->size -= newblock->size;
+		p = newblock;
+	}
+
+	/* Maybe cut off the end of an existing block */
+	if (size < p->size) {
+		struct mem_block *newblock =
+			kmalloc(sizeof(*newblock), GFP_KERNEL);
+		if (!newblock)
+			goto out;
+		newblock->start = start + size;
+		newblock->size = p->size - size;
+		newblock->file_priv = NULL;
+		newblock->next = p->next;
+		newblock->prev = p;
+		p->next->prev = newblock;
+		p->next = newblock;
+		p->size = size;
+	}
+
+out:
+	/* Our block is in the middle */
+	p->file_priv = file_priv;
+	return p;
+}
+
+struct mem_block *
+nouveau_mem_alloc_block(struct mem_block *heap, uint64_t size,
+			int align2, struct drm_file *file_priv, int tail)
+{
+	struct mem_block *p;
+	uint64_t mask = (1 << align2) - 1;
+
+	if (!heap)
+		return NULL;
+
+	if (tail) {
+		list_for_each_prev(p, heap) {
+			uint64_t start = ((p->start + p->size) - size) & ~mask;
+
+			if (p->file_priv == NULL && start >= p->start &&
+			    start + size <= p->start + p->size)
+				return split_block(p, start, size, file_priv);
+		}
+	} else {
+		list_for_each(p, heap) {
+			uint64_t start = (p->start + mask) & ~mask;
+
+			if (p->file_priv == NULL &&
+			    start + size <= p->start + p->size)
+				return split_block(p, start, size, file_priv);
+		}
+	}
+
+	return NULL;
+}
+
+void nouveau_mem_free_block(struct mem_block *p)
+{
+	p->file_priv = NULL;
+
+	/* Assumes a single contiguous range.  Needs a special file_priv in
+	 * 'heap' to stop it being subsumed.
+	 */
+	if (p->next->file_priv == NULL) {
+		struct mem_block *q = p->next;
+		p->size += q->size;
+		p->next = q->next;
+		p->next->prev = p;
+		kfree(q);
+	}
+
+	if (p->prev->file_priv == NULL) {
+		struct mem_block *q = p->prev;
+		q->size += p->size;
+		q->next = p->next;
+		q->next->prev = q;
+		kfree(p);
+	}
+}
+
+/* Initialize.  How to check for an uninitialized heap?
+ */
+int nouveau_mem_init_heap(struct mem_block **heap, uint64_t start,
+			  uint64_t size)
+{
+	struct mem_block *blocks = kmalloc(sizeof(*blocks), GFP_KERNEL);
+
+	if (!blocks)
+		return -ENOMEM;
+
+	*heap = kmalloc(sizeof(**heap), GFP_KERNEL);
+	if (!*heap) {
+		kfree(blocks);
+		return -ENOMEM;
+	}
+
+	blocks->start = start;
+	blocks->size = size;
+	blocks->file_priv = NULL;
+	blocks->next = blocks->prev = *heap;
+
+	memset(*heap, 0, sizeof(**heap));
+	(*heap)->file_priv = (struct drm_file *) -1;
+	(*heap)->next = (*heap)->prev = blocks;
+	return 0;
+}
+
+/*
+ * Free all blocks associated with the releasing file_priv
+ */
+void nouveau_mem_release(struct drm_file *file_priv, struct mem_block *heap)
+{
+	struct mem_block *p;
+
+	if (!heap || !heap->next)
+		return;
+
+	list_for_each(p, heap) {
+		if (p->file_priv == file_priv)
+			p->file_priv = NULL;
+	}
+
+	/* Assumes a single contiguous range.  Needs a special file_priv in
+	 * 'heap' to stop it being subsumed.
+	 */
+	list_for_each(p, heap) {
+		while ((p->file_priv == NULL) &&
+					(p->next->file_priv == NULL) &&
+					(p->next != heap)) {
+			struct mem_block *q = p->next;
+			p->size += q->size;
+			p->next = q->next;
+			p->next->prev = p;
+			kfree(q);
+		}
+	}
+}
+
+/*
+ * NV10-NV40 tiling helpers
+ */
+
+static void
+nv10_mem_set_region_tiling(struct drm_device *dev, int i, uint32_t addr,
+			   uint32_t size, uint32_t pitch)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_fifo_engine *pfifo = &dev_priv->engine.fifo;
+	struct nouveau_fb_engine *pfb = &dev_priv->engine.fb;
+	struct nouveau_pgraph_engine *pgraph = &dev_priv->engine.graph;
+	struct nouveau_tile_reg *tile = &dev_priv->tile.reg[i];
+
+	tile->addr = addr;
+	tile->size = size;
+	tile->used = !!pitch;
+	nouveau_fence_unref((void **)&tile->fence);
+
+	if (!pfifo->cache_flush(dev))
+		return;
+
+	pfifo->reassign(dev, false);
+	pfifo->cache_flush(dev);
+	pfifo->cache_pull(dev, false);
+
+	nouveau_wait_for_idle(dev);
+
+	pgraph->set_region_tiling(dev, i, addr, size, pitch);
+	pfb->set_region_tiling(dev, i, addr, size, pitch);
+
+	pfifo->cache_pull(dev, true);
+	pfifo->reassign(dev, true);
+}
+
+struct nouveau_tile_reg *
+nv10_mem_set_tiling(struct drm_device *dev, uint32_t addr, uint32_t size,
+		    uint32_t pitch)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_fb_engine *pfb = &dev_priv->engine.fb;
+	struct nouveau_tile_reg *tile = dev_priv->tile.reg, *found = NULL;
+	int i;
+
+	spin_lock(&dev_priv->tile.lock);
+
+	for (i = 0; i < pfb->num_tiles; i++) {
+		if (tile[i].used)
+			/* Tile region in use. */
+			continue;
+
+		if (tile[i].fence &&
+		    !nouveau_fence_signalled(tile[i].fence, NULL))
+			/* Pending tile region. */
+			continue;
+
+		if (max(tile[i].addr, addr) <
+		    min(tile[i].addr + tile[i].size, addr + size))
+			/* Kill an intersecting tile region. */
+			nv10_mem_set_region_tiling(dev, i, 0, 0, 0);
+
+		if (pitch && !found) {
+			/* Free tile region. */
+			nv10_mem_set_region_tiling(dev, i, addr, size, pitch);
+			found = &tile[i];
+		}
+	}
+
+	spin_unlock(&dev_priv->tile.lock);
+
+	return found;
+}
+
+void
+nv10_mem_expire_tiling(struct drm_device *dev, struct nouveau_tile_reg *tile,
+		       struct nouveau_fence *fence)
+{
+	if (fence) {
+		/* Mark it as pending. */
+		tile->fence = fence;
+		nouveau_fence_ref(fence);
+	}
+
+	tile->used = false;
+}
+
+/*
+ * NV50 VM helpers
+ */
+int
+nv50_mem_vm_bind_linear(struct drm_device *dev, uint64_t virt, uint32_t size,
+			uint32_t flags, uint64_t phys)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_gpuobj **pgt;
+	unsigned psz, pfl, pages;
+
+	if (virt >= dev_priv->vm_gart_base &&
+	    (virt + size) < (dev_priv->vm_gart_base + dev_priv->vm_gart_size)) {
+		psz = 12;
+		pgt = &dev_priv->gart_info.sg_ctxdma;
+		pfl = 0x21;
+		virt -= dev_priv->vm_gart_base;
+	} else
+	if (virt >= dev_priv->vm_vram_base &&
+	    (virt + size) < (dev_priv->vm_vram_base + dev_priv->vm_vram_size)) {
+		psz = 16;
+		pgt = dev_priv->vm_vram_pt;
+		pfl = 0x01;
+		virt -= dev_priv->vm_vram_base;
+	} else {
+		NV_ERROR(dev, "Invalid address: 0x%16llx-0x%16llx\n",
+			 virt, virt + size - 1);
+		return -EINVAL;
+	}
+
+	pages = size >> psz;
+
+	dev_priv->engine.instmem.prepare_access(dev, true);
+	if (flags & 0x80000000) {
+		while (pages--) {
+			struct nouveau_gpuobj *pt = pgt[virt >> 29];
+			unsigned pte = ((virt & 0x1fffffffULL) >> psz) << 1;
+
+			nv_wo32(dev, pt, pte++, 0x00000000);
+			nv_wo32(dev, pt, pte++, 0x00000000);
+
+			virt += (1 << psz);
+		}
+	} else {
+		while (pages--) {
+			struct nouveau_gpuobj *pt = pgt[virt >> 29];
+			unsigned pte = ((virt & 0x1fffffffULL) >> psz) << 1;
+			unsigned offset_h = upper_32_bits(phys) & 0xff;
+			unsigned offset_l = lower_32_bits(phys);
+
+			nv_wo32(dev, pt, pte++, offset_l | pfl);
+			nv_wo32(dev, pt, pte++, offset_h | flags);
+
+			phys += (1 << psz);
+			virt += (1 << psz);
+		}
+	}
+	dev_priv->engine.instmem.finish_access(dev);
+
+	nv_wr32(dev, 0x100c80, 0x00050001);
+	if (!nv_wait(0x100c80, 0x00000001, 0x00000000)) {
+		NV_ERROR(dev, "timeout: (0x100c80 & 1) == 0 (2)\n");
+		NV_ERROR(dev, "0x100c80 = 0x%08x\n", nv_rd32(dev, 0x100c80));
+		return -EBUSY;
+	}
+
+	nv_wr32(dev, 0x100c80, 0x00000001);
+	if (!nv_wait(0x100c80, 0x00000001, 0x00000000)) {
+		NV_ERROR(dev, "timeout: (0x100c80 & 1) == 0 (2)\n");
+		NV_ERROR(dev, "0x100c80 = 0x%08x\n", nv_rd32(dev, 0x100c80));
+		return -EBUSY;
+	}
+
+	return 0;
+}
+
+void
+nv50_mem_vm_unbind(struct drm_device *dev, uint64_t virt, uint32_t size)
+{
+	nv50_mem_vm_bind_linear(dev, virt, size, 0x80000000, 0);
+}
+
+/*
+ * Cleanup everything
+ */
+void nouveau_mem_takedown(struct mem_block **heap)
+{
+	struct mem_block *p;
+
+	if (!*heap)
+		return;
+
+	for (p = (*heap)->next; p != *heap;) {
+		struct mem_block *q = p;
+		p = p->next;
+		kfree(q);
+	}
+
+	kfree(*heap);
+	*heap = NULL;
+}
+
+void nouveau_mem_close(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+
+	if (dev_priv->ttm.bdev.man[TTM_PL_PRIV0].has_type)
+		ttm_bo_clean_mm(&dev_priv->ttm.bdev, TTM_PL_PRIV0);
+	ttm_bo_clean_mm(&dev_priv->ttm.bdev, TTM_PL_VRAM);
+
+	ttm_bo_device_release(&dev_priv->ttm.bdev);
+
+	nouveau_ttm_global_release(dev_priv);
+
+	if (drm_core_has_AGP(dev) && dev->agp &&
+	    drm_core_check_feature(dev, DRIVER_MODESET)) {
+		struct drm_agp_mem *entry, *tempe;
+
+		/* Remove AGP resources, but leave dev->agp
+		   intact until drv_cleanup is called. */
+		list_for_each_entry_safe(entry, tempe, &dev->agp->memory, head) {
+			if (entry->bound)
+				drm_unbind_agp(entry->memory);
+			drm_free_agp(entry->memory, entry->pages);
+			kfree(entry);
+		}
+		INIT_LIST_HEAD(&dev->agp->memory);
+
+		if (dev->agp->acquired)
+			drm_agp_release(dev);
+
+		dev->agp->acquired = 0;
+		dev->agp->enabled = 0;
+	}
+
+	if (dev_priv->fb_mtrr) {
+		drm_mtrr_del(dev_priv->fb_mtrr, drm_get_resource_start(dev, 1),
+			     drm_get_resource_len(dev, 1), DRM_MTRR_WC);
+		dev_priv->fb_mtrr = 0;
+	}
+}
+
+/*XXX won't work on BSD because of pci_read_config_dword */
+static uint32_t
+nouveau_mem_fb_amount_igp(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct pci_dev *bridge;
+	uint32_t mem;
+
+	bridge = pci_get_bus_and_slot(0, PCI_DEVFN(0, 1));
+	if (!bridge) {
+		NV_ERROR(dev, "no bridge device\n");
+		return 0;
+	}
+
+	if (dev_priv->flags&NV_NFORCE) {
+		pci_read_config_dword(bridge, 0x7C, &mem);
+		return (uint64_t)(((mem >> 6) & 31) + 1)*1024*1024;
+	} else
+	if (dev_priv->flags&NV_NFORCE2) {
+		pci_read_config_dword(bridge, 0x84, &mem);
+		return (uint64_t)(((mem >> 4) & 127) + 1)*1024*1024;
+	}
+
+	NV_ERROR(dev, "impossible!\n");
+	return 0;
+}
+
+/* returns the amount of FB ram in bytes */
+uint64_t nouveau_mem_fb_amount(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	uint32_t boot0;
+
+	switch (dev_priv->card_type) {
+	case NV_04:
+		boot0 = nv_rd32(dev, NV03_BOOT_0);
+		if (boot0 & 0x00000100)
+			return (((boot0 >> 12) & 0xf) * 2 + 2) * 1024 * 1024;
+
+		switch (boot0 & NV03_BOOT_0_RAM_AMOUNT) {
+		case NV04_BOOT_0_RAM_AMOUNT_32MB:
+			return 32 * 1024 * 1024;
+		case NV04_BOOT_0_RAM_AMOUNT_16MB:
+			return 16 * 1024 * 1024;
+		case NV04_BOOT_0_RAM_AMOUNT_8MB:
+			return 8 * 1024 * 1024;
+		case NV04_BOOT_0_RAM_AMOUNT_4MB:
+			return 4 * 1024 * 1024;
+		}
+		break;
+	case NV_10:
+	case NV_20:
+	case NV_30:
+	case NV_40:
+	case NV_50:
+	default:
+		if (dev_priv->flags & (NV_NFORCE | NV_NFORCE2)) {
+			return nouveau_mem_fb_amount_igp(dev);
+		} else {
+			uint64_t mem;
+			mem = (nv_rd32(dev, NV04_FIFO_DATA) &
+					NV10_FIFO_DATA_RAM_AMOUNT_MB_MASK) >>
+					NV10_FIFO_DATA_RAM_AMOUNT_MB_SHIFT;
+			return mem * 1024 * 1024;
+		}
+		break;
+	}
+
+	NV_ERROR(dev,
+		"Unable to detect video ram size. Please report your setup to "
+							DRIVER_EMAIL "\n");
+	return 0;
+}
+
+#if __OS_HAS_AGP
+static void nouveau_mem_reset_agp(struct drm_device *dev)
+{
+	uint32_t saved_pci_nv_1, saved_pci_nv_19, pmc_enable;
+
+	saved_pci_nv_1 = nv_rd32(dev, NV04_PBUS_PCI_NV_1);
+	saved_pci_nv_19 = nv_rd32(dev, NV04_PBUS_PCI_NV_19);
+
+	/* clear busmaster bit */
+	nv_wr32(dev, NV04_PBUS_PCI_NV_1, saved_pci_nv_1 & ~0x4);
+	/* clear SBA and AGP bits */
+	nv_wr32(dev, NV04_PBUS_PCI_NV_19, saved_pci_nv_19 & 0xfffff0ff);
+
+	/* power cycle pgraph, if enabled */
+	pmc_enable = nv_rd32(dev, NV03_PMC_ENABLE);
+	if (pmc_enable & NV_PMC_ENABLE_PGRAPH) {
+		nv_wr32(dev, NV03_PMC_ENABLE,
+				pmc_enable & ~NV_PMC_ENABLE_PGRAPH);
+		nv_wr32(dev, NV03_PMC_ENABLE, nv_rd32(dev, NV03_PMC_ENABLE) |
+				NV_PMC_ENABLE_PGRAPH);
+	}
+
+	/* and restore (gives effect of resetting AGP) */
+	nv_wr32(dev, NV04_PBUS_PCI_NV_19, saved_pci_nv_19);
+	nv_wr32(dev, NV04_PBUS_PCI_NV_1, saved_pci_nv_1);
+}
+#endif
+
+int
+nouveau_mem_init_agp(struct drm_device *dev)
+{
+#if __OS_HAS_AGP
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct drm_agp_info info;
+	struct drm_agp_mode mode;
+	int ret;
+
+	if (nouveau_noagp)
+		return 0;
+
+	nouveau_mem_reset_agp(dev);
+
+	if (!dev->agp->acquired) {
+		ret = drm_agp_acquire(dev);
+		if (ret) {
+			NV_ERROR(dev, "Unable to acquire AGP: %d\n", ret);
+			return ret;
+		}
+	}
+
+	ret = drm_agp_info(dev, &info);
+	if (ret) {
+		NV_ERROR(dev, "Unable to get AGP info: %d\n", ret);
+		return ret;
+	}
+
+	/* see agp.h for the AGPSTAT_* modes available */
+	mode.mode = info.mode;
+	ret = drm_agp_enable(dev, mode);
+	if (ret) {
+		NV_ERROR(dev, "Unable to enable AGP: %d\n", ret);
+		return ret;
+	}
+
+	dev_priv->gart_info.type	= NOUVEAU_GART_AGP;
+	dev_priv->gart_info.aper_base	= info.aperture_base;
+	dev_priv->gart_info.aper_size	= info.aperture_size;
+#endif
+	return 0;
+}
+
+int
+nouveau_mem_init(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct ttm_bo_device *bdev = &dev_priv->ttm.bdev;
+	int ret, dma_bits = 32;
+
+	dev_priv->fb_phys = drm_get_resource_start(dev, 1);
+	dev_priv->gart_info.type = NOUVEAU_GART_NONE;
+
+	if (dev_priv->card_type >= NV_50 &&
+	    pci_dma_supported(dev->pdev, DMA_BIT_MASK(40)))
+		dma_bits = 40;
+
+	ret = pci_set_dma_mask(dev->pdev, DMA_BIT_MASK(dma_bits));
+	if (ret) {
+		NV_ERROR(dev, "Error setting DMA mask: %d\n", ret);
+		return ret;
+	}
+
+	ret = nouveau_ttm_global_init(dev_priv);
+	if (ret)
+		return ret;
+
+	ret = ttm_bo_device_init(&dev_priv->ttm.bdev,
+				 dev_priv->ttm.bo_global_ref.ref.object,
+				 &nouveau_bo_driver, DRM_FILE_PAGE_OFFSET,
+				 dma_bits <= 32 ? true : false);
+	if (ret) {
+		NV_ERROR(dev, "Error initialising bo driver: %d\n", ret);
+		return ret;
+	}
+
+	INIT_LIST_HEAD(&dev_priv->ttm.bo_list);
+	spin_lock_init(&dev_priv->ttm.bo_list_lock);
+	spin_lock_init(&dev_priv->tile.lock);
+
+	dev_priv->fb_available_size = nouveau_mem_fb_amount(dev);
+
+	dev_priv->fb_mappable_pages = dev_priv->fb_available_size;
+	if (dev_priv->fb_mappable_pages > drm_get_resource_len(dev, 1))
+		dev_priv->fb_mappable_pages = drm_get_resource_len(dev, 1);
+	dev_priv->fb_mappable_pages >>= PAGE_SHIFT;
+
+	NV_INFO(dev, "%d MiB VRAM\n", (int)(dev_priv->fb_available_size >> 20));
+
+	/* remove reserved space at end of vram from available amount */
+	dev_priv->fb_available_size -= dev_priv->ramin_rsvd_vram;
+	dev_priv->fb_aper_free = dev_priv->fb_available_size;
+
+	/* mappable vram */
+	ret = ttm_bo_init_mm(bdev, TTM_PL_VRAM,
+			     dev_priv->fb_available_size >> PAGE_SHIFT);
+	if (ret) {
+		NV_ERROR(dev, "Failed VRAM mm init: %d\n", ret);
+		return ret;
+	}
+
+	/* GART */
+#if !defined(__powerpc__) && !defined(__ia64__)
+	if (drm_device_is_agp(dev) && dev->agp) {
+		ret = nouveau_mem_init_agp(dev);
+		if (ret)
+			NV_ERROR(dev, "Error initialising AGP: %d\n", ret);
+	}
+#endif
+
+	if (dev_priv->gart_info.type == NOUVEAU_GART_NONE) {
+		ret = nouveau_sgdma_init(dev);
+		if (ret) {
+			NV_ERROR(dev, "Error initialising PCI(E): %d\n", ret);
+			return ret;
+		}
+	}
+
+	NV_INFO(dev, "%d MiB GART (aperture)\n",
+		(int)(dev_priv->gart_info.aper_size >> 20));
+	dev_priv->gart_info.aper_free = dev_priv->gart_info.aper_size;
+
+	ret = ttm_bo_init_mm(bdev, TTM_PL_TT,
+			     dev_priv->gart_info.aper_size >> PAGE_SHIFT);
+	if (ret) {
+		NV_ERROR(dev, "Failed TT mm init: %d\n", ret);
+		return ret;
+	}
+
+	dev_priv->fb_mtrr = drm_mtrr_add(drm_get_resource_start(dev, 1),
+					 drm_get_resource_len(dev, 1),
+					 DRM_MTRR_WC);
+	return 0;
+}
+
+
diff --git a/drivers/gpu/drm/nouveau/nouveau_notifier.c b/drivers/gpu/drm/nouveau/nouveau_notifier.c
new file mode 100644
index 000000000000..6c66a34b6345
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nouveau_notifier.c
@@ -0,0 +1,196 @@
+/*
+ * Copyright (C) 2007 Ben Skeggs.
+ *
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial
+ * portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE COPYRIGHT OWNER(S) AND/OR ITS SUPPLIERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
+#include "drmP.h"
+#include "drm.h"
+#include "nouveau_drv.h"
+
+int
+nouveau_notifier_init_channel(struct nouveau_channel *chan)
+{
+	struct drm_device *dev = chan->dev;
+	struct nouveau_bo *ntfy = NULL;
+	int ret;
+
+	ret = nouveau_gem_new(dev, NULL, PAGE_SIZE, 0, nouveau_vram_notify ?
+			      TTM_PL_FLAG_VRAM : TTM_PL_FLAG_TT,
+			      0, 0x0000, false, true, &ntfy);
+	if (ret)
+		return ret;
+
+	ret = nouveau_bo_pin(ntfy, TTM_PL_FLAG_VRAM);
+	if (ret)
+		goto out_err;
+
+	ret = nouveau_bo_map(ntfy);
+	if (ret)
+		goto out_err;
+
+	ret = nouveau_mem_init_heap(&chan->notifier_heap, 0, ntfy->bo.mem.size);
+	if (ret)
+		goto out_err;
+
+	chan->notifier_bo = ntfy;
+out_err:
+	if (ret) {
+		mutex_lock(&dev->struct_mutex);
+		drm_gem_object_unreference(ntfy->gem);
+		mutex_unlock(&dev->struct_mutex);
+	}
+
+	return ret;
+}
+
+void
+nouveau_notifier_takedown_channel(struct nouveau_channel *chan)
+{
+	struct drm_device *dev = chan->dev;
+
+	if (!chan->notifier_bo)
+		return;
+
+	nouveau_bo_unmap(chan->notifier_bo);
+	mutex_lock(&dev->struct_mutex);
+	nouveau_bo_unpin(chan->notifier_bo);
+	drm_gem_object_unreference(chan->notifier_bo->gem);
+	mutex_unlock(&dev->struct_mutex);
+	nouveau_mem_takedown(&chan->notifier_heap);
+}
+
+static void
+nouveau_notifier_gpuobj_dtor(struct drm_device *dev,
+			     struct nouveau_gpuobj *gpuobj)
+{
+	NV_DEBUG(dev, "\n");
+
+	if (gpuobj->priv)
+		nouveau_mem_free_block(gpuobj->priv);
+}
+
+int
+nouveau_notifier_alloc(struct nouveau_channel *chan, uint32_t handle,
+		       int size, uint32_t *b_offset)
+{
+	struct drm_device *dev = chan->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_gpuobj *nobj = NULL;
+	struct mem_block *mem;
+	uint32_t offset;
+	int target, ret;
+
+	if (!chan->notifier_heap) {
+		NV_ERROR(dev, "Channel %d doesn't have a notifier heap!\n",
+			 chan->id);
+		return -EINVAL;
+	}
+
+	mem = nouveau_mem_alloc_block(chan->notifier_heap, size, 0,
+				      (struct drm_file *)-2, 0);
+	if (!mem) {
+		NV_ERROR(dev, "Channel %d notifier block full\n", chan->id);
+		return -ENOMEM;
+	}
+
+	offset = chan->notifier_bo->bo.mem.mm_node->start << PAGE_SHIFT;
+	if (chan->notifier_bo->bo.mem.mem_type == TTM_PL_VRAM) {
+		target = NV_DMA_TARGET_VIDMEM;
+	} else
+	if (chan->notifier_bo->bo.mem.mem_type == TTM_PL_TT) {
+		if (dev_priv->gart_info.type == NOUVEAU_GART_SGDMA &&
+		    dev_priv->card_type < NV_50) {
+			ret = nouveau_sgdma_get_page(dev, offset, &offset);
+			if (ret)
+				return ret;
+			target = NV_DMA_TARGET_PCI;
+		} else {
+			target = NV_DMA_TARGET_AGP;
+		}
+	} else {
+		NV_ERROR(dev, "Bad DMA target, mem_type %d!\n",
+			 chan->notifier_bo->bo.mem.mem_type);
+		return -EINVAL;
+	}
+	offset += mem->start;
+
+	ret = nouveau_gpuobj_dma_new(chan, NV_CLASS_DMA_IN_MEMORY, offset,
+				     mem->size, NV_DMA_ACCESS_RW, target,
+				     &nobj);
+	if (ret) {
+		nouveau_mem_free_block(mem);
+		NV_ERROR(dev, "Error creating notifier ctxdma: %d\n", ret);
+		return ret;
+	}
+	nobj->dtor   = nouveau_notifier_gpuobj_dtor;
+	nobj->priv   = mem;
+
+	ret = nouveau_gpuobj_ref_add(dev, chan, handle, nobj, NULL);
+	if (ret) {
+		nouveau_gpuobj_del(dev, &nobj);
+		nouveau_mem_free_block(mem);
+		NV_ERROR(dev, "Error referencing notifier ctxdma: %d\n", ret);
+		return ret;
+	}
+
+	*b_offset = mem->start;
+	return 0;
+}
+
+int
+nouveau_notifier_offset(struct nouveau_gpuobj *nobj, uint32_t *poffset)
+{
+	if (!nobj || nobj->dtor != nouveau_notifier_gpuobj_dtor)
+		return -EINVAL;
+
+	if (poffset) {
+		struct mem_block *mem = nobj->priv;
+
+		if (*poffset >= mem->size)
+			return false;
+
+		*poffset += mem->start;
+	}
+
+	return 0;
+}
+
+int
+nouveau_ioctl_notifier_alloc(struct drm_device *dev, void *data,
+			     struct drm_file *file_priv)
+{
+	struct drm_nouveau_notifierobj_alloc *na = data;
+	struct nouveau_channel *chan;
+	int ret;
+
+	NOUVEAU_CHECK_INITIALISED_WITH_RETURN;
+	NOUVEAU_GET_USER_CHANNEL_WITH_RETURN(na->channel, file_priv, chan);
+
+	ret = nouveau_notifier_alloc(chan, na->handle, na->size, &na->offset);
+	if (ret)
+		return ret;
+
+	return 0;
+}
diff --git a/drivers/gpu/drm/nouveau/nouveau_object.c b/drivers/gpu/drm/nouveau/nouveau_object.c
new file mode 100644
index 000000000000..6c2cf81716df
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nouveau_object.c
@@ -0,0 +1,1294 @@
+/*
+ * Copyright (C) 2006 Ben Skeggs.
+ *
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial
+ * portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE COPYRIGHT OWNER(S) AND/OR ITS SUPPLIERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
+/*
+ * Authors:
+ *   Ben Skeggs <darktama@iinet.net.au>
+ */
+
+#include "drmP.h"
+#include "drm.h"
+#include "nouveau_drv.h"
+#include "nouveau_drm.h"
+
+/* NVidia uses context objects to drive drawing operations.
+
+   Context objects can be selected into 8 subchannels in the FIFO,
+   and then used via DMA command buffers.
+
+   A context object is referenced by a user defined handle (CARD32). The HW
+   looks up graphics objects in a hash table in the instance RAM.
+
+   An entry in the hash table consists of 2 CARD32. The first CARD32 contains
+   the handle, the second one a bitfield, that contains the address of the
+   object in instance RAM.
+
+   The format of the second CARD32 seems to be:
+
+   NV4 to NV30:
+
+   15: 0  instance_addr >> 4
+   17:16  engine (here uses 1 = graphics)
+   28:24  channel id (here uses 0)
+   31	  valid (use 1)
+
+   NV40:
+
+   15: 0  instance_addr >> 4   (maybe 19-0)
+   21:20  engine (here uses 1 = graphics)
+   I'm unsure about the other bits, but using 0 seems to work.
+
+   The key into the hash table depends on the object handle and channel id and
+   is given as:
+*/
+static uint32_t
+nouveau_ramht_hash_handle(struct drm_device *dev, int channel, uint32_t handle)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	uint32_t hash = 0;
+	int i;
+
+	NV_DEBUG(dev, "ch%d handle=0x%08x\n", channel, handle);
+
+	for (i = 32; i > 0; i -= dev_priv->ramht_bits) {
+		hash ^= (handle & ((1 << dev_priv->ramht_bits) - 1));
+		handle >>= dev_priv->ramht_bits;
+	}
+
+	if (dev_priv->card_type < NV_50)
+		hash ^= channel << (dev_priv->ramht_bits - 4);
+	hash <<= 3;
+
+	NV_DEBUG(dev, "hash=0x%08x\n", hash);
+	return hash;
+}
+
+static int
+nouveau_ramht_entry_valid(struct drm_device *dev, struct nouveau_gpuobj *ramht,
+			  uint32_t offset)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	uint32_t ctx = nv_ro32(dev, ramht, (offset + 4)/4);
+
+	if (dev_priv->card_type < NV_40)
+		return ((ctx & NV_RAMHT_CONTEXT_VALID) != 0);
+	return (ctx != 0);
+}
+
+static int
+nouveau_ramht_insert(struct drm_device *dev, struct nouveau_gpuobj_ref *ref)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_instmem_engine *instmem = &dev_priv->engine.instmem;
+	struct nouveau_channel *chan = ref->channel;
+	struct nouveau_gpuobj *ramht = chan->ramht ? chan->ramht->gpuobj : NULL;
+	uint32_t ctx, co, ho;
+
+	if (!ramht) {
+		NV_ERROR(dev, "No hash table!\n");
+		return -EINVAL;
+	}
+
+	if (dev_priv->card_type < NV_40) {
+		ctx = NV_RAMHT_CONTEXT_VALID | (ref->instance >> 4) |
+		      (chan->id << NV_RAMHT_CONTEXT_CHANNEL_SHIFT) |
+		      (ref->gpuobj->engine << NV_RAMHT_CONTEXT_ENGINE_SHIFT);
+	} else
+	if (dev_priv->card_type < NV_50) {
+		ctx = (ref->instance >> 4) |
+		      (chan->id << NV40_RAMHT_CONTEXT_CHANNEL_SHIFT) |
+		      (ref->gpuobj->engine << NV40_RAMHT_CONTEXT_ENGINE_SHIFT);
+	} else {
+		if (ref->gpuobj->engine == NVOBJ_ENGINE_DISPLAY) {
+			ctx = (ref->instance << 10) | 2;
+		} else {
+			ctx = (ref->instance >> 4) |
+			      ((ref->gpuobj->engine <<
+				NV40_RAMHT_CONTEXT_ENGINE_SHIFT));
+		}
+	}
+
+	instmem->prepare_access(dev, true);
+	co = ho = nouveau_ramht_hash_handle(dev, chan->id, ref->handle);
+	do {
+		if (!nouveau_ramht_entry_valid(dev, ramht, co)) {
+			NV_DEBUG(dev,
+				 "insert ch%d 0x%08x: h=0x%08x, c=0x%08x\n",
+				 chan->id, co, ref->handle, ctx);
+			nv_wo32(dev, ramht, (co + 0)/4, ref->handle);
+			nv_wo32(dev, ramht, (co + 4)/4, ctx);
+
+			list_add_tail(&ref->list, &chan->ramht_refs);
+			instmem->finish_access(dev);
+			return 0;
+		}
+		NV_DEBUG(dev, "collision ch%d 0x%08x: h=0x%08x\n",
+			 chan->id, co, nv_ro32(dev, ramht, co/4));
+
+		co += 8;
+		if (co >= dev_priv->ramht_size)
+			co = 0;
+	} while (co != ho);
+	instmem->finish_access(dev);
+
+	NV_ERROR(dev, "RAMHT space exhausted. ch=%d\n", chan->id);
+	return -ENOMEM;
+}
+
+static void
+nouveau_ramht_remove(struct drm_device *dev, struct nouveau_gpuobj_ref *ref)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_instmem_engine *instmem = &dev_priv->engine.instmem;
+	struct nouveau_channel *chan = ref->channel;
+	struct nouveau_gpuobj *ramht = chan->ramht ? chan->ramht->gpuobj : NULL;
+	uint32_t co, ho;
+
+	if (!ramht) {
+		NV_ERROR(dev, "No hash table!\n");
+		return;
+	}
+
+	instmem->prepare_access(dev, true);
+	co = ho = nouveau_ramht_hash_handle(dev, chan->id, ref->handle);
+	do {
+		if (nouveau_ramht_entry_valid(dev, ramht, co) &&
+		    (ref->handle == nv_ro32(dev, ramht, (co/4)))) {
+			NV_DEBUG(dev,
+				 "remove ch%d 0x%08x: h=0x%08x, c=0x%08x\n",
+				 chan->id, co, ref->handle,
+				 nv_ro32(dev, ramht, (co + 4)));
+			nv_wo32(dev, ramht, (co + 0)/4, 0x00000000);
+			nv_wo32(dev, ramht, (co + 4)/4, 0x00000000);
+
+			list_del(&ref->list);
+			instmem->finish_access(dev);
+			return;
+		}
+
+		co += 8;
+		if (co >= dev_priv->ramht_size)
+			co = 0;
+	} while (co != ho);
+	list_del(&ref->list);
+	instmem->finish_access(dev);
+
+	NV_ERROR(dev, "RAMHT entry not found. ch=%d, handle=0x%08x\n",
+		 chan->id, ref->handle);
+}
+
+int
+nouveau_gpuobj_new(struct drm_device *dev, struct nouveau_channel *chan,
+		   uint32_t size, int align, uint32_t flags,
+		   struct nouveau_gpuobj **gpuobj_ret)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_engine *engine = &dev_priv->engine;
+	struct nouveau_gpuobj *gpuobj;
+	struct mem_block *pramin = NULL;
+	int ret;
+
+	NV_DEBUG(dev, "ch%d size=%u align=%d flags=0x%08x\n",
+		 chan ? chan->id : -1, size, align, flags);
+
+	if (!dev_priv || !gpuobj_ret || *gpuobj_ret != NULL)
+		return -EINVAL;
+
+	gpuobj = kzalloc(sizeof(*gpuobj), GFP_KERNEL);
+	if (!gpuobj)
+		return -ENOMEM;
+	NV_DEBUG(dev, "gpuobj %p\n", gpuobj);
+	gpuobj->flags = flags;
+	gpuobj->im_channel = chan;
+
+	list_add_tail(&gpuobj->list, &dev_priv->gpuobj_list);
+
+	/* Choose between global instmem heap, and per-channel private
+	 * instmem heap.  On <NV50 allow requests for private instmem
+	 * to be satisfied from global heap if no per-channel area
+	 * available.
+	 */
+	if (chan) {
+		if (chan->ramin_heap) {
+			NV_DEBUG(dev, "private heap\n");
+			pramin = chan->ramin_heap;
+		} else
+		if (dev_priv->card_type < NV_50) {
+			NV_DEBUG(dev, "global heap fallback\n");
+			pramin = dev_priv->ramin_heap;
+		}
+	} else {
+		NV_DEBUG(dev, "global heap\n");
+		pramin = dev_priv->ramin_heap;
+	}
+
+	if (!pramin) {
+		NV_ERROR(dev, "No PRAMIN heap!\n");
+		return -EINVAL;
+	}
+
+	if (!chan) {
+		ret = engine->instmem.populate(dev, gpuobj, &size);
+		if (ret) {
+			nouveau_gpuobj_del(dev, &gpuobj);
+			return ret;
+		}
+	}
+
+	/* Allocate a chunk of the PRAMIN aperture */
+	gpuobj->im_pramin = nouveau_mem_alloc_block(pramin, size,
+						    drm_order(align),
+						    (struct drm_file *)-2, 0);
+	if (!gpuobj->im_pramin) {
+		nouveau_gpuobj_del(dev, &gpuobj);
+		return -ENOMEM;
+	}
+
+	if (!chan) {
+		ret = engine->instmem.bind(dev, gpuobj);
+		if (ret) {
+			nouveau_gpuobj_del(dev, &gpuobj);
+			return ret;
+		}
+	}
+
+	if (gpuobj->flags & NVOBJ_FLAG_ZERO_ALLOC) {
+		int i;
+
+		engine->instmem.prepare_access(dev, true);
+		for (i = 0; i < gpuobj->im_pramin->size; i += 4)
+			nv_wo32(dev, gpuobj, i/4, 0);
+		engine->instmem.finish_access(dev);
+	}
+
+	*gpuobj_ret = gpuobj;
+	return 0;
+}
+
+int
+nouveau_gpuobj_early_init(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+
+	NV_DEBUG(dev, "\n");
+
+	INIT_LIST_HEAD(&dev_priv->gpuobj_list);
+
+	return 0;
+}
+
+int
+nouveau_gpuobj_init(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	int ret;
+
+	NV_DEBUG(dev, "\n");
+
+	if (dev_priv->card_type < NV_50) {
+		ret = nouveau_gpuobj_new_fake(dev,
+			dev_priv->ramht_offset, ~0, dev_priv->ramht_size,
+			NVOBJ_FLAG_ZERO_ALLOC | NVOBJ_FLAG_ALLOW_NO_REFS,
+						&dev_priv->ramht, NULL);
+		if (ret)
+			return ret;
+	}
+
+	return 0;
+}
+
+void
+nouveau_gpuobj_takedown(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+
+	NV_DEBUG(dev, "\n");
+
+	nouveau_gpuobj_del(dev, &dev_priv->ramht);
+}
+
+void
+nouveau_gpuobj_late_takedown(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_gpuobj *gpuobj = NULL;
+	struct list_head *entry, *tmp;
+
+	NV_DEBUG(dev, "\n");
+
+	list_for_each_safe(entry, tmp, &dev_priv->gpuobj_list) {
+		gpuobj = list_entry(entry, struct nouveau_gpuobj, list);
+
+		NV_ERROR(dev, "gpuobj %p still exists at takedown, refs=%d\n",
+			 gpuobj, gpuobj->refcount);
+		gpuobj->refcount = 0;
+		nouveau_gpuobj_del(dev, &gpuobj);
+	}
+}
+
+int
+nouveau_gpuobj_del(struct drm_device *dev, struct nouveau_gpuobj **pgpuobj)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_engine *engine = &dev_priv->engine;
+	struct nouveau_gpuobj *gpuobj;
+	int i;
+
+	NV_DEBUG(dev, "gpuobj %p\n", pgpuobj ? *pgpuobj : NULL);
+
+	if (!dev_priv || !pgpuobj || !(*pgpuobj))
+		return -EINVAL;
+	gpuobj = *pgpuobj;
+
+	if (gpuobj->refcount != 0) {
+		NV_ERROR(dev, "gpuobj refcount is %d\n", gpuobj->refcount);
+		return -EINVAL;
+	}
+
+	if (gpuobj->im_pramin && (gpuobj->flags & NVOBJ_FLAG_ZERO_FREE)) {
+		engine->instmem.prepare_access(dev, true);
+		for (i = 0; i < gpuobj->im_pramin->size; i += 4)
+			nv_wo32(dev, gpuobj, i/4, 0);
+		engine->instmem.finish_access(dev);
+	}
+
+	if (gpuobj->dtor)
+		gpuobj->dtor(dev, gpuobj);
+
+	if (gpuobj->im_backing && !(gpuobj->flags & NVOBJ_FLAG_FAKE))
+		engine->instmem.clear(dev, gpuobj);
+
+	if (gpuobj->im_pramin) {
+		if (gpuobj->flags & NVOBJ_FLAG_FAKE)
+			kfree(gpuobj->im_pramin);
+		else
+			nouveau_mem_free_block(gpuobj->im_pramin);
+	}
+
+	list_del(&gpuobj->list);
+
+	*pgpuobj = NULL;
+	kfree(gpuobj);
+	return 0;
+}
+
+static int
+nouveau_gpuobj_instance_get(struct drm_device *dev,
+			    struct nouveau_channel *chan,
+			    struct nouveau_gpuobj *gpuobj, uint32_t *inst)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_gpuobj *cpramin;
+
+	/* <NV50 use PRAMIN address everywhere */
+	if (dev_priv->card_type < NV_50) {
+		*inst = gpuobj->im_pramin->start;
+		return 0;
+	}
+
+	if (chan && gpuobj->im_channel != chan) {
+		NV_ERROR(dev, "Channel mismatch: obj %d, ref %d\n",
+			 gpuobj->im_channel->id, chan->id);
+		return -EINVAL;
+	}
+
+	/* NV50 channel-local instance */
+	if (chan) {
+		cpramin = chan->ramin->gpuobj;
+		*inst = gpuobj->im_pramin->start - cpramin->im_pramin->start;
+		return 0;
+	}
+
+	/* NV50 global (VRAM) instance */
+	if (!gpuobj->im_channel) {
+		/* ...from global heap */
+		if (!gpuobj->im_backing) {
+			NV_ERROR(dev, "AII, no VRAM backing gpuobj\n");
+			return -EINVAL;
+		}
+		*inst = gpuobj->im_backing_start;
+		return 0;
+	} else {
+		/* ...from local heap */
+		cpramin = gpuobj->im_channel->ramin->gpuobj;
+		*inst = cpramin->im_backing_start +
+			(gpuobj->im_pramin->start - cpramin->im_pramin->start);
+		return 0;
+	}
+
+	return -EINVAL;
+}
+
+int
+nouveau_gpuobj_ref_add(struct drm_device *dev, struct nouveau_channel *chan,
+		       uint32_t handle, struct nouveau_gpuobj *gpuobj,
+		       struct nouveau_gpuobj_ref **ref_ret)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_gpuobj_ref *ref;
+	uint32_t instance;
+	int ret;
+
+	NV_DEBUG(dev, "ch%d h=0x%08x gpuobj=%p\n",
+		 chan ? chan->id : -1, handle, gpuobj);
+
+	if (!dev_priv || !gpuobj || (ref_ret && *ref_ret != NULL))
+		return -EINVAL;
+
+	if (!chan && !ref_ret)
+		return -EINVAL;
+
+	if (gpuobj->engine == NVOBJ_ENGINE_SW && !gpuobj->im_pramin) {
+		/* sw object */
+		instance = 0x40;
+	} else {
+		ret = nouveau_gpuobj_instance_get(dev, chan, gpuobj, &instance);
+		if (ret)
+			return ret;
+	}
+
+	ref = kzalloc(sizeof(*ref), GFP_KERNEL);
+	if (!ref)
+		return -ENOMEM;
+	INIT_LIST_HEAD(&ref->list);
+	ref->gpuobj   = gpuobj;
+	ref->channel  = chan;
+	ref->instance = instance;
+
+	if (!ref_ret) {
+		ref->handle = handle;
+
+		ret = nouveau_ramht_insert(dev, ref);
+		if (ret) {
+			kfree(ref);
+			return ret;
+		}
+	} else {
+		ref->handle = ~0;
+		*ref_ret = ref;
+	}
+
+	ref->gpuobj->refcount++;
+	return 0;
+}
+
+int nouveau_gpuobj_ref_del(struct drm_device *dev, struct nouveau_gpuobj_ref **pref)
+{
+	struct nouveau_gpuobj_ref *ref;
+
+	NV_DEBUG(dev, "ref %p\n", pref ? *pref : NULL);
+
+	if (!dev || !pref || *pref == NULL)
+		return -EINVAL;
+	ref = *pref;
+
+	if (ref->handle != ~0)
+		nouveau_ramht_remove(dev, ref);
+
+	if (ref->gpuobj) {
+		ref->gpuobj->refcount--;
+
+		if (ref->gpuobj->refcount == 0) {
+			if (!(ref->gpuobj->flags & NVOBJ_FLAG_ALLOW_NO_REFS))
+				nouveau_gpuobj_del(dev, &ref->gpuobj);
+		}
+	}
+
+	*pref = NULL;
+	kfree(ref);
+	return 0;
+}
+
+int
+nouveau_gpuobj_new_ref(struct drm_device *dev,
+		       struct nouveau_channel *oc, struct nouveau_channel *rc,
+		       uint32_t handle, uint32_t size, int align,
+		       uint32_t flags, struct nouveau_gpuobj_ref **ref)
+{
+	struct nouveau_gpuobj *gpuobj = NULL;
+	int ret;
+
+	ret = nouveau_gpuobj_new(dev, oc, size, align, flags, &gpuobj);
+	if (ret)
+		return ret;
+
+	ret = nouveau_gpuobj_ref_add(dev, rc, handle, gpuobj, ref);
+	if (ret) {
+		nouveau_gpuobj_del(dev, &gpuobj);
+		return ret;
+	}
+
+	return 0;
+}
+
+int
+nouveau_gpuobj_ref_find(struct nouveau_channel *chan, uint32_t handle,
+			struct nouveau_gpuobj_ref **ref_ret)
+{
+	struct nouveau_gpuobj_ref *ref;
+	struct list_head *entry, *tmp;
+
+	list_for_each_safe(entry, tmp, &chan->ramht_refs) {
+		ref = list_entry(entry, struct nouveau_gpuobj_ref, list);
+
+		if (ref->handle == handle) {
+			if (ref_ret)
+				*ref_ret = ref;
+			return 0;
+		}
+	}
+
+	return -EINVAL;
+}
+
+int
+nouveau_gpuobj_new_fake(struct drm_device *dev, uint32_t p_offset,
+			uint32_t b_offset, uint32_t size,
+			uint32_t flags, struct nouveau_gpuobj **pgpuobj,
+			struct nouveau_gpuobj_ref **pref)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_gpuobj *gpuobj = NULL;
+	int i;
+
+	NV_DEBUG(dev,
+		 "p_offset=0x%08x b_offset=0x%08x size=0x%08x flags=0x%08x\n",
+		 p_offset, b_offset, size, flags);
+
+	gpuobj = kzalloc(sizeof(*gpuobj), GFP_KERNEL);
+	if (!gpuobj)
+		return -ENOMEM;
+	NV_DEBUG(dev, "gpuobj %p\n", gpuobj);
+	gpuobj->im_channel = NULL;
+	gpuobj->flags      = flags | NVOBJ_FLAG_FAKE;
+
+	list_add_tail(&gpuobj->list, &dev_priv->gpuobj_list);
+
+	if (p_offset != ~0) {
+		gpuobj->im_pramin = kzalloc(sizeof(struct mem_block),
+					    GFP_KERNEL);
+		if (!gpuobj->im_pramin) {
+			nouveau_gpuobj_del(dev, &gpuobj);
+			return -ENOMEM;
+		}
+		gpuobj->im_pramin->start = p_offset;
+		gpuobj->im_pramin->size  = size;
+	}
+
+	if (b_offset != ~0) {
+		gpuobj->im_backing = (struct nouveau_bo *)-1;
+		gpuobj->im_backing_start = b_offset;
+	}
+
+	if (gpuobj->flags & NVOBJ_FLAG_ZERO_ALLOC) {
+		dev_priv->engine.instmem.prepare_access(dev, true);
+		for (i = 0; i < gpuobj->im_pramin->size; i += 4)
+			nv_wo32(dev, gpuobj, i/4, 0);
+		dev_priv->engine.instmem.finish_access(dev);
+	}
+
+	if (pref) {
+		i = nouveau_gpuobj_ref_add(dev, NULL, 0, gpuobj, pref);
+		if (i) {
+			nouveau_gpuobj_del(dev, &gpuobj);
+			return i;
+		}
+	}
+
+	if (pgpuobj)
+		*pgpuobj = gpuobj;
+	return 0;
+}
+
+
+static uint32_t
+nouveau_gpuobj_class_instmem_size(struct drm_device *dev, int class)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+
+	/*XXX: dodgy hack for now */
+	if (dev_priv->card_type >= NV_50)
+		return 24;
+	if (dev_priv->card_type >= NV_40)
+		return 32;
+	return 16;
+}
+
+/*
+   DMA objects are used to reference a piece of memory in the
+   framebuffer, PCI or AGP address space. Each object is 16 bytes big
+   and looks as follows:
+
+   entry[0]
+   11:0  class (seems like I can always use 0 here)
+   12    page table present?
+   13    page entry linear?
+   15:14 access: 0 rw, 1 ro, 2 wo
+   17:16 target: 0 NV memory, 1 NV memory tiled, 2 PCI, 3 AGP
+   31:20 dma adjust (bits 0-11 of the address)
+   entry[1]
+   dma limit (size of transfer)
+   entry[X]
+   1     0 readonly, 1 readwrite
+   31:12 dma frame address of the page (bits 12-31 of the address)
+   entry[N]
+   page table terminator, same value as the first pte, as does nvidia
+   rivatv uses 0xffffffff
+
+   Non linear page tables need a list of frame addresses afterwards,
+   the rivatv project has some info on this.
+
+   The method below creates a DMA object in instance RAM and returns a handle
+   to it that can be used to set up context objects.
+*/
+int
+nouveau_gpuobj_dma_new(struct nouveau_channel *chan, int class,
+		       uint64_t offset, uint64_t size, int access,
+		       int target, struct nouveau_gpuobj **gpuobj)
+{
+	struct drm_device *dev = chan->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_instmem_engine *instmem = &dev_priv->engine.instmem;
+	int ret;
+
+	NV_DEBUG(dev, "ch%d class=0x%04x offset=0x%llx size=0x%llx\n",
+		 chan->id, class, offset, size);
+	NV_DEBUG(dev, "access=%d target=%d\n", access, target);
+
+	switch (target) {
+	case NV_DMA_TARGET_AGP:
+		offset += dev_priv->gart_info.aper_base;
+		break;
+	default:
+		break;
+	}
+
+	ret = nouveau_gpuobj_new(dev, chan,
+				 nouveau_gpuobj_class_instmem_size(dev, class),
+				 16, NVOBJ_FLAG_ZERO_ALLOC |
+				 NVOBJ_FLAG_ZERO_FREE, gpuobj);
+	if (ret) {
+		NV_ERROR(dev, "Error creating gpuobj: %d\n", ret);
+		return ret;
+	}
+
+	instmem->prepare_access(dev, true);
+
+	if (dev_priv->card_type < NV_50) {
+		uint32_t frame, adjust, pte_flags = 0;
+
+		if (access != NV_DMA_ACCESS_RO)
+			pte_flags |= (1<<1);
+		adjust = offset &  0x00000fff;
+		frame  = offset & ~0x00000fff;
+
+		nv_wo32(dev, *gpuobj, 0, ((1<<12) | (1<<13) |
+				(adjust << 20) |
+				 (access << 14) |
+				 (target << 16) |
+				  class));
+		nv_wo32(dev, *gpuobj, 1, size - 1);
+		nv_wo32(dev, *gpuobj, 2, frame | pte_flags);
+		nv_wo32(dev, *gpuobj, 3, frame | pte_flags);
+	} else {
+		uint64_t limit = offset + size - 1;
+		uint32_t flags0, flags5;
+
+		if (target == NV_DMA_TARGET_VIDMEM) {
+			flags0 = 0x00190000;
+			flags5 = 0x00010000;
+		} else {
+			flags0 = 0x7fc00000;
+			flags5 = 0x00080000;
+		}
+
+		nv_wo32(dev, *gpuobj, 0, flags0 | class);
+		nv_wo32(dev, *gpuobj, 1, lower_32_bits(limit));
+		nv_wo32(dev, *gpuobj, 2, lower_32_bits(offset));
+		nv_wo32(dev, *gpuobj, 3, ((upper_32_bits(limit) & 0xff) << 24) |
+					(upper_32_bits(offset) & 0xff));
+		nv_wo32(dev, *gpuobj, 5, flags5);
+	}
+
+	instmem->finish_access(dev);
+
+	(*gpuobj)->engine = NVOBJ_ENGINE_SW;
+	(*gpuobj)->class  = class;
+	return 0;
+}
+
+int
+nouveau_gpuobj_gart_dma_new(struct nouveau_channel *chan,
+			    uint64_t offset, uint64_t size, int access,
+			    struct nouveau_gpuobj **gpuobj,
+			    uint32_t *o_ret)
+{
+	struct drm_device *dev = chan->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	int ret;
+
+	if (dev_priv->gart_info.type == NOUVEAU_GART_AGP ||
+	    (dev_priv->card_type >= NV_50 &&
+	     dev_priv->gart_info.type == NOUVEAU_GART_SGDMA)) {
+		ret = nouveau_gpuobj_dma_new(chan, NV_CLASS_DMA_IN_MEMORY,
+					     offset + dev_priv->vm_gart_base,
+					     size, access, NV_DMA_TARGET_AGP,
+					     gpuobj);
+		if (o_ret)
+			*o_ret = 0;
+	} else
+	if (dev_priv->gart_info.type == NOUVEAU_GART_SGDMA) {
+		*gpuobj = dev_priv->gart_info.sg_ctxdma;
+		if (offset & ~0xffffffffULL) {
+			NV_ERROR(dev, "obj offset exceeds 32-bits\n");
+			return -EINVAL;
+		}
+		if (o_ret)
+			*o_ret = (uint32_t)offset;
+		ret = (*gpuobj != NULL) ? 0 : -EINVAL;
+	} else {
+		NV_ERROR(dev, "Invalid GART type %d\n", dev_priv->gart_info.type);
+		return -EINVAL;
+	}
+
+	return ret;
+}
+
+/* Context objects in the instance RAM have the following structure.
+ * On NV40 they are 32 byte long, on NV30 and smaller 16 bytes.
+
+   NV4 - NV30:
+
+   entry[0]
+   11:0 class
+   12   chroma key enable
+   13   user clip enable
+   14   swizzle enable
+   17:15 patch config:
+       scrcopy_and, rop_and, blend_and, scrcopy, srccopy_pre, blend_pre
+   18   synchronize enable
+   19   endian: 1 big, 0 little
+   21:20 dither mode
+   23    single step enable
+   24    patch status: 0 invalid, 1 valid
+   25    context_surface 0: 1 valid
+   26    context surface 1: 1 valid
+   27    context pattern: 1 valid
+   28    context rop: 1 valid
+   29,30 context beta, beta4
+   entry[1]
+   7:0   mono format
+   15:8  color format
+   31:16 notify instance address
+   entry[2]
+   15:0  dma 0 instance address
+   31:16 dma 1 instance address
+   entry[3]
+   dma method traps
+
+   NV40:
+   No idea what the exact format is. Here's what can be deducted:
+
+   entry[0]:
+   11:0  class  (maybe uses more bits here?)
+   17    user clip enable
+   21:19 patch config
+   25    patch status valid ?
+   entry[1]:
+   15:0  DMA notifier  (maybe 20:0)
+   entry[2]:
+   15:0  DMA 0 instance (maybe 20:0)
+   24    big endian
+   entry[3]:
+   15:0  DMA 1 instance (maybe 20:0)
+   entry[4]:
+   entry[5]:
+   set to 0?
+*/
+int
+nouveau_gpuobj_gr_new(struct nouveau_channel *chan, int class,
+		      struct nouveau_gpuobj **gpuobj)
+{
+	struct drm_device *dev = chan->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	int ret;
+
+	NV_DEBUG(dev, "ch%d class=0x%04x\n", chan->id, class);
+
+	ret = nouveau_gpuobj_new(dev, chan,
+				 nouveau_gpuobj_class_instmem_size(dev, class),
+				 16,
+				 NVOBJ_FLAG_ZERO_ALLOC | NVOBJ_FLAG_ZERO_FREE,
+				 gpuobj);
+	if (ret) {
+		NV_ERROR(dev, "Error creating gpuobj: %d\n", ret);
+		return ret;
+	}
+
+	dev_priv->engine.instmem.prepare_access(dev, true);
+	if (dev_priv->card_type >= NV_50) {
+		nv_wo32(dev, *gpuobj, 0, class);
+		nv_wo32(dev, *gpuobj, 5, 0x00010000);
+	} else {
+		switch (class) {
+		case NV_CLASS_NULL:
+			nv_wo32(dev, *gpuobj, 0, 0x00001030);
+			nv_wo32(dev, *gpuobj, 1, 0xFFFFFFFF);
+			break;
+		default:
+			if (dev_priv->card_type >= NV_40) {
+				nv_wo32(dev, *gpuobj, 0, class);
+#ifdef __BIG_ENDIAN
+				nv_wo32(dev, *gpuobj, 2, 0x01000000);
+#endif
+			} else {
+#ifdef __BIG_ENDIAN
+				nv_wo32(dev, *gpuobj, 0, class | 0x00080000);
+#else
+				nv_wo32(dev, *gpuobj, 0, class);
+#endif
+			}
+		}
+	}
+	dev_priv->engine.instmem.finish_access(dev);
+
+	(*gpuobj)->engine = NVOBJ_ENGINE_GR;
+	(*gpuobj)->class  = class;
+	return 0;
+}
+
+int
+nouveau_gpuobj_sw_new(struct nouveau_channel *chan, int class,
+		      struct nouveau_gpuobj **gpuobj_ret)
+{
+	struct drm_nouveau_private *dev_priv = chan->dev->dev_private;
+	struct nouveau_gpuobj *gpuobj;
+
+	if (!chan || !gpuobj_ret || *gpuobj_ret != NULL)
+		return -EINVAL;
+
+	gpuobj = kzalloc(sizeof(*gpuobj), GFP_KERNEL);
+	if (!gpuobj)
+		return -ENOMEM;
+	gpuobj->engine = NVOBJ_ENGINE_SW;
+	gpuobj->class = class;
+
+	list_add_tail(&gpuobj->list, &dev_priv->gpuobj_list);
+	*gpuobj_ret = gpuobj;
+	return 0;
+}
+
+static int
+nouveau_gpuobj_channel_init_pramin(struct nouveau_channel *chan)
+{
+	struct drm_device *dev = chan->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_gpuobj *pramin = NULL;
+	uint32_t size;
+	uint32_t base;
+	int ret;
+
+	NV_DEBUG(dev, "ch%d\n", chan->id);
+
+	/* Base amount for object storage (4KiB enough?) */
+	size = 0x1000;
+	base = 0;
+
+	/* PGRAPH context */
+
+	if (dev_priv->card_type == NV_50) {
+		/* Various fixed table thingos */
+		size += 0x1400; /* mostly unknown stuff */
+		size += 0x4000; /* vm pd */
+		base  = 0x6000;
+		/* RAMHT, not sure about setting size yet, 32KiB to be safe */
+		size += 0x8000;
+		/* RAMFC */
+		size += 0x1000;
+		/* PGRAPH context */
+		size += 0x70000;
+	}
+
+	NV_DEBUG(dev, "ch%d PRAMIN size: 0x%08x bytes, base alloc=0x%08x\n",
+		 chan->id, size, base);
+	ret = nouveau_gpuobj_new_ref(dev, NULL, NULL, 0, size, 0x1000, 0,
+				     &chan->ramin);
+	if (ret) {
+		NV_ERROR(dev, "Error allocating channel PRAMIN: %d\n", ret);
+		return ret;
+	}
+	pramin = chan->ramin->gpuobj;
+
+	ret = nouveau_mem_init_heap(&chan->ramin_heap,
+				    pramin->im_pramin->start + base, size);
+	if (ret) {
+		NV_ERROR(dev, "Error creating PRAMIN heap: %d\n", ret);
+		nouveau_gpuobj_ref_del(dev, &chan->ramin);
+		return ret;
+	}
+
+	return 0;
+}
+
+int
+nouveau_gpuobj_channel_init(struct nouveau_channel *chan,
+			    uint32_t vram_h, uint32_t tt_h)
+{
+	struct drm_device *dev = chan->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_instmem_engine *instmem = &dev_priv->engine.instmem;
+	struct nouveau_gpuobj *vram = NULL, *tt = NULL;
+	int ret, i;
+
+	INIT_LIST_HEAD(&chan->ramht_refs);
+
+	NV_DEBUG(dev, "ch%d vram=0x%08x tt=0x%08x\n", chan->id, vram_h, tt_h);
+
+	/* Reserve a block of PRAMIN for the channel
+	 *XXX: maybe on <NV50 too at some point
+	 */
+	if (0 || dev_priv->card_type == NV_50) {
+		ret = nouveau_gpuobj_channel_init_pramin(chan);
+		if (ret) {
+			NV_ERROR(dev, "init pramin\n");
+			return ret;
+		}
+	}
+
+	/* NV50 VM
+	 *  - Allocate per-channel page-directory
+	 *  - Map GART and VRAM into the channel's address space at the
+	 *    locations determined during init.
+	 */
+	if (dev_priv->card_type >= NV_50) {
+		uint32_t vm_offset, pde;
+
+		instmem->prepare_access(dev, true);
+
+		vm_offset = (dev_priv->chipset & 0xf0) == 0x50 ? 0x1400 : 0x200;
+		vm_offset += chan->ramin->gpuobj->im_pramin->start;
+
+		ret = nouveau_gpuobj_new_fake(dev, vm_offset, ~0, 0x4000,
+							0, &chan->vm_pd, NULL);
+		if (ret) {
+			instmem->finish_access(dev);
+			return ret;
+		}
+		for (i = 0; i < 0x4000; i += 8) {
+			nv_wo32(dev, chan->vm_pd, (i+0)/4, 0x00000000);
+			nv_wo32(dev, chan->vm_pd, (i+4)/4, 0xdeadcafe);
+		}
+
+		pde = (dev_priv->vm_gart_base / (512*1024*1024)) * 2;
+		ret = nouveau_gpuobj_ref_add(dev, NULL, 0,
+					     dev_priv->gart_info.sg_ctxdma,
+					     &chan->vm_gart_pt);
+		if (ret) {
+			instmem->finish_access(dev);
+			return ret;
+		}
+		nv_wo32(dev, chan->vm_pd, pde++,
+			    chan->vm_gart_pt->instance | 0x03);
+		nv_wo32(dev, chan->vm_pd, pde++, 0x00000000);
+
+		pde = (dev_priv->vm_vram_base / (512*1024*1024)) * 2;
+		for (i = 0; i < dev_priv->vm_vram_pt_nr; i++) {
+			ret = nouveau_gpuobj_ref_add(dev, NULL, 0,
+						     dev_priv->vm_vram_pt[i],
+						     &chan->vm_vram_pt[i]);
+			if (ret) {
+				instmem->finish_access(dev);
+				return ret;
+			}
+
+			nv_wo32(dev, chan->vm_pd, pde++,
+				    chan->vm_vram_pt[i]->instance | 0x61);
+			nv_wo32(dev, chan->vm_pd, pde++, 0x00000000);
+		}
+
+		instmem->finish_access(dev);
+	}
+
+	/* RAMHT */
+	if (dev_priv->card_type < NV_50) {
+		ret = nouveau_gpuobj_ref_add(dev, NULL, 0, dev_priv->ramht,
+					     &chan->ramht);
+		if (ret)
+			return ret;
+	} else {
+		ret = nouveau_gpuobj_new_ref(dev, chan, chan, 0,
+					     0x8000, 16,
+					     NVOBJ_FLAG_ZERO_ALLOC,
+					     &chan->ramht);
+		if (ret)
+			return ret;
+	}
+
+	/* VRAM ctxdma */
+	if (dev_priv->card_type >= NV_50) {
+		ret = nouveau_gpuobj_dma_new(chan, NV_CLASS_DMA_IN_MEMORY,
+					     0, dev_priv->vm_end,
+					     NV_DMA_ACCESS_RW,
+					     NV_DMA_TARGET_AGP, &vram);
+		if (ret) {
+			NV_ERROR(dev, "Error creating VRAM ctxdma: %d\n", ret);
+			return ret;
+		}
+	} else {
+		ret = nouveau_gpuobj_dma_new(chan, NV_CLASS_DMA_IN_MEMORY,
+						0, dev_priv->fb_available_size,
+						NV_DMA_ACCESS_RW,
+						NV_DMA_TARGET_VIDMEM, &vram);
+		if (ret) {
+			NV_ERROR(dev, "Error creating VRAM ctxdma: %d\n", ret);
+			return ret;
+		}
+	}
+
+	ret = nouveau_gpuobj_ref_add(dev, chan, vram_h, vram, NULL);
+	if (ret) {
+		NV_ERROR(dev, "Error referencing VRAM ctxdma: %d\n", ret);
+		return ret;
+	}
+
+	/* TT memory ctxdma */
+	if (dev_priv->card_type >= NV_50) {
+		tt = vram;
+	} else
+	if (dev_priv->gart_info.type != NOUVEAU_GART_NONE) {
+		ret = nouveau_gpuobj_gart_dma_new(chan, 0,
+						  dev_priv->gart_info.aper_size,
+						  NV_DMA_ACCESS_RW, &tt, NULL);
+	} else {
+		NV_ERROR(dev, "Invalid GART type %d\n", dev_priv->gart_info.type);
+		ret = -EINVAL;
+	}
+
+	if (ret) {
+		NV_ERROR(dev, "Error creating TT ctxdma: %d\n", ret);
+		return ret;
+	}
+
+	ret = nouveau_gpuobj_ref_add(dev, chan, tt_h, tt, NULL);
+	if (ret) {
+		NV_ERROR(dev, "Error referencing TT ctxdma: %d\n", ret);
+		return ret;
+	}
+
+	return 0;
+}
+
+void
+nouveau_gpuobj_channel_takedown(struct nouveau_channel *chan)
+{
+	struct drm_nouveau_private *dev_priv = chan->dev->dev_private;
+	struct drm_device *dev = chan->dev;
+	struct list_head *entry, *tmp;
+	struct nouveau_gpuobj_ref *ref;
+	int i;
+
+	NV_DEBUG(dev, "ch%d\n", chan->id);
+
+	if (!chan->ramht_refs.next)
+		return;
+
+	list_for_each_safe(entry, tmp, &chan->ramht_refs) {
+		ref = list_entry(entry, struct nouveau_gpuobj_ref, list);
+
+		nouveau_gpuobj_ref_del(dev, &ref);
+	}
+
+	nouveau_gpuobj_ref_del(dev, &chan->ramht);
+
+	nouveau_gpuobj_del(dev, &chan->vm_pd);
+	nouveau_gpuobj_ref_del(dev, &chan->vm_gart_pt);
+	for (i = 0; i < dev_priv->vm_vram_pt_nr; i++)
+		nouveau_gpuobj_ref_del(dev, &chan->vm_vram_pt[i]);
+
+	if (chan->ramin_heap)
+		nouveau_mem_takedown(&chan->ramin_heap);
+	if (chan->ramin)
+		nouveau_gpuobj_ref_del(dev, &chan->ramin);
+
+}
+
+int
+nouveau_gpuobj_suspend(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_gpuobj *gpuobj;
+	int i;
+
+	if (dev_priv->card_type < NV_50) {
+		dev_priv->susres.ramin_copy = vmalloc(dev_priv->ramin_rsvd_vram);
+		if (!dev_priv->susres.ramin_copy)
+			return -ENOMEM;
+
+		for (i = 0; i < dev_priv->ramin_rsvd_vram; i += 4)
+			dev_priv->susres.ramin_copy[i/4] = nv_ri32(dev, i);
+		return 0;
+	}
+
+	list_for_each_entry(gpuobj, &dev_priv->gpuobj_list, list) {
+		if (!gpuobj->im_backing || (gpuobj->flags & NVOBJ_FLAG_FAKE))
+			continue;
+
+		gpuobj->im_backing_suspend = vmalloc(gpuobj->im_pramin->size);
+		if (!gpuobj->im_backing_suspend) {
+			nouveau_gpuobj_resume(dev);
+			return -ENOMEM;
+		}
+
+		dev_priv->engine.instmem.prepare_access(dev, false);
+		for (i = 0; i < gpuobj->im_pramin->size / 4; i++)
+			gpuobj->im_backing_suspend[i] = nv_ro32(dev, gpuobj, i);
+		dev_priv->engine.instmem.finish_access(dev);
+	}
+
+	return 0;
+}
+
+void
+nouveau_gpuobj_suspend_cleanup(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_gpuobj *gpuobj;
+
+	if (dev_priv->card_type < NV_50) {
+		vfree(dev_priv->susres.ramin_copy);
+		dev_priv->susres.ramin_copy = NULL;
+		return;
+	}
+
+	list_for_each_entry(gpuobj, &dev_priv->gpuobj_list, list) {
+		if (!gpuobj->im_backing_suspend)
+			continue;
+
+		vfree(gpuobj->im_backing_suspend);
+		gpuobj->im_backing_suspend = NULL;
+	}
+}
+
+void
+nouveau_gpuobj_resume(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_gpuobj *gpuobj;
+	int i;
+
+	if (dev_priv->card_type < NV_50) {
+		for (i = 0; i < dev_priv->ramin_rsvd_vram; i += 4)
+			nv_wi32(dev, i, dev_priv->susres.ramin_copy[i/4]);
+		nouveau_gpuobj_suspend_cleanup(dev);
+		return;
+	}
+
+	list_for_each_entry(gpuobj, &dev_priv->gpuobj_list, list) {
+		if (!gpuobj->im_backing_suspend)
+			continue;
+
+		dev_priv->engine.instmem.prepare_access(dev, true);
+		for (i = 0; i < gpuobj->im_pramin->size / 4; i++)
+			nv_wo32(dev, gpuobj, i, gpuobj->im_backing_suspend[i]);
+		dev_priv->engine.instmem.finish_access(dev);
+	}
+
+	nouveau_gpuobj_suspend_cleanup(dev);
+}
+
+int nouveau_ioctl_grobj_alloc(struct drm_device *dev, void *data,
+			      struct drm_file *file_priv)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct drm_nouveau_grobj_alloc *init = data;
+	struct nouveau_pgraph_engine *pgraph = &dev_priv->engine.graph;
+	struct nouveau_pgraph_object_class *grc;
+	struct nouveau_gpuobj *gr = NULL;
+	struct nouveau_channel *chan;
+	int ret;
+
+	NOUVEAU_CHECK_INITIALISED_WITH_RETURN;
+	NOUVEAU_GET_USER_CHANNEL_WITH_RETURN(init->channel, file_priv, chan);
+
+	if (init->handle == ~0)
+		return -EINVAL;
+
+	grc = pgraph->grclass;
+	while (grc->id) {
+		if (grc->id == init->class)
+			break;
+		grc++;
+	}
+
+	if (!grc->id) {
+		NV_ERROR(dev, "Illegal object class: 0x%x\n", init->class);
+		return -EPERM;
+	}
+
+	if (nouveau_gpuobj_ref_find(chan, init->handle, NULL) == 0)
+		return -EEXIST;
+
+	if (!grc->software)
+		ret = nouveau_gpuobj_gr_new(chan, grc->id, &gr);
+	else
+		ret = nouveau_gpuobj_sw_new(chan, grc->id, &gr);
+
+	if (ret) {
+		NV_ERROR(dev, "Error creating object: %d (%d/0x%08x)\n",
+			 ret, init->channel, init->handle);
+		return ret;
+	}
+
+	ret = nouveau_gpuobj_ref_add(dev, chan, init->handle, gr, NULL);
+	if (ret) {
+		NV_ERROR(dev, "Error referencing object: %d (%d/0x%08x)\n",
+			 ret, init->channel, init->handle);
+		nouveau_gpuobj_del(dev, &gr);
+		return ret;
+	}
+
+	return 0;
+}
+
+int nouveau_ioctl_gpuobj_free(struct drm_device *dev, void *data,
+			      struct drm_file *file_priv)
+{
+	struct drm_nouveau_gpuobj_free *objfree = data;
+	struct nouveau_gpuobj_ref *ref;
+	struct nouveau_channel *chan;
+	int ret;
+
+	NOUVEAU_CHECK_INITIALISED_WITH_RETURN;
+	NOUVEAU_GET_USER_CHANNEL_WITH_RETURN(objfree->channel, file_priv, chan);
+
+	ret = nouveau_gpuobj_ref_find(chan, objfree->handle, &ref);
+	if (ret)
+		return ret;
+	nouveau_gpuobj_ref_del(dev, &ref);
+
+	return 0;
+}
diff --git a/drivers/gpu/drm/nouveau/nouveau_reg.h b/drivers/gpu/drm/nouveau/nouveau_reg.h
new file mode 100644
index 000000000000..251f1b3b38b9
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nouveau_reg.h
@@ -0,0 +1,836 @@
+
+
+#define NV03_BOOT_0                                        0x00100000
+#    define NV03_BOOT_0_RAM_AMOUNT                         0x00000003
+#    define NV03_BOOT_0_RAM_AMOUNT_8MB                     0x00000000
+#    define NV03_BOOT_0_RAM_AMOUNT_2MB                     0x00000001
+#    define NV03_BOOT_0_RAM_AMOUNT_4MB                     0x00000002
+#    define NV03_BOOT_0_RAM_AMOUNT_8MB_SDRAM               0x00000003
+#    define NV04_BOOT_0_RAM_AMOUNT_32MB                    0x00000000
+#    define NV04_BOOT_0_RAM_AMOUNT_4MB                     0x00000001
+#    define NV04_BOOT_0_RAM_AMOUNT_8MB                     0x00000002
+#    define NV04_BOOT_0_RAM_AMOUNT_16MB                    0x00000003
+
+#define NV04_FIFO_DATA                                     0x0010020c
+#    define NV10_FIFO_DATA_RAM_AMOUNT_MB_MASK              0xfff00000
+#    define NV10_FIFO_DATA_RAM_AMOUNT_MB_SHIFT             20
+
+#define NV_RAMIN                                           0x00700000
+
+#define NV_RAMHT_HANDLE_OFFSET                             0
+#define NV_RAMHT_CONTEXT_OFFSET                            4
+#    define NV_RAMHT_CONTEXT_VALID                         (1<<31)
+#    define NV_RAMHT_CONTEXT_CHANNEL_SHIFT                 24
+#    define NV_RAMHT_CONTEXT_ENGINE_SHIFT                  16
+#        define NV_RAMHT_CONTEXT_ENGINE_SOFTWARE           0
+#        define NV_RAMHT_CONTEXT_ENGINE_GRAPHICS           1
+#    define NV_RAMHT_CONTEXT_INSTANCE_SHIFT                0
+#    define NV40_RAMHT_CONTEXT_CHANNEL_SHIFT               23
+#    define NV40_RAMHT_CONTEXT_ENGINE_SHIFT                20
+#    define NV40_RAMHT_CONTEXT_INSTANCE_SHIFT              0
+
+/* DMA object defines */
+#define NV_DMA_ACCESS_RW 0
+#define NV_DMA_ACCESS_RO 1
+#define NV_DMA_ACCESS_WO 2
+#define NV_DMA_TARGET_VIDMEM 0
+#define NV_DMA_TARGET_PCI    2
+#define NV_DMA_TARGET_AGP    3
+/* The following is not a real value used by the card, it's changed by
+ * nouveau_object_dma_create */
+#define NV_DMA_TARGET_PCI_NONLINEAR 8
+
+/* Some object classes we care about in the drm */
+#define NV_CLASS_DMA_FROM_MEMORY                           0x00000002
+#define NV_CLASS_DMA_TO_MEMORY                             0x00000003
+#define NV_CLASS_NULL                                      0x00000030
+#define NV_CLASS_DMA_IN_MEMORY                             0x0000003D
+
+#define NV03_USER(i)                             (0x00800000+(i*NV03_USER_SIZE))
+#define NV03_USER__SIZE                                                       16
+#define NV10_USER__SIZE                                                       32
+#define NV03_USER_SIZE                                                0x00010000
+#define NV03_USER_DMA_PUT(i)                     (0x00800040+(i*NV03_USER_SIZE))
+#define NV03_USER_DMA_PUT__SIZE                                               16
+#define NV10_USER_DMA_PUT__SIZE                                               32
+#define NV03_USER_DMA_GET(i)                     (0x00800044+(i*NV03_USER_SIZE))
+#define NV03_USER_DMA_GET__SIZE                                               16
+#define NV10_USER_DMA_GET__SIZE                                               32
+#define NV03_USER_REF_CNT(i)                     (0x00800048+(i*NV03_USER_SIZE))
+#define NV03_USER_REF_CNT__SIZE                                               16
+#define NV10_USER_REF_CNT__SIZE                                               32
+
+#define NV40_USER(i)                             (0x00c00000+(i*NV40_USER_SIZE))
+#define NV40_USER_SIZE                                                0x00001000
+#define NV40_USER_DMA_PUT(i)                     (0x00c00040+(i*NV40_USER_SIZE))
+#define NV40_USER_DMA_PUT__SIZE                                               32
+#define NV40_USER_DMA_GET(i)                     (0x00c00044+(i*NV40_USER_SIZE))
+#define NV40_USER_DMA_GET__SIZE                                               32
+#define NV40_USER_REF_CNT(i)                     (0x00c00048+(i*NV40_USER_SIZE))
+#define NV40_USER_REF_CNT__SIZE                                               32
+
+#define NV50_USER(i)                             (0x00c00000+(i*NV50_USER_SIZE))
+#define NV50_USER_SIZE                                                0x00002000
+#define NV50_USER_DMA_PUT(i)                     (0x00c00040+(i*NV50_USER_SIZE))
+#define NV50_USER_DMA_PUT__SIZE                                              128
+#define NV50_USER_DMA_GET(i)                     (0x00c00044+(i*NV50_USER_SIZE))
+#define NV50_USER_DMA_GET__SIZE                                              128
+#define NV50_USER_REF_CNT(i)                     (0x00c00048+(i*NV50_USER_SIZE))
+#define NV50_USER_REF_CNT__SIZE                                              128
+
+#define NV03_FIFO_SIZE                                     0x8000UL
+
+#define NV03_PMC_BOOT_0                                    0x00000000
+#define NV03_PMC_BOOT_1                                    0x00000004
+#define NV03_PMC_INTR_0                                    0x00000100
+#    define NV_PMC_INTR_0_PFIFO_PENDING                        (1<<8)
+#    define NV_PMC_INTR_0_PGRAPH_PENDING                      (1<<12)
+#    define NV_PMC_INTR_0_NV50_I2C_PENDING                    (1<<21)
+#    define NV_PMC_INTR_0_CRTC0_PENDING                       (1<<24)
+#    define NV_PMC_INTR_0_CRTC1_PENDING                       (1<<25)
+#    define NV_PMC_INTR_0_NV50_DISPLAY_PENDING                (1<<26)
+#    define NV_PMC_INTR_0_CRTCn_PENDING                       (3<<24)
+#define NV03_PMC_INTR_EN_0                                 0x00000140
+#    define NV_PMC_INTR_EN_0_MASTER_ENABLE                     (1<<0)
+#define NV03_PMC_ENABLE                                    0x00000200
+#    define NV_PMC_ENABLE_PFIFO                                (1<<8)
+#    define NV_PMC_ENABLE_PGRAPH                              (1<<12)
+/* Disabling the below bit breaks newer (G7X only?) mobile chipsets,
+ * the card will hang early on in the X init process.
+ */
+#    define NV_PMC_ENABLE_UNK13                               (1<<13)
+#define NV40_PMC_BACKLIGHT				   0x000015f0
+#	define NV40_PMC_BACKLIGHT_MASK			   0x001f0000
+#define NV40_PMC_1700                                      0x00001700
+#define NV40_PMC_1704                                      0x00001704
+#define NV40_PMC_1708                                      0x00001708
+#define NV40_PMC_170C                                      0x0000170C
+
+/* probably PMC ? */
+#define NV50_PUNK_BAR0_PRAMIN                              0x00001700
+#define NV50_PUNK_BAR_CFG_BASE                             0x00001704
+#define NV50_PUNK_BAR_CFG_BASE_VALID                          (1<<30)
+#define NV50_PUNK_BAR1_CTXDMA                              0x00001708
+#define NV50_PUNK_BAR1_CTXDMA_VALID                           (1<<31)
+#define NV50_PUNK_BAR3_CTXDMA                              0x0000170C
+#define NV50_PUNK_BAR3_CTXDMA_VALID                           (1<<31)
+#define NV50_PUNK_UNK1710                                  0x00001710
+
+#define NV04_PBUS_PCI_NV_1                                 0x00001804
+#define NV04_PBUS_PCI_NV_19                                0x0000184C
+#define NV04_PBUS_PCI_NV_20				0x00001850
+#	define NV04_PBUS_PCI_NV_20_ROM_SHADOW_DISABLED		(0 << 0)
+#	define NV04_PBUS_PCI_NV_20_ROM_SHADOW_ENABLED		(1 << 0)
+
+#define NV04_PTIMER_INTR_0                                 0x00009100
+#define NV04_PTIMER_INTR_EN_0                              0x00009140
+#define NV04_PTIMER_NUMERATOR                              0x00009200
+#define NV04_PTIMER_DENOMINATOR                            0x00009210
+#define NV04_PTIMER_TIME_0                                 0x00009400
+#define NV04_PTIMER_TIME_1                                 0x00009410
+#define NV04_PTIMER_ALARM_0                                0x00009420
+
+#define NV04_PFB_CFG0                                      0x00100200
+#define NV04_PFB_CFG1                                      0x00100204
+#define NV40_PFB_020C                                      0x0010020C
+#define NV10_PFB_TILE(i)                                   (0x00100240 + (i*16))
+#define NV10_PFB_TILE__SIZE                                8
+#define NV10_PFB_TLIMIT(i)                                 (0x00100244 + (i*16))
+#define NV10_PFB_TSIZE(i)                                  (0x00100248 + (i*16))
+#define NV10_PFB_TSTATUS(i)                                (0x0010024C + (i*16))
+#define NV10_PFB_CLOSE_PAGE2                               0x0010033C
+#define NV40_PFB_TILE(i)                                   (0x00100600 + (i*16))
+#define NV40_PFB_TILE__SIZE_0                              12
+#define NV40_PFB_TILE__SIZE_1                              15
+#define NV40_PFB_TLIMIT(i)                                 (0x00100604 + (i*16))
+#define NV40_PFB_TSIZE(i)                                  (0x00100608 + (i*16))
+#define NV40_PFB_TSTATUS(i)                                (0x0010060C + (i*16))
+#define NV40_PFB_UNK_800					0x00100800
+
+#define NV04_PGRAPH_DEBUG_0                                0x00400080
+#define NV04_PGRAPH_DEBUG_1                                0x00400084
+#define NV04_PGRAPH_DEBUG_2                                0x00400088
+#define NV04_PGRAPH_DEBUG_3                                0x0040008c
+#define NV10_PGRAPH_DEBUG_4                                0x00400090
+#define NV03_PGRAPH_INTR                                   0x00400100
+#define NV03_PGRAPH_NSTATUS                                0x00400104
+#    define NV04_PGRAPH_NSTATUS_STATE_IN_USE                  (1<<11)
+#    define NV04_PGRAPH_NSTATUS_INVALID_STATE                 (1<<12)
+#    define NV04_PGRAPH_NSTATUS_BAD_ARGUMENT                  (1<<13)
+#    define NV04_PGRAPH_NSTATUS_PROTECTION_FAULT              (1<<14)
+#    define NV10_PGRAPH_NSTATUS_STATE_IN_USE                  (1<<23)
+#    define NV10_PGRAPH_NSTATUS_INVALID_STATE                 (1<<24)
+#    define NV10_PGRAPH_NSTATUS_BAD_ARGUMENT                  (1<<25)
+#    define NV10_PGRAPH_NSTATUS_PROTECTION_FAULT              (1<<26)
+#define NV03_PGRAPH_NSOURCE                                0x00400108
+#    define NV03_PGRAPH_NSOURCE_NOTIFICATION                   (1<<0)
+#    define NV03_PGRAPH_NSOURCE_DATA_ERROR                     (1<<1)
+#    define NV03_PGRAPH_NSOURCE_PROTECTION_ERROR               (1<<2)
+#    define NV03_PGRAPH_NSOURCE_RANGE_EXCEPTION                (1<<3)
+#    define NV03_PGRAPH_NSOURCE_LIMIT_COLOR                    (1<<4)
+#    define NV03_PGRAPH_NSOURCE_LIMIT_ZETA                     (1<<5)
+#    define NV03_PGRAPH_NSOURCE_ILLEGAL_MTHD                   (1<<6)
+#    define NV03_PGRAPH_NSOURCE_DMA_R_PROTECTION               (1<<7)
+#    define NV03_PGRAPH_NSOURCE_DMA_W_PROTECTION               (1<<8)
+#    define NV03_PGRAPH_NSOURCE_FORMAT_EXCEPTION               (1<<9)
+#    define NV03_PGRAPH_NSOURCE_PATCH_EXCEPTION               (1<<10)
+#    define NV03_PGRAPH_NSOURCE_STATE_INVALID                 (1<<11)
+#    define NV03_PGRAPH_NSOURCE_DOUBLE_NOTIFY                 (1<<12)
+#    define NV03_PGRAPH_NSOURCE_NOTIFY_IN_USE                 (1<<13)
+#    define NV03_PGRAPH_NSOURCE_METHOD_CNT                    (1<<14)
+#    define NV03_PGRAPH_NSOURCE_BFR_NOTIFICATION              (1<<15)
+#    define NV03_PGRAPH_NSOURCE_DMA_VTX_PROTECTION            (1<<16)
+#    define NV03_PGRAPH_NSOURCE_DMA_WIDTH_A                   (1<<17)
+#    define NV03_PGRAPH_NSOURCE_DMA_WIDTH_B                   (1<<18)
+#define NV03_PGRAPH_INTR_EN                                0x00400140
+#define NV40_PGRAPH_INTR_EN                                0x0040013C
+#    define NV_PGRAPH_INTR_NOTIFY                              (1<<0)
+#    define NV_PGRAPH_INTR_MISSING_HW                          (1<<4)
+#    define NV_PGRAPH_INTR_CONTEXT_SWITCH                     (1<<12)
+#    define NV_PGRAPH_INTR_BUFFER_NOTIFY                      (1<<16)
+#    define NV_PGRAPH_INTR_ERROR                              (1<<20)
+#define NV10_PGRAPH_CTX_CONTROL                            0x00400144
+#define NV10_PGRAPH_CTX_USER                               0x00400148
+#define NV10_PGRAPH_CTX_SWITCH1                            0x0040014C
+#define NV10_PGRAPH_CTX_SWITCH2                            0x00400150
+#define NV10_PGRAPH_CTX_SWITCH3                            0x00400154
+#define NV10_PGRAPH_CTX_SWITCH4                            0x00400158
+#define NV10_PGRAPH_CTX_SWITCH5                            0x0040015C
+#define NV04_PGRAPH_CTX_SWITCH1                            0x00400160
+#define NV10_PGRAPH_CTX_CACHE1                             0x00400160
+#define NV04_PGRAPH_CTX_SWITCH2                            0x00400164
+#define NV04_PGRAPH_CTX_SWITCH3                            0x00400168
+#define NV04_PGRAPH_CTX_SWITCH4                            0x0040016C
+#define NV04_PGRAPH_CTX_CONTROL                            0x00400170
+#define NV04_PGRAPH_CTX_USER                               0x00400174
+#define NV04_PGRAPH_CTX_CACHE1                             0x00400180
+#define NV10_PGRAPH_CTX_CACHE2                             0x00400180
+#define NV03_PGRAPH_CTX_CONTROL                            0x00400190
+#define NV03_PGRAPH_CTX_USER                               0x00400194
+#define NV04_PGRAPH_CTX_CACHE2                             0x004001A0
+#define NV10_PGRAPH_CTX_CACHE3                             0x004001A0
+#define NV04_PGRAPH_CTX_CACHE3                             0x004001C0
+#define NV10_PGRAPH_CTX_CACHE4                             0x004001C0
+#define NV04_PGRAPH_CTX_CACHE4                             0x004001E0
+#define NV10_PGRAPH_CTX_CACHE5                             0x004001E0
+#define NV40_PGRAPH_CTXCTL_0304                            0x00400304
+#define NV40_PGRAPH_CTXCTL_0304_XFER_CTX                   0x00000001
+#define NV40_PGRAPH_CTXCTL_UCODE_STAT                      0x00400308
+#define NV40_PGRAPH_CTXCTL_UCODE_STAT_IP_MASK              0xff000000
+#define NV40_PGRAPH_CTXCTL_UCODE_STAT_IP_SHIFT                     24
+#define NV40_PGRAPH_CTXCTL_UCODE_STAT_OP_MASK              0x00ffffff
+#define NV40_PGRAPH_CTXCTL_0310                            0x00400310
+#define NV40_PGRAPH_CTXCTL_0310_XFER_SAVE                  0x00000020
+#define NV40_PGRAPH_CTXCTL_0310_XFER_LOAD                  0x00000040
+#define NV40_PGRAPH_CTXCTL_030C                            0x0040030c
+#define NV40_PGRAPH_CTXCTL_UCODE_INDEX                     0x00400324
+#define NV40_PGRAPH_CTXCTL_UCODE_DATA                      0x00400328
+#define NV40_PGRAPH_CTXCTL_CUR                             0x0040032c
+#define NV40_PGRAPH_CTXCTL_CUR_LOADED                      0x01000000
+#define NV40_PGRAPH_CTXCTL_CUR_INSTANCE                    0x000FFFFF
+#define NV40_PGRAPH_CTXCTL_NEXT                            0x00400330
+#define NV40_PGRAPH_CTXCTL_NEXT_INSTANCE                   0x000fffff
+#define NV50_PGRAPH_CTXCTL_CUR                             0x0040032c
+#define NV50_PGRAPH_CTXCTL_CUR_LOADED                      0x80000000
+#define NV50_PGRAPH_CTXCTL_CUR_INSTANCE                    0x00ffffff
+#define NV50_PGRAPH_CTXCTL_NEXT                            0x00400330
+#define NV50_PGRAPH_CTXCTL_NEXT_INSTANCE                   0x00ffffff
+#define NV03_PGRAPH_ABS_X_RAM                              0x00400400
+#define NV03_PGRAPH_ABS_Y_RAM                              0x00400480
+#define NV03_PGRAPH_X_MISC                                 0x00400500
+#define NV03_PGRAPH_Y_MISC                                 0x00400504
+#define NV04_PGRAPH_VALID1                                 0x00400508
+#define NV04_PGRAPH_SOURCE_COLOR                           0x0040050C
+#define NV04_PGRAPH_MISC24_0                               0x00400510
+#define NV03_PGRAPH_XY_LOGIC_MISC0                         0x00400514
+#define NV03_PGRAPH_XY_LOGIC_MISC1                         0x00400518
+#define NV03_PGRAPH_XY_LOGIC_MISC2                         0x0040051C
+#define NV03_PGRAPH_XY_LOGIC_MISC3                         0x00400520
+#define NV03_PGRAPH_CLIPX_0                                0x00400524
+#define NV03_PGRAPH_CLIPX_1                                0x00400528
+#define NV03_PGRAPH_CLIPY_0                                0x0040052C
+#define NV03_PGRAPH_CLIPY_1                                0x00400530
+#define NV03_PGRAPH_ABS_ICLIP_XMAX                         0x00400534
+#define NV03_PGRAPH_ABS_ICLIP_YMAX                         0x00400538
+#define NV03_PGRAPH_ABS_UCLIP_XMIN                         0x0040053C
+#define NV03_PGRAPH_ABS_UCLIP_YMIN                         0x00400540
+#define NV03_PGRAPH_ABS_UCLIP_XMAX                         0x00400544
+#define NV03_PGRAPH_ABS_UCLIP_YMAX                         0x00400548
+#define NV03_PGRAPH_ABS_UCLIPA_XMIN                        0x00400560
+#define NV03_PGRAPH_ABS_UCLIPA_YMIN                        0x00400564
+#define NV03_PGRAPH_ABS_UCLIPA_XMAX                        0x00400568
+#define NV03_PGRAPH_ABS_UCLIPA_YMAX                        0x0040056C
+#define NV04_PGRAPH_MISC24_1                               0x00400570
+#define NV04_PGRAPH_MISC24_2                               0x00400574
+#define NV04_PGRAPH_VALID2                                 0x00400578
+#define NV04_PGRAPH_PASSTHRU_0                             0x0040057C
+#define NV04_PGRAPH_PASSTHRU_1                             0x00400580
+#define NV04_PGRAPH_PASSTHRU_2                             0x00400584
+#define NV10_PGRAPH_DIMX_TEXTURE                           0x00400588
+#define NV10_PGRAPH_WDIMX_TEXTURE                          0x0040058C
+#define NV04_PGRAPH_COMBINE_0_ALPHA                        0x00400590
+#define NV04_PGRAPH_COMBINE_0_COLOR                        0x00400594
+#define NV04_PGRAPH_COMBINE_1_ALPHA                        0x00400598
+#define NV04_PGRAPH_COMBINE_1_COLOR                        0x0040059C
+#define NV04_PGRAPH_FORMAT_0                               0x004005A8
+#define NV04_PGRAPH_FORMAT_1                               0x004005AC
+#define NV04_PGRAPH_FILTER_0                               0x004005B0
+#define NV04_PGRAPH_FILTER_1                               0x004005B4
+#define NV03_PGRAPH_MONO_COLOR0                            0x00400600
+#define NV04_PGRAPH_ROP3                                   0x00400604
+#define NV04_PGRAPH_BETA_AND                               0x00400608
+#define NV04_PGRAPH_BETA_PREMULT                           0x0040060C
+#define NV04_PGRAPH_LIMIT_VIOL_PIX                         0x00400610
+#define NV04_PGRAPH_FORMATS                                0x00400618
+#define NV10_PGRAPH_DEBUG_2                                0x00400620
+#define NV04_PGRAPH_BOFFSET0                               0x00400640
+#define NV04_PGRAPH_BOFFSET1                               0x00400644
+#define NV04_PGRAPH_BOFFSET2                               0x00400648
+#define NV04_PGRAPH_BOFFSET3                               0x0040064C
+#define NV04_PGRAPH_BOFFSET4                               0x00400650
+#define NV04_PGRAPH_BOFFSET5                               0x00400654
+#define NV04_PGRAPH_BBASE0                                 0x00400658
+#define NV04_PGRAPH_BBASE1                                 0x0040065C
+#define NV04_PGRAPH_BBASE2                                 0x00400660
+#define NV04_PGRAPH_BBASE3                                 0x00400664
+#define NV04_PGRAPH_BBASE4                                 0x00400668
+#define NV04_PGRAPH_BBASE5                                 0x0040066C
+#define NV04_PGRAPH_BPITCH0                                0x00400670
+#define NV04_PGRAPH_BPITCH1                                0x00400674
+#define NV04_PGRAPH_BPITCH2                                0x00400678
+#define NV04_PGRAPH_BPITCH3                                0x0040067C
+#define NV04_PGRAPH_BPITCH4                                0x00400680
+#define NV04_PGRAPH_BLIMIT0                                0x00400684
+#define NV04_PGRAPH_BLIMIT1                                0x00400688
+#define NV04_PGRAPH_BLIMIT2                                0x0040068C
+#define NV04_PGRAPH_BLIMIT3                                0x00400690
+#define NV04_PGRAPH_BLIMIT4                                0x00400694
+#define NV04_PGRAPH_BLIMIT5                                0x00400698
+#define NV04_PGRAPH_BSWIZZLE2                              0x0040069C
+#define NV04_PGRAPH_BSWIZZLE5                              0x004006A0
+#define NV03_PGRAPH_STATUS                                 0x004006B0
+#define NV04_PGRAPH_STATUS                                 0x00400700
+#define NV04_PGRAPH_TRAPPED_ADDR                           0x00400704
+#define NV04_PGRAPH_TRAPPED_DATA                           0x00400708
+#define NV04_PGRAPH_SURFACE                                0x0040070C
+#define NV10_PGRAPH_TRAPPED_DATA_HIGH                      0x0040070C
+#define NV04_PGRAPH_STATE                                  0x00400710
+#define NV10_PGRAPH_SURFACE                                0x00400710
+#define NV04_PGRAPH_NOTIFY                                 0x00400714
+#define NV10_PGRAPH_STATE                                  0x00400714
+#define NV10_PGRAPH_NOTIFY                                 0x00400718
+
+#define NV04_PGRAPH_FIFO                                   0x00400720
+
+#define NV04_PGRAPH_BPIXEL                                 0x00400724
+#define NV10_PGRAPH_RDI_INDEX                              0x00400750
+#define NV04_PGRAPH_FFINTFC_ST2                            0x00400754
+#define NV10_PGRAPH_RDI_DATA                               0x00400754
+#define NV04_PGRAPH_DMA_PITCH                              0x00400760
+#define NV10_PGRAPH_FFINTFC_ST2                            0x00400764
+#define NV04_PGRAPH_DVD_COLORFMT                           0x00400764
+#define NV04_PGRAPH_SCALED_FORMAT                          0x00400768
+#define NV10_PGRAPH_DMA_PITCH                              0x00400770
+#define NV10_PGRAPH_DVD_COLORFMT                           0x00400774
+#define NV10_PGRAPH_SCALED_FORMAT                          0x00400778
+#define NV20_PGRAPH_CHANNEL_CTX_TABLE                      0x00400780
+#define NV20_PGRAPH_CHANNEL_CTX_POINTER                    0x00400784
+#define NV20_PGRAPH_CHANNEL_CTX_XFER                       0x00400788
+#define NV20_PGRAPH_CHANNEL_CTX_XFER_LOAD                  0x00000001
+#define NV20_PGRAPH_CHANNEL_CTX_XFER_SAVE                  0x00000002
+#define NV04_PGRAPH_PATT_COLOR0                            0x00400800
+#define NV04_PGRAPH_PATT_COLOR1                            0x00400804
+#define NV04_PGRAPH_PATTERN                                0x00400808
+#define NV04_PGRAPH_PATTERN_SHAPE                          0x00400810
+#define NV04_PGRAPH_CHROMA                                 0x00400814
+#define NV04_PGRAPH_CONTROL0                               0x00400818
+#define NV04_PGRAPH_CONTROL1                               0x0040081C
+#define NV04_PGRAPH_CONTROL2                               0x00400820
+#define NV04_PGRAPH_BLEND                                  0x00400824
+#define NV04_PGRAPH_STORED_FMT                             0x00400830
+#define NV04_PGRAPH_PATT_COLORRAM                          0x00400900
+#define NV20_PGRAPH_TILE(i)                                (0x00400900 + (i*16))
+#define NV20_PGRAPH_TLIMIT(i)                              (0x00400904 + (i*16))
+#define NV20_PGRAPH_TSIZE(i)                               (0x00400908 + (i*16))
+#define NV20_PGRAPH_TSTATUS(i)                             (0x0040090C + (i*16))
+#define NV10_PGRAPH_TILE(i)                                (0x00400B00 + (i*16))
+#define NV10_PGRAPH_TLIMIT(i)                              (0x00400B04 + (i*16))
+#define NV10_PGRAPH_TSIZE(i)                               (0x00400B08 + (i*16))
+#define NV10_PGRAPH_TSTATUS(i)                             (0x00400B0C + (i*16))
+#define NV04_PGRAPH_U_RAM                                  0x00400D00
+#define NV47_PGRAPH_TILE(i)                                (0x00400D00 + (i*16))
+#define NV47_PGRAPH_TLIMIT(i)                              (0x00400D04 + (i*16))
+#define NV47_PGRAPH_TSIZE(i)                               (0x00400D08 + (i*16))
+#define NV47_PGRAPH_TSTATUS(i)                             (0x00400D0C + (i*16))
+#define NV04_PGRAPH_V_RAM                                  0x00400D40
+#define NV04_PGRAPH_W_RAM                                  0x00400D80
+#define NV10_PGRAPH_COMBINER0_IN_ALPHA                     0x00400E40
+#define NV10_PGRAPH_COMBINER1_IN_ALPHA                     0x00400E44
+#define NV10_PGRAPH_COMBINER0_IN_RGB                       0x00400E48
+#define NV10_PGRAPH_COMBINER1_IN_RGB                       0x00400E4C
+#define NV10_PGRAPH_COMBINER_COLOR0                        0x00400E50
+#define NV10_PGRAPH_COMBINER_COLOR1                        0x00400E54
+#define NV10_PGRAPH_COMBINER0_OUT_ALPHA                    0x00400E58
+#define NV10_PGRAPH_COMBINER1_OUT_ALPHA                    0x00400E5C
+#define NV10_PGRAPH_COMBINER0_OUT_RGB                      0x00400E60
+#define NV10_PGRAPH_COMBINER1_OUT_RGB                      0x00400E64
+#define NV10_PGRAPH_COMBINER_FINAL0                        0x00400E68
+#define NV10_PGRAPH_COMBINER_FINAL1                        0x00400E6C
+#define NV10_PGRAPH_WINDOWCLIP_HORIZONTAL                  0x00400F00
+#define NV10_PGRAPH_WINDOWCLIP_VERTICAL                    0x00400F20
+#define NV10_PGRAPH_XFMODE0                                0x00400F40
+#define NV10_PGRAPH_XFMODE1                                0x00400F44
+#define NV10_PGRAPH_GLOBALSTATE0                           0x00400F48
+#define NV10_PGRAPH_GLOBALSTATE1                           0x00400F4C
+#define NV10_PGRAPH_PIPE_ADDRESS                           0x00400F50
+#define NV10_PGRAPH_PIPE_DATA                              0x00400F54
+#define NV04_PGRAPH_DMA_START_0                            0x00401000
+#define NV04_PGRAPH_DMA_START_1                            0x00401004
+#define NV04_PGRAPH_DMA_LENGTH                             0x00401008
+#define NV04_PGRAPH_DMA_MISC                               0x0040100C
+#define NV04_PGRAPH_DMA_DATA_0                             0x00401020
+#define NV04_PGRAPH_DMA_DATA_1                             0x00401024
+#define NV04_PGRAPH_DMA_RM                                 0x00401030
+#define NV04_PGRAPH_DMA_A_XLATE_INST                       0x00401040
+#define NV04_PGRAPH_DMA_A_CONTROL                          0x00401044
+#define NV04_PGRAPH_DMA_A_LIMIT                            0x00401048
+#define NV04_PGRAPH_DMA_A_TLB_PTE                          0x0040104C
+#define NV04_PGRAPH_DMA_A_TLB_TAG                          0x00401050
+#define NV04_PGRAPH_DMA_A_ADJ_OFFSET                       0x00401054
+#define NV04_PGRAPH_DMA_A_OFFSET                           0x00401058
+#define NV04_PGRAPH_DMA_A_SIZE                             0x0040105C
+#define NV04_PGRAPH_DMA_A_Y_SIZE                           0x00401060
+#define NV04_PGRAPH_DMA_B_XLATE_INST                       0x00401080
+#define NV04_PGRAPH_DMA_B_CONTROL                          0x00401084
+#define NV04_PGRAPH_DMA_B_LIMIT                            0x00401088
+#define NV04_PGRAPH_DMA_B_TLB_PTE                          0x0040108C
+#define NV04_PGRAPH_DMA_B_TLB_TAG                          0x00401090
+#define NV04_PGRAPH_DMA_B_ADJ_OFFSET                       0x00401094
+#define NV04_PGRAPH_DMA_B_OFFSET                           0x00401098
+#define NV04_PGRAPH_DMA_B_SIZE                             0x0040109C
+#define NV04_PGRAPH_DMA_B_Y_SIZE                           0x004010A0
+#define NV40_PGRAPH_TILE1(i)                               (0x00406900 + (i*16))
+#define NV40_PGRAPH_TLIMIT1(i)                             (0x00406904 + (i*16))
+#define NV40_PGRAPH_TSIZE1(i)                              (0x00406908 + (i*16))
+#define NV40_PGRAPH_TSTATUS1(i)                            (0x0040690C + (i*16))
+
+
+/* It's a guess that this works on NV03. Confirmed on NV04, though */
+#define NV04_PFIFO_DELAY_0                                 0x00002040
+#define NV04_PFIFO_DMA_TIMESLICE                           0x00002044
+#define NV04_PFIFO_NEXT_CHANNEL                            0x00002050
+#define NV03_PFIFO_INTR_0                                  0x00002100
+#define NV03_PFIFO_INTR_EN_0                               0x00002140
+#    define NV_PFIFO_INTR_CACHE_ERROR                          (1<<0)
+#    define NV_PFIFO_INTR_RUNOUT                               (1<<4)
+#    define NV_PFIFO_INTR_RUNOUT_OVERFLOW                      (1<<8)
+#    define NV_PFIFO_INTR_DMA_PUSHER                          (1<<12)
+#    define NV_PFIFO_INTR_DMA_PT                              (1<<16)
+#    define NV_PFIFO_INTR_SEMAPHORE                           (1<<20)
+#    define NV_PFIFO_INTR_ACQUIRE_TIMEOUT                     (1<<24)
+#define NV03_PFIFO_RAMHT                                   0x00002210
+#define NV03_PFIFO_RAMFC                                   0x00002214
+#define NV03_PFIFO_RAMRO                                   0x00002218
+#define NV40_PFIFO_RAMFC                                   0x00002220
+#define NV03_PFIFO_CACHES                                  0x00002500
+#define NV04_PFIFO_MODE                                    0x00002504
+#define NV04_PFIFO_DMA                                     0x00002508
+#define NV04_PFIFO_SIZE                                    0x0000250c
+#define NV50_PFIFO_CTX_TABLE(c)                        (0x2600+(c)*4)
+#define NV50_PFIFO_CTX_TABLE__SIZE                                128
+#define NV50_PFIFO_CTX_TABLE_CHANNEL_ENABLED                  (1<<31)
+#define NV50_PFIFO_CTX_TABLE_UNK30_BAD                        (1<<30)
+#define NV50_PFIFO_CTX_TABLE_INSTANCE_MASK_G80             0x0FFFFFFF
+#define NV50_PFIFO_CTX_TABLE_INSTANCE_MASK_G84             0x00FFFFFF
+#define NV03_PFIFO_CACHE0_PUSH0                            0x00003000
+#define NV03_PFIFO_CACHE0_PULL0                            0x00003040
+#define NV04_PFIFO_CACHE0_PULL0                            0x00003050
+#define NV04_PFIFO_CACHE0_PULL1                            0x00003054
+#define NV03_PFIFO_CACHE1_PUSH0                            0x00003200
+#define NV03_PFIFO_CACHE1_PUSH1                            0x00003204
+#define NV03_PFIFO_CACHE1_PUSH1_DMA                            (1<<8)
+#define NV40_PFIFO_CACHE1_PUSH1_DMA                           (1<<16)
+#define NV03_PFIFO_CACHE1_PUSH1_CHID_MASK                  0x0000000f
+#define NV10_PFIFO_CACHE1_PUSH1_CHID_MASK                  0x0000001f
+#define NV50_PFIFO_CACHE1_PUSH1_CHID_MASK                  0x0000007f
+#define NV03_PFIFO_CACHE1_PUT                              0x00003210
+#define NV04_PFIFO_CACHE1_DMA_PUSH                         0x00003220
+#define NV04_PFIFO_CACHE1_DMA_FETCH                        0x00003224
+#    define NV_PFIFO_CACHE1_DMA_FETCH_TRIG_8_BYTES         0x00000000
+#    define NV_PFIFO_CACHE1_DMA_FETCH_TRIG_16_BYTES        0x00000008
+#    define NV_PFIFO_CACHE1_DMA_FETCH_TRIG_24_BYTES        0x00000010
+#    define NV_PFIFO_CACHE1_DMA_FETCH_TRIG_32_BYTES        0x00000018
+#    define NV_PFIFO_CACHE1_DMA_FETCH_TRIG_40_BYTES        0x00000020
+#    define NV_PFIFO_CACHE1_DMA_FETCH_TRIG_48_BYTES        0x00000028
+#    define NV_PFIFO_CACHE1_DMA_FETCH_TRIG_56_BYTES        0x00000030
+#    define NV_PFIFO_CACHE1_DMA_FETCH_TRIG_64_BYTES        0x00000038
+#    define NV_PFIFO_CACHE1_DMA_FETCH_TRIG_72_BYTES        0x00000040
+#    define NV_PFIFO_CACHE1_DMA_FETCH_TRIG_80_BYTES        0x00000048
+#    define NV_PFIFO_CACHE1_DMA_FETCH_TRIG_88_BYTES        0x00000050
+#    define NV_PFIFO_CACHE1_DMA_FETCH_TRIG_96_BYTES        0x00000058
+#    define NV_PFIFO_CACHE1_DMA_FETCH_TRIG_104_BYTES       0x00000060
+#    define NV_PFIFO_CACHE1_DMA_FETCH_TRIG_112_BYTES       0x00000068
+#    define NV_PFIFO_CACHE1_DMA_FETCH_TRIG_120_BYTES       0x00000070
+#    define NV_PFIFO_CACHE1_DMA_FETCH_TRIG_128_BYTES       0x00000078
+#    define NV_PFIFO_CACHE1_DMA_FETCH_TRIG_136_BYTES       0x00000080
+#    define NV_PFIFO_CACHE1_DMA_FETCH_TRIG_144_BYTES       0x00000088
+#    define NV_PFIFO_CACHE1_DMA_FETCH_TRIG_152_BYTES       0x00000090
+#    define NV_PFIFO_CACHE1_DMA_FETCH_TRIG_160_BYTES       0x00000098
+#    define NV_PFIFO_CACHE1_DMA_FETCH_TRIG_168_BYTES       0x000000A0
+#    define NV_PFIFO_CACHE1_DMA_FETCH_TRIG_176_BYTES       0x000000A8
+#    define NV_PFIFO_CACHE1_DMA_FETCH_TRIG_184_BYTES       0x000000B0
+#    define NV_PFIFO_CACHE1_DMA_FETCH_TRIG_192_BYTES       0x000000B8
+#    define NV_PFIFO_CACHE1_DMA_FETCH_TRIG_200_BYTES       0x000000C0
+#    define NV_PFIFO_CACHE1_DMA_FETCH_TRIG_208_BYTES       0x000000C8
+#    define NV_PFIFO_CACHE1_DMA_FETCH_TRIG_216_BYTES       0x000000D0
+#    define NV_PFIFO_CACHE1_DMA_FETCH_TRIG_224_BYTES       0x000000D8
+#    define NV_PFIFO_CACHE1_DMA_FETCH_TRIG_232_BYTES       0x000000E0
+#    define NV_PFIFO_CACHE1_DMA_FETCH_TRIG_240_BYTES       0x000000E8
+#    define NV_PFIFO_CACHE1_DMA_FETCH_TRIG_248_BYTES       0x000000F0
+#    define NV_PFIFO_CACHE1_DMA_FETCH_TRIG_256_BYTES       0x000000F8
+#    define NV_PFIFO_CACHE1_DMA_FETCH_SIZE                 0x0000E000
+#    define NV_PFIFO_CACHE1_DMA_FETCH_SIZE_32_BYTES        0x00000000
+#    define NV_PFIFO_CACHE1_DMA_FETCH_SIZE_64_BYTES        0x00002000
+#    define NV_PFIFO_CACHE1_DMA_FETCH_SIZE_96_BYTES        0x00004000
+#    define NV_PFIFO_CACHE1_DMA_FETCH_SIZE_128_BYTES       0x00006000
+#    define NV_PFIFO_CACHE1_DMA_FETCH_SIZE_160_BYTES       0x00008000
+#    define NV_PFIFO_CACHE1_DMA_FETCH_SIZE_192_BYTES       0x0000A000
+#    define NV_PFIFO_CACHE1_DMA_FETCH_SIZE_224_BYTES       0x0000C000
+#    define NV_PFIFO_CACHE1_DMA_FETCH_SIZE_256_BYTES       0x0000E000
+#    define NV_PFIFO_CACHE1_DMA_FETCH_MAX_REQS             0x001F0000
+#    define NV_PFIFO_CACHE1_DMA_FETCH_MAX_REQS_0           0x00000000
+#    define NV_PFIFO_CACHE1_DMA_FETCH_MAX_REQS_1           0x00010000
+#    define NV_PFIFO_CACHE1_DMA_FETCH_MAX_REQS_2           0x00020000
+#    define NV_PFIFO_CACHE1_DMA_FETCH_MAX_REQS_3           0x00030000
+#    define NV_PFIFO_CACHE1_DMA_FETCH_MAX_REQS_4           0x00040000
+#    define NV_PFIFO_CACHE1_DMA_FETCH_MAX_REQS_5           0x00050000
+#    define NV_PFIFO_CACHE1_DMA_FETCH_MAX_REQS_6           0x00060000
+#    define NV_PFIFO_CACHE1_DMA_FETCH_MAX_REQS_7           0x00070000
+#    define NV_PFIFO_CACHE1_DMA_FETCH_MAX_REQS_8           0x00080000
+#    define NV_PFIFO_CACHE1_DMA_FETCH_MAX_REQS_9           0x00090000
+#    define NV_PFIFO_CACHE1_DMA_FETCH_MAX_REQS_10          0x000A0000
+#    define NV_PFIFO_CACHE1_DMA_FETCH_MAX_REQS_11          0x000B0000
+#    define NV_PFIFO_CACHE1_DMA_FETCH_MAX_REQS_12          0x000C0000
+#    define NV_PFIFO_CACHE1_DMA_FETCH_MAX_REQS_13          0x000D0000
+#    define NV_PFIFO_CACHE1_DMA_FETCH_MAX_REQS_14          0x000E0000
+#    define NV_PFIFO_CACHE1_DMA_FETCH_MAX_REQS_15          0x000F0000
+#    define NV_PFIFO_CACHE1_ENDIAN                         0x80000000
+#    define NV_PFIFO_CACHE1_LITTLE_ENDIAN                  0x7FFFFFFF
+#    define NV_PFIFO_CACHE1_BIG_ENDIAN                     0x80000000
+#define NV04_PFIFO_CACHE1_DMA_STATE                        0x00003228
+#define NV04_PFIFO_CACHE1_DMA_INSTANCE                     0x0000322c
+#define NV04_PFIFO_CACHE1_DMA_CTL                          0x00003230
+#define NV04_PFIFO_CACHE1_DMA_PUT                          0x00003240
+#define NV04_PFIFO_CACHE1_DMA_GET                          0x00003244
+#define NV10_PFIFO_CACHE1_REF_CNT                          0x00003248
+#define NV10_PFIFO_CACHE1_DMA_SUBROUTINE                   0x0000324C
+#define NV03_PFIFO_CACHE1_PULL0                            0x00003240
+#define NV04_PFIFO_CACHE1_PULL0                            0x00003250
+#define NV03_PFIFO_CACHE1_PULL1                            0x00003250
+#define NV04_PFIFO_CACHE1_PULL1                            0x00003254
+#define NV04_PFIFO_CACHE1_HASH                             0x00003258
+#define NV10_PFIFO_CACHE1_ACQUIRE_TIMEOUT                  0x00003260
+#define NV10_PFIFO_CACHE1_ACQUIRE_TIMESTAMP                0x00003264
+#define NV10_PFIFO_CACHE1_ACQUIRE_VALUE                    0x00003268
+#define NV10_PFIFO_CACHE1_SEMAPHORE                        0x0000326C
+#define NV03_PFIFO_CACHE1_GET                              0x00003270
+#define NV04_PFIFO_CACHE1_ENGINE                           0x00003280
+#define NV04_PFIFO_CACHE1_DMA_DCOUNT                       0x000032A0
+#define NV40_PFIFO_GRCTX_INSTANCE                          0x000032E0
+#define NV40_PFIFO_UNK32E4                                 0x000032E4
+#define NV04_PFIFO_CACHE1_METHOD(i)                (0x00003800+(i*8))
+#define NV04_PFIFO_CACHE1_DATA(i)                  (0x00003804+(i*8))
+#define NV40_PFIFO_CACHE1_METHOD(i)                (0x00090000+(i*8))
+#define NV40_PFIFO_CACHE1_DATA(i)                  (0x00090004+(i*8))
+
+#define NV_CRTC0_INTSTAT                                   0x00600100
+#define NV_CRTC0_INTEN                                     0x00600140
+#define NV_CRTC1_INTSTAT                                   0x00602100
+#define NV_CRTC1_INTEN                                     0x00602140
+#    define NV_CRTC_INTR_VBLANK                                (1<<0)
+
+#define NV04_PRAMIN						0x00700000
+
+/* Fifo commands. These are not regs, neither masks */
+#define NV03_FIFO_CMD_JUMP                                 0x20000000
+#define NV03_FIFO_CMD_JUMP_OFFSET_MASK                     0x1ffffffc
+#define NV03_FIFO_CMD_REWIND                               (NV03_FIFO_CMD_JUMP | (0 & NV03_FIFO_CMD_JUMP_OFFSET_MASK))
+
+/* This is a partial import from rules-ng, a few things may be duplicated.
+ * Eventually we should completely import everything from rules-ng.
+ * For the moment check rules-ng for docs.
+  */
+
+#define NV50_PMC                                            0x00000000
+#define NV50_PMC__LEN                                              0x1
+#define NV50_PMC__ESIZE                                         0x2000
+#    define NV50_PMC_BOOT_0                                 0x00000000
+#        define NV50_PMC_BOOT_0_REVISION                    0x000000ff
+#        define NV50_PMC_BOOT_0_REVISION__SHIFT                      0
+#        define NV50_PMC_BOOT_0_ARCH                        0x0ff00000
+#        define NV50_PMC_BOOT_0_ARCH__SHIFT                         20
+#    define NV50_PMC_INTR_0                                 0x00000100
+#        define NV50_PMC_INTR_0_PFIFO                           (1<<8)
+#        define NV50_PMC_INTR_0_PGRAPH                         (1<<12)
+#        define NV50_PMC_INTR_0_PTIMER                         (1<<20)
+#        define NV50_PMC_INTR_0_HOTPLUG                        (1<<21)
+#        define NV50_PMC_INTR_0_DISPLAY                        (1<<26)
+#    define NV50_PMC_INTR_EN_0                              0x00000140
+#        define NV50_PMC_INTR_EN_0_MASTER                       (1<<0)
+#            define NV50_PMC_INTR_EN_0_MASTER_DISABLED          (0<<0)
+#            define NV50_PMC_INTR_EN_0_MASTER_ENABLED           (1<<0)
+#    define NV50_PMC_ENABLE                                 0x00000200
+#        define NV50_PMC_ENABLE_PFIFO                           (1<<8)
+#        define NV50_PMC_ENABLE_PGRAPH                         (1<<12)
+
+#define NV50_PCONNECTOR                                     0x0000e000
+#define NV50_PCONNECTOR__LEN                                       0x1
+#define NV50_PCONNECTOR__ESIZE                                  0x1000
+#    define NV50_PCONNECTOR_HOTPLUG_INTR                    0x0000e050
+#        define NV50_PCONNECTOR_HOTPLUG_INTR_PLUG_I2C0          (1<<0)
+#        define NV50_PCONNECTOR_HOTPLUG_INTR_PLUG_I2C1          (1<<1)
+#        define NV50_PCONNECTOR_HOTPLUG_INTR_PLUG_I2C2          (1<<2)
+#        define NV50_PCONNECTOR_HOTPLUG_INTR_PLUG_I2C3          (1<<3)
+#        define NV50_PCONNECTOR_HOTPLUG_INTR_UNPLUG_I2C0       (1<<16)
+#        define NV50_PCONNECTOR_HOTPLUG_INTR_UNPLUG_I2C1       (1<<17)
+#        define NV50_PCONNECTOR_HOTPLUG_INTR_UNPLUG_I2C2       (1<<18)
+#        define NV50_PCONNECTOR_HOTPLUG_INTR_UNPLUG_I2C3       (1<<19)
+#    define NV50_PCONNECTOR_HOTPLUG_CTRL                    0x0000e054
+#        define NV50_PCONNECTOR_HOTPLUG_CTRL_PLUG_I2C0          (1<<0)
+#        define NV50_PCONNECTOR_HOTPLUG_CTRL_PLUG_I2C1          (1<<1)
+#        define NV50_PCONNECTOR_HOTPLUG_CTRL_PLUG_I2C2          (1<<2)
+#        define NV50_PCONNECTOR_HOTPLUG_CTRL_PLUG_I2C3          (1<<3)
+#        define NV50_PCONNECTOR_HOTPLUG_CTRL_UNPLUG_I2C0       (1<<16)
+#        define NV50_PCONNECTOR_HOTPLUG_CTRL_UNPLUG_I2C1       (1<<17)
+#        define NV50_PCONNECTOR_HOTPLUG_CTRL_UNPLUG_I2C2       (1<<18)
+#        define NV50_PCONNECTOR_HOTPLUG_CTRL_UNPLUG_I2C3       (1<<19)
+#    define NV50_PCONNECTOR_HOTPLUG_STATE                   0x0000e104
+#        define NV50_PCONNECTOR_HOTPLUG_STATE_PIN_CONNECTED_I2C0 (1<<2)
+#        define NV50_PCONNECTOR_HOTPLUG_STATE_PIN_CONNECTED_I2C1 (1<<6)
+#        define NV50_PCONNECTOR_HOTPLUG_STATE_PIN_CONNECTED_I2C2 (1<<10)
+#        define NV50_PCONNECTOR_HOTPLUG_STATE_PIN_CONNECTED_I2C3 (1<<14)
+#    define NV50_PCONNECTOR_I2C_PORT_0                      0x0000e138
+#    define NV50_PCONNECTOR_I2C_PORT_1                      0x0000e150
+#    define NV50_PCONNECTOR_I2C_PORT_2                      0x0000e168
+#    define NV50_PCONNECTOR_I2C_PORT_3                      0x0000e180
+#    define NV50_PCONNECTOR_I2C_PORT_4                      0x0000e240
+#    define NV50_PCONNECTOR_I2C_PORT_5                      0x0000e258
+
+#define NV50_AUXCH_DATA_OUT(i,n)             ((n) * 4 + (i) * 0x50 + 0x0000e4c0)
+#define NV50_AUXCH_DATA_OUT__SIZE                                             4
+#define NV50_AUXCH_DATA_IN(i,n)              ((n) * 4 + (i) * 0x50 + 0x0000e4d0)
+#define NV50_AUXCH_DATA_IN__SIZE                                              4
+#define NV50_AUXCH_ADDR(i)                             ((i) * 0x50 + 0x0000e4e0)
+#define NV50_AUXCH_CTRL(i)                             ((i) * 0x50 + 0x0000e4e4)
+#define NV50_AUXCH_CTRL_LINKSTAT                                     0x01000000
+#define NV50_AUXCH_CTRL_LINKSTAT_NOT_READY                           0x00000000
+#define NV50_AUXCH_CTRL_LINKSTAT_READY                               0x01000000
+#define NV50_AUXCH_CTRL_LINKEN                                       0x00100000
+#define NV50_AUXCH_CTRL_LINKEN_DISABLED                              0x00000000
+#define NV50_AUXCH_CTRL_LINKEN_ENABLED                               0x00100000
+#define NV50_AUXCH_CTRL_EXEC                                         0x00010000
+#define NV50_AUXCH_CTRL_EXEC_COMPLETE                                0x00000000
+#define NV50_AUXCH_CTRL_EXEC_IN_PROCESS                              0x00010000
+#define NV50_AUXCH_CTRL_CMD                                          0x0000f000
+#define NV50_AUXCH_CTRL_CMD_SHIFT                                            12
+#define NV50_AUXCH_CTRL_LEN                                          0x0000000f
+#define NV50_AUXCH_CTRL_LEN_SHIFT                                             0
+#define NV50_AUXCH_STAT(i)                             ((i) * 0x50 + 0x0000e4e8)
+#define NV50_AUXCH_STAT_STATE                                        0x10000000
+#define NV50_AUXCH_STAT_STATE_NOT_READY                              0x00000000
+#define NV50_AUXCH_STAT_STATE_READY                                  0x10000000
+#define NV50_AUXCH_STAT_REPLY                                        0x000f0000
+#define NV50_AUXCH_STAT_REPLY_AUX                                    0x00030000
+#define NV50_AUXCH_STAT_REPLY_AUX_ACK                                0x00000000
+#define NV50_AUXCH_STAT_REPLY_AUX_NACK                               0x00010000
+#define NV50_AUXCH_STAT_REPLY_AUX_DEFER                              0x00020000
+#define NV50_AUXCH_STAT_REPLY_I2C                                    0x000c0000
+#define NV50_AUXCH_STAT_REPLY_I2C_ACK                                0x00000000
+#define NV50_AUXCH_STAT_REPLY_I2C_NACK                               0x00040000
+#define NV50_AUXCH_STAT_REPLY_I2C_DEFER                              0x00080000
+#define NV50_AUXCH_STAT_COUNT                                        0x0000001f
+
+#define NV50_PBUS                                           0x00088000
+#define NV50_PBUS__LEN                                             0x1
+#define NV50_PBUS__ESIZE                                        0x1000
+#    define NV50_PBUS_PCI_ID                                0x00088000
+#        define NV50_PBUS_PCI_ID_VENDOR_ID                  0x0000ffff
+#        define NV50_PBUS_PCI_ID_VENDOR_ID__SHIFT                    0
+#        define NV50_PBUS_PCI_ID_DEVICE_ID                  0xffff0000
+#        define NV50_PBUS_PCI_ID_DEVICE_ID__SHIFT                   16
+
+#define NV50_PFB                                            0x00100000
+#define NV50_PFB__LEN                                              0x1
+#define NV50_PFB__ESIZE                                         0x1000
+
+#define NV50_PEXTDEV                                        0x00101000
+#define NV50_PEXTDEV__LEN                                          0x1
+#define NV50_PEXTDEV__ESIZE                                     0x1000
+
+#define NV50_PROM                                           0x00300000
+#define NV50_PROM__LEN                                             0x1
+#define NV50_PROM__ESIZE                                       0x10000
+
+#define NV50_PGRAPH                                         0x00400000
+#define NV50_PGRAPH__LEN                                           0x1
+#define NV50_PGRAPH__ESIZE                                     0x10000
+
+#define NV50_PDISPLAY                                                0x00610000
+#define NV50_PDISPLAY_OBJECTS                                        0x00610010
+#define NV50_PDISPLAY_INTR_0                                         0x00610020
+#define NV50_PDISPLAY_INTR_1                                         0x00610024
+#define NV50_PDISPLAY_INTR_1_VBLANK_CRTC                             0x0000000c
+#define NV50_PDISPLAY_INTR_1_VBLANK_CRTC_SHIFT                                2
+#define NV50_PDISPLAY_INTR_1_VBLANK_CRTC_(n)                   (1 << ((n) + 2))
+#define NV50_PDISPLAY_INTR_1_VBLANK_CRTC_0                           0x00000004
+#define NV50_PDISPLAY_INTR_1_VBLANK_CRTC_1                           0x00000008
+#define NV50_PDISPLAY_INTR_1_CLK_UNK10                               0x00000010
+#define NV50_PDISPLAY_INTR_1_CLK_UNK20                               0x00000020
+#define NV50_PDISPLAY_INTR_1_CLK_UNK40                               0x00000040
+#define NV50_PDISPLAY_INTR_EN                                        0x0061002c
+#define NV50_PDISPLAY_INTR_EN_VBLANK_CRTC                            0x0000000c
+#define NV50_PDISPLAY_INTR_EN_VBLANK_CRTC_(n)                   (1 << ((n) + 2))
+#define NV50_PDISPLAY_INTR_EN_VBLANK_CRTC_0                          0x00000004
+#define NV50_PDISPLAY_INTR_EN_VBLANK_CRTC_1                          0x00000008
+#define NV50_PDISPLAY_INTR_EN_CLK_UNK10                              0x00000010
+#define NV50_PDISPLAY_INTR_EN_CLK_UNK20                              0x00000020
+#define NV50_PDISPLAY_INTR_EN_CLK_UNK40                              0x00000040
+#define NV50_PDISPLAY_UNK30_CTRL                                     0x00610030
+#define NV50_PDISPLAY_UNK30_CTRL_UPDATE_VCLK0                        0x00000200
+#define NV50_PDISPLAY_UNK30_CTRL_UPDATE_VCLK1                        0x00000400
+#define NV50_PDISPLAY_UNK30_CTRL_PENDING                             0x80000000
+#define NV50_PDISPLAY_TRAPPED_ADDR                                   0x00610080
+#define NV50_PDISPLAY_TRAPPED_DATA                                   0x00610084
+#define NV50_PDISPLAY_CHANNEL_STAT(i)                  ((i) * 0x10 + 0x00610200)
+#define NV50_PDISPLAY_CHANNEL_STAT_DMA                               0x00000010
+#define NV50_PDISPLAY_CHANNEL_STAT_DMA_DISABLED                      0x00000000
+#define NV50_PDISPLAY_CHANNEL_STAT_DMA_ENABLED                       0x00000010
+#define NV50_PDISPLAY_CHANNEL_DMA_CB(i)                ((i) * 0x10 + 0x00610204)
+#define NV50_PDISPLAY_CHANNEL_DMA_CB_LOCATION                        0x00000002
+#define NV50_PDISPLAY_CHANNEL_DMA_CB_LOCATION_VRAM                   0x00000000
+#define NV50_PDISPLAY_CHANNEL_DMA_CB_LOCATION_SYSTEM                 0x00000002
+#define NV50_PDISPLAY_CHANNEL_DMA_CB_VALID                           0x00000001
+#define NV50_PDISPLAY_CHANNEL_UNK2(i)                  ((i) * 0x10 + 0x00610208)
+#define NV50_PDISPLAY_CHANNEL_UNK3(i)                  ((i) * 0x10 + 0x0061020c)
+
+#define NV50_PDISPLAY_CURSOR                                         0x00610270
+#define NV50_PDISPLAY_CURSOR_CURSOR_CTRL2(i)           ((i) * 0x10 + 0x00610270)
+#define NV50_PDISPLAY_CURSOR_CURSOR_CTRL2_ON                         0x00000001
+#define NV50_PDISPLAY_CURSOR_CURSOR_CTRL2_STATUS                     0x00030000
+#define NV50_PDISPLAY_CURSOR_CURSOR_CTRL2_STATUS_ACTIVE              0x00010000
+
+#define NV50_PDISPLAY_CTRL_STATE                                     0x00610300
+#define NV50_PDISPLAY_CTRL_STATE_PENDING                             0x80000000
+#define NV50_PDISPLAY_CTRL_STATE_METHOD                              0x00001ffc
+#define NV50_PDISPLAY_CTRL_STATE_ENABLE                              0x00000001
+#define NV50_PDISPLAY_CTRL_VAL                                       0x00610304
+#define NV50_PDISPLAY_UNK_380                                        0x00610380
+#define NV50_PDISPLAY_RAM_AMOUNT                                     0x00610384
+#define NV50_PDISPLAY_UNK_388                                        0x00610388
+#define NV50_PDISPLAY_UNK_38C                                        0x0061038c
+
+#define NV50_PDISPLAY_CRTC_P(i, r)        ((i) * 0x540 + NV50_PDISPLAY_CRTC_##r)
+#define NV50_PDISPLAY_CRTC_C(i, r)    (4 + (i) * 0x540 + NV50_PDISPLAY_CRTC_##r)
+#define NV50_PDISPLAY_CRTC_UNK_0A18 /* mthd 0x0900 */                0x00610a18
+#define NV50_PDISPLAY_CRTC_CLUT_MODE                                 0x00610a24
+#define NV50_PDISPLAY_CRTC_INTERLACE                                 0x00610a48
+#define NV50_PDISPLAY_CRTC_SCALE_CTRL                                0x00610a50
+#define NV50_PDISPLAY_CRTC_CURSOR_CTRL                               0x00610a58
+#define NV50_PDISPLAY_CRTC_UNK0A78 /* mthd 0x0904 */                 0x00610a78
+#define NV50_PDISPLAY_CRTC_UNK0AB8                                   0x00610ab8
+#define NV50_PDISPLAY_CRTC_DEPTH                                     0x00610ac8
+#define NV50_PDISPLAY_CRTC_CLOCK                                     0x00610ad0
+#define NV50_PDISPLAY_CRTC_COLOR_CTRL                                0x00610ae0
+#define NV50_PDISPLAY_CRTC_SYNC_START_TO_BLANK_END                   0x00610ae8
+#define NV50_PDISPLAY_CRTC_MODE_UNK1                                 0x00610af0
+#define NV50_PDISPLAY_CRTC_DISPLAY_TOTAL                             0x00610af8
+#define NV50_PDISPLAY_CRTC_SYNC_DURATION                             0x00610b00
+#define NV50_PDISPLAY_CRTC_MODE_UNK2                                 0x00610b08
+#define NV50_PDISPLAY_CRTC_UNK_0B10 /* mthd 0x0828 */                0x00610b10
+#define NV50_PDISPLAY_CRTC_FB_SIZE                                   0x00610b18
+#define NV50_PDISPLAY_CRTC_FB_PITCH                                  0x00610b20
+#define NV50_PDISPLAY_CRTC_FB_PITCH_LINEAR                           0x00100000
+#define NV50_PDISPLAY_CRTC_FB_POS                                    0x00610b28
+#define NV50_PDISPLAY_CRTC_SCALE_CENTER_OFFSET                       0x00610b38
+#define NV50_PDISPLAY_CRTC_REAL_RES                                  0x00610b40
+#define NV50_PDISPLAY_CRTC_SCALE_RES1                                0x00610b48
+#define NV50_PDISPLAY_CRTC_SCALE_RES2                                0x00610b50
+
+#define NV50_PDISPLAY_DAC_MODE_CTRL_P(i)                (0x00610b58 + (i) * 0x8)
+#define NV50_PDISPLAY_DAC_MODE_CTRL_C(i)                (0x00610b5c + (i) * 0x8)
+#define NV50_PDISPLAY_SOR_MODE_CTRL_P(i)                (0x00610b70 + (i) * 0x8)
+#define NV50_PDISPLAY_SOR_MODE_CTRL_C(i)                (0x00610b74 + (i) * 0x8)
+#define NV50_PDISPLAY_DAC_MODE_CTRL2_P(i)               (0x00610bdc + (i) * 0x8)
+#define NV50_PDISPLAY_DAC_MODE_CTRL2_C(i)               (0x00610be0 + (i) * 0x8)
+
+#define NV90_PDISPLAY_SOR_MODE_CTRL_P(i)                (0x00610794 + (i) * 0x8)
+#define NV90_PDISPLAY_SOR_MODE_CTRL_C(i)                (0x00610798 + (i) * 0x8)
+#define NV90_PDISPLAY_DAC_MODE_CTRL_P(i)                (0x00610b58 + (i) * 0x8)
+#define NV90_PDISPLAY_DAC_MODE_CTRL_C(i)                (0x00610b5c + (i) * 0x8)
+#define NV90_PDISPLAY_DAC_MODE_CTRL2_P(i)               (0x00610b80 + (i) * 0x8)
+#define NV90_PDISPLAY_DAC_MODE_CTRL2_C(i)               (0x00610b84 + (i) * 0x8)
+
+#define NV50_PDISPLAY_CRTC_CLK                                       0x00614000
+#define NV50_PDISPLAY_CRTC_CLK_CTRL1(i)                 ((i) * 0x800 + 0x614100)
+#define NV50_PDISPLAY_CRTC_CLK_CTRL1_CONNECTED                       0x00000600
+#define NV50_PDISPLAY_CRTC_CLK_VPLL_A(i)                ((i) * 0x800 + 0x614104)
+#define NV50_PDISPLAY_CRTC_CLK_VPLL_B(i)                ((i) * 0x800 + 0x614108)
+#define NV50_PDISPLAY_CRTC_CLK_CTRL2(i)                 ((i) * 0x800 + 0x614200)
+
+#define NV50_PDISPLAY_DAC_CLK                                        0x00614000
+#define NV50_PDISPLAY_DAC_CLK_CTRL2(i)                  ((i) * 0x800 + 0x614280)
+
+#define NV50_PDISPLAY_SOR_CLK                                        0x00614000
+#define NV50_PDISPLAY_SOR_CLK_CTRL2(i)                  ((i) * 0x800 + 0x614300)
+
+#define NV50_PDISPLAY_VGACRTC(r)                                ((r) + 0x619400)
+
+#define NV50_PDISPLAY_DAC                                            0x0061a000
+#define NV50_PDISPLAY_DAC_DPMS_CTRL(i)                (0x0061a004 + (i) * 0x800)
+#define NV50_PDISPLAY_DAC_DPMS_CTRL_HSYNC_OFF                        0x00000001
+#define NV50_PDISPLAY_DAC_DPMS_CTRL_VSYNC_OFF                        0x00000004
+#define NV50_PDISPLAY_DAC_DPMS_CTRL_BLANKED                          0x00000010
+#define NV50_PDISPLAY_DAC_DPMS_CTRL_OFF                              0x00000040
+#define NV50_PDISPLAY_DAC_DPMS_CTRL_PENDING                          0x80000000
+#define NV50_PDISPLAY_DAC_LOAD_CTRL(i)                (0x0061a00c + (i) * 0x800)
+#define NV50_PDISPLAY_DAC_LOAD_CTRL_ACTIVE                           0x00100000
+#define NV50_PDISPLAY_DAC_LOAD_CTRL_PRESENT                          0x38000000
+#define NV50_PDISPLAY_DAC_LOAD_CTRL_DONE                             0x80000000
+#define NV50_PDISPLAY_DAC_CLK_CTRL1(i)                (0x0061a010 + (i) * 0x800)
+#define NV50_PDISPLAY_DAC_CLK_CTRL1_CONNECTED                        0x00000600
+
+#define NV50_PDISPLAY_SOR                                            0x0061c000
+#define NV50_PDISPLAY_SOR_DPMS_CTRL(i)                (0x0061c004 + (i) * 0x800)
+#define NV50_PDISPLAY_SOR_DPMS_CTRL_PENDING                          0x80000000
+#define NV50_PDISPLAY_SOR_DPMS_CTRL_ON                               0x00000001
+#define NV50_PDISPLAY_SOR_CLK_CTRL1(i)                (0x0061c008 + (i) * 0x800)
+#define NV50_PDISPLAY_SOR_CLK_CTRL1_CONNECTED                        0x00000600
+#define NV50_PDISPLAY_SOR_DPMS_STATE(i)               (0x0061c030 + (i) * 0x800)
+#define NV50_PDISPLAY_SOR_DPMS_STATE_ACTIVE                          0x00030000
+#define NV50_PDISPLAY_SOR_DPMS_STATE_BLANKED                         0x00080000
+#define NV50_PDISPLAY_SOR_DPMS_STATE_WAIT                            0x10000000
+#define NV50_PDISPLAY_SOR_BACKLIGHT                                  0x0061c084
+#define NV50_PDISPLAY_SOR_BACKLIGHT_ENABLE                           0x80000000
+#define NV50_PDISPLAY_SOR_BACKLIGHT_LEVEL                            0x00000fff
+#define NV50_SOR_DP_CTRL(i,l)            (0x0061c10c + (i) * 0x800 + (l) * 0x80)
+#define NV50_SOR_DP_CTRL_ENHANCED_FRAME_ENABLED                      0x00004000
+#define NV50_SOR_DP_CTRL_LANE_MASK                                   0x001f0000
+#define NV50_SOR_DP_CTRL_LANE_0_ENABLED                              0x00010000
+#define NV50_SOR_DP_CTRL_LANE_1_ENABLED                              0x00020000
+#define NV50_SOR_DP_CTRL_LANE_2_ENABLED                              0x00040000
+#define NV50_SOR_DP_CTRL_LANE_3_ENABLED                              0x00080000
+#define NV50_SOR_DP_CTRL_TRAINING_PATTERN                            0x0f000000
+#define NV50_SOR_DP_CTRL_TRAINING_PATTERN_DISABLED                   0x00000000
+#define NV50_SOR_DP_CTRL_TRAINING_PATTERN_1                          0x01000000
+#define NV50_SOR_DP_CTRL_TRAINING_PATTERN_2                          0x02000000
+#define NV50_SOR_DP_UNK118(i,l)          (0x0061c118 + (i) * 0x800 + (l) * 0x80)
+#define NV50_SOR_DP_UNK120(i,l)          (0x0061c120 + (i) * 0x800 + (l) * 0x80)
+#define NV50_SOR_DP_UNK130(i,l)          (0x0061c130 + (i) * 0x800 + (l) * 0x80)
+
+#define NV50_PDISPLAY_USER(i)                        ((i) * 0x1000 + 0x00640000)
+#define NV50_PDISPLAY_USER_PUT(i)                    ((i) * 0x1000 + 0x00640000)
+#define NV50_PDISPLAY_USER_GET(i)                    ((i) * 0x1000 + 0x00640004)
+
+#define NV50_PDISPLAY_CURSOR_USER                                    0x00647000
+#define NV50_PDISPLAY_CURSOR_USER_POS_CTRL(i)        ((i) * 0x1000 + 0x00647080)
+#define NV50_PDISPLAY_CURSOR_USER_POS(i)             ((i) * 0x1000 + 0x00647084)
diff --git a/drivers/gpu/drm/nouveau/nouveau_sgdma.c b/drivers/gpu/drm/nouveau/nouveau_sgdma.c
new file mode 100644
index 000000000000..4c7f1e403e80
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nouveau_sgdma.c
@@ -0,0 +1,321 @@
+#include "drmP.h"
+#include "nouveau_drv.h"
+#include <linux/pagemap.h>
+
+#define NV_CTXDMA_PAGE_SHIFT 12
+#define NV_CTXDMA_PAGE_SIZE  (1 << NV_CTXDMA_PAGE_SHIFT)
+#define NV_CTXDMA_PAGE_MASK  (NV_CTXDMA_PAGE_SIZE - 1)
+
+struct nouveau_sgdma_be {
+	struct ttm_backend backend;
+	struct drm_device *dev;
+
+	dma_addr_t *pages;
+	unsigned nr_pages;
+
+	unsigned pte_start;
+	bool bound;
+};
+
+static int
+nouveau_sgdma_populate(struct ttm_backend *be, unsigned long num_pages,
+		       struct page **pages, struct page *dummy_read_page)
+{
+	struct nouveau_sgdma_be *nvbe = (struct nouveau_sgdma_be *)be;
+	struct drm_device *dev = nvbe->dev;
+
+	NV_DEBUG(nvbe->dev, "num_pages = %ld\n", num_pages);
+
+	if (nvbe->pages)
+		return -EINVAL;
+
+	nvbe->pages = kmalloc(sizeof(dma_addr_t) * num_pages, GFP_KERNEL);
+	if (!nvbe->pages)
+		return -ENOMEM;
+
+	nvbe->nr_pages = 0;
+	while (num_pages--) {
+		nvbe->pages[nvbe->nr_pages] =
+			pci_map_page(dev->pdev, pages[nvbe->nr_pages], 0,
+				     PAGE_SIZE, PCI_DMA_BIDIRECTIONAL);
+		if (pci_dma_mapping_error(dev->pdev,
+					  nvbe->pages[nvbe->nr_pages])) {
+			be->func->clear(be);
+			return -EFAULT;
+		}
+
+		nvbe->nr_pages++;
+	}
+
+	return 0;
+}
+
+static void
+nouveau_sgdma_clear(struct ttm_backend *be)
+{
+	struct nouveau_sgdma_be *nvbe = (struct nouveau_sgdma_be *)be;
+	struct drm_device *dev = nvbe->dev;
+
+	NV_DEBUG(nvbe->dev, "\n");
+
+	if (nvbe && nvbe->pages) {
+		if (nvbe->bound)
+			be->func->unbind(be);
+
+		while (nvbe->nr_pages--) {
+			pci_unmap_page(dev->pdev, nvbe->pages[nvbe->nr_pages],
+				       PAGE_SIZE, PCI_DMA_BIDIRECTIONAL);
+		}
+		kfree(nvbe->pages);
+		nvbe->pages = NULL;
+		nvbe->nr_pages = 0;
+	}
+}
+
+static inline unsigned
+nouveau_sgdma_pte(struct drm_device *dev, uint64_t offset)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	unsigned pte = (offset >> NV_CTXDMA_PAGE_SHIFT);
+
+	if (dev_priv->card_type < NV_50)
+		return pte + 2;
+
+	return pte << 1;
+}
+
+static int
+nouveau_sgdma_bind(struct ttm_backend *be, struct ttm_mem_reg *mem)
+{
+	struct nouveau_sgdma_be *nvbe = (struct nouveau_sgdma_be *)be;
+	struct drm_device *dev = nvbe->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_gpuobj *gpuobj = dev_priv->gart_info.sg_ctxdma;
+	unsigned i, j, pte;
+
+	NV_DEBUG(dev, "pg=0x%lx\n", mem->mm_node->start);
+
+	dev_priv->engine.instmem.prepare_access(nvbe->dev, true);
+	pte = nouveau_sgdma_pte(nvbe->dev, mem->mm_node->start << PAGE_SHIFT);
+	nvbe->pte_start = pte;
+	for (i = 0; i < nvbe->nr_pages; i++) {
+		dma_addr_t dma_offset = nvbe->pages[i];
+		uint32_t offset_l = lower_32_bits(dma_offset);
+		uint32_t offset_h = upper_32_bits(dma_offset);
+
+		for (j = 0; j < PAGE_SIZE / NV_CTXDMA_PAGE_SIZE; j++) {
+			if (dev_priv->card_type < NV_50)
+				nv_wo32(dev, gpuobj, pte++, offset_l | 3);
+			else {
+				nv_wo32(dev, gpuobj, pte++, offset_l | 0x21);
+				nv_wo32(dev, gpuobj, pte++, offset_h & 0xff);
+			}
+
+			dma_offset += NV_CTXDMA_PAGE_SIZE;
+		}
+	}
+	dev_priv->engine.instmem.finish_access(nvbe->dev);
+
+	if (dev_priv->card_type == NV_50) {
+		nv_wr32(dev, 0x100c80, 0x00050001);
+		if (!nv_wait(0x100c80, 0x00000001, 0x00000000)) {
+			NV_ERROR(dev, "timeout: (0x100c80 & 1) == 0 (2)\n");
+			NV_ERROR(dev, "0x100c80 = 0x%08x\n",
+						nv_rd32(dev, 0x100c80));
+			return -EBUSY;
+		}
+
+		nv_wr32(dev, 0x100c80, 0x00000001);
+		if (!nv_wait(0x100c80, 0x00000001, 0x00000000)) {
+			NV_ERROR(dev, "timeout: (0x100c80 & 1) == 0 (2)\n");
+			NV_ERROR(dev, "0x100c80 = 0x%08x\n",
+						nv_rd32(dev, 0x100c80));
+			return -EBUSY;
+		}
+	}
+
+	nvbe->bound = true;
+	return 0;
+}
+
+static int
+nouveau_sgdma_unbind(struct ttm_backend *be)
+{
+	struct nouveau_sgdma_be *nvbe = (struct nouveau_sgdma_be *)be;
+	struct drm_device *dev = nvbe->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_gpuobj *gpuobj = dev_priv->gart_info.sg_ctxdma;
+	unsigned i, j, pte;
+
+	NV_DEBUG(dev, "\n");
+
+	if (!nvbe->bound)
+		return 0;
+
+	dev_priv->engine.instmem.prepare_access(nvbe->dev, true);
+	pte = nvbe->pte_start;
+	for (i = 0; i < nvbe->nr_pages; i++) {
+		dma_addr_t dma_offset = dev_priv->gart_info.sg_dummy_bus;
+
+		for (j = 0; j < PAGE_SIZE / NV_CTXDMA_PAGE_SIZE; j++) {
+			if (dev_priv->card_type < NV_50)
+				nv_wo32(dev, gpuobj, pte++, dma_offset | 3);
+			else {
+				nv_wo32(dev, gpuobj, pte++, dma_offset | 0x21);
+				nv_wo32(dev, gpuobj, pte++, 0x00000000);
+			}
+
+			dma_offset += NV_CTXDMA_PAGE_SIZE;
+		}
+	}
+	dev_priv->engine.instmem.finish_access(nvbe->dev);
+
+	nvbe->bound = false;
+	return 0;
+}
+
+static void
+nouveau_sgdma_destroy(struct ttm_backend *be)
+{
+	struct nouveau_sgdma_be *nvbe = (struct nouveau_sgdma_be *)be;
+
+	if (be) {
+		NV_DEBUG(nvbe->dev, "\n");
+
+		if (nvbe) {
+			if (nvbe->pages)
+				be->func->clear(be);
+			kfree(nvbe);
+		}
+	}
+}
+
+static struct ttm_backend_func nouveau_sgdma_backend = {
+	.populate		= nouveau_sgdma_populate,
+	.clear			= nouveau_sgdma_clear,
+	.bind			= nouveau_sgdma_bind,
+	.unbind			= nouveau_sgdma_unbind,
+	.destroy		= nouveau_sgdma_destroy
+};
+
+struct ttm_backend *
+nouveau_sgdma_init_ttm(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_sgdma_be *nvbe;
+
+	if (!dev_priv->gart_info.sg_ctxdma)
+		return NULL;
+
+	nvbe = kzalloc(sizeof(*nvbe), GFP_KERNEL);
+	if (!nvbe)
+		return NULL;
+
+	nvbe->dev = dev;
+
+	nvbe->backend.func	= &nouveau_sgdma_backend;
+
+	return &nvbe->backend;
+}
+
+int
+nouveau_sgdma_init(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_gpuobj *gpuobj = NULL;
+	uint32_t aper_size, obj_size;
+	int i, ret;
+
+	if (dev_priv->card_type < NV_50) {
+		aper_size = (64 * 1024 * 1024);
+		obj_size  = (aper_size >> NV_CTXDMA_PAGE_SHIFT) * 4;
+		obj_size += 8; /* ctxdma header */
+	} else {
+		/* 1 entire VM page table */
+		aper_size = (512 * 1024 * 1024);
+		obj_size  = (aper_size >> NV_CTXDMA_PAGE_SHIFT) * 8;
+	}
+
+	ret = nouveau_gpuobj_new(dev, NULL, obj_size, 16,
+				      NVOBJ_FLAG_ALLOW_NO_REFS |
+				      NVOBJ_FLAG_ZERO_ALLOC |
+				      NVOBJ_FLAG_ZERO_FREE, &gpuobj);
+	if (ret) {
+		NV_ERROR(dev, "Error creating sgdma object: %d\n", ret);
+		return ret;
+	}
+
+	dev_priv->gart_info.sg_dummy_page =
+		alloc_page(GFP_KERNEL|__GFP_DMA32);
+	set_bit(PG_locked, &dev_priv->gart_info.sg_dummy_page->flags);
+	dev_priv->gart_info.sg_dummy_bus =
+		pci_map_page(dev->pdev, dev_priv->gart_info.sg_dummy_page, 0,
+			     PAGE_SIZE, PCI_DMA_BIDIRECTIONAL);
+
+	dev_priv->engine.instmem.prepare_access(dev, true);
+	if (dev_priv->card_type < NV_50) {
+		/* Maybe use NV_DMA_TARGET_AGP for PCIE? NVIDIA do this, and
+		 * confirmed to work on c51.  Perhaps means NV_DMA_TARGET_PCIE
+		 * on those cards? */
+		nv_wo32(dev, gpuobj, 0, NV_CLASS_DMA_IN_MEMORY |
+				       (1 << 12) /* PT present */ |
+				       (0 << 13) /* PT *not* linear */ |
+				       (NV_DMA_ACCESS_RW  << 14) |
+				       (NV_DMA_TARGET_PCI << 16));
+		nv_wo32(dev, gpuobj, 1, aper_size - 1);
+		for (i = 2; i < 2 + (aper_size >> 12); i++) {
+			nv_wo32(dev, gpuobj, i,
+				    dev_priv->gart_info.sg_dummy_bus | 3);
+		}
+	} else {
+		for (i = 0; i < obj_size; i += 8) {
+			nv_wo32(dev, gpuobj, (i+0)/4,
+				    dev_priv->gart_info.sg_dummy_bus | 0x21);
+			nv_wo32(dev, gpuobj, (i+4)/4, 0);
+		}
+	}
+	dev_priv->engine.instmem.finish_access(dev);
+
+	dev_priv->gart_info.type      = NOUVEAU_GART_SGDMA;
+	dev_priv->gart_info.aper_base = 0;
+	dev_priv->gart_info.aper_size = aper_size;
+	dev_priv->gart_info.sg_ctxdma = gpuobj;
+	return 0;
+}
+
+void
+nouveau_sgdma_takedown(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+
+	if (dev_priv->gart_info.sg_dummy_page) {
+		pci_unmap_page(dev->pdev, dev_priv->gart_info.sg_dummy_bus,
+			       NV_CTXDMA_PAGE_SIZE, PCI_DMA_BIDIRECTIONAL);
+		unlock_page(dev_priv->gart_info.sg_dummy_page);
+		__free_page(dev_priv->gart_info.sg_dummy_page);
+		dev_priv->gart_info.sg_dummy_page = NULL;
+		dev_priv->gart_info.sg_dummy_bus = 0;
+	}
+
+	nouveau_gpuobj_del(dev, &dev_priv->gart_info.sg_ctxdma);
+}
+
+int
+nouveau_sgdma_get_page(struct drm_device *dev, uint32_t offset, uint32_t *page)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_gpuobj *gpuobj = dev_priv->gart_info.sg_ctxdma;
+	struct nouveau_instmem_engine *instmem = &dev_priv->engine.instmem;
+	int pte;
+
+	pte = (offset >> NV_CTXDMA_PAGE_SHIFT);
+	if (dev_priv->card_type < NV_50) {
+		instmem->prepare_access(dev, false);
+		*page = nv_ro32(dev, gpuobj, (pte + 2)) & ~NV_CTXDMA_PAGE_MASK;
+		instmem->finish_access(dev);
+		return 0;
+	}
+
+	NV_ERROR(dev, "Unimplemented on NV50\n");
+	return -EINVAL;
+}
diff --git a/drivers/gpu/drm/nouveau/nouveau_state.c b/drivers/gpu/drm/nouveau/nouveau_state.c
new file mode 100644
index 000000000000..09b9a46dfc0e
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nouveau_state.c
@@ -0,0 +1,871 @@
+/*
+ * Copyright 2005 Stephane Marchesin
+ * Copyright 2008 Stuart Bennett
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * PRECISION INSIGHT AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ */
+
+#include <linux/swab.h>
+#include "drmP.h"
+#include "drm.h"
+#include "drm_sarea.h"
+#include "drm_crtc_helper.h"
+#include <linux/vgaarb.h>
+
+#include "nouveau_drv.h"
+#include "nouveau_drm.h"
+#include "nv50_display.h"
+
+static int nouveau_stub_init(struct drm_device *dev) { return 0; }
+static void nouveau_stub_takedown(struct drm_device *dev) {}
+
+static int nouveau_init_engine_ptrs(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_engine *engine = &dev_priv->engine;
+
+	switch (dev_priv->chipset & 0xf0) {
+	case 0x00:
+		engine->instmem.init		= nv04_instmem_init;
+		engine->instmem.takedown	= nv04_instmem_takedown;
+		engine->instmem.suspend		= nv04_instmem_suspend;
+		engine->instmem.resume		= nv04_instmem_resume;
+		engine->instmem.populate	= nv04_instmem_populate;
+		engine->instmem.clear		= nv04_instmem_clear;
+		engine->instmem.bind		= nv04_instmem_bind;
+		engine->instmem.unbind		= nv04_instmem_unbind;
+		engine->instmem.prepare_access	= nv04_instmem_prepare_access;
+		engine->instmem.finish_access	= nv04_instmem_finish_access;
+		engine->mc.init			= nv04_mc_init;
+		engine->mc.takedown		= nv04_mc_takedown;
+		engine->timer.init		= nv04_timer_init;
+		engine->timer.read		= nv04_timer_read;
+		engine->timer.takedown		= nv04_timer_takedown;
+		engine->fb.init			= nv04_fb_init;
+		engine->fb.takedown		= nv04_fb_takedown;
+		engine->graph.grclass		= nv04_graph_grclass;
+		engine->graph.init		= nv04_graph_init;
+		engine->graph.takedown		= nv04_graph_takedown;
+		engine->graph.fifo_access	= nv04_graph_fifo_access;
+		engine->graph.channel		= nv04_graph_channel;
+		engine->graph.create_context	= nv04_graph_create_context;
+		engine->graph.destroy_context	= nv04_graph_destroy_context;
+		engine->graph.load_context	= nv04_graph_load_context;
+		engine->graph.unload_context	= nv04_graph_unload_context;
+		engine->fifo.channels		= 16;
+		engine->fifo.init		= nv04_fifo_init;
+		engine->fifo.takedown		= nouveau_stub_takedown;
+		engine->fifo.disable		= nv04_fifo_disable;
+		engine->fifo.enable		= nv04_fifo_enable;
+		engine->fifo.reassign		= nv04_fifo_reassign;
+		engine->fifo.cache_flush	= nv04_fifo_cache_flush;
+		engine->fifo.cache_pull		= nv04_fifo_cache_pull;
+		engine->fifo.channel_id		= nv04_fifo_channel_id;
+		engine->fifo.create_context	= nv04_fifo_create_context;
+		engine->fifo.destroy_context	= nv04_fifo_destroy_context;
+		engine->fifo.load_context	= nv04_fifo_load_context;
+		engine->fifo.unload_context	= nv04_fifo_unload_context;
+		break;
+	case 0x10:
+		engine->instmem.init		= nv04_instmem_init;
+		engine->instmem.takedown	= nv04_instmem_takedown;
+		engine->instmem.suspend		= nv04_instmem_suspend;
+		engine->instmem.resume		= nv04_instmem_resume;
+		engine->instmem.populate	= nv04_instmem_populate;
+		engine->instmem.clear		= nv04_instmem_clear;
+		engine->instmem.bind		= nv04_instmem_bind;
+		engine->instmem.unbind		= nv04_instmem_unbind;
+		engine->instmem.prepare_access	= nv04_instmem_prepare_access;
+		engine->instmem.finish_access	= nv04_instmem_finish_access;
+		engine->mc.init			= nv04_mc_init;
+		engine->mc.takedown		= nv04_mc_takedown;
+		engine->timer.init		= nv04_timer_init;
+		engine->timer.read		= nv04_timer_read;
+		engine->timer.takedown		= nv04_timer_takedown;
+		engine->fb.init			= nv10_fb_init;
+		engine->fb.takedown		= nv10_fb_takedown;
+		engine->fb.set_region_tiling	= nv10_fb_set_region_tiling;
+		engine->graph.grclass		= nv10_graph_grclass;
+		engine->graph.init		= nv10_graph_init;
+		engine->graph.takedown		= nv10_graph_takedown;
+		engine->graph.channel		= nv10_graph_channel;
+		engine->graph.create_context	= nv10_graph_create_context;
+		engine->graph.destroy_context	= nv10_graph_destroy_context;
+		engine->graph.fifo_access	= nv04_graph_fifo_access;
+		engine->graph.load_context	= nv10_graph_load_context;
+		engine->graph.unload_context	= nv10_graph_unload_context;
+		engine->graph.set_region_tiling	= nv10_graph_set_region_tiling;
+		engine->fifo.channels		= 32;
+		engine->fifo.init		= nv10_fifo_init;
+		engine->fifo.takedown		= nouveau_stub_takedown;
+		engine->fifo.disable		= nv04_fifo_disable;
+		engine->fifo.enable		= nv04_fifo_enable;
+		engine->fifo.reassign		= nv04_fifo_reassign;
+		engine->fifo.cache_flush	= nv04_fifo_cache_flush;
+		engine->fifo.cache_pull		= nv04_fifo_cache_pull;
+		engine->fifo.channel_id		= nv10_fifo_channel_id;
+		engine->fifo.create_context	= nv10_fifo_create_context;
+		engine->fifo.destroy_context	= nv10_fifo_destroy_context;
+		engine->fifo.load_context	= nv10_fifo_load_context;
+		engine->fifo.unload_context	= nv10_fifo_unload_context;
+		break;
+	case 0x20:
+		engine->instmem.init		= nv04_instmem_init;
+		engine->instmem.takedown	= nv04_instmem_takedown;
+		engine->instmem.suspend		= nv04_instmem_suspend;
+		engine->instmem.resume		= nv04_instmem_resume;
+		engine->instmem.populate	= nv04_instmem_populate;
+		engine->instmem.clear		= nv04_instmem_clear;
+		engine->instmem.bind		= nv04_instmem_bind;
+		engine->instmem.unbind		= nv04_instmem_unbind;
+		engine->instmem.prepare_access	= nv04_instmem_prepare_access;
+		engine->instmem.finish_access	= nv04_instmem_finish_access;
+		engine->mc.init			= nv04_mc_init;
+		engine->mc.takedown		= nv04_mc_takedown;
+		engine->timer.init		= nv04_timer_init;
+		engine->timer.read		= nv04_timer_read;
+		engine->timer.takedown		= nv04_timer_takedown;
+		engine->fb.init			= nv10_fb_init;
+		engine->fb.takedown		= nv10_fb_takedown;
+		engine->fb.set_region_tiling	= nv10_fb_set_region_tiling;
+		engine->graph.grclass		= nv20_graph_grclass;
+		engine->graph.init		= nv20_graph_init;
+		engine->graph.takedown		= nv20_graph_takedown;
+		engine->graph.channel		= nv10_graph_channel;
+		engine->graph.create_context	= nv20_graph_create_context;
+		engine->graph.destroy_context	= nv20_graph_destroy_context;
+		engine->graph.fifo_access	= nv04_graph_fifo_access;
+		engine->graph.load_context	= nv20_graph_load_context;
+		engine->graph.unload_context	= nv20_graph_unload_context;
+		engine->graph.set_region_tiling	= nv20_graph_set_region_tiling;
+		engine->fifo.channels		= 32;
+		engine->fifo.init		= nv10_fifo_init;
+		engine->fifo.takedown		= nouveau_stub_takedown;
+		engine->fifo.disable		= nv04_fifo_disable;
+		engine->fifo.enable		= nv04_fifo_enable;
+		engine->fifo.reassign		= nv04_fifo_reassign;
+		engine->fifo.cache_flush	= nv04_fifo_cache_flush;
+		engine->fifo.cache_pull		= nv04_fifo_cache_pull;
+		engine->fifo.channel_id		= nv10_fifo_channel_id;
+		engine->fifo.create_context	= nv10_fifo_create_context;
+		engine->fifo.destroy_context	= nv10_fifo_destroy_context;
+		engine->fifo.load_context	= nv10_fifo_load_context;
+		engine->fifo.unload_context	= nv10_fifo_unload_context;
+		break;
+	case 0x30:
+		engine->instmem.init		= nv04_instmem_init;
+		engine->instmem.takedown	= nv04_instmem_takedown;
+		engine->instmem.suspend		= nv04_instmem_suspend;
+		engine->instmem.resume		= nv04_instmem_resume;
+		engine->instmem.populate	= nv04_instmem_populate;
+		engine->instmem.clear		= nv04_instmem_clear;
+		engine->instmem.bind		= nv04_instmem_bind;
+		engine->instmem.unbind		= nv04_instmem_unbind;
+		engine->instmem.prepare_access	= nv04_instmem_prepare_access;
+		engine->instmem.finish_access	= nv04_instmem_finish_access;
+		engine->mc.init			= nv04_mc_init;
+		engine->mc.takedown		= nv04_mc_takedown;
+		engine->timer.init		= nv04_timer_init;
+		engine->timer.read		= nv04_timer_read;
+		engine->timer.takedown		= nv04_timer_takedown;
+		engine->fb.init			= nv10_fb_init;
+		engine->fb.takedown		= nv10_fb_takedown;
+		engine->fb.set_region_tiling	= nv10_fb_set_region_tiling;
+		engine->graph.grclass		= nv30_graph_grclass;
+		engine->graph.init		= nv30_graph_init;
+		engine->graph.takedown		= nv20_graph_takedown;
+		engine->graph.fifo_access	= nv04_graph_fifo_access;
+		engine->graph.channel		= nv10_graph_channel;
+		engine->graph.create_context	= nv20_graph_create_context;
+		engine->graph.destroy_context	= nv20_graph_destroy_context;
+		engine->graph.load_context	= nv20_graph_load_context;
+		engine->graph.unload_context	= nv20_graph_unload_context;
+		engine->graph.set_region_tiling	= nv20_graph_set_region_tiling;
+		engine->fifo.channels		= 32;
+		engine->fifo.init		= nv10_fifo_init;
+		engine->fifo.takedown		= nouveau_stub_takedown;
+		engine->fifo.disable		= nv04_fifo_disable;
+		engine->fifo.enable		= nv04_fifo_enable;
+		engine->fifo.reassign		= nv04_fifo_reassign;
+		engine->fifo.cache_flush	= nv04_fifo_cache_flush;
+		engine->fifo.cache_pull		= nv04_fifo_cache_pull;
+		engine->fifo.channel_id		= nv10_fifo_channel_id;
+		engine->fifo.create_context	= nv10_fifo_create_context;
+		engine->fifo.destroy_context	= nv10_fifo_destroy_context;
+		engine->fifo.load_context	= nv10_fifo_load_context;
+		engine->fifo.unload_context	= nv10_fifo_unload_context;
+		break;
+	case 0x40:
+	case 0x60:
+		engine->instmem.init		= nv04_instmem_init;
+		engine->instmem.takedown	= nv04_instmem_takedown;
+		engine->instmem.suspend		= nv04_instmem_suspend;
+		engine->instmem.resume		= nv04_instmem_resume;
+		engine->instmem.populate	= nv04_instmem_populate;
+		engine->instmem.clear		= nv04_instmem_clear;
+		engine->instmem.bind		= nv04_instmem_bind;
+		engine->instmem.unbind		= nv04_instmem_unbind;
+		engine->instmem.prepare_access	= nv04_instmem_prepare_access;
+		engine->instmem.finish_access	= nv04_instmem_finish_access;
+		engine->mc.init			= nv40_mc_init;
+		engine->mc.takedown		= nv40_mc_takedown;
+		engine->timer.init		= nv04_timer_init;
+		engine->timer.read		= nv04_timer_read;
+		engine->timer.takedown		= nv04_timer_takedown;
+		engine->fb.init			= nv40_fb_init;
+		engine->fb.takedown		= nv40_fb_takedown;
+		engine->fb.set_region_tiling	= nv40_fb_set_region_tiling;
+		engine->graph.grclass		= nv40_graph_grclass;
+		engine->graph.init		= nv40_graph_init;
+		engine->graph.takedown		= nv40_graph_takedown;
+		engine->graph.fifo_access	= nv04_graph_fifo_access;
+		engine->graph.channel		= nv40_graph_channel;
+		engine->graph.create_context	= nv40_graph_create_context;
+		engine->graph.destroy_context	= nv40_graph_destroy_context;
+		engine->graph.load_context	= nv40_graph_load_context;
+		engine->graph.unload_context	= nv40_graph_unload_context;
+		engine->graph.set_region_tiling	= nv40_graph_set_region_tiling;
+		engine->fifo.channels		= 32;
+		engine->fifo.init		= nv40_fifo_init;
+		engine->fifo.takedown		= nouveau_stub_takedown;
+		engine->fifo.disable		= nv04_fifo_disable;
+		engine->fifo.enable		= nv04_fifo_enable;
+		engine->fifo.reassign		= nv04_fifo_reassign;
+		engine->fifo.cache_flush	= nv04_fifo_cache_flush;
+		engine->fifo.cache_pull		= nv04_fifo_cache_pull;
+		engine->fifo.channel_id		= nv10_fifo_channel_id;
+		engine->fifo.create_context	= nv40_fifo_create_context;
+		engine->fifo.destroy_context	= nv40_fifo_destroy_context;
+		engine->fifo.load_context	= nv40_fifo_load_context;
+		engine->fifo.unload_context	= nv40_fifo_unload_context;
+		break;
+	case 0x50:
+	case 0x80: /* gotta love NVIDIA's consistency.. */
+	case 0x90:
+	case 0xA0:
+		engine->instmem.init		= nv50_instmem_init;
+		engine->instmem.takedown	= nv50_instmem_takedown;
+		engine->instmem.suspend		= nv50_instmem_suspend;
+		engine->instmem.resume		= nv50_instmem_resume;
+		engine->instmem.populate	= nv50_instmem_populate;
+		engine->instmem.clear		= nv50_instmem_clear;
+		engine->instmem.bind		= nv50_instmem_bind;
+		engine->instmem.unbind		= nv50_instmem_unbind;
+		engine->instmem.prepare_access	= nv50_instmem_prepare_access;
+		engine->instmem.finish_access	= nv50_instmem_finish_access;
+		engine->mc.init			= nv50_mc_init;
+		engine->mc.takedown		= nv50_mc_takedown;
+		engine->timer.init		= nv04_timer_init;
+		engine->timer.read		= nv04_timer_read;
+		engine->timer.takedown		= nv04_timer_takedown;
+		engine->fb.init			= nouveau_stub_init;
+		engine->fb.takedown		= nouveau_stub_takedown;
+		engine->graph.grclass		= nv50_graph_grclass;
+		engine->graph.init		= nv50_graph_init;
+		engine->graph.takedown		= nv50_graph_takedown;
+		engine->graph.fifo_access	= nv50_graph_fifo_access;
+		engine->graph.channel		= nv50_graph_channel;
+		engine->graph.create_context	= nv50_graph_create_context;
+		engine->graph.destroy_context	= nv50_graph_destroy_context;
+		engine->graph.load_context	= nv50_graph_load_context;
+		engine->graph.unload_context	= nv50_graph_unload_context;
+		engine->fifo.channels		= 128;
+		engine->fifo.init		= nv50_fifo_init;
+		engine->fifo.takedown		= nv50_fifo_takedown;
+		engine->fifo.disable		= nv04_fifo_disable;
+		engine->fifo.enable		= nv04_fifo_enable;
+		engine->fifo.reassign		= nv04_fifo_reassign;
+		engine->fifo.channel_id		= nv50_fifo_channel_id;
+		engine->fifo.create_context	= nv50_fifo_create_context;
+		engine->fifo.destroy_context	= nv50_fifo_destroy_context;
+		engine->fifo.load_context	= nv50_fifo_load_context;
+		engine->fifo.unload_context	= nv50_fifo_unload_context;
+		break;
+	default:
+		NV_ERROR(dev, "NV%02x unsupported\n", dev_priv->chipset);
+		return 1;
+	}
+
+	return 0;
+}
+
+static unsigned int
+nouveau_vga_set_decode(void *priv, bool state)
+{
+	if (state)
+		return VGA_RSRC_LEGACY_IO | VGA_RSRC_LEGACY_MEM |
+		       VGA_RSRC_NORMAL_IO | VGA_RSRC_NORMAL_MEM;
+	else
+		return VGA_RSRC_NORMAL_IO | VGA_RSRC_NORMAL_MEM;
+}
+
+static int
+nouveau_card_init_channel(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_gpuobj *gpuobj;
+	int ret;
+
+	ret = nouveau_channel_alloc(dev, &dev_priv->channel,
+				    (struct drm_file *)-2,
+				    NvDmaFB, NvDmaTT);
+	if (ret)
+		return ret;
+
+	gpuobj = NULL;
+	ret = nouveau_gpuobj_dma_new(dev_priv->channel, NV_CLASS_DMA_IN_MEMORY,
+				     0, nouveau_mem_fb_amount(dev),
+				     NV_DMA_ACCESS_RW, NV_DMA_TARGET_VIDMEM,
+				     &gpuobj);
+	if (ret)
+		goto out_err;
+
+	ret = nouveau_gpuobj_ref_add(dev, dev_priv->channel, NvDmaVRAM,
+				     gpuobj, NULL);
+	if (ret)
+		goto out_err;
+
+	gpuobj = NULL;
+	ret = nouveau_gpuobj_gart_dma_new(dev_priv->channel, 0,
+					  dev_priv->gart_info.aper_size,
+					  NV_DMA_ACCESS_RW, &gpuobj, NULL);
+	if (ret)
+		goto out_err;
+
+	ret = nouveau_gpuobj_ref_add(dev, dev_priv->channel, NvDmaGART,
+				     gpuobj, NULL);
+	if (ret)
+		goto out_err;
+
+	return 0;
+out_err:
+	nouveau_gpuobj_del(dev, &gpuobj);
+	nouveau_channel_free(dev_priv->channel);
+	dev_priv->channel = NULL;
+	return ret;
+}
+
+int
+nouveau_card_init(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_engine *engine;
+	int ret;
+
+	NV_DEBUG(dev, "prev state = %d\n", dev_priv->init_state);
+
+	if (dev_priv->init_state == NOUVEAU_CARD_INIT_DONE)
+		return 0;
+
+	vga_client_register(dev->pdev, dev, NULL, nouveau_vga_set_decode);
+
+	/* Initialise internal driver API hooks */
+	ret = nouveau_init_engine_ptrs(dev);
+	if (ret)
+		goto out;
+	engine = &dev_priv->engine;
+	dev_priv->init_state = NOUVEAU_CARD_INIT_FAILED;
+
+	/* Parse BIOS tables / Run init tables if card not POSTed */
+	if (drm_core_check_feature(dev, DRIVER_MODESET)) {
+		ret = nouveau_bios_init(dev);
+		if (ret)
+			goto out;
+	}
+
+	ret = nouveau_gpuobj_early_init(dev);
+	if (ret)
+		goto out_bios;
+
+	/* Initialise instance memory, must happen before mem_init so we
+	 * know exactly how much VRAM we're able to use for "normal"
+	 * purposes.
+	 */
+	ret = engine->instmem.init(dev);
+	if (ret)
+		goto out_gpuobj_early;
+
+	/* Setup the memory manager */
+	ret = nouveau_mem_init(dev);
+	if (ret)
+		goto out_instmem;
+
+	ret = nouveau_gpuobj_init(dev);
+	if (ret)
+		goto out_mem;
+
+	/* PMC */
+	ret = engine->mc.init(dev);
+	if (ret)
+		goto out_gpuobj;
+
+	/* PTIMER */
+	ret = engine->timer.init(dev);
+	if (ret)
+		goto out_mc;
+
+	/* PFB */
+	ret = engine->fb.init(dev);
+	if (ret)
+		goto out_timer;
+
+	/* PGRAPH */
+	ret = engine->graph.init(dev);
+	if (ret)
+		goto out_fb;
+
+	/* PFIFO */
+	ret = engine->fifo.init(dev);
+	if (ret)
+		goto out_graph;
+
+	/* this call irq_preinstall, register irq handler and
+	 * call irq_postinstall
+	 */
+	ret = drm_irq_install(dev);
+	if (ret)
+		goto out_fifo;
+
+	ret = drm_vblank_init(dev, 0);
+	if (ret)
+		goto out_irq;
+
+	/* what about PVIDEO/PCRTC/PRAMDAC etc? */
+
+	if (!engine->graph.accel_blocked) {
+		ret = nouveau_card_init_channel(dev);
+		if (ret)
+			goto out_irq;
+	}
+
+	if (drm_core_check_feature(dev, DRIVER_MODESET)) {
+		if (dev_priv->card_type >= NV_50)
+			ret = nv50_display_create(dev);
+		else
+			ret = nv04_display_create(dev);
+		if (ret)
+			goto out_irq;
+	}
+
+	ret = nouveau_backlight_init(dev);
+	if (ret)
+		NV_ERROR(dev, "Error %d registering backlight\n", ret);
+
+	dev_priv->init_state = NOUVEAU_CARD_INIT_DONE;
+
+	if (drm_core_check_feature(dev, DRIVER_MODESET))
+		drm_helper_initial_config(dev);
+
+	return 0;
+
+out_irq:
+	drm_irq_uninstall(dev);
+out_fifo:
+	engine->fifo.takedown(dev);
+out_graph:
+	engine->graph.takedown(dev);
+out_fb:
+	engine->fb.takedown(dev);
+out_timer:
+	engine->timer.takedown(dev);
+out_mc:
+	engine->mc.takedown(dev);
+out_gpuobj:
+	nouveau_gpuobj_takedown(dev);
+out_mem:
+	nouveau_mem_close(dev);
+out_instmem:
+	engine->instmem.takedown(dev);
+out_gpuobj_early:
+	nouveau_gpuobj_late_takedown(dev);
+out_bios:
+	nouveau_bios_takedown(dev);
+out:
+	vga_client_register(dev->pdev, NULL, NULL, NULL);
+	return ret;
+}
+
+static void nouveau_card_takedown(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_engine *engine = &dev_priv->engine;
+
+	NV_DEBUG(dev, "prev state = %d\n", dev_priv->init_state);
+
+	if (dev_priv->init_state != NOUVEAU_CARD_INIT_DOWN) {
+		nouveau_backlight_exit(dev);
+
+		if (dev_priv->channel) {
+			nouveau_channel_free(dev_priv->channel);
+			dev_priv->channel = NULL;
+		}
+
+		engine->fifo.takedown(dev);
+		engine->graph.takedown(dev);
+		engine->fb.takedown(dev);
+		engine->timer.takedown(dev);
+		engine->mc.takedown(dev);
+
+		mutex_lock(&dev->struct_mutex);
+		ttm_bo_clean_mm(&dev_priv->ttm.bdev, TTM_PL_TT);
+		mutex_unlock(&dev->struct_mutex);
+		nouveau_sgdma_takedown(dev);
+
+		nouveau_gpuobj_takedown(dev);
+		nouveau_mem_close(dev);
+		engine->instmem.takedown(dev);
+
+		if (drm_core_check_feature(dev, DRIVER_MODESET))
+			drm_irq_uninstall(dev);
+
+		nouveau_gpuobj_late_takedown(dev);
+		nouveau_bios_takedown(dev);
+
+		vga_client_register(dev->pdev, NULL, NULL, NULL);
+
+		dev_priv->init_state = NOUVEAU_CARD_INIT_DOWN;
+	}
+}
+
+/* here a client dies, release the stuff that was allocated for its
+ * file_priv */
+void nouveau_preclose(struct drm_device *dev, struct drm_file *file_priv)
+{
+	nouveau_channel_cleanup(dev, file_priv);
+}
+
+/* first module load, setup the mmio/fb mapping */
+/* KMS: we need mmio at load time, not when the first drm client opens. */
+int nouveau_firstopen(struct drm_device *dev)
+{
+	return 0;
+}
+
+/* if we have an OF card, copy vbios to RAMIN */
+static void nouveau_OF_copy_vbios_to_ramin(struct drm_device *dev)
+{
+#if defined(__powerpc__)
+	int size, i;
+	const uint32_t *bios;
+	struct device_node *dn = pci_device_to_OF_node(dev->pdev);
+	if (!dn) {
+		NV_INFO(dev, "Unable to get the OF node\n");
+		return;
+	}
+
+	bios = of_get_property(dn, "NVDA,BMP", &size);
+	if (bios) {
+		for (i = 0; i < size; i += 4)
+			nv_wi32(dev, i, bios[i/4]);
+		NV_INFO(dev, "OF bios successfully copied (%d bytes)\n", size);
+	} else {
+		NV_INFO(dev, "Unable to get the OF bios\n");
+	}
+#endif
+}
+
+int nouveau_load(struct drm_device *dev, unsigned long flags)
+{
+	struct drm_nouveau_private *dev_priv;
+	uint32_t reg0;
+	resource_size_t mmio_start_offs;
+
+	dev_priv = kzalloc(sizeof(*dev_priv), GFP_KERNEL);
+	if (!dev_priv)
+		return -ENOMEM;
+	dev->dev_private = dev_priv;
+	dev_priv->dev = dev;
+
+	dev_priv->flags = flags & NOUVEAU_FLAGS;
+	dev_priv->init_state = NOUVEAU_CARD_INIT_DOWN;
+
+	NV_DEBUG(dev, "vendor: 0x%X device: 0x%X class: 0x%X\n",
+		 dev->pci_vendor, dev->pci_device, dev->pdev->class);
+
+	dev_priv->acpi_dsm = nouveau_dsm_probe(dev);
+
+	if (dev_priv->acpi_dsm)
+		nouveau_hybrid_setup(dev);
+
+	dev_priv->wq = create_workqueue("nouveau");
+	if (!dev_priv->wq)
+		return -EINVAL;
+
+	/* resource 0 is mmio regs */
+	/* resource 1 is linear FB */
+	/* resource 2 is RAMIN (mmio regs + 0x1000000) */
+	/* resource 6 is bios */
+
+	/* map the mmio regs */
+	mmio_start_offs = pci_resource_start(dev->pdev, 0);
+	dev_priv->mmio = ioremap(mmio_start_offs, 0x00800000);
+	if (!dev_priv->mmio) {
+		NV_ERROR(dev, "Unable to initialize the mmio mapping. "
+			 "Please report your setup to " DRIVER_EMAIL "\n");
+		return -EINVAL;
+	}
+	NV_DEBUG(dev, "regs mapped ok at 0x%llx\n",
+					(unsigned long long)mmio_start_offs);
+
+#ifdef __BIG_ENDIAN
+	/* Put the card in BE mode if it's not */
+	if (nv_rd32(dev, NV03_PMC_BOOT_1))
+		nv_wr32(dev, NV03_PMC_BOOT_1, 0x00000001);
+
+	DRM_MEMORYBARRIER();
+#endif
+
+	/* Time to determine the card architecture */
+	reg0 = nv_rd32(dev, NV03_PMC_BOOT_0);
+
+	/* We're dealing with >=NV10 */
+	if ((reg0 & 0x0f000000) > 0) {
+		/* Bit 27-20 contain the architecture in hex */
+		dev_priv->chipset = (reg0 & 0xff00000) >> 20;
+	/* NV04 or NV05 */
+	} else if ((reg0 & 0xff00fff0) == 0x20004000) {
+		if (reg0 & 0x00f00000)
+			dev_priv->chipset = 0x05;
+		else
+			dev_priv->chipset = 0x04;
+	} else
+		dev_priv->chipset = 0xff;
+
+	switch (dev_priv->chipset & 0xf0) {
+	case 0x00:
+	case 0x10:
+	case 0x20:
+	case 0x30:
+		dev_priv->card_type = dev_priv->chipset & 0xf0;
+		break;
+	case 0x40:
+	case 0x60:
+		dev_priv->card_type = NV_40;
+		break;
+	case 0x50:
+	case 0x80:
+	case 0x90:
+	case 0xa0:
+		dev_priv->card_type = NV_50;
+		break;
+	default:
+		NV_INFO(dev, "Unsupported chipset 0x%08x\n", reg0);
+		return -EINVAL;
+	}
+
+	NV_INFO(dev, "Detected an NV%2x generation card (0x%08x)\n",
+		dev_priv->card_type, reg0);
+
+	/* map larger RAMIN aperture on NV40 cards */
+	dev_priv->ramin  = NULL;
+	if (dev_priv->card_type >= NV_40) {
+		int ramin_bar = 2;
+		if (pci_resource_len(dev->pdev, ramin_bar) == 0)
+			ramin_bar = 3;
+
+		dev_priv->ramin_size = pci_resource_len(dev->pdev, ramin_bar);
+		dev_priv->ramin = ioremap(
+				pci_resource_start(dev->pdev, ramin_bar),
+				dev_priv->ramin_size);
+		if (!dev_priv->ramin) {
+			NV_ERROR(dev, "Failed to init RAMIN mapping, "
+				      "limited instance memory available\n");
+		}
+	}
+
+	/* On older cards (or if the above failed), create a map covering
+	 * the BAR0 PRAMIN aperture */
+	if (!dev_priv->ramin) {
+		dev_priv->ramin_size = 1 * 1024 * 1024;
+		dev_priv->ramin = ioremap(mmio_start_offs + NV_RAMIN,
+							dev_priv->ramin_size);
+		if (!dev_priv->ramin) {
+			NV_ERROR(dev, "Failed to map BAR0 PRAMIN.\n");
+			return -ENOMEM;
+		}
+	}
+
+	nouveau_OF_copy_vbios_to_ramin(dev);
+
+	/* Special flags */
+	if (dev->pci_device == 0x01a0)
+		dev_priv->flags |= NV_NFORCE;
+	else if (dev->pci_device == 0x01f0)
+		dev_priv->flags |= NV_NFORCE2;
+
+	/* For kernel modesetting, init card now and bring up fbcon */
+	if (drm_core_check_feature(dev, DRIVER_MODESET)) {
+		int ret = nouveau_card_init(dev);
+		if (ret)
+			return ret;
+	}
+
+	return 0;
+}
+
+static void nouveau_close(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+
+	/* In the case of an error dev_priv may not be allocated yet */
+	if (dev_priv)
+		nouveau_card_takedown(dev);
+}
+
+/* KMS: we need mmio at load time, not when the first drm client opens. */
+void nouveau_lastclose(struct drm_device *dev)
+{
+	if (drm_core_check_feature(dev, DRIVER_MODESET))
+		return;
+
+	nouveau_close(dev);
+}
+
+int nouveau_unload(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+
+	if (drm_core_check_feature(dev, DRIVER_MODESET)) {
+		if (dev_priv->card_type >= NV_50)
+			nv50_display_destroy(dev);
+		else
+			nv04_display_destroy(dev);
+		nouveau_close(dev);
+	}
+
+	iounmap(dev_priv->mmio);
+	iounmap(dev_priv->ramin);
+
+	kfree(dev_priv);
+	dev->dev_private = NULL;
+	return 0;
+}
+
+int
+nouveau_ioctl_card_init(struct drm_device *dev, void *data,
+			struct drm_file *file_priv)
+{
+	return nouveau_card_init(dev);
+}
+
+int nouveau_ioctl_getparam(struct drm_device *dev, void *data,
+						struct drm_file *file_priv)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct drm_nouveau_getparam *getparam = data;
+
+	NOUVEAU_CHECK_INITIALISED_WITH_RETURN;
+
+	switch (getparam->param) {
+	case NOUVEAU_GETPARAM_CHIPSET_ID:
+		getparam->value = dev_priv->chipset;
+		break;
+	case NOUVEAU_GETPARAM_PCI_VENDOR:
+		getparam->value = dev->pci_vendor;
+		break;
+	case NOUVEAU_GETPARAM_PCI_DEVICE:
+		getparam->value = dev->pci_device;
+		break;
+	case NOUVEAU_GETPARAM_BUS_TYPE:
+		if (drm_device_is_agp(dev))
+			getparam->value = NV_AGP;
+		else if (drm_device_is_pcie(dev))
+			getparam->value = NV_PCIE;
+		else
+			getparam->value = NV_PCI;
+		break;
+	case NOUVEAU_GETPARAM_FB_PHYSICAL:
+		getparam->value = dev_priv->fb_phys;
+		break;
+	case NOUVEAU_GETPARAM_AGP_PHYSICAL:
+		getparam->value = dev_priv->gart_info.aper_base;
+		break;
+	case NOUVEAU_GETPARAM_PCI_PHYSICAL:
+		if (dev->sg) {
+			getparam->value = (unsigned long)dev->sg->virtual;
+		} else {
+			NV_ERROR(dev, "Requested PCIGART address, "
+					"while no PCIGART was created\n");
+			return -EINVAL;
+		}
+		break;
+	case NOUVEAU_GETPARAM_FB_SIZE:
+		getparam->value = dev_priv->fb_available_size;
+		break;
+	case NOUVEAU_GETPARAM_AGP_SIZE:
+		getparam->value = dev_priv->gart_info.aper_size;
+		break;
+	case NOUVEAU_GETPARAM_VM_VRAM_BASE:
+		getparam->value = dev_priv->vm_vram_base;
+		break;
+	default:
+		NV_ERROR(dev, "unknown parameter %lld\n", getparam->param);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+int
+nouveau_ioctl_setparam(struct drm_device *dev, void *data,
+		       struct drm_file *file_priv)
+{
+	struct drm_nouveau_setparam *setparam = data;
+
+	NOUVEAU_CHECK_INITIALISED_WITH_RETURN;
+
+	switch (setparam->param) {
+	default:
+		NV_ERROR(dev, "unknown parameter %lld\n", setparam->param);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+/* Wait until (value(reg) & mask) == val, up until timeout has hit */
+bool nouveau_wait_until(struct drm_device *dev, uint64_t timeout,
+			uint32_t reg, uint32_t mask, uint32_t val)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_timer_engine *ptimer = &dev_priv->engine.timer;
+	uint64_t start = ptimer->read(dev);
+
+	do {
+		if ((nv_rd32(dev, reg) & mask) == val)
+			return true;
+	} while (ptimer->read(dev) - start < timeout);
+
+	return false;
+}
+
+/* Waits for PGRAPH to go completely idle */
+bool nouveau_wait_for_idle(struct drm_device *dev)
+{
+	if (!nv_wait(NV04_PGRAPH_STATUS, 0xffffffff, 0x00000000)) {
+		NV_ERROR(dev, "PGRAPH idle timed out with status 0x%08x\n",
+			 nv_rd32(dev, NV04_PGRAPH_STATUS));
+		return false;
+	}
+
+	return true;
+}
+
diff --git a/drivers/gpu/drm/nouveau/nouveau_ttm.c b/drivers/gpu/drm/nouveau/nouveau_ttm.c
new file mode 100644
index 000000000000..c385d50f041b
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nouveau_ttm.c
@@ -0,0 +1,103 @@
+/*
+ * Copyright (c) 2007-2008 Tungsten Graphics, Inc., Cedar Park, TX., USA,
+ * All Rights Reserved.
+ * Copyright (c) 2009 VMware, Inc., Palo Alto, CA., USA,
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sub license,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#include "drmP.h"
+
+#include "nouveau_drv.h"
+
+int
+nouveau_ttm_mmap(struct file *filp, struct vm_area_struct *vma)
+{
+	struct drm_file *file_priv = filp->private_data;
+	struct drm_nouveau_private *dev_priv =
+		file_priv->minor->dev->dev_private;
+
+	if (unlikely(vma->vm_pgoff < DRM_FILE_PAGE_OFFSET))
+		return drm_mmap(filp, vma);
+
+	return ttm_bo_mmap(filp, vma, &dev_priv->ttm.bdev);
+}
+
+static int
+nouveau_ttm_mem_global_init(struct ttm_global_reference *ref)
+{
+	return ttm_mem_global_init(ref->object);
+}
+
+static void
+nouveau_ttm_mem_global_release(struct ttm_global_reference *ref)
+{
+	ttm_mem_global_release(ref->object);
+}
+
+int
+nouveau_ttm_global_init(struct drm_nouveau_private *dev_priv)
+{
+	struct ttm_global_reference *global_ref;
+	int ret;
+
+	global_ref = &dev_priv->ttm.mem_global_ref;
+	global_ref->global_type = TTM_GLOBAL_TTM_MEM;
+	global_ref->size = sizeof(struct ttm_mem_global);
+	global_ref->init = &nouveau_ttm_mem_global_init;
+	global_ref->release = &nouveau_ttm_mem_global_release;
+
+	ret = ttm_global_item_ref(global_ref);
+	if (unlikely(ret != 0)) {
+		DRM_ERROR("Failed setting up TTM memory accounting\n");
+		dev_priv->ttm.mem_global_ref.release = NULL;
+		return ret;
+	}
+
+	dev_priv->ttm.bo_global_ref.mem_glob = global_ref->object;
+	global_ref = &dev_priv->ttm.bo_global_ref.ref;
+	global_ref->global_type = TTM_GLOBAL_TTM_BO;
+	global_ref->size = sizeof(struct ttm_bo_global);
+	global_ref->init = &ttm_bo_global_init;
+	global_ref->release = &ttm_bo_global_release;
+
+	ret = ttm_global_item_ref(global_ref);
+	if (unlikely(ret != 0)) {
+		DRM_ERROR("Failed setting up TTM BO subsystem\n");
+		ttm_global_item_unref(&dev_priv->ttm.mem_global_ref);
+		dev_priv->ttm.mem_global_ref.release = NULL;
+		return ret;
+	}
+
+	return 0;
+}
+
+void
+nouveau_ttm_global_release(struct drm_nouveau_private *dev_priv)
+{
+	if (dev_priv->ttm.mem_global_ref.release == NULL)
+		return;
+
+	ttm_global_item_unref(&dev_priv->ttm.bo_global_ref.ref);
+	ttm_global_item_unref(&dev_priv->ttm.mem_global_ref);
+	dev_priv->ttm.mem_global_ref.release = NULL;
+}
+
diff --git a/drivers/gpu/drm/nouveau/nv04_crtc.c b/drivers/gpu/drm/nouveau/nv04_crtc.c
new file mode 100644
index 000000000000..d2f143ed97c1
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nv04_crtc.c
@@ -0,0 +1,1002 @@
+/*
+ * Copyright 1993-2003 NVIDIA, Corporation
+ * Copyright 2006 Dave Airlie
+ * Copyright 2007 Maarten Maathuis
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ */
+
+#include "drmP.h"
+#include "drm_crtc_helper.h"
+
+#include "nouveau_drv.h"
+#include "nouveau_encoder.h"
+#include "nouveau_connector.h"
+#include "nouveau_crtc.h"
+#include "nouveau_fb.h"
+#include "nouveau_hw.h"
+#include "nvreg.h"
+
+static int
+nv04_crtc_mode_set_base(struct drm_crtc *crtc, int x, int y,
+			struct drm_framebuffer *old_fb);
+
+static void
+crtc_wr_cio_state(struct drm_crtc *crtc, struct nv04_crtc_reg *crtcstate, int index)
+{
+	NVWriteVgaCrtc(crtc->dev, nouveau_crtc(crtc)->index, index,
+		       crtcstate->CRTC[index]);
+}
+
+static void nv_crtc_set_digital_vibrance(struct drm_crtc *crtc, int level)
+{
+	struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
+	struct drm_nouveau_private *dev_priv = crtc->dev->dev_private;
+	struct nv04_crtc_reg *regp = &dev_priv->mode_reg.crtc_reg[nv_crtc->index];
+
+	regp->CRTC[NV_CIO_CRE_CSB] = nv_crtc->saturation = level;
+	if (nv_crtc->saturation && nv_gf4_disp_arch(crtc->dev)) {
+		regp->CRTC[NV_CIO_CRE_CSB] = 0x80;
+		regp->CRTC[NV_CIO_CRE_5B] = nv_crtc->saturation << 2;
+		crtc_wr_cio_state(crtc, regp, NV_CIO_CRE_5B);
+	}
+	crtc_wr_cio_state(crtc, regp, NV_CIO_CRE_CSB);
+}
+
+static void nv_crtc_set_image_sharpening(struct drm_crtc *crtc, int level)
+{
+	struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
+	struct drm_nouveau_private *dev_priv = crtc->dev->dev_private;
+	struct nv04_crtc_reg *regp = &dev_priv->mode_reg.crtc_reg[nv_crtc->index];
+
+	nv_crtc->sharpness = level;
+	if (level < 0)	/* blur is in hw range 0x3f -> 0x20 */
+		level += 0x40;
+	regp->ramdac_634 = level;
+	NVWriteRAMDAC(crtc->dev, nv_crtc->index, NV_PRAMDAC_634, regp->ramdac_634);
+}
+
+#define PLLSEL_VPLL1_MASK				\
+	(NV_PRAMDAC_PLL_COEFF_SELECT_SOURCE_PROG_VPLL	\
+	 | NV_PRAMDAC_PLL_COEFF_SELECT_VCLK_RATIO_DB2)
+#define PLLSEL_VPLL2_MASK				\
+	(NV_PRAMDAC_PLL_COEFF_SELECT_PLL_SOURCE_VPLL2		\
+	 | NV_PRAMDAC_PLL_COEFF_SELECT_VCLK2_RATIO_DB2)
+#define PLLSEL_TV_MASK					\
+	(NV_PRAMDAC_PLL_COEFF_SELECT_TV_VSCLK1		\
+	 | NV_PRAMDAC_PLL_COEFF_SELECT_TV_PCLK1		\
+	 | NV_PRAMDAC_PLL_COEFF_SELECT_TV_VSCLK2	\
+	 | NV_PRAMDAC_PLL_COEFF_SELECT_TV_PCLK2)
+
+/* NV4x 0x40.. pll notes:
+ * gpu pll: 0x4000 + 0x4004
+ * ?gpu? pll: 0x4008 + 0x400c
+ * vpll1: 0x4010 + 0x4014
+ * vpll2: 0x4018 + 0x401c
+ * mpll: 0x4020 + 0x4024
+ * mpll: 0x4038 + 0x403c
+ *
+ * the first register of each pair has some unknown details:
+ * bits 0-7: redirected values from elsewhere? (similar to PLL_SETUP_CONTROL?)
+ * bits 20-23: (mpll) something to do with post divider?
+ * bits 28-31: related to single stage mode? (bit 8/12)
+ */
+
+static void nv_crtc_calc_state_ext(struct drm_crtc *crtc, struct drm_display_mode * mode, int dot_clock)
+{
+	struct drm_device *dev = crtc->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
+	struct nv04_mode_state *state = &dev_priv->mode_reg;
+	struct nv04_crtc_reg *regp = &state->crtc_reg[nv_crtc->index];
+	struct nouveau_pll_vals *pv = &regp->pllvals;
+	struct pll_lims pll_lim;
+
+	if (get_pll_limits(dev, nv_crtc->index ? VPLL2 : VPLL1, &pll_lim))
+		return;
+
+	/* NM2 == 0 is used to determine single stage mode on two stage plls */
+	pv->NM2 = 0;
+
+	/* for newer nv4x the blob uses only the first stage of the vpll below a
+	 * certain clock.  for a certain nv4b this is 150MHz.  since the max
+	 * output frequency of the first stage for this card is 300MHz, it is
+	 * assumed the threshold is given by vco1 maxfreq/2
+	 */
+	/* for early nv4x, specifically nv40 and *some* nv43 (devids 0 and 6,
+	 * not 8, others unknown), the blob always uses both plls.  no problem
+	 * has yet been observed in allowing the use a single stage pll on all
+	 * nv43 however.  the behaviour of single stage use is untested on nv40
+	 */
+	if (dev_priv->chipset > 0x40 && dot_clock <= (pll_lim.vco1.maxfreq / 2))
+		memset(&pll_lim.vco2, 0, sizeof(pll_lim.vco2));
+
+	if (!nouveau_calc_pll_mnp(dev, &pll_lim, dot_clock, pv))
+		return;
+
+	state->pllsel &= PLLSEL_VPLL1_MASK | PLLSEL_VPLL2_MASK | PLLSEL_TV_MASK;
+
+	/* The blob uses this always, so let's do the same */
+	if (dev_priv->card_type == NV_40)
+		state->pllsel |= NV_PRAMDAC_PLL_COEFF_SELECT_USE_VPLL2_TRUE;
+	/* again nv40 and some nv43 act more like nv3x as described above */
+	if (dev_priv->chipset < 0x41)
+		state->pllsel |= NV_PRAMDAC_PLL_COEFF_SELECT_SOURCE_PROG_MPLL |
+				 NV_PRAMDAC_PLL_COEFF_SELECT_SOURCE_PROG_NVPLL;
+	state->pllsel |= nv_crtc->index ? PLLSEL_VPLL2_MASK : PLLSEL_VPLL1_MASK;
+
+	if (pv->NM2)
+		NV_DEBUG_KMS(dev, "vpll: n1 %d n2 %d m1 %d m2 %d log2p %d\n",
+			 pv->N1, pv->N2, pv->M1, pv->M2, pv->log2P);
+	else
+		NV_DEBUG_KMS(dev, "vpll: n %d m %d log2p %d\n",
+			 pv->N1, pv->M1, pv->log2P);
+
+	nv_crtc->cursor.set_offset(nv_crtc, nv_crtc->cursor.offset);
+}
+
+static void
+nv_crtc_dpms(struct drm_crtc *crtc, int mode)
+{
+	struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
+	struct drm_device *dev = crtc->dev;
+	unsigned char seq1 = 0, crtc17 = 0;
+	unsigned char crtc1A;
+
+	NV_DEBUG_KMS(dev, "Setting dpms mode %d on CRTC %d\n", mode,
+							nv_crtc->index);
+
+	if (nv_crtc->last_dpms == mode) /* Don't do unnecesary mode changes. */
+		return;
+
+	nv_crtc->last_dpms = mode;
+
+	if (nv_two_heads(dev))
+		NVSetOwner(dev, nv_crtc->index);
+
+	/* nv4ref indicates these two RPC1 bits inhibit h/v sync */
+	crtc1A = NVReadVgaCrtc(dev, nv_crtc->index,
+					NV_CIO_CRE_RPC1_INDEX) & ~0xC0;
+	switch (mode) {
+	case DRM_MODE_DPMS_STANDBY:
+		/* Screen: Off; HSync: Off, VSync: On -- Not Supported */
+		seq1 = 0x20;
+		crtc17 = 0x80;
+		crtc1A |= 0x80;
+		break;
+	case DRM_MODE_DPMS_SUSPEND:
+		/* Screen: Off; HSync: On, VSync: Off -- Not Supported */
+		seq1 = 0x20;
+		crtc17 = 0x80;
+		crtc1A |= 0x40;
+		break;
+	case DRM_MODE_DPMS_OFF:
+		/* Screen: Off; HSync: Off, VSync: Off */
+		seq1 = 0x20;
+		crtc17 = 0x00;
+		crtc1A |= 0xC0;
+		break;
+	case DRM_MODE_DPMS_ON:
+	default:
+		/* Screen: On; HSync: On, VSync: On */
+		seq1 = 0x00;
+		crtc17 = 0x80;
+		break;
+	}
+
+	NVVgaSeqReset(dev, nv_crtc->index, true);
+	/* Each head has it's own sequencer, so we can turn it off when we want */
+	seq1 |= (NVReadVgaSeq(dev, nv_crtc->index, NV_VIO_SR_CLOCK_INDEX) & ~0x20);
+	NVWriteVgaSeq(dev, nv_crtc->index, NV_VIO_SR_CLOCK_INDEX, seq1);
+	crtc17 |= (NVReadVgaCrtc(dev, nv_crtc->index, NV_CIO_CR_MODE_INDEX) & ~0x80);
+	mdelay(10);
+	NVWriteVgaCrtc(dev, nv_crtc->index, NV_CIO_CR_MODE_INDEX, crtc17);
+	NVVgaSeqReset(dev, nv_crtc->index, false);
+
+	NVWriteVgaCrtc(dev, nv_crtc->index, NV_CIO_CRE_RPC1_INDEX, crtc1A);
+}
+
+static bool
+nv_crtc_mode_fixup(struct drm_crtc *crtc, struct drm_display_mode *mode,
+		   struct drm_display_mode *adjusted_mode)
+{
+	return true;
+}
+
+static void
+nv_crtc_mode_set_vga(struct drm_crtc *crtc, struct drm_display_mode *mode)
+{
+	struct drm_device *dev = crtc->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
+	struct nv04_crtc_reg *regp = &dev_priv->mode_reg.crtc_reg[nv_crtc->index];
+	struct drm_framebuffer *fb = crtc->fb;
+
+	/* Calculate our timings */
+	int horizDisplay	= (mode->crtc_hdisplay >> 3) 	- 1;
+	int horizStart		= (mode->crtc_hsync_start >> 3) 	- 1;
+	int horizEnd		= (mode->crtc_hsync_end >> 3) 	- 1;
+	int horizTotal		= (mode->crtc_htotal >> 3)		- 5;
+	int horizBlankStart	= (mode->crtc_hdisplay >> 3)		- 1;
+	int horizBlankEnd	= (mode->crtc_htotal >> 3)		- 1;
+	int vertDisplay		= mode->crtc_vdisplay			- 1;
+	int vertStart		= mode->crtc_vsync_start 		- 1;
+	int vertEnd		= mode->crtc_vsync_end			- 1;
+	int vertTotal		= mode->crtc_vtotal 			- 2;
+	int vertBlankStart	= mode->crtc_vdisplay 			- 1;
+	int vertBlankEnd	= mode->crtc_vtotal			- 1;
+
+	struct drm_encoder *encoder;
+	bool fp_output = false;
+
+	list_for_each_entry(encoder, &dev->mode_config.encoder_list, head) {
+		struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
+
+		if (encoder->crtc == crtc &&
+		    (nv_encoder->dcb->type == OUTPUT_LVDS ||
+		     nv_encoder->dcb->type == OUTPUT_TMDS))
+			fp_output = true;
+	}
+
+	if (fp_output) {
+		vertStart = vertTotal - 3;
+		vertEnd = vertTotal - 2;
+		vertBlankStart = vertStart;
+		horizStart = horizTotal - 5;
+		horizEnd = horizTotal - 2;
+		horizBlankEnd = horizTotal + 4;
+#if 0
+		if (dev->overlayAdaptor && dev_priv->card_type >= NV_10)
+			/* This reportedly works around some video overlay bandwidth problems */
+			horizTotal += 2;
+#endif
+	}
+
+	if (mode->flags & DRM_MODE_FLAG_INTERLACE)
+		vertTotal |= 1;
+
+#if 0
+	ErrorF("horizDisplay: 0x%X \n", horizDisplay);
+	ErrorF("horizStart: 0x%X \n", horizStart);
+	ErrorF("horizEnd: 0x%X \n", horizEnd);
+	ErrorF("horizTotal: 0x%X \n", horizTotal);
+	ErrorF("horizBlankStart: 0x%X \n", horizBlankStart);
+	ErrorF("horizBlankEnd: 0x%X \n", horizBlankEnd);
+	ErrorF("vertDisplay: 0x%X \n", vertDisplay);
+	ErrorF("vertStart: 0x%X \n", vertStart);
+	ErrorF("vertEnd: 0x%X \n", vertEnd);
+	ErrorF("vertTotal: 0x%X \n", vertTotal);
+	ErrorF("vertBlankStart: 0x%X \n", vertBlankStart);
+	ErrorF("vertBlankEnd: 0x%X \n", vertBlankEnd);
+#endif
+
+	/*
+	* compute correct Hsync & Vsync polarity
+	*/
+	if ((mode->flags & (DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_NHSYNC))
+		&& (mode->flags & (DRM_MODE_FLAG_PVSYNC | DRM_MODE_FLAG_NVSYNC))) {
+
+		regp->MiscOutReg = 0x23;
+		if (mode->flags & DRM_MODE_FLAG_NHSYNC)
+			regp->MiscOutReg |= 0x40;
+		if (mode->flags & DRM_MODE_FLAG_NVSYNC)
+			regp->MiscOutReg |= 0x80;
+	} else {
+		int vdisplay = mode->vdisplay;
+		if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
+			vdisplay *= 2;
+		if (mode->vscan > 1)
+			vdisplay *= mode->vscan;
+		if (vdisplay < 400)
+			regp->MiscOutReg = 0xA3;	/* +hsync -vsync */
+		else if (vdisplay < 480)
+			regp->MiscOutReg = 0x63;	/* -hsync +vsync */
+		else if (vdisplay < 768)
+			regp->MiscOutReg = 0xE3;	/* -hsync -vsync */
+		else
+			regp->MiscOutReg = 0x23;	/* +hsync +vsync */
+	}
+
+	regp->MiscOutReg |= (mode->clock_index & 0x03) << 2;
+
+	/*
+	 * Time Sequencer
+	 */
+	regp->Sequencer[NV_VIO_SR_RESET_INDEX] = 0x00;
+	/* 0x20 disables the sequencer */
+	if (mode->flags & DRM_MODE_FLAG_CLKDIV2)
+		regp->Sequencer[NV_VIO_SR_CLOCK_INDEX] = 0x29;
+	else
+		regp->Sequencer[NV_VIO_SR_CLOCK_INDEX] = 0x21;
+	regp->Sequencer[NV_VIO_SR_PLANE_MASK_INDEX] = 0x0F;
+	regp->Sequencer[NV_VIO_SR_CHAR_MAP_INDEX] = 0x00;
+	regp->Sequencer[NV_VIO_SR_MEM_MODE_INDEX] = 0x0E;
+
+	/*
+	 * CRTC
+	 */
+	regp->CRTC[NV_CIO_CR_HDT_INDEX] = horizTotal;
+	regp->CRTC[NV_CIO_CR_HDE_INDEX] = horizDisplay;
+	regp->CRTC[NV_CIO_CR_HBS_INDEX] = horizBlankStart;
+	regp->CRTC[NV_CIO_CR_HBE_INDEX] = (1 << 7) |
+					  XLATE(horizBlankEnd, 0, NV_CIO_CR_HBE_4_0);
+	regp->CRTC[NV_CIO_CR_HRS_INDEX] = horizStart;
+	regp->CRTC[NV_CIO_CR_HRE_INDEX] = XLATE(horizBlankEnd, 5, NV_CIO_CR_HRE_HBE_5) |
+					  XLATE(horizEnd, 0, NV_CIO_CR_HRE_4_0);
+	regp->CRTC[NV_CIO_CR_VDT_INDEX] = vertTotal;
+	regp->CRTC[NV_CIO_CR_OVL_INDEX] = XLATE(vertStart, 9, NV_CIO_CR_OVL_VRS_9) |
+					  XLATE(vertDisplay, 9, NV_CIO_CR_OVL_VDE_9) |
+					  XLATE(vertTotal, 9, NV_CIO_CR_OVL_VDT_9) |
+					  (1 << 4) |
+					  XLATE(vertBlankStart, 8, NV_CIO_CR_OVL_VBS_8) |
+					  XLATE(vertStart, 8, NV_CIO_CR_OVL_VRS_8) |
+					  XLATE(vertDisplay, 8, NV_CIO_CR_OVL_VDE_8) |
+					  XLATE(vertTotal, 8, NV_CIO_CR_OVL_VDT_8);
+	regp->CRTC[NV_CIO_CR_RSAL_INDEX] = 0x00;
+	regp->CRTC[NV_CIO_CR_CELL_HT_INDEX] = ((mode->flags & DRM_MODE_FLAG_DBLSCAN) ? MASK(NV_CIO_CR_CELL_HT_SCANDBL) : 0) |
+					      1 << 6 |
+					      XLATE(vertBlankStart, 9, NV_CIO_CR_CELL_HT_VBS_9);
+	regp->CRTC[NV_CIO_CR_CURS_ST_INDEX] = 0x00;
+	regp->CRTC[NV_CIO_CR_CURS_END_INDEX] = 0x00;
+	regp->CRTC[NV_CIO_CR_SA_HI_INDEX] = 0x00;
+	regp->CRTC[NV_CIO_CR_SA_LO_INDEX] = 0x00;
+	regp->CRTC[NV_CIO_CR_TCOFF_HI_INDEX] = 0x00;
+	regp->CRTC[NV_CIO_CR_TCOFF_LO_INDEX] = 0x00;
+	regp->CRTC[NV_CIO_CR_VRS_INDEX] = vertStart;
+	regp->CRTC[NV_CIO_CR_VRE_INDEX] = 1 << 5 | XLATE(vertEnd, 0, NV_CIO_CR_VRE_3_0);
+	regp->CRTC[NV_CIO_CR_VDE_INDEX] = vertDisplay;
+	/* framebuffer can be larger than crtc scanout area. */
+	regp->CRTC[NV_CIO_CR_OFFSET_INDEX] = fb->pitch / 8;
+	regp->CRTC[NV_CIO_CR_ULINE_INDEX] = 0x00;
+	regp->CRTC[NV_CIO_CR_VBS_INDEX] = vertBlankStart;
+	regp->CRTC[NV_CIO_CR_VBE_INDEX] = vertBlankEnd;
+	regp->CRTC[NV_CIO_CR_MODE_INDEX] = 0x43;
+	regp->CRTC[NV_CIO_CR_LCOMP_INDEX] = 0xff;
+
+	/*
+	 * Some extended CRTC registers (they are not saved with the rest of the vga regs).
+	 */
+
+	/* framebuffer can be larger than crtc scanout area. */
+	regp->CRTC[NV_CIO_CRE_RPC0_INDEX] = XLATE(fb->pitch / 8, 8, NV_CIO_CRE_RPC0_OFFSET_10_8);
+	regp->CRTC[NV_CIO_CRE_RPC1_INDEX] = mode->crtc_hdisplay < 1280 ?
+					    MASK(NV_CIO_CRE_RPC1_LARGE) : 0x00;
+	regp->CRTC[NV_CIO_CRE_LSR_INDEX] = XLATE(horizBlankEnd, 6, NV_CIO_CRE_LSR_HBE_6) |
+					   XLATE(vertBlankStart, 10, NV_CIO_CRE_LSR_VBS_10) |
+					   XLATE(vertStart, 10, NV_CIO_CRE_LSR_VRS_10) |
+					   XLATE(vertDisplay, 10, NV_CIO_CRE_LSR_VDE_10) |
+					   XLATE(vertTotal, 10, NV_CIO_CRE_LSR_VDT_10);
+	regp->CRTC[NV_CIO_CRE_HEB__INDEX] = XLATE(horizStart, 8, NV_CIO_CRE_HEB_HRS_8) |
+					    XLATE(horizBlankStart, 8, NV_CIO_CRE_HEB_HBS_8) |
+					    XLATE(horizDisplay, 8, NV_CIO_CRE_HEB_HDE_8) |
+					    XLATE(horizTotal, 8, NV_CIO_CRE_HEB_HDT_8);
+	regp->CRTC[NV_CIO_CRE_EBR_INDEX] = XLATE(vertBlankStart, 11, NV_CIO_CRE_EBR_VBS_11) |
+					   XLATE(vertStart, 11, NV_CIO_CRE_EBR_VRS_11) |
+					   XLATE(vertDisplay, 11, NV_CIO_CRE_EBR_VDE_11) |
+					   XLATE(vertTotal, 11, NV_CIO_CRE_EBR_VDT_11);
+
+	if (mode->flags & DRM_MODE_FLAG_INTERLACE) {
+		horizTotal = (horizTotal >> 1) & ~1;
+		regp->CRTC[NV_CIO_CRE_ILACE__INDEX] = horizTotal;
+		regp->CRTC[NV_CIO_CRE_HEB__INDEX] |= XLATE(horizTotal, 8, NV_CIO_CRE_HEB_ILC_8);
+	} else
+		regp->CRTC[NV_CIO_CRE_ILACE__INDEX] = 0xff;  /* interlace off */
+
+	/*
+	* Graphics Display Controller
+	*/
+	regp->Graphics[NV_VIO_GX_SR_INDEX] = 0x00;
+	regp->Graphics[NV_VIO_GX_SREN_INDEX] = 0x00;
+	regp->Graphics[NV_VIO_GX_CCOMP_INDEX] = 0x00;
+	regp->Graphics[NV_VIO_GX_ROP_INDEX] = 0x00;
+	regp->Graphics[NV_VIO_GX_READ_MAP_INDEX] = 0x00;
+	regp->Graphics[NV_VIO_GX_MODE_INDEX] = 0x40; /* 256 color mode */
+	regp->Graphics[NV_VIO_GX_MISC_INDEX] = 0x05; /* map 64k mem + graphic mode */
+	regp->Graphics[NV_VIO_GX_DONT_CARE_INDEX] = 0x0F;
+	regp->Graphics[NV_VIO_GX_BIT_MASK_INDEX] = 0xFF;
+
+	regp->Attribute[0]  = 0x00; /* standard colormap translation */
+	regp->Attribute[1]  = 0x01;
+	regp->Attribute[2]  = 0x02;
+	regp->Attribute[3]  = 0x03;
+	regp->Attribute[4]  = 0x04;
+	regp->Attribute[5]  = 0x05;
+	regp->Attribute[6]  = 0x06;
+	regp->Attribute[7]  = 0x07;
+	regp->Attribute[8]  = 0x08;
+	regp->Attribute[9]  = 0x09;
+	regp->Attribute[10] = 0x0A;
+	regp->Attribute[11] = 0x0B;
+	regp->Attribute[12] = 0x0C;
+	regp->Attribute[13] = 0x0D;
+	regp->Attribute[14] = 0x0E;
+	regp->Attribute[15] = 0x0F;
+	regp->Attribute[NV_CIO_AR_MODE_INDEX] = 0x01; /* Enable graphic mode */
+	/* Non-vga */
+	regp->Attribute[NV_CIO_AR_OSCAN_INDEX] = 0x00;
+	regp->Attribute[NV_CIO_AR_PLANE_INDEX] = 0x0F; /* enable all color planes */
+	regp->Attribute[NV_CIO_AR_HPP_INDEX] = 0x00;
+	regp->Attribute[NV_CIO_AR_CSEL_INDEX] = 0x00;
+}
+
+/**
+ * Sets up registers for the given mode/adjusted_mode pair.
+ *
+ * The clocks, CRTCs and outputs attached to this CRTC must be off.
+ *
+ * This shouldn't enable any clocks, CRTCs, or outputs, but they should
+ * be easily turned on/off after this.
+ */
+static void
+nv_crtc_mode_set_regs(struct drm_crtc *crtc, struct drm_display_mode * mode)
+{
+	struct drm_device *dev = crtc->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
+	struct nv04_crtc_reg *regp = &dev_priv->mode_reg.crtc_reg[nv_crtc->index];
+	struct nv04_crtc_reg *savep = &dev_priv->saved_reg.crtc_reg[nv_crtc->index];
+	struct drm_encoder *encoder;
+	bool lvds_output = false, tmds_output = false, tv_output = false,
+		off_chip_digital = false;
+
+	list_for_each_entry(encoder, &dev->mode_config.encoder_list, head) {
+		struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
+		bool digital = false;
+
+		if (encoder->crtc != crtc)
+			continue;
+
+		if (nv_encoder->dcb->type == OUTPUT_LVDS)
+			digital = lvds_output = true;
+		if (nv_encoder->dcb->type == OUTPUT_TV)
+			tv_output = true;
+		if (nv_encoder->dcb->type == OUTPUT_TMDS)
+			digital = tmds_output = true;
+		if (nv_encoder->dcb->location != DCB_LOC_ON_CHIP && digital)
+			off_chip_digital = true;
+	}
+
+	/* Registers not directly related to the (s)vga mode */
+
+	/* What is the meaning of this register? */
+	/* A few popular values are 0x18, 0x1c, 0x38, 0x3c */
+	regp->CRTC[NV_CIO_CRE_ENH_INDEX] = savep->CRTC[NV_CIO_CRE_ENH_INDEX] & ~(1<<5);
+
+	regp->crtc_eng_ctrl = 0;
+	/* Except for rare conditions I2C is enabled on the primary crtc */
+	if (nv_crtc->index == 0)
+		regp->crtc_eng_ctrl |= NV_CRTC_FSEL_I2C;
+#if 0
+	/* Set overlay to desired crtc. */
+	if (dev->overlayAdaptor) {
+		NVPortPrivPtr pPriv = GET_OVERLAY_PRIVATE(dev);
+		if (pPriv->overlayCRTC == nv_crtc->index)
+			regp->crtc_eng_ctrl |= NV_CRTC_FSEL_OVERLAY;
+	}
+#endif
+
+	/* ADDRESS_SPACE_PNVM is the same as setting HCUR_ASI */
+	regp->cursor_cfg = NV_PCRTC_CURSOR_CONFIG_CUR_LINES_64 |
+			     NV_PCRTC_CURSOR_CONFIG_CUR_PIXELS_64 |
+			     NV_PCRTC_CURSOR_CONFIG_ADDRESS_SPACE_PNVM;
+	if (dev_priv->chipset >= 0x11)
+		regp->cursor_cfg |= NV_PCRTC_CURSOR_CONFIG_CUR_BPP_32;
+	if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
+		regp->cursor_cfg |= NV_PCRTC_CURSOR_CONFIG_DOUBLE_SCAN_ENABLE;
+
+	/* Unblock some timings */
+	regp->CRTC[NV_CIO_CRE_53] = 0;
+	regp->CRTC[NV_CIO_CRE_54] = 0;
+
+	/* 0x00 is disabled, 0x11 is lvds, 0x22 crt and 0x88 tmds */
+	if (lvds_output)
+		regp->CRTC[NV_CIO_CRE_SCRATCH3__INDEX] = 0x11;
+	else if (tmds_output)
+		regp->CRTC[NV_CIO_CRE_SCRATCH3__INDEX] = 0x88;
+	else
+		regp->CRTC[NV_CIO_CRE_SCRATCH3__INDEX] = 0x22;
+
+	/* These values seem to vary */
+	/* This register seems to be used by the bios to make certain decisions on some G70 cards? */
+	regp->CRTC[NV_CIO_CRE_SCRATCH4__INDEX] = savep->CRTC[NV_CIO_CRE_SCRATCH4__INDEX];
+
+	nv_crtc_set_digital_vibrance(crtc, nv_crtc->saturation);
+
+	/* probably a scratch reg, but kept for cargo-cult purposes:
+	 * bit0: crtc0?, head A
+	 * bit6: lvds, head A
+	 * bit7: (only in X), head A
+	 */
+	if (nv_crtc->index == 0)
+		regp->CRTC[NV_CIO_CRE_4B] = savep->CRTC[NV_CIO_CRE_4B] | 0x80;
+
+	/* The blob seems to take the current value from crtc 0, add 4 to that
+	 * and reuse the old value for crtc 1 */
+	regp->CRTC[NV_CIO_CRE_TVOUT_LATENCY] = dev_priv->saved_reg.crtc_reg[0].CRTC[NV_CIO_CRE_TVOUT_LATENCY];
+	if (!nv_crtc->index)
+		regp->CRTC[NV_CIO_CRE_TVOUT_LATENCY] += 4;
+
+	/* the blob sometimes sets |= 0x10 (which is the same as setting |=
+	 * 1 << 30 on 0x60.830), for no apparent reason */
+	regp->CRTC[NV_CIO_CRE_59] = off_chip_digital;
+
+	regp->crtc_830 = mode->crtc_vdisplay - 3;
+	regp->crtc_834 = mode->crtc_vdisplay - 1;
+
+	if (dev_priv->card_type == NV_40)
+		/* This is what the blob does */
+		regp->crtc_850 = NVReadCRTC(dev, 0, NV_PCRTC_850);
+
+	if (dev_priv->card_type >= NV_30)
+		regp->gpio_ext = NVReadCRTC(dev, 0, NV_PCRTC_GPIO_EXT);
+
+	regp->crtc_cfg = NV_PCRTC_CONFIG_START_ADDRESS_HSYNC;
+
+	/* Some misc regs */
+	if (dev_priv->card_type == NV_40) {
+		regp->CRTC[NV_CIO_CRE_85] = 0xFF;
+		regp->CRTC[NV_CIO_CRE_86] = 0x1;
+	}
+
+	regp->CRTC[NV_CIO_CRE_PIXEL_INDEX] = (crtc->fb->depth + 1) / 8;
+	/* Enable slaved mode (called MODE_TV in nv4ref.h) */
+	if (lvds_output || tmds_output || tv_output)
+		regp->CRTC[NV_CIO_CRE_PIXEL_INDEX] |= (1 << 7);
+
+	/* Generic PRAMDAC regs */
+
+	if (dev_priv->card_type >= NV_10)
+		/* Only bit that bios and blob set. */
+		regp->nv10_cursync = (1 << 25);
+
+	regp->ramdac_gen_ctrl = NV_PRAMDAC_GENERAL_CONTROL_BPC_8BITS |
+				NV_PRAMDAC_GENERAL_CONTROL_VGA_STATE_SEL |
+				NV_PRAMDAC_GENERAL_CONTROL_PIXMIX_ON;
+	if (crtc->fb->depth == 16)
+		regp->ramdac_gen_ctrl |= NV_PRAMDAC_GENERAL_CONTROL_ALT_MODE_SEL;
+	if (dev_priv->chipset >= 0x11)
+		regp->ramdac_gen_ctrl |= NV_PRAMDAC_GENERAL_CONTROL_PIPE_LONG;
+
+	regp->ramdac_630 = 0; /* turn off green mode (tv test pattern?) */
+	regp->tv_setup = 0;
+
+	nv_crtc_set_image_sharpening(crtc, nv_crtc->sharpness);
+
+	/* Some values the blob sets */
+	regp->ramdac_8c0 = 0x100;
+	regp->ramdac_a20 = 0x0;
+	regp->ramdac_a24 = 0xfffff;
+	regp->ramdac_a34 = 0x1;
+}
+
+/**
+ * Sets up registers for the given mode/adjusted_mode pair.
+ *
+ * The clocks, CRTCs and outputs attached to this CRTC must be off.
+ *
+ * This shouldn't enable any clocks, CRTCs, or outputs, but they should
+ * be easily turned on/off after this.
+ */
+static int
+nv_crtc_mode_set(struct drm_crtc *crtc, struct drm_display_mode *mode,
+		 struct drm_display_mode *adjusted_mode,
+		 int x, int y, struct drm_framebuffer *old_fb)
+{
+	struct drm_device *dev = crtc->dev;
+	struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+
+	NV_DEBUG_KMS(dev, "CTRC mode on CRTC %d:\n", nv_crtc->index);
+	drm_mode_debug_printmodeline(adjusted_mode);
+
+	/* unlock must come after turning off FP_TG_CONTROL in output_prepare */
+	nv_lock_vga_crtc_shadow(dev, nv_crtc->index, -1);
+
+	nv_crtc_mode_set_vga(crtc, adjusted_mode);
+	/* calculated in nv04_dfp_prepare, nv40 needs it written before calculating PLLs */
+	if (dev_priv->card_type == NV_40)
+		NVWriteRAMDAC(dev, 0, NV_PRAMDAC_SEL_CLK, dev_priv->mode_reg.sel_clk);
+	nv_crtc_mode_set_regs(crtc, adjusted_mode);
+	nv_crtc_calc_state_ext(crtc, mode, adjusted_mode->clock);
+	return 0;
+}
+
+static void nv_crtc_save(struct drm_crtc *crtc)
+{
+	struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
+	struct drm_nouveau_private *dev_priv = crtc->dev->dev_private;
+	struct nv04_mode_state *state = &dev_priv->mode_reg;
+	struct nv04_crtc_reg *crtc_state = &state->crtc_reg[nv_crtc->index];
+	struct nv04_mode_state *saved = &dev_priv->saved_reg;
+	struct nv04_crtc_reg *crtc_saved = &saved->crtc_reg[nv_crtc->index];
+
+	if (nv_two_heads(crtc->dev))
+		NVSetOwner(crtc->dev, nv_crtc->index);
+
+	nouveau_hw_save_state(crtc->dev, nv_crtc->index, saved);
+
+	/* init some state to saved value */
+	state->sel_clk = saved->sel_clk & ~(0x5 << 16);
+	crtc_state->CRTC[NV_CIO_CRE_LCD__INDEX] = crtc_saved->CRTC[NV_CIO_CRE_LCD__INDEX];
+	state->pllsel = saved->pllsel & ~(PLLSEL_VPLL1_MASK | PLLSEL_VPLL2_MASK | PLLSEL_TV_MASK);
+	crtc_state->gpio_ext = crtc_saved->gpio_ext;
+}
+
+static void nv_crtc_restore(struct drm_crtc *crtc)
+{
+	struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
+	struct drm_nouveau_private *dev_priv = crtc->dev->dev_private;
+	int head = nv_crtc->index;
+	uint8_t saved_cr21 = dev_priv->saved_reg.crtc_reg[head].CRTC[NV_CIO_CRE_21];
+
+	if (nv_two_heads(crtc->dev))
+		NVSetOwner(crtc->dev, head);
+
+	nouveau_hw_load_state(crtc->dev, head, &dev_priv->saved_reg);
+	nv_lock_vga_crtc_shadow(crtc->dev, head, saved_cr21);
+
+	nv_crtc->last_dpms = NV_DPMS_CLEARED;
+}
+
+static void nv_crtc_prepare(struct drm_crtc *crtc)
+{
+	struct drm_device *dev = crtc->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
+	struct drm_crtc_helper_funcs *funcs = crtc->helper_private;
+
+	if (nv_two_heads(dev))
+		NVSetOwner(dev, nv_crtc->index);
+
+	funcs->dpms(crtc, DRM_MODE_DPMS_OFF);
+
+	NVBlankScreen(dev, nv_crtc->index, true);
+
+	/* Some more preperation. */
+	NVWriteCRTC(dev, nv_crtc->index, NV_PCRTC_CONFIG, NV_PCRTC_CONFIG_START_ADDRESS_NON_VGA);
+	if (dev_priv->card_type == NV_40) {
+		uint32_t reg900 = NVReadRAMDAC(dev, nv_crtc->index, NV_PRAMDAC_900);
+		NVWriteRAMDAC(dev, nv_crtc->index, NV_PRAMDAC_900, reg900 & ~0x10000);
+	}
+}
+
+static void nv_crtc_commit(struct drm_crtc *crtc)
+{
+	struct drm_device *dev = crtc->dev;
+	struct drm_crtc_helper_funcs *funcs = crtc->helper_private;
+	struct drm_nouveau_private *dev_priv = crtc->dev->dev_private;
+	struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
+
+	nouveau_hw_load_state(dev, nv_crtc->index, &dev_priv->mode_reg);
+	nv04_crtc_mode_set_base(crtc, crtc->x, crtc->y, NULL);
+
+#ifdef __BIG_ENDIAN
+	/* turn on LFB swapping */
+	{
+		uint8_t tmp = NVReadVgaCrtc(dev, nv_crtc->index, NV_CIO_CRE_RCR);
+		tmp |= MASK(NV_CIO_CRE_RCR_ENDIAN_BIG);
+		NVWriteVgaCrtc(dev, nv_crtc->index, NV_CIO_CRE_RCR, tmp);
+	}
+#endif
+
+	funcs->dpms(crtc, DRM_MODE_DPMS_ON);
+}
+
+static void nv_crtc_destroy(struct drm_crtc *crtc)
+{
+	struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
+
+	NV_DEBUG_KMS(crtc->dev, "\n");
+
+	if (!nv_crtc)
+		return;
+
+	drm_crtc_cleanup(crtc);
+
+	nouveau_bo_ref(NULL, &nv_crtc->cursor.nvbo);
+	kfree(nv_crtc);
+}
+
+static void
+nv_crtc_gamma_load(struct drm_crtc *crtc)
+{
+	struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
+	struct drm_device *dev = nv_crtc->base.dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct rgb { uint8_t r, g, b; } __attribute__((packed)) *rgbs;
+	int i;
+
+	rgbs = (struct rgb *)dev_priv->mode_reg.crtc_reg[nv_crtc->index].DAC;
+	for (i = 0; i < 256; i++) {
+		rgbs[i].r = nv_crtc->lut.r[i] >> 8;
+		rgbs[i].g = nv_crtc->lut.g[i] >> 8;
+		rgbs[i].b = nv_crtc->lut.b[i] >> 8;
+	}
+
+	nouveau_hw_load_state_palette(dev, nv_crtc->index, &dev_priv->mode_reg);
+}
+
+static void
+nv_crtc_gamma_set(struct drm_crtc *crtc, u16 *r, u16 *g, u16 *b, uint32_t size)
+{
+	struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
+	int i;
+
+	if (size != 256)
+		return;
+
+	for (i = 0; i < 256; i++) {
+		nv_crtc->lut.r[i] = r[i];
+		nv_crtc->lut.g[i] = g[i];
+		nv_crtc->lut.b[i] = b[i];
+	}
+
+	/* We need to know the depth before we upload, but it's possible to
+	 * get called before a framebuffer is bound.  If this is the case,
+	 * mark the lut values as dirty by setting depth==0, and it'll be
+	 * uploaded on the first mode_set_base()
+	 */
+	if (!nv_crtc->base.fb) {
+		nv_crtc->lut.depth = 0;
+		return;
+	}
+
+	nv_crtc_gamma_load(crtc);
+}
+
+static int
+nv04_crtc_mode_set_base(struct drm_crtc *crtc, int x, int y,
+			struct drm_framebuffer *old_fb)
+{
+	struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
+	struct drm_device *dev = crtc->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nv04_crtc_reg *regp = &dev_priv->mode_reg.crtc_reg[nv_crtc->index];
+	struct drm_framebuffer *drm_fb = nv_crtc->base.fb;
+	struct nouveau_framebuffer *fb = nouveau_framebuffer(drm_fb);
+	int arb_burst, arb_lwm;
+	int ret;
+
+	ret = nouveau_bo_pin(fb->nvbo, TTM_PL_FLAG_VRAM);
+	if (ret)
+		return ret;
+
+	if (old_fb) {
+		struct nouveau_framebuffer *ofb = nouveau_framebuffer(old_fb);
+		nouveau_bo_unpin(ofb->nvbo);
+	}
+
+	nv_crtc->fb.offset = fb->nvbo->bo.offset;
+
+	if (nv_crtc->lut.depth != drm_fb->depth) {
+		nv_crtc->lut.depth = drm_fb->depth;
+		nv_crtc_gamma_load(crtc);
+	}
+
+	/* Update the framebuffer format. */
+	regp->CRTC[NV_CIO_CRE_PIXEL_INDEX] &= ~3;
+	regp->CRTC[NV_CIO_CRE_PIXEL_INDEX] |= (crtc->fb->depth + 1) / 8;
+	regp->ramdac_gen_ctrl &= ~NV_PRAMDAC_GENERAL_CONTROL_ALT_MODE_SEL;
+	if (crtc->fb->depth == 16)
+		regp->ramdac_gen_ctrl |= NV_PRAMDAC_GENERAL_CONTROL_ALT_MODE_SEL;
+	crtc_wr_cio_state(crtc, regp, NV_CIO_CRE_PIXEL_INDEX);
+	NVWriteRAMDAC(dev, nv_crtc->index, NV_PRAMDAC_GENERAL_CONTROL,
+		      regp->ramdac_gen_ctrl);
+
+	regp->CRTC[NV_CIO_CR_OFFSET_INDEX] = drm_fb->pitch >> 3;
+	regp->CRTC[NV_CIO_CRE_RPC0_INDEX] =
+		XLATE(drm_fb->pitch >> 3, 8, NV_CIO_CRE_RPC0_OFFSET_10_8);
+	crtc_wr_cio_state(crtc, regp, NV_CIO_CRE_RPC0_INDEX);
+	crtc_wr_cio_state(crtc, regp, NV_CIO_CR_OFFSET_INDEX);
+
+	/* Update the framebuffer location. */
+	regp->fb_start = nv_crtc->fb.offset & ~3;
+	regp->fb_start += (y * drm_fb->pitch) + (x * drm_fb->bits_per_pixel / 8);
+	NVWriteCRTC(dev, nv_crtc->index, NV_PCRTC_START, regp->fb_start);
+
+	/* Update the arbitration parameters. */
+	nouveau_calc_arb(dev, crtc->mode.clock, drm_fb->bits_per_pixel,
+			 &arb_burst, &arb_lwm);
+
+	regp->CRTC[NV_CIO_CRE_FF_INDEX] = arb_burst;
+	regp->CRTC[NV_CIO_CRE_FFLWM__INDEX] = arb_lwm & 0xff;
+	crtc_wr_cio_state(crtc, regp, NV_CIO_CRE_FF_INDEX);
+	crtc_wr_cio_state(crtc, regp, NV_CIO_CRE_FFLWM__INDEX);
+
+	if (dev_priv->card_type >= NV_30) {
+		regp->CRTC[NV_CIO_CRE_47] = arb_lwm >> 8;
+		crtc_wr_cio_state(crtc, regp, NV_CIO_CRE_47);
+	}
+
+	return 0;
+}
+
+static void nv04_cursor_upload(struct drm_device *dev, struct nouveau_bo *src,
+			       struct nouveau_bo *dst)
+{
+	int width = nv_cursor_width(dev);
+	uint32_t pixel;
+	int i, j;
+
+	for (i = 0; i < width; i++) {
+		for (j = 0; j < width; j++) {
+			pixel = nouveau_bo_rd32(src, i*64 + j);
+
+			nouveau_bo_wr16(dst, i*width + j, (pixel & 0x80000000) >> 16
+				     | (pixel & 0xf80000) >> 9
+				     | (pixel & 0xf800) >> 6
+				     | (pixel & 0xf8) >> 3);
+		}
+	}
+}
+
+static void nv11_cursor_upload(struct drm_device *dev, struct nouveau_bo *src,
+			       struct nouveau_bo *dst)
+{
+	uint32_t pixel;
+	int alpha, i;
+
+	/* nv11+ supports premultiplied (PM), or non-premultiplied (NPM) alpha
+	 * cursors (though NPM in combination with fp dithering may not work on
+	 * nv11, from "nv" driver history)
+	 * NPM mode needs NV_PCRTC_CURSOR_CONFIG_ALPHA_BLEND set and is what the
+	 * blob uses, however we get given PM cursors so we use PM mode
+	 */
+	for (i = 0; i < 64 * 64; i++) {
+		pixel = nouveau_bo_rd32(src, i);
+
+		/* hw gets unhappy if alpha <= rgb values.  for a PM image "less
+		 * than" shouldn't happen; fix "equal to" case by adding one to
+		 * alpha channel (slightly inaccurate, but so is attempting to
+		 * get back to NPM images, due to limits of integer precision)
+		 */
+		alpha = pixel >> 24;
+		if (alpha > 0 && alpha < 255)
+			pixel = (pixel & 0x00ffffff) | ((alpha + 1) << 24);
+
+#ifdef __BIG_ENDIAN
+		{
+			struct drm_nouveau_private *dev_priv = dev->dev_private;
+
+			if (dev_priv->chipset == 0x11) {
+				pixel = ((pixel & 0x000000ff) << 24) |
+					((pixel & 0x0000ff00) << 8) |
+					((pixel & 0x00ff0000) >> 8) |
+					((pixel & 0xff000000) >> 24);
+			}
+		}
+#endif
+
+		nouveau_bo_wr32(dst, i, pixel);
+	}
+}
+
+static int
+nv04_crtc_cursor_set(struct drm_crtc *crtc, struct drm_file *file_priv,
+		     uint32_t buffer_handle, uint32_t width, uint32_t height)
+{
+	struct drm_nouveau_private *dev_priv = crtc->dev->dev_private;
+	struct drm_device *dev = dev_priv->dev;
+	struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
+	struct nouveau_bo *cursor = NULL;
+	struct drm_gem_object *gem;
+	int ret = 0;
+
+	if (width != 64 || height != 64)
+		return -EINVAL;
+
+	if (!buffer_handle) {
+		nv_crtc->cursor.hide(nv_crtc, true);
+		return 0;
+	}
+
+	gem = drm_gem_object_lookup(dev, file_priv, buffer_handle);
+	if (!gem)
+		return -EINVAL;
+	cursor = nouveau_gem_object(gem);
+
+	ret = nouveau_bo_map(cursor);
+	if (ret)
+		goto out;
+
+	if (dev_priv->chipset >= 0x11)
+		nv11_cursor_upload(dev, cursor, nv_crtc->cursor.nvbo);
+	else
+		nv04_cursor_upload(dev, cursor, nv_crtc->cursor.nvbo);
+
+	nouveau_bo_unmap(cursor);
+	nv_crtc->cursor.offset = nv_crtc->cursor.nvbo->bo.offset;
+	nv_crtc->cursor.set_offset(nv_crtc, nv_crtc->cursor.offset);
+	nv_crtc->cursor.show(nv_crtc, true);
+out:
+	mutex_lock(&dev->struct_mutex);
+	drm_gem_object_unreference(gem);
+	mutex_unlock(&dev->struct_mutex);
+	return ret;
+}
+
+static int
+nv04_crtc_cursor_move(struct drm_crtc *crtc, int x, int y)
+{
+	struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
+
+	nv_crtc->cursor.set_pos(nv_crtc, x, y);
+	return 0;
+}
+
+static const struct drm_crtc_funcs nv04_crtc_funcs = {
+	.save = nv_crtc_save,
+	.restore = nv_crtc_restore,
+	.cursor_set = nv04_crtc_cursor_set,
+	.cursor_move = nv04_crtc_cursor_move,
+	.gamma_set = nv_crtc_gamma_set,
+	.set_config = drm_crtc_helper_set_config,
+	.destroy = nv_crtc_destroy,
+};
+
+static const struct drm_crtc_helper_funcs nv04_crtc_helper_funcs = {
+	.dpms = nv_crtc_dpms,
+	.prepare = nv_crtc_prepare,
+	.commit = nv_crtc_commit,
+	.mode_fixup = nv_crtc_mode_fixup,
+	.mode_set = nv_crtc_mode_set,
+	.mode_set_base = nv04_crtc_mode_set_base,
+	.load_lut = nv_crtc_gamma_load,
+};
+
+int
+nv04_crtc_create(struct drm_device *dev, int crtc_num)
+{
+	struct nouveau_crtc *nv_crtc;
+	int ret, i;
+
+	nv_crtc = kzalloc(sizeof(*nv_crtc), GFP_KERNEL);
+	if (!nv_crtc)
+		return -ENOMEM;
+
+	for (i = 0; i < 256; i++) {
+		nv_crtc->lut.r[i] = i << 8;
+		nv_crtc->lut.g[i] = i << 8;
+		nv_crtc->lut.b[i] = i << 8;
+	}
+	nv_crtc->lut.depth = 0;
+
+	nv_crtc->index = crtc_num;
+	nv_crtc->last_dpms = NV_DPMS_CLEARED;
+
+	drm_crtc_init(dev, &nv_crtc->base, &nv04_crtc_funcs);
+	drm_crtc_helper_add(&nv_crtc->base, &nv04_crtc_helper_funcs);
+	drm_mode_crtc_set_gamma_size(&nv_crtc->base, 256);
+
+	ret = nouveau_bo_new(dev, NULL, 64*64*4, 0x100, TTM_PL_FLAG_VRAM,
+			     0, 0x0000, false, true, &nv_crtc->cursor.nvbo);
+	if (!ret) {
+		ret = nouveau_bo_pin(nv_crtc->cursor.nvbo, TTM_PL_FLAG_VRAM);
+		if (!ret)
+			ret = nouveau_bo_map(nv_crtc->cursor.nvbo);
+		if (ret)
+			nouveau_bo_ref(NULL, &nv_crtc->cursor.nvbo);
+	}
+
+	nv04_cursor_init(nv_crtc);
+
+	return 0;
+}
+
diff --git a/drivers/gpu/drm/nouveau/nv04_cursor.c b/drivers/gpu/drm/nouveau/nv04_cursor.c
new file mode 100644
index 000000000000..89a91b9d8b25
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nv04_cursor.c
@@ -0,0 +1,70 @@
+#include "drmP.h"
+#include "drm_mode.h"
+#include "nouveau_reg.h"
+#include "nouveau_drv.h"
+#include "nouveau_crtc.h"
+#include "nouveau_hw.h"
+
+static void
+nv04_cursor_show(struct nouveau_crtc *nv_crtc, bool update)
+{
+	nv_show_cursor(nv_crtc->base.dev, nv_crtc->index, true);
+}
+
+static void
+nv04_cursor_hide(struct nouveau_crtc *nv_crtc, bool update)
+{
+	nv_show_cursor(nv_crtc->base.dev, nv_crtc->index, false);
+}
+
+static void
+nv04_cursor_set_pos(struct nouveau_crtc *nv_crtc, int x, int y)
+{
+	NVWriteRAMDAC(nv_crtc->base.dev, nv_crtc->index,
+		      NV_PRAMDAC_CU_START_POS,
+		      XLATE(y, 0, NV_PRAMDAC_CU_START_POS_Y) |
+		      XLATE(x, 0, NV_PRAMDAC_CU_START_POS_X));
+}
+
+static void
+crtc_wr_cio_state(struct drm_crtc *crtc, struct nv04_crtc_reg *crtcstate, int index)
+{
+	NVWriteVgaCrtc(crtc->dev, nouveau_crtc(crtc)->index, index,
+		       crtcstate->CRTC[index]);
+}
+
+static void
+nv04_cursor_set_offset(struct nouveau_crtc *nv_crtc, uint32_t offset)
+{
+	struct drm_device *dev = nv_crtc->base.dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nv04_crtc_reg *regp = &dev_priv->mode_reg.crtc_reg[nv_crtc->index];
+	struct drm_crtc *crtc = &nv_crtc->base;
+
+	regp->CRTC[NV_CIO_CRE_HCUR_ADDR0_INDEX] =
+		MASK(NV_CIO_CRE_HCUR_ASI) |
+		XLATE(offset, 17, NV_CIO_CRE_HCUR_ADDR0_ADR);
+	regp->CRTC[NV_CIO_CRE_HCUR_ADDR1_INDEX] =
+		XLATE(offset, 11, NV_CIO_CRE_HCUR_ADDR1_ADR);
+	if (crtc->mode.flags & DRM_MODE_FLAG_DBLSCAN)
+		regp->CRTC[NV_CIO_CRE_HCUR_ADDR1_INDEX] |=
+			MASK(NV_CIO_CRE_HCUR_ADDR1_CUR_DBL);
+	regp->CRTC[NV_CIO_CRE_HCUR_ADDR2_INDEX] = offset >> 24;
+
+	crtc_wr_cio_state(crtc, regp, NV_CIO_CRE_HCUR_ADDR0_INDEX);
+	crtc_wr_cio_state(crtc, regp, NV_CIO_CRE_HCUR_ADDR1_INDEX);
+	crtc_wr_cio_state(crtc, regp, NV_CIO_CRE_HCUR_ADDR2_INDEX);
+	if (dev_priv->card_type == NV_40)
+		nv_fix_nv40_hw_cursor(dev, nv_crtc->index);
+}
+
+int
+nv04_cursor_init(struct nouveau_crtc *crtc)
+{
+	crtc->cursor.set_offset = nv04_cursor_set_offset;
+	crtc->cursor.set_pos = nv04_cursor_set_pos;
+	crtc->cursor.hide = nv04_cursor_hide;
+	crtc->cursor.show = nv04_cursor_show;
+	return 0;
+}
+
diff --git a/drivers/gpu/drm/nouveau/nv04_dac.c b/drivers/gpu/drm/nouveau/nv04_dac.c
new file mode 100644
index 000000000000..d0e038d28948
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nv04_dac.c
@@ -0,0 +1,527 @@
+/*
+ * Copyright 2003 NVIDIA, Corporation
+ * Copyright 2006 Dave Airlie
+ * Copyright 2007 Maarten Maathuis
+ * Copyright 2007-2009 Stuart Bennett
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ */
+
+#include "drmP.h"
+#include "drm_crtc_helper.h"
+
+#include "nouveau_drv.h"
+#include "nouveau_encoder.h"
+#include "nouveau_connector.h"
+#include "nouveau_crtc.h"
+#include "nouveau_hw.h"
+#include "nvreg.h"
+
+int nv04_dac_output_offset(struct drm_encoder *encoder)
+{
+	struct dcb_entry *dcb = nouveau_encoder(encoder)->dcb;
+	int offset = 0;
+
+	if (dcb->or & (8 | OUTPUT_C))
+		offset += 0x68;
+	if (dcb->or & (8 | OUTPUT_B))
+		offset += 0x2000;
+
+	return offset;
+}
+
+/*
+ * arbitrary limit to number of sense oscillations tolerated in one sample
+ * period (observed to be at least 13 in "nvidia")
+ */
+#define MAX_HBLANK_OSC 20
+
+/*
+ * arbitrary limit to number of conflicting sample pairs to tolerate at a
+ * voltage step (observed to be at least 5 in "nvidia")
+ */
+#define MAX_SAMPLE_PAIRS 10
+
+static int sample_load_twice(struct drm_device *dev, bool sense[2])
+{
+	int i;
+
+	for (i = 0; i < 2; i++) {
+		bool sense_a, sense_b, sense_b_prime;
+		int j = 0;
+
+		/*
+		 * wait for bit 0 clear -- out of hblank -- (say reg value 0x4),
+		 * then wait for transition 0x4->0x5->0x4: enter hblank, leave
+		 * hblank again
+		 * use a 10ms timeout (guards against crtc being inactive, in
+		 * which case blank state would never change)
+		 */
+		if (!nouveau_wait_until(dev, 10000000, NV_PRMCIO_INP0__COLOR,
+					0x00000001, 0x00000000))
+			return -EBUSY;
+		if (!nouveau_wait_until(dev, 10000000, NV_PRMCIO_INP0__COLOR,
+					0x00000001, 0x00000001))
+			return -EBUSY;
+		if (!nouveau_wait_until(dev, 10000000, NV_PRMCIO_INP0__COLOR,
+					0x00000001, 0x00000000))
+			return -EBUSY;
+
+		udelay(100);
+		/* when level triggers, sense is _LO_ */
+		sense_a = nv_rd08(dev, NV_PRMCIO_INP0) & 0x10;
+
+		/* take another reading until it agrees with sense_a... */
+		do {
+			udelay(100);
+			sense_b = nv_rd08(dev, NV_PRMCIO_INP0) & 0x10;
+			if (sense_a != sense_b) {
+				sense_b_prime =
+					nv_rd08(dev, NV_PRMCIO_INP0) & 0x10;
+				if (sense_b == sense_b_prime) {
+					/* ... unless two consecutive subsequent
+					 * samples agree; sense_a is replaced */
+					sense_a = sense_b;
+					/* force mis-match so we loop */
+					sense_b = !sense_a;
+				}
+			}
+		} while ((sense_a != sense_b) && ++j < MAX_HBLANK_OSC);
+
+		if (j == MAX_HBLANK_OSC)
+			/* with so much oscillation, default to sense:LO */
+			sense[i] = false;
+		else
+			sense[i] = sense_a;
+	}
+
+	return 0;
+}
+
+static enum drm_connector_status nv04_dac_detect(struct drm_encoder *encoder,
+						 struct drm_connector *connector)
+{
+	struct drm_device *dev = encoder->dev;
+	uint8_t saved_seq1, saved_pi, saved_rpc1;
+	uint8_t saved_palette0[3], saved_palette_mask;
+	uint32_t saved_rtest_ctrl, saved_rgen_ctrl;
+	int i;
+	uint8_t blue;
+	bool sense = true;
+
+	/*
+	 * for this detection to work, there needs to be a mode set up on the
+	 * CRTC.  this is presumed to be the case
+	 */
+
+	if (nv_two_heads(dev))
+		/* only implemented for head A for now */
+		NVSetOwner(dev, 0);
+
+	saved_seq1 = NVReadVgaSeq(dev, 0, NV_VIO_SR_CLOCK_INDEX);
+	NVWriteVgaSeq(dev, 0, NV_VIO_SR_CLOCK_INDEX, saved_seq1 & ~0x20);
+
+	saved_rtest_ctrl = NVReadRAMDAC(dev, 0, NV_PRAMDAC_TEST_CONTROL);
+	NVWriteRAMDAC(dev, 0, NV_PRAMDAC_TEST_CONTROL,
+		      saved_rtest_ctrl & ~NV_PRAMDAC_TEST_CONTROL_PWRDWN_DAC_OFF);
+
+	msleep(10);
+
+	saved_pi = NVReadVgaCrtc(dev, 0, NV_CIO_CRE_PIXEL_INDEX);
+	NVWriteVgaCrtc(dev, 0, NV_CIO_CRE_PIXEL_INDEX,
+		       saved_pi & ~(0x80 | MASK(NV_CIO_CRE_PIXEL_FORMAT)));
+	saved_rpc1 = NVReadVgaCrtc(dev, 0, NV_CIO_CRE_RPC1_INDEX);
+	NVWriteVgaCrtc(dev, 0, NV_CIO_CRE_RPC1_INDEX, saved_rpc1 & ~0xc0);
+
+	nv_wr08(dev, NV_PRMDIO_READ_MODE_ADDRESS, 0x0);
+	for (i = 0; i < 3; i++)
+		saved_palette0[i] = nv_rd08(dev, NV_PRMDIO_PALETTE_DATA);
+	saved_palette_mask = nv_rd08(dev, NV_PRMDIO_PIXEL_MASK);
+	nv_wr08(dev, NV_PRMDIO_PIXEL_MASK, 0);
+
+	saved_rgen_ctrl = NVReadRAMDAC(dev, 0, NV_PRAMDAC_GENERAL_CONTROL);
+	NVWriteRAMDAC(dev, 0, NV_PRAMDAC_GENERAL_CONTROL,
+		      (saved_rgen_ctrl & ~(NV_PRAMDAC_GENERAL_CONTROL_BPC_8BITS |
+					   NV_PRAMDAC_GENERAL_CONTROL_TERMINATION_75OHM)) |
+		      NV_PRAMDAC_GENERAL_CONTROL_PIXMIX_ON);
+
+	blue = 8;	/* start of test range */
+
+	do {
+		bool sense_pair[2];
+
+		nv_wr08(dev, NV_PRMDIO_WRITE_MODE_ADDRESS, 0);
+		nv_wr08(dev, NV_PRMDIO_PALETTE_DATA, 0);
+		nv_wr08(dev, NV_PRMDIO_PALETTE_DATA, 0);
+		/* testing blue won't find monochrome monitors.  I don't care */
+		nv_wr08(dev, NV_PRMDIO_PALETTE_DATA, blue);
+
+		i = 0;
+		/* take sample pairs until both samples in the pair agree */
+		do {
+			if (sample_load_twice(dev, sense_pair))
+				goto out;
+		} while ((sense_pair[0] != sense_pair[1]) &&
+							++i < MAX_SAMPLE_PAIRS);
+
+		if (i == MAX_SAMPLE_PAIRS)
+			/* too much oscillation defaults to LO */
+			sense = false;
+		else
+			sense = sense_pair[0];
+
+	/*
+	 * if sense goes LO before blue ramps to 0x18, monitor is not connected.
+	 * ergo, if blue gets to 0x18, monitor must be connected
+	 */
+	} while (++blue < 0x18 && sense);
+
+out:
+	nv_wr08(dev, NV_PRMDIO_PIXEL_MASK, saved_palette_mask);
+	NVWriteRAMDAC(dev, 0, NV_PRAMDAC_GENERAL_CONTROL, saved_rgen_ctrl);
+	nv_wr08(dev, NV_PRMDIO_WRITE_MODE_ADDRESS, 0);
+	for (i = 0; i < 3; i++)
+		nv_wr08(dev, NV_PRMDIO_PALETTE_DATA, saved_palette0[i]);
+	NVWriteRAMDAC(dev, 0, NV_PRAMDAC_TEST_CONTROL, saved_rtest_ctrl);
+	NVWriteVgaCrtc(dev, 0, NV_CIO_CRE_PIXEL_INDEX, saved_pi);
+	NVWriteVgaCrtc(dev, 0, NV_CIO_CRE_RPC1_INDEX, saved_rpc1);
+	NVWriteVgaSeq(dev, 0, NV_VIO_SR_CLOCK_INDEX, saved_seq1);
+
+	if (blue == 0x18) {
+		NV_INFO(dev, "Load detected on head A\n");
+		return connector_status_connected;
+	}
+
+	return connector_status_disconnected;
+}
+
+uint32_t nv17_dac_sample_load(struct drm_encoder *encoder)
+{
+	struct drm_device *dev = encoder->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct dcb_entry *dcb = nouveau_encoder(encoder)->dcb;
+	uint32_t sample, testval, regoffset = nv04_dac_output_offset(encoder);
+	uint32_t saved_powerctrl_2 = 0, saved_powerctrl_4 = 0, saved_routput,
+		saved_rtest_ctrl, saved_gpio0, saved_gpio1, temp, routput;
+	int head;
+
+#define RGB_TEST_DATA(r, g, b) (r << 0 | g << 10 | b << 20)
+	if (dcb->type == OUTPUT_TV) {
+		testval = RGB_TEST_DATA(0xa0, 0xa0, 0xa0);
+
+		if (dev_priv->vbios->tvdactestval)
+			testval = dev_priv->vbios->tvdactestval;
+	} else {
+		testval = RGB_TEST_DATA(0x140, 0x140, 0x140); /* 0x94050140 */
+
+		if (dev_priv->vbios->dactestval)
+			testval = dev_priv->vbios->dactestval;
+	}
+
+	saved_rtest_ctrl = NVReadRAMDAC(dev, 0, NV_PRAMDAC_TEST_CONTROL + regoffset);
+	NVWriteRAMDAC(dev, 0, NV_PRAMDAC_TEST_CONTROL + regoffset,
+		      saved_rtest_ctrl & ~NV_PRAMDAC_TEST_CONTROL_PWRDWN_DAC_OFF);
+
+	saved_powerctrl_2 = nvReadMC(dev, NV_PBUS_POWERCTRL_2);
+
+	nvWriteMC(dev, NV_PBUS_POWERCTRL_2, saved_powerctrl_2 & 0xd7ffffff);
+	if (regoffset == 0x68) {
+		saved_powerctrl_4 = nvReadMC(dev, NV_PBUS_POWERCTRL_4);
+		nvWriteMC(dev, NV_PBUS_POWERCTRL_4, saved_powerctrl_4 & 0xffffffcf);
+	}
+
+	saved_gpio1 = nv17_gpio_get(dev, DCB_GPIO_TVDAC1);
+	saved_gpio0 = nv17_gpio_get(dev, DCB_GPIO_TVDAC0);
+
+	nv17_gpio_set(dev, DCB_GPIO_TVDAC1, dcb->type == OUTPUT_TV);
+	nv17_gpio_set(dev, DCB_GPIO_TVDAC0, dcb->type == OUTPUT_TV);
+
+	msleep(4);
+
+	saved_routput = NVReadRAMDAC(dev, 0, NV_PRAMDAC_DACCLK + regoffset);
+	head = (saved_routput & 0x100) >> 8;
+#if 0
+	/* if there's a spare crtc, using it will minimise flicker for the case
+	 * where the in-use crtc is in use by an off-chip tmds encoder */
+	if (xf86_config->crtc[head]->enabled && !xf86_config->crtc[head ^ 1]->enabled)
+		head ^= 1;
+#endif
+	/* nv driver and nv31 use 0xfffffeee, nv34 and 6600 use 0xfffffece */
+	routput = (saved_routput & 0xfffffece) | head << 8;
+
+	if (dev_priv->card_type >= NV_40) {
+		if (dcb->type == OUTPUT_TV)
+			routput |= 0x1a << 16;
+		else
+			routput &= ~(0x1a << 16);
+	}
+
+	NVWriteRAMDAC(dev, 0, NV_PRAMDAC_DACCLK + regoffset, routput);
+	msleep(1);
+
+	temp = NVReadRAMDAC(dev, 0, NV_PRAMDAC_DACCLK + regoffset);
+	NVWriteRAMDAC(dev, 0, NV_PRAMDAC_DACCLK + regoffset, temp | 1);
+
+	NVWriteRAMDAC(dev, head, NV_PRAMDAC_TESTPOINT_DATA,
+		      NV_PRAMDAC_TESTPOINT_DATA_NOTBLANK | testval);
+	temp = NVReadRAMDAC(dev, head, NV_PRAMDAC_TEST_CONTROL);
+	NVWriteRAMDAC(dev, head, NV_PRAMDAC_TEST_CONTROL,
+		      temp | NV_PRAMDAC_TEST_CONTROL_TP_INS_EN_ASSERTED);
+	msleep(5);
+
+	sample = NVReadRAMDAC(dev, 0, NV_PRAMDAC_TEST_CONTROL + regoffset);
+
+	temp = NVReadRAMDAC(dev, head, NV_PRAMDAC_TEST_CONTROL);
+	NVWriteRAMDAC(dev, head, NV_PRAMDAC_TEST_CONTROL,
+		      temp & ~NV_PRAMDAC_TEST_CONTROL_TP_INS_EN_ASSERTED);
+	NVWriteRAMDAC(dev, head, NV_PRAMDAC_TESTPOINT_DATA, 0);
+
+	/* bios does something more complex for restoring, but I think this is good enough */
+	NVWriteRAMDAC(dev, 0, NV_PRAMDAC_DACCLK + regoffset, saved_routput);
+	NVWriteRAMDAC(dev, 0, NV_PRAMDAC_TEST_CONTROL + regoffset, saved_rtest_ctrl);
+	if (regoffset == 0x68)
+		nvWriteMC(dev, NV_PBUS_POWERCTRL_4, saved_powerctrl_4);
+	nvWriteMC(dev, NV_PBUS_POWERCTRL_2, saved_powerctrl_2);
+
+	nv17_gpio_set(dev, DCB_GPIO_TVDAC1, saved_gpio1);
+	nv17_gpio_set(dev, DCB_GPIO_TVDAC0, saved_gpio0);
+
+	return sample;
+}
+
+static enum drm_connector_status
+nv17_dac_detect(struct drm_encoder *encoder, struct drm_connector *connector)
+{
+	struct drm_device *dev = encoder->dev;
+	struct dcb_entry *dcb = nouveau_encoder(encoder)->dcb;
+	uint32_t sample = nv17_dac_sample_load(encoder);
+
+	if (sample & NV_PRAMDAC_TEST_CONTROL_SENSEB_ALLHI) {
+		NV_INFO(dev, "Load detected on output %c\n",
+			'@' + ffs(dcb->or));
+		return connector_status_connected;
+	} else {
+		return connector_status_disconnected;
+	}
+}
+
+static bool nv04_dac_mode_fixup(struct drm_encoder *encoder,
+				struct drm_display_mode *mode,
+				struct drm_display_mode *adjusted_mode)
+{
+	return true;
+}
+
+static void nv04_dac_prepare(struct drm_encoder *encoder)
+{
+	struct drm_encoder_helper_funcs *helper = encoder->helper_private;
+	struct drm_device *dev = encoder->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	int head = nouveau_crtc(encoder->crtc)->index;
+	struct nv04_crtc_reg *crtcstate = dev_priv->mode_reg.crtc_reg;
+
+	helper->dpms(encoder, DRM_MODE_DPMS_OFF);
+
+	nv04_dfp_disable(dev, head);
+
+	/* Some NV4x have unknown values (0x3f, 0x50, 0x54, 0x6b, 0x79, 0x7f)
+	 * at LCD__INDEX which we don't alter
+	 */
+	if (!(crtcstate[head].CRTC[NV_CIO_CRE_LCD__INDEX] & 0x44))
+		crtcstate[head].CRTC[NV_CIO_CRE_LCD__INDEX] = 0;
+}
+
+
+static void nv04_dac_mode_set(struct drm_encoder *encoder,
+			      struct drm_display_mode *mode,
+			      struct drm_display_mode *adjusted_mode)
+{
+	struct drm_device *dev = encoder->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	int head = nouveau_crtc(encoder->crtc)->index;
+
+	if (nv_gf4_disp_arch(dev)) {
+		struct drm_encoder *rebind;
+		uint32_t dac_offset = nv04_dac_output_offset(encoder);
+		uint32_t otherdac;
+
+		/* bit 16-19 are bits that are set on some G70 cards,
+		 * but don't seem to have much effect */
+		NVWriteRAMDAC(dev, 0, NV_PRAMDAC_DACCLK + dac_offset,
+			      head << 8 | NV_PRAMDAC_DACCLK_SEL_DACCLK);
+		/* force any other vga encoders to bind to the other crtc */
+		list_for_each_entry(rebind, &dev->mode_config.encoder_list, head) {
+			if (rebind == encoder
+			    || nouveau_encoder(rebind)->dcb->type != OUTPUT_ANALOG)
+				continue;
+
+			dac_offset = nv04_dac_output_offset(rebind);
+			otherdac = NVReadRAMDAC(dev, 0, NV_PRAMDAC_DACCLK + dac_offset);
+			NVWriteRAMDAC(dev, 0, NV_PRAMDAC_DACCLK + dac_offset,
+				      (otherdac & ~0x0100) | (head ^ 1) << 8);
+		}
+	}
+
+	/* This could use refinement for flatpanels, but it should work this way */
+	if (dev_priv->chipset < 0x44)
+		NVWriteRAMDAC(dev, 0, NV_PRAMDAC_TEST_CONTROL + nv04_dac_output_offset(encoder), 0xf0000000);
+	else
+		NVWriteRAMDAC(dev, 0, NV_PRAMDAC_TEST_CONTROL + nv04_dac_output_offset(encoder), 0x00100000);
+}
+
+static void nv04_dac_commit(struct drm_encoder *encoder)
+{
+	struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
+	struct drm_device *dev = encoder->dev;
+	struct nouveau_crtc *nv_crtc = nouveau_crtc(encoder->crtc);
+	struct drm_encoder_helper_funcs *helper = encoder->helper_private;
+
+	helper->dpms(encoder, DRM_MODE_DPMS_ON);
+
+	NV_INFO(dev, "Output %s is running on CRTC %d using output %c\n",
+		drm_get_connector_name(&nouveau_encoder_connector_get(nv_encoder)->base),
+		nv_crtc->index, '@' + ffs(nv_encoder->dcb->or));
+}
+
+void nv04_dac_update_dacclk(struct drm_encoder *encoder, bool enable)
+{
+	struct drm_device *dev = encoder->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct dcb_entry *dcb = nouveau_encoder(encoder)->dcb;
+
+	if (nv_gf4_disp_arch(dev)) {
+		uint32_t *dac_users = &dev_priv->dac_users[ffs(dcb->or) - 1];
+		int dacclk_off = NV_PRAMDAC_DACCLK + nv04_dac_output_offset(encoder);
+		uint32_t dacclk = NVReadRAMDAC(dev, 0, dacclk_off);
+
+		if (enable) {
+			*dac_users |= 1 << dcb->index;
+			NVWriteRAMDAC(dev, 0, dacclk_off, dacclk | NV_PRAMDAC_DACCLK_SEL_DACCLK);
+
+		} else {
+			*dac_users &= ~(1 << dcb->index);
+			if (!*dac_users)
+				NVWriteRAMDAC(dev, 0, dacclk_off,
+					dacclk & ~NV_PRAMDAC_DACCLK_SEL_DACCLK);
+		}
+	}
+}
+
+static void nv04_dac_dpms(struct drm_encoder *encoder, int mode)
+{
+	struct drm_device *dev = encoder->dev;
+	struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
+
+	if (nv_encoder->last_dpms == mode)
+		return;
+	nv_encoder->last_dpms = mode;
+
+	NV_INFO(dev, "Setting dpms mode %d on vga encoder (output %d)\n",
+		     mode, nv_encoder->dcb->index);
+
+	nv04_dac_update_dacclk(encoder, mode == DRM_MODE_DPMS_ON);
+}
+
+static void nv04_dac_save(struct drm_encoder *encoder)
+{
+	struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
+	struct drm_device *dev = encoder->dev;
+
+	if (nv_gf4_disp_arch(dev))
+		nv_encoder->restore.output = NVReadRAMDAC(dev, 0, NV_PRAMDAC_DACCLK +
+							  nv04_dac_output_offset(encoder));
+}
+
+static void nv04_dac_restore(struct drm_encoder *encoder)
+{
+	struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
+	struct drm_device *dev = encoder->dev;
+
+	if (nv_gf4_disp_arch(dev))
+		NVWriteRAMDAC(dev, 0, NV_PRAMDAC_DACCLK + nv04_dac_output_offset(encoder),
+			      nv_encoder->restore.output);
+
+	nv_encoder->last_dpms = NV_DPMS_CLEARED;
+}
+
+static void nv04_dac_destroy(struct drm_encoder *encoder)
+{
+	struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
+
+	NV_DEBUG_KMS(encoder->dev, "\n");
+
+	drm_encoder_cleanup(encoder);
+	kfree(nv_encoder);
+}
+
+static const struct drm_encoder_helper_funcs nv04_dac_helper_funcs = {
+	.dpms = nv04_dac_dpms,
+	.save = nv04_dac_save,
+	.restore = nv04_dac_restore,
+	.mode_fixup = nv04_dac_mode_fixup,
+	.prepare = nv04_dac_prepare,
+	.commit = nv04_dac_commit,
+	.mode_set = nv04_dac_mode_set,
+	.detect = nv04_dac_detect
+};
+
+static const struct drm_encoder_helper_funcs nv17_dac_helper_funcs = {
+	.dpms = nv04_dac_dpms,
+	.save = nv04_dac_save,
+	.restore = nv04_dac_restore,
+	.mode_fixup = nv04_dac_mode_fixup,
+	.prepare = nv04_dac_prepare,
+	.commit = nv04_dac_commit,
+	.mode_set = nv04_dac_mode_set,
+	.detect = nv17_dac_detect
+};
+
+static const struct drm_encoder_funcs nv04_dac_funcs = {
+	.destroy = nv04_dac_destroy,
+};
+
+int nv04_dac_create(struct drm_device *dev, struct dcb_entry *entry)
+{
+	const struct drm_encoder_helper_funcs *helper;
+	struct drm_encoder *encoder;
+	struct nouveau_encoder *nv_encoder = NULL;
+
+	nv_encoder = kzalloc(sizeof(*nv_encoder), GFP_KERNEL);
+	if (!nv_encoder)
+		return -ENOMEM;
+
+	encoder = to_drm_encoder(nv_encoder);
+
+	nv_encoder->dcb = entry;
+	nv_encoder->or = ffs(entry->or) - 1;
+
+	if (nv_gf4_disp_arch(dev))
+		helper = &nv17_dac_helper_funcs;
+	else
+		helper = &nv04_dac_helper_funcs;
+
+	drm_encoder_init(dev, encoder, &nv04_dac_funcs, DRM_MODE_ENCODER_DAC);
+	drm_encoder_helper_add(encoder, helper);
+
+	encoder->possible_crtcs = entry->heads;
+	encoder->possible_clones = 0;
+
+	return 0;
+}
diff --git a/drivers/gpu/drm/nouveau/nv04_dfp.c b/drivers/gpu/drm/nouveau/nv04_dfp.c
new file mode 100644
index 000000000000..483f875bdb6a
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nv04_dfp.c
@@ -0,0 +1,623 @@
+/*
+ * Copyright 2003 NVIDIA, Corporation
+ * Copyright 2006 Dave Airlie
+ * Copyright 2007 Maarten Maathuis
+ * Copyright 2007-2009 Stuart Bennett
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ */
+
+#include "drmP.h"
+#include "drm_crtc_helper.h"
+
+#include "nouveau_drv.h"
+#include "nouveau_encoder.h"
+#include "nouveau_connector.h"
+#include "nouveau_crtc.h"
+#include "nouveau_hw.h"
+#include "nvreg.h"
+
+#define FP_TG_CONTROL_ON  (NV_PRAMDAC_FP_TG_CONTROL_DISPEN_POS |	\
+			   NV_PRAMDAC_FP_TG_CONTROL_HSYNC_POS |		\
+			   NV_PRAMDAC_FP_TG_CONTROL_VSYNC_POS)
+#define FP_TG_CONTROL_OFF (NV_PRAMDAC_FP_TG_CONTROL_DISPEN_DISABLE |	\
+			   NV_PRAMDAC_FP_TG_CONTROL_HSYNC_DISABLE |	\
+			   NV_PRAMDAC_FP_TG_CONTROL_VSYNC_DISABLE)
+
+static inline bool is_fpc_off(uint32_t fpc)
+{
+	return ((fpc & (FP_TG_CONTROL_ON | FP_TG_CONTROL_OFF)) ==
+			FP_TG_CONTROL_OFF);
+}
+
+int nv04_dfp_get_bound_head(struct drm_device *dev, struct dcb_entry *dcbent)
+{
+	/* special case of nv_read_tmds to find crtc associated with an output.
+	 * this does not give a correct answer for off-chip dvi, but there's no
+	 * use for such an answer anyway
+	 */
+	int ramdac = (dcbent->or & OUTPUT_C) >> 2;
+
+	NVWriteRAMDAC(dev, ramdac, NV_PRAMDAC_FP_TMDS_CONTROL,
+	NV_PRAMDAC_FP_TMDS_CONTROL_WRITE_DISABLE | 0x4);
+	return ((NVReadRAMDAC(dev, ramdac, NV_PRAMDAC_FP_TMDS_DATA) & 0x8) >> 3) ^ ramdac;
+}
+
+void nv04_dfp_bind_head(struct drm_device *dev, struct dcb_entry *dcbent,
+			int head, bool dl)
+{
+	/* The BIOS scripts don't do this for us, sadly
+	 * Luckily we do know the values ;-)
+	 *
+	 * head < 0 indicates we wish to force a setting with the overrideval
+	 * (for VT restore etc.)
+	 */
+
+	int ramdac = (dcbent->or & OUTPUT_C) >> 2;
+	uint8_t tmds04 = 0x80;
+
+	if (head != ramdac)
+		tmds04 = 0x88;
+
+	if (dcbent->type == OUTPUT_LVDS)
+		tmds04 |= 0x01;
+
+	nv_write_tmds(dev, dcbent->or, 0, 0x04, tmds04);
+
+	if (dl)	/* dual link */
+		nv_write_tmds(dev, dcbent->or, 1, 0x04, tmds04 ^ 0x08);
+}
+
+void nv04_dfp_disable(struct drm_device *dev, int head)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nv04_crtc_reg *crtcstate = dev_priv->mode_reg.crtc_reg;
+
+	if (NVReadRAMDAC(dev, head, NV_PRAMDAC_FP_TG_CONTROL) &
+	    FP_TG_CONTROL_ON) {
+		/* digital remnants must be cleaned before new crtc
+		 * values programmed.  delay is time for the vga stuff
+		 * to realise it's in control again
+		 */
+		NVWriteRAMDAC(dev, head, NV_PRAMDAC_FP_TG_CONTROL,
+			      FP_TG_CONTROL_OFF);
+		msleep(50);
+	}
+	/* don't inadvertently turn it on when state written later */
+	crtcstate[head].fp_control = FP_TG_CONTROL_OFF;
+}
+
+void nv04_dfp_update_fp_control(struct drm_encoder *encoder, int mode)
+{
+	struct drm_device *dev = encoder->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct drm_crtc *crtc;
+	struct nouveau_crtc *nv_crtc;
+	uint32_t *fpc;
+
+	if (mode == DRM_MODE_DPMS_ON) {
+		nv_crtc = nouveau_crtc(encoder->crtc);
+		fpc = &dev_priv->mode_reg.crtc_reg[nv_crtc->index].fp_control;
+
+		if (is_fpc_off(*fpc)) {
+			/* using saved value is ok, as (is_digital && dpms_on &&
+			 * fp_control==OFF) is (at present) *only* true when
+			 * fpc's most recent change was by below "off" code
+			 */
+			*fpc = nv_crtc->dpms_saved_fp_control;
+		}
+
+		nv_crtc->fp_users |= 1 << nouveau_encoder(encoder)->dcb->index;
+		NVWriteRAMDAC(dev, nv_crtc->index, NV_PRAMDAC_FP_TG_CONTROL, *fpc);
+	} else {
+		list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
+			nv_crtc = nouveau_crtc(crtc);
+			fpc = &dev_priv->mode_reg.crtc_reg[nv_crtc->index].fp_control;
+
+			nv_crtc->fp_users &= ~(1 << nouveau_encoder(encoder)->dcb->index);
+			if (!is_fpc_off(*fpc) && !nv_crtc->fp_users) {
+				nv_crtc->dpms_saved_fp_control = *fpc;
+				/* cut the FP output */
+				*fpc &= ~FP_TG_CONTROL_ON;
+				*fpc |= FP_TG_CONTROL_OFF;
+				NVWriteRAMDAC(dev, nv_crtc->index,
+					      NV_PRAMDAC_FP_TG_CONTROL, *fpc);
+			}
+		}
+	}
+}
+
+static bool nv04_dfp_mode_fixup(struct drm_encoder *encoder,
+				struct drm_display_mode *mode,
+				struct drm_display_mode *adjusted_mode)
+{
+	struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
+	struct nouveau_connector *nv_connector = nouveau_encoder_connector_get(nv_encoder);
+
+	/* For internal panels and gpu scaling on DVI we need the native mode */
+	if (nv_connector->scaling_mode != DRM_MODE_SCALE_NONE) {
+		if (!nv_connector->native_mode)
+			return false;
+		nv_encoder->mode = *nv_connector->native_mode;
+		adjusted_mode->clock = nv_connector->native_mode->clock;
+	} else {
+		nv_encoder->mode = *adjusted_mode;
+	}
+
+	return true;
+}
+
+static void nv04_dfp_prepare_sel_clk(struct drm_device *dev,
+				     struct nouveau_encoder *nv_encoder, int head)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nv04_mode_state *state = &dev_priv->mode_reg;
+	uint32_t bits1618 = nv_encoder->dcb->or & OUTPUT_A ? 0x10000 : 0x40000;
+
+	if (nv_encoder->dcb->location != DCB_LOC_ON_CHIP)
+		return;
+
+	/* SEL_CLK is only used on the primary ramdac
+	 * It toggles spread spectrum PLL output and sets the bindings of PLLs
+	 * to heads on digital outputs
+	 */
+	if (head)
+		state->sel_clk |= bits1618;
+	else
+		state->sel_clk &= ~bits1618;
+
+	/* nv30:
+	 *	bit 0		NVClk spread spectrum on/off
+	 *	bit 2		MemClk spread spectrum on/off
+	 * 	bit 4		PixClk1 spread spectrum on/off toggle
+	 * 	bit 6		PixClk2 spread spectrum on/off toggle
+	 *
+	 * nv40 (observations from bios behaviour and mmio traces):
+	 * 	bits 4&6	as for nv30
+	 * 	bits 5&7	head dependent as for bits 4&6, but do not appear with 4&6;
+	 * 			maybe a different spread mode
+	 * 	bits 8&10	seen on dual-link dvi outputs, purpose unknown (set by POST scripts)
+	 * 	The logic behind turning spread spectrum on/off in the first place,
+	 * 	and which bit-pair to use, is unclear on nv40 (for earlier cards, the fp table
+	 * 	entry has the necessary info)
+	 */
+	if (nv_encoder->dcb->type == OUTPUT_LVDS && dev_priv->saved_reg.sel_clk & 0xf0) {
+		int shift = (dev_priv->saved_reg.sel_clk & 0x50) ? 0 : 1;
+
+		state->sel_clk &= ~0xf0;
+		state->sel_clk |= (head ? 0x40 : 0x10) << shift;
+	}
+}
+
+static void nv04_dfp_prepare(struct drm_encoder *encoder)
+{
+	struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
+	struct drm_encoder_helper_funcs *helper = encoder->helper_private;
+	struct drm_device *dev = encoder->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	int head = nouveau_crtc(encoder->crtc)->index;
+	struct nv04_crtc_reg *crtcstate = dev_priv->mode_reg.crtc_reg;
+	uint8_t *cr_lcd = &crtcstate[head].CRTC[NV_CIO_CRE_LCD__INDEX];
+	uint8_t *cr_lcd_oth = &crtcstate[head ^ 1].CRTC[NV_CIO_CRE_LCD__INDEX];
+
+	helper->dpms(encoder, DRM_MODE_DPMS_OFF);
+
+	nv04_dfp_prepare_sel_clk(dev, nv_encoder, head);
+
+	/* Some NV4x have unknown values (0x3f, 0x50, 0x54, 0x6b, 0x79, 0x7f)
+	 * at LCD__INDEX which we don't alter
+	 */
+	if (!(*cr_lcd & 0x44)) {
+		*cr_lcd = 0x3;
+
+		if (nv_two_heads(dev)) {
+			if (nv_encoder->dcb->location == DCB_LOC_ON_CHIP)
+				*cr_lcd |= head ? 0x0 : 0x8;
+			else {
+				*cr_lcd |= (nv_encoder->dcb->or << 4) & 0x30;
+				if (nv_encoder->dcb->type == OUTPUT_LVDS)
+					*cr_lcd |= 0x30;
+				if ((*cr_lcd & 0x30) == (*cr_lcd_oth & 0x30)) {
+					/* avoid being connected to both crtcs */
+					*cr_lcd_oth &= ~0x30;
+					NVWriteVgaCrtc(dev, head ^ 1,
+						       NV_CIO_CRE_LCD__INDEX,
+						       *cr_lcd_oth);
+				}
+			}
+		}
+	}
+}
+
+
+static void nv04_dfp_mode_set(struct drm_encoder *encoder,
+			      struct drm_display_mode *mode,
+			      struct drm_display_mode *adjusted_mode)
+{
+	struct drm_device *dev = encoder->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_crtc *nv_crtc = nouveau_crtc(encoder->crtc);
+	struct nv04_crtc_reg *regp = &dev_priv->mode_reg.crtc_reg[nv_crtc->index];
+	struct nv04_crtc_reg *savep = &dev_priv->saved_reg.crtc_reg[nv_crtc->index];
+	struct nouveau_connector *nv_connector = nouveau_crtc_connector_get(nv_crtc);
+	struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
+	struct drm_display_mode *output_mode = &nv_encoder->mode;
+	uint32_t mode_ratio, panel_ratio;
+
+	NV_DEBUG_KMS(dev, "Output mode on CRTC %d:\n", nv_crtc->index);
+	drm_mode_debug_printmodeline(output_mode);
+
+	/* Initialize the FP registers in this CRTC. */
+	regp->fp_horiz_regs[FP_DISPLAY_END] = output_mode->hdisplay - 1;
+	regp->fp_horiz_regs[FP_TOTAL] = output_mode->htotal - 1;
+	if (!nv_gf4_disp_arch(dev) ||
+	    (output_mode->hsync_start - output_mode->hdisplay) >=
+					dev_priv->vbios->digital_min_front_porch)
+		regp->fp_horiz_regs[FP_CRTC] = output_mode->hdisplay;
+	else
+		regp->fp_horiz_regs[FP_CRTC] = output_mode->hsync_start - dev_priv->vbios->digital_min_front_porch - 1;
+	regp->fp_horiz_regs[FP_SYNC_START] = output_mode->hsync_start - 1;
+	regp->fp_horiz_regs[FP_SYNC_END] = output_mode->hsync_end - 1;
+	regp->fp_horiz_regs[FP_VALID_START] = output_mode->hskew;
+	regp->fp_horiz_regs[FP_VALID_END] = output_mode->hdisplay - 1;
+
+	regp->fp_vert_regs[FP_DISPLAY_END] = output_mode->vdisplay - 1;
+	regp->fp_vert_regs[FP_TOTAL] = output_mode->vtotal - 1;
+	regp->fp_vert_regs[FP_CRTC] = output_mode->vtotal - 5 - 1;
+	regp->fp_vert_regs[FP_SYNC_START] = output_mode->vsync_start - 1;
+	regp->fp_vert_regs[FP_SYNC_END] = output_mode->vsync_end - 1;
+	regp->fp_vert_regs[FP_VALID_START] = 0;
+	regp->fp_vert_regs[FP_VALID_END] = output_mode->vdisplay - 1;
+
+	/* bit26: a bit seen on some g7x, no as yet discernable purpose */
+	regp->fp_control = NV_PRAMDAC_FP_TG_CONTROL_DISPEN_POS |
+			   (savep->fp_control & (1 << 26 | NV_PRAMDAC_FP_TG_CONTROL_READ_PROG));
+	/* Deal with vsync/hsync polarity */
+	/* LVDS screens do set this, but modes with +ve syncs are very rare */
+	if (output_mode->flags & DRM_MODE_FLAG_PVSYNC)
+		regp->fp_control |= NV_PRAMDAC_FP_TG_CONTROL_VSYNC_POS;
+	if (output_mode->flags & DRM_MODE_FLAG_PHSYNC)
+		regp->fp_control |= NV_PRAMDAC_FP_TG_CONTROL_HSYNC_POS;
+	/* panel scaling first, as native would get set otherwise */
+	if (nv_connector->scaling_mode == DRM_MODE_SCALE_NONE ||
+	    nv_connector->scaling_mode == DRM_MODE_SCALE_CENTER)	/* panel handles it */
+		regp->fp_control |= NV_PRAMDAC_FP_TG_CONTROL_MODE_CENTER;
+	else if (adjusted_mode->hdisplay == output_mode->hdisplay &&
+		 adjusted_mode->vdisplay == output_mode->vdisplay) /* native mode */
+		regp->fp_control |= NV_PRAMDAC_FP_TG_CONTROL_MODE_NATIVE;
+	else /* gpu needs to scale */
+		regp->fp_control |= NV_PRAMDAC_FP_TG_CONTROL_MODE_SCALE;
+	if (nvReadEXTDEV(dev, NV_PEXTDEV_BOOT_0) & NV_PEXTDEV_BOOT_0_STRAP_FP_IFACE_12BIT)
+		regp->fp_control |= NV_PRAMDAC_FP_TG_CONTROL_WIDTH_12;
+	if (nv_encoder->dcb->location != DCB_LOC_ON_CHIP &&
+	    output_mode->clock > 165000)
+		regp->fp_control |= (2 << 24);
+	if (nv_encoder->dcb->type == OUTPUT_LVDS) {
+		bool duallink, dummy;
+
+		nouveau_bios_parse_lvds_table(dev, nv_connector->native_mode->
+					      clock, &duallink, &dummy);
+		if (duallink)
+			regp->fp_control |= (8 << 28);
+	} else
+	if (output_mode->clock > 165000)
+		regp->fp_control |= (8 << 28);
+
+	regp->fp_debug_0 = NV_PRAMDAC_FP_DEBUG_0_YWEIGHT_ROUND |
+			   NV_PRAMDAC_FP_DEBUG_0_XWEIGHT_ROUND |
+			   NV_PRAMDAC_FP_DEBUG_0_YINTERP_BILINEAR |
+			   NV_PRAMDAC_FP_DEBUG_0_XINTERP_BILINEAR |
+			   NV_RAMDAC_FP_DEBUG_0_TMDS_ENABLED |
+			   NV_PRAMDAC_FP_DEBUG_0_YSCALE_ENABLE |
+			   NV_PRAMDAC_FP_DEBUG_0_XSCALE_ENABLE;
+
+	/* We want automatic scaling */
+	regp->fp_debug_1 = 0;
+	/* This can override HTOTAL and VTOTAL */
+	regp->fp_debug_2 = 0;
+
+	/* Use 20.12 fixed point format to avoid floats */
+	mode_ratio = (1 << 12) * adjusted_mode->hdisplay / adjusted_mode->vdisplay;
+	panel_ratio = (1 << 12) * output_mode->hdisplay / output_mode->vdisplay;
+	/* if ratios are equal, SCALE_ASPECT will automatically (and correctly)
+	 * get treated the same as SCALE_FULLSCREEN */
+	if (nv_connector->scaling_mode == DRM_MODE_SCALE_ASPECT &&
+	    mode_ratio != panel_ratio) {
+		uint32_t diff, scale;
+		bool divide_by_2 = nv_gf4_disp_arch(dev);
+
+		if (mode_ratio < panel_ratio) {
+			/* vertical needs to expand to glass size (automatic)
+			 * horizontal needs to be scaled at vertical scale factor
+			 * to maintain aspect */
+
+			scale = (1 << 12) * adjusted_mode->vdisplay / output_mode->vdisplay;
+			regp->fp_debug_1 = NV_PRAMDAC_FP_DEBUG_1_XSCALE_TESTMODE_ENABLE |
+					   XLATE(scale, divide_by_2, NV_PRAMDAC_FP_DEBUG_1_XSCALE_VALUE);
+
+			/* restrict area of screen used, horizontally */
+			diff = output_mode->hdisplay -
+			       output_mode->vdisplay * mode_ratio / (1 << 12);
+			regp->fp_horiz_regs[FP_VALID_START] += diff / 2;
+			regp->fp_horiz_regs[FP_VALID_END] -= diff / 2;
+		}
+
+		if (mode_ratio > panel_ratio) {
+			/* horizontal needs to expand to glass size (automatic)
+			 * vertical needs to be scaled at horizontal scale factor
+			 * to maintain aspect */
+
+			scale = (1 << 12) * adjusted_mode->hdisplay / output_mode->hdisplay;
+			regp->fp_debug_1 = NV_PRAMDAC_FP_DEBUG_1_YSCALE_TESTMODE_ENABLE |
+					   XLATE(scale, divide_by_2, NV_PRAMDAC_FP_DEBUG_1_YSCALE_VALUE);
+
+			/* restrict area of screen used, vertically */
+			diff = output_mode->vdisplay -
+			       (1 << 12) * output_mode->hdisplay / mode_ratio;
+			regp->fp_vert_regs[FP_VALID_START] += diff / 2;
+			regp->fp_vert_regs[FP_VALID_END] -= diff / 2;
+		}
+	}
+
+	/* Output property. */
+	if (nv_connector->use_dithering) {
+		if (dev_priv->chipset == 0x11)
+			regp->dither = savep->dither | 0x00010000;
+		else {
+			int i;
+			regp->dither = savep->dither | 0x00000001;
+			for (i = 0; i < 3; i++) {
+				regp->dither_regs[i] = 0xe4e4e4e4;
+				regp->dither_regs[i + 3] = 0x44444444;
+			}
+		}
+	} else {
+		if (dev_priv->chipset != 0x11) {
+			/* reset them */
+			int i;
+			for (i = 0; i < 3; i++) {
+				regp->dither_regs[i] = savep->dither_regs[i];
+				regp->dither_regs[i + 3] = savep->dither_regs[i + 3];
+			}
+		}
+		regp->dither = savep->dither;
+	}
+
+	regp->fp_margin_color = 0;
+}
+
+static void nv04_dfp_commit(struct drm_encoder *encoder)
+{
+	struct drm_device *dev = encoder->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct drm_encoder_helper_funcs *helper = encoder->helper_private;
+	struct nouveau_crtc *nv_crtc = nouveau_crtc(encoder->crtc);
+	struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
+	struct dcb_entry *dcbe = nv_encoder->dcb;
+	int head = nouveau_crtc(encoder->crtc)->index;
+
+	NV_INFO(dev, "Output %s is running on CRTC %d using output %c\n",
+		drm_get_connector_name(&nouveau_encoder_connector_get(nv_encoder)->base),
+		nv_crtc->index, '@' + ffs(nv_encoder->dcb->or));
+
+	if (dcbe->type == OUTPUT_TMDS)
+		run_tmds_table(dev, dcbe, head, nv_encoder->mode.clock);
+	else if (dcbe->type == OUTPUT_LVDS)
+		call_lvds_script(dev, dcbe, head, LVDS_RESET, nv_encoder->mode.clock);
+
+	/* update fp_control state for any changes made by scripts,
+	 * so correct value is written at DPMS on */
+	dev_priv->mode_reg.crtc_reg[head].fp_control =
+		NVReadRAMDAC(dev, head, NV_PRAMDAC_FP_TG_CONTROL);
+
+	/* This could use refinement for flatpanels, but it should work this way */
+	if (dev_priv->chipset < 0x44)
+		NVWriteRAMDAC(dev, 0, NV_PRAMDAC_TEST_CONTROL + nv04_dac_output_offset(encoder), 0xf0000000);
+	else
+		NVWriteRAMDAC(dev, 0, NV_PRAMDAC_TEST_CONTROL + nv04_dac_output_offset(encoder), 0x00100000);
+
+	helper->dpms(encoder, DRM_MODE_DPMS_ON);
+
+	NV_INFO(dev, "Output %s is running on CRTC %d using output %c\n",
+		drm_get_connector_name(&nouveau_encoder_connector_get(nv_encoder)->base),
+		nv_crtc->index, '@' + ffs(nv_encoder->dcb->or));
+}
+
+static inline bool is_powersaving_dpms(int mode)
+{
+	return (mode != DRM_MODE_DPMS_ON);
+}
+
+static void nv04_lvds_dpms(struct drm_encoder *encoder, int mode)
+{
+	struct drm_device *dev = encoder->dev;
+	struct drm_crtc *crtc = encoder->crtc;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
+	bool was_powersaving = is_powersaving_dpms(nv_encoder->last_dpms);
+
+	if (nv_encoder->last_dpms == mode)
+		return;
+	nv_encoder->last_dpms = mode;
+
+	NV_INFO(dev, "Setting dpms mode %d on lvds encoder (output %d)\n",
+		     mode, nv_encoder->dcb->index);
+
+	if (was_powersaving && is_powersaving_dpms(mode))
+		return;
+
+	if (nv_encoder->dcb->lvdsconf.use_power_scripts) {
+		struct nouveau_connector *nv_connector = nouveau_encoder_connector_get(nv_encoder);
+
+		/* when removing an output, crtc may not be set, but PANEL_OFF
+		 * must still be run
+		 */
+		int head = crtc ? nouveau_crtc(crtc)->index :
+			   nv04_dfp_get_bound_head(dev, nv_encoder->dcb);
+
+		if (mode == DRM_MODE_DPMS_ON) {
+			if (!nv_connector->native_mode) {
+				NV_ERROR(dev, "Not turning on LVDS without native mode\n");
+				return;
+			}
+			call_lvds_script(dev, nv_encoder->dcb, head,
+					 LVDS_PANEL_ON, nv_connector->native_mode->clock);
+		} else
+			/* pxclk of 0 is fine for PANEL_OFF, and for a
+			 * disconnected LVDS encoder there is no native_mode
+			 */
+			call_lvds_script(dev, nv_encoder->dcb, head,
+					 LVDS_PANEL_OFF, 0);
+	}
+
+	nv04_dfp_update_fp_control(encoder, mode);
+
+	if (mode == DRM_MODE_DPMS_ON)
+		nv04_dfp_prepare_sel_clk(dev, nv_encoder, nouveau_crtc(crtc)->index);
+	else {
+		dev_priv->mode_reg.sel_clk = NVReadRAMDAC(dev, 0, NV_PRAMDAC_SEL_CLK);
+		dev_priv->mode_reg.sel_clk &= ~0xf0;
+	}
+	NVWriteRAMDAC(dev, 0, NV_PRAMDAC_SEL_CLK, dev_priv->mode_reg.sel_clk);
+}
+
+static void nv04_tmds_dpms(struct drm_encoder *encoder, int mode)
+{
+	struct drm_device *dev = encoder->dev;
+	struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
+
+	if (nv_encoder->last_dpms == mode)
+		return;
+	nv_encoder->last_dpms = mode;
+
+	NV_INFO(dev, "Setting dpms mode %d on tmds encoder (output %d)\n",
+		     mode, nv_encoder->dcb->index);
+
+	nv04_dfp_update_fp_control(encoder, mode);
+}
+
+static void nv04_dfp_save(struct drm_encoder *encoder)
+{
+	struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
+	struct drm_device *dev = encoder->dev;
+
+	if (nv_two_heads(dev))
+		nv_encoder->restore.head =
+			nv04_dfp_get_bound_head(dev, nv_encoder->dcb);
+}
+
+static void nv04_dfp_restore(struct drm_encoder *encoder)
+{
+	struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
+	struct drm_device *dev = encoder->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	int head = nv_encoder->restore.head;
+
+	if (nv_encoder->dcb->type == OUTPUT_LVDS) {
+		struct drm_display_mode *native_mode = nouveau_encoder_connector_get(nv_encoder)->native_mode;
+		if (native_mode)
+			call_lvds_script(dev, nv_encoder->dcb, head, LVDS_PANEL_ON,
+					 native_mode->clock);
+		else
+			NV_ERROR(dev, "Not restoring LVDS without native mode\n");
+
+	} else if (nv_encoder->dcb->type == OUTPUT_TMDS) {
+		int clock = nouveau_hw_pllvals_to_clk
+					(&dev_priv->saved_reg.crtc_reg[head].pllvals);
+
+		run_tmds_table(dev, nv_encoder->dcb, head, clock);
+	}
+
+	nv_encoder->last_dpms = NV_DPMS_CLEARED;
+}
+
+static void nv04_dfp_destroy(struct drm_encoder *encoder)
+{
+	struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
+
+	NV_DEBUG_KMS(encoder->dev, "\n");
+
+	drm_encoder_cleanup(encoder);
+	kfree(nv_encoder);
+}
+
+static const struct drm_encoder_helper_funcs nv04_lvds_helper_funcs = {
+	.dpms = nv04_lvds_dpms,
+	.save = nv04_dfp_save,
+	.restore = nv04_dfp_restore,
+	.mode_fixup = nv04_dfp_mode_fixup,
+	.prepare = nv04_dfp_prepare,
+	.commit = nv04_dfp_commit,
+	.mode_set = nv04_dfp_mode_set,
+	.detect = NULL,
+};
+
+static const struct drm_encoder_helper_funcs nv04_tmds_helper_funcs = {
+	.dpms = nv04_tmds_dpms,
+	.save = nv04_dfp_save,
+	.restore = nv04_dfp_restore,
+	.mode_fixup = nv04_dfp_mode_fixup,
+	.prepare = nv04_dfp_prepare,
+	.commit = nv04_dfp_commit,
+	.mode_set = nv04_dfp_mode_set,
+	.detect = NULL,
+};
+
+static const struct drm_encoder_funcs nv04_dfp_funcs = {
+	.destroy = nv04_dfp_destroy,
+};
+
+int nv04_dfp_create(struct drm_device *dev, struct dcb_entry *entry)
+{
+	const struct drm_encoder_helper_funcs *helper;
+	struct drm_encoder *encoder;
+	struct nouveau_encoder *nv_encoder = NULL;
+	int type;
+
+	switch (entry->type) {
+	case OUTPUT_TMDS:
+		type = DRM_MODE_ENCODER_TMDS;
+		helper = &nv04_tmds_helper_funcs;
+		break;
+	case OUTPUT_LVDS:
+		type = DRM_MODE_ENCODER_LVDS;
+		helper = &nv04_lvds_helper_funcs;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	nv_encoder = kzalloc(sizeof(*nv_encoder), GFP_KERNEL);
+	if (!nv_encoder)
+		return -ENOMEM;
+
+	encoder = to_drm_encoder(nv_encoder);
+
+	nv_encoder->dcb = entry;
+	nv_encoder->or = ffs(entry->or) - 1;
+
+	drm_encoder_init(dev, encoder, &nv04_dfp_funcs, type);
+	drm_encoder_helper_add(encoder, helper);
+
+	encoder->possible_crtcs = entry->heads;
+	encoder->possible_clones = 0;
+
+	return 0;
+}
diff --git a/drivers/gpu/drm/nouveau/nv04_display.c b/drivers/gpu/drm/nouveau/nv04_display.c
new file mode 100644
index 000000000000..ef77215fa5b9
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nv04_display.c
@@ -0,0 +1,287 @@
+/*
+ * Copyright 2009 Red Hat Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * Author: Ben Skeggs
+ */
+
+#include "drmP.h"
+#include "drm.h"
+#include "drm_crtc_helper.h"
+
+#include "nouveau_drv.h"
+#include "nouveau_fb.h"
+#include "nouveau_hw.h"
+#include "nouveau_encoder.h"
+#include "nouveau_connector.h"
+
+#define MULTIPLE_ENCODERS(e) (e & (e - 1))
+
+static void
+nv04_display_store_initial_head_owner(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+
+	if (dev_priv->chipset != 0x11) {
+		dev_priv->crtc_owner = NVReadVgaCrtc(dev, 0, NV_CIO_CRE_44);
+		goto ownerknown;
+	}
+
+	/* reading CR44 is broken on nv11, so we attempt to infer it */
+	if (nvReadMC(dev, NV_PBUS_DEBUG_1) & (1 << 28))	/* heads tied, restore both */
+		dev_priv->crtc_owner = 0x4;
+	else {
+		uint8_t slaved_on_A, slaved_on_B;
+		bool tvA = false;
+		bool tvB = false;
+
+		NVLockVgaCrtcs(dev, false);
+
+		slaved_on_B = NVReadVgaCrtc(dev, 1, NV_CIO_CRE_PIXEL_INDEX) &
+									0x80;
+		if (slaved_on_B)
+			tvB = !(NVReadVgaCrtc(dev, 1, NV_CIO_CRE_LCD__INDEX) &
+					MASK(NV_CIO_CRE_LCD_LCD_SELECT));
+
+		slaved_on_A = NVReadVgaCrtc(dev, 0, NV_CIO_CRE_PIXEL_INDEX) &
+									0x80;
+		if (slaved_on_A)
+			tvA = !(NVReadVgaCrtc(dev, 0, NV_CIO_CRE_LCD__INDEX) &
+					MASK(NV_CIO_CRE_LCD_LCD_SELECT));
+
+		NVLockVgaCrtcs(dev, true);
+
+		if (slaved_on_A && !tvA)
+			dev_priv->crtc_owner = 0x0;
+		else if (slaved_on_B && !tvB)
+			dev_priv->crtc_owner = 0x3;
+		else if (slaved_on_A)
+			dev_priv->crtc_owner = 0x0;
+		else if (slaved_on_B)
+			dev_priv->crtc_owner = 0x3;
+		else
+			dev_priv->crtc_owner = 0x0;
+	}
+
+ownerknown:
+	NV_INFO(dev, "Initial CRTC_OWNER is %d\n", dev_priv->crtc_owner);
+
+	/* we need to ensure the heads are not tied henceforth, or reading any
+	 * 8 bit reg on head B will fail
+	 * setting a single arbitrary head solves that */
+	NVSetOwner(dev, 0);
+}
+
+int
+nv04_display_create(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct parsed_dcb *dcb = dev_priv->vbios->dcb;
+	struct drm_encoder *encoder;
+	struct drm_crtc *crtc;
+	uint16_t connector[16] = { 0 };
+	int i, ret;
+
+	NV_DEBUG_KMS(dev, "\n");
+
+	if (nv_two_heads(dev))
+		nv04_display_store_initial_head_owner(dev);
+	nouveau_hw_save_vga_fonts(dev, 1);
+
+	drm_mode_config_init(dev);
+	drm_mode_create_scaling_mode_property(dev);
+	drm_mode_create_dithering_property(dev);
+
+	dev->mode_config.funcs = (void *)&nouveau_mode_config_funcs;
+
+	dev->mode_config.min_width = 0;
+	dev->mode_config.min_height = 0;
+	switch (dev_priv->card_type) {
+	case NV_04:
+		dev->mode_config.max_width = 2048;
+		dev->mode_config.max_height = 2048;
+		break;
+	default:
+		dev->mode_config.max_width = 4096;
+		dev->mode_config.max_height = 4096;
+		break;
+	}
+
+	dev->mode_config.fb_base = dev_priv->fb_phys;
+
+	nv04_crtc_create(dev, 0);
+	if (nv_two_heads(dev))
+		nv04_crtc_create(dev, 1);
+
+	for (i = 0; i < dcb->entries; i++) {
+		struct dcb_entry *dcbent = &dcb->entry[i];
+
+		switch (dcbent->type) {
+		case OUTPUT_ANALOG:
+			ret = nv04_dac_create(dev, dcbent);
+			break;
+		case OUTPUT_LVDS:
+		case OUTPUT_TMDS:
+			ret = nv04_dfp_create(dev, dcbent);
+			break;
+		case OUTPUT_TV:
+			if (dcbent->location == DCB_LOC_ON_CHIP)
+				ret = nv17_tv_create(dev, dcbent);
+			else
+				ret = nv04_tv_create(dev, dcbent);
+			break;
+		default:
+			NV_WARN(dev, "DCB type %d not known\n", dcbent->type);
+			continue;
+		}
+
+		if (ret)
+			continue;
+
+		connector[dcbent->connector] |= (1 << dcbent->type);
+	}
+
+	for (i = 0; i < dcb->entries; i++) {
+		struct dcb_entry *dcbent = &dcb->entry[i];
+		uint16_t encoders;
+		int type;
+
+		encoders = connector[dcbent->connector];
+		if (!(encoders & (1 << dcbent->type)))
+			continue;
+		connector[dcbent->connector] = 0;
+
+		switch (dcbent->type) {
+		case OUTPUT_ANALOG:
+			if (!MULTIPLE_ENCODERS(encoders))
+				type = DRM_MODE_CONNECTOR_VGA;
+			else
+				type = DRM_MODE_CONNECTOR_DVII;
+			break;
+		case OUTPUT_TMDS:
+			if (!MULTIPLE_ENCODERS(encoders))
+				type = DRM_MODE_CONNECTOR_DVID;
+			else
+				type = DRM_MODE_CONNECTOR_DVII;
+			break;
+		case OUTPUT_LVDS:
+			type = DRM_MODE_CONNECTOR_LVDS;
+#if 0
+			/* don't create i2c adapter when lvds ddc not allowed */
+			if (dcbent->lvdsconf.use_straps_for_mode ||
+			    dev_priv->vbios->fp_no_ddc)
+				i2c_index = 0xf;
+#endif
+			break;
+		case OUTPUT_TV:
+			type = DRM_MODE_CONNECTOR_TV;
+			break;
+		default:
+			type = DRM_MODE_CONNECTOR_Unknown;
+			continue;
+		}
+
+		nouveau_connector_create(dev, dcbent->connector, type);
+	}
+
+	/* Save previous state */
+	NVLockVgaCrtcs(dev, false);
+
+	list_for_each_entry(crtc, &dev->mode_config.crtc_list, head)
+		crtc->funcs->save(crtc);
+
+	list_for_each_entry(encoder, &dev->mode_config.encoder_list, head) {
+		struct drm_encoder_helper_funcs *func = encoder->helper_private;
+
+		func->save(encoder);
+	}
+
+	return 0;
+}
+
+void
+nv04_display_destroy(struct drm_device *dev)
+{
+	struct drm_encoder *encoder;
+	struct drm_crtc *crtc;
+
+	NV_DEBUG_KMS(dev, "\n");
+
+	/* Turn every CRTC off. */
+	list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
+		struct drm_mode_set modeset = {
+			.crtc = crtc,
+		};
+
+		crtc->funcs->set_config(&modeset);
+	}
+
+	/* Restore state */
+	NVLockVgaCrtcs(dev, false);
+
+	list_for_each_entry(encoder, &dev->mode_config.encoder_list, head) {
+		struct drm_encoder_helper_funcs *func = encoder->helper_private;
+
+		func->restore(encoder);
+	}
+
+	list_for_each_entry(crtc, &dev->mode_config.crtc_list, head)
+		crtc->funcs->restore(crtc);
+
+	drm_mode_config_cleanup(dev);
+
+	nouveau_hw_save_vga_fonts(dev, 0);
+}
+
+void
+nv04_display_restore(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct drm_encoder *encoder;
+	struct drm_crtc *crtc;
+
+	NVLockVgaCrtcs(dev, false);
+
+	/* meh.. modeset apparently doesn't setup all the regs and depends
+	 * on pre-existing state, for now load the state of the card *before*
+	 * nouveau was loaded, and then do a modeset.
+	 *
+	 * best thing to do probably is to make save/restore routines not
+	 * save/restore "pre-load" state, but more general so we can save
+	 * on suspend too.
+	 */
+	list_for_each_entry(encoder, &dev->mode_config.encoder_list, head) {
+		struct drm_encoder_helper_funcs *func = encoder->helper_private;
+
+		func->restore(encoder);
+	}
+
+	list_for_each_entry(crtc, &dev->mode_config.crtc_list, head)
+		crtc->funcs->restore(crtc);
+
+	if (nv_two_heads(dev)) {
+		NV_INFO(dev, "Restoring CRTC_OWNER to %d.\n",
+			dev_priv->crtc_owner);
+		NVSetOwner(dev, dev_priv->crtc_owner);
+	}
+
+	NVLockVgaCrtcs(dev, true);
+}
+
diff --git a/drivers/gpu/drm/nouveau/nv04_fb.c b/drivers/gpu/drm/nouveau/nv04_fb.c
new file mode 100644
index 000000000000..638cf601c427
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nv04_fb.c
@@ -0,0 +1,21 @@
+#include "drmP.h"
+#include "drm.h"
+#include "nouveau_drv.h"
+#include "nouveau_drm.h"
+
+int
+nv04_fb_init(struct drm_device *dev)
+{
+	/* This is what the DDX did for NV_ARCH_04, but a mmio-trace shows
+	 * nvidia reading PFB_CFG_0, then writing back its original value.
+	 * (which was 0x701114 in this case)
+	 */
+
+	nv_wr32(dev, NV04_PFB_CFG0, 0x1114);
+	return 0;
+}
+
+void
+nv04_fb_takedown(struct drm_device *dev)
+{
+}
diff --git a/drivers/gpu/drm/nouveau/nv04_fbcon.c b/drivers/gpu/drm/nouveau/nv04_fbcon.c
new file mode 100644
index 000000000000..d910873c1368
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nv04_fbcon.c
@@ -0,0 +1,315 @@
+/*
+ * Copyright 2009 Ben Skeggs
+ * Copyright 2008 Stuart Bennett
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ */
+
+#include "drmP.h"
+#include "nouveau_drv.h"
+#include "nouveau_dma.h"
+#include "nouveau_fbcon.h"
+
+static void
+nv04_fbcon_copyarea(struct fb_info *info, const struct fb_copyarea *region)
+{
+	struct nouveau_fbcon_par *par = info->par;
+	struct drm_device *dev = par->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_channel *chan = dev_priv->channel;
+
+	if (info->state != FBINFO_STATE_RUNNING)
+		return;
+
+	if (!(info->flags & FBINFO_HWACCEL_DISABLED) && RING_SPACE(chan, 4)) {
+		nouveau_fbcon_gpu_lockup(info);
+	}
+
+	if (info->flags & FBINFO_HWACCEL_DISABLED) {
+		cfb_copyarea(info, region);
+		return;
+	}
+
+	BEGIN_RING(chan, NvSubImageBlit, 0x0300, 3);
+	OUT_RING(chan, (region->sy << 16) | region->sx);
+	OUT_RING(chan, (region->dy << 16) | region->dx);
+	OUT_RING(chan, (region->height << 16) | region->width);
+	FIRE_RING(chan);
+}
+
+static void
+nv04_fbcon_fillrect(struct fb_info *info, const struct fb_fillrect *rect)
+{
+	struct nouveau_fbcon_par *par = info->par;
+	struct drm_device *dev = par->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_channel *chan = dev_priv->channel;
+
+	if (info->state != FBINFO_STATE_RUNNING)
+		return;
+
+	if (!(info->flags & FBINFO_HWACCEL_DISABLED) && RING_SPACE(chan, 7)) {
+		nouveau_fbcon_gpu_lockup(info);
+	}
+
+	if (info->flags & FBINFO_HWACCEL_DISABLED) {
+		cfb_fillrect(info, rect);
+		return;
+	}
+
+	BEGIN_RING(chan, NvSubGdiRect, 0x02fc, 1);
+	OUT_RING(chan, (rect->rop != ROP_COPY) ? 1 : 3);
+	BEGIN_RING(chan, NvSubGdiRect, 0x03fc, 1);
+	if (info->fix.visual == FB_VISUAL_TRUECOLOR ||
+	    info->fix.visual == FB_VISUAL_DIRECTCOLOR)
+		OUT_RING(chan, ((uint32_t *)info->pseudo_palette)[rect->color]);
+	else
+		OUT_RING(chan, rect->color);
+	BEGIN_RING(chan, NvSubGdiRect, 0x0400, 2);
+	OUT_RING(chan, (rect->dx << 16) | rect->dy);
+	OUT_RING(chan, (rect->width << 16) | rect->height);
+	FIRE_RING(chan);
+}
+
+static void
+nv04_fbcon_imageblit(struct fb_info *info, const struct fb_image *image)
+{
+	struct nouveau_fbcon_par *par = info->par;
+	struct drm_device *dev = par->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_channel *chan = dev_priv->channel;
+	uint32_t fg;
+	uint32_t bg;
+	uint32_t dsize;
+	uint32_t width;
+	uint32_t *data = (uint32_t *)image->data;
+
+	if (info->state != FBINFO_STATE_RUNNING)
+		return;
+
+	if (image->depth != 1) {
+		cfb_imageblit(info, image);
+		return;
+	}
+
+	if (!(info->flags & FBINFO_HWACCEL_DISABLED) && RING_SPACE(chan, 8)) {
+		nouveau_fbcon_gpu_lockup(info);
+	}
+
+	if (info->flags & FBINFO_HWACCEL_DISABLED) {
+		cfb_imageblit(info, image);
+		return;
+	}
+
+	width = (image->width + 31) & ~31;
+	dsize = (width * image->height) >> 5;
+
+	if (info->fix.visual == FB_VISUAL_TRUECOLOR ||
+	    info->fix.visual == FB_VISUAL_DIRECTCOLOR) {
+		fg = ((uint32_t *) info->pseudo_palette)[image->fg_color];
+		bg = ((uint32_t *) info->pseudo_palette)[image->bg_color];
+	} else {
+		fg = image->fg_color;
+		bg = image->bg_color;
+	}
+
+	BEGIN_RING(chan, NvSubGdiRect, 0x0be4, 7);
+	OUT_RING(chan, (image->dy << 16) | (image->dx & 0xffff));
+	OUT_RING(chan, ((image->dy + image->height) << 16) |
+			 ((image->dx + image->width) & 0xffff));
+	OUT_RING(chan, bg);
+	OUT_RING(chan, fg);
+	OUT_RING(chan, (image->height << 16) | image->width);
+	OUT_RING(chan, (image->height << 16) | width);
+	OUT_RING(chan, (image->dy << 16) | (image->dx & 0xffff));
+
+	while (dsize) {
+		int iter_len = dsize > 128 ? 128 : dsize;
+
+		if (RING_SPACE(chan, iter_len + 1)) {
+			nouveau_fbcon_gpu_lockup(info);
+			cfb_imageblit(info, image);
+			return;
+		}
+
+		BEGIN_RING(chan, NvSubGdiRect, 0x0c00, iter_len);
+		OUT_RINGp(chan, data, iter_len);
+		data += iter_len;
+		dsize -= iter_len;
+	}
+
+	FIRE_RING(chan);
+}
+
+static int
+nv04_fbcon_grobj_new(struct drm_device *dev, int class, uint32_t handle)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_gpuobj *obj = NULL;
+	int ret;
+
+	ret = nouveau_gpuobj_gr_new(dev_priv->channel, class, &obj);
+	if (ret)
+		return ret;
+
+	ret = nouveau_gpuobj_ref_add(dev, dev_priv->channel, handle, obj, NULL);
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+int
+nv04_fbcon_accel_init(struct fb_info *info)
+{
+	struct nouveau_fbcon_par *par = info->par;
+	struct drm_device *dev = par->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_channel *chan = dev_priv->channel;
+	const int sub = NvSubCtxSurf2D;
+	int surface_fmt, pattern_fmt, rect_fmt;
+	int ret;
+
+	switch (info->var.bits_per_pixel) {
+	case 8:
+		surface_fmt = 1;
+		pattern_fmt = 3;
+		rect_fmt = 3;
+		break;
+	case 16:
+		surface_fmt = 4;
+		pattern_fmt = 1;
+		rect_fmt = 1;
+		break;
+	case 32:
+		switch (info->var.transp.length) {
+		case 0: /* depth 24 */
+		case 8: /* depth 32 */
+			break;
+		default:
+			return -EINVAL;
+		}
+
+		surface_fmt = 6;
+		pattern_fmt = 3;
+		rect_fmt = 3;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	ret = nv04_fbcon_grobj_new(dev, dev_priv->card_type >= NV_10 ?
+				   0x0062 : 0x0042, NvCtxSurf2D);
+	if (ret)
+		return ret;
+
+	ret = nv04_fbcon_grobj_new(dev, 0x0019, NvClipRect);
+	if (ret)
+		return ret;
+
+	ret = nv04_fbcon_grobj_new(dev, 0x0043, NvRop);
+	if (ret)
+		return ret;
+
+	ret = nv04_fbcon_grobj_new(dev, 0x0044, NvImagePatt);
+	if (ret)
+		return ret;
+
+	ret = nv04_fbcon_grobj_new(dev, 0x004a, NvGdiRect);
+	if (ret)
+		return ret;
+
+	ret = nv04_fbcon_grobj_new(dev, dev_priv->card_type >= NV_10 ?
+				   0x009f : 0x005f, NvImageBlit);
+	if (ret)
+		return ret;
+
+	if (RING_SPACE(chan, 49)) {
+		nouveau_fbcon_gpu_lockup(info);
+		return 0;
+	}
+
+	BEGIN_RING(chan, sub, 0x0000, 1);
+	OUT_RING(chan, NvCtxSurf2D);
+	BEGIN_RING(chan, sub, 0x0184, 2);
+	OUT_RING(chan, NvDmaFB);
+	OUT_RING(chan, NvDmaFB);
+	BEGIN_RING(chan, sub, 0x0300, 4);
+	OUT_RING(chan, surface_fmt);
+	OUT_RING(chan, info->fix.line_length | (info->fix.line_length << 16));
+	OUT_RING(chan, info->fix.smem_start - dev->mode_config.fb_base);
+	OUT_RING(chan, info->fix.smem_start - dev->mode_config.fb_base);
+
+	BEGIN_RING(chan, sub, 0x0000, 1);
+	OUT_RING(chan, NvRop);
+	BEGIN_RING(chan, sub, 0x0300, 1);
+	OUT_RING(chan, 0x55);
+
+	BEGIN_RING(chan, sub, 0x0000, 1);
+	OUT_RING(chan, NvImagePatt);
+	BEGIN_RING(chan, sub, 0x0300, 8);
+	OUT_RING(chan, pattern_fmt);
+#ifdef __BIG_ENDIAN
+	OUT_RING(chan, 2);
+#else
+	OUT_RING(chan, 1);
+#endif
+	OUT_RING(chan, 0);
+	OUT_RING(chan, 1);
+	OUT_RING(chan, ~0);
+	OUT_RING(chan, ~0);
+	OUT_RING(chan, ~0);
+	OUT_RING(chan, ~0);
+
+	BEGIN_RING(chan, sub, 0x0000, 1);
+	OUT_RING(chan, NvClipRect);
+	BEGIN_RING(chan, sub, 0x0300, 2);
+	OUT_RING(chan, 0);
+	OUT_RING(chan, (info->var.yres_virtual << 16) | info->var.xres_virtual);
+
+	BEGIN_RING(chan, NvSubImageBlit, 0x0000, 1);
+	OUT_RING(chan, NvImageBlit);
+	BEGIN_RING(chan, NvSubImageBlit, 0x019c, 1);
+	OUT_RING(chan, NvCtxSurf2D);
+	BEGIN_RING(chan, NvSubImageBlit, 0x02fc, 1);
+	OUT_RING(chan, 3);
+
+	BEGIN_RING(chan, NvSubGdiRect, 0x0000, 1);
+	OUT_RING(chan, NvGdiRect);
+	BEGIN_RING(chan, NvSubGdiRect, 0x0198, 1);
+	OUT_RING(chan, NvCtxSurf2D);
+	BEGIN_RING(chan, NvSubGdiRect, 0x0188, 2);
+	OUT_RING(chan, NvImagePatt);
+	OUT_RING(chan, NvRop);
+	BEGIN_RING(chan, NvSubGdiRect, 0x0304, 1);
+	OUT_RING(chan, 1);
+	BEGIN_RING(chan, NvSubGdiRect, 0x0300, 1);
+	OUT_RING(chan, rect_fmt);
+	BEGIN_RING(chan, NvSubGdiRect, 0x02fc, 1);
+	OUT_RING(chan, 3);
+
+	FIRE_RING(chan);
+
+	info->fbops->fb_fillrect = nv04_fbcon_fillrect;
+	info->fbops->fb_copyarea = nv04_fbcon_copyarea;
+	info->fbops->fb_imageblit = nv04_fbcon_imageblit;
+	return 0;
+}
+
diff --git a/drivers/gpu/drm/nouveau/nv04_fifo.c b/drivers/gpu/drm/nouveau/nv04_fifo.c
new file mode 100644
index 000000000000..f31347b8c9b0
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nv04_fifo.c
@@ -0,0 +1,305 @@
+/*
+ * Copyright (C) 2007 Ben Skeggs.
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial
+ * portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE COPYRIGHT OWNER(S) AND/OR ITS SUPPLIERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
+#include "drmP.h"
+#include "drm.h"
+#include "nouveau_drv.h"
+
+#define NV04_RAMFC(c) (dev_priv->ramfc_offset + ((c) * NV04_RAMFC__SIZE))
+#define NV04_RAMFC__SIZE 32
+#define NV04_RAMFC_DMA_PUT                                       0x00
+#define NV04_RAMFC_DMA_GET                                       0x04
+#define NV04_RAMFC_DMA_INSTANCE                                  0x08
+#define NV04_RAMFC_DMA_STATE                                     0x0C
+#define NV04_RAMFC_DMA_FETCH                                     0x10
+#define NV04_RAMFC_ENGINE                                        0x14
+#define NV04_RAMFC_PULL1_ENGINE                                  0x18
+
+#define RAMFC_WR(offset, val) nv_wo32(dev, chan->ramfc->gpuobj, \
+					 NV04_RAMFC_##offset/4, (val))
+#define RAMFC_RD(offset)      nv_ro32(dev, chan->ramfc->gpuobj, \
+					 NV04_RAMFC_##offset/4)
+
+void
+nv04_fifo_disable(struct drm_device *dev)
+{
+	uint32_t tmp;
+
+	tmp = nv_rd32(dev, NV04_PFIFO_CACHE1_DMA_PUSH);
+	nv_wr32(dev, NV04_PFIFO_CACHE1_DMA_PUSH, tmp & ~1);
+	nv_wr32(dev, NV03_PFIFO_CACHE1_PUSH0, 0);
+	tmp = nv_rd32(dev, NV03_PFIFO_CACHE1_PULL1);
+	nv_wr32(dev, NV04_PFIFO_CACHE1_PULL0, tmp & ~1);
+}
+
+void
+nv04_fifo_enable(struct drm_device *dev)
+{
+	nv_wr32(dev, NV03_PFIFO_CACHE1_PUSH0, 1);
+	nv_wr32(dev, NV04_PFIFO_CACHE1_PULL0, 1);
+}
+
+bool
+nv04_fifo_reassign(struct drm_device *dev, bool enable)
+{
+	uint32_t reassign = nv_rd32(dev, NV03_PFIFO_CACHES);
+
+	nv_wr32(dev, NV03_PFIFO_CACHES, enable ? 1 : 0);
+	return (reassign == 1);
+}
+
+bool
+nv04_fifo_cache_flush(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_timer_engine *ptimer = &dev_priv->engine.timer;
+	uint64_t start = ptimer->read(dev);
+
+	do {
+		if (nv_rd32(dev, NV03_PFIFO_CACHE1_GET) ==
+		    nv_rd32(dev, NV03_PFIFO_CACHE1_PUT))
+			return true;
+
+	} while (ptimer->read(dev) - start < 100000000);
+
+	NV_ERROR(dev, "Timeout flushing the PFIFO cache.\n");
+
+	return false;
+}
+
+bool
+nv04_fifo_cache_pull(struct drm_device *dev, bool enable)
+{
+	uint32_t pull = nv_rd32(dev, NV04_PFIFO_CACHE1_PULL0);
+
+	if (enable) {
+		nv_wr32(dev, NV04_PFIFO_CACHE1_PULL0, pull | 1);
+	} else {
+		nv_wr32(dev, NV04_PFIFO_CACHE1_PULL0, pull & ~1);
+		nv_wr32(dev, NV04_PFIFO_CACHE1_HASH, 0);
+	}
+
+	return !!(pull & 1);
+}
+
+int
+nv04_fifo_channel_id(struct drm_device *dev)
+{
+	return nv_rd32(dev, NV03_PFIFO_CACHE1_PUSH1) &
+			NV03_PFIFO_CACHE1_PUSH1_CHID_MASK;
+}
+
+int
+nv04_fifo_create_context(struct nouveau_channel *chan)
+{
+	struct drm_device *dev = chan->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	int ret;
+
+	ret = nouveau_gpuobj_new_fake(dev, NV04_RAMFC(chan->id), ~0,
+						NV04_RAMFC__SIZE,
+						NVOBJ_FLAG_ZERO_ALLOC |
+						NVOBJ_FLAG_ZERO_FREE,
+						NULL, &chan->ramfc);
+	if (ret)
+		return ret;
+
+	/* Setup initial state */
+	dev_priv->engine.instmem.prepare_access(dev, true);
+	RAMFC_WR(DMA_PUT, chan->pushbuf_base);
+	RAMFC_WR(DMA_GET, chan->pushbuf_base);
+	RAMFC_WR(DMA_INSTANCE, chan->pushbuf->instance >> 4);
+	RAMFC_WR(DMA_FETCH, (NV_PFIFO_CACHE1_DMA_FETCH_TRIG_128_BYTES |
+			     NV_PFIFO_CACHE1_DMA_FETCH_SIZE_128_BYTES |
+			     NV_PFIFO_CACHE1_DMA_FETCH_MAX_REQS_8 |
+#ifdef __BIG_ENDIAN
+			     NV_PFIFO_CACHE1_BIG_ENDIAN |
+#endif
+			     0));
+	dev_priv->engine.instmem.finish_access(dev);
+
+	/* enable the fifo dma operation */
+	nv_wr32(dev, NV04_PFIFO_MODE,
+		nv_rd32(dev, NV04_PFIFO_MODE) | (1 << chan->id));
+	return 0;
+}
+
+void
+nv04_fifo_destroy_context(struct nouveau_channel *chan)
+{
+	struct drm_device *dev = chan->dev;
+
+	nv_wr32(dev, NV04_PFIFO_MODE,
+		nv_rd32(dev, NV04_PFIFO_MODE) & ~(1 << chan->id));
+
+	nouveau_gpuobj_ref_del(dev, &chan->ramfc);
+}
+
+static void
+nv04_fifo_do_load_context(struct drm_device *dev, int chid)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	uint32_t fc = NV04_RAMFC(chid), tmp;
+
+	dev_priv->engine.instmem.prepare_access(dev, false);
+
+	nv_wr32(dev, NV04_PFIFO_CACHE1_DMA_PUT, nv_ri32(dev, fc + 0));
+	nv_wr32(dev, NV04_PFIFO_CACHE1_DMA_GET, nv_ri32(dev, fc + 4));
+	tmp = nv_ri32(dev, fc + 8);
+	nv_wr32(dev, NV04_PFIFO_CACHE1_DMA_INSTANCE, tmp & 0xFFFF);
+	nv_wr32(dev, NV04_PFIFO_CACHE1_DMA_DCOUNT, tmp >> 16);
+	nv_wr32(dev, NV04_PFIFO_CACHE1_DMA_STATE, nv_ri32(dev, fc + 12));
+	nv_wr32(dev, NV04_PFIFO_CACHE1_DMA_FETCH, nv_ri32(dev, fc + 16));
+	nv_wr32(dev, NV04_PFIFO_CACHE1_ENGINE, nv_ri32(dev, fc + 20));
+	nv_wr32(dev, NV04_PFIFO_CACHE1_PULL1, nv_ri32(dev, fc + 24));
+
+	dev_priv->engine.instmem.finish_access(dev);
+
+	nv_wr32(dev, NV03_PFIFO_CACHE1_GET, 0);
+	nv_wr32(dev, NV03_PFIFO_CACHE1_PUT, 0);
+}
+
+int
+nv04_fifo_load_context(struct nouveau_channel *chan)
+{
+	uint32_t tmp;
+
+	nv_wr32(chan->dev, NV03_PFIFO_CACHE1_PUSH1,
+			   NV03_PFIFO_CACHE1_PUSH1_DMA | chan->id);
+	nv04_fifo_do_load_context(chan->dev, chan->id);
+	nv_wr32(chan->dev, NV04_PFIFO_CACHE1_DMA_PUSH, 1);
+
+	/* Reset NV04_PFIFO_CACHE1_DMA_CTL_AT_INFO to INVALID */
+	tmp = nv_rd32(chan->dev, NV04_PFIFO_CACHE1_DMA_CTL) & ~(1 << 31);
+	nv_wr32(chan->dev, NV04_PFIFO_CACHE1_DMA_CTL, tmp);
+
+	return 0;
+}
+
+int
+nv04_fifo_unload_context(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_fifo_engine *pfifo = &dev_priv->engine.fifo;
+	struct nouveau_channel *chan = NULL;
+	uint32_t tmp;
+	int chid;
+
+	chid = pfifo->channel_id(dev);
+	if (chid < 0 || chid >= dev_priv->engine.fifo.channels)
+		return 0;
+
+	chan = dev_priv->fifos[chid];
+	if (!chan) {
+		NV_ERROR(dev, "Inactive channel on PFIFO: %d\n", chid);
+		return -EINVAL;
+	}
+
+	dev_priv->engine.instmem.prepare_access(dev, true);
+	RAMFC_WR(DMA_PUT, nv_rd32(dev, NV04_PFIFO_CACHE1_DMA_PUT));
+	RAMFC_WR(DMA_GET, nv_rd32(dev, NV04_PFIFO_CACHE1_DMA_GET));
+	tmp  = nv_rd32(dev, NV04_PFIFO_CACHE1_DMA_DCOUNT) << 16;
+	tmp |= nv_rd32(dev, NV04_PFIFO_CACHE1_DMA_INSTANCE);
+	RAMFC_WR(DMA_INSTANCE, tmp);
+	RAMFC_WR(DMA_STATE, nv_rd32(dev, NV04_PFIFO_CACHE1_DMA_STATE));
+	RAMFC_WR(DMA_FETCH, nv_rd32(dev, NV04_PFIFO_CACHE1_DMA_FETCH));
+	RAMFC_WR(ENGINE, nv_rd32(dev, NV04_PFIFO_CACHE1_ENGINE));
+	RAMFC_WR(PULL1_ENGINE, nv_rd32(dev, NV04_PFIFO_CACHE1_PULL1));
+	dev_priv->engine.instmem.finish_access(dev);
+
+	nv04_fifo_do_load_context(dev, pfifo->channels - 1);
+	nv_wr32(dev, NV03_PFIFO_CACHE1_PUSH1, pfifo->channels - 1);
+	return 0;
+}
+
+static void
+nv04_fifo_init_reset(struct drm_device *dev)
+{
+	nv_wr32(dev, NV03_PMC_ENABLE,
+		nv_rd32(dev, NV03_PMC_ENABLE) & ~NV_PMC_ENABLE_PFIFO);
+	nv_wr32(dev, NV03_PMC_ENABLE,
+		nv_rd32(dev, NV03_PMC_ENABLE) |  NV_PMC_ENABLE_PFIFO);
+
+	nv_wr32(dev, 0x003224, 0x000f0078);
+	nv_wr32(dev, 0x002044, 0x0101ffff);
+	nv_wr32(dev, 0x002040, 0x000000ff);
+	nv_wr32(dev, 0x002500, 0x00000000);
+	nv_wr32(dev, 0x003000, 0x00000000);
+	nv_wr32(dev, 0x003050, 0x00000000);
+	nv_wr32(dev, 0x003200, 0x00000000);
+	nv_wr32(dev, 0x003250, 0x00000000);
+	nv_wr32(dev, 0x003220, 0x00000000);
+
+	nv_wr32(dev, 0x003250, 0x00000000);
+	nv_wr32(dev, 0x003270, 0x00000000);
+	nv_wr32(dev, 0x003210, 0x00000000);
+}
+
+static void
+nv04_fifo_init_ramxx(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+
+	nv_wr32(dev, NV03_PFIFO_RAMHT, (0x03 << 24) /* search 128 */ |
+				       ((dev_priv->ramht_bits - 9) << 16) |
+				       (dev_priv->ramht_offset >> 8));
+	nv_wr32(dev, NV03_PFIFO_RAMRO, dev_priv->ramro_offset>>8);
+	nv_wr32(dev, NV03_PFIFO_RAMFC, dev_priv->ramfc_offset >> 8);
+}
+
+static void
+nv04_fifo_init_intr(struct drm_device *dev)
+{
+	nv_wr32(dev, 0x002100, 0xffffffff);
+	nv_wr32(dev, 0x002140, 0xffffffff);
+}
+
+int
+nv04_fifo_init(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_fifo_engine *pfifo = &dev_priv->engine.fifo;
+	int i;
+
+	nv04_fifo_init_reset(dev);
+	nv04_fifo_init_ramxx(dev);
+
+	nv04_fifo_do_load_context(dev, pfifo->channels - 1);
+	nv_wr32(dev, NV03_PFIFO_CACHE1_PUSH1, pfifo->channels - 1);
+
+	nv04_fifo_init_intr(dev);
+	pfifo->enable(dev);
+
+	for (i = 0; i < dev_priv->engine.fifo.channels; i++) {
+		if (dev_priv->fifos[i]) {
+			uint32_t mode = nv_rd32(dev, NV04_PFIFO_MODE);
+			nv_wr32(dev, NV04_PFIFO_MODE, mode | (1 << i));
+		}
+	}
+
+	return 0;
+}
+
diff --git a/drivers/gpu/drm/nouveau/nv04_graph.c b/drivers/gpu/drm/nouveau/nv04_graph.c
new file mode 100644
index 000000000000..e260986ea65a
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nv04_graph.c
@@ -0,0 +1,584 @@
+/*
+ * Copyright 2007 Stephane Marchesin
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * PRECISION INSIGHT AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ */
+
+#include "drmP.h"
+#include "drm.h"
+#include "nouveau_drm.h"
+#include "nouveau_drv.h"
+
+static uint32_t nv04_graph_ctx_regs[] = {
+	0x0040053c,
+	0x00400544,
+	0x00400540,
+	0x00400548,
+	NV04_PGRAPH_CTX_SWITCH1,
+	NV04_PGRAPH_CTX_SWITCH2,
+	NV04_PGRAPH_CTX_SWITCH3,
+	NV04_PGRAPH_CTX_SWITCH4,
+	NV04_PGRAPH_CTX_CACHE1,
+	NV04_PGRAPH_CTX_CACHE2,
+	NV04_PGRAPH_CTX_CACHE3,
+	NV04_PGRAPH_CTX_CACHE4,
+	0x00400184,
+	0x004001a4,
+	0x004001c4,
+	0x004001e4,
+	0x00400188,
+	0x004001a8,
+	0x004001c8,
+	0x004001e8,
+	0x0040018c,
+	0x004001ac,
+	0x004001cc,
+	0x004001ec,
+	0x00400190,
+	0x004001b0,
+	0x004001d0,
+	0x004001f0,
+	0x00400194,
+	0x004001b4,
+	0x004001d4,
+	0x004001f4,
+	0x00400198,
+	0x004001b8,
+	0x004001d8,
+	0x004001f8,
+	0x0040019c,
+	0x004001bc,
+	0x004001dc,
+	0x004001fc,
+	0x00400174,
+	NV04_PGRAPH_DMA_START_0,
+	NV04_PGRAPH_DMA_START_1,
+	NV04_PGRAPH_DMA_LENGTH,
+	NV04_PGRAPH_DMA_MISC,
+	NV04_PGRAPH_DMA_PITCH,
+	NV04_PGRAPH_BOFFSET0,
+	NV04_PGRAPH_BBASE0,
+	NV04_PGRAPH_BLIMIT0,
+	NV04_PGRAPH_BOFFSET1,
+	NV04_PGRAPH_BBASE1,
+	NV04_PGRAPH_BLIMIT1,
+	NV04_PGRAPH_BOFFSET2,
+	NV04_PGRAPH_BBASE2,
+	NV04_PGRAPH_BLIMIT2,
+	NV04_PGRAPH_BOFFSET3,
+	NV04_PGRAPH_BBASE3,
+	NV04_PGRAPH_BLIMIT3,
+	NV04_PGRAPH_BOFFSET4,
+	NV04_PGRAPH_BBASE4,
+	NV04_PGRAPH_BLIMIT4,
+	NV04_PGRAPH_BOFFSET5,
+	NV04_PGRAPH_BBASE5,
+	NV04_PGRAPH_BLIMIT5,
+	NV04_PGRAPH_BPITCH0,
+	NV04_PGRAPH_BPITCH1,
+	NV04_PGRAPH_BPITCH2,
+	NV04_PGRAPH_BPITCH3,
+	NV04_PGRAPH_BPITCH4,
+	NV04_PGRAPH_SURFACE,
+	NV04_PGRAPH_STATE,
+	NV04_PGRAPH_BSWIZZLE2,
+	NV04_PGRAPH_BSWIZZLE5,
+	NV04_PGRAPH_BPIXEL,
+	NV04_PGRAPH_NOTIFY,
+	NV04_PGRAPH_PATT_COLOR0,
+	NV04_PGRAPH_PATT_COLOR1,
+	NV04_PGRAPH_PATT_COLORRAM+0x00,
+	NV04_PGRAPH_PATT_COLORRAM+0x04,
+	NV04_PGRAPH_PATT_COLORRAM+0x08,
+	NV04_PGRAPH_PATT_COLORRAM+0x0c,
+	NV04_PGRAPH_PATT_COLORRAM+0x10,
+	NV04_PGRAPH_PATT_COLORRAM+0x14,
+	NV04_PGRAPH_PATT_COLORRAM+0x18,
+	NV04_PGRAPH_PATT_COLORRAM+0x1c,
+	NV04_PGRAPH_PATT_COLORRAM+0x20,
+	NV04_PGRAPH_PATT_COLORRAM+0x24,
+	NV04_PGRAPH_PATT_COLORRAM+0x28,
+	NV04_PGRAPH_PATT_COLORRAM+0x2c,
+	NV04_PGRAPH_PATT_COLORRAM+0x30,
+	NV04_PGRAPH_PATT_COLORRAM+0x34,
+	NV04_PGRAPH_PATT_COLORRAM+0x38,
+	NV04_PGRAPH_PATT_COLORRAM+0x3c,
+	NV04_PGRAPH_PATT_COLORRAM+0x40,
+	NV04_PGRAPH_PATT_COLORRAM+0x44,
+	NV04_PGRAPH_PATT_COLORRAM+0x48,
+	NV04_PGRAPH_PATT_COLORRAM+0x4c,
+	NV04_PGRAPH_PATT_COLORRAM+0x50,
+	NV04_PGRAPH_PATT_COLORRAM+0x54,
+	NV04_PGRAPH_PATT_COLORRAM+0x58,
+	NV04_PGRAPH_PATT_COLORRAM+0x5c,
+	NV04_PGRAPH_PATT_COLORRAM+0x60,
+	NV04_PGRAPH_PATT_COLORRAM+0x64,
+	NV04_PGRAPH_PATT_COLORRAM+0x68,
+	NV04_PGRAPH_PATT_COLORRAM+0x6c,
+	NV04_PGRAPH_PATT_COLORRAM+0x70,
+	NV04_PGRAPH_PATT_COLORRAM+0x74,
+	NV04_PGRAPH_PATT_COLORRAM+0x78,
+	NV04_PGRAPH_PATT_COLORRAM+0x7c,
+	NV04_PGRAPH_PATT_COLORRAM+0x80,
+	NV04_PGRAPH_PATT_COLORRAM+0x84,
+	NV04_PGRAPH_PATT_COLORRAM+0x88,
+	NV04_PGRAPH_PATT_COLORRAM+0x8c,
+	NV04_PGRAPH_PATT_COLORRAM+0x90,
+	NV04_PGRAPH_PATT_COLORRAM+0x94,
+	NV04_PGRAPH_PATT_COLORRAM+0x98,
+	NV04_PGRAPH_PATT_COLORRAM+0x9c,
+	NV04_PGRAPH_PATT_COLORRAM+0xa0,
+	NV04_PGRAPH_PATT_COLORRAM+0xa4,
+	NV04_PGRAPH_PATT_COLORRAM+0xa8,
+	NV04_PGRAPH_PATT_COLORRAM+0xac,
+	NV04_PGRAPH_PATT_COLORRAM+0xb0,
+	NV04_PGRAPH_PATT_COLORRAM+0xb4,
+	NV04_PGRAPH_PATT_COLORRAM+0xb8,
+	NV04_PGRAPH_PATT_COLORRAM+0xbc,
+	NV04_PGRAPH_PATT_COLORRAM+0xc0,
+	NV04_PGRAPH_PATT_COLORRAM+0xc4,
+	NV04_PGRAPH_PATT_COLORRAM+0xc8,
+	NV04_PGRAPH_PATT_COLORRAM+0xcc,
+	NV04_PGRAPH_PATT_COLORRAM+0xd0,
+	NV04_PGRAPH_PATT_COLORRAM+0xd4,
+	NV04_PGRAPH_PATT_COLORRAM+0xd8,
+	NV04_PGRAPH_PATT_COLORRAM+0xdc,
+	NV04_PGRAPH_PATT_COLORRAM+0xe0,
+	NV04_PGRAPH_PATT_COLORRAM+0xe4,
+	NV04_PGRAPH_PATT_COLORRAM+0xe8,
+	NV04_PGRAPH_PATT_COLORRAM+0xec,
+	NV04_PGRAPH_PATT_COLORRAM+0xf0,
+	NV04_PGRAPH_PATT_COLORRAM+0xf4,
+	NV04_PGRAPH_PATT_COLORRAM+0xf8,
+	NV04_PGRAPH_PATT_COLORRAM+0xfc,
+	NV04_PGRAPH_PATTERN,
+	0x0040080c,
+	NV04_PGRAPH_PATTERN_SHAPE,
+	0x00400600,
+	NV04_PGRAPH_ROP3,
+	NV04_PGRAPH_CHROMA,
+	NV04_PGRAPH_BETA_AND,
+	NV04_PGRAPH_BETA_PREMULT,
+	NV04_PGRAPH_CONTROL0,
+	NV04_PGRAPH_CONTROL1,
+	NV04_PGRAPH_CONTROL2,
+	NV04_PGRAPH_BLEND,
+	NV04_PGRAPH_STORED_FMT,
+	NV04_PGRAPH_SOURCE_COLOR,
+	0x00400560,
+	0x00400568,
+	0x00400564,
+	0x0040056c,
+	0x00400400,
+	0x00400480,
+	0x00400404,
+	0x00400484,
+	0x00400408,
+	0x00400488,
+	0x0040040c,
+	0x0040048c,
+	0x00400410,
+	0x00400490,
+	0x00400414,
+	0x00400494,
+	0x00400418,
+	0x00400498,
+	0x0040041c,
+	0x0040049c,
+	0x00400420,
+	0x004004a0,
+	0x00400424,
+	0x004004a4,
+	0x00400428,
+	0x004004a8,
+	0x0040042c,
+	0x004004ac,
+	0x00400430,
+	0x004004b0,
+	0x00400434,
+	0x004004b4,
+	0x00400438,
+	0x004004b8,
+	0x0040043c,
+	0x004004bc,
+	0x00400440,
+	0x004004c0,
+	0x00400444,
+	0x004004c4,
+	0x00400448,
+	0x004004c8,
+	0x0040044c,
+	0x004004cc,
+	0x00400450,
+	0x004004d0,
+	0x00400454,
+	0x004004d4,
+	0x00400458,
+	0x004004d8,
+	0x0040045c,
+	0x004004dc,
+	0x00400460,
+	0x004004e0,
+	0x00400464,
+	0x004004e4,
+	0x00400468,
+	0x004004e8,
+	0x0040046c,
+	0x004004ec,
+	0x00400470,
+	0x004004f0,
+	0x00400474,
+	0x004004f4,
+	0x00400478,
+	0x004004f8,
+	0x0040047c,
+	0x004004fc,
+	0x00400534,
+	0x00400538,
+	0x00400514,
+	0x00400518,
+	0x0040051c,
+	0x00400520,
+	0x00400524,
+	0x00400528,
+	0x0040052c,
+	0x00400530,
+	0x00400d00,
+	0x00400d40,
+	0x00400d80,
+	0x00400d04,
+	0x00400d44,
+	0x00400d84,
+	0x00400d08,
+	0x00400d48,
+	0x00400d88,
+	0x00400d0c,
+	0x00400d4c,
+	0x00400d8c,
+	0x00400d10,
+	0x00400d50,
+	0x00400d90,
+	0x00400d14,
+	0x00400d54,
+	0x00400d94,
+	0x00400d18,
+	0x00400d58,
+	0x00400d98,
+	0x00400d1c,
+	0x00400d5c,
+	0x00400d9c,
+	0x00400d20,
+	0x00400d60,
+	0x00400da0,
+	0x00400d24,
+	0x00400d64,
+	0x00400da4,
+	0x00400d28,
+	0x00400d68,
+	0x00400da8,
+	0x00400d2c,
+	0x00400d6c,
+	0x00400dac,
+	0x00400d30,
+	0x00400d70,
+	0x00400db0,
+	0x00400d34,
+	0x00400d74,
+	0x00400db4,
+	0x00400d38,
+	0x00400d78,
+	0x00400db8,
+	0x00400d3c,
+	0x00400d7c,
+	0x00400dbc,
+	0x00400590,
+	0x00400594,
+	0x00400598,
+	0x0040059c,
+	0x004005a8,
+	0x004005ac,
+	0x004005b0,
+	0x004005b4,
+	0x004005c0,
+	0x004005c4,
+	0x004005c8,
+	0x004005cc,
+	0x004005d0,
+	0x004005d4,
+	0x004005d8,
+	0x004005dc,
+	0x004005e0,
+	NV04_PGRAPH_PASSTHRU_0,
+	NV04_PGRAPH_PASSTHRU_1,
+	NV04_PGRAPH_PASSTHRU_2,
+	NV04_PGRAPH_DVD_COLORFMT,
+	NV04_PGRAPH_SCALED_FORMAT,
+	NV04_PGRAPH_MISC24_0,
+	NV04_PGRAPH_MISC24_1,
+	NV04_PGRAPH_MISC24_2,
+	0x00400500,
+	0x00400504,
+	NV04_PGRAPH_VALID1,
+	NV04_PGRAPH_VALID2,
+	NV04_PGRAPH_DEBUG_3
+};
+
+struct graph_state {
+	int nv04[ARRAY_SIZE(nv04_graph_ctx_regs)];
+};
+
+struct nouveau_channel *
+nv04_graph_channel(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	int chid = dev_priv->engine.fifo.channels;
+
+	if (nv_rd32(dev, NV04_PGRAPH_CTX_CONTROL) & 0x00010000)
+		chid = nv_rd32(dev, NV04_PGRAPH_CTX_USER) >> 24;
+
+	if (chid >= dev_priv->engine.fifo.channels)
+		return NULL;
+
+	return dev_priv->fifos[chid];
+}
+
+void
+nv04_graph_context_switch(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_pgraph_engine *pgraph = &dev_priv->engine.graph;
+	struct nouveau_channel *chan = NULL;
+	int chid;
+
+	pgraph->fifo_access(dev, false);
+	nouveau_wait_for_idle(dev);
+
+	/* If previous context is valid, we need to save it */
+	pgraph->unload_context(dev);
+
+	/* Load context for next channel */
+	chid = dev_priv->engine.fifo.channel_id(dev);
+	chan = dev_priv->fifos[chid];
+	if (chan)
+		nv04_graph_load_context(chan);
+
+	pgraph->fifo_access(dev, true);
+}
+
+static uint32_t *ctx_reg(struct graph_state *ctx, uint32_t reg)
+{
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(nv04_graph_ctx_regs); i++) {
+		if (nv04_graph_ctx_regs[i] == reg)
+			return &ctx->nv04[i];
+	}
+
+	return NULL;
+}
+
+int nv04_graph_create_context(struct nouveau_channel *chan)
+{
+	struct graph_state *pgraph_ctx;
+	NV_DEBUG(chan->dev, "nv04_graph_context_create %d\n", chan->id);
+
+	chan->pgraph_ctx = pgraph_ctx = kzalloc(sizeof(*pgraph_ctx),
+						GFP_KERNEL);
+	if (pgraph_ctx == NULL)
+		return -ENOMEM;
+
+	*ctx_reg(pgraph_ctx, NV04_PGRAPH_DEBUG_3) = 0xfad4ff31;
+
+	return 0;
+}
+
+void nv04_graph_destroy_context(struct nouveau_channel *chan)
+{
+	struct graph_state *pgraph_ctx = chan->pgraph_ctx;
+
+	kfree(pgraph_ctx);
+	chan->pgraph_ctx = NULL;
+}
+
+int nv04_graph_load_context(struct nouveau_channel *chan)
+{
+	struct drm_device *dev = chan->dev;
+	struct graph_state *pgraph_ctx = chan->pgraph_ctx;
+	uint32_t tmp;
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(nv04_graph_ctx_regs); i++)
+		nv_wr32(dev, nv04_graph_ctx_regs[i], pgraph_ctx->nv04[i]);
+
+	nv_wr32(dev, NV04_PGRAPH_CTX_CONTROL, 0x10010100);
+
+	tmp  = nv_rd32(dev, NV04_PGRAPH_CTX_USER) & 0x00ffffff;
+	nv_wr32(dev, NV04_PGRAPH_CTX_USER, tmp | chan->id << 24);
+
+	tmp = nv_rd32(dev, NV04_PGRAPH_FFINTFC_ST2);
+	nv_wr32(dev, NV04_PGRAPH_FFINTFC_ST2, tmp & 0x000fffff);
+
+	return 0;
+}
+
+int
+nv04_graph_unload_context(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_pgraph_engine *pgraph = &dev_priv->engine.graph;
+	struct nouveau_channel *chan = NULL;
+	struct graph_state *ctx;
+	uint32_t tmp;
+	int i;
+
+	chan = pgraph->channel(dev);
+	if (!chan)
+		return 0;
+	ctx = chan->pgraph_ctx;
+
+	for (i = 0; i < ARRAY_SIZE(nv04_graph_ctx_regs); i++)
+		ctx->nv04[i] = nv_rd32(dev, nv04_graph_ctx_regs[i]);
+
+	nv_wr32(dev, NV04_PGRAPH_CTX_CONTROL, 0x10000000);
+	tmp  = nv_rd32(dev, NV04_PGRAPH_CTX_USER) & 0x00ffffff;
+	tmp |= (dev_priv->engine.fifo.channels - 1) << 24;
+	nv_wr32(dev, NV04_PGRAPH_CTX_USER, tmp);
+	return 0;
+}
+
+int nv04_graph_init(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	uint32_t tmp;
+
+	nv_wr32(dev, NV03_PMC_ENABLE, nv_rd32(dev, NV03_PMC_ENABLE) &
+			~NV_PMC_ENABLE_PGRAPH);
+	nv_wr32(dev, NV03_PMC_ENABLE, nv_rd32(dev, NV03_PMC_ENABLE) |
+			 NV_PMC_ENABLE_PGRAPH);
+
+	/* Enable PGRAPH interrupts */
+	nv_wr32(dev, NV03_PGRAPH_INTR, 0xFFFFFFFF);
+	nv_wr32(dev, NV03_PGRAPH_INTR_EN, 0xFFFFFFFF);
+
+	nv_wr32(dev, NV04_PGRAPH_VALID1, 0);
+	nv_wr32(dev, NV04_PGRAPH_VALID2, 0);
+	/*nv_wr32(dev, NV04_PGRAPH_DEBUG_0, 0x000001FF);
+	nv_wr32(dev, NV04_PGRAPH_DEBUG_0, 0x001FFFFF);*/
+	nv_wr32(dev, NV04_PGRAPH_DEBUG_0, 0x1231c000);
+	/*1231C000 blob, 001 haiku*/
+	//*V_WRITE(NV04_PGRAPH_DEBUG_1, 0xf2d91100);*/
+	nv_wr32(dev, NV04_PGRAPH_DEBUG_1, 0x72111100);
+	/*0x72111100 blob , 01 haiku*/
+	/*nv_wr32(dev, NV04_PGRAPH_DEBUG_2, 0x11d5f870);*/
+	nv_wr32(dev, NV04_PGRAPH_DEBUG_2, 0x11d5f071);
+	/*haiku same*/
+
+	/*nv_wr32(dev, NV04_PGRAPH_DEBUG_3, 0xfad4ff31);*/
+	nv_wr32(dev, NV04_PGRAPH_DEBUG_3, 0xf0d4ff31);
+	/*haiku and blob 10d4*/
+
+	nv_wr32(dev, NV04_PGRAPH_STATE        , 0xFFFFFFFF);
+	nv_wr32(dev, NV04_PGRAPH_CTX_CONTROL  , 0x10000100);
+	tmp  = nv_rd32(dev, NV04_PGRAPH_CTX_USER) & 0x00ffffff;
+	tmp |= (dev_priv->engine.fifo.channels - 1) << 24;
+	nv_wr32(dev, NV04_PGRAPH_CTX_USER, tmp);
+
+	/* These don't belong here, they're part of a per-channel context */
+	nv_wr32(dev, NV04_PGRAPH_PATTERN_SHAPE, 0x00000000);
+	nv_wr32(dev, NV04_PGRAPH_BETA_AND     , 0xFFFFFFFF);
+
+	return 0;
+}
+
+void nv04_graph_takedown(struct drm_device *dev)
+{
+}
+
+void
+nv04_graph_fifo_access(struct drm_device *dev, bool enabled)
+{
+	if (enabled)
+		nv_wr32(dev, NV04_PGRAPH_FIFO,
+					nv_rd32(dev, NV04_PGRAPH_FIFO) | 1);
+	else
+		nv_wr32(dev, NV04_PGRAPH_FIFO,
+					nv_rd32(dev, NV04_PGRAPH_FIFO) & ~1);
+}
+
+static int
+nv04_graph_mthd_set_ref(struct nouveau_channel *chan, int grclass,
+			int mthd, uint32_t data)
+{
+	chan->fence.last_sequence_irq = data;
+	nouveau_fence_handler(chan->dev, chan->id);
+	return 0;
+}
+
+static int
+nv04_graph_mthd_set_operation(struct nouveau_channel *chan, int grclass,
+			      int mthd, uint32_t data)
+{
+	struct drm_device *dev = chan->dev;
+	uint32_t instance = (nv_rd32(dev, NV04_PGRAPH_CTX_SWITCH4) & 0xffff) << 4;
+	int subc = (nv_rd32(dev, NV04_PGRAPH_TRAPPED_ADDR) >> 13) & 0x7;
+	uint32_t tmp;
+
+	tmp  = nv_ri32(dev, instance);
+	tmp &= ~0x00038000;
+	tmp |= ((data & 7) << 15);
+
+	nv_wi32(dev, instance, tmp);
+	nv_wr32(dev, NV04_PGRAPH_CTX_SWITCH1, tmp);
+	nv_wr32(dev, NV04_PGRAPH_CTX_CACHE1 + (subc<<2), tmp);
+	return 0;
+}
+
+static struct nouveau_pgraph_object_method nv04_graph_mthds_sw[] = {
+	{ 0x0150, nv04_graph_mthd_set_ref },
+	{}
+};
+
+static struct nouveau_pgraph_object_method nv04_graph_mthds_set_operation[] = {
+	{ 0x02fc, nv04_graph_mthd_set_operation },
+	{},
+};
+
+struct nouveau_pgraph_object_class nv04_graph_grclass[] = {
+	{ 0x0039, false, NULL },
+	{ 0x004a, false, nv04_graph_mthds_set_operation }, /* gdirect */
+	{ 0x005f, false, nv04_graph_mthds_set_operation }, /* imageblit */
+	{ 0x0061, false, nv04_graph_mthds_set_operation }, /* ifc */
+	{ 0x0077, false, nv04_graph_mthds_set_operation }, /* sifm */
+	{ 0x0030, false, NULL }, /* null */
+	{ 0x0042, false, NULL }, /* surf2d */
+	{ 0x0043, false, NULL }, /* rop */
+	{ 0x0012, false, NULL }, /* beta1 */
+	{ 0x0072, false, NULL }, /* beta4 */
+	{ 0x0019, false, NULL }, /* cliprect */
+	{ 0x0044, false, NULL }, /* pattern */
+	{ 0x0052, false, NULL }, /* swzsurf */
+	{ 0x0053, false, NULL }, /* surf3d */
+	{ 0x0054, false, NULL }, /* tex_tri */
+	{ 0x0055, false, NULL }, /* multitex_tri */
+	{ 0x506e, true, nv04_graph_mthds_sw },
+	{}
+};
+
diff --git a/drivers/gpu/drm/nouveau/nv04_instmem.c b/drivers/gpu/drm/nouveau/nv04_instmem.c
new file mode 100644
index 000000000000..a20c206625a2
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nv04_instmem.c
@@ -0,0 +1,208 @@
+#include "drmP.h"
+#include "drm.h"
+#include "nouveau_drv.h"
+
+/* returns the size of fifo context */
+static int
+nouveau_fifo_ctx_size(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+
+	if (dev_priv->chipset >= 0x40)
+		return 128;
+	else
+	if (dev_priv->chipset >= 0x17)
+		return 64;
+
+	return 32;
+}
+
+static void
+nv04_instmem_determine_amount(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	int i;
+
+	/* Figure out how much instance memory we need */
+	if (dev_priv->card_type >= NV_40) {
+		/* We'll want more instance memory than this on some NV4x cards.
+		 * There's a 16MB aperture to play with that maps onto the end
+		 * of vram.  For now, only reserve a small piece until we know
+		 * more about what each chipset requires.
+		 */
+		switch (dev_priv->chipset & 0xf0) {
+		case 0x40:
+		case 0x47:
+		case 0x49:
+		case 0x4b:
+			dev_priv->ramin_rsvd_vram = (2 * 1024 * 1024);
+			break;
+		default:
+			dev_priv->ramin_rsvd_vram = (1 * 1024 * 1024);
+			break;
+		}
+	} else {
+		/*XXX: what *are* the limits on <NV40 cards?
+		 */
+		dev_priv->ramin_rsvd_vram = (512 * 1024);
+	}
+	NV_DEBUG(dev, "RAMIN size: %dKiB\n", dev_priv->ramin_rsvd_vram >> 10);
+
+	/* Clear all of it, except the BIOS image that's in the first 64KiB */
+	dev_priv->engine.instmem.prepare_access(dev, true);
+	for (i = 64 * 1024; i < dev_priv->ramin_rsvd_vram; i += 4)
+		nv_wi32(dev, i, 0x00000000);
+	dev_priv->engine.instmem.finish_access(dev);
+}
+
+static void
+nv04_instmem_configure_fixed_tables(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_engine *engine = &dev_priv->engine;
+
+	/* FIFO hash table (RAMHT)
+	 *   use 4k hash table at RAMIN+0x10000
+	 *   TODO: extend the hash table
+	 */
+	dev_priv->ramht_offset = 0x10000;
+	dev_priv->ramht_bits   = 9;
+	dev_priv->ramht_size   = (1 << dev_priv->ramht_bits); /* nr entries */
+	dev_priv->ramht_size  *= 8; /* 2 32-bit values per entry in RAMHT */
+	NV_DEBUG(dev, "RAMHT offset=0x%x, size=%d\n", dev_priv->ramht_offset,
+						      dev_priv->ramht_size);
+
+	/* FIFO runout table (RAMRO) - 512k at 0x11200 */
+	dev_priv->ramro_offset = 0x11200;
+	dev_priv->ramro_size   = 512;
+	NV_DEBUG(dev, "RAMRO offset=0x%x, size=%d\n", dev_priv->ramro_offset,
+						      dev_priv->ramro_size);
+
+	/* FIFO context table (RAMFC)
+	 *   NV40  : Not sure exactly how to position RAMFC on some cards,
+	 *           0x30002 seems to position it at RAMIN+0x20000 on these
+	 *           cards.  RAMFC is 4kb (32 fifos, 128byte entries).
+	 *   Others: Position RAMFC at RAMIN+0x11400
+	 */
+	dev_priv->ramfc_size = engine->fifo.channels *
+						nouveau_fifo_ctx_size(dev);
+	switch (dev_priv->card_type) {
+	case NV_40:
+		dev_priv->ramfc_offset = 0x20000;
+		break;
+	case NV_30:
+	case NV_20:
+	case NV_10:
+	case NV_04:
+	default:
+		dev_priv->ramfc_offset = 0x11400;
+		break;
+	}
+	NV_DEBUG(dev, "RAMFC offset=0x%x, size=%d\n", dev_priv->ramfc_offset,
+						      dev_priv->ramfc_size);
+}
+
+int nv04_instmem_init(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	uint32_t offset;
+	int ret = 0;
+
+	nv04_instmem_determine_amount(dev);
+	nv04_instmem_configure_fixed_tables(dev);
+
+	/* Create a heap to manage RAMIN allocations, we don't allocate
+	 * the space that was reserved for RAMHT/FC/RO.
+	 */
+	offset = dev_priv->ramfc_offset + dev_priv->ramfc_size;
+
+	/* It appears RAMRO (or something?) is controlled by 0x2220/0x2230
+	 * on certain NV4x chipsets as well as RAMFC.  When 0x2230 == 0
+	 * ("new style" control) the upper 16-bits of 0x2220 points at this
+	 * other mysterious table that's clobbering important things.
+	 *
+	 * We're now pointing this at RAMIN+0x30000 to avoid RAMFC getting
+	 * smashed to pieces on us, so reserve 0x30000-0x40000 too..
+	 */
+	if (dev_priv->card_type >= NV_40) {
+		if (offset < 0x40000)
+			offset = 0x40000;
+	}
+
+	ret = nouveau_mem_init_heap(&dev_priv->ramin_heap,
+				    offset, dev_priv->ramin_rsvd_vram - offset);
+	if (ret) {
+		dev_priv->ramin_heap = NULL;
+		NV_ERROR(dev, "Failed to init RAMIN heap\n");
+	}
+
+	return ret;
+}
+
+void
+nv04_instmem_takedown(struct drm_device *dev)
+{
+}
+
+int
+nv04_instmem_populate(struct drm_device *dev, struct nouveau_gpuobj *gpuobj, uint32_t *sz)
+{
+	if (gpuobj->im_backing)
+		return -EINVAL;
+
+	return 0;
+}
+
+void
+nv04_instmem_clear(struct drm_device *dev, struct nouveau_gpuobj *gpuobj)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+
+	if (gpuobj && gpuobj->im_backing) {
+		if (gpuobj->im_bound)
+			dev_priv->engine.instmem.unbind(dev, gpuobj);
+		gpuobj->im_backing = NULL;
+	}
+}
+
+int
+nv04_instmem_bind(struct drm_device *dev, struct nouveau_gpuobj *gpuobj)
+{
+	if (!gpuobj->im_pramin || gpuobj->im_bound)
+		return -EINVAL;
+
+	gpuobj->im_bound = 1;
+	return 0;
+}
+
+int
+nv04_instmem_unbind(struct drm_device *dev, struct nouveau_gpuobj *gpuobj)
+{
+	if (gpuobj->im_bound == 0)
+		return -EINVAL;
+
+	gpuobj->im_bound = 0;
+	return 0;
+}
+
+void
+nv04_instmem_prepare_access(struct drm_device *dev, bool write)
+{
+}
+
+void
+nv04_instmem_finish_access(struct drm_device *dev)
+{
+}
+
+int
+nv04_instmem_suspend(struct drm_device *dev)
+{
+	return 0;
+}
+
+void
+nv04_instmem_resume(struct drm_device *dev)
+{
+}
+
diff --git a/drivers/gpu/drm/nouveau/nv04_mc.c b/drivers/gpu/drm/nouveau/nv04_mc.c
new file mode 100644
index 000000000000..617ed1e05269
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nv04_mc.c
@@ -0,0 +1,20 @@
+#include "drmP.h"
+#include "drm.h"
+#include "nouveau_drv.h"
+#include "nouveau_drm.h"
+
+int
+nv04_mc_init(struct drm_device *dev)
+{
+	/* Power up everything, resetting each individual unit will
+	 * be done later if needed.
+	 */
+
+	nv_wr32(dev, NV03_PMC_ENABLE, 0xFFFFFFFF);
+	return 0;
+}
+
+void
+nv04_mc_takedown(struct drm_device *dev)
+{
+}
diff --git a/drivers/gpu/drm/nouveau/nv04_timer.c b/drivers/gpu/drm/nouveau/nv04_timer.c
new file mode 100644
index 000000000000..1d09ddd57399
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nv04_timer.c
@@ -0,0 +1,51 @@
+#include "drmP.h"
+#include "drm.h"
+#include "nouveau_drv.h"
+#include "nouveau_drm.h"
+
+int
+nv04_timer_init(struct drm_device *dev)
+{
+	nv_wr32(dev, NV04_PTIMER_INTR_EN_0, 0x00000000);
+	nv_wr32(dev, NV04_PTIMER_INTR_0, 0xFFFFFFFF);
+
+	/* Just use the pre-existing values when possible for now; these regs
+	 * are not written in nv (driver writer missed a /4 on the address), and
+	 * writing 8 and 3 to the correct regs breaks the timings on the LVDS
+	 * hardware sequencing microcode.
+	 * A correct solution (involving calculations with the GPU PLL) can
+	 * be done when kernel modesetting lands
+	 */
+	if (!nv_rd32(dev, NV04_PTIMER_NUMERATOR) ||
+				!nv_rd32(dev, NV04_PTIMER_DENOMINATOR)) {
+		nv_wr32(dev, NV04_PTIMER_NUMERATOR, 0x00000008);
+		nv_wr32(dev, NV04_PTIMER_DENOMINATOR, 0x00000003);
+	}
+
+	return 0;
+}
+
+uint64_t
+nv04_timer_read(struct drm_device *dev)
+{
+	uint32_t low;
+	/* From kmmio dumps on nv28 this looks like how the blob does this.
+	 * It reads the high dword twice, before and after.
+	 * The only explanation seems to be that the 64-bit timer counter
+	 * advances between high and low dword reads and may corrupt the
+	 * result. Not confirmed.
+	 */
+	uint32_t high2 = nv_rd32(dev, NV04_PTIMER_TIME_1);
+	uint32_t high1;
+	do {
+		high1 = high2;
+		low = nv_rd32(dev, NV04_PTIMER_TIME_0);
+		high2 = nv_rd32(dev, NV04_PTIMER_TIME_1);
+	} while (high1 != high2);
+	return (((uint64_t)high2) << 32) | (uint64_t)low;
+}
+
+void
+nv04_timer_takedown(struct drm_device *dev)
+{
+}
diff --git a/drivers/gpu/drm/nouveau/nv04_tv.c b/drivers/gpu/drm/nouveau/nv04_tv.c
new file mode 100644
index 000000000000..9c63099e9c42
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nv04_tv.c
@@ -0,0 +1,305 @@
+/*
+ * Copyright (C) 2009 Francisco Jerez.
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial
+ * portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE COPYRIGHT OWNER(S) AND/OR ITS SUPPLIERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
+#include "drmP.h"
+#include "nouveau_drv.h"
+#include "nouveau_encoder.h"
+#include "nouveau_connector.h"
+#include "nouveau_crtc.h"
+#include "nouveau_hw.h"
+#include "drm_crtc_helper.h"
+
+#include "i2c/ch7006.h"
+
+static struct {
+	struct i2c_board_info board_info;
+	struct drm_encoder_funcs funcs;
+	struct drm_encoder_helper_funcs hfuncs;
+	void *params;
+
+} nv04_tv_encoder_info[] = {
+	{
+		.board_info = { I2C_BOARD_INFO("ch7006", 0x75) },
+		.params = &(struct ch7006_encoder_params) {
+			CH7006_FORMAT_RGB24m12I, CH7006_CLOCK_MASTER,
+			0, 0, 0,
+			CH7006_SYNC_SLAVE, CH7006_SYNC_SEPARATED,
+			CH7006_POUT_3_3V, CH7006_ACTIVE_HSYNC
+		},
+	},
+};
+
+static bool probe_i2c_addr(struct i2c_adapter *adapter, int addr)
+{
+	struct i2c_msg msg = {
+		.addr = addr,
+		.len = 0,
+	};
+
+	return i2c_transfer(adapter, &msg, 1) == 1;
+}
+
+int nv04_tv_identify(struct drm_device *dev, int i2c_index)
+{
+	struct nouveau_i2c_chan *i2c;
+	bool was_locked;
+	int i, ret;
+
+	NV_TRACE(dev, "Probing TV encoders on I2C bus: %d\n", i2c_index);
+
+	i2c = nouveau_i2c_find(dev, i2c_index);
+	if (!i2c)
+		return -ENODEV;
+
+	was_locked = NVLockVgaCrtcs(dev, false);
+
+	for (i = 0; i < ARRAY_SIZE(nv04_tv_encoder_info); i++) {
+		if (probe_i2c_addr(&i2c->adapter,
+				   nv04_tv_encoder_info[i].board_info.addr)) {
+			ret = i;
+			break;
+		}
+	}
+
+	if (i < ARRAY_SIZE(nv04_tv_encoder_info)) {
+		NV_TRACE(dev, "Detected TV encoder: %s\n",
+			 nv04_tv_encoder_info[i].board_info.type);
+
+	} else {
+		NV_TRACE(dev, "No TV encoders found.\n");
+		i = -ENODEV;
+	}
+
+	NVLockVgaCrtcs(dev, was_locked);
+	return i;
+}
+
+#define PLLSEL_TV_CRTC1_MASK				\
+	(NV_PRAMDAC_PLL_COEFF_SELECT_TV_VSCLK1		\
+	 | NV_PRAMDAC_PLL_COEFF_SELECT_TV_PCLK1)
+#define PLLSEL_TV_CRTC2_MASK				\
+	(NV_PRAMDAC_PLL_COEFF_SELECT_TV_VSCLK2		\
+	 | NV_PRAMDAC_PLL_COEFF_SELECT_TV_PCLK2)
+
+static void nv04_tv_dpms(struct drm_encoder *encoder, int mode)
+{
+	struct drm_device *dev = encoder->dev;
+	struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nv04_mode_state *state = &dev_priv->mode_reg;
+	uint8_t crtc1A;
+
+	NV_INFO(dev, "Setting dpms mode %d on TV encoder (output %d)\n",
+		mode, nv_encoder->dcb->index);
+
+	state->pllsel &= ~(PLLSEL_TV_CRTC1_MASK | PLLSEL_TV_CRTC2_MASK);
+
+	if (mode == DRM_MODE_DPMS_ON) {
+		int head = nouveau_crtc(encoder->crtc)->index;
+		crtc1A = NVReadVgaCrtc(dev, head, NV_CIO_CRE_RPC1_INDEX);
+
+		state->pllsel |= head ? PLLSEL_TV_CRTC2_MASK :
+					PLLSEL_TV_CRTC1_MASK;
+
+		/* Inhibit hsync */
+		crtc1A |= 0x80;
+
+		NVWriteVgaCrtc(dev, head, NV_CIO_CRE_RPC1_INDEX, crtc1A);
+	}
+
+	NVWriteRAMDAC(dev, 0, NV_PRAMDAC_PLL_COEFF_SELECT, state->pllsel);
+
+	to_encoder_slave(encoder)->slave_funcs->dpms(encoder, mode);
+}
+
+static void nv04_tv_bind(struct drm_device *dev, int head, bool bind)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nv04_crtc_reg *state = &dev_priv->mode_reg.crtc_reg[head];
+
+	state->tv_setup = 0;
+
+	if (bind) {
+		state->CRTC[NV_CIO_CRE_LCD__INDEX] = 0;
+		state->CRTC[NV_CIO_CRE_49] |= 0x10;
+	} else {
+		state->CRTC[NV_CIO_CRE_49] &= ~0x10;
+	}
+
+	NVWriteVgaCrtc(dev, head, NV_CIO_CRE_LCD__INDEX,
+		       state->CRTC[NV_CIO_CRE_LCD__INDEX]);
+	NVWriteVgaCrtc(dev, head, NV_CIO_CRE_49,
+		       state->CRTC[NV_CIO_CRE_49]);
+	NVWriteRAMDAC(dev, head, NV_PRAMDAC_TV_SETUP,
+		      state->tv_setup);
+}
+
+static void nv04_tv_prepare(struct drm_encoder *encoder)
+{
+	struct drm_device *dev = encoder->dev;
+	int head = nouveau_crtc(encoder->crtc)->index;
+	struct drm_encoder_helper_funcs *helper = encoder->helper_private;
+
+	helper->dpms(encoder, DRM_MODE_DPMS_OFF);
+
+	nv04_dfp_disable(dev, head);
+
+	if (nv_two_heads(dev))
+		nv04_tv_bind(dev, head ^ 1, false);
+
+	nv04_tv_bind(dev, head, true);
+}
+
+static void nv04_tv_mode_set(struct drm_encoder *encoder,
+			     struct drm_display_mode *mode,
+			     struct drm_display_mode *adjusted_mode)
+{
+	struct drm_device *dev = encoder->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_crtc *nv_crtc = nouveau_crtc(encoder->crtc);
+	struct nv04_crtc_reg *regp = &dev_priv->mode_reg.crtc_reg[nv_crtc->index];
+
+	regp->tv_htotal = adjusted_mode->htotal;
+	regp->tv_vtotal = adjusted_mode->vtotal;
+
+	/* These delay the TV signals with respect to the VGA port,
+	 * they might be useful if we ever allow a CRTC to drive
+	 * multiple outputs.
+	 */
+	regp->tv_hskew = 1;
+	regp->tv_hsync_delay = 1;
+	regp->tv_hsync_delay2 = 64;
+	regp->tv_vskew = 1;
+	regp->tv_vsync_delay = 1;
+
+	to_encoder_slave(encoder)->slave_funcs->mode_set(encoder, mode, adjusted_mode);
+}
+
+static void nv04_tv_commit(struct drm_encoder *encoder)
+{
+	struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
+	struct drm_device *dev = encoder->dev;
+	struct nouveau_crtc *nv_crtc = nouveau_crtc(encoder->crtc);
+	struct drm_encoder_helper_funcs *helper = encoder->helper_private;
+
+	helper->dpms(encoder, DRM_MODE_DPMS_ON);
+
+	NV_INFO(dev, "Output %s is running on CRTC %d using output %c\n",
+		      drm_get_connector_name(&nouveau_encoder_connector_get(nv_encoder)->base), nv_crtc->index,
+		      '@' + ffs(nv_encoder->dcb->or));
+}
+
+static void nv04_tv_destroy(struct drm_encoder *encoder)
+{
+	struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
+
+	to_encoder_slave(encoder)->slave_funcs->destroy(encoder);
+
+	drm_encoder_cleanup(encoder);
+
+	kfree(nv_encoder);
+}
+
+int nv04_tv_create(struct drm_device *dev, struct dcb_entry *entry)
+{
+	struct nouveau_encoder *nv_encoder;
+	struct drm_encoder *encoder;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct i2c_adapter *adap;
+	struct drm_encoder_funcs *funcs = NULL;
+	struct drm_encoder_helper_funcs *hfuncs = NULL;
+	struct drm_encoder_slave_funcs *sfuncs = NULL;
+	int i2c_index = entry->i2c_index;
+	int type, ret;
+	bool was_locked;
+
+	/* Ensure that we can talk to this encoder */
+	type = nv04_tv_identify(dev, i2c_index);
+	if (type < 0)
+		return type;
+
+	/* Allocate the necessary memory */
+	nv_encoder = kzalloc(sizeof(*nv_encoder), GFP_KERNEL);
+	if (!nv_encoder)
+		return -ENOMEM;
+
+	/* Initialize the common members */
+	encoder = to_drm_encoder(nv_encoder);
+
+	funcs = &nv04_tv_encoder_info[type].funcs;
+	hfuncs = &nv04_tv_encoder_info[type].hfuncs;
+
+	drm_encoder_init(dev, encoder, funcs, DRM_MODE_ENCODER_TVDAC);
+	drm_encoder_helper_add(encoder, hfuncs);
+
+	encoder->possible_crtcs = entry->heads;
+	encoder->possible_clones = 0;
+
+	nv_encoder->dcb = entry;
+	nv_encoder->or = ffs(entry->or) - 1;
+
+	/* Run the slave-specific initialization */
+	adap = &dev_priv->vbios->dcb->i2c[i2c_index].chan->adapter;
+
+	was_locked = NVLockVgaCrtcs(dev, false);
+
+	ret = drm_i2c_encoder_init(encoder->dev, to_encoder_slave(encoder), adap,
+				   &nv04_tv_encoder_info[type].board_info);
+
+	NVLockVgaCrtcs(dev, was_locked);
+
+	if (ret < 0)
+		goto fail;
+
+	/* Fill the function pointers */
+	sfuncs = to_encoder_slave(encoder)->slave_funcs;
+
+	*funcs = (struct drm_encoder_funcs) {
+		.destroy = nv04_tv_destroy,
+	};
+
+	*hfuncs = (struct drm_encoder_helper_funcs) {
+		.dpms = nv04_tv_dpms,
+		.save = sfuncs->save,
+		.restore = sfuncs->restore,
+		.mode_fixup = sfuncs->mode_fixup,
+		.prepare = nv04_tv_prepare,
+		.commit = nv04_tv_commit,
+		.mode_set = nv04_tv_mode_set,
+		.detect = sfuncs->detect,
+	};
+
+	/* Set the slave encoder configuration */
+	sfuncs->set_config(encoder, nv04_tv_encoder_info[type].params);
+
+	return 0;
+
+fail:
+	drm_encoder_cleanup(encoder);
+
+	kfree(nv_encoder);
+	return ret;
+}
diff --git a/drivers/gpu/drm/nouveau/nv10_fb.c b/drivers/gpu/drm/nouveau/nv10_fb.c
new file mode 100644
index 000000000000..cc5cda44e501
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nv10_fb.c
@@ -0,0 +1,44 @@
+#include "drmP.h"
+#include "drm.h"
+#include "nouveau_drv.h"
+#include "nouveau_drm.h"
+
+void
+nv10_fb_set_region_tiling(struct drm_device *dev, int i, uint32_t addr,
+			  uint32_t size, uint32_t pitch)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	uint32_t limit = max(1u, addr + size) - 1;
+
+	if (pitch) {
+		if (dev_priv->card_type >= NV_20)
+			addr |= 1;
+		else
+			addr |= 1 << 31;
+	}
+
+	nv_wr32(dev, NV10_PFB_TLIMIT(i), limit);
+	nv_wr32(dev, NV10_PFB_TSIZE(i), pitch);
+	nv_wr32(dev, NV10_PFB_TILE(i), addr);
+}
+
+int
+nv10_fb_init(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_fb_engine *pfb = &dev_priv->engine.fb;
+	int i;
+
+	pfb->num_tiles = NV10_PFB_TILE__SIZE;
+
+	/* Turn all the tiling regions off. */
+	for (i = 0; i < pfb->num_tiles; i++)
+		pfb->set_region_tiling(dev, i, 0, 0, 0);
+
+	return 0;
+}
+
+void
+nv10_fb_takedown(struct drm_device *dev)
+{
+}
diff --git a/drivers/gpu/drm/nouveau/nv10_fifo.c b/drivers/gpu/drm/nouveau/nv10_fifo.c
new file mode 100644
index 000000000000..7aeabf262bc0
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nv10_fifo.c
@@ -0,0 +1,260 @@
+/*
+ * Copyright (C) 2007 Ben Skeggs.
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial
+ * portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE COPYRIGHT OWNER(S) AND/OR ITS SUPPLIERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
+#include "drmP.h"
+#include "drm.h"
+#include "nouveau_drv.h"
+
+#define NV10_RAMFC(c) (dev_priv->ramfc_offset + ((c) * NV10_RAMFC__SIZE))
+#define NV10_RAMFC__SIZE ((dev_priv->chipset) >= 0x17 ? 64 : 32)
+
+int
+nv10_fifo_channel_id(struct drm_device *dev)
+{
+	return nv_rd32(dev, NV03_PFIFO_CACHE1_PUSH1) &
+			NV10_PFIFO_CACHE1_PUSH1_CHID_MASK;
+}
+
+int
+nv10_fifo_create_context(struct nouveau_channel *chan)
+{
+	struct drm_nouveau_private *dev_priv = chan->dev->dev_private;
+	struct drm_device *dev = chan->dev;
+	uint32_t fc = NV10_RAMFC(chan->id);
+	int ret;
+
+	ret = nouveau_gpuobj_new_fake(dev, NV10_RAMFC(chan->id), ~0,
+				      NV10_RAMFC__SIZE, NVOBJ_FLAG_ZERO_ALLOC |
+				      NVOBJ_FLAG_ZERO_FREE, NULL, &chan->ramfc);
+	if (ret)
+		return ret;
+
+	/* Fill entries that are seen filled in dumps of nvidia driver just
+	 * after channel's is put into DMA mode
+	 */
+	dev_priv->engine.instmem.prepare_access(dev, true);
+	nv_wi32(dev, fc +  0, chan->pushbuf_base);
+	nv_wi32(dev, fc +  4, chan->pushbuf_base);
+	nv_wi32(dev, fc + 12, chan->pushbuf->instance >> 4);
+	nv_wi32(dev, fc + 20, NV_PFIFO_CACHE1_DMA_FETCH_TRIG_128_BYTES |
+			      NV_PFIFO_CACHE1_DMA_FETCH_SIZE_128_BYTES |
+			      NV_PFIFO_CACHE1_DMA_FETCH_MAX_REQS_8 |
+#ifdef __BIG_ENDIAN
+			      NV_PFIFO_CACHE1_BIG_ENDIAN |
+#endif
+			      0);
+	dev_priv->engine.instmem.finish_access(dev);
+
+	/* enable the fifo dma operation */
+	nv_wr32(dev, NV04_PFIFO_MODE,
+		nv_rd32(dev, NV04_PFIFO_MODE) | (1 << chan->id));
+	return 0;
+}
+
+void
+nv10_fifo_destroy_context(struct nouveau_channel *chan)
+{
+	struct drm_device *dev = chan->dev;
+
+	nv_wr32(dev, NV04_PFIFO_MODE,
+			nv_rd32(dev, NV04_PFIFO_MODE) & ~(1 << chan->id));
+
+	nouveau_gpuobj_ref_del(dev, &chan->ramfc);
+}
+
+static void
+nv10_fifo_do_load_context(struct drm_device *dev, int chid)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	uint32_t fc = NV10_RAMFC(chid), tmp;
+
+	dev_priv->engine.instmem.prepare_access(dev, false);
+
+	nv_wr32(dev, NV04_PFIFO_CACHE1_DMA_PUT, nv_ri32(dev, fc + 0));
+	nv_wr32(dev, NV04_PFIFO_CACHE1_DMA_GET, nv_ri32(dev, fc + 4));
+	nv_wr32(dev, NV10_PFIFO_CACHE1_REF_CNT, nv_ri32(dev, fc + 8));
+
+	tmp = nv_ri32(dev, fc + 12);
+	nv_wr32(dev, NV04_PFIFO_CACHE1_DMA_INSTANCE, tmp & 0xFFFF);
+	nv_wr32(dev, NV04_PFIFO_CACHE1_DMA_DCOUNT, tmp >> 16);
+
+	nv_wr32(dev, NV04_PFIFO_CACHE1_DMA_STATE, nv_ri32(dev, fc + 16));
+	nv_wr32(dev, NV04_PFIFO_CACHE1_DMA_FETCH, nv_ri32(dev, fc + 20));
+	nv_wr32(dev, NV04_PFIFO_CACHE1_ENGINE, nv_ri32(dev, fc + 24));
+	nv_wr32(dev, NV04_PFIFO_CACHE1_PULL1, nv_ri32(dev, fc + 28));
+
+	if (dev_priv->chipset < 0x17)
+		goto out;
+
+	nv_wr32(dev, NV10_PFIFO_CACHE1_ACQUIRE_VALUE, nv_ri32(dev, fc + 32));
+	tmp = nv_ri32(dev, fc + 36);
+	nv_wr32(dev, NV10_PFIFO_CACHE1_ACQUIRE_TIMESTAMP, tmp);
+	nv_wr32(dev, NV10_PFIFO_CACHE1_ACQUIRE_TIMEOUT, nv_ri32(dev, fc + 40));
+	nv_wr32(dev, NV10_PFIFO_CACHE1_SEMAPHORE, nv_ri32(dev, fc + 44));
+	nv_wr32(dev, NV10_PFIFO_CACHE1_DMA_SUBROUTINE, nv_ri32(dev, fc + 48));
+
+out:
+	dev_priv->engine.instmem.finish_access(dev);
+
+	nv_wr32(dev, NV03_PFIFO_CACHE1_GET, 0);
+	nv_wr32(dev, NV03_PFIFO_CACHE1_PUT, 0);
+}
+
+int
+nv10_fifo_load_context(struct nouveau_channel *chan)
+{
+	struct drm_device *dev = chan->dev;
+	uint32_t tmp;
+
+	nv10_fifo_do_load_context(dev, chan->id);
+
+	nv_wr32(dev, NV03_PFIFO_CACHE1_PUSH1,
+		     NV03_PFIFO_CACHE1_PUSH1_DMA | chan->id);
+	nv_wr32(dev, NV04_PFIFO_CACHE1_DMA_PUSH, 1);
+
+	/* Reset NV04_PFIFO_CACHE1_DMA_CTL_AT_INFO to INVALID */
+	tmp = nv_rd32(dev, NV04_PFIFO_CACHE1_DMA_CTL) & ~(1 << 31);
+	nv_wr32(dev, NV04_PFIFO_CACHE1_DMA_CTL, tmp);
+
+	return 0;
+}
+
+int
+nv10_fifo_unload_context(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_fifo_engine *pfifo = &dev_priv->engine.fifo;
+	uint32_t fc, tmp;
+	int chid;
+
+	chid = pfifo->channel_id(dev);
+	if (chid < 0 || chid >= dev_priv->engine.fifo.channels)
+		return 0;
+	fc = NV10_RAMFC(chid);
+
+	dev_priv->engine.instmem.prepare_access(dev, true);
+
+	nv_wi32(dev, fc +  0, nv_rd32(dev, NV04_PFIFO_CACHE1_DMA_PUT));
+	nv_wi32(dev, fc +  4, nv_rd32(dev, NV04_PFIFO_CACHE1_DMA_GET));
+	nv_wi32(dev, fc +  8, nv_rd32(dev, NV10_PFIFO_CACHE1_REF_CNT));
+	tmp  = nv_rd32(dev, NV04_PFIFO_CACHE1_DMA_INSTANCE) & 0xFFFF;
+	tmp |= (nv_rd32(dev, NV04_PFIFO_CACHE1_DMA_DCOUNT) << 16);
+	nv_wi32(dev, fc + 12, tmp);
+	nv_wi32(dev, fc + 16, nv_rd32(dev, NV04_PFIFO_CACHE1_DMA_STATE));
+	nv_wi32(dev, fc + 20, nv_rd32(dev, NV04_PFIFO_CACHE1_DMA_FETCH));
+	nv_wi32(dev, fc + 24, nv_rd32(dev, NV04_PFIFO_CACHE1_ENGINE));
+	nv_wi32(dev, fc + 28, nv_rd32(dev, NV04_PFIFO_CACHE1_PULL1));
+
+	if (dev_priv->chipset < 0x17)
+		goto out;
+
+	nv_wi32(dev, fc + 32, nv_rd32(dev, NV10_PFIFO_CACHE1_ACQUIRE_VALUE));
+	tmp = nv_rd32(dev, NV10_PFIFO_CACHE1_ACQUIRE_TIMESTAMP);
+	nv_wi32(dev, fc + 36, tmp);
+	nv_wi32(dev, fc + 40, nv_rd32(dev, NV10_PFIFO_CACHE1_ACQUIRE_TIMEOUT));
+	nv_wi32(dev, fc + 44, nv_rd32(dev, NV10_PFIFO_CACHE1_SEMAPHORE));
+	nv_wi32(dev, fc + 48, nv_rd32(dev, NV04_PFIFO_CACHE1_DMA_GET));
+
+out:
+	dev_priv->engine.instmem.finish_access(dev);
+
+	nv10_fifo_do_load_context(dev, pfifo->channels - 1);
+	nv_wr32(dev, NV03_PFIFO_CACHE1_PUSH1, pfifo->channels - 1);
+	return 0;
+}
+
+static void
+nv10_fifo_init_reset(struct drm_device *dev)
+{
+	nv_wr32(dev, NV03_PMC_ENABLE,
+		nv_rd32(dev, NV03_PMC_ENABLE) & ~NV_PMC_ENABLE_PFIFO);
+	nv_wr32(dev, NV03_PMC_ENABLE,
+		nv_rd32(dev, NV03_PMC_ENABLE) |  NV_PMC_ENABLE_PFIFO);
+
+	nv_wr32(dev, 0x003224, 0x000f0078);
+	nv_wr32(dev, 0x002044, 0x0101ffff);
+	nv_wr32(dev, 0x002040, 0x000000ff);
+	nv_wr32(dev, 0x002500, 0x00000000);
+	nv_wr32(dev, 0x003000, 0x00000000);
+	nv_wr32(dev, 0x003050, 0x00000000);
+
+	nv_wr32(dev, 0x003258, 0x00000000);
+	nv_wr32(dev, 0x003210, 0x00000000);
+	nv_wr32(dev, 0x003270, 0x00000000);
+}
+
+static void
+nv10_fifo_init_ramxx(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+
+	nv_wr32(dev, NV03_PFIFO_RAMHT, (0x03 << 24) /* search 128 */ |
+				       ((dev_priv->ramht_bits - 9) << 16) |
+				       (dev_priv->ramht_offset >> 8));
+	nv_wr32(dev, NV03_PFIFO_RAMRO, dev_priv->ramro_offset>>8);
+
+	if (dev_priv->chipset < 0x17) {
+		nv_wr32(dev, NV03_PFIFO_RAMFC, dev_priv->ramfc_offset >> 8);
+	} else {
+		nv_wr32(dev, NV03_PFIFO_RAMFC, (dev_priv->ramfc_offset >> 8) |
+					       (1 << 16) /* 64 Bytes entry*/);
+		/* XXX nvidia blob set bit 18, 21,23 for nv20 & nv30 */
+	}
+}
+
+static void
+nv10_fifo_init_intr(struct drm_device *dev)
+{
+	nv_wr32(dev, 0x002100, 0xffffffff);
+	nv_wr32(dev, 0x002140, 0xffffffff);
+}
+
+int
+nv10_fifo_init(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_fifo_engine *pfifo = &dev_priv->engine.fifo;
+	int i;
+
+	nv10_fifo_init_reset(dev);
+	nv10_fifo_init_ramxx(dev);
+
+	nv10_fifo_do_load_context(dev, pfifo->channels - 1);
+	nv_wr32(dev, NV03_PFIFO_CACHE1_PUSH1, pfifo->channels - 1);
+
+	nv10_fifo_init_intr(dev);
+	pfifo->enable(dev);
+	pfifo->reassign(dev, true);
+
+	for (i = 0; i < dev_priv->engine.fifo.channels; i++) {
+		if (dev_priv->fifos[i]) {
+			uint32_t mode = nv_rd32(dev, NV04_PFIFO_MODE);
+			nv_wr32(dev, NV04_PFIFO_MODE, mode | (1 << i));
+		}
+	}
+
+	return 0;
+}
diff --git a/drivers/gpu/drm/nouveau/nv10_graph.c b/drivers/gpu/drm/nouveau/nv10_graph.c
new file mode 100644
index 000000000000..fcf2cdd19493
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nv10_graph.c
@@ -0,0 +1,1009 @@
+/*
+ * Copyright 2007 Matthieu CASTET <castet.matthieu@free.fr>
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * PRECISION INSIGHT AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ */
+
+#include "drmP.h"
+#include "drm.h"
+#include "nouveau_drm.h"
+#include "nouveau_drv.h"
+
+#define NV10_FIFO_NUMBER 32
+
+struct pipe_state {
+	uint32_t pipe_0x0000[0x040/4];
+	uint32_t pipe_0x0040[0x010/4];
+	uint32_t pipe_0x0200[0x0c0/4];
+	uint32_t pipe_0x4400[0x080/4];
+	uint32_t pipe_0x6400[0x3b0/4];
+	uint32_t pipe_0x6800[0x2f0/4];
+	uint32_t pipe_0x6c00[0x030/4];
+	uint32_t pipe_0x7000[0x130/4];
+	uint32_t pipe_0x7400[0x0c0/4];
+	uint32_t pipe_0x7800[0x0c0/4];
+};
+
+static int nv10_graph_ctx_regs[] = {
+	NV10_PGRAPH_CTX_SWITCH1,
+	NV10_PGRAPH_CTX_SWITCH2,
+	NV10_PGRAPH_CTX_SWITCH3,
+	NV10_PGRAPH_CTX_SWITCH4,
+	NV10_PGRAPH_CTX_SWITCH5,
+	NV10_PGRAPH_CTX_CACHE1,	/* 8 values from 0x400160 to 0x40017c */
+	NV10_PGRAPH_CTX_CACHE2,	/* 8 values from 0x400180 to 0x40019c */
+	NV10_PGRAPH_CTX_CACHE3,	/* 8 values from 0x4001a0 to 0x4001bc */
+	NV10_PGRAPH_CTX_CACHE4,	/* 8 values from 0x4001c0 to 0x4001dc */
+	NV10_PGRAPH_CTX_CACHE5,	/* 8 values from 0x4001e0 to 0x4001fc */
+	0x00400164,
+	0x00400184,
+	0x004001a4,
+	0x004001c4,
+	0x004001e4,
+	0x00400168,
+	0x00400188,
+	0x004001a8,
+	0x004001c8,
+	0x004001e8,
+	0x0040016c,
+	0x0040018c,
+	0x004001ac,
+	0x004001cc,
+	0x004001ec,
+	0x00400170,
+	0x00400190,
+	0x004001b0,
+	0x004001d0,
+	0x004001f0,
+	0x00400174,
+	0x00400194,
+	0x004001b4,
+	0x004001d4,
+	0x004001f4,
+	0x00400178,
+	0x00400198,
+	0x004001b8,
+	0x004001d8,
+	0x004001f8,
+	0x0040017c,
+	0x0040019c,
+	0x004001bc,
+	0x004001dc,
+	0x004001fc,
+	NV10_PGRAPH_CTX_USER,
+	NV04_PGRAPH_DMA_START_0,
+	NV04_PGRAPH_DMA_START_1,
+	NV04_PGRAPH_DMA_LENGTH,
+	NV04_PGRAPH_DMA_MISC,
+	NV10_PGRAPH_DMA_PITCH,
+	NV04_PGRAPH_BOFFSET0,
+	NV04_PGRAPH_BBASE0,
+	NV04_PGRAPH_BLIMIT0,
+	NV04_PGRAPH_BOFFSET1,
+	NV04_PGRAPH_BBASE1,
+	NV04_PGRAPH_BLIMIT1,
+	NV04_PGRAPH_BOFFSET2,
+	NV04_PGRAPH_BBASE2,
+	NV04_PGRAPH_BLIMIT2,
+	NV04_PGRAPH_BOFFSET3,
+	NV04_PGRAPH_BBASE3,
+	NV04_PGRAPH_BLIMIT3,
+	NV04_PGRAPH_BOFFSET4,
+	NV04_PGRAPH_BBASE4,
+	NV04_PGRAPH_BLIMIT4,
+	NV04_PGRAPH_BOFFSET5,
+	NV04_PGRAPH_BBASE5,
+	NV04_PGRAPH_BLIMIT5,
+	NV04_PGRAPH_BPITCH0,
+	NV04_PGRAPH_BPITCH1,
+	NV04_PGRAPH_BPITCH2,
+	NV04_PGRAPH_BPITCH3,
+	NV04_PGRAPH_BPITCH4,
+	NV10_PGRAPH_SURFACE,
+	NV10_PGRAPH_STATE,
+	NV04_PGRAPH_BSWIZZLE2,
+	NV04_PGRAPH_BSWIZZLE5,
+	NV04_PGRAPH_BPIXEL,
+	NV10_PGRAPH_NOTIFY,
+	NV04_PGRAPH_PATT_COLOR0,
+	NV04_PGRAPH_PATT_COLOR1,
+	NV04_PGRAPH_PATT_COLORRAM, /* 64 values from 0x400900 to 0x4009fc */
+	0x00400904,
+	0x00400908,
+	0x0040090c,
+	0x00400910,
+	0x00400914,
+	0x00400918,
+	0x0040091c,
+	0x00400920,
+	0x00400924,
+	0x00400928,
+	0x0040092c,
+	0x00400930,
+	0x00400934,
+	0x00400938,
+	0x0040093c,
+	0x00400940,
+	0x00400944,
+	0x00400948,
+	0x0040094c,
+	0x00400950,
+	0x00400954,
+	0x00400958,
+	0x0040095c,
+	0x00400960,
+	0x00400964,
+	0x00400968,
+	0x0040096c,
+	0x00400970,
+	0x00400974,
+	0x00400978,
+	0x0040097c,
+	0x00400980,
+	0x00400984,
+	0x00400988,
+	0x0040098c,
+	0x00400990,
+	0x00400994,
+	0x00400998,
+	0x0040099c,
+	0x004009a0,
+	0x004009a4,
+	0x004009a8,
+	0x004009ac,
+	0x004009b0,
+	0x004009b4,
+	0x004009b8,
+	0x004009bc,
+	0x004009c0,
+	0x004009c4,
+	0x004009c8,
+	0x004009cc,
+	0x004009d0,
+	0x004009d4,
+	0x004009d8,
+	0x004009dc,
+	0x004009e0,
+	0x004009e4,
+	0x004009e8,
+	0x004009ec,
+	0x004009f0,
+	0x004009f4,
+	0x004009f8,
+	0x004009fc,
+	NV04_PGRAPH_PATTERN,	/* 2 values from 0x400808 to 0x40080c */
+	0x0040080c,
+	NV04_PGRAPH_PATTERN_SHAPE,
+	NV03_PGRAPH_MONO_COLOR0,
+	NV04_PGRAPH_ROP3,
+	NV04_PGRAPH_CHROMA,
+	NV04_PGRAPH_BETA_AND,
+	NV04_PGRAPH_BETA_PREMULT,
+	0x00400e70,
+	0x00400e74,
+	0x00400e78,
+	0x00400e7c,
+	0x00400e80,
+	0x00400e84,
+	0x00400e88,
+	0x00400e8c,
+	0x00400ea0,
+	0x00400ea4,
+	0x00400ea8,
+	0x00400e90,
+	0x00400e94,
+	0x00400e98,
+	0x00400e9c,
+	NV10_PGRAPH_WINDOWCLIP_HORIZONTAL, /* 8 values from 0x400f00-0x400f1c */
+	NV10_PGRAPH_WINDOWCLIP_VERTICAL,   /* 8 values from 0x400f20-0x400f3c */
+	0x00400f04,
+	0x00400f24,
+	0x00400f08,
+	0x00400f28,
+	0x00400f0c,
+	0x00400f2c,
+	0x00400f10,
+	0x00400f30,
+	0x00400f14,
+	0x00400f34,
+	0x00400f18,
+	0x00400f38,
+	0x00400f1c,
+	0x00400f3c,
+	NV10_PGRAPH_XFMODE0,
+	NV10_PGRAPH_XFMODE1,
+	NV10_PGRAPH_GLOBALSTATE0,
+	NV10_PGRAPH_GLOBALSTATE1,
+	NV04_PGRAPH_STORED_FMT,
+	NV04_PGRAPH_SOURCE_COLOR,
+	NV03_PGRAPH_ABS_X_RAM,	/* 32 values from 0x400400 to 0x40047c */
+	NV03_PGRAPH_ABS_Y_RAM,	/* 32 values from 0x400480 to 0x4004fc */
+	0x00400404,
+	0x00400484,
+	0x00400408,
+	0x00400488,
+	0x0040040c,
+	0x0040048c,
+	0x00400410,
+	0x00400490,
+	0x00400414,
+	0x00400494,
+	0x00400418,
+	0x00400498,
+	0x0040041c,
+	0x0040049c,
+	0x00400420,
+	0x004004a0,
+	0x00400424,
+	0x004004a4,
+	0x00400428,
+	0x004004a8,
+	0x0040042c,
+	0x004004ac,
+	0x00400430,
+	0x004004b0,
+	0x00400434,
+	0x004004b4,
+	0x00400438,
+	0x004004b8,
+	0x0040043c,
+	0x004004bc,
+	0x00400440,
+	0x004004c0,
+	0x00400444,
+	0x004004c4,
+	0x00400448,
+	0x004004c8,
+	0x0040044c,
+	0x004004cc,
+	0x00400450,
+	0x004004d0,
+	0x00400454,
+	0x004004d4,
+	0x00400458,
+	0x004004d8,
+	0x0040045c,
+	0x004004dc,
+	0x00400460,
+	0x004004e0,
+	0x00400464,
+	0x004004e4,
+	0x00400468,
+	0x004004e8,
+	0x0040046c,
+	0x004004ec,
+	0x00400470,
+	0x004004f0,
+	0x00400474,
+	0x004004f4,
+	0x00400478,
+	0x004004f8,
+	0x0040047c,
+	0x004004fc,
+	NV03_PGRAPH_ABS_UCLIP_XMIN,
+	NV03_PGRAPH_ABS_UCLIP_XMAX,
+	NV03_PGRAPH_ABS_UCLIP_YMIN,
+	NV03_PGRAPH_ABS_UCLIP_YMAX,
+	0x00400550,
+	0x00400558,
+	0x00400554,
+	0x0040055c,
+	NV03_PGRAPH_ABS_UCLIPA_XMIN,
+	NV03_PGRAPH_ABS_UCLIPA_XMAX,
+	NV03_PGRAPH_ABS_UCLIPA_YMIN,
+	NV03_PGRAPH_ABS_UCLIPA_YMAX,
+	NV03_PGRAPH_ABS_ICLIP_XMAX,
+	NV03_PGRAPH_ABS_ICLIP_YMAX,
+	NV03_PGRAPH_XY_LOGIC_MISC0,
+	NV03_PGRAPH_XY_LOGIC_MISC1,
+	NV03_PGRAPH_XY_LOGIC_MISC2,
+	NV03_PGRAPH_XY_LOGIC_MISC3,
+	NV03_PGRAPH_CLIPX_0,
+	NV03_PGRAPH_CLIPX_1,
+	NV03_PGRAPH_CLIPY_0,
+	NV03_PGRAPH_CLIPY_1,
+	NV10_PGRAPH_COMBINER0_IN_ALPHA,
+	NV10_PGRAPH_COMBINER1_IN_ALPHA,
+	NV10_PGRAPH_COMBINER0_IN_RGB,
+	NV10_PGRAPH_COMBINER1_IN_RGB,
+	NV10_PGRAPH_COMBINER_COLOR0,
+	NV10_PGRAPH_COMBINER_COLOR1,
+	NV10_PGRAPH_COMBINER0_OUT_ALPHA,
+	NV10_PGRAPH_COMBINER1_OUT_ALPHA,
+	NV10_PGRAPH_COMBINER0_OUT_RGB,
+	NV10_PGRAPH_COMBINER1_OUT_RGB,
+	NV10_PGRAPH_COMBINER_FINAL0,
+	NV10_PGRAPH_COMBINER_FINAL1,
+	0x00400e00,
+	0x00400e04,
+	0x00400e08,
+	0x00400e0c,
+	0x00400e10,
+	0x00400e14,
+	0x00400e18,
+	0x00400e1c,
+	0x00400e20,
+	0x00400e24,
+	0x00400e28,
+	0x00400e2c,
+	0x00400e30,
+	0x00400e34,
+	0x00400e38,
+	0x00400e3c,
+	NV04_PGRAPH_PASSTHRU_0,
+	NV04_PGRAPH_PASSTHRU_1,
+	NV04_PGRAPH_PASSTHRU_2,
+	NV10_PGRAPH_DIMX_TEXTURE,
+	NV10_PGRAPH_WDIMX_TEXTURE,
+	NV10_PGRAPH_DVD_COLORFMT,
+	NV10_PGRAPH_SCALED_FORMAT,
+	NV04_PGRAPH_MISC24_0,
+	NV04_PGRAPH_MISC24_1,
+	NV04_PGRAPH_MISC24_2,
+	NV03_PGRAPH_X_MISC,
+	NV03_PGRAPH_Y_MISC,
+	NV04_PGRAPH_VALID1,
+	NV04_PGRAPH_VALID2,
+};
+
+static int nv17_graph_ctx_regs[] = {
+	NV10_PGRAPH_DEBUG_4,
+	0x004006b0,
+	0x00400eac,
+	0x00400eb0,
+	0x00400eb4,
+	0x00400eb8,
+	0x00400ebc,
+	0x00400ec0,
+	0x00400ec4,
+	0x00400ec8,
+	0x00400ecc,
+	0x00400ed0,
+	0x00400ed4,
+	0x00400ed8,
+	0x00400edc,
+	0x00400ee0,
+	0x00400a00,
+	0x00400a04,
+};
+
+struct graph_state {
+	int nv10[ARRAY_SIZE(nv10_graph_ctx_regs)];
+	int nv17[ARRAY_SIZE(nv17_graph_ctx_regs)];
+	struct pipe_state pipe_state;
+	uint32_t lma_window[4];
+};
+
+#define PIPE_SAVE(dev, state, addr)					\
+	do {								\
+		int __i;						\
+		nv_wr32(dev, NV10_PGRAPH_PIPE_ADDRESS, addr);		\
+		for (__i = 0; __i < ARRAY_SIZE(state); __i++)		\
+			state[__i] = nv_rd32(dev, NV10_PGRAPH_PIPE_DATA); \
+	} while (0)
+
+#define PIPE_RESTORE(dev, state, addr)					\
+	do {								\
+		int __i;						\
+		nv_wr32(dev, NV10_PGRAPH_PIPE_ADDRESS, addr);		\
+		for (__i = 0; __i < ARRAY_SIZE(state); __i++)		\
+			nv_wr32(dev, NV10_PGRAPH_PIPE_DATA, state[__i]); \
+	} while (0)
+
+static void nv10_graph_save_pipe(struct nouveau_channel *chan)
+{
+	struct drm_device *dev = chan->dev;
+	struct graph_state *pgraph_ctx = chan->pgraph_ctx;
+	struct pipe_state *pipe = &pgraph_ctx->pipe_state;
+
+	PIPE_SAVE(dev, pipe->pipe_0x4400, 0x4400);
+	PIPE_SAVE(dev, pipe->pipe_0x0200, 0x0200);
+	PIPE_SAVE(dev, pipe->pipe_0x6400, 0x6400);
+	PIPE_SAVE(dev, pipe->pipe_0x6800, 0x6800);
+	PIPE_SAVE(dev, pipe->pipe_0x6c00, 0x6c00);
+	PIPE_SAVE(dev, pipe->pipe_0x7000, 0x7000);
+	PIPE_SAVE(dev, pipe->pipe_0x7400, 0x7400);
+	PIPE_SAVE(dev, pipe->pipe_0x7800, 0x7800);
+	PIPE_SAVE(dev, pipe->pipe_0x0040, 0x0040);
+	PIPE_SAVE(dev, pipe->pipe_0x0000, 0x0000);
+}
+
+static void nv10_graph_load_pipe(struct nouveau_channel *chan)
+{
+	struct drm_device *dev = chan->dev;
+	struct graph_state *pgraph_ctx = chan->pgraph_ctx;
+	struct pipe_state *pipe = &pgraph_ctx->pipe_state;
+	uint32_t xfmode0, xfmode1;
+	int i;
+
+	nouveau_wait_for_idle(dev);
+	/* XXX check haiku comments */
+	xfmode0 = nv_rd32(dev, NV10_PGRAPH_XFMODE0);
+	xfmode1 = nv_rd32(dev, NV10_PGRAPH_XFMODE1);
+	nv_wr32(dev, NV10_PGRAPH_XFMODE0, 0x10000000);
+	nv_wr32(dev, NV10_PGRAPH_XFMODE1, 0x00000000);
+	nv_wr32(dev, NV10_PGRAPH_PIPE_ADDRESS, 0x000064c0);
+	for (i = 0; i < 4; i++)
+		nv_wr32(dev, NV10_PGRAPH_PIPE_DATA, 0x3f800000);
+	for (i = 0; i < 4; i++)
+		nv_wr32(dev, NV10_PGRAPH_PIPE_DATA, 0x00000000);
+
+	nv_wr32(dev, NV10_PGRAPH_PIPE_ADDRESS, 0x00006ab0);
+	for (i = 0; i < 3; i++)
+		nv_wr32(dev, NV10_PGRAPH_PIPE_DATA, 0x3f800000);
+
+	nv_wr32(dev, NV10_PGRAPH_PIPE_ADDRESS, 0x00006a80);
+	for (i = 0; i < 3; i++)
+		nv_wr32(dev, NV10_PGRAPH_PIPE_DATA, 0x00000000);
+
+	nv_wr32(dev, NV10_PGRAPH_PIPE_ADDRESS, 0x00000040);
+	nv_wr32(dev, NV10_PGRAPH_PIPE_DATA, 0x00000008);
+
+
+	PIPE_RESTORE(dev, pipe->pipe_0x0200, 0x0200);
+	nouveau_wait_for_idle(dev);
+
+	/* restore XFMODE */
+	nv_wr32(dev, NV10_PGRAPH_XFMODE0, xfmode0);
+	nv_wr32(dev, NV10_PGRAPH_XFMODE1, xfmode1);
+	PIPE_RESTORE(dev, pipe->pipe_0x6400, 0x6400);
+	PIPE_RESTORE(dev, pipe->pipe_0x6800, 0x6800);
+	PIPE_RESTORE(dev, pipe->pipe_0x6c00, 0x6c00);
+	PIPE_RESTORE(dev, pipe->pipe_0x7000, 0x7000);
+	PIPE_RESTORE(dev, pipe->pipe_0x7400, 0x7400);
+	PIPE_RESTORE(dev, pipe->pipe_0x7800, 0x7800);
+	PIPE_RESTORE(dev, pipe->pipe_0x4400, 0x4400);
+	PIPE_RESTORE(dev, pipe->pipe_0x0000, 0x0000);
+	PIPE_RESTORE(dev, pipe->pipe_0x0040, 0x0040);
+	nouveau_wait_for_idle(dev);
+}
+
+static void nv10_graph_create_pipe(struct nouveau_channel *chan)
+{
+	struct drm_device *dev = chan->dev;
+	struct graph_state *pgraph_ctx = chan->pgraph_ctx;
+	struct pipe_state *fifo_pipe_state = &pgraph_ctx->pipe_state;
+	uint32_t *fifo_pipe_state_addr;
+	int i;
+#define PIPE_INIT(addr) \
+	do { \
+		fifo_pipe_state_addr = fifo_pipe_state->pipe_##addr; \
+	} while (0)
+#define PIPE_INIT_END(addr) \
+	do { \
+		uint32_t *__end_addr = fifo_pipe_state->pipe_##addr + \
+				ARRAY_SIZE(fifo_pipe_state->pipe_##addr); \
+		if (fifo_pipe_state_addr != __end_addr) \
+			NV_ERROR(dev, "incomplete pipe init for 0x%x :  %p/%p\n", \
+				addr, fifo_pipe_state_addr, __end_addr); \
+	} while (0)
+#define NV_WRITE_PIPE_INIT(value) *(fifo_pipe_state_addr++) = value
+
+	PIPE_INIT(0x0200);
+	for (i = 0; i < 48; i++)
+		NV_WRITE_PIPE_INIT(0x00000000);
+	PIPE_INIT_END(0x0200);
+
+	PIPE_INIT(0x6400);
+	for (i = 0; i < 211; i++)
+		NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x3f800000);
+	NV_WRITE_PIPE_INIT(0x40000000);
+	NV_WRITE_PIPE_INIT(0x40000000);
+	NV_WRITE_PIPE_INIT(0x40000000);
+	NV_WRITE_PIPE_INIT(0x40000000);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x3f800000);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x3f000000);
+	NV_WRITE_PIPE_INIT(0x3f000000);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x3f800000);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x3f800000);
+	NV_WRITE_PIPE_INIT(0x3f800000);
+	NV_WRITE_PIPE_INIT(0x3f800000);
+	NV_WRITE_PIPE_INIT(0x3f800000);
+	PIPE_INIT_END(0x6400);
+
+	PIPE_INIT(0x6800);
+	for (i = 0; i < 162; i++)
+		NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x3f800000);
+	for (i = 0; i < 25; i++)
+		NV_WRITE_PIPE_INIT(0x00000000);
+	PIPE_INIT_END(0x6800);
+
+	PIPE_INIT(0x6c00);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0xbf800000);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	PIPE_INIT_END(0x6c00);
+
+	PIPE_INIT(0x7000);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x7149f2ca);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x7149f2ca);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x7149f2ca);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x7149f2ca);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x7149f2ca);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x7149f2ca);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x7149f2ca);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x00000000);
+	NV_WRITE_PIPE_INIT(0x7149f2ca);
+	for (i = 0; i < 35; i++)
+		NV_WRITE_PIPE_INIT(0x00000000);
+	PIPE_INIT_END(0x7000);
+
+	PIPE_INIT(0x7400);
+	for (i = 0; i < 48; i++)
+		NV_WRITE_PIPE_INIT(0x00000000);
+	PIPE_INIT_END(0x7400);
+
+	PIPE_INIT(0x7800);
+	for (i = 0; i < 48; i++)
+		NV_WRITE_PIPE_INIT(0x00000000);
+	PIPE_INIT_END(0x7800);
+
+	PIPE_INIT(0x4400);
+	for (i = 0; i < 32; i++)
+		NV_WRITE_PIPE_INIT(0x00000000);
+	PIPE_INIT_END(0x4400);
+
+	PIPE_INIT(0x0000);
+	for (i = 0; i < 16; i++)
+		NV_WRITE_PIPE_INIT(0x00000000);
+	PIPE_INIT_END(0x0000);
+
+	PIPE_INIT(0x0040);
+	for (i = 0; i < 4; i++)
+		NV_WRITE_PIPE_INIT(0x00000000);
+	PIPE_INIT_END(0x0040);
+
+#undef PIPE_INIT
+#undef PIPE_INIT_END
+#undef NV_WRITE_PIPE_INIT
+}
+
+static int nv10_graph_ctx_regs_find_offset(struct drm_device *dev, int reg)
+{
+	int i;
+	for (i = 0; i < ARRAY_SIZE(nv10_graph_ctx_regs); i++) {
+		if (nv10_graph_ctx_regs[i] == reg)
+			return i;
+	}
+	NV_ERROR(dev, "unknow offset nv10_ctx_regs %d\n", reg);
+	return -1;
+}
+
+static int nv17_graph_ctx_regs_find_offset(struct drm_device *dev, int reg)
+{
+	int i;
+	for (i = 0; i < ARRAY_SIZE(nv17_graph_ctx_regs); i++) {
+		if (nv17_graph_ctx_regs[i] == reg)
+			return i;
+	}
+	NV_ERROR(dev, "unknow offset nv17_ctx_regs %d\n", reg);
+	return -1;
+}
+
+int nv10_graph_load_context(struct nouveau_channel *chan)
+{
+	struct drm_device *dev = chan->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct graph_state *pgraph_ctx = chan->pgraph_ctx;
+	uint32_t tmp;
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(nv10_graph_ctx_regs); i++)
+		nv_wr32(dev, nv10_graph_ctx_regs[i], pgraph_ctx->nv10[i]);
+	if (dev_priv->chipset >= 0x17) {
+		for (i = 0; i < ARRAY_SIZE(nv17_graph_ctx_regs); i++)
+			nv_wr32(dev, nv17_graph_ctx_regs[i],
+						pgraph_ctx->nv17[i]);
+	}
+
+	nv10_graph_load_pipe(chan);
+
+	nv_wr32(dev, NV10_PGRAPH_CTX_CONTROL, 0x10010100);
+	tmp = nv_rd32(dev, NV10_PGRAPH_CTX_USER);
+	nv_wr32(dev, NV10_PGRAPH_CTX_USER, (tmp & 0xffffff) | chan->id << 24);
+	tmp = nv_rd32(dev, NV10_PGRAPH_FFINTFC_ST2);
+	nv_wr32(dev, NV10_PGRAPH_FFINTFC_ST2, tmp & 0xcfffffff);
+	return 0;
+}
+
+int
+nv10_graph_unload_context(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_pgraph_engine *pgraph = &dev_priv->engine.graph;
+	struct nouveau_fifo_engine *pfifo = &dev_priv->engine.fifo;
+	struct nouveau_channel *chan;
+	struct graph_state *ctx;
+	uint32_t tmp;
+	int i;
+
+	chan = pgraph->channel(dev);
+	if (!chan)
+		return 0;
+	ctx = chan->pgraph_ctx;
+
+	for (i = 0; i < ARRAY_SIZE(nv10_graph_ctx_regs); i++)
+		ctx->nv10[i] = nv_rd32(dev, nv10_graph_ctx_regs[i]);
+
+	if (dev_priv->chipset >= 0x17) {
+		for (i = 0; i < ARRAY_SIZE(nv17_graph_ctx_regs); i++)
+			ctx->nv17[i] = nv_rd32(dev, nv17_graph_ctx_regs[i]);
+	}
+
+	nv10_graph_save_pipe(chan);
+
+	nv_wr32(dev, NV10_PGRAPH_CTX_CONTROL, 0x10000000);
+	tmp  = nv_rd32(dev, NV10_PGRAPH_CTX_USER) & 0x00ffffff;
+	tmp |= (pfifo->channels - 1) << 24;
+	nv_wr32(dev, NV10_PGRAPH_CTX_USER, tmp);
+	return 0;
+}
+
+void
+nv10_graph_context_switch(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_pgraph_engine *pgraph = &dev_priv->engine.graph;
+	struct nouveau_channel *chan = NULL;
+	int chid;
+
+	pgraph->fifo_access(dev, false);
+	nouveau_wait_for_idle(dev);
+
+	/* If previous context is valid, we need to save it */
+	nv10_graph_unload_context(dev);
+
+	/* Load context for next channel */
+	chid = (nv_rd32(dev, NV04_PGRAPH_TRAPPED_ADDR) >> 20) & 0x1f;
+	chan = dev_priv->fifos[chid];
+	if (chan)
+		nv10_graph_load_context(chan);
+
+	pgraph->fifo_access(dev, true);
+}
+
+#define NV_WRITE_CTX(reg, val) do { \
+	int offset = nv10_graph_ctx_regs_find_offset(dev, reg); \
+	if (offset > 0) \
+		pgraph_ctx->nv10[offset] = val; \
+	} while (0)
+
+#define NV17_WRITE_CTX(reg, val) do { \
+	int offset = nv17_graph_ctx_regs_find_offset(dev, reg); \
+	if (offset > 0) \
+		pgraph_ctx->nv17[offset] = val; \
+	} while (0)
+
+struct nouveau_channel *
+nv10_graph_channel(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	int chid = dev_priv->engine.fifo.channels;
+
+	if (nv_rd32(dev, NV10_PGRAPH_CTX_CONTROL) & 0x00010000)
+		chid = nv_rd32(dev, NV10_PGRAPH_CTX_USER) >> 24;
+
+	if (chid >= dev_priv->engine.fifo.channels)
+		return NULL;
+
+	return dev_priv->fifos[chid];
+}
+
+int nv10_graph_create_context(struct nouveau_channel *chan)
+{
+	struct drm_device *dev = chan->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct graph_state *pgraph_ctx;
+
+	NV_DEBUG(dev, "nv10_graph_context_create %d\n", chan->id);
+
+	chan->pgraph_ctx = pgraph_ctx = kzalloc(sizeof(*pgraph_ctx),
+						GFP_KERNEL);
+	if (pgraph_ctx == NULL)
+		return -ENOMEM;
+
+
+	NV_WRITE_CTX(0x00400e88, 0x08000000);
+	NV_WRITE_CTX(0x00400e9c, 0x4b7fffff);
+	NV_WRITE_CTX(NV03_PGRAPH_XY_LOGIC_MISC0, 0x0001ffff);
+	NV_WRITE_CTX(0x00400e10, 0x00001000);
+	NV_WRITE_CTX(0x00400e14, 0x00001000);
+	NV_WRITE_CTX(0x00400e30, 0x00080008);
+	NV_WRITE_CTX(0x00400e34, 0x00080008);
+	if (dev_priv->chipset >= 0x17) {
+		/* is it really needed ??? */
+		NV17_WRITE_CTX(NV10_PGRAPH_DEBUG_4,
+					nv_rd32(dev, NV10_PGRAPH_DEBUG_4));
+		NV17_WRITE_CTX(0x004006b0, nv_rd32(dev, 0x004006b0));
+		NV17_WRITE_CTX(0x00400eac, 0x0fff0000);
+		NV17_WRITE_CTX(0x00400eb0, 0x0fff0000);
+		NV17_WRITE_CTX(0x00400ec0, 0x00000080);
+		NV17_WRITE_CTX(0x00400ed0, 0x00000080);
+	}
+	NV_WRITE_CTX(NV10_PGRAPH_CTX_USER, chan->id << 24);
+
+	nv10_graph_create_pipe(chan);
+	return 0;
+}
+
+void nv10_graph_destroy_context(struct nouveau_channel *chan)
+{
+	struct graph_state *pgraph_ctx = chan->pgraph_ctx;
+
+	kfree(pgraph_ctx);
+	chan->pgraph_ctx = NULL;
+}
+
+void
+nv10_graph_set_region_tiling(struct drm_device *dev, int i, uint32_t addr,
+			     uint32_t size, uint32_t pitch)
+{
+	uint32_t limit = max(1u, addr + size) - 1;
+
+	if (pitch)
+		addr |= 1 << 31;
+
+	nv_wr32(dev, NV10_PGRAPH_TLIMIT(i), limit);
+	nv_wr32(dev, NV10_PGRAPH_TSIZE(i), pitch);
+	nv_wr32(dev, NV10_PGRAPH_TILE(i), addr);
+}
+
+int nv10_graph_init(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	uint32_t tmp;
+	int i;
+
+	nv_wr32(dev, NV03_PMC_ENABLE, nv_rd32(dev, NV03_PMC_ENABLE) &
+			~NV_PMC_ENABLE_PGRAPH);
+	nv_wr32(dev, NV03_PMC_ENABLE, nv_rd32(dev, NV03_PMC_ENABLE) |
+			 NV_PMC_ENABLE_PGRAPH);
+
+	nv_wr32(dev, NV03_PGRAPH_INTR   , 0xFFFFFFFF);
+	nv_wr32(dev, NV03_PGRAPH_INTR_EN, 0xFFFFFFFF);
+
+	nv_wr32(dev, NV04_PGRAPH_DEBUG_0, 0xFFFFFFFF);
+	nv_wr32(dev, NV04_PGRAPH_DEBUG_0, 0x00000000);
+	nv_wr32(dev, NV04_PGRAPH_DEBUG_1, 0x00118700);
+	/* nv_wr32(dev, NV04_PGRAPH_DEBUG_2, 0x24E00810); */ /* 0x25f92ad9 */
+	nv_wr32(dev, NV04_PGRAPH_DEBUG_2, 0x25f92ad9);
+	nv_wr32(dev, NV04_PGRAPH_DEBUG_3, 0x55DE0830 |
+				      (1<<29) |
+				      (1<<31));
+	if (dev_priv->chipset >= 0x17) {
+		nv_wr32(dev, NV10_PGRAPH_DEBUG_4, 0x1f000000);
+		nv_wr32(dev, 0x400a10, 0x3ff3fb6);
+		nv_wr32(dev, 0x400838, 0x2f8684);
+		nv_wr32(dev, 0x40083c, 0x115f3f);
+		nv_wr32(dev, 0x004006b0, 0x40000020);
+	} else
+		nv_wr32(dev, NV10_PGRAPH_DEBUG_4, 0x00000000);
+
+	/* Turn all the tiling regions off. */
+	for (i = 0; i < NV10_PFB_TILE__SIZE; i++)
+		nv10_graph_set_region_tiling(dev, i, 0, 0, 0);
+
+	nv_wr32(dev, NV10_PGRAPH_CTX_SWITCH1, 0x00000000);
+	nv_wr32(dev, NV10_PGRAPH_CTX_SWITCH2, 0x00000000);
+	nv_wr32(dev, NV10_PGRAPH_CTX_SWITCH3, 0x00000000);
+	nv_wr32(dev, NV10_PGRAPH_CTX_SWITCH4, 0x00000000);
+	nv_wr32(dev, NV10_PGRAPH_STATE      , 0xFFFFFFFF);
+
+	tmp  = nv_rd32(dev, NV10_PGRAPH_CTX_USER) & 0x00ffffff;
+	tmp |= (dev_priv->engine.fifo.channels - 1) << 24;
+	nv_wr32(dev, NV10_PGRAPH_CTX_USER, tmp);
+	nv_wr32(dev, NV10_PGRAPH_CTX_CONTROL, 0x10000100);
+	nv_wr32(dev, NV10_PGRAPH_FFINTFC_ST2, 0x08000000);
+
+	return 0;
+}
+
+void nv10_graph_takedown(struct drm_device *dev)
+{
+}
+
+static int
+nv17_graph_mthd_lma_window(struct nouveau_channel *chan, int grclass,
+			   int mthd, uint32_t data)
+{
+	struct drm_device *dev = chan->dev;
+	struct graph_state *ctx = chan->pgraph_ctx;
+	struct pipe_state *pipe = &ctx->pipe_state;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_pgraph_engine *pgraph = &dev_priv->engine.graph;
+	uint32_t pipe_0x0040[1], pipe_0x64c0[8], pipe_0x6a80[3], pipe_0x6ab0[3];
+	uint32_t xfmode0, xfmode1;
+	int i;
+
+	ctx->lma_window[(mthd - 0x1638) / 4] = data;
+
+	if (mthd != 0x1644)
+		return 0;
+
+	nouveau_wait_for_idle(dev);
+
+	PIPE_SAVE(dev, pipe_0x0040, 0x0040);
+	PIPE_SAVE(dev, pipe->pipe_0x0200, 0x0200);
+
+	PIPE_RESTORE(dev, ctx->lma_window, 0x6790);
+
+	nouveau_wait_for_idle(dev);
+
+	xfmode0 = nv_rd32(dev, NV10_PGRAPH_XFMODE0);
+	xfmode1 = nv_rd32(dev, NV10_PGRAPH_XFMODE1);
+
+	PIPE_SAVE(dev, pipe->pipe_0x4400, 0x4400);
+	PIPE_SAVE(dev, pipe_0x64c0, 0x64c0);
+	PIPE_SAVE(dev, pipe_0x6ab0, 0x6ab0);
+	PIPE_SAVE(dev, pipe_0x6a80, 0x6a80);
+
+	nouveau_wait_for_idle(dev);
+
+	nv_wr32(dev, NV10_PGRAPH_XFMODE0, 0x10000000);
+	nv_wr32(dev, NV10_PGRAPH_XFMODE1, 0x00000000);
+	nv_wr32(dev, NV10_PGRAPH_PIPE_ADDRESS, 0x000064c0);
+	for (i = 0; i < 4; i++)
+		nv_wr32(dev, NV10_PGRAPH_PIPE_DATA, 0x3f800000);
+	for (i = 0; i < 4; i++)
+		nv_wr32(dev, NV10_PGRAPH_PIPE_DATA, 0x00000000);
+
+	nv_wr32(dev, NV10_PGRAPH_PIPE_ADDRESS, 0x00006ab0);
+	for (i = 0; i < 3; i++)
+		nv_wr32(dev, NV10_PGRAPH_PIPE_DATA, 0x3f800000);
+
+	nv_wr32(dev, NV10_PGRAPH_PIPE_ADDRESS, 0x00006a80);
+	for (i = 0; i < 3; i++)
+		nv_wr32(dev, NV10_PGRAPH_PIPE_DATA, 0x00000000);
+
+	nv_wr32(dev, NV10_PGRAPH_PIPE_ADDRESS, 0x00000040);
+	nv_wr32(dev, NV10_PGRAPH_PIPE_DATA, 0x00000008);
+
+	PIPE_RESTORE(dev, pipe->pipe_0x0200, 0x0200);
+
+	nouveau_wait_for_idle(dev);
+
+	PIPE_RESTORE(dev, pipe_0x0040, 0x0040);
+
+	nv_wr32(dev, NV10_PGRAPH_XFMODE0, xfmode0);
+	nv_wr32(dev, NV10_PGRAPH_XFMODE1, xfmode1);
+
+	PIPE_RESTORE(dev, pipe_0x64c0, 0x64c0);
+	PIPE_RESTORE(dev, pipe_0x6ab0, 0x6ab0);
+	PIPE_RESTORE(dev, pipe_0x6a80, 0x6a80);
+	PIPE_RESTORE(dev, pipe->pipe_0x4400, 0x4400);
+
+	nv_wr32(dev, NV10_PGRAPH_PIPE_ADDRESS, 0x000000c0);
+	nv_wr32(dev, NV10_PGRAPH_PIPE_DATA, 0x00000000);
+
+	nouveau_wait_for_idle(dev);
+
+	pgraph->fifo_access(dev, true);
+
+	return 0;
+}
+
+static int
+nv17_graph_mthd_lma_enable(struct nouveau_channel *chan, int grclass,
+			   int mthd, uint32_t data)
+{
+	struct drm_device *dev = chan->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_pgraph_engine *pgraph = &dev_priv->engine.graph;
+
+	nouveau_wait_for_idle(dev);
+
+	nv_wr32(dev, NV10_PGRAPH_DEBUG_4,
+		nv_rd32(dev, NV10_PGRAPH_DEBUG_4) | 0x1 << 8);
+	nv_wr32(dev, 0x004006b0,
+		nv_rd32(dev, 0x004006b0) | 0x8 << 24);
+
+	pgraph->fifo_access(dev, true);
+
+	return 0;
+}
+
+static struct nouveau_pgraph_object_method nv17_graph_celsius_mthds[] = {
+	{ 0x1638, nv17_graph_mthd_lma_window },
+	{ 0x163c, nv17_graph_mthd_lma_window },
+	{ 0x1640, nv17_graph_mthd_lma_window },
+	{ 0x1644, nv17_graph_mthd_lma_window },
+	{ 0x1658, nv17_graph_mthd_lma_enable },
+	{}
+};
+
+struct nouveau_pgraph_object_class nv10_graph_grclass[] = {
+	{ 0x0030, false, NULL }, /* null */
+	{ 0x0039, false, NULL }, /* m2mf */
+	{ 0x004a, false, NULL }, /* gdirect */
+	{ 0x005f, false, NULL }, /* imageblit */
+	{ 0x009f, false, NULL }, /* imageblit (nv12) */
+	{ 0x008a, false, NULL }, /* ifc */
+	{ 0x0089, false, NULL }, /* sifm */
+	{ 0x0062, false, NULL }, /* surf2d */
+	{ 0x0043, false, NULL }, /* rop */
+	{ 0x0012, false, NULL }, /* beta1 */
+	{ 0x0072, false, NULL }, /* beta4 */
+	{ 0x0019, false, NULL }, /* cliprect */
+	{ 0x0044, false, NULL }, /* pattern */
+	{ 0x0052, false, NULL }, /* swzsurf */
+	{ 0x0093, false, NULL }, /* surf3d */
+	{ 0x0094, false, NULL }, /* tex_tri */
+	{ 0x0095, false, NULL }, /* multitex_tri */
+	{ 0x0056, false, NULL }, /* celcius (nv10) */
+	{ 0x0096, false, NULL }, /* celcius (nv11) */
+	{ 0x0099, false, nv17_graph_celsius_mthds }, /* celcius (nv17) */
+	{}
+};
diff --git a/drivers/gpu/drm/nouveau/nv17_gpio.c b/drivers/gpu/drm/nouveau/nv17_gpio.c
new file mode 100644
index 000000000000..2e58c331e9b7
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nv17_gpio.c
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2009 Francisco Jerez.
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial
+ * portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE COPYRIGHT OWNER(S) AND/OR ITS SUPPLIERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
+#include "drmP.h"
+#include "nouveau_drv.h"
+#include "nouveau_hw.h"
+
+static bool
+get_gpio_location(struct dcb_gpio_entry *ent, uint32_t *reg, uint32_t *shift,
+		  uint32_t *mask)
+{
+	if (ent->line < 2) {
+		*reg = NV_PCRTC_GPIO;
+		*shift = ent->line * 16;
+		*mask = 0x11;
+
+	} else if (ent->line < 10) {
+		*reg = NV_PCRTC_GPIO_EXT;
+		*shift = (ent->line - 2) * 4;
+		*mask = 0x3;
+
+	} else if (ent->line < 14) {
+		*reg = NV_PCRTC_850;
+		*shift = (ent->line - 10) * 4;
+		*mask = 0x3;
+
+	} else {
+		return false;
+	}
+
+	return true;
+}
+
+int
+nv17_gpio_get(struct drm_device *dev, enum dcb_gpio_tag tag)
+{
+	struct dcb_gpio_entry *ent = nouveau_bios_gpio_entry(dev, tag);
+	uint32_t reg, shift, mask, value;
+
+	if (!ent)
+		return -ENODEV;
+
+	if (!get_gpio_location(ent, &reg, &shift, &mask))
+		return -ENODEV;
+
+	value = NVReadCRTC(dev, 0, reg) >> shift;
+
+	return (ent->invert ? 1 : 0) ^ (value & 1);
+}
+
+int
+nv17_gpio_set(struct drm_device *dev, enum dcb_gpio_tag tag, int state)
+{
+	struct dcb_gpio_entry *ent = nouveau_bios_gpio_entry(dev, tag);
+	uint32_t reg, shift, mask, value;
+
+	if (!ent)
+		return -ENODEV;
+
+	if (!get_gpio_location(ent, &reg, &shift, &mask))
+		return -ENODEV;
+
+	value = ((ent->invert ? 1 : 0) ^ (state ? 1 : 0)) << shift;
+	mask = ~(mask << shift);
+
+	NVWriteCRTC(dev, 0, reg, value | (NVReadCRTC(dev, 0, reg) & mask));
+
+	return 0;
+}
diff --git a/drivers/gpu/drm/nouveau/nv17_tv.c b/drivers/gpu/drm/nouveau/nv17_tv.c
new file mode 100644
index 000000000000..58b917c3341b
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nv17_tv.c
@@ -0,0 +1,776 @@
+/*
+ * Copyright (C) 2009 Francisco Jerez.
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial
+ * portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE COPYRIGHT OWNER(S) AND/OR ITS SUPPLIERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
+#include "drmP.h"
+#include "drm_crtc_helper.h"
+#include "nouveau_drv.h"
+#include "nouveau_encoder.h"
+#include "nouveau_connector.h"
+#include "nouveau_crtc.h"
+#include "nouveau_hw.h"
+#include "nv17_tv.h"
+
+static uint32_t nv42_tv_sample_load(struct drm_encoder *encoder)
+{
+	struct drm_device *dev = encoder->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	uint32_t testval, regoffset = nv04_dac_output_offset(encoder);
+	uint32_t gpio0, gpio1, fp_htotal, fp_hsync_start, fp_hsync_end,
+		fp_control, test_ctrl, dacclk, ctv_14, ctv_1c, ctv_6c;
+	uint32_t sample = 0;
+	int head;
+
+#define RGB_TEST_DATA(r, g, b) (r << 0 | g << 10 | b << 20)
+	testval = RGB_TEST_DATA(0x82, 0xeb, 0x82);
+	if (dev_priv->vbios->tvdactestval)
+		testval = dev_priv->vbios->tvdactestval;
+
+	dacclk = NVReadRAMDAC(dev, 0, NV_PRAMDAC_DACCLK + regoffset);
+	head = (dacclk & 0x100) >> 8;
+
+	/* Save the previous state. */
+	gpio1 = nv17_gpio_get(dev, DCB_GPIO_TVDAC1);
+	gpio0 = nv17_gpio_get(dev, DCB_GPIO_TVDAC0);
+	fp_htotal = NVReadRAMDAC(dev, head, NV_PRAMDAC_FP_HTOTAL);
+	fp_hsync_start = NVReadRAMDAC(dev, head, NV_PRAMDAC_FP_HSYNC_START);
+	fp_hsync_end = NVReadRAMDAC(dev, head, NV_PRAMDAC_FP_HSYNC_END);
+	fp_control = NVReadRAMDAC(dev, head, NV_PRAMDAC_FP_TG_CONTROL);
+	test_ctrl = NVReadRAMDAC(dev, 0, NV_PRAMDAC_TEST_CONTROL + regoffset);
+	ctv_1c = NVReadRAMDAC(dev, head, 0x680c1c);
+	ctv_14 = NVReadRAMDAC(dev, head, 0x680c14);
+	ctv_6c = NVReadRAMDAC(dev, head, 0x680c6c);
+
+	/* Prepare the DAC for load detection.  */
+	nv17_gpio_set(dev, DCB_GPIO_TVDAC1, true);
+	nv17_gpio_set(dev, DCB_GPIO_TVDAC0, true);
+
+	NVWriteRAMDAC(dev, head, NV_PRAMDAC_FP_HTOTAL, 1343);
+	NVWriteRAMDAC(dev, head, NV_PRAMDAC_FP_HSYNC_START, 1047);
+	NVWriteRAMDAC(dev, head, NV_PRAMDAC_FP_HSYNC_END, 1183);
+	NVWriteRAMDAC(dev, head, NV_PRAMDAC_FP_TG_CONTROL,
+		      NV_PRAMDAC_FP_TG_CONTROL_DISPEN_POS |
+		      NV_PRAMDAC_FP_TG_CONTROL_WIDTH_12 |
+		      NV_PRAMDAC_FP_TG_CONTROL_READ_PROG |
+		      NV_PRAMDAC_FP_TG_CONTROL_HSYNC_POS |
+		      NV_PRAMDAC_FP_TG_CONTROL_VSYNC_POS);
+
+	NVWriteRAMDAC(dev, 0, NV_PRAMDAC_TEST_CONTROL + regoffset, 0);
+
+	NVWriteRAMDAC(dev, 0, NV_PRAMDAC_DACCLK + regoffset,
+		      (dacclk & ~0xff) | 0x22);
+	msleep(1);
+	NVWriteRAMDAC(dev, 0, NV_PRAMDAC_DACCLK + regoffset,
+		      (dacclk & ~0xff) | 0x21);
+
+	NVWriteRAMDAC(dev, head, 0x680c1c, 1 << 20);
+	NVWriteRAMDAC(dev, head, 0x680c14, 4 << 16);
+
+	/* Sample pin 0x4 (usually S-video luma). */
+	NVWriteRAMDAC(dev, head, 0x680c6c, testval >> 10 & 0x3ff);
+	msleep(20);
+	sample |= NVReadRAMDAC(dev, 0, NV_PRAMDAC_TEST_CONTROL + regoffset)
+		& 0x4 << 28;
+
+	/* Sample the remaining pins. */
+	NVWriteRAMDAC(dev, head, 0x680c6c, testval & 0x3ff);
+	msleep(20);
+	sample |= NVReadRAMDAC(dev, 0, NV_PRAMDAC_TEST_CONTROL + regoffset)
+		& 0xa << 28;
+
+	/* Restore the previous state. */
+	NVWriteRAMDAC(dev, head, 0x680c1c, ctv_1c);
+	NVWriteRAMDAC(dev, head, 0x680c14, ctv_14);
+	NVWriteRAMDAC(dev, head, 0x680c6c, ctv_6c);
+	NVWriteRAMDAC(dev, 0, NV_PRAMDAC_DACCLK + regoffset, dacclk);
+	NVWriteRAMDAC(dev, 0, NV_PRAMDAC_TEST_CONTROL + regoffset, test_ctrl);
+	NVWriteRAMDAC(dev, head, NV_PRAMDAC_FP_TG_CONTROL, fp_control);
+	NVWriteRAMDAC(dev, head, NV_PRAMDAC_FP_HSYNC_END, fp_hsync_end);
+	NVWriteRAMDAC(dev, head, NV_PRAMDAC_FP_HSYNC_START, fp_hsync_start);
+	NVWriteRAMDAC(dev, head, NV_PRAMDAC_FP_HTOTAL, fp_htotal);
+	nv17_gpio_set(dev, DCB_GPIO_TVDAC1, gpio1);
+	nv17_gpio_set(dev, DCB_GPIO_TVDAC0, gpio0);
+
+	return sample;
+}
+
+static enum drm_connector_status
+nv17_tv_detect(struct drm_encoder *encoder, struct drm_connector *connector)
+{
+	struct drm_device *dev = encoder->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct drm_mode_config *conf = &dev->mode_config;
+	struct nv17_tv_encoder *tv_enc = to_tv_enc(encoder);
+	struct dcb_entry *dcb = tv_enc->base.dcb;
+
+	if (dev_priv->chipset == 0x42 ||
+	    dev_priv->chipset == 0x43)
+		tv_enc->pin_mask = nv42_tv_sample_load(encoder) >> 28 & 0xe;
+	else
+		tv_enc->pin_mask = nv17_dac_sample_load(encoder) >> 28 & 0xe;
+
+	switch (tv_enc->pin_mask) {
+	case 0x2:
+	case 0x4:
+		tv_enc->subconnector = DRM_MODE_SUBCONNECTOR_Composite;
+		break;
+	case 0xc:
+		tv_enc->subconnector = DRM_MODE_SUBCONNECTOR_SVIDEO;
+		break;
+	case 0xe:
+		if (dcb->tvconf.has_component_output)
+			tv_enc->subconnector = DRM_MODE_SUBCONNECTOR_Component;
+		else
+			tv_enc->subconnector = DRM_MODE_SUBCONNECTOR_SCART;
+		break;
+	default:
+		tv_enc->subconnector = DRM_MODE_SUBCONNECTOR_Unknown;
+		break;
+	}
+
+	drm_connector_property_set_value(connector,
+					 conf->tv_subconnector_property,
+					 tv_enc->subconnector);
+
+	if (tv_enc->subconnector) {
+		NV_INFO(dev, "Load detected on output %c\n",
+			'@' + ffs(dcb->or));
+		return connector_status_connected;
+	} else {
+		return connector_status_disconnected;
+	}
+}
+
+static const struct {
+	int hdisplay;
+	int vdisplay;
+} modes[] = {
+	{ 640, 400 },
+	{ 640, 480 },
+	{ 720, 480 },
+	{ 720, 576 },
+	{ 800, 600 },
+	{ 1024, 768 },
+	{ 1280, 720 },
+	{ 1280, 1024 },
+	{ 1920, 1080 }
+};
+
+static int nv17_tv_get_modes(struct drm_encoder *encoder,
+			     struct drm_connector *connector)
+{
+	struct nv17_tv_norm_params *tv_norm = get_tv_norm(encoder);
+	struct drm_display_mode *mode;
+	struct drm_display_mode *output_mode;
+	int n = 0;
+	int i;
+
+	if (tv_norm->kind != CTV_ENC_MODE) {
+		struct drm_display_mode *tv_mode;
+
+		for (tv_mode = nv17_tv_modes; tv_mode->hdisplay; tv_mode++) {
+			mode = drm_mode_duplicate(encoder->dev, tv_mode);
+
+			mode->clock = tv_norm->tv_enc_mode.vrefresh *
+						mode->htotal / 1000 *
+						mode->vtotal / 1000;
+
+			if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
+				mode->clock *= 2;
+
+			if (mode->hdisplay == tv_norm->tv_enc_mode.hdisplay &&
+			    mode->vdisplay == tv_norm->tv_enc_mode.vdisplay)
+				mode->type |= DRM_MODE_TYPE_PREFERRED;
+
+			drm_mode_probed_add(connector, mode);
+			n++;
+		}
+		return n;
+	}
+
+	/* tv_norm->kind == CTV_ENC_MODE */
+	output_mode = &tv_norm->ctv_enc_mode.mode;
+	for (i = 0; i < ARRAY_SIZE(modes); i++) {
+		if (modes[i].hdisplay > output_mode->hdisplay ||
+		    modes[i].vdisplay > output_mode->vdisplay)
+			continue;
+
+		if (modes[i].hdisplay == output_mode->hdisplay &&
+		    modes[i].vdisplay == output_mode->vdisplay) {
+			mode = drm_mode_duplicate(encoder->dev, output_mode);
+			mode->type |= DRM_MODE_TYPE_PREFERRED;
+		} else {
+			mode = drm_cvt_mode(encoder->dev, modes[i].hdisplay,
+				modes[i].vdisplay, 60, false,
+				output_mode->flags & DRM_MODE_FLAG_INTERLACE,
+				false);
+		}
+
+		/* CVT modes are sometimes unsuitable... */
+		if (output_mode->hdisplay <= 720
+		    || output_mode->hdisplay >= 1920) {
+			mode->htotal = output_mode->htotal;
+			mode->hsync_start = (mode->hdisplay + (mode->htotal
+					     - mode->hdisplay) * 9 / 10) & ~7;
+			mode->hsync_end = mode->hsync_start + 8;
+		}
+		if (output_mode->vdisplay >= 1024) {
+			mode->vtotal = output_mode->vtotal;
+			mode->vsync_start = output_mode->vsync_start;
+			mode->vsync_end = output_mode->vsync_end;
+		}
+
+		mode->type |= DRM_MODE_TYPE_DRIVER;
+		drm_mode_probed_add(connector, mode);
+		n++;
+	}
+	return n;
+}
+
+static int nv17_tv_mode_valid(struct drm_encoder *encoder,
+			      struct drm_display_mode *mode)
+{
+	struct nv17_tv_norm_params *tv_norm = get_tv_norm(encoder);
+
+	if (tv_norm->kind == CTV_ENC_MODE) {
+		struct drm_display_mode *output_mode =
+						&tv_norm->ctv_enc_mode.mode;
+
+		if (mode->clock > 400000)
+			return MODE_CLOCK_HIGH;
+
+		if (mode->hdisplay > output_mode->hdisplay ||
+		    mode->vdisplay > output_mode->vdisplay)
+			return MODE_BAD;
+
+		if ((mode->flags & DRM_MODE_FLAG_INTERLACE) !=
+		    (output_mode->flags & DRM_MODE_FLAG_INTERLACE))
+			return MODE_NO_INTERLACE;
+
+		if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
+			return MODE_NO_DBLESCAN;
+
+	} else {
+		const int vsync_tolerance = 600;
+
+		if (mode->clock > 70000)
+			return MODE_CLOCK_HIGH;
+
+		if (abs(drm_mode_vrefresh(mode) * 1000 -
+			tv_norm->tv_enc_mode.vrefresh) > vsync_tolerance)
+			return MODE_VSYNC;
+
+		/* The encoder takes care of the actual interlacing */
+		if (mode->flags & DRM_MODE_FLAG_INTERLACE)
+			return MODE_NO_INTERLACE;
+	}
+
+	return MODE_OK;
+}
+
+static bool nv17_tv_mode_fixup(struct drm_encoder *encoder,
+			       struct drm_display_mode *mode,
+			       struct drm_display_mode *adjusted_mode)
+{
+	struct nv17_tv_norm_params *tv_norm = get_tv_norm(encoder);
+
+	if (tv_norm->kind == CTV_ENC_MODE)
+		adjusted_mode->clock = tv_norm->ctv_enc_mode.mode.clock;
+	else
+		adjusted_mode->clock = 90000;
+
+	return true;
+}
+
+static void  nv17_tv_dpms(struct drm_encoder *encoder, int mode)
+{
+	struct drm_device *dev = encoder->dev;
+	struct nv17_tv_state *regs = &to_tv_enc(encoder)->state;
+	struct nv17_tv_norm_params *tv_norm = get_tv_norm(encoder);
+
+	if (nouveau_encoder(encoder)->last_dpms == mode)
+		return;
+	nouveau_encoder(encoder)->last_dpms = mode;
+
+	NV_INFO(dev, "Setting dpms mode %d on TV encoder (output %d)\n",
+		 mode, nouveau_encoder(encoder)->dcb->index);
+
+	regs->ptv_200 &= ~1;
+
+	if (tv_norm->kind == CTV_ENC_MODE) {
+		nv04_dfp_update_fp_control(encoder, mode);
+
+	} else {
+		nv04_dfp_update_fp_control(encoder, DRM_MODE_DPMS_OFF);
+
+		if (mode == DRM_MODE_DPMS_ON)
+			regs->ptv_200 |= 1;
+	}
+
+	nv_load_ptv(dev, regs, 200);
+
+	nv17_gpio_set(dev, DCB_GPIO_TVDAC1, mode == DRM_MODE_DPMS_ON);
+	nv17_gpio_set(dev, DCB_GPIO_TVDAC0, mode == DRM_MODE_DPMS_ON);
+
+	nv04_dac_update_dacclk(encoder, mode == DRM_MODE_DPMS_ON);
+}
+
+static void nv17_tv_prepare(struct drm_encoder *encoder)
+{
+	struct drm_device *dev = encoder->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct drm_encoder_helper_funcs *helper = encoder->helper_private;
+	struct nv17_tv_norm_params *tv_norm = get_tv_norm(encoder);
+	int head = nouveau_crtc(encoder->crtc)->index;
+	uint8_t *cr_lcd = &dev_priv->mode_reg.crtc_reg[head].CRTC[
+							NV_CIO_CRE_LCD__INDEX];
+	uint32_t dacclk_off = NV_PRAMDAC_DACCLK +
+					nv04_dac_output_offset(encoder);
+	uint32_t dacclk;
+
+	helper->dpms(encoder, DRM_MODE_DPMS_OFF);
+
+	nv04_dfp_disable(dev, head);
+
+	/* Unbind any FP encoders from this head if we need the FP
+	 * stuff enabled. */
+	if (tv_norm->kind == CTV_ENC_MODE) {
+		struct drm_encoder *enc;
+
+		list_for_each_entry(enc, &dev->mode_config.encoder_list, head) {
+			struct dcb_entry *dcb = nouveau_encoder(enc)->dcb;
+
+			if ((dcb->type == OUTPUT_TMDS ||
+			     dcb->type == OUTPUT_LVDS) &&
+			     !enc->crtc &&
+			     nv04_dfp_get_bound_head(dev, dcb) == head) {
+				nv04_dfp_bind_head(dev, dcb, head ^ 1,
+						dev_priv->VBIOS.fp.dual_link);
+			}
+		}
+
+	}
+
+	/* Some NV4x have unknown values (0x3f, 0x50, 0x54, 0x6b, 0x79, 0x7f)
+	 * at LCD__INDEX which we don't alter
+	 */
+	if (!(*cr_lcd & 0x44)) {
+		if (tv_norm->kind == CTV_ENC_MODE)
+			*cr_lcd = 0x1 | (head ? 0x0 : 0x8);
+		else
+			*cr_lcd = 0;
+	}
+
+	/* Set the DACCLK register */
+	dacclk = (NVReadRAMDAC(dev, 0, dacclk_off) & ~0x30) | 0x1;
+
+	if (dev_priv->card_type == NV_40)
+		dacclk |= 0x1a << 16;
+
+	if (tv_norm->kind == CTV_ENC_MODE) {
+		dacclk |=  0x20;
+
+		if (head)
+			dacclk |= 0x100;
+		else
+			dacclk &= ~0x100;
+
+	} else {
+		dacclk |= 0x10;
+
+	}
+
+	NVWriteRAMDAC(dev, 0, dacclk_off, dacclk);
+}
+
+static void nv17_tv_mode_set(struct drm_encoder *encoder,
+			     struct drm_display_mode *drm_mode,
+			     struct drm_display_mode *adjusted_mode)
+{
+	struct drm_device *dev = encoder->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	int head = nouveau_crtc(encoder->crtc)->index;
+	struct nv04_crtc_reg *regs = &dev_priv->mode_reg.crtc_reg[head];
+	struct nv17_tv_state *tv_regs = &to_tv_enc(encoder)->state;
+	struct nv17_tv_norm_params *tv_norm = get_tv_norm(encoder);
+	int i;
+
+	regs->CRTC[NV_CIO_CRE_53] = 0x40; /* FP_HTIMING */
+	regs->CRTC[NV_CIO_CRE_54] = 0; /* FP_VTIMING */
+	regs->ramdac_630 = 0x2; /* turn off green mode (tv test pattern?) */
+	regs->tv_setup = 1;
+	regs->ramdac_8c0 = 0x0;
+
+	if (tv_norm->kind == TV_ENC_MODE) {
+		tv_regs->ptv_200 = 0x13111100;
+		if (head)
+			tv_regs->ptv_200 |= 0x10;
+
+		tv_regs->ptv_20c = 0x808010;
+		tv_regs->ptv_304 = 0x2d00000;
+		tv_regs->ptv_600 = 0x0;
+		tv_regs->ptv_60c = 0x0;
+		tv_regs->ptv_610 = 0x1e00000;
+
+		if (tv_norm->tv_enc_mode.vdisplay == 576) {
+			tv_regs->ptv_508 = 0x1200000;
+			tv_regs->ptv_614 = 0x33;
+
+		} else if (tv_norm->tv_enc_mode.vdisplay == 480) {
+			tv_regs->ptv_508 = 0xf00000;
+			tv_regs->ptv_614 = 0x13;
+		}
+
+		if (dev_priv->card_type >= NV_30) {
+			tv_regs->ptv_500 = 0xe8e0;
+			tv_regs->ptv_504 = 0x1710;
+			tv_regs->ptv_604 = 0x0;
+			tv_regs->ptv_608 = 0x0;
+		} else {
+			if (tv_norm->tv_enc_mode.vdisplay == 576) {
+				tv_regs->ptv_604 = 0x20;
+				tv_regs->ptv_608 = 0x10;
+				tv_regs->ptv_500 = 0x19710;
+				tv_regs->ptv_504 = 0x68f0;
+
+			} else if (tv_norm->tv_enc_mode.vdisplay == 480) {
+				tv_regs->ptv_604 = 0x10;
+				tv_regs->ptv_608 = 0x20;
+				tv_regs->ptv_500 = 0x4b90;
+				tv_regs->ptv_504 = 0x1b480;
+			}
+		}
+
+		for (i = 0; i < 0x40; i++)
+			tv_regs->tv_enc[i] = tv_norm->tv_enc_mode.tv_enc[i];
+
+	} else {
+		struct drm_display_mode *output_mode =
+						&tv_norm->ctv_enc_mode.mode;
+
+		/* The registers in PRAMDAC+0xc00 control some timings and CSC
+		 * parameters for the CTV encoder (It's only used for "HD" TV
+		 * modes, I don't think I have enough working to guess what
+		 * they exactly mean...), it's probably connected at the
+		 * output of the FP encoder, but it also needs the analog
+		 * encoder in its OR enabled and routed to the head it's
+		 * using. It's enabled with the DACCLK register, bits [5:4].
+		 */
+		for (i = 0; i < 38; i++)
+			regs->ctv_regs[i] = tv_norm->ctv_enc_mode.ctv_regs[i];
+
+		regs->fp_horiz_regs[FP_DISPLAY_END] = output_mode->hdisplay - 1;
+		regs->fp_horiz_regs[FP_TOTAL] = output_mode->htotal - 1;
+		regs->fp_horiz_regs[FP_SYNC_START] =
+						output_mode->hsync_start - 1;
+		regs->fp_horiz_regs[FP_SYNC_END] = output_mode->hsync_end - 1;
+		regs->fp_horiz_regs[FP_CRTC] = output_mode->hdisplay +
+			max((output_mode->hdisplay-600)/40 - 1, 1);
+
+		regs->fp_vert_regs[FP_DISPLAY_END] = output_mode->vdisplay - 1;
+		regs->fp_vert_regs[FP_TOTAL] = output_mode->vtotal - 1;
+		regs->fp_vert_regs[FP_SYNC_START] =
+						output_mode->vsync_start - 1;
+		regs->fp_vert_regs[FP_SYNC_END] = output_mode->vsync_end - 1;
+		regs->fp_vert_regs[FP_CRTC] = output_mode->vdisplay - 1;
+
+		regs->fp_control = NV_PRAMDAC_FP_TG_CONTROL_DISPEN_POS |
+			NV_PRAMDAC_FP_TG_CONTROL_READ_PROG |
+			NV_PRAMDAC_FP_TG_CONTROL_WIDTH_12;
+
+		if (output_mode->flags & DRM_MODE_FLAG_PVSYNC)
+			regs->fp_control |= NV_PRAMDAC_FP_TG_CONTROL_VSYNC_POS;
+		if (output_mode->flags & DRM_MODE_FLAG_PHSYNC)
+			regs->fp_control |= NV_PRAMDAC_FP_TG_CONTROL_HSYNC_POS;
+
+		regs->fp_debug_0 = NV_PRAMDAC_FP_DEBUG_0_YWEIGHT_ROUND |
+			NV_PRAMDAC_FP_DEBUG_0_XWEIGHT_ROUND |
+			NV_PRAMDAC_FP_DEBUG_0_YINTERP_BILINEAR |
+			NV_PRAMDAC_FP_DEBUG_0_XINTERP_BILINEAR |
+			NV_RAMDAC_FP_DEBUG_0_TMDS_ENABLED |
+			NV_PRAMDAC_FP_DEBUG_0_YSCALE_ENABLE |
+			NV_PRAMDAC_FP_DEBUG_0_XSCALE_ENABLE;
+
+		regs->fp_debug_2 = 0;
+
+		regs->fp_margin_color = 0x801080;
+
+	}
+}
+
+static void nv17_tv_commit(struct drm_encoder *encoder)
+{
+	struct drm_device *dev = encoder->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_crtc *nv_crtc = nouveau_crtc(encoder->crtc);
+	struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
+	struct drm_encoder_helper_funcs *helper = encoder->helper_private;
+
+	if (get_tv_norm(encoder)->kind == TV_ENC_MODE) {
+		nv17_tv_update_rescaler(encoder);
+		nv17_tv_update_properties(encoder);
+	} else {
+		nv17_ctv_update_rescaler(encoder);
+	}
+
+	nv17_tv_state_load(dev, &to_tv_enc(encoder)->state);
+
+	/* This could use refinement for flatpanels, but it should work */
+	if (dev_priv->chipset < 0x44)
+		NVWriteRAMDAC(dev, 0, NV_PRAMDAC_TEST_CONTROL +
+					nv04_dac_output_offset(encoder),
+					0xf0000000);
+	else
+		NVWriteRAMDAC(dev, 0, NV_PRAMDAC_TEST_CONTROL +
+					nv04_dac_output_offset(encoder),
+					0x00100000);
+
+	helper->dpms(encoder, DRM_MODE_DPMS_ON);
+
+	NV_INFO(dev, "Output %s is running on CRTC %d using output %c\n",
+		drm_get_connector_name(
+			&nouveau_encoder_connector_get(nv_encoder)->base),
+		nv_crtc->index, '@' + ffs(nv_encoder->dcb->or));
+}
+
+static void nv17_tv_save(struct drm_encoder *encoder)
+{
+	struct drm_device *dev = encoder->dev;
+	struct nv17_tv_encoder *tv_enc = to_tv_enc(encoder);
+
+	nouveau_encoder(encoder)->restore.output =
+					NVReadRAMDAC(dev, 0,
+					NV_PRAMDAC_DACCLK +
+					nv04_dac_output_offset(encoder));
+
+	nv17_tv_state_save(dev, &tv_enc->saved_state);
+
+	tv_enc->state.ptv_200 = tv_enc->saved_state.ptv_200;
+}
+
+static void nv17_tv_restore(struct drm_encoder *encoder)
+{
+	struct drm_device *dev = encoder->dev;
+
+	NVWriteRAMDAC(dev, 0, NV_PRAMDAC_DACCLK +
+				nv04_dac_output_offset(encoder),
+				nouveau_encoder(encoder)->restore.output);
+
+	nv17_tv_state_load(dev, &to_tv_enc(encoder)->saved_state);
+}
+
+static int nv17_tv_create_resources(struct drm_encoder *encoder,
+				    struct drm_connector *connector)
+{
+	struct drm_device *dev = encoder->dev;
+	struct drm_mode_config *conf = &dev->mode_config;
+	struct nv17_tv_encoder *tv_enc = to_tv_enc(encoder);
+	struct dcb_entry *dcb = nouveau_encoder(encoder)->dcb;
+	int num_tv_norms = dcb->tvconf.has_component_output ? NUM_TV_NORMS :
+							NUM_LD_TV_NORMS;
+	int i;
+
+	if (nouveau_tv_norm) {
+		for (i = 0; i < num_tv_norms; i++) {
+			if (!strcmp(nv17_tv_norm_names[i], nouveau_tv_norm)) {
+				tv_enc->tv_norm = i;
+				break;
+			}
+		}
+
+		if (i == num_tv_norms)
+			NV_WARN(dev, "Invalid TV norm setting \"%s\"\n",
+				nouveau_tv_norm);
+	}
+
+	drm_mode_create_tv_properties(dev, num_tv_norms, nv17_tv_norm_names);
+
+	drm_connector_attach_property(connector,
+					conf->tv_select_subconnector_property,
+					tv_enc->select_subconnector);
+	drm_connector_attach_property(connector,
+					conf->tv_subconnector_property,
+					tv_enc->subconnector);
+	drm_connector_attach_property(connector,
+					conf->tv_mode_property,
+					tv_enc->tv_norm);
+	drm_connector_attach_property(connector,
+					conf->tv_flicker_reduction_property,
+					tv_enc->flicker);
+	drm_connector_attach_property(connector,
+					conf->tv_saturation_property,
+					tv_enc->saturation);
+	drm_connector_attach_property(connector,
+					conf->tv_hue_property,
+					tv_enc->hue);
+	drm_connector_attach_property(connector,
+					conf->tv_overscan_property,
+					tv_enc->overscan);
+
+	return 0;
+}
+
+static int nv17_tv_set_property(struct drm_encoder *encoder,
+				struct drm_connector *connector,
+				struct drm_property *property,
+				uint64_t val)
+{
+	struct drm_mode_config *conf = &encoder->dev->mode_config;
+	struct drm_crtc *crtc = encoder->crtc;
+	struct nv17_tv_encoder *tv_enc = to_tv_enc(encoder);
+	struct nv17_tv_norm_params *tv_norm = get_tv_norm(encoder);
+	bool modes_changed = false;
+
+	if (property == conf->tv_overscan_property) {
+		tv_enc->overscan = val;
+		if (encoder->crtc) {
+			if (tv_norm->kind == CTV_ENC_MODE)
+				nv17_ctv_update_rescaler(encoder);
+			else
+				nv17_tv_update_rescaler(encoder);
+		}
+
+	} else if (property == conf->tv_saturation_property) {
+		if (tv_norm->kind != TV_ENC_MODE)
+			return -EINVAL;
+
+		tv_enc->saturation = val;
+		nv17_tv_update_properties(encoder);
+
+	} else if (property == conf->tv_hue_property) {
+		if (tv_norm->kind != TV_ENC_MODE)
+			return -EINVAL;
+
+		tv_enc->hue = val;
+		nv17_tv_update_properties(encoder);
+
+	} else if (property == conf->tv_flicker_reduction_property) {
+		if (tv_norm->kind != TV_ENC_MODE)
+			return -EINVAL;
+
+		tv_enc->flicker = val;
+		if (encoder->crtc)
+			nv17_tv_update_rescaler(encoder);
+
+	} else if (property == conf->tv_mode_property) {
+		if (connector->dpms != DRM_MODE_DPMS_OFF)
+			return -EINVAL;
+
+		tv_enc->tv_norm = val;
+
+		modes_changed = true;
+
+	} else if (property == conf->tv_select_subconnector_property) {
+		if (tv_norm->kind != TV_ENC_MODE)
+			return -EINVAL;
+
+		tv_enc->select_subconnector = val;
+		nv17_tv_update_properties(encoder);
+
+	} else {
+		return -EINVAL;
+	}
+
+	if (modes_changed) {
+		drm_helper_probe_single_connector_modes(connector, 0, 0);
+
+		/* Disable the crtc to ensure a full modeset is
+		 * performed whenever it's turned on again. */
+		if (crtc) {
+			struct drm_mode_set modeset = {
+				.crtc = crtc,
+			};
+
+			crtc->funcs->set_config(&modeset);
+		}
+	}
+
+	return 0;
+}
+
+static void nv17_tv_destroy(struct drm_encoder *encoder)
+{
+	struct nv17_tv_encoder *tv_enc = to_tv_enc(encoder);
+
+	NV_DEBUG_KMS(encoder->dev, "\n");
+
+	drm_encoder_cleanup(encoder);
+	kfree(tv_enc);
+}
+
+static struct drm_encoder_helper_funcs nv17_tv_helper_funcs = {
+	.dpms = nv17_tv_dpms,
+	.save = nv17_tv_save,
+	.restore = nv17_tv_restore,
+	.mode_fixup = nv17_tv_mode_fixup,
+	.prepare = nv17_tv_prepare,
+	.commit = nv17_tv_commit,
+	.mode_set = nv17_tv_mode_set,
+	.detect = nv17_tv_detect,
+};
+
+static struct drm_encoder_slave_funcs nv17_tv_slave_funcs = {
+	.get_modes = nv17_tv_get_modes,
+	.mode_valid = nv17_tv_mode_valid,
+	.create_resources = nv17_tv_create_resources,
+	.set_property = nv17_tv_set_property,
+};
+
+static struct drm_encoder_funcs nv17_tv_funcs = {
+	.destroy = nv17_tv_destroy,
+};
+
+int nv17_tv_create(struct drm_device *dev, struct dcb_entry *entry)
+{
+	struct drm_encoder *encoder;
+	struct nv17_tv_encoder *tv_enc = NULL;
+
+	tv_enc = kzalloc(sizeof(*tv_enc), GFP_KERNEL);
+	if (!tv_enc)
+		return -ENOMEM;
+
+	tv_enc->overscan = 50;
+	tv_enc->flicker = 50;
+	tv_enc->saturation = 50;
+	tv_enc->hue = 0;
+	tv_enc->tv_norm = TV_NORM_PAL;
+	tv_enc->subconnector = DRM_MODE_SUBCONNECTOR_Unknown;
+	tv_enc->select_subconnector = DRM_MODE_SUBCONNECTOR_Automatic;
+	tv_enc->pin_mask = 0;
+
+	encoder = to_drm_encoder(&tv_enc->base);
+
+	tv_enc->base.dcb = entry;
+	tv_enc->base.or = ffs(entry->or) - 1;
+
+	drm_encoder_init(dev, encoder, &nv17_tv_funcs, DRM_MODE_ENCODER_TVDAC);
+	drm_encoder_helper_add(encoder, &nv17_tv_helper_funcs);
+	to_encoder_slave(encoder)->slave_funcs = &nv17_tv_slave_funcs;
+
+	encoder->possible_crtcs = entry->heads;
+	encoder->possible_clones = 0;
+
+	return 0;
+}
diff --git a/drivers/gpu/drm/nouveau/nv17_tv.h b/drivers/gpu/drm/nouveau/nv17_tv.h
new file mode 100644
index 000000000000..c00977cedabd
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nv17_tv.h
@@ -0,0 +1,156 @@
+/*
+ * Copyright (C) 2009 Francisco Jerez.
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial
+ * portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE COPYRIGHT OWNER(S) AND/OR ITS SUPPLIERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
+#ifndef __NV17_TV_H__
+#define __NV17_TV_H__
+
+struct nv17_tv_state {
+	uint8_t tv_enc[0x40];
+
+	uint32_t hfilter[4][7];
+	uint32_t hfilter2[4][7];
+	uint32_t vfilter[4][7];
+
+	uint32_t ptv_200;
+	uint32_t ptv_204;
+	uint32_t ptv_208;
+	uint32_t ptv_20c;
+	uint32_t ptv_304;
+	uint32_t ptv_500;
+	uint32_t ptv_504;
+	uint32_t ptv_508;
+	uint32_t ptv_600;
+	uint32_t ptv_604;
+	uint32_t ptv_608;
+	uint32_t ptv_60c;
+	uint32_t ptv_610;
+	uint32_t ptv_614;
+};
+
+enum nv17_tv_norm{
+	TV_NORM_PAL,
+	TV_NORM_PAL_M,
+	TV_NORM_PAL_N,
+	TV_NORM_PAL_NC,
+	TV_NORM_NTSC_M,
+	TV_NORM_NTSC_J,
+	NUM_LD_TV_NORMS,
+	TV_NORM_HD480I = NUM_LD_TV_NORMS,
+	TV_NORM_HD480P,
+	TV_NORM_HD576I,
+	TV_NORM_HD576P,
+	TV_NORM_HD720P,
+	TV_NORM_HD1080I,
+	NUM_TV_NORMS
+};
+
+struct nv17_tv_encoder {
+	struct nouveau_encoder base;
+
+	struct nv17_tv_state state;
+	struct nv17_tv_state saved_state;
+
+	int overscan;
+	int flicker;
+	int saturation;
+	int hue;
+	enum nv17_tv_norm tv_norm;
+	int subconnector;
+	int select_subconnector;
+	uint32_t pin_mask;
+};
+#define to_tv_enc(x) container_of(nouveau_encoder(x),		\
+				  struct nv17_tv_encoder, base)
+
+extern char *nv17_tv_norm_names[NUM_TV_NORMS];
+
+extern struct nv17_tv_norm_params {
+	enum {
+		TV_ENC_MODE,
+		CTV_ENC_MODE,
+	} kind;
+
+	union {
+		struct {
+			int hdisplay;
+			int vdisplay;
+			int vrefresh; /* mHz */
+
+			uint8_t tv_enc[0x40];
+		} tv_enc_mode;
+
+		struct {
+			struct drm_display_mode mode;
+
+			uint32_t ctv_regs[38];
+		} ctv_enc_mode;
+	};
+
+} nv17_tv_norms[NUM_TV_NORMS];
+#define get_tv_norm(enc) (&nv17_tv_norms[to_tv_enc(enc)->tv_norm])
+
+extern struct drm_display_mode nv17_tv_modes[];
+
+static inline int interpolate(int y0, int y1, int y2, int x)
+{
+	return y1 + (x < 50 ? y1 - y0 : y2 - y1) * (x - 50) / 50;
+}
+
+void nv17_tv_state_save(struct drm_device *dev, struct nv17_tv_state *state);
+void nv17_tv_state_load(struct drm_device *dev, struct nv17_tv_state *state);
+void nv17_tv_update_properties(struct drm_encoder *encoder);
+void nv17_tv_update_rescaler(struct drm_encoder *encoder);
+void nv17_ctv_update_rescaler(struct drm_encoder *encoder);
+
+/* TV hardware access functions */
+
+static inline void nv_write_ptv(struct drm_device *dev, uint32_t reg, uint32_t val)
+{
+	nv_wr32(dev, reg, val);
+}
+
+static inline uint32_t nv_read_ptv(struct drm_device *dev, uint32_t reg)
+{
+	return nv_rd32(dev, reg);
+}
+
+static inline void nv_write_tv_enc(struct drm_device *dev, uint8_t reg, uint8_t val)
+{
+	nv_write_ptv(dev, NV_PTV_TV_INDEX, reg);
+	nv_write_ptv(dev, NV_PTV_TV_DATA, val);
+}
+
+static inline uint8_t nv_read_tv_enc(struct drm_device *dev, uint8_t reg)
+{
+	nv_write_ptv(dev, NV_PTV_TV_INDEX, reg);
+	return nv_read_ptv(dev, NV_PTV_TV_DATA);
+}
+
+#define nv_load_ptv(dev, state, reg) nv_write_ptv(dev, NV_PTV_OFFSET + 0x##reg, state->ptv_##reg)
+#define nv_save_ptv(dev, state, reg) state->ptv_##reg = nv_read_ptv(dev, NV_PTV_OFFSET + 0x##reg)
+#define nv_load_tv_enc(dev, state, reg) nv_write_tv_enc(dev, 0x##reg, state->tv_enc[0x##reg])
+
+#endif
diff --git a/drivers/gpu/drm/nouveau/nv17_tv_modes.c b/drivers/gpu/drm/nouveau/nv17_tv_modes.c
new file mode 100644
index 000000000000..d64683d97e0d
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nv17_tv_modes.c
@@ -0,0 +1,583 @@
+/*
+ * Copyright (C) 2009 Francisco Jerez.
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial
+ * portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE COPYRIGHT OWNER(S) AND/OR ITS SUPPLIERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
+#include "drmP.h"
+#include "drm_crtc_helper.h"
+#include "nouveau_drv.h"
+#include "nouveau_encoder.h"
+#include "nouveau_crtc.h"
+#include "nouveau_hw.h"
+#include "nv17_tv.h"
+
+char *nv17_tv_norm_names[NUM_TV_NORMS] = {
+	[TV_NORM_PAL] = "PAL",
+	[TV_NORM_PAL_M] = "PAL-M",
+	[TV_NORM_PAL_N] = "PAL-N",
+	[TV_NORM_PAL_NC] = "PAL-Nc",
+	[TV_NORM_NTSC_M] = "NTSC-M",
+	[TV_NORM_NTSC_J] = "NTSC-J",
+	[TV_NORM_HD480I] = "hd480i",
+	[TV_NORM_HD480P] = "hd480p",
+	[TV_NORM_HD576I] = "hd576i",
+	[TV_NORM_HD576P] = "hd576p",
+	[TV_NORM_HD720P] = "hd720p",
+	[TV_NORM_HD1080I] = "hd1080i"
+};
+
+/* TV standard specific parameters */
+
+struct nv17_tv_norm_params nv17_tv_norms[NUM_TV_NORMS] = {
+	[TV_NORM_PAL] = { TV_ENC_MODE, {
+			.tv_enc_mode = { 720, 576, 50000, {
+					0x2a, 0x9, 0x8a, 0xcb, 0x0, 0x0, 0xb, 0x18,
+					0x7e, 0x40, 0x8a, 0x35, 0x27, 0x0, 0x34, 0x3,
+					0x3e, 0x3, 0x17, 0x21, 0x1b, 0x1b, 0x24, 0x9c,
+					0x1, 0x0, 0xf, 0xf, 0x60, 0x5, 0xd3, 0x3,
+					0xd3, 0x4, 0xd4, 0x1, 0x2, 0x0, 0xa, 0x5,
+					0x0, 0x1a, 0xff, 0x3, 0x18, 0xf, 0x78, 0x0,
+					0x0, 0xb4, 0x0, 0x15, 0x49, 0x10, 0x0, 0x9b,
+					0xbd, 0x15, 0x5, 0x15, 0x3e, 0x3, 0x0, 0x0
+				} } } },
+
+	[TV_NORM_PAL_M] = { TV_ENC_MODE, {
+			.tv_enc_mode = { 720, 480, 59940, {
+					0x21, 0xe6, 0xef, 0xe3, 0x0, 0x0, 0xb, 0x18,
+					0x7e, 0x44, 0x76, 0x32, 0x25, 0x0, 0x3c, 0x0,
+					0x3c, 0x0, 0x17, 0x21, 0x1b, 0x1b, 0x24, 0x83,
+					0x1, 0x0, 0xf, 0xf, 0x60, 0x5, 0xd3, 0x1,
+					0xc5, 0x4, 0xc5, 0x1, 0x2, 0x0, 0xa, 0x5,
+					0x0, 0x18, 0xff, 0x3, 0x20, 0xf, 0x78, 0x0,
+					0x0, 0xb4, 0x0, 0x15, 0x40, 0x10, 0x0, 0x9c,
+					0xc8, 0x15, 0x5, 0x15, 0x3c, 0x0, 0x0, 0x0
+				} } } },
+
+	[TV_NORM_PAL_N] = { TV_ENC_MODE, {
+			.tv_enc_mode = { 720, 576, 50000, {
+					0x2a, 0x9, 0x8a, 0xcb, 0x0, 0x0, 0xb, 0x18,
+					0x7e, 0x40, 0x8a, 0x32, 0x25, 0x0, 0x3c, 0x0,
+					0x3c, 0x0, 0x17, 0x21, 0x1b, 0x1b, 0x24, 0x9c,
+					0x1, 0x0, 0xf, 0xf, 0x60, 0x5, 0xd3, 0x1,
+					0xc5, 0x4, 0xc5, 0x1, 0x2, 0x0, 0xa, 0x5,
+					0x0, 0x1a, 0xff, 0x3, 0x18, 0xf, 0x78, 0x0,
+					0x0, 0xb4, 0x0, 0x15, 0x49, 0x10, 0x0, 0x9b,
+					0xbd, 0x15, 0x5, 0x15, 0x3c, 0x0, 0x0, 0x0
+				} } } },
+
+	[TV_NORM_PAL_NC] = { TV_ENC_MODE, {
+			.tv_enc_mode = { 720, 576, 50000, {
+					0x21, 0xf6, 0x94, 0x46, 0x0, 0x0, 0xb, 0x18,
+					0x7e, 0x44, 0x8a, 0x35, 0x27, 0x0, 0x34, 0x3,
+					0x3e, 0x3, 0x17, 0x21, 0x1b, 0x1b, 0x24, 0x9c,
+					0x1, 0x0, 0xf, 0xf, 0x60, 0x5, 0xd3, 0x3,
+					0xd3, 0x4, 0xd4, 0x1, 0x2, 0x0, 0xa, 0x5,
+					0x0, 0x1a, 0xff, 0x3, 0x18, 0xf, 0x78, 0x0,
+					0x0, 0xb4, 0x0, 0x15, 0x49, 0x10, 0x0, 0x9b,
+					0xbd, 0x15, 0x5, 0x15, 0x3e, 0x3, 0x0, 0x0
+				} } } },
+
+	[TV_NORM_NTSC_M] = { TV_ENC_MODE, {
+			.tv_enc_mode = { 720, 480, 59940, {
+					0x21, 0xf0, 0x7c, 0x1f, 0x0, 0x0, 0xb, 0x18,
+					0x7e, 0x44, 0x76, 0x48, 0x0, 0x0, 0x3c, 0x0,
+					0x3c, 0x0, 0x17, 0x21, 0x1b, 0x1b, 0x24, 0x83,
+					0x1, 0x0, 0xf, 0xf, 0x60, 0x5, 0xd3, 0x1,
+					0xc5, 0x4, 0xc5, 0x1, 0x2, 0x0, 0xa, 0x5,
+					0x0, 0x16, 0xff, 0x3, 0x20, 0xf, 0x78, 0x0,
+					0x0, 0xb4, 0x0, 0x15, 0x4, 0x10, 0x0, 0x9c,
+					0xc8, 0x15, 0x5, 0x15, 0x3c, 0x0, 0x0, 0x0
+				} } } },
+
+	[TV_NORM_NTSC_J] = { TV_ENC_MODE, {
+			.tv_enc_mode = { 720, 480, 59940, {
+					0x21, 0xf0, 0x7c, 0x1f, 0x0, 0x0, 0xb, 0x18,
+					0x7e, 0x44, 0x76, 0x48, 0x0, 0x0, 0x32, 0x0,
+					0x3c, 0x0, 0x17, 0x21, 0x1b, 0x1b, 0x24, 0x83,
+					0x1, 0x0, 0xf, 0xf, 0x60, 0x5, 0xd3, 0x1,
+					0xcf, 0x4, 0xcf, 0x1, 0x2, 0x0, 0xa, 0x5,
+					0x0, 0x16, 0xff, 0x3, 0x20, 0xf, 0x78, 0x0,
+					0x0, 0xb4, 0x0, 0x15, 0x4, 0x10, 0x0, 0xa4,
+					0xc8, 0x15, 0x5, 0x15, 0x3c, 0x0, 0x0, 0x0
+				} } } },
+
+	[TV_NORM_HD480I] = { TV_ENC_MODE, {
+			.tv_enc_mode = { 720, 480, 59940, {
+					0x21, 0xf0, 0x7c, 0x1f, 0x0, 0x0, 0xb, 0x18,
+					0x7e, 0x44, 0x76, 0x48, 0x0, 0x0, 0x32, 0x0,
+					0x3c, 0x0, 0x17, 0x21, 0x1b, 0x1b, 0x24, 0x83,
+					0x1, 0x0, 0xf, 0xf, 0x60, 0x5, 0xd3, 0x1,
+					0xcf, 0x4, 0xcf, 0x1, 0x2, 0x0, 0xa, 0x5,
+					0x0, 0x16, 0xff, 0x3, 0x20, 0xf, 0x78, 0x0,
+					0x0, 0xb4, 0x0, 0x15, 0x4, 0x10, 0x0, 0xa4,
+					0xc8, 0x15, 0x5, 0x15, 0x3c, 0x0, 0x0, 0x0
+				} } } },
+
+	[TV_NORM_HD576I] = { TV_ENC_MODE, {
+			.tv_enc_mode = { 720, 576, 50000, {
+					0x2a, 0x9, 0x8a, 0xcb, 0x0, 0x0, 0xb, 0x18,
+					0x7e, 0x40, 0x8a, 0x35, 0x27, 0x0, 0x34, 0x3,
+					0x3e, 0x3, 0x17, 0x21, 0x1b, 0x1b, 0x24, 0x9c,
+					0x1, 0x0, 0xf, 0xf, 0x60, 0x5, 0xd3, 0x3,
+					0xd3, 0x4, 0xd4, 0x1, 0x2, 0x0, 0xa, 0x5,
+					0x0, 0x1a, 0xff, 0x3, 0x18, 0xf, 0x78, 0x0,
+					0x0, 0xb4, 0x0, 0x15, 0x49, 0x10, 0x0, 0x9b,
+					0xbd, 0x15, 0x5, 0x15, 0x3e, 0x3, 0x0, 0x0
+				} } } },
+
+
+	[TV_NORM_HD480P] = { CTV_ENC_MODE, {
+			.ctv_enc_mode = {
+				.mode = { DRM_MODE("720x480", DRM_MODE_TYPE_DRIVER, 27000,
+						   720, 735, 743, 858, 0, 480, 490, 494, 525, 0,
+						   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+				.ctv_regs = { 0x3540000, 0x0, 0x0, 0x314,
+					      0x354003a, 0x40000, 0x6f0344, 0x18100000,
+					      0x10160004, 0x10060005, 0x1006000c, 0x10060020,
+					      0x10060021, 0x140e0022, 0x10060202, 0x1802020a,
+					      0x1810020b, 0x10000fff, 0x10000fff, 0x10000fff,
+					      0x10000fff, 0x10000fff, 0x10000fff, 0x70,
+					      0x3ff0000, 0x57, 0x2e001e, 0x258012c,
+					      0xa0aa04ec, 0x30, 0x80960019, 0x12c0300,
+					      0x2019, 0x600, 0x32060019, 0x0, 0x0, 0x400
+				} } } },
+
+	[TV_NORM_HD576P] = { CTV_ENC_MODE, {
+			.ctv_enc_mode = {
+				.mode = { DRM_MODE("720x576", DRM_MODE_TYPE_DRIVER, 27000,
+						   720, 730, 738, 864, 0, 576, 581, 585, 625, 0,
+						   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+				.ctv_regs = { 0x3540000, 0x0, 0x0, 0x314,
+					      0x354003a, 0x40000, 0x6f0344, 0x18100000,
+					      0x10060001, 0x10060009, 0x10060026, 0x10060027,
+					      0x140e0028, 0x10060268, 0x1810026d, 0x10000fff,
+					      0x10000fff, 0x10000fff, 0x10000fff, 0x10000fff,
+					      0x10000fff, 0x10000fff, 0x10000fff, 0x69,
+					      0x3ff0000, 0x57, 0x2e001e, 0x258012c,
+					      0xa0aa04ec, 0x30, 0x80960019, 0x12c0300,
+					      0x2019, 0x600, 0x32060019, 0x0, 0x0, 0x400
+				} } } },
+
+	[TV_NORM_HD720P] = { CTV_ENC_MODE, {
+			.ctv_enc_mode = {
+				.mode = { DRM_MODE("1280x720", DRM_MODE_TYPE_DRIVER, 74250,
+						   1280, 1349, 1357, 1650, 0, 720, 725, 730, 750, 0,
+						   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+				.ctv_regs = { 0x1260394, 0x0, 0x0, 0x622,
+					      0x66b0021, 0x6004a, 0x1210626, 0x8170000,
+					      0x70004, 0x70016, 0x70017, 0x40f0018,
+					      0x702e8, 0x81702ed, 0xfff, 0xfff,
+					      0xfff, 0xfff, 0xfff, 0xfff,
+					      0xfff, 0xfff, 0xfff, 0x0,
+					      0x2e40001, 0x58, 0x2e001e, 0x258012c,
+					      0xa0aa04ec, 0x30, 0x810c0039, 0x12c0300,
+					      0xc0002039, 0x600, 0x32060039, 0x0, 0x0, 0x0
+				} } } },
+
+	[TV_NORM_HD1080I] = { CTV_ENC_MODE, {
+			.ctv_enc_mode = {
+				.mode = { DRM_MODE("1920x1080", DRM_MODE_TYPE_DRIVER, 74250,
+						   1920, 1961, 2049, 2200, 0, 1080, 1084, 1088, 1125, 0,
+						   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC
+						   | DRM_MODE_FLAG_INTERLACE) },
+				.ctv_regs = { 0xac0420, 0x44c0478, 0x4a4, 0x4fc0868,
+					      0x8940028, 0x60054, 0xe80870, 0xbf70000,
+					      0xbc70004, 0x70005, 0x70012, 0x70013,
+					      0x40f0014, 0x70230, 0xbf70232, 0xbf70233,
+					      0x1c70237, 0x70238, 0x70244, 0x70245,
+					      0x40f0246, 0x70462, 0x1f70464, 0x0,
+					      0x2e40001, 0x58, 0x2e001e, 0x258012c,
+					      0xa0aa04ec, 0x30, 0x815f004c, 0x12c0300,
+					      0xc000204c, 0x600, 0x3206004c, 0x0, 0x0, 0x0
+				} } } }
+};
+
+/*
+ * The following is some guesswork on how the TV encoder flicker
+ * filter/rescaler works:
+ *
+ * It seems to use some sort of resampling filter, it is controlled
+ * through the registers at NV_PTV_HFILTER and NV_PTV_VFILTER, they
+ * control the horizontal and vertical stage respectively, there is
+ * also NV_PTV_HFILTER2 the blob fills identically to NV_PTV_HFILTER,
+ * but they seem to do nothing. A rough guess might be that they could
+ * be used to independently control the filtering of each interlaced
+ * field, but I don't know how they are enabled. The whole filtering
+ * process seems to be disabled with bits 26:27 of PTV_200, but we
+ * aren't doing that.
+ *
+ * The layout of both register sets is the same:
+ *
+ * A: [BASE+0x18]...[BASE+0x0] [BASE+0x58]..[BASE+0x40]
+ * B: [BASE+0x34]...[BASE+0x1c] [BASE+0x74]..[BASE+0x5c]
+ *
+ * Each coefficient is stored in bits [31],[15:9] in two's complement
+ * format. They seem to be some kind of weights used in a low-pass
+ * filter. Both A and B coefficients are applied to the 14 nearest
+ * samples on each side (Listed from nearest to furthermost.  They
+ * roughly cover 2 framebuffer pixels on each side).  They are
+ * probably multiplied with some more hardwired weights before being
+ * used: B-coefficients are applied the same on both sides,
+ * A-coefficients are inverted before being applied to the opposite
+ * side.
+ *
+ * After all the hassle, I got the following formula by empirical
+ * means...
+ */
+
+#define calc_overscan(o) interpolate(0x100, 0xe1, 0xc1, o)
+
+#define id1 (1LL << 8)
+#define id2 (1LL << 16)
+#define id3 (1LL << 24)
+#define id4 (1LL << 32)
+#define id5 (1LL << 48)
+
+static struct filter_params{
+	int64_t k1;
+	int64_t ki;
+	int64_t ki2;
+	int64_t ki3;
+	int64_t kr;
+	int64_t kir;
+	int64_t ki2r;
+	int64_t ki3r;
+	int64_t kf;
+	int64_t kif;
+	int64_t ki2f;
+	int64_t ki3f;
+	int64_t krf;
+	int64_t kirf;
+	int64_t ki2rf;
+	int64_t ki3rf;
+} fparams[2][4] = {
+	/* Horizontal filter parameters */
+	{
+		{64.311690 * id5, -39.516924 * id5, 6.586143 * id5, 0.000002 * id5,
+		 0.051285 * id4, 26.168746 * id4, -4.361449 * id4, -0.000001 * id4,
+		 9.308169 * id3, 78.180965 * id3, -13.030158 * id3, -0.000001 * id3,
+		 -8.801540 * id1, -46.572890 * id1, 7.762145 * id1, -0.000000 * id1},
+		{-44.565569 * id5, -68.081246 * id5, 39.812074 * id5, -4.009316 * id5,
+		 29.832207 * id4, 50.047322 * id4, -25.380017 * id4, 2.546422 * id4,
+		 104.605622 * id3, 141.908641 * id3, -74.322319 * id3, 7.484316 * id3,
+		 -37.081621 * id1, -90.397510 * id1, 42.784229 * id1, -4.289952 * id1},
+		{-56.793244 * id5, 31.153584 * id5, -5.192247 * id5, -0.000003 * id5,
+		 33.541131 * id4, -34.149302 * id4, 5.691537 * id4, 0.000002 * id4,
+		 87.196610 * id3, -88.995169 * id3, 14.832456 * id3, 0.000012 * id3,
+		 17.288138 * id1, 71.864786 * id1, -11.977408 * id1, -0.000009 * id1},
+		{51.787796 * id5, 21.211771 * id5, -18.993730 * id5, 1.853310 * id5,
+		 -41.470726 * id4, -17.775823 * id4, 13.057821 * id4, -1.15823 * id4,
+		 -154.235673 * id3, -44.878641 * id3, 40.656077 * id3, -3.695595 * id3,
+		 112.201065 * id1, 39.992155 * id1, -25.155714 * id1, 2.113984 * id1},
+	},
+
+	/* Vertical filter parameters */
+	{
+		{67.601979 * id5, 0.428319 * id5, -0.071318 * id5, -0.000012 * id5,
+		 -3.402339 * id4, 0.000209 * id4, -0.000092 * id4, 0.000010 * id4,
+		 -9.180996 * id3, 6.111270 * id3, -1.024457 * id3, 0.001043 * id3,
+		 6.060315 * id1, -0.017425 * id1, 0.007830 * id1, -0.000869 * id1},
+		{6.755647 * id5, 5.841348 * id5, 1.469734 * id5, -0.149656 * id5,
+		 8.293120 * id4, -1.192888 * id4, -0.947652 * id4, 0.094507 * id4,
+		 37.526655 * id3, 10.257875 * id3, -10.823275 * id3, 1.081497 * id3,
+		 -2.361928 * id1, -2.059432 * id1, 1.840671 * id1, -0.168100 * id1},
+		{-14.780391 * id5, -16.042148 * id5, 2.673692 * id5, -0.000000 * id5,
+		 39.541978 * id4, 5.680053 * id4, -0.946676 * id4, 0.000000 * id4,
+		 152.994486 * id3, 12.625439 * id3, -2.119579 * id3, 0.002708 * id3,
+		 -38.125089 * id1, -0.855880 * id1, 0.155359 * id1, -0.002245 * id1},
+		{-27.476193 * id5, -1.454976 * id5, 1.286557 * id5, 0.025346 * id5,
+		 20.687300 * id4, 3.014003 * id4, -0.557786 * id4, -0.01311 * id4,
+		 60.008737 * id3, -0.738273 * id3, 5.408217 * id3, -0.796798 * id3,
+		 -17.296835 * id1, 4.438577 * id1, -2.809420 * id1, 0.385491 * id1},
+	}
+};
+
+static void tv_setup_filter(struct drm_encoder *encoder)
+{
+	struct nv17_tv_encoder *tv_enc = to_tv_enc(encoder);
+	struct nv17_tv_norm_params *tv_norm = get_tv_norm(encoder);
+	struct drm_display_mode *mode = &encoder->crtc->mode;
+	uint32_t (*filters[])[4][7] = {&tv_enc->state.hfilter,
+				       &tv_enc->state.vfilter};
+	int i, j, k;
+	int32_t overscan = calc_overscan(tv_enc->overscan);
+	int64_t flicker = (tv_enc->flicker - 50) * (id3 / 100);
+	uint64_t rs[] = {mode->hdisplay * id3,
+			 mode->vdisplay * id3};
+
+	do_div(rs[0], overscan * tv_norm->tv_enc_mode.hdisplay);
+	do_div(rs[1], overscan * tv_norm->tv_enc_mode.vdisplay);
+
+	for (k = 0; k < 2; k++) {
+		rs[k] = max((int64_t)rs[k], id2);
+
+		for (j = 0; j < 4; j++) {
+			struct filter_params *p = &fparams[k][j];
+
+			for (i = 0; i < 7; i++) {
+				int64_t c = (p->k1 + p->ki*i + p->ki2*i*i + p->ki3*i*i*i)
+					+ (p->kr + p->kir*i + p->ki2r*i*i + p->ki3r*i*i*i)*rs[k]
+					+ (p->kf + p->kif*i + p->ki2f*i*i + p->ki3f*i*i*i)*flicker
+					+ (p->krf + p->kirf*i + p->ki2rf*i*i + p->ki3rf*i*i*i)*flicker*rs[k];
+
+				(*filters[k])[j][i] = (c + id5/2) >> 39 & (0x1 << 31 | 0x7f << 9);
+			}
+		}
+	}
+}
+
+/* Hardware state saving/restoring */
+
+static void tv_save_filter(struct drm_device *dev, uint32_t base, uint32_t regs[4][7])
+{
+	int i, j;
+	uint32_t offsets[] = { base, base + 0x1c, base + 0x40, base + 0x5c };
+
+	for (i = 0; i < 4; i++) {
+		for (j = 0; j < 7; j++)
+			regs[i][j] = nv_read_ptv(dev, offsets[i]+4*j);
+	}
+}
+
+static void tv_load_filter(struct drm_device *dev, uint32_t base, uint32_t regs[4][7])
+{
+	int i, j;
+	uint32_t offsets[] = { base, base + 0x1c, base + 0x40, base + 0x5c };
+
+	for (i = 0; i < 4; i++) {
+		for (j = 0; j < 7; j++)
+			nv_write_ptv(dev, offsets[i]+4*j, regs[i][j]);
+	}
+}
+
+void nv17_tv_state_save(struct drm_device *dev, struct nv17_tv_state *state)
+{
+	int i;
+
+	for (i = 0; i < 0x40; i++)
+		state->tv_enc[i] = nv_read_tv_enc(dev, i);
+
+	tv_save_filter(dev, NV_PTV_HFILTER, state->hfilter);
+	tv_save_filter(dev, NV_PTV_HFILTER2, state->hfilter2);
+	tv_save_filter(dev, NV_PTV_VFILTER, state->vfilter);
+
+	nv_save_ptv(dev, state, 200);
+	nv_save_ptv(dev, state, 204);
+	nv_save_ptv(dev, state, 208);
+	nv_save_ptv(dev, state, 20c);
+	nv_save_ptv(dev, state, 304);
+	nv_save_ptv(dev, state, 500);
+	nv_save_ptv(dev, state, 504);
+	nv_save_ptv(dev, state, 508);
+	nv_save_ptv(dev, state, 600);
+	nv_save_ptv(dev, state, 604);
+	nv_save_ptv(dev, state, 608);
+	nv_save_ptv(dev, state, 60c);
+	nv_save_ptv(dev, state, 610);
+	nv_save_ptv(dev, state, 614);
+}
+
+void nv17_tv_state_load(struct drm_device *dev, struct nv17_tv_state *state)
+{
+	int i;
+
+	for (i = 0; i < 0x40; i++)
+		nv_write_tv_enc(dev, i, state->tv_enc[i]);
+
+	tv_load_filter(dev, NV_PTV_HFILTER, state->hfilter);
+	tv_load_filter(dev, NV_PTV_HFILTER2, state->hfilter2);
+	tv_load_filter(dev, NV_PTV_VFILTER, state->vfilter);
+
+	nv_load_ptv(dev, state, 200);
+	nv_load_ptv(dev, state, 204);
+	nv_load_ptv(dev, state, 208);
+	nv_load_ptv(dev, state, 20c);
+	nv_load_ptv(dev, state, 304);
+	nv_load_ptv(dev, state, 500);
+	nv_load_ptv(dev, state, 504);
+	nv_load_ptv(dev, state, 508);
+	nv_load_ptv(dev, state, 600);
+	nv_load_ptv(dev, state, 604);
+	nv_load_ptv(dev, state, 608);
+	nv_load_ptv(dev, state, 60c);
+	nv_load_ptv(dev, state, 610);
+	nv_load_ptv(dev, state, 614);
+
+	/* This is required for some settings to kick in. */
+	nv_write_tv_enc(dev, 0x3e, 1);
+	nv_write_tv_enc(dev, 0x3e, 0);
+}
+
+/* Timings similar to the ones the blob sets */
+
+struct drm_display_mode nv17_tv_modes[] = {
+	{ DRM_MODE("320x200", DRM_MODE_TYPE_DRIVER, 0,
+		   320, 344, 392, 560, 0, 200, 200, 202, 220, 0,
+		   DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_NVSYNC
+		   | DRM_MODE_FLAG_DBLSCAN | DRM_MODE_FLAG_CLKDIV2) },
+	{ DRM_MODE("320x240", DRM_MODE_TYPE_DRIVER, 0,
+		   320, 344, 392, 560, 0, 240, 240, 246, 263, 0,
+		   DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_NVSYNC
+		   | DRM_MODE_FLAG_DBLSCAN | DRM_MODE_FLAG_CLKDIV2) },
+	{ DRM_MODE("400x300", DRM_MODE_TYPE_DRIVER, 0,
+		   400, 432, 496, 640, 0, 300, 300, 303, 314, 0,
+		   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC
+		   | DRM_MODE_FLAG_DBLSCAN | DRM_MODE_FLAG_CLKDIV2) },
+	{ DRM_MODE("640x480", DRM_MODE_TYPE_DRIVER, 0,
+		   640, 672, 768, 880, 0, 480, 480, 492, 525, 0,
+		   DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_NVSYNC) },
+	{ DRM_MODE("720x480", DRM_MODE_TYPE_DRIVER, 0,
+		   720, 752, 872, 960, 0, 480, 480, 493, 525, 0,
+		   DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_NVSYNC) },
+	{ DRM_MODE("720x576", DRM_MODE_TYPE_DRIVER, 0,
+		   720, 776, 856, 960, 0, 576, 576, 588, 597, 0,
+		   DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_NVSYNC) },
+	{ DRM_MODE("800x600", DRM_MODE_TYPE_DRIVER, 0,
+		   800, 840, 920, 1040, 0, 600, 600, 604, 618, 0,
+		   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+	{ DRM_MODE("1024x768", DRM_MODE_TYPE_DRIVER, 0,
+		   1024, 1064, 1200, 1344, 0, 768, 768, 777, 806, 0,
+		   DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_NVSYNC) },
+	{}
+};
+
+void nv17_tv_update_properties(struct drm_encoder *encoder)
+{
+	struct drm_device *dev = encoder->dev;
+	struct nv17_tv_encoder *tv_enc = to_tv_enc(encoder);
+	struct nv17_tv_state *regs = &tv_enc->state;
+	struct nv17_tv_norm_params *tv_norm = get_tv_norm(encoder);
+	int subconnector = tv_enc->select_subconnector ?
+						tv_enc->select_subconnector :
+						tv_enc->subconnector;
+
+	switch (subconnector) {
+	case DRM_MODE_SUBCONNECTOR_Composite:
+	{
+		regs->ptv_204 = 0x2;
+
+		/* The composite connector may be found on either pin. */
+		if (tv_enc->pin_mask & 0x4)
+			regs->ptv_204 |= 0x010000;
+		else if (tv_enc->pin_mask & 0x2)
+			regs->ptv_204 |= 0x100000;
+		else
+			regs->ptv_204 |= 0x110000;
+
+		regs->tv_enc[0x7] = 0x10;
+		break;
+	}
+	case DRM_MODE_SUBCONNECTOR_SVIDEO:
+		regs->ptv_204 = 0x11012;
+		regs->tv_enc[0x7] = 0x18;
+		break;
+
+	case DRM_MODE_SUBCONNECTOR_Component:
+		regs->ptv_204 = 0x111333;
+		regs->tv_enc[0x7] = 0x14;
+		break;
+
+	case DRM_MODE_SUBCONNECTOR_SCART:
+		regs->ptv_204 = 0x111012;
+		regs->tv_enc[0x7] = 0x18;
+		break;
+	}
+
+	regs->tv_enc[0x20] = interpolate(0, tv_norm->tv_enc_mode.tv_enc[0x20], 255,
+					 tv_enc->saturation);
+	regs->tv_enc[0x22] = interpolate(0, tv_norm->tv_enc_mode.tv_enc[0x22], 255,
+					 tv_enc->saturation);
+	regs->tv_enc[0x25] = tv_enc->hue * 255 / 100;
+
+	nv_load_ptv(dev, regs, 204);
+	nv_load_tv_enc(dev, regs, 7);
+	nv_load_tv_enc(dev, regs, 20);
+	nv_load_tv_enc(dev, regs, 22);
+	nv_load_tv_enc(dev, regs, 25);
+}
+
+void nv17_tv_update_rescaler(struct drm_encoder *encoder)
+{
+	struct drm_device *dev = encoder->dev;
+	struct nv17_tv_encoder *tv_enc = to_tv_enc(encoder);
+	struct nv17_tv_state *regs = &tv_enc->state;
+
+	regs->ptv_208 = 0x40 | (calc_overscan(tv_enc->overscan) << 8);
+
+	tv_setup_filter(encoder);
+
+	nv_load_ptv(dev, regs, 208);
+	tv_load_filter(dev, NV_PTV_HFILTER, regs->hfilter);
+	tv_load_filter(dev, NV_PTV_HFILTER2, regs->hfilter2);
+	tv_load_filter(dev, NV_PTV_VFILTER, regs->vfilter);
+}
+
+void nv17_ctv_update_rescaler(struct drm_encoder *encoder)
+{
+	struct drm_device *dev = encoder->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nv17_tv_encoder *tv_enc = to_tv_enc(encoder);
+	int head = nouveau_crtc(encoder->crtc)->index;
+	struct nv04_crtc_reg *regs = &dev_priv->mode_reg.crtc_reg[head];
+	struct drm_display_mode *crtc_mode = &encoder->crtc->mode;
+	struct drm_display_mode *output_mode = &get_tv_norm(encoder)->ctv_enc_mode.mode;
+	int overscan, hmargin, vmargin, hratio, vratio;
+
+	/* The rescaler doesn't do the right thing for interlaced modes. */
+	if (output_mode->flags & DRM_MODE_FLAG_INTERLACE)
+		overscan = 100;
+	else
+		overscan = tv_enc->overscan;
+
+	hmargin = (output_mode->hdisplay - crtc_mode->hdisplay) / 2;
+	vmargin = (output_mode->vdisplay - crtc_mode->vdisplay) / 2;
+
+	hmargin = interpolate(0, min(hmargin, output_mode->hdisplay/20), hmargin,
+			      overscan);
+	vmargin = interpolate(0, min(vmargin, output_mode->vdisplay/20), vmargin,
+			      overscan);
+
+	hratio = crtc_mode->hdisplay * 0x800 / (output_mode->hdisplay - 2*hmargin);
+	vratio = crtc_mode->vdisplay * 0x800 / (output_mode->vdisplay - 2*vmargin) & ~3;
+
+	regs->fp_horiz_regs[FP_VALID_START] = hmargin;
+	regs->fp_horiz_regs[FP_VALID_END] = output_mode->hdisplay - hmargin - 1;
+	regs->fp_vert_regs[FP_VALID_START] = vmargin;
+	regs->fp_vert_regs[FP_VALID_END] = output_mode->vdisplay - vmargin - 1;
+
+	regs->fp_debug_1 = NV_PRAMDAC_FP_DEBUG_1_YSCALE_TESTMODE_ENABLE |
+		XLATE(vratio, 0, NV_PRAMDAC_FP_DEBUG_1_YSCALE_VALUE) |
+		NV_PRAMDAC_FP_DEBUG_1_XSCALE_TESTMODE_ENABLE |
+		XLATE(hratio, 0, NV_PRAMDAC_FP_DEBUG_1_XSCALE_VALUE);
+
+	NVWriteRAMDAC(dev, head, NV_PRAMDAC_FP_HVALID_START,
+		      regs->fp_horiz_regs[FP_VALID_START]);
+	NVWriteRAMDAC(dev, head, NV_PRAMDAC_FP_HVALID_END,
+		      regs->fp_horiz_regs[FP_VALID_END]);
+	NVWriteRAMDAC(dev, head, NV_PRAMDAC_FP_VVALID_START,
+		      regs->fp_vert_regs[FP_VALID_START]);
+	NVWriteRAMDAC(dev, head, NV_PRAMDAC_FP_VVALID_END,
+		      regs->fp_vert_regs[FP_VALID_END]);
+	NVWriteRAMDAC(dev, head, NV_PRAMDAC_FP_DEBUG_1, regs->fp_debug_1);
+}
diff --git a/drivers/gpu/drm/nouveau/nv20_graph.c b/drivers/gpu/drm/nouveau/nv20_graph.c
new file mode 100644
index 000000000000..d6fc0a82f03d
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nv20_graph.c
@@ -0,0 +1,775 @@
+#include "drmP.h"
+#include "drm.h"
+#include "nouveau_drv.h"
+#include "nouveau_drm.h"
+
+/*
+ * NV20
+ * -----
+ * There are 3 families :
+ * NV20 is 0x10de:0x020*
+ * NV25/28 is 0x10de:0x025* / 0x10de:0x028*
+ * NV2A is 0x10de:0x02A0
+ *
+ * NV30
+ * -----
+ * There are 3 families :
+ * NV30/31 is 0x10de:0x030* / 0x10de:0x031*
+ * NV34 is 0x10de:0x032*
+ * NV35/36 is 0x10de:0x033* / 0x10de:0x034*
+ *
+ * Not seen in the wild, no dumps (probably NV35) :
+ * NV37 is 0x10de:0x00fc, 0x10de:0x00fd
+ * NV38 is 0x10de:0x0333, 0x10de:0x00fe
+ *
+ */
+
+#define NV20_GRCTX_SIZE (3580*4)
+#define NV25_GRCTX_SIZE (3529*4)
+#define NV2A_GRCTX_SIZE (3500*4)
+
+#define NV30_31_GRCTX_SIZE (24392)
+#define NV34_GRCTX_SIZE    (18140)
+#define NV35_36_GRCTX_SIZE (22396)
+
+static void
+nv20_graph_context_init(struct drm_device *dev, struct nouveau_gpuobj *ctx)
+{
+	int i;
+
+	nv_wo32(dev, ctx, 0x033c/4, 0xffff0000);
+	nv_wo32(dev, ctx, 0x03a0/4, 0x0fff0000);
+	nv_wo32(dev, ctx, 0x03a4/4, 0x0fff0000);
+	nv_wo32(dev, ctx, 0x047c/4, 0x00000101);
+	nv_wo32(dev, ctx, 0x0490/4, 0x00000111);
+	nv_wo32(dev, ctx, 0x04a8/4, 0x44400000);
+	for (i = 0x04d4; i <= 0x04e0; i += 4)
+		nv_wo32(dev, ctx, i/4, 0x00030303);
+	for (i = 0x04f4; i <= 0x0500; i += 4)
+		nv_wo32(dev, ctx, i/4, 0x00080000);
+	for (i = 0x050c; i <= 0x0518; i += 4)
+		nv_wo32(dev, ctx, i/4, 0x01012000);
+	for (i = 0x051c; i <= 0x0528; i += 4)
+		nv_wo32(dev, ctx, i/4, 0x000105b8);
+	for (i = 0x052c; i <= 0x0538; i += 4)
+		nv_wo32(dev, ctx, i/4, 0x00080008);
+	for (i = 0x055c; i <= 0x0598; i += 4)
+		nv_wo32(dev, ctx, i/4, 0x07ff0000);
+	nv_wo32(dev, ctx, 0x05a4/4, 0x4b7fffff);
+	nv_wo32(dev, ctx, 0x05fc/4, 0x00000001);
+	nv_wo32(dev, ctx, 0x0604/4, 0x00004000);
+	nv_wo32(dev, ctx, 0x0610/4, 0x00000001);
+	nv_wo32(dev, ctx, 0x0618/4, 0x00040000);
+	nv_wo32(dev, ctx, 0x061c/4, 0x00010000);
+	for (i = 0x1c1c; i <= 0x248c; i += 16) {
+		nv_wo32(dev, ctx, (i + 0)/4, 0x10700ff9);
+		nv_wo32(dev, ctx, (i + 4)/4, 0x0436086c);
+		nv_wo32(dev, ctx, (i + 8)/4, 0x000c001b);
+	}
+	nv_wo32(dev, ctx, 0x281c/4, 0x3f800000);
+	nv_wo32(dev, ctx, 0x2830/4, 0x3f800000);
+	nv_wo32(dev, ctx, 0x285c/4, 0x40000000);
+	nv_wo32(dev, ctx, 0x2860/4, 0x3f800000);
+	nv_wo32(dev, ctx, 0x2864/4, 0x3f000000);
+	nv_wo32(dev, ctx, 0x286c/4, 0x40000000);
+	nv_wo32(dev, ctx, 0x2870/4, 0x3f800000);
+	nv_wo32(dev, ctx, 0x2878/4, 0xbf800000);
+	nv_wo32(dev, ctx, 0x2880/4, 0xbf800000);
+	nv_wo32(dev, ctx, 0x34a4/4, 0x000fe000);
+	nv_wo32(dev, ctx, 0x3530/4, 0x000003f8);
+	nv_wo32(dev, ctx, 0x3540/4, 0x002fe000);
+	for (i = 0x355c; i <= 0x3578; i += 4)
+		nv_wo32(dev, ctx, i/4, 0x001c527c);
+}
+
+static void
+nv25_graph_context_init(struct drm_device *dev, struct nouveau_gpuobj *ctx)
+{
+	int i;
+
+	nv_wo32(dev, ctx, 0x035c/4, 0xffff0000);
+	nv_wo32(dev, ctx, 0x03c0/4, 0x0fff0000);
+	nv_wo32(dev, ctx, 0x03c4/4, 0x0fff0000);
+	nv_wo32(dev, ctx, 0x049c/4, 0x00000101);
+	nv_wo32(dev, ctx, 0x04b0/4, 0x00000111);
+	nv_wo32(dev, ctx, 0x04c8/4, 0x00000080);
+	nv_wo32(dev, ctx, 0x04cc/4, 0xffff0000);
+	nv_wo32(dev, ctx, 0x04d0/4, 0x00000001);
+	nv_wo32(dev, ctx, 0x04e4/4, 0x44400000);
+	nv_wo32(dev, ctx, 0x04fc/4, 0x4b800000);
+	for (i = 0x0510; i <= 0x051c; i += 4)
+		nv_wo32(dev, ctx, i/4, 0x00030303);
+	for (i = 0x0530; i <= 0x053c; i += 4)
+		nv_wo32(dev, ctx, i/4, 0x00080000);
+	for (i = 0x0548; i <= 0x0554; i += 4)
+		nv_wo32(dev, ctx, i/4, 0x01012000);
+	for (i = 0x0558; i <= 0x0564; i += 4)
+		nv_wo32(dev, ctx, i/4, 0x000105b8);
+	for (i = 0x0568; i <= 0x0574; i += 4)
+		nv_wo32(dev, ctx, i/4, 0x00080008);
+	for (i = 0x0598; i <= 0x05d4; i += 4)
+		nv_wo32(dev, ctx, i/4, 0x07ff0000);
+	nv_wo32(dev, ctx, 0x05e0/4, 0x4b7fffff);
+	nv_wo32(dev, ctx, 0x0620/4, 0x00000080);
+	nv_wo32(dev, ctx, 0x0624/4, 0x30201000);
+	nv_wo32(dev, ctx, 0x0628/4, 0x70605040);
+	nv_wo32(dev, ctx, 0x062c/4, 0xb0a09080);
+	nv_wo32(dev, ctx, 0x0630/4, 0xf0e0d0c0);
+	nv_wo32(dev, ctx, 0x0664/4, 0x00000001);
+	nv_wo32(dev, ctx, 0x066c/4, 0x00004000);
+	nv_wo32(dev, ctx, 0x0678/4, 0x00000001);
+	nv_wo32(dev, ctx, 0x0680/4, 0x00040000);
+	nv_wo32(dev, ctx, 0x0684/4, 0x00010000);
+	for (i = 0x1b04; i <= 0x2374; i += 16) {
+		nv_wo32(dev, ctx, (i + 0)/4, 0x10700ff9);
+		nv_wo32(dev, ctx, (i + 4)/4, 0x0436086c);
+		nv_wo32(dev, ctx, (i + 8)/4, 0x000c001b);
+	}
+	nv_wo32(dev, ctx, 0x2704/4, 0x3f800000);
+	nv_wo32(dev, ctx, 0x2718/4, 0x3f800000);
+	nv_wo32(dev, ctx, 0x2744/4, 0x40000000);
+	nv_wo32(dev, ctx, 0x2748/4, 0x3f800000);
+	nv_wo32(dev, ctx, 0x274c/4, 0x3f000000);
+	nv_wo32(dev, ctx, 0x2754/4, 0x40000000);
+	nv_wo32(dev, ctx, 0x2758/4, 0x3f800000);
+	nv_wo32(dev, ctx, 0x2760/4, 0xbf800000);
+	nv_wo32(dev, ctx, 0x2768/4, 0xbf800000);
+	nv_wo32(dev, ctx, 0x308c/4, 0x000fe000);
+	nv_wo32(dev, ctx, 0x3108/4, 0x000003f8);
+	nv_wo32(dev, ctx, 0x3468/4, 0x002fe000);
+	for (i = 0x3484; i <= 0x34a0; i += 4)
+		nv_wo32(dev, ctx, i/4, 0x001c527c);
+}
+
+static void
+nv2a_graph_context_init(struct drm_device *dev, struct nouveau_gpuobj *ctx)
+{
+	int i;
+
+	nv_wo32(dev, ctx, 0x033c/4, 0xffff0000);
+	nv_wo32(dev, ctx, 0x03a0/4, 0x0fff0000);
+	nv_wo32(dev, ctx, 0x03a4/4, 0x0fff0000);
+	nv_wo32(dev, ctx, 0x047c/4, 0x00000101);
+	nv_wo32(dev, ctx, 0x0490/4, 0x00000111);
+	nv_wo32(dev, ctx, 0x04a8/4, 0x44400000);
+	for (i = 0x04d4; i <= 0x04e0; i += 4)
+		nv_wo32(dev, ctx, i/4, 0x00030303);
+	for (i = 0x04f4; i <= 0x0500; i += 4)
+		nv_wo32(dev, ctx, i/4, 0x00080000);
+	for (i = 0x050c; i <= 0x0518; i += 4)
+		nv_wo32(dev, ctx, i/4, 0x01012000);
+	for (i = 0x051c; i <= 0x0528; i += 4)
+		nv_wo32(dev, ctx, i/4, 0x000105b8);
+	for (i = 0x052c; i <= 0x0538; i += 4)
+		nv_wo32(dev, ctx, i/4, 0x00080008);
+	for (i = 0x055c; i <= 0x0598; i += 4)
+		nv_wo32(dev, ctx, i/4, 0x07ff0000);
+	nv_wo32(dev, ctx, 0x05a4/4, 0x4b7fffff);
+	nv_wo32(dev, ctx, 0x05fc/4, 0x00000001);
+	nv_wo32(dev, ctx, 0x0604/4, 0x00004000);
+	nv_wo32(dev, ctx, 0x0610/4, 0x00000001);
+	nv_wo32(dev, ctx, 0x0618/4, 0x00040000);
+	nv_wo32(dev, ctx, 0x061c/4, 0x00010000);
+	for (i = 0x1a9c; i <= 0x22fc; i += 16) { /*XXX: check!! */
+		nv_wo32(dev, ctx, (i + 0)/4, 0x10700ff9);
+		nv_wo32(dev, ctx, (i + 4)/4, 0x0436086c);
+		nv_wo32(dev, ctx, (i + 8)/4, 0x000c001b);
+	}
+	nv_wo32(dev, ctx, 0x269c/4, 0x3f800000);
+	nv_wo32(dev, ctx, 0x26b0/4, 0x3f800000);
+	nv_wo32(dev, ctx, 0x26dc/4, 0x40000000);
+	nv_wo32(dev, ctx, 0x26e0/4, 0x3f800000);
+	nv_wo32(dev, ctx, 0x26e4/4, 0x3f000000);
+	nv_wo32(dev, ctx, 0x26ec/4, 0x40000000);
+	nv_wo32(dev, ctx, 0x26f0/4, 0x3f800000);
+	nv_wo32(dev, ctx, 0x26f8/4, 0xbf800000);
+	nv_wo32(dev, ctx, 0x2700/4, 0xbf800000);
+	nv_wo32(dev, ctx, 0x3024/4, 0x000fe000);
+	nv_wo32(dev, ctx, 0x30a0/4, 0x000003f8);
+	nv_wo32(dev, ctx, 0x33fc/4, 0x002fe000);
+	for (i = 0x341c; i <= 0x3438; i += 4)
+		nv_wo32(dev, ctx, i/4, 0x001c527c);
+}
+
+static void
+nv30_31_graph_context_init(struct drm_device *dev, struct nouveau_gpuobj *ctx)
+{
+	int i;
+
+	nv_wo32(dev, ctx, 0x0410/4, 0x00000101);
+	nv_wo32(dev, ctx, 0x0424/4, 0x00000111);
+	nv_wo32(dev, ctx, 0x0428/4, 0x00000060);
+	nv_wo32(dev, ctx, 0x0444/4, 0x00000080);
+	nv_wo32(dev, ctx, 0x0448/4, 0xffff0000);
+	nv_wo32(dev, ctx, 0x044c/4, 0x00000001);
+	nv_wo32(dev, ctx, 0x0460/4, 0x44400000);
+	nv_wo32(dev, ctx, 0x048c/4, 0xffff0000);
+	for (i = 0x04e0; i < 0x04e8; i += 4)
+		nv_wo32(dev, ctx, i/4, 0x0fff0000);
+	nv_wo32(dev, ctx, 0x04ec/4, 0x00011100);
+	for (i = 0x0508; i < 0x0548; i += 4)
+		nv_wo32(dev, ctx, i/4, 0x07ff0000);
+	nv_wo32(dev, ctx, 0x0550/4, 0x4b7fffff);
+	nv_wo32(dev, ctx, 0x058c/4, 0x00000080);
+	nv_wo32(dev, ctx, 0x0590/4, 0x30201000);
+	nv_wo32(dev, ctx, 0x0594/4, 0x70605040);
+	nv_wo32(dev, ctx, 0x0598/4, 0xb8a89888);
+	nv_wo32(dev, ctx, 0x059c/4, 0xf8e8d8c8);
+	nv_wo32(dev, ctx, 0x05b0/4, 0xb0000000);
+	for (i = 0x0600; i < 0x0640; i += 4)
+		nv_wo32(dev, ctx, i/4, 0x00010588);
+	for (i = 0x0640; i < 0x0680; i += 4)
+		nv_wo32(dev, ctx, i/4, 0x00030303);
+	for (i = 0x06c0; i < 0x0700; i += 4)
+		nv_wo32(dev, ctx, i/4, 0x0008aae4);
+	for (i = 0x0700; i < 0x0740; i += 4)
+		nv_wo32(dev, ctx, i/4, 0x01012000);
+	for (i = 0x0740; i < 0x0780; i += 4)
+		nv_wo32(dev, ctx, i/4, 0x00080008);
+	nv_wo32(dev, ctx, 0x085c/4, 0x00040000);
+	nv_wo32(dev, ctx, 0x0860/4, 0x00010000);
+	for (i = 0x0864; i < 0x0874; i += 4)
+		nv_wo32(dev, ctx, i/4, 0x00040004);
+	for (i = 0x1f18; i <= 0x3088 ; i += 16) {
+		nv_wo32(dev, ctx, i/4 + 0, 0x10700ff9);
+		nv_wo32(dev, ctx, i/4 + 1, 0x0436086c);
+		nv_wo32(dev, ctx, i/4 + 2, 0x000c001b);
+	}
+	for (i = 0x30b8; i < 0x30c8; i += 4)
+		nv_wo32(dev, ctx, i/4, 0x0000ffff);
+	nv_wo32(dev, ctx, 0x344c/4, 0x3f800000);
+	nv_wo32(dev, ctx, 0x3808/4, 0x3f800000);
+	nv_wo32(dev, ctx, 0x381c/4, 0x3f800000);
+	nv_wo32(dev, ctx, 0x3848/4, 0x40000000);
+	nv_wo32(dev, ctx, 0x384c/4, 0x3f800000);
+	nv_wo32(dev, ctx, 0x3850/4, 0x3f000000);
+	nv_wo32(dev, ctx, 0x3858/4, 0x40000000);
+	nv_wo32(dev, ctx, 0x385c/4, 0x3f800000);
+	nv_wo32(dev, ctx, 0x3864/4, 0xbf800000);
+	nv_wo32(dev, ctx, 0x386c/4, 0xbf800000);
+}
+
+static void
+nv34_graph_context_init(struct drm_device *dev, struct nouveau_gpuobj *ctx)
+{
+	int i;
+
+	nv_wo32(dev, ctx, 0x040c/4, 0x01000101);
+	nv_wo32(dev, ctx, 0x0420/4, 0x00000111);
+	nv_wo32(dev, ctx, 0x0424/4, 0x00000060);
+	nv_wo32(dev, ctx, 0x0440/4, 0x00000080);
+	nv_wo32(dev, ctx, 0x0444/4, 0xffff0000);
+	nv_wo32(dev, ctx, 0x0448/4, 0x00000001);
+	nv_wo32(dev, ctx, 0x045c/4, 0x44400000);
+	nv_wo32(dev, ctx, 0x0480/4, 0xffff0000);
+	for (i = 0x04d4; i < 0x04dc; i += 4)
+		nv_wo32(dev, ctx, i/4, 0x0fff0000);
+	nv_wo32(dev, ctx, 0x04e0/4, 0x00011100);
+	for (i = 0x04fc; i < 0x053c; i += 4)
+		nv_wo32(dev, ctx, i/4, 0x07ff0000);
+	nv_wo32(dev, ctx, 0x0544/4, 0x4b7fffff);
+	nv_wo32(dev, ctx, 0x057c/4, 0x00000080);
+	nv_wo32(dev, ctx, 0x0580/4, 0x30201000);
+	nv_wo32(dev, ctx, 0x0584/4, 0x70605040);
+	nv_wo32(dev, ctx, 0x0588/4, 0xb8a89888);
+	nv_wo32(dev, ctx, 0x058c/4, 0xf8e8d8c8);
+	nv_wo32(dev, ctx, 0x05a0/4, 0xb0000000);
+	for (i = 0x05f0; i < 0x0630; i += 4)
+		nv_wo32(dev, ctx, i/4, 0x00010588);
+	for (i = 0x0630; i < 0x0670; i += 4)
+		nv_wo32(dev, ctx, i/4, 0x00030303);
+	for (i = 0x06b0; i < 0x06f0; i += 4)
+		nv_wo32(dev, ctx, i/4, 0x0008aae4);
+	for (i = 0x06f0; i < 0x0730; i += 4)
+		nv_wo32(dev, ctx, i/4, 0x01012000);
+	for (i = 0x0730; i < 0x0770; i += 4)
+		nv_wo32(dev, ctx, i/4, 0x00080008);
+	nv_wo32(dev, ctx, 0x0850/4, 0x00040000);
+	nv_wo32(dev, ctx, 0x0854/4, 0x00010000);
+	for (i = 0x0858; i < 0x0868; i += 4)
+		nv_wo32(dev, ctx, i/4, 0x00040004);
+	for (i = 0x15ac; i <= 0x271c ; i += 16) {
+		nv_wo32(dev, ctx, i/4 + 0, 0x10700ff9);
+		nv_wo32(dev, ctx, i/4 + 1, 0x0436086c);
+		nv_wo32(dev, ctx, i/4 + 2, 0x000c001b);
+	}
+	for (i = 0x274c; i < 0x275c; i += 4)
+		nv_wo32(dev, ctx, i/4, 0x0000ffff);
+	nv_wo32(dev, ctx, 0x2ae0/4, 0x3f800000);
+	nv_wo32(dev, ctx, 0x2e9c/4, 0x3f800000);
+	nv_wo32(dev, ctx, 0x2eb0/4, 0x3f800000);
+	nv_wo32(dev, ctx, 0x2edc/4, 0x40000000);
+	nv_wo32(dev, ctx, 0x2ee0/4, 0x3f800000);
+	nv_wo32(dev, ctx, 0x2ee4/4, 0x3f000000);
+	nv_wo32(dev, ctx, 0x2eec/4, 0x40000000);
+	nv_wo32(dev, ctx, 0x2ef0/4, 0x3f800000);
+	nv_wo32(dev, ctx, 0x2ef8/4, 0xbf800000);
+	nv_wo32(dev, ctx, 0x2f00/4, 0xbf800000);
+}
+
+static void
+nv35_36_graph_context_init(struct drm_device *dev, struct nouveau_gpuobj *ctx)
+{
+	int i;
+
+	nv_wo32(dev, ctx, 0x040c/4, 0x00000101);
+	nv_wo32(dev, ctx, 0x0420/4, 0x00000111);
+	nv_wo32(dev, ctx, 0x0424/4, 0x00000060);
+	nv_wo32(dev, ctx, 0x0440/4, 0x00000080);
+	nv_wo32(dev, ctx, 0x0444/4, 0xffff0000);
+	nv_wo32(dev, ctx, 0x0448/4, 0x00000001);
+	nv_wo32(dev, ctx, 0x045c/4, 0x44400000);
+	nv_wo32(dev, ctx, 0x0488/4, 0xffff0000);
+	for (i = 0x04dc; i < 0x04e4; i += 4)
+		nv_wo32(dev, ctx, i/4, 0x0fff0000);
+	nv_wo32(dev, ctx, 0x04e8/4, 0x00011100);
+	for (i = 0x0504; i < 0x0544; i += 4)
+		nv_wo32(dev, ctx, i/4, 0x07ff0000);
+	nv_wo32(dev, ctx, 0x054c/4, 0x4b7fffff);
+	nv_wo32(dev, ctx, 0x0588/4, 0x00000080);
+	nv_wo32(dev, ctx, 0x058c/4, 0x30201000);
+	nv_wo32(dev, ctx, 0x0590/4, 0x70605040);
+	nv_wo32(dev, ctx, 0x0594/4, 0xb8a89888);
+	nv_wo32(dev, ctx, 0x0598/4, 0xf8e8d8c8);
+	nv_wo32(dev, ctx, 0x05ac/4, 0xb0000000);
+	for (i = 0x0604; i < 0x0644; i += 4)
+		nv_wo32(dev, ctx, i/4, 0x00010588);
+	for (i = 0x0644; i < 0x0684; i += 4)
+		nv_wo32(dev, ctx, i/4, 0x00030303);
+	for (i = 0x06c4; i < 0x0704; i += 4)
+		nv_wo32(dev, ctx, i/4, 0x0008aae4);
+	for (i = 0x0704; i < 0x0744; i += 4)
+		nv_wo32(dev, ctx, i/4, 0x01012000);
+	for (i = 0x0744; i < 0x0784; i += 4)
+		nv_wo32(dev, ctx, i/4, 0x00080008);
+	nv_wo32(dev, ctx, 0x0860/4, 0x00040000);
+	nv_wo32(dev, ctx, 0x0864/4, 0x00010000);
+	for (i = 0x0868; i < 0x0878; i += 4)
+		nv_wo32(dev, ctx, i/4, 0x00040004);
+	for (i = 0x1f1c; i <= 0x308c ; i += 16) {
+		nv_wo32(dev, ctx, i/4 + 0, 0x10700ff9);
+		nv_wo32(dev, ctx, i/4 + 1, 0x0436086c);
+		nv_wo32(dev, ctx, i/4 + 2, 0x000c001b);
+	}
+	for (i = 0x30bc; i < 0x30cc; i += 4)
+		nv_wo32(dev, ctx, i/4, 0x0000ffff);
+	nv_wo32(dev, ctx, 0x3450/4, 0x3f800000);
+	nv_wo32(dev, ctx, 0x380c/4, 0x3f800000);
+	nv_wo32(dev, ctx, 0x3820/4, 0x3f800000);
+	nv_wo32(dev, ctx, 0x384c/4, 0x40000000);
+	nv_wo32(dev, ctx, 0x3850/4, 0x3f800000);
+	nv_wo32(dev, ctx, 0x3854/4, 0x3f000000);
+	nv_wo32(dev, ctx, 0x385c/4, 0x40000000);
+	nv_wo32(dev, ctx, 0x3860/4, 0x3f800000);
+	nv_wo32(dev, ctx, 0x3868/4, 0xbf800000);
+	nv_wo32(dev, ctx, 0x3870/4, 0xbf800000);
+}
+
+int
+nv20_graph_create_context(struct nouveau_channel *chan)
+{
+	struct drm_device *dev = chan->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	void (*ctx_init)(struct drm_device *, struct nouveau_gpuobj *);
+	unsigned int ctx_size;
+	unsigned int idoffs = 0x28/4;
+	int ret;
+
+	switch (dev_priv->chipset) {
+	case 0x20:
+		ctx_size = NV20_GRCTX_SIZE;
+		ctx_init = nv20_graph_context_init;
+		idoffs = 0;
+		break;
+	case 0x25:
+	case 0x28:
+		ctx_size = NV25_GRCTX_SIZE;
+		ctx_init = nv25_graph_context_init;
+		break;
+	case 0x2a:
+		ctx_size = NV2A_GRCTX_SIZE;
+		ctx_init = nv2a_graph_context_init;
+		idoffs = 0;
+		break;
+	case 0x30:
+	case 0x31:
+		ctx_size = NV30_31_GRCTX_SIZE;
+		ctx_init = nv30_31_graph_context_init;
+		break;
+	case 0x34:
+		ctx_size = NV34_GRCTX_SIZE;
+		ctx_init = nv34_graph_context_init;
+		break;
+	case 0x35:
+	case 0x36:
+		ctx_size = NV35_36_GRCTX_SIZE;
+		ctx_init = nv35_36_graph_context_init;
+		break;
+	default:
+		ctx_size = 0;
+		ctx_init = nv35_36_graph_context_init;
+		NV_ERROR(dev, "Please contact the devs if you want your NV%x"
+			      " card to work\n", dev_priv->chipset);
+		return -ENOSYS;
+		break;
+	}
+
+	ret = nouveau_gpuobj_new_ref(dev, chan, NULL, 0, ctx_size, 16,
+					  NVOBJ_FLAG_ZERO_ALLOC,
+					  &chan->ramin_grctx);
+	if (ret)
+		return ret;
+
+	/* Initialise default context values */
+	dev_priv->engine.instmem.prepare_access(dev, true);
+	ctx_init(dev, chan->ramin_grctx->gpuobj);
+
+	/* nv20: nv_wo32(dev, chan->ramin_grctx->gpuobj, 10, chan->id<<24); */
+	nv_wo32(dev, chan->ramin_grctx->gpuobj, idoffs,
+					(chan->id << 24) | 0x1); /* CTX_USER */
+
+	nv_wo32(dev, dev_priv->ctx_table->gpuobj, chan->id,
+			chan->ramin_grctx->instance >> 4);
+
+	dev_priv->engine.instmem.finish_access(dev);
+	return 0;
+}
+
+void
+nv20_graph_destroy_context(struct nouveau_channel *chan)
+{
+	struct drm_device *dev = chan->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+
+	if (chan->ramin_grctx)
+		nouveau_gpuobj_ref_del(dev, &chan->ramin_grctx);
+
+	dev_priv->engine.instmem.prepare_access(dev, true);
+	nv_wo32(dev, dev_priv->ctx_table->gpuobj, chan->id, 0);
+	dev_priv->engine.instmem.finish_access(dev);
+}
+
+int
+nv20_graph_load_context(struct nouveau_channel *chan)
+{
+	struct drm_device *dev = chan->dev;
+	uint32_t inst;
+
+	if (!chan->ramin_grctx)
+		return -EINVAL;
+	inst = chan->ramin_grctx->instance >> 4;
+
+	nv_wr32(dev, NV20_PGRAPH_CHANNEL_CTX_POINTER, inst);
+	nv_wr32(dev, NV20_PGRAPH_CHANNEL_CTX_XFER,
+		     NV20_PGRAPH_CHANNEL_CTX_XFER_LOAD);
+	nv_wr32(dev, NV10_PGRAPH_CTX_CONTROL, 0x10010100);
+
+	nouveau_wait_for_idle(dev);
+	return 0;
+}
+
+int
+nv20_graph_unload_context(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_pgraph_engine *pgraph = &dev_priv->engine.graph;
+	struct nouveau_fifo_engine *pfifo = &dev_priv->engine.fifo;
+	struct nouveau_channel *chan;
+	uint32_t inst, tmp;
+
+	chan = pgraph->channel(dev);
+	if (!chan)
+		return 0;
+	inst = chan->ramin_grctx->instance >> 4;
+
+	nv_wr32(dev, NV20_PGRAPH_CHANNEL_CTX_POINTER, inst);
+	nv_wr32(dev, NV20_PGRAPH_CHANNEL_CTX_XFER,
+		     NV20_PGRAPH_CHANNEL_CTX_XFER_SAVE);
+
+	nouveau_wait_for_idle(dev);
+
+	nv_wr32(dev, NV10_PGRAPH_CTX_CONTROL, 0x10000000);
+	tmp  = nv_rd32(dev, NV10_PGRAPH_CTX_USER) & 0x00ffffff;
+	tmp |= (pfifo->channels - 1) << 24;
+	nv_wr32(dev, NV10_PGRAPH_CTX_USER, tmp);
+	return 0;
+}
+
+static void
+nv20_graph_rdi(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	int i, writecount = 32;
+	uint32_t rdi_index = 0x2c80000;
+
+	if (dev_priv->chipset == 0x20) {
+		rdi_index = 0x3d0000;
+		writecount = 15;
+	}
+
+	nv_wr32(dev, NV10_PGRAPH_RDI_INDEX, rdi_index);
+	for (i = 0; i < writecount; i++)
+		nv_wr32(dev, NV10_PGRAPH_RDI_DATA, 0);
+
+	nouveau_wait_for_idle(dev);
+}
+
+void
+nv20_graph_set_region_tiling(struct drm_device *dev, int i, uint32_t addr,
+			     uint32_t size, uint32_t pitch)
+{
+	uint32_t limit = max(1u, addr + size) - 1;
+
+	if (pitch)
+		addr |= 1;
+
+	nv_wr32(dev, NV20_PGRAPH_TLIMIT(i), limit);
+	nv_wr32(dev, NV20_PGRAPH_TSIZE(i), pitch);
+	nv_wr32(dev, NV20_PGRAPH_TILE(i), addr);
+
+	nv_wr32(dev, NV10_PGRAPH_RDI_INDEX, 0x00EA0030 + 4 * i);
+	nv_wr32(dev, NV10_PGRAPH_RDI_DATA, limit);
+	nv_wr32(dev, NV10_PGRAPH_RDI_INDEX, 0x00EA0050 + 4 * i);
+	nv_wr32(dev, NV10_PGRAPH_RDI_DATA, pitch);
+	nv_wr32(dev, NV10_PGRAPH_RDI_INDEX, 0x00EA0010 + 4 * i);
+	nv_wr32(dev, NV10_PGRAPH_RDI_DATA, addr);
+}
+
+int
+nv20_graph_init(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv =
+		(struct drm_nouveau_private *)dev->dev_private;
+	uint32_t tmp, vramsz;
+	int ret, i;
+
+	nv_wr32(dev, NV03_PMC_ENABLE,
+		nv_rd32(dev, NV03_PMC_ENABLE) & ~NV_PMC_ENABLE_PGRAPH);
+	nv_wr32(dev, NV03_PMC_ENABLE,
+		nv_rd32(dev, NV03_PMC_ENABLE) |  NV_PMC_ENABLE_PGRAPH);
+
+	if (!dev_priv->ctx_table) {
+		/* Create Context Pointer Table */
+		dev_priv->ctx_table_size = 32 * 4;
+		ret = nouveau_gpuobj_new_ref(dev, NULL, NULL, 0,
+						  dev_priv->ctx_table_size, 16,
+						  NVOBJ_FLAG_ZERO_ALLOC,
+						  &dev_priv->ctx_table);
+		if (ret)
+			return ret;
+	}
+
+	nv_wr32(dev, NV20_PGRAPH_CHANNEL_CTX_TABLE,
+		 dev_priv->ctx_table->instance >> 4);
+
+	nv20_graph_rdi(dev);
+
+	nv_wr32(dev, NV03_PGRAPH_INTR   , 0xFFFFFFFF);
+	nv_wr32(dev, NV03_PGRAPH_INTR_EN, 0xFFFFFFFF);
+
+	nv_wr32(dev, NV04_PGRAPH_DEBUG_0, 0xFFFFFFFF);
+	nv_wr32(dev, NV04_PGRAPH_DEBUG_0, 0x00000000);
+	nv_wr32(dev, NV04_PGRAPH_DEBUG_1, 0x00118700);
+	nv_wr32(dev, NV04_PGRAPH_DEBUG_3, 0xF3CE0475); /* 0x4 = auto ctx switch */
+	nv_wr32(dev, NV10_PGRAPH_DEBUG_4, 0x00000000);
+	nv_wr32(dev, 0x40009C           , 0x00000040);
+
+	if (dev_priv->chipset >= 0x25) {
+		nv_wr32(dev, 0x400890, 0x00080000);
+		nv_wr32(dev, 0x400610, 0x304B1FB6);
+		nv_wr32(dev, 0x400B80, 0x18B82880);
+		nv_wr32(dev, 0x400B84, 0x44000000);
+		nv_wr32(dev, 0x400098, 0x40000080);
+		nv_wr32(dev, 0x400B88, 0x000000ff);
+	} else {
+		nv_wr32(dev, 0x400880, 0x00080000); /* 0x0008c7df */
+		nv_wr32(dev, 0x400094, 0x00000005);
+		nv_wr32(dev, 0x400B80, 0x45CAA208); /* 0x45eae20e */
+		nv_wr32(dev, 0x400B84, 0x24000000);
+		nv_wr32(dev, 0x400098, 0x00000040);
+		nv_wr32(dev, NV10_PGRAPH_RDI_INDEX, 0x00E00038);
+		nv_wr32(dev, NV10_PGRAPH_RDI_DATA , 0x00000030);
+		nv_wr32(dev, NV10_PGRAPH_RDI_INDEX, 0x00E10038);
+		nv_wr32(dev, NV10_PGRAPH_RDI_DATA , 0x00000030);
+	}
+
+	/* Turn all the tiling regions off. */
+	for (i = 0; i < NV10_PFB_TILE__SIZE; i++)
+		nv20_graph_set_region_tiling(dev, i, 0, 0, 0);
+
+	for (i = 0; i < 8; i++) {
+		nv_wr32(dev, 0x400980 + i * 4, nv_rd32(dev, 0x100300 + i * 4));
+		nv_wr32(dev, NV10_PGRAPH_RDI_INDEX, 0x00EA0090 + i * 4);
+		nv_wr32(dev, NV10_PGRAPH_RDI_DATA,
+					nv_rd32(dev, 0x100300 + i * 4));
+	}
+	nv_wr32(dev, 0x4009a0, nv_rd32(dev, 0x100324));
+	nv_wr32(dev, NV10_PGRAPH_RDI_INDEX, 0x00EA000C);
+	nv_wr32(dev, NV10_PGRAPH_RDI_DATA, nv_rd32(dev, 0x100324));
+
+	nv_wr32(dev, NV10_PGRAPH_CTX_CONTROL, 0x10000100);
+	nv_wr32(dev, NV10_PGRAPH_STATE      , 0xFFFFFFFF);
+
+	tmp = nv_rd32(dev, NV10_PGRAPH_SURFACE) & 0x0007ff00;
+	nv_wr32(dev, NV10_PGRAPH_SURFACE, tmp);
+	tmp = nv_rd32(dev, NV10_PGRAPH_SURFACE) | 0x00020100;
+	nv_wr32(dev, NV10_PGRAPH_SURFACE, tmp);
+
+	/* begin RAM config */
+	vramsz = drm_get_resource_len(dev, 0) - 1;
+	nv_wr32(dev, 0x4009A4, nv_rd32(dev, NV04_PFB_CFG0));
+	nv_wr32(dev, 0x4009A8, nv_rd32(dev, NV04_PFB_CFG1));
+	nv_wr32(dev, NV10_PGRAPH_RDI_INDEX, 0x00EA0000);
+	nv_wr32(dev, NV10_PGRAPH_RDI_DATA , nv_rd32(dev, NV04_PFB_CFG0));
+	nv_wr32(dev, NV10_PGRAPH_RDI_INDEX, 0x00EA0004);
+	nv_wr32(dev, NV10_PGRAPH_RDI_DATA , nv_rd32(dev, NV04_PFB_CFG1));
+	nv_wr32(dev, 0x400820, 0);
+	nv_wr32(dev, 0x400824, 0);
+	nv_wr32(dev, 0x400864, vramsz - 1);
+	nv_wr32(dev, 0x400868, vramsz - 1);
+
+	/* interesting.. the below overwrites some of the tile setup above.. */
+	nv_wr32(dev, 0x400B20, 0x00000000);
+	nv_wr32(dev, 0x400B04, 0xFFFFFFFF);
+
+	nv_wr32(dev, NV03_PGRAPH_ABS_UCLIP_XMIN, 0);
+	nv_wr32(dev, NV03_PGRAPH_ABS_UCLIP_YMIN, 0);
+	nv_wr32(dev, NV03_PGRAPH_ABS_UCLIP_XMAX, 0x7fff);
+	nv_wr32(dev, NV03_PGRAPH_ABS_UCLIP_YMAX, 0x7fff);
+
+	return 0;
+}
+
+void
+nv20_graph_takedown(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+
+	nouveau_gpuobj_ref_del(dev, &dev_priv->ctx_table);
+}
+
+int
+nv30_graph_init(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	int ret, i;
+
+	nv_wr32(dev, NV03_PMC_ENABLE,
+		nv_rd32(dev, NV03_PMC_ENABLE) & ~NV_PMC_ENABLE_PGRAPH);
+	nv_wr32(dev, NV03_PMC_ENABLE,
+		nv_rd32(dev, NV03_PMC_ENABLE) |  NV_PMC_ENABLE_PGRAPH);
+
+	if (!dev_priv->ctx_table) {
+		/* Create Context Pointer Table */
+		dev_priv->ctx_table_size = 32 * 4;
+		ret = nouveau_gpuobj_new_ref(dev, NULL, NULL, 0,
+						  dev_priv->ctx_table_size, 16,
+						  NVOBJ_FLAG_ZERO_ALLOC,
+						  &dev_priv->ctx_table);
+		if (ret)
+			return ret;
+	}
+
+	nv_wr32(dev, NV20_PGRAPH_CHANNEL_CTX_TABLE,
+			dev_priv->ctx_table->instance >> 4);
+
+	nv_wr32(dev, NV03_PGRAPH_INTR   , 0xFFFFFFFF);
+	nv_wr32(dev, NV03_PGRAPH_INTR_EN, 0xFFFFFFFF);
+
+	nv_wr32(dev, NV04_PGRAPH_DEBUG_0, 0xFFFFFFFF);
+	nv_wr32(dev, NV04_PGRAPH_DEBUG_0, 0x00000000);
+	nv_wr32(dev, NV04_PGRAPH_DEBUG_1, 0x401287c0);
+	nv_wr32(dev, 0x400890, 0x01b463ff);
+	nv_wr32(dev, NV04_PGRAPH_DEBUG_3, 0xf2de0475);
+	nv_wr32(dev, NV10_PGRAPH_DEBUG_4, 0x00008000);
+	nv_wr32(dev, NV04_PGRAPH_LIMIT_VIOL_PIX, 0xf04bdff6);
+	nv_wr32(dev, 0x400B80, 0x1003d888);
+	nv_wr32(dev, 0x400B84, 0x0c000000);
+	nv_wr32(dev, 0x400098, 0x00000000);
+	nv_wr32(dev, 0x40009C, 0x0005ad00);
+	nv_wr32(dev, 0x400B88, 0x62ff00ff); /* suspiciously like PGRAPH_DEBUG_2 */
+	nv_wr32(dev, 0x4000a0, 0x00000000);
+	nv_wr32(dev, 0x4000a4, 0x00000008);
+	nv_wr32(dev, 0x4008a8, 0xb784a400);
+	nv_wr32(dev, 0x400ba0, 0x002f8685);
+	nv_wr32(dev, 0x400ba4, 0x00231f3f);
+	nv_wr32(dev, 0x4008a4, 0x40000020);
+
+	if (dev_priv->chipset == 0x34) {
+		nv_wr32(dev, NV10_PGRAPH_RDI_INDEX, 0x00EA0004);
+		nv_wr32(dev, NV10_PGRAPH_RDI_DATA , 0x00200201);
+		nv_wr32(dev, NV10_PGRAPH_RDI_INDEX, 0x00EA0008);
+		nv_wr32(dev, NV10_PGRAPH_RDI_DATA , 0x00000008);
+		nv_wr32(dev, NV10_PGRAPH_RDI_INDEX, 0x00EA0000);
+		nv_wr32(dev, NV10_PGRAPH_RDI_DATA , 0x00000032);
+		nv_wr32(dev, NV10_PGRAPH_RDI_INDEX, 0x00E00004);
+		nv_wr32(dev, NV10_PGRAPH_RDI_DATA , 0x00000002);
+	}
+
+	nv_wr32(dev, 0x4000c0, 0x00000016);
+
+	/* Turn all the tiling regions off. */
+	for (i = 0; i < NV10_PFB_TILE__SIZE; i++)
+		nv20_graph_set_region_tiling(dev, i, 0, 0, 0);
+
+	nv_wr32(dev, NV10_PGRAPH_CTX_CONTROL, 0x10000100);
+	nv_wr32(dev, NV10_PGRAPH_STATE      , 0xFFFFFFFF);
+	nv_wr32(dev, 0x0040075c             , 0x00000001);
+
+	/* begin RAM config */
+	/* vramsz = drm_get_resource_len(dev, 0) - 1; */
+	nv_wr32(dev, 0x4009A4, nv_rd32(dev, NV04_PFB_CFG0));
+	nv_wr32(dev, 0x4009A8, nv_rd32(dev, NV04_PFB_CFG1));
+	if (dev_priv->chipset != 0x34) {
+		nv_wr32(dev, 0x400750, 0x00EA0000);
+		nv_wr32(dev, 0x400754, nv_rd32(dev, NV04_PFB_CFG0));
+		nv_wr32(dev, 0x400750, 0x00EA0004);
+		nv_wr32(dev, 0x400754, nv_rd32(dev, NV04_PFB_CFG1));
+	}
+
+	return 0;
+}
+
+struct nouveau_pgraph_object_class nv20_graph_grclass[] = {
+	{ 0x0030, false, NULL }, /* null */
+	{ 0x0039, false, NULL }, /* m2mf */
+	{ 0x004a, false, NULL }, /* gdirect */
+	{ 0x009f, false, NULL }, /* imageblit (nv12) */
+	{ 0x008a, false, NULL }, /* ifc */
+	{ 0x0089, false, NULL }, /* sifm */
+	{ 0x0062, false, NULL }, /* surf2d */
+	{ 0x0043, false, NULL }, /* rop */
+	{ 0x0012, false, NULL }, /* beta1 */
+	{ 0x0072, false, NULL }, /* beta4 */
+	{ 0x0019, false, NULL }, /* cliprect */
+	{ 0x0044, false, NULL }, /* pattern */
+	{ 0x009e, false, NULL }, /* swzsurf */
+	{ 0x0096, false, NULL }, /* celcius */
+	{ 0x0097, false, NULL }, /* kelvin (nv20) */
+	{ 0x0597, false, NULL }, /* kelvin (nv25) */
+	{}
+};
+
+struct nouveau_pgraph_object_class nv30_graph_grclass[] = {
+	{ 0x0030, false, NULL }, /* null */
+	{ 0x0039, false, NULL }, /* m2mf */
+	{ 0x004a, false, NULL }, /* gdirect */
+	{ 0x009f, false, NULL }, /* imageblit (nv12) */
+	{ 0x008a, false, NULL }, /* ifc */
+	{ 0x038a, false, NULL }, /* ifc (nv30) */
+	{ 0x0089, false, NULL }, /* sifm */
+	{ 0x0389, false, NULL }, /* sifm (nv30) */
+	{ 0x0062, false, NULL }, /* surf2d */
+	{ 0x0362, false, NULL }, /* surf2d (nv30) */
+	{ 0x0043, false, NULL }, /* rop */
+	{ 0x0012, false, NULL }, /* beta1 */
+	{ 0x0072, false, NULL }, /* beta4 */
+	{ 0x0019, false, NULL }, /* cliprect */
+	{ 0x0044, false, NULL }, /* pattern */
+	{ 0x039e, false, NULL }, /* swzsurf */
+	{ 0x0397, false, NULL }, /* rankine (nv30) */
+	{ 0x0497, false, NULL }, /* rankine (nv35) */
+	{ 0x0697, false, NULL }, /* rankine (nv34) */
+	{}
+};
+
diff --git a/drivers/gpu/drm/nouveau/nv40_fb.c b/drivers/gpu/drm/nouveau/nv40_fb.c
new file mode 100644
index 000000000000..3cd07d8d5bd7
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nv40_fb.c
@@ -0,0 +1,75 @@
+#include "drmP.h"
+#include "drm.h"
+#include "nouveau_drv.h"
+#include "nouveau_drm.h"
+
+void
+nv40_fb_set_region_tiling(struct drm_device *dev, int i, uint32_t addr,
+			  uint32_t size, uint32_t pitch)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	uint32_t limit = max(1u, addr + size) - 1;
+
+	if (pitch)
+		addr |= 1;
+
+	switch (dev_priv->chipset) {
+	case 0x40:
+		nv_wr32(dev, NV10_PFB_TLIMIT(i), limit);
+		nv_wr32(dev, NV10_PFB_TSIZE(i), pitch);
+		nv_wr32(dev, NV10_PFB_TILE(i), addr);
+		break;
+
+	default:
+		nv_wr32(dev, NV40_PFB_TLIMIT(i), limit);
+		nv_wr32(dev, NV40_PFB_TSIZE(i), pitch);
+		nv_wr32(dev, NV40_PFB_TILE(i), addr);
+		break;
+	}
+}
+
+int
+nv40_fb_init(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_fb_engine *pfb = &dev_priv->engine.fb;
+	uint32_t tmp;
+	int i;
+
+	/* This is strictly a NV4x register (don't know about NV5x). */
+	/* The blob sets these to all kinds of values, and they mess up our setup. */
+	/* I got value 0x52802 instead. For some cards the blob even sets it back to 0x1. */
+	/* Note: the blob doesn't read this value, so i'm pretty sure this is safe for all cards. */
+	/* Any idea what this is? */
+	nv_wr32(dev, NV40_PFB_UNK_800, 0x1);
+
+	switch (dev_priv->chipset) {
+	case 0x40:
+	case 0x45:
+		tmp = nv_rd32(dev, NV10_PFB_CLOSE_PAGE2);
+		nv_wr32(dev, NV10_PFB_CLOSE_PAGE2, tmp & ~(1 << 15));
+		pfb->num_tiles = NV10_PFB_TILE__SIZE;
+		break;
+	case 0x46: /* G72 */
+	case 0x47: /* G70 */
+	case 0x49: /* G71 */
+	case 0x4b: /* G73 */
+	case 0x4c: /* C51 (G7X version) */
+		pfb->num_tiles = NV40_PFB_TILE__SIZE_1;
+		break;
+	default:
+		pfb->num_tiles = NV40_PFB_TILE__SIZE_0;
+		break;
+	}
+
+	/* Turn all the tiling regions off. */
+	for (i = 0; i < pfb->num_tiles; i++)
+		pfb->set_region_tiling(dev, i, 0, 0, 0);
+
+	return 0;
+}
+
+void
+nv40_fb_takedown(struct drm_device *dev)
+{
+}
diff --git a/drivers/gpu/drm/nouveau/nv40_fifo.c b/drivers/gpu/drm/nouveau/nv40_fifo.c
new file mode 100644
index 000000000000..b4f19ccb8b41
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nv40_fifo.c
@@ -0,0 +1,314 @@
+/*
+ * Copyright (C) 2007 Ben Skeggs.
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial
+ * portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE COPYRIGHT OWNER(S) AND/OR ITS SUPPLIERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
+#include "drmP.h"
+#include "nouveau_drv.h"
+#include "nouveau_drm.h"
+
+#define NV40_RAMFC(c) (dev_priv->ramfc_offset + ((c) * NV40_RAMFC__SIZE))
+#define NV40_RAMFC__SIZE 128
+
+int
+nv40_fifo_create_context(struct nouveau_channel *chan)
+{
+	struct drm_device *dev = chan->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	uint32_t fc = NV40_RAMFC(chan->id);
+	int ret;
+
+	ret = nouveau_gpuobj_new_fake(dev, NV40_RAMFC(chan->id), ~0,
+				      NV40_RAMFC__SIZE, NVOBJ_FLAG_ZERO_ALLOC |
+				      NVOBJ_FLAG_ZERO_FREE, NULL, &chan->ramfc);
+	if (ret)
+		return ret;
+
+	dev_priv->engine.instmem.prepare_access(dev, true);
+	nv_wi32(dev, fc +  0, chan->pushbuf_base);
+	nv_wi32(dev, fc +  4, chan->pushbuf_base);
+	nv_wi32(dev, fc + 12, chan->pushbuf->instance >> 4);
+	nv_wi32(dev, fc + 24, NV_PFIFO_CACHE1_DMA_FETCH_TRIG_128_BYTES |
+			      NV_PFIFO_CACHE1_DMA_FETCH_SIZE_128_BYTES |
+			      NV_PFIFO_CACHE1_DMA_FETCH_MAX_REQS_8 |
+#ifdef __BIG_ENDIAN
+			      NV_PFIFO_CACHE1_BIG_ENDIAN |
+#endif
+			      0x30000000 /* no idea.. */);
+	nv_wi32(dev, fc + 56, chan->ramin_grctx->instance >> 4);
+	nv_wi32(dev, fc + 60, 0x0001FFFF);
+	dev_priv->engine.instmem.finish_access(dev);
+
+	/* enable the fifo dma operation */
+	nv_wr32(dev, NV04_PFIFO_MODE,
+		nv_rd32(dev, NV04_PFIFO_MODE) | (1 << chan->id));
+	return 0;
+}
+
+void
+nv40_fifo_destroy_context(struct nouveau_channel *chan)
+{
+	struct drm_device *dev = chan->dev;
+
+	nv_wr32(dev, NV04_PFIFO_MODE,
+		nv_rd32(dev, NV04_PFIFO_MODE) & ~(1 << chan->id));
+
+	if (chan->ramfc)
+		nouveau_gpuobj_ref_del(dev, &chan->ramfc);
+}
+
+static void
+nv40_fifo_do_load_context(struct drm_device *dev, int chid)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	uint32_t fc = NV40_RAMFC(chid), tmp, tmp2;
+
+	dev_priv->engine.instmem.prepare_access(dev, false);
+
+	nv_wr32(dev, NV04_PFIFO_CACHE1_DMA_PUT, nv_ri32(dev, fc + 0));
+	nv_wr32(dev, NV04_PFIFO_CACHE1_DMA_GET, nv_ri32(dev, fc + 4));
+	nv_wr32(dev, NV10_PFIFO_CACHE1_REF_CNT, nv_ri32(dev, fc + 8));
+	nv_wr32(dev, NV04_PFIFO_CACHE1_DMA_INSTANCE, nv_ri32(dev, fc + 12));
+	nv_wr32(dev, NV04_PFIFO_CACHE1_DMA_DCOUNT, nv_ri32(dev, fc + 16));
+	nv_wr32(dev, NV04_PFIFO_CACHE1_DMA_STATE, nv_ri32(dev, fc + 20));
+
+	/* No idea what 0x2058 is.. */
+	tmp   = nv_ri32(dev, fc + 24);
+	tmp2  = nv_rd32(dev, 0x2058) & 0xFFF;
+	tmp2 |= (tmp & 0x30000000);
+	nv_wr32(dev, 0x2058, tmp2);
+	tmp  &= ~0x30000000;
+	nv_wr32(dev, NV04_PFIFO_CACHE1_DMA_FETCH, tmp);
+
+	nv_wr32(dev, NV04_PFIFO_CACHE1_ENGINE, nv_ri32(dev, fc + 28));
+	nv_wr32(dev, NV04_PFIFO_CACHE1_PULL1, nv_ri32(dev, fc + 32));
+	nv_wr32(dev, NV10_PFIFO_CACHE1_ACQUIRE_VALUE, nv_ri32(dev, fc + 36));
+	tmp = nv_ri32(dev, fc + 40);
+	nv_wr32(dev, NV10_PFIFO_CACHE1_ACQUIRE_TIMESTAMP, tmp);
+	nv_wr32(dev, NV10_PFIFO_CACHE1_ACQUIRE_TIMEOUT, nv_ri32(dev, fc + 44));
+	nv_wr32(dev, NV10_PFIFO_CACHE1_SEMAPHORE, nv_ri32(dev, fc + 48));
+	nv_wr32(dev, NV10_PFIFO_CACHE1_DMA_SUBROUTINE, nv_ri32(dev, fc + 52));
+	nv_wr32(dev, NV40_PFIFO_GRCTX_INSTANCE, nv_ri32(dev, fc + 56));
+
+	/* Don't clobber the TIMEOUT_ENABLED flag when restoring from RAMFC */
+	tmp  = nv_rd32(dev, NV04_PFIFO_DMA_TIMESLICE) & ~0x1FFFF;
+	tmp |= nv_ri32(dev, fc + 60) & 0x1FFFF;
+	nv_wr32(dev, NV04_PFIFO_DMA_TIMESLICE, tmp);
+
+	nv_wr32(dev, 0x32e4, nv_ri32(dev, fc + 64));
+	/* NVIDIA does this next line twice... */
+	nv_wr32(dev, 0x32e8, nv_ri32(dev, fc + 68));
+	nv_wr32(dev, 0x2088, nv_ri32(dev, fc + 76));
+	nv_wr32(dev, 0x3300, nv_ri32(dev, fc + 80));
+
+	dev_priv->engine.instmem.finish_access(dev);
+
+	nv_wr32(dev, NV03_PFIFO_CACHE1_GET, 0);
+	nv_wr32(dev, NV03_PFIFO_CACHE1_PUT, 0);
+}
+
+int
+nv40_fifo_load_context(struct nouveau_channel *chan)
+{
+	struct drm_device *dev = chan->dev;
+	uint32_t tmp;
+
+	nv40_fifo_do_load_context(dev, chan->id);
+
+	/* Set channel active, and in DMA mode */
+	nv_wr32(dev, NV03_PFIFO_CACHE1_PUSH1,
+		     NV40_PFIFO_CACHE1_PUSH1_DMA | chan->id);
+	nv_wr32(dev, NV04_PFIFO_CACHE1_DMA_PUSH, 1);
+
+	/* Reset DMA_CTL_AT_INFO to INVALID */
+	tmp = nv_rd32(dev, NV04_PFIFO_CACHE1_DMA_CTL) & ~(1 << 31);
+	nv_wr32(dev, NV04_PFIFO_CACHE1_DMA_CTL, tmp);
+
+	return 0;
+}
+
+int
+nv40_fifo_unload_context(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_fifo_engine *pfifo = &dev_priv->engine.fifo;
+	uint32_t fc, tmp;
+	int chid;
+
+	chid = pfifo->channel_id(dev);
+	if (chid < 0 || chid >= dev_priv->engine.fifo.channels)
+		return 0;
+	fc = NV40_RAMFC(chid);
+
+	dev_priv->engine.instmem.prepare_access(dev, true);
+	nv_wi32(dev, fc + 0, nv_rd32(dev, NV04_PFIFO_CACHE1_DMA_PUT));
+	nv_wi32(dev, fc + 4, nv_rd32(dev, NV04_PFIFO_CACHE1_DMA_GET));
+	nv_wi32(dev, fc + 8, nv_rd32(dev, NV10_PFIFO_CACHE1_REF_CNT));
+	nv_wi32(dev, fc + 12, nv_rd32(dev, NV04_PFIFO_CACHE1_DMA_INSTANCE));
+	nv_wi32(dev, fc + 16, nv_rd32(dev, NV04_PFIFO_CACHE1_DMA_DCOUNT));
+	nv_wi32(dev, fc + 20, nv_rd32(dev, NV04_PFIFO_CACHE1_DMA_STATE));
+	tmp  = nv_rd32(dev, NV04_PFIFO_CACHE1_DMA_FETCH);
+	tmp |= nv_rd32(dev, 0x2058) & 0x30000000;
+	nv_wi32(dev, fc + 24, tmp);
+	nv_wi32(dev, fc + 28, nv_rd32(dev, NV04_PFIFO_CACHE1_ENGINE));
+	nv_wi32(dev, fc + 32, nv_rd32(dev, NV04_PFIFO_CACHE1_PULL1));
+	nv_wi32(dev, fc + 36, nv_rd32(dev, NV10_PFIFO_CACHE1_ACQUIRE_VALUE));
+	tmp = nv_rd32(dev, NV10_PFIFO_CACHE1_ACQUIRE_TIMESTAMP);
+	nv_wi32(dev, fc + 40, tmp);
+	nv_wi32(dev, fc + 44, nv_rd32(dev, NV10_PFIFO_CACHE1_ACQUIRE_TIMEOUT));
+	nv_wi32(dev, fc + 48, nv_rd32(dev, NV10_PFIFO_CACHE1_SEMAPHORE));
+	/* NVIDIA read 0x3228 first, then write DMA_GET here.. maybe something
+	 * more involved depending on the value of 0x3228?
+	 */
+	nv_wi32(dev, fc + 52, nv_rd32(dev, NV04_PFIFO_CACHE1_DMA_GET));
+	nv_wi32(dev, fc + 56, nv_rd32(dev, NV40_PFIFO_GRCTX_INSTANCE));
+	nv_wi32(dev, fc + 60, nv_rd32(dev, NV04_PFIFO_DMA_TIMESLICE) & 0x1ffff);
+	/* No idea what the below is for exactly, ripped from a mmio-trace */
+	nv_wi32(dev, fc + 64, nv_rd32(dev, NV40_PFIFO_UNK32E4));
+	/* NVIDIA do this next line twice.. bug? */
+	nv_wi32(dev, fc + 68, nv_rd32(dev, 0x32e8));
+	nv_wi32(dev, fc + 76, nv_rd32(dev, 0x2088));
+	nv_wi32(dev, fc + 80, nv_rd32(dev, 0x3300));
+#if 0 /* no real idea which is PUT/GET in UNK_48.. */
+	tmp  = nv_rd32(dev, NV04_PFIFO_CACHE1_GET);
+	tmp |= (nv_rd32(dev, NV04_PFIFO_CACHE1_PUT) << 16);
+	nv_wi32(dev, fc + 72, tmp);
+#endif
+	dev_priv->engine.instmem.finish_access(dev);
+
+	nv40_fifo_do_load_context(dev, pfifo->channels - 1);
+	nv_wr32(dev, NV03_PFIFO_CACHE1_PUSH1,
+		     NV40_PFIFO_CACHE1_PUSH1_DMA | (pfifo->channels - 1));
+	return 0;
+}
+
+static void
+nv40_fifo_init_reset(struct drm_device *dev)
+{
+	int i;
+
+	nv_wr32(dev, NV03_PMC_ENABLE,
+		nv_rd32(dev, NV03_PMC_ENABLE) & ~NV_PMC_ENABLE_PFIFO);
+	nv_wr32(dev, NV03_PMC_ENABLE,
+		nv_rd32(dev, NV03_PMC_ENABLE) |  NV_PMC_ENABLE_PFIFO);
+
+	nv_wr32(dev, 0x003224, 0x000f0078);
+	nv_wr32(dev, 0x003210, 0x00000000);
+	nv_wr32(dev, 0x003270, 0x00000000);
+	nv_wr32(dev, 0x003240, 0x00000000);
+	nv_wr32(dev, 0x003244, 0x00000000);
+	nv_wr32(dev, 0x003258, 0x00000000);
+	nv_wr32(dev, 0x002504, 0x00000000);
+	for (i = 0; i < 16; i++)
+		nv_wr32(dev, 0x002510 + (i * 4), 0x00000000);
+	nv_wr32(dev, 0x00250c, 0x0000ffff);
+	nv_wr32(dev, 0x002048, 0x00000000);
+	nv_wr32(dev, 0x003228, 0x00000000);
+	nv_wr32(dev, 0x0032e8, 0x00000000);
+	nv_wr32(dev, 0x002410, 0x00000000);
+	nv_wr32(dev, 0x002420, 0x00000000);
+	nv_wr32(dev, 0x002058, 0x00000001);
+	nv_wr32(dev, 0x00221c, 0x00000000);
+	/* something with 0x2084, read/modify/write, no change */
+	nv_wr32(dev, 0x002040, 0x000000ff);
+	nv_wr32(dev, 0x002500, 0x00000000);
+	nv_wr32(dev, 0x003200, 0x00000000);
+
+	nv_wr32(dev, NV04_PFIFO_DMA_TIMESLICE, 0x2101ffff);
+}
+
+static void
+nv40_fifo_init_ramxx(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+
+	nv_wr32(dev, NV03_PFIFO_RAMHT, (0x03 << 24) /* search 128 */ |
+				       ((dev_priv->ramht_bits - 9) << 16) |
+				       (dev_priv->ramht_offset >> 8));
+	nv_wr32(dev, NV03_PFIFO_RAMRO, dev_priv->ramro_offset>>8);
+
+	switch (dev_priv->chipset) {
+	case 0x47:
+	case 0x49:
+	case 0x4b:
+		nv_wr32(dev, 0x2230, 1);
+		break;
+	default:
+		break;
+	}
+
+	switch (dev_priv->chipset) {
+	case 0x40:
+	case 0x41:
+	case 0x42:
+	case 0x43:
+	case 0x45:
+	case 0x47:
+	case 0x48:
+	case 0x49:
+	case 0x4b:
+		nv_wr32(dev, NV40_PFIFO_RAMFC, 0x30002);
+		break;
+	default:
+		nv_wr32(dev, 0x2230, 0);
+		nv_wr32(dev, NV40_PFIFO_RAMFC,
+			((nouveau_mem_fb_amount(dev) - 512 * 1024 +
+			  dev_priv->ramfc_offset) >> 16) | (3 << 16));
+		break;
+	}
+}
+
+static void
+nv40_fifo_init_intr(struct drm_device *dev)
+{
+	nv_wr32(dev, 0x002100, 0xffffffff);
+	nv_wr32(dev, 0x002140, 0xffffffff);
+}
+
+int
+nv40_fifo_init(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_fifo_engine *pfifo = &dev_priv->engine.fifo;
+	int i;
+
+	nv40_fifo_init_reset(dev);
+	nv40_fifo_init_ramxx(dev);
+
+	nv40_fifo_do_load_context(dev, pfifo->channels - 1);
+	nv_wr32(dev, NV03_PFIFO_CACHE1_PUSH1, pfifo->channels - 1);
+
+	nv40_fifo_init_intr(dev);
+	pfifo->enable(dev);
+	pfifo->reassign(dev, true);
+
+	for (i = 0; i < dev_priv->engine.fifo.channels; i++) {
+		if (dev_priv->fifos[i]) {
+			uint32_t mode = nv_rd32(dev, NV04_PFIFO_MODE);
+			nv_wr32(dev, NV04_PFIFO_MODE, mode | (1 << i));
+		}
+	}
+
+	return 0;
+}
diff --git a/drivers/gpu/drm/nouveau/nv40_graph.c b/drivers/gpu/drm/nouveau/nv40_graph.c
new file mode 100644
index 000000000000..53e8afe1dcd1
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nv40_graph.c
@@ -0,0 +1,406 @@
+/*
+ * Copyright (C) 2007 Ben Skeggs.
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial
+ * portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE COPYRIGHT OWNER(S) AND/OR ITS SUPPLIERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
+#include "drmP.h"
+#include "drm.h"
+#include "nouveau_drv.h"
+#include "nouveau_grctx.h"
+
+struct nouveau_channel *
+nv40_graph_channel(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	uint32_t inst;
+	int i;
+
+	inst = nv_rd32(dev, NV40_PGRAPH_CTXCTL_CUR);
+	if (!(inst & NV40_PGRAPH_CTXCTL_CUR_LOADED))
+		return NULL;
+	inst = (inst & NV40_PGRAPH_CTXCTL_CUR_INSTANCE) << 4;
+
+	for (i = 0; i < dev_priv->engine.fifo.channels; i++) {
+		struct nouveau_channel *chan = dev_priv->fifos[i];
+
+		if (chan && chan->ramin_grctx &&
+		    chan->ramin_grctx->instance == inst)
+			return chan;
+	}
+
+	return NULL;
+}
+
+int
+nv40_graph_create_context(struct nouveau_channel *chan)
+{
+	struct drm_device *dev = chan->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_pgraph_engine *pgraph = &dev_priv->engine.graph;
+	int ret;
+
+	ret = nouveau_gpuobj_new_ref(dev, chan, NULL, 0, pgraph->grctx_size,
+				     16, NVOBJ_FLAG_ZERO_ALLOC,
+				     &chan->ramin_grctx);
+	if (ret)
+		return ret;
+
+	/* Initialise default context values */
+	dev_priv->engine.instmem.prepare_access(dev, true);
+	if (!pgraph->ctxprog) {
+		struct nouveau_grctx ctx = {};
+
+		ctx.dev = chan->dev;
+		ctx.mode = NOUVEAU_GRCTX_VALS;
+		ctx.data = chan->ramin_grctx->gpuobj;
+		nv40_grctx_init(&ctx);
+	} else {
+		nouveau_grctx_vals_load(dev, chan->ramin_grctx->gpuobj);
+	}
+	nv_wo32(dev, chan->ramin_grctx->gpuobj, 0,
+		     chan->ramin_grctx->gpuobj->im_pramin->start);
+	dev_priv->engine.instmem.finish_access(dev);
+	return 0;
+}
+
+void
+nv40_graph_destroy_context(struct nouveau_channel *chan)
+{
+	nouveau_gpuobj_ref_del(chan->dev, &chan->ramin_grctx);
+}
+
+static int
+nv40_graph_transfer_context(struct drm_device *dev, uint32_t inst, int save)
+{
+	uint32_t old_cp, tv = 1000, tmp;
+	int i;
+
+	old_cp = nv_rd32(dev, NV20_PGRAPH_CHANNEL_CTX_POINTER);
+	nv_wr32(dev, NV20_PGRAPH_CHANNEL_CTX_POINTER, inst);
+
+	tmp  = nv_rd32(dev, NV40_PGRAPH_CTXCTL_0310);
+	tmp |= save ? NV40_PGRAPH_CTXCTL_0310_XFER_SAVE :
+		      NV40_PGRAPH_CTXCTL_0310_XFER_LOAD;
+	nv_wr32(dev, NV40_PGRAPH_CTXCTL_0310, tmp);
+
+	tmp  = nv_rd32(dev, NV40_PGRAPH_CTXCTL_0304);
+	tmp |= NV40_PGRAPH_CTXCTL_0304_XFER_CTX;
+	nv_wr32(dev, NV40_PGRAPH_CTXCTL_0304, tmp);
+
+	nouveau_wait_for_idle(dev);
+
+	for (i = 0; i < tv; i++) {
+		if (nv_rd32(dev, NV40_PGRAPH_CTXCTL_030C) == 0)
+			break;
+	}
+
+	nv_wr32(dev, NV20_PGRAPH_CHANNEL_CTX_POINTER, old_cp);
+
+	if (i == tv) {
+		uint32_t ucstat = nv_rd32(dev, NV40_PGRAPH_CTXCTL_UCODE_STAT);
+		NV_ERROR(dev, "Failed: Instance=0x%08x Save=%d\n", inst, save);
+		NV_ERROR(dev, "IP: 0x%02x, Opcode: 0x%08x\n",
+			 ucstat >> NV40_PGRAPH_CTXCTL_UCODE_STAT_IP_SHIFT,
+			 ucstat  & NV40_PGRAPH_CTXCTL_UCODE_STAT_OP_MASK);
+		NV_ERROR(dev, "0x40030C = 0x%08x\n",
+			 nv_rd32(dev, NV40_PGRAPH_CTXCTL_030C));
+		return -EBUSY;
+	}
+
+	return 0;
+}
+
+/* Restore the context for a specific channel into PGRAPH */
+int
+nv40_graph_load_context(struct nouveau_channel *chan)
+{
+	struct drm_device *dev = chan->dev;
+	uint32_t inst;
+	int ret;
+
+	if (!chan->ramin_grctx)
+		return -EINVAL;
+	inst = chan->ramin_grctx->instance >> 4;
+
+	ret = nv40_graph_transfer_context(dev, inst, 0);
+	if (ret)
+		return ret;
+
+	/* 0x40032C, no idea of it's exact function.  Could simply be a
+	 * record of the currently active PGRAPH context.  It's currently
+	 * unknown as to what bit 24 does.  The nv ddx has it set, so we will
+	 * set it here too.
+	 */
+	nv_wr32(dev, NV20_PGRAPH_CHANNEL_CTX_POINTER, inst);
+	nv_wr32(dev, NV40_PGRAPH_CTXCTL_CUR,
+		 (inst & NV40_PGRAPH_CTXCTL_CUR_INSTANCE) |
+		  NV40_PGRAPH_CTXCTL_CUR_LOADED);
+	/* 0x32E0 records the instance address of the active FIFO's PGRAPH
+	 * context.  If at any time this doesn't match 0x40032C, you will
+	 * recieve PGRAPH_INTR_CONTEXT_SWITCH
+	 */
+	nv_wr32(dev, NV40_PFIFO_GRCTX_INSTANCE, inst);
+	return 0;
+}
+
+int
+nv40_graph_unload_context(struct drm_device *dev)
+{
+	uint32_t inst;
+	int ret;
+
+	inst = nv_rd32(dev, NV40_PGRAPH_CTXCTL_CUR);
+	if (!(inst & NV40_PGRAPH_CTXCTL_CUR_LOADED))
+		return 0;
+	inst &= NV40_PGRAPH_CTXCTL_CUR_INSTANCE;
+
+	ret = nv40_graph_transfer_context(dev, inst, 1);
+
+	nv_wr32(dev, NV40_PGRAPH_CTXCTL_CUR, inst);
+	return ret;
+}
+
+void
+nv40_graph_set_region_tiling(struct drm_device *dev, int i, uint32_t addr,
+			     uint32_t size, uint32_t pitch)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	uint32_t limit = max(1u, addr + size) - 1;
+
+	if (pitch)
+		addr |= 1;
+
+	switch (dev_priv->chipset) {
+	case 0x44:
+	case 0x4a:
+	case 0x4e:
+		nv_wr32(dev, NV20_PGRAPH_TSIZE(i), pitch);
+		nv_wr32(dev, NV20_PGRAPH_TLIMIT(i), limit);
+		nv_wr32(dev, NV20_PGRAPH_TILE(i), addr);
+		break;
+
+	case 0x46:
+	case 0x47:
+	case 0x49:
+	case 0x4b:
+		nv_wr32(dev, NV47_PGRAPH_TSIZE(i), pitch);
+		nv_wr32(dev, NV47_PGRAPH_TLIMIT(i), limit);
+		nv_wr32(dev, NV47_PGRAPH_TILE(i), addr);
+		nv_wr32(dev, NV40_PGRAPH_TSIZE1(i), pitch);
+		nv_wr32(dev, NV40_PGRAPH_TLIMIT1(i), limit);
+		nv_wr32(dev, NV40_PGRAPH_TILE1(i), addr);
+		break;
+
+	default:
+		nv_wr32(dev, NV20_PGRAPH_TSIZE(i), pitch);
+		nv_wr32(dev, NV20_PGRAPH_TLIMIT(i), limit);
+		nv_wr32(dev, NV20_PGRAPH_TILE(i), addr);
+		nv_wr32(dev, NV40_PGRAPH_TSIZE1(i), pitch);
+		nv_wr32(dev, NV40_PGRAPH_TLIMIT1(i), limit);
+		nv_wr32(dev, NV40_PGRAPH_TILE1(i), addr);
+		break;
+	}
+}
+
+/*
+ * G70		0x47
+ * G71		0x49
+ * NV45		0x48
+ * G72[M]	0x46
+ * G73		0x4b
+ * C51_G7X	0x4c
+ * C51		0x4e
+ */
+int
+nv40_graph_init(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv =
+		(struct drm_nouveau_private *)dev->dev_private;
+	struct nouveau_fb_engine *pfb = &dev_priv->engine.fb;
+	uint32_t vramsz;
+	int i, j;
+
+	nv_wr32(dev, NV03_PMC_ENABLE, nv_rd32(dev, NV03_PMC_ENABLE) &
+			~NV_PMC_ENABLE_PGRAPH);
+	nv_wr32(dev, NV03_PMC_ENABLE, nv_rd32(dev, NV03_PMC_ENABLE) |
+			 NV_PMC_ENABLE_PGRAPH);
+
+	if (nouveau_ctxfw) {
+		nouveau_grctx_prog_load(dev);
+		dev_priv->engine.graph.grctx_size = 175 * 1024;
+	}
+
+	if (!dev_priv->engine.graph.ctxprog) {
+		struct nouveau_grctx ctx = {};
+		uint32_t cp[256];
+
+		ctx.dev = dev;
+		ctx.mode = NOUVEAU_GRCTX_PROG;
+		ctx.data = cp;
+		ctx.ctxprog_max = 256;
+		nv40_grctx_init(&ctx);
+		dev_priv->engine.graph.grctx_size = ctx.ctxvals_pos * 4;
+
+		nv_wr32(dev, NV40_PGRAPH_CTXCTL_UCODE_INDEX, 0);
+		for (i = 0; i < ctx.ctxprog_len; i++)
+			nv_wr32(dev, NV40_PGRAPH_CTXCTL_UCODE_DATA, cp[i]);
+	}
+
+	/* No context present currently */
+	nv_wr32(dev, NV40_PGRAPH_CTXCTL_CUR, 0x00000000);
+
+	nv_wr32(dev, NV03_PGRAPH_INTR   , 0xFFFFFFFF);
+	nv_wr32(dev, NV40_PGRAPH_INTR_EN, 0xFFFFFFFF);
+
+	nv_wr32(dev, NV04_PGRAPH_DEBUG_0, 0xFFFFFFFF);
+	nv_wr32(dev, NV04_PGRAPH_DEBUG_0, 0x00000000);
+	nv_wr32(dev, NV04_PGRAPH_DEBUG_1, 0x401287c0);
+	nv_wr32(dev, NV04_PGRAPH_DEBUG_3, 0xe0de8055);
+	nv_wr32(dev, NV10_PGRAPH_DEBUG_4, 0x00008000);
+	nv_wr32(dev, NV04_PGRAPH_LIMIT_VIOL_PIX, 0x00be3c5f);
+
+	nv_wr32(dev, NV10_PGRAPH_CTX_CONTROL, 0x10010100);
+	nv_wr32(dev, NV10_PGRAPH_STATE      , 0xFFFFFFFF);
+
+	j = nv_rd32(dev, 0x1540) & 0xff;
+	if (j) {
+		for (i = 0; !(j & 1); j >>= 1, i++)
+			;
+		nv_wr32(dev, 0x405000, i);
+	}
+
+	if (dev_priv->chipset == 0x40) {
+		nv_wr32(dev, 0x4009b0, 0x83280fff);
+		nv_wr32(dev, 0x4009b4, 0x000000a0);
+	} else {
+		nv_wr32(dev, 0x400820, 0x83280eff);
+		nv_wr32(dev, 0x400824, 0x000000a0);
+	}
+
+	switch (dev_priv->chipset) {
+	case 0x40:
+	case 0x45:
+		nv_wr32(dev, 0x4009b8, 0x0078e366);
+		nv_wr32(dev, 0x4009bc, 0x0000014c);
+		break;
+	case 0x41:
+	case 0x42: /* pciid also 0x00Cx */
+	/* case 0x0120: XXX (pciid) */
+		nv_wr32(dev, 0x400828, 0x007596ff);
+		nv_wr32(dev, 0x40082c, 0x00000108);
+		break;
+	case 0x43:
+		nv_wr32(dev, 0x400828, 0x0072cb77);
+		nv_wr32(dev, 0x40082c, 0x00000108);
+		break;
+	case 0x44:
+	case 0x46: /* G72 */
+	case 0x4a:
+	case 0x4c: /* G7x-based C51 */
+	case 0x4e:
+		nv_wr32(dev, 0x400860, 0);
+		nv_wr32(dev, 0x400864, 0);
+		break;
+	case 0x47: /* G70 */
+	case 0x49: /* G71 */
+	case 0x4b: /* G73 */
+		nv_wr32(dev, 0x400828, 0x07830610);
+		nv_wr32(dev, 0x40082c, 0x0000016A);
+		break;
+	default:
+		break;
+	}
+
+	nv_wr32(dev, 0x400b38, 0x2ffff800);
+	nv_wr32(dev, 0x400b3c, 0x00006000);
+
+	/* Turn all the tiling regions off. */
+	for (i = 0; i < pfb->num_tiles; i++)
+		nv40_graph_set_region_tiling(dev, i, 0, 0, 0);
+
+	/* begin RAM config */
+	vramsz = drm_get_resource_len(dev, 0) - 1;
+	switch (dev_priv->chipset) {
+	case 0x40:
+		nv_wr32(dev, 0x4009A4, nv_rd32(dev, NV04_PFB_CFG0));
+		nv_wr32(dev, 0x4009A8, nv_rd32(dev, NV04_PFB_CFG1));
+		nv_wr32(dev, 0x4069A4, nv_rd32(dev, NV04_PFB_CFG0));
+		nv_wr32(dev, 0x4069A8, nv_rd32(dev, NV04_PFB_CFG1));
+		nv_wr32(dev, 0x400820, 0);
+		nv_wr32(dev, 0x400824, 0);
+		nv_wr32(dev, 0x400864, vramsz);
+		nv_wr32(dev, 0x400868, vramsz);
+		break;
+	default:
+		switch (dev_priv->chipset) {
+		case 0x46:
+		case 0x47:
+		case 0x49:
+		case 0x4b:
+			nv_wr32(dev, 0x400DF0, nv_rd32(dev, NV04_PFB_CFG0));
+			nv_wr32(dev, 0x400DF4, nv_rd32(dev, NV04_PFB_CFG1));
+			break;
+		default:
+			nv_wr32(dev, 0x4009F0, nv_rd32(dev, NV04_PFB_CFG0));
+			nv_wr32(dev, 0x4009F4, nv_rd32(dev, NV04_PFB_CFG1));
+			break;
+		}
+		nv_wr32(dev, 0x4069F0, nv_rd32(dev, NV04_PFB_CFG0));
+		nv_wr32(dev, 0x4069F4, nv_rd32(dev, NV04_PFB_CFG1));
+		nv_wr32(dev, 0x400840, 0);
+		nv_wr32(dev, 0x400844, 0);
+		nv_wr32(dev, 0x4008A0, vramsz);
+		nv_wr32(dev, 0x4008A4, vramsz);
+		break;
+	}
+
+	return 0;
+}
+
+void nv40_graph_takedown(struct drm_device *dev)
+{
+	nouveau_grctx_fini(dev);
+}
+
+struct nouveau_pgraph_object_class nv40_graph_grclass[] = {
+	{ 0x0030, false, NULL }, /* null */
+	{ 0x0039, false, NULL }, /* m2mf */
+	{ 0x004a, false, NULL }, /* gdirect */
+	{ 0x009f, false, NULL }, /* imageblit (nv12) */
+	{ 0x008a, false, NULL }, /* ifc */
+	{ 0x0089, false, NULL }, /* sifm */
+	{ 0x3089, false, NULL }, /* sifm (nv40) */
+	{ 0x0062, false, NULL }, /* surf2d */
+	{ 0x3062, false, NULL }, /* surf2d (nv40) */
+	{ 0x0043, false, NULL }, /* rop */
+	{ 0x0012, false, NULL }, /* beta1 */
+	{ 0x0072, false, NULL }, /* beta4 */
+	{ 0x0019, false, NULL }, /* cliprect */
+	{ 0x0044, false, NULL }, /* pattern */
+	{ 0x309e, false, NULL }, /* swzsurf */
+	{ 0x4097, false, NULL }, /* curie (nv40) */
+	{ 0x4497, false, NULL }, /* curie (nv44) */
+	{}
+};
+
diff --git a/drivers/gpu/drm/nouveau/nv40_grctx.c b/drivers/gpu/drm/nouveau/nv40_grctx.c
new file mode 100644
index 000000000000..11b11c31f543
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nv40_grctx.c
@@ -0,0 +1,678 @@
+/*
+ * Copyright 2009 Red Hat Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * Authors: Ben Skeggs
+ */
+
+/* NVIDIA context programs handle a number of other conditions which are
+ * not implemented in our versions.  It's not clear why NVIDIA context
+ * programs have this code, nor whether it's strictly necessary for
+ * correct operation.  We'll implement additional handling if/when we
+ * discover it's necessary.
+ *
+ * - On context save, NVIDIA set 0x400314 bit 0 to 1 if the "3D state"
+ *   flag is set, this gets saved into the context.
+ * - On context save, the context program for all cards load nsource
+ *   into a flag register and check for ILLEGAL_MTHD.  If it's set,
+ *   opcode 0x60000d is called before resuming normal operation.
+ * - Some context programs check more conditions than the above.  NV44
+ *   checks: ((nsource & 0x0857) || (0x400718 & 0x0100) || (intr & 0x0001))
+ *   and calls 0x60000d before resuming normal operation.
+ * - At the very beginning of NVIDIA's context programs, flag 9 is checked
+ *   and if true 0x800001 is called with count=0, pos=0, the flag is cleared
+ *   and then the ctxprog is aborted.  It looks like a complicated NOP,
+ *   its purpose is unknown.
+ * - In the section of code that loads the per-vs state, NVIDIA check
+ *   flag 10.  If it's set, they only transfer the small 0x300 byte block
+ *   of state + the state for a single vs as opposed to the state for
+ *   all vs units.  It doesn't seem likely that it'll occur in normal
+ *   operation, especially seeing as it appears NVIDIA may have screwed
+ *   up the ctxprogs for some cards and have an invalid instruction
+ *   rather than a cp_lsr(ctx, dwords_for_1_vs_unit) instruction.
+ * - There's a number of places where context offset 0 (where we place
+ *   the PRAMIN offset of the context) is loaded into either 0x408000,
+ *   0x408004 or 0x408008.  Not sure what's up there either.
+ * - The ctxprogs for some cards save 0x400a00 again during the cleanup
+ *   path for auto-loadctx.
+ */
+
+#define CP_FLAG_CLEAR                 0
+#define CP_FLAG_SET                   1
+#define CP_FLAG_SWAP_DIRECTION        ((0 * 32) + 0)
+#define CP_FLAG_SWAP_DIRECTION_LOAD   0
+#define CP_FLAG_SWAP_DIRECTION_SAVE   1
+#define CP_FLAG_USER_SAVE             ((0 * 32) + 5)
+#define CP_FLAG_USER_SAVE_NOT_PENDING 0
+#define CP_FLAG_USER_SAVE_PENDING     1
+#define CP_FLAG_USER_LOAD             ((0 * 32) + 6)
+#define CP_FLAG_USER_LOAD_NOT_PENDING 0
+#define CP_FLAG_USER_LOAD_PENDING     1
+#define CP_FLAG_STATUS                ((3 * 32) + 0)
+#define CP_FLAG_STATUS_IDLE           0
+#define CP_FLAG_STATUS_BUSY           1
+#define CP_FLAG_AUTO_SAVE             ((3 * 32) + 4)
+#define CP_FLAG_AUTO_SAVE_NOT_PENDING 0
+#define CP_FLAG_AUTO_SAVE_PENDING     1
+#define CP_FLAG_AUTO_LOAD             ((3 * 32) + 5)
+#define CP_FLAG_AUTO_LOAD_NOT_PENDING 0
+#define CP_FLAG_AUTO_LOAD_PENDING     1
+#define CP_FLAG_UNK54                 ((3 * 32) + 6)
+#define CP_FLAG_UNK54_CLEAR           0
+#define CP_FLAG_UNK54_SET             1
+#define CP_FLAG_ALWAYS                ((3 * 32) + 8)
+#define CP_FLAG_ALWAYS_FALSE          0
+#define CP_FLAG_ALWAYS_TRUE           1
+#define CP_FLAG_UNK57                 ((3 * 32) + 9)
+#define CP_FLAG_UNK57_CLEAR           0
+#define CP_FLAG_UNK57_SET             1
+
+#define CP_CTX                   0x00100000
+#define CP_CTX_COUNT             0x000fc000
+#define CP_CTX_COUNT_SHIFT               14
+#define CP_CTX_REG               0x00003fff
+#define CP_LOAD_SR               0x00200000
+#define CP_LOAD_SR_VALUE         0x000fffff
+#define CP_BRA                   0x00400000
+#define CP_BRA_IP                0x0000ff00
+#define CP_BRA_IP_SHIFT                   8
+#define CP_BRA_IF_CLEAR          0x00000080
+#define CP_BRA_FLAG              0x0000007f
+#define CP_WAIT                  0x00500000
+#define CP_WAIT_SET              0x00000080
+#define CP_WAIT_FLAG             0x0000007f
+#define CP_SET                   0x00700000
+#define CP_SET_1                 0x00000080
+#define CP_SET_FLAG              0x0000007f
+#define CP_NEXT_TO_SWAP          0x00600007
+#define CP_NEXT_TO_CURRENT       0x00600009
+#define CP_SET_CONTEXT_POINTER   0x0060000a
+#define CP_END                   0x0060000e
+#define CP_LOAD_MAGIC_UNK01      0x00800001 /* unknown */
+#define CP_LOAD_MAGIC_NV44TCL    0x00800029 /* per-vs state (0x4497) */
+#define CP_LOAD_MAGIC_NV40TCL    0x00800041 /* per-vs state (0x4097) */
+
+#include "drmP.h"
+#include "nouveau_drv.h"
+#include "nouveau_grctx.h"
+
+/* TODO:
+ *  - get vs count from 0x1540
+ *  - document unimplemented bits compared to nvidia
+ *    - nsource handling
+ *    - R0 & 0x0200 handling
+ *    - single-vs handling
+ *    - 400314 bit 0
+ */
+
+static int
+nv40_graph_4097(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+
+	if ((dev_priv->chipset & 0xf0) == 0x60)
+		return 0;
+
+	return !!(0x0baf & (1 << dev_priv->chipset));
+}
+
+static int
+nv40_graph_vs_count(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+
+	switch (dev_priv->chipset) {
+	case 0x47:
+	case 0x49:
+	case 0x4b:
+		return 8;
+	case 0x40:
+		return 6;
+	case 0x41:
+	case 0x42:
+		return 5;
+	case 0x43:
+	case 0x44:
+	case 0x46:
+	case 0x4a:
+		return 3;
+	case 0x4c:
+	case 0x4e:
+	case 0x67:
+	default:
+		return 1;
+	}
+}
+
+
+enum cp_label {
+	cp_check_load = 1,
+	cp_setup_auto_load,
+	cp_setup_load,
+	cp_setup_save,
+	cp_swap_state,
+	cp_swap_state3d_3_is_save,
+	cp_prepare_exit,
+	cp_exit,
+};
+
+static void
+nv40_graph_construct_general(struct nouveau_grctx *ctx)
+{
+	struct drm_nouveau_private *dev_priv = ctx->dev->dev_private;
+	int i;
+
+	cp_ctx(ctx, 0x4000a4, 1);
+	gr_def(ctx, 0x4000a4, 0x00000008);
+	cp_ctx(ctx, 0x400144, 58);
+	gr_def(ctx, 0x400144, 0x00000001);
+	cp_ctx(ctx, 0x400314, 1);
+	gr_def(ctx, 0x400314, 0x00000000);
+	cp_ctx(ctx, 0x400400, 10);
+	cp_ctx(ctx, 0x400480, 10);
+	cp_ctx(ctx, 0x400500, 19);
+	gr_def(ctx, 0x400514, 0x00040000);
+	gr_def(ctx, 0x400524, 0x55555555);
+	gr_def(ctx, 0x400528, 0x55555555);
+	gr_def(ctx, 0x40052c, 0x55555555);
+	gr_def(ctx, 0x400530, 0x55555555);
+	cp_ctx(ctx, 0x400560, 6);
+	gr_def(ctx, 0x400568, 0x0000ffff);
+	gr_def(ctx, 0x40056c, 0x0000ffff);
+	cp_ctx(ctx, 0x40057c, 5);
+	cp_ctx(ctx, 0x400710, 3);
+	gr_def(ctx, 0x400710, 0x20010001);
+	gr_def(ctx, 0x400714, 0x0f73ef00);
+	cp_ctx(ctx, 0x400724, 1);
+	gr_def(ctx, 0x400724, 0x02008821);
+	cp_ctx(ctx, 0x400770, 3);
+	if (dev_priv->chipset == 0x40) {
+		cp_ctx(ctx, 0x400814, 4);
+		cp_ctx(ctx, 0x400828, 5);
+		cp_ctx(ctx, 0x400840, 5);
+		gr_def(ctx, 0x400850, 0x00000040);
+		cp_ctx(ctx, 0x400858, 4);
+		gr_def(ctx, 0x400858, 0x00000040);
+		gr_def(ctx, 0x40085c, 0x00000040);
+		gr_def(ctx, 0x400864, 0x80000000);
+		cp_ctx(ctx, 0x40086c, 9);
+		gr_def(ctx, 0x40086c, 0x80000000);
+		gr_def(ctx, 0x400870, 0x80000000);
+		gr_def(ctx, 0x400874, 0x80000000);
+		gr_def(ctx, 0x400878, 0x80000000);
+		gr_def(ctx, 0x400888, 0x00000040);
+		gr_def(ctx, 0x40088c, 0x80000000);
+		cp_ctx(ctx, 0x4009c0, 8);
+		gr_def(ctx, 0x4009cc, 0x80000000);
+		gr_def(ctx, 0x4009dc, 0x80000000);
+	} else {
+		cp_ctx(ctx, 0x400840, 20);
+		if (!nv40_graph_4097(ctx->dev)) {
+			for (i = 0; i < 8; i++)
+				gr_def(ctx, 0x400860 + (i * 4), 0x00000001);
+		}
+		gr_def(ctx, 0x400880, 0x00000040);
+		gr_def(ctx, 0x400884, 0x00000040);
+		gr_def(ctx, 0x400888, 0x00000040);
+		cp_ctx(ctx, 0x400894, 11);
+		gr_def(ctx, 0x400894, 0x00000040);
+		if (nv40_graph_4097(ctx->dev)) {
+			for (i = 0; i < 8; i++)
+				gr_def(ctx, 0x4008a0 + (i * 4), 0x80000000);
+		}
+		cp_ctx(ctx, 0x4008e0, 2);
+		cp_ctx(ctx, 0x4008f8, 2);
+		if (dev_priv->chipset == 0x4c ||
+		    (dev_priv->chipset & 0xf0) == 0x60)
+			cp_ctx(ctx, 0x4009f8, 1);
+	}
+	cp_ctx(ctx, 0x400a00, 73);
+	gr_def(ctx, 0x400b0c, 0x0b0b0b0c);
+	cp_ctx(ctx, 0x401000, 4);
+	cp_ctx(ctx, 0x405004, 1);
+	switch (dev_priv->chipset) {
+	case 0x47:
+	case 0x49:
+	case 0x4b:
+		cp_ctx(ctx, 0x403448, 1);
+		gr_def(ctx, 0x403448, 0x00001010);
+		break;
+	default:
+		cp_ctx(ctx, 0x403440, 1);
+		switch (dev_priv->chipset) {
+		case 0x40:
+			gr_def(ctx, 0x403440, 0x00000010);
+			break;
+		case 0x44:
+		case 0x46:
+		case 0x4a:
+			gr_def(ctx, 0x403440, 0x00003010);
+			break;
+		case 0x41:
+		case 0x42:
+		case 0x43:
+		case 0x4c:
+		case 0x4e:
+		case 0x67:
+		default:
+			gr_def(ctx, 0x403440, 0x00001010);
+			break;
+		}
+		break;
+	}
+}
+
+static void
+nv40_graph_construct_state3d(struct nouveau_grctx *ctx)
+{
+	struct drm_nouveau_private *dev_priv = ctx->dev->dev_private;
+	int i;
+
+	if (dev_priv->chipset == 0x40) {
+		cp_ctx(ctx, 0x401880, 51);
+		gr_def(ctx, 0x401940, 0x00000100);
+	} else
+	if (dev_priv->chipset == 0x46 || dev_priv->chipset == 0x47 ||
+	    dev_priv->chipset == 0x49 || dev_priv->chipset == 0x4b) {
+		cp_ctx(ctx, 0x401880, 32);
+		for (i = 0; i < 16; i++)
+			gr_def(ctx, 0x401880 + (i * 4), 0x00000111);
+		if (dev_priv->chipset == 0x46)
+			cp_ctx(ctx, 0x401900, 16);
+		cp_ctx(ctx, 0x401940, 3);
+	}
+	cp_ctx(ctx, 0x40194c, 18);
+	gr_def(ctx, 0x401954, 0x00000111);
+	gr_def(ctx, 0x401958, 0x00080060);
+	gr_def(ctx, 0x401974, 0x00000080);
+	gr_def(ctx, 0x401978, 0xffff0000);
+	gr_def(ctx, 0x40197c, 0x00000001);
+	gr_def(ctx, 0x401990, 0x46400000);
+	if (dev_priv->chipset == 0x40) {
+		cp_ctx(ctx, 0x4019a0, 2);
+		cp_ctx(ctx, 0x4019ac, 5);
+	} else {
+		cp_ctx(ctx, 0x4019a0, 1);
+		cp_ctx(ctx, 0x4019b4, 3);
+	}
+	gr_def(ctx, 0x4019bc, 0xffff0000);
+	switch (dev_priv->chipset) {
+	case 0x46:
+	case 0x47:
+	case 0x49:
+	case 0x4b:
+		cp_ctx(ctx, 0x4019c0, 18);
+		for (i = 0; i < 16; i++)
+			gr_def(ctx, 0x4019c0 + (i * 4), 0x88888888);
+		break;
+	}
+	cp_ctx(ctx, 0x401a08, 8);
+	gr_def(ctx, 0x401a10, 0x0fff0000);
+	gr_def(ctx, 0x401a14, 0x0fff0000);
+	gr_def(ctx, 0x401a1c, 0x00011100);
+	cp_ctx(ctx, 0x401a2c, 4);
+	cp_ctx(ctx, 0x401a44, 26);
+	for (i = 0; i < 16; i++)
+		gr_def(ctx, 0x401a44 + (i * 4), 0x07ff0000);
+	gr_def(ctx, 0x401a8c, 0x4b7fffff);
+	if (dev_priv->chipset == 0x40) {
+		cp_ctx(ctx, 0x401ab8, 3);
+	} else {
+		cp_ctx(ctx, 0x401ab8, 1);
+		cp_ctx(ctx, 0x401ac0, 1);
+	}
+	cp_ctx(ctx, 0x401ad0, 8);
+	gr_def(ctx, 0x401ad0, 0x30201000);
+	gr_def(ctx, 0x401ad4, 0x70605040);
+	gr_def(ctx, 0x401ad8, 0xb8a89888);
+	gr_def(ctx, 0x401adc, 0xf8e8d8c8);
+	cp_ctx(ctx, 0x401b10, dev_priv->chipset == 0x40 ? 2 : 1);
+	gr_def(ctx, 0x401b10, 0x40100000);
+	cp_ctx(ctx, 0x401b18, dev_priv->chipset == 0x40 ? 6 : 5);
+	gr_def(ctx, 0x401b28, dev_priv->chipset == 0x40 ?
+			      0x00000004 : 0x00000000);
+	cp_ctx(ctx, 0x401b30, 25);
+	gr_def(ctx, 0x401b34, 0x0000ffff);
+	gr_def(ctx, 0x401b68, 0x435185d6);
+	gr_def(ctx, 0x401b6c, 0x2155b699);
+	gr_def(ctx, 0x401b70, 0xfedcba98);
+	gr_def(ctx, 0x401b74, 0x00000098);
+	gr_def(ctx, 0x401b84, 0xffffffff);
+	gr_def(ctx, 0x401b88, 0x00ff7000);
+	gr_def(ctx, 0x401b8c, 0x0000ffff);
+	if (dev_priv->chipset != 0x44 && dev_priv->chipset != 0x4a &&
+	    dev_priv->chipset != 0x4e)
+		cp_ctx(ctx, 0x401b94, 1);
+	cp_ctx(ctx, 0x401b98, 8);
+	gr_def(ctx, 0x401b9c, 0x00ff0000);
+	cp_ctx(ctx, 0x401bc0, 9);
+	gr_def(ctx, 0x401be0, 0x00ffff00);
+	cp_ctx(ctx, 0x401c00, 192);
+	for (i = 0; i < 16; i++) { /* fragment texture units */
+		gr_def(ctx, 0x401c40 + (i * 4), 0x00018488);
+		gr_def(ctx, 0x401c80 + (i * 4), 0x00028202);
+		gr_def(ctx, 0x401d00 + (i * 4), 0x0000aae4);
+		gr_def(ctx, 0x401d40 + (i * 4), 0x01012000);
+		gr_def(ctx, 0x401d80 + (i * 4), 0x00080008);
+		gr_def(ctx, 0x401e00 + (i * 4), 0x00100008);
+	}
+	for (i = 0; i < 4; i++) { /* vertex texture units */
+		gr_def(ctx, 0x401e90 + (i * 4), 0x0001bc80);
+		gr_def(ctx, 0x401ea0 + (i * 4), 0x00000202);
+		gr_def(ctx, 0x401ec0 + (i * 4), 0x00000008);
+		gr_def(ctx, 0x401ee0 + (i * 4), 0x00080008);
+	}
+	cp_ctx(ctx, 0x400f5c, 3);
+	gr_def(ctx, 0x400f5c, 0x00000002);
+	cp_ctx(ctx, 0x400f84, 1);
+}
+
+static void
+nv40_graph_construct_state3d_2(struct nouveau_grctx *ctx)
+{
+	struct drm_nouveau_private *dev_priv = ctx->dev->dev_private;
+	int i;
+
+	cp_ctx(ctx, 0x402000, 1);
+	cp_ctx(ctx, 0x402404, dev_priv->chipset == 0x40 ? 1 : 2);
+	switch (dev_priv->chipset) {
+	case 0x40:
+		gr_def(ctx, 0x402404, 0x00000001);
+		break;
+	case 0x4c:
+	case 0x4e:
+	case 0x67:
+		gr_def(ctx, 0x402404, 0x00000020);
+		break;
+	case 0x46:
+	case 0x49:
+	case 0x4b:
+		gr_def(ctx, 0x402404, 0x00000421);
+		break;
+	default:
+		gr_def(ctx, 0x402404, 0x00000021);
+	}
+	if (dev_priv->chipset != 0x40)
+		gr_def(ctx, 0x402408, 0x030c30c3);
+	switch (dev_priv->chipset) {
+	case 0x44:
+	case 0x46:
+	case 0x4a:
+	case 0x4c:
+	case 0x4e:
+	case 0x67:
+		cp_ctx(ctx, 0x402440, 1);
+		gr_def(ctx, 0x402440, 0x00011001);
+		break;
+	default:
+		break;
+	}
+	cp_ctx(ctx, 0x402480, dev_priv->chipset == 0x40 ? 8 : 9);
+	gr_def(ctx, 0x402488, 0x3e020200);
+	gr_def(ctx, 0x40248c, 0x00ffffff);
+	switch (dev_priv->chipset) {
+	case 0x40:
+		gr_def(ctx, 0x402490, 0x60103f00);
+		break;
+	case 0x47:
+		gr_def(ctx, 0x402490, 0x40103f00);
+		break;
+	case 0x41:
+	case 0x42:
+	case 0x49:
+	case 0x4b:
+		gr_def(ctx, 0x402490, 0x20103f00);
+		break;
+	default:
+		gr_def(ctx, 0x402490, 0x0c103f00);
+		break;
+	}
+	gr_def(ctx, 0x40249c, dev_priv->chipset <= 0x43 ?
+			      0x00020000 : 0x00040000);
+	cp_ctx(ctx, 0x402500, 31);
+	gr_def(ctx, 0x402530, 0x00008100);
+	if (dev_priv->chipset == 0x40)
+		cp_ctx(ctx, 0x40257c, 6);
+	cp_ctx(ctx, 0x402594, 16);
+	cp_ctx(ctx, 0x402800, 17);
+	gr_def(ctx, 0x402800, 0x00000001);
+	switch (dev_priv->chipset) {
+	case 0x47:
+	case 0x49:
+	case 0x4b:
+		cp_ctx(ctx, 0x402864, 1);
+		gr_def(ctx, 0x402864, 0x00001001);
+		cp_ctx(ctx, 0x402870, 3);
+		gr_def(ctx, 0x402878, 0x00000003);
+		if (dev_priv->chipset != 0x47) { /* belong at end!! */
+			cp_ctx(ctx, 0x402900, 1);
+			cp_ctx(ctx, 0x402940, 1);
+			cp_ctx(ctx, 0x402980, 1);
+			cp_ctx(ctx, 0x4029c0, 1);
+			cp_ctx(ctx, 0x402a00, 1);
+			cp_ctx(ctx, 0x402a40, 1);
+			cp_ctx(ctx, 0x402a80, 1);
+			cp_ctx(ctx, 0x402ac0, 1);
+		}
+		break;
+	case 0x40:
+		cp_ctx(ctx, 0x402844, 1);
+		gr_def(ctx, 0x402844, 0x00000001);
+		cp_ctx(ctx, 0x402850, 1);
+		break;
+	default:
+		cp_ctx(ctx, 0x402844, 1);
+		gr_def(ctx, 0x402844, 0x00001001);
+		cp_ctx(ctx, 0x402850, 2);
+		gr_def(ctx, 0x402854, 0x00000003);
+		break;
+	}
+
+	cp_ctx(ctx, 0x402c00, 4);
+	gr_def(ctx, 0x402c00, dev_priv->chipset == 0x40 ?
+			      0x80800001 : 0x00888001);
+	switch (dev_priv->chipset) {
+	case 0x47:
+	case 0x49:
+	case 0x4b:
+		cp_ctx(ctx, 0x402c20, 40);
+		for (i = 0; i < 32; i++)
+			gr_def(ctx, 0x402c40 + (i * 4), 0xffffffff);
+		cp_ctx(ctx, 0x4030b8, 13);
+		gr_def(ctx, 0x4030dc, 0x00000005);
+		gr_def(ctx, 0x4030e8, 0x0000ffff);
+		break;
+	default:
+		cp_ctx(ctx, 0x402c10, 4);
+		if (dev_priv->chipset == 0x40)
+			cp_ctx(ctx, 0x402c20, 36);
+		else
+		if (dev_priv->chipset <= 0x42)
+			cp_ctx(ctx, 0x402c20, 24);
+		else
+		if (dev_priv->chipset <= 0x4a)
+			cp_ctx(ctx, 0x402c20, 16);
+		else
+			cp_ctx(ctx, 0x402c20, 8);
+		cp_ctx(ctx, 0x402cb0, dev_priv->chipset == 0x40 ? 12 : 13);
+		gr_def(ctx, 0x402cd4, 0x00000005);
+		if (dev_priv->chipset != 0x40)
+			gr_def(ctx, 0x402ce0, 0x0000ffff);
+		break;
+	}
+
+	cp_ctx(ctx, 0x403400, dev_priv->chipset == 0x40 ? 4 : 3);
+	cp_ctx(ctx, 0x403410, dev_priv->chipset == 0x40 ? 4 : 3);
+	cp_ctx(ctx, 0x403420, nv40_graph_vs_count(ctx->dev));
+	for (i = 0; i < nv40_graph_vs_count(ctx->dev); i++)
+		gr_def(ctx, 0x403420 + (i * 4), 0x00005555);
+
+	if (dev_priv->chipset != 0x40) {
+		cp_ctx(ctx, 0x403600, 1);
+		gr_def(ctx, 0x403600, 0x00000001);
+	}
+	cp_ctx(ctx, 0x403800, 1);
+
+	cp_ctx(ctx, 0x403c18, 1);
+	gr_def(ctx, 0x403c18, 0x00000001);
+	switch (dev_priv->chipset) {
+	case 0x46:
+	case 0x47:
+	case 0x49:
+	case 0x4b:
+		cp_ctx(ctx, 0x405018, 1);
+		gr_def(ctx, 0x405018, 0x08e00001);
+		cp_ctx(ctx, 0x405c24, 1);
+		gr_def(ctx, 0x405c24, 0x000e3000);
+		break;
+	}
+	if (dev_priv->chipset != 0x4e)
+		cp_ctx(ctx, 0x405800, 11);
+	cp_ctx(ctx, 0x407000, 1);
+}
+
+static void
+nv40_graph_construct_state3d_3(struct nouveau_grctx *ctx)
+{
+	int len = nv40_graph_4097(ctx->dev) ? 0x0684 : 0x0084;
+
+	cp_out (ctx, 0x300000);
+	cp_lsr (ctx, len - 4);
+	cp_bra (ctx, SWAP_DIRECTION, SAVE, cp_swap_state3d_3_is_save);
+	cp_lsr (ctx, len);
+	cp_name(ctx, cp_swap_state3d_3_is_save);
+	cp_out (ctx, 0x800001);
+
+	ctx->ctxvals_pos += len;
+}
+
+static void
+nv40_graph_construct_shader(struct nouveau_grctx *ctx)
+{
+	struct drm_device *dev = ctx->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_gpuobj *obj = ctx->data;
+	int vs, vs_nr, vs_len, vs_nr_b0, vs_nr_b1, b0_offset, b1_offset;
+	int offset, i;
+
+	vs_nr    = nv40_graph_vs_count(ctx->dev);
+	vs_nr_b0 = 363;
+	vs_nr_b1 = dev_priv->chipset == 0x40 ? 128 : 64;
+	if (dev_priv->chipset == 0x40) {
+		b0_offset = 0x2200/4; /* 33a0 */
+		b1_offset = 0x55a0/4; /* 1500 */
+		vs_len = 0x6aa0/4;
+	} else
+	if (dev_priv->chipset == 0x41 || dev_priv->chipset == 0x42) {
+		b0_offset = 0x2200/4; /* 2200 */
+		b1_offset = 0x4400/4; /* 0b00 */
+		vs_len = 0x4f00/4;
+	} else {
+		b0_offset = 0x1d40/4; /* 2200 */
+		b1_offset = 0x3f40/4; /* 0b00 : 0a40 */
+		vs_len = nv40_graph_4097(dev) ? 0x4a40/4 : 0x4980/4;
+	}
+
+	cp_lsr(ctx, vs_len * vs_nr + 0x300/4);
+	cp_out(ctx, nv40_graph_4097(dev) ? 0x800041 : 0x800029);
+
+	offset = ctx->ctxvals_pos;
+	ctx->ctxvals_pos += (0x0300/4 + (vs_nr * vs_len));
+
+	if (ctx->mode != NOUVEAU_GRCTX_VALS)
+		return;
+
+	offset += 0x0280/4;
+	for (i = 0; i < 16; i++, offset += 2)
+		nv_wo32(dev, obj, offset, 0x3f800000);
+
+	for (vs = 0; vs < vs_nr; vs++, offset += vs_len) {
+		for (i = 0; i < vs_nr_b0 * 6; i += 6)
+			nv_wo32(dev, obj, offset + b0_offset + i, 0x00000001);
+		for (i = 0; i < vs_nr_b1 * 4; i += 4)
+			nv_wo32(dev, obj, offset + b1_offset + i, 0x3f800000);
+	}
+}
+
+void
+nv40_grctx_init(struct nouveau_grctx *ctx)
+{
+	/* decide whether we're loading/unloading the context */
+	cp_bra (ctx, AUTO_SAVE, PENDING, cp_setup_save);
+	cp_bra (ctx, USER_SAVE, PENDING, cp_setup_save);
+
+	cp_name(ctx, cp_check_load);
+	cp_bra (ctx, AUTO_LOAD, PENDING, cp_setup_auto_load);
+	cp_bra (ctx, USER_LOAD, PENDING, cp_setup_load);
+	cp_bra (ctx, ALWAYS, TRUE, cp_exit);
+
+	/* setup for context load */
+	cp_name(ctx, cp_setup_auto_load);
+	cp_wait(ctx, STATUS, IDLE);
+	cp_out (ctx, CP_NEXT_TO_SWAP);
+	cp_name(ctx, cp_setup_load);
+	cp_wait(ctx, STATUS, IDLE);
+	cp_set (ctx, SWAP_DIRECTION, LOAD);
+	cp_out (ctx, 0x00910880); /* ?? */
+	cp_out (ctx, 0x00901ffe); /* ?? */
+	cp_out (ctx, 0x01940000); /* ?? */
+	cp_lsr (ctx, 0x20);
+	cp_out (ctx, 0x0060000b); /* ?? */
+	cp_wait(ctx, UNK57, CLEAR);
+	cp_out (ctx, 0x0060000c); /* ?? */
+	cp_bra (ctx, ALWAYS, TRUE, cp_swap_state);
+
+	/* setup for context save */
+	cp_name(ctx, cp_setup_save);
+	cp_set (ctx, SWAP_DIRECTION, SAVE);
+
+	/* general PGRAPH state */
+	cp_name(ctx, cp_swap_state);
+	cp_pos (ctx, 0x00020/4);
+	nv40_graph_construct_general(ctx);
+	cp_wait(ctx, STATUS, IDLE);
+
+	/* 3D state, block 1 */
+	cp_bra (ctx, UNK54, CLEAR, cp_prepare_exit);
+	nv40_graph_construct_state3d(ctx);
+	cp_wait(ctx, STATUS, IDLE);
+
+	/* 3D state, block 2 */
+	nv40_graph_construct_state3d_2(ctx);
+
+	/* Some other block of "random" state */
+	nv40_graph_construct_state3d_3(ctx);
+
+	/* Per-vertex shader state */
+	cp_pos (ctx, ctx->ctxvals_pos);
+	nv40_graph_construct_shader(ctx);
+
+	/* pre-exit state updates */
+	cp_name(ctx, cp_prepare_exit);
+	cp_bra (ctx, SWAP_DIRECTION, SAVE, cp_check_load);
+	cp_bra (ctx, USER_SAVE, PENDING, cp_exit);
+	cp_out (ctx, CP_NEXT_TO_CURRENT);
+
+	cp_name(ctx, cp_exit);
+	cp_set (ctx, USER_SAVE, NOT_PENDING);
+	cp_set (ctx, USER_LOAD, NOT_PENDING);
+	cp_out (ctx, CP_END);
+}
+
diff --git a/drivers/gpu/drm/nouveau/nv40_mc.c b/drivers/gpu/drm/nouveau/nv40_mc.c
new file mode 100644
index 000000000000..2a3495e848e9
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nv40_mc.c
@@ -0,0 +1,38 @@
+#include "drmP.h"
+#include "drm.h"
+#include "nouveau_drv.h"
+#include "nouveau_drm.h"
+
+int
+nv40_mc_init(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	uint32_t tmp;
+
+	/* Power up everything, resetting each individual unit will
+	 * be done later if needed.
+	 */
+	nv_wr32(dev, NV03_PMC_ENABLE, 0xFFFFFFFF);
+
+	switch (dev_priv->chipset) {
+	case 0x44:
+	case 0x46: /* G72 */
+	case 0x4e:
+	case 0x4c: /* C51_G7X */
+		tmp = nv_rd32(dev, NV40_PFB_020C);
+		nv_wr32(dev, NV40_PMC_1700, tmp);
+		nv_wr32(dev, NV40_PMC_1704, 0);
+		nv_wr32(dev, NV40_PMC_1708, 0);
+		nv_wr32(dev, NV40_PMC_170C, tmp);
+		break;
+	default:
+		break;
+	}
+
+	return 0;
+}
+
+void
+nv40_mc_takedown(struct drm_device *dev)
+{
+}
diff --git a/drivers/gpu/drm/nouveau/nv50_crtc.c b/drivers/gpu/drm/nouveau/nv50_crtc.c
new file mode 100644
index 000000000000..118d3285fd8c
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nv50_crtc.c
@@ -0,0 +1,769 @@
+/*
+ * Copyright (C) 2008 Maarten Maathuis.
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial
+ * portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE COPYRIGHT OWNER(S) AND/OR ITS SUPPLIERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
+#include "drmP.h"
+#include "drm_mode.h"
+#include "drm_crtc_helper.h"
+
+#define NOUVEAU_DMA_DEBUG (nouveau_reg_debug & NOUVEAU_REG_DEBUG_EVO)
+#include "nouveau_reg.h"
+#include "nouveau_drv.h"
+#include "nouveau_hw.h"
+#include "nouveau_encoder.h"
+#include "nouveau_crtc.h"
+#include "nouveau_fb.h"
+#include "nouveau_connector.h"
+#include "nv50_display.h"
+
+static void
+nv50_crtc_lut_load(struct drm_crtc *crtc)
+{
+	struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
+	void __iomem *lut = nvbo_kmap_obj_iovirtual(nv_crtc->lut.nvbo);
+	int i;
+
+	NV_DEBUG_KMS(crtc->dev, "\n");
+
+	for (i = 0; i < 256; i++) {
+		writew(nv_crtc->lut.r[i] >> 2, lut + 8*i + 0);
+		writew(nv_crtc->lut.g[i] >> 2, lut + 8*i + 2);
+		writew(nv_crtc->lut.b[i] >> 2, lut + 8*i + 4);
+	}
+
+	if (nv_crtc->lut.depth == 30) {
+		writew(nv_crtc->lut.r[i - 1] >> 2, lut + 8*i + 0);
+		writew(nv_crtc->lut.g[i - 1] >> 2, lut + 8*i + 2);
+		writew(nv_crtc->lut.b[i - 1] >> 2, lut + 8*i + 4);
+	}
+}
+
+int
+nv50_crtc_blank(struct nouveau_crtc *nv_crtc, bool blanked)
+{
+	struct drm_device *dev = nv_crtc->base.dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_channel *evo = dev_priv->evo;
+	int index = nv_crtc->index, ret;
+
+	NV_DEBUG_KMS(dev, "index %d\n", nv_crtc->index);
+	NV_DEBUG_KMS(dev, "%s\n", blanked ? "blanked" : "unblanked");
+
+	if (blanked) {
+		nv_crtc->cursor.hide(nv_crtc, false);
+
+		ret = RING_SPACE(evo, dev_priv->chipset != 0x50 ? 7 : 5);
+		if (ret) {
+			NV_ERROR(dev, "no space while blanking crtc\n");
+			return ret;
+		}
+		BEGIN_RING(evo, 0, NV50_EVO_CRTC(index, CLUT_MODE), 2);
+		OUT_RING(evo, NV50_EVO_CRTC_CLUT_MODE_BLANK);
+		OUT_RING(evo, 0);
+		if (dev_priv->chipset != 0x50) {
+			BEGIN_RING(evo, 0, NV84_EVO_CRTC(index, CLUT_DMA), 1);
+			OUT_RING(evo, NV84_EVO_CRTC_CLUT_DMA_HANDLE_NONE);
+		}
+
+		BEGIN_RING(evo, 0, NV50_EVO_CRTC(index, FB_DMA), 1);
+		OUT_RING(evo, NV50_EVO_CRTC_FB_DMA_HANDLE_NONE);
+	} else {
+		if (nv_crtc->cursor.visible)
+			nv_crtc->cursor.show(nv_crtc, false);
+		else
+			nv_crtc->cursor.hide(nv_crtc, false);
+
+		ret = RING_SPACE(evo, dev_priv->chipset != 0x50 ? 10 : 8);
+		if (ret) {
+			NV_ERROR(dev, "no space while unblanking crtc\n");
+			return ret;
+		}
+		BEGIN_RING(evo, 0, NV50_EVO_CRTC(index, CLUT_MODE), 2);
+		OUT_RING(evo, nv_crtc->lut.depth == 8 ?
+				NV50_EVO_CRTC_CLUT_MODE_OFF :
+				NV50_EVO_CRTC_CLUT_MODE_ON);
+		OUT_RING(evo, (nv_crtc->lut.nvbo->bo.mem.mm_node->start <<
+				 PAGE_SHIFT) >> 8);
+		if (dev_priv->chipset != 0x50) {
+			BEGIN_RING(evo, 0, NV84_EVO_CRTC(index, CLUT_DMA), 1);
+			OUT_RING(evo, NvEvoVRAM);
+		}
+
+		BEGIN_RING(evo, 0, NV50_EVO_CRTC(index, FB_OFFSET), 2);
+		OUT_RING(evo, nv_crtc->fb.offset >> 8);
+		OUT_RING(evo, 0);
+		BEGIN_RING(evo, 0, NV50_EVO_CRTC(index, FB_DMA), 1);
+		if (dev_priv->chipset != 0x50)
+			if (nv_crtc->fb.tile_flags == 0x7a00)
+				OUT_RING(evo, NvEvoFB32);
+			else
+			if (nv_crtc->fb.tile_flags == 0x7000)
+				OUT_RING(evo, NvEvoFB16);
+			else
+				OUT_RING(evo, NvEvoVRAM);
+		else
+			OUT_RING(evo, NvEvoVRAM);
+	}
+
+	nv_crtc->fb.blanked = blanked;
+	return 0;
+}
+
+static int
+nv50_crtc_set_dither(struct nouveau_crtc *nv_crtc, bool on, bool update)
+{
+	struct drm_device *dev = nv_crtc->base.dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_channel *evo = dev_priv->evo;
+	int ret;
+
+	NV_DEBUG_KMS(dev, "\n");
+
+	ret = RING_SPACE(evo, 2 + (update ? 2 : 0));
+	if (ret) {
+		NV_ERROR(dev, "no space while setting dither\n");
+		return ret;
+	}
+
+	BEGIN_RING(evo, 0, NV50_EVO_CRTC(nv_crtc->index, DITHER_CTRL), 1);
+	if (on)
+		OUT_RING(evo, NV50_EVO_CRTC_DITHER_CTRL_ON);
+	else
+		OUT_RING(evo, NV50_EVO_CRTC_DITHER_CTRL_OFF);
+
+	if (update) {
+		BEGIN_RING(evo, 0, NV50_EVO_UPDATE, 1);
+		OUT_RING(evo, 0);
+		FIRE_RING(evo);
+	}
+
+	return 0;
+}
+
+struct nouveau_connector *
+nouveau_crtc_connector_get(struct nouveau_crtc *nv_crtc)
+{
+	struct drm_device *dev = nv_crtc->base.dev;
+	struct drm_connector *connector;
+	struct drm_crtc *crtc = to_drm_crtc(nv_crtc);
+
+	/* The safest approach is to find an encoder with the right crtc, that
+	 * is also linked to a connector. */
+	list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+		if (connector->encoder)
+			if (connector->encoder->crtc == crtc)
+				return nouveau_connector(connector);
+	}
+
+	return NULL;
+}
+
+static int
+nv50_crtc_set_scale(struct nouveau_crtc *nv_crtc, int scaling_mode, bool update)
+{
+	struct nouveau_connector *nv_connector =
+		nouveau_crtc_connector_get(nv_crtc);
+	struct drm_device *dev = nv_crtc->base.dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_channel *evo = dev_priv->evo;
+	struct drm_display_mode *native_mode = NULL;
+	struct drm_display_mode *mode = &nv_crtc->base.mode;
+	uint32_t outX, outY, horiz, vert;
+	int ret;
+
+	NV_DEBUG_KMS(dev, "\n");
+
+	switch (scaling_mode) {
+	case DRM_MODE_SCALE_NONE:
+		break;
+	default:
+		if (!nv_connector || !nv_connector->native_mode) {
+			NV_ERROR(dev, "No native mode, forcing panel scaling\n");
+			scaling_mode = DRM_MODE_SCALE_NONE;
+		} else {
+			native_mode = nv_connector->native_mode;
+		}
+		break;
+	}
+
+	switch (scaling_mode) {
+	case DRM_MODE_SCALE_ASPECT:
+		horiz = (native_mode->hdisplay << 19) / mode->hdisplay;
+		vert = (native_mode->vdisplay << 19) / mode->vdisplay;
+
+		if (vert > horiz) {
+			outX = (mode->hdisplay * horiz) >> 19;
+			outY = (mode->vdisplay * horiz) >> 19;
+		} else {
+			outX = (mode->hdisplay * vert) >> 19;
+			outY = (mode->vdisplay * vert) >> 19;
+		}
+		break;
+	case DRM_MODE_SCALE_FULLSCREEN:
+		outX = native_mode->hdisplay;
+		outY = native_mode->vdisplay;
+		break;
+	case DRM_MODE_SCALE_CENTER:
+	case DRM_MODE_SCALE_NONE:
+	default:
+		outX = mode->hdisplay;
+		outY = mode->vdisplay;
+		break;
+	}
+
+	ret = RING_SPACE(evo, update ? 7 : 5);
+	if (ret)
+		return ret;
+
+	/* Got a better name for SCALER_ACTIVE? */
+	/* One day i've got to really figure out why this is needed. */
+	BEGIN_RING(evo, 0, NV50_EVO_CRTC(nv_crtc->index, SCALE_CTRL), 1);
+	if ((mode->flags & DRM_MODE_FLAG_DBLSCAN) ||
+	    (mode->flags & DRM_MODE_FLAG_INTERLACE) ||
+	    mode->hdisplay != outX || mode->vdisplay != outY) {
+		OUT_RING(evo, NV50_EVO_CRTC_SCALE_CTRL_ACTIVE);
+	} else {
+		OUT_RING(evo, NV50_EVO_CRTC_SCALE_CTRL_INACTIVE);
+	}
+
+	BEGIN_RING(evo, 0, NV50_EVO_CRTC(nv_crtc->index, SCALE_RES1), 2);
+	OUT_RING(evo, outY << 16 | outX);
+	OUT_RING(evo, outY << 16 | outX);
+
+	if (update) {
+		BEGIN_RING(evo, 0, NV50_EVO_UPDATE, 1);
+		OUT_RING(evo, 0);
+		FIRE_RING(evo);
+	}
+
+	return 0;
+}
+
+int
+nv50_crtc_set_clock(struct drm_device *dev, int head, int pclk)
+{
+	uint32_t pll_reg = NV50_PDISPLAY_CRTC_CLK_CTRL1(head);
+	struct nouveau_pll_vals pll;
+	struct pll_lims limits;
+	uint32_t reg1, reg2;
+	int ret;
+
+	ret = get_pll_limits(dev, pll_reg, &limits);
+	if (ret)
+		return ret;
+
+	ret = nouveau_calc_pll_mnp(dev, &limits, pclk, &pll);
+	if (ret <= 0)
+		return ret;
+
+	if (limits.vco2.maxfreq) {
+		reg1 = nv_rd32(dev, pll_reg + 4) & 0xff00ff00;
+		reg2 = nv_rd32(dev, pll_reg + 8) & 0x8000ff00;
+		nv_wr32(dev, pll_reg, 0x10000611);
+		nv_wr32(dev, pll_reg + 4, reg1 | (pll.M1 << 16) | pll.N1);
+		nv_wr32(dev, pll_reg + 8,
+			reg2 | (pll.log2P << 28) | (pll.M2 << 16) | pll.N2);
+	} else {
+		reg1 = nv_rd32(dev, pll_reg + 4) & 0xffc00000;
+		nv_wr32(dev, pll_reg, 0x50000610);
+		nv_wr32(dev, pll_reg + 4, reg1 |
+			(pll.log2P << 16) | (pll.M1 << 8) | pll.N1);
+	}
+
+	return 0;
+}
+
+static void
+nv50_crtc_destroy(struct drm_crtc *crtc)
+{
+	struct drm_device *dev = crtc->dev;
+	struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
+
+	NV_DEBUG_KMS(dev, "\n");
+
+	if (!crtc)
+		return;
+
+	drm_crtc_cleanup(&nv_crtc->base);
+
+	nv50_cursor_fini(nv_crtc);
+
+	nouveau_bo_ref(NULL, &nv_crtc->lut.nvbo);
+	nouveau_bo_ref(NULL, &nv_crtc->cursor.nvbo);
+	kfree(nv_crtc->mode);
+	kfree(nv_crtc);
+}
+
+int
+nv50_crtc_cursor_set(struct drm_crtc *crtc, struct drm_file *file_priv,
+		     uint32_t buffer_handle, uint32_t width, uint32_t height)
+{
+	struct drm_device *dev = crtc->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
+	struct nouveau_bo *cursor = NULL;
+	struct drm_gem_object *gem;
+	int ret = 0, i;
+
+	if (width != 64 || height != 64)
+		return -EINVAL;
+
+	if (!buffer_handle) {
+		nv_crtc->cursor.hide(nv_crtc, true);
+		return 0;
+	}
+
+	gem = drm_gem_object_lookup(dev, file_priv, buffer_handle);
+	if (!gem)
+		return -EINVAL;
+	cursor = nouveau_gem_object(gem);
+
+	ret = nouveau_bo_map(cursor);
+	if (ret)
+		goto out;
+
+	/* The simple will do for now. */
+	for (i = 0; i < 64 * 64; i++)
+		nouveau_bo_wr32(nv_crtc->cursor.nvbo, i, nouveau_bo_rd32(cursor, i));
+
+	nouveau_bo_unmap(cursor);
+
+	nv_crtc->cursor.set_offset(nv_crtc, nv_crtc->cursor.nvbo->bo.offset -
+					    dev_priv->vm_vram_base);
+	nv_crtc->cursor.show(nv_crtc, true);
+
+out:
+	mutex_lock(&dev->struct_mutex);
+	drm_gem_object_unreference(gem);
+	mutex_unlock(&dev->struct_mutex);
+	return ret;
+}
+
+int
+nv50_crtc_cursor_move(struct drm_crtc *crtc, int x, int y)
+{
+	struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
+
+	nv_crtc->cursor.set_pos(nv_crtc, x, y);
+	return 0;
+}
+
+static void
+nv50_crtc_gamma_set(struct drm_crtc *crtc, u16 *r, u16 *g, u16 *b,
+		    uint32_t size)
+{
+	struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
+	int i;
+
+	if (size != 256)
+		return;
+
+	for (i = 0; i < 256; i++) {
+		nv_crtc->lut.r[i] = r[i];
+		nv_crtc->lut.g[i] = g[i];
+		nv_crtc->lut.b[i] = b[i];
+	}
+
+	/* We need to know the depth before we upload, but it's possible to
+	 * get called before a framebuffer is bound.  If this is the case,
+	 * mark the lut values as dirty by setting depth==0, and it'll be
+	 * uploaded on the first mode_set_base()
+	 */
+	if (!nv_crtc->base.fb) {
+		nv_crtc->lut.depth = 0;
+		return;
+	}
+
+	nv50_crtc_lut_load(crtc);
+}
+
+static void
+nv50_crtc_save(struct drm_crtc *crtc)
+{
+	NV_ERROR(crtc->dev, "!!\n");
+}
+
+static void
+nv50_crtc_restore(struct drm_crtc *crtc)
+{
+	NV_ERROR(crtc->dev, "!!\n");
+}
+
+static const struct drm_crtc_funcs nv50_crtc_funcs = {
+	.save = nv50_crtc_save,
+	.restore = nv50_crtc_restore,
+	.cursor_set = nv50_crtc_cursor_set,
+	.cursor_move = nv50_crtc_cursor_move,
+	.gamma_set = nv50_crtc_gamma_set,
+	.set_config = drm_crtc_helper_set_config,
+	.destroy = nv50_crtc_destroy,
+};
+
+static void
+nv50_crtc_dpms(struct drm_crtc *crtc, int mode)
+{
+}
+
+static void
+nv50_crtc_prepare(struct drm_crtc *crtc)
+{
+	struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
+	struct drm_device *dev = crtc->dev;
+	struct drm_encoder *encoder;
+
+	NV_DEBUG_KMS(dev, "index %d\n", nv_crtc->index);
+
+	/* Disconnect all unused encoders. */
+	list_for_each_entry(encoder, &dev->mode_config.encoder_list, head) {
+		struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
+
+		if (drm_helper_encoder_in_use(encoder))
+			continue;
+
+		nv_encoder->disconnect(nv_encoder);
+	}
+
+	nv50_crtc_blank(nv_crtc, true);
+}
+
+static void
+nv50_crtc_commit(struct drm_crtc *crtc)
+{
+	struct drm_crtc *crtc2;
+	struct drm_device *dev = crtc->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_channel *evo = dev_priv->evo;
+	struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
+	int ret;
+
+	NV_DEBUG_KMS(dev, "index %d\n", nv_crtc->index);
+
+	nv50_crtc_blank(nv_crtc, false);
+
+	/* Explicitly blank all unused crtc's. */
+	list_for_each_entry(crtc2, &dev->mode_config.crtc_list, head) {
+		if (!drm_helper_crtc_in_use(crtc2))
+			nv50_crtc_blank(nouveau_crtc(crtc2), true);
+	}
+
+	ret = RING_SPACE(evo, 2);
+	if (ret) {
+		NV_ERROR(dev, "no space while committing crtc\n");
+		return;
+	}
+	BEGIN_RING(evo, 0, NV50_EVO_UPDATE, 1);
+	OUT_RING(evo, 0);
+	FIRE_RING(evo);
+}
+
+static bool
+nv50_crtc_mode_fixup(struct drm_crtc *crtc, struct drm_display_mode *mode,
+		     struct drm_display_mode *adjusted_mode)
+{
+	return true;
+}
+
+static int
+nv50_crtc_do_mode_set_base(struct drm_crtc *crtc, int x, int y,
+			   struct drm_framebuffer *old_fb, bool update)
+{
+	struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
+	struct drm_device *dev = nv_crtc->base.dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_channel *evo = dev_priv->evo;
+	struct drm_framebuffer *drm_fb = nv_crtc->base.fb;
+	struct nouveau_framebuffer *fb = nouveau_framebuffer(drm_fb);
+	int ret, format;
+
+	NV_DEBUG_KMS(dev, "index %d\n", nv_crtc->index);
+
+	switch (drm_fb->depth) {
+	case  8:
+		format = NV50_EVO_CRTC_FB_DEPTH_8;
+		break;
+	case 15:
+		format = NV50_EVO_CRTC_FB_DEPTH_15;
+		break;
+	case 16:
+		format = NV50_EVO_CRTC_FB_DEPTH_16;
+		break;
+	case 24:
+	case 32:
+		format = NV50_EVO_CRTC_FB_DEPTH_24;
+		break;
+	case 30:
+		format = NV50_EVO_CRTC_FB_DEPTH_30;
+		break;
+	default:
+		 NV_ERROR(dev, "unknown depth %d\n", drm_fb->depth);
+		 return -EINVAL;
+	}
+
+	ret = nouveau_bo_pin(fb->nvbo, TTM_PL_FLAG_VRAM);
+	if (ret)
+		return ret;
+
+	if (old_fb) {
+		struct nouveau_framebuffer *ofb = nouveau_framebuffer(old_fb);
+		nouveau_bo_unpin(ofb->nvbo);
+	}
+
+	nv_crtc->fb.offset = fb->nvbo->bo.offset - dev_priv->vm_vram_base;
+	nv_crtc->fb.tile_flags = fb->nvbo->tile_flags;
+	nv_crtc->fb.cpp = drm_fb->bits_per_pixel / 8;
+	if (!nv_crtc->fb.blanked && dev_priv->chipset != 0x50) {
+		ret = RING_SPACE(evo, 2);
+		if (ret)
+			return ret;
+
+		BEGIN_RING(evo, 0, NV50_EVO_CRTC(nv_crtc->index, FB_DMA), 1);
+		if (nv_crtc->fb.tile_flags == 0x7a00)
+			OUT_RING(evo, NvEvoFB32);
+		else
+		if (nv_crtc->fb.tile_flags == 0x7000)
+			OUT_RING(evo, NvEvoFB16);
+		else
+			OUT_RING(evo, NvEvoVRAM);
+	}
+
+	ret = RING_SPACE(evo, 12);
+	if (ret)
+		return ret;
+
+	BEGIN_RING(evo, 0, NV50_EVO_CRTC(nv_crtc->index, FB_OFFSET), 5);
+	OUT_RING(evo, nv_crtc->fb.offset >> 8);
+	OUT_RING(evo, 0);
+	OUT_RING(evo, (drm_fb->height << 16) | drm_fb->width);
+	if (!nv_crtc->fb.tile_flags) {
+		OUT_RING(evo, drm_fb->pitch | (1 << 20));
+	} else {
+		OUT_RING(evo, ((drm_fb->pitch / 4) << 4) |
+				  fb->nvbo->tile_mode);
+	}
+	if (dev_priv->chipset == 0x50)
+		OUT_RING(evo, (fb->nvbo->tile_flags << 8) | format);
+	else
+		OUT_RING(evo, format);
+
+	BEGIN_RING(evo, 0, NV50_EVO_CRTC(nv_crtc->index, CLUT_MODE), 1);
+	OUT_RING(evo, fb->base.depth == 8 ?
+		 NV50_EVO_CRTC_CLUT_MODE_OFF : NV50_EVO_CRTC_CLUT_MODE_ON);
+
+	BEGIN_RING(evo, 0, NV50_EVO_CRTC(nv_crtc->index, COLOR_CTRL), 1);
+	OUT_RING(evo, NV50_EVO_CRTC_COLOR_CTRL_COLOR);
+	BEGIN_RING(evo, 0, NV50_EVO_CRTC(nv_crtc->index, FB_POS), 1);
+	OUT_RING(evo, (y << 16) | x);
+
+	if (nv_crtc->lut.depth != fb->base.depth) {
+		nv_crtc->lut.depth = fb->base.depth;
+		nv50_crtc_lut_load(crtc);
+	}
+
+	if (update) {
+		ret = RING_SPACE(evo, 2);
+		if (ret)
+			return ret;
+		BEGIN_RING(evo, 0, NV50_EVO_UPDATE, 1);
+		OUT_RING(evo, 0);
+		FIRE_RING(evo);
+	}
+
+	return 0;
+}
+
+static int
+nv50_crtc_mode_set(struct drm_crtc *crtc, struct drm_display_mode *mode,
+		   struct drm_display_mode *adjusted_mode, int x, int y,
+		   struct drm_framebuffer *old_fb)
+{
+	struct drm_device *dev = crtc->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_channel *evo = dev_priv->evo;
+	struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
+	struct nouveau_connector *nv_connector = NULL;
+	uint32_t hsync_dur,  vsync_dur, hsync_start_to_end, vsync_start_to_end;
+	uint32_t hunk1, vunk1, vunk2a, vunk2b;
+	int ret;
+
+	/* Find the connector attached to this CRTC */
+	nv_connector = nouveau_crtc_connector_get(nv_crtc);
+
+	*nv_crtc->mode = *adjusted_mode;
+
+	NV_DEBUG_KMS(dev, "index %d\n", nv_crtc->index);
+
+	hsync_dur = adjusted_mode->hsync_end - adjusted_mode->hsync_start;
+	vsync_dur = adjusted_mode->vsync_end - adjusted_mode->vsync_start;
+	hsync_start_to_end = adjusted_mode->htotal - adjusted_mode->hsync_start;
+	vsync_start_to_end = adjusted_mode->vtotal - adjusted_mode->vsync_start;
+	/* I can't give this a proper name, anyone else can? */
+	hunk1 = adjusted_mode->htotal -
+		adjusted_mode->hsync_start + adjusted_mode->hdisplay;
+	vunk1 = adjusted_mode->vtotal -
+		adjusted_mode->vsync_start + adjusted_mode->vdisplay;
+	/* Another strange value, this time only for interlaced adjusted_modes. */
+	vunk2a = 2 * adjusted_mode->vtotal -
+		 adjusted_mode->vsync_start + adjusted_mode->vdisplay;
+	vunk2b = adjusted_mode->vtotal -
+		 adjusted_mode->vsync_start + adjusted_mode->vtotal;
+
+	if (adjusted_mode->flags & DRM_MODE_FLAG_INTERLACE) {
+		vsync_dur /= 2;
+		vsync_start_to_end  /= 2;
+		vunk1 /= 2;
+		vunk2a /= 2;
+		vunk2b /= 2;
+		/* magic */
+		if (adjusted_mode->flags & DRM_MODE_FLAG_DBLSCAN) {
+			vsync_start_to_end -= 1;
+			vunk1 -= 1;
+			vunk2a -= 1;
+			vunk2b -= 1;
+		}
+	}
+
+	ret = RING_SPACE(evo, 17);
+	if (ret)
+		return ret;
+
+	BEGIN_RING(evo, 0, NV50_EVO_CRTC(nv_crtc->index, CLOCK), 2);
+	OUT_RING(evo, adjusted_mode->clock | 0x800000);
+	OUT_RING(evo, (adjusted_mode->flags & DRM_MODE_FLAG_INTERLACE) ? 2 : 0);
+
+	BEGIN_RING(evo, 0, NV50_EVO_CRTC(nv_crtc->index, DISPLAY_START), 5);
+	OUT_RING(evo, 0);
+	OUT_RING(evo, (adjusted_mode->vtotal << 16) | adjusted_mode->htotal);
+	OUT_RING(evo, (vsync_dur - 1) << 16 | (hsync_dur - 1));
+	OUT_RING(evo, (vsync_start_to_end - 1) << 16 |
+			(hsync_start_to_end - 1));
+	OUT_RING(evo, (vunk1 - 1) << 16 | (hunk1 - 1));
+
+	if (adjusted_mode->flags & DRM_MODE_FLAG_INTERLACE) {
+		BEGIN_RING(evo, 0, NV50_EVO_CRTC(nv_crtc->index, UNK0824), 1);
+		OUT_RING(evo, (vunk2b - 1) << 16 | (vunk2a - 1));
+	} else {
+		OUT_RING(evo, 0);
+		OUT_RING(evo, 0);
+	}
+
+	BEGIN_RING(evo, 0, NV50_EVO_CRTC(nv_crtc->index, UNK082C), 1);
+	OUT_RING(evo, 0);
+
+	/* This is the actual resolution of the mode. */
+	BEGIN_RING(evo, 0, NV50_EVO_CRTC(nv_crtc->index, REAL_RES), 1);
+	OUT_RING(evo, (mode->vdisplay << 16) | mode->hdisplay);
+	BEGIN_RING(evo, 0, NV50_EVO_CRTC(nv_crtc->index, SCALE_CENTER_OFFSET), 1);
+	OUT_RING(evo, NV50_EVO_CRTC_SCALE_CENTER_OFFSET_VAL(0, 0));
+
+	nv_crtc->set_dither(nv_crtc, nv_connector->use_dithering, false);
+	nv_crtc->set_scale(nv_crtc, nv_connector->scaling_mode, false);
+
+	return nv50_crtc_do_mode_set_base(crtc, x, y, old_fb, false);
+}
+
+static int
+nv50_crtc_mode_set_base(struct drm_crtc *crtc, int x, int y,
+			struct drm_framebuffer *old_fb)
+{
+	return nv50_crtc_do_mode_set_base(crtc, x, y, old_fb, true);
+}
+
+static const struct drm_crtc_helper_funcs nv50_crtc_helper_funcs = {
+	.dpms = nv50_crtc_dpms,
+	.prepare = nv50_crtc_prepare,
+	.commit = nv50_crtc_commit,
+	.mode_fixup = nv50_crtc_mode_fixup,
+	.mode_set = nv50_crtc_mode_set,
+	.mode_set_base = nv50_crtc_mode_set_base,
+	.load_lut = nv50_crtc_lut_load,
+};
+
+int
+nv50_crtc_create(struct drm_device *dev, int index)
+{
+	struct nouveau_crtc *nv_crtc = NULL;
+	int ret, i;
+
+	NV_DEBUG_KMS(dev, "\n");
+
+	nv_crtc = kzalloc(sizeof(*nv_crtc), GFP_KERNEL);
+	if (!nv_crtc)
+		return -ENOMEM;
+
+	nv_crtc->mode = kzalloc(sizeof(*nv_crtc->mode), GFP_KERNEL);
+	if (!nv_crtc->mode) {
+		kfree(nv_crtc);
+		return -ENOMEM;
+	}
+
+	/* Default CLUT parameters, will be activated on the hw upon
+	 * first mode set.
+	 */
+	for (i = 0; i < 256; i++) {
+		nv_crtc->lut.r[i] = i << 8;
+		nv_crtc->lut.g[i] = i << 8;
+		nv_crtc->lut.b[i] = i << 8;
+	}
+	nv_crtc->lut.depth = 0;
+
+	ret = nouveau_bo_new(dev, NULL, 4096, 0x100, TTM_PL_FLAG_VRAM,
+			     0, 0x0000, false, true, &nv_crtc->lut.nvbo);
+	if (!ret) {
+		ret = nouveau_bo_pin(nv_crtc->lut.nvbo, TTM_PL_FLAG_VRAM);
+		if (!ret)
+			ret = nouveau_bo_map(nv_crtc->lut.nvbo);
+		if (ret)
+			nouveau_bo_ref(NULL, &nv_crtc->lut.nvbo);
+	}
+
+	if (ret) {
+		kfree(nv_crtc->mode);
+		kfree(nv_crtc);
+		return ret;
+	}
+
+	nv_crtc->index = index;
+
+	/* set function pointers */
+	nv_crtc->set_dither = nv50_crtc_set_dither;
+	nv_crtc->set_scale = nv50_crtc_set_scale;
+
+	drm_crtc_init(dev, &nv_crtc->base, &nv50_crtc_funcs);
+	drm_crtc_helper_add(&nv_crtc->base, &nv50_crtc_helper_funcs);
+	drm_mode_crtc_set_gamma_size(&nv_crtc->base, 256);
+
+	ret = nouveau_bo_new(dev, NULL, 64*64*4, 0x100, TTM_PL_FLAG_VRAM,
+			     0, 0x0000, false, true, &nv_crtc->cursor.nvbo);
+	if (!ret) {
+		ret = nouveau_bo_pin(nv_crtc->cursor.nvbo, TTM_PL_FLAG_VRAM);
+		if (!ret)
+			ret = nouveau_bo_map(nv_crtc->cursor.nvbo);
+		if (ret)
+			nouveau_bo_ref(NULL, &nv_crtc->cursor.nvbo);
+	}
+
+	nv50_cursor_init(nv_crtc);
+	return 0;
+}
diff --git a/drivers/gpu/drm/nouveau/nv50_cursor.c b/drivers/gpu/drm/nouveau/nv50_cursor.c
new file mode 100644
index 000000000000..753e723adb3a
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nv50_cursor.c
@@ -0,0 +1,156 @@
+/*
+ * Copyright (C) 2008 Maarten Maathuis.
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial
+ * portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE COPYRIGHT OWNER(S) AND/OR ITS SUPPLIERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
+#include "drmP.h"
+#include "drm_mode.h"
+
+#define NOUVEAU_DMA_DEBUG (nouveau_reg_debug & NOUVEAU_REG_DEBUG_EVO)
+#include "nouveau_reg.h"
+#include "nouveau_drv.h"
+#include "nouveau_crtc.h"
+#include "nv50_display.h"
+
+static void
+nv50_cursor_show(struct nouveau_crtc *nv_crtc, bool update)
+{
+	struct drm_nouveau_private *dev_priv = nv_crtc->base.dev->dev_private;
+	struct nouveau_channel *evo = dev_priv->evo;
+	struct drm_device *dev = nv_crtc->base.dev;
+	int ret;
+
+	NV_DEBUG_KMS(dev, "\n");
+
+	if (update && nv_crtc->cursor.visible)
+		return;
+
+	ret = RING_SPACE(evo, (dev_priv->chipset != 0x50 ? 5 : 3) + update * 2);
+	if (ret) {
+		NV_ERROR(dev, "no space while unhiding cursor\n");
+		return;
+	}
+
+	if (dev_priv->chipset != 0x50) {
+		BEGIN_RING(evo, 0, NV84_EVO_CRTC(nv_crtc->index, CURSOR_DMA), 1);
+		OUT_RING(evo, NvEvoVRAM);
+	}
+	BEGIN_RING(evo, 0, NV50_EVO_CRTC(nv_crtc->index, CURSOR_CTRL), 2);
+	OUT_RING(evo, NV50_EVO_CRTC_CURSOR_CTRL_SHOW);
+	OUT_RING(evo, nv_crtc->cursor.offset >> 8);
+
+	if (update) {
+		BEGIN_RING(evo, 0, NV50_EVO_UPDATE, 1);
+		OUT_RING(evo, 0);
+		FIRE_RING(evo);
+		nv_crtc->cursor.visible = true;
+	}
+}
+
+static void
+nv50_cursor_hide(struct nouveau_crtc *nv_crtc, bool update)
+{
+	struct drm_nouveau_private *dev_priv = nv_crtc->base.dev->dev_private;
+	struct nouveau_channel *evo = dev_priv->evo;
+	struct drm_device *dev = nv_crtc->base.dev;
+	int ret;
+
+	NV_DEBUG_KMS(dev, "\n");
+
+	if (update && !nv_crtc->cursor.visible)
+		return;
+
+	ret = RING_SPACE(evo, (dev_priv->chipset != 0x50 ? 5 : 3) + update * 2);
+	if (ret) {
+		NV_ERROR(dev, "no space while hiding cursor\n");
+		return;
+	}
+	BEGIN_RING(evo, 0, NV50_EVO_CRTC(nv_crtc->index, CURSOR_CTRL), 2);
+	OUT_RING(evo, NV50_EVO_CRTC_CURSOR_CTRL_HIDE);
+	OUT_RING(evo, 0);
+	if (dev_priv->chipset != 0x50) {
+		BEGIN_RING(evo, 0, NV84_EVO_CRTC(nv_crtc->index, CURSOR_DMA), 1);
+		OUT_RING(evo, NV84_EVO_CRTC_CURSOR_DMA_HANDLE_NONE);
+	}
+
+	if (update) {
+		BEGIN_RING(evo, 0, NV50_EVO_UPDATE, 1);
+		OUT_RING(evo, 0);
+		FIRE_RING(evo);
+		nv_crtc->cursor.visible = false;
+	}
+}
+
+static void
+nv50_cursor_set_pos(struct nouveau_crtc *nv_crtc, int x, int y)
+{
+	struct drm_device *dev = nv_crtc->base.dev;
+
+	nv_wr32(dev, NV50_PDISPLAY_CURSOR_USER_POS(nv_crtc->index),
+		((y & 0xFFFF) << 16) | (x & 0xFFFF));
+	/* Needed to make the cursor move. */
+	nv_wr32(dev, NV50_PDISPLAY_CURSOR_USER_POS_CTRL(nv_crtc->index), 0);
+}
+
+static void
+nv50_cursor_set_offset(struct nouveau_crtc *nv_crtc, uint32_t offset)
+{
+	NV_DEBUG_KMS(nv_crtc->base.dev, "\n");
+	if (offset == nv_crtc->cursor.offset)
+		return;
+
+	nv_crtc->cursor.offset = offset;
+	if (nv_crtc->cursor.visible) {
+		nv_crtc->cursor.visible = false;
+		nv_crtc->cursor.show(nv_crtc, true);
+	}
+}
+
+int
+nv50_cursor_init(struct nouveau_crtc *nv_crtc)
+{
+	nv_crtc->cursor.set_offset = nv50_cursor_set_offset;
+	nv_crtc->cursor.set_pos = nv50_cursor_set_pos;
+	nv_crtc->cursor.hide = nv50_cursor_hide;
+	nv_crtc->cursor.show = nv50_cursor_show;
+	return 0;
+}
+
+void
+nv50_cursor_fini(struct nouveau_crtc *nv_crtc)
+{
+	struct drm_device *dev = nv_crtc->base.dev;
+	int idx = nv_crtc->index;
+
+	NV_DEBUG_KMS(dev, "\n");
+
+	nv_wr32(dev, NV50_PDISPLAY_CURSOR_CURSOR_CTRL2(idx), 0);
+	if (!nv_wait(NV50_PDISPLAY_CURSOR_CURSOR_CTRL2(idx),
+		     NV50_PDISPLAY_CURSOR_CURSOR_CTRL2_STATUS, 0)) {
+		NV_ERROR(dev, "timeout: CURSOR_CTRL2_STATUS == 0\n");
+		NV_ERROR(dev, "CURSOR_CTRL2 = 0x%08x\n",
+			 nv_rd32(dev, NV50_PDISPLAY_CURSOR_CURSOR_CTRL2(idx)));
+	}
+}
+
diff --git a/drivers/gpu/drm/nouveau/nv50_dac.c b/drivers/gpu/drm/nouveau/nv50_dac.c
new file mode 100644
index 000000000000..f08f042a8e10
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nv50_dac.c
@@ -0,0 +1,304 @@
+/*
+ * Copyright (C) 2008 Maarten Maathuis.
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial
+ * portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE COPYRIGHT OWNER(S) AND/OR ITS SUPPLIERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
+#include "drmP.h"
+#include "drm_crtc_helper.h"
+
+#define NOUVEAU_DMA_DEBUG (nouveau_reg_debug & NOUVEAU_REG_DEBUG_EVO)
+#include "nouveau_reg.h"
+#include "nouveau_drv.h"
+#include "nouveau_dma.h"
+#include "nouveau_encoder.h"
+#include "nouveau_connector.h"
+#include "nouveau_crtc.h"
+#include "nv50_display.h"
+
+static void
+nv50_dac_disconnect(struct nouveau_encoder *nv_encoder)
+{
+	struct drm_device *dev = to_drm_encoder(nv_encoder)->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_channel *evo = dev_priv->evo;
+	int ret;
+
+	NV_DEBUG_KMS(dev, "Disconnecting DAC %d\n", nv_encoder->or);
+
+	ret = RING_SPACE(evo, 2);
+	if (ret) {
+		NV_ERROR(dev, "no space while disconnecting DAC\n");
+		return;
+	}
+	BEGIN_RING(evo, 0, NV50_EVO_DAC(nv_encoder->or, MODE_CTRL), 1);
+	OUT_RING(evo, 0);
+}
+
+static enum drm_connector_status
+nv50_dac_detect(struct drm_encoder *encoder, struct drm_connector *connector)
+{
+	struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
+	struct drm_device *dev = encoder->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	enum drm_connector_status status = connector_status_disconnected;
+	uint32_t dpms_state, load_pattern, load_state;
+	int or = nv_encoder->or;
+
+	nv_wr32(dev, NV50_PDISPLAY_DAC_CLK_CTRL1(or), 0x00000001);
+	dpms_state = nv_rd32(dev, NV50_PDISPLAY_DAC_DPMS_CTRL(or));
+
+	nv_wr32(dev, NV50_PDISPLAY_DAC_DPMS_CTRL(or),
+		0x00150000 | NV50_PDISPLAY_DAC_DPMS_CTRL_PENDING);
+	if (!nv_wait(NV50_PDISPLAY_DAC_DPMS_CTRL(or),
+		     NV50_PDISPLAY_DAC_DPMS_CTRL_PENDING, 0)) {
+		NV_ERROR(dev, "timeout: DAC_DPMS_CTRL_PENDING(%d) == 0\n", or);
+		NV_ERROR(dev, "DAC_DPMS_CTRL(%d) = 0x%08x\n", or,
+			  nv_rd32(dev, NV50_PDISPLAY_DAC_DPMS_CTRL(or)));
+		return status;
+	}
+
+	/* Use bios provided value if possible. */
+	if (dev_priv->vbios->dactestval) {
+		load_pattern = dev_priv->vbios->dactestval;
+		NV_DEBUG_KMS(dev, "Using bios provided load_pattern of %d\n",
+			  load_pattern);
+	} else {
+		load_pattern = 340;
+		NV_DEBUG_KMS(dev, "Using default load_pattern of %d\n",
+			 load_pattern);
+	}
+
+	nv_wr32(dev, NV50_PDISPLAY_DAC_LOAD_CTRL(or),
+		NV50_PDISPLAY_DAC_LOAD_CTRL_ACTIVE | load_pattern);
+	mdelay(45); /* give it some time to process */
+	load_state = nv_rd32(dev, NV50_PDISPLAY_DAC_LOAD_CTRL(or));
+
+	nv_wr32(dev, NV50_PDISPLAY_DAC_LOAD_CTRL(or), 0);
+	nv_wr32(dev, NV50_PDISPLAY_DAC_DPMS_CTRL(or), dpms_state |
+		NV50_PDISPLAY_DAC_DPMS_CTRL_PENDING);
+
+	if ((load_state & NV50_PDISPLAY_DAC_LOAD_CTRL_PRESENT) ==
+			  NV50_PDISPLAY_DAC_LOAD_CTRL_PRESENT)
+		status = connector_status_connected;
+
+	if (status == connector_status_connected)
+		NV_DEBUG_KMS(dev, "Load was detected on output with or %d\n", or);
+	else
+		NV_DEBUG_KMS(dev, "Load was not detected on output with or %d\n", or);
+
+	return status;
+}
+
+static void
+nv50_dac_dpms(struct drm_encoder *encoder, int mode)
+{
+	struct drm_device *dev = encoder->dev;
+	struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
+	uint32_t val;
+	int or = nv_encoder->or;
+
+	NV_DEBUG_KMS(dev, "or %d mode %d\n", or, mode);
+
+	/* wait for it to be done */
+	if (!nv_wait(NV50_PDISPLAY_DAC_DPMS_CTRL(or),
+		     NV50_PDISPLAY_DAC_DPMS_CTRL_PENDING, 0)) {
+		NV_ERROR(dev, "timeout: DAC_DPMS_CTRL_PENDING(%d) == 0\n", or);
+		NV_ERROR(dev, "DAC_DPMS_CTRL(%d) = 0x%08x\n", or,
+			 nv_rd32(dev, NV50_PDISPLAY_DAC_DPMS_CTRL(or)));
+		return;
+	}
+
+	val = nv_rd32(dev, NV50_PDISPLAY_DAC_DPMS_CTRL(or)) & ~0x7F;
+
+	if (mode != DRM_MODE_DPMS_ON)
+		val |= NV50_PDISPLAY_DAC_DPMS_CTRL_BLANKED;
+
+	switch (mode) {
+	case DRM_MODE_DPMS_STANDBY:
+		val |= NV50_PDISPLAY_DAC_DPMS_CTRL_HSYNC_OFF;
+		break;
+	case DRM_MODE_DPMS_SUSPEND:
+		val |= NV50_PDISPLAY_DAC_DPMS_CTRL_VSYNC_OFF;
+		break;
+	case DRM_MODE_DPMS_OFF:
+		val |= NV50_PDISPLAY_DAC_DPMS_CTRL_OFF;
+		val |= NV50_PDISPLAY_DAC_DPMS_CTRL_HSYNC_OFF;
+		val |= NV50_PDISPLAY_DAC_DPMS_CTRL_VSYNC_OFF;
+		break;
+	default:
+		break;
+	}
+
+	nv_wr32(dev, NV50_PDISPLAY_DAC_DPMS_CTRL(or), val |
+		NV50_PDISPLAY_DAC_DPMS_CTRL_PENDING);
+}
+
+static void
+nv50_dac_save(struct drm_encoder *encoder)
+{
+	NV_ERROR(encoder->dev, "!!\n");
+}
+
+static void
+nv50_dac_restore(struct drm_encoder *encoder)
+{
+	NV_ERROR(encoder->dev, "!!\n");
+}
+
+static bool
+nv50_dac_mode_fixup(struct drm_encoder *encoder, struct drm_display_mode *mode,
+		    struct drm_display_mode *adjusted_mode)
+{
+	struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
+	struct nouveau_connector *connector;
+
+	NV_DEBUG_KMS(encoder->dev, "or %d\n", nv_encoder->or);
+
+	connector = nouveau_encoder_connector_get(nv_encoder);
+	if (!connector) {
+		NV_ERROR(encoder->dev, "Encoder has no connector\n");
+		return false;
+	}
+
+	if (connector->scaling_mode != DRM_MODE_SCALE_NONE &&
+	     connector->native_mode) {
+		int id = adjusted_mode->base.id;
+		*adjusted_mode = *connector->native_mode;
+		adjusted_mode->base.id = id;
+	}
+
+	return true;
+}
+
+static void
+nv50_dac_prepare(struct drm_encoder *encoder)
+{
+}
+
+static void
+nv50_dac_commit(struct drm_encoder *encoder)
+{
+}
+
+static void
+nv50_dac_mode_set(struct drm_encoder *encoder, struct drm_display_mode *mode,
+		  struct drm_display_mode *adjusted_mode)
+{
+	struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
+	struct drm_device *dev = encoder->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_channel *evo = dev_priv->evo;
+	struct nouveau_crtc *crtc = nouveau_crtc(encoder->crtc);
+	uint32_t mode_ctl = 0, mode_ctl2 = 0;
+	int ret;
+
+	NV_DEBUG_KMS(dev, "or %d\n", nv_encoder->or);
+
+	nv50_dac_dpms(encoder, DRM_MODE_DPMS_ON);
+
+	if (crtc->index == 1)
+		mode_ctl |= NV50_EVO_DAC_MODE_CTRL_CRTC1;
+	else
+		mode_ctl |= NV50_EVO_DAC_MODE_CTRL_CRTC0;
+
+	/* Lacking a working tv-out, this is not a 100% sure. */
+	if (nv_encoder->dcb->type == OUTPUT_ANALOG)
+		mode_ctl |= 0x40;
+	else
+	if (nv_encoder->dcb->type == OUTPUT_TV)
+		mode_ctl |= 0x100;
+
+	if (adjusted_mode->flags & DRM_MODE_FLAG_NHSYNC)
+		mode_ctl2 |= NV50_EVO_DAC_MODE_CTRL2_NHSYNC;
+
+	if (adjusted_mode->flags & DRM_MODE_FLAG_NVSYNC)
+		mode_ctl2 |= NV50_EVO_DAC_MODE_CTRL2_NVSYNC;
+
+	ret = RING_SPACE(evo, 3);
+	if (ret) {
+		NV_ERROR(dev, "no space while connecting DAC\n");
+		return;
+	}
+	BEGIN_RING(evo, 0, NV50_EVO_DAC(nv_encoder->or, MODE_CTRL), 2);
+	OUT_RING(evo, mode_ctl);
+	OUT_RING(evo, mode_ctl2);
+}
+
+static const struct drm_encoder_helper_funcs nv50_dac_helper_funcs = {
+	.dpms = nv50_dac_dpms,
+	.save = nv50_dac_save,
+	.restore = nv50_dac_restore,
+	.mode_fixup = nv50_dac_mode_fixup,
+	.prepare = nv50_dac_prepare,
+	.commit = nv50_dac_commit,
+	.mode_set = nv50_dac_mode_set,
+	.detect = nv50_dac_detect
+};
+
+static void
+nv50_dac_destroy(struct drm_encoder *encoder)
+{
+	struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
+
+	if (!encoder)
+		return;
+
+	NV_DEBUG_KMS(encoder->dev, "\n");
+
+	drm_encoder_cleanup(encoder);
+	kfree(nv_encoder);
+}
+
+static const struct drm_encoder_funcs nv50_dac_encoder_funcs = {
+	.destroy = nv50_dac_destroy,
+};
+
+int
+nv50_dac_create(struct drm_device *dev, struct dcb_entry *entry)
+{
+	struct nouveau_encoder *nv_encoder;
+	struct drm_encoder *encoder;
+
+	NV_DEBUG_KMS(dev, "\n");
+	NV_INFO(dev, "Detected a DAC output\n");
+
+	nv_encoder = kzalloc(sizeof(*nv_encoder), GFP_KERNEL);
+	if (!nv_encoder)
+		return -ENOMEM;
+	encoder = to_drm_encoder(nv_encoder);
+
+	nv_encoder->dcb = entry;
+	nv_encoder->or = ffs(entry->or) - 1;
+
+	nv_encoder->disconnect = nv50_dac_disconnect;
+
+	drm_encoder_init(dev, encoder, &nv50_dac_encoder_funcs,
+			 DRM_MODE_ENCODER_DAC);
+	drm_encoder_helper_add(encoder, &nv50_dac_helper_funcs);
+
+	encoder->possible_crtcs = entry->heads;
+	encoder->possible_clones = 0;
+	return 0;
+}
+
diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c
new file mode 100644
index 000000000000..90f0bf59fbcd
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nv50_display.c
@@ -0,0 +1,1032 @@
+/*
+ * Copyright (C) 2008 Maarten Maathuis.
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial
+ * portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE COPYRIGHT OWNER(S) AND/OR ITS SUPPLIERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
+#include "nv50_display.h"
+#include "nouveau_crtc.h"
+#include "nouveau_encoder.h"
+#include "nouveau_connector.h"
+#include "nouveau_fb.h"
+#include "drm_crtc_helper.h"
+
+static void
+nv50_evo_channel_del(struct nouveau_channel **pchan)
+{
+	struct nouveau_channel *chan = *pchan;
+
+	if (!chan)
+		return;
+	*pchan = NULL;
+
+	nouveau_gpuobj_channel_takedown(chan);
+	nouveau_bo_ref(NULL, &chan->pushbuf_bo);
+
+	if (chan->user)
+		iounmap(chan->user);
+
+	kfree(chan);
+}
+
+static int
+nv50_evo_dmaobj_new(struct nouveau_channel *evo, uint32_t class, uint32_t name,
+		    uint32_t tile_flags, uint32_t magic_flags,
+		    uint32_t offset, uint32_t limit)
+{
+	struct drm_nouveau_private *dev_priv = evo->dev->dev_private;
+	struct drm_device *dev = evo->dev;
+	struct nouveau_gpuobj *obj = NULL;
+	int ret;
+
+	ret = nouveau_gpuobj_new(dev, evo, 6*4, 32, 0, &obj);
+	if (ret)
+		return ret;
+	obj->engine = NVOBJ_ENGINE_DISPLAY;
+
+	ret = nouveau_gpuobj_ref_add(dev, evo, name, obj, NULL);
+	if (ret) {
+		nouveau_gpuobj_del(dev, &obj);
+		return ret;
+	}
+
+	dev_priv->engine.instmem.prepare_access(dev, true);
+	nv_wo32(dev, obj, 0, (tile_flags << 22) | (magic_flags << 16) | class);
+	nv_wo32(dev, obj, 1, limit);
+	nv_wo32(dev, obj, 2, offset);
+	nv_wo32(dev, obj, 3, 0x00000000);
+	nv_wo32(dev, obj, 4, 0x00000000);
+	nv_wo32(dev, obj, 5, 0x00010000);
+	dev_priv->engine.instmem.finish_access(dev);
+
+	return 0;
+}
+
+static int
+nv50_evo_channel_new(struct drm_device *dev, struct nouveau_channel **pchan)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_channel *chan;
+	int ret;
+
+	chan = kzalloc(sizeof(struct nouveau_channel), GFP_KERNEL);
+	if (!chan)
+		return -ENOMEM;
+	*pchan = chan;
+
+	chan->id = -1;
+	chan->dev = dev;
+	chan->user_get = 4;
+	chan->user_put = 0;
+
+	INIT_LIST_HEAD(&chan->ramht_refs);
+
+	ret = nouveau_gpuobj_new_ref(dev, NULL, NULL, 0, 32768, 0x1000,
+				     NVOBJ_FLAG_ZERO_ALLOC, &chan->ramin);
+	if (ret) {
+		NV_ERROR(dev, "Error allocating EVO channel memory: %d\n", ret);
+		nv50_evo_channel_del(pchan);
+		return ret;
+	}
+
+	ret = nouveau_mem_init_heap(&chan->ramin_heap, chan->ramin->gpuobj->
+				    im_pramin->start, 32768);
+	if (ret) {
+		NV_ERROR(dev, "Error initialising EVO PRAMIN heap: %d\n", ret);
+		nv50_evo_channel_del(pchan);
+		return ret;
+	}
+
+	ret = nouveau_gpuobj_new_ref(dev, chan, chan, 0, 4096, 16,
+				     0, &chan->ramht);
+	if (ret) {
+		NV_ERROR(dev, "Unable to allocate EVO RAMHT: %d\n", ret);
+		nv50_evo_channel_del(pchan);
+		return ret;
+	}
+
+	if (dev_priv->chipset != 0x50) {
+		ret = nv50_evo_dmaobj_new(chan, 0x3d, NvEvoFB16, 0x70, 0x19,
+					  0, 0xffffffff);
+		if (ret) {
+			nv50_evo_channel_del(pchan);
+			return ret;
+		}
+
+
+		ret = nv50_evo_dmaobj_new(chan, 0x3d, NvEvoFB32, 0x7a, 0x19,
+					  0, 0xffffffff);
+		if (ret) {
+			nv50_evo_channel_del(pchan);
+			return ret;
+		}
+	}
+
+	ret = nv50_evo_dmaobj_new(chan, 0x3d, NvEvoVRAM, 0, 0x19,
+				  0, nouveau_mem_fb_amount(dev));
+	if (ret) {
+		nv50_evo_channel_del(pchan);
+		return ret;
+	}
+
+	ret = nouveau_bo_new(dev, NULL, 4096, 0, TTM_PL_FLAG_VRAM, 0, 0,
+			     false, true, &chan->pushbuf_bo);
+	if (ret == 0)
+		ret = nouveau_bo_pin(chan->pushbuf_bo, TTM_PL_FLAG_VRAM);
+	if (ret) {
+		NV_ERROR(dev, "Error creating EVO DMA push buffer: %d\n", ret);
+		nv50_evo_channel_del(pchan);
+		return ret;
+	}
+
+	ret = nouveau_bo_map(chan->pushbuf_bo);
+	if (ret) {
+		NV_ERROR(dev, "Error mapping EVO DMA push buffer: %d\n", ret);
+		nv50_evo_channel_del(pchan);
+		return ret;
+	}
+
+	chan->user = ioremap(pci_resource_start(dev->pdev, 0) +
+					NV50_PDISPLAY_USER(0), PAGE_SIZE);
+	if (!chan->user) {
+		NV_ERROR(dev, "Error mapping EVO control regs.\n");
+		nv50_evo_channel_del(pchan);
+		return -ENOMEM;
+	}
+
+	return 0;
+}
+
+int
+nv50_display_init(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_timer_engine *ptimer = &dev_priv->engine.timer;
+	struct nouveau_channel *evo = dev_priv->evo;
+	struct drm_connector *connector;
+	uint32_t val, ram_amount, hpd_en[2];
+	uint64_t start;
+	int ret, i;
+
+	NV_DEBUG_KMS(dev, "\n");
+
+	nv_wr32(dev, 0x00610184, nv_rd32(dev, 0x00614004));
+	/*
+	 * I think the 0x006101XX range is some kind of main control area
+	 * that enables things.
+	 */
+	/* CRTC? */
+	for (i = 0; i < 2; i++) {
+		val = nv_rd32(dev, 0x00616100 + (i * 0x800));
+		nv_wr32(dev, 0x00610190 + (i * 0x10), val);
+		val = nv_rd32(dev, 0x00616104 + (i * 0x800));
+		nv_wr32(dev, 0x00610194 + (i * 0x10), val);
+		val = nv_rd32(dev, 0x00616108 + (i * 0x800));
+		nv_wr32(dev, 0x00610198 + (i * 0x10), val);
+		val = nv_rd32(dev, 0x0061610c + (i * 0x800));
+		nv_wr32(dev, 0x0061019c + (i * 0x10), val);
+	}
+	/* DAC */
+	for (i = 0; i < 3; i++) {
+		val = nv_rd32(dev, 0x0061a000 + (i * 0x800));
+		nv_wr32(dev, 0x006101d0 + (i * 0x04), val);
+	}
+	/* SOR */
+	for (i = 0; i < 4; i++) {
+		val = nv_rd32(dev, 0x0061c000 + (i * 0x800));
+		nv_wr32(dev, 0x006101e0 + (i * 0x04), val);
+	}
+	/* Something not yet in use, tv-out maybe. */
+	for (i = 0; i < 3; i++) {
+		val = nv_rd32(dev, 0x0061e000 + (i * 0x800));
+		nv_wr32(dev, 0x006101f0 + (i * 0x04), val);
+	}
+
+	for (i = 0; i < 3; i++) {
+		nv_wr32(dev, NV50_PDISPLAY_DAC_DPMS_CTRL(i), 0x00550000 |
+			NV50_PDISPLAY_DAC_DPMS_CTRL_PENDING);
+		nv_wr32(dev, NV50_PDISPLAY_DAC_CLK_CTRL1(i), 0x00000001);
+	}
+
+	/* This used to be in crtc unblank, but seems out of place there. */
+	nv_wr32(dev, NV50_PDISPLAY_UNK_380, 0);
+	/* RAM is clamped to 256 MiB. */
+	ram_amount = nouveau_mem_fb_amount(dev);
+	NV_DEBUG_KMS(dev, "ram_amount %d\n", ram_amount);
+	if (ram_amount > 256*1024*1024)
+		ram_amount = 256*1024*1024;
+	nv_wr32(dev, NV50_PDISPLAY_RAM_AMOUNT, ram_amount - 1);
+	nv_wr32(dev, NV50_PDISPLAY_UNK_388, 0x150000);
+	nv_wr32(dev, NV50_PDISPLAY_UNK_38C, 0);
+
+	/* The precise purpose is unknown, i suspect it has something to do
+	 * with text mode.
+	 */
+	if (nv_rd32(dev, NV50_PDISPLAY_INTR_1) & 0x100) {
+		nv_wr32(dev, NV50_PDISPLAY_INTR_1, 0x100);
+		nv_wr32(dev, 0x006194e8, nv_rd32(dev, 0x006194e8) & ~1);
+		if (!nv_wait(0x006194e8, 2, 0)) {
+			NV_ERROR(dev, "timeout: (0x6194e8 & 2) != 0\n");
+			NV_ERROR(dev, "0x6194e8 = 0x%08x\n",
+						nv_rd32(dev, 0x6194e8));
+			return -EBUSY;
+		}
+	}
+
+	/* taken from nv bug #12637, attempts to un-wedge the hw if it's
+	 * stuck in some unspecified state
+	 */
+	start = ptimer->read(dev);
+	nv_wr32(dev, NV50_PDISPLAY_CHANNEL_STAT(0), 0x2b00);
+	while ((val = nv_rd32(dev, NV50_PDISPLAY_CHANNEL_STAT(0))) & 0x1e0000) {
+		if ((val & 0x9f0000) == 0x20000)
+			nv_wr32(dev, NV50_PDISPLAY_CHANNEL_STAT(0),
+							val | 0x800000);
+
+		if ((val & 0x3f0000) == 0x30000)
+			nv_wr32(dev, NV50_PDISPLAY_CHANNEL_STAT(0),
+							val | 0x200000);
+
+		if (ptimer->read(dev) - start > 1000000000ULL) {
+			NV_ERROR(dev, "timeout: (0x610200 & 0x1e0000) != 0\n");
+			NV_ERROR(dev, "0x610200 = 0x%08x\n", val);
+			return -EBUSY;
+		}
+	}
+
+	nv_wr32(dev, NV50_PDISPLAY_CTRL_STATE, NV50_PDISPLAY_CTRL_STATE_ENABLE);
+	nv_wr32(dev, NV50_PDISPLAY_CHANNEL_STAT(0), 0x1000b03);
+	if (!nv_wait(NV50_PDISPLAY_CHANNEL_STAT(0), 0x40000000, 0x40000000)) {
+		NV_ERROR(dev, "timeout: (0x610200 & 0x40000000) == 0x40000000\n");
+		NV_ERROR(dev, "0x610200 = 0x%08x\n",
+			  nv_rd32(dev, NV50_PDISPLAY_CHANNEL_STAT(0)));
+		return -EBUSY;
+	}
+
+	for (i = 0; i < 2; i++) {
+		nv_wr32(dev, NV50_PDISPLAY_CURSOR_CURSOR_CTRL2(i), 0x2000);
+		if (!nv_wait(NV50_PDISPLAY_CURSOR_CURSOR_CTRL2(i),
+			     NV50_PDISPLAY_CURSOR_CURSOR_CTRL2_STATUS, 0)) {
+			NV_ERROR(dev, "timeout: CURSOR_CTRL2_STATUS == 0\n");
+			NV_ERROR(dev, "CURSOR_CTRL2 = 0x%08x\n",
+				 nv_rd32(dev, NV50_PDISPLAY_CURSOR_CURSOR_CTRL2(i)));
+			return -EBUSY;
+		}
+
+		nv_wr32(dev, NV50_PDISPLAY_CURSOR_CURSOR_CTRL2(i),
+			NV50_PDISPLAY_CURSOR_CURSOR_CTRL2_ON);
+		if (!nv_wait(NV50_PDISPLAY_CURSOR_CURSOR_CTRL2(i),
+			     NV50_PDISPLAY_CURSOR_CURSOR_CTRL2_STATUS,
+			     NV50_PDISPLAY_CURSOR_CURSOR_CTRL2_STATUS_ACTIVE)) {
+			NV_ERROR(dev, "timeout: "
+				      "CURSOR_CTRL2_STATUS_ACTIVE(%d)\n", i);
+			NV_ERROR(dev, "CURSOR_CTRL2(%d) = 0x%08x\n", i,
+				 nv_rd32(dev, NV50_PDISPLAY_CURSOR_CURSOR_CTRL2(i)));
+			return -EBUSY;
+		}
+	}
+
+	nv_wr32(dev, NV50_PDISPLAY_OBJECTS, (evo->ramin->instance >> 8) | 9);
+
+	/* initialise fifo */
+	nv_wr32(dev, NV50_PDISPLAY_CHANNEL_DMA_CB(0),
+		((evo->pushbuf_bo->bo.mem.mm_node->start << PAGE_SHIFT) >> 8) |
+		NV50_PDISPLAY_CHANNEL_DMA_CB_LOCATION_VRAM |
+		NV50_PDISPLAY_CHANNEL_DMA_CB_VALID);
+	nv_wr32(dev, NV50_PDISPLAY_CHANNEL_UNK2(0), 0x00010000);
+	nv_wr32(dev, NV50_PDISPLAY_CHANNEL_UNK3(0), 0x00000002);
+	if (!nv_wait(0x610200, 0x80000000, 0x00000000)) {
+		NV_ERROR(dev, "timeout: (0x610200 & 0x80000000) == 0\n");
+		NV_ERROR(dev, "0x610200 = 0x%08x\n", nv_rd32(dev, 0x610200));
+		return -EBUSY;
+	}
+	nv_wr32(dev, NV50_PDISPLAY_CHANNEL_STAT(0),
+		(nv_rd32(dev, NV50_PDISPLAY_CHANNEL_STAT(0)) & ~0x00000003) |
+		 NV50_PDISPLAY_CHANNEL_STAT_DMA_ENABLED);
+	nv_wr32(dev, NV50_PDISPLAY_USER_PUT(0), 0);
+	nv_wr32(dev, NV50_PDISPLAY_CHANNEL_STAT(0), 0x01000003 |
+		NV50_PDISPLAY_CHANNEL_STAT_DMA_ENABLED);
+	nv_wr32(dev, 0x610300, nv_rd32(dev, 0x610300) & ~1);
+
+	evo->dma.max = (4096/4) - 2;
+	evo->dma.put = 0;
+	evo->dma.cur = evo->dma.put;
+	evo->dma.free = evo->dma.max - evo->dma.cur;
+
+	ret = RING_SPACE(evo, NOUVEAU_DMA_SKIPS);
+	if (ret)
+		return ret;
+
+	for (i = 0; i < NOUVEAU_DMA_SKIPS; i++)
+		OUT_RING(evo, 0);
+
+	ret = RING_SPACE(evo, 11);
+	if (ret)
+		return ret;
+	BEGIN_RING(evo, 0, NV50_EVO_UNK84, 2);
+	OUT_RING(evo, NV50_EVO_UNK84_NOTIFY_DISABLED);
+	OUT_RING(evo, NV50_EVO_DMA_NOTIFY_HANDLE_NONE);
+	BEGIN_RING(evo, 0, NV50_EVO_CRTC(0, FB_DMA), 1);
+	OUT_RING(evo, NV50_EVO_CRTC_FB_DMA_HANDLE_NONE);
+	BEGIN_RING(evo, 0, NV50_EVO_CRTC(0, UNK0800), 1);
+	OUT_RING(evo, 0);
+	BEGIN_RING(evo, 0, NV50_EVO_CRTC(0, DISPLAY_START), 1);
+	OUT_RING(evo, 0);
+	BEGIN_RING(evo, 0, NV50_EVO_CRTC(0, UNK082C), 1);
+	OUT_RING(evo, 0);
+	FIRE_RING(evo);
+	if (!nv_wait(0x640004, 0xffffffff, evo->dma.put << 2))
+		NV_ERROR(dev, "evo pushbuf stalled\n");
+
+	/* enable clock change interrupts. */
+	nv_wr32(dev, 0x610028, 0x00010001);
+	nv_wr32(dev, NV50_PDISPLAY_INTR_EN, (NV50_PDISPLAY_INTR_EN_CLK_UNK10 |
+					     NV50_PDISPLAY_INTR_EN_CLK_UNK20 |
+					     NV50_PDISPLAY_INTR_EN_CLK_UNK40));
+
+	/* enable hotplug interrupts */
+	hpd_en[0] = hpd_en[1] = 0;
+	list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+		struct nouveau_connector *conn = nouveau_connector(connector);
+		struct dcb_gpio_entry *gpio;
+
+		if (connector->connector_type != DRM_MODE_CONNECTOR_DVII &&
+		    connector->connector_type != DRM_MODE_CONNECTOR_DVID &&
+		    connector->connector_type != DRM_MODE_CONNECTOR_DisplayPort)
+			continue;
+
+		gpio = nouveau_bios_gpio_entry(dev, conn->dcb->gpio_tag);
+		if (!gpio)
+			continue;
+
+		hpd_en[gpio->line >> 4] |= (0x00010001 << (gpio->line & 0xf));
+	}
+
+	nv_wr32(dev, 0xe054, 0xffffffff);
+	nv_wr32(dev, 0xe050, hpd_en[0]);
+	if (dev_priv->chipset >= 0x90) {
+		nv_wr32(dev, 0xe074, 0xffffffff);
+		nv_wr32(dev, 0xe070, hpd_en[1]);
+	}
+
+	return 0;
+}
+
+static int nv50_display_disable(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct drm_crtc *drm_crtc;
+	int ret, i;
+
+	NV_DEBUG_KMS(dev, "\n");
+
+	list_for_each_entry(drm_crtc, &dev->mode_config.crtc_list, head) {
+		struct nouveau_crtc *crtc = nouveau_crtc(drm_crtc);
+
+		nv50_crtc_blank(crtc, true);
+	}
+
+	ret = RING_SPACE(dev_priv->evo, 2);
+	if (ret == 0) {
+		BEGIN_RING(dev_priv->evo, 0, NV50_EVO_UPDATE, 1);
+		OUT_RING(dev_priv->evo, 0);
+	}
+	FIRE_RING(dev_priv->evo);
+
+	/* Almost like ack'ing a vblank interrupt, maybe in the spirit of
+	 * cleaning up?
+	 */
+	list_for_each_entry(drm_crtc, &dev->mode_config.crtc_list, head) {
+		struct nouveau_crtc *crtc = nouveau_crtc(drm_crtc);
+		uint32_t mask = NV50_PDISPLAY_INTR_1_VBLANK_CRTC_(crtc->index);
+
+		if (!crtc->base.enabled)
+			continue;
+
+		nv_wr32(dev, NV50_PDISPLAY_INTR_1, mask);
+		if (!nv_wait(NV50_PDISPLAY_INTR_1, mask, mask)) {
+			NV_ERROR(dev, "timeout: (0x610024 & 0x%08x) == "
+				      "0x%08x\n", mask, mask);
+			NV_ERROR(dev, "0x610024 = 0x%08x\n",
+				 nv_rd32(dev, NV50_PDISPLAY_INTR_1));
+		}
+	}
+
+	nv_wr32(dev, NV50_PDISPLAY_CHANNEL_STAT(0), 0);
+	nv_wr32(dev, NV50_PDISPLAY_CTRL_STATE, 0);
+	if (!nv_wait(NV50_PDISPLAY_CHANNEL_STAT(0), 0x1e0000, 0)) {
+		NV_ERROR(dev, "timeout: (0x610200 & 0x1e0000) == 0\n");
+		NV_ERROR(dev, "0x610200 = 0x%08x\n",
+			  nv_rd32(dev, NV50_PDISPLAY_CHANNEL_STAT(0)));
+	}
+
+	for (i = 0; i < 3; i++) {
+		if (!nv_wait(NV50_PDISPLAY_SOR_DPMS_STATE(i),
+			     NV50_PDISPLAY_SOR_DPMS_STATE_WAIT, 0)) {
+			NV_ERROR(dev, "timeout: SOR_DPMS_STATE_WAIT(%d) == 0\n", i);
+			NV_ERROR(dev, "SOR_DPMS_STATE(%d) = 0x%08x\n", i,
+				  nv_rd32(dev, NV50_PDISPLAY_SOR_DPMS_STATE(i)));
+		}
+	}
+
+	/* disable interrupts. */
+	nv_wr32(dev, NV50_PDISPLAY_INTR_EN, 0x00000000);
+
+	/* disable hotplug interrupts */
+	nv_wr32(dev, 0xe054, 0xffffffff);
+	nv_wr32(dev, 0xe050, 0x00000000);
+	if (dev_priv->chipset >= 0x90) {
+		nv_wr32(dev, 0xe074, 0xffffffff);
+		nv_wr32(dev, 0xe070, 0x00000000);
+	}
+	return 0;
+}
+
+int nv50_display_create(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct parsed_dcb *dcb = dev_priv->vbios->dcb;
+	uint32_t connector[16] = {};
+	int ret, i;
+
+	NV_DEBUG_KMS(dev, "\n");
+
+	/* init basic kernel modesetting */
+	drm_mode_config_init(dev);
+
+	/* Initialise some optional connector properties. */
+	drm_mode_create_scaling_mode_property(dev);
+	drm_mode_create_dithering_property(dev);
+
+	dev->mode_config.min_width = 0;
+	dev->mode_config.min_height = 0;
+
+	dev->mode_config.funcs = (void *)&nouveau_mode_config_funcs;
+
+	dev->mode_config.max_width = 8192;
+	dev->mode_config.max_height = 8192;
+
+	dev->mode_config.fb_base = dev_priv->fb_phys;
+
+	/* Create EVO channel */
+	ret = nv50_evo_channel_new(dev, &dev_priv->evo);
+	if (ret) {
+		NV_ERROR(dev, "Error creating EVO channel: %d\n", ret);
+		return ret;
+	}
+
+	/* Create CRTC objects */
+	for (i = 0; i < 2; i++)
+		nv50_crtc_create(dev, i);
+
+	/* We setup the encoders from the BIOS table */
+	for (i = 0 ; i < dcb->entries; i++) {
+		struct dcb_entry *entry = &dcb->entry[i];
+
+		if (entry->location != DCB_LOC_ON_CHIP) {
+			NV_WARN(dev, "Off-chip encoder %d/%d unsupported\n",
+				entry->type, ffs(entry->or) - 1);
+			continue;
+		}
+
+		switch (entry->type) {
+		case OUTPUT_TMDS:
+		case OUTPUT_LVDS:
+		case OUTPUT_DP:
+			nv50_sor_create(dev, entry);
+			break;
+		case OUTPUT_ANALOG:
+			nv50_dac_create(dev, entry);
+			break;
+		default:
+			NV_WARN(dev, "DCB encoder %d unknown\n", entry->type);
+			continue;
+		}
+
+		connector[entry->connector] |= (1 << entry->type);
+	}
+
+	/* It appears that DCB 3.0+ VBIOS has a connector table, however,
+	 * I'm not 100% certain how to decode it correctly yet so just
+	 * look at what encoders are present on each connector index and
+	 * attempt to derive the connector type from that.
+	 */
+	for (i = 0 ; i < dcb->entries; i++) {
+		struct dcb_entry *entry = &dcb->entry[i];
+		uint16_t encoders;
+		int type;
+
+		encoders = connector[entry->connector];
+		if (!(encoders & (1 << entry->type)))
+			continue;
+		connector[entry->connector] = 0;
+
+		if (encoders & (1 << OUTPUT_DP)) {
+			type = DRM_MODE_CONNECTOR_DisplayPort;
+		} else if (encoders & (1 << OUTPUT_TMDS)) {
+			if (encoders & (1 << OUTPUT_ANALOG))
+				type = DRM_MODE_CONNECTOR_DVII;
+			else
+				type = DRM_MODE_CONNECTOR_DVID;
+		} else if (encoders & (1 << OUTPUT_ANALOG)) {
+			type = DRM_MODE_CONNECTOR_VGA;
+		} else if (encoders & (1 << OUTPUT_LVDS)) {
+			type = DRM_MODE_CONNECTOR_LVDS;
+		} else {
+			type = DRM_MODE_CONNECTOR_Unknown;
+		}
+
+		if (type == DRM_MODE_CONNECTOR_Unknown)
+			continue;
+
+		nouveau_connector_create(dev, entry->connector, type);
+	}
+
+	ret = nv50_display_init(dev);
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+int nv50_display_destroy(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+
+	NV_DEBUG_KMS(dev, "\n");
+
+	drm_mode_config_cleanup(dev);
+
+	nv50_display_disable(dev);
+	nv50_evo_channel_del(&dev_priv->evo);
+
+	return 0;
+}
+
+static inline uint32_t
+nv50_display_mode_ctrl(struct drm_device *dev, bool sor, int or)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	uint32_t mc;
+
+	if (sor) {
+		if (dev_priv->chipset < 0x90 ||
+		    dev_priv->chipset == 0x92 || dev_priv->chipset == 0xa0)
+			mc = nv_rd32(dev, NV50_PDISPLAY_SOR_MODE_CTRL_P(or));
+		else
+			mc = nv_rd32(dev, NV90_PDISPLAY_SOR_MODE_CTRL_P(or));
+	} else {
+		mc = nv_rd32(dev, NV50_PDISPLAY_DAC_MODE_CTRL_P(or));
+	}
+
+	return mc;
+}
+
+static int
+nv50_display_irq_head(struct drm_device *dev, int *phead,
+		      struct dcb_entry **pdcbent)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	uint32_t unk30 = nv_rd32(dev, NV50_PDISPLAY_UNK30_CTRL);
+	uint32_t dac = 0, sor = 0;
+	int head, i, or = 0, type = OUTPUT_ANY;
+
+	/* We're assuming that head 0 *or* head 1 will be active here,
+	 * and not both.  I'm not sure if the hw will even signal both
+	 * ever, but it definitely shouldn't for us as we commit each
+	 * CRTC separately, and submission will be blocked by the GPU
+	 * until we handle each in turn.
+	 */
+	NV_DEBUG_KMS(dev, "0x610030: 0x%08x\n", unk30);
+	head = ffs((unk30 >> 9) & 3) - 1;
+	if (head < 0)
+		return -EINVAL;
+
+	/* This assumes CRTCs are never bound to multiple encoders, which
+	 * should be the case.
+	 */
+	for (i = 0; i < 3 && type == OUTPUT_ANY; i++) {
+		uint32_t mc = nv50_display_mode_ctrl(dev, false, i);
+		if (!(mc & (1 << head)))
+			continue;
+
+		switch ((mc >> 8) & 0xf) {
+		case 0: type = OUTPUT_ANALOG; break;
+		case 1: type = OUTPUT_TV; break;
+		default:
+			NV_ERROR(dev, "unknown dac mode_ctrl: 0x%08x\n", dac);
+			return -1;
+		}
+
+		or = i;
+	}
+
+	for (i = 0; i < 4 && type == OUTPUT_ANY; i++) {
+		uint32_t mc = nv50_display_mode_ctrl(dev, true, i);
+		if (!(mc & (1 << head)))
+			continue;
+
+		switch ((mc >> 8) & 0xf) {
+		case 0: type = OUTPUT_LVDS; break;
+		case 1: type = OUTPUT_TMDS; break;
+		case 2: type = OUTPUT_TMDS; break;
+		case 5: type = OUTPUT_TMDS; break;
+		case 8: type = OUTPUT_DP; break;
+		case 9: type = OUTPUT_DP; break;
+		default:
+			NV_ERROR(dev, "unknown sor mode_ctrl: 0x%08x\n", sor);
+			return -1;
+		}
+
+		or = i;
+	}
+
+	NV_DEBUG_KMS(dev, "type %d, or %d\n", type, or);
+	if (type == OUTPUT_ANY) {
+		NV_ERROR(dev, "unknown encoder!!\n");
+		return -1;
+	}
+
+	for (i = 0; i < dev_priv->vbios->dcb->entries; i++) {
+		struct dcb_entry *dcbent = &dev_priv->vbios->dcb->entry[i];
+
+		if (dcbent->type != type)
+			continue;
+
+		if (!(dcbent->or & (1 << or)))
+			continue;
+
+		*phead = head;
+		*pdcbent = dcbent;
+		return 0;
+	}
+
+	NV_ERROR(dev, "no DCB entry for %d %d\n", dac != 0, or);
+	return 0;
+}
+
+static uint32_t
+nv50_display_script_select(struct drm_device *dev, struct dcb_entry *dcbent,
+			   int pxclk)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_connector *nv_connector = NULL;
+	struct drm_encoder *encoder;
+	struct nvbios *bios = &dev_priv->VBIOS;
+	uint32_t mc, script = 0, or;
+
+	list_for_each_entry(encoder, &dev->mode_config.encoder_list, head) {
+		struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
+
+		if (nv_encoder->dcb != dcbent)
+			continue;
+
+		nv_connector = nouveau_encoder_connector_get(nv_encoder);
+		break;
+	}
+
+	or = ffs(dcbent->or) - 1;
+	mc = nv50_display_mode_ctrl(dev, dcbent->type != OUTPUT_ANALOG, or);
+	switch (dcbent->type) {
+	case OUTPUT_LVDS:
+		script = (mc >> 8) & 0xf;
+		if (bios->pub.fp_no_ddc) {
+			if (bios->fp.dual_link)
+				script |= 0x0100;
+			if (bios->fp.if_is_24bit)
+				script |= 0x0200;
+		} else {
+			if (pxclk >= bios->fp.duallink_transition_clk) {
+				script |= 0x0100;
+				if (bios->fp.strapless_is_24bit & 2)
+					script |= 0x0200;
+			} else
+			if (bios->fp.strapless_is_24bit & 1)
+				script |= 0x0200;
+
+			if (nv_connector && nv_connector->edid &&
+			    (nv_connector->edid->revision >= 4) &&
+			    (nv_connector->edid->input & 0x70) >= 0x20)
+				script |= 0x0200;
+		}
+
+		if (nouveau_uscript_lvds >= 0) {
+			NV_INFO(dev, "override script 0x%04x with 0x%04x "
+				     "for output LVDS-%d\n", script,
+				     nouveau_uscript_lvds, or);
+			script = nouveau_uscript_lvds;
+		}
+		break;
+	case OUTPUT_TMDS:
+		script = (mc >> 8) & 0xf;
+		if (pxclk >= 165000)
+			script |= 0x0100;
+
+		if (nouveau_uscript_tmds >= 0) {
+			NV_INFO(dev, "override script 0x%04x with 0x%04x "
+				     "for output TMDS-%d\n", script,
+				     nouveau_uscript_tmds, or);
+			script = nouveau_uscript_tmds;
+		}
+		break;
+	case OUTPUT_DP:
+		script = (mc >> 8) & 0xf;
+		break;
+	case OUTPUT_ANALOG:
+		script = 0xff;
+		break;
+	default:
+		NV_ERROR(dev, "modeset on unsupported output type!\n");
+		break;
+	}
+
+	return script;
+}
+
+static void
+nv50_display_vblank_crtc_handler(struct drm_device *dev, int crtc)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_channel *chan;
+	struct list_head *entry, *tmp;
+
+	list_for_each_safe(entry, tmp, &dev_priv->vbl_waiting) {
+		chan = list_entry(entry, struct nouveau_channel, nvsw.vbl_wait);
+
+		nouveau_bo_wr32(chan->notifier_bo, chan->nvsw.vblsem_offset,
+						chan->nvsw.vblsem_rval);
+		list_del(&chan->nvsw.vbl_wait);
+	}
+}
+
+static void
+nv50_display_vblank_handler(struct drm_device *dev, uint32_t intr)
+{
+	intr &= NV50_PDISPLAY_INTR_1_VBLANK_CRTC;
+
+	if (intr & NV50_PDISPLAY_INTR_1_VBLANK_CRTC_0)
+		nv50_display_vblank_crtc_handler(dev, 0);
+
+	if (intr & NV50_PDISPLAY_INTR_1_VBLANK_CRTC_1)
+		nv50_display_vblank_crtc_handler(dev, 1);
+
+	nv_wr32(dev, NV50_PDISPLAY_INTR_EN, nv_rd32(dev,
+		     NV50_PDISPLAY_INTR_EN) & ~intr);
+	nv_wr32(dev, NV50_PDISPLAY_INTR_1, intr);
+}
+
+static void
+nv50_display_unk10_handler(struct drm_device *dev)
+{
+	struct dcb_entry *dcbent;
+	int head, ret;
+
+	ret = nv50_display_irq_head(dev, &head, &dcbent);
+	if (ret)
+		goto ack;
+
+	nv_wr32(dev, 0x619494, nv_rd32(dev, 0x619494) & ~8);
+
+	nouveau_bios_run_display_table(dev, dcbent, 0, -1);
+
+ack:
+	nv_wr32(dev, NV50_PDISPLAY_INTR_1, NV50_PDISPLAY_INTR_1_CLK_UNK10);
+	nv_wr32(dev, 0x610030, 0x80000000);
+}
+
+static void
+nv50_display_unk20_handler(struct drm_device *dev)
+{
+	struct dcb_entry *dcbent;
+	uint32_t tmp, pclk, script;
+	int head, or, ret;
+
+	ret = nv50_display_irq_head(dev, &head, &dcbent);
+	if (ret)
+		goto ack;
+	or = ffs(dcbent->or) - 1;
+	pclk = nv_rd32(dev, NV50_PDISPLAY_CRTC_P(head, CLOCK)) & 0x3fffff;
+	script = nv50_display_script_select(dev, dcbent, pclk);
+
+	NV_DEBUG_KMS(dev, "head %d pxclk: %dKHz\n", head, pclk);
+
+	if (dcbent->type != OUTPUT_DP)
+		nouveau_bios_run_display_table(dev, dcbent, 0, -2);
+
+	nv50_crtc_set_clock(dev, head, pclk);
+
+	nouveau_bios_run_display_table(dev, dcbent, script, pclk);
+
+	tmp = nv_rd32(dev, NV50_PDISPLAY_CRTC_CLK_CTRL2(head));
+	tmp &= ~0x000000f;
+	nv_wr32(dev, NV50_PDISPLAY_CRTC_CLK_CTRL2(head), tmp);
+
+	if (dcbent->type != OUTPUT_ANALOG) {
+		tmp = nv_rd32(dev, NV50_PDISPLAY_SOR_CLK_CTRL2(or));
+		tmp &= ~0x00000f0f;
+		if (script & 0x0100)
+			tmp |= 0x00000101;
+		nv_wr32(dev, NV50_PDISPLAY_SOR_CLK_CTRL2(or), tmp);
+	} else {
+		nv_wr32(dev, NV50_PDISPLAY_DAC_CLK_CTRL2(or), 0);
+	}
+
+ack:
+	nv_wr32(dev, NV50_PDISPLAY_INTR_1, NV50_PDISPLAY_INTR_1_CLK_UNK20);
+	nv_wr32(dev, 0x610030, 0x80000000);
+}
+
+static void
+nv50_display_unk40_handler(struct drm_device *dev)
+{
+	struct dcb_entry *dcbent;
+	int head, pclk, script, ret;
+
+	ret = nv50_display_irq_head(dev, &head, &dcbent);
+	if (ret)
+		goto ack;
+	pclk = nv_rd32(dev, NV50_PDISPLAY_CRTC_P(head, CLOCK)) & 0x3fffff;
+	script = nv50_display_script_select(dev, dcbent, pclk);
+
+	nouveau_bios_run_display_table(dev, dcbent, script, -pclk);
+
+ack:
+	nv_wr32(dev, NV50_PDISPLAY_INTR_1, NV50_PDISPLAY_INTR_1_CLK_UNK40);
+	nv_wr32(dev, 0x610030, 0x80000000);
+	nv_wr32(dev, 0x619494, nv_rd32(dev, 0x619494) | 8);
+}
+
+void
+nv50_display_irq_handler_bh(struct work_struct *work)
+{
+	struct drm_nouveau_private *dev_priv =
+		container_of(work, struct drm_nouveau_private, irq_work);
+	struct drm_device *dev = dev_priv->dev;
+
+	for (;;) {
+		uint32_t intr0 = nv_rd32(dev, NV50_PDISPLAY_INTR_0);
+		uint32_t intr1 = nv_rd32(dev, NV50_PDISPLAY_INTR_1);
+
+		NV_DEBUG_KMS(dev, "PDISPLAY_INTR_BH 0x%08x 0x%08x\n", intr0, intr1);
+
+		if (intr1 & NV50_PDISPLAY_INTR_1_CLK_UNK10)
+			nv50_display_unk10_handler(dev);
+		else
+		if (intr1 & NV50_PDISPLAY_INTR_1_CLK_UNK20)
+			nv50_display_unk20_handler(dev);
+		else
+		if (intr1 & NV50_PDISPLAY_INTR_1_CLK_UNK40)
+			nv50_display_unk40_handler(dev);
+		else
+			break;
+	}
+
+	nv_wr32(dev, NV03_PMC_INTR_EN_0, 1);
+}
+
+static void
+nv50_display_error_handler(struct drm_device *dev)
+{
+	uint32_t addr, data;
+
+	nv_wr32(dev, NV50_PDISPLAY_INTR_0, 0x00010000);
+	addr = nv_rd32(dev, NV50_PDISPLAY_TRAPPED_ADDR);
+	data = nv_rd32(dev, NV50_PDISPLAY_TRAPPED_DATA);
+
+	NV_ERROR(dev, "EvoCh %d Mthd 0x%04x Data 0x%08x (0x%04x 0x%02x)\n",
+		 0, addr & 0xffc, data, addr >> 16, (addr >> 12) & 0xf);
+
+	nv_wr32(dev, NV50_PDISPLAY_TRAPPED_ADDR, 0x90000000);
+}
+
+static void
+nv50_display_irq_hotplug(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct drm_connector *connector;
+	const uint32_t gpio_reg[4] = { 0xe104, 0xe108, 0xe280, 0xe284 };
+	uint32_t unplug_mask, plug_mask, change_mask;
+	uint32_t hpd0, hpd1 = 0;
+
+	hpd0 = nv_rd32(dev, 0xe054) & nv_rd32(dev, 0xe050);
+	if (dev_priv->chipset >= 0x90)
+		hpd1 = nv_rd32(dev, 0xe074) & nv_rd32(dev, 0xe070);
+
+	plug_mask   = (hpd0 & 0x0000ffff) | (hpd1 << 16);
+	unplug_mask = (hpd0 >> 16) | (hpd1 & 0xffff0000);
+	change_mask = plug_mask | unplug_mask;
+
+	list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+		struct drm_encoder_helper_funcs *helper;
+		struct nouveau_connector *nv_connector =
+			nouveau_connector(connector);
+		struct nouveau_encoder *nv_encoder;
+		struct dcb_gpio_entry *gpio;
+		uint32_t reg;
+		bool plugged;
+
+		if (!nv_connector->dcb)
+			continue;
+
+		gpio = nouveau_bios_gpio_entry(dev, nv_connector->dcb->gpio_tag);
+		if (!gpio || !(change_mask & (1 << gpio->line)))
+			continue;
+
+		reg = nv_rd32(dev, gpio_reg[gpio->line >> 3]);
+		plugged = !!(reg & (4 << ((gpio->line & 7) << 2)));
+		NV_INFO(dev, "%splugged %s\n", plugged ? "" : "un",
+			drm_get_connector_name(connector)) ;
+
+		if (!connector->encoder || !connector->encoder->crtc ||
+		    !connector->encoder->crtc->enabled)
+			continue;
+		nv_encoder = nouveau_encoder(connector->encoder);
+		helper = connector->encoder->helper_private;
+
+		if (nv_encoder->dcb->type != OUTPUT_DP)
+			continue;
+
+		if (plugged)
+			helper->dpms(connector->encoder, DRM_MODE_DPMS_ON);
+		else
+			helper->dpms(connector->encoder, DRM_MODE_DPMS_OFF);
+	}
+
+	nv_wr32(dev, 0xe054, nv_rd32(dev, 0xe054));
+	if (dev_priv->chipset >= 0x90)
+		nv_wr32(dev, 0xe074, nv_rd32(dev, 0xe074));
+}
+
+void
+nv50_display_irq_handler(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	uint32_t delayed = 0;
+
+	while (nv_rd32(dev, NV50_PMC_INTR_0) & NV50_PMC_INTR_0_HOTPLUG)
+		nv50_display_irq_hotplug(dev);
+
+	while (nv_rd32(dev, NV50_PMC_INTR_0) & NV50_PMC_INTR_0_DISPLAY) {
+		uint32_t intr0 = nv_rd32(dev, NV50_PDISPLAY_INTR_0);
+		uint32_t intr1 = nv_rd32(dev, NV50_PDISPLAY_INTR_1);
+		uint32_t clock;
+
+		NV_DEBUG_KMS(dev, "PDISPLAY_INTR 0x%08x 0x%08x\n", intr0, intr1);
+
+		if (!intr0 && !(intr1 & ~delayed))
+			break;
+
+		if (intr0 & 0x00010000) {
+			nv50_display_error_handler(dev);
+			intr0 &= ~0x00010000;
+		}
+
+		if (intr1 & NV50_PDISPLAY_INTR_1_VBLANK_CRTC) {
+			nv50_display_vblank_handler(dev, intr1);
+			intr1 &= ~NV50_PDISPLAY_INTR_1_VBLANK_CRTC;
+		}
+
+		clock = (intr1 & (NV50_PDISPLAY_INTR_1_CLK_UNK10 |
+				  NV50_PDISPLAY_INTR_1_CLK_UNK20 |
+				  NV50_PDISPLAY_INTR_1_CLK_UNK40));
+		if (clock) {
+			nv_wr32(dev, NV03_PMC_INTR_EN_0, 0);
+			if (!work_pending(&dev_priv->irq_work))
+				queue_work(dev_priv->wq, &dev_priv->irq_work);
+			delayed |= clock;
+			intr1 &= ~clock;
+		}
+
+		if (intr0) {
+			NV_ERROR(dev, "unknown PDISPLAY_INTR_0: 0x%08x\n", intr0);
+			nv_wr32(dev, NV50_PDISPLAY_INTR_0, intr0);
+		}
+
+		if (intr1) {
+			NV_ERROR(dev,
+				 "unknown PDISPLAY_INTR_1: 0x%08x\n", intr1);
+			nv_wr32(dev, NV50_PDISPLAY_INTR_1, intr1);
+		}
+	}
+}
+
diff --git a/drivers/gpu/drm/nouveau/nv50_display.h b/drivers/gpu/drm/nouveau/nv50_display.h
new file mode 100644
index 000000000000..3ae8d0725f63
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nv50_display.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2008 Maarten Maathuis.
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial
+ * portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE COPYRIGHT OWNER(S) AND/OR ITS SUPPLIERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
+#ifndef __NV50_DISPLAY_H__
+#define __NV50_DISPLAY_H__
+
+#include "drmP.h"
+#include "drm.h"
+#include "nouveau_drv.h"
+#include "nouveau_dma.h"
+#include "nouveau_reg.h"
+#include "nouveau_crtc.h"
+#include "nv50_evo.h"
+
+void nv50_display_irq_handler(struct drm_device *dev);
+void nv50_display_irq_handler_bh(struct work_struct *work);
+int nv50_display_init(struct drm_device *dev);
+int nv50_display_create(struct drm_device *dev);
+int nv50_display_destroy(struct drm_device *dev);
+int nv50_crtc_blank(struct nouveau_crtc *, bool blank);
+int nv50_crtc_set_clock(struct drm_device *, int head, int pclk);
+
+#endif /* __NV50_DISPLAY_H__ */
diff --git a/drivers/gpu/drm/nouveau/nv50_evo.h b/drivers/gpu/drm/nouveau/nv50_evo.h
new file mode 100644
index 000000000000..aae13343bcec
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nv50_evo.h
@@ -0,0 +1,113 @@
+/*
+ * Copyright (C) 2008 Maarten Maathuis.
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial
+ * portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE COPYRIGHT OWNER(S) AND/OR ITS SUPPLIERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
+#define NV50_EVO_UPDATE                                              0x00000080
+#define NV50_EVO_UNK84                                               0x00000084
+#define NV50_EVO_UNK84_NOTIFY                                        0x40000000
+#define NV50_EVO_UNK84_NOTIFY_DISABLED                               0x00000000
+#define NV50_EVO_UNK84_NOTIFY_ENABLED                                0x40000000
+#define NV50_EVO_DMA_NOTIFY                                          0x00000088
+#define NV50_EVO_DMA_NOTIFY_HANDLE                                   0xffffffff
+#define NV50_EVO_DMA_NOTIFY_HANDLE_NONE                              0x00000000
+#define NV50_EVO_UNK8C                                               0x0000008C
+
+#define NV50_EVO_DAC(n, r)                       ((n) * 0x80 + NV50_EVO_DAC_##r)
+#define NV50_EVO_DAC_MODE_CTRL                                       0x00000400
+#define NV50_EVO_DAC_MODE_CTRL_CRTC0                                 0x00000001
+#define NV50_EVO_DAC_MODE_CTRL_CRTC1                                 0x00000002
+#define NV50_EVO_DAC_MODE_CTRL2                                      0x00000404
+#define NV50_EVO_DAC_MODE_CTRL2_NHSYNC                               0x00000001
+#define NV50_EVO_DAC_MODE_CTRL2_NVSYNC                               0x00000002
+
+#define NV50_EVO_SOR(n, r)                       ((n) * 0x40 + NV50_EVO_SOR_##r)
+#define NV50_EVO_SOR_MODE_CTRL                                       0x00000600
+#define NV50_EVO_SOR_MODE_CTRL_CRTC0                                 0x00000001
+#define NV50_EVO_SOR_MODE_CTRL_CRTC1                                 0x00000002
+#define NV50_EVO_SOR_MODE_CTRL_TMDS                                  0x00000100
+#define NV50_EVO_SOR_MODE_CTRL_TMDS_DUAL_LINK                        0x00000400
+#define NV50_EVO_SOR_MODE_CTRL_NHSYNC                                0x00001000
+#define NV50_EVO_SOR_MODE_CTRL_NVSYNC                                0x00002000
+
+#define NV50_EVO_CRTC(n, r)                    ((n) * 0x400 + NV50_EVO_CRTC_##r)
+#define NV84_EVO_CRTC(n, r)                    ((n) * 0x400 + NV84_EVO_CRTC_##r)
+#define NV50_EVO_CRTC_UNK0800                                        0x00000800
+#define NV50_EVO_CRTC_CLOCK                                          0x00000804
+#define NV50_EVO_CRTC_INTERLACE                                      0x00000808
+#define NV50_EVO_CRTC_DISPLAY_START                                  0x00000810
+#define NV50_EVO_CRTC_DISPLAY_TOTAL                                  0x00000814
+#define NV50_EVO_CRTC_SYNC_DURATION                                  0x00000818
+#define NV50_EVO_CRTC_SYNC_START_TO_BLANK_END                        0x0000081c
+#define NV50_EVO_CRTC_UNK0820                                        0x00000820
+#define NV50_EVO_CRTC_UNK0824                                        0x00000824
+#define NV50_EVO_CRTC_UNK082C                                        0x0000082c
+#define NV50_EVO_CRTC_CLUT_MODE                                      0x00000840
+/* You can't have a palette in 8 bit mode (=OFF) */
+#define NV50_EVO_CRTC_CLUT_MODE_BLANK                                0x00000000
+#define NV50_EVO_CRTC_CLUT_MODE_OFF                                  0x80000000
+#define NV50_EVO_CRTC_CLUT_MODE_ON                                   0xC0000000
+#define NV50_EVO_CRTC_CLUT_OFFSET                                    0x00000844
+#define NV84_EVO_CRTC_CLUT_DMA                                       0x0000085C
+#define NV84_EVO_CRTC_CLUT_DMA_HANDLE                                0xffffffff
+#define NV84_EVO_CRTC_CLUT_DMA_HANDLE_NONE                           0x00000000
+#define NV50_EVO_CRTC_FB_OFFSET                                      0x00000860
+#define NV50_EVO_CRTC_FB_SIZE                                        0x00000868
+#define NV50_EVO_CRTC_FB_CONFIG                                      0x0000086c
+#define NV50_EVO_CRTC_FB_CONFIG_MODE                                 0x00100000
+#define NV50_EVO_CRTC_FB_CONFIG_MODE_TILE                            0x00000000
+#define NV50_EVO_CRTC_FB_CONFIG_MODE_PITCH                           0x00100000
+#define NV50_EVO_CRTC_FB_DEPTH                                       0x00000870
+#define NV50_EVO_CRTC_FB_DEPTH_8                                     0x00001e00
+#define NV50_EVO_CRTC_FB_DEPTH_15                                    0x0000e900
+#define NV50_EVO_CRTC_FB_DEPTH_16                                    0x0000e800
+#define NV50_EVO_CRTC_FB_DEPTH_24                                    0x0000cf00
+#define NV50_EVO_CRTC_FB_DEPTH_30                                    0x0000d100
+#define NV50_EVO_CRTC_FB_DMA                                         0x00000874
+#define NV50_EVO_CRTC_FB_DMA_HANDLE                                  0xffffffff
+#define NV50_EVO_CRTC_FB_DMA_HANDLE_NONE                             0x00000000
+#define NV50_EVO_CRTC_CURSOR_CTRL                                    0x00000880
+#define NV50_EVO_CRTC_CURSOR_CTRL_HIDE                               0x05000000
+#define NV50_EVO_CRTC_CURSOR_CTRL_SHOW                               0x85000000
+#define NV50_EVO_CRTC_CURSOR_OFFSET                                  0x00000884
+#define NV84_EVO_CRTC_CURSOR_DMA                                     0x0000089c
+#define NV84_EVO_CRTC_CURSOR_DMA_HANDLE                              0xffffffff
+#define NV84_EVO_CRTC_CURSOR_DMA_HANDLE_NONE                         0x00000000
+#define NV50_EVO_CRTC_DITHER_CTRL                                    0x000008a0
+#define NV50_EVO_CRTC_DITHER_CTRL_OFF                                0x00000000
+#define NV50_EVO_CRTC_DITHER_CTRL_ON                                 0x00000011
+#define NV50_EVO_CRTC_SCALE_CTRL                                     0x000008a4
+#define NV50_EVO_CRTC_SCALE_CTRL_INACTIVE                            0x00000000
+#define NV50_EVO_CRTC_SCALE_CTRL_ACTIVE                              0x00000009
+#define NV50_EVO_CRTC_COLOR_CTRL                                     0x000008a8
+#define NV50_EVO_CRTC_COLOR_CTRL_COLOR                               0x00040000
+#define NV50_EVO_CRTC_FB_POS                                         0x000008c0
+#define NV50_EVO_CRTC_REAL_RES                                       0x000008c8
+#define NV50_EVO_CRTC_SCALE_CENTER_OFFSET                            0x000008d4
+#define NV50_EVO_CRTC_SCALE_CENTER_OFFSET_VAL(x, y) \
+	((((unsigned)y << 16) & 0xFFFF0000) | (((unsigned)x) & 0x0000FFFF))
+/* Both of these are needed, otherwise nothing happens. */
+#define NV50_EVO_CRTC_SCALE_RES1                                     0x000008d8
+#define NV50_EVO_CRTC_SCALE_RES2                                     0x000008dc
+
diff --git a/drivers/gpu/drm/nouveau/nv50_fbcon.c b/drivers/gpu/drm/nouveau/nv50_fbcon.c
new file mode 100644
index 000000000000..e4f279ee61cf
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nv50_fbcon.c
@@ -0,0 +1,270 @@
+#include "drmP.h"
+#include "nouveau_drv.h"
+#include "nouveau_dma.h"
+#include "nouveau_fbcon.h"
+
+static void
+nv50_fbcon_fillrect(struct fb_info *info, const struct fb_fillrect *rect)
+{
+	struct nouveau_fbcon_par *par = info->par;
+	struct drm_device *dev = par->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_channel *chan = dev_priv->channel;
+
+	if (info->state != FBINFO_STATE_RUNNING)
+		return;
+
+	if (!(info->flags & FBINFO_HWACCEL_DISABLED) &&
+	     RING_SPACE(chan, rect->rop == ROP_COPY ? 7 : 11)) {
+		nouveau_fbcon_gpu_lockup(info);
+	}
+
+	if (info->flags & FBINFO_HWACCEL_DISABLED) {
+		cfb_fillrect(info, rect);
+		return;
+	}
+
+	if (rect->rop != ROP_COPY) {
+		BEGIN_RING(chan, NvSub2D, 0x02ac, 1);
+		OUT_RING(chan, 1);
+	}
+	BEGIN_RING(chan, NvSub2D, 0x0588, 1);
+	if (info->fix.visual == FB_VISUAL_TRUECOLOR ||
+	    info->fix.visual == FB_VISUAL_DIRECTCOLOR)
+		OUT_RING(chan, ((uint32_t *)info->pseudo_palette)[rect->color]);
+	else
+		OUT_RING(chan, rect->color);
+	BEGIN_RING(chan, NvSub2D, 0x0600, 4);
+	OUT_RING(chan, rect->dx);
+	OUT_RING(chan, rect->dy);
+	OUT_RING(chan, rect->dx + rect->width);
+	OUT_RING(chan, rect->dy + rect->height);
+	if (rect->rop != ROP_COPY) {
+		BEGIN_RING(chan, NvSub2D, 0x02ac, 1);
+		OUT_RING(chan, 3);
+	}
+	FIRE_RING(chan);
+}
+
+static void
+nv50_fbcon_copyarea(struct fb_info *info, const struct fb_copyarea *region)
+{
+	struct nouveau_fbcon_par *par = info->par;
+	struct drm_device *dev = par->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_channel *chan = dev_priv->channel;
+
+	if (info->state != FBINFO_STATE_RUNNING)
+		return;
+
+	if (!(info->flags & FBINFO_HWACCEL_DISABLED) && RING_SPACE(chan, 12)) {
+		nouveau_fbcon_gpu_lockup(info);
+	}
+
+	if (info->flags & FBINFO_HWACCEL_DISABLED) {
+		cfb_copyarea(info, region);
+		return;
+	}
+
+	BEGIN_RING(chan, NvSub2D, 0x0110, 1);
+	OUT_RING(chan, 0);
+	BEGIN_RING(chan, NvSub2D, 0x08b0, 4);
+	OUT_RING(chan, region->dx);
+	OUT_RING(chan, region->dy);
+	OUT_RING(chan, region->width);
+	OUT_RING(chan, region->height);
+	BEGIN_RING(chan, NvSub2D, 0x08d0, 4);
+	OUT_RING(chan, 0);
+	OUT_RING(chan, region->sx);
+	OUT_RING(chan, 0);
+	OUT_RING(chan, region->sy);
+	FIRE_RING(chan);
+}
+
+static void
+nv50_fbcon_imageblit(struct fb_info *info, const struct fb_image *image)
+{
+	struct nouveau_fbcon_par *par = info->par;
+	struct drm_device *dev = par->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_channel *chan = dev_priv->channel;
+	uint32_t width, dwords, *data = (uint32_t *)image->data;
+	uint32_t mask = ~(~0 >> (32 - info->var.bits_per_pixel));
+	uint32_t *palette = info->pseudo_palette;
+
+	if (info->state != FBINFO_STATE_RUNNING)
+		return;
+
+	if (image->depth != 1) {
+		cfb_imageblit(info, image);
+		return;
+	}
+
+	if (!(info->flags & FBINFO_HWACCEL_DISABLED) && RING_SPACE(chan, 11)) {
+		nouveau_fbcon_gpu_lockup(info);
+	}
+
+	if (info->flags & FBINFO_HWACCEL_DISABLED) {
+		cfb_imageblit(info, image);
+		return;
+	}
+
+	width = (image->width + 31) & ~31;
+	dwords = (width * image->height) >> 5;
+
+	BEGIN_RING(chan, NvSub2D, 0x0814, 2);
+	if (info->fix.visual == FB_VISUAL_TRUECOLOR ||
+	    info->fix.visual == FB_VISUAL_DIRECTCOLOR) {
+		OUT_RING(chan, palette[image->bg_color] | mask);
+		OUT_RING(chan, palette[image->fg_color] | mask);
+	} else {
+		OUT_RING(chan, image->bg_color);
+		OUT_RING(chan, image->fg_color);
+	}
+	BEGIN_RING(chan, NvSub2D, 0x0838, 2);
+	OUT_RING(chan, image->width);
+	OUT_RING(chan, image->height);
+	BEGIN_RING(chan, NvSub2D, 0x0850, 4);
+	OUT_RING(chan, 0);
+	OUT_RING(chan, image->dx);
+	OUT_RING(chan, 0);
+	OUT_RING(chan, image->dy);
+
+	while (dwords) {
+		int push = dwords > 2047 ? 2047 : dwords;
+
+		if (RING_SPACE(chan, push + 1)) {
+			nouveau_fbcon_gpu_lockup(info);
+			cfb_imageblit(info, image);
+			return;
+		}
+
+		dwords -= push;
+
+		BEGIN_RING(chan, NvSub2D, 0x40000860, push);
+		OUT_RINGp(chan, data, push);
+		data += push;
+	}
+
+	FIRE_RING(chan);
+}
+
+int
+nv50_fbcon_accel_init(struct fb_info *info)
+{
+	struct nouveau_fbcon_par *par = info->par;
+	struct drm_device *dev = par->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_channel *chan = dev_priv->channel;
+	struct nouveau_gpuobj *eng2d = NULL;
+	int ret, format;
+
+	switch (info->var.bits_per_pixel) {
+	case 8:
+		format = 0xf3;
+		break;
+	case 15:
+		format = 0xf8;
+		break;
+	case 16:
+		format = 0xe8;
+		break;
+	case 32:
+		switch (info->var.transp.length) {
+		case 0: /* depth 24 */
+		case 8: /* depth 32, just use 24.. */
+			format = 0xe6;
+			break;
+		case 2: /* depth 30 */
+			format = 0xd1;
+			break;
+		default:
+			return -EINVAL;
+		}
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	ret = nouveau_gpuobj_gr_new(dev_priv->channel, 0x502d, &eng2d);
+	if (ret)
+		return ret;
+
+	ret = nouveau_gpuobj_ref_add(dev, dev_priv->channel, Nv2D, eng2d, NULL);
+	if (ret)
+		return ret;
+
+	ret = RING_SPACE(chan, 59);
+	if (ret) {
+		nouveau_fbcon_gpu_lockup(info);
+		return ret;
+	}
+
+	BEGIN_RING(chan, NvSub2D, 0x0000, 1);
+	OUT_RING(chan, Nv2D);
+	BEGIN_RING(chan, NvSub2D, 0x0180, 4);
+	OUT_RING(chan, NvNotify0);
+	OUT_RING(chan, chan->vram_handle);
+	OUT_RING(chan, chan->vram_handle);
+	OUT_RING(chan, chan->vram_handle);
+	BEGIN_RING(chan, NvSub2D, 0x0290, 1);
+	OUT_RING(chan, 0);
+	BEGIN_RING(chan, NvSub2D, 0x0888, 1);
+	OUT_RING(chan, 1);
+	BEGIN_RING(chan, NvSub2D, 0x02ac, 1);
+	OUT_RING(chan, 3);
+	BEGIN_RING(chan, NvSub2D, 0x02a0, 1);
+	OUT_RING(chan, 0x55);
+	BEGIN_RING(chan, NvSub2D, 0x08c0, 4);
+	OUT_RING(chan, 0);
+	OUT_RING(chan, 1);
+	OUT_RING(chan, 0);
+	OUT_RING(chan, 1);
+	BEGIN_RING(chan, NvSub2D, 0x0580, 2);
+	OUT_RING(chan, 4);
+	OUT_RING(chan, format);
+	BEGIN_RING(chan, NvSub2D, 0x02e8, 2);
+	OUT_RING(chan, 2);
+	OUT_RING(chan, 1);
+	BEGIN_RING(chan, NvSub2D, 0x0804, 1);
+	OUT_RING(chan, format);
+	BEGIN_RING(chan, NvSub2D, 0x0800, 1);
+	OUT_RING(chan, 1);
+	BEGIN_RING(chan, NvSub2D, 0x0808, 3);
+	OUT_RING(chan, 0);
+	OUT_RING(chan, 0);
+	OUT_RING(chan, 0);
+	BEGIN_RING(chan, NvSub2D, 0x081c, 1);
+	OUT_RING(chan, 1);
+	BEGIN_RING(chan, NvSub2D, 0x0840, 4);
+	OUT_RING(chan, 0);
+	OUT_RING(chan, 1);
+	OUT_RING(chan, 0);
+	OUT_RING(chan, 1);
+	BEGIN_RING(chan, NvSub2D, 0x0200, 2);
+	OUT_RING(chan, format);
+	OUT_RING(chan, 1);
+	BEGIN_RING(chan, NvSub2D, 0x0214, 5);
+	OUT_RING(chan, info->fix.line_length);
+	OUT_RING(chan, info->var.xres_virtual);
+	OUT_RING(chan, info->var.yres_virtual);
+	OUT_RING(chan, 0);
+	OUT_RING(chan, info->fix.smem_start - dev_priv->fb_phys +
+			 dev_priv->vm_vram_base);
+	BEGIN_RING(chan, NvSub2D, 0x0230, 2);
+	OUT_RING(chan, format);
+	OUT_RING(chan, 1);
+	BEGIN_RING(chan, NvSub2D, 0x0244, 5);
+	OUT_RING(chan, info->fix.line_length);
+	OUT_RING(chan, info->var.xres_virtual);
+	OUT_RING(chan, info->var.yres_virtual);
+	OUT_RING(chan, 0);
+	OUT_RING(chan, info->fix.smem_start - dev_priv->fb_phys +
+			 dev_priv->vm_vram_base);
+
+	info->fbops->fb_fillrect = nv50_fbcon_fillrect;
+	info->fbops->fb_copyarea = nv50_fbcon_copyarea;
+	info->fbops->fb_imageblit = nv50_fbcon_imageblit;
+	return 0;
+}
+
diff --git a/drivers/gpu/drm/nouveau/nv50_fifo.c b/drivers/gpu/drm/nouveau/nv50_fifo.c
new file mode 100644
index 000000000000..39caf167587d
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nv50_fifo.c
@@ -0,0 +1,492 @@
+/*
+ * Copyright (C) 2007 Ben Skeggs.
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial
+ * portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE COPYRIGHT OWNER(S) AND/OR ITS SUPPLIERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
+#include "drmP.h"
+#include "drm.h"
+#include "nouveau_drv.h"
+
+struct nv50_fifo_priv {
+	struct nouveau_gpuobj_ref *thingo[2];
+	int cur_thingo;
+};
+
+#define IS_G80 ((dev_priv->chipset & 0xf0) == 0x50)
+
+static void
+nv50_fifo_init_thingo(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nv50_fifo_priv *priv = dev_priv->engine.fifo.priv;
+	struct nouveau_gpuobj_ref *cur;
+	int i, nr;
+
+	NV_DEBUG(dev, "\n");
+
+	cur = priv->thingo[priv->cur_thingo];
+	priv->cur_thingo = !priv->cur_thingo;
+
+	/* We never schedule channel 0 or 127 */
+	dev_priv->engine.instmem.prepare_access(dev, true);
+	for (i = 1, nr = 0; i < 127; i++) {
+		if (dev_priv->fifos[i] && dev_priv->fifos[i]->ramfc)
+			nv_wo32(dev, cur->gpuobj, nr++, i);
+	}
+	dev_priv->engine.instmem.finish_access(dev);
+
+	nv_wr32(dev, 0x32f4, cur->instance >> 12);
+	nv_wr32(dev, 0x32ec, nr);
+	nv_wr32(dev, 0x2500, 0x101);
+}
+
+static int
+nv50_fifo_channel_enable(struct drm_device *dev, int channel, bool nt)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_channel *chan = dev_priv->fifos[channel];
+	uint32_t inst;
+
+	NV_DEBUG(dev, "ch%d\n", channel);
+
+	if (!chan->ramfc)
+		return -EINVAL;
+
+	if (IS_G80)
+		inst = chan->ramfc->instance >> 12;
+	else
+		inst = chan->ramfc->instance >> 8;
+	nv_wr32(dev, NV50_PFIFO_CTX_TABLE(channel),
+		 inst | NV50_PFIFO_CTX_TABLE_CHANNEL_ENABLED);
+
+	if (!nt)
+		nv50_fifo_init_thingo(dev);
+	return 0;
+}
+
+static void
+nv50_fifo_channel_disable(struct drm_device *dev, int channel, bool nt)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	uint32_t inst;
+
+	NV_DEBUG(dev, "ch%d, nt=%d\n", channel, nt);
+
+	if (IS_G80)
+		inst = NV50_PFIFO_CTX_TABLE_INSTANCE_MASK_G80;
+	else
+		inst = NV50_PFIFO_CTX_TABLE_INSTANCE_MASK_G84;
+	nv_wr32(dev, NV50_PFIFO_CTX_TABLE(channel), inst);
+
+	if (!nt)
+		nv50_fifo_init_thingo(dev);
+}
+
+static void
+nv50_fifo_init_reset(struct drm_device *dev)
+{
+	uint32_t pmc_e = NV_PMC_ENABLE_PFIFO;
+
+	NV_DEBUG(dev, "\n");
+
+	nv_wr32(dev, NV03_PMC_ENABLE, nv_rd32(dev, NV03_PMC_ENABLE) & ~pmc_e);
+	nv_wr32(dev, NV03_PMC_ENABLE, nv_rd32(dev, NV03_PMC_ENABLE) |  pmc_e);
+}
+
+static void
+nv50_fifo_init_intr(struct drm_device *dev)
+{
+	NV_DEBUG(dev, "\n");
+
+	nv_wr32(dev, NV03_PFIFO_INTR_0, 0xFFFFFFFF);
+	nv_wr32(dev, NV03_PFIFO_INTR_EN_0, 0xFFFFFFFF);
+}
+
+static void
+nv50_fifo_init_context_table(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	int i;
+
+	NV_DEBUG(dev, "\n");
+
+	for (i = 0; i < NV50_PFIFO_CTX_TABLE__SIZE; i++) {
+		if (dev_priv->fifos[i])
+			nv50_fifo_channel_enable(dev, i, true);
+		else
+			nv50_fifo_channel_disable(dev, i, true);
+	}
+
+	nv50_fifo_init_thingo(dev);
+}
+
+static void
+nv50_fifo_init_regs__nv(struct drm_device *dev)
+{
+	NV_DEBUG(dev, "\n");
+
+	nv_wr32(dev, 0x250c, 0x6f3cfc34);
+}
+
+static void
+nv50_fifo_init_regs(struct drm_device *dev)
+{
+	NV_DEBUG(dev, "\n");
+
+	nv_wr32(dev, 0x2500, 0);
+	nv_wr32(dev, 0x3250, 0);
+	nv_wr32(dev, 0x3220, 0);
+	nv_wr32(dev, 0x3204, 0);
+	nv_wr32(dev, 0x3210, 0);
+	nv_wr32(dev, 0x3270, 0);
+
+	/* Enable dummy channels setup by nv50_instmem.c */
+	nv50_fifo_channel_enable(dev, 0, true);
+	nv50_fifo_channel_enable(dev, 127, true);
+}
+
+int
+nv50_fifo_init(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nv50_fifo_priv *priv;
+	int ret;
+
+	NV_DEBUG(dev, "\n");
+
+	priv = dev_priv->engine.fifo.priv;
+	if (priv) {
+		priv->cur_thingo = !priv->cur_thingo;
+		goto just_reset;
+	}
+
+	priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+	if (!priv)
+		return -ENOMEM;
+	dev_priv->engine.fifo.priv = priv;
+
+	ret = nouveau_gpuobj_new_ref(dev, NULL, NULL, 0, 128*4, 0x1000,
+				     NVOBJ_FLAG_ZERO_ALLOC, &priv->thingo[0]);
+	if (ret) {
+		NV_ERROR(dev, "error creating thingo0: %d\n", ret);
+		return ret;
+	}
+
+	ret = nouveau_gpuobj_new_ref(dev, NULL, NULL, 0, 128*4, 0x1000,
+				     NVOBJ_FLAG_ZERO_ALLOC, &priv->thingo[1]);
+	if (ret) {
+		NV_ERROR(dev, "error creating thingo1: %d\n", ret);
+		return ret;
+	}
+
+just_reset:
+	nv50_fifo_init_reset(dev);
+	nv50_fifo_init_intr(dev);
+	nv50_fifo_init_context_table(dev);
+	nv50_fifo_init_regs__nv(dev);
+	nv50_fifo_init_regs(dev);
+	dev_priv->engine.fifo.enable(dev);
+	dev_priv->engine.fifo.reassign(dev, true);
+
+	return 0;
+}
+
+void
+nv50_fifo_takedown(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nv50_fifo_priv *priv = dev_priv->engine.fifo.priv;
+
+	NV_DEBUG(dev, "\n");
+
+	if (!priv)
+		return;
+
+	nouveau_gpuobj_ref_del(dev, &priv->thingo[0]);
+	nouveau_gpuobj_ref_del(dev, &priv->thingo[1]);
+
+	dev_priv->engine.fifo.priv = NULL;
+	kfree(priv);
+}
+
+int
+nv50_fifo_channel_id(struct drm_device *dev)
+{
+	return nv_rd32(dev, NV03_PFIFO_CACHE1_PUSH1) &
+			NV50_PFIFO_CACHE1_PUSH1_CHID_MASK;
+}
+
+int
+nv50_fifo_create_context(struct nouveau_channel *chan)
+{
+	struct drm_device *dev = chan->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_gpuobj *ramfc = NULL;
+	int ret;
+
+	NV_DEBUG(dev, "ch%d\n", chan->id);
+
+	if (IS_G80) {
+		uint32_t ramin_poffset = chan->ramin->gpuobj->im_pramin->start;
+		uint32_t ramin_voffset = chan->ramin->gpuobj->im_backing_start;
+
+		ret = nouveau_gpuobj_new_fake(dev, ramin_poffset, ramin_voffset,
+					      0x100, NVOBJ_FLAG_ZERO_ALLOC |
+					      NVOBJ_FLAG_ZERO_FREE, &ramfc,
+					      &chan->ramfc);
+		if (ret)
+			return ret;
+
+		ret = nouveau_gpuobj_new_fake(dev, ramin_poffset + 0x0400,
+					      ramin_voffset + 0x0400, 4096,
+					      0, NULL, &chan->cache);
+		if (ret)
+			return ret;
+	} else {
+		ret = nouveau_gpuobj_new_ref(dev, chan, NULL, 0, 0x100, 256,
+					     NVOBJ_FLAG_ZERO_ALLOC |
+					     NVOBJ_FLAG_ZERO_FREE,
+					     &chan->ramfc);
+		if (ret)
+			return ret;
+		ramfc = chan->ramfc->gpuobj;
+
+		ret = nouveau_gpuobj_new_ref(dev, chan, NULL, 0, 4096, 256,
+					     0, &chan->cache);
+		if (ret)
+			return ret;
+	}
+
+	dev_priv->engine.instmem.prepare_access(dev, true);
+
+	nv_wo32(dev, ramfc, 0x08/4, chan->pushbuf_base);
+	nv_wo32(dev, ramfc, 0x10/4, chan->pushbuf_base);
+	nv_wo32(dev, ramfc, 0x48/4, chan->pushbuf->instance >> 4);
+	nv_wo32(dev, ramfc, 0x80/4, (0xc << 24) | (chan->ramht->instance >> 4));
+	nv_wo32(dev, ramfc, 0x3c/4, 0x00086078);
+	nv_wo32(dev, ramfc, 0x44/4, 0x2101ffff);
+	nv_wo32(dev, ramfc, 0x60/4, 0x7fffffff);
+	nv_wo32(dev, ramfc, 0x40/4, 0x00000000);
+	nv_wo32(dev, ramfc, 0x7c/4, 0x30000001);
+	nv_wo32(dev, ramfc, 0x78/4, 0x00000000);
+	nv_wo32(dev, ramfc, 0x4c/4, 0xffffffff);
+
+	if (!IS_G80) {
+		nv_wo32(dev, chan->ramin->gpuobj, 0, chan->id);
+		nv_wo32(dev, chan->ramin->gpuobj, 1,
+						chan->ramfc->instance >> 8);
+
+		nv_wo32(dev, ramfc, 0x88/4, chan->cache->instance >> 10);
+		nv_wo32(dev, ramfc, 0x98/4, chan->ramin->instance >> 12);
+	}
+
+	dev_priv->engine.instmem.finish_access(dev);
+
+	ret = nv50_fifo_channel_enable(dev, chan->id, false);
+	if (ret) {
+		NV_ERROR(dev, "error enabling ch%d: %d\n", chan->id, ret);
+		nouveau_gpuobj_ref_del(dev, &chan->ramfc);
+		return ret;
+	}
+
+	return 0;
+}
+
+void
+nv50_fifo_destroy_context(struct nouveau_channel *chan)
+{
+	struct drm_device *dev = chan->dev;
+
+	NV_DEBUG(dev, "ch%d\n", chan->id);
+
+	nouveau_gpuobj_ref_del(dev, &chan->ramfc);
+	nouveau_gpuobj_ref_del(dev, &chan->cache);
+
+	nv50_fifo_channel_disable(dev, chan->id, false);
+
+	/* Dummy channel, also used on ch 127 */
+	if (chan->id == 0)
+		nv50_fifo_channel_disable(dev, 127, false);
+}
+
+int
+nv50_fifo_load_context(struct nouveau_channel *chan)
+{
+	struct drm_device *dev = chan->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_gpuobj *ramfc = chan->ramfc->gpuobj;
+	struct nouveau_gpuobj *cache = chan->cache->gpuobj;
+	int ptr, cnt;
+
+	NV_DEBUG(dev, "ch%d\n", chan->id);
+
+	dev_priv->engine.instmem.prepare_access(dev, false);
+
+	nv_wr32(dev, 0x3330, nv_ro32(dev, ramfc, 0x00/4));
+	nv_wr32(dev, 0x3334, nv_ro32(dev, ramfc, 0x04/4));
+	nv_wr32(dev, 0x3240, nv_ro32(dev, ramfc, 0x08/4));
+	nv_wr32(dev, 0x3320, nv_ro32(dev, ramfc, 0x0c/4));
+	nv_wr32(dev, 0x3244, nv_ro32(dev, ramfc, 0x10/4));
+	nv_wr32(dev, 0x3328, nv_ro32(dev, ramfc, 0x14/4));
+	nv_wr32(dev, 0x3368, nv_ro32(dev, ramfc, 0x18/4));
+	nv_wr32(dev, 0x336c, nv_ro32(dev, ramfc, 0x1c/4));
+	nv_wr32(dev, 0x3370, nv_ro32(dev, ramfc, 0x20/4));
+	nv_wr32(dev, 0x3374, nv_ro32(dev, ramfc, 0x24/4));
+	nv_wr32(dev, 0x3378, nv_ro32(dev, ramfc, 0x28/4));
+	nv_wr32(dev, 0x337c, nv_ro32(dev, ramfc, 0x2c/4));
+	nv_wr32(dev, 0x3228, nv_ro32(dev, ramfc, 0x30/4));
+	nv_wr32(dev, 0x3364, nv_ro32(dev, ramfc, 0x34/4));
+	nv_wr32(dev, 0x32a0, nv_ro32(dev, ramfc, 0x38/4));
+	nv_wr32(dev, 0x3224, nv_ro32(dev, ramfc, 0x3c/4));
+	nv_wr32(dev, 0x324c, nv_ro32(dev, ramfc, 0x40/4));
+	nv_wr32(dev, 0x2044, nv_ro32(dev, ramfc, 0x44/4));
+	nv_wr32(dev, 0x322c, nv_ro32(dev, ramfc, 0x48/4));
+	nv_wr32(dev, 0x3234, nv_ro32(dev, ramfc, 0x4c/4));
+	nv_wr32(dev, 0x3340, nv_ro32(dev, ramfc, 0x50/4));
+	nv_wr32(dev, 0x3344, nv_ro32(dev, ramfc, 0x54/4));
+	nv_wr32(dev, 0x3280, nv_ro32(dev, ramfc, 0x58/4));
+	nv_wr32(dev, 0x3254, nv_ro32(dev, ramfc, 0x5c/4));
+	nv_wr32(dev, 0x3260, nv_ro32(dev, ramfc, 0x60/4));
+	nv_wr32(dev, 0x3264, nv_ro32(dev, ramfc, 0x64/4));
+	nv_wr32(dev, 0x3268, nv_ro32(dev, ramfc, 0x68/4));
+	nv_wr32(dev, 0x326c, nv_ro32(dev, ramfc, 0x6c/4));
+	nv_wr32(dev, 0x32e4, nv_ro32(dev, ramfc, 0x70/4));
+	nv_wr32(dev, 0x3248, nv_ro32(dev, ramfc, 0x74/4));
+	nv_wr32(dev, 0x2088, nv_ro32(dev, ramfc, 0x78/4));
+	nv_wr32(dev, 0x2058, nv_ro32(dev, ramfc, 0x7c/4));
+	nv_wr32(dev, 0x2210, nv_ro32(dev, ramfc, 0x80/4));
+
+	cnt = nv_ro32(dev, ramfc, 0x84/4);
+	for (ptr = 0; ptr < cnt; ptr++) {
+		nv_wr32(dev, NV40_PFIFO_CACHE1_METHOD(ptr),
+			nv_ro32(dev, cache, (ptr * 2) + 0));
+		nv_wr32(dev, NV40_PFIFO_CACHE1_DATA(ptr),
+			nv_ro32(dev, cache, (ptr * 2) + 1));
+	}
+	nv_wr32(dev, NV03_PFIFO_CACHE1_PUT, cnt << 2);
+	nv_wr32(dev, NV03_PFIFO_CACHE1_GET, 0);
+
+	/* guessing that all the 0x34xx regs aren't on NV50 */
+	if (!IS_G80) {
+		nv_wr32(dev, 0x340c, nv_ro32(dev, ramfc, 0x88/4));
+		nv_wr32(dev, 0x3400, nv_ro32(dev, ramfc, 0x8c/4));
+		nv_wr32(dev, 0x3404, nv_ro32(dev, ramfc, 0x90/4));
+		nv_wr32(dev, 0x3408, nv_ro32(dev, ramfc, 0x94/4));
+		nv_wr32(dev, 0x3410, nv_ro32(dev, ramfc, 0x98/4));
+	}
+
+	dev_priv->engine.instmem.finish_access(dev);
+
+	nv_wr32(dev, NV03_PFIFO_CACHE1_PUSH1, chan->id | (1<<16));
+	return 0;
+}
+
+int
+nv50_fifo_unload_context(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_fifo_engine *pfifo = &dev_priv->engine.fifo;
+	struct nouveau_gpuobj *ramfc, *cache;
+	struct nouveau_channel *chan = NULL;
+	int chid, get, put, ptr;
+
+	NV_DEBUG(dev, "\n");
+
+	chid = pfifo->channel_id(dev);
+	if (chid < 1 || chid >= dev_priv->engine.fifo.channels - 1)
+		return 0;
+
+	chan = dev_priv->fifos[chid];
+	if (!chan) {
+		NV_ERROR(dev, "Inactive channel on PFIFO: %d\n", chid);
+		return -EINVAL;
+	}
+	NV_DEBUG(dev, "ch%d\n", chan->id);
+	ramfc = chan->ramfc->gpuobj;
+	cache = chan->cache->gpuobj;
+
+	dev_priv->engine.instmem.prepare_access(dev, true);
+
+	nv_wo32(dev, ramfc, 0x00/4, nv_rd32(dev, 0x3330));
+	nv_wo32(dev, ramfc, 0x04/4, nv_rd32(dev, 0x3334));
+	nv_wo32(dev, ramfc, 0x08/4, nv_rd32(dev, 0x3240));
+	nv_wo32(dev, ramfc, 0x0c/4, nv_rd32(dev, 0x3320));
+	nv_wo32(dev, ramfc, 0x10/4, nv_rd32(dev, 0x3244));
+	nv_wo32(dev, ramfc, 0x14/4, nv_rd32(dev, 0x3328));
+	nv_wo32(dev, ramfc, 0x18/4, nv_rd32(dev, 0x3368));
+	nv_wo32(dev, ramfc, 0x1c/4, nv_rd32(dev, 0x336c));
+	nv_wo32(dev, ramfc, 0x20/4, nv_rd32(dev, 0x3370));
+	nv_wo32(dev, ramfc, 0x24/4, nv_rd32(dev, 0x3374));
+	nv_wo32(dev, ramfc, 0x28/4, nv_rd32(dev, 0x3378));
+	nv_wo32(dev, ramfc, 0x2c/4, nv_rd32(dev, 0x337c));
+	nv_wo32(dev, ramfc, 0x30/4, nv_rd32(dev, 0x3228));
+	nv_wo32(dev, ramfc, 0x34/4, nv_rd32(dev, 0x3364));
+	nv_wo32(dev, ramfc, 0x38/4, nv_rd32(dev, 0x32a0));
+	nv_wo32(dev, ramfc, 0x3c/4, nv_rd32(dev, 0x3224));
+	nv_wo32(dev, ramfc, 0x40/4, nv_rd32(dev, 0x324c));
+	nv_wo32(dev, ramfc, 0x44/4, nv_rd32(dev, 0x2044));
+	nv_wo32(dev, ramfc, 0x48/4, nv_rd32(dev, 0x322c));
+	nv_wo32(dev, ramfc, 0x4c/4, nv_rd32(dev, 0x3234));
+	nv_wo32(dev, ramfc, 0x50/4, nv_rd32(dev, 0x3340));
+	nv_wo32(dev, ramfc, 0x54/4, nv_rd32(dev, 0x3344));
+	nv_wo32(dev, ramfc, 0x58/4, nv_rd32(dev, 0x3280));
+	nv_wo32(dev, ramfc, 0x5c/4, nv_rd32(dev, 0x3254));
+	nv_wo32(dev, ramfc, 0x60/4, nv_rd32(dev, 0x3260));
+	nv_wo32(dev, ramfc, 0x64/4, nv_rd32(dev, 0x3264));
+	nv_wo32(dev, ramfc, 0x68/4, nv_rd32(dev, 0x3268));
+	nv_wo32(dev, ramfc, 0x6c/4, nv_rd32(dev, 0x326c));
+	nv_wo32(dev, ramfc, 0x70/4, nv_rd32(dev, 0x32e4));
+	nv_wo32(dev, ramfc, 0x74/4, nv_rd32(dev, 0x3248));
+	nv_wo32(dev, ramfc, 0x78/4, nv_rd32(dev, 0x2088));
+	nv_wo32(dev, ramfc, 0x7c/4, nv_rd32(dev, 0x2058));
+	nv_wo32(dev, ramfc, 0x80/4, nv_rd32(dev, 0x2210));
+
+	put = (nv_rd32(dev, NV03_PFIFO_CACHE1_PUT) & 0x7ff) >> 2;
+	get = (nv_rd32(dev, NV03_PFIFO_CACHE1_GET) & 0x7ff) >> 2;
+	ptr = 0;
+	while (put != get) {
+		nv_wo32(dev, cache, ptr++,
+			    nv_rd32(dev, NV40_PFIFO_CACHE1_METHOD(get)));
+		nv_wo32(dev, cache, ptr++,
+			    nv_rd32(dev, NV40_PFIFO_CACHE1_DATA(get)));
+		get = (get + 1) & 0x1ff;
+	}
+
+	/* guessing that all the 0x34xx regs aren't on NV50 */
+	if (!IS_G80) {
+		nv_wo32(dev, ramfc, 0x84/4, ptr >> 1);
+		nv_wo32(dev, ramfc, 0x88/4, nv_rd32(dev, 0x340c));
+		nv_wo32(dev, ramfc, 0x8c/4, nv_rd32(dev, 0x3400));
+		nv_wo32(dev, ramfc, 0x90/4, nv_rd32(dev, 0x3404));
+		nv_wo32(dev, ramfc, 0x94/4, nv_rd32(dev, 0x3408));
+		nv_wo32(dev, ramfc, 0x98/4, nv_rd32(dev, 0x3410));
+	}
+
+	dev_priv->engine.instmem.finish_access(dev);
+
+	/*XXX: probably reload ch127 (NULL) state back too */
+	nv_wr32(dev, NV03_PFIFO_CACHE1_PUSH1, 127);
+	return 0;
+}
+
diff --git a/drivers/gpu/drm/nouveau/nv50_graph.c b/drivers/gpu/drm/nouveau/nv50_graph.c
new file mode 100644
index 000000000000..ca79f32be44c
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nv50_graph.c
@@ -0,0 +1,389 @@
+/*
+ * Copyright (C) 2007 Ben Skeggs.
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial
+ * portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE COPYRIGHT OWNER(S) AND/OR ITS SUPPLIERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
+#include "drmP.h"
+#include "drm.h"
+#include "nouveau_drv.h"
+
+MODULE_FIRMWARE("nouveau/nv50.ctxprog");
+MODULE_FIRMWARE("nouveau/nv50.ctxvals");
+MODULE_FIRMWARE("nouveau/nv84.ctxprog");
+MODULE_FIRMWARE("nouveau/nv84.ctxvals");
+MODULE_FIRMWARE("nouveau/nv86.ctxprog");
+MODULE_FIRMWARE("nouveau/nv86.ctxvals");
+MODULE_FIRMWARE("nouveau/nv92.ctxprog");
+MODULE_FIRMWARE("nouveau/nv92.ctxvals");
+MODULE_FIRMWARE("nouveau/nv94.ctxprog");
+MODULE_FIRMWARE("nouveau/nv94.ctxvals");
+MODULE_FIRMWARE("nouveau/nv96.ctxprog");
+MODULE_FIRMWARE("nouveau/nv96.ctxvals");
+MODULE_FIRMWARE("nouveau/nv98.ctxprog");
+MODULE_FIRMWARE("nouveau/nv98.ctxvals");
+MODULE_FIRMWARE("nouveau/nva0.ctxprog");
+MODULE_FIRMWARE("nouveau/nva0.ctxvals");
+MODULE_FIRMWARE("nouveau/nva5.ctxprog");
+MODULE_FIRMWARE("nouveau/nva5.ctxvals");
+MODULE_FIRMWARE("nouveau/nva8.ctxprog");
+MODULE_FIRMWARE("nouveau/nva8.ctxvals");
+MODULE_FIRMWARE("nouveau/nvaa.ctxprog");
+MODULE_FIRMWARE("nouveau/nvaa.ctxvals");
+MODULE_FIRMWARE("nouveau/nvac.ctxprog");
+MODULE_FIRMWARE("nouveau/nvac.ctxvals");
+
+#define IS_G80 ((dev_priv->chipset & 0xf0) == 0x50)
+
+static void
+nv50_graph_init_reset(struct drm_device *dev)
+{
+	uint32_t pmc_e = NV_PMC_ENABLE_PGRAPH | (1 << 21);
+
+	NV_DEBUG(dev, "\n");
+
+	nv_wr32(dev, NV03_PMC_ENABLE, nv_rd32(dev, NV03_PMC_ENABLE) & ~pmc_e);
+	nv_wr32(dev, NV03_PMC_ENABLE, nv_rd32(dev, NV03_PMC_ENABLE) |  pmc_e);
+}
+
+static void
+nv50_graph_init_intr(struct drm_device *dev)
+{
+	NV_DEBUG(dev, "\n");
+
+	nv_wr32(dev, NV03_PGRAPH_INTR, 0xffffffff);
+	nv_wr32(dev, 0x400138, 0xffffffff);
+	nv_wr32(dev, NV40_PGRAPH_INTR_EN, 0xffffffff);
+}
+
+static void
+nv50_graph_init_regs__nv(struct drm_device *dev)
+{
+	NV_DEBUG(dev, "\n");
+
+	nv_wr32(dev, 0x400804, 0xc0000000);
+	nv_wr32(dev, 0x406800, 0xc0000000);
+	nv_wr32(dev, 0x400c04, 0xc0000000);
+	nv_wr32(dev, 0x401804, 0xc0000000);
+	nv_wr32(dev, 0x405018, 0xc0000000);
+	nv_wr32(dev, 0x402000, 0xc0000000);
+
+	nv_wr32(dev, 0x400108, 0xffffffff);
+
+	nv_wr32(dev, 0x400824, 0x00004000);
+	nv_wr32(dev, 0x400500, 0x00010001);
+}
+
+static void
+nv50_graph_init_regs(struct drm_device *dev)
+{
+	NV_DEBUG(dev, "\n");
+
+	nv_wr32(dev, NV04_PGRAPH_DEBUG_3,
+				(1 << 2) /* HW_CONTEXT_SWITCH_ENABLED */);
+	nv_wr32(dev, 0x402ca8, 0x800);
+}
+
+static int
+nv50_graph_init_ctxctl(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+
+	NV_DEBUG(dev, "\n");
+
+	nouveau_grctx_prog_load(dev);
+	if (!dev_priv->engine.graph.ctxprog)
+		dev_priv->engine.graph.accel_blocked = true;
+
+	nv_wr32(dev, 0x400320, 4);
+	nv_wr32(dev, NV40_PGRAPH_CTXCTL_CUR, 0);
+	nv_wr32(dev, NV20_PGRAPH_CHANNEL_CTX_POINTER, 0);
+	return 0;
+}
+
+int
+nv50_graph_init(struct drm_device *dev)
+{
+	int ret;
+
+	NV_DEBUG(dev, "\n");
+
+	nv50_graph_init_reset(dev);
+	nv50_graph_init_regs__nv(dev);
+	nv50_graph_init_regs(dev);
+	nv50_graph_init_intr(dev);
+
+	ret = nv50_graph_init_ctxctl(dev);
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+void
+nv50_graph_takedown(struct drm_device *dev)
+{
+	NV_DEBUG(dev, "\n");
+	nouveau_grctx_fini(dev);
+}
+
+void
+nv50_graph_fifo_access(struct drm_device *dev, bool enabled)
+{
+	const uint32_t mask = 0x00010001;
+
+	if (enabled)
+		nv_wr32(dev, 0x400500, nv_rd32(dev, 0x400500) | mask);
+	else
+		nv_wr32(dev, 0x400500, nv_rd32(dev, 0x400500) & ~mask);
+}
+
+struct nouveau_channel *
+nv50_graph_channel(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	uint32_t inst;
+	int i;
+
+	inst = nv_rd32(dev, NV50_PGRAPH_CTXCTL_CUR);
+	if (!(inst & NV50_PGRAPH_CTXCTL_CUR_LOADED))
+		return NULL;
+	inst = (inst & NV50_PGRAPH_CTXCTL_CUR_INSTANCE) << 12;
+
+	for (i = 0; i < dev_priv->engine.fifo.channels; i++) {
+		struct nouveau_channel *chan = dev_priv->fifos[i];
+
+		if (chan && chan->ramin && chan->ramin->instance == inst)
+			return chan;
+	}
+
+	return NULL;
+}
+
+int
+nv50_graph_create_context(struct nouveau_channel *chan)
+{
+	struct drm_device *dev = chan->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_gpuobj *ramin = chan->ramin->gpuobj;
+	struct nouveau_gpuobj *ctx;
+	uint32_t grctx_size = 0x70000;
+	int hdr, ret;
+
+	NV_DEBUG(dev, "ch%d\n", chan->id);
+
+	ret = nouveau_gpuobj_new_ref(dev, chan, NULL, 0, grctx_size, 0x1000,
+				     NVOBJ_FLAG_ZERO_ALLOC |
+				     NVOBJ_FLAG_ZERO_FREE, &chan->ramin_grctx);
+	if (ret)
+		return ret;
+	ctx = chan->ramin_grctx->gpuobj;
+
+	hdr = IS_G80 ? 0x200 : 0x20;
+	dev_priv->engine.instmem.prepare_access(dev, true);
+	nv_wo32(dev, ramin, (hdr + 0x00)/4, 0x00190002);
+	nv_wo32(dev, ramin, (hdr + 0x04)/4, chan->ramin_grctx->instance +
+					   grctx_size - 1);
+	nv_wo32(dev, ramin, (hdr + 0x08)/4, chan->ramin_grctx->instance);
+	nv_wo32(dev, ramin, (hdr + 0x0c)/4, 0);
+	nv_wo32(dev, ramin, (hdr + 0x10)/4, 0);
+	nv_wo32(dev, ramin, (hdr + 0x14)/4, 0x00010000);
+	dev_priv->engine.instmem.finish_access(dev);
+
+	dev_priv->engine.instmem.prepare_access(dev, true);
+	nouveau_grctx_vals_load(dev, ctx);
+	nv_wo32(dev, ctx, 0x00000/4, chan->ramin->instance >> 12);
+	if ((dev_priv->chipset & 0xf0) == 0xa0)
+		nv_wo32(dev, ctx, 0x00004/4, 0x00000000);
+	else
+		nv_wo32(dev, ctx, 0x0011c/4, 0x00000000);
+	dev_priv->engine.instmem.finish_access(dev);
+
+	return 0;
+}
+
+void
+nv50_graph_destroy_context(struct nouveau_channel *chan)
+{
+	struct drm_device *dev = chan->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	int i, hdr = IS_G80 ? 0x200 : 0x20;
+
+	NV_DEBUG(dev, "ch%d\n", chan->id);
+
+	if (!chan->ramin || !chan->ramin->gpuobj)
+		return;
+
+	dev_priv->engine.instmem.prepare_access(dev, true);
+	for (i = hdr; i < hdr + 24; i += 4)
+		nv_wo32(dev, chan->ramin->gpuobj, i/4, 0);
+	dev_priv->engine.instmem.finish_access(dev);
+
+	nouveau_gpuobj_ref_del(dev, &chan->ramin_grctx);
+}
+
+static int
+nv50_graph_do_load_context(struct drm_device *dev, uint32_t inst)
+{
+	uint32_t fifo = nv_rd32(dev, 0x400500);
+
+	nv_wr32(dev, 0x400500, fifo & ~1);
+	nv_wr32(dev, 0x400784, inst);
+	nv_wr32(dev, 0x400824, nv_rd32(dev, 0x400824) | 0x40);
+	nv_wr32(dev, 0x400320, nv_rd32(dev, 0x400320) | 0x11);
+	nv_wr32(dev, 0x400040, 0xffffffff);
+	(void)nv_rd32(dev, 0x400040);
+	nv_wr32(dev, 0x400040, 0x00000000);
+	nv_wr32(dev, 0x400304, nv_rd32(dev, 0x400304) | 1);
+
+	if (nouveau_wait_for_idle(dev))
+		nv_wr32(dev, 0x40032c, inst | (1<<31));
+	nv_wr32(dev, 0x400500, fifo);
+
+	return 0;
+}
+
+int
+nv50_graph_load_context(struct nouveau_channel *chan)
+{
+	uint32_t inst = chan->ramin->instance >> 12;
+
+	NV_DEBUG(chan->dev, "ch%d\n", chan->id);
+	return nv50_graph_do_load_context(chan->dev, inst);
+}
+
+int
+nv50_graph_unload_context(struct drm_device *dev)
+{
+	uint32_t inst, fifo = nv_rd32(dev, 0x400500);
+
+	inst  = nv_rd32(dev, NV50_PGRAPH_CTXCTL_CUR);
+	if (!(inst & NV50_PGRAPH_CTXCTL_CUR_LOADED))
+		return 0;
+	inst &= NV50_PGRAPH_CTXCTL_CUR_INSTANCE;
+
+	nv_wr32(dev, 0x400500, fifo & ~1);
+	nv_wr32(dev, 0x400784, inst);
+	nv_wr32(dev, 0x400824, nv_rd32(dev, 0x400824) | 0x20);
+	nv_wr32(dev, 0x400304, nv_rd32(dev, 0x400304) | 0x01);
+	nouveau_wait_for_idle(dev);
+	nv_wr32(dev, 0x400500, fifo);
+
+	nv_wr32(dev, NV50_PGRAPH_CTXCTL_CUR, inst);
+	return 0;
+}
+
+void
+nv50_graph_context_switch(struct drm_device *dev)
+{
+	uint32_t inst;
+
+	nv50_graph_unload_context(dev);
+
+	inst  = nv_rd32(dev, NV50_PGRAPH_CTXCTL_NEXT);
+	inst &= NV50_PGRAPH_CTXCTL_NEXT_INSTANCE;
+	nv50_graph_do_load_context(dev, inst);
+
+	nv_wr32(dev, NV40_PGRAPH_INTR_EN, nv_rd32(dev,
+		NV40_PGRAPH_INTR_EN) | NV_PGRAPH_INTR_CONTEXT_SWITCH);
+}
+
+static int
+nv50_graph_nvsw_dma_vblsem(struct nouveau_channel *chan, int grclass,
+			   int mthd, uint32_t data)
+{
+	struct nouveau_gpuobj_ref *ref = NULL;
+
+	if (nouveau_gpuobj_ref_find(chan, data, &ref))
+		return -ENOENT;
+
+	if (nouveau_notifier_offset(ref->gpuobj, NULL))
+		return -EINVAL;
+
+	chan->nvsw.vblsem = ref->gpuobj;
+	chan->nvsw.vblsem_offset = ~0;
+	return 0;
+}
+
+static int
+nv50_graph_nvsw_vblsem_offset(struct nouveau_channel *chan, int grclass,
+			      int mthd, uint32_t data)
+{
+	if (nouveau_notifier_offset(chan->nvsw.vblsem, &data))
+		return -ERANGE;
+
+	chan->nvsw.vblsem_offset = data >> 2;
+	return 0;
+}
+
+static int
+nv50_graph_nvsw_vblsem_release_val(struct nouveau_channel *chan, int grclass,
+				   int mthd, uint32_t data)
+{
+	chan->nvsw.vblsem_rval = data;
+	return 0;
+}
+
+static int
+nv50_graph_nvsw_vblsem_release(struct nouveau_channel *chan, int grclass,
+			       int mthd, uint32_t data)
+{
+	struct drm_device *dev = chan->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+
+	if (!chan->nvsw.vblsem || chan->nvsw.vblsem_offset == ~0 || data > 1)
+		return -EINVAL;
+
+	if (!(nv_rd32(dev, NV50_PDISPLAY_INTR_EN) &
+		      NV50_PDISPLAY_INTR_EN_VBLANK_CRTC_(data))) {
+		nv_wr32(dev, NV50_PDISPLAY_INTR_1,
+			NV50_PDISPLAY_INTR_1_VBLANK_CRTC_(data));
+		nv_wr32(dev, NV50_PDISPLAY_INTR_EN, nv_rd32(dev,
+			NV50_PDISPLAY_INTR_EN) |
+			NV50_PDISPLAY_INTR_EN_VBLANK_CRTC_(data));
+	}
+
+	list_add(&chan->nvsw.vbl_wait, &dev_priv->vbl_waiting);
+	return 0;
+}
+
+static struct nouveau_pgraph_object_method nv50_graph_nvsw_methods[] = {
+	{ 0x018c, nv50_graph_nvsw_dma_vblsem },
+	{ 0x0400, nv50_graph_nvsw_vblsem_offset },
+	{ 0x0404, nv50_graph_nvsw_vblsem_release_val },
+	{ 0x0408, nv50_graph_nvsw_vblsem_release },
+	{}
+};
+
+struct nouveau_pgraph_object_class nv50_graph_grclass[] = {
+	{ 0x506e, true, nv50_graph_nvsw_methods }, /* nvsw */
+	{ 0x0030, false, NULL }, /* null */
+	{ 0x5039, false, NULL }, /* m2mf */
+	{ 0x502d, false, NULL }, /* 2d */
+	{ 0x50c0, false, NULL }, /* compute */
+	{ 0x5097, false, NULL }, /* tesla (nv50) */
+	{ 0x8297, false, NULL }, /* tesla (nv80/nv90) */
+	{ 0x8397, false, NULL }, /* tesla (nva0) */
+	{ 0x8597, false, NULL }, /* tesla (nva8) */
+	{}
+};
diff --git a/drivers/gpu/drm/nouveau/nv50_instmem.c b/drivers/gpu/drm/nouveau/nv50_instmem.c
new file mode 100644
index 000000000000..94400f777e7f
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nv50_instmem.c
@@ -0,0 +1,509 @@
+/*
+ * Copyright (C) 2007 Ben Skeggs.
+ *
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial
+ * portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE COPYRIGHT OWNER(S) AND/OR ITS SUPPLIERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
+#include "drmP.h"
+#include "drm.h"
+#include "nouveau_drv.h"
+
+struct nv50_instmem_priv {
+	uint32_t save1700[5]; /* 0x1700->0x1710 */
+
+	struct nouveau_gpuobj_ref *pramin_pt;
+	struct nouveau_gpuobj_ref *pramin_bar;
+	struct nouveau_gpuobj_ref *fb_bar;
+
+	bool last_access_wr;
+};
+
+#define NV50_INSTMEM_PAGE_SHIFT 12
+#define NV50_INSTMEM_PAGE_SIZE  (1 << NV50_INSTMEM_PAGE_SHIFT)
+#define NV50_INSTMEM_PT_SIZE(a)	(((a) >> 12) << 3)
+
+/*NOTE: - Assumes 0x1700 already covers the correct MiB of PRAMIN
+ */
+#define BAR0_WI32(g, o, v) do {                                   \
+	uint32_t offset;                                          \
+	if ((g)->im_backing) {                                    \
+		offset = (g)->im_backing_start;                   \
+	} else {                                                  \
+		offset  = chan->ramin->gpuobj->im_backing_start;  \
+		offset += (g)->im_pramin->start;                  \
+	}                                                         \
+	offset += (o);                                            \
+	nv_wr32(dev, NV_RAMIN + (offset & 0xfffff), (v));              \
+} while (0)
+
+int
+nv50_instmem_init(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_channel *chan;
+	uint32_t c_offset, c_size, c_ramfc, c_vmpd, c_base, pt_size;
+	struct nv50_instmem_priv *priv;
+	int ret, i;
+	uint32_t v, save_nv001700;
+
+	priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+	if (!priv)
+		return -ENOMEM;
+	dev_priv->engine.instmem.priv = priv;
+
+	/* Save state, will restore at takedown. */
+	for (i = 0x1700; i <= 0x1710; i += 4)
+		priv->save1700[(i-0x1700)/4] = nv_rd32(dev, i);
+
+	/* Reserve the last MiB of VRAM, we should probably try to avoid
+	 * setting up the below tables over the top of the VBIOS image at
+	 * some point.
+	 */
+	dev_priv->ramin_rsvd_vram = 1 << 20;
+	c_offset = nouveau_mem_fb_amount(dev) - dev_priv->ramin_rsvd_vram;
+	c_size   = 128 << 10;
+	c_vmpd   = ((dev_priv->chipset & 0xf0) == 0x50) ? 0x1400 : 0x200;
+	c_ramfc  = ((dev_priv->chipset & 0xf0) == 0x50) ? 0x0 : 0x20;
+	c_base   = c_vmpd + 0x4000;
+	pt_size  = NV50_INSTMEM_PT_SIZE(dev_priv->ramin_size);
+
+	NV_DEBUG(dev, " Rsvd VRAM base: 0x%08x\n", c_offset);
+	NV_DEBUG(dev, "    VBIOS image: 0x%08x\n",
+				(nv_rd32(dev, 0x619f04) & ~0xff) << 8);
+	NV_DEBUG(dev, "  Aperture size: %d MiB\n", dev_priv->ramin_size >> 20);
+	NV_DEBUG(dev, "        PT size: %d KiB\n", pt_size >> 10);
+
+	/* Determine VM layout, we need to do this first to make sure
+	 * we allocate enough memory for all the page tables.
+	 */
+	dev_priv->vm_gart_base = roundup(NV50_VM_BLOCK, NV50_VM_BLOCK);
+	dev_priv->vm_gart_size = NV50_VM_BLOCK;
+
+	dev_priv->vm_vram_base = dev_priv->vm_gart_base + dev_priv->vm_gart_size;
+	dev_priv->vm_vram_size = nouveau_mem_fb_amount(dev);
+	if (dev_priv->vm_vram_size > NV50_VM_MAX_VRAM)
+		dev_priv->vm_vram_size = NV50_VM_MAX_VRAM;
+	dev_priv->vm_vram_size = roundup(dev_priv->vm_vram_size, NV50_VM_BLOCK);
+	dev_priv->vm_vram_pt_nr = dev_priv->vm_vram_size / NV50_VM_BLOCK;
+
+	dev_priv->vm_end = dev_priv->vm_vram_base + dev_priv->vm_vram_size;
+
+	NV_DEBUG(dev, "NV50VM: GART 0x%016llx-0x%016llx\n",
+		 dev_priv->vm_gart_base,
+		 dev_priv->vm_gart_base + dev_priv->vm_gart_size - 1);
+	NV_DEBUG(dev, "NV50VM: VRAM 0x%016llx-0x%016llx\n",
+		 dev_priv->vm_vram_base,
+		 dev_priv->vm_vram_base + dev_priv->vm_vram_size - 1);
+
+	c_size += dev_priv->vm_vram_pt_nr * (NV50_VM_BLOCK / 65536 * 8);
+
+	/* Map BAR0 PRAMIN aperture over the memory we want to use */
+	save_nv001700 = nv_rd32(dev, NV50_PUNK_BAR0_PRAMIN);
+	nv_wr32(dev, NV50_PUNK_BAR0_PRAMIN, (c_offset >> 16));
+
+	/* Create a fake channel, and use it as our "dummy" channels 0/127.
+	 * The main reason for creating a channel is so we can use the gpuobj
+	 * code.  However, it's probably worth noting that NVIDIA also setup
+	 * their channels 0/127 with the same values they configure here.
+	 * So, there may be some other reason for doing this.
+	 *
+	 * Have to create the entire channel manually, as the real channel
+	 * creation code assumes we have PRAMIN access, and we don't until
+	 * we're done here.
+	 */
+	chan = kzalloc(sizeof(*chan), GFP_KERNEL);
+	if (!chan)
+		return -ENOMEM;
+	chan->id = 0;
+	chan->dev = dev;
+	chan->file_priv = (struct drm_file *)-2;
+	dev_priv->fifos[0] = dev_priv->fifos[127] = chan;
+
+	/* Channel's PRAMIN object + heap */
+	ret = nouveau_gpuobj_new_fake(dev, 0, c_offset, c_size, 0,
+							NULL, &chan->ramin);
+	if (ret)
+		return ret;
+
+	if (nouveau_mem_init_heap(&chan->ramin_heap, c_base, c_size - c_base))
+		return -ENOMEM;
+
+	/* RAMFC + zero channel's PRAMIN up to start of VM pagedir */
+	ret = nouveau_gpuobj_new_fake(dev, c_ramfc, c_offset + c_ramfc,
+						0x4000, 0, NULL, &chan->ramfc);
+	if (ret)
+		return ret;
+
+	for (i = 0; i < c_vmpd; i += 4)
+		BAR0_WI32(chan->ramin->gpuobj, i, 0);
+
+	/* VM page directory */
+	ret = nouveau_gpuobj_new_fake(dev, c_vmpd, c_offset + c_vmpd,
+					   0x4000, 0, &chan->vm_pd, NULL);
+	if (ret)
+		return ret;
+	for (i = 0; i < 0x4000; i += 8) {
+		BAR0_WI32(chan->vm_pd, i + 0x00, 0x00000000);
+		BAR0_WI32(chan->vm_pd, i + 0x04, 0x00000000);
+	}
+
+	/* PRAMIN page table, cheat and map into VM at 0x0000000000.
+	 * We map the entire fake channel into the start of the PRAMIN BAR
+	 */
+	ret = nouveau_gpuobj_new_ref(dev, chan, NULL, 0, pt_size, 0x1000,
+							0, &priv->pramin_pt);
+	if (ret)
+		return ret;
+
+	for (i = 0, v = c_offset; i < pt_size; i += 8, v += 0x1000) {
+		if (v < (c_offset + c_size))
+			BAR0_WI32(priv->pramin_pt->gpuobj, i + 0, v | 1);
+		else
+			BAR0_WI32(priv->pramin_pt->gpuobj, i + 0, 0x00000009);
+		BAR0_WI32(priv->pramin_pt->gpuobj, i + 4, 0x00000000);
+	}
+
+	BAR0_WI32(chan->vm_pd, 0x00, priv->pramin_pt->instance | 0x63);
+	BAR0_WI32(chan->vm_pd, 0x04, 0x00000000);
+
+	/* VRAM page table(s), mapped into VM at +1GiB  */
+	for (i = 0; i < dev_priv->vm_vram_pt_nr; i++) {
+		ret = nouveau_gpuobj_new_ref(dev, chan, NULL, 0,
+					     NV50_VM_BLOCK/65536*8, 0, 0,
+					     &chan->vm_vram_pt[i]);
+		if (ret) {
+			NV_ERROR(dev, "Error creating VRAM page tables: %d\n",
+									ret);
+			dev_priv->vm_vram_pt_nr = i;
+			return ret;
+		}
+		dev_priv->vm_vram_pt[i] = chan->vm_vram_pt[i]->gpuobj;
+
+		for (v = 0; v < dev_priv->vm_vram_pt[i]->im_pramin->size;
+								v += 4)
+			BAR0_WI32(dev_priv->vm_vram_pt[i], v, 0);
+
+		BAR0_WI32(chan->vm_pd, 0x10 + (i*8),
+			  chan->vm_vram_pt[i]->instance | 0x61);
+		BAR0_WI32(chan->vm_pd, 0x14 + (i*8), 0);
+	}
+
+	/* DMA object for PRAMIN BAR */
+	ret = nouveau_gpuobj_new_ref(dev, chan, chan, 0, 6*4, 16, 0,
+							&priv->pramin_bar);
+	if (ret)
+		return ret;
+	BAR0_WI32(priv->pramin_bar->gpuobj, 0x00, 0x7fc00000);
+	BAR0_WI32(priv->pramin_bar->gpuobj, 0x04, dev_priv->ramin_size - 1);
+	BAR0_WI32(priv->pramin_bar->gpuobj, 0x08, 0x00000000);
+	BAR0_WI32(priv->pramin_bar->gpuobj, 0x0c, 0x00000000);
+	BAR0_WI32(priv->pramin_bar->gpuobj, 0x10, 0x00000000);
+	BAR0_WI32(priv->pramin_bar->gpuobj, 0x14, 0x00000000);
+
+	/* DMA object for FB BAR */
+	ret = nouveau_gpuobj_new_ref(dev, chan, chan, 0, 6*4, 16, 0,
+							&priv->fb_bar);
+	if (ret)
+		return ret;
+	BAR0_WI32(priv->fb_bar->gpuobj, 0x00, 0x7fc00000);
+	BAR0_WI32(priv->fb_bar->gpuobj, 0x04, 0x40000000 +
+					      drm_get_resource_len(dev, 1) - 1);
+	BAR0_WI32(priv->fb_bar->gpuobj, 0x08, 0x40000000);
+	BAR0_WI32(priv->fb_bar->gpuobj, 0x0c, 0x00000000);
+	BAR0_WI32(priv->fb_bar->gpuobj, 0x10, 0x00000000);
+	BAR0_WI32(priv->fb_bar->gpuobj, 0x14, 0x00000000);
+
+	/* Poke the relevant regs, and pray it works :) */
+	nv_wr32(dev, NV50_PUNK_BAR_CFG_BASE, (chan->ramin->instance >> 12));
+	nv_wr32(dev, NV50_PUNK_UNK1710, 0);
+	nv_wr32(dev, NV50_PUNK_BAR_CFG_BASE, (chan->ramin->instance >> 12) |
+					 NV50_PUNK_BAR_CFG_BASE_VALID);
+	nv_wr32(dev, NV50_PUNK_BAR1_CTXDMA, (priv->fb_bar->instance >> 4) |
+					NV50_PUNK_BAR1_CTXDMA_VALID);
+	nv_wr32(dev, NV50_PUNK_BAR3_CTXDMA, (priv->pramin_bar->instance >> 4) |
+					NV50_PUNK_BAR3_CTXDMA_VALID);
+
+	for (i = 0; i < 8; i++)
+		nv_wr32(dev, 0x1900 + (i*4), 0);
+
+	/* Assume that praying isn't enough, check that we can re-read the
+	 * entire fake channel back from the PRAMIN BAR */
+	dev_priv->engine.instmem.prepare_access(dev, false);
+	for (i = 0; i < c_size; i += 4) {
+		if (nv_rd32(dev, NV_RAMIN + i) != nv_ri32(dev, i)) {
+			NV_ERROR(dev, "Error reading back PRAMIN at 0x%08x\n",
+									i);
+			dev_priv->engine.instmem.finish_access(dev);
+			return -EINVAL;
+		}
+	}
+	dev_priv->engine.instmem.finish_access(dev);
+
+	nv_wr32(dev, NV50_PUNK_BAR0_PRAMIN, save_nv001700);
+
+	/* Global PRAMIN heap */
+	if (nouveau_mem_init_heap(&dev_priv->ramin_heap,
+				  c_size, dev_priv->ramin_size - c_size)) {
+		dev_priv->ramin_heap = NULL;
+		NV_ERROR(dev, "Failed to init RAMIN heap\n");
+	}
+
+	/*XXX: incorrect, but needed to make hash func "work" */
+	dev_priv->ramht_offset = 0x10000;
+	dev_priv->ramht_bits   = 9;
+	dev_priv->ramht_size   = (1 << dev_priv->ramht_bits);
+	return 0;
+}
+
+void
+nv50_instmem_takedown(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nv50_instmem_priv *priv = dev_priv->engine.instmem.priv;
+	struct nouveau_channel *chan = dev_priv->fifos[0];
+	int i;
+
+	NV_DEBUG(dev, "\n");
+
+	if (!priv)
+		return;
+
+	/* Restore state from before init */
+	for (i = 0x1700; i <= 0x1710; i += 4)
+		nv_wr32(dev, i, priv->save1700[(i - 0x1700) / 4]);
+
+	nouveau_gpuobj_ref_del(dev, &priv->fb_bar);
+	nouveau_gpuobj_ref_del(dev, &priv->pramin_bar);
+	nouveau_gpuobj_ref_del(dev, &priv->pramin_pt);
+
+	/* Destroy dummy channel */
+	if (chan) {
+		for (i = 0; i < dev_priv->vm_vram_pt_nr; i++) {
+			nouveau_gpuobj_ref_del(dev, &chan->vm_vram_pt[i]);
+			dev_priv->vm_vram_pt[i] = NULL;
+		}
+		dev_priv->vm_vram_pt_nr = 0;
+
+		nouveau_gpuobj_del(dev, &chan->vm_pd);
+		nouveau_gpuobj_ref_del(dev, &chan->ramfc);
+		nouveau_gpuobj_ref_del(dev, &chan->ramin);
+		nouveau_mem_takedown(&chan->ramin_heap);
+
+		dev_priv->fifos[0] = dev_priv->fifos[127] = NULL;
+		kfree(chan);
+	}
+
+	dev_priv->engine.instmem.priv = NULL;
+	kfree(priv);
+}
+
+int
+nv50_instmem_suspend(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_channel *chan = dev_priv->fifos[0];
+	struct nouveau_gpuobj *ramin = chan->ramin->gpuobj;
+	int i;
+
+	ramin->im_backing_suspend = vmalloc(ramin->im_pramin->size);
+	if (!ramin->im_backing_suspend)
+		return -ENOMEM;
+
+	for (i = 0; i < ramin->im_pramin->size; i += 4)
+		ramin->im_backing_suspend[i/4] = nv_ri32(dev, i);
+	return 0;
+}
+
+void
+nv50_instmem_resume(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nv50_instmem_priv *priv = dev_priv->engine.instmem.priv;
+	struct nouveau_channel *chan = dev_priv->fifos[0];
+	struct nouveau_gpuobj *ramin = chan->ramin->gpuobj;
+	int i;
+
+	nv_wr32(dev, NV50_PUNK_BAR0_PRAMIN, (ramin->im_backing_start >> 16));
+	for (i = 0; i < ramin->im_pramin->size; i += 4)
+		BAR0_WI32(ramin, i, ramin->im_backing_suspend[i/4]);
+	vfree(ramin->im_backing_suspend);
+	ramin->im_backing_suspend = NULL;
+
+	/* Poke the relevant regs, and pray it works :) */
+	nv_wr32(dev, NV50_PUNK_BAR_CFG_BASE, (chan->ramin->instance >> 12));
+	nv_wr32(dev, NV50_PUNK_UNK1710, 0);
+	nv_wr32(dev, NV50_PUNK_BAR_CFG_BASE, (chan->ramin->instance >> 12) |
+					 NV50_PUNK_BAR_CFG_BASE_VALID);
+	nv_wr32(dev, NV50_PUNK_BAR1_CTXDMA, (priv->fb_bar->instance >> 4) |
+					NV50_PUNK_BAR1_CTXDMA_VALID);
+	nv_wr32(dev, NV50_PUNK_BAR3_CTXDMA, (priv->pramin_bar->instance >> 4) |
+					NV50_PUNK_BAR3_CTXDMA_VALID);
+
+	for (i = 0; i < 8; i++)
+		nv_wr32(dev, 0x1900 + (i*4), 0);
+}
+
+int
+nv50_instmem_populate(struct drm_device *dev, struct nouveau_gpuobj *gpuobj,
+		      uint32_t *sz)
+{
+	int ret;
+
+	if (gpuobj->im_backing)
+		return -EINVAL;
+
+	*sz = (*sz + (NV50_INSTMEM_PAGE_SIZE-1)) & ~(NV50_INSTMEM_PAGE_SIZE-1);
+	if (*sz == 0)
+		return -EINVAL;
+
+	ret = nouveau_bo_new(dev, NULL, *sz, 0, TTM_PL_FLAG_VRAM, 0, 0x0000,
+			     true, false, &gpuobj->im_backing);
+	if (ret) {
+		NV_ERROR(dev, "error getting PRAMIN backing pages: %d\n", ret);
+		return ret;
+	}
+
+	ret = nouveau_bo_pin(gpuobj->im_backing, TTM_PL_FLAG_VRAM);
+	if (ret) {
+		NV_ERROR(dev, "error pinning PRAMIN backing VRAM: %d\n", ret);
+		nouveau_bo_ref(NULL, &gpuobj->im_backing);
+		return ret;
+	}
+
+	gpuobj->im_backing_start = gpuobj->im_backing->bo.mem.mm_node->start;
+	gpuobj->im_backing_start <<= PAGE_SHIFT;
+
+	return 0;
+}
+
+void
+nv50_instmem_clear(struct drm_device *dev, struct nouveau_gpuobj *gpuobj)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+
+	if (gpuobj && gpuobj->im_backing) {
+		if (gpuobj->im_bound)
+			dev_priv->engine.instmem.unbind(dev, gpuobj);
+		nouveau_bo_unpin(gpuobj->im_backing);
+		nouveau_bo_ref(NULL, &gpuobj->im_backing);
+		gpuobj->im_backing = NULL;
+	}
+}
+
+int
+nv50_instmem_bind(struct drm_device *dev, struct nouveau_gpuobj *gpuobj)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nv50_instmem_priv *priv = dev_priv->engine.instmem.priv;
+	uint32_t pte, pte_end, vram;
+
+	if (!gpuobj->im_backing || !gpuobj->im_pramin || gpuobj->im_bound)
+		return -EINVAL;
+
+	NV_DEBUG(dev, "st=0x%0llx sz=0x%0llx\n",
+		 gpuobj->im_pramin->start, gpuobj->im_pramin->size);
+
+	pte     = (gpuobj->im_pramin->start >> 12) << 3;
+	pte_end = ((gpuobj->im_pramin->size >> 12) << 3) + pte;
+	vram    = gpuobj->im_backing_start;
+
+	NV_DEBUG(dev, "pramin=0x%llx, pte=%d, pte_end=%d\n",
+		 gpuobj->im_pramin->start, pte, pte_end);
+	NV_DEBUG(dev, "first vram page: 0x%08x\n", gpuobj->im_backing_start);
+
+	dev_priv->engine.instmem.prepare_access(dev, true);
+	while (pte < pte_end) {
+		nv_wo32(dev, priv->pramin_pt->gpuobj, (pte + 0)/4, vram | 1);
+		nv_wo32(dev, priv->pramin_pt->gpuobj, (pte + 4)/4, 0x00000000);
+
+		pte += 8;
+		vram += NV50_INSTMEM_PAGE_SIZE;
+	}
+	dev_priv->engine.instmem.finish_access(dev);
+
+	nv_wr32(dev, 0x100c80, 0x00040001);
+	if (!nv_wait(0x100c80, 0x00000001, 0x00000000)) {
+		NV_ERROR(dev, "timeout: (0x100c80 & 1) == 0 (1)\n");
+		NV_ERROR(dev, "0x100c80 = 0x%08x\n", nv_rd32(dev, 0x100c80));
+		return -EBUSY;
+	}
+
+	nv_wr32(dev, 0x100c80, 0x00060001);
+	if (!nv_wait(0x100c80, 0x00000001, 0x00000000)) {
+		NV_ERROR(dev, "timeout: (0x100c80 & 1) == 0 (2)\n");
+		NV_ERROR(dev, "0x100c80 = 0x%08x\n", nv_rd32(dev, 0x100c80));
+		return -EBUSY;
+	}
+
+	gpuobj->im_bound = 1;
+	return 0;
+}
+
+int
+nv50_instmem_unbind(struct drm_device *dev, struct nouveau_gpuobj *gpuobj)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nv50_instmem_priv *priv = dev_priv->engine.instmem.priv;
+	uint32_t pte, pte_end;
+
+	if (gpuobj->im_bound == 0)
+		return -EINVAL;
+
+	pte     = (gpuobj->im_pramin->start >> 12) << 3;
+	pte_end = ((gpuobj->im_pramin->size >> 12) << 3) + pte;
+
+	dev_priv->engine.instmem.prepare_access(dev, true);
+	while (pte < pte_end) {
+		nv_wo32(dev, priv->pramin_pt->gpuobj, (pte + 0)/4, 0x00000009);
+		nv_wo32(dev, priv->pramin_pt->gpuobj, (pte + 4)/4, 0x00000000);
+		pte += 8;
+	}
+	dev_priv->engine.instmem.finish_access(dev);
+
+	gpuobj->im_bound = 0;
+	return 0;
+}
+
+void
+nv50_instmem_prepare_access(struct drm_device *dev, bool write)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nv50_instmem_priv *priv = dev_priv->engine.instmem.priv;
+
+	priv->last_access_wr = write;
+}
+
+void
+nv50_instmem_finish_access(struct drm_device *dev)
+{
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nv50_instmem_priv *priv = dev_priv->engine.instmem.priv;
+
+	if (priv->last_access_wr) {
+		nv_wr32(dev, 0x070000, 0x00000001);
+		if (!nv_wait(0x070000, 0x00000001, 0x00000000))
+			NV_ERROR(dev, "PRAMIN flush timeout\n");
+	}
+}
+
diff --git a/drivers/gpu/drm/nouveau/nv50_mc.c b/drivers/gpu/drm/nouveau/nv50_mc.c
new file mode 100644
index 000000000000..e0a9c3faa202
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nv50_mc.c
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2007 Ben Skeggs.
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial
+ * portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE COPYRIGHT OWNER(S) AND/OR ITS SUPPLIERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
+#include "drmP.h"
+#include "drm.h"
+#include "nouveau_drv.h"
+
+int
+nv50_mc_init(struct drm_device *dev)
+{
+	nv_wr32(dev, NV03_PMC_ENABLE, 0xFFFFFFFF);
+	return 0;
+}
+
+void nv50_mc_takedown(struct drm_device *dev)
+{
+}
diff --git a/drivers/gpu/drm/nouveau/nv50_sor.c b/drivers/gpu/drm/nouveau/nv50_sor.c
new file mode 100644
index 000000000000..e395c16d30f5
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nv50_sor.c
@@ -0,0 +1,309 @@
+/*
+ * Copyright (C) 2008 Maarten Maathuis.
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial
+ * portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE COPYRIGHT OWNER(S) AND/OR ITS SUPPLIERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
+#include "drmP.h"
+#include "drm_crtc_helper.h"
+
+#define NOUVEAU_DMA_DEBUG (nouveau_reg_debug & NOUVEAU_REG_DEBUG_EVO)
+#include "nouveau_reg.h"
+#include "nouveau_drv.h"
+#include "nouveau_dma.h"
+#include "nouveau_encoder.h"
+#include "nouveau_connector.h"
+#include "nouveau_crtc.h"
+#include "nv50_display.h"
+
+static void
+nv50_sor_disconnect(struct nouveau_encoder *nv_encoder)
+{
+	struct drm_device *dev = to_drm_encoder(nv_encoder)->dev;
+	struct drm_nouveau_private *dev_priv = dev->dev_private;
+	struct nouveau_channel *evo = dev_priv->evo;
+	int ret;
+
+	NV_DEBUG_KMS(dev, "Disconnecting SOR %d\n", nv_encoder->or);
+
+	ret = RING_SPACE(evo, 2);
+	if (ret) {
+		NV_ERROR(dev, "no space while disconnecting SOR\n");
+		return;
+	}
+	BEGIN_RING(evo, 0, NV50_EVO_SOR(nv_encoder->or, MODE_CTRL), 1);
+	OUT_RING(evo, 0);
+}
+
+static void
+nv50_sor_dp_link_train(struct drm_encoder *encoder)
+{
+	struct drm_device *dev = encoder->dev;
+	struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
+	struct bit_displayport_encoder_table *dpe;
+	int dpe_headerlen;
+
+	dpe = nouveau_bios_dp_table(dev, nv_encoder->dcb, &dpe_headerlen);
+	if (!dpe) {
+		NV_ERROR(dev, "SOR-%d: no DP encoder table!\n", nv_encoder->or);
+		return;
+	}
+
+	if (dpe->script0) {
+		NV_DEBUG_KMS(dev, "SOR-%d: running DP script 0\n", nv_encoder->or);
+		nouveau_bios_run_init_table(dev, le16_to_cpu(dpe->script0),
+					    nv_encoder->dcb);
+	}
+
+	if (!nouveau_dp_link_train(encoder))
+		NV_ERROR(dev, "SOR-%d: link training failed\n", nv_encoder->or);
+
+	if (dpe->script1) {
+		NV_DEBUG_KMS(dev, "SOR-%d: running DP script 1\n", nv_encoder->or);
+		nouveau_bios_run_init_table(dev, le16_to_cpu(dpe->script1),
+					    nv_encoder->dcb);
+	}
+}
+
+static void
+nv50_sor_dpms(struct drm_encoder *encoder, int mode)
+{
+	struct drm_device *dev = encoder->dev;
+	struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
+	uint32_t val;
+	int or = nv_encoder->or;
+
+	NV_DEBUG_KMS(dev, "or %d mode %d\n", or, mode);
+
+	/* wait for it to be done */
+	if (!nv_wait(NV50_PDISPLAY_SOR_DPMS_CTRL(or),
+		     NV50_PDISPLAY_SOR_DPMS_CTRL_PENDING, 0)) {
+		NV_ERROR(dev, "timeout: SOR_DPMS_CTRL_PENDING(%d) == 0\n", or);
+		NV_ERROR(dev, "SOR_DPMS_CTRL(%d) = 0x%08x\n", or,
+			 nv_rd32(dev, NV50_PDISPLAY_SOR_DPMS_CTRL(or)));
+	}
+
+	val = nv_rd32(dev, NV50_PDISPLAY_SOR_DPMS_CTRL(or));
+
+	if (mode == DRM_MODE_DPMS_ON)
+		val |= NV50_PDISPLAY_SOR_DPMS_CTRL_ON;
+	else
+		val &= ~NV50_PDISPLAY_SOR_DPMS_CTRL_ON;
+
+	nv_wr32(dev, NV50_PDISPLAY_SOR_DPMS_CTRL(or), val |
+		NV50_PDISPLAY_SOR_DPMS_CTRL_PENDING);
+	if (!nv_wait(NV50_PDISPLAY_SOR_DPMS_STATE(or),
+		     NV50_PDISPLAY_SOR_DPMS_STATE_WAIT, 0)) {
+		NV_ERROR(dev, "timeout: SOR_DPMS_STATE_WAIT(%d) == 0\n", or);
+		NV_ERROR(dev, "SOR_DPMS_STATE(%d) = 0x%08x\n", or,
+			 nv_rd32(dev, NV50_PDISPLAY_SOR_DPMS_STATE(or)));
+	}
+
+	if (nv_encoder->dcb->type == OUTPUT_DP && mode == DRM_MODE_DPMS_ON)
+		nv50_sor_dp_link_train(encoder);
+}
+
+static void
+nv50_sor_save(struct drm_encoder *encoder)
+{
+	NV_ERROR(encoder->dev, "!!\n");
+}
+
+static void
+nv50_sor_restore(struct drm_encoder *encoder)
+{
+	NV_ERROR(encoder->dev, "!!\n");
+}
+
+static bool
+nv50_sor_mode_fixup(struct drm_encoder *encoder, struct drm_display_mode *mode,
+		    struct drm_display_mode *adjusted_mode)
+{
+	struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
+	struct nouveau_connector *connector;
+
+	NV_DEBUG_KMS(encoder->dev, "or %d\n", nv_encoder->or);
+
+	connector = nouveau_encoder_connector_get(nv_encoder);
+	if (!connector) {
+		NV_ERROR(encoder->dev, "Encoder has no connector\n");
+		return false;
+	}
+
+	if (connector->scaling_mode != DRM_MODE_SCALE_NONE &&
+	     connector->native_mode) {
+		int id = adjusted_mode->base.id;
+		*adjusted_mode = *connector->native_mode;
+		adjusted_mode->base.id = id;
+	}
+
+	return true;
+}
+
+static void
+nv50_sor_prepare(struct drm_encoder *encoder)
+{
+}
+
+static void
+nv50_sor_commit(struct drm_encoder *encoder)
+{
+}
+
+static void
+nv50_sor_mode_set(struct drm_encoder *encoder, struct drm_display_mode *mode,
+		  struct drm_display_mode *adjusted_mode)
+{
+	struct drm_nouveau_private *dev_priv = encoder->dev->dev_private;
+	struct nouveau_channel *evo = dev_priv->evo;
+	struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
+	struct drm_device *dev = encoder->dev;
+	struct nouveau_crtc *crtc = nouveau_crtc(encoder->crtc);
+	uint32_t mode_ctl = 0;
+	int ret;
+
+	NV_DEBUG_KMS(dev, "or %d\n", nv_encoder->or);
+
+	nv50_sor_dpms(encoder, DRM_MODE_DPMS_ON);
+
+	switch (nv_encoder->dcb->type) {
+	case OUTPUT_TMDS:
+		if (nv_encoder->dcb->sorconf.link & 1) {
+			if (adjusted_mode->clock < 165000)
+				mode_ctl = 0x0100;
+			else
+				mode_ctl = 0x0500;
+		} else
+			mode_ctl = 0x0200;
+		break;
+	case OUTPUT_DP:
+		mode_ctl |= 0x00050000;
+		if (nv_encoder->dcb->sorconf.link & 1)
+			mode_ctl |= 0x00000800;
+		else
+			mode_ctl |= 0x00000900;
+		break;
+	default:
+		break;
+	}
+
+	if (crtc->index == 1)
+		mode_ctl |= NV50_EVO_SOR_MODE_CTRL_CRTC1;
+	else
+		mode_ctl |= NV50_EVO_SOR_MODE_CTRL_CRTC0;
+
+	if (adjusted_mode->flags & DRM_MODE_FLAG_NHSYNC)
+		mode_ctl |= NV50_EVO_SOR_MODE_CTRL_NHSYNC;
+
+	if (adjusted_mode->flags & DRM_MODE_FLAG_NVSYNC)
+		mode_ctl |= NV50_EVO_SOR_MODE_CTRL_NVSYNC;
+
+	ret = RING_SPACE(evo, 2);
+	if (ret) {
+		NV_ERROR(dev, "no space while connecting SOR\n");
+		return;
+	}
+	BEGIN_RING(evo, 0, NV50_EVO_SOR(nv_encoder->or, MODE_CTRL), 1);
+	OUT_RING(evo, mode_ctl);
+}
+
+static const struct drm_encoder_helper_funcs nv50_sor_helper_funcs = {
+	.dpms = nv50_sor_dpms,
+	.save = nv50_sor_save,
+	.restore = nv50_sor_restore,
+	.mode_fixup = nv50_sor_mode_fixup,
+	.prepare = nv50_sor_prepare,
+	.commit = nv50_sor_commit,
+	.mode_set = nv50_sor_mode_set,
+	.detect = NULL
+};
+
+static void
+nv50_sor_destroy(struct drm_encoder *encoder)
+{
+	struct nouveau_encoder *nv_encoder = nouveau_encoder(encoder);
+
+	if (!encoder)
+		return;
+
+	NV_DEBUG_KMS(encoder->dev, "\n");
+
+	drm_encoder_cleanup(encoder);
+
+	kfree(nv_encoder);
+}
+
+static const struct drm_encoder_funcs nv50_sor_encoder_funcs = {
+	.destroy = nv50_sor_destroy,
+};
+
+int
+nv50_sor_create(struct drm_device *dev, struct dcb_entry *entry)
+{
+	struct nouveau_encoder *nv_encoder = NULL;
+	struct drm_encoder *encoder;
+	bool dum;
+	int type;
+
+	NV_DEBUG_KMS(dev, "\n");
+
+	switch (entry->type) {
+	case OUTPUT_TMDS:
+		NV_INFO(dev, "Detected a TMDS output\n");
+		type = DRM_MODE_ENCODER_TMDS;
+		break;
+	case OUTPUT_LVDS:
+		NV_INFO(dev, "Detected a LVDS output\n");
+		type = DRM_MODE_ENCODER_LVDS;
+
+		if (nouveau_bios_parse_lvds_table(dev, 0, &dum, &dum)) {
+			NV_ERROR(dev, "Failed parsing LVDS table\n");
+			return -EINVAL;
+		}
+		break;
+	case OUTPUT_DP:
+		NV_INFO(dev, "Detected a DP output\n");
+		type = DRM_MODE_ENCODER_TMDS;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	nv_encoder = kzalloc(sizeof(*nv_encoder), GFP_KERNEL);
+	if (!nv_encoder)
+		return -ENOMEM;
+	encoder = to_drm_encoder(nv_encoder);
+
+	nv_encoder->dcb = entry;
+	nv_encoder->or = ffs(entry->or) - 1;
+
+	nv_encoder->disconnect = nv50_sor_disconnect;
+
+	drm_encoder_init(dev, encoder, &nv50_sor_encoder_funcs, type);
+	drm_encoder_helper_add(encoder, &nv50_sor_helper_funcs);
+
+	encoder->possible_crtcs = entry->heads;
+	encoder->possible_clones = 0;
+
+	return 0;
+}
diff --git a/drivers/gpu/drm/nouveau/nvreg.h b/drivers/gpu/drm/nouveau/nvreg.h
new file mode 100644
index 000000000000..5998c35237b0
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/nvreg.h
@@ -0,0 +1,535 @@
+/* $XConsortium: nvreg.h /main/2 1996/10/28 05:13:41 kaleb $ */
+/*
+ * Copyright 1996-1997  David J. McKay
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * DAVID J. MCKAY BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+ * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF
+ * OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+/* $XFree86: xc/programs/Xserver/hw/xfree86/drivers/nv/nvreg.h,v 1.6 2002/01/25 21:56:06 tsi Exp $ */
+
+#ifndef __NVREG_H_
+#define __NVREG_H_
+
+#define NV_PMC_OFFSET               0x00000000
+#define NV_PMC_SIZE                 0x00001000
+
+#define NV_PBUS_OFFSET              0x00001000
+#define NV_PBUS_SIZE                0x00001000
+
+#define NV_PFIFO_OFFSET             0x00002000
+#define NV_PFIFO_SIZE               0x00002000
+
+#define NV_HDIAG_OFFSET             0x00005000
+#define NV_HDIAG_SIZE               0x00001000
+
+#define NV_PRAM_OFFSET              0x00006000
+#define NV_PRAM_SIZE                0x00001000
+
+#define NV_PVIDEO_OFFSET            0x00008000
+#define NV_PVIDEO_SIZE              0x00001000
+
+#define NV_PTIMER_OFFSET            0x00009000
+#define NV_PTIMER_SIZE              0x00001000
+
+#define NV_PPM_OFFSET               0x0000A000
+#define NV_PPM_SIZE                 0x00001000
+
+#define NV_PTV_OFFSET               0x0000D000
+#define NV_PTV_SIZE                 0x00001000
+
+#define NV_PRMVGA_OFFSET            0x000A0000
+#define NV_PRMVGA_SIZE              0x00020000
+
+#define NV_PRMVIO0_OFFSET           0x000C0000
+#define NV_PRMVIO_SIZE              0x00002000
+#define NV_PRMVIO1_OFFSET           0x000C2000
+
+#define NV_PFB_OFFSET               0x00100000
+#define NV_PFB_SIZE                 0x00001000
+
+#define NV_PEXTDEV_OFFSET           0x00101000
+#define NV_PEXTDEV_SIZE             0x00001000
+
+#define NV_PME_OFFSET               0x00200000
+#define NV_PME_SIZE                 0x00001000
+
+#define NV_PROM_OFFSET              0x00300000
+#define NV_PROM_SIZE                0x00010000
+
+#define NV_PGRAPH_OFFSET            0x00400000
+#define NV_PGRAPH_SIZE              0x00010000
+
+#define NV_PCRTC0_OFFSET            0x00600000
+#define NV_PCRTC0_SIZE              0x00002000 /* empirical */
+
+#define NV_PRMCIO0_OFFSET           0x00601000
+#define NV_PRMCIO_SIZE              0x00002000
+#define NV_PRMCIO1_OFFSET           0x00603000
+
+#define NV50_DISPLAY_OFFSET           0x00610000
+#define NV50_DISPLAY_SIZE             0x0000FFFF
+
+#define NV_PRAMDAC0_OFFSET          0x00680000
+#define NV_PRAMDAC0_SIZE            0x00002000
+
+#define NV_PRMDIO0_OFFSET           0x00681000
+#define NV_PRMDIO_SIZE              0x00002000
+#define NV_PRMDIO1_OFFSET           0x00683000
+
+#define NV_PRAMIN_OFFSET            0x00700000
+#define NV_PRAMIN_SIZE              0x00100000
+
+#define NV_FIFO_OFFSET              0x00800000
+#define NV_FIFO_SIZE                0x00800000
+
+#define NV_PMC_BOOT_0			0x00000000
+#define NV_PMC_ENABLE			0x00000200
+
+#define NV_VIO_VSE2			0x000003c3
+#define NV_VIO_SRX			0x000003c4
+
+#define NV_CIO_CRX__COLOR		0x000003d4
+#define NV_CIO_CR__COLOR		0x000003d5
+
+#define NV_PBUS_DEBUG_1			0x00001084
+#define NV_PBUS_DEBUG_4			0x00001098
+#define NV_PBUS_DEBUG_DUALHEAD_CTL	0x000010f0
+#define NV_PBUS_POWERCTRL_1		0x00001584
+#define NV_PBUS_POWERCTRL_2		0x00001588
+#define NV_PBUS_POWERCTRL_4		0x00001590
+#define NV_PBUS_PCI_NV_19		0x0000184C
+#define NV_PBUS_PCI_NV_20		0x00001850
+#	define NV_PBUS_PCI_NV_20_ROM_SHADOW_DISABLED	(0 << 0)
+#	define NV_PBUS_PCI_NV_20_ROM_SHADOW_ENABLED	(1 << 0)
+
+#define NV_PFIFO_RAMHT			0x00002210
+
+#define NV_PTV_TV_INDEX			0x0000d220
+#define NV_PTV_TV_DATA			0x0000d224
+#define NV_PTV_HFILTER			0x0000d310
+#define NV_PTV_HFILTER2			0x0000d390
+#define NV_PTV_VFILTER			0x0000d510
+
+#define NV_PRMVIO_MISC__WRITE		0x000c03c2
+#define NV_PRMVIO_SRX			0x000c03c4
+#define NV_PRMVIO_SR			0x000c03c5
+#	define NV_VIO_SR_RESET_INDEX		0x00
+#	define NV_VIO_SR_CLOCK_INDEX		0x01
+#	define NV_VIO_SR_PLANE_MASK_INDEX	0x02
+#	define NV_VIO_SR_CHAR_MAP_INDEX		0x03
+#	define NV_VIO_SR_MEM_MODE_INDEX		0x04
+#define NV_PRMVIO_MISC__READ		0x000c03cc
+#define NV_PRMVIO_GRX			0x000c03ce
+#define NV_PRMVIO_GX			0x000c03cf
+#	define NV_VIO_GX_SR_INDEX		0x00
+#	define NV_VIO_GX_SREN_INDEX		0x01
+#	define NV_VIO_GX_CCOMP_INDEX		0x02
+#	define NV_VIO_GX_ROP_INDEX		0x03
+#	define NV_VIO_GX_READ_MAP_INDEX		0x04
+#	define NV_VIO_GX_MODE_INDEX		0x05
+#	define NV_VIO_GX_MISC_INDEX		0x06
+#	define NV_VIO_GX_DONT_CARE_INDEX	0x07
+#	define NV_VIO_GX_BIT_MASK_INDEX		0x08
+
+#define NV_PFB_BOOT_0			0x00100000
+#define NV_PFB_CFG0			0x00100200
+#define NV_PFB_CFG1			0x00100204
+#define NV_PFB_CSTATUS			0x0010020C
+#define NV_PFB_REFCTRL			0x00100210
+#	define NV_PFB_REFCTRL_VALID_1			(1 << 31)
+#define NV_PFB_PAD			0x0010021C
+#	define NV_PFB_PAD_CKE_NORMAL			(1 << 0)
+#define NV_PFB_TILE_NV10		0x00100240
+#define NV_PFB_TILE_SIZE_NV10		0x00100244
+#define NV_PFB_REF			0x001002D0
+#	define NV_PFB_REF_CMD_REFRESH			(1 << 0)
+#define NV_PFB_PRE			0x001002D4
+#	define NV_PFB_PRE_CMD_PRECHARGE			(1 << 0)
+#define NV_PFB_CLOSE_PAGE2		0x0010033C
+#define NV_PFB_TILE_NV40		0x00100600
+#define NV_PFB_TILE_SIZE_NV40		0x00100604
+
+#define NV_PEXTDEV_BOOT_0		0x00101000
+#	define NV_PEXTDEV_BOOT_0_STRAP_FP_IFACE_12BIT	(8 << 12)
+#define NV_PEXTDEV_BOOT_3		0x0010100c
+
+#define NV_PCRTC_INTR_0					0x00600100
+#	define NV_PCRTC_INTR_0_VBLANK				(1 << 0)
+#define NV_PCRTC_INTR_EN_0				0x00600140
+#define NV_PCRTC_START					0x00600800
+#define NV_PCRTC_CONFIG					0x00600804
+#	define NV_PCRTC_CONFIG_START_ADDRESS_NON_VGA		(1 << 0)
+#	define NV_PCRTC_CONFIG_START_ADDRESS_HSYNC		(2 << 0)
+#define NV_PCRTC_CURSOR_CONFIG				0x00600810
+#	define NV_PCRTC_CURSOR_CONFIG_ENABLE_ENABLE		(1 << 0)
+#	define NV_PCRTC_CURSOR_CONFIG_DOUBLE_SCAN_ENABLE	(1 << 4)
+#	define NV_PCRTC_CURSOR_CONFIG_ADDRESS_SPACE_PNVM	(1 << 8)
+#	define NV_PCRTC_CURSOR_CONFIG_CUR_BPP_32		(1 << 12)
+#	define NV_PCRTC_CURSOR_CONFIG_CUR_PIXELS_64		(1 << 16)
+#	define NV_PCRTC_CURSOR_CONFIG_CUR_LINES_32		(2 << 24)
+#	define NV_PCRTC_CURSOR_CONFIG_CUR_LINES_64		(4 << 24)
+#	define NV_PCRTC_CURSOR_CONFIG_CUR_BLEND_ALPHA		(1 << 28)
+
+/* note: PCRTC_GPIO is not available on nv10, and in fact aliases 0x600810 */
+#define NV_PCRTC_GPIO					0x00600818
+#define NV_PCRTC_GPIO_EXT				0x0060081c
+#define NV_PCRTC_830					0x00600830
+#define NV_PCRTC_834					0x00600834
+#define NV_PCRTC_850					0x00600850
+#define NV_PCRTC_ENGINE_CTRL				0x00600860
+#	define NV_CRTC_FSEL_I2C					(1 << 4)
+#	define NV_CRTC_FSEL_OVERLAY				(1 << 12)
+
+#define NV_PRMCIO_ARX			0x006013c0
+#define NV_PRMCIO_AR__WRITE		0x006013c0
+#define NV_PRMCIO_AR__READ		0x006013c1
+#	define NV_CIO_AR_MODE_INDEX		0x10
+#	define NV_CIO_AR_OSCAN_INDEX		0x11
+#	define NV_CIO_AR_PLANE_INDEX		0x12
+#	define NV_CIO_AR_HPP_INDEX		0x13
+#	define NV_CIO_AR_CSEL_INDEX		0x14
+#define NV_PRMCIO_INP0			0x006013c2
+#define NV_PRMCIO_CRX__COLOR		0x006013d4
+#define NV_PRMCIO_CR__COLOR		0x006013d5
+	/* Standard VGA CRTC registers */
+#	define NV_CIO_CR_HDT_INDEX		0x00	/* horizontal display total */
+#	define NV_CIO_CR_HDE_INDEX		0x01	/* horizontal display end */
+#	define NV_CIO_CR_HBS_INDEX		0x02	/* horizontal blanking start */
+#	define NV_CIO_CR_HBE_INDEX		0x03	/* horizontal blanking end */
+#		define NV_CIO_CR_HBE_4_0		4:0
+#	define NV_CIO_CR_HRS_INDEX		0x04	/* horizontal retrace start */
+#	define NV_CIO_CR_HRE_INDEX		0x05	/* horizontal retrace end */
+#		define NV_CIO_CR_HRE_4_0		4:0
+#		define NV_CIO_CR_HRE_HBE_5		7:7
+#	define NV_CIO_CR_VDT_INDEX		0x06	/* vertical display total */
+#	define NV_CIO_CR_OVL_INDEX		0x07	/* overflow bits */
+#		define NV_CIO_CR_OVL_VDT_8		0:0
+#		define NV_CIO_CR_OVL_VDE_8		1:1
+#		define NV_CIO_CR_OVL_VRS_8		2:2
+#		define NV_CIO_CR_OVL_VBS_8		3:3
+#		define NV_CIO_CR_OVL_VDT_9		5:5
+#		define NV_CIO_CR_OVL_VDE_9		6:6
+#		define NV_CIO_CR_OVL_VRS_9		7:7
+#	define NV_CIO_CR_RSAL_INDEX		0x08	/* normally "preset row scan" */
+#	define NV_CIO_CR_CELL_HT_INDEX		0x09	/* cell height?! normally "max scan line" */
+#		define NV_CIO_CR_CELL_HT_VBS_9		5:5
+#		define NV_CIO_CR_CELL_HT_SCANDBL	7:7
+#	define NV_CIO_CR_CURS_ST_INDEX		0x0a	/* cursor start */
+#	define NV_CIO_CR_CURS_END_INDEX		0x0b	/* cursor end */
+#	define NV_CIO_CR_SA_HI_INDEX		0x0c	/* screen start address high */
+#	define NV_CIO_CR_SA_LO_INDEX		0x0d	/* screen start address low */
+#	define NV_CIO_CR_TCOFF_HI_INDEX		0x0e	/* cursor offset high */
+#	define NV_CIO_CR_TCOFF_LO_INDEX		0x0f	/* cursor offset low */
+#	define NV_CIO_CR_VRS_INDEX		0x10	/* vertical retrace start */
+#	define NV_CIO_CR_VRE_INDEX		0x11	/* vertical retrace end */
+#		define NV_CIO_CR_VRE_3_0		3:0
+#	define NV_CIO_CR_VDE_INDEX		0x12	/* vertical display end */
+#	define NV_CIO_CR_OFFSET_INDEX		0x13	/* sets screen pitch */
+#	define NV_CIO_CR_ULINE_INDEX		0x14	/* underline location */
+#	define NV_CIO_CR_VBS_INDEX		0x15	/* vertical blank start */
+#	define NV_CIO_CR_VBE_INDEX		0x16	/* vertical blank end */
+#	define NV_CIO_CR_MODE_INDEX		0x17	/* crtc mode control */
+#	define NV_CIO_CR_LCOMP_INDEX		0x18	/* line compare */
+	/* Extended VGA CRTC registers */
+#	define NV_CIO_CRE_RPC0_INDEX		0x19	/* repaint control 0 */
+#		define NV_CIO_CRE_RPC0_OFFSET_10_8	7:5
+#	define NV_CIO_CRE_RPC1_INDEX		0x1a	/* repaint control 1 */
+#		define NV_CIO_CRE_RPC1_LARGE		2:2
+#	define NV_CIO_CRE_FF_INDEX		0x1b	/* fifo control */
+#	define NV_CIO_CRE_ENH_INDEX		0x1c	/* enhanced? */
+#	define NV_CIO_SR_LOCK_INDEX		0x1f	/* crtc lock */
+#		define NV_CIO_SR_UNLOCK_RW_VALUE	0x57
+#		define NV_CIO_SR_LOCK_VALUE		0x99
+#	define NV_CIO_CRE_FFLWM__INDEX		0x20	/* fifo low water mark */
+#	define NV_CIO_CRE_21			0x21	/* vga shadow crtc lock */
+#	define NV_CIO_CRE_LSR_INDEX		0x25	/* ? */
+#		define NV_CIO_CRE_LSR_VDT_10		0:0
+#		define NV_CIO_CRE_LSR_VDE_10		1:1
+#		define NV_CIO_CRE_LSR_VRS_10		2:2
+#		define NV_CIO_CRE_LSR_VBS_10		3:3
+#		define NV_CIO_CRE_LSR_HBE_6		4:4
+#	define NV_CIO_CR_ARX_INDEX		0x26	/* attribute index -- ro copy of 0x60.3c0 */
+#	define NV_CIO_CRE_CHIP_ID_INDEX		0x27	/* chip revision */
+#	define NV_CIO_CRE_PIXEL_INDEX		0x28
+#		define NV_CIO_CRE_PIXEL_FORMAT		1:0
+#	define NV_CIO_CRE_HEB__INDEX		0x2d	/* horizontal extra bits? */
+#		define NV_CIO_CRE_HEB_HDT_8		0:0
+#		define NV_CIO_CRE_HEB_HDE_8		1:1
+#		define NV_CIO_CRE_HEB_HBS_8		2:2
+#		define NV_CIO_CRE_HEB_HRS_8		3:3
+#		define NV_CIO_CRE_HEB_ILC_8		4:4
+#	define NV_CIO_CRE_2E			0x2e	/* some scratch or dummy reg to force writes to sink in */
+#	define NV_CIO_CRE_HCUR_ADDR2_INDEX	0x2f	/* cursor */
+#	define NV_CIO_CRE_HCUR_ADDR0_INDEX	0x30		/* pixmap */
+#		define NV_CIO_CRE_HCUR_ADDR0_ADR	6:0
+#		define NV_CIO_CRE_HCUR_ASI		7:7
+#	define NV_CIO_CRE_HCUR_ADDR1_INDEX	0x31			/* address */
+#		define NV_CIO_CRE_HCUR_ADDR1_ENABLE	0:0
+#		define NV_CIO_CRE_HCUR_ADDR1_CUR_DBL	1:1
+#		define NV_CIO_CRE_HCUR_ADDR1_ADR	7:2
+#	define NV_CIO_CRE_LCD__INDEX		0x33
+#		define NV_CIO_CRE_LCD_LCD_SELECT	0:0
+#	define NV_CIO_CRE_DDC0_STATUS__INDEX	0x36
+#	define NV_CIO_CRE_DDC0_WR__INDEX	0x37
+#	define NV_CIO_CRE_ILACE__INDEX		0x39	/* interlace */
+#	define NV_CIO_CRE_SCRATCH3__INDEX	0x3b
+#	define NV_CIO_CRE_SCRATCH4__INDEX	0x3c
+#	define NV_CIO_CRE_DDC_STATUS__INDEX	0x3e
+#	define NV_CIO_CRE_DDC_WR__INDEX		0x3f
+#	define NV_CIO_CRE_EBR_INDEX		0x41	/* extra bits ? (vertical) */
+#		define NV_CIO_CRE_EBR_VDT_11		0:0
+#		define NV_CIO_CRE_EBR_VDE_11		2:2
+#		define NV_CIO_CRE_EBR_VRS_11		4:4
+#		define NV_CIO_CRE_EBR_VBS_11		6:6
+#	define NV_CIO_CRE_43			0x43
+#	define NV_CIO_CRE_44			0x44	/* head control */
+#	define NV_CIO_CRE_CSB			0x45	/* colour saturation boost */
+#	define NV_CIO_CRE_RCR			0x46
+#		define NV_CIO_CRE_RCR_ENDIAN_BIG	7:7
+#	define NV_CIO_CRE_47			0x47	/* extended fifo lwm, used on nv30+ */
+#	define NV_CIO_CRE_49			0x49
+#	define NV_CIO_CRE_4B			0x4b	/* given patterns in 0x[2-3][a-c] regs, probably scratch 6 */
+#	define NV_CIO_CRE_TVOUT_LATENCY		0x52
+#	define NV_CIO_CRE_53			0x53	/* `fp_htiming' according to Haiku */
+#	define NV_CIO_CRE_54			0x54	/* `fp_vtiming' according to Haiku */
+#	define NV_CIO_CRE_57			0x57	/* index reg for cr58 */
+#	define NV_CIO_CRE_58			0x58	/* data reg for cr57 */
+#	define NV_CIO_CRE_59			0x59	/* related to on/off-chip-ness of digital outputs */
+#	define NV_CIO_CRE_5B			0x5B	/* newer colour saturation reg */
+#	define NV_CIO_CRE_85			0x85
+#	define NV_CIO_CRE_86			0x86
+#define NV_PRMCIO_INP0__COLOR		0x006013da
+
+#define NV_PRAMDAC_CU_START_POS				0x00680300
+#	define NV_PRAMDAC_CU_START_POS_X			15:0
+#	define NV_PRAMDAC_CU_START_POS_Y			31:16
+#define NV_RAMDAC_NV10_CURSYNC				0x00680404
+
+#define NV_PRAMDAC_NVPLL_COEFF				0x00680500
+#define NV_PRAMDAC_MPLL_COEFF				0x00680504
+#define NV_PRAMDAC_VPLL_COEFF				0x00680508
+#	define NV30_RAMDAC_ENABLE_VCO2				(8 << 4)
+
+#define NV_PRAMDAC_PLL_COEFF_SELECT			0x0068050c
+#	define NV_PRAMDAC_PLL_COEFF_SELECT_USE_VPLL2_TRUE	(4 << 0)
+#	define NV_PRAMDAC_PLL_COEFF_SELECT_SOURCE_PROG_MPLL	(1 << 8)
+#	define NV_PRAMDAC_PLL_COEFF_SELECT_SOURCE_PROG_VPLL	(2 << 8)
+#	define NV_PRAMDAC_PLL_COEFF_SELECT_SOURCE_PROG_NVPLL	(4 << 8)
+#	define NV_PRAMDAC_PLL_COEFF_SELECT_PLL_SOURCE_VPLL2	(8 << 8)
+#	define NV_PRAMDAC_PLL_COEFF_SELECT_TV_VSCLK1		(1 << 16)
+#	define NV_PRAMDAC_PLL_COEFF_SELECT_TV_PCLK1		(2 << 16)
+#	define NV_PRAMDAC_PLL_COEFF_SELECT_TV_VSCLK2		(4 << 16)
+#	define NV_PRAMDAC_PLL_COEFF_SELECT_TV_PCLK2		(8 << 16)
+#	define NV_PRAMDAC_PLL_COEFF_SELECT_TV_CLK_SOURCE_VIP	(1 << 20)
+#	define NV_PRAMDAC_PLL_COEFF_SELECT_VCLK_RATIO_DB2	(1 << 28)
+#	define NV_PRAMDAC_PLL_COEFF_SELECT_VCLK2_RATIO_DB2	(2 << 28)
+
+#define NV_PRAMDAC_PLL_SETUP_CONTROL			0x00680510
+#define NV_RAMDAC_VPLL2					0x00680520
+#define NV_PRAMDAC_SEL_CLK				0x00680524
+#define NV_RAMDAC_DITHER_NV11				0x00680528
+#define NV_PRAMDAC_DACCLK				0x0068052c
+#	define NV_PRAMDAC_DACCLK_SEL_DACCLK			(1 << 0)
+
+#define NV_RAMDAC_NVPLL_B				0x00680570
+#define NV_RAMDAC_MPLL_B				0x00680574
+#define NV_RAMDAC_VPLL_B				0x00680578
+#define NV_RAMDAC_VPLL2_B				0x0068057c
+#	define NV31_RAMDAC_ENABLE_VCO2				(8 << 28)
+#define NV_PRAMDAC_580					0x00680580
+#	define NV_RAMDAC_580_VPLL1_ACTIVE			(1 << 8)
+#	define NV_RAMDAC_580_VPLL2_ACTIVE			(1 << 28)
+
+#define NV_PRAMDAC_GENERAL_CONTROL			0x00680600
+#	define NV_PRAMDAC_GENERAL_CONTROL_PIXMIX_ON		(3 << 4)
+#	define NV_PRAMDAC_GENERAL_CONTROL_VGA_STATE_SEL		(1 << 8)
+#	define NV_PRAMDAC_GENERAL_CONTROL_ALT_MODE_SEL		(1 << 12)
+#	define NV_PRAMDAC_GENERAL_CONTROL_TERMINATION_75OHM	(2 << 16)
+#	define NV_PRAMDAC_GENERAL_CONTROL_BPC_8BITS		(1 << 20)
+#	define NV_PRAMDAC_GENERAL_CONTROL_PIPE_LONG		(2 << 28)
+#define NV_PRAMDAC_TEST_CONTROL				0x00680608
+#	define NV_PRAMDAC_TEST_CONTROL_TP_INS_EN_ASSERTED	(1 << 12)
+#	define NV_PRAMDAC_TEST_CONTROL_PWRDWN_DAC_OFF		(1 << 16)
+#	define NV_PRAMDAC_TEST_CONTROL_SENSEB_ALLHI		(1 << 28)
+#define NV_PRAMDAC_TESTPOINT_DATA			0x00680610
+#	define NV_PRAMDAC_TESTPOINT_DATA_NOTBLANK		(8 << 28)
+#define NV_PRAMDAC_630					0x00680630
+#define NV_PRAMDAC_634					0x00680634
+
+#define NV_PRAMDAC_TV_SETUP				0x00680700
+#define NV_PRAMDAC_TV_VTOTAL				0x00680720
+#define NV_PRAMDAC_TV_VSKEW				0x00680724
+#define NV_PRAMDAC_TV_VSYNC_DELAY			0x00680728
+#define NV_PRAMDAC_TV_HTOTAL				0x0068072c
+#define NV_PRAMDAC_TV_HSKEW				0x00680730
+#define NV_PRAMDAC_TV_HSYNC_DELAY			0x00680734
+#define NV_PRAMDAC_TV_HSYNC_DELAY2			0x00680738
+
+#define NV_PRAMDAC_TV_SETUP                             0x00680700
+
+#define NV_PRAMDAC_FP_VDISPLAY_END			0x00680800
+#define NV_PRAMDAC_FP_VTOTAL				0x00680804
+#define NV_PRAMDAC_FP_VCRTC				0x00680808
+#define NV_PRAMDAC_FP_VSYNC_START			0x0068080c
+#define NV_PRAMDAC_FP_VSYNC_END				0x00680810
+#define NV_PRAMDAC_FP_VVALID_START			0x00680814
+#define NV_PRAMDAC_FP_VVALID_END			0x00680818
+#define NV_PRAMDAC_FP_HDISPLAY_END			0x00680820
+#define NV_PRAMDAC_FP_HTOTAL				0x00680824
+#define NV_PRAMDAC_FP_HCRTC				0x00680828
+#define NV_PRAMDAC_FP_HSYNC_START			0x0068082c
+#define NV_PRAMDAC_FP_HSYNC_END				0x00680830
+#define NV_PRAMDAC_FP_HVALID_START			0x00680834
+#define NV_PRAMDAC_FP_HVALID_END			0x00680838
+
+#define NV_RAMDAC_FP_DITHER				0x0068083c
+#define NV_PRAMDAC_FP_TG_CONTROL			0x00680848
+#	define NV_PRAMDAC_FP_TG_CONTROL_VSYNC_POS		(1 << 0)
+#	define NV_PRAMDAC_FP_TG_CONTROL_VSYNC_DISABLE		(2 << 0)
+#	define NV_PRAMDAC_FP_TG_CONTROL_HSYNC_POS		(1 << 4)
+#	define NV_PRAMDAC_FP_TG_CONTROL_HSYNC_DISABLE		(2 << 4)
+#	define NV_PRAMDAC_FP_TG_CONTROL_MODE_SCALE		(0 << 8)
+#	define NV_PRAMDAC_FP_TG_CONTROL_MODE_CENTER		(1 << 8)
+#	define NV_PRAMDAC_FP_TG_CONTROL_MODE_NATIVE		(2 << 8)
+#	define NV_PRAMDAC_FP_TG_CONTROL_READ_PROG		(1 << 20)
+#	define NV_PRAMDAC_FP_TG_CONTROL_WIDTH_12		(1 << 24)
+#	define NV_PRAMDAC_FP_TG_CONTROL_DISPEN_POS		(1 << 28)
+#	define NV_PRAMDAC_FP_TG_CONTROL_DISPEN_DISABLE		(2 << 28)
+#define NV_PRAMDAC_FP_MARGIN_COLOR			0x0068084c
+#define NV_PRAMDAC_850					0x00680850
+#define NV_PRAMDAC_85C					0x0068085c
+#define NV_PRAMDAC_FP_DEBUG_0				0x00680880
+#	define NV_PRAMDAC_FP_DEBUG_0_XSCALE_ENABLE		(1 << 0)
+#	define NV_PRAMDAC_FP_DEBUG_0_YSCALE_ENABLE		(1 << 4)
+/* This doesn't seem to be essential for tmds, but still often set */
+#	define NV_RAMDAC_FP_DEBUG_0_TMDS_ENABLED		(8 << 4)
+#	define NV_PRAMDAC_FP_DEBUG_0_XINTERP_BILINEAR		(1 << 8)
+#	define NV_PRAMDAC_FP_DEBUG_0_YINTERP_BILINEAR		(1 << 12)
+#	define NV_PRAMDAC_FP_DEBUG_0_XWEIGHT_ROUND		(1 << 20)
+#	define NV_PRAMDAC_FP_DEBUG_0_YWEIGHT_ROUND		(1 << 24)
+#       define NV_PRAMDAC_FP_DEBUG_0_PWRDOWN_FPCLK              (1 << 28)
+#define NV_PRAMDAC_FP_DEBUG_1				0x00680884
+#	define NV_PRAMDAC_FP_DEBUG_1_XSCALE_VALUE		11:0
+#	define NV_PRAMDAC_FP_DEBUG_1_XSCALE_TESTMODE_ENABLE	(1 << 12)
+#	define NV_PRAMDAC_FP_DEBUG_1_YSCALE_VALUE		27:16
+#	define NV_PRAMDAC_FP_DEBUG_1_YSCALE_TESTMODE_ENABLE	(1 << 28)
+#define NV_PRAMDAC_FP_DEBUG_2				0x00680888
+#define NV_PRAMDAC_FP_DEBUG_3				0x0068088C
+
+/* see NV_PRAMDAC_INDIR_TMDS in rules.xml */
+#define NV_PRAMDAC_FP_TMDS_CONTROL			0x006808b0
+#	define NV_PRAMDAC_FP_TMDS_CONTROL_WRITE_DISABLE		(1 << 16)
+#define NV_PRAMDAC_FP_TMDS_DATA				0x006808b4
+
+#define NV_PRAMDAC_8C0                                  0x006808c0
+
+/* Some kind of switch */
+#define NV_PRAMDAC_900					0x00680900
+#define NV_PRAMDAC_A20					0x00680A20
+#define NV_PRAMDAC_A24					0x00680A24
+#define NV_PRAMDAC_A34					0x00680A34
+
+#define NV_PRAMDAC_CTV					0x00680c00
+
+/* names fabricated from NV_USER_DAC info */
+#define NV_PRMDIO_PIXEL_MASK		0x006813c6
+#	define NV_PRMDIO_PIXEL_MASK_MASK	0xff
+#define NV_PRMDIO_READ_MODE_ADDRESS	0x006813c7
+#define NV_PRMDIO_WRITE_MODE_ADDRESS	0x006813c8
+#define NV_PRMDIO_PALETTE_DATA		0x006813c9
+
+#define NV_PGRAPH_DEBUG_0		0x00400080
+#define NV_PGRAPH_DEBUG_1		0x00400084
+#define NV_PGRAPH_DEBUG_2_NV04		0x00400088
+#define NV_PGRAPH_DEBUG_2		0x00400620
+#define NV_PGRAPH_DEBUG_3		0x0040008c
+#define NV_PGRAPH_DEBUG_4		0x00400090
+#define NV_PGRAPH_INTR			0x00400100
+#define NV_PGRAPH_INTR_EN		0x00400140
+#define NV_PGRAPH_CTX_CONTROL		0x00400144
+#define NV_PGRAPH_CTX_CONTROL_NV04	0x00400170
+#define NV_PGRAPH_ABS_UCLIP_XMIN	0x0040053C
+#define NV_PGRAPH_ABS_UCLIP_YMIN	0x00400540
+#define NV_PGRAPH_ABS_UCLIP_XMAX	0x00400544
+#define NV_PGRAPH_ABS_UCLIP_YMAX	0x00400548
+#define NV_PGRAPH_BETA_AND		0x00400608
+#define NV_PGRAPH_LIMIT_VIOL_PIX	0x00400610
+#define NV_PGRAPH_BOFFSET0		0x00400640
+#define NV_PGRAPH_BOFFSET1		0x00400644
+#define NV_PGRAPH_BOFFSET2		0x00400648
+#define NV_PGRAPH_BLIMIT0		0x00400684
+#define NV_PGRAPH_BLIMIT1		0x00400688
+#define NV_PGRAPH_BLIMIT2		0x0040068c
+#define NV_PGRAPH_STATUS		0x00400700
+#define NV_PGRAPH_SURFACE		0x00400710
+#define NV_PGRAPH_STATE			0x00400714
+#define NV_PGRAPH_FIFO			0x00400720
+#define NV_PGRAPH_PATTERN_SHAPE		0x00400810
+#define NV_PGRAPH_TILE			0x00400b00
+
+#define NV_PVIDEO_INTR_EN		0x00008140
+#define NV_PVIDEO_BUFFER		0x00008700
+#define NV_PVIDEO_STOP			0x00008704
+#define NV_PVIDEO_UVPLANE_BASE(buff)	(0x00008800+(buff)*4)
+#define NV_PVIDEO_UVPLANE_LIMIT(buff)	(0x00008808+(buff)*4)
+#define NV_PVIDEO_UVPLANE_OFFSET_BUFF(buff)	(0x00008820+(buff)*4)
+#define NV_PVIDEO_BASE(buff)		(0x00008900+(buff)*4)
+#define NV_PVIDEO_LIMIT(buff)		(0x00008908+(buff)*4)
+#define NV_PVIDEO_LUMINANCE(buff)	(0x00008910+(buff)*4)
+#define NV_PVIDEO_CHROMINANCE(buff)	(0x00008918+(buff)*4)
+#define NV_PVIDEO_OFFSET_BUFF(buff)	(0x00008920+(buff)*4)
+#define NV_PVIDEO_SIZE_IN(buff)		(0x00008928+(buff)*4)
+#define NV_PVIDEO_POINT_IN(buff)	(0x00008930+(buff)*4)
+#define NV_PVIDEO_DS_DX(buff)		(0x00008938+(buff)*4)
+#define NV_PVIDEO_DT_DY(buff)		(0x00008940+(buff)*4)
+#define NV_PVIDEO_POINT_OUT(buff)	(0x00008948+(buff)*4)
+#define NV_PVIDEO_SIZE_OUT(buff)	(0x00008950+(buff)*4)
+#define NV_PVIDEO_FORMAT(buff)		(0x00008958+(buff)*4)
+#	define NV_PVIDEO_FORMAT_PLANAR			(1 << 0)
+#	define NV_PVIDEO_FORMAT_COLOR_LE_CR8YB8CB8YA8	(1 << 16)
+#	define NV_PVIDEO_FORMAT_DISPLAY_COLOR_KEY	(1 << 20)
+#	define NV_PVIDEO_FORMAT_MATRIX_ITURBT709	(1 << 24)
+#define NV_PVIDEO_COLOR_KEY		0x00008B00
+
+/* NV04 overlay defines from VIDIX & Haiku */
+#define NV_PVIDEO_INTR_EN_0		0x00680140
+#define NV_PVIDEO_STEP_SIZE		0x00680200
+#define NV_PVIDEO_CONTROL_Y		0x00680204
+#define NV_PVIDEO_CONTROL_X		0x00680208
+#define NV_PVIDEO_BUFF0_START_ADDRESS	0x0068020c
+#define NV_PVIDEO_BUFF0_PITCH_LENGTH	0x00680214
+#define NV_PVIDEO_BUFF0_OFFSET		0x0068021c
+#define NV_PVIDEO_BUFF1_START_ADDRESS	0x00680210
+#define NV_PVIDEO_BUFF1_PITCH_LENGTH	0x00680218
+#define NV_PVIDEO_BUFF1_OFFSET		0x00680220
+#define NV_PVIDEO_OE_STATE		0x00680224
+#define NV_PVIDEO_SU_STATE		0x00680228
+#define NV_PVIDEO_RM_STATE		0x0068022c
+#define NV_PVIDEO_WINDOW_START		0x00680230
+#define NV_PVIDEO_WINDOW_SIZE		0x00680234
+#define NV_PVIDEO_FIFO_THRES_SIZE	0x00680238
+#define NV_PVIDEO_FIFO_BURST_LENGTH	0x0068023c
+#define NV_PVIDEO_KEY			0x00680240
+#define NV_PVIDEO_OVERLAY		0x00680244
+#define NV_PVIDEO_RED_CSC_OFFSET	0x00680280
+#define NV_PVIDEO_GREEN_CSC_OFFSET	0x00680284
+#define NV_PVIDEO_BLUE_CSC_OFFSET	0x00680288
+#define NV_PVIDEO_CSC_ADJUST		0x0068028c
+
+#endif
diff --git a/drivers/gpu/drm/r128/r128_drv.c b/drivers/gpu/drm/r128/r128_drv.c
index 601f4c0e5da5..b806fdcc7170 100644
--- a/drivers/gpu/drm/r128/r128_drv.c
+++ b/drivers/gpu/drm/r128/r128_drv.c
@@ -64,7 +64,7 @@ static struct drm_driver driver = {
 		.owner = THIS_MODULE,
 		.open = drm_open,
 		.release = drm_release,
-		.ioctl = drm_ioctl,
+		.unlocked_ioctl = drm_ioctl,
 		.mmap = drm_mmap,
 		.poll = drm_poll,
 		.fasync = drm_fasync,
diff --git a/drivers/gpu/drm/r128/r128_ioc32.c b/drivers/gpu/drm/r128/r128_ioc32.c
index d3cb676eee84..51c99fc4dd38 100644
--- a/drivers/gpu/drm/r128/r128_ioc32.c
+++ b/drivers/gpu/drm/r128/r128_ioc32.c
@@ -95,8 +95,7 @@ static int compat_r128_init(struct file *file, unsigned int cmd,
 			  &init->agp_textures_offset))
 		return -EFAULT;
 
-	return drm_ioctl(file->f_path.dentry->d_inode, file,
-			 DRM_IOCTL_R128_INIT, (unsigned long)init);
+	return drm_ioctl(file, DRM_IOCTL_R128_INIT, (unsigned long)init);
 }
 
 typedef struct drm_r128_depth32 {
@@ -129,8 +128,7 @@ static int compat_r128_depth(struct file *file, unsigned int cmd,
 			  &depth->mask))
 		return -EFAULT;
 
-	return drm_ioctl(file->f_path.dentry->d_inode, file,
-			 DRM_IOCTL_R128_DEPTH, (unsigned long)depth);
+	return drm_ioctl(file, DRM_IOCTL_R128_DEPTH, (unsigned long)depth);
 
 }
 
@@ -153,8 +151,7 @@ static int compat_r128_stipple(struct file *file, unsigned int cmd,
 			  &stipple->mask))
 		return -EFAULT;
 
-	return drm_ioctl(file->f_path.dentry->d_inode, file,
-			 DRM_IOCTL_R128_STIPPLE, (unsigned long)stipple);
+	return drm_ioctl(file, DRM_IOCTL_R128_STIPPLE, (unsigned long)stipple);
 }
 
 typedef struct drm_r128_getparam32 {
@@ -178,8 +175,7 @@ static int compat_r128_getparam(struct file *file, unsigned int cmd,
 			  &getparam->value))
 		return -EFAULT;
 
-	return drm_ioctl(file->f_path.dentry->d_inode, file,
-			 DRM_IOCTL_R128_GETPARAM, (unsigned long)getparam);
+	return drm_ioctl(file, DRM_IOCTL_R128_GETPARAM, (unsigned long)getparam);
 }
 
 drm_ioctl_compat_t *r128_compat_ioctls[] = {
@@ -210,12 +206,10 @@ long r128_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 	if (nr < DRM_COMMAND_BASE + DRM_ARRAY_SIZE(r128_compat_ioctls))
 		fn = r128_compat_ioctls[nr - DRM_COMMAND_BASE];
 
-	lock_kernel();		/* XXX for now */
 	if (fn != NULL)
 		ret = (*fn) (filp, cmd, arg);
 	else
-		ret = drm_ioctl(filp->f_path.dentry->d_inode, filp, cmd, arg);
-	unlock_kernel();
+		ret = drm_ioctl(filp, cmd, arg);
 
 	return ret;
 }
diff --git a/drivers/gpu/drm/radeon/Makefile b/drivers/gpu/drm/radeon/Makefile
index b5713eedd6e1..1cc7b937b1ea 100644
--- a/drivers/gpu/drm/radeon/Makefile
+++ b/drivers/gpu/drm/radeon/Makefile
@@ -24,6 +24,9 @@ $(obj)/rv515_reg_safe.h: $(src)/reg_srcs/rv515 $(obj)/mkregtable
 $(obj)/r300_reg_safe.h: $(src)/reg_srcs/r300 $(obj)/mkregtable
 	$(call if_changed,mkregtable)
 
+$(obj)/r420_reg_safe.h: $(src)/reg_srcs/r420 $(obj)/mkregtable
+	$(call if_changed,mkregtable)
+
 $(obj)/rs600_reg_safe.h: $(src)/reg_srcs/rs600 $(obj)/mkregtable
 	$(call if_changed,mkregtable)
 
@@ -35,6 +38,8 @@ $(obj)/rv515.o: $(obj)/rv515_reg_safe.h
 
 $(obj)/r300.o: $(obj)/r300_reg_safe.h
 
+$(obj)/r420.o: $(obj)/r420_reg_safe.h
+
 $(obj)/rs600.o: $(obj)/rs600_reg_safe.h
 
 radeon-y := radeon_drv.o radeon_cp.o radeon_state.o radeon_mem.o \
@@ -49,7 +54,7 @@ radeon-y += radeon_device.o radeon_kms.o \
 	radeon_cs.o radeon_bios.o radeon_benchmark.o r100.o r300.o r420.o \
 	rs400.o rs600.o rs690.o rv515.o r520.o r600.o rv770.o radeon_test.o \
 	r200.o radeon_legacy_tv.o r600_cs.o r600_blit.o r600_blit_shaders.o \
-	r600_blit_kms.o radeon_pm.o
+	r600_blit_kms.o radeon_pm.o atombios_dp.o r600_audio.o r600_hdmi.o
 
 radeon-$(CONFIG_COMPAT) += radeon_ioc32.o
 
diff --git a/drivers/gpu/drm/radeon/ObjectID.h b/drivers/gpu/drm/radeon/ObjectID.h
index 6d0183c61d3b..c714179d1bfa 100644
--- a/drivers/gpu/drm/radeon/ObjectID.h
+++ b/drivers/gpu/drm/radeon/ObjectID.h
@@ -1,5 +1,5 @@
 /*
-* Copyright 2006-2007 Advanced Micro Devices, Inc.
+* Copyright 2006-2007 Advanced Micro Devices, Inc.  
 *
 * Permission is hereby granted, free of charge, to any person obtaining a
 * copy of this software and associated documentation files (the "Software"),
@@ -41,14 +41,14 @@
 /****************************************************/
 /* Encoder Object ID Definition                     */
 /****************************************************/
-#define ENCODER_OBJECT_ID_NONE                    0x00
+#define ENCODER_OBJECT_ID_NONE                    0x00 
 
 /* Radeon Class Display Hardware */
 #define ENCODER_OBJECT_ID_INTERNAL_LVDS           0x01
 #define ENCODER_OBJECT_ID_INTERNAL_TMDS1          0x02
 #define ENCODER_OBJECT_ID_INTERNAL_TMDS2          0x03
 #define ENCODER_OBJECT_ID_INTERNAL_DAC1           0x04
-#define ENCODER_OBJECT_ID_INTERNAL_DAC2           0x05	/* TV/CV DAC */
+#define ENCODER_OBJECT_ID_INTERNAL_DAC2           0x05     /* TV/CV DAC */
 #define ENCODER_OBJECT_ID_INTERNAL_SDVOA          0x06
 #define ENCODER_OBJECT_ID_INTERNAL_SDVOB          0x07
 
@@ -56,11 +56,11 @@
 #define ENCODER_OBJECT_ID_SI170B                  0x08
 #define ENCODER_OBJECT_ID_CH7303                  0x09
 #define ENCODER_OBJECT_ID_CH7301                  0x0A
-#define ENCODER_OBJECT_ID_INTERNAL_DVO1           0x0B	/* This belongs to Radeon Class Display Hardware */
+#define ENCODER_OBJECT_ID_INTERNAL_DVO1           0x0B    /* This belongs to Radeon Class Display Hardware */
 #define ENCODER_OBJECT_ID_EXTERNAL_SDVOA          0x0C
 #define ENCODER_OBJECT_ID_EXTERNAL_SDVOB          0x0D
 #define ENCODER_OBJECT_ID_TITFP513                0x0E
-#define ENCODER_OBJECT_ID_INTERNAL_LVTM1          0x0F	/* not used for Radeon */
+#define ENCODER_OBJECT_ID_INTERNAL_LVTM1          0x0F    /* not used for Radeon */
 #define ENCODER_OBJECT_ID_VT1623                  0x10
 #define ENCODER_OBJECT_ID_HDMI_SI1930             0x11
 #define ENCODER_OBJECT_ID_HDMI_INTERNAL           0x12
@@ -68,9 +68,9 @@
 #define ENCODER_OBJECT_ID_INTERNAL_KLDSCP_TMDS1   0x13
 #define ENCODER_OBJECT_ID_INTERNAL_KLDSCP_DVO1    0x14
 #define ENCODER_OBJECT_ID_INTERNAL_KLDSCP_DAC1    0x15
-#define ENCODER_OBJECT_ID_INTERNAL_KLDSCP_DAC2    0x16	/* Shared with CV/TV and CRT */
-#define ENCODER_OBJECT_ID_SI178                   0X17	/* External TMDS (dual link, no HDCP.) */
-#define ENCODER_OBJECT_ID_MVPU_FPGA               0x18	/* MVPU FPGA chip */
+#define ENCODER_OBJECT_ID_INTERNAL_KLDSCP_DAC2    0x16  /* Shared with CV/TV and CRT */
+#define ENCODER_OBJECT_ID_SI178                   0X17  /* External TMDS (dual link, no HDCP.) */
+#define ENCODER_OBJECT_ID_MVPU_FPGA               0x18  /* MVPU FPGA chip */
 #define ENCODER_OBJECT_ID_INTERNAL_DDI            0x19
 #define ENCODER_OBJECT_ID_VT1625                  0x1A
 #define ENCODER_OBJECT_ID_HDMI_SI1932             0x1B
@@ -86,7 +86,7 @@
 /****************************************************/
 /* Connector Object ID Definition                   */
 /****************************************************/
-#define CONNECTOR_OBJECT_ID_NONE                  0x00
+#define CONNECTOR_OBJECT_ID_NONE                  0x00 
 #define CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_I     0x01
 #define CONNECTOR_OBJECT_ID_DUAL_LINK_DVI_I       0x02
 #define CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_D     0x03
@@ -96,7 +96,7 @@
 #define CONNECTOR_OBJECT_ID_SVIDEO                0x07
 #define CONNECTOR_OBJECT_ID_YPbPr                 0x08
 #define CONNECTOR_OBJECT_ID_D_CONNECTOR           0x09
-#define CONNECTOR_OBJECT_ID_9PIN_DIN              0x0A	/* Supports both CV & TV */
+#define CONNECTOR_OBJECT_ID_9PIN_DIN              0x0A  /* Supports both CV & TV */
 #define CONNECTOR_OBJECT_ID_SCART                 0x0B
 #define CONNECTOR_OBJECT_ID_HDMI_TYPE_A           0x0C
 #define CONNECTOR_OBJECT_ID_HDMI_TYPE_B           0x0D
@@ -106,6 +106,8 @@
 #define CONNECTOR_OBJECT_ID_CROSSFIRE             0x11
 #define CONNECTOR_OBJECT_ID_HARDCODE_DVI          0x12
 #define CONNECTOR_OBJECT_ID_DISPLAYPORT           0x13
+#define CONNECTOR_OBJECT_ID_eDP                   0x14
+#define CONNECTOR_OBJECT_ID_MXM                   0x15
 
 /* deleted */
 
@@ -116,6 +118,14 @@
 #define ROUTER_OBJECT_ID_I2C_EXTENDER_CNTL				0x01
 
 /****************************************************/
+/* Generic Object ID Definition                     */
+/****************************************************/
+#define GENERIC_OBJECT_ID_NONE                    0x00
+#define GENERIC_OBJECT_ID_GLSYNC                  0x01
+#define GENERIC_OBJECT_ID_PX2_NON_DRIVABLE        0x02
+#define GENERIC_OBJECT_ID_MXM_OPM                 0x03
+
+/****************************************************/
 /* Graphics Object ENUM ID Definition               */
 /****************************************************/
 #define GRAPH_OBJECT_ENUM_ID1                     0x01
@@ -124,6 +134,7 @@
 #define GRAPH_OBJECT_ENUM_ID4                     0x04
 #define GRAPH_OBJECT_ENUM_ID5                     0x05
 #define GRAPH_OBJECT_ENUM_ID6                     0x06
+#define GRAPH_OBJECT_ENUM_ID7                     0x07
 
 /****************************************************/
 /* Graphics Object ID Bit definition                */
@@ -133,35 +144,35 @@
 #define RESERVED1_ID_MASK                         0x0800
 #define OBJECT_TYPE_MASK                          0x7000
 #define RESERVED2_ID_MASK                         0x8000
-
+                                                  
 #define OBJECT_ID_SHIFT                           0x00
 #define ENUM_ID_SHIFT                             0x08
 #define OBJECT_TYPE_SHIFT                         0x0C
 
+
 /****************************************************/
 /* Graphics Object family definition                */
 /****************************************************/
-#define CONSTRUCTOBJECTFAMILYID(GRAPHICS_OBJECT_TYPE, GRAPHICS_OBJECT_ID) \
-	(GRAPHICS_OBJECT_TYPE << OBJECT_TYPE_SHIFT | \
-	 GRAPHICS_OBJECT_ID   << OBJECT_ID_SHIFT)
+#define CONSTRUCTOBJECTFAMILYID(GRAPHICS_OBJECT_TYPE, GRAPHICS_OBJECT_ID) (GRAPHICS_OBJECT_TYPE << OBJECT_TYPE_SHIFT | \
+                                                                           GRAPHICS_OBJECT_ID   << OBJECT_ID_SHIFT)
 /****************************************************/
 /* GPU Object ID definition - Shared with BIOS      */
 /****************************************************/
-#define GPU_ENUM_ID1	(GRAPH_OBJECT_TYPE_GPU << OBJECT_TYPE_SHIFT |\
-			 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT)
+#define GPU_ENUM_ID1                            ( GRAPH_OBJECT_TYPE_GPU << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT)
 
 /****************************************************/
 /* Encoder Object ID definition - Shared with BIOS  */
 /****************************************************/
 /*
-#define ENCODER_INTERNAL_LVDS_ENUM_ID1        0x2101
+#define ENCODER_INTERNAL_LVDS_ENUM_ID1        0x2101      
 #define ENCODER_INTERNAL_TMDS1_ENUM_ID1       0x2102
 #define ENCODER_INTERNAL_TMDS2_ENUM_ID1       0x2103
 #define ENCODER_INTERNAL_DAC1_ENUM_ID1        0x2104
 #define ENCODER_INTERNAL_DAC2_ENUM_ID1        0x2105
 #define ENCODER_INTERNAL_SDVOA_ENUM_ID1       0x2106
 #define ENCODER_INTERNAL_SDVOB_ENUM_ID1       0x2107
-#define ENCODER_SIL170B_ENUM_ID1              0x2108
+#define ENCODER_SIL170B_ENUM_ID1              0x2108  
 #define ENCODER_CH7303_ENUM_ID1               0x2109
 #define ENCODER_CH7301_ENUM_ID1               0x210A
 #define ENCODER_INTERNAL_DVO1_ENUM_ID1        0x210B
@@ -175,8 +186,8 @@
 #define ENCODER_INTERNAL_KLDSCP_TMDS1_ENUM_ID1   0x2113
 #define ENCODER_INTERNAL_KLDSCP_DVO1_ENUM_ID1    0x2114
 #define ENCODER_INTERNAL_KLDSCP_DAC1_ENUM_ID1    0x2115
-#define ENCODER_INTERNAL_KLDSCP_DAC2_ENUM_ID1    0x2116
-#define ENCODER_SI178_ENUM_ID1                   0x2117
+#define ENCODER_INTERNAL_KLDSCP_DAC2_ENUM_ID1    0x2116  
+#define ENCODER_SI178_ENUM_ID1                   0x2117 
 #define ENCODER_MVPU_FPGA_ENUM_ID1               0x2118
 #define ENCODER_INTERNAL_DDI_ENUM_ID1            0x2119
 #define ENCODER_VT1625_ENUM_ID1                  0x211A
@@ -185,205 +196,169 @@
 #define ENCODER_DP_DP501_ENUM_ID1                0x211D
 #define ENCODER_INTERNAL_UNIPHY_ENUM_ID1         0x211E
 */
-#define ENCODER_INTERNAL_LVDS_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 ENCODER_OBJECT_ID_INTERNAL_LVDS << OBJECT_ID_SHIFT)
-
-#define ENCODER_INTERNAL_TMDS1_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 ENCODER_OBJECT_ID_INTERNAL_TMDS1 << OBJECT_ID_SHIFT)
-
-#define ENCODER_INTERNAL_TMDS2_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 ENCODER_OBJECT_ID_INTERNAL_TMDS2 << OBJECT_ID_SHIFT)
-
-#define ENCODER_INTERNAL_DAC1_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 ENCODER_OBJECT_ID_INTERNAL_DAC1 << OBJECT_ID_SHIFT)
-
-#define ENCODER_INTERNAL_DAC2_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 ENCODER_OBJECT_ID_INTERNAL_DAC2 << OBJECT_ID_SHIFT)
-
-#define ENCODER_INTERNAL_SDVOA_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 ENCODER_OBJECT_ID_INTERNAL_SDVOA << OBJECT_ID_SHIFT)
-
-#define ENCODER_INTERNAL_SDVOA_ENUM_ID2 \
-	(GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID2 << ENUM_ID_SHIFT |\
-	 ENCODER_OBJECT_ID_INTERNAL_SDVOA << OBJECT_ID_SHIFT)
-
-#define ENCODER_INTERNAL_SDVOB_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 ENCODER_OBJECT_ID_INTERNAL_SDVOB << OBJECT_ID_SHIFT)
-
-#define ENCODER_SIL170B_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 ENCODER_OBJECT_ID_SI170B << OBJECT_ID_SHIFT)
-
-#define ENCODER_CH7303_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 ENCODER_OBJECT_ID_CH7303 << OBJECT_ID_SHIFT)
-
-#define ENCODER_CH7301_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 ENCODER_OBJECT_ID_CH7301 << OBJECT_ID_SHIFT)
-
-#define ENCODER_INTERNAL_DVO1_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 ENCODER_OBJECT_ID_INTERNAL_DVO1 << OBJECT_ID_SHIFT)
-
-#define ENCODER_EXTERNAL_SDVOA_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 ENCODER_OBJECT_ID_EXTERNAL_SDVOA << OBJECT_ID_SHIFT)
-
-#define ENCODER_EXTERNAL_SDVOA_ENUM_ID2 \
-	(GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID2 << ENUM_ID_SHIFT |\
-	 ENCODER_OBJECT_ID_EXTERNAL_SDVOA << OBJECT_ID_SHIFT)
-
-#define ENCODER_EXTERNAL_SDVOB_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 ENCODER_OBJECT_ID_EXTERNAL_SDVOB << OBJECT_ID_SHIFT)
-
-#define ENCODER_TITFP513_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 ENCODER_OBJECT_ID_TITFP513 << OBJECT_ID_SHIFT)
-
-#define ENCODER_INTERNAL_LVTM1_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 ENCODER_OBJECT_ID_INTERNAL_LVTM1 << OBJECT_ID_SHIFT)
-
-#define ENCODER_VT1623_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 ENCODER_OBJECT_ID_VT1623 << OBJECT_ID_SHIFT)
-
-#define ENCODER_HDMI_SI1930_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 ENCODER_OBJECT_ID_HDMI_SI1930 << OBJECT_ID_SHIFT)
-
-#define ENCODER_HDMI_INTERNAL_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 ENCODER_OBJECT_ID_HDMI_INTERNAL << OBJECT_ID_SHIFT)
-
-#define ENCODER_INTERNAL_KLDSCP_TMDS1_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 ENCODER_OBJECT_ID_INTERNAL_KLDSCP_TMDS1 << OBJECT_ID_SHIFT)
-
-#define ENCODER_INTERNAL_KLDSCP_TMDS1_ENUM_ID2 \
-	(GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID2 << ENUM_ID_SHIFT |\
-	 ENCODER_OBJECT_ID_INTERNAL_KLDSCP_TMDS1 << OBJECT_ID_SHIFT)
-
-#define ENCODER_INTERNAL_KLDSCP_DVO1_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 ENCODER_OBJECT_ID_INTERNAL_KLDSCP_DVO1 << OBJECT_ID_SHIFT)
-
-#define ENCODER_INTERNAL_KLDSCP_DAC1_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 ENCODER_OBJECT_ID_INTERNAL_KLDSCP_DAC1 << OBJECT_ID_SHIFT)
-
-#define ENCODER_INTERNAL_KLDSCP_DAC2_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 ENCODER_OBJECT_ID_INTERNAL_KLDSCP_DAC2 << OBJECT_ID_SHIFT) /* Shared with CV/TV and CRT */
-
-#define ENCODER_SI178_ENUM_ID1  \
-	(GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 ENCODER_OBJECT_ID_SI178 << OBJECT_ID_SHIFT)
-
-#define ENCODER_MVPU_FPGA_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 ENCODER_OBJECT_ID_MVPU_FPGA << OBJECT_ID_SHIFT)
-
-#define ENCODER_INTERNAL_DDI_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 ENCODER_OBJECT_ID_INTERNAL_DDI << OBJECT_ID_SHIFT)
-
-#define ENCODER_VT1625_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 ENCODER_OBJECT_ID_VT1625 << OBJECT_ID_SHIFT)
-
-#define ENCODER_HDMI_SI1932_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 ENCODER_OBJECT_ID_HDMI_SI1932 << OBJECT_ID_SHIFT)
-
-#define ENCODER_DP_DP501_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 ENCODER_OBJECT_ID_DP_DP501 << OBJECT_ID_SHIFT)
-
-#define ENCODER_DP_AN9801_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 ENCODER_OBJECT_ID_DP_AN9801 << OBJECT_ID_SHIFT)
-
-#define ENCODER_INTERNAL_UNIPHY_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 ENCODER_OBJECT_ID_INTERNAL_UNIPHY << OBJECT_ID_SHIFT)
-
-#define ENCODER_INTERNAL_UNIPHY_ENUM_ID2 \
-	(GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID2 << ENUM_ID_SHIFT |\
-	 ENCODER_OBJECT_ID_INTERNAL_UNIPHY << OBJECT_ID_SHIFT)
-
-#define ENCODER_INTERNAL_KLDSCP_LVTMA_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 ENCODER_OBJECT_ID_INTERNAL_KLDSCP_LVTMA << OBJECT_ID_SHIFT)
-
-#define ENCODER_INTERNAL_UNIPHY1_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 ENCODER_OBJECT_ID_INTERNAL_UNIPHY1 << OBJECT_ID_SHIFT)
-
-#define ENCODER_INTERNAL_UNIPHY1_ENUM_ID2 \
-	(GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID2 << ENUM_ID_SHIFT |\
-	 ENCODER_OBJECT_ID_INTERNAL_UNIPHY1 << OBJECT_ID_SHIFT)
-
-#define ENCODER_INTERNAL_UNIPHY2_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 ENCODER_OBJECT_ID_INTERNAL_UNIPHY2 << OBJECT_ID_SHIFT)
-
-#define ENCODER_INTERNAL_UNIPHY2_ENUM_ID2 \
-	(GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID2 << ENUM_ID_SHIFT |\
-	 ENCODER_OBJECT_ID_INTERNAL_UNIPHY2 << OBJECT_ID_SHIFT)
-
-#define ENCODER_GENERAL_EXTERNAL_DVO_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 ENCODER_OBJECT_ID_GENERAL_EXTERNAL_DVO << OBJECT_ID_SHIFT)
+#define ENCODER_INTERNAL_LVDS_ENUM_ID1     ( GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
+                                             GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                             ENCODER_OBJECT_ID_INTERNAL_LVDS << OBJECT_ID_SHIFT)
+
+#define ENCODER_INTERNAL_TMDS1_ENUM_ID1    ( GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
+                                             GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                             ENCODER_OBJECT_ID_INTERNAL_TMDS1 << OBJECT_ID_SHIFT)
+
+#define ENCODER_INTERNAL_TMDS2_ENUM_ID1    ( GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
+                                             GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                             ENCODER_OBJECT_ID_INTERNAL_TMDS2 << OBJECT_ID_SHIFT)
+
+#define ENCODER_INTERNAL_DAC1_ENUM_ID1     ( GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
+                                             GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                             ENCODER_OBJECT_ID_INTERNAL_DAC1 << OBJECT_ID_SHIFT)
+
+#define ENCODER_INTERNAL_DAC2_ENUM_ID1     ( GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
+                                             GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                             ENCODER_OBJECT_ID_INTERNAL_DAC2 << OBJECT_ID_SHIFT)
+
+#define ENCODER_INTERNAL_SDVOA_ENUM_ID1    ( GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
+                                             GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                             ENCODER_OBJECT_ID_INTERNAL_SDVOA << OBJECT_ID_SHIFT)
+
+#define ENCODER_INTERNAL_SDVOA_ENUM_ID2    ( GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
+                                             GRAPH_OBJECT_ENUM_ID2 << ENUM_ID_SHIFT |\
+                                             ENCODER_OBJECT_ID_INTERNAL_SDVOA << OBJECT_ID_SHIFT)
+
+#define ENCODER_INTERNAL_SDVOB_ENUM_ID1    ( GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
+                                             GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                             ENCODER_OBJECT_ID_INTERNAL_SDVOB << OBJECT_ID_SHIFT)
+
+#define ENCODER_SIL170B_ENUM_ID1           ( GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
+                                             GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                             ENCODER_OBJECT_ID_SI170B << OBJECT_ID_SHIFT)
+
+#define ENCODER_CH7303_ENUM_ID1            ( GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
+                                             GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                             ENCODER_OBJECT_ID_CH7303 << OBJECT_ID_SHIFT)
+
+#define ENCODER_CH7301_ENUM_ID1            ( GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
+                                             GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                             ENCODER_OBJECT_ID_CH7301 << OBJECT_ID_SHIFT)
+
+#define ENCODER_INTERNAL_DVO1_ENUM_ID1     ( GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
+                                             GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                             ENCODER_OBJECT_ID_INTERNAL_DVO1 << OBJECT_ID_SHIFT)
+
+#define ENCODER_EXTERNAL_SDVOA_ENUM_ID1    ( GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
+                                             GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                             ENCODER_OBJECT_ID_EXTERNAL_SDVOA << OBJECT_ID_SHIFT)
+
+#define ENCODER_EXTERNAL_SDVOA_ENUM_ID2    ( GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
+                                             GRAPH_OBJECT_ENUM_ID2 << ENUM_ID_SHIFT |\
+                                             ENCODER_OBJECT_ID_EXTERNAL_SDVOA << OBJECT_ID_SHIFT)
+
+
+#define ENCODER_EXTERNAL_SDVOB_ENUM_ID1    ( GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
+                                             GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                             ENCODER_OBJECT_ID_EXTERNAL_SDVOB << OBJECT_ID_SHIFT)
+
+
+#define ENCODER_TITFP513_ENUM_ID1          ( GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
+                                             GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                             ENCODER_OBJECT_ID_TITFP513 << OBJECT_ID_SHIFT)
+
+#define ENCODER_INTERNAL_LVTM1_ENUM_ID1    ( GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
+                                             GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                             ENCODER_OBJECT_ID_INTERNAL_LVTM1 << OBJECT_ID_SHIFT)
+
+#define ENCODER_VT1623_ENUM_ID1            ( GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
+                                             GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                             ENCODER_OBJECT_ID_VT1623 << OBJECT_ID_SHIFT)
+
+#define ENCODER_HDMI_SI1930_ENUM_ID1       ( GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
+                                             GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                             ENCODER_OBJECT_ID_HDMI_SI1930 << OBJECT_ID_SHIFT)
+
+#define ENCODER_HDMI_INTERNAL_ENUM_ID1     ( GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
+                                             GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                             ENCODER_OBJECT_ID_HDMI_INTERNAL << OBJECT_ID_SHIFT)
+
+#define ENCODER_INTERNAL_KLDSCP_TMDS1_ENUM_ID1   ( GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
+                                                   GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                                   ENCODER_OBJECT_ID_INTERNAL_KLDSCP_TMDS1 << OBJECT_ID_SHIFT)
+
+
+#define ENCODER_INTERNAL_KLDSCP_TMDS1_ENUM_ID2   ( GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
+                                                   GRAPH_OBJECT_ENUM_ID2 << ENUM_ID_SHIFT |\
+                                                   ENCODER_OBJECT_ID_INTERNAL_KLDSCP_TMDS1 << OBJECT_ID_SHIFT)
+
+
+#define ENCODER_INTERNAL_KLDSCP_DVO1_ENUM_ID1    ( GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
+                                                   GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                                   ENCODER_OBJECT_ID_INTERNAL_KLDSCP_DVO1 << OBJECT_ID_SHIFT)
+
+#define ENCODER_INTERNAL_KLDSCP_DAC1_ENUM_ID1    ( GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
+                                                   GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                                   ENCODER_OBJECT_ID_INTERNAL_KLDSCP_DAC1 << OBJECT_ID_SHIFT)
+
+#define ENCODER_INTERNAL_KLDSCP_DAC2_ENUM_ID1    ( GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
+                                                   GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                                   ENCODER_OBJECT_ID_INTERNAL_KLDSCP_DAC2 << OBJECT_ID_SHIFT)  // Shared with CV/TV and CRT
+
+#define ENCODER_SI178_ENUM_ID1                    ( GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
+                                                   GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                                   ENCODER_OBJECT_ID_SI178 << OBJECT_ID_SHIFT)  
+
+#define ENCODER_MVPU_FPGA_ENUM_ID1                ( GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
+                                                   GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                                   ENCODER_OBJECT_ID_MVPU_FPGA << OBJECT_ID_SHIFT)
+
+#define ENCODER_INTERNAL_DDI_ENUM_ID1     (  GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
+                                             GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                             ENCODER_OBJECT_ID_INTERNAL_DDI << OBJECT_ID_SHIFT) 
+
+#define ENCODER_VT1625_ENUM_ID1            ( GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
+                                             GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                             ENCODER_OBJECT_ID_VT1625 << OBJECT_ID_SHIFT)
+
+#define ENCODER_HDMI_SI1932_ENUM_ID1       ( GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
+                                             GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                             ENCODER_OBJECT_ID_HDMI_SI1932 << OBJECT_ID_SHIFT)
+
+#define ENCODER_DP_DP501_ENUM_ID1            ( GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
+                                             GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                             ENCODER_OBJECT_ID_DP_DP501 << OBJECT_ID_SHIFT)
+
+#define ENCODER_DP_AN9801_ENUM_ID1            ( GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
+                                             GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                             ENCODER_OBJECT_ID_DP_AN9801 << OBJECT_ID_SHIFT)
+
+#define ENCODER_INTERNAL_UNIPHY_ENUM_ID1         ( GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                                 ENCODER_OBJECT_ID_INTERNAL_UNIPHY << OBJECT_ID_SHIFT)
+
+#define ENCODER_INTERNAL_UNIPHY_ENUM_ID2         ( GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID2 << ENUM_ID_SHIFT |\
+                                                 ENCODER_OBJECT_ID_INTERNAL_UNIPHY << OBJECT_ID_SHIFT)
+
+#define ENCODER_INTERNAL_KLDSCP_LVTMA_ENUM_ID1   ( GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                                 ENCODER_OBJECT_ID_INTERNAL_KLDSCP_LVTMA << OBJECT_ID_SHIFT)  
+
+#define ENCODER_INTERNAL_UNIPHY1_ENUM_ID1         ( GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                                 ENCODER_OBJECT_ID_INTERNAL_UNIPHY1 << OBJECT_ID_SHIFT)
+
+#define ENCODER_INTERNAL_UNIPHY1_ENUM_ID2         ( GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID2 << ENUM_ID_SHIFT |\
+                                                 ENCODER_OBJECT_ID_INTERNAL_UNIPHY1 << OBJECT_ID_SHIFT)
+
+#define ENCODER_INTERNAL_UNIPHY2_ENUM_ID1         ( GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                                 ENCODER_OBJECT_ID_INTERNAL_UNIPHY2 << OBJECT_ID_SHIFT)
+
+#define ENCODER_INTERNAL_UNIPHY2_ENUM_ID2         ( GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID2 << ENUM_ID_SHIFT |\
+                                                 ENCODER_OBJECT_ID_INTERNAL_UNIPHY2 << OBJECT_ID_SHIFT)
+
+#define ENCODER_GENERAL_EXTERNAL_DVO_ENUM_ID1    ( GRAPH_OBJECT_TYPE_ENCODER << OBJECT_TYPE_SHIFT |\
+                                                  GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                                  ENCODER_OBJECT_ID_GENERAL_EXTERNAL_DVO << OBJECT_ID_SHIFT)
 
 /****************************************************/
 /* Connector Object ID definition - Shared with BIOS */
@@ -406,167 +381,253 @@
 #define CONNECTOR_7PIN_DIN_ENUM_ID1                 0x310F
 #define CONNECTOR_PCIE_CONNECTOR_ENUM_ID1           0x3110
 */
-#define CONNECTOR_LVDS_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 CONNECTOR_OBJECT_ID_LVDS << OBJECT_ID_SHIFT)
-
-#define CONNECTOR_SINGLE_LINK_DVI_I_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_I << OBJECT_ID_SHIFT)
-
-#define CONNECTOR_SINGLE_LINK_DVI_I_ENUM_ID2 \
-	(GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID2 << ENUM_ID_SHIFT |\
-	 CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_I << OBJECT_ID_SHIFT)
-
-#define CONNECTOR_DUAL_LINK_DVI_I_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 CONNECTOR_OBJECT_ID_DUAL_LINK_DVI_I << OBJECT_ID_SHIFT)
-
-#define CONNECTOR_DUAL_LINK_DVI_I_ENUM_ID2 \
-	(GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID2 << ENUM_ID_SHIFT |\
-	 CONNECTOR_OBJECT_ID_DUAL_LINK_DVI_I << OBJECT_ID_SHIFT)
-
-#define CONNECTOR_SINGLE_LINK_DVI_D_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_D << OBJECT_ID_SHIFT)
-
-#define CONNECTOR_SINGLE_LINK_DVI_D_ENUM_ID2 \
-	(GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID2 << ENUM_ID_SHIFT |\
-	 CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_D << OBJECT_ID_SHIFT)
-
-#define CONNECTOR_DUAL_LINK_DVI_D_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 CONNECTOR_OBJECT_ID_DUAL_LINK_DVI_D << OBJECT_ID_SHIFT)
-
-#define CONNECTOR_VGA_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 CONNECTOR_OBJECT_ID_VGA << OBJECT_ID_SHIFT)
-
-#define CONNECTOR_VGA_ENUM_ID2 \
-	(GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID2 << ENUM_ID_SHIFT |\
-	 CONNECTOR_OBJECT_ID_VGA << OBJECT_ID_SHIFT)
-
-#define CONNECTOR_COMPOSITE_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 CONNECTOR_OBJECT_ID_COMPOSITE << OBJECT_ID_SHIFT)
-
-#define CONNECTOR_SVIDEO_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 CONNECTOR_OBJECT_ID_SVIDEO << OBJECT_ID_SHIFT)
-
-#define CONNECTOR_YPbPr_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 CONNECTOR_OBJECT_ID_YPbPr << OBJECT_ID_SHIFT)
-
-#define CONNECTOR_D_CONNECTOR_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 CONNECTOR_OBJECT_ID_D_CONNECTOR << OBJECT_ID_SHIFT)
-
-#define CONNECTOR_9PIN_DIN_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 CONNECTOR_OBJECT_ID_9PIN_DIN << OBJECT_ID_SHIFT)
-
-#define CONNECTOR_SCART_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 CONNECTOR_OBJECT_ID_SCART << OBJECT_ID_SHIFT)
-
-#define CONNECTOR_HDMI_TYPE_A_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 CONNECTOR_OBJECT_ID_HDMI_TYPE_A << OBJECT_ID_SHIFT)
-
-#define CONNECTOR_HDMI_TYPE_B_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 CONNECTOR_OBJECT_ID_HDMI_TYPE_B << OBJECT_ID_SHIFT)
-
-#define CONNECTOR_7PIN_DIN_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 CONNECTOR_OBJECT_ID_7PIN_DIN << OBJECT_ID_SHIFT)
-
-#define CONNECTOR_PCIE_CONNECTOR_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 CONNECTOR_OBJECT_ID_PCIE_CONNECTOR << OBJECT_ID_SHIFT)
-
-#define CONNECTOR_PCIE_CONNECTOR_ENUM_ID2 \
-	(GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID2 << ENUM_ID_SHIFT |\
-	 CONNECTOR_OBJECT_ID_PCIE_CONNECTOR << OBJECT_ID_SHIFT)
-
-#define CONNECTOR_CROSSFIRE_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 CONNECTOR_OBJECT_ID_CROSSFIRE << OBJECT_ID_SHIFT)
-
-#define CONNECTOR_CROSSFIRE_ENUM_ID2 \
-	(GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID2 << ENUM_ID_SHIFT |\
-	 CONNECTOR_OBJECT_ID_CROSSFIRE << OBJECT_ID_SHIFT)
-
-#define CONNECTOR_HARDCODE_DVI_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 CONNECTOR_OBJECT_ID_HARDCODE_DVI << OBJECT_ID_SHIFT)
-
-#define CONNECTOR_HARDCODE_DVI_ENUM_ID2 \
-	(GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID2 << ENUM_ID_SHIFT |\
-	 CONNECTOR_OBJECT_ID_HARDCODE_DVI << OBJECT_ID_SHIFT)
-
-#define CONNECTOR_DISPLAYPORT_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 CONNECTOR_OBJECT_ID_DISPLAYPORT << OBJECT_ID_SHIFT)
-
-#define CONNECTOR_DISPLAYPORT_ENUM_ID2 \
-	(GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID2 << ENUM_ID_SHIFT |\
-	 CONNECTOR_OBJECT_ID_DISPLAYPORT << OBJECT_ID_SHIFT)
-
-#define CONNECTOR_DISPLAYPORT_ENUM_ID3 \
-	(GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID3 << ENUM_ID_SHIFT |\
-	 CONNECTOR_OBJECT_ID_DISPLAYPORT << OBJECT_ID_SHIFT)
-
-#define CONNECTOR_DISPLAYPORT_ENUM_ID4 \
-	(GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID4 << ENUM_ID_SHIFT |\
-	 CONNECTOR_OBJECT_ID_DISPLAYPORT << OBJECT_ID_SHIFT)
+#define CONNECTOR_LVDS_ENUM_ID1                ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_LVDS << OBJECT_ID_SHIFT)
+
+#define CONNECTOR_LVDS_ENUM_ID2                ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID2 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_LVDS << OBJECT_ID_SHIFT)
+
+#define CONNECTOR_eDP_ENUM_ID1                 ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_eDP << OBJECT_ID_SHIFT)
+
+#define CONNECTOR_eDP_ENUM_ID2                 ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID2 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_eDP << OBJECT_ID_SHIFT)
+
+#define CONNECTOR_SINGLE_LINK_DVI_I_ENUM_ID1   ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_I << OBJECT_ID_SHIFT)
+
+#define CONNECTOR_SINGLE_LINK_DVI_I_ENUM_ID2   ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID2 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_I << OBJECT_ID_SHIFT)
+
+#define CONNECTOR_DUAL_LINK_DVI_I_ENUM_ID1     ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_DUAL_LINK_DVI_I << OBJECT_ID_SHIFT)
+
+#define CONNECTOR_DUAL_LINK_DVI_I_ENUM_ID2     ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID2 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_DUAL_LINK_DVI_I << OBJECT_ID_SHIFT)
+
+#define CONNECTOR_SINGLE_LINK_DVI_D_ENUM_ID1   ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_D << OBJECT_ID_SHIFT)
+
+#define CONNECTOR_SINGLE_LINK_DVI_D_ENUM_ID2   ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID2 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_D << OBJECT_ID_SHIFT)
+
+#define CONNECTOR_DUAL_LINK_DVI_D_ENUM_ID1     ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_DUAL_LINK_DVI_D << OBJECT_ID_SHIFT)
+
+#define CONNECTOR_DUAL_LINK_DVI_D_ENUM_ID2     ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID2 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_DUAL_LINK_DVI_D << OBJECT_ID_SHIFT)
+
+#define CONNECTOR_DUAL_LINK_DVI_D_ENUM_ID3     ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID3 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_DUAL_LINK_DVI_D << OBJECT_ID_SHIFT)
+
+#define CONNECTOR_VGA_ENUM_ID1                 ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_VGA << OBJECT_ID_SHIFT)
+
+#define CONNECTOR_VGA_ENUM_ID2                 ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID2 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_VGA << OBJECT_ID_SHIFT)
+
+#define CONNECTOR_COMPOSITE_ENUM_ID1           ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_COMPOSITE << OBJECT_ID_SHIFT)
+
+#define CONNECTOR_COMPOSITE_ENUM_ID2           ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID2 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_COMPOSITE << OBJECT_ID_SHIFT)
+
+#define CONNECTOR_SVIDEO_ENUM_ID1              ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_SVIDEO << OBJECT_ID_SHIFT)
+
+#define CONNECTOR_SVIDEO_ENUM_ID2              ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID2 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_SVIDEO << OBJECT_ID_SHIFT)
+
+#define CONNECTOR_YPbPr_ENUM_ID1               ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_YPbPr << OBJECT_ID_SHIFT)
+
+#define CONNECTOR_YPbPr_ENUM_ID2               ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID2 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_YPbPr << OBJECT_ID_SHIFT)
+
+#define CONNECTOR_D_CONNECTOR_ENUM_ID1         ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_D_CONNECTOR << OBJECT_ID_SHIFT)
+
+#define CONNECTOR_D_CONNECTOR_ENUM_ID2         ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID2 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_D_CONNECTOR << OBJECT_ID_SHIFT)
+
+#define CONNECTOR_9PIN_DIN_ENUM_ID1            ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_9PIN_DIN << OBJECT_ID_SHIFT)
+
+#define CONNECTOR_9PIN_DIN_ENUM_ID2            ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID2 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_9PIN_DIN << OBJECT_ID_SHIFT)
+
+#define CONNECTOR_SCART_ENUM_ID1               ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_SCART << OBJECT_ID_SHIFT)
+
+#define CONNECTOR_SCART_ENUM_ID2               ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID2 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_SCART << OBJECT_ID_SHIFT)
+
+#define CONNECTOR_HDMI_TYPE_A_ENUM_ID1         ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_HDMI_TYPE_A << OBJECT_ID_SHIFT)
+
+#define CONNECTOR_HDMI_TYPE_A_ENUM_ID2         ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID2 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_HDMI_TYPE_A << OBJECT_ID_SHIFT)
+
+#define CONNECTOR_HDMI_TYPE_A_ENUM_ID3         ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID3 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_HDMI_TYPE_A << OBJECT_ID_SHIFT)
+
+#define CONNECTOR_HDMI_TYPE_B_ENUM_ID1         ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_HDMI_TYPE_B << OBJECT_ID_SHIFT)
+
+#define CONNECTOR_HDMI_TYPE_B_ENUM_ID2         ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID2 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_HDMI_TYPE_B << OBJECT_ID_SHIFT)
+
+#define CONNECTOR_7PIN_DIN_ENUM_ID1            ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_7PIN_DIN << OBJECT_ID_SHIFT)
+#define CONNECTOR_7PIN_DIN_ENUM_ID2            ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID2 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_7PIN_DIN << OBJECT_ID_SHIFT)
+
+#define CONNECTOR_PCIE_CONNECTOR_ENUM_ID1      ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_PCIE_CONNECTOR << OBJECT_ID_SHIFT)
+
+#define CONNECTOR_PCIE_CONNECTOR_ENUM_ID2      ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID2 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_PCIE_CONNECTOR << OBJECT_ID_SHIFT)
+
+#define CONNECTOR_CROSSFIRE_ENUM_ID1           ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_CROSSFIRE << OBJECT_ID_SHIFT)
+
+#define CONNECTOR_CROSSFIRE_ENUM_ID2           ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID2 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_CROSSFIRE << OBJECT_ID_SHIFT)
+
+
+#define CONNECTOR_HARDCODE_DVI_ENUM_ID1        ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_HARDCODE_DVI << OBJECT_ID_SHIFT)
+
+#define CONNECTOR_HARDCODE_DVI_ENUM_ID2        ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID2 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_HARDCODE_DVI << OBJECT_ID_SHIFT)
+
+#define CONNECTOR_DISPLAYPORT_ENUM_ID1         ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_DISPLAYPORT << OBJECT_ID_SHIFT)
+
+#define CONNECTOR_DISPLAYPORT_ENUM_ID2         ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID2 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_DISPLAYPORT << OBJECT_ID_SHIFT)
+
+#define CONNECTOR_DISPLAYPORT_ENUM_ID3         ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID3 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_DISPLAYPORT << OBJECT_ID_SHIFT)
+
+#define CONNECTOR_DISPLAYPORT_ENUM_ID4         ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID4 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_DISPLAYPORT << OBJECT_ID_SHIFT)
+
+#define CONNECTOR_DISPLAYPORT_ENUM_ID5         ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID5 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_DISPLAYPORT << OBJECT_ID_SHIFT)
+
+#define CONNECTOR_DISPLAYPORT_ENUM_ID6         ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID6 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_DISPLAYPORT << OBJECT_ID_SHIFT)
+
+#define CONNECTOR_MXM_ENUM_ID1                 ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_MXM << OBJECT_ID_SHIFT)          //Mapping to MXM_DP_A
+
+#define CONNECTOR_MXM_ENUM_ID2                 ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID2 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_MXM << OBJECT_ID_SHIFT)          //Mapping to MXM_DP_B
+
+#define CONNECTOR_MXM_ENUM_ID3                 ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID3 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_MXM << OBJECT_ID_SHIFT)          //Mapping to MXM_DP_C
+
+#define CONNECTOR_MXM_ENUM_ID4                 ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID4 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_MXM << OBJECT_ID_SHIFT)          //Mapping to MXM_DP_D
+
+#define CONNECTOR_MXM_ENUM_ID5                 ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID5 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_MXM << OBJECT_ID_SHIFT)          //Mapping to MXM_LVDS_TXxx
+
+#define CONNECTOR_MXM_ENUM_ID6                 ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID6 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_MXM << OBJECT_ID_SHIFT)          //Mapping to MXM_LVDS_UXxx
+
+#define CONNECTOR_MXM_ENUM_ID7                 ( GRAPH_OBJECT_TYPE_CONNECTOR << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID7 << ENUM_ID_SHIFT |\
+                                                 CONNECTOR_OBJECT_ID_MXM << OBJECT_ID_SHIFT)          //Mapping to MXM_DAC
 
 /****************************************************/
 /* Router Object ID definition - Shared with BIOS   */
 /****************************************************/
-#define ROUTER_I2C_EXTENDER_CNTL_ENUM_ID1 \
-	(GRAPH_OBJECT_TYPE_ROUTER << OBJECT_TYPE_SHIFT |\
-	 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
-	 ROUTER_OBJECT_ID_I2C_EXTENDER_CNTL << OBJECT_ID_SHIFT)
+#define ROUTER_I2C_EXTENDER_CNTL_ENUM_ID1      ( GRAPH_OBJECT_TYPE_ROUTER << OBJECT_TYPE_SHIFT |\
+                                                GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                                ROUTER_OBJECT_ID_I2C_EXTENDER_CNTL << OBJECT_ID_SHIFT)
 
 /* deleted */
 
 /****************************************************/
+/* Generic Object ID definition - Shared with BIOS  */
+/****************************************************/
+#define GENERICOBJECT_GLSYNC_ENUM_ID1           (GRAPH_OBJECT_TYPE_GENERIC << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                                 GENERIC_OBJECT_ID_GLSYNC << OBJECT_ID_SHIFT)
+
+#define GENERICOBJECT_PX2_NON_DRIVABLE_ID1       (GRAPH_OBJECT_TYPE_GENERIC << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                                 GENERIC_OBJECT_ID_PX2_NON_DRIVABLE<< OBJECT_ID_SHIFT)
+
+#define GENERICOBJECT_PX2_NON_DRIVABLE_ID2       (GRAPH_OBJECT_TYPE_GENERIC << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID2 << ENUM_ID_SHIFT |\
+                                                 GENERIC_OBJECT_ID_PX2_NON_DRIVABLE<< OBJECT_ID_SHIFT)
+
+#define GENERICOBJECT_MXM_OPM_ENUM_ID1           (GRAPH_OBJECT_TYPE_GENERIC << OBJECT_TYPE_SHIFT |\
+                                                 GRAPH_OBJECT_ENUM_ID1 << ENUM_ID_SHIFT |\
+                                                 GENERIC_OBJECT_ID_MXM_OPM << OBJECT_ID_SHIFT)
+
+/****************************************************/
 /* Object Cap definition - Shared with BIOS         */
 /****************************************************/
 #define GRAPHICS_OBJECT_CAP_I2C                 0x00000001L
 #define GRAPHICS_OBJECT_CAP_TABLE_ID            0x00000002L
 
+
 #define GRAPHICS_OBJECT_I2CCOMMAND_TABLE_ID                   0x01
 #define GRAPHICS_OBJECT_HOTPLUGDETECTIONINTERUPT_TABLE_ID     0x02
 #define GRAPHICS_OBJECT_ENCODER_OUTPUT_PROTECTION_TABLE_ID    0x03
@@ -575,4 +636,8 @@
 #pragma pack()
 #endif
 
-#endif /*GRAPHICTYPE */
+#endif  /*GRAPHICTYPE */
+
+
+
+
diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
index d67c42555ab9..388140a7e651 100644
--- a/drivers/gpu/drm/radeon/atom.c
+++ b/drivers/gpu/drm/radeon/atom.c
@@ -58,6 +58,7 @@ typedef struct {
 } atom_exec_context;
 
 int atom_debug = 0;
+static void atom_execute_table_locked(struct atom_context *ctx, int index, uint32_t * params);
 void atom_execute_table(struct atom_context *ctx, int index, uint32_t * params);
 
 static uint32_t atom_arg_mask[8] =
@@ -263,10 +264,10 @@ static uint32_t atom_get_src_int(atom_exec_context *ctx, uint8_t attr,
 	case ATOM_ARG_FB:
 		idx = U8(*ptr);
 		(*ptr)++;
+		val = gctx->scratch[((gctx->fb_base + idx) / 4)];
 		if (print)
 			DEBUG("FB[0x%02X]", idx);
-		printk(KERN_INFO "FB access is not implemented.\n");
-		return 0;
+		break;
 	case ATOM_ARG_IMM:
 		switch (align) {
 		case ATOM_SRC_DWORD:
@@ -488,9 +489,9 @@ static void atom_put_dst(atom_exec_context *ctx, int arg, uint8_t attr,
 	case ATOM_ARG_FB:
 		idx = U8(*ptr);
 		(*ptr)++;
+		gctx->scratch[((gctx->fb_base + idx) / 4)] = val;
 		DEBUG("FB[0x%02X]", idx);
-		printk(KERN_INFO "FB access is not implemented.\n");
-		return;
+		break;
 	case ATOM_ARG_PLL:
 		idx = U8(*ptr);
 		(*ptr)++;
@@ -573,7 +574,7 @@ static void atom_op_calltable(atom_exec_context *ctx, int *ptr, int arg)
 	else
 		SDEBUG("   table: %d\n", idx);
 	if (U16(ctx->ctx->cmd_table + 4 + 2 * idx))
-		atom_execute_table(ctx->ctx, idx, ctx->ps + ctx->ps_shift);
+		atom_execute_table_locked(ctx->ctx, idx, ctx->ps + ctx->ps_shift);
 }
 
 static void atom_op_clear(atom_exec_context *ctx, int *ptr, int arg)
@@ -1040,7 +1041,7 @@ static struct {
 	atom_op_shr, ATOM_ARG_MC}, {
 atom_op_debug, 0},};
 
-void atom_execute_table(struct atom_context *ctx, int index, uint32_t * params)
+static void atom_execute_table_locked(struct atom_context *ctx, int index, uint32_t * params)
 {
 	int base = CU16(ctx->cmd_table + 4 + 2 * index);
 	int len, ws, ps, ptr;
@@ -1092,6 +1093,13 @@ void atom_execute_table(struct atom_context *ctx, int index, uint32_t * params)
 		kfree(ectx.ws);
 }
 
+void atom_execute_table(struct atom_context *ctx, int index, uint32_t * params)
+{
+	mutex_lock(&ctx->mutex);
+	atom_execute_table_locked(ctx, index, params);
+	mutex_unlock(&ctx->mutex);
+}
+
 static int atom_iio_len[] = { 1, 2, 3, 3, 3, 3, 4, 4, 4, 3 };
 
 static void atom_index_iio(struct atom_context *ctx, int base)
@@ -1214,3 +1222,28 @@ void atom_parse_cmd_header(struct atom_context *ctx, int index, uint8_t * frev,
 		*crev = CU8(idx + 3);
 	return;
 }
+
+int atom_allocate_fb_scratch(struct atom_context *ctx)
+{
+	int index = GetIndexIntoMasterTable(DATA, VRAM_UsageByFirmware);
+	uint16_t data_offset;
+	int usage_bytes;
+	struct _ATOM_VRAM_USAGE_BY_FIRMWARE *firmware_usage;
+
+	atom_parse_data_header(ctx, index, NULL, NULL, NULL, &data_offset);
+
+	firmware_usage = (struct _ATOM_VRAM_USAGE_BY_FIRMWARE *)(ctx->bios + data_offset);
+
+	DRM_DEBUG("atom firmware requested %08x %dkb\n",
+		  firmware_usage->asFirmwareVramReserveInfo[0].ulStartAddrUsedByFirmware,
+		  firmware_usage->asFirmwareVramReserveInfo[0].usFirmwareUseInKb);
+
+	usage_bytes = firmware_usage->asFirmwareVramReserveInfo[0].usFirmwareUseInKb * 1024;
+	if (usage_bytes == 0)
+		usage_bytes = 20 * 1024;
+	/* allocate some scratch memory */
+	ctx->scratch = kzalloc(usage_bytes, GFP_KERNEL);
+	if (!ctx->scratch)
+		return -ENOMEM;
+	return 0;
+}
diff --git a/drivers/gpu/drm/radeon/atom.h b/drivers/gpu/drm/radeon/atom.h
index e6eb38f2bcae..47fd943f6d14 100644
--- a/drivers/gpu/drm/radeon/atom.h
+++ b/drivers/gpu/drm/radeon/atom.h
@@ -120,6 +120,7 @@ struct card_info {
 
 struct atom_context {
 	struct card_info *card;
+	struct mutex mutex;
 	void *bios;
 	uint32_t cmd_table, data_table;
 	uint16_t *iio;
@@ -132,6 +133,7 @@ struct atom_context {
 	uint8_t shift;
 	int cs_equal, cs_above;
 	int io_mode;
+	uint32_t *scratch;
 };
 
 extern int atom_debug;
@@ -142,6 +144,7 @@ int atom_asic_init(struct atom_context *);
 void atom_destroy(struct atom_context *);
 void atom_parse_data_header(struct atom_context *ctx, int index, uint16_t *size, uint8_t *frev, uint8_t *crev, uint16_t *data_start);
 void atom_parse_cmd_header(struct atom_context *ctx, int index, uint8_t *frev, uint8_t *crev);
+int atom_allocate_fb_scratch(struct atom_context *ctx);
 #include "atom-types.h"
 #include "atombios.h"
 #include "ObjectID.h"
diff --git a/drivers/gpu/drm/radeon/atombios.h b/drivers/gpu/drm/radeon/atombios.h
index c11ddddfb3b6..91ad0d1c1b17 100644
--- a/drivers/gpu/drm/radeon/atombios.h
+++ b/drivers/gpu/drm/radeon/atombios.h
@@ -1141,7 +1141,7 @@ typedef struct _LVDS_ENCODER_CONTROL_PARAMETERS {
 /* ucTableFormatRevision=1,ucTableContentRevision=2 */
 typedef struct _LVDS_ENCODER_CONTROL_PARAMETERS_V2 {
 	USHORT usPixelClock;	/*  in 10KHz; for bios convenient */
-	UCHAR ucMisc;		/*  see PANEL_ENCODER_MISC_xx defintions below */
+	UCHAR ucMisc;		/*  see PANEL_ENCODER_MISC_xx definitions below */
 	UCHAR ucAction;		/*  0: turn off encoder */
 	/*  1: setup and turn on encoder */
 	UCHAR ucTruncate;	/*  bit0=0: Disable truncate */
@@ -1424,7 +1424,7 @@ typedef struct _ATOM_MULTIMEDIA_CONFIG_INFO {
 /*  Structures used in FirmwareInfoTable */
 /****************************************************************************/
 
-/*  usBIOSCapability Defintion: */
+/*  usBIOSCapability Definition: */
 /*  Bit 0 = 0: Bios image is not Posted, =1:Bios image is Posted; */
 /*  Bit 1 = 0: Dual CRTC is not supported, =1: Dual CRTC is supported; */
 /*  Bit 2 = 0: Extended Desktop is not supported, =1: Extended Desktop is supported; */
@@ -2386,7 +2386,7 @@ typedef struct _ATOM_ANALOG_TV_INFO_V1_2 {
 } ATOM_ANALOG_TV_INFO_V1_2;
 
 /**************************************************************************/
-/*  VRAM usage and their defintions */
+/*  VRAM usage and their definitions */
 
 /*  One chunk of VRAM used by Bios are for HWICON surfaces,EDID data. */
 /*  Current Mode timing and Dail Timing and/or STD timing data EACH device. They can be broken down as below. */
@@ -2680,7 +2680,7 @@ typedef struct _ATOM_I2C_RECORD {
 typedef struct _ATOM_HPD_INT_RECORD {
 	ATOM_COMMON_RECORD_HEADER sheader;
 	UCHAR ucHPDIntGPIOID;	/* Corresponding block in GPIO_PIN_INFO table gives the pin info */
-	UCHAR ucPluggged_PinState;
+	UCHAR ucPlugged_PinState;
 } ATOM_HPD_INT_RECORD;
 
 typedef struct _ATOM_OUTPUT_PROTECTION_RECORD {
@@ -3046,7 +3046,7 @@ typedef struct _ATOM_ASIC_INTERNAL_SS_INFO {
 #define ATOM_S0_SYSTEM_POWER_STATE_VALUE_DC     2
 #define ATOM_S0_SYSTEM_POWER_STATE_VALUE_LITEAC 3
 
-/* Byte aligned defintion for BIOS usage */
+/* Byte aligned definition for BIOS usage */
 #define ATOM_S0_CRT1_MONOb0             0x01
 #define ATOM_S0_CRT1_COLORb0            0x02
 #define ATOM_S0_CRT1_MASKb0             (ATOM_S0_CRT1_MONOb0+ATOM_S0_CRT1_COLORb0)
@@ -3131,7 +3131,7 @@ typedef struct _ATOM_ASIC_INTERNAL_SS_INFO {
 #define ATOM_S2_DISPLAY_ROTATION_DEGREE_SHIFT 30
 #define ATOM_S2_DISPLAY_ROTATION_ANGLE_MASK   0xC0000000L
 
-/* Byte aligned defintion for BIOS usage */
+/* Byte aligned definition for BIOS usage */
 #define ATOM_S2_TV1_STANDARD_MASKb0     0x0F
 #define ATOM_S2_CURRENT_BL_LEVEL_MASKb1 0xFF
 #define ATOM_S2_CRT1_DPMS_STATEb2       0x01
@@ -3190,7 +3190,7 @@ typedef struct _ATOM_ASIC_INTERNAL_SS_INFO {
 #define ATOM_S3_ALLOW_FAST_PWR_SWITCH   0x40000000L
 #define ATOM_S3_RQST_GPU_USE_MIN_PWR    0x80000000L
 
-/* Byte aligned defintion for BIOS usage */
+/* Byte aligned definition for BIOS usage */
 #define ATOM_S3_CRT1_ACTIVEb0           0x01
 #define ATOM_S3_LCD1_ACTIVEb0           0x02
 #define ATOM_S3_TV1_ACTIVEb0            0x04
@@ -3230,7 +3230,7 @@ typedef struct _ATOM_ASIC_INTERNAL_SS_INFO {
 #define ATOM_S4_LCD1_REFRESH_MASK       0x0000FF00L
 #define ATOM_S4_LCD1_REFRESH_SHIFT      8
 
-/* Byte aligned defintion for BIOS usage */
+/* Byte aligned definition for BIOS usage */
 #define ATOM_S4_LCD1_PANEL_ID_MASKb0	  0x0FF
 #define ATOM_S4_LCD1_REFRESH_MASKb1		  ATOM_S4_LCD1_PANEL_ID_MASKb0
 #define ATOM_S4_VRAM_INFO_MASKb2        ATOM_S4_LCD1_PANEL_ID_MASKb0
@@ -3310,7 +3310,7 @@ typedef struct _ATOM_ASIC_INTERNAL_SS_INFO {
 #define ATOM_S6_VRI_BRIGHTNESS_CHANGE       0x40000000L
 #define ATOM_S6_CONFIG_DISPLAY_CHANGE_MASK  0x80000000L
 
-/* Byte aligned defintion for BIOS usage */
+/* Byte aligned definition for BIOS usage */
 #define ATOM_S6_DEVICE_CHANGEb0         0x01
 #define ATOM_S6_SCALER_CHANGEb0         0x02
 #define ATOM_S6_LID_CHANGEb0            0x04
@@ -4690,6 +4690,205 @@ typedef struct _ATOM_POWERPLAY_INFO_V3 {
 	ATOM_POWERMODE_INFO_V3 asPowerPlayInfo[ATOM_MAX_NUMBEROF_POWER_BLOCK];
 } ATOM_POWERPLAY_INFO_V3;
 
+/* New PPlib */
+/**************************************************************************/
+typedef struct _ATOM_PPLIB_THERMALCONTROLLER
+
+{
+    UCHAR ucType;           // one of ATOM_PP_THERMALCONTROLLER_*
+    UCHAR ucI2cLine;        // as interpreted by DAL I2C
+    UCHAR ucI2cAddress;
+    UCHAR ucFanParameters;  // Fan Control Parameters.
+    UCHAR ucFanMinRPM;      // Fan Minimum RPM (hundreds) -- for display purposes only.
+    UCHAR ucFanMaxRPM;      // Fan Maximum RPM (hundreds) -- for display purposes only.
+    UCHAR ucReserved;       // ----
+    UCHAR ucFlags;          // to be defined
+} ATOM_PPLIB_THERMALCONTROLLER;
+
+#define ATOM_PP_FANPARAMETERS_TACHOMETER_PULSES_PER_REVOLUTION_MASK 0x0f
+#define ATOM_PP_FANPARAMETERS_NOFAN                                 0x80    // No fan is connected to this controller.
+
+#define ATOM_PP_THERMALCONTROLLER_NONE      0
+#define ATOM_PP_THERMALCONTROLLER_LM63      1  // Not used by PPLib
+#define ATOM_PP_THERMALCONTROLLER_ADM1032   2  // Not used by PPLib
+#define ATOM_PP_THERMALCONTROLLER_ADM1030   3  // Not used by PPLib
+#define ATOM_PP_THERMALCONTROLLER_MUA6649   4  // Not used by PPLib
+#define ATOM_PP_THERMALCONTROLLER_LM64      5
+#define ATOM_PP_THERMALCONTROLLER_F75375    6  // Not used by PPLib
+#define ATOM_PP_THERMALCONTROLLER_RV6xx     7
+#define ATOM_PP_THERMALCONTROLLER_RV770     8
+#define ATOM_PP_THERMALCONTROLLER_ADT7473   9
+
+typedef struct _ATOM_PPLIB_STATE
+{
+    UCHAR ucNonClockStateIndex;
+    UCHAR ucClockStateIndices[1]; // variable-sized
+} ATOM_PPLIB_STATE;
+
+//// ATOM_PPLIB_POWERPLAYTABLE::ulPlatformCaps
+#define ATOM_PP_PLATFORM_CAP_BACKBIAS 1
+#define ATOM_PP_PLATFORM_CAP_POWERPLAY 2
+#define ATOM_PP_PLATFORM_CAP_SBIOSPOWERSOURCE 4
+#define ATOM_PP_PLATFORM_CAP_ASPM_L0s 8
+#define ATOM_PP_PLATFORM_CAP_ASPM_L1 16
+#define ATOM_PP_PLATFORM_CAP_HARDWAREDC 32
+#define ATOM_PP_PLATFORM_CAP_GEMINIPRIMARY 64
+#define ATOM_PP_PLATFORM_CAP_STEPVDDC 128
+#define ATOM_PP_PLATFORM_CAP_VOLTAGECONTROL 256
+#define ATOM_PP_PLATFORM_CAP_SIDEPORTCONTROL 512
+#define ATOM_PP_PLATFORM_CAP_TURNOFFPLL_ASPML1 1024
+#define ATOM_PP_PLATFORM_CAP_HTLINKCONTROL 2048
+
+typedef struct _ATOM_PPLIB_POWERPLAYTABLE
+{
+      ATOM_COMMON_TABLE_HEADER sHeader;
+
+      UCHAR ucDataRevision;
+
+      UCHAR ucNumStates;
+      UCHAR ucStateEntrySize;
+      UCHAR ucClockInfoSize;
+      UCHAR ucNonClockSize;
+
+      // offset from start of this table to array of ucNumStates ATOM_PPLIB_STATE structures
+      USHORT usStateArrayOffset;
+
+      // offset from start of this table to array of ASIC-specific structures,
+      // currently ATOM_PPLIB_CLOCK_INFO.
+      USHORT usClockInfoArrayOffset;
+
+      // offset from start of this table to array of ATOM_PPLIB_NONCLOCK_INFO
+      USHORT usNonClockInfoArrayOffset;
+
+      USHORT usBackbiasTime;    // in microseconds
+      USHORT usVoltageTime;     // in microseconds
+      USHORT usTableSize;       //the size of this structure, or the extended structure
+
+      ULONG ulPlatformCaps;            // See ATOM_PPLIB_CAPS_*
+
+      ATOM_PPLIB_THERMALCONTROLLER    sThermalController;
+
+      USHORT usBootClockInfoOffset;
+      USHORT usBootNonClockInfoOffset;
+
+} ATOM_PPLIB_POWERPLAYTABLE;
+
+//// ATOM_PPLIB_NONCLOCK_INFO::usClassification
+#define ATOM_PPLIB_CLASSIFICATION_UI_MASK          0x0007
+#define ATOM_PPLIB_CLASSIFICATION_UI_SHIFT         0
+#define ATOM_PPLIB_CLASSIFICATION_UI_NONE          0
+#define ATOM_PPLIB_CLASSIFICATION_UI_BATTERY       1
+#define ATOM_PPLIB_CLASSIFICATION_UI_BALANCED      3
+#define ATOM_PPLIB_CLASSIFICATION_UI_PERFORMANCE   5
+// 2, 4, 6, 7 are reserved
+
+#define ATOM_PPLIB_CLASSIFICATION_BOOT                   0x0008
+#define ATOM_PPLIB_CLASSIFICATION_THERMAL                0x0010
+#define ATOM_PPLIB_CLASSIFICATION_LIMITEDPOWERSOURCE     0x0020
+#define ATOM_PPLIB_CLASSIFICATION_REST                   0x0040
+#define ATOM_PPLIB_CLASSIFICATION_FORCED                 0x0080
+#define ATOM_PPLIB_CLASSIFICATION_3DPERFORMANCE          0x0100
+#define ATOM_PPLIB_CLASSIFICATION_OVERDRIVETEMPLATE      0x0200
+#define ATOM_PPLIB_CLASSIFICATION_UVDSTATE               0x0400
+#define ATOM_PPLIB_CLASSIFICATION_3DLOW                  0x0800
+#define ATOM_PPLIB_CLASSIFICATION_ACPI                   0x1000
+// remaining 3 bits are reserved
+
+//// ATOM_PPLIB_NONCLOCK_INFO::ulCapsAndSettings
+#define ATOM_PPLIB_SINGLE_DISPLAY_ONLY           0x00000001
+#define ATOM_PPLIB_SUPPORTS_VIDEO_PLAYBACK         0x00000002
+
+// 0 is 2.5Gb/s, 1 is 5Gb/s
+#define ATOM_PPLIB_PCIE_LINK_SPEED_MASK            0x00000004
+#define ATOM_PPLIB_PCIE_LINK_SPEED_SHIFT           2
+
+// lanes - 1: 1, 2, 4, 8, 12, 16 permitted by PCIE spec
+#define ATOM_PPLIB_PCIE_LINK_WIDTH_MASK            0x000000F8
+#define ATOM_PPLIB_PCIE_LINK_WIDTH_SHIFT           3
+
+// lookup into reduced refresh-rate table
+#define ATOM_PPLIB_LIMITED_REFRESHRATE_VALUE_MASK  0x00000F00
+#define ATOM_PPLIB_LIMITED_REFRESHRATE_VALUE_SHIFT 8
+
+#define ATOM_PPLIB_LIMITED_REFRESHRATE_UNLIMITED    0
+#define ATOM_PPLIB_LIMITED_REFRESHRATE_50HZ         1
+// 2-15 TBD as needed.
+
+#define ATOM_PPLIB_SOFTWARE_DISABLE_LOADBALANCING        0x00001000
+#define ATOM_PPLIB_SOFTWARE_ENABLE_SLEEP_FOR_TIMESTAMPS  0x00002000
+#define ATOM_PPLIB_ENABLE_VARIBRIGHT                     0x00008000
+
+#define ATOM_PPLIB_DISALLOW_ON_DC                       0x00004000
+
+// Contained in an array starting at the offset
+// in ATOM_PPLIB_POWERPLAYTABLE::usNonClockInfoArrayOffset.
+// referenced from ATOM_PPLIB_STATE_INFO::ucNonClockStateIndex
+typedef struct _ATOM_PPLIB_NONCLOCK_INFO
+{
+      USHORT usClassification;
+      UCHAR  ucMinTemperature;
+      UCHAR  ucMaxTemperature;
+      ULONG  ulCapsAndSettings;
+      UCHAR  ucRequiredPower;
+      UCHAR  ucUnused1[3];
+} ATOM_PPLIB_NONCLOCK_INFO;
+
+// Contained in an array starting at the offset
+// in ATOM_PPLIB_POWERPLAYTABLE::usClockInfoArrayOffset.
+// referenced from ATOM_PPLIB_STATE::ucClockStateIndices
+typedef struct _ATOM_PPLIB_R600_CLOCK_INFO
+{
+      USHORT usEngineClockLow;
+      UCHAR ucEngineClockHigh;
+
+      USHORT usMemoryClockLow;
+      UCHAR ucMemoryClockHigh;
+
+      USHORT usVDDC;
+      USHORT usUnused1;
+      USHORT usUnused2;
+
+      ULONG ulFlags; // ATOM_PPLIB_R600_FLAGS_*
+
+} ATOM_PPLIB_R600_CLOCK_INFO;
+
+// ulFlags in ATOM_PPLIB_R600_CLOCK_INFO
+#define ATOM_PPLIB_R600_FLAGS_PCIEGEN2          1
+#define ATOM_PPLIB_R600_FLAGS_UVDSAFE           2
+#define ATOM_PPLIB_R600_FLAGS_BACKBIASENABLE    4
+#define ATOM_PPLIB_R600_FLAGS_MEMORY_ODT_OFF    8
+#define ATOM_PPLIB_R600_FLAGS_MEMORY_DLL_OFF    16
+
+typedef struct _ATOM_PPLIB_RS780_CLOCK_INFO
+
+{
+      USHORT usLowEngineClockLow;         // Low Engine clock in MHz (the same way as on the R600).
+      UCHAR  ucLowEngineClockHigh;
+      USHORT usHighEngineClockLow;        // High Engine clock in MHz.
+      UCHAR  ucHighEngineClockHigh;
+      USHORT usMemoryClockLow;            // For now one of the ATOM_PPLIB_RS780_SPMCLK_XXXX constants.
+      UCHAR  ucMemoryClockHigh;           // Currentyl unused.
+      UCHAR  ucPadding;                   // For proper alignment and size.
+      USHORT usVDDC;                      // For the 780, use: None, Low, High, Variable
+      UCHAR  ucMaxHTLinkWidth;            // From SBIOS - {2, 4, 8, 16}
+      UCHAR  ucMinHTLinkWidth;            // From SBIOS - {2, 4, 8, 16}. Effective only if CDLW enabled. Minimum down stream width could be bigger as display BW requriement.
+      USHORT usHTLinkFreq;                // See definition ATOM_PPLIB_RS780_HTLINKFREQ_xxx or in MHz(>=200).
+      ULONG  ulFlags;
+} ATOM_PPLIB_RS780_CLOCK_INFO;
+
+#define ATOM_PPLIB_RS780_VOLTAGE_NONE       0
+#define ATOM_PPLIB_RS780_VOLTAGE_LOW        1
+#define ATOM_PPLIB_RS780_VOLTAGE_HIGH       2
+#define ATOM_PPLIB_RS780_VOLTAGE_VARIABLE   3
+
+#define ATOM_PPLIB_RS780_SPMCLK_NONE        0   // We cannot change the side port memory clock, leave it as it is.
+#define ATOM_PPLIB_RS780_SPMCLK_LOW         1
+#define ATOM_PPLIB_RS780_SPMCLK_HIGH        2
+
+#define ATOM_PPLIB_RS780_HTLINKFREQ_NONE       0
+#define ATOM_PPLIB_RS780_HTLINKFREQ_LOW        1
+#define ATOM_PPLIB_RS780_HTLINKFREQ_HIGH       2
+
 /**************************************************************************/
 
 /*  Following definitions are for compatiblity issue in different SW components. */
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index c15287a590ff..260fcf59f00c 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -241,6 +241,7 @@ void atombios_crtc_dpms(struct drm_crtc *crtc, int mode)
 {
 	struct drm_device *dev = crtc->dev;
 	struct radeon_device *rdev = dev->dev_private;
+	struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
 
 	switch (mode) {
 	case DRM_MODE_DPMS_ON:
@@ -248,20 +249,19 @@ void atombios_crtc_dpms(struct drm_crtc *crtc, int mode)
 		if (ASIC_IS_DCE3(rdev))
 			atombios_enable_crtc_memreq(crtc, 1);
 		atombios_blank_crtc(crtc, 0);
+		drm_vblank_post_modeset(dev, radeon_crtc->crtc_id);
+		radeon_crtc_load_lut(crtc);
 		break;
 	case DRM_MODE_DPMS_STANDBY:
 	case DRM_MODE_DPMS_SUSPEND:
 	case DRM_MODE_DPMS_OFF:
+		drm_vblank_pre_modeset(dev, radeon_crtc->crtc_id);
 		atombios_blank_crtc(crtc, 1);
 		if (ASIC_IS_DCE3(rdev))
 			atombios_enable_crtc_memreq(crtc, 0);
 		atombios_enable_crtc(crtc, 0);
 		break;
 	}
-
-	if (mode != DRM_MODE_DPMS_OFF) {
-		radeon_crtc_load_lut(crtc);
-	}
 }
 
 static void
@@ -457,9 +457,8 @@ void atombios_crtc_set_pll(struct drm_crtc *crtc, struct drm_display_mode *mode)
 				if (encoder->encoder_type !=
 				    DRM_MODE_ENCODER_DAC)
 					pll_flags |= RADEON_PLL_NO_ODD_POST_DIV;
-				if (!ASIC_IS_AVIVO(rdev)
-				    && (encoder->encoder_type ==
-					DRM_MODE_ENCODER_LVDS))
+				if (encoder->encoder_type ==
+					DRM_MODE_ENCODER_LVDS)
 					pll_flags |= RADEON_PLL_USE_REF_DIV;
 			}
 			radeon_encoder = to_radeon_encoder(encoder);
@@ -500,8 +499,18 @@ void atombios_crtc_set_pll(struct drm_crtc *crtc, struct drm_display_mode *mode)
 	else
 		pll = &rdev->clock.p2pll;
 
-	radeon_compute_pll(pll, adjusted_clock, &pll_clock, &fb_div, &frac_fb_div,
-			   &ref_div, &post_div, pll_flags);
+	if (ASIC_IS_AVIVO(rdev)) {
+		if (radeon_new_pll)
+			radeon_compute_pll_avivo(pll, adjusted_clock, &pll_clock,
+						 &fb_div, &frac_fb_div,
+						 &ref_div, &post_div, pll_flags);
+		else
+			radeon_compute_pll(pll, adjusted_clock, &pll_clock,
+					   &fb_div, &frac_fb_div,
+					   &ref_div, &post_div, pll_flags);
+	} else
+		radeon_compute_pll(pll, adjusted_clock, &pll_clock, &fb_div, &frac_fb_div,
+				   &ref_div, &post_div, pll_flags);
 
 	index = GetIndexIntoMasterTable(COMMAND, SetPixelClock);
 	atom_parse_cmd_header(rdev->mode_info.atom_context, index, &frev,
@@ -574,21 +583,32 @@ int atombios_crtc_set_base(struct drm_crtc *crtc, int x, int y,
 	struct radeon_device *rdev = dev->dev_private;
 	struct radeon_framebuffer *radeon_fb;
 	struct drm_gem_object *obj;
-	struct drm_radeon_gem_object *obj_priv;
+	struct radeon_bo *rbo;
 	uint64_t fb_location;
 	uint32_t fb_format, fb_pitch_pixels, tiling_flags;
+	int r;
 
-	if (!crtc->fb)
-		return -EINVAL;
+	/* no fb bound */
+	if (!crtc->fb) {
+		DRM_DEBUG("No FB bound\n");
+		return 0;
+	}
 
 	radeon_fb = to_radeon_framebuffer(crtc->fb);
 
+	/* Pin framebuffer & get tilling informations */
 	obj = radeon_fb->obj;
-	obj_priv = obj->driver_private;
-
-	if (radeon_gem_object_pin(obj, RADEON_GEM_DOMAIN_VRAM, &fb_location)) {
+	rbo = obj->driver_private;
+	r = radeon_bo_reserve(rbo, false);
+	if (unlikely(r != 0))
+		return r;
+	r = radeon_bo_pin(rbo, RADEON_GEM_DOMAIN_VRAM, &fb_location);
+	if (unlikely(r != 0)) {
+		radeon_bo_unreserve(rbo);
 		return -EINVAL;
 	}
+	radeon_bo_get_tiling_flags(rbo, &tiling_flags, NULL);
+	radeon_bo_unreserve(rbo);
 
 	switch (crtc->fb->bits_per_pixel) {
 	case 8:
@@ -618,8 +638,6 @@ int atombios_crtc_set_base(struct drm_crtc *crtc, int x, int y,
 		return -EINVAL;
 	}
 
-	radeon_object_get_tiling_flags(obj->driver_private,
-				       &tiling_flags, NULL);
 	if (tiling_flags & RADEON_TILING_MACRO)
 		fb_format |= AVIVO_D1GRPH_MACRO_ADDRESS_MODE;
 
@@ -674,7 +692,12 @@ int atombios_crtc_set_base(struct drm_crtc *crtc, int x, int y,
 
 	if (old_fb && old_fb != crtc->fb) {
 		radeon_fb = to_radeon_framebuffer(old_fb);
-		radeon_gem_object_unpin(radeon_fb->obj);
+		rbo = radeon_fb->obj->driver_private;
+		r = radeon_bo_reserve(rbo, false);
+		if (unlikely(r != 0))
+			return r;
+		radeon_bo_unpin(rbo);
+		radeon_bo_unreserve(rbo);
 	}
 
 	/* Bytes per pixel may have changed */
diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c
new file mode 100644
index 000000000000..3eb0ca5b3d73
--- /dev/null
+++ b/drivers/gpu/drm/radeon/atombios_dp.c
@@ -0,0 +1,792 @@
+/*
+ * Copyright 2007-8 Advanced Micro Devices, Inc.
+ * Copyright 2008 Red Hat Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * Authors: Dave Airlie
+ *          Alex Deucher
+ */
+#include "drmP.h"
+#include "radeon_drm.h"
+#include "radeon.h"
+
+#include "atom.h"
+#include "atom-bits.h"
+#include "drm_dp_helper.h"
+
+/* move these to drm_dp_helper.c/h */
+#define DP_LINK_CONFIGURATION_SIZE 9
+#define DP_LINK_STATUS_SIZE	   6
+#define DP_DPCD_SIZE	           8
+
+static char *voltage_names[] = {
+        "0.4V", "0.6V", "0.8V", "1.2V"
+};
+static char *pre_emph_names[] = {
+        "0dB", "3.5dB", "6dB", "9.5dB"
+};
+
+static const int dp_clocks[] = {
+	54000,  /* 1 lane, 1.62 Ghz */
+	90000,  /* 1 lane, 2.70 Ghz */
+	108000, /* 2 lane, 1.62 Ghz */
+	180000, /* 2 lane, 2.70 Ghz */
+	216000, /* 4 lane, 1.62 Ghz */
+	360000, /* 4 lane, 2.70 Ghz */
+};
+
+static const int num_dp_clocks = sizeof(dp_clocks) / sizeof(int);
+
+/* common helper functions */
+static int dp_lanes_for_mode_clock(u8 dpcd[DP_DPCD_SIZE], int mode_clock)
+{
+	int i;
+	u8 max_link_bw;
+	u8 max_lane_count;
+
+	if (!dpcd)
+		return 0;
+
+	max_link_bw = dpcd[DP_MAX_LINK_RATE];
+	max_lane_count = dpcd[DP_MAX_LANE_COUNT] & DP_MAX_LANE_COUNT_MASK;
+
+	switch (max_link_bw) {
+	case DP_LINK_BW_1_62:
+	default:
+		for (i = 0; i < num_dp_clocks; i++) {
+			if (i % 2)
+				continue;
+			switch (max_lane_count) {
+			case 1:
+				if (i > 1)
+					return 0;
+				break;
+			case 2:
+				if (i > 3)
+					return 0;
+				break;
+			case 4:
+			default:
+				break;
+			}
+			if (dp_clocks[i] > mode_clock) {
+				if (i < 2)
+					return 1;
+				else if (i < 4)
+					return 2;
+				else
+					return 4;
+			}
+		}
+		break;
+	case DP_LINK_BW_2_7:
+		for (i = 0; i < num_dp_clocks; i++) {
+			switch (max_lane_count) {
+			case 1:
+				if (i > 1)
+					return 0;
+				break;
+			case 2:
+				if (i > 3)
+					return 0;
+				break;
+			case 4:
+			default:
+				break;
+			}
+			if (dp_clocks[i] > mode_clock) {
+				if (i < 2)
+					return 1;
+				else if (i < 4)
+					return 2;
+				else
+					return 4;
+			}
+		}
+		break;
+	}
+
+	return 0;
+}
+
+static int dp_link_clock_for_mode_clock(u8 dpcd[DP_DPCD_SIZE], int mode_clock)
+{
+	int i;
+	u8 max_link_bw;
+	u8 max_lane_count;
+
+	if (!dpcd)
+		return 0;
+
+	max_link_bw = dpcd[DP_MAX_LINK_RATE];
+	max_lane_count = dpcd[DP_MAX_LANE_COUNT] & DP_MAX_LANE_COUNT_MASK;
+
+	switch (max_link_bw) {
+	case DP_LINK_BW_1_62:
+	default:
+		for (i = 0; i < num_dp_clocks; i++) {
+			if (i % 2)
+				continue;
+			switch (max_lane_count) {
+			case 1:
+				if (i > 1)
+					return 0;
+				break;
+			case 2:
+				if (i > 3)
+					return 0;
+				break;
+			case 4:
+			default:
+				break;
+			}
+			if (dp_clocks[i] > mode_clock)
+				return 162000;
+		}
+		break;
+	case DP_LINK_BW_2_7:
+		for (i = 0; i < num_dp_clocks; i++) {
+			switch (max_lane_count) {
+			case 1:
+				if (i > 1)
+					return 0;
+				break;
+			case 2:
+				if (i > 3)
+					return 0;
+				break;
+			case 4:
+			default:
+				break;
+			}
+			if (dp_clocks[i] > mode_clock)
+				return (i % 2) ? 270000 : 162000;
+		}
+	}
+
+	return 0;
+}
+
+int dp_mode_valid(u8 dpcd[DP_DPCD_SIZE], int mode_clock)
+{
+	int lanes = dp_lanes_for_mode_clock(dpcd, mode_clock);
+	int bw = dp_lanes_for_mode_clock(dpcd, mode_clock);
+
+	if ((lanes == 0) || (bw == 0))
+		return MODE_CLOCK_HIGH;
+
+	return MODE_OK;
+}
+
+static u8 dp_link_status(u8 link_status[DP_LINK_STATUS_SIZE], int r)
+{
+	return link_status[r - DP_LANE0_1_STATUS];
+}
+
+static u8 dp_get_lane_status(u8 link_status[DP_LINK_STATUS_SIZE],
+			     int lane)
+{
+	int i = DP_LANE0_1_STATUS + (lane >> 1);
+	int s = (lane & 1) * 4;
+	u8 l = dp_link_status(link_status, i);
+	return (l >> s) & 0xf;
+}
+
+static bool dp_clock_recovery_ok(u8 link_status[DP_LINK_STATUS_SIZE],
+				 int lane_count)
+{
+	int lane;
+	u8 lane_status;
+
+	for (lane = 0; lane < lane_count; lane++) {
+		lane_status = dp_get_lane_status(link_status, lane);
+		if ((lane_status & DP_LANE_CR_DONE) == 0)
+			return false;
+	}
+	return true;
+}
+
+static bool dp_channel_eq_ok(u8 link_status[DP_LINK_STATUS_SIZE],
+			     int lane_count)
+{
+	u8 lane_align;
+	u8 lane_status;
+	int lane;
+
+	lane_align = dp_link_status(link_status,
+				    DP_LANE_ALIGN_STATUS_UPDATED);
+	if ((lane_align & DP_INTERLANE_ALIGN_DONE) == 0)
+		return false;
+	for (lane = 0; lane < lane_count; lane++) {
+		lane_status = dp_get_lane_status(link_status, lane);
+		if ((lane_status & DP_CHANNEL_EQ_BITS) != DP_CHANNEL_EQ_BITS)
+			return false;
+	}
+	return true;
+}
+
+static u8 dp_get_adjust_request_voltage(uint8_t link_status[DP_LINK_STATUS_SIZE],
+					int lane)
+
+{
+	int i = DP_ADJUST_REQUEST_LANE0_1 + (lane >> 1);
+	int s = ((lane & 1) ?
+		 DP_ADJUST_VOLTAGE_SWING_LANE1_SHIFT :
+		 DP_ADJUST_VOLTAGE_SWING_LANE0_SHIFT);
+	u8 l = dp_link_status(link_status, i);
+
+	return ((l >> s) & 0x3) << DP_TRAIN_VOLTAGE_SWING_SHIFT;
+}
+
+static u8 dp_get_adjust_request_pre_emphasis(uint8_t link_status[DP_LINK_STATUS_SIZE],
+					     int lane)
+{
+	int i = DP_ADJUST_REQUEST_LANE0_1 + (lane >> 1);
+	int s = ((lane & 1) ?
+		 DP_ADJUST_PRE_EMPHASIS_LANE1_SHIFT :
+		 DP_ADJUST_PRE_EMPHASIS_LANE0_SHIFT);
+	u8 l = dp_link_status(link_status, i);
+
+	return ((l >> s) & 0x3) << DP_TRAIN_PRE_EMPHASIS_SHIFT;
+}
+
+/* XXX fix me -- chip specific */
+#define DP_VOLTAGE_MAX         DP_TRAIN_VOLTAGE_SWING_1200
+static u8 dp_pre_emphasis_max(u8 voltage_swing)
+{
+	switch (voltage_swing & DP_TRAIN_VOLTAGE_SWING_MASK) {
+	case DP_TRAIN_VOLTAGE_SWING_400:
+		return DP_TRAIN_PRE_EMPHASIS_6;
+	case DP_TRAIN_VOLTAGE_SWING_600:
+		return DP_TRAIN_PRE_EMPHASIS_6;
+	case DP_TRAIN_VOLTAGE_SWING_800:
+		return DP_TRAIN_PRE_EMPHASIS_3_5;
+	case DP_TRAIN_VOLTAGE_SWING_1200:
+	default:
+		return DP_TRAIN_PRE_EMPHASIS_0;
+	}
+}
+
+static void dp_get_adjust_train(u8 link_status[DP_LINK_STATUS_SIZE],
+				int lane_count,
+				u8 train_set[4])
+{
+	u8 v = 0;
+	u8 p = 0;
+	int lane;
+
+	for (lane = 0; lane < lane_count; lane++) {
+		u8 this_v = dp_get_adjust_request_voltage(link_status, lane);
+		u8 this_p = dp_get_adjust_request_pre_emphasis(link_status, lane);
+
+		DRM_DEBUG("requested signal parameters: lane %d voltage %s pre_emph %s\n",
+			  lane,
+			  voltage_names[this_v >> DP_TRAIN_VOLTAGE_SWING_SHIFT],
+			  pre_emph_names[this_p >> DP_TRAIN_PRE_EMPHASIS_SHIFT]);
+
+		if (this_v > v)
+			v = this_v;
+		if (this_p > p)
+			p = this_p;
+	}
+
+	if (v >= DP_VOLTAGE_MAX)
+		v = DP_VOLTAGE_MAX | DP_TRAIN_MAX_SWING_REACHED;
+
+	if (p >= dp_pre_emphasis_max(v))
+		p = dp_pre_emphasis_max(v) | DP_TRAIN_MAX_PRE_EMPHASIS_REACHED;
+
+	DRM_DEBUG("using signal parameters: voltage %s pre_emph %s\n",
+		  voltage_names[(v & DP_TRAIN_VOLTAGE_SWING_MASK) >> DP_TRAIN_VOLTAGE_SWING_SHIFT],
+		  pre_emph_names[(p & DP_TRAIN_PRE_EMPHASIS_MASK) >> DP_TRAIN_PRE_EMPHASIS_SHIFT]);
+
+	for (lane = 0; lane < 4; lane++)
+		train_set[lane] = v | p;
+}
+
+
+/* radeon aux chan functions */
+bool radeon_process_aux_ch(struct radeon_i2c_chan *chan, u8 *req_bytes,
+			   int num_bytes, u8 *read_byte,
+			   u8 read_buf_len, u8 delay)
+{
+	struct drm_device *dev = chan->dev;
+	struct radeon_device *rdev = dev->dev_private;
+	PROCESS_AUX_CHANNEL_TRANSACTION_PS_ALLOCATION args;
+	int index = GetIndexIntoMasterTable(COMMAND, ProcessAuxChannelTransaction);
+	unsigned char *base;
+
+	memset(&args, 0, sizeof(args));
+
+	base = (unsigned char *)rdev->mode_info.atom_context->scratch;
+
+	memcpy(base, req_bytes, num_bytes);
+
+	args.lpAuxRequest = 0;
+	args.lpDataOut = 16;
+	args.ucDataOutLen = 0;
+	args.ucChannelID = chan->rec.i2c_id;
+	args.ucDelay = delay / 10;
+
+	atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+
+	if (args.ucReplyStatus) {
+		DRM_DEBUG("failed to get auxch %02x%02x %02x %02x 0x%02x %02x\n",
+			  req_bytes[1], req_bytes[0], req_bytes[2], req_bytes[3],
+			  chan->rec.i2c_id, args.ucReplyStatus);
+		return false;
+	}
+
+	if (args.ucDataOutLen && read_byte && read_buf_len) {
+		if (read_buf_len < args.ucDataOutLen) {
+			DRM_ERROR("Buffer to small for return answer %d %d\n",
+				  read_buf_len, args.ucDataOutLen);
+			return false;
+		}
+		{
+			int len = min(read_buf_len, args.ucDataOutLen);
+			memcpy(read_byte, base + 16, len);
+		}
+	}
+	return true;
+}
+
+bool radeon_dp_aux_native_write(struct radeon_connector *radeon_connector, uint16_t address,
+				uint8_t send_bytes, uint8_t *send)
+{
+	struct radeon_connector_atom_dig *dig_connector = radeon_connector->con_priv;
+	u8 msg[20];
+	u8 msg_len, dp_msg_len;
+	bool ret;
+
+	dp_msg_len = 4;
+	msg[0] = address;
+	msg[1] = address >> 8;
+	msg[2] = AUX_NATIVE_WRITE << 4;
+	dp_msg_len += send_bytes;
+	msg[3] = (dp_msg_len << 4) | (send_bytes - 1);
+
+	if (send_bytes > 16)
+		return false;
+
+	memcpy(&msg[4], send, send_bytes);
+	msg_len = 4 + send_bytes;
+	ret = radeon_process_aux_ch(dig_connector->dp_i2c_bus, msg, msg_len, NULL, 0, 0);
+	return ret;
+}
+
+bool radeon_dp_aux_native_read(struct radeon_connector *radeon_connector, uint16_t address,
+			       uint8_t delay, uint8_t expected_bytes,
+			       uint8_t *read_p)
+{
+	struct radeon_connector_atom_dig *dig_connector = radeon_connector->con_priv;
+	u8 msg[20];
+	u8 msg_len, dp_msg_len;
+	bool ret = false;
+	msg_len = 4;
+	dp_msg_len = 4;
+	msg[0] = address;
+	msg[1] = address >> 8;
+	msg[2] = AUX_NATIVE_READ << 4;
+	msg[3] = (dp_msg_len) << 4;
+	msg[3] |= expected_bytes - 1;
+
+	ret = radeon_process_aux_ch(dig_connector->dp_i2c_bus, msg, msg_len, read_p, expected_bytes, delay);
+	return ret;
+}
+
+/* radeon dp functions */
+static u8 radeon_dp_encoder_service(struct radeon_device *rdev, int action, int dp_clock,
+				    uint8_t ucconfig, uint8_t lane_num)
+{
+	DP_ENCODER_SERVICE_PARAMETERS args;
+	int index = GetIndexIntoMasterTable(COMMAND, DPEncoderService);
+
+	memset(&args, 0, sizeof(args));
+	args.ucLinkClock = dp_clock / 10;
+	args.ucConfig = ucconfig;
+	args.ucAction = action;
+	args.ucLaneNum = lane_num;
+	args.ucStatus = 0;
+
+	atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+	return args.ucStatus;
+}
+
+u8 radeon_dp_getsinktype(struct radeon_connector *radeon_connector)
+{
+	struct radeon_connector_atom_dig *dig_connector = radeon_connector->con_priv;
+	struct drm_device *dev = radeon_connector->base.dev;
+	struct radeon_device *rdev = dev->dev_private;
+
+	return radeon_dp_encoder_service(rdev, ATOM_DP_ACTION_GET_SINK_TYPE, 0,
+					 dig_connector->dp_i2c_bus->rec.i2c_id, 0);
+}
+
+bool radeon_dp_getdpcd(struct radeon_connector *radeon_connector)
+{
+	struct radeon_connector_atom_dig *dig_connector = radeon_connector->con_priv;
+	u8 msg[25];
+	int ret;
+
+	ret = radeon_dp_aux_native_read(radeon_connector, DP_DPCD_REV, 0, 8, msg);
+	if (ret) {
+		memcpy(dig_connector->dpcd, msg, 8);
+		{
+			int i;
+			DRM_DEBUG("DPCD: ");
+			for (i = 0; i < 8; i++)
+				DRM_DEBUG("%02x ", msg[i]);
+			DRM_DEBUG("\n");
+		}
+		return true;
+	}
+	dig_connector->dpcd[0] = 0;
+	return false;
+}
+
+void radeon_dp_set_link_config(struct drm_connector *connector,
+			       struct drm_display_mode *mode)
+{
+	struct radeon_connector *radeon_connector;
+	struct radeon_connector_atom_dig *dig_connector;
+
+	if ((connector->connector_type != DRM_MODE_CONNECTOR_DisplayPort) ||
+	    (connector->connector_type != DRM_MODE_CONNECTOR_eDP))
+		return;
+
+	radeon_connector = to_radeon_connector(connector);
+	if (!radeon_connector->con_priv)
+		return;
+	dig_connector = radeon_connector->con_priv;
+
+	dig_connector->dp_clock =
+		dp_link_clock_for_mode_clock(dig_connector->dpcd, mode->clock);
+	dig_connector->dp_lane_count =
+		dp_lanes_for_mode_clock(dig_connector->dpcd, mode->clock);
+}
+
+int radeon_dp_mode_valid_helper(struct radeon_connector *radeon_connector,
+				struct drm_display_mode *mode)
+{
+	struct radeon_connector_atom_dig *dig_connector = radeon_connector->con_priv;
+
+	return dp_mode_valid(dig_connector->dpcd, mode->clock);
+}
+
+static bool atom_dp_get_link_status(struct radeon_connector *radeon_connector,
+				    u8 link_status[DP_LINK_STATUS_SIZE])
+{
+	int ret;
+	ret = radeon_dp_aux_native_read(radeon_connector, DP_LANE0_1_STATUS, 100,
+					DP_LINK_STATUS_SIZE, link_status);
+	if (!ret) {
+		DRM_ERROR("displayport link status failed\n");
+		return false;
+	}
+
+	DRM_DEBUG("link status %02x %02x %02x %02x %02x %02x\n",
+		  link_status[0], link_status[1], link_status[2],
+		  link_status[3], link_status[4], link_status[5]);
+	return true;
+}
+
+bool radeon_dp_needs_link_train(struct radeon_connector *radeon_connector)
+{
+	struct radeon_connector_atom_dig *dig_connector = radeon_connector->con_priv;
+	u8 link_status[DP_LINK_STATUS_SIZE];
+
+	if (!atom_dp_get_link_status(radeon_connector, link_status))
+		return false;
+	if (dp_channel_eq_ok(link_status, dig_connector->dp_lane_count))
+		return false;
+	return true;
+}
+
+static void dp_set_power(struct radeon_connector *radeon_connector, u8 power_state)
+{
+	struct radeon_connector_atom_dig *dig_connector = radeon_connector->con_priv;
+
+	if (dig_connector->dpcd[0] >= 0x11) {
+		radeon_dp_aux_native_write(radeon_connector, DP_SET_POWER, 1,
+					   &power_state);
+	}
+}
+
+static void dp_set_downspread(struct radeon_connector *radeon_connector, u8 downspread)
+{
+	radeon_dp_aux_native_write(radeon_connector, DP_DOWNSPREAD_CTRL, 1,
+				   &downspread);
+}
+
+static void dp_set_link_bw_lanes(struct radeon_connector *radeon_connector,
+				 u8 link_configuration[DP_LINK_CONFIGURATION_SIZE])
+{
+	radeon_dp_aux_native_write(radeon_connector, DP_LINK_BW_SET, 2,
+				   link_configuration);
+}
+
+static void dp_update_dpvs_emph(struct radeon_connector *radeon_connector,
+				struct drm_encoder *encoder,
+				u8 train_set[4])
+{
+	struct radeon_connector_atom_dig *dig_connector = radeon_connector->con_priv;
+	int i;
+
+	for (i = 0; i < dig_connector->dp_lane_count; i++)
+		atombios_dig_transmitter_setup(encoder,
+					       ATOM_TRANSMITTER_ACTION_SETUP_VSEMPH,
+					       i, train_set[i]);
+
+	radeon_dp_aux_native_write(radeon_connector, DP_TRAINING_LANE0_SET,
+				   dig_connector->dp_lane_count, train_set);
+}
+
+static void dp_set_training(struct radeon_connector *radeon_connector,
+			    u8 training)
+{
+	radeon_dp_aux_native_write(radeon_connector, DP_TRAINING_PATTERN_SET,
+				   1, &training);
+}
+
+void dp_link_train(struct drm_encoder *encoder,
+		   struct drm_connector *connector)
+{
+	struct drm_device *dev = encoder->dev;
+	struct radeon_device *rdev = dev->dev_private;
+	struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
+	struct radeon_encoder_atom_dig *dig;
+	struct radeon_connector *radeon_connector;
+	struct radeon_connector_atom_dig *dig_connector;
+	int enc_id = 0;
+	bool clock_recovery, channel_eq;
+	u8 link_status[DP_LINK_STATUS_SIZE];
+	u8 link_configuration[DP_LINK_CONFIGURATION_SIZE];
+	u8 tries, voltage;
+	u8 train_set[4];
+	int i;
+
+	if ((connector->connector_type != DRM_MODE_CONNECTOR_DisplayPort) ||
+	    (connector->connector_type != DRM_MODE_CONNECTOR_eDP))
+		return;
+
+	if (!radeon_encoder->enc_priv)
+		return;
+	dig = radeon_encoder->enc_priv;
+
+	radeon_connector = to_radeon_connector(connector);
+	if (!radeon_connector->con_priv)
+		return;
+	dig_connector = radeon_connector->con_priv;
+
+	if (ASIC_IS_DCE32(rdev)) {
+		if (dig->dig_block)
+			enc_id |= ATOM_DP_CONFIG_DIG2_ENCODER;
+		else
+			enc_id |= ATOM_DP_CONFIG_DIG1_ENCODER;
+		if (dig_connector->linkb)
+			enc_id |= ATOM_DP_CONFIG_LINK_B;
+		else
+			enc_id |= ATOM_DP_CONFIG_LINK_A;
+	} else {
+		if (dig_connector->linkb)
+			enc_id |= ATOM_DP_CONFIG_DIG2_ENCODER | ATOM_DP_CONFIG_LINK_B;
+		else
+			enc_id |= ATOM_DP_CONFIG_DIG1_ENCODER | ATOM_DP_CONFIG_LINK_A;
+	}
+
+	memset(link_configuration, 0, DP_LINK_CONFIGURATION_SIZE);
+	if (dig_connector->dp_clock == 270000)
+		link_configuration[0] = DP_LINK_BW_2_7;
+	else
+		link_configuration[0] = DP_LINK_BW_1_62;
+	link_configuration[1] = dig_connector->dp_lane_count;
+	if (dig_connector->dpcd[0] >= 0x11)
+		link_configuration[1] |= DP_LANE_COUNT_ENHANCED_FRAME_EN;
+
+	/* power up the sink */
+	dp_set_power(radeon_connector, DP_SET_POWER_D0);
+	/* disable the training pattern on the sink */
+	dp_set_training(radeon_connector, DP_TRAINING_PATTERN_DISABLE);
+	/* set link bw and lanes on the sink */
+	dp_set_link_bw_lanes(radeon_connector, link_configuration);
+	/* disable downspread on the sink */
+	dp_set_downspread(radeon_connector, 0);
+	/* start training on the source */
+	radeon_dp_encoder_service(rdev, ATOM_DP_ACTION_TRAINING_START,
+				  dig_connector->dp_clock, enc_id, 0);
+	/* set training pattern 1 on the source */
+	radeon_dp_encoder_service(rdev, ATOM_DP_ACTION_TRAINING_PATTERN_SEL,
+				  dig_connector->dp_clock, enc_id, 0);
+
+	/* set initial vs/emph */
+	memset(train_set, 0, 4);
+	udelay(400);
+	/* set training pattern 1 on the sink */
+	dp_set_training(radeon_connector, DP_TRAINING_PATTERN_1);
+
+	dp_update_dpvs_emph(radeon_connector, encoder, train_set);
+
+	/* clock recovery loop */
+	clock_recovery = false;
+	tries = 0;
+	voltage = 0xff;
+	for (;;) {
+		udelay(100);
+		if (!atom_dp_get_link_status(radeon_connector, link_status))
+			break;
+
+		if (dp_clock_recovery_ok(link_status, dig_connector->dp_lane_count)) {
+			clock_recovery = true;
+			break;
+		}
+
+		for (i = 0; i < dig_connector->dp_lane_count; i++) {
+			if ((train_set[i] & DP_TRAIN_MAX_SWING_REACHED) == 0)
+				break;
+		}
+		if (i == dig_connector->dp_lane_count) {
+			DRM_ERROR("clock recovery reached max voltage\n");
+			break;
+		}
+
+		if ((train_set[0] & DP_TRAIN_VOLTAGE_SWING_MASK) == voltage) {
+			++tries;
+			if (tries == 5) {
+				DRM_ERROR("clock recovery tried 5 times\n");
+				break;
+			}
+		} else
+			tries = 0;
+
+		voltage = train_set[0] & DP_TRAIN_VOLTAGE_SWING_MASK;
+
+		/* Compute new train_set as requested by sink */
+		dp_get_adjust_train(link_status, dig_connector->dp_lane_count, train_set);
+		dp_update_dpvs_emph(radeon_connector, encoder, train_set);
+	}
+	if (!clock_recovery)
+		DRM_ERROR("clock recovery failed\n");
+	else
+		DRM_DEBUG("clock recovery at voltage %d pre-emphasis %d\n",
+			  train_set[0] & DP_TRAIN_VOLTAGE_SWING_MASK,
+			  (train_set[0] & DP_TRAIN_PRE_EMPHASIS_MASK) >>
+			  DP_TRAIN_PRE_EMPHASIS_SHIFT);
+
+
+	/* set training pattern 2 on the sink */
+	dp_set_training(radeon_connector, DP_TRAINING_PATTERN_2);
+	/* set training pattern 2 on the source */
+	radeon_dp_encoder_service(rdev, ATOM_DP_ACTION_TRAINING_PATTERN_SEL,
+				  dig_connector->dp_clock, enc_id, 1);
+
+	/* channel equalization loop */
+	tries = 0;
+	channel_eq = false;
+	for (;;) {
+		udelay(400);
+		if (!atom_dp_get_link_status(radeon_connector, link_status))
+			break;
+
+		if (dp_channel_eq_ok(link_status, dig_connector->dp_lane_count)) {
+			channel_eq = true;
+			break;
+		}
+
+		/* Try 5 times */
+		if (tries > 5) {
+			DRM_ERROR("channel eq failed: 5 tries\n");
+			break;
+		}
+
+		/* Compute new train_set as requested by sink */
+		dp_get_adjust_train(link_status, dig_connector->dp_lane_count, train_set);
+		dp_update_dpvs_emph(radeon_connector, encoder, train_set);
+
+		tries++;
+	}
+
+	if (!channel_eq)
+		DRM_ERROR("channel eq failed\n");
+	else
+		DRM_DEBUG("channel eq at voltage %d pre-emphasis %d\n",
+			  train_set[0] & DP_TRAIN_VOLTAGE_SWING_MASK,
+			  (train_set[0] & DP_TRAIN_PRE_EMPHASIS_MASK)
+			  >> DP_TRAIN_PRE_EMPHASIS_SHIFT);
+
+	/* disable the training pattern on the sink */
+	dp_set_training(radeon_connector, DP_TRAINING_PATTERN_DISABLE);
+
+	radeon_dp_encoder_service(rdev, ATOM_DP_ACTION_TRAINING_COMPLETE,
+				  dig_connector->dp_clock, enc_id, 0);
+}
+
+int radeon_dp_i2c_aux_ch(struct i2c_adapter *adapter, int mode,
+			 uint8_t write_byte, uint8_t *read_byte)
+{
+	struct i2c_algo_dp_aux_data *algo_data = adapter->algo_data;
+	struct radeon_i2c_chan *auxch = (struct radeon_i2c_chan *)adapter;
+	int ret = 0;
+	uint16_t address = algo_data->address;
+	uint8_t msg[5];
+	uint8_t reply[2];
+	int msg_len, dp_msg_len;
+	int reply_bytes;
+
+	/* Set up the command byte */
+	if (mode & MODE_I2C_READ)
+		msg[2] = AUX_I2C_READ << 4;
+	else
+		msg[2] = AUX_I2C_WRITE << 4;
+
+	if (!(mode & MODE_I2C_STOP))
+		msg[2] |= AUX_I2C_MOT << 4;
+
+	msg[0] = address;
+	msg[1] = address >> 8;
+
+	reply_bytes = 1;
+
+	msg_len = 4;
+	dp_msg_len = 3;
+	switch (mode) {
+	case MODE_I2C_WRITE:
+		msg[4] = write_byte;
+		msg_len++;
+		dp_msg_len += 2;
+		break;
+	case MODE_I2C_READ:
+		dp_msg_len += 1;
+		break;
+	default:
+		break;
+	}
+
+	msg[3] = (dp_msg_len) << 4;
+	ret = radeon_process_aux_ch(auxch, msg, msg_len, reply, reply_bytes, 0);
+
+	if (ret) {
+		if (read_byte)
+			*read_byte = reply[0];
+		return reply_bytes;
+	}
+	return -EREMOTEIO;
+}
+
diff --git a/drivers/gpu/drm/radeon/mkregtable.c b/drivers/gpu/drm/radeon/mkregtable.c
index 0d79577c1576..607241c6a8a9 100644
--- a/drivers/gpu/drm/radeon/mkregtable.c
+++ b/drivers/gpu/drm/radeon/mkregtable.c
@@ -661,8 +661,10 @@ static int parser_auth(struct table *t, const char *filename)
 	fseek(file, 0, SEEK_SET);
 
 	/* get header */
-	if (fgets(buf, 1024, file) == NULL)
+	if (fgets(buf, 1024, file) == NULL) {
+		fclose(file);
 		return -1;
+	}
 
 	/* first line will contain the last register
 	 * and gpu name */
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index c9e93eabcf16..8760d66e058a 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -65,6 +65,96 @@ MODULE_FIRMWARE(FIRMWARE_R520);
  * r100,rv100,rs100,rv200,rs200,r200,rv250,rs300,rv280
  */
 
+/* hpd for digital panel detect/disconnect */
+bool r100_hpd_sense(struct radeon_device *rdev, enum radeon_hpd_id hpd)
+{
+	bool connected = false;
+
+	switch (hpd) {
+	case RADEON_HPD_1:
+		if (RREG32(RADEON_FP_GEN_CNTL) & RADEON_FP_DETECT_SENSE)
+			connected = true;
+		break;
+	case RADEON_HPD_2:
+		if (RREG32(RADEON_FP2_GEN_CNTL) & RADEON_FP2_DETECT_SENSE)
+			connected = true;
+		break;
+	default:
+		break;
+	}
+	return connected;
+}
+
+void r100_hpd_set_polarity(struct radeon_device *rdev,
+			   enum radeon_hpd_id hpd)
+{
+	u32 tmp;
+	bool connected = r100_hpd_sense(rdev, hpd);
+
+	switch (hpd) {
+	case RADEON_HPD_1:
+		tmp = RREG32(RADEON_FP_GEN_CNTL);
+		if (connected)
+			tmp &= ~RADEON_FP_DETECT_INT_POL;
+		else
+			tmp |= RADEON_FP_DETECT_INT_POL;
+		WREG32(RADEON_FP_GEN_CNTL, tmp);
+		break;
+	case RADEON_HPD_2:
+		tmp = RREG32(RADEON_FP2_GEN_CNTL);
+		if (connected)
+			tmp &= ~RADEON_FP2_DETECT_INT_POL;
+		else
+			tmp |= RADEON_FP2_DETECT_INT_POL;
+		WREG32(RADEON_FP2_GEN_CNTL, tmp);
+		break;
+	default:
+		break;
+	}
+}
+
+void r100_hpd_init(struct radeon_device *rdev)
+{
+	struct drm_device *dev = rdev->ddev;
+	struct drm_connector *connector;
+
+	list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+		struct radeon_connector *radeon_connector = to_radeon_connector(connector);
+		switch (radeon_connector->hpd.hpd) {
+		case RADEON_HPD_1:
+			rdev->irq.hpd[0] = true;
+			break;
+		case RADEON_HPD_2:
+			rdev->irq.hpd[1] = true;
+			break;
+		default:
+			break;
+		}
+	}
+	if (rdev->irq.installed)
+		r100_irq_set(rdev);
+}
+
+void r100_hpd_fini(struct radeon_device *rdev)
+{
+	struct drm_device *dev = rdev->ddev;
+	struct drm_connector *connector;
+
+	list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+		struct radeon_connector *radeon_connector = to_radeon_connector(connector);
+		switch (radeon_connector->hpd.hpd) {
+		case RADEON_HPD_1:
+			rdev->irq.hpd[0] = false;
+			break;
+		case RADEON_HPD_2:
+			rdev->irq.hpd[1] = false;
+			break;
+		default:
+			break;
+		}
+	}
+}
+
 /*
  * PCI GART
  */
@@ -94,6 +184,15 @@ int r100_pci_gart_init(struct radeon_device *rdev)
 	return radeon_gart_table_ram_alloc(rdev);
 }
 
+/* required on r1xx, r2xx, r300, r(v)350, r420/r481, rs400/rs480 */
+void r100_enable_bm(struct radeon_device *rdev)
+{
+	uint32_t tmp;
+	/* Enable bus mastering */
+	tmp = RREG32(RADEON_BUS_CNTL) & ~RADEON_BUS_MASTER_DIS;
+	WREG32(RADEON_BUS_CNTL, tmp);
+}
+
 int r100_pci_gart_enable(struct radeon_device *rdev)
 {
 	uint32_t tmp;
@@ -105,9 +204,6 @@ int r100_pci_gart_enable(struct radeon_device *rdev)
 	WREG32(RADEON_AIC_LO_ADDR, rdev->mc.gtt_location);
 	tmp = rdev->mc.gtt_location + rdev->mc.gtt_size - 1;
 	WREG32(RADEON_AIC_HI_ADDR, tmp);
-	/* Enable bus mastering */
-	tmp = RREG32(RADEON_BUS_CNTL) & ~RADEON_BUS_MASTER_DIS;
-	WREG32(RADEON_BUS_CNTL, tmp);
 	/* set PCI GART page-table base address */
 	WREG32(RADEON_AIC_PT_BASE, rdev->gart.table_addr);
 	tmp = RREG32(RADEON_AIC_CNTL) | RADEON_PCIGART_TRANSLATE_EN;
@@ -148,6 +244,11 @@ int r100_irq_set(struct radeon_device *rdev)
 {
 	uint32_t tmp = 0;
 
+	if (!rdev->irq.installed) {
+		WARN(1, "Can't enable IRQ/MSI because no handler is installed.\n");
+		WREG32(R_000040_GEN_INT_CNTL, 0);
+		return -EINVAL;
+	}
 	if (rdev->irq.sw_int) {
 		tmp |= RADEON_SW_INT_ENABLE;
 	}
@@ -157,6 +258,12 @@ int r100_irq_set(struct radeon_device *rdev)
 	if (rdev->irq.crtc_vblank_int[1]) {
 		tmp |= RADEON_CRTC2_VBLANK_MASK;
 	}
+	if (rdev->irq.hpd[0]) {
+		tmp |= RADEON_FP_DETECT_MASK;
+	}
+	if (rdev->irq.hpd[1]) {
+		tmp |= RADEON_FP2_DETECT_MASK;
+	}
 	WREG32(RADEON_GEN_INT_CNTL, tmp);
 	return 0;
 }
@@ -175,8 +282,9 @@ void r100_irq_disable(struct radeon_device *rdev)
 static inline uint32_t r100_irq_ack(struct radeon_device *rdev)
 {
 	uint32_t irqs = RREG32(RADEON_GEN_INT_STATUS);
-	uint32_t irq_mask = RADEON_SW_INT_TEST | RADEON_CRTC_VBLANK_STAT |
-		RADEON_CRTC2_VBLANK_STAT;
+	uint32_t irq_mask = RADEON_SW_INT_TEST |
+		RADEON_CRTC_VBLANK_STAT | RADEON_CRTC2_VBLANK_STAT |
+		RADEON_FP_DETECT_STAT | RADEON_FP2_DETECT_STAT;
 
 	if (irqs) {
 		WREG32(RADEON_GEN_INT_STATUS, irqs);
@@ -187,6 +295,7 @@ static inline uint32_t r100_irq_ack(struct radeon_device *rdev)
 int r100_irq_process(struct radeon_device *rdev)
 {
 	uint32_t status, msi_rearm;
+	bool queue_hotplug = false;
 
 	status = r100_irq_ack(rdev);
 	if (!status) {
@@ -207,8 +316,18 @@ int r100_irq_process(struct radeon_device *rdev)
 		if (status & RADEON_CRTC2_VBLANK_STAT) {
 			drm_handle_vblank(rdev->ddev, 1);
 		}
+		if (status & RADEON_FP_DETECT_STAT) {
+			queue_hotplug = true;
+			DRM_DEBUG("HPD1\n");
+		}
+		if (status & RADEON_FP2_DETECT_STAT) {
+			queue_hotplug = true;
+			DRM_DEBUG("HPD2\n");
+		}
 		status = r100_irq_ack(rdev);
 	}
+	if (queue_hotplug)
+		queue_work(rdev->wq, &rdev->hotplug_work);
 	if (rdev->msi_enabled) {
 		switch (rdev->family) {
 		case CHIP_RS400:
@@ -243,6 +362,11 @@ void r100_fence_ring_emit(struct radeon_device *rdev,
 	/* Wait until IDLE & CLEAN */
 	radeon_ring_write(rdev, PACKET0(0x1720, 0));
 	radeon_ring_write(rdev, (1 << 16) | (1 << 17));
+	radeon_ring_write(rdev, PACKET0(RADEON_HOST_PATH_CNTL, 0));
+	radeon_ring_write(rdev, rdev->config.r100.hdp_cntl |
+				RADEON_HDP_READ_BUFFER_INVALIDATE);
+	radeon_ring_write(rdev, PACKET0(RADEON_HOST_PATH_CNTL, 0));
+	radeon_ring_write(rdev, rdev->config.r100.hdp_cntl);
 	/* Emit fence sequence & fire IRQ */
 	radeon_ring_write(rdev, PACKET0(rdev->fence_drv.scratch_reg, 0));
 	radeon_ring_write(rdev, fence->seq);
@@ -255,24 +379,27 @@ int r100_wb_init(struct radeon_device *rdev)
 	int r;
 
 	if (rdev->wb.wb_obj == NULL) {
-		r = radeon_object_create(rdev, NULL, RADEON_GPU_PAGE_SIZE,
-					 true,
-					 RADEON_GEM_DOMAIN_GTT,
-					 false, &rdev->wb.wb_obj);
+		r = radeon_bo_create(rdev, NULL, RADEON_GPU_PAGE_SIZE, true,
+					RADEON_GEM_DOMAIN_GTT,
+					&rdev->wb.wb_obj);
 		if (r) {
-			DRM_ERROR("radeon: failed to create WB buffer (%d).\n", r);
+			dev_err(rdev->dev, "(%d) create WB buffer failed\n", r);
 			return r;
 		}
-		r = radeon_object_pin(rdev->wb.wb_obj,
-				      RADEON_GEM_DOMAIN_GTT,
-				      &rdev->wb.gpu_addr);
+		r = radeon_bo_reserve(rdev->wb.wb_obj, false);
+		if (unlikely(r != 0))
+			return r;
+		r = radeon_bo_pin(rdev->wb.wb_obj, RADEON_GEM_DOMAIN_GTT,
+					&rdev->wb.gpu_addr);
 		if (r) {
-			DRM_ERROR("radeon: failed to pin WB buffer (%d).\n", r);
+			dev_err(rdev->dev, "(%d) pin WB buffer failed\n", r);
+			radeon_bo_unreserve(rdev->wb.wb_obj);
 			return r;
 		}
-		r = radeon_object_kmap(rdev->wb.wb_obj, (void **)&rdev->wb.wb);
+		r = radeon_bo_kmap(rdev->wb.wb_obj, (void **)&rdev->wb.wb);
+		radeon_bo_unreserve(rdev->wb.wb_obj);
 		if (r) {
-			DRM_ERROR("radeon: failed to map WB buffer (%d).\n", r);
+			dev_err(rdev->dev, "(%d) map WB buffer failed\n", r);
 			return r;
 		}
 	}
@@ -290,11 +417,19 @@ void r100_wb_disable(struct radeon_device *rdev)
 
 void r100_wb_fini(struct radeon_device *rdev)
 {
+	int r;
+
 	r100_wb_disable(rdev);
 	if (rdev->wb.wb_obj) {
-		radeon_object_kunmap(rdev->wb.wb_obj);
-		radeon_object_unpin(rdev->wb.wb_obj);
-		radeon_object_unref(&rdev->wb.wb_obj);
+		r = radeon_bo_reserve(rdev->wb.wb_obj, false);
+		if (unlikely(r != 0)) {
+			dev_err(rdev->dev, "(%d) can't finish WB\n", r);
+			return;
+		}
+		radeon_bo_kunmap(rdev->wb.wb_obj);
+		radeon_bo_unpin(rdev->wb.wb_obj);
+		radeon_bo_unreserve(rdev->wb.wb_obj);
+		radeon_bo_unref(&rdev->wb.wb_obj);
 		rdev->wb.wb = NULL;
 		rdev->wb.wb_obj = NULL;
 	}
@@ -1250,7 +1385,6 @@ static int r100_packet0_check(struct radeon_cs_parser *p,
 		case RADEON_TXFORMAT_ARGB4444:
 		case RADEON_TXFORMAT_VYUY422:
 		case RADEON_TXFORMAT_YVYU422:
-		case RADEON_TXFORMAT_DXT1:
 		case RADEON_TXFORMAT_SHADOW16:
 		case RADEON_TXFORMAT_LDUDV655:
 		case RADEON_TXFORMAT_DUDV88:
@@ -1258,12 +1392,19 @@ static int r100_packet0_check(struct radeon_cs_parser *p,
 			break;
 		case RADEON_TXFORMAT_ARGB8888:
 		case RADEON_TXFORMAT_RGBA8888:
-		case RADEON_TXFORMAT_DXT23:
-		case RADEON_TXFORMAT_DXT45:
 		case RADEON_TXFORMAT_SHADOW32:
 		case RADEON_TXFORMAT_LDUDUV8888:
 			track->textures[i].cpp = 4;
 			break;
+		case RADEON_TXFORMAT_DXT1:
+			track->textures[i].cpp = 1;
+			track->textures[i].compress_format = R100_TRACK_COMP_DXT1;
+			break;
+		case RADEON_TXFORMAT_DXT23:
+		case RADEON_TXFORMAT_DXT45:
+			track->textures[i].cpp = 1;
+			track->textures[i].compress_format = R100_TRACK_COMP_DXT35;
+			break;
 		}
 		track->textures[i].cube_info[4].width = 1 << ((idx_value >> 16) & 0xf);
 		track->textures[i].cube_info[4].height = 1 << ((idx_value >> 20) & 0xf);
@@ -1288,17 +1429,17 @@ static int r100_packet0_check(struct radeon_cs_parser *p,
 
 int r100_cs_track_check_pkt3_indx_buffer(struct radeon_cs_parser *p,
 					 struct radeon_cs_packet *pkt,
-					 struct radeon_object *robj)
+					 struct radeon_bo *robj)
 {
 	unsigned idx;
 	u32 value;
 	idx = pkt->idx + 1;
 	value = radeon_get_ib_value(p, idx + 2);
-	if ((value + 1) > radeon_object_size(robj)) {
+	if ((value + 1) > radeon_bo_size(robj)) {
 		DRM_ERROR("[drm] Buffer too small for PACKET3 INDX_BUFFER "
 			  "(need %u have %lu) !\n",
 			  value + 1,
-			  radeon_object_size(robj));
+			  radeon_bo_size(robj));
 		return -EINVAL;
 	}
 	return 0;
@@ -1650,6 +1791,17 @@ int r100_gpu_reset(struct radeon_device *rdev)
 	return 0;
 }
 
+void r100_set_common_regs(struct radeon_device *rdev)
+{
+	/* set these so they don't interfere with anything */
+	WREG32(RADEON_OV0_SCALE_CNTL, 0);
+	WREG32(RADEON_SUBPIC_CNTL, 0);
+	WREG32(RADEON_VIPH_CONTROL, 0);
+	WREG32(RADEON_I2C_CNTL_1, 0);
+	WREG32(RADEON_DVI_I2C_CNTL_1, 0);
+	WREG32(RADEON_CAP0_TRIG_CNTL, 0);
+	WREG32(RADEON_CAP1_TRIG_CNTL, 0);
+}
 
 /*
  * VRAM info
@@ -2588,13 +2740,14 @@ static inline void r100_cs_track_texture_print(struct r100_cs_track_texture *t)
 	DRM_ERROR("coordinate type            %d\n", t->tex_coord_type);
 	DRM_ERROR("width round to power of 2  %d\n", t->roundup_w);
 	DRM_ERROR("height round to power of 2 %d\n", t->roundup_h);
+	DRM_ERROR("compress format            %d\n", t->compress_format);
 }
 
 static int r100_cs_track_cube(struct radeon_device *rdev,
 			      struct r100_cs_track *track, unsigned idx)
 {
 	unsigned face, w, h;
-	struct radeon_object *cube_robj;
+	struct radeon_bo *cube_robj;
 	unsigned long size;
 
 	for (face = 0; face < 5; face++) {
@@ -2607,9 +2760,9 @@ static int r100_cs_track_cube(struct radeon_device *rdev,
 
 		size += track->textures[idx].cube_info[face].offset;
 
-		if (size > radeon_object_size(cube_robj)) {
+		if (size > radeon_bo_size(cube_robj)) {
 			DRM_ERROR("Cube texture offset greater than object size %lu %lu\n",
-				  size, radeon_object_size(cube_robj));
+				  size, radeon_bo_size(cube_robj));
 			r100_cs_track_texture_print(&track->textures[idx]);
 			return -1;
 		}
@@ -2617,10 +2770,40 @@ static int r100_cs_track_cube(struct radeon_device *rdev,
 	return 0;
 }
 
+static int r100_track_compress_size(int compress_format, int w, int h)
+{
+	int block_width, block_height, block_bytes;
+	int wblocks, hblocks;
+	int min_wblocks;
+	int sz;
+
+	block_width = 4;
+	block_height = 4;
+
+	switch (compress_format) {
+	case R100_TRACK_COMP_DXT1:
+		block_bytes = 8;
+		min_wblocks = 4;
+		break;
+	default:
+	case R100_TRACK_COMP_DXT35:
+		block_bytes = 16;
+		min_wblocks = 2;
+		break;
+	}
+
+	hblocks = (h + block_height - 1) / block_height;
+	wblocks = (w + block_width - 1) / block_width;
+	if (wblocks < min_wblocks)
+		wblocks = min_wblocks;
+	sz = wblocks * hblocks * block_bytes;
+	return sz;
+}
+
 static int r100_cs_track_texture_check(struct radeon_device *rdev,
 				       struct r100_cs_track *track)
 {
-	struct radeon_object *robj;
+	struct radeon_bo *robj;
 	unsigned long size;
 	unsigned u, i, w, h;
 	int ret;
@@ -2654,9 +2837,15 @@ static int r100_cs_track_texture_check(struct radeon_device *rdev,
 			h = h / (1 << i);
 			if (track->textures[u].roundup_h)
 				h = roundup_pow_of_two(h);
-			size += w * h;
+			if (track->textures[u].compress_format) {
+
+				size += r100_track_compress_size(track->textures[u].compress_format, w, h);
+				/* compressed textures are block based */
+			} else
+				size += w * h;
 		}
 		size *= track->textures[u].cpp;
+
 		switch (track->textures[u].tex_coord_type) {
 		case 0:
 			break;
@@ -2676,9 +2865,9 @@ static int r100_cs_track_texture_check(struct radeon_device *rdev,
 				  "%u\n", track->textures[u].tex_coord_type, u);
 			return -EINVAL;
 		}
-		if (size > radeon_object_size(robj)) {
+		if (size > radeon_bo_size(robj)) {
 			DRM_ERROR("Texture of unit %u needs %lu bytes but is "
-				  "%lu\n", u, size, radeon_object_size(robj));
+				  "%lu\n", u, size, radeon_bo_size(robj));
 			r100_cs_track_texture_print(&track->textures[u]);
 			return -EINVAL;
 		}
@@ -2695,15 +2884,19 @@ int r100_cs_track_check(struct radeon_device *rdev, struct r100_cs_track *track)
 
 	for (i = 0; i < track->num_cb; i++) {
 		if (track->cb[i].robj == NULL) {
+			if (!(track->fastfill || track->color_channel_mask ||
+			      track->blend_read_enable)) {
+				continue;
+			}
 			DRM_ERROR("[drm] No buffer for color buffer %d !\n", i);
 			return -EINVAL;
 		}
 		size = track->cb[i].pitch * track->cb[i].cpp * track->maxy;
 		size += track->cb[i].offset;
-		if (size > radeon_object_size(track->cb[i].robj)) {
+		if (size > radeon_bo_size(track->cb[i].robj)) {
 			DRM_ERROR("[drm] Buffer too small for color buffer %d "
 				  "(need %lu have %lu) !\n", i, size,
-				  radeon_object_size(track->cb[i].robj));
+				  radeon_bo_size(track->cb[i].robj));
 			DRM_ERROR("[drm] color buffer %d (%u %u %u %u)\n",
 				  i, track->cb[i].pitch, track->cb[i].cpp,
 				  track->cb[i].offset, track->maxy);
@@ -2717,10 +2910,10 @@ int r100_cs_track_check(struct radeon_device *rdev, struct r100_cs_track *track)
 		}
 		size = track->zb.pitch * track->zb.cpp * track->maxy;
 		size += track->zb.offset;
-		if (size > radeon_object_size(track->zb.robj)) {
+		if (size > radeon_bo_size(track->zb.robj)) {
 			DRM_ERROR("[drm] Buffer too small for z buffer "
 				  "(need %lu have %lu) !\n", size,
-				  radeon_object_size(track->zb.robj));
+				  radeon_bo_size(track->zb.robj));
 			DRM_ERROR("[drm] zbuffer (%u %u %u %u)\n",
 				  track->zb.pitch, track->zb.cpp,
 				  track->zb.offset, track->maxy);
@@ -2738,11 +2931,12 @@ int r100_cs_track_check(struct radeon_device *rdev, struct r100_cs_track *track)
 					  "bound\n", prim_walk, i);
 				return -EINVAL;
 			}
-			if (size > radeon_object_size(track->arrays[i].robj)) {
-				DRM_ERROR("(PW %u) Vertex array %u need %lu dwords "
-					   "have %lu dwords\n", prim_walk, i,
-					   size >> 2,
-					   radeon_object_size(track->arrays[i].robj) >> 2);
+			if (size > radeon_bo_size(track->arrays[i].robj)) {
+				dev_err(rdev->dev, "(PW %u) Vertex array %u "
+					"need %lu dwords have %lu dwords\n",
+					prim_walk, i, size >> 2,
+					radeon_bo_size(track->arrays[i].robj)
+					>> 2);
 				DRM_ERROR("Max indices %u\n", track->max_indx);
 				return -EINVAL;
 			}
@@ -2756,10 +2950,12 @@ int r100_cs_track_check(struct radeon_device *rdev, struct r100_cs_track *track)
 					  "bound\n", prim_walk, i);
 				return -EINVAL;
 			}
-			if (size > radeon_object_size(track->arrays[i].robj)) {
-				DRM_ERROR("(PW %u) Vertex array %u need %lu dwords "
-					   "have %lu dwords\n", prim_walk, i, size >> 2,
-					   radeon_object_size(track->arrays[i].robj) >> 2);
+			if (size > radeon_bo_size(track->arrays[i].robj)) {
+				dev_err(rdev->dev, "(PW %u) Vertex array %u "
+					"need %lu dwords have %lu dwords\n",
+					prim_walk, i, size >> 2,
+					radeon_bo_size(track->arrays[i].robj)
+					>> 2);
 				return -EINVAL;
 			}
 		}
@@ -2821,6 +3017,7 @@ void r100_cs_track_clear(struct radeon_device *rdev, struct r100_cs_track *track
 		track->arrays[i].esize = 0x7F;
 	}
 	for (i = 0; i < track->num_texture; i++) {
+		track->textures[i].compress_format = R100_TRACK_COMP_NONE;
 		track->textures[i].pitch = 16536;
 		track->textures[i].width = 16536;
 		track->textures[i].height = 16536;
@@ -3101,6 +3298,9 @@ static int r100_startup(struct radeon_device *rdev)
 {
 	int r;
 
+	/* set common regs */
+	r100_set_common_regs(rdev);
+	/* program mc */
 	r100_mc_program(rdev);
 	/* Resume clock */
 	r100_clock_startup(rdev);
@@ -3108,14 +3308,15 @@ static int r100_startup(struct radeon_device *rdev)
 	r100_gpu_init(rdev);
 	/* Initialize GART (initialize after TTM so we can allocate
 	 * memory through TTM but finalize after TTM) */
+	r100_enable_bm(rdev);
 	if (rdev->flags & RADEON_IS_PCI) {
 		r = r100_pci_gart_enable(rdev);
 		if (r)
 			return r;
 	}
 	/* Enable IRQ */
-	rdev->irq.sw_int = true;
 	r100_irq_set(rdev);
+	rdev->config.r100.hdp_cntl = RREG32(RADEON_HOST_PATH_CNTL);
 	/* 1M ring buffer */
 	r = r100_cp_init(rdev, 1024 * 1024);
 	if (r) {
@@ -3150,6 +3351,8 @@ int r100_resume(struct radeon_device *rdev)
 	radeon_combios_asic_init(rdev->ddev);
 	/* Resume clock after posting */
 	r100_clock_startup(rdev);
+	/* Initialize surface registers */
+	radeon_surface_init(rdev);
 	return r100_startup(rdev);
 }
 
@@ -3172,9 +3375,10 @@ void r100_fini(struct radeon_device *rdev)
 	radeon_gem_fini(rdev);
 	if (rdev->flags & RADEON_IS_PCI)
 		r100_pci_gart_fini(rdev);
+	radeon_agp_fini(rdev);
 	radeon_irq_kms_fini(rdev);
 	radeon_fence_driver_fini(rdev);
-	radeon_object_fini(rdev);
+	radeon_bo_fini(rdev);
 	radeon_atombios_fini(rdev);
 	kfree(rdev->bios);
 	rdev->bios = NULL;
@@ -3242,14 +3446,14 @@ int r100_init(struct radeon_device *rdev)
 			RREG32(R_0007C0_CP_STAT));
 	}
 	/* check if cards are posted or not */
-	if (!radeon_card_posted(rdev) && rdev->bios) {
-		DRM_INFO("GPU not posted. posting now...\n");
-		radeon_combios_asic_init(rdev->ddev);
-	}
+	if (radeon_boot_test_post_card(rdev) == false)
+		return -EINVAL;
 	/* Set asic errata */
 	r100_errata(rdev);
 	/* Initialize clocks */
 	radeon_get_clock_info(rdev->ddev);
+	/* Initialize power management */
+	radeon_pm_init(rdev);
 	/* Get vram informations */
 	r100_vram_info(rdev);
 	/* Initialize memory controller (also test AGP) */
@@ -3264,7 +3468,7 @@ int r100_init(struct radeon_device *rdev)
 	if (r)
 		return r;
 	/* Memory manager */
-	r = radeon_object_init(rdev);
+	r = radeon_bo_init(rdev);
 	if (r)
 		return r;
 	if (rdev->flags & RADEON_IS_PCI) {
diff --git a/drivers/gpu/drm/radeon/r100_track.h b/drivers/gpu/drm/radeon/r100_track.h
index 0daf0d76a891..b27a6999d219 100644
--- a/drivers/gpu/drm/radeon/r100_track.h
+++ b/drivers/gpu/drm/radeon/r100_track.h
@@ -10,26 +10,30 @@
  * CS functions
  */
 struct r100_cs_track_cb {
-	struct radeon_object	*robj;
+	struct radeon_bo	*robj;
 	unsigned		pitch;
 	unsigned		cpp;
 	unsigned		offset;
 };
 
 struct r100_cs_track_array {
-	struct radeon_object	*robj;
+	struct radeon_bo	*robj;
 	unsigned		esize;
 };
 
 struct r100_cs_cube_info {
-	struct radeon_object	*robj;
-	unsigned                offset;
+	struct radeon_bo	*robj;
+	unsigned		offset;
 	unsigned		width;
 	unsigned		height;
 };
 
+#define R100_TRACK_COMP_NONE   0
+#define R100_TRACK_COMP_DXT1   1
+#define R100_TRACK_COMP_DXT35  2
+
 struct r100_cs_track_texture {
-	struct radeon_object	*robj;
+	struct radeon_bo	*robj;
 	struct r100_cs_cube_info cube_info[5]; /* info for 5 non-primary faces */
 	unsigned		pitch;
 	unsigned		width;
@@ -44,6 +48,7 @@ struct r100_cs_track_texture {
 	bool			enabled;
 	bool			roundup_w;
 	bool			roundup_h;
+	unsigned                compress_format;
 };
 
 struct r100_cs_track_limits {
@@ -62,13 +67,15 @@ struct r100_cs_track {
 	unsigned			immd_dwords;
 	unsigned			num_arrays;
 	unsigned			max_indx;
+	unsigned			color_channel_mask;
 	struct r100_cs_track_array	arrays[11];
 	struct r100_cs_track_cb 	cb[R300_MAX_CB];
 	struct r100_cs_track_cb 	zb;
 	struct r100_cs_track_texture	textures[R300_TRACK_MAX_TEXTURE];
 	bool				z_enabled;
 	bool                            separate_cube;
-
+	bool				fastfill;
+	bool				blend_read_enable;
 };
 
 int r100_cs_track_check(struct radeon_device *rdev, struct r100_cs_track *track);
diff --git a/drivers/gpu/drm/radeon/r200.c b/drivers/gpu/drm/radeon/r200.c
index eb740fc3549f..20942127c46b 100644
--- a/drivers/gpu/drm/radeon/r200.c
+++ b/drivers/gpu/drm/radeon/r200.c
@@ -401,7 +401,6 @@ int r200_packet0_check(struct radeon_cs_parser *p,
 		case R200_TXFORMAT_Y8:
 			track->textures[i].cpp = 1;
 			break;
-		case R200_TXFORMAT_DXT1:
 		case R200_TXFORMAT_AI88:
 		case R200_TXFORMAT_ARGB1555:
 		case R200_TXFORMAT_RGB565:
@@ -418,9 +417,16 @@ int r200_packet0_check(struct radeon_cs_parser *p,
 		case R200_TXFORMAT_ABGR8888:
 		case R200_TXFORMAT_BGR111110:
 		case R200_TXFORMAT_LDVDU8888:
+			track->textures[i].cpp = 4;
+			break;
+		case R200_TXFORMAT_DXT1:
+			track->textures[i].cpp = 1;
+			track->textures[i].compress_format = R100_TRACK_COMP_DXT1;
+			break;
 		case R200_TXFORMAT_DXT23:
 		case R200_TXFORMAT_DXT45:
-			track->textures[i].cpp = 4;
+			track->textures[i].cpp = 1;
+			track->textures[i].compress_format = R100_TRACK_COMP_DXT1;
 			break;
 		}
 		track->textures[i].cube_info[4].width = 1 << ((idx_value >> 16) & 0xf);
diff --git a/drivers/gpu/drm/radeon/r300.c b/drivers/gpu/drm/radeon/r300.c
index 2f43ee8e4048..0051d11b907c 100644
--- a/drivers/gpu/drm/radeon/r300.c
+++ b/drivers/gpu/drm/radeon/r300.c
@@ -36,7 +36,15 @@
 #include "rv350d.h"
 #include "r300_reg_safe.h"
 
-/* This files gather functions specifics to: r300,r350,rv350,rv370,rv380 */
+/* This files gather functions specifics to: r300,r350,rv350,rv370,rv380
+ *
+ * GPU Errata:
+ * - HOST_PATH_CNTL: r300 family seems to dislike write to HOST_PATH_CNTL
+ *   using MMIO to flush host path read cache, this lead to HARDLOCKUP.
+ *   However, scheduling such write to the ring seems harmless, i suspect
+ *   the CP read collide with the flush somehow, or maybe the MC, hard to
+ *   tell. (Jerome Glisse)
+ */
 
 /*
  * rv370,rv380 PCIE GART
@@ -137,14 +145,19 @@ int rv370_pcie_gart_enable(struct radeon_device *rdev)
 
 void rv370_pcie_gart_disable(struct radeon_device *rdev)
 {
-	uint32_t tmp;
+	u32 tmp;
+	int r;
 
 	tmp = RREG32_PCIE(RADEON_PCIE_TX_GART_CNTL);
 	tmp |= RADEON_PCIE_TX_GART_UNMAPPED_ACCESS_DISCARD;
 	WREG32_PCIE(RADEON_PCIE_TX_GART_CNTL, tmp & ~RADEON_PCIE_TX_GART_EN);
 	if (rdev->gart.table.vram.robj) {
-		radeon_object_kunmap(rdev->gart.table.vram.robj);
-		radeon_object_unpin(rdev->gart.table.vram.robj);
+		r = radeon_bo_reserve(rdev->gart.table.vram.robj, false);
+		if (likely(r == 0)) {
+			radeon_bo_kunmap(rdev->gart.table.vram.robj);
+			radeon_bo_unpin(rdev->gart.table.vram.robj);
+			radeon_bo_unreserve(rdev->gart.table.vram.robj);
+		}
 	}
 }
 
@@ -173,6 +186,11 @@ void r300_fence_ring_emit(struct radeon_device *rdev,
 	/* Wait until IDLE & CLEAN */
 	radeon_ring_write(rdev, PACKET0(0x1720, 0));
 	radeon_ring_write(rdev, (1 << 17) | (1 << 16)  | (1 << 9));
+	radeon_ring_write(rdev, PACKET0(RADEON_HOST_PATH_CNTL, 0));
+	radeon_ring_write(rdev, rdev->config.r300.hdp_cntl |
+				RADEON_HDP_READ_BUFFER_INVALIDATE);
+	radeon_ring_write(rdev, PACKET0(RADEON_HOST_PATH_CNTL, 0));
+	radeon_ring_write(rdev, rdev->config.r300.hdp_cntl);
 	/* Emit fence sequence & fire IRQ */
 	radeon_ring_write(rdev, PACKET0(rdev->fence_drv.scratch_reg, 0));
 	radeon_ring_write(rdev, fence->seq);
@@ -681,7 +699,15 @@ static int r300_packet0_check(struct radeon_cs_parser *p,
 			r100_cs_dump_packet(p, pkt);
 			return r;
 		}
-		ib[idx] = idx_value + ((u32)reloc->lobj.gpu_offset);
+
+		if (reloc->lobj.tiling_flags & RADEON_TILING_MACRO)
+			tile_flags |= R300_TXO_MACRO_TILE;
+		if (reloc->lobj.tiling_flags & RADEON_TILING_MICRO)
+			tile_flags |= R300_TXO_MICRO_TILE;
+
+		tmp = idx_value + ((u32)reloc->lobj.gpu_offset);
+		tmp |= tile_flags;
+		ib[idx] = tmp;
 		track->textures[i].robj = reloc->robj;
 		break;
 	/* Tracked registers */
@@ -847,7 +873,6 @@ static int r300_packet0_check(struct radeon_cs_parser *p,
 		case R300_TX_FORMAT_Z6Y5X5:
 		case R300_TX_FORMAT_W4Z4Y4X4:
 		case R300_TX_FORMAT_W1Z5Y5X5:
-		case R300_TX_FORMAT_DXT1:
 		case R300_TX_FORMAT_D3DMFT_CxV8U8:
 		case R300_TX_FORMAT_B8G8_B8G8:
 		case R300_TX_FORMAT_G8R8_G8B8:
@@ -861,8 +886,6 @@ static int r300_packet0_check(struct radeon_cs_parser *p,
 		case 0x17:
 		case R300_TX_FORMAT_FL_I32:
 		case 0x1e:
-		case R300_TX_FORMAT_DXT3:
-		case R300_TX_FORMAT_DXT5:
 			track->textures[i].cpp = 4;
 			break;
 		case R300_TX_FORMAT_W16Z16Y16X16:
@@ -873,6 +896,23 @@ static int r300_packet0_check(struct radeon_cs_parser *p,
 		case R300_TX_FORMAT_FL_R32G32B32A32:
 			track->textures[i].cpp = 16;
 			break;
+		case R300_TX_FORMAT_DXT1:
+			track->textures[i].cpp = 1;
+			track->textures[i].compress_format = R100_TRACK_COMP_DXT1;
+			break;
+		case R300_TX_FORMAT_ATI2N:
+			if (p->rdev->family < CHIP_R420) {
+				DRM_ERROR("Invalid texture format %u\n",
+					  (idx_value & 0x1F));
+				return -EINVAL;
+			}
+			/* The same rules apply as for DXT3/5. */
+			/* Pass through. */
+		case R300_TX_FORMAT_DXT3:
+		case R300_TX_FORMAT_DXT5:
+			track->textures[i].cpp = 1;
+			track->textures[i].compress_format = R100_TRACK_COMP_DXT35;
+			break;
 		default:
 			DRM_ERROR("Invalid texture format %u\n",
 				  (idx_value & 0x1F));
@@ -932,6 +972,16 @@ static int r300_packet0_check(struct radeon_cs_parser *p,
 			track->textures[i].width_11 = tmp;
 			tmp = ((idx_value >> 16) & 1) << 11;
 			track->textures[i].height_11 = tmp;
+
+			/* ATI1N */
+			if (idx_value & (1 << 14)) {
+				/* The same rules apply as for DXT1. */
+				track->textures[i].compress_format =
+					R100_TRACK_COMP_DXT1;
+			}
+		} else if (idx_value & (1 << 14)) {
+			DRM_ERROR("Forbidden bit TXFORMAT_MSB\n");
+			return -EINVAL;
 		}
 		break;
 	case 0x4480:
@@ -973,6 +1023,18 @@ static int r300_packet0_check(struct radeon_cs_parser *p,
 		}
 		ib[idx] = idx_value + ((u32)reloc->lobj.gpu_offset);
 		break;
+	case 0x4e0c:
+		/* RB3D_COLOR_CHANNEL_MASK */
+		track->color_channel_mask = idx_value;
+		break;
+	case 0x4d1c:
+		/* ZB_BW_CNTL */
+		track->fastfill = !!(idx_value & (1 << 2));
+		break;
+	case 0x4e04:
+		/* RB3D_BLENDCNTL */
+		track->blend_read_enable = !!(idx_value & (1 << 2));
+		break;
 	case 0x4be8:
 		/* valid register only on RV530 */
 		if (p->rdev->family == CHIP_RV530)
@@ -1181,6 +1243,9 @@ static int r300_startup(struct radeon_device *rdev)
 {
 	int r;
 
+	/* set common regs */
+	r100_set_common_regs(rdev);
+	/* program mc */
 	r300_mc_program(rdev);
 	/* Resume clock */
 	r300_clock_startup(rdev);
@@ -1193,14 +1258,20 @@ static int r300_startup(struct radeon_device *rdev)
 		if (r)
 			return r;
 	}
+
+	if (rdev->family == CHIP_R300 ||
+	    rdev->family == CHIP_R350 ||
+	    rdev->family == CHIP_RV350)
+		r100_enable_bm(rdev);
+
 	if (rdev->flags & RADEON_IS_PCI) {
 		r = r100_pci_gart_enable(rdev);
 		if (r)
 			return r;
 	}
 	/* Enable IRQ */
-	rdev->irq.sw_int = true;
 	r100_irq_set(rdev);
+	rdev->config.r300.hdp_cntl = RREG32(RADEON_HOST_PATH_CNTL);
 	/* 1M ring buffer */
 	r = r100_cp_init(rdev, 1024 * 1024);
 	if (r) {
@@ -1237,6 +1308,8 @@ int r300_resume(struct radeon_device *rdev)
 	radeon_combios_asic_init(rdev->ddev);
 	/* Resume clock after posting */
 	r300_clock_startup(rdev);
+	/* Initialize surface registers */
+	radeon_surface_init(rdev);
 	return r300_startup(rdev);
 }
 
@@ -1263,9 +1336,10 @@ void r300_fini(struct radeon_device *rdev)
 		rv370_pcie_gart_fini(rdev);
 	if (rdev->flags & RADEON_IS_PCI)
 		r100_pci_gart_fini(rdev);
+	radeon_agp_fini(rdev);
 	radeon_irq_kms_fini(rdev);
 	radeon_fence_driver_fini(rdev);
-	radeon_object_fini(rdev);
+	radeon_bo_fini(rdev);
 	radeon_atombios_fini(rdev);
 	kfree(rdev->bios);
 	rdev->bios = NULL;
@@ -1303,14 +1377,14 @@ int r300_init(struct radeon_device *rdev)
 			RREG32(R_0007C0_CP_STAT));
 	}
 	/* check if cards are posted or not */
-	if (!radeon_card_posted(rdev) && rdev->bios) {
-		DRM_INFO("GPU not posted. posting now...\n");
-		radeon_combios_asic_init(rdev->ddev);
-	}
+	if (radeon_boot_test_post_card(rdev) == false)
+		return -EINVAL;
 	/* Set asic errata */
 	r300_errata(rdev);
 	/* Initialize clocks */
 	radeon_get_clock_info(rdev->ddev);
+	/* Initialize power management */
+	radeon_pm_init(rdev);
 	/* Get vram informations */
 	r300_vram_info(rdev);
 	/* Initialize memory controller (also test AGP) */
@@ -1325,7 +1399,7 @@ int r300_init(struct radeon_device *rdev)
 	if (r)
 		return r;
 	/* Memory manager */
-	r = radeon_object_init(rdev);
+	r = radeon_bo_init(rdev);
 	if (r)
 		return r;
 	if (rdev->flags & RADEON_IS_PCIE) {
diff --git a/drivers/gpu/drm/radeon/r300_cmdbuf.c b/drivers/gpu/drm/radeon/r300_cmdbuf.c
index cb2e470f97d4..34bffa0e4b73 100644
--- a/drivers/gpu/drm/radeon/r300_cmdbuf.c
+++ b/drivers/gpu/drm/radeon/r300_cmdbuf.c
@@ -990,7 +990,7 @@ static inline int r300_emit_r500fp(drm_radeon_private_t *dev_priv,
 	int sz;
 	int addr;
 	int type;
-	int clamp;
+	int isclamp;
 	int stride;
 	RING_LOCALS;
 
@@ -999,10 +999,10 @@ static inline int r300_emit_r500fp(drm_radeon_private_t *dev_priv,
 	addr = ((header.r500fp.adrhi_flags & 1) << 8) | header.r500fp.adrlo;
 
 	type = !!(header.r500fp.adrhi_flags & R500FP_CONSTANT_TYPE);
-	clamp = !!(header.r500fp.adrhi_flags & R500FP_CONSTANT_CLAMP);
+	isclamp = !!(header.r500fp.adrhi_flags & R500FP_CONSTANT_CLAMP);
 
 	addr |= (type << 16);
-	addr |= (clamp << 17);
+	addr |= (isclamp << 17);
 
 	stride = type ? 4 : 6;
 
diff --git a/drivers/gpu/drm/radeon/r300_reg.h b/drivers/gpu/drm/radeon/r300_reg.h
index 4b7afef35a65..1735a2b69580 100644
--- a/drivers/gpu/drm/radeon/r300_reg.h
+++ b/drivers/gpu/drm/radeon/r300_reg.h
@@ -900,6 +900,7 @@
 #	define R300_TX_FORMAT_FL_I32		    0x1B
 #	define R300_TX_FORMAT_FL_I32A32		    0x1C
 #	define R300_TX_FORMAT_FL_R32G32B32A32	    0x1D
+#	define R300_TX_FORMAT_ATI2N		    0x1F
 	/* alpha modes, convenience mostly */
 	/* if you have alpha, pick constant appropriate to the
 	   number of channels (1 for I8, 2 for I8A8, 4 for R8G8B8A8, etc */
diff --git a/drivers/gpu/drm/radeon/r420.c b/drivers/gpu/drm/radeon/r420.c
index 1cefdbcc0850..053404e71a9d 100644
--- a/drivers/gpu/drm/radeon/r420.c
+++ b/drivers/gpu/drm/radeon/r420.c
@@ -30,7 +30,15 @@
 #include "radeon_reg.h"
 #include "radeon.h"
 #include "atom.h"
+#include "r100d.h"
 #include "r420d.h"
+#include "r420_reg_safe.h"
+
+static void r420_set_reg_safe(struct radeon_device *rdev)
+{
+	rdev->config.r300.reg_safe_bm = r420_reg_safe_bm;
+	rdev->config.r300.reg_safe_bm_size = ARRAY_SIZE(r420_reg_safe_bm);
+}
 
 int r420_mc_init(struct radeon_device *rdev)
 {
@@ -165,10 +173,41 @@ static void r420_clock_resume(struct radeon_device *rdev)
 	WREG32_PLL(R_00000D_SCLK_CNTL, sclk_cntl);
 }
 
+static void r420_cp_errata_init(struct radeon_device *rdev)
+{
+	/* RV410 and R420 can lock up if CP DMA to host memory happens
+	 * while the 2D engine is busy.
+	 *
+	 * The proper workaround is to queue a RESYNC at the beginning
+	 * of the CP init, apparently.
+	 */
+	radeon_scratch_get(rdev, &rdev->config.r300.resync_scratch);
+	radeon_ring_lock(rdev, 8);
+	radeon_ring_write(rdev, PACKET0(R300_CP_RESYNC_ADDR, 1));
+	radeon_ring_write(rdev, rdev->config.r300.resync_scratch);
+	radeon_ring_write(rdev, 0xDEADBEEF);
+	radeon_ring_unlock_commit(rdev);
+}
+
+static void r420_cp_errata_fini(struct radeon_device *rdev)
+{
+	/* Catch the RESYNC we dispatched all the way back,
+	 * at the very beginning of the CP init.
+	 */
+	radeon_ring_lock(rdev, 8);
+	radeon_ring_write(rdev, PACKET0(R300_RB3D_DSTCACHE_CTLSTAT, 0));
+	radeon_ring_write(rdev, R300_RB3D_DC_FINISH);
+	radeon_ring_unlock_commit(rdev);
+	radeon_scratch_free(rdev, rdev->config.r300.resync_scratch);
+}
+
 static int r420_startup(struct radeon_device *rdev)
 {
 	int r;
 
+	/* set common regs */
+	r100_set_common_regs(rdev);
+	/* program mc */
 	r300_mc_program(rdev);
 	/* Resume clock */
 	r420_clock_resume(rdev);
@@ -186,14 +225,15 @@ static int r420_startup(struct radeon_device *rdev)
 	}
 	r420_pipes_init(rdev);
 	/* Enable IRQ */
-	rdev->irq.sw_int = true;
 	r100_irq_set(rdev);
+	rdev->config.r300.hdp_cntl = RREG32(RADEON_HOST_PATH_CNTL);
 	/* 1M ring buffer */
 	r = r100_cp_init(rdev, 1024 * 1024);
 	if (r) {
 		dev_err(rdev->dev, "failled initializing CP (%d).\n", r);
 		return r;
 	}
+	r420_cp_errata_init(rdev);
 	r = r100_wb_init(rdev);
 	if (r) {
 		dev_err(rdev->dev, "failled initializing WB (%d).\n", r);
@@ -229,12 +269,14 @@ int r420_resume(struct radeon_device *rdev)
 	}
 	/* Resume clock after posting */
 	r420_clock_resume(rdev);
-
+	/* Initialize surface registers */
+	radeon_surface_init(rdev);
 	return r420_startup(rdev);
 }
 
 int r420_suspend(struct radeon_device *rdev)
 {
+	r420_cp_errata_fini(rdev);
 	r100_cp_disable(rdev);
 	r100_wb_disable(rdev);
 	r100_irq_disable(rdev);
@@ -258,7 +300,7 @@ void r420_fini(struct radeon_device *rdev)
 	radeon_agp_fini(rdev);
 	radeon_irq_kms_fini(rdev);
 	radeon_fence_driver_fini(rdev);
-	radeon_object_fini(rdev);
+	radeon_bo_fini(rdev);
 	if (rdev->is_atom_bios) {
 		radeon_atombios_fini(rdev);
 	} else {
@@ -301,14 +343,9 @@ int r420_init(struct radeon_device *rdev)
 			RREG32(R_0007C0_CP_STAT));
 	}
 	/* check if cards are posted or not */
-	if (!radeon_card_posted(rdev) && rdev->bios) {
-		DRM_INFO("GPU not posted. posting now...\n");
-		if (rdev->is_atom_bios) {
-			atom_asic_init(rdev->mode_info.atom_context);
-		} else {
-			radeon_combios_asic_init(rdev->ddev);
-		}
-	}
+	if (radeon_boot_test_post_card(rdev) == false)
+		return -EINVAL;
+
 	/* Initialize clocks */
 	radeon_get_clock_info(rdev->ddev);
 	/* Initialize power management */
@@ -331,10 +368,13 @@ int r420_init(struct radeon_device *rdev)
 		return r;
 	}
 	/* Memory manager */
-	r = radeon_object_init(rdev);
+	r = radeon_bo_init(rdev);
 	if (r) {
 		return r;
 	}
+	if (rdev->family == CHIP_R420)
+		r100_enable_bm(rdev);
+
 	if (rdev->flags & RADEON_IS_PCIE) {
 		r = rv370_pcie_gart_init(rdev);
 		if (r)
@@ -345,7 +385,7 @@ int r420_init(struct radeon_device *rdev)
 		if (r)
 			return r;
 	}
-	r300_set_reg_safe(rdev);
+	r420_set_reg_safe(rdev);
 	rdev->accel_working = true;
 	r = r420_startup(rdev);
 	if (r) {
diff --git a/drivers/gpu/drm/radeon/r500_reg.h b/drivers/gpu/drm/radeon/r500_reg.h
index 7baa73955563..74ad89bdf2b5 100644
--- a/drivers/gpu/drm/radeon/r500_reg.h
+++ b/drivers/gpu/drm/radeon/r500_reg.h
@@ -716,6 +716,8 @@
 
 #define AVIVO_DVOA_BIT_DEPTH_CONTROL			0x7988
 
+#define AVIVO_DC_GPIO_HPD_A                 0x7e94
+
 #define AVIVO_GPIO_0                        0x7e30
 #define AVIVO_GPIO_1                        0x7e40
 #define AVIVO_GPIO_2                        0x7e50
diff --git a/drivers/gpu/drm/radeon/r520.c b/drivers/gpu/drm/radeon/r520.c
index f7435185c0a6..9a189072f2b9 100644
--- a/drivers/gpu/drm/radeon/r520.c
+++ b/drivers/gpu/drm/radeon/r520.c
@@ -185,8 +185,8 @@ static int r520_startup(struct radeon_device *rdev)
 			return r;
 	}
 	/* Enable IRQ */
-	rdev->irq.sw_int = true;
 	rs600_irq_set(rdev);
+	rdev->config.r300.hdp_cntl = RREG32(RADEON_HOST_PATH_CNTL);
 	/* 1M ring buffer */
 	r = r100_cp_init(rdev, 1024 * 1024);
 	if (r) {
@@ -221,6 +221,8 @@ int r520_resume(struct radeon_device *rdev)
 	atom_asic_init(rdev->mode_info.atom_context);
 	/* Resume clock after posting */
 	rv515_clock_startup(rdev);
+	/* Initialize surface registers */
+	radeon_surface_init(rdev);
 	return r520_startup(rdev);
 }
 
@@ -254,6 +256,9 @@ int r520_init(struct radeon_device *rdev)
 			RREG32(R_0007C0_CP_STAT));
 	}
 	/* check if cards are posted or not */
+	if (radeon_boot_test_post_card(rdev) == false)
+		return -EINVAL;
+
 	if (!radeon_card_posted(rdev) && rdev->bios) {
 		DRM_INFO("GPU not posted. posting now...\n");
 		atom_asic_init(rdev->mode_info.atom_context);
@@ -277,7 +282,7 @@ int r520_init(struct radeon_device *rdev)
 	if (r)
 		return r;
 	/* Memory manager */
-	r = radeon_object_init(rdev);
+	r = radeon_bo_init(rdev);
 	if (r)
 		return r;
 	r = rv370_pcie_gart_init(rdev);
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index 278f646bc18e..f5ff3490929f 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -38,8 +38,10 @@
 
 #define PFP_UCODE_SIZE 576
 #define PM4_UCODE_SIZE 1792
+#define RLC_UCODE_SIZE 768
 #define R700_PFP_UCODE_SIZE 848
 #define R700_PM4_UCODE_SIZE 1360
+#define R700_RLC_UCODE_SIZE 1024
 
 /* Firmware Names */
 MODULE_FIRMWARE("radeon/R600_pfp.bin");
@@ -62,6 +64,8 @@ MODULE_FIRMWARE("radeon/RV730_pfp.bin");
 MODULE_FIRMWARE("radeon/RV730_me.bin");
 MODULE_FIRMWARE("radeon/RV710_pfp.bin");
 MODULE_FIRMWARE("radeon/RV710_me.bin");
+MODULE_FIRMWARE("radeon/R600_rlc.bin");
+MODULE_FIRMWARE("radeon/R700_rlc.bin");
 
 int r600_debugfs_mc_info_init(struct radeon_device *rdev);
 
@@ -70,6 +74,282 @@ int r600_mc_wait_for_idle(struct radeon_device *rdev);
 void r600_gpu_init(struct radeon_device *rdev);
 void r600_fini(struct radeon_device *rdev);
 
+/* hpd for digital panel detect/disconnect */
+bool r600_hpd_sense(struct radeon_device *rdev, enum radeon_hpd_id hpd)
+{
+	bool connected = false;
+
+	if (ASIC_IS_DCE3(rdev)) {
+		switch (hpd) {
+		case RADEON_HPD_1:
+			if (RREG32(DC_HPD1_INT_STATUS) & DC_HPDx_SENSE)
+				connected = true;
+			break;
+		case RADEON_HPD_2:
+			if (RREG32(DC_HPD2_INT_STATUS) & DC_HPDx_SENSE)
+				connected = true;
+			break;
+		case RADEON_HPD_3:
+			if (RREG32(DC_HPD3_INT_STATUS) & DC_HPDx_SENSE)
+				connected = true;
+			break;
+		case RADEON_HPD_4:
+			if (RREG32(DC_HPD4_INT_STATUS) & DC_HPDx_SENSE)
+				connected = true;
+			break;
+			/* DCE 3.2 */
+		case RADEON_HPD_5:
+			if (RREG32(DC_HPD5_INT_STATUS) & DC_HPDx_SENSE)
+				connected = true;
+			break;
+		case RADEON_HPD_6:
+			if (RREG32(DC_HPD6_INT_STATUS) & DC_HPDx_SENSE)
+				connected = true;
+			break;
+		default:
+			break;
+		}
+	} else {
+		switch (hpd) {
+		case RADEON_HPD_1:
+			if (RREG32(DC_HOT_PLUG_DETECT1_INT_STATUS) & DC_HOT_PLUG_DETECTx_SENSE)
+				connected = true;
+			break;
+		case RADEON_HPD_2:
+			if (RREG32(DC_HOT_PLUG_DETECT2_INT_STATUS) & DC_HOT_PLUG_DETECTx_SENSE)
+				connected = true;
+			break;
+		case RADEON_HPD_3:
+			if (RREG32(DC_HOT_PLUG_DETECT3_INT_STATUS) & DC_HOT_PLUG_DETECTx_SENSE)
+				connected = true;
+			break;
+		default:
+			break;
+		}
+	}
+	return connected;
+}
+
+void r600_hpd_set_polarity(struct radeon_device *rdev,
+			   enum radeon_hpd_id hpd)
+{
+	u32 tmp;
+	bool connected = r600_hpd_sense(rdev, hpd);
+
+	if (ASIC_IS_DCE3(rdev)) {
+		switch (hpd) {
+		case RADEON_HPD_1:
+			tmp = RREG32(DC_HPD1_INT_CONTROL);
+			if (connected)
+				tmp &= ~DC_HPDx_INT_POLARITY;
+			else
+				tmp |= DC_HPDx_INT_POLARITY;
+			WREG32(DC_HPD1_INT_CONTROL, tmp);
+			break;
+		case RADEON_HPD_2:
+			tmp = RREG32(DC_HPD2_INT_CONTROL);
+			if (connected)
+				tmp &= ~DC_HPDx_INT_POLARITY;
+			else
+				tmp |= DC_HPDx_INT_POLARITY;
+			WREG32(DC_HPD2_INT_CONTROL, tmp);
+			break;
+		case RADEON_HPD_3:
+			tmp = RREG32(DC_HPD3_INT_CONTROL);
+			if (connected)
+				tmp &= ~DC_HPDx_INT_POLARITY;
+			else
+				tmp |= DC_HPDx_INT_POLARITY;
+			WREG32(DC_HPD3_INT_CONTROL, tmp);
+			break;
+		case RADEON_HPD_4:
+			tmp = RREG32(DC_HPD4_INT_CONTROL);
+			if (connected)
+				tmp &= ~DC_HPDx_INT_POLARITY;
+			else
+				tmp |= DC_HPDx_INT_POLARITY;
+			WREG32(DC_HPD4_INT_CONTROL, tmp);
+			break;
+		case RADEON_HPD_5:
+			tmp = RREG32(DC_HPD5_INT_CONTROL);
+			if (connected)
+				tmp &= ~DC_HPDx_INT_POLARITY;
+			else
+				tmp |= DC_HPDx_INT_POLARITY;
+			WREG32(DC_HPD5_INT_CONTROL, tmp);
+			break;
+			/* DCE 3.2 */
+		case RADEON_HPD_6:
+			tmp = RREG32(DC_HPD6_INT_CONTROL);
+			if (connected)
+				tmp &= ~DC_HPDx_INT_POLARITY;
+			else
+				tmp |= DC_HPDx_INT_POLARITY;
+			WREG32(DC_HPD6_INT_CONTROL, tmp);
+			break;
+		default:
+			break;
+		}
+	} else {
+		switch (hpd) {
+		case RADEON_HPD_1:
+			tmp = RREG32(DC_HOT_PLUG_DETECT1_INT_CONTROL);
+			if (connected)
+				tmp &= ~DC_HOT_PLUG_DETECTx_INT_POLARITY;
+			else
+				tmp |= DC_HOT_PLUG_DETECTx_INT_POLARITY;
+			WREG32(DC_HOT_PLUG_DETECT1_INT_CONTROL, tmp);
+			break;
+		case RADEON_HPD_2:
+			tmp = RREG32(DC_HOT_PLUG_DETECT2_INT_CONTROL);
+			if (connected)
+				tmp &= ~DC_HOT_PLUG_DETECTx_INT_POLARITY;
+			else
+				tmp |= DC_HOT_PLUG_DETECTx_INT_POLARITY;
+			WREG32(DC_HOT_PLUG_DETECT2_INT_CONTROL, tmp);
+			break;
+		case RADEON_HPD_3:
+			tmp = RREG32(DC_HOT_PLUG_DETECT3_INT_CONTROL);
+			if (connected)
+				tmp &= ~DC_HOT_PLUG_DETECTx_INT_POLARITY;
+			else
+				tmp |= DC_HOT_PLUG_DETECTx_INT_POLARITY;
+			WREG32(DC_HOT_PLUG_DETECT3_INT_CONTROL, tmp);
+			break;
+		default:
+			break;
+		}
+	}
+}
+
+void r600_hpd_init(struct radeon_device *rdev)
+{
+	struct drm_device *dev = rdev->ddev;
+	struct drm_connector *connector;
+
+	if (ASIC_IS_DCE3(rdev)) {
+		u32 tmp = DC_HPDx_CONNECTION_TIMER(0x9c4) | DC_HPDx_RX_INT_TIMER(0xfa);
+		if (ASIC_IS_DCE32(rdev))
+			tmp |= DC_HPDx_EN;
+
+		list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+			struct radeon_connector *radeon_connector = to_radeon_connector(connector);
+			switch (radeon_connector->hpd.hpd) {
+			case RADEON_HPD_1:
+				WREG32(DC_HPD1_CONTROL, tmp);
+				rdev->irq.hpd[0] = true;
+				break;
+			case RADEON_HPD_2:
+				WREG32(DC_HPD2_CONTROL, tmp);
+				rdev->irq.hpd[1] = true;
+				break;
+			case RADEON_HPD_3:
+				WREG32(DC_HPD3_CONTROL, tmp);
+				rdev->irq.hpd[2] = true;
+				break;
+			case RADEON_HPD_4:
+				WREG32(DC_HPD4_CONTROL, tmp);
+				rdev->irq.hpd[3] = true;
+				break;
+				/* DCE 3.2 */
+			case RADEON_HPD_5:
+				WREG32(DC_HPD5_CONTROL, tmp);
+				rdev->irq.hpd[4] = true;
+				break;
+			case RADEON_HPD_6:
+				WREG32(DC_HPD6_CONTROL, tmp);
+				rdev->irq.hpd[5] = true;
+				break;
+			default:
+				break;
+			}
+		}
+	} else {
+		list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+			struct radeon_connector *radeon_connector = to_radeon_connector(connector);
+			switch (radeon_connector->hpd.hpd) {
+			case RADEON_HPD_1:
+				WREG32(DC_HOT_PLUG_DETECT1_CONTROL, DC_HOT_PLUG_DETECTx_EN);
+				rdev->irq.hpd[0] = true;
+				break;
+			case RADEON_HPD_2:
+				WREG32(DC_HOT_PLUG_DETECT2_CONTROL, DC_HOT_PLUG_DETECTx_EN);
+				rdev->irq.hpd[1] = true;
+				break;
+			case RADEON_HPD_3:
+				WREG32(DC_HOT_PLUG_DETECT3_CONTROL, DC_HOT_PLUG_DETECTx_EN);
+				rdev->irq.hpd[2] = true;
+				break;
+			default:
+				break;
+			}
+		}
+	}
+	if (rdev->irq.installed)
+		r600_irq_set(rdev);
+}
+
+void r600_hpd_fini(struct radeon_device *rdev)
+{
+	struct drm_device *dev = rdev->ddev;
+	struct drm_connector *connector;
+
+	if (ASIC_IS_DCE3(rdev)) {
+		list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+			struct radeon_connector *radeon_connector = to_radeon_connector(connector);
+			switch (radeon_connector->hpd.hpd) {
+			case RADEON_HPD_1:
+				WREG32(DC_HPD1_CONTROL, 0);
+				rdev->irq.hpd[0] = false;
+				break;
+			case RADEON_HPD_2:
+				WREG32(DC_HPD2_CONTROL, 0);
+				rdev->irq.hpd[1] = false;
+				break;
+			case RADEON_HPD_3:
+				WREG32(DC_HPD3_CONTROL, 0);
+				rdev->irq.hpd[2] = false;
+				break;
+			case RADEON_HPD_4:
+				WREG32(DC_HPD4_CONTROL, 0);
+				rdev->irq.hpd[3] = false;
+				break;
+				/* DCE 3.2 */
+			case RADEON_HPD_5:
+				WREG32(DC_HPD5_CONTROL, 0);
+				rdev->irq.hpd[4] = false;
+				break;
+			case RADEON_HPD_6:
+				WREG32(DC_HPD6_CONTROL, 0);
+				rdev->irq.hpd[5] = false;
+				break;
+			default:
+				break;
+			}
+		}
+	} else {
+		list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+			struct radeon_connector *radeon_connector = to_radeon_connector(connector);
+			switch (radeon_connector->hpd.hpd) {
+			case RADEON_HPD_1:
+				WREG32(DC_HOT_PLUG_DETECT1_CONTROL, 0);
+				rdev->irq.hpd[0] = false;
+				break;
+			case RADEON_HPD_2:
+				WREG32(DC_HOT_PLUG_DETECT2_CONTROL, 0);
+				rdev->irq.hpd[1] = false;
+				break;
+			case RADEON_HPD_3:
+				WREG32(DC_HOT_PLUG_DETECT3_CONTROL, 0);
+				rdev->irq.hpd[2] = false;
+				break;
+			default:
+				break;
+			}
+		}
+	}
+}
+
 /*
  * R600 PCIE GART
  */
@@ -180,7 +460,7 @@ int r600_pcie_gart_enable(struct radeon_device *rdev)
 void r600_pcie_gart_disable(struct radeon_device *rdev)
 {
 	u32 tmp;
-	int i;
+	int i, r;
 
 	/* Disable all tables */
 	for (i = 0; i < 7; i++)
@@ -208,8 +488,12 @@ void r600_pcie_gart_disable(struct radeon_device *rdev)
 	WREG32(MC_VM_L1_TLB_MCB_RD_HDP_CNTL, tmp);
 	WREG32(MC_VM_L1_TLB_MCB_WR_HDP_CNTL, tmp);
 	if (rdev->gart.table.vram.robj) {
-		radeon_object_kunmap(rdev->gart.table.vram.robj);
-		radeon_object_unpin(rdev->gart.table.vram.robj);
+		r = radeon_bo_reserve(rdev->gart.table.vram.robj, false);
+		if (likely(r == 0)) {
+			radeon_bo_kunmap(rdev->gart.table.vram.robj);
+			radeon_bo_unpin(rdev->gart.table.vram.robj);
+			radeon_bo_unreserve(rdev->gart.table.vram.robj);
+		}
 	}
 }
 
@@ -394,11 +678,11 @@ int r600_mc_init(struct radeon_device *rdev)
 		 * AGP so that GPU can catch out of VRAM/AGP access
 		 */
 		if (rdev->mc.gtt_location > rdev->mc.mc_vram_size) {
-			/* Enought place before */
+			/* Enough place before */
 			rdev->mc.vram_location = rdev->mc.gtt_location -
 							rdev->mc.mc_vram_size;
 		} else if (tmp > rdev->mc.mc_vram_size) {
-			/* Enought place after */
+			/* Enough place after */
 			rdev->mc.vram_location = rdev->mc.gtt_location +
 							rdev->mc.gtt_size;
 		} else {
@@ -443,6 +727,10 @@ int r600_mc_init(struct radeon_device *rdev)
 	a.full = rfixed_const(100);
 	rdev->pm.sclk.full = rfixed_const(rdev->clock.default_sclk);
 	rdev->pm.sclk.full = rfixed_div(rdev->pm.sclk, a);
+
+	if (rdev->flags & RADEON_IS_IGP)
+		rdev->mc.igp_sideport_enabled = radeon_atombios_sideport_present(rdev);
+
 	return 0;
 }
 
@@ -1101,7 +1389,6 @@ void r600_pciep_wreg(struct radeon_device *rdev, u32 reg, u32 v)
 	(void)RREG32(PCIE_PORT_DATA);
 }
 
-
 /*
  * CP & Ring
  */
@@ -1110,11 +1397,12 @@ void r600_cp_stop(struct radeon_device *rdev)
 	WREG32(R_0086D8_CP_ME_CNTL, S_0086D8_CP_ME_HALT(1));
 }
 
-int r600_cp_init_microcode(struct radeon_device *rdev)
+int r600_init_microcode(struct radeon_device *rdev)
 {
 	struct platform_device *pdev;
 	const char *chip_name;
-	size_t pfp_req_size, me_req_size;
+	const char *rlc_chip_name;
+	size_t pfp_req_size, me_req_size, rlc_req_size;
 	char fw_name[30];
 	int err;
 
@@ -1128,30 +1416,62 @@ int r600_cp_init_microcode(struct radeon_device *rdev)
 	}
 
 	switch (rdev->family) {
-	case CHIP_R600: chip_name = "R600"; break;
-	case CHIP_RV610: chip_name = "RV610"; break;
-	case CHIP_RV630: chip_name = "RV630"; break;
-	case CHIP_RV620: chip_name = "RV620"; break;
-	case CHIP_RV635: chip_name = "RV635"; break;
-	case CHIP_RV670: chip_name = "RV670"; break;
+	case CHIP_R600:
+		chip_name = "R600";
+		rlc_chip_name = "R600";
+		break;
+	case CHIP_RV610:
+		chip_name = "RV610";
+		rlc_chip_name = "R600";
+		break;
+	case CHIP_RV630:
+		chip_name = "RV630";
+		rlc_chip_name = "R600";
+		break;
+	case CHIP_RV620:
+		chip_name = "RV620";
+		rlc_chip_name = "R600";
+		break;
+	case CHIP_RV635:
+		chip_name = "RV635";
+		rlc_chip_name = "R600";
+		break;
+	case CHIP_RV670:
+		chip_name = "RV670";
+		rlc_chip_name = "R600";
+		break;
 	case CHIP_RS780:
-	case CHIP_RS880: chip_name = "RS780"; break;
-	case CHIP_RV770: chip_name = "RV770"; break;
+	case CHIP_RS880:
+		chip_name = "RS780";
+		rlc_chip_name = "R600";
+		break;
+	case CHIP_RV770:
+		chip_name = "RV770";
+		rlc_chip_name = "R700";
+		break;
 	case CHIP_RV730:
-	case CHIP_RV740: chip_name = "RV730"; break;
-	case CHIP_RV710: chip_name = "RV710"; break;
+	case CHIP_RV740:
+		chip_name = "RV730";
+		rlc_chip_name = "R700";
+		break;
+	case CHIP_RV710:
+		chip_name = "RV710";
+		rlc_chip_name = "R700";
+		break;
 	default: BUG();
 	}
 
 	if (rdev->family >= CHIP_RV770) {
 		pfp_req_size = R700_PFP_UCODE_SIZE * 4;
 		me_req_size = R700_PM4_UCODE_SIZE * 4;
+		rlc_req_size = R700_RLC_UCODE_SIZE * 4;
 	} else {
 		pfp_req_size = PFP_UCODE_SIZE * 4;
 		me_req_size = PM4_UCODE_SIZE * 12;
+		rlc_req_size = RLC_UCODE_SIZE * 4;
 	}
 
-	DRM_INFO("Loading %s CP Microcode\n", chip_name);
+	DRM_INFO("Loading %s Microcode\n", chip_name);
 
 	snprintf(fw_name, sizeof(fw_name), "radeon/%s_pfp.bin", chip_name);
 	err = request_firmware(&rdev->pfp_fw, fw_name, &pdev->dev);
@@ -1175,6 +1495,18 @@ int r600_cp_init_microcode(struct radeon_device *rdev)
 		       rdev->me_fw->size, fw_name);
 		err = -EINVAL;
 	}
+
+	snprintf(fw_name, sizeof(fw_name), "radeon/%s_rlc.bin", rlc_chip_name);
+	err = request_firmware(&rdev->rlc_fw, fw_name, &pdev->dev);
+	if (err)
+		goto out;
+	if (rdev->rlc_fw->size != rlc_req_size) {
+		printk(KERN_ERR
+		       "r600_rlc: Bogus length %zu in firmware \"%s\"\n",
+		       rdev->rlc_fw->size, fw_name);
+		err = -EINVAL;
+	}
+
 out:
 	platform_device_unregister(pdev);
 
@@ -1187,6 +1519,8 @@ out:
 		rdev->pfp_fw = NULL;
 		release_firmware(rdev->me_fw);
 		rdev->me_fw = NULL;
+		release_firmware(rdev->rlc_fw);
+		rdev->rlc_fw = NULL;
 	}
 	return err;
 }
@@ -1381,10 +1715,16 @@ int r600_ring_test(struct radeon_device *rdev)
 
 void r600_wb_disable(struct radeon_device *rdev)
 {
+	int r;
+
 	WREG32(SCRATCH_UMSK, 0);
 	if (rdev->wb.wb_obj) {
-		radeon_object_kunmap(rdev->wb.wb_obj);
-		radeon_object_unpin(rdev->wb.wb_obj);
+		r = radeon_bo_reserve(rdev->wb.wb_obj, false);
+		if (unlikely(r != 0))
+			return;
+		radeon_bo_kunmap(rdev->wb.wb_obj);
+		radeon_bo_unpin(rdev->wb.wb_obj);
+		radeon_bo_unreserve(rdev->wb.wb_obj);
 	}
 }
 
@@ -1392,7 +1732,7 @@ void r600_wb_fini(struct radeon_device *rdev)
 {
 	r600_wb_disable(rdev);
 	if (rdev->wb.wb_obj) {
-		radeon_object_unref(&rdev->wb.wb_obj);
+		radeon_bo_unref(&rdev->wb.wb_obj);
 		rdev->wb.wb = NULL;
 		rdev->wb.wb_obj = NULL;
 	}
@@ -1403,22 +1743,29 @@ int r600_wb_enable(struct radeon_device *rdev)
 	int r;
 
 	if (rdev->wb.wb_obj == NULL) {
-		r = radeon_object_create(rdev, NULL, RADEON_GPU_PAGE_SIZE, true,
-				RADEON_GEM_DOMAIN_GTT, false, &rdev->wb.wb_obj);
+		r = radeon_bo_create(rdev, NULL, RADEON_GPU_PAGE_SIZE, true,
+				RADEON_GEM_DOMAIN_GTT, &rdev->wb.wb_obj);
 		if (r) {
-			dev_warn(rdev->dev, "failed to create WB buffer (%d).\n", r);
+			dev_warn(rdev->dev, "(%d) create WB bo failed\n", r);
 			return r;
 		}
-		r = radeon_object_pin(rdev->wb.wb_obj, RADEON_GEM_DOMAIN_GTT,
+		r = radeon_bo_reserve(rdev->wb.wb_obj, false);
+		if (unlikely(r != 0)) {
+			r600_wb_fini(rdev);
+			return r;
+		}
+		r = radeon_bo_pin(rdev->wb.wb_obj, RADEON_GEM_DOMAIN_GTT,
 				&rdev->wb.gpu_addr);
 		if (r) {
-			dev_warn(rdev->dev, "failed to pin WB buffer (%d).\n", r);
+			radeon_bo_unreserve(rdev->wb.wb_obj);
+			dev_warn(rdev->dev, "(%d) pin WB bo failed\n", r);
 			r600_wb_fini(rdev);
 			return r;
 		}
-		r = radeon_object_kmap(rdev->wb.wb_obj, (void **)&rdev->wb.wb);
+		r = radeon_bo_kmap(rdev->wb.wb_obj, (void **)&rdev->wb.wb);
+		radeon_bo_unreserve(rdev->wb.wb_obj);
 		if (r) {
-			dev_warn(rdev->dev, "failed to map WB buffer (%d).\n", r);
+			dev_warn(rdev->dev, "(%d) map WB bo failed\n", r);
 			r600_wb_fini(rdev);
 			return r;
 		}
@@ -1433,10 +1780,16 @@ int r600_wb_enable(struct radeon_device *rdev)
 void r600_fence_ring_emit(struct radeon_device *rdev,
 			  struct radeon_fence *fence)
 {
+	/* Also consider EVENT_WRITE_EOP.  it handles the interrupts + timestamps + events */
 	/* Emit fence sequence & fire IRQ */
 	radeon_ring_write(rdev, PACKET3(PACKET3_SET_CONFIG_REG, 1));
 	radeon_ring_write(rdev, ((rdev->fence_drv.scratch_reg - PACKET3_SET_CONFIG_REG_OFFSET) >> 2));
 	radeon_ring_write(rdev, fence->seq);
+	radeon_ring_write(rdev, PACKET0(R_005480_HDP_MEM_COHERENCY_FLUSH_CNTL, 0));
+	radeon_ring_write(rdev, 1);
+	/* CP_INTERRUPT packet 3 no longer exists, use packet 0 */
+	radeon_ring_write(rdev, PACKET0(CP_INT_STATUS, 0));
+	radeon_ring_write(rdev, RB_INT_STAT);
 }
 
 int r600_copy_dma(struct radeon_device *rdev,
@@ -1459,18 +1812,6 @@ int r600_copy_blit(struct radeon_device *rdev,
 	return 0;
 }
 
-int r600_irq_process(struct radeon_device *rdev)
-{
-	/* FIXME: implement */
-	return 0;
-}
-
-int r600_irq_set(struct radeon_device *rdev)
-{
-	/* FIXME: implement */
-	return 0;
-}
-
 int r600_set_surface_reg(struct radeon_device *rdev, int reg,
 			 uint32_t tiling_flags, uint32_t pitch,
 			 uint32_t offset, uint32_t obj_size)
@@ -1506,6 +1847,14 @@ int r600_startup(struct radeon_device *rdev)
 {
 	int r;
 
+	if (!rdev->me_fw || !rdev->pfp_fw || !rdev->rlc_fw) {
+		r = r600_init_microcode(rdev);
+		if (r) {
+			DRM_ERROR("Failed to load firmware!\n");
+			return r;
+		}
+	}
+
 	r600_mc_program(rdev);
 	if (rdev->flags & RADEON_IS_AGP) {
 		r600_agp_enable(rdev);
@@ -1516,12 +1865,33 @@ int r600_startup(struct radeon_device *rdev)
 	}
 	r600_gpu_init(rdev);
 
-	r = radeon_object_pin(rdev->r600_blit.shader_obj, RADEON_GEM_DOMAIN_VRAM,
-			      &rdev->r600_blit.shader_gpu_addr);
+	if (!rdev->r600_blit.shader_obj) {
+		r = r600_blit_init(rdev);
+		if (r) {
+			DRM_ERROR("radeon: failed blitter (%d).\n", r);
+			return r;
+		}
+	}
+
+	r = radeon_bo_reserve(rdev->r600_blit.shader_obj, false);
+	if (unlikely(r != 0))
+		return r;
+	r = radeon_bo_pin(rdev->r600_blit.shader_obj, RADEON_GEM_DOMAIN_VRAM,
+			&rdev->r600_blit.shader_gpu_addr);
+	radeon_bo_unreserve(rdev->r600_blit.shader_obj);
+	if (r) {
+		dev_err(rdev->dev, "(%d) pin blit object failed\n", r);
+		return r;
+	}
+
+	/* Enable IRQ */
+	r = r600_irq_init(rdev);
 	if (r) {
-		DRM_ERROR("failed to pin blit object %d\n", r);
+		DRM_ERROR("radeon: IH init failed (%d).\n", r);
+		radeon_irq_kms_fini(rdev);
 		return r;
 	}
+	r600_irq_set(rdev);
 
 	r = radeon_ring_init(rdev, rdev->cp.ring_size);
 	if (r)
@@ -1583,13 +1953,19 @@ int r600_resume(struct radeon_device *rdev)
 
 int r600_suspend(struct radeon_device *rdev)
 {
+	int r;
+
 	/* FIXME: we should wait for ring to be empty */
 	r600_cp_stop(rdev);
 	rdev->cp.ready = false;
 	r600_wb_disable(rdev);
 	r600_pcie_gart_disable(rdev);
 	/* unpin shaders bo */
-	radeon_object_unpin(rdev->r600_blit.shader_obj);
+	r = radeon_bo_reserve(rdev->r600_blit.shader_obj, false);
+	if (unlikely(r != 0))
+		return r;
+	radeon_bo_unpin(rdev->r600_blit.shader_obj);
+	radeon_bo_unreserve(rdev->r600_blit.shader_obj);
 	return 0;
 }
 
@@ -1627,7 +2003,11 @@ int r600_init(struct radeon_device *rdev)
 	if (r)
 		return r;
 	/* Post card if necessary */
-	if (!r600_card_posted(rdev) && rdev->bios) {
+	if (!r600_card_posted(rdev)) {
+		if (!rdev->bios) {
+			dev_err(rdev->dev, "Card not posted and no BIOS - ignoring\n");
+			return -EINVAL;
+		}
 		DRM_INFO("GPU not posted. posting now...\n");
 		atom_asic_init(rdev->mode_info.atom_context);
 	}
@@ -1650,31 +2030,25 @@ int r600_init(struct radeon_device *rdev)
 	if (r)
 		return r;
 	/* Memory manager */
-	r = radeon_object_init(rdev);
+	r = radeon_bo_init(rdev);
 	if (r)
 		return r;
+
+	r = radeon_irq_kms_init(rdev);
+	if (r)
+		return r;
+
 	rdev->cp.ring_obj = NULL;
 	r600_ring_init(rdev, 1024 * 1024);
 
-	if (!rdev->me_fw || !rdev->pfp_fw) {
-		r = r600_cp_init_microcode(rdev);
-		if (r) {
-			DRM_ERROR("Failed to load firmware!\n");
-			return r;
-		}
-	}
+	rdev->ih.ring_obj = NULL;
+	r600_ih_ring_init(rdev, 64 * 1024);
 
 	r = r600_pcie_gart_init(rdev);
 	if (r)
 		return r;
 
 	rdev->accel_working = true;
-	r = r600_blit_init(rdev);
-	if (r) {
-		DRM_ERROR("radeon: failled blitter (%d).\n", r);
-		return r;
-	}
-
 	r = r600_startup(rdev);
 	if (r) {
 		r600_suspend(rdev);
@@ -1686,15 +2060,19 @@ int r600_init(struct radeon_device *rdev)
 	if (rdev->accel_working) {
 		r = radeon_ib_pool_init(rdev);
 		if (r) {
-			DRM_ERROR("radeon: failled initializing IB pool (%d).\n", r);
+			DRM_ERROR("radeon: failed initializing IB pool (%d).\n", r);
 			rdev->accel_working = false;
 		}
 		r = r600_ib_test(rdev);
 		if (r) {
-			DRM_ERROR("radeon: failled testing IB (%d).\n", r);
+			DRM_ERROR("radeon: failed testing IB (%d).\n", r);
 			rdev->accel_working = false;
 		}
 	}
+
+	r = r600_audio_init(rdev);
+	if (r)
+		return r; /* TODO error handling */
 	return 0;
 }
 
@@ -1703,16 +2081,18 @@ void r600_fini(struct radeon_device *rdev)
 	/* Suspend operations */
 	r600_suspend(rdev);
 
+	r600_audio_fini(rdev);
 	r600_blit_fini(rdev);
+	r600_irq_fini(rdev);
+	radeon_irq_kms_fini(rdev);
 	radeon_ring_fini(rdev);
 	r600_wb_fini(rdev);
 	r600_pcie_gart_fini(rdev);
 	radeon_gem_fini(rdev);
 	radeon_fence_driver_fini(rdev);
 	radeon_clocks_fini(rdev);
-	if (rdev->flags & RADEON_IS_AGP)
-		radeon_agp_fini(rdev);
-	radeon_object_fini(rdev);
+	radeon_agp_fini(rdev);
+	radeon_bo_fini(rdev);
 	radeon_atombios_fini(rdev);
 	kfree(rdev->bios);
 	rdev->bios = NULL;
@@ -1798,8 +2178,661 @@ int r600_ib_test(struct radeon_device *rdev)
 	return r;
 }
 
+/*
+ * Interrupts
+ *
+ * Interrupts use a ring buffer on r6xx/r7xx hardware.  It works pretty
+ * the same as the CP ring buffer, but in reverse.  Rather than the CPU
+ * writing to the ring and the GPU consuming, the GPU writes to the ring
+ * and host consumes.  As the host irq handler processes interrupts, it
+ * increments the rptr.  When the rptr catches up with the wptr, all the
+ * current interrupts have been processed.
+ */
+
+void r600_ih_ring_init(struct radeon_device *rdev, unsigned ring_size)
+{
+	u32 rb_bufsz;
+
+	/* Align ring size */
+	rb_bufsz = drm_order(ring_size / 4);
+	ring_size = (1 << rb_bufsz) * 4;
+	rdev->ih.ring_size = ring_size;
+	rdev->ih.align_mask = 4 - 1;
+}
+
+static int r600_ih_ring_alloc(struct radeon_device *rdev, unsigned ring_size)
+{
+	int r;
+
+	rdev->ih.ring_size = ring_size;
+	/* Allocate ring buffer */
+	if (rdev->ih.ring_obj == NULL) {
+		r = radeon_bo_create(rdev, NULL, rdev->ih.ring_size,
+				     true,
+				     RADEON_GEM_DOMAIN_GTT,
+				     &rdev->ih.ring_obj);
+		if (r) {
+			DRM_ERROR("radeon: failed to create ih ring buffer (%d).\n", r);
+			return r;
+		}
+		r = radeon_bo_reserve(rdev->ih.ring_obj, false);
+		if (unlikely(r != 0))
+			return r;
+		r = radeon_bo_pin(rdev->ih.ring_obj,
+				  RADEON_GEM_DOMAIN_GTT,
+				  &rdev->ih.gpu_addr);
+		if (r) {
+			radeon_bo_unreserve(rdev->ih.ring_obj);
+			DRM_ERROR("radeon: failed to pin ih ring buffer (%d).\n", r);
+			return r;
+		}
+		r = radeon_bo_kmap(rdev->ih.ring_obj,
+				   (void **)&rdev->ih.ring);
+		radeon_bo_unreserve(rdev->ih.ring_obj);
+		if (r) {
+			DRM_ERROR("radeon: failed to map ih ring buffer (%d).\n", r);
+			return r;
+		}
+	}
+	rdev->ih.ptr_mask = (rdev->cp.ring_size / 4) - 1;
+	rdev->ih.rptr = 0;
+
+	return 0;
+}
+
+static void r600_ih_ring_fini(struct radeon_device *rdev)
+{
+	int r;
+	if (rdev->ih.ring_obj) {
+		r = radeon_bo_reserve(rdev->ih.ring_obj, false);
+		if (likely(r == 0)) {
+			radeon_bo_kunmap(rdev->ih.ring_obj);
+			radeon_bo_unpin(rdev->ih.ring_obj);
+			radeon_bo_unreserve(rdev->ih.ring_obj);
+		}
+		radeon_bo_unref(&rdev->ih.ring_obj);
+		rdev->ih.ring = NULL;
+		rdev->ih.ring_obj = NULL;
+	}
+}
+
+static void r600_rlc_stop(struct radeon_device *rdev)
+{
+
+	if (rdev->family >= CHIP_RV770) {
+		/* r7xx asics need to soft reset RLC before halting */
+		WREG32(SRBM_SOFT_RESET, SOFT_RESET_RLC);
+		RREG32(SRBM_SOFT_RESET);
+		udelay(15000);
+		WREG32(SRBM_SOFT_RESET, 0);
+		RREG32(SRBM_SOFT_RESET);
+	}
+
+	WREG32(RLC_CNTL, 0);
+}
+
+static void r600_rlc_start(struct radeon_device *rdev)
+{
+	WREG32(RLC_CNTL, RLC_ENABLE);
+}
+
+static int r600_rlc_init(struct radeon_device *rdev)
+{
+	u32 i;
+	const __be32 *fw_data;
+
+	if (!rdev->rlc_fw)
+		return -EINVAL;
+
+	r600_rlc_stop(rdev);
+
+	WREG32(RLC_HB_BASE, 0);
+	WREG32(RLC_HB_CNTL, 0);
+	WREG32(RLC_HB_RPTR, 0);
+	WREG32(RLC_HB_WPTR, 0);
+	WREG32(RLC_HB_WPTR_LSB_ADDR, 0);
+	WREG32(RLC_HB_WPTR_MSB_ADDR, 0);
+	WREG32(RLC_MC_CNTL, 0);
+	WREG32(RLC_UCODE_CNTL, 0);
+
+	fw_data = (const __be32 *)rdev->rlc_fw->data;
+	if (rdev->family >= CHIP_RV770) {
+		for (i = 0; i < R700_RLC_UCODE_SIZE; i++) {
+			WREG32(RLC_UCODE_ADDR, i);
+			WREG32(RLC_UCODE_DATA, be32_to_cpup(fw_data++));
+		}
+	} else {
+		for (i = 0; i < RLC_UCODE_SIZE; i++) {
+			WREG32(RLC_UCODE_ADDR, i);
+			WREG32(RLC_UCODE_DATA, be32_to_cpup(fw_data++));
+		}
+	}
+	WREG32(RLC_UCODE_ADDR, 0);
+
+	r600_rlc_start(rdev);
+
+	return 0;
+}
+
+static void r600_enable_interrupts(struct radeon_device *rdev)
+{
+	u32 ih_cntl = RREG32(IH_CNTL);
+	u32 ih_rb_cntl = RREG32(IH_RB_CNTL);
+
+	ih_cntl |= ENABLE_INTR;
+	ih_rb_cntl |= IH_RB_ENABLE;
+	WREG32(IH_CNTL, ih_cntl);
+	WREG32(IH_RB_CNTL, ih_rb_cntl);
+	rdev->ih.enabled = true;
+}
+
+static void r600_disable_interrupts(struct radeon_device *rdev)
+{
+	u32 ih_rb_cntl = RREG32(IH_RB_CNTL);
+	u32 ih_cntl = RREG32(IH_CNTL);
+
+	ih_rb_cntl &= ~IH_RB_ENABLE;
+	ih_cntl &= ~ENABLE_INTR;
+	WREG32(IH_RB_CNTL, ih_rb_cntl);
+	WREG32(IH_CNTL, ih_cntl);
+	/* set rptr, wptr to 0 */
+	WREG32(IH_RB_RPTR, 0);
+	WREG32(IH_RB_WPTR, 0);
+	rdev->ih.enabled = false;
+	rdev->ih.wptr = 0;
+	rdev->ih.rptr = 0;
+}
+
+static void r600_disable_interrupt_state(struct radeon_device *rdev)
+{
+	u32 tmp;
+
+	WREG32(CP_INT_CNTL, 0);
+	WREG32(GRBM_INT_CNTL, 0);
+	WREG32(DxMODE_INT_MASK, 0);
+	if (ASIC_IS_DCE3(rdev)) {
+		WREG32(DCE3_DACA_AUTODETECT_INT_CONTROL, 0);
+		WREG32(DCE3_DACB_AUTODETECT_INT_CONTROL, 0);
+		tmp = RREG32(DC_HPD1_INT_CONTROL) & DC_HPDx_INT_POLARITY;
+		WREG32(DC_HPD1_INT_CONTROL, tmp);
+		tmp = RREG32(DC_HPD2_INT_CONTROL) & DC_HPDx_INT_POLARITY;
+		WREG32(DC_HPD2_INT_CONTROL, tmp);
+		tmp = RREG32(DC_HPD3_INT_CONTROL) & DC_HPDx_INT_POLARITY;
+		WREG32(DC_HPD3_INT_CONTROL, tmp);
+		tmp = RREG32(DC_HPD4_INT_CONTROL) & DC_HPDx_INT_POLARITY;
+		WREG32(DC_HPD4_INT_CONTROL, tmp);
+		if (ASIC_IS_DCE32(rdev)) {
+			tmp = RREG32(DC_HPD5_INT_CONTROL) & DC_HPDx_INT_POLARITY;
+			WREG32(DC_HPD5_INT_CONTROL, 0);
+			tmp = RREG32(DC_HPD6_INT_CONTROL) & DC_HPDx_INT_POLARITY;
+			WREG32(DC_HPD6_INT_CONTROL, 0);
+		}
+	} else {
+		WREG32(DACA_AUTODETECT_INT_CONTROL, 0);
+		WREG32(DACB_AUTODETECT_INT_CONTROL, 0);
+		tmp = RREG32(DC_HOT_PLUG_DETECT1_INT_CONTROL) & DC_HOT_PLUG_DETECTx_INT_POLARITY;
+		WREG32(DC_HOT_PLUG_DETECT1_INT_CONTROL, 0);
+		tmp = RREG32(DC_HOT_PLUG_DETECT2_INT_CONTROL) & DC_HOT_PLUG_DETECTx_INT_POLARITY;
+		WREG32(DC_HOT_PLUG_DETECT2_INT_CONTROL, 0);
+		tmp = RREG32(DC_HOT_PLUG_DETECT3_INT_CONTROL) & DC_HOT_PLUG_DETECTx_INT_POLARITY;
+		WREG32(DC_HOT_PLUG_DETECT3_INT_CONTROL, 0);
+	}
+}
+
+int r600_irq_init(struct radeon_device *rdev)
+{
+	int ret = 0;
+	int rb_bufsz;
+	u32 interrupt_cntl, ih_cntl, ih_rb_cntl;
+
+	/* allocate ring */
+	ret = r600_ih_ring_alloc(rdev, rdev->ih.ring_size);
+	if (ret)
+		return ret;
+
+	/* disable irqs */
+	r600_disable_interrupts(rdev);
+
+	/* init rlc */
+	ret = r600_rlc_init(rdev);
+	if (ret) {
+		r600_ih_ring_fini(rdev);
+		return ret;
+	}
+
+	/* setup interrupt control */
+	/* set dummy read address to ring address */
+	WREG32(INTERRUPT_CNTL2, rdev->ih.gpu_addr >> 8);
+	interrupt_cntl = RREG32(INTERRUPT_CNTL);
+	/* IH_DUMMY_RD_OVERRIDE=0 - dummy read disabled with msi, enabled without msi
+	 * IH_DUMMY_RD_OVERRIDE=1 - dummy read controlled by IH_DUMMY_RD_EN
+	 */
+	interrupt_cntl &= ~IH_DUMMY_RD_OVERRIDE;
+	/* IH_REQ_NONSNOOP_EN=1 if ring is in non-cacheable memory, e.g., vram */
+	interrupt_cntl &= ~IH_REQ_NONSNOOP_EN;
+	WREG32(INTERRUPT_CNTL, interrupt_cntl);
+
+	WREG32(IH_RB_BASE, rdev->ih.gpu_addr >> 8);
+	rb_bufsz = drm_order(rdev->ih.ring_size / 4);
+
+	ih_rb_cntl = (IH_WPTR_OVERFLOW_ENABLE |
+		      IH_WPTR_OVERFLOW_CLEAR |
+		      (rb_bufsz << 1));
+	/* WPTR writeback, not yet */
+	/*ih_rb_cntl |= IH_WPTR_WRITEBACK_ENABLE;*/
+	WREG32(IH_RB_WPTR_ADDR_LO, 0);
+	WREG32(IH_RB_WPTR_ADDR_HI, 0);
+
+	WREG32(IH_RB_CNTL, ih_rb_cntl);
+
+	/* set rptr, wptr to 0 */
+	WREG32(IH_RB_RPTR, 0);
+	WREG32(IH_RB_WPTR, 0);
+
+	/* Default settings for IH_CNTL (disabled at first) */
+	ih_cntl = MC_WRREQ_CREDIT(0x10) | MC_WR_CLEAN_CNT(0x10);
+	/* RPTR_REARM only works if msi's are enabled */
+	if (rdev->msi_enabled)
+		ih_cntl |= RPTR_REARM;
+
+#ifdef __BIG_ENDIAN
+	ih_cntl |= IH_MC_SWAP(IH_MC_SWAP_32BIT);
+#endif
+	WREG32(IH_CNTL, ih_cntl);
+
+	/* force the active interrupt state to all disabled */
+	r600_disable_interrupt_state(rdev);
+
+	/* enable irqs */
+	r600_enable_interrupts(rdev);
+
+	return ret;
+}
+
+void r600_irq_fini(struct radeon_device *rdev)
+{
+	r600_disable_interrupts(rdev);
+	r600_rlc_stop(rdev);
+	r600_ih_ring_fini(rdev);
+}
 
+int r600_irq_set(struct radeon_device *rdev)
+{
+	u32 cp_int_cntl = CNTX_BUSY_INT_ENABLE | CNTX_EMPTY_INT_ENABLE;
+	u32 mode_int = 0;
+	u32 hpd1, hpd2, hpd3, hpd4 = 0, hpd5 = 0, hpd6 = 0;
+
+	if (!rdev->irq.installed) {
+		WARN(1, "Can't enable IRQ/MSI because no handler is installed.\n");
+		return -EINVAL;
+	}
+	/* don't enable anything if the ih is disabled */
+	if (!rdev->ih.enabled)
+		return 0;
 
+	if (ASIC_IS_DCE3(rdev)) {
+		hpd1 = RREG32(DC_HPD1_INT_CONTROL) & ~DC_HPDx_INT_EN;
+		hpd2 = RREG32(DC_HPD2_INT_CONTROL) & ~DC_HPDx_INT_EN;
+		hpd3 = RREG32(DC_HPD3_INT_CONTROL) & ~DC_HPDx_INT_EN;
+		hpd4 = RREG32(DC_HPD4_INT_CONTROL) & ~DC_HPDx_INT_EN;
+		if (ASIC_IS_DCE32(rdev)) {
+			hpd5 = RREG32(DC_HPD5_INT_CONTROL) & ~DC_HPDx_INT_EN;
+			hpd6 = RREG32(DC_HPD6_INT_CONTROL) & ~DC_HPDx_INT_EN;
+		}
+	} else {
+		hpd1 = RREG32(DC_HOT_PLUG_DETECT1_INT_CONTROL) & ~DC_HPDx_INT_EN;
+		hpd2 = RREG32(DC_HOT_PLUG_DETECT2_INT_CONTROL) & ~DC_HPDx_INT_EN;
+		hpd3 = RREG32(DC_HOT_PLUG_DETECT3_INT_CONTROL) & ~DC_HPDx_INT_EN;
+	}
+
+	if (rdev->irq.sw_int) {
+		DRM_DEBUG("r600_irq_set: sw int\n");
+		cp_int_cntl |= RB_INT_ENABLE;
+	}
+	if (rdev->irq.crtc_vblank_int[0]) {
+		DRM_DEBUG("r600_irq_set: vblank 0\n");
+		mode_int |= D1MODE_VBLANK_INT_MASK;
+	}
+	if (rdev->irq.crtc_vblank_int[1]) {
+		DRM_DEBUG("r600_irq_set: vblank 1\n");
+		mode_int |= D2MODE_VBLANK_INT_MASK;
+	}
+	if (rdev->irq.hpd[0]) {
+		DRM_DEBUG("r600_irq_set: hpd 1\n");
+		hpd1 |= DC_HPDx_INT_EN;
+	}
+	if (rdev->irq.hpd[1]) {
+		DRM_DEBUG("r600_irq_set: hpd 2\n");
+		hpd2 |= DC_HPDx_INT_EN;
+	}
+	if (rdev->irq.hpd[2]) {
+		DRM_DEBUG("r600_irq_set: hpd 3\n");
+		hpd3 |= DC_HPDx_INT_EN;
+	}
+	if (rdev->irq.hpd[3]) {
+		DRM_DEBUG("r600_irq_set: hpd 4\n");
+		hpd4 |= DC_HPDx_INT_EN;
+	}
+	if (rdev->irq.hpd[4]) {
+		DRM_DEBUG("r600_irq_set: hpd 5\n");
+		hpd5 |= DC_HPDx_INT_EN;
+	}
+	if (rdev->irq.hpd[5]) {
+		DRM_DEBUG("r600_irq_set: hpd 6\n");
+		hpd6 |= DC_HPDx_INT_EN;
+	}
+
+	WREG32(CP_INT_CNTL, cp_int_cntl);
+	WREG32(DxMODE_INT_MASK, mode_int);
+	if (ASIC_IS_DCE3(rdev)) {
+		WREG32(DC_HPD1_INT_CONTROL, hpd1);
+		WREG32(DC_HPD2_INT_CONTROL, hpd2);
+		WREG32(DC_HPD3_INT_CONTROL, hpd3);
+		WREG32(DC_HPD4_INT_CONTROL, hpd4);
+		if (ASIC_IS_DCE32(rdev)) {
+			WREG32(DC_HPD5_INT_CONTROL, hpd5);
+			WREG32(DC_HPD6_INT_CONTROL, hpd6);
+		}
+	} else {
+		WREG32(DC_HOT_PLUG_DETECT1_INT_CONTROL, hpd1);
+		WREG32(DC_HOT_PLUG_DETECT2_INT_CONTROL, hpd2);
+		WREG32(DC_HOT_PLUG_DETECT3_INT_CONTROL, hpd3);
+	}
+
+	return 0;
+}
+
+static inline void r600_irq_ack(struct radeon_device *rdev,
+				u32 *disp_int,
+				u32 *disp_int_cont,
+				u32 *disp_int_cont2)
+{
+	u32 tmp;
+
+	if (ASIC_IS_DCE3(rdev)) {
+		*disp_int = RREG32(DCE3_DISP_INTERRUPT_STATUS);
+		*disp_int_cont = RREG32(DCE3_DISP_INTERRUPT_STATUS_CONTINUE);
+		*disp_int_cont2 = RREG32(DCE3_DISP_INTERRUPT_STATUS_CONTINUE2);
+	} else {
+		*disp_int = RREG32(DISP_INTERRUPT_STATUS);
+		*disp_int_cont = RREG32(DISP_INTERRUPT_STATUS_CONTINUE);
+		*disp_int_cont2 = 0;
+	}
+
+	if (*disp_int & LB_D1_VBLANK_INTERRUPT)
+		WREG32(D1MODE_VBLANK_STATUS, DxMODE_VBLANK_ACK);
+	if (*disp_int & LB_D1_VLINE_INTERRUPT)
+		WREG32(D1MODE_VLINE_STATUS, DxMODE_VLINE_ACK);
+	if (*disp_int & LB_D2_VBLANK_INTERRUPT)
+		WREG32(D2MODE_VBLANK_STATUS, DxMODE_VBLANK_ACK);
+	if (*disp_int & LB_D2_VLINE_INTERRUPT)
+		WREG32(D2MODE_VLINE_STATUS, DxMODE_VLINE_ACK);
+	if (*disp_int & DC_HPD1_INTERRUPT) {
+		if (ASIC_IS_DCE3(rdev)) {
+			tmp = RREG32(DC_HPD1_INT_CONTROL);
+			tmp |= DC_HPDx_INT_ACK;
+			WREG32(DC_HPD1_INT_CONTROL, tmp);
+		} else {
+			tmp = RREG32(DC_HOT_PLUG_DETECT1_INT_CONTROL);
+			tmp |= DC_HPDx_INT_ACK;
+			WREG32(DC_HOT_PLUG_DETECT1_INT_CONTROL, tmp);
+		}
+	}
+	if (*disp_int & DC_HPD2_INTERRUPT) {
+		if (ASIC_IS_DCE3(rdev)) {
+			tmp = RREG32(DC_HPD2_INT_CONTROL);
+			tmp |= DC_HPDx_INT_ACK;
+			WREG32(DC_HPD2_INT_CONTROL, tmp);
+		} else {
+			tmp = RREG32(DC_HOT_PLUG_DETECT2_INT_CONTROL);
+			tmp |= DC_HPDx_INT_ACK;
+			WREG32(DC_HOT_PLUG_DETECT2_INT_CONTROL, tmp);
+		}
+	}
+	if (*disp_int_cont & DC_HPD3_INTERRUPT) {
+		if (ASIC_IS_DCE3(rdev)) {
+			tmp = RREG32(DC_HPD3_INT_CONTROL);
+			tmp |= DC_HPDx_INT_ACK;
+			WREG32(DC_HPD3_INT_CONTROL, tmp);
+		} else {
+			tmp = RREG32(DC_HOT_PLUG_DETECT3_INT_CONTROL);
+			tmp |= DC_HPDx_INT_ACK;
+			WREG32(DC_HOT_PLUG_DETECT3_INT_CONTROL, tmp);
+		}
+	}
+	if (*disp_int_cont & DC_HPD4_INTERRUPT) {
+		tmp = RREG32(DC_HPD4_INT_CONTROL);
+		tmp |= DC_HPDx_INT_ACK;
+		WREG32(DC_HPD4_INT_CONTROL, tmp);
+	}
+	if (ASIC_IS_DCE32(rdev)) {
+		if (*disp_int_cont2 & DC_HPD5_INTERRUPT) {
+			tmp = RREG32(DC_HPD5_INT_CONTROL);
+			tmp |= DC_HPDx_INT_ACK;
+			WREG32(DC_HPD5_INT_CONTROL, tmp);
+		}
+		if (*disp_int_cont2 & DC_HPD6_INTERRUPT) {
+			tmp = RREG32(DC_HPD5_INT_CONTROL);
+			tmp |= DC_HPDx_INT_ACK;
+			WREG32(DC_HPD6_INT_CONTROL, tmp);
+		}
+	}
+}
+
+void r600_irq_disable(struct radeon_device *rdev)
+{
+	u32 disp_int, disp_int_cont, disp_int_cont2;
+
+	r600_disable_interrupts(rdev);
+	/* Wait and acknowledge irq */
+	mdelay(1);
+	r600_irq_ack(rdev, &disp_int, &disp_int_cont, &disp_int_cont2);
+	r600_disable_interrupt_state(rdev);
+}
+
+static inline u32 r600_get_ih_wptr(struct radeon_device *rdev)
+{
+	u32 wptr, tmp;
+
+	/* XXX use writeback */
+	wptr = RREG32(IH_RB_WPTR);
+
+	if (wptr & RB_OVERFLOW) {
+		WARN_ON(1);
+		/* XXX deal with overflow */
+		DRM_ERROR("IH RB overflow\n");
+		tmp = RREG32(IH_RB_CNTL);
+		tmp |= IH_WPTR_OVERFLOW_CLEAR;
+		WREG32(IH_RB_CNTL, tmp);
+	}
+	wptr = wptr & WPTR_OFFSET_MASK;
+
+	return wptr;
+}
+
+/*        r600 IV Ring
+ * Each IV ring entry is 128 bits:
+ * [7:0]    - interrupt source id
+ * [31:8]   - reserved
+ * [59:32]  - interrupt source data
+ * [127:60]  - reserved
+ *
+ * The basic interrupt vector entries
+ * are decoded as follows:
+ * src_id  src_data  description
+ *      1         0  D1 Vblank
+ *      1         1  D1 Vline
+ *      5         0  D2 Vblank
+ *      5         1  D2 Vline
+ *     19         0  FP Hot plug detection A
+ *     19         1  FP Hot plug detection B
+ *     19         2  DAC A auto-detection
+ *     19         3  DAC B auto-detection
+ *    176         -  CP_INT RB
+ *    177         -  CP_INT IB1
+ *    178         -  CP_INT IB2
+ *    181         -  EOP Interrupt
+ *    233         -  GUI Idle
+ *
+ * Note, these are based on r600 and may need to be
+ * adjusted or added to on newer asics
+ */
+
+int r600_irq_process(struct radeon_device *rdev)
+{
+	u32 wptr = r600_get_ih_wptr(rdev);
+	u32 rptr = rdev->ih.rptr;
+	u32 src_id, src_data;
+	u32 last_entry = rdev->ih.ring_size - 16;
+	u32 ring_index, disp_int, disp_int_cont, disp_int_cont2;
+	unsigned long flags;
+	bool queue_hotplug = false;
+
+	DRM_DEBUG("r600_irq_process start: rptr %d, wptr %d\n", rptr, wptr);
+
+	spin_lock_irqsave(&rdev->ih.lock, flags);
+
+	if (rptr == wptr) {
+		spin_unlock_irqrestore(&rdev->ih.lock, flags);
+		return IRQ_NONE;
+	}
+	if (rdev->shutdown) {
+		spin_unlock_irqrestore(&rdev->ih.lock, flags);
+		return IRQ_NONE;
+	}
+
+restart_ih:
+	/* display interrupts */
+	r600_irq_ack(rdev, &disp_int, &disp_int_cont, &disp_int_cont2);
+
+	rdev->ih.wptr = wptr;
+	while (rptr != wptr) {
+		/* wptr/rptr are in bytes! */
+		ring_index = rptr / 4;
+		src_id =  rdev->ih.ring[ring_index] & 0xff;
+		src_data = rdev->ih.ring[ring_index + 1] & 0xfffffff;
+
+		switch (src_id) {
+		case 1: /* D1 vblank/vline */
+			switch (src_data) {
+			case 0: /* D1 vblank */
+				if (disp_int & LB_D1_VBLANK_INTERRUPT) {
+					drm_handle_vblank(rdev->ddev, 0);
+					disp_int &= ~LB_D1_VBLANK_INTERRUPT;
+					DRM_DEBUG("IH: D1 vblank\n");
+				}
+				break;
+			case 1: /* D1 vline */
+				if (disp_int & LB_D1_VLINE_INTERRUPT) {
+					disp_int &= ~LB_D1_VLINE_INTERRUPT;
+					DRM_DEBUG("IH: D1 vline\n");
+				}
+				break;
+			default:
+				DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
+				break;
+			}
+			break;
+		case 5: /* D2 vblank/vline */
+			switch (src_data) {
+			case 0: /* D2 vblank */
+				if (disp_int & LB_D2_VBLANK_INTERRUPT) {
+					drm_handle_vblank(rdev->ddev, 1);
+					disp_int &= ~LB_D2_VBLANK_INTERRUPT;
+					DRM_DEBUG("IH: D2 vblank\n");
+				}
+				break;
+			case 1: /* D1 vline */
+				if (disp_int & LB_D2_VLINE_INTERRUPT) {
+					disp_int &= ~LB_D2_VLINE_INTERRUPT;
+					DRM_DEBUG("IH: D2 vline\n");
+				}
+				break;
+			default:
+				DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
+				break;
+			}
+			break;
+		case 19: /* HPD/DAC hotplug */
+			switch (src_data) {
+			case 0:
+				if (disp_int & DC_HPD1_INTERRUPT) {
+					disp_int &= ~DC_HPD1_INTERRUPT;
+					queue_hotplug = true;
+					DRM_DEBUG("IH: HPD1\n");
+				}
+				break;
+			case 1:
+				if (disp_int & DC_HPD2_INTERRUPT) {
+					disp_int &= ~DC_HPD2_INTERRUPT;
+					queue_hotplug = true;
+					DRM_DEBUG("IH: HPD2\n");
+				}
+				break;
+			case 4:
+				if (disp_int_cont & DC_HPD3_INTERRUPT) {
+					disp_int_cont &= ~DC_HPD3_INTERRUPT;
+					queue_hotplug = true;
+					DRM_DEBUG("IH: HPD3\n");
+				}
+				break;
+			case 5:
+				if (disp_int_cont & DC_HPD4_INTERRUPT) {
+					disp_int_cont &= ~DC_HPD4_INTERRUPT;
+					queue_hotplug = true;
+					DRM_DEBUG("IH: HPD4\n");
+				}
+				break;
+			case 10:
+				if (disp_int_cont2 & DC_HPD5_INTERRUPT) {
+					disp_int_cont &= ~DC_HPD5_INTERRUPT;
+					queue_hotplug = true;
+					DRM_DEBUG("IH: HPD5\n");
+				}
+				break;
+			case 12:
+				if (disp_int_cont2 & DC_HPD6_INTERRUPT) {
+					disp_int_cont &= ~DC_HPD6_INTERRUPT;
+					queue_hotplug = true;
+					DRM_DEBUG("IH: HPD6\n");
+				}
+				break;
+			default:
+				DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
+				break;
+			}
+			break;
+		case 176: /* CP_INT in ring buffer */
+		case 177: /* CP_INT in IB1 */
+		case 178: /* CP_INT in IB2 */
+			DRM_DEBUG("IH: CP int: 0x%08x\n", src_data);
+			radeon_fence_process(rdev);
+			break;
+		case 181: /* CP EOP event */
+			DRM_DEBUG("IH: CP EOP\n");
+			break;
+		default:
+			DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
+			break;
+		}
+
+		/* wptr/rptr are in bytes! */
+		if (rptr == last_entry)
+			rptr = 0;
+		else
+			rptr += 16;
+	}
+	/* make sure wptr hasn't changed while processing */
+	wptr = r600_get_ih_wptr(rdev);
+	if (wptr != rdev->ih.wptr)
+		goto restart_ih;
+	if (queue_hotplug)
+		queue_work(rdev->wq, &rdev->hotplug_work);
+	rdev->ih.rptr = rptr;
+	WREG32(IH_RB_RPTR, rdev->ih.rptr);
+	spin_unlock_irqrestore(&rdev->ih.lock, flags);
+	return IRQ_HANDLED;
+}
 
 /*
  * Debugfs info
@@ -1811,21 +2844,21 @@ static int r600_debugfs_cp_ring_info(struct seq_file *m, void *data)
 	struct drm_info_node *node = (struct drm_info_node *) m->private;
 	struct drm_device *dev = node->minor->dev;
 	struct radeon_device *rdev = dev->dev_private;
-	uint32_t rdp, wdp;
 	unsigned count, i, j;
 
 	radeon_ring_free_size(rdev);
-	rdp = RREG32(CP_RB_RPTR);
-	wdp = RREG32(CP_RB_WPTR);
-	count = (rdp + rdev->cp.ring_size - wdp) & rdev->cp.ptr_mask;
+	count = (rdev->cp.ring_size / 4) - rdev->cp.ring_free_dw;
 	seq_printf(m, "CP_STAT 0x%08x\n", RREG32(CP_STAT));
-	seq_printf(m, "CP_RB_WPTR 0x%08x\n", wdp);
-	seq_printf(m, "CP_RB_RPTR 0x%08x\n", rdp);
+	seq_printf(m, "CP_RB_WPTR 0x%08x\n", RREG32(CP_RB_WPTR));
+	seq_printf(m, "CP_RB_RPTR 0x%08x\n", RREG32(CP_RB_RPTR));
+	seq_printf(m, "driver's copy of the CP_RB_WPTR 0x%08x\n", rdev->cp.wptr);
+	seq_printf(m, "driver's copy of the CP_RB_RPTR 0x%08x\n", rdev->cp.rptr);
 	seq_printf(m, "%u free dwords in ring\n", rdev->cp.ring_free_dw);
 	seq_printf(m, "%u dwords in ring\n", count);
+	i = rdev->cp.rptr;
 	for (j = 0; j <= count; j++) {
-		i = (rdp + j) & rdev->cp.ptr_mask;
 		seq_printf(m, "r[%04d]=0x%08x\n", i, rdev->cp.ring[i]);
+		i = (i + 1) & rdev->cp.ptr_mask;
 	}
 	return 0;
 }
diff --git a/drivers/gpu/drm/radeon/r600_audio.c b/drivers/gpu/drm/radeon/r600_audio.c
new file mode 100644
index 000000000000..99e2c3891a7d
--- /dev/null
+++ b/drivers/gpu/drm/radeon/r600_audio.c
@@ -0,0 +1,267 @@
+/*
+ * Copyright 2008 Advanced Micro Devices, Inc.
+ * Copyright 2008 Red Hat Inc.
+ * Copyright 2009 Christian König.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * Authors: Christian König
+ */
+#include "drmP.h"
+#include "radeon.h"
+#include "radeon_reg.h"
+#include "atom.h"
+
+#define AUDIO_TIMER_INTERVALL 100 /* 1/10 sekund should be enough */
+
+/*
+ * check if the chipset is supported
+ */
+static int r600_audio_chipset_supported(struct radeon_device *rdev)
+{
+	return rdev->family >= CHIP_R600
+		|| rdev->family == CHIP_RS600
+		|| rdev->family == CHIP_RS690
+		|| rdev->family == CHIP_RS740;
+}
+
+/*
+ * current number of channels
+ */
+static int r600_audio_channels(struct radeon_device *rdev)
+{
+	return (RREG32(R600_AUDIO_RATE_BPS_CHANNEL) & 0x7) + 1;
+}
+
+/*
+ * current bits per sample
+ */
+static int r600_audio_bits_per_sample(struct radeon_device *rdev)
+{
+	uint32_t value = (RREG32(R600_AUDIO_RATE_BPS_CHANNEL) & 0xF0) >> 4;
+	switch (value) {
+	case 0x0: return  8;
+	case 0x1: return 16;
+	case 0x2: return 20;
+	case 0x3: return 24;
+	case 0x4: return 32;
+	}
+
+	DRM_ERROR("Unknown bits per sample 0x%x using 16 instead.\n", (int)value);
+
+	return 16;
+}
+
+/*
+ * current sampling rate in HZ
+ */
+static int r600_audio_rate(struct radeon_device *rdev)
+{
+	uint32_t value = RREG32(R600_AUDIO_RATE_BPS_CHANNEL);
+	uint32_t result;
+
+	if (value & 0x4000)
+		result = 44100;
+	else
+		result = 48000;
+
+	result *= ((value >> 11) & 0x7) + 1;
+	result /= ((value >> 8) & 0x7) + 1;
+
+	return result;
+}
+
+/*
+ * iec 60958 status bits
+ */
+static uint8_t r600_audio_status_bits(struct radeon_device *rdev)
+{
+	return RREG32(R600_AUDIO_STATUS_BITS) & 0xff;
+}
+
+/*
+ * iec 60958 category code
+ */
+static uint8_t r600_audio_category_code(struct radeon_device *rdev)
+{
+	return (RREG32(R600_AUDIO_STATUS_BITS) >> 8) & 0xff;
+}
+
+/*
+ * update all hdmi interfaces with current audio parameters
+ */
+static void r600_audio_update_hdmi(unsigned long param)
+{
+	struct radeon_device *rdev = (struct radeon_device *)param;
+	struct drm_device *dev = rdev->ddev;
+
+	int channels = r600_audio_channels(rdev);
+	int rate = r600_audio_rate(rdev);
+	int bps = r600_audio_bits_per_sample(rdev);
+	uint8_t status_bits = r600_audio_status_bits(rdev);
+	uint8_t category_code = r600_audio_category_code(rdev);
+
+	struct drm_encoder *encoder;
+	int changes = 0;
+
+	changes |= channels != rdev->audio_channels;
+	changes |= rate != rdev->audio_rate;
+	changes |= bps != rdev->audio_bits_per_sample;
+	changes |= status_bits != rdev->audio_status_bits;
+	changes |= category_code != rdev->audio_category_code;
+
+	if (changes) {
+		rdev->audio_channels = channels;
+		rdev->audio_rate = rate;
+		rdev->audio_bits_per_sample = bps;
+		rdev->audio_status_bits = status_bits;
+		rdev->audio_category_code = category_code;
+	}
+
+	list_for_each_entry(encoder, &dev->mode_config.encoder_list, head) {
+		if (changes || r600_hdmi_buffer_status_changed(encoder))
+			r600_hdmi_update_audio_settings(
+				encoder, channels,
+				rate, bps, status_bits,
+				category_code);
+	}
+
+	mod_timer(&rdev->audio_timer,
+		jiffies + msecs_to_jiffies(AUDIO_TIMER_INTERVALL));
+}
+
+/*
+ * initialize the audio vars and register the update timer
+ */
+int r600_audio_init(struct radeon_device *rdev)
+{
+	if (!r600_audio_chipset_supported(rdev))
+		return 0;
+
+	DRM_INFO("%s audio support", radeon_audio ? "Enabling" : "Disabling");
+	WREG32_P(R600_AUDIO_ENABLE, radeon_audio ? 0x81000000 : 0x0, ~0x81000000);
+
+	rdev->audio_channels = -1;
+	rdev->audio_rate = -1;
+	rdev->audio_bits_per_sample = -1;
+	rdev->audio_status_bits = 0;
+	rdev->audio_category_code = 0;
+
+	setup_timer(
+		&rdev->audio_timer,
+		r600_audio_update_hdmi,
+		(unsigned long)rdev);
+
+	mod_timer(&rdev->audio_timer, jiffies + 1);
+
+	return 0;
+}
+
+/*
+ * determin how the encoders and audio interface is wired together
+ */
+int r600_audio_tmds_index(struct drm_encoder *encoder)
+{
+	struct drm_device *dev = encoder->dev;
+	struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
+	struct drm_encoder *other;
+
+	switch (radeon_encoder->encoder_id) {
+	case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_TMDS1:
+	case ENCODER_OBJECT_ID_INTERNAL_UNIPHY:
+	case ENCODER_OBJECT_ID_INTERNAL_UNIPHY1:
+		return 0;
+
+	case ENCODER_OBJECT_ID_INTERNAL_LVTM1:
+		/* special case check if an TMDS1 is present */
+		list_for_each_entry(other, &dev->mode_config.encoder_list, head) {
+			if (to_radeon_encoder(other)->encoder_id ==
+				ENCODER_OBJECT_ID_INTERNAL_TMDS1)
+				return 1;
+		}
+		return 0;
+
+	case ENCODER_OBJECT_ID_INTERNAL_UNIPHY2:
+	case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_LVTMA:
+		return 1;
+
+	default:
+		DRM_ERROR("Unsupported encoder type 0x%02X\n",
+			  radeon_encoder->encoder_id);
+		return -1;
+	}
+}
+
+/*
+ * atach the audio codec to the clock source of the encoder
+ */
+void r600_audio_set_clock(struct drm_encoder *encoder, int clock)
+{
+	struct drm_device *dev = encoder->dev;
+	struct radeon_device *rdev = dev->dev_private;
+	struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
+	int base_rate = 48000;
+
+	switch (radeon_encoder->encoder_id) {
+	case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_TMDS1:
+	case ENCODER_OBJECT_ID_INTERNAL_LVTM1:
+		WREG32_P(R600_AUDIO_TIMING, 0, ~0x301);
+		break;
+
+	case ENCODER_OBJECT_ID_INTERNAL_UNIPHY:
+	case ENCODER_OBJECT_ID_INTERNAL_UNIPHY1:
+	case ENCODER_OBJECT_ID_INTERNAL_UNIPHY2:
+	case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_LVTMA:
+		WREG32_P(R600_AUDIO_TIMING, 0x100, ~0x301);
+		break;
+
+	default:
+		DRM_ERROR("Unsupported encoder type 0x%02X\n",
+			  radeon_encoder->encoder_id);
+		return;
+	}
+
+	switch (r600_audio_tmds_index(encoder)) {
+	case 0:
+		WREG32(R600_AUDIO_PLL1_MUL, base_rate*50);
+		WREG32(R600_AUDIO_PLL1_DIV, clock*100);
+		WREG32(R600_AUDIO_CLK_SRCSEL, 0);
+		break;
+
+	case 1:
+		WREG32(R600_AUDIO_PLL2_MUL, base_rate*50);
+		WREG32(R600_AUDIO_PLL2_DIV, clock*100);
+		WREG32(R600_AUDIO_CLK_SRCSEL, 1);
+		break;
+	}
+}
+
+/*
+ * release the audio timer
+ * TODO: How to do this correctly on SMP systems?
+ */
+void r600_audio_fini(struct radeon_device *rdev)
+{
+	if (!r600_audio_chipset_supported(rdev))
+		return;
+
+	WREG32_P(R600_AUDIO_ENABLE, 0x0, ~0x81000000);
+
+	del_timer(&rdev->audio_timer);
+}
diff --git a/drivers/gpu/drm/radeon/r600_blit_kms.c b/drivers/gpu/drm/radeon/r600_blit_kms.c
index dbf716e1fbf3..8787ea89dc6e 100644
--- a/drivers/gpu/drm/radeon/r600_blit_kms.c
+++ b/drivers/gpu/drm/radeon/r600_blit_kms.c
@@ -473,9 +473,8 @@ int r600_blit_init(struct radeon_device *rdev)
 	obj_size += r6xx_ps_size * 4;
 	obj_size = ALIGN(obj_size, 256);
 
-	r = radeon_object_create(rdev, NULL, obj_size,
-				 true, RADEON_GEM_DOMAIN_VRAM,
-				 false, &rdev->r600_blit.shader_obj);
+	r = radeon_bo_create(rdev, NULL, obj_size, true, RADEON_GEM_DOMAIN_VRAM,
+				&rdev->r600_blit.shader_obj);
 	if (r) {
 		DRM_ERROR("r600 failed to allocate shader\n");
 		return r;
@@ -485,12 +484,14 @@ int r600_blit_init(struct radeon_device *rdev)
 		  obj_size,
 		  rdev->r600_blit.vs_offset, rdev->r600_blit.ps_offset);
 
-	r = radeon_object_kmap(rdev->r600_blit.shader_obj, &ptr);
+	r = radeon_bo_reserve(rdev->r600_blit.shader_obj, false);
+	if (unlikely(r != 0))
+		return r;
+	r = radeon_bo_kmap(rdev->r600_blit.shader_obj, &ptr);
 	if (r) {
 		DRM_ERROR("failed to map blit object %d\n", r);
 		return r;
 	}
-
 	if (rdev->family >= CHIP_RV770)
 		memcpy_toio(ptr + rdev->r600_blit.state_offset,
 			    r7xx_default_state, rdev->r600_blit.state_len * 4);
@@ -500,19 +501,26 @@ int r600_blit_init(struct radeon_device *rdev)
 	if (num_packet2s)
 		memcpy_toio(ptr + rdev->r600_blit.state_offset + (rdev->r600_blit.state_len * 4),
 			    packet2s, num_packet2s * 4);
-
-
 	memcpy(ptr + rdev->r600_blit.vs_offset, r6xx_vs, r6xx_vs_size * 4);
 	memcpy(ptr + rdev->r600_blit.ps_offset, r6xx_ps, r6xx_ps_size * 4);
-
-	radeon_object_kunmap(rdev->r600_blit.shader_obj);
+	radeon_bo_kunmap(rdev->r600_blit.shader_obj);
+	radeon_bo_unreserve(rdev->r600_blit.shader_obj);
 	return 0;
 }
 
 void r600_blit_fini(struct radeon_device *rdev)
 {
-	radeon_object_unpin(rdev->r600_blit.shader_obj);
-	radeon_object_unref(&rdev->r600_blit.shader_obj);
+	int r;
+
+	r = radeon_bo_reserve(rdev->r600_blit.shader_obj, false);
+	if (unlikely(r != 0)) {
+		dev_err(rdev->dev, "(%d) can't finish r600 blit\n", r);
+		goto out_unref;
+	}
+	radeon_bo_unpin(rdev->r600_blit.shader_obj);
+	radeon_bo_unreserve(rdev->r600_blit.shader_obj);
+out_unref:
+	radeon_bo_unref(&rdev->r600_blit.shader_obj);
 }
 
 int r600_vb_ib_get(struct radeon_device *rdev)
@@ -569,9 +577,9 @@ int r600_blit_prepare_copy(struct radeon_device *rdev, int size_bytes)
 	ring_size = num_loops * dwords_per_loop;
 	/* set default  + shaders */
 	ring_size += 40; /* shaders + def state */
-	ring_size += 3; /* fence emit for VB IB */
+	ring_size += 7; /* fence emit for VB IB */
 	ring_size += 5; /* done copy */
-	ring_size += 3; /* fence emit for done copy */
+	ring_size += 7; /* fence emit for done copy */
 	r = radeon_ring_lock(rdev, ring_size);
 	WARN_ON(r);
 
diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c
index 0d820764f340..44060b92d9e6 100644
--- a/drivers/gpu/drm/radeon/r600_cs.c
+++ b/drivers/gpu/drm/radeon/r600_cs.c
@@ -170,7 +170,7 @@ static int r600_cs_packet_next_reloc_nomm(struct radeon_cs_parser *p,
 			  idx, relocs_chunk->length_dw);
 		return -EINVAL;
 	}
-	*cs_reloc = &p->relocs[0];
+	*cs_reloc = p->relocs;
 	(*cs_reloc)->lobj.gpu_offset = (u64)relocs_chunk->kdata[idx + 3] << 32;
 	(*cs_reloc)->lobj.gpu_offset |= relocs_chunk->kdata[idx + 0];
 	return 0;
@@ -717,7 +717,7 @@ static int r600_cs_parser_relocs_legacy(struct radeon_cs_parser *p)
 	if (p->chunk_relocs_idx == -1) {
 		return 0;
 	}
-	p->relocs = kcalloc(1, sizeof(struct radeon_cs_reloc), GFP_KERNEL);
+	p->relocs = kzalloc(sizeof(struct radeon_cs_reloc), GFP_KERNEL);
 	if (p->relocs == NULL) {
 		return -ENOMEM;
 	}
diff --git a/drivers/gpu/drm/radeon/r600_hdmi.c b/drivers/gpu/drm/radeon/r600_hdmi.c
new file mode 100644
index 000000000000..fcc949df0e5d
--- /dev/null
+++ b/drivers/gpu/drm/radeon/r600_hdmi.c
@@ -0,0 +1,506 @@
+/*
+ * Copyright 2008 Advanced Micro Devices, Inc.
+ * Copyright 2008 Red Hat Inc.
+ * Copyright 2009 Christian König.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * Authors: Christian König
+ */
+#include "drmP.h"
+#include "radeon_drm.h"
+#include "radeon.h"
+#include "atom.h"
+
+/*
+ * HDMI color format
+ */
+enum r600_hdmi_color_format {
+	RGB = 0,
+	YCC_422 = 1,
+	YCC_444 = 2
+};
+
+/*
+ * IEC60958 status bits
+ */
+enum r600_hdmi_iec_status_bits {
+	AUDIO_STATUS_DIG_ENABLE   = 0x01,
+	AUDIO_STATUS_V	    = 0x02,
+	AUDIO_STATUS_VCFG	 = 0x04,
+	AUDIO_STATUS_EMPHASIS     = 0x08,
+	AUDIO_STATUS_COPYRIGHT    = 0x10,
+	AUDIO_STATUS_NONAUDIO     = 0x20,
+	AUDIO_STATUS_PROFESSIONAL = 0x40,
+	AUDIO_STATUS_LEVEL	= 0x80
+};
+
+struct {
+	uint32_t Clock;
+
+	int N_32kHz;
+	int CTS_32kHz;
+
+	int N_44_1kHz;
+	int CTS_44_1kHz;
+
+	int N_48kHz;
+	int CTS_48kHz;
+
+} r600_hdmi_ACR[] = {
+    /*	     32kHz	  44.1kHz	48kHz    */
+    /* Clock      N     CTS      N     CTS      N     CTS */
+    {  25174,  4576,  28125,  7007,  31250,  6864,  28125 }, /*  25,20/1.001 MHz */
+    {  25200,  4096,  25200,  6272,  28000,  6144,  25200 }, /*  25.20       MHz */
+    {  27000,  4096,  27000,  6272,  30000,  6144,  27000 }, /*  27.00       MHz */
+    {  27027,  4096,  27027,  6272,  30030,  6144,  27027 }, /*  27.00*1.001 MHz */
+    {  54000,  4096,  54000,  6272,  60000,  6144,  54000 }, /*  54.00       MHz */
+    {  54054,  4096,  54054,  6272,  60060,  6144,  54054 }, /*  54.00*1.001 MHz */
+    {  74175, 11648, 210937, 17836, 234375, 11648, 140625 }, /*  74.25/1.001 MHz */
+    {  74250,  4096,  74250,  6272,  82500,  6144,  74250 }, /*  74.25       MHz */
+    { 148351, 11648, 421875,  8918, 234375,  5824, 140625 }, /* 148.50/1.001 MHz */
+    { 148500,  4096, 148500,  6272, 165000,  6144, 148500 }, /* 148.50       MHz */
+    {      0,  4096,      0,  6272,      0,  6144,      0 }  /* Other */
+};
+
+/*
+ * calculate CTS value if it's not found in the table
+ */
+static void r600_hdmi_calc_CTS(uint32_t clock, int *CTS, int N, int freq)
+{
+	if (*CTS == 0)
+		*CTS = clock*N/(128*freq)*1000;
+	DRM_DEBUG("Using ACR timing N=%d CTS=%d for frequency %d\n",
+		  N, *CTS, freq);
+}
+
+/*
+ * update the N and CTS parameters for a given pixel clock rate
+ */
+static void r600_hdmi_update_ACR(struct drm_encoder *encoder, uint32_t clock)
+{
+	struct drm_device *dev = encoder->dev;
+	struct radeon_device *rdev = dev->dev_private;
+	uint32_t offset = to_radeon_encoder(encoder)->hdmi_offset;
+	int CTS;
+	int N;
+	int i;
+
+	for (i = 0; r600_hdmi_ACR[i].Clock != clock && r600_hdmi_ACR[i].Clock != 0; i++);
+
+	CTS = r600_hdmi_ACR[i].CTS_32kHz;
+	N = r600_hdmi_ACR[i].N_32kHz;
+	r600_hdmi_calc_CTS(clock, &CTS, N, 32000);
+	WREG32(offset+R600_HDMI_32kHz_CTS, CTS << 12);
+	WREG32(offset+R600_HDMI_32kHz_N, N);
+
+	CTS = r600_hdmi_ACR[i].CTS_44_1kHz;
+	N = r600_hdmi_ACR[i].N_44_1kHz;
+	r600_hdmi_calc_CTS(clock, &CTS, N, 44100);
+	WREG32(offset+R600_HDMI_44_1kHz_CTS, CTS << 12);
+	WREG32(offset+R600_HDMI_44_1kHz_N, N);
+
+	CTS = r600_hdmi_ACR[i].CTS_48kHz;
+	N = r600_hdmi_ACR[i].N_48kHz;
+	r600_hdmi_calc_CTS(clock, &CTS, N, 48000);
+	WREG32(offset+R600_HDMI_48kHz_CTS, CTS << 12);
+	WREG32(offset+R600_HDMI_48kHz_N, N);
+}
+
+/*
+ * calculate the crc for a given info frame
+ */
+static void r600_hdmi_infoframe_checksum(uint8_t packetType,
+					 uint8_t versionNumber,
+					 uint8_t length,
+					 uint8_t *frame)
+{
+    int i;
+    frame[0] = packetType + versionNumber + length;
+    for (i = 1; i <= length; i++)
+	frame[0] += frame[i];
+    frame[0] = 0x100 - frame[0];
+}
+
+/*
+ * build a HDMI Video Info Frame
+ */
+static void r600_hdmi_videoinfoframe(
+	struct drm_encoder *encoder,
+	enum r600_hdmi_color_format color_format,
+	int active_information_present,
+	uint8_t active_format_aspect_ratio,
+	uint8_t scan_information,
+	uint8_t colorimetry,
+	uint8_t ex_colorimetry,
+	uint8_t quantization,
+	int ITC,
+	uint8_t picture_aspect_ratio,
+	uint8_t video_format_identification,
+	uint8_t pixel_repetition,
+	uint8_t non_uniform_picture_scaling,
+	uint8_t bar_info_data_valid,
+	uint16_t top_bar,
+	uint16_t bottom_bar,
+	uint16_t left_bar,
+	uint16_t right_bar
+)
+{
+	struct drm_device *dev = encoder->dev;
+	struct radeon_device *rdev = dev->dev_private;
+	uint32_t offset = to_radeon_encoder(encoder)->hdmi_offset;
+
+	uint8_t frame[14];
+
+	frame[0x0] = 0;
+	frame[0x1] =
+		(scan_information & 0x3) |
+		((bar_info_data_valid & 0x3) << 2) |
+		((active_information_present & 0x1) << 4) |
+		((color_format & 0x3) << 5);
+	frame[0x2] =
+		(active_format_aspect_ratio & 0xF) |
+		((picture_aspect_ratio & 0x3) << 4) |
+		((colorimetry & 0x3) << 6);
+	frame[0x3] =
+		(non_uniform_picture_scaling & 0x3) |
+		((quantization & 0x3) << 2) |
+		((ex_colorimetry & 0x7) << 4) |
+		((ITC & 0x1) << 7);
+	frame[0x4] = (video_format_identification & 0x7F);
+	frame[0x5] = (pixel_repetition & 0xF);
+	frame[0x6] = (top_bar & 0xFF);
+	frame[0x7] = (top_bar >> 8);
+	frame[0x8] = (bottom_bar & 0xFF);
+	frame[0x9] = (bottom_bar >> 8);
+	frame[0xA] = (left_bar & 0xFF);
+	frame[0xB] = (left_bar >> 8);
+	frame[0xC] = (right_bar & 0xFF);
+	frame[0xD] = (right_bar >> 8);
+
+	r600_hdmi_infoframe_checksum(0x82, 0x02, 0x0D, frame);
+
+	WREG32(offset+R600_HDMI_VIDEOINFOFRAME_0,
+		frame[0x0] | (frame[0x1] << 8) | (frame[0x2] << 16) | (frame[0x3] << 24));
+	WREG32(offset+R600_HDMI_VIDEOINFOFRAME_1,
+		frame[0x4] | (frame[0x5] << 8) | (frame[0x6] << 16) | (frame[0x7] << 24));
+	WREG32(offset+R600_HDMI_VIDEOINFOFRAME_2,
+		frame[0x8] | (frame[0x9] << 8) | (frame[0xA] << 16) | (frame[0xB] << 24));
+	WREG32(offset+R600_HDMI_VIDEOINFOFRAME_3,
+		frame[0xC] | (frame[0xD] << 8));
+}
+
+/*
+ * build a Audio Info Frame
+ */
+static void r600_hdmi_audioinfoframe(
+	struct drm_encoder *encoder,
+	uint8_t channel_count,
+	uint8_t coding_type,
+	uint8_t sample_size,
+	uint8_t sample_frequency,
+	uint8_t format,
+	uint8_t channel_allocation,
+	uint8_t level_shift,
+	int downmix_inhibit
+)
+{
+	struct drm_device *dev = encoder->dev;
+	struct radeon_device *rdev = dev->dev_private;
+	uint32_t offset = to_radeon_encoder(encoder)->hdmi_offset;
+
+	uint8_t frame[11];
+
+	frame[0x0] = 0;
+	frame[0x1] = (channel_count & 0x7) | ((coding_type & 0xF) << 4);
+	frame[0x2] = (sample_size & 0x3) | ((sample_frequency & 0x7) << 2);
+	frame[0x3] = format;
+	frame[0x4] = channel_allocation;
+	frame[0x5] = ((level_shift & 0xF) << 3) | ((downmix_inhibit & 0x1) << 7);
+	frame[0x6] = 0;
+	frame[0x7] = 0;
+	frame[0x8] = 0;
+	frame[0x9] = 0;
+	frame[0xA] = 0;
+
+	r600_hdmi_infoframe_checksum(0x84, 0x01, 0x0A, frame);
+
+	WREG32(offset+R600_HDMI_AUDIOINFOFRAME_0,
+		frame[0x0] | (frame[0x1] << 8) | (frame[0x2] << 16) | (frame[0x3] << 24));
+	WREG32(offset+R600_HDMI_AUDIOINFOFRAME_1,
+		frame[0x4] | (frame[0x5] << 8) | (frame[0x6] << 16) | (frame[0x8] << 24));
+}
+
+/*
+ * test if audio buffer is filled enough to start playing
+ */
+static int r600_hdmi_is_audio_buffer_filled(struct drm_encoder *encoder)
+{
+	struct drm_device *dev = encoder->dev;
+	struct radeon_device *rdev = dev->dev_private;
+	uint32_t offset = to_radeon_encoder(encoder)->hdmi_offset;
+
+	return (RREG32(offset+R600_HDMI_STATUS) & 0x10) != 0;
+}
+
+/*
+ * have buffer status changed since last call?
+ */
+int r600_hdmi_buffer_status_changed(struct drm_encoder *encoder)
+{
+	struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
+	int status, result;
+
+	if (!radeon_encoder->hdmi_offset)
+		return 0;
+
+	status = r600_hdmi_is_audio_buffer_filled(encoder);
+	result = radeon_encoder->hdmi_buffer_status != status;
+	radeon_encoder->hdmi_buffer_status = status;
+
+	return result;
+}
+
+/*
+ * write the audio workaround status to the hardware
+ */
+void r600_hdmi_audio_workaround(struct drm_encoder *encoder)
+{
+	struct drm_device *dev = encoder->dev;
+	struct radeon_device *rdev = dev->dev_private;
+	struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
+	uint32_t offset = radeon_encoder->hdmi_offset;
+
+	if (!offset)
+		return;
+
+	if (r600_hdmi_is_audio_buffer_filled(encoder)) {
+		/* disable audio workaround and start delivering of audio frames */
+		WREG32_P(offset+R600_HDMI_CNTL, 0x00000001, ~0x00001001);
+
+	} else if (radeon_encoder->hdmi_audio_workaround) {
+		/* enable audio workaround and start delivering of audio frames */
+		WREG32_P(offset+R600_HDMI_CNTL, 0x00001001, ~0x00001001);
+
+	} else {
+		/* disable audio workaround and stop delivering of audio frames */
+		WREG32_P(offset+R600_HDMI_CNTL, 0x00000000, ~0x00001001);
+	}
+}
+
+
+/*
+ * update the info frames with the data from the current display mode
+ */
+void r600_hdmi_setmode(struct drm_encoder *encoder, struct drm_display_mode *mode)
+{
+	struct drm_device *dev = encoder->dev;
+	struct radeon_device *rdev = dev->dev_private;
+	uint32_t offset = to_radeon_encoder(encoder)->hdmi_offset;
+
+	if (!offset)
+		return;
+
+	r600_audio_set_clock(encoder, mode->clock);
+
+	WREG32(offset+R600_HDMI_UNKNOWN_0, 0x1000);
+	WREG32(offset+R600_HDMI_UNKNOWN_1, 0x0);
+	WREG32(offset+R600_HDMI_UNKNOWN_2, 0x1000);
+
+	r600_hdmi_update_ACR(encoder, mode->clock);
+
+	WREG32(offset+R600_HDMI_VIDEOCNTL, 0x13);
+
+	WREG32(offset+R600_HDMI_VERSION, 0x202);
+
+	r600_hdmi_videoinfoframe(encoder, RGB, 0, 0, 0, 0,
+		0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);
+
+	/* it's unknown what these bits do excatly, but it's indeed quite usefull for debugging */
+	WREG32(offset+R600_HDMI_AUDIO_DEBUG_0, 0x00FFFFFF);
+	WREG32(offset+R600_HDMI_AUDIO_DEBUG_1, 0x007FFFFF);
+	WREG32(offset+R600_HDMI_AUDIO_DEBUG_2, 0x00000001);
+	WREG32(offset+R600_HDMI_AUDIO_DEBUG_3, 0x00000001);
+
+	r600_hdmi_audio_workaround(encoder);
+
+	/* audio packets per line, does anyone know how to calc this ? */
+	WREG32_P(offset+R600_HDMI_CNTL, 0x00040000, ~0x001F0000);
+
+	/* update? reset? don't realy know */
+	WREG32_P(offset+R600_HDMI_CNTL, 0x14000000, ~0x14000000);
+}
+
+/*
+ * update settings with current parameters from audio engine
+ */
+void r600_hdmi_update_audio_settings(struct drm_encoder *encoder,
+				     int channels,
+				     int rate,
+				     int bps,
+				     uint8_t status_bits,
+				     uint8_t category_code)
+{
+	struct drm_device *dev = encoder->dev;
+	struct radeon_device *rdev = dev->dev_private;
+	uint32_t offset = to_radeon_encoder(encoder)->hdmi_offset;
+
+	uint32_t iec;
+
+	if (!offset)
+		return;
+
+	DRM_DEBUG("%s with %d channels, %d Hz sampling rate, %d bits per sample,\n",
+		 r600_hdmi_is_audio_buffer_filled(encoder) ? "playing" : "stopped",
+		channels, rate, bps);
+	DRM_DEBUG("0x%02X IEC60958 status bits and 0x%02X category code\n",
+		  (int)status_bits, (int)category_code);
+
+	iec = 0;
+	if (status_bits & AUDIO_STATUS_PROFESSIONAL)
+		iec |= 1 << 0;
+	if (status_bits & AUDIO_STATUS_NONAUDIO)
+		iec |= 1 << 1;
+	if (status_bits & AUDIO_STATUS_COPYRIGHT)
+		iec |= 1 << 2;
+	if (status_bits & AUDIO_STATUS_EMPHASIS)
+		iec |= 1 << 3;
+
+	iec |= category_code << 8;
+
+	switch (rate) {
+	case  32000: iec |= 0x3 << 24; break;
+	case  44100: iec |= 0x0 << 24; break;
+	case  88200: iec |= 0x8 << 24; break;
+	case 176400: iec |= 0xc << 24; break;
+	case  48000: iec |= 0x2 << 24; break;
+	case  96000: iec |= 0xa << 24; break;
+	case 192000: iec |= 0xe << 24; break;
+	}
+
+	WREG32(offset+R600_HDMI_IEC60958_1, iec);
+
+	iec = 0;
+	switch (bps) {
+	case 16: iec |= 0x2; break;
+	case 20: iec |= 0x3; break;
+	case 24: iec |= 0xb; break;
+	}
+	if (status_bits & AUDIO_STATUS_V)
+		iec |= 0x5 << 16;
+
+	WREG32_P(offset+R600_HDMI_IEC60958_2, iec, ~0x5000f);
+
+	/* 0x021 or 0x031 sets the audio frame length */
+	WREG32(offset+R600_HDMI_AUDIOCNTL, 0x31);
+	r600_hdmi_audioinfoframe(encoder, channels-1, 0, 0, 0, 0, 0, 0, 0);
+
+	r600_hdmi_audio_workaround(encoder);
+
+	/* update? reset? don't realy know */
+	WREG32_P(offset+R600_HDMI_CNTL, 0x04000000, ~0x04000000);
+}
+
+/*
+ * enable/disable the HDMI engine
+ */
+void r600_hdmi_enable(struct drm_encoder *encoder, int enable)
+{
+	struct drm_device *dev = encoder->dev;
+	struct radeon_device *rdev = dev->dev_private;
+	struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
+	uint32_t offset = to_radeon_encoder(encoder)->hdmi_offset;
+
+	if (!offset)
+		return;
+
+	DRM_DEBUG("%s HDMI interface @ 0x%04X\n", enable ? "Enabling" : "Disabling", offset);
+
+	/* some version of atombios ignore the enable HDMI flag
+	 * so enabling/disabling HDMI was moved here for TMDS1+2 */
+	switch (radeon_encoder->encoder_id) {
+	case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_TMDS1:
+		WREG32_P(AVIVO_TMDSA_CNTL, enable ? 0x4 : 0x0, ~0x4);
+		WREG32(offset+R600_HDMI_ENABLE, enable ? 0x101 : 0x0);
+		break;
+
+	case ENCODER_OBJECT_ID_INTERNAL_LVTM1:
+		WREG32_P(AVIVO_LVTMA_CNTL, enable ? 0x4 : 0x0, ~0x4);
+		WREG32(offset+R600_HDMI_ENABLE, enable ? 0x105 : 0x0);
+		break;
+
+	case ENCODER_OBJECT_ID_INTERNAL_UNIPHY:
+	case ENCODER_OBJECT_ID_INTERNAL_UNIPHY1:
+	case ENCODER_OBJECT_ID_INTERNAL_UNIPHY2:
+	case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_LVTMA:
+		/* This part is doubtfull in my opinion */
+		WREG32(offset+R600_HDMI_ENABLE, enable ? 0x110 : 0x0);
+		break;
+
+	default:
+		DRM_ERROR("unknown HDMI output type\n");
+		break;
+	}
+}
+
+/*
+ * determin at which register offset the HDMI encoder is
+ */
+void r600_hdmi_init(struct drm_encoder *encoder)
+{
+	struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
+
+	switch (radeon_encoder->encoder_id) {
+	case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_TMDS1:
+	case ENCODER_OBJECT_ID_INTERNAL_UNIPHY:
+	case ENCODER_OBJECT_ID_INTERNAL_UNIPHY1:
+		radeon_encoder->hdmi_offset = R600_HDMI_TMDS1;
+		break;
+
+	case ENCODER_OBJECT_ID_INTERNAL_LVTM1:
+		switch (r600_audio_tmds_index(encoder)) {
+		case 0:
+			radeon_encoder->hdmi_offset = R600_HDMI_TMDS1;
+			break;
+		case 1:
+			radeon_encoder->hdmi_offset = R600_HDMI_TMDS2;
+			break;
+		default:
+			radeon_encoder->hdmi_offset = 0;
+			break;
+		}
+	case ENCODER_OBJECT_ID_INTERNAL_UNIPHY2:
+		radeon_encoder->hdmi_offset = R600_HDMI_TMDS2;
+		break;
+
+	case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_LVTMA:
+		radeon_encoder->hdmi_offset = R600_HDMI_DIG;
+		break;
+
+	default:
+		radeon_encoder->hdmi_offset = 0;
+		break;
+	}
+
+	DRM_DEBUG("using HDMI engine at offset 0x%04X for encoder 0x%x\n",
+		  radeon_encoder->hdmi_offset, radeon_encoder->encoder_id);
+
+	/* TODO: make this configureable */
+	radeon_encoder->hdmi_audio_workaround = 0;
+}
diff --git a/drivers/gpu/drm/radeon/r600_reg.h b/drivers/gpu/drm/radeon/r600_reg.h
index e2d1f5f33f7e..d0e28ffdeda9 100644
--- a/drivers/gpu/drm/radeon/r600_reg.h
+++ b/drivers/gpu/drm/radeon/r600_reg.h
@@ -110,5 +110,79 @@
 #define R600_BIOS_6_SCRATCH               0x173c
 #define R600_BIOS_7_SCRATCH               0x1740
 
+/* Audio, these regs were reverse enginered,
+ * so the chance is high that the naming is wrong
+ * R6xx+ ??? */
+
+/* Audio clocks */
+#define R600_AUDIO_PLL1_MUL               0x0514
+#define R600_AUDIO_PLL1_DIV               0x0518
+#define R600_AUDIO_PLL2_MUL               0x0524
+#define R600_AUDIO_PLL2_DIV               0x0528
+#define R600_AUDIO_CLK_SRCSEL             0x0534
+
+/* Audio general */
+#define R600_AUDIO_ENABLE                 0x7300
+#define R600_AUDIO_TIMING                 0x7344
+
+/* Audio params */
+#define R600_AUDIO_VENDOR_ID              0x7380
+#define R600_AUDIO_REVISION_ID            0x7384
+#define R600_AUDIO_ROOT_NODE_COUNT        0x7388
+#define R600_AUDIO_NID1_NODE_COUNT        0x738c
+#define R600_AUDIO_NID1_TYPE              0x7390
+#define R600_AUDIO_SUPPORTED_SIZE_RATE    0x7394
+#define R600_AUDIO_SUPPORTED_CODEC        0x7398
+#define R600_AUDIO_SUPPORTED_POWER_STATES 0x739c
+#define R600_AUDIO_NID2_CAPS              0x73a0
+#define R600_AUDIO_NID3_CAPS              0x73a4
+#define R600_AUDIO_NID3_PIN_CAPS          0x73a8
+
+/* Audio conn list */
+#define R600_AUDIO_CONN_LIST_LEN          0x73ac
+#define R600_AUDIO_CONN_LIST              0x73b0
+
+/* Audio verbs */
+#define R600_AUDIO_RATE_BPS_CHANNEL       0x73c0
+#define R600_AUDIO_PLAYING                0x73c4
+#define R600_AUDIO_IMPLEMENTATION_ID      0x73c8
+#define R600_AUDIO_CONFIG_DEFAULT         0x73cc
+#define R600_AUDIO_PIN_SENSE              0x73d0
+#define R600_AUDIO_PIN_WIDGET_CNTL        0x73d4
+#define R600_AUDIO_STATUS_BITS            0x73d8
+
+/* HDMI base register addresses */
+#define R600_HDMI_TMDS1                   0x7400
+#define R600_HDMI_TMDS2                   0x7700
+#define R600_HDMI_DIG                     0x7800
+
+/* HDMI registers */
+#define R600_HDMI_ENABLE           0x00
+#define R600_HDMI_STATUS           0x04
+#define R600_HDMI_CNTL             0x08
+#define R600_HDMI_UNKNOWN_0        0x0C
+#define R600_HDMI_AUDIOCNTL        0x10
+#define R600_HDMI_VIDEOCNTL        0x14
+#define R600_HDMI_VERSION          0x18
+#define R600_HDMI_UNKNOWN_1        0x28
+#define R600_HDMI_VIDEOINFOFRAME_0 0x54
+#define R600_HDMI_VIDEOINFOFRAME_1 0x58
+#define R600_HDMI_VIDEOINFOFRAME_2 0x5c
+#define R600_HDMI_VIDEOINFOFRAME_3 0x60
+#define R600_HDMI_32kHz_CTS        0xac
+#define R600_HDMI_32kHz_N          0xb0
+#define R600_HDMI_44_1kHz_CTS      0xb4
+#define R600_HDMI_44_1kHz_N        0xb8
+#define R600_HDMI_48kHz_CTS        0xbc
+#define R600_HDMI_48kHz_N          0xc0
+#define R600_HDMI_AUDIOINFOFRAME_0 0xcc
+#define R600_HDMI_AUDIOINFOFRAME_1 0xd0
+#define R600_HDMI_IEC60958_1       0xd4
+#define R600_HDMI_IEC60958_2       0xd8
+#define R600_HDMI_UNKNOWN_2        0xdc
+#define R600_HDMI_AUDIO_DEBUG_0    0xe0
+#define R600_HDMI_AUDIO_DEBUG_1    0xe4
+#define R600_HDMI_AUDIO_DEBUG_2    0xe8
+#define R600_HDMI_AUDIO_DEBUG_3    0xec
 
 #endif
diff --git a/drivers/gpu/drm/radeon/r600d.h b/drivers/gpu/drm/radeon/r600d.h
index 27ab428b149b..05894edadab4 100644
--- a/drivers/gpu/drm/radeon/r600d.h
+++ b/drivers/gpu/drm/radeon/r600d.h
@@ -456,7 +456,215 @@
 #define         WAIT_2D_IDLECLEAN_bit                           (1 << 16)
 #define         WAIT_3D_IDLECLEAN_bit                           (1 << 17)
 
-
+#define IH_RB_CNTL                                        0x3e00
+#       define IH_RB_ENABLE                               (1 << 0)
+#       define IH_IB_SIZE(x)                              ((x) << 1) /* log2 */
+#       define IH_RB_FULL_DRAIN_ENABLE                    (1 << 6)
+#       define IH_WPTR_WRITEBACK_ENABLE                   (1 << 8)
+#       define IH_WPTR_WRITEBACK_TIMER(x)                 ((x) << 9) /* log2 */
+#       define IH_WPTR_OVERFLOW_ENABLE                    (1 << 16)
+#       define IH_WPTR_OVERFLOW_CLEAR                     (1 << 31)
+#define IH_RB_BASE                                        0x3e04
+#define IH_RB_RPTR                                        0x3e08
+#define IH_RB_WPTR                                        0x3e0c
+#       define RB_OVERFLOW                                (1 << 0)
+#       define WPTR_OFFSET_MASK                           0x3fffc
+#define IH_RB_WPTR_ADDR_HI                                0x3e10
+#define IH_RB_WPTR_ADDR_LO                                0x3e14
+#define IH_CNTL                                           0x3e18
+#       define ENABLE_INTR                                (1 << 0)
+#       define IH_MC_SWAP(x)                              ((x) << 2)
+#       define IH_MC_SWAP_NONE                            0
+#       define IH_MC_SWAP_16BIT                           1
+#       define IH_MC_SWAP_32BIT                           2
+#       define IH_MC_SWAP_64BIT                           3
+#       define RPTR_REARM                                 (1 << 4)
+#       define MC_WRREQ_CREDIT(x)                         ((x) << 15)
+#       define MC_WR_CLEAN_CNT(x)                         ((x) << 20)
+
+#define RLC_CNTL                                          0x3f00
+#       define RLC_ENABLE                                 (1 << 0)
+#define RLC_HB_BASE                                       0x3f10
+#define RLC_HB_CNTL                                       0x3f0c
+#define RLC_HB_RPTR                                       0x3f20
+#define RLC_HB_WPTR                                       0x3f1c
+#define RLC_HB_WPTR_LSB_ADDR                              0x3f14
+#define RLC_HB_WPTR_MSB_ADDR                              0x3f18
+#define RLC_MC_CNTL                                       0x3f44
+#define RLC_UCODE_CNTL                                    0x3f48
+#define RLC_UCODE_ADDR                                    0x3f2c
+#define RLC_UCODE_DATA                                    0x3f30
+
+#define SRBM_SOFT_RESET                                   0xe60
+#       define SOFT_RESET_RLC                             (1 << 13)
+
+#define CP_INT_CNTL                                       0xc124
+#       define CNTX_BUSY_INT_ENABLE                       (1 << 19)
+#       define CNTX_EMPTY_INT_ENABLE                      (1 << 20)
+#       define SCRATCH_INT_ENABLE                         (1 << 25)
+#       define TIME_STAMP_INT_ENABLE                      (1 << 26)
+#       define IB2_INT_ENABLE                             (1 << 29)
+#       define IB1_INT_ENABLE                             (1 << 30)
+#       define RB_INT_ENABLE                              (1 << 31)
+#define CP_INT_STATUS                                     0xc128
+#       define SCRATCH_INT_STAT                           (1 << 25)
+#       define TIME_STAMP_INT_STAT                        (1 << 26)
+#       define IB2_INT_STAT                               (1 << 29)
+#       define IB1_INT_STAT                               (1 << 30)
+#       define RB_INT_STAT                                (1 << 31)
+
+#define GRBM_INT_CNTL                                     0x8060
+#       define RDERR_INT_ENABLE                           (1 << 0)
+#       define WAIT_COUNT_TIMEOUT_INT_ENABLE              (1 << 1)
+#       define GUI_IDLE_INT_ENABLE                        (1 << 19)
+
+#define INTERRUPT_CNTL                                    0x5468
+#       define IH_DUMMY_RD_OVERRIDE                       (1 << 0)
+#       define IH_DUMMY_RD_EN                             (1 << 1)
+#       define IH_REQ_NONSNOOP_EN                         (1 << 3)
+#       define GEN_IH_INT_EN                              (1 << 8)
+#define INTERRUPT_CNTL2                                   0x546c
+
+#define D1MODE_VBLANK_STATUS                              0x6534
+#define D2MODE_VBLANK_STATUS                              0x6d34
+#       define DxMODE_VBLANK_OCCURRED                     (1 << 0)
+#       define DxMODE_VBLANK_ACK                          (1 << 4)
+#       define DxMODE_VBLANK_STAT                         (1 << 12)
+#       define DxMODE_VBLANK_INTERRUPT                    (1 << 16)
+#       define DxMODE_VBLANK_INTERRUPT_TYPE               (1 << 17)
+#define D1MODE_VLINE_STATUS                               0x653c
+#define D2MODE_VLINE_STATUS                               0x6d3c
+#       define DxMODE_VLINE_OCCURRED                      (1 << 0)
+#       define DxMODE_VLINE_ACK                           (1 << 4)
+#       define DxMODE_VLINE_STAT                          (1 << 12)
+#       define DxMODE_VLINE_INTERRUPT                     (1 << 16)
+#       define DxMODE_VLINE_INTERRUPT_TYPE                (1 << 17)
+#define DxMODE_INT_MASK                                   0x6540
+#       define D1MODE_VBLANK_INT_MASK                     (1 << 0)
+#       define D1MODE_VLINE_INT_MASK                      (1 << 4)
+#       define D2MODE_VBLANK_INT_MASK                     (1 << 8)
+#       define D2MODE_VLINE_INT_MASK                      (1 << 12)
+#define DCE3_DISP_INTERRUPT_STATUS                        0x7ddc
+#       define DC_HPD1_INTERRUPT                          (1 << 18)
+#       define DC_HPD2_INTERRUPT                          (1 << 19)
+#define DISP_INTERRUPT_STATUS                             0x7edc
+#       define LB_D1_VLINE_INTERRUPT                      (1 << 2)
+#       define LB_D2_VLINE_INTERRUPT                      (1 << 3)
+#       define LB_D1_VBLANK_INTERRUPT                     (1 << 4)
+#       define LB_D2_VBLANK_INTERRUPT                     (1 << 5)
+#       define DACA_AUTODETECT_INTERRUPT                  (1 << 16)
+#       define DACB_AUTODETECT_INTERRUPT                  (1 << 17)
+#       define DC_HOT_PLUG_DETECT1_INTERRUPT              (1 << 18)
+#       define DC_HOT_PLUG_DETECT2_INTERRUPT              (1 << 19)
+#       define DC_I2C_SW_DONE_INTERRUPT                   (1 << 20)
+#       define DC_I2C_HW_DONE_INTERRUPT                   (1 << 21)
+#define DISP_INTERRUPT_STATUS_CONTINUE                    0x7ee8
+#define DCE3_DISP_INTERRUPT_STATUS_CONTINUE               0x7de8
+#       define DC_HPD4_INTERRUPT                          (1 << 14)
+#       define DC_HPD4_RX_INTERRUPT                       (1 << 15)
+#       define DC_HPD3_INTERRUPT                          (1 << 28)
+#       define DC_HPD1_RX_INTERRUPT                       (1 << 29)
+#       define DC_HPD2_RX_INTERRUPT                       (1 << 30)
+#define DCE3_DISP_INTERRUPT_STATUS_CONTINUE2              0x7dec
+#       define DC_HPD3_RX_INTERRUPT                       (1 << 0)
+#       define DIGA_DP_VID_STREAM_DISABLE_INTERRUPT       (1 << 1)
+#       define DIGA_DP_STEER_FIFO_OVERFLOW_INTERRUPT      (1 << 2)
+#       define DIGB_DP_VID_STREAM_DISABLE_INTERRUPT       (1 << 3)
+#       define DIGB_DP_STEER_FIFO_OVERFLOW_INTERRUPT      (1 << 4)
+#       define AUX1_SW_DONE_INTERRUPT                     (1 << 5)
+#       define AUX1_LS_DONE_INTERRUPT                     (1 << 6)
+#       define AUX2_SW_DONE_INTERRUPT                     (1 << 7)
+#       define AUX2_LS_DONE_INTERRUPT                     (1 << 8)
+#       define AUX3_SW_DONE_INTERRUPT                     (1 << 9)
+#       define AUX3_LS_DONE_INTERRUPT                     (1 << 10)
+#       define AUX4_SW_DONE_INTERRUPT                     (1 << 11)
+#       define AUX4_LS_DONE_INTERRUPT                     (1 << 12)
+#       define DIGA_DP_FAST_TRAINING_COMPLETE_INTERRUPT   (1 << 13)
+#       define DIGB_DP_FAST_TRAINING_COMPLETE_INTERRUPT   (1 << 14)
+/* DCE 3.2 */
+#       define AUX5_SW_DONE_INTERRUPT                     (1 << 15)
+#       define AUX5_LS_DONE_INTERRUPT                     (1 << 16)
+#       define AUX6_SW_DONE_INTERRUPT                     (1 << 17)
+#       define AUX6_LS_DONE_INTERRUPT                     (1 << 18)
+#       define DC_HPD5_INTERRUPT                          (1 << 19)
+#       define DC_HPD5_RX_INTERRUPT                       (1 << 20)
+#       define DC_HPD6_INTERRUPT                          (1 << 21)
+#       define DC_HPD6_RX_INTERRUPT                       (1 << 22)
+
+#define DACA_AUTO_DETECT_CONTROL                          0x7828
+#define DACB_AUTO_DETECT_CONTROL                          0x7a28
+#define DCE3_DACA_AUTO_DETECT_CONTROL                     0x7028
+#define DCE3_DACB_AUTO_DETECT_CONTROL                     0x7128
+#       define DACx_AUTODETECT_MODE(x)                    ((x) << 0)
+#       define DACx_AUTODETECT_MODE_NONE                  0
+#       define DACx_AUTODETECT_MODE_CONNECT               1
+#       define DACx_AUTODETECT_MODE_DISCONNECT            2
+#       define DACx_AUTODETECT_FRAME_TIME_COUNTER(x)      ((x) << 8)
+/* bit 18 = R/C, 17 = G/Y, 16 = B/Comp */
+#       define DACx_AUTODETECT_CHECK_MASK(x)              ((x) << 16)
+
+#define DCE3_DACA_AUTODETECT_INT_CONTROL                  0x7038
+#define DCE3_DACB_AUTODETECT_INT_CONTROL                  0x7138
+#define DACA_AUTODETECT_INT_CONTROL                       0x7838
+#define DACB_AUTODETECT_INT_CONTROL                       0x7a38
+#       define DACx_AUTODETECT_ACK                        (1 << 0)
+#       define DACx_AUTODETECT_INT_ENABLE                 (1 << 16)
+
+#define DC_HOT_PLUG_DETECT1_CONTROL                       0x7d00
+#define DC_HOT_PLUG_DETECT2_CONTROL                       0x7d10
+#define DC_HOT_PLUG_DETECT3_CONTROL                       0x7d24
+#       define DC_HOT_PLUG_DETECTx_EN                     (1 << 0)
+
+#define DC_HOT_PLUG_DETECT1_INT_STATUS                    0x7d04
+#define DC_HOT_PLUG_DETECT2_INT_STATUS                    0x7d14
+#define DC_HOT_PLUG_DETECT3_INT_STATUS                    0x7d28
+#       define DC_HOT_PLUG_DETECTx_INT_STATUS             (1 << 0)
+#       define DC_HOT_PLUG_DETECTx_SENSE                  (1 << 1)
+
+/* DCE 3.0 */
+#define DC_HPD1_INT_STATUS                                0x7d00
+#define DC_HPD2_INT_STATUS                                0x7d0c
+#define DC_HPD3_INT_STATUS                                0x7d18
+#define DC_HPD4_INT_STATUS                                0x7d24
+/* DCE 3.2 */
+#define DC_HPD5_INT_STATUS                                0x7dc0
+#define DC_HPD6_INT_STATUS                                0x7df4
+#       define DC_HPDx_INT_STATUS                         (1 << 0)
+#       define DC_HPDx_SENSE                              (1 << 1)
+#       define DC_HPDx_RX_INT_STATUS                      (1 << 8)
+
+#define DC_HOT_PLUG_DETECT1_INT_CONTROL                   0x7d08
+#define DC_HOT_PLUG_DETECT2_INT_CONTROL                   0x7d18
+#define DC_HOT_PLUG_DETECT3_INT_CONTROL                   0x7d2c
+#       define DC_HOT_PLUG_DETECTx_INT_ACK                (1 << 0)
+#       define DC_HOT_PLUG_DETECTx_INT_POLARITY           (1 << 8)
+#       define DC_HOT_PLUG_DETECTx_INT_EN                 (1 << 16)
+/* DCE 3.0 */
+#define DC_HPD1_INT_CONTROL                               0x7d04
+#define DC_HPD2_INT_CONTROL                               0x7d10
+#define DC_HPD3_INT_CONTROL                               0x7d1c
+#define DC_HPD4_INT_CONTROL                               0x7d28
+/* DCE 3.2 */
+#define DC_HPD5_INT_CONTROL                               0x7dc4
+#define DC_HPD6_INT_CONTROL                               0x7df8
+#       define DC_HPDx_INT_ACK                            (1 << 0)
+#       define DC_HPDx_INT_POLARITY                       (1 << 8)
+#       define DC_HPDx_INT_EN                             (1 << 16)
+#       define DC_HPDx_RX_INT_ACK                         (1 << 20)
+#       define DC_HPDx_RX_INT_EN                          (1 << 24)
+
+/* DCE 3.0 */
+#define DC_HPD1_CONTROL                                   0x7d08
+#define DC_HPD2_CONTROL                                   0x7d14
+#define DC_HPD3_CONTROL                                   0x7d20
+#define DC_HPD4_CONTROL                                   0x7d2c
+/* DCE 3.2 */
+#define DC_HPD5_CONTROL                                   0x7dc8
+#define DC_HPD6_CONTROL                                   0x7dfc
+#       define DC_HPDx_CONNECTION_TIMER(x)                ((x) << 0)
+#       define DC_HPDx_RX_INT_TIMER(x)                    ((x) << 16)
+/* DCE 3.2 */
+#       define DC_HPDx_EN                                 (1 << 28)
 
 /*
  * PM4
@@ -500,7 +708,6 @@
 #define	PACKET3_WAIT_REG_MEM				0x3C
 #define	PACKET3_MEM_WRITE				0x3D
 #define	PACKET3_INDIRECT_BUFFER				0x32
-#define	PACKET3_CP_INTERRUPT				0x40
 #define	PACKET3_SURFACE_SYNC				0x43
 #              define PACKET3_CB0_DEST_BASE_ENA    (1 << 6)
 #              define PACKET3_TC_ACTION_ENA        (1 << 23)
@@ -674,4 +881,5 @@
 #define		S_000E60_SOFT_RESET_TSC(x)		(((x) & 1) << 16)
 #define		S_000E60_SOFT_RESET_VMC(x)		(((x) & 1) << 17)
 
+#define R_005480_HDP_MEM_COHERENCY_FLUSH_CNTL		0x5480
 #endif
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index 224506a2f7b1..eb5f99b9469d 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -28,8 +28,6 @@
 #ifndef __RADEON_H__
 #define __RADEON_H__
 
-#include "radeon_object.h"
-
 /* TODO: Here are things that needs to be done :
  *	- surface allocator & initializer : (bit like scratch reg) should
  *	  initialize HDP_ stuff on RS600, R600, R700 hw, well anythings
@@ -67,6 +65,11 @@
 #include <linux/list.h>
 #include <linux/kref.h>
 
+#include <ttm/ttm_bo_api.h>
+#include <ttm/ttm_bo_driver.h>
+#include <ttm/ttm_placement.h>
+#include <ttm/ttm_module.h>
+
 #include "radeon_family.h"
 #include "radeon_mode.h"
 #include "radeon_reg.h"
@@ -85,6 +88,8 @@ extern int radeon_benchmarking;
 extern int radeon_testing;
 extern int radeon_connector_table;
 extern int radeon_tv;
+extern int radeon_new_pll;
+extern int radeon_audio;
 
 /*
  * Copy from radeon_drv.h so we don't have to include both and have conflicting
@@ -157,6 +162,7 @@ struct radeon_fence_driver {
 	struct list_head		created;
 	struct list_head		emited;
 	struct list_head		signaled;
+	bool				initialized;
 };
 
 struct radeon_fence {
@@ -186,76 +192,63 @@ void radeon_fence_unref(struct radeon_fence **fence);
  * Tiling registers
  */
 struct radeon_surface_reg {
-	struct radeon_object *robj;
+	struct radeon_bo *bo;
 };
 
 #define RADEON_GEM_MAX_SURFACES 8
 
 /*
- * Radeon buffer.
+ * TTM.
  */
-struct radeon_object;
+struct radeon_mman {
+	struct ttm_bo_global_ref        bo_global_ref;
+	struct ttm_global_reference	mem_global_ref;
+	struct ttm_bo_device		bdev;
+	bool				mem_global_referenced;
+	bool				initialized;
+};
+
+struct radeon_bo {
+	/* Protected by gem.mutex */
+	struct list_head		list;
+	/* Protected by tbo.reserved */
+	u32				placements[3];
+	struct ttm_placement		placement;
+	struct ttm_buffer_object	tbo;
+	struct ttm_bo_kmap_obj		kmap;
+	unsigned			pin_count;
+	void				*kptr;
+	u32				tiling_flags;
+	u32				pitch;
+	int				surface_reg;
+	/* Constant after initialization */
+	struct radeon_device		*rdev;
+	struct drm_gem_object		*gobj;
+};
 
-struct radeon_object_list {
+struct radeon_bo_list {
 	struct list_head	list;
-	struct radeon_object	*robj;
+	struct radeon_bo	*bo;
 	uint64_t		gpu_offset;
 	unsigned		rdomain;
 	unsigned		wdomain;
-	uint32_t                tiling_flags;
+	u32			tiling_flags;
 };
 
-int radeon_object_init(struct radeon_device *rdev);
-void radeon_object_fini(struct radeon_device *rdev);
-int radeon_object_create(struct radeon_device *rdev,
-			 struct drm_gem_object *gobj,
-			 unsigned long size,
-			 bool kernel,
-			 uint32_t domain,
-			 bool interruptible,
-			 struct radeon_object **robj_ptr);
-int radeon_object_kmap(struct radeon_object *robj, void **ptr);
-void radeon_object_kunmap(struct radeon_object *robj);
-void radeon_object_unref(struct radeon_object **robj);
-int radeon_object_pin(struct radeon_object *robj, uint32_t domain,
-		      uint64_t *gpu_addr);
-void radeon_object_unpin(struct radeon_object *robj);
-int radeon_object_wait(struct radeon_object *robj);
-int radeon_object_busy_domain(struct radeon_object *robj, uint32_t *cur_placement);
-int radeon_object_evict_vram(struct radeon_device *rdev);
-int radeon_object_mmap(struct radeon_object *robj, uint64_t *offset);
-void radeon_object_force_delete(struct radeon_device *rdev);
-void radeon_object_list_add_object(struct radeon_object_list *lobj,
-				   struct list_head *head);
-int radeon_object_list_validate(struct list_head *head, void *fence);
-void radeon_object_list_unvalidate(struct list_head *head);
-void radeon_object_list_clean(struct list_head *head);
-int radeon_object_fbdev_mmap(struct radeon_object *robj,
-			     struct vm_area_struct *vma);
-unsigned long radeon_object_size(struct radeon_object *robj);
-void radeon_object_clear_surface_reg(struct radeon_object *robj);
-int radeon_object_check_tiling(struct radeon_object *robj, bool has_moved,
-			       bool force_drop);
-void radeon_object_set_tiling_flags(struct radeon_object *robj,
-				    uint32_t tiling_flags, uint32_t pitch);
-void radeon_object_get_tiling_flags(struct radeon_object *robj, uint32_t *tiling_flags, uint32_t *pitch);
-void radeon_bo_move_notify(struct ttm_buffer_object *bo,
-			   struct ttm_mem_reg *mem);
-void radeon_bo_fault_reserve_notify(struct ttm_buffer_object *bo);
 /*
  * GEM objects.
  */
 struct radeon_gem {
+	struct mutex		mutex;
 	struct list_head	objects;
 };
 
 int radeon_gem_init(struct radeon_device *rdev);
 void radeon_gem_fini(struct radeon_device *rdev);
 int radeon_gem_object_create(struct radeon_device *rdev, int size,
-			     int alignment, int initial_domain,
-			     bool discardable, bool kernel,
-			     bool interruptible,
-			     struct drm_gem_object **obj);
+				int alignment, int initial_domain,
+				bool discardable, bool kernel,
+				struct drm_gem_object **obj);
 int radeon_gem_object_pin(struct drm_gem_object *obj, uint32_t pin_domain,
 			  uint64_t *gpu_addr);
 void radeon_gem_object_unpin(struct drm_gem_object *obj);
@@ -271,7 +264,7 @@ struct radeon_gart_table_ram {
 };
 
 struct radeon_gart_table_vram {
-	struct radeon_object		*robj;
+	struct radeon_bo		*robj;
 	volatile uint32_t		*ptr;
 };
 
@@ -326,10 +319,12 @@ struct radeon_mc {
 	u64			real_vram_size;
 	int			vram_mtrr;
 	bool			vram_is_ddr;
+	bool                    igp_sideport_enabled;
 };
 
 int radeon_mc_setup(struct radeon_device *rdev);
-
+bool radeon_combios_sideport_present(struct radeon_device *rdev);
+bool radeon_atombios_sideport_present(struct radeon_device *rdev);
 
 /*
  * GPU scratch registers structures, functions & helpers
@@ -352,11 +347,16 @@ struct radeon_irq {
 	bool		sw_int;
 	/* FIXME: use a define max crtc rather than hardcode it */
 	bool		crtc_vblank_int[2];
+	/* FIXME: use defines for max hpd/dacs */
+	bool            hpd[6];
+	spinlock_t sw_lock;
+	int sw_refcount;
 };
 
 int radeon_irq_kms_init(struct radeon_device *rdev);
 void radeon_irq_kms_fini(struct radeon_device *rdev);
-
+void radeon_irq_kms_sw_irq_get(struct radeon_device *rdev);
+void radeon_irq_kms_sw_irq_put(struct radeon_device *rdev);
 
 /*
  * CP & ring.
@@ -376,7 +376,7 @@ struct radeon_ib {
  */
 struct radeon_ib_pool {
 	struct mutex		mutex;
-	struct radeon_object	*robj;
+	struct radeon_bo	*robj;
 	struct list_head	scheduled_ibs;
 	struct radeon_ib	ibs[RADEON_IB_POOL_SIZE];
 	bool			ready;
@@ -384,7 +384,7 @@ struct radeon_ib_pool {
 };
 
 struct radeon_cp {
-	struct radeon_object	*ring_obj;
+	struct radeon_bo	*ring_obj;
 	volatile uint32_t	*ring;
 	unsigned		rptr;
 	unsigned		wptr;
@@ -399,8 +399,25 @@ struct radeon_cp {
 	bool			ready;
 };
 
+/*
+ * R6xx+ IH ring
+ */
+struct r600_ih {
+	struct radeon_bo	*ring_obj;
+	volatile uint32_t	*ring;
+	unsigned		rptr;
+	unsigned		wptr;
+	unsigned		wptr_old;
+	unsigned		ring_size;
+	uint64_t		gpu_addr;
+	uint32_t		align_mask;
+	uint32_t		ptr_mask;
+	spinlock_t              lock;
+	bool                    enabled;
+};
+
 struct r600_blit {
-	struct radeon_object	*shader_obj;
+	struct radeon_bo	*shader_obj;
 	u64 shader_gpu_addr;
 	u32 vs_offset, ps_offset;
 	u32 state_offset;
@@ -430,8 +447,8 @@ void radeon_ring_fini(struct radeon_device *rdev);
  */
 struct radeon_cs_reloc {
 	struct drm_gem_object		*gobj;
-	struct radeon_object		*robj;
-	struct radeon_object_list	lobj;
+	struct radeon_bo		*robj;
+	struct radeon_bo_list		lobj;
 	uint32_t			handle;
 	uint32_t			flags;
 };
@@ -527,7 +544,7 @@ void radeon_agp_fini(struct radeon_device *rdev);
  * Writeback
  */
 struct radeon_wb {
-	struct radeon_object	*wb_obj;
+	struct radeon_bo	*wb_obj;
 	volatile uint32_t	*wb;
 	uint64_t		gpu_addr;
 };
@@ -639,6 +656,10 @@ struct radeon_asic {
 			       uint32_t offset, uint32_t obj_size);
 	int (*clear_surface_reg)(struct radeon_device *rdev, int reg);
 	void (*bandwidth_update)(struct radeon_device *rdev);
+	void (*hpd_init)(struct radeon_device *rdev);
+	void (*hpd_fini)(struct radeon_device *rdev);
+	bool (*hpd_sense)(struct radeon_device *rdev, enum radeon_hpd_id hpd);
+	void (*hpd_set_polarity)(struct radeon_device *rdev, enum radeon_hpd_id hpd);
 };
 
 /*
@@ -647,11 +668,14 @@ struct radeon_asic {
 struct r100_asic {
 	const unsigned	*reg_safe_bm;
 	unsigned	reg_safe_bm_size;
+	u32		hdp_cntl;
 };
 
 struct r300_asic {
 	const unsigned	*reg_safe_bm;
 	unsigned	reg_safe_bm_size;
+	u32		resync_scratch;
+	u32		hdp_cntl;
 };
 
 struct r600_asic {
@@ -751,9 +775,9 @@ struct radeon_device {
 	uint8_t				*bios;
 	bool				is_atom_bios;
 	uint16_t			bios_header_start;
-	struct radeon_object		*stollen_vga_memory;
+	struct radeon_bo		*stollen_vga_memory;
 	struct fb_info			*fbdev_info;
-	struct radeon_object		*fbdev_robj;
+	struct radeon_bo		*fbdev_rbo;
 	struct radeon_framebuffer	*fbdev_rfb;
 	/* Register mmio */
 	resource_size_t			rmmio_base;
@@ -791,8 +815,20 @@ struct radeon_device {
 	struct radeon_surface_reg surface_regs[RADEON_GEM_MAX_SURFACES];
 	const struct firmware *me_fw;	/* all family ME firmware */
 	const struct firmware *pfp_fw;	/* r6/700 PFP firmware */
+	const struct firmware *rlc_fw;	/* r6/700 RLC firmware */
 	struct r600_blit r600_blit;
 	int msi_enabled; /* msi enabled */
+	struct r600_ih ih; /* r6/700 interrupt ring */
+	struct workqueue_struct *wq;
+	struct work_struct hotplug_work;
+
+	/* audio stuff */
+	struct timer_list	audio_timer;
+	int			audio_channels;
+	int			audio_rate;
+	int			audio_bits_per_sample;
+	uint8_t			audio_status_bits;
+	uint8_t			audio_category_code;
 };
 
 int radeon_device_init(struct radeon_device *rdev,
@@ -829,6 +865,10 @@ static inline void r100_mm_wreg(struct radeon_device *rdev, uint32_t reg, uint32
 	}
 }
 
+/*
+ * Cast helper
+ */
+#define to_radeon_fence(p) ((struct radeon_fence *)(p))
 
 /*
  * Registers read & write functions.
@@ -965,18 +1005,23 @@ static inline void radeon_ring_write(struct radeon_device *rdev, uint32_t v)
 #define radeon_get_engine_clock(rdev) (rdev)->asic->get_engine_clock((rdev))
 #define radeon_set_engine_clock(rdev, e) (rdev)->asic->set_engine_clock((rdev), (e))
 #define radeon_get_memory_clock(rdev) (rdev)->asic->get_memory_clock((rdev))
-#define radeon_set_memory_clock(rdev, e) (rdev)->asic->set_engine_clock((rdev), (e))
+#define radeon_set_memory_clock(rdev, e) (rdev)->asic->set_memory_clock((rdev), (e))
 #define radeon_set_pcie_lanes(rdev, l) (rdev)->asic->set_pcie_lanes((rdev), (l))
 #define radeon_set_clock_gating(rdev, e) (rdev)->asic->set_clock_gating((rdev), (e))
 #define radeon_set_surface_reg(rdev, r, f, p, o, s) ((rdev)->asic->set_surface_reg((rdev), (r), (f), (p), (o), (s)))
 #define radeon_clear_surface_reg(rdev, r) ((rdev)->asic->clear_surface_reg((rdev), (r)))
 #define radeon_bandwidth_update(rdev) (rdev)->asic->bandwidth_update((rdev))
+#define radeon_hpd_init(rdev) (rdev)->asic->hpd_init((rdev))
+#define radeon_hpd_fini(rdev) (rdev)->asic->hpd_fini((rdev))
+#define radeon_hpd_sense(rdev, hpd) (rdev)->asic->hpd_sense((rdev), (hpd))
+#define radeon_hpd_set_polarity(rdev, hpd) (rdev)->asic->hpd_set_polarity((rdev), (hpd))
 
 /* Common functions */
 extern int radeon_gart_table_vram_pin(struct radeon_device *rdev);
 extern int radeon_modeset_init(struct radeon_device *rdev);
 extern void radeon_modeset_fini(struct radeon_device *rdev);
 extern bool radeon_card_posted(struct radeon_device *rdev);
+extern bool radeon_boot_test_post_card(struct radeon_device *rdev);
 extern int radeon_clocks_init(struct radeon_device *rdev);
 extern void radeon_clocks_fini(struct radeon_device *rdev);
 extern void radeon_scratch_init(struct radeon_device *rdev);
@@ -984,6 +1029,8 @@ extern void radeon_surface_init(struct radeon_device *rdev);
 extern int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data);
 extern void radeon_legacy_set_clock_gating(struct radeon_device *rdev, int enable);
 extern void radeon_atom_set_clock_gating(struct radeon_device *rdev, int enable);
+extern void radeon_ttm_placement_from_domain(struct radeon_bo *rbo, u32 domain);
+extern bool radeon_ttm_bo_is_radeon_bo(struct ttm_buffer_object *bo);
 
 /* r100,rv100,rs100,rv200,rs200,r200,rv250,rs300,rv280 */
 struct r100_mc_save {
@@ -1021,7 +1068,7 @@ extern int r100_cp_reset(struct radeon_device *rdev);
 extern void r100_vga_render_disable(struct radeon_device *rdev);
 extern int r100_cs_track_check_pkt3_indx_buffer(struct radeon_cs_parser *p,
 						struct radeon_cs_packet *pkt,
-						struct radeon_object *robj);
+						struct radeon_bo *robj);
 extern int r100_cs_parse_packet0(struct radeon_cs_parser *p,
 				struct radeon_cs_packet *pkt,
 				const unsigned *auth, unsigned n,
@@ -1029,6 +1076,8 @@ extern int r100_cs_parse_packet0(struct radeon_cs_parser *p,
 extern int r100_cs_packet_parse(struct radeon_cs_parser *p,
 				struct radeon_cs_packet *pkt,
 				unsigned idx);
+extern void r100_enable_bm(struct radeon_device *rdev);
+extern void r100_set_common_regs(struct radeon_device *rdev);
 
 /* rv200,rv250,rv280 */
 extern void r200_set_safe_registers(struct radeon_device *rdev);
@@ -1104,7 +1153,29 @@ extern void r600_wb_disable(struct radeon_device *rdev);
 extern void r600_scratch_init(struct radeon_device *rdev);
 extern int r600_blit_init(struct radeon_device *rdev);
 extern void r600_blit_fini(struct radeon_device *rdev);
-extern int r600_cp_init_microcode(struct radeon_device *rdev);
+extern int r600_init_microcode(struct radeon_device *rdev);
 extern int r600_gpu_reset(struct radeon_device *rdev);
+/* r600 irq */
+extern int r600_irq_init(struct radeon_device *rdev);
+extern void r600_irq_fini(struct radeon_device *rdev);
+extern void r600_ih_ring_init(struct radeon_device *rdev, unsigned ring_size);
+extern int r600_irq_set(struct radeon_device *rdev);
+
+extern int r600_audio_init(struct radeon_device *rdev);
+extern int r600_audio_tmds_index(struct drm_encoder *encoder);
+extern void r600_audio_set_clock(struct drm_encoder *encoder, int clock);
+extern void r600_audio_fini(struct radeon_device *rdev);
+extern void r600_hdmi_init(struct drm_encoder *encoder);
+extern void r600_hdmi_enable(struct drm_encoder *encoder, int enable);
+extern void r600_hdmi_setmode(struct drm_encoder *encoder, struct drm_display_mode *mode);
+extern int r600_hdmi_buffer_status_changed(struct drm_encoder *encoder);
+extern void r600_hdmi_update_audio_settings(struct drm_encoder *encoder,
+					    int channels,
+					    int rate,
+					    int bps,
+					    uint8_t status_bits,
+					    uint8_t category_code);
+
+#include "radeon_object.h"
 
 #endif
diff --git a/drivers/gpu/drm/radeon/radeon_agp.c b/drivers/gpu/drm/radeon/radeon_agp.c
index 54bf49a6d676..220f454ea9fa 100644
--- a/drivers/gpu/drm/radeon/radeon_agp.c
+++ b/drivers/gpu/drm/radeon/radeon_agp.c
@@ -252,10 +252,8 @@ void radeon_agp_resume(struct radeon_device *rdev)
 void radeon_agp_fini(struct radeon_device *rdev)
 {
 #if __OS_HAS_AGP
-	if (rdev->flags & RADEON_IS_AGP) {
-		if (rdev->ddev->agp && rdev->ddev->agp->acquired) {
-			drm_agp_release(rdev->ddev);
-		}
+	if (rdev->ddev->agp && rdev->ddev->agp->acquired) {
+		drm_agp_release(rdev->ddev);
 	}
 #endif
 }
diff --git a/drivers/gpu/drm/radeon/radeon_asic.h b/drivers/gpu/drm/radeon/radeon_asic.h
index c18fbee387d7..f2fbd2e4e9df 100644
--- a/drivers/gpu/drm/radeon/radeon_asic.h
+++ b/drivers/gpu/drm/radeon/radeon_asic.h
@@ -33,6 +33,7 @@
  */
 uint32_t radeon_legacy_get_engine_clock(struct radeon_device *rdev);
 void radeon_legacy_set_engine_clock(struct radeon_device *rdev, uint32_t eng_clock);
+uint32_t radeon_legacy_get_memory_clock(struct radeon_device *rdev);
 void radeon_legacy_set_clock_gating(struct radeon_device *rdev, int enable);
 
 uint32_t radeon_atom_get_engine_clock(struct radeon_device *rdev);
@@ -76,6 +77,11 @@ int r100_clear_surface_reg(struct radeon_device *rdev, int reg);
 void r100_bandwidth_update(struct radeon_device *rdev);
 void r100_ring_ib_execute(struct radeon_device *rdev, struct radeon_ib *ib);
 int r100_ring_test(struct radeon_device *rdev);
+void r100_hpd_init(struct radeon_device *rdev);
+void r100_hpd_fini(struct radeon_device *rdev);
+bool r100_hpd_sense(struct radeon_device *rdev, enum radeon_hpd_id hpd);
+void r100_hpd_set_polarity(struct radeon_device *rdev,
+			   enum radeon_hpd_id hpd);
 
 static struct radeon_asic r100_asic = {
 	.init = &r100_init,
@@ -100,13 +106,17 @@ static struct radeon_asic r100_asic = {
 	.copy = &r100_copy_blit,
 	.get_engine_clock = &radeon_legacy_get_engine_clock,
 	.set_engine_clock = &radeon_legacy_set_engine_clock,
-	.get_memory_clock = NULL,
+	.get_memory_clock = &radeon_legacy_get_memory_clock,
 	.set_memory_clock = NULL,
 	.set_pcie_lanes = NULL,
 	.set_clock_gating = &radeon_legacy_set_clock_gating,
 	.set_surface_reg = r100_set_surface_reg,
 	.clear_surface_reg = r100_clear_surface_reg,
 	.bandwidth_update = &r100_bandwidth_update,
+	.hpd_init = &r100_hpd_init,
+	.hpd_fini = &r100_hpd_fini,
+	.hpd_sense = &r100_hpd_sense,
+	.hpd_set_polarity = &r100_hpd_set_polarity,
 };
 
 
@@ -155,13 +165,17 @@ static struct radeon_asic r300_asic = {
 	.copy = &r100_copy_blit,
 	.get_engine_clock = &radeon_legacy_get_engine_clock,
 	.set_engine_clock = &radeon_legacy_set_engine_clock,
-	.get_memory_clock = NULL,
+	.get_memory_clock = &radeon_legacy_get_memory_clock,
 	.set_memory_clock = NULL,
 	.set_pcie_lanes = &rv370_set_pcie_lanes,
 	.set_clock_gating = &radeon_legacy_set_clock_gating,
 	.set_surface_reg = r100_set_surface_reg,
 	.clear_surface_reg = r100_clear_surface_reg,
 	.bandwidth_update = &r100_bandwidth_update,
+	.hpd_init = &r100_hpd_init,
+	.hpd_fini = &r100_hpd_fini,
+	.hpd_sense = &r100_hpd_sense,
+	.hpd_set_polarity = &r100_hpd_set_polarity,
 };
 
 /*
@@ -201,6 +215,10 @@ static struct radeon_asic r420_asic = {
 	.set_surface_reg = r100_set_surface_reg,
 	.clear_surface_reg = r100_clear_surface_reg,
 	.bandwidth_update = &r100_bandwidth_update,
+	.hpd_init = &r100_hpd_init,
+	.hpd_fini = &r100_hpd_fini,
+	.hpd_sense = &r100_hpd_sense,
+	.hpd_set_polarity = &r100_hpd_set_polarity,
 };
 
 
@@ -238,13 +256,17 @@ static struct radeon_asic rs400_asic = {
 	.copy = &r100_copy_blit,
 	.get_engine_clock = &radeon_legacy_get_engine_clock,
 	.set_engine_clock = &radeon_legacy_set_engine_clock,
-	.get_memory_clock = NULL,
+	.get_memory_clock = &radeon_legacy_get_memory_clock,
 	.set_memory_clock = NULL,
 	.set_pcie_lanes = NULL,
 	.set_clock_gating = &radeon_legacy_set_clock_gating,
 	.set_surface_reg = r100_set_surface_reg,
 	.clear_surface_reg = r100_clear_surface_reg,
 	.bandwidth_update = &r100_bandwidth_update,
+	.hpd_init = &r100_hpd_init,
+	.hpd_fini = &r100_hpd_fini,
+	.hpd_sense = &r100_hpd_sense,
+	.hpd_set_polarity = &r100_hpd_set_polarity,
 };
 
 
@@ -263,6 +285,12 @@ int rs600_gart_set_page(struct radeon_device *rdev, int i, uint64_t addr);
 uint32_t rs600_mc_rreg(struct radeon_device *rdev, uint32_t reg);
 void rs600_mc_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v);
 void rs600_bandwidth_update(struct radeon_device *rdev);
+void rs600_hpd_init(struct radeon_device *rdev);
+void rs600_hpd_fini(struct radeon_device *rdev);
+bool rs600_hpd_sense(struct radeon_device *rdev, enum radeon_hpd_id hpd);
+void rs600_hpd_set_polarity(struct radeon_device *rdev,
+			    enum radeon_hpd_id hpd);
+
 static struct radeon_asic rs600_asic = {
 	.init = &rs600_init,
 	.fini = &rs600_fini,
@@ -291,6 +319,10 @@ static struct radeon_asic rs600_asic = {
 	.set_pcie_lanes = NULL,
 	.set_clock_gating = &radeon_atom_set_clock_gating,
 	.bandwidth_update = &rs600_bandwidth_update,
+	.hpd_init = &rs600_hpd_init,
+	.hpd_fini = &rs600_hpd_fini,
+	.hpd_sense = &rs600_hpd_sense,
+	.hpd_set_polarity = &rs600_hpd_set_polarity,
 };
 
 
@@ -334,6 +366,10 @@ static struct radeon_asic rs690_asic = {
 	.set_surface_reg = r100_set_surface_reg,
 	.clear_surface_reg = r100_clear_surface_reg,
 	.bandwidth_update = &rs690_bandwidth_update,
+	.hpd_init = &rs600_hpd_init,
+	.hpd_fini = &rs600_hpd_fini,
+	.hpd_sense = &rs600_hpd_sense,
+	.hpd_set_polarity = &rs600_hpd_set_polarity,
 };
 
 
@@ -381,6 +417,10 @@ static struct radeon_asic rv515_asic = {
 	.set_surface_reg = r100_set_surface_reg,
 	.clear_surface_reg = r100_clear_surface_reg,
 	.bandwidth_update = &rv515_bandwidth_update,
+	.hpd_init = &rs600_hpd_init,
+	.hpd_fini = &rs600_hpd_fini,
+	.hpd_sense = &rs600_hpd_sense,
+	.hpd_set_polarity = &rs600_hpd_set_polarity,
 };
 
 
@@ -419,6 +459,10 @@ static struct radeon_asic r520_asic = {
 	.set_surface_reg = r100_set_surface_reg,
 	.clear_surface_reg = r100_clear_surface_reg,
 	.bandwidth_update = &rv515_bandwidth_update,
+	.hpd_init = &rs600_hpd_init,
+	.hpd_fini = &rs600_hpd_fini,
+	.hpd_sense = &rs600_hpd_sense,
+	.hpd_set_polarity = &rs600_hpd_set_polarity,
 };
 
 /*
@@ -455,6 +499,11 @@ int r600_ring_test(struct radeon_device *rdev);
 int r600_copy_blit(struct radeon_device *rdev,
 		   uint64_t src_offset, uint64_t dst_offset,
 		   unsigned num_pages, struct radeon_fence *fence);
+void r600_hpd_init(struct radeon_device *rdev);
+void r600_hpd_fini(struct radeon_device *rdev);
+bool r600_hpd_sense(struct radeon_device *rdev, enum radeon_hpd_id hpd);
+void r600_hpd_set_polarity(struct radeon_device *rdev,
+			   enum radeon_hpd_id hpd);
 
 static struct radeon_asic r600_asic = {
 	.init = &r600_init,
@@ -470,6 +519,7 @@ static struct radeon_asic r600_asic = {
 	.ring_ib_execute = &r600_ring_ib_execute,
 	.irq_set = &r600_irq_set,
 	.irq_process = &r600_irq_process,
+	.get_vblank_counter = &rs600_get_vblank_counter,
 	.fence_ring_emit = &r600_fence_ring_emit,
 	.cs_parse = &r600_cs_parse,
 	.copy_blit = &r600_copy_blit,
@@ -484,6 +534,10 @@ static struct radeon_asic r600_asic = {
 	.set_surface_reg = r600_set_surface_reg,
 	.clear_surface_reg = r600_clear_surface_reg,
 	.bandwidth_update = &rv515_bandwidth_update,
+	.hpd_init = &r600_hpd_init,
+	.hpd_fini = &r600_hpd_fini,
+	.hpd_sense = &r600_hpd_sense,
+	.hpd_set_polarity = &r600_hpd_set_polarity,
 };
 
 /*
@@ -509,6 +563,7 @@ static struct radeon_asic rv770_asic = {
 	.ring_ib_execute = &r600_ring_ib_execute,
 	.irq_set = &r600_irq_set,
 	.irq_process = &r600_irq_process,
+	.get_vblank_counter = &rs600_get_vblank_counter,
 	.fence_ring_emit = &r600_fence_ring_emit,
 	.cs_parse = &r600_cs_parse,
 	.copy_blit = &r600_copy_blit,
@@ -523,6 +578,10 @@ static struct radeon_asic rv770_asic = {
 	.set_surface_reg = r600_set_surface_reg,
 	.clear_surface_reg = r600_clear_surface_reg,
 	.bandwidth_update = &rv515_bandwidth_update,
+	.hpd_init = &r600_hpd_init,
+	.hpd_fini = &r600_hpd_fini,
+	.hpd_sense = &r600_hpd_sense,
+	.hpd_set_polarity = &r600_hpd_set_polarity,
 };
 
 #endif
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index 2ed88a820935..fa82ca74324e 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -47,7 +47,8 @@ radeon_add_atom_connector(struct drm_device *dev,
 			  int connector_type,
 			  struct radeon_i2c_bus_rec *i2c_bus,
 			  bool linkb, uint32_t igp_lane_info,
-			  uint16_t connector_object_id);
+			  uint16_t connector_object_id,
+			  struct radeon_hpd *hpd);
 
 /* from radeon_legacy_encoder.c */
 extern void
@@ -60,16 +61,16 @@ union atom_supported_devices {
 	struct _ATOM_SUPPORTED_DEVICES_INFO_2d1 info_2d1;
 };
 
-static inline struct radeon_i2c_bus_rec radeon_lookup_gpio(struct drm_device
-							   *dev, uint8_t id)
+static inline struct radeon_i2c_bus_rec radeon_lookup_i2c_gpio(struct radeon_device *rdev,
+							       uint8_t id)
 {
-	struct radeon_device *rdev = dev->dev_private;
 	struct atom_context *ctx = rdev->mode_info.atom_context;
-	ATOM_GPIO_I2C_ASSIGMENT gpio;
+	ATOM_GPIO_I2C_ASSIGMENT *gpio;
 	struct radeon_i2c_bus_rec i2c;
 	int index = GetIndexIntoMasterTable(DATA, GPIO_I2C_Info);
 	struct _ATOM_GPIO_I2C_INFO *i2c_info;
 	uint16_t data_offset;
+	int i;
 
 	memset(&i2c, 0, sizeof(struct radeon_i2c_bus_rec));
 	i2c.valid = false;
@@ -78,34 +79,122 @@ static inline struct radeon_i2c_bus_rec radeon_lookup_gpio(struct drm_device
 
 	i2c_info = (struct _ATOM_GPIO_I2C_INFO *)(ctx->bios + data_offset);
 
-	gpio = i2c_info->asGPIO_Info[id];
-
-	i2c.mask_clk_reg = le16_to_cpu(gpio.usClkMaskRegisterIndex) * 4;
-	i2c.mask_data_reg = le16_to_cpu(gpio.usDataMaskRegisterIndex) * 4;
-	i2c.put_clk_reg = le16_to_cpu(gpio.usClkEnRegisterIndex) * 4;
-	i2c.put_data_reg = le16_to_cpu(gpio.usDataEnRegisterIndex) * 4;
-	i2c.get_clk_reg = le16_to_cpu(gpio.usClkY_RegisterIndex) * 4;
-	i2c.get_data_reg = le16_to_cpu(gpio.usDataY_RegisterIndex) * 4;
-	i2c.a_clk_reg = le16_to_cpu(gpio.usClkA_RegisterIndex) * 4;
-	i2c.a_data_reg = le16_to_cpu(gpio.usDataA_RegisterIndex) * 4;
-	i2c.mask_clk_mask = (1 << gpio.ucClkMaskShift);
-	i2c.mask_data_mask = (1 << gpio.ucDataMaskShift);
-	i2c.put_clk_mask = (1 << gpio.ucClkEnShift);
-	i2c.put_data_mask = (1 << gpio.ucDataEnShift);
-	i2c.get_clk_mask = (1 << gpio.ucClkY_Shift);
-	i2c.get_data_mask = (1 << gpio.ucDataY_Shift);
-	i2c.a_clk_mask = (1 << gpio.ucClkA_Shift);
-	i2c.a_data_mask = (1 << gpio.ucDataA_Shift);
-	i2c.valid = true;
+
+	for (i = 0; i < ATOM_MAX_SUPPORTED_DEVICE; i++) {
+		gpio = &i2c_info->asGPIO_Info[i];
+
+		if (gpio->sucI2cId.ucAccess == id) {
+			i2c.mask_clk_reg = le16_to_cpu(gpio->usClkMaskRegisterIndex) * 4;
+			i2c.mask_data_reg = le16_to_cpu(gpio->usDataMaskRegisterIndex) * 4;
+			i2c.en_clk_reg = le16_to_cpu(gpio->usClkEnRegisterIndex) * 4;
+			i2c.en_data_reg = le16_to_cpu(gpio->usDataEnRegisterIndex) * 4;
+			i2c.y_clk_reg = le16_to_cpu(gpio->usClkY_RegisterIndex) * 4;
+			i2c.y_data_reg = le16_to_cpu(gpio->usDataY_RegisterIndex) * 4;
+			i2c.a_clk_reg = le16_to_cpu(gpio->usClkA_RegisterIndex) * 4;
+			i2c.a_data_reg = le16_to_cpu(gpio->usDataA_RegisterIndex) * 4;
+			i2c.mask_clk_mask = (1 << gpio->ucClkMaskShift);
+			i2c.mask_data_mask = (1 << gpio->ucDataMaskShift);
+			i2c.en_clk_mask = (1 << gpio->ucClkEnShift);
+			i2c.en_data_mask = (1 << gpio->ucDataEnShift);
+			i2c.y_clk_mask = (1 << gpio->ucClkY_Shift);
+			i2c.y_data_mask = (1 << gpio->ucDataY_Shift);
+			i2c.a_clk_mask = (1 << gpio->ucClkA_Shift);
+			i2c.a_data_mask = (1 << gpio->ucDataA_Shift);
+
+			if (gpio->sucI2cId.sbfAccess.bfHW_Capable)
+				i2c.hw_capable = true;
+			else
+				i2c.hw_capable = false;
+
+			if (gpio->sucI2cId.ucAccess == 0xa0)
+				i2c.mm_i2c = true;
+			else
+				i2c.mm_i2c = false;
+
+			i2c.i2c_id = gpio->sucI2cId.ucAccess;
+
+			i2c.valid = true;
+			break;
+		}
+	}
 
 	return i2c;
 }
 
+static inline struct radeon_gpio_rec radeon_lookup_gpio(struct radeon_device *rdev,
+							u8 id)
+{
+	struct atom_context *ctx = rdev->mode_info.atom_context;
+	struct radeon_gpio_rec gpio;
+	int index = GetIndexIntoMasterTable(DATA, GPIO_Pin_LUT);
+	struct _ATOM_GPIO_PIN_LUT *gpio_info;
+	ATOM_GPIO_PIN_ASSIGNMENT *pin;
+	u16 data_offset, size;
+	int i, num_indices;
+
+	memset(&gpio, 0, sizeof(struct radeon_gpio_rec));
+	gpio.valid = false;
+
+	atom_parse_data_header(ctx, index, &size, NULL, NULL, &data_offset);
+
+	gpio_info = (struct _ATOM_GPIO_PIN_LUT *)(ctx->bios + data_offset);
+
+	num_indices = (size - sizeof(ATOM_COMMON_TABLE_HEADER)) / sizeof(ATOM_GPIO_PIN_ASSIGNMENT);
+
+	for (i = 0; i < num_indices; i++) {
+		pin = &gpio_info->asGPIO_Pin[i];
+		if (id == pin->ucGPIO_ID) {
+			gpio.id = pin->ucGPIO_ID;
+			gpio.reg = pin->usGpioPin_AIndex * 4;
+			gpio.mask = (1 << pin->ucGpioPinBitShift);
+			gpio.valid = true;
+			break;
+		}
+	}
+
+	return gpio;
+}
+
+static struct radeon_hpd radeon_atom_get_hpd_info_from_gpio(struct radeon_device *rdev,
+							    struct radeon_gpio_rec *gpio)
+{
+	struct radeon_hpd hpd;
+	hpd.gpio = *gpio;
+	if (gpio->reg == AVIVO_DC_GPIO_HPD_A) {
+		switch(gpio->mask) {
+		case (1 << 0):
+			hpd.hpd = RADEON_HPD_1;
+			break;
+		case (1 << 8):
+			hpd.hpd = RADEON_HPD_2;
+			break;
+		case (1 << 16):
+			hpd.hpd = RADEON_HPD_3;
+			break;
+		case (1 << 24):
+			hpd.hpd = RADEON_HPD_4;
+			break;
+		case (1 << 26):
+			hpd.hpd = RADEON_HPD_5;
+			break;
+		case (1 << 28):
+			hpd.hpd = RADEON_HPD_6;
+			break;
+		default:
+			hpd.hpd = RADEON_HPD_NONE;
+			break;
+		}
+	} else
+		hpd.hpd = RADEON_HPD_NONE;
+	return hpd;
+}
+
 static bool radeon_atom_apply_quirks(struct drm_device *dev,
 				     uint32_t supported_device,
 				     int *connector_type,
 				     struct radeon_i2c_bus_rec *i2c_bus,
-				     uint16_t *line_mux)
+				     uint16_t *line_mux,
+				     struct radeon_hpd *hpd)
 {
 
 	/* Asus M2A-VM HDMI board lists the DVI port as HDMI */
@@ -135,6 +224,23 @@ static bool radeon_atom_apply_quirks(struct drm_device *dev,
 		}
 	}
 
+	/* HIS X1300 is DVI+VGA, not DVI+DVI */
+	if ((dev->pdev->device == 0x7146) &&
+	    (dev->pdev->subsystem_vendor == 0x17af) &&
+	    (dev->pdev->subsystem_device == 0x2058)) {
+		if (supported_device == ATOM_DEVICE_DFP1_SUPPORT)
+			return false;
+	}
+
+	/* Gigabyte X1300 is DVI+VGA, not DVI+DVI */
+	if ((dev->pdev->device == 0x7142) &&
+	    (dev->pdev->subsystem_vendor == 0x1458) &&
+	    (dev->pdev->subsystem_device == 0x2134)) {
+		if (supported_device == ATOM_DEVICE_DFP1_SUPPORT)
+			return false;
+	}
+
+
 	/* Funky macbooks */
 	if ((dev->pdev->device == 0x71C5) &&
 	    (dev->pdev->subsystem_vendor == 0x106b) &&
@@ -172,6 +278,15 @@ static bool radeon_atom_apply_quirks(struct drm_device *dev,
 		}
 	}
 
+	/* Acer laptop reports DVI-D as DVI-I */
+	if ((dev->pdev->device == 0x95c4) &&
+	    (dev->pdev->subsystem_vendor == 0x1025) &&
+	    (dev->pdev->subsystem_device == 0x013c)) {
+		if ((*connector_type == DRM_MODE_CONNECTOR_DVII) &&
+		    (supported_device == ATOM_DEVICE_DFP1_SUPPORT))
+			*connector_type = DRM_MODE_CONNECTOR_DVID;
+	}
+
 	return true;
 }
 
@@ -231,7 +346,9 @@ const int object_connector_convert[] = {
 	DRM_MODE_CONNECTOR_Unknown,
 	DRM_MODE_CONNECTOR_Unknown,
 	DRM_MODE_CONNECTOR_Unknown,
-	DRM_MODE_CONNECTOR_DisplayPort
+	DRM_MODE_CONNECTOR_DisplayPort,
+	DRM_MODE_CONNECTOR_eDP,
+	DRM_MODE_CONNECTOR_Unknown
 };
 
 bool radeon_get_atom_connector_info_from_object_table(struct drm_device *dev)
@@ -240,16 +357,18 @@ bool radeon_get_atom_connector_info_from_object_table(struct drm_device *dev)
 	struct radeon_mode_info *mode_info = &rdev->mode_info;
 	struct atom_context *ctx = mode_info->atom_context;
 	int index = GetIndexIntoMasterTable(DATA, Object_Header);
-	uint16_t size, data_offset;
-	uint8_t frev, crev, line_mux = 0;
+	u16 size, data_offset;
+	u8 frev, crev;
 	ATOM_CONNECTOR_OBJECT_TABLE *con_obj;
 	ATOM_DISPLAY_OBJECT_PATH_TABLE *path_obj;
 	ATOM_OBJECT_HEADER *obj_header;
 	int i, j, path_size, device_support;
 	int connector_type;
-	uint16_t igp_lane_info, conn_id, connector_object_id;
+	u16 igp_lane_info, conn_id, connector_object_id;
 	bool linkb;
 	struct radeon_i2c_bus_rec ddc_bus;
+	struct radeon_gpio_rec gpio;
+	struct radeon_hpd hpd;
 
 	atom_parse_data_header(ctx, index, &size, &frev, &crev, &data_offset);
 
@@ -276,7 +395,6 @@ bool radeon_get_atom_connector_info_from_object_table(struct drm_device *dev)
 		path = (ATOM_DISPLAY_OBJECT_PATH *) addr;
 		path_size += le16_to_cpu(path->usSize);
 		linkb = false;
-
 		if (device_support & le16_to_cpu(path->usDeviceTag)) {
 			uint8_t con_obj_id, con_obj_num, con_obj_type;
 
@@ -377,10 +495,9 @@ bool radeon_get_atom_connector_info_from_object_table(struct drm_device *dev)
 				}
 			}
 
-			/* look up gpio for ddc */
+			/* look up gpio for ddc, hpd */
 			if ((le16_to_cpu(path->usDeviceTag) &
-			     (ATOM_DEVICE_TV_SUPPORT | ATOM_DEVICE_CV_SUPPORT))
-			    == 0) {
+			     (ATOM_DEVICE_TV_SUPPORT | ATOM_DEVICE_CV_SUPPORT)) == 0) {
 				for (j = 0; j < con_obj->ucNumberOfObjects; j++) {
 					if (le16_to_cpu(path->usConnObjectId) ==
 					    le16_to_cpu(con_obj->asObjects[j].
@@ -394,21 +511,34 @@ bool radeon_get_atom_connector_info_from_object_table(struct drm_device *dev)
 								 asObjects[j].
 								 usRecordOffset));
 						ATOM_I2C_RECORD *i2c_record;
+						ATOM_HPD_INT_RECORD *hpd_record;
+						ATOM_I2C_ID_CONFIG_ACCESS *i2c_config;
+						hpd.hpd = RADEON_HPD_NONE;
 
 						while (record->ucRecordType > 0
 						       && record->
 						       ucRecordType <=
 						       ATOM_MAX_OBJECT_RECORD_NUMBER) {
-							switch (record->
-								ucRecordType) {
+							switch (record->ucRecordType) {
 							case ATOM_I2C_RECORD_TYPE:
 								i2c_record =
-								    (ATOM_I2C_RECORD
-								     *) record;
-								line_mux =
-								    i2c_record->
-								    sucI2cId.
-								    bfI2C_LineMux;
+								    (ATOM_I2C_RECORD *)
+									record;
+								i2c_config =
+									(ATOM_I2C_ID_CONFIG_ACCESS *)
+									&i2c_record->sucI2cId;
+								ddc_bus = radeon_lookup_i2c_gpio(rdev,
+												 i2c_config->
+												 ucAccess);
+								break;
+							case ATOM_HPD_INT_RECORD_TYPE:
+								hpd_record =
+									(ATOM_HPD_INT_RECORD *)
+									record;
+								gpio = radeon_lookup_gpio(rdev,
+											  hpd_record->ucHPDIntGPIOID);
+								hpd = radeon_atom_get_hpd_info_from_gpio(rdev, &gpio);
+								hpd.plugged_state = hpd_record->ucPlugged_PinState;
 								break;
 							}
 							record =
@@ -421,24 +551,16 @@ bool radeon_get_atom_connector_info_from_object_table(struct drm_device *dev)
 						break;
 					}
 				}
-			} else
-				line_mux = 0;
-
-			if ((le16_to_cpu(path->usDeviceTag) ==
-			     ATOM_DEVICE_TV1_SUPPORT)
-			    || (le16_to_cpu(path->usDeviceTag) ==
-				ATOM_DEVICE_TV2_SUPPORT)
-			    || (le16_to_cpu(path->usDeviceTag) ==
-				ATOM_DEVICE_CV_SUPPORT))
+			} else {
+				hpd.hpd = RADEON_HPD_NONE;
 				ddc_bus.valid = false;
-			else
-				ddc_bus = radeon_lookup_gpio(dev, line_mux);
+			}
 
 			conn_id = le16_to_cpu(path->usConnObjectId);
 
 			if (!radeon_atom_apply_quirks
 			    (dev, le16_to_cpu(path->usDeviceTag), &connector_type,
-			     &ddc_bus, &conn_id))
+			     &ddc_bus, &conn_id, &hpd))
 				continue;
 
 			radeon_add_atom_connector(dev,
@@ -447,7 +569,8 @@ bool radeon_get_atom_connector_info_from_object_table(struct drm_device *dev)
 							      usDeviceTag),
 						  connector_type, &ddc_bus,
 						  linkb, igp_lane_info,
-						  connector_object_id);
+						  connector_object_id,
+						  &hpd);
 
 		}
 	}
@@ -502,6 +625,7 @@ struct bios_connector {
 	uint16_t devices;
 	int connector_type;
 	struct radeon_i2c_bus_rec ddc_bus;
+	struct radeon_hpd hpd;
 };
 
 bool radeon_get_atom_connector_info_from_supported_devices_table(struct
@@ -517,7 +641,7 @@ bool radeon_get_atom_connector_info_from_supported_devices_table(struct
 	uint16_t device_support;
 	uint8_t dac;
 	union atom_supported_devices *supported_devices;
-	int i, j;
+	int i, j, max_device;
 	struct bios_connector bios_connectors[ATOM_MAX_SUPPORTED_DEVICE];
 
 	atom_parse_data_header(ctx, index, &size, &frev, &crev, &data_offset);
@@ -527,7 +651,12 @@ bool radeon_get_atom_connector_info_from_supported_devices_table(struct
 
 	device_support = le16_to_cpu(supported_devices->info.usDeviceSupport);
 
-	for (i = 0; i < ATOM_MAX_SUPPORTED_DEVICE; i++) {
+	if (frev > 1)
+		max_device = ATOM_MAX_SUPPORTED_DEVICE;
+	else
+		max_device = ATOM_MAX_SUPPORTED_DEVICE_INFO;
+
+	for (i = 0; i < max_device; i++) {
 		ATOM_CONNECTOR_INFO_I2C ci =
 		    supported_devices->info.asConnInfo[i];
 
@@ -553,22 +682,8 @@ bool radeon_get_atom_connector_info_from_supported_devices_table(struct
 
 		dac = ci.sucConnectorInfo.sbfAccess.bfAssociatedDAC;
 
-		if ((rdev->family == CHIP_RS690) ||
-		    (rdev->family == CHIP_RS740)) {
-			if ((i == ATOM_DEVICE_DFP2_INDEX)
-			    && (ci.sucI2cId.sbfAccess.bfI2C_LineMux == 2))
-				bios_connectors[i].line_mux =
-				    ci.sucI2cId.sbfAccess.bfI2C_LineMux + 1;
-			else if ((i == ATOM_DEVICE_DFP3_INDEX)
-				 && (ci.sucI2cId.sbfAccess.bfI2C_LineMux == 1))
-				bios_connectors[i].line_mux =
-				    ci.sucI2cId.sbfAccess.bfI2C_LineMux + 1;
-			else
-				bios_connectors[i].line_mux =
-				    ci.sucI2cId.sbfAccess.bfI2C_LineMux;
-		} else
-			bios_connectors[i].line_mux =
-			    ci.sucI2cId.sbfAccess.bfI2C_LineMux;
+		bios_connectors[i].line_mux =
+			ci.sucI2cId.ucAccess;
 
 		/* give tv unique connector ids */
 		if (i == ATOM_DEVICE_TV1_INDEX) {
@@ -582,8 +697,30 @@ bool radeon_get_atom_connector_info_from_supported_devices_table(struct
 			bios_connectors[i].line_mux = 52;
 		} else
 			bios_connectors[i].ddc_bus =
-			    radeon_lookup_gpio(dev,
-					       bios_connectors[i].line_mux);
+			    radeon_lookup_i2c_gpio(rdev,
+						   bios_connectors[i].line_mux);
+
+		if ((crev > 1) && (frev > 1)) {
+			u8 isb = supported_devices->info_2d1.asIntSrcInfo[i].ucIntSrcBitmap;
+			switch (isb) {
+			case 0x4:
+				bios_connectors[i].hpd.hpd = RADEON_HPD_1;
+				break;
+			case 0xa:
+				bios_connectors[i].hpd.hpd = RADEON_HPD_2;
+				break;
+			default:
+				bios_connectors[i].hpd.hpd = RADEON_HPD_NONE;
+				break;
+			}
+		} else {
+			if (i == ATOM_DEVICE_DFP1_INDEX)
+				bios_connectors[i].hpd.hpd = RADEON_HPD_1;
+			else if (i == ATOM_DEVICE_DFP2_INDEX)
+				bios_connectors[i].hpd.hpd = RADEON_HPD_2;
+			else
+				bios_connectors[i].hpd.hpd = RADEON_HPD_NONE;
+		}
 
 		/* Always set the connector type to VGA for CRT1/CRT2. if they are
 		 * shared with a DVI port, we'll pick up the DVI connector when we
@@ -595,7 +732,8 @@ bool radeon_get_atom_connector_info_from_supported_devices_table(struct
 
 		if (!radeon_atom_apply_quirks
 		    (dev, (1 << i), &bios_connectors[i].connector_type,
-		     &bios_connectors[i].ddc_bus, &bios_connectors[i].line_mux))
+		     &bios_connectors[i].ddc_bus, &bios_connectors[i].line_mux,
+		     &bios_connectors[i].hpd))
 			continue;
 
 		bios_connectors[i].valid = true;
@@ -610,41 +748,42 @@ bool radeon_get_atom_connector_info_from_supported_devices_table(struct
 		else
 			radeon_add_legacy_encoder(dev,
 						  radeon_get_encoder_id(dev,
-									(1 <<
-									 i),
+									(1 << i),
 									dac),
 						  (1 << i));
 	}
 
 	/* combine shared connectors */
-	for (i = 0; i < ATOM_MAX_SUPPORTED_DEVICE; i++) {
+	for (i = 0; i < max_device; i++) {
 		if (bios_connectors[i].valid) {
-			for (j = 0; j < ATOM_MAX_SUPPORTED_DEVICE; j++) {
+			for (j = 0; j < max_device; j++) {
 				if (bios_connectors[j].valid && (i != j)) {
 					if (bios_connectors[i].line_mux ==
 					    bios_connectors[j].line_mux) {
-						if (((bios_connectors[i].
-						      devices &
-						      (ATOM_DEVICE_DFP_SUPPORT))
-						     && (bios_connectors[j].
-							 devices &
-							 (ATOM_DEVICE_CRT_SUPPORT)))
-						    ||
-						    ((bios_connectors[j].
-						      devices &
-						      (ATOM_DEVICE_DFP_SUPPORT))
-						     && (bios_connectors[i].
-							 devices &
-							 (ATOM_DEVICE_CRT_SUPPORT)))) {
-							bios_connectors[i].
-							    devices |=
-							    bios_connectors[j].
-							    devices;
-							bios_connectors[i].
-							    connector_type =
-							    DRM_MODE_CONNECTOR_DVII;
-							bios_connectors[j].
-							    valid = false;
+						/* make sure not to combine LVDS */
+						if (bios_connectors[i].devices & (ATOM_DEVICE_LCD_SUPPORT)) {
+							bios_connectors[i].line_mux = 53;
+							bios_connectors[i].ddc_bus.valid = false;
+							continue;
+						}
+						if (bios_connectors[j].devices & (ATOM_DEVICE_LCD_SUPPORT)) {
+							bios_connectors[j].line_mux = 53;
+							bios_connectors[j].ddc_bus.valid = false;
+							continue;
+						}
+						/* combine analog and digital for DVI-I */
+						if (((bios_connectors[i].devices & (ATOM_DEVICE_DFP_SUPPORT)) &&
+						     (bios_connectors[j].devices & (ATOM_DEVICE_CRT_SUPPORT))) ||
+						    ((bios_connectors[j].devices & (ATOM_DEVICE_DFP_SUPPORT)) &&
+						     (bios_connectors[i].devices & (ATOM_DEVICE_CRT_SUPPORT)))) {
+							bios_connectors[i].devices |=
+								bios_connectors[j].devices;
+							bios_connectors[i].connector_type =
+								DRM_MODE_CONNECTOR_DVII;
+							if (bios_connectors[j].devices & (ATOM_DEVICE_DFP_SUPPORT))
+								bios_connectors[i].hpd =
+									bios_connectors[j].hpd;
+							bios_connectors[j].valid = false;
 						}
 					}
 				}
@@ -653,7 +792,7 @@ bool radeon_get_atom_connector_info_from_supported_devices_table(struct
 	}
 
 	/* add the connectors */
-	for (i = 0; i < ATOM_MAX_SUPPORTED_DEVICE; i++) {
+	for (i = 0; i < max_device; i++) {
 		if (bios_connectors[i].valid) {
 			uint16_t connector_object_id =
 				atombios_get_connector_object_id(dev,
@@ -666,7 +805,8 @@ bool radeon_get_atom_connector_info_from_supported_devices_table(struct
 						  connector_type,
 						  &bios_connectors[i].ddc_bus,
 						  false, 0,
-						  connector_object_id);
+						  connector_object_id,
+						  &bios_connectors[i].hpd);
 		}
 	}
 
@@ -731,7 +871,8 @@ bool radeon_atom_get_clock_info(struct drm_device *dev)
 			 * pre-DCE 3.0 r6xx hardware.  This might need to be adjusted per
 			 * family.
 			 */
-			p1pll->pll_out_min = 64800;
+			if (!radeon_new_pll)
+				p1pll->pll_out_min = 64800;
 		}
 
 		p1pll->pll_in_min =
@@ -797,6 +938,43 @@ bool radeon_atom_get_clock_info(struct drm_device *dev)
 	return false;
 }
 
+union igp_info {
+	struct _ATOM_INTEGRATED_SYSTEM_INFO info;
+	struct _ATOM_INTEGRATED_SYSTEM_INFO_V2 info_2;
+};
+
+bool radeon_atombios_sideport_present(struct radeon_device *rdev)
+{
+	struct radeon_mode_info *mode_info = &rdev->mode_info;
+	int index = GetIndexIntoMasterTable(DATA, IntegratedSystemInfo);
+	union igp_info *igp_info;
+	u8 frev, crev;
+	u16 data_offset;
+
+	atom_parse_data_header(mode_info->atom_context, index, NULL, &frev,
+			       &crev, &data_offset);
+
+	igp_info = (union igp_info *)(mode_info->atom_context->bios +
+				      data_offset);
+
+	if (igp_info) {
+		switch (crev) {
+		case 1:
+			if (igp_info->info.ucMemoryType & 0xf0)
+				return true;
+			break;
+		case 2:
+			if (igp_info->info_2.ucMemoryType & 0x0f)
+				return true;
+			break;
+		default:
+			DRM_ERROR("Unsupported IGP table: %d %d\n", frev, crev);
+			break;
+		}
+	}
+	return false;
+}
+
 bool radeon_atombios_get_tmds_info(struct radeon_encoder *encoder,
 				   struct radeon_encoder_int_tmds *tmds)
 {
@@ -861,6 +1039,7 @@ static struct radeon_atom_ss *radeon_atombios_get_ss_info(struct
 	struct _ATOM_SPREAD_SPECTRUM_INFO *ss_info;
 	uint8_t frev, crev;
 	struct radeon_atom_ss *ss = NULL;
+	int i;
 
 	if (id > ATOM_MAX_SS_ENTRY)
 		return NULL;
@@ -878,12 +1057,18 @@ static struct radeon_atom_ss *radeon_atombios_get_ss_info(struct
 		if (!ss)
 			return NULL;
 
-		ss->percentage = le16_to_cpu(ss_info->asSS_Info[id].usSpreadSpectrumPercentage);
-		ss->type = ss_info->asSS_Info[id].ucSpreadSpectrumType;
-		ss->step = ss_info->asSS_Info[id].ucSS_Step;
-		ss->delay = ss_info->asSS_Info[id].ucSS_Delay;
-		ss->range = ss_info->asSS_Info[id].ucSS_Range;
-		ss->refdiv = ss_info->asSS_Info[id].ucRecommendedRef_Div;
+		for (i = 0; i < ATOM_MAX_SS_ENTRY; i++) {
+			if (ss_info->asSS_Info[i].ucSS_Id == id) {
+				ss->percentage =
+					le16_to_cpu(ss_info->asSS_Info[i].usSpreadSpectrumPercentage);
+				ss->type = ss_info->asSS_Info[i].ucSpreadSpectrumType;
+				ss->step = ss_info->asSS_Info[i].ucSS_Step;
+				ss->delay = ss_info->asSS_Info[i].ucSS_Delay;
+				ss->range = ss_info->asSS_Info[i].ucSS_Range;
+				ss->refdiv = ss_info->asSS_Info[i].ucRecommendedRef_Div;
+				break;
+			}
+		}
 	}
 	return ss;
 }
@@ -901,7 +1086,7 @@ struct radeon_encoder_atom_dig *radeon_atombios_get_lvds_info(struct
 	struct radeon_device *rdev = dev->dev_private;
 	struct radeon_mode_info *mode_info = &rdev->mode_info;
 	int index = GetIndexIntoMasterTable(DATA, LVDS_Info);
-	uint16_t data_offset;
+	uint16_t data_offset, misc;
 	union lvds_info *lvds_info;
 	uint8_t frev, crev;
 	struct radeon_encoder_atom_dig *lvds = NULL;
@@ -940,6 +1125,19 @@ struct radeon_encoder_atom_dig *radeon_atombios_get_lvds_info(struct
 		lvds->panel_pwr_delay =
 		    le16_to_cpu(lvds_info->info.usOffDelayInMs);
 		lvds->lvds_misc = lvds_info->info.ucLVDS_Misc;
+
+		misc = le16_to_cpu(lvds_info->info.sLCDTiming.susModeMiscInfo.usAccess);
+		if (misc & ATOM_VSYNC_POLARITY)
+			lvds->native_mode.flags |= DRM_MODE_FLAG_NVSYNC;
+		if (misc & ATOM_HSYNC_POLARITY)
+			lvds->native_mode.flags |= DRM_MODE_FLAG_NHSYNC;
+		if (misc & ATOM_COMPOSITESYNC)
+			lvds->native_mode.flags |= DRM_MODE_FLAG_CSYNC;
+		if (misc & ATOM_INTERLACE)
+			lvds->native_mode.flags |= DRM_MODE_FLAG_INTERLACE;
+		if (misc & ATOM_DOUBLE_CLOCK_MODE)
+			lvds->native_mode.flags |= DRM_MODE_FLAG_DBLSCAN;
+
 		/* set crtc values */
 		drm_mode_set_crtcinfo(&lvds->native_mode, CRTC_INTERLACE_HALVE_V);
 
@@ -1074,6 +1272,61 @@ bool radeon_atom_get_tv_timings(struct radeon_device *rdev, int index,
 	return true;
 }
 
+enum radeon_tv_std
+radeon_atombios_get_tv_info(struct radeon_device *rdev)
+{
+	struct radeon_mode_info *mode_info = &rdev->mode_info;
+	int index = GetIndexIntoMasterTable(DATA, AnalogTV_Info);
+	uint16_t data_offset;
+	uint8_t frev, crev;
+	struct _ATOM_ANALOG_TV_INFO *tv_info;
+	enum radeon_tv_std tv_std = TV_STD_NTSC;
+
+	atom_parse_data_header(mode_info->atom_context, index, NULL, &frev, &crev, &data_offset);
+
+	tv_info = (struct _ATOM_ANALOG_TV_INFO *)(mode_info->atom_context->bios + data_offset);
+
+	switch (tv_info->ucTV_BootUpDefaultStandard) {
+	case ATOM_TV_NTSC:
+		tv_std = TV_STD_NTSC;
+		DRM_INFO("Default TV standard: NTSC\n");
+		break;
+	case ATOM_TV_NTSCJ:
+		tv_std = TV_STD_NTSC_J;
+		DRM_INFO("Default TV standard: NTSC-J\n");
+		break;
+	case ATOM_TV_PAL:
+		tv_std = TV_STD_PAL;
+		DRM_INFO("Default TV standard: PAL\n");
+		break;
+	case ATOM_TV_PALM:
+		tv_std = TV_STD_PAL_M;
+		DRM_INFO("Default TV standard: PAL-M\n");
+		break;
+	case ATOM_TV_PALN:
+		tv_std = TV_STD_PAL_N;
+		DRM_INFO("Default TV standard: PAL-N\n");
+		break;
+	case ATOM_TV_PALCN:
+		tv_std = TV_STD_PAL_CN;
+		DRM_INFO("Default TV standard: PAL-CN\n");
+		break;
+	case ATOM_TV_PAL60:
+		tv_std = TV_STD_PAL_60;
+		DRM_INFO("Default TV standard: PAL-60\n");
+		break;
+	case ATOM_TV_SECAM:
+		tv_std = TV_STD_SECAM;
+		DRM_INFO("Default TV standard: SECAM\n");
+		break;
+	default:
+		tv_std = TV_STD_NTSC;
+		DRM_INFO("Unknown TV standard; defaulting to NTSC\n");
+		break;
+	}
+	return tv_std;
+}
+
 struct radeon_encoder_tv_dac *
 radeon_atombios_get_tv_dac_info(struct radeon_encoder *encoder)
 {
@@ -1109,6 +1362,7 @@ radeon_atombios_get_tv_dac_info(struct radeon_encoder *encoder)
 		dac = dac_info->ucDAC2_NTSC_DAC_Adjustment;
 		tv_dac->ntsc_tvdac_adj = (bg << 16) | (dac << 20);
 
+		tv_dac->tv_std = radeon_atombios_get_tv_info(rdev);
 	}
 	return tv_dac;
 }
diff --git a/drivers/gpu/drm/radeon/radeon_benchmark.c b/drivers/gpu/drm/radeon/radeon_benchmark.c
index 10bd50a7db87..4ddfd4b5bc51 100644
--- a/drivers/gpu/drm/radeon/radeon_benchmark.c
+++ b/drivers/gpu/drm/radeon/radeon_benchmark.c
@@ -29,8 +29,8 @@
 void radeon_benchmark_move(struct radeon_device *rdev, unsigned bsize,
 			   unsigned sdomain, unsigned ddomain)
 {
-	struct radeon_object *dobj = NULL;
-	struct radeon_object *sobj = NULL;
+	struct radeon_bo *dobj = NULL;
+	struct radeon_bo *sobj = NULL;
 	struct radeon_fence *fence = NULL;
 	uint64_t saddr, daddr;
 	unsigned long start_jiffies;
@@ -41,19 +41,27 @@ void radeon_benchmark_move(struct radeon_device *rdev, unsigned bsize,
 
 	size = bsize;
 	n = 1024;
-	r = radeon_object_create(rdev, NULL, size, true, sdomain, false, &sobj);
+	r = radeon_bo_create(rdev, NULL, size, true, sdomain, &sobj);
 	if (r) {
 		goto out_cleanup;
 	}
-	r = radeon_object_pin(sobj, sdomain, &saddr);
+	r = radeon_bo_reserve(sobj, false);
+	if (unlikely(r != 0))
+		goto out_cleanup;
+	r = radeon_bo_pin(sobj, sdomain, &saddr);
+	radeon_bo_unreserve(sobj);
 	if (r) {
 		goto out_cleanup;
 	}
-	r = radeon_object_create(rdev, NULL, size, true, ddomain, false, &dobj);
+	r = radeon_bo_create(rdev, NULL, size, true, ddomain, &dobj);
 	if (r) {
 		goto out_cleanup;
 	}
-	r = radeon_object_pin(dobj, ddomain, &daddr);
+	r = radeon_bo_reserve(dobj, false);
+	if (unlikely(r != 0))
+		goto out_cleanup;
+	r = radeon_bo_pin(dobj, ddomain, &daddr);
+	radeon_bo_unreserve(dobj);
 	if (r) {
 		goto out_cleanup;
 	}
@@ -109,12 +117,20 @@ void radeon_benchmark_move(struct radeon_device *rdev, unsigned bsize,
 	}
 out_cleanup:
 	if (sobj) {
-		radeon_object_unpin(sobj);
-		radeon_object_unref(&sobj);
+		r = radeon_bo_reserve(sobj, false);
+		if (likely(r == 0)) {
+			radeon_bo_unpin(sobj);
+			radeon_bo_unreserve(sobj);
+		}
+		radeon_bo_unref(&sobj);
 	}
 	if (dobj) {
-		radeon_object_unpin(dobj);
-		radeon_object_unref(&dobj);
+		r = radeon_bo_reserve(dobj, false);
+		if (likely(r == 0)) {
+			radeon_bo_unpin(dobj);
+			radeon_bo_unreserve(dobj);
+		}
+		radeon_bo_unref(&dobj);
 	}
 	if (fence) {
 		radeon_fence_unref(&fence);
diff --git a/drivers/gpu/drm/radeon/radeon_clocks.c b/drivers/gpu/drm/radeon/radeon_clocks.c
index a81354167621..812f24dbc2a8 100644
--- a/drivers/gpu/drm/radeon/radeon_clocks.c
+++ b/drivers/gpu/drm/radeon/radeon_clocks.c
@@ -44,6 +44,10 @@ uint32_t radeon_legacy_get_engine_clock(struct radeon_device *rdev)
 
 	ref_div =
 	    RREG32_PLL(RADEON_M_SPLL_REF_FB_DIV) & RADEON_M_SPLL_REF_DIV_MASK;
+
+	if (ref_div == 0)
+		return 0;
+
 	sclk = fb_div / ref_div;
 
 	post_div = RREG32_PLL(RADEON_SCLK_CNTL) & RADEON_SCLK_SRC_SEL_MASK;
@@ -58,7 +62,7 @@ uint32_t radeon_legacy_get_engine_clock(struct radeon_device *rdev)
 }
 
 /* 10 khz */
-static uint32_t radeon_legacy_get_memory_clock(struct radeon_device *rdev)
+uint32_t radeon_legacy_get_memory_clock(struct radeon_device *rdev)
 {
 	struct radeon_pll *mpll = &rdev->clock.mpll;
 	uint32_t fb_div, ref_div, post_div, mclk;
@@ -70,6 +74,10 @@ static uint32_t radeon_legacy_get_memory_clock(struct radeon_device *rdev)
 
 	ref_div =
 	    RREG32_PLL(RADEON_M_SPLL_REF_FB_DIV) & RADEON_M_SPLL_REF_DIV_MASK;
+
+	if (ref_div == 0)
+		return 0;
+
 	mclk = fb_div / ref_div;
 
 	post_div = RREG32_PLL(RADEON_MCLK_CNTL) & 0x7;
@@ -98,8 +106,19 @@ void radeon_get_clock_info(struct drm_device *dev)
 		ret = radeon_combios_get_clock_info(dev);
 
 	if (ret) {
-		if (p1pll->reference_div < 2)
-			p1pll->reference_div = 12;
+		if (p1pll->reference_div < 2) {
+			if (!ASIC_IS_AVIVO(rdev)) {
+				u32 tmp = RREG32_PLL(RADEON_PPLL_REF_DIV);
+				if (ASIC_IS_R300(rdev))
+					p1pll->reference_div =
+						(tmp & R300_PPLL_REF_DIV_ACC_MASK) >> R300_PPLL_REF_DIV_ACC_SHIFT;
+				else
+					p1pll->reference_div = tmp & RADEON_PPLL_REF_DIV_MASK;
+				if (p1pll->reference_div < 2)
+					p1pll->reference_div = 12;
+			} else
+				p1pll->reference_div = 12;
+		}
 		if (p2pll->reference_div < 2)
 			p2pll->reference_div = 12;
 		if (rdev->family < CHIP_RS600) {
diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
index 5253cbf6db1f..579c8920e081 100644
--- a/drivers/gpu/drm/radeon/radeon_combios.c
+++ b/drivers/gpu/drm/radeon/radeon_combios.c
@@ -50,7 +50,8 @@ radeon_add_legacy_connector(struct drm_device *dev,
 			    uint32_t supported_device,
 			    int connector_type,
 			    struct radeon_i2c_bus_rec *i2c_bus,
-			    uint16_t connector_object_id);
+			    uint16_t connector_object_id,
+			    struct radeon_hpd *hpd);
 
 /* from radeon_legacy_encoder.c */
 extern void
@@ -442,39 +443,71 @@ static uint16_t combios_get_table_offset(struct drm_device *dev,
 
 }
 
-struct radeon_i2c_bus_rec combios_setup_i2c_bus(int ddc_line)
+static struct radeon_i2c_bus_rec combios_setup_i2c_bus(struct radeon_device *rdev,
+						       int ddc_line)
 {
 	struct radeon_i2c_bus_rec i2c;
 
-	i2c.mask_clk_mask = RADEON_GPIO_EN_1;
-	i2c.mask_data_mask = RADEON_GPIO_EN_0;
-	i2c.a_clk_mask = RADEON_GPIO_A_1;
-	i2c.a_data_mask = RADEON_GPIO_A_0;
-	i2c.put_clk_mask = RADEON_GPIO_EN_1;
-	i2c.put_data_mask = RADEON_GPIO_EN_0;
-	i2c.get_clk_mask = RADEON_GPIO_Y_1;
-	i2c.get_data_mask = RADEON_GPIO_Y_0;
-	if ((ddc_line == RADEON_LCD_GPIO_MASK) ||
-	    (ddc_line == RADEON_MDGPIO_EN_REG)) {
-		i2c.mask_clk_reg = ddc_line;
-		i2c.mask_data_reg = ddc_line;
-		i2c.a_clk_reg = ddc_line;
-		i2c.a_data_reg = ddc_line;
-		i2c.put_clk_reg = ddc_line;
-		i2c.put_data_reg = ddc_line;
-		i2c.get_clk_reg = ddc_line + 4;
-		i2c.get_data_reg = ddc_line + 4;
+	if (ddc_line == RADEON_GPIOPAD_MASK) {
+		i2c.mask_clk_reg = RADEON_GPIOPAD_MASK;
+		i2c.mask_data_reg = RADEON_GPIOPAD_MASK;
+		i2c.a_clk_reg = RADEON_GPIOPAD_A;
+		i2c.a_data_reg = RADEON_GPIOPAD_A;
+		i2c.en_clk_reg = RADEON_GPIOPAD_EN;
+		i2c.en_data_reg = RADEON_GPIOPAD_EN;
+		i2c.y_clk_reg = RADEON_GPIOPAD_Y;
+		i2c.y_data_reg = RADEON_GPIOPAD_Y;
+	} else if (ddc_line == RADEON_MDGPIO_MASK) {
+		i2c.mask_clk_reg = RADEON_MDGPIO_MASK;
+		i2c.mask_data_reg = RADEON_MDGPIO_MASK;
+		i2c.a_clk_reg = RADEON_MDGPIO_A;
+		i2c.a_data_reg = RADEON_MDGPIO_A;
+		i2c.en_clk_reg = RADEON_MDGPIO_EN;
+		i2c.en_data_reg = RADEON_MDGPIO_EN;
+		i2c.y_clk_reg = RADEON_MDGPIO_Y;
+		i2c.y_data_reg = RADEON_MDGPIO_Y;
 	} else {
+		i2c.mask_clk_mask = RADEON_GPIO_EN_1;
+		i2c.mask_data_mask = RADEON_GPIO_EN_0;
+		i2c.a_clk_mask = RADEON_GPIO_A_1;
+		i2c.a_data_mask = RADEON_GPIO_A_0;
+		i2c.en_clk_mask = RADEON_GPIO_EN_1;
+		i2c.en_data_mask = RADEON_GPIO_EN_0;
+		i2c.y_clk_mask = RADEON_GPIO_Y_1;
+		i2c.y_data_mask = RADEON_GPIO_Y_0;
+
 		i2c.mask_clk_reg = ddc_line;
 		i2c.mask_data_reg = ddc_line;
 		i2c.a_clk_reg = ddc_line;
 		i2c.a_data_reg = ddc_line;
-		i2c.put_clk_reg = ddc_line;
-		i2c.put_data_reg = ddc_line;
-		i2c.get_clk_reg = ddc_line;
-		i2c.get_data_reg = ddc_line;
+		i2c.en_clk_reg = ddc_line;
+		i2c.en_data_reg = ddc_line;
+		i2c.y_clk_reg = ddc_line;
+		i2c.y_data_reg = ddc_line;
 	}
 
+	if (rdev->family < CHIP_R200)
+		i2c.hw_capable = false;
+	else {
+		switch (ddc_line) {
+		case RADEON_GPIO_VGA_DDC:
+		case RADEON_GPIO_DVI_DDC:
+			i2c.hw_capable = true;
+			break;
+		case RADEON_GPIO_MONID:
+			/* hw i2c on RADEON_GPIO_MONID doesn't seem to work
+			 * reliably on some pre-r4xx hardware; not sure why.
+			 */
+			i2c.hw_capable = false;
+			break;
+		default:
+			i2c.hw_capable = false;
+			break;
+		}
+	}
+	i2c.mm_i2c = false;
+	i2c.i2c_id = 0;
+
 	if (ddc_line)
 		i2c.valid = true;
 	else
@@ -495,7 +528,7 @@ bool radeon_combios_get_clock_info(struct drm_device *dev)
 	uint16_t sclk, mclk;
 
 	if (rdev->bios == NULL)
-		return NULL;
+		return false;
 
 	pll_info = combios_get_table_offset(dev, COMBIOS_PLL_INFO_TABLE);
 	if (pll_info) {
@@ -562,6 +595,48 @@ bool radeon_combios_get_clock_info(struct drm_device *dev)
 	return false;
 }
 
+bool radeon_combios_sideport_present(struct radeon_device *rdev)
+{
+	struct drm_device *dev = rdev->ddev;
+	u16 igp_info;
+
+	igp_info = combios_get_table_offset(dev, COMBIOS_INTEGRATED_SYSTEM_INFO_TABLE);
+
+	if (igp_info) {
+		if (RBIOS16(igp_info + 0x4))
+			return true;
+	}
+	return false;
+}
+
+static const uint32_t default_primarydac_adj[CHIP_LAST] = {
+	0x00000808,		/* r100  */
+	0x00000808,		/* rv100 */
+	0x00000808,		/* rs100 */
+	0x00000808,		/* rv200 */
+	0x00000808,		/* rs200 */
+	0x00000808,		/* r200  */
+	0x00000808,		/* rv250 */
+	0x00000000,		/* rs300 */
+	0x00000808,		/* rv280 */
+	0x00000808,		/* r300  */
+	0x00000808,		/* r350  */
+	0x00000808,		/* rv350 */
+	0x00000808,		/* rv380 */
+	0x00000808,		/* r420  */
+	0x00000808,		/* r423  */
+	0x00000808,		/* rv410 */
+	0x00000000,		/* rs400 */
+	0x00000000,		/* rs480 */
+};
+
+static void radeon_legacy_get_primary_dac_info_from_table(struct radeon_device *rdev,
+							  struct radeon_encoder_primary_dac *p_dac)
+{
+	p_dac->ps2_pdac_adj = default_primarydac_adj[rdev->family];
+	return;
+}
+
 struct radeon_encoder_primary_dac *radeon_combios_get_primary_dac_info(struct
 								       radeon_encoder
 								       *encoder)
@@ -571,20 +646,20 @@ struct radeon_encoder_primary_dac *radeon_combios_get_primary_dac_info(struct
 	uint16_t dac_info;
 	uint8_t rev, bg, dac;
 	struct radeon_encoder_primary_dac *p_dac = NULL;
+	int found = 0;
 
-	if (rdev->bios == NULL)
+	p_dac = kzalloc(sizeof(struct radeon_encoder_primary_dac),
+			GFP_KERNEL);
+
+	if (!p_dac)
 		return NULL;
 
+	if (rdev->bios == NULL)
+		goto out;
+
 	/* check CRT table */
 	dac_info = combios_get_table_offset(dev, COMBIOS_CRT_INFO_TABLE);
 	if (dac_info) {
-		p_dac =
-		    kzalloc(sizeof(struct radeon_encoder_primary_dac),
-			    GFP_KERNEL);
-
-		if (!p_dac)
-			return NULL;
-
 		rev = RBIOS8(dac_info) & 0x3;
 		if (rev < 2) {
 			bg = RBIOS8(dac_info + 0x2) & 0xf;
@@ -595,20 +670,26 @@ struct radeon_encoder_primary_dac *radeon_combios_get_primary_dac_info(struct
 			dac = RBIOS8(dac_info + 0x3) & 0xf;
 			p_dac->ps2_pdac_adj = (bg << 8) | (dac);
 		}
-
+		found = 1;
 	}
 
+out:
+	if (!found) /* fallback to defaults */
+		radeon_legacy_get_primary_dac_info_from_table(rdev, p_dac);
+
 	return p_dac;
 }
 
-static enum radeon_tv_std
-radeon_combios_get_tv_info(struct radeon_encoder *encoder)
+enum radeon_tv_std
+radeon_combios_get_tv_info(struct radeon_device *rdev)
 {
-	struct drm_device *dev = encoder->base.dev;
-	struct radeon_device *rdev = dev->dev_private;
+	struct drm_device *dev = rdev->ddev;
 	uint16_t tv_info;
 	enum radeon_tv_std tv_std = TV_STD_NTSC;
 
+	if (rdev->bios == NULL)
+		return tv_std;
+
 	tv_info = combios_get_table_offset(dev, COMBIOS_TV_INFO_TABLE);
 	if (tv_info) {
 		if (RBIOS8(tv_info + 6) == 'T') {
@@ -746,7 +827,7 @@ struct radeon_encoder_tv_dac *radeon_combios_get_tv_dac_info(struct
 			tv_dac->ntsc_tvdac_adj = (bg << 16) | (dac << 20);
 			found = 1;
 		}
-		tv_dac->tv_std = radeon_combios_get_tv_info(encoder);
+		tv_dac->tv_std = radeon_combios_get_tv_info(rdev);
 	}
 	if (!found) {
 		/* then check CRT table */
@@ -993,8 +1074,8 @@ static const struct radeon_tmds_pll default_tmds_pll[CHIP_LAST][4] = {
 	{{0xffffffff, 0xb01cb}, {0, 0}, {0, 0}, {0, 0}},	/* CHIP_R420  */
 	{{0xffffffff, 0xb01cb}, {0, 0}, {0, 0}, {0, 0}},	/* CHIP_R423  */
 	{{0xffffffff, 0xb01cb}, {0, 0}, {0, 0}, {0, 0}},	/* CHIP_RV410 */
-	{{15000, 0xb0155}, {0xffffffff, 0xb01cb}, {0, 0}, {0, 0}},	/* CHIP_RS400 */
-	{{15000, 0xb0155}, {0xffffffff, 0xb01cb}, {0, 0}, {0, 0}},	/* CHIP_RS480 */
+	{ {0, 0}, {0, 0}, {0, 0}, {0, 0} },	/* CHIP_RS400 */
+	{ {0, 0}, {0, 0}, {0, 0}, {0, 0} },	/* CHIP_RS480 */
 };
 
 bool radeon_legacy_get_tmds_info_from_table(struct radeon_encoder *encoder,
@@ -1028,7 +1109,6 @@ bool radeon_legacy_get_tmds_info_from_combios(struct radeon_encoder *encoder,
 	tmds_info = combios_get_table_offset(dev, COMBIOS_DFP_INFO_TABLE);
 
 	if (tmds_info) {
-
 		ver = RBIOS8(tmds_info);
 		DRM_INFO("DFP table revision: %d\n", ver);
 		if (ver == 3) {
@@ -1063,51 +1143,139 @@ bool radeon_legacy_get_tmds_info_from_combios(struct radeon_encoder *encoder,
 					  tmds->tmds_pll[i].value);
 			}
 		}
-	} else
+	} else {
 		DRM_INFO("No TMDS info found in BIOS\n");
+		return false;
+	}
 	return true;
 }
 
-struct radeon_encoder_int_tmds *radeon_combios_get_tmds_info(struct radeon_encoder *encoder)
+bool radeon_legacy_get_ext_tmds_info_from_table(struct radeon_encoder *encoder,
+						struct radeon_encoder_ext_tmds *tmds)
 {
-	struct radeon_encoder_int_tmds *tmds = NULL;
-	bool ret;
+	struct drm_device *dev = encoder->base.dev;
+	struct radeon_device *rdev = dev->dev_private;
+	struct radeon_i2c_bus_rec i2c_bus;
 
-	tmds = kzalloc(sizeof(struct radeon_encoder_int_tmds), GFP_KERNEL);
+	/* default for macs */
+	i2c_bus = combios_setup_i2c_bus(rdev, RADEON_GPIO_MONID);
+	tmds->i2c_bus = radeon_i2c_create(dev, &i2c_bus, "DVO");
 
-	if (!tmds)
-		return NULL;
-
-	ret = radeon_legacy_get_tmds_info_from_combios(encoder, tmds);
-	if (ret == false)
-		radeon_legacy_get_tmds_info_from_table(encoder, tmds);
+	/* XXX some macs have duallink chips */
+	switch (rdev->mode_info.connector_table) {
+	case CT_POWERBOOK_EXTERNAL:
+	case CT_MINI_EXTERNAL:
+	default:
+		tmds->dvo_chip = DVO_SIL164;
+		tmds->slave_addr = 0x70 >> 1; /* 7 bit addressing */
+		break;
+	}
 
-	return tmds;
+	return true;
 }
 
-void radeon_combios_get_ext_tmds_info(struct radeon_encoder *encoder)
+bool radeon_legacy_get_ext_tmds_info_from_combios(struct radeon_encoder *encoder,
+						  struct radeon_encoder_ext_tmds *tmds)
 {
 	struct drm_device *dev = encoder->base.dev;
 	struct radeon_device *rdev = dev->dev_private;
-	uint16_t ext_tmds_info;
-	uint8_t ver;
+	uint16_t offset;
+	uint8_t ver, id, blocks, clk, data;
+	int i;
+	enum radeon_combios_ddc gpio;
+	struct radeon_i2c_bus_rec i2c_bus;
 
 	if (rdev->bios == NULL)
-		return;
+		return false;
 
-	ext_tmds_info =
-	    combios_get_table_offset(dev, COMBIOS_EXT_TMDS_INFO_TABLE);
-	if (ext_tmds_info) {
-		ver = RBIOS8(ext_tmds_info);
-		DRM_INFO("External TMDS Table revision: %d\n", ver);
-		// TODO
+	tmds->i2c_bus = NULL;
+	if (rdev->flags & RADEON_IS_IGP) {
+		offset = combios_get_table_offset(dev, COMBIOS_I2C_INFO_TABLE);
+		if (offset) {
+			ver = RBIOS8(offset);
+			DRM_INFO("GPIO Table revision: %d\n", ver);
+			blocks = RBIOS8(offset + 2);
+			for (i = 0; i < blocks; i++) {
+				id = RBIOS8(offset + 3 + (i * 5) + 0);
+				if (id == 136) {
+					clk = RBIOS8(offset + 3 + (i * 5) + 3);
+					data = RBIOS8(offset + 3 + (i * 5) + 4);
+					i2c_bus.valid = true;
+					i2c_bus.mask_clk_mask = (1 << clk);
+					i2c_bus.mask_data_mask = (1 << data);
+					i2c_bus.a_clk_mask = (1 << clk);
+					i2c_bus.a_data_mask = (1 << data);
+					i2c_bus.en_clk_mask = (1 << clk);
+					i2c_bus.en_data_mask = (1 << data);
+					i2c_bus.y_clk_mask = (1 << clk);
+					i2c_bus.y_data_mask = (1 << data);
+					i2c_bus.mask_clk_reg = RADEON_GPIOPAD_MASK;
+					i2c_bus.mask_data_reg = RADEON_GPIOPAD_MASK;
+					i2c_bus.a_clk_reg = RADEON_GPIOPAD_A;
+					i2c_bus.a_data_reg = RADEON_GPIOPAD_A;
+					i2c_bus.en_clk_reg = RADEON_GPIOPAD_EN;
+					i2c_bus.en_data_reg = RADEON_GPIOPAD_EN;
+					i2c_bus.y_clk_reg = RADEON_GPIOPAD_Y;
+					i2c_bus.y_data_reg = RADEON_GPIOPAD_Y;
+					tmds->i2c_bus = radeon_i2c_create(dev, &i2c_bus, "DVO");
+					tmds->dvo_chip = DVO_SIL164;
+					tmds->slave_addr = 0x70 >> 1; /* 7 bit addressing */
+					break;
+				}
+			}
+		}
+	} else {
+		offset = combios_get_table_offset(dev, COMBIOS_EXT_TMDS_INFO_TABLE);
+		if (offset) {
+			ver = RBIOS8(offset);
+			DRM_INFO("External TMDS Table revision: %d\n", ver);
+			tmds->slave_addr = RBIOS8(offset + 4 + 2);
+			tmds->slave_addr >>= 1; /* 7 bit addressing */
+			gpio = RBIOS8(offset + 4 + 3);
+			switch (gpio) {
+			case DDC_MONID:
+				i2c_bus = combios_setup_i2c_bus(rdev, RADEON_GPIO_MONID);
+				tmds->i2c_bus = radeon_i2c_create(dev, &i2c_bus, "DVO");
+				break;
+			case DDC_DVI:
+				i2c_bus = combios_setup_i2c_bus(rdev, RADEON_GPIO_DVI_DDC);
+				tmds->i2c_bus = radeon_i2c_create(dev, &i2c_bus, "DVO");
+				break;
+			case DDC_VGA:
+				i2c_bus = combios_setup_i2c_bus(rdev, RADEON_GPIO_VGA_DDC);
+				tmds->i2c_bus = radeon_i2c_create(dev, &i2c_bus, "DVO");
+				break;
+			case DDC_CRT2:
+				/* R3xx+ chips don't have GPIO_CRT2_DDC gpio pad */
+				if (rdev->family >= CHIP_R300)
+					i2c_bus = combios_setup_i2c_bus(rdev, RADEON_GPIO_MONID);
+				else
+					i2c_bus = combios_setup_i2c_bus(rdev, RADEON_GPIO_CRT2_DDC);
+				tmds->i2c_bus = radeon_i2c_create(dev, &i2c_bus, "DVO");
+				break;
+			case DDC_LCD: /* MM i2c */
+				DRM_ERROR("MM i2c requires hw i2c engine\n");
+				break;
+			default:
+				DRM_ERROR("Unsupported gpio %d\n", gpio);
+				break;
+			}
+		}
 	}
+
+	if (!tmds->i2c_bus) {
+		DRM_INFO("No valid Ext TMDS info found in BIOS\n");
+		return false;
+	}
+
+	return true;
 }
 
 bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
 {
 	struct radeon_device *rdev = dev->dev_private;
 	struct radeon_i2c_bus_rec ddc_i2c;
+	struct radeon_hpd hpd;
 
 	rdev->mode_info.connector_table = radeon_connector_table;
 	if (rdev->mode_info.connector_table == CT_NONE) {
@@ -1168,7 +1336,8 @@ bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
 		/* these are the most common settings */
 		if (rdev->flags & RADEON_SINGLE_CRTC) {
 			/* VGA - primary dac */
-			ddc_i2c = combios_setup_i2c_bus(RADEON_GPIO_VGA_DDC);
+			ddc_i2c = combios_setup_i2c_bus(rdev, RADEON_GPIO_VGA_DDC);
+			hpd.hpd = RADEON_HPD_NONE;
 			radeon_add_legacy_encoder(dev,
 						  radeon_get_encoder_id(dev,
 									ATOM_DEVICE_CRT1_SUPPORT,
@@ -1178,10 +1347,12 @@ bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
 						    ATOM_DEVICE_CRT1_SUPPORT,
 						    DRM_MODE_CONNECTOR_VGA,
 						    &ddc_i2c,
-						    CONNECTOR_OBJECT_ID_VGA);
+						    CONNECTOR_OBJECT_ID_VGA,
+						    &hpd);
 		} else if (rdev->flags & RADEON_IS_MOBILITY) {
 			/* LVDS */
-			ddc_i2c = combios_setup_i2c_bus(RADEON_LCD_GPIO_MASK);
+			ddc_i2c = combios_setup_i2c_bus(rdev, 0);
+			hpd.hpd = RADEON_HPD_NONE;
 			radeon_add_legacy_encoder(dev,
 						  radeon_get_encoder_id(dev,
 									ATOM_DEVICE_LCD1_SUPPORT,
@@ -1191,10 +1362,12 @@ bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
 						    ATOM_DEVICE_LCD1_SUPPORT,
 						    DRM_MODE_CONNECTOR_LVDS,
 						    &ddc_i2c,
-						    CONNECTOR_OBJECT_ID_LVDS);
+						    CONNECTOR_OBJECT_ID_LVDS,
+						    &hpd);
 
 			/* VGA - primary dac */
-			ddc_i2c = combios_setup_i2c_bus(RADEON_GPIO_VGA_DDC);
+			ddc_i2c = combios_setup_i2c_bus(rdev, RADEON_GPIO_VGA_DDC);
+			hpd.hpd = RADEON_HPD_NONE;
 			radeon_add_legacy_encoder(dev,
 						  radeon_get_encoder_id(dev,
 									ATOM_DEVICE_CRT1_SUPPORT,
@@ -1204,10 +1377,12 @@ bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
 						    ATOM_DEVICE_CRT1_SUPPORT,
 						    DRM_MODE_CONNECTOR_VGA,
 						    &ddc_i2c,
-						    CONNECTOR_OBJECT_ID_VGA);
+						    CONNECTOR_OBJECT_ID_VGA,
+						    &hpd);
 		} else {
 			/* DVI-I - tv dac, int tmds */
-			ddc_i2c = combios_setup_i2c_bus(RADEON_GPIO_DVI_DDC);
+			ddc_i2c = combios_setup_i2c_bus(rdev, RADEON_GPIO_DVI_DDC);
+			hpd.hpd = RADEON_HPD_1;
 			radeon_add_legacy_encoder(dev,
 						  radeon_get_encoder_id(dev,
 									ATOM_DEVICE_DFP1_SUPPORT,
@@ -1223,10 +1398,12 @@ bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
 						    ATOM_DEVICE_CRT2_SUPPORT,
 						    DRM_MODE_CONNECTOR_DVII,
 						    &ddc_i2c,
-						    CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_I);
+						    CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_I,
+						    &hpd);
 
 			/* VGA - primary dac */
-			ddc_i2c = combios_setup_i2c_bus(RADEON_GPIO_VGA_DDC);
+			ddc_i2c = combios_setup_i2c_bus(rdev, RADEON_GPIO_VGA_DDC);
+			hpd.hpd = RADEON_HPD_NONE;
 			radeon_add_legacy_encoder(dev,
 						  radeon_get_encoder_id(dev,
 									ATOM_DEVICE_CRT1_SUPPORT,
@@ -1236,11 +1413,14 @@ bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
 						    ATOM_DEVICE_CRT1_SUPPORT,
 						    DRM_MODE_CONNECTOR_VGA,
 						    &ddc_i2c,
-						    CONNECTOR_OBJECT_ID_VGA);
+						    CONNECTOR_OBJECT_ID_VGA,
+						    &hpd);
 		}
 
 		if (rdev->family != CHIP_R100 && rdev->family != CHIP_R200) {
 			/* TV - tv dac */
+			ddc_i2c.valid = false;
+			hpd.hpd = RADEON_HPD_NONE;
 			radeon_add_legacy_encoder(dev,
 						  radeon_get_encoder_id(dev,
 									ATOM_DEVICE_TV1_SUPPORT,
@@ -1250,14 +1430,16 @@ bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
 						    ATOM_DEVICE_TV1_SUPPORT,
 						    DRM_MODE_CONNECTOR_SVIDEO,
 						    &ddc_i2c,
-						    CONNECTOR_OBJECT_ID_SVIDEO);
+						    CONNECTOR_OBJECT_ID_SVIDEO,
+						    &hpd);
 		}
 		break;
 	case CT_IBOOK:
 		DRM_INFO("Connector Table: %d (ibook)\n",
 			 rdev->mode_info.connector_table);
 		/* LVDS */
-		ddc_i2c = combios_setup_i2c_bus(RADEON_GPIO_DVI_DDC);
+		ddc_i2c = combios_setup_i2c_bus(rdev, RADEON_GPIO_DVI_DDC);
+		hpd.hpd = RADEON_HPD_NONE;
 		radeon_add_legacy_encoder(dev,
 					  radeon_get_encoder_id(dev,
 								ATOM_DEVICE_LCD1_SUPPORT,
@@ -1265,9 +1447,11 @@ bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
 					  ATOM_DEVICE_LCD1_SUPPORT);
 		radeon_add_legacy_connector(dev, 0, ATOM_DEVICE_LCD1_SUPPORT,
 					    DRM_MODE_CONNECTOR_LVDS, &ddc_i2c,
-					    CONNECTOR_OBJECT_ID_LVDS);
+					    CONNECTOR_OBJECT_ID_LVDS,
+					    &hpd);
 		/* VGA - TV DAC */
-		ddc_i2c = combios_setup_i2c_bus(RADEON_GPIO_VGA_DDC);
+		ddc_i2c = combios_setup_i2c_bus(rdev, RADEON_GPIO_VGA_DDC);
+		hpd.hpd = RADEON_HPD_NONE;
 		radeon_add_legacy_encoder(dev,
 					  radeon_get_encoder_id(dev,
 								ATOM_DEVICE_CRT2_SUPPORT,
@@ -1275,8 +1459,11 @@ bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
 					  ATOM_DEVICE_CRT2_SUPPORT);
 		radeon_add_legacy_connector(dev, 1, ATOM_DEVICE_CRT2_SUPPORT,
 					    DRM_MODE_CONNECTOR_VGA, &ddc_i2c,
-					    CONNECTOR_OBJECT_ID_VGA);
+					    CONNECTOR_OBJECT_ID_VGA,
+					    &hpd);
 		/* TV - TV DAC */
+		ddc_i2c.valid = false;
+		hpd.hpd = RADEON_HPD_NONE;
 		radeon_add_legacy_encoder(dev,
 					  radeon_get_encoder_id(dev,
 								ATOM_DEVICE_TV1_SUPPORT,
@@ -1285,13 +1472,15 @@ bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
 		radeon_add_legacy_connector(dev, 2, ATOM_DEVICE_TV1_SUPPORT,
 					    DRM_MODE_CONNECTOR_SVIDEO,
 					    &ddc_i2c,
-					    CONNECTOR_OBJECT_ID_SVIDEO);
+					    CONNECTOR_OBJECT_ID_SVIDEO,
+					    &hpd);
 		break;
 	case CT_POWERBOOK_EXTERNAL:
 		DRM_INFO("Connector Table: %d (powerbook external tmds)\n",
 			 rdev->mode_info.connector_table);
 		/* LVDS */
-		ddc_i2c = combios_setup_i2c_bus(RADEON_GPIO_DVI_DDC);
+		ddc_i2c = combios_setup_i2c_bus(rdev, RADEON_GPIO_DVI_DDC);
+		hpd.hpd = RADEON_HPD_NONE;
 		radeon_add_legacy_encoder(dev,
 					  radeon_get_encoder_id(dev,
 								ATOM_DEVICE_LCD1_SUPPORT,
@@ -1299,9 +1488,11 @@ bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
 					  ATOM_DEVICE_LCD1_SUPPORT);
 		radeon_add_legacy_connector(dev, 0, ATOM_DEVICE_LCD1_SUPPORT,
 					    DRM_MODE_CONNECTOR_LVDS, &ddc_i2c,
-					    CONNECTOR_OBJECT_ID_LVDS);
+					    CONNECTOR_OBJECT_ID_LVDS,
+					    &hpd);
 		/* DVI-I - primary dac, ext tmds */
-		ddc_i2c = combios_setup_i2c_bus(RADEON_GPIO_VGA_DDC);
+		ddc_i2c = combios_setup_i2c_bus(rdev, RADEON_GPIO_VGA_DDC);
+		hpd.hpd = RADEON_HPD_2; /* ??? */
 		radeon_add_legacy_encoder(dev,
 					  radeon_get_encoder_id(dev,
 								ATOM_DEVICE_DFP2_SUPPORT,
@@ -1317,8 +1508,11 @@ bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
 					    ATOM_DEVICE_DFP2_SUPPORT |
 					    ATOM_DEVICE_CRT1_SUPPORT,
 					    DRM_MODE_CONNECTOR_DVII, &ddc_i2c,
-					    CONNECTOR_OBJECT_ID_DUAL_LINK_DVI_I);
+					    CONNECTOR_OBJECT_ID_DUAL_LINK_DVI_I,
+					    &hpd);
 		/* TV - TV DAC */
+		ddc_i2c.valid = false;
+		hpd.hpd = RADEON_HPD_NONE;
 		radeon_add_legacy_encoder(dev,
 					  radeon_get_encoder_id(dev,
 								ATOM_DEVICE_TV1_SUPPORT,
@@ -1327,13 +1521,15 @@ bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
 		radeon_add_legacy_connector(dev, 2, ATOM_DEVICE_TV1_SUPPORT,
 					    DRM_MODE_CONNECTOR_SVIDEO,
 					    &ddc_i2c,
-					    CONNECTOR_OBJECT_ID_SVIDEO);
+					    CONNECTOR_OBJECT_ID_SVIDEO,
+					    &hpd);
 		break;
 	case CT_POWERBOOK_INTERNAL:
 		DRM_INFO("Connector Table: %d (powerbook internal tmds)\n",
 			 rdev->mode_info.connector_table);
 		/* LVDS */
-		ddc_i2c = combios_setup_i2c_bus(RADEON_GPIO_DVI_DDC);
+		ddc_i2c = combios_setup_i2c_bus(rdev, RADEON_GPIO_DVI_DDC);
+		hpd.hpd = RADEON_HPD_NONE;
 		radeon_add_legacy_encoder(dev,
 					  radeon_get_encoder_id(dev,
 								ATOM_DEVICE_LCD1_SUPPORT,
@@ -1341,9 +1537,11 @@ bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
 					  ATOM_DEVICE_LCD1_SUPPORT);
 		radeon_add_legacy_connector(dev, 0, ATOM_DEVICE_LCD1_SUPPORT,
 					    DRM_MODE_CONNECTOR_LVDS, &ddc_i2c,
-					    CONNECTOR_OBJECT_ID_LVDS);
+					    CONNECTOR_OBJECT_ID_LVDS,
+					    &hpd);
 		/* DVI-I - primary dac, int tmds */
-		ddc_i2c = combios_setup_i2c_bus(RADEON_GPIO_VGA_DDC);
+		ddc_i2c = combios_setup_i2c_bus(rdev, RADEON_GPIO_VGA_DDC);
+		hpd.hpd = RADEON_HPD_1; /* ??? */
 		radeon_add_legacy_encoder(dev,
 					  radeon_get_encoder_id(dev,
 								ATOM_DEVICE_DFP1_SUPPORT,
@@ -1358,8 +1556,11 @@ bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
 					    ATOM_DEVICE_DFP1_SUPPORT |
 					    ATOM_DEVICE_CRT1_SUPPORT,
 					    DRM_MODE_CONNECTOR_DVII, &ddc_i2c,
-					    CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_I);
+					    CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_I,
+					    &hpd);
 		/* TV - TV DAC */
+		ddc_i2c.valid = false;
+		hpd.hpd = RADEON_HPD_NONE;
 		radeon_add_legacy_encoder(dev,
 					  radeon_get_encoder_id(dev,
 								ATOM_DEVICE_TV1_SUPPORT,
@@ -1368,13 +1569,15 @@ bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
 		radeon_add_legacy_connector(dev, 2, ATOM_DEVICE_TV1_SUPPORT,
 					    DRM_MODE_CONNECTOR_SVIDEO,
 					    &ddc_i2c,
-					    CONNECTOR_OBJECT_ID_SVIDEO);
+					    CONNECTOR_OBJECT_ID_SVIDEO,
+					    &hpd);
 		break;
 	case CT_POWERBOOK_VGA:
 		DRM_INFO("Connector Table: %d (powerbook vga)\n",
 			 rdev->mode_info.connector_table);
 		/* LVDS */
-		ddc_i2c = combios_setup_i2c_bus(RADEON_GPIO_DVI_DDC);
+		ddc_i2c = combios_setup_i2c_bus(rdev, RADEON_GPIO_DVI_DDC);
+		hpd.hpd = RADEON_HPD_NONE;
 		radeon_add_legacy_encoder(dev,
 					  radeon_get_encoder_id(dev,
 								ATOM_DEVICE_LCD1_SUPPORT,
@@ -1382,9 +1585,11 @@ bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
 					  ATOM_DEVICE_LCD1_SUPPORT);
 		radeon_add_legacy_connector(dev, 0, ATOM_DEVICE_LCD1_SUPPORT,
 					    DRM_MODE_CONNECTOR_LVDS, &ddc_i2c,
-					    CONNECTOR_OBJECT_ID_LVDS);
+					    CONNECTOR_OBJECT_ID_LVDS,
+					    &hpd);
 		/* VGA - primary dac */
-		ddc_i2c = combios_setup_i2c_bus(RADEON_GPIO_VGA_DDC);
+		ddc_i2c = combios_setup_i2c_bus(rdev, RADEON_GPIO_VGA_DDC);
+		hpd.hpd = RADEON_HPD_NONE;
 		radeon_add_legacy_encoder(dev,
 					  radeon_get_encoder_id(dev,
 								ATOM_DEVICE_CRT1_SUPPORT,
@@ -1392,8 +1597,11 @@ bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
 					  ATOM_DEVICE_CRT1_SUPPORT);
 		radeon_add_legacy_connector(dev, 1, ATOM_DEVICE_CRT1_SUPPORT,
 					    DRM_MODE_CONNECTOR_VGA, &ddc_i2c,
-					    CONNECTOR_OBJECT_ID_VGA);
+					    CONNECTOR_OBJECT_ID_VGA,
+					    &hpd);
 		/* TV - TV DAC */
+		ddc_i2c.valid = false;
+		hpd.hpd = RADEON_HPD_NONE;
 		radeon_add_legacy_encoder(dev,
 					  radeon_get_encoder_id(dev,
 								ATOM_DEVICE_TV1_SUPPORT,
@@ -1402,13 +1610,15 @@ bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
 		radeon_add_legacy_connector(dev, 2, ATOM_DEVICE_TV1_SUPPORT,
 					    DRM_MODE_CONNECTOR_SVIDEO,
 					    &ddc_i2c,
-					    CONNECTOR_OBJECT_ID_SVIDEO);
+					    CONNECTOR_OBJECT_ID_SVIDEO,
+					    &hpd);
 		break;
 	case CT_MINI_EXTERNAL:
 		DRM_INFO("Connector Table: %d (mini external tmds)\n",
 			 rdev->mode_info.connector_table);
 		/* DVI-I - tv dac, ext tmds */
-		ddc_i2c = combios_setup_i2c_bus(RADEON_GPIO_CRT2_DDC);
+		ddc_i2c = combios_setup_i2c_bus(rdev, RADEON_GPIO_CRT2_DDC);
+		hpd.hpd = RADEON_HPD_2; /* ??? */
 		radeon_add_legacy_encoder(dev,
 					  radeon_get_encoder_id(dev,
 								ATOM_DEVICE_DFP2_SUPPORT,
@@ -1424,8 +1634,11 @@ bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
 					    ATOM_DEVICE_DFP2_SUPPORT |
 					    ATOM_DEVICE_CRT2_SUPPORT,
 					    DRM_MODE_CONNECTOR_DVII, &ddc_i2c,
-					    CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_I);
+					    CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_I,
+					    &hpd);
 		/* TV - TV DAC */
+		ddc_i2c.valid = false;
+		hpd.hpd = RADEON_HPD_NONE;
 		radeon_add_legacy_encoder(dev,
 					  radeon_get_encoder_id(dev,
 								ATOM_DEVICE_TV1_SUPPORT,
@@ -1434,13 +1647,15 @@ bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
 		radeon_add_legacy_connector(dev, 1, ATOM_DEVICE_TV1_SUPPORT,
 					    DRM_MODE_CONNECTOR_SVIDEO,
 					    &ddc_i2c,
-					    CONNECTOR_OBJECT_ID_SVIDEO);
+					    CONNECTOR_OBJECT_ID_SVIDEO,
+					    &hpd);
 		break;
 	case CT_MINI_INTERNAL:
 		DRM_INFO("Connector Table: %d (mini internal tmds)\n",
 			 rdev->mode_info.connector_table);
 		/* DVI-I - tv dac, int tmds */
-		ddc_i2c = combios_setup_i2c_bus(RADEON_GPIO_CRT2_DDC);
+		ddc_i2c = combios_setup_i2c_bus(rdev, RADEON_GPIO_CRT2_DDC);
+		hpd.hpd = RADEON_HPD_1; /* ??? */
 		radeon_add_legacy_encoder(dev,
 					  radeon_get_encoder_id(dev,
 								ATOM_DEVICE_DFP1_SUPPORT,
@@ -1455,8 +1670,11 @@ bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
 					    ATOM_DEVICE_DFP1_SUPPORT |
 					    ATOM_DEVICE_CRT2_SUPPORT,
 					    DRM_MODE_CONNECTOR_DVII, &ddc_i2c,
-					    CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_I);
+					    CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_I,
+					    &hpd);
 		/* TV - TV DAC */
+		ddc_i2c.valid = false;
+		hpd.hpd = RADEON_HPD_NONE;
 		radeon_add_legacy_encoder(dev,
 					  radeon_get_encoder_id(dev,
 								ATOM_DEVICE_TV1_SUPPORT,
@@ -1465,13 +1683,15 @@ bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
 		radeon_add_legacy_connector(dev, 1, ATOM_DEVICE_TV1_SUPPORT,
 					    DRM_MODE_CONNECTOR_SVIDEO,
 					    &ddc_i2c,
-					    CONNECTOR_OBJECT_ID_SVIDEO);
+					    CONNECTOR_OBJECT_ID_SVIDEO,
+					    &hpd);
 		break;
 	case CT_IMAC_G5_ISIGHT:
 		DRM_INFO("Connector Table: %d (imac g5 isight)\n",
 			 rdev->mode_info.connector_table);
 		/* DVI-D - int tmds */
-		ddc_i2c = combios_setup_i2c_bus(RADEON_GPIO_MONID);
+		ddc_i2c = combios_setup_i2c_bus(rdev, RADEON_GPIO_MONID);
+		hpd.hpd = RADEON_HPD_1; /* ??? */
 		radeon_add_legacy_encoder(dev,
 					  radeon_get_encoder_id(dev,
 								ATOM_DEVICE_DFP1_SUPPORT,
@@ -1479,9 +1699,11 @@ bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
 					  ATOM_DEVICE_DFP1_SUPPORT);
 		radeon_add_legacy_connector(dev, 0, ATOM_DEVICE_DFP1_SUPPORT,
 					    DRM_MODE_CONNECTOR_DVID, &ddc_i2c,
-					    CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_D);
+					    CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_D,
+					    &hpd);
 		/* VGA - tv dac */
-		ddc_i2c = combios_setup_i2c_bus(RADEON_GPIO_DVI_DDC);
+		ddc_i2c = combios_setup_i2c_bus(rdev, RADEON_GPIO_DVI_DDC);
+		hpd.hpd = RADEON_HPD_NONE;
 		radeon_add_legacy_encoder(dev,
 					  radeon_get_encoder_id(dev,
 								ATOM_DEVICE_CRT2_SUPPORT,
@@ -1489,8 +1711,11 @@ bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
 					  ATOM_DEVICE_CRT2_SUPPORT);
 		radeon_add_legacy_connector(dev, 1, ATOM_DEVICE_CRT2_SUPPORT,
 					    DRM_MODE_CONNECTOR_VGA, &ddc_i2c,
-					    CONNECTOR_OBJECT_ID_VGA);
+					    CONNECTOR_OBJECT_ID_VGA,
+					    &hpd);
 		/* TV - TV DAC */
+		ddc_i2c.valid = false;
+		hpd.hpd = RADEON_HPD_NONE;
 		radeon_add_legacy_encoder(dev,
 					  radeon_get_encoder_id(dev,
 								ATOM_DEVICE_TV1_SUPPORT,
@@ -1499,13 +1724,15 @@ bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
 		radeon_add_legacy_connector(dev, 2, ATOM_DEVICE_TV1_SUPPORT,
 					    DRM_MODE_CONNECTOR_SVIDEO,
 					    &ddc_i2c,
-					    CONNECTOR_OBJECT_ID_SVIDEO);
+					    CONNECTOR_OBJECT_ID_SVIDEO,
+					    &hpd);
 		break;
 	case CT_EMAC:
 		DRM_INFO("Connector Table: %d (emac)\n",
 			 rdev->mode_info.connector_table);
 		/* VGA - primary dac */
-		ddc_i2c = combios_setup_i2c_bus(RADEON_GPIO_VGA_DDC);
+		ddc_i2c = combios_setup_i2c_bus(rdev, RADEON_GPIO_VGA_DDC);
+		hpd.hpd = RADEON_HPD_NONE;
 		radeon_add_legacy_encoder(dev,
 					  radeon_get_encoder_id(dev,
 								ATOM_DEVICE_CRT1_SUPPORT,
@@ -1513,9 +1740,11 @@ bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
 					  ATOM_DEVICE_CRT1_SUPPORT);
 		radeon_add_legacy_connector(dev, 0, ATOM_DEVICE_CRT1_SUPPORT,
 					    DRM_MODE_CONNECTOR_VGA, &ddc_i2c,
-					    CONNECTOR_OBJECT_ID_VGA);
+					    CONNECTOR_OBJECT_ID_VGA,
+					    &hpd);
 		/* VGA - tv dac */
-		ddc_i2c = combios_setup_i2c_bus(RADEON_GPIO_CRT2_DDC);
+		ddc_i2c = combios_setup_i2c_bus(rdev, RADEON_GPIO_CRT2_DDC);
+		hpd.hpd = RADEON_HPD_NONE;
 		radeon_add_legacy_encoder(dev,
 					  radeon_get_encoder_id(dev,
 								ATOM_DEVICE_CRT2_SUPPORT,
@@ -1523,8 +1752,11 @@ bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
 					  ATOM_DEVICE_CRT2_SUPPORT);
 		radeon_add_legacy_connector(dev, 1, ATOM_DEVICE_CRT2_SUPPORT,
 					    DRM_MODE_CONNECTOR_VGA, &ddc_i2c,
-					    CONNECTOR_OBJECT_ID_VGA);
+					    CONNECTOR_OBJECT_ID_VGA,
+					    &hpd);
 		/* TV - TV DAC */
+		ddc_i2c.valid = false;
+		hpd.hpd = RADEON_HPD_NONE;
 		radeon_add_legacy_encoder(dev,
 					  radeon_get_encoder_id(dev,
 								ATOM_DEVICE_TV1_SUPPORT,
@@ -1533,7 +1765,8 @@ bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
 		radeon_add_legacy_connector(dev, 2, ATOM_DEVICE_TV1_SUPPORT,
 					    DRM_MODE_CONNECTOR_SVIDEO,
 					    &ddc_i2c,
-					    CONNECTOR_OBJECT_ID_SVIDEO);
+					    CONNECTOR_OBJECT_ID_SVIDEO,
+					    &hpd);
 		break;
 	default:
 		DRM_INFO("Connector table: %d (invalid)\n",
@@ -1550,7 +1783,8 @@ static bool radeon_apply_legacy_quirks(struct drm_device *dev,
 				       int bios_index,
 				       enum radeon_combios_connector
 				       *legacy_connector,
-				       struct radeon_i2c_bus_rec *ddc_i2c)
+				       struct radeon_i2c_bus_rec *ddc_i2c,
+				       struct radeon_hpd *hpd)
 {
 	struct radeon_device *rdev = dev->dev_private;
 
@@ -1558,29 +1792,26 @@ static bool radeon_apply_legacy_quirks(struct drm_device *dev,
 	if ((rdev->family == CHIP_RS400 ||
 	     rdev->family == CHIP_RS480) &&
 	    ddc_i2c->mask_clk_reg == RADEON_GPIO_CRT2_DDC)
-		*ddc_i2c = combios_setup_i2c_bus(RADEON_GPIO_MONID);
+		*ddc_i2c = combios_setup_i2c_bus(rdev, RADEON_GPIO_MONID);
 	else if ((rdev->family == CHIP_RS400 ||
 		  rdev->family == CHIP_RS480) &&
 		 ddc_i2c->mask_clk_reg == RADEON_GPIO_MONID) {
-		ddc_i2c->valid = true;
+		*ddc_i2c = combios_setup_i2c_bus(rdev, RADEON_GPIOPAD_MASK);
 		ddc_i2c->mask_clk_mask = (0x20 << 8);
 		ddc_i2c->mask_data_mask = 0x80;
 		ddc_i2c->a_clk_mask = (0x20 << 8);
 		ddc_i2c->a_data_mask = 0x80;
-		ddc_i2c->put_clk_mask = (0x20 << 8);
-		ddc_i2c->put_data_mask = 0x80;
-		ddc_i2c->get_clk_mask = (0x20 << 8);
-		ddc_i2c->get_data_mask = 0x80;
-		ddc_i2c->mask_clk_reg = RADEON_GPIOPAD_MASK;
-		ddc_i2c->mask_data_reg = RADEON_GPIOPAD_MASK;
-		ddc_i2c->a_clk_reg = RADEON_GPIOPAD_A;
-		ddc_i2c->a_data_reg = RADEON_GPIOPAD_A;
-		ddc_i2c->put_clk_reg = RADEON_GPIOPAD_EN;
-		ddc_i2c->put_data_reg = RADEON_GPIOPAD_EN;
-		ddc_i2c->get_clk_reg = RADEON_LCD_GPIO_Y_REG;
-		ddc_i2c->get_data_reg = RADEON_LCD_GPIO_Y_REG;
+		ddc_i2c->en_clk_mask = (0x20 << 8);
+		ddc_i2c->en_data_mask = 0x80;
+		ddc_i2c->y_clk_mask = (0x20 << 8);
+		ddc_i2c->y_data_mask = 0x80;
 	}
 
+	/* R3xx+ chips don't have GPIO_CRT2_DDC gpio pad */
+	if ((rdev->family >= CHIP_R300) &&
+	    ddc_i2c->mask_clk_reg == RADEON_GPIO_CRT2_DDC)
+		*ddc_i2c = combios_setup_i2c_bus(rdev, RADEON_GPIO_DVI_DDC);
+
 	/* Certain IBM chipset RN50s have a BIOS reporting two VGAs,
 	   one with VGA DDC and one with CRT2 DDC. - kill the CRT2 DDC one */
 	if (dev->pdev->device == 0x515e &&
@@ -1624,6 +1855,12 @@ static bool radeon_apply_legacy_tv_quirks(struct drm_device *dev)
 	    dev->pdev->subsystem_device == 0x280a)
 		return false;
 
+	/* MSI S270 has non-existent TV port */
+	if (dev->pdev->device == 0x5955 &&
+	    dev->pdev->subsystem_vendor == 0x1462 &&
+	    dev->pdev->subsystem_device == 0x0131)
+		return false;
+
 	return true;
 }
 
@@ -1671,6 +1908,7 @@ bool radeon_get_legacy_connector_info_from_bios(struct drm_device *dev)
 	enum radeon_combios_connector connector;
 	int i = 0;
 	struct radeon_i2c_bus_rec ddc_i2c;
+	struct radeon_hpd hpd;
 
 	if (rdev->bios == NULL)
 		return false;
@@ -1691,26 +1929,40 @@ bool radeon_get_legacy_connector_info_from_bios(struct drm_device *dev)
 			switch (ddc_type) {
 			case DDC_MONID:
 				ddc_i2c =
-				    combios_setup_i2c_bus(RADEON_GPIO_MONID);
+					combios_setup_i2c_bus(rdev, RADEON_GPIO_MONID);
 				break;
 			case DDC_DVI:
 				ddc_i2c =
-				    combios_setup_i2c_bus(RADEON_GPIO_DVI_DDC);
+					combios_setup_i2c_bus(rdev, RADEON_GPIO_DVI_DDC);
 				break;
 			case DDC_VGA:
 				ddc_i2c =
-				    combios_setup_i2c_bus(RADEON_GPIO_VGA_DDC);
+					combios_setup_i2c_bus(rdev, RADEON_GPIO_VGA_DDC);
 				break;
 			case DDC_CRT2:
 				ddc_i2c =
-				    combios_setup_i2c_bus(RADEON_GPIO_CRT2_DDC);
+					combios_setup_i2c_bus(rdev, RADEON_GPIO_CRT2_DDC);
+				break;
+			default:
+				break;
+			}
+
+			switch (connector) {
+			case CONNECTOR_PROPRIETARY_LEGACY:
+			case CONNECTOR_DVI_I_LEGACY:
+			case CONNECTOR_DVI_D_LEGACY:
+				if ((tmp >> 4) & 0x1)
+					hpd.hpd = RADEON_HPD_2;
+				else
+					hpd.hpd = RADEON_HPD_1;
 				break;
 			default:
+				hpd.hpd = RADEON_HPD_NONE;
 				break;
 			}
 
 			if (!radeon_apply_legacy_quirks(dev, i, &connector,
-						       &ddc_i2c))
+							&ddc_i2c, &hpd))
 				continue;
 
 			switch (connector) {
@@ -1727,7 +1979,8 @@ bool radeon_get_legacy_connector_info_from_bios(struct drm_device *dev)
 							    legacy_connector_convert
 							    [connector],
 							    &ddc_i2c,
-							    CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_D);
+							    CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_D,
+							    &hpd);
 				break;
 			case CONNECTOR_CRT_LEGACY:
 				if (tmp & 0x1) {
@@ -1753,7 +2006,8 @@ bool radeon_get_legacy_connector_info_from_bios(struct drm_device *dev)
 							    legacy_connector_convert
 							    [connector],
 							    &ddc_i2c,
-							    CONNECTOR_OBJECT_ID_VGA);
+							    CONNECTOR_OBJECT_ID_VGA,
+							    &hpd);
 				break;
 			case CONNECTOR_DVI_I_LEGACY:
 				devices = 0;
@@ -1799,7 +2053,8 @@ bool radeon_get_legacy_connector_info_from_bios(struct drm_device *dev)
 							    legacy_connector_convert
 							    [connector],
 							    &ddc_i2c,
-							    connector_object_id);
+							    connector_object_id,
+							    &hpd);
 				break;
 			case CONNECTOR_DVI_D_LEGACY:
 				if ((tmp >> 4) & 0x1) {
@@ -1817,7 +2072,8 @@ bool radeon_get_legacy_connector_info_from_bios(struct drm_device *dev)
 							    legacy_connector_convert
 							    [connector],
 							    &ddc_i2c,
-							    connector_object_id);
+							    connector_object_id,
+							    &hpd);
 				break;
 			case CONNECTOR_CTV_LEGACY:
 			case CONNECTOR_STV_LEGACY:
@@ -1832,7 +2088,8 @@ bool radeon_get_legacy_connector_info_from_bios(struct drm_device *dev)
 							    legacy_connector_convert
 							    [connector],
 							    &ddc_i2c,
-							    CONNECTOR_OBJECT_ID_SVIDEO);
+							    CONNECTOR_OBJECT_ID_SVIDEO,
+							    &hpd);
 				break;
 			default:
 				DRM_ERROR("Unknown connector type: %d\n",
@@ -1858,14 +2115,16 @@ bool radeon_get_legacy_connector_info_from_bios(struct drm_device *dev)
 									0),
 						  ATOM_DEVICE_DFP1_SUPPORT);
 
-			ddc_i2c = combios_setup_i2c_bus(RADEON_GPIO_DVI_DDC);
+			ddc_i2c = combios_setup_i2c_bus(rdev, RADEON_GPIO_DVI_DDC);
+			hpd.hpd = RADEON_HPD_NONE;
 			radeon_add_legacy_connector(dev,
 						    0,
 						    ATOM_DEVICE_CRT1_SUPPORT |
 						    ATOM_DEVICE_DFP1_SUPPORT,
 						    DRM_MODE_CONNECTOR_DVII,
 						    &ddc_i2c,
-						    CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_I);
+						    CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_I,
+						    &hpd);
 		} else {
 			uint16_t crt_info =
 				combios_get_table_offset(dev, COMBIOS_CRT_INFO_TABLE);
@@ -1876,13 +2135,15 @@ bool radeon_get_legacy_connector_info_from_bios(struct drm_device *dev)
 										ATOM_DEVICE_CRT1_SUPPORT,
 										1),
 							  ATOM_DEVICE_CRT1_SUPPORT);
-				ddc_i2c = combios_setup_i2c_bus(RADEON_GPIO_VGA_DDC);
+				ddc_i2c = combios_setup_i2c_bus(rdev, RADEON_GPIO_VGA_DDC);
+				hpd.hpd = RADEON_HPD_NONE;
 				radeon_add_legacy_connector(dev,
 							    0,
 							    ATOM_DEVICE_CRT1_SUPPORT,
 							    DRM_MODE_CONNECTOR_VGA,
 							    &ddc_i2c,
-							    CONNECTOR_OBJECT_ID_VGA);
+							    CONNECTOR_OBJECT_ID_VGA,
+							    &hpd);
 			} else {
 				DRM_DEBUG("No connector info found\n");
 				return false;
@@ -1910,27 +2171,27 @@ bool radeon_get_legacy_connector_info_from_bios(struct drm_device *dev)
 				case DDC_MONID:
 					ddc_i2c =
 					    combios_setup_i2c_bus
-					    (RADEON_GPIO_MONID);
+						(rdev, RADEON_GPIO_MONID);
 					break;
 				case DDC_DVI:
 					ddc_i2c =
 					    combios_setup_i2c_bus
-					    (RADEON_GPIO_DVI_DDC);
+						(rdev, RADEON_GPIO_DVI_DDC);
 					break;
 				case DDC_VGA:
 					ddc_i2c =
 					    combios_setup_i2c_bus
-					    (RADEON_GPIO_VGA_DDC);
+						(rdev, RADEON_GPIO_VGA_DDC);
 					break;
 				case DDC_CRT2:
 					ddc_i2c =
 					    combios_setup_i2c_bus
-					    (RADEON_GPIO_CRT2_DDC);
+						(rdev, RADEON_GPIO_CRT2_DDC);
 					break;
 				case DDC_LCD:
 					ddc_i2c =
 					    combios_setup_i2c_bus
-					    (RADEON_LCD_GPIO_MASK);
+						(rdev, RADEON_GPIOPAD_MASK);
 					ddc_i2c.mask_clk_mask =
 					    RBIOS32(lcd_ddc_info + 3);
 					ddc_i2c.mask_data_mask =
@@ -1939,19 +2200,19 @@ bool radeon_get_legacy_connector_info_from_bios(struct drm_device *dev)
 					    RBIOS32(lcd_ddc_info + 3);
 					ddc_i2c.a_data_mask =
 					    RBIOS32(lcd_ddc_info + 7);
-					ddc_i2c.put_clk_mask =
+					ddc_i2c.en_clk_mask =
 					    RBIOS32(lcd_ddc_info + 3);
-					ddc_i2c.put_data_mask =
+					ddc_i2c.en_data_mask =
 					    RBIOS32(lcd_ddc_info + 7);
-					ddc_i2c.get_clk_mask =
+					ddc_i2c.y_clk_mask =
 					    RBIOS32(lcd_ddc_info + 3);
-					ddc_i2c.get_data_mask =
+					ddc_i2c.y_data_mask =
 					    RBIOS32(lcd_ddc_info + 7);
 					break;
 				case DDC_GPIO:
 					ddc_i2c =
 					    combios_setup_i2c_bus
-					    (RADEON_MDGPIO_EN_REG);
+						(rdev, RADEON_MDGPIO_MASK);
 					ddc_i2c.mask_clk_mask =
 					    RBIOS32(lcd_ddc_info + 3);
 					ddc_i2c.mask_data_mask =
@@ -1960,13 +2221,13 @@ bool radeon_get_legacy_connector_info_from_bios(struct drm_device *dev)
 					    RBIOS32(lcd_ddc_info + 3);
 					ddc_i2c.a_data_mask =
 					    RBIOS32(lcd_ddc_info + 7);
-					ddc_i2c.put_clk_mask =
+					ddc_i2c.en_clk_mask =
 					    RBIOS32(lcd_ddc_info + 3);
-					ddc_i2c.put_data_mask =
+					ddc_i2c.en_data_mask =
 					    RBIOS32(lcd_ddc_info + 7);
-					ddc_i2c.get_clk_mask =
+					ddc_i2c.y_clk_mask =
 					    RBIOS32(lcd_ddc_info + 3);
-					ddc_i2c.get_data_mask =
+					ddc_i2c.y_data_mask =
 					    RBIOS32(lcd_ddc_info + 7);
 					break;
 				default:
@@ -1977,12 +2238,14 @@ bool radeon_get_legacy_connector_info_from_bios(struct drm_device *dev)
 			} else
 				ddc_i2c.valid = false;
 
+			hpd.hpd = RADEON_HPD_NONE;
 			radeon_add_legacy_connector(dev,
 						    5,
 						    ATOM_DEVICE_LCD1_SUPPORT,
 						    DRM_MODE_CONNECTOR_LVDS,
 						    &ddc_i2c,
-						    CONNECTOR_OBJECT_ID_LVDS);
+						    CONNECTOR_OBJECT_ID_LVDS,
+						    &hpd);
 		}
 	}
 
@@ -1993,6 +2256,7 @@ bool radeon_get_legacy_connector_info_from_bios(struct drm_device *dev)
 		if (tv_info) {
 			if (RBIOS8(tv_info + 6) == 'T') {
 				if (radeon_apply_legacy_tv_quirks(dev)) {
+					hpd.hpd = RADEON_HPD_NONE;
 					radeon_add_legacy_encoder(dev,
 								  radeon_get_encoder_id
 								  (dev,
@@ -2003,7 +2267,8 @@ bool radeon_get_legacy_connector_info_from_bios(struct drm_device *dev)
 								    ATOM_DEVICE_TV1_SUPPORT,
 								    DRM_MODE_CONNECTOR_SVIDEO,
 								    &ddc_i2c,
-								    CONNECTOR_OBJECT_ID_SVIDEO);
+								    CONNECTOR_OBJECT_ID_SVIDEO,
+								    &hpd);
 				}
 			}
 		}
@@ -2014,6 +2279,193 @@ bool radeon_get_legacy_connector_info_from_bios(struct drm_device *dev)
 	return true;
 }
 
+void radeon_external_tmds_setup(struct drm_encoder *encoder)
+{
+	struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
+	struct radeon_encoder_ext_tmds *tmds = radeon_encoder->enc_priv;
+
+	if (!tmds)
+		return;
+
+	switch (tmds->dvo_chip) {
+	case DVO_SIL164:
+		/* sil 164 */
+		radeon_i2c_do_lock(tmds->i2c_bus, 1);
+		radeon_i2c_sw_put_byte(tmds->i2c_bus,
+				       tmds->slave_addr,
+				       0x08, 0x30);
+		radeon_i2c_sw_put_byte(tmds->i2c_bus,
+				       tmds->slave_addr,
+				       0x09, 0x00);
+		radeon_i2c_sw_put_byte(tmds->i2c_bus,
+				       tmds->slave_addr,
+				       0x0a, 0x90);
+		radeon_i2c_sw_put_byte(tmds->i2c_bus,
+				       tmds->slave_addr,
+				       0x0c, 0x89);
+		radeon_i2c_sw_put_byte(tmds->i2c_bus,
+				       tmds->slave_addr,
+				       0x08, 0x3b);
+		radeon_i2c_do_lock(tmds->i2c_bus, 0);
+		break;
+	case DVO_SIL1178:
+		/* sil 1178 - untested */
+		/*
+		 * 0x0f, 0x44
+		 * 0x0f, 0x4c
+		 * 0x0e, 0x01
+		 * 0x0a, 0x80
+		 * 0x09, 0x30
+		 * 0x0c, 0xc9
+		 * 0x0d, 0x70
+		 * 0x08, 0x32
+		 * 0x08, 0x33
+		 */
+		break;
+	default:
+		break;
+	}
+
+}
+
+bool radeon_combios_external_tmds_setup(struct drm_encoder *encoder)
+{
+	struct drm_device *dev = encoder->dev;
+	struct radeon_device *rdev = dev->dev_private;
+	struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
+	uint16_t offset;
+	uint8_t blocks, slave_addr, rev;
+	uint32_t index, id;
+	uint32_t reg, val, and_mask, or_mask;
+	struct radeon_encoder_ext_tmds *tmds = radeon_encoder->enc_priv;
+
+	if (rdev->bios == NULL)
+		return false;
+
+	if (!tmds)
+		return false;
+
+	if (rdev->flags & RADEON_IS_IGP) {
+		offset = combios_get_table_offset(dev, COMBIOS_TMDS_POWER_ON_TABLE);
+		rev = RBIOS8(offset);
+		if (offset) {
+			rev = RBIOS8(offset);
+			if (rev > 1) {
+				blocks = RBIOS8(offset + 3);
+				index = offset + 4;
+				while (blocks > 0) {
+					id = RBIOS16(index);
+					index += 2;
+					switch (id >> 13) {
+					case 0:
+						reg = (id & 0x1fff) * 4;
+						val = RBIOS32(index);
+						index += 4;
+						WREG32(reg, val);
+						break;
+					case 2:
+						reg = (id & 0x1fff) * 4;
+						and_mask = RBIOS32(index);
+						index += 4;
+						or_mask = RBIOS32(index);
+						index += 4;
+						val = RREG32(reg);
+						val = (val & and_mask) | or_mask;
+						WREG32(reg, val);
+						break;
+					case 3:
+						val = RBIOS16(index);
+						index += 2;
+						udelay(val);
+						break;
+					case 4:
+						val = RBIOS16(index);
+						index += 2;
+						udelay(val * 1000);
+						break;
+					case 6:
+						slave_addr = id & 0xff;
+						slave_addr >>= 1; /* 7 bit addressing */
+						index++;
+						reg = RBIOS8(index);
+						index++;
+						val = RBIOS8(index);
+						index++;
+						radeon_i2c_do_lock(tmds->i2c_bus, 1);
+						radeon_i2c_sw_put_byte(tmds->i2c_bus,
+								       slave_addr,
+								       reg, val);
+						radeon_i2c_do_lock(tmds->i2c_bus, 0);
+						break;
+					default:
+						DRM_ERROR("Unknown id %d\n", id >> 13);
+						break;
+					}
+					blocks--;
+				}
+				return true;
+			}
+		}
+	} else {
+		offset = combios_get_table_offset(dev, COMBIOS_EXT_TMDS_INFO_TABLE);
+		if (offset) {
+			index = offset + 10;
+			id = RBIOS16(index);
+			while (id != 0xffff) {
+				index += 2;
+				switch (id >> 13) {
+				case 0:
+					reg = (id & 0x1fff) * 4;
+					val = RBIOS32(index);
+					WREG32(reg, val);
+					break;
+				case 2:
+					reg = (id & 0x1fff) * 4;
+					and_mask = RBIOS32(index);
+					index += 4;
+					or_mask = RBIOS32(index);
+					index += 4;
+					val = RREG32(reg);
+					val = (val & and_mask) | or_mask;
+					WREG32(reg, val);
+					break;
+				case 4:
+					val = RBIOS16(index);
+					index += 2;
+					udelay(val);
+					break;
+				case 5:
+					reg = id & 0x1fff;
+					and_mask = RBIOS32(index);
+					index += 4;
+					or_mask = RBIOS32(index);
+					index += 4;
+					val = RREG32_PLL(reg);
+					val = (val & and_mask) | or_mask;
+					WREG32_PLL(reg, val);
+					break;
+				case 6:
+					reg = id & 0x1fff;
+					val = RBIOS8(index);
+					index += 1;
+					radeon_i2c_do_lock(tmds->i2c_bus, 1);
+					radeon_i2c_sw_put_byte(tmds->i2c_bus,
+							       tmds->slave_addr,
+							       reg, val);
+					radeon_i2c_do_lock(tmds->i2c_bus, 0);
+					break;
+				default:
+					DRM_ERROR("Unknown id %d\n", id >> 13);
+					break;
+				}
+				id = RBIOS16(index);
+			}
+			return true;
+		}
+	}
+	return false;
+}
+
 static void combios_parse_mmio_table(struct drm_device *dev, uint16_t offset)
 {
 	struct radeon_device *rdev = dev->dev_private;
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index 29763ceae3af..55266416fa47 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -40,6 +40,28 @@ radeon_atombios_connected_scratch_regs(struct drm_connector *connector,
 				       struct drm_encoder *encoder,
 				       bool connected);
 
+void radeon_connector_hotplug(struct drm_connector *connector)
+{
+	struct drm_device *dev = connector->dev;
+	struct radeon_device *rdev = dev->dev_private;
+	struct radeon_connector *radeon_connector = to_radeon_connector(connector);
+
+	if (radeon_connector->hpd.hpd != RADEON_HPD_NONE)
+		radeon_hpd_set_polarity(rdev, radeon_connector->hpd.hpd);
+
+	if ((connector->connector_type == DRM_MODE_CONNECTOR_DisplayPort) ||
+	    (connector->connector_type == DRM_MODE_CONNECTOR_eDP)) {
+		if ((radeon_dp_getsinktype(radeon_connector) == CONNECTOR_OBJECT_ID_DISPLAYPORT) ||
+		    (radeon_dp_getsinktype(radeon_connector) == CONNECTOR_OBJECT_ID_eDP)) {
+			if (radeon_dp_needs_link_train(radeon_connector)) {
+				if (connector->encoder)
+					dp_link_train(connector->encoder, connector);
+			}
+		}
+	}
+
+}
+
 static void radeon_property_change_mode(struct drm_encoder *encoder)
 {
 	struct drm_crtc *crtc = encoder->crtc;
@@ -188,6 +210,18 @@ static struct drm_display_mode *radeon_fp_native_mode(struct drm_encoder *encode
 		drm_mode_set_name(mode);
 
 		DRM_DEBUG("Adding native panel mode %s\n", mode->name);
+	} else if (native_mode->hdisplay != 0 &&
+		   native_mode->vdisplay != 0) {
+		/* mac laptops without an edid */
+		/* Note that this is not necessarily the exact panel mode,
+		 * but an approximation based on the cvt formula.  For these
+		 * systems we should ideally read the mode info out of the
+		 * registers or add a mode table, but this works and is much
+		 * simpler.
+		 */
+		mode = drm_cvt_mode(dev, native_mode->hdisplay, native_mode->vdisplay, 60, true, false, false);
+		mode->type = DRM_MODE_TYPE_PREFERRED | DRM_MODE_TYPE_DRIVER;
+		DRM_DEBUG("Adding cvt approximation of native panel mode %s\n", mode->name);
 	}
 	return mode;
 }
@@ -445,10 +479,10 @@ static enum drm_connector_status radeon_lvds_detect(struct drm_connector *connec
 		ret = connector_status_connected;
 	else {
 		if (radeon_connector->ddc_bus) {
-			radeon_i2c_do_lock(radeon_connector, 1);
+			radeon_i2c_do_lock(radeon_connector->ddc_bus, 1);
 			radeon_connector->edid = drm_get_edid(&radeon_connector->base,
 							      &radeon_connector->ddc_bus->adapter);
-			radeon_i2c_do_lock(radeon_connector, 0);
+			radeon_i2c_do_lock(radeon_connector->ddc_bus, 0);
 			if (radeon_connector->edid)
 				ret = connector_status_connected;
 		}
@@ -553,17 +587,17 @@ static enum drm_connector_status radeon_vga_detect(struct drm_connector *connect
 	if (!encoder)
 		ret = connector_status_disconnected;
 
-	radeon_i2c_do_lock(radeon_connector, 1);
+	radeon_i2c_do_lock(radeon_connector->ddc_bus, 1);
 	dret = radeon_ddc_probe(radeon_connector);
-	radeon_i2c_do_lock(radeon_connector, 0);
+	radeon_i2c_do_lock(radeon_connector->ddc_bus, 0);
 	if (dret) {
 		if (radeon_connector->edid) {
 			kfree(radeon_connector->edid);
 			radeon_connector->edid = NULL;
 		}
-		radeon_i2c_do_lock(radeon_connector, 1);
+		radeon_i2c_do_lock(radeon_connector->ddc_bus, 1);
 		radeon_connector->edid = drm_get_edid(&radeon_connector->base, &radeon_connector->ddc_bus->adapter);
-		radeon_i2c_do_lock(radeon_connector, 0);
+		radeon_i2c_do_lock(radeon_connector->ddc_bus, 0);
 
 		if (!radeon_connector->edid) {
 			DRM_ERROR("%s: probed a monitor but no|invalid EDID\n",
@@ -583,7 +617,7 @@ static enum drm_connector_status radeon_vga_detect(struct drm_connector *connect
 				ret = connector_status_connected;
 		}
 	} else {
-		if (radeon_connector->dac_load_detect) {
+		if (radeon_connector->dac_load_detect && encoder) {
 			encoder_funcs = encoder->helper_private;
 			ret = encoder_funcs->detect(encoder, connector);
 		}
@@ -708,17 +742,17 @@ static enum drm_connector_status radeon_dvi_detect(struct drm_connector *connect
 	enum drm_connector_status ret = connector_status_disconnected;
 	bool dret;
 
-	radeon_i2c_do_lock(radeon_connector, 1);
+	radeon_i2c_do_lock(radeon_connector->ddc_bus, 1);
 	dret = radeon_ddc_probe(radeon_connector);
-	radeon_i2c_do_lock(radeon_connector, 0);
+	radeon_i2c_do_lock(radeon_connector->ddc_bus, 0);
 	if (dret) {
 		if (radeon_connector->edid) {
 			kfree(radeon_connector->edid);
 			radeon_connector->edid = NULL;
 		}
-		radeon_i2c_do_lock(radeon_connector, 1);
+		radeon_i2c_do_lock(radeon_connector->ddc_bus, 1);
 		radeon_connector->edid = drm_get_edid(&radeon_connector->base, &radeon_connector->ddc_bus->adapter);
-		radeon_i2c_do_lock(radeon_connector, 0);
+		radeon_i2c_do_lock(radeon_connector->ddc_bus, 0);
 
 		if (!radeon_connector->edid) {
 			DRM_ERROR("%s: probed a monitor but no|invalid EDID\n",
@@ -735,6 +769,39 @@ static enum drm_connector_status radeon_dvi_detect(struct drm_connector *connect
 				ret = connector_status_disconnected;
 			} else
 				ret = connector_status_connected;
+
+			/* multiple connectors on the same encoder with the same ddc line
+			 * This tends to be HDMI and DVI on the same encoder with the
+			 * same ddc line.  If the edid says HDMI, consider the HDMI port
+			 * connected and the DVI port disconnected.  If the edid doesn't
+			 * say HDMI, vice versa.
+			 */
+			if (radeon_connector->shared_ddc && connector_status_connected) {
+				struct drm_device *dev = connector->dev;
+				struct drm_connector *list_connector;
+				struct radeon_connector *list_radeon_connector;
+				list_for_each_entry(list_connector, &dev->mode_config.connector_list, head) {
+					if (connector == list_connector)
+						continue;
+					list_radeon_connector = to_radeon_connector(list_connector);
+					if (radeon_connector->devices == list_radeon_connector->devices) {
+						if (drm_detect_hdmi_monitor(radeon_connector->edid)) {
+							if (connector->connector_type == DRM_MODE_CONNECTOR_DVID) {
+								kfree(radeon_connector->edid);
+								radeon_connector->edid = NULL;
+								ret = connector_status_disconnected;
+							}
+						} else {
+							if ((connector->connector_type == DRM_MODE_CONNECTOR_HDMIA) ||
+							    (connector->connector_type == DRM_MODE_CONNECTOR_HDMIB)) {
+								kfree(radeon_connector->edid);
+								radeon_connector->edid = NULL;
+								ret = connector_status_disconnected;
+							}
+						}
+					}
+				}
+			}
 		}
 	}
 
@@ -833,10 +900,18 @@ static void radeon_dvi_force(struct drm_connector *connector)
 static int radeon_dvi_mode_valid(struct drm_connector *connector,
 				  struct drm_display_mode *mode)
 {
+	struct drm_device *dev = connector->dev;
+	struct radeon_device *rdev = dev->dev_private;
 	struct radeon_connector *radeon_connector = to_radeon_connector(connector);
 
 	/* XXX check mode bandwidth */
 
+	/* clocks over 135 MHz have heat issues with DVI on RV100 */
+	if (radeon_connector->use_digital &&
+	    (rdev->family == CHIP_RV100) &&
+	    (mode->clock > 135000))
+		return MODE_CLOCK_HIGH;
+
 	if (radeon_connector->use_digital && (mode->clock > 165000)) {
 		if ((radeon_connector->connector_object_id == CONNECTOR_OBJECT_ID_DUAL_LINK_DVI_I) ||
 		    (radeon_connector->connector_object_id == CONNECTOR_OBJECT_ID_DUAL_LINK_DVI_D) ||
@@ -863,6 +938,93 @@ struct drm_connector_funcs radeon_dvi_connector_funcs = {
 	.force = radeon_dvi_force,
 };
 
+static void radeon_dp_connector_destroy(struct drm_connector *connector)
+{
+	struct radeon_connector *radeon_connector = to_radeon_connector(connector);
+	struct radeon_connector_atom_dig *radeon_dig_connector = radeon_connector->con_priv;
+
+	if (radeon_connector->ddc_bus)
+		radeon_i2c_destroy(radeon_connector->ddc_bus);
+	if (radeon_connector->edid)
+		kfree(radeon_connector->edid);
+	if (radeon_dig_connector->dp_i2c_bus)
+		radeon_i2c_destroy(radeon_dig_connector->dp_i2c_bus);
+	kfree(radeon_connector->con_priv);
+	drm_sysfs_connector_remove(connector);
+	drm_connector_cleanup(connector);
+	kfree(connector);
+}
+
+static int radeon_dp_get_modes(struct drm_connector *connector)
+{
+	struct radeon_connector *radeon_connector = to_radeon_connector(connector);
+	int ret;
+
+	ret = radeon_ddc_get_modes(radeon_connector);
+	return ret;
+}
+
+static enum drm_connector_status radeon_dp_detect(struct drm_connector *connector)
+{
+	struct radeon_connector *radeon_connector = to_radeon_connector(connector);
+	enum drm_connector_status ret = connector_status_disconnected;
+	struct radeon_connector_atom_dig *radeon_dig_connector = radeon_connector->con_priv;
+	u8 sink_type;
+
+	if (radeon_connector->edid) {
+		kfree(radeon_connector->edid);
+		radeon_connector->edid = NULL;
+	}
+
+	sink_type = radeon_dp_getsinktype(radeon_connector);
+	if ((sink_type == CONNECTOR_OBJECT_ID_DISPLAYPORT) ||
+	    (sink_type == CONNECTOR_OBJECT_ID_eDP)) {
+		if (radeon_dp_getdpcd(radeon_connector)) {
+			radeon_dig_connector->dp_sink_type = sink_type;
+			ret = connector_status_connected;
+		}
+	} else {
+		radeon_i2c_do_lock(radeon_connector->ddc_bus, 1);
+		if (radeon_ddc_probe(radeon_connector)) {
+			radeon_dig_connector->dp_sink_type = sink_type;
+			ret = connector_status_connected;
+		}
+		radeon_i2c_do_lock(radeon_connector->ddc_bus, 0);
+	}
+
+	return ret;
+}
+
+static int radeon_dp_mode_valid(struct drm_connector *connector,
+				  struct drm_display_mode *mode)
+{
+	struct radeon_connector *radeon_connector = to_radeon_connector(connector);
+	struct radeon_connector_atom_dig *radeon_dig_connector = radeon_connector->con_priv;
+
+	/* XXX check mode bandwidth */
+
+	if ((radeon_dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_DISPLAYPORT) ||
+	    (radeon_dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_eDP))
+		return radeon_dp_mode_valid_helper(radeon_connector, mode);
+	else
+		return MODE_OK;
+}
+
+struct drm_connector_helper_funcs radeon_dp_connector_helper_funcs = {
+	.get_modes = radeon_dp_get_modes,
+	.mode_valid = radeon_dp_mode_valid,
+	.best_encoder = radeon_dvi_encoder,
+};
+
+struct drm_connector_funcs radeon_dp_connector_funcs = {
+	.dpms = drm_helper_connector_dpms,
+	.detect = radeon_dp_detect,
+	.fill_modes = drm_helper_probe_single_connector_modes,
+	.set_property = radeon_connector_set_property,
+	.destroy = radeon_dp_connector_destroy,
+	.force = radeon_dvi_force,
+};
+
 void
 radeon_add_atom_connector(struct drm_device *dev,
 			  uint32_t connector_id,
@@ -871,7 +1033,8 @@ radeon_add_atom_connector(struct drm_device *dev,
 			  struct radeon_i2c_bus_rec *i2c_bus,
 			  bool linkb,
 			  uint32_t igp_lane_info,
-			  uint16_t connector_object_id)
+			  uint16_t connector_object_id,
+			  struct radeon_hpd *hpd)
 {
 	struct radeon_device *rdev = dev->dev_private;
 	struct drm_connector *connector;
@@ -911,6 +1074,7 @@ radeon_add_atom_connector(struct drm_device *dev,
 	radeon_connector->devices = supported_device;
 	radeon_connector->shared_ddc = shared_ddc;
 	radeon_connector->connector_object_id = connector_object_id;
+	radeon_connector->hpd = *hpd;
 	switch (connector_type) {
 	case DRM_MODE_CONNECTOR_VGA:
 		drm_connector_init(dev, &radeon_connector->base, &radeon_vga_connector_funcs, connector_type);
@@ -963,10 +1127,12 @@ radeon_add_atom_connector(struct drm_device *dev,
 		drm_connector_attach_property(&radeon_connector->base,
 					      rdev->mode_info.coherent_mode_property,
 					      1);
-		radeon_connector->dac_load_detect = true;
-		drm_connector_attach_property(&radeon_connector->base,
-					      rdev->mode_info.load_detect_property,
-					      1);
+		if (connector_type == DRM_MODE_CONNECTOR_DVII) {
+			radeon_connector->dac_load_detect = true;
+			drm_connector_attach_property(&radeon_connector->base,
+						      rdev->mode_info.load_detect_property,
+						      1);
+		}
 		break;
 	case DRM_MODE_CONNECTOR_HDMIA:
 	case DRM_MODE_CONNECTOR_HDMIB:
@@ -991,22 +1157,36 @@ radeon_add_atom_connector(struct drm_device *dev,
 		subpixel_order = SubPixelHorizontalRGB;
 		break;
 	case DRM_MODE_CONNECTOR_DisplayPort:
+	case DRM_MODE_CONNECTOR_eDP:
 		radeon_dig_connector = kzalloc(sizeof(struct radeon_connector_atom_dig), GFP_KERNEL);
 		if (!radeon_dig_connector)
 			goto failed;
 		radeon_dig_connector->linkb = linkb;
 		radeon_dig_connector->igp_lane_info = igp_lane_info;
 		radeon_connector->con_priv = radeon_dig_connector;
-		drm_connector_init(dev, &radeon_connector->base, &radeon_dvi_connector_funcs, connector_type);
-		ret = drm_connector_helper_add(&radeon_connector->base, &radeon_dvi_connector_helper_funcs);
+		drm_connector_init(dev, &radeon_connector->base, &radeon_dp_connector_funcs, connector_type);
+		ret = drm_connector_helper_add(&radeon_connector->base, &radeon_dp_connector_helper_funcs);
 		if (ret)
 			goto failed;
 		if (i2c_bus->valid) {
-			radeon_connector->ddc_bus = radeon_i2c_create(dev, i2c_bus, "DP");
+			/* add DP i2c bus */
+			if (connector_type == DRM_MODE_CONNECTOR_eDP)
+				radeon_dig_connector->dp_i2c_bus = radeon_i2c_create_dp(dev, i2c_bus, "eDP-auxch");
+			else
+				radeon_dig_connector->dp_i2c_bus = radeon_i2c_create_dp(dev, i2c_bus, "DP-auxch");
+			if (!radeon_dig_connector->dp_i2c_bus)
+				goto failed;
+			if (connector_type == DRM_MODE_CONNECTOR_eDP)
+				radeon_connector->ddc_bus = radeon_i2c_create(dev, i2c_bus, "eDP");
+			else
+				radeon_connector->ddc_bus = radeon_i2c_create(dev, i2c_bus, "DP");
 			if (!radeon_connector->ddc_bus)
 				goto failed;
 		}
 		subpixel_order = SubPixelHorizontalRGB;
+		drm_connector_attach_property(&radeon_connector->base,
+					      rdev->mode_info.coherent_mode_property,
+					      1);
 		break;
 	case DRM_MODE_CONNECTOR_SVIDEO:
 	case DRM_MODE_CONNECTOR_Composite:
@@ -1020,6 +1200,9 @@ radeon_add_atom_connector(struct drm_device *dev,
 			drm_connector_attach_property(&radeon_connector->base,
 						      rdev->mode_info.load_detect_property,
 						      1);
+			drm_connector_attach_property(&radeon_connector->base,
+						      rdev->mode_info.tv_std_property,
+						      radeon_atombios_get_tv_info(rdev));
 		}
 		break;
 	case DRM_MODE_CONNECTOR_LVDS:
@@ -1038,7 +1221,6 @@ radeon_add_atom_connector(struct drm_device *dev,
 			if (!radeon_connector->ddc_bus)
 				goto failed;
 		}
-		drm_mode_create_scaling_mode_property(dev);
 		drm_connector_attach_property(&radeon_connector->base,
 					      dev->mode_config.scaling_mode_property,
 					      DRM_MODE_SCALE_FULLSCREEN);
@@ -1063,7 +1245,8 @@ radeon_add_legacy_connector(struct drm_device *dev,
 			    uint32_t supported_device,
 			    int connector_type,
 			    struct radeon_i2c_bus_rec *i2c_bus,
-			    uint16_t connector_object_id)
+			    uint16_t connector_object_id,
+			    struct radeon_hpd *hpd)
 {
 	struct radeon_device *rdev = dev->dev_private;
 	struct drm_connector *connector;
@@ -1093,6 +1276,7 @@ radeon_add_legacy_connector(struct drm_device *dev,
 	radeon_connector->connector_id = connector_id;
 	radeon_connector->devices = supported_device;
 	radeon_connector->connector_object_id = connector_object_id;
+	radeon_connector->hpd = *hpd;
 	switch (connector_type) {
 	case DRM_MODE_CONNECTOR_VGA:
 		drm_connector_init(dev, &radeon_connector->base, &radeon_vga_connector_funcs, connector_type);
@@ -1160,6 +1344,9 @@ radeon_add_legacy_connector(struct drm_device *dev,
 			drm_connector_attach_property(&radeon_connector->base,
 						      rdev->mode_info.load_detect_property,
 						      1);
+			drm_connector_attach_property(&radeon_connector->base,
+						      rdev->mode_info.tv_std_property,
+						      radeon_combios_get_tv_info(rdev));
 		}
 		break;
 	case DRM_MODE_CONNECTOR_LVDS:
diff --git a/drivers/gpu/drm/radeon/radeon_cp.c b/drivers/gpu/drm/radeon/radeon_cp.c
index 4f7afc79dd82..06123ba31d31 100644
--- a/drivers/gpu/drm/radeon/radeon_cp.c
+++ b/drivers/gpu/drm/radeon/radeon_cp.c
@@ -1941,8 +1941,8 @@ struct drm_buf *radeon_freelist_get(struct drm_device * dev)
 	for (t = 0; t < dev_priv->usec_timeout; t++) {
 		u32 done_age = GET_SCRATCH(dev_priv, 1);
 		DRM_DEBUG("done_age = %d\n", done_age);
-		for (i = start; i < dma->buf_count; i++) {
-			buf = dma->buflist[i];
+		for (i = 0; i < dma->buf_count; i++) {
+			buf = dma->buflist[start];
 			buf_priv = buf->dev_private;
 			if (buf->file_priv == NULL || (buf->pending &&
 						       buf_priv->age <=
@@ -1951,7 +1951,8 @@ struct drm_buf *radeon_freelist_get(struct drm_device * dev)
 				buf->pending = 0;
 				return buf;
 			}
-			start = 0;
+			if (++start >= dma->buf_count)
+				start = 0;
 		}
 
 		if (t) {
@@ -1960,47 +1961,9 @@ struct drm_buf *radeon_freelist_get(struct drm_device * dev)
 		}
 	}
 
-	DRM_DEBUG("returning NULL!\n");
 	return NULL;
 }
 
-#if 0
-struct drm_buf *radeon_freelist_get(struct drm_device * dev)
-{
-	struct drm_device_dma *dma = dev->dma;
-	drm_radeon_private_t *dev_priv = dev->dev_private;
-	drm_radeon_buf_priv_t *buf_priv;
-	struct drm_buf *buf;
-	int i, t;
-	int start;
-	u32 done_age;
-
-	done_age = radeon_read_ring_rptr(dev_priv, RADEON_SCRATCHOFF(1));
-	if (++dev_priv->last_buf >= dma->buf_count)
-		dev_priv->last_buf = 0;
-
-	start = dev_priv->last_buf;
-	dev_priv->stats.freelist_loops++;
-
-	for (t = 0; t < 2; t++) {
-		for (i = start; i < dma->buf_count; i++) {
-			buf = dma->buflist[i];
-			buf_priv = buf->dev_private;
-			if (buf->file_priv == 0 || (buf->pending &&
-						    buf_priv->age <=
-						    done_age)) {
-				dev_priv->stats.requested_bufs++;
-				buf->pending = 0;
-				return buf;
-			}
-		}
-		start = 0;
-	}
-
-	return NULL;
-}
-#endif
-
 void radeon_freelist_reset(struct drm_device * dev)
 {
 	struct drm_device_dma *dma = dev->dma;
@@ -2182,6 +2145,7 @@ int radeon_master_create(struct drm_device *dev, struct drm_master *master)
 			 &master_priv->sarea);
 	if (ret) {
 		DRM_ERROR("SAREA setup failed\n");
+		kfree(master_priv);
 		return ret;
 	}
 	master_priv->sarea_priv = master_priv->sarea->handle + sizeof(struct drm_sarea);
diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
index 5ab2cf96a264..65590a0f1d93 100644
--- a/drivers/gpu/drm/radeon/radeon_cs.c
+++ b/drivers/gpu/drm/radeon/radeon_cs.c
@@ -76,17 +76,17 @@ int radeon_cs_parser_relocs(struct radeon_cs_parser *p)
 			}
 			p->relocs_ptr[i] = &p->relocs[i];
 			p->relocs[i].robj = p->relocs[i].gobj->driver_private;
-			p->relocs[i].lobj.robj = p->relocs[i].robj;
+			p->relocs[i].lobj.bo = p->relocs[i].robj;
 			p->relocs[i].lobj.rdomain = r->read_domains;
 			p->relocs[i].lobj.wdomain = r->write_domain;
 			p->relocs[i].handle = r->handle;
 			p->relocs[i].flags = r->flags;
 			INIT_LIST_HEAD(&p->relocs[i].lobj.list);
-			radeon_object_list_add_object(&p->relocs[i].lobj,
-						      &p->validated);
+			radeon_bo_list_add_object(&p->relocs[i].lobj,
+						&p->validated);
 		}
 	}
-	return radeon_object_list_validate(&p->validated, p->ib->fence);
+	return radeon_bo_list_validate(&p->validated, p->ib->fence);
 }
 
 int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data)
@@ -190,9 +190,10 @@ static void radeon_cs_parser_fini(struct radeon_cs_parser *parser, int error)
 	unsigned i;
 
 	if (error) {
-		radeon_object_list_unvalidate(&parser->validated);
+		radeon_bo_list_unvalidate(&parser->validated,
+						parser->ib->fence);
 	} else {
-		radeon_object_list_clean(&parser->validated);
+		radeon_bo_list_unreserve(&parser->validated);
 	}
 	for (i = 0; i < parser->nrelocs; i++) {
 		if (parser->relocs[i].gobj) {
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index 41bb76fbe734..0c51f8e46613 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -44,10 +44,11 @@ void radeon_surface_init(struct radeon_device *rdev)
 	if (rdev->family < CHIP_R600) {
 		int i;
 
-		for (i = 0; i < 8; i++) {
-			WREG32(RADEON_SURFACE0_INFO +
-			       i * (RADEON_SURFACE1_INFO - RADEON_SURFACE0_INFO),
-			       0);
+		for (i = 0; i < RADEON_GEM_MAX_SURFACES; i++) {
+			if (rdev->surface_regs[i].bo)
+				radeon_bo_get_surface_reg(rdev->surface_regs[i].bo);
+			else
+				radeon_clear_surface_reg(rdev, i);
 		}
 		/* enable surfaces */
 		WREG32(RADEON_SURFACE_CNTL, 0);
@@ -208,6 +209,24 @@ bool radeon_card_posted(struct radeon_device *rdev)
 
 }
 
+bool radeon_boot_test_post_card(struct radeon_device *rdev)
+{
+	if (radeon_card_posted(rdev))
+		return true;
+
+	if (rdev->bios) {
+		DRM_INFO("GPU not posted. posting now...\n");
+		if (rdev->is_atom_bios)
+			atom_asic_init(rdev->mode_info.atom_context);
+		else
+			radeon_combios_asic_init(rdev->ddev);
+		return true;
+	} else {
+		dev_err(rdev->dev, "Card not posted and no BIOS - ignoring\n");
+		return false;
+	}
+}
+
 int radeon_dummy_page_init(struct radeon_device *rdev)
 {
 	rdev->dummy_page.page = alloc_page(GFP_DMA32 | GFP_KERNEL | __GFP_ZERO);
@@ -372,6 +391,12 @@ int radeon_asic_init(struct radeon_device *rdev)
 		/* FIXME: not supported yet */
 		return -EINVAL;
 	}
+
+	if (rdev->flags & RADEON_IS_IGP) {
+		rdev->asic->get_memory_clock = NULL;
+		rdev->asic->set_memory_clock = NULL;
+	}
+
 	return 0;
 }
 
@@ -462,13 +487,18 @@ int radeon_atombios_init(struct radeon_device *rdev)
 	atom_card_info->pll_write = cail_pll_write;
 
 	rdev->mode_info.atom_context = atom_parse(atom_card_info, rdev->bios);
+	mutex_init(&rdev->mode_info.atom_context->mutex);
 	radeon_atom_initialize_bios_scratch_regs(rdev->ddev);
+	atom_allocate_fb_scratch(rdev->mode_info.atom_context);
 	return 0;
 }
 
 void radeon_atombios_fini(struct radeon_device *rdev)
 {
-	kfree(rdev->mode_info.atom_context);
+	if (rdev->mode_info.atom_context) {
+		kfree(rdev->mode_info.atom_context->scratch);
+		kfree(rdev->mode_info.atom_context);
+	}
 	kfree(rdev->mode_info.atom_card_info);
 }
 
@@ -516,9 +546,72 @@ void radeon_agp_disable(struct radeon_device *rdev)
 	}
 }
 
-/*
- * Radeon device.
- */
+void radeon_check_arguments(struct radeon_device *rdev)
+{
+	/* vramlimit must be a power of two */
+	switch (radeon_vram_limit) {
+	case 0:
+	case 4:
+	case 8:
+	case 16:
+	case 32:
+	case 64:
+	case 128:
+	case 256:
+	case 512:
+	case 1024:
+	case 2048:
+	case 4096:
+		break;
+	default:
+		dev_warn(rdev->dev, "vram limit (%d) must be a power of 2\n",
+				radeon_vram_limit);
+		radeon_vram_limit = 0;
+		break;
+	}
+	radeon_vram_limit = radeon_vram_limit << 20;
+	/* gtt size must be power of two and greater or equal to 32M */
+	switch (radeon_gart_size) {
+	case 4:
+	case 8:
+	case 16:
+		dev_warn(rdev->dev, "gart size (%d) too small forcing to 512M\n",
+				radeon_gart_size);
+		radeon_gart_size = 512;
+		break;
+	case 32:
+	case 64:
+	case 128:
+	case 256:
+	case 512:
+	case 1024:
+	case 2048:
+	case 4096:
+		break;
+	default:
+		dev_warn(rdev->dev, "gart size (%d) must be a power of 2\n",
+				radeon_gart_size);
+		radeon_gart_size = 512;
+		break;
+	}
+	rdev->mc.gtt_size = radeon_gart_size * 1024 * 1024;
+	/* AGP mode can only be -1, 1, 2, 4, 8 */
+	switch (radeon_agpmode) {
+	case -1:
+	case 0:
+	case 1:
+	case 2:
+	case 4:
+	case 8:
+		break;
+	default:
+		dev_warn(rdev->dev, "invalid AGP mode %d (valid mode: "
+				"-1, 0, 1, 2, 4, 8)\n", radeon_agpmode);
+		radeon_agpmode = 0;
+		break;
+	}
+}
+
 int radeon_device_init(struct radeon_device *rdev,
 		       struct drm_device *ddev,
 		       struct pci_dev *pdev,
@@ -544,16 +637,24 @@ int radeon_device_init(struct radeon_device *rdev,
 	mutex_init(&rdev->cs_mutex);
 	mutex_init(&rdev->ib_pool.mutex);
 	mutex_init(&rdev->cp.mutex);
+	if (rdev->family >= CHIP_R600)
+		spin_lock_init(&rdev->ih.lock);
+	mutex_init(&rdev->gem.mutex);
 	rwlock_init(&rdev->fence_drv.lock);
 	INIT_LIST_HEAD(&rdev->gem.objects);
 
+	/* setup workqueue */
+	rdev->wq = create_workqueue("radeon");
+	if (rdev->wq == NULL)
+		return -ENOMEM;
+
 	/* Set asic functions */
 	r = radeon_asic_init(rdev);
-	if (r) {
+	if (r)
 		return r;
-	}
+	radeon_check_arguments(rdev);
 
-	if (radeon_agpmode == -1) {
+	if (rdev->flags & RADEON_IS_AGP && radeon_agpmode == -1) {
 		radeon_agp_disable(rdev);
 	}
 
@@ -620,6 +721,7 @@ void radeon_device_fini(struct radeon_device *rdev)
 	DRM_INFO("radeon: finishing device.\n");
 	rdev->shutdown = true;
 	radeon_fini(rdev);
+	destroy_workqueue(rdev->wq);
 	vga_client_register(rdev->pdev, NULL, NULL, NULL);
 	iounmap(rdev->rmmio);
 	rdev->rmmio = NULL;
@@ -631,38 +733,46 @@ void radeon_device_fini(struct radeon_device *rdev)
  */
 int radeon_suspend_kms(struct drm_device *dev, pm_message_t state)
 {
-	struct radeon_device *rdev = dev->dev_private;
+	struct radeon_device *rdev;
 	struct drm_crtc *crtc;
+	int r;
 
-	if (dev == NULL || rdev == NULL) {
+	if (dev == NULL || dev->dev_private == NULL) {
 		return -ENODEV;
 	}
 	if (state.event == PM_EVENT_PRETHAW) {
 		return 0;
 	}
+	rdev = dev->dev_private;
+
 	/* unpin the front buffers */
 	list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
 		struct radeon_framebuffer *rfb = to_radeon_framebuffer(crtc->fb);
-		struct radeon_object *robj;
+		struct radeon_bo *robj;
 
 		if (rfb == NULL || rfb->obj == NULL) {
 			continue;
 		}
 		robj = rfb->obj->driver_private;
-		if (robj != rdev->fbdev_robj) {
-			radeon_object_unpin(robj);
+		if (robj != rdev->fbdev_rbo) {
+			r = radeon_bo_reserve(robj, false);
+			if (unlikely(r == 0)) {
+				radeon_bo_unpin(robj);
+				radeon_bo_unreserve(robj);
+			}
 		}
 	}
 	/* evict vram memory */
-	radeon_object_evict_vram(rdev);
+	radeon_bo_evict_vram(rdev);
 	/* wait for gpu to finish processing current batch */
 	radeon_fence_wait_last(rdev);
 
 	radeon_save_bios_scratch_regs(rdev);
 
 	radeon_suspend(rdev);
+	radeon_hpd_fini(rdev);
 	/* evict remaining vram memory */
-	radeon_object_evict_vram(rdev);
+	radeon_bo_evict_vram(rdev);
 
 	pci_save_state(dev->pdev);
 	if (state.event == PM_EVENT_SUSPEND) {
@@ -695,6 +805,8 @@ int radeon_resume_kms(struct drm_device *dev)
 	fb_set_suspend(rdev->fbdev_info, 0);
 	release_console_sem();
 
+	/* reset hpd state */
+	radeon_hpd_init(rdev);
 	/* blat the mode back in */
 	drm_helper_resume_force_mode(dev);
 	return 0;
diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index c85df4afcb7a..0ec491ead2ff 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -234,7 +234,7 @@ static const char *encoder_names[34] = {
 	"INTERNAL_UNIPHY2",
 };
 
-static const char *connector_names[13] = {
+static const char *connector_names[15] = {
 	"Unknown",
 	"VGA",
 	"DVI-I",
@@ -248,6 +248,18 @@ static const char *connector_names[13] = {
 	"DisplayPort",
 	"HDMI-A",
 	"HDMI-B",
+	"TV",
+	"eDP",
+};
+
+static const char *hpd_names[7] = {
+	"NONE",
+	"HPD1",
+	"HPD2",
+	"HPD3",
+	"HPD4",
+	"HPD5",
+	"HPD6",
 };
 
 static void radeon_print_display_setup(struct drm_device *dev)
@@ -264,16 +276,18 @@ static void radeon_print_display_setup(struct drm_device *dev)
 		radeon_connector = to_radeon_connector(connector);
 		DRM_INFO("Connector %d:\n", i);
 		DRM_INFO("  %s\n", connector_names[connector->connector_type]);
+		if (radeon_connector->hpd.hpd != RADEON_HPD_NONE)
+			DRM_INFO("  %s\n", hpd_names[radeon_connector->hpd.hpd]);
 		if (radeon_connector->ddc_bus)
 			DRM_INFO("  DDC: 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x\n",
 				 radeon_connector->ddc_bus->rec.mask_clk_reg,
 				 radeon_connector->ddc_bus->rec.mask_data_reg,
 				 radeon_connector->ddc_bus->rec.a_clk_reg,
 				 radeon_connector->ddc_bus->rec.a_data_reg,
-				 radeon_connector->ddc_bus->rec.put_clk_reg,
-				 radeon_connector->ddc_bus->rec.put_data_reg,
-				 radeon_connector->ddc_bus->rec.get_clk_reg,
-				 radeon_connector->ddc_bus->rec.get_data_reg);
+				 radeon_connector->ddc_bus->rec.en_clk_reg,
+				 radeon_connector->ddc_bus->rec.en_data_reg,
+				 radeon_connector->ddc_bus->rec.y_clk_reg,
+				 radeon_connector->ddc_bus->rec.y_data_reg);
 		DRM_INFO("  Encoders:\n");
 		list_for_each_entry(encoder, &dev->mode_config.encoder_list, head) {
 			radeon_encoder = to_radeon_encoder(encoder);
@@ -317,13 +331,17 @@ static bool radeon_setup_enc_conn(struct drm_device *dev)
 				ret = radeon_get_atom_connector_info_from_object_table(dev);
 			else
 				ret = radeon_get_atom_connector_info_from_supported_devices_table(dev);
-		} else
+		} else {
 			ret = radeon_get_legacy_connector_info_from_bios(dev);
+			if (ret == false)
+				ret = radeon_get_legacy_connector_info_from_table(dev);
+		}
 	} else {
 		if (!ASIC_IS_AVIVO(rdev))
 			ret = radeon_get_legacy_connector_info_from_table(dev);
 	}
 	if (ret) {
+		radeon_setup_encoder_clones(dev);
 		radeon_print_display_setup(dev);
 		list_for_each_entry(drm_connector, &dev->mode_config.connector_list, head)
 			radeon_ddc_dump(drm_connector);
@@ -336,12 +354,18 @@ int radeon_ddc_get_modes(struct radeon_connector *radeon_connector)
 {
 	int ret = 0;
 
+	if ((radeon_connector->base.connector_type == DRM_MODE_CONNECTOR_DisplayPort) ||
+	    (radeon_connector->base.connector_type == DRM_MODE_CONNECTOR_eDP)) {
+		struct radeon_connector_atom_dig *dig = radeon_connector->con_priv;
+		if (dig->dp_i2c_bus)
+			radeon_connector->edid = drm_get_edid(&radeon_connector->base, &dig->dp_i2c_bus->adapter);
+	}
 	if (!radeon_connector->ddc_bus)
 		return -1;
 	if (!radeon_connector->edid) {
-		radeon_i2c_do_lock(radeon_connector, 1);
+		radeon_i2c_do_lock(radeon_connector->ddc_bus, 1);
 		radeon_connector->edid = drm_get_edid(&radeon_connector->base, &radeon_connector->ddc_bus->adapter);
-		radeon_i2c_do_lock(radeon_connector, 0);
+		radeon_i2c_do_lock(radeon_connector->ddc_bus, 0);
 	}
 
 	if (radeon_connector->edid) {
@@ -361,9 +385,9 @@ static int radeon_ddc_dump(struct drm_connector *connector)
 
 	if (!radeon_connector->ddc_bus)
 		return -1;
-	radeon_i2c_do_lock(radeon_connector, 1);
+	radeon_i2c_do_lock(radeon_connector->ddc_bus, 1);
 	edid = drm_get_edid(connector, &radeon_connector->ddc_bus->adapter);
-	radeon_i2c_do_lock(radeon_connector, 0);
+	radeon_i2c_do_lock(radeon_connector->ddc_bus, 0);
 	if (edid) {
 		kfree(edid);
 	}
@@ -542,6 +566,98 @@ void radeon_compute_pll(struct radeon_pll *pll,
 	*post_div_p = best_post_div;
 }
 
+void radeon_compute_pll_avivo(struct radeon_pll *pll,
+			      uint64_t freq,
+			      uint32_t *dot_clock_p,
+			      uint32_t *fb_div_p,
+			      uint32_t *frac_fb_div_p,
+			      uint32_t *ref_div_p,
+			      uint32_t *post_div_p,
+			      int flags)
+{
+	fixed20_12 m, n, frac_n, p, f_vco, f_pclk, best_freq;
+	fixed20_12 pll_out_max, pll_out_min;
+	fixed20_12 pll_in_max, pll_in_min;
+	fixed20_12 reference_freq;
+	fixed20_12 error, ffreq, a, b;
+
+	pll_out_max.full = rfixed_const(pll->pll_out_max);
+	pll_out_min.full = rfixed_const(pll->pll_out_min);
+	pll_in_max.full = rfixed_const(pll->pll_in_max);
+	pll_in_min.full = rfixed_const(pll->pll_in_min);
+	reference_freq.full = rfixed_const(pll->reference_freq);
+	do_div(freq, 10);
+	ffreq.full = rfixed_const(freq);
+	error.full = rfixed_const(100 * 100);
+
+	/* max p */
+	p.full = rfixed_div(pll_out_max, ffreq);
+	p.full = rfixed_floor(p);
+
+	/* min m */
+	m.full = rfixed_div(reference_freq, pll_in_max);
+	m.full = rfixed_ceil(m);
+
+	while (1) {
+		n.full = rfixed_div(ffreq, reference_freq);
+		n.full = rfixed_mul(n, m);
+		n.full = rfixed_mul(n, p);
+
+		f_vco.full = rfixed_div(n, m);
+		f_vco.full = rfixed_mul(f_vco, reference_freq);
+
+		f_pclk.full = rfixed_div(f_vco, p);
+
+		if (f_pclk.full > ffreq.full)
+			error.full = f_pclk.full - ffreq.full;
+		else
+			error.full = ffreq.full - f_pclk.full;
+		error.full = rfixed_div(error, f_pclk);
+		a.full = rfixed_const(100 * 100);
+		error.full = rfixed_mul(error, a);
+
+		a.full = rfixed_mul(m, p);
+		a.full = rfixed_div(n, a);
+		best_freq.full = rfixed_mul(reference_freq, a);
+
+		if (rfixed_trunc(error) < 25)
+			break;
+
+		a.full = rfixed_const(1);
+		m.full = m.full + a.full;
+		a.full = rfixed_div(reference_freq, m);
+		if (a.full >= pll_in_min.full)
+			continue;
+
+		m.full = rfixed_div(reference_freq, pll_in_max);
+		m.full = rfixed_ceil(m);
+		a.full= rfixed_const(1);
+		p.full = p.full - a.full;
+		a.full = rfixed_mul(p, ffreq);
+		if (a.full >= pll_out_min.full)
+			continue;
+		else {
+			DRM_ERROR("Unable to find pll dividers\n");
+			break;
+		}
+	}
+
+	a.full = rfixed_const(10);
+	b.full = rfixed_mul(n, a);
+
+	frac_n.full = rfixed_floor(n);
+	frac_n.full = rfixed_mul(frac_n, a);
+	frac_n.full = b.full - frac_n.full;
+
+	*dot_clock_p = rfixed_trunc(best_freq);
+	*fb_div_p = rfixed_trunc(n);
+	*frac_fb_div_p = rfixed_trunc(frac_n);
+	*ref_div_p = rfixed_trunc(m);
+	*post_div_p = rfixed_trunc(p);
+
+	DRM_DEBUG("%u %d.%d, %d, %d\n", *dot_clock_p * 10, *fb_div_p, *frac_fb_div_p, *ref_div_p, *post_div_p);
+}
+
 static void radeon_user_framebuffer_destroy(struct drm_framebuffer *fb)
 {
 	struct radeon_framebuffer *radeon_fb = to_radeon_framebuffer(fb);
@@ -629,7 +745,7 @@ static struct drm_prop_enum_list radeon_tv_std_enum_list[] =
 	{ TV_STD_SECAM, "secam" },
 };
 
-int radeon_modeset_create_props(struct radeon_device *rdev)
+static int radeon_modeset_create_props(struct radeon_device *rdev)
 {
 	int i, sz;
 
@@ -642,7 +758,7 @@ int radeon_modeset_create_props(struct radeon_device *rdev)
 			return -ENOMEM;
 
 		rdev->mode_info.coherent_mode_property->values[0] = 0;
-		rdev->mode_info.coherent_mode_property->values[0] = 1;
+		rdev->mode_info.coherent_mode_property->values[1] = 1;
 	}
 
 	if (!ASIC_IS_AVIVO(rdev)) {
@@ -666,7 +782,7 @@ int radeon_modeset_create_props(struct radeon_device *rdev)
 	if (!rdev->mode_info.load_detect_property)
 		return -ENOMEM;
 	rdev->mode_info.load_detect_property->values[0] = 0;
-	rdev->mode_info.load_detect_property->values[0] = 1;
+	rdev->mode_info.load_detect_property->values[1] = 1;
 
 	drm_mode_create_scaling_mode_property(rdev->ddev);
 
@@ -723,6 +839,8 @@ int radeon_modeset_init(struct radeon_device *rdev)
 	if (!ret) {
 		return ret;
 	}
+	/* initialize hpd */
+	radeon_hpd_init(rdev);
 	drm_helper_initial_config(rdev->ddev);
 	return 0;
 }
@@ -730,6 +848,7 @@ int radeon_modeset_init(struct radeon_device *rdev)
 void radeon_modeset_fini(struct radeon_device *rdev)
 {
 	if (rdev->mode_info.mode_config_initialized) {
+		radeon_hpd_fini(rdev);
 		drm_mode_config_cleanup(rdev->ddev);
 		rdev->mode_info.mode_config_initialized = false;
 	}
@@ -750,9 +869,17 @@ bool radeon_crtc_scaling_mode_fixup(struct drm_crtc *crtc,
 		if (encoder->crtc != crtc)
 			continue;
 		if (first) {
-			radeon_crtc->rmx_type = radeon_encoder->rmx_type;
+			/* set scaling */
+			if (radeon_encoder->rmx_type == RMX_OFF)
+				radeon_crtc->rmx_type = RMX_OFF;
+			else if (mode->hdisplay < radeon_encoder->native_mode.hdisplay ||
+				 mode->vdisplay < radeon_encoder->native_mode.vdisplay)
+				radeon_crtc->rmx_type = radeon_encoder->rmx_type;
+			else
+				radeon_crtc->rmx_type = RMX_OFF;
+			/* copy native mode */
 			memcpy(&radeon_crtc->native_mode,
-				&radeon_encoder->native_mode,
+			       &radeon_encoder->native_mode,
 				sizeof(struct drm_display_mode));
 			first = false;
 		} else {
diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
index 7f50fb864af8..8ba3de7994d4 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.c
+++ b/drivers/gpu/drm/radeon/radeon_drv.c
@@ -86,6 +86,8 @@ int radeon_benchmarking = 0;
 int radeon_testing = 0;
 int radeon_connector_table = 0;
 int radeon_tv = 1;
+int radeon_new_pll = 1;
+int radeon_audio = 1;
 
 MODULE_PARM_DESC(no_wb, "Disable AGP writeback for scratch registers");
 module_param_named(no_wb, radeon_no_wb, int, 0444);
@@ -120,6 +122,12 @@ module_param_named(connector_table, radeon_connector_table, int, 0444);
 MODULE_PARM_DESC(tv, "TV enable (0 = disable)");
 module_param_named(tv, radeon_tv, int, 0444);
 
+MODULE_PARM_DESC(new_pll, "Select new PLL code for AVIVO chips");
+module_param_named(new_pll, radeon_new_pll, int, 0444);
+
+MODULE_PARM_DESC(audio, "Audio enable (0 = disable)");
+module_param_named(audio, radeon_audio, int, 0444);
+
 static int radeon_suspend(struct drm_device *dev, pm_message_t state)
 {
 	drm_radeon_private_t *dev_priv = dev->dev_private;
@@ -188,7 +196,7 @@ static struct drm_driver driver_old = {
 		 .owner = THIS_MODULE,
 		 .open = drm_open,
 		 .release = drm_release,
-		 .ioctl = drm_ioctl,
+		 .unlocked_ioctl = drm_ioctl,
 		 .mmap = drm_mmap,
 		 .poll = drm_poll,
 		 .fasync = drm_fasync,
@@ -276,7 +284,7 @@ static struct drm_driver kms_driver = {
 		 .owner = THIS_MODULE,
 		 .open = drm_open,
 		 .release = drm_release,
-		 .ioctl = drm_ioctl,
+		 .unlocked_ioctl = drm_ioctl,
 		 .mmap = radeon_mmap,
 		 .poll = drm_poll,
 		 .fasync = drm_fasync,
diff --git a/drivers/gpu/drm/radeon/radeon_drv.h b/drivers/gpu/drm/radeon/radeon_drv.h
index 350962e0f346..e13785282a82 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.h
+++ b/drivers/gpu/drm/radeon/radeon_drv.h
@@ -1104,7 +1104,6 @@ extern u32 radeon_get_scratch(drm_radeon_private_t *dev_priv, int index);
 #       define R600_IT_WAIT_REG_MEM             0x00003C00
 #       define R600_IT_MEM_WRITE                0x00003D00
 #       define R600_IT_INDIRECT_BUFFER          0x00003200
-#       define R600_IT_CP_INTERRUPT             0x00004000
 #       define R600_IT_SURFACE_SYNC             0x00004300
 #              define R600_CB0_DEST_BASE_ENA    (1 << 6)
 #              define R600_TC_ACTION_ENA        (1 << 23)
diff --git a/drivers/gpu/drm/radeon/radeon_encoders.c b/drivers/gpu/drm/radeon/radeon_encoders.c
index d42bc512d75a..82eb551970b9 100644
--- a/drivers/gpu/drm/radeon/radeon_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_encoders.c
@@ -35,6 +35,51 @@ extern int atom_debug;
 bool radeon_atom_get_tv_timings(struct radeon_device *rdev, int index,
 				struct drm_display_mode *mode);
 
+static uint32_t radeon_encoder_clones(struct drm_encoder *encoder)
+{
+	struct drm_device *dev = encoder->dev;
+	struct radeon_device *rdev = dev->dev_private;
+	struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
+	struct drm_encoder *clone_encoder;
+	uint32_t index_mask = 0;
+	int count;
+
+	/* DIG routing gets problematic */
+	if (rdev->family >= CHIP_R600)
+		return index_mask;
+	/* LVDS/TV are too wacky */
+	if (radeon_encoder->devices & ATOM_DEVICE_LCD_SUPPORT)
+		return index_mask;
+	/* DVO requires 2x ppll clocks depending on tmds chip */
+	if (radeon_encoder->devices & ATOM_DEVICE_DFP2_SUPPORT)
+		return index_mask;
+	
+	count = -1;
+	list_for_each_entry(clone_encoder, &dev->mode_config.encoder_list, head) {
+		struct radeon_encoder *radeon_clone = to_radeon_encoder(clone_encoder);
+		count++;
+
+		if (clone_encoder == encoder)
+			continue;
+		if (radeon_clone->devices & (ATOM_DEVICE_LCD_SUPPORT))
+			continue;
+		if (radeon_clone->devices & ATOM_DEVICE_DFP2_SUPPORT)
+			continue;
+		else
+			index_mask |= (1 << count);
+	}
+	return index_mask;
+}
+
+void radeon_setup_encoder_clones(struct drm_device *dev)
+{
+	struct drm_encoder *encoder;
+
+	list_for_each_entry(encoder, &dev->mode_config.encoder_list, head) {
+		encoder->possible_clones = radeon_encoder_clones(encoder);
+	}
+}
+
 uint32_t
 radeon_get_encoder_id(struct drm_device *dev, uint32_t supported_device, uint8_t dac)
 {
@@ -163,29 +208,6 @@ radeon_get_connector_for_encoder(struct drm_encoder *encoder)
 	return NULL;
 }
 
-/* used for both atom and legacy */
-void radeon_rmx_mode_fixup(struct drm_encoder *encoder,
-			   struct drm_display_mode *mode,
-			   struct drm_display_mode *adjusted_mode)
-{
-	struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
-	struct drm_device *dev = encoder->dev;
-	struct radeon_device *rdev = dev->dev_private;
-	struct drm_display_mode *native_mode = &radeon_encoder->native_mode;
-
-	if (mode->hdisplay < native_mode->hdisplay ||
-	    mode->vdisplay < native_mode->vdisplay) {
-		int mode_id = adjusted_mode->base.id;
-		*adjusted_mode = *native_mode;
-		if (!ASIC_IS_AVIVO(rdev)) {
-			adjusted_mode->hdisplay = mode->hdisplay;
-			adjusted_mode->vdisplay = mode->vdisplay;
-		}
-		adjusted_mode->base.id = mode_id;
-	}
-}
-
-
 static bool radeon_atom_mode_fixup(struct drm_encoder *encoder,
 				   struct drm_display_mode *mode,
 				   struct drm_display_mode *adjusted_mode)
@@ -198,14 +220,26 @@ static bool radeon_atom_mode_fixup(struct drm_encoder *encoder,
 	radeon_encoder_set_active_device(encoder);
 	drm_mode_set_crtcinfo(adjusted_mode, 0);
 
-	if (radeon_encoder->rmx_type != RMX_OFF)
-		radeon_rmx_mode_fixup(encoder, mode, adjusted_mode);
-
 	/* hw bug */
 	if ((mode->flags & DRM_MODE_FLAG_INTERLACE)
 	    && (mode->crtc_vsync_start < (mode->crtc_vdisplay + 2)))
 		adjusted_mode->crtc_vsync_start = adjusted_mode->crtc_vdisplay + 2;
 
+	/* get the native mode for LVDS */
+	if (radeon_encoder->active_device & (ATOM_DEVICE_LCD_SUPPORT)) {
+		struct drm_display_mode *native_mode = &radeon_encoder->native_mode;
+		int mode_id = adjusted_mode->base.id;
+		*adjusted_mode = *native_mode;
+		if (!ASIC_IS_AVIVO(rdev)) {
+			adjusted_mode->hdisplay = mode->hdisplay;
+			adjusted_mode->vdisplay = mode->vdisplay;
+			adjusted_mode->crtc_hdisplay = mode->hdisplay;
+			adjusted_mode->crtc_vdisplay = mode->vdisplay;
+		}
+		adjusted_mode->base.id = mode_id;
+	}
+
+	/* get the native mode for TV */
 	if (radeon_encoder->active_device & (ATOM_DEVICE_TV_SUPPORT)) {
 		struct radeon_encoder_atom_dac *tv_dac = radeon_encoder->enc_priv;
 		if (tv_dac) {
@@ -218,6 +252,12 @@ static bool radeon_atom_mode_fixup(struct drm_encoder *encoder,
 		}
 	}
 
+	if (ASIC_IS_DCE3(rdev) &&
+	    (radeon_encoder->active_device & (ATOM_DEVICE_DFP_SUPPORT))) {
+		struct drm_connector *connector = radeon_get_connector_for_encoder(encoder);
+		radeon_dp_set_link_config(connector, mode);
+	}
+
 	return true;
 }
 
@@ -392,7 +432,7 @@ union lvds_encoder_control {
 	LVDS_ENCODER_CONTROL_PS_ALLOCATION_V2 v2;
 };
 
-static void
+void
 atombios_digital_setup(struct drm_encoder *encoder, int action)
 {
 	struct drm_device *dev = encoder->dev;
@@ -400,6 +440,7 @@ atombios_digital_setup(struct drm_encoder *encoder, int action)
 	struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
 	union lvds_encoder_control args;
 	int index = 0;
+	int hdmi_detected = 0;
 	uint8_t frev, crev;
 	struct radeon_encoder_atom_dig *dig;
 	struct drm_connector *connector;
@@ -420,6 +461,9 @@ atombios_digital_setup(struct drm_encoder *encoder, int action)
 	if (!radeon_connector->con_priv)
 		return;
 
+	if (drm_detect_hdmi_monitor(radeon_connector->edid))
+		hdmi_detected = 1;
+
 	dig_connector = radeon_connector->con_priv;
 
 	memset(&args, 0, sizeof(args));
@@ -449,13 +493,13 @@ atombios_digital_setup(struct drm_encoder *encoder, int action)
 		case 1:
 			args.v1.ucMisc = 0;
 			args.v1.ucAction = action;
-			if (drm_detect_hdmi_monitor(radeon_connector->edid))
+			if (hdmi_detected)
 				args.v1.ucMisc |= PANEL_ENCODER_MISC_HDMI_TYPE;
 			args.v1.usPixelClock = cpu_to_le16(radeon_encoder->pixel_clock / 10);
 			if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT)) {
-				if (dig->lvds_misc & (1 << 0))
+				if (dig->lvds_misc & ATOM_PANEL_MISC_DUAL)
 					args.v1.ucMisc |= PANEL_ENCODER_MISC_DUAL;
-				if (dig->lvds_misc & (1 << 1))
+				if (dig->lvds_misc & ATOM_PANEL_MISC_888RGB)
 					args.v1.ucMisc |= (1 << 1);
 			} else {
 				if (dig_connector->linkb)
@@ -474,7 +518,7 @@ atombios_digital_setup(struct drm_encoder *encoder, int action)
 				if (dig->coherent_mode)
 					args.v2.ucMisc |= PANEL_ENCODER_MISC_COHERENT;
 			}
-			if (drm_detect_hdmi_monitor(radeon_connector->edid))
+			if (hdmi_detected)
 				args.v2.ucMisc |= PANEL_ENCODER_MISC_HDMI_TYPE;
 			args.v2.usPixelClock = cpu_to_le16(radeon_encoder->pixel_clock / 10);
 			args.v2.ucTruncate = 0;
@@ -482,18 +526,18 @@ atombios_digital_setup(struct drm_encoder *encoder, int action)
 			args.v2.ucTemporal = 0;
 			args.v2.ucFRC = 0;
 			if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT)) {
-				if (dig->lvds_misc & (1 << 0))
+				if (dig->lvds_misc & ATOM_PANEL_MISC_DUAL)
 					args.v2.ucMisc |= PANEL_ENCODER_MISC_DUAL;
-				if (dig->lvds_misc & (1 << 5)) {
+				if (dig->lvds_misc & ATOM_PANEL_MISC_SPATIAL) {
 					args.v2.ucSpatial = PANEL_ENCODER_SPATIAL_DITHER_EN;
-					if (dig->lvds_misc & (1 << 1))
+					if (dig->lvds_misc & ATOM_PANEL_MISC_888RGB)
 						args.v2.ucSpatial |= PANEL_ENCODER_SPATIAL_DITHER_DEPTH;
 				}
-				if (dig->lvds_misc & (1 << 6)) {
+				if (dig->lvds_misc & ATOM_PANEL_MISC_TEMPORAL) {
 					args.v2.ucTemporal = PANEL_ENCODER_TEMPORAL_DITHER_EN;
-					if (dig->lvds_misc & (1 << 1))
+					if (dig->lvds_misc & ATOM_PANEL_MISC_888RGB)
 						args.v2.ucTemporal |= PANEL_ENCODER_TEMPORAL_DITHER_DEPTH;
-					if (((dig->lvds_misc >> 2) & 0x3) == 2)
+					if (((dig->lvds_misc >> ATOM_PANEL_MISC_GREY_LEVEL_SHIFT) & 0x3) == 2)
 						args.v2.ucTemporal |= PANEL_ENCODER_TEMPORAL_LEVEL_4;
 				}
 			} else {
@@ -514,7 +558,7 @@ atombios_digital_setup(struct drm_encoder *encoder, int action)
 	}
 
 	atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
-
+	r600_hdmi_enable(encoder, hdmi_detected);
 }
 
 int
@@ -522,6 +566,7 @@ atombios_get_encoder_mode(struct drm_encoder *encoder)
 {
 	struct drm_connector *connector;
 	struct radeon_connector *radeon_connector;
+	struct radeon_connector_atom_dig *radeon_dig_connector;
 
 	connector = radeon_get_connector_for_encoder(encoder);
 	if (!connector)
@@ -551,21 +596,23 @@ atombios_get_encoder_mode(struct drm_encoder *encoder)
 		return ATOM_ENCODER_MODE_LVDS;
 		break;
 	case DRM_MODE_CONNECTOR_DisplayPort:
-		/*if (radeon_output->MonType == MT_DP)
-		  return ATOM_ENCODER_MODE_DP;
-		  else*/
-		if (drm_detect_hdmi_monitor(radeon_connector->edid))
+	case DRM_MODE_CONNECTOR_eDP:
+		radeon_dig_connector = radeon_connector->con_priv;
+		if ((radeon_dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_DISPLAYPORT) ||
+		    (radeon_dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_eDP))
+			return ATOM_ENCODER_MODE_DP;
+		else if (drm_detect_hdmi_monitor(radeon_connector->edid))
 			return ATOM_ENCODER_MODE_HDMI;
 		else
 			return ATOM_ENCODER_MODE_DVI;
 		break;
-	case CONNECTOR_DVI_A:
-	case CONNECTOR_VGA:
+	case DRM_MODE_CONNECTOR_DVIA:
+	case DRM_MODE_CONNECTOR_VGA:
 		return ATOM_ENCODER_MODE_CRT;
 		break;
-	case CONNECTOR_STV:
-	case CONNECTOR_CTV:
-	case CONNECTOR_DIN:
+	case DRM_MODE_CONNECTOR_Composite:
+	case DRM_MODE_CONNECTOR_SVIDEO:
+	case DRM_MODE_CONNECTOR_9PinDIN:
 		/* fix me */
 		return ATOM_ENCODER_MODE_TV;
 		/*return ATOM_ENCODER_MODE_CV;*/
@@ -573,6 +620,30 @@ atombios_get_encoder_mode(struct drm_encoder *encoder)
 	}
 }
 
+/*
+ * DIG Encoder/Transmitter Setup
+ *
+ * DCE 3.0/3.1
+ * - 2 DIG transmitter blocks. UNIPHY (links A and B) and LVTMA.
+ * Supports up to 3 digital outputs
+ * - 2 DIG encoder blocks.
+ * DIG1 can drive UNIPHY link A or link B
+ * DIG2 can drive UNIPHY link B or LVTMA
+ *
+ * DCE 3.2
+ * - 3 DIG transmitter blocks. UNIPHY0/1/2 (links A and B).
+ * Supports up to 5 digital outputs
+ * - 2 DIG encoder blocks.
+ * DIG1/2 can drive UNIPHY0/1/2 link A or link B
+ *
+ * Routing
+ * crtc -> dig encoder -> UNIPHY/LVTMA (1 or 2 links)
+ * Examples:
+ * crtc0 -> dig2 -> LVTMA   links A+B -> TMDS/HDMI
+ * crtc1 -> dig1 -> UNIPHY0 link  B   -> DP
+ * crtc0 -> dig1 -> UNIPHY2 link  A   -> LVDS
+ * crtc1 -> dig2 -> UNIPHY1 link  B+A -> TMDS/HDMI
+ */
 static void
 atombios_dig_encoder_setup(struct drm_encoder *encoder, int action)
 {
@@ -614,10 +685,17 @@ atombios_dig_encoder_setup(struct drm_encoder *encoder, int action)
 	} else {
 		switch (radeon_encoder->encoder_id) {
 		case ENCODER_OBJECT_ID_INTERNAL_UNIPHY:
-			index = GetIndexIntoMasterTable(COMMAND, DIG1EncoderControl);
+			/* XXX doesn't really matter which dig encoder we pick as long as it's
+			 * not already in use
+			 */
+			if (dig_connector->linkb)
+				index = GetIndexIntoMasterTable(COMMAND, DIG2EncoderControl);
+			else
+				index = GetIndexIntoMasterTable(COMMAND, DIG1EncoderControl);
 			num = 1;
 			break;
 		case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_LVTMA:
+			/* Only dig2 encoder can drive LVTMA */
 			index = GetIndexIntoMasterTable(COMMAND, DIG2EncoderControl);
 			num = 2;
 			break;
@@ -652,18 +730,21 @@ atombios_dig_encoder_setup(struct drm_encoder *encoder, int action)
 		}
 	}
 
-	if (radeon_encoder->pixel_clock > 165000) {
-		args.ucConfig |= ATOM_ENCODER_CONFIG_LINKA_B;
+	args.ucEncoderMode = atombios_get_encoder_mode(encoder);
+
+	if (args.ucEncoderMode == ATOM_ENCODER_MODE_DP) {
+		if (dig_connector->dp_clock == 270000)
+			args.ucConfig |= ATOM_ENCODER_CONFIG_DPLINKRATE_2_70GHZ;
+		args.ucLaneNum = dig_connector->dp_lane_count;
+	} else if (radeon_encoder->pixel_clock > 165000)
 		args.ucLaneNum = 8;
-	} else {
-		if (dig_connector->linkb)
-			args.ucConfig |= ATOM_ENCODER_CONFIG_LINKB;
-		else
-			args.ucConfig |= ATOM_ENCODER_CONFIG_LINKA;
+	else
 		args.ucLaneNum = 4;
-	}
 
-	args.ucEncoderMode = atombios_get_encoder_mode(encoder);
+	if (dig_connector->linkb)
+		args.ucConfig |= ATOM_ENCODER_CONFIG_LINKB;
+	else
+		args.ucConfig |= ATOM_ENCODER_CONFIG_LINKA;
 
 	atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
 
@@ -674,8 +755,8 @@ union dig_transmitter_control {
 	DIG_TRANSMITTER_CONTROL_PARAMETERS_V2 v2;
 };
 
-static void
-atombios_dig_transmitter_setup(struct drm_encoder *encoder, int action)
+void
+atombios_dig_transmitter_setup(struct drm_encoder *encoder, int action, uint8_t lane_num, uint8_t lane_set)
 {
 	struct drm_device *dev = encoder->dev;
 	struct radeon_device *rdev = dev->dev_private;
@@ -687,6 +768,7 @@ atombios_dig_transmitter_setup(struct drm_encoder *encoder, int action)
 	struct drm_connector *connector;
 	struct radeon_connector *radeon_connector;
 	struct radeon_connector_atom_dig *dig_connector;
+	bool is_dp = false;
 
 	connector = radeon_get_connector_for_encoder(encoder);
 	if (!connector)
@@ -704,6 +786,9 @@ atombios_dig_transmitter_setup(struct drm_encoder *encoder, int action)
 
 	dig_connector = radeon_connector->con_priv;
 
+	if (atombios_get_encoder_mode(encoder) == ATOM_ENCODER_MODE_DP)
+		is_dp = true;
+
 	memset(&args, 0, sizeof(args));
 
 	if (ASIC_IS_DCE32(rdev))
@@ -724,17 +809,23 @@ atombios_dig_transmitter_setup(struct drm_encoder *encoder, int action)
 	args.v1.ucAction = action;
 	if (action == ATOM_TRANSMITTER_ACTION_INIT) {
 		args.v1.usInitInfo = radeon_connector->connector_object_id;
+	} else if (action == ATOM_TRANSMITTER_ACTION_SETUP_VSEMPH) {
+		args.v1.asMode.ucLaneSel = lane_num;
+		args.v1.asMode.ucLaneSet = lane_set;
 	} else {
-		if (radeon_encoder->pixel_clock > 165000)
+		if (is_dp)
+			args.v1.usPixelClock =
+				cpu_to_le16(dig_connector->dp_clock / 10);
+		else if (radeon_encoder->pixel_clock > 165000)
 			args.v1.usPixelClock = cpu_to_le16((radeon_encoder->pixel_clock / 2) / 10);
 		else
 			args.v1.usPixelClock = cpu_to_le16(radeon_encoder->pixel_clock / 10);
 	}
 	if (ASIC_IS_DCE32(rdev)) {
-		if (radeon_encoder->pixel_clock > 165000)
-			args.v2.usPixelClock = cpu_to_le16((radeon_encoder->pixel_clock / 2) / 10);
 		if (dig->dig_block)
 			args.v2.acConfig.ucEncoderSel = 1;
+		if (dig_connector->linkb)
+			args.v2.acConfig.ucLinkSel = 1;
 
 		switch (radeon_encoder->encoder_id) {
 		case ENCODER_OBJECT_ID_INTERNAL_UNIPHY:
@@ -751,7 +842,9 @@ atombios_dig_transmitter_setup(struct drm_encoder *encoder, int action)
 			break;
 		}
 
-		if (radeon_encoder->devices & (ATOM_DEVICE_DFP_SUPPORT)) {
+		if (is_dp)
+			args.v2.acConfig.fCoherentMode = 1;
+		else if (radeon_encoder->devices & (ATOM_DEVICE_DFP_SUPPORT)) {
 			if (dig->coherent_mode)
 				args.v2.acConfig.fCoherentMode = 1;
 		}
@@ -760,17 +853,20 @@ atombios_dig_transmitter_setup(struct drm_encoder *encoder, int action)
 
 		switch (radeon_encoder->encoder_id) {
 		case ENCODER_OBJECT_ID_INTERNAL_UNIPHY:
-			args.v1.ucConfig |= ATOM_TRANSMITTER_CONFIG_DIG1_ENCODER;
+			/* XXX doesn't really matter which dig encoder we pick as long as it's
+			 * not already in use
+			 */
+			if (dig_connector->linkb)
+				args.v1.ucConfig |= ATOM_TRANSMITTER_CONFIG_DIG2_ENCODER;
+			else
+				args.v1.ucConfig |= ATOM_TRANSMITTER_CONFIG_DIG1_ENCODER;
 			if (rdev->flags & RADEON_IS_IGP) {
 				if (radeon_encoder->pixel_clock > 165000) {
-					args.v1.ucConfig |= (ATOM_TRANSMITTER_CONFIG_8LANE_LINK |
-							     ATOM_TRANSMITTER_CONFIG_LINKA_B);
 					if (dig_connector->igp_lane_info & 0x3)
 						args.v1.ucConfig |= ATOM_TRANSMITTER_CONFIG_LANE_0_7;
 					else if (dig_connector->igp_lane_info & 0xc)
 						args.v1.ucConfig |= ATOM_TRANSMITTER_CONFIG_LANE_8_15;
 				} else {
-					args.v1.ucConfig |= ATOM_TRANSMITTER_CONFIG_LINKA;
 					if (dig_connector->igp_lane_info & 0x1)
 						args.v1.ucConfig |= ATOM_TRANSMITTER_CONFIG_LANE_0_3;
 					else if (dig_connector->igp_lane_info & 0x2)
@@ -780,42 +876,31 @@ atombios_dig_transmitter_setup(struct drm_encoder *encoder, int action)
 					else if (dig_connector->igp_lane_info & 0x8)
 						args.v1.ucConfig |= ATOM_TRANSMITTER_CONFIG_LANE_12_15;
 				}
-			} else {
-				if (radeon_encoder->pixel_clock > 165000)
-					args.v1.ucConfig |= (ATOM_TRANSMITTER_CONFIG_8LANE_LINK |
-							     ATOM_TRANSMITTER_CONFIG_LINKA_B |
-							     ATOM_TRANSMITTER_CONFIG_LANE_0_7);
-				else {
-					if (dig_connector->linkb)
-						args.v1.ucConfig |= ATOM_TRANSMITTER_CONFIG_LINKB | ATOM_TRANSMITTER_CONFIG_LANE_0_3;
-					else
-						args.v1.ucConfig |= ATOM_TRANSMITTER_CONFIG_LINKA | ATOM_TRANSMITTER_CONFIG_LANE_0_3;
-				}
 			}
 			break;
 		case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_LVTMA:
+			/* Only dig2 encoder can drive LVTMA */
 			args.v1.ucConfig |= ATOM_TRANSMITTER_CONFIG_DIG2_ENCODER;
-			if (radeon_encoder->pixel_clock > 165000)
-				args.v1.ucConfig |= (ATOM_TRANSMITTER_CONFIG_8LANE_LINK |
-						     ATOM_TRANSMITTER_CONFIG_LINKA_B |
-						     ATOM_TRANSMITTER_CONFIG_LANE_0_7);
-			else {
-				if (dig_connector->linkb)
-					args.v1.ucConfig |= ATOM_TRANSMITTER_CONFIG_LINKB | ATOM_TRANSMITTER_CONFIG_LANE_0_3;
-				else
-					args.v1.ucConfig |= ATOM_TRANSMITTER_CONFIG_LINKA | ATOM_TRANSMITTER_CONFIG_LANE_0_3;
-			}
 			break;
 		}
 
-		if (radeon_encoder->devices & (ATOM_DEVICE_DFP_SUPPORT)) {
+		if (radeon_encoder->pixel_clock > 165000)
+			args.v1.ucConfig |= ATOM_TRANSMITTER_CONFIG_8LANE_LINK;
+
+		if (dig_connector->linkb)
+			args.v1.ucConfig |= ATOM_TRANSMITTER_CONFIG_LINKB;
+		else
+			args.v1.ucConfig |= ATOM_TRANSMITTER_CONFIG_LINKA;
+
+		if (is_dp)
+			args.v1.ucConfig |= ATOM_TRANSMITTER_CONFIG_COHERENT;
+		else if (radeon_encoder->devices & (ATOM_DEVICE_DFP_SUPPORT)) {
 			if (dig->coherent_mode)
 				args.v1.ucConfig |= ATOM_TRANSMITTER_CONFIG_COHERENT;
 		}
 	}
 
 	atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
-
 }
 
 static void
@@ -918,12 +1003,16 @@ radeon_atom_encoder_dpms(struct drm_encoder *encoder, int mode)
 	if (is_dig) {
 		switch (mode) {
 		case DRM_MODE_DPMS_ON:
-			atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE);
+			atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE_OUTPUT, 0, 0);
+			{
+				struct drm_connector *connector = radeon_get_connector_for_encoder(encoder);
+				dp_link_train(encoder, connector);
+			}
 			break;
 		case DRM_MODE_DPMS_STANDBY:
 		case DRM_MODE_DPMS_SUSPEND:
 		case DRM_MODE_DPMS_OFF:
-			atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_DISABLE);
+			atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_DISABLE_OUTPUT, 0, 0);
 			break;
 		}
 	} else {
@@ -1025,13 +1114,33 @@ atombios_set_encoder_crtc_source(struct drm_encoder *encoder)
 						args.v2.ucEncoderID = ASIC_INT_DIG2_ENCODER_ID;
 					else
 						args.v2.ucEncoderID = ASIC_INT_DIG1_ENCODER_ID;
-				} else
-					args.v2.ucEncoderID = ASIC_INT_DIG1_ENCODER_ID;
+				} else {
+					struct drm_connector *connector;
+					struct radeon_connector *radeon_connector;
+					struct radeon_connector_atom_dig *dig_connector;
+
+					connector = radeon_get_connector_for_encoder(encoder);
+					if (!connector)
+						return;
+					radeon_connector = to_radeon_connector(connector);
+					if (!radeon_connector->con_priv)
+						return;
+					dig_connector = radeon_connector->con_priv;
+
+					/* XXX doesn't really matter which dig encoder we pick as long as it's
+					 * not already in use
+					 */
+					if (dig_connector->linkb)
+						args.v2.ucEncoderID = ASIC_INT_DIG2_ENCODER_ID;
+					else
+						args.v2.ucEncoderID = ASIC_INT_DIG1_ENCODER_ID;
+				}
 				break;
 			case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_DVO1:
 				args.v2.ucEncoderID = ASIC_INT_DVO_ENCODER_ID;
 				break;
 			case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_LVTMA:
+				/* Only dig2 encoder can drive LVTMA */
 				args.v2.ucEncoderID = ASIC_INT_DIG2_ENCODER_ID;
 				break;
 			case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_DAC1:
@@ -1060,7 +1169,6 @@ atombios_set_encoder_crtc_source(struct drm_encoder *encoder)
 	}
 
 	atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
-
 }
 
 static void
@@ -1104,11 +1212,14 @@ radeon_atom_encoder_mode_set(struct drm_encoder *encoder,
 	struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
 	struct radeon_crtc *radeon_crtc = to_radeon_crtc(encoder->crtc);
 
-	if (radeon_encoder->enc_priv) {
-		struct radeon_encoder_atom_dig *dig;
+	if (radeon_encoder->active_device &
+	    (ATOM_DEVICE_DFP_SUPPORT | ATOM_DEVICE_LCD_SUPPORT)) {
+		if (radeon_encoder->enc_priv) {
+			struct radeon_encoder_atom_dig *dig;
 
-		dig = radeon_encoder->enc_priv;
-		dig->dig_block = radeon_crtc->crtc_id;
+			dig = radeon_encoder->enc_priv;
+			dig->dig_block = radeon_crtc->crtc_id;
+		}
 	}
 	radeon_encoder->pixel_clock = adjusted_mode->clock;
 
@@ -1134,14 +1245,14 @@ radeon_atom_encoder_mode_set(struct drm_encoder *encoder,
 	case ENCODER_OBJECT_ID_INTERNAL_UNIPHY2:
 	case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_LVTMA:
 		/* disable the encoder and transmitter */
-		atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_DISABLE);
+		atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_DISABLE, 0, 0);
 		atombios_dig_encoder_setup(encoder, ATOM_DISABLE);
 
 		/* setup and enable the encoder and transmitter */
 		atombios_dig_encoder_setup(encoder, ATOM_ENABLE);
-		atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_INIT);
-		atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_SETUP);
-		atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE);
+		atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_INIT, 0, 0);
+		atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_SETUP, 0, 0);
+		atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE, 0, 0);
 		break;
 	case ENCODER_OBJECT_ID_INTERNAL_DDI:
 		atombios_ddia_setup(encoder, ATOM_ENABLE);
@@ -1160,6 +1271,8 @@ radeon_atom_encoder_mode_set(struct drm_encoder *encoder,
 		break;
 	}
 	atombios_apply_encoder_quirks(encoder, adjusted_mode);
+
+	r600_hdmi_setmode(encoder, adjusted_mode);
 }
 
 static bool
@@ -1354,7 +1467,6 @@ radeon_add_atom_encoder(struct drm_device *dev, uint32_t encoder_id, uint32_t su
 		encoder->possible_crtcs = 0x1;
 	else
 		encoder->possible_crtcs = 0x3;
-	encoder->possible_clones = 0;
 
 	radeon_encoder->enc_priv = NULL;
 
@@ -1406,4 +1518,6 @@ radeon_add_atom_encoder(struct drm_device *dev, uint32_t encoder_id, uint32_t su
 		drm_encoder_helper_add(encoder, &radeon_atom_dig_helper_funcs);
 		break;
 	}
+
+	r600_hdmi_init(encoder);
 }
diff --git a/drivers/gpu/drm/radeon/radeon_fb.c b/drivers/gpu/drm/radeon/radeon_fb.c
index b38c4c8e2c61..3ba213d1b06c 100644
--- a/drivers/gpu/drm/radeon/radeon_fb.c
+++ b/drivers/gpu/drm/radeon/radeon_fb.c
@@ -59,7 +59,7 @@ static struct fb_ops radeonfb_ops = {
 };
 
 /**
- * Curretly it is assumed that the old framebuffer is reused.
+ * Currently it is assumed that the old framebuffer is reused.
  *
  * LOCKING
  * caller should hold the mode config lock.
@@ -140,7 +140,7 @@ int radeonfb_create(struct drm_device *dev,
 	struct radeon_framebuffer *rfb;
 	struct drm_mode_fb_cmd mode_cmd;
 	struct drm_gem_object *gobj = NULL;
-	struct radeon_object *robj = NULL;
+	struct radeon_bo *rbo = NULL;
 	struct device *device = &rdev->pdev->dev;
 	int size, aligned_size, ret;
 	u64 fb_gpuaddr;
@@ -168,14 +168,14 @@ int radeonfb_create(struct drm_device *dev,
 	ret = radeon_gem_object_create(rdev, aligned_size, 0,
 			RADEON_GEM_DOMAIN_VRAM,
 			false, ttm_bo_type_kernel,
-			false, &gobj);
+			&gobj);
 	if (ret) {
 		printk(KERN_ERR "failed to allocate framebuffer (%d %d)\n",
 		       surface_width, surface_height);
 		ret = -ENOMEM;
 		goto out;
 	}
-	robj = gobj->driver_private;
+	rbo = gobj->driver_private;
 
 	if (fb_tiled)
 		tiling_flags = RADEON_TILING_MACRO;
@@ -192,8 +192,13 @@ int radeonfb_create(struct drm_device *dev,
 	}
 #endif
 
-	if (tiling_flags)
-		radeon_object_set_tiling_flags(robj, tiling_flags | RADEON_TILING_SURFACE, mode_cmd.pitch);
+	if (tiling_flags) {
+		ret = radeon_bo_set_tiling_flags(rbo,
+					tiling_flags | RADEON_TILING_SURFACE,
+					mode_cmd.pitch);
+		if (ret)
+			dev_err(rdev->dev, "FB failed to set tiling flags\n");
+	}
 	mutex_lock(&rdev->ddev->struct_mutex);
 	fb = radeon_framebuffer_create(rdev->ddev, &mode_cmd, gobj);
 	if (fb == NULL) {
@@ -201,10 +206,19 @@ int radeonfb_create(struct drm_device *dev,
 		ret = -ENOMEM;
 		goto out_unref;
 	}
-	ret = radeon_object_pin(robj, RADEON_GEM_DOMAIN_VRAM, &fb_gpuaddr);
+	ret = radeon_bo_reserve(rbo, false);
+	if (unlikely(ret != 0))
+		goto out_unref;
+	ret = radeon_bo_pin(rbo, RADEON_GEM_DOMAIN_VRAM, &fb_gpuaddr);
+	if (ret) {
+		radeon_bo_unreserve(rbo);
+		goto out_unref;
+	}
+	if (fb_tiled)
+		radeon_bo_check_tiling(rbo, 0, 0);
+	ret = radeon_bo_kmap(rbo, &fbptr);
+	radeon_bo_unreserve(rbo);
 	if (ret) {
-		printk(KERN_ERR "failed to pin framebuffer\n");
-		ret = -ENOMEM;
 		goto out_unref;
 	}
 
@@ -213,7 +227,7 @@ int radeonfb_create(struct drm_device *dev,
 	*fb_p = fb;
 	rfb = to_radeon_framebuffer(fb);
 	rdev->fbdev_rfb = rfb;
-	rdev->fbdev_robj = robj;
+	rdev->fbdev_rbo = rbo;
 
 	info = framebuffer_alloc(sizeof(struct radeon_fb_device), device);
 	if (info == NULL) {
@@ -234,15 +248,7 @@ int radeonfb_create(struct drm_device *dev,
 	if (ret)
 		goto out_unref;
 
-	if (fb_tiled)
-		radeon_object_check_tiling(robj, 0, 0);
-
-	ret = radeon_object_kmap(robj, &fbptr);
-	if (ret) {
-		goto out_unref;
-	}
-
-	memset_io(fbptr, 0, aligned_size);
+	memset_io(fbptr, 0xff, aligned_size);
 
 	strcpy(info->fix.id, "radeondrmfb");
 
@@ -288,8 +294,12 @@ int radeonfb_create(struct drm_device *dev,
 	return 0;
 
 out_unref:
-	if (robj) {
-		radeon_object_kunmap(robj);
+	if (rbo) {
+		ret = radeon_bo_reserve(rbo, false);
+		if (likely(ret == 0)) {
+			radeon_bo_kunmap(rbo);
+			radeon_bo_unreserve(rbo);
+		}
 	}
 	if (fb && ret) {
 		list_del(&fb->filp_head);
@@ -321,14 +331,22 @@ int radeon_parse_options(char *options)
 
 int radeonfb_probe(struct drm_device *dev)
 {
-	return drm_fb_helper_single_fb_probe(dev, 32, &radeonfb_create);
+	struct radeon_device *rdev = dev->dev_private;
+	int bpp_sel = 32;
+
+	/* select 8 bpp console on RN50 or 16MB cards */
+	if (ASIC_IS_RN50(rdev) || rdev->mc.real_vram_size <= (32*1024*1024))
+		bpp_sel = 8;
+
+	return drm_fb_helper_single_fb_probe(dev, bpp_sel, &radeonfb_create);
 }
 
 int radeonfb_remove(struct drm_device *dev, struct drm_framebuffer *fb)
 {
 	struct fb_info *info;
 	struct radeon_framebuffer *rfb = to_radeon_framebuffer(fb);
-	struct radeon_object *robj;
+	struct radeon_bo *rbo;
+	int r;
 
 	if (!fb) {
 		return -EINVAL;
@@ -336,10 +354,14 @@ int radeonfb_remove(struct drm_device *dev, struct drm_framebuffer *fb)
 	info = fb->fbdev;
 	if (info) {
 		struct radeon_fb_device *rfbdev = info->par;
-		robj = rfb->obj->driver_private;
+		rbo = rfb->obj->driver_private;
 		unregister_framebuffer(info);
-		radeon_object_kunmap(robj);
-		radeon_object_unpin(robj);
+		r = radeon_bo_reserve(rbo, false);
+		if (likely(r == 0)) {
+			radeon_bo_kunmap(rbo);
+			radeon_bo_unpin(rbo);
+			radeon_bo_unreserve(rbo);
+		}
 		drm_fb_helper_free(&rfbdev->helper);
 		framebuffer_release(info);
 	}
diff --git a/drivers/gpu/drm/radeon/radeon_fence.c b/drivers/gpu/drm/radeon/radeon_fence.c
index 3beb26d74719..8495d4e32e18 100644
--- a/drivers/gpu/drm/radeon/radeon_fence.c
+++ b/drivers/gpu/drm/radeon/radeon_fence.c
@@ -140,16 +140,15 @@ int radeon_fence_create(struct radeon_device *rdev, struct radeon_fence **fence)
 
 bool radeon_fence_signaled(struct radeon_fence *fence)
 {
-	struct radeon_device *rdev = fence->rdev;
 	unsigned long irq_flags;
 	bool signaled = false;
 
-	if (rdev->gpu_lockup) {
+	if (!fence)
 		return true;
-	}
-	if (fence == NULL) {
+
+	if (fence->rdev->gpu_lockup)
 		return true;
-	}
+
 	write_lock_irqsave(&fence->rdev->fence_drv.lock, irq_flags);
 	signaled = fence->signaled;
 	/* if we are shuting down report all fence as signaled */
@@ -168,37 +167,6 @@ bool radeon_fence_signaled(struct radeon_fence *fence)
 	return signaled;
 }
 
-int r600_fence_wait(struct radeon_fence *fence,  bool intr, bool lazy)
-{
-	struct radeon_device *rdev;
-	int ret = 0;
-
-	rdev = fence->rdev;
-
-	__set_current_state(intr ? TASK_INTERRUPTIBLE : TASK_UNINTERRUPTIBLE);
-
-	while (1) {
-		if (radeon_fence_signaled(fence))
-			break;
-
-		if (time_after_eq(jiffies, fence->timeout)) {
-			ret = -EBUSY;
-			break;
-		}
-
-		if (lazy)
-			schedule_timeout(1);
-
-		if (intr && signal_pending(current)) {
-			ret = -ERESTARTSYS;
-			break;
-		}
-	}
-	__set_current_state(TASK_RUNNING);
-	return ret;
-}
-
-
 int radeon_fence_wait(struct radeon_fence *fence, bool intr)
 {
 	struct radeon_device *rdev;
@@ -216,13 +184,6 @@ int radeon_fence_wait(struct radeon_fence *fence, bool intr)
 		return 0;
 	}
 
-	if (rdev->family >= CHIP_R600) {
-		r = r600_fence_wait(fence, intr, 0);
-		if (r == -ERESTARTSYS)
-			return -EBUSY;
-		return r;
-	}
-
 retry:
 	cur_jiffies = jiffies;
 	timeout = HZ / 100;
@@ -231,14 +192,17 @@ retry:
 	}
 
 	if (intr) {
+		radeon_irq_kms_sw_irq_get(rdev);
 		r = wait_event_interruptible_timeout(rdev->fence_drv.queue,
 				radeon_fence_signaled(fence), timeout);
-		if (unlikely(r == -ERESTARTSYS)) {
-			return -EBUSY;
-		}
+		radeon_irq_kms_sw_irq_put(rdev);
+		if (unlikely(r < 0))
+			return r;
 	} else {
+		radeon_irq_kms_sw_irq_get(rdev);
 		r = wait_event_timeout(rdev->fence_drv.queue,
 			 radeon_fence_signaled(fence), timeout);
+		radeon_irq_kms_sw_irq_put(rdev);
 	}
 	if (unlikely(!radeon_fence_signaled(fence))) {
 		if (unlikely(r == 0)) {
@@ -359,7 +323,7 @@ int radeon_fence_driver_init(struct radeon_device *rdev)
 	write_lock_irqsave(&rdev->fence_drv.lock, irq_flags);
 	r = radeon_scratch_get(rdev, &rdev->fence_drv.scratch_reg);
 	if (r) {
-		DRM_ERROR("Fence failed to get a scratch register.");
+		dev_err(rdev->dev, "fence failed to get scratch register\n");
 		write_unlock_irqrestore(&rdev->fence_drv.lock, irq_flags);
 		return r;
 	}
@@ -370,9 +334,10 @@ int radeon_fence_driver_init(struct radeon_device *rdev)
 	INIT_LIST_HEAD(&rdev->fence_drv.signaled);
 	rdev->fence_drv.count_timeout = 0;
 	init_waitqueue_head(&rdev->fence_drv.queue);
+	rdev->fence_drv.initialized = true;
 	write_unlock_irqrestore(&rdev->fence_drv.lock, irq_flags);
 	if (radeon_debugfs_fence_init(rdev)) {
-		DRM_ERROR("Failed to register debugfs file for fence !\n");
+		dev_err(rdev->dev, "fence debugfs file creation failed\n");
 	}
 	return 0;
 }
@@ -381,11 +346,13 @@ void radeon_fence_driver_fini(struct radeon_device *rdev)
 {
 	unsigned long irq_flags;
 
+	if (!rdev->fence_drv.initialized)
+		return;
 	wake_up_all(&rdev->fence_drv.queue);
 	write_lock_irqsave(&rdev->fence_drv.lock, irq_flags);
 	radeon_scratch_free(rdev, rdev->fence_drv.scratch_reg);
 	write_unlock_irqrestore(&rdev->fence_drv.lock, irq_flags);
-	DRM_INFO("radeon: fence finalized\n");
+	rdev->fence_drv.initialized = false;
 }
 
 
diff --git a/drivers/gpu/drm/radeon/radeon_fixed.h b/drivers/gpu/drm/radeon/radeon_fixed.h
index 90187d173847..3d4d84e078ac 100644
--- a/drivers/gpu/drm/radeon/radeon_fixed.h
+++ b/drivers/gpu/drm/radeon/radeon_fixed.h
@@ -38,6 +38,23 @@ typedef union rfixed {
 #define fixed_init_half(A) { .full = rfixed_const_half((A)) }
 #define rfixed_trunc(A) ((A).full >> 12)
 
+static inline u32 rfixed_floor(fixed20_12 A)
+{
+	u32 non_frac = rfixed_trunc(A);
+
+	return rfixed_const(non_frac);
+}
+
+static inline u32 rfixed_ceil(fixed20_12 A)
+{
+	u32 non_frac = rfixed_trunc(A);
+
+	if (A.full > rfixed_const(non_frac))
+		return rfixed_const(non_frac + 1);
+	else
+		return rfixed_const(non_frac);
+}
+
 static inline u32 rfixed_div(fixed20_12 A, fixed20_12 B)
 {
 	u64 tmp = ((u64)A.full << 13);
diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c
index a68d7566178c..e73d56e83fa6 100644
--- a/drivers/gpu/drm/radeon/radeon_gart.c
+++ b/drivers/gpu/drm/radeon/radeon_gart.c
@@ -78,11 +78,9 @@ int radeon_gart_table_vram_alloc(struct radeon_device *rdev)
 	int r;
 
 	if (rdev->gart.table.vram.robj == NULL) {
-		r = radeon_object_create(rdev, NULL,
-					 rdev->gart.table_size,
-					 true,
-					 RADEON_GEM_DOMAIN_VRAM,
-					 false, &rdev->gart.table.vram.robj);
+		r = radeon_bo_create(rdev, NULL, rdev->gart.table_size,
+					true, RADEON_GEM_DOMAIN_VRAM,
+					&rdev->gart.table.vram.robj);
 		if (r) {
 			return r;
 		}
@@ -95,32 +93,38 @@ int radeon_gart_table_vram_pin(struct radeon_device *rdev)
 	uint64_t gpu_addr;
 	int r;
 
-	r = radeon_object_pin(rdev->gart.table.vram.robj,
-			      RADEON_GEM_DOMAIN_VRAM, &gpu_addr);
-	if (r) {
-		radeon_object_unref(&rdev->gart.table.vram.robj);
+	r = radeon_bo_reserve(rdev->gart.table.vram.robj, false);
+	if (unlikely(r != 0))
 		return r;
-	}
-	r = radeon_object_kmap(rdev->gart.table.vram.robj,
-			       (void **)&rdev->gart.table.vram.ptr);
+	r = radeon_bo_pin(rdev->gart.table.vram.robj,
+				RADEON_GEM_DOMAIN_VRAM, &gpu_addr);
 	if (r) {
-		radeon_object_unpin(rdev->gart.table.vram.robj);
-		radeon_object_unref(&rdev->gart.table.vram.robj);
-		DRM_ERROR("radeon: failed to map gart vram table.\n");
+		radeon_bo_unreserve(rdev->gart.table.vram.robj);
 		return r;
 	}
+	r = radeon_bo_kmap(rdev->gart.table.vram.robj,
+				(void **)&rdev->gart.table.vram.ptr);
+	if (r)
+		radeon_bo_unpin(rdev->gart.table.vram.robj);
+	radeon_bo_unreserve(rdev->gart.table.vram.robj);
 	rdev->gart.table_addr = gpu_addr;
-	return 0;
+	return r;
 }
 
 void radeon_gart_table_vram_free(struct radeon_device *rdev)
 {
+	int r;
+
 	if (rdev->gart.table.vram.robj == NULL) {
 		return;
 	}
-	radeon_object_kunmap(rdev->gart.table.vram.robj);
-	radeon_object_unpin(rdev->gart.table.vram.robj);
-	radeon_object_unref(&rdev->gart.table.vram.robj);
+	r = radeon_bo_reserve(rdev->gart.table.vram.robj, false);
+	if (likely(r == 0)) {
+		radeon_bo_kunmap(rdev->gart.table.vram.robj);
+		radeon_bo_unpin(rdev->gart.table.vram.robj);
+		radeon_bo_unreserve(rdev->gart.table.vram.robj);
+	}
+	radeon_bo_unref(&rdev->gart.table.vram.robj);
 }
 
 
diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c
index d880edf254db..0e1325e18534 100644
--- a/drivers/gpu/drm/radeon/radeon_gem.c
+++ b/drivers/gpu/drm/radeon/radeon_gem.c
@@ -38,22 +38,21 @@ int radeon_gem_object_init(struct drm_gem_object *obj)
 
 void radeon_gem_object_free(struct drm_gem_object *gobj)
 {
-	struct radeon_object *robj = gobj->driver_private;
+	struct radeon_bo *robj = gobj->driver_private;
 
 	gobj->driver_private = NULL;
 	if (robj) {
-		radeon_object_unref(&robj);
+		radeon_bo_unref(&robj);
 	}
 }
 
 int radeon_gem_object_create(struct radeon_device *rdev, int size,
-			     int alignment, int initial_domain,
-			     bool discardable, bool kernel,
-			     bool interruptible,
-			     struct drm_gem_object **obj)
+				int alignment, int initial_domain,
+				bool discardable, bool kernel,
+				struct drm_gem_object **obj)
 {
 	struct drm_gem_object *gobj;
-	struct radeon_object *robj;
+	struct radeon_bo *robj;
 	int r;
 
 	*obj = NULL;
@@ -65,11 +64,11 @@ int radeon_gem_object_create(struct radeon_device *rdev, int size,
 	if (alignment < PAGE_SIZE) {
 		alignment = PAGE_SIZE;
 	}
-	r = radeon_object_create(rdev, gobj, size, kernel, initial_domain,
-				 interruptible, &robj);
+	r = radeon_bo_create(rdev, gobj, size, kernel, initial_domain, &robj);
 	if (r) {
-		DRM_ERROR("Failed to allocate GEM object (%d, %d, %u)\n",
-			  size, initial_domain, alignment);
+		if (r != -ERESTARTSYS)
+			DRM_ERROR("Failed to allocate GEM object (%d, %d, %u, %d)\n",
+				  size, initial_domain, alignment, r);
 		mutex_lock(&rdev->ddev->struct_mutex);
 		drm_gem_object_unreference(gobj);
 		mutex_unlock(&rdev->ddev->struct_mutex);
@@ -83,33 +82,33 @@ int radeon_gem_object_create(struct radeon_device *rdev, int size,
 int radeon_gem_object_pin(struct drm_gem_object *obj, uint32_t pin_domain,
 			  uint64_t *gpu_addr)
 {
-	struct radeon_object *robj = obj->driver_private;
-	uint32_t flags;
+	struct radeon_bo *robj = obj->driver_private;
+	int r;
 
-	switch (pin_domain) {
-	case RADEON_GEM_DOMAIN_VRAM:
-		flags = TTM_PL_FLAG_VRAM;
-		break;
-	case RADEON_GEM_DOMAIN_GTT:
-		flags = TTM_PL_FLAG_TT;
-		break;
-	default:
-		flags = TTM_PL_FLAG_SYSTEM;
-		break;
-	}
-	return radeon_object_pin(robj, flags, gpu_addr);
+	r = radeon_bo_reserve(robj, false);
+	if (unlikely(r != 0))
+		return r;
+	r = radeon_bo_pin(robj, pin_domain, gpu_addr);
+	radeon_bo_unreserve(robj);
+	return r;
 }
 
 void radeon_gem_object_unpin(struct drm_gem_object *obj)
 {
-	struct radeon_object *robj = obj->driver_private;
-	radeon_object_unpin(robj);
+	struct radeon_bo *robj = obj->driver_private;
+	int r;
+
+	r = radeon_bo_reserve(robj, false);
+	if (likely(r == 0)) {
+		radeon_bo_unpin(robj);
+		radeon_bo_unreserve(robj);
+	}
 }
 
 int radeon_gem_set_domain(struct drm_gem_object *gobj,
 			  uint32_t rdomain, uint32_t wdomain)
 {
-	struct radeon_object *robj;
+	struct radeon_bo *robj;
 	uint32_t domain;
 	int r;
 
@@ -127,7 +126,7 @@ int radeon_gem_set_domain(struct drm_gem_object *gobj,
 	}
 	if (domain == RADEON_GEM_DOMAIN_CPU) {
 		/* Asking for cpu access wait for object idle */
-		r = radeon_object_wait(robj);
+		r = radeon_bo_wait(robj, NULL, false);
 		if (r) {
 			printk(KERN_ERR "Failed to wait for object !\n");
 			return r;
@@ -144,7 +143,7 @@ int radeon_gem_init(struct radeon_device *rdev)
 
 void radeon_gem_fini(struct radeon_device *rdev)
 {
-	radeon_object_force_delete(rdev);
+	radeon_bo_force_delete(rdev);
 }
 
 
@@ -158,9 +157,13 @@ int radeon_gem_info_ioctl(struct drm_device *dev, void *data,
 	struct drm_radeon_gem_info *args = data;
 
 	args->vram_size = rdev->mc.real_vram_size;
-	/* FIXME: report somethings that makes sense */
-	args->vram_visible = rdev->mc.real_vram_size - (4 * 1024 * 1024);
-	args->gart_size = rdev->mc.gtt_size;
+	args->vram_visible = rdev->mc.real_vram_size;
+	if (rdev->stollen_vga_memory)
+		args->vram_visible -= radeon_bo_size(rdev->stollen_vga_memory);
+	if (rdev->fbdev_rbo)
+		args->vram_visible -= radeon_bo_size(rdev->fbdev_rbo);
+	args->gart_size = rdev->mc.gtt_size - rdev->cp.ring_size - 4096 -
+		RADEON_IB_POOL_SIZE*64*1024;
 	return 0;
 }
 
@@ -192,8 +195,8 @@ int radeon_gem_create_ioctl(struct drm_device *dev, void *data,
 	/* create a gem object to contain this object in */
 	args->size = roundup(args->size, PAGE_SIZE);
 	r = radeon_gem_object_create(rdev, args->size, args->alignment,
-				     args->initial_domain, false,
-				     false, true, &gobj);
+					args->initial_domain, false,
+					false, &gobj);
 	if (r) {
 		return r;
 	}
@@ -218,7 +221,7 @@ int radeon_gem_set_domain_ioctl(struct drm_device *dev, void *data,
 	 * just validate the BO into a certain domain */
 	struct drm_radeon_gem_set_domain *args = data;
 	struct drm_gem_object *gobj;
-	struct radeon_object *robj;
+	struct radeon_bo *robj;
 	int r;
 
 	/* for now if someone requests domain CPU -
@@ -244,19 +247,18 @@ int radeon_gem_mmap_ioctl(struct drm_device *dev, void *data,
 {
 	struct drm_radeon_gem_mmap *args = data;
 	struct drm_gem_object *gobj;
-	struct radeon_object *robj;
-	int r;
+	struct radeon_bo *robj;
 
 	gobj = drm_gem_object_lookup(dev, filp, args->handle);
 	if (gobj == NULL) {
 		return -EINVAL;
 	}
 	robj = gobj->driver_private;
-	r = radeon_object_mmap(robj, &args->addr_ptr);
+	args->addr_ptr = radeon_bo_mmap_offset(robj);
 	mutex_lock(&dev->struct_mutex);
 	drm_gem_object_unreference(gobj);
 	mutex_unlock(&dev->struct_mutex);
-	return r;
+	return 0;
 }
 
 int radeon_gem_busy_ioctl(struct drm_device *dev, void *data,
@@ -264,16 +266,16 @@ int radeon_gem_busy_ioctl(struct drm_device *dev, void *data,
 {
 	struct drm_radeon_gem_busy *args = data;
 	struct drm_gem_object *gobj;
-	struct radeon_object *robj;
+	struct radeon_bo *robj;
 	int r;
-	uint32_t cur_placement;
+	uint32_t cur_placement = 0;
 
 	gobj = drm_gem_object_lookup(dev, filp, args->handle);
 	if (gobj == NULL) {
 		return -EINVAL;
 	}
 	robj = gobj->driver_private;
-	r = radeon_object_busy_domain(robj, &cur_placement);
+	r = radeon_bo_wait(robj, &cur_placement, true);
 	switch (cur_placement) {
 	case TTM_PL_VRAM:
 		args->domain = RADEON_GEM_DOMAIN_VRAM;
@@ -297,7 +299,7 @@ int radeon_gem_wait_idle_ioctl(struct drm_device *dev, void *data,
 {
 	struct drm_radeon_gem_wait_idle *args = data;
 	struct drm_gem_object *gobj;
-	struct radeon_object *robj;
+	struct radeon_bo *robj;
 	int r;
 
 	gobj = drm_gem_object_lookup(dev, filp, args->handle);
@@ -305,7 +307,7 @@ int radeon_gem_wait_idle_ioctl(struct drm_device *dev, void *data,
 		return -EINVAL;
 	}
 	robj = gobj->driver_private;
-	r = radeon_object_wait(robj);
+	r = radeon_bo_wait(robj, NULL, false);
 	mutex_lock(&dev->struct_mutex);
 	drm_gem_object_unreference(gobj);
 	mutex_unlock(&dev->struct_mutex);
@@ -317,7 +319,7 @@ int radeon_gem_set_tiling_ioctl(struct drm_device *dev, void *data,
 {
 	struct drm_radeon_gem_set_tiling *args = data;
 	struct drm_gem_object *gobj;
-	struct radeon_object *robj;
+	struct radeon_bo *robj;
 	int r = 0;
 
 	DRM_DEBUG("%d \n", args->handle);
@@ -325,7 +327,7 @@ int radeon_gem_set_tiling_ioctl(struct drm_device *dev, void *data,
 	if (gobj == NULL)
 		return -EINVAL;
 	robj = gobj->driver_private;
-	radeon_object_set_tiling_flags(robj, args->tiling_flags, args->pitch);
+	r = radeon_bo_set_tiling_flags(robj, args->tiling_flags, args->pitch);
 	mutex_lock(&dev->struct_mutex);
 	drm_gem_object_unreference(gobj);
 	mutex_unlock(&dev->struct_mutex);
@@ -337,16 +339,20 @@ int radeon_gem_get_tiling_ioctl(struct drm_device *dev, void *data,
 {
 	struct drm_radeon_gem_get_tiling *args = data;
 	struct drm_gem_object *gobj;
-	struct radeon_object *robj;
+	struct radeon_bo *rbo;
 	int r = 0;
 
 	DRM_DEBUG("\n");
 	gobj = drm_gem_object_lookup(dev, filp, args->handle);
 	if (gobj == NULL)
 		return -EINVAL;
-	robj = gobj->driver_private;
-	radeon_object_get_tiling_flags(robj, &args->tiling_flags,
-				       &args->pitch);
+	rbo = gobj->driver_private;
+	r = radeon_bo_reserve(rbo, false);
+	if (unlikely(r != 0))
+		goto out;
+	radeon_bo_get_tiling_flags(rbo, &args->tiling_flags, &args->pitch);
+	radeon_bo_unreserve(rbo);
+out:
 	mutex_lock(&dev->struct_mutex);
 	drm_gem_object_unreference(gobj);
 	mutex_unlock(&dev->struct_mutex);
diff --git a/drivers/gpu/drm/radeon/radeon_i2c.c b/drivers/gpu/drm/radeon/radeon_i2c.c
index dd438d32e5c0..da3da1e89d00 100644
--- a/drivers/gpu/drm/radeon/radeon_i2c.c
+++ b/drivers/gpu/drm/radeon/radeon_i2c.c
@@ -59,35 +59,43 @@ bool radeon_ddc_probe(struct radeon_connector *radeon_connector)
 }
 
 
-void radeon_i2c_do_lock(struct radeon_connector *radeon_connector, int lock_state)
+void radeon_i2c_do_lock(struct radeon_i2c_chan *i2c, int lock_state)
 {
-	struct radeon_device *rdev = radeon_connector->base.dev->dev_private;
+	struct radeon_device *rdev = i2c->dev->dev_private;
+	struct radeon_i2c_bus_rec *rec = &i2c->rec;
 	uint32_t temp;
-	struct radeon_i2c_bus_rec *rec = &radeon_connector->ddc_bus->rec;
 
 	/* RV410 appears to have a bug where the hw i2c in reset
 	 * holds the i2c port in a bad state - switch hw i2c away before
 	 * doing DDC - do this for all r200s/r300s/r400s for safety sake
 	 */
-	if ((rdev->family >= CHIP_R200) && !ASIC_IS_AVIVO(rdev)) {
-		if (rec->a_clk_reg == RADEON_GPIO_MONID) {
-			WREG32(RADEON_DVI_I2C_CNTL_0, (RADEON_I2C_SOFT_RST |
-						R200_DVI_I2C_PIN_SEL(R200_SEL_DDC1)));
-		} else {
-			WREG32(RADEON_DVI_I2C_CNTL_0, (RADEON_I2C_SOFT_RST |
-						R200_DVI_I2C_PIN_SEL(R200_SEL_DDC3)));
+	if (rec->hw_capable) {
+		if ((rdev->family >= CHIP_R200) && !ASIC_IS_AVIVO(rdev)) {
+			if (rec->a_clk_reg == RADEON_GPIO_MONID) {
+				WREG32(RADEON_DVI_I2C_CNTL_0, (RADEON_I2C_SOFT_RST |
+							       R200_DVI_I2C_PIN_SEL(R200_SEL_DDC1)));
+			} else {
+				WREG32(RADEON_DVI_I2C_CNTL_0, (RADEON_I2C_SOFT_RST |
+							       R200_DVI_I2C_PIN_SEL(R200_SEL_DDC3)));
+			}
 		}
 	}
-	if (lock_state) {
-		temp = RREG32(rec->a_clk_reg);
-		temp &= ~(rec->a_clk_mask);
-		WREG32(rec->a_clk_reg, temp);
-
-		temp = RREG32(rec->a_data_reg);
-		temp &= ~(rec->a_data_mask);
-		WREG32(rec->a_data_reg, temp);
-	}
 
+	/* clear the output pin values */
+	temp = RREG32(rec->a_clk_reg) & ~rec->a_clk_mask;
+	WREG32(rec->a_clk_reg, temp);
+
+	temp = RREG32(rec->a_data_reg) & ~rec->a_data_mask;
+	WREG32(rec->a_data_reg, temp);
+
+	/* set the pins to input */
+	temp = RREG32(rec->en_clk_reg) & ~rec->en_clk_mask;
+	WREG32(rec->en_clk_reg, temp);
+
+	temp = RREG32(rec->en_data_reg) & ~rec->en_data_mask;
+	WREG32(rec->en_data_reg, temp);
+
+	/* mask the gpio pins for software use */
 	temp = RREG32(rec->mask_clk_reg);
 	if (lock_state)
 		temp |= rec->mask_clk_mask;
@@ -112,8 +120,9 @@ static int get_clock(void *i2c_priv)
 	struct radeon_i2c_bus_rec *rec = &i2c->rec;
 	uint32_t val;
 
-	val = RREG32(rec->get_clk_reg);
-	val &= rec->get_clk_mask;
+	/* read the value off the pin */
+	val = RREG32(rec->y_clk_reg);
+	val &= rec->y_clk_mask;
 
 	return (val != 0);
 }
@@ -126,8 +135,10 @@ static int get_data(void *i2c_priv)
 	struct radeon_i2c_bus_rec *rec = &i2c->rec;
 	uint32_t val;
 
-	val = RREG32(rec->get_data_reg);
-	val &= rec->get_data_mask;
+	/* read the value off the pin */
+	val = RREG32(rec->y_data_reg);
+	val &= rec->y_data_mask;
+
 	return (val != 0);
 }
 
@@ -138,9 +149,10 @@ static void set_clock(void *i2c_priv, int clock)
 	struct radeon_i2c_bus_rec *rec = &i2c->rec;
 	uint32_t val;
 
-	val = RREG32(rec->put_clk_reg) & (uint32_t)~(rec->put_clk_mask);
-	val |= clock ? 0 : rec->put_clk_mask;
-	WREG32(rec->put_clk_reg, val);
+	/* set pin direction */
+	val = RREG32(rec->en_clk_reg) & ~rec->en_clk_mask;
+	val |= clock ? 0 : rec->en_clk_mask;
+	WREG32(rec->en_clk_reg, val);
 }
 
 static void set_data(void *i2c_priv, int data)
@@ -150,14 +162,15 @@ static void set_data(void *i2c_priv, int data)
 	struct radeon_i2c_bus_rec *rec = &i2c->rec;
 	uint32_t val;
 
-	val = RREG32(rec->put_data_reg) & (uint32_t)~(rec->put_data_mask);
-	val |= data ? 0 : rec->put_data_mask;
-	WREG32(rec->put_data_reg, val);
+	/* set pin direction */
+	val = RREG32(rec->en_data_reg) & ~rec->en_data_mask;
+	val |= data ? 0 : rec->en_data_mask;
+	WREG32(rec->en_data_reg, val);
 }
 
 struct radeon_i2c_chan *radeon_i2c_create(struct drm_device *dev,
-		struct radeon_i2c_bus_rec *rec,
-		const char *name)
+					  struct radeon_i2c_bus_rec *rec,
+					  const char *name)
 {
 	struct radeon_i2c_chan *i2c;
 	int ret;
@@ -167,20 +180,19 @@ struct radeon_i2c_chan *radeon_i2c_create(struct drm_device *dev,
 		return NULL;
 
 	i2c->adapter.owner = THIS_MODULE;
-	i2c->adapter.algo_data = &i2c->algo;
 	i2c->dev = dev;
-	i2c->algo.setsda = set_data;
-	i2c->algo.setscl = set_clock;
-	i2c->algo.getsda = get_data;
-	i2c->algo.getscl = get_clock;
-	i2c->algo.udelay = 20;
+	i2c_set_adapdata(&i2c->adapter, i2c);
+	i2c->adapter.algo_data = &i2c->algo.bit;
+	i2c->algo.bit.setsda = set_data;
+	i2c->algo.bit.setscl = set_clock;
+	i2c->algo.bit.getsda = get_data;
+	i2c->algo.bit.getscl = get_clock;
+	i2c->algo.bit.udelay = 20;
 	/* vesa says 2.2 ms is enough, 1 jiffy doesn't seem to always
 	 * make this, 2 jiffies is a lot more reliable */
-	i2c->algo.timeout = 2;
-	i2c->algo.data = i2c;
+	i2c->algo.bit.timeout = 2;
+	i2c->algo.bit.data = i2c;
 	i2c->rec = *rec;
-	i2c_set_adapdata(&i2c->adapter, i2c);
-
 	ret = i2c_bit_add_bus(&i2c->adapter);
 	if (ret) {
 		DRM_INFO("Failed to register i2c %s\n", name);
@@ -194,6 +206,38 @@ out_free:
 
 }
 
+struct radeon_i2c_chan *radeon_i2c_create_dp(struct drm_device *dev,
+					     struct radeon_i2c_bus_rec *rec,
+					     const char *name)
+{
+	struct radeon_i2c_chan *i2c;
+	int ret;
+
+	i2c = kzalloc(sizeof(struct radeon_i2c_chan), GFP_KERNEL);
+	if (i2c == NULL)
+		return NULL;
+
+	i2c->rec = *rec;
+	i2c->adapter.owner = THIS_MODULE;
+	i2c->dev = dev;
+	i2c_set_adapdata(&i2c->adapter, i2c);
+	i2c->adapter.algo_data = &i2c->algo.dp;
+	i2c->algo.dp.aux_ch = radeon_dp_i2c_aux_ch;
+	i2c->algo.dp.address = 0;
+	ret = i2c_dp_aux_add_bus(&i2c->adapter);
+	if (ret) {
+		DRM_INFO("Failed to register i2c %s\n", name);
+		goto out_free;
+	}
+
+	return i2c;
+out_free:
+	kfree(i2c);
+	return NULL;
+
+}
+
+
 void radeon_i2c_destroy(struct radeon_i2c_chan *i2c)
 {
 	if (!i2c)
@@ -207,3 +251,59 @@ struct drm_encoder *radeon_best_encoder(struct drm_connector *connector)
 {
 	return NULL;
 }
+
+void radeon_i2c_sw_get_byte(struct radeon_i2c_chan *i2c_bus,
+			    u8 slave_addr,
+			    u8 addr,
+			    u8 *val)
+{
+	u8 out_buf[2];
+	u8 in_buf[2];
+	struct i2c_msg msgs[] = {
+		{
+			.addr = slave_addr,
+			.flags = 0,
+			.len = 1,
+			.buf = out_buf,
+		},
+		{
+			.addr = slave_addr,
+			.flags = I2C_M_RD,
+			.len = 1,
+			.buf = in_buf,
+		}
+	};
+
+	out_buf[0] = addr;
+	out_buf[1] = 0;
+
+	if (i2c_transfer(&i2c_bus->adapter, msgs, 2) == 2) {
+		*val = in_buf[0];
+		DRM_DEBUG("val = 0x%02x\n", *val);
+	} else {
+		DRM_ERROR("i2c 0x%02x 0x%02x read failed\n",
+			  addr, *val);
+	}
+}
+
+void radeon_i2c_sw_put_byte(struct radeon_i2c_chan *i2c_bus,
+			    u8 slave_addr,
+			    u8 addr,
+			    u8 val)
+{
+	uint8_t out_buf[2];
+	struct i2c_msg msg = {
+		.addr = slave_addr,
+		.flags = 0,
+		.len = 2,
+		.buf = out_buf,
+	};
+
+	out_buf[0] = addr;
+	out_buf[1] = val;
+
+	if (i2c_transfer(&i2c_bus->adapter, &msg, 1) != 1)
+		DRM_ERROR("i2c 0x%02x 0x%02x write failed\n",
+			  addr, val);
+}
+
diff --git a/drivers/gpu/drm/radeon/radeon_ioc32.c b/drivers/gpu/drm/radeon/radeon_ioc32.c
index a1bf11de308a..48b7cea31e08 100644
--- a/drivers/gpu/drm/radeon/radeon_ioc32.c
+++ b/drivers/gpu/drm/radeon/radeon_ioc32.c
@@ -92,8 +92,7 @@ static int compat_radeon_cp_init(struct file *file, unsigned int cmd,
 			  &init->gart_textures_offset))
 		return -EFAULT;
 
-	return drm_ioctl(file->f_path.dentry->d_inode, file,
-			 DRM_IOCTL_RADEON_CP_INIT, (unsigned long)init);
+	return drm_ioctl(file, DRM_IOCTL_RADEON_CP_INIT, (unsigned long)init);
 }
 
 typedef struct drm_radeon_clear32 {
@@ -125,8 +124,7 @@ static int compat_radeon_cp_clear(struct file *file, unsigned int cmd,
 			  &clr->depth_boxes))
 		return -EFAULT;
 
-	return drm_ioctl(file->f_path.dentry->d_inode, file,
-			 DRM_IOCTL_RADEON_CLEAR, (unsigned long)clr);
+	return drm_ioctl(file, DRM_IOCTL_RADEON_CLEAR, (unsigned long)clr);
 }
 
 typedef struct drm_radeon_stipple32 {
@@ -149,8 +147,7 @@ static int compat_radeon_cp_stipple(struct file *file, unsigned int cmd,
 			  &request->mask))
 		return -EFAULT;
 
-	return drm_ioctl(file->f_path.dentry->d_inode, file,
-			 DRM_IOCTL_RADEON_STIPPLE, (unsigned long)request);
+	return drm_ioctl(file, DRM_IOCTL_RADEON_STIPPLE, (unsigned long)request);
 }
 
 typedef struct drm_radeon_tex_image32 {
@@ -204,8 +201,7 @@ static int compat_radeon_cp_texture(struct file *file, unsigned int cmd,
 			  &image->data))
 		return -EFAULT;
 
-	return drm_ioctl(file->f_path.dentry->d_inode, file,
-			 DRM_IOCTL_RADEON_TEXTURE, (unsigned long)request);
+	return drm_ioctl(file, DRM_IOCTL_RADEON_TEXTURE, (unsigned long)request);
 }
 
 typedef struct drm_radeon_vertex2_32 {
@@ -238,8 +234,7 @@ static int compat_radeon_cp_vertex2(struct file *file, unsigned int cmd,
 			  &request->prim))
 		return -EFAULT;
 
-	return drm_ioctl(file->f_path.dentry->d_inode, file,
-			 DRM_IOCTL_RADEON_VERTEX2, (unsigned long)request);
+	return drm_ioctl(file, DRM_IOCTL_RADEON_VERTEX2, (unsigned long)request);
 }
 
 typedef struct drm_radeon_cmd_buffer32 {
@@ -268,8 +263,7 @@ static int compat_radeon_cp_cmdbuf(struct file *file, unsigned int cmd,
 			  &request->boxes))
 		return -EFAULT;
 
-	return drm_ioctl(file->f_path.dentry->d_inode, file,
-			 DRM_IOCTL_RADEON_CMDBUF, (unsigned long)request);
+	return drm_ioctl(file, DRM_IOCTL_RADEON_CMDBUF, (unsigned long)request);
 }
 
 typedef struct drm_radeon_getparam32 {
@@ -293,8 +287,7 @@ static int compat_radeon_cp_getparam(struct file *file, unsigned int cmd,
 			  &request->value))
 		return -EFAULT;
 
-	return drm_ioctl(file->f_path.dentry->d_inode, file,
-			 DRM_IOCTL_RADEON_GETPARAM, (unsigned long)request);
+	return drm_ioctl(file, DRM_IOCTL_RADEON_GETPARAM, (unsigned long)request);
 }
 
 typedef struct drm_radeon_mem_alloc32 {
@@ -322,8 +315,7 @@ static int compat_radeon_mem_alloc(struct file *file, unsigned int cmd,
 			  &request->region_offset))
 		return -EFAULT;
 
-	return drm_ioctl(file->f_path.dentry->d_inode, file,
-			 DRM_IOCTL_RADEON_ALLOC, (unsigned long)request);
+	return drm_ioctl(file, DRM_IOCTL_RADEON_ALLOC, (unsigned long)request);
 }
 
 typedef struct drm_radeon_irq_emit32 {
@@ -345,8 +337,7 @@ static int compat_radeon_irq_emit(struct file *file, unsigned int cmd,
 			  &request->irq_seq))
 		return -EFAULT;
 
-	return drm_ioctl(file->f_path.dentry->d_inode, file,
-			 DRM_IOCTL_RADEON_IRQ_EMIT, (unsigned long)request);
+	return drm_ioctl(file, DRM_IOCTL_RADEON_IRQ_EMIT, (unsigned long)request);
 }
 
 /* The two 64-bit arches where alignof(u64)==4 in 32-bit code */
@@ -372,8 +363,7 @@ static int compat_radeon_cp_setparam(struct file *file, unsigned int cmd,
 			  &request->value))
 		return -EFAULT;
 
-	return drm_ioctl(file->f_dentry->d_inode, file,
-			 DRM_IOCTL_RADEON_SETPARAM, (unsigned long) request);
+	return drm_ioctl(file, DRM_IOCTL_RADEON_SETPARAM, (unsigned long) request);
 }
 #else
 #define compat_radeon_cp_setparam NULL
@@ -413,12 +403,10 @@ long radeon_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 	if (nr < DRM_COMMAND_BASE + DRM_ARRAY_SIZE(radeon_compat_ioctls))
 		fn = radeon_compat_ioctls[nr - DRM_COMMAND_BASE];
 
-	lock_kernel();		/* XXX for now */
 	if (fn != NULL)
 		ret = (*fn) (filp, cmd, arg);
 	else
-		ret = drm_ioctl(filp->f_path.dentry->d_inode, filp, cmd, arg);
-	unlock_kernel();
+		ret = drm_ioctl(filp, cmd, arg);
 
 	return ret;
 }
@@ -431,9 +419,7 @@ long radeon_kms_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long
 	if (nr < DRM_COMMAND_BASE)
 		return drm_compat_ioctl(filp, cmd, arg);
 
-	lock_kernel();		/* XXX for now */
-	ret = drm_ioctl(filp->f_path.dentry->d_inode, filp, cmd, arg);
-	unlock_kernel();
+	ret = drm_ioctl(filp, cmd, arg);
 
 	return ret;
 }
diff --git a/drivers/gpu/drm/radeon/radeon_irq.c b/drivers/gpu/drm/radeon/radeon_irq.c
index b79ecc4a7cc4..2f349a300195 100644
--- a/drivers/gpu/drm/radeon/radeon_irq.c
+++ b/drivers/gpu/drm/radeon/radeon_irq.c
@@ -289,16 +289,16 @@ int radeon_irq_emit(struct drm_device *dev, void *data, struct drm_file *file_pr
 	drm_radeon_irq_emit_t *emit = data;
 	int result;
 
-	if ((dev_priv->flags & RADEON_FAMILY_MASK) >= CHIP_R600)
-		return -EINVAL;
-
-	LOCK_TEST_WITH_RETURN(dev, file_priv);
-
 	if (!dev_priv) {
 		DRM_ERROR("called with no initialization\n");
 		return -EINVAL;
 	}
 
+	if ((dev_priv->flags & RADEON_FAMILY_MASK) >= CHIP_R600)
+		return -EINVAL;
+
+	LOCK_TEST_WITH_RETURN(dev, file_priv);
+
 	result = radeon_emit_irq(dev);
 
 	if (DRM_COPY_TO_USER(emit->irq_seq, &result, sizeof(int))) {
diff --git a/drivers/gpu/drm/radeon/radeon_irq_kms.c b/drivers/gpu/drm/radeon/radeon_irq_kms.c
index a0fe6232dcb6..3cfd60fd0083 100644
--- a/drivers/gpu/drm/radeon/radeon_irq_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_irq_kms.c
@@ -39,11 +39,32 @@ irqreturn_t radeon_driver_irq_handler_kms(DRM_IRQ_ARGS)
 	return radeon_irq_process(rdev);
 }
 
+/*
+ * Handle hotplug events outside the interrupt handler proper.
+ */
+static void radeon_hotplug_work_func(struct work_struct *work)
+{
+	struct radeon_device *rdev = container_of(work, struct radeon_device,
+						  hotplug_work);
+	struct drm_device *dev = rdev->ddev;
+	struct drm_mode_config *mode_config = &dev->mode_config;
+	struct drm_connector *connector;
+
+	if (mode_config->num_connector) {
+		list_for_each_entry(connector, &mode_config->connector_list, head)
+			radeon_connector_hotplug(connector);
+	}
+	/* Just fire off a uevent and let userspace tell us what to do */
+	drm_sysfs_hotplug_event(dev);
+}
+
 void radeon_driver_irq_preinstall_kms(struct drm_device *dev)
 {
 	struct radeon_device *rdev = dev->dev_private;
 	unsigned i;
 
+	INIT_WORK(&rdev->hotplug_work, radeon_hotplug_work_func);
+
 	/* Disable *all* interrupts */
 	rdev->irq.sw_int = false;
 	for (i = 0; i < 2; i++) {
@@ -76,6 +97,7 @@ void radeon_driver_irq_uninstall_kms(struct drm_device *dev)
 	rdev->irq.sw_int = false;
 	for (i = 0; i < 2; i++) {
 		rdev->irq.crtc_vblank_int[i] = false;
+		rdev->irq.hpd[i] = false;
 	}
 	radeon_irq_set(rdev);
 }
@@ -87,30 +109,69 @@ int radeon_irq_kms_init(struct radeon_device *rdev)
 
 	if (rdev->flags & RADEON_SINGLE_CRTC)
 		num_crtc = 1;
-
+	spin_lock_init(&rdev->irq.sw_lock);
 	r = drm_vblank_init(rdev->ddev, num_crtc);
 	if (r) {
 		return r;
 	}
 	/* enable msi */
 	rdev->msi_enabled = 0;
-	if (rdev->family >= CHIP_RV380) {
+	/* MSIs don't seem to work on my rs780;
+	 * not sure about rs880 or other rs780s.
+	 * Needs more investigation.
+	 */
+	if ((rdev->family >= CHIP_RV380) &&
+	    (rdev->family != CHIP_RS780) &&
+	    (rdev->family != CHIP_RS880)) {
 		int ret = pci_enable_msi(rdev->pdev);
-		if (!ret)
+		if (!ret) {
 			rdev->msi_enabled = 1;
+			DRM_INFO("radeon: using MSI.\n");
+		}
 	}
-	drm_irq_install(rdev->ddev);
 	rdev->irq.installed = true;
+	r = drm_irq_install(rdev->ddev);
+	if (r) {
+		rdev->irq.installed = false;
+		return r;
+	}
 	DRM_INFO("radeon: irq initialized.\n");
 	return 0;
 }
 
 void radeon_irq_kms_fini(struct radeon_device *rdev)
 {
+	drm_vblank_cleanup(rdev->ddev);
 	if (rdev->irq.installed) {
-		rdev->irq.installed = false;
 		drm_irq_uninstall(rdev->ddev);
+		rdev->irq.installed = false;
 		if (rdev->msi_enabled)
 			pci_disable_msi(rdev->pdev);
 	}
 }
+
+void radeon_irq_kms_sw_irq_get(struct radeon_device *rdev)
+{
+	unsigned long irqflags;
+
+	spin_lock_irqsave(&rdev->irq.sw_lock, irqflags);
+	if (rdev->ddev->irq_enabled && (++rdev->irq.sw_refcount == 1)) {
+		rdev->irq.sw_int = true;
+		radeon_irq_set(rdev);
+	}
+	spin_unlock_irqrestore(&rdev->irq.sw_lock, irqflags);
+}
+
+void radeon_irq_kms_sw_irq_put(struct radeon_device *rdev)
+{
+	unsigned long irqflags;
+
+	spin_lock_irqsave(&rdev->irq.sw_lock, irqflags);
+	BUG_ON(rdev->ddev->irq_enabled && rdev->irq.sw_refcount <= 0);
+	if (rdev->ddev->irq_enabled && (--rdev->irq.sw_refcount == 0)) {
+		rdev->irq.sw_int = false;
+		radeon_irq_set(rdev);
+	}
+	spin_unlock_irqrestore(&rdev->irq.sw_lock, irqflags);
+}
+
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index ba128621057a..f23b05606eb5 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -30,10 +30,19 @@
 #include "radeon.h"
 #include "radeon_drm.h"
 
+int radeon_driver_unload_kms(struct drm_device *dev)
+{
+	struct radeon_device *rdev = dev->dev_private;
+
+	if (rdev == NULL)
+		return 0;
+	radeon_modeset_fini(rdev);
+	radeon_device_fini(rdev);
+	kfree(rdev);
+	dev->dev_private = NULL;
+	return 0;
+}
 
-/*
- * Driver load/unload
- */
 int radeon_driver_load_kms(struct drm_device *dev, unsigned long flags)
 {
 	struct radeon_device *rdev;
@@ -62,31 +71,20 @@ int radeon_driver_load_kms(struct drm_device *dev, unsigned long flags)
 	 */
 	r = radeon_device_init(rdev, dev, dev->pdev, flags);
 	if (r) {
-		DRM_ERROR("Fatal error while trying to initialize radeon.\n");
-		return r;
+		dev_err(&dev->pdev->dev, "Fatal error during GPU init\n");
+		goto out;
 	}
 	/* Again modeset_init should fail only on fatal error
 	 * otherwise it should provide enough functionalities
 	 * for shadowfb to run
 	 */
 	r = radeon_modeset_init(rdev);
-	if (r) {
-		return r;
-	}
-	return 0;
-}
-
-int radeon_driver_unload_kms(struct drm_device *dev)
-{
-	struct radeon_device *rdev = dev->dev_private;
-
-	if (rdev == NULL)
-		return 0;
-	radeon_modeset_fini(rdev);
-	radeon_device_fini(rdev);
-	kfree(rdev);
-	dev->dev_private = NULL;
-	return 0;
+	if (r)
+		dev_err(&dev->pdev->dev, "Fatal error during modeset init\n");
+out:
+	if (r)
+		radeon_driver_unload_kms(dev);
+	return r;
 }
 
 
diff --git a/drivers/gpu/drm/radeon/radeon_legacy_crtc.c b/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
index 8d0b7aa87fa4..cc27485a07ad 100644
--- a/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
+++ b/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
@@ -30,9 +30,20 @@
 #include "radeon.h"
 #include "atom.h"
 
+static void radeon_overscan_setup(struct drm_crtc *crtc,
+				  struct drm_display_mode *mode)
+{
+	struct drm_device *dev = crtc->dev;
+	struct radeon_device *rdev = dev->dev_private;
+	struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
+
+	WREG32(RADEON_OVR_CLR + radeon_crtc->crtc_offset, 0);
+	WREG32(RADEON_OVR_WID_LEFT_RIGHT + radeon_crtc->crtc_offset, 0);
+	WREG32(RADEON_OVR_WID_TOP_BOTTOM + radeon_crtc->crtc_offset, 0);
+}
+
 static void radeon_legacy_rmx_mode_set(struct drm_crtc *crtc,
-				       struct drm_display_mode *mode,
-				       struct drm_display_mode *adjusted_mode)
+				       struct drm_display_mode *mode)
 {
 	struct drm_device *dev = crtc->dev;
 	struct radeon_device *rdev = dev->dev_private;
@@ -292,8 +303,7 @@ void radeon_crtc_dpms(struct drm_crtc *crtc, int mode)
 	uint32_t mask;
 
 	if (radeon_crtc->crtc_id)
-		mask = (RADEON_CRTC2_EN |
-			RADEON_CRTC2_DISP_DIS |
+		mask = (RADEON_CRTC2_DISP_DIS |
 			RADEON_CRTC2_VSYNC_DIS |
 			RADEON_CRTC2_HSYNC_DIS |
 			RADEON_CRTC2_DISP_REQ_EN_B);
@@ -305,7 +315,7 @@ void radeon_crtc_dpms(struct drm_crtc *crtc, int mode)
 	switch (mode) {
 	case DRM_MODE_DPMS_ON:
 		if (radeon_crtc->crtc_id)
-			WREG32_P(RADEON_CRTC2_GEN_CNTL, RADEON_CRTC2_EN, ~mask);
+			WREG32_P(RADEON_CRTC2_GEN_CNTL, RADEON_CRTC2_EN, ~(RADEON_CRTC2_EN | mask));
 		else {
 			WREG32_P(RADEON_CRTC_GEN_CNTL, RADEON_CRTC_EN, ~(RADEON_CRTC_EN |
 									 RADEON_CRTC_DISP_REQ_EN_B));
@@ -319,7 +329,7 @@ void radeon_crtc_dpms(struct drm_crtc *crtc, int mode)
 	case DRM_MODE_DPMS_OFF:
 		drm_vblank_pre_modeset(dev, radeon_crtc->crtc_id);
 		if (radeon_crtc->crtc_id)
-			WREG32_P(RADEON_CRTC2_GEN_CNTL, mask, ~mask);
+			WREG32_P(RADEON_CRTC2_GEN_CNTL, mask, ~(RADEON_CRTC2_EN | mask));
 		else {
 			WREG32_P(RADEON_CRTC_GEN_CNTL, RADEON_CRTC_DISP_REQ_EN_B, ~(RADEON_CRTC_EN |
 										    RADEON_CRTC_DISP_REQ_EN_B));
@@ -400,14 +410,21 @@ int radeon_crtc_set_base(struct drm_crtc *crtc, int x, int y,
 	struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
 	struct radeon_framebuffer *radeon_fb;
 	struct drm_gem_object *obj;
+	struct radeon_bo *rbo;
 	uint64_t base;
 	uint32_t crtc_offset, crtc_offset_cntl, crtc_tile_x0_y0 = 0;
 	uint32_t crtc_pitch, pitch_pixels;
 	uint32_t tiling_flags;
 	int format;
 	uint32_t gen_cntl_reg, gen_cntl_val;
+	int r;
 
 	DRM_DEBUG("\n");
+	/* no fb bound */
+	if (!crtc->fb) {
+		DRM_DEBUG("No FB bound\n");
+		return 0;
+	}
 
 	radeon_fb = to_radeon_framebuffer(crtc->fb);
 
@@ -431,10 +448,22 @@ int radeon_crtc_set_base(struct drm_crtc *crtc, int x, int y,
 		return false;
 	}
 
+	/* Pin framebuffer & get tilling informations */
 	obj = radeon_fb->obj;
-	if (radeon_gem_object_pin(obj, RADEON_GEM_DOMAIN_VRAM, &base)) {
+	rbo = obj->driver_private;
+	r = radeon_bo_reserve(rbo, false);
+	if (unlikely(r != 0))
+		return r;
+	r = radeon_bo_pin(rbo, RADEON_GEM_DOMAIN_VRAM, &base);
+	if (unlikely(r != 0)) {
+		radeon_bo_unreserve(rbo);
 		return -EINVAL;
 	}
+	radeon_bo_get_tiling_flags(rbo, &tiling_flags, NULL);
+	radeon_bo_unreserve(rbo);
+	if (tiling_flags & RADEON_TILING_MICRO)
+		DRM_ERROR("trying to scanout microtiled buffer\n");
+
 	/* if scanout was in GTT this really wouldn't work */
 	/* crtc offset is from display base addr not FB location */
 	radeon_crtc->legacy_display_base_addr = rdev->mc.vram_location;
@@ -449,10 +478,6 @@ int radeon_crtc_set_base(struct drm_crtc *crtc, int x, int y,
 		       (crtc->fb->bits_per_pixel * 8));
 	crtc_pitch |= crtc_pitch << 16;
 
-	radeon_object_get_tiling_flags(obj->driver_private,
-				       &tiling_flags, NULL);
-	if (tiling_flags & RADEON_TILING_MICRO)
-		DRM_ERROR("trying to scanout microtiled buffer\n");
 
 	if (tiling_flags & RADEON_TILING_MACRO) {
 		if (ASIC_IS_R300(rdev))
@@ -530,7 +555,12 @@ int radeon_crtc_set_base(struct drm_crtc *crtc, int x, int y,
 
 	if (old_fb && old_fb != crtc->fb) {
 		radeon_fb = to_radeon_framebuffer(old_fb);
-		radeon_gem_object_unpin(radeon_fb->obj);
+		rbo = radeon_fb->obj->driver_private;
+		r = radeon_bo_reserve(rbo, false);
+		if (unlikely(r != 0))
+			return r;
+		radeon_bo_unpin(rbo);
+		radeon_bo_unreserve(rbo);
 	}
 
 	/* Bytes per pixel may have changed */
@@ -642,12 +672,8 @@ static bool radeon_set_crtc_timing(struct drm_crtc *crtc, struct drm_display_mod
 		uint32_t crtc2_gen_cntl;
 		uint32_t disp2_merge_cntl;
 
-		/* check to see if TV DAC is enabled for another crtc and keep it enabled */
-		if (RREG32(RADEON_CRTC2_GEN_CNTL) & RADEON_CRTC2_CRT2_ON)
-			crtc2_gen_cntl = RADEON_CRTC2_CRT2_ON;
-		else
-			crtc2_gen_cntl = 0;
-
+		/* if TV DAC is enabled for another crtc and keep it enabled */
+		crtc2_gen_cntl = RREG32(RADEON_CRTC2_GEN_CNTL) & 0x00718080;
 		crtc2_gen_cntl |= ((format << 8)
 				   | RADEON_CRTC2_VSYNC_DIS
 				   | RADEON_CRTC2_HSYNC_DIS
@@ -676,7 +702,8 @@ static bool radeon_set_crtc_timing(struct drm_crtc *crtc, struct drm_display_mod
 		uint32_t crtc_ext_cntl;
 		uint32_t disp_merge_cntl;
 
-		crtc_gen_cntl = (RADEON_CRTC_EXT_DISP_EN
+		crtc_gen_cntl = RREG32(RADEON_CRTC_GEN_CNTL) & 0x00718000;
+		crtc_gen_cntl |= (RADEON_CRTC_EXT_DISP_EN
 				 | (format << 8)
 				 | RADEON_CRTC_DISP_REQ_EN_B
 				 | ((mode->flags & DRM_MODE_FLAG_DBLSCAN)
@@ -779,15 +806,17 @@ static void radeon_set_pll(struct drm_crtc *crtc, struct drm_display_mode *mode)
 			if (encoder->encoder_type != DRM_MODE_ENCODER_DAC)
 				pll_flags |= RADEON_PLL_NO_ODD_POST_DIV;
 			if (encoder->encoder_type == DRM_MODE_ENCODER_LVDS) {
-				struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
-				struct radeon_encoder_lvds *lvds = (struct radeon_encoder_lvds *)radeon_encoder->enc_priv;
-				if (lvds) {
-					if (lvds->use_bios_dividers) {
-						pll_ref_div = lvds->panel_ref_divider;
-						pll_fb_post_div   = (lvds->panel_fb_divider |
-								     (lvds->panel_post_divider << 16));
-						htotal_cntl  = 0;
-						use_bios_divs = true;
+				if (!rdev->is_atom_bios) {
+					struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
+					struct radeon_encoder_lvds *lvds = (struct radeon_encoder_lvds *)radeon_encoder->enc_priv;
+					if (lvds) {
+						if (lvds->use_bios_dividers) {
+							pll_ref_div = lvds->panel_ref_divider;
+							pll_fb_post_div   = (lvds->panel_fb_divider |
+									     (lvds->panel_post_divider << 16));
+							htotal_cntl  = 0;
+							use_bios_divs = true;
+						}
 					}
 				}
 				pll_flags |= RADEON_PLL_USE_REF_DIV;
@@ -1027,8 +1056,9 @@ static int radeon_crtc_mode_set(struct drm_crtc *crtc,
 	radeon_crtc_set_base(crtc, x, y, old_fb);
 	radeon_set_crtc_timing(crtc, adjusted_mode);
 	radeon_set_pll(crtc, adjusted_mode);
+	radeon_overscan_setup(crtc, adjusted_mode);
 	if (radeon_crtc->crtc_id == 0) {
-		radeon_legacy_rmx_mode_set(crtc, mode, adjusted_mode);
+		radeon_legacy_rmx_mode_set(crtc, adjusted_mode);
 	} else {
 		if (radeon_crtc->rmx_type != RMX_OFF) {
 			/* FIXME: only first crtc has rmx what should we
@@ -1042,12 +1072,29 @@ static int radeon_crtc_mode_set(struct drm_crtc *crtc,
 
 static void radeon_crtc_prepare(struct drm_crtc *crtc)
 {
-	radeon_crtc_dpms(crtc, DRM_MODE_DPMS_OFF);
+	struct drm_device *dev = crtc->dev;
+	struct drm_crtc *crtci;
+
+	/*
+	* The hardware wedges sometimes if you reconfigure one CRTC
+	* whilst another is running (see fdo bug #24611).
+	*/
+	list_for_each_entry(crtci, &dev->mode_config.crtc_list, head)
+		radeon_crtc_dpms(crtci, DRM_MODE_DPMS_OFF);
 }
 
 static void radeon_crtc_commit(struct drm_crtc *crtc)
 {
-	radeon_crtc_dpms(crtc, DRM_MODE_DPMS_ON);
+	struct drm_device *dev = crtc->dev;
+	struct drm_crtc *crtci;
+
+	/*
+	* Reenable the CRTCs that should be running.
+	*/
+	list_for_each_entry(crtci, &dev->mode_config.crtc_list, head) {
+		if (crtci->enabled)
+			radeon_crtc_dpms(crtci, DRM_MODE_DPMS_ON);
+	}
 }
 
 static const struct drm_crtc_helper_funcs legacy_helper_funcs = {
diff --git a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
index 00382122869b..38e45e231ef5 100644
--- a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
@@ -46,6 +46,7 @@ static void radeon_legacy_lvds_dpms(struct drm_encoder *encoder, int mode)
 	struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
 	uint32_t lvds_gen_cntl, lvds_pll_cntl, pixclks_cntl, disp_pwr_man;
 	int panel_pwr_delay = 2000;
+	bool is_mac = false;
 	DRM_DEBUG("\n");
 
 	if (radeon_encoder->enc_priv) {
@@ -58,6 +59,15 @@ static void radeon_legacy_lvds_dpms(struct drm_encoder *encoder, int mode)
 		}
 	}
 
+	/* macs (and possibly some x86 oem systems?) wire up LVDS strangely
+	 * Taken from radeonfb.
+	 */
+	if ((rdev->mode_info.connector_table == CT_IBOOK) ||
+	    (rdev->mode_info.connector_table == CT_POWERBOOK_EXTERNAL) ||
+	    (rdev->mode_info.connector_table == CT_POWERBOOK_INTERNAL) ||
+	    (rdev->mode_info.connector_table == CT_POWERBOOK_VGA))
+		is_mac = true;
+
 	switch (mode) {
 	case DRM_MODE_DPMS_ON:
 		disp_pwr_man = RREG32(RADEON_DISP_PWR_MAN);
@@ -74,6 +84,8 @@ static void radeon_legacy_lvds_dpms(struct drm_encoder *encoder, int mode)
 
 		lvds_gen_cntl = RREG32(RADEON_LVDS_GEN_CNTL);
 		lvds_gen_cntl |= (RADEON_LVDS_ON | RADEON_LVDS_EN | RADEON_LVDS_DIGON | RADEON_LVDS_BLON);
+		if (is_mac)
+			lvds_gen_cntl |= RADEON_LVDS_BL_MOD_EN;
 		lvds_gen_cntl &= ~(RADEON_LVDS_DISPLAY_DIS);
 		udelay(panel_pwr_delay * 1000);
 		WREG32(RADEON_LVDS_GEN_CNTL, lvds_gen_cntl);
@@ -85,7 +97,14 @@ static void radeon_legacy_lvds_dpms(struct drm_encoder *encoder, int mode)
 		WREG32_PLL_P(RADEON_PIXCLKS_CNTL, 0, ~RADEON_PIXCLK_LVDS_ALWAYS_ONb);
 		lvds_gen_cntl = RREG32(RADEON_LVDS_GEN_CNTL);
 		lvds_gen_cntl |= RADEON_LVDS_DISPLAY_DIS;
-		lvds_gen_cntl &= ~(RADEON_LVDS_ON | RADEON_LVDS_BLON | RADEON_LVDS_EN | RADEON_LVDS_DIGON);
+		if (is_mac) {
+			lvds_gen_cntl &= ~RADEON_LVDS_BL_MOD_EN;
+			WREG32(RADEON_LVDS_GEN_CNTL, lvds_gen_cntl);
+			lvds_gen_cntl &= ~(RADEON_LVDS_ON | RADEON_LVDS_EN);
+		} else {
+			WREG32(RADEON_LVDS_GEN_CNTL, lvds_gen_cntl);
+			lvds_gen_cntl &= ~(RADEON_LVDS_ON | RADEON_LVDS_BLON | RADEON_LVDS_EN | RADEON_LVDS_DIGON);
+		}
 		udelay(panel_pwr_delay * 1000);
 		WREG32(RADEON_LVDS_GEN_CNTL, lvds_gen_cntl);
 		WREG32_PLL(RADEON_PIXCLKS_CNTL, pixclks_cntl);
@@ -136,7 +155,14 @@ static void radeon_legacy_lvds_mode_set(struct drm_encoder *encoder,
 	lvds_pll_cntl &= ~RADEON_LVDS_PLL_EN;
 
 	lvds_ss_gen_cntl = RREG32(RADEON_LVDS_SS_GEN_CNTL);
-	if ((!rdev->is_atom_bios)) {
+	if (rdev->is_atom_bios) {
+		/* LVDS_GEN_CNTL parameters are computed in LVDSEncoderControl
+		 * need to call that on resume to set up the reg properly.
+		 */
+		radeon_encoder->pixel_clock = adjusted_mode->clock;
+		atombios_digital_setup(encoder, PANEL_ENCODER_ACTION_ENABLE);
+		lvds_gen_cntl = RREG32(RADEON_LVDS_GEN_CNTL);
+	} else {
 		struct radeon_encoder_lvds *lvds = (struct radeon_encoder_lvds *)radeon_encoder->enc_priv;
 		if (lvds) {
 			DRM_DEBUG("bios LVDS_GEN_CNTL: 0x%x\n", lvds->lvds_gen_cntl);
@@ -147,8 +173,7 @@ static void radeon_legacy_lvds_mode_set(struct drm_encoder *encoder,
 					     (lvds->panel_blon_delay << RADEON_LVDS_PWRSEQ_DELAY2_SHIFT));
 		} else
 			lvds_gen_cntl = RREG32(RADEON_LVDS_GEN_CNTL);
-	} else
-		lvds_gen_cntl = RREG32(RADEON_LVDS_GEN_CNTL);
+	}
 	lvds_gen_cntl |= RADEON_LVDS_DISPLAY_DIS;
 	lvds_gen_cntl &= ~(RADEON_LVDS_ON |
 			   RADEON_LVDS_BLON |
@@ -184,9 +209,9 @@ static void radeon_legacy_lvds_mode_set(struct drm_encoder *encoder,
 		radeon_combios_encoder_crtc_scratch_regs(encoder, radeon_crtc->crtc_id);
 }
 
-static bool radeon_legacy_lvds_mode_fixup(struct drm_encoder *encoder,
-					  struct drm_display_mode *mode,
-					  struct drm_display_mode *adjusted_mode)
+static bool radeon_legacy_mode_fixup(struct drm_encoder *encoder,
+				     struct drm_display_mode *mode,
+				     struct drm_display_mode *adjusted_mode)
 {
 	struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
 
@@ -194,15 +219,24 @@ static bool radeon_legacy_lvds_mode_fixup(struct drm_encoder *encoder,
 	radeon_encoder_set_active_device(encoder);
 	drm_mode_set_crtcinfo(adjusted_mode, 0);
 
-	if (radeon_encoder->rmx_type != RMX_OFF)
-		radeon_rmx_mode_fixup(encoder, mode, adjusted_mode);
+	/* get the native mode for LVDS */
+	if (radeon_encoder->active_device & (ATOM_DEVICE_LCD_SUPPORT)) {
+		struct drm_display_mode *native_mode = &radeon_encoder->native_mode;
+		int mode_id = adjusted_mode->base.id;
+		*adjusted_mode = *native_mode;
+		adjusted_mode->hdisplay = mode->hdisplay;
+		adjusted_mode->vdisplay = mode->vdisplay;
+		adjusted_mode->crtc_hdisplay = mode->hdisplay;
+		adjusted_mode->crtc_vdisplay = mode->vdisplay;
+		adjusted_mode->base.id = mode_id;
+	}
 
 	return true;
 }
 
 static const struct drm_encoder_helper_funcs radeon_legacy_lvds_helper_funcs = {
 	.dpms = radeon_legacy_lvds_dpms,
-	.mode_fixup = radeon_legacy_lvds_mode_fixup,
+	.mode_fixup = radeon_legacy_mode_fixup,
 	.prepare = radeon_legacy_lvds_prepare,
 	.mode_set = radeon_legacy_lvds_mode_set,
 	.commit = radeon_legacy_lvds_commit,
@@ -214,17 +248,6 @@ static const struct drm_encoder_funcs radeon_legacy_lvds_enc_funcs = {
 	.destroy = radeon_enc_destroy,
 };
 
-static bool radeon_legacy_primary_dac_mode_fixup(struct drm_encoder *encoder,
-						 struct drm_display_mode *mode,
-						 struct drm_display_mode *adjusted_mode)
-{
-	/* set the active encoder to connector routing */
-	radeon_encoder_set_active_device(encoder);
-	drm_mode_set_crtcinfo(adjusted_mode, 0);
-
-	return true;
-}
-
 static void radeon_legacy_primary_dac_dpms(struct drm_encoder *encoder, int mode)
 {
 	struct drm_device *dev = encoder->dev;
@@ -410,7 +433,7 @@ static enum drm_connector_status radeon_legacy_primary_dac_detect(struct drm_enc
 
 static const struct drm_encoder_helper_funcs radeon_legacy_primary_dac_helper_funcs = {
 	.dpms = radeon_legacy_primary_dac_dpms,
-	.mode_fixup = radeon_legacy_primary_dac_mode_fixup,
+	.mode_fixup = radeon_legacy_mode_fixup,
 	.prepare = radeon_legacy_primary_dac_prepare,
 	.mode_set = radeon_legacy_primary_dac_mode_set,
 	.commit = radeon_legacy_primary_dac_commit,
@@ -423,16 +446,6 @@ static const struct drm_encoder_funcs radeon_legacy_primary_dac_enc_funcs = {
 	.destroy = radeon_enc_destroy,
 };
 
-static bool radeon_legacy_tmds_int_mode_fixup(struct drm_encoder *encoder,
-					      struct drm_display_mode *mode,
-					      struct drm_display_mode *adjusted_mode)
-{
-
-	drm_mode_set_crtcinfo(adjusted_mode, 0);
-
-	return true;
-}
-
 static void radeon_legacy_tmds_int_dpms(struct drm_encoder *encoder, int mode)
 {
 	struct drm_device *dev = encoder->dev;
@@ -584,7 +597,7 @@ static void radeon_legacy_tmds_int_mode_set(struct drm_encoder *encoder,
 
 static const struct drm_encoder_helper_funcs radeon_legacy_tmds_int_helper_funcs = {
 	.dpms = radeon_legacy_tmds_int_dpms,
-	.mode_fixup = radeon_legacy_tmds_int_mode_fixup,
+	.mode_fixup = radeon_legacy_mode_fixup,
 	.prepare = radeon_legacy_tmds_int_prepare,
 	.mode_set = radeon_legacy_tmds_int_mode_set,
 	.commit = radeon_legacy_tmds_int_commit,
@@ -596,17 +609,6 @@ static const struct drm_encoder_funcs radeon_legacy_tmds_int_enc_funcs = {
 	.destroy = radeon_enc_destroy,
 };
 
-static bool radeon_legacy_tmds_ext_mode_fixup(struct drm_encoder *encoder,
-					      struct drm_display_mode *mode,
-					      struct drm_display_mode *adjusted_mode)
-{
-	/* set the active encoder to connector routing */
-	radeon_encoder_set_active_device(encoder);
-	drm_mode_set_crtcinfo(adjusted_mode, 0);
-
-	return true;
-}
-
 static void radeon_legacy_tmds_ext_dpms(struct drm_encoder *encoder, int mode)
 {
 	struct drm_device *dev = encoder->dev;
@@ -697,6 +699,8 @@ static void radeon_legacy_tmds_ext_mode_set(struct drm_encoder *encoder,
 			/*if (mode->clock > 165000)
 			  fp2_gen_cntl |= R300_FP2_DVO_DUAL_CHANNEL_EN;*/
 		}
+		if (!radeon_combios_external_tmds_setup(encoder))
+			radeon_external_tmds_setup(encoder);
 	}
 
 	if (radeon_crtc->crtc_id == 0) {
@@ -724,9 +728,22 @@ static void radeon_legacy_tmds_ext_mode_set(struct drm_encoder *encoder,
 		radeon_combios_encoder_crtc_scratch_regs(encoder, radeon_crtc->crtc_id);
 }
 
+static void radeon_ext_tmds_enc_destroy(struct drm_encoder *encoder)
+{
+	struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
+	struct radeon_encoder_ext_tmds *tmds = radeon_encoder->enc_priv;
+	if (tmds) {
+		if (tmds->i2c_bus)
+			radeon_i2c_destroy(tmds->i2c_bus);
+	}
+	kfree(radeon_encoder->enc_priv);
+	drm_encoder_cleanup(encoder);
+	kfree(radeon_encoder);
+}
+
 static const struct drm_encoder_helper_funcs radeon_legacy_tmds_ext_helper_funcs = {
 	.dpms = radeon_legacy_tmds_ext_dpms,
-	.mode_fixup = radeon_legacy_tmds_ext_mode_fixup,
+	.mode_fixup = radeon_legacy_mode_fixup,
 	.prepare = radeon_legacy_tmds_ext_prepare,
 	.mode_set = radeon_legacy_tmds_ext_mode_set,
 	.commit = radeon_legacy_tmds_ext_commit,
@@ -735,20 +752,9 @@ static const struct drm_encoder_helper_funcs radeon_legacy_tmds_ext_helper_funcs
 
 
 static const struct drm_encoder_funcs radeon_legacy_tmds_ext_enc_funcs = {
-	.destroy = radeon_enc_destroy,
+	.destroy = radeon_ext_tmds_enc_destroy,
 };
 
-static bool radeon_legacy_tv_dac_mode_fixup(struct drm_encoder *encoder,
-					    struct drm_display_mode *mode,
-					    struct drm_display_mode *adjusted_mode)
-{
-	/* set the active encoder to connector routing */
-	radeon_encoder_set_active_device(encoder);
-	drm_mode_set_crtcinfo(adjusted_mode, 0);
-
-	return true;
-}
-
 static void radeon_legacy_tv_dac_dpms(struct drm_encoder *encoder, int mode)
 {
 	struct drm_device *dev = encoder->dev;
@@ -1265,7 +1271,7 @@ static enum drm_connector_status radeon_legacy_tv_dac_detect(struct drm_encoder
 
 static const struct drm_encoder_helper_funcs radeon_legacy_tv_dac_helper_funcs = {
 	.dpms = radeon_legacy_tv_dac_dpms,
-	.mode_fixup = radeon_legacy_tv_dac_mode_fixup,
+	.mode_fixup = radeon_legacy_mode_fixup,
 	.prepare = radeon_legacy_tv_dac_prepare,
 	.mode_set = radeon_legacy_tv_dac_mode_set,
 	.commit = radeon_legacy_tv_dac_commit,
@@ -1302,6 +1308,29 @@ static struct radeon_encoder_int_tmds *radeon_legacy_get_tmds_info(struct radeon
 	return tmds;
 }
 
+static struct radeon_encoder_ext_tmds *radeon_legacy_get_ext_tmds_info(struct radeon_encoder *encoder)
+{
+	struct drm_device *dev = encoder->base.dev;
+	struct radeon_device *rdev = dev->dev_private;
+	struct radeon_encoder_ext_tmds *tmds = NULL;
+	bool ret;
+
+	if (rdev->is_atom_bios)
+		return NULL;
+
+	tmds = kzalloc(sizeof(struct radeon_encoder_ext_tmds), GFP_KERNEL);
+
+	if (!tmds)
+		return NULL;
+
+	ret = radeon_legacy_get_ext_tmds_info_from_combios(encoder, tmds);
+
+	if (ret == false)
+		radeon_legacy_get_ext_tmds_info_from_table(encoder, tmds);
+
+	return tmds;
+}
+
 void
 radeon_add_legacy_encoder(struct drm_device *dev, uint32_t encoder_id, uint32_t supported_device)
 {
@@ -1329,7 +1358,6 @@ radeon_add_legacy_encoder(struct drm_device *dev, uint32_t encoder_id, uint32_t
 		encoder->possible_crtcs = 0x1;
 	else
 		encoder->possible_crtcs = 0x3;
-	encoder->possible_clones = 0;
 
 	radeon_encoder->enc_priv = NULL;
 
@@ -1373,7 +1401,7 @@ radeon_add_legacy_encoder(struct drm_device *dev, uint32_t encoder_id, uint32_t
 		drm_encoder_init(dev, encoder, &radeon_legacy_tmds_ext_enc_funcs, DRM_MODE_ENCODER_TMDS);
 		drm_encoder_helper_add(encoder, &radeon_legacy_tmds_ext_helper_funcs);
 		if (!rdev->is_atom_bios)
-			radeon_combios_get_ext_tmds_info(radeon_encoder);
+			radeon_encoder->enc_priv = radeon_legacy_get_ext_tmds_info(radeon_encoder);
 		break;
 	}
 }
diff --git a/drivers/gpu/drm/radeon/radeon_legacy_tv.c b/drivers/gpu/drm/radeon/radeon_legacy_tv.c
index 3a12bb0c0563..417684daef4c 100644
--- a/drivers/gpu/drm/radeon/radeon_legacy_tv.c
+++ b/drivers/gpu/drm/radeon/radeon_legacy_tv.c
@@ -77,7 +77,7 @@ struct radeon_tv_mode_constants {
 	unsigned pix_to_tv;
 };
 
-static const uint16_t hor_timing_NTSC[] = {
+static const uint16_t hor_timing_NTSC[MAX_H_CODE_TIMING_LEN] = {
 	0x0007,
 	0x003f,
 	0x0263,
@@ -98,7 +98,7 @@ static const uint16_t hor_timing_NTSC[] = {
 	0
 };
 
-static const uint16_t vert_timing_NTSC[] = {
+static const uint16_t vert_timing_NTSC[MAX_V_CODE_TIMING_LEN] = {
 	0x2001,
 	0x200d,
 	0x1006,
@@ -115,7 +115,7 @@ static const uint16_t vert_timing_NTSC[] = {
 	0
 };
 
-static const uint16_t hor_timing_PAL[] = {
+static const uint16_t hor_timing_PAL[MAX_H_CODE_TIMING_LEN] = {
 	0x0007,
 	0x0058,
 	0x027c,
@@ -136,7 +136,7 @@ static const uint16_t hor_timing_PAL[] = {
 	0
 };
 
-static const uint16_t vert_timing_PAL[] = 	{
+static const uint16_t vert_timing_PAL[MAX_V_CODE_TIMING_LEN] = {
 	0x2001,
 	0x200c,
 	0x1005,
@@ -623,9 +623,9 @@ void radeon_legacy_tv_mode_set(struct drm_encoder *encoder,
 	}
 	flicker_removal = (tmp + 500) / 1000;
 
-	if (flicker_removal < 3)
-		flicker_removal = 3;
-	for (i = 0; i < 6; ++i) {
+	if (flicker_removal < 2)
+		flicker_removal = 2;
+	for (i = 0; i < ARRAY_SIZE(SLOPE_limit); ++i) {
 		if (flicker_removal == SLOPE_limit[i])
 			break;
 	}
diff --git a/drivers/gpu/drm/radeon/radeon_mode.h b/drivers/gpu/drm/radeon/radeon_mode.h
index ace726aa0d76..91cb041cb40d 100644
--- a/drivers/gpu/drm/radeon/radeon_mode.h
+++ b/drivers/gpu/drm/radeon/radeon_mode.h
@@ -33,6 +33,7 @@
 #include <drm_crtc.h>
 #include <drm_mode.h>
 #include <drm_edid.h>
+#include <drm_dp_helper.h>
 #include <linux/i2c.h>
 #include <linux/i2c-id.h>
 #include <linux/i2c-algo-bit.h>
@@ -45,32 +46,6 @@ struct radeon_device;
 #define to_radeon_encoder(x) container_of(x, struct radeon_encoder, base)
 #define to_radeon_framebuffer(x) container_of(x, struct radeon_framebuffer, base)
 
-enum radeon_connector_type {
-	CONNECTOR_NONE,
-	CONNECTOR_VGA,
-	CONNECTOR_DVI_I,
-	CONNECTOR_DVI_D,
-	CONNECTOR_DVI_A,
-	CONNECTOR_STV,
-	CONNECTOR_CTV,
-	CONNECTOR_LVDS,
-	CONNECTOR_DIGITAL,
-	CONNECTOR_SCART,
-	CONNECTOR_HDMI_TYPE_A,
-	CONNECTOR_HDMI_TYPE_B,
-	CONNECTOR_0XC,
-	CONNECTOR_0XD,
-	CONNECTOR_DIN,
-	CONNECTOR_DISPLAY_PORT,
-	CONNECTOR_UNSUPPORTED
-};
-
-enum radeon_dvi_type {
-	DVI_AUTO,
-	DVI_DIGITAL,
-	DVI_ANALOG
-};
-
 enum radeon_rmx_type {
 	RMX_OFF,
 	RMX_FULL,
@@ -87,26 +62,48 @@ enum radeon_tv_std {
 	TV_STD_SCART_PAL,
 	TV_STD_SECAM,
 	TV_STD_PAL_CN,
+	TV_STD_PAL_N,
 };
 
+/* radeon gpio-based i2c
+ * 1. "mask" reg and bits
+ *    grabs the gpio pins for software use
+ *    0=not held  1=held
+ * 2. "a" reg and bits
+ *    output pin value
+ *    0=low 1=high
+ * 3. "en" reg and bits
+ *    sets the pin direction
+ *    0=input 1=output
+ * 4. "y" reg and bits
+ *    input pin value
+ *    0=low 1=high
+ */
 struct radeon_i2c_bus_rec {
 	bool valid;
+	/* id used by atom */
+	uint8_t i2c_id;
+	/* can be used with hw i2c engine */
+	bool hw_capable;
+	/* uses multi-media i2c engine */
+	bool mm_i2c;
+	/* regs and bits */
 	uint32_t mask_clk_reg;
 	uint32_t mask_data_reg;
 	uint32_t a_clk_reg;
 	uint32_t a_data_reg;
-	uint32_t put_clk_reg;
-	uint32_t put_data_reg;
-	uint32_t get_clk_reg;
-	uint32_t get_data_reg;
+	uint32_t en_clk_reg;
+	uint32_t en_data_reg;
+	uint32_t y_clk_reg;
+	uint32_t y_data_reg;
 	uint32_t mask_clk_mask;
 	uint32_t mask_data_mask;
-	uint32_t put_clk_mask;
-	uint32_t put_data_mask;
-	uint32_t get_clk_mask;
-	uint32_t get_data_mask;
 	uint32_t a_clk_mask;
 	uint32_t a_data_mask;
+	uint32_t en_clk_mask;
+	uint32_t en_data_mask;
+	uint32_t y_clk_mask;
+	uint32_t y_data_mask;
 };
 
 struct radeon_tmds_pll {
@@ -150,9 +147,12 @@ struct radeon_pll {
 };
 
 struct radeon_i2c_chan {
-	struct drm_device *dev;
 	struct i2c_adapter adapter;
-	struct i2c_algo_bit_data algo;
+	struct drm_device *dev;
+	union {
+		struct i2c_algo_dp_aux_data dp;
+		struct i2c_algo_bit_data bit;
+	} algo;
 	struct radeon_i2c_bus_rec rec;
 };
 
@@ -170,6 +170,11 @@ enum radeon_connector_table {
 	CT_EMAC,
 };
 
+enum radeon_dvo_chip {
+	DVO_SIL164,
+	DVO_SIL1178,
+};
+
 struct radeon_mode_info {
 	struct atom_context *atom_context;
 	struct card_info *atom_card_info;
@@ -261,6 +266,13 @@ struct radeon_encoder_int_tmds {
 	struct radeon_tmds_pll tmds_pll[4];
 };
 
+struct radeon_encoder_ext_tmds {
+	/* tmds over dvo */
+	struct radeon_i2c_chan *i2c_bus;
+	uint8_t slave_addr;
+	enum radeon_dvo_chip dvo_chip;
+};
+
 /* spread spectrum */
 struct radeon_atom_ss {
 	uint16_t percentage;
@@ -297,11 +309,43 @@ struct radeon_encoder {
 	enum radeon_rmx_type rmx_type;
 	struct drm_display_mode native_mode;
 	void *enc_priv;
+	int hdmi_offset;
+	int hdmi_audio_workaround;
+	int hdmi_buffer_status;
 };
 
 struct radeon_connector_atom_dig {
 	uint32_t igp_lane_info;
 	bool linkb;
+	/* displayport */
+	struct radeon_i2c_chan *dp_i2c_bus;
+	u8 dpcd[8];
+	u8 dp_sink_type;
+	int dp_clock;
+	int dp_lane_count;
+};
+
+struct radeon_gpio_rec {
+	bool valid;
+	u8 id;
+	u32 reg;
+	u32 mask;
+};
+
+enum radeon_hpd_id {
+	RADEON_HPD_NONE = 0,
+	RADEON_HPD_1,
+	RADEON_HPD_2,
+	RADEON_HPD_3,
+	RADEON_HPD_4,
+	RADEON_HPD_5,
+	RADEON_HPD_6,
+};
+
+struct radeon_hpd {
+	enum radeon_hpd_id hpd;
+	u8 plugged_state;
+	struct radeon_gpio_rec gpio;
 };
 
 struct radeon_connector {
@@ -318,6 +362,7 @@ struct radeon_connector {
 	void *con_priv;
 	bool dac_load_detect;
 	uint16_t connector_object_id;
+	struct radeon_hpd hpd;
 };
 
 struct radeon_framebuffer {
@@ -325,10 +370,42 @@ struct radeon_framebuffer {
 	struct drm_gem_object *obj;
 };
 
+extern enum radeon_tv_std
+radeon_combios_get_tv_info(struct radeon_device *rdev);
+extern enum radeon_tv_std
+radeon_atombios_get_tv_info(struct radeon_device *rdev);
+
+extern void radeon_connector_hotplug(struct drm_connector *connector);
+extern bool radeon_dp_needs_link_train(struct radeon_connector *radeon_connector);
+extern int radeon_dp_mode_valid_helper(struct radeon_connector *radeon_connector,
+				       struct drm_display_mode *mode);
+extern void radeon_dp_set_link_config(struct drm_connector *connector,
+				      struct drm_display_mode *mode);
+extern void dp_link_train(struct drm_encoder *encoder,
+			  struct drm_connector *connector);
+extern u8 radeon_dp_getsinktype(struct radeon_connector *radeon_connector);
+extern bool radeon_dp_getdpcd(struct radeon_connector *radeon_connector);
+extern void atombios_dig_transmitter_setup(struct drm_encoder *encoder,
+					   int action, uint8_t lane_num,
+					   uint8_t lane_set);
+extern int radeon_dp_i2c_aux_ch(struct i2c_adapter *adapter, int mode,
+				uint8_t write_byte, uint8_t *read_byte);
+
+extern struct radeon_i2c_chan *radeon_i2c_create_dp(struct drm_device *dev,
+						    struct radeon_i2c_bus_rec *rec,
+						    const char *name);
 extern struct radeon_i2c_chan *radeon_i2c_create(struct drm_device *dev,
 						 struct radeon_i2c_bus_rec *rec,
 						 const char *name);
 extern void radeon_i2c_destroy(struct radeon_i2c_chan *i2c);
+extern void radeon_i2c_sw_get_byte(struct radeon_i2c_chan *i2c_bus,
+				   u8 slave_addr,
+				   u8 addr,
+				   u8 *val);
+extern void radeon_i2c_sw_put_byte(struct radeon_i2c_chan *i2c,
+				   u8 slave_addr,
+				   u8 addr,
+				   u8 val);
 extern bool radeon_ddc_probe(struct radeon_connector *radeon_connector);
 extern int radeon_ddc_get_modes(struct radeon_connector *radeon_connector);
 
@@ -343,12 +420,24 @@ extern void radeon_compute_pll(struct radeon_pll *pll,
 			       uint32_t *post_div_p,
 			       int flags);
 
+extern void radeon_compute_pll_avivo(struct radeon_pll *pll,
+				     uint64_t freq,
+				     uint32_t *dot_clock_p,
+				     uint32_t *fb_div_p,
+				     uint32_t *frac_fb_div_p,
+				     uint32_t *ref_div_p,
+				     uint32_t *post_div_p,
+				     int flags);
+
+extern void radeon_setup_encoder_clones(struct drm_device *dev);
+
 struct drm_encoder *radeon_encoder_legacy_lvds_add(struct drm_device *dev, int bios_index);
 struct drm_encoder *radeon_encoder_legacy_primary_dac_add(struct drm_device *dev, int bios_index, int with_tv);
 struct drm_encoder *radeon_encoder_legacy_tv_dac_add(struct drm_device *dev, int bios_index, int with_tv);
 struct drm_encoder *radeon_encoder_legacy_tmds_int_add(struct drm_device *dev, int bios_index);
 struct drm_encoder *radeon_encoder_legacy_tmds_ext_add(struct drm_device *dev, int bios_index);
 extern void atombios_external_tmds_setup(struct drm_encoder *encoder, int action);
+extern void atombios_digital_setup(struct drm_encoder *encoder, int action);
 extern int atombios_get_encoder_mode(struct drm_encoder *encoder);
 extern void radeon_encoder_set_active_device(struct drm_encoder *encoder);
 
@@ -378,12 +467,16 @@ extern bool radeon_atom_get_clock_info(struct drm_device *dev);
 extern bool radeon_combios_get_clock_info(struct drm_device *dev);
 extern struct radeon_encoder_atom_dig *
 radeon_atombios_get_lvds_info(struct radeon_encoder *encoder);
-bool radeon_atombios_get_tmds_info(struct radeon_encoder *encoder,
-				   struct radeon_encoder_int_tmds *tmds);
-bool radeon_legacy_get_tmds_info_from_combios(struct radeon_encoder *encoder,
-					   struct radeon_encoder_int_tmds *tmds);
-bool radeon_legacy_get_tmds_info_from_table(struct radeon_encoder *encoder,
-					    struct radeon_encoder_int_tmds *tmds);
+extern bool radeon_atombios_get_tmds_info(struct radeon_encoder *encoder,
+					  struct radeon_encoder_int_tmds *tmds);
+extern bool radeon_legacy_get_tmds_info_from_combios(struct radeon_encoder *encoder,
+						     struct radeon_encoder_int_tmds *tmds);
+extern bool radeon_legacy_get_tmds_info_from_table(struct radeon_encoder *encoder,
+						   struct radeon_encoder_int_tmds *tmds);
+extern bool radeon_legacy_get_ext_tmds_info_from_combios(struct radeon_encoder *encoder,
+							 struct radeon_encoder_ext_tmds *tmds);
+extern bool radeon_legacy_get_ext_tmds_info_from_table(struct radeon_encoder *encoder,
+						       struct radeon_encoder_ext_tmds *tmds);
 extern struct radeon_encoder_primary_dac *
 radeon_atombios_get_primary_dac_info(struct radeon_encoder *encoder);
 extern struct radeon_encoder_tv_dac *
@@ -395,6 +488,8 @@ extern struct radeon_encoder_tv_dac *
 radeon_combios_get_tv_dac_info(struct radeon_encoder *encoder);
 extern struct radeon_encoder_primary_dac *
 radeon_combios_get_primary_dac_info(struct radeon_encoder *encoder);
+extern bool radeon_combios_external_tmds_setup(struct drm_encoder *encoder);
+extern void radeon_external_tmds_setup(struct drm_encoder *encoder);
 extern void radeon_combios_output_lock(struct drm_encoder *encoder, bool lock);
 extern void radeon_combios_initialize_bios_scratch_regs(struct drm_device *dev);
 extern void radeon_atom_output_lock(struct drm_encoder *encoder, bool lock);
@@ -426,16 +521,13 @@ void radeon_atombios_init_crtc(struct drm_device *dev,
 			       struct radeon_crtc *radeon_crtc);
 void radeon_legacy_init_crtc(struct drm_device *dev,
 			     struct radeon_crtc *radeon_crtc);
-void radeon_i2c_do_lock(struct radeon_connector *radeon_connector, int lock_state);
+extern void radeon_i2c_do_lock(struct radeon_i2c_chan *i2c, int lock_state);
 
 void radeon_get_clock_info(struct drm_device *dev);
 
 extern bool radeon_get_atom_connector_info_from_object_table(struct drm_device *dev);
 extern bool radeon_get_atom_connector_info_from_supported_devices_table(struct drm_device *dev);
 
-void radeon_rmx_mode_fixup(struct drm_encoder *encoder,
-			   struct drm_display_mode *mode,
-			   struct drm_display_mode *adjusted_mode);
 void radeon_enc_destroy(struct drm_encoder *encoder);
 void radeon_copy_fb(struct drm_device *dev, struct drm_gem_object *dst_obj);
 void radeon_combios_asic_init(struct drm_device *dev);
diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
index 1f056dadc5c2..4e636de877b2 100644
--- a/drivers/gpu/drm/radeon/radeon_object.c
+++ b/drivers/gpu/drm/radeon/radeon_object.c
@@ -34,100 +34,62 @@
 #include "radeon_drm.h"
 #include "radeon.h"
 
-struct radeon_object {
-	struct ttm_buffer_object	tobj;
-	struct list_head		list;
-	struct radeon_device		*rdev;
-	struct drm_gem_object		*gobj;
-	struct ttm_bo_kmap_obj		kmap;
-	unsigned			pin_count;
-	uint64_t			gpu_addr;
-	void				*kptr;
-	bool				is_iomem;
-	uint32_t			tiling_flags;
-	uint32_t			pitch;
-	int				surface_reg;
-};
 
 int radeon_ttm_init(struct radeon_device *rdev);
 void radeon_ttm_fini(struct radeon_device *rdev);
+static void radeon_bo_clear_surface_reg(struct radeon_bo *bo);
 
 /*
  * To exclude mutual BO access we rely on bo_reserve exclusion, as all
  * function are calling it.
  */
 
-static int radeon_object_reserve(struct radeon_object *robj, bool interruptible)
+static void radeon_ttm_bo_destroy(struct ttm_buffer_object *tbo)
 {
-	return ttm_bo_reserve(&robj->tobj, interruptible, false, false, 0);
-}
+	struct radeon_bo *bo;
 
-static void radeon_object_unreserve(struct radeon_object *robj)
-{
-	ttm_bo_unreserve(&robj->tobj);
+	bo = container_of(tbo, struct radeon_bo, tbo);
+	mutex_lock(&bo->rdev->gem.mutex);
+	list_del_init(&bo->list);
+	mutex_unlock(&bo->rdev->gem.mutex);
+	radeon_bo_clear_surface_reg(bo);
+	kfree(bo);
 }
 
-static void radeon_ttm_object_object_destroy(struct ttm_buffer_object *tobj)
+bool radeon_ttm_bo_is_radeon_bo(struct ttm_buffer_object *bo)
 {
-	struct radeon_object *robj;
-
-	robj = container_of(tobj, struct radeon_object, tobj);
-	list_del_init(&robj->list);
-	radeon_object_clear_surface_reg(robj);
-	kfree(robj);
+	if (bo->destroy == &radeon_ttm_bo_destroy)
+		return true;
+	return false;
 }
 
-static inline void radeon_object_gpu_addr(struct radeon_object *robj)
+void radeon_ttm_placement_from_domain(struct radeon_bo *rbo, u32 domain)
 {
-	/* Default gpu address */
-	robj->gpu_addr = 0xFFFFFFFFFFFFFFFFULL;
-	if (robj->tobj.mem.mm_node == NULL) {
-		return;
-	}
-	robj->gpu_addr = ((u64)robj->tobj.mem.mm_node->start) << PAGE_SHIFT;
-	switch (robj->tobj.mem.mem_type) {
-	case TTM_PL_VRAM:
-		robj->gpu_addr += (u64)robj->rdev->mc.vram_location;
-		break;
-	case TTM_PL_TT:
-		robj->gpu_addr += (u64)robj->rdev->mc.gtt_location;
-		break;
-	default:
-		DRM_ERROR("Unknown placement %d\n", robj->tobj.mem.mem_type);
-		robj->gpu_addr = 0xFFFFFFFFFFFFFFFFULL;
-		return;
-	}
-}
+	u32 c = 0;
 
-static inline uint32_t radeon_object_flags_from_domain(uint32_t domain)
-{
-	uint32_t flags = 0;
-	if (domain & RADEON_GEM_DOMAIN_VRAM) {
-		flags |= TTM_PL_FLAG_VRAM | TTM_PL_FLAG_WC | TTM_PL_FLAG_UNCACHED;
-	}
-	if (domain & RADEON_GEM_DOMAIN_GTT) {
-		flags |= TTM_PL_FLAG_TT | TTM_PL_MASK_CACHING;
-	}
-	if (domain & RADEON_GEM_DOMAIN_CPU) {
-		flags |= TTM_PL_FLAG_SYSTEM | TTM_PL_MASK_CACHING;
-	}
-	if (!flags) {
-		flags |= TTM_PL_FLAG_SYSTEM | TTM_PL_MASK_CACHING;
-	}
-	return flags;
+	rbo->placement.fpfn = 0;
+	rbo->placement.lpfn = 0;
+	rbo->placement.placement = rbo->placements;
+	rbo->placement.busy_placement = rbo->placements;
+	if (domain & RADEON_GEM_DOMAIN_VRAM)
+		rbo->placements[c++] = TTM_PL_FLAG_WC | TTM_PL_FLAG_UNCACHED |
+					TTM_PL_FLAG_VRAM;
+	if (domain & RADEON_GEM_DOMAIN_GTT)
+		rbo->placements[c++] = TTM_PL_MASK_CACHING | TTM_PL_FLAG_TT;
+	if (domain & RADEON_GEM_DOMAIN_CPU)
+		rbo->placements[c++] = TTM_PL_MASK_CACHING | TTM_PL_FLAG_SYSTEM;
+	if (!c)
+		rbo->placements[c++] = TTM_PL_MASK_CACHING | TTM_PL_FLAG_SYSTEM;
+	rbo->placement.num_placement = c;
+	rbo->placement.num_busy_placement = c;
 }
 
-int radeon_object_create(struct radeon_device *rdev,
-			 struct drm_gem_object *gobj,
-			 unsigned long size,
-			 bool kernel,
-			 uint32_t domain,
-			 bool interruptible,
-			 struct radeon_object **robj_ptr)
+int radeon_bo_create(struct radeon_device *rdev, struct drm_gem_object *gobj,
+			unsigned long size, bool kernel, u32 domain,
+			struct radeon_bo **bo_ptr)
 {
-	struct radeon_object *robj;
+	struct radeon_bo *bo;
 	enum ttm_bo_type type;
-	uint32_t flags;
 	int r;
 
 	if (unlikely(rdev->mman.bdev.dev_mapping == NULL)) {
@@ -138,238 +100,160 @@ int radeon_object_create(struct radeon_device *rdev,
 	} else {
 		type = ttm_bo_type_device;
 	}
-	*robj_ptr = NULL;
-	robj = kzalloc(sizeof(struct radeon_object), GFP_KERNEL);
-	if (robj == NULL) {
+	*bo_ptr = NULL;
+	bo = kzalloc(sizeof(struct radeon_bo), GFP_KERNEL);
+	if (bo == NULL)
 		return -ENOMEM;
-	}
-	robj->rdev = rdev;
-	robj->gobj = gobj;
-	robj->surface_reg = -1;
-	INIT_LIST_HEAD(&robj->list);
-
-	flags = radeon_object_flags_from_domain(domain);
-	r = ttm_buffer_object_init(&rdev->mman.bdev, &robj->tobj, size, type, flags,
-				   0, 0, false, NULL, size,
-				   &radeon_ttm_object_object_destroy);
+	bo->rdev = rdev;
+	bo->gobj = gobj;
+	bo->surface_reg = -1;
+	INIT_LIST_HEAD(&bo->list);
+
+	radeon_ttm_placement_from_domain(bo, domain);
+	/* Kernel allocation are uninterruptible */
+	r = ttm_bo_init(&rdev->mman.bdev, &bo->tbo, size, type,
+			&bo->placement, 0, 0, !kernel, NULL, size,
+			&radeon_ttm_bo_destroy);
 	if (unlikely(r != 0)) {
-		/* ttm call radeon_ttm_object_object_destroy if error happen */
-		DRM_ERROR("Failed to allocate TTM object (%ld, 0x%08X, %u)\n",
-			  size, flags, 0);
+		if (r != -ERESTARTSYS)
+			dev_err(rdev->dev,
+				"object_init failed for (%lu, 0x%08X)\n",
+				size, domain);
 		return r;
 	}
-	*robj_ptr = robj;
+	*bo_ptr = bo;
 	if (gobj) {
-		list_add_tail(&robj->list, &rdev->gem.objects);
+		mutex_lock(&bo->rdev->gem.mutex);
+		list_add_tail(&bo->list, &rdev->gem.objects);
+		mutex_unlock(&bo->rdev->gem.mutex);
 	}
 	return 0;
 }
 
-int radeon_object_kmap(struct radeon_object *robj, void **ptr)
+int radeon_bo_kmap(struct radeon_bo *bo, void **ptr)
 {
+	bool is_iomem;
 	int r;
 
-	spin_lock(&robj->tobj.lock);
-	if (robj->kptr) {
+	if (bo->kptr) {
 		if (ptr) {
-			*ptr = robj->kptr;
+			*ptr = bo->kptr;
 		}
-		spin_unlock(&robj->tobj.lock);
 		return 0;
 	}
-	spin_unlock(&robj->tobj.lock);
-	r = ttm_bo_kmap(&robj->tobj, 0, robj->tobj.num_pages, &robj->kmap);
+	r = ttm_bo_kmap(&bo->tbo, 0, bo->tbo.num_pages, &bo->kmap);
 	if (r) {
 		return r;
 	}
-	spin_lock(&robj->tobj.lock);
-	robj->kptr = ttm_kmap_obj_virtual(&robj->kmap, &robj->is_iomem);
-	spin_unlock(&robj->tobj.lock);
+	bo->kptr = ttm_kmap_obj_virtual(&bo->kmap, &is_iomem);
 	if (ptr) {
-		*ptr = robj->kptr;
+		*ptr = bo->kptr;
 	}
-	radeon_object_check_tiling(robj, 0, 0);
+	radeon_bo_check_tiling(bo, 0, 0);
 	return 0;
 }
 
-void radeon_object_kunmap(struct radeon_object *robj)
+void radeon_bo_kunmap(struct radeon_bo *bo)
 {
-	spin_lock(&robj->tobj.lock);
-	if (robj->kptr == NULL) {
-		spin_unlock(&robj->tobj.lock);
+	if (bo->kptr == NULL)
 		return;
-	}
-	robj->kptr = NULL;
-	spin_unlock(&robj->tobj.lock);
-	radeon_object_check_tiling(robj, 0, 0);
-	ttm_bo_kunmap(&robj->kmap);
+	bo->kptr = NULL;
+	radeon_bo_check_tiling(bo, 0, 0);
+	ttm_bo_kunmap(&bo->kmap);
 }
 
-void radeon_object_unref(struct radeon_object **robj)
+void radeon_bo_unref(struct radeon_bo **bo)
 {
-	struct ttm_buffer_object *tobj;
+	struct ttm_buffer_object *tbo;
 
-	if ((*robj) == NULL) {
+	if ((*bo) == NULL)
 		return;
-	}
-	tobj = &((*robj)->tobj);
-	ttm_bo_unref(&tobj);
-	if (tobj == NULL) {
-		*robj = NULL;
-	}
-}
-
-int radeon_object_mmap(struct radeon_object *robj, uint64_t *offset)
-{
-	*offset = robj->tobj.addr_space_offset;
-	return 0;
+	tbo = &((*bo)->tbo);
+	ttm_bo_unref(&tbo);
+	if (tbo == NULL)
+		*bo = NULL;
 }
 
-int radeon_object_pin(struct radeon_object *robj, uint32_t domain,
-		      uint64_t *gpu_addr)
+int radeon_bo_pin(struct radeon_bo *bo, u32 domain, u64 *gpu_addr)
 {
-	uint32_t flags;
-	uint32_t tmp;
-	int r;
+	int r, i;
 
-	flags = radeon_object_flags_from_domain(domain);
-	spin_lock(&robj->tobj.lock);
-	if (robj->pin_count) {
-		robj->pin_count++;
-		if (gpu_addr != NULL) {
-			*gpu_addr = robj->gpu_addr;
-		}
-		spin_unlock(&robj->tobj.lock);
+	radeon_ttm_placement_from_domain(bo, domain);
+	if (bo->pin_count) {
+		bo->pin_count++;
+		if (gpu_addr)
+			*gpu_addr = radeon_bo_gpu_offset(bo);
 		return 0;
 	}
-	spin_unlock(&robj->tobj.lock);
-	r = radeon_object_reserve(robj, false);
-	if (unlikely(r != 0)) {
-		DRM_ERROR("radeon: failed to reserve object for pinning it.\n");
-		return r;
-	}
-	tmp = robj->tobj.mem.placement;
-	ttm_flag_masked(&tmp, flags, TTM_PL_MASK_MEM);
-	robj->tobj.proposed_placement = tmp | TTM_PL_FLAG_NO_EVICT | TTM_PL_MASK_CACHING;
-	r = ttm_buffer_object_validate(&robj->tobj,
-				       robj->tobj.proposed_placement,
-				       false, false);
-	radeon_object_gpu_addr(robj);
-	if (gpu_addr != NULL) {
-		*gpu_addr = robj->gpu_addr;
-	}
-	robj->pin_count = 1;
-	if (unlikely(r != 0)) {
-		DRM_ERROR("radeon: failed to pin object.\n");
-	}
-	radeon_object_unreserve(robj);
-	return r;
-}
-
-void radeon_object_unpin(struct radeon_object *robj)
-{
-	uint32_t flags;
-	int r;
-
-	spin_lock(&robj->tobj.lock);
-	if (!robj->pin_count) {
-		spin_unlock(&robj->tobj.lock);
-		printk(KERN_WARNING "Unpin not necessary for %p !\n", robj);
-		return;
-	}
-	robj->pin_count--;
-	if (robj->pin_count) {
-		spin_unlock(&robj->tobj.lock);
-		return;
-	}
-	spin_unlock(&robj->tobj.lock);
-	r = radeon_object_reserve(robj, false);
-	if (unlikely(r != 0)) {
-		DRM_ERROR("radeon: failed to reserve object for unpinning it.\n");
-		return;
-	}
-	flags = robj->tobj.mem.placement;
-	robj->tobj.proposed_placement = flags & ~TTM_PL_FLAG_NO_EVICT;
-	r = ttm_buffer_object_validate(&robj->tobj,
-				       robj->tobj.proposed_placement,
-				       false, false);
-	if (unlikely(r != 0)) {
-		DRM_ERROR("radeon: failed to unpin buffer.\n");
-	}
-	radeon_object_unreserve(robj);
-}
-
-int radeon_object_wait(struct radeon_object *robj)
-{
-	int r = 0;
-
-	/* FIXME: should use block reservation instead */
-	r = radeon_object_reserve(robj, true);
-	if (unlikely(r != 0)) {
-		DRM_ERROR("radeon: failed to reserve object for waiting.\n");
-		return r;
-	}
-	spin_lock(&robj->tobj.lock);
-	if (robj->tobj.sync_obj) {
-		r = ttm_bo_wait(&robj->tobj, true, true, false);
-	}
-	spin_unlock(&robj->tobj.lock);
-	radeon_object_unreserve(robj);
+	radeon_ttm_placement_from_domain(bo, domain);
+	for (i = 0; i < bo->placement.num_placement; i++)
+		bo->placements[i] |= TTM_PL_FLAG_NO_EVICT;
+	r = ttm_bo_validate(&bo->tbo, &bo->placement, false, false);
+	if (likely(r == 0)) {
+		bo->pin_count = 1;
+		if (gpu_addr != NULL)
+			*gpu_addr = radeon_bo_gpu_offset(bo);
+	}
+	if (unlikely(r != 0))
+		dev_err(bo->rdev->dev, "%p pin failed\n", bo);
 	return r;
 }
 
-int radeon_object_busy_domain(struct radeon_object *robj, uint32_t *cur_placement)
+int radeon_bo_unpin(struct radeon_bo *bo)
 {
-	int r = 0;
+	int r, i;
 
-	r = radeon_object_reserve(robj, true);
-	if (unlikely(r != 0)) {
-		DRM_ERROR("radeon: failed to reserve object for waiting.\n");
-		return r;
-	}
-	spin_lock(&robj->tobj.lock);
-	*cur_placement = robj->tobj.mem.mem_type;
-	if (robj->tobj.sync_obj) {
-		r = ttm_bo_wait(&robj->tobj, true, true, true);
+	if (!bo->pin_count) {
+		dev_warn(bo->rdev->dev, "%p unpin not necessary\n", bo);
+		return 0;
 	}
-	spin_unlock(&robj->tobj.lock);
-	radeon_object_unreserve(robj);
+	bo->pin_count--;
+	if (bo->pin_count)
+		return 0;
+	for (i = 0; i < bo->placement.num_placement; i++)
+		bo->placements[i] &= ~TTM_PL_FLAG_NO_EVICT;
+	r = ttm_bo_validate(&bo->tbo, &bo->placement, false, false);
+	if (unlikely(r != 0))
+		dev_err(bo->rdev->dev, "%p validate failed for unpin\n", bo);
 	return r;
 }
 
-int radeon_object_evict_vram(struct radeon_device *rdev)
+int radeon_bo_evict_vram(struct radeon_device *rdev)
 {
 	if (rdev->flags & RADEON_IS_IGP) {
-		/* Useless to evict on IGP chips */
-		return 0;
+		if (rdev->mc.igp_sideport_enabled == false)
+			/* Useless to evict on IGP chips */
+			return 0;
 	}
 	return ttm_bo_evict_mm(&rdev->mman.bdev, TTM_PL_VRAM);
 }
 
-void radeon_object_force_delete(struct radeon_device *rdev)
+void radeon_bo_force_delete(struct radeon_device *rdev)
 {
-	struct radeon_object *robj, *n;
+	struct radeon_bo *bo, *n;
 	struct drm_gem_object *gobj;
 
 	if (list_empty(&rdev->gem.objects)) {
 		return;
 	}
-	DRM_ERROR("Userspace still has active objects !\n");
-	list_for_each_entry_safe(robj, n, &rdev->gem.objects, list) {
+	dev_err(rdev->dev, "Userspace still has active objects !\n");
+	list_for_each_entry_safe(bo, n, &rdev->gem.objects, list) {
 		mutex_lock(&rdev->ddev->struct_mutex);
-		gobj = robj->gobj;
-		DRM_ERROR("Force free for (%p,%p,%lu,%lu)\n",
-			  gobj, robj, (unsigned long)gobj->size,
-			  *((unsigned long *)&gobj->refcount));
-		list_del_init(&robj->list);
-		radeon_object_unref(&robj);
+		gobj = bo->gobj;
+		dev_err(rdev->dev, "%p %p %lu %lu force free\n",
+			gobj, bo, (unsigned long)gobj->size,
+			*((unsigned long *)&gobj->refcount));
+		mutex_lock(&bo->rdev->gem.mutex);
+		list_del_init(&bo->list);
+		mutex_unlock(&bo->rdev->gem.mutex);
+		radeon_bo_unref(&bo);
 		gobj->driver_private = NULL;
 		drm_gem_object_unreference(gobj);
 		mutex_unlock(&rdev->ddev->struct_mutex);
 	}
 }
 
-int radeon_object_init(struct radeon_device *rdev)
+int radeon_bo_init(struct radeon_device *rdev)
 {
 	/* Add an MTRR for the VRAM */
 	rdev->mc.vram_mtrr = mtrr_add(rdev->mc.aper_base, rdev->mc.aper_size,
@@ -382,13 +266,13 @@ int radeon_object_init(struct radeon_device *rdev)
 	return radeon_ttm_init(rdev);
 }
 
-void radeon_object_fini(struct radeon_device *rdev)
+void radeon_bo_fini(struct radeon_device *rdev)
 {
 	radeon_ttm_fini(rdev);
 }
 
-void radeon_object_list_add_object(struct radeon_object_list *lobj,
-				   struct list_head *head)
+void radeon_bo_list_add_object(struct radeon_bo_list *lobj,
+				struct list_head *head)
 {
 	if (lobj->wdomain) {
 		list_add(&lobj->list, head);
@@ -397,72 +281,62 @@ void radeon_object_list_add_object(struct radeon_object_list *lobj,
 	}
 }
 
-int radeon_object_list_reserve(struct list_head *head)
+int radeon_bo_list_reserve(struct list_head *head)
 {
-	struct radeon_object_list *lobj;
+	struct radeon_bo_list *lobj;
 	int r;
 
 	list_for_each_entry(lobj, head, list){
-		if (!lobj->robj->pin_count) {
-			r = radeon_object_reserve(lobj->robj, true);
-			if (unlikely(r != 0)) {
-				DRM_ERROR("radeon: failed to reserve object.\n");
-				return r;
-			}
-		} else {
-		}
+		r = radeon_bo_reserve(lobj->bo, false);
+		if (unlikely(r != 0))
+			return r;
 	}
 	return 0;
 }
 
-void radeon_object_list_unreserve(struct list_head *head)
+void radeon_bo_list_unreserve(struct list_head *head)
 {
-	struct radeon_object_list *lobj;
+	struct radeon_bo_list *lobj;
 
 	list_for_each_entry(lobj, head, list) {
-		if (!lobj->robj->pin_count) {
-			radeon_object_unreserve(lobj->robj);
-		}
+		/* only unreserve object we successfully reserved */
+		if (radeon_bo_is_reserved(lobj->bo))
+			radeon_bo_unreserve(lobj->bo);
 	}
 }
 
-int radeon_object_list_validate(struct list_head *head, void *fence)
+int radeon_bo_list_validate(struct list_head *head, void *fence)
 {
-	struct radeon_object_list *lobj;
-	struct radeon_object *robj;
+	struct radeon_bo_list *lobj;
+	struct radeon_bo *bo;
 	struct radeon_fence *old_fence = NULL;
 	int r;
 
-	r = radeon_object_list_reserve(head);
+	r = radeon_bo_list_reserve(head);
 	if (unlikely(r != 0)) {
-		radeon_object_list_unreserve(head);
 		return r;
 	}
 	list_for_each_entry(lobj, head, list) {
-		robj = lobj->robj;
-		if (!robj->pin_count) {
+		bo = lobj->bo;
+		if (!bo->pin_count) {
 			if (lobj->wdomain) {
-				robj->tobj.proposed_placement =
-					radeon_object_flags_from_domain(lobj->wdomain);
+				radeon_ttm_placement_from_domain(bo,
+								lobj->wdomain);
 			} else {
-				robj->tobj.proposed_placement =
-					radeon_object_flags_from_domain(lobj->rdomain);
+				radeon_ttm_placement_from_domain(bo,
+								lobj->rdomain);
 			}
-			r = ttm_buffer_object_validate(&robj->tobj,
-						       robj->tobj.proposed_placement,
-						       true, false);
-			if (unlikely(r)) {
-				DRM_ERROR("radeon: failed to validate.\n");
+			r = ttm_bo_validate(&bo->tbo, &bo->placement,
+						true, false);
+			if (unlikely(r))
 				return r;
-			}
-			radeon_object_gpu_addr(robj);
 		}
-		lobj->gpu_offset = robj->gpu_addr;
-		lobj->tiling_flags = robj->tiling_flags;
+		lobj->gpu_offset = radeon_bo_gpu_offset(bo);
+		lobj->tiling_flags = bo->tiling_flags;
 		if (fence) {
-			old_fence = (struct radeon_fence *)robj->tobj.sync_obj;
-			robj->tobj.sync_obj = radeon_fence_ref(fence);
-			robj->tobj.sync_obj_arg = NULL;
+			old_fence = (struct radeon_fence *)bo->tbo.sync_obj;
+			bo->tbo.sync_obj = radeon_fence_ref(fence);
+			bo->tbo.sync_obj_arg = NULL;
 		}
 		if (old_fence) {
 			radeon_fence_unref(&old_fence);
@@ -471,51 +345,44 @@ int radeon_object_list_validate(struct list_head *head, void *fence)
 	return 0;
 }
 
-void radeon_object_list_unvalidate(struct list_head *head)
+void radeon_bo_list_unvalidate(struct list_head *head, void *fence)
 {
-	struct radeon_object_list *lobj;
-	struct radeon_fence *old_fence = NULL;
+	struct radeon_bo_list *lobj;
+	struct radeon_fence *old_fence;
 
-	list_for_each_entry(lobj, head, list) {
-		old_fence = (struct radeon_fence *)lobj->robj->tobj.sync_obj;
-		lobj->robj->tobj.sync_obj = NULL;
-		if (old_fence) {
-			radeon_fence_unref(&old_fence);
+	if (fence)
+		list_for_each_entry(lobj, head, list) {
+			old_fence = to_radeon_fence(lobj->bo->tbo.sync_obj);
+			if (old_fence == fence) {
+				lobj->bo->tbo.sync_obj = NULL;
+				radeon_fence_unref(&old_fence);
+			}
 		}
-	}
-	radeon_object_list_unreserve(head);
+	radeon_bo_list_unreserve(head);
 }
 
-void radeon_object_list_clean(struct list_head *head)
-{
-	radeon_object_list_unreserve(head);
-}
-
-int radeon_object_fbdev_mmap(struct radeon_object *robj,
+int radeon_bo_fbdev_mmap(struct radeon_bo *bo,
 			     struct vm_area_struct *vma)
 {
-	return ttm_fbdev_mmap(vma, &robj->tobj);
+	return ttm_fbdev_mmap(vma, &bo->tbo);
 }
 
-unsigned long radeon_object_size(struct radeon_object *robj)
+int radeon_bo_get_surface_reg(struct radeon_bo *bo)
 {
-	return robj->tobj.num_pages << PAGE_SHIFT;
-}
-
-int radeon_object_get_surface_reg(struct radeon_object *robj)
-{
-	struct radeon_device *rdev = robj->rdev;
+	struct radeon_device *rdev = bo->rdev;
 	struct radeon_surface_reg *reg;
-	struct radeon_object *old_object;
+	struct radeon_bo *old_object;
 	int steal;
 	int i;
 
-	if (!robj->tiling_flags)
+	BUG_ON(!atomic_read(&bo->tbo.reserved));
+
+	if (!bo->tiling_flags)
 		return 0;
 
-	if (robj->surface_reg >= 0) {
-		reg = &rdev->surface_regs[robj->surface_reg];
-		i = robj->surface_reg;
+	if (bo->surface_reg >= 0) {
+		reg = &rdev->surface_regs[bo->surface_reg];
+		i = bo->surface_reg;
 		goto out;
 	}
 
@@ -523,10 +390,10 @@ int radeon_object_get_surface_reg(struct radeon_object *robj)
 	for (i = 0; i < RADEON_GEM_MAX_SURFACES; i++) {
 
 		reg = &rdev->surface_regs[i];
-		if (!reg->robj)
+		if (!reg->bo)
 			break;
 
-		old_object = reg->robj;
+		old_object = reg->bo;
 		if (old_object->pin_count == 0)
 			steal = i;
 	}
@@ -537,91 +404,107 @@ int radeon_object_get_surface_reg(struct radeon_object *robj)
 			return -ENOMEM;
 		/* find someone with a surface reg and nuke their BO */
 		reg = &rdev->surface_regs[steal];
-		old_object = reg->robj;
+		old_object = reg->bo;
 		/* blow away the mapping */
 		DRM_DEBUG("stealing surface reg %d from %p\n", steal, old_object);
-		ttm_bo_unmap_virtual(&old_object->tobj);
+		ttm_bo_unmap_virtual(&old_object->tbo);
 		old_object->surface_reg = -1;
 		i = steal;
 	}
 
-	robj->surface_reg = i;
-	reg->robj = robj;
+	bo->surface_reg = i;
+	reg->bo = bo;
 
 out:
-	radeon_set_surface_reg(rdev, i, robj->tiling_flags, robj->pitch,
-			       robj->tobj.mem.mm_node->start << PAGE_SHIFT,
-			       robj->tobj.num_pages << PAGE_SHIFT);
+	radeon_set_surface_reg(rdev, i, bo->tiling_flags, bo->pitch,
+			       bo->tbo.mem.mm_node->start << PAGE_SHIFT,
+			       bo->tbo.num_pages << PAGE_SHIFT);
 	return 0;
 }
 
-void radeon_object_clear_surface_reg(struct radeon_object *robj)
+static void radeon_bo_clear_surface_reg(struct radeon_bo *bo)
 {
-	struct radeon_device *rdev = robj->rdev;
+	struct radeon_device *rdev = bo->rdev;
 	struct radeon_surface_reg *reg;
 
-	if (robj->surface_reg == -1)
+	if (bo->surface_reg == -1)
 		return;
 
-	reg = &rdev->surface_regs[robj->surface_reg];
-	radeon_clear_surface_reg(rdev, robj->surface_reg);
+	reg = &rdev->surface_regs[bo->surface_reg];
+	radeon_clear_surface_reg(rdev, bo->surface_reg);
 
-	reg->robj = NULL;
-	robj->surface_reg = -1;
+	reg->bo = NULL;
+	bo->surface_reg = -1;
 }
 
-void radeon_object_set_tiling_flags(struct radeon_object *robj,
-				    uint32_t tiling_flags, uint32_t pitch)
+int radeon_bo_set_tiling_flags(struct radeon_bo *bo,
+				uint32_t tiling_flags, uint32_t pitch)
 {
-	robj->tiling_flags = tiling_flags;
-	robj->pitch = pitch;
+	int r;
+
+	r = radeon_bo_reserve(bo, false);
+	if (unlikely(r != 0))
+		return r;
+	bo->tiling_flags = tiling_flags;
+	bo->pitch = pitch;
+	radeon_bo_unreserve(bo);
+	return 0;
 }
 
-void radeon_object_get_tiling_flags(struct radeon_object *robj,
-				    uint32_t *tiling_flags,
-				    uint32_t *pitch)
+void radeon_bo_get_tiling_flags(struct radeon_bo *bo,
+				uint32_t *tiling_flags,
+				uint32_t *pitch)
 {
+	BUG_ON(!atomic_read(&bo->tbo.reserved));
 	if (tiling_flags)
-		*tiling_flags = robj->tiling_flags;
+		*tiling_flags = bo->tiling_flags;
 	if (pitch)
-		*pitch = robj->pitch;
+		*pitch = bo->pitch;
 }
 
-int radeon_object_check_tiling(struct radeon_object *robj, bool has_moved,
-			       bool force_drop)
+int radeon_bo_check_tiling(struct radeon_bo *bo, bool has_moved,
+				bool force_drop)
 {
-	if (!(robj->tiling_flags & RADEON_TILING_SURFACE))
+	BUG_ON(!atomic_read(&bo->tbo.reserved));
+
+	if (!(bo->tiling_flags & RADEON_TILING_SURFACE))
 		return 0;
 
 	if (force_drop) {
-		radeon_object_clear_surface_reg(robj);
+		radeon_bo_clear_surface_reg(bo);
 		return 0;
 	}
 
-	if (robj->tobj.mem.mem_type != TTM_PL_VRAM) {
+	if (bo->tbo.mem.mem_type != TTM_PL_VRAM) {
 		if (!has_moved)
 			return 0;
 
-		if (robj->surface_reg >= 0)
-			radeon_object_clear_surface_reg(robj);
+		if (bo->surface_reg >= 0)
+			radeon_bo_clear_surface_reg(bo);
 		return 0;
 	}
 
-	if ((robj->surface_reg >= 0) && !has_moved)
+	if ((bo->surface_reg >= 0) && !has_moved)
 		return 0;
 
-	return radeon_object_get_surface_reg(robj);
+	return radeon_bo_get_surface_reg(bo);
 }
 
 void radeon_bo_move_notify(struct ttm_buffer_object *bo,
-			  struct ttm_mem_reg *mem)
+			   struct ttm_mem_reg *mem)
 {
-	struct radeon_object *robj = container_of(bo, struct radeon_object, tobj);
-	radeon_object_check_tiling(robj, 0, 1);
+	struct radeon_bo *rbo;
+	if (!radeon_ttm_bo_is_radeon_bo(bo))
+		return;
+	rbo = container_of(bo, struct radeon_bo, tbo);
+	radeon_bo_check_tiling(rbo, 0, 1);
 }
 
 void radeon_bo_fault_reserve_notify(struct ttm_buffer_object *bo)
 {
-	struct radeon_object *robj = container_of(bo, struct radeon_object, tobj);
-	radeon_object_check_tiling(robj, 0, 0);
+	struct radeon_bo *rbo;
+	if (!radeon_ttm_bo_is_radeon_bo(bo))
+		return;
+	rbo = container_of(bo, struct radeon_bo, tbo);
+	radeon_bo_check_tiling(rbo, 0, 0);
 }
diff --git a/drivers/gpu/drm/radeon/radeon_object.h b/drivers/gpu/drm/radeon/radeon_object.h
index 10e8af6bb456..a02f18011ad1 100644
--- a/drivers/gpu/drm/radeon/radeon_object.h
+++ b/drivers/gpu/drm/radeon/radeon_object.h
@@ -28,19 +28,146 @@
 #ifndef __RADEON_OBJECT_H__
 #define __RADEON_OBJECT_H__
 
-#include <ttm/ttm_bo_api.h>
-#include <ttm/ttm_bo_driver.h>
-#include <ttm/ttm_placement.h>
-#include <ttm/ttm_module.h>
+#include <drm/radeon_drm.h>
+#include "radeon.h"
 
-/*
- * TTM.
+/**
+ * radeon_mem_type_to_domain - return domain corresponding to mem_type
+ * @mem_type:	ttm memory type
+ *
+ * Returns corresponding domain of the ttm mem_type
+ */
+static inline unsigned radeon_mem_type_to_domain(u32 mem_type)
+{
+	switch (mem_type) {
+	case TTM_PL_VRAM:
+		return RADEON_GEM_DOMAIN_VRAM;
+	case TTM_PL_TT:
+		return RADEON_GEM_DOMAIN_GTT;
+	case TTM_PL_SYSTEM:
+		return RADEON_GEM_DOMAIN_CPU;
+	default:
+		break;
+	}
+	return 0;
+}
+
+/**
+ * radeon_bo_reserve - reserve bo
+ * @bo:		bo structure
+ * @no_wait:		don't sleep while trying to reserve (return -EBUSY)
+ *
+ * Returns:
+ * -EBUSY: buffer is busy and @no_wait is true
+ * -ERESTARTSYS: A wait for the buffer to become unreserved was interrupted by
+ * a signal. Release all buffer reservations and return to user-space.
  */
-struct radeon_mman {
-	struct ttm_bo_global_ref        bo_global_ref;
-	struct ttm_global_reference	mem_global_ref;
-	bool				mem_global_referenced;
-	struct ttm_bo_device		bdev;
-};
+static inline int radeon_bo_reserve(struct radeon_bo *bo, bool no_wait)
+{
+	int r;
+
+	r = ttm_bo_reserve(&bo->tbo, true, no_wait, false, 0);
+	if (unlikely(r != 0)) {
+		if (r != -ERESTARTSYS)
+			dev_err(bo->rdev->dev, "%p reserve failed\n", bo);
+		return r;
+	}
+	return 0;
+}
+
+static inline void radeon_bo_unreserve(struct radeon_bo *bo)
+{
+	ttm_bo_unreserve(&bo->tbo);
+}
+
+/**
+ * radeon_bo_gpu_offset - return GPU offset of bo
+ * @bo:	radeon object for which we query the offset
+ *
+ * Returns current GPU offset of the object.
+ *
+ * Note: object should either be pinned or reserved when calling this
+ * function, it might be usefull to add check for this for debugging.
+ */
+static inline u64 radeon_bo_gpu_offset(struct radeon_bo *bo)
+{
+	return bo->tbo.offset;
+}
+
+static inline unsigned long radeon_bo_size(struct radeon_bo *bo)
+{
+	return bo->tbo.num_pages << PAGE_SHIFT;
+}
+
+static inline bool radeon_bo_is_reserved(struct radeon_bo *bo)
+{
+	return !!atomic_read(&bo->tbo.reserved);
+}
+
+/**
+ * radeon_bo_mmap_offset - return mmap offset of bo
+ * @bo:	radeon object for which we query the offset
+ *
+ * Returns mmap offset of the object.
+ *
+ * Note: addr_space_offset is constant after ttm bo init thus isn't protected
+ * by any lock.
+ */
+static inline u64 radeon_bo_mmap_offset(struct radeon_bo *bo)
+{
+	return bo->tbo.addr_space_offset;
+}
+
+static inline int radeon_bo_wait(struct radeon_bo *bo, u32 *mem_type,
+					bool no_wait)
+{
+	int r;
+
+	r = ttm_bo_reserve(&bo->tbo, true, no_wait, false, 0);
+	if (unlikely(r != 0)) {
+		if (r != -ERESTARTSYS)
+			dev_err(bo->rdev->dev, "%p reserve failed for wait\n", bo);
+		return r;
+	}
+	spin_lock(&bo->tbo.lock);
+	if (mem_type)
+		*mem_type = bo->tbo.mem.mem_type;
+	if (bo->tbo.sync_obj)
+		r = ttm_bo_wait(&bo->tbo, true, true, no_wait);
+	spin_unlock(&bo->tbo.lock);
+	ttm_bo_unreserve(&bo->tbo);
+	return r;
+}
 
+extern int radeon_bo_create(struct radeon_device *rdev,
+				struct drm_gem_object *gobj, unsigned long size,
+				bool kernel, u32 domain,
+				struct radeon_bo **bo_ptr);
+extern int radeon_bo_kmap(struct radeon_bo *bo, void **ptr);
+extern void radeon_bo_kunmap(struct radeon_bo *bo);
+extern void radeon_bo_unref(struct radeon_bo **bo);
+extern int radeon_bo_pin(struct radeon_bo *bo, u32 domain, u64 *gpu_addr);
+extern int radeon_bo_unpin(struct radeon_bo *bo);
+extern int radeon_bo_evict_vram(struct radeon_device *rdev);
+extern void radeon_bo_force_delete(struct radeon_device *rdev);
+extern int radeon_bo_init(struct radeon_device *rdev);
+extern void radeon_bo_fini(struct radeon_device *rdev);
+extern void radeon_bo_list_add_object(struct radeon_bo_list *lobj,
+				struct list_head *head);
+extern int radeon_bo_list_reserve(struct list_head *head);
+extern void radeon_bo_list_unreserve(struct list_head *head);
+extern int radeon_bo_list_validate(struct list_head *head, void *fence);
+extern void radeon_bo_list_unvalidate(struct list_head *head, void *fence);
+extern int radeon_bo_fbdev_mmap(struct radeon_bo *bo,
+				struct vm_area_struct *vma);
+extern int radeon_bo_set_tiling_flags(struct radeon_bo *bo,
+				u32 tiling_flags, u32 pitch);
+extern void radeon_bo_get_tiling_flags(struct radeon_bo *bo,
+				u32 *tiling_flags, u32 *pitch);
+extern int radeon_bo_check_tiling(struct radeon_bo *bo, bool has_moved,
+				bool force_drop);
+extern void radeon_bo_move_notify(struct ttm_buffer_object *bo,
+					struct ttm_mem_reg *mem);
+extern void radeon_bo_fault_reserve_notify(struct ttm_buffer_object *bo);
+extern int radeon_bo_get_surface_reg(struct radeon_bo *bo);
 #endif
diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
index 46146c6a2a06..8bce64cdc320 100644
--- a/drivers/gpu/drm/radeon/radeon_pm.c
+++ b/drivers/gpu/drm/radeon/radeon_pm.c
@@ -27,7 +27,7 @@ int radeon_debugfs_pm_init(struct radeon_device *rdev);
 int radeon_pm_init(struct radeon_device *rdev)
 {
 	if (radeon_debugfs_pm_init(rdev)) {
-		DRM_ERROR("Failed to register debugfs file for CP !\n");
+		DRM_ERROR("Failed to register debugfs file for PM!\n");
 	}
 
 	return 0;
@@ -44,8 +44,11 @@ static int radeon_debugfs_pm_info(struct seq_file *m, void *data)
 	struct drm_device *dev = node->minor->dev;
 	struct radeon_device *rdev = dev->dev_private;
 
-	seq_printf(m, "engine clock: %u0 Hz\n", radeon_get_engine_clock(rdev));
-	seq_printf(m, "memory clock: %u0 Hz\n", radeon_get_memory_clock(rdev));
+	seq_printf(m, "default engine clock: %u0 kHz\n", rdev->clock.default_sclk);
+	seq_printf(m, "current engine clock: %u0 kHz\n", radeon_get_engine_clock(rdev));
+	seq_printf(m, "default memory clock: %u0 kHz\n", rdev->clock.default_mclk);
+	if (rdev->asic->get_memory_clock)
+		seq_printf(m, "current memory clock: %u0 kHz\n", radeon_get_memory_clock(rdev));
 
 	return 0;
 }
diff --git a/drivers/gpu/drm/radeon/radeon_reg.h b/drivers/gpu/drm/radeon/radeon_reg.h
index 29ab75903ec1..6d0a009dd4a1 100644
--- a/drivers/gpu/drm/radeon/radeon_reg.h
+++ b/drivers/gpu/drm/radeon/radeon_reg.h
@@ -887,6 +887,7 @@
 #       define RADEON_FP_PANEL_FORMAT          (1 <<  3)
 #       define RADEON_FP_EN_TMDS               (1 <<  7)
 #       define RADEON_FP_DETECT_SENSE          (1 <<  8)
+#       define RADEON_FP_DETECT_INT_POL        (1 <<  9)
 #       define R200_FP_SOURCE_SEL_MASK         (3 <<  10)
 #       define R200_FP_SOURCE_SEL_CRTC1        (0 <<  10)
 #       define R200_FP_SOURCE_SEL_CRTC2        (1 <<  10)
@@ -894,6 +895,7 @@
 #       define R200_FP_SOURCE_SEL_TRANS        (3 <<  10)
 #       define RADEON_FP_SEL_CRTC1             (0 << 13)
 #       define RADEON_FP_SEL_CRTC2             (1 << 13)
+#       define R300_HPD_SEL(x)                 ((x) << 13)
 #       define RADEON_FP_CRTC_DONT_SHADOW_HPAR (1 << 15)
 #       define RADEON_FP_CRTC_DONT_SHADOW_VPAR (1 << 16)
 #       define RADEON_FP_CRTC_DONT_SHADOW_HEND (1 << 17)
@@ -909,6 +911,7 @@
 #       define RADEON_FP2_ON                   (1 <<  2)
 #       define RADEON_FP2_PANEL_FORMAT         (1 <<  3)
 #       define RADEON_FP2_DETECT_SENSE         (1 <<  8)
+#       define RADEON_FP2_DETECT_INT_POL       (1 <<  9)
 #       define R200_FP2_SOURCE_SEL_MASK        (3 << 10)
 #       define R200_FP2_SOURCE_SEL_CRTC1       (0 << 10)
 #       define R200_FP2_SOURCE_SEL_CRTC2       (1 << 10)
@@ -988,14 +991,20 @@
 
 #define RADEON_GEN_INT_CNTL                 0x0040
 #	define RADEON_CRTC_VBLANK_MASK		(1 << 0)
+#	define RADEON_FP_DETECT_MASK		(1 << 4)
 #	define RADEON_CRTC2_VBLANK_MASK		(1 << 9)
+#	define RADEON_FP2_DETECT_MASK		(1 << 10)
 #	define RADEON_SW_INT_ENABLE		(1 << 25)
 #define RADEON_GEN_INT_STATUS               0x0044
 #	define AVIVO_DISPLAY_INT_STATUS		(1 << 0)
 #	define RADEON_CRTC_VBLANK_STAT		(1 << 0)
 #	define RADEON_CRTC_VBLANK_STAT_ACK	(1 << 0)
+#	define RADEON_FP_DETECT_STAT		(1 << 4)
+#	define RADEON_FP_DETECT_STAT_ACK	(1 << 4)
 #	define RADEON_CRTC2_VBLANK_STAT		(1 << 9)
 #	define RADEON_CRTC2_VBLANK_STAT_ACK	(1 << 9)
+#	define RADEON_FP2_DETECT_STAT		(1 << 10)
+#	define RADEON_FP2_DETECT_STAT_ACK	(1 << 10)
 #	define RADEON_SW_INT_FIRE		(1 << 26)
 #	define RADEON_SW_INT_TEST		(1 << 25)
 #	define RADEON_SW_INT_TEST_ACK		(1 << 25)
@@ -1051,20 +1060,25 @@
 
        /* Multimedia I2C bus */
 #define RADEON_I2C_CNTL_0		    0x0090
-#define RADEON_I2C_DONE (1<<0)
-#define RADEON_I2C_NACK (1<<1)
-#define RADEON_I2C_HALT (1<<2)
-#define RADEON_I2C_SOFT_RST (1<<5)
-#define RADEON_I2C_DRIVE_EN (1<<6)
-#define RADEON_I2C_DRIVE_SEL (1<<7)
-#define RADEON_I2C_START (1<<8)
-#define RADEON_I2C_STOP (1<<9)
-#define RADEON_I2C_RECEIVE (1<<10)
-#define RADEON_I2C_ABORT (1<<11)
-#define RADEON_I2C_GO (1<<12)
+#define RADEON_I2C_DONE                     (1 << 0)
+#define RADEON_I2C_NACK                     (1 << 1)
+#define RADEON_I2C_HALT                     (1 << 2)
+#define RADEON_I2C_SOFT_RST                 (1 << 5)
+#define RADEON_I2C_DRIVE_EN                 (1 << 6)
+#define RADEON_I2C_DRIVE_SEL                (1 << 7)
+#define RADEON_I2C_START                    (1 << 8)
+#define RADEON_I2C_STOP                     (1 << 9)
+#define RADEON_I2C_RECEIVE                  (1 << 10)
+#define RADEON_I2C_ABORT                    (1 << 11)
+#define RADEON_I2C_GO                       (1 << 12)
+#define RADEON_I2C_PRESCALE_SHIFT           16
 #define RADEON_I2C_CNTL_1                   0x0094
-#define RADEON_I2C_SEL         (1<<16)
-#define RADEON_I2C_EN          (1<<17)
+#define RADEON_I2C_DATA_COUNT_SHIFT         0
+#define RADEON_I2C_ADDR_COUNT_SHIFT         4
+#define RADEON_I2C_INTRA_BYTE_DELAY_SHIFT   8
+#define RADEON_I2C_SEL                      (1 << 16)
+#define RADEON_I2C_EN                       (1 << 17)
+#define RADEON_I2C_TIME_LIMIT_SHIFT         24
 #define RADEON_I2C_DATA			    0x0098
 
 #define RADEON_DVI_I2C_CNTL_0		    0x02e0
@@ -1072,7 +1086,7 @@
 #       define R200_SEL_DDC1                0 /* 0x60 - VGA_DDC */
 #       define R200_SEL_DDC2                1 /* 0x64 - DVI_DDC */
 #       define R200_SEL_DDC3                2 /* 0x68 - MONID_DDC */
-#define RADEON_DVI_I2C_CNTL_1               0x02e4 /* ? */
+#define RADEON_DVI_I2C_CNTL_1               0x02e4
 #define RADEON_DVI_I2C_DATA		    0x02e8
 
 #define RADEON_INTERRUPT_LINE               0x0f3c /* PCI */
@@ -1143,15 +1157,16 @@
 #       define RADEON_IO_MCLK_MAX_DYN_STOP_LAT (1 << 13)
 #       define RADEON_MC_MCLK_DYN_ENABLE    (1 << 14)
 #       define RADEON_IO_MCLK_DYN_ENABLE    (1 << 15)
-#define RADEON_LCD_GPIO_MASK                0x01a0
-#define RADEON_GPIOPAD_EN                   0x01a0
-#define RADEON_LCD_GPIO_Y_REG               0x01a4
-#define RADEON_MDGPIO_A_REG                 0x01ac
-#define RADEON_MDGPIO_EN_REG                0x01b0
-#define RADEON_MDGPIO_MASK                  0x0198
+
 #define RADEON_GPIOPAD_MASK                 0x0198
 #define RADEON_GPIOPAD_A		    0x019c
-#define RADEON_MDGPIO_Y_REG                 0x01b4
+#define RADEON_GPIOPAD_EN                   0x01a0
+#define RADEON_GPIOPAD_Y                    0x01a4
+#define RADEON_MDGPIO_MASK                  0x01a8
+#define RADEON_MDGPIO_A                     0x01ac
+#define RADEON_MDGPIO_EN                    0x01b0
+#define RADEON_MDGPIO_Y                     0x01b4
+
 #define RADEON_MEM_ADDR_CONFIG              0x0148
 #define RADEON_MEM_BASE                     0x0f10 /* PCI */
 #define RADEON_MEM_CNTL                     0x0140
@@ -1360,6 +1375,9 @@
 #define RADEON_OVR_CLR                      0x0230
 #define RADEON_OVR_WID_LEFT_RIGHT           0x0234
 #define RADEON_OVR_WID_TOP_BOTTOM           0x0238
+#define RADEON_OVR2_CLR                     0x0330
+#define RADEON_OVR2_WID_LEFT_RIGHT          0x0334
+#define RADEON_OVR2_WID_TOP_BOTTOM          0x0338
 
 /* first capture unit */
 
diff --git a/drivers/gpu/drm/radeon/radeon_ring.c b/drivers/gpu/drm/radeon/radeon_ring.c
index 747b4bffb84b..4d12b2d17b4d 100644
--- a/drivers/gpu/drm/radeon/radeon_ring.c
+++ b/drivers/gpu/drm/radeon/radeon_ring.c
@@ -165,19 +165,24 @@ int radeon_ib_pool_init(struct radeon_device *rdev)
 		return 0;
 	/* Allocate 1M object buffer */
 	INIT_LIST_HEAD(&rdev->ib_pool.scheduled_ibs);
-	r = radeon_object_create(rdev, NULL,  RADEON_IB_POOL_SIZE*64*1024,
-				 true, RADEON_GEM_DOMAIN_GTT,
-				 false, &rdev->ib_pool.robj);
+	r = radeon_bo_create(rdev, NULL,  RADEON_IB_POOL_SIZE*64*1024,
+				true, RADEON_GEM_DOMAIN_GTT,
+				&rdev->ib_pool.robj);
 	if (r) {
 		DRM_ERROR("radeon: failed to ib pool (%d).\n", r);
 		return r;
 	}
-	r = radeon_object_pin(rdev->ib_pool.robj, RADEON_GEM_DOMAIN_GTT, &gpu_addr);
+	r = radeon_bo_reserve(rdev->ib_pool.robj, false);
+	if (unlikely(r != 0))
+		return r;
+	r = radeon_bo_pin(rdev->ib_pool.robj, RADEON_GEM_DOMAIN_GTT, &gpu_addr);
 	if (r) {
+		radeon_bo_unreserve(rdev->ib_pool.robj);
 		DRM_ERROR("radeon: failed to pin ib pool (%d).\n", r);
 		return r;
 	}
-	r = radeon_object_kmap(rdev->ib_pool.robj, &ptr);
+	r = radeon_bo_kmap(rdev->ib_pool.robj, &ptr);
+	radeon_bo_unreserve(rdev->ib_pool.robj);
 	if (r) {
 		DRM_ERROR("radeon: failed to map ib poll (%d).\n", r);
 		return r;
@@ -203,14 +208,21 @@ int radeon_ib_pool_init(struct radeon_device *rdev)
 
 void radeon_ib_pool_fini(struct radeon_device *rdev)
 {
+	int r;
+
 	if (!rdev->ib_pool.ready) {
 		return;
 	}
 	mutex_lock(&rdev->ib_pool.mutex);
 	bitmap_zero(rdev->ib_pool.alloc_bm, RADEON_IB_POOL_SIZE);
 	if (rdev->ib_pool.robj) {
-		radeon_object_kunmap(rdev->ib_pool.robj);
-		radeon_object_unref(&rdev->ib_pool.robj);
+		r = radeon_bo_reserve(rdev->ib_pool.robj, false);
+		if (likely(r == 0)) {
+			radeon_bo_kunmap(rdev->ib_pool.robj);
+			radeon_bo_unpin(rdev->ib_pool.robj);
+			radeon_bo_unreserve(rdev->ib_pool.robj);
+		}
+		radeon_bo_unref(&rdev->ib_pool.robj);
 		rdev->ib_pool.robj = NULL;
 	}
 	mutex_unlock(&rdev->ib_pool.mutex);
@@ -288,29 +300,28 @@ int radeon_ring_init(struct radeon_device *rdev, unsigned ring_size)
 	rdev->cp.ring_size = ring_size;
 	/* Allocate ring buffer */
 	if (rdev->cp.ring_obj == NULL) {
-		r = radeon_object_create(rdev, NULL, rdev->cp.ring_size,
-					 true,
-					 RADEON_GEM_DOMAIN_GTT,
-					 false,
-					 &rdev->cp.ring_obj);
+		r = radeon_bo_create(rdev, NULL, rdev->cp.ring_size, true,
+					RADEON_GEM_DOMAIN_GTT,
+					&rdev->cp.ring_obj);
 		if (r) {
-			DRM_ERROR("radeon: failed to create ring buffer (%d).\n", r);
-			mutex_unlock(&rdev->cp.mutex);
+			dev_err(rdev->dev, "(%d) ring create failed\n", r);
 			return r;
 		}
-		r = radeon_object_pin(rdev->cp.ring_obj,
-				      RADEON_GEM_DOMAIN_GTT,
-				      &rdev->cp.gpu_addr);
+		r = radeon_bo_reserve(rdev->cp.ring_obj, false);
+		if (unlikely(r != 0))
+			return r;
+		r = radeon_bo_pin(rdev->cp.ring_obj, RADEON_GEM_DOMAIN_GTT,
+					&rdev->cp.gpu_addr);
 		if (r) {
-			DRM_ERROR("radeon: failed to pin ring buffer (%d).\n", r);
-			mutex_unlock(&rdev->cp.mutex);
+			radeon_bo_unreserve(rdev->cp.ring_obj);
+			dev_err(rdev->dev, "(%d) ring pin failed\n", r);
 			return r;
 		}
-		r = radeon_object_kmap(rdev->cp.ring_obj,
+		r = radeon_bo_kmap(rdev->cp.ring_obj,
 				       (void **)&rdev->cp.ring);
+		radeon_bo_unreserve(rdev->cp.ring_obj);
 		if (r) {
-			DRM_ERROR("radeon: failed to map ring buffer (%d).\n", r);
-			mutex_unlock(&rdev->cp.mutex);
+			dev_err(rdev->dev, "(%d) ring map failed\n", r);
 			return r;
 		}
 	}
@@ -321,11 +332,17 @@ int radeon_ring_init(struct radeon_device *rdev, unsigned ring_size)
 
 void radeon_ring_fini(struct radeon_device *rdev)
 {
+	int r;
+
 	mutex_lock(&rdev->cp.mutex);
 	if (rdev->cp.ring_obj) {
-		radeon_object_kunmap(rdev->cp.ring_obj);
-		radeon_object_unpin(rdev->cp.ring_obj);
-		radeon_object_unref(&rdev->cp.ring_obj);
+		r = radeon_bo_reserve(rdev->cp.ring_obj, false);
+		if (likely(r == 0)) {
+			radeon_bo_kunmap(rdev->cp.ring_obj);
+			radeon_bo_unpin(rdev->cp.ring_obj);
+			radeon_bo_unreserve(rdev->cp.ring_obj);
+		}
+		radeon_bo_unref(&rdev->cp.ring_obj);
 		rdev->cp.ring = NULL;
 		rdev->cp.ring_obj = NULL;
 	}
diff --git a/drivers/gpu/drm/radeon/radeon_state.c b/drivers/gpu/drm/radeon/radeon_state.c
index 38537d971a3e..067167cb39ca 100644
--- a/drivers/gpu/drm/radeon/radeon_state.c
+++ b/drivers/gpu/drm/radeon/radeon_state.c
@@ -1950,7 +1950,7 @@ static void radeon_apply_surface_regs(int surf_index,
  * Note that refcount can be at most 2, since during a free refcount=3
  * might mean we have to allocate a new surface which might not always
  * be available.
- * For example : we allocate three contigous surfaces ABC. If B is
+ * For example : we allocate three contiguous surfaces ABC. If B is
  * freed, we suddenly need two surfaces to store A and C, which might
  * not always be available.
  */
diff --git a/drivers/gpu/drm/radeon/radeon_test.c b/drivers/gpu/drm/radeon/radeon_test.c
index f8a465d9a1cf..9f5e2f929da9 100644
--- a/drivers/gpu/drm/radeon/radeon_test.c
+++ b/drivers/gpu/drm/radeon/radeon_test.c
@@ -30,8 +30,8 @@
 /* Test BO GTT->VRAM and VRAM->GTT GPU copies across the whole GTT aperture */
 void radeon_test_moves(struct radeon_device *rdev)
 {
-	struct radeon_object *vram_obj = NULL;
-	struct radeon_object **gtt_obj = NULL;
+	struct radeon_bo *vram_obj = NULL;
+	struct radeon_bo **gtt_obj = NULL;
 	struct radeon_fence *fence = NULL;
 	uint64_t gtt_addr, vram_addr;
 	unsigned i, n, size;
@@ -42,8 +42,8 @@ void radeon_test_moves(struct radeon_device *rdev)
 	/* Number of tests =
 	 * (Total GTT - IB pool - writeback page - ring buffer) / test size
 	 */
-	n = (rdev->mc.gtt_size - RADEON_IB_POOL_SIZE*64*1024 - RADEON_GPU_PAGE_SIZE -
-	     rdev->cp.ring_size) / size;
+	n = ((u32)(rdev->mc.gtt_size - RADEON_IB_POOL_SIZE*64*1024 - RADEON_GPU_PAGE_SIZE -
+	     rdev->cp.ring_size)) / size;
 
 	gtt_obj = kzalloc(n * sizeof(*gtt_obj), GFP_KERNEL);
 	if (!gtt_obj) {
@@ -52,38 +52,42 @@ void radeon_test_moves(struct radeon_device *rdev)
 		goto out_cleanup;
 	}
 
-	r = radeon_object_create(rdev, NULL, size, true, RADEON_GEM_DOMAIN_VRAM,
-				 false, &vram_obj);
+	r = radeon_bo_create(rdev, NULL, size, true, RADEON_GEM_DOMAIN_VRAM,
+				&vram_obj);
 	if (r) {
 		DRM_ERROR("Failed to create VRAM object\n");
 		goto out_cleanup;
 	}
-
-	r = radeon_object_pin(vram_obj, RADEON_GEM_DOMAIN_VRAM, &vram_addr);
+	r = radeon_bo_reserve(vram_obj, false);
+	if (unlikely(r != 0))
+		goto out_cleanup;
+	r = radeon_bo_pin(vram_obj, RADEON_GEM_DOMAIN_VRAM, &vram_addr);
 	if (r) {
 		DRM_ERROR("Failed to pin VRAM object\n");
 		goto out_cleanup;
 	}
-
 	for (i = 0; i < n; i++) {
 		void *gtt_map, *vram_map;
 		void **gtt_start, **gtt_end;
 		void **vram_start, **vram_end;
 
-		r = radeon_object_create(rdev, NULL, size, true,
-					 RADEON_GEM_DOMAIN_GTT, false, gtt_obj + i);
+		r = radeon_bo_create(rdev, NULL, size, true,
+					 RADEON_GEM_DOMAIN_GTT, gtt_obj + i);
 		if (r) {
 			DRM_ERROR("Failed to create GTT object %d\n", i);
 			goto out_cleanup;
 		}
 
-		r = radeon_object_pin(gtt_obj[i], RADEON_GEM_DOMAIN_GTT, &gtt_addr);
+		r = radeon_bo_reserve(gtt_obj[i], false);
+		if (unlikely(r != 0))
+			goto out_cleanup;
+		r = radeon_bo_pin(gtt_obj[i], RADEON_GEM_DOMAIN_GTT, &gtt_addr);
 		if (r) {
 			DRM_ERROR("Failed to pin GTT object %d\n", i);
 			goto out_cleanup;
 		}
 
-		r = radeon_object_kmap(gtt_obj[i], &gtt_map);
+		r = radeon_bo_kmap(gtt_obj[i], &gtt_map);
 		if (r) {
 			DRM_ERROR("Failed to map GTT object %d\n", i);
 			goto out_cleanup;
@@ -94,7 +98,7 @@ void radeon_test_moves(struct radeon_device *rdev)
 		     gtt_start++)
 			*gtt_start = gtt_start;
 
-		radeon_object_kunmap(gtt_obj[i]);
+		radeon_bo_kunmap(gtt_obj[i]);
 
 		r = radeon_fence_create(rdev, &fence);
 		if (r) {
@@ -116,7 +120,7 @@ void radeon_test_moves(struct radeon_device *rdev)
 
 		radeon_fence_unref(&fence);
 
-		r = radeon_object_kmap(vram_obj, &vram_map);
+		r = radeon_bo_kmap(vram_obj, &vram_map);
 		if (r) {
 			DRM_ERROR("Failed to map VRAM object after copy %d\n", i);
 			goto out_cleanup;
@@ -131,13 +135,13 @@ void radeon_test_moves(struct radeon_device *rdev)
 					  "expected 0x%p (GTT map 0x%p-0x%p)\n",
 					  i, *vram_start, gtt_start, gtt_map,
 					  gtt_end);
-				radeon_object_kunmap(vram_obj);
+				radeon_bo_kunmap(vram_obj);
 				goto out_cleanup;
 			}
 			*vram_start = vram_start;
 		}
 
-		radeon_object_kunmap(vram_obj);
+		radeon_bo_kunmap(vram_obj);
 
 		r = radeon_fence_create(rdev, &fence);
 		if (r) {
@@ -159,7 +163,7 @@ void radeon_test_moves(struct radeon_device *rdev)
 
 		radeon_fence_unref(&fence);
 
-		r = radeon_object_kmap(gtt_obj[i], &gtt_map);
+		r = radeon_bo_kmap(gtt_obj[i], &gtt_map);
 		if (r) {
 			DRM_ERROR("Failed to map GTT object after copy %d\n", i);
 			goto out_cleanup;
@@ -174,12 +178,12 @@ void radeon_test_moves(struct radeon_device *rdev)
 					  "expected 0x%p (VRAM map 0x%p-0x%p)\n",
 					  i, *gtt_start, vram_start, vram_map,
 					  vram_end);
-				radeon_object_kunmap(gtt_obj[i]);
+				radeon_bo_kunmap(gtt_obj[i]);
 				goto out_cleanup;
 			}
 		}
 
-		radeon_object_kunmap(gtt_obj[i]);
+		radeon_bo_kunmap(gtt_obj[i]);
 
 		DRM_INFO("Tested GTT->VRAM and VRAM->GTT copy for GTT offset 0x%llx\n",
 			 gtt_addr - rdev->mc.gtt_location);
@@ -187,14 +191,20 @@ void radeon_test_moves(struct radeon_device *rdev)
 
 out_cleanup:
 	if (vram_obj) {
-		radeon_object_unpin(vram_obj);
-		radeon_object_unref(&vram_obj);
+		if (radeon_bo_is_reserved(vram_obj)) {
+			radeon_bo_unpin(vram_obj);
+			radeon_bo_unreserve(vram_obj);
+		}
+		radeon_bo_unref(&vram_obj);
 	}
 	if (gtt_obj) {
 		for (i = 0; i < n; i++) {
 			if (gtt_obj[i]) {
-				radeon_object_unpin(gtt_obj[i]);
-				radeon_object_unref(&gtt_obj[i]);
+				if (radeon_bo_is_reserved(gtt_obj[i])) {
+					radeon_bo_unpin(gtt_obj[i]);
+					radeon_bo_unreserve(gtt_obj[i]);
+				}
+				radeon_bo_unref(&gtt_obj[i]);
 			}
 		}
 		kfree(gtt_obj);
@@ -206,4 +216,3 @@ out_cleanup:
 		printk(KERN_WARNING "Error while testing BO move.\n");
 	}
 }
-
diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
index 1381e06d6af3..58b5adf974ca 100644
--- a/drivers/gpu/drm/radeon/radeon_ttm.c
+++ b/drivers/gpu/drm/radeon/radeon_ttm.c
@@ -150,7 +150,7 @@ static int radeon_init_mem_type(struct ttm_bo_device *bdev, uint32_t type,
 		man->default_caching = TTM_PL_FLAG_CACHED;
 		break;
 	case TTM_PL_TT:
-		man->gpu_offset = 0;
+		man->gpu_offset = rdev->mc.gtt_location;
 		man->available_caching = TTM_PL_MASK_CACHING;
 		man->default_caching = TTM_PL_FLAG_CACHED;
 		man->flags = TTM_MEMTYPE_FLAG_MAPPABLE | TTM_MEMTYPE_FLAG_CMA;
@@ -180,7 +180,7 @@ static int radeon_init_mem_type(struct ttm_bo_device *bdev, uint32_t type,
 		break;
 	case TTM_PL_VRAM:
 		/* "On-card" video ram */
-		man->gpu_offset = 0;
+		man->gpu_offset = rdev->mc.vram_location;
 		man->flags = TTM_MEMTYPE_FLAG_FIXED |
 			     TTM_MEMTYPE_FLAG_NEEDS_IOREMAP |
 			     TTM_MEMTYPE_FLAG_MAPPABLE;
@@ -197,16 +197,34 @@ static int radeon_init_mem_type(struct ttm_bo_device *bdev, uint32_t type,
 	return 0;
 }
 
-static uint32_t radeon_evict_flags(struct ttm_buffer_object *bo)
+static void radeon_evict_flags(struct ttm_buffer_object *bo,
+				struct ttm_placement *placement)
 {
-	uint32_t cur_placement = bo->mem.placement & ~TTM_PL_MASK_MEMTYPE;
+	struct radeon_bo *rbo;
+	static u32 placements = TTM_PL_MASK_CACHING | TTM_PL_FLAG_SYSTEM;
 
+	if (!radeon_ttm_bo_is_radeon_bo(bo)) {
+		placement->fpfn = 0;
+		placement->lpfn = 0;
+		placement->placement = &placements;
+		placement->busy_placement = &placements;
+		placement->num_placement = 1;
+		placement->num_busy_placement = 1;
+		return;
+	}
+	rbo = container_of(bo, struct radeon_bo, tbo);
 	switch (bo->mem.mem_type) {
+	case TTM_PL_VRAM:
+		if (rbo->rdev->cp.ready == false)
+			radeon_ttm_placement_from_domain(rbo, RADEON_GEM_DOMAIN_CPU);
+		else
+			radeon_ttm_placement_from_domain(rbo, RADEON_GEM_DOMAIN_GTT);
+		break;
+	case TTM_PL_TT:
 	default:
-		return (cur_placement & ~TTM_PL_MASK_CACHING) |
-			TTM_PL_FLAG_SYSTEM |
-			TTM_PL_FLAG_CACHED;
+		radeon_ttm_placement_from_domain(rbo, RADEON_GEM_DOMAIN_CPU);
 	}
+	*placement = rbo->placement;
 }
 
 static int radeon_verify_access(struct ttm_buffer_object *bo, struct file *filp)
@@ -283,14 +301,21 @@ static int radeon_move_vram_ram(struct ttm_buffer_object *bo,
 	struct radeon_device *rdev;
 	struct ttm_mem_reg *old_mem = &bo->mem;
 	struct ttm_mem_reg tmp_mem;
-	uint32_t proposed_placement;
+	u32 placements;
+	struct ttm_placement placement;
 	int r;
 
 	rdev = radeon_get_rdev(bo->bdev);
 	tmp_mem = *new_mem;
 	tmp_mem.mm_node = NULL;
-	proposed_placement = TTM_PL_FLAG_TT | TTM_PL_MASK_CACHING;
-	r = ttm_bo_mem_space(bo, proposed_placement, &tmp_mem,
+	placement.fpfn = 0;
+	placement.lpfn = 0;
+	placement.num_placement = 1;
+	placement.placement = &placements;
+	placement.num_busy_placement = 1;
+	placement.busy_placement = &placements;
+	placements = TTM_PL_MASK_CACHING | TTM_PL_FLAG_TT;
+	r = ttm_bo_mem_space(bo, &placement, &tmp_mem,
 			     interruptible, no_wait);
 	if (unlikely(r)) {
 		return r;
@@ -329,15 +354,21 @@ static int radeon_move_ram_vram(struct ttm_buffer_object *bo,
 	struct radeon_device *rdev;
 	struct ttm_mem_reg *old_mem = &bo->mem;
 	struct ttm_mem_reg tmp_mem;
-	uint32_t proposed_flags;
+	struct ttm_placement placement;
+	u32 placements;
 	int r;
 
 	rdev = radeon_get_rdev(bo->bdev);
 	tmp_mem = *new_mem;
 	tmp_mem.mm_node = NULL;
-	proposed_flags = TTM_PL_FLAG_TT | TTM_PL_MASK_CACHING;
-	r = ttm_bo_mem_space(bo, proposed_flags, &tmp_mem,
-			     interruptible, no_wait);
+	placement.fpfn = 0;
+	placement.lpfn = 0;
+	placement.num_placement = 1;
+	placement.placement = &placements;
+	placement.num_busy_placement = 1;
+	placement.busy_placement = &placements;
+	placements = TTM_PL_MASK_CACHING | TTM_PL_FLAG_TT;
+	r = ttm_bo_mem_space(bo, &placement, &tmp_mem, interruptible, no_wait);
 	if (unlikely(r)) {
 		return r;
 	}
@@ -378,7 +409,7 @@ static int radeon_bo_move(struct ttm_buffer_object *bo,
 	     new_mem->mem_type == TTM_PL_SYSTEM) ||
 	    (old_mem->mem_type == TTM_PL_SYSTEM &&
 	     new_mem->mem_type == TTM_PL_TT)) {
-		/* bind is enought */
+		/* bind is enough */
 		radeon_move_null(bo, new_mem);
 		return 0;
 	}
@@ -407,18 +438,6 @@ memcpy:
 	return r;
 }
 
-const uint32_t radeon_mem_prios[] = {
-	TTM_PL_VRAM,
-	TTM_PL_TT,
-	TTM_PL_SYSTEM,
-};
-
-const uint32_t radeon_busy_prios[] = {
-	TTM_PL_TT,
-	TTM_PL_VRAM,
-	TTM_PL_SYSTEM,
-};
-
 static int radeon_sync_obj_wait(void *sync_obj, void *sync_arg,
 				bool lazy, bool interruptible)
 {
@@ -446,10 +465,6 @@ static bool radeon_sync_obj_signaled(void *sync_obj, void *sync_arg)
 }
 
 static struct ttm_bo_driver radeon_bo_driver = {
-	.mem_type_prio = radeon_mem_prios,
-	.mem_busy_prio = radeon_busy_prios,
-	.num_mem_type_prio = ARRAY_SIZE(radeon_mem_prios),
-	.num_mem_busy_prio = ARRAY_SIZE(radeon_busy_prios),
 	.create_ttm_backend_entry = &radeon_create_ttm_backend_entry,
 	.invalidate_caches = &radeon_invalidate_caches,
 	.init_mem_type = &radeon_init_mem_type,
@@ -482,27 +497,32 @@ int radeon_ttm_init(struct radeon_device *rdev)
 		DRM_ERROR("failed initializing buffer object driver(%d).\n", r);
 		return r;
 	}
-	r = ttm_bo_init_mm(&rdev->mman.bdev, TTM_PL_VRAM, 0,
-			   ((rdev->mc.real_vram_size) >> PAGE_SHIFT));
+	rdev->mman.initialized = true;
+	r = ttm_bo_init_mm(&rdev->mman.bdev, TTM_PL_VRAM,
+				rdev->mc.real_vram_size >> PAGE_SHIFT);
 	if (r) {
 		DRM_ERROR("Failed initializing VRAM heap.\n");
 		return r;
 	}
-	r = radeon_object_create(rdev, NULL, 256 * 1024, true,
-				 RADEON_GEM_DOMAIN_VRAM, false,
-				 &rdev->stollen_vga_memory);
+	r = radeon_bo_create(rdev, NULL, 256 * 1024, true,
+				RADEON_GEM_DOMAIN_VRAM,
+				&rdev->stollen_vga_memory);
 	if (r) {
 		return r;
 	}
-	r = radeon_object_pin(rdev->stollen_vga_memory, RADEON_GEM_DOMAIN_VRAM, NULL);
+	r = radeon_bo_reserve(rdev->stollen_vga_memory, false);
+	if (r)
+		return r;
+	r = radeon_bo_pin(rdev->stollen_vga_memory, RADEON_GEM_DOMAIN_VRAM, NULL);
+	radeon_bo_unreserve(rdev->stollen_vga_memory);
 	if (r) {
-		radeon_object_unref(&rdev->stollen_vga_memory);
+		radeon_bo_unref(&rdev->stollen_vga_memory);
 		return r;
 	}
 	DRM_INFO("radeon: %uM of VRAM memory ready\n",
 		 (unsigned)rdev->mc.real_vram_size / (1024 * 1024));
-	r = ttm_bo_init_mm(&rdev->mman.bdev, TTM_PL_TT, 0,
-			   ((rdev->mc.gtt_size) >> PAGE_SHIFT));
+	r = ttm_bo_init_mm(&rdev->mman.bdev, TTM_PL_TT,
+				rdev->mc.gtt_size >> PAGE_SHIFT);
 	if (r) {
 		DRM_ERROR("Failed initializing GTT heap.\n");
 		return r;
@@ -523,15 +543,24 @@ int radeon_ttm_init(struct radeon_device *rdev)
 
 void radeon_ttm_fini(struct radeon_device *rdev)
 {
+	int r;
+
+	if (!rdev->mman.initialized)
+		return;
 	if (rdev->stollen_vga_memory) {
-		radeon_object_unpin(rdev->stollen_vga_memory);
-		radeon_object_unref(&rdev->stollen_vga_memory);
+		r = radeon_bo_reserve(rdev->stollen_vga_memory, false);
+		if (r == 0) {
+			radeon_bo_unpin(rdev->stollen_vga_memory);
+			radeon_bo_unreserve(rdev->stollen_vga_memory);
+		}
+		radeon_bo_unref(&rdev->stollen_vga_memory);
 	}
 	ttm_bo_clean_mm(&rdev->mman.bdev, TTM_PL_VRAM);
 	ttm_bo_clean_mm(&rdev->mman.bdev, TTM_PL_TT);
 	ttm_bo_device_release(&rdev->mman.bdev);
 	radeon_gart_fini(rdev);
 	radeon_ttm_global_fini(rdev);
+	rdev->mman.initialized = false;
 	DRM_INFO("radeon: ttm finalized\n");
 }
 
diff --git a/drivers/gpu/drm/radeon/reg_srcs/r420 b/drivers/gpu/drm/radeon/reg_srcs/r420
new file mode 100644
index 000000000000..989f7a020832
--- /dev/null
+++ b/drivers/gpu/drm/radeon/reg_srcs/r420
@@ -0,0 +1,795 @@
+r420 0x4f60
+0x1434 SRC_Y_X
+0x1438 DST_Y_X
+0x143C DST_HEIGHT_WIDTH
+0x146C DP_GUI_MASTER_CNTL
+0x1474 BRUSH_Y_X
+0x1478 DP_BRUSH_BKGD_CLR
+0x147C DP_BRUSH_FRGD_CLR
+0x1480 BRUSH_DATA0
+0x1484 BRUSH_DATA1
+0x1598 DST_WIDTH_HEIGHT
+0x15C0 CLR_CMP_CNTL
+0x15C4 CLR_CMP_CLR_SRC
+0x15C8 CLR_CMP_CLR_DST
+0x15CC CLR_CMP_MSK
+0x15D8 DP_SRC_FRGD_CLR
+0x15DC DP_SRC_BKGD_CLR
+0x1600 DST_LINE_START
+0x1604 DST_LINE_END
+0x1608 DST_LINE_PATCOUNT
+0x16C0 DP_CNTL
+0x16CC DP_WRITE_MSK
+0x16D0 DP_CNTL_XDIR_YDIR_YMAJOR
+0x16E8 DEFAULT_SC_BOTTOM_RIGHT
+0x16EC SC_TOP_LEFT
+0x16F0 SC_BOTTOM_RIGHT
+0x16F4 SRC_SC_BOTTOM_RIGHT
+0x1714 DSTCACHE_CTLSTAT
+0x1720 WAIT_UNTIL
+0x172C RBBM_GUICNTL
+0x1D98 VAP_VPORT_XSCALE
+0x1D9C VAP_VPORT_XOFFSET
+0x1DA0 VAP_VPORT_YSCALE
+0x1DA4 VAP_VPORT_YOFFSET
+0x1DA8 VAP_VPORT_ZSCALE
+0x1DAC VAP_VPORT_ZOFFSET
+0x2080 VAP_CNTL
+0x2090 VAP_OUT_VTX_FMT_0
+0x2094 VAP_OUT_VTX_FMT_1
+0x20B0 VAP_VTE_CNTL
+0x2138 VAP_VF_MIN_VTX_INDX
+0x2140 VAP_CNTL_STATUS
+0x2150 VAP_PROG_STREAM_CNTL_0
+0x2154 VAP_PROG_STREAM_CNTL_1
+0x2158 VAP_PROG_STREAM_CNTL_2
+0x215C VAP_PROG_STREAM_CNTL_3
+0x2160 VAP_PROG_STREAM_CNTL_4
+0x2164 VAP_PROG_STREAM_CNTL_5
+0x2168 VAP_PROG_STREAM_CNTL_6
+0x216C VAP_PROG_STREAM_CNTL_7
+0x2180 VAP_VTX_STATE_CNTL
+0x2184 VAP_VSM_VTX_ASSM
+0x2188 VAP_VTX_STATE_IND_REG_0
+0x218C VAP_VTX_STATE_IND_REG_1
+0x2190 VAP_VTX_STATE_IND_REG_2
+0x2194 VAP_VTX_STATE_IND_REG_3
+0x2198 VAP_VTX_STATE_IND_REG_4
+0x219C VAP_VTX_STATE_IND_REG_5
+0x21A0 VAP_VTX_STATE_IND_REG_6
+0x21A4 VAP_VTX_STATE_IND_REG_7
+0x21A8 VAP_VTX_STATE_IND_REG_8
+0x21AC VAP_VTX_STATE_IND_REG_9
+0x21B0 VAP_VTX_STATE_IND_REG_10
+0x21B4 VAP_VTX_STATE_IND_REG_11
+0x21B8 VAP_VTX_STATE_IND_REG_12
+0x21BC VAP_VTX_STATE_IND_REG_13
+0x21C0 VAP_VTX_STATE_IND_REG_14
+0x21C4 VAP_VTX_STATE_IND_REG_15
+0x21DC VAP_PSC_SGN_NORM_CNTL
+0x21E0 VAP_PROG_STREAM_CNTL_EXT_0
+0x21E4 VAP_PROG_STREAM_CNTL_EXT_1
+0x21E8 VAP_PROG_STREAM_CNTL_EXT_2
+0x21EC VAP_PROG_STREAM_CNTL_EXT_3
+0x21F0 VAP_PROG_STREAM_CNTL_EXT_4
+0x21F4 VAP_PROG_STREAM_CNTL_EXT_5
+0x21F8 VAP_PROG_STREAM_CNTL_EXT_6
+0x21FC VAP_PROG_STREAM_CNTL_EXT_7
+0x2200 VAP_PVS_VECTOR_INDX_REG
+0x2204 VAP_PVS_VECTOR_DATA_REG
+0x2208 VAP_PVS_VECTOR_DATA_REG_128
+0x221C VAP_CLIP_CNTL
+0x2220 VAP_GB_VERT_CLIP_ADJ
+0x2224 VAP_GB_VERT_DISC_ADJ
+0x2228 VAP_GB_HORZ_CLIP_ADJ
+0x222C VAP_GB_HORZ_DISC_ADJ
+0x2230 VAP_PVS_FLOW_CNTL_ADDRS_0
+0x2234 VAP_PVS_FLOW_CNTL_ADDRS_1
+0x2238 VAP_PVS_FLOW_CNTL_ADDRS_2
+0x223C VAP_PVS_FLOW_CNTL_ADDRS_3
+0x2240 VAP_PVS_FLOW_CNTL_ADDRS_4
+0x2244 VAP_PVS_FLOW_CNTL_ADDRS_5
+0x2248 VAP_PVS_FLOW_CNTL_ADDRS_6
+0x224C VAP_PVS_FLOW_CNTL_ADDRS_7
+0x2250 VAP_PVS_FLOW_CNTL_ADDRS_8
+0x2254 VAP_PVS_FLOW_CNTL_ADDRS_9
+0x2258 VAP_PVS_FLOW_CNTL_ADDRS_10
+0x225C VAP_PVS_FLOW_CNTL_ADDRS_11
+0x2260 VAP_PVS_FLOW_CNTL_ADDRS_12
+0x2264 VAP_PVS_FLOW_CNTL_ADDRS_13
+0x2268 VAP_PVS_FLOW_CNTL_ADDRS_14
+0x226C VAP_PVS_FLOW_CNTL_ADDRS_15
+0x2284 VAP_PVS_STATE_FLUSH_REG
+0x2288 VAP_PVS_VTX_TIMEOUT_REG
+0x2290 VAP_PVS_FLOW_CNTL_LOOP_INDEX_0
+0x2294 VAP_PVS_FLOW_CNTL_LOOP_INDEX_1
+0x2298 VAP_PVS_FLOW_CNTL_LOOP_INDEX_2
+0x229C VAP_PVS_FLOW_CNTL_LOOP_INDEX_3
+0x22A0 VAP_PVS_FLOW_CNTL_LOOP_INDEX_4
+0x22A4 VAP_PVS_FLOW_CNTL_LOOP_INDEX_5
+0x22A8 VAP_PVS_FLOW_CNTL_LOOP_INDEX_6
+0x22AC VAP_PVS_FLOW_CNTL_LOOP_INDEX_7
+0x22B0 VAP_PVS_FLOW_CNTL_LOOP_INDEX_8
+0x22B4 VAP_PVS_FLOW_CNTL_LOOP_INDEX_9
+0x22B8 VAP_PVS_FLOW_CNTL_LOOP_INDEX_10
+0x22BC VAP_PVS_FLOW_CNTL_LOOP_INDEX_11
+0x22C0 VAP_PVS_FLOW_CNTL_LOOP_INDEX_12
+0x22C4 VAP_PVS_FLOW_CNTL_LOOP_INDEX_13
+0x22C8 VAP_PVS_FLOW_CNTL_LOOP_INDEX_14
+0x22CC VAP_PVS_FLOW_CNTL_LOOP_INDEX_15
+0x22D0 VAP_PVS_CODE_CNTL_0
+0x22D4 VAP_PVS_CONST_CNTL
+0x22D8 VAP_PVS_CODE_CNTL_1
+0x22DC VAP_PVS_FLOW_CNTL_OPC
+0x342C RB2D_DSTCACHE_CTLSTAT
+0x4000 GB_VAP_RASTER_VTX_FMT_0
+0x4004 GB_VAP_RASTER_VTX_FMT_1
+0x4008 GB_ENABLE
+0x401C GB_SELECT
+0x4020 GB_AA_CONFIG
+0x4024 GB_FIFO_SIZE
+0x4100 TX_INVALTAGS
+0x4200 GA_POINT_S0
+0x4204 GA_POINT_T0
+0x4208 GA_POINT_S1
+0x420C GA_POINT_T1
+0x4214 GA_TRIANGLE_STIPPLE
+0x421C GA_POINT_SIZE
+0x4230 GA_POINT_MINMAX
+0x4234 GA_LINE_CNTL
+0x4238 GA_LINE_STIPPLE_CONFIG
+0x4260 GA_LINE_STIPPLE_VALUE
+0x4264 GA_LINE_S0
+0x4268 GA_LINE_S1
+0x4278 GA_COLOR_CONTROL
+0x427C GA_SOLID_RG
+0x4280 GA_SOLID_BA
+0x4288 GA_POLY_MODE
+0x428C GA_ROUND_MODE
+0x4290 GA_OFFSET
+0x4294 GA_FOG_SCALE
+0x4298 GA_FOG_OFFSET
+0x42A0 SU_TEX_WRAP
+0x42A4 SU_POLY_OFFSET_FRONT_SCALE
+0x42A8 SU_POLY_OFFSET_FRONT_OFFSET
+0x42AC SU_POLY_OFFSET_BACK_SCALE
+0x42B0 SU_POLY_OFFSET_BACK_OFFSET
+0x42B4 SU_POLY_OFFSET_ENABLE
+0x42B8 SU_CULL_MODE
+0x42C0 SU_DEPTH_SCALE
+0x42C4 SU_DEPTH_OFFSET
+0x42C8 SU_REG_DEST
+0x4300 RS_COUNT
+0x4304 RS_INST_COUNT
+0x4310 RS_IP_0
+0x4314 RS_IP_1
+0x4318 RS_IP_2
+0x431C RS_IP_3
+0x4320 RS_IP_4
+0x4324 RS_IP_5
+0x4328 RS_IP_6
+0x432C RS_IP_7
+0x4330 RS_INST_0
+0x4334 RS_INST_1
+0x4338 RS_INST_2
+0x433C RS_INST_3
+0x4340 RS_INST_4
+0x4344 RS_INST_5
+0x4348 RS_INST_6
+0x434C RS_INST_7
+0x4350 RS_INST_8
+0x4354 RS_INST_9
+0x4358 RS_INST_10
+0x435C RS_INST_11
+0x4360 RS_INST_12
+0x4364 RS_INST_13
+0x4368 RS_INST_14
+0x436C RS_INST_15
+0x43A4 SC_HYPERZ_EN
+0x43A8 SC_EDGERULE
+0x43B0 SC_CLIP_0_A
+0x43B4 SC_CLIP_0_B
+0x43B8 SC_CLIP_1_A
+0x43BC SC_CLIP_1_B
+0x43C0 SC_CLIP_2_A
+0x43C4 SC_CLIP_2_B
+0x43C8 SC_CLIP_3_A
+0x43CC SC_CLIP_3_B
+0x43D0 SC_CLIP_RULE
+0x43E0 SC_SCISSOR0
+0x43E8 SC_SCREENDOOR
+0x4440 TX_FILTER1_0
+0x4444 TX_FILTER1_1
+0x4448 TX_FILTER1_2
+0x444C TX_FILTER1_3
+0x4450 TX_FILTER1_4
+0x4454 TX_FILTER1_5
+0x4458 TX_FILTER1_6
+0x445C TX_FILTER1_7
+0x4460 TX_FILTER1_8
+0x4464 TX_FILTER1_9
+0x4468 TX_FILTER1_10
+0x446C TX_FILTER1_11
+0x4470 TX_FILTER1_12
+0x4474 TX_FILTER1_13
+0x4478 TX_FILTER1_14
+0x447C TX_FILTER1_15
+0x4580 TX_CHROMA_KEY_0
+0x4584 TX_CHROMA_KEY_1
+0x4588 TX_CHROMA_KEY_2
+0x458C TX_CHROMA_KEY_3
+0x4590 TX_CHROMA_KEY_4
+0x4594 TX_CHROMA_KEY_5
+0x4598 TX_CHROMA_KEY_6
+0x459C TX_CHROMA_KEY_7
+0x45A0 TX_CHROMA_KEY_8
+0x45A4 TX_CHROMA_KEY_9
+0x45A8 TX_CHROMA_KEY_10
+0x45AC TX_CHROMA_KEY_11
+0x45B0 TX_CHROMA_KEY_12
+0x45B4 TX_CHROMA_KEY_13
+0x45B8 TX_CHROMA_KEY_14
+0x45BC TX_CHROMA_KEY_15
+0x45C0 TX_BORDER_COLOR_0
+0x45C4 TX_BORDER_COLOR_1
+0x45C8 TX_BORDER_COLOR_2
+0x45CC TX_BORDER_COLOR_3
+0x45D0 TX_BORDER_COLOR_4
+0x45D4 TX_BORDER_COLOR_5
+0x45D8 TX_BORDER_COLOR_6
+0x45DC TX_BORDER_COLOR_7
+0x45E0 TX_BORDER_COLOR_8
+0x45E4 TX_BORDER_COLOR_9
+0x45E8 TX_BORDER_COLOR_10
+0x45EC TX_BORDER_COLOR_11
+0x45F0 TX_BORDER_COLOR_12
+0x45F4 TX_BORDER_COLOR_13
+0x45F8 TX_BORDER_COLOR_14
+0x45FC TX_BORDER_COLOR_15
+0x4600 US_CONFIG
+0x4604 US_PIXSIZE
+0x4608 US_CODE_OFFSET
+0x460C US_RESET
+0x4610 US_CODE_ADDR_0
+0x4614 US_CODE_ADDR_1
+0x4618 US_CODE_ADDR_2
+0x461C US_CODE_ADDR_3
+0x4620 US_TEX_INST_0
+0x4624 US_TEX_INST_1
+0x4628 US_TEX_INST_2
+0x462C US_TEX_INST_3
+0x4630 US_TEX_INST_4
+0x4634 US_TEX_INST_5
+0x4638 US_TEX_INST_6
+0x463C US_TEX_INST_7
+0x4640 US_TEX_INST_8
+0x4644 US_TEX_INST_9
+0x4648 US_TEX_INST_10
+0x464C US_TEX_INST_11
+0x4650 US_TEX_INST_12
+0x4654 US_TEX_INST_13
+0x4658 US_TEX_INST_14
+0x465C US_TEX_INST_15
+0x4660 US_TEX_INST_16
+0x4664 US_TEX_INST_17
+0x4668 US_TEX_INST_18
+0x466C US_TEX_INST_19
+0x4670 US_TEX_INST_20
+0x4674 US_TEX_INST_21
+0x4678 US_TEX_INST_22
+0x467C US_TEX_INST_23
+0x4680 US_TEX_INST_24
+0x4684 US_TEX_INST_25
+0x4688 US_TEX_INST_26
+0x468C US_TEX_INST_27
+0x4690 US_TEX_INST_28
+0x4694 US_TEX_INST_29
+0x4698 US_TEX_INST_30
+0x469C US_TEX_INST_31
+0x46A4 US_OUT_FMT_0
+0x46A8 US_OUT_FMT_1
+0x46AC US_OUT_FMT_2
+0x46B0 US_OUT_FMT_3
+0x46B4 US_W_FMT
+0x46B8 US_CODE_BANK
+0x46BC US_CODE_EXT
+0x46C0 US_ALU_RGB_ADDR_0
+0x46C4 US_ALU_RGB_ADDR_1
+0x46C8 US_ALU_RGB_ADDR_2
+0x46CC US_ALU_RGB_ADDR_3
+0x46D0 US_ALU_RGB_ADDR_4
+0x46D4 US_ALU_RGB_ADDR_5
+0x46D8 US_ALU_RGB_ADDR_6
+0x46DC US_ALU_RGB_ADDR_7
+0x46E0 US_ALU_RGB_ADDR_8
+0x46E4 US_ALU_RGB_ADDR_9
+0x46E8 US_ALU_RGB_ADDR_10
+0x46EC US_ALU_RGB_ADDR_11
+0x46F0 US_ALU_RGB_ADDR_12
+0x46F4 US_ALU_RGB_ADDR_13
+0x46F8 US_ALU_RGB_ADDR_14
+0x46FC US_ALU_RGB_ADDR_15
+0x4700 US_ALU_RGB_ADDR_16
+0x4704 US_ALU_RGB_ADDR_17
+0x4708 US_ALU_RGB_ADDR_18
+0x470C US_ALU_RGB_ADDR_19
+0x4710 US_ALU_RGB_ADDR_20
+0x4714 US_ALU_RGB_ADDR_21
+0x4718 US_ALU_RGB_ADDR_22
+0x471C US_ALU_RGB_ADDR_23
+0x4720 US_ALU_RGB_ADDR_24
+0x4724 US_ALU_RGB_ADDR_25
+0x4728 US_ALU_RGB_ADDR_26
+0x472C US_ALU_RGB_ADDR_27
+0x4730 US_ALU_RGB_ADDR_28
+0x4734 US_ALU_RGB_ADDR_29
+0x4738 US_ALU_RGB_ADDR_30
+0x473C US_ALU_RGB_ADDR_31
+0x4740 US_ALU_RGB_ADDR_32
+0x4744 US_ALU_RGB_ADDR_33
+0x4748 US_ALU_RGB_ADDR_34
+0x474C US_ALU_RGB_ADDR_35
+0x4750 US_ALU_RGB_ADDR_36
+0x4754 US_ALU_RGB_ADDR_37
+0x4758 US_ALU_RGB_ADDR_38
+0x475C US_ALU_RGB_ADDR_39
+0x4760 US_ALU_RGB_ADDR_40
+0x4764 US_ALU_RGB_ADDR_41
+0x4768 US_ALU_RGB_ADDR_42
+0x476C US_ALU_RGB_ADDR_43
+0x4770 US_ALU_RGB_ADDR_44
+0x4774 US_ALU_RGB_ADDR_45
+0x4778 US_ALU_RGB_ADDR_46
+0x477C US_ALU_RGB_ADDR_47
+0x4780 US_ALU_RGB_ADDR_48
+0x4784 US_ALU_RGB_ADDR_49
+0x4788 US_ALU_RGB_ADDR_50
+0x478C US_ALU_RGB_ADDR_51
+0x4790 US_ALU_RGB_ADDR_52
+0x4794 US_ALU_RGB_ADDR_53
+0x4798 US_ALU_RGB_ADDR_54
+0x479C US_ALU_RGB_ADDR_55
+0x47A0 US_ALU_RGB_ADDR_56
+0x47A4 US_ALU_RGB_ADDR_57
+0x47A8 US_ALU_RGB_ADDR_58
+0x47AC US_ALU_RGB_ADDR_59
+0x47B0 US_ALU_RGB_ADDR_60
+0x47B4 US_ALU_RGB_ADDR_61
+0x47B8 US_ALU_RGB_ADDR_62
+0x47BC US_ALU_RGB_ADDR_63
+0x47C0 US_ALU_ALPHA_ADDR_0
+0x47C4 US_ALU_ALPHA_ADDR_1
+0x47C8 US_ALU_ALPHA_ADDR_2
+0x47CC US_ALU_ALPHA_ADDR_3
+0x47D0 US_ALU_ALPHA_ADDR_4
+0x47D4 US_ALU_ALPHA_ADDR_5
+0x47D8 US_ALU_ALPHA_ADDR_6
+0x47DC US_ALU_ALPHA_ADDR_7
+0x47E0 US_ALU_ALPHA_ADDR_8
+0x47E4 US_ALU_ALPHA_ADDR_9
+0x47E8 US_ALU_ALPHA_ADDR_10
+0x47EC US_ALU_ALPHA_ADDR_11
+0x47F0 US_ALU_ALPHA_ADDR_12
+0x47F4 US_ALU_ALPHA_ADDR_13
+0x47F8 US_ALU_ALPHA_ADDR_14
+0x47FC US_ALU_ALPHA_ADDR_15
+0x4800 US_ALU_ALPHA_ADDR_16
+0x4804 US_ALU_ALPHA_ADDR_17
+0x4808 US_ALU_ALPHA_ADDR_18
+0x480C US_ALU_ALPHA_ADDR_19
+0x4810 US_ALU_ALPHA_ADDR_20
+0x4814 US_ALU_ALPHA_ADDR_21
+0x4818 US_ALU_ALPHA_ADDR_22
+0x481C US_ALU_ALPHA_ADDR_23
+0x4820 US_ALU_ALPHA_ADDR_24
+0x4824 US_ALU_ALPHA_ADDR_25
+0x4828 US_ALU_ALPHA_ADDR_26
+0x482C US_ALU_ALPHA_ADDR_27
+0x4830 US_ALU_ALPHA_ADDR_28
+0x4834 US_ALU_ALPHA_ADDR_29
+0x4838 US_ALU_ALPHA_ADDR_30
+0x483C US_ALU_ALPHA_ADDR_31
+0x4840 US_ALU_ALPHA_ADDR_32
+0x4844 US_ALU_ALPHA_ADDR_33
+0x4848 US_ALU_ALPHA_ADDR_34
+0x484C US_ALU_ALPHA_ADDR_35
+0x4850 US_ALU_ALPHA_ADDR_36
+0x4854 US_ALU_ALPHA_ADDR_37
+0x4858 US_ALU_ALPHA_ADDR_38
+0x485C US_ALU_ALPHA_ADDR_39
+0x4860 US_ALU_ALPHA_ADDR_40
+0x4864 US_ALU_ALPHA_ADDR_41
+0x4868 US_ALU_ALPHA_ADDR_42
+0x486C US_ALU_ALPHA_ADDR_43
+0x4870 US_ALU_ALPHA_ADDR_44
+0x4874 US_ALU_ALPHA_ADDR_45
+0x4878 US_ALU_ALPHA_ADDR_46
+0x487C US_ALU_ALPHA_ADDR_47
+0x4880 US_ALU_ALPHA_ADDR_48
+0x4884 US_ALU_ALPHA_ADDR_49
+0x4888 US_ALU_ALPHA_ADDR_50
+0x488C US_ALU_ALPHA_ADDR_51
+0x4890 US_ALU_ALPHA_ADDR_52
+0x4894 US_ALU_ALPHA_ADDR_53
+0x4898 US_ALU_ALPHA_ADDR_54
+0x489C US_ALU_ALPHA_ADDR_55
+0x48A0 US_ALU_ALPHA_ADDR_56
+0x48A4 US_ALU_ALPHA_ADDR_57
+0x48A8 US_ALU_ALPHA_ADDR_58
+0x48AC US_ALU_ALPHA_ADDR_59
+0x48B0 US_ALU_ALPHA_ADDR_60
+0x48B4 US_ALU_ALPHA_ADDR_61
+0x48B8 US_ALU_ALPHA_ADDR_62
+0x48BC US_ALU_ALPHA_ADDR_63
+0x48C0 US_ALU_RGB_INST_0
+0x48C4 US_ALU_RGB_INST_1
+0x48C8 US_ALU_RGB_INST_2
+0x48CC US_ALU_RGB_INST_3
+0x48D0 US_ALU_RGB_INST_4
+0x48D4 US_ALU_RGB_INST_5
+0x48D8 US_ALU_RGB_INST_6
+0x48DC US_ALU_RGB_INST_7
+0x48E0 US_ALU_RGB_INST_8
+0x48E4 US_ALU_RGB_INST_9
+0x48E8 US_ALU_RGB_INST_10
+0x48EC US_ALU_RGB_INST_11
+0x48F0 US_ALU_RGB_INST_12
+0x48F4 US_ALU_RGB_INST_13
+0x48F8 US_ALU_RGB_INST_14
+0x48FC US_ALU_RGB_INST_15
+0x4900 US_ALU_RGB_INST_16
+0x4904 US_ALU_RGB_INST_17
+0x4908 US_ALU_RGB_INST_18
+0x490C US_ALU_RGB_INST_19
+0x4910 US_ALU_RGB_INST_20
+0x4914 US_ALU_RGB_INST_21
+0x4918 US_ALU_RGB_INST_22
+0x491C US_ALU_RGB_INST_23
+0x4920 US_ALU_RGB_INST_24
+0x4924 US_ALU_RGB_INST_25
+0x4928 US_ALU_RGB_INST_26
+0x492C US_ALU_RGB_INST_27
+0x4930 US_ALU_RGB_INST_28
+0x4934 US_ALU_RGB_INST_29
+0x4938 US_ALU_RGB_INST_30
+0x493C US_ALU_RGB_INST_31
+0x4940 US_ALU_RGB_INST_32
+0x4944 US_ALU_RGB_INST_33
+0x4948 US_ALU_RGB_INST_34
+0x494C US_ALU_RGB_INST_35
+0x4950 US_ALU_RGB_INST_36
+0x4954 US_ALU_RGB_INST_37
+0x4958 US_ALU_RGB_INST_38
+0x495C US_ALU_RGB_INST_39
+0x4960 US_ALU_RGB_INST_40
+0x4964 US_ALU_RGB_INST_41
+0x4968 US_ALU_RGB_INST_42
+0x496C US_ALU_RGB_INST_43
+0x4970 US_ALU_RGB_INST_44
+0x4974 US_ALU_RGB_INST_45
+0x4978 US_ALU_RGB_INST_46
+0x497C US_ALU_RGB_INST_47
+0x4980 US_ALU_RGB_INST_48
+0x4984 US_ALU_RGB_INST_49
+0x4988 US_ALU_RGB_INST_50
+0x498C US_ALU_RGB_INST_51
+0x4990 US_ALU_RGB_INST_52
+0x4994 US_ALU_RGB_INST_53
+0x4998 US_ALU_RGB_INST_54
+0x499C US_ALU_RGB_INST_55
+0x49A0 US_ALU_RGB_INST_56
+0x49A4 US_ALU_RGB_INST_57
+0x49A8 US_ALU_RGB_INST_58
+0x49AC US_ALU_RGB_INST_59
+0x49B0 US_ALU_RGB_INST_60
+0x49B4 US_ALU_RGB_INST_61
+0x49B8 US_ALU_RGB_INST_62
+0x49BC US_ALU_RGB_INST_63
+0x49C0 US_ALU_ALPHA_INST_0
+0x49C4 US_ALU_ALPHA_INST_1
+0x49C8 US_ALU_ALPHA_INST_2
+0x49CC US_ALU_ALPHA_INST_3
+0x49D0 US_ALU_ALPHA_INST_4
+0x49D4 US_ALU_ALPHA_INST_5
+0x49D8 US_ALU_ALPHA_INST_6
+0x49DC US_ALU_ALPHA_INST_7
+0x49E0 US_ALU_ALPHA_INST_8
+0x49E4 US_ALU_ALPHA_INST_9
+0x49E8 US_ALU_ALPHA_INST_10
+0x49EC US_ALU_ALPHA_INST_11
+0x49F0 US_ALU_ALPHA_INST_12
+0x49F4 US_ALU_ALPHA_INST_13
+0x49F8 US_ALU_ALPHA_INST_14
+0x49FC US_ALU_ALPHA_INST_15
+0x4A00 US_ALU_ALPHA_INST_16
+0x4A04 US_ALU_ALPHA_INST_17
+0x4A08 US_ALU_ALPHA_INST_18
+0x4A0C US_ALU_ALPHA_INST_19
+0x4A10 US_ALU_ALPHA_INST_20
+0x4A14 US_ALU_ALPHA_INST_21
+0x4A18 US_ALU_ALPHA_INST_22
+0x4A1C US_ALU_ALPHA_INST_23
+0x4A20 US_ALU_ALPHA_INST_24
+0x4A24 US_ALU_ALPHA_INST_25
+0x4A28 US_ALU_ALPHA_INST_26
+0x4A2C US_ALU_ALPHA_INST_27
+0x4A30 US_ALU_ALPHA_INST_28
+0x4A34 US_ALU_ALPHA_INST_29
+0x4A38 US_ALU_ALPHA_INST_30
+0x4A3C US_ALU_ALPHA_INST_31
+0x4A40 US_ALU_ALPHA_INST_32
+0x4A44 US_ALU_ALPHA_INST_33
+0x4A48 US_ALU_ALPHA_INST_34
+0x4A4C US_ALU_ALPHA_INST_35
+0x4A50 US_ALU_ALPHA_INST_36
+0x4A54 US_ALU_ALPHA_INST_37
+0x4A58 US_ALU_ALPHA_INST_38
+0x4A5C US_ALU_ALPHA_INST_39
+0x4A60 US_ALU_ALPHA_INST_40
+0x4A64 US_ALU_ALPHA_INST_41
+0x4A68 US_ALU_ALPHA_INST_42
+0x4A6C US_ALU_ALPHA_INST_43
+0x4A70 US_ALU_ALPHA_INST_44
+0x4A74 US_ALU_ALPHA_INST_45
+0x4A78 US_ALU_ALPHA_INST_46
+0x4A7C US_ALU_ALPHA_INST_47
+0x4A80 US_ALU_ALPHA_INST_48
+0x4A84 US_ALU_ALPHA_INST_49
+0x4A88 US_ALU_ALPHA_INST_50
+0x4A8C US_ALU_ALPHA_INST_51
+0x4A90 US_ALU_ALPHA_INST_52
+0x4A94 US_ALU_ALPHA_INST_53
+0x4A98 US_ALU_ALPHA_INST_54
+0x4A9C US_ALU_ALPHA_INST_55
+0x4AA0 US_ALU_ALPHA_INST_56
+0x4AA4 US_ALU_ALPHA_INST_57
+0x4AA8 US_ALU_ALPHA_INST_58
+0x4AAC US_ALU_ALPHA_INST_59
+0x4AB0 US_ALU_ALPHA_INST_60
+0x4AB4 US_ALU_ALPHA_INST_61
+0x4AB8 US_ALU_ALPHA_INST_62
+0x4ABC US_ALU_ALPHA_INST_63
+0x4AC0 US_ALU_EXT_ADDR_0
+0x4AC4 US_ALU_EXT_ADDR_1
+0x4AC8 US_ALU_EXT_ADDR_2
+0x4ACC US_ALU_EXT_ADDR_3
+0x4AD0 US_ALU_EXT_ADDR_4
+0x4AD4 US_ALU_EXT_ADDR_5
+0x4AD8 US_ALU_EXT_ADDR_6
+0x4ADC US_ALU_EXT_ADDR_7
+0x4AE0 US_ALU_EXT_ADDR_8
+0x4AE4 US_ALU_EXT_ADDR_9
+0x4AE8 US_ALU_EXT_ADDR_10
+0x4AEC US_ALU_EXT_ADDR_11
+0x4AF0 US_ALU_EXT_ADDR_12
+0x4AF4 US_ALU_EXT_ADDR_13
+0x4AF8 US_ALU_EXT_ADDR_14
+0x4AFC US_ALU_EXT_ADDR_15
+0x4B00 US_ALU_EXT_ADDR_16
+0x4B04 US_ALU_EXT_ADDR_17
+0x4B08 US_ALU_EXT_ADDR_18
+0x4B0C US_ALU_EXT_ADDR_19
+0x4B10 US_ALU_EXT_ADDR_20
+0x4B14 US_ALU_EXT_ADDR_21
+0x4B18 US_ALU_EXT_ADDR_22
+0x4B1C US_ALU_EXT_ADDR_23
+0x4B20 US_ALU_EXT_ADDR_24
+0x4B24 US_ALU_EXT_ADDR_25
+0x4B28 US_ALU_EXT_ADDR_26
+0x4B2C US_ALU_EXT_ADDR_27
+0x4B30 US_ALU_EXT_ADDR_28
+0x4B34 US_ALU_EXT_ADDR_29
+0x4B38 US_ALU_EXT_ADDR_30
+0x4B3C US_ALU_EXT_ADDR_31
+0x4B40 US_ALU_EXT_ADDR_32
+0x4B44 US_ALU_EXT_ADDR_33
+0x4B48 US_ALU_EXT_ADDR_34
+0x4B4C US_ALU_EXT_ADDR_35
+0x4B50 US_ALU_EXT_ADDR_36
+0x4B54 US_ALU_EXT_ADDR_37
+0x4B58 US_ALU_EXT_ADDR_38
+0x4B5C US_ALU_EXT_ADDR_39
+0x4B60 US_ALU_EXT_ADDR_40
+0x4B64 US_ALU_EXT_ADDR_41
+0x4B68 US_ALU_EXT_ADDR_42
+0x4B6C US_ALU_EXT_ADDR_43
+0x4B70 US_ALU_EXT_ADDR_44
+0x4B74 US_ALU_EXT_ADDR_45
+0x4B78 US_ALU_EXT_ADDR_46
+0x4B7C US_ALU_EXT_ADDR_47
+0x4B80 US_ALU_EXT_ADDR_48
+0x4B84 US_ALU_EXT_ADDR_49
+0x4B88 US_ALU_EXT_ADDR_50
+0x4B8C US_ALU_EXT_ADDR_51
+0x4B90 US_ALU_EXT_ADDR_52
+0x4B94 US_ALU_EXT_ADDR_53
+0x4B98 US_ALU_EXT_ADDR_54
+0x4B9C US_ALU_EXT_ADDR_55
+0x4BA0 US_ALU_EXT_ADDR_56
+0x4BA4 US_ALU_EXT_ADDR_57
+0x4BA8 US_ALU_EXT_ADDR_58
+0x4BAC US_ALU_EXT_ADDR_59
+0x4BB0 US_ALU_EXT_ADDR_60
+0x4BB4 US_ALU_EXT_ADDR_61
+0x4BB8 US_ALU_EXT_ADDR_62
+0x4BBC US_ALU_EXT_ADDR_63
+0x4BC0 FG_FOG_BLEND
+0x4BC4 FG_FOG_FACTOR
+0x4BC8 FG_FOG_COLOR_R
+0x4BCC FG_FOG_COLOR_G
+0x4BD0 FG_FOG_COLOR_B
+0x4BD4 FG_ALPHA_FUNC
+0x4BD8 FG_DEPTH_SRC
+0x4C00 US_ALU_CONST_R_0
+0x4C04 US_ALU_CONST_G_0
+0x4C08 US_ALU_CONST_B_0
+0x4C0C US_ALU_CONST_A_0
+0x4C10 US_ALU_CONST_R_1
+0x4C14 US_ALU_CONST_G_1
+0x4C18 US_ALU_CONST_B_1
+0x4C1C US_ALU_CONST_A_1
+0x4C20 US_ALU_CONST_R_2
+0x4C24 US_ALU_CONST_G_2
+0x4C28 US_ALU_CONST_B_2
+0x4C2C US_ALU_CONST_A_2
+0x4C30 US_ALU_CONST_R_3
+0x4C34 US_ALU_CONST_G_3
+0x4C38 US_ALU_CONST_B_3
+0x4C3C US_ALU_CONST_A_3
+0x4C40 US_ALU_CONST_R_4
+0x4C44 US_ALU_CONST_G_4
+0x4C48 US_ALU_CONST_B_4
+0x4C4C US_ALU_CONST_A_4
+0x4C50 US_ALU_CONST_R_5
+0x4C54 US_ALU_CONST_G_5
+0x4C58 US_ALU_CONST_B_5
+0x4C5C US_ALU_CONST_A_5
+0x4C60 US_ALU_CONST_R_6
+0x4C64 US_ALU_CONST_G_6
+0x4C68 US_ALU_CONST_B_6
+0x4C6C US_ALU_CONST_A_6
+0x4C70 US_ALU_CONST_R_7
+0x4C74 US_ALU_CONST_G_7
+0x4C78 US_ALU_CONST_B_7
+0x4C7C US_ALU_CONST_A_7
+0x4C80 US_ALU_CONST_R_8
+0x4C84 US_ALU_CONST_G_8
+0x4C88 US_ALU_CONST_B_8
+0x4C8C US_ALU_CONST_A_8
+0x4C90 US_ALU_CONST_R_9
+0x4C94 US_ALU_CONST_G_9
+0x4C98 US_ALU_CONST_B_9
+0x4C9C US_ALU_CONST_A_9
+0x4CA0 US_ALU_CONST_R_10
+0x4CA4 US_ALU_CONST_G_10
+0x4CA8 US_ALU_CONST_B_10
+0x4CAC US_ALU_CONST_A_10
+0x4CB0 US_ALU_CONST_R_11
+0x4CB4 US_ALU_CONST_G_11
+0x4CB8 US_ALU_CONST_B_11
+0x4CBC US_ALU_CONST_A_11
+0x4CC0 US_ALU_CONST_R_12
+0x4CC4 US_ALU_CONST_G_12
+0x4CC8 US_ALU_CONST_B_12
+0x4CCC US_ALU_CONST_A_12
+0x4CD0 US_ALU_CONST_R_13
+0x4CD4 US_ALU_CONST_G_13
+0x4CD8 US_ALU_CONST_B_13
+0x4CDC US_ALU_CONST_A_13
+0x4CE0 US_ALU_CONST_R_14
+0x4CE4 US_ALU_CONST_G_14
+0x4CE8 US_ALU_CONST_B_14
+0x4CEC US_ALU_CONST_A_14
+0x4CF0 US_ALU_CONST_R_15
+0x4CF4 US_ALU_CONST_G_15
+0x4CF8 US_ALU_CONST_B_15
+0x4CFC US_ALU_CONST_A_15
+0x4D00 US_ALU_CONST_R_16
+0x4D04 US_ALU_CONST_G_16
+0x4D08 US_ALU_CONST_B_16
+0x4D0C US_ALU_CONST_A_16
+0x4D10 US_ALU_CONST_R_17
+0x4D14 US_ALU_CONST_G_17
+0x4D18 US_ALU_CONST_B_17
+0x4D1C US_ALU_CONST_A_17
+0x4D20 US_ALU_CONST_R_18
+0x4D24 US_ALU_CONST_G_18
+0x4D28 US_ALU_CONST_B_18
+0x4D2C US_ALU_CONST_A_18
+0x4D30 US_ALU_CONST_R_19
+0x4D34 US_ALU_CONST_G_19
+0x4D38 US_ALU_CONST_B_19
+0x4D3C US_ALU_CONST_A_19
+0x4D40 US_ALU_CONST_R_20
+0x4D44 US_ALU_CONST_G_20
+0x4D48 US_ALU_CONST_B_20
+0x4D4C US_ALU_CONST_A_20
+0x4D50 US_ALU_CONST_R_21
+0x4D54 US_ALU_CONST_G_21
+0x4D58 US_ALU_CONST_B_21
+0x4D5C US_ALU_CONST_A_21
+0x4D60 US_ALU_CONST_R_22
+0x4D64 US_ALU_CONST_G_22
+0x4D68 US_ALU_CONST_B_22
+0x4D6C US_ALU_CONST_A_22
+0x4D70 US_ALU_CONST_R_23
+0x4D74 US_ALU_CONST_G_23
+0x4D78 US_ALU_CONST_B_23
+0x4D7C US_ALU_CONST_A_23
+0x4D80 US_ALU_CONST_R_24
+0x4D84 US_ALU_CONST_G_24
+0x4D88 US_ALU_CONST_B_24
+0x4D8C US_ALU_CONST_A_24
+0x4D90 US_ALU_CONST_R_25
+0x4D94 US_ALU_CONST_G_25
+0x4D98 US_ALU_CONST_B_25
+0x4D9C US_ALU_CONST_A_25
+0x4DA0 US_ALU_CONST_R_26
+0x4DA4 US_ALU_CONST_G_26
+0x4DA8 US_ALU_CONST_B_26
+0x4DAC US_ALU_CONST_A_26
+0x4DB0 US_ALU_CONST_R_27
+0x4DB4 US_ALU_CONST_G_27
+0x4DB8 US_ALU_CONST_B_27
+0x4DBC US_ALU_CONST_A_27
+0x4DC0 US_ALU_CONST_R_28
+0x4DC4 US_ALU_CONST_G_28
+0x4DC8 US_ALU_CONST_B_28
+0x4DCC US_ALU_CONST_A_28
+0x4DD0 US_ALU_CONST_R_29
+0x4DD4 US_ALU_CONST_G_29
+0x4DD8 US_ALU_CONST_B_29
+0x4DDC US_ALU_CONST_A_29
+0x4DE0 US_ALU_CONST_R_30
+0x4DE4 US_ALU_CONST_G_30
+0x4DE8 US_ALU_CONST_B_30
+0x4DEC US_ALU_CONST_A_30
+0x4DF0 US_ALU_CONST_R_31
+0x4DF4 US_ALU_CONST_G_31
+0x4DF8 US_ALU_CONST_B_31
+0x4DFC US_ALU_CONST_A_31
+0x4E04 RB3D_BLENDCNTL_R3
+0x4E08 RB3D_ABLENDCNTL_R3
+0x4E0C RB3D_COLOR_CHANNEL_MASK
+0x4E10 RB3D_CONSTANT_COLOR
+0x4E14 RB3D_COLOR_CLEAR_VALUE
+0x4E18 RB3D_ROPCNTL_R3
+0x4E1C RB3D_CLRCMP_FLIPE_R3
+0x4E20 RB3D_CLRCMP_CLR_R3
+0x4E24 RB3D_CLRCMP_MSK_R3
+0x4E48 RB3D_DEBUG_CTL
+0x4E4C RB3D_DSTCACHE_CTLSTAT_R3
+0x4E50 RB3D_DITHER_CTL
+0x4E54 RB3D_CMASK_OFFSET0
+0x4E58 RB3D_CMASK_OFFSET1
+0x4E5C RB3D_CMASK_OFFSET2
+0x4E60 RB3D_CMASK_OFFSET3
+0x4E64 RB3D_CMASK_PITCH0
+0x4E68 RB3D_CMASK_PITCH1
+0x4E6C RB3D_CMASK_PITCH2
+0x4E70 RB3D_CMASK_PITCH3
+0x4E74 RB3D_CMASK_WRINDEX
+0x4E78 RB3D_CMASK_DWORD
+0x4E7C RB3D_CMASK_RDINDEX
+0x4E80 RB3D_AARESOLVE_OFFSET
+0x4E84 RB3D_AARESOLVE_PITCH
+0x4E88 RB3D_AARESOLVE_CTL
+0x4EA0 RB3D_DISCARD_SRC_PIXEL_LTE_THRESHOLD
+0x4EA4 RB3D_DISCARD_SRC_PIXEL_GTE_THRESHOLD
+0x4F04 ZB_ZSTENCILCNTL
+0x4F08 ZB_STENCILREFMASK
+0x4F14 ZB_ZTOP
+0x4F18 ZB_ZCACHE_CTLSTAT
+0x4F1C ZB_BW_CNTL
+0x4F28 ZB_DEPTHCLEARVALUE
+0x4F30 ZB_ZMASK_OFFSET
+0x4F34 ZB_ZMASK_PITCH
+0x4F38 ZB_ZMASK_WRINDEX
+0x4F3C ZB_ZMASK_DWORD
+0x4F40 ZB_ZMASK_RDINDEX
+0x4F44 ZB_HIZ_OFFSET
+0x4F48 ZB_HIZ_WRINDEX
+0x4F4C ZB_HIZ_DWORD
+0x4F50 ZB_HIZ_RDINDEX
+0x4F54 ZB_HIZ_PITCH
+0x4F58 ZB_ZPASS_DATA
diff --git a/drivers/gpu/drm/radeon/reg_srcs/rs600 b/drivers/gpu/drm/radeon/reg_srcs/rs600
index 8e3c0b807add..6801b865d1c4 100644
--- a/drivers/gpu/drm/radeon/reg_srcs/rs600
+++ b/drivers/gpu/drm/radeon/reg_srcs/rs600
@@ -153,7 +153,7 @@ rs600 0x6d40
 0x42A4 SU_POLY_OFFSET_FRONT_SCALE
 0x42A8 SU_POLY_OFFSET_FRONT_OFFSET
 0x42AC SU_POLY_OFFSET_BACK_SCALE
-0x42B0 SU_POLY_OFFSET_BACK_OFFSET 
+0x42B0 SU_POLY_OFFSET_BACK_OFFSET
 0x42B4 SU_POLY_OFFSET_ENABLE
 0x42B8 SU_CULL_MODE
 0x42C0 SU_DEPTH_SCALE
@@ -291,6 +291,8 @@ rs600 0x6d40
 0x46AC US_OUT_FMT_2
 0x46B0 US_OUT_FMT_3
 0x46B4 US_W_FMT
+0x46B8 US_CODE_BANK
+0x46BC US_CODE_EXT
 0x46C0 US_ALU_RGB_ADDR_0
 0x46C4 US_ALU_RGB_ADDR_1
 0x46C8 US_ALU_RGB_ADDR_2
@@ -547,6 +549,70 @@ rs600 0x6d40
 0x4AB4 US_ALU_ALPHA_INST_61
 0x4AB8 US_ALU_ALPHA_INST_62
 0x4ABC US_ALU_ALPHA_INST_63
+0x4AC0 US_ALU_EXT_ADDR_0
+0x4AC4 US_ALU_EXT_ADDR_1
+0x4AC8 US_ALU_EXT_ADDR_2
+0x4ACC US_ALU_EXT_ADDR_3
+0x4AD0 US_ALU_EXT_ADDR_4
+0x4AD4 US_ALU_EXT_ADDR_5
+0x4AD8 US_ALU_EXT_ADDR_6
+0x4ADC US_ALU_EXT_ADDR_7
+0x4AE0 US_ALU_EXT_ADDR_8
+0x4AE4 US_ALU_EXT_ADDR_9
+0x4AE8 US_ALU_EXT_ADDR_10
+0x4AEC US_ALU_EXT_ADDR_11
+0x4AF0 US_ALU_EXT_ADDR_12
+0x4AF4 US_ALU_EXT_ADDR_13
+0x4AF8 US_ALU_EXT_ADDR_14
+0x4AFC US_ALU_EXT_ADDR_15
+0x4B00 US_ALU_EXT_ADDR_16
+0x4B04 US_ALU_EXT_ADDR_17
+0x4B08 US_ALU_EXT_ADDR_18
+0x4B0C US_ALU_EXT_ADDR_19
+0x4B10 US_ALU_EXT_ADDR_20
+0x4B14 US_ALU_EXT_ADDR_21
+0x4B18 US_ALU_EXT_ADDR_22
+0x4B1C US_ALU_EXT_ADDR_23
+0x4B20 US_ALU_EXT_ADDR_24
+0x4B24 US_ALU_EXT_ADDR_25
+0x4B28 US_ALU_EXT_ADDR_26
+0x4B2C US_ALU_EXT_ADDR_27
+0x4B30 US_ALU_EXT_ADDR_28
+0x4B34 US_ALU_EXT_ADDR_29
+0x4B38 US_ALU_EXT_ADDR_30
+0x4B3C US_ALU_EXT_ADDR_31
+0x4B40 US_ALU_EXT_ADDR_32
+0x4B44 US_ALU_EXT_ADDR_33
+0x4B48 US_ALU_EXT_ADDR_34
+0x4B4C US_ALU_EXT_ADDR_35
+0x4B50 US_ALU_EXT_ADDR_36
+0x4B54 US_ALU_EXT_ADDR_37
+0x4B58 US_ALU_EXT_ADDR_38
+0x4B5C US_ALU_EXT_ADDR_39
+0x4B60 US_ALU_EXT_ADDR_40
+0x4B64 US_ALU_EXT_ADDR_41
+0x4B68 US_ALU_EXT_ADDR_42
+0x4B6C US_ALU_EXT_ADDR_43
+0x4B70 US_ALU_EXT_ADDR_44
+0x4B74 US_ALU_EXT_ADDR_45
+0x4B78 US_ALU_EXT_ADDR_46
+0x4B7C US_ALU_EXT_ADDR_47
+0x4B80 US_ALU_EXT_ADDR_48
+0x4B84 US_ALU_EXT_ADDR_49
+0x4B88 US_ALU_EXT_ADDR_50
+0x4B8C US_ALU_EXT_ADDR_51
+0x4B90 US_ALU_EXT_ADDR_52
+0x4B94 US_ALU_EXT_ADDR_53
+0x4B98 US_ALU_EXT_ADDR_54
+0x4B9C US_ALU_EXT_ADDR_55
+0x4BA0 US_ALU_EXT_ADDR_56
+0x4BA4 US_ALU_EXT_ADDR_57
+0x4BA8 US_ALU_EXT_ADDR_58
+0x4BAC US_ALU_EXT_ADDR_59
+0x4BB0 US_ALU_EXT_ADDR_60
+0x4BB4 US_ALU_EXT_ADDR_61
+0x4BB8 US_ALU_EXT_ADDR_62
+0x4BBC US_ALU_EXT_ADDR_63
 0x4BC0 FG_FOG_BLEND
 0x4BC4 FG_FOG_FACTOR
 0x4BC8 FG_FOG_COLOR_R
diff --git a/drivers/gpu/drm/radeon/reg_srcs/rv515 b/drivers/gpu/drm/radeon/reg_srcs/rv515
index 0102a0d5735c..38abf63bf2cd 100644
--- a/drivers/gpu/drm/radeon/reg_srcs/rv515
+++ b/drivers/gpu/drm/radeon/reg_srcs/rv515
@@ -161,7 +161,12 @@ rv515 0x6d40
 0x401C GB_SELECT
 0x4020 GB_AA_CONFIG
 0x4024 GB_FIFO_SIZE
+0x4028 GB_Z_PEQ_CONFIG
 0x4100 TX_INVALTAGS
+0x4114 SU_TEX_WRAP_PS3
+0x4118 PS3_ENABLE
+0x411c PS3_VTX_FMT
+0x4120 PS3_TEX_SOURCE
 0x4200 GA_POINT_S0
 0x4204 GA_POINT_T0
 0x4208 GA_POINT_S1
@@ -171,6 +176,7 @@ rv515 0x6d40
 0x4230 GA_POINT_MINMAX
 0x4234 GA_LINE_CNTL
 0x4238 GA_LINE_STIPPLE_CONFIG
+0x4258 GA_COLOR_CONTROL_PS3
 0x4260 GA_LINE_STIPPLE_VALUE
 0x4264 GA_LINE_S0
 0x4268 GA_LINE_S1
diff --git a/drivers/gpu/drm/radeon/rs400.c b/drivers/gpu/drm/radeon/rs400.c
index ca037160a582..9f5418983e2a 100644
--- a/drivers/gpu/drm/radeon/rs400.c
+++ b/drivers/gpu/drm/radeon/rs400.c
@@ -352,10 +352,11 @@ static int rs400_mc_init(struct radeon_device *rdev)
 	u32 tmp;
 
 	/* Setup GPU memory space */
-	tmp = G_00015C_MC_FB_START(RREG32(R_00015C_NB_TOM));
+	tmp = RREG32(R_00015C_NB_TOM);
 	rdev->mc.vram_location = G_00015C_MC_FB_START(tmp) << 16;
 	rdev->mc.gtt_location = 0xFFFFFFFFUL;
 	r = radeon_mc_setup(rdev);
+	rdev->mc.igp_sideport_enabled = radeon_combios_sideport_present(rdev);
 	if (r)
 		return r;
 	return 0;
@@ -387,14 +388,15 @@ static int rs400_startup(struct radeon_device *rdev)
 	r300_clock_startup(rdev);
 	/* Initialize GPU configuration (# pipes, ...) */
 	rs400_gpu_init(rdev);
+	r100_enable_bm(rdev);
 	/* Initialize GART (initialize after TTM so we can allocate
 	 * memory through TTM but finalize after TTM) */
 	r = rs400_gart_enable(rdev);
 	if (r)
 		return r;
 	/* Enable IRQ */
-	rdev->irq.sw_int = true;
 	r100_irq_set(rdev);
+	rdev->config.r300.hdp_cntl = RREG32(RADEON_HOST_PATH_CNTL);
 	/* 1M ring buffer */
 	r = r100_cp_init(rdev, 1024 * 1024);
 	if (r) {
@@ -430,6 +432,8 @@ int rs400_resume(struct radeon_device *rdev)
 	radeon_combios_asic_init(rdev->ddev);
 	/* Resume clock after posting */
 	r300_clock_startup(rdev);
+	/* Initialize surface registers */
+	radeon_surface_init(rdev);
 	return rs400_startup(rdev);
 }
 
@@ -452,7 +456,7 @@ void rs400_fini(struct radeon_device *rdev)
 	rs400_gart_fini(rdev);
 	radeon_irq_kms_fini(rdev);
 	radeon_fence_driver_fini(rdev);
-	radeon_object_fini(rdev);
+	radeon_bo_fini(rdev);
 	radeon_atombios_fini(rdev);
 	kfree(rdev->bios);
 	rdev->bios = NULL;
@@ -490,12 +494,13 @@ int rs400_init(struct radeon_device *rdev)
 			RREG32(R_0007C0_CP_STAT));
 	}
 	/* check if cards are posted or not */
-	if (!radeon_card_posted(rdev) && rdev->bios) {
-		DRM_INFO("GPU not posted. posting now...\n");
-		radeon_combios_asic_init(rdev->ddev);
-	}
+	if (radeon_boot_test_post_card(rdev) == false)
+		return -EINVAL;
+
 	/* Initialize clocks */
 	radeon_get_clock_info(rdev->ddev);
+	/* Initialize power management */
+	radeon_pm_init(rdev);
 	/* Get vram informations */
 	rs400_vram_info(rdev);
 	/* Initialize memory controller (also test AGP) */
@@ -510,7 +515,7 @@ int rs400_init(struct radeon_device *rdev)
 	if (r)
 		return r;
 	/* Memory manager */
-	r = radeon_object_init(rdev);
+	r = radeon_bo_init(rdev);
 	if (r)
 		return r;
 	r = rs400_gart_init(rdev);
diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
index 5f117cd8736a..d5255751e7b3 100644
--- a/drivers/gpu/drm/radeon/rs600.c
+++ b/drivers/gpu/drm/radeon/rs600.c
@@ -45,6 +45,124 @@
 void rs600_gpu_init(struct radeon_device *rdev);
 int rs600_mc_wait_for_idle(struct radeon_device *rdev);
 
+int rs600_mc_init(struct radeon_device *rdev)
+{
+	/* read back the MC value from the hw */
+	int r;
+	u32 tmp;
+
+	/* Setup GPU memory space */
+	tmp = RREG32_MC(R_000004_MC_FB_LOCATION);
+	rdev->mc.vram_location = G_000004_MC_FB_START(tmp) << 16;
+	rdev->mc.gtt_location = 0xffffffffUL;
+	r = radeon_mc_setup(rdev);
+	rdev->mc.igp_sideport_enabled = radeon_atombios_sideport_present(rdev);
+	if (r)
+		return r;
+	return 0;
+}
+
+/* hpd for digital panel detect/disconnect */
+bool rs600_hpd_sense(struct radeon_device *rdev, enum radeon_hpd_id hpd)
+{
+	u32 tmp;
+	bool connected = false;
+
+	switch (hpd) {
+	case RADEON_HPD_1:
+		tmp = RREG32(R_007D04_DC_HOT_PLUG_DETECT1_INT_STATUS);
+		if (G_007D04_DC_HOT_PLUG_DETECT1_SENSE(tmp))
+			connected = true;
+		break;
+	case RADEON_HPD_2:
+		tmp = RREG32(R_007D14_DC_HOT_PLUG_DETECT2_INT_STATUS);
+		if (G_007D14_DC_HOT_PLUG_DETECT2_SENSE(tmp))
+			connected = true;
+		break;
+	default:
+		break;
+	}
+	return connected;
+}
+
+void rs600_hpd_set_polarity(struct radeon_device *rdev,
+			    enum radeon_hpd_id hpd)
+{
+	u32 tmp;
+	bool connected = rs600_hpd_sense(rdev, hpd);
+
+	switch (hpd) {
+	case RADEON_HPD_1:
+		tmp = RREG32(R_007D08_DC_HOT_PLUG_DETECT1_INT_CONTROL);
+		if (connected)
+			tmp &= ~S_007D08_DC_HOT_PLUG_DETECT1_INT_POLARITY(1);
+		else
+			tmp |= S_007D08_DC_HOT_PLUG_DETECT1_INT_POLARITY(1);
+		WREG32(R_007D08_DC_HOT_PLUG_DETECT1_INT_CONTROL, tmp);
+		break;
+	case RADEON_HPD_2:
+		tmp = RREG32(R_007D18_DC_HOT_PLUG_DETECT2_INT_CONTROL);
+		if (connected)
+			tmp &= ~S_007D18_DC_HOT_PLUG_DETECT2_INT_POLARITY(1);
+		else
+			tmp |= S_007D18_DC_HOT_PLUG_DETECT2_INT_POLARITY(1);
+		WREG32(R_007D18_DC_HOT_PLUG_DETECT2_INT_CONTROL, tmp);
+		break;
+	default:
+		break;
+	}
+}
+
+void rs600_hpd_init(struct radeon_device *rdev)
+{
+	struct drm_device *dev = rdev->ddev;
+	struct drm_connector *connector;
+
+	list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+		struct radeon_connector *radeon_connector = to_radeon_connector(connector);
+		switch (radeon_connector->hpd.hpd) {
+		case RADEON_HPD_1:
+			WREG32(R_007D00_DC_HOT_PLUG_DETECT1_CONTROL,
+			       S_007D00_DC_HOT_PLUG_DETECT1_EN(1));
+			rdev->irq.hpd[0] = true;
+			break;
+		case RADEON_HPD_2:
+			WREG32(R_007D10_DC_HOT_PLUG_DETECT2_CONTROL,
+			       S_007D10_DC_HOT_PLUG_DETECT2_EN(1));
+			rdev->irq.hpd[1] = true;
+			break;
+		default:
+			break;
+		}
+	}
+	if (rdev->irq.installed)
+		rs600_irq_set(rdev);
+}
+
+void rs600_hpd_fini(struct radeon_device *rdev)
+{
+	struct drm_device *dev = rdev->ddev;
+	struct drm_connector *connector;
+
+	list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+		struct radeon_connector *radeon_connector = to_radeon_connector(connector);
+		switch (radeon_connector->hpd.hpd) {
+		case RADEON_HPD_1:
+			WREG32(R_007D00_DC_HOT_PLUG_DETECT1_CONTROL,
+			       S_007D00_DC_HOT_PLUG_DETECT1_EN(0));
+			rdev->irq.hpd[0] = false;
+			break;
+		case RADEON_HPD_2:
+			WREG32(R_007D10_DC_HOT_PLUG_DETECT2_CONTROL,
+			       S_007D10_DC_HOT_PLUG_DETECT2_EN(0));
+			rdev->irq.hpd[1] = false;
+			break;
+		default:
+			break;
+		}
+	}
+}
+
 /*
  * GART.
  */
@@ -100,40 +218,40 @@ int rs600_gart_enable(struct radeon_device *rdev)
 	WREG32(R_00004C_BUS_CNTL, tmp);
 	/* FIXME: setup default page */
 	WREG32_MC(R_000100_MC_PT0_CNTL,
-		 (S_000100_EFFECTIVE_L2_CACHE_SIZE(6) |
-		  S_000100_EFFECTIVE_L2_QUEUE_SIZE(6)));
+		  (S_000100_EFFECTIVE_L2_CACHE_SIZE(6) |
+		   S_000100_EFFECTIVE_L2_QUEUE_SIZE(6)));
+
 	for (i = 0; i < 19; i++) {
 		WREG32_MC(R_00016C_MC_PT0_CLIENT0_CNTL + i,
-			S_00016C_ENABLE_TRANSLATION_MODE_OVERRIDE(1) |
-			S_00016C_SYSTEM_ACCESS_MODE_MASK(
-				V_00016C_SYSTEM_ACCESS_MODE_IN_SYS) |
-			S_00016C_SYSTEM_APERTURE_UNMAPPED_ACCESS(
-				V_00016C_SYSTEM_APERTURE_UNMAPPED_DEFAULT_PAGE) |
-			S_00016C_EFFECTIVE_L1_CACHE_SIZE(1) |
-			S_00016C_ENABLE_FRAGMENT_PROCESSING(1) |
-			S_00016C_EFFECTIVE_L1_QUEUE_SIZE(1));
+			  S_00016C_ENABLE_TRANSLATION_MODE_OVERRIDE(1) |
+			  S_00016C_SYSTEM_ACCESS_MODE_MASK(
+				  V_00016C_SYSTEM_ACCESS_MODE_NOT_IN_SYS) |
+			  S_00016C_SYSTEM_APERTURE_UNMAPPED_ACCESS(
+				  V_00016C_SYSTEM_APERTURE_UNMAPPED_PASSTHROUGH) |
+			  S_00016C_EFFECTIVE_L1_CACHE_SIZE(3) |
+			  S_00016C_ENABLE_FRAGMENT_PROCESSING(1) |
+			  S_00016C_EFFECTIVE_L1_QUEUE_SIZE(3));
 	}
-
-	/* System context map to GART space */
-	WREG32_MC(R_000112_MC_PT0_SYSTEM_APERTURE_LOW_ADDR, rdev->mc.gtt_start);
-	WREG32_MC(R_000114_MC_PT0_SYSTEM_APERTURE_HIGH_ADDR, rdev->mc.gtt_end);
-
 	/* enable first context */
-	WREG32_MC(R_00013C_MC_PT0_CONTEXT0_FLAT_START_ADDR, rdev->mc.gtt_start);
-	WREG32_MC(R_00014C_MC_PT0_CONTEXT0_FLAT_END_ADDR, rdev->mc.gtt_end);
 	WREG32_MC(R_000102_MC_PT0_CONTEXT0_CNTL,
-			S_000102_ENABLE_PAGE_TABLE(1) |
-			S_000102_PAGE_TABLE_DEPTH(V_000102_PAGE_TABLE_FLAT));
+		  S_000102_ENABLE_PAGE_TABLE(1) |
+		  S_000102_PAGE_TABLE_DEPTH(V_000102_PAGE_TABLE_FLAT));
+
 	/* disable all other contexts */
-	for (i = 1; i < 8; i++) {
+	for (i = 1; i < 8; i++)
 		WREG32_MC(R_000102_MC_PT0_CONTEXT0_CNTL + i, 0);
-	}
 
 	/* setup the page table */
 	WREG32_MC(R_00012C_MC_PT0_CONTEXT0_FLAT_BASE_ADDR,
-			rdev->gart.table_addr);
+		  rdev->gart.table_addr);
+	WREG32_MC(R_00013C_MC_PT0_CONTEXT0_FLAT_START_ADDR, rdev->mc.gtt_start);
+	WREG32_MC(R_00014C_MC_PT0_CONTEXT0_FLAT_END_ADDR, rdev->mc.gtt_end);
 	WREG32_MC(R_00011C_MC_PT0_CONTEXT0_DEFAULT_READ_ADDR, 0);
 
+	/* System context maps to VRAM space */
+	WREG32_MC(R_000112_MC_PT0_SYSTEM_APERTURE_LOW_ADDR, rdev->mc.vram_start);
+	WREG32_MC(R_000114_MC_PT0_SYSTEM_APERTURE_HIGH_ADDR, rdev->mc.vram_end);
+
 	/* enable page tables */
 	tmp = RREG32_MC(R_000100_MC_PT0_CNTL);
 	WREG32_MC(R_000100_MC_PT0_CNTL, (tmp | S_000100_ENABLE_PT(1)));
@@ -146,15 +264,20 @@ int rs600_gart_enable(struct radeon_device *rdev)
 
 void rs600_gart_disable(struct radeon_device *rdev)
 {
-	uint32_t tmp;
+	u32 tmp;
+	int r;
 
 	/* FIXME: disable out of gart access */
 	WREG32_MC(R_000100_MC_PT0_CNTL, 0);
 	tmp = RREG32_MC(R_000009_MC_CNTL1);
 	WREG32_MC(R_000009_MC_CNTL1, tmp & C_000009_ENABLE_PAGE_TABLES);
 	if (rdev->gart.table.vram.robj) {
-		radeon_object_kunmap(rdev->gart.table.vram.robj);
-		radeon_object_unpin(rdev->gart.table.vram.robj);
+		r = radeon_bo_reserve(rdev->gart.table.vram.robj, false);
+		if (r == 0) {
+			radeon_bo_kunmap(rdev->gart.table.vram.robj);
+			radeon_bo_unpin(rdev->gart.table.vram.robj);
+			radeon_bo_unreserve(rdev->gart.table.vram.robj);
+		}
 	}
 }
 
@@ -189,7 +312,16 @@ int rs600_irq_set(struct radeon_device *rdev)
 {
 	uint32_t tmp = 0;
 	uint32_t mode_int = 0;
-
+	u32 hpd1 = RREG32(R_007D08_DC_HOT_PLUG_DETECT1_INT_CONTROL) &
+		~S_007D08_DC_HOT_PLUG_DETECT1_INT_EN(1);
+	u32 hpd2 = RREG32(R_007D18_DC_HOT_PLUG_DETECT2_INT_CONTROL) &
+		~S_007D18_DC_HOT_PLUG_DETECT2_INT_EN(1);
+
+	if (!rdev->irq.installed) {
+		WARN(1, "Can't enable IRQ/MSI because no handler is installed.\n");
+		WREG32(R_000040_GEN_INT_CNTL, 0);
+		return -EINVAL;
+	}
 	if (rdev->irq.sw_int) {
 		tmp |= S_000040_SW_INT_EN(1);
 	}
@@ -199,8 +331,16 @@ int rs600_irq_set(struct radeon_device *rdev)
 	if (rdev->irq.crtc_vblank_int[1]) {
 		mode_int |= S_006540_D2MODE_VBLANK_INT_MASK(1);
 	}
+	if (rdev->irq.hpd[0]) {
+		hpd1 |= S_007D08_DC_HOT_PLUG_DETECT1_INT_EN(1);
+	}
+	if (rdev->irq.hpd[1]) {
+		hpd2 |= S_007D18_DC_HOT_PLUG_DETECT2_INT_EN(1);
+	}
 	WREG32(R_000040_GEN_INT_CNTL, tmp);
 	WREG32(R_006540_DxMODE_INT_MASK, mode_int);
+	WREG32(R_007D08_DC_HOT_PLUG_DETECT1_INT_CONTROL, hpd1);
+	WREG32(R_007D18_DC_HOT_PLUG_DETECT2_INT_CONTROL, hpd2);
 	return 0;
 }
 
@@ -208,6 +348,7 @@ static inline uint32_t rs600_irq_ack(struct radeon_device *rdev, u32 *r500_disp_
 {
 	uint32_t irqs = RREG32(R_000044_GEN_INT_STATUS);
 	uint32_t irq_mask = ~C_000044_SW_INT;
+	u32 tmp;
 
 	if (G_000044_DISPLAY_INT_STAT(irqs)) {
 		*r500_disp_int = RREG32(R_007EDC_DISP_INTERRUPT_STATUS);
@@ -219,6 +360,16 @@ static inline uint32_t rs600_irq_ack(struct radeon_device *rdev, u32 *r500_disp_
 			WREG32(R_006D34_D2MODE_VBLANK_STATUS,
 				S_006D34_D2MODE_VBLANK_ACK(1));
 		}
+		if (G_007EDC_DC_HOT_PLUG_DETECT1_INTERRUPT(*r500_disp_int)) {
+			tmp = RREG32(R_007D08_DC_HOT_PLUG_DETECT1_INT_CONTROL);
+			tmp |= S_007D08_DC_HOT_PLUG_DETECT1_INT_ACK(1);
+			WREG32(R_007D08_DC_HOT_PLUG_DETECT1_INT_CONTROL, tmp);
+		}
+		if (G_007EDC_DC_HOT_PLUG_DETECT2_INTERRUPT(*r500_disp_int)) {
+			tmp = RREG32(R_007D18_DC_HOT_PLUG_DETECT2_INT_CONTROL);
+			tmp |= S_007D18_DC_HOT_PLUG_DETECT2_INT_ACK(1);
+			WREG32(R_007D18_DC_HOT_PLUG_DETECT2_INT_CONTROL, tmp);
+		}
 	} else {
 		*r500_disp_int = 0;
 	}
@@ -244,6 +395,7 @@ int rs600_irq_process(struct radeon_device *rdev)
 {
 	uint32_t status, msi_rearm;
 	uint32_t r500_disp_int;
+	bool queue_hotplug = false;
 
 	status = rs600_irq_ack(rdev, &r500_disp_int);
 	if (!status && !r500_disp_int) {
@@ -251,15 +403,25 @@ int rs600_irq_process(struct radeon_device *rdev)
 	}
 	while (status || r500_disp_int) {
 		/* SW interrupt */
-		if (G_000040_SW_INT_EN(status))
+		if (G_000044_SW_INT(status))
 			radeon_fence_process(rdev);
 		/* Vertical blank interrupts */
 		if (G_007EDC_LB_D1_VBLANK_INTERRUPT(r500_disp_int))
 			drm_handle_vblank(rdev->ddev, 0);
 		if (G_007EDC_LB_D2_VBLANK_INTERRUPT(r500_disp_int))
 			drm_handle_vblank(rdev->ddev, 1);
+		if (G_007EDC_DC_HOT_PLUG_DETECT1_INTERRUPT(r500_disp_int)) {
+			queue_hotplug = true;
+			DRM_DEBUG("HPD1\n");
+		}
+		if (G_007EDC_DC_HOT_PLUG_DETECT2_INTERRUPT(r500_disp_int)) {
+			queue_hotplug = true;
+			DRM_DEBUG("HPD2\n");
+		}
 		status = rs600_irq_ack(rdev, &r500_disp_int);
 	}
+	if (queue_hotplug)
+		queue_work(rdev->wq, &rdev->hotplug_work);
 	if (rdev->msi_enabled) {
 		switch (rdev->family) {
 		case CHIP_RS600:
@@ -301,9 +463,7 @@ int rs600_mc_wait_for_idle(struct radeon_device *rdev)
 
 void rs600_gpu_init(struct radeon_device *rdev)
 {
-	/* FIXME: HDP same place on rs600 ? */
 	r100_hdp_reset(rdev);
-	/* FIXME: is this correct ? */
 	r420_pipes_init(rdev);
 	/* Wait for mc idle */
 	if (rs600_mc_wait_for_idle(rdev))
@@ -312,9 +472,20 @@ void rs600_gpu_init(struct radeon_device *rdev)
 
 void rs600_vram_info(struct radeon_device *rdev)
 {
-	/* FIXME: to do or is these values sane ? */
 	rdev->mc.vram_is_ddr = true;
 	rdev->mc.vram_width = 128;
+
+	rdev->mc.real_vram_size = RREG32(RADEON_CONFIG_MEMSIZE);
+	rdev->mc.mc_vram_size = rdev->mc.real_vram_size;
+
+	rdev->mc.aper_base = drm_get_resource_start(rdev->ddev, 0);
+	rdev->mc.aper_size = drm_get_resource_len(rdev->ddev, 0);
+
+	if (rdev->mc.mc_vram_size > rdev->mc.aper_size)
+		rdev->mc.mc_vram_size = rdev->mc.aper_size;
+
+	if (rdev->mc.real_vram_size > rdev->mc.aper_size)
+		rdev->mc.real_vram_size = rdev->mc.aper_size;
 }
 
 void rs600_bandwidth_update(struct radeon_device *rdev)
@@ -388,8 +559,8 @@ static int rs600_startup(struct radeon_device *rdev)
 	if (r)
 		return r;
 	/* Enable IRQ */
-	rdev->irq.sw_int = true;
 	rs600_irq_set(rdev);
+	rdev->config.r300.hdp_cntl = RREG32(RADEON_HOST_PATH_CNTL);
 	/* 1M ring buffer */
 	r = r100_cp_init(rdev, 1024 * 1024);
 	if (r) {
@@ -423,6 +594,8 @@ int rs600_resume(struct radeon_device *rdev)
 	atom_asic_init(rdev->mode_info.atom_context);
 	/* Resume clock after posting */
 	rv515_clock_startup(rdev);
+	/* Initialize surface registers */
+	radeon_surface_init(rdev);
 	return rs600_startup(rdev);
 }
 
@@ -445,7 +618,7 @@ void rs600_fini(struct radeon_device *rdev)
 	rs600_gart_fini(rdev);
 	radeon_irq_kms_fini(rdev);
 	radeon_fence_driver_fini(rdev);
-	radeon_object_fini(rdev);
+	radeon_bo_fini(rdev);
 	radeon_atombios_fini(rdev);
 	kfree(rdev->bios);
 	rdev->bios = NULL;
@@ -482,10 +655,9 @@ int rs600_init(struct radeon_device *rdev)
 			RREG32(R_0007C0_CP_STAT));
 	}
 	/* check if cards are posted or not */
-	if (!radeon_card_posted(rdev) && rdev->bios) {
-		DRM_INFO("GPU not posted. posting now...\n");
-		atom_asic_init(rdev->mode_info.atom_context);
-	}
+	if (radeon_boot_test_post_card(rdev) == false)
+		return -EINVAL;
+
 	/* Initialize clocks */
 	radeon_get_clock_info(rdev->ddev);
 	/* Initialize power management */
@@ -493,7 +665,7 @@ int rs600_init(struct radeon_device *rdev)
 	/* Get vram informations */
 	rs600_vram_info(rdev);
 	/* Initialize memory controller (also test AGP) */
-	r = r420_mc_init(rdev);
+	r = rs600_mc_init(rdev);
 	if (r)
 		return r;
 	rs600_debugfs(rdev);
@@ -505,7 +677,7 @@ int rs600_init(struct radeon_device *rdev)
 	if (r)
 		return r;
 	/* Memory manager */
-	r = radeon_object_init(rdev);
+	r = radeon_bo_init(rdev);
 	if (r)
 		return r;
 	r = rs600_gart_init(rdev);
diff --git a/drivers/gpu/drm/radeon/rs600d.h b/drivers/gpu/drm/radeon/rs600d.h
index 81308924859a..c1c8f5885cbb 100644
--- a/drivers/gpu/drm/radeon/rs600d.h
+++ b/drivers/gpu/drm/radeon/rs600d.h
@@ -30,27 +30,12 @@
 
 /* Registers */
 #define R_000040_GEN_INT_CNTL                        0x000040
-#define   S_000040_DISPLAY_INT_STATUS(x)               (((x) & 0x1) << 0)
-#define   G_000040_DISPLAY_INT_STATUS(x)               (((x) >> 0) & 0x1)
-#define   C_000040_DISPLAY_INT_STATUS                  0xFFFFFFFE
-#define   S_000040_DMA_VIPH0_INT_EN(x)                 (((x) & 0x1) << 12)
-#define   G_000040_DMA_VIPH0_INT_EN(x)                 (((x) >> 12) & 0x1)
-#define   C_000040_DMA_VIPH0_INT_EN                    0xFFFFEFFF
-#define   S_000040_CRTC2_VSYNC(x)                      (((x) & 0x1) << 6)
-#define   G_000040_CRTC2_VSYNC(x)                      (((x) >> 6) & 0x1)
-#define   C_000040_CRTC2_VSYNC                         0xFFFFFFBF
-#define   S_000040_SNAPSHOT2(x)                        (((x) & 0x1) << 7)
-#define   G_000040_SNAPSHOT2(x)                        (((x) >> 7) & 0x1)
-#define   C_000040_SNAPSHOT2                           0xFFFFFF7F
-#define   S_000040_CRTC2_VBLANK(x)                     (((x) & 0x1) << 9)
-#define   G_000040_CRTC2_VBLANK(x)                     (((x) >> 9) & 0x1)
-#define   C_000040_CRTC2_VBLANK                        0xFFFFFDFF
-#define   S_000040_FP2_DETECT(x)                       (((x) & 0x1) << 10)
-#define   G_000040_FP2_DETECT(x)                       (((x) >> 10) & 0x1)
-#define   C_000040_FP2_DETECT                          0xFFFFFBFF
-#define   S_000040_VSYNC_DIFF_OVER_LIMIT(x)            (((x) & 0x1) << 11)
-#define   G_000040_VSYNC_DIFF_OVER_LIMIT(x)            (((x) >> 11) & 0x1)
-#define   C_000040_VSYNC_DIFF_OVER_LIMIT               0xFFFFF7FF
+#define   S_000040_SCRATCH_INT_MASK(x)                 (((x) & 0x1) << 18)
+#define   G_000040_SCRATCH_INT_MASK(x)                 (((x) >> 18) & 0x1)
+#define   C_000040_SCRATCH_INT_MASK                    0xFFFBFFFF
+#define   S_000040_GUI_IDLE_MASK(x)                    (((x) & 0x1) << 19)
+#define   G_000040_GUI_IDLE_MASK(x)                    (((x) >> 19) & 0x1)
+#define   C_000040_GUI_IDLE_MASK                       0xFFF7FFFF
 #define   S_000040_DMA_VIPH1_INT_EN(x)                 (((x) & 0x1) << 13)
 #define   G_000040_DMA_VIPH1_INT_EN(x)                 (((x) >> 13) & 0x1)
 #define   C_000040_DMA_VIPH1_INT_EN                    0xFFFFDFFF
@@ -370,7 +355,90 @@
 #define   S_007EDC_LB_D2_VBLANK_INTERRUPT(x)           (((x) & 0x1) << 5)
 #define   G_007EDC_LB_D2_VBLANK_INTERRUPT(x)           (((x) >> 5) & 0x1)
 #define   C_007EDC_LB_D2_VBLANK_INTERRUPT              0xFFFFFFDF
-
+#define   S_007EDC_DACA_AUTODETECT_INTERRUPT(x)        (((x) & 0x1) << 16)
+#define   G_007EDC_DACA_AUTODETECT_INTERRUPT(x)        (((x) >> 16) & 0x1)
+#define   C_007EDC_DACA_AUTODETECT_INTERRUPT           0xFFFEFFFF
+#define   S_007EDC_DACB_AUTODETECT_INTERRUPT(x)        (((x) & 0x1) << 17)
+#define   G_007EDC_DACB_AUTODETECT_INTERRUPT(x)        (((x) >> 17) & 0x1)
+#define   C_007EDC_DACB_AUTODETECT_INTERRUPT           0xFFFDFFFF
+#define   S_007EDC_DC_HOT_PLUG_DETECT1_INTERRUPT(x)    (((x) & 0x1) << 18)
+#define   G_007EDC_DC_HOT_PLUG_DETECT1_INTERRUPT(x)    (((x) >> 18) & 0x1)
+#define   C_007EDC_DC_HOT_PLUG_DETECT1_INTERRUPT       0xFFFBFFFF
+#define   S_007EDC_DC_HOT_PLUG_DETECT2_INTERRUPT(x)    (((x) & 0x1) << 19)
+#define   G_007EDC_DC_HOT_PLUG_DETECT2_INTERRUPT(x)    (((x) >> 19) & 0x1)
+#define   C_007EDC_DC_HOT_PLUG_DETECT2_INTERRUPT       0xFFF7FFFF
+#define R_007828_DACA_AUTODETECT_CONTROL               0x007828
+#define   S_007828_DACA_AUTODETECT_MODE(x)             (((x) & 0x3) << 0)
+#define   G_007828_DACA_AUTODETECT_MODE(x)             (((x) >> 0) & 0x3)
+#define   C_007828_DACA_AUTODETECT_MODE                0xFFFFFFFC
+#define   S_007828_DACA_AUTODETECT_FRAME_TIME_COUNTER(x) (((x) & 0xff) << 8)
+#define   G_007828_DACA_AUTODETECT_FRAME_TIME_COUNTER(x) (((x) >> 8) & 0xff)
+#define   C_007828_DACA_AUTODETECT_FRAME_TIME_COUNTER  0xFFFF00FF
+#define   S_007828_DACA_AUTODETECT_CHECK_MASK(x)       (((x) & 0x3) << 16)
+#define   G_007828_DACA_AUTODETECT_CHECK_MASK(x)       (((x) >> 16) & 0x3)
+#define   C_007828_DACA_AUTODETECT_CHECK_MASK          0xFFFCFFFF
+#define R_007838_DACA_AUTODETECT_INT_CONTROL           0x007838
+#define   S_007838_DACA_AUTODETECT_ACK(x)              (((x) & 0x1) << 0)
+#define   C_007838_DACA_DACA_AUTODETECT_ACK            0xFFFFFFFE
+#define   S_007838_DACA_AUTODETECT_INT_ENABLE(x)       (((x) & 0x1) << 16)
+#define   G_007838_DACA_AUTODETECT_INT_ENABLE(x)       (((x) >> 16) & 0x1)
+#define   C_007838_DACA_AUTODETECT_INT_ENABLE          0xFFFCFFFF
+#define R_007A28_DACB_AUTODETECT_CONTROL               0x007A28
+#define   S_007A28_DACB_AUTODETECT_MODE(x)             (((x) & 0x3) << 0)
+#define   G_007A28_DACB_AUTODETECT_MODE(x)             (((x) >> 0) & 0x3)
+#define   C_007A28_DACB_AUTODETECT_MODE                0xFFFFFFFC
+#define   S_007A28_DACB_AUTODETECT_FRAME_TIME_COUNTER(x) (((x) & 0xff) << 8)
+#define   G_007A28_DACB_AUTODETECT_FRAME_TIME_COUNTER(x) (((x) >> 8) & 0xff)
+#define   C_007A28_DACB_AUTODETECT_FRAME_TIME_COUNTER  0xFFFF00FF
+#define   S_007A28_DACB_AUTODETECT_CHECK_MASK(x)       (((x) & 0x3) << 16)
+#define   G_007A28_DACB_AUTODETECT_CHECK_MASK(x)       (((x) >> 16) & 0x3)
+#define   C_007A28_DACB_AUTODETECT_CHECK_MASK          0xFFFCFFFF
+#define R_007A38_DACB_AUTODETECT_INT_CONTROL           0x007A38
+#define   S_007A38_DACB_AUTODETECT_ACK(x)              (((x) & 0x1) << 0)
+#define   C_007A38_DACB_DACA_AUTODETECT_ACK            0xFFFFFFFE
+#define   S_007A38_DACB_AUTODETECT_INT_ENABLE(x)       (((x) & 0x1) << 16)
+#define   G_007A38_DACB_AUTODETECT_INT_ENABLE(x)       (((x) >> 16) & 0x1)
+#define   C_007A38_DACB_AUTODETECT_INT_ENABLE          0xFFFCFFFF
+#define R_007D00_DC_HOT_PLUG_DETECT1_CONTROL           0x007D00
+#define   S_007D00_DC_HOT_PLUG_DETECT1_EN(x)           (((x) & 0x1) << 0)
+#define   G_007D00_DC_HOT_PLUG_DETECT1_EN(x)           (((x) >> 0) & 0x1)
+#define   C_007D00_DC_HOT_PLUG_DETECT1_EN              0xFFFFFFFE
+#define R_007D04_DC_HOT_PLUG_DETECT1_INT_STATUS        0x007D04
+#define   S_007D04_DC_HOT_PLUG_DETECT1_INT_STATUS(x)   (((x) & 0x1) << 0)
+#define   G_007D04_DC_HOT_PLUG_DETECT1_INT_STATUS(x)   (((x) >> 0) & 0x1)
+#define   C_007D04_DC_HOT_PLUG_DETECT1_INT_STATUS      0xFFFFFFFE
+#define   S_007D04_DC_HOT_PLUG_DETECT1_SENSE(x)        (((x) & 0x1) << 1)
+#define   G_007D04_DC_HOT_PLUG_DETECT1_SENSE(x)        (((x) >> 1) & 0x1)
+#define   C_007D04_DC_HOT_PLUG_DETECT1_SENSE           0xFFFFFFFD
+#define R_007D08_DC_HOT_PLUG_DETECT1_INT_CONTROL       0x007D08
+#define   S_007D08_DC_HOT_PLUG_DETECT1_INT_ACK(x)      (((x) & 0x1) << 0)
+#define   C_007D08_DC_HOT_PLUG_DETECT1_INT_ACK         0xFFFFFFFE
+#define   S_007D08_DC_HOT_PLUG_DETECT1_INT_POLARITY(x) (((x) & 0x1) << 8)
+#define   G_007D08_DC_HOT_PLUG_DETECT1_INT_POLARITY(x) (((x) >> 8) & 0x1)
+#define   C_007D08_DC_HOT_PLUG_DETECT1_INT_POLARITY    0xFFFFFEFF
+#define   S_007D08_DC_HOT_PLUG_DETECT1_INT_EN(x)       (((x) & 0x1) << 16)
+#define   G_007D08_DC_HOT_PLUG_DETECT1_INT_EN(x)       (((x) >> 16) & 0x1)
+#define   C_007D08_DC_HOT_PLUG_DETECT1_INT_EN          0xFFFEFFFF
+#define R_007D10_DC_HOT_PLUG_DETECT2_CONTROL           0x007D10
+#define   S_007D10_DC_HOT_PLUG_DETECT2_EN(x)           (((x) & 0x1) << 0)
+#define   G_007D10_DC_HOT_PLUG_DETECT2_EN(x)           (((x) >> 0) & 0x1)
+#define   C_007D10_DC_HOT_PLUG_DETECT2_EN              0xFFFFFFFE
+#define R_007D14_DC_HOT_PLUG_DETECT2_INT_STATUS        0x007D14
+#define   S_007D14_DC_HOT_PLUG_DETECT2_INT_STATUS(x)   (((x) & 0x1) << 0)
+#define   G_007D14_DC_HOT_PLUG_DETECT2_INT_STATUS(x)   (((x) >> 0) & 0x1)
+#define   C_007D14_DC_HOT_PLUG_DETECT2_INT_STATUS      0xFFFFFFFE
+#define   S_007D14_DC_HOT_PLUG_DETECT2_SENSE(x)        (((x) & 0x1) << 1)
+#define   G_007D14_DC_HOT_PLUG_DETECT2_SENSE(x)        (((x) >> 1) & 0x1)
+#define   C_007D14_DC_HOT_PLUG_DETECT2_SENSE           0xFFFFFFFD
+#define R_007D18_DC_HOT_PLUG_DETECT2_INT_CONTROL       0x007D18
+#define   S_007D18_DC_HOT_PLUG_DETECT2_INT_ACK(x)      (((x) & 0x1) << 0)
+#define   C_007D18_DC_HOT_PLUG_DETECT2_INT_ACK         0xFFFFFFFE
+#define   S_007D18_DC_HOT_PLUG_DETECT2_INT_POLARITY(x) (((x) & 0x1) << 8)
+#define   G_007D18_DC_HOT_PLUG_DETECT2_INT_POLARITY(x) (((x) >> 8) & 0x1)
+#define   C_007D18_DC_HOT_PLUG_DETECT2_INT_POLARITY    0xFFFFFEFF
+#define   S_007D18_DC_HOT_PLUG_DETECT2_INT_EN(x)       (((x) & 0x1) << 16)
+#define   G_007D18_DC_HOT_PLUG_DETECT2_INT_EN(x)       (((x) >> 16) & 0x1)
+#define   C_007D18_DC_HOT_PLUG_DETECT2_INT_EN          0xFFFEFFFF
 
 /* MC registers */
 #define R_000000_MC_STATUS                           0x000000
diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
index 27547175cf93..cd31da913771 100644
--- a/drivers/gpu/drm/radeon/rs690.c
+++ b/drivers/gpu/drm/radeon/rs690.c
@@ -131,24 +131,25 @@ void rs690_pm_info(struct radeon_device *rdev)
 
 void rs690_vram_info(struct radeon_device *rdev)
 {
-	uint32_t tmp;
 	fixed20_12 a;
 
 	rs400_gart_adjust_size(rdev);
-	/* DDR for all card after R300 & IGP */
+
 	rdev->mc.vram_is_ddr = true;
-	/* FIXME: is this correct for RS690/RS740 ? */
-	tmp = RREG32(RADEON_MEM_CNTL);
-	if (tmp & R300_MEM_NUM_CHANNELS_MASK) {
-		rdev->mc.vram_width = 128;
-	} else {
-		rdev->mc.vram_width = 64;
-	}
+	rdev->mc.vram_width = 128;
+
 	rdev->mc.real_vram_size = RREG32(RADEON_CONFIG_MEMSIZE);
 	rdev->mc.mc_vram_size = rdev->mc.real_vram_size;
 
 	rdev->mc.aper_base = drm_get_resource_start(rdev->ddev, 0);
 	rdev->mc.aper_size = drm_get_resource_len(rdev->ddev, 0);
+
+	if (rdev->mc.mc_vram_size > rdev->mc.aper_size)
+		rdev->mc.mc_vram_size = rdev->mc.aper_size;
+
+	if (rdev->mc.real_vram_size > rdev->mc.aper_size)
+		rdev->mc.real_vram_size = rdev->mc.aper_size;
+
 	rs690_pm_info(rdev);
 	/* FIXME: we should enforce default clock in case GPU is not in
 	 * default setup
@@ -161,6 +162,22 @@ void rs690_vram_info(struct radeon_device *rdev)
 	rdev->pm.core_bandwidth.full = rfixed_div(rdev->pm.sclk, a);
 }
 
+static int rs690_mc_init(struct radeon_device *rdev)
+{
+	int r;
+	u32 tmp;
+
+	/* Setup GPU memory space */
+	tmp = RREG32_MC(R_000100_MCCFG_FB_LOCATION);
+	rdev->mc.vram_location = G_000100_MC_FB_START(tmp) << 16;
+	rdev->mc.gtt_location = 0xFFFFFFFFUL;
+	r = radeon_mc_setup(rdev);
+	rdev->mc.igp_sideport_enabled = radeon_atombios_sideport_present(rdev);
+	if (r)
+		return r;
+	return 0;
+}
+
 void rs690_line_buffer_adjust(struct radeon_device *rdev,
 			      struct drm_display_mode *mode1,
 			      struct drm_display_mode *mode2)
@@ -244,8 +261,9 @@ void rs690_crtc_bandwidth_compute(struct radeon_device *rdev,
 
 	b.full = rfixed_const(mode->crtc_hdisplay);
 	c.full = rfixed_const(256);
-	a.full = rfixed_mul(wm->num_line_pair, b);
-	request_fifo_depth.full = rfixed_div(a, c);
+	a.full = rfixed_div(b, c);
+	request_fifo_depth.full = rfixed_mul(a, wm->num_line_pair);
+	request_fifo_depth.full = rfixed_ceil(request_fifo_depth);
 	if (a.full < rfixed_const(4)) {
 		wm->lb_request_fifo_depth = 4;
 	} else {
@@ -374,6 +392,7 @@ void rs690_crtc_bandwidth_compute(struct radeon_device *rdev,
 	a.full = rfixed_const(16);
 	wm->priority_mark_max.full = rfixed_const(crtc->base.mode.crtc_hdisplay);
 	wm->priority_mark_max.full = rfixed_div(wm->priority_mark_max, a);
+	wm->priority_mark_max.full = rfixed_ceil(wm->priority_mark_max);
 
 	/* Determine estimated width */
 	estimated_width.full = tolerable_latency.full - wm->worst_case_latency.full;
@@ -383,6 +402,7 @@ void rs690_crtc_bandwidth_compute(struct radeon_device *rdev,
 	} else {
 		a.full = rfixed_const(16);
 		wm->priority_mark.full = rfixed_div(estimated_width, a);
+		wm->priority_mark.full = rfixed_ceil(wm->priority_mark);
 		wm->priority_mark.full = wm->priority_mark_max.full - wm->priority_mark.full;
 	}
 }
@@ -605,8 +625,8 @@ static int rs690_startup(struct radeon_device *rdev)
 	if (r)
 		return r;
 	/* Enable IRQ */
-	rdev->irq.sw_int = true;
 	rs600_irq_set(rdev);
+	rdev->config.r300.hdp_cntl = RREG32(RADEON_HOST_PATH_CNTL);
 	/* 1M ring buffer */
 	r = r100_cp_init(rdev, 1024 * 1024);
 	if (r) {
@@ -640,6 +660,8 @@ int rs690_resume(struct radeon_device *rdev)
 	atom_asic_init(rdev->mode_info.atom_context);
 	/* Resume clock after posting */
 	rv515_clock_startup(rdev);
+	/* Initialize surface registers */
+	radeon_surface_init(rdev);
 	return rs690_startup(rdev);
 }
 
@@ -662,7 +684,7 @@ void rs690_fini(struct radeon_device *rdev)
 	rs400_gart_fini(rdev);
 	radeon_irq_kms_fini(rdev);
 	radeon_fence_driver_fini(rdev);
-	radeon_object_fini(rdev);
+	radeon_bo_fini(rdev);
 	radeon_atombios_fini(rdev);
 	kfree(rdev->bios);
 	rdev->bios = NULL;
@@ -700,10 +722,9 @@ int rs690_init(struct radeon_device *rdev)
 			RREG32(R_0007C0_CP_STAT));
 	}
 	/* check if cards are posted or not */
-	if (!radeon_card_posted(rdev) && rdev->bios) {
-		DRM_INFO("GPU not posted. posting now...\n");
-		atom_asic_init(rdev->mode_info.atom_context);
-	}
+	if (radeon_boot_test_post_card(rdev) == false)
+		return -EINVAL;
+
 	/* Initialize clocks */
 	radeon_get_clock_info(rdev->ddev);
 	/* Initialize power management */
@@ -711,7 +732,7 @@ int rs690_init(struct radeon_device *rdev)
 	/* Get vram informations */
 	rs690_vram_info(rdev);
 	/* Initialize memory controller (also test AGP) */
-	r = r420_mc_init(rdev);
+	r = rs690_mc_init(rdev);
 	if (r)
 		return r;
 	rv515_debugfs(rdev);
@@ -723,7 +744,7 @@ int rs690_init(struct radeon_device *rdev)
 	if (r)
 		return r;
 	/* Memory manager */
-	r = radeon_object_init(rdev);
+	r = radeon_bo_init(rdev);
 	if (r)
 		return r;
 	r = rs400_gart_init(rdev);
diff --git a/drivers/gpu/drm/radeon/rv515.c b/drivers/gpu/drm/radeon/rv515.c
index ba68c9fe90a1..62756717b044 100644
--- a/drivers/gpu/drm/radeon/rv515.c
+++ b/drivers/gpu/drm/radeon/rv515.c
@@ -478,8 +478,8 @@ static int rv515_startup(struct radeon_device *rdev)
 			return r;
 	}
 	/* Enable IRQ */
-	rdev->irq.sw_int = true;
 	rs600_irq_set(rdev);
+	rdev->config.r300.hdp_cntl = RREG32(RADEON_HOST_PATH_CNTL);
 	/* 1M ring buffer */
 	r = r100_cp_init(rdev, 1024 * 1024);
 	if (r) {
@@ -514,6 +514,8 @@ int rv515_resume(struct radeon_device *rdev)
 	atom_asic_init(rdev->mode_info.atom_context);
 	/* Resume clock after posting */
 	rv515_clock_startup(rdev);
+	/* Initialize surface registers */
+	radeon_surface_init(rdev);
 	return rv515_startup(rdev);
 }
 
@@ -540,11 +542,11 @@ void rv515_fini(struct radeon_device *rdev)
 	r100_wb_fini(rdev);
 	r100_ib_fini(rdev);
 	radeon_gem_fini(rdev);
-    rv370_pcie_gart_fini(rdev);
+	rv370_pcie_gart_fini(rdev);
 	radeon_agp_fini(rdev);
 	radeon_irq_kms_fini(rdev);
 	radeon_fence_driver_fini(rdev);
-	radeon_object_fini(rdev);
+	radeon_bo_fini(rdev);
 	radeon_atombios_fini(rdev);
 	kfree(rdev->bios);
 	rdev->bios = NULL;
@@ -580,10 +582,8 @@ int rv515_init(struct radeon_device *rdev)
 			RREG32(R_0007C0_CP_STAT));
 	}
 	/* check if cards are posted or not */
-	if (!radeon_card_posted(rdev) && rdev->bios) {
-		DRM_INFO("GPU not posted. posting now...\n");
-		atom_asic_init(rdev->mode_info.atom_context);
-	}
+	if (radeon_boot_test_post_card(rdev) == false)
+		return -EINVAL;
 	/* Initialize clocks */
 	radeon_get_clock_info(rdev->ddev);
 	/* Initialize power management */
@@ -603,7 +603,7 @@ int rv515_init(struct radeon_device *rdev)
 	if (r)
 		return r;
 	/* Memory manager */
-	r = radeon_object_init(rdev);
+	r = radeon_bo_init(rdev);
 	if (r)
 		return r;
 	r = rv370_pcie_gart_init(rdev);
@@ -892,8 +892,9 @@ void rv515_crtc_bandwidth_compute(struct radeon_device *rdev,
 
 	b.full = rfixed_const(mode->crtc_hdisplay);
 	c.full = rfixed_const(256);
-	a.full = rfixed_mul(wm->num_line_pair, b);
-	request_fifo_depth.full = rfixed_div(a, c);
+	a.full = rfixed_div(b, c);
+	request_fifo_depth.full = rfixed_mul(a, wm->num_line_pair);
+	request_fifo_depth.full = rfixed_ceil(request_fifo_depth);
 	if (a.full < rfixed_const(4)) {
 		wm->lb_request_fifo_depth = 4;
 	} else {
@@ -995,15 +996,17 @@ void rv515_crtc_bandwidth_compute(struct radeon_device *rdev,
 	a.full = rfixed_const(16);
 	wm->priority_mark_max.full = rfixed_const(crtc->base.mode.crtc_hdisplay);
 	wm->priority_mark_max.full = rfixed_div(wm->priority_mark_max, a);
+	wm->priority_mark_max.full = rfixed_ceil(wm->priority_mark_max);
 
 	/* Determine estimated width */
 	estimated_width.full = tolerable_latency.full - wm->worst_case_latency.full;
 	estimated_width.full = rfixed_div(estimated_width, consumption_time);
 	if (rfixed_trunc(estimated_width) > crtc->base.mode.crtc_hdisplay) {
-		wm->priority_mark.full = rfixed_const(10);
+		wm->priority_mark.full = wm->priority_mark_max.full;
 	} else {
 		a.full = rfixed_const(16);
 		wm->priority_mark.full = rfixed_div(estimated_width, a);
+		wm->priority_mark.full = rfixed_ceil(wm->priority_mark);
 		wm->priority_mark.full = wm->priority_mark_max.full - wm->priority_mark.full;
 	}
 }
diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
index b0efd0ddae7a..59c71245fb91 100644
--- a/drivers/gpu/drm/radeon/rv770.c
+++ b/drivers/gpu/drm/radeon/rv770.c
@@ -92,7 +92,7 @@ int rv770_pcie_gart_enable(struct radeon_device *rdev)
 void rv770_pcie_gart_disable(struct radeon_device *rdev)
 {
 	u32 tmp;
-	int i;
+	int i, r;
 
 	/* Disable all tables */
 	for (i = 0; i < 7; i++)
@@ -113,8 +113,12 @@ void rv770_pcie_gart_disable(struct radeon_device *rdev)
 	WREG32(MC_VM_MB_L1_TLB2_CNTL, tmp);
 	WREG32(MC_VM_MB_L1_TLB3_CNTL, tmp);
 	if (rdev->gart.table.vram.robj) {
-		radeon_object_kunmap(rdev->gart.table.vram.robj);
-		radeon_object_unpin(rdev->gart.table.vram.robj);
+		r = radeon_bo_reserve(rdev->gart.table.vram.robj, false);
+		if (likely(r == 0)) {
+			radeon_bo_kunmap(rdev->gart.table.vram.robj);
+			radeon_bo_unpin(rdev->gart.table.vram.robj);
+			radeon_bo_unreserve(rdev->gart.table.vram.robj);
+		}
 	}
 }
 
@@ -829,11 +833,11 @@ int rv770_mc_init(struct radeon_device *rdev)
 		 * AGP so that GPU can catch out of VRAM/AGP access
 		 */
 		if (rdev->mc.gtt_location > rdev->mc.mc_vram_size) {
-			/* Enought place before */
+			/* Enough place before */
 			rdev->mc.vram_location = rdev->mc.gtt_location -
 							rdev->mc.mc_vram_size;
 		} else if (tmp > rdev->mc.mc_vram_size) {
-			/* Enought place after */
+			/* Enough place after */
 			rdev->mc.vram_location = rdev->mc.gtt_location +
 							rdev->mc.gtt_size;
 		} else {
@@ -870,6 +874,14 @@ static int rv770_startup(struct radeon_device *rdev)
 {
 	int r;
 
+	if (!rdev->me_fw || !rdev->pfp_fw || !rdev->rlc_fw) {
+		r = r600_init_microcode(rdev);
+		if (r) {
+			DRM_ERROR("Failed to load firmware!\n");
+			return r;
+		}
+	}
+
 	rv770_mc_program(rdev);
 	if (rdev->flags & RADEON_IS_AGP) {
 		rv770_agp_enable(rdev);
@@ -880,13 +892,34 @@ static int rv770_startup(struct radeon_device *rdev)
 	}
 	rv770_gpu_init(rdev);
 
-	r = radeon_object_pin(rdev->r600_blit.shader_obj, RADEON_GEM_DOMAIN_VRAM,
-			      &rdev->r600_blit.shader_gpu_addr);
+	if (!rdev->r600_blit.shader_obj) {
+		r = r600_blit_init(rdev);
+		if (r) {
+			DRM_ERROR("radeon: failed blitter (%d).\n", r);
+			return r;
+		}
+	}
+
+	r = radeon_bo_reserve(rdev->r600_blit.shader_obj, false);
+	if (unlikely(r != 0))
+		return r;
+	r = radeon_bo_pin(rdev->r600_blit.shader_obj, RADEON_GEM_DOMAIN_VRAM,
+			&rdev->r600_blit.shader_gpu_addr);
+	radeon_bo_unreserve(rdev->r600_blit.shader_obj);
 	if (r) {
 		DRM_ERROR("failed to pin blit object %d\n", r);
 		return r;
 	}
 
+	/* Enable IRQ */
+	r = r600_irq_init(rdev);
+	if (r) {
+		DRM_ERROR("radeon: IH init failed (%d).\n", r);
+		radeon_irq_kms_fini(rdev);
+		return r;
+	}
+	r600_irq_set(rdev);
+
 	r = radeon_ring_init(rdev, rdev->cp.ring_size);
 	if (r)
 		return r;
@@ -934,13 +967,19 @@ int rv770_resume(struct radeon_device *rdev)
 
 int rv770_suspend(struct radeon_device *rdev)
 {
+	int r;
+
 	/* FIXME: we should wait for ring to be empty */
 	r700_cp_stop(rdev);
 	rdev->cp.ready = false;
 	r600_wb_disable(rdev);
 	rv770_pcie_gart_disable(rdev);
 	/* unpin shaders bo */
-        radeon_object_unpin(rdev->r600_blit.shader_obj);
+	r = radeon_bo_reserve(rdev->r600_blit.shader_obj, false);
+	if (likely(r == 0)) {
+		radeon_bo_unpin(rdev->r600_blit.shader_obj);
+		radeon_bo_unreserve(rdev->r600_blit.shader_obj);
+	}
 	return 0;
 }
 
@@ -975,7 +1014,11 @@ int rv770_init(struct radeon_device *rdev)
 	if (r)
 		return r;
 	/* Post card if necessary */
-	if (!r600_card_posted(rdev) && rdev->bios) {
+	if (!r600_card_posted(rdev)) {
+		if (!rdev->bios) {
+			dev_err(rdev->dev, "Card not posted and no BIOS - ignoring\n");
+			return -EINVAL;
+		}
 		DRM_INFO("GPU not posted. posting now...\n");
 		atom_asic_init(rdev->mode_info.atom_context);
 	}
@@ -998,31 +1041,25 @@ int rv770_init(struct radeon_device *rdev)
 	if (r)
 		return r;
 	/* Memory manager */
-	r = radeon_object_init(rdev);
+	r = radeon_bo_init(rdev);
 	if (r)
 		return r;
+
+	r = radeon_irq_kms_init(rdev);
+	if (r)
+		return r;
+
 	rdev->cp.ring_obj = NULL;
 	r600_ring_init(rdev, 1024 * 1024);
 
-	if (!rdev->me_fw || !rdev->pfp_fw) {
-		r = r600_cp_init_microcode(rdev);
-		if (r) {
-			DRM_ERROR("Failed to load firmware!\n");
-			return r;
-		}
-	}
+	rdev->ih.ring_obj = NULL;
+	r600_ih_ring_init(rdev, 64 * 1024);
 
 	r = r600_pcie_gart_init(rdev);
 	if (r)
 		return r;
 
 	rdev->accel_working = true;
-	r = r600_blit_init(rdev);
-	if (r) {
-		DRM_ERROR("radeon: failled blitter (%d).\n", r);
-		rdev->accel_working = false;
-	}
-
 	r = rv770_startup(rdev);
 	if (r) {
 		rv770_suspend(rdev);
@@ -1034,12 +1071,12 @@ int rv770_init(struct radeon_device *rdev)
 	if (rdev->accel_working) {
 		r = radeon_ib_pool_init(rdev);
 		if (r) {
-			DRM_ERROR("radeon: failled initializing IB pool (%d).\n", r);
+			DRM_ERROR("radeon: failed initializing IB pool (%d).\n", r);
 			rdev->accel_working = false;
 		}
 		r = r600_ib_test(rdev);
 		if (r) {
-			DRM_ERROR("radeon: failled testing IB (%d).\n", r);
+			DRM_ERROR("radeon: failed testing IB (%d).\n", r);
 			rdev->accel_working = false;
 		}
 	}
@@ -1051,15 +1088,16 @@ void rv770_fini(struct radeon_device *rdev)
 	rv770_suspend(rdev);
 
 	r600_blit_fini(rdev);
+	r600_irq_fini(rdev);
+	radeon_irq_kms_fini(rdev);
 	radeon_ring_fini(rdev);
 	r600_wb_fini(rdev);
 	rv770_pcie_gart_fini(rdev);
 	radeon_gem_fini(rdev);
 	radeon_fence_driver_fini(rdev);
 	radeon_clocks_fini(rdev);
-	if (rdev->flags & RADEON_IS_AGP)
-		radeon_agp_fini(rdev);
-	radeon_object_fini(rdev);
+	radeon_agp_fini(rdev);
+	radeon_bo_fini(rdev);
 	radeon_atombios_fini(rdev);
 	kfree(rdev->bios);
 	rdev->bios = NULL;
diff --git a/drivers/gpu/drm/savage/savage_drv.c b/drivers/gpu/drm/savage/savage_drv.c
index eee52aa92a7c..021de44c15ab 100644
--- a/drivers/gpu/drm/savage/savage_drv.c
+++ b/drivers/gpu/drm/savage/savage_drv.c
@@ -50,7 +50,7 @@ static struct drm_driver driver = {
 		 .owner = THIS_MODULE,
 		 .open = drm_open,
 		 .release = drm_release,
-		 .ioctl = drm_ioctl,
+		 .unlocked_ioctl = drm_ioctl,
 		 .mmap = drm_mmap,
 		 .poll = drm_poll,
 		 .fasync = drm_fasync,
diff --git a/drivers/gpu/drm/sis/sis_drv.c b/drivers/gpu/drm/sis/sis_drv.c
index e725cc0b1155..4fd1f067d380 100644
--- a/drivers/gpu/drm/sis/sis_drv.c
+++ b/drivers/gpu/drm/sis/sis_drv.c
@@ -80,7 +80,7 @@ static struct drm_driver driver = {
 		 .owner = THIS_MODULE,
 		 .open = drm_open,
 		 .release = drm_release,
-		 .ioctl = drm_ioctl,
+		 .unlocked_ioctl = drm_ioctl,
 		 .mmap = drm_mmap,
 		 .poll = drm_poll,
 		 .fasync = drm_fasync,
diff --git a/drivers/gpu/drm/tdfx/tdfx_drv.c b/drivers/gpu/drm/tdfx/tdfx_drv.c
index 012ff2e356b2..ec5a43e65722 100644
--- a/drivers/gpu/drm/tdfx/tdfx_drv.c
+++ b/drivers/gpu/drm/tdfx/tdfx_drv.c
@@ -48,7 +48,7 @@ static struct drm_driver driver = {
 		 .owner = THIS_MODULE,
 		 .open = drm_open,
 		 .release = drm_release,
-		 .ioctl = drm_ioctl,
+		 .unlocked_ioctl = drm_ioctl,
 		 .mmap = drm_mmap,
 		 .poll = drm_poll,
 		 .fasync = drm_fasync,
diff --git a/drivers/gpu/drm/ttm/Makefile b/drivers/gpu/drm/ttm/Makefile
index b0a9de7a57c2..1e138f5bae09 100644
--- a/drivers/gpu/drm/ttm/Makefile
+++ b/drivers/gpu/drm/ttm/Makefile
@@ -3,6 +3,7 @@
 
 ccflags-y := -Iinclude/drm
 ttm-y := ttm_agp_backend.o ttm_memory.o ttm_tt.o ttm_bo.o \
-	ttm_bo_util.o ttm_bo_vm.o ttm_module.o ttm_global.o
+	ttm_bo_util.o ttm_bo_vm.o ttm_module.o ttm_global.o \
+	ttm_object.o ttm_lock.o ttm_execbuf_util.o
 
 obj-$(CONFIG_DRM_TTM) += ttm.o
diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index 87c06252d464..2920f9a279e1 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -27,6 +27,14 @@
 /*
  * Authors: Thomas Hellstrom <thellstrom-at-vmware-dot-com>
  */
+/* Notes:
+ *
+ * We store bo pointer in drm_mm_node struct so we know which bo own a
+ * specific node. There is no protection on the pointer, thus to make
+ * sure things don't go berserk you have to access this pointer while
+ * holding the global lru lock and make sure anytime you free a node you
+ * reset the pointer to NULL.
+ */
 
 #include "ttm/ttm_module.h"
 #include "ttm/ttm_bo_driver.h"
@@ -51,6 +59,59 @@ static struct attribute ttm_bo_count = {
 	.mode = S_IRUGO
 };
 
+static inline int ttm_mem_type_from_flags(uint32_t flags, uint32_t *mem_type)
+{
+	int i;
+
+	for (i = 0; i <= TTM_PL_PRIV5; i++)
+		if (flags & (1 << i)) {
+			*mem_type = i;
+			return 0;
+		}
+	return -EINVAL;
+}
+
+static void ttm_mem_type_debug(struct ttm_bo_device *bdev, int mem_type)
+{
+	struct ttm_mem_type_manager *man = &bdev->man[mem_type];
+
+	printk(KERN_ERR TTM_PFX "    has_type: %d\n", man->has_type);
+	printk(KERN_ERR TTM_PFX "    use_type: %d\n", man->use_type);
+	printk(KERN_ERR TTM_PFX "    flags: 0x%08X\n", man->flags);
+	printk(KERN_ERR TTM_PFX "    gpu_offset: 0x%08lX\n", man->gpu_offset);
+	printk(KERN_ERR TTM_PFX "    io_offset: 0x%08lX\n", man->io_offset);
+	printk(KERN_ERR TTM_PFX "    io_size: %ld\n", man->io_size);
+	printk(KERN_ERR TTM_PFX "    size: %llu\n", man->size);
+	printk(KERN_ERR TTM_PFX "    available_caching: 0x%08X\n",
+		man->available_caching);
+	printk(KERN_ERR TTM_PFX "    default_caching: 0x%08X\n",
+		man->default_caching);
+	if (mem_type != TTM_PL_SYSTEM) {
+		spin_lock(&bdev->glob->lru_lock);
+		drm_mm_debug_table(&man->manager, TTM_PFX);
+		spin_unlock(&bdev->glob->lru_lock);
+	}
+}
+
+static void ttm_bo_mem_space_debug(struct ttm_buffer_object *bo,
+					struct ttm_placement *placement)
+{
+	int i, ret, mem_type;
+
+	printk(KERN_ERR TTM_PFX "No space for %p (%lu pages, %luK, %luM)\n",
+		bo, bo->mem.num_pages, bo->mem.size >> 10,
+		bo->mem.size >> 20);
+	for (i = 0; i < placement->num_placement; i++) {
+		ret = ttm_mem_type_from_flags(placement->placement[i],
+						&mem_type);
+		if (ret)
+			return;
+		printk(KERN_ERR TTM_PFX "  placement[%d]=0x%08X (%d)\n",
+			i, placement->placement[i], mem_type);
+		ttm_mem_type_debug(bo->bdev, mem_type);
+	}
+}
+
 static ssize_t ttm_bo_global_show(struct kobject *kobj,
 				  struct attribute *attr,
 				  char *buffer)
@@ -117,12 +178,13 @@ int ttm_bo_wait_unreserved(struct ttm_buffer_object *bo, bool interruptible)
 		ret = wait_event_interruptible(bo->event_queue,
 					       atomic_read(&bo->reserved) == 0);
 		if (unlikely(ret != 0))
-			return -ERESTART;
+			return ret;
 	} else {
 		wait_event(bo->event_queue, atomic_read(&bo->reserved) == 0);
 	}
 	return 0;
 }
+EXPORT_SYMBOL(ttm_bo_wait_unreserved);
 
 static void ttm_bo_add_to_lru(struct ttm_buffer_object *bo)
 {
@@ -247,7 +309,6 @@ EXPORT_SYMBOL(ttm_bo_unreserve);
 /*
  * Call bo->mutex locked.
  */
-
 static int ttm_bo_add_ttm(struct ttm_buffer_object *bo, bool zero_alloc)
 {
 	struct ttm_bo_device *bdev = bo->bdev;
@@ -275,9 +336,10 @@ static int ttm_bo_add_ttm(struct ttm_buffer_object *bo, bool zero_alloc)
 		bo->ttm = ttm_tt_create(bdev, bo->num_pages << PAGE_SHIFT,
 					page_flags | TTM_PAGE_FLAG_USER,
 					glob->dummy_read_page);
-		if (unlikely(bo->ttm == NULL))
+		if (unlikely(bo->ttm == NULL)) {
 			ret = -ENOMEM;
-		break;
+			break;
+		}
 
 		ret = ttm_tt_set_user(bo->ttm, current,
 				      bo->buffer_start, bo->num_pages);
@@ -328,14 +390,8 @@ static int ttm_bo_handle_move_mem(struct ttm_buffer_object *bo,
 		}
 
 		if (bo->mem.mem_type == TTM_PL_SYSTEM) {
-
-			struct ttm_mem_reg *old_mem = &bo->mem;
-			uint32_t save_flags = old_mem->placement;
-
-			*old_mem = *mem;
+			bo->mem = *mem;
 			mem->mm_node = NULL;
-			ttm_flag_masked(&save_flags, mem->placement,
-					TTM_PL_MASK_MEMTYPE);
 			goto moved;
 		}
 
@@ -408,6 +464,8 @@ static int ttm_bo_cleanup_refs(struct ttm_buffer_object *bo, bool remove_all)
 		spin_unlock(&bo->lock);
 
 		spin_lock(&glob->lru_lock);
+		put_count = ttm_bo_del_from_lru(bo);
+
 		ret = ttm_bo_reserve_locked(bo, false, false, false, 0);
 		BUG_ON(ret);
 		if (bo->ttm)
@@ -415,19 +473,19 @@ static int ttm_bo_cleanup_refs(struct ttm_buffer_object *bo, bool remove_all)
 
 		if (!list_empty(&bo->ddestroy)) {
 			list_del_init(&bo->ddestroy);
-			kref_put(&bo->list_kref, ttm_bo_ref_bug);
+			++put_count;
 		}
 		if (bo->mem.mm_node) {
+			bo->mem.mm_node->private = NULL;
 			drm_mm_put_block(bo->mem.mm_node);
 			bo->mem.mm_node = NULL;
 		}
-		put_count = ttm_bo_del_from_lru(bo);
 		spin_unlock(&glob->lru_lock);
 
 		atomic_set(&bo->reserved, 0);
 
 		while (put_count--)
-			kref_put(&bo->list_kref, ttm_bo_release_list);
+			kref_put(&bo->list_kref, ttm_bo_ref_bug);
 
 		return 0;
 	}
@@ -554,24 +612,21 @@ void ttm_bo_unref(struct ttm_buffer_object **p_bo)
 }
 EXPORT_SYMBOL(ttm_bo_unref);
 
-static int ttm_bo_evict(struct ttm_buffer_object *bo, unsigned mem_type,
-			bool interruptible, bool no_wait)
+static int ttm_bo_evict(struct ttm_buffer_object *bo, bool interruptible,
+			bool no_wait)
 {
-	int ret = 0;
 	struct ttm_bo_device *bdev = bo->bdev;
 	struct ttm_bo_global *glob = bo->glob;
 	struct ttm_mem_reg evict_mem;
-	uint32_t proposed_placement;
-
-	if (bo->mem.mem_type != mem_type)
-		goto out;
+	struct ttm_placement placement;
+	int ret = 0;
 
 	spin_lock(&bo->lock);
 	ret = ttm_bo_wait(bo, false, interruptible, no_wait);
 	spin_unlock(&bo->lock);
 
 	if (unlikely(ret != 0)) {
-		if (ret != -ERESTART) {
+		if (ret != -ERESTARTSYS) {
 			printk(KERN_ERR TTM_PFX
 			       "Failed to expire sync object before "
 			       "buffer eviction.\n");
@@ -584,116 +639,165 @@ static int ttm_bo_evict(struct ttm_buffer_object *bo, unsigned mem_type,
 	evict_mem = bo->mem;
 	evict_mem.mm_node = NULL;
 
-	proposed_placement = bdev->driver->evict_flags(bo);
-
-	ret = ttm_bo_mem_space(bo, proposed_placement,
-			       &evict_mem, interruptible, no_wait);
-	if (unlikely(ret != 0 && ret != -ERESTART))
-		ret = ttm_bo_mem_space(bo, TTM_PL_FLAG_SYSTEM,
-				       &evict_mem, interruptible, no_wait);
-
+	placement.fpfn = 0;
+	placement.lpfn = 0;
+	placement.num_placement = 0;
+	placement.num_busy_placement = 0;
+	bdev->driver->evict_flags(bo, &placement);
+	ret = ttm_bo_mem_space(bo, &placement, &evict_mem, interruptible,
+				no_wait);
 	if (ret) {
-		if (ret != -ERESTART)
+		if (ret != -ERESTARTSYS) {
 			printk(KERN_ERR TTM_PFX
 			       "Failed to find memory space for "
 			       "buffer 0x%p eviction.\n", bo);
+			ttm_bo_mem_space_debug(bo, &placement);
+		}
 		goto out;
 	}
 
 	ret = ttm_bo_handle_move_mem(bo, &evict_mem, true, interruptible,
 				     no_wait);
 	if (ret) {
-		if (ret != -ERESTART)
+		if (ret != -ERESTARTSYS)
 			printk(KERN_ERR TTM_PFX "Buffer eviction failed\n");
+		spin_lock(&glob->lru_lock);
+		if (evict_mem.mm_node) {
+			evict_mem.mm_node->private = NULL;
+			drm_mm_put_block(evict_mem.mm_node);
+			evict_mem.mm_node = NULL;
+		}
+		spin_unlock(&glob->lru_lock);
 		goto out;
 	}
-
-	spin_lock(&glob->lru_lock);
-	if (evict_mem.mm_node) {
-		drm_mm_put_block(evict_mem.mm_node);
-		evict_mem.mm_node = NULL;
-	}
-	spin_unlock(&glob->lru_lock);
 	bo->evicted = true;
 out:
 	return ret;
 }
 
-/**
- * Repeatedly evict memory from the LRU for @mem_type until we create enough
- * space, or we've evicted everything and there isn't enough space.
- */
-static int ttm_bo_mem_force_space(struct ttm_bo_device *bdev,
-				  struct ttm_mem_reg *mem,
-				  uint32_t mem_type,
-				  bool interruptible, bool no_wait)
+static int ttm_mem_evict_first(struct ttm_bo_device *bdev,
+				uint32_t mem_type,
+				bool interruptible, bool no_wait)
 {
 	struct ttm_bo_global *glob = bdev->glob;
-	struct drm_mm_node *node;
-	struct ttm_buffer_object *entry;
 	struct ttm_mem_type_manager *man = &bdev->man[mem_type];
-	struct list_head *lru;
-	unsigned long num_pages = mem->num_pages;
-	int put_count = 0;
-	int ret;
-
-retry_pre_get:
-	ret = drm_mm_pre_get(&man->manager);
-	if (unlikely(ret != 0))
-		return ret;
+	struct ttm_buffer_object *bo;
+	int ret, put_count = 0;
 
+retry:
 	spin_lock(&glob->lru_lock);
-	do {
-		node = drm_mm_search_free(&man->manager, num_pages,
-					  mem->page_alignment, 1);
-		if (node)
-			break;
+	if (list_empty(&man->lru)) {
+		spin_unlock(&glob->lru_lock);
+		return -EBUSY;
+	}
 
-		lru = &man->lru;
-		if (list_empty(lru))
-			break;
+	bo = list_first_entry(&man->lru, struct ttm_buffer_object, lru);
+	kref_get(&bo->list_kref);
 
-		entry = list_first_entry(lru, struct ttm_buffer_object, lru);
-		kref_get(&entry->list_kref);
+	ret = ttm_bo_reserve_locked(bo, false, true, false, 0);
 
-		ret =
-		    ttm_bo_reserve_locked(entry, interruptible, no_wait,
-					  false, 0);
+	if (unlikely(ret == -EBUSY)) {
+		spin_unlock(&glob->lru_lock);
+		if (likely(!no_wait))
+			ret = ttm_bo_wait_unreserved(bo, interruptible);
 
-		if (likely(ret == 0))
-			put_count = ttm_bo_del_from_lru(entry);
+		kref_put(&bo->list_kref, ttm_bo_release_list);
 
-		spin_unlock(&glob->lru_lock);
+		/**
+		 * We *need* to retry after releasing the lru lock.
+		 */
 
 		if (unlikely(ret != 0))
 			return ret;
+		goto retry;
+	}
 
-		while (put_count--)
-			kref_put(&entry->list_kref, ttm_bo_ref_bug);
+	put_count = ttm_bo_del_from_lru(bo);
+	spin_unlock(&glob->lru_lock);
 
-		ret = ttm_bo_evict(entry, mem_type, interruptible, no_wait);
+	BUG_ON(ret != 0);
 
-		ttm_bo_unreserve(entry);
+	while (put_count--)
+		kref_put(&bo->list_kref, ttm_bo_ref_bug);
 
-		kref_put(&entry->list_kref, ttm_bo_release_list);
-		if (ret)
+	ret = ttm_bo_evict(bo, interruptible, no_wait);
+	ttm_bo_unreserve(bo);
+
+	kref_put(&bo->list_kref, ttm_bo_release_list);
+	return ret;
+}
+
+static int ttm_bo_man_get_node(struct ttm_buffer_object *bo,
+				struct ttm_mem_type_manager *man,
+				struct ttm_placement *placement,
+				struct ttm_mem_reg *mem,
+				struct drm_mm_node **node)
+{
+	struct ttm_bo_global *glob = bo->glob;
+	unsigned long lpfn;
+	int ret;
+
+	lpfn = placement->lpfn;
+	if (!lpfn)
+		lpfn = man->size;
+	*node = NULL;
+	do {
+		ret = drm_mm_pre_get(&man->manager);
+		if (unlikely(ret))
 			return ret;
 
 		spin_lock(&glob->lru_lock);
-	} while (1);
-
-	if (!node) {
+		*node = drm_mm_search_free_in_range(&man->manager,
+					mem->num_pages, mem->page_alignment,
+					placement->fpfn, lpfn, 1);
+		if (unlikely(*node == NULL)) {
+			spin_unlock(&glob->lru_lock);
+			return 0;
+		}
+		*node = drm_mm_get_block_atomic_range(*node, mem->num_pages,
+							mem->page_alignment,
+							placement->fpfn,
+							lpfn);
 		spin_unlock(&glob->lru_lock);
-		return -ENOMEM;
-	}
+	} while (*node == NULL);
+	return 0;
+}
 
-	node = drm_mm_get_block_atomic(node, num_pages, mem->page_alignment);
-	if (unlikely(!node)) {
-		spin_unlock(&glob->lru_lock);
-		goto retry_pre_get;
-	}
+/**
+ * Repeatedly evict memory from the LRU for @mem_type until we create enough
+ * space, or we've evicted everything and there isn't enough space.
+ */
+static int ttm_bo_mem_force_space(struct ttm_buffer_object *bo,
+					uint32_t mem_type,
+					struct ttm_placement *placement,
+					struct ttm_mem_reg *mem,
+					bool interruptible, bool no_wait)
+{
+	struct ttm_bo_device *bdev = bo->bdev;
+	struct ttm_bo_global *glob = bdev->glob;
+	struct ttm_mem_type_manager *man = &bdev->man[mem_type];
+	struct drm_mm_node *node;
+	int ret;
 
-	spin_unlock(&glob->lru_lock);
+	do {
+		ret = ttm_bo_man_get_node(bo, man, placement, mem, &node);
+		if (unlikely(ret != 0))
+			return ret;
+		if (node)
+			break;
+		spin_lock(&glob->lru_lock);
+		if (list_empty(&man->lru)) {
+			spin_unlock(&glob->lru_lock);
+			break;
+		}
+		spin_unlock(&glob->lru_lock);
+		ret = ttm_mem_evict_first(bdev, mem_type, interruptible,
+						no_wait);
+		if (unlikely(ret != 0))
+			return ret;
+	} while (1);
+	if (node == NULL)
+		return -ENOMEM;
 	mem->mm_node = node;
 	mem->mem_type = mem_type;
 	return 0;
@@ -724,7 +828,6 @@ static uint32_t ttm_bo_select_caching(struct ttm_mem_type_manager *man,
 	return result;
 }
 
-
 static bool ttm_bo_mt_compatible(struct ttm_mem_type_manager *man,
 				 bool disallow_fixed,
 				 uint32_t mem_type,
@@ -757,66 +860,55 @@ static bool ttm_bo_mt_compatible(struct ttm_mem_type_manager *man,
  * space.
  */
 int ttm_bo_mem_space(struct ttm_buffer_object *bo,
-		     uint32_t proposed_placement,
-		     struct ttm_mem_reg *mem,
-		     bool interruptible, bool no_wait)
+			struct ttm_placement *placement,
+			struct ttm_mem_reg *mem,
+			bool interruptible, bool no_wait)
 {
 	struct ttm_bo_device *bdev = bo->bdev;
-	struct ttm_bo_global *glob = bo->glob;
 	struct ttm_mem_type_manager *man;
-
-	uint32_t num_prios = bdev->driver->num_mem_type_prio;
-	const uint32_t *prios = bdev->driver->mem_type_prio;
-	uint32_t i;
 	uint32_t mem_type = TTM_PL_SYSTEM;
 	uint32_t cur_flags = 0;
 	bool type_found = false;
 	bool type_ok = false;
-	bool has_eagain = false;
+	bool has_erestartsys = false;
 	struct drm_mm_node *node = NULL;
-	int ret;
+	int i, ret;
 
 	mem->mm_node = NULL;
-	for (i = 0; i < num_prios; ++i) {
-		mem_type = prios[i];
+	for (i = 0; i < placement->num_placement; ++i) {
+		ret = ttm_mem_type_from_flags(placement->placement[i],
+						&mem_type);
+		if (ret)
+			return ret;
 		man = &bdev->man[mem_type];
 
 		type_ok = ttm_bo_mt_compatible(man,
-					       bo->type == ttm_bo_type_user,
-					       mem_type, proposed_placement,
-					       &cur_flags);
+						bo->type == ttm_bo_type_user,
+						mem_type,
+						placement->placement[i],
+						&cur_flags);
 
 		if (!type_ok)
 			continue;
 
 		cur_flags = ttm_bo_select_caching(man, bo->mem.placement,
 						  cur_flags);
+		/*
+		 * Use the access and other non-mapping-related flag bits from
+		 * the memory placement flags to the current flags
+		 */
+		ttm_flag_masked(&cur_flags, placement->placement[i],
+				~TTM_PL_MASK_MEMTYPE);
 
 		if (mem_type == TTM_PL_SYSTEM)
 			break;
 
 		if (man->has_type && man->use_type) {
 			type_found = true;
-			do {
-				ret = drm_mm_pre_get(&man->manager);
-				if (unlikely(ret))
-					return ret;
-
-				spin_lock(&glob->lru_lock);
-				node = drm_mm_search_free(&man->manager,
-							  mem->num_pages,
-							  mem->page_alignment,
-							  1);
-				if (unlikely(!node)) {
-					spin_unlock(&glob->lru_lock);
-					break;
-				}
-				node = drm_mm_get_block_atomic(node,
-							       mem->num_pages,
-							       mem->
-							       page_alignment);
-				spin_unlock(&glob->lru_lock);
-			} while (!node);
+			ret = ttm_bo_man_get_node(bo, man, placement, mem,
+							&node);
+			if (unlikely(ret))
+				return ret;
 		}
 		if (node)
 			break;
@@ -826,67 +918,66 @@ int ttm_bo_mem_space(struct ttm_buffer_object *bo,
 		mem->mm_node = node;
 		mem->mem_type = mem_type;
 		mem->placement = cur_flags;
+		if (node)
+			node->private = bo;
 		return 0;
 	}
 
 	if (!type_found)
 		return -EINVAL;
 
-	num_prios = bdev->driver->num_mem_busy_prio;
-	prios = bdev->driver->mem_busy_prio;
-
-	for (i = 0; i < num_prios; ++i) {
-		mem_type = prios[i];
+	for (i = 0; i < placement->num_busy_placement; ++i) {
+		ret = ttm_mem_type_from_flags(placement->busy_placement[i],
+						&mem_type);
+		if (ret)
+			return ret;
 		man = &bdev->man[mem_type];
-
 		if (!man->has_type)
 			continue;
-
 		if (!ttm_bo_mt_compatible(man,
-					  bo->type == ttm_bo_type_user,
-					  mem_type,
-					  proposed_placement, &cur_flags))
+						bo->type == ttm_bo_type_user,
+						mem_type,
+						placement->busy_placement[i],
+						&cur_flags))
 			continue;
 
 		cur_flags = ttm_bo_select_caching(man, bo->mem.placement,
 						  cur_flags);
+		/*
+		 * Use the access and other non-mapping-related flag bits from
+		 * the memory placement flags to the current flags
+		 */
+		ttm_flag_masked(&cur_flags, placement->busy_placement[i],
+				~TTM_PL_MASK_MEMTYPE);
 
-		ret = ttm_bo_mem_force_space(bdev, mem, mem_type,
-					     interruptible, no_wait);
-
+		ret = ttm_bo_mem_force_space(bo, mem_type, placement, mem,
+						interruptible, no_wait);
 		if (ret == 0 && mem->mm_node) {
 			mem->placement = cur_flags;
+			mem->mm_node->private = bo;
 			return 0;
 		}
-
-		if (ret == -ERESTART)
-			has_eagain = true;
+		if (ret == -ERESTARTSYS)
+			has_erestartsys = true;
 	}
-
-	ret = (has_eagain) ? -ERESTART : -ENOMEM;
+	ret = (has_erestartsys) ? -ERESTARTSYS : -ENOMEM;
 	return ret;
 }
 EXPORT_SYMBOL(ttm_bo_mem_space);
 
 int ttm_bo_wait_cpu(struct ttm_buffer_object *bo, bool no_wait)
 {
-	int ret = 0;
-
 	if ((atomic_read(&bo->cpu_writers) > 0) && no_wait)
 		return -EBUSY;
 
-	ret = wait_event_interruptible(bo->event_queue,
-				       atomic_read(&bo->cpu_writers) == 0);
-
-	if (ret == -ERESTARTSYS)
-		ret = -ERESTART;
-
-	return ret;
+	return wait_event_interruptible(bo->event_queue,
+					atomic_read(&bo->cpu_writers) == 0);
 }
+EXPORT_SYMBOL(ttm_bo_wait_cpu);
 
 int ttm_bo_move_buffer(struct ttm_buffer_object *bo,
-		       uint32_t proposed_placement,
-		       bool interruptible, bool no_wait)
+			struct ttm_placement *placement,
+			bool interruptible, bool no_wait)
 {
 	struct ttm_bo_global *glob = bo->glob;
 	int ret = 0;
@@ -899,147 +990,132 @@ int ttm_bo_move_buffer(struct ttm_buffer_object *bo,
 	 * Have the driver move function wait for idle when necessary,
 	 * instead of doing it here.
 	 */
-
 	spin_lock(&bo->lock);
 	ret = ttm_bo_wait(bo, false, interruptible, no_wait);
 	spin_unlock(&bo->lock);
-
 	if (ret)
 		return ret;
-
 	mem.num_pages = bo->num_pages;
 	mem.size = mem.num_pages << PAGE_SHIFT;
 	mem.page_alignment = bo->mem.page_alignment;
-
 	/*
 	 * Determine where to move the buffer.
 	 */
-
-	ret = ttm_bo_mem_space(bo, proposed_placement, &mem,
-			       interruptible, no_wait);
+	ret = ttm_bo_mem_space(bo, placement, &mem, interruptible, no_wait);
 	if (ret)
 		goto out_unlock;
-
 	ret = ttm_bo_handle_move_mem(bo, &mem, false, interruptible, no_wait);
-
 out_unlock:
 	if (ret && mem.mm_node) {
 		spin_lock(&glob->lru_lock);
+		mem.mm_node->private = NULL;
 		drm_mm_put_block(mem.mm_node);
 		spin_unlock(&glob->lru_lock);
 	}
 	return ret;
 }
 
-static int ttm_bo_mem_compat(uint32_t proposed_placement,
+static int ttm_bo_mem_compat(struct ttm_placement *placement,
 			     struct ttm_mem_reg *mem)
 {
-	if ((proposed_placement & mem->placement & TTM_PL_MASK_MEM) == 0)
-		return 0;
-	if ((proposed_placement & mem->placement & TTM_PL_MASK_CACHING) == 0)
-		return 0;
-
-	return 1;
+	int i;
+
+	for (i = 0; i < placement->num_placement; i++) {
+		if ((placement->placement[i] & mem->placement &
+			TTM_PL_MASK_CACHING) &&
+			(placement->placement[i] & mem->placement &
+			TTM_PL_MASK_MEM))
+			return i;
+	}
+	return -1;
 }
 
-int ttm_buffer_object_validate(struct ttm_buffer_object *bo,
-			       uint32_t proposed_placement,
-			       bool interruptible, bool no_wait)
+int ttm_bo_validate(struct ttm_buffer_object *bo,
+			struct ttm_placement *placement,
+			bool interruptible, bool no_wait)
 {
 	int ret;
 
 	BUG_ON(!atomic_read(&bo->reserved));
-	bo->proposed_placement = proposed_placement;
-
-	TTM_DEBUG("Proposed placement 0x%08lx, Old flags 0x%08lx\n",
-		  (unsigned long)proposed_placement,
-		  (unsigned long)bo->mem.placement);
-
+	/* Check that range is valid */
+	if (placement->lpfn || placement->fpfn)
+		if (placement->fpfn > placement->lpfn ||
+			(placement->lpfn - placement->fpfn) < bo->num_pages)
+			return -EINVAL;
 	/*
 	 * Check whether we need to move buffer.
 	 */
-
-	if (!ttm_bo_mem_compat(bo->proposed_placement, &bo->mem)) {
-		ret = ttm_bo_move_buffer(bo, bo->proposed_placement,
-					 interruptible, no_wait);
-		if (ret) {
-			if (ret != -ERESTART)
-				printk(KERN_ERR TTM_PFX
-				       "Failed moving buffer. "
-				       "Proposed placement 0x%08x\n",
-				       bo->proposed_placement);
-			if (ret == -ENOMEM)
-				printk(KERN_ERR TTM_PFX
-				       "Out of aperture space or "
-				       "DRM memory quota.\n");
+	ret = ttm_bo_mem_compat(placement, &bo->mem);
+	if (ret < 0) {
+		ret = ttm_bo_move_buffer(bo, placement, interruptible, no_wait);
+		if (ret)
 			return ret;
-		}
+	} else {
+		/*
+		 * Use the access and other non-mapping-related flag bits from
+		 * the compatible memory placement flags to the active flags
+		 */
+		ttm_flag_masked(&bo->mem.placement, placement->placement[ret],
+				~TTM_PL_MASK_MEMTYPE);
 	}
-
 	/*
 	 * We might need to add a TTM.
 	 */
-
 	if (bo->mem.mem_type == TTM_PL_SYSTEM && bo->ttm == NULL) {
 		ret = ttm_bo_add_ttm(bo, true);
 		if (ret)
 			return ret;
 	}
-	/*
-	 * Validation has succeeded, move the access and other
-	 * non-mapping-related flag bits from the proposed flags to
-	 * the active flags
-	 */
-
-	ttm_flag_masked(&bo->mem.placement, bo->proposed_placement,
-			~TTM_PL_MASK_MEMTYPE);
-
 	return 0;
 }
-EXPORT_SYMBOL(ttm_buffer_object_validate);
+EXPORT_SYMBOL(ttm_bo_validate);
 
-int
-ttm_bo_check_placement(struct ttm_buffer_object *bo,
-		       uint32_t set_flags, uint32_t clr_flags)
+int ttm_bo_check_placement(struct ttm_buffer_object *bo,
+				struct ttm_placement *placement)
 {
-	uint32_t new_mask = set_flags | clr_flags;
-
-	if ((bo->type == ttm_bo_type_user) &&
-	    (clr_flags & TTM_PL_FLAG_CACHED)) {
-		printk(KERN_ERR TTM_PFX
-		       "User buffers require cache-coherent memory.\n");
-		return -EINVAL;
-	}
-
-	if (!capable(CAP_SYS_ADMIN)) {
-		if (new_mask & TTM_PL_FLAG_NO_EVICT) {
-			printk(KERN_ERR TTM_PFX "Need to be root to modify"
-			       " NO_EVICT status.\n");
+	int i;
+
+	if (placement->fpfn || placement->lpfn) {
+		if (bo->mem.num_pages > (placement->lpfn - placement->fpfn)) {
+			printk(KERN_ERR TTM_PFX "Page number range to small "
+				"Need %lu pages, range is [%u, %u]\n",
+				bo->mem.num_pages, placement->fpfn,
+				placement->lpfn);
 			return -EINVAL;
 		}
-
-		if ((clr_flags & bo->mem.placement & TTM_PL_MASK_MEMTYPE) &&
-		    (bo->mem.placement & TTM_PL_FLAG_NO_EVICT)) {
-			printk(KERN_ERR TTM_PFX
-			       "Incompatible memory specification"
-			       " for NO_EVICT buffer.\n");
-			return -EINVAL;
+	}
+	for (i = 0; i < placement->num_placement; i++) {
+		if (!capable(CAP_SYS_ADMIN)) {
+			if (placement->placement[i] & TTM_PL_FLAG_NO_EVICT) {
+				printk(KERN_ERR TTM_PFX "Need to be root to "
+					"modify NO_EVICT status.\n");
+				return -EINVAL;
+			}
+		}
+	}
+	for (i = 0; i < placement->num_busy_placement; i++) {
+		if (!capable(CAP_SYS_ADMIN)) {
+			if (placement->busy_placement[i] & TTM_PL_FLAG_NO_EVICT) {
+				printk(KERN_ERR TTM_PFX "Need to be root to "
+					"modify NO_EVICT status.\n");
+				return -EINVAL;
+			}
 		}
 	}
 	return 0;
 }
 
-int ttm_buffer_object_init(struct ttm_bo_device *bdev,
-			   struct ttm_buffer_object *bo,
-			   unsigned long size,
-			   enum ttm_bo_type type,
-			   uint32_t flags,
-			   uint32_t page_alignment,
-			   unsigned long buffer_start,
-			   bool interruptible,
-			   struct file *persistant_swap_storage,
-			   size_t acc_size,
-			   void (*destroy) (struct ttm_buffer_object *))
+int ttm_bo_init(struct ttm_bo_device *bdev,
+		struct ttm_buffer_object *bo,
+		unsigned long size,
+		enum ttm_bo_type type,
+		struct ttm_placement *placement,
+		uint32_t page_alignment,
+		unsigned long buffer_start,
+		bool interruptible,
+		struct file *persistant_swap_storage,
+		size_t acc_size,
+		void (*destroy) (struct ttm_buffer_object *))
 {
 	int ret = 0;
 	unsigned long num_pages;
@@ -1065,6 +1141,7 @@ int ttm_buffer_object_init(struct ttm_bo_device *bdev,
 	bo->glob = bdev->glob;
 	bo->type = type;
 	bo->num_pages = num_pages;
+	bo->mem.size = num_pages << PAGE_SHIFT;
 	bo->mem.mem_type = TTM_PL_SYSTEM;
 	bo->mem.num_pages = bo->num_pages;
 	bo->mem.mm_node = NULL;
@@ -1077,29 +1154,21 @@ int ttm_buffer_object_init(struct ttm_bo_device *bdev,
 	bo->acc_size = acc_size;
 	atomic_inc(&bo->glob->bo_count);
 
-	ret = ttm_bo_check_placement(bo, flags, 0ULL);
+	ret = ttm_bo_check_placement(bo, placement);
 	if (unlikely(ret != 0))
 		goto out_err;
 
 	/*
-	 * If no caching attributes are set, accept any form of caching.
-	 */
-
-	if ((flags & TTM_PL_MASK_CACHING) == 0)
-		flags |= TTM_PL_MASK_CACHING;
-
-	/*
 	 * For ttm_bo_type_device buffers, allocate
 	 * address space from the device.
 	 */
-
 	if (bo->type == ttm_bo_type_device) {
 		ret = ttm_bo_setup_vm(bo);
 		if (ret)
 			goto out_err;
 	}
 
-	ret = ttm_buffer_object_validate(bo, flags, interruptible, false);
+	ret = ttm_bo_validate(bo, placement, interruptible, false);
 	if (ret)
 		goto out_err;
 
@@ -1112,7 +1181,7 @@ out_err:
 
 	return ret;
 }
-EXPORT_SYMBOL(ttm_buffer_object_init);
+EXPORT_SYMBOL(ttm_bo_init);
 
 static inline size_t ttm_bo_size(struct ttm_bo_global *glob,
 				 unsigned long num_pages)
@@ -1123,19 +1192,19 @@ static inline size_t ttm_bo_size(struct ttm_bo_global *glob,
 	return glob->ttm_bo_size + 2 * page_array_size;
 }
 
-int ttm_buffer_object_create(struct ttm_bo_device *bdev,
-			     unsigned long size,
-			     enum ttm_bo_type type,
-			     uint32_t flags,
-			     uint32_t page_alignment,
-			     unsigned long buffer_start,
-			     bool interruptible,
-			     struct file *persistant_swap_storage,
-			     struct ttm_buffer_object **p_bo)
+int ttm_bo_create(struct ttm_bo_device *bdev,
+			unsigned long size,
+			enum ttm_bo_type type,
+			struct ttm_placement *placement,
+			uint32_t page_alignment,
+			unsigned long buffer_start,
+			bool interruptible,
+			struct file *persistant_swap_storage,
+			struct ttm_buffer_object **p_bo)
 {
 	struct ttm_buffer_object *bo;
-	int ret;
 	struct ttm_mem_global *mem_glob = bdev->glob->mem_glob;
+	int ret;
 
 	size_t acc_size =
 	    ttm_bo_size(bdev->glob, (size + PAGE_SIZE - 1) >> PAGE_SHIFT);
@@ -1150,76 +1219,41 @@ int ttm_buffer_object_create(struct ttm_bo_device *bdev,
 		return -ENOMEM;
 	}
 
-	ret = ttm_buffer_object_init(bdev, bo, size, type, flags,
-				     page_alignment, buffer_start,
-				     interruptible,
-				     persistant_swap_storage, acc_size, NULL);
+	ret = ttm_bo_init(bdev, bo, size, type, placement, page_alignment,
+				buffer_start, interruptible,
+				persistant_swap_storage, acc_size, NULL);
 	if (likely(ret == 0))
 		*p_bo = bo;
 
 	return ret;
 }
 
-static int ttm_bo_leave_list(struct ttm_buffer_object *bo,
-			     uint32_t mem_type, bool allow_errors)
-{
-	int ret;
-
-	spin_lock(&bo->lock);
-	ret = ttm_bo_wait(bo, false, false, false);
-	spin_unlock(&bo->lock);
-
-	if (ret && allow_errors)
-		goto out;
-
-	if (bo->mem.mem_type == mem_type)
-		ret = ttm_bo_evict(bo, mem_type, false, false);
-
-	if (ret) {
-		if (allow_errors) {
-			goto out;
-		} else {
-			ret = 0;
-			printk(KERN_ERR TTM_PFX "Cleanup eviction failed\n");
-		}
-	}
-
-out:
-	return ret;
-}
-
 static int ttm_bo_force_list_clean(struct ttm_bo_device *bdev,
-				   struct list_head *head,
-				   unsigned mem_type, bool allow_errors)
+					unsigned mem_type, bool allow_errors)
 {
+	struct ttm_mem_type_manager *man = &bdev->man[mem_type];
 	struct ttm_bo_global *glob = bdev->glob;
-	struct ttm_buffer_object *entry;
 	int ret;
-	int put_count;
 
 	/*
 	 * Can't use standard list traversal since we're unlocking.
 	 */
 
 	spin_lock(&glob->lru_lock);
-
-	while (!list_empty(head)) {
-		entry = list_first_entry(head, struct ttm_buffer_object, lru);
-		kref_get(&entry->list_kref);
-		ret = ttm_bo_reserve_locked(entry, false, false, false, 0);
-		put_count = ttm_bo_del_from_lru(entry);
+	while (!list_empty(&man->lru)) {
 		spin_unlock(&glob->lru_lock);
-		while (put_count--)
-			kref_put(&entry->list_kref, ttm_bo_ref_bug);
-		BUG_ON(ret);
-		ret = ttm_bo_leave_list(entry, mem_type, allow_errors);
-		ttm_bo_unreserve(entry);
-		kref_put(&entry->list_kref, ttm_bo_release_list);
+		ret = ttm_mem_evict_first(bdev, mem_type, false, false);
+		if (ret) {
+			if (allow_errors) {
+				return ret;
+			} else {
+				printk(KERN_ERR TTM_PFX
+					"Cleanup eviction failed\n");
+			}
+		}
 		spin_lock(&glob->lru_lock);
 	}
-
 	spin_unlock(&glob->lru_lock);
-
 	return 0;
 }
 
@@ -1246,7 +1280,7 @@ int ttm_bo_clean_mm(struct ttm_bo_device *bdev, unsigned mem_type)
 
 	ret = 0;
 	if (mem_type > 0) {
-		ttm_bo_force_list_clean(bdev, &man->lru, mem_type, false);
+		ttm_bo_force_list_clean(bdev, mem_type, false);
 
 		spin_lock(&glob->lru_lock);
 		if (drm_mm_clean(&man->manager))
@@ -1279,12 +1313,12 @@ int ttm_bo_evict_mm(struct ttm_bo_device *bdev, unsigned mem_type)
 		return 0;
 	}
 
-	return ttm_bo_force_list_clean(bdev, &man->lru, mem_type, true);
+	return ttm_bo_force_list_clean(bdev, mem_type, true);
 }
 EXPORT_SYMBOL(ttm_bo_evict_mm);
 
 int ttm_bo_init_mm(struct ttm_bo_device *bdev, unsigned type,
-		   unsigned long p_offset, unsigned long p_size)
+			unsigned long p_size)
 {
 	int ret = -EINVAL;
 	struct ttm_mem_type_manager *man;
@@ -1314,7 +1348,7 @@ int ttm_bo_init_mm(struct ttm_bo_device *bdev, unsigned type,
 			       type);
 			return ret;
 		}
-		ret = drm_mm_init(&man->manager, p_offset, p_size);
+		ret = drm_mm_init(&man->manager, 0, p_size);
 		if (ret)
 			return ret;
 	}
@@ -1463,7 +1497,7 @@ int ttm_bo_device_init(struct ttm_bo_device *bdev,
 	 * Initialize the system memory buffer type.
 	 * Other types need to be driver / IOCTL initialized.
 	 */
-	ret = ttm_bo_init_mm(bdev, TTM_PL_SYSTEM, 0, 0);
+	ret = ttm_bo_init_mm(bdev, TTM_PL_SYSTEM, 0);
 	if (unlikely(ret != 0))
 		goto out_no_sys;
 
@@ -1693,7 +1727,7 @@ int ttm_bo_block_reservation(struct ttm_buffer_object *bo, bool interruptible,
 			ret = wait_event_interruptible
 			    (bo->event_queue, atomic_read(&bo->reserved) == 0);
 			if (unlikely(ret != 0))
-				return -ERESTART;
+				return ret;
 		} else {
 			wait_event(bo->event_queue,
 				   atomic_read(&bo->reserved) == 0);
@@ -1722,12 +1756,14 @@ int ttm_bo_synccpu_write_grab(struct ttm_buffer_object *bo, bool no_wait)
 	ttm_bo_unreserve(bo);
 	return ret;
 }
+EXPORT_SYMBOL(ttm_bo_synccpu_write_grab);
 
 void ttm_bo_synccpu_write_release(struct ttm_buffer_object *bo)
 {
 	if (atomic_dec_and_test(&bo->cpu_writers))
 		wake_up_all(&bo->event_queue);
 }
+EXPORT_SYMBOL(ttm_bo_synccpu_write_release);
 
 /**
  * A buffer object shrink method that tries to swap out the first
diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
index c70927ecda21..2ecf7d0c64f6 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
@@ -369,6 +369,7 @@ pgprot_t ttm_io_prot(uint32_t caching_flags, pgprot_t tmp)
 #endif
 	return tmp;
 }
+EXPORT_SYMBOL(ttm_io_prot);
 
 static int ttm_bo_ioremap(struct ttm_buffer_object *bo,
 			  unsigned long bus_base,
@@ -427,7 +428,7 @@ static int ttm_bo_kmap_ttm(struct ttm_buffer_object *bo,
 
 		/*
 		 * We need to use vmap to get the desired page protection
-		 * or to make the buffer object look contigous.
+		 * or to make the buffer object look contiguous.
 		 */
 		prot = (mem->placement & TTM_PL_FLAG_CACHED) ?
 			PAGE_KERNEL :
diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c
index 1c040d040338..668dbe8b8dd3 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
@@ -114,7 +114,7 @@ static int ttm_bo_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
 		ret = ttm_bo_wait(bo, false, true, false);
 		spin_unlock(&bo->lock);
 		if (unlikely(ret != 0)) {
-			retval = (ret != -ERESTART) ?
+			retval = (ret != -ERESTARTSYS) ?
 			    VM_FAULT_SIGBUS : VM_FAULT_NOPAGE;
 			goto out_unlock;
 		}
@@ -320,7 +320,7 @@ ssize_t ttm_bo_io(struct ttm_bo_device *bdev, struct file *filp,
 		return -EFAULT;
 
 	driver = bo->bdev->driver;
-	if (unlikely(driver->verify_access)) {
+	if (unlikely(!driver->verify_access)) {
 		ret = -EPERM;
 		goto out_unref;
 	}
@@ -349,9 +349,6 @@ ssize_t ttm_bo_io(struct ttm_bo_device *bdev, struct file *filp,
 	switch (ret) {
 	case 0:
 		break;
-	case -ERESTART:
-		ret = -EINTR;
-		goto out_unref;
 	case -EBUSY:
 		ret = -EAGAIN;
 		goto out_unref;
@@ -421,8 +418,6 @@ ssize_t ttm_bo_fbdev_io(struct ttm_buffer_object *bo, const char __user *wbuf,
 	switch (ret) {
 	case 0:
 		break;
-	case -ERESTART:
-		return -EINTR;
 	case -EBUSY:
 		return -EAGAIN;
 	default:
diff --git a/drivers/gpu/drm/ttm/ttm_execbuf_util.c b/drivers/gpu/drm/ttm/ttm_execbuf_util.c
new file mode 100644
index 000000000000..c285c2902d15
--- /dev/null
+++ b/drivers/gpu/drm/ttm/ttm_execbuf_util.c
@@ -0,0 +1,117 @@
+/**************************************************************************
+ *
+ * Copyright (c) 2006-2009 VMware, Inc., Palo Alto, CA., USA
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ **************************************************************************/
+
+#include "ttm/ttm_execbuf_util.h"
+#include "ttm/ttm_bo_driver.h"
+#include "ttm/ttm_placement.h"
+#include <linux/wait.h>
+#include <linux/sched.h>
+#include <linux/module.h>
+
+void ttm_eu_backoff_reservation(struct list_head *list)
+{
+	struct ttm_validate_buffer *entry;
+
+	list_for_each_entry(entry, list, head) {
+		struct ttm_buffer_object *bo = entry->bo;
+		if (!entry->reserved)
+			continue;
+
+		entry->reserved = false;
+		ttm_bo_unreserve(bo);
+	}
+}
+EXPORT_SYMBOL(ttm_eu_backoff_reservation);
+
+/*
+ * Reserve buffers for validation.
+ *
+ * If a buffer in the list is marked for CPU access, we back off and
+ * wait for that buffer to become free for GPU access.
+ *
+ * If a buffer is reserved for another validation, the validator with
+ * the highest validation sequence backs off and waits for that buffer
+ * to become unreserved. This prevents deadlocks when validating multiple
+ * buffers in different orders.
+ */
+
+int ttm_eu_reserve_buffers(struct list_head *list, uint32_t val_seq)
+{
+	struct ttm_validate_buffer *entry;
+	int ret;
+
+retry:
+	list_for_each_entry(entry, list, head) {
+		struct ttm_buffer_object *bo = entry->bo;
+
+		entry->reserved = false;
+		ret = ttm_bo_reserve(bo, true, false, true, val_seq);
+		if (ret != 0) {
+			ttm_eu_backoff_reservation(list);
+			if (ret == -EAGAIN) {
+				ret = ttm_bo_wait_unreserved(bo, true);
+				if (unlikely(ret != 0))
+					return ret;
+				goto retry;
+			} else
+				return ret;
+		}
+
+		entry->reserved = true;
+		if (unlikely(atomic_read(&bo->cpu_writers) > 0)) {
+			ttm_eu_backoff_reservation(list);
+			ret = ttm_bo_wait_cpu(bo, false);
+			if (ret)
+				return ret;
+			goto retry;
+		}
+	}
+	return 0;
+}
+EXPORT_SYMBOL(ttm_eu_reserve_buffers);
+
+void ttm_eu_fence_buffer_objects(struct list_head *list, void *sync_obj)
+{
+	struct ttm_validate_buffer *entry;
+
+	list_for_each_entry(entry, list, head) {
+		struct ttm_buffer_object *bo = entry->bo;
+		struct ttm_bo_driver *driver = bo->bdev->driver;
+		void *old_sync_obj;
+
+		spin_lock(&bo->lock);
+		old_sync_obj = bo->sync_obj;
+		bo->sync_obj = driver->sync_obj_ref(sync_obj);
+		bo->sync_obj_arg = entry->new_sync_obj_arg;
+		spin_unlock(&bo->lock);
+		ttm_bo_unreserve(bo);
+		entry->reserved = false;
+		if (old_sync_obj)
+			driver->sync_obj_unref(&old_sync_obj);
+	}
+}
+EXPORT_SYMBOL(ttm_eu_fence_buffer_objects);
diff --git a/drivers/gpu/drm/ttm/ttm_lock.c b/drivers/gpu/drm/ttm/ttm_lock.c
new file mode 100644
index 000000000000..f619ebcaa4ec
--- /dev/null
+++ b/drivers/gpu/drm/ttm/ttm_lock.c
@@ -0,0 +1,311 @@
+/**************************************************************************
+ *
+ * Copyright (c) 2007-2009 VMware, Inc., Palo Alto, CA., USA
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ **************************************************************************/
+/*
+ * Authors: Thomas Hellstrom <thellstrom-at-vmware-dot-com>
+ */
+
+#include "ttm/ttm_lock.h"
+#include "ttm/ttm_module.h"
+#include <asm/atomic.h>
+#include <linux/errno.h>
+#include <linux/wait.h>
+#include <linux/sched.h>
+#include <linux/module.h>
+
+#define TTM_WRITE_LOCK_PENDING    (1 << 0)
+#define TTM_VT_LOCK_PENDING       (1 << 1)
+#define TTM_SUSPEND_LOCK_PENDING  (1 << 2)
+#define TTM_VT_LOCK               (1 << 3)
+#define TTM_SUSPEND_LOCK          (1 << 4)
+
+void ttm_lock_init(struct ttm_lock *lock)
+{
+	spin_lock_init(&lock->lock);
+	init_waitqueue_head(&lock->queue);
+	lock->rw = 0;
+	lock->flags = 0;
+	lock->kill_takers = false;
+	lock->signal = SIGKILL;
+}
+EXPORT_SYMBOL(ttm_lock_init);
+
+void ttm_read_unlock(struct ttm_lock *lock)
+{
+	spin_lock(&lock->lock);
+	if (--lock->rw == 0)
+		wake_up_all(&lock->queue);
+	spin_unlock(&lock->lock);
+}
+EXPORT_SYMBOL(ttm_read_unlock);
+
+static bool __ttm_read_lock(struct ttm_lock *lock)
+{
+	bool locked = false;
+
+	spin_lock(&lock->lock);
+	if (unlikely(lock->kill_takers)) {
+		send_sig(lock->signal, current, 0);
+		spin_unlock(&lock->lock);
+		return false;
+	}
+	if (lock->rw >= 0 && lock->flags == 0) {
+		++lock->rw;
+		locked = true;
+	}
+	spin_unlock(&lock->lock);
+	return locked;
+}
+
+int ttm_read_lock(struct ttm_lock *lock, bool interruptible)
+{
+	int ret = 0;
+
+	if (interruptible)
+		ret = wait_event_interruptible(lock->queue,
+					       __ttm_read_lock(lock));
+	else
+		wait_event(lock->queue, __ttm_read_lock(lock));
+	return ret;
+}
+EXPORT_SYMBOL(ttm_read_lock);
+
+static bool __ttm_read_trylock(struct ttm_lock *lock, bool *locked)
+{
+	bool block = true;
+
+	*locked = false;
+
+	spin_lock(&lock->lock);
+	if (unlikely(lock->kill_takers)) {
+		send_sig(lock->signal, current, 0);
+		spin_unlock(&lock->lock);
+		return false;
+	}
+	if (lock->rw >= 0 && lock->flags == 0) {
+		++lock->rw;
+		block = false;
+		*locked = true;
+	} else if (lock->flags == 0) {
+		block = false;
+	}
+	spin_unlock(&lock->lock);
+
+	return !block;
+}
+
+int ttm_read_trylock(struct ttm_lock *lock, bool interruptible)
+{
+	int ret = 0;
+	bool locked;
+
+	if (interruptible)
+		ret = wait_event_interruptible
+			(lock->queue, __ttm_read_trylock(lock, &locked));
+	else
+		wait_event(lock->queue, __ttm_read_trylock(lock, &locked));
+
+	if (unlikely(ret != 0)) {
+		BUG_ON(locked);
+		return ret;
+	}
+
+	return (locked) ? 0 : -EBUSY;
+}
+
+void ttm_write_unlock(struct ttm_lock *lock)
+{
+	spin_lock(&lock->lock);
+	lock->rw = 0;
+	wake_up_all(&lock->queue);
+	spin_unlock(&lock->lock);
+}
+EXPORT_SYMBOL(ttm_write_unlock);
+
+static bool __ttm_write_lock(struct ttm_lock *lock)
+{
+	bool locked = false;
+
+	spin_lock(&lock->lock);
+	if (unlikely(lock->kill_takers)) {
+		send_sig(lock->signal, current, 0);
+		spin_unlock(&lock->lock);
+		return false;
+	}
+	if (lock->rw == 0 && ((lock->flags & ~TTM_WRITE_LOCK_PENDING) == 0)) {
+		lock->rw = -1;
+		lock->flags &= ~TTM_WRITE_LOCK_PENDING;
+		locked = true;
+	} else {
+		lock->flags |= TTM_WRITE_LOCK_PENDING;
+	}
+	spin_unlock(&lock->lock);
+	return locked;
+}
+
+int ttm_write_lock(struct ttm_lock *lock, bool interruptible)
+{
+	int ret = 0;
+
+	if (interruptible) {
+		ret = wait_event_interruptible(lock->queue,
+					       __ttm_write_lock(lock));
+		if (unlikely(ret != 0)) {
+			spin_lock(&lock->lock);
+			lock->flags &= ~TTM_WRITE_LOCK_PENDING;
+			wake_up_all(&lock->queue);
+			spin_unlock(&lock->lock);
+		}
+	} else
+		wait_event(lock->queue, __ttm_read_lock(lock));
+
+	return ret;
+}
+EXPORT_SYMBOL(ttm_write_lock);
+
+void ttm_write_lock_downgrade(struct ttm_lock *lock)
+{
+	spin_lock(&lock->lock);
+	lock->rw = 1;
+	wake_up_all(&lock->queue);
+	spin_unlock(&lock->lock);
+}
+
+static int __ttm_vt_unlock(struct ttm_lock *lock)
+{
+	int ret = 0;
+
+	spin_lock(&lock->lock);
+	if (unlikely(!(lock->flags & TTM_VT_LOCK)))
+		ret = -EINVAL;
+	lock->flags &= ~TTM_VT_LOCK;
+	wake_up_all(&lock->queue);
+	spin_unlock(&lock->lock);
+	printk(KERN_INFO TTM_PFX "vt unlock.\n");
+
+	return ret;
+}
+
+static void ttm_vt_lock_remove(struct ttm_base_object **p_base)
+{
+	struct ttm_base_object *base = *p_base;
+	struct ttm_lock *lock = container_of(base, struct ttm_lock, base);
+	int ret;
+
+	*p_base = NULL;
+	ret = __ttm_vt_unlock(lock);
+	BUG_ON(ret != 0);
+}
+
+static bool __ttm_vt_lock(struct ttm_lock *lock)
+{
+	bool locked = false;
+
+	spin_lock(&lock->lock);
+	if (lock->rw == 0) {
+		lock->flags &= ~TTM_VT_LOCK_PENDING;
+		lock->flags |= TTM_VT_LOCK;
+		locked = true;
+	} else {
+		lock->flags |= TTM_VT_LOCK_PENDING;
+	}
+	spin_unlock(&lock->lock);
+	return locked;
+}
+
+int ttm_vt_lock(struct ttm_lock *lock,
+		bool interruptible,
+		struct ttm_object_file *tfile)
+{
+	int ret = 0;
+
+	if (interruptible) {
+		ret = wait_event_interruptible(lock->queue,
+					       __ttm_vt_lock(lock));
+		if (unlikely(ret != 0)) {
+			spin_lock(&lock->lock);
+			lock->flags &= ~TTM_VT_LOCK_PENDING;
+			wake_up_all(&lock->queue);
+			spin_unlock(&lock->lock);
+			return ret;
+		}
+	} else
+		wait_event(lock->queue, __ttm_vt_lock(lock));
+
+	/*
+	 * Add a base-object, the destructor of which will
+	 * make sure the lock is released if the client dies
+	 * while holding it.
+	 */
+
+	ret = ttm_base_object_init(tfile, &lock->base, false,
+				   ttm_lock_type, &ttm_vt_lock_remove, NULL);
+	if (ret)
+		(void)__ttm_vt_unlock(lock);
+	else {
+		lock->vt_holder = tfile;
+		printk(KERN_INFO TTM_PFX "vt lock.\n");
+	}
+
+	return ret;
+}
+EXPORT_SYMBOL(ttm_vt_lock);
+
+int ttm_vt_unlock(struct ttm_lock *lock)
+{
+	return ttm_ref_object_base_unref(lock->vt_holder,
+					 lock->base.hash.key, TTM_REF_USAGE);
+}
+EXPORT_SYMBOL(ttm_vt_unlock);
+
+void ttm_suspend_unlock(struct ttm_lock *lock)
+{
+	spin_lock(&lock->lock);
+	lock->flags &= ~TTM_SUSPEND_LOCK;
+	wake_up_all(&lock->queue);
+	spin_unlock(&lock->lock);
+}
+
+static bool __ttm_suspend_lock(struct ttm_lock *lock)
+{
+	bool locked = false;
+
+	spin_lock(&lock->lock);
+	if (lock->rw == 0) {
+		lock->flags &= ~TTM_SUSPEND_LOCK_PENDING;
+		lock->flags |= TTM_SUSPEND_LOCK;
+		locked = true;
+	} else {
+		lock->flags |= TTM_SUSPEND_LOCK_PENDING;
+	}
+	spin_unlock(&lock->lock);
+	return locked;
+}
+
+void ttm_suspend_lock(struct ttm_lock *lock)
+{
+	wait_event(lock->queue, __ttm_suspend_lock(lock));
+}
diff --git a/drivers/gpu/drm/ttm/ttm_memory.c b/drivers/gpu/drm/ttm/ttm_memory.c
index 072c281a6bb5..f5245c02b8fd 100644
--- a/drivers/gpu/drm/ttm/ttm_memory.c
+++ b/drivers/gpu/drm/ttm/ttm_memory.c
@@ -274,16 +274,17 @@ static int ttm_mem_init_kernel_zone(struct ttm_mem_global *glob,
 static int ttm_mem_init_highmem_zone(struct ttm_mem_global *glob,
 				     const struct sysinfo *si)
 {
-	struct ttm_mem_zone *zone = kzalloc(sizeof(*zone), GFP_KERNEL);
+	struct ttm_mem_zone *zone;
 	uint64_t mem;
 	int ret;
 
-	if (unlikely(!zone))
-		return -ENOMEM;
-
 	if (si->totalhigh == 0)
 		return 0;
 
+	zone = kzalloc(sizeof(*zone), GFP_KERNEL);
+	if (unlikely(!zone))
+		return -ENOMEM;
+
 	mem = si->totalram;
 	mem *= si->mem_unit;
 
@@ -322,8 +323,10 @@ static int ttm_mem_init_dma32_zone(struct ttm_mem_global *glob,
 	 * No special dma32 zone needed.
 	 */
 
-	if (mem <= ((uint64_t) 1ULL << 32))
+	if (mem <= ((uint64_t) 1ULL << 32)) {
+		kfree(zone);
 		return 0;
+	}
 
 	/*
 	 * Limit max dma32 memory to 4GB for now
@@ -460,6 +463,7 @@ void ttm_mem_global_free(struct ttm_mem_global *glob,
 {
 	return ttm_mem_global_free_zone(glob, NULL, amount);
 }
+EXPORT_SYMBOL(ttm_mem_global_free);
 
 static int ttm_mem_global_reserve(struct ttm_mem_global *glob,
 				  struct ttm_mem_zone *single_zone,
@@ -533,6 +537,7 @@ int ttm_mem_global_alloc(struct ttm_mem_global *glob, uint64_t memory,
 	return ttm_mem_global_alloc_zone(glob, NULL, memory, no_wait,
 					 interruptible);
 }
+EXPORT_SYMBOL(ttm_mem_global_alloc);
 
 int ttm_mem_global_alloc_page(struct ttm_mem_global *glob,
 			      struct page *page,
@@ -588,3 +593,4 @@ size_t ttm_round_pot(size_t size)
 	}
 	return 0;
 }
+EXPORT_SYMBOL(ttm_round_pot);
diff --git a/drivers/gpu/drm/ttm/ttm_object.c b/drivers/gpu/drm/ttm/ttm_object.c
new file mode 100644
index 000000000000..1099abac824b
--- /dev/null
+++ b/drivers/gpu/drm/ttm/ttm_object.c
@@ -0,0 +1,452 @@
+/**************************************************************************
+ *
+ * Copyright (c) 2009 VMware, Inc., Palo Alto, CA., USA
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ **************************************************************************/
+/*
+ * Authors: Thomas Hellstrom <thellstrom-at-vmware-dot-com>
+ */
+/** @file ttm_ref_object.c
+ *
+ * Base- and reference object implementation for the various
+ * ttm objects. Implements reference counting, minimal security checks
+ * and release on file close.
+ */
+
+/**
+ * struct ttm_object_file
+ *
+ * @tdev: Pointer to the ttm_object_device.
+ *
+ * @lock: Lock that protects the ref_list list and the
+ * ref_hash hash tables.
+ *
+ * @ref_list: List of ttm_ref_objects to be destroyed at
+ * file release.
+ *
+ * @ref_hash: Hash tables of ref objects, one per ttm_ref_type,
+ * for fast lookup of ref objects given a base object.
+ */
+
+#include "ttm/ttm_object.h"
+#include "ttm/ttm_module.h"
+#include <linux/list.h>
+#include <linux/spinlock.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <asm/atomic.h>
+
+struct ttm_object_file {
+	struct ttm_object_device *tdev;
+	rwlock_t lock;
+	struct list_head ref_list;
+	struct drm_open_hash ref_hash[TTM_REF_NUM];
+	struct kref refcount;
+};
+
+/**
+ * struct ttm_object_device
+ *
+ * @object_lock: lock that protects the object_hash hash table.
+ *
+ * @object_hash: hash table for fast lookup of object global names.
+ *
+ * @object_count: Per device object count.
+ *
+ * This is the per-device data structure needed for ttm object management.
+ */
+
+struct ttm_object_device {
+	rwlock_t object_lock;
+	struct drm_open_hash object_hash;
+	atomic_t object_count;
+	struct ttm_mem_global *mem_glob;
+};
+
+/**
+ * struct ttm_ref_object
+ *
+ * @hash: Hash entry for the per-file object reference hash.
+ *
+ * @head: List entry for the per-file list of ref-objects.
+ *
+ * @kref: Ref count.
+ *
+ * @obj: Base object this ref object is referencing.
+ *
+ * @ref_type: Type of ref object.
+ *
+ * This is similar to an idr object, but it also has a hash table entry
+ * that allows lookup with a pointer to the referenced object as a key. In
+ * that way, one can easily detect whether a base object is referenced by
+ * a particular ttm_object_file. It also carries a ref count to avoid creating
+ * multiple ref objects if a ttm_object_file references the same base
+ * object more than once.
+ */
+
+struct ttm_ref_object {
+	struct drm_hash_item hash;
+	struct list_head head;
+	struct kref kref;
+	struct ttm_base_object *obj;
+	enum ttm_ref_type ref_type;
+	struct ttm_object_file *tfile;
+};
+
+static inline struct ttm_object_file *
+ttm_object_file_ref(struct ttm_object_file *tfile)
+{
+	kref_get(&tfile->refcount);
+	return tfile;
+}
+
+static void ttm_object_file_destroy(struct kref *kref)
+{
+	struct ttm_object_file *tfile =
+		container_of(kref, struct ttm_object_file, refcount);
+
+	kfree(tfile);
+}
+
+
+static inline void ttm_object_file_unref(struct ttm_object_file **p_tfile)
+{
+	struct ttm_object_file *tfile = *p_tfile;
+
+	*p_tfile = NULL;
+	kref_put(&tfile->refcount, ttm_object_file_destroy);
+}
+
+
+int ttm_base_object_init(struct ttm_object_file *tfile,
+			 struct ttm_base_object *base,
+			 bool shareable,
+			 enum ttm_object_type object_type,
+			 void (*refcount_release) (struct ttm_base_object **),
+			 void (*ref_obj_release) (struct ttm_base_object *,
+						  enum ttm_ref_type ref_type))
+{
+	struct ttm_object_device *tdev = tfile->tdev;
+	int ret;
+
+	base->shareable = shareable;
+	base->tfile = ttm_object_file_ref(tfile);
+	base->refcount_release = refcount_release;
+	base->ref_obj_release = ref_obj_release;
+	base->object_type = object_type;
+	write_lock(&tdev->object_lock);
+	kref_init(&base->refcount);
+	ret = drm_ht_just_insert_please(&tdev->object_hash,
+					&base->hash,
+					(unsigned long)base, 31, 0, 0);
+	write_unlock(&tdev->object_lock);
+	if (unlikely(ret != 0))
+		goto out_err0;
+
+	ret = ttm_ref_object_add(tfile, base, TTM_REF_USAGE, NULL);
+	if (unlikely(ret != 0))
+		goto out_err1;
+
+	ttm_base_object_unref(&base);
+
+	return 0;
+out_err1:
+	(void)drm_ht_remove_item(&tdev->object_hash, &base->hash);
+out_err0:
+	return ret;
+}
+EXPORT_SYMBOL(ttm_base_object_init);
+
+static void ttm_release_base(struct kref *kref)
+{
+	struct ttm_base_object *base =
+	    container_of(kref, struct ttm_base_object, refcount);
+	struct ttm_object_device *tdev = base->tfile->tdev;
+
+	(void)drm_ht_remove_item(&tdev->object_hash, &base->hash);
+	write_unlock(&tdev->object_lock);
+	if (base->refcount_release) {
+		ttm_object_file_unref(&base->tfile);
+		base->refcount_release(&base);
+	}
+	write_lock(&tdev->object_lock);
+}
+
+void ttm_base_object_unref(struct ttm_base_object **p_base)
+{
+	struct ttm_base_object *base = *p_base;
+	struct ttm_object_device *tdev = base->tfile->tdev;
+
+	*p_base = NULL;
+
+	/*
+	 * Need to take the lock here to avoid racing with
+	 * users trying to look up the object.
+	 */
+
+	write_lock(&tdev->object_lock);
+	(void)kref_put(&base->refcount, &ttm_release_base);
+	write_unlock(&tdev->object_lock);
+}
+EXPORT_SYMBOL(ttm_base_object_unref);
+
+struct ttm_base_object *ttm_base_object_lookup(struct ttm_object_file *tfile,
+					       uint32_t key)
+{
+	struct ttm_object_device *tdev = tfile->tdev;
+	struct ttm_base_object *base;
+	struct drm_hash_item *hash;
+	int ret;
+
+	read_lock(&tdev->object_lock);
+	ret = drm_ht_find_item(&tdev->object_hash, key, &hash);
+
+	if (likely(ret == 0)) {
+		base = drm_hash_entry(hash, struct ttm_base_object, hash);
+		kref_get(&base->refcount);
+	}
+	read_unlock(&tdev->object_lock);
+
+	if (unlikely(ret != 0))
+		return NULL;
+
+	if (tfile != base->tfile && !base->shareable) {
+		printk(KERN_ERR TTM_PFX
+		       "Attempted access of non-shareable object.\n");
+		ttm_base_object_unref(&base);
+		return NULL;
+	}
+
+	return base;
+}
+EXPORT_SYMBOL(ttm_base_object_lookup);
+
+int ttm_ref_object_add(struct ttm_object_file *tfile,
+		       struct ttm_base_object *base,
+		       enum ttm_ref_type ref_type, bool *existed)
+{
+	struct drm_open_hash *ht = &tfile->ref_hash[ref_type];
+	struct ttm_ref_object *ref;
+	struct drm_hash_item *hash;
+	struct ttm_mem_global *mem_glob = tfile->tdev->mem_glob;
+	int ret = -EINVAL;
+
+	if (existed != NULL)
+		*existed = true;
+
+	while (ret == -EINVAL) {
+		read_lock(&tfile->lock);
+		ret = drm_ht_find_item(ht, base->hash.key, &hash);
+
+		if (ret == 0) {
+			ref = drm_hash_entry(hash, struct ttm_ref_object, hash);
+			kref_get(&ref->kref);
+			read_unlock(&tfile->lock);
+			break;
+		}
+
+		read_unlock(&tfile->lock);
+		ret = ttm_mem_global_alloc(mem_glob, sizeof(*ref),
+					   false, false);
+		if (unlikely(ret != 0))
+			return ret;
+		ref = kmalloc(sizeof(*ref), GFP_KERNEL);
+		if (unlikely(ref == NULL)) {
+			ttm_mem_global_free(mem_glob, sizeof(*ref));
+			return -ENOMEM;
+		}
+
+		ref->hash.key = base->hash.key;
+		ref->obj = base;
+		ref->tfile = tfile;
+		ref->ref_type = ref_type;
+		kref_init(&ref->kref);
+
+		write_lock(&tfile->lock);
+		ret = drm_ht_insert_item(ht, &ref->hash);
+
+		if (likely(ret == 0)) {
+			list_add_tail(&ref->head, &tfile->ref_list);
+			kref_get(&base->refcount);
+			write_unlock(&tfile->lock);
+			if (existed != NULL)
+				*existed = false;
+			break;
+		}
+
+		write_unlock(&tfile->lock);
+		BUG_ON(ret != -EINVAL);
+
+		ttm_mem_global_free(mem_glob, sizeof(*ref));
+		kfree(ref);
+	}
+
+	return ret;
+}
+EXPORT_SYMBOL(ttm_ref_object_add);
+
+static void ttm_ref_object_release(struct kref *kref)
+{
+	struct ttm_ref_object *ref =
+	    container_of(kref, struct ttm_ref_object, kref);
+	struct ttm_base_object *base = ref->obj;
+	struct ttm_object_file *tfile = ref->tfile;
+	struct drm_open_hash *ht;
+	struct ttm_mem_global *mem_glob = tfile->tdev->mem_glob;
+
+	ht = &tfile->ref_hash[ref->ref_type];
+	(void)drm_ht_remove_item(ht, &ref->hash);
+	list_del(&ref->head);
+	write_unlock(&tfile->lock);
+
+	if (ref->ref_type != TTM_REF_USAGE && base->ref_obj_release)
+		base->ref_obj_release(base, ref->ref_type);
+
+	ttm_base_object_unref(&ref->obj);
+	ttm_mem_global_free(mem_glob, sizeof(*ref));
+	kfree(ref);
+	write_lock(&tfile->lock);
+}
+
+int ttm_ref_object_base_unref(struct ttm_object_file *tfile,
+			      unsigned long key, enum ttm_ref_type ref_type)
+{
+	struct drm_open_hash *ht = &tfile->ref_hash[ref_type];
+	struct ttm_ref_object *ref;
+	struct drm_hash_item *hash;
+	int ret;
+
+	write_lock(&tfile->lock);
+	ret = drm_ht_find_item(ht, key, &hash);
+	if (unlikely(ret != 0)) {
+		write_unlock(&tfile->lock);
+		return -EINVAL;
+	}
+	ref = drm_hash_entry(hash, struct ttm_ref_object, hash);
+	kref_put(&ref->kref, ttm_ref_object_release);
+	write_unlock(&tfile->lock);
+	return 0;
+}
+EXPORT_SYMBOL(ttm_ref_object_base_unref);
+
+void ttm_object_file_release(struct ttm_object_file **p_tfile)
+{
+	struct ttm_ref_object *ref;
+	struct list_head *list;
+	unsigned int i;
+	struct ttm_object_file *tfile = *p_tfile;
+
+	*p_tfile = NULL;
+	write_lock(&tfile->lock);
+
+	/*
+	 * Since we release the lock within the loop, we have to
+	 * restart it from the beginning each time.
+	 */
+
+	while (!list_empty(&tfile->ref_list)) {
+		list = tfile->ref_list.next;
+		ref = list_entry(list, struct ttm_ref_object, head);
+		ttm_ref_object_release(&ref->kref);
+	}
+
+	for (i = 0; i < TTM_REF_NUM; ++i)
+		drm_ht_remove(&tfile->ref_hash[i]);
+
+	write_unlock(&tfile->lock);
+	ttm_object_file_unref(&tfile);
+}
+EXPORT_SYMBOL(ttm_object_file_release);
+
+struct ttm_object_file *ttm_object_file_init(struct ttm_object_device *tdev,
+					     unsigned int hash_order)
+{
+	struct ttm_object_file *tfile = kmalloc(sizeof(*tfile), GFP_KERNEL);
+	unsigned int i;
+	unsigned int j = 0;
+	int ret;
+
+	if (unlikely(tfile == NULL))
+		return NULL;
+
+	rwlock_init(&tfile->lock);
+	tfile->tdev = tdev;
+	kref_init(&tfile->refcount);
+	INIT_LIST_HEAD(&tfile->ref_list);
+
+	for (i = 0; i < TTM_REF_NUM; ++i) {
+		ret = drm_ht_create(&tfile->ref_hash[i], hash_order);
+		if (ret) {
+			j = i;
+			goto out_err;
+		}
+	}
+
+	return tfile;
+out_err:
+	for (i = 0; i < j; ++i)
+		drm_ht_remove(&tfile->ref_hash[i]);
+
+	kfree(tfile);
+
+	return NULL;
+}
+EXPORT_SYMBOL(ttm_object_file_init);
+
+struct ttm_object_device *ttm_object_device_init(struct ttm_mem_global
+						 *mem_glob,
+						 unsigned int hash_order)
+{
+	struct ttm_object_device *tdev = kmalloc(sizeof(*tdev), GFP_KERNEL);
+	int ret;
+
+	if (unlikely(tdev == NULL))
+		return NULL;
+
+	tdev->mem_glob = mem_glob;
+	rwlock_init(&tdev->object_lock);
+	atomic_set(&tdev->object_count, 0);
+	ret = drm_ht_create(&tdev->object_hash, hash_order);
+
+	if (likely(ret == 0))
+		return tdev;
+
+	kfree(tdev);
+	return NULL;
+}
+EXPORT_SYMBOL(ttm_object_device_init);
+
+void ttm_object_device_release(struct ttm_object_device **p_tdev)
+{
+	struct ttm_object_device *tdev = *p_tdev;
+
+	*p_tdev = NULL;
+
+	write_lock(&tdev->object_lock);
+	drm_ht_remove(&tdev->object_hash);
+	write_unlock(&tdev->object_lock);
+
+	kfree(tdev);
+}
+EXPORT_SYMBOL(ttm_object_device_release);
diff --git a/drivers/gpu/drm/ttm/ttm_tt.c b/drivers/gpu/drm/ttm/ttm_tt.c
index 7bcb89f39ce8..9c2b1cc5dba5 100644
--- a/drivers/gpu/drm/ttm/ttm_tt.c
+++ b/drivers/gpu/drm/ttm/ttm_tt.c
@@ -192,6 +192,7 @@ int ttm_tt_populate(struct ttm_tt *ttm)
 	ttm->state = tt_unbound;
 	return 0;
 }
+EXPORT_SYMBOL(ttm_tt_populate);
 
 #ifdef CONFIG_X86
 static inline int ttm_tt_set_page_caching(struct page *p,
diff --git a/drivers/gpu/drm/via/via_drv.c b/drivers/gpu/drm/via/via_drv.c
index bc2f51843005..7a1b210401e0 100644
--- a/drivers/gpu/drm/via/via_drv.c
+++ b/drivers/gpu/drm/via/via_drv.c
@@ -58,7 +58,7 @@ static struct drm_driver driver = {
 		.owner = THIS_MODULE,
 		.open = drm_open,
 		.release = drm_release,
-		.ioctl = drm_ioctl,
+		.unlocked_ioctl = drm_ioctl,
 		.mmap = drm_mmap,
 		.poll = drm_poll,
 		.fasync = drm_fasync,
diff --git a/drivers/gpu/drm/vmwgfx/Kconfig b/drivers/gpu/drm/vmwgfx/Kconfig
new file mode 100644
index 000000000000..f20b8bcbef39
--- /dev/null
+++ b/drivers/gpu/drm/vmwgfx/Kconfig
@@ -0,0 +1,13 @@
+config DRM_VMWGFX
+	tristate "DRM driver for VMware Virtual GPU"
+	depends on DRM && PCI
+	select FB_DEFERRED_IO
+	select FB_CFB_FILLRECT
+	select FB_CFB_COPYAREA
+	select FB_CFB_IMAGEBLIT
+	select DRM_TTM
+	help
+	  KMS enabled DRM driver for SVGA2 virtual hardware.
+
+	  If unsure say n. The compiled module will be
+	  called vmwgfx.ko
diff --git a/drivers/gpu/drm/vmwgfx/Makefile b/drivers/gpu/drm/vmwgfx/Makefile
new file mode 100644
index 000000000000..1a3cb6816d1c
--- /dev/null
+++ b/drivers/gpu/drm/vmwgfx/Makefile
@@ -0,0 +1,9 @@
+
+ccflags-y := -Iinclude/drm
+
+vmwgfx-y := vmwgfx_execbuf.o vmwgfx_gmr.o vmwgfx_kms.o vmwgfx_drv.o \
+	    vmwgfx_fb.o vmwgfx_ioctl.o vmwgfx_resource.o vmwgfx_buffer.o \
+	    vmwgfx_fifo.o vmwgfx_irq.o vmwgfx_ldu.o vmwgfx_ttm_glue.o \
+	    vmwgfx_overlay.o
+
+obj-$(CONFIG_DRM_VMWGFX) := vmwgfx.o
diff --git a/drivers/gpu/drm/vmwgfx/svga3d_reg.h b/drivers/gpu/drm/vmwgfx/svga3d_reg.h
new file mode 100644
index 000000000000..77cb45331000
--- /dev/null
+++ b/drivers/gpu/drm/vmwgfx/svga3d_reg.h
@@ -0,0 +1,1793 @@
+/**********************************************************
+ * Copyright 1998-2009 VMware, Inc.  All rights reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person
+ * obtaining a copy of this software and associated documentation
+ * files (the "Software"), to deal in the Software without
+ * restriction, including without limitation the rights to use, copy,
+ * modify, merge, publish, distribute, sublicense, and/or sell copies
+ * of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ *
+ **********************************************************/
+
+/*
+ * svga3d_reg.h --
+ *
+ *       SVGA 3D hardware definitions
+ */
+
+#ifndef _SVGA3D_REG_H_
+#define _SVGA3D_REG_H_
+
+#include "svga_reg.h"
+
+
+/*
+ * 3D Hardware Version
+ *
+ *   The hardware version is stored in the SVGA_FIFO_3D_HWVERSION fifo
+ *   register.   Is set by the host and read by the guest.  This lets
+ *   us make new guest drivers which are backwards-compatible with old
+ *   SVGA hardware revisions.  It does not let us support old guest
+ *   drivers.  Good enough for now.
+ *
+ */
+
+#define SVGA3D_MAKE_HWVERSION(major, minor)      (((major) << 16) | ((minor) & 0xFF))
+#define SVGA3D_MAJOR_HWVERSION(version)          ((version) >> 16)
+#define SVGA3D_MINOR_HWVERSION(version)          ((version) & 0xFF)
+
+typedef enum {
+   SVGA3D_HWVERSION_WS5_RC1   = SVGA3D_MAKE_HWVERSION(0, 1),
+   SVGA3D_HWVERSION_WS5_RC2   = SVGA3D_MAKE_HWVERSION(0, 2),
+   SVGA3D_HWVERSION_WS51_RC1  = SVGA3D_MAKE_HWVERSION(0, 3),
+   SVGA3D_HWVERSION_WS6_B1    = SVGA3D_MAKE_HWVERSION(1, 1),
+   SVGA3D_HWVERSION_FUSION_11 = SVGA3D_MAKE_HWVERSION(1, 4),
+   SVGA3D_HWVERSION_WS65_B1   = SVGA3D_MAKE_HWVERSION(2, 0),
+   SVGA3D_HWVERSION_CURRENT   = SVGA3D_HWVERSION_WS65_B1,
+} SVGA3dHardwareVersion;
+
+/*
+ * Generic Types
+ */
+
+typedef uint32 SVGA3dBool; /* 32-bit Bool definition */
+#define SVGA3D_NUM_CLIPPLANES                   6
+#define SVGA3D_MAX_SIMULTANEOUS_RENDER_TARGETS  8
+
+
+/*
+ * Surface formats.
+ *
+ * If you modify this list, be sure to keep GLUtil.c in sync. It
+ * includes the internal format definition of each surface in
+ * GLUtil_ConvertSurfaceFormat, and it contains a table of
+ * human-readable names in GLUtil_GetFormatName.
+ */
+
+typedef enum SVGA3dSurfaceFormat {
+   SVGA3D_FORMAT_INVALID = 0,
+
+   SVGA3D_X8R8G8B8       = 1,
+   SVGA3D_A8R8G8B8       = 2,
+
+   SVGA3D_R5G6B5         = 3,
+   SVGA3D_X1R5G5B5       = 4,
+   SVGA3D_A1R5G5B5       = 5,
+   SVGA3D_A4R4G4B4       = 6,
+
+   SVGA3D_Z_D32          = 7,
+   SVGA3D_Z_D16          = 8,
+   SVGA3D_Z_D24S8        = 9,
+   SVGA3D_Z_D15S1        = 10,
+
+   SVGA3D_LUMINANCE8            = 11,
+   SVGA3D_LUMINANCE4_ALPHA4     = 12,
+   SVGA3D_LUMINANCE16           = 13,
+   SVGA3D_LUMINANCE8_ALPHA8     = 14,
+
+   SVGA3D_DXT1           = 15,
+   SVGA3D_DXT2           = 16,
+   SVGA3D_DXT3           = 17,
+   SVGA3D_DXT4           = 18,
+   SVGA3D_DXT5           = 19,
+
+   SVGA3D_BUMPU8V8       = 20,
+   SVGA3D_BUMPL6V5U5     = 21,
+   SVGA3D_BUMPX8L8V8U8   = 22,
+   SVGA3D_BUMPL8V8U8     = 23,
+
+   SVGA3D_ARGB_S10E5     = 24,   /* 16-bit floating-point ARGB */
+   SVGA3D_ARGB_S23E8     = 25,   /* 32-bit floating-point ARGB */
+
+   SVGA3D_A2R10G10B10    = 26,
+
+   /* signed formats */
+   SVGA3D_V8U8           = 27,
+   SVGA3D_Q8W8V8U8       = 28,
+   SVGA3D_CxV8U8         = 29,
+
+   /* mixed formats */
+   SVGA3D_X8L8V8U8       = 30,
+   SVGA3D_A2W10V10U10    = 31,
+
+   SVGA3D_ALPHA8         = 32,
+
+   /* Single- and dual-component floating point formats */
+   SVGA3D_R_S10E5        = 33,
+   SVGA3D_R_S23E8        = 34,
+   SVGA3D_RG_S10E5       = 35,
+   SVGA3D_RG_S23E8       = 36,
+
+   /*
+    * Any surface can be used as a buffer object, but SVGA3D_BUFFER is
+    * the most efficient format to use when creating new surfaces
+    * expressly for index or vertex data.
+    */
+   SVGA3D_BUFFER         = 37,
+
+   SVGA3D_Z_D24X8        = 38,
+
+   SVGA3D_V16U16         = 39,
+
+   SVGA3D_G16R16         = 40,
+   SVGA3D_A16B16G16R16   = 41,
+
+   /* Packed Video formats */
+   SVGA3D_UYVY           = 42,
+   SVGA3D_YUY2           = 43,
+
+   SVGA3D_FORMAT_MAX
+} SVGA3dSurfaceFormat;
+
+typedef uint32 SVGA3dColor; /* a, r, g, b */
+
+/*
+ * These match the D3DFORMAT_OP definitions used by Direct3D. We need
+ * them so that we can query the host for what the supported surface
+ * operations are (when we're using the D3D backend, in particular),
+ * and so we can send those operations to the guest.
+ */
+typedef enum {
+   SVGA3DFORMAT_OP_TEXTURE                               = 0x00000001,
+   SVGA3DFORMAT_OP_VOLUMETEXTURE                         = 0x00000002,
+   SVGA3DFORMAT_OP_CUBETEXTURE                           = 0x00000004,
+   SVGA3DFORMAT_OP_OFFSCREEN_RENDERTARGET                = 0x00000008,
+   SVGA3DFORMAT_OP_SAME_FORMAT_RENDERTARGET              = 0x00000010,
+   SVGA3DFORMAT_OP_ZSTENCIL                              = 0x00000040,
+   SVGA3DFORMAT_OP_ZSTENCIL_WITH_ARBITRARY_COLOR_DEPTH   = 0x00000080,
+
+/*
+ * This format can be used as a render target if the current display mode
+ * is the same depth if the alpha channel is ignored. e.g. if the device
+ * can render to A8R8G8B8 when the display mode is X8R8G8B8, then the
+ * format op list entry for A8R8G8B8 should have this cap.
+ */
+   SVGA3DFORMAT_OP_SAME_FORMAT_UP_TO_ALPHA_RENDERTARGET  = 0x00000100,
+
+/*
+ * This format contains DirectDraw support (including Flip).  This flag
+ * should not to be set on alpha formats.
+ */
+   SVGA3DFORMAT_OP_DISPLAYMODE                           = 0x00000400,
+
+/*
+ * The rasterizer can support some level of Direct3D support in this format
+ * and implies that the driver can create a Context in this mode (for some
+ * render target format).  When this flag is set, the SVGA3DFORMAT_OP_DISPLAYMODE
+ * flag must also be set.
+ */
+   SVGA3DFORMAT_OP_3DACCELERATION                        = 0x00000800,
+
+/*
+ * This is set for a private format when the driver has put the bpp in
+ * the structure.
+ */
+   SVGA3DFORMAT_OP_PIXELSIZE                             = 0x00001000,
+
+/*
+ * Indicates that this format can be converted to any RGB format for which
+ * SVGA3DFORMAT_OP_MEMBEROFGROUP_ARGB is specified
+ */
+   SVGA3DFORMAT_OP_CONVERT_TO_ARGB                       = 0x00002000,
+
+/*
+ * Indicates that this format can be used to create offscreen plain surfaces.
+ */
+   SVGA3DFORMAT_OP_OFFSCREENPLAIN                        = 0x00004000,
+
+/*
+ * Indicated that this format can be read as an SRGB texture (meaning that the
+ * sampler will linearize the looked up data)
+ */
+   SVGA3DFORMAT_OP_SRGBREAD                              = 0x00008000,
+
+/*
+ * Indicates that this format can be used in the bumpmap instructions
+ */
+   SVGA3DFORMAT_OP_BUMPMAP                               = 0x00010000,
+
+/*
+ * Indicates that this format can be sampled by the displacement map sampler
+ */
+   SVGA3DFORMAT_OP_DMAP                                  = 0x00020000,
+
+/*
+ * Indicates that this format cannot be used with texture filtering
+ */
+   SVGA3DFORMAT_OP_NOFILTER                              = 0x00040000,
+
+/*
+ * Indicates that format conversions are supported to this RGB format if
+ * SVGA3DFORMAT_OP_CONVERT_TO_ARGB is specified in the source format.
+ */
+   SVGA3DFORMAT_OP_MEMBEROFGROUP_ARGB                    = 0x00080000,
+
+/*
+ * Indicated that this format can be written as an SRGB target (meaning that the
+ * pixel pipe will DE-linearize data on output to format)
+ */
+   SVGA3DFORMAT_OP_SRGBWRITE                             = 0x00100000,
+
+/*
+ * Indicates that this format cannot be used with alpha blending
+ */
+   SVGA3DFORMAT_OP_NOALPHABLEND                          = 0x00200000,
+
+/*
+ * Indicates that the device can auto-generated sublevels for resources
+ * of this format
+ */
+   SVGA3DFORMAT_OP_AUTOGENMIPMAP                         = 0x00400000,
+
+/*
+ * Indicates that this format can be used by vertex texture sampler
+ */
+   SVGA3DFORMAT_OP_VERTEXTEXTURE                         = 0x00800000,
+
+/*
+ * Indicates that this format supports neither texture coordinate wrap
+ * modes, nor mipmapping
+ */
+   SVGA3DFORMAT_OP_NOTEXCOORDWRAPNORMIP                  = 0x01000000
+} SVGA3dFormatOp;
+
+/*
+ * This structure is a conversion of SVGA3DFORMAT_OP_*.
+ * Entries must be located at the same position.
+ */
+typedef union {
+   uint32 value;
+   struct {
+      uint32 texture : 1;
+      uint32 volumeTexture : 1;
+      uint32 cubeTexture : 1;
+      uint32 offscreenRenderTarget : 1;
+      uint32 sameFormatRenderTarget : 1;
+      uint32 unknown1 : 1;
+      uint32 zStencil : 1;
+      uint32 zStencilArbitraryDepth : 1;
+      uint32 sameFormatUpToAlpha : 1;
+      uint32 unknown2 : 1;
+      uint32 displayMode : 1;
+      uint32 acceleration3d : 1;
+      uint32 pixelSize : 1;
+      uint32 convertToARGB : 1;
+      uint32 offscreenPlain : 1;
+      uint32 sRGBRead : 1;
+      uint32 bumpMap : 1;
+      uint32 dmap : 1;
+      uint32 noFilter : 1;
+      uint32 memberOfGroupARGB : 1;
+      uint32 sRGBWrite : 1;
+      uint32 noAlphaBlend : 1;
+      uint32 autoGenMipMap : 1;
+      uint32 vertexTexture : 1;
+      uint32 noTexCoordWrapNorMip : 1;
+   };
+} SVGA3dSurfaceFormatCaps;
+
+/*
+ * SVGA_3D_CMD_SETRENDERSTATE Types.  All value types
+ * must fit in a uint32.
+ */
+
+typedef enum {
+   SVGA3D_RS_INVALID                   = 0,
+   SVGA3D_RS_ZENABLE                   = 1,     /* SVGA3dBool */
+   SVGA3D_RS_ZWRITEENABLE              = 2,     /* SVGA3dBool */
+   SVGA3D_RS_ALPHATESTENABLE           = 3,     /* SVGA3dBool */
+   SVGA3D_RS_DITHERENABLE              = 4,     /* SVGA3dBool */
+   SVGA3D_RS_BLENDENABLE               = 5,     /* SVGA3dBool */
+   SVGA3D_RS_FOGENABLE                 = 6,     /* SVGA3dBool */
+   SVGA3D_RS_SPECULARENABLE            = 7,     /* SVGA3dBool */
+   SVGA3D_RS_STENCILENABLE             = 8,     /* SVGA3dBool */
+   SVGA3D_RS_LIGHTINGENABLE            = 9,     /* SVGA3dBool */
+   SVGA3D_RS_NORMALIZENORMALS          = 10,    /* SVGA3dBool */
+   SVGA3D_RS_POINTSPRITEENABLE         = 11,    /* SVGA3dBool */
+   SVGA3D_RS_POINTSCALEENABLE          = 12,    /* SVGA3dBool */
+   SVGA3D_RS_STENCILREF                = 13,    /* uint32 */
+   SVGA3D_RS_STENCILMASK               = 14,    /* uint32 */
+   SVGA3D_RS_STENCILWRITEMASK          = 15,    /* uint32 */
+   SVGA3D_RS_FOGSTART                  = 16,    /* float */
+   SVGA3D_RS_FOGEND                    = 17,    /* float */
+   SVGA3D_RS_FOGDENSITY                = 18,    /* float */
+   SVGA3D_RS_POINTSIZE                 = 19,    /* float */
+   SVGA3D_RS_POINTSIZEMIN              = 20,    /* float */
+   SVGA3D_RS_POINTSIZEMAX              = 21,    /* float */
+   SVGA3D_RS_POINTSCALE_A              = 22,    /* float */
+   SVGA3D_RS_POINTSCALE_B              = 23,    /* float */
+   SVGA3D_RS_POINTSCALE_C              = 24,    /* float */
+   SVGA3D_RS_FOGCOLOR                  = 25,    /* SVGA3dColor */
+   SVGA3D_RS_AMBIENT                   = 26,    /* SVGA3dColor */
+   SVGA3D_RS_CLIPPLANEENABLE           = 27,    /* SVGA3dClipPlanes */
+   SVGA3D_RS_FOGMODE                   = 28,    /* SVGA3dFogMode */
+   SVGA3D_RS_FILLMODE                  = 29,    /* SVGA3dFillMode */
+   SVGA3D_RS_SHADEMODE                 = 30,    /* SVGA3dShadeMode */
+   SVGA3D_RS_LINEPATTERN               = 31,    /* SVGA3dLinePattern */
+   SVGA3D_RS_SRCBLEND                  = 32,    /* SVGA3dBlendOp */
+   SVGA3D_RS_DSTBLEND                  = 33,    /* SVGA3dBlendOp */
+   SVGA3D_RS_BLENDEQUATION             = 34,    /* SVGA3dBlendEquation */
+   SVGA3D_RS_CULLMODE                  = 35,    /* SVGA3dFace */
+   SVGA3D_RS_ZFUNC                     = 36,    /* SVGA3dCmpFunc */
+   SVGA3D_RS_ALPHAFUNC                 = 37,    /* SVGA3dCmpFunc */
+   SVGA3D_RS_STENCILFUNC               = 38,    /* SVGA3dCmpFunc */
+   SVGA3D_RS_STENCILFAIL               = 39,    /* SVGA3dStencilOp */
+   SVGA3D_RS_STENCILZFAIL              = 40,    /* SVGA3dStencilOp */
+   SVGA3D_RS_STENCILPASS               = 41,    /* SVGA3dStencilOp */
+   SVGA3D_RS_ALPHAREF                  = 42,    /* float (0.0 .. 1.0) */
+   SVGA3D_RS_FRONTWINDING              = 43,    /* SVGA3dFrontWinding */
+   SVGA3D_RS_COORDINATETYPE            = 44,    /* SVGA3dCoordinateType */
+   SVGA3D_RS_ZBIAS                     = 45,    /* float */
+   SVGA3D_RS_RANGEFOGENABLE            = 46,    /* SVGA3dBool */
+   SVGA3D_RS_COLORWRITEENABLE          = 47,    /* SVGA3dColorMask */
+   SVGA3D_RS_VERTEXMATERIALENABLE      = 48,    /* SVGA3dBool */
+   SVGA3D_RS_DIFFUSEMATERIALSOURCE     = 49,    /* SVGA3dVertexMaterial */
+   SVGA3D_RS_SPECULARMATERIALSOURCE    = 50,    /* SVGA3dVertexMaterial */
+   SVGA3D_RS_AMBIENTMATERIALSOURCE     = 51,    /* SVGA3dVertexMaterial */
+   SVGA3D_RS_EMISSIVEMATERIALSOURCE    = 52,    /* SVGA3dVertexMaterial */
+   SVGA3D_RS_TEXTUREFACTOR             = 53,    /* SVGA3dColor */
+   SVGA3D_RS_LOCALVIEWER               = 54,    /* SVGA3dBool */
+   SVGA3D_RS_SCISSORTESTENABLE         = 55,    /* SVGA3dBool */
+   SVGA3D_RS_BLENDCOLOR                = 56,    /* SVGA3dColor */
+   SVGA3D_RS_STENCILENABLE2SIDED       = 57,    /* SVGA3dBool */
+   SVGA3D_RS_CCWSTENCILFUNC            = 58,    /* SVGA3dCmpFunc */
+   SVGA3D_RS_CCWSTENCILFAIL            = 59,    /* SVGA3dStencilOp */
+   SVGA3D_RS_CCWSTENCILZFAIL           = 60,    /* SVGA3dStencilOp */
+   SVGA3D_RS_CCWSTENCILPASS            = 61,    /* SVGA3dStencilOp */
+   SVGA3D_RS_VERTEXBLEND               = 62,    /* SVGA3dVertexBlendFlags */
+   SVGA3D_RS_SLOPESCALEDEPTHBIAS       = 63,    /* float */
+   SVGA3D_RS_DEPTHBIAS                 = 64,    /* float */
+
+
+   /*
+    * Output Gamma Level
+    *
+    * Output gamma effects the gamma curve of colors that are output from the
+    * rendering pipeline.  A value of 1.0 specifies a linear color space. If the
+    * value is <= 0.0, gamma correction is ignored and linear color space is
+    * used.
+    */
+
+   SVGA3D_RS_OUTPUTGAMMA               = 65,    /* float */
+   SVGA3D_RS_ZVISIBLE                  = 66,    /* SVGA3dBool */
+   SVGA3D_RS_LASTPIXEL                 = 67,    /* SVGA3dBool */
+   SVGA3D_RS_CLIPPING                  = 68,    /* SVGA3dBool */
+   SVGA3D_RS_WRAP0                     = 69,    /* SVGA3dWrapFlags */
+   SVGA3D_RS_WRAP1                     = 70,    /* SVGA3dWrapFlags */
+   SVGA3D_RS_WRAP2                     = 71,    /* SVGA3dWrapFlags */
+   SVGA3D_RS_WRAP3                     = 72,    /* SVGA3dWrapFlags */
+   SVGA3D_RS_WRAP4                     = 73,    /* SVGA3dWrapFlags */
+   SVGA3D_RS_WRAP5                     = 74,    /* SVGA3dWrapFlags */
+   SVGA3D_RS_WRAP6                     = 75,    /* SVGA3dWrapFlags */
+   SVGA3D_RS_WRAP7                     = 76,    /* SVGA3dWrapFlags */
+   SVGA3D_RS_WRAP8                     = 77,    /* SVGA3dWrapFlags */
+   SVGA3D_RS_WRAP9                     = 78,    /* SVGA3dWrapFlags */
+   SVGA3D_RS_WRAP10                    = 79,    /* SVGA3dWrapFlags */
+   SVGA3D_RS_WRAP11                    = 80,    /* SVGA3dWrapFlags */
+   SVGA3D_RS_WRAP12                    = 81,    /* SVGA3dWrapFlags */
+   SVGA3D_RS_WRAP13                    = 82,    /* SVGA3dWrapFlags */
+   SVGA3D_RS_WRAP14                    = 83,    /* SVGA3dWrapFlags */
+   SVGA3D_RS_WRAP15                    = 84,    /* SVGA3dWrapFlags */
+   SVGA3D_RS_MULTISAMPLEANTIALIAS      = 85,    /* SVGA3dBool */
+   SVGA3D_RS_MULTISAMPLEMASK           = 86,    /* uint32 */
+   SVGA3D_RS_INDEXEDVERTEXBLENDENABLE  = 87,    /* SVGA3dBool */
+   SVGA3D_RS_TWEENFACTOR               = 88,    /* float */
+   SVGA3D_RS_ANTIALIASEDLINEENABLE     = 89,    /* SVGA3dBool */
+   SVGA3D_RS_COLORWRITEENABLE1         = 90,    /* SVGA3dColorMask */
+   SVGA3D_RS_COLORWRITEENABLE2         = 91,    /* SVGA3dColorMask */
+   SVGA3D_RS_COLORWRITEENABLE3         = 92,    /* SVGA3dColorMask */
+   SVGA3D_RS_SEPARATEALPHABLENDENABLE  = 93,    /* SVGA3dBool */
+   SVGA3D_RS_SRCBLENDALPHA             = 94,    /* SVGA3dBlendOp */
+   SVGA3D_RS_DSTBLENDALPHA             = 95,    /* SVGA3dBlendOp */
+   SVGA3D_RS_BLENDEQUATIONALPHA        = 96,    /* SVGA3dBlendEquation */
+   SVGA3D_RS_MAX
+} SVGA3dRenderStateName;
+
+typedef enum {
+   SVGA3D_VERTEXMATERIAL_NONE     = 0,    /* Use the value in the current material */
+   SVGA3D_VERTEXMATERIAL_DIFFUSE  = 1,    /* Use the value in the diffuse component */
+   SVGA3D_VERTEXMATERIAL_SPECULAR = 2,    /* Use the value in the specular component */
+} SVGA3dVertexMaterial;
+
+typedef enum {
+   SVGA3D_FILLMODE_INVALID = 0,
+   SVGA3D_FILLMODE_POINT   = 1,
+   SVGA3D_FILLMODE_LINE    = 2,
+   SVGA3D_FILLMODE_FILL    = 3,
+   SVGA3D_FILLMODE_MAX
+} SVGA3dFillModeType;
+
+
+typedef
+union {
+   struct {
+      uint16   mode;       /* SVGA3dFillModeType */
+      uint16   face;       /* SVGA3dFace */
+   };
+   uint32 uintValue;
+} SVGA3dFillMode;
+
+typedef enum {
+   SVGA3D_SHADEMODE_INVALID = 0,
+   SVGA3D_SHADEMODE_FLAT    = 1,
+   SVGA3D_SHADEMODE_SMOOTH  = 2,
+   SVGA3D_SHADEMODE_PHONG   = 3,     /* Not supported */
+   SVGA3D_SHADEMODE_MAX
+} SVGA3dShadeMode;
+
+typedef
+union {
+   struct {
+      uint16 repeat;
+      uint16 pattern;
+   };
+   uint32 uintValue;
+} SVGA3dLinePattern;
+
+typedef enum {
+   SVGA3D_BLENDOP_INVALID            = 0,
+   SVGA3D_BLENDOP_ZERO               = 1,
+   SVGA3D_BLENDOP_ONE                = 2,
+   SVGA3D_BLENDOP_SRCCOLOR           = 3,
+   SVGA3D_BLENDOP_INVSRCCOLOR        = 4,
+   SVGA3D_BLENDOP_SRCALPHA           = 5,
+   SVGA3D_BLENDOP_INVSRCALPHA        = 6,
+   SVGA3D_BLENDOP_DESTALPHA          = 7,
+   SVGA3D_BLENDOP_INVDESTALPHA       = 8,
+   SVGA3D_BLENDOP_DESTCOLOR          = 9,
+   SVGA3D_BLENDOP_INVDESTCOLOR       = 10,
+   SVGA3D_BLENDOP_SRCALPHASAT        = 11,
+   SVGA3D_BLENDOP_BLENDFACTOR        = 12,
+   SVGA3D_BLENDOP_INVBLENDFACTOR     = 13,
+   SVGA3D_BLENDOP_MAX
+} SVGA3dBlendOp;
+
+typedef enum {
+   SVGA3D_BLENDEQ_INVALID            = 0,
+   SVGA3D_BLENDEQ_ADD                = 1,
+   SVGA3D_BLENDEQ_SUBTRACT           = 2,
+   SVGA3D_BLENDEQ_REVSUBTRACT        = 3,
+   SVGA3D_BLENDEQ_MINIMUM            = 4,
+   SVGA3D_BLENDEQ_MAXIMUM            = 5,
+   SVGA3D_BLENDEQ_MAX
+} SVGA3dBlendEquation;
+
+typedef enum {
+   SVGA3D_FRONTWINDING_INVALID = 0,
+   SVGA3D_FRONTWINDING_CW      = 1,
+   SVGA3D_FRONTWINDING_CCW     = 2,
+   SVGA3D_FRONTWINDING_MAX
+} SVGA3dFrontWinding;
+
+typedef enum {
+   SVGA3D_FACE_INVALID  = 0,
+   SVGA3D_FACE_NONE     = 1,
+   SVGA3D_FACE_FRONT    = 2,
+   SVGA3D_FACE_BACK     = 3,
+   SVGA3D_FACE_FRONT_BACK = 4,
+   SVGA3D_FACE_MAX
+} SVGA3dFace;
+
+/*
+ * The order and the values should not be changed
+ */
+
+typedef enum {
+   SVGA3D_CMP_INVALID              = 0,
+   SVGA3D_CMP_NEVER                = 1,
+   SVGA3D_CMP_LESS                 = 2,
+   SVGA3D_CMP_EQUAL                = 3,
+   SVGA3D_CMP_LESSEQUAL            = 4,
+   SVGA3D_CMP_GREATER              = 5,
+   SVGA3D_CMP_NOTEQUAL             = 6,
+   SVGA3D_CMP_GREATEREQUAL         = 7,
+   SVGA3D_CMP_ALWAYS               = 8,
+   SVGA3D_CMP_MAX
+} SVGA3dCmpFunc;
+
+/*
+ * SVGA3D_FOGFUNC_* specifies the fog equation, or PER_VERTEX which allows
+ * the fog factor to be specified in the alpha component of the specular
+ * (a.k.a. secondary) vertex color.
+ */
+typedef enum {
+   SVGA3D_FOGFUNC_INVALID          = 0,
+   SVGA3D_FOGFUNC_EXP              = 1,
+   SVGA3D_FOGFUNC_EXP2             = 2,
+   SVGA3D_FOGFUNC_LINEAR           = 3,
+   SVGA3D_FOGFUNC_PER_VERTEX       = 4
+} SVGA3dFogFunction;
+
+/*
+ * SVGA3D_FOGTYPE_* specifies if fog factors are computed on a per-vertex
+ * or per-pixel basis.
+ */
+typedef enum {
+   SVGA3D_FOGTYPE_INVALID          = 0,
+   SVGA3D_FOGTYPE_VERTEX           = 1,
+   SVGA3D_FOGTYPE_PIXEL            = 2,
+   SVGA3D_FOGTYPE_MAX              = 3
+} SVGA3dFogType;
+
+/*
+ * SVGA3D_FOGBASE_* selects depth or range-based fog. Depth-based fog is
+ * computed using the eye Z value of each pixel (or vertex), whereas range-
+ * based fog is computed using the actual distance (range) to the eye.
+ */
+typedef enum {
+   SVGA3D_FOGBASE_INVALID          = 0,
+   SVGA3D_FOGBASE_DEPTHBASED       = 1,
+   SVGA3D_FOGBASE_RANGEBASED       = 2,
+   SVGA3D_FOGBASE_MAX              = 3
+} SVGA3dFogBase;
+
+typedef enum {
+   SVGA3D_STENCILOP_INVALID        = 0,
+   SVGA3D_STENCILOP_KEEP           = 1,
+   SVGA3D_STENCILOP_ZERO           = 2,
+   SVGA3D_STENCILOP_REPLACE        = 3,
+   SVGA3D_STENCILOP_INCRSAT        = 4,
+   SVGA3D_STENCILOP_DECRSAT        = 5,
+   SVGA3D_STENCILOP_INVERT         = 6,
+   SVGA3D_STENCILOP_INCR           = 7,
+   SVGA3D_STENCILOP_DECR           = 8,
+   SVGA3D_STENCILOP_MAX
+} SVGA3dStencilOp;
+
+typedef enum {
+   SVGA3D_CLIPPLANE_0              = (1 << 0),
+   SVGA3D_CLIPPLANE_1              = (1 << 1),
+   SVGA3D_CLIPPLANE_2              = (1 << 2),
+   SVGA3D_CLIPPLANE_3              = (1 << 3),
+   SVGA3D_CLIPPLANE_4              = (1 << 4),
+   SVGA3D_CLIPPLANE_5              = (1 << 5),
+} SVGA3dClipPlanes;
+
+typedef enum {
+   SVGA3D_CLEAR_COLOR              = 0x1,
+   SVGA3D_CLEAR_DEPTH              = 0x2,
+   SVGA3D_CLEAR_STENCIL            = 0x4
+} SVGA3dClearFlag;
+
+typedef enum {
+   SVGA3D_RT_DEPTH                 = 0,
+   SVGA3D_RT_STENCIL               = 1,
+   SVGA3D_RT_COLOR0                = 2,
+   SVGA3D_RT_COLOR1                = 3,
+   SVGA3D_RT_COLOR2                = 4,
+   SVGA3D_RT_COLOR3                = 5,
+   SVGA3D_RT_COLOR4                = 6,
+   SVGA3D_RT_COLOR5                = 7,
+   SVGA3D_RT_COLOR6                = 8,
+   SVGA3D_RT_COLOR7                = 9,
+   SVGA3D_RT_MAX,
+   SVGA3D_RT_INVALID               = ((uint32)-1),
+} SVGA3dRenderTargetType;
+
+#define SVGA3D_MAX_RT_COLOR (SVGA3D_RT_COLOR7 - SVGA3D_RT_COLOR0 + 1)
+
+typedef
+union {
+   struct {
+      uint32  red   : 1;
+      uint32  green : 1;
+      uint32  blue  : 1;
+      uint32  alpha : 1;
+   };
+   uint32 uintValue;
+} SVGA3dColorMask;
+
+typedef enum {
+   SVGA3D_VBLEND_DISABLE            = 0,
+   SVGA3D_VBLEND_1WEIGHT            = 1,
+   SVGA3D_VBLEND_2WEIGHT            = 2,
+   SVGA3D_VBLEND_3WEIGHT            = 3,
+} SVGA3dVertexBlendFlags;
+
+typedef enum {
+   SVGA3D_WRAPCOORD_0   = 1 << 0,
+   SVGA3D_WRAPCOORD_1   = 1 << 1,
+   SVGA3D_WRAPCOORD_2   = 1 << 2,
+   SVGA3D_WRAPCOORD_3   = 1 << 3,
+   SVGA3D_WRAPCOORD_ALL = 0xF,
+} SVGA3dWrapFlags;
+
+/*
+ * SVGA_3D_CMD_TEXTURESTATE Types.  All value types
+ * must fit in a uint32.
+ */
+
+typedef enum {
+   SVGA3D_TS_INVALID                    = 0,
+   SVGA3D_TS_BIND_TEXTURE               = 1,    /* SVGA3dSurfaceId */
+   SVGA3D_TS_COLOROP                    = 2,    /* SVGA3dTextureCombiner */
+   SVGA3D_TS_COLORARG1                  = 3,    /* SVGA3dTextureArgData */
+   SVGA3D_TS_COLORARG2                  = 4,    /* SVGA3dTextureArgData */
+   SVGA3D_TS_ALPHAOP                    = 5,    /* SVGA3dTextureCombiner */
+   SVGA3D_TS_ALPHAARG1                  = 6,    /* SVGA3dTextureArgData */
+   SVGA3D_TS_ALPHAARG2                  = 7,    /* SVGA3dTextureArgData */
+   SVGA3D_TS_ADDRESSU                   = 8,    /* SVGA3dTextureAddress */
+   SVGA3D_TS_ADDRESSV                   = 9,    /* SVGA3dTextureAddress */
+   SVGA3D_TS_MIPFILTER                  = 10,   /* SVGA3dTextureFilter */
+   SVGA3D_TS_MAGFILTER                  = 11,   /* SVGA3dTextureFilter */
+   SVGA3D_TS_MINFILTER                  = 12,   /* SVGA3dTextureFilter */
+   SVGA3D_TS_BORDERCOLOR                = 13,   /* SVGA3dColor */
+   SVGA3D_TS_TEXCOORDINDEX              = 14,   /* uint32 */
+   SVGA3D_TS_TEXTURETRANSFORMFLAGS      = 15,   /* SVGA3dTexTransformFlags */
+   SVGA3D_TS_TEXCOORDGEN                = 16,   /* SVGA3dTextureCoordGen */
+   SVGA3D_TS_BUMPENVMAT00               = 17,   /* float */
+   SVGA3D_TS_BUMPENVMAT01               = 18,   /* float */
+   SVGA3D_TS_BUMPENVMAT10               = 19,   /* float */
+   SVGA3D_TS_BUMPENVMAT11               = 20,   /* float */
+   SVGA3D_TS_TEXTURE_MIPMAP_LEVEL       = 21,   /* uint32 */
+   SVGA3D_TS_TEXTURE_LOD_BIAS           = 22,   /* float */
+   SVGA3D_TS_TEXTURE_ANISOTROPIC_LEVEL  = 23,   /* uint32 */
+   SVGA3D_TS_ADDRESSW                   = 24,   /* SVGA3dTextureAddress */
+
+
+   /*
+    * Sampler Gamma Level
+    *
+    * Sampler gamma effects the color of samples taken from the sampler.  A
+    * value of 1.0 will produce linear samples.  If the value is <= 0.0 the
+    * gamma value is ignored and a linear space is used.
+    */
+
+   SVGA3D_TS_GAMMA                      = 25,   /* float */
+   SVGA3D_TS_BUMPENVLSCALE              = 26,   /* float */
+   SVGA3D_TS_BUMPENVLOFFSET             = 27,   /* float */
+   SVGA3D_TS_COLORARG0                  = 28,   /* SVGA3dTextureArgData */
+   SVGA3D_TS_ALPHAARG0                  = 29,   /* SVGA3dTextureArgData */
+   SVGA3D_TS_MAX
+} SVGA3dTextureStateName;
+
+typedef enum {
+   SVGA3D_TC_INVALID                   = 0,
+   SVGA3D_TC_DISABLE                   = 1,
+   SVGA3D_TC_SELECTARG1                = 2,
+   SVGA3D_TC_SELECTARG2                = 3,
+   SVGA3D_TC_MODULATE                  = 4,
+   SVGA3D_TC_ADD                       = 5,
+   SVGA3D_TC_ADDSIGNED                 = 6,
+   SVGA3D_TC_SUBTRACT                  = 7,
+   SVGA3D_TC_BLENDTEXTUREALPHA         = 8,
+   SVGA3D_TC_BLENDDIFFUSEALPHA         = 9,
+   SVGA3D_TC_BLENDCURRENTALPHA         = 10,
+   SVGA3D_TC_BLENDFACTORALPHA          = 11,
+   SVGA3D_TC_MODULATE2X                = 12,
+   SVGA3D_TC_MODULATE4X                = 13,
+   SVGA3D_TC_DSDT                      = 14,
+   SVGA3D_TC_DOTPRODUCT3               = 15,
+   SVGA3D_TC_BLENDTEXTUREALPHAPM       = 16,
+   SVGA3D_TC_ADDSIGNED2X               = 17,
+   SVGA3D_TC_ADDSMOOTH                 = 18,
+   SVGA3D_TC_PREMODULATE               = 19,
+   SVGA3D_TC_MODULATEALPHA_ADDCOLOR    = 20,
+   SVGA3D_TC_MODULATECOLOR_ADDALPHA    = 21,
+   SVGA3D_TC_MODULATEINVALPHA_ADDCOLOR = 22,
+   SVGA3D_TC_MODULATEINVCOLOR_ADDALPHA = 23,
+   SVGA3D_TC_BUMPENVMAPLUMINANCE       = 24,
+   SVGA3D_TC_MULTIPLYADD               = 25,
+   SVGA3D_TC_LERP                      = 26,
+   SVGA3D_TC_MAX
+} SVGA3dTextureCombiner;
+
+#define SVGA3D_TC_CAP_BIT(svga3d_tc_op) (svga3d_tc_op ? (1 << (svga3d_tc_op - 1)) : 0)
+
+typedef enum {
+   SVGA3D_TEX_ADDRESS_INVALID    = 0,
+   SVGA3D_TEX_ADDRESS_WRAP       = 1,
+   SVGA3D_TEX_ADDRESS_MIRROR     = 2,
+   SVGA3D_TEX_ADDRESS_CLAMP      = 3,
+   SVGA3D_TEX_ADDRESS_BORDER     = 4,
+   SVGA3D_TEX_ADDRESS_MIRRORONCE = 5,
+   SVGA3D_TEX_ADDRESS_EDGE       = 6,
+   SVGA3D_TEX_ADDRESS_MAX
+} SVGA3dTextureAddress;
+
+/*
+ * SVGA3D_TEX_FILTER_NONE as the minification filter means mipmapping is
+ * disabled, and the rasterizer should use the magnification filter instead.
+ */
+typedef enum {
+   SVGA3D_TEX_FILTER_NONE           = 0,
+   SVGA3D_TEX_FILTER_NEAREST        = 1,
+   SVGA3D_TEX_FILTER_LINEAR         = 2,
+   SVGA3D_TEX_FILTER_ANISOTROPIC    = 3,
+   SVGA3D_TEX_FILTER_FLATCUBIC      = 4, // Deprecated, not implemented
+   SVGA3D_TEX_FILTER_GAUSSIANCUBIC  = 5, // Deprecated, not implemented
+   SVGA3D_TEX_FILTER_PYRAMIDALQUAD  = 6, // Not currently implemented
+   SVGA3D_TEX_FILTER_GAUSSIANQUAD   = 7, // Not currently implemented
+   SVGA3D_TEX_FILTER_MAX
+} SVGA3dTextureFilter;
+
+typedef enum {
+   SVGA3D_TEX_TRANSFORM_OFF    = 0,
+   SVGA3D_TEX_TRANSFORM_S      = (1 << 0),
+   SVGA3D_TEX_TRANSFORM_T      = (1 << 1),
+   SVGA3D_TEX_TRANSFORM_R      = (1 << 2),
+   SVGA3D_TEX_TRANSFORM_Q      = (1 << 3),
+   SVGA3D_TEX_PROJECTED        = (1 << 15),
+} SVGA3dTexTransformFlags;
+
+typedef enum {
+   SVGA3D_TEXCOORD_GEN_OFF              = 0,
+   SVGA3D_TEXCOORD_GEN_EYE_POSITION     = 1,
+   SVGA3D_TEXCOORD_GEN_EYE_NORMAL       = 2,
+   SVGA3D_TEXCOORD_GEN_REFLECTIONVECTOR = 3,
+   SVGA3D_TEXCOORD_GEN_SPHERE           = 4,
+   SVGA3D_TEXCOORD_GEN_MAX
+} SVGA3dTextureCoordGen;
+
+/*
+ * Texture argument constants for texture combiner
+ */
+typedef enum {
+   SVGA3D_TA_INVALID    = 0,
+   SVGA3D_TA_CONSTANT   = 1,
+   SVGA3D_TA_PREVIOUS   = 2,
+   SVGA3D_TA_DIFFUSE    = 3,
+   SVGA3D_TA_TEXTURE    = 4,
+   SVGA3D_TA_SPECULAR   = 5,
+   SVGA3D_TA_MAX
+} SVGA3dTextureArgData;
+
+#define SVGA3D_TM_MASK_LEN 4
+
+/* Modifiers for texture argument constants defined above. */
+typedef enum {
+   SVGA3D_TM_NONE       = 0,
+   SVGA3D_TM_ALPHA      = (1 << SVGA3D_TM_MASK_LEN),
+   SVGA3D_TM_ONE_MINUS  = (2 << SVGA3D_TM_MASK_LEN),
+} SVGA3dTextureArgModifier;
+
+#define SVGA3D_INVALID_ID         ((uint32)-1)
+#define SVGA3D_MAX_CLIP_PLANES    6
+
+/*
+ * This is the limit to the number of fixed-function texture
+ * transforms and texture coordinates we can support. It does *not*
+ * correspond to the number of texture image units (samplers) we
+ * support!
+ */
+#define SVGA3D_MAX_TEXTURE_COORDS 8
+
+/*
+ * Vertex declarations
+ *
+ * Notes:
+ *
+ * SVGA3D_DECLUSAGE_POSITIONT is for pre-transformed vertices. If you
+ * draw with any POSITIONT vertex arrays, the programmable vertex
+ * pipeline will be implicitly disabled. Drawing will take place as if
+ * no vertex shader was bound.
+ */
+
+typedef enum {
+   SVGA3D_DECLUSAGE_POSITION     = 0,
+   SVGA3D_DECLUSAGE_BLENDWEIGHT,       //  1
+   SVGA3D_DECLUSAGE_BLENDINDICES,      //  2
+   SVGA3D_DECLUSAGE_NORMAL,            //  3
+   SVGA3D_DECLUSAGE_PSIZE,             //  4
+   SVGA3D_DECLUSAGE_TEXCOORD,          //  5
+   SVGA3D_DECLUSAGE_TANGENT,           //  6
+   SVGA3D_DECLUSAGE_BINORMAL,          //  7
+   SVGA3D_DECLUSAGE_TESSFACTOR,        //  8
+   SVGA3D_DECLUSAGE_POSITIONT,         //  9
+   SVGA3D_DECLUSAGE_COLOR,             // 10
+   SVGA3D_DECLUSAGE_FOG,               // 11
+   SVGA3D_DECLUSAGE_DEPTH,             // 12
+   SVGA3D_DECLUSAGE_SAMPLE,            // 13
+   SVGA3D_DECLUSAGE_MAX
+} SVGA3dDeclUsage;
+
+typedef enum {
+   SVGA3D_DECLMETHOD_DEFAULT     = 0,
+   SVGA3D_DECLMETHOD_PARTIALU,
+   SVGA3D_DECLMETHOD_PARTIALV,
+   SVGA3D_DECLMETHOD_CROSSUV,          // Normal
+   SVGA3D_DECLMETHOD_UV,
+   SVGA3D_DECLMETHOD_LOOKUP,           // Lookup a displacement map
+   SVGA3D_DECLMETHOD_LOOKUPPRESAMPLED, // Lookup a pre-sampled displacement map
+} SVGA3dDeclMethod;
+
+typedef enum {
+   SVGA3D_DECLTYPE_FLOAT1        =  0,
+   SVGA3D_DECLTYPE_FLOAT2        =  1,
+   SVGA3D_DECLTYPE_FLOAT3        =  2,
+   SVGA3D_DECLTYPE_FLOAT4        =  3,
+   SVGA3D_DECLTYPE_D3DCOLOR      =  4,
+   SVGA3D_DECLTYPE_UBYTE4        =  5,
+   SVGA3D_DECLTYPE_SHORT2        =  6,
+   SVGA3D_DECLTYPE_SHORT4        =  7,
+   SVGA3D_DECLTYPE_UBYTE4N       =  8,
+   SVGA3D_DECLTYPE_SHORT2N       =  9,
+   SVGA3D_DECLTYPE_SHORT4N       = 10,
+   SVGA3D_DECLTYPE_USHORT2N      = 11,
+   SVGA3D_DECLTYPE_USHORT4N      = 12,
+   SVGA3D_DECLTYPE_UDEC3         = 13,
+   SVGA3D_DECLTYPE_DEC3N         = 14,
+   SVGA3D_DECLTYPE_FLOAT16_2     = 15,
+   SVGA3D_DECLTYPE_FLOAT16_4     = 16,
+   SVGA3D_DECLTYPE_MAX,
+} SVGA3dDeclType;
+
+/*
+ * This structure is used for the divisor for geometry instancing;
+ * it's a direct translation of the Direct3D equivalent.
+ */
+typedef union {
+   struct {
+      /*
+       * For index data, this number represents the number of instances to draw.
+       * For instance data, this number represents the number of
+       * instances/vertex in this stream
+       */
+      uint32 count : 30;
+
+      /*
+       * This is 1 if this is supposed to be the data that is repeated for
+       * every instance.
+       */
+      uint32 indexedData : 1;
+
+      /*
+       * This is 1 if this is supposed to be the per-instance data.
+       */
+      uint32 instanceData : 1;
+   };
+
+   uint32 value;
+} SVGA3dVertexDivisor;
+
+typedef enum {
+   SVGA3D_PRIMITIVE_INVALID                     = 0,
+   SVGA3D_PRIMITIVE_TRIANGLELIST                = 1,
+   SVGA3D_PRIMITIVE_POINTLIST                   = 2,
+   SVGA3D_PRIMITIVE_LINELIST                    = 3,
+   SVGA3D_PRIMITIVE_LINESTRIP                   = 4,
+   SVGA3D_PRIMITIVE_TRIANGLESTRIP               = 5,
+   SVGA3D_PRIMITIVE_TRIANGLEFAN                 = 6,
+   SVGA3D_PRIMITIVE_MAX
+} SVGA3dPrimitiveType;
+
+typedef enum {
+   SVGA3D_COORDINATE_INVALID                   = 0,
+   SVGA3D_COORDINATE_LEFTHANDED                = 1,
+   SVGA3D_COORDINATE_RIGHTHANDED               = 2,
+   SVGA3D_COORDINATE_MAX
+} SVGA3dCoordinateType;
+
+typedef enum {
+   SVGA3D_TRANSFORM_INVALID                     = 0,
+   SVGA3D_TRANSFORM_WORLD                       = 1,
+   SVGA3D_TRANSFORM_VIEW                        = 2,
+   SVGA3D_TRANSFORM_PROJECTION                  = 3,
+   SVGA3D_TRANSFORM_TEXTURE0                    = 4,
+   SVGA3D_TRANSFORM_TEXTURE1                    = 5,
+   SVGA3D_TRANSFORM_TEXTURE2                    = 6,
+   SVGA3D_TRANSFORM_TEXTURE3                    = 7,
+   SVGA3D_TRANSFORM_TEXTURE4                    = 8,
+   SVGA3D_TRANSFORM_TEXTURE5                    = 9,
+   SVGA3D_TRANSFORM_TEXTURE6                    = 10,
+   SVGA3D_TRANSFORM_TEXTURE7                    = 11,
+   SVGA3D_TRANSFORM_WORLD1                      = 12,
+   SVGA3D_TRANSFORM_WORLD2                      = 13,
+   SVGA3D_TRANSFORM_WORLD3                      = 14,
+   SVGA3D_TRANSFORM_MAX
+} SVGA3dTransformType;
+
+typedef enum {
+   SVGA3D_LIGHTTYPE_INVALID                     = 0,
+   SVGA3D_LIGHTTYPE_POINT                       = 1,
+   SVGA3D_LIGHTTYPE_SPOT1                       = 2, /* 1-cone, in degrees */
+   SVGA3D_LIGHTTYPE_SPOT2                       = 3, /* 2-cone, in radians */
+   SVGA3D_LIGHTTYPE_DIRECTIONAL                 = 4,
+   SVGA3D_LIGHTTYPE_MAX
+} SVGA3dLightType;
+
+typedef enum {
+   SVGA3D_CUBEFACE_POSX                         = 0,
+   SVGA3D_CUBEFACE_NEGX                         = 1,
+   SVGA3D_CUBEFACE_POSY                         = 2,
+   SVGA3D_CUBEFACE_NEGY                         = 3,
+   SVGA3D_CUBEFACE_POSZ                         = 4,
+   SVGA3D_CUBEFACE_NEGZ                         = 5,
+} SVGA3dCubeFace;
+
+typedef enum {
+   SVGA3D_SHADERTYPE_COMPILED_DX8               = 0,
+   SVGA3D_SHADERTYPE_VS                         = 1,
+   SVGA3D_SHADERTYPE_PS                         = 2,
+   SVGA3D_SHADERTYPE_MAX
+} SVGA3dShaderType;
+
+typedef enum {
+   SVGA3D_CONST_TYPE_FLOAT                      = 0,
+   SVGA3D_CONST_TYPE_INT                        = 1,
+   SVGA3D_CONST_TYPE_BOOL                       = 2,
+} SVGA3dShaderConstType;
+
+#define SVGA3D_MAX_SURFACE_FACES                6
+
+typedef enum {
+   SVGA3D_STRETCH_BLT_POINT                     = 0,
+   SVGA3D_STRETCH_BLT_LINEAR                    = 1,
+   SVGA3D_STRETCH_BLT_MAX
+} SVGA3dStretchBltMode;
+
+typedef enum {
+   SVGA3D_QUERYTYPE_OCCLUSION                   = 0,
+   SVGA3D_QUERYTYPE_MAX
+} SVGA3dQueryType;
+
+typedef enum {
+   SVGA3D_QUERYSTATE_PENDING     = 0,      /* Waiting on the host (set by guest) */
+   SVGA3D_QUERYSTATE_SUCCEEDED   = 1,      /* Completed successfully (set by host) */
+   SVGA3D_QUERYSTATE_FAILED      = 2,      /* Completed unsuccessfully (set by host) */
+   SVGA3D_QUERYSTATE_NEW         = 3,      /* Never submitted (For guest use only) */
+} SVGA3dQueryState;
+
+typedef enum {
+   SVGA3D_WRITE_HOST_VRAM        = 1,
+   SVGA3D_READ_HOST_VRAM         = 2,
+} SVGA3dTransferType;
+
+/*
+ * The maximum number vertex arrays we're guaranteed to support in
+ * SVGA_3D_CMD_DRAWPRIMITIVES.
+ */
+#define SVGA3D_MAX_VERTEX_ARRAYS   32
+
+/*
+ * Identifiers for commands in the command FIFO.
+ *
+ * IDs between 1000 and 1039 (inclusive) were used by obsolete versions of
+ * the SVGA3D protocol and remain reserved; they should not be used in the
+ * future.
+ *
+ * IDs between 1040 and 1999 (inclusive) are available for use by the
+ * current SVGA3D protocol.
+ *
+ * FIFO clients other than SVGA3D should stay below 1000, or at 2000
+ * and up.
+ */
+
+#define SVGA_3D_CMD_LEGACY_BASE            1000
+#define SVGA_3D_CMD_BASE                   1040
+
+#define SVGA_3D_CMD_SURFACE_DEFINE         SVGA_3D_CMD_BASE + 0
+#define SVGA_3D_CMD_SURFACE_DESTROY        SVGA_3D_CMD_BASE + 1
+#define SVGA_3D_CMD_SURFACE_COPY           SVGA_3D_CMD_BASE + 2
+#define SVGA_3D_CMD_SURFACE_STRETCHBLT     SVGA_3D_CMD_BASE + 3
+#define SVGA_3D_CMD_SURFACE_DMA            SVGA_3D_CMD_BASE + 4
+#define SVGA_3D_CMD_CONTEXT_DEFINE         SVGA_3D_CMD_BASE + 5
+#define SVGA_3D_CMD_CONTEXT_DESTROY        SVGA_3D_CMD_BASE + 6
+#define SVGA_3D_CMD_SETTRANSFORM           SVGA_3D_CMD_BASE + 7
+#define SVGA_3D_CMD_SETZRANGE              SVGA_3D_CMD_BASE + 8
+#define SVGA_3D_CMD_SETRENDERSTATE         SVGA_3D_CMD_BASE + 9
+#define SVGA_3D_CMD_SETRENDERTARGET        SVGA_3D_CMD_BASE + 10
+#define SVGA_3D_CMD_SETTEXTURESTATE        SVGA_3D_CMD_BASE + 11
+#define SVGA_3D_CMD_SETMATERIAL            SVGA_3D_CMD_BASE + 12
+#define SVGA_3D_CMD_SETLIGHTDATA           SVGA_3D_CMD_BASE + 13
+#define SVGA_3D_CMD_SETLIGHTENABLED        SVGA_3D_CMD_BASE + 14
+#define SVGA_3D_CMD_SETVIEWPORT            SVGA_3D_CMD_BASE + 15
+#define SVGA_3D_CMD_SETCLIPPLANE           SVGA_3D_CMD_BASE + 16
+#define SVGA_3D_CMD_CLEAR                  SVGA_3D_CMD_BASE + 17
+#define SVGA_3D_CMD_PRESENT                SVGA_3D_CMD_BASE + 18    // Deprecated
+#define SVGA_3D_CMD_SHADER_DEFINE          SVGA_3D_CMD_BASE + 19
+#define SVGA_3D_CMD_SHADER_DESTROY         SVGA_3D_CMD_BASE + 20
+#define SVGA_3D_CMD_SET_SHADER             SVGA_3D_CMD_BASE + 21
+#define SVGA_3D_CMD_SET_SHADER_CONST       SVGA_3D_CMD_BASE + 22
+#define SVGA_3D_CMD_DRAW_PRIMITIVES        SVGA_3D_CMD_BASE + 23
+#define SVGA_3D_CMD_SETSCISSORRECT         SVGA_3D_CMD_BASE + 24
+#define SVGA_3D_CMD_BEGIN_QUERY            SVGA_3D_CMD_BASE + 25
+#define SVGA_3D_CMD_END_QUERY              SVGA_3D_CMD_BASE + 26
+#define SVGA_3D_CMD_WAIT_FOR_QUERY         SVGA_3D_CMD_BASE + 27
+#define SVGA_3D_CMD_PRESENT_READBACK       SVGA_3D_CMD_BASE + 28    // Deprecated
+#define SVGA_3D_CMD_BLIT_SURFACE_TO_SCREEN SVGA_3D_CMD_BASE + 29
+#define SVGA_3D_CMD_MAX                    SVGA_3D_CMD_BASE + 30
+
+#define SVGA_3D_CMD_FUTURE_MAX             2000
+
+/*
+ * Common substructures used in multiple FIFO commands:
+ */
+
+typedef struct {
+   union {
+      struct {
+         uint16  function;       // SVGA3dFogFunction
+         uint8   type;           // SVGA3dFogType
+         uint8   base;           // SVGA3dFogBase
+      };
+      uint32     uintValue;
+   };
+} SVGA3dFogMode;
+
+/*
+ * Uniquely identify one image (a 1D/2D/3D array) from a surface. This
+ * is a surface ID as well as face/mipmap indices.
+ */
+
+typedef
+struct SVGA3dSurfaceImageId {
+   uint32               sid;
+   uint32               face;
+   uint32               mipmap;
+} SVGA3dSurfaceImageId;
+
+typedef
+struct SVGA3dGuestImage {
+   SVGAGuestPtr         ptr;
+
+   /*
+    * A note on interpretation of pitch: This value of pitch is the
+    * number of bytes between vertically adjacent image
+    * blocks. Normally this is the number of bytes between the first
+    * pixel of two adjacent scanlines. With compressed textures,
+    * however, this may represent the number of bytes between
+    * compression blocks rather than between rows of pixels.
+    *
+    * XXX: Compressed textures currently must be tightly packed in guest memory.
+    *
+    * If the image is 1-dimensional, pitch is ignored.
+    *
+    * If 'pitch' is zero, the SVGA3D device calculates a pitch value
+    * assuming each row of blocks is tightly packed.
+    */
+   uint32 pitch;
+} SVGA3dGuestImage;
+
+
+/*
+ * FIFO command format definitions:
+ */
+
+/*
+ * The data size header following cmdNum for every 3d command
+ */
+typedef
+struct {
+   uint32               id;
+   uint32               size;
+} SVGA3dCmdHeader;
+
+/*
+ * A surface is a hierarchy of host VRAM surfaces: 1D, 2D, or 3D, with
+ * optional mipmaps and cube faces.
+ */
+
+typedef
+struct {
+   uint32               width;
+   uint32               height;
+   uint32               depth;
+} SVGA3dSize;
+
+typedef enum {
+   SVGA3D_SURFACE_CUBEMAP              = (1 << 0),
+   SVGA3D_SURFACE_HINT_STATIC          = (1 << 1),
+   SVGA3D_SURFACE_HINT_DYNAMIC         = (1 << 2),
+   SVGA3D_SURFACE_HINT_INDEXBUFFER     = (1 << 3),
+   SVGA3D_SURFACE_HINT_VERTEXBUFFER    = (1 << 4),
+   SVGA3D_SURFACE_HINT_TEXTURE         = (1 << 5),
+   SVGA3D_SURFACE_HINT_RENDERTARGET    = (1 << 6),
+   SVGA3D_SURFACE_HINT_DEPTHSTENCIL    = (1 << 7),
+   SVGA3D_SURFACE_HINT_WRITEONLY       = (1 << 8),
+} SVGA3dSurfaceFlags;
+
+typedef
+struct {
+   uint32               numMipLevels;
+} SVGA3dSurfaceFace;
+
+typedef
+struct {
+   uint32                      sid;
+   SVGA3dSurfaceFlags          surfaceFlags;
+   SVGA3dSurfaceFormat         format;
+   SVGA3dSurfaceFace           face[SVGA3D_MAX_SURFACE_FACES];
+   /*
+    * Followed by an SVGA3dSize structure for each mip level in each face.
+    *
+    * A note on surface sizes: Sizes are always specified in pixels,
+    * even if the true surface size is not a multiple of the minimum
+    * block size of the surface's format. For example, a 3x3x1 DXT1
+    * compressed texture would actually be stored as a 4x4x1 image in
+    * memory.
+    */
+} SVGA3dCmdDefineSurface;       /* SVGA_3D_CMD_SURFACE_DEFINE */
+
+typedef
+struct {
+   uint32               sid;
+} SVGA3dCmdDestroySurface;      /* SVGA_3D_CMD_SURFACE_DESTROY */
+
+typedef
+struct {
+   uint32               cid;
+} SVGA3dCmdDefineContext;       /* SVGA_3D_CMD_CONTEXT_DEFINE */
+
+typedef
+struct {
+   uint32               cid;
+} SVGA3dCmdDestroyContext;      /* SVGA_3D_CMD_CONTEXT_DESTROY */
+
+typedef
+struct {
+   uint32               cid;
+   SVGA3dClearFlag      clearFlag;
+   uint32               color;
+   float                depth;
+   uint32               stencil;
+   /* Followed by variable number of SVGA3dRect structures */
+} SVGA3dCmdClear;               /* SVGA_3D_CMD_CLEAR */
+
+typedef
+struct SVGA3dCopyRect {
+   uint32               x;
+   uint32               y;
+   uint32               w;
+   uint32               h;
+   uint32               srcx;
+   uint32               srcy;
+} SVGA3dCopyRect;
+
+typedef
+struct SVGA3dCopyBox {
+   uint32               x;
+   uint32               y;
+   uint32               z;
+   uint32               w;
+   uint32               h;
+   uint32               d;
+   uint32               srcx;
+   uint32               srcy;
+   uint32               srcz;
+} SVGA3dCopyBox;
+
+typedef
+struct {
+   uint32               x;
+   uint32               y;
+   uint32               w;
+   uint32               h;
+} SVGA3dRect;
+
+typedef
+struct {
+   uint32               x;
+   uint32               y;
+   uint32               z;
+   uint32               w;
+   uint32               h;
+   uint32               d;
+} SVGA3dBox;
+
+typedef
+struct {
+   uint32               x;
+   uint32               y;
+   uint32               z;
+} SVGA3dPoint;
+
+typedef
+struct {
+   SVGA3dLightType      type;
+   SVGA3dBool           inWorldSpace;
+   float                diffuse[4];
+   float                specular[4];
+   float                ambient[4];
+   float                position[4];
+   float                direction[4];
+   float                range;
+   float                falloff;
+   float                attenuation0;
+   float                attenuation1;
+   float                attenuation2;
+   float                theta;
+   float                phi;
+} SVGA3dLightData;
+
+typedef
+struct {
+   uint32               sid;
+   /* Followed by variable number of SVGA3dCopyRect structures */
+} SVGA3dCmdPresent;             /* SVGA_3D_CMD_PRESENT */
+
+typedef
+struct {
+   SVGA3dRenderStateName   state;
+   union {
+      uint32               uintValue;
+      float                floatValue;
+   };
+} SVGA3dRenderState;
+
+typedef
+struct {
+   uint32               cid;
+   /* Followed by variable number of SVGA3dRenderState structures */
+} SVGA3dCmdSetRenderState;      /* SVGA_3D_CMD_SETRENDERSTATE */
+
+typedef
+struct {
+   uint32                 cid;
+   SVGA3dRenderTargetType type;
+   SVGA3dSurfaceImageId   target;
+} SVGA3dCmdSetRenderTarget;     /* SVGA_3D_CMD_SETRENDERTARGET */
+
+typedef
+struct {
+   SVGA3dSurfaceImageId  src;
+   SVGA3dSurfaceImageId  dest;
+   /* Followed by variable number of SVGA3dCopyBox structures */
+} SVGA3dCmdSurfaceCopy;               /* SVGA_3D_CMD_SURFACE_COPY */
+
+typedef
+struct {
+   SVGA3dSurfaceImageId  src;
+   SVGA3dSurfaceImageId  dest;
+   SVGA3dBox             boxSrc;
+   SVGA3dBox             boxDest;
+   SVGA3dStretchBltMode  mode;
+} SVGA3dCmdSurfaceStretchBlt;         /* SVGA_3D_CMD_SURFACE_STRETCHBLT */
+
+typedef
+struct {
+   /*
+    * If the discard flag is present in a surface DMA operation, the host may
+    * discard the contents of the current mipmap level and face of the target
+    * surface before applying the surface DMA contents.
+    */
+   uint32 discard : 1;
+
+   /*
+    * If the unsynchronized flag is present, the host may perform this upload
+    * without syncing to pending reads on this surface.
+    */
+   uint32 unsynchronized : 1;
+
+   /*
+    * Guests *MUST* set the reserved bits to 0 before submitting the command
+    * suffix as future flags may occupy these bits.
+    */
+   uint32 reserved : 30;
+} SVGA3dSurfaceDMAFlags;
+
+typedef
+struct {
+   SVGA3dGuestImage      guest;
+   SVGA3dSurfaceImageId  host;
+   SVGA3dTransferType    transfer;
+   /*
+    * Followed by variable number of SVGA3dCopyBox structures. For consistency
+    * in all clipping logic and coordinate translation, we define the
+    * "source" in each copyBox as the guest image and the
+    * "destination" as the host image, regardless of transfer
+    * direction.
+    *
+    * For efficiency, the SVGA3D device is free to copy more data than
+    * specified. For example, it may round copy boxes outwards such
+    * that they lie on particular alignment boundaries.
+    */
+} SVGA3dCmdSurfaceDMA;                /* SVGA_3D_CMD_SURFACE_DMA */
+
+/*
+ * SVGA3dCmdSurfaceDMASuffix --
+ *
+ *    This is a command suffix that will appear after a SurfaceDMA command in
+ *    the FIFO.  It contains some extra information that hosts may use to
+ *    optimize performance or protect the guest.  This suffix exists to preserve
+ *    backwards compatibility while also allowing for new functionality to be
+ *    implemented.
+ */
+
+typedef
+struct {
+   uint32 suffixSize;
+
+   /*
+    * The maximum offset is used to determine the maximum offset from the
+    * guestPtr base address that will be accessed or written to during this
+    * surfaceDMA.  If the suffix is supported, the host will respect this
+    * boundary while performing surface DMAs.
+    *
+    * Defaults to MAX_UINT32
+    */
+   uint32 maximumOffset;
+
+   /*
+    * A set of flags that describes optimizations that the host may perform
+    * while performing this surface DMA operation.  The guest should never rely
+    * on behaviour that is different when these flags are set for correctness.
+    *
+    * Defaults to 0
+    */
+   SVGA3dSurfaceDMAFlags flags;
+} SVGA3dCmdSurfaceDMASuffix;
+
+/*
+ * SVGA_3D_CMD_DRAW_PRIMITIVES --
+ *
+ *   This command is the SVGA3D device's generic drawing entry point.
+ *   It can draw multiple ranges of primitives, optionally using an
+ *   index buffer, using an arbitrary collection of vertex buffers.
+ *
+ *   Each SVGA3dVertexDecl defines a distinct vertex array to bind
+ *   during this draw call. The declarations specify which surface
+ *   the vertex data lives in, what that vertex data is used for,
+ *   and how to interpret it.
+ *
+ *   Each SVGA3dPrimitiveRange defines a collection of primitives
+ *   to render using the same vertex arrays. An index buffer is
+ *   optional.
+ */
+
+typedef
+struct {
+   /*
+    * A range hint is an optional specification for the range of indices
+    * in an SVGA3dArray that will be used. If 'last' is zero, it is assumed
+    * that the entire array will be used.
+    *
+    * These are only hints. The SVGA3D device may use them for
+    * performance optimization if possible, but it's also allowed to
+    * ignore these values.
+    */
+   uint32               first;
+   uint32               last;
+} SVGA3dArrayRangeHint;
+
+typedef
+struct {
+   /*
+    * Define the origin and shape of a vertex or index array. Both
+    * 'offset' and 'stride' are in bytes. The provided surface will be
+    * reinterpreted as a flat array of bytes in the same format used
+    * by surface DMA operations. To avoid unnecessary conversions, the
+    * surface should be created with the SVGA3D_BUFFER format.
+    *
+    * Index 0 in the array starts 'offset' bytes into the surface.
+    * Index 1 begins at byte 'offset + stride', etc. Array indices may
+    * not be negative.
+    */
+   uint32               surfaceId;
+   uint32               offset;
+   uint32               stride;
+} SVGA3dArray;
+
+typedef
+struct {
+   /*
+    * Describe a vertex array's data type, and define how it is to be
+    * used by the fixed function pipeline or the vertex shader. It
+    * isn't useful to have two VertexDecls with the same
+    * VertexArrayIdentity in one draw call.
+    */
+   SVGA3dDeclType       type;
+   SVGA3dDeclMethod     method;
+   SVGA3dDeclUsage      usage;
+   uint32               usageIndex;
+} SVGA3dVertexArrayIdentity;
+
+typedef
+struct {
+   SVGA3dVertexArrayIdentity  identity;
+   SVGA3dArray                array;
+   SVGA3dArrayRangeHint       rangeHint;
+} SVGA3dVertexDecl;
+
+typedef
+struct {
+   /*
+    * Define a group of primitives to render, from sequential indices.
+    *
+    * The value of 'primitiveType' and 'primitiveCount' imply the
+    * total number of vertices that will be rendered.
+    */
+   SVGA3dPrimitiveType  primType;
+   uint32               primitiveCount;
+
+   /*
+    * Optional index buffer. If indexArray.surfaceId is
+    * SVGA3D_INVALID_ID, we render without an index buffer. Rendering
+    * without an index buffer is identical to rendering with an index
+    * buffer containing the sequence [0, 1, 2, 3, ...].
+    *
+    * If an index buffer is in use, indexWidth specifies the width in
+    * bytes of each index value. It must be less than or equal to
+    * indexArray.stride.
+    *
+    * (Currently, the SVGA3D device requires index buffers to be tightly
+    * packed. In other words, indexWidth == indexArray.stride)
+    */
+   SVGA3dArray          indexArray;
+   uint32               indexWidth;
+
+   /*
+    * Optional index bias. This number is added to all indices from
+    * indexArray before they are used as vertex array indices. This
+    * can be used in multiple ways:
+    *
+    *  - When not using an indexArray, this bias can be used to
+    *    specify where in the vertex arrays to begin rendering.
+    *
+    *  - A positive number here is equivalent to increasing the
+    *    offset in each vertex array.
+    *
+    *  - A negative number can be used to render using a small
+    *    vertex array and an index buffer that contains large
+    *    values. This may be used by some applications that
+    *    crop a vertex buffer without modifying their index
+    *    buffer.
+    *
+    * Note that rendering with a negative bias value may be slower and
+    * use more memory than rendering with a positive or zero bias.
+    */
+   int32                indexBias;
+} SVGA3dPrimitiveRange;
+
+typedef
+struct {
+   uint32               cid;
+   uint32               numVertexDecls;
+   uint32               numRanges;
+
+   /*
+    * There are two variable size arrays after the
+    * SVGA3dCmdDrawPrimitives structure. In order,
+    * they are:
+    *
+    * 1. SVGA3dVertexDecl, quantity 'numVertexDecls'
+    * 2. SVGA3dPrimitiveRange, quantity 'numRanges'
+    * 3. Optionally, SVGA3dVertexDivisor, quantity 'numVertexDecls' (contains
+    *    the frequency divisor for this the corresponding vertex decl)
+    */
+} SVGA3dCmdDrawPrimitives;      /* SVGA_3D_CMD_DRAWPRIMITIVES */
+
+typedef
+struct {
+   uint32                   stage;
+   SVGA3dTextureStateName   name;
+   union {
+      uint32                value;
+      float                 floatValue;
+   };
+} SVGA3dTextureState;
+
+typedef
+struct {
+   uint32               cid;
+   /* Followed by variable number of SVGA3dTextureState structures */
+} SVGA3dCmdSetTextureState;      /* SVGA_3D_CMD_SETTEXTURESTATE */
+
+typedef
+struct {
+   uint32                   cid;
+   SVGA3dTransformType      type;
+   float                    matrix[16];
+} SVGA3dCmdSetTransform;          /* SVGA_3D_CMD_SETTRANSFORM */
+
+typedef
+struct {
+   float                min;
+   float                max;
+} SVGA3dZRange;
+
+typedef
+struct {
+   uint32               cid;
+   SVGA3dZRange         zRange;
+} SVGA3dCmdSetZRange;             /* SVGA_3D_CMD_SETZRANGE */
+
+typedef
+struct {
+   float                diffuse[4];
+   float                ambient[4];
+   float                specular[4];
+   float                emissive[4];
+   float                shininess;
+} SVGA3dMaterial;
+
+typedef
+struct {
+   uint32               cid;
+   SVGA3dFace           face;
+   SVGA3dMaterial       material;
+} SVGA3dCmdSetMaterial;           /* SVGA_3D_CMD_SETMATERIAL */
+
+typedef
+struct {
+   uint32               cid;
+   uint32               index;
+   SVGA3dLightData      data;
+} SVGA3dCmdSetLightData;           /* SVGA_3D_CMD_SETLIGHTDATA */
+
+typedef
+struct {
+   uint32               cid;
+   uint32               index;
+   uint32               enabled;
+} SVGA3dCmdSetLightEnabled;      /* SVGA_3D_CMD_SETLIGHTENABLED */
+
+typedef
+struct {
+   uint32               cid;
+   SVGA3dRect           rect;
+} SVGA3dCmdSetViewport;           /* SVGA_3D_CMD_SETVIEWPORT */
+
+typedef
+struct {
+   uint32               cid;
+   SVGA3dRect           rect;
+} SVGA3dCmdSetScissorRect;         /* SVGA_3D_CMD_SETSCISSORRECT */
+
+typedef
+struct {
+   uint32               cid;
+   uint32               index;
+   float                plane[4];
+} SVGA3dCmdSetClipPlane;           /* SVGA_3D_CMD_SETCLIPPLANE */
+
+typedef
+struct {
+   uint32               cid;
+   uint32               shid;
+   SVGA3dShaderType     type;
+   /* Followed by variable number of DWORDs for shader bycode */
+} SVGA3dCmdDefineShader;           /* SVGA_3D_CMD_SHADER_DEFINE */
+
+typedef
+struct {
+   uint32               cid;
+   uint32               shid;
+   SVGA3dShaderType     type;
+} SVGA3dCmdDestroyShader;         /* SVGA_3D_CMD_SHADER_DESTROY */
+
+typedef
+struct {
+   uint32                  cid;
+   uint32                  reg;     /* register number */
+   SVGA3dShaderType        type;
+   SVGA3dShaderConstType   ctype;
+   uint32                  values[4];
+} SVGA3dCmdSetShaderConst;        /* SVGA_3D_CMD_SET_SHADER_CONST */
+
+typedef
+struct {
+   uint32               cid;
+   SVGA3dShaderType     type;
+   uint32               shid;
+} SVGA3dCmdSetShader;             /* SVGA_3D_CMD_SET_SHADER */
+
+typedef
+struct {
+   uint32               cid;
+   SVGA3dQueryType      type;
+} SVGA3dCmdBeginQuery;           /* SVGA_3D_CMD_BEGIN_QUERY */
+
+typedef
+struct {
+   uint32               cid;
+   SVGA3dQueryType      type;
+   SVGAGuestPtr         guestResult;  /* Points to an SVGA3dQueryResult structure */
+} SVGA3dCmdEndQuery;                  /* SVGA_3D_CMD_END_QUERY */
+
+typedef
+struct {
+   uint32               cid;          /* Same parameters passed to END_QUERY */
+   SVGA3dQueryType      type;
+   SVGAGuestPtr         guestResult;
+} SVGA3dCmdWaitForQuery;              /* SVGA_3D_CMD_WAIT_FOR_QUERY */
+
+typedef
+struct {
+   uint32               totalSize;    /* Set by guest before query is ended. */
+   SVGA3dQueryState     state;        /* Set by host or guest. See SVGA3dQueryState. */
+   union {                            /* Set by host on exit from PENDING state */
+      uint32            result32;
+   };
+} SVGA3dQueryResult;
+
+/*
+ * SVGA_3D_CMD_BLIT_SURFACE_TO_SCREEN --
+ *
+ *    This is a blit from an SVGA3D surface to a Screen Object. Just
+ *    like GMR-to-screen blits, this blit may be directed at a
+ *    specific screen or to the virtual coordinate space.
+ *
+ *    The blit copies from a rectangular region of an SVGA3D surface
+ *    image to a rectangular region of a screen or screens.
+ *
+ *    This command takes an optional variable-length list of clipping
+ *    rectangles after the body of the command. If no rectangles are
+ *    specified, there is no clipping region. The entire destRect is
+ *    drawn to. If one or more rectangles are included, they describe
+ *    a clipping region. The clip rectangle coordinates are measured
+ *    relative to the top-left corner of destRect.
+ *
+ *    This clipping region serves multiple purposes:
+ *
+ *      - It can be used to perform an irregularly shaped blit more
+ *        efficiently than by issuing many separate blit commands.
+ *
+ *      - It is equivalent to allowing blits with non-integer
+ *        source coordinates. You could blit just one half-pixel
+ *        of a source, for example, by specifying a larger
+ *        destination rectangle than you need, then removing
+ *        part of it using a clip rectangle.
+ *
+ * Availability:
+ *    SVGA_FIFO_CAP_SCREEN_OBJECT
+ *
+ * Limitations:
+ *
+ *    - Currently, no backend supports blits from a mipmap or face
+ *      other than the first one.
+ */
+
+typedef
+struct {
+   SVGA3dSurfaceImageId srcImage;
+   SVGASignedRect       srcRect;
+   uint32               destScreenId; /* Screen ID or SVGA_ID_INVALID for virt. coords */
+   SVGASignedRect       destRect;     /* Supports scaling if src/rest different size */
+   /* Clipping: zero or more SVGASignedRects follow */
+} SVGA3dCmdBlitSurfaceToScreen;         /* SVGA_3D_CMD_BLIT_SURFACE_TO_SCREEN */
+
+
+/*
+ * Capability query index.
+ *
+ * Notes:
+ *
+ *   1. SVGA3D_DEVCAP_MAX_TEXTURES reflects the maximum number of
+ *      fixed-function texture units available. Each of these units
+ *      work in both FFP and Shader modes, and they support texture
+ *      transforms and texture coordinates. The host may have additional
+ *      texture image units that are only usable with shaders.
+ *
+ *   2. The BUFFER_FORMAT capabilities are deprecated, and they always
+ *      return TRUE. Even on physical hardware that does not support
+ *      these formats natively, the SVGA3D device will provide an emulation
+ *      which should be invisible to the guest OS.
+ *
+ *      In general, the SVGA3D device should support any operation on
+ *      any surface format, it just may perform some of these
+ *      operations in software depending on the capabilities of the
+ *      available physical hardware.
+ *
+ *      XXX: In the future, we will add capabilities that describe in
+ *      detail what formats are supported in hardware for what kinds
+ *      of operations.
+ */
+
+typedef enum {
+   SVGA3D_DEVCAP_3D                                = 0,
+   SVGA3D_DEVCAP_MAX_LIGHTS                        = 1,
+   SVGA3D_DEVCAP_MAX_TEXTURES                      = 2,  /* See note (1) */
+   SVGA3D_DEVCAP_MAX_CLIP_PLANES                   = 3,
+   SVGA3D_DEVCAP_VERTEX_SHADER_VERSION             = 4,
+   SVGA3D_DEVCAP_VERTEX_SHADER                     = 5,
+   SVGA3D_DEVCAP_FRAGMENT_SHADER_VERSION           = 6,
+   SVGA3D_DEVCAP_FRAGMENT_SHADER                   = 7,
+   SVGA3D_DEVCAP_MAX_RENDER_TARGETS                = 8,
+   SVGA3D_DEVCAP_S23E8_TEXTURES                    = 9,
+   SVGA3D_DEVCAP_S10E5_TEXTURES                    = 10,
+   SVGA3D_DEVCAP_MAX_FIXED_VERTEXBLEND             = 11,
+   SVGA3D_DEVCAP_D16_BUFFER_FORMAT                 = 12, /* See note (2) */
+   SVGA3D_DEVCAP_D24S8_BUFFER_FORMAT               = 13, /* See note (2) */
+   SVGA3D_DEVCAP_D24X8_BUFFER_FORMAT               = 14, /* See note (2) */
+   SVGA3D_DEVCAP_QUERY_TYPES                       = 15,
+   SVGA3D_DEVCAP_TEXTURE_GRADIENT_SAMPLING         = 16,
+   SVGA3D_DEVCAP_MAX_POINT_SIZE                    = 17,
+   SVGA3D_DEVCAP_MAX_SHADER_TEXTURES               = 18,
+   SVGA3D_DEVCAP_MAX_TEXTURE_WIDTH                 = 19,
+   SVGA3D_DEVCAP_MAX_TEXTURE_HEIGHT                = 20,
+   SVGA3D_DEVCAP_MAX_VOLUME_EXTENT                 = 21,
+   SVGA3D_DEVCAP_MAX_TEXTURE_REPEAT                = 22,
+   SVGA3D_DEVCAP_MAX_TEXTURE_ASPECT_RATIO          = 23,
+   SVGA3D_DEVCAP_MAX_TEXTURE_ANISOTROPY            = 24,
+   SVGA3D_DEVCAP_MAX_PRIMITIVE_COUNT               = 25,
+   SVGA3D_DEVCAP_MAX_VERTEX_INDEX                  = 26,
+   SVGA3D_DEVCAP_MAX_VERTEX_SHADER_INSTRUCTIONS    = 27,
+   SVGA3D_DEVCAP_MAX_FRAGMENT_SHADER_INSTRUCTIONS  = 28,
+   SVGA3D_DEVCAP_MAX_VERTEX_SHADER_TEMPS           = 29,
+   SVGA3D_DEVCAP_MAX_FRAGMENT_SHADER_TEMPS         = 30,
+   SVGA3D_DEVCAP_TEXTURE_OPS                       = 31,
+   SVGA3D_DEVCAP_SURFACEFMT_X8R8G8B8               = 32,
+   SVGA3D_DEVCAP_SURFACEFMT_A8R8G8B8               = 33,
+   SVGA3D_DEVCAP_SURFACEFMT_A2R10G10B10            = 34,
+   SVGA3D_DEVCAP_SURFACEFMT_X1R5G5B5               = 35,
+   SVGA3D_DEVCAP_SURFACEFMT_A1R5G5B5               = 36,
+   SVGA3D_DEVCAP_SURFACEFMT_A4R4G4B4               = 37,
+   SVGA3D_DEVCAP_SURFACEFMT_R5G6B5                 = 38,
+   SVGA3D_DEVCAP_SURFACEFMT_LUMINANCE16            = 39,
+   SVGA3D_DEVCAP_SURFACEFMT_LUMINANCE8_ALPHA8      = 40,
+   SVGA3D_DEVCAP_SURFACEFMT_ALPHA8                 = 41,
+   SVGA3D_DEVCAP_SURFACEFMT_LUMINANCE8             = 42,
+   SVGA3D_DEVCAP_SURFACEFMT_Z_D16                  = 43,
+   SVGA3D_DEVCAP_SURFACEFMT_Z_D24S8                = 44,
+   SVGA3D_DEVCAP_SURFACEFMT_Z_D24X8                = 45,
+   SVGA3D_DEVCAP_SURFACEFMT_DXT1                   = 46,
+   SVGA3D_DEVCAP_SURFACEFMT_DXT2                   = 47,
+   SVGA3D_DEVCAP_SURFACEFMT_DXT3                   = 48,
+   SVGA3D_DEVCAP_SURFACEFMT_DXT4                   = 49,
+   SVGA3D_DEVCAP_SURFACEFMT_DXT5                   = 50,
+   SVGA3D_DEVCAP_SURFACEFMT_BUMPX8L8V8U8           = 51,
+   SVGA3D_DEVCAP_SURFACEFMT_A2W10V10U10            = 52,
+   SVGA3D_DEVCAP_SURFACEFMT_BUMPU8V8               = 53,
+   SVGA3D_DEVCAP_SURFACEFMT_Q8W8V8U8               = 54,
+   SVGA3D_DEVCAP_SURFACEFMT_CxV8U8                 = 55,
+   SVGA3D_DEVCAP_SURFACEFMT_R_S10E5                = 56,
+   SVGA3D_DEVCAP_SURFACEFMT_R_S23E8                = 57,
+   SVGA3D_DEVCAP_SURFACEFMT_RG_S10E5               = 58,
+   SVGA3D_DEVCAP_SURFACEFMT_RG_S23E8               = 59,
+   SVGA3D_DEVCAP_SURFACEFMT_ARGB_S10E5             = 60,
+   SVGA3D_DEVCAP_SURFACEFMT_ARGB_S23E8             = 61,
+   SVGA3D_DEVCAP_MAX_VERTEX_SHADER_TEXTURES        = 63,
+
+   /*
+    * Note that MAX_SIMULTANEOUS_RENDER_TARGETS is a maximum count of color
+    * render targets.  This does no include the depth or stencil targets.
+    */
+   SVGA3D_DEVCAP_MAX_SIMULTANEOUS_RENDER_TARGETS   = 64,
+
+   SVGA3D_DEVCAP_SURFACEFMT_V16U16                 = 65,
+   SVGA3D_DEVCAP_SURFACEFMT_G16R16                 = 66,
+   SVGA3D_DEVCAP_SURFACEFMT_A16B16G16R16           = 67,
+   SVGA3D_DEVCAP_SURFACEFMT_UYVY                   = 68,
+   SVGA3D_DEVCAP_SURFACEFMT_YUY2                   = 69,
+
+   /*
+    * Don't add new caps into the previous section; the values in this
+    * enumeration must not change. You can put new values right before
+    * SVGA3D_DEVCAP_MAX.
+    */
+   SVGA3D_DEVCAP_MAX                                  /* This must be the last index. */
+} SVGA3dDevCapIndex;
+
+typedef union {
+   Bool   b;
+   uint32 u;
+   int32  i;
+   float  f;
+} SVGA3dDevCapResult;
+
+#endif /* _SVGA3D_REG_H_ */
diff --git a/drivers/gpu/drm/vmwgfx/svga_escape.h b/drivers/gpu/drm/vmwgfx/svga_escape.h
new file mode 100644
index 000000000000..7b85e9b8c854
--- /dev/null
+++ b/drivers/gpu/drm/vmwgfx/svga_escape.h
@@ -0,0 +1,89 @@
+/**********************************************************
+ * Copyright 2007-2009 VMware, Inc.  All rights reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person
+ * obtaining a copy of this software and associated documentation
+ * files (the "Software"), to deal in the Software without
+ * restriction, including without limitation the rights to use, copy,
+ * modify, merge, publish, distribute, sublicense, and/or sell copies
+ * of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ *
+ **********************************************************/
+
+/*
+ * svga_escape.h --
+ *
+ *    Definitions for our own (vendor-specific) SVGA Escape commands.
+ */
+
+#ifndef _SVGA_ESCAPE_H_
+#define _SVGA_ESCAPE_H_
+
+
+/*
+ * Namespace IDs for the escape command
+ */
+
+#define SVGA_ESCAPE_NSID_VMWARE 0x00000000
+#define SVGA_ESCAPE_NSID_DEVEL  0xFFFFFFFF
+
+
+/*
+ * Within SVGA_ESCAPE_NSID_VMWARE, we multiplex commands according to
+ * the first DWORD of escape data (after the nsID and size). As a
+ * guideline we're using the high word and low word as a major and
+ * minor command number, respectively.
+ *
+ * Major command number allocation:
+ *
+ *   0000: Reserved
+ *   0001: SVGA_ESCAPE_VMWARE_LOG (svga_binary_logger.h)
+ *   0002: SVGA_ESCAPE_VMWARE_VIDEO (svga_overlay.h)
+ *   0003: SVGA_ESCAPE_VMWARE_HINT (svga_escape.h)
+ */
+
+#define SVGA_ESCAPE_VMWARE_MAJOR_MASK  0xFFFF0000
+
+
+/*
+ * SVGA Hint commands.
+ *
+ * These escapes let the SVGA driver provide optional information to
+ * he host about the state of the guest or guest applications. The
+ * host can use these hints to make user interface or performance
+ * decisions.
+ *
+ * Notes:
+ *
+ *   - SVGA_ESCAPE_VMWARE_HINT_FULLSCREEN is deprecated for guests
+ *     that use the SVGA Screen Object extension. Instead of sending
+ *     this escape, use the SVGA_SCREEN_FULLSCREEN_HINT flag on your
+ *     Screen Object.
+ */
+
+#define SVGA_ESCAPE_VMWARE_HINT               0x00030000
+#define SVGA_ESCAPE_VMWARE_HINT_FULLSCREEN    0x00030001  // Deprecated
+
+typedef
+struct {
+   uint32 command;
+   uint32 fullscreen;
+   struct {
+      int32 x, y;
+   } monitorPosition;
+} SVGAEscapeHintFullscreen;
+
+#endif /* _SVGA_ESCAPE_H_ */
diff --git a/drivers/gpu/drm/vmwgfx/svga_overlay.h b/drivers/gpu/drm/vmwgfx/svga_overlay.h
new file mode 100644
index 000000000000..f753d73c14b4
--- /dev/null
+++ b/drivers/gpu/drm/vmwgfx/svga_overlay.h
@@ -0,0 +1,201 @@
+/**********************************************************
+ * Copyright 2007-2009 VMware, Inc.  All rights reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person
+ * obtaining a copy of this software and associated documentation
+ * files (the "Software"), to deal in the Software without
+ * restriction, including without limitation the rights to use, copy,
+ * modify, merge, publish, distribute, sublicense, and/or sell copies
+ * of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ *
+ **********************************************************/
+
+/*
+ * svga_overlay.h --
+ *
+ *    Definitions for video-overlay support.
+ */
+
+#ifndef _SVGA_OVERLAY_H_
+#define _SVGA_OVERLAY_H_
+
+#include "svga_reg.h"
+
+/*
+ * Video formats we support
+ */
+
+#define VMWARE_FOURCC_YV12 0x32315659 // 'Y' 'V' '1' '2'
+#define VMWARE_FOURCC_YUY2 0x32595559 // 'Y' 'U' 'Y' '2'
+#define VMWARE_FOURCC_UYVY 0x59565955 // 'U' 'Y' 'V' 'Y'
+
+typedef enum {
+   SVGA_OVERLAY_FORMAT_INVALID = 0,
+   SVGA_OVERLAY_FORMAT_YV12 = VMWARE_FOURCC_YV12,
+   SVGA_OVERLAY_FORMAT_YUY2 = VMWARE_FOURCC_YUY2,
+   SVGA_OVERLAY_FORMAT_UYVY = VMWARE_FOURCC_UYVY,
+} SVGAOverlayFormat;
+
+#define SVGA_VIDEO_COLORKEY_MASK             0x00ffffff
+
+#define SVGA_ESCAPE_VMWARE_VIDEO             0x00020000
+
+#define SVGA_ESCAPE_VMWARE_VIDEO_SET_REGS    0x00020001
+        /* FIFO escape layout:
+         * Type, Stream Id, (Register Id, Value) pairs */
+
+#define SVGA_ESCAPE_VMWARE_VIDEO_FLUSH       0x00020002
+        /* FIFO escape layout:
+         * Type, Stream Id */
+
+typedef
+struct SVGAEscapeVideoSetRegs {
+   struct {
+      uint32 cmdType;
+      uint32 streamId;
+   } header;
+
+   // May include zero or more items.
+   struct {
+      uint32 registerId;
+      uint32 value;
+   } items[1];
+} SVGAEscapeVideoSetRegs;
+
+typedef
+struct SVGAEscapeVideoFlush {
+   uint32 cmdType;
+   uint32 streamId;
+} SVGAEscapeVideoFlush;
+
+
+/*
+ * Struct definitions for the video overlay commands built on
+ * SVGAFifoCmdEscape.
+ */
+typedef
+struct {
+   uint32 command;
+   uint32 overlay;
+} SVGAFifoEscapeCmdVideoBase;
+
+typedef
+struct {
+   SVGAFifoEscapeCmdVideoBase videoCmd;
+} SVGAFifoEscapeCmdVideoFlush;
+
+typedef
+struct {
+   SVGAFifoEscapeCmdVideoBase videoCmd;
+   struct {
+      uint32 regId;
+      uint32 value;
+   } items[1];
+} SVGAFifoEscapeCmdVideoSetRegs;
+
+typedef
+struct {
+   SVGAFifoEscapeCmdVideoBase videoCmd;
+   struct {
+      uint32 regId;
+      uint32 value;
+   } items[SVGA_VIDEO_NUM_REGS];
+} SVGAFifoEscapeCmdVideoSetAllRegs;
+
+
+/*
+ *----------------------------------------------------------------------
+ *
+ * VMwareVideoGetAttributes --
+ *
+ *      Computes the size, pitches and offsets for YUV frames.
+ *
+ * Results:
+ *      TRUE on success; otherwise FALSE on failure.
+ *
+ * Side effects:
+ *      Pitches and offsets for the given YUV frame are put in 'pitches'
+ *      and 'offsets' respectively. They are both optional though.
+ *
+ *----------------------------------------------------------------------
+ */
+
+static inline bool
+VMwareVideoGetAttributes(const SVGAOverlayFormat format,    // IN
+                         uint32 *width,                     // IN / OUT
+                         uint32 *height,                    // IN / OUT
+                         uint32 *size,                      // OUT
+                         uint32 *pitches,                   // OUT (optional)
+                         uint32 *offsets)                   // OUT (optional)
+{
+    int tmp;
+
+    *width = (*width + 1) & ~1;
+
+    if (offsets) {
+        offsets[0] = 0;
+    }
+
+    switch (format) {
+    case VMWARE_FOURCC_YV12:
+       *height = (*height + 1) & ~1;
+       *size = (*width + 3) & ~3;
+
+       if (pitches) {
+          pitches[0] = *size;
+       }
+
+       *size *= *height;
+
+       if (offsets) {
+          offsets[1] = *size;
+       }
+
+       tmp = ((*width >> 1) + 3) & ~3;
+
+       if (pitches) {
+          pitches[1] = pitches[2] = tmp;
+       }
+
+       tmp *= (*height >> 1);
+       *size += tmp;
+
+       if (offsets) {
+          offsets[2] = *size;
+       }
+
+       *size += tmp;
+       break;
+
+    case VMWARE_FOURCC_YUY2:
+    case VMWARE_FOURCC_UYVY:
+       *size = *width * 2;
+
+       if (pitches) {
+          pitches[0] = *size;
+       }
+
+       *size *= *height;
+       break;
+
+    default:
+       return false;
+    }
+
+    return true;
+}
+
+#endif // _SVGA_OVERLAY_H_
diff --git a/drivers/gpu/drm/vmwgfx/svga_reg.h b/drivers/gpu/drm/vmwgfx/svga_reg.h
new file mode 100644
index 000000000000..1b96c2ec07dd
--- /dev/null
+++ b/drivers/gpu/drm/vmwgfx/svga_reg.h
@@ -0,0 +1,1346 @@
+/**********************************************************
+ * Copyright 1998-2009 VMware, Inc.  All rights reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person
+ * obtaining a copy of this software and associated documentation
+ * files (the "Software"), to deal in the Software without
+ * restriction, including without limitation the rights to use, copy,
+ * modify, merge, publish, distribute, sublicense, and/or sell copies
+ * of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ *
+ **********************************************************/
+
+/*
+ * svga_reg.h --
+ *
+ *    Virtual hardware definitions for the VMware SVGA II device.
+ */
+
+#ifndef _SVGA_REG_H_
+#define _SVGA_REG_H_
+
+/*
+ * PCI device IDs.
+ */
+#define PCI_VENDOR_ID_VMWARE            0x15AD
+#define PCI_DEVICE_ID_VMWARE_SVGA2      0x0405
+
+/*
+ * Legal values for the SVGA_REG_CURSOR_ON register in old-fashioned
+ * cursor bypass mode. This is still supported, but no new guest
+ * drivers should use it.
+ */
+#define SVGA_CURSOR_ON_HIDE            0x0   /* Must be 0 to maintain backward compatibility */
+#define SVGA_CURSOR_ON_SHOW            0x1   /* Must be 1 to maintain backward compatibility */
+#define SVGA_CURSOR_ON_REMOVE_FROM_FB  0x2   /* Remove the cursor from the framebuffer because we need to see what's under it */
+#define SVGA_CURSOR_ON_RESTORE_TO_FB   0x3   /* Put the cursor back in the framebuffer so the user can see it */
+
+/*
+ * The maximum framebuffer size that can traced for e.g. guests in VESA mode.
+ * The changeMap in the monitor is proportional to this number. Therefore, we'd
+ * like to keep it as small as possible to reduce monitor overhead (using
+ * SVGA_VRAM_MAX_SIZE for this increases the size of the shared area by over
+ * 4k!).
+ *
+ * NB: For compatibility reasons, this value must be greater than 0xff0000.
+ *     See bug 335072.
+ */
+#define SVGA_FB_MAX_TRACEABLE_SIZE      0x1000000
+
+#define SVGA_MAX_PSEUDOCOLOR_DEPTH      8
+#define SVGA_MAX_PSEUDOCOLORS           (1 << SVGA_MAX_PSEUDOCOLOR_DEPTH)
+#define SVGA_NUM_PALETTE_REGS           (3 * SVGA_MAX_PSEUDOCOLORS)
+
+#define SVGA_MAGIC         0x900000UL
+#define SVGA_MAKE_ID(ver)  (SVGA_MAGIC << 8 | (ver))
+
+/* Version 2 let the address of the frame buffer be unsigned on Win32 */
+#define SVGA_VERSION_2     2
+#define SVGA_ID_2          SVGA_MAKE_ID(SVGA_VERSION_2)
+
+/* Version 1 has new registers starting with SVGA_REG_CAPABILITIES so
+   PALETTE_BASE has moved */
+#define SVGA_VERSION_1     1
+#define SVGA_ID_1          SVGA_MAKE_ID(SVGA_VERSION_1)
+
+/* Version 0 is the initial version */
+#define SVGA_VERSION_0     0
+#define SVGA_ID_0          SVGA_MAKE_ID(SVGA_VERSION_0)
+
+/* "Invalid" value for all SVGA IDs. (Version ID, screen object ID, surface ID...) */
+#define SVGA_ID_INVALID    0xFFFFFFFF
+
+/* Port offsets, relative to BAR0 */
+#define SVGA_INDEX_PORT         0x0
+#define SVGA_VALUE_PORT         0x1
+#define SVGA_BIOS_PORT          0x2
+#define SVGA_IRQSTATUS_PORT     0x8
+
+/*
+ * Interrupt source flags for IRQSTATUS_PORT and IRQMASK.
+ *
+ * Interrupts are only supported when the
+ * SVGA_CAP_IRQMASK capability is present.
+ */
+#define SVGA_IRQFLAG_ANY_FENCE            0x1    /* Any fence was passed */
+#define SVGA_IRQFLAG_FIFO_PROGRESS        0x2    /* Made forward progress in the FIFO */
+#define SVGA_IRQFLAG_FENCE_GOAL           0x4    /* SVGA_FIFO_FENCE_GOAL reached */
+
+/*
+ * Registers
+ */
+
+enum {
+   SVGA_REG_ID = 0,
+   SVGA_REG_ENABLE = 1,
+   SVGA_REG_WIDTH = 2,
+   SVGA_REG_HEIGHT = 3,
+   SVGA_REG_MAX_WIDTH = 4,
+   SVGA_REG_MAX_HEIGHT = 5,
+   SVGA_REG_DEPTH = 6,
+   SVGA_REG_BITS_PER_PIXEL = 7,       /* Current bpp in the guest */
+   SVGA_REG_PSEUDOCOLOR = 8,
+   SVGA_REG_RED_MASK = 9,
+   SVGA_REG_GREEN_MASK = 10,
+   SVGA_REG_BLUE_MASK = 11,
+   SVGA_REG_BYTES_PER_LINE = 12,
+   SVGA_REG_FB_START = 13,            /* (Deprecated) */
+   SVGA_REG_FB_OFFSET = 14,
+   SVGA_REG_VRAM_SIZE = 15,
+   SVGA_REG_FB_SIZE = 16,
+
+   /* ID 0 implementation only had the above registers, then the palette */
+
+   SVGA_REG_CAPABILITIES = 17,
+   SVGA_REG_MEM_START = 18,           /* (Deprecated) */
+   SVGA_REG_MEM_SIZE = 19,
+   SVGA_REG_CONFIG_DONE = 20,         /* Set when memory area configured */
+   SVGA_REG_SYNC = 21,                /* See "FIFO Synchronization Registers" */
+   SVGA_REG_BUSY = 22,                /* See "FIFO Synchronization Registers" */
+   SVGA_REG_GUEST_ID = 23,            /* Set guest OS identifier */
+   SVGA_REG_CURSOR_ID = 24,           /* (Deprecated) */
+   SVGA_REG_CURSOR_X = 25,            /* (Deprecated) */
+   SVGA_REG_CURSOR_Y = 26,            /* (Deprecated) */
+   SVGA_REG_CURSOR_ON = 27,           /* (Deprecated) */
+   SVGA_REG_HOST_BITS_PER_PIXEL = 28, /* (Deprecated) */
+   SVGA_REG_SCRATCH_SIZE = 29,        /* Number of scratch registers */
+   SVGA_REG_MEM_REGS = 30,            /* Number of FIFO registers */
+   SVGA_REG_NUM_DISPLAYS = 31,        /* (Deprecated) */
+   SVGA_REG_PITCHLOCK = 32,           /* Fixed pitch for all modes */
+   SVGA_REG_IRQMASK = 33,             /* Interrupt mask */
+
+   /* Legacy multi-monitor support */
+   SVGA_REG_NUM_GUEST_DISPLAYS = 34,/* Number of guest displays in X/Y direction */
+   SVGA_REG_DISPLAY_ID = 35,        /* Display ID for the following display attributes */
+   SVGA_REG_DISPLAY_IS_PRIMARY = 36,/* Whether this is a primary display */
+   SVGA_REG_DISPLAY_POSITION_X = 37,/* The display position x */
+   SVGA_REG_DISPLAY_POSITION_Y = 38,/* The display position y */
+   SVGA_REG_DISPLAY_WIDTH = 39,     /* The display's width */
+   SVGA_REG_DISPLAY_HEIGHT = 40,    /* The display's height */
+
+   /* See "Guest memory regions" below. */
+   SVGA_REG_GMR_ID = 41,
+   SVGA_REG_GMR_DESCRIPTOR = 42,
+   SVGA_REG_GMR_MAX_IDS = 43,
+   SVGA_REG_GMR_MAX_DESCRIPTOR_LENGTH = 44,
+
+   SVGA_REG_TRACES = 45,            /* Enable trace-based updates even when FIFO is on */
+   SVGA_REG_TOP = 46,               /* Must be 1 more than the last register */
+
+   SVGA_PALETTE_BASE = 1024,        /* Base of SVGA color map */
+   /* Next 768 (== 256*3) registers exist for colormap */
+
+   SVGA_SCRATCH_BASE = SVGA_PALETTE_BASE + SVGA_NUM_PALETTE_REGS
+                                    /* Base of scratch registers */
+   /* Next reg[SVGA_REG_SCRATCH_SIZE] registers exist for scratch usage:
+      First 4 are reserved for VESA BIOS Extension; any remaining are for
+      the use of the current SVGA driver. */
+};
+
+
+/*
+ * Guest memory regions (GMRs):
+ *
+ * This is a new memory mapping feature available in SVGA devices
+ * which have the SVGA_CAP_GMR bit set. Previously, there were two
+ * fixed memory regions available with which to share data between the
+ * device and the driver: the FIFO ('MEM') and the framebuffer. GMRs
+ * are our name for an extensible way of providing arbitrary DMA
+ * buffers for use between the driver and the SVGA device. They are a
+ * new alternative to framebuffer memory, usable for both 2D and 3D
+ * graphics operations.
+ *
+ * Since GMR mapping must be done synchronously with guest CPU
+ * execution, we use a new pair of SVGA registers:
+ *
+ *   SVGA_REG_GMR_ID --
+ *
+ *     Read/write.
+ *     This register holds the 32-bit ID (a small positive integer)
+ *     of a GMR to create, delete, or redefine. Writing this register
+ *     has no side-effects.
+ *
+ *   SVGA_REG_GMR_DESCRIPTOR --
+ *
+ *     Write-only.
+ *     Writing this register will create, delete, or redefine the GMR
+ *     specified by the above ID register. If this register is zero,
+ *     the GMR is deleted. Any pointers into this GMR (including those
+ *     currently being processed by FIFO commands) will be
+ *     synchronously invalidated.
+ *
+ *     If this register is nonzero, it must be the physical page
+ *     number (PPN) of a data structure which describes the physical
+ *     layout of the memory region this GMR should describe. The
+ *     descriptor structure will be read synchronously by the SVGA
+ *     device when this register is written. The descriptor need not
+ *     remain allocated for the lifetime of the GMR.
+ *
+ *     The guest driver should write SVGA_REG_GMR_ID first, then
+ *     SVGA_REG_GMR_DESCRIPTOR.
+ *
+ *   SVGA_REG_GMR_MAX_IDS --
+ *
+ *     Read-only.
+ *     The SVGA device may choose to support a maximum number of
+ *     user-defined GMR IDs. This register holds the number of supported
+ *     IDs. (The maximum supported ID plus 1)
+ *
+ *   SVGA_REG_GMR_MAX_DESCRIPTOR_LENGTH --
+ *
+ *     Read-only.
+ *     The SVGA device may choose to put a limit on the total number
+ *     of SVGAGuestMemDescriptor structures it will read when defining
+ *     a single GMR.
+ *
+ * The descriptor structure is an array of SVGAGuestMemDescriptor
+ * structures. Each structure may do one of three things:
+ *
+ *   - Terminate the GMR descriptor list.
+ *     (ppn==0, numPages==0)
+ *
+ *   - Add a PPN or range of PPNs to the GMR's virtual address space.
+ *     (ppn != 0, numPages != 0)
+ *
+ *   - Provide the PPN of the next SVGAGuestMemDescriptor, in order to
+ *     support multi-page GMR descriptor tables without forcing the
+ *     driver to allocate physically contiguous memory.
+ *     (ppn != 0, numPages == 0)
+ *
+ * Note that each physical page of SVGAGuestMemDescriptor structures
+ * can describe at least 2MB of guest memory. If the driver needs to
+ * use more than one page of descriptor structures, it must use one of
+ * its SVGAGuestMemDescriptors to point to an additional page.  The
+ * device will never automatically cross a page boundary.
+ *
+ * Once the driver has described a GMR, it is immediately available
+ * for use via any FIFO command that uses an SVGAGuestPtr structure.
+ * These pointers include a GMR identifier plus an offset into that
+ * GMR.
+ *
+ * The driver must check the SVGA_CAP_GMR bit before using the GMR
+ * registers.
+ */
+
+/*
+ * Special GMR IDs, allowing SVGAGuestPtrs to point to framebuffer
+ * memory as well.  In the future, these IDs could even be used to
+ * allow legacy memory regions to be redefined by the guest as GMRs.
+ *
+ * Using the guest framebuffer (GFB) at BAR1 for general purpose DMA
+ * is being phased out. Please try to use user-defined GMRs whenever
+ * possible.
+ */
+#define SVGA_GMR_NULL         ((uint32) -1)
+#define SVGA_GMR_FRAMEBUFFER  ((uint32) -2)  // Guest Framebuffer (GFB)
+
+typedef
+struct SVGAGuestMemDescriptor {
+   uint32 ppn;
+   uint32 numPages;
+} SVGAGuestMemDescriptor;
+
+typedef
+struct SVGAGuestPtr {
+   uint32 gmrId;
+   uint32 offset;
+} SVGAGuestPtr;
+
+
+/*
+ * SVGAGMRImageFormat --
+ *
+ *    This is a packed representation of the source 2D image format
+ *    for a GMR-to-screen blit. Currently it is defined as an encoding
+ *    of the screen's color depth and bits-per-pixel, however, 16 bits
+ *    are reserved for future use to identify other encodings (such as
+ *    RGBA or higher-precision images).
+ *
+ *    Currently supported formats:
+ *
+ *       bpp depth  Format Name
+ *       --- -----  -----------
+ *        32    24  32-bit BGRX
+ *        24    24  24-bit BGR
+ *        16    16  RGB 5-6-5
+ *        16    15  RGB 5-5-5
+ *
+ */
+
+typedef
+struct SVGAGMRImageFormat {
+   union {
+      struct {
+         uint32 bitsPerPixel : 8;
+         uint32 colorDepth   : 8;
+         uint32 reserved     : 16;  // Must be zero
+      };
+
+      uint32 value;
+   };
+} SVGAGMRImageFormat;
+
+/*
+ * SVGAColorBGRX --
+ *
+ *    A 24-bit color format (BGRX), which does not depend on the
+ *    format of the legacy guest framebuffer (GFB) or the current
+ *    GMRFB state.
+ */
+
+typedef
+struct SVGAColorBGRX {
+   union {
+      struct {
+         uint32 b : 8;
+         uint32 g : 8;
+         uint32 r : 8;
+         uint32 x : 8;  // Unused
+      };
+
+      uint32 value;
+   };
+} SVGAColorBGRX;
+
+
+/*
+ * SVGASignedRect --
+ * SVGASignedPoint --
+ *
+ *    Signed rectangle and point primitives. These are used by the new
+ *    2D primitives for drawing to Screen Objects, which can occupy a
+ *    signed virtual coordinate space.
+ *
+ *    SVGASignedRect specifies a half-open interval: the (left, top)
+ *    pixel is part of the rectangle, but the (right, bottom) pixel is
+ *    not.
+ */
+
+typedef
+struct SVGASignedRect {
+   int32  left;
+   int32  top;
+   int32  right;
+   int32  bottom;
+} SVGASignedRect;
+
+typedef
+struct SVGASignedPoint {
+   int32  x;
+   int32  y;
+} SVGASignedPoint;
+
+
+/*
+ *  Capabilities
+ *
+ *  Note the holes in the bitfield. Missing bits have been deprecated,
+ *  and must not be reused. Those capabilities will never be reported
+ *  by new versions of the SVGA device.
+ */
+
+#define SVGA_CAP_NONE               0x00000000
+#define SVGA_CAP_RECT_COPY          0x00000002
+#define SVGA_CAP_CURSOR             0x00000020
+#define SVGA_CAP_CURSOR_BYPASS      0x00000040   // Legacy (Use Cursor Bypass 3 instead)
+#define SVGA_CAP_CURSOR_BYPASS_2    0x00000080   // Legacy (Use Cursor Bypass 3 instead)
+#define SVGA_CAP_8BIT_EMULATION     0x00000100
+#define SVGA_CAP_ALPHA_CURSOR       0x00000200
+#define SVGA_CAP_3D                 0x00004000
+#define SVGA_CAP_EXTENDED_FIFO      0x00008000
+#define SVGA_CAP_MULTIMON           0x00010000   // Legacy multi-monitor support
+#define SVGA_CAP_PITCHLOCK          0x00020000
+#define SVGA_CAP_IRQMASK            0x00040000
+#define SVGA_CAP_DISPLAY_TOPOLOGY   0x00080000   // Legacy multi-monitor support
+#define SVGA_CAP_GMR                0x00100000
+#define SVGA_CAP_TRACES             0x00200000
+
+
+/*
+ * FIFO register indices.
+ *
+ * The FIFO is a chunk of device memory mapped into guest physmem.  It
+ * is always treated as 32-bit words.
+ *
+ * The guest driver gets to decide how to partition it between
+ * - FIFO registers (there are always at least 4, specifying where the
+ *   following data area is and how much data it contains; there may be
+ *   more registers following these, depending on the FIFO protocol
+ *   version in use)
+ * - FIFO data, written by the guest and slurped out by the VMX.
+ * These indices are 32-bit word offsets into the FIFO.
+ */
+
+enum {
+   /*
+    * Block 1 (basic registers): The originally defined FIFO registers.
+    * These exist and are valid for all versions of the FIFO protocol.
+    */
+
+   SVGA_FIFO_MIN = 0,
+   SVGA_FIFO_MAX,       /* The distance from MIN to MAX must be at least 10K */
+   SVGA_FIFO_NEXT_CMD,
+   SVGA_FIFO_STOP,
+
+   /*
+    * Block 2 (extended registers): Mandatory registers for the extended
+    * FIFO.  These exist if the SVGA caps register includes
+    * SVGA_CAP_EXTENDED_FIFO; some of them are valid only if their
+    * associated capability bit is enabled.
+    *
+    * Note that when originally defined, SVGA_CAP_EXTENDED_FIFO implied
+    * support only for (FIFO registers) CAPABILITIES, FLAGS, and FENCE.
+    * This means that the guest has to test individually (in most cases
+    * using FIFO caps) for the presence of registers after this; the VMX
+    * can define "extended FIFO" to mean whatever it wants, and currently
+    * won't enable it unless there's room for that set and much more.
+    */
+
+   SVGA_FIFO_CAPABILITIES = 4,
+   SVGA_FIFO_FLAGS,
+   // Valid with SVGA_FIFO_CAP_FENCE:
+   SVGA_FIFO_FENCE,
+
+   /*
+    * Block 3a (optional extended registers): Additional registers for the
+    * extended FIFO, whose presence isn't actually implied by
+    * SVGA_CAP_EXTENDED_FIFO; these exist if SVGA_FIFO_MIN is high enough to
+    * leave room for them.
+    *
+    * These in block 3a, the VMX currently considers mandatory for the
+    * extended FIFO.
+    */
+
+   // Valid if exists (i.e. if extended FIFO enabled):
+   SVGA_FIFO_3D_HWVERSION,       /* See SVGA3dHardwareVersion in svga3d_reg.h */
+   // Valid with SVGA_FIFO_CAP_PITCHLOCK:
+   SVGA_FIFO_PITCHLOCK,
+
+   // Valid with SVGA_FIFO_CAP_CURSOR_BYPASS_3:
+   SVGA_FIFO_CURSOR_ON,          /* Cursor bypass 3 show/hide register */
+   SVGA_FIFO_CURSOR_X,           /* Cursor bypass 3 x register */
+   SVGA_FIFO_CURSOR_Y,           /* Cursor bypass 3 y register */
+   SVGA_FIFO_CURSOR_COUNT,       /* Incremented when any of the other 3 change */
+   SVGA_FIFO_CURSOR_LAST_UPDATED,/* Last time the host updated the cursor */
+
+   // Valid with SVGA_FIFO_CAP_RESERVE:
+   SVGA_FIFO_RESERVED,           /* Bytes past NEXT_CMD with real contents */
+
+   /*
+    * Valid with SVGA_FIFO_CAP_SCREEN_OBJECT:
+    *
+    * By default this is SVGA_ID_INVALID, to indicate that the cursor
+    * coordinates are specified relative to the virtual root. If this
+    * is set to a specific screen ID, cursor position is reinterpreted
+    * as a signed offset relative to that screen's origin. This is the
+    * only way to place the cursor on a non-rooted screen.
+    */
+   SVGA_FIFO_CURSOR_SCREEN_ID,
+
+   /*
+    * XXX: The gap here, up until SVGA_FIFO_3D_CAPS, can be used for new
+    * registers, but this must be done carefully and with judicious use of
+    * capability bits, since comparisons based on SVGA_FIFO_MIN aren't
+    * enough to tell you whether the register exists: we've shipped drivers
+    * and products that used SVGA_FIFO_3D_CAPS but didn't know about some of
+    * the earlier ones.  The actual order of introduction was:
+    * - PITCHLOCK
+    * - 3D_CAPS
+    * - CURSOR_* (cursor bypass 3)
+    * - RESERVED
+    * So, code that wants to know whether it can use any of the
+    * aforementioned registers, or anything else added after PITCHLOCK and
+    * before 3D_CAPS, needs to reason about something other than
+    * SVGA_FIFO_MIN.
+    */
+
+   /*
+    * 3D caps block space; valid with 3D hardware version >=
+    * SVGA3D_HWVERSION_WS6_B1.
+    */
+   SVGA_FIFO_3D_CAPS      = 32,
+   SVGA_FIFO_3D_CAPS_LAST = 32 + 255,
+
+   /*
+    * End of VMX's current definition of "extended-FIFO registers".
+    * Registers before here are always enabled/disabled as a block; either
+    * the extended FIFO is enabled and includes all preceding registers, or
+    * it's disabled entirely.
+    *
+    * Block 3b (truly optional extended registers): Additional registers for
+    * the extended FIFO, which the VMX already knows how to enable and
+    * disable with correct granularity.
+    *
+    * Registers after here exist if and only if the guest SVGA driver
+    * sets SVGA_FIFO_MIN high enough to leave room for them.
+    */
+
+   // Valid if register exists:
+   SVGA_FIFO_GUEST_3D_HWVERSION, /* Guest driver's 3D version */
+   SVGA_FIFO_FENCE_GOAL,         /* Matching target for SVGA_IRQFLAG_FENCE_GOAL */
+   SVGA_FIFO_BUSY,               /* See "FIFO Synchronization Registers" */
+
+   /*
+    * Always keep this last.  This defines the maximum number of
+    * registers we know about.  At power-on, this value is placed in
+    * the SVGA_REG_MEM_REGS register, and we expect the guest driver
+    * to allocate this much space in FIFO memory for registers.
+    */
+    SVGA_FIFO_NUM_REGS
+};
+
+
+/*
+ * Definition of registers included in extended FIFO support.
+ *
+ * The guest SVGA driver gets to allocate the FIFO between registers
+ * and data.  It must always allocate at least 4 registers, but old
+ * drivers stopped there.
+ *
+ * The VMX will enable extended FIFO support if and only if the guest
+ * left enough room for all registers defined as part of the mandatory
+ * set for the extended FIFO.
+ *
+ * Note that the guest drivers typically allocate the FIFO only at
+ * initialization time, not at mode switches, so it's likely that the
+ * number of FIFO registers won't change without a reboot.
+ *
+ * All registers less than this value are guaranteed to be present if
+ * svgaUser->fifo.extended is set. Any later registers must be tested
+ * individually for compatibility at each use (in the VMX).
+ *
+ * This value is used only by the VMX, so it can change without
+ * affecting driver compatibility; keep it that way?
+ */
+#define SVGA_FIFO_EXTENDED_MANDATORY_REGS  (SVGA_FIFO_3D_CAPS_LAST + 1)
+
+
+/*
+ * FIFO Synchronization Registers
+ *
+ *  This explains the relationship between the various FIFO
+ *  sync-related registers in IOSpace and in FIFO space.
+ *
+ *  SVGA_REG_SYNC --
+ *
+ *       The SYNC register can be used in two different ways by the guest:
+ *
+ *         1. If the guest wishes to fully sync (drain) the FIFO,
+ *            it will write once to SYNC then poll on the BUSY
+ *            register. The FIFO is sync'ed once BUSY is zero.
+ *
+ *         2. If the guest wants to asynchronously wake up the host,
+ *            it will write once to SYNC without polling on BUSY.
+ *            Ideally it will do this after some new commands have
+ *            been placed in the FIFO, and after reading a zero
+ *            from SVGA_FIFO_BUSY.
+ *
+ *       (1) is the original behaviour that SYNC was designed to
+ *       support.  Originally, a write to SYNC would implicitly
+ *       trigger a read from BUSY. This causes us to synchronously
+ *       process the FIFO.
+ *
+ *       This behaviour has since been changed so that writing SYNC
+ *       will *not* implicitly cause a read from BUSY. Instead, it
+ *       makes a channel call which asynchronously wakes up the MKS
+ *       thread.
+ *
+ *       New guests can use this new behaviour to implement (2)
+ *       efficiently. This lets guests get the host's attention
+ *       without waiting for the MKS to poll, which gives us much
+ *       better CPU utilization on SMP hosts and on UP hosts while
+ *       we're blocked on the host GPU.
+ *
+ *       Old guests shouldn't notice the behaviour change. SYNC was
+ *       never guaranteed to process the entire FIFO, since it was
+ *       bounded to a particular number of CPU cycles. Old guests will
+ *       still loop on the BUSY register until the FIFO is empty.
+ *
+ *       Writing to SYNC currently has the following side-effects:
+ *
+ *         - Sets SVGA_REG_BUSY to TRUE (in the monitor)
+ *         - Asynchronously wakes up the MKS thread for FIFO processing
+ *         - The value written to SYNC is recorded as a "reason", for
+ *           stats purposes.
+ *
+ *       If SVGA_FIFO_BUSY is available, drivers are advised to only
+ *       write to SYNC if SVGA_FIFO_BUSY is FALSE. Drivers should set
+ *       SVGA_FIFO_BUSY to TRUE after writing to SYNC. The MKS will
+ *       eventually set SVGA_FIFO_BUSY on its own, but this approach
+ *       lets the driver avoid sending multiple asynchronous wakeup
+ *       messages to the MKS thread.
+ *
+ *  SVGA_REG_BUSY --
+ *
+ *       This register is set to TRUE when SVGA_REG_SYNC is written,
+ *       and it reads as FALSE when the FIFO has been completely
+ *       drained.
+ *
+ *       Every read from this register causes us to synchronously
+ *       process FIFO commands. There is no guarantee as to how many
+ *       commands each read will process.
+ *
+ *       CPU time spent processing FIFO commands will be billed to
+ *       the guest.
+ *
+ *       New drivers should avoid using this register unless they
+ *       need to guarantee that the FIFO is completely drained. It
+ *       is overkill for performing a sync-to-fence. Older drivers
+ *       will use this register for any type of synchronization.
+ *
+ *  SVGA_FIFO_BUSY --
+ *
+ *       This register is a fast way for the guest driver to check
+ *       whether the FIFO is already being processed. It reads and
+ *       writes at normal RAM speeds, with no monitor intervention.
+ *
+ *       If this register reads as TRUE, the host is guaranteeing that
+ *       any new commands written into the FIFO will be noticed before
+ *       the MKS goes back to sleep.
+ *
+ *       If this register reads as FALSE, no such guarantee can be
+ *       made.
+ *
+ *       The guest should use this register to quickly determine
+ *       whether or not it needs to wake up the host. If the guest
+ *       just wrote a command or group of commands that it would like
+ *       the host to begin processing, it should:
+ *
+ *         1. Read SVGA_FIFO_BUSY. If it reads as TRUE, no further
+ *            action is necessary.
+ *
+ *         2. Write TRUE to SVGA_FIFO_BUSY. This informs future guest
+ *            code that we've already sent a SYNC to the host and we
+ *            don't need to send a duplicate.
+ *
+ *         3. Write a reason to SVGA_REG_SYNC. This will send an
+ *            asynchronous wakeup to the MKS thread.
+ */
+
+
+/*
+ * FIFO Capabilities
+ *
+ *      Fence -- Fence register and command are supported
+ *      Accel Front -- Front buffer only commands are supported
+ *      Pitch Lock -- Pitch lock register is supported
+ *      Video -- SVGA Video overlay units are supported
+ *      Escape -- Escape command is supported
+ *
+ * XXX: Add longer descriptions for each capability, including a list
+ *      of the new features that each capability provides.
+ *
+ * SVGA_FIFO_CAP_SCREEN_OBJECT --
+ *
+ *    Provides dynamic multi-screen rendering, for improved Unity and
+ *    multi-monitor modes. With Screen Object, the guest can
+ *    dynamically create and destroy 'screens', which can represent
+ *    Unity windows or virtual monitors. Screen Object also provides
+ *    strong guarantees that DMA operations happen only when
+ *    guest-initiated. Screen Object deprecates the BAR1 guest
+ *    framebuffer (GFB) and all commands that work only with the GFB.
+ *
+ *    New registers:
+ *       FIFO_CURSOR_SCREEN_ID, VIDEO_DATA_GMRID, VIDEO_DST_SCREEN_ID
+ *
+ *    New 2D commands:
+ *       DEFINE_SCREEN, DESTROY_SCREEN, DEFINE_GMRFB, BLIT_GMRFB_TO_SCREEN,
+ *       BLIT_SCREEN_TO_GMRFB, ANNOTATION_FILL, ANNOTATION_COPY
+ *
+ *    New 3D commands:
+ *       BLIT_SURFACE_TO_SCREEN
+ *
+ *    New guarantees:
+ *
+ *       - The host will not read or write guest memory, including the GFB,
+ *         except when explicitly initiated by a DMA command.
+ *
+ *       - All DMA, including legacy DMA like UPDATE and PRESENT_READBACK,
+ *         is guaranteed to complete before any subsequent FENCEs.
+ *
+ *       - All legacy commands which affect a Screen (UPDATE, PRESENT,
+ *         PRESENT_READBACK) as well as new Screen blit commands will
+ *         all behave consistently as blits, and memory will be read
+ *         or written in FIFO order.
+ *
+ *         For example, if you PRESENT from one SVGA3D surface to multiple
+ *         places on the screen, the data copied will always be from the
+ *         SVGA3D surface at the time the PRESENT was issued in the FIFO.
+ *         This was not necessarily true on devices without Screen Object.
+ *
+ *         This means that on devices that support Screen Object, the
+ *         PRESENT_READBACK command should not be necessary unless you
+ *         actually want to read back the results of 3D rendering into
+ *         system memory. (And for that, the BLIT_SCREEN_TO_GMRFB
+ *         command provides a strict superset of functionality.)
+ *
+ *       - When a screen is resized, either using Screen Object commands or
+ *         legacy multimon registers, its contents are preserved.
+ */
+
+#define SVGA_FIFO_CAP_NONE                  0
+#define SVGA_FIFO_CAP_FENCE             (1<<0)
+#define SVGA_FIFO_CAP_ACCELFRONT        (1<<1)
+#define SVGA_FIFO_CAP_PITCHLOCK         (1<<2)
+#define SVGA_FIFO_CAP_VIDEO             (1<<3)
+#define SVGA_FIFO_CAP_CURSOR_BYPASS_3   (1<<4)
+#define SVGA_FIFO_CAP_ESCAPE            (1<<5)
+#define SVGA_FIFO_CAP_RESERVE           (1<<6)
+#define SVGA_FIFO_CAP_SCREEN_OBJECT     (1<<7)
+
+
+/*
+ * FIFO Flags
+ *
+ *      Accel Front -- Driver should use front buffer only commands
+ */
+
+#define SVGA_FIFO_FLAG_NONE                 0
+#define SVGA_FIFO_FLAG_ACCELFRONT       (1<<0)
+#define SVGA_FIFO_FLAG_RESERVED        (1<<31) // Internal use only
+
+/*
+ * FIFO reservation sentinel value
+ */
+
+#define SVGA_FIFO_RESERVED_UNKNOWN      0xffffffff
+
+
+/*
+ * Video overlay support
+ */
+
+#define SVGA_NUM_OVERLAY_UNITS 32
+
+
+/*
+ * Video capabilities that the guest is currently using
+ */
+
+#define SVGA_VIDEO_FLAG_COLORKEY        0x0001
+
+
+/*
+ * Offsets for the video overlay registers
+ */
+
+enum {
+   SVGA_VIDEO_ENABLED = 0,
+   SVGA_VIDEO_FLAGS,
+   SVGA_VIDEO_DATA_OFFSET,
+   SVGA_VIDEO_FORMAT,
+   SVGA_VIDEO_COLORKEY,
+   SVGA_VIDEO_SIZE,          // Deprecated
+   SVGA_VIDEO_WIDTH,
+   SVGA_VIDEO_HEIGHT,
+   SVGA_VIDEO_SRC_X,
+   SVGA_VIDEO_SRC_Y,
+   SVGA_VIDEO_SRC_WIDTH,
+   SVGA_VIDEO_SRC_HEIGHT,
+   SVGA_VIDEO_DST_X,         // Signed int32
+   SVGA_VIDEO_DST_Y,         // Signed int32
+   SVGA_VIDEO_DST_WIDTH,
+   SVGA_VIDEO_DST_HEIGHT,
+   SVGA_VIDEO_PITCH_1,
+   SVGA_VIDEO_PITCH_2,
+   SVGA_VIDEO_PITCH_3,
+   SVGA_VIDEO_DATA_GMRID,    // Optional, defaults to SVGA_GMR_FRAMEBUFFER
+   SVGA_VIDEO_DST_SCREEN_ID, // Optional, defaults to virtual coords (SVGA_ID_INVALID)
+   SVGA_VIDEO_NUM_REGS
+};
+
+
+/*
+ * SVGA Overlay Units
+ *
+ *      width and height relate to the entire source video frame.
+ *      srcX, srcY, srcWidth and srcHeight represent subset of the source
+ *      video frame to be displayed.
+ */
+
+typedef struct SVGAOverlayUnit {
+   uint32 enabled;
+   uint32 flags;
+   uint32 dataOffset;
+   uint32 format;
+   uint32 colorKey;
+   uint32 size;
+   uint32 width;
+   uint32 height;
+   uint32 srcX;
+   uint32 srcY;
+   uint32 srcWidth;
+   uint32 srcHeight;
+   int32  dstX;
+   int32  dstY;
+   uint32 dstWidth;
+   uint32 dstHeight;
+   uint32 pitches[3];
+   uint32 dataGMRId;
+   uint32 dstScreenId;
+} SVGAOverlayUnit;
+
+
+/*
+ * SVGAScreenObject --
+ *
+ *    This is a new way to represent a guest's multi-monitor screen or
+ *    Unity window. Screen objects are only supported if the
+ *    SVGA_FIFO_CAP_SCREEN_OBJECT capability bit is set.
+ *
+ *    If Screen Objects are supported, they can be used to fully
+ *    replace the functionality provided by the framebuffer registers
+ *    (SVGA_REG_WIDTH, HEIGHT, etc.) and by SVGA_CAP_DISPLAY_TOPOLOGY.
+ *
+ *    The screen object is a struct with guaranteed binary
+ *    compatibility. New flags can be added, and the struct may grow,
+ *    but existing fields must retain their meaning.
+ *
+ */
+
+#define SVGA_SCREEN_HAS_ROOT    (1 << 0)  // Screen is present in the virtual coord space
+#define SVGA_SCREEN_IS_PRIMARY  (1 << 1)  // Guest considers this screen to be 'primary'
+#define SVGA_SCREEN_FULLSCREEN_HINT (1 << 2)   // Guest is running a fullscreen app here
+
+typedef
+struct SVGAScreenObject {
+   uint32 structSize;   // sizeof(SVGAScreenObject)
+   uint32 id;
+   uint32 flags;
+   struct {
+      uint32 width;
+      uint32 height;
+   } size;
+   struct {
+      int32 x;
+      int32 y;
+   } root;              // Only used if SVGA_SCREEN_HAS_ROOT is set.
+} SVGAScreenObject;
+
+
+/*
+ *  Commands in the command FIFO:
+ *
+ *  Command IDs defined below are used for the traditional 2D FIFO
+ *  communication (not all commands are available for all versions of the
+ *  SVGA FIFO protocol).
+ *
+ *  Note the holes in the command ID numbers: These commands have been
+ *  deprecated, and the old IDs must not be reused.
+ *
+ *  Command IDs from 1000 to 1999 are reserved for use by the SVGA3D
+ *  protocol.
+ *
+ *  Each command's parameters are described by the comments and
+ *  structs below.
+ */
+
+typedef enum {
+   SVGA_CMD_INVALID_CMD           = 0,
+   SVGA_CMD_UPDATE                = 1,
+   SVGA_CMD_RECT_COPY             = 3,
+   SVGA_CMD_DEFINE_CURSOR         = 19,
+   SVGA_CMD_DEFINE_ALPHA_CURSOR   = 22,
+   SVGA_CMD_UPDATE_VERBOSE        = 25,
+   SVGA_CMD_FRONT_ROP_FILL        = 29,
+   SVGA_CMD_FENCE                 = 30,
+   SVGA_CMD_ESCAPE                = 33,
+   SVGA_CMD_DEFINE_SCREEN         = 34,
+   SVGA_CMD_DESTROY_SCREEN        = 35,
+   SVGA_CMD_DEFINE_GMRFB          = 36,
+   SVGA_CMD_BLIT_GMRFB_TO_SCREEN  = 37,
+   SVGA_CMD_BLIT_SCREEN_TO_GMRFB  = 38,
+   SVGA_CMD_ANNOTATION_FILL       = 39,
+   SVGA_CMD_ANNOTATION_COPY       = 40,
+   SVGA_CMD_MAX
+} SVGAFifoCmdId;
+
+#define SVGA_CMD_MAX_ARGS           64
+
+
+/*
+ * SVGA_CMD_UPDATE --
+ *
+ *    This is a DMA transfer which copies from the Guest Framebuffer
+ *    (GFB) at BAR1 + SVGA_REG_FB_OFFSET to any screens which
+ *    intersect with the provided virtual rectangle.
+ *
+ *    This command does not support using arbitrary guest memory as a
+ *    data source- it only works with the pre-defined GFB memory.
+ *    This command also does not support signed virtual coordinates.
+ *    If you have defined screens (using SVGA_CMD_DEFINE_SCREEN) with
+ *    negative root x/y coordinates, the negative portion of those
+ *    screens will not be reachable by this command.
+ *
+ *    This command is not necessary when using framebuffer
+ *    traces. Traces are automatically enabled if the SVGA FIFO is
+ *    disabled, and you may explicitly enable/disable traces using
+ *    SVGA_REG_TRACES. With traces enabled, any write to the GFB will
+ *    automatically act as if a subsequent SVGA_CMD_UPDATE was issued.
+ *
+ *    Traces and SVGA_CMD_UPDATE are the only supported ways to render
+ *    pseudocolor screen updates. The newer Screen Object commands
+ *    only support true color formats.
+ *
+ * Availability:
+ *    Always available.
+ */
+
+typedef
+struct {
+   uint32 x;
+   uint32 y;
+   uint32 width;
+   uint32 height;
+} SVGAFifoCmdUpdate;
+
+
+/*
+ * SVGA_CMD_RECT_COPY --
+ *
+ *    Perform a rectangular DMA transfer from one area of the GFB to
+ *    another, and copy the result to any screens which intersect it.
+ *
+ * Availability:
+ *    SVGA_CAP_RECT_COPY
+ */
+
+typedef
+struct {
+   uint32 srcX;
+   uint32 srcY;
+   uint32 destX;
+   uint32 destY;
+   uint32 width;
+   uint32 height;
+} SVGAFifoCmdRectCopy;
+
+
+/*
+ * SVGA_CMD_DEFINE_CURSOR --
+ *
+ *    Provide a new cursor image, as an AND/XOR mask.
+ *
+ *    The recommended way to position the cursor overlay is by using
+ *    the SVGA_FIFO_CURSOR_* registers, supported by the
+ *    SVGA_FIFO_CAP_CURSOR_BYPASS_3 capability.
+ *
+ * Availability:
+ *    SVGA_CAP_CURSOR
+ */
+
+typedef
+struct {
+   uint32 id;             // Reserved, must be zero.
+   uint32 hotspotX;
+   uint32 hotspotY;
+   uint32 width;
+   uint32 height;
+   uint32 andMaskDepth;   // Value must be 1 or equal to BITS_PER_PIXEL
+   uint32 xorMaskDepth;   // Value must be 1 or equal to BITS_PER_PIXEL
+   /*
+    * Followed by scanline data for AND mask, then XOR mask.
+    * Each scanline is padded to a 32-bit boundary.
+   */
+} SVGAFifoCmdDefineCursor;
+
+
+/*
+ * SVGA_CMD_DEFINE_ALPHA_CURSOR --
+ *
+ *    Provide a new cursor image, in 32-bit BGRA format.
+ *
+ *    The recommended way to position the cursor overlay is by using
+ *    the SVGA_FIFO_CURSOR_* registers, supported by the
+ *    SVGA_FIFO_CAP_CURSOR_BYPASS_3 capability.
+ *
+ * Availability:
+ *    SVGA_CAP_ALPHA_CURSOR
+ */
+
+typedef
+struct {
+   uint32 id;             // Reserved, must be zero.
+   uint32 hotspotX;
+   uint32 hotspotY;
+   uint32 width;
+   uint32 height;
+   /* Followed by scanline data */
+} SVGAFifoCmdDefineAlphaCursor;
+
+
+/*
+ * SVGA_CMD_UPDATE_VERBOSE --
+ *
+ *    Just like SVGA_CMD_UPDATE, but also provide a per-rectangle
+ *    'reason' value, an opaque cookie which is used by internal
+ *    debugging tools. Third party drivers should not use this
+ *    command.
+ *
+ * Availability:
+ *    SVGA_CAP_EXTENDED_FIFO
+ */
+
+typedef
+struct {
+   uint32 x;
+   uint32 y;
+   uint32 width;
+   uint32 height;
+   uint32 reason;
+} SVGAFifoCmdUpdateVerbose;
+
+
+/*
+ * SVGA_CMD_FRONT_ROP_FILL --
+ *
+ *    This is a hint which tells the SVGA device that the driver has
+ *    just filled a rectangular region of the GFB with a solid
+ *    color. Instead of reading these pixels from the GFB, the device
+ *    can assume that they all equal 'color'. This is primarily used
+ *    for remote desktop protocols.
+ *
+ * Availability:
+ *    SVGA_FIFO_CAP_ACCELFRONT
+ */
+
+#define  SVGA_ROP_COPY                    0x03
+
+typedef
+struct {
+   uint32 color;     // In the same format as the GFB
+   uint32 x;
+   uint32 y;
+   uint32 width;
+   uint32 height;
+   uint32 rop;       // Must be SVGA_ROP_COPY
+} SVGAFifoCmdFrontRopFill;
+
+
+/*
+ * SVGA_CMD_FENCE --
+ *
+ *    Insert a synchronization fence.  When the SVGA device reaches
+ *    this command, it will copy the 'fence' value into the
+ *    SVGA_FIFO_FENCE register. It will also compare the fence against
+ *    SVGA_FIFO_FENCE_GOAL. If the fence matches the goal and the
+ *    SVGA_IRQFLAG_FENCE_GOAL interrupt is enabled, the device will
+ *    raise this interrupt.
+ *
+ * Availability:
+ *    SVGA_FIFO_FENCE for this command,
+ *    SVGA_CAP_IRQMASK for SVGA_FIFO_FENCE_GOAL.
+ */
+
+typedef
+struct {
+   uint32 fence;
+} SVGAFifoCmdFence;
+
+
+/*
+ * SVGA_CMD_ESCAPE --
+ *
+ *    Send an extended or vendor-specific variable length command.
+ *    This is used for video overlay, third party plugins, and
+ *    internal debugging tools. See svga_escape.h
+ *
+ * Availability:
+ *    SVGA_FIFO_CAP_ESCAPE
+ */
+
+typedef
+struct {
+   uint32 nsid;
+   uint32 size;
+   /* followed by 'size' bytes of data */
+} SVGAFifoCmdEscape;
+
+
+/*
+ * SVGA_CMD_DEFINE_SCREEN --
+ *
+ *    Define or redefine an SVGAScreenObject. See the description of
+ *    SVGAScreenObject above.  The video driver is responsible for
+ *    generating new screen IDs. They should be small positive
+ *    integers. The virtual device will have an implementation
+ *    specific upper limit on the number of screen IDs
+ *    supported. Drivers are responsible for recycling IDs. The first
+ *    valid ID is zero.
+ *
+ *    - Interaction with other registers:
+ *
+ *    For backwards compatibility, when the GFB mode registers (WIDTH,
+ *    HEIGHT, PITCHLOCK, BITS_PER_PIXEL) are modified, the SVGA device
+ *    deletes all screens other than screen #0, and redefines screen
+ *    #0 according to the specified mode. Drivers that use
+ *    SVGA_CMD_DEFINE_SCREEN should destroy or redefine screen #0.
+ *
+ *    If you use screen objects, do not use the legacy multi-mon
+ *    registers (SVGA_REG_NUM_GUEST_DISPLAYS, SVGA_REG_DISPLAY_*).
+ *
+ * Availability:
+ *    SVGA_FIFO_CAP_SCREEN_OBJECT
+ */
+
+typedef
+struct {
+   SVGAScreenObject screen;   // Variable-length according to version
+} SVGAFifoCmdDefineScreen;
+
+
+/*
+ * SVGA_CMD_DESTROY_SCREEN --
+ *
+ *    Destroy an SVGAScreenObject. Its ID is immediately available for
+ *    re-use.
+ *
+ * Availability:
+ *    SVGA_FIFO_CAP_SCREEN_OBJECT
+ */
+
+typedef
+struct {
+   uint32 screenId;
+} SVGAFifoCmdDestroyScreen;
+
+
+/*
+ * SVGA_CMD_DEFINE_GMRFB --
+ *
+ *    This command sets a piece of SVGA device state called the
+ *    Guest Memory Region Framebuffer, or GMRFB. The GMRFB is a
+ *    piece of light-weight state which identifies the location and
+ *    format of an image in guest memory or in BAR1. The GMRFB has
+ *    an arbitrary size, and it doesn't need to match the geometry
+ *    of the GFB or any screen object.
+ *
+ *    The GMRFB can be redefined as often as you like. You could
+ *    always use the same GMRFB, you could redefine it before
+ *    rendering from a different guest screen, or you could even
+ *    redefine it before every blit.
+ *
+ *    There are multiple ways to use this command. The simplest way is
+ *    to use it to move the framebuffer either to elsewhere in the GFB
+ *    (BAR1) memory region, or to a user-defined GMR. This lets a
+ *    driver use a framebuffer allocated entirely out of normal system
+ *    memory, which we encourage.
+ *
+ *    Another way to use this command is to set up a ring buffer of
+ *    updates in GFB memory. If a driver wants to ensure that no
+ *    frames are skipped by the SVGA device, it is important that the
+ *    driver not modify the source data for a blit until the device is
+ *    done processing the command. One efficient way to accomplish
+ *    this is to use a ring of small DMA buffers. Each buffer is used
+ *    for one blit, then we move on to the next buffer in the
+ *    ring. The FENCE mechanism is used to protect each buffer from
+ *    re-use until the device is finished with that buffer's
+ *    corresponding blit.
+ *
+ *    This command does not affect the meaning of SVGA_CMD_UPDATE.
+ *    UPDATEs always occur from the legacy GFB memory area. This
+ *    command has no support for pseudocolor GMRFBs. Currently only
+ *    true-color 15, 16, and 24-bit depths are supported. Future
+ *    devices may expose capabilities for additional framebuffer
+ *    formats.
+ *
+ *    The default GMRFB value is undefined. Drivers must always send
+ *    this command at least once before performing any blit from the
+ *    GMRFB.
+ *
+ * Availability:
+ *    SVGA_FIFO_CAP_SCREEN_OBJECT
+ */
+
+typedef
+struct {
+   SVGAGuestPtr        ptr;
+   uint32              bytesPerLine;
+   SVGAGMRImageFormat  format;
+} SVGAFifoCmdDefineGMRFB;
+
+
+/*
+ * SVGA_CMD_BLIT_GMRFB_TO_SCREEN --
+ *
+ *    This is a guest-to-host blit. It performs a DMA operation to
+ *    copy a rectangular region of pixels from the current GMRFB to
+ *    one or more Screen Objects.
+ *
+ *    The destination coordinate may be specified relative to a
+ *    screen's origin (if a screen ID is specified) or relative to the
+ *    virtual coordinate system's origin (if the screen ID is
+ *    SVGA_ID_INVALID). The actual destination may span zero or more
+ *    screens, in the case of a virtual destination rect or a rect
+ *    which extends off the edge of the specified screen.
+ *
+ *    This command writes to the screen's "base layer": the underlying
+ *    framebuffer which exists below any cursor or video overlays. No
+ *    action is necessary to explicitly hide or update any overlays
+ *    which exist on top of the updated region.
+ *
+ *    The SVGA device is guaranteed to finish reading from the GMRFB
+ *    by the time any subsequent FENCE commands are reached.
+ *
+ *    This command consumes an annotation. See the
+ *    SVGA_CMD_ANNOTATION_* commands for details.
+ *
+ * Availability:
+ *    SVGA_FIFO_CAP_SCREEN_OBJECT
+ */
+
+typedef
+struct {
+   SVGASignedPoint  srcOrigin;
+   SVGASignedRect   destRect;
+   uint32           destScreenId;
+} SVGAFifoCmdBlitGMRFBToScreen;
+
+
+/*
+ * SVGA_CMD_BLIT_SCREEN_TO_GMRFB --
+ *
+ *    This is a host-to-guest blit. It performs a DMA operation to
+ *    copy a rectangular region of pixels from a single Screen Object
+ *    back to the current GMRFB.
+ *
+ *    Usage note: This command should be used rarely. It will
+ *    typically be inefficient, but it is necessary for some types of
+ *    synchronization between 3D (GPU) and 2D (CPU) rendering into
+ *    overlapping areas of a screen.
+ *
+ *    The source coordinate is specified relative to a screen's
+ *    origin. The provided screen ID must be valid. If any parameters
+ *    are invalid, the resulting pixel values are undefined.
+ *
+ *    This command reads the screen's "base layer". Overlays like
+ *    video and cursor are not included, but any data which was sent
+ *    using a blit-to-screen primitive will be available, no matter
+ *    whether the data's original source was the GMRFB or the 3D
+ *    acceleration hardware.
+ *
+ *    Note that our guest-to-host blits and host-to-guest blits aren't
+ *    symmetric in their current implementation. While the parameters
+ *    are identical, host-to-guest blits are a lot less featureful.
+ *    They do not support clipping: If the source parameters don't
+ *    fully fit within a screen, the blit fails. They must originate
+ *    from exactly one screen. Virtual coordinates are not directly
+ *    supported.
+ *
+ *    Host-to-guest blits do support the same set of GMRFB formats
+ *    offered by guest-to-host blits.
+ *
+ *    The SVGA device is guaranteed to finish writing to the GMRFB by
+ *    the time any subsequent FENCE commands are reached.
+ *
+ * Availability:
+ *    SVGA_FIFO_CAP_SCREEN_OBJECT
+ */
+
+typedef
+struct {
+   SVGASignedPoint  destOrigin;
+   SVGASignedRect   srcRect;
+   uint32           srcScreenId;
+} SVGAFifoCmdBlitScreenToGMRFB;
+
+
+/*
+ * SVGA_CMD_ANNOTATION_FILL --
+ *
+ *    This is a blit annotation. This command stores a small piece of
+ *    device state which is consumed by the next blit-to-screen
+ *    command. The state is only cleared by commands which are
+ *    specifically documented as consuming an annotation. Other
+ *    commands (such as ESCAPEs for debugging) may intervene between
+ *    the annotation and its associated blit.
+ *
+ *    This annotation is a promise about the contents of the next
+ *    blit: The video driver is guaranteeing that all pixels in that
+ *    blit will have the same value, specified here as a color in
+ *    SVGAColorBGRX format.
+ *
+ *    The SVGA device can still render the blit correctly even if it
+ *    ignores this annotation, but the annotation may allow it to
+ *    perform the blit more efficiently, for example by ignoring the
+ *    source data and performing a fill in hardware.
+ *
+ *    This annotation is most important for performance when the
+ *    user's display is being remoted over a network connection.
+ *
+ * Availability:
+ *    SVGA_FIFO_CAP_SCREEN_OBJECT
+ */
+
+typedef
+struct {
+   SVGAColorBGRX  color;
+} SVGAFifoCmdAnnotationFill;
+
+
+/*
+ * SVGA_CMD_ANNOTATION_COPY --
+ *
+ *    This is a blit annotation. See SVGA_CMD_ANNOTATION_FILL for more
+ *    information about annotations.
+ *
+ *    This annotation is a promise about the contents of the next
+ *    blit: The video driver is guaranteeing that all pixels in that
+ *    blit will have the same value as those which already exist at an
+ *    identically-sized region on the same or a different screen.
+ *
+ *    Note that the source pixels for the COPY in this annotation are
+ *    sampled before applying the anqnotation's associated blit. They
+ *    are allowed to overlap with the blit's destination pixels.
+ *
+ *    The copy source rectangle is specified the same way as the blit
+ *    destination: it can be a rectangle which spans zero or more
+ *    screens, specified relative to either a screen or to the virtual
+ *    coordinate system's origin. If the source rectangle includes
+ *    pixels which are not from exactly one screen, the results are
+ *    undefined.
+ *
+ * Availability:
+ *    SVGA_FIFO_CAP_SCREEN_OBJECT
+ */
+
+typedef
+struct {
+   SVGASignedPoint  srcOrigin;
+   uint32           srcScreenId;
+} SVGAFifoCmdAnnotationCopy;
+
+#endif
diff --git a/drivers/gpu/drm/vmwgfx/svga_types.h b/drivers/gpu/drm/vmwgfx/svga_types.h
new file mode 100644
index 000000000000..55836dedcfc2
--- /dev/null
+++ b/drivers/gpu/drm/vmwgfx/svga_types.h
@@ -0,0 +1,45 @@
+/**************************************************************************
+ *
+ * Copyright © 2009 VMware, Inc., Palo Alto, CA., USA
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ **************************************************************************/
+
+/**
+ * Silly typedefs for the svga headers. Currently the headers are shared
+ * between all components that talk to svga. And as such the headers are
+ * are in a completely different style and use weird defines.
+ *
+ * This file lets all the ugly be prefixed with svga*.
+ */
+
+#ifndef _SVGA_TYPES_H_
+#define _SVGA_TYPES_H_
+
+typedef uint16_t uint16;
+typedef uint32_t uint32;
+typedef uint8_t uint8;
+typedef int32_t int32;
+typedef bool Bool;
+
+#endif
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_buffer.c b/drivers/gpu/drm/vmwgfx/vmwgfx_buffer.c
new file mode 100644
index 000000000000..d6f2d2b882e9
--- /dev/null
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_buffer.c
@@ -0,0 +1,229 @@
+/**************************************************************************
+ *
+ * Copyright © 2009 VMware, Inc., Palo Alto, CA., USA
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ **************************************************************************/
+
+#include "vmwgfx_drv.h"
+#include "ttm/ttm_bo_driver.h"
+#include "ttm/ttm_placement.h"
+
+static uint32_t vram_placement_flags = TTM_PL_FLAG_VRAM |
+	TTM_PL_FLAG_CACHED;
+
+static uint32_t vram_ne_placement_flags = TTM_PL_FLAG_VRAM |
+	TTM_PL_FLAG_CACHED |
+	TTM_PL_FLAG_NO_EVICT;
+
+static uint32_t sys_placement_flags = TTM_PL_FLAG_SYSTEM |
+	TTM_PL_FLAG_CACHED;
+
+struct ttm_placement vmw_vram_placement = {
+	.fpfn = 0,
+	.lpfn = 0,
+	.num_placement = 1,
+	.placement = &vram_placement_flags,
+	.num_busy_placement = 1,
+	.busy_placement = &vram_placement_flags
+};
+
+struct ttm_placement vmw_vram_ne_placement = {
+	.fpfn = 0,
+	.lpfn = 0,
+	.num_placement = 1,
+	.placement = &vram_ne_placement_flags,
+	.num_busy_placement = 1,
+	.busy_placement = &vram_ne_placement_flags
+};
+
+struct ttm_placement vmw_sys_placement = {
+	.fpfn = 0,
+	.lpfn = 0,
+	.num_placement = 1,
+	.placement = &sys_placement_flags,
+	.num_busy_placement = 1,
+	.busy_placement = &sys_placement_flags
+};
+
+struct vmw_ttm_backend {
+	struct ttm_backend backend;
+};
+
+static int vmw_ttm_populate(struct ttm_backend *backend,
+			    unsigned long num_pages, struct page **pages,
+			    struct page *dummy_read_page)
+{
+	return 0;
+}
+
+static int vmw_ttm_bind(struct ttm_backend *backend, struct ttm_mem_reg *bo_mem)
+{
+	return 0;
+}
+
+static int vmw_ttm_unbind(struct ttm_backend *backend)
+{
+	return 0;
+}
+
+static void vmw_ttm_clear(struct ttm_backend *backend)
+{
+}
+
+static void vmw_ttm_destroy(struct ttm_backend *backend)
+{
+	struct vmw_ttm_backend *vmw_be =
+	    container_of(backend, struct vmw_ttm_backend, backend);
+
+	kfree(vmw_be);
+}
+
+static struct ttm_backend_func vmw_ttm_func = {
+	.populate = vmw_ttm_populate,
+	.clear = vmw_ttm_clear,
+	.bind = vmw_ttm_bind,
+	.unbind = vmw_ttm_unbind,
+	.destroy = vmw_ttm_destroy,
+};
+
+struct ttm_backend *vmw_ttm_backend_init(struct ttm_bo_device *bdev)
+{
+	struct vmw_ttm_backend *vmw_be;
+
+	vmw_be = kmalloc(sizeof(*vmw_be), GFP_KERNEL);
+	if (!vmw_be)
+		return NULL;
+
+	vmw_be->backend.func = &vmw_ttm_func;
+
+	return &vmw_be->backend;
+}
+
+int vmw_invalidate_caches(struct ttm_bo_device *bdev, uint32_t flags)
+{
+	return 0;
+}
+
+int vmw_init_mem_type(struct ttm_bo_device *bdev, uint32_t type,
+		      struct ttm_mem_type_manager *man)
+{
+	struct vmw_private *dev_priv =
+	    container_of(bdev, struct vmw_private, bdev);
+
+	switch (type) {
+	case TTM_PL_SYSTEM:
+		/* System memory */
+
+		man->flags = TTM_MEMTYPE_FLAG_MAPPABLE;
+		man->available_caching = TTM_PL_MASK_CACHING;
+		man->default_caching = TTM_PL_FLAG_CACHED;
+		break;
+	case TTM_PL_VRAM:
+		/* "On-card" video ram */
+		man->gpu_offset = 0;
+		man->io_offset = dev_priv->vram_start;
+		man->io_size = dev_priv->vram_size;
+		man->flags = TTM_MEMTYPE_FLAG_FIXED |
+		    TTM_MEMTYPE_FLAG_NEEDS_IOREMAP | TTM_MEMTYPE_FLAG_MAPPABLE;
+		man->io_addr = NULL;
+		man->available_caching = TTM_PL_MASK_CACHING;
+		man->default_caching = TTM_PL_FLAG_WC;
+		break;
+	default:
+		DRM_ERROR("Unsupported memory type %u\n", (unsigned)type);
+		return -EINVAL;
+	}
+	return 0;
+}
+
+void vmw_evict_flags(struct ttm_buffer_object *bo,
+		     struct ttm_placement *placement)
+{
+	*placement = vmw_sys_placement;
+}
+
+/**
+ * FIXME: Proper access checks on buffers.
+ */
+
+static int vmw_verify_access(struct ttm_buffer_object *bo, struct file *filp)
+{
+	return 0;
+}
+
+/**
+ * FIXME: We're using the old vmware polling method to sync.
+ * Do this with fences instead.
+ */
+
+static void *vmw_sync_obj_ref(void *sync_obj)
+{
+	return sync_obj;
+}
+
+static void vmw_sync_obj_unref(void **sync_obj)
+{
+	*sync_obj = NULL;
+}
+
+static int vmw_sync_obj_flush(void *sync_obj, void *sync_arg)
+{
+	struct vmw_private *dev_priv = (struct vmw_private *)sync_arg;
+
+	mutex_lock(&dev_priv->hw_mutex);
+	vmw_write(dev_priv, SVGA_REG_SYNC, SVGA_SYNC_GENERIC);
+	mutex_unlock(&dev_priv->hw_mutex);
+	return 0;
+}
+
+static bool vmw_sync_obj_signaled(void *sync_obj, void *sync_arg)
+{
+	struct vmw_private *dev_priv = (struct vmw_private *)sync_arg;
+	uint32_t sequence = (unsigned long) sync_obj;
+
+	return vmw_fence_signaled(dev_priv, sequence);
+}
+
+static int vmw_sync_obj_wait(void *sync_obj, void *sync_arg,
+			     bool lazy, bool interruptible)
+{
+	struct vmw_private *dev_priv = (struct vmw_private *)sync_arg;
+	uint32_t sequence = (unsigned long) sync_obj;
+
+	return vmw_wait_fence(dev_priv, false, sequence, false, 3*HZ);
+}
+
+struct ttm_bo_driver vmw_bo_driver = {
+	.create_ttm_backend_entry = vmw_ttm_backend_init,
+	.invalidate_caches = vmw_invalidate_caches,
+	.init_mem_type = vmw_init_mem_type,
+	.evict_flags = vmw_evict_flags,
+	.move = NULL,
+	.verify_access = vmw_verify_access,
+	.sync_obj_signaled = vmw_sync_obj_signaled,
+	.sync_obj_wait = vmw_sync_obj_wait,
+	.sync_obj_flush = vmw_sync_obj_flush,
+	.sync_obj_unref = vmw_sync_obj_unref,
+	.sync_obj_ref = vmw_sync_obj_ref
+};
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
new file mode 100644
index 000000000000..1db1ef30be2b
--- /dev/null
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -0,0 +1,726 @@
+/**************************************************************************
+ *
+ * Copyright © 2009 VMware, Inc., Palo Alto, CA., USA
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ **************************************************************************/
+
+#include "drmP.h"
+#include "vmwgfx_drv.h"
+#include "ttm/ttm_placement.h"
+#include "ttm/ttm_bo_driver.h"
+#include "ttm/ttm_object.h"
+#include "ttm/ttm_module.h"
+
+#define VMWGFX_DRIVER_NAME "vmwgfx"
+#define VMWGFX_DRIVER_DESC "Linux drm driver for VMware graphics devices"
+#define VMWGFX_CHIP_SVGAII 0
+#define VMW_FB_RESERVATION 0
+
+/**
+ * Fully encoded drm commands. Might move to vmw_drm.h
+ */
+
+#define DRM_IOCTL_VMW_GET_PARAM					\
+	DRM_IOWR(DRM_COMMAND_BASE + DRM_VMW_GET_PARAM,		\
+		 struct drm_vmw_getparam_arg)
+#define DRM_IOCTL_VMW_ALLOC_DMABUF				\
+	DRM_IOWR(DRM_COMMAND_BASE + DRM_VMW_ALLOC_DMABUF,	\
+		union drm_vmw_alloc_dmabuf_arg)
+#define DRM_IOCTL_VMW_UNREF_DMABUF				\
+	DRM_IOW(DRM_COMMAND_BASE + DRM_VMW_UNREF_DMABUF,	\
+		struct drm_vmw_unref_dmabuf_arg)
+#define DRM_IOCTL_VMW_CURSOR_BYPASS				\
+	DRM_IOW(DRM_COMMAND_BASE + DRM_VMW_CURSOR_BYPASS,	\
+		 struct drm_vmw_cursor_bypass_arg)
+
+#define DRM_IOCTL_VMW_CONTROL_STREAM				\
+	DRM_IOW(DRM_COMMAND_BASE + DRM_VMW_CONTROL_STREAM,	\
+		 struct drm_vmw_control_stream_arg)
+#define DRM_IOCTL_VMW_CLAIM_STREAM				\
+	DRM_IOR(DRM_COMMAND_BASE + DRM_VMW_CLAIM_STREAM,	\
+		 struct drm_vmw_stream_arg)
+#define DRM_IOCTL_VMW_UNREF_STREAM				\
+	DRM_IOW(DRM_COMMAND_BASE + DRM_VMW_UNREF_STREAM,	\
+		 struct drm_vmw_stream_arg)
+
+#define DRM_IOCTL_VMW_CREATE_CONTEXT				\
+	DRM_IOR(DRM_COMMAND_BASE + DRM_VMW_CREATE_CONTEXT,	\
+		struct drm_vmw_context_arg)
+#define DRM_IOCTL_VMW_UNREF_CONTEXT				\
+	DRM_IOW(DRM_COMMAND_BASE + DRM_VMW_UNREF_CONTEXT,	\
+		struct drm_vmw_context_arg)
+#define DRM_IOCTL_VMW_CREATE_SURFACE				\
+	DRM_IOWR(DRM_COMMAND_BASE + DRM_VMW_CREATE_SURFACE,	\
+		 union drm_vmw_surface_create_arg)
+#define DRM_IOCTL_VMW_UNREF_SURFACE				\
+	DRM_IOW(DRM_COMMAND_BASE + DRM_VMW_UNREF_SURFACE,	\
+		 struct drm_vmw_surface_arg)
+#define DRM_IOCTL_VMW_REF_SURFACE				\
+	DRM_IOWR(DRM_COMMAND_BASE + DRM_VMW_REF_SURFACE,	\
+		 union drm_vmw_surface_reference_arg)
+#define DRM_IOCTL_VMW_EXECBUF					\
+	DRM_IOW(DRM_COMMAND_BASE + DRM_VMW_EXECBUF,		\
+		struct drm_vmw_execbuf_arg)
+#define DRM_IOCTL_VMW_FIFO_DEBUG				\
+	DRM_IOWR(DRM_COMMAND_BASE + DRM_VMW_FIFO_DEBUG,		\
+		 struct drm_vmw_fifo_debug_arg)
+#define DRM_IOCTL_VMW_FENCE_WAIT				\
+	DRM_IOWR(DRM_COMMAND_BASE + DRM_VMW_FENCE_WAIT,		\
+		 struct drm_vmw_fence_wait_arg)
+
+
+/**
+ * The core DRM version of this macro doesn't account for
+ * DRM_COMMAND_BASE.
+ */
+
+#define VMW_IOCTL_DEF(ioctl, func, flags) \
+	[DRM_IOCTL_NR(ioctl) - DRM_COMMAND_BASE] = {ioctl, flags, func}
+
+/**
+ * Ioctl definitions.
+ */
+
+static struct drm_ioctl_desc vmw_ioctls[] = {
+	VMW_IOCTL_DEF(DRM_IOCTL_VMW_GET_PARAM, vmw_getparam_ioctl,
+		      DRM_AUTH | DRM_UNLOCKED),
+	VMW_IOCTL_DEF(DRM_IOCTL_VMW_ALLOC_DMABUF, vmw_dmabuf_alloc_ioctl,
+		      DRM_AUTH | DRM_UNLOCKED),
+	VMW_IOCTL_DEF(DRM_IOCTL_VMW_UNREF_DMABUF, vmw_dmabuf_unref_ioctl,
+		      DRM_AUTH | DRM_UNLOCKED),
+	VMW_IOCTL_DEF(DRM_IOCTL_VMW_CURSOR_BYPASS,
+		      vmw_kms_cursor_bypass_ioctl,
+		      DRM_MASTER | DRM_CONTROL_ALLOW | DRM_UNLOCKED),
+
+	VMW_IOCTL_DEF(DRM_IOCTL_VMW_CONTROL_STREAM, vmw_overlay_ioctl,
+		      DRM_MASTER | DRM_CONTROL_ALLOW | DRM_UNLOCKED),
+	VMW_IOCTL_DEF(DRM_IOCTL_VMW_CLAIM_STREAM, vmw_stream_claim_ioctl,
+		      DRM_MASTER | DRM_CONTROL_ALLOW | DRM_UNLOCKED),
+	VMW_IOCTL_DEF(DRM_IOCTL_VMW_UNREF_STREAM, vmw_stream_unref_ioctl,
+		      DRM_MASTER | DRM_CONTROL_ALLOW | DRM_UNLOCKED),
+
+	VMW_IOCTL_DEF(DRM_IOCTL_VMW_CREATE_CONTEXT, vmw_context_define_ioctl,
+		      DRM_AUTH | DRM_UNLOCKED),
+	VMW_IOCTL_DEF(DRM_IOCTL_VMW_UNREF_CONTEXT, vmw_context_destroy_ioctl,
+		      DRM_AUTH | DRM_UNLOCKED),
+	VMW_IOCTL_DEF(DRM_IOCTL_VMW_CREATE_SURFACE, vmw_surface_define_ioctl,
+		      DRM_AUTH | DRM_UNLOCKED),
+	VMW_IOCTL_DEF(DRM_IOCTL_VMW_UNREF_SURFACE, vmw_surface_destroy_ioctl,
+		      DRM_AUTH | DRM_UNLOCKED),
+	VMW_IOCTL_DEF(DRM_IOCTL_VMW_REF_SURFACE, vmw_surface_reference_ioctl,
+		      DRM_AUTH | DRM_UNLOCKED),
+	VMW_IOCTL_DEF(DRM_IOCTL_VMW_EXECBUF, vmw_execbuf_ioctl,
+		      DRM_AUTH | DRM_UNLOCKED),
+	VMW_IOCTL_DEF(DRM_IOCTL_VMW_FIFO_DEBUG, vmw_fifo_debug_ioctl,
+		      DRM_AUTH | DRM_ROOT_ONLY | DRM_MASTER | DRM_UNLOCKED),
+	VMW_IOCTL_DEF(DRM_IOCTL_VMW_FENCE_WAIT, vmw_fence_wait_ioctl,
+		      DRM_AUTH | DRM_UNLOCKED)
+};
+
+static struct pci_device_id vmw_pci_id_list[] = {
+	{0x15ad, 0x0405, PCI_ANY_ID, PCI_ANY_ID, 0, 0, VMWGFX_CHIP_SVGAII},
+	{0, 0, 0}
+};
+
+static char *vmw_devname = "vmwgfx";
+
+static int vmw_probe(struct pci_dev *, const struct pci_device_id *);
+static void vmw_master_init(struct vmw_master *);
+
+static void vmw_print_capabilities(uint32_t capabilities)
+{
+	DRM_INFO("Capabilities:\n");
+	if (capabilities & SVGA_CAP_RECT_COPY)
+		DRM_INFO("  Rect copy.\n");
+	if (capabilities & SVGA_CAP_CURSOR)
+		DRM_INFO("  Cursor.\n");
+	if (capabilities & SVGA_CAP_CURSOR_BYPASS)
+		DRM_INFO("  Cursor bypass.\n");
+	if (capabilities & SVGA_CAP_CURSOR_BYPASS_2)
+		DRM_INFO("  Cursor bypass 2.\n");
+	if (capabilities & SVGA_CAP_8BIT_EMULATION)
+		DRM_INFO("  8bit emulation.\n");
+	if (capabilities & SVGA_CAP_ALPHA_CURSOR)
+		DRM_INFO("  Alpha cursor.\n");
+	if (capabilities & SVGA_CAP_3D)
+		DRM_INFO("  3D.\n");
+	if (capabilities & SVGA_CAP_EXTENDED_FIFO)
+		DRM_INFO("  Extended Fifo.\n");
+	if (capabilities & SVGA_CAP_MULTIMON)
+		DRM_INFO("  Multimon.\n");
+	if (capabilities & SVGA_CAP_PITCHLOCK)
+		DRM_INFO("  Pitchlock.\n");
+	if (capabilities & SVGA_CAP_IRQMASK)
+		DRM_INFO("  Irq mask.\n");
+	if (capabilities & SVGA_CAP_DISPLAY_TOPOLOGY)
+		DRM_INFO("  Display Topology.\n");
+	if (capabilities & SVGA_CAP_GMR)
+		DRM_INFO("  GMR.\n");
+	if (capabilities & SVGA_CAP_TRACES)
+		DRM_INFO("  Traces.\n");
+}
+
+static int vmw_request_device(struct vmw_private *dev_priv)
+{
+	int ret;
+
+	vmw_kms_save_vga(dev_priv);
+
+	ret = vmw_fifo_init(dev_priv, &dev_priv->fifo);
+	if (unlikely(ret != 0)) {
+		DRM_ERROR("Unable to initialize FIFO.\n");
+		return ret;
+	}
+
+	return 0;
+}
+
+static void vmw_release_device(struct vmw_private *dev_priv)
+{
+	vmw_fifo_release(dev_priv, &dev_priv->fifo);
+	vmw_kms_restore_vga(dev_priv);
+}
+
+
+static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
+{
+	struct vmw_private *dev_priv;
+	int ret;
+
+	dev_priv = kzalloc(sizeof(*dev_priv), GFP_KERNEL);
+	if (unlikely(dev_priv == NULL)) {
+		DRM_ERROR("Failed allocating a device private struct.\n");
+		return -ENOMEM;
+	}
+	memset(dev_priv, 0, sizeof(*dev_priv));
+
+	dev_priv->dev = dev;
+	dev_priv->vmw_chipset = chipset;
+	mutex_init(&dev_priv->hw_mutex);
+	mutex_init(&dev_priv->cmdbuf_mutex);
+	rwlock_init(&dev_priv->resource_lock);
+	idr_init(&dev_priv->context_idr);
+	idr_init(&dev_priv->surface_idr);
+	idr_init(&dev_priv->stream_idr);
+	ida_init(&dev_priv->gmr_ida);
+	mutex_init(&dev_priv->init_mutex);
+	init_waitqueue_head(&dev_priv->fence_queue);
+	init_waitqueue_head(&dev_priv->fifo_queue);
+	atomic_set(&dev_priv->fence_queue_waiters, 0);
+	atomic_set(&dev_priv->fifo_queue_waiters, 0);
+	INIT_LIST_HEAD(&dev_priv->gmr_lru);
+
+	dev_priv->io_start = pci_resource_start(dev->pdev, 0);
+	dev_priv->vram_start = pci_resource_start(dev->pdev, 1);
+	dev_priv->mmio_start = pci_resource_start(dev->pdev, 2);
+
+	mutex_lock(&dev_priv->hw_mutex);
+	dev_priv->capabilities = vmw_read(dev_priv, SVGA_REG_CAPABILITIES);
+
+	if (dev_priv->capabilities & SVGA_CAP_GMR) {
+		dev_priv->max_gmr_descriptors =
+			vmw_read(dev_priv,
+				 SVGA_REG_GMR_MAX_DESCRIPTOR_LENGTH);
+		dev_priv->max_gmr_ids =
+			vmw_read(dev_priv, SVGA_REG_GMR_MAX_IDS);
+	}
+
+	dev_priv->vram_size = vmw_read(dev_priv, SVGA_REG_VRAM_SIZE);
+	dev_priv->mmio_size = vmw_read(dev_priv, SVGA_REG_MEM_SIZE);
+	dev_priv->fb_max_width = vmw_read(dev_priv, SVGA_REG_MAX_WIDTH);
+	dev_priv->fb_max_height = vmw_read(dev_priv, SVGA_REG_MAX_HEIGHT);
+
+	mutex_unlock(&dev_priv->hw_mutex);
+
+	vmw_print_capabilities(dev_priv->capabilities);
+
+	if (dev_priv->capabilities & SVGA_CAP_GMR) {
+		DRM_INFO("Max GMR ids is %u\n",
+			 (unsigned)dev_priv->max_gmr_ids);
+		DRM_INFO("Max GMR descriptors is %u\n",
+			 (unsigned)dev_priv->max_gmr_descriptors);
+	}
+	DRM_INFO("VRAM at 0x%08x size is %u kiB\n",
+		 dev_priv->vram_start, dev_priv->vram_size / 1024);
+	DRM_INFO("MMIO at 0x%08x size is %u kiB\n",
+		 dev_priv->mmio_start, dev_priv->mmio_size / 1024);
+
+	ret = vmw_ttm_global_init(dev_priv);
+	if (unlikely(ret != 0))
+		goto out_err0;
+
+
+	vmw_master_init(&dev_priv->fbdev_master);
+	ttm_lock_set_kill(&dev_priv->fbdev_master.lock, false, SIGTERM);
+	dev_priv->active_master = &dev_priv->fbdev_master;
+
+
+	ret = ttm_bo_device_init(&dev_priv->bdev,
+				 dev_priv->bo_global_ref.ref.object,
+				 &vmw_bo_driver, VMWGFX_FILE_PAGE_OFFSET,
+				 false);
+	if (unlikely(ret != 0)) {
+		DRM_ERROR("Failed initializing TTM buffer object driver.\n");
+		goto out_err1;
+	}
+
+	ret = ttm_bo_init_mm(&dev_priv->bdev, TTM_PL_VRAM,
+			     (dev_priv->vram_size >> PAGE_SHIFT));
+	if (unlikely(ret != 0)) {
+		DRM_ERROR("Failed initializing memory manager for VRAM.\n");
+		goto out_err2;
+	}
+
+	dev_priv->mmio_mtrr = drm_mtrr_add(dev_priv->mmio_start,
+					   dev_priv->mmio_size, DRM_MTRR_WC);
+
+	dev_priv->mmio_virt = ioremap_wc(dev_priv->mmio_start,
+					 dev_priv->mmio_size);
+
+	if (unlikely(dev_priv->mmio_virt == NULL)) {
+		ret = -ENOMEM;
+		DRM_ERROR("Failed mapping MMIO.\n");
+		goto out_err3;
+	}
+
+	dev_priv->tdev = ttm_object_device_init
+	    (dev_priv->mem_global_ref.object, 12);
+
+	if (unlikely(dev_priv->tdev == NULL)) {
+		DRM_ERROR("Unable to initialize TTM object management.\n");
+		ret = -ENOMEM;
+		goto out_err4;
+	}
+
+	dev->dev_private = dev_priv;
+
+	if (!dev->devname)
+		dev->devname = vmw_devname;
+
+	if (dev_priv->capabilities & SVGA_CAP_IRQMASK) {
+		ret = drm_irq_install(dev);
+		if (unlikely(ret != 0)) {
+			DRM_ERROR("Failed installing irq: %d\n", ret);
+			goto out_no_irq;
+		}
+	}
+
+	ret = pci_request_regions(dev->pdev, "vmwgfx probe");
+	dev_priv->stealth = (ret != 0);
+	if (dev_priv->stealth) {
+		/**
+		 * Request at least the mmio PCI resource.
+		 */
+
+		DRM_INFO("It appears like vesafb is loaded. "
+			 "Ignore above error if any. Entering stealth mode.\n");
+		ret = pci_request_region(dev->pdev, 2, "vmwgfx stealth probe");
+		if (unlikely(ret != 0)) {
+			DRM_ERROR("Failed reserving the SVGA MMIO resource.\n");
+			goto out_no_device;
+		}
+		vmw_kms_init(dev_priv);
+		vmw_overlay_init(dev_priv);
+	} else {
+		ret = vmw_request_device(dev_priv);
+		if (unlikely(ret != 0))
+			goto out_no_device;
+		vmw_kms_init(dev_priv);
+		vmw_overlay_init(dev_priv);
+		vmw_fb_init(dev_priv);
+	}
+
+	return 0;
+
+out_no_device:
+	if (dev_priv->capabilities & SVGA_CAP_IRQMASK)
+		drm_irq_uninstall(dev_priv->dev);
+	if (dev->devname == vmw_devname)
+		dev->devname = NULL;
+out_no_irq:
+	ttm_object_device_release(&dev_priv->tdev);
+out_err4:
+	iounmap(dev_priv->mmio_virt);
+out_err3:
+	drm_mtrr_del(dev_priv->mmio_mtrr, dev_priv->mmio_start,
+		     dev_priv->mmio_size, DRM_MTRR_WC);
+	(void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
+out_err2:
+	(void)ttm_bo_device_release(&dev_priv->bdev);
+out_err1:
+	vmw_ttm_global_release(dev_priv);
+out_err0:
+	ida_destroy(&dev_priv->gmr_ida);
+	idr_destroy(&dev_priv->surface_idr);
+	idr_destroy(&dev_priv->context_idr);
+	idr_destroy(&dev_priv->stream_idr);
+	kfree(dev_priv);
+	return ret;
+}
+
+static int vmw_driver_unload(struct drm_device *dev)
+{
+	struct vmw_private *dev_priv = vmw_priv(dev);
+
+	DRM_INFO(VMWGFX_DRIVER_NAME " unload.\n");
+
+	if (!dev_priv->stealth) {
+		vmw_fb_close(dev_priv);
+		vmw_kms_close(dev_priv);
+		vmw_overlay_close(dev_priv);
+		vmw_release_device(dev_priv);
+		pci_release_regions(dev->pdev);
+	} else {
+		vmw_kms_close(dev_priv);
+		vmw_overlay_close(dev_priv);
+		pci_release_region(dev->pdev, 2);
+	}
+	if (dev_priv->capabilities & SVGA_CAP_IRQMASK)
+		drm_irq_uninstall(dev_priv->dev);
+	if (dev->devname == vmw_devname)
+		dev->devname = NULL;
+	ttm_object_device_release(&dev_priv->tdev);
+	iounmap(dev_priv->mmio_virt);
+	drm_mtrr_del(dev_priv->mmio_mtrr, dev_priv->mmio_start,
+		     dev_priv->mmio_size, DRM_MTRR_WC);
+	(void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
+	(void)ttm_bo_device_release(&dev_priv->bdev);
+	vmw_ttm_global_release(dev_priv);
+	ida_destroy(&dev_priv->gmr_ida);
+	idr_destroy(&dev_priv->surface_idr);
+	idr_destroy(&dev_priv->context_idr);
+	idr_destroy(&dev_priv->stream_idr);
+
+	kfree(dev_priv);
+
+	return 0;
+}
+
+static void vmw_postclose(struct drm_device *dev,
+			 struct drm_file *file_priv)
+{
+	struct vmw_fpriv *vmw_fp;
+
+	vmw_fp = vmw_fpriv(file_priv);
+	ttm_object_file_release(&vmw_fp->tfile);
+	if (vmw_fp->locked_master)
+		drm_master_put(&vmw_fp->locked_master);
+	kfree(vmw_fp);
+}
+
+static int vmw_driver_open(struct drm_device *dev, struct drm_file *file_priv)
+{
+	struct vmw_private *dev_priv = vmw_priv(dev);
+	struct vmw_fpriv *vmw_fp;
+	int ret = -ENOMEM;
+
+	vmw_fp = kzalloc(sizeof(*vmw_fp), GFP_KERNEL);
+	if (unlikely(vmw_fp == NULL))
+		return ret;
+
+	vmw_fp->tfile = ttm_object_file_init(dev_priv->tdev, 10);
+	if (unlikely(vmw_fp->tfile == NULL))
+		goto out_no_tfile;
+
+	file_priv->driver_priv = vmw_fp;
+
+	if (unlikely(dev_priv->bdev.dev_mapping == NULL))
+		dev_priv->bdev.dev_mapping =
+			file_priv->filp->f_path.dentry->d_inode->i_mapping;
+
+	return 0;
+
+out_no_tfile:
+	kfree(vmw_fp);
+	return ret;
+}
+
+static long vmw_unlocked_ioctl(struct file *filp, unsigned int cmd,
+			       unsigned long arg)
+{
+	struct drm_file *file_priv = filp->private_data;
+	struct drm_device *dev = file_priv->minor->dev;
+	unsigned int nr = DRM_IOCTL_NR(cmd);
+
+	/*
+	 * Do extra checking on driver private ioctls.
+	 */
+
+	if ((nr >= DRM_COMMAND_BASE) && (nr < DRM_COMMAND_END)
+	    && (nr < DRM_COMMAND_BASE + dev->driver->num_ioctls)) {
+		struct drm_ioctl_desc *ioctl =
+		    &vmw_ioctls[nr - DRM_COMMAND_BASE];
+
+		if (unlikely(ioctl->cmd != cmd)) {
+			DRM_ERROR("Invalid command format, ioctl %d\n",
+				  nr - DRM_COMMAND_BASE);
+			return -EINVAL;
+		}
+	}
+
+	return drm_ioctl(filp, cmd, arg);
+}
+
+static int vmw_firstopen(struct drm_device *dev)
+{
+	struct vmw_private *dev_priv = vmw_priv(dev);
+	dev_priv->is_opened = true;
+
+	return 0;
+}
+
+static void vmw_lastclose(struct drm_device *dev)
+{
+	struct vmw_private *dev_priv = vmw_priv(dev);
+	struct drm_crtc *crtc;
+	struct drm_mode_set set;
+	int ret;
+
+	/**
+	 * Do nothing on the lastclose call from drm_unload.
+	 */
+
+	if (!dev_priv->is_opened)
+		return;
+
+	dev_priv->is_opened = false;
+	set.x = 0;
+	set.y = 0;
+	set.fb = NULL;
+	set.mode = NULL;
+	set.connectors = NULL;
+	set.num_connectors = 0;
+
+	list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
+		set.crtc = crtc;
+		ret = crtc->funcs->set_config(&set);
+		WARN_ON(ret != 0);
+	}
+
+}
+
+static void vmw_master_init(struct vmw_master *vmaster)
+{
+	ttm_lock_init(&vmaster->lock);
+}
+
+static int vmw_master_create(struct drm_device *dev,
+			     struct drm_master *master)
+{
+	struct vmw_master *vmaster;
+
+	DRM_INFO("Master create.\n");
+	vmaster = kzalloc(sizeof(*vmaster), GFP_KERNEL);
+	if (unlikely(vmaster == NULL))
+		return -ENOMEM;
+
+	ttm_lock_init(&vmaster->lock);
+	ttm_lock_set_kill(&vmaster->lock, true, SIGTERM);
+	master->driver_priv = vmaster;
+
+	return 0;
+}
+
+static void vmw_master_destroy(struct drm_device *dev,
+			       struct drm_master *master)
+{
+	struct vmw_master *vmaster = vmw_master(master);
+
+	DRM_INFO("Master destroy.\n");
+	master->driver_priv = NULL;
+	kfree(vmaster);
+}
+
+
+static int vmw_master_set(struct drm_device *dev,
+			  struct drm_file *file_priv,
+			  bool from_open)
+{
+	struct vmw_private *dev_priv = vmw_priv(dev);
+	struct vmw_fpriv *vmw_fp = vmw_fpriv(file_priv);
+	struct vmw_master *active = dev_priv->active_master;
+	struct vmw_master *vmaster = vmw_master(file_priv->master);
+	int ret = 0;
+
+	DRM_INFO("Master set.\n");
+	if (dev_priv->stealth) {
+		ret = vmw_request_device(dev_priv);
+		if (unlikely(ret != 0))
+			return ret;
+	}
+
+	if (active) {
+		BUG_ON(active != &dev_priv->fbdev_master);
+		ret = ttm_vt_lock(&active->lock, false, vmw_fp->tfile);
+		if (unlikely(ret != 0))
+			goto out_no_active_lock;
+
+		ttm_lock_set_kill(&active->lock, true, SIGTERM);
+		ret = ttm_bo_evict_mm(&dev_priv->bdev, TTM_PL_VRAM);
+		if (unlikely(ret != 0)) {
+			DRM_ERROR("Unable to clean VRAM on "
+				  "master drop.\n");
+		}
+
+		dev_priv->active_master = NULL;
+	}
+
+	ttm_lock_set_kill(&vmaster->lock, false, SIGTERM);
+	if (!from_open) {
+		ttm_vt_unlock(&vmaster->lock);
+		BUG_ON(vmw_fp->locked_master != file_priv->master);
+		drm_master_put(&vmw_fp->locked_master);
+	}
+
+	dev_priv->active_master = vmaster;
+
+	return 0;
+
+out_no_active_lock:
+	vmw_release_device(dev_priv);
+	return ret;
+}
+
+static void vmw_master_drop(struct drm_device *dev,
+			    struct drm_file *file_priv,
+			    bool from_release)
+{
+	struct vmw_private *dev_priv = vmw_priv(dev);
+	struct vmw_fpriv *vmw_fp = vmw_fpriv(file_priv);
+	struct vmw_master *vmaster = vmw_master(file_priv->master);
+	int ret;
+
+	DRM_INFO("Master drop.\n");
+
+	/**
+	 * Make sure the master doesn't disappear while we have
+	 * it locked.
+	 */
+
+	vmw_fp->locked_master = drm_master_get(file_priv->master);
+	ret = ttm_vt_lock(&vmaster->lock, false, vmw_fp->tfile);
+
+	if (unlikely((ret != 0))) {
+		DRM_ERROR("Unable to lock TTM at VT switch.\n");
+		drm_master_put(&vmw_fp->locked_master);
+	}
+
+	ttm_lock_set_kill(&vmaster->lock, true, SIGTERM);
+
+	if (dev_priv->stealth) {
+		ret = ttm_bo_evict_mm(&dev_priv->bdev, TTM_PL_VRAM);
+		if (unlikely(ret != 0))
+			DRM_ERROR("Unable to clean VRAM on master drop.\n");
+		vmw_release_device(dev_priv);
+	}
+	dev_priv->active_master = &dev_priv->fbdev_master;
+	ttm_lock_set_kill(&dev_priv->fbdev_master.lock, false, SIGTERM);
+	ttm_vt_unlock(&dev_priv->fbdev_master.lock);
+
+	if (!dev_priv->stealth)
+		vmw_fb_on(dev_priv);
+}
+
+
+static void vmw_remove(struct pci_dev *pdev)
+{
+	struct drm_device *dev = pci_get_drvdata(pdev);
+
+	drm_put_dev(dev);
+}
+
+static struct drm_driver driver = {
+	.driver_features = DRIVER_HAVE_IRQ | DRIVER_IRQ_SHARED |
+	DRIVER_MODESET,
+	.load = vmw_driver_load,
+	.unload = vmw_driver_unload,
+	.firstopen = vmw_firstopen,
+	.lastclose = vmw_lastclose,
+	.irq_preinstall = vmw_irq_preinstall,
+	.irq_postinstall = vmw_irq_postinstall,
+	.irq_uninstall = vmw_irq_uninstall,
+	.irq_handler = vmw_irq_handler,
+	.reclaim_buffers_locked = NULL,
+	.get_map_ofs = drm_core_get_map_ofs,
+	.get_reg_ofs = drm_core_get_reg_ofs,
+	.ioctls = vmw_ioctls,
+	.num_ioctls = DRM_ARRAY_SIZE(vmw_ioctls),
+	.dma_quiescent = NULL,	/*vmw_dma_quiescent, */
+	.master_create = vmw_master_create,
+	.master_destroy = vmw_master_destroy,
+	.master_set = vmw_master_set,
+	.master_drop = vmw_master_drop,
+	.open = vmw_driver_open,
+	.postclose = vmw_postclose,
+	.fops = {
+		 .owner = THIS_MODULE,
+		 .open = drm_open,
+		 .release = drm_release,
+		 .unlocked_ioctl = vmw_unlocked_ioctl,
+		 .mmap = vmw_mmap,
+		 .poll = drm_poll,
+		 .fasync = drm_fasync,
+#if defined(CONFIG_COMPAT)
+		 .compat_ioctl = drm_compat_ioctl,
+#endif
+		 },
+	.pci_driver = {
+		       .name = VMWGFX_DRIVER_NAME,
+		       .id_table = vmw_pci_id_list,
+		       .probe = vmw_probe,
+		       .remove = vmw_remove
+		       },
+	.name = VMWGFX_DRIVER_NAME,
+	.desc = VMWGFX_DRIVER_DESC,
+	.date = VMWGFX_DRIVER_DATE,
+	.major = VMWGFX_DRIVER_MAJOR,
+	.minor = VMWGFX_DRIVER_MINOR,
+	.patchlevel = VMWGFX_DRIVER_PATCHLEVEL
+};
+
+static int vmw_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+{
+	return drm_get_dev(pdev, ent, &driver);
+}
+
+static int __init vmwgfx_init(void)
+{
+	int ret;
+	ret = drm_init(&driver);
+	if (ret)
+		DRM_ERROR("Failed initializing DRM.\n");
+	return ret;
+}
+
+static void __exit vmwgfx_exit(void)
+{
+	drm_exit(&driver);
+}
+
+module_init(vmwgfx_init);
+module_exit(vmwgfx_exit);
+
+MODULE_AUTHOR("VMware Inc. and others");
+MODULE_DESCRIPTION("Standalone drm driver for the VMware SVGA device");
+MODULE_LICENSE("GPL and additional rights");
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
new file mode 100644
index 000000000000..e61bd85b6975
--- /dev/null
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
@@ -0,0 +1,513 @@
+/**************************************************************************
+ *
+ * Copyright © 2009 VMware, Inc., Palo Alto, CA., USA
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ **************************************************************************/
+
+#ifndef _VMWGFX_DRV_H_
+#define _VMWGFX_DRV_H_
+
+#include "vmwgfx_reg.h"
+#include "drmP.h"
+#include "vmwgfx_drm.h"
+#include "drm_hashtab.h"
+#include "ttm/ttm_bo_driver.h"
+#include "ttm/ttm_object.h"
+#include "ttm/ttm_lock.h"
+#include "ttm/ttm_execbuf_util.h"
+#include "ttm/ttm_module.h"
+
+#define VMWGFX_DRIVER_DATE "20090724"
+#define VMWGFX_DRIVER_MAJOR 0
+#define VMWGFX_DRIVER_MINOR 1
+#define VMWGFX_DRIVER_PATCHLEVEL 2
+#define VMWGFX_FILE_PAGE_OFFSET 0x00100000
+#define VMWGFX_FIFO_STATIC_SIZE (1024*1024)
+#define VMWGFX_MAX_RELOCATIONS 2048
+#define VMWGFX_MAX_GMRS 2048
+
+struct vmw_fpriv {
+	struct drm_master *locked_master;
+	struct ttm_object_file *tfile;
+};
+
+struct vmw_dma_buffer {
+	struct ttm_buffer_object base;
+	struct list_head validate_list;
+	struct list_head gmr_lru;
+	uint32_t gmr_id;
+	bool gmr_bound;
+	uint32_t cur_validate_node;
+	bool on_validate_list;
+};
+
+struct vmw_resource {
+	struct kref kref;
+	struct vmw_private *dev_priv;
+	struct idr *idr;
+	int id;
+	enum ttm_object_type res_type;
+	bool avail;
+	void (*hw_destroy) (struct vmw_resource *res);
+	void (*res_free) (struct vmw_resource *res);
+
+	/* TODO is a generic snooper needed? */
+#if 0
+	void (*snoop)(struct vmw_resource *res,
+		      struct ttm_object_file *tfile,
+		      SVGA3dCmdHeader *header);
+	void *snoop_priv;
+#endif
+};
+
+struct vmw_cursor_snooper {
+	struct drm_crtc *crtc;
+	size_t age;
+	uint32_t *image;
+};
+
+struct vmw_surface {
+	struct vmw_resource res;
+	uint32_t flags;
+	uint32_t format;
+	uint32_t mip_levels[DRM_VMW_MAX_SURFACE_FACES];
+	struct drm_vmw_size *sizes;
+	uint32_t num_sizes;
+
+	/* TODO so far just a extra pointer */
+	struct vmw_cursor_snooper snooper;
+};
+
+struct vmw_fifo_state {
+	unsigned long reserved_size;
+	__le32 *dynamic_buffer;
+	__le32 *static_buffer;
+	__le32 *last_buffer;
+	uint32_t last_data_size;
+	uint32_t last_buffer_size;
+	bool last_buffer_add;
+	unsigned long static_buffer_size;
+	bool using_bounce_buffer;
+	uint32_t capabilities;
+	struct rw_semaphore rwsem;
+};
+
+struct vmw_relocation {
+	SVGAGuestPtr *location;
+	uint32_t index;
+};
+
+struct vmw_sw_context{
+	struct ida bo_list;
+	uint32_t last_cid;
+	bool cid_valid;
+	uint32_t last_sid;
+	uint32_t sid_translation;
+	bool sid_valid;
+	struct ttm_object_file *tfile;
+	struct list_head validate_nodes;
+	struct vmw_relocation relocs[VMWGFX_MAX_RELOCATIONS];
+	uint32_t cur_reloc;
+	struct ttm_validate_buffer val_bufs[VMWGFX_MAX_GMRS];
+	uint32_t cur_val_buf;
+};
+
+struct vmw_legacy_display;
+struct vmw_overlay;
+
+struct vmw_master {
+	struct ttm_lock lock;
+};
+
+struct vmw_private {
+	struct ttm_bo_device bdev;
+	struct ttm_bo_global_ref bo_global_ref;
+	struct ttm_global_reference mem_global_ref;
+
+	struct vmw_fifo_state fifo;
+
+	struct drm_device *dev;
+	unsigned long vmw_chipset;
+	unsigned int io_start;
+	uint32_t vram_start;
+	uint32_t vram_size;
+	uint32_t mmio_start;
+	uint32_t mmio_size;
+	uint32_t fb_max_width;
+	uint32_t fb_max_height;
+	__le32 __iomem *mmio_virt;
+	int mmio_mtrr;
+	uint32_t capabilities;
+	uint32_t max_gmr_descriptors;
+	uint32_t max_gmr_ids;
+	struct mutex hw_mutex;
+
+	/*
+	 * VGA registers.
+	 */
+
+	uint32_t vga_width;
+	uint32_t vga_height;
+	uint32_t vga_depth;
+	uint32_t vga_bpp;
+	uint32_t vga_pseudo;
+	uint32_t vga_red_mask;
+	uint32_t vga_blue_mask;
+	uint32_t vga_green_mask;
+
+	/*
+	 * Framebuffer info.
+	 */
+
+	void *fb_info;
+	struct vmw_legacy_display *ldu_priv;
+	struct vmw_overlay *overlay_priv;
+
+	/*
+	 * Context and surface management.
+	 */
+
+	rwlock_t resource_lock;
+	struct idr context_idr;
+	struct idr surface_idr;
+	struct idr stream_idr;
+
+	/*
+	 * Block lastclose from racing with firstopen.
+	 */
+
+	struct mutex init_mutex;
+
+	/*
+	 * A resource manager for kernel-only surfaces and
+	 * contexts.
+	 */
+
+	struct ttm_object_device *tdev;
+
+	/*
+	 * Fencing and IRQs.
+	 */
+
+	uint32_t fence_seq;
+	wait_queue_head_t fence_queue;
+	wait_queue_head_t fifo_queue;
+	atomic_t fence_queue_waiters;
+	atomic_t fifo_queue_waiters;
+	uint32_t last_read_sequence;
+	spinlock_t irq_lock;
+
+	/*
+	 * Device state
+	 */
+
+	uint32_t traces_state;
+	uint32_t enable_state;
+	uint32_t config_done_state;
+
+	/**
+	 * Execbuf
+	 */
+	/**
+	 * Protected by the cmdbuf mutex.
+	 */
+
+	struct vmw_sw_context ctx;
+	uint32_t val_seq;
+	struct mutex cmdbuf_mutex;
+
+	/**
+	 * GMR management. Protected by the lru spinlock.
+	 */
+
+	struct ida gmr_ida;
+	struct list_head gmr_lru;
+
+
+	/**
+	 * Operating mode.
+	 */
+
+	bool stealth;
+	bool is_opened;
+
+	/**
+	 * Master management.
+	 */
+
+	struct vmw_master *active_master;
+	struct vmw_master fbdev_master;
+};
+
+static inline struct vmw_private *vmw_priv(struct drm_device *dev)
+{
+	return (struct vmw_private *)dev->dev_private;
+}
+
+static inline struct vmw_fpriv *vmw_fpriv(struct drm_file *file_priv)
+{
+	return (struct vmw_fpriv *)file_priv->driver_priv;
+}
+
+static inline struct vmw_master *vmw_master(struct drm_master *master)
+{
+	return (struct vmw_master *) master->driver_priv;
+}
+
+static inline void vmw_write(struct vmw_private *dev_priv,
+			     unsigned int offset, uint32_t value)
+{
+	outl(offset, dev_priv->io_start + VMWGFX_INDEX_PORT);
+	outl(value, dev_priv->io_start + VMWGFX_VALUE_PORT);
+}
+
+static inline uint32_t vmw_read(struct vmw_private *dev_priv,
+				unsigned int offset)
+{
+	uint32_t val;
+
+	outl(offset, dev_priv->io_start + VMWGFX_INDEX_PORT);
+	val = inl(dev_priv->io_start + VMWGFX_VALUE_PORT);
+	return val;
+}
+
+/**
+ * GMR utilities - vmwgfx_gmr.c
+ */
+
+extern int vmw_gmr_bind(struct vmw_private *dev_priv,
+			struct ttm_buffer_object *bo);
+extern void vmw_gmr_unbind(struct vmw_private *dev_priv, int gmr_id);
+
+/**
+ * Resource utilities - vmwgfx_resource.c
+ */
+
+extern struct vmw_resource *vmw_context_alloc(struct vmw_private *dev_priv);
+extern void vmw_resource_unreference(struct vmw_resource **p_res);
+extern struct vmw_resource *vmw_resource_reference(struct vmw_resource *res);
+extern int vmw_context_destroy_ioctl(struct drm_device *dev, void *data,
+				     struct drm_file *file_priv);
+extern int vmw_context_define_ioctl(struct drm_device *dev, void *data,
+				    struct drm_file *file_priv);
+extern int vmw_context_check(struct vmw_private *dev_priv,
+			     struct ttm_object_file *tfile,
+			     int id);
+extern void vmw_surface_res_free(struct vmw_resource *res);
+extern int vmw_surface_init(struct vmw_private *dev_priv,
+			    struct vmw_surface *srf,
+			    void (*res_free) (struct vmw_resource *res));
+extern int vmw_user_surface_lookup_handle(struct vmw_private *dev_priv,
+					  struct ttm_object_file *tfile,
+					  uint32_t handle,
+					  struct vmw_surface **out);
+extern int vmw_surface_destroy_ioctl(struct drm_device *dev, void *data,
+				     struct drm_file *file_priv);
+extern int vmw_surface_define_ioctl(struct drm_device *dev, void *data,
+				    struct drm_file *file_priv);
+extern int vmw_surface_reference_ioctl(struct drm_device *dev, void *data,
+				       struct drm_file *file_priv);
+extern int vmw_surface_check(struct vmw_private *dev_priv,
+			     struct ttm_object_file *tfile,
+			     uint32_t handle, int *id);
+extern void vmw_dmabuf_bo_free(struct ttm_buffer_object *bo);
+extern int vmw_dmabuf_init(struct vmw_private *dev_priv,
+			   struct vmw_dma_buffer *vmw_bo,
+			   size_t size, struct ttm_placement *placement,
+			   bool interuptable,
+			   void (*bo_free) (struct ttm_buffer_object *bo));
+extern int vmw_dmabuf_alloc_ioctl(struct drm_device *dev, void *data,
+				  struct drm_file *file_priv);
+extern int vmw_dmabuf_unref_ioctl(struct drm_device *dev, void *data,
+				  struct drm_file *file_priv);
+extern uint32_t vmw_dmabuf_validate_node(struct ttm_buffer_object *bo,
+					 uint32_t cur_validate_node);
+extern void vmw_dmabuf_validate_clear(struct ttm_buffer_object *bo);
+extern int vmw_user_dmabuf_lookup(struct ttm_object_file *tfile,
+				  uint32_t id, struct vmw_dma_buffer **out);
+extern uint32_t vmw_dmabuf_gmr(struct ttm_buffer_object *bo);
+extern void vmw_dmabuf_set_gmr(struct ttm_buffer_object *bo, uint32_t id);
+extern int vmw_gmr_id_alloc(struct vmw_private *dev_priv, uint32_t *p_id);
+extern int vmw_dmabuf_to_start_of_vram(struct vmw_private *vmw_priv,
+				       struct vmw_dma_buffer *bo);
+extern int vmw_dmabuf_from_vram(struct vmw_private *vmw_priv,
+				struct vmw_dma_buffer *bo);
+extern int vmw_stream_claim_ioctl(struct drm_device *dev, void *data,
+				  struct drm_file *file_priv);
+extern int vmw_stream_unref_ioctl(struct drm_device *dev, void *data,
+				  struct drm_file *file_priv);
+extern int vmw_user_stream_lookup(struct vmw_private *dev_priv,
+				  struct ttm_object_file *tfile,
+				  uint32_t *inout_id,
+				  struct vmw_resource **out);
+
+
+/**
+ * Misc Ioctl functionality - vmwgfx_ioctl.c
+ */
+
+extern int vmw_getparam_ioctl(struct drm_device *dev, void *data,
+			      struct drm_file *file_priv);
+extern int vmw_fifo_debug_ioctl(struct drm_device *dev, void *data,
+				struct drm_file *file_priv);
+
+/**
+ * Fifo utilities - vmwgfx_fifo.c
+ */
+
+extern int vmw_fifo_init(struct vmw_private *dev_priv,
+			 struct vmw_fifo_state *fifo);
+extern void vmw_fifo_release(struct vmw_private *dev_priv,
+			     struct vmw_fifo_state *fifo);
+extern void *vmw_fifo_reserve(struct vmw_private *dev_priv, uint32_t bytes);
+extern void vmw_fifo_commit(struct vmw_private *dev_priv, uint32_t bytes);
+extern int vmw_fifo_send_fence(struct vmw_private *dev_priv,
+			       uint32_t *sequence);
+extern void vmw_fifo_ping_host(struct vmw_private *dev_priv, uint32_t reason);
+extern int vmw_fifo_mmap(struct file *filp, struct vm_area_struct *vma);
+
+/**
+ * TTM glue - vmwgfx_ttm_glue.c
+ */
+
+extern int vmw_ttm_global_init(struct vmw_private *dev_priv);
+extern void vmw_ttm_global_release(struct vmw_private *dev_priv);
+extern int vmw_mmap(struct file *filp, struct vm_area_struct *vma);
+
+/**
+ * TTM buffer object driver - vmwgfx_buffer.c
+ */
+
+extern struct ttm_placement vmw_vram_placement;
+extern struct ttm_placement vmw_vram_ne_placement;
+extern struct ttm_placement vmw_sys_placement;
+extern struct ttm_bo_driver vmw_bo_driver;
+extern int vmw_dma_quiescent(struct drm_device *dev);
+
+/**
+ * Command submission - vmwgfx_execbuf.c
+ */
+
+extern int vmw_execbuf_ioctl(struct drm_device *dev, void *data,
+			     struct drm_file *file_priv);
+
+/**
+ * IRQs and wating - vmwgfx_irq.c
+ */
+
+extern irqreturn_t vmw_irq_handler(DRM_IRQ_ARGS);
+extern int vmw_wait_fence(struct vmw_private *dev_priv, bool lazy,
+			  uint32_t sequence, bool interruptible,
+			  unsigned long timeout);
+extern void vmw_irq_preinstall(struct drm_device *dev);
+extern int vmw_irq_postinstall(struct drm_device *dev);
+extern void vmw_irq_uninstall(struct drm_device *dev);
+extern bool vmw_fence_signaled(struct vmw_private *dev_priv,
+			       uint32_t sequence);
+extern int vmw_fence_wait_ioctl(struct drm_device *dev, void *data,
+				struct drm_file *file_priv);
+extern int vmw_fallback_wait(struct vmw_private *dev_priv,
+			     bool lazy,
+			     bool fifo_idle,
+			     uint32_t sequence,
+			     bool interruptible,
+			     unsigned long timeout);
+
+/**
+ * Kernel framebuffer - vmwgfx_fb.c
+ */
+
+int vmw_fb_init(struct vmw_private *vmw_priv);
+int vmw_fb_close(struct vmw_private *dev_priv);
+int vmw_fb_off(struct vmw_private *vmw_priv);
+int vmw_fb_on(struct vmw_private *vmw_priv);
+
+/**
+ * Kernel modesetting - vmwgfx_kms.c
+ */
+
+int vmw_kms_init(struct vmw_private *dev_priv);
+int vmw_kms_close(struct vmw_private *dev_priv);
+int vmw_kms_save_vga(struct vmw_private *vmw_priv);
+int vmw_kms_restore_vga(struct vmw_private *vmw_priv);
+int vmw_kms_cursor_bypass_ioctl(struct drm_device *dev, void *data,
+				struct drm_file *file_priv);
+void vmw_kms_cursor_post_execbuf(struct vmw_private *dev_priv);
+void vmw_kms_cursor_snoop(struct vmw_surface *srf,
+			  struct ttm_object_file *tfile,
+			  struct ttm_buffer_object *bo,
+			  SVGA3dCmdHeader *header);
+
+/**
+ * Overlay control - vmwgfx_overlay.c
+ */
+
+int vmw_overlay_init(struct vmw_private *dev_priv);
+int vmw_overlay_close(struct vmw_private *dev_priv);
+int vmw_overlay_ioctl(struct drm_device *dev, void *data,
+		      struct drm_file *file_priv);
+int vmw_overlay_stop_all(struct vmw_private *dev_priv);
+int vmw_overlay_resume_all(struct vmw_private *dev_priv);
+int vmw_overlay_pause_all(struct vmw_private *dev_priv);
+int vmw_overlay_claim(struct vmw_private *dev_priv, uint32_t *out);
+int vmw_overlay_unref(struct vmw_private *dev_priv, uint32_t stream_id);
+int vmw_overlay_num_overlays(struct vmw_private *dev_priv);
+int vmw_overlay_num_free_overlays(struct vmw_private *dev_priv);
+
+/**
+ * Inline helper functions
+ */
+
+static inline void vmw_surface_unreference(struct vmw_surface **srf)
+{
+	struct vmw_surface *tmp_srf = *srf;
+	struct vmw_resource *res = &tmp_srf->res;
+	*srf = NULL;
+
+	vmw_resource_unreference(&res);
+}
+
+static inline struct vmw_surface *vmw_surface_reference(struct vmw_surface *srf)
+{
+	(void) vmw_resource_reference(&srf->res);
+	return srf;
+}
+
+static inline void vmw_dmabuf_unreference(struct vmw_dma_buffer **buf)
+{
+	struct vmw_dma_buffer *tmp_buf = *buf;
+	struct ttm_buffer_object *bo = &tmp_buf->base;
+	*buf = NULL;
+
+	ttm_bo_unref(&bo);
+}
+
+static inline struct vmw_dma_buffer *vmw_dmabuf_reference(struct vmw_dma_buffer *buf)
+{
+	if (ttm_bo_reference(&buf->base))
+		return buf;
+	return NULL;
+}
+
+#endif
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
new file mode 100644
index 000000000000..2e92da567403
--- /dev/null
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -0,0 +1,621 @@
+/**************************************************************************
+ *
+ * Copyright © 2009 VMware, Inc., Palo Alto, CA., USA
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ **************************************************************************/
+
+#include "vmwgfx_drv.h"
+#include "vmwgfx_reg.h"
+#include "ttm/ttm_bo_api.h"
+#include "ttm/ttm_placement.h"
+
+static int vmw_cmd_invalid(struct vmw_private *dev_priv,
+			   struct vmw_sw_context *sw_context,
+			   SVGA3dCmdHeader *header)
+{
+	return capable(CAP_SYS_ADMIN) ? : -EINVAL;
+}
+
+static int vmw_cmd_ok(struct vmw_private *dev_priv,
+		      struct vmw_sw_context *sw_context,
+		      SVGA3dCmdHeader *header)
+{
+	return 0;
+}
+
+static int vmw_cmd_cid_check(struct vmw_private *dev_priv,
+			     struct vmw_sw_context *sw_context,
+			     SVGA3dCmdHeader *header)
+{
+	struct vmw_cid_cmd {
+		SVGA3dCmdHeader header;
+		__le32 cid;
+	} *cmd;
+	int ret;
+
+	cmd = container_of(header, struct vmw_cid_cmd, header);
+	if (likely(sw_context->cid_valid && cmd->cid == sw_context->last_cid))
+		return 0;
+
+	ret = vmw_context_check(dev_priv, sw_context->tfile, cmd->cid);
+	if (unlikely(ret != 0)) {
+		DRM_ERROR("Could not find or use context %u\n",
+			  (unsigned) cmd->cid);
+		return ret;
+	}
+
+	sw_context->last_cid = cmd->cid;
+	sw_context->cid_valid = true;
+
+	return 0;
+}
+
+static int vmw_cmd_sid_check(struct vmw_private *dev_priv,
+			     struct vmw_sw_context *sw_context,
+			     uint32_t *sid)
+{
+	if (*sid == SVGA3D_INVALID_ID)
+		return 0;
+
+	if (unlikely((!sw_context->sid_valid  ||
+		      *sid != sw_context->last_sid))) {
+		int real_id;
+		int ret = vmw_surface_check(dev_priv, sw_context->tfile,
+					    *sid, &real_id);
+
+		if (unlikely(ret != 0)) {
+			DRM_ERROR("Could ot find or use surface 0x%08x "
+				  "address 0x%08lx\n",
+				  (unsigned int) *sid,
+				  (unsigned long) sid);
+			return ret;
+		}
+
+		sw_context->last_sid = *sid;
+		sw_context->sid_valid = true;
+		*sid = real_id;
+		sw_context->sid_translation = real_id;
+	} else
+		*sid = sw_context->sid_translation;
+
+	return 0;
+}
+
+
+static int vmw_cmd_set_render_target_check(struct vmw_private *dev_priv,
+					   struct vmw_sw_context *sw_context,
+					   SVGA3dCmdHeader *header)
+{
+	struct vmw_sid_cmd {
+		SVGA3dCmdHeader header;
+		SVGA3dCmdSetRenderTarget body;
+	} *cmd;
+	int ret;
+
+	ret = vmw_cmd_cid_check(dev_priv, sw_context, header);
+	if (unlikely(ret != 0))
+		return ret;
+
+	cmd = container_of(header, struct vmw_sid_cmd, header);
+	ret = vmw_cmd_sid_check(dev_priv, sw_context, &cmd->body.target.sid);
+	return ret;
+}
+
+static int vmw_cmd_surface_copy_check(struct vmw_private *dev_priv,
+				      struct vmw_sw_context *sw_context,
+				      SVGA3dCmdHeader *header)
+{
+	struct vmw_sid_cmd {
+		SVGA3dCmdHeader header;
+		SVGA3dCmdSurfaceCopy body;
+	} *cmd;
+	int ret;
+
+	cmd = container_of(header, struct vmw_sid_cmd, header);
+	ret = vmw_cmd_sid_check(dev_priv, sw_context, &cmd->body.src.sid);
+	if (unlikely(ret != 0))
+		return ret;
+	return vmw_cmd_sid_check(dev_priv, sw_context, &cmd->body.dest.sid);
+}
+
+static int vmw_cmd_stretch_blt_check(struct vmw_private *dev_priv,
+				     struct vmw_sw_context *sw_context,
+				     SVGA3dCmdHeader *header)
+{
+	struct vmw_sid_cmd {
+		SVGA3dCmdHeader header;
+		SVGA3dCmdSurfaceStretchBlt body;
+	} *cmd;
+	int ret;
+
+	cmd = container_of(header, struct vmw_sid_cmd, header);
+	ret = vmw_cmd_sid_check(dev_priv, sw_context, &cmd->body.src.sid);
+	if (unlikely(ret != 0))
+		return ret;
+	return vmw_cmd_sid_check(dev_priv, sw_context, &cmd->body.dest.sid);
+}
+
+static int vmw_cmd_blt_surf_screen_check(struct vmw_private *dev_priv,
+					 struct vmw_sw_context *sw_context,
+					 SVGA3dCmdHeader *header)
+{
+	struct vmw_sid_cmd {
+		SVGA3dCmdHeader header;
+		SVGA3dCmdBlitSurfaceToScreen body;
+	} *cmd;
+
+	cmd = container_of(header, struct vmw_sid_cmd, header);
+	return vmw_cmd_sid_check(dev_priv, sw_context, &cmd->body.srcImage.sid);
+}
+
+static int vmw_cmd_present_check(struct vmw_private *dev_priv,
+				 struct vmw_sw_context *sw_context,
+				 SVGA3dCmdHeader *header)
+{
+	struct vmw_sid_cmd {
+		SVGA3dCmdHeader header;
+		SVGA3dCmdPresent body;
+	} *cmd;
+
+	cmd = container_of(header, struct vmw_sid_cmd, header);
+	return vmw_cmd_sid_check(dev_priv, sw_context, &cmd->body.sid);
+}
+
+static int vmw_cmd_dma(struct vmw_private *dev_priv,
+		       struct vmw_sw_context *sw_context,
+		       SVGA3dCmdHeader *header)
+{
+	uint32_t handle;
+	struct vmw_dma_buffer *vmw_bo = NULL;
+	struct ttm_buffer_object *bo;
+	struct vmw_surface *srf = NULL;
+	struct vmw_dma_cmd {
+		SVGA3dCmdHeader header;
+		SVGA3dCmdSurfaceDMA dma;
+	} *cmd;
+	struct vmw_relocation *reloc;
+	int ret;
+	uint32_t cur_validate_node;
+	struct ttm_validate_buffer *val_buf;
+
+	cmd = container_of(header, struct vmw_dma_cmd, header);
+	handle = cmd->dma.guest.ptr.gmrId;
+	ret = vmw_user_dmabuf_lookup(sw_context->tfile, handle, &vmw_bo);
+	if (unlikely(ret != 0)) {
+		DRM_ERROR("Could not find or use GMR region.\n");
+		return -EINVAL;
+	}
+	bo = &vmw_bo->base;
+
+	if (unlikely(sw_context->cur_reloc >= VMWGFX_MAX_RELOCATIONS)) {
+		DRM_ERROR("Max number of DMA commands per submission"
+			  " exceeded\n");
+		ret = -EINVAL;
+		goto out_no_reloc;
+	}
+
+	reloc = &sw_context->relocs[sw_context->cur_reloc++];
+	reloc->location = &cmd->dma.guest.ptr;
+
+	cur_validate_node = vmw_dmabuf_validate_node(bo, sw_context->cur_val_buf);
+	if (unlikely(cur_validate_node >= VMWGFX_MAX_GMRS)) {
+		DRM_ERROR("Max number of DMA buffers per submission"
+			  " exceeded.\n");
+		ret = -EINVAL;
+		goto out_no_reloc;
+	}
+
+	reloc->index = cur_validate_node;
+	if (unlikely(cur_validate_node == sw_context->cur_val_buf)) {
+		val_buf = &sw_context->val_bufs[cur_validate_node];
+		val_buf->bo = ttm_bo_reference(bo);
+		val_buf->new_sync_obj_arg = (void *) dev_priv;
+		list_add_tail(&val_buf->head, &sw_context->validate_nodes);
+		++sw_context->cur_val_buf;
+	}
+
+	ret = vmw_user_surface_lookup_handle(dev_priv, sw_context->tfile,
+					     cmd->dma.host.sid, &srf);
+	if (ret) {
+		DRM_ERROR("could not find surface\n");
+		goto out_no_reloc;
+	}
+
+	/**
+	 * Patch command stream with device SID.
+	 */
+
+	cmd->dma.host.sid = srf->res.id;
+	vmw_kms_cursor_snoop(srf, sw_context->tfile, bo, header);
+	/**
+	 * FIXME: May deadlock here when called from the
+	 * command parsing code.
+	 */
+	vmw_surface_unreference(&srf);
+
+out_no_reloc:
+	vmw_dmabuf_unreference(&vmw_bo);
+	return ret;
+}
+
+static int vmw_cmd_draw(struct vmw_private *dev_priv,
+			struct vmw_sw_context *sw_context,
+			SVGA3dCmdHeader *header)
+{
+	struct vmw_draw_cmd {
+		SVGA3dCmdHeader header;
+		SVGA3dCmdDrawPrimitives body;
+	} *cmd;
+	SVGA3dVertexDecl *decl = (SVGA3dVertexDecl *)(
+		(unsigned long)header + sizeof(*cmd));
+	SVGA3dPrimitiveRange *range;
+	uint32_t i;
+	uint32_t maxnum;
+	int ret;
+
+	ret = vmw_cmd_cid_check(dev_priv, sw_context, header);
+	if (unlikely(ret != 0))
+		return ret;
+
+	cmd = container_of(header, struct vmw_draw_cmd, header);
+	maxnum = (header->size - sizeof(cmd->body)) / sizeof(*decl);
+
+	if (unlikely(cmd->body.numVertexDecls > maxnum)) {
+		DRM_ERROR("Illegal number of vertex declarations.\n");
+		return -EINVAL;
+	}
+
+	for (i = 0; i < cmd->body.numVertexDecls; ++i, ++decl) {
+		ret = vmw_cmd_sid_check(dev_priv, sw_context,
+					&decl->array.surfaceId);
+		if (unlikely(ret != 0))
+			return ret;
+	}
+
+	maxnum = (header->size - sizeof(cmd->body) -
+		  cmd->body.numVertexDecls * sizeof(*decl)) / sizeof(*range);
+	if (unlikely(cmd->body.numRanges > maxnum)) {
+		DRM_ERROR("Illegal number of index ranges.\n");
+		return -EINVAL;
+	}
+
+	range = (SVGA3dPrimitiveRange *) decl;
+	for (i = 0; i < cmd->body.numRanges; ++i, ++range) {
+		ret = vmw_cmd_sid_check(dev_priv, sw_context,
+					&range->indexArray.surfaceId);
+		if (unlikely(ret != 0))
+			return ret;
+	}
+	return 0;
+}
+
+
+static int vmw_cmd_tex_state(struct vmw_private *dev_priv,
+			     struct vmw_sw_context *sw_context,
+			     SVGA3dCmdHeader *header)
+{
+	struct vmw_tex_state_cmd {
+		SVGA3dCmdHeader header;
+		SVGA3dCmdSetTextureState state;
+	};
+
+	SVGA3dTextureState *last_state = (SVGA3dTextureState *)
+	  ((unsigned long) header + header->size + sizeof(header));
+	SVGA3dTextureState *cur_state = (SVGA3dTextureState *)
+		((unsigned long) header + sizeof(struct vmw_tex_state_cmd));
+	int ret;
+
+	ret = vmw_cmd_cid_check(dev_priv, sw_context, header);
+	if (unlikely(ret != 0))
+		return ret;
+
+	for (; cur_state < last_state; ++cur_state) {
+		if (likely(cur_state->name != SVGA3D_TS_BIND_TEXTURE))
+			continue;
+
+		ret = vmw_cmd_sid_check(dev_priv, sw_context,
+					&cur_state->value);
+		if (unlikely(ret != 0))
+			return ret;
+	}
+
+	return 0;
+}
+
+
+typedef int (*vmw_cmd_func) (struct vmw_private *,
+			     struct vmw_sw_context *,
+			     SVGA3dCmdHeader *);
+
+#define VMW_CMD_DEF(cmd, func) \
+	[cmd - SVGA_3D_CMD_BASE] = func
+
+static vmw_cmd_func vmw_cmd_funcs[SVGA_3D_CMD_MAX] = {
+	VMW_CMD_DEF(SVGA_3D_CMD_SURFACE_DEFINE, &vmw_cmd_invalid),
+	VMW_CMD_DEF(SVGA_3D_CMD_SURFACE_DESTROY, &vmw_cmd_invalid),
+	VMW_CMD_DEF(SVGA_3D_CMD_SURFACE_COPY, &vmw_cmd_surface_copy_check),
+	VMW_CMD_DEF(SVGA_3D_CMD_SURFACE_STRETCHBLT, &vmw_cmd_stretch_blt_check),
+	VMW_CMD_DEF(SVGA_3D_CMD_SURFACE_DMA, &vmw_cmd_dma),
+	VMW_CMD_DEF(SVGA_3D_CMD_CONTEXT_DEFINE, &vmw_cmd_invalid),
+	VMW_CMD_DEF(SVGA_3D_CMD_CONTEXT_DESTROY, &vmw_cmd_invalid),
+	VMW_CMD_DEF(SVGA_3D_CMD_SETTRANSFORM, &vmw_cmd_cid_check),
+	VMW_CMD_DEF(SVGA_3D_CMD_SETZRANGE, &vmw_cmd_cid_check),
+	VMW_CMD_DEF(SVGA_3D_CMD_SETRENDERSTATE, &vmw_cmd_cid_check),
+	VMW_CMD_DEF(SVGA_3D_CMD_SETRENDERTARGET,
+		    &vmw_cmd_set_render_target_check),
+	VMW_CMD_DEF(SVGA_3D_CMD_SETTEXTURESTATE, &vmw_cmd_tex_state),
+	VMW_CMD_DEF(SVGA_3D_CMD_SETMATERIAL, &vmw_cmd_cid_check),
+	VMW_CMD_DEF(SVGA_3D_CMD_SETLIGHTDATA, &vmw_cmd_cid_check),
+	VMW_CMD_DEF(SVGA_3D_CMD_SETLIGHTENABLED, &vmw_cmd_cid_check),
+	VMW_CMD_DEF(SVGA_3D_CMD_SETVIEWPORT, &vmw_cmd_cid_check),
+	VMW_CMD_DEF(SVGA_3D_CMD_SETCLIPPLANE, &vmw_cmd_cid_check),
+	VMW_CMD_DEF(SVGA_3D_CMD_CLEAR, &vmw_cmd_cid_check),
+	VMW_CMD_DEF(SVGA_3D_CMD_PRESENT, &vmw_cmd_present_check),
+	VMW_CMD_DEF(SVGA_3D_CMD_SHADER_DEFINE, &vmw_cmd_cid_check),
+	VMW_CMD_DEF(SVGA_3D_CMD_SHADER_DESTROY, &vmw_cmd_cid_check),
+	VMW_CMD_DEF(SVGA_3D_CMD_SET_SHADER, &vmw_cmd_cid_check),
+	VMW_CMD_DEF(SVGA_3D_CMD_SET_SHADER_CONST, &vmw_cmd_cid_check),
+	VMW_CMD_DEF(SVGA_3D_CMD_DRAW_PRIMITIVES, &vmw_cmd_draw),
+	VMW_CMD_DEF(SVGA_3D_CMD_SETSCISSORRECT, &vmw_cmd_cid_check),
+	VMW_CMD_DEF(SVGA_3D_CMD_BEGIN_QUERY, &vmw_cmd_cid_check),
+	VMW_CMD_DEF(SVGA_3D_CMD_END_QUERY, &vmw_cmd_cid_check),
+	VMW_CMD_DEF(SVGA_3D_CMD_WAIT_FOR_QUERY, &vmw_cmd_cid_check),
+	VMW_CMD_DEF(SVGA_3D_CMD_PRESENT_READBACK, &vmw_cmd_ok),
+	VMW_CMD_DEF(SVGA_3D_CMD_BLIT_SURFACE_TO_SCREEN,
+		    &vmw_cmd_blt_surf_screen_check)
+};
+
+static int vmw_cmd_check(struct vmw_private *dev_priv,
+			 struct vmw_sw_context *sw_context,
+			 void *buf, uint32_t *size)
+{
+	uint32_t cmd_id;
+	uint32_t size_remaining = *size;
+	SVGA3dCmdHeader *header = (SVGA3dCmdHeader *) buf;
+	int ret;
+
+	cmd_id = ((uint32_t *)buf)[0];
+	if (cmd_id == SVGA_CMD_UPDATE) {
+		*size = 5 << 2;
+		return 0;
+	}
+
+	cmd_id = le32_to_cpu(header->id);
+	*size = le32_to_cpu(header->size) + sizeof(SVGA3dCmdHeader);
+
+	cmd_id -= SVGA_3D_CMD_BASE;
+	if (unlikely(*size > size_remaining))
+		goto out_err;
+
+	if (unlikely(cmd_id >= SVGA_3D_CMD_MAX - SVGA_3D_CMD_BASE))
+		goto out_err;
+
+	ret = vmw_cmd_funcs[cmd_id](dev_priv, sw_context, header);
+	if (unlikely(ret != 0))
+		goto out_err;
+
+	return 0;
+out_err:
+	DRM_ERROR("Illegal / Invalid SVGA3D command: %d\n",
+		  cmd_id + SVGA_3D_CMD_BASE);
+	return -EINVAL;
+}
+
+static int vmw_cmd_check_all(struct vmw_private *dev_priv,
+			     struct vmw_sw_context *sw_context,
+			     void *buf, uint32_t size)
+{
+	int32_t cur_size = size;
+	int ret;
+
+	while (cur_size > 0) {
+		size = cur_size;
+		ret = vmw_cmd_check(dev_priv, sw_context, buf, &size);
+		if (unlikely(ret != 0))
+			return ret;
+		buf = (void *)((unsigned long) buf + size);
+		cur_size -= size;
+	}
+
+	if (unlikely(cur_size != 0)) {
+		DRM_ERROR("Command verifier out of sync.\n");
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static void vmw_free_relocations(struct vmw_sw_context *sw_context)
+{
+	sw_context->cur_reloc = 0;
+}
+
+static void vmw_apply_relocations(struct vmw_sw_context *sw_context)
+{
+	uint32_t i;
+	struct vmw_relocation *reloc;
+	struct ttm_validate_buffer *validate;
+	struct ttm_buffer_object *bo;
+
+	for (i = 0; i < sw_context->cur_reloc; ++i) {
+		reloc = &sw_context->relocs[i];
+		validate = &sw_context->val_bufs[reloc->index];
+		bo = validate->bo;
+		reloc->location->offset += bo->offset;
+		reloc->location->gmrId = vmw_dmabuf_gmr(bo);
+	}
+	vmw_free_relocations(sw_context);
+}
+
+static void vmw_clear_validations(struct vmw_sw_context *sw_context)
+{
+	struct ttm_validate_buffer *entry, *next;
+
+	list_for_each_entry_safe(entry, next, &sw_context->validate_nodes,
+				 head) {
+		list_del(&entry->head);
+		vmw_dmabuf_validate_clear(entry->bo);
+		ttm_bo_unref(&entry->bo);
+		sw_context->cur_val_buf--;
+	}
+	BUG_ON(sw_context->cur_val_buf != 0);
+}
+
+static int vmw_validate_single_buffer(struct vmw_private *dev_priv,
+				      struct ttm_buffer_object *bo)
+{
+	int ret;
+
+	if (vmw_dmabuf_gmr(bo) != SVGA_GMR_NULL)
+		return 0;
+
+	ret = vmw_gmr_bind(dev_priv, bo);
+	if (likely(ret == 0 || ret == -ERESTARTSYS))
+		return ret;
+
+
+	ret = ttm_bo_validate(bo, &vmw_vram_placement, true, false);
+	return ret;
+}
+
+
+static int vmw_validate_buffers(struct vmw_private *dev_priv,
+				struct vmw_sw_context *sw_context)
+{
+	struct ttm_validate_buffer *entry;
+	int ret;
+
+	list_for_each_entry(entry, &sw_context->validate_nodes, head) {
+		ret = vmw_validate_single_buffer(dev_priv, entry->bo);
+		if (unlikely(ret != 0))
+			return ret;
+	}
+	return 0;
+}
+
+int vmw_execbuf_ioctl(struct drm_device *dev, void *data,
+		      struct drm_file *file_priv)
+{
+	struct vmw_private *dev_priv = vmw_priv(dev);
+	struct drm_vmw_execbuf_arg *arg = (struct drm_vmw_execbuf_arg *)data;
+	struct drm_vmw_fence_rep fence_rep;
+	struct drm_vmw_fence_rep __user *user_fence_rep;
+	int ret;
+	void *user_cmd;
+	void *cmd;
+	uint32_t sequence;
+	struct vmw_sw_context *sw_context = &dev_priv->ctx;
+	struct vmw_master *vmaster = vmw_master(file_priv->master);
+
+	ret = ttm_read_lock(&vmaster->lock, true);
+	if (unlikely(ret != 0))
+		return ret;
+
+	ret = mutex_lock_interruptible(&dev_priv->cmdbuf_mutex);
+	if (unlikely(ret != 0)) {
+		ret = -ERESTARTSYS;
+		goto out_no_cmd_mutex;
+	}
+
+	cmd = vmw_fifo_reserve(dev_priv, arg->command_size);
+	if (unlikely(cmd == NULL)) {
+		DRM_ERROR("Failed reserving fifo space for commands.\n");
+		ret = -ENOMEM;
+		goto out_unlock;
+	}
+
+	user_cmd = (void __user *)(unsigned long)arg->commands;
+	ret = copy_from_user(cmd, user_cmd, arg->command_size);
+
+	if (unlikely(ret != 0)) {
+		DRM_ERROR("Failed copying commands.\n");
+		goto out_commit;
+	}
+
+	sw_context->tfile = vmw_fpriv(file_priv)->tfile;
+	sw_context->cid_valid = false;
+	sw_context->sid_valid = false;
+	sw_context->cur_reloc = 0;
+	sw_context->cur_val_buf = 0;
+
+	INIT_LIST_HEAD(&sw_context->validate_nodes);
+
+	ret = vmw_cmd_check_all(dev_priv, sw_context, cmd, arg->command_size);
+	if (unlikely(ret != 0))
+		goto out_err;
+	ret = ttm_eu_reserve_buffers(&sw_context->validate_nodes,
+				     dev_priv->val_seq++);
+	if (unlikely(ret != 0))
+		goto out_err;
+
+	ret = vmw_validate_buffers(dev_priv, sw_context);
+	if (unlikely(ret != 0))
+		goto out_err;
+
+	vmw_apply_relocations(sw_context);
+	vmw_fifo_commit(dev_priv, arg->command_size);
+
+	ret = vmw_fifo_send_fence(dev_priv, &sequence);
+
+	ttm_eu_fence_buffer_objects(&sw_context->validate_nodes,
+				    (void *)(unsigned long) sequence);
+	vmw_clear_validations(sw_context);
+	mutex_unlock(&dev_priv->cmdbuf_mutex);
+
+	/*
+	 * This error is harmless, because if fence submission fails,
+	 * vmw_fifo_send_fence will sync.
+	 */
+
+	if (ret != 0)
+		DRM_ERROR("Fence submission error. Syncing.\n");
+
+	fence_rep.error = ret;
+	fence_rep.fence_seq = (uint64_t) sequence;
+
+	user_fence_rep = (struct drm_vmw_fence_rep __user *)
+	    (unsigned long)arg->fence_rep;
+
+	/*
+	 * copy_to_user errors will be detected by user space not
+	 * seeing fence_rep::error filled in.
+	 */
+
+	ret = copy_to_user(user_fence_rep, &fence_rep, sizeof(fence_rep));
+
+	vmw_kms_cursor_post_execbuf(dev_priv);
+	ttm_read_unlock(&vmaster->lock);
+	return 0;
+out_err:
+	vmw_free_relocations(sw_context);
+	ttm_eu_backoff_reservation(&sw_context->validate_nodes);
+	vmw_clear_validations(sw_context);
+out_commit:
+	vmw_fifo_commit(dev_priv, 0);
+out_unlock:
+	mutex_unlock(&dev_priv->cmdbuf_mutex);
+out_no_cmd_mutex:
+	ttm_read_unlock(&vmaster->lock);
+	return ret;
+}
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
new file mode 100644
index 000000000000..641dde76ada1
--- /dev/null
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
@@ -0,0 +1,742 @@
+/**************************************************************************
+ *
+ * Copyright © 2007 David Airlie
+ * Copyright © 2009 VMware, Inc., Palo Alto, CA., USA
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ **************************************************************************/
+
+#include "drmP.h"
+#include "vmwgfx_drv.h"
+
+#include "ttm/ttm_placement.h"
+
+#define VMW_DIRTY_DELAY (HZ / 30)
+
+struct vmw_fb_par {
+	struct vmw_private *vmw_priv;
+
+	void *vmalloc;
+
+	struct vmw_dma_buffer *vmw_bo;
+	struct ttm_bo_kmap_obj map;
+
+	u32 pseudo_palette[17];
+
+	unsigned depth;
+	unsigned bpp;
+
+	unsigned max_width;
+	unsigned max_height;
+
+	void *bo_ptr;
+	unsigned bo_size;
+	bool bo_iowrite;
+
+	struct {
+		spinlock_t lock;
+		bool active;
+		unsigned x1;
+		unsigned y1;
+		unsigned x2;
+		unsigned y2;
+	} dirty;
+};
+
+static int vmw_fb_setcolreg(unsigned regno, unsigned red, unsigned green,
+			    unsigned blue, unsigned transp,
+			    struct fb_info *info)
+{
+	struct vmw_fb_par *par = info->par;
+	u32 *pal = par->pseudo_palette;
+
+	if (regno > 15) {
+		DRM_ERROR("Bad regno %u.\n", regno);
+		return 1;
+	}
+
+	switch (par->depth) {
+	case 24:
+	case 32:
+		pal[regno] = ((red & 0xff00) << 8) |
+			      (green & 0xff00) |
+			     ((blue  & 0xff00) >> 8);
+		break;
+	default:
+		DRM_ERROR("Bad depth %u, bpp %u.\n", par->depth, par->bpp);
+		return 1;
+	}
+
+	return 0;
+}
+
+static int vmw_fb_check_var(struct fb_var_screeninfo *var,
+			    struct fb_info *info)
+{
+	int depth = var->bits_per_pixel;
+	struct vmw_fb_par *par = info->par;
+	struct vmw_private *vmw_priv = par->vmw_priv;
+
+	switch (var->bits_per_pixel) {
+	case 32:
+		depth = (var->transp.length > 0) ? 32 : 24;
+		break;
+	default:
+		DRM_ERROR("Bad bpp %u.\n", var->bits_per_pixel);
+		return -EINVAL;
+	}
+
+	switch (depth) {
+	case 24:
+		var->red.offset = 16;
+		var->green.offset = 8;
+		var->blue.offset = 0;
+		var->red.length = 8;
+		var->green.length = 8;
+		var->blue.length = 8;
+		var->transp.length = 0;
+		var->transp.offset = 0;
+		break;
+	case 32:
+		var->red.offset = 16;
+		var->green.offset = 8;
+		var->blue.offset = 0;
+		var->red.length = 8;
+		var->green.length = 8;
+		var->blue.length = 8;
+		var->transp.length = 8;
+		var->transp.offset = 24;
+		break;
+	default:
+		DRM_ERROR("Bad depth %u.\n", depth);
+		return -EINVAL;
+	}
+
+	/* without multimon its hard to resize */
+	if (!(vmw_priv->capabilities & SVGA_CAP_MULTIMON) &&
+	    (var->xres != par->max_width ||
+	     var->yres != par->max_height)) {
+		DRM_ERROR("Tried to resize, but we don't have multimon\n");
+		return -EINVAL;
+	}
+
+	if (var->xres > par->max_width ||
+	    var->yres > par->max_height) {
+		DRM_ERROR("Requested geom can not fit in framebuffer\n");
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int vmw_fb_set_par(struct fb_info *info)
+{
+	struct vmw_fb_par *par = info->par;
+	struct vmw_private *vmw_priv = par->vmw_priv;
+
+	if (vmw_priv->capabilities & SVGA_CAP_MULTIMON) {
+		vmw_write(vmw_priv, SVGA_REG_NUM_GUEST_DISPLAYS, 1);
+		vmw_write(vmw_priv, SVGA_REG_DISPLAY_ID, 0);
+		vmw_write(vmw_priv, SVGA_REG_DISPLAY_IS_PRIMARY, true);
+		vmw_write(vmw_priv, SVGA_REG_DISPLAY_POSITION_X, 0);
+		vmw_write(vmw_priv, SVGA_REG_DISPLAY_POSITION_Y, 0);
+		vmw_write(vmw_priv, SVGA_REG_DISPLAY_WIDTH, 0);
+		vmw_write(vmw_priv, SVGA_REG_DISPLAY_HEIGHT, 0);
+		vmw_write(vmw_priv, SVGA_REG_DISPLAY_ID, SVGA_ID_INVALID);
+
+		vmw_write(vmw_priv, SVGA_REG_ENABLE, 1);
+		vmw_write(vmw_priv, SVGA_REG_WIDTH, par->max_width);
+		vmw_write(vmw_priv, SVGA_REG_HEIGHT, par->max_height);
+		vmw_write(vmw_priv, SVGA_REG_BITS_PER_PIXEL, par->bpp);
+		vmw_write(vmw_priv, SVGA_REG_DEPTH, par->depth);
+		vmw_write(vmw_priv, SVGA_REG_RED_MASK, 0x00ff0000);
+		vmw_write(vmw_priv, SVGA_REG_GREEN_MASK, 0x0000ff00);
+		vmw_write(vmw_priv, SVGA_REG_BLUE_MASK, 0x000000ff);
+
+		/* TODO check if pitch and offset changes */
+
+		vmw_write(vmw_priv, SVGA_REG_NUM_GUEST_DISPLAYS, 1);
+		vmw_write(vmw_priv, SVGA_REG_DISPLAY_ID, 0);
+		vmw_write(vmw_priv, SVGA_REG_DISPLAY_IS_PRIMARY, true);
+		vmw_write(vmw_priv, SVGA_REG_DISPLAY_POSITION_X, info->var.xoffset);
+		vmw_write(vmw_priv, SVGA_REG_DISPLAY_POSITION_Y, info->var.yoffset);
+		vmw_write(vmw_priv, SVGA_REG_DISPLAY_WIDTH, info->var.xres);
+		vmw_write(vmw_priv, SVGA_REG_DISPLAY_HEIGHT, info->var.yres);
+		vmw_write(vmw_priv, SVGA_REG_DISPLAY_ID, SVGA_ID_INVALID);
+	} else {
+		vmw_write(vmw_priv, SVGA_REG_WIDTH, info->var.xres);
+		vmw_write(vmw_priv, SVGA_REG_HEIGHT, info->var.yres);
+
+		/* TODO check if pitch and offset changes */
+	}
+
+	return 0;
+}
+
+static int vmw_fb_pan_display(struct fb_var_screeninfo *var,
+			      struct fb_info *info)
+{
+	return 0;
+}
+
+static int vmw_fb_blank(int blank, struct fb_info *info)
+{
+	return 0;
+}
+
+/*
+ * Dirty code
+ */
+
+static void vmw_fb_dirty_flush(struct vmw_fb_par *par)
+{
+	struct vmw_private *vmw_priv = par->vmw_priv;
+	struct fb_info *info = vmw_priv->fb_info;
+	int stride = (info->fix.line_length / 4);
+	int *src = (int *)info->screen_base;
+	__le32 __iomem *vram_mem = par->bo_ptr;
+	unsigned long flags;
+	unsigned x, y, w, h;
+	int i, k;
+	struct {
+		uint32_t header;
+		SVGAFifoCmdUpdate body;
+	} *cmd;
+
+	spin_lock_irqsave(&par->dirty.lock, flags);
+	if (!par->dirty.active) {
+		spin_unlock_irqrestore(&par->dirty.lock, flags);
+		return;
+	}
+	x = par->dirty.x1;
+	y = par->dirty.y1;
+	w = min(par->dirty.x2, info->var.xres) - x;
+	h = min(par->dirty.y2, info->var.yres) - y;
+	par->dirty.x1 = par->dirty.x2 = 0;
+	par->dirty.y1 = par->dirty.y2 = 0;
+	spin_unlock_irqrestore(&par->dirty.lock, flags);
+
+	for (i = y * stride; i < info->fix.smem_len / 4; i += stride) {
+		for (k = i+x; k < i+x+w && k < info->fix.smem_len / 4; k++)
+			iowrite32(src[k], vram_mem + k);
+	}
+
+#if 0
+	DRM_INFO("%s, (%u, %u) (%ux%u)\n", __func__, x, y, w, h);
+#endif
+
+	cmd = vmw_fifo_reserve(vmw_priv, sizeof(*cmd));
+	if (unlikely(cmd == NULL)) {
+		DRM_ERROR("Fifo reserve failed.\n");
+		return;
+	}
+
+	cmd->header = cpu_to_le32(SVGA_CMD_UPDATE);
+	cmd->body.x = cpu_to_le32(x);
+	cmd->body.y = cpu_to_le32(y);
+	cmd->body.width = cpu_to_le32(w);
+	cmd->body.height = cpu_to_le32(h);
+	vmw_fifo_commit(vmw_priv, sizeof(*cmd));
+}
+
+static void vmw_fb_dirty_mark(struct vmw_fb_par *par,
+			      unsigned x1, unsigned y1,
+			      unsigned width, unsigned height)
+{
+	struct fb_info *info = par->vmw_priv->fb_info;
+	unsigned long flags;
+	unsigned x2 = x1 + width;
+	unsigned y2 = y1 + height;
+
+	spin_lock_irqsave(&par->dirty.lock, flags);
+	if (par->dirty.x1 == par->dirty.x2) {
+		par->dirty.x1 = x1;
+		par->dirty.y1 = y1;
+		par->dirty.x2 = x2;
+		par->dirty.y2 = y2;
+		/* if we are active start the dirty work
+		 * we share the work with the defio system */
+		if (par->dirty.active)
+			schedule_delayed_work(&info->deferred_work, VMW_DIRTY_DELAY);
+	} else {
+		if (x1 < par->dirty.x1)
+			par->dirty.x1 = x1;
+		if (y1 < par->dirty.y1)
+			par->dirty.y1 = y1;
+		if (x2 > par->dirty.x2)
+			par->dirty.x2 = x2;
+		if (y2 > par->dirty.y2)
+			par->dirty.y2 = y2;
+	}
+	spin_unlock_irqrestore(&par->dirty.lock, flags);
+}
+
+static void vmw_deferred_io(struct fb_info *info,
+			    struct list_head *pagelist)
+{
+	struct vmw_fb_par *par = info->par;
+	unsigned long start, end, min, max;
+	unsigned long flags;
+	struct page *page;
+	int y1, y2;
+
+	min = ULONG_MAX;
+	max = 0;
+	list_for_each_entry(page, pagelist, lru) {
+		start = page->index << PAGE_SHIFT;
+		end = start + PAGE_SIZE - 1;
+		min = min(min, start);
+		max = max(max, end);
+	}
+
+	if (min < max) {
+		y1 = min / info->fix.line_length;
+		y2 = (max / info->fix.line_length) + 1;
+
+		spin_lock_irqsave(&par->dirty.lock, flags);
+		par->dirty.x1 = 0;
+		par->dirty.y1 = y1;
+		par->dirty.x2 = info->var.xres;
+		par->dirty.y2 = y2;
+		spin_unlock_irqrestore(&par->dirty.lock, flags);
+	}
+
+	vmw_fb_dirty_flush(par);
+};
+
+struct fb_deferred_io vmw_defio = {
+	.delay		= VMW_DIRTY_DELAY,
+	.deferred_io	= vmw_deferred_io,
+};
+
+/*
+ * Draw code
+ */
+
+static void vmw_fb_fillrect(struct fb_info *info, const struct fb_fillrect *rect)
+{
+	cfb_fillrect(info, rect);
+	vmw_fb_dirty_mark(info->par, rect->dx, rect->dy,
+			  rect->width, rect->height);
+}
+
+static void vmw_fb_copyarea(struct fb_info *info, const struct fb_copyarea *region)
+{
+	cfb_copyarea(info, region);
+	vmw_fb_dirty_mark(info->par, region->dx, region->dy,
+			  region->width, region->height);
+}
+
+static void vmw_fb_imageblit(struct fb_info *info, const struct fb_image *image)
+{
+	cfb_imageblit(info, image);
+	vmw_fb_dirty_mark(info->par, image->dx, image->dy,
+			  image->width, image->height);
+}
+
+/*
+ * Bring up code
+ */
+
+static struct fb_ops vmw_fb_ops = {
+	.owner = THIS_MODULE,
+	.fb_check_var = vmw_fb_check_var,
+	.fb_set_par = vmw_fb_set_par,
+	.fb_setcolreg = vmw_fb_setcolreg,
+	.fb_fillrect = vmw_fb_fillrect,
+	.fb_copyarea = vmw_fb_copyarea,
+	.fb_imageblit = vmw_fb_imageblit,
+	.fb_pan_display = vmw_fb_pan_display,
+	.fb_blank = vmw_fb_blank,
+};
+
+static int vmw_fb_create_bo(struct vmw_private *vmw_priv,
+			    size_t size, struct vmw_dma_buffer **out)
+{
+	struct vmw_dma_buffer *vmw_bo;
+	struct ttm_placement ne_placement = vmw_vram_ne_placement;
+	int ret;
+
+	ne_placement.lpfn = (size + PAGE_SIZE - 1) >> PAGE_SHIFT;
+
+	/* interuptable? */
+	ret = ttm_write_lock(&vmw_priv->fbdev_master.lock, false);
+	if (unlikely(ret != 0))
+		return ret;
+
+	vmw_bo = kmalloc(sizeof(*vmw_bo), GFP_KERNEL);
+	if (!vmw_bo)
+		goto err_unlock;
+
+	ret = vmw_dmabuf_init(vmw_priv, vmw_bo, size,
+			      &ne_placement,
+			      false,
+			      &vmw_dmabuf_bo_free);
+	if (unlikely(ret != 0))
+		goto err_unlock; /* init frees the buffer on failure */
+
+	*out = vmw_bo;
+
+	ttm_write_unlock(&vmw_priv->fbdev_master.lock);
+
+	return 0;
+
+err_unlock:
+	ttm_write_unlock(&vmw_priv->fbdev_master.lock);
+	return ret;
+}
+
+int vmw_fb_init(struct vmw_private *vmw_priv)
+{
+	struct device *device = &vmw_priv->dev->pdev->dev;
+	struct vmw_fb_par *par;
+	struct fb_info *info;
+	unsigned initial_width, initial_height;
+	unsigned fb_width, fb_height;
+	unsigned fb_bbp, fb_depth, fb_offset, fb_pitch, fb_size;
+	int ret;
+
+	initial_width = 800;
+	initial_height = 600;
+
+	fb_bbp = 32;
+	fb_depth = 24;
+
+	if (vmw_priv->capabilities & SVGA_CAP_MULTIMON) {
+		fb_width = min(vmw_priv->fb_max_width, (unsigned)2048);
+		fb_height = min(vmw_priv->fb_max_height, (unsigned)2048);
+	} else {
+		fb_width = min(vmw_priv->fb_max_width, initial_width);
+		fb_height = min(vmw_priv->fb_max_height, initial_height);
+	}
+
+	initial_width = min(fb_width, initial_width);
+	initial_height = min(fb_height, initial_height);
+
+	vmw_write(vmw_priv, SVGA_REG_WIDTH, fb_width);
+	vmw_write(vmw_priv, SVGA_REG_HEIGHT, fb_height);
+	vmw_write(vmw_priv, SVGA_REG_BITS_PER_PIXEL, fb_bbp);
+	vmw_write(vmw_priv, SVGA_REG_DEPTH, fb_depth);
+	vmw_write(vmw_priv, SVGA_REG_RED_MASK, 0x00ff0000);
+	vmw_write(vmw_priv, SVGA_REG_GREEN_MASK, 0x0000ff00);
+	vmw_write(vmw_priv, SVGA_REG_BLUE_MASK, 0x000000ff);
+
+	fb_size = vmw_read(vmw_priv, SVGA_REG_FB_SIZE);
+	fb_offset = vmw_read(vmw_priv, SVGA_REG_FB_OFFSET);
+	fb_pitch = vmw_read(vmw_priv, SVGA_REG_BYTES_PER_LINE);
+
+	DRM_DEBUG("width  %u\n", vmw_read(vmw_priv, SVGA_REG_MAX_WIDTH));
+	DRM_DEBUG("height %u\n", vmw_read(vmw_priv, SVGA_REG_MAX_HEIGHT));
+	DRM_DEBUG("width  %u\n", vmw_read(vmw_priv, SVGA_REG_WIDTH));
+	DRM_DEBUG("height %u\n", vmw_read(vmw_priv, SVGA_REG_HEIGHT));
+	DRM_DEBUG("bpp    %u\n", vmw_read(vmw_priv, SVGA_REG_BITS_PER_PIXEL));
+	DRM_DEBUG("depth  %u\n", vmw_read(vmw_priv, SVGA_REG_DEPTH));
+	DRM_DEBUG("bpl    %u\n", vmw_read(vmw_priv, SVGA_REG_BYTES_PER_LINE));
+	DRM_DEBUG("r mask %08x\n", vmw_read(vmw_priv, SVGA_REG_RED_MASK));
+	DRM_DEBUG("g mask %08x\n", vmw_read(vmw_priv, SVGA_REG_GREEN_MASK));
+	DRM_DEBUG("b mask %08x\n", vmw_read(vmw_priv, SVGA_REG_BLUE_MASK));
+	DRM_DEBUG("fb_offset 0x%08x\n", fb_offset);
+	DRM_DEBUG("fb_pitch  %u\n", fb_pitch);
+	DRM_DEBUG("fb_size   %u kiB\n", fb_size / 1024);
+
+	info = framebuffer_alloc(sizeof(*par), device);
+	if (!info)
+		return -ENOMEM;
+
+	/*
+	 * Par
+	 */
+	vmw_priv->fb_info = info;
+	par = info->par;
+	par->vmw_priv = vmw_priv;
+	par->depth = fb_depth;
+	par->bpp = fb_bbp;
+	par->vmalloc = NULL;
+	par->max_width = fb_width;
+	par->max_height = fb_height;
+
+	/*
+	 * Create buffers and alloc memory
+	 */
+	par->vmalloc = vmalloc(fb_size);
+	if (unlikely(par->vmalloc == NULL)) {
+		ret = -ENOMEM;
+		goto err_free;
+	}
+
+	ret = vmw_fb_create_bo(vmw_priv, fb_size, &par->vmw_bo);
+	if (unlikely(ret != 0))
+		goto err_free;
+
+	ret = ttm_bo_kmap(&par->vmw_bo->base,
+			  0,
+			  par->vmw_bo->base.num_pages,
+			  &par->map);
+	if (unlikely(ret != 0))
+		goto err_unref;
+	par->bo_ptr = ttm_kmap_obj_virtual(&par->map, &par->bo_iowrite);
+	par->bo_size = fb_size;
+
+	/*
+	 * Fixed and var
+	 */
+	strcpy(info->fix.id, "svgadrmfb");
+	info->fix.type = FB_TYPE_PACKED_PIXELS;
+	info->fix.visual = FB_VISUAL_TRUECOLOR;
+	info->fix.type_aux = 0;
+	info->fix.xpanstep = 1; /* doing it in hw */
+	info->fix.ypanstep = 1; /* doing it in hw */
+	info->fix.ywrapstep = 0;
+	info->fix.accel = FB_ACCEL_NONE;
+	info->fix.line_length = fb_pitch;
+
+	info->fix.smem_start = 0;
+	info->fix.smem_len = fb_size;
+
+	info->fix.mmio_start = 0;
+	info->fix.mmio_len = 0;
+
+	info->pseudo_palette = par->pseudo_palette;
+	info->screen_base = par->vmalloc;
+	info->screen_size = fb_size;
+
+	info->flags = FBINFO_DEFAULT;
+	info->fbops = &vmw_fb_ops;
+
+	/* 24 depth per default */
+	info->var.red.offset = 16;
+	info->var.green.offset = 8;
+	info->var.blue.offset = 0;
+	info->var.red.length = 8;
+	info->var.green.length = 8;
+	info->var.blue.length = 8;
+	info->var.transp.offset = 0;
+	info->var.transp.length = 0;
+
+	info->var.xres_virtual = fb_width;
+	info->var.yres_virtual = fb_height;
+	info->var.bits_per_pixel = par->bpp;
+	info->var.xoffset = 0;
+	info->var.yoffset = 0;
+	info->var.activate = FB_ACTIVATE_NOW;
+	info->var.height = -1;
+	info->var.width = -1;
+
+	info->var.xres = initial_width;
+	info->var.yres = initial_height;
+
+#if 0
+	info->pixmap.size = 64*1024;
+	info->pixmap.buf_align = 8;
+	info->pixmap.access_align = 32;
+	info->pixmap.flags = FB_PIXMAP_SYSTEM;
+	info->pixmap.scan_align = 1;
+#else
+	info->pixmap.size = 0;
+	info->pixmap.buf_align = 8;
+	info->pixmap.access_align = 32;
+	info->pixmap.flags = FB_PIXMAP_SYSTEM;
+	info->pixmap.scan_align = 1;
+#endif
+
+	/*
+	 * Dirty & Deferred IO
+	 */
+	par->dirty.x1 = par->dirty.x2 = 0;
+	par->dirty.y1 = par->dirty.y1 = 0;
+	par->dirty.active = true;
+	spin_lock_init(&par->dirty.lock);
+	info->fbdefio = &vmw_defio;
+	fb_deferred_io_init(info);
+
+	ret = register_framebuffer(info);
+	if (unlikely(ret != 0))
+		goto err_defio;
+
+	return 0;
+
+err_defio:
+	fb_deferred_io_cleanup(info);
+	ttm_bo_kunmap(&par->map);
+err_unref:
+	ttm_bo_unref((struct ttm_buffer_object **)&par->vmw_bo);
+err_free:
+	vfree(par->vmalloc);
+	framebuffer_release(info);
+	vmw_priv->fb_info = NULL;
+
+	return ret;
+}
+
+int vmw_fb_close(struct vmw_private *vmw_priv)
+{
+	struct fb_info *info;
+	struct vmw_fb_par *par;
+	struct ttm_buffer_object *bo;
+
+	if (!vmw_priv->fb_info)
+		return 0;
+
+	info = vmw_priv->fb_info;
+	par = info->par;
+	bo = &par->vmw_bo->base;
+	par->vmw_bo = NULL;
+
+	/* ??? order */
+	fb_deferred_io_cleanup(info);
+	unregister_framebuffer(info);
+
+	ttm_bo_kunmap(&par->map);
+	ttm_bo_unref(&bo);
+
+	vfree(par->vmalloc);
+	framebuffer_release(info);
+
+	return 0;
+}
+
+int vmw_dmabuf_from_vram(struct vmw_private *vmw_priv,
+			 struct vmw_dma_buffer *vmw_bo)
+{
+	struct ttm_buffer_object *bo = &vmw_bo->base;
+	int ret = 0;
+
+	ret = ttm_bo_reserve(bo, false, false, false, 0);
+	if (unlikely(ret != 0))
+		return ret;
+
+	ret = ttm_bo_validate(bo, &vmw_sys_placement, false, false);
+	ttm_bo_unreserve(bo);
+
+	return ret;
+}
+
+int vmw_dmabuf_to_start_of_vram(struct vmw_private *vmw_priv,
+				struct vmw_dma_buffer *vmw_bo)
+{
+	struct ttm_buffer_object *bo = &vmw_bo->base;
+	struct ttm_placement ne_placement = vmw_vram_ne_placement;
+	int ret = 0;
+
+	ne_placement.lpfn = bo->num_pages;
+
+	/* interuptable? */
+	ret = ttm_write_lock(&vmw_priv->active_master->lock, false);
+	if (unlikely(ret != 0))
+		return ret;
+
+	ret = ttm_bo_reserve(bo, false, false, false, 0);
+	if (unlikely(ret != 0))
+		goto err_unlock;
+
+	if (vmw_bo->gmr_bound) {
+		vmw_gmr_unbind(vmw_priv, vmw_bo->gmr_id);
+		spin_lock(&bo->glob->lru_lock);
+		ida_remove(&vmw_priv->gmr_ida, vmw_bo->gmr_id);
+		spin_unlock(&bo->glob->lru_lock);
+		vmw_bo->gmr_bound = NULL;
+	}
+
+	ret = ttm_bo_validate(bo, &ne_placement, false, false);
+	ttm_bo_unreserve(bo);
+err_unlock:
+	ttm_write_unlock(&vmw_priv->active_master->lock);
+
+	return ret;
+}
+
+int vmw_fb_off(struct vmw_private *vmw_priv)
+{
+	struct fb_info *info;
+	struct vmw_fb_par *par;
+	unsigned long flags;
+
+	if (!vmw_priv->fb_info)
+		return -EINVAL;
+
+	info = vmw_priv->fb_info;
+	par = info->par;
+
+	spin_lock_irqsave(&par->dirty.lock, flags);
+	par->dirty.active = false;
+	spin_unlock_irqrestore(&par->dirty.lock, flags);
+
+	flush_scheduled_work();
+
+	par->bo_ptr = NULL;
+	ttm_bo_kunmap(&par->map);
+
+	vmw_dmabuf_from_vram(vmw_priv, par->vmw_bo);
+
+	return 0;
+}
+
+int vmw_fb_on(struct vmw_private *vmw_priv)
+{
+	struct fb_info *info;
+	struct vmw_fb_par *par;
+	unsigned long flags;
+	bool dummy;
+	int ret;
+
+	if (!vmw_priv->fb_info)
+		return -EINVAL;
+
+	info = vmw_priv->fb_info;
+	par = info->par;
+
+	/* we are already active */
+	if (par->bo_ptr != NULL)
+		return 0;
+
+	/* Make sure that all overlays are stoped when we take over */
+	vmw_overlay_stop_all(vmw_priv);
+
+	ret = vmw_dmabuf_to_start_of_vram(vmw_priv, par->vmw_bo);
+	if (unlikely(ret != 0)) {
+		DRM_ERROR("could not move buffer to start of VRAM\n");
+		goto err_no_buffer;
+	}
+
+	ret = ttm_bo_kmap(&par->vmw_bo->base,
+			  0,
+			  par->vmw_bo->base.num_pages,
+			  &par->map);
+	BUG_ON(ret != 0);
+	par->bo_ptr = ttm_kmap_obj_virtual(&par->map, &dummy);
+
+	spin_lock_irqsave(&par->dirty.lock, flags);
+	par->dirty.active = true;
+	spin_unlock_irqrestore(&par->dirty.lock, flags);
+
+err_no_buffer:
+	vmw_fb_set_par(info);
+
+	vmw_fb_dirty_mark(par, 0, 0, info->var.xres, info->var.yres);
+
+	/* If there already was stuff dirty we wont
+	 * schedule a new work, so lets do it now */
+	schedule_delayed_work(&info->deferred_work, 0);
+
+	return 0;
+}
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
new file mode 100644
index 000000000000..01feb48af333
--- /dev/null
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
@@ -0,0 +1,519 @@
+/**************************************************************************
+ *
+ * Copyright © 2009 VMware, Inc., Palo Alto, CA., USA
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ **************************************************************************/
+
+#include "vmwgfx_drv.h"
+#include "drmP.h"
+#include "ttm/ttm_placement.h"
+
+int vmw_fifo_init(struct vmw_private *dev_priv, struct vmw_fifo_state *fifo)
+{
+	__le32 __iomem *fifo_mem = dev_priv->mmio_virt;
+	uint32_t max;
+	uint32_t min;
+	uint32_t dummy;
+	int ret;
+
+	fifo->static_buffer_size = VMWGFX_FIFO_STATIC_SIZE;
+	fifo->static_buffer = vmalloc(fifo->static_buffer_size);
+	if (unlikely(fifo->static_buffer == NULL))
+		return -ENOMEM;
+
+	fifo->last_buffer_size = VMWGFX_FIFO_STATIC_SIZE;
+	fifo->last_data_size = 0;
+	fifo->last_buffer_add = false;
+	fifo->last_buffer = vmalloc(fifo->last_buffer_size);
+	if (unlikely(fifo->last_buffer == NULL)) {
+		ret = -ENOMEM;
+		goto out_err;
+	}
+
+	fifo->dynamic_buffer = NULL;
+	fifo->reserved_size = 0;
+	fifo->using_bounce_buffer = false;
+
+	init_rwsem(&fifo->rwsem);
+
+	/*
+	 * Allow mapping the first page read-only to user-space.
+	 */
+
+	DRM_INFO("width %d\n", vmw_read(dev_priv, SVGA_REG_WIDTH));
+	DRM_INFO("height %d\n", vmw_read(dev_priv, SVGA_REG_HEIGHT));
+	DRM_INFO("bpp %d\n", vmw_read(dev_priv, SVGA_REG_BITS_PER_PIXEL));
+
+	mutex_lock(&dev_priv->hw_mutex);
+	dev_priv->enable_state = vmw_read(dev_priv, SVGA_REG_ENABLE);
+	dev_priv->config_done_state = vmw_read(dev_priv, SVGA_REG_CONFIG_DONE);
+	vmw_write(dev_priv, SVGA_REG_ENABLE, 1);
+
+	min = 4;
+	if (dev_priv->capabilities & SVGA_CAP_EXTENDED_FIFO)
+		min = vmw_read(dev_priv, SVGA_REG_MEM_REGS);
+	min <<= 2;
+
+	if (min < PAGE_SIZE)
+		min = PAGE_SIZE;
+
+	iowrite32(min, fifo_mem + SVGA_FIFO_MIN);
+	iowrite32(dev_priv->mmio_size, fifo_mem + SVGA_FIFO_MAX);
+	wmb();
+	iowrite32(min,  fifo_mem + SVGA_FIFO_NEXT_CMD);
+	iowrite32(min,  fifo_mem + SVGA_FIFO_STOP);
+	iowrite32(0, fifo_mem + SVGA_FIFO_BUSY);
+	mb();
+
+	vmw_write(dev_priv, SVGA_REG_CONFIG_DONE, 1);
+	mutex_unlock(&dev_priv->hw_mutex);
+
+	max = ioread32(fifo_mem + SVGA_FIFO_MAX);
+	min = ioread32(fifo_mem  + SVGA_FIFO_MIN);
+	fifo->capabilities = ioread32(fifo_mem + SVGA_FIFO_CAPABILITIES);
+
+	DRM_INFO("Fifo max 0x%08x min 0x%08x cap 0x%08x\n",
+		 (unsigned int) max,
+		 (unsigned int) min,
+		 (unsigned int) fifo->capabilities);
+
+	dev_priv->fence_seq = (uint32_t) -100;
+	dev_priv->last_read_sequence = (uint32_t) -100;
+	iowrite32(dev_priv->last_read_sequence, fifo_mem + SVGA_FIFO_FENCE);
+
+	return vmw_fifo_send_fence(dev_priv, &dummy);
+out_err:
+	vfree(fifo->static_buffer);
+	fifo->static_buffer = NULL;
+	return ret;
+}
+
+void vmw_fifo_ping_host(struct vmw_private *dev_priv, uint32_t reason)
+{
+	__le32 __iomem *fifo_mem = dev_priv->mmio_virt;
+
+	mutex_lock(&dev_priv->hw_mutex);
+
+	if (unlikely(ioread32(fifo_mem + SVGA_FIFO_BUSY) == 0)) {
+		iowrite32(1, fifo_mem + SVGA_FIFO_BUSY);
+		vmw_write(dev_priv, SVGA_REG_SYNC, reason);
+	}
+
+	mutex_unlock(&dev_priv->hw_mutex);
+}
+
+void vmw_fifo_release(struct vmw_private *dev_priv, struct vmw_fifo_state *fifo)
+{
+	__le32 __iomem *fifo_mem = dev_priv->mmio_virt;
+
+	mutex_lock(&dev_priv->hw_mutex);
+
+	while (vmw_read(dev_priv, SVGA_REG_BUSY) != 0)
+		vmw_write(dev_priv, SVGA_REG_SYNC, SVGA_SYNC_GENERIC);
+
+	dev_priv->last_read_sequence = ioread32(fifo_mem + SVGA_FIFO_FENCE);
+
+	vmw_write(dev_priv, SVGA_REG_CONFIG_DONE,
+		  dev_priv->config_done_state);
+	vmw_write(dev_priv, SVGA_REG_ENABLE,
+		  dev_priv->enable_state);
+
+	mutex_unlock(&dev_priv->hw_mutex);
+
+	if (likely(fifo->last_buffer != NULL)) {
+		vfree(fifo->last_buffer);
+		fifo->last_buffer = NULL;
+	}
+
+	if (likely(fifo->static_buffer != NULL)) {
+		vfree(fifo->static_buffer);
+		fifo->static_buffer = NULL;
+	}
+
+	if (likely(fifo->dynamic_buffer != NULL)) {
+		vfree(fifo->dynamic_buffer);
+		fifo->dynamic_buffer = NULL;
+	}
+}
+
+static bool vmw_fifo_is_full(struct vmw_private *dev_priv, uint32_t bytes)
+{
+	__le32 __iomem *fifo_mem = dev_priv->mmio_virt;
+	uint32_t max = ioread32(fifo_mem + SVGA_FIFO_MAX);
+	uint32_t next_cmd = ioread32(fifo_mem + SVGA_FIFO_NEXT_CMD);
+	uint32_t min = ioread32(fifo_mem + SVGA_FIFO_MIN);
+	uint32_t stop = ioread32(fifo_mem + SVGA_FIFO_STOP);
+
+	return ((max - next_cmd) + (stop - min) <= bytes);
+}
+
+static int vmw_fifo_wait_noirq(struct vmw_private *dev_priv,
+			       uint32_t bytes, bool interruptible,
+			       unsigned long timeout)
+{
+	int ret = 0;
+	unsigned long end_jiffies = jiffies + timeout;
+	DEFINE_WAIT(__wait);
+
+	DRM_INFO("Fifo wait noirq.\n");
+
+	for (;;) {
+		prepare_to_wait(&dev_priv->fifo_queue, &__wait,
+				(interruptible) ?
+				TASK_INTERRUPTIBLE : TASK_UNINTERRUPTIBLE);
+		if (!vmw_fifo_is_full(dev_priv, bytes))
+			break;
+		if (time_after_eq(jiffies, end_jiffies)) {
+			ret = -EBUSY;
+			DRM_ERROR("SVGA device lockup.\n");
+			break;
+		}
+		schedule_timeout(1);
+		if (interruptible && signal_pending(current)) {
+			ret = -ERESTARTSYS;
+			break;
+		}
+	}
+	finish_wait(&dev_priv->fifo_queue, &__wait);
+	wake_up_all(&dev_priv->fifo_queue);
+	DRM_INFO("Fifo noirq exit.\n");
+	return ret;
+}
+
+static int vmw_fifo_wait(struct vmw_private *dev_priv,
+			 uint32_t bytes, bool interruptible,
+			 unsigned long timeout)
+{
+	long ret = 1L;
+	unsigned long irq_flags;
+
+	if (likely(!vmw_fifo_is_full(dev_priv, bytes)))
+		return 0;
+
+	vmw_fifo_ping_host(dev_priv, SVGA_SYNC_FIFOFULL);
+	if (!(dev_priv->capabilities & SVGA_CAP_IRQMASK))
+		return vmw_fifo_wait_noirq(dev_priv, bytes,
+					   interruptible, timeout);
+
+	mutex_lock(&dev_priv->hw_mutex);
+	if (atomic_add_return(1, &dev_priv->fifo_queue_waiters) > 0) {
+		spin_lock_irqsave(&dev_priv->irq_lock, irq_flags);
+		outl(SVGA_IRQFLAG_FIFO_PROGRESS,
+		     dev_priv->io_start + VMWGFX_IRQSTATUS_PORT);
+		vmw_write(dev_priv, SVGA_REG_IRQMASK,
+			  vmw_read(dev_priv, SVGA_REG_IRQMASK) |
+			  SVGA_IRQFLAG_FIFO_PROGRESS);
+		spin_unlock_irqrestore(&dev_priv->irq_lock, irq_flags);
+	}
+	mutex_unlock(&dev_priv->hw_mutex);
+
+	if (interruptible)
+		ret = wait_event_interruptible_timeout
+		    (dev_priv->fifo_queue,
+		     !vmw_fifo_is_full(dev_priv, bytes), timeout);
+	else
+		ret = wait_event_timeout
+		    (dev_priv->fifo_queue,
+		     !vmw_fifo_is_full(dev_priv, bytes), timeout);
+
+	if (unlikely(ret == 0))
+		ret = -EBUSY;
+	else if (likely(ret > 0))
+		ret = 0;
+
+	mutex_lock(&dev_priv->hw_mutex);
+	if (atomic_dec_and_test(&dev_priv->fifo_queue_waiters)) {
+		spin_lock_irqsave(&dev_priv->irq_lock, irq_flags);
+		vmw_write(dev_priv, SVGA_REG_IRQMASK,
+			  vmw_read(dev_priv, SVGA_REG_IRQMASK) &
+			  ~SVGA_IRQFLAG_FIFO_PROGRESS);
+		spin_unlock_irqrestore(&dev_priv->irq_lock, irq_flags);
+	}
+	mutex_unlock(&dev_priv->hw_mutex);
+
+	return ret;
+}
+
+void *vmw_fifo_reserve(struct vmw_private *dev_priv, uint32_t bytes)
+{
+	struct vmw_fifo_state *fifo_state = &dev_priv->fifo;
+	__le32 __iomem *fifo_mem = dev_priv->mmio_virt;
+	uint32_t max;
+	uint32_t min;
+	uint32_t next_cmd;
+	uint32_t reserveable = fifo_state->capabilities & SVGA_FIFO_CAP_RESERVE;
+	int ret;
+
+	down_write(&fifo_state->rwsem);
+	max = ioread32(fifo_mem + SVGA_FIFO_MAX);
+	min = ioread32(fifo_mem + SVGA_FIFO_MIN);
+	next_cmd = ioread32(fifo_mem + SVGA_FIFO_NEXT_CMD);
+
+	if (unlikely(bytes >= (max - min)))
+		goto out_err;
+
+	BUG_ON(fifo_state->reserved_size != 0);
+	BUG_ON(fifo_state->dynamic_buffer != NULL);
+
+	fifo_state->reserved_size = bytes;
+
+	while (1) {
+		uint32_t stop = ioread32(fifo_mem + SVGA_FIFO_STOP);
+		bool need_bounce = false;
+		bool reserve_in_place = false;
+
+		if (next_cmd >= stop) {
+			if (likely((next_cmd + bytes < max ||
+				    (next_cmd + bytes == max && stop > min))))
+				reserve_in_place = true;
+
+			else if (vmw_fifo_is_full(dev_priv, bytes)) {
+				ret = vmw_fifo_wait(dev_priv, bytes,
+						    false, 3 * HZ);
+				if (unlikely(ret != 0))
+					goto out_err;
+			} else
+				need_bounce = true;
+
+		} else {
+
+			if (likely((next_cmd + bytes < stop)))
+				reserve_in_place = true;
+			else {
+				ret = vmw_fifo_wait(dev_priv, bytes,
+						    false, 3 * HZ);
+				if (unlikely(ret != 0))
+					goto out_err;
+			}
+		}
+
+		if (reserve_in_place) {
+			if (reserveable || bytes <= sizeof(uint32_t)) {
+				fifo_state->using_bounce_buffer = false;
+
+				if (reserveable)
+					iowrite32(bytes, fifo_mem +
+						  SVGA_FIFO_RESERVED);
+				return fifo_mem + (next_cmd >> 2);
+			} else {
+				need_bounce = true;
+			}
+		}
+
+		if (need_bounce) {
+			fifo_state->using_bounce_buffer = true;
+			if (bytes < fifo_state->static_buffer_size)
+				return fifo_state->static_buffer;
+			else {
+				fifo_state->dynamic_buffer = vmalloc(bytes);
+				return fifo_state->dynamic_buffer;
+			}
+		}
+	}
+out_err:
+	fifo_state->reserved_size = 0;
+	up_write(&fifo_state->rwsem);
+	return NULL;
+}
+
+static void vmw_fifo_res_copy(struct vmw_fifo_state *fifo_state,
+			      __le32 __iomem *fifo_mem,
+			      uint32_t next_cmd,
+			      uint32_t max, uint32_t min, uint32_t bytes)
+{
+	uint32_t chunk_size = max - next_cmd;
+	uint32_t rest;
+	uint32_t *buffer = (fifo_state->dynamic_buffer != NULL) ?
+	    fifo_state->dynamic_buffer : fifo_state->static_buffer;
+
+	if (bytes < chunk_size)
+		chunk_size = bytes;
+
+	iowrite32(bytes, fifo_mem + SVGA_FIFO_RESERVED);
+	mb();
+	memcpy_toio(fifo_mem + (next_cmd >> 2), buffer, chunk_size);
+	rest = bytes - chunk_size;
+	if (rest)
+		memcpy_toio(fifo_mem + (min >> 2), buffer + (chunk_size >> 2),
+			    rest);
+}
+
+static void vmw_fifo_slow_copy(struct vmw_fifo_state *fifo_state,
+			       __le32 __iomem *fifo_mem,
+			       uint32_t next_cmd,
+			       uint32_t max, uint32_t min, uint32_t bytes)
+{
+	uint32_t *buffer = (fifo_state->dynamic_buffer != NULL) ?
+	    fifo_state->dynamic_buffer : fifo_state->static_buffer;
+
+	while (bytes > 0) {
+		iowrite32(*buffer++, fifo_mem + (next_cmd >> 2));
+		next_cmd += sizeof(uint32_t);
+		if (unlikely(next_cmd == max))
+			next_cmd = min;
+		mb();
+		iowrite32(next_cmd, fifo_mem + SVGA_FIFO_NEXT_CMD);
+		mb();
+		bytes -= sizeof(uint32_t);
+	}
+}
+
+void vmw_fifo_commit(struct vmw_private *dev_priv, uint32_t bytes)
+{
+	struct vmw_fifo_state *fifo_state = &dev_priv->fifo;
+	__le32 __iomem *fifo_mem = dev_priv->mmio_virt;
+	uint32_t next_cmd = ioread32(fifo_mem + SVGA_FIFO_NEXT_CMD);
+	uint32_t max = ioread32(fifo_mem + SVGA_FIFO_MAX);
+	uint32_t min = ioread32(fifo_mem + SVGA_FIFO_MIN);
+	bool reserveable = fifo_state->capabilities & SVGA_FIFO_CAP_RESERVE;
+
+	BUG_ON((bytes & 3) != 0);
+	BUG_ON(bytes > fifo_state->reserved_size);
+
+	fifo_state->reserved_size = 0;
+
+	if (fifo_state->using_bounce_buffer) {
+		if (reserveable)
+			vmw_fifo_res_copy(fifo_state, fifo_mem,
+					  next_cmd, max, min, bytes);
+		else
+			vmw_fifo_slow_copy(fifo_state, fifo_mem,
+					   next_cmd, max, min, bytes);
+
+		if (fifo_state->dynamic_buffer) {
+			vfree(fifo_state->dynamic_buffer);
+			fifo_state->dynamic_buffer = NULL;
+		}
+
+	}
+
+	if (fifo_state->using_bounce_buffer || reserveable) {
+		next_cmd += bytes;
+		if (next_cmd >= max)
+			next_cmd -= max - min;
+		mb();
+		iowrite32(next_cmd, fifo_mem + SVGA_FIFO_NEXT_CMD);
+	}
+
+	if (reserveable)
+		iowrite32(0, fifo_mem + SVGA_FIFO_RESERVED);
+	mb();
+	vmw_fifo_ping_host(dev_priv, SVGA_SYNC_GENERIC);
+	up_write(&fifo_state->rwsem);
+}
+
+int vmw_fifo_send_fence(struct vmw_private *dev_priv, uint32_t *sequence)
+{
+	struct vmw_fifo_state *fifo_state = &dev_priv->fifo;
+	struct svga_fifo_cmd_fence *cmd_fence;
+	void *fm;
+	int ret = 0;
+	uint32_t bytes = sizeof(__le32) + sizeof(*cmd_fence);
+
+	fm = vmw_fifo_reserve(dev_priv, bytes);
+	if (unlikely(fm == NULL)) {
+		down_write(&fifo_state->rwsem);
+		*sequence = dev_priv->fence_seq;
+		up_write(&fifo_state->rwsem);
+		ret = -ENOMEM;
+		(void)vmw_fallback_wait(dev_priv, false, true, *sequence,
+					false, 3*HZ);
+		goto out_err;
+	}
+
+	do {
+		*sequence = dev_priv->fence_seq++;
+	} while (*sequence == 0);
+
+	if (!(fifo_state->capabilities & SVGA_FIFO_CAP_FENCE)) {
+
+		/*
+		 * Don't request hardware to send a fence. The
+		 * waiting code in vmwgfx_irq.c will emulate this.
+		 */
+
+		vmw_fifo_commit(dev_priv, 0);
+		return 0;
+	}
+
+	*(__le32 *) fm = cpu_to_le32(SVGA_CMD_FENCE);
+	cmd_fence = (struct svga_fifo_cmd_fence *)
+	    ((unsigned long)fm + sizeof(__le32));
+
+	iowrite32(*sequence, &cmd_fence->fence);
+	fifo_state->last_buffer_add = true;
+	vmw_fifo_commit(dev_priv, bytes);
+	fifo_state->last_buffer_add = false;
+
+out_err:
+	return ret;
+}
+
+/**
+ * Map the first page of the FIFO read-only to user-space.
+ */
+
+static int vmw_fifo_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
+{
+	int ret;
+	unsigned long address = (unsigned long)vmf->virtual_address;
+
+	if (address != vma->vm_start)
+		return VM_FAULT_SIGBUS;
+
+	ret = vm_insert_pfn(vma, address, vma->vm_pgoff);
+	if (likely(ret == -EBUSY || ret == 0))
+		return VM_FAULT_NOPAGE;
+	else if (ret == -ENOMEM)
+		return VM_FAULT_OOM;
+
+	return VM_FAULT_SIGBUS;
+}
+
+static struct vm_operations_struct vmw_fifo_vm_ops = {
+	.fault = vmw_fifo_vm_fault,
+	.open = NULL,
+	.close = NULL
+};
+
+int vmw_fifo_mmap(struct file *filp, struct vm_area_struct *vma)
+{
+	struct drm_file *file_priv;
+	struct vmw_private *dev_priv;
+
+	file_priv = (struct drm_file *)filp->private_data;
+	dev_priv = vmw_priv(file_priv->minor->dev);
+
+	if (vma->vm_pgoff != (dev_priv->mmio_start >> PAGE_SHIFT) ||
+	    (vma->vm_end - vma->vm_start) != PAGE_SIZE)
+		return -EINVAL;
+
+	vma->vm_flags &= ~(VM_WRITE | VM_MAYWRITE);
+	vma->vm_flags |= VM_IO | VM_PFNMAP | VM_DONTEXPAND | VM_SHARED;
+	vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
+	vma->vm_page_prot = ttm_io_prot(TTM_PL_FLAG_UNCACHED,
+					vma->vm_page_prot);
+	vma->vm_ops = &vmw_fifo_vm_ops;
+	return 0;
+}
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_gmr.c b/drivers/gpu/drm/vmwgfx/vmwgfx_gmr.c
new file mode 100644
index 000000000000..5f8908a5d7fd
--- /dev/null
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_gmr.c
@@ -0,0 +1,213 @@
+/**************************************************************************
+ *
+ * Copyright © 2009 VMware, Inc., Palo Alto, CA., USA
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ **************************************************************************/
+
+#include "vmwgfx_drv.h"
+#include "drmP.h"
+#include "ttm/ttm_bo_driver.h"
+
+/**
+ * FIXME: Adjust to the ttm lowmem / highmem storage to minimize
+ * the number of used descriptors.
+ */
+
+static int vmw_gmr_build_descriptors(struct list_head *desc_pages,
+				     struct page *pages[],
+				     unsigned long num_pages)
+{
+	struct page *page, *next;
+	struct svga_guest_mem_descriptor *page_virtual = NULL;
+	struct svga_guest_mem_descriptor *desc_virtual = NULL;
+	unsigned int desc_per_page;
+	unsigned long prev_pfn;
+	unsigned long pfn;
+	int ret;
+
+	desc_per_page = PAGE_SIZE /
+	    sizeof(struct svga_guest_mem_descriptor) - 1;
+
+	while (likely(num_pages != 0)) {
+		page = alloc_page(__GFP_HIGHMEM);
+		if (unlikely(page == NULL)) {
+			ret = -ENOMEM;
+			goto out_err;
+		}
+
+		list_add_tail(&page->lru, desc_pages);
+
+		/*
+		 * Point previous page terminating descriptor to this
+		 * page before unmapping it.
+		 */
+
+		if (likely(page_virtual != NULL)) {
+			desc_virtual->ppn = page_to_pfn(page);
+			kunmap_atomic(page_virtual, KM_USER0);
+		}
+
+		page_virtual = kmap_atomic(page, KM_USER0);
+		desc_virtual = page_virtual - 1;
+		prev_pfn = ~(0UL);
+
+		while (likely(num_pages != 0)) {
+			pfn = page_to_pfn(*pages);
+
+			if (pfn != prev_pfn + 1) {
+
+				if (desc_virtual - page_virtual ==
+				    desc_per_page - 1)
+					break;
+
+				(++desc_virtual)->ppn = cpu_to_le32(pfn);
+				desc_virtual->num_pages = cpu_to_le32(1);
+			} else {
+				uint32_t tmp =
+				    le32_to_cpu(desc_virtual->num_pages);
+				desc_virtual->num_pages = cpu_to_le32(tmp + 1);
+			}
+			prev_pfn = pfn;
+			--num_pages;
+			++pages;
+		}
+
+		(++desc_virtual)->ppn = cpu_to_le32(0);
+		desc_virtual->num_pages = cpu_to_le32(0);
+	}
+
+	if (likely(page_virtual != NULL))
+		kunmap_atomic(page_virtual, KM_USER0);
+
+	return 0;
+out_err:
+	list_for_each_entry_safe(page, next, desc_pages, lru) {
+		list_del_init(&page->lru);
+		__free_page(page);
+	}
+	return ret;
+}
+
+static inline void vmw_gmr_free_descriptors(struct list_head *desc_pages)
+{
+	struct page *page, *next;
+
+	list_for_each_entry_safe(page, next, desc_pages, lru) {
+		list_del_init(&page->lru);
+		__free_page(page);
+	}
+}
+
+static void vmw_gmr_fire_descriptors(struct vmw_private *dev_priv,
+				     int gmr_id, struct list_head *desc_pages)
+{
+	struct page *page;
+
+	if (unlikely(list_empty(desc_pages)))
+		return;
+
+	page = list_entry(desc_pages->next, struct page, lru);
+
+	mutex_lock(&dev_priv->hw_mutex);
+
+	vmw_write(dev_priv, SVGA_REG_GMR_ID, gmr_id);
+	wmb();
+	vmw_write(dev_priv, SVGA_REG_GMR_DESCRIPTOR, page_to_pfn(page));
+	mb();
+
+	mutex_unlock(&dev_priv->hw_mutex);
+
+}
+
+/**
+ * FIXME: Adjust to the ttm lowmem / highmem storage to minimize
+ * the number of used descriptors.
+ */
+
+static unsigned long vmw_gmr_count_descriptors(struct page *pages[],
+					       unsigned long num_pages)
+{
+	unsigned long prev_pfn = ~(0UL);
+	unsigned long pfn;
+	unsigned long descriptors = 0;
+
+	while (num_pages--) {
+		pfn = page_to_pfn(*pages++);
+		if (prev_pfn + 1 != pfn)
+			++descriptors;
+		prev_pfn = pfn;
+	}
+
+	return descriptors;
+}
+
+int vmw_gmr_bind(struct vmw_private *dev_priv,
+		 struct ttm_buffer_object *bo)
+{
+	struct ttm_tt *ttm = bo->ttm;
+	unsigned long descriptors;
+	int ret;
+	uint32_t id;
+	struct list_head desc_pages;
+
+	if (!(dev_priv->capabilities & SVGA_CAP_GMR))
+		return -EINVAL;
+
+	ret = ttm_tt_populate(ttm);
+	if (unlikely(ret != 0))
+		return ret;
+
+	descriptors = vmw_gmr_count_descriptors(ttm->pages, ttm->num_pages);
+	if (unlikely(descriptors > dev_priv->max_gmr_descriptors))
+		return -EINVAL;
+
+	INIT_LIST_HEAD(&desc_pages);
+	ret = vmw_gmr_build_descriptors(&desc_pages, ttm->pages,
+					ttm->num_pages);
+	if (unlikely(ret != 0))
+		return ret;
+
+	ret = vmw_gmr_id_alloc(dev_priv, &id);
+	if (unlikely(ret != 0))
+		goto out_no_id;
+
+	vmw_gmr_fire_descriptors(dev_priv, id, &desc_pages);
+	vmw_gmr_free_descriptors(&desc_pages);
+	vmw_dmabuf_set_gmr(bo, id);
+	return 0;
+
+out_no_id:
+	vmw_gmr_free_descriptors(&desc_pages);
+	return ret;
+}
+
+void vmw_gmr_unbind(struct vmw_private *dev_priv, int gmr_id)
+{
+	mutex_lock(&dev_priv->hw_mutex);
+	vmw_write(dev_priv, SVGA_REG_GMR_ID, gmr_id);
+	wmb();
+	vmw_write(dev_priv, SVGA_REG_GMR_DESCRIPTOR, 0);
+	mb();
+	mutex_unlock(&dev_priv->hw_mutex);
+}
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
new file mode 100644
index 000000000000..5fa6a4ed238a
--- /dev/null
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
@@ -0,0 +1,81 @@
+/**************************************************************************
+ *
+ * Copyright © 2009 VMware, Inc., Palo Alto, CA., USA
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ **************************************************************************/
+
+#include "vmwgfx_drv.h"
+#include "vmwgfx_drm.h"
+
+int vmw_getparam_ioctl(struct drm_device *dev, void *data,
+		       struct drm_file *file_priv)
+{
+	struct vmw_private *dev_priv = vmw_priv(dev);
+	struct drm_vmw_getparam_arg *param =
+	    (struct drm_vmw_getparam_arg *)data;
+
+	switch (param->param) {
+	case DRM_VMW_PARAM_NUM_STREAMS:
+		param->value = vmw_overlay_num_overlays(dev_priv);
+		break;
+	case DRM_VMW_PARAM_NUM_FREE_STREAMS:
+		param->value = vmw_overlay_num_free_overlays(dev_priv);
+		break;
+	case DRM_VMW_PARAM_3D:
+		param->value = dev_priv->capabilities & SVGA_CAP_3D ? 1 : 0;
+		break;
+	case DRM_VMW_PARAM_FIFO_OFFSET:
+		param->value = dev_priv->mmio_start;
+		break;
+	default:
+		DRM_ERROR("Illegal vmwgfx get param request: %d\n",
+			  param->param);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+int vmw_fifo_debug_ioctl(struct drm_device *dev, void *data,
+			 struct drm_file *file_priv)
+{
+	struct vmw_private *dev_priv = vmw_priv(dev);
+	struct vmw_fifo_state *fifo_state = &dev_priv->fifo;
+	struct drm_vmw_fifo_debug_arg *arg =
+	    (struct drm_vmw_fifo_debug_arg *)data;
+	__le32 __user *buffer = (__le32 __user *)
+	    (unsigned long)arg->debug_buffer;
+
+	if (unlikely(fifo_state->last_buffer == NULL))
+		return -EINVAL;
+
+	if (arg->debug_buffer_size < fifo_state->last_data_size) {
+		arg->used_size = arg->debug_buffer_size;
+		arg->did_not_fit = 1;
+	} else {
+		arg->used_size = fifo_state->last_data_size;
+		arg->did_not_fit = 0;
+	}
+	return copy_to_user(buffer, fifo_state->last_buffer, arg->used_size);
+}
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c b/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
new file mode 100644
index 000000000000..d40086fc8647
--- /dev/null
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
@@ -0,0 +1,293 @@
+/**************************************************************************
+ *
+ * Copyright © 2009 VMware, Inc., Palo Alto, CA., USA
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ **************************************************************************/
+
+#include "drmP.h"
+#include "vmwgfx_drv.h"
+
+#define VMW_FENCE_WRAP (1 << 24)
+
+irqreturn_t vmw_irq_handler(DRM_IRQ_ARGS)
+{
+	struct drm_device *dev = (struct drm_device *)arg;
+	struct vmw_private *dev_priv = vmw_priv(dev);
+	uint32_t status;
+
+	spin_lock(&dev_priv->irq_lock);
+	status = inl(dev_priv->io_start + VMWGFX_IRQSTATUS_PORT);
+	spin_unlock(&dev_priv->irq_lock);
+
+	if (status & SVGA_IRQFLAG_ANY_FENCE)
+		wake_up_all(&dev_priv->fence_queue);
+	if (status & SVGA_IRQFLAG_FIFO_PROGRESS)
+		wake_up_all(&dev_priv->fifo_queue);
+
+	if (likely(status)) {
+		outl(status, dev_priv->io_start + VMWGFX_IRQSTATUS_PORT);
+		return IRQ_HANDLED;
+	}
+
+	return IRQ_NONE;
+}
+
+static bool vmw_fifo_idle(struct vmw_private *dev_priv, uint32_t sequence)
+{
+	uint32_t busy;
+
+	mutex_lock(&dev_priv->hw_mutex);
+	busy = vmw_read(dev_priv, SVGA_REG_BUSY);
+	mutex_unlock(&dev_priv->hw_mutex);
+
+	return (busy == 0);
+}
+
+
+bool vmw_fence_signaled(struct vmw_private *dev_priv,
+			uint32_t sequence)
+{
+	__le32 __iomem *fifo_mem = dev_priv->mmio_virt;
+	struct vmw_fifo_state *fifo_state;
+	bool ret;
+
+	if (likely(dev_priv->last_read_sequence - sequence < VMW_FENCE_WRAP))
+		return true;
+
+	dev_priv->last_read_sequence = ioread32(fifo_mem + SVGA_FIFO_FENCE);
+	if (likely(dev_priv->last_read_sequence - sequence < VMW_FENCE_WRAP))
+		return true;
+
+	fifo_state = &dev_priv->fifo;
+	if (!(fifo_state->capabilities & SVGA_FIFO_CAP_FENCE) &&
+	    vmw_fifo_idle(dev_priv, sequence))
+		return true;
+
+	/**
+	 * Below is to signal stale fences that have wrapped.
+	 * First, block fence submission.
+	 */
+
+	down_read(&fifo_state->rwsem);
+
+	/**
+	 * Then check if the sequence is higher than what we've actually
+	 * emitted. Then the fence is stale and signaled.
+	 */
+
+	ret = ((dev_priv->fence_seq - sequence) > VMW_FENCE_WRAP);
+	up_read(&fifo_state->rwsem);
+
+	return ret;
+}
+
+int vmw_fallback_wait(struct vmw_private *dev_priv,
+		      bool lazy,
+		      bool fifo_idle,
+		      uint32_t sequence,
+		      bool interruptible,
+		      unsigned long timeout)
+{
+	struct vmw_fifo_state *fifo_state = &dev_priv->fifo;
+
+	uint32_t count = 0;
+	uint32_t signal_seq;
+	int ret;
+	unsigned long end_jiffies = jiffies + timeout;
+	bool (*wait_condition)(struct vmw_private *, uint32_t);
+	DEFINE_WAIT(__wait);
+
+	wait_condition = (fifo_idle) ? &vmw_fifo_idle :
+		&vmw_fence_signaled;
+
+	/**
+	 * Block command submission while waiting for idle.
+	 */
+
+	if (fifo_idle)
+		down_read(&fifo_state->rwsem);
+	signal_seq = dev_priv->fence_seq;
+	ret = 0;
+
+	for (;;) {
+		prepare_to_wait(&dev_priv->fence_queue, &__wait,
+				(interruptible) ?
+				TASK_INTERRUPTIBLE : TASK_UNINTERRUPTIBLE);
+		if (wait_condition(dev_priv, sequence))
+			break;
+		if (time_after_eq(jiffies, end_jiffies)) {
+			DRM_ERROR("SVGA device lockup.\n");
+			break;
+		}
+		if (lazy)
+			schedule_timeout(1);
+		else if ((++count & 0x0F) == 0) {
+			/**
+			 * FIXME: Use schedule_hr_timeout here for
+			 * newer kernels and lower CPU utilization.
+			 */
+
+			__set_current_state(TASK_RUNNING);
+			schedule();
+			__set_current_state((interruptible) ?
+					    TASK_INTERRUPTIBLE :
+					    TASK_UNINTERRUPTIBLE);
+		}
+		if (interruptible && signal_pending(current)) {
+			ret = -ERESTARTSYS;
+			break;
+		}
+	}
+	finish_wait(&dev_priv->fence_queue, &__wait);
+	if (ret == 0 && fifo_idle) {
+		__le32 __iomem *fifo_mem = dev_priv->mmio_virt;
+		iowrite32(signal_seq, fifo_mem + SVGA_FIFO_FENCE);
+	}
+	wake_up_all(&dev_priv->fence_queue);
+	if (fifo_idle)
+		up_read(&fifo_state->rwsem);
+
+	return ret;
+}
+
+int vmw_wait_fence(struct vmw_private *dev_priv,
+		   bool lazy, uint32_t sequence,
+		   bool interruptible, unsigned long timeout)
+{
+	long ret;
+	unsigned long irq_flags;
+	struct vmw_fifo_state *fifo = &dev_priv->fifo;
+
+	if (likely(dev_priv->last_read_sequence - sequence < VMW_FENCE_WRAP))
+		return 0;
+
+	if (likely(vmw_fence_signaled(dev_priv, sequence)))
+		return 0;
+
+	vmw_fifo_ping_host(dev_priv, SVGA_SYNC_GENERIC);
+
+	if (!(fifo->capabilities & SVGA_FIFO_CAP_FENCE))
+		return vmw_fallback_wait(dev_priv, lazy, true, sequence,
+					 interruptible, timeout);
+
+	if (!(dev_priv->capabilities & SVGA_CAP_IRQMASK))
+		return vmw_fallback_wait(dev_priv, lazy, false, sequence,
+					 interruptible, timeout);
+
+	mutex_lock(&dev_priv->hw_mutex);
+	if (atomic_add_return(1, &dev_priv->fence_queue_waiters) > 0) {
+		spin_lock_irqsave(&dev_priv->irq_lock, irq_flags);
+		outl(SVGA_IRQFLAG_ANY_FENCE,
+		     dev_priv->io_start + VMWGFX_IRQSTATUS_PORT);
+		vmw_write(dev_priv, SVGA_REG_IRQMASK,
+			  vmw_read(dev_priv, SVGA_REG_IRQMASK) |
+			  SVGA_IRQFLAG_ANY_FENCE);
+		spin_unlock_irqrestore(&dev_priv->irq_lock, irq_flags);
+	}
+	mutex_unlock(&dev_priv->hw_mutex);
+
+	if (interruptible)
+		ret = wait_event_interruptible_timeout
+		    (dev_priv->fence_queue,
+		     vmw_fence_signaled(dev_priv, sequence),
+		     timeout);
+	else
+		ret = wait_event_timeout
+		    (dev_priv->fence_queue,
+		     vmw_fence_signaled(dev_priv, sequence),
+		     timeout);
+
+	if (unlikely(ret == 0))
+		ret = -EBUSY;
+	else if (likely(ret > 0))
+		ret = 0;
+
+	mutex_lock(&dev_priv->hw_mutex);
+	if (atomic_dec_and_test(&dev_priv->fence_queue_waiters)) {
+		spin_lock_irqsave(&dev_priv->irq_lock, irq_flags);
+		vmw_write(dev_priv, SVGA_REG_IRQMASK,
+			  vmw_read(dev_priv, SVGA_REG_IRQMASK) &
+			  ~SVGA_IRQFLAG_ANY_FENCE);
+		spin_unlock_irqrestore(&dev_priv->irq_lock, irq_flags);
+	}
+	mutex_unlock(&dev_priv->hw_mutex);
+
+	return ret;
+}
+
+void vmw_irq_preinstall(struct drm_device *dev)
+{
+	struct vmw_private *dev_priv = vmw_priv(dev);
+	uint32_t status;
+
+	if (!(dev_priv->capabilities & SVGA_CAP_IRQMASK))
+		return;
+
+	spin_lock_init(&dev_priv->irq_lock);
+	status = inl(dev_priv->io_start + VMWGFX_IRQSTATUS_PORT);
+	outl(status, dev_priv->io_start + VMWGFX_IRQSTATUS_PORT);
+}
+
+int vmw_irq_postinstall(struct drm_device *dev)
+{
+	return 0;
+}
+
+void vmw_irq_uninstall(struct drm_device *dev)
+{
+	struct vmw_private *dev_priv = vmw_priv(dev);
+	uint32_t status;
+
+	if (!(dev_priv->capabilities & SVGA_CAP_IRQMASK))
+		return;
+
+	mutex_lock(&dev_priv->hw_mutex);
+	vmw_write(dev_priv, SVGA_REG_IRQMASK, 0);
+	mutex_unlock(&dev_priv->hw_mutex);
+
+	status = inl(dev_priv->io_start + VMWGFX_IRQSTATUS_PORT);
+	outl(status, dev_priv->io_start + VMWGFX_IRQSTATUS_PORT);
+}
+
+#define VMW_FENCE_WAIT_TIMEOUT 3*HZ;
+
+int vmw_fence_wait_ioctl(struct drm_device *dev, void *data,
+			 struct drm_file *file_priv)
+{
+	struct drm_vmw_fence_wait_arg *arg =
+	    (struct drm_vmw_fence_wait_arg *)data;
+	unsigned long timeout;
+
+	if (!arg->cookie_valid) {
+		arg->cookie_valid = 1;
+		arg->kernel_cookie = jiffies + VMW_FENCE_WAIT_TIMEOUT;
+	}
+
+	timeout = jiffies;
+	if (time_after_eq(timeout, (unsigned long)arg->kernel_cookie))
+		return -EBUSY;
+
+	timeout = (unsigned long)arg->kernel_cookie - timeout;
+	return vmw_wait_fence(vmw_priv(dev), true, arg->sequence, true, timeout);
+}
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
new file mode 100644
index 000000000000..b1af76e371c3
--- /dev/null
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -0,0 +1,872 @@
+/**************************************************************************
+ *
+ * Copyright © 2009 VMware, Inc., Palo Alto, CA., USA
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ **************************************************************************/
+
+#include "vmwgfx_kms.h"
+
+/* Might need a hrtimer here? */
+#define VMWGFX_PRESENT_RATE ((HZ / 60 > 0) ? HZ / 60 : 1)
+
+
+void vmw_display_unit_cleanup(struct vmw_display_unit *du)
+{
+	if (du->cursor_surface)
+		vmw_surface_unreference(&du->cursor_surface);
+	if (du->cursor_dmabuf)
+		vmw_dmabuf_unreference(&du->cursor_dmabuf);
+	drm_crtc_cleanup(&du->crtc);
+	drm_encoder_cleanup(&du->encoder);
+	drm_connector_cleanup(&du->connector);
+}
+
+/*
+ * Display Unit Cursor functions
+ */
+
+int vmw_cursor_update_image(struct vmw_private *dev_priv,
+			    u32 *image, u32 width, u32 height,
+			    u32 hotspotX, u32 hotspotY)
+{
+	struct {
+		u32 cmd;
+		SVGAFifoCmdDefineAlphaCursor cursor;
+	} *cmd;
+	u32 image_size = width * height * 4;
+	u32 cmd_size = sizeof(*cmd) + image_size;
+
+	if (!image)
+		return -EINVAL;
+
+	cmd = vmw_fifo_reserve(dev_priv, cmd_size);
+	if (unlikely(cmd == NULL)) {
+		DRM_ERROR("Fifo reserve failed.\n");
+		return -ENOMEM;
+	}
+
+	memset(cmd, 0, sizeof(*cmd));
+
+	memcpy(&cmd[1], image, image_size);
+
+	cmd->cmd = cpu_to_le32(SVGA_CMD_DEFINE_ALPHA_CURSOR);
+	cmd->cursor.id = cpu_to_le32(0);
+	cmd->cursor.width = cpu_to_le32(width);
+	cmd->cursor.height = cpu_to_le32(height);
+	cmd->cursor.hotspotX = cpu_to_le32(hotspotX);
+	cmd->cursor.hotspotY = cpu_to_le32(hotspotY);
+
+	vmw_fifo_commit(dev_priv, cmd_size);
+
+	return 0;
+}
+
+void vmw_cursor_update_position(struct vmw_private *dev_priv,
+				bool show, int x, int y)
+{
+	__le32 __iomem *fifo_mem = dev_priv->mmio_virt;
+	uint32_t count;
+
+	iowrite32(show ? 1 : 0, fifo_mem + SVGA_FIFO_CURSOR_ON);
+	iowrite32(x, fifo_mem + SVGA_FIFO_CURSOR_X);
+	iowrite32(y, fifo_mem + SVGA_FIFO_CURSOR_Y);
+	count = ioread32(fifo_mem + SVGA_FIFO_CURSOR_COUNT);
+	iowrite32(++count, fifo_mem + SVGA_FIFO_CURSOR_COUNT);
+}
+
+int vmw_du_crtc_cursor_set(struct drm_crtc *crtc, struct drm_file *file_priv,
+			   uint32_t handle, uint32_t width, uint32_t height)
+{
+	struct vmw_private *dev_priv = vmw_priv(crtc->dev);
+	struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
+	struct vmw_display_unit *du = vmw_crtc_to_du(crtc);
+	struct vmw_surface *surface = NULL;
+	struct vmw_dma_buffer *dmabuf = NULL;
+	int ret;
+
+	if (handle) {
+		ret = vmw_user_surface_lookup_handle(dev_priv, tfile,
+						     handle, &surface);
+		if (!ret) {
+			if (!surface->snooper.image) {
+				DRM_ERROR("surface not suitable for cursor\n");
+				return -EINVAL;
+			}
+		} else {
+			ret = vmw_user_dmabuf_lookup(tfile,
+						     handle, &dmabuf);
+			if (ret) {
+				DRM_ERROR("failed to find surface or dmabuf: %i\n", ret);
+				return -EINVAL;
+			}
+		}
+	}
+
+	/* takedown old cursor */
+	if (du->cursor_surface) {
+		du->cursor_surface->snooper.crtc = NULL;
+		vmw_surface_unreference(&du->cursor_surface);
+	}
+	if (du->cursor_dmabuf)
+		vmw_dmabuf_unreference(&du->cursor_dmabuf);
+
+	/* setup new image */
+	if (surface) {
+		/* vmw_user_surface_lookup takes one reference */
+		du->cursor_surface = surface;
+
+		du->cursor_surface->snooper.crtc = crtc;
+		du->cursor_age = du->cursor_surface->snooper.age;
+		vmw_cursor_update_image(dev_priv, surface->snooper.image,
+					64, 64, du->hotspot_x, du->hotspot_y);
+	} else if (dmabuf) {
+		struct ttm_bo_kmap_obj map;
+		unsigned long kmap_offset;
+		unsigned long kmap_num;
+		void *virtual;
+		bool dummy;
+
+		/* vmw_user_surface_lookup takes one reference */
+		du->cursor_dmabuf = dmabuf;
+
+		kmap_offset = 0;
+		kmap_num = (64*64*4) >> PAGE_SHIFT;
+
+		ret = ttm_bo_reserve(&dmabuf->base, true, false, false, 0);
+		if (unlikely(ret != 0)) {
+			DRM_ERROR("reserve failed\n");
+			return -EINVAL;
+		}
+
+		ret = ttm_bo_kmap(&dmabuf->base, kmap_offset, kmap_num, &map);
+		if (unlikely(ret != 0))
+			goto err_unreserve;
+
+		virtual = ttm_kmap_obj_virtual(&map, &dummy);
+		vmw_cursor_update_image(dev_priv, virtual, 64, 64,
+					du->hotspot_x, du->hotspot_y);
+
+		ttm_bo_kunmap(&map);
+err_unreserve:
+		ttm_bo_unreserve(&dmabuf->base);
+
+	} else {
+		vmw_cursor_update_position(dev_priv, false, 0, 0);
+		return 0;
+	}
+
+	vmw_cursor_update_position(dev_priv, true, du->cursor_x, du->cursor_y);
+
+	return 0;
+}
+
+int vmw_du_crtc_cursor_move(struct drm_crtc *crtc, int x, int y)
+{
+	struct vmw_private *dev_priv = vmw_priv(crtc->dev);
+	struct vmw_display_unit *du = vmw_crtc_to_du(crtc);
+	bool shown = du->cursor_surface || du->cursor_dmabuf ? true : false;
+
+	du->cursor_x = x + crtc->x;
+	du->cursor_y = y + crtc->y;
+
+	vmw_cursor_update_position(dev_priv, shown,
+				   du->cursor_x, du->cursor_y);
+
+	return 0;
+}
+
+void vmw_kms_cursor_snoop(struct vmw_surface *srf,
+			  struct ttm_object_file *tfile,
+			  struct ttm_buffer_object *bo,
+			  SVGA3dCmdHeader *header)
+{
+	struct ttm_bo_kmap_obj map;
+	unsigned long kmap_offset;
+	unsigned long kmap_num;
+	SVGA3dCopyBox *box;
+	unsigned box_count;
+	void *virtual;
+	bool dummy;
+	struct vmw_dma_cmd {
+		SVGA3dCmdHeader header;
+		SVGA3dCmdSurfaceDMA dma;
+	} *cmd;
+	int ret;
+
+	cmd = container_of(header, struct vmw_dma_cmd, header);
+
+	/* No snooper installed */
+	if (!srf->snooper.image)
+		return;
+
+	if (cmd->dma.host.face != 0 || cmd->dma.host.mipmap != 0) {
+		DRM_ERROR("face and mipmap for cursors should never != 0\n");
+		return;
+	}
+
+	if (cmd->header.size < 64) {
+		DRM_ERROR("at least one full copy box must be given\n");
+		return;
+	}
+
+	box = (SVGA3dCopyBox *)&cmd[1];
+	box_count = (cmd->header.size - sizeof(SVGA3dCmdSurfaceDMA)) /
+			sizeof(SVGA3dCopyBox);
+
+	if (cmd->dma.guest.pitch != (64 * 4) ||
+	    cmd->dma.guest.ptr.offset % PAGE_SIZE ||
+	    box->x != 0    || box->y != 0    || box->z != 0    ||
+	    box->srcx != 0 || box->srcy != 0 || box->srcz != 0 ||
+	    box->w != 64   || box->h != 64   || box->d != 1    ||
+	    box_count != 1) {
+		/* TODO handle none page aligned offsets */
+		/* TODO handle partial uploads and pitch != 256 */
+		/* TODO handle more then one copy (size != 64) */
+		DRM_ERROR("lazy programer, cant handle wierd stuff\n");
+		return;
+	}
+
+	kmap_offset = cmd->dma.guest.ptr.offset >> PAGE_SHIFT;
+	kmap_num = (64*64*4) >> PAGE_SHIFT;
+
+	ret = ttm_bo_reserve(bo, true, false, false, 0);
+	if (unlikely(ret != 0)) {
+		DRM_ERROR("reserve failed\n");
+		return;
+	}
+
+	ret = ttm_bo_kmap(bo, kmap_offset, kmap_num, &map);
+	if (unlikely(ret != 0))
+		goto err_unreserve;
+
+	virtual = ttm_kmap_obj_virtual(&map, &dummy);
+
+	memcpy(srf->snooper.image, virtual, 64*64*4);
+	srf->snooper.age++;
+
+	/* we can't call this function from this function since execbuf has
+	 * reserved fifo space.
+	 *
+	 * if (srf->snooper.crtc)
+	 *	vmw_ldu_crtc_cursor_update_image(dev_priv,
+	 *					 srf->snooper.image, 64, 64,
+	 *					 du->hotspot_x, du->hotspot_y);
+	 */
+
+	ttm_bo_kunmap(&map);
+err_unreserve:
+	ttm_bo_unreserve(bo);
+}
+
+void vmw_kms_cursor_post_execbuf(struct vmw_private *dev_priv)
+{
+	struct drm_device *dev = dev_priv->dev;
+	struct vmw_display_unit *du;
+	struct drm_crtc *crtc;
+
+	mutex_lock(&dev->mode_config.mutex);
+
+	list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
+		du = vmw_crtc_to_du(crtc);
+		if (!du->cursor_surface ||
+		    du->cursor_age == du->cursor_surface->snooper.age)
+			continue;
+
+		du->cursor_age = du->cursor_surface->snooper.age;
+		vmw_cursor_update_image(dev_priv,
+					du->cursor_surface->snooper.image,
+					64, 64, du->hotspot_x, du->hotspot_y);
+	}
+
+	mutex_unlock(&dev->mode_config.mutex);
+}
+
+/*
+ * Generic framebuffer code
+ */
+
+int vmw_framebuffer_create_handle(struct drm_framebuffer *fb,
+				  struct drm_file *file_priv,
+				  unsigned int *handle)
+{
+	if (handle)
+		handle = 0;
+
+	return 0;
+}
+
+/*
+ * Surface framebuffer code
+ */
+
+#define vmw_framebuffer_to_vfbs(x) \
+	container_of(x, struct vmw_framebuffer_surface, base.base)
+
+struct vmw_framebuffer_surface {
+	struct vmw_framebuffer base;
+	struct vmw_surface *surface;
+	struct delayed_work d_work;
+	struct mutex work_lock;
+	bool present_fs;
+};
+
+void vmw_framebuffer_surface_destroy(struct drm_framebuffer *framebuffer)
+{
+	struct vmw_framebuffer_surface *vfb =
+		vmw_framebuffer_to_vfbs(framebuffer);
+
+	cancel_delayed_work_sync(&vfb->d_work);
+	drm_framebuffer_cleanup(framebuffer);
+	vmw_surface_unreference(&vfb->surface);
+
+	kfree(framebuffer);
+}
+
+static void vmw_framebuffer_present_fs_callback(struct work_struct *work)
+{
+	struct delayed_work *d_work =
+		container_of(work, struct delayed_work, work);
+	struct vmw_framebuffer_surface *vfbs =
+		container_of(d_work, struct vmw_framebuffer_surface, d_work);
+	struct vmw_surface *surf = vfbs->surface;
+	struct drm_framebuffer *framebuffer = &vfbs->base.base;
+	struct vmw_private *dev_priv = vmw_priv(framebuffer->dev);
+
+	struct {
+		SVGA3dCmdHeader header;
+		SVGA3dCmdPresent body;
+		SVGA3dCopyRect cr;
+	} *cmd;
+
+	mutex_lock(&vfbs->work_lock);
+	if (!vfbs->present_fs)
+		goto out_unlock;
+
+	cmd = vmw_fifo_reserve(dev_priv, sizeof(*cmd));
+	if (unlikely(cmd == NULL))
+		goto out_resched;
+
+	cmd->header.id = cpu_to_le32(SVGA_3D_CMD_PRESENT);
+	cmd->header.size = cpu_to_le32(sizeof(cmd->body) + sizeof(cmd->cr));
+	cmd->body.sid = cpu_to_le32(surf->res.id);
+	cmd->cr.x = cpu_to_le32(0);
+	cmd->cr.y = cpu_to_le32(0);
+	cmd->cr.srcx = cmd->cr.x;
+	cmd->cr.srcy = cmd->cr.y;
+	cmd->cr.w = cpu_to_le32(framebuffer->width);
+	cmd->cr.h = cpu_to_le32(framebuffer->height);
+	vfbs->present_fs = false;
+	vmw_fifo_commit(dev_priv, sizeof(*cmd));
+out_resched:
+	/**
+	 * Will not re-add if already pending.
+	 */
+	schedule_delayed_work(&vfbs->d_work, VMWGFX_PRESENT_RATE);
+out_unlock:
+	mutex_unlock(&vfbs->work_lock);
+}
+
+
+int vmw_framebuffer_surface_dirty(struct drm_framebuffer *framebuffer,
+				  unsigned flags, unsigned color,
+				  struct drm_clip_rect *clips,
+				  unsigned num_clips)
+{
+	struct vmw_private *dev_priv = vmw_priv(framebuffer->dev);
+	struct vmw_framebuffer_surface *vfbs =
+		vmw_framebuffer_to_vfbs(framebuffer);
+	struct vmw_surface *surf = vfbs->surface;
+	struct drm_clip_rect norect;
+	SVGA3dCopyRect *cr;
+	int i, inc = 1;
+
+	struct {
+		SVGA3dCmdHeader header;
+		SVGA3dCmdPresent body;
+		SVGA3dCopyRect cr;
+	} *cmd;
+
+	if (!num_clips ||
+	    !(dev_priv->fifo.capabilities &
+	      SVGA_FIFO_CAP_SCREEN_OBJECT)) {
+		int ret;
+
+		mutex_lock(&vfbs->work_lock);
+		vfbs->present_fs = true;
+		ret = schedule_delayed_work(&vfbs->d_work, VMWGFX_PRESENT_RATE);
+		mutex_unlock(&vfbs->work_lock);
+		if (ret) {
+			/**
+			 * No work pending, Force immediate present.
+			 */
+			vmw_framebuffer_present_fs_callback(&vfbs->d_work.work);
+		}
+		return 0;
+	}
+
+	if (!num_clips) {
+		num_clips = 1;
+		clips = &norect;
+		norect.x1 = norect.y1 = 0;
+		norect.x2 = framebuffer->width;
+		norect.y2 = framebuffer->height;
+	} else if (flags & DRM_MODE_FB_DIRTY_ANNOTATE_COPY) {
+		num_clips /= 2;
+		inc = 2; /* skip source rects */
+	}
+
+	cmd = vmw_fifo_reserve(dev_priv, sizeof(*cmd) + (num_clips - 1) * sizeof(cmd->cr));
+	if (unlikely(cmd == NULL)) {
+		DRM_ERROR("Fifo reserve failed.\n");
+		return -ENOMEM;
+	}
+
+	memset(cmd, 0, sizeof(*cmd));
+
+	cmd->header.id = cpu_to_le32(SVGA_3D_CMD_PRESENT);
+	cmd->header.size = cpu_to_le32(sizeof(cmd->body) + num_clips * sizeof(cmd->cr));
+	cmd->body.sid = cpu_to_le32(surf->res.id);
+
+	for (i = 0, cr = &cmd->cr; i < num_clips; i++, cr++, clips += inc) {
+		cr->x = cpu_to_le16(clips->x1);
+		cr->y = cpu_to_le16(clips->y1);
+		cr->srcx = cr->x;
+		cr->srcy = cr->y;
+		cr->w = cpu_to_le16(clips->x2 - clips->x1);
+		cr->h = cpu_to_le16(clips->y2 - clips->y1);
+	}
+
+	vmw_fifo_commit(dev_priv, sizeof(*cmd) + (num_clips - 1) * sizeof(cmd->cr));
+
+	return 0;
+}
+
+static struct drm_framebuffer_funcs vmw_framebuffer_surface_funcs = {
+	.destroy = vmw_framebuffer_surface_destroy,
+	.dirty = vmw_framebuffer_surface_dirty,
+	.create_handle = vmw_framebuffer_create_handle,
+};
+
+int vmw_kms_new_framebuffer_surface(struct vmw_private *dev_priv,
+				    struct vmw_surface *surface,
+				    struct vmw_framebuffer **out,
+				    unsigned width, unsigned height)
+
+{
+	struct drm_device *dev = dev_priv->dev;
+	struct vmw_framebuffer_surface *vfbs;
+	int ret;
+
+	vfbs = kzalloc(sizeof(*vfbs), GFP_KERNEL);
+	if (!vfbs) {
+		ret = -ENOMEM;
+		goto out_err1;
+	}
+
+	ret = drm_framebuffer_init(dev, &vfbs->base.base,
+				   &vmw_framebuffer_surface_funcs);
+	if (ret)
+		goto out_err2;
+
+	if (!vmw_surface_reference(surface)) {
+		DRM_ERROR("failed to reference surface %p\n", surface);
+		goto out_err3;
+	}
+
+	/* XXX get the first 3 from the surface info */
+	vfbs->base.base.bits_per_pixel = 32;
+	vfbs->base.base.pitch = width * 32 / 4;
+	vfbs->base.base.depth = 24;
+	vfbs->base.base.width = width;
+	vfbs->base.base.height = height;
+	vfbs->base.pin = NULL;
+	vfbs->base.unpin = NULL;
+	vfbs->surface = surface;
+	mutex_init(&vfbs->work_lock);
+	INIT_DELAYED_WORK(&vfbs->d_work, &vmw_framebuffer_present_fs_callback);
+	*out = &vfbs->base;
+
+	return 0;
+
+out_err3:
+	drm_framebuffer_cleanup(&vfbs->base.base);
+out_err2:
+	kfree(vfbs);
+out_err1:
+	return ret;
+}
+
+/*
+ * Dmabuf framebuffer code
+ */
+
+#define vmw_framebuffer_to_vfbd(x) \
+	container_of(x, struct vmw_framebuffer_dmabuf, base.base)
+
+struct vmw_framebuffer_dmabuf {
+	struct vmw_framebuffer base;
+	struct vmw_dma_buffer *buffer;
+};
+
+void vmw_framebuffer_dmabuf_destroy(struct drm_framebuffer *framebuffer)
+{
+	struct vmw_framebuffer_dmabuf *vfbd =
+		vmw_framebuffer_to_vfbd(framebuffer);
+
+	drm_framebuffer_cleanup(framebuffer);
+	vmw_dmabuf_unreference(&vfbd->buffer);
+
+	kfree(vfbd);
+}
+
+int vmw_framebuffer_dmabuf_dirty(struct drm_framebuffer *framebuffer,
+				 unsigned flags, unsigned color,
+				 struct drm_clip_rect *clips,
+				 unsigned num_clips)
+{
+	struct vmw_private *dev_priv = vmw_priv(framebuffer->dev);
+	struct drm_clip_rect norect;
+	struct {
+		uint32_t header;
+		SVGAFifoCmdUpdate body;
+	} *cmd;
+	int i, increment = 1;
+
+	if (!num_clips ||
+	    !(dev_priv->fifo.capabilities &
+	      SVGA_FIFO_CAP_SCREEN_OBJECT)) {
+		num_clips = 1;
+		clips = &norect;
+		norect.x1 = norect.y1 = 0;
+		norect.x2 = framebuffer->width;
+		norect.y2 = framebuffer->height;
+	} else if (flags & DRM_MODE_FB_DIRTY_ANNOTATE_COPY) {
+		num_clips /= 2;
+		increment = 2;
+	}
+
+	cmd = vmw_fifo_reserve(dev_priv, sizeof(*cmd) * num_clips);
+	if (unlikely(cmd == NULL)) {
+		DRM_ERROR("Fifo reserve failed.\n");
+		return -ENOMEM;
+	}
+
+	for (i = 0; i < num_clips; i++, clips += increment) {
+		cmd[i].header = cpu_to_le32(SVGA_CMD_UPDATE);
+		cmd[i].body.x = cpu_to_le32(clips[i].x1);
+		cmd[i].body.y = cpu_to_le32(clips[i].y1);
+		cmd[i].body.width = cpu_to_le32(clips[i].x2 - clips[i].x1);
+		cmd[i].body.height = cpu_to_le32(clips[i].y2 - clips[i].y1);
+	}
+
+	vmw_fifo_commit(dev_priv, sizeof(*cmd) * num_clips);
+
+	return 0;
+}
+
+static struct drm_framebuffer_funcs vmw_framebuffer_dmabuf_funcs = {
+	.destroy = vmw_framebuffer_dmabuf_destroy,
+	.dirty = vmw_framebuffer_dmabuf_dirty,
+	.create_handle = vmw_framebuffer_create_handle,
+};
+
+static int vmw_framebuffer_dmabuf_pin(struct vmw_framebuffer *vfb)
+{
+	struct vmw_private *dev_priv = vmw_priv(vfb->base.dev);
+	struct vmw_framebuffer_dmabuf *vfbd =
+		vmw_framebuffer_to_vfbd(&vfb->base);
+	int ret;
+
+	vmw_overlay_pause_all(dev_priv);
+
+	ret = vmw_dmabuf_to_start_of_vram(dev_priv, vfbd->buffer);
+
+	if (dev_priv->capabilities & SVGA_CAP_MULTIMON) {
+		vmw_write(dev_priv, SVGA_REG_NUM_GUEST_DISPLAYS, 1);
+		vmw_write(dev_priv, SVGA_REG_DISPLAY_ID, 0);
+		vmw_write(dev_priv, SVGA_REG_DISPLAY_IS_PRIMARY, true);
+		vmw_write(dev_priv, SVGA_REG_DISPLAY_POSITION_X, 0);
+		vmw_write(dev_priv, SVGA_REG_DISPLAY_POSITION_Y, 0);
+		vmw_write(dev_priv, SVGA_REG_DISPLAY_WIDTH, 0);
+		vmw_write(dev_priv, SVGA_REG_DISPLAY_HEIGHT, 0);
+		vmw_write(dev_priv, SVGA_REG_DISPLAY_ID, SVGA_ID_INVALID);
+
+		vmw_write(dev_priv, SVGA_REG_ENABLE, 1);
+		vmw_write(dev_priv, SVGA_REG_WIDTH, vfb->base.width);
+		vmw_write(dev_priv, SVGA_REG_HEIGHT, vfb->base.height);
+		vmw_write(dev_priv, SVGA_REG_BITS_PER_PIXEL, vfb->base.bits_per_pixel);
+		vmw_write(dev_priv, SVGA_REG_DEPTH, vfb->base.depth);
+		vmw_write(dev_priv, SVGA_REG_RED_MASK, 0x00ff0000);
+		vmw_write(dev_priv, SVGA_REG_GREEN_MASK, 0x0000ff00);
+		vmw_write(dev_priv, SVGA_REG_BLUE_MASK, 0x000000ff);
+	} else
+		WARN_ON(true);
+
+	vmw_overlay_resume_all(dev_priv);
+
+	return 0;
+}
+
+static int vmw_framebuffer_dmabuf_unpin(struct vmw_framebuffer *vfb)
+{
+	struct vmw_private *dev_priv = vmw_priv(vfb->base.dev);
+	struct vmw_framebuffer_dmabuf *vfbd =
+		vmw_framebuffer_to_vfbd(&vfb->base);
+
+	if (!vfbd->buffer) {
+		WARN_ON(!vfbd->buffer);
+		return 0;
+	}
+
+	return vmw_dmabuf_from_vram(dev_priv, vfbd->buffer);
+}
+
+int vmw_kms_new_framebuffer_dmabuf(struct vmw_private *dev_priv,
+				   struct vmw_dma_buffer *dmabuf,
+				   struct vmw_framebuffer **out,
+				   unsigned width, unsigned height)
+
+{
+	struct drm_device *dev = dev_priv->dev;
+	struct vmw_framebuffer_dmabuf *vfbd;
+	int ret;
+
+	vfbd = kzalloc(sizeof(*vfbd), GFP_KERNEL);
+	if (!vfbd) {
+		ret = -ENOMEM;
+		goto out_err1;
+	}
+
+	ret = drm_framebuffer_init(dev, &vfbd->base.base,
+				   &vmw_framebuffer_dmabuf_funcs);
+	if (ret)
+		goto out_err2;
+
+	if (!vmw_dmabuf_reference(dmabuf)) {
+		DRM_ERROR("failed to reference dmabuf %p\n", dmabuf);
+		goto out_err3;
+	}
+
+	/* XXX get the first 3 from the surface info */
+	vfbd->base.base.bits_per_pixel = 32;
+	vfbd->base.base.pitch = width * 32 / 4;
+	vfbd->base.base.depth = 24;
+	vfbd->base.base.width = width;
+	vfbd->base.base.height = height;
+	vfbd->base.pin = vmw_framebuffer_dmabuf_pin;
+	vfbd->base.unpin = vmw_framebuffer_dmabuf_unpin;
+	vfbd->buffer = dmabuf;
+	*out = &vfbd->base;
+
+	return 0;
+
+out_err3:
+	drm_framebuffer_cleanup(&vfbd->base.base);
+out_err2:
+	kfree(vfbd);
+out_err1:
+	return ret;
+}
+
+/*
+ * Generic Kernel modesetting functions
+ */
+
+static struct drm_framebuffer *vmw_kms_fb_create(struct drm_device *dev,
+						 struct drm_file *file_priv,
+						 struct drm_mode_fb_cmd *mode_cmd)
+{
+	struct vmw_private *dev_priv = vmw_priv(dev);
+	struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
+	struct vmw_framebuffer *vfb = NULL;
+	struct vmw_surface *surface = NULL;
+	struct vmw_dma_buffer *bo = NULL;
+	int ret;
+
+	ret = vmw_user_surface_lookup_handle(dev_priv, tfile,
+					     mode_cmd->handle, &surface);
+	if (ret)
+		goto try_dmabuf;
+
+	ret = vmw_kms_new_framebuffer_surface(dev_priv, surface, &vfb,
+					      mode_cmd->width, mode_cmd->height);
+
+	/* vmw_user_surface_lookup takes one ref so does new_fb */
+	vmw_surface_unreference(&surface);
+
+	if (ret) {
+		DRM_ERROR("failed to create vmw_framebuffer: %i\n", ret);
+		return NULL;
+	}
+	return &vfb->base;
+
+try_dmabuf:
+	DRM_INFO("%s: trying buffer\n", __func__);
+
+	ret = vmw_user_dmabuf_lookup(tfile, mode_cmd->handle, &bo);
+	if (ret) {
+		DRM_ERROR("failed to find buffer: %i\n", ret);
+		return NULL;
+	}
+
+	ret = vmw_kms_new_framebuffer_dmabuf(dev_priv, bo, &vfb,
+					     mode_cmd->width, mode_cmd->height);
+
+	/* vmw_user_dmabuf_lookup takes one ref so does new_fb */
+	vmw_dmabuf_unreference(&bo);
+
+	if (ret) {
+		DRM_ERROR("failed to create vmw_framebuffer: %i\n", ret);
+		return NULL;
+	}
+
+	return &vfb->base;
+}
+
+static int vmw_kms_fb_changed(struct drm_device *dev)
+{
+	return 0;
+}
+
+static struct drm_mode_config_funcs vmw_kms_funcs = {
+	.fb_create = vmw_kms_fb_create,
+	.fb_changed = vmw_kms_fb_changed,
+};
+
+int vmw_kms_init(struct vmw_private *dev_priv)
+{
+	struct drm_device *dev = dev_priv->dev;
+	int ret;
+
+	drm_mode_config_init(dev);
+	dev->mode_config.funcs = &vmw_kms_funcs;
+	dev->mode_config.min_width = 640;
+	dev->mode_config.min_height = 480;
+	dev->mode_config.max_width = 2048;
+	dev->mode_config.max_height = 2048;
+
+	ret = vmw_kms_init_legacy_display_system(dev_priv);
+
+	return 0;
+}
+
+int vmw_kms_close(struct vmw_private *dev_priv)
+{
+	/*
+	 * Docs says we should take the lock before calling this function
+	 * but since it destroys encoders and our destructor calls
+	 * drm_encoder_cleanup which takes the lock we deadlock.
+	 */
+	drm_mode_config_cleanup(dev_priv->dev);
+	vmw_kms_close_legacy_display_system(dev_priv);
+	return 0;
+}
+
+int vmw_kms_cursor_bypass_ioctl(struct drm_device *dev, void *data,
+				struct drm_file *file_priv)
+{
+	struct drm_vmw_cursor_bypass_arg *arg = data;
+	struct vmw_display_unit *du;
+	struct drm_mode_object *obj;
+	struct drm_crtc *crtc;
+	int ret = 0;
+
+
+	mutex_lock(&dev->mode_config.mutex);
+	if (arg->flags & DRM_VMW_CURSOR_BYPASS_ALL) {
+
+		list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
+			du = vmw_crtc_to_du(crtc);
+			du->hotspot_x = arg->xhot;
+			du->hotspot_y = arg->yhot;
+		}
+
+		mutex_unlock(&dev->mode_config.mutex);
+		return 0;
+	}
+
+	obj = drm_mode_object_find(dev, arg->crtc_id, DRM_MODE_OBJECT_CRTC);
+	if (!obj) {
+		ret = -EINVAL;
+		goto out;
+	}
+
+	crtc = obj_to_crtc(obj);
+	du = vmw_crtc_to_du(crtc);
+
+	du->hotspot_x = arg->xhot;
+	du->hotspot_y = arg->yhot;
+
+out:
+	mutex_unlock(&dev->mode_config.mutex);
+
+	return ret;
+}
+
+int vmw_kms_save_vga(struct vmw_private *vmw_priv)
+{
+	/*
+	 * setup a single multimon monitor with the size
+	 * of 0x0, this stops the UI from resizing when we
+	 * change the framebuffer size
+	 */
+	if (vmw_priv->capabilities & SVGA_CAP_MULTIMON) {
+		vmw_write(vmw_priv, SVGA_REG_NUM_GUEST_DISPLAYS, 1);
+		vmw_write(vmw_priv, SVGA_REG_DISPLAY_ID, 0);
+		vmw_write(vmw_priv, SVGA_REG_DISPLAY_IS_PRIMARY, true);
+		vmw_write(vmw_priv, SVGA_REG_DISPLAY_POSITION_X, 0);
+		vmw_write(vmw_priv, SVGA_REG_DISPLAY_POSITION_Y, 0);
+		vmw_write(vmw_priv, SVGA_REG_DISPLAY_WIDTH, 0);
+		vmw_write(vmw_priv, SVGA_REG_DISPLAY_HEIGHT, 0);
+		vmw_write(vmw_priv, SVGA_REG_DISPLAY_ID, SVGA_ID_INVALID);
+	}
+
+	vmw_priv->vga_width = vmw_read(vmw_priv, SVGA_REG_WIDTH);
+	vmw_priv->vga_height = vmw_read(vmw_priv, SVGA_REG_HEIGHT);
+	vmw_priv->vga_bpp = vmw_read(vmw_priv, SVGA_REG_BITS_PER_PIXEL);
+	vmw_priv->vga_depth = vmw_read(vmw_priv, SVGA_REG_DEPTH);
+	vmw_priv->vga_pseudo = vmw_read(vmw_priv, SVGA_REG_PSEUDOCOLOR);
+	vmw_priv->vga_red_mask = vmw_read(vmw_priv, SVGA_REG_RED_MASK);
+	vmw_priv->vga_green_mask = vmw_read(vmw_priv, SVGA_REG_GREEN_MASK);
+	vmw_priv->vga_blue_mask = vmw_read(vmw_priv, SVGA_REG_BLUE_MASK);
+
+	return 0;
+}
+
+int vmw_kms_restore_vga(struct vmw_private *vmw_priv)
+{
+	vmw_write(vmw_priv, SVGA_REG_WIDTH, vmw_priv->vga_width);
+	vmw_write(vmw_priv, SVGA_REG_HEIGHT, vmw_priv->vga_height);
+	vmw_write(vmw_priv, SVGA_REG_BITS_PER_PIXEL, vmw_priv->vga_bpp);
+	vmw_write(vmw_priv, SVGA_REG_DEPTH, vmw_priv->vga_depth);
+	vmw_write(vmw_priv, SVGA_REG_PSEUDOCOLOR, vmw_priv->vga_pseudo);
+	vmw_write(vmw_priv, SVGA_REG_RED_MASK, vmw_priv->vga_red_mask);
+	vmw_write(vmw_priv, SVGA_REG_GREEN_MASK, vmw_priv->vga_green_mask);
+	vmw_write(vmw_priv, SVGA_REG_BLUE_MASK, vmw_priv->vga_blue_mask);
+
+	/* TODO check for multimon */
+	vmw_write(vmw_priv, SVGA_REG_NUM_GUEST_DISPLAYS, 0);
+
+	return 0;
+}
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h
new file mode 100644
index 000000000000..8b95249f0531
--- /dev/null
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h
@@ -0,0 +1,102 @@
+/**************************************************************************
+ *
+ * Copyright © 2009 VMware, Inc., Palo Alto, CA., USA
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ **************************************************************************/
+
+#ifndef VMWGFX_KMS_H_
+#define VMWGFX_KMS_H_
+
+#include "drmP.h"
+#include "vmwgfx_drv.h"
+
+
+#define vmw_framebuffer_to_vfb(x) \
+	container_of(x, struct vmw_framebuffer, base)
+
+/**
+ * Base class for framebuffers
+ *
+ * @pin is called the when ever a crtc uses this framebuffer
+ * @unpin is called
+ */
+struct vmw_framebuffer {
+	struct drm_framebuffer base;
+	int (*pin)(struct vmw_framebuffer *fb);
+	int (*unpin)(struct vmw_framebuffer *fb);
+};
+
+
+#define vmw_crtc_to_du(x) \
+	container_of(x, struct vmw_display_unit, crtc)
+
+/*
+ * Basic cursor manipulation
+ */
+int vmw_cursor_update_image(struct vmw_private *dev_priv,
+			    u32 *image, u32 width, u32 height,
+			    u32 hotspotX, u32 hotspotY);
+void vmw_cursor_update_position(struct vmw_private *dev_priv,
+				bool show, int x, int y);
+
+/**
+ * Base class display unit.
+ *
+ * Since the SVGA hw doesn't have a concept of a crtc, encoder or connector
+ * so the display unit is all of them at the same time. This is true for both
+ * legacy multimon and screen objects.
+ */
+struct vmw_display_unit {
+	struct drm_crtc crtc;
+	struct drm_encoder encoder;
+	struct drm_connector connector;
+
+	struct vmw_surface *cursor_surface;
+	struct vmw_dma_buffer *cursor_dmabuf;
+	size_t cursor_age;
+
+	int cursor_x;
+	int cursor_y;
+
+	int hotspot_x;
+	int hotspot_y;
+
+	unsigned unit;
+};
+
+/*
+ * Shared display unit functions - vmwgfx_kms.c
+ */
+void vmw_display_unit_cleanup(struct vmw_display_unit *du);
+int vmw_du_crtc_cursor_set(struct drm_crtc *crtc, struct drm_file *file_priv,
+			   uint32_t handle, uint32_t width, uint32_t height);
+int vmw_du_crtc_cursor_move(struct drm_crtc *crtc, int x, int y);
+
+/*
+ * Legacy display unit functions - vmwgfx_ldu.h
+ */
+int vmw_kms_init_legacy_display_system(struct vmw_private *dev_priv);
+int vmw_kms_close_legacy_display_system(struct vmw_private *dev_priv);
+
+#endif
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
new file mode 100644
index 000000000000..90891593bf6c
--- /dev/null
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
@@ -0,0 +1,516 @@
+/**************************************************************************
+ *
+ * Copyright © 2009 VMware, Inc., Palo Alto, CA., USA
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ **************************************************************************/
+
+#include "vmwgfx_kms.h"
+
+#define vmw_crtc_to_ldu(x) \
+	container_of(x, struct vmw_legacy_display_unit, base.crtc)
+#define vmw_encoder_to_ldu(x) \
+	container_of(x, struct vmw_legacy_display_unit, base.encoder)
+#define vmw_connector_to_ldu(x) \
+	container_of(x, struct vmw_legacy_display_unit, base.connector)
+
+struct vmw_legacy_display {
+	struct list_head active;
+
+	unsigned num_active;
+
+	struct vmw_framebuffer *fb;
+};
+
+/**
+ * Display unit using the legacy register interface.
+ */
+struct vmw_legacy_display_unit {
+	struct vmw_display_unit base;
+
+	struct list_head active;
+
+	unsigned unit;
+};
+
+static void vmw_ldu_destroy(struct vmw_legacy_display_unit *ldu)
+{
+	list_del_init(&ldu->active);
+	vmw_display_unit_cleanup(&ldu->base);
+	kfree(ldu);
+}
+
+
+/*
+ * Legacy Display Unit CRTC functions
+ */
+
+static void vmw_ldu_crtc_save(struct drm_crtc *crtc)
+{
+}
+
+static void vmw_ldu_crtc_restore(struct drm_crtc *crtc)
+{
+}
+
+static void vmw_ldu_crtc_gamma_set(struct drm_crtc *crtc,
+				   u16 *r, u16 *g, u16 *b,
+				   uint32_t size)
+{
+}
+
+static void vmw_ldu_crtc_destroy(struct drm_crtc *crtc)
+{
+	vmw_ldu_destroy(vmw_crtc_to_ldu(crtc));
+}
+
+static int vmw_ldu_commit_list(struct vmw_private *dev_priv)
+{
+	struct vmw_legacy_display *lds = dev_priv->ldu_priv;
+	struct vmw_legacy_display_unit *entry;
+	struct drm_crtc *crtc;
+	int i = 0;
+
+	/* to stop the screen from changing size on resize */
+	vmw_write(dev_priv, SVGA_REG_NUM_GUEST_DISPLAYS, 0);
+	for (i = 0; i < lds->num_active; i++) {
+		vmw_write(dev_priv, SVGA_REG_DISPLAY_ID, i);
+		vmw_write(dev_priv, SVGA_REG_DISPLAY_IS_PRIMARY, !i);
+		vmw_write(dev_priv, SVGA_REG_DISPLAY_POSITION_X, 0);
+		vmw_write(dev_priv, SVGA_REG_DISPLAY_POSITION_Y, 0);
+		vmw_write(dev_priv, SVGA_REG_DISPLAY_WIDTH, 0);
+		vmw_write(dev_priv, SVGA_REG_DISPLAY_HEIGHT, 0);
+		vmw_write(dev_priv, SVGA_REG_DISPLAY_ID, SVGA_ID_INVALID);
+	}
+
+	/* Now set the mode */
+	vmw_write(dev_priv, SVGA_REG_NUM_GUEST_DISPLAYS, lds->num_active);
+	i = 0;
+	list_for_each_entry(entry, &lds->active, active) {
+		crtc = &entry->base.crtc;
+
+		vmw_write(dev_priv, SVGA_REG_DISPLAY_ID, i);
+		vmw_write(dev_priv, SVGA_REG_DISPLAY_IS_PRIMARY, !i);
+		vmw_write(dev_priv, SVGA_REG_DISPLAY_POSITION_X, crtc->x);
+		vmw_write(dev_priv, SVGA_REG_DISPLAY_POSITION_Y, crtc->y);
+		vmw_write(dev_priv, SVGA_REG_DISPLAY_WIDTH, crtc->mode.hdisplay);
+		vmw_write(dev_priv, SVGA_REG_DISPLAY_HEIGHT, crtc->mode.vdisplay);
+		vmw_write(dev_priv, SVGA_REG_DISPLAY_ID, SVGA_ID_INVALID);
+
+		i++;
+	}
+
+	return 0;
+}
+
+static int vmw_ldu_del_active(struct vmw_private *vmw_priv,
+			      struct vmw_legacy_display_unit *ldu)
+{
+	struct vmw_legacy_display *ld = vmw_priv->ldu_priv;
+	if (list_empty(&ldu->active))
+		return 0;
+
+	list_del_init(&ldu->active);
+	if (--(ld->num_active) == 0) {
+		BUG_ON(!ld->fb);
+		if (ld->fb->unpin)
+			ld->fb->unpin(ld->fb);
+		ld->fb = NULL;
+	}
+
+	return 0;
+}
+
+static int vmw_ldu_add_active(struct vmw_private *vmw_priv,
+			      struct vmw_legacy_display_unit *ldu,
+			      struct vmw_framebuffer *vfb)
+{
+	struct vmw_legacy_display *ld = vmw_priv->ldu_priv;
+	struct vmw_legacy_display_unit *entry;
+	struct list_head *at;
+
+	if (!list_empty(&ldu->active))
+		return 0;
+
+	at = &ld->active;
+	list_for_each_entry(entry, &ld->active, active) {
+		if (entry->unit > ldu->unit)
+			break;
+
+		at = &entry->active;
+	}
+
+	list_add(&ldu->active, at);
+	if (ld->num_active++ == 0) {
+		BUG_ON(ld->fb);
+		if (vfb->pin)
+			vfb->pin(vfb);
+		ld->fb = vfb;
+	}
+
+	return 0;
+}
+
+static int vmw_ldu_crtc_set_config(struct drm_mode_set *set)
+{
+	struct vmw_private *dev_priv;
+	struct vmw_legacy_display_unit *ldu;
+	struct drm_connector *connector;
+	struct drm_display_mode *mode;
+	struct drm_encoder *encoder;
+	struct vmw_framebuffer *vfb;
+	struct drm_framebuffer *fb;
+	struct drm_crtc *crtc;
+
+	if (!set)
+		return -EINVAL;
+
+	if (!set->crtc)
+		return -EINVAL;
+
+	/* get the ldu */
+	crtc = set->crtc;
+	ldu = vmw_crtc_to_ldu(crtc);
+	vfb = set->fb ? vmw_framebuffer_to_vfb(set->fb) : NULL;
+	dev_priv = vmw_priv(crtc->dev);
+
+	if (set->num_connectors > 1) {
+		DRM_ERROR("to many connectors\n");
+		return -EINVAL;
+	}
+
+	if (set->num_connectors == 1 &&
+	    set->connectors[0] != &ldu->base.connector) {
+		DRM_ERROR("connector doesn't match %p %p\n",
+			set->connectors[0], &ldu->base.connector);
+		return -EINVAL;
+	}
+
+	/* ldu only supports one fb active at the time */
+	if (dev_priv->ldu_priv->fb && vfb &&
+	    dev_priv->ldu_priv->fb != vfb) {
+		DRM_ERROR("Multiple framebuffers not supported\n");
+		return -EINVAL;
+	}
+
+	/* since they always map one to one these are safe */
+	connector = &ldu->base.connector;
+	encoder = &ldu->base.encoder;
+
+	/* should we turn the crtc off? */
+	if (set->num_connectors == 0 || !set->mode || !set->fb) {
+
+		connector->encoder = NULL;
+		encoder->crtc = NULL;
+		crtc->fb = NULL;
+
+		vmw_ldu_del_active(dev_priv, ldu);
+
+		vmw_ldu_commit_list(dev_priv);
+
+		return 0;
+	}
+
+
+	/* we now know we want to set a mode */
+	mode = set->mode;
+	fb = set->fb;
+
+	if (set->x + mode->hdisplay > fb->width ||
+	    set->y + mode->vdisplay > fb->height) {
+		DRM_ERROR("set outside of framebuffer\n");
+		return -EINVAL;
+	}
+
+	vmw_fb_off(dev_priv);
+
+	crtc->fb = fb;
+	encoder->crtc = crtc;
+	connector->encoder = encoder;
+	crtc->x = set->x;
+	crtc->y = set->y;
+	crtc->mode = *mode;
+
+	vmw_ldu_add_active(dev_priv, ldu, vfb);
+
+	vmw_ldu_commit_list(dev_priv);
+
+	return 0;
+}
+
+static struct drm_crtc_funcs vmw_legacy_crtc_funcs = {
+	.save = vmw_ldu_crtc_save,
+	.restore = vmw_ldu_crtc_restore,
+	.cursor_set = vmw_du_crtc_cursor_set,
+	.cursor_move = vmw_du_crtc_cursor_move,
+	.gamma_set = vmw_ldu_crtc_gamma_set,
+	.destroy = vmw_ldu_crtc_destroy,
+	.set_config = vmw_ldu_crtc_set_config,
+};
+
+/*
+ * Legacy Display Unit encoder functions
+ */
+
+static void vmw_ldu_encoder_destroy(struct drm_encoder *encoder)
+{
+	vmw_ldu_destroy(vmw_encoder_to_ldu(encoder));
+}
+
+static struct drm_encoder_funcs vmw_legacy_encoder_funcs = {
+	.destroy = vmw_ldu_encoder_destroy,
+};
+
+/*
+ * Legacy Display Unit connector functions
+ */
+
+static void vmw_ldu_connector_dpms(struct drm_connector *connector, int mode)
+{
+}
+
+static void vmw_ldu_connector_save(struct drm_connector *connector)
+{
+}
+
+static void vmw_ldu_connector_restore(struct drm_connector *connector)
+{
+}
+
+static enum drm_connector_status
+	vmw_ldu_connector_detect(struct drm_connector *connector)
+{
+	/* XXX vmwctrl should control connection status */
+	if (vmw_connector_to_ldu(connector)->base.unit == 0)
+		return connector_status_connected;
+	return connector_status_disconnected;
+}
+
+static struct drm_display_mode vmw_ldu_connector_builtin[] = {
+	/* 640x480@60Hz */
+	{ DRM_MODE("640x480", DRM_MODE_TYPE_DRIVER, 25175, 640, 656,
+		   752, 800, 0, 480, 489, 492, 525, 0,
+		   DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_NVSYNC) },
+	/* 800x600@60Hz */
+	{ DRM_MODE("800x600",
+		   DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED,
+		   40000, 800, 840, 968, 1056, 0, 600, 601, 605, 628,
+		   0, DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+	/* 1024x768@60Hz */
+	{ DRM_MODE("1024x768", DRM_MODE_TYPE_DRIVER, 65000, 1024, 1048,
+		   1184, 1344, 0, 768, 771, 777, 806, 0,
+		   DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_NVSYNC) },
+	/* 1152x864@75Hz */
+	{ DRM_MODE("1152x864", DRM_MODE_TYPE_DRIVER, 108000, 1152, 1216,
+		   1344, 1600, 0, 864, 865, 868, 900, 0,
+		   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+	/* 1280x768@60Hz */
+	{ DRM_MODE("1280x768", DRM_MODE_TYPE_DRIVER, 79500, 1280, 1344,
+		   1472, 1664, 0, 768, 771, 778, 798, 0,
+		   DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_PVSYNC) },
+	/* 1280x800@60Hz */
+	{ DRM_MODE("1280x800", DRM_MODE_TYPE_DRIVER, 83500, 1280, 1352,
+		   1480, 1680, 0, 800, 803, 809, 831, 0,
+		   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_NVSYNC) },
+	/* 1280x960@60Hz */
+	{ DRM_MODE("1280x960", DRM_MODE_TYPE_DRIVER, 108000, 1280, 1376,
+		   1488, 1800, 0, 960, 961, 964, 1000, 0,
+		   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+	/* 1280x1024@60Hz */
+	{ DRM_MODE("1280x1024", DRM_MODE_TYPE_DRIVER, 108000, 1280, 1328,
+		   1440, 1688, 0, 1024, 1025, 1028, 1066, 0,
+		   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+	/* 1360x768@60Hz */
+	{ DRM_MODE("1360x768", DRM_MODE_TYPE_DRIVER, 85500, 1360, 1424,
+		   1536, 1792, 0, 768, 771, 777, 795, 0,
+		   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+	/* 1440x1050@60Hz */
+	{ DRM_MODE("1400x1050", DRM_MODE_TYPE_DRIVER, 121750, 1400, 1488,
+		   1632, 1864, 0, 1050, 1053, 1057, 1089, 0,
+		   DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_PVSYNC) },
+	/* 1440x900@60Hz */
+	{ DRM_MODE("1440x900", DRM_MODE_TYPE_DRIVER, 106500, 1440, 1520,
+		   1672, 1904, 0, 900, 903, 909, 934, 0,
+		   DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_PVSYNC) },
+	/* 1600x1200@60Hz */
+	{ DRM_MODE("1600x1200", DRM_MODE_TYPE_DRIVER, 162000, 1600, 1664,
+		   1856, 2160, 0, 1200, 1201, 1204, 1250, 0,
+		   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+	/* 1680x1050@60Hz */
+	{ DRM_MODE("1680x1050", DRM_MODE_TYPE_DRIVER, 146250, 1680, 1784,
+		   1960, 2240, 0, 1050, 1053, 1059, 1089, 0,
+		   DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_PVSYNC) },
+	/* 1792x1344@60Hz */
+	{ DRM_MODE("1792x1344", DRM_MODE_TYPE_DRIVER, 204750, 1792, 1920,
+		   2120, 2448, 0, 1344, 1345, 1348, 1394, 0,
+		   DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_PVSYNC) },
+	/* 1853x1392@60Hz */
+	{ DRM_MODE("1856x1392", DRM_MODE_TYPE_DRIVER, 218250, 1856, 1952,
+		   2176, 2528, 0, 1392, 1393, 1396, 1439, 0,
+		   DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_PVSYNC) },
+	/* 1920x1200@60Hz */
+	{ DRM_MODE("1920x1200", DRM_MODE_TYPE_DRIVER, 193250, 1920, 2056,
+		   2256, 2592, 0, 1200, 1203, 1209, 1245, 0,
+		   DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_PVSYNC) },
+	/* 1920x1440@60Hz */
+	{ DRM_MODE("1920x1440", DRM_MODE_TYPE_DRIVER, 234000, 1920, 2048,
+		   2256, 2600, 0, 1440, 1441, 1444, 1500, 0,
+		   DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_PVSYNC) },
+	/* 2560x1600@60Hz */
+	{ DRM_MODE("2560x1600", DRM_MODE_TYPE_DRIVER, 348500, 2560, 2752,
+		   3032, 3504, 0, 1600, 1603, 1609, 1658, 0,
+		   DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_PVSYNC) },
+	/* Terminate */
+	{ DRM_MODE("", 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0) },
+};
+
+static int vmw_ldu_connector_fill_modes(struct drm_connector *connector,
+					uint32_t max_width, uint32_t max_height)
+{
+	struct drm_device *dev = connector->dev;
+	struct drm_display_mode *mode = NULL;
+	int i;
+
+	for (i = 0; vmw_ldu_connector_builtin[i].type != 0; i++) {
+		if (vmw_ldu_connector_builtin[i].hdisplay > max_width ||
+		    vmw_ldu_connector_builtin[i].vdisplay > max_height)
+			continue;
+
+		mode = drm_mode_duplicate(dev, &vmw_ldu_connector_builtin[i]);
+		if (!mode)
+			return 0;
+		mode->vrefresh = drm_mode_vrefresh(mode);
+
+		drm_mode_probed_add(connector, mode);
+	}
+
+	drm_mode_connector_list_update(connector);
+
+	return 1;
+}
+
+static int vmw_ldu_connector_set_property(struct drm_connector *connector,
+					  struct drm_property *property,
+					  uint64_t val)
+{
+	return 0;
+}
+
+static void vmw_ldu_connector_destroy(struct drm_connector *connector)
+{
+	vmw_ldu_destroy(vmw_connector_to_ldu(connector));
+}
+
+static struct drm_connector_funcs vmw_legacy_connector_funcs = {
+	.dpms = vmw_ldu_connector_dpms,
+	.save = vmw_ldu_connector_save,
+	.restore = vmw_ldu_connector_restore,
+	.detect = vmw_ldu_connector_detect,
+	.fill_modes = vmw_ldu_connector_fill_modes,
+	.set_property = vmw_ldu_connector_set_property,
+	.destroy = vmw_ldu_connector_destroy,
+};
+
+static int vmw_ldu_init(struct vmw_private *dev_priv, unsigned unit)
+{
+	struct vmw_legacy_display_unit *ldu;
+	struct drm_device *dev = dev_priv->dev;
+	struct drm_connector *connector;
+	struct drm_encoder *encoder;
+	struct drm_crtc *crtc;
+
+	ldu = kzalloc(sizeof(*ldu), GFP_KERNEL);
+	if (!ldu)
+		return -ENOMEM;
+
+	ldu->unit = unit;
+	crtc = &ldu->base.crtc;
+	encoder = &ldu->base.encoder;
+	connector = &ldu->base.connector;
+
+	drm_connector_init(dev, connector, &vmw_legacy_connector_funcs,
+			   DRM_MODE_CONNECTOR_LVDS);
+	/* Initial status */
+	if (unit == 0)
+		connector->status = connector_status_connected;
+	else
+		connector->status = connector_status_disconnected;
+
+	drm_encoder_init(dev, encoder, &vmw_legacy_encoder_funcs,
+			 DRM_MODE_ENCODER_LVDS);
+	drm_mode_connector_attach_encoder(connector, encoder);
+	encoder->possible_crtcs = (1 << unit);
+	encoder->possible_clones = 0;
+
+	INIT_LIST_HEAD(&ldu->active);
+
+	drm_crtc_init(dev, crtc, &vmw_legacy_crtc_funcs);
+
+	drm_connector_attach_property(connector,
+				      dev->mode_config.dirty_info_property,
+				      1);
+
+	return 0;
+}
+
+int vmw_kms_init_legacy_display_system(struct vmw_private *dev_priv)
+{
+	if (dev_priv->ldu_priv) {
+		DRM_INFO("ldu system already on\n");
+		return -EINVAL;
+	}
+
+	dev_priv->ldu_priv = kmalloc(GFP_KERNEL, sizeof(*dev_priv->ldu_priv));
+
+	if (!dev_priv->ldu_priv)
+		return -ENOMEM;
+
+	INIT_LIST_HEAD(&dev_priv->ldu_priv->active);
+	dev_priv->ldu_priv->num_active = 0;
+	dev_priv->ldu_priv->fb = NULL;
+
+	drm_mode_create_dirty_info_property(dev_priv->dev);
+
+	vmw_ldu_init(dev_priv, 0);
+	vmw_ldu_init(dev_priv, 1);
+	vmw_ldu_init(dev_priv, 2);
+	vmw_ldu_init(dev_priv, 3);
+	vmw_ldu_init(dev_priv, 4);
+	vmw_ldu_init(dev_priv, 5);
+	vmw_ldu_init(dev_priv, 6);
+	vmw_ldu_init(dev_priv, 7);
+
+	return 0;
+}
+
+int vmw_kms_close_legacy_display_system(struct vmw_private *dev_priv)
+{
+	if (!dev_priv->ldu_priv)
+		return -ENOSYS;
+
+	BUG_ON(!list_empty(&dev_priv->ldu_priv->active));
+
+	kfree(dev_priv->ldu_priv);
+
+	return 0;
+}
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_overlay.c b/drivers/gpu/drm/vmwgfx/vmwgfx_overlay.c
new file mode 100644
index 000000000000..bb6e6a096d25
--- /dev/null
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_overlay.c
@@ -0,0 +1,634 @@
+/**************************************************************************
+ *
+ * Copyright © 2009 VMware, Inc., Palo Alto, CA., USA
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ **************************************************************************/
+
+
+#include "drmP.h"
+#include "vmwgfx_drv.h"
+
+#include "ttm/ttm_placement.h"
+
+#include "svga_overlay.h"
+#include "svga_escape.h"
+
+#define VMW_MAX_NUM_STREAMS 1
+
+struct vmw_stream {
+	struct vmw_dma_buffer *buf;
+	bool claimed;
+	bool paused;
+	struct drm_vmw_control_stream_arg saved;
+};
+
+/**
+ * Overlay control
+ */
+struct vmw_overlay {
+	/*
+	 * Each stream is a single overlay. In Xv these are called ports.
+	 */
+	struct mutex mutex;
+	struct vmw_stream stream[VMW_MAX_NUM_STREAMS];
+};
+
+static inline struct vmw_overlay *vmw_overlay(struct drm_device *dev)
+{
+	struct vmw_private *dev_priv = vmw_priv(dev);
+	return dev_priv ? dev_priv->overlay_priv : NULL;
+}
+
+struct vmw_escape_header {
+	uint32_t cmd;
+	SVGAFifoCmdEscape body;
+};
+
+struct vmw_escape_video_flush {
+	struct vmw_escape_header escape;
+	SVGAEscapeVideoFlush flush;
+};
+
+static inline void fill_escape(struct vmw_escape_header *header,
+			       uint32_t size)
+{
+	header->cmd = SVGA_CMD_ESCAPE;
+	header->body.nsid = SVGA_ESCAPE_NSID_VMWARE;
+	header->body.size = size;
+}
+
+static inline void fill_flush(struct vmw_escape_video_flush *cmd,
+			      uint32_t stream_id)
+{
+	fill_escape(&cmd->escape, sizeof(cmd->flush));
+	cmd->flush.cmdType = SVGA_ESCAPE_VMWARE_VIDEO_FLUSH;
+	cmd->flush.streamId = stream_id;
+}
+
+/**
+ * Pin or unpin a buffer in vram.
+ *
+ * @dev_priv:  Driver private.
+ * @buf:  DMA buffer to pin or unpin.
+ * @pin:  Pin buffer in vram if true.
+ * @interruptible:  Use interruptible wait.
+ *
+ * Takes the current masters ttm lock in read.
+ *
+ * Returns
+ * -ERESTARTSYS if interrupted by a signal.
+ */
+static int vmw_dmabuf_pin_in_vram(struct vmw_private *dev_priv,
+				  struct vmw_dma_buffer *buf,
+				  bool pin, bool interruptible)
+{
+	struct ttm_buffer_object *bo = &buf->base;
+	struct ttm_bo_global *glob = bo->glob;
+	struct ttm_placement *overlay_placement = &vmw_vram_placement;
+	int ret;
+
+	ret = ttm_read_lock(&dev_priv->active_master->lock, interruptible);
+	if (unlikely(ret != 0))
+		return ret;
+
+	ret = ttm_bo_reserve(bo, interruptible, false, false, 0);
+	if (unlikely(ret != 0))
+		goto err;
+
+	if (buf->gmr_bound) {
+		vmw_gmr_unbind(dev_priv, buf->gmr_id);
+		spin_lock(&glob->lru_lock);
+		ida_remove(&dev_priv->gmr_ida, buf->gmr_id);
+		spin_unlock(&glob->lru_lock);
+		buf->gmr_bound = NULL;
+	}
+
+	if (pin)
+		overlay_placement = &vmw_vram_ne_placement;
+
+	ret = ttm_bo_validate(bo, overlay_placement, interruptible, false);
+
+	ttm_bo_unreserve(bo);
+
+err:
+	ttm_read_unlock(&dev_priv->active_master->lock);
+
+	return ret;
+}
+
+/**
+ * Send put command to hw.
+ *
+ * Returns
+ * -ERESTARTSYS if interrupted by a signal.
+ */
+static int vmw_overlay_send_put(struct vmw_private *dev_priv,
+				struct vmw_dma_buffer *buf,
+				struct drm_vmw_control_stream_arg *arg,
+				bool interruptible)
+{
+	struct {
+		struct vmw_escape_header escape;
+		struct {
+			struct {
+				uint32_t cmdType;
+				uint32_t streamId;
+			} header;
+			struct {
+				uint32_t registerId;
+				uint32_t value;
+			} items[SVGA_VIDEO_PITCH_3 + 1];
+		} body;
+		struct vmw_escape_video_flush flush;
+	} *cmds;
+	uint32_t offset;
+	int i, ret;
+
+	for (;;) {
+		cmds = vmw_fifo_reserve(dev_priv, sizeof(*cmds));
+		if (cmds)
+			break;
+
+		ret = vmw_fallback_wait(dev_priv, false, true, 0,
+					interruptible, 3*HZ);
+		if (interruptible && ret == -ERESTARTSYS)
+			return ret;
+		else
+			BUG_ON(ret != 0);
+	}
+
+	fill_escape(&cmds->escape, sizeof(cmds->body));
+	cmds->body.header.cmdType = SVGA_ESCAPE_VMWARE_VIDEO_SET_REGS;
+	cmds->body.header.streamId = arg->stream_id;
+
+	for (i = 0; i <= SVGA_VIDEO_PITCH_3; i++)
+		cmds->body.items[i].registerId = i;
+
+	offset = buf->base.offset + arg->offset;
+
+	cmds->body.items[SVGA_VIDEO_ENABLED].value     = true;
+	cmds->body.items[SVGA_VIDEO_FLAGS].value       = arg->flags;
+	cmds->body.items[SVGA_VIDEO_DATA_OFFSET].value = offset;
+	cmds->body.items[SVGA_VIDEO_FORMAT].value      = arg->format;
+	cmds->body.items[SVGA_VIDEO_COLORKEY].value    = arg->color_key;
+	cmds->body.items[SVGA_VIDEO_SIZE].value        = arg->size;
+	cmds->body.items[SVGA_VIDEO_WIDTH].value       = arg->width;
+	cmds->body.items[SVGA_VIDEO_HEIGHT].value      = arg->height;
+	cmds->body.items[SVGA_VIDEO_SRC_X].value       = arg->src.x;
+	cmds->body.items[SVGA_VIDEO_SRC_Y].value       = arg->src.y;
+	cmds->body.items[SVGA_VIDEO_SRC_WIDTH].value   = arg->src.w;
+	cmds->body.items[SVGA_VIDEO_SRC_HEIGHT].value  = arg->src.h;
+	cmds->body.items[SVGA_VIDEO_DST_X].value       = arg->dst.x;
+	cmds->body.items[SVGA_VIDEO_DST_Y].value       = arg->dst.y;
+	cmds->body.items[SVGA_VIDEO_DST_WIDTH].value   = arg->dst.w;
+	cmds->body.items[SVGA_VIDEO_DST_HEIGHT].value  = arg->dst.h;
+	cmds->body.items[SVGA_VIDEO_PITCH_1].value     = arg->pitch[0];
+	cmds->body.items[SVGA_VIDEO_PITCH_2].value     = arg->pitch[1];
+	cmds->body.items[SVGA_VIDEO_PITCH_3].value     = arg->pitch[2];
+
+	fill_flush(&cmds->flush, arg->stream_id);
+
+	vmw_fifo_commit(dev_priv, sizeof(*cmds));
+
+	return 0;
+}
+
+/**
+ * Send stop command to hw.
+ *
+ * Returns
+ * -ERESTARTSYS if interrupted by a signal.
+ */
+static int vmw_overlay_send_stop(struct vmw_private *dev_priv,
+				 uint32_t stream_id,
+				 bool interruptible)
+{
+	struct {
+		struct vmw_escape_header escape;
+		SVGAEscapeVideoSetRegs body;
+		struct vmw_escape_video_flush flush;
+	} *cmds;
+	int ret;
+
+	for (;;) {
+		cmds = vmw_fifo_reserve(dev_priv, sizeof(*cmds));
+		if (cmds)
+			break;
+
+		ret = vmw_fallback_wait(dev_priv, false, true, 0,
+					interruptible, 3*HZ);
+		if (interruptible && ret == -ERESTARTSYS)
+			return ret;
+		else
+			BUG_ON(ret != 0);
+	}
+
+	fill_escape(&cmds->escape, sizeof(cmds->body));
+	cmds->body.header.cmdType = SVGA_ESCAPE_VMWARE_VIDEO_SET_REGS;
+	cmds->body.header.streamId = stream_id;
+	cmds->body.items[0].registerId = SVGA_VIDEO_ENABLED;
+	cmds->body.items[0].value = false;
+	fill_flush(&cmds->flush, stream_id);
+
+	vmw_fifo_commit(dev_priv, sizeof(*cmds));
+
+	return 0;
+}
+
+/**
+ * Stop or pause a stream.
+ *
+ * If the stream is paused the no evict flag is removed from the buffer
+ * but left in vram. This allows for instance mode_set to evict it
+ * should it need to.
+ *
+ * The caller must hold the overlay lock.
+ *
+ * @stream_id which stream to stop/pause.
+ * @pause true to pause, false to stop completely.
+ */
+static int vmw_overlay_stop(struct vmw_private *dev_priv,
+			    uint32_t stream_id, bool pause,
+			    bool interruptible)
+{
+	struct vmw_overlay *overlay = dev_priv->overlay_priv;
+	struct vmw_stream *stream = &overlay->stream[stream_id];
+	int ret;
+
+	/* no buffer attached the stream is completely stopped */
+	if (!stream->buf)
+		return 0;
+
+	/* If the stream is paused this is already done */
+	if (!stream->paused) {
+		ret = vmw_overlay_send_stop(dev_priv, stream_id,
+					    interruptible);
+		if (ret)
+			return ret;
+
+		/* We just remove the NO_EVICT flag so no -ENOMEM */
+		ret = vmw_dmabuf_pin_in_vram(dev_priv, stream->buf, false,
+					     interruptible);
+		if (interruptible && ret == -ERESTARTSYS)
+			return ret;
+		else
+			BUG_ON(ret != 0);
+	}
+
+	if (!pause) {
+		vmw_dmabuf_unreference(&stream->buf);
+		stream->paused = false;
+	} else {
+		stream->paused = true;
+	}
+
+	return 0;
+}
+
+/**
+ * Update a stream and send any put or stop fifo commands needed.
+ *
+ * The caller must hold the overlay lock.
+ *
+ * Returns
+ * -ENOMEM if buffer doesn't fit in vram.
+ * -ERESTARTSYS if interrupted.
+ */
+static int vmw_overlay_update_stream(struct vmw_private *dev_priv,
+				     struct vmw_dma_buffer *buf,
+				     struct drm_vmw_control_stream_arg *arg,
+				     bool interruptible)
+{
+	struct vmw_overlay *overlay = dev_priv->overlay_priv;
+	struct vmw_stream *stream = &overlay->stream[arg->stream_id];
+	int ret = 0;
+
+	if (!buf)
+		return -EINVAL;
+
+	DRM_DEBUG("   %s: old %p, new %p, %spaused\n", __func__,
+		  stream->buf, buf, stream->paused ? "" : "not ");
+
+	if (stream->buf != buf) {
+		ret = vmw_overlay_stop(dev_priv, arg->stream_id,
+				       false, interruptible);
+		if (ret)
+			return ret;
+	} else if (!stream->paused) {
+		/* If the buffers match and not paused then just send
+		 * the put command, no need to do anything else.
+		 */
+		ret = vmw_overlay_send_put(dev_priv, buf, arg, interruptible);
+		if (ret == 0)
+			stream->saved = *arg;
+		else
+			BUG_ON(!interruptible);
+
+		return ret;
+	}
+
+	/* We don't start the old stream if we are interrupted.
+	 * Might return -ENOMEM if it can't fit the buffer in vram.
+	 */
+	ret = vmw_dmabuf_pin_in_vram(dev_priv, buf, true, interruptible);
+	if (ret)
+		return ret;
+
+	ret = vmw_overlay_send_put(dev_priv, buf, arg, interruptible);
+	if (ret) {
+		/* This one needs to happen no matter what. We only remove
+		 * the NO_EVICT flag so this is safe from -ENOMEM.
+		 */
+		BUG_ON(vmw_dmabuf_pin_in_vram(dev_priv, buf, false, false) != 0);
+		return ret;
+	}
+
+	if (stream->buf != buf)
+		stream->buf = vmw_dmabuf_reference(buf);
+	stream->saved = *arg;
+
+	return 0;
+}
+
+/**
+ * Stop all streams.
+ *
+ * Used by the fb code when starting.
+ *
+ * Takes the overlay lock.
+ */
+int vmw_overlay_stop_all(struct vmw_private *dev_priv)
+{
+	struct vmw_overlay *overlay = dev_priv->overlay_priv;
+	int i, ret;
+
+	if (!overlay)
+		return 0;
+
+	mutex_lock(&overlay->mutex);
+
+	for (i = 0; i < VMW_MAX_NUM_STREAMS; i++) {
+		struct vmw_stream *stream = &overlay->stream[i];
+		if (!stream->buf)
+			continue;
+
+		ret = vmw_overlay_stop(dev_priv, i, false, false);
+		WARN_ON(ret != 0);
+	}
+
+	mutex_unlock(&overlay->mutex);
+
+	return 0;
+}
+
+/**
+ * Try to resume all paused streams.
+ *
+ * Used by the kms code after moving a new scanout buffer to vram.
+ *
+ * Takes the overlay lock.
+ */
+int vmw_overlay_resume_all(struct vmw_private *dev_priv)
+{
+	struct vmw_overlay *overlay = dev_priv->overlay_priv;
+	int i, ret;
+
+	if (!overlay)
+		return 0;
+
+	mutex_lock(&overlay->mutex);
+
+	for (i = 0; i < VMW_MAX_NUM_STREAMS; i++) {
+		struct vmw_stream *stream = &overlay->stream[i];
+		if (!stream->paused)
+			continue;
+
+		ret = vmw_overlay_update_stream(dev_priv, stream->buf,
+						&stream->saved, false);
+		if (ret != 0)
+			DRM_INFO("%s: *warning* failed to resume stream %i\n",
+				 __func__, i);
+	}
+
+	mutex_unlock(&overlay->mutex);
+
+	return 0;
+}
+
+/**
+ * Pauses all active streams.
+ *
+ * Used by the kms code when moving a new scanout buffer to vram.
+ *
+ * Takes the overlay lock.
+ */
+int vmw_overlay_pause_all(struct vmw_private *dev_priv)
+{
+	struct vmw_overlay *overlay = dev_priv->overlay_priv;
+	int i, ret;
+
+	if (!overlay)
+		return 0;
+
+	mutex_lock(&overlay->mutex);
+
+	for (i = 0; i < VMW_MAX_NUM_STREAMS; i++) {
+		if (overlay->stream[i].paused)
+			DRM_INFO("%s: *warning* stream %i already paused\n",
+				 __func__, i);
+		ret = vmw_overlay_stop(dev_priv, i, true, false);
+		WARN_ON(ret != 0);
+	}
+
+	mutex_unlock(&overlay->mutex);
+
+	return 0;
+}
+
+int vmw_overlay_ioctl(struct drm_device *dev, void *data,
+		      struct drm_file *file_priv)
+{
+	struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
+	struct vmw_private *dev_priv = vmw_priv(dev);
+	struct vmw_overlay *overlay = dev_priv->overlay_priv;
+	struct drm_vmw_control_stream_arg *arg =
+	    (struct drm_vmw_control_stream_arg *)data;
+	struct vmw_dma_buffer *buf;
+	struct vmw_resource *res;
+	int ret;
+
+	if (!overlay)
+		return -ENOSYS;
+
+	ret = vmw_user_stream_lookup(dev_priv, tfile, &arg->stream_id, &res);
+	if (ret)
+		return ret;
+
+	mutex_lock(&overlay->mutex);
+
+	if (!arg->enabled) {
+		ret = vmw_overlay_stop(dev_priv, arg->stream_id, false, true);
+		goto out_unlock;
+	}
+
+	ret = vmw_user_dmabuf_lookup(tfile, arg->handle, &buf);
+	if (ret)
+		goto out_unlock;
+
+	ret = vmw_overlay_update_stream(dev_priv, buf, arg, true);
+
+	vmw_dmabuf_unreference(&buf);
+
+out_unlock:
+	mutex_unlock(&overlay->mutex);
+	vmw_resource_unreference(&res);
+
+	return ret;
+}
+
+int vmw_overlay_num_overlays(struct vmw_private *dev_priv)
+{
+	if (!dev_priv->overlay_priv)
+		return 0;
+
+	return VMW_MAX_NUM_STREAMS;
+}
+
+int vmw_overlay_num_free_overlays(struct vmw_private *dev_priv)
+{
+	struct vmw_overlay *overlay = dev_priv->overlay_priv;
+	int i, k;
+
+	if (!overlay)
+		return 0;
+
+	mutex_lock(&overlay->mutex);
+
+	for (i = 0, k = 0; i < VMW_MAX_NUM_STREAMS; i++)
+		if (!overlay->stream[i].claimed)
+			k++;
+
+	mutex_unlock(&overlay->mutex);
+
+	return k;
+}
+
+int vmw_overlay_claim(struct vmw_private *dev_priv, uint32_t *out)
+{
+	struct vmw_overlay *overlay = dev_priv->overlay_priv;
+	int i;
+
+	if (!overlay)
+		return -ENOSYS;
+
+	mutex_lock(&overlay->mutex);
+
+	for (i = 0; i < VMW_MAX_NUM_STREAMS; i++) {
+
+		if (overlay->stream[i].claimed)
+			continue;
+
+		overlay->stream[i].claimed = true;
+		*out = i;
+		mutex_unlock(&overlay->mutex);
+		return 0;
+	}
+
+	mutex_unlock(&overlay->mutex);
+	return -ESRCH;
+}
+
+int vmw_overlay_unref(struct vmw_private *dev_priv, uint32_t stream_id)
+{
+	struct vmw_overlay *overlay = dev_priv->overlay_priv;
+
+	BUG_ON(stream_id >= VMW_MAX_NUM_STREAMS);
+
+	if (!overlay)
+		return -ENOSYS;
+
+	mutex_lock(&overlay->mutex);
+
+	WARN_ON(!overlay->stream[stream_id].claimed);
+	vmw_overlay_stop(dev_priv, stream_id, false, false);
+	overlay->stream[stream_id].claimed = false;
+
+	mutex_unlock(&overlay->mutex);
+	return 0;
+}
+
+int vmw_overlay_init(struct vmw_private *dev_priv)
+{
+	struct vmw_overlay *overlay;
+	int i;
+
+	if (dev_priv->overlay_priv)
+		return -EINVAL;
+
+	if (!(dev_priv->fifo.capabilities & SVGA_FIFO_CAP_VIDEO) &&
+	     (dev_priv->fifo.capabilities & SVGA_FIFO_CAP_ESCAPE)) {
+		DRM_INFO("hardware doesn't support overlays\n");
+		return -ENOSYS;
+	}
+
+	overlay = kmalloc(GFP_KERNEL, sizeof(*overlay));
+	if (!overlay)
+		return -ENOMEM;
+
+	memset(overlay, 0, sizeof(*overlay));
+	mutex_init(&overlay->mutex);
+	for (i = 0; i < VMW_MAX_NUM_STREAMS; i++) {
+		overlay->stream[i].buf = NULL;
+		overlay->stream[i].paused = false;
+		overlay->stream[i].claimed = false;
+	}
+
+	dev_priv->overlay_priv = overlay;
+
+	return 0;
+}
+
+int vmw_overlay_close(struct vmw_private *dev_priv)
+{
+	struct vmw_overlay *overlay = dev_priv->overlay_priv;
+	bool forgotten_buffer = false;
+	int i;
+
+	if (!overlay)
+		return -ENOSYS;
+
+	for (i = 0; i < VMW_MAX_NUM_STREAMS; i++) {
+		if (overlay->stream[i].buf) {
+			forgotten_buffer = true;
+			vmw_overlay_stop(dev_priv, i, false, false);
+		}
+	}
+
+	WARN_ON(forgotten_buffer);
+
+	dev_priv->overlay_priv = NULL;
+	kfree(overlay);
+
+	return 0;
+}
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_reg.h b/drivers/gpu/drm/vmwgfx/vmwgfx_reg.h
new file mode 100644
index 000000000000..9d0dd3a342eb
--- /dev/null
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_reg.h
@@ -0,0 +1,57 @@
+/**************************************************************************
+ *
+ * Copyright © 2009 VMware, Inc., Palo Alto, CA., USA
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ **************************************************************************/
+
+/**
+ * This file contains virtual hardware defines for kernel space.
+ */
+
+#ifndef _VMWGFX_REG_H_
+#define _VMWGFX_REG_H_
+
+#include <linux/types.h>
+
+#define VMWGFX_INDEX_PORT     0x0
+#define VMWGFX_VALUE_PORT     0x1
+#define VMWGFX_IRQSTATUS_PORT 0x8
+
+struct svga_guest_mem_descriptor {
+	__le32 ppn;
+	__le32 num_pages;
+};
+
+struct svga_fifo_cmd_fence {
+	__le32 fence;
+};
+
+#define SVGA_SYNC_GENERIC         1
+#define SVGA_SYNC_FIFOFULL        2
+
+#include "svga_types.h"
+
+#include "svga3d_reg.h"
+
+#endif
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
new file mode 100644
index 000000000000..c012d5927f65
--- /dev/null
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
@@ -0,0 +1,1183 @@
+/**************************************************************************
+ *
+ * Copyright © 2009 VMware, Inc., Palo Alto, CA., USA
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ **************************************************************************/
+
+#include "vmwgfx_drv.h"
+#include "vmwgfx_drm.h"
+#include "ttm/ttm_object.h"
+#include "ttm/ttm_placement.h"
+#include "drmP.h"
+
+#define VMW_RES_CONTEXT ttm_driver_type0
+#define VMW_RES_SURFACE ttm_driver_type1
+#define VMW_RES_STREAM ttm_driver_type2
+
+struct vmw_user_context {
+	struct ttm_base_object base;
+	struct vmw_resource res;
+};
+
+struct vmw_user_surface {
+	struct ttm_base_object base;
+	struct vmw_surface srf;
+};
+
+struct vmw_user_dma_buffer {
+	struct ttm_base_object base;
+	struct vmw_dma_buffer dma;
+};
+
+struct vmw_bo_user_rep {
+	uint32_t handle;
+	uint64_t map_handle;
+};
+
+struct vmw_stream {
+	struct vmw_resource res;
+	uint32_t stream_id;
+};
+
+struct vmw_user_stream {
+	struct ttm_base_object base;
+	struct vmw_stream stream;
+};
+
+static inline struct vmw_dma_buffer *
+vmw_dma_buffer(struct ttm_buffer_object *bo)
+{
+	return container_of(bo, struct vmw_dma_buffer, base);
+}
+
+static inline struct vmw_user_dma_buffer *
+vmw_user_dma_buffer(struct ttm_buffer_object *bo)
+{
+	struct vmw_dma_buffer *vmw_bo = vmw_dma_buffer(bo);
+	return container_of(vmw_bo, struct vmw_user_dma_buffer, dma);
+}
+
+struct vmw_resource *vmw_resource_reference(struct vmw_resource *res)
+{
+	kref_get(&res->kref);
+	return res;
+}
+
+static void vmw_resource_release(struct kref *kref)
+{
+	struct vmw_resource *res =
+	    container_of(kref, struct vmw_resource, kref);
+	struct vmw_private *dev_priv = res->dev_priv;
+
+	idr_remove(res->idr, res->id);
+	write_unlock(&dev_priv->resource_lock);
+
+	if (likely(res->hw_destroy != NULL))
+		res->hw_destroy(res);
+
+	if (res->res_free != NULL)
+		res->res_free(res);
+	else
+		kfree(res);
+
+	write_lock(&dev_priv->resource_lock);
+}
+
+void vmw_resource_unreference(struct vmw_resource **p_res)
+{
+	struct vmw_resource *res = *p_res;
+	struct vmw_private *dev_priv = res->dev_priv;
+
+	*p_res = NULL;
+	write_lock(&dev_priv->resource_lock);
+	kref_put(&res->kref, vmw_resource_release);
+	write_unlock(&dev_priv->resource_lock);
+}
+
+static int vmw_resource_init(struct vmw_private *dev_priv,
+			     struct vmw_resource *res,
+			     struct idr *idr,
+			     enum ttm_object_type obj_type,
+			     void (*res_free) (struct vmw_resource *res))
+{
+	int ret;
+
+	kref_init(&res->kref);
+	res->hw_destroy = NULL;
+	res->res_free = res_free;
+	res->res_type = obj_type;
+	res->idr = idr;
+	res->avail = false;
+	res->dev_priv = dev_priv;
+
+	do {
+		if (unlikely(idr_pre_get(idr, GFP_KERNEL) == 0))
+			return -ENOMEM;
+
+		write_lock(&dev_priv->resource_lock);
+		ret = idr_get_new_above(idr, res, 1, &res->id);
+		write_unlock(&dev_priv->resource_lock);
+
+	} while (ret == -EAGAIN);
+
+	return ret;
+}
+
+/**
+ * vmw_resource_activate
+ *
+ * @res:        Pointer to the newly created resource
+ * @hw_destroy: Destroy function. NULL if none.
+ *
+ * Activate a resource after the hardware has been made aware of it.
+ * Set tye destroy function to @destroy. Typically this frees the
+ * resource and destroys the hardware resources associated with it.
+ * Activate basically means that the function vmw_resource_lookup will
+ * find it.
+ */
+
+static void vmw_resource_activate(struct vmw_resource *res,
+				  void (*hw_destroy) (struct vmw_resource *))
+{
+	struct vmw_private *dev_priv = res->dev_priv;
+
+	write_lock(&dev_priv->resource_lock);
+	res->avail = true;
+	res->hw_destroy = hw_destroy;
+	write_unlock(&dev_priv->resource_lock);
+}
+
+struct vmw_resource *vmw_resource_lookup(struct vmw_private *dev_priv,
+					 struct idr *idr, int id)
+{
+	struct vmw_resource *res;
+
+	read_lock(&dev_priv->resource_lock);
+	res = idr_find(idr, id);
+	if (res && res->avail)
+		kref_get(&res->kref);
+	else
+		res = NULL;
+	read_unlock(&dev_priv->resource_lock);
+
+	if (unlikely(res == NULL))
+		return NULL;
+
+	return res;
+}
+
+/**
+ * Context management:
+ */
+
+static void vmw_hw_context_destroy(struct vmw_resource *res)
+{
+
+	struct vmw_private *dev_priv = res->dev_priv;
+	struct {
+		SVGA3dCmdHeader header;
+		SVGA3dCmdDestroyContext body;
+	} *cmd = vmw_fifo_reserve(dev_priv, sizeof(*cmd));
+
+	if (unlikely(cmd == NULL)) {
+		DRM_ERROR("Failed reserving FIFO space for surface "
+			  "destruction.\n");
+		return;
+	}
+
+	cmd->header.id = cpu_to_le32(SVGA_3D_CMD_CONTEXT_DESTROY);
+	cmd->header.size = cpu_to_le32(sizeof(cmd->body));
+	cmd->body.cid = cpu_to_le32(res->id);
+
+	vmw_fifo_commit(dev_priv, sizeof(*cmd));
+}
+
+static int vmw_context_init(struct vmw_private *dev_priv,
+			    struct vmw_resource *res,
+			    void (*res_free) (struct vmw_resource *res))
+{
+	int ret;
+
+	struct {
+		SVGA3dCmdHeader header;
+		SVGA3dCmdDefineContext body;
+	} *cmd;
+
+	ret = vmw_resource_init(dev_priv, res, &dev_priv->context_idr,
+				VMW_RES_CONTEXT, res_free);
+
+	if (unlikely(ret != 0)) {
+		if (res_free == NULL)
+			kfree(res);
+		else
+			res_free(res);
+		return ret;
+	}
+
+	cmd = vmw_fifo_reserve(dev_priv, sizeof(*cmd));
+	if (unlikely(cmd == NULL)) {
+		DRM_ERROR("Fifo reserve failed.\n");
+		vmw_resource_unreference(&res);
+		return -ENOMEM;
+	}
+
+	cmd->header.id = cpu_to_le32(SVGA_3D_CMD_CONTEXT_DEFINE);
+	cmd->header.size = cpu_to_le32(sizeof(cmd->body));
+	cmd->body.cid = cpu_to_le32(res->id);
+
+	vmw_fifo_commit(dev_priv, sizeof(*cmd));
+	vmw_resource_activate(res, vmw_hw_context_destroy);
+	return 0;
+}
+
+struct vmw_resource *vmw_context_alloc(struct vmw_private *dev_priv)
+{
+	struct vmw_resource *res = kmalloc(sizeof(*res), GFP_KERNEL);
+	int ret;
+
+	if (unlikely(res == NULL))
+		return NULL;
+
+	ret = vmw_context_init(dev_priv, res, NULL);
+	return (ret == 0) ? res : NULL;
+}
+
+/**
+ * User-space context management:
+ */
+
+static void vmw_user_context_free(struct vmw_resource *res)
+{
+	struct vmw_user_context *ctx =
+	    container_of(res, struct vmw_user_context, res);
+
+	kfree(ctx);
+}
+
+/**
+ * This function is called when user space has no more references on the
+ * base object. It releases the base-object's reference on the resource object.
+ */
+
+static void vmw_user_context_base_release(struct ttm_base_object **p_base)
+{
+	struct ttm_base_object *base = *p_base;
+	struct vmw_user_context *ctx =
+	    container_of(base, struct vmw_user_context, base);
+	struct vmw_resource *res = &ctx->res;
+
+	*p_base = NULL;
+	vmw_resource_unreference(&res);
+}
+
+int vmw_context_destroy_ioctl(struct drm_device *dev, void *data,
+			      struct drm_file *file_priv)
+{
+	struct vmw_private *dev_priv = vmw_priv(dev);
+	struct vmw_resource *res;
+	struct vmw_user_context *ctx;
+	struct drm_vmw_context_arg *arg = (struct drm_vmw_context_arg *)data;
+	struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
+	int ret = 0;
+
+	res = vmw_resource_lookup(dev_priv, &dev_priv->context_idr, arg->cid);
+	if (unlikely(res == NULL))
+		return -EINVAL;
+
+	if (res->res_free != &vmw_user_context_free) {
+		ret = -EINVAL;
+		goto out;
+	}
+
+	ctx = container_of(res, struct vmw_user_context, res);
+	if (ctx->base.tfile != tfile && !ctx->base.shareable) {
+		ret = -EPERM;
+		goto out;
+	}
+
+	ttm_ref_object_base_unref(tfile, ctx->base.hash.key, TTM_REF_USAGE);
+out:
+	vmw_resource_unreference(&res);
+	return ret;
+}
+
+int vmw_context_define_ioctl(struct drm_device *dev, void *data,
+			     struct drm_file *file_priv)
+{
+	struct vmw_private *dev_priv = vmw_priv(dev);
+	struct vmw_user_context *ctx = kmalloc(sizeof(*ctx), GFP_KERNEL);
+	struct vmw_resource *res;
+	struct vmw_resource *tmp;
+	struct drm_vmw_context_arg *arg = (struct drm_vmw_context_arg *)data;
+	struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
+	int ret;
+
+	if (unlikely(ctx == NULL))
+		return -ENOMEM;
+
+	res = &ctx->res;
+	ctx->base.shareable = false;
+	ctx->base.tfile = NULL;
+
+	ret = vmw_context_init(dev_priv, res, vmw_user_context_free);
+	if (unlikely(ret != 0))
+		return ret;
+
+	tmp = vmw_resource_reference(&ctx->res);
+	ret = ttm_base_object_init(tfile, &ctx->base, false, VMW_RES_CONTEXT,
+				   &vmw_user_context_base_release, NULL);
+
+	if (unlikely(ret != 0)) {
+		vmw_resource_unreference(&tmp);
+		goto out_err;
+	}
+
+	arg->cid = res->id;
+out_err:
+	vmw_resource_unreference(&res);
+	return ret;
+
+}
+
+int vmw_context_check(struct vmw_private *dev_priv,
+		      struct ttm_object_file *tfile,
+		      int id)
+{
+	struct vmw_resource *res;
+	int ret = 0;
+
+	read_lock(&dev_priv->resource_lock);
+	res = idr_find(&dev_priv->context_idr, id);
+	if (res && res->avail) {
+		struct vmw_user_context *ctx =
+			container_of(res, struct vmw_user_context, res);
+		if (ctx->base.tfile != tfile && !ctx->base.shareable)
+			ret = -EPERM;
+	} else
+		ret = -EINVAL;
+	read_unlock(&dev_priv->resource_lock);
+
+	return ret;
+}
+
+
+/**
+ * Surface management.
+ */
+
+static void vmw_hw_surface_destroy(struct vmw_resource *res)
+{
+
+	struct vmw_private *dev_priv = res->dev_priv;
+	struct {
+		SVGA3dCmdHeader header;
+		SVGA3dCmdDestroySurface body;
+	} *cmd = vmw_fifo_reserve(dev_priv, sizeof(*cmd));
+
+	if (unlikely(cmd == NULL)) {
+		DRM_ERROR("Failed reserving FIFO space for surface "
+			  "destruction.\n");
+		return;
+	}
+
+	cmd->header.id = cpu_to_le32(SVGA_3D_CMD_SURFACE_DESTROY);
+	cmd->header.size = cpu_to_le32(sizeof(cmd->body));
+	cmd->body.sid = cpu_to_le32(res->id);
+
+	vmw_fifo_commit(dev_priv, sizeof(*cmd));
+}
+
+void vmw_surface_res_free(struct vmw_resource *res)
+{
+	struct vmw_surface *srf = container_of(res, struct vmw_surface, res);
+
+	kfree(srf->sizes);
+	kfree(srf->snooper.image);
+	kfree(srf);
+}
+
+int vmw_surface_init(struct vmw_private *dev_priv,
+		     struct vmw_surface *srf,
+		     void (*res_free) (struct vmw_resource *res))
+{
+	int ret;
+	struct {
+		SVGA3dCmdHeader header;
+		SVGA3dCmdDefineSurface body;
+	} *cmd;
+	SVGA3dSize *cmd_size;
+	struct vmw_resource *res = &srf->res;
+	struct drm_vmw_size *src_size;
+	size_t submit_size;
+	uint32_t cmd_len;
+	int i;
+
+	BUG_ON(res_free == NULL);
+	ret = vmw_resource_init(dev_priv, res, &dev_priv->surface_idr,
+				VMW_RES_SURFACE, res_free);
+
+	if (unlikely(ret != 0)) {
+		res_free(res);
+		return ret;
+	}
+
+	submit_size = sizeof(*cmd) + srf->num_sizes * sizeof(SVGA3dSize);
+	cmd_len = sizeof(cmd->body) + srf->num_sizes * sizeof(SVGA3dSize);
+
+	cmd = vmw_fifo_reserve(dev_priv, submit_size);
+	if (unlikely(cmd == NULL)) {
+		DRM_ERROR("Fifo reserve failed for create surface.\n");
+		vmw_resource_unreference(&res);
+		return -ENOMEM;
+	}
+
+	cmd->header.id = cpu_to_le32(SVGA_3D_CMD_SURFACE_DEFINE);
+	cmd->header.size = cpu_to_le32(cmd_len);
+	cmd->body.sid = cpu_to_le32(res->id);
+	cmd->body.surfaceFlags = cpu_to_le32(srf->flags);
+	cmd->body.format = cpu_to_le32(srf->format);
+	for (i = 0; i < DRM_VMW_MAX_SURFACE_FACES; ++i) {
+		cmd->body.face[i].numMipLevels =
+		    cpu_to_le32(srf->mip_levels[i]);
+	}
+
+	cmd += 1;
+	cmd_size = (SVGA3dSize *) cmd;
+	src_size = srf->sizes;
+
+	for (i = 0; i < srf->num_sizes; ++i, cmd_size++, src_size++) {
+		cmd_size->width = cpu_to_le32(src_size->width);
+		cmd_size->height = cpu_to_le32(src_size->height);
+		cmd_size->depth = cpu_to_le32(src_size->depth);
+	}
+
+	vmw_fifo_commit(dev_priv, submit_size);
+	vmw_resource_activate(res, vmw_hw_surface_destroy);
+	return 0;
+}
+
+static void vmw_user_surface_free(struct vmw_resource *res)
+{
+	struct vmw_surface *srf = container_of(res, struct vmw_surface, res);
+	struct vmw_user_surface *user_srf =
+	    container_of(srf, struct vmw_user_surface, srf);
+
+	kfree(srf->sizes);
+	kfree(srf->snooper.image);
+	kfree(user_srf);
+}
+
+int vmw_user_surface_lookup_handle(struct vmw_private *dev_priv,
+				   struct ttm_object_file *tfile,
+				   uint32_t handle, struct vmw_surface **out)
+{
+	struct vmw_resource *res;
+	struct vmw_surface *srf;
+	struct vmw_user_surface *user_srf;
+	struct ttm_base_object *base;
+	int ret = -EINVAL;
+
+	base = ttm_base_object_lookup(tfile, handle);
+	if (unlikely(base == NULL))
+		return -EINVAL;
+
+	if (unlikely(base->object_type != VMW_RES_SURFACE))
+		goto out_bad_resource;
+
+	user_srf = container_of(base, struct vmw_user_surface, base);
+	srf = &user_srf->srf;
+	res = &srf->res;
+
+	read_lock(&dev_priv->resource_lock);
+
+	if (!res->avail || res->res_free != &vmw_user_surface_free) {
+		read_unlock(&dev_priv->resource_lock);
+		goto out_bad_resource;
+	}
+
+	kref_get(&res->kref);
+	read_unlock(&dev_priv->resource_lock);
+
+	*out = srf;
+	ret = 0;
+
+out_bad_resource:
+	ttm_base_object_unref(&base);
+
+	return ret;
+}
+
+static void vmw_user_surface_base_release(struct ttm_base_object **p_base)
+{
+	struct ttm_base_object *base = *p_base;
+	struct vmw_user_surface *user_srf =
+	    container_of(base, struct vmw_user_surface, base);
+	struct vmw_resource *res = &user_srf->srf.res;
+
+	*p_base = NULL;
+	vmw_resource_unreference(&res);
+}
+
+int vmw_surface_destroy_ioctl(struct drm_device *dev, void *data,
+			      struct drm_file *file_priv)
+{
+	struct drm_vmw_surface_arg *arg = (struct drm_vmw_surface_arg *)data;
+	struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
+
+	return ttm_ref_object_base_unref(tfile, arg->sid, TTM_REF_USAGE);
+}
+
+int vmw_surface_define_ioctl(struct drm_device *dev, void *data,
+			     struct drm_file *file_priv)
+{
+	struct vmw_private *dev_priv = vmw_priv(dev);
+	struct vmw_user_surface *user_srf =
+	    kmalloc(sizeof(*user_srf), GFP_KERNEL);
+	struct vmw_surface *srf;
+	struct vmw_resource *res;
+	struct vmw_resource *tmp;
+	union drm_vmw_surface_create_arg *arg =
+	    (union drm_vmw_surface_create_arg *)data;
+	struct drm_vmw_surface_create_req *req = &arg->req;
+	struct drm_vmw_surface_arg *rep = &arg->rep;
+	struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
+	struct drm_vmw_size __user *user_sizes;
+	int ret;
+	int i;
+
+	if (unlikely(user_srf == NULL))
+		return -ENOMEM;
+
+	srf = &user_srf->srf;
+	res = &srf->res;
+
+	srf->flags = req->flags;
+	srf->format = req->format;
+	memcpy(srf->mip_levels, req->mip_levels, sizeof(srf->mip_levels));
+	srf->num_sizes = 0;
+	for (i = 0; i < DRM_VMW_MAX_SURFACE_FACES; ++i)
+		srf->num_sizes += srf->mip_levels[i];
+
+	if (srf->num_sizes > DRM_VMW_MAX_SURFACE_FACES *
+	    DRM_VMW_MAX_MIP_LEVELS) {
+		ret = -EINVAL;
+		goto out_err0;
+	}
+
+	srf->sizes = kmalloc(srf->num_sizes * sizeof(*srf->sizes), GFP_KERNEL);
+	if (unlikely(srf->sizes == NULL)) {
+		ret = -ENOMEM;
+		goto out_err0;
+	}
+
+	user_sizes = (struct drm_vmw_size __user *)(unsigned long)
+	    req->size_addr;
+
+	ret = copy_from_user(srf->sizes, user_sizes,
+			     srf->num_sizes * sizeof(*srf->sizes));
+	if (unlikely(ret != 0))
+		goto out_err1;
+
+	user_srf->base.shareable = false;
+	user_srf->base.tfile = NULL;
+
+	/**
+	 * From this point, the generic resource management functions
+	 * destroy the object on failure.
+	 */
+
+	ret = vmw_surface_init(dev_priv, srf, vmw_user_surface_free);
+	if (unlikely(ret != 0))
+		return ret;
+
+	tmp = vmw_resource_reference(&srf->res);
+	ret = ttm_base_object_init(tfile, &user_srf->base,
+				   req->shareable, VMW_RES_SURFACE,
+				   &vmw_user_surface_base_release, NULL);
+
+	if (unlikely(ret != 0)) {
+		vmw_resource_unreference(&tmp);
+		vmw_resource_unreference(&res);
+		return ret;
+	}
+
+	if (srf->flags & (1 << 9) &&
+	    srf->num_sizes == 1 &&
+	    srf->sizes[0].width == 64 &&
+	    srf->sizes[0].height == 64 &&
+	    srf->format == SVGA3D_A8R8G8B8) {
+
+		srf->snooper.image = kmalloc(64 * 64 * 4, GFP_KERNEL);
+		/* clear the image */
+		if (srf->snooper.image)
+			memset(srf->snooper.image, 0x00, 64 * 64 * 4);
+		else
+			DRM_ERROR("Failed to allocate cursor_image\n");
+
+	} else {
+		srf->snooper.image = NULL;
+	}
+	srf->snooper.crtc = NULL;
+
+	rep->sid = user_srf->base.hash.key;
+	if (rep->sid == SVGA3D_INVALID_ID)
+		DRM_ERROR("Created bad Surface ID.\n");
+
+	vmw_resource_unreference(&res);
+	return 0;
+out_err1:
+	kfree(srf->sizes);
+out_err0:
+	kfree(user_srf);
+	return ret;
+}
+
+int vmw_surface_reference_ioctl(struct drm_device *dev, void *data,
+				struct drm_file *file_priv)
+{
+	union drm_vmw_surface_reference_arg *arg =
+	    (union drm_vmw_surface_reference_arg *)data;
+	struct drm_vmw_surface_arg *req = &arg->req;
+	struct drm_vmw_surface_create_req *rep = &arg->rep;
+	struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
+	struct vmw_surface *srf;
+	struct vmw_user_surface *user_srf;
+	struct drm_vmw_size __user *user_sizes;
+	struct ttm_base_object *base;
+	int ret = -EINVAL;
+
+	base = ttm_base_object_lookup(tfile, req->sid);
+	if (unlikely(base == NULL)) {
+		DRM_ERROR("Could not find surface to reference.\n");
+		return -EINVAL;
+	}
+
+	if (unlikely(base->object_type != VMW_RES_SURFACE))
+		goto out_bad_resource;
+
+	user_srf = container_of(base, struct vmw_user_surface, base);
+	srf = &user_srf->srf;
+
+	ret = ttm_ref_object_add(tfile, &user_srf->base, TTM_REF_USAGE, NULL);
+	if (unlikely(ret != 0)) {
+		DRM_ERROR("Could not add a reference to a surface.\n");
+		goto out_no_reference;
+	}
+
+	rep->flags = srf->flags;
+	rep->format = srf->format;
+	memcpy(rep->mip_levels, srf->mip_levels, sizeof(srf->mip_levels));
+	user_sizes = (struct drm_vmw_size __user *)(unsigned long)
+	    rep->size_addr;
+
+	if (user_sizes)
+		ret = copy_to_user(user_sizes, srf->sizes,
+				   srf->num_sizes * sizeof(*srf->sizes));
+	if (unlikely(ret != 0))
+		DRM_ERROR("copy_to_user failed %p %u\n",
+			  user_sizes, srf->num_sizes);
+out_bad_resource:
+out_no_reference:
+	ttm_base_object_unref(&base);
+
+	return ret;
+}
+
+int vmw_surface_check(struct vmw_private *dev_priv,
+		      struct ttm_object_file *tfile,
+		      uint32_t handle, int *id)
+{
+	struct ttm_base_object *base;
+	struct vmw_user_surface *user_srf;
+
+	int ret = -EPERM;
+
+	base = ttm_base_object_lookup(tfile, handle);
+	if (unlikely(base == NULL))
+		return -EINVAL;
+
+	if (unlikely(base->object_type != VMW_RES_SURFACE))
+		goto out_bad_surface;
+
+	user_srf = container_of(base, struct vmw_user_surface, base);
+	*id = user_srf->srf.res.id;
+	ret = 0;
+
+out_bad_surface:
+	/**
+	 * FIXME: May deadlock here when called from the
+	 * command parsing code.
+	 */
+
+	ttm_base_object_unref(&base);
+	return ret;
+}
+
+/**
+ * Buffer management.
+ */
+
+static size_t vmw_dmabuf_acc_size(struct ttm_bo_global *glob,
+				  unsigned long num_pages)
+{
+	static size_t bo_user_size = ~0;
+
+	size_t page_array_size =
+	    (num_pages * sizeof(void *) + PAGE_SIZE - 1) & PAGE_MASK;
+
+	if (unlikely(bo_user_size == ~0)) {
+		bo_user_size = glob->ttm_bo_extra_size +
+		    ttm_round_pot(sizeof(struct vmw_dma_buffer));
+	}
+
+	return bo_user_size + page_array_size;
+}
+
+void vmw_dmabuf_bo_free(struct ttm_buffer_object *bo)
+{
+	struct vmw_dma_buffer *vmw_bo = vmw_dma_buffer(bo);
+	struct ttm_bo_global *glob = bo->glob;
+	struct vmw_private *dev_priv =
+		container_of(bo->bdev, struct vmw_private, bdev);
+
+	ttm_mem_global_free(glob->mem_glob, bo->acc_size);
+	if (vmw_bo->gmr_bound) {
+		vmw_gmr_unbind(dev_priv, vmw_bo->gmr_id);
+		spin_lock(&glob->lru_lock);
+		ida_remove(&dev_priv->gmr_ida, vmw_bo->gmr_id);
+		spin_unlock(&glob->lru_lock);
+	}
+	kfree(vmw_bo);
+}
+
+int vmw_dmabuf_init(struct vmw_private *dev_priv,
+		    struct vmw_dma_buffer *vmw_bo,
+		    size_t size, struct ttm_placement *placement,
+		    bool interruptible,
+		    void (*bo_free) (struct ttm_buffer_object *bo))
+{
+	struct ttm_bo_device *bdev = &dev_priv->bdev;
+	struct ttm_mem_global *mem_glob = bdev->glob->mem_glob;
+	size_t acc_size;
+	int ret;
+
+	BUG_ON(!bo_free);
+
+	acc_size =
+	    vmw_dmabuf_acc_size(bdev->glob,
+				(size + PAGE_SIZE - 1) >> PAGE_SHIFT);
+
+	ret = ttm_mem_global_alloc(mem_glob, acc_size, false, false);
+	if (unlikely(ret != 0)) {
+		/* we must free the bo here as
+		 * ttm_buffer_object_init does so as well */
+		bo_free(&vmw_bo->base);
+		return ret;
+	}
+
+	memset(vmw_bo, 0, sizeof(*vmw_bo));
+
+	INIT_LIST_HEAD(&vmw_bo->gmr_lru);
+	INIT_LIST_HEAD(&vmw_bo->validate_list);
+	vmw_bo->gmr_id = 0;
+	vmw_bo->gmr_bound = false;
+
+	ret = ttm_bo_init(bdev, &vmw_bo->base, size,
+			  ttm_bo_type_device, placement,
+			  0, 0, interruptible,
+			  NULL, acc_size, bo_free);
+	return ret;
+}
+
+static void vmw_user_dmabuf_destroy(struct ttm_buffer_object *bo)
+{
+	struct vmw_user_dma_buffer *vmw_user_bo = vmw_user_dma_buffer(bo);
+	struct vmw_dma_buffer *vmw_bo = &vmw_user_bo->dma;
+	struct ttm_bo_global *glob = bo->glob;
+	struct vmw_private *dev_priv =
+		container_of(bo->bdev, struct vmw_private, bdev);
+
+	ttm_mem_global_free(glob->mem_glob, bo->acc_size);
+	if (vmw_bo->gmr_bound) {
+		vmw_gmr_unbind(dev_priv, vmw_bo->gmr_id);
+		spin_lock(&glob->lru_lock);
+		ida_remove(&dev_priv->gmr_ida, vmw_bo->gmr_id);
+		spin_unlock(&glob->lru_lock);
+	}
+	kfree(vmw_user_bo);
+}
+
+static void vmw_user_dmabuf_release(struct ttm_base_object **p_base)
+{
+	struct vmw_user_dma_buffer *vmw_user_bo;
+	struct ttm_base_object *base = *p_base;
+	struct ttm_buffer_object *bo;
+
+	*p_base = NULL;
+
+	if (unlikely(base == NULL))
+		return;
+
+	vmw_user_bo = container_of(base, struct vmw_user_dma_buffer, base);
+	bo = &vmw_user_bo->dma.base;
+	ttm_bo_unref(&bo);
+}
+
+int vmw_dmabuf_alloc_ioctl(struct drm_device *dev, void *data,
+			   struct drm_file *file_priv)
+{
+	struct vmw_private *dev_priv = vmw_priv(dev);
+	union drm_vmw_alloc_dmabuf_arg *arg =
+	    (union drm_vmw_alloc_dmabuf_arg *)data;
+	struct drm_vmw_alloc_dmabuf_req *req = &arg->req;
+	struct drm_vmw_dmabuf_rep *rep = &arg->rep;
+	struct vmw_user_dma_buffer *vmw_user_bo;
+	struct ttm_buffer_object *tmp;
+	struct vmw_master *vmaster = vmw_master(file_priv->master);
+	int ret;
+
+	vmw_user_bo = kzalloc(sizeof(*vmw_user_bo), GFP_KERNEL);
+	if (unlikely(vmw_user_bo == NULL))
+		return -ENOMEM;
+
+	ret = ttm_read_lock(&vmaster->lock, true);
+	if (unlikely(ret != 0)) {
+		kfree(vmw_user_bo);
+		return ret;
+	}
+
+	ret = vmw_dmabuf_init(dev_priv, &vmw_user_bo->dma, req->size,
+			      &vmw_vram_placement, true,
+			      &vmw_user_dmabuf_destroy);
+	if (unlikely(ret != 0))
+		return ret;
+
+	tmp = ttm_bo_reference(&vmw_user_bo->dma.base);
+	ret = ttm_base_object_init(vmw_fpriv(file_priv)->tfile,
+				   &vmw_user_bo->base,
+				   false,
+				   ttm_buffer_type,
+				   &vmw_user_dmabuf_release, NULL);
+	if (unlikely(ret != 0)) {
+		ttm_bo_unref(&tmp);
+	} else {
+		rep->handle = vmw_user_bo->base.hash.key;
+		rep->map_handle = vmw_user_bo->dma.base.addr_space_offset;
+		rep->cur_gmr_id = vmw_user_bo->base.hash.key;
+		rep->cur_gmr_offset = 0;
+	}
+	ttm_bo_unref(&tmp);
+
+	ttm_read_unlock(&vmaster->lock);
+
+	return 0;
+}
+
+int vmw_dmabuf_unref_ioctl(struct drm_device *dev, void *data,
+			   struct drm_file *file_priv)
+{
+	struct drm_vmw_unref_dmabuf_arg *arg =
+	    (struct drm_vmw_unref_dmabuf_arg *)data;
+
+	return ttm_ref_object_base_unref(vmw_fpriv(file_priv)->tfile,
+					 arg->handle,
+					 TTM_REF_USAGE);
+}
+
+uint32_t vmw_dmabuf_validate_node(struct ttm_buffer_object *bo,
+				  uint32_t cur_validate_node)
+{
+	struct vmw_dma_buffer *vmw_bo = vmw_dma_buffer(bo);
+
+	if (likely(vmw_bo->on_validate_list))
+		return vmw_bo->cur_validate_node;
+
+	vmw_bo->cur_validate_node = cur_validate_node;
+	vmw_bo->on_validate_list = true;
+
+	return cur_validate_node;
+}
+
+void vmw_dmabuf_validate_clear(struct ttm_buffer_object *bo)
+{
+	struct vmw_dma_buffer *vmw_bo = vmw_dma_buffer(bo);
+
+	vmw_bo->on_validate_list = false;
+}
+
+uint32_t vmw_dmabuf_gmr(struct ttm_buffer_object *bo)
+{
+	struct vmw_dma_buffer *vmw_bo;
+
+	if (bo->mem.mem_type == TTM_PL_VRAM)
+		return SVGA_GMR_FRAMEBUFFER;
+
+	vmw_bo = vmw_dma_buffer(bo);
+
+	return (vmw_bo->gmr_bound) ? vmw_bo->gmr_id : SVGA_GMR_NULL;
+}
+
+void vmw_dmabuf_set_gmr(struct ttm_buffer_object *bo, uint32_t id)
+{
+	struct vmw_dma_buffer *vmw_bo = vmw_dma_buffer(bo);
+	vmw_bo->gmr_bound = true;
+	vmw_bo->gmr_id = id;
+}
+
+int vmw_user_dmabuf_lookup(struct ttm_object_file *tfile,
+			   uint32_t handle, struct vmw_dma_buffer **out)
+{
+	struct vmw_user_dma_buffer *vmw_user_bo;
+	struct ttm_base_object *base;
+
+	base = ttm_base_object_lookup(tfile, handle);
+	if (unlikely(base == NULL)) {
+		printk(KERN_ERR "Invalid buffer object handle 0x%08lx.\n",
+		       (unsigned long)handle);
+		return -ESRCH;
+	}
+
+	if (unlikely(base->object_type != ttm_buffer_type)) {
+		ttm_base_object_unref(&base);
+		printk(KERN_ERR "Invalid buffer object handle 0x%08lx.\n",
+		       (unsigned long)handle);
+		return -EINVAL;
+	}
+
+	vmw_user_bo = container_of(base, struct vmw_user_dma_buffer, base);
+	(void)ttm_bo_reference(&vmw_user_bo->dma.base);
+	ttm_base_object_unref(&base);
+	*out = &vmw_user_bo->dma;
+
+	return 0;
+}
+
+/**
+ * TODO: Implement a gmr id eviction mechanism. Currently we just fail
+ * when we're out of ids, causing GMR space to be allocated
+ * out of VRAM.
+ */
+
+int vmw_gmr_id_alloc(struct vmw_private *dev_priv, uint32_t *p_id)
+{
+	struct ttm_bo_global *glob = dev_priv->bdev.glob;
+	int id;
+	int ret;
+
+	do {
+		if (unlikely(ida_pre_get(&dev_priv->gmr_ida, GFP_KERNEL) == 0))
+			return -ENOMEM;
+
+		spin_lock(&glob->lru_lock);
+		ret = ida_get_new(&dev_priv->gmr_ida, &id);
+		spin_unlock(&glob->lru_lock);
+	} while (ret == -EAGAIN);
+
+	if (unlikely(ret != 0))
+		return ret;
+
+	if (unlikely(id >= dev_priv->max_gmr_ids)) {
+		spin_lock(&glob->lru_lock);
+		ida_remove(&dev_priv->gmr_ida, id);
+		spin_unlock(&glob->lru_lock);
+		return -EBUSY;
+	}
+
+	*p_id = (uint32_t) id;
+	return 0;
+}
+
+/*
+ * Stream managment
+ */
+
+static void vmw_stream_destroy(struct vmw_resource *res)
+{
+	struct vmw_private *dev_priv = res->dev_priv;
+	struct vmw_stream *stream;
+	int ret;
+
+	DRM_INFO("%s: unref\n", __func__);
+	stream = container_of(res, struct vmw_stream, res);
+
+	ret = vmw_overlay_unref(dev_priv, stream->stream_id);
+	WARN_ON(ret != 0);
+}
+
+static int vmw_stream_init(struct vmw_private *dev_priv,
+			   struct vmw_stream *stream,
+			   void (*res_free) (struct vmw_resource *res))
+{
+	struct vmw_resource *res = &stream->res;
+	int ret;
+
+	ret = vmw_resource_init(dev_priv, res, &dev_priv->stream_idr,
+				VMW_RES_STREAM, res_free);
+
+	if (unlikely(ret != 0)) {
+		if (res_free == NULL)
+			kfree(stream);
+		else
+			res_free(&stream->res);
+		return ret;
+	}
+
+	ret = vmw_overlay_claim(dev_priv, &stream->stream_id);
+	if (ret) {
+		vmw_resource_unreference(&res);
+		return ret;
+	}
+
+	DRM_INFO("%s: claimed\n", __func__);
+
+	vmw_resource_activate(&stream->res, vmw_stream_destroy);
+	return 0;
+}
+
+/**
+ * User-space context management:
+ */
+
+static void vmw_user_stream_free(struct vmw_resource *res)
+{
+	struct vmw_user_stream *stream =
+	    container_of(res, struct vmw_user_stream, stream.res);
+
+	kfree(stream);
+}
+
+/**
+ * This function is called when user space has no more references on the
+ * base object. It releases the base-object's reference on the resource object.
+ */
+
+static void vmw_user_stream_base_release(struct ttm_base_object **p_base)
+{
+	struct ttm_base_object *base = *p_base;
+	struct vmw_user_stream *stream =
+	    container_of(base, struct vmw_user_stream, base);
+	struct vmw_resource *res = &stream->stream.res;
+
+	*p_base = NULL;
+	vmw_resource_unreference(&res);
+}
+
+int vmw_stream_unref_ioctl(struct drm_device *dev, void *data,
+			   struct drm_file *file_priv)
+{
+	struct vmw_private *dev_priv = vmw_priv(dev);
+	struct vmw_resource *res;
+	struct vmw_user_stream *stream;
+	struct drm_vmw_stream_arg *arg = (struct drm_vmw_stream_arg *)data;
+	struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
+	int ret = 0;
+
+	res = vmw_resource_lookup(dev_priv, &dev_priv->stream_idr, arg->stream_id);
+	if (unlikely(res == NULL))
+		return -EINVAL;
+
+	if (res->res_free != &vmw_user_stream_free) {
+		ret = -EINVAL;
+		goto out;
+	}
+
+	stream = container_of(res, struct vmw_user_stream, stream.res);
+	if (stream->base.tfile != tfile) {
+		ret = -EINVAL;
+		goto out;
+	}
+
+	ttm_ref_object_base_unref(tfile, stream->base.hash.key, TTM_REF_USAGE);
+out:
+	vmw_resource_unreference(&res);
+	return ret;
+}
+
+int vmw_stream_claim_ioctl(struct drm_device *dev, void *data,
+			   struct drm_file *file_priv)
+{
+	struct vmw_private *dev_priv = vmw_priv(dev);
+	struct vmw_user_stream *stream = kmalloc(sizeof(*stream), GFP_KERNEL);
+	struct vmw_resource *res;
+	struct vmw_resource *tmp;
+	struct drm_vmw_stream_arg *arg = (struct drm_vmw_stream_arg *)data;
+	struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
+	int ret;
+
+	if (unlikely(stream == NULL))
+		return -ENOMEM;
+
+	res = &stream->stream.res;
+	stream->base.shareable = false;
+	stream->base.tfile = NULL;
+
+	ret = vmw_stream_init(dev_priv, &stream->stream, vmw_user_stream_free);
+	if (unlikely(ret != 0))
+		return ret;
+
+	tmp = vmw_resource_reference(res);
+	ret = ttm_base_object_init(tfile, &stream->base, false, VMW_RES_STREAM,
+				   &vmw_user_stream_base_release, NULL);
+
+	if (unlikely(ret != 0)) {
+		vmw_resource_unreference(&tmp);
+		goto out_err;
+	}
+
+	arg->stream_id = res->id;
+out_err:
+	vmw_resource_unreference(&res);
+	return ret;
+}
+
+int vmw_user_stream_lookup(struct vmw_private *dev_priv,
+			   struct ttm_object_file *tfile,
+			   uint32_t *inout_id, struct vmw_resource **out)
+{
+	struct vmw_user_stream *stream;
+	struct vmw_resource *res;
+	int ret;
+
+	res = vmw_resource_lookup(dev_priv, &dev_priv->stream_idr, *inout_id);
+	if (unlikely(res == NULL))
+		return -EINVAL;
+
+	if (res->res_free != &vmw_user_stream_free) {
+		ret = -EINVAL;
+		goto err_ref;
+	}
+
+	stream = container_of(res, struct vmw_user_stream, stream.res);
+	if (stream->base.tfile != tfile) {
+		ret = -EPERM;
+		goto err_ref;
+	}
+
+	*inout_id = stream->stream.stream_id;
+	*out = res;
+	return 0;
+err_ref:
+	vmw_resource_unreference(&res);
+	return ret;
+}
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ttm_glue.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ttm_glue.c
new file mode 100644
index 000000000000..e3df4adfb4d8
--- /dev/null
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ttm_glue.c
@@ -0,0 +1,99 @@
+/**************************************************************************
+ *
+ * Copyright © 2009 VMware, Inc., Palo Alto, CA., USA
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sub license, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ * USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ **************************************************************************/
+
+#include "drmP.h"
+#include "vmwgfx_drv.h"
+
+int vmw_mmap(struct file *filp, struct vm_area_struct *vma)
+{
+	struct drm_file *file_priv;
+	struct vmw_private *dev_priv;
+
+	if (unlikely(vma->vm_pgoff < VMWGFX_FILE_PAGE_OFFSET)) {
+		if (vmw_fifo_mmap(filp, vma) == 0)
+			return 0;
+		return drm_mmap(filp, vma);
+	}
+
+	file_priv = (struct drm_file *)filp->private_data;
+	dev_priv = vmw_priv(file_priv->minor->dev);
+	return ttm_bo_mmap(filp, vma, &dev_priv->bdev);
+}
+
+static int vmw_ttm_mem_global_init(struct ttm_global_reference *ref)
+{
+	DRM_INFO("global init.\n");
+	return ttm_mem_global_init(ref->object);
+}
+
+static void vmw_ttm_mem_global_release(struct ttm_global_reference *ref)
+{
+	ttm_mem_global_release(ref->object);
+}
+
+int vmw_ttm_global_init(struct vmw_private *dev_priv)
+{
+	struct ttm_global_reference *global_ref;
+	int ret;
+
+	global_ref = &dev_priv->mem_global_ref;
+	global_ref->global_type = TTM_GLOBAL_TTM_MEM;
+	global_ref->size = sizeof(struct ttm_mem_global);
+	global_ref->init = &vmw_ttm_mem_global_init;
+	global_ref->release = &vmw_ttm_mem_global_release;
+
+	ret = ttm_global_item_ref(global_ref);
+	if (unlikely(ret != 0)) {
+		DRM_ERROR("Failed setting up TTM memory accounting.\n");
+		return ret;
+	}
+
+	dev_priv->bo_global_ref.mem_glob =
+		dev_priv->mem_global_ref.object;
+	global_ref = &dev_priv->bo_global_ref.ref;
+	global_ref->global_type = TTM_GLOBAL_TTM_BO;
+	global_ref->size = sizeof(struct ttm_bo_global);
+	global_ref->init = &ttm_bo_global_init;
+	global_ref->release = &ttm_bo_global_release;
+		ret = ttm_global_item_ref(global_ref);
+
+	if (unlikely(ret != 0)) {
+		DRM_ERROR("Failed setting up TTM buffer objects.\n");
+		goto out_no_bo;
+	}
+
+	return 0;
+out_no_bo:
+	ttm_global_item_unref(&dev_priv->mem_global_ref);
+	return ret;
+}
+
+void vmw_ttm_global_release(struct vmw_private *dev_priv)
+{
+	ttm_global_item_unref(&dev_priv->bo_global_ref.ref);
+	ttm_global_item_unref(&dev_priv->mem_global_ref);
+}
diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
index 4b96e7a898cf..5b4d66dc1a05 100644
--- a/drivers/hid/hid-apple.c
+++ b/drivers/hid/hid-apple.c
@@ -431,6 +431,13 @@ static const struct hid_device_id apple_devices[] = {
 		.driver_data = APPLE_HAS_FN | APPLE_ISO_KEYBOARD },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_JIS),
 		.driver_data = APPLE_HAS_FN | APPLE_RDESC_JIS },
+	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ANSI),
+		.driver_data = APPLE_NUMLOCK_EMULATION | APPLE_HAS_FN },
+	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ISO),
+		.driver_data = APPLE_NUMLOCK_EMULATION | APPLE_HAS_FN |
+			APPLE_ISO_KEYBOARD },
+	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_JIS),
+		.driver_data = APPLE_NUMLOCK_EMULATION | APPLE_HAS_FN },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY),
 		.driver_data = APPLE_NUMLOCK_EMULATION | APPLE_HAS_FN },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY),
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 7d05c4bb201e..eabe5f87c6c1 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -39,8 +39,6 @@
  * Version Information
  */
 
-#define DRIVER_VERSION "v2.6"
-#define DRIVER_AUTHOR "Andreas Gal, Vojtech Pavlik, Jiri Kosina"
 #define DRIVER_DESC "HID core driver"
 #define DRIVER_LICENSE "GPL"
 
@@ -1287,6 +1285,9 @@ static const struct hid_device_id hid_blacklist[] = {
 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_ANSI) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_ISO) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING3_JIS) },
+	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ANSI) },
+	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ISO) },
+	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_JIS) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_BELKIN, USB_DEVICE_ID_FLIP_KVM) },
@@ -1294,6 +1295,7 @@ static const struct hid_device_id hid_blacklist[] = {
 	{ HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_TACTICAL_PAD) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_BARCODE_1) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_BARCODE_2) },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_BARCODE_3) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_MOUSE) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, 0x0006) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_EZKEY, USB_DEVICE_ID_BTC_8193) },
@@ -1326,6 +1328,8 @@ static const struct hid_device_id hid_blacklist[] = {
 	{ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_MOMO_WHEEL2) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_G25_WHEEL) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_RUMBLEPAD2) },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_SPACETRAVELLER) },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_SPACENAVIGATOR) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_SIDEWINDER_GV) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_NE4K) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_LK6K) },
@@ -1552,6 +1556,7 @@ static const struct hid_device_id hid_ignore_list[] = {
 	{ HID_USB_DEVICE(USB_VENDOR_ID_DELORME, USB_DEVICE_ID_DELORME_EARTHMATE) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_DELORME, USB_DEVICE_ID_DELORME_EM_LT20) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_ESSENTIAL_REALITY, USB_DEVICE_ID_ESSENTIAL_REALITY_P5) },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_ETT, USB_DEVICE_ID_TC5UH) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_GENERAL_TOUCH, 0x0001) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_GENERAL_TOUCH, 0x0002) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_GENERAL_TOUCH, 0x0003) },
@@ -1620,6 +1625,7 @@ static const struct hid_device_id hid_ignore_list[] = {
 	{ HID_USB_DEVICE(USB_VENDOR_ID_KBGEAR, USB_DEVICE_ID_KBGEAR_JAMSTUDIO) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_KWORLD, USB_DEVICE_ID_KWORLD_RADIO_FM700) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_GPEN_560) },
+	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_KYE, 0x0058) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_CASSY) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_POCKETCASSY) },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MOBILECASSY) },
@@ -1918,5 +1924,8 @@ static void __exit hid_exit(void)
 module_init(hid_init);
 module_exit(hid_exit);
 
+MODULE_AUTHOR("Andreas Gal");
+MODULE_AUTHOR("Vojtech Pavlik");
+MODULE_AUTHOR("Jiri Kosina");
 MODULE_LICENSE(DRIVER_LICENSE);
 
diff --git a/drivers/hid/hid-cypress.c b/drivers/hid/hid-cypress.c
index 62e9cb10e88c..998b6f443d7d 100644
--- a/drivers/hid/hid-cypress.c
+++ b/drivers/hid/hid-cypress.c
@@ -126,6 +126,8 @@ static const struct hid_device_id cp_devices[] = {
 		.driver_data = CP_RDESC_SWAPPED_MIN_MAX },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_BARCODE_2),
 		.driver_data = CP_RDESC_SWAPPED_MIN_MAX },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_BARCODE_3),
+		.driver_data = CP_RDESC_SWAPPED_MIN_MAX },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_MOUSE),
 		.driver_data = CP_2WHEEL_MOUSE_HACK },
 	{ }
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index adbef5d069c4..010368e649ed 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -88,6 +88,9 @@
 #define USB_DEVICE_ID_APPLE_WELLSPRING3_ANSI	0x0236
 #define USB_DEVICE_ID_APPLE_WELLSPRING3_ISO	0x0237
 #define USB_DEVICE_ID_APPLE_WELLSPRING3_JIS	0x0238
+#define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ANSI  0x0239
+#define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ISO   0x023a
+#define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_JIS   0x023b
 #define USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY	0x030a
 #define USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY	0x030b
 #define USB_DEVICE_ID_APPLE_ATV_IRCONTROL	0x8241
@@ -117,6 +120,7 @@
 #define USB_DEVICE_ID_CH_PRO_PEDALS	0x00f2
 #define USB_DEVICE_ID_CH_COMBATSTICK	0x00f4
 #define USB_DEVICE_ID_CH_FLIGHT_SIM_YOKE	0x00ff
+#define USB_DEVICE_ID_CH_3AXIS_5BUTTON_STICK	0x00d3
 
 #define USB_VENDOR_ID_CHERRY		0x046a
 #define USB_DEVICE_ID_CHERRY_CYMOTION	0x0023
@@ -145,6 +149,7 @@
 #define USB_DEVICE_ID_CYPRESS_ULTRAMOUSE	0x7417
 #define USB_DEVICE_ID_CYPRESS_BARCODE_1	0xde61
 #define USB_DEVICE_ID_CYPRESS_BARCODE_2	0xde64
+#define USB_DEVICE_ID_CYPRESS_BARCODE_3	0xbca1
 
 #define USB_VENDOR_ID_DEALEXTREAME	0x10c5
 #define USB_DEVICE_ID_DEALEXTREAME_RADIO_SI4701	0x819a
@@ -164,6 +169,9 @@
 #define USB_VENDOR_ID_ESSENTIAL_REALITY	0x0d7f
 #define USB_DEVICE_ID_ESSENTIAL_REALITY_P5 0x0100
 
+#define USB_VENDOR_ID_ETT		0x0664
+#define USB_DEVICE_ID_TC5UH		0x0309
+
 #define USB_VENDOR_ID_EZKEY 		0x0518
 #define USB_DEVICE_ID_BTC_8193		0x0002
 
@@ -304,6 +312,8 @@
 #define USB_DEVICE_ID_S510_RECEIVER_2	0xc517
 #define USB_DEVICE_ID_LOGITECH_CORDLESS_DESKTOP_LX500	0xc512
 #define USB_DEVICE_ID_MX3000_RECEIVER	0xc513
+#define USB_DEVICE_ID_SPACETRAVELLER	0xc623
+#define USB_DEVICE_ID_SPACENAVIGATOR	0xc626
 #define USB_DEVICE_ID_DINOVO_DESKTOP	0xc704
 #define USB_DEVICE_ID_DINOVO_EDGE	0xc714
 #define USB_DEVICE_ID_DINOVO_MINI	0xc71f
@@ -346,6 +356,9 @@
 #define USB_VENDOR_ID_NEC		0x073e
 #define USB_DEVICE_ID_NEC_USB_GAME_PAD	0x0301
 
+#define USB_VENDOR_ID_NEXTWINDOW	0x1926
+#define USB_DEVICE_ID_NEXTWINDOW_TOUCHSCREEN	0x0003
+
 #define USB_VENDOR_ID_NTRIG                0x1b96
 #define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN   0x0001
 
diff --git a/drivers/hid/hid-lg.c b/drivers/hid/hid-lg.c
index 0f870a3243ed..9fcd3d017ab3 100644
--- a/drivers/hid/hid-lg.c
+++ b/drivers/hid/hid-lg.c
@@ -33,6 +33,7 @@
 #define LG_NOGET		0x100
 #define LG_FF			0x200
 #define LG_FF2			0x400
+#define LG_RDESC_REL_ABS	0x800
 
 /*
  * Certain Logitech keyboards send in report #3 keys which are far
@@ -51,6 +52,13 @@ static void lg_report_fixup(struct hid_device *hdev, __u8 *rdesc,
 		rdesc[84] = rdesc[89] = 0x4d;
 		rdesc[85] = rdesc[90] = 0x10;
 	}
+	if ((quirks & LG_RDESC_REL_ABS) && rsize >= 50 &&
+			rdesc[32] == 0x81 && rdesc[33] == 0x06 &&
+			rdesc[49] == 0x81 && rdesc[50] == 0x06) {
+		dev_info(&hdev->dev, "fixing up rel/abs in Logitech "
+				"report descriptor\n");
+		rdesc[33] = rdesc[50] = 0x02;
+	}
 }
 
 #define lg_map_key_clear(c)	hid_map_usage_clear(hi, usage, bit, max, \
@@ -89,6 +97,22 @@ static int lg_ultrax_remote_mapping(struct hid_input *hi,
 	return 1;
 }
 
+static int lg_dinovo_mapping(struct hid_input *hi, struct hid_usage *usage,
+		unsigned long **bit, int *max)
+{
+	if ((usage->hid & HID_USAGE_PAGE) != HID_UP_LOGIVENDOR)
+		return 0;
+
+	switch (usage->hid & HID_USAGE) {
+
+	case 0x00d: lg_map_key_clear(KEY_MEDIA);	break;
+	default:
+		return 0;
+
+	}
+	return 1;
+}
+
 static int lg_wireless_mapping(struct hid_input *hi, struct hid_usage *usage,
 		unsigned long **bit, int *max)
 {
@@ -164,6 +188,10 @@ static int lg_input_mapping(struct hid_device *hdev, struct hid_input *hi,
 			lg_ultrax_remote_mapping(hi, usage, bit, max))
 		return 1;
 
+	if (hdev->product == USB_DEVICE_ID_DINOVO_MINI &&
+			lg_dinovo_mapping(hi, usage, bit, max))
+		return 1;
+
 	if ((quirks & LG_WIRELESS) && lg_wireless_mapping(hi, usage, bit, max))
 		return 1;
 
@@ -303,8 +331,13 @@ static const struct hid_device_id lg_devices[] = {
 		.driver_data = LG_FF },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_RUMBLEPAD2),
 		.driver_data = LG_FF2 },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_SPACENAVIGATOR),
+		.driver_data = LG_RDESC_REL_ABS },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_SPACETRAVELLER),
+		.driver_data = LG_RDESC_REL_ABS },
 	{ }
 };
+
 MODULE_DEVICE_TABLE(hid, lg_devices);
 
 static struct hid_driver lg_driver = {
diff --git a/drivers/hid/hid-lg.h b/drivers/hid/hid-lg.h
index 27ae750ca878..bf31592eaf79 100644
--- a/drivers/hid/hid-lg.h
+++ b/drivers/hid/hid-lg.h
@@ -1,8 +1,6 @@
 #ifndef __HID_LG_H
 #define __HID_LG_H
 
-#include <linux/autoconf.h>
-
 #ifdef CONFIG_LOGITECH_FF
 int lgff_init(struct hid_device *hdev);
 #else
diff --git a/drivers/hid/hid-samsung.c b/drivers/hid/hid-samsung.c
index 5b222eed0692..510dd1340597 100644
--- a/drivers/hid/hid-samsung.c
+++ b/drivers/hid/hid-samsung.c
@@ -39,7 +39,17 @@
  *
  * 3. 135 byte report descriptor
  * Report #4 has an array field with logical range 0..17 instead of 1..14.
+ *
+ * 4. 171 byte report descriptor
+ * Report #3 has an array field with logical range 0..1 instead of 1..3.
  */
+static inline void samsung_dev_trace(struct hid_device *hdev,
+		unsigned int rsize)
+{
+	dev_info(&hdev->dev, "fixing up Samsung IrDA %d byte report "
+			"descriptor\n", rsize);
+}
+
 static void samsung_report_fixup(struct hid_device *hdev, __u8 *rdesc,
 		unsigned int rsize)
 {
@@ -47,8 +57,7 @@ static void samsung_report_fixup(struct hid_device *hdev, __u8 *rdesc,
 			rdesc[177] == 0x75 && rdesc[178] == 0x30 &&
 			rdesc[179] == 0x95 && rdesc[180] == 0x01 &&
 			rdesc[182] == 0x40) {
-		dev_info(&hdev->dev, "fixing up Samsung IrDA %d byte report "
-				"descriptor\n", 184);
+		samsung_dev_trace(hdev, 184);
 		rdesc[176] = 0xff;
 		rdesc[178] = 0x08;
 		rdesc[180] = 0x06;
@@ -56,17 +65,21 @@ static void samsung_report_fixup(struct hid_device *hdev, __u8 *rdesc,
 	} else
 	if (rsize == 203 && rdesc[192] == 0x15 && rdesc[193] == 0x0 &&
 			rdesc[194] == 0x25 && rdesc[195] == 0x12) {
-		dev_info(&hdev->dev, "fixing up Samsung IrDA %d byte report "
-				"descriptor\n", 203);
+		samsung_dev_trace(hdev, 203);
 		rdesc[193] = 0x1;
 		rdesc[195] = 0xf;
 	} else
 	if (rsize == 135 && rdesc[124] == 0x15 && rdesc[125] == 0x0 &&
 			rdesc[126] == 0x25 && rdesc[127] == 0x11) {
-		dev_info(&hdev->dev, "fixing up Samsung IrDA %d byte report "
-				"descriptor\n", 135);
+		samsung_dev_trace(hdev, 135);
 		rdesc[125] = 0x1;
 		rdesc[127] = 0xe;
+	} else
+	if (rsize == 171 && rdesc[160] == 0x15 && rdesc[161] == 0x0 &&
+			rdesc[162] == 0x25 && rdesc[163] == 0x01) {
+		samsung_dev_trace(hdev, 171);
+		rdesc[161] = 0x1;
+		rdesc[163] = 0x3;
 	}
 }
 
diff --git a/drivers/hid/hid-wacom.c b/drivers/hid/hid-wacom.c
index 747542172242..12dcda529201 100644
--- a/drivers/hid/hid-wacom.c
+++ b/drivers/hid/hid-wacom.c
@@ -142,6 +142,7 @@ static int wacom_raw_event(struct hid_device *hdev, struct hid_report *report,
 		wdata->butstate = rw;
 		input_report_key(input, BTN_0, rw & 0x02);
 		input_report_key(input, BTN_1, rw & 0x01);
+		input_report_key(input, BTN_TOOL_FINGER, 0xf0);
 		input_event(input, EV_MSC, MSC_SERIAL, 0xf0);
 		input_sync(input);
 	}
@@ -196,6 +197,9 @@ static int wacom_probe(struct hid_device *hdev,
 	/* Pad */
 	input->evbit[0] |= BIT(EV_MSC);
 	input->mscbit[0] |= BIT(MSC_SERIAL);
+	set_bit(BTN_0, input->keybit);
+	set_bit(BTN_1, input->keybit);
+	set_bit(BTN_TOOL_FINGER, input->keybit);
 
 	/* Distance, rubber and mouse */
 	input->absbit[0] |= BIT(ABS_DISTANCE);
diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
index 03bd703255a3..e2997a8d5e1b 100644
--- a/drivers/hid/usbhid/hid-core.c
+++ b/drivers/hid/usbhid/hid-core.c
@@ -41,8 +41,6 @@
  * Version Information
  */
 
-#define DRIVER_VERSION "v2.6"
-#define DRIVER_AUTHOR "Andreas Gal, Vojtech Pavlik, Jiri Kosina"
 #define DRIVER_DESC "USB HID core driver"
 #define DRIVER_LICENSE "GPL"
 
@@ -998,7 +996,8 @@ static int usbhid_start(struct hid_device *hid)
 	usbhid->urbctrl->transfer_dma = usbhid->ctrlbuf_dma;
 	usbhid->urbctrl->transfer_flags |= (URB_NO_TRANSFER_DMA_MAP | URB_NO_SETUP_DMA_MAP);
 
-	usbhid_init_reports(hid);
+	if (!(hid->quirks & HID_QUIRK_NO_INIT_REPORTS))
+		usbhid_init_reports(hid);
 
 	set_bit(HID_STARTED, &usbhid->iofl);
 
@@ -1254,10 +1253,9 @@ static int hid_suspend(struct usb_interface *intf, pm_message_t message)
 {
 	struct hid_device *hid = usb_get_intfdata(intf);
 	struct usbhid_device *usbhid = hid->driver_data;
-	struct usb_device *udev = interface_to_usbdev(intf);
 	int status;
 
-	if (udev->auto_pm) {
+	if (message.event & PM_EVENT_AUTO) {
 		spin_lock_irq(&usbhid->lock);	/* Sync with error handler */
 		if (!test_bit(HID_RESET_PENDING, &usbhid->iofl)
 		    && !test_bit(HID_CLEAR_HALT, &usbhid->iofl)
@@ -1282,7 +1280,7 @@ static int hid_suspend(struct usb_interface *intf, pm_message_t message)
 			return -EIO;
 	}
 
-	if (!ignoreled && udev->auto_pm) {
+	if (!ignoreled && (message.event & PM_EVENT_AUTO)) {
 		spin_lock_irq(&usbhid->lock);
 		if (test_bit(HID_LED_ON, &usbhid->iofl)) {
 			spin_unlock_irq(&usbhid->lock);
@@ -1295,7 +1293,8 @@ static int hid_suspend(struct usb_interface *intf, pm_message_t message)
 	hid_cancel_delayed_stuff(usbhid);
 	hid_cease_io(usbhid);
 
-	if (udev->auto_pm && test_bit(HID_KEYS_PRESSED, &usbhid->iofl)) {
+	if ((message.event & PM_EVENT_AUTO) &&
+			test_bit(HID_KEYS_PRESSED, &usbhid->iofl)) {
 		/* lost race against keypresses */
 		status = hid_start_in(hid);
 		if (status < 0)
@@ -1395,8 +1394,7 @@ static int __init hid_init(void)
 	retval = usb_register(&hid_driver);
 	if (retval)
 		goto usb_register_fail;
-	printk(KERN_INFO KBUILD_MODNAME ": " DRIVER_VERSION ":"
-			DRIVER_DESC "\n");
+	printk(KERN_INFO KBUILD_MODNAME ": " DRIVER_DESC "\n");
 
 	return 0;
 usb_register_fail:
@@ -1423,6 +1421,8 @@ static void __exit hid_exit(void)
 module_init(hid_init);
 module_exit(hid_exit);
 
-MODULE_AUTHOR(DRIVER_AUTHOR);
+MODULE_AUTHOR("Andreas Gal");
+MODULE_AUTHOR("Vojtech Pavlik");
+MODULE_AUTHOR("Jiri Kosina");
 MODULE_DESCRIPTION(DRIVER_DESC);
 MODULE_LICENSE(DRIVER_LICENSE);
diff --git a/drivers/hid/usbhid/hid-pidff.c b/drivers/hid/usbhid/hid-pidff.c
index 484e3eec2f88..e565dbe91d97 100644
--- a/drivers/hid/usbhid/hid-pidff.c
+++ b/drivers/hid/usbhid/hid-pidff.c
@@ -1181,12 +1181,11 @@ static void pidff_reset(struct pidff_device *pidff)
 	usbhid_wait_io(hid);
 
 	if (pidff->pool[PID_SIMULTANEOUS_MAX].value) {
-		int sim_effects = pidff->pool[PID_SIMULTANEOUS_MAX].value[0];
-		while (sim_effects < 2) {
+		while (pidff->pool[PID_SIMULTANEOUS_MAX].value[0] < 2) {
 			if (i++ > 20) {
 				printk(KERN_WARNING "hid-pidff: device reports "
 				       "%d simultaneous effects\n",
-				       sim_effects);
+				       pidff->pool[PID_SIMULTANEOUS_MAX].value[0]);
 				break;
 			}
 			debug("pid_pool requested again");
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index 0d9045aa2c4b..38773dc2821b 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -37,6 +37,7 @@ static const struct hid_blacklist {
 	{ USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_FIGHTING, HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
 	{ USB_VENDOR_ID_NATSU, USB_DEVICE_ID_NATSU_GAMEPAD, HID_QUIRK_BADPAD },
 	{ USB_VENDOR_ID_NEC, USB_DEVICE_ID_NEC_USB_GAME_PAD, HID_QUIRK_BADPAD },
+	{ USB_VENDOR_ID_NEXTWINDOW, USB_DEVICE_ID_NEXTWINDOW_TOUCHSCREEN, HID_QUIRK_MULTI_INPUT},
 	{ USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RUMBLEPAD, HID_QUIRK_BADPAD },
 	{ USB_VENDOR_ID_TOPMAX, USB_DEVICE_ID_TOPMAX_COBRAPAD, HID_QUIRK_BADPAD },
 
@@ -53,6 +54,7 @@ static const struct hid_blacklist {
 	{ USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_COMBATSTICK, HID_QUIRK_NOGET },
 	{ USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FLIGHT_SIM_YOKE, HID_QUIRK_NOGET },
 	{ USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_PEDALS, HID_QUIRK_NOGET },
+	{ USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_3AXIS_5BUTTON_STICK, HID_QUIRK_NOGET },
 	{ USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET },
 	{ USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2700, HID_QUIRK_NOGET },
 	{ USB_VENDOR_ID_SUN, USB_DEVICE_ID_RARITAN_KVM_DONGLE, HID_QUIRK_NOGET },
@@ -280,7 +282,7 @@ u32 usbhid_lookup_quirk(const u16 idVendor, const u16 idProduct)
 	if (idVendor == USB_VENDOR_ID_NCR &&
 			idProduct >= USB_DEVICE_ID_NCR_FIRST &&
 			idProduct <= USB_DEVICE_ID_NCR_LAST)
-			return HID_QUIRK_NOGET;
+			return HID_QUIRK_NO_INIT_REPORTS;
 
 	down_read(&dquirks_rwsem);
 	bl_entry = usbhid_exists_dquirk(idVendor, idProduct);
diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
index 8b6ee247bfe4..867e08433e4b 100644
--- a/drivers/hid/usbhid/hiddev.c
+++ b/drivers/hid/usbhid/hiddev.c
@@ -450,7 +450,6 @@ static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd,
 	uref_multi = kmalloc(sizeof(struct hiddev_usage_ref_multi), GFP_KERNEL);
 	if (!uref_multi)
 		return -ENOMEM;
-	lock_kernel();
 	uref = &uref_multi->uref;
 	if (cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) {
 		if (copy_from_user(uref_multi, user_arg,
@@ -528,7 +527,6 @@ static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd,
 
 		case HIDIOCGCOLLECTIONINDEX:
 			i = field->usage[uref->usage_index].collection_index;
-			unlock_kernel();
 			kfree(uref_multi);
 			return i;
 		case HIDIOCGUSAGES:
@@ -547,15 +545,12 @@ static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd,
 		}
 
 goodreturn:
-		unlock_kernel();
 		kfree(uref_multi);
 		return 0;
 fault:
-		unlock_kernel();
 		kfree(uref_multi);
 		return -EFAULT;
 inval:
-		unlock_kernel();
 		kfree(uref_multi);
 		return -EINVAL;
 	}
diff --git a/drivers/hid/usbhid/usbkbd.c b/drivers/hid/usbhid/usbkbd.c
index b342926dd7fc..f843443ba5c3 100644
--- a/drivers/hid/usbhid/usbkbd.c
+++ b/drivers/hid/usbhid/usbkbd.c
@@ -266,7 +266,7 @@ static int usb_kbd_probe(struct usb_interface *iface,
 			 le16_to_cpu(dev->descriptor.idProduct));
 
 	usb_make_path(dev, kbd->phys, sizeof(kbd->phys));
-	strlcpy(kbd->phys, "/input0", sizeof(kbd->phys));
+	strlcat(kbd->phys, "/input0", sizeof(kbd->phys));
 
 	input_dev->name = kbd->name;
 	input_dev->phys = kbd->phys;
diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
index 700e93adeb33..68cf87749a42 100644
--- a/drivers/hwmon/Kconfig
+++ b/drivers/hwmon/Kconfig
@@ -191,21 +191,27 @@ config SENSORS_ADT7470
 	  will be called adt7470.
 
 config SENSORS_ADT7473
-	tristate "Analog Devices ADT7473"
+	tristate "Analog Devices ADT7473 (DEPRECATED)"
 	depends on I2C && EXPERIMENTAL
+	select SENSORS_ADT7475
 	help
 	  If you say yes here you get support for the Analog Devices
 	  ADT7473 temperature monitoring chips.
 
+	  This driver is deprecated, you should use the adt7475 driver
+	  instead.
+
 	  This driver can also be built as a module. If so, the module
 	  will be called adt7473.
 
 config SENSORS_ADT7475
-	tristate "Analog Devices ADT7475"
+	tristate "Analog Devices ADT7473, ADT7475, ADT7476 and ADT7490"
 	depends on I2C && EXPERIMENTAL
+	select HWMON_VID
 	help
 	  If you say yes here you get support for the Analog Devices
-	  ADT7475 hardware monitoring chips.
+	  ADT7473, ADT7475, ADT7476 and ADT7490 hardware monitoring
+	  chips.
 
 	  This driver can also be build as a module.  If so, the module
 	  will be called adt7475.
@@ -222,6 +228,18 @@ config SENSORS_K8TEMP
 	  This driver can also be built as a module.  If so, the module
 	  will be called k8temp.
 
+config SENSORS_K10TEMP
+	tristate "AMD Phenom/Sempron/Turion/Opteron temperature sensor"
+	depends on X86 && PCI
+	help
+	  If you say yes here you get support for the temperature
+	  sensor(s) inside your CPU. Supported are later revisions of
+	  the AMD Family 10h and all revisions of the AMD Family 11h
+	  microarchitectures.
+
+	  This driver can also be built as a module.  If so, the module
+	  will be called k10temp.
+
 config SENSORS_AMS
 	tristate "Apple Motion Sensor driver"
 	depends on PPC_PMAC && !PPC64 && INPUT && ((ADB_PMU && I2C = y) || (ADB_PMU && !I2C) || I2C) && EXPERIMENTAL
@@ -305,12 +323,12 @@ config SENSORS_F71805F
 	  will be called f71805f.
 
 config SENSORS_F71882FG
-	tristate "Fintek F71858FG, F71862FG, F71882FG and F8000"
+	tristate "Fintek F71858FG, F71862FG, F71882FG, F71889FG and F8000"
 	depends on EXPERIMENTAL
 	help
 	  If you say yes here you get support for hardware monitoring
-	  features of the Fintek F71858FG, F71862FG/71863FG, F71882FG/F71883FG
-	  and F8000 Super-I/O chips.
+	  features of the Fintek F71858FG, F71862FG/71863FG, F71882FG/F71883FG,
+	  F71889FG and F8000 Super-I/O chips.
 
 	  This driver can also be built as a module.  If so, the module
 	  will be called f71882fg.
@@ -374,7 +392,7 @@ config SENSORS_GL520SM
 
 config SENSORS_CORETEMP
 	tristate "Intel Core/Core2/Atom temperature sensor"
-	depends on X86 && EXPERIMENTAL
+	depends on X86 && PCI && EXPERIMENTAL
 	help
 	  If you say yes here you get support for the temperature
 	  sensor inside your CPU. Most of the family 6 CPUs
@@ -442,6 +460,15 @@ config SENSORS_LM70
 	  This driver can also be built as a module.  If so, the module
 	  will be called lm70.
 
+config SENSORS_LM73
+	tristate "National Semiconductor LM73"
+	depends on I2C
+	help
+	  If you say yes here you get support for National Semiconductor LM73
+	  sensor chips.
+	  This driver can also be built as a module.  If so, the module
+	  will be called lm73.
+
 config SENSORS_LM75
 	tristate "National Semiconductor LM75 and compatibles"
 	depends on I2C
@@ -765,6 +792,16 @@ config SENSORS_ADS7828
 	  This driver can also be built as a module.  If so, the module
 	  will be called ads7828.
 
+config SENSORS_AMC6821
+	tristate "Texas Instruments AMC6821"
+	depends on I2C  && EXPERIMENTAL
+	help
+	  If you say yes here you get support for the Texas Instruments
+	  AMC6821 hardware monitoring chips.
+
+	  This driver can also be build as a module.  If so, the module
+	  will be called amc6821.
+
 config SENSORS_THMC50
 	tristate "Texas Instruments THMC50 / Analog Devices ADM1022"
 	depends on I2C && EXPERIMENTAL
@@ -795,6 +832,14 @@ config SENSORS_TMP421
 	  This driver can also be built as a module.  If so, the module
 	  will be called tmp421.
 
+config SENSORS_VIA_CPUTEMP
+	tristate "VIA CPU temperature sensor"
+	depends on X86
+	help
+	  If you say yes here you get support for the temperature
+	  sensor inside your CPU. Supported are all known variants of
+	  the VIA C7 and Nano.
+
 config SENSORS_VIA686A
 	tristate "VIA686A"
 	depends on PCI
@@ -841,7 +886,7 @@ config SENSORS_W83781D
 
 config SENSORS_W83791D
 	tristate "Winbond W83791D"
-	depends on I2C && EXPERIMENTAL
+	depends on I2C
 	select HWMON_VID
 	help
 	  If you say yes here you get support for the Winbond W83791D chip.
@@ -983,6 +1028,23 @@ config SENSORS_LIS3_SPI
 	  will be called lis3lv02d and a specific module for the SPI transport
 	  is called lis3lv02d_spi.
 
+config SENSORS_LIS3_I2C
+	tristate "STMicroeletronics LIS3LV02Dx three-axis digital accelerometer (I2C)"
+	depends on I2C && INPUT
+	select INPUT_POLLDEV
+	default n
+	help
+	  This driver provides support for the LIS3LV02Dx accelerometer connected
+	  via I2C. The accelerometer data is readable via
+	  /sys/devices/platform/lis3lv02d.
+
+	  This driver also provides an absolute input class device, allowing
+	  the device to act as a pinball machine-esque joystick.
+
+	  This driver can also be built as modules.  If so, the core module
+	  will be called lis3lv02d and a specific module for the I2C transport
+	  is called lis3lv02d_i2c.
+
 config SENSORS_APPLESMC
 	tristate "Apple SMC (Motion sensor, light sensor, keyboard backlight)"
 	depends on INPUT && X86
@@ -1008,6 +1070,12 @@ config SENSORS_APPLESMC
 	  Say Y here if you have an applicable laptop and want to experience
 	  the awesome power of applesmc.
 
+config SENSORS_MC13783_ADC
+        tristate "Freescale MC13783 ADC"
+        depends on MFD_MC13783
+        help
+          Support for the A/D converter on MC13783 PMIC.
+
 if ACPI
 
 comment "ACPI drivers"
@@ -1025,25 +1093,27 @@ config SENSORS_ATK0110
 	  will be called asus_atk0110.
 
 config SENSORS_LIS3LV02D
-	tristate "STMicroeletronics LIS3LV02Dx three-axis digital accelerometer"
+	tristate "STMicroeletronics LIS3* three-axis digital accelerometer"
 	depends on INPUT
 	select INPUT_POLLDEV
 	select NEW_LEDS
 	select LEDS_CLASS
 	default n
 	help
-	  This driver provides support for the LIS3LV02Dx accelerometer. In
-	  particular, it can be found in a number of HP laptops, which have the
-	  "Mobile Data Protection System 3D" or "3D DriveGuard" feature. On such
-	  systems the driver should load automatically (via ACPI). The
-	  accelerometer might also be found in other systems, connected via SPI
-	  or I2C.  The accelerometer data is readable via
-	  /sys/devices/platform/lis3lv02d.
+	  This driver provides support for the LIS3* accelerometers, such as the
+	  LIS3LV02DL or the LIS331DL. In particular, it can be found in a number
+	  of HP laptops, which have the "Mobile Data Protection System 3D" or
+	  "3D DriveGuard" feature. On such systems the driver should load
+	  automatically (via ACPI alias). The accelerometer might also be found
+	  in other systems, connected via SPI or I2C. The accelerometer data is
+	  readable via /sys/devices/platform/lis3lv02d.
 
 	  This driver also provides an absolute input class device, allowing
-	  the laptop to act as a pinball machine-esque joystick. On HP laptops,
+	  a laptop to act as a pinball machine-esque joystick. It provides also
+	  a misc device which can be used to detect free-fall. On HP laptops,
 	  if the led infrastructure is activated, support for a led indicating
-	  disk protection will be provided as hp:red:hddprotection.
+	  disk protection will be provided as hp::hddprotect. For more
+	  information on the feature, refer to Documentation/hwmon/lis3lv02d.
 
 	  This driver can also be built as modules.  If so, the core module
 	  will be called lis3lv02d and a specific module for HP laptops will be
diff --git a/drivers/hwmon/Makefile b/drivers/hwmon/Makefile
index 9f46cb019cc6..4bc215c0953f 100644
--- a/drivers/hwmon/Makefile
+++ b/drivers/hwmon/Makefile
@@ -53,10 +53,13 @@ obj-$(CONFIG_SENSORS_IBMAEM)	+= ibmaem.o
 obj-$(CONFIG_SENSORS_IBMPEX)	+= ibmpex.o
 obj-$(CONFIG_SENSORS_IT87)	+= it87.o
 obj-$(CONFIG_SENSORS_K8TEMP)	+= k8temp.o
+obj-$(CONFIG_SENSORS_K10TEMP)	+= k10temp.o
 obj-$(CONFIG_SENSORS_LIS3LV02D) += lis3lv02d.o hp_accel.o
 obj-$(CONFIG_SENSORS_LIS3_SPI)	+= lis3lv02d.o lis3lv02d_spi.o
+obj-$(CONFIG_SENSORS_LIS3_I2C)	+= lis3lv02d.o lis3lv02d_i2c.o
 obj-$(CONFIG_SENSORS_LM63)	+= lm63.o
 obj-$(CONFIG_SENSORS_LM70)	+= lm70.o
+obj-$(CONFIG_SENSORS_LM73)	+= lm73.o
 obj-$(CONFIG_SENSORS_LM75)	+= lm75.o
 obj-$(CONFIG_SENSORS_LM77)	+= lm77.o
 obj-$(CONFIG_SENSORS_LM78)	+= lm78.o
@@ -73,6 +76,7 @@ obj-$(CONFIG_SENSORS_LTC4245)	+= ltc4245.o
 obj-$(CONFIG_SENSORS_MAX1111)	+= max1111.o
 obj-$(CONFIG_SENSORS_MAX1619)	+= max1619.o
 obj-$(CONFIG_SENSORS_MAX6650)	+= max6650.o
+obj-$(CONFIG_SENSORS_MC13783_ADC)+= mc13783-adc.o
 obj-$(CONFIG_SENSORS_PC87360)	+= pc87360.o
 obj-$(CONFIG_SENSORS_PC87427)	+= pc87427.o
 obj-$(CONFIG_SENSORS_PCF8591)	+= pcf8591.o
@@ -82,9 +86,11 @@ obj-$(CONFIG_SENSORS_SIS5595)	+= sis5595.o
 obj-$(CONFIG_SENSORS_SMSC47B397)+= smsc47b397.o
 obj-$(CONFIG_SENSORS_SMSC47M1)	+= smsc47m1.o
 obj-$(CONFIG_SENSORS_SMSC47M192)+= smsc47m192.o
+obj-$(CONFIG_SENSORS_AMC6821)	+= amc6821.o
 obj-$(CONFIG_SENSORS_THMC50)	+= thmc50.o
 obj-$(CONFIG_SENSORS_TMP401)	+= tmp401.o
 obj-$(CONFIG_SENSORS_TMP421)	+= tmp421.o
+obj-$(CONFIG_SENSORS_VIA_CPUTEMP)+= via-cputemp.o
 obj-$(CONFIG_SENSORS_VIA686A)	+= via686a.o
 obj-$(CONFIG_SENSORS_VT1211)	+= vt1211.o
 obj-$(CONFIG_SENSORS_VT8231)	+= vt8231.o
diff --git a/drivers/hwmon/adm1021.c b/drivers/hwmon/adm1021.c
index afc594318125..1ad0a885c5a5 100644
--- a/drivers/hwmon/adm1021.c
+++ b/drivers/hwmon/adm1021.c
@@ -34,9 +34,8 @@
 static const unsigned short normal_i2c[] = {
 	0x18, 0x19, 0x1a, 0x29, 0x2a, 0x2b, 0x4c, 0x4d, 0x4e, I2C_CLIENT_END };
 
-/* Insmod parameters */
-I2C_CLIENT_INSMOD_8(adm1021, adm1023, max1617, max1617a, thmc10, lm84, gl523sm,
-			mc1066);
+enum chips {
+	adm1021, adm1023, max1617, max1617a, thmc10, lm84, gl523sm, mc1066 };
 
 /* adm1021 constants specified below */
 
@@ -97,7 +96,7 @@ struct adm1021_data {
 
 static int adm1021_probe(struct i2c_client *client,
 			 const struct i2c_device_id *id);
-static int adm1021_detect(struct i2c_client *client, int kind,
+static int adm1021_detect(struct i2c_client *client,
 			  struct i2c_board_info *info);
 static void adm1021_init_client(struct i2c_client *client);
 static int adm1021_remove(struct i2c_client *client);
@@ -130,7 +129,7 @@ static struct i2c_driver adm1021_driver = {
 	.remove		= adm1021_remove,
 	.id_table	= adm1021_id,
 	.detect		= adm1021_detect,
-	.address_data	= &addr_data,
+	.address_list	= normal_i2c,
 };
 
 static ssize_t show_temp(struct device *dev,
@@ -284,13 +283,12 @@ static const struct attribute_group adm1021_group = {
 };
 
 /* Return 0 if detection is successful, -ENODEV otherwise */
-static int adm1021_detect(struct i2c_client *client, int kind,
+static int adm1021_detect(struct i2c_client *client,
 			  struct i2c_board_info *info)
 {
 	struct i2c_adapter *adapter = client->adapter;
-	int i;
-	const char *type_name = "";
-	int conv_rate, status, config;
+	const char *type_name;
+	int conv_rate, status, config, man_id, dev_id;
 
 	if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA)) {
 		pr_debug("adm1021: detect failed, "
@@ -303,62 +301,37 @@ static int adm1021_detect(struct i2c_client *client, int kind,
 					     ADM1021_REG_CONV_RATE_R);
 	config = i2c_smbus_read_byte_data(client, ADM1021_REG_CONFIG_R);
 
-	/* Now, we do the remaining detection. */
-	if (kind < 0) {
-		if ((status & 0x03) != 0x00 || (config & 0x3F) != 0x00
-		    || (conv_rate & 0xF8) != 0x00) {
-			pr_debug("adm1021: detect failed, "
-				 "chip not detected!\n");
-			return -ENODEV;
-		}
+	/* Check unused bits */
+	if ((status & 0x03) || (config & 0x3F) || (conv_rate & 0xF8)) {
+		pr_debug("adm1021: detect failed, chip not detected!\n");
+		return -ENODEV;
 	}
 
 	/* Determine the chip type. */
-	if (kind <= 0) {
-		i = i2c_smbus_read_byte_data(client, ADM1021_REG_MAN_ID);
-		if (i == 0x41)
-			if ((i2c_smbus_read_byte_data(client,
-					ADM1021_REG_DEV_ID) & 0xF0) == 0x30)
-				kind = adm1023;
-			else
-				kind = adm1021;
-		else if (i == 0x49)
-			kind = thmc10;
-		else if (i == 0x23)
-			kind = gl523sm;
-		else if ((i == 0x4d) &&
-			 (i2c_smbus_read_byte_data(client,
-						   ADM1021_REG_DEV_ID) == 0x01))
-			kind = max1617a;
-		else if (i == 0x54)
-			kind = mc1066;
-		/* LM84 Mfr ID in a different place, and it has more unused bits */
-		else if (conv_rate == 0x00
-			 && (kind == 0 /* skip extra detection */
-			     || ((config & 0x7F) == 0x00
-				 && (status & 0xAB) == 0x00)))
-			kind = lm84;
-		else
-			kind = max1617;
-	}
+	man_id = i2c_smbus_read_byte_data(client, ADM1021_REG_MAN_ID);
+	dev_id = i2c_smbus_read_byte_data(client, ADM1021_REG_DEV_ID);
 
-	if (kind == max1617) {
-		type_name = "max1617";
-	} else if (kind == max1617a) {
+	if (man_id == 0x4d && dev_id == 0x01)
 		type_name = "max1617a";
-	} else if (kind == adm1021) {
-		type_name = "adm1021";
-	} else if (kind == adm1023) {
-		type_name = "adm1023";
-	} else if (kind == thmc10) {
+	else if (man_id == 0x41) {
+		if ((dev_id & 0xF0) == 0x30)
+			type_name = "adm1023";
+		else
+			type_name = "adm1021";
+	} else if (man_id == 0x49)
 		type_name = "thmc10";
-	} else if (kind == lm84) {
-		type_name = "lm84";
-	} else if (kind == gl523sm) {
+	else if (man_id == 0x23)
 		type_name = "gl523sm";
-	} else if (kind == mc1066) {
+	else if (man_id == 0x54)
 		type_name = "mc1066";
-	}
+	/* LM84 Mfr ID in a different place, and it has more unused bits */
+	else if (conv_rate == 0x00
+		 && (config & 0x7F) == 0x00
+		 && (status & 0xAB) == 0x00)
+		type_name = "lm84";
+	else
+		type_name = "max1617";
+
 	pr_debug("adm1021: Detected chip %s at adapter %d, address 0x%02x.\n",
 		 type_name, i2c_adapter_id(adapter), client->addr);
 	strlcpy(info->type, type_name, I2C_NAME_SIZE);
diff --git a/drivers/hwmon/adm1025.c b/drivers/hwmon/adm1025.c
index 4db04d603ec9..251b63165e2a 100644
--- a/drivers/hwmon/adm1025.c
+++ b/drivers/hwmon/adm1025.c
@@ -2,7 +2,7 @@
  * adm1025.c
  *
  * Copyright (C) 2000       Chen-Yuan Wu <gwu@esoft.com>
- * Copyright (C) 2003-2008  Jean Delvare <khali@linux-fr.org>
+ * Copyright (C) 2003-2009  Jean Delvare <khali@linux-fr.org>
  *
  * The ADM1025 is a sensor chip made by Analog Devices. It reports up to 6
  * voltages (including its own power source) and up to two temperatures
@@ -64,11 +64,7 @@
 
 static const unsigned short normal_i2c[] = { 0x2c, 0x2d, 0x2e, I2C_CLIENT_END };
 
-/*
- * Insmod parameters
- */
-
-I2C_CLIENT_INSMOD_2(adm1025, ne1619);
+enum chips { adm1025, ne1619 };
 
 /*
  * The ADM1025 registers
@@ -111,7 +107,7 @@ static const int in_scale[6] = { 2500, 2250, 3300, 5000, 12000, 3300 };
 
 static int adm1025_probe(struct i2c_client *client,
 			 const struct i2c_device_id *id);
-static int adm1025_detect(struct i2c_client *client, int kind,
+static int adm1025_detect(struct i2c_client *client,
 			  struct i2c_board_info *info);
 static void adm1025_init_client(struct i2c_client *client);
 static int adm1025_remove(struct i2c_client *client);
@@ -137,7 +133,7 @@ static struct i2c_driver adm1025_driver = {
 	.remove		= adm1025_remove,
 	.id_table	= adm1025_id,
 	.detect		= adm1025_detect,
-	.address_data	= &addr_data,
+	.address_list	= normal_i2c,
 };
 
 /*
@@ -409,71 +405,38 @@ static const struct attribute_group adm1025_group_in4 = {
 };
 
 /* Return 0 if detection is successful, -ENODEV otherwise */
-static int adm1025_detect(struct i2c_client *client, int kind,
+static int adm1025_detect(struct i2c_client *client,
 			  struct i2c_board_info *info)
 {
 	struct i2c_adapter *adapter = client->adapter;
-	const char *name = "";
-	u8 config;
+	const char *name;
+	u8 man_id, chip_id;
 
 	if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA))
 		return -ENODEV;
 
-	/*
-	 * Now we do the remaining detection. A negative kind means that
-	 * the driver was loaded with no force parameter (default), so we
-	 * must both detect and identify the chip. A zero kind means that
-	 * the driver was loaded with the force parameter, the detection
-	 * step shall be skipped. A positive kind means that the driver
-	 * was loaded with the force parameter and a given kind of chip is
-	 * requested, so both the detection and the identification steps
-	 * are skipped.
-	 */
-	config = i2c_smbus_read_byte_data(client, ADM1025_REG_CONFIG);
-	if (kind < 0) { /* detection */
-		if ((config & 0x80) != 0x00
-		 || (i2c_smbus_read_byte_data(client,
-		     ADM1025_REG_STATUS1) & 0xC0) != 0x00
-		 || (i2c_smbus_read_byte_data(client,
-		     ADM1025_REG_STATUS2) & 0xBC) != 0x00) {
-			dev_dbg(&adapter->dev,
-				"ADM1025 detection failed at 0x%02x.\n",
-				client->addr);
-			return -ENODEV;
-		}
+	/* Check for unused bits */
+	if ((i2c_smbus_read_byte_data(client, ADM1025_REG_CONFIG) & 0x80)
+	 || (i2c_smbus_read_byte_data(client, ADM1025_REG_STATUS1) & 0xC0)
+	 || (i2c_smbus_read_byte_data(client, ADM1025_REG_STATUS2) & 0xBC)) {
+		dev_dbg(&adapter->dev, "ADM1025 detection failed at 0x%02x\n",
+			client->addr);
+		return -ENODEV;
 	}
 
-	if (kind <= 0) { /* identification */
-		u8 man_id, chip_id;
-
-		man_id = i2c_smbus_read_byte_data(client, ADM1025_REG_MAN_ID);
-		chip_id = i2c_smbus_read_byte_data(client, ADM1025_REG_CHIP_ID);
-
-		if (man_id == 0x41) { /* Analog Devices */
-			if ((chip_id & 0xF0) == 0x20) { /* ADM1025/ADM1025A */
-				kind = adm1025;
-			}
-		} else
-		if (man_id == 0xA1) { /* Philips */
-			if (client->addr != 0x2E
-			 && (chip_id & 0xF0) == 0x20) { /* NE1619 */
-				kind = ne1619;
-			}
-		}
-
-		if (kind <= 0) { /* identification failed */
-			dev_info(&adapter->dev,
-			    "Unsupported chip (man_id=0x%02X, "
-			    "chip_id=0x%02X).\n", man_id, chip_id);
-			return -ENODEV;
-		}
-	}
+	/* Identification */
+	chip_id = i2c_smbus_read_byte_data(client, ADM1025_REG_CHIP_ID);
+	if ((chip_id & 0xF0) != 0x20)
+		return -ENODEV;
 
-	if (kind == adm1025) {
+	man_id = i2c_smbus_read_byte_data(client, ADM1025_REG_MAN_ID);
+	if (man_id == 0x41)
 		name = "adm1025";
-	} else if (kind == ne1619) {
+	else if (man_id == 0xA1 && client->addr != 0x2E)
 		name = "ne1619";
-	}
+	else
+		return -ENODEV;
+
 	strlcpy(info->type, name, I2C_NAME_SIZE);
 
 	return 0;
diff --git a/drivers/hwmon/adm1026.c b/drivers/hwmon/adm1026.c
index ff7de40b6e35..65335b268fa9 100644
--- a/drivers/hwmon/adm1026.c
+++ b/drivers/hwmon/adm1026.c
@@ -37,9 +37,6 @@
 /* Addresses to scan */
 static const unsigned short normal_i2c[] = { 0x2c, 0x2d, 0x2e, I2C_CLIENT_END };
 
-/* Insmod parameters */
-I2C_CLIENT_INSMOD_1(adm1026);
-
 static int gpio_input[17] = { -1, -1, -1, -1, -1, -1, -1, -1, -1,
 				-1, -1, -1, -1, -1, -1, -1, -1 };
 static int gpio_output[17] = { -1, -1, -1, -1, -1, -1, -1, -1, -1,
@@ -293,7 +290,7 @@ struct adm1026_data {
 
 static int adm1026_probe(struct i2c_client *client,
 			 const struct i2c_device_id *id);
-static int adm1026_detect(struct i2c_client *client, int kind,
+static int adm1026_detect(struct i2c_client *client,
 			  struct i2c_board_info *info);
 static int adm1026_remove(struct i2c_client *client);
 static int adm1026_read_value(struct i2c_client *client, u8 reg);
@@ -305,7 +302,7 @@ static void adm1026_init_client(struct i2c_client *client);
 
 
 static const struct i2c_device_id adm1026_id[] = {
-	{ "adm1026", adm1026 },
+	{ "adm1026", 0 },
 	{ }
 };
 MODULE_DEVICE_TABLE(i2c, adm1026_id);
@@ -319,7 +316,7 @@ static struct i2c_driver adm1026_driver = {
 	.remove		= adm1026_remove,
 	.id_table	= adm1026_id,
 	.detect		= adm1026_detect,
-	.address_data	= &addr_data,
+	.address_list	= normal_i2c,
 };
 
 static int adm1026_read_value(struct i2c_client *client, u8 reg)
@@ -1650,7 +1647,7 @@ static const struct attribute_group adm1026_group_in8_9 = {
 };
 
 /* Return 0 if detection is successful, -ENODEV otherwise */
-static int adm1026_detect(struct i2c_client *client, int kind,
+static int adm1026_detect(struct i2c_client *client,
 			  struct i2c_board_info *info)
 {
 	struct i2c_adapter *adapter = client->adapter;
@@ -1672,35 +1669,26 @@ static int adm1026_detect(struct i2c_client *client, int kind,
 		i2c_adapter_id(client->adapter), client->addr,
 		company, verstep);
 
-	/* If auto-detecting, Determine the chip type. */
-	if (kind <= 0) {
-		dev_dbg(&adapter->dev, "Autodetecting device at %d,0x%02x "
-			"...\n", i2c_adapter_id(adapter), address);
-		if (company == ADM1026_COMPANY_ANALOG_DEV
-		    && verstep == ADM1026_VERSTEP_ADM1026) {
-			kind = adm1026;
-		} else if (company == ADM1026_COMPANY_ANALOG_DEV
-			&& (verstep & 0xf0) == ADM1026_VERSTEP_GENERIC) {
-			dev_err(&adapter->dev, "Unrecognized stepping "
-				"0x%02x. Defaulting to ADM1026.\n", verstep);
-			kind = adm1026;
-		} else if ((verstep & 0xf0) == ADM1026_VERSTEP_GENERIC) {
-			dev_err(&adapter->dev, "Found version/stepping "
-				"0x%02x. Assuming generic ADM1026.\n",
-				verstep);
-			kind = any_chip;
-		} else {
-			dev_dbg(&adapter->dev, "Autodetection failed\n");
-			/* Not an ADM1026 ... */
-			if (kind == 0) { /* User used force=x,y */
-				dev_err(&adapter->dev, "Generic ADM1026 not "
-					"found at %d,0x%02x.  Try "
-					"force_adm1026.\n",
-					i2c_adapter_id(adapter), address);
-			}
-			return -ENODEV;
-		}
+	/* Determine the chip type. */
+	dev_dbg(&adapter->dev, "Autodetecting device at %d,0x%02x...\n",
+		i2c_adapter_id(adapter), address);
+	if (company == ADM1026_COMPANY_ANALOG_DEV
+	    && verstep == ADM1026_VERSTEP_ADM1026) {
+		/* Analog Devices ADM1026 */
+	} else if (company == ADM1026_COMPANY_ANALOG_DEV
+		&& (verstep & 0xf0) == ADM1026_VERSTEP_GENERIC) {
+		dev_err(&adapter->dev, "Unrecognized stepping "
+			"0x%02x. Defaulting to ADM1026.\n", verstep);
+	} else if ((verstep & 0xf0) == ADM1026_VERSTEP_GENERIC) {
+		dev_err(&adapter->dev, "Found version/stepping "
+			"0x%02x. Assuming generic ADM1026.\n",
+			verstep);
+	} else {
+		dev_dbg(&adapter->dev, "Autodetection failed\n");
+		/* Not an ADM1026... */
+		return -ENODEV;
 	}
+
 	strlcpy(info->type, "adm1026", I2C_NAME_SIZE);
 
 	return 0;
diff --git a/drivers/hwmon/adm1029.c b/drivers/hwmon/adm1029.c
index 36718150b475..0b8a3b145bd2 100644
--- a/drivers/hwmon/adm1029.c
+++ b/drivers/hwmon/adm1029.c
@@ -44,12 +44,6 @@ static const unsigned short normal_i2c[] = { 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d,
 };
 
 /*
- * Insmod parameters
- */
-
-I2C_CLIENT_INSMOD_1(adm1029);
-
-/*
  * The ADM1029 registers
  * Manufacturer ID is 0x41 for Analog Devices
  */
@@ -117,7 +111,7 @@ static const u8 ADM1029_REG_FAN_DIV[] = {
 
 static int adm1029_probe(struct i2c_client *client,
 			 const struct i2c_device_id *id);
-static int adm1029_detect(struct i2c_client *client, int kind,
+static int adm1029_detect(struct i2c_client *client,
 			  struct i2c_board_info *info);
 static int adm1029_remove(struct i2c_client *client);
 static struct adm1029_data *adm1029_update_device(struct device *dev);
@@ -128,7 +122,7 @@ static int adm1029_init_client(struct i2c_client *client);
  */
 
 static const struct i2c_device_id adm1029_id[] = {
-	{ "adm1029", adm1029 },
+	{ "adm1029", 0 },
 	{ }
 };
 MODULE_DEVICE_TABLE(i2c, adm1029_id);
@@ -142,7 +136,7 @@ static struct i2c_driver adm1029_driver = {
 	.remove		= adm1029_remove,
 	.id_table	= adm1029_id,
 	.detect		= adm1029_detect,
-	.address_data	= &addr_data,
+	.address_list	= normal_i2c,
 };
 
 /*
@@ -297,63 +291,40 @@ static const struct attribute_group adm1029_group = {
  */
 
 /* Return 0 if detection is successful, -ENODEV otherwise */
-static int adm1029_detect(struct i2c_client *client, int kind,
+static int adm1029_detect(struct i2c_client *client,
 			  struct i2c_board_info *info)
 {
 	struct i2c_adapter *adapter = client->adapter;
+	u8 man_id, chip_id, temp_devices_installed, nb_fan_support;
 
 	if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA))
 		return -ENODEV;
 
-	/* Now we do the detection and identification. A negative kind
-	 * means that the driver was loaded with no force parameter
-	 * (default), so we must both detect and identify the chip
-	 * (actually there is only one possible kind of chip for now, adm1029).
-	 * A zero kind means that the driver was loaded with the force
-	 * parameter, the detection step shall be skipped. A positive kind
-	 * means that the driver was loaded with the force parameter and a
-	 * given kind of chip is requested, so both the detection and the
-	 * identification steps are skipped. */
-
-	/* Default to an adm1029 if forced */
-	if (kind == 0)
-		kind = adm1029;
-
 	/* ADM1029 doesn't have CHIP ID, check just MAN ID
 	 * For better detection we check also ADM1029_TEMP_DEVICES_INSTALLED,
 	 * ADM1029_REG_NB_FAN_SUPPORT and compare it with possible values
 	 * documented
 	 */
 
-	if (kind <= 0) {	/* identification */
-		u8 man_id, chip_id, temp_devices_installed, nb_fan_support;
-
-		man_id = i2c_smbus_read_byte_data(client, ADM1029_REG_MAN_ID);
-		chip_id = i2c_smbus_read_byte_data(client, ADM1029_REG_CHIP_ID);
-		temp_devices_installed = i2c_smbus_read_byte_data(client,
+	man_id = i2c_smbus_read_byte_data(client, ADM1029_REG_MAN_ID);
+	chip_id = i2c_smbus_read_byte_data(client, ADM1029_REG_CHIP_ID);
+	temp_devices_installed = i2c_smbus_read_byte_data(client,
 					ADM1029_REG_TEMP_DEVICES_INSTALLED);
-		nb_fan_support = i2c_smbus_read_byte_data(client,
+	nb_fan_support = i2c_smbus_read_byte_data(client,
 						ADM1029_REG_NB_FAN_SUPPORT);
-		/* 0x41 is Analog Devices */
-		if (man_id == 0x41 && (temp_devices_installed & 0xf9) == 0x01
-		    && nb_fan_support == 0x03) {
-			if ((chip_id & 0xF0) == 0x00) {
-				kind = adm1029;
-			} else {
-				/* There are no "official" CHIP ID, so actually
-				 * we use Major/Minor revision for that */
-				printk(KERN_INFO
-				       "adm1029: Unknown major revision %x, "
-				       "please let us know\n", chip_id);
-			}
-		}
+	/* 0x41 is Analog Devices */
+	if (man_id != 0x41 || (temp_devices_installed & 0xf9) != 0x01
+	    || nb_fan_support != 0x03)
+		return -ENODEV;
 
-		if (kind <= 0) {	/* identification failed */
-			pr_debug("adm1029: Unsupported chip (man_id=0x%02X, "
-				 "chip_id=0x%02X)\n", man_id, chip_id);
-			return -ENODEV;
-		}
+	if ((chip_id & 0xF0) != 0x00) {
+		/* There are no "official" CHIP ID, so actually
+		 * we use Major/Minor revision for that */
+		pr_info("adm1029: Unknown major revision %x, "
+			"please let us know\n", chip_id);
+		return -ENODEV;
 	}
+
 	strlcpy(info->type, "adm1029", I2C_NAME_SIZE);
 
 	return 0;
@@ -432,7 +403,7 @@ static int adm1029_remove(struct i2c_client *client)
 }
 
 /*
-function that update the status of the chips (temperature for exemple)
+function that update the status of the chips (temperature for example)
 */
 static struct adm1029_data *adm1029_update_device(struct device *dev)
 {
diff --git a/drivers/hwmon/adm1031.c b/drivers/hwmon/adm1031.c
index 56905955352c..1644b92e7cc4 100644
--- a/drivers/hwmon/adm1031.c
+++ b/drivers/hwmon/adm1031.c
@@ -64,8 +64,7 @@
 /* Addresses to scan */
 static const unsigned short normal_i2c[] = { 0x2c, 0x2d, 0x2e, I2C_CLIENT_END };
 
-/* Insmod parameters */
-I2C_CLIENT_INSMOD_2(adm1030, adm1031);
+enum chips { adm1030, adm1031 };
 
 typedef u8 auto_chan_table_t[8][2];
 
@@ -102,7 +101,7 @@ struct adm1031_data {
 
 static int adm1031_probe(struct i2c_client *client,
 			 const struct i2c_device_id *id);
-static int adm1031_detect(struct i2c_client *client, int kind,
+static int adm1031_detect(struct i2c_client *client,
 			  struct i2c_board_info *info);
 static void adm1031_init_client(struct i2c_client *client);
 static int adm1031_remove(struct i2c_client *client);
@@ -125,7 +124,7 @@ static struct i2c_driver adm1031_driver = {
 	.remove		= adm1031_remove,
 	.id_table	= adm1031_id,
 	.detect		= adm1031_detect,
-	.address_data	= &addr_data,
+	.address_list	= normal_i2c,
 };
 
 static inline u8 adm1031_read_value(struct i2c_client *client, u8 reg)
@@ -813,35 +812,23 @@ static const struct attribute_group adm1031_group_opt = {
 };
 
 /* Return 0 if detection is successful, -ENODEV otherwise */
-static int adm1031_detect(struct i2c_client *client, int kind,
+static int adm1031_detect(struct i2c_client *client,
 			  struct i2c_board_info *info)
 {
 	struct i2c_adapter *adapter = client->adapter;
-	const char *name = "";
+	const char *name;
+	int id, co;
 
 	if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA))
 		return -ENODEV;
 
-	if (kind < 0) {
-		int id, co;
-		id = i2c_smbus_read_byte_data(client, 0x3d);
-		co = i2c_smbus_read_byte_data(client, 0x3e);
+	id = i2c_smbus_read_byte_data(client, 0x3d);
+	co = i2c_smbus_read_byte_data(client, 0x3e);
 
-		if (!((id == 0x31 || id == 0x30) && co == 0x41))
-			return -ENODEV;
-		kind = (id == 0x30) ? adm1030 : adm1031;
-	}
-
-	if (kind <= 0)
-		kind = adm1031;
+	if (!((id == 0x31 || id == 0x30) && co == 0x41))
+		return -ENODEV;
+	name = (id == 0x30) ? "adm1030" : "adm1031";
 
-	/* Given the detected chip type, set the chip name and the
-	 * auto fan control helper table. */
-	if (kind == adm1030) {
-		name = "adm1030";
-	} else if (kind == adm1031) {
-		name = "adm1031";
-	}
 	strlcpy(info->type, name, I2C_NAME_SIZE);
 
 	return 0;
diff --git a/drivers/hwmon/adm9240.c b/drivers/hwmon/adm9240.c
index 2444b15f2e9d..0727ad250793 100644
--- a/drivers/hwmon/adm9240.c
+++ b/drivers/hwmon/adm9240.c
@@ -55,8 +55,7 @@
 static const unsigned short normal_i2c[] = { 0x2c, 0x2d, 0x2e, 0x2f,
 					I2C_CLIENT_END };
 
-/* Insmod parameters */
-I2C_CLIENT_INSMOD_3(adm9240, ds1780, lm81);
+enum chips { adm9240, ds1780, lm81 };
 
 /* ADM9240 registers */
 #define ADM9240_REG_MAN_ID		0x3e
@@ -132,7 +131,7 @@ static inline unsigned int AOUT_FROM_REG(u8 reg)
 
 static int adm9240_probe(struct i2c_client *client,
 			 const struct i2c_device_id *id);
-static int adm9240_detect(struct i2c_client *client, int kind,
+static int adm9240_detect(struct i2c_client *client,
 			  struct i2c_board_info *info);
 static void adm9240_init_client(struct i2c_client *client);
 static int adm9240_remove(struct i2c_client *client);
@@ -156,7 +155,7 @@ static struct i2c_driver adm9240_driver = {
 	.remove		= adm9240_remove,
 	.id_table	= adm9240_id,
 	.detect		= adm9240_detect,
-	.address_data	= &addr_data,
+	.address_list	= normal_i2c,
 };
 
 /* per client data */
@@ -545,7 +544,7 @@ static const struct attribute_group adm9240_group = {
 /*** sensor chip detect and driver install ***/
 
 /* Return 0 if detection is successful, -ENODEV otherwise */
-static int adm9240_detect(struct i2c_client *new_client, int kind,
+static int adm9240_detect(struct i2c_client *new_client,
 			  struct i2c_board_info *info)
 {
 	struct i2c_adapter *adapter = new_client->adapter;
@@ -556,51 +555,34 @@ static int adm9240_detect(struct i2c_client *new_client, int kind,
 	if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA))
 		return -ENODEV;
 
-	if (kind == 0) {
-		kind = adm9240;
-	}
-
-	if (kind < 0) {
-
-		/* verify chip: reg address should match i2c address */
-		if (i2c_smbus_read_byte_data(new_client, ADM9240_REG_I2C_ADDR)
-				!= address) {
-			dev_err(&adapter->dev, "detect fail: address match, "
-					"0x%02x\n", address);
-			return -ENODEV;
-		}
-
-		/* check known chip manufacturer */
-		man_id = i2c_smbus_read_byte_data(new_client,
-				ADM9240_REG_MAN_ID);
-		if (man_id == 0x23) {
-			kind = adm9240;
-		} else if (man_id == 0xda) {
-			kind = ds1780;
-		} else if (man_id == 0x01) {
-			kind = lm81;
-		} else {
-			dev_err(&adapter->dev, "detect fail: unknown manuf, "
-					"0x%02x\n", man_id);
-			return -ENODEV;
-		}
-
-		/* successful detect, print chip info */
-		die_rev = i2c_smbus_read_byte_data(new_client,
-				ADM9240_REG_DIE_REV);
-		dev_info(&adapter->dev, "found %s revision %u\n",
-				man_id == 0x23 ? "ADM9240" :
-				man_id == 0xda ? "DS1780" : "LM81", die_rev);
+	/* verify chip: reg address should match i2c address */
+	if (i2c_smbus_read_byte_data(new_client, ADM9240_REG_I2C_ADDR)
+			!= address) {
+		dev_err(&adapter->dev, "detect fail: address match, 0x%02x\n",
+			address);
+		return -ENODEV;
 	}
 
-	/* either forced or detected chip kind */
-	if (kind == adm9240) {
+	/* check known chip manufacturer */
+	man_id = i2c_smbus_read_byte_data(new_client, ADM9240_REG_MAN_ID);
+	if (man_id == 0x23) {
 		name = "adm9240";
-	} else if (kind == ds1780) {
+	} else if (man_id == 0xda) {
 		name = "ds1780";
-	} else if (kind == lm81) {
+	} else if (man_id == 0x01) {
 		name = "lm81";
+	} else {
+		dev_err(&adapter->dev, "detect fail: unknown manuf, 0x%02x\n",
+			man_id);
+		return -ENODEV;
 	}
+
+	/* successful detect, print chip info */
+	die_rev = i2c_smbus_read_byte_data(new_client, ADM9240_REG_DIE_REV);
+	dev_info(&adapter->dev, "found %s revision %u\n",
+		 man_id == 0x23 ? "ADM9240" :
+		 man_id == 0xda ? "DS1780" : "LM81", die_rev);
+
 	strlcpy(info->type, name, I2C_NAME_SIZE);
 
 	return 0;
diff --git a/drivers/hwmon/ads7828.c b/drivers/hwmon/ads7828.c
index 5c39b4af1b23..aac85f3aed50 100644
--- a/drivers/hwmon/ads7828.c
+++ b/drivers/hwmon/ads7828.c
@@ -47,10 +47,7 @@
 static const unsigned short normal_i2c[] = { 0x48, 0x49, 0x4a, 0x4b,
 	I2C_CLIENT_END };
 
-/* Insmod parameters */
-I2C_CLIENT_INSMOD_1(ads7828);
-
-/* Other module parameters */
+/* Module parameters */
 static int se_input = 1; /* Default is SE, 0 == diff */
 static int int_vref = 1; /* Default is internal ref ON */
 static int vref_mv = ADS7828_INT_VREF_MV; /* set if vref != 2.5V */
@@ -72,7 +69,7 @@ struct ads7828_data {
 };
 
 /* Function declaration - necessary due to function dependencies */
-static int ads7828_detect(struct i2c_client *client, int kind,
+static int ads7828_detect(struct i2c_client *client,
 			  struct i2c_board_info *info);
 static int ads7828_probe(struct i2c_client *client,
 			 const struct i2c_device_id *id);
@@ -168,7 +165,7 @@ static int ads7828_remove(struct i2c_client *client)
 }
 
 static const struct i2c_device_id ads7828_id[] = {
-	{ "ads7828", ads7828 },
+	{ "ads7828", 0 },
 	{ }
 };
 MODULE_DEVICE_TABLE(i2c, ads7828_id);
@@ -183,14 +180,15 @@ static struct i2c_driver ads7828_driver = {
 	.remove = ads7828_remove,
 	.id_table = ads7828_id,
 	.detect = ads7828_detect,
-	.address_data = &addr_data,
+	.address_list = normal_i2c,
 };
 
 /* Return 0 if detection is successful, -ENODEV otherwise */
-static int ads7828_detect(struct i2c_client *client, int kind,
+static int ads7828_detect(struct i2c_client *client,
 			  struct i2c_board_info *info)
 {
 	struct i2c_adapter *adapter = client->adapter;
+	int ch;
 
 	/* Check we have a valid client */
 	if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_READ_WORD_DATA))
@@ -202,20 +200,17 @@ static int ads7828_detect(struct i2c_client *client, int kind,
 	- Read from the 8 channel addresses
 	- Check the top 4 bits of each result are not set (12 data bits)
 	*/
-	if (kind < 0) {
-		int ch;
-		for (ch = 0; ch < ADS7828_NCH; ch++) {
-			u16 in_data;
-			u8 cmd = channel_cmd_byte(ch);
-			in_data = ads7828_read_value(client, cmd);
-			if (in_data & 0xF000) {
-				printk(KERN_DEBUG
-				"%s : Doesn't look like an ads7828 device\n",
-				__func__);
-				return -ENODEV;
-			}
+	for (ch = 0; ch < ADS7828_NCH; ch++) {
+		u16 in_data;
+		u8 cmd = channel_cmd_byte(ch);
+		in_data = ads7828_read_value(client, cmd);
+		if (in_data & 0xF000) {
+			pr_debug("%s : Doesn't look like an ads7828 device\n",
+				 __func__);
+			return -ENODEV;
 		}
 	}
+
 	strlcpy(info->type, "ads7828", I2C_NAME_SIZE);
 
 	return 0;
diff --git a/drivers/hwmon/adt7462.c b/drivers/hwmon/adt7462.c
index 1852f27bac51..a31e77c776ae 100644
--- a/drivers/hwmon/adt7462.c
+++ b/drivers/hwmon/adt7462.c
@@ -32,9 +32,6 @@
 /* Addresses to scan */
 static const unsigned short normal_i2c[] = { 0x58, 0x5C, I2C_CLIENT_END };
 
-/* Insmod parameters */
-I2C_CLIENT_INSMOD_1(adt7462);
-
 /* ADT7462 registers */
 #define ADT7462_REG_DEVICE			0x3D
 #define ADT7462_REG_VENDOR			0x3E
@@ -97,7 +94,7 @@ I2C_CLIENT_INSMOD_1(adt7462);
 #define		ADT7462_PIN24_SHIFT		6
 #define		ADT7462_PIN26_VOLT_INPUT	0x08
 #define		ADT7462_PIN25_VOLT_INPUT	0x20
-#define		ADT7462_PIN28_SHIFT		6	/* cfg3 */
+#define		ADT7462_PIN28_SHIFT		4	/* cfg3 */
 #define		ADT7462_PIN28_VOLT		0x5
 
 #define ADT7462_REG_ALARM1			0xB8
@@ -237,12 +234,12 @@ struct adt7462_data {
 
 static int adt7462_probe(struct i2c_client *client,
 			 const struct i2c_device_id *id);
-static int adt7462_detect(struct i2c_client *client, int kind,
+static int adt7462_detect(struct i2c_client *client,
 			  struct i2c_board_info *info);
 static int adt7462_remove(struct i2c_client *client);
 
 static const struct i2c_device_id adt7462_id[] = {
-	{ "adt7462", adt7462 },
+	{ "adt7462", 0 },
 	{ }
 };
 MODULE_DEVICE_TABLE(i2c, adt7462_id);
@@ -256,7 +253,7 @@ static struct i2c_driver adt7462_driver = {
 	.remove		= adt7462_remove,
 	.id_table	= adt7462_id,
 	.detect		= adt7462_detect,
-	.address_data	= &addr_data,
+	.address_list	= normal_i2c,
 };
 
 /*
@@ -1902,31 +1899,26 @@ static struct attribute *adt7462_attr[] =
 };
 
 /* Return 0 if detection is successful, -ENODEV otherwise */
-static int adt7462_detect(struct i2c_client *client, int kind,
+static int adt7462_detect(struct i2c_client *client,
 			  struct i2c_board_info *info)
 {
 	struct i2c_adapter *adapter = client->adapter;
+	int vendor, device, revision;
 
 	if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA))
 		return -ENODEV;
 
-	if (kind <= 0) {
-		int vendor, device, revision;
-
-		vendor = i2c_smbus_read_byte_data(client, ADT7462_REG_VENDOR);
-		if (vendor != ADT7462_VENDOR)
-			return -ENODEV;
+	vendor = i2c_smbus_read_byte_data(client, ADT7462_REG_VENDOR);
+	if (vendor != ADT7462_VENDOR)
+		return -ENODEV;
 
-		device = i2c_smbus_read_byte_data(client, ADT7462_REG_DEVICE);
-		if (device != ADT7462_DEVICE)
-			return -ENODEV;
+	device = i2c_smbus_read_byte_data(client, ADT7462_REG_DEVICE);
+	if (device != ADT7462_DEVICE)
+		return -ENODEV;
 
-		revision = i2c_smbus_read_byte_data(client,
-						    ADT7462_REG_REVISION);
-		if (revision != ADT7462_REVISION)
-			return -ENODEV;
-	} else
-		dev_dbg(&adapter->dev, "detection forced\n");
+	revision = i2c_smbus_read_byte_data(client, ADT7462_REG_REVISION);
+	if (revision != ADT7462_REVISION)
+		return -ENODEV;
 
 	strlcpy(info->type, "adt7462", I2C_NAME_SIZE);
 
diff --git a/drivers/hwmon/adt7470.c b/drivers/hwmon/adt7470.c
index 633e1a1e9d79..3445ce1cba81 100644
--- a/drivers/hwmon/adt7470.c
+++ b/drivers/hwmon/adt7470.c
@@ -33,9 +33,6 @@
 /* Addresses to scan */
 static const unsigned short normal_i2c[] = { 0x2C, 0x2E, 0x2F, I2C_CLIENT_END };
 
-/* Insmod parameters */
-I2C_CLIENT_INSMOD_1(adt7470);
-
 /* ADT7470 registers */
 #define ADT7470_REG_BASE_ADDR			0x20
 #define ADT7470_REG_TEMP_BASE_ADDR		0x20
@@ -177,12 +174,12 @@ struct adt7470_data {
 
 static int adt7470_probe(struct i2c_client *client,
 			 const struct i2c_device_id *id);
-static int adt7470_detect(struct i2c_client *client, int kind,
+static int adt7470_detect(struct i2c_client *client,
 			  struct i2c_board_info *info);
 static int adt7470_remove(struct i2c_client *client);
 
 static const struct i2c_device_id adt7470_id[] = {
-	{ "adt7470", adt7470 },
+	{ "adt7470", 0 },
 	{ }
 };
 MODULE_DEVICE_TABLE(i2c, adt7470_id);
@@ -196,7 +193,7 @@ static struct i2c_driver adt7470_driver = {
 	.remove		= adt7470_remove,
 	.id_table	= adt7470_id,
 	.detect		= adt7470_detect,
-	.address_data	= &addr_data,
+	.address_list	= normal_i2c,
 };
 
 /*
@@ -1225,31 +1222,26 @@ static struct attribute *adt7470_attr[] =
 };
 
 /* Return 0 if detection is successful, -ENODEV otherwise */
-static int adt7470_detect(struct i2c_client *client, int kind,
+static int adt7470_detect(struct i2c_client *client,
 			  struct i2c_board_info *info)
 {
 	struct i2c_adapter *adapter = client->adapter;
+	int vendor, device, revision;
 
 	if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA))
 		return -ENODEV;
 
-	if (kind <= 0) {
-		int vendor, device, revision;
-
-		vendor = i2c_smbus_read_byte_data(client, ADT7470_REG_VENDOR);
-		if (vendor != ADT7470_VENDOR)
-			return -ENODEV;
+	vendor = i2c_smbus_read_byte_data(client, ADT7470_REG_VENDOR);
+	if (vendor != ADT7470_VENDOR)
+		return -ENODEV;
 
-		device = i2c_smbus_read_byte_data(client, ADT7470_REG_DEVICE);
-		if (device != ADT7470_DEVICE)
-			return -ENODEV;
+	device = i2c_smbus_read_byte_data(client, ADT7470_REG_DEVICE);
+	if (device != ADT7470_DEVICE)
+		return -ENODEV;
 
-		revision = i2c_smbus_read_byte_data(client,
-						    ADT7470_REG_REVISION);
-		if (revision != ADT7470_REVISION)
-			return -ENODEV;
-	} else
-		dev_dbg(&adapter->dev, "detection forced\n");
+	revision = i2c_smbus_read_byte_data(client, ADT7470_REG_REVISION);
+	if (revision != ADT7470_REVISION)
+		return -ENODEV;
 
 	strlcpy(info->type, "adt7470", I2C_NAME_SIZE);
 
diff --git a/drivers/hwmon/adt7473.c b/drivers/hwmon/adt7473.c
index 0a6ce2367b42..434576f61c84 100644
--- a/drivers/hwmon/adt7473.c
+++ b/drivers/hwmon/adt7473.c
@@ -32,9 +32,6 @@
 /* Addresses to scan */
 static const unsigned short normal_i2c[] = { 0x2C, 0x2D, 0x2E, I2C_CLIENT_END };
 
-/* Insmod parameters */
-I2C_CLIENT_INSMOD_1(adt7473);
-
 /* ADT7473 registers */
 #define ADT7473_REG_BASE_ADDR			0x20
 
@@ -166,15 +163,14 @@ struct adt7473_data {
 
 static int adt7473_probe(struct i2c_client *client,
 			 const struct i2c_device_id *id);
-static int adt7473_detect(struct i2c_client *client, int kind,
+static int adt7473_detect(struct i2c_client *client,
 			  struct i2c_board_info *info);
 static int adt7473_remove(struct i2c_client *client);
 
 static const struct i2c_device_id adt7473_id[] = {
-	{ "adt7473", adt7473 },
+	{ "adt7473", 0 },
 	{ }
 };
-MODULE_DEVICE_TABLE(i2c, adt7473_id);
 
 static struct i2c_driver adt7473_driver = {
 	.class		= I2C_CLASS_HWMON,
@@ -185,7 +181,7 @@ static struct i2c_driver adt7473_driver = {
 	.remove		= adt7473_remove,
 	.id_table	= adt7473_id,
 	.detect		= adt7473_detect,
-	.address_data	= &addr_data,
+	.address_list	= normal_i2c,
 };
 
 /*
@@ -1086,31 +1082,26 @@ static struct attribute *adt7473_attr[] =
 };
 
 /* Return 0 if detection is successful, -ENODEV otherwise */
-static int adt7473_detect(struct i2c_client *client, int kind,
+static int adt7473_detect(struct i2c_client *client,
 			  struct i2c_board_info *info)
 {
 	struct i2c_adapter *adapter = client->adapter;
+	int vendor, device, revision;
 
 	if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA))
 		return -ENODEV;
 
-	if (kind <= 0) {
-		int vendor, device, revision;
-
-		vendor = i2c_smbus_read_byte_data(client, ADT7473_REG_VENDOR);
-		if (vendor != ADT7473_VENDOR)
-			return -ENODEV;
+	vendor = i2c_smbus_read_byte_data(client, ADT7473_REG_VENDOR);
+	if (vendor != ADT7473_VENDOR)
+		return -ENODEV;
 
-		device = i2c_smbus_read_byte_data(client, ADT7473_REG_DEVICE);
-		if (device != ADT7473_DEVICE)
-			return -ENODEV;
+	device = i2c_smbus_read_byte_data(client, ADT7473_REG_DEVICE);
+	if (device != ADT7473_DEVICE)
+		return -ENODEV;
 
-		revision = i2c_smbus_read_byte_data(client,
-						    ADT7473_REG_REVISION);
-		if (revision != ADT7473_REV_68 && revision != ADT7473_REV_69)
-			return -ENODEV;
-	} else
-		dev_dbg(&adapter->dev, "detection forced\n");
+	revision = i2c_smbus_read_byte_data(client, ADT7473_REG_REVISION);
+	if (revision != ADT7473_REV_68 && revision != ADT7473_REV_69)
+		return -ENODEV;
 
 	strlcpy(info->type, "adt7473", I2C_NAME_SIZE);
 
@@ -1171,6 +1162,8 @@ static int adt7473_remove(struct i2c_client *client)
 
 static int __init adt7473_init(void)
 {
+	pr_notice("The adt7473 driver is deprecated, please use the adt7475 "
+		  "driver instead\n");
 	return i2c_add_driver(&adt7473_driver);
 }
 
diff --git a/drivers/hwmon/adt7475.c b/drivers/hwmon/adt7475.c
index b5a95193c694..a0c385145686 100644
--- a/drivers/hwmon/adt7475.c
+++ b/drivers/hwmon/adt7475.c
@@ -3,7 +3,8 @@
  * Copyright (C) 2007-2008, Advanced Micro Devices, Inc.
  * Copyright (C) 2008 Jordan Crouse <jordan@cosmicpenguin.net>
  * Copyright (C) 2008 Hans de Goede <hdegoede@redhat.com>
-
+ * Copyright (C) 2009 Jean Delvare <khali@linux-fr.org>
+ *
  * Derived from the lm83 driver by Jean Delvare
  *
  * This program is free software; you can redistribute it and/or modify
@@ -17,6 +18,7 @@
 #include <linux/i2c.h>
 #include <linux/hwmon.h>
 #include <linux/hwmon-sysfs.h>
+#include <linux/hwmon-vid.h>
 #include <linux/err.h>
 
 /* Indexes for the sysfs hooks */
@@ -39,7 +41,12 @@
 
 /* 7475 Common Registers */
 
-#define REG_VOLTAGE_BASE	0x21
+#define REG_DEVREV2		0x12	/* ADT7490 only */
+
+#define REG_VTT			0x1E	/* ADT7490 only */
+#define REG_EXTEND3		0x1F	/* ADT7490 only */
+
+#define REG_VOLTAGE_BASE	0x20
 #define REG_TEMP_BASE		0x25
 #define REG_TACH_BASE		0x28
 #define REG_PWM_BASE		0x30
@@ -47,12 +54,15 @@
 
 #define REG_DEVID		0x3D
 #define REG_VENDID		0x3E
+#define REG_DEVID2		0x3F
 
 #define REG_STATUS1		0x41
 #define REG_STATUS2		0x42
 
-#define REG_VOLTAGE_MIN_BASE	0x46
-#define REG_VOLTAGE_MAX_BASE	0x47
+#define REG_VID			0x43	/* ADT7476 only */
+
+#define REG_VOLTAGE_MIN_BASE	0x44
+#define REG_VOLTAGE_MAX_BASE	0x45
 
 #define REG_TEMP_MIN_BASE	0x4E
 #define REG_TEMP_MAX_BASE	0x4F
@@ -73,16 +83,39 @@
 
 #define REG_TEMP_OFFSET_BASE	0x70
 
+#define REG_CONFIG2		0x73
+
 #define REG_EXTEND1		0x76
 #define REG_EXTEND2		0x77
+
+#define REG_CONFIG3		0x78
 #define REG_CONFIG5		0x7C
+#define REG_CONFIG4		0x7D
+
+#define REG_STATUS4		0x81	/* ADT7490 only */
+
+#define REG_VTT_MIN		0x84	/* ADT7490 only */
+#define REG_VTT_MAX		0x86	/* ADT7490 only */
+
+#define VID_VIDSEL		0x80	/* ADT7476 only */
+
+#define CONFIG2_ATTN		0x20
+
+#define CONFIG3_SMBALERT	0x01
+#define CONFIG3_THERM		0x02
+
+#define CONFIG4_PINFUNC		0x03
+#define CONFIG4_MAXDUTY		0x08
+#define CONFIG4_ATTN_IN10	0x30
+#define CONFIG4_ATTN_IN43	0xC0
 
 #define CONFIG5_TWOSCOMP	0x01
 #define CONFIG5_TEMPOFFSET	0x02
+#define CONFIG5_VIDGPIO		0x10	/* ADT7476 only */
 
 /* ADT7475 Settings */
 
-#define ADT7475_VOLTAGE_COUNT	2
+#define ADT7475_VOLTAGE_COUNT	5	/* Not counting Vtt */
 #define ADT7475_TEMP_COUNT	3
 #define ADT7475_TACH_COUNT	4
 #define ADT7475_PWM_COUNT	3
@@ -113,12 +146,15 @@
 #define TEMP_OFFSET_REG(idx) (REG_TEMP_OFFSET_BASE + (idx))
 #define TEMP_TRANGE_REG(idx) (REG_TEMP_TRANGE_BASE + (idx))
 
-static unsigned short normal_i2c[] = { 0x2e, I2C_CLIENT_END };
+static unsigned short normal_i2c[] = { 0x2c, 0x2d, 0x2e, I2C_CLIENT_END };
 
-I2C_CLIENT_INSMOD_1(adt7475);
+enum chips { adt7473, adt7475, adt7476, adt7490 };
 
 static const struct i2c_device_id adt7475_id[] = {
+	{ "adt7473", adt7473 },
 	{ "adt7475", adt7475 },
+	{ "adt7476", adt7476 },
+	{ "adt7490", adt7490 },
 	{ }
 };
 MODULE_DEVICE_TABLE(i2c, adt7475_id);
@@ -131,15 +167,24 @@ struct adt7475_data {
 	unsigned long limits_updated;
 	char valid;
 
+	u8 config4;
 	u8 config5;
-	u16 alarms;
-	u16 voltage[3][3];
+	u8 has_voltage;
+	u8 bypass_attn;		/* Bypass voltage attenuator */
+	u8 has_pwm2:1;
+	u8 has_fan4:1;
+	u8 has_vid:1;
+	u32 alarms;
+	u16 voltage[3][6];
 	u16 temp[7][3];
 	u16 tach[2][4];
 	u8 pwm[4][3];
 	u8 range[3];
 	u8 pwmctl[3];
 	u8 pwmchan[3];
+
+	u8 vid;
+	u8 vrm;
 };
 
 static struct i2c_driver adt7475_driver;
@@ -196,26 +241,35 @@ static inline u16 rpm2tach(unsigned long rpm)
 	return SENSORS_LIMIT((90000 * 60) / rpm, 1, 0xFFFF);
 }
 
-static inline int reg2vcc(u16 reg)
-{
-	return (4296 * reg) / 1000;
-}
+/* Scaling factors for voltage inputs, taken from the ADT7490 datasheet */
+static const int adt7473_in_scaling[ADT7475_VOLTAGE_COUNT + 1][2] = {
+	{ 45, 94 },	/* +2.5V */
+	{ 175, 525 },	/* Vccp */
+	{ 68, 71 },	/* Vcc */
+	{ 93, 47 },	/* +5V */
+	{ 120, 20 },	/* +12V */
+	{ 45, 45 },	/* Vtt */
+};
 
-static inline int reg2vccp(u16 reg)
+static inline int reg2volt(int channel, u16 reg, u8 bypass_attn)
 {
-	return (2929 * reg) / 1000;
-}
+	const int *r = adt7473_in_scaling[channel];
 
-static inline u16 vcc2reg(long vcc)
-{
-	vcc = SENSORS_LIMIT(vcc, 0, 4396);
-	return (vcc * 1000) / 4296;
+	if (bypass_attn & (1 << channel))
+		return DIV_ROUND_CLOSEST(reg * 2250, 1024);
+	return DIV_ROUND_CLOSEST(reg * (r[0] + r[1]) * 2250, r[1] * 1024);
 }
 
-static inline u16 vccp2reg(long vcc)
+static inline u16 volt2reg(int channel, long volt, u8 bypass_attn)
 {
-	vcc = SENSORS_LIMIT(vcc, 0, 2998);
-	return (vcc * 1000) / 2929;
+	const int *r = adt7473_in_scaling[channel];
+	long reg;
+
+	if (bypass_attn & (1 << channel))
+		reg = (volt * 1024) / 2250;
+	else
+		reg = (volt * r[1] * 1024) / ((r[0] + r[1]) * 2250);
+	return SENSORS_LIMIT(reg, 0, 1023) & (0xff << 2);
 }
 
 static u16 adt7475_read_word(struct i2c_client *client, int reg)
@@ -271,12 +325,11 @@ static ssize_t show_voltage(struct device *dev, struct device_attribute *attr,
 	switch (sattr->nr) {
 	case ALARM:
 		return sprintf(buf, "%d\n",
-			       (data->alarms >> (sattr->index + 1)) & 1);
+			       (data->alarms >> sattr->index) & 1);
 	default:
 		val = data->voltage[sattr->nr][sattr->index];
 		return sprintf(buf, "%d\n",
-			       sattr->index ==
-			       0 ? reg2vccp(val) : reg2vcc(val));
+			       reg2volt(sattr->index, val, data->bypass_attn));
 	}
 }
 
@@ -296,12 +349,19 @@ static ssize_t set_voltage(struct device *dev, struct device_attribute *attr,
 	mutex_lock(&data->lock);
 
 	data->voltage[sattr->nr][sattr->index] =
-		sattr->index ? vcc2reg(val) : vccp2reg(val);
+				volt2reg(sattr->index, val, data->bypass_attn);
 
-	if (sattr->nr == MIN)
-		reg = VOLTAGE_MIN_REG(sattr->index);
-	else
-		reg = VOLTAGE_MAX_REG(sattr->index);
+	if (sattr->index < ADT7475_VOLTAGE_COUNT) {
+		if (sattr->nr == MIN)
+			reg = VOLTAGE_MIN_REG(sattr->index);
+		else
+			reg = VOLTAGE_MAX_REG(sattr->index);
+	} else {
+		if (sattr->nr == MIN)
+			reg = REG_VTT_MIN;
+		else
+			reg = REG_VTT_MAX;
+	}
 
 	i2c_smbus_write_byte_data(client, reg,
 				  data->voltage[sattr->nr][sattr->index] >> 2);
@@ -778,18 +838,103 @@ static ssize_t set_pwmfreq(struct device *dev, struct device_attribute *attr,
 	return count;
 }
 
-static SENSOR_DEVICE_ATTR_2(in1_input, S_IRUGO, show_voltage, NULL, INPUT, 0);
-static SENSOR_DEVICE_ATTR_2(in1_max, S_IRUGO | S_IWUSR, show_voltage,
+static ssize_t show_pwm_at_crit(struct device *dev,
+				struct device_attribute *devattr, char *buf)
+{
+	struct adt7475_data *data = adt7475_update_device(dev);
+	return sprintf(buf, "%d\n", !!(data->config4 & CONFIG4_MAXDUTY));
+}
+
+static ssize_t set_pwm_at_crit(struct device *dev,
+			       struct device_attribute *devattr,
+			       const char *buf, size_t count)
+{
+	struct i2c_client *client = to_i2c_client(dev);
+	struct adt7475_data *data = i2c_get_clientdata(client);
+	long val;
+
+	if (strict_strtol(buf, 10, &val))
+		return -EINVAL;
+	if (val != 0 && val != 1)
+		return -EINVAL;
+
+	mutex_lock(&data->lock);
+	data->config4 = i2c_smbus_read_byte_data(client, REG_CONFIG4);
+	if (val)
+		data->config4 |= CONFIG4_MAXDUTY;
+	else
+		data->config4 &= ~CONFIG4_MAXDUTY;
+	i2c_smbus_write_byte_data(client, REG_CONFIG4, data->config4);
+	mutex_unlock(&data->lock);
+
+	return count;
+}
+
+static ssize_t show_vrm(struct device *dev, struct device_attribute *devattr,
+			char *buf)
+{
+	struct adt7475_data *data = dev_get_drvdata(dev);
+	return sprintf(buf, "%d\n", (int)data->vrm);
+}
+
+static ssize_t set_vrm(struct device *dev, struct device_attribute *devattr,
+		       const char *buf, size_t count)
+{
+	struct adt7475_data *data = dev_get_drvdata(dev);
+	long val;
+
+	if (strict_strtol(buf, 10, &val))
+		return -EINVAL;
+	if (val < 0 || val > 255)
+		return -EINVAL;
+	data->vrm = val;
+
+	return count;
+}
+
+static ssize_t show_vid(struct device *dev, struct device_attribute *devattr,
+			char *buf)
+{
+	struct adt7475_data *data = adt7475_update_device(dev);
+	return sprintf(buf, "%d\n", vid_from_reg(data->vid, data->vrm));
+}
+
+static SENSOR_DEVICE_ATTR_2(in0_input, S_IRUGO, show_voltage, NULL, INPUT, 0);
+static SENSOR_DEVICE_ATTR_2(in0_max, S_IRUGO | S_IWUSR, show_voltage,
 			    set_voltage, MAX, 0);
-static SENSOR_DEVICE_ATTR_2(in1_min, S_IRUGO | S_IWUSR, show_voltage,
+static SENSOR_DEVICE_ATTR_2(in0_min, S_IRUGO | S_IWUSR, show_voltage,
 			    set_voltage, MIN, 0);
-static SENSOR_DEVICE_ATTR_2(in1_alarm, S_IRUGO, show_voltage, NULL, ALARM, 0);
-static SENSOR_DEVICE_ATTR_2(in2_input, S_IRUGO, show_voltage, NULL, INPUT, 1);
-static SENSOR_DEVICE_ATTR_2(in2_max, S_IRUGO | S_IWUSR, show_voltage,
+static SENSOR_DEVICE_ATTR_2(in0_alarm, S_IRUGO, show_voltage, NULL, ALARM, 0);
+static SENSOR_DEVICE_ATTR_2(in1_input, S_IRUGO, show_voltage, NULL, INPUT, 1);
+static SENSOR_DEVICE_ATTR_2(in1_max, S_IRUGO | S_IWUSR, show_voltage,
 			    set_voltage, MAX, 1);
-static SENSOR_DEVICE_ATTR_2(in2_min, S_IRUGO | S_IWUSR, show_voltage,
+static SENSOR_DEVICE_ATTR_2(in1_min, S_IRUGO | S_IWUSR, show_voltage,
 			    set_voltage, MIN, 1);
-static SENSOR_DEVICE_ATTR_2(in2_alarm, S_IRUGO, show_voltage, NULL, ALARM, 1);
+static SENSOR_DEVICE_ATTR_2(in1_alarm, S_IRUGO, show_voltage, NULL, ALARM, 1);
+static SENSOR_DEVICE_ATTR_2(in2_input, S_IRUGO, show_voltage, NULL, INPUT, 2);
+static SENSOR_DEVICE_ATTR_2(in2_max, S_IRUGO | S_IWUSR, show_voltage,
+			    set_voltage, MAX, 2);
+static SENSOR_DEVICE_ATTR_2(in2_min, S_IRUGO | S_IWUSR, show_voltage,
+			    set_voltage, MIN, 2);
+static SENSOR_DEVICE_ATTR_2(in2_alarm, S_IRUGO, show_voltage, NULL, ALARM, 2);
+static SENSOR_DEVICE_ATTR_2(in3_input, S_IRUGO, show_voltage, NULL, INPUT, 3);
+static SENSOR_DEVICE_ATTR_2(in3_max, S_IRUGO | S_IWUSR, show_voltage,
+			    set_voltage, MAX, 3);
+static SENSOR_DEVICE_ATTR_2(in3_min, S_IRUGO | S_IWUSR, show_voltage,
+			    set_voltage, MIN, 3);
+static SENSOR_DEVICE_ATTR_2(in3_alarm, S_IRUGO, show_voltage, NULL, ALARM, 3);
+static SENSOR_DEVICE_ATTR_2(in4_input, S_IRUGO, show_voltage, NULL, INPUT, 4);
+static SENSOR_DEVICE_ATTR_2(in4_max, S_IRUGO | S_IWUSR, show_voltage,
+			    set_voltage, MAX, 4);
+static SENSOR_DEVICE_ATTR_2(in4_min, S_IRUGO | S_IWUSR, show_voltage,
+			    set_voltage, MIN, 4);
+static SENSOR_DEVICE_ATTR_2(in4_alarm, S_IRUGO, show_voltage, NULL, ALARM, 8);
+static SENSOR_DEVICE_ATTR_2(in5_input, S_IRUGO, show_voltage, NULL, INPUT, 5);
+static SENSOR_DEVICE_ATTR_2(in5_max, S_IRUGO | S_IWUSR, show_voltage,
+			    set_voltage, MAX, 5);
+static SENSOR_DEVICE_ATTR_2(in5_min, S_IRUGO | S_IWUSR, show_voltage,
+			    set_voltage, MIN, 5);
+static SENSOR_DEVICE_ATTR_2(in5_alarm, S_IRUGO, show_voltage, NULL, ALARM, 31);
 static SENSOR_DEVICE_ATTR_2(temp1_input, S_IRUGO, show_temp, NULL, INPUT, 0);
 static SENSOR_DEVICE_ATTR_2(temp1_alarm, S_IRUGO, show_temp, NULL, ALARM, 0);
 static SENSOR_DEVICE_ATTR_2(temp1_fault, S_IRUGO, show_temp, NULL, FAULT, 0);
@@ -893,6 +1038,13 @@ static SENSOR_DEVICE_ATTR_2(pwm3_auto_point1_pwm, S_IRUGO | S_IWUSR, show_pwm,
 static SENSOR_DEVICE_ATTR_2(pwm3_auto_point2_pwm, S_IRUGO | S_IWUSR, show_pwm,
 			    set_pwm, MAX, 2);
 
+/* Non-standard name, might need revisiting */
+static DEVICE_ATTR(pwm_use_point2_pwm_at_crit, S_IWUSR | S_IRUGO,
+		   show_pwm_at_crit, set_pwm_at_crit);
+
+static DEVICE_ATTR(vrm, S_IWUSR | S_IRUGO, show_vrm, set_vrm);
+static DEVICE_ATTR(cpu0_vid, S_IRUGO, show_vid, NULL);
+
 static struct attribute *adt7475_attrs[] = {
 	&sensor_dev_attr_in1_input.dev_attr.attr,
 	&sensor_dev_attr_in1_max.dev_attr.attr,
@@ -940,60 +1092,156 @@ static struct attribute *adt7475_attrs[] = {
 	&sensor_dev_attr_fan3_input.dev_attr.attr,
 	&sensor_dev_attr_fan3_min.dev_attr.attr,
 	&sensor_dev_attr_fan3_alarm.dev_attr.attr,
-	&sensor_dev_attr_fan4_input.dev_attr.attr,
-	&sensor_dev_attr_fan4_min.dev_attr.attr,
-	&sensor_dev_attr_fan4_alarm.dev_attr.attr,
 	&sensor_dev_attr_pwm1.dev_attr.attr,
 	&sensor_dev_attr_pwm1_freq.dev_attr.attr,
 	&sensor_dev_attr_pwm1_enable.dev_attr.attr,
 	&sensor_dev_attr_pwm1_auto_channels_temp.dev_attr.attr,
 	&sensor_dev_attr_pwm1_auto_point1_pwm.dev_attr.attr,
 	&sensor_dev_attr_pwm1_auto_point2_pwm.dev_attr.attr,
-	&sensor_dev_attr_pwm2.dev_attr.attr,
-	&sensor_dev_attr_pwm2_freq.dev_attr.attr,
-	&sensor_dev_attr_pwm2_enable.dev_attr.attr,
-	&sensor_dev_attr_pwm2_auto_channels_temp.dev_attr.attr,
-	&sensor_dev_attr_pwm2_auto_point1_pwm.dev_attr.attr,
-	&sensor_dev_attr_pwm2_auto_point2_pwm.dev_attr.attr,
 	&sensor_dev_attr_pwm3.dev_attr.attr,
 	&sensor_dev_attr_pwm3_freq.dev_attr.attr,
 	&sensor_dev_attr_pwm3_enable.dev_attr.attr,
 	&sensor_dev_attr_pwm3_auto_channels_temp.dev_attr.attr,
 	&sensor_dev_attr_pwm3_auto_point1_pwm.dev_attr.attr,
 	&sensor_dev_attr_pwm3_auto_point2_pwm.dev_attr.attr,
+	&dev_attr_pwm_use_point2_pwm_at_crit.attr,
 	NULL,
 };
 
-struct attribute_group adt7475_attr_group = { .attrs = adt7475_attrs };
+static struct attribute *fan4_attrs[] = {
+	&sensor_dev_attr_fan4_input.dev_attr.attr,
+	&sensor_dev_attr_fan4_min.dev_attr.attr,
+	&sensor_dev_attr_fan4_alarm.dev_attr.attr,
+	NULL
+};
+
+static struct attribute *pwm2_attrs[] = {
+	&sensor_dev_attr_pwm2.dev_attr.attr,
+	&sensor_dev_attr_pwm2_freq.dev_attr.attr,
+	&sensor_dev_attr_pwm2_enable.dev_attr.attr,
+	&sensor_dev_attr_pwm2_auto_channels_temp.dev_attr.attr,
+	&sensor_dev_attr_pwm2_auto_point1_pwm.dev_attr.attr,
+	&sensor_dev_attr_pwm2_auto_point2_pwm.dev_attr.attr,
+	NULL
+};
+
+static struct attribute *in0_attrs[] = {
+	&sensor_dev_attr_in0_input.dev_attr.attr,
+	&sensor_dev_attr_in0_max.dev_attr.attr,
+	&sensor_dev_attr_in0_min.dev_attr.attr,
+	&sensor_dev_attr_in0_alarm.dev_attr.attr,
+	NULL
+};
+
+static struct attribute *in3_attrs[] = {
+	&sensor_dev_attr_in3_input.dev_attr.attr,
+	&sensor_dev_attr_in3_max.dev_attr.attr,
+	&sensor_dev_attr_in3_min.dev_attr.attr,
+	&sensor_dev_attr_in3_alarm.dev_attr.attr,
+	NULL
+};
+
+static struct attribute *in4_attrs[] = {
+	&sensor_dev_attr_in4_input.dev_attr.attr,
+	&sensor_dev_attr_in4_max.dev_attr.attr,
+	&sensor_dev_attr_in4_min.dev_attr.attr,
+	&sensor_dev_attr_in4_alarm.dev_attr.attr,
+	NULL
+};
 
-static int adt7475_detect(struct i2c_client *client, int kind,
+static struct attribute *in5_attrs[] = {
+	&sensor_dev_attr_in5_input.dev_attr.attr,
+	&sensor_dev_attr_in5_max.dev_attr.attr,
+	&sensor_dev_attr_in5_min.dev_attr.attr,
+	&sensor_dev_attr_in5_alarm.dev_attr.attr,
+	NULL
+};
+
+static struct attribute *vid_attrs[] = {
+	&dev_attr_cpu0_vid.attr,
+	&dev_attr_vrm.attr,
+	NULL
+};
+
+static struct attribute_group adt7475_attr_group = { .attrs = adt7475_attrs };
+static struct attribute_group fan4_attr_group = { .attrs = fan4_attrs };
+static struct attribute_group pwm2_attr_group = { .attrs = pwm2_attrs };
+static struct attribute_group in0_attr_group = { .attrs = in0_attrs };
+static struct attribute_group in3_attr_group = { .attrs = in3_attrs };
+static struct attribute_group in4_attr_group = { .attrs = in4_attrs };
+static struct attribute_group in5_attr_group = { .attrs = in5_attrs };
+static struct attribute_group vid_attr_group = { .attrs = vid_attrs };
+
+static int adt7475_detect(struct i2c_client *client,
 			  struct i2c_board_info *info)
 {
 	struct i2c_adapter *adapter = client->adapter;
+	int vendid, devid, devid2;
+	const char *name;
 
 	if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA))
 		return -ENODEV;
 
-	if (kind <= 0) {
-		if (adt7475_read(REG_VENDID) != 0x41 ||
-		    adt7475_read(REG_DEVID) != 0x75) {
-			dev_err(&adapter->dev,
-				"Couldn't detect a adt7475 part at 0x%02x\n",
-				(unsigned int)client->addr);
-			return -ENODEV;
-		}
+	vendid = adt7475_read(REG_VENDID);
+	devid2 = adt7475_read(REG_DEVID2);
+	if (vendid != 0x41 ||		/* Analog Devices */
+	    (devid2 & 0xf8) != 0x68)
+		return -ENODEV;
+
+	devid = adt7475_read(REG_DEVID);
+	if (devid == 0x73)
+		name = "adt7473";
+	else if (devid == 0x75 && client->addr == 0x2e)
+		name = "adt7475";
+	else if (devid == 0x76)
+		name = "adt7476";
+	else if ((devid2 & 0xfc) == 0x6c)
+		name = "adt7490";
+	else {
+		dev_dbg(&adapter->dev,
+			"Couldn't detect an ADT7473/75/76/90 part at "
+			"0x%02x\n", (unsigned int)client->addr);
+		return -ENODEV;
 	}
 
-	strlcpy(info->type, adt7475_id[0].name, I2C_NAME_SIZE);
+	strlcpy(info->type, name, I2C_NAME_SIZE);
 
 	return 0;
 }
 
+static void adt7475_remove_files(struct i2c_client *client,
+				 struct adt7475_data *data)
+{
+	sysfs_remove_group(&client->dev.kobj, &adt7475_attr_group);
+	if (data->has_fan4)
+		sysfs_remove_group(&client->dev.kobj, &fan4_attr_group);
+	if (data->has_pwm2)
+		sysfs_remove_group(&client->dev.kobj, &pwm2_attr_group);
+	if (data->has_voltage & (1 << 0))
+		sysfs_remove_group(&client->dev.kobj, &in0_attr_group);
+	if (data->has_voltage & (1 << 3))
+		sysfs_remove_group(&client->dev.kobj, &in3_attr_group);
+	if (data->has_voltage & (1 << 4))
+		sysfs_remove_group(&client->dev.kobj, &in4_attr_group);
+	if (data->has_voltage & (1 << 5))
+		sysfs_remove_group(&client->dev.kobj, &in5_attr_group);
+	if (data->has_vid)
+		sysfs_remove_group(&client->dev.kobj, &vid_attr_group);
+}
+
 static int adt7475_probe(struct i2c_client *client,
 			 const struct i2c_device_id *id)
 {
+	static const char *names[] = {
+		[adt7473] = "ADT7473",
+		[adt7475] = "ADT7475",
+		[adt7476] = "ADT7476",
+		[adt7490] = "ADT7490",
+	};
+
 	struct adt7475_data *data;
-	int i, ret = 0;
+	int i, ret = 0, revision;
+	u8 config2, config3;
 
 	data = kzalloc(sizeof(*data), GFP_KERNEL);
 	if (data == NULL)
@@ -1002,6 +1250,70 @@ static int adt7475_probe(struct i2c_client *client,
 	mutex_init(&data->lock);
 	i2c_set_clientdata(client, data);
 
+	/* Initialize device-specific values */
+	switch (id->driver_data) {
+	case adt7476:
+		data->has_voltage = 0x0e;	/* in1 to in3 */
+		revision = adt7475_read(REG_DEVID2) & 0x07;
+		break;
+	case adt7490:
+		data->has_voltage = 0x3e;	/* in1 to in5 */
+		revision = adt7475_read(REG_DEVID2) & 0x03;
+		if (revision == 0x03)
+			revision += adt7475_read(REG_DEVREV2);
+		break;
+	default:
+		data->has_voltage = 0x06;	/* in1, in2 */
+		revision = adt7475_read(REG_DEVID2) & 0x07;
+	}
+
+	config3 = adt7475_read(REG_CONFIG3);
+	/* Pin PWM2 may alternatively be used for ALERT output */
+	if (!(config3 & CONFIG3_SMBALERT))
+		data->has_pwm2 = 1;
+	/* Meaning of this bit is inverted for the ADT7473-1 */
+	if (id->driver_data == adt7473 && revision >= 1)
+		data->has_pwm2 = !data->has_pwm2;
+
+	data->config4 = adt7475_read(REG_CONFIG4);
+	/* Pin TACH4 may alternatively be used for THERM */
+	if ((data->config4 & CONFIG4_PINFUNC) == 0x0)
+		data->has_fan4 = 1;
+
+	/* THERM configuration is more complex on the ADT7476 and ADT7490,
+	   because 2 different pins (TACH4 and +2.5 Vin) can be used for
+	   this function */
+	if (id->driver_data == adt7490) {
+		if ((data->config4 & CONFIG4_PINFUNC) == 0x1 &&
+		    !(config3 & CONFIG3_THERM))
+			data->has_fan4 = 1;
+	}
+	if (id->driver_data == adt7476 || id->driver_data == adt7490) {
+		if (!(config3 & CONFIG3_THERM) ||
+		    (data->config4 & CONFIG4_PINFUNC) == 0x1)
+			data->has_voltage |= (1 << 0);		/* in0 */
+	}
+
+	/* On the ADT7476, the +12V input pin may instead be used as VID5,
+	   and VID pins may alternatively be used as GPIO */
+	if (id->driver_data == adt7476) {
+		u8 vid = adt7475_read(REG_VID);
+		if (!(vid & VID_VIDSEL))
+			data->has_voltage |= (1 << 4);		/* in4 */
+
+		data->has_vid = !(adt7475_read(REG_CONFIG5) & CONFIG5_VIDGPIO);
+	}
+
+	/* Voltage attenuators can be bypassed, globally or individually */
+	config2 = adt7475_read(REG_CONFIG2);
+	if (config2 & CONFIG2_ATTN) {
+		data->bypass_attn = (0x3 << 3) | 0x3;
+	} else {
+		data->bypass_attn = ((data->config4 & CONFIG4_ATTN_IN10) >> 4) |
+				    ((data->config4 & CONFIG4_ATTN_IN43) >> 3);
+	}
+	data->bypass_attn &= data->has_voltage;
+
 	/* Call adt7475_read_pwm for all pwm's as this will reprogram any
 	   pwm's which are disabled to manual mode with 0% duty cycle */
 	for (i = 0; i < ADT7475_PWM_COUNT; i++)
@@ -1011,16 +1323,70 @@ static int adt7475_probe(struct i2c_client *client,
 	if (ret)
 		goto efree;
 
+	/* Features that can be disabled individually */
+	if (data->has_fan4) {
+		ret = sysfs_create_group(&client->dev.kobj, &fan4_attr_group);
+		if (ret)
+			goto eremove;
+	}
+	if (data->has_pwm2) {
+		ret = sysfs_create_group(&client->dev.kobj, &pwm2_attr_group);
+		if (ret)
+			goto eremove;
+	}
+	if (data->has_voltage & (1 << 0)) {
+		ret = sysfs_create_group(&client->dev.kobj, &in0_attr_group);
+		if (ret)
+			goto eremove;
+	}
+	if (data->has_voltage & (1 << 3)) {
+		ret = sysfs_create_group(&client->dev.kobj, &in3_attr_group);
+		if (ret)
+			goto eremove;
+	}
+	if (data->has_voltage & (1 << 4)) {
+		ret = sysfs_create_group(&client->dev.kobj, &in4_attr_group);
+		if (ret)
+			goto eremove;
+	}
+	if (data->has_voltage & (1 << 5)) {
+		ret = sysfs_create_group(&client->dev.kobj, &in5_attr_group);
+		if (ret)
+			goto eremove;
+	}
+	if (data->has_vid) {
+		data->vrm = vid_which_vrm();
+		ret = sysfs_create_group(&client->dev.kobj, &vid_attr_group);
+		if (ret)
+			goto eremove;
+	}
+
 	data->hwmon_dev = hwmon_device_register(&client->dev);
 	if (IS_ERR(data->hwmon_dev)) {
 		ret = PTR_ERR(data->hwmon_dev);
 		goto eremove;
 	}
 
+	dev_info(&client->dev, "%s device, revision %d\n",
+		 names[id->driver_data], revision);
+	if ((data->has_voltage & 0x11) || data->has_fan4 || data->has_pwm2)
+		dev_info(&client->dev, "Optional features:%s%s%s%s%s\n",
+			 (data->has_voltage & (1 << 0)) ? " in0" : "",
+			 (data->has_voltage & (1 << 4)) ? " in4" : "",
+			 data->has_fan4 ? " fan4" : "",
+			 data->has_pwm2 ? " pwm2" : "",
+			 data->has_vid ? " vid" : "");
+	if (data->bypass_attn)
+		dev_info(&client->dev, "Bypassing attenuators on:%s%s%s%s\n",
+			 (data->bypass_attn & (1 << 0)) ? " in0" : "",
+			 (data->bypass_attn & (1 << 1)) ? " in1" : "",
+			 (data->bypass_attn & (1 << 3)) ? " in3" : "",
+			 (data->bypass_attn & (1 << 4)) ? " in4" : "");
+
 	return 0;
 
 eremove:
-	sysfs_remove_group(&client->dev.kobj, &adt7475_attr_group);
+	adt7475_remove_files(client, data);
 efree:
 	kfree(data);
 	return ret;
@@ -1031,7 +1397,7 @@ static int adt7475_remove(struct i2c_client *client)
 	struct adt7475_data *data = i2c_get_clientdata(client);
 
 	hwmon_device_unregister(data->hwmon_dev);
-	sysfs_remove_group(&client->dev.kobj, &adt7475_attr_group);
+	adt7475_remove_files(client, data);
 	kfree(data);
 
 	return 0;
@@ -1046,7 +1412,7 @@ static struct i2c_driver adt7475_driver = {
 	.remove		= adt7475_remove,
 	.id_table	= adt7475_id,
 	.detect		= adt7475_detect,
-	.address_data	= &addr_data,
+	.address_list	= normal_i2c,
 };
 
 static void adt7475_read_hystersis(struct i2c_client *client)
@@ -1116,7 +1482,7 @@ static struct adt7475_data *adt7475_update_device(struct device *dev)
 {
 	struct i2c_client *client = to_i2c_client(dev);
 	struct adt7475_data *data = i2c_get_clientdata(client);
-	u8 ext;
+	u16 ext;
 	int i;
 
 	mutex_lock(&data->lock);
@@ -1127,25 +1493,44 @@ static struct adt7475_data *adt7475_update_device(struct device *dev)
 		data->alarms = adt7475_read(REG_STATUS2) << 8;
 		data->alarms |= adt7475_read(REG_STATUS1);
 
-		ext = adt7475_read(REG_EXTEND1);
-		for (i = 0; i < ADT7475_VOLTAGE_COUNT; i++)
+		ext = (adt7475_read(REG_EXTEND2) << 8) |
+			adt7475_read(REG_EXTEND1);
+		for (i = 0; i < ADT7475_VOLTAGE_COUNT; i++) {
+			if (!(data->has_voltage & (1 << i)))
+				continue;
 			data->voltage[INPUT][i] =
 				(adt7475_read(VOLTAGE_REG(i)) << 2) |
-				((ext >> ((i + 1) * 2)) & 3);
+				((ext >> (i * 2)) & 3);
+		}
 
-		ext = adt7475_read(REG_EXTEND2);
 		for (i = 0; i < ADT7475_TEMP_COUNT; i++)
 			data->temp[INPUT][i] =
 				(adt7475_read(TEMP_REG(i)) << 2) |
-				((ext >> ((i + 1) * 2)) & 3);
+				((ext >> ((i + 5) * 2)) & 3);
 
-		for (i = 0; i < ADT7475_TACH_COUNT; i++)
+		if (data->has_voltage & (1 << 5)) {
+			data->alarms |= adt7475_read(REG_STATUS4) << 24;
+			ext = adt7475_read(REG_EXTEND3);
+			data->voltage[INPUT][5] = adt7475_read(REG_VTT) << 2 |
+				((ext >> 4) & 3);
+		}
+
+		for (i = 0; i < ADT7475_TACH_COUNT; i++) {
+			if (i == 3 && !data->has_fan4)
+				continue;
 			data->tach[INPUT][i] =
 				adt7475_read_word(client, TACH_REG(i));
+		}
 
 		/* Updated by hw when in auto mode */
-		for (i = 0; i < ADT7475_PWM_COUNT; i++)
+		for (i = 0; i < ADT7475_PWM_COUNT; i++) {
+			if (i == 1 && !data->has_pwm2)
+				continue;
 			data->pwm[INPUT][i] = adt7475_read(PWM_REG(i));
+		}
+
+		if (data->has_vid)
+			data->vid = adt7475_read(REG_VID) & 0x3f;
 
 		data->measure_updated = jiffies;
 	}
@@ -1153,9 +1538,12 @@ static struct adt7475_data *adt7475_update_device(struct device *dev)
 	/* Limits and settings, should never change update every 60 seconds */
 	if (time_after(jiffies, data->limits_updated + HZ * 60) ||
 	    !data->valid) {
+		data->config4 = adt7475_read(REG_CONFIG4);
 		data->config5 = adt7475_read(REG_CONFIG5);
 
 		for (i = 0; i < ADT7475_VOLTAGE_COUNT; i++) {
+			if (!(data->has_voltage & (1 << i)))
+				continue;
 			/* Adjust values so they match the input precision */
 			data->voltage[MIN][i] =
 				adt7475_read(VOLTAGE_MIN_REG(i)) << 2;
@@ -1163,6 +1551,11 @@ static struct adt7475_data *adt7475_update_device(struct device *dev)
 				adt7475_read(VOLTAGE_MAX_REG(i)) << 2;
 		}
 
+		if (data->has_voltage & (1 << 5)) {
+			data->voltage[MIN][5] = adt7475_read(REG_VTT_MIN) << 2;
+			data->voltage[MAX][5] = adt7475_read(REG_VTT_MAX) << 2;
+		}
+
 		for (i = 0; i < ADT7475_TEMP_COUNT; i++) {
 			/* Adjust values so they match the input precision */
 			data->temp[MIN][i] =
@@ -1178,11 +1571,16 @@ static struct adt7475_data *adt7475_update_device(struct device *dev)
 		}
 		adt7475_read_hystersis(client);
 
-		for (i = 0; i < ADT7475_TACH_COUNT; i++)
+		for (i = 0; i < ADT7475_TACH_COUNT; i++) {
+			if (i == 3 && !data->has_fan4)
+				continue;
 			data->tach[MIN][i] =
 				adt7475_read_word(client, TACH_MIN_REG(i));
+		}
 
 		for (i = 0; i < ADT7475_PWM_COUNT; i++) {
+			if (i == 1 && !data->has_pwm2)
+				continue;
 			data->pwm[MAX][i] = adt7475_read(PWM_MAX_REG(i));
 			data->pwm[MIN][i] = adt7475_read(PWM_MIN_REG(i));
 			/* Set the channel and control information */
diff --git a/drivers/hwmon/amc6821.c b/drivers/hwmon/amc6821.c
new file mode 100644
index 000000000000..1c89d922d619
--- /dev/null
+++ b/drivers/hwmon/amc6821.c
@@ -0,0 +1,1116 @@
+/*
+	amc6821.c - Part of lm_sensors, Linux kernel modules for hardware
+	monitoring
+	Copyright (C) 2009 T. Mertelj <tomaz.mertelj@guest.arnes.si>
+
+	Based on max6650.c:
+	Copyright (C) 2007 Hans J. Koch <hjk@linutronix.de>
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+
+#include <linux/kernel.h>	/* Needed for KERN_INFO */
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/jiffies.h>
+#include <linux/i2c.h>
+#include <linux/hwmon.h>
+#include <linux/hwmon-sysfs.h>
+#include <linux/err.h>
+#include <linux/mutex.h>
+
+
+/*
+ * Addresses to scan.
+ */
+
+static const unsigned short normal_i2c[] = {0x18, 0x19, 0x1a, 0x2c, 0x2d, 0x2e,
+	0x4c, 0x4d, 0x4e, I2C_CLIENT_END};
+
+
+
+/*
+ * Insmod parameters
+ */
+
+static int pwminv = 0;	/*Inverted PWM output. */
+module_param(pwminv, int, S_IRUGO);
+
+static int init = 1; /*Power-on initialization.*/
+module_param(init, int, S_IRUGO);
+
+
+enum chips { amc6821 };
+
+#define AMC6821_REG_DEV_ID 0x3D
+#define AMC6821_REG_COMP_ID 0x3E
+#define AMC6821_REG_CONF1 0x00
+#define AMC6821_REG_CONF2 0x01
+#define AMC6821_REG_CONF3 0x3F
+#define AMC6821_REG_CONF4 0x04
+#define AMC6821_REG_STAT1 0x02
+#define AMC6821_REG_STAT2 0x03
+#define AMC6821_REG_TDATA_LOW 0x08
+#define AMC6821_REG_TDATA_HI 0x09
+#define AMC6821_REG_LTEMP_HI 0x0A
+#define AMC6821_REG_RTEMP_HI 0x0B
+#define AMC6821_REG_LTEMP_LIMIT_MIN 0x15
+#define AMC6821_REG_LTEMP_LIMIT_MAX 0x14
+#define AMC6821_REG_RTEMP_LIMIT_MIN 0x19
+#define AMC6821_REG_RTEMP_LIMIT_MAX 0x18
+#define AMC6821_REG_LTEMP_CRIT 0x1B
+#define AMC6821_REG_RTEMP_CRIT 0x1D
+#define AMC6821_REG_PSV_TEMP 0x1C
+#define AMC6821_REG_DCY 0x22
+#define AMC6821_REG_LTEMP_FAN_CTRL 0x24
+#define AMC6821_REG_RTEMP_FAN_CTRL 0x25
+#define AMC6821_REG_DCY_LOW_TEMP 0x21
+
+#define AMC6821_REG_TACH_LLIMITL 0x10
+#define AMC6821_REG_TACH_LLIMITH 0x11
+#define AMC6821_REG_TACH_HLIMITL 0x12
+#define AMC6821_REG_TACH_HLIMITH 0x13
+
+#define AMC6821_CONF1_START 0x01
+#define AMC6821_CONF1_FAN_INT_EN 0x02
+#define AMC6821_CONF1_FANIE 0x04
+#define AMC6821_CONF1_PWMINV 0x08
+#define AMC6821_CONF1_FAN_FAULT_EN 0x10
+#define AMC6821_CONF1_FDRC0 0x20
+#define AMC6821_CONF1_FDRC1 0x40
+#define AMC6821_CONF1_THERMOVIE 0x80
+
+#define AMC6821_CONF2_PWM_EN 0x01
+#define AMC6821_CONF2_TACH_MODE 0x02
+#define AMC6821_CONF2_TACH_EN 0x04
+#define AMC6821_CONF2_RTFIE 0x08
+#define AMC6821_CONF2_LTOIE 0x10
+#define AMC6821_CONF2_RTOIE 0x20
+#define AMC6821_CONF2_PSVIE 0x40
+#define AMC6821_CONF2_RST 0x80
+
+#define AMC6821_CONF3_THERM_FAN_EN 0x80
+#define AMC6821_CONF3_REV_MASK 0x0F
+
+#define AMC6821_CONF4_OVREN 0x10
+#define AMC6821_CONF4_TACH_FAST 0x20
+#define AMC6821_CONF4_PSPR 0x40
+#define AMC6821_CONF4_MODE 0x80
+
+#define AMC6821_STAT1_RPM_ALARM 0x01
+#define AMC6821_STAT1_FANS 0x02
+#define AMC6821_STAT1_RTH 0x04
+#define AMC6821_STAT1_RTL 0x08
+#define AMC6821_STAT1_R_THERM 0x10
+#define AMC6821_STAT1_RTF 0x20
+#define AMC6821_STAT1_LTH 0x40
+#define AMC6821_STAT1_LTL 0x80
+
+#define AMC6821_STAT2_RTC 0x08
+#define AMC6821_STAT2_LTC 0x10
+#define AMC6821_STAT2_LPSV 0x20
+#define AMC6821_STAT2_L_THERM 0x40
+#define AMC6821_STAT2_THERM_IN 0x80
+
+enum {IDX_TEMP1_INPUT = 0, IDX_TEMP1_MIN, IDX_TEMP1_MAX,
+	IDX_TEMP1_CRIT, IDX_TEMP2_INPUT, IDX_TEMP2_MIN,
+	IDX_TEMP2_MAX, IDX_TEMP2_CRIT,
+	TEMP_IDX_LEN, };
+
+static const u8 temp_reg[] = {AMC6821_REG_LTEMP_HI,
+			AMC6821_REG_LTEMP_LIMIT_MIN,
+			AMC6821_REG_LTEMP_LIMIT_MAX,
+			AMC6821_REG_LTEMP_CRIT,
+			AMC6821_REG_RTEMP_HI,
+			AMC6821_REG_RTEMP_LIMIT_MIN,
+			AMC6821_REG_RTEMP_LIMIT_MAX,
+			AMC6821_REG_RTEMP_CRIT, };
+
+enum {IDX_FAN1_INPUT = 0, IDX_FAN1_MIN, IDX_FAN1_MAX,
+	FAN1_IDX_LEN, };
+
+static const u8 fan_reg_low[] = {AMC6821_REG_TDATA_LOW,
+			AMC6821_REG_TACH_LLIMITL,
+			AMC6821_REG_TACH_HLIMITL, };
+
+
+static const u8 fan_reg_hi[] = {AMC6821_REG_TDATA_HI,
+			AMC6821_REG_TACH_LLIMITH,
+			AMC6821_REG_TACH_HLIMITH, };
+
+static int amc6821_probe(
+		struct i2c_client *client,
+		const struct i2c_device_id *id);
+static int amc6821_detect(
+		struct i2c_client *client,
+		struct i2c_board_info *info);
+static int amc6821_init_client(struct i2c_client *client);
+static int amc6821_remove(struct i2c_client *client);
+static struct amc6821_data *amc6821_update_device(struct device *dev);
+
+/*
+ * Driver data (common to all clients)
+ */
+
+static const struct i2c_device_id amc6821_id[] = {
+	{ "amc6821", amc6821 },
+	{ }
+};
+
+MODULE_DEVICE_TABLE(i2c, amc6821_id);
+
+static struct i2c_driver amc6821_driver = {
+	.class = I2C_CLASS_HWMON,
+	.driver = {
+		.name	= "amc6821",
+	},
+	.probe = amc6821_probe,
+	.remove = amc6821_remove,
+	.id_table = amc6821_id,
+	.detect = amc6821_detect,
+	.address_list = normal_i2c,
+};
+
+
+/*
+ * Client data (each client gets its own)
+  */
+
+struct amc6821_data {
+	struct device *hwmon_dev;
+	struct mutex update_lock;
+	char valid; /* zero until following fields are valid */
+	unsigned long last_updated; /* in jiffies */
+
+	/* register values */
+	int temp[TEMP_IDX_LEN];
+
+	u16 fan[FAN1_IDX_LEN];
+	u8 fan1_div;
+
+	u8 pwm1;
+	u8 temp1_auto_point_temp[3];
+	u8 temp2_auto_point_temp[3];
+	u8 pwm1_auto_point_pwm[3];
+	u8 pwm1_enable;
+	u8 pwm1_auto_channels_temp;
+
+	u8 stat1;
+	u8 stat2;
+};
+
+
+static ssize_t get_temp(
+		struct device *dev,
+		struct device_attribute *devattr,
+		char *buf)
+{
+	struct amc6821_data *data = amc6821_update_device(dev);
+	int ix = to_sensor_dev_attr(devattr)->index;
+
+	return sprintf(buf, "%d\n", data->temp[ix] * 1000);
+}
+
+
+
+static ssize_t set_temp(
+		struct device *dev,
+		struct device_attribute *attr,
+		const char *buf,
+		size_t count)
+{
+	struct i2c_client *client = to_i2c_client(dev);
+	struct amc6821_data *data = i2c_get_clientdata(client);
+	int ix = to_sensor_dev_attr(attr)->index;
+	long val;
+
+	int ret = strict_strtol(buf, 10, &val);
+	if (ret)
+		return ret;
+	val = SENSORS_LIMIT(val / 1000, -128, 127);
+
+	mutex_lock(&data->update_lock);
+	data->temp[ix] = val;
+	if (i2c_smbus_write_byte_data(client, temp_reg[ix], data->temp[ix])) {
+		dev_err(&client->dev, "Register write error, aborting.\n");
+		count = -EIO;
+	}
+	mutex_unlock(&data->update_lock);
+	return count;
+}
+
+
+
+
+static ssize_t get_temp_alarm(
+	struct device *dev,
+	struct device_attribute *devattr,
+	char *buf)
+{
+	struct amc6821_data *data = amc6821_update_device(dev);
+	int ix = to_sensor_dev_attr(devattr)->index;
+	u8 flag;
+
+	switch (ix) {
+	case IDX_TEMP1_MIN:
+		flag = data->stat1 & AMC6821_STAT1_LTL;
+		break;
+	case IDX_TEMP1_MAX:
+		flag = data->stat1 & AMC6821_STAT1_LTH;
+		break;
+	case IDX_TEMP1_CRIT:
+		flag = data->stat2 & AMC6821_STAT2_LTC;
+		break;
+	case IDX_TEMP2_MIN:
+		flag = data->stat1 & AMC6821_STAT1_RTL;
+		break;
+	case IDX_TEMP2_MAX:
+		flag = data->stat1 & AMC6821_STAT1_RTH;
+		break;
+	case IDX_TEMP2_CRIT:
+		flag = data->stat2 & AMC6821_STAT2_RTC;
+		break;
+	default:
+		dev_dbg(dev, "Unknown attr->index (%d).\n", ix);
+		return -EINVAL;
+	}
+	if (flag)
+		return sprintf(buf, "1");
+	else
+		return sprintf(buf, "0");
+}
+
+
+
+
+static ssize_t get_temp2_fault(
+		struct device *dev,
+		struct device_attribute *devattr,
+		char *buf)
+{
+	struct amc6821_data *data = amc6821_update_device(dev);
+	if (data->stat1 & AMC6821_STAT1_RTF)
+		return sprintf(buf, "1");
+	else
+		return sprintf(buf, "0");
+}
+
+static ssize_t get_pwm1(
+		struct device *dev,
+		struct device_attribute *devattr,
+		char *buf)
+{
+	struct amc6821_data *data = amc6821_update_device(dev);
+	return sprintf(buf, "%d\n", data->pwm1);
+}
+
+static ssize_t set_pwm1(
+		struct device *dev,
+		struct device_attribute *devattr,
+		const char *buf,
+		size_t count)
+{
+	struct i2c_client *client = to_i2c_client(dev);
+	struct amc6821_data *data = i2c_get_clientdata(client);
+	long val;
+	int ret = strict_strtol(buf, 10, &val);
+	if (ret)
+		return ret;
+
+	mutex_lock(&data->update_lock);
+	data->pwm1 = SENSORS_LIMIT(val , 0, 255);
+	i2c_smbus_write_byte_data(client, AMC6821_REG_DCY, data->pwm1);
+	mutex_unlock(&data->update_lock);
+	return count;
+}
+
+static ssize_t get_pwm1_enable(
+		struct device *dev,
+		struct device_attribute *devattr,
+		char *buf)
+{
+	struct amc6821_data *data = amc6821_update_device(dev);
+	return sprintf(buf, "%d\n", data->pwm1_enable);
+}
+
+static ssize_t set_pwm1_enable(
+		struct device *dev,
+		struct device_attribute *attr,
+		const char *buf,
+		size_t count)
+{
+	struct i2c_client *client = to_i2c_client(dev);
+	struct amc6821_data *data = i2c_get_clientdata(client);
+	long val;
+	int config = strict_strtol(buf, 10, &val);
+	if (config)
+		return config;
+
+	config = i2c_smbus_read_byte_data(client, AMC6821_REG_CONF1);
+	if (config < 0) {
+			dev_err(&client->dev,
+			"Error reading configuration register, aborting.\n");
+			return -EIO;
+	}
+
+	switch (val) {
+	case 1:
+		config &= ~AMC6821_CONF1_FDRC0;
+		config &= ~AMC6821_CONF1_FDRC1;
+		break;
+	case 2:
+		config &= ~AMC6821_CONF1_FDRC0;
+		config |= AMC6821_CONF1_FDRC1;
+		break;
+	case 3:
+		config |= AMC6821_CONF1_FDRC0;
+		config |= AMC6821_CONF1_FDRC1;
+		break;
+	default:
+		return -EINVAL;
+	}
+	mutex_lock(&data->update_lock);
+	if (i2c_smbus_write_byte_data(client, AMC6821_REG_CONF1, config)) {
+			dev_err(&client->dev,
+			"Configuration register write error, aborting.\n");
+			count = -EIO;
+	}
+	mutex_unlock(&data->update_lock);
+	return count;
+}
+
+
+static ssize_t get_pwm1_auto_channels_temp(
+		struct device *dev,
+		struct device_attribute *devattr,
+		char *buf)
+{
+	struct amc6821_data *data = amc6821_update_device(dev);
+	return sprintf(buf, "%d\n", data->pwm1_auto_channels_temp);
+}
+
+
+static ssize_t get_temp_auto_point_temp(
+		struct device *dev,
+		struct device_attribute *devattr,
+		char *buf)
+{
+	int ix = to_sensor_dev_attr_2(devattr)->index;
+	int nr = to_sensor_dev_attr_2(devattr)->nr;
+	struct amc6821_data *data = amc6821_update_device(dev);
+	switch (nr) {
+	case 1:
+		return sprintf(buf, "%d\n",
+			data->temp1_auto_point_temp[ix] * 1000);
+		break;
+	case 2:
+		return sprintf(buf, "%d\n",
+			data->temp2_auto_point_temp[ix] * 1000);
+		break;
+	default:
+		dev_dbg(dev, "Unknown attr->nr (%d).\n", nr);
+		return -EINVAL;
+	}
+}
+
+
+static ssize_t get_pwm1_auto_point_pwm(
+		struct device *dev,
+		struct device_attribute *devattr,
+		char *buf)
+{
+	int ix = to_sensor_dev_attr(devattr)->index;
+	struct amc6821_data *data = amc6821_update_device(dev);
+	return sprintf(buf, "%d\n", data->pwm1_auto_point_pwm[ix]);
+}
+
+
+static inline ssize_t set_slope_register(struct i2c_client *client,
+		u8 reg,
+		u8 dpwm,
+		u8 *ptemp)
+{
+	int dt;
+	u8 tmp;
+
+	dt = ptemp[2]-ptemp[1];
+	for (tmp = 4; tmp > 0; tmp--) {
+		if (dt * (0x20 >> tmp) >= dpwm)
+			break;
+	}
+	tmp |= (ptemp[1] & 0x7C) << 1;
+	if (i2c_smbus_write_byte_data(client,
+			reg, tmp)) {
+		dev_err(&client->dev, "Register write error, aborting.\n");
+		return -EIO;
+	}
+	return 0;
+}
+
+
+
+static ssize_t set_temp_auto_point_temp(
+		struct device *dev,
+		struct device_attribute *attr,
+		const char *buf,
+		size_t count)
+{
+	struct i2c_client *client = to_i2c_client(dev);
+	struct amc6821_data *data = amc6821_update_device(dev);
+	int ix = to_sensor_dev_attr_2(attr)->index;
+	int nr = to_sensor_dev_attr_2(attr)->nr;
+	u8 *ptemp;
+	u8 reg;
+	int dpwm;
+	long val;
+	int ret = strict_strtol(buf, 10, &val);
+	if (ret)
+		return ret;
+
+	switch (nr) {
+	case 1:
+		ptemp = data->temp1_auto_point_temp;
+		reg = AMC6821_REG_LTEMP_FAN_CTRL;
+		break;
+	case 2:
+		ptemp = data->temp2_auto_point_temp;
+		reg = AMC6821_REG_RTEMP_FAN_CTRL;
+		break;
+	default:
+		dev_dbg(dev, "Unknown attr->nr (%d).\n", nr);
+		return -EINVAL;
+	}
+
+	data->valid = 0;
+	mutex_lock(&data->update_lock);
+	switch (ix) {
+	case 0:
+		ptemp[0] = SENSORS_LIMIT(val / 1000, 0,
+				data->temp1_auto_point_temp[1]);
+		ptemp[0] = SENSORS_LIMIT(ptemp[0], 0,
+				data->temp2_auto_point_temp[1]);
+		ptemp[0] = SENSORS_LIMIT(ptemp[0], 0, 63);
+		if (i2c_smbus_write_byte_data(
+					client,
+					AMC6821_REG_PSV_TEMP,
+					ptemp[0])) {
+				dev_err(&client->dev,
+					"Register write error, aborting.\n");
+				count = -EIO;
+		}
+		goto EXIT;
+		break;
+	case 1:
+		ptemp[1] = SENSORS_LIMIT(
+					val / 1000,
+					(ptemp[0] & 0x7C) + 4,
+					124);
+		ptemp[1] &= 0x7C;
+		ptemp[2] = SENSORS_LIMIT(
+					ptemp[2], ptemp[1] + 1,
+					255);
+		break;
+	case 2:
+		ptemp[2] = SENSORS_LIMIT(
+					val / 1000,
+					ptemp[1]+1,
+					255);
+		break;
+	default:
+		dev_dbg(dev, "Unknown attr->index (%d).\n", ix);
+		count = -EINVAL;
+		goto EXIT;
+	}
+	dpwm = data->pwm1_auto_point_pwm[2] - data->pwm1_auto_point_pwm[1];
+	if (set_slope_register(client, reg, dpwm, ptemp))
+		count = -EIO;
+
+EXIT:
+	mutex_unlock(&data->update_lock);
+	return count;
+}
+
+
+
+static ssize_t set_pwm1_auto_point_pwm(
+		struct device *dev,
+		struct device_attribute *attr,
+		const char *buf,
+		size_t count)
+{
+	struct i2c_client *client = to_i2c_client(dev);
+	struct amc6821_data *data = i2c_get_clientdata(client);
+	int dpwm;
+	long val;
+	int ret = strict_strtol(buf, 10, &val);
+	if (ret)
+		return ret;
+
+	mutex_lock(&data->update_lock);
+	data->pwm1_auto_point_pwm[1] = SENSORS_LIMIT(val, 0, 254);
+	if (i2c_smbus_write_byte_data(client, AMC6821_REG_DCY_LOW_TEMP,
+			data->pwm1_auto_point_pwm[1])) {
+		dev_err(&client->dev, "Register write error, aborting.\n");
+		count = -EIO;
+		goto EXIT;
+	}
+	dpwm = data->pwm1_auto_point_pwm[2] - data->pwm1_auto_point_pwm[1];
+	if (set_slope_register(client, AMC6821_REG_LTEMP_FAN_CTRL, dpwm,
+			data->temp1_auto_point_temp)) {
+		count = -EIO;
+		goto EXIT;
+	}
+	if (set_slope_register(client, AMC6821_REG_RTEMP_FAN_CTRL, dpwm,
+			data->temp2_auto_point_temp)) {
+		count = -EIO;
+		goto EXIT;
+	}
+
+EXIT:
+	data->valid = 0;
+	mutex_unlock(&data->update_lock);
+	return count;
+}
+
+static ssize_t get_fan(
+		struct device *dev,
+		struct device_attribute *devattr,
+		char *buf)
+{
+	struct amc6821_data *data = amc6821_update_device(dev);
+	int ix = to_sensor_dev_attr(devattr)->index;
+	if (0 == data->fan[ix])
+		return sprintf(buf, "0");
+	return sprintf(buf, "%d\n", (int)(6000000 / data->fan[ix]));
+}
+
+
+
+static ssize_t get_fan1_fault(
+		struct device *dev,
+		struct device_attribute *devattr,
+		char *buf)
+{
+	struct amc6821_data *data = amc6821_update_device(dev);
+	if (data->stat1 & AMC6821_STAT1_FANS)
+		return sprintf(buf, "1");
+	else
+		return sprintf(buf, "0");
+}
+
+
+
+static ssize_t set_fan(
+		struct device *dev,
+		struct device_attribute *attr,
+		const char *buf, size_t count)
+{
+	struct i2c_client *client = to_i2c_client(dev);
+	struct amc6821_data *data = i2c_get_clientdata(client);
+	long val;
+	int ix = to_sensor_dev_attr(attr)->index;
+	int ret = strict_strtol(buf, 10, &val);
+	if (ret)
+		return ret;
+	val = 1 > val ? 0xFFFF : 6000000/val;
+
+	mutex_lock(&data->update_lock);
+	data->fan[ix] = (u16) SENSORS_LIMIT(val, 1, 0xFFFF);
+	if (i2c_smbus_write_byte_data(client, fan_reg_low[ix],
+			data->fan[ix] & 0xFF)) {
+		dev_err(&client->dev, "Register write error, aborting.\n");
+		count = -EIO;
+		goto EXIT;
+	}
+	if (i2c_smbus_write_byte_data(client,
+			fan_reg_hi[ix], data->fan[ix] >> 8)) {
+		dev_err(&client->dev, "Register write error, aborting.\n");
+		count = -EIO;
+	}
+EXIT:
+	mutex_unlock(&data->update_lock);
+	return count;
+}
+
+
+
+static ssize_t get_fan1_div(
+		struct device *dev,
+		struct device_attribute *devattr,
+		char *buf)
+{
+	struct amc6821_data *data = amc6821_update_device(dev);
+	return sprintf(buf, "%d\n", data->fan1_div);
+}
+
+static ssize_t set_fan1_div(
+		struct device *dev,
+		struct device_attribute *attr,
+		const char *buf, size_t count)
+{
+	struct i2c_client *client = to_i2c_client(dev);
+	struct amc6821_data *data = i2c_get_clientdata(client);
+	long val;
+	int config = strict_strtol(buf, 10, &val);
+	if (config)
+		return config;
+
+	config = i2c_smbus_read_byte_data(client, AMC6821_REG_CONF4);
+	if (config < 0) {
+		dev_err(&client->dev,
+			"Error reading configuration register, aborting.\n");
+		return -EIO;
+	}
+	mutex_lock(&data->update_lock);
+	switch (val) {
+	case 2:
+		config &= ~AMC6821_CONF4_PSPR;
+		data->fan1_div = 2;
+		break;
+	case 4:
+		config |= AMC6821_CONF4_PSPR;
+		data->fan1_div = 4;
+		break;
+	default:
+		mutex_unlock(&data->update_lock);
+		count = -EINVAL;
+		goto EXIT;
+	}
+	if (i2c_smbus_write_byte_data(client, AMC6821_REG_CONF4, config)) {
+		dev_err(&client->dev,
+			"Configuration register write error, aborting.\n");
+		count = -EIO;
+	}
+EXIT:
+	mutex_unlock(&data->update_lock);
+	return count;
+}
+
+
+
+static SENSOR_DEVICE_ATTR(temp1_input, S_IRUGO,
+	get_temp, NULL, IDX_TEMP1_INPUT);
+static SENSOR_DEVICE_ATTR(temp1_min, S_IRUGO | S_IWUSR, get_temp,
+	set_temp, IDX_TEMP1_MIN);
+static SENSOR_DEVICE_ATTR(temp1_max, S_IRUGO | S_IWUSR, get_temp,
+	set_temp, IDX_TEMP1_MAX);
+static SENSOR_DEVICE_ATTR(temp1_crit, S_IRUGO | S_IWUSR, get_temp,
+	set_temp, IDX_TEMP1_CRIT);
+static SENSOR_DEVICE_ATTR(temp1_min_alarm, S_IRUGO,
+	get_temp_alarm, NULL, IDX_TEMP1_MIN);
+static SENSOR_DEVICE_ATTR(temp1_max_alarm, S_IRUGO,
+	get_temp_alarm, NULL, IDX_TEMP1_MAX);
+static SENSOR_DEVICE_ATTR(temp1_crit_alarm, S_IRUGO,
+	get_temp_alarm, NULL, IDX_TEMP1_CRIT);
+static SENSOR_DEVICE_ATTR(temp2_input, S_IRUGO | S_IWUSR,
+	get_temp, NULL, IDX_TEMP2_INPUT);
+static SENSOR_DEVICE_ATTR(temp2_min, S_IRUGO | S_IWUSR, get_temp,
+	set_temp, IDX_TEMP2_MIN);
+static SENSOR_DEVICE_ATTR(temp2_max, S_IRUGO | S_IWUSR, get_temp,
+	set_temp, IDX_TEMP2_MAX);
+static SENSOR_DEVICE_ATTR(temp2_crit, S_IRUGO | S_IWUSR, get_temp,
+	set_temp, IDX_TEMP2_CRIT);
+static SENSOR_DEVICE_ATTR(temp2_fault, S_IRUGO,
+	get_temp2_fault, NULL, 0);
+static SENSOR_DEVICE_ATTR(temp2_min_alarm, S_IRUGO,
+	get_temp_alarm, NULL, IDX_TEMP2_MIN);
+static SENSOR_DEVICE_ATTR(temp2_max_alarm, S_IRUGO,
+	get_temp_alarm, NULL, IDX_TEMP2_MAX);
+static SENSOR_DEVICE_ATTR(temp2_crit_alarm, S_IRUGO,
+	get_temp_alarm, NULL, IDX_TEMP2_CRIT);
+static SENSOR_DEVICE_ATTR(fan1_input, S_IRUGO, get_fan, NULL, IDX_FAN1_INPUT);
+static SENSOR_DEVICE_ATTR(fan1_min, S_IRUGO | S_IWUSR,
+	get_fan, set_fan, IDX_FAN1_MIN);
+static SENSOR_DEVICE_ATTR(fan1_max, S_IRUGO | S_IWUSR,
+	get_fan, set_fan, IDX_FAN1_MAX);
+static SENSOR_DEVICE_ATTR(fan1_fault, S_IRUGO, get_fan1_fault, NULL, 0);
+static SENSOR_DEVICE_ATTR(fan1_div, S_IRUGO | S_IWUSR,
+	get_fan1_div, set_fan1_div, 0);
+
+static SENSOR_DEVICE_ATTR(pwm1, S_IWUSR | S_IRUGO, get_pwm1, set_pwm1, 0);
+static SENSOR_DEVICE_ATTR(pwm1_enable, S_IWUSR | S_IRUGO,
+	get_pwm1_enable, set_pwm1_enable, 0);
+static SENSOR_DEVICE_ATTR(pwm1_auto_point1_pwm, S_IRUGO,
+	get_pwm1_auto_point_pwm, NULL, 0);
+static SENSOR_DEVICE_ATTR(pwm1_auto_point2_pwm, S_IWUSR | S_IRUGO,
+	get_pwm1_auto_point_pwm, set_pwm1_auto_point_pwm, 1);
+static SENSOR_DEVICE_ATTR(pwm1_auto_point3_pwm, S_IRUGO,
+	get_pwm1_auto_point_pwm, NULL, 2);
+static SENSOR_DEVICE_ATTR(pwm1_auto_channels_temp, S_IRUGO,
+	get_pwm1_auto_channels_temp, NULL, 0);
+static SENSOR_DEVICE_ATTR_2(temp1_auto_point1_temp, S_IRUGO,
+	get_temp_auto_point_temp, NULL, 1, 0);
+static SENSOR_DEVICE_ATTR_2(temp1_auto_point2_temp, S_IWUSR | S_IRUGO,
+	get_temp_auto_point_temp, set_temp_auto_point_temp, 1, 1);
+static SENSOR_DEVICE_ATTR_2(temp1_auto_point3_temp, S_IWUSR | S_IRUGO,
+	get_temp_auto_point_temp, set_temp_auto_point_temp, 1, 2);
+
+static SENSOR_DEVICE_ATTR_2(temp2_auto_point1_temp, S_IWUSR | S_IRUGO,
+	get_temp_auto_point_temp, set_temp_auto_point_temp, 2, 0);
+static SENSOR_DEVICE_ATTR_2(temp2_auto_point2_temp, S_IWUSR | S_IRUGO,
+	get_temp_auto_point_temp, set_temp_auto_point_temp, 2, 1);
+static SENSOR_DEVICE_ATTR_2(temp2_auto_point3_temp, S_IWUSR | S_IRUGO,
+	get_temp_auto_point_temp, set_temp_auto_point_temp, 2, 2);
+
+
+
+static struct attribute *amc6821_attrs[] = {
+	&sensor_dev_attr_temp1_input.dev_attr.attr,
+	&sensor_dev_attr_temp1_min.dev_attr.attr,
+	&sensor_dev_attr_temp1_max.dev_attr.attr,
+	&sensor_dev_attr_temp1_crit.dev_attr.attr,
+	&sensor_dev_attr_temp1_min_alarm.dev_attr.attr,
+	&sensor_dev_attr_temp1_max_alarm.dev_attr.attr,
+	&sensor_dev_attr_temp1_crit_alarm.dev_attr.attr,
+	&sensor_dev_attr_temp2_input.dev_attr.attr,
+	&sensor_dev_attr_temp2_min.dev_attr.attr,
+	&sensor_dev_attr_temp2_max.dev_attr.attr,
+	&sensor_dev_attr_temp2_crit.dev_attr.attr,
+	&sensor_dev_attr_temp2_min_alarm.dev_attr.attr,
+	&sensor_dev_attr_temp2_max_alarm.dev_attr.attr,
+	&sensor_dev_attr_temp2_crit_alarm.dev_attr.attr,
+	&sensor_dev_attr_temp2_fault.dev_attr.attr,
+	&sensor_dev_attr_fan1_input.dev_attr.attr,
+	&sensor_dev_attr_fan1_min.dev_attr.attr,
+	&sensor_dev_attr_fan1_max.dev_attr.attr,
+	&sensor_dev_attr_fan1_fault.dev_attr.attr,
+	&sensor_dev_attr_fan1_div.dev_attr.attr,
+	&sensor_dev_attr_pwm1.dev_attr.attr,
+	&sensor_dev_attr_pwm1_enable.dev_attr.attr,
+	&sensor_dev_attr_pwm1_auto_channels_temp.dev_attr.attr,
+	&sensor_dev_attr_pwm1_auto_point1_pwm.dev_attr.attr,
+	&sensor_dev_attr_pwm1_auto_point2_pwm.dev_attr.attr,
+	&sensor_dev_attr_pwm1_auto_point3_pwm.dev_attr.attr,
+	&sensor_dev_attr_temp1_auto_point1_temp.dev_attr.attr,
+	&sensor_dev_attr_temp1_auto_point2_temp.dev_attr.attr,
+	&sensor_dev_attr_temp1_auto_point3_temp.dev_attr.attr,
+	&sensor_dev_attr_temp2_auto_point1_temp.dev_attr.attr,
+	&sensor_dev_attr_temp2_auto_point2_temp.dev_attr.attr,
+	&sensor_dev_attr_temp2_auto_point3_temp.dev_attr.attr,
+	NULL
+};
+
+static struct attribute_group amc6821_attr_grp = {
+	.attrs = amc6821_attrs,
+};
+
+
+
+/* Return 0 if detection is successful, -ENODEV otherwise */
+static int amc6821_detect(
+		struct i2c_client *client,
+		struct i2c_board_info *info)
+{
+	struct i2c_adapter *adapter = client->adapter;
+	int address = client->addr;
+	int dev_id, comp_id;
+
+	dev_dbg(&adapter->dev, "amc6821_detect called.\n");
+
+	if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA)) {
+		dev_dbg(&adapter->dev,
+			"amc6821: I2C bus doesn't support byte mode, "
+			"skipping.\n");
+		return -ENODEV;
+	}
+
+	dev_id = i2c_smbus_read_byte_data(client, AMC6821_REG_DEV_ID);
+	comp_id = i2c_smbus_read_byte_data(client, AMC6821_REG_COMP_ID);
+	if (dev_id != 0x21 || comp_id != 0x49) {
+		dev_dbg(&adapter->dev,
+			"amc6821: detection failed at 0x%02x.\n",
+			address);
+		return -ENODEV;
+	}
+
+	/* Bit 7 of the address register is ignored, so we can check the
+	   ID registers again */
+	dev_id = i2c_smbus_read_byte_data(client, 0x80 | AMC6821_REG_DEV_ID);
+	comp_id = i2c_smbus_read_byte_data(client, 0x80 | AMC6821_REG_COMP_ID);
+	if (dev_id != 0x21 || comp_id != 0x49) {
+		dev_dbg(&adapter->dev,
+			"amc6821: detection failed at 0x%02x.\n",
+			address);
+		return -ENODEV;
+	}
+
+	dev_info(&adapter->dev, "amc6821: chip found at 0x%02x.\n", address);
+	strlcpy(info->type, "amc6821", I2C_NAME_SIZE);
+
+	return 0;
+}
+
+static int amc6821_probe(
+	struct i2c_client *client,
+	const struct i2c_device_id *id)
+{
+	struct amc6821_data *data;
+	int err;
+
+	data = kzalloc(sizeof(struct amc6821_data), GFP_KERNEL);
+	if (!data) {
+		dev_err(&client->dev, "out of memory.\n");
+		return -ENOMEM;
+	}
+
+
+	i2c_set_clientdata(client, data);
+	mutex_init(&data->update_lock);
+
+	/*
+	 * Initialize the amc6821 chip
+	 */
+	err = amc6821_init_client(client);
+	if (err)
+		goto err_free;
+
+	err = sysfs_create_group(&client->dev.kobj, &amc6821_attr_grp);
+	if (err)
+		goto err_free;
+
+	data->hwmon_dev = hwmon_device_register(&client->dev);
+	if (!IS_ERR(data->hwmon_dev))
+		return 0;
+
+	err = PTR_ERR(data->hwmon_dev);
+	dev_err(&client->dev, "error registering hwmon device.\n");
+	sysfs_remove_group(&client->dev.kobj, &amc6821_attr_grp);
+err_free:
+	kfree(data);
+	return err;
+}
+
+static int amc6821_remove(struct i2c_client *client)
+{
+	struct amc6821_data *data = i2c_get_clientdata(client);
+
+	hwmon_device_unregister(data->hwmon_dev);
+	sysfs_remove_group(&client->dev.kobj, &amc6821_attr_grp);
+
+	kfree(data);
+
+	return 0;
+}
+
+
+static int amc6821_init_client(struct i2c_client *client)
+{
+	int config;
+	int err = -EIO;
+
+	if (init) {
+		config = i2c_smbus_read_byte_data(client, AMC6821_REG_CONF4);
+
+		if (config < 0) {
+				dev_err(&client->dev,
+			"Error reading configuration register, aborting.\n");
+				return err;
+		}
+
+		config |= AMC6821_CONF4_MODE;
+
+		if (i2c_smbus_write_byte_data(client, AMC6821_REG_CONF4,
+				config)) {
+			dev_err(&client->dev,
+			"Configuration register write error, aborting.\n");
+			return err;
+		}
+
+		config = i2c_smbus_read_byte_data(client, AMC6821_REG_CONF3);
+
+		if (config < 0) {
+			dev_err(&client->dev,
+			"Error reading configuration register, aborting.\n");
+			return err;
+		}
+
+		dev_info(&client->dev, "Revision %d\n", config & 0x0f);
+
+		config &= ~AMC6821_CONF3_THERM_FAN_EN;
+
+		if (i2c_smbus_write_byte_data(client, AMC6821_REG_CONF3,
+				config)) {
+			dev_err(&client->dev,
+			"Configuration register write error, aborting.\n");
+			return err;
+		}
+
+		config = i2c_smbus_read_byte_data(client, AMC6821_REG_CONF2);
+
+		if (config < 0) {
+			dev_err(&client->dev,
+			"Error reading configuration register, aborting.\n");
+			return err;
+		}
+
+		config &= ~AMC6821_CONF2_RTFIE;
+		config &= ~AMC6821_CONF2_LTOIE;
+		config &= ~AMC6821_CONF2_RTOIE;
+		if (i2c_smbus_write_byte_data(client,
+				AMC6821_REG_CONF2, config)) {
+			dev_err(&client->dev,
+			"Configuration register write error, aborting.\n");
+			return err;
+		}
+
+		config = i2c_smbus_read_byte_data(client, AMC6821_REG_CONF1);
+
+		if (config < 0) {
+			dev_err(&client->dev,
+			"Error reading configuration register, aborting.\n");
+			return err;
+		}
+
+		config &= ~AMC6821_CONF1_THERMOVIE;
+		config &= ~AMC6821_CONF1_FANIE;
+		config |= AMC6821_CONF1_START;
+		if (pwminv)
+			config |= AMC6821_CONF1_PWMINV;
+		else
+			config &= ~AMC6821_CONF1_PWMINV;
+
+		if (i2c_smbus_write_byte_data(
+				client, AMC6821_REG_CONF1, config)) {
+			dev_err(&client->dev,
+			"Configuration register write error, aborting.\n");
+			return err;
+		}
+	}
+	return 0;
+}
+
+
+static struct amc6821_data *amc6821_update_device(struct device *dev)
+{
+	struct i2c_client *client = to_i2c_client(dev);
+	struct amc6821_data *data = i2c_get_clientdata(client);
+	int timeout = HZ;
+	u8 reg;
+	int i;
+
+	mutex_lock(&data->update_lock);
+
+	if (time_after(jiffies, data->last_updated + timeout) ||
+			!data->valid) {
+
+		for (i = 0; i < TEMP_IDX_LEN; i++)
+			data->temp[i] = i2c_smbus_read_byte_data(client,
+				temp_reg[i]);
+
+		data->stat1 = i2c_smbus_read_byte_data(client,
+			AMC6821_REG_STAT1);
+		data->stat2 = i2c_smbus_read_byte_data(client,
+			AMC6821_REG_STAT2);
+
+		data->pwm1 = i2c_smbus_read_byte_data(client,
+			AMC6821_REG_DCY);
+		for (i = 0; i < FAN1_IDX_LEN; i++) {
+			data->fan[i] = i2c_smbus_read_byte_data(
+					client,
+					fan_reg_low[i]);
+			data->fan[i] += i2c_smbus_read_byte_data(
+					client,
+					fan_reg_hi[i]) << 8;
+		}
+		data->fan1_div = i2c_smbus_read_byte_data(client,
+			AMC6821_REG_CONF4);
+		data->fan1_div = data->fan1_div & AMC6821_CONF4_PSPR ? 4 : 2;
+
+		data->pwm1_auto_point_pwm[0] = 0;
+		data->pwm1_auto_point_pwm[2] = 255;
+		data->pwm1_auto_point_pwm[1] = i2c_smbus_read_byte_data(client,
+			AMC6821_REG_DCY_LOW_TEMP);
+
+		data->temp1_auto_point_temp[0] =
+			i2c_smbus_read_byte_data(client,
+					AMC6821_REG_PSV_TEMP);
+		data->temp2_auto_point_temp[0] =
+				data->temp1_auto_point_temp[0];
+		reg = i2c_smbus_read_byte_data(client,
+			AMC6821_REG_LTEMP_FAN_CTRL);
+		data->temp1_auto_point_temp[1] = (reg & 0xF8) >> 1;
+		reg &= 0x07;
+		reg = 0x20 >> reg;
+		if (reg > 0)
+			data->temp1_auto_point_temp[2] =
+				data->temp1_auto_point_temp[1] +
+				(data->pwm1_auto_point_pwm[2] -
+				data->pwm1_auto_point_pwm[1]) / reg;
+		else
+			data->temp1_auto_point_temp[2] = 255;
+
+		reg = i2c_smbus_read_byte_data(client,
+			AMC6821_REG_RTEMP_FAN_CTRL);
+		data->temp2_auto_point_temp[1] = (reg & 0xF8) >> 1;
+		reg &= 0x07;
+		reg = 0x20 >> reg;
+		if (reg > 0)
+			data->temp2_auto_point_temp[2] =
+				data->temp2_auto_point_temp[1] +
+				(data->pwm1_auto_point_pwm[2] -
+				data->pwm1_auto_point_pwm[1]) / reg;
+		else
+			data->temp2_auto_point_temp[2] = 255;
+
+		reg = i2c_smbus_read_byte_data(client, AMC6821_REG_CONF1);
+		reg = (reg >> 5) & 0x3;
+		switch (reg) {
+		case 0: /*open loop: software sets pwm1*/
+			data->pwm1_auto_channels_temp = 0;
+			data->pwm1_enable = 1;
+			break;
+		case 2: /*closed loop: remote T (temp2)*/
+			data->pwm1_auto_channels_temp = 2;
+			data->pwm1_enable = 2;
+			break;
+		case 3: /*closed loop: local and remote T (temp2)*/
+			data->pwm1_auto_channels_temp = 3;
+			data->pwm1_enable = 3;
+			break;
+		case 1: /*semi-open loop: software sets rpm, chip controls pwm1,
+			  *currently not implemented
+			  */
+			data->pwm1_auto_channels_temp = 0;
+			data->pwm1_enable = 0;
+			break;
+		}
+
+		data->last_updated = jiffies;
+		data->valid = 1;
+	}
+	mutex_unlock(&data->update_lock);
+	return data;
+}
+
+
+static int __init amc6821_init(void)
+{
+	return i2c_add_driver(&amc6821_driver);
+}
+
+static void __exit amc6821_exit(void)
+{
+	i2c_del_driver(&amc6821_driver);
+}
+
+module_init(amc6821_init);
+module_exit(amc6821_exit);
+
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("T. Mertelj <tomaz.mertelj@guest.arnes.si>");
+MODULE_DESCRIPTION("Texas Instruments amc6821 hwmon driver");
diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c
index 7ea6a8f66056..c1605b528e8f 100644
--- a/drivers/hwmon/applesmc.c
+++ b/drivers/hwmon/applesmc.c
@@ -518,7 +518,7 @@ static int applesmc_pm_restore(struct device *dev)
 	return applesmc_pm_resume(dev);
 }
 
-static struct dev_pm_ops applesmc_pm_ops = {
+static const struct dev_pm_ops applesmc_pm_ops = {
 	.resume = applesmc_pm_resume,
 	.restore = applesmc_pm_restore,
 };
diff --git a/drivers/hwmon/asb100.c b/drivers/hwmon/asb100.c
index 8acf82977e7b..7dada559b3a1 100644
--- a/drivers/hwmon/asb100.c
+++ b/drivers/hwmon/asb100.c
@@ -51,9 +51,6 @@
 /* I2C addresses to scan */
 static const unsigned short normal_i2c[] = { 0x2d, I2C_CLIENT_END };
 
-/* Insmod parameters */
-I2C_CLIENT_INSMOD_1(asb100);
-
 static unsigned short force_subclients[4];
 module_param_array(force_subclients, short, NULL, 0);
 MODULE_PARM_DESC(force_subclients, "List of subclient addresses: "
@@ -209,14 +206,14 @@ static void asb100_write_value(struct i2c_client *client, u16 reg, u16 val);
 
 static int asb100_probe(struct i2c_client *client,
 			const struct i2c_device_id *id);
-static int asb100_detect(struct i2c_client *client, int kind,
+static int asb100_detect(struct i2c_client *client,
 			 struct i2c_board_info *info);
 static int asb100_remove(struct i2c_client *client);
 static struct asb100_data *asb100_update_device(struct device *dev);
 static void asb100_init_client(struct i2c_client *client);
 
 static const struct i2c_device_id asb100_id[] = {
-	{ "asb100", asb100 },
+	{ "asb100", 0 },
 	{ }
 };
 MODULE_DEVICE_TABLE(i2c, asb100_id);
@@ -230,7 +227,7 @@ static struct i2c_driver asb100_driver = {
 	.remove		= asb100_remove,
 	.id_table	= asb100_id,
 	.detect		= asb100_detect,
-	.address_data	= &addr_data,
+	.address_list	= normal_i2c,
 };
 
 /* 7 Voltages */
@@ -697,10 +694,11 @@ ERROR_SC_2:
 }
 
 /* Return 0 if detection is successful, -ENODEV otherwise */
-static int asb100_detect(struct i2c_client *client, int kind,
+static int asb100_detect(struct i2c_client *client,
 			 struct i2c_board_info *info)
 {
 	struct i2c_adapter *adapter = client->adapter;
+	int val1, val2;
 
 	if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA)) {
 		pr_debug("asb100.o: detect failed, "
@@ -708,50 +706,30 @@ static int asb100_detect(struct i2c_client *client, int kind,
 		return -ENODEV;
 	}
 
-	/* The chip may be stuck in some other bank than bank 0. This may
-	   make reading other information impossible. Specify a force=... or
-	   force_*=... parameter, and the chip will be reset to the right
-	   bank. */
-	if (kind < 0) {
-
-		int val1 = i2c_smbus_read_byte_data(client, ASB100_REG_BANK);
-		int val2 = i2c_smbus_read_byte_data(client, ASB100_REG_CHIPMAN);
-
-		/* If we're in bank 0 */
-		if ((!(val1 & 0x07)) &&
-				/* Check for ASB100 ID (low byte) */
-				(((!(val1 & 0x80)) && (val2 != 0x94)) ||
-				/* Check for ASB100 ID (high byte ) */
-				((val1 & 0x80) && (val2 != 0x06)))) {
-			pr_debug("asb100.o: detect failed, "
-					"bad chip id 0x%02x!\n", val2);
-			return -ENODEV;
-		}
+	val1 = i2c_smbus_read_byte_data(client, ASB100_REG_BANK);
+	val2 = i2c_smbus_read_byte_data(client, ASB100_REG_CHIPMAN);
 
-	} /* kind < 0 */
+	/* If we're in bank 0 */
+	if ((!(val1 & 0x07)) &&
+			/* Check for ASB100 ID (low byte) */
+			(((!(val1 & 0x80)) && (val2 != 0x94)) ||
+			/* Check for ASB100 ID (high byte ) */
+			((val1 & 0x80) && (val2 != 0x06)))) {
+		pr_debug("asb100: detect failed, bad chip id 0x%02x!\n", val2);
+		return -ENODEV;
+	}
 
-	/* We have either had a force parameter, or we have already detected
-	   Winbond. Put it now into bank 0 and Vendor ID High Byte */
+	/* Put it now into bank 0 and Vendor ID High Byte */
 	i2c_smbus_write_byte_data(client, ASB100_REG_BANK,
 		(i2c_smbus_read_byte_data(client, ASB100_REG_BANK) & 0x78)
 		| 0x80);
 
 	/* Determine the chip type. */
-	if (kind <= 0) {
-		int val1 = i2c_smbus_read_byte_data(client, ASB100_REG_WCHIPID);
-		int val2 = i2c_smbus_read_byte_data(client, ASB100_REG_CHIPMAN);
-
-		if ((val1 == 0x31) && (val2 == 0x06))
-			kind = asb100;
-		else {
-			if (kind == 0)
-				dev_warn(&adapter->dev, "ignoring "
-					"'force' parameter for unknown chip "
-					"at adapter %d, address 0x%02x.\n",
-					i2c_adapter_id(adapter), client->addr);
-			return -ENODEV;
-		}
-	}
+	val1 = i2c_smbus_read_byte_data(client, ASB100_REG_WCHIPID);
+	val2 = i2c_smbus_read_byte_data(client, ASB100_REG_CHIPMAN);
+
+	if (val1 != 0x31 || val2 != 0x06)
+		return -ENODEV;
 
 	strlcpy(info->type, "asb100", I2C_NAME_SIZE);
 
diff --git a/drivers/hwmon/asus_atk0110.c b/drivers/hwmon/asus_atk0110.c
index 5a3ee00c0e7d..6811346c1c62 100644
--- a/drivers/hwmon/asus_atk0110.c
+++ b/drivers/hwmon/asus_atk0110.c
@@ -5,6 +5,7 @@
  * See COPYING in the top level directory of the kernel tree.
  */
 
+#include <linux/debugfs.h>
 #include <linux/kernel.h>
 #include <linux/hwmon.h>
 #include <linux/list.h>
@@ -101,6 +102,11 @@ struct atk_data {
 	int temperature_count;
 	int fan_count;
 	struct list_head sensor_list;
+
+	struct {
+		struct dentry *root;
+		u32 id;
+	} debugfs;
 };
 
 
@@ -624,6 +630,187 @@ static int atk_read_value(struct atk_sensor_data *sensor, u64 *value)
 	return err;
 }
 
+#ifdef CONFIG_DEBUG_FS
+static int atk_debugfs_gitm_get(void *p, u64 *val)
+{
+	struct atk_data *data = p;
+	union acpi_object *ret;
+	struct atk_acpi_ret_buffer *buf;
+	int err = 0;
+
+	if (!data->read_handle)
+		return -ENODEV;
+
+	if (!data->debugfs.id)
+		return -EINVAL;
+
+	ret = atk_gitm(data, data->debugfs.id);
+	if (IS_ERR(ret))
+		return PTR_ERR(ret);
+
+	buf = (struct atk_acpi_ret_buffer *)ret->buffer.pointer;
+	if (buf->flags)
+		*val = buf->value;
+	else
+		err = -EIO;
+
+	return err;
+}
+
+DEFINE_SIMPLE_ATTRIBUTE(atk_debugfs_gitm,
+			atk_debugfs_gitm_get,
+			NULL,
+			"0x%08llx\n")
+
+static int atk_acpi_print(char *buf, size_t sz, union acpi_object *obj)
+{
+	int ret = 0;
+
+	switch (obj->type) {
+	case ACPI_TYPE_INTEGER:
+		ret = snprintf(buf, sz, "0x%08llx\n", obj->integer.value);
+		break;
+	case ACPI_TYPE_STRING:
+		ret = snprintf(buf, sz, "%s\n", obj->string.pointer);
+		break;
+	}
+
+	return ret;
+}
+
+static void atk_pack_print(char *buf, size_t sz, union acpi_object *pack)
+{
+	int ret;
+	int i;
+
+	for (i = 0; i < pack->package.count; i++) {
+		union acpi_object *obj = &pack->package.elements[i];
+
+		ret = atk_acpi_print(buf, sz, obj);
+		if (ret >= sz)
+			break;
+		buf += ret;
+		sz -= ret;
+	}
+}
+
+static int atk_debugfs_ggrp_open(struct inode *inode, struct file *file)
+{
+	struct atk_data *data = inode->i_private;
+	char *buf = NULL;
+	union acpi_object *ret;
+	u8 cls;
+	int i;
+
+	if (!data->enumerate_handle)
+		return -ENODEV;
+	if (!data->debugfs.id)
+		return -EINVAL;
+
+	cls = (data->debugfs.id & 0xff000000) >> 24;
+	ret = atk_ggrp(data, cls);
+	if (IS_ERR(ret))
+		return PTR_ERR(ret);
+
+	for (i = 0; i < ret->package.count; i++) {
+		union acpi_object *pack = &ret->package.elements[i];
+		union acpi_object *id;
+
+		if (pack->type != ACPI_TYPE_PACKAGE)
+			continue;
+		if (!pack->package.count)
+			continue;
+		id = &pack->package.elements[0];
+		if (id->integer.value == data->debugfs.id) {
+			/* Print the package */
+			buf = kzalloc(512, GFP_KERNEL);
+			if (!buf) {
+				ACPI_FREE(ret);
+				return -ENOMEM;
+			}
+			atk_pack_print(buf, 512, pack);
+			break;
+		}
+	}
+	ACPI_FREE(ret);
+
+	if (!buf)
+		return -EINVAL;
+
+	file->private_data = buf;
+
+	return nonseekable_open(inode, file);
+}
+
+static ssize_t atk_debugfs_ggrp_read(struct file *file, char __user *buf,
+		size_t count, loff_t *pos)
+{
+	char *str = file->private_data;
+	size_t len = strlen(str);
+
+	return simple_read_from_buffer(buf, count, pos, str, len);
+}
+
+static int atk_debugfs_ggrp_release(struct inode *inode, struct file *file)
+{
+	kfree(file->private_data);
+	return 0;
+}
+
+static const struct file_operations atk_debugfs_ggrp_fops = {
+	.read		= atk_debugfs_ggrp_read,
+	.open		= atk_debugfs_ggrp_open,
+	.release	= atk_debugfs_ggrp_release,
+};
+
+static void atk_debugfs_init(struct atk_data *data)
+{
+	struct dentry *d;
+	struct dentry *f;
+
+	data->debugfs.id = 0;
+
+	d = debugfs_create_dir("asus_atk0110", NULL);
+	if (!d || IS_ERR(d))
+		return;
+
+	f = debugfs_create_x32("id", S_IRUSR | S_IWUSR, d, &data->debugfs.id);
+	if (!f || IS_ERR(f))
+		goto cleanup;
+
+	f = debugfs_create_file("gitm", S_IRUSR, d, data,
+			&atk_debugfs_gitm);
+	if (!f || IS_ERR(f))
+		goto cleanup;
+
+	f = debugfs_create_file("ggrp", S_IRUSR, d, data,
+			&atk_debugfs_ggrp_fops);
+	if (!f || IS_ERR(f))
+		goto cleanup;
+
+	data->debugfs.root = d;
+
+	return;
+cleanup:
+	debugfs_remove_recursive(d);
+}
+
+static void atk_debugfs_cleanup(struct atk_data *data)
+{
+	debugfs_remove_recursive(data->debugfs.root);
+}
+
+#else /* CONFIG_DEBUG_FS */
+
+static void atk_debugfs_init(struct atk_data *data)
+{
+}
+
+static void atk_debugfs_cleanup(struct atk_data *data)
+{
+}
+#endif
+
 static int atk_add_sensor(struct atk_data *data, union acpi_object *obj)
 {
 	struct device *dev = &data->acpi_dev->dev;
@@ -1047,76 +1234,75 @@ remove:
 	return err;
 }
 
-static int atk_check_old_if(struct atk_data *data)
+static int atk_probe_if(struct atk_data *data)
 {
 	struct device *dev = &data->acpi_dev->dev;
 	acpi_handle ret;
 	acpi_status status;
+	int err = 0;
 
 	/* RTMP: read temperature */
 	status = acpi_get_handle(data->atk_handle, METHOD_OLD_READ_TMP, &ret);
-	if (status != AE_OK) {
+	if (ACPI_SUCCESS(status))
+		data->rtmp_handle = ret;
+	else
 		dev_dbg(dev, "method " METHOD_OLD_READ_TMP " not found: %s\n",
 				acpi_format_exception(status));
-		return -ENODEV;
-	}
-	data->rtmp_handle = ret;
 
 	/* RVLT: read voltage */
 	status = acpi_get_handle(data->atk_handle, METHOD_OLD_READ_VLT, &ret);
-	if (status != AE_OK) {
+	if (ACPI_SUCCESS(status))
+		data->rvlt_handle = ret;
+	else
 		dev_dbg(dev, "method " METHOD_OLD_READ_VLT " not found: %s\n",
 				acpi_format_exception(status));
-		return -ENODEV;
-	}
-	data->rvlt_handle = ret;
 
 	/* RFAN: read fan status */
 	status = acpi_get_handle(data->atk_handle, METHOD_OLD_READ_FAN, &ret);
-	if (status != AE_OK) {
+	if (ACPI_SUCCESS(status))
+		data->rfan_handle = ret;
+	else
 		dev_dbg(dev, "method " METHOD_OLD_READ_FAN " not found: %s\n",
 				acpi_format_exception(status));
-		return -ENODEV;
-	}
-	data->rfan_handle = ret;
-
-	return 0;
-}
-
-static int atk_check_new_if(struct atk_data *data)
-{
-	struct device *dev = &data->acpi_dev->dev;
-	acpi_handle ret;
-	acpi_status status;
 
 	/* Enumeration */
 	status = acpi_get_handle(data->atk_handle, METHOD_ENUMERATE, &ret);
-	if (status != AE_OK) {
+	if (ACPI_SUCCESS(status))
+		data->enumerate_handle = ret;
+	else
 		dev_dbg(dev, "method " METHOD_ENUMERATE " not found: %s\n",
 				acpi_format_exception(status));
-		return -ENODEV;
-	}
-	data->enumerate_handle = ret;
 
 	/* De-multiplexer (read) */
 	status = acpi_get_handle(data->atk_handle, METHOD_READ, &ret);
-	if (status != AE_OK) {
+	if (ACPI_SUCCESS(status))
+		data->read_handle = ret;
+	else
 		dev_dbg(dev, "method " METHOD_READ " not found: %s\n",
 				acpi_format_exception(status));
-		return -ENODEV;
-	}
-	data->read_handle = ret;
 
 	/* De-multiplexer (write) */
 	status = acpi_get_handle(data->atk_handle, METHOD_WRITE, &ret);
-	if (status != AE_OK) {
-		dev_dbg(dev, "method " METHOD_READ " not found: %s\n",
+	if (ACPI_SUCCESS(status))
+		data->write_handle = ret;
+	else
+		dev_dbg(dev, "method " METHOD_WRITE " not found: %s\n",
 				 acpi_format_exception(status));
-		return -ENODEV;
-	}
-	data->write_handle = ret;
 
-	return 0;
+	/* Check for hwmon methods: first check "old" style methods; note that
+	 * both may be present: in this case we stick to the old interface;
+	 * analysis of multiple DSDTs indicates that when both interfaces
+	 * are present the new one (GGRP/GITM) is not functional.
+	 */
+	if (data->rtmp_handle && data->rvlt_handle && data->rfan_handle)
+		data->old_interface = true;
+	else if (data->enumerate_handle && data->read_handle &&
+			data->write_handle)
+		data->old_interface = false;
+	else
+		err = -ENODEV;
+
+	return err;
 }
 
 static int atk_add(struct acpi_device *device)
@@ -1155,28 +1341,19 @@ static int atk_add(struct acpi_device *device)
 	}
 	ACPI_FREE(buf.pointer);
 
-	/* Check for hwmon methods: first check "old" style methods; note that
-	 * both may be present: in this case we stick to the old interface;
-	 * analysis of multiple DSDTs indicates that when both interfaces
-	 * are present the new one (GGRP/GITM) is not functional.
-	 */
-	err = atk_check_old_if(data);
-	if (!err) {
-		dev_dbg(&device->dev, "Using old hwmon interface\n");
-		data->old_interface = true;
-	} else {
-		err = atk_check_new_if(data);
-		if (err)
-			goto out;
-
-		dev_dbg(&device->dev, "Using new hwmon interface\n");
-		data->old_interface = false;
+	err = atk_probe_if(data);
+	if (err) {
+		dev_err(&device->dev, "No usable hwmon interface detected\n");
+		goto out;
 	}
 
-	if (data->old_interface)
+	if (data->old_interface) {
+		dev_dbg(&device->dev, "Using old hwmon interface\n");
 		err = atk_enumerate_old_hwmon(data);
-	else
+	} else {
+		dev_dbg(&device->dev, "Using new hwmon interface\n");
 		err = atk_enumerate_new_hwmon(data);
+	}
 	if (err < 0)
 		goto out;
 	if (err == 0) {
@@ -1190,6 +1367,8 @@ static int atk_add(struct acpi_device *device)
 	if (err)
 		goto cleanup;
 
+	atk_debugfs_init(data);
+
 	device->driver_data = data;
 	return 0;
 cleanup:
@@ -1208,6 +1387,8 @@ static int atk_remove(struct acpi_device *device, int type)
 
 	device->driver_data = NULL;
 
+	atk_debugfs_cleanup(data);
+
 	atk_remove_files(data);
 	atk_free_sensors(data);
 	hwmon_device_unregister(data->hwmon_dev);
diff --git a/drivers/hwmon/atxp1.c b/drivers/hwmon/atxp1.c
index d6b490d3e36f..94cadc19f0c5 100644
--- a/drivers/hwmon/atxp1.c
+++ b/drivers/hwmon/atxp1.c
@@ -44,17 +44,14 @@ MODULE_AUTHOR("Sebastian Witt <se.witt@gmx.net>");
 
 static const unsigned short normal_i2c[] = { 0x37, 0x4e, I2C_CLIENT_END };
 
-I2C_CLIENT_INSMOD_1(atxp1);
-
 static int atxp1_probe(struct i2c_client *client,
 		       const struct i2c_device_id *id);
 static int atxp1_remove(struct i2c_client *client);
 static struct atxp1_data * atxp1_update_device(struct device *dev);
-static int atxp1_detect(struct i2c_client *client, int kind,
-			struct i2c_board_info *info);
+static int atxp1_detect(struct i2c_client *client, struct i2c_board_info *info);
 
 static const struct i2c_device_id atxp1_id[] = {
-	{ "atxp1", atxp1 },
+	{ "atxp1", 0 },
 	{ }
 };
 MODULE_DEVICE_TABLE(i2c, atxp1_id);
@@ -68,7 +65,7 @@ static struct i2c_driver atxp1_driver = {
 	.remove		= atxp1_remove,
 	.id_table	= atxp1_id,
 	.detect		= atxp1_detect,
-	.address_data	= &addr_data,
+	.address_list	= normal_i2c,
 };
 
 struct atxp1_data {
@@ -275,7 +272,7 @@ static const struct attribute_group atxp1_group = {
 
 
 /* Return 0 if detection is successful, -ENODEV otherwise */
-static int atxp1_detect(struct i2c_client *new_client, int kind,
+static int atxp1_detect(struct i2c_client *new_client,
 			struct i2c_board_info *info)
 {
 	struct i2c_adapter *adapter = new_client->adapter;
diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
index caef39cda8c8..2d7bceeed0bc 100644
--- a/drivers/hwmon/coretemp.c
+++ b/drivers/hwmon/coretemp.c
@@ -33,6 +33,7 @@
 #include <linux/list.h>
 #include <linux/platform_device.h>
 #include <linux/cpu.h>
+#include <linux/pci.h>
 #include <asm/msr.h>
 #include <asm/processor.h>
 
@@ -161,6 +162,7 @@ static int __devinit adjust_tjmax(struct cpuinfo_x86 *c, u32 id, struct device *
 	int usemsr_ee = 1;
 	int err;
 	u32 eax, edx;
+	struct pci_dev *host_bridge;
 
 	/* Early chips have no MSR for TjMax */
 
@@ -168,11 +170,21 @@ static int __devinit adjust_tjmax(struct cpuinfo_x86 *c, u32 id, struct device *
 		usemsr_ee = 0;
 	}
 
-	/* Atoms seems to have TjMax at 90C */
+	/* Atom CPUs */
 
 	if (c->x86_model == 0x1c) {
 		usemsr_ee = 0;
-		tjmax = 90000;
+
+		host_bridge = pci_get_bus_and_slot(0, PCI_DEVFN(0, 0));
+
+		if (host_bridge && host_bridge->vendor == PCI_VENDOR_ID_INTEL
+		    && (host_bridge->device == 0xa000	/* NM10 based nettop */
+		    || host_bridge->device == 0xa010))	/* NM10 based netbook */
+			tjmax = 100000;
+		else
+			tjmax = 90000;
+
+		pci_dev_put(host_bridge);
 	}
 
 	if ((c->x86_model > 0xe) && (usemsr_ee)) {
diff --git a/drivers/hwmon/dme1737.c b/drivers/hwmon/dme1737.c
index 27d62574284f..823dd28a902c 100644
--- a/drivers/hwmon/dme1737.c
+++ b/drivers/hwmon/dme1737.c
@@ -57,11 +57,7 @@ MODULE_PARM_DESC(probe_all_addr, "Include probing of non-standard LPC "
 /* Addresses to scan */
 static const unsigned short normal_i2c[] = {0x2c, 0x2d, 0x2e, I2C_CLIENT_END};
 
-/* Insmod parameters */
-I2C_CLIENT_INSMOD_2(dme1737, sch5027);
-
-/* ISA chip types */
-enum isa_chips { sch311x = sch5027 + 1 };
+enum chips { dme1737, sch5027, sch311x };
 
 /* ---------------------------------------------------------------------
  * Registers
@@ -2208,7 +2204,7 @@ exit:
 }
 
 /* Return 0 if detection is successful, -ENODEV otherwise */
-static int dme1737_i2c_detect(struct i2c_client *client, int kind,
+static int dme1737_i2c_detect(struct i2c_client *client,
 			      struct i2c_board_info *info)
 {
 	struct i2c_adapter *adapter = client->adapter;
@@ -2220,33 +2216,23 @@ static int dme1737_i2c_detect(struct i2c_client *client, int kind,
 		return -ENODEV;
 	}
 
-	/* A negative kind means that the driver was loaded with no force
-	 * parameter (default), so we must identify the chip. */
-	if (kind < 0) {
-		company = i2c_smbus_read_byte_data(client, DME1737_REG_COMPANY);
-		verstep = i2c_smbus_read_byte_data(client, DME1737_REG_VERSTEP);
-
-		if (company == DME1737_COMPANY_SMSC &&
-		    (verstep & DME1737_VERSTEP_MASK) == DME1737_VERSTEP) {
-			kind = dme1737;
-		} else if (company == DME1737_COMPANY_SMSC &&
-			   verstep == SCH5027_VERSTEP) {
-			kind = sch5027;
-		} else {
-			return -ENODEV;
-		}
-	}
+	company = i2c_smbus_read_byte_data(client, DME1737_REG_COMPANY);
+	verstep = i2c_smbus_read_byte_data(client, DME1737_REG_VERSTEP);
 
-	if (kind == sch5027) {
+	if (company == DME1737_COMPANY_SMSC &&
+	    verstep == SCH5027_VERSTEP) {
 		name = "sch5027";
-	} else {
-		kind = dme1737;
+
+	} else if (company == DME1737_COMPANY_SMSC &&
+		   (verstep & DME1737_VERSTEP_MASK) == DME1737_VERSTEP) {
 		name = "dme1737";
+	} else {
+		return -ENODEV;
 	}
 
 	dev_info(dev, "Found a %s chip at 0x%02x (rev 0x%02x).\n",
-		 kind == sch5027 ? "SCH5027" : "DME1737", client->addr,
-		 verstep);
+		 verstep == SCH5027_VERSTEP ? "SCH5027" : "DME1737",
+		 client->addr, verstep);
 	strlcpy(info->type, name, I2C_NAME_SIZE);
 
 	return 0;
@@ -2328,7 +2314,7 @@ static struct i2c_driver dme1737_i2c_driver = {
 	.remove = dme1737_i2c_remove,
 	.id_table = dme1737_id,
 	.detect = dme1737_i2c_detect,
-	.address_data = &addr_data,
+	.address_list = normal_i2c,
 };
 
 /* ---------------------------------------------------------------------
diff --git a/drivers/hwmon/ds1621.c b/drivers/hwmon/ds1621.c
index 53f88f511816..e11363467a8d 100644
--- a/drivers/hwmon/ds1621.c
+++ b/drivers/hwmon/ds1621.c
@@ -38,7 +38,6 @@ static const unsigned short normal_i2c[] = { 0x48, 0x49, 0x4a, 0x4b, 0x4c,
 					0x4d, 0x4e, 0x4f, I2C_CLIENT_END };
 
 /* Insmod parameters */
-I2C_CLIENT_INSMOD_1(ds1621);
 static int polarity = -1;
 module_param(polarity, int, 0);
 MODULE_PARM_DESC(polarity, "Output's polarity: 0 = active high, 1 = active low");
@@ -224,7 +223,7 @@ static const struct attribute_group ds1621_group = {
 
 
 /* Return 0 if detection is successful, -ENODEV otherwise */
-static int ds1621_detect(struct i2c_client *client, int kind,
+static int ds1621_detect(struct i2c_client *client,
 			 struct i2c_board_info *info)
 {
 	struct i2c_adapter *adapter = client->adapter;
@@ -237,20 +236,16 @@ static int ds1621_detect(struct i2c_client *client, int kind,
 		return -ENODEV;
 
 	/* Now, we do the remaining detection. It is lousy. */
-	if (kind < 0) {
-		/* The NVB bit should be low if no EEPROM write has been 
-		   requested during the latest 10ms, which is highly 
-		   improbable in our case. */
-		conf = i2c_smbus_read_byte_data(client, DS1621_REG_CONF);
-		if (conf < 0 || conf & DS1621_REG_CONFIG_NVB)
+	/* The NVB bit should be low if no EEPROM write has been  requested
+	   during the latest 10ms, which is highly improbable in our case. */
+	conf = i2c_smbus_read_byte_data(client, DS1621_REG_CONF);
+	if (conf < 0 || conf & DS1621_REG_CONFIG_NVB)
+		return -ENODEV;
+	/* The 7 lowest bits of a temperature should always be 0. */
+	for (i = 0; i < ARRAY_SIZE(DS1621_REG_TEMP); i++) {
+		temp = i2c_smbus_read_word_data(client, DS1621_REG_TEMP[i]);
+		if (temp < 0 || (temp & 0x7f00))
 			return -ENODEV;
-		/* The 7 lowest bits of a temperature should always be 0. */
-		for (i = 0; i < ARRAY_SIZE(DS1621_REG_TEMP); i++) {
-			temp = i2c_smbus_read_word_data(client,
-							DS1621_REG_TEMP[i]);
-			if (temp < 0 || (temp & 0x7f00))
-				return -ENODEV;
-		}
 	}
 
 	strlcpy(info->type, "ds1621", I2C_NAME_SIZE);
@@ -309,8 +304,8 @@ static int ds1621_remove(struct i2c_client *client)
 }
 
 static const struct i2c_device_id ds1621_id[] = {
-	{ "ds1621", ds1621 },
-	{ "ds1625", ds1621 },
+	{ "ds1621", 0 },
+	{ "ds1625", 0 },
 	{ }
 };
 MODULE_DEVICE_TABLE(i2c, ds1621_id);
@@ -325,7 +320,7 @@ static struct i2c_driver ds1621_driver = {
 	.remove		= ds1621_remove,
 	.id_table	= ds1621_id,
 	.detect		= ds1621_detect,
-	.address_data	= &addr_data,
+	.address_list	= normal_i2c,
 };
 
 static int __init ds1621_init(void)
diff --git a/drivers/hwmon/f71882fg.c b/drivers/hwmon/f71882fg.c
index 4146105f1a57..a95fa4256caa 100644
--- a/drivers/hwmon/f71882fg.c
+++ b/drivers/hwmon/f71882fg.c
@@ -48,6 +48,7 @@
 #define SIO_F71858_ID		0x0507  /* Chipset ID */
 #define SIO_F71862_ID		0x0601	/* Chipset ID */
 #define SIO_F71882_ID		0x0541	/* Chipset ID */
+#define SIO_F71889_ID		0x0723	/* Chipset ID */
 #define SIO_F8000_ID		0x0581	/* Chipset ID */
 
 #define REGION_LENGTH		8
@@ -95,12 +96,13 @@ static unsigned short force_id;
 module_param(force_id, ushort, 0);
 MODULE_PARM_DESC(force_id, "Override the detected device ID");
 
-enum chips { f71858fg, f71862fg, f71882fg, f8000 };
+enum chips { f71858fg, f71862fg, f71882fg, f71889fg, f8000 };
 
 static const char *f71882fg_names[] = {
 	"f71858fg",
 	"f71862fg",
 	"f71882fg",
+	"f71889fg",
 	"f8000",
 };
 
@@ -155,7 +157,7 @@ struct f71882fg_data {
 	u8	pwm_auto_point_hyst[2];
 	u8	pwm_auto_point_mapping[4];
 	u8	pwm_auto_point_pwm[4][5];
-	u8	pwm_auto_point_temp[4][4];
+	s8	pwm_auto_point_temp[4][4];
 };
 
 /* Sysfs in */
@@ -258,7 +260,9 @@ static struct platform_driver f71882fg_driver = {
 
 static DEVICE_ATTR(name, S_IRUGO, show_name, NULL);
 
-/* Temp and in attr for the f71858fg */
+/* Temp and in attr for the f71858fg, the f71858fg is special as it
+   has its temperature indexes start at 0 (the others start at 1) and
+   it only has 3 voltage inputs */
 static struct sensor_device_attribute_2 f71858fg_in_temp_attr[] = {
 	SENSOR_ATTR_2(in0_input, S_IRUGO, show_in, NULL, 0, 0),
 	SENSOR_ATTR_2(in1_input, S_IRUGO, show_in, NULL, 0, 1),
@@ -302,8 +306,8 @@ static struct sensor_device_attribute_2 f71858fg_in_temp_attr[] = {
 	SENSOR_ATTR_2(temp3_fault, S_IRUGO, show_temp_fault, NULL, 0, 2),
 };
 
-/* Temp and in attr common to both the f71862fg and f71882fg */
-static struct sensor_device_attribute_2 f718x2fg_in_temp_attr[] = {
+/* Temp and in attr common to the f71862fg, f71882fg and f71889fg */
+static struct sensor_device_attribute_2 fxxxx_in_temp_attr[] = {
 	SENSOR_ATTR_2(in0_input, S_IRUGO, show_in, NULL, 0, 0),
 	SENSOR_ATTR_2(in1_input, S_IRUGO, show_in, NULL, 0, 1),
 	SENSOR_ATTR_2(in2_input, S_IRUGO, show_in, NULL, 0, 2),
@@ -371,8 +375,8 @@ static struct sensor_device_attribute_2 f718x2fg_in_temp_attr[] = {
 	SENSOR_ATTR_2(temp3_fault, S_IRUGO, show_temp_fault, NULL, 0, 3),
 };
 
-/* Temp and in attr found only on the f71882fg */
-static struct sensor_device_attribute_2 f71882fg_in_temp_attr[] = {
+/* For models with in1 alarm capability */
+static struct sensor_device_attribute_2 fxxxx_in1_alarm_attr[] = {
 	SENSOR_ATTR_2(in1_max, S_IRUGO|S_IWUSR, show_in_max, store_in_max,
 		0, 1),
 	SENSOR_ATTR_2(in1_beep, S_IRUGO|S_IWUSR, show_in_beep, store_in_beep,
@@ -383,6 +387,7 @@ static struct sensor_device_attribute_2 f71882fg_in_temp_attr[] = {
 /* Temp and in attr for the f8000
    Note on the f8000 temp_ovt (crit) is used as max, and temp_high (max)
    is used as hysteresis value to clear alarms
+   Also like the f71858fg its temperature indexes start at 0
  */
 static struct sensor_device_attribute_2 f8000_in_temp_attr[] = {
 	SENSOR_ATTR_2(in0_input, S_IRUGO, show_in, NULL, 0, 0),
@@ -413,61 +418,70 @@ static struct sensor_device_attribute_2 f8000_in_temp_attr[] = {
 };
 
 /* Fan / PWM attr common to all models */
-static struct sensor_device_attribute_2 fxxxx_fan_attr[] = {
+static struct sensor_device_attribute_2 fxxxx_fan_attr[4][6] = { {
 	SENSOR_ATTR_2(fan1_input, S_IRUGO, show_fan, NULL, 0, 0),
 	SENSOR_ATTR_2(fan1_full_speed, S_IRUGO|S_IWUSR,
 		      show_fan_full_speed,
 		      store_fan_full_speed, 0, 0),
 	SENSOR_ATTR_2(fan1_alarm, S_IRUGO, show_fan_alarm, NULL, 0, 0),
-	SENSOR_ATTR_2(fan2_input, S_IRUGO, show_fan, NULL, 0, 1),
-	SENSOR_ATTR_2(fan2_full_speed, S_IRUGO|S_IWUSR,
-		      show_fan_full_speed,
-		      store_fan_full_speed, 0, 1),
-	SENSOR_ATTR_2(fan2_alarm, S_IRUGO, show_fan_alarm, NULL, 0, 1),
-	SENSOR_ATTR_2(fan3_input, S_IRUGO, show_fan, NULL, 0, 2),
-	SENSOR_ATTR_2(fan3_full_speed, S_IRUGO|S_IWUSR,
-		      show_fan_full_speed,
-		      store_fan_full_speed, 0, 2),
-	SENSOR_ATTR_2(fan3_alarm, S_IRUGO, show_fan_alarm, NULL, 0, 2),
-
 	SENSOR_ATTR_2(pwm1, S_IRUGO|S_IWUSR, show_pwm, store_pwm, 0, 0),
 	SENSOR_ATTR_2(pwm1_enable, S_IRUGO|S_IWUSR, show_pwm_enable,
 		      store_pwm_enable, 0, 0),
 	SENSOR_ATTR_2(pwm1_interpolate, S_IRUGO|S_IWUSR,
 		      show_pwm_interpolate, store_pwm_interpolate, 0, 0),
-	SENSOR_ATTR_2(pwm1_auto_channels_temp, S_IRUGO|S_IWUSR,
-		      show_pwm_auto_point_channel,
-		      store_pwm_auto_point_channel, 0, 0),
-
+}, {
+	SENSOR_ATTR_2(fan2_input, S_IRUGO, show_fan, NULL, 0, 1),
+	SENSOR_ATTR_2(fan2_full_speed, S_IRUGO|S_IWUSR,
+		      show_fan_full_speed,
+		      store_fan_full_speed, 0, 1),
+	SENSOR_ATTR_2(fan2_alarm, S_IRUGO, show_fan_alarm, NULL, 0, 1),
 	SENSOR_ATTR_2(pwm2, S_IRUGO|S_IWUSR, show_pwm, store_pwm, 0, 1),
 	SENSOR_ATTR_2(pwm2_enable, S_IRUGO|S_IWUSR, show_pwm_enable,
 		      store_pwm_enable, 0, 1),
 	SENSOR_ATTR_2(pwm2_interpolate, S_IRUGO|S_IWUSR,
 		      show_pwm_interpolate, store_pwm_interpolate, 0, 1),
-	SENSOR_ATTR_2(pwm2_auto_channels_temp, S_IRUGO|S_IWUSR,
-		      show_pwm_auto_point_channel,
-		      store_pwm_auto_point_channel, 0, 1),
-
+}, {
+	SENSOR_ATTR_2(fan3_input, S_IRUGO, show_fan, NULL, 0, 2),
+	SENSOR_ATTR_2(fan3_full_speed, S_IRUGO|S_IWUSR,
+		      show_fan_full_speed,
+		      store_fan_full_speed, 0, 2),
+	SENSOR_ATTR_2(fan3_alarm, S_IRUGO, show_fan_alarm, NULL, 0, 2),
 	SENSOR_ATTR_2(pwm3, S_IRUGO|S_IWUSR, show_pwm, store_pwm, 0, 2),
 	SENSOR_ATTR_2(pwm3_enable, S_IRUGO|S_IWUSR, show_pwm_enable,
 		      store_pwm_enable, 0, 2),
 	SENSOR_ATTR_2(pwm3_interpolate, S_IRUGO|S_IWUSR,
 		      show_pwm_interpolate, store_pwm_interpolate, 0, 2),
-	SENSOR_ATTR_2(pwm3_auto_channels_temp, S_IRUGO|S_IWUSR,
-		      show_pwm_auto_point_channel,
-		      store_pwm_auto_point_channel, 0, 2),
-};
+}, {
+	SENSOR_ATTR_2(fan4_input, S_IRUGO, show_fan, NULL, 0, 3),
+	SENSOR_ATTR_2(fan4_full_speed, S_IRUGO|S_IWUSR,
+		      show_fan_full_speed,
+		      store_fan_full_speed, 0, 3),
+	SENSOR_ATTR_2(fan4_alarm, S_IRUGO, show_fan_alarm, NULL, 0, 3),
+	SENSOR_ATTR_2(pwm4, S_IRUGO|S_IWUSR, show_pwm, store_pwm, 0, 3),
+	SENSOR_ATTR_2(pwm4_enable, S_IRUGO|S_IWUSR, show_pwm_enable,
+		      store_pwm_enable, 0, 3),
+	SENSOR_ATTR_2(pwm4_interpolate, S_IRUGO|S_IWUSR,
+		      show_pwm_interpolate, store_pwm_interpolate, 0, 3),
+} };
 
-/* Fan / PWM attr for the f71862fg, less pwms and less zones per pwm than the
-   f71882fg */
-static struct sensor_device_attribute_2 f71862fg_fan_attr[] = {
+/* Attr for models which can beep on Fan alarm */
+static struct sensor_device_attribute_2 fxxxx_fan_beep_attr[] = {
 	SENSOR_ATTR_2(fan1_beep, S_IRUGO|S_IWUSR, show_fan_beep,
 		store_fan_beep, 0, 0),
 	SENSOR_ATTR_2(fan2_beep, S_IRUGO|S_IWUSR, show_fan_beep,
 		store_fan_beep, 0, 1),
 	SENSOR_ATTR_2(fan3_beep, S_IRUGO|S_IWUSR, show_fan_beep,
 		store_fan_beep, 0, 2),
+	SENSOR_ATTR_2(fan4_beep, S_IRUGO|S_IWUSR, show_fan_beep,
+		store_fan_beep, 0, 3),
+};
 
+/* PWM attr for the f71862fg, fewer pwms and fewer zones per pwm than the
+   f71858fg / f71882fg / f71889fg */
+static struct sensor_device_attribute_2 f71862fg_auto_pwm_attr[] = {
+	SENSOR_ATTR_2(pwm1_auto_channels_temp, S_IRUGO|S_IWUSR,
+		      show_pwm_auto_point_channel,
+		      store_pwm_auto_point_channel, 0, 0),
 	SENSOR_ATTR_2(pwm1_auto_point1_pwm, S_IRUGO|S_IWUSR,
 		      show_pwm_auto_point_pwm, store_pwm_auto_point_pwm,
 		      1, 0),
@@ -487,6 +501,9 @@ static struct sensor_device_attribute_2 f71862fg_fan_attr[] = {
 	SENSOR_ATTR_2(pwm1_auto_point2_temp_hyst, S_IRUGO,
 		      show_pwm_auto_point_temp_hyst, NULL, 3, 0),
 
+	SENSOR_ATTR_2(pwm2_auto_channels_temp, S_IRUGO|S_IWUSR,
+		      show_pwm_auto_point_channel,
+		      store_pwm_auto_point_channel, 0, 1),
 	SENSOR_ATTR_2(pwm2_auto_point1_pwm, S_IRUGO|S_IWUSR,
 		      show_pwm_auto_point_pwm, store_pwm_auto_point_pwm,
 		      1, 1),
@@ -506,6 +523,9 @@ static struct sensor_device_attribute_2 f71862fg_fan_attr[] = {
 	SENSOR_ATTR_2(pwm2_auto_point2_temp_hyst, S_IRUGO,
 		      show_pwm_auto_point_temp_hyst, NULL, 3, 1),
 
+	SENSOR_ATTR_2(pwm3_auto_channels_temp, S_IRUGO|S_IWUSR,
+		      show_pwm_auto_point_channel,
+		      store_pwm_auto_point_channel, 0, 2),
 	SENSOR_ATTR_2(pwm3_auto_point1_pwm, S_IRUGO|S_IWUSR,
 		      show_pwm_auto_point_pwm, store_pwm_auto_point_pwm,
 		      1, 2),
@@ -526,8 +546,11 @@ static struct sensor_device_attribute_2 f71862fg_fan_attr[] = {
 		      show_pwm_auto_point_temp_hyst, NULL, 3, 2),
 };
 
-/* Fan / PWM attr common to both the f71882fg and f71858fg */
-static struct sensor_device_attribute_2 f71882fg_f71858fg_fan_attr[] = {
+/* PWM attr common to the f71858fg, f71882fg and f71889fg */
+static struct sensor_device_attribute_2 fxxxx_auto_pwm_attr[4][14] = { {
+	SENSOR_ATTR_2(pwm1_auto_channels_temp, S_IRUGO|S_IWUSR,
+		      show_pwm_auto_point_channel,
+		      store_pwm_auto_point_channel, 0, 0),
 	SENSOR_ATTR_2(pwm1_auto_point1_pwm, S_IRUGO|S_IWUSR,
 		      show_pwm_auto_point_pwm, store_pwm_auto_point_pwm,
 		      0, 0),
@@ -565,7 +588,10 @@ static struct sensor_device_attribute_2 f71882fg_f71858fg_fan_attr[] = {
 		      show_pwm_auto_point_temp_hyst, NULL, 2, 0),
 	SENSOR_ATTR_2(pwm1_auto_point4_temp_hyst, S_IRUGO,
 		      show_pwm_auto_point_temp_hyst, NULL, 3, 0),
-
+}, {
+	SENSOR_ATTR_2(pwm2_auto_channels_temp, S_IRUGO|S_IWUSR,
+		      show_pwm_auto_point_channel,
+		      store_pwm_auto_point_channel, 0, 1),
 	SENSOR_ATTR_2(pwm2_auto_point1_pwm, S_IRUGO|S_IWUSR,
 		      show_pwm_auto_point_pwm, store_pwm_auto_point_pwm,
 		      0, 1),
@@ -603,7 +629,10 @@ static struct sensor_device_attribute_2 f71882fg_f71858fg_fan_attr[] = {
 		      show_pwm_auto_point_temp_hyst, NULL, 2, 1),
 	SENSOR_ATTR_2(pwm2_auto_point4_temp_hyst, S_IRUGO,
 		      show_pwm_auto_point_temp_hyst, NULL, 3, 1),
-
+}, {
+	SENSOR_ATTR_2(pwm3_auto_channels_temp, S_IRUGO|S_IWUSR,
+		      show_pwm_auto_point_channel,
+		      store_pwm_auto_point_channel, 0, 2),
 	SENSOR_ATTR_2(pwm3_auto_point1_pwm, S_IRUGO|S_IWUSR,
 		      show_pwm_auto_point_pwm, store_pwm_auto_point_pwm,
 		      0, 2),
@@ -641,30 +670,7 @@ static struct sensor_device_attribute_2 f71882fg_f71858fg_fan_attr[] = {
 		      show_pwm_auto_point_temp_hyst, NULL, 2, 2),
 	SENSOR_ATTR_2(pwm3_auto_point4_temp_hyst, S_IRUGO,
 		      show_pwm_auto_point_temp_hyst, NULL, 3, 2),
-};
-
-/* Fan / PWM attr found on the f71882fg but not on the f71858fg */
-static struct sensor_device_attribute_2 f71882fg_fan_attr[] = {
-	SENSOR_ATTR_2(fan1_beep, S_IRUGO|S_IWUSR, show_fan_beep,
-		store_fan_beep, 0, 0),
-	SENSOR_ATTR_2(fan2_beep, S_IRUGO|S_IWUSR, show_fan_beep,
-		store_fan_beep, 0, 1),
-	SENSOR_ATTR_2(fan3_beep, S_IRUGO|S_IWUSR, show_fan_beep,
-		store_fan_beep, 0, 2),
-
-	SENSOR_ATTR_2(fan4_input, S_IRUGO, show_fan, NULL, 0, 3),
-	SENSOR_ATTR_2(fan4_full_speed, S_IRUGO|S_IWUSR,
-		      show_fan_full_speed,
-		      store_fan_full_speed, 0, 3),
-	SENSOR_ATTR_2(fan4_beep, S_IRUGO|S_IWUSR, show_fan_beep,
-		store_fan_beep, 0, 3),
-	SENSOR_ATTR_2(fan4_alarm, S_IRUGO, show_fan_alarm, NULL, 0, 3),
-
-	SENSOR_ATTR_2(pwm4, S_IRUGO|S_IWUSR, show_pwm, store_pwm, 0, 3),
-	SENSOR_ATTR_2(pwm4_enable, S_IRUGO|S_IWUSR, show_pwm_enable,
-		      store_pwm_enable, 0, 3),
-	SENSOR_ATTR_2(pwm4_interpolate, S_IRUGO|S_IWUSR,
-		      show_pwm_interpolate, store_pwm_interpolate, 0, 3),
+}, {
 	SENSOR_ATTR_2(pwm4_auto_channels_temp, S_IRUGO|S_IWUSR,
 		      show_pwm_auto_point_channel,
 		      store_pwm_auto_point_channel, 0, 3),
@@ -705,14 +711,20 @@ static struct sensor_device_attribute_2 f71882fg_fan_attr[] = {
 		      show_pwm_auto_point_temp_hyst, NULL, 2, 3),
 	SENSOR_ATTR_2(pwm4_auto_point4_temp_hyst, S_IRUGO,
 		      show_pwm_auto_point_temp_hyst, NULL, 3, 3),
-};
+} };
 
-/* Fan / PWM attr for the f8000, zones mapped to temp instead of to pwm!
-   Also the register block at offset A0 maps to TEMP1 (so our temp2, as the
-   F8000 starts counting temps at 0), B0 maps the TEMP2 and C0 maps to TEMP0 */
+/* Fan attr specific to the f8000 (4th fan input can only measure speed) */
 static struct sensor_device_attribute_2 f8000_fan_attr[] = {
 	SENSOR_ATTR_2(fan4_input, S_IRUGO, show_fan, NULL, 0, 3),
+};
 
+/* PWM attr for the f8000, zones mapped to temp instead of to pwm!
+   Also the register block at offset A0 maps to TEMP1 (so our temp2, as the
+   F8000 starts counting temps at 0), B0 maps the TEMP2 and C0 maps to TEMP0 */
+static struct sensor_device_attribute_2 f8000_auto_pwm_attr[] = {
+	SENSOR_ATTR_2(pwm1_auto_channels_temp, S_IRUGO|S_IWUSR,
+		      show_pwm_auto_point_channel,
+		      store_pwm_auto_point_channel, 0, 0),
 	SENSOR_ATTR_2(temp1_auto_point1_pwm, S_IRUGO|S_IWUSR,
 		      show_pwm_auto_point_pwm, store_pwm_auto_point_pwm,
 		      0, 2),
@@ -751,6 +763,9 @@ static struct sensor_device_attribute_2 f8000_fan_attr[] = {
 	SENSOR_ATTR_2(temp1_auto_point4_temp_hyst, S_IRUGO,
 		      show_pwm_auto_point_temp_hyst, NULL, 3, 2),
 
+	SENSOR_ATTR_2(pwm2_auto_channels_temp, S_IRUGO|S_IWUSR,
+		      show_pwm_auto_point_channel,
+		      store_pwm_auto_point_channel, 0, 1),
 	SENSOR_ATTR_2(temp2_auto_point1_pwm, S_IRUGO|S_IWUSR,
 		      show_pwm_auto_point_pwm, store_pwm_auto_point_pwm,
 		      0, 0),
@@ -789,6 +804,9 @@ static struct sensor_device_attribute_2 f8000_fan_attr[] = {
 	SENSOR_ATTR_2(temp2_auto_point4_temp_hyst, S_IRUGO,
 		      show_pwm_auto_point_temp_hyst, NULL, 3, 0),
 
+	SENSOR_ATTR_2(pwm3_auto_channels_temp, S_IRUGO|S_IWUSR,
+		      show_pwm_auto_point_channel,
+		      store_pwm_auto_point_channel, 0, 2),
 	SENSOR_ATTR_2(temp3_auto_point1_pwm, S_IRUGO|S_IWUSR,
 		      show_pwm_auto_point_pwm, store_pwm_auto_point_pwm,
 		      0, 1),
@@ -929,7 +947,7 @@ static struct f71882fg_data *f71882fg_update_device(struct device *dev)
 	/* Update once every 60 seconds */
 	if ( time_after(jiffies, data->last_limits + 60 * HZ ) ||
 			!data->valid) {
-		if (data->type == f71882fg) {
+		if (data->type == f71882fg || data->type == f71889fg) {
 			data->in1_max =
 				f71882fg_read8(data, F71882FG_REG_IN1_HIGH);
 			data->in_beep =
@@ -951,7 +969,8 @@ static struct f71882fg_data *f71882fg_update_device(struct device *dev)
 						F71882FG_REG_TEMP_HYST(1));
 		}
 
-		if (data->type == f71862fg || data->type == f71882fg) {
+		if (data->type == f71862fg || data->type == f71882fg ||
+		    data->type == f71889fg) {
 			data->fan_beep = f71882fg_read8(data,
 						F71882FG_REG_FAN_BEEP);
 			data->temp_beep = f71882fg_read8(data,
@@ -961,15 +980,33 @@ static struct f71882fg_data *f71882fg_update_device(struct device *dev)
 			data->temp_type[2] = (reg & 0x04) ? 2 : 4;
 			data->temp_type[3] = (reg & 0x08) ? 2 : 4;
 		}
-		reg2 = f71882fg_read8(data, F71882FG_REG_PECI);
-		if ((reg2 & 0x03) == 0x01)
-			data->temp_type[1] = 6 /* PECI */;
-		else if ((reg2 & 0x03) == 0x02)
-			data->temp_type[1] = 5 /* AMDSI */;
-		else if (data->type == f71862fg || data->type == f71882fg)
-			data->temp_type[1] = (reg & 0x02) ? 2 : 4;
-		else
-			data->temp_type[1] = 2; /* Only supports BJT */
+		/* Determine temp index 1 sensor type */
+		if (data->type == f71889fg) {
+			reg2 = f71882fg_read8(data, F71882FG_REG_START);
+			switch ((reg2 & 0x60) >> 5) {
+			case 0x00: /* BJT / Thermistor */
+				data->temp_type[1] = (reg & 0x02) ? 2 : 4;
+				break;
+			case 0x01: /* AMDSI */
+				data->temp_type[1] = 5;
+				break;
+			case 0x02: /* PECI */
+			case 0x03: /* Ibex Peak ?? Report as PECI for now */
+				data->temp_type[1] = 6;
+				break;
+			}
+		} else {
+			reg2 = f71882fg_read8(data, F71882FG_REG_PECI);
+			if ((reg2 & 0x03) == 0x01)
+				data->temp_type[1] = 6; /* PECI */
+			else if ((reg2 & 0x03) == 0x02)
+				data->temp_type[1] = 5; /* AMDSI */
+			else if (data->type == f71862fg ||
+				 data->type == f71882fg)
+				data->temp_type[1] = (reg & 0x02) ? 2 : 4;
+			else /* f71858fg and f8000 only support BJT */
+				data->temp_type[1] = 2;
+		}
 
 		data->pwm_enable = f71882fg_read8(data,
 						  F71882FG_REG_PWM_ENABLE);
@@ -1046,7 +1083,7 @@ static struct f71882fg_data *f71882fg_update_device(struct device *dev)
 		if (data->type == f8000)
 			data->fan[3] = f71882fg_read16(data,
 						F71882FG_REG_FAN(3));
-		if (data->type == f71882fg)
+		if (data->type == f71882fg || data->type == f71889fg)
 			data->in_status = f71882fg_read8(data,
 						F71882FG_REG_IN_STATUS);
 		for (nr = 0; nr < nr_ins; nr++)
@@ -1764,7 +1801,11 @@ static ssize_t store_pwm_auto_point_temp(struct device *dev,
 	int pwm = to_sensor_dev_attr_2(devattr)->index;
 	int point = to_sensor_dev_attr_2(devattr)->nr;
 	long val = simple_strtol(buf, NULL, 10) / 1000;
-	val = SENSORS_LIMIT(val, 0, 255);
+
+	if (data->type == f71889fg)
+		val = SENSORS_LIMIT(val, -128, 127);
+	else
+		val = SENSORS_LIMIT(val, 0, 127);
 
 	mutex_lock(&data->update_lock);
 	f71882fg_write8(data, F71882FG_REG_POINT_TEMP(pwm, point), val);
@@ -1794,6 +1835,15 @@ static int __devinit f71882fg_create_sysfs_files(struct platform_device *pdev,
 	return 0;
 }
 
+static void f71882fg_remove_sysfs_files(struct platform_device *pdev,
+	struct sensor_device_attribute_2 *attr, int count)
+{
+	int i;
+
+	for (i = 0; i < count; i++)
+		device_remove_file(&pdev->dev, &attr[i].dev_attr);
+}
+
 static int __devinit f71882fg_probe(struct platform_device *pdev)
 {
 	struct f71882fg_data *data;
@@ -1846,16 +1896,17 @@ static int __devinit f71882fg_probe(struct platform_device *pdev)
 					ARRAY_SIZE(f71858fg_in_temp_attr));
 			break;
 		case f71882fg:
+		case f71889fg:
 			err = f71882fg_create_sysfs_files(pdev,
-					f71882fg_in_temp_attr,
-					ARRAY_SIZE(f71882fg_in_temp_attr));
+					fxxxx_in1_alarm_attr,
+					ARRAY_SIZE(fxxxx_in1_alarm_attr));
 			if (err)
 				goto exit_unregister_sysfs;
 			/* fall through! */
 		case f71862fg:
 			err = f71882fg_create_sysfs_files(pdev,
-					f718x2fg_in_temp_attr,
-					ARRAY_SIZE(f718x2fg_in_temp_attr));
+					fxxxx_in_temp_attr,
+					ARRAY_SIZE(fxxxx_in_temp_attr));
 			break;
 		case f8000:
 			err = f71882fg_create_sysfs_files(pdev,
@@ -1883,6 +1934,7 @@ static int __devinit f71882fg_probe(struct platform_device *pdev)
 			err = (data->pwm_enable & 0x15) != 0x15;
 			break;
 		case f71882fg:
+		case f71889fg:
 			err = 0;
 			break;
 		case f8000:
@@ -1897,34 +1949,55 @@ static int __devinit f71882fg_probe(struct platform_device *pdev)
 			goto exit_unregister_sysfs;
 		}
 
-		err = f71882fg_create_sysfs_files(pdev, fxxxx_fan_attr,
-					ARRAY_SIZE(fxxxx_fan_attr));
+		err = f71882fg_create_sysfs_files(pdev, &fxxxx_fan_attr[0][0],
+				ARRAY_SIZE(fxxxx_fan_attr[0]) * nr_fans);
 		if (err)
 			goto exit_unregister_sysfs;
 
-		switch (data->type) {
-		case f71862fg:
-			err = f71882fg_create_sysfs_files(pdev,
-					f71862fg_fan_attr,
-					ARRAY_SIZE(f71862fg_fan_attr));
-			break;
-		case f71882fg:
+		if (data->type == f71862fg || data->type == f71882fg ||
+		    data->type == f71889fg) {
 			err = f71882fg_create_sysfs_files(pdev,
-					f71882fg_fan_attr,
-					ARRAY_SIZE(f71882fg_fan_attr));
+					fxxxx_fan_beep_attr, nr_fans);
 			if (err)
 				goto exit_unregister_sysfs;
-			/* fall through! */
-		case f71858fg:
+		}
+
+		switch (data->type) {
+		case f71862fg:
 			err = f71882fg_create_sysfs_files(pdev,
-					f71882fg_f71858fg_fan_attr,
-					ARRAY_SIZE(f71882fg_f71858fg_fan_attr));
+					f71862fg_auto_pwm_attr,
+					ARRAY_SIZE(f71862fg_auto_pwm_attr));
 			break;
 		case f8000:
 			err = f71882fg_create_sysfs_files(pdev,
 					f8000_fan_attr,
 					ARRAY_SIZE(f8000_fan_attr));
+			if (err)
+				goto exit_unregister_sysfs;
+			err = f71882fg_create_sysfs_files(pdev,
+					f8000_auto_pwm_attr,
+					ARRAY_SIZE(f8000_auto_pwm_attr));
 			break;
+		case f71889fg:
+			for (i = 0; i < nr_fans; i++) {
+				data->pwm_auto_point_mapping[i] =
+					f71882fg_read8(data,
+						F71882FG_REG_POINT_MAPPING(i));
+				if (data->pwm_auto_point_mapping[i] & 0x80)
+					break;
+			}
+			if (i != nr_fans) {
+				dev_warn(&pdev->dev,
+					 "Auto pwm controlled by raw digital "
+					 "data, disabling pwm auto_point "
+					 "sysfs attributes\n");
+				break;
+			}
+			/* fall through */
+		default: /* f71858fg / f71882fg */
+			err = f71882fg_create_sysfs_files(pdev,
+				&fxxxx_auto_pwm_attr[0][0],
+				ARRAY_SIZE(fxxxx_auto_pwm_attr[0]) * nr_fans);
 		}
 		if (err)
 			goto exit_unregister_sysfs;
@@ -1954,33 +2027,76 @@ exit_free:
 
 static int f71882fg_remove(struct platform_device *pdev)
 {
-	int i;
 	struct f71882fg_data *data = platform_get_drvdata(pdev);
+	int nr_fans = (data->type == f71882fg) ? 4 : 3;
+	u8 start_reg = f71882fg_read8(data, F71882FG_REG_START);
 
 	platform_set_drvdata(pdev, NULL);
 	if (data->hwmon_dev)
 		hwmon_device_unregister(data->hwmon_dev);
 
-	/* Note we are not looping over all attr arrays we have as the ones
-	   below are supersets of the ones skipped. */
 	device_remove_file(&pdev->dev, &dev_attr_name);
 
-	for (i = 0; i < ARRAY_SIZE(f718x2fg_in_temp_attr); i++)
-		device_remove_file(&pdev->dev,
-					&f718x2fg_in_temp_attr[i].dev_attr);
-
-	for (i = 0; i < ARRAY_SIZE(f71882fg_in_temp_attr); i++)
-		device_remove_file(&pdev->dev,
-					&f71882fg_in_temp_attr[i].dev_attr);
+	if (start_reg & 0x01) {
+		switch (data->type) {
+		case f71858fg:
+			if (data->temp_config & 0x10)
+				f71882fg_remove_sysfs_files(pdev,
+					f8000_in_temp_attr,
+					ARRAY_SIZE(f8000_in_temp_attr));
+			else
+				f71882fg_remove_sysfs_files(pdev,
+					f71858fg_in_temp_attr,
+					ARRAY_SIZE(f71858fg_in_temp_attr));
+			break;
+		case f71882fg:
+		case f71889fg:
+			f71882fg_remove_sysfs_files(pdev,
+					fxxxx_in1_alarm_attr,
+					ARRAY_SIZE(fxxxx_in1_alarm_attr));
+			/* fall through! */
+		case f71862fg:
+			f71882fg_remove_sysfs_files(pdev,
+					fxxxx_in_temp_attr,
+					ARRAY_SIZE(fxxxx_in_temp_attr));
+			break;
+		case f8000:
+			f71882fg_remove_sysfs_files(pdev,
+					f8000_in_temp_attr,
+					ARRAY_SIZE(f8000_in_temp_attr));
+			break;
+		}
+	}
 
-	for (i = 0; i < ARRAY_SIZE(fxxxx_fan_attr); i++)
-		device_remove_file(&pdev->dev, &fxxxx_fan_attr[i].dev_attr);
+	if (start_reg & 0x02) {
+		f71882fg_remove_sysfs_files(pdev, &fxxxx_fan_attr[0][0],
+				ARRAY_SIZE(fxxxx_fan_attr[0]) * nr_fans);
 
-	for (i = 0; i < ARRAY_SIZE(f71882fg_fan_attr); i++)
-		device_remove_file(&pdev->dev, &f71882fg_fan_attr[i].dev_attr);
+		if (data->type == f71862fg || data->type == f71882fg ||
+		    data->type == f71889fg)
+			f71882fg_remove_sysfs_files(pdev,
+					fxxxx_fan_beep_attr, nr_fans);
 
-	for (i = 0; i < ARRAY_SIZE(f8000_fan_attr); i++)
-		device_remove_file(&pdev->dev, &f8000_fan_attr[i].dev_attr);
+		switch (data->type) {
+		case f71862fg:
+			f71882fg_remove_sysfs_files(pdev,
+					f71862fg_auto_pwm_attr,
+					ARRAY_SIZE(f71862fg_auto_pwm_attr));
+			break;
+		case f8000:
+			f71882fg_remove_sysfs_files(pdev,
+					f8000_fan_attr,
+					ARRAY_SIZE(f8000_fan_attr));
+			f71882fg_remove_sysfs_files(pdev,
+					f8000_auto_pwm_attr,
+					ARRAY_SIZE(f8000_auto_pwm_attr));
+			break;
+		default: /* f71858fg / f71882fg / f71889fg */
+			f71882fg_remove_sysfs_files(pdev,
+				&fxxxx_auto_pwm_attr[0][0],
+				ARRAY_SIZE(fxxxx_auto_pwm_attr[0]) * nr_fans);
+		}
+	}
 
 	kfree(data);
 
@@ -2012,11 +2128,15 @@ static int __init f71882fg_find(int sioaddr, unsigned short *address,
 	case SIO_F71882_ID:
 		sio_data->type = f71882fg;
 		break;
+	case SIO_F71889_ID:
+		sio_data->type = f71889fg;
+		break;
 	case SIO_F8000_ID:
 		sio_data->type = f8000;
 		break;
 	default:
-		printk(KERN_INFO DRVNAME ": Unsupported Fintek device\n");
+		printk(KERN_INFO DRVNAME ": Unsupported Fintek device: %04x\n",
+		       (unsigned int)devid);
 		goto exit;
 	}
 
diff --git a/drivers/hwmon/f75375s.c b/drivers/hwmon/f75375s.c
index e2107e533ede..277398f9c938 100644
--- a/drivers/hwmon/f75375s.c
+++ b/drivers/hwmon/f75375s.c
@@ -39,8 +39,7 @@
 /* Addresses to scan */
 static const unsigned short normal_i2c[] = { 0x2d, 0x2e, I2C_CLIENT_END };
 
-/* Insmod parameters */
-I2C_CLIENT_INSMOD_2(f75373, f75375);
+enum chips { f75373, f75375 };
 
 /* Fintek F75375 registers  */
 #define F75375_REG_CONFIG0		0x0
@@ -113,7 +112,7 @@ struct f75375_data {
 	s8 temp_max_hyst[2];
 };
 
-static int f75375_detect(struct i2c_client *client, int kind,
+static int f75375_detect(struct i2c_client *client,
 			 struct i2c_board_info *info);
 static int f75375_probe(struct i2c_client *client,
 			const struct i2c_device_id *id);
@@ -135,7 +134,7 @@ static struct i2c_driver f75375_driver = {
 	.remove = f75375_remove,
 	.id_table = f75375_id,
 	.detect = f75375_detect,
-	.address_data = &addr_data,
+	.address_list = normal_i2c,
 };
 
 static inline int f75375_read8(struct i2c_client *client, u8 reg)
@@ -677,34 +676,24 @@ static int f75375_remove(struct i2c_client *client)
 }
 
 /* Return 0 if detection is successful, -ENODEV otherwise */
-static int f75375_detect(struct i2c_client *client, int kind,
+static int f75375_detect(struct i2c_client *client,
 			 struct i2c_board_info *info)
 {
 	struct i2c_adapter *adapter = client->adapter;
-	u8 version = 0;
-	const char *name = "";
-
-	if (kind < 0) {
-		u16 vendid = f75375_read16(client, F75375_REG_VENDOR);
-		u16 chipid = f75375_read16(client, F75375_CHIP_ID);
-		version = f75375_read8(client, F75375_REG_VERSION);
-		if (chipid == 0x0306 && vendid == 0x1934) {
-			kind = f75375;
-		} else if (chipid == 0x0204 && vendid == 0x1934) {
-			kind = f75373;
-		} else {
-			dev_err(&adapter->dev,
-				"failed,%02X,%02X,%02X\n",
-				chipid, version, vendid);
-			return -ENODEV;
-		}
-	}
+	u16 vendid, chipid;
+	u8 version;
+	const char *name;
 
-	if (kind == f75375) {
+	vendid = f75375_read16(client, F75375_REG_VENDOR);
+	chipid = f75375_read16(client, F75375_CHIP_ID);
+	if (chipid == 0x0306 && vendid == 0x1934)
 		name = "f75375";
-	} else if (kind == f75373) {
+	else if (chipid == 0x0204 && vendid == 0x1934)
 		name = "f75373";
-	}
+	else
+		return -ENODEV;
+
+	version = f75375_read8(client, F75375_REG_VERSION);
 	dev_info(&adapter->dev, "found %s version: %02X\n", name, version);
 	strlcpy(info->type, name, I2C_NAME_SIZE);
 
diff --git a/drivers/hwmon/fschmd.c b/drivers/hwmon/fschmd.c
index da1b1f9488af..bd0fc67e804b 100644
--- a/drivers/hwmon/fschmd.c
+++ b/drivers/hwmon/fschmd.c
@@ -56,7 +56,8 @@ static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
 MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default="
 	__MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
-I2C_CLIENT_INSMOD_7(fscpos, fscher, fscscy, fschrc, fschmd, fschds, fscsyl);
+
+enum chips { fscpos, fscher, fscscy, fschrc, fschmd, fschds, fscsyl };
 
 /*
  * The FSCHMD registers and other defines
@@ -221,7 +222,7 @@ static const int FSCHMD_NO_TEMP_SENSORS[7] = { 3, 3, 4, 3, 5, 5, 11 };
 
 static int fschmd_probe(struct i2c_client *client,
 			const struct i2c_device_id *id);
-static int fschmd_detect(struct i2c_client *client, int kind,
+static int fschmd_detect(struct i2c_client *client,
 			 struct i2c_board_info *info);
 static int fschmd_remove(struct i2c_client *client);
 static struct fschmd_data *fschmd_update_device(struct device *dev);
@@ -251,7 +252,7 @@ static struct i2c_driver fschmd_driver = {
 	.remove		= fschmd_remove,
 	.id_table	= fschmd_id,
 	.detect		= fschmd_detect,
-	.address_data	= &addr_data,
+	.address_list	= normal_i2c,
 };
 
 /*
@@ -1000,43 +1001,38 @@ static void fschmd_dmi_decode(const struct dmi_header *header, void *dummy)
 	}
 }
 
-static int fschmd_detect(struct i2c_client *client, int kind,
+static int fschmd_detect(struct i2c_client *client,
 			 struct i2c_board_info *info)
 {
+	enum chips kind;
 	struct i2c_adapter *adapter = client->adapter;
+	char id[4];
 
 	if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA))
 		return -ENODEV;
 
 	/* Detect & Identify the chip */
-	if (kind <= 0) {
-		char id[4];
-
-		id[0] = i2c_smbus_read_byte_data(client,
-				FSCHMD_REG_IDENT_0);
-		id[1] = i2c_smbus_read_byte_data(client,
-				FSCHMD_REG_IDENT_1);
-		id[2] = i2c_smbus_read_byte_data(client,
-				FSCHMD_REG_IDENT_2);
-		id[3] = '\0';
-
-		if (!strcmp(id, "PEG"))
-			kind = fscpos;
-		else if (!strcmp(id, "HER"))
-			kind = fscher;
-		else if (!strcmp(id, "SCY"))
-			kind = fscscy;
-		else if (!strcmp(id, "HRC"))
-			kind = fschrc;
-		else if (!strcmp(id, "HMD"))
-			kind = fschmd;
-		else if (!strcmp(id, "HDS"))
-			kind = fschds;
-		else if (!strcmp(id, "SYL"))
-			kind = fscsyl;
-		else
-			return -ENODEV;
-	}
+	id[0] = i2c_smbus_read_byte_data(client, FSCHMD_REG_IDENT_0);
+	id[1] = i2c_smbus_read_byte_data(client, FSCHMD_REG_IDENT_1);
+	id[2] = i2c_smbus_read_byte_data(client, FSCHMD_REG_IDENT_2);
+	id[3] = '\0';
+
+	if (!strcmp(id, "PEG"))
+		kind = fscpos;
+	else if (!strcmp(id, "HER"))
+		kind = fscher;
+	else if (!strcmp(id, "SCY"))
+		kind = fscscy;
+	else if (!strcmp(id, "HRC"))
+		kind = fschrc;
+	else if (!strcmp(id, "HMD"))
+		kind = fschmd;
+	else if (!strcmp(id, "HDS"))
+		kind = fschds;
+	else if (!strcmp(id, "SYL"))
+		kind = fscsyl;
+	else
+		return -ENODEV;
 
 	strlcpy(info->type, fschmd_id[kind - 1].name, I2C_NAME_SIZE);
 
diff --git a/drivers/hwmon/gl518sm.c b/drivers/hwmon/gl518sm.c
index 7820df45d77a..e7ae5743e181 100644
--- a/drivers/hwmon/gl518sm.c
+++ b/drivers/hwmon/gl518sm.c
@@ -46,8 +46,7 @@
 /* Addresses to scan */
 static const unsigned short normal_i2c[] = { 0x2c, 0x2d, I2C_CLIENT_END };
 
-/* Insmod parameters */
-I2C_CLIENT_INSMOD_2(gl518sm_r00, gl518sm_r80);
+enum chips { gl518sm_r00, gl518sm_r80 };
 
 /* Many GL518 constants specified below */
 
@@ -139,8 +138,7 @@ struct gl518_data {
 
 static int gl518_probe(struct i2c_client *client,
 		       const struct i2c_device_id *id);
-static int gl518_detect(struct i2c_client *client, int kind,
-			struct i2c_board_info *info);
+static int gl518_detect(struct i2c_client *client, struct i2c_board_info *info);
 static void gl518_init_client(struct i2c_client *client);
 static int gl518_remove(struct i2c_client *client);
 static int gl518_read_value(struct i2c_client *client, u8 reg);
@@ -163,7 +161,7 @@ static struct i2c_driver gl518_driver = {
 	.remove		= gl518_remove,
 	.id_table	= gl518_id,
 	.detect		= gl518_detect,
-	.address_data	= &addr_data,
+	.address_list	= normal_i2c,
 };
 
 /*
@@ -484,40 +482,24 @@ static const struct attribute_group gl518_group_r80 = {
  */
 
 /* Return 0 if detection is successful, -ENODEV otherwise */
-static int gl518_detect(struct i2c_client *client, int kind,
-			struct i2c_board_info *info)
+static int gl518_detect(struct i2c_client *client, struct i2c_board_info *info)
 {
 	struct i2c_adapter *adapter = client->adapter;
-	int i;
+	int rev;
 
 	if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA |
 				     I2C_FUNC_SMBUS_WORD_DATA))
 		return -ENODEV;
 
 	/* Now, we do the remaining detection. */
-
-	if (kind < 0) {
-		if ((gl518_read_value(client, GL518_REG_CHIP_ID) != 0x80)
-		 || (gl518_read_value(client, GL518_REG_CONF) & 0x80))
-			return -ENODEV;
-	}
+	if ((gl518_read_value(client, GL518_REG_CHIP_ID) != 0x80)
+	 || (gl518_read_value(client, GL518_REG_CONF) & 0x80))
+		return -ENODEV;
 
 	/* Determine the chip type. */
-	if (kind <= 0) {
-		i = gl518_read_value(client, GL518_REG_REVISION);
-		if (i == 0x00) {
-			kind = gl518sm_r00;
-		} else if (i == 0x80) {
-			kind = gl518sm_r80;
-		} else {
-			if (kind <= 0)
-				dev_info(&adapter->dev,
-				    "Ignoring 'force' parameter for unknown "
-				    "chip at adapter %d, address 0x%02x\n",
-				    i2c_adapter_id(adapter), client->addr);
-			return -ENODEV;
-		}
-	}
+	rev = gl518_read_value(client, GL518_REG_REVISION);
+	if (rev != 0x00 && rev != 0x80)
+		return -ENODEV;
 
 	strlcpy(info->type, "gl518sm", I2C_NAME_SIZE);
 
diff --git a/drivers/hwmon/gl520sm.c b/drivers/hwmon/gl520sm.c
index 19616f2242b0..ec588026f0a9 100644
--- a/drivers/hwmon/gl520sm.c
+++ b/drivers/hwmon/gl520sm.c
@@ -41,9 +41,6 @@ MODULE_PARM_DESC(extra_sensor_type, "Type of extra sensor (0=autodetect, 1=tempe
 /* Addresses to scan */
 static const unsigned short normal_i2c[] = { 0x2c, 0x2d, I2C_CLIENT_END };
 
-/* Insmod parameters */
-I2C_CLIENT_INSMOD_1(gl520sm);
-
 /* Many GL520 constants specified below
 One of the inputs can be configured as either temp or voltage.
 That's why _TEMP2 and _IN4 access the same register
@@ -81,8 +78,7 @@ static const u8 GL520_REG_TEMP_MAX_HYST[]	= { 0x06, 0x18 };
 
 static int gl520_probe(struct i2c_client *client,
 		       const struct i2c_device_id *id);
-static int gl520_detect(struct i2c_client *client, int kind,
-			struct i2c_board_info *info);
+static int gl520_detect(struct i2c_client *client, struct i2c_board_info *info);
 static void gl520_init_client(struct i2c_client *client);
 static int gl520_remove(struct i2c_client *client);
 static int gl520_read_value(struct i2c_client *client, u8 reg);
@@ -91,7 +87,7 @@ static struct gl520_data *gl520_update_device(struct device *dev);
 
 /* Driver data */
 static const struct i2c_device_id gl520_id[] = {
-	{ "gl520sm", gl520sm },
+	{ "gl520sm", 0 },
 	{ }
 };
 MODULE_DEVICE_TABLE(i2c, gl520_id);
@@ -105,7 +101,7 @@ static struct i2c_driver gl520_driver = {
 	.remove		= gl520_remove,
 	.id_table	= gl520_id,
 	.detect		= gl520_detect,
-	.address_data	= &addr_data,
+	.address_list	= normal_i2c,
 };
 
 /* Client data */
@@ -681,8 +677,7 @@ static const struct attribute_group gl520_group_opt = {
  */
 
 /* Return 0 if detection is successful, -ENODEV otherwise */
-static int gl520_detect(struct i2c_client *client, int kind,
-			struct i2c_board_info *info)
+static int gl520_detect(struct i2c_client *client, struct i2c_board_info *info)
 {
 	struct i2c_adapter *adapter = client->adapter;
 
@@ -691,13 +686,11 @@ static int gl520_detect(struct i2c_client *client, int kind,
 		return -ENODEV;
 
 	/* Determine the chip type. */
-	if (kind < 0) {
-		if ((gl520_read_value(client, GL520_REG_CHIP_ID) != 0x20) ||
-		    ((gl520_read_value(client, GL520_REG_REVISION) & 0x7f) != 0x00) ||
-		    ((gl520_read_value(client, GL520_REG_CONF) & 0x80) != 0x00)) {
-			dev_dbg(&client->dev, "Unknown chip type, skipping\n");
-			return -ENODEV;
-		}
+	if ((gl520_read_value(client, GL520_REG_CHIP_ID) != 0x20) ||
+	    ((gl520_read_value(client, GL520_REG_REVISION) & 0x7f) != 0x00) ||
+	    ((gl520_read_value(client, GL520_REG_CONF) & 0x80) != 0x00)) {
+		dev_dbg(&client->dev, "Unknown chip type, skipping\n");
+		return -ENODEV;
 	}
 
 	strlcpy(info->type, "gl520sm", I2C_NAME_SIZE);
diff --git a/drivers/hwmon/it87.c b/drivers/hwmon/it87.c
index a3749cb0f181..0ffe84d190bb 100644
--- a/drivers/hwmon/it87.c
+++ b/drivers/hwmon/it87.c
@@ -124,6 +124,8 @@ superio_exit(void)
 #define IT87_BASE_REG 0x60
 
 /* Logical device 7 registers (IT8712F and later) */
+#define IT87_SIO_GPIO3_REG	0x27
+#define IT87_SIO_GPIO5_REG	0x29
 #define IT87_SIO_PINX2_REG	0x2c	/* Pin selection */
 #define IT87_SIO_VID_REG	0xfc	/* VID value */
 
@@ -244,7 +246,9 @@ struct it87_sio_data {
 	/* Values read from Super-I/O config space */
 	u8 revision;
 	u8 vid_value;
-	/* Values set based on DMI strings */
+	/* Features skipped based on config or DMI */
+	u8 skip_vid;
+	u8 skip_fan;
 	u8 skip_pwm;
 };
 
@@ -1028,11 +1032,35 @@ static int __init it87_find(unsigned short *address,
 		chip_type, *address, sio_data->revision);
 
 	/* Read GPIO config and VID value from LDN 7 (GPIO) */
-	if (sio_data->type != it87) {
+	if (sio_data->type == it87) {
+		/* The IT8705F doesn't have VID pins at all */
+		sio_data->skip_vid = 1;
+	} else {
 		int reg;
 
 		superio_select(GPIO);
-		if (sio_data->type == it8718 || sio_data->type == it8720)
+		/* We need at least 4 VID pins */
+		reg = superio_inb(IT87_SIO_GPIO3_REG);
+		if (reg & 0x0f) {
+			pr_info("it87: VID is disabled (pins used for GPIO)\n");
+			sio_data->skip_vid = 1;
+		}
+
+		/* Check if fan3 is there or not */
+		if (reg & (1 << 6))
+			sio_data->skip_pwm |= (1 << 2);
+		if (reg & (1 << 7))
+			sio_data->skip_fan |= (1 << 2);
+
+		/* Check if fan2 is there or not */
+		reg = superio_inb(IT87_SIO_GPIO5_REG);
+		if (reg & (1 << 1))
+			sio_data->skip_pwm |= (1 << 1);
+		if (reg & (1 << 2))
+			sio_data->skip_fan |= (1 << 1);
+
+		if ((sio_data->type == it8718 || sio_data->type == it8720)
+		 && !(sio_data->skip_vid))
 			sio_data->vid_value = superio_inb(IT87_SIO_VID_REG);
 
 		reg = superio_inb(IT87_SIO_PINX2_REG);
@@ -1236,8 +1264,7 @@ static int __devinit it87_probe(struct platform_device *pdev)
 		}
 	}
 
-	if (data->type == it8712 || data->type == it8716
-	 || data->type == it8718 || data->type == it8720) {
+	if (!sio_data->skip_vid) {
 		data->vrm = vid_which_vrm();
 		/* VID reading from Super-I/O config space if available */
 		data->vid = sio_data->vid_value;
@@ -1355,8 +1382,10 @@ static int __devinit it87_check_pwm(struct device *dev)
 /* Called when we have found a new IT87. */
 static void __devinit it87_init_device(struct platform_device *pdev)
 {
+	struct it87_sio_data *sio_data = pdev->dev.platform_data;
 	struct it87_data *data = platform_get_drvdata(pdev);
 	int tmp, i;
+	u8 mask;
 
 	/* initialize to sane defaults:
 	 * - if the chip is in manual pwm mode, this will be overwritten with
@@ -1402,10 +1431,11 @@ static void __devinit it87_init_device(struct platform_device *pdev)
 	}
 
 	/* Check if tachometers are reset manually or by some reason */
+	mask = 0x70 & ~(sio_data->skip_fan << 4);
 	data->fan_main_ctrl = it87_read_value(data, IT87_REG_FAN_MAIN_CTRL);
-	if ((data->fan_main_ctrl & 0x70) == 0) {
+	if ((data->fan_main_ctrl & mask) == 0) {
 		/* Enable all fan tachometers */
-		data->fan_main_ctrl |= 0x70;
+		data->fan_main_ctrl |= mask;
 		it87_write_value(data, IT87_REG_FAN_MAIN_CTRL, data->fan_main_ctrl);
 	}
 	data->has_fan = (data->fan_main_ctrl >> 4) & 0x07;
@@ -1428,6 +1458,9 @@ static void __devinit it87_init_device(struct platform_device *pdev)
 		}
 	}
 
+	/* Fan input pins may be used for alternative functions */
+	data->has_fan &= ~sio_data->skip_fan;
+
 	/* Set current fan mode registers and the default settings for the
 	 * other mode registers */
 	for (i = 0; i < 3; i++) {
diff --git a/drivers/hwmon/k10temp.c b/drivers/hwmon/k10temp.c
new file mode 100644
index 000000000000..099a2138cdf6
--- /dev/null
+++ b/drivers/hwmon/k10temp.c
@@ -0,0 +1,223 @@
+/*
+ * k10temp.c - AMD Family 10h/11h processor hardware monitoring
+ *
+ * Copyright (c) 2009 Clemens Ladisch <clemens@ladisch.de>
+ *
+ *
+ * This driver is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This driver is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ * See the GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this driver; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <linux/err.h>
+#include <linux/hwmon.h>
+#include <linux/hwmon-sysfs.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/pci.h>
+#include <asm/processor.h>
+
+MODULE_DESCRIPTION("AMD Family 10h/11h CPU core temperature monitor");
+MODULE_AUTHOR("Clemens Ladisch <clemens@ladisch.de>");
+MODULE_LICENSE("GPL");
+
+static bool force;
+module_param(force, bool, 0444);
+MODULE_PARM_DESC(force, "force loading on processors with erratum 319");
+
+/* CPUID function 0x80000001, ebx */
+#define CPUID_PKGTYPE_MASK	0xf0000000
+#define CPUID_PKGTYPE_F		0x00000000
+#define CPUID_PKGTYPE_AM2R2_AM3	0x10000000
+
+/* DRAM controller (PCI function 2) */
+#define REG_DCT0_CONFIG_HIGH		0x094
+#define  DDR3_MODE			0x00000100
+
+/* miscellaneous (PCI function 3) */
+#define REG_HARDWARE_THERMAL_CONTROL	0x64
+#define  HTC_ENABLE			0x00000001
+
+#define REG_REPORTED_TEMPERATURE	0xa4
+
+#define REG_NORTHBRIDGE_CAPABILITIES	0xe8
+#define  NB_CAP_HTC			0x00000400
+
+static ssize_t show_temp(struct device *dev,
+			 struct device_attribute *attr, char *buf)
+{
+	u32 regval;
+
+	pci_read_config_dword(to_pci_dev(dev),
+			      REG_REPORTED_TEMPERATURE, &regval);
+	return sprintf(buf, "%u\n", (regval >> 21) * 125);
+}
+
+static ssize_t show_temp_max(struct device *dev,
+			     struct device_attribute *attr, char *buf)
+{
+	return sprintf(buf, "%d\n", 70 * 1000);
+}
+
+static ssize_t show_temp_crit(struct device *dev,
+			      struct device_attribute *devattr, char *buf)
+{
+	struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
+	int show_hyst = attr->index;
+	u32 regval;
+	int value;
+
+	pci_read_config_dword(to_pci_dev(dev),
+			      REG_HARDWARE_THERMAL_CONTROL, &regval);
+	value = ((regval >> 16) & 0x7f) * 500 + 52000;
+	if (show_hyst)
+		value -= ((regval >> 24) & 0xf) * 500;
+	return sprintf(buf, "%d\n", value);
+}
+
+static ssize_t show_name(struct device *dev,
+			 struct device_attribute *attr, char *buf)
+{
+	return sprintf(buf, "k10temp\n");
+}
+
+static DEVICE_ATTR(temp1_input, S_IRUGO, show_temp, NULL);
+static DEVICE_ATTR(temp1_max, S_IRUGO, show_temp_max, NULL);
+static SENSOR_DEVICE_ATTR(temp1_crit, S_IRUGO, show_temp_crit, NULL, 0);
+static SENSOR_DEVICE_ATTR(temp1_crit_hyst, S_IRUGO, show_temp_crit, NULL, 1);
+static DEVICE_ATTR(name, S_IRUGO, show_name, NULL);
+
+static bool __devinit has_erratum_319(struct pci_dev *pdev)
+{
+	u32 pkg_type, reg_dram_cfg;
+
+	if (boot_cpu_data.x86 != 0x10)
+		return false;
+
+	/*
+	 * Erratum 319: The thermal sensor of Socket F/AM2+ processors
+	 *              may be unreliable.
+	 */
+	pkg_type = cpuid_ebx(0x80000001) & CPUID_PKGTYPE_MASK;
+	if (pkg_type == CPUID_PKGTYPE_F)
+		return true;
+	if (pkg_type != CPUID_PKGTYPE_AM2R2_AM3)
+		return false;
+
+	/* Differentiate between AM2+ (bad) and AM3 (good) */
+	pci_bus_read_config_dword(pdev->bus,
+				  PCI_DEVFN(PCI_SLOT(pdev->devfn), 2),
+				  REG_DCT0_CONFIG_HIGH, &reg_dram_cfg);
+	return !(reg_dram_cfg & DDR3_MODE);
+}
+
+static int __devinit k10temp_probe(struct pci_dev *pdev,
+				   const struct pci_device_id *id)
+{
+	struct device *hwmon_dev;
+	u32 reg_caps, reg_htc;
+	int unreliable = has_erratum_319(pdev);
+	int err;
+
+	if (unreliable && !force) {
+		dev_err(&pdev->dev,
+			"unreliable CPU thermal sensor; monitoring disabled\n");
+		err = -ENODEV;
+		goto exit;
+	}
+
+	err = device_create_file(&pdev->dev, &dev_attr_temp1_input);
+	if (err)
+		goto exit;
+	err = device_create_file(&pdev->dev, &dev_attr_temp1_max);
+	if (err)
+		goto exit_remove;
+
+	pci_read_config_dword(pdev, REG_NORTHBRIDGE_CAPABILITIES, &reg_caps);
+	pci_read_config_dword(pdev, REG_HARDWARE_THERMAL_CONTROL, &reg_htc);
+	if ((reg_caps & NB_CAP_HTC) && (reg_htc & HTC_ENABLE)) {
+		err = device_create_file(&pdev->dev,
+				&sensor_dev_attr_temp1_crit.dev_attr);
+		if (err)
+			goto exit_remove;
+		err = device_create_file(&pdev->dev,
+				&sensor_dev_attr_temp1_crit_hyst.dev_attr);
+		if (err)
+			goto exit_remove;
+	}
+
+	err = device_create_file(&pdev->dev, &dev_attr_name);
+	if (err)
+		goto exit_remove;
+
+	hwmon_dev = hwmon_device_register(&pdev->dev);
+	if (IS_ERR(hwmon_dev)) {
+		err = PTR_ERR(hwmon_dev);
+		goto exit_remove;
+	}
+	dev_set_drvdata(&pdev->dev, hwmon_dev);
+
+	if (unreliable && force)
+		dev_warn(&pdev->dev,
+			 "unreliable CPU thermal sensor; check erratum 319\n");
+	return 0;
+
+exit_remove:
+	device_remove_file(&pdev->dev, &dev_attr_name);
+	device_remove_file(&pdev->dev, &dev_attr_temp1_input);
+	device_remove_file(&pdev->dev, &dev_attr_temp1_max);
+	device_remove_file(&pdev->dev,
+			   &sensor_dev_attr_temp1_crit.dev_attr);
+	device_remove_file(&pdev->dev,
+			   &sensor_dev_attr_temp1_crit_hyst.dev_attr);
+exit:
+	return err;
+}
+
+static void __devexit k10temp_remove(struct pci_dev *pdev)
+{
+	hwmon_device_unregister(dev_get_drvdata(&pdev->dev));
+	device_remove_file(&pdev->dev, &dev_attr_name);
+	device_remove_file(&pdev->dev, &dev_attr_temp1_input);
+	device_remove_file(&pdev->dev, &dev_attr_temp1_max);
+	device_remove_file(&pdev->dev,
+			   &sensor_dev_attr_temp1_crit.dev_attr);
+	device_remove_file(&pdev->dev,
+			   &sensor_dev_attr_temp1_crit_hyst.dev_attr);
+	dev_set_drvdata(&pdev->dev, NULL);
+}
+
+static const struct pci_device_id k10temp_id_table[] = {
+	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_10H_NB_MISC) },
+	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_11H_NB_MISC) },
+	{}
+};
+MODULE_DEVICE_TABLE(pci, k10temp_id_table);
+
+static struct pci_driver k10temp_driver = {
+	.name = "k10temp",
+	.id_table = k10temp_id_table,
+	.probe = k10temp_probe,
+	.remove = __devexit_p(k10temp_remove),
+};
+
+static int __init k10temp_init(void)
+{
+	return pci_register_driver(&k10temp_driver);
+}
+
+static void __exit k10temp_exit(void)
+{
+	pci_unregister_driver(&k10temp_driver);
+}
+
+module_init(k10temp_init)
+module_exit(k10temp_exit)
diff --git a/drivers/hwmon/k8temp.c b/drivers/hwmon/k8temp.c
index 1fe995111841..0ceb6d6200a3 100644
--- a/drivers/hwmon/k8temp.c
+++ b/drivers/hwmon/k8temp.c
@@ -136,7 +136,7 @@ static SENSOR_DEVICE_ATTR_2(temp3_input, S_IRUGO, show_temp, NULL, 1, 0);
 static SENSOR_DEVICE_ATTR_2(temp4_input, S_IRUGO, show_temp, NULL, 1, 1);
 static DEVICE_ATTR(name, S_IRUGO, show_name, NULL);
 
-static struct pci_device_id k8temp_ids[] = {
+static const struct pci_device_id k8temp_ids[] = {
 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_K8_NB_MISC) },
 	{ 0 },
 };
diff --git a/drivers/hwmon/lis3lv02d.c b/drivers/hwmon/lis3lv02d.c
index cf5afb9a10ab..b2f2277cad3c 100644
--- a/drivers/hwmon/lis3lv02d.c
+++ b/drivers/hwmon/lis3lv02d.c
@@ -43,13 +43,30 @@
 #define MDPS_POLL_INTERVAL 50
 /*
  * The sensor can also generate interrupts (DRDY) but it's pretty pointless
- * because their are generated even if the data do not change. So it's better
+ * because they are generated even if the data do not change. So it's better
  * to keep the interrupt for the free-fall event. The values are updated at
  * 40Hz (at the lowest frequency), but as it can be pretty time consuming on
  * some low processor, we poll the sensor only at 20Hz... enough for the
  * joystick.
  */
 
+#define LIS3_PWRON_DELAY_WAI_12B	(5000)
+#define LIS3_PWRON_DELAY_WAI_8B		(3000)
+
+/*
+ * LIS3LV02D spec says 1024 LSBs corresponds 1 G -> 1LSB is 1000/1024 mG
+ * LIS302D spec says: 18 mG / digit
+ * LIS3_ACCURACY is used to increase accuracy of the intermediate
+ * calculation results.
+ */
+#define LIS3_ACCURACY			1024
+/* Sensitivity values for -2G +2G scale */
+#define LIS3_SENSITIVITY_12B		((LIS3_ACCURACY * 1000) / 1024)
+#define LIS3_SENSITIVITY_8B		(18 * LIS3_ACCURACY)
+
+#define LIS3_DEFAULT_FUZZ		3
+#define LIS3_DEFAULT_FLAT		3
+
 struct lis3lv02d lis3_dev = {
 	.misc_wait   = __WAIT_QUEUE_HEAD_INITIALIZER(lis3_dev.misc_wait),
 };
@@ -65,7 +82,7 @@ static s16 lis3lv02d_read_8(struct lis3lv02d *lis3, int reg)
 	return lo;
 }
 
-static s16 lis3lv02d_read_16(struct lis3lv02d *lis3, int reg)
+static s16 lis3lv02d_read_12(struct lis3lv02d *lis3, int reg)
 {
 	u8 lo, hi;
 
@@ -102,16 +119,106 @@ static inline int lis3lv02d_get_axis(s8 axis, int hw_values[3])
 static void lis3lv02d_get_xyz(struct lis3lv02d *lis3, int *x, int *y, int *z)
 {
 	int position[3];
+	int i;
 
+	mutex_lock(&lis3->mutex);
 	position[0] = lis3->read_data(lis3, OUTX);
 	position[1] = lis3->read_data(lis3, OUTY);
 	position[2] = lis3->read_data(lis3, OUTZ);
+	mutex_unlock(&lis3->mutex);
+
+	for (i = 0; i < 3; i++)
+		position[i] = (position[i] * lis3->scale) / LIS3_ACCURACY;
 
 	*x = lis3lv02d_get_axis(lis3->ac.x, position);
 	*y = lis3lv02d_get_axis(lis3->ac.y, position);
 	*z = lis3lv02d_get_axis(lis3->ac.z, position);
 }
 
+/* conversion btw sampling rate and the register values */
+static int lis3_12_rates[4] = {40, 160, 640, 2560};
+static int lis3_8_rates[2] = {100, 400};
+
+/* ODR is Output Data Rate */
+static int lis3lv02d_get_odr(void)
+{
+	u8 ctrl;
+	int shift;
+
+	lis3_dev.read(&lis3_dev, CTRL_REG1, &ctrl);
+	ctrl &= lis3_dev.odr_mask;
+	shift = ffs(lis3_dev.odr_mask) - 1;
+	return lis3_dev.odrs[(ctrl >> shift)];
+}
+
+static int lis3lv02d_set_odr(int rate)
+{
+	u8 ctrl;
+	int i, len, shift;
+
+	lis3_dev.read(&lis3_dev, CTRL_REG1, &ctrl);
+	ctrl &= ~lis3_dev.odr_mask;
+	len = 1 << hweight_long(lis3_dev.odr_mask); /* # of possible values */
+	shift = ffs(lis3_dev.odr_mask) - 1;
+
+	for (i = 0; i < len; i++)
+		if (lis3_dev.odrs[i] == rate) {
+			lis3_dev.write(&lis3_dev, CTRL_REG1,
+					ctrl | (i << shift));
+			return 0;
+		}
+	return -EINVAL;
+}
+
+static int lis3lv02d_selftest(struct lis3lv02d *lis3, s16 results[3])
+{
+	u8 reg;
+	s16 x, y, z;
+	u8 selftest;
+	int ret;
+
+	mutex_lock(&lis3->mutex);
+	if (lis3_dev.whoami == WAI_12B)
+		selftest = CTRL1_ST;
+	else
+		selftest = CTRL1_STP;
+
+	lis3->read(lis3, CTRL_REG1, &reg);
+	lis3->write(lis3, CTRL_REG1, (reg | selftest));
+	msleep(lis3->pwron_delay / lis3lv02d_get_odr());
+
+	/* Read directly to avoid axis remap */
+	x = lis3->read_data(lis3, OUTX);
+	y = lis3->read_data(lis3, OUTY);
+	z = lis3->read_data(lis3, OUTZ);
+
+	/* back to normal settings */
+	lis3->write(lis3, CTRL_REG1, reg);
+	msleep(lis3->pwron_delay / lis3lv02d_get_odr());
+
+	results[0] = x - lis3->read_data(lis3, OUTX);
+	results[1] = y - lis3->read_data(lis3, OUTY);
+	results[2] = z - lis3->read_data(lis3, OUTZ);
+
+	ret = 0;
+	if (lis3->pdata) {
+		int i;
+		for (i = 0; i < 3; i++) {
+			/* Check against selftest acceptance limits */
+			if ((results[i] < lis3->pdata->st_min_limits[i]) ||
+			    (results[i] > lis3->pdata->st_max_limits[i])) {
+				ret = -EIO;
+				goto fail;
+			}
+		}
+	}
+
+	/* test passed */
+fail:
+	mutex_unlock(&lis3->mutex);
+	return ret;
+}
+
 void lis3lv02d_poweroff(struct lis3lv02d *lis3)
 {
 	/* disable X,Y,Z axis and power down */
@@ -125,14 +232,19 @@ void lis3lv02d_poweron(struct lis3lv02d *lis3)
 
 	lis3->init(lis3);
 
+	/* LIS3 power on delay is quite long */
+	msleep(lis3->pwron_delay / lis3lv02d_get_odr());
+
 	/*
 	 * Common configuration
-	 * BDU: LSB and MSB values are not updated until both have been read.
-	 *      So the value read will always be correct.
+	 * BDU: (12 bits sensors only) LSB and MSB values are not updated until
+	 *      both have been read. So the value read will always be correct.
 	 */
-	lis3->read(lis3, CTRL_REG2, &reg);
-	reg |= CTRL2_BDU;
-	lis3->write(lis3, CTRL_REG2, reg);
+	if (lis3->whoami ==  WAI_12B) {
+		lis3->read(lis3, CTRL_REG2, &reg);
+		reg |= CTRL2_BDU;
+		lis3->write(lis3, CTRL_REG2, reg);
+	}
 }
 EXPORT_SYMBOL_GPL(lis3lv02d_poweron);
 
@@ -273,22 +385,17 @@ static void lis3lv02d_joystick_poll(struct input_polled_dev *pidev)
 	int x, y, z;
 
 	lis3lv02d_get_xyz(&lis3_dev, &x, &y, &z);
-	input_report_abs(pidev->input, ABS_X, x - lis3_dev.xcalib);
-	input_report_abs(pidev->input, ABS_Y, y - lis3_dev.ycalib);
-	input_report_abs(pidev->input, ABS_Z, z - lis3_dev.zcalib);
-}
-
-
-static inline void lis3lv02d_calibrate_joystick(void)
-{
-	lis3lv02d_get_xyz(&lis3_dev,
-		&lis3_dev.xcalib, &lis3_dev.ycalib, &lis3_dev.zcalib);
+	input_report_abs(pidev->input, ABS_X, x);
+	input_report_abs(pidev->input, ABS_Y, y);
+	input_report_abs(pidev->input, ABS_Z, z);
+	input_sync(pidev->input);
 }
 
 int lis3lv02d_joystick_enable(void)
 {
 	struct input_dev *input_dev;
 	int err;
+	int max_val, fuzz, flat;
 
 	if (lis3_dev.idev)
 		return -EINVAL;
@@ -301,8 +408,6 @@ int lis3lv02d_joystick_enable(void)
 	lis3_dev.idev->poll_interval = MDPS_POLL_INTERVAL;
 	input_dev = lis3_dev.idev->input;
 
-	lis3lv02d_calibrate_joystick();
-
 	input_dev->name       = "ST LIS3LV02DL Accelerometer";
 	input_dev->phys       = DRIVER_NAME "/input0";
 	input_dev->id.bustype = BUS_HOST;
@@ -310,9 +415,12 @@ int lis3lv02d_joystick_enable(void)
 	input_dev->dev.parent = &lis3_dev.pdev->dev;
 
 	set_bit(EV_ABS, input_dev->evbit);
-	input_set_abs_params(input_dev, ABS_X, -lis3_dev.mdps_max_val, lis3_dev.mdps_max_val, 3, 3);
-	input_set_abs_params(input_dev, ABS_Y, -lis3_dev.mdps_max_val, lis3_dev.mdps_max_val, 3, 3);
-	input_set_abs_params(input_dev, ABS_Z, -lis3_dev.mdps_max_val, lis3_dev.mdps_max_val, 3, 3);
+	max_val = (lis3_dev.mdps_max_val * lis3_dev.scale) / LIS3_ACCURACY;
+	fuzz = (LIS3_DEFAULT_FUZZ * lis3_dev.scale) / LIS3_ACCURACY;
+	flat = (LIS3_DEFAULT_FLAT * lis3_dev.scale) / LIS3_ACCURACY;
+	input_set_abs_params(input_dev, ABS_X, -max_val, max_val, fuzz, flat);
+	input_set_abs_params(input_dev, ABS_Y, -max_val, max_val, fuzz, flat);
+	input_set_abs_params(input_dev, ABS_Z, -max_val, max_val, fuzz, flat);
 
 	err = input_register_polled_device(lis3_dev.idev);
 	if (err) {
@@ -332,11 +440,23 @@ void lis3lv02d_joystick_disable(void)
 	if (lis3_dev.irq)
 		misc_deregister(&lis3lv02d_misc_device);
 	input_unregister_polled_device(lis3_dev.idev);
+	input_free_polled_device(lis3_dev.idev);
 	lis3_dev.idev = NULL;
 }
 EXPORT_SYMBOL_GPL(lis3lv02d_joystick_disable);
 
 /* Sysfs stuff */
+static ssize_t lis3lv02d_selftest_show(struct device *dev,
+				struct device_attribute *attr, char *buf)
+{
+	int result;
+	s16 values[3];
+
+	result = lis3lv02d_selftest(&lis3_dev, values);
+	return sprintf(buf, "%s %d %d %d\n", result == 0 ? "OK" : "FAIL",
+		values[0], values[1], values[2]);
+}
+
 static ssize_t lis3lv02d_position_show(struct device *dev,
 				struct device_attribute *attr, char *buf)
 {
@@ -346,41 +466,35 @@ static ssize_t lis3lv02d_position_show(struct device *dev,
 	return sprintf(buf, "(%d,%d,%d)\n", x, y, z);
 }
 
-static ssize_t lis3lv02d_calibrate_show(struct device *dev,
-				struct device_attribute *attr, char *buf)
+static ssize_t lis3lv02d_rate_show(struct device *dev,
+			struct device_attribute *attr, char *buf)
 {
-	return sprintf(buf, "(%d,%d,%d)\n", lis3_dev.xcalib, lis3_dev.ycalib, lis3_dev.zcalib);
+	return sprintf(buf, "%d\n", lis3lv02d_get_odr());
 }
 
-static ssize_t lis3lv02d_calibrate_store(struct device *dev,
-				struct device_attribute *attr,
-				const char *buf, size_t count)
+static ssize_t lis3lv02d_rate_set(struct device *dev,
+				struct device_attribute *attr, const char *buf,
+				size_t count)
 {
-	lis3lv02d_calibrate_joystick();
-	return count;
-}
+	unsigned long rate;
 
-/* conversion btw sampling rate and the register values */
-static int lis3lv02dl_df_val[4] = {40, 160, 640, 2560};
-static ssize_t lis3lv02d_rate_show(struct device *dev,
-			struct device_attribute *attr, char *buf)
-{
-	u8 ctrl;
-	int val;
+	if (strict_strtoul(buf, 0, &rate))
+		return -EINVAL;
 
-	lis3_dev.read(&lis3_dev, CTRL_REG1, &ctrl);
-	val = (ctrl & (CTRL1_DF0 | CTRL1_DF1)) >> 4;
-	return sprintf(buf, "%d\n", lis3lv02dl_df_val[val]);
+	if (lis3lv02d_set_odr(rate))
+		return -EINVAL;
+
+	return count;
 }
 
+static DEVICE_ATTR(selftest, S_IRUSR, lis3lv02d_selftest_show, NULL);
 static DEVICE_ATTR(position, S_IRUGO, lis3lv02d_position_show, NULL);
-static DEVICE_ATTR(calibrate, S_IRUGO|S_IWUSR, lis3lv02d_calibrate_show,
-	lis3lv02d_calibrate_store);
-static DEVICE_ATTR(rate, S_IRUGO, lis3lv02d_rate_show, NULL);
+static DEVICE_ATTR(rate, S_IRUGO | S_IWUSR, lis3lv02d_rate_show,
+					    lis3lv02d_rate_set);
 
 static struct attribute *lis3lv02d_attributes[] = {
+	&dev_attr_selftest.attr,
 	&dev_attr_position.attr,
-	&dev_attr_calibrate.attr,
 	&dev_attr_rate.attr,
 	NULL
 };
@@ -409,22 +523,30 @@ EXPORT_SYMBOL_GPL(lis3lv02d_remove_fs);
 
 /*
  * Initialise the accelerometer and the various subsystems.
- * Should be rather independant of the bus system.
+ * Should be rather independent of the bus system.
  */
 int lis3lv02d_init_device(struct lis3lv02d *dev)
 {
 	dev->whoami = lis3lv02d_read_8(dev, WHO_AM_I);
 
 	switch (dev->whoami) {
-	case LIS_DOUBLE_ID:
-		printk(KERN_INFO DRIVER_NAME ": 2-byte sensor found\n");
-		dev->read_data = lis3lv02d_read_16;
+	case WAI_12B:
+		printk(KERN_INFO DRIVER_NAME ": 12 bits sensor found\n");
+		dev->read_data = lis3lv02d_read_12;
 		dev->mdps_max_val = 2048;
+		dev->pwron_delay = LIS3_PWRON_DELAY_WAI_12B;
+		dev->odrs = lis3_12_rates;
+		dev->odr_mask = CTRL1_DF0 | CTRL1_DF1;
+		dev->scale = LIS3_SENSITIVITY_12B;
 		break;
-	case LIS_SINGLE_ID:
-		printk(KERN_INFO DRIVER_NAME ": 1-byte sensor found\n");
+	case WAI_8B:
+		printk(KERN_INFO DRIVER_NAME ": 8 bits sensor found\n");
 		dev->read_data = lis3lv02d_read_8;
 		dev->mdps_max_val = 128;
+		dev->pwron_delay = LIS3_PWRON_DELAY_WAI_8B;
+		dev->odrs = lis3_8_rates;
+		dev->odr_mask = CTRL1_DR;
+		dev->scale = LIS3_SENSITIVITY_8B;
 		break;
 	default:
 		printk(KERN_ERR DRIVER_NAME
@@ -432,6 +554,8 @@ int lis3lv02d_init_device(struct lis3lv02d *dev)
 		return -EINVAL;
 	}
 
+	mutex_init(&dev->mutex);
+
 	lis3lv02d_add_fs(dev);
 	lis3lv02d_poweron(dev);
 
@@ -443,7 +567,7 @@ int lis3lv02d_init_device(struct lis3lv02d *dev)
 	if (dev->pdata) {
 		struct lis3lv02d_platform_data *p = dev->pdata;
 
-		if (p->click_flags && (dev->whoami == LIS_SINGLE_ID)) {
+		if (p->click_flags && (dev->whoami == WAI_8B)) {
 			dev->write(dev, CLICK_CFG, p->click_flags);
 			dev->write(dev, CLICK_TIMELIMIT, p->click_time_limit);
 			dev->write(dev, CLICK_LATENCY, p->click_latency);
@@ -454,7 +578,7 @@ int lis3lv02d_init_device(struct lis3lv02d *dev)
 					(p->click_thresh_y << 4));
 		}
 
-		if (p->wakeup_flags && (dev->whoami == LIS_SINGLE_ID)) {
+		if (p->wakeup_flags && (dev->whoami == WAI_8B)) {
 			dev->write(dev, FF_WU_CFG_1, p->wakeup_flags);
 			dev->write(dev, FF_WU_THS_1, p->wakeup_thresh & 0x7f);
 			/* default to 2.5ms for now */
@@ -484,4 +608,3 @@ EXPORT_SYMBOL_GPL(lis3lv02d_init_device);
 MODULE_DESCRIPTION("ST LIS3LV02Dx three-axis digital accelerometer driver");
 MODULE_AUTHOR("Yan Burman, Eric Piel, Pavel Machek");
 MODULE_LICENSE("GPL");
-
diff --git a/drivers/hwmon/lis3lv02d.h b/drivers/hwmon/lis3lv02d.h
index 3e1ff46f72d3..e6a01f44709b 100644
--- a/drivers/hwmon/lis3lv02d.h
+++ b/drivers/hwmon/lis3lv02d.h
@@ -2,7 +2,7 @@
  *  lis3lv02d.h - ST LIS3LV02DL accelerometer driver
  *
  *  Copyright (C) 2007-2008 Yan Burman
- *  Copyright (C) 2008 Eric Piel
+ *  Copyright (C) 2008-2009 Eric Piel
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
@@ -22,20 +22,18 @@
 #include <linux/input-polldev.h>
 
 /*
- * The actual chip is STMicroelectronics LIS3LV02DL or LIS3LV02DQ that seems to
- * be connected via SPI. There exists also several similar chips (such as LIS302DL or
- * LIS3L02DQ) and they have slightly different registers, but we can provide a
- * common interface for all of them.
- * They can also be connected via I²C.
+ * This driver tries to support the "digital" accelerometer chips from
+ * STMicroelectronics such as LIS3LV02DL, LIS302DL, LIS3L02DQ, LIS331DL,
+ * LIS35DE, or LIS202DL. They are very similar in terms of programming, with
+ * almost the same registers. In addition to differing on physical properties,
+ * they differ on the number of axes (2/3), precision (8/12 bits), and special
+ * features (freefall detection, click...). Unfortunately, not all the
+ * differences can be probed via a register.
+ * They can be connected either via I²C or SPI.
  */
 
 #include <linux/lis3lv02d.h>
 
-/* 2-byte registers */
-#define LIS_DOUBLE_ID	0x3A /* LIS3LV02D[LQ] */
-/* 1-byte registers */
-#define LIS_SINGLE_ID	0x3B /* LIS[32]02DL and others */
-
 enum lis3_reg {
 	WHO_AM_I	= 0x0F,
 	OFFSET_X	= 0x16,
@@ -94,7 +92,13 @@ enum lis3lv02d_reg {
 	DD_THSE_H	= 0x3F,
 };
 
-enum lis3lv02d_ctrl1 {
+enum lis3_who_am_i {
+	WAI_12B		= 0x3A, /* 12 bits: LIS3LV02D[LQ]... */
+	WAI_8B		= 0x3B, /* 8 bits: LIS[23]02D[LQ]... */
+	WAI_6B		= 0x52, /* 6 bits: LIS331DLF - not supported */
+};
+
+enum lis3lv02d_ctrl1_12b {
 	CTRL1_Xen	= 0x01,
 	CTRL1_Yen	= 0x02,
 	CTRL1_Zen	= 0x04,
@@ -104,6 +108,16 @@ enum lis3lv02d_ctrl1 {
 	CTRL1_PD0	= 0x40,
 	CTRL1_PD1	= 0x80,
 };
+
+/* Delta to ctrl1_12b version */
+enum lis3lv02d_ctrl1_8b {
+	CTRL1_STM	= 0x08,
+	CTRL1_STP	= 0x10,
+	CTRL1_FS	= 0x20,
+	CTRL1_PD	= 0x40,
+	CTRL1_DR	= 0x80,
+};
+
 enum lis3lv02d_ctrl2 {
 	CTRL2_DAS	= 0x01,
 	CTRL2_SIM	= 0x02,
@@ -194,16 +208,20 @@ struct lis3lv02d {
 	int (*write) (struct lis3lv02d *lis3, int reg, u8 val);
 	int (*read) (struct lis3lv02d *lis3, int reg, u8 *ret);
 
-	u8			whoami;    /* 3Ah: 2-byte registries, 3Bh: 1-byte registries */
+	int                     *odrs;     /* Supported output data rates */
+	u8                      odr_mask;  /* ODR bit mask */
+	u8			whoami;    /* indicates measurement precision */
 	s16 (*read_data) (struct lis3lv02d *lis3, int reg);
 	int			mdps_max_val;
+	int			pwron_delay;
+	int                     scale; /*
+					* relationship between 1 LBS and mG
+					* (1/1000th of earth gravity)
+					*/
 
 	struct input_polled_dev	*idev;     /* input device */
 	struct platform_device	*pdev;     /* platform device */
 	atomic_t		count;     /* interrupt count after last read */
-	int			xcalib;    /* calibrated null value for x */
-	int			ycalib;    /* calibrated null value for y */
-	int			zcalib;    /* calibrated null value for z */
 	struct axis_conversion	ac;        /* hw -> logical axis */
 
 	u32			irq;       /* IRQ number */
@@ -212,6 +230,7 @@ struct lis3lv02d {
 	unsigned long		misc_opened; /* bit0: whether the device is open */
 
 	struct lis3lv02d_platform_data *pdata;	/* for passing board config */
+	struct mutex		mutex;     /* Serialize poll and selftest */
 };
 
 int lis3lv02d_init_device(struct lis3lv02d *lis3);
diff --git a/drivers/hwmon/lis3lv02d_i2c.c b/drivers/hwmon/lis3lv02d_i2c.c
new file mode 100644
index 000000000000..dc1f5402c1d7
--- /dev/null
+++ b/drivers/hwmon/lis3lv02d_i2c.c
@@ -0,0 +1,183 @@
+/*
+ * drivers/hwmon/lis3lv02d_i2c.c
+ *
+ * Implements I2C interface for lis3lv02d (STMicroelectronics) accelerometer.
+ * Driver is based on corresponding SPI driver written by Daniel Mack
+ * (lis3lv02d_spi.c (C) 2009 Daniel Mack <daniel@caiaq.de> ).
+ *
+ * Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies).
+ *
+ * Contact: Samu Onkalo <samu.p.onkalo@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ */
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/err.h>
+#include <linux/i2c.h>
+#include "lis3lv02d.h"
+
+#define DRV_NAME 	"lis3lv02d_i2c"
+
+static inline s32 lis3_i2c_write(struct lis3lv02d *lis3, int reg, u8 value)
+{
+	struct i2c_client *c = lis3->bus_priv;
+	return i2c_smbus_write_byte_data(c, reg, value);
+}
+
+static inline s32 lis3_i2c_read(struct lis3lv02d *lis3, int reg, u8 *v)
+{
+	struct i2c_client *c = lis3->bus_priv;
+	*v = i2c_smbus_read_byte_data(c, reg);
+	return 0;
+}
+
+static int lis3_i2c_init(struct lis3lv02d *lis3)
+{
+	u8 reg;
+	int ret;
+
+	/* power up the device */
+	ret = lis3->read(lis3, CTRL_REG1, &reg);
+	if (ret < 0)
+		return ret;
+
+	reg |= CTRL1_PD0;
+	return lis3->write(lis3, CTRL_REG1, reg);
+}
+
+/* Default axis mapping but it can be overwritten by platform data */
+static struct axis_conversion lis3lv02d_axis_map = { LIS3_DEV_X,
+						     LIS3_DEV_Y,
+						     LIS3_DEV_Z };
+
+static int __devinit lis3lv02d_i2c_probe(struct i2c_client *client,
+					const struct i2c_device_id *id)
+{
+	int ret = 0;
+	struct lis3lv02d_platform_data *pdata = client->dev.platform_data;
+
+	if (pdata) {
+		if (pdata->axis_x)
+			lis3lv02d_axis_map.x = pdata->axis_x;
+
+		if (pdata->axis_y)
+			lis3lv02d_axis_map.y = pdata->axis_y;
+
+		if (pdata->axis_z)
+			lis3lv02d_axis_map.z = pdata->axis_z;
+
+		if (pdata->setup_resources)
+			ret = pdata->setup_resources();
+
+		if (ret)
+			goto fail;
+	}
+
+	lis3_dev.pdata	  = pdata;
+	lis3_dev.bus_priv = client;
+	lis3_dev.init	  = lis3_i2c_init;
+	lis3_dev.read	  = lis3_i2c_read;
+	lis3_dev.write	  = lis3_i2c_write;
+	lis3_dev.irq	  = client->irq;
+	lis3_dev.ac	  = lis3lv02d_axis_map;
+
+	i2c_set_clientdata(client, &lis3_dev);
+	ret = lis3lv02d_init_device(&lis3_dev);
+fail:
+	return ret;
+}
+
+static int __devexit lis3lv02d_i2c_remove(struct i2c_client *client)
+{
+	struct lis3lv02d *lis3 = i2c_get_clientdata(client);
+	struct lis3lv02d_platform_data *pdata = client->dev.platform_data;
+
+	if (pdata && pdata->release_resources)
+		pdata->release_resources();
+
+	lis3lv02d_joystick_disable();
+	lis3lv02d_poweroff(lis3);
+
+	return lis3lv02d_remove_fs(&lis3_dev);
+}
+
+#ifdef CONFIG_PM
+static int lis3lv02d_i2c_suspend(struct i2c_client *client, pm_message_t mesg)
+{
+	struct lis3lv02d *lis3 = i2c_get_clientdata(client);
+
+	if (!lis3->pdata->wakeup_flags)
+		lis3lv02d_poweroff(lis3);
+	return 0;
+}
+
+static int lis3lv02d_i2c_resume(struct i2c_client *client)
+{
+	struct lis3lv02d *lis3 = i2c_get_clientdata(client);
+
+	if (!lis3->pdata->wakeup_flags)
+		lis3lv02d_poweron(lis3);
+	return 0;
+}
+
+static void lis3lv02d_i2c_shutdown(struct i2c_client *client)
+{
+	lis3lv02d_i2c_suspend(client, PMSG_SUSPEND);
+}
+#else
+#define lis3lv02d_i2c_suspend	NULL
+#define lis3lv02d_i2c_resume	NULL
+#define lis3lv02d_i2c_shutdown	NULL
+#endif
+
+static const struct i2c_device_id lis3lv02d_id[] = {
+	{"lis3lv02d", 0 },
+	{}
+};
+
+MODULE_DEVICE_TABLE(i2c, lis3lv02d_id);
+
+static struct i2c_driver lis3lv02d_i2c_driver = {
+	.driver	 = {
+		.name   = DRV_NAME,
+		.owner  = THIS_MODULE,
+	},
+	.suspend = lis3lv02d_i2c_suspend,
+	.shutdown = lis3lv02d_i2c_shutdown,
+	.resume = lis3lv02d_i2c_resume,
+	.probe	= lis3lv02d_i2c_probe,
+	.remove	= __devexit_p(lis3lv02d_i2c_remove),
+	.id_table = lis3lv02d_id,
+};
+
+static int __init lis3lv02d_init(void)
+{
+	return i2c_add_driver(&lis3lv02d_i2c_driver);
+}
+
+static void __exit lis3lv02d_exit(void)
+{
+	i2c_del_driver(&lis3lv02d_i2c_driver);
+}
+
+MODULE_AUTHOR("Nokia Corporation");
+MODULE_DESCRIPTION("lis3lv02d I2C interface");
+MODULE_LICENSE("GPL");
+
+module_init(lis3lv02d_init);
+module_exit(lis3lv02d_exit);
diff --git a/drivers/hwmon/lm63.c b/drivers/hwmon/lm63.c
index 3195a265f0e9..bf81aff7051d 100644
--- a/drivers/hwmon/lm63.c
+++ b/drivers/hwmon/lm63.c
@@ -56,12 +56,6 @@
 static const unsigned short normal_i2c[] = { 0x4c, I2C_CLIENT_END };
 
 /*
- * Insmod parameters
- */
-
-I2C_CLIENT_INSMOD_1(lm63);
-
-/*
  * The LM63 registers
  */
 
@@ -134,8 +128,7 @@ static int lm63_remove(struct i2c_client *client);
 
 static struct lm63_data *lm63_update_device(struct device *dev);
 
-static int lm63_detect(struct i2c_client *client, int kind,
-		       struct i2c_board_info *info);
+static int lm63_detect(struct i2c_client *client, struct i2c_board_info *info);
 static void lm63_init_client(struct i2c_client *client);
 
 /*
@@ -143,7 +136,7 @@ static void lm63_init_client(struct i2c_client *client);
  */
 
 static const struct i2c_device_id lm63_id[] = {
-	{ "lm63", lm63 },
+	{ "lm63", 0 },
 	{ }
 };
 MODULE_DEVICE_TABLE(i2c, lm63_id);
@@ -157,7 +150,7 @@ static struct i2c_driver lm63_driver = {
 	.remove		= lm63_remove,
 	.id_table	= lm63_id,
 	.detect		= lm63_detect,
-	.address_data	= &addr_data,
+	.address_list	= normal_i2c,
 };
 
 /*
@@ -423,44 +416,38 @@ static const struct attribute_group lm63_group_fan1 = {
  */
 
 /* Return 0 if detection is successful, -ENODEV otherwise */
-static int lm63_detect(struct i2c_client *new_client, int kind,
+static int lm63_detect(struct i2c_client *new_client,
 		       struct i2c_board_info *info)
 {
 	struct i2c_adapter *adapter = new_client->adapter;
+	u8 man_id, chip_id, reg_config1, reg_config2;
+	u8 reg_alert_status, reg_alert_mask;
 
 	if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA))
 		return -ENODEV;
 
-	if (kind < 0) { /* must identify */
-		u8 man_id, chip_id, reg_config1, reg_config2;
-		u8 reg_alert_status, reg_alert_mask;
-
-		man_id = i2c_smbus_read_byte_data(new_client,
-			 LM63_REG_MAN_ID);
-		chip_id = i2c_smbus_read_byte_data(new_client,
-			  LM63_REG_CHIP_ID);
-		reg_config1 = i2c_smbus_read_byte_data(new_client,
-			      LM63_REG_CONFIG1);
-		reg_config2 = i2c_smbus_read_byte_data(new_client,
-			      LM63_REG_CONFIG2);
-		reg_alert_status = i2c_smbus_read_byte_data(new_client,
-				   LM63_REG_ALERT_STATUS);
-		reg_alert_mask = i2c_smbus_read_byte_data(new_client,
-				 LM63_REG_ALERT_MASK);
-
-		if (man_id == 0x01 /* National Semiconductor */
-		 && chip_id == 0x41 /* LM63 */
-		 && (reg_config1 & 0x18) == 0x00
-		 && (reg_config2 & 0xF8) == 0x00
-		 && (reg_alert_status & 0x20) == 0x00
-		 && (reg_alert_mask & 0xA4) == 0xA4) {
-			kind = lm63;
-		} else { /* failed */
-			dev_dbg(&adapter->dev, "Unsupported chip "
-				"(man_id=0x%02X, chip_id=0x%02X).\n",
-				man_id, chip_id);
-			return -ENODEV;
-		}
+	man_id = i2c_smbus_read_byte_data(new_client, LM63_REG_MAN_ID);
+	chip_id = i2c_smbus_read_byte_data(new_client, LM63_REG_CHIP_ID);
+
+	reg_config1 = i2c_smbus_read_byte_data(new_client,
+		      LM63_REG_CONFIG1);
+	reg_config2 = i2c_smbus_read_byte_data(new_client,
+		      LM63_REG_CONFIG2);
+	reg_alert_status = i2c_smbus_read_byte_data(new_client,
+			   LM63_REG_ALERT_STATUS);
+	reg_alert_mask = i2c_smbus_read_byte_data(new_client,
+			 LM63_REG_ALERT_MASK);
+
+	if (man_id != 0x01 /* National Semiconductor */
+	 || chip_id != 0x41 /* LM63 */
+	 || (reg_config1 & 0x18) != 0x00
+	 || (reg_config2 & 0xF8) != 0x00
+	 || (reg_alert_status & 0x20) != 0x00
+	 || (reg_alert_mask & 0xA4) != 0xA4) {
+		dev_dbg(&adapter->dev,
+			"Unsupported chip (man_id=0x%02X, chip_id=0x%02X)\n",
+			man_id, chip_id);
+		return -ENODEV;
 	}
 
 	strlcpy(info->type, "lm63", I2C_NAME_SIZE);
diff --git a/drivers/hwmon/lm73.c b/drivers/hwmon/lm73.c
new file mode 100644
index 000000000000..c5f39ba103c0
--- /dev/null
+++ b/drivers/hwmon/lm73.c
@@ -0,0 +1,202 @@
+/*
+ * LM73 Sensor driver
+ * Based on LM75
+ *
+ * Copyright (C) 2007, CenoSYS (www.cenosys.com).
+ * Copyright (C) 2009, Bollore telecom (www.bolloretelecom.eu).
+ *
+ * Guillaume Ligneul <guillaume.ligneul@gmail.com>
+ * Adrien Demarez <adrien.demarez@bolloretelecom.eu>
+ * Jeremy Laine <jeremy.laine@bolloretelecom.eu>
+ *
+ * This software program is licensed subject to the GNU General Public License
+ * (GPL).Version 2,June 1991, available at
+ * http://www.gnu.org/licenses/old-licenses/gpl-2.0.html
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/i2c.h>
+#include <linux/hwmon.h>
+#include <linux/hwmon-sysfs.h>
+#include <linux/err.h>
+
+
+/* Addresses scanned */
+static const unsigned short normal_i2c[] = { 0x48, 0x49, 0x4a, 0x4c,
+					0x4d, 0x4e, I2C_CLIENT_END };
+
+/* LM73 registers */
+#define LM73_REG_INPUT		0x00
+#define LM73_REG_CONF		0x01
+#define LM73_REG_MAX		0x02
+#define LM73_REG_MIN		0x03
+#define LM73_REG_CTRL		0x04
+#define LM73_REG_ID		0x07
+
+#define LM73_ID			0x9001 /* or 0x190 after a swab16() */
+#define DRVNAME			"lm73"
+#define LM73_TEMP_MIN		(-40)
+#define LM73_TEMP_MAX		150
+
+/*-----------------------------------------------------------------------*/
+
+
+static ssize_t set_temp(struct device *dev, struct device_attribute *da,
+			const char *buf, size_t count)
+{
+	struct sensor_device_attribute *attr = to_sensor_dev_attr(da);
+	struct i2c_client *client = to_i2c_client(dev);
+	long temp;
+	short value;
+
+	int status = strict_strtol(buf, 10, &temp);
+	if (status < 0)
+		return status;
+
+	/* Write value */
+	value = (short) SENSORS_LIMIT(temp/250, (LM73_TEMP_MIN*4),
+		(LM73_TEMP_MAX*4)) << 5;
+	i2c_smbus_write_word_data(client, attr->index, swab16(value));
+	return count;
+}
+
+static ssize_t show_temp(struct device *dev, struct device_attribute *da,
+			 char *buf)
+{
+	struct sensor_device_attribute *attr = to_sensor_dev_attr(da);
+	struct i2c_client *client = to_i2c_client(dev);
+	/* use integer division instead of equivalent right shift to
+	   guarantee arithmetic shift and preserve the sign */
+	int temp = ((s16) (swab16(i2c_smbus_read_word_data(client,
+		attr->index)))*250) / 32;
+	return sprintf(buf, "%d\n", temp);
+}
+
+
+/*-----------------------------------------------------------------------*/
+
+/* sysfs attributes for hwmon */
+
+static SENSOR_DEVICE_ATTR(temp1_max, S_IWUSR | S_IRUGO,
+			show_temp, set_temp, LM73_REG_MAX);
+static SENSOR_DEVICE_ATTR(temp1_min, S_IWUSR | S_IRUGO,
+			show_temp, set_temp, LM73_REG_MIN);
+static SENSOR_DEVICE_ATTR(temp1_input, S_IRUGO,
+			show_temp, NULL, LM73_REG_INPUT);
+
+
+static struct attribute *lm73_attributes[] = {
+	&sensor_dev_attr_temp1_input.dev_attr.attr,
+	&sensor_dev_attr_temp1_max.dev_attr.attr,
+	&sensor_dev_attr_temp1_min.dev_attr.attr,
+
+	NULL
+};
+
+static const struct attribute_group lm73_group = {
+	.attrs = lm73_attributes,
+};
+
+/*-----------------------------------------------------------------------*/
+
+/* device probe and removal */
+
+static int
+lm73_probe(struct i2c_client *client, const struct i2c_device_id *id)
+{
+	struct device *hwmon_dev;
+	int status;
+
+	/* Register sysfs hooks */
+	status = sysfs_create_group(&client->dev.kobj, &lm73_group);
+	if (status)
+		return status;
+
+	hwmon_dev = hwmon_device_register(&client->dev);
+	if (IS_ERR(hwmon_dev)) {
+		status = PTR_ERR(hwmon_dev);
+		goto exit_remove;
+	}
+	i2c_set_clientdata(client, hwmon_dev);
+
+	dev_info(&client->dev, "%s: sensor '%s'\n",
+		 dev_name(hwmon_dev), client->name);
+
+	return 0;
+
+exit_remove:
+	sysfs_remove_group(&client->dev.kobj, &lm73_group);
+	return status;
+}
+
+static int lm73_remove(struct i2c_client *client)
+{
+	struct device *hwmon_dev = i2c_get_clientdata(client);
+
+	hwmon_device_unregister(hwmon_dev);
+	sysfs_remove_group(&client->dev.kobj, &lm73_group);
+	i2c_set_clientdata(client, NULL);
+	return 0;
+}
+
+static const struct i2c_device_id lm73_ids[] = {
+	{ "lm73", 0 },
+	{ /* LIST END */ }
+};
+MODULE_DEVICE_TABLE(i2c, lm73_ids);
+
+/* Return 0 if detection is successful, -ENODEV otherwise */
+static int lm73_detect(struct i2c_client *new_client,
+			struct i2c_board_info *info)
+{
+	struct i2c_adapter *adapter = new_client->adapter;
+	u16 id;
+	u8 ctrl;
+
+	if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA |
+					I2C_FUNC_SMBUS_WORD_DATA))
+		return -ENODEV;
+
+	/* Check device ID */
+	id = i2c_smbus_read_word_data(new_client, LM73_REG_ID);
+	ctrl = i2c_smbus_read_byte_data(new_client, LM73_REG_CTRL);
+	if ((id != LM73_ID) || (ctrl & 0x10))
+		return -ENODEV;
+
+	strlcpy(info->type, "lm73", I2C_NAME_SIZE);
+
+	return 0;
+}
+
+static struct i2c_driver lm73_driver = {
+	.class		= I2C_CLASS_HWMON,
+	.driver = {
+		.name	= "lm73",
+	},
+	.probe		= lm73_probe,
+	.remove		= lm73_remove,
+	.id_table	= lm73_ids,
+	.detect		= lm73_detect,
+	.address_list	= normal_i2c,
+};
+
+/* module glue */
+
+static int __init sensors_lm73_init(void)
+{
+	return i2c_add_driver(&lm73_driver);
+}
+
+static void __exit sensors_lm73_exit(void)
+{
+	i2c_del_driver(&lm73_driver);
+}
+
+MODULE_AUTHOR("Guillaume Ligneul <guillaume.ligneul@gmail.com>");
+MODULE_DESCRIPTION("LM73 driver");
+MODULE_LICENSE("GPL");
+
+module_init(sensors_lm73_init);
+module_exit(sensors_lm73_exit);
diff --git a/drivers/hwmon/lm75.c b/drivers/hwmon/lm75.c
index 55bd87c15c9a..8ae2cfe2d827 100644
--- a/drivers/hwmon/lm75.c
+++ b/drivers/hwmon/lm75.c
@@ -32,15 +32,12 @@
 
 /*
  * This driver handles the LM75 and compatible digital temperature sensors.
- * Only types which are _not_ listed in I2C_CLIENT_INSMOD_*() need to be
- * listed here.  We start at 9 since I2C_CLIENT_INSMOD_*() currently allow
- * definition of up to 8 chip types (plus zero).
  */
 
 enum lm75_type {		/* keep sorted in alphabetical order */
-	ds1775 = 9,
+	ds1775,
 	ds75,
-	/* lm75 -- in I2C_CLIENT_INSMOD_1() */
+	lm75,
 	lm75a,
 	max6625,
 	max6626,
@@ -58,9 +55,6 @@ enum lm75_type {		/* keep sorted in alphabetical order */
 static const unsigned short normal_i2c[] = { 0x48, 0x49, 0x4a, 0x4b, 0x4c,
 					0x4d, 0x4e, 0x4f, I2C_CLIENT_END };
 
-/* Insmod parameters */
-I2C_CLIENT_INSMOD_1(lm75);
-
 
 /* The LM75 registers */
 #define LM75_REG_CONF		0x01
@@ -234,11 +228,12 @@ static const struct i2c_device_id lm75_ids[] = {
 MODULE_DEVICE_TABLE(i2c, lm75_ids);
 
 /* Return 0 if detection is successful, -ENODEV otherwise */
-static int lm75_detect(struct i2c_client *new_client, int kind,
+static int lm75_detect(struct i2c_client *new_client,
 		       struct i2c_board_info *info)
 {
 	struct i2c_adapter *adapter = new_client->adapter;
 	int i;
+	int cur, conf, hyst, os;
 
 	if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA |
 				     I2C_FUNC_SMBUS_WORD_DATA))
@@ -251,40 +246,35 @@ static int lm75_detect(struct i2c_client *new_client, int kind,
 	   The cycling+unused addresses combination is not tested,
 	   since it would significantly slow the detection down and would
 	   hardly add any value. */
-	if (kind < 0) {
-		int cur, conf, hyst, os;
-
-		/* Unused addresses */
-		cur = i2c_smbus_read_word_data(new_client, 0);
-		conf = i2c_smbus_read_byte_data(new_client, 1);
-		hyst = i2c_smbus_read_word_data(new_client, 2);
-		if (i2c_smbus_read_word_data(new_client, 4) != hyst
-		 || i2c_smbus_read_word_data(new_client, 5) != hyst
-		 || i2c_smbus_read_word_data(new_client, 6) != hyst
-		 || i2c_smbus_read_word_data(new_client, 7) != hyst)
-			return -ENODEV;
-		os = i2c_smbus_read_word_data(new_client, 3);
-		if (i2c_smbus_read_word_data(new_client, 4) != os
-		 || i2c_smbus_read_word_data(new_client, 5) != os
-		 || i2c_smbus_read_word_data(new_client, 6) != os
-		 || i2c_smbus_read_word_data(new_client, 7) != os)
-			return -ENODEV;
 
-		/* Unused bits */
-		if (conf & 0xe0)
-			return -ENODEV;
+	/* Unused addresses */
+	cur = i2c_smbus_read_word_data(new_client, 0);
+	conf = i2c_smbus_read_byte_data(new_client, 1);
+	hyst = i2c_smbus_read_word_data(new_client, 2);
+	if (i2c_smbus_read_word_data(new_client, 4) != hyst
+	 || i2c_smbus_read_word_data(new_client, 5) != hyst
+	 || i2c_smbus_read_word_data(new_client, 6) != hyst
+	 || i2c_smbus_read_word_data(new_client, 7) != hyst)
+		return -ENODEV;
+	os = i2c_smbus_read_word_data(new_client, 3);
+	if (i2c_smbus_read_word_data(new_client, 4) != os
+	 || i2c_smbus_read_word_data(new_client, 5) != os
+	 || i2c_smbus_read_word_data(new_client, 6) != os
+	 || i2c_smbus_read_word_data(new_client, 7) != os)
+		return -ENODEV;
+
+	/* Unused bits */
+	if (conf & 0xe0)
+		return -ENODEV;
 
-		/* Addresses cycling */
-		for (i = 8; i < 0xff; i += 8)
-			if (i2c_smbus_read_byte_data(new_client, i + 1) != conf
-			 || i2c_smbus_read_word_data(new_client, i + 2) != hyst
-			 || i2c_smbus_read_word_data(new_client, i + 3) != os)
-				return -ENODEV;
+	/* Addresses cycling */
+	for (i = 8; i < 0xff; i += 8) {
+		if (i2c_smbus_read_byte_data(new_client, i + 1) != conf
+		 || i2c_smbus_read_word_data(new_client, i + 2) != hyst
+		 || i2c_smbus_read_word_data(new_client, i + 3) != os)
+			return -ENODEV;
 	}
 
-	/* NOTE: we treat "force=..." and "force_lm75=..." the same.
-	 * Only new-style driver binding distinguishes chip types.
-	 */
 	strlcpy(info->type, "lm75", I2C_NAME_SIZE);
 
 	return 0;
@@ -299,7 +289,7 @@ static struct i2c_driver lm75_driver = {
 	.remove		= lm75_remove,
 	.id_table	= lm75_ids,
 	.detect		= lm75_detect,
-	.address_data	= &addr_data,
+	.address_list	= normal_i2c,
 };
 
 /*-----------------------------------------------------------------------*/
diff --git a/drivers/hwmon/lm77.c b/drivers/hwmon/lm77.c
index 866b401ab6e8..b28a297be50c 100644
--- a/drivers/hwmon/lm77.c
+++ b/drivers/hwmon/lm77.c
@@ -39,9 +39,6 @@
 static const unsigned short normal_i2c[] = { 0x48, 0x49, 0x4a, 0x4b,
 						I2C_CLIENT_END };
 
-/* Insmod parameters */
-I2C_CLIENT_INSMOD_1(lm77);
-
 /* The LM77 registers */
 #define LM77_REG_TEMP		0x00
 #define LM77_REG_CONF		0x01
@@ -66,8 +63,7 @@ struct lm77_data {
 
 static int lm77_probe(struct i2c_client *client,
 		      const struct i2c_device_id *id);
-static int lm77_detect(struct i2c_client *client, int kind,
-		       struct i2c_board_info *info);
+static int lm77_detect(struct i2c_client *client, struct i2c_board_info *info);
 static void lm77_init_client(struct i2c_client *client);
 static int lm77_remove(struct i2c_client *client);
 static u16 lm77_read_value(struct i2c_client *client, u8 reg);
@@ -77,7 +73,7 @@ static struct lm77_data *lm77_update_device(struct device *dev);
 
 
 static const struct i2c_device_id lm77_id[] = {
-	{ "lm77", lm77 },
+	{ "lm77", 0 },
 	{ }
 };
 MODULE_DEVICE_TABLE(i2c, lm77_id);
@@ -92,7 +88,7 @@ static struct i2c_driver lm77_driver = {
 	.remove		= lm77_remove,
 	.id_table	= lm77_id,
 	.detect		= lm77_detect,
-	.address_data	= &addr_data,
+	.address_list	= normal_i2c,
 };
 
 /* straight from the datasheet */
@@ -245,10 +241,11 @@ static const struct attribute_group lm77_group = {
 };
 
 /* Return 0 if detection is successful, -ENODEV otherwise */
-static int lm77_detect(struct i2c_client *new_client, int kind,
+static int lm77_detect(struct i2c_client *new_client,
 		       struct i2c_board_info *info)
 {
 	struct i2c_adapter *adapter = new_client->adapter;
+	int i, cur, conf, hyst, crit, min, max;
 
 	if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA |
 				     I2C_FUNC_SMBUS_WORD_DATA))
@@ -265,51 +262,48 @@ static int lm77_detect(struct i2c_client *new_client, int kind,
 	   4. registers cycling over 8-address boundaries
 
 	   Word-sized registers are high-byte first. */
-	if (kind < 0) {
-		int i, cur, conf, hyst, crit, min, max;
-
-		/* addresses cycling */
-		cur = i2c_smbus_read_word_data(new_client, 0);
-		conf = i2c_smbus_read_byte_data(new_client, 1);
-		hyst = i2c_smbus_read_word_data(new_client, 2);
-		crit = i2c_smbus_read_word_data(new_client, 3);
-		min = i2c_smbus_read_word_data(new_client, 4);
-		max = i2c_smbus_read_word_data(new_client, 5);
-		for (i = 8; i <= 0xff; i += 8)
-			if (i2c_smbus_read_byte_data(new_client, i + 1) != conf
-			    || i2c_smbus_read_word_data(new_client, i + 2) != hyst
-			    || i2c_smbus_read_word_data(new_client, i + 3) != crit
-			    || i2c_smbus_read_word_data(new_client, i + 4) != min
-			    || i2c_smbus_read_word_data(new_client, i + 5) != max)
-				return -ENODEV;
-
-		/* sign bits */
-		if (((cur & 0x00f0) != 0xf0 && (cur & 0x00f0) != 0x0)
-		    || ((hyst & 0x00f0) != 0xf0 && (hyst & 0x00f0) != 0x0)
-		    || ((crit & 0x00f0) != 0xf0 && (crit & 0x00f0) != 0x0)
-		    || ((min & 0x00f0) != 0xf0 && (min & 0x00f0) != 0x0)
-		    || ((max & 0x00f0) != 0xf0 && (max & 0x00f0) != 0x0))
-			return -ENODEV;
 
-		/* unused bits */
-		if (conf & 0xe0)
+	/* addresses cycling */
+	cur = i2c_smbus_read_word_data(new_client, 0);
+	conf = i2c_smbus_read_byte_data(new_client, 1);
+	hyst = i2c_smbus_read_word_data(new_client, 2);
+	crit = i2c_smbus_read_word_data(new_client, 3);
+	min = i2c_smbus_read_word_data(new_client, 4);
+	max = i2c_smbus_read_word_data(new_client, 5);
+	for (i = 8; i <= 0xff; i += 8) {
+		if (i2c_smbus_read_byte_data(new_client, i + 1) != conf
+		 || i2c_smbus_read_word_data(new_client, i + 2) != hyst
+		 || i2c_smbus_read_word_data(new_client, i + 3) != crit
+		 || i2c_smbus_read_word_data(new_client, i + 4) != min
+		 || i2c_smbus_read_word_data(new_client, i + 5) != max)
 			return -ENODEV;
+	}
 
-		/* 0x06 and 0x07 return the last read value */
-		cur = i2c_smbus_read_word_data(new_client, 0);
-		if (i2c_smbus_read_word_data(new_client, 6) != cur
-		    || i2c_smbus_read_word_data(new_client, 7) != cur)
-			return -ENODEV;
-		hyst = i2c_smbus_read_word_data(new_client, 2);
-		if (i2c_smbus_read_word_data(new_client, 6) != hyst
-		    || i2c_smbus_read_word_data(new_client, 7) != hyst)
-			return -ENODEV;
-		min = i2c_smbus_read_word_data(new_client, 4);
-		if (i2c_smbus_read_word_data(new_client, 6) != min
-		    || i2c_smbus_read_word_data(new_client, 7) != min)
-			return -ENODEV;
+	/* sign bits */
+	if (((cur & 0x00f0) != 0xf0 && (cur & 0x00f0) != 0x0)
+	 || ((hyst & 0x00f0) != 0xf0 && (hyst & 0x00f0) != 0x0)
+	 || ((crit & 0x00f0) != 0xf0 && (crit & 0x00f0) != 0x0)
+	 || ((min & 0x00f0) != 0xf0 && (min & 0x00f0) != 0x0)
+	 || ((max & 0x00f0) != 0xf0 && (max & 0x00f0) != 0x0))
+		return -ENODEV;
 
-	}
+	/* unused bits */
+	if (conf & 0xe0)
+		return -ENODEV;
+
+	/* 0x06 and 0x07 return the last read value */
+	cur = i2c_smbus_read_word_data(new_client, 0);
+	if (i2c_smbus_read_word_data(new_client, 6) != cur
+	 || i2c_smbus_read_word_data(new_client, 7) != cur)
+		return -ENODEV;
+	hyst = i2c_smbus_read_word_data(new_client, 2);
+	if (i2c_smbus_read_word_data(new_client, 6) != hyst
+	 || i2c_smbus_read_word_data(new_client, 7) != hyst)
+		return -ENODEV;
+	min = i2c_smbus_read_word_data(new_client, 4);
+	if (i2c_smbus_read_word_data(new_client, 6) != min
+	 || i2c_smbus_read_word_data(new_client, 7) != min)
+		return -ENODEV;
 
 	strlcpy(info->type, "lm77", I2C_NAME_SIZE);
 
diff --git a/drivers/hwmon/lm78.c b/drivers/hwmon/lm78.c
index f7e70163e016..cadcbd90ff3b 100644
--- a/drivers/hwmon/lm78.c
+++ b/drivers/hwmon/lm78.c
@@ -41,8 +41,7 @@ static const unsigned short normal_i2c[] = { 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d,
 						0x2e, 0x2f, I2C_CLIENT_END };
 static unsigned short isa_address = 0x290;
 
-/* Insmod parameters */
-I2C_CLIENT_INSMOD_2(lm78, lm79);
+enum chips { lm78, lm79 };
 
 /* Many LM78 constants specified below */
 
@@ -142,7 +141,7 @@ struct lm78_data {
 };
 
 
-static int lm78_i2c_detect(struct i2c_client *client, int kind,
+static int lm78_i2c_detect(struct i2c_client *client,
 			   struct i2c_board_info *info);
 static int lm78_i2c_probe(struct i2c_client *client,
 			  const struct i2c_device_id *id);
@@ -173,7 +172,7 @@ static struct i2c_driver lm78_driver = {
 	.remove		= lm78_i2c_remove,
 	.id_table	= lm78_i2c_id,
 	.detect		= lm78_i2c_detect,
-	.address_data	= &addr_data,
+	.address_list	= normal_i2c,
 };
 
 static struct platform_driver lm78_isa_driver = {
@@ -558,7 +557,7 @@ static int lm78_alias_detect(struct i2c_client *client, u8 chipid)
 	return 1;
 }
 
-static int lm78_i2c_detect(struct i2c_client *client, int kind,
+static int lm78_i2c_detect(struct i2c_client *client,
 			   struct i2c_board_info *info)
 {
 	int i;
@@ -576,52 +575,34 @@ static int lm78_i2c_detect(struct i2c_client *client, int kind,
 	if (isa)
 		mutex_lock(&isa->update_lock);
 
-	if (kind < 0) {
-		if ((i2c_smbus_read_byte_data(client, LM78_REG_CONFIG) & 0x80)
-		 || i2c_smbus_read_byte_data(client, LM78_REG_I2C_ADDR)
-		    != address)
-			goto err_nodev;
+	if ((i2c_smbus_read_byte_data(client, LM78_REG_CONFIG) & 0x80)
+	 || i2c_smbus_read_byte_data(client, LM78_REG_I2C_ADDR) != address)
+		goto err_nodev;
 
-		/* Explicitly prevent the misdetection of Winbond chips */
-		i = i2c_smbus_read_byte_data(client, 0x4f);
-		if (i == 0xa3 || i == 0x5c)
-			goto err_nodev;
-	}
+	/* Explicitly prevent the misdetection of Winbond chips */
+	i = i2c_smbus_read_byte_data(client, 0x4f);
+	if (i == 0xa3 || i == 0x5c)
+		goto err_nodev;
 
 	/* Determine the chip type. */
-	if (kind <= 0) {
-		i = i2c_smbus_read_byte_data(client, LM78_REG_CHIPID);
-		if (i == 0x00 || i == 0x20	/* LM78 */
-		 || i == 0x40)			/* LM78-J */
-			kind = lm78;
-		else if ((i & 0xfe) == 0xc0)
-			kind = lm79;
-		else {
-			if (kind == 0)
-				dev_warn(&adapter->dev, "Ignoring 'force' "
-					"parameter for unknown chip at "
-					"adapter %d, address 0x%02x\n",
-					i2c_adapter_id(adapter), address);
-			goto err_nodev;
-		}
+	i = i2c_smbus_read_byte_data(client, LM78_REG_CHIPID);
+	if (i == 0x00 || i == 0x20	/* LM78 */
+	 || i == 0x40)			/* LM78-J */
+		client_name = "lm78";
+	else if ((i & 0xfe) == 0xc0)
+		client_name = "lm79";
+	else
+		goto err_nodev;
 
-		if (lm78_alias_detect(client, i)) {
-			dev_dbg(&adapter->dev, "Device at 0x%02x appears to "
-				"be the same as ISA device\n", address);
-			goto err_nodev;
-		}
+	if (lm78_alias_detect(client, i)) {
+		dev_dbg(&adapter->dev, "Device at 0x%02x appears to "
+			"be the same as ISA device\n", address);
+		goto err_nodev;
 	}
 
 	if (isa)
 		mutex_unlock(&isa->update_lock);
 
-	switch (kind) {
-	case lm79:
-		client_name = "lm79";
-		break;
-	default:
-		client_name = "lm78";
-	}
 	strlcpy(info->type, client_name, I2C_NAME_SIZE);
 
 	return 0;
diff --git a/drivers/hwmon/lm80.c b/drivers/hwmon/lm80.c
index bcffc1899403..18a0e6c5fe88 100644
--- a/drivers/hwmon/lm80.c
+++ b/drivers/hwmon/lm80.c
@@ -35,9 +35,6 @@
 static const unsigned short normal_i2c[] = { 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d,
 						0x2e, 0x2f, I2C_CLIENT_END };
 
-/* Insmod parameters */
-I2C_CLIENT_INSMOD_1(lm80);
-
 /* Many LM80 constants specified below */
 
 /* The LM80 registers */
@@ -133,8 +130,7 @@ struct lm80_data {
 
 static int lm80_probe(struct i2c_client *client,
 		      const struct i2c_device_id *id);
-static int lm80_detect(struct i2c_client *client, int kind,
-		       struct i2c_board_info *info);
+static int lm80_detect(struct i2c_client *client, struct i2c_board_info *info);
 static void lm80_init_client(struct i2c_client *client);
 static int lm80_remove(struct i2c_client *client);
 static struct lm80_data *lm80_update_device(struct device *dev);
@@ -146,7 +142,7 @@ static int lm80_write_value(struct i2c_client *client, u8 reg, u8 value);
  */
 
 static const struct i2c_device_id lm80_id[] = {
-	{ "lm80", lm80 },
+	{ "lm80", 0 },
 	{ }
 };
 MODULE_DEVICE_TABLE(i2c, lm80_id);
@@ -160,7 +156,7 @@ static struct i2c_driver lm80_driver = {
 	.remove		= lm80_remove,
 	.id_table	= lm80_id,
 	.detect		= lm80_detect,
-	.address_data	= &addr_data,
+	.address_list	= normal_i2c,
 };
 
 /*
@@ -447,8 +443,7 @@ static const struct attribute_group lm80_group = {
 };
 
 /* Return 0 if detection is successful, -ENODEV otherwise */
-static int lm80_detect(struct i2c_client *client, int kind,
-		       struct i2c_board_info *info)
+static int lm80_detect(struct i2c_client *client, struct i2c_board_info *info)
 {
 	struct i2c_adapter *adapter = client->adapter;
 	int i, cur;
diff --git a/drivers/hwmon/lm83.c b/drivers/hwmon/lm83.c
index e59e2d1f080c..8290476aee4a 100644
--- a/drivers/hwmon/lm83.c
+++ b/drivers/hwmon/lm83.c
@@ -1,7 +1,7 @@
 /*
  * lm83.c - Part of lm_sensors, Linux kernel modules for hardware
  *          monitoring
- * Copyright (C) 2003-2008  Jean Delvare <khali@linux-fr.org>
+ * Copyright (C) 2003-2009  Jean Delvare <khali@linux-fr.org>
  *
  * Heavily inspired from the lm78, lm75 and adm1021 drivers. The LM83 is
  * a sensor chip made by National Semiconductor. It reports up to four
@@ -51,11 +51,7 @@
 static const unsigned short normal_i2c[] = {
 	0x18, 0x19, 0x1a, 0x29, 0x2a, 0x2b, 0x4c, 0x4d, 0x4e, I2C_CLIENT_END };
 
-/*
- * Insmod parameters
- */
-
-I2C_CLIENT_INSMOD_2(lm83, lm82);
+enum chips { lm83, lm82 };
 
 /*
  * The LM83 registers
@@ -118,7 +114,7 @@ static const u8 LM83_REG_W_HIGH[] = {
  * Functions declaration
  */
 
-static int lm83_detect(struct i2c_client *new_client, int kind,
+static int lm83_detect(struct i2c_client *new_client,
 		       struct i2c_board_info *info);
 static int lm83_probe(struct i2c_client *client,
 		      const struct i2c_device_id *id);
@@ -145,7 +141,7 @@ static struct i2c_driver lm83_driver = {
 	.remove		= lm83_remove,
 	.id_table	= lm83_id,
 	.detect		= lm83_detect,
-	.address_data	= &addr_data,
+	.address_list	= normal_i2c,
 };
 
 /*
@@ -291,73 +287,44 @@ static const struct attribute_group lm83_group_opt = {
  */
 
 /* Return 0 if detection is successful, -ENODEV otherwise */
-static int lm83_detect(struct i2c_client *new_client, int kind,
+static int lm83_detect(struct i2c_client *new_client,
 		       struct i2c_board_info *info)
 {
 	struct i2c_adapter *adapter = new_client->adapter;
-	const char *name = "";
+	const char *name;
+	u8 man_id, chip_id;
 
 	if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA))
 		return -ENODEV;
 
-	/* Now we do the detection and identification. A negative kind
-	 * means that the driver was loaded with no force parameter
-	 * (default), so we must both detect and identify the chip
-	 * (actually there is only one possible kind of chip for now, LM83).
-	 * A zero kind means that the driver was loaded with the force
-	 * parameter, the detection step shall be skipped. A positive kind
-	 * means that the driver was loaded with the force parameter and a
-	 * given kind of chip is requested, so both the detection and the
-	 * identification steps are skipped. */
-
-	/* Default to an LM83 if forced */
-	if (kind == 0)
-		kind = lm83;
-
-	if (kind < 0) { /* detection */
-		if (((i2c_smbus_read_byte_data(new_client, LM83_REG_R_STATUS1)
-		    & 0xA8) != 0x00) ||
-		    ((i2c_smbus_read_byte_data(new_client, LM83_REG_R_STATUS2)
-		    & 0x48) != 0x00) ||
-		    ((i2c_smbus_read_byte_data(new_client, LM83_REG_R_CONFIG)
-		    & 0x41) != 0x00)) {
-			dev_dbg(&adapter->dev,
-				"LM83 detection failed at 0x%02x.\n",
-				new_client->addr);
-			return -ENODEV;
-		}
+	/* Detection */
+	if ((i2c_smbus_read_byte_data(new_client, LM83_REG_R_STATUS1) & 0xA8) ||
+	    (i2c_smbus_read_byte_data(new_client, LM83_REG_R_STATUS2) & 0x48) ||
+	    (i2c_smbus_read_byte_data(new_client, LM83_REG_R_CONFIG) & 0x41)) {
+		dev_dbg(&adapter->dev, "LM83 detection failed at 0x%02x\n",
+			new_client->addr);
+		return -ENODEV;
 	}
 
-	if (kind <= 0) { /* identification */
-		u8 man_id, chip_id;
-
-		man_id = i2c_smbus_read_byte_data(new_client,
-		    LM83_REG_R_MAN_ID);
-		chip_id = i2c_smbus_read_byte_data(new_client,
-		    LM83_REG_R_CHIP_ID);
-
-		if (man_id == 0x01) { /* National Semiconductor */
-			if (chip_id == 0x03) {
-				kind = lm83;
-			} else
-			if (chip_id == 0x01) {
-				kind = lm82;
-			}
-		}
-
-		if (kind <= 0) { /* identification failed */
-			dev_info(&adapter->dev,
-			    "Unsupported chip (man_id=0x%02X, "
-			    "chip_id=0x%02X).\n", man_id, chip_id);
-			return -ENODEV;
-		}
-	}
+	/* Identification */
+	man_id = i2c_smbus_read_byte_data(new_client, LM83_REG_R_MAN_ID);
+	if (man_id != 0x01)	/* National Semiconductor */
+		return -ENODEV;
 
-	if (kind == lm83) {
+	chip_id = i2c_smbus_read_byte_data(new_client, LM83_REG_R_CHIP_ID);
+	switch (chip_id) {
+	case 0x03:
 		name = "lm83";
-	} else
-	if (kind == lm82) {
+		break;
+	case 0x01:
 		name = "lm82";
+		break;
+	default:
+		/* identification failed */
+		dev_info(&adapter->dev,
+			 "Unsupported chip (man_id=0x%02X, chip_id=0x%02X)\n",
+			 man_id, chip_id);
+		return -ENODEV;
 	}
 
 	strlcpy(info->type, name, I2C_NAME_SIZE);
diff --git a/drivers/hwmon/lm85.c b/drivers/hwmon/lm85.c
index 6c53d987de10..b3841a615595 100644
--- a/drivers/hwmon/lm85.c
+++ b/drivers/hwmon/lm85.c
@@ -5,7 +5,7 @@
     Copyright (c) 2002, 2003  Philip Pokorny <ppokorny@penguincomputing.com>
     Copyright (c) 2003        Margit Schubert-While <margitsw@t-online.de>
     Copyright (c) 2004        Justin Thiessen <jthiessen@penguincomputing.com>
-    Copyright (C) 2007, 2008  Jean Delvare <khali@linux-fr.org>
+    Copyright (C) 2007--2009  Jean Delvare <khali@linux-fr.org>
 
     Chip details at	      <http://www.national.com/ds/LM/LM85.pdf>
 
@@ -38,9 +38,11 @@
 /* Addresses to scan */
 static const unsigned short normal_i2c[] = { 0x2c, 0x2d, 0x2e, I2C_CLIENT_END };
 
-/* Insmod parameters */
-I2C_CLIENT_INSMOD_7(lm85b, lm85c, adm1027, adt7463, adt7468, emc6d100,
-		    emc6d102);
+enum chips {
+	any_chip, lm85b, lm85c,
+	adm1027, adt7463, adt7468,
+	emc6d100, emc6d102
+};
 
 /* The LM85 registers */
 
@@ -323,8 +325,7 @@ struct lm85_data {
 	struct lm85_zone zone[3];
 };
 
-static int lm85_detect(struct i2c_client *client, int kind,
-		       struct i2c_board_info *info);
+static int lm85_detect(struct i2c_client *client, struct i2c_board_info *info);
 static int lm85_probe(struct i2c_client *client,
 		      const struct i2c_device_id *id);
 static int lm85_remove(struct i2c_client *client);
@@ -357,7 +358,7 @@ static struct i2c_driver lm85_driver = {
 	.remove		= lm85_remove,
 	.id_table	= lm85_id,
 	.detect		= lm85_detect,
-	.address_data	= &addr_data,
+	.address_list	= normal_i2c,
 };
 
 
@@ -1156,113 +1157,85 @@ static int lm85_is_fake(struct i2c_client *client)
 }
 
 /* Return 0 if detection is successful, -ENODEV otherwise */
-static int lm85_detect(struct i2c_client *client, int kind,
-		       struct i2c_board_info *info)
+static int lm85_detect(struct i2c_client *client, struct i2c_board_info *info)
 {
 	struct i2c_adapter *adapter = client->adapter;
 	int address = client->addr;
 	const char *type_name;
+	int company, verstep;
 
 	if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA)) {
 		/* We need to be able to do byte I/O */
 		return -ENODEV;
 	}
 
-	/* If auto-detecting, determine the chip type */
-	if (kind < 0) {
-		int company = lm85_read_value(client, LM85_REG_COMPANY);
-		int verstep = lm85_read_value(client, LM85_REG_VERSTEP);
-
-		dev_dbg(&adapter->dev, "Detecting device at 0x%02x with "
-			"COMPANY: 0x%02x and VERSTEP: 0x%02x\n",
-			address, company, verstep);
-
-		/* All supported chips have the version in common */
-		if ((verstep & LM85_VERSTEP_VMASK) != LM85_VERSTEP_GENERIC &&
-		    (verstep & LM85_VERSTEP_VMASK) != LM85_VERSTEP_GENERIC2) {
-			dev_dbg(&adapter->dev, "Autodetection failed: "
-				"unsupported version\n");
-			return -ENODEV;
-		}
-		kind = any_chip;
-
-		/* Now, refine the detection */
-		if (company == LM85_COMPANY_NATIONAL) {
-			switch (verstep) {
-			case LM85_VERSTEP_LM85C:
-				kind = lm85c;
-				break;
-			case LM85_VERSTEP_LM85B:
-				kind = lm85b;
-				break;
-			case LM85_VERSTEP_LM96000_1:
-			case LM85_VERSTEP_LM96000_2:
-				/* Check for Winbond WPCD377I */
-				if (lm85_is_fake(client)) {
-					dev_dbg(&adapter->dev,
-						"Found Winbond WPCD377I, "
-						"ignoring\n");
-					return -ENODEV;
-				}
-				break;
-			}
-		} else if (company == LM85_COMPANY_ANALOG_DEV) {
-			switch (verstep) {
-			case LM85_VERSTEP_ADM1027:
-				kind = adm1027;
-				break;
-			case LM85_VERSTEP_ADT7463:
-			case LM85_VERSTEP_ADT7463C:
-				kind = adt7463;
-				break;
-			case LM85_VERSTEP_ADT7468_1:
-			case LM85_VERSTEP_ADT7468_2:
-				kind = adt7468;
-				break;
-			}
-		} else if (company == LM85_COMPANY_SMSC) {
-			switch (verstep) {
-			case LM85_VERSTEP_EMC6D100_A0:
-			case LM85_VERSTEP_EMC6D100_A1:
-				/* Note: we can't tell a '100 from a '101 */
-				kind = emc6d100;
-				break;
-			case LM85_VERSTEP_EMC6D102:
-				kind = emc6d102;
-				break;
+	/* Determine the chip type */
+	company = lm85_read_value(client, LM85_REG_COMPANY);
+	verstep = lm85_read_value(client, LM85_REG_VERSTEP);
+
+	dev_dbg(&adapter->dev, "Detecting device at 0x%02x with "
+		"COMPANY: 0x%02x and VERSTEP: 0x%02x\n",
+		address, company, verstep);
+
+	/* All supported chips have the version in common */
+	if ((verstep & LM85_VERSTEP_VMASK) != LM85_VERSTEP_GENERIC &&
+	    (verstep & LM85_VERSTEP_VMASK) != LM85_VERSTEP_GENERIC2) {
+		dev_dbg(&adapter->dev,
+			"Autodetection failed: unsupported version\n");
+		return -ENODEV;
+	}
+	type_name = "lm85";
+
+	/* Now, refine the detection */
+	if (company == LM85_COMPANY_NATIONAL) {
+		switch (verstep) {
+		case LM85_VERSTEP_LM85C:
+			type_name = "lm85c";
+			break;
+		case LM85_VERSTEP_LM85B:
+			type_name = "lm85b";
+			break;
+		case LM85_VERSTEP_LM96000_1:
+		case LM85_VERSTEP_LM96000_2:
+			/* Check for Winbond WPCD377I */
+			if (lm85_is_fake(client)) {
+				dev_dbg(&adapter->dev,
+					"Found Winbond WPCD377I, ignoring\n");
+				return -ENODEV;
 			}
-		} else {
-			dev_dbg(&adapter->dev, "Autodetection failed: "
-				"unknown vendor\n");
-			return -ENODEV;
+			break;
+		}
+	} else if (company == LM85_COMPANY_ANALOG_DEV) {
+		switch (verstep) {
+		case LM85_VERSTEP_ADM1027:
+			type_name = "adm1027";
+			break;
+		case LM85_VERSTEP_ADT7463:
+		case LM85_VERSTEP_ADT7463C:
+			type_name = "adt7463";
+			break;
+		case LM85_VERSTEP_ADT7468_1:
+		case LM85_VERSTEP_ADT7468_2:
+			type_name = "adt7468";
+			break;
+		}
+	} else if (company == LM85_COMPANY_SMSC) {
+		switch (verstep) {
+		case LM85_VERSTEP_EMC6D100_A0:
+		case LM85_VERSTEP_EMC6D100_A1:
+			/* Note: we can't tell a '100 from a '101 */
+			type_name = "emc6d100";
+			break;
+		case LM85_VERSTEP_EMC6D102:
+			type_name = "emc6d102";
+			break;
 		}
+	} else {
+		dev_dbg(&adapter->dev,
+			"Autodetection failed: unknown vendor\n");
+		return -ENODEV;
 	}
 
-	switch (kind) {
-	case lm85b:
-		type_name = "lm85b";
-		break;
-	case lm85c:
-		type_name = "lm85c";
-		break;
-	case adm1027:
-		type_name = "adm1027";
-		break;
-	case adt7463:
-		type_name = "adt7463";
-		break;
-	case adt7468:
-		type_name = "adt7468";
-		break;
-	case emc6d100:
-		type_name = "emc6d100";
-		break;
-	case emc6d102:
-		type_name = "emc6d102";
-		break;
-	default:
-		type_name = "lm85";
-	}
 	strlcpy(info->type, type_name, I2C_NAME_SIZE);
 
 	return 0;
diff --git a/drivers/hwmon/lm87.c b/drivers/hwmon/lm87.c
index 2e4a3cea95f7..f1e6e7512ffa 100644
--- a/drivers/hwmon/lm87.c
+++ b/drivers/hwmon/lm87.c
@@ -74,11 +74,7 @@
 
 static const unsigned short normal_i2c[] = { 0x2c, 0x2d, 0x2e, I2C_CLIENT_END };
 
-/*
- * Insmod parameters
- */
-
-I2C_CLIENT_INSMOD_2(lm87, adm1024);
+enum chips { lm87, adm1024 };
 
 /*
  * The LM87 registers
@@ -158,7 +154,7 @@ static u8 LM87_REG_TEMP_LOW[3] = { 0x3A, 0x38, 0x2C };
 
 static int lm87_probe(struct i2c_client *client,
 		      const struct i2c_device_id *id);
-static int lm87_detect(struct i2c_client *new_client, int kind,
+static int lm87_detect(struct i2c_client *new_client,
 		       struct i2c_board_info *info);
 static void lm87_init_client(struct i2c_client *client);
 static int lm87_remove(struct i2c_client *client);
@@ -184,7 +180,7 @@ static struct i2c_driver lm87_driver = {
 	.remove		= lm87_remove,
 	.id_table	= lm87_id,
 	.detect		= lm87_detect,
-	.address_data	= &addr_data,
+	.address_list	= normal_i2c,
 };
 
 /*
@@ -662,41 +658,36 @@ static const struct attribute_group lm87_group_opt = {
 };
 
 /* Return 0 if detection is successful, -ENODEV otherwise */
-static int lm87_detect(struct i2c_client *new_client, int kind,
+static int lm87_detect(struct i2c_client *new_client,
 		       struct i2c_board_info *info)
 {
 	struct i2c_adapter *adapter = new_client->adapter;
-	static const char *names[] = { "lm87", "adm1024" };
+	const char *name;
+	u8 cid, rev;
 
 	if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA))
 		return -ENODEV;
 
-	/* Default to an LM87 if forced */
-	if (kind == 0)
-		kind = lm87;
+	if (lm87_read_value(new_client, LM87_REG_CONFIG) & 0x80)
+		return -ENODEV;
 
 	/* Now, we do the remaining detection. */
-	if (kind < 0) {
-		u8 cid = lm87_read_value(new_client, LM87_REG_COMPANY_ID);
-		u8 rev = lm87_read_value(new_client, LM87_REG_REVISION);
-
-		if (cid == 0x02			/* National Semiconductor */
-		 && (rev >= 0x01 && rev <= 0x08))
-			kind = lm87;
-		else if (cid == 0x41		/* Analog Devices */
-		      && (rev & 0xf0) == 0x10)
-			kind = adm1024;
-
-		if (kind < 0
-		 || (lm87_read_value(new_client, LM87_REG_CONFIG) & 0x80)) {
-			dev_dbg(&adapter->dev,
-				"LM87 detection failed at 0x%02x.\n",
-				new_client->addr);
-			return -ENODEV;
-		}
+	cid = lm87_read_value(new_client, LM87_REG_COMPANY_ID);
+	rev = lm87_read_value(new_client, LM87_REG_REVISION);
+
+	if (cid == 0x02			/* National Semiconductor */
+	 && (rev >= 0x01 && rev <= 0x08))
+		name = "lm87";
+	else if (cid == 0x41		/* Analog Devices */
+	      && (rev & 0xf0) == 0x10)
+		name = "adm1024";
+	else {
+		dev_dbg(&adapter->dev, "LM87 detection failed at 0x%02x\n",
+			new_client->addr);
+		return -ENODEV;
 	}
 
-	strlcpy(info->type, names[kind - 1], I2C_NAME_SIZE);
+	strlcpy(info->type, name, I2C_NAME_SIZE);
 
 	return 0;
 }
diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c
index 1aff7575799d..7c9bdc167426 100644
--- a/drivers/hwmon/lm90.c
+++ b/drivers/hwmon/lm90.c
@@ -1,7 +1,7 @@
 /*
  * lm90.c - Part of lm_sensors, Linux kernel modules for hardware
  *          monitoring
- * Copyright (C) 2003-2008  Jean Delvare <khali@linux-fr.org>
+ * Copyright (C) 2003-2009  Jean Delvare <khali@linux-fr.org>
  *
  * Based on the lm83 driver. The LM90 is a sensor chip made by National
  * Semiconductor. It reports up to two temperatures (its own plus up to
@@ -93,12 +93,7 @@
 static const unsigned short normal_i2c[] = {
 	0x18, 0x19, 0x1a, 0x29, 0x2a, 0x2b, 0x4c, 0x4d, 0x4e, I2C_CLIENT_END };
 
-/*
- * Insmod parameters
- */
-
-I2C_CLIENT_INSMOD_8(lm90, adm1032, lm99, lm86, max6657, adt7461, max6680,
-		    max6646);
+enum chips { lm90, adm1032, lm99, lm86, max6657, adt7461, max6680, max6646 };
 
 /*
  * The LM90 registers
@@ -152,8 +147,7 @@ I2C_CLIENT_INSMOD_8(lm90, adm1032, lm99, lm86, max6657, adt7461, max6680,
  * Functions declaration
  */
 
-static int lm90_detect(struct i2c_client *client, int kind,
-		       struct i2c_board_info *info);
+static int lm90_detect(struct i2c_client *client, struct i2c_board_info *info);
 static int lm90_probe(struct i2c_client *client,
 		      const struct i2c_device_id *id);
 static void lm90_init_client(struct i2c_client *client);
@@ -192,7 +186,7 @@ static struct i2c_driver lm90_driver = {
 	.remove		= lm90_remove,
 	.id_table	= lm90_id,
 	.detect		= lm90_detect,
-	.address_data	= &addr_data,
+	.address_list	= normal_i2c,
 };
 
 /*
@@ -656,159 +650,123 @@ static int lm90_read_reg(struct i2c_client* client, u8 reg, u8 *value)
 }
 
 /* Return 0 if detection is successful, -ENODEV otherwise */
-static int lm90_detect(struct i2c_client *new_client, int kind,
+static int lm90_detect(struct i2c_client *new_client,
 		       struct i2c_board_info *info)
 {
 	struct i2c_adapter *adapter = new_client->adapter;
 	int address = new_client->addr;
-	const char *name = "";
+	const char *name = NULL;
+	int man_id, chip_id, reg_config1, reg_convrate;
 
 	if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA))
 		return -ENODEV;
 
-	/*
-	 * Now we do the remaining detection. A negative kind means that
-	 * the driver was loaded with no force parameter (default), so we
-	 * must both detect and identify the chip. A zero kind means that
-	 * the driver was loaded with the force parameter, the detection
-	 * step shall be skipped. A positive kind means that the driver
-	 * was loaded with the force parameter and a given kind of chip is
-	 * requested, so both the detection and the identification steps
-	 * are skipped.
-	 */
-
-	/* Default to an LM90 if forced */
-	if (kind == 0)
-		kind = lm90;
-
-	if (kind < 0) { /* detection and identification */
-		int man_id, chip_id, reg_config1, reg_convrate;
-
-		if ((man_id = i2c_smbus_read_byte_data(new_client,
+	/* detection and identification */
+	if ((man_id = i2c_smbus_read_byte_data(new_client,
 						LM90_REG_R_MAN_ID)) < 0
-		 || (chip_id = i2c_smbus_read_byte_data(new_client,
+	 || (chip_id = i2c_smbus_read_byte_data(new_client,
 						LM90_REG_R_CHIP_ID)) < 0
-		 || (reg_config1 = i2c_smbus_read_byte_data(new_client,
+	 || (reg_config1 = i2c_smbus_read_byte_data(new_client,
 						LM90_REG_R_CONFIG1)) < 0
-		 || (reg_convrate = i2c_smbus_read_byte_data(new_client,
+	 || (reg_convrate = i2c_smbus_read_byte_data(new_client,
 						LM90_REG_R_CONVRATE)) < 0)
+		return -ENODEV;
+
+	if ((address == 0x4C || address == 0x4D)
+	 && man_id == 0x01) { /* National Semiconductor */
+		int reg_config2;
+
+		reg_config2 = i2c_smbus_read_byte_data(new_client,
+						LM90_REG_R_CONFIG2);
+		if (reg_config2 < 0)
 			return -ENODEV;
-		
-		if ((address == 0x4C || address == 0x4D)
-		 && man_id == 0x01) { /* National Semiconductor */
-			int reg_config2;
-
-			if ((reg_config2 = i2c_smbus_read_byte_data(new_client,
-						LM90_REG_R_CONFIG2)) < 0)
-				return -ENODEV;
-
-			if ((reg_config1 & 0x2A) == 0x00
-			 && (reg_config2 & 0xF8) == 0x00
-			 && reg_convrate <= 0x09) {
-				if (address == 0x4C
-				 && (chip_id & 0xF0) == 0x20) { /* LM90 */
-					kind = lm90;
-				} else
-				if ((chip_id & 0xF0) == 0x30) { /* LM89/LM99 */
-					kind = lm99;
-					dev_info(&adapter->dev,
-						 "Assuming LM99 chip at "
-						 "0x%02x\n", address);
-					dev_info(&adapter->dev,
-						 "If it is an LM89, pass "
-						 "force_lm86=%d,0x%02x when "
-						 "loading the lm90 driver\n",
-						 i2c_adapter_id(adapter),
-						 address);
-				} else
-				if (address == 0x4C
-				 && (chip_id & 0xF0) == 0x10) { /* LM86 */
-					kind = lm86;
-				}
-			}
-		} else
-		if ((address == 0x4C || address == 0x4D)
-		 && man_id == 0x41) { /* Analog Devices */
-			if ((chip_id & 0xF0) == 0x40 /* ADM1032 */
-			 && (reg_config1 & 0x3F) == 0x00
-			 && reg_convrate <= 0x0A) {
-				kind = adm1032;
-			} else
-			if (chip_id == 0x51 /* ADT7461 */
-			 && (reg_config1 & 0x1B) == 0x00
-			 && reg_convrate <= 0x0A) {
-				kind = adt7461;
-			}
-		} else
-		if (man_id == 0x4D) { /* Maxim */
-			/*
-			 * The MAX6657, MAX6658 and MAX6659 do NOT have a
-			 * chip_id register. Reading from that address will
-			 * return the last read value, which in our case is
-			 * those of the man_id register. Likewise, the config1
-			 * register seems to lack a low nibble, so the value
-			 * will be those of the previous read, so in our case
-			 * those of the man_id register.
-			 */
-			if (chip_id == man_id
-			 && (address == 0x4C || address == 0x4D)
-			 && (reg_config1 & 0x1F) == (man_id & 0x0F)
-			 && reg_convrate <= 0x09) {
-			 	kind = max6657;
+
+		if ((reg_config1 & 0x2A) == 0x00
+		 && (reg_config2 & 0xF8) == 0x00
+		 && reg_convrate <= 0x09) {
+			if (address == 0x4C
+			 && (chip_id & 0xF0) == 0x20) { /* LM90 */
+				name = "lm90";
 			} else
-			/* The chip_id register of the MAX6680 and MAX6681
-			 * holds the revision of the chip.
-			 * the lowest bit of the config1 register is unused
-			 * and should return zero when read, so should the
-			 * second to last bit of config1 (software reset)
-			 */
-			if (chip_id == 0x01
-			 && (reg_config1 & 0x03) == 0x00
-			 && reg_convrate <= 0x07) {
-			 	kind = max6680;
+			if ((chip_id & 0xF0) == 0x30) { /* LM89/LM99 */
+				name = "lm99";
+				dev_info(&adapter->dev,
+					 "Assuming LM99 chip at 0x%02x\n",
+					 address);
+				dev_info(&adapter->dev,
+					 "If it is an LM89, instantiate it "
+					 "with the new_device sysfs "
+					 "interface\n");
 			} else
-			/* The chip_id register of the MAX6646/6647/6649
-			 * holds the revision of the chip.
-			 * The lowest 6 bits of the config1 register are
-			 * unused and should return zero when read.
-			 */
-			if (chip_id == 0x59
-			 && (reg_config1 & 0x3f) == 0x00
-			 && reg_convrate <= 0x07) {
-				kind = max6646;
+			if (address == 0x4C
+			 && (chip_id & 0xF0) == 0x10) { /* LM86 */
+				name = "lm86";
 			}
 		}
-
-		if (kind <= 0) { /* identification failed */
-			dev_dbg(&adapter->dev,
-				"Unsupported chip at 0x%02x (man_id=0x%02X, "
-				"chip_id=0x%02X)\n", address, man_id, chip_id);
-			return -ENODEV;
+	} else
+	if ((address == 0x4C || address == 0x4D)
+	 && man_id == 0x41) { /* Analog Devices */
+		if ((chip_id & 0xF0) == 0x40 /* ADM1032 */
+		 && (reg_config1 & 0x3F) == 0x00
+		 && reg_convrate <= 0x0A) {
+			name = "adm1032";
+			/* The ADM1032 supports PEC, but only if combined
+			   transactions are not used. */
+			if (i2c_check_functionality(adapter,
+						    I2C_FUNC_SMBUS_BYTE))
+				info->flags |= I2C_CLIENT_PEC;
+		} else
+		if (chip_id == 0x51 /* ADT7461 */
+		 && (reg_config1 & 0x1B) == 0x00
+		 && reg_convrate <= 0x0A) {
+			name = "adt7461";
+		}
+	} else
+	if (man_id == 0x4D) { /* Maxim */
+		/*
+		 * The MAX6657, MAX6658 and MAX6659 do NOT have a chip_id
+		 * register. Reading from that address will return the last
+		 * read value, which in our case is those of the man_id
+		 * register. Likewise, the config1 register seems to lack a
+		 * low nibble, so the value will be those of the previous
+		 * read, so in our case those of the man_id register.
+		 */
+		if (chip_id == man_id
+		 && (address == 0x4C || address == 0x4D)
+		 && (reg_config1 & 0x1F) == (man_id & 0x0F)
+		 && reg_convrate <= 0x09) {
+			name = "max6657";
+		} else
+		/*
+		 * The chip_id register of the MAX6680 and MAX6681 holds the
+		 * revision of the chip. The lowest bit of the config1 register
+		 * is unused and should return zero when read, so should the
+		 * second to last bit of config1 (software reset).
+		 */
+		if (chip_id == 0x01
+		 && (reg_config1 & 0x03) == 0x00
+		 && reg_convrate <= 0x07) {
+			name = "max6680";
+		} else
+		/*
+		 * The chip_id register of the MAX6646/6647/6649 holds the
+		 * revision of the chip. The lowest 6 bits of the config1
+		 * register are unused and should return zero when read.
+		 */
+		if (chip_id == 0x59
+		 && (reg_config1 & 0x3f) == 0x00
+		 && reg_convrate <= 0x07) {
+			name = "max6646";
 		}
 	}
 
-	/* Fill the i2c board info */
-	if (kind == lm90) {
-		name = "lm90";
-	} else if (kind == adm1032) {
-		name = "adm1032";
-		/* The ADM1032 supports PEC, but only if combined
-		   transactions are not used. */
-		if (i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE))
-			info->flags |= I2C_CLIENT_PEC;
-	} else if (kind == lm99) {
-		name = "lm99";
-	} else if (kind == lm86) {
-		name = "lm86";
-	} else if (kind == max6657) {
-		name = "max6657";
-	} else if (kind == max6680) {
-		name = "max6680";
-	} else if (kind == adt7461) {
-		name = "adt7461";
-	} else if (kind == max6646) {
-		name = "max6646";
+	if (!name) { /* identification failed */
+		dev_dbg(&adapter->dev,
+			"Unsupported chip at 0x%02x (man_id=0x%02X, "
+			"chip_id=0x%02X)\n", address, man_id, chip_id);
+		return -ENODEV;
 	}
+
 	strlcpy(info->type, name, I2C_NAME_SIZE);
 
 	return 0;
diff --git a/drivers/hwmon/lm92.c b/drivers/hwmon/lm92.c
index b2e00c5a7eec..7c31e6205f85 100644
--- a/drivers/hwmon/lm92.c
+++ b/drivers/hwmon/lm92.c
@@ -54,9 +54,6 @@
 static const unsigned short normal_i2c[] = { 0x48, 0x49, 0x4a, 0x4b,
 						I2C_CLIENT_END };
 
-/* Insmod parameters */
-I2C_CLIENT_INSMOD_1(lm92);
-
 /* The LM92 registers */
 #define LM92_REG_CONFIG			0x01 /* 8-bit, RW */
 #define LM92_REG_TEMP			0x00 /* 16-bit, RO */
@@ -319,35 +316,26 @@ static const struct attribute_group lm92_group = {
 };
 
 /* Return 0 if detection is successful, -ENODEV otherwise */
-static int lm92_detect(struct i2c_client *new_client, int kind,
+static int lm92_detect(struct i2c_client *new_client,
 		       struct i2c_board_info *info)
 {
 	struct i2c_adapter *adapter = new_client->adapter;
+	u8 config;
+	u16 man_id;
 
 	if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA
 					    | I2C_FUNC_SMBUS_WORD_DATA))
 		return -ENODEV;
 
-	/* A negative kind means that the driver was loaded with no force
-	   parameter (default), so we must identify the chip. */
-	if (kind < 0) {
-		u8 config = i2c_smbus_read_byte_data(new_client,
-			     LM92_REG_CONFIG);
-		u16 man_id = i2c_smbus_read_word_data(new_client,
-			     LM92_REG_MAN_ID);
-
-		if ((config & 0xe0) == 0x00
-		 && man_id == 0x0180) {
-			pr_info("lm92: Found National Semiconductor LM92 chip\n");
-	 		kind = lm92;
-		} else
-		if (max6635_check(new_client)) {
-			pr_info("lm92: Found Maxim MAX6635 chip\n");
-			kind = lm92; /* No separate prefix */
-		}
-		else
-			return -ENODEV;
-	}
+	config = i2c_smbus_read_byte_data(new_client, LM92_REG_CONFIG);
+	man_id = i2c_smbus_read_word_data(new_client, LM92_REG_MAN_ID);
+
+	if ((config & 0xe0) == 0x00 && man_id == 0x0180)
+		pr_info("lm92: Found National Semiconductor LM92 chip\n");
+	else if (max6635_check(new_client))
+		pr_info("lm92: Found Maxim MAX6635 chip\n");
+	else
+		return -ENODEV;
 
 	strlcpy(info->type, "lm92", I2C_NAME_SIZE);
 
@@ -410,7 +398,7 @@ static int lm92_remove(struct i2c_client *client)
  */
 
 static const struct i2c_device_id lm92_id[] = {
-	{ "lm92", lm92 },
+	{ "lm92", 0 },
 	/* max6635 could be added here */
 	{ }
 };
@@ -425,7 +413,7 @@ static struct i2c_driver lm92_driver = {
 	.remove		= lm92_remove,
 	.id_table	= lm92_id,
 	.detect		= lm92_detect,
-	.address_data	= &addr_data,
+	.address_list	= normal_i2c,
 };
 
 static int __init sensors_lm92_init(void)
diff --git a/drivers/hwmon/lm93.c b/drivers/hwmon/lm93.c
index fc36cadf36fb..6669255aadcf 100644
--- a/drivers/hwmon/lm93.c
+++ b/drivers/hwmon/lm93.c
@@ -145,7 +145,6 @@
 static const unsigned short normal_i2c[] = { 0x2c, 0x2d, 0x2e, I2C_CLIENT_END };
 
 /* Insmod parameters */
-I2C_CLIENT_INSMOD_1(lm93);
 
 static int disable_block;
 module_param(disable_block, bool, 0);
@@ -928,7 +927,7 @@ static void lm93_update_client_common(struct lm93_data *data,
 	data->prochot_interval = lm93_read_byte(client,
 			LM93_REG_PROCHOT_INTERVAL);
 
-	/* Fan Boost Termperature registers */
+	/* Fan Boost Temperature registers */
 	for (i = 0; i < 4; i++)
 		data->boost[i] = lm93_read_byte(client, LM93_REG_BOOST(i));
 
@@ -2501,38 +2500,27 @@ static void lm93_init_client(struct i2c_client *client)
 }
 
 /* Return 0 if detection is successful, -ENODEV otherwise */
-static int lm93_detect(struct i2c_client *client, int kind,
-		       struct i2c_board_info *info)
+static int lm93_detect(struct i2c_client *client, struct i2c_board_info *info)
 {
 	struct i2c_adapter *adapter = client->adapter;
+	int mfr, ver;
 
 	if (!i2c_check_functionality(adapter, LM93_SMBUS_FUNC_MIN))
 		return -ENODEV;
 
 	/* detection */
-	if (kind < 0) {
-		int mfr = lm93_read_byte(client, LM93_REG_MFR_ID);
-
-		if (mfr != 0x01) {
-			dev_dbg(&adapter->dev,"detect failed, "
-				"bad manufacturer id 0x%02x!\n", mfr);
-			return -ENODEV;
-		}
+	mfr = lm93_read_byte(client, LM93_REG_MFR_ID);
+	if (mfr != 0x01) {
+		dev_dbg(&adapter->dev,
+			"detect failed, bad manufacturer id 0x%02x!\n", mfr);
+		return -ENODEV;
 	}
 
-	if (kind <= 0) {
-		int ver = lm93_read_byte(client, LM93_REG_VER);
-
-		if ((ver == LM93_MFR_ID) || (ver == LM93_MFR_ID_PROTOTYPE)) {
-			kind = lm93;
-		} else {
-			dev_dbg(&adapter->dev,"detect failed, "
-				"bad version id 0x%02x!\n", ver);
-			if (kind == 0)
-				dev_dbg(&adapter->dev,
-					"(ignored 'force' parameter)\n");
-			return -ENODEV;
-		}
+	ver = lm93_read_byte(client, LM93_REG_VER);
+	if (ver != LM93_MFR_ID && ver != LM93_MFR_ID_PROTOTYPE) {
+		dev_dbg(&adapter->dev,
+			"detect failed, bad version id 0x%02x!\n", ver);
+		return -ENODEV;
 	}
 
 	strlcpy(info->type, "lm93", I2C_NAME_SIZE);
@@ -2613,7 +2601,7 @@ static int lm93_remove(struct i2c_client *client)
 }
 
 static const struct i2c_device_id lm93_id[] = {
-	{ "lm93", lm93 },
+	{ "lm93", 0 },
 	{ }
 };
 MODULE_DEVICE_TABLE(i2c, lm93_id);
@@ -2627,7 +2615,7 @@ static struct i2c_driver lm93_driver = {
 	.remove		= lm93_remove,
 	.id_table	= lm93_id,
 	.detect		= lm93_detect,
-	.address_data	= &addr_data,
+	.address_list	= normal_i2c,
 };
 
 static int __init lm93_init(void)
diff --git a/drivers/hwmon/lm95241.c b/drivers/hwmon/lm95241.c
index e34f9e402a2c..8fc8eb8cba47 100644
--- a/drivers/hwmon/lm95241.c
+++ b/drivers/hwmon/lm95241.c
@@ -39,9 +39,6 @@
 static const unsigned short normal_i2c[] = {
 	0x19, 0x2a, 0x2b, I2C_CLIENT_END};
 
-/* Insmod parameters */
-I2C_CLIENT_INSMOD_1(lm95241);
-
 /* LM95241 registers */
 #define LM95241_REG_R_MAN_ID		0xFE
 #define LM95241_REG_R_CHIP_ID		0xFF
@@ -310,56 +307,28 @@ static const struct attribute_group lm95241_group = {
 };
 
 /* Return 0 if detection is successful, -ENODEV otherwise */
-static int lm95241_detect(struct i2c_client *new_client, int kind,
+static int lm95241_detect(struct i2c_client *new_client,
 			  struct i2c_board_info *info)
 {
 	struct i2c_adapter *adapter = new_client->adapter;
 	int address = new_client->addr;
-	const char *name = "";
+	const char *name;
 
 	if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA))
 		return -ENODEV;
 
-	/*
-	 * Now we do the remaining detection. A negative kind means that
-	 * the driver was loaded with no force parameter (default), so we
-	 * must both detect and identify the chip. A zero kind means that
-	 * the driver was loaded with the force parameter, the detection
-	 * step shall be skipped. A positive kind means that the driver
-	 * was loaded with the force parameter and a given kind of chip is
-	 * requested, so both the detection and the identification steps
-	 * are skipped.
-	 */
-	if (kind < 0) {	/* detection */
-		if ((i2c_smbus_read_byte_data(new_client, LM95241_REG_R_MAN_ID)
-		     != MANUFACTURER_ID)
-		|| (i2c_smbus_read_byte_data(new_client, LM95241_REG_R_CHIP_ID)
-		    < DEFAULT_REVISION)) {
-			dev_dbg(&adapter->dev,
-				"LM95241 detection failed at 0x%02x.\n",
-				address);
-			return -ENODEV;
-		}
-	}
-
-	if (kind <= 0) { /* identification */
-		if ((i2c_smbus_read_byte_data(new_client, LM95241_REG_R_MAN_ID)
-		     == MANUFACTURER_ID)
-		&& (i2c_smbus_read_byte_data(new_client, LM95241_REG_R_CHIP_ID)
-		    >= DEFAULT_REVISION)) {
-
-			kind = lm95241;
-
-			if (kind <= 0) { /* identification failed */
-				dev_info(&adapter->dev, "Unsupported chip\n");
-				return -ENODEV;
-			}
-		}
+	if ((i2c_smbus_read_byte_data(new_client, LM95241_REG_R_MAN_ID)
+	     == MANUFACTURER_ID)
+	 && (i2c_smbus_read_byte_data(new_client, LM95241_REG_R_CHIP_ID)
+	     >= DEFAULT_REVISION)) {
+		name = "lm95241";
+	} else {
+		dev_dbg(&adapter->dev, "LM95241 detection failed at 0x%02x\n",
+			address);
+		return -ENODEV;
 	}
 
 	/* Fill the i2c board info */
-	if (kind == lm95241)
-		name = "lm95241";
 	strlcpy(info->type, name, I2C_NAME_SIZE);
 	return 0;
 }
@@ -474,7 +443,7 @@ static struct lm95241_data *lm95241_update_device(struct device *dev)
 
 /* Driver data (common to all clients) */
 static const struct i2c_device_id lm95241_id[] = {
-	{ "lm95241", lm95241 },
+	{ "lm95241", 0 },
 	{ }
 };
 MODULE_DEVICE_TABLE(i2c, lm95241_id);
@@ -488,7 +457,7 @@ static struct i2c_driver lm95241_driver = {
 	.remove		= lm95241_remove,
 	.id_table	= lm95241_id,
 	.detect		= lm95241_detect,
-	.address_data	= &addr_data,
+	.address_list	= normal_i2c,
 };
 
 static int __init sensors_lm95241_init(void)
diff --git a/drivers/hwmon/max1619.c b/drivers/hwmon/max1619.c
index 7897754f3a5c..022ded098100 100644
--- a/drivers/hwmon/max1619.c
+++ b/drivers/hwmon/max1619.c
@@ -41,12 +41,6 @@ static const unsigned short normal_i2c[] = {
 	0x18, 0x19, 0x1a, 0x29, 0x2a, 0x2b, 0x4c, 0x4d, 0x4e, I2C_CLIENT_END };
 
 /*
- * Insmod parameters
- */
-
-I2C_CLIENT_INSMOD_1(max1619);
-
-/*
  * The MAX1619 registers
  */
 
@@ -88,7 +82,7 @@ static int temp_to_reg(int val)
 
 static int max1619_probe(struct i2c_client *client,
 			 const struct i2c_device_id *id);
-static int max1619_detect(struct i2c_client *client, int kind,
+static int max1619_detect(struct i2c_client *client,
 			  struct i2c_board_info *info);
 static void max1619_init_client(struct i2c_client *client);
 static int max1619_remove(struct i2c_client *client);
@@ -99,7 +93,7 @@ static struct max1619_data *max1619_update_device(struct device *dev);
  */
 
 static const struct i2c_device_id max1619_id[] = {
-	{ "max1619", max1619 },
+	{ "max1619", 0 },
 	{ }
 };
 MODULE_DEVICE_TABLE(i2c, max1619_id);
@@ -113,7 +107,7 @@ static struct i2c_driver max1619_driver = {
 	.remove		= max1619_remove,
 	.id_table	= max1619_id,
 	.detect		= max1619_detect,
-	.address_data	= &addr_data,
+	.address_list	= normal_i2c,
 };
 
 /*
@@ -226,58 +220,34 @@ static const struct attribute_group max1619_group = {
  */
 
 /* Return 0 if detection is successful, -ENODEV otherwise */
-static int max1619_detect(struct i2c_client *new_client, int kind,
+static int max1619_detect(struct i2c_client *client,
 			  struct i2c_board_info *info)
 {
-	struct i2c_adapter *adapter = new_client->adapter;
-	u8 reg_config=0, reg_convrate=0, reg_status=0;
+	struct i2c_adapter *adapter = client->adapter;
+	u8 reg_config, reg_convrate, reg_status, man_id, chip_id;
 
 	if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA))
 		return -ENODEV;
 
-	/*
-	 * Now we do the remaining detection. A negative kind means that
-	 * the driver was loaded with no force parameter (default), so we
-	 * must both detect and identify the chip. A zero kind means that
-	 * the driver was loaded with the force parameter, the detection
-	 * step shall be skipped. A positive kind means that the driver
-	 * was loaded with the force parameter and a given kind of chip is
-	 * requested, so both the detection and the identification steps
-	 * are skipped.
-	 */
-	if (kind < 0) { /* detection */
-		reg_config = i2c_smbus_read_byte_data(new_client,
-			      MAX1619_REG_R_CONFIG);
-		reg_convrate = i2c_smbus_read_byte_data(new_client,
-			       MAX1619_REG_R_CONVRATE);
-		reg_status = i2c_smbus_read_byte_data(new_client,
-				MAX1619_REG_R_STATUS);
-		if ((reg_config & 0x03) != 0x00
-		 || reg_convrate > 0x07 || (reg_status & 0x61 ) !=0x00) {
-			dev_dbg(&adapter->dev,
-				"MAX1619 detection failed at 0x%02x.\n",
-				new_client->addr);
-			return -ENODEV;
-		}
+	/* detection */
+	reg_config = i2c_smbus_read_byte_data(client, MAX1619_REG_R_CONFIG);
+	reg_convrate = i2c_smbus_read_byte_data(client, MAX1619_REG_R_CONVRATE);
+	reg_status = i2c_smbus_read_byte_data(client, MAX1619_REG_R_STATUS);
+	if ((reg_config & 0x03) != 0x00
+	 || reg_convrate > 0x07 || (reg_status & 0x61) != 0x00) {
+		dev_dbg(&adapter->dev, "MAX1619 detection failed at 0x%02x\n",
+			client->addr);
+		return -ENODEV;
 	}
 
-	if (kind <= 0) { /* identification */
-		u8 man_id, chip_id;
-	
-		man_id = i2c_smbus_read_byte_data(new_client,
-			 MAX1619_REG_R_MAN_ID);
-		chip_id = i2c_smbus_read_byte_data(new_client,
-			  MAX1619_REG_R_CHIP_ID);
-		
-		if ((man_id == 0x4D) && (chip_id == 0x04))
-			kind = max1619;
-
-		if (kind <= 0) { /* identification failed */
-			dev_info(&adapter->dev,
-			    "Unsupported chip (man_id=0x%02X, "
-			    "chip_id=0x%02X).\n", man_id, chip_id);
-			return -ENODEV;
-		}
+	/* identification */
+	man_id = i2c_smbus_read_byte_data(client, MAX1619_REG_R_MAN_ID);
+	chip_id = i2c_smbus_read_byte_data(client, MAX1619_REG_R_CHIP_ID);
+	if (man_id != 0x4D || chip_id != 0x04) {
+		dev_info(&adapter->dev,
+			 "Unsupported chip (man_id=0x%02X, chip_id=0x%02X).\n",
+			 man_id, chip_id);
+		return -ENODEV;
 	}
 
 	strlcpy(info->type, "max1619", I2C_NAME_SIZE);
diff --git a/drivers/hwmon/max6650.c b/drivers/hwmon/max6650.c
index 58f66be61b1f..a0160ee5caef 100644
--- a/drivers/hwmon/max6650.c
+++ b/drivers/hwmon/max6650.c
@@ -62,8 +62,6 @@ module_param(fan_voltage, int, S_IRUGO);
 module_param(prescaler, int, S_IRUGO);
 module_param(clock, int, S_IRUGO);
 
-I2C_CLIENT_INSMOD_1(max6650);
-
 /*
  * MAX 6650/6651 registers
  */
@@ -116,7 +114,7 @@ I2C_CLIENT_INSMOD_1(max6650);
 
 static int max6650_probe(struct i2c_client *client,
 			 const struct i2c_device_id *id);
-static int max6650_detect(struct i2c_client *client, int kind,
+static int max6650_detect(struct i2c_client *client,
 			  struct i2c_board_info *info);
 static int max6650_init_client(struct i2c_client *client);
 static int max6650_remove(struct i2c_client *client);
@@ -127,7 +125,7 @@ static struct max6650_data *max6650_update_device(struct device *dev);
  */
 
 static const struct i2c_device_id max6650_id[] = {
-	{ "max6650", max6650 },
+	{ "max6650", 0 },
 	{ }
 };
 MODULE_DEVICE_TABLE(i2c, max6650_id);
@@ -141,7 +139,7 @@ static struct i2c_driver max6650_driver = {
 	.remove		= max6650_remove,
 	.id_table	= max6650_id,
 	.detect		= max6650_detect,
-	.address_data	= &addr_data,
+	.address_list	= normal_i2c,
 };
 
 /*
@@ -528,13 +526,13 @@ static struct attribute_group max6650_attr_grp = {
  */
 
 /* Return 0 if detection is successful, -ENODEV otherwise */
-static int max6650_detect(struct i2c_client *client, int kind,
+static int max6650_detect(struct i2c_client *client,
 			  struct i2c_board_info *info)
 {
 	struct i2c_adapter *adapter = client->adapter;
 	int address = client->addr;
 
-	dev_dbg(&adapter->dev, "max6650_detect called, kind = %d\n", kind);
+	dev_dbg(&adapter->dev, "max6650_detect called\n");
 
 	if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA)) {
 		dev_dbg(&adapter->dev, "max6650: I2C bus doesn't support "
@@ -542,23 +540,7 @@ static int max6650_detect(struct i2c_client *client, int kind,
 		return -ENODEV;
 	}
 
-	/*
-	 * Now we do the remaining detection. A negative kind means that
-	 * the driver was loaded with no force parameter (default), so we
-	 * must both detect and identify the chip (actually there is only
-	 * one possible kind of chip for now, max6650). A zero kind means that
-	 * the driver was loaded with the force parameter, the detection
-	 * step shall be skipped. A positive kind means that the driver
-	 * was loaded with the force parameter and a given kind of chip is
-	 * requested, so both the detection and the identification steps
-	 * are skipped.
-	 *
-	 * Currently I can find no way to distinguish between a MAX6650 and
-	 * a MAX6651. This driver has only been tried on the former.
-	 */
-
-	if ((kind < 0) &&
-	   (  (i2c_smbus_read_byte_data(client, MAX6650_REG_CONFIG) & 0xC0)
+	if (((i2c_smbus_read_byte_data(client, MAX6650_REG_CONFIG) & 0xC0)
 	    ||(i2c_smbus_read_byte_data(client, MAX6650_REG_GPIO_STAT) & 0xE0)
 	    ||(i2c_smbus_read_byte_data(client, MAX6650_REG_ALARM_EN) & 0xE0)
 	    ||(i2c_smbus_read_byte_data(client, MAX6650_REG_ALARM) & 0xE0)
diff --git a/drivers/hwmon/mc13783-adc.c b/drivers/hwmon/mc13783-adc.c
new file mode 100644
index 000000000000..883fa8197da4
--- /dev/null
+++ b/drivers/hwmon/mc13783-adc.c
@@ -0,0 +1,236 @@
+/*
+ * Driver for the Freescale Semiconductor MC13783 adc.
+ *
+ * Copyright 2004-2007 Freescale Semiconductor, Inc. All Rights Reserved.
+ * Copyright (C) 2009 Sascha Hauer, Pengutronix
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc., 51
+ * Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+#include <linux/mfd/mc13783-private.h>
+#include <linux/platform_device.h>
+#include <linux/hwmon-sysfs.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/hwmon.h>
+#include <linux/init.h>
+#include <linux/err.h>
+
+#define MC13783_ADC_NAME	"mc13783-adc"
+
+struct mc13783_adc_priv {
+	struct mc13783 *mc13783;
+	struct device *hwmon_dev;
+};
+
+static ssize_t mc13783_adc_show_name(struct device *dev, struct device_attribute
+			      *devattr, char *buf)
+{
+	return sprintf(buf, "mc13783_adc\n");
+}
+
+static int mc13783_adc_read(struct device *dev,
+		struct device_attribute *devattr, unsigned int *val)
+{
+	struct platform_device *pdev = to_platform_device(dev);
+	struct mc13783_adc_priv *priv = platform_get_drvdata(pdev);
+	struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
+	unsigned int channel = attr->index;
+	unsigned int sample[4];
+	int ret;
+
+	ret = mc13783_adc_do_conversion(priv->mc13783,
+			MC13783_ADC_MODE_MULT_CHAN,
+			channel, sample);
+	if (ret)
+		return ret;
+
+	channel &= 0x7;
+
+	*val = (sample[channel % 4] >> (channel > 3 ? 14 : 2)) & 0x3ff;
+
+	return 0;
+}
+
+static ssize_t mc13783_adc_read_bp(struct device *dev,
+		struct device_attribute *devattr, char *buf)
+{
+	unsigned val;
+	int ret = mc13783_adc_read(dev, devattr, &val);
+
+	if (ret)
+		return ret;
+
+	/*
+	 * BP (channel 2) reports with offset 2.4V to the actual value to fit
+	 * the input range of the ADC.  unit = 2.25mV = 9/4 mV.
+	 */
+	val = DIV_ROUND_CLOSEST(val * 9, 4) + 2400;
+
+	return sprintf(buf, "%u\n", val);
+}
+
+static ssize_t mc13783_adc_read_gp(struct device *dev,
+		struct device_attribute *devattr, char *buf)
+{
+	unsigned val;
+	int ret = mc13783_adc_read(dev, devattr, &val);
+
+	if (ret)
+		return ret;
+
+	/*
+	 * input range is [0, 2.3V], val has 10 bits, so each bit
+	 * is worth 9/4 mV.
+	 */
+	val = DIV_ROUND_CLOSEST(val * 9, 4);
+
+	return sprintf(buf, "%u\n", val);
+}
+
+static DEVICE_ATTR(name, S_IRUGO, mc13783_adc_show_name, NULL);
+static SENSOR_DEVICE_ATTR(in2_input, S_IRUGO, mc13783_adc_read_bp, NULL, 2);
+static SENSOR_DEVICE_ATTR(in5_input, S_IRUGO, mc13783_adc_read_gp, NULL, 5);
+static SENSOR_DEVICE_ATTR(in6_input, S_IRUGO, mc13783_adc_read_gp, NULL, 6);
+static SENSOR_DEVICE_ATTR(in7_input, S_IRUGO, mc13783_adc_read_gp, NULL, 7);
+static SENSOR_DEVICE_ATTR(in8_input, S_IRUGO, mc13783_adc_read_gp, NULL, 8);
+static SENSOR_DEVICE_ATTR(in9_input, S_IRUGO, mc13783_adc_read_gp, NULL, 9);
+static SENSOR_DEVICE_ATTR(in10_input, S_IRUGO, mc13783_adc_read_gp, NULL, 10);
+static SENSOR_DEVICE_ATTR(in11_input, S_IRUGO, mc13783_adc_read_gp, NULL, 11);
+static SENSOR_DEVICE_ATTR(in12_input, S_IRUGO, mc13783_adc_read_gp, NULL, 12);
+static SENSOR_DEVICE_ATTR(in13_input, S_IRUGO, mc13783_adc_read_gp, NULL, 13);
+static SENSOR_DEVICE_ATTR(in14_input, S_IRUGO, mc13783_adc_read_gp, NULL, 14);
+static SENSOR_DEVICE_ATTR(in15_input, S_IRUGO, mc13783_adc_read_gp, NULL, 15);
+
+static struct attribute *mc13783_attr[] = {
+	&dev_attr_name.attr,
+	&sensor_dev_attr_in2_input.dev_attr.attr,
+	&sensor_dev_attr_in5_input.dev_attr.attr,
+	&sensor_dev_attr_in6_input.dev_attr.attr,
+	&sensor_dev_attr_in7_input.dev_attr.attr,
+	&sensor_dev_attr_in8_input.dev_attr.attr,
+	&sensor_dev_attr_in9_input.dev_attr.attr,
+	&sensor_dev_attr_in10_input.dev_attr.attr,
+	&sensor_dev_attr_in11_input.dev_attr.attr,
+	NULL
+};
+
+static const struct attribute_group mc13783_group = {
+	.attrs = mc13783_attr,
+};
+
+/* last four channels may be occupied by the touchscreen */
+static struct attribute *mc13783_attr_ts[] = {
+	&sensor_dev_attr_in12_input.dev_attr.attr,
+	&sensor_dev_attr_in13_input.dev_attr.attr,
+	&sensor_dev_attr_in14_input.dev_attr.attr,
+	&sensor_dev_attr_in15_input.dev_attr.attr,
+	NULL
+};
+
+static const struct attribute_group mc13783_group_ts = {
+	.attrs = mc13783_attr_ts,
+};
+
+static int __init mc13783_adc_probe(struct platform_device *pdev)
+{
+	struct mc13783_adc_priv *priv;
+	int ret;
+
+	priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+	if (!priv)
+		return -ENOMEM;
+
+	priv->mc13783 = dev_get_drvdata(pdev->dev.parent);
+
+	platform_set_drvdata(pdev, priv);
+
+	/* Register sysfs hooks */
+	ret = sysfs_create_group(&pdev->dev.kobj, &mc13783_group);
+	if (ret)
+		goto out_err_create1;
+
+	if (!(priv->mc13783->flags & MC13783_USE_TOUCHSCREEN))
+		ret = sysfs_create_group(&pdev->dev.kobj, &mc13783_group_ts);
+		if (ret)
+			goto out_err_create2;
+
+	priv->hwmon_dev = hwmon_device_register(&pdev->dev);
+	if (IS_ERR(priv->hwmon_dev)) {
+		ret = PTR_ERR(priv->hwmon_dev);
+		dev_err(&pdev->dev,
+				"hwmon_device_register failed with %d.\n", ret);
+		goto out_err_register;
+	}
+
+
+	return 0;
+
+out_err_register:
+
+	if (!(priv->mc13783->flags & MC13783_USE_TOUCHSCREEN))
+		sysfs_remove_group(&pdev->dev.kobj, &mc13783_group_ts);
+out_err_create2:
+
+	sysfs_remove_group(&pdev->dev.kobj, &mc13783_group);
+out_err_create1:
+
+	platform_set_drvdata(pdev, NULL);
+	kfree(priv);
+
+	return ret;
+}
+
+static int __devexit mc13783_adc_remove(struct platform_device *pdev)
+{
+	struct mc13783_adc_priv *priv = platform_get_drvdata(pdev);
+
+	hwmon_device_unregister(priv->hwmon_dev);
+
+	if (!(priv->mc13783->flags & MC13783_USE_TOUCHSCREEN))
+		sysfs_remove_group(&pdev->dev.kobj, &mc13783_group_ts);
+
+	sysfs_remove_group(&pdev->dev.kobj, &mc13783_group);
+
+	platform_set_drvdata(pdev, NULL);
+	kfree(priv);
+
+	return 0;
+}
+
+static struct platform_driver mc13783_adc_driver = {
+	.remove 	= __devexit_p(mc13783_adc_remove),
+	.driver		= {
+		.owner	= THIS_MODULE,
+		.name	= MC13783_ADC_NAME,
+	},
+};
+
+static int __init mc13783_adc_init(void)
+{
+	return platform_driver_probe(&mc13783_adc_driver, mc13783_adc_probe);
+}
+
+static void __exit mc13783_adc_exit(void)
+{
+	platform_driver_unregister(&mc13783_adc_driver);
+}
+
+module_init(mc13783_adc_init);
+module_exit(mc13783_adc_exit);
+
+MODULE_DESCRIPTION("MC13783 ADC driver");
+MODULE_AUTHOR("Luotao Fu <l.fu@pengutronix.de>");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:" MC13783_ADC_NAME);
diff --git a/drivers/hwmon/pcf8591.c b/drivers/hwmon/pcf8591.c
index 1d7ffebd679d..d44787949851 100644
--- a/drivers/hwmon/pcf8591.c
+++ b/drivers/hwmon/pcf8591.c
@@ -29,7 +29,6 @@ static const unsigned short normal_i2c[] = { 0x48, 0x49, 0x4a, 0x4b, 0x4c,
 					0x4d, 0x4e, 0x4f, I2C_CLIENT_END };
 
 /* Insmod parameters */
-I2C_CLIENT_INSMOD_1(pcf8591);
 
 static int input_mode;
 module_param(input_mode, int, 0);
@@ -169,7 +168,7 @@ static const struct attribute_group pcf8591_attr_group_opt = {
  */
 
 /* Return 0 if detection is successful, -ENODEV otherwise */
-static int pcf8591_detect(struct i2c_client *client, int kind,
+static int pcf8591_detect(struct i2c_client *client,
 			  struct i2c_board_info *info)
 {
 	struct i2c_adapter *adapter = client->adapter;
@@ -299,7 +298,7 @@ static struct i2c_driver pcf8591_driver = {
 
 	.class		= I2C_CLASS_HWMON,	/* Nearest choice */
 	.detect		= pcf8591_detect,
-	.address_data	= &addr_data,
+	.address_list	= normal_i2c,
 };
 
 static int __init pcf8591_init(void)
diff --git a/drivers/hwmon/s3c-hwmon.c b/drivers/hwmon/s3c-hwmon.c
index 71835412529f..3f3f9a47acfd 100644
--- a/drivers/hwmon/s3c-hwmon.c
+++ b/drivers/hwmon/s3c-hwmon.c
@@ -323,7 +323,7 @@ static int __devinit s3c_hwmon_probe(struct platform_device *dev)
 	}
 
 	for (i = 0; i < ARRAY_SIZE(pdata->in); i++) {
-		struct s3c24xx_adc_hwmon_incfg *cfg = pdata->in[i];
+		struct s3c_hwmon_chcfg *cfg = pdata->in[i];
 
 		if (!cfg)
 			continue;
@@ -333,7 +333,7 @@ static int __devinit s3c_hwmon_probe(struct platform_device *dev)
 				 "channel %d multiplier too large\n",
 				 i);
 
-		if (cfg->divider == 0) {
+		if (cfg->div == 0) {
 			dev_err(&dev->dev, "channel %d divider zero\n", i);
 			continue;
 		}
diff --git a/drivers/hwmon/sht15.c b/drivers/hwmon/sht15.c
index ebe38b680ee3..864a371f6eb9 100644
--- a/drivers/hwmon/sht15.c
+++ b/drivers/hwmon/sht15.c
@@ -305,7 +305,7 @@ static inline int sht15_calc_temp(struct sht15_data *data)
 	int d1 = 0;
 	int i;
 
-	for (i = 1; i < ARRAY_SIZE(temppoints) - 1; i++)
+	for (i = 1; i < ARRAY_SIZE(temppoints); i++)
 		/* Find pointer to interpolate */
 		if (data->supply_uV > temppoints[i - 1].vdd) {
 			d1 = (data->supply_uV/1000 - temppoints[i - 1].vdd)
@@ -332,12 +332,12 @@ static inline int sht15_calc_humid(struct sht15_data *data)
 
 	const int c1 = -4;
 	const int c2 = 40500; /* x 10 ^ -6 */
-	const int c3 = 2800; /* x10 ^ -9 */
+	const int c3 = -2800; /* x10 ^ -9 */
 
 	RHlinear = c1*1000
 		+ c2 * data->val_humid/1000
 		+ (data->val_humid * data->val_humid * c3)/1000000;
-	return (temp - 25000) * (10000 + 800 * data->val_humid)
+	return (temp - 25000) * (10000 + 80 * data->val_humid)
 		/ 1000000 + RHlinear;
 }
 
diff --git a/drivers/hwmon/sis5595.c b/drivers/hwmon/sis5595.c
index 12f2e7086560..79c2931e3008 100644
--- a/drivers/hwmon/sis5595.c
+++ b/drivers/hwmon/sis5595.c
@@ -697,7 +697,7 @@ static struct sis5595_data *sis5595_update_device(struct device *dev)
 	return data;
 }
 
-static struct pci_device_id sis5595_pci_ids[] = {
+static const struct pci_device_id sis5595_pci_ids[] = {
 	{ PCI_DEVICE(PCI_VENDOR_ID_SI, PCI_DEVICE_ID_SI_503) },
 	{ 0, }
 };
diff --git a/drivers/hwmon/smsc47m1.c b/drivers/hwmon/smsc47m1.c
index 8ad50fdba00d..9ca97818bd4b 100644
--- a/drivers/hwmon/smsc47m1.c
+++ b/drivers/hwmon/smsc47m1.c
@@ -136,11 +136,11 @@ struct smsc47m1_data {
 
 struct smsc47m1_sio_data {
 	enum chips type;
+	u8 activate;		/* Remember initial device state */
 };
 
 
-static int smsc47m1_probe(struct platform_device *pdev);
-static int __devexit smsc47m1_remove(struct platform_device *pdev);
+static int __exit smsc47m1_remove(struct platform_device *pdev);
 static struct smsc47m1_data *smsc47m1_update_device(struct device *dev,
 		int init);
 
@@ -160,8 +160,7 @@ static struct platform_driver smsc47m1_driver = {
 		.owner	= THIS_MODULE,
 		.name	= DRVNAME,
 	},
-	.probe		= smsc47m1_probe,
-	.remove		= __devexit_p(smsc47m1_remove),
+	.remove		= __exit_p(smsc47m1_remove),
 };
 
 static ssize_t get_fan(struct device *dev, struct device_attribute
@@ -470,24 +469,126 @@ static int __init smsc47m1_find(unsigned short *addr,
 	superio_select();
 	*addr = (superio_inb(SUPERIO_REG_BASE) << 8)
 	      |  superio_inb(SUPERIO_REG_BASE + 1);
-	val = superio_inb(SUPERIO_REG_ACT);
-	if (*addr == 0 || (val & 0x01) == 0) {
-		pr_info(DRVNAME ": Device is disabled, will not use\n");
+	if (*addr == 0) {
+		pr_info(DRVNAME ": Device address not set, will not use\n");
 		superio_exit();
 		return -ENODEV;
 	}
 
+	/* Enable only if address is set (needed at least on the
+	 * Compaq Presario S4000NX) */
+	sio_data->activate = superio_inb(SUPERIO_REG_ACT);
+	if ((sio_data->activate & 0x01) == 0) {
+		pr_info(DRVNAME ": Enabling device\n");
+		superio_outb(SUPERIO_REG_ACT, sio_data->activate | 0x01);
+	}
+
 	superio_exit();
 	return 0;
 }
 
-static int __devinit smsc47m1_probe(struct platform_device *pdev)
+/* Restore device to its initial state */
+static void __init smsc47m1_restore(const struct smsc47m1_sio_data *sio_data)
+{
+	if ((sio_data->activate & 0x01) == 0) {
+		superio_enter();
+		superio_select();
+
+		pr_info(DRVNAME ": Disabling device\n");
+		superio_outb(SUPERIO_REG_ACT, sio_data->activate);
+
+		superio_exit();
+	}
+}
+
+#define CHECK		1
+#define REQUEST		2
+#define RELEASE		3
+
+/*
+ * This function can be used to:
+ *  - test for resource conflicts with ACPI
+ *  - request the resources
+ *  - release the resources
+ * We only allocate the I/O ports we really need, to minimize the risk of
+ * conflicts with ACPI or with other drivers.
+ */
+static int smsc47m1_handle_resources(unsigned short address, enum chips type,
+				     int action, struct device *dev)
+{
+	static const u8 ports_m1[] = {
+		/* register, region length */
+		0x04, 1,
+		0x33, 4,
+		0x56, 7,
+	};
+
+	static const u8 ports_m2[] = {
+		/* register, region length */
+		0x04, 1,
+		0x09, 1,
+		0x2c, 2,
+		0x35, 4,
+		0x56, 7,
+		0x69, 4,
+	};
+
+	int i, ports_size, err;
+	const u8 *ports;
+
+	switch (type) {
+	case smsc47m1:
+	default:
+		ports = ports_m1;
+		ports_size = ARRAY_SIZE(ports_m1);
+		break;
+	case smsc47m2:
+		ports = ports_m2;
+		ports_size = ARRAY_SIZE(ports_m2);
+		break;
+	}
+
+	for (i = 0; i + 1 < ports_size; i += 2) {
+		unsigned short start = address + ports[i];
+		unsigned short len = ports[i + 1];
+
+		switch (action) {
+		case CHECK:
+			/* Only check for conflicts */
+			err = acpi_check_region(start, len, DRVNAME);
+			if (err)
+				return err;
+			break;
+		case REQUEST:
+			/* Request the resources */
+			if (!request_region(start, len, DRVNAME)) {
+				dev_err(dev, "Region 0x%hx-0x%hx already in "
+					"use!\n", start, start + len);
+
+				/* Undo all requests */
+				for (i -= 2; i >= 0; i -= 2)
+					release_region(address + ports[i],
+						       ports[i + 1]);
+				return -EBUSY;
+			}
+			break;
+		case RELEASE:
+			/* Release the resources */
+			release_region(start, len);
+			break;
+		}
+	}
+
+	return 0;
+}
+
+static int __init smsc47m1_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
 	struct smsc47m1_sio_data *sio_data = dev->platform_data;
 	struct smsc47m1_data *data;
 	struct resource *res;
-	int err = 0;
+	int err;
 	int fan1, fan2, fan3, pwm1, pwm2, pwm3;
 
 	static const char *names[] = {
@@ -496,12 +597,10 @@ static int __devinit smsc47m1_probe(struct platform_device *pdev)
 	};
 
 	res = platform_get_resource(pdev, IORESOURCE_IO, 0);
-	if (!request_region(res->start, SMSC_EXTENT, DRVNAME)) {
-		dev_err(dev, "Region 0x%lx-0x%lx already in use!\n",
-			(unsigned long)res->start,
-			(unsigned long)res->end);
-		return -EBUSY;
-	}
+	err = smsc47m1_handle_resources(res->start, sio_data->type,
+					REQUEST, dev);
+	if (err < 0)
+		return err;
 
 	if (!(data = kzalloc(sizeof(struct smsc47m1_data), GFP_KERNEL))) {
 		err = -ENOMEM;
@@ -637,11 +736,11 @@ error_free:
 	platform_set_drvdata(pdev, NULL);
 	kfree(data);
 error_release:
-	release_region(res->start, SMSC_EXTENT);
+	smsc47m1_handle_resources(res->start, sio_data->type, RELEASE, dev);
 	return err;
 }
 
-static int __devexit smsc47m1_remove(struct platform_device *pdev)
+static int __exit smsc47m1_remove(struct platform_device *pdev)
 {
 	struct smsc47m1_data *data = platform_get_drvdata(pdev);
 	struct resource *res;
@@ -650,7 +749,7 @@ static int __devexit smsc47m1_remove(struct platform_device *pdev)
 	sysfs_remove_group(&pdev->dev.kobj, &smsc47m1_group);
 
 	res = platform_get_resource(pdev, IORESOURCE_IO, 0);
-	release_region(res->start, SMSC_EXTENT);
+	smsc47m1_handle_resources(res->start, data->type, RELEASE, &pdev->dev);
 	platform_set_drvdata(pdev, NULL);
 	kfree(data);
 
@@ -717,7 +816,7 @@ static int __init smsc47m1_device_add(unsigned short address,
 	};
 	int err;
 
-	err = acpi_check_resource_conflict(&res);
+	err = smsc47m1_handle_resources(address, sio_data->type, CHECK, NULL);
 	if (err)
 		goto exit;
 
@@ -766,27 +865,29 @@ static int __init sm_smsc47m1_init(void)
 	if (smsc47m1_find(&address, &sio_data))
 		return -ENODEV;
 
-	err = platform_driver_register(&smsc47m1_driver);
+	/* Sets global pdev as a side effect */
+	err = smsc47m1_device_add(address, &sio_data);
 	if (err)
 		goto exit;
 
-	/* Sets global pdev as a side effect */
-	err = smsc47m1_device_add(address, &sio_data);
+	err = platform_driver_probe(&smsc47m1_driver, smsc47m1_probe);
 	if (err)
-		goto exit_driver;
+		goto exit_device;
 
 	return 0;
 
-exit_driver:
-	platform_driver_unregister(&smsc47m1_driver);
+exit_device:
+	platform_device_unregister(pdev);
+	smsc47m1_restore(&sio_data);
 exit:
 	return err;
 }
 
 static void __exit sm_smsc47m1_exit(void)
 {
-	platform_device_unregister(pdev);
 	platform_driver_unregister(&smsc47m1_driver);
+	smsc47m1_restore(pdev->dev.platform_data);
+	platform_device_unregister(pdev);
 }
 
 MODULE_AUTHOR("Mark D. Studebaker <mdsxyz123@yahoo.com>");
diff --git a/drivers/hwmon/smsc47m192.c b/drivers/hwmon/smsc47m192.c
index 8bb5cb532d4d..40b26673d87f 100644
--- a/drivers/hwmon/smsc47m192.c
+++ b/drivers/hwmon/smsc47m192.c
@@ -36,9 +36,6 @@
 /* Addresses to scan */
 static const unsigned short normal_i2c[] = { 0x2c, 0x2d, I2C_CLIENT_END };
 
-/* Insmod parameters */
-I2C_CLIENT_INSMOD_1(smsc47m192);
-
 /* SMSC47M192 registers */
 #define SMSC47M192_REG_IN(nr)		((nr)<6 ? (0x20 + (nr)) : \
 					(0x50 + (nr) - 6))
@@ -115,13 +112,13 @@ struct smsc47m192_data {
 
 static int smsc47m192_probe(struct i2c_client *client,
 			    const struct i2c_device_id *id);
-static int smsc47m192_detect(struct i2c_client *client, int kind,
+static int smsc47m192_detect(struct i2c_client *client,
 			     struct i2c_board_info *info);
 static int smsc47m192_remove(struct i2c_client *client);
 static struct smsc47m192_data *smsc47m192_update_device(struct device *dev);
 
 static const struct i2c_device_id smsc47m192_id[] = {
-	{ "smsc47m192", smsc47m192 },
+	{ "smsc47m192", 0 },
 	{ }
 };
 MODULE_DEVICE_TABLE(i2c, smsc47m192_id);
@@ -135,7 +132,7 @@ static struct i2c_driver smsc47m192_driver = {
 	.remove		= smsc47m192_remove,
 	.id_table	= smsc47m192_id,
 	.detect		= smsc47m192_detect,
-	.address_data	= &addr_data,
+	.address_list	= normal_i2c,
 };
 
 /* Voltages */
@@ -481,7 +478,7 @@ static void smsc47m192_init_client(struct i2c_client *client)
 }
 
 /* Return 0 if detection is successful, -ENODEV otherwise */
-static int smsc47m192_detect(struct i2c_client *client, int kind,
+static int smsc47m192_detect(struct i2c_client *client,
 			     struct i2c_board_info *info)
 {
 	struct i2c_adapter *adapter = client->adapter;
@@ -491,24 +488,22 @@ static int smsc47m192_detect(struct i2c_client *client, int kind,
 		return -ENODEV;
 
 	/* Detection criteria from sensors_detect script */
-	if (kind < 0) {
-		if (i2c_smbus_read_byte_data(client,
+	version = i2c_smbus_read_byte_data(client, SMSC47M192_REG_VERSION);
+	if (i2c_smbus_read_byte_data(client,
 				SMSC47M192_REG_COMPANY_ID) == 0x55
-		 && ((version = i2c_smbus_read_byte_data(client,
-				SMSC47M192_REG_VERSION)) & 0xf0) == 0x20
-		 && (i2c_smbus_read_byte_data(client,
+	 && (version & 0xf0) == 0x20
+	 && (i2c_smbus_read_byte_data(client,
 				SMSC47M192_REG_VID) & 0x70) == 0x00
-		 && (i2c_smbus_read_byte_data(client,
+	 && (i2c_smbus_read_byte_data(client,
 				SMSC47M192_REG_VID4) & 0xfe) == 0x80) {
-			dev_info(&adapter->dev,
-				 "found SMSC47M192 or compatible, "
-				 "version 2, stepping A%d\n", version & 0x0f);
-		} else {
-			dev_dbg(&adapter->dev,
-				"SMSC47M192 detection failed at 0x%02x\n",
-				client->addr);
-			return -ENODEV;
-		}
+		dev_info(&adapter->dev,
+			 "found SMSC47M192 or compatible, "
+			 "version 2, stepping A%d\n", version & 0x0f);
+	} else {
+		dev_dbg(&adapter->dev,
+			"SMSC47M192 detection failed at 0x%02x\n",
+			client->addr);
+		return -ENODEV;
 	}
 
 	strlcpy(info->type, "smsc47m192", I2C_NAME_SIZE);
diff --git a/drivers/hwmon/thmc50.c b/drivers/hwmon/thmc50.c
index 7d97431e132f..7dfb4dec4c5f 100644
--- a/drivers/hwmon/thmc50.c
+++ b/drivers/hwmon/thmc50.c
@@ -35,8 +35,12 @@ MODULE_LICENSE("GPL");
 static const unsigned short normal_i2c[] = { 0x2c, 0x2d, 0x2e, I2C_CLIENT_END };
 
 /* Insmod parameters */
-I2C_CLIENT_INSMOD_2(thmc50, adm1022);
-I2C_CLIENT_MODULE_PARM(adm1022_temp3, "List of adapter,address pairs "
+enum chips { thmc50, adm1022 };
+
+static unsigned short adm1022_temp3[16];
+static unsigned int adm1022_temp3_num;
+module_param_array(adm1022_temp3, ushort, &adm1022_temp3_num, 0);
+MODULE_PARM_DESC(adm1022_temp3, "List of adapter,address pairs "
 			"to enable 3rd temperature (ADM1022 only)");
 
 /* Many THMC50 constants specified below */
@@ -80,7 +84,7 @@ struct thmc50_data {
 	u8 alarms;
 };
 
-static int thmc50_detect(struct i2c_client *client, int kind,
+static int thmc50_detect(struct i2c_client *client,
 			 struct i2c_board_info *info);
 static int thmc50_probe(struct i2c_client *client,
 			const struct i2c_device_id *id);
@@ -104,7 +108,7 @@ static struct i2c_driver thmc50_driver = {
 	.remove = thmc50_remove,
 	.id_table = thmc50_id,
 	.detect = thmc50_detect,
-	.address_data = &addr_data,
+	.address_list = normal_i2c,
 };
 
 static ssize_t show_analog_out(struct device *dev,
@@ -282,14 +286,13 @@ static const struct attribute_group temp3_group = {
 };
 
 /* Return 0 if detection is successful, -ENODEV otherwise */
-static int thmc50_detect(struct i2c_client *client, int kind,
+static int thmc50_detect(struct i2c_client *client,
 			 struct i2c_board_info *info)
 {
 	unsigned company;
 	unsigned revision;
 	unsigned config;
 	struct i2c_adapter *adapter = client->adapter;
-	int err = 0;
 	const char *type_name;
 
 	if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA)) {
@@ -301,31 +304,13 @@ static int thmc50_detect(struct i2c_client *client, int kind,
 	pr_debug("thmc50: Probing for THMC50 at 0x%2X on bus %d\n",
 		 client->addr, i2c_adapter_id(client->adapter));
 
-	/* Now, we do the remaining detection. */
 	company = i2c_smbus_read_byte_data(client, THMC50_REG_COMPANY_ID);
 	revision = i2c_smbus_read_byte_data(client, THMC50_REG_DIE_CODE);
 	config = i2c_smbus_read_byte_data(client, THMC50_REG_CONF);
+	if (revision < 0xc0 || (config & 0x10))
+		return -ENODEV;
 
-	if (kind == 0)
-		kind = thmc50;
-	else if (kind < 0) {
-		err = -ENODEV;
-		if (revision >= 0xc0 && ((config & 0x10) == 0)) {
-			if (company == 0x49) {
-				kind = thmc50;
-				err = 0;
-			} else if (company == 0x41) {
-				kind = adm1022;
-				err = 0;
-			}
-		}
-	}
-	if (err == -ENODEV) {
-		pr_debug("thmc50: Detection of THMC50/ADM1022 failed\n");
-		return err;
-	}
-
-	if (kind == adm1022) {
+	if (company == 0x41) {
 		int id = i2c_adapter_id(client->adapter);
 		int i;
 
@@ -340,9 +325,13 @@ static int thmc50_detect(struct i2c_client *client, int kind,
 							  config);
 				break;
 			}
-	} else {
+	} else if (company == 0x49) {
 		type_name = "thmc50";
+	} else {
+		pr_debug("thmc50: Detection of THMC50/ADM1022 failed\n");
+		return -ENODEV;
 	}
+
 	pr_debug("thmc50: Detected %s (version %x, revision %x)\n",
 		 type_name, (revision >> 4) - 0xc, revision & 0xf);
 
diff --git a/drivers/hwmon/tmp401.c b/drivers/hwmon/tmp401.c
index 7b34f2cd08bb..a13b30e8d8d8 100644
--- a/drivers/hwmon/tmp401.c
+++ b/drivers/hwmon/tmp401.c
@@ -42,8 +42,7 @@
 /* Addresses to scan */
 static const unsigned short normal_i2c[] = { 0x4c, I2C_CLIENT_END };
 
-/* Insmod parameters */
-I2C_CLIENT_INSMOD_2(tmp401, tmp411);
+enum chips { tmp401, tmp411 };
 
 /*
  * The TMP401 registers, note some registers have different addresses for
@@ -98,7 +97,7 @@ static const u8 TMP411_TEMP_HIGHEST_LSB[2]		= { 0x33, 0x37 };
 
 static int tmp401_probe(struct i2c_client *client,
 			const struct i2c_device_id *id);
-static int tmp401_detect(struct i2c_client *client, int kind,
+static int tmp401_detect(struct i2c_client *client,
 			 struct i2c_board_info *info);
 static int tmp401_remove(struct i2c_client *client);
 static struct tmp401_data *tmp401_update_device(struct device *dev);
@@ -123,7 +122,7 @@ static struct i2c_driver tmp401_driver = {
 	.remove		= tmp401_remove,
 	.id_table	= tmp401_id,
 	.detect		= tmp401_detect,
-	.address_data	= &addr_data,
+	.address_list	= normal_i2c,
 };
 
 /*
@@ -488,46 +487,43 @@ static void tmp401_init_client(struct i2c_client *client)
 		i2c_smbus_write_byte_data(client, TMP401_CONFIG_WRITE, config);
 }
 
-static int tmp401_detect(struct i2c_client *client, int kind,
+static int tmp401_detect(struct i2c_client *client,
 			 struct i2c_board_info *info)
 {
+	enum chips kind;
 	struct i2c_adapter *adapter = client->adapter;
+	u8 reg;
 
 	if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA))
 		return -ENODEV;
 
 	/* Detect and identify the chip */
-	if (kind <= 0) {
-		u8 reg;
-
-		reg = i2c_smbus_read_byte_data(client,
-					       TMP401_MANUFACTURER_ID_REG);
-		if (reg != TMP401_MANUFACTURER_ID)
-			return -ENODEV;
-
-		reg = i2c_smbus_read_byte_data(client, TMP401_DEVICE_ID_REG);
-
-		switch (reg) {
-		case TMP401_DEVICE_ID:
-			kind = tmp401;
-			break;
-		case TMP411_DEVICE_ID:
-			kind = tmp411;
-			break;
-		default:
-			return -ENODEV;
-		}
+	reg = i2c_smbus_read_byte_data(client, TMP401_MANUFACTURER_ID_REG);
+	if (reg != TMP401_MANUFACTURER_ID)
+		return -ENODEV;
 
-		reg = i2c_smbus_read_byte_data(client, TMP401_CONFIG_READ);
-		if (reg & 0x1b)
-			return -ENODEV;
+	reg = i2c_smbus_read_byte_data(client, TMP401_DEVICE_ID_REG);
 
-		reg = i2c_smbus_read_byte_data(client,
-					       TMP401_CONVERSION_RATE_READ);
-		/* Datasheet says: 0x1-0x6 */
-		if (reg > 15)
-			return -ENODEV;
+	switch (reg) {
+	case TMP401_DEVICE_ID:
+		kind = tmp401;
+		break;
+	case TMP411_DEVICE_ID:
+		kind = tmp411;
+		break;
+	default:
+		return -ENODEV;
 	}
+
+	reg = i2c_smbus_read_byte_data(client, TMP401_CONFIG_READ);
+	if (reg & 0x1b)
+		return -ENODEV;
+
+	reg = i2c_smbus_read_byte_data(client, TMP401_CONVERSION_RATE_READ);
+	/* Datasheet says: 0x1-0x6 */
+	if (reg > 15)
+		return -ENODEV;
+
 	strlcpy(info->type, tmp401_id[kind - 1].name, I2C_NAME_SIZE);
 
 	return 0;
diff --git a/drivers/hwmon/tmp421.c b/drivers/hwmon/tmp421.c
index 20924343431b..4f7c051e2d7b 100644
--- a/drivers/hwmon/tmp421.c
+++ b/drivers/hwmon/tmp421.c
@@ -39,8 +39,7 @@
 static unsigned short normal_i2c[] = { 0x2a, 0x4c, 0x4d, 0x4e, 0x4f,
 				       I2C_CLIENT_END };
 
-/* Insmod parameters */
-I2C_CLIENT_INSMOD_3(tmp421, tmp422, tmp423);
+enum chips { tmp421, tmp422, tmp423 };
 
 /* The TMP421 registers */
 #define TMP421_CONFIG_REG_1			0x09
@@ -223,39 +222,36 @@ static int tmp421_init_client(struct i2c_client *client)
 	return 0;
 }
 
-static int tmp421_detect(struct i2c_client *client, int kind,
+static int tmp421_detect(struct i2c_client *client,
 			 struct i2c_board_info *info)
 {
+	enum chips kind;
 	struct i2c_adapter *adapter = client->adapter;
 	const char *names[] = { "TMP421", "TMP422", "TMP423" };
+	u8 reg;
 
 	if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA))
 		return -ENODEV;
 
-	if (kind <= 0) {
-		u8 reg;
-
-		reg = i2c_smbus_read_byte_data(client,
-					       TMP421_MANUFACTURER_ID_REG);
-		if (reg != TMP421_MANUFACTURER_ID)
-			return -ENODEV;
-
-		reg = i2c_smbus_read_byte_data(client,
-					       TMP421_DEVICE_ID_REG);
-		switch (reg) {
-		case TMP421_DEVICE_ID:
-			kind = tmp421;
-			break;
-		case TMP422_DEVICE_ID:
-			kind = tmp422;
-			break;
-		case TMP423_DEVICE_ID:
-			kind = tmp423;
-			break;
-		default:
-			return -ENODEV;
-		}
+	reg = i2c_smbus_read_byte_data(client, TMP421_MANUFACTURER_ID_REG);
+	if (reg != TMP421_MANUFACTURER_ID)
+		return -ENODEV;
+
+	reg = i2c_smbus_read_byte_data(client, TMP421_DEVICE_ID_REG);
+	switch (reg) {
+	case TMP421_DEVICE_ID:
+		kind = tmp421;
+		break;
+	case TMP422_DEVICE_ID:
+		kind = tmp422;
+		break;
+	case TMP423_DEVICE_ID:
+		kind = tmp423;
+		break;
+	default:
+		return -ENODEV;
 	}
+
 	strlcpy(info->type, tmp421_id[kind - 1].name, I2C_NAME_SIZE);
 	dev_info(&adapter->dev, "Detected TI %s chip at 0x%02x\n",
 		 names[kind - 1], client->addr);
@@ -325,7 +321,7 @@ static struct i2c_driver tmp421_driver = {
 	.remove = tmp421_remove,
 	.id_table = tmp421_id,
 	.detect = tmp421_detect,
-	.address_data = &addr_data,
+	.address_list = normal_i2c,
 };
 
 static int __init tmp421_init(void)
diff --git a/drivers/hwmon/via-cputemp.c b/drivers/hwmon/via-cputemp.c
new file mode 100644
index 000000000000..7442cf754856
--- /dev/null
+++ b/drivers/hwmon/via-cputemp.c
@@ -0,0 +1,356 @@
+/*
+ * via-cputemp.c - Driver for VIA CPU core temperature monitoring
+ * Copyright (C) 2009 VIA Technologies, Inc.
+ *
+ * based on existing coretemp.c, which is
+ *
+ * Copyright (C) 2007 Rudolf Marek <r.marek@assembler.cz>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301 USA.
+ */
+
+#include <linux/module.h>
+#include <linux/delay.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/jiffies.h>
+#include <linux/hwmon.h>
+#include <linux/sysfs.h>
+#include <linux/hwmon-sysfs.h>
+#include <linux/err.h>
+#include <linux/mutex.h>
+#include <linux/list.h>
+#include <linux/platform_device.h>
+#include <linux/cpu.h>
+#include <asm/msr.h>
+#include <asm/processor.h>
+
+#define DRVNAME	"via_cputemp"
+
+enum { SHOW_TEMP, SHOW_LABEL, SHOW_NAME } SHOW;
+
+/*
+ * Functions declaration
+ */
+
+struct via_cputemp_data {
+	struct device *hwmon_dev;
+	const char *name;
+	u32 id;
+	u32 msr;
+};
+
+/*
+ * Sysfs stuff
+ */
+
+static ssize_t show_name(struct device *dev, struct device_attribute
+			  *devattr, char *buf)
+{
+	int ret;
+	struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
+	struct via_cputemp_data *data = dev_get_drvdata(dev);
+
+	if (attr->index == SHOW_NAME)
+		ret = sprintf(buf, "%s\n", data->name);
+	else	/* show label */
+		ret = sprintf(buf, "Core %d\n", data->id);
+	return ret;
+}
+
+static ssize_t show_temp(struct device *dev,
+			 struct device_attribute *devattr, char *buf)
+{
+	struct via_cputemp_data *data = dev_get_drvdata(dev);
+	u32 eax, edx;
+	int err;
+
+	err = rdmsr_safe_on_cpu(data->id, data->msr, &eax, &edx);
+	if (err)
+		return -EAGAIN;
+
+	return sprintf(buf, "%lu\n", ((unsigned long)eax & 0xffffff) * 1000);
+}
+
+static SENSOR_DEVICE_ATTR(temp1_input, S_IRUGO, show_temp, NULL,
+			  SHOW_TEMP);
+static SENSOR_DEVICE_ATTR(temp1_label, S_IRUGO, show_name, NULL, SHOW_LABEL);
+static SENSOR_DEVICE_ATTR(name, S_IRUGO, show_name, NULL, SHOW_NAME);
+
+static struct attribute *via_cputemp_attributes[] = {
+	&sensor_dev_attr_name.dev_attr.attr,
+	&sensor_dev_attr_temp1_label.dev_attr.attr,
+	&sensor_dev_attr_temp1_input.dev_attr.attr,
+	NULL
+};
+
+static const struct attribute_group via_cputemp_group = {
+	.attrs = via_cputemp_attributes,
+};
+
+static int __devinit via_cputemp_probe(struct platform_device *pdev)
+{
+	struct via_cputemp_data *data;
+	struct cpuinfo_x86 *c = &cpu_data(pdev->id);
+	int err;
+	u32 eax, edx;
+
+	data = kzalloc(sizeof(struct via_cputemp_data), GFP_KERNEL);
+	if (!data) {
+		err = -ENOMEM;
+		dev_err(&pdev->dev, "Out of memory\n");
+		goto exit;
+	}
+
+	data->id = pdev->id;
+	data->name = "via_cputemp";
+
+	switch (c->x86_model) {
+	case 0xA:
+		/* C7 A */
+	case 0xD:
+		/* C7 D */
+		data->msr = 0x1169;
+		break;
+	case 0xF:
+		/* Nano */
+		data->msr = 0x1423;
+		break;
+	default:
+		err = -ENODEV;
+		goto exit_free;
+	}
+
+	/* test if we can access the TEMPERATURE MSR */
+	err = rdmsr_safe_on_cpu(data->id, data->msr, &eax, &edx);
+	if (err) {
+		dev_err(&pdev->dev,
+			"Unable to access TEMPERATURE MSR, giving up\n");
+		goto exit_free;
+	}
+
+	platform_set_drvdata(pdev, data);
+
+	err = sysfs_create_group(&pdev->dev.kobj, &via_cputemp_group);
+	if (err)
+		goto exit_free;
+
+	data->hwmon_dev = hwmon_device_register(&pdev->dev);
+	if (IS_ERR(data->hwmon_dev)) {
+		err = PTR_ERR(data->hwmon_dev);
+		dev_err(&pdev->dev, "Class registration failed (%d)\n",
+			err);
+		goto exit_remove;
+	}
+
+	return 0;
+
+exit_remove:
+	sysfs_remove_group(&pdev->dev.kobj, &via_cputemp_group);
+exit_free:
+	platform_set_drvdata(pdev, NULL);
+	kfree(data);
+exit:
+	return err;
+}
+
+static int __devexit via_cputemp_remove(struct platform_device *pdev)
+{
+	struct via_cputemp_data *data = platform_get_drvdata(pdev);
+
+	hwmon_device_unregister(data->hwmon_dev);
+	sysfs_remove_group(&pdev->dev.kobj, &via_cputemp_group);
+	platform_set_drvdata(pdev, NULL);
+	kfree(data);
+	return 0;
+}
+
+static struct platform_driver via_cputemp_driver = {
+	.driver = {
+		.owner = THIS_MODULE,
+		.name = DRVNAME,
+	},
+	.probe = via_cputemp_probe,
+	.remove = __devexit_p(via_cputemp_remove),
+};
+
+struct pdev_entry {
+	struct list_head list;
+	struct platform_device *pdev;
+	unsigned int cpu;
+};
+
+static LIST_HEAD(pdev_list);
+static DEFINE_MUTEX(pdev_list_mutex);
+
+static int __cpuinit via_cputemp_device_add(unsigned int cpu)
+{
+	int err;
+	struct platform_device *pdev;
+	struct pdev_entry *pdev_entry;
+
+	pdev = platform_device_alloc(DRVNAME, cpu);
+	if (!pdev) {
+		err = -ENOMEM;
+		printk(KERN_ERR DRVNAME ": Device allocation failed\n");
+		goto exit;
+	}
+
+	pdev_entry = kzalloc(sizeof(struct pdev_entry), GFP_KERNEL);
+	if (!pdev_entry) {
+		err = -ENOMEM;
+		goto exit_device_put;
+	}
+
+	err = platform_device_add(pdev);
+	if (err) {
+		printk(KERN_ERR DRVNAME ": Device addition failed (%d)\n",
+		       err);
+		goto exit_device_free;
+	}
+
+	pdev_entry->pdev = pdev;
+	pdev_entry->cpu = cpu;
+	mutex_lock(&pdev_list_mutex);
+	list_add_tail(&pdev_entry->list, &pdev_list);
+	mutex_unlock(&pdev_list_mutex);
+
+	return 0;
+
+exit_device_free:
+	kfree(pdev_entry);
+exit_device_put:
+	platform_device_put(pdev);
+exit:
+	return err;
+}
+
+#ifdef CONFIG_HOTPLUG_CPU
+static void via_cputemp_device_remove(unsigned int cpu)
+{
+	struct pdev_entry *p, *n;
+	mutex_lock(&pdev_list_mutex);
+	list_for_each_entry_safe(p, n, &pdev_list, list) {
+		if (p->cpu == cpu) {
+			platform_device_unregister(p->pdev);
+			list_del(&p->list);
+			kfree(p);
+		}
+	}
+	mutex_unlock(&pdev_list_mutex);
+}
+
+static int __cpuinit via_cputemp_cpu_callback(struct notifier_block *nfb,
+				 unsigned long action, void *hcpu)
+{
+	unsigned int cpu = (unsigned long) hcpu;
+
+	switch (action) {
+	case CPU_ONLINE:
+	case CPU_DOWN_FAILED:
+		via_cputemp_device_add(cpu);
+		break;
+	case CPU_DOWN_PREPARE:
+		via_cputemp_device_remove(cpu);
+		break;
+	}
+	return NOTIFY_OK;
+}
+
+static struct notifier_block via_cputemp_cpu_notifier __refdata = {
+	.notifier_call = via_cputemp_cpu_callback,
+};
+#endif				/* !CONFIG_HOTPLUG_CPU */
+
+static int __init via_cputemp_init(void)
+{
+	int i, err;
+	struct pdev_entry *p, *n;
+
+	if (cpu_data(0).x86_vendor != X86_VENDOR_CENTAUR) {
+		printk(KERN_DEBUG DRVNAME ": Not a VIA CPU\n");
+		err = -ENODEV;
+		goto exit;
+	}
+
+	err = platform_driver_register(&via_cputemp_driver);
+	if (err)
+		goto exit;
+
+	for_each_online_cpu(i) {
+		struct cpuinfo_x86 *c = &cpu_data(i);
+
+		if (c->x86 != 6)
+			continue;
+
+		if (c->x86_model < 0x0a)
+			continue;
+
+		if (c->x86_model > 0x0f) {
+			printk(KERN_WARNING DRVNAME ": Unknown CPU "
+				"model 0x%x\n", c->x86_model);
+			continue;
+		}
+
+		err = via_cputemp_device_add(i);
+		if (err)
+			goto exit_devices_unreg;
+	}
+	if (list_empty(&pdev_list)) {
+		err = -ENODEV;
+		goto exit_driver_unreg;
+	}
+
+#ifdef CONFIG_HOTPLUG_CPU
+	register_hotcpu_notifier(&via_cputemp_cpu_notifier);
+#endif
+	return 0;
+
+exit_devices_unreg:
+	mutex_lock(&pdev_list_mutex);
+	list_for_each_entry_safe(p, n, &pdev_list, list) {
+		platform_device_unregister(p->pdev);
+		list_del(&p->list);
+		kfree(p);
+	}
+	mutex_unlock(&pdev_list_mutex);
+exit_driver_unreg:
+	platform_driver_unregister(&via_cputemp_driver);
+exit:
+	return err;
+}
+
+static void __exit via_cputemp_exit(void)
+{
+	struct pdev_entry *p, *n;
+#ifdef CONFIG_HOTPLUG_CPU
+	unregister_hotcpu_notifier(&via_cputemp_cpu_notifier);
+#endif
+	mutex_lock(&pdev_list_mutex);
+	list_for_each_entry_safe(p, n, &pdev_list, list) {
+		platform_device_unregister(p->pdev);
+		list_del(&p->list);
+		kfree(p);
+	}
+	mutex_unlock(&pdev_list_mutex);
+	platform_driver_unregister(&via_cputemp_driver);
+}
+
+MODULE_AUTHOR("Harald Welte <HaraldWelte@viatech.com>");
+MODULE_DESCRIPTION("VIA CPU temperature monitor");
+MODULE_LICENSE("GPL");
+
+module_init(via_cputemp_init)
+module_exit(via_cputemp_exit)
diff --git a/drivers/hwmon/via686a.c b/drivers/hwmon/via686a.c
index 39e82a492f26..f397ce7ad598 100644
--- a/drivers/hwmon/via686a.c
+++ b/drivers/hwmon/via686a.c
@@ -767,7 +767,7 @@ static struct via686a_data *via686a_update_device(struct device *dev)
 	return data;
 }
 
-static struct pci_device_id via686a_pci_ids[] = {
+static const struct pci_device_id via686a_pci_ids[] = {
 	{ PCI_DEVICE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C686_4) },
 	{ 0, }
 };
diff --git a/drivers/hwmon/vt8231.c b/drivers/hwmon/vt8231.c
index 470a1226ba2b..d47b4c9949c2 100644
--- a/drivers/hwmon/vt8231.c
+++ b/drivers/hwmon/vt8231.c
@@ -697,7 +697,7 @@ static struct platform_driver vt8231_driver = {
 	.remove	= __devexit_p(vt8231_remove),
 };
 
-static struct pci_device_id vt8231_pci_ids[] = {
+static const struct pci_device_id vt8231_pci_ids[] = {
 	{ PCI_DEVICE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_8231_4) },
 	{ 0, }
 };
diff --git a/drivers/hwmon/w83627ehf.c b/drivers/hwmon/w83627ehf.c
index bb5e78748783..0dcaba9b7189 100644
--- a/drivers/hwmon/w83627ehf.c
+++ b/drivers/hwmon/w83627ehf.c
@@ -5,6 +5,7 @@
     Copyright (C) 2006  Yuan Mu (Winbond),
                         Rudolf Marek <r.marek@assembler.cz>
                         David Hubbard <david.c.hubbard@gmail.com>
+			Daniel J Blueman <daniel.blueman@gmail.com>
 
     Shamelessly ripped from the w83627hf driver
     Copyright (C) 2003  Mark Studebaker
@@ -177,12 +178,15 @@ static const u16 W83627EHF_REG_TEMP_CONFIG[] = { 0x152, 0x252 };
 #define W83627EHF_REG_ALARM3		0x45B
 
 /* SmartFan registers */
+#define W83627EHF_REG_FAN_STEPUP_TIME 0x0f
+#define W83627EHF_REG_FAN_STEPDOWN_TIME 0x0e
+
 /* DC or PWM output fan configuration */
 static const u8 W83627EHF_REG_PWM_ENABLE[] = {
 	0x04,			/* SYS FAN0 output mode and PWM mode */
 	0x04,			/* CPU FAN0 output mode and PWM mode */
 	0x12,			/* AUX FAN mode */
-	0x62,			/* CPU fan1 mode */
+	0x62,			/* CPU FAN1 mode */
 };
 
 static const u8 W83627EHF_PWM_MODE_SHIFT[] = { 0, 1, 0, 6 };
@@ -193,10 +197,12 @@ static const u8 W83627EHF_REG_PWM[] = { 0x01, 0x03, 0x11, 0x61 };
 static const u8 W83627EHF_REG_TARGET[] = { 0x05, 0x06, 0x13, 0x63 };
 static const u8 W83627EHF_REG_TOLERANCE[] = { 0x07, 0x07, 0x14, 0x62 };
 
-
 /* Advanced Fan control, some values are common for all fans */
-static const u8 W83627EHF_REG_FAN_MIN_OUTPUT[] = { 0x08, 0x09, 0x15, 0x64 };
-static const u8 W83627EHF_REG_FAN_STOP_TIME[] = { 0x0C, 0x0D, 0x17, 0x66 };
+static const u8 W83627EHF_REG_FAN_START_OUTPUT[] = { 0x0a, 0x0b, 0x16, 0x65 };
+static const u8 W83627EHF_REG_FAN_STOP_OUTPUT[] = { 0x08, 0x09, 0x15, 0x64 };
+static const u8 W83627EHF_REG_FAN_STOP_TIME[] = { 0x0c, 0x0d, 0x17, 0x66 };
+static const u8 W83627EHF_REG_FAN_MAX_OUTPUT[] = { 0xff, 0x67, 0xff, 0x69 };
+static const u8 W83627EHF_REG_FAN_STEP_OUTPUT[] = { 0xff, 0x68, 0xff, 0x6a };
 
 /*
  * Conversions
@@ -295,14 +301,19 @@ struct w83627ehf_data {
 
 	u8 pwm_mode[4]; /* 0->DC variable voltage, 1->PWM variable duty cycle */
 	u8 pwm_enable[4]; /* 1->manual
-			     2->thermal cruise (also called SmartFan I) */
+			     2->thermal cruise mode (also called SmartFan I)
+			     3->fan speed cruise mode
+			     4->variable thermal cruise (also called SmartFan III) */
 	u8 pwm_num;		/* number of pwm */
 	u8 pwm[4];
 	u8 target_temp[4];
 	u8 tolerance[4];
 
-	u8 fan_min_output[4]; /* minimum fan speed */
-	u8 fan_stop_time[4];
+	u8 fan_start_output[4]; /* minimum fan speed when spinning up */
+	u8 fan_stop_output[4]; /* minimum fan speed when spinning down */
+	u8 fan_stop_time[4]; /* time at minimum before disabling fan */
+	u8 fan_max_output[4]; /* maximum fan speed */
+	u8 fan_step_output[4]; /* rate of change output value */
 
 	u8 vid;
 	u8 vrm;
@@ -529,8 +540,10 @@ static struct w83627ehf_data *w83627ehf_update_device(struct device *dev)
 						& 3) + 1;
 			data->pwm[i] = w83627ehf_read_value(data,
 						W83627EHF_REG_PWM[i]);
-			data->fan_min_output[i] = w83627ehf_read_value(data,
-						W83627EHF_REG_FAN_MIN_OUTPUT[i]);
+			data->fan_start_output[i] = w83627ehf_read_value(data,
+						W83627EHF_REG_FAN_START_OUTPUT[i]);
+			data->fan_stop_output[i] = w83627ehf_read_value(data,
+						W83627EHF_REG_FAN_STOP_OUTPUT[i]);
 			data->fan_stop_time[i] = w83627ehf_read_value(data,
 						W83627EHF_REG_FAN_STOP_TIME[i]);
 			data->target_temp[i] =
@@ -976,7 +989,7 @@ store_pwm_enable(struct device *dev, struct device_attribute *attr,
 	u32 val = simple_strtoul(buf, NULL, 10);
 	u16 reg;
 
-	if (!val || (val > 2))	/* only modes 1 and 2 are supported */
+	if (!val || (val > 4))
 		return -EINVAL;
 	mutex_lock(&data->update_lock);
 	reg = w83627ehf_read_value(data, W83627EHF_REG_PWM_ENABLE[nr]);
@@ -1118,7 +1131,10 @@ store_##reg(struct device *dev, struct device_attribute *attr, \
 	return count; \
 }
 
-fan_functions(fan_min_output, FAN_MIN_OUTPUT)
+fan_functions(fan_start_output, FAN_START_OUTPUT)
+fan_functions(fan_stop_output, FAN_STOP_OUTPUT)
+fan_functions(fan_max_output, FAN_MAX_OUTPUT)
+fan_functions(fan_step_output, FAN_STEP_OUTPUT)
 
 #define fan_time_functions(reg, REG) \
 static ssize_t show_##reg(struct device *dev, struct device_attribute *attr, \
@@ -1161,8 +1177,14 @@ static DEVICE_ATTR(name, S_IRUGO, show_name, NULL);
 static struct sensor_device_attribute sda_sf3_arrays_fan4[] = {
 	SENSOR_ATTR(pwm4_stop_time, S_IWUSR | S_IRUGO, show_fan_stop_time,
 		    store_fan_stop_time, 3),
-	SENSOR_ATTR(pwm4_min_output, S_IWUSR | S_IRUGO, show_fan_min_output,
-		    store_fan_min_output, 3),
+	SENSOR_ATTR(pwm4_start_output, S_IWUSR | S_IRUGO, show_fan_start_output,
+		    store_fan_start_output, 3),
+	SENSOR_ATTR(pwm4_stop_output, S_IWUSR | S_IRUGO, show_fan_stop_output,
+		    store_fan_stop_output, 3),
+	SENSOR_ATTR(pwm4_max_output, S_IWUSR | S_IRUGO, show_fan_max_output,
+		    store_fan_max_output, 3),
+	SENSOR_ATTR(pwm4_step_output, S_IWUSR | S_IRUGO, show_fan_step_output,
+		    store_fan_step_output, 3),
 };
 
 static struct sensor_device_attribute sda_sf3_arrays[] = {
@@ -1172,12 +1194,24 @@ static struct sensor_device_attribute sda_sf3_arrays[] = {
 		    store_fan_stop_time, 1),
 	SENSOR_ATTR(pwm3_stop_time, S_IWUSR | S_IRUGO, show_fan_stop_time,
 		    store_fan_stop_time, 2),
-	SENSOR_ATTR(pwm1_min_output, S_IWUSR | S_IRUGO, show_fan_min_output,
-		    store_fan_min_output, 0),
-	SENSOR_ATTR(pwm2_min_output, S_IWUSR | S_IRUGO, show_fan_min_output,
-		    store_fan_min_output, 1),
-	SENSOR_ATTR(pwm3_min_output, S_IWUSR | S_IRUGO, show_fan_min_output,
-		    store_fan_min_output, 2),
+	SENSOR_ATTR(pwm1_start_output, S_IWUSR | S_IRUGO, show_fan_start_output,
+		    store_fan_start_output, 0),
+	SENSOR_ATTR(pwm2_start_output, S_IWUSR | S_IRUGO, show_fan_start_output,
+		    store_fan_start_output, 1),
+	SENSOR_ATTR(pwm3_start_output, S_IWUSR | S_IRUGO, show_fan_start_output,
+		    store_fan_start_output, 2),
+	SENSOR_ATTR(pwm1_stop_output, S_IWUSR | S_IRUGO, show_fan_stop_output,
+		    store_fan_stop_output, 0),
+	SENSOR_ATTR(pwm2_stop_output, S_IWUSR | S_IRUGO, show_fan_stop_output,
+		    store_fan_stop_output, 1),
+	SENSOR_ATTR(pwm3_stop_output, S_IWUSR | S_IRUGO, show_fan_stop_output,
+		    store_fan_stop_output, 2),
+
+	/* pwm1 and pwm3 don't support max and step settings */
+	SENSOR_ATTR(pwm2_max_output, S_IWUSR | S_IRUGO, show_fan_max_output,
+		    store_fan_max_output, 1),
+	SENSOR_ATTR(pwm2_step_output, S_IWUSR | S_IRUGO, show_fan_step_output,
+		    store_fan_step_output, 1),
 };
 
 static ssize_t
diff --git a/drivers/hwmon/w83627hf.c b/drivers/hwmon/w83627hf.c
index 2be28ac4ede0..38e280523071 100644
--- a/drivers/hwmon/w83627hf.c
+++ b/drivers/hwmon/w83627hf.c
@@ -59,10 +59,11 @@ static struct platform_device *pdev;
 #define DRVNAME "w83627hf"
 enum chips { w83627hf, w83627thf, w83697hf, w83637hf, w83687thf };
 
-static u16 force_addr;
-module_param(force_addr, ushort, 0);
-MODULE_PARM_DESC(force_addr,
-		 "Initialize the base address of the sensors");
+struct w83627hf_sio_data {
+	enum chips type;
+	int sioaddr;
+};
+
 static u8 force_i2c = 0x1f;
 module_param(force_i2c, byte, 0);
 MODULE_PARM_DESC(force_i2c,
@@ -77,9 +78,7 @@ module_param(force_id, ushort, 0);
 MODULE_PARM_DESC(force_id, "Override the detected device ID");
 
 /* modified from kernel/include/traps.c */
-static int REG;		/* The register to read/write */
 #define	DEV	0x07	/* Register: Logical device select */
-static int VAL;		/* The value to read/write */
 
 /* logical device numbers for superio_select (below) */
 #define W83627HF_LD_FDC		0x00
@@ -109,37 +108,37 @@ static int VAL;		/* The value to read/write */
 #define W83687THF_VID_DATA	0xF1 /* w83687thf only */
 
 static inline void
-superio_outb(int reg, int val)
+superio_outb(struct w83627hf_sio_data *sio, int reg, int val)
 {
-	outb(reg, REG);
-	outb(val, VAL);
+	outb(reg, sio->sioaddr);
+	outb(val, sio->sioaddr + 1);
 }
 
 static inline int
-superio_inb(int reg)
+superio_inb(struct w83627hf_sio_data *sio, int reg)
 {
-	outb(reg, REG);
-	return inb(VAL);
+	outb(reg, sio->sioaddr);
+	return inb(sio->sioaddr + 1);
 }
 
 static inline void
-superio_select(int ld)
+superio_select(struct w83627hf_sio_data *sio, int ld)
 {
-	outb(DEV, REG);
-	outb(ld, VAL);
+	outb(DEV, sio->sioaddr);
+	outb(ld,  sio->sioaddr + 1);
 }
 
 static inline void
-superio_enter(void)
+superio_enter(struct w83627hf_sio_data *sio)
 {
-	outb(0x87, REG);
-	outb(0x87, REG);
+	outb(0x87, sio->sioaddr);
+	outb(0x87, sio->sioaddr);
 }
 
 static inline void
-superio_exit(void)
+superio_exit(struct w83627hf_sio_data *sio)
 {
-	outb(0xAA, REG);
+	outb(0xAA, sio->sioaddr);
 }
 
 #define W627_DEVID 0x52
@@ -380,10 +379,6 @@ struct w83627hf_data {
 	u8 vrm_ovt;		/* Register value, 627THF/637HF/687THF only */
 };
 
-struct w83627hf_sio_data {
-	enum chips type;
-};
-
 
 static int w83627hf_probe(struct platform_device *pdev);
 static int __devexit w83627hf_remove(struct platform_device *pdev);
@@ -1140,11 +1135,9 @@ static int __init w83627hf_find(int sioaddr, unsigned short *addr,
 		"W83687THF",
 	};
 
-	REG = sioaddr;
-	VAL = sioaddr + 1;
-
-	superio_enter();
-	val = force_id ? force_id : superio_inb(DEVID);
+	sio_data->sioaddr = sioaddr;
+	superio_enter(sio_data);
+	val = force_id ? force_id : superio_inb(sio_data, DEVID);
 	switch (val) {
 	case W627_DEVID:
 		sio_data->type = w83627hf;
@@ -1168,16 +1161,9 @@ static int __init w83627hf_find(int sioaddr, unsigned short *addr,
 		goto exit;
 	}
 
-	superio_select(W83627HF_LD_HWM);
-	force_addr &= WINB_ALIGNMENT;
-	if (force_addr) {
-		printk(KERN_WARNING DRVNAME ": Forcing address 0x%x\n",
-		       force_addr);
-		superio_outb(WINB_BASE_REG, force_addr >> 8);
-		superio_outb(WINB_BASE_REG + 1, force_addr & 0xff);
-	}
-	val = (superio_inb(WINB_BASE_REG) << 8) |
-	       superio_inb(WINB_BASE_REG + 1);
+	superio_select(sio_data, W83627HF_LD_HWM);
+	val = (superio_inb(sio_data, WINB_BASE_REG) << 8) |
+	       superio_inb(sio_data, WINB_BASE_REG + 1);
 	*addr = val & WINB_ALIGNMENT;
 	if (*addr == 0) {
 		printk(KERN_WARNING DRVNAME ": Base address not set, "
@@ -1185,10 +1171,10 @@ static int __init w83627hf_find(int sioaddr, unsigned short *addr,
 		goto exit;
 	}
 
-	val = superio_inb(WINB_ACT_REG);
+	val = superio_inb(sio_data, WINB_ACT_REG);
 	if (!(val & 0x01)) {
 		printk(KERN_WARNING DRVNAME ": Enabling HWM logical device\n");
-		superio_outb(WINB_ACT_REG, val | 0x01);
+		superio_outb(sio_data, WINB_ACT_REG, val | 0x01);
 	}
 
 	err = 0;
@@ -1196,7 +1182,7 @@ static int __init w83627hf_find(int sioaddr, unsigned short *addr,
 		names[sio_data->type], *addr);
 
  exit:
-	superio_exit();
+	superio_exit(sio_data);
 	return err;
 }
 
@@ -1511,20 +1497,21 @@ static int w83627hf_read_value(struct w83627hf_data *data, u16 reg)
 
 static int __devinit w83627thf_read_gpio5(struct platform_device *pdev)
 {
+	struct w83627hf_sio_data *sio_data = pdev->dev.platform_data;
 	int res = 0xff, sel;
 
-	superio_enter();
-	superio_select(W83627HF_LD_GPIO5);
+	superio_enter(sio_data);
+	superio_select(sio_data, W83627HF_LD_GPIO5);
 
 	/* Make sure these GPIO pins are enabled */
-	if (!(superio_inb(W83627THF_GPIO5_EN) & (1<<3))) {
+	if (!(superio_inb(sio_data, W83627THF_GPIO5_EN) & (1<<3))) {
 		dev_dbg(&pdev->dev, "GPIO5 disabled, no VID function\n");
 		goto exit;
 	}
 
 	/* Make sure the pins are configured for input
 	   There must be at least five (VRM 9), and possibly 6 (VRM 10) */
-	sel = superio_inb(W83627THF_GPIO5_IOSR) & 0x3f;
+	sel = superio_inb(sio_data, W83627THF_GPIO5_IOSR) & 0x3f;
 	if ((sel & 0x1f) != 0x1f) {
 		dev_dbg(&pdev->dev, "GPIO5 not configured for VID "
 			"function\n");
@@ -1532,37 +1519,38 @@ static int __devinit w83627thf_read_gpio5(struct platform_device *pdev)
 	}
 
 	dev_info(&pdev->dev, "Reading VID from GPIO5\n");
-	res = superio_inb(W83627THF_GPIO5_DR) & sel;
+	res = superio_inb(sio_data, W83627THF_GPIO5_DR) & sel;
 
 exit:
-	superio_exit();
+	superio_exit(sio_data);
 	return res;
 }
 
 static int __devinit w83687thf_read_vid(struct platform_device *pdev)
 {
+	struct w83627hf_sio_data *sio_data = pdev->dev.platform_data;
 	int res = 0xff;
 
-	superio_enter();
-	superio_select(W83627HF_LD_HWM);
+	superio_enter(sio_data);
+	superio_select(sio_data, W83627HF_LD_HWM);
 
 	/* Make sure these GPIO pins are enabled */
-	if (!(superio_inb(W83687THF_VID_EN) & (1 << 2))) {
+	if (!(superio_inb(sio_data, W83687THF_VID_EN) & (1 << 2))) {
 		dev_dbg(&pdev->dev, "VID disabled, no VID function\n");
 		goto exit;
 	}
 
 	/* Make sure the pins are configured for input */
-	if (!(superio_inb(W83687THF_VID_CFG) & (1 << 4))) {
+	if (!(superio_inb(sio_data, W83687THF_VID_CFG) & (1 << 4))) {
 		dev_dbg(&pdev->dev, "VID configured as output, "
 			"no VID function\n");
 		goto exit;
 	}
 
-	res = superio_inb(W83687THF_VID_DATA) & 0x3f;
+	res = superio_inb(sio_data, W83687THF_VID_DATA) & 0x3f;
 
 exit:
-	superio_exit();
+	superio_exit(sio_data);
 	return res;
 }
 
diff --git a/drivers/hwmon/w83781d.c b/drivers/hwmon/w83781d.c
index d27ed1bac002..05f9225b6f94 100644
--- a/drivers/hwmon/w83781d.c
+++ b/drivers/hwmon/w83781d.c
@@ -56,9 +56,10 @@
 /* Addresses to scan */
 static const unsigned short normal_i2c[] = { 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d,
 						0x2e, 0x2f, I2C_CLIENT_END };
-/* Insmod parameters */
-I2C_CLIENT_INSMOD_4(w83781d, w83782d, w83783s, as99127f);
 
+enum chips { w83781d, w83782d, w83783s, as99127f };
+
+/* Insmod parameters */
 static unsigned short force_subclients[4];
 module_param_array(force_subclients, short, NULL, 0);
 MODULE_PARM_DESC(force_subclients, "List of subclient addresses: "
@@ -1051,14 +1052,13 @@ w83781d_create_files(struct device *dev, int kind, int is_isa)
 
 /* Return 0 if detection is successful, -ENODEV otherwise */
 static int
-w83781d_detect(struct i2c_client *client, int kind,
-	       struct i2c_board_info *info)
+w83781d_detect(struct i2c_client *client, struct i2c_board_info *info)
 {
-	int val1 = 0, val2;
+	int val1, val2;
 	struct w83781d_data *isa = w83781d_data_if_isa();
 	struct i2c_adapter *adapter = client->adapter;
 	int address = client->addr;
-	const char *client_name = "";
+	const char *client_name;
 	enum vendor { winbond, asus } vendid;
 
 	if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA))
@@ -1070,98 +1070,73 @@ w83781d_detect(struct i2c_client *client, int kind,
 	if (isa)
 		mutex_lock(&isa->update_lock);
 
-	/* The w8378?d may be stuck in some other bank than bank 0. This may
-	   make reading other information impossible. Specify a force=... or
-	   force_*=... parameter, and the Winbond will be reset to the right
-	   bank. */
-	if (kind < 0) {
-		if (i2c_smbus_read_byte_data
-		    (client, W83781D_REG_CONFIG) & 0x80) {
-			dev_dbg(&adapter->dev, "Detection of w83781d chip "
-				"failed at step 3\n");
-			goto err_nodev;
-		}
-		val1 = i2c_smbus_read_byte_data(client, W83781D_REG_BANK);
-		val2 = i2c_smbus_read_byte_data(client, W83781D_REG_CHIPMAN);
-		/* Check for Winbond or Asus ID if in bank 0 */
-		if ((!(val1 & 0x07)) &&
-		    (((!(val1 & 0x80)) && (val2 != 0xa3) && (val2 != 0xc3))
-		     || ((val1 & 0x80) && (val2 != 0x5c) && (val2 != 0x12)))) {
-			dev_dbg(&adapter->dev, "Detection of w83781d chip "
-				"failed at step 4\n");
+	if (i2c_smbus_read_byte_data(client, W83781D_REG_CONFIG) & 0x80) {
+		dev_dbg(&adapter->dev,
+			"Detection of w83781d chip failed at step 3\n");
+		goto err_nodev;
+	}
+
+	val1 = i2c_smbus_read_byte_data(client, W83781D_REG_BANK);
+	val2 = i2c_smbus_read_byte_data(client, W83781D_REG_CHIPMAN);
+	/* Check for Winbond or Asus ID if in bank 0 */
+	if (!(val1 & 0x07) &&
+	    ((!(val1 & 0x80) && val2 != 0xa3 && val2 != 0xc3) ||
+	     ( (val1 & 0x80) && val2 != 0x5c && val2 != 0x12))) {
+		dev_dbg(&adapter->dev,
+			"Detection of w83781d chip failed at step 4\n");
+		goto err_nodev;
+	}
+	/* If Winbond SMBus, check address at 0x48.
+	   Asus doesn't support, except for as99127f rev.2 */
+	if ((!(val1 & 0x80) && val2 == 0xa3) ||
+	    ( (val1 & 0x80) && val2 == 0x5c)) {
+		if (i2c_smbus_read_byte_data(client, W83781D_REG_I2C_ADDR)
+		    != address) {
+			dev_dbg(&adapter->dev,
+				"Detection of w83781d chip failed at step 5\n");
 			goto err_nodev;
 		}
-		/* If Winbond SMBus, check address at 0x48.
-		   Asus doesn't support, except for as99127f rev.2 */
-		if ((!(val1 & 0x80) && (val2 == 0xa3)) ||
-		    ((val1 & 0x80) && (val2 == 0x5c))) {
-			if (i2c_smbus_read_byte_data
-			    (client, W83781D_REG_I2C_ADDR) != address) {
-				dev_dbg(&adapter->dev, "Detection of w83781d "
-					"chip failed at step 5\n");
-				goto err_nodev;
-			}
-		}
 	}
 
-	/* We have either had a force parameter, or we have already detected the
-	   Winbond. Put it now into bank 0 and Vendor ID High Byte */
+	/* Put it now into bank 0 and Vendor ID High Byte */
 	i2c_smbus_write_byte_data(client, W83781D_REG_BANK,
 		(i2c_smbus_read_byte_data(client, W83781D_REG_BANK)
 		 & 0x78) | 0x80);
 
-	/* Determine the chip type. */
-	if (kind <= 0) {
-		/* get vendor ID */
-		val2 = i2c_smbus_read_byte_data(client, W83781D_REG_CHIPMAN);
-		if (val2 == 0x5c)
-			vendid = winbond;
-		else if (val2 == 0x12)
-			vendid = asus;
-		else {
-			dev_dbg(&adapter->dev, "w83781d chip vendor is "
-				"neither Winbond nor Asus\n");
-			goto err_nodev;
-		}
-
-		val1 = i2c_smbus_read_byte_data(client, W83781D_REG_WCHIPID);
-		if ((val1 == 0x10 || val1 == 0x11) && vendid == winbond)
-			kind = w83781d;
-		else if (val1 == 0x30 && vendid == winbond)
-			kind = w83782d;
-		else if (val1 == 0x40 && vendid == winbond && address == 0x2d)
-			kind = w83783s;
-		else if (val1 == 0x31)
-			kind = as99127f;
-		else {
-			if (kind == 0)
-				dev_warn(&adapter->dev, "Ignoring 'force' "
-					 "parameter for unknown chip at "
-					 "address 0x%02x\n", address);
-			goto err_nodev;
-		}
-
-		if ((kind == w83781d || kind == w83782d)
-		 && w83781d_alias_detect(client, val1)) {
-			dev_dbg(&adapter->dev, "Device at 0x%02x appears to "
-				"be the same as ISA device\n", address);
-			goto err_nodev;
-		}
+	/* Get the vendor ID */
+	val2 = i2c_smbus_read_byte_data(client, W83781D_REG_CHIPMAN);
+	if (val2 == 0x5c)
+		vendid = winbond;
+	else if (val2 == 0x12)
+		vendid = asus;
+	else {
+		dev_dbg(&adapter->dev,
+			"w83781d chip vendor is neither Winbond nor Asus\n");
+		goto err_nodev;
 	}
 
-	if (isa)
-		mutex_unlock(&isa->update_lock);
-
-	if (kind == w83781d) {
+	/* Determine the chip type. */
+	val1 = i2c_smbus_read_byte_data(client, W83781D_REG_WCHIPID);
+	if ((val1 == 0x10 || val1 == 0x11) && vendid == winbond)
 		client_name = "w83781d";
-	} else if (kind == w83782d) {
+	else if (val1 == 0x30 && vendid == winbond)
 		client_name = "w83782d";
-	} else if (kind == w83783s) {
+	else if (val1 == 0x40 && vendid == winbond && address == 0x2d)
 		client_name = "w83783s";
-	} else if (kind == as99127f) {
+	else if (val1 == 0x31)
 		client_name = "as99127f";
+	else
+		goto err_nodev;
+
+	if (val1 <= 0x30 && w83781d_alias_detect(client, val1)) {
+		dev_dbg(&adapter->dev, "Device at 0x%02x appears to "
+			"be the same as ISA device\n", address);
+		goto err_nodev;
 	}
 
+	if (isa)
+		mutex_unlock(&isa->update_lock);
+
 	strlcpy(info->type, client_name, I2C_NAME_SIZE);
 
 	return 0;
@@ -1562,7 +1537,7 @@ static struct i2c_driver w83781d_driver = {
 	.remove		= w83781d_remove,
 	.id_table	= w83781d_ids,
 	.detect		= w83781d_detect,
-	.address_data	= &addr_data,
+	.address_list	= normal_i2c,
 };
 
 /*
diff --git a/drivers/hwmon/w83791d.c b/drivers/hwmon/w83791d.c
index 97851c5ba3a3..400a88bde278 100644
--- a/drivers/hwmon/w83791d.c
+++ b/drivers/hwmon/w83791d.c
@@ -52,7 +52,6 @@ static const unsigned short normal_i2c[] = { 0x2c, 0x2d, 0x2e, 0x2f,
 						I2C_CLIENT_END };
 
 /* Insmod parameters */
-I2C_CLIENT_INSMOD_1(w83791d);
 
 static unsigned short force_subclients[4];
 module_param_array(force_subclients, short, NULL, 0);
@@ -326,7 +325,7 @@ struct w83791d_data {
 
 static int w83791d_probe(struct i2c_client *client,
 			 const struct i2c_device_id *id);
-static int w83791d_detect(struct i2c_client *client, int kind,
+static int w83791d_detect(struct i2c_client *client,
 			  struct i2c_board_info *info);
 static int w83791d_remove(struct i2c_client *client);
 
@@ -341,7 +340,7 @@ static void w83791d_print_debug(struct w83791d_data *data, struct device *dev);
 static void w83791d_init_client(struct i2c_client *client);
 
 static const struct i2c_device_id w83791d_id[] = {
-	{ "w83791d", w83791d },
+	{ "w83791d", 0 },
 	{ }
 };
 MODULE_DEVICE_TABLE(i2c, w83791d_id);
@@ -355,7 +354,7 @@ static struct i2c_driver w83791d_driver = {
 	.remove		= w83791d_remove,
 	.id_table	= w83791d_id,
 	.detect		= w83791d_detect,
-	.address_data	= &addr_data,
+	.address_list	= normal_i2c,
 };
 
 /* following are the sysfs callback functions */
@@ -1259,7 +1258,7 @@ error_sc_0:
 
 
 /* Return 0 if detection is successful, -ENODEV otherwise */
-static int w83791d_detect(struct i2c_client *client, int kind,
+static int w83791d_detect(struct i2c_client *client,
 			  struct i2c_board_info *info)
 {
 	struct i2c_adapter *adapter = client->adapter;
@@ -1270,56 +1269,32 @@ static int w83791d_detect(struct i2c_client *client, int kind,
 		return -ENODEV;
 	}
 
-	/* The w83791d may be stuck in some other bank than bank 0. This may
-	   make reading other information impossible. Specify a force=...
-	   parameter, and the Winbond will be reset to the right bank. */
-	if (kind < 0) {
-		if (w83791d_read(client, W83791D_REG_CONFIG) & 0x80) {
-			return -ENODEV;
-		}
-		val1 = w83791d_read(client, W83791D_REG_BANK);
-		val2 = w83791d_read(client, W83791D_REG_CHIPMAN);
-		/* Check for Winbond ID if in bank 0 */
-		if (!(val1 & 0x07)) {
-			/* yes it is Bank0 */
-			if (((!(val1 & 0x80)) && (val2 != 0xa3)) ||
-			    ((val1 & 0x80) && (val2 != 0x5c))) {
-				return -ENODEV;
-			}
-		}
-		/* If Winbond chip, address of chip and W83791D_REG_I2C_ADDR
-		   should match */
-		if (w83791d_read(client, W83791D_REG_I2C_ADDR) != address) {
+	if (w83791d_read(client, W83791D_REG_CONFIG) & 0x80)
+		return -ENODEV;
+
+	val1 = w83791d_read(client, W83791D_REG_BANK);
+	val2 = w83791d_read(client, W83791D_REG_CHIPMAN);
+	/* Check for Winbond ID if in bank 0 */
+	if (!(val1 & 0x07)) {
+		if ((!(val1 & 0x80) && val2 != 0xa3) ||
+		    ( (val1 & 0x80) && val2 != 0x5c)) {
 			return -ENODEV;
 		}
 	}
+	/* If Winbond chip, address of chip and W83791D_REG_I2C_ADDR
+	   should match */
+	if (w83791d_read(client, W83791D_REG_I2C_ADDR) != address)
+		return -ENODEV;
 
-	/* We either have a force parameter or we have reason to
-	   believe it is a Winbond chip. Either way, we want bank 0 and
-	   Vendor ID high byte */
+	/* We want bank 0 and Vendor ID high byte */
 	val1 = w83791d_read(client, W83791D_REG_BANK) & 0x78;
 	w83791d_write(client, W83791D_REG_BANK, val1 | 0x80);
 
 	/* Verify it is a Winbond w83791d */
-	if (kind <= 0) {
-		/* get vendor ID */
-		val2 = w83791d_read(client, W83791D_REG_CHIPMAN);
-		if (val2 != 0x5c) {	/* the vendor is NOT Winbond */
-			return -ENODEV;
-		}
-		val1 = w83791d_read(client, W83791D_REG_WCHIPID);
-		if (val1 == 0x71) {
-			kind = w83791d;
-		} else {
-			if (kind == 0)
-				dev_warn(&adapter->dev,
-					"w83791d: Ignoring 'force' parameter "
-					"for unknown chip at adapter %d, "
-					"address 0x%02x\n",
-					i2c_adapter_id(adapter), address);
-			return -ENODEV;
-		}
-	}
+	val1 = w83791d_read(client, W83791D_REG_WCHIPID);
+	val2 = w83791d_read(client, W83791D_REG_CHIPMAN);
+	if (val1 != 0x71 || val2 != 0x5c)
+		return -ENODEV;
 
 	strlcpy(info->type, "w83791d", I2C_NAME_SIZE);
 
diff --git a/drivers/hwmon/w83792d.c b/drivers/hwmon/w83792d.c
index 2be16194ddf3..679718e6b017 100644
--- a/drivers/hwmon/w83792d.c
+++ b/drivers/hwmon/w83792d.c
@@ -50,7 +50,6 @@ static const unsigned short normal_i2c[] = { 0x2c, 0x2d, 0x2e, 0x2f,
 						I2C_CLIENT_END };
 
 /* Insmod parameters */
-I2C_CLIENT_INSMOD_1(w83792d);
 
 static unsigned short force_subclients[4];
 module_param_array(force_subclients, short, NULL, 0);
@@ -302,7 +301,7 @@ struct w83792d_data {
 
 static int w83792d_probe(struct i2c_client *client,
 			 const struct i2c_device_id *id);
-static int w83792d_detect(struct i2c_client *client, int kind,
+static int w83792d_detect(struct i2c_client *client,
 			  struct i2c_board_info *info);
 static int w83792d_remove(struct i2c_client *client);
 static struct w83792d_data *w83792d_update_device(struct device *dev);
@@ -314,7 +313,7 @@ static void w83792d_print_debug(struct w83792d_data *data, struct device *dev);
 static void w83792d_init_client(struct i2c_client *client);
 
 static const struct i2c_device_id w83792d_id[] = {
-	{ "w83792d", w83792d },
+	{ "w83792d", 0 },
 	{ }
 };
 MODULE_DEVICE_TABLE(i2c, w83792d_id);
@@ -328,7 +327,7 @@ static struct i2c_driver w83792d_driver = {
 	.remove		= w83792d_remove,
 	.id_table	= w83792d_id,
 	.detect		= w83792d_detect,
-	.address_data	= &addr_data,
+	.address_list	= normal_i2c,
 };
 
 static inline long in_count_from_reg(int nr, struct w83792d_data *data)
@@ -1263,7 +1262,7 @@ static const struct attribute_group w83792d_group = {
 
 /* Return 0 if detection is successful, -ENODEV otherwise */
 static int
-w83792d_detect(struct i2c_client *client, int kind, struct i2c_board_info *info)
+w83792d_detect(struct i2c_client *client, struct i2c_board_info *info)
 {
 	struct i2c_adapter *adapter = client->adapter;
 	int val1, val2;
@@ -1273,58 +1272,33 @@ w83792d_detect(struct i2c_client *client, int kind, struct i2c_board_info *info)
 		return -ENODEV;
 	}
 
-	/* The w83792d may be stuck in some other bank than bank 0. This may
-	   make reading other information impossible. Specify a force=... or
-	   force_*=... parameter, and the Winbond will be reset to the right
-	   bank. */
-	if (kind < 0) {
-		if (w83792d_read_value(client, W83792D_REG_CONFIG) & 0x80) {
-			return -ENODEV;
-		}
-		val1 = w83792d_read_value(client, W83792D_REG_BANK);
-		val2 = w83792d_read_value(client, W83792D_REG_CHIPMAN);
-		/* Check for Winbond ID if in bank 0 */
-		if (!(val1 & 0x07)) {  /* is Bank0 */
-			if (((!(val1 & 0x80)) && (val2 != 0xa3)) ||
-			     ((val1 & 0x80) && (val2 != 0x5c))) {
-				return -ENODEV;
-			}
-		}
-		/* If Winbond chip, address of chip and W83792D_REG_I2C_ADDR
-		   should match */
-		if (w83792d_read_value(client,
-					W83792D_REG_I2C_ADDR) != address) {
+	if (w83792d_read_value(client, W83792D_REG_CONFIG) & 0x80)
+		return -ENODEV;
+
+	val1 = w83792d_read_value(client, W83792D_REG_BANK);
+	val2 = w83792d_read_value(client, W83792D_REG_CHIPMAN);
+	/* Check for Winbond ID if in bank 0 */
+	if (!(val1 & 0x07)) {  /* is Bank0 */
+		if ((!(val1 & 0x80) && val2 != 0xa3) ||
+		    ( (val1 & 0x80) && val2 != 0x5c))
 			return -ENODEV;
-		}
 	}
+	/* If Winbond chip, address of chip and W83792D_REG_I2C_ADDR
+	   should match */
+	if (w83792d_read_value(client, W83792D_REG_I2C_ADDR) != address)
+		return -ENODEV;
 
-	/* We have either had a force parameter, or we have already detected the
-	   Winbond. Put it now into bank 0 and Vendor ID High Byte */
+	/*  Put it now into bank 0 and Vendor ID High Byte */
 	w83792d_write_value(client,
 			    W83792D_REG_BANK,
 			    (w83792d_read_value(client,
 				W83792D_REG_BANK) & 0x78) | 0x80);
 
 	/* Determine the chip type. */
-	if (kind <= 0) {
-		/* get vendor ID */
-		val2 = w83792d_read_value(client, W83792D_REG_CHIPMAN);
-		if (val2 != 0x5c) {  /* the vendor is NOT Winbond */
-			return -ENODEV;
-		}
-		val1 = w83792d_read_value(client, W83792D_REG_WCHIPID);
-		if (val1 == 0x7a) {
-			kind = w83792d;
-		} else {
-			if (kind == 0)
-				dev_warn(&adapter->dev,
-					"w83792d: Ignoring 'force' parameter for"
-					" unknown chip at adapter %d, address"
-					" 0x%02x\n", i2c_adapter_id(adapter),
-					address);
-			return -ENODEV;
-		}
-	}
+	val1 = w83792d_read_value(client, W83792D_REG_WCHIPID);
+	val2 = w83792d_read_value(client, W83792D_REG_CHIPMAN);
+	if (val1 != 0x7a || val2 != 0x5c)
+		return -ENODEV;
 
 	strlcpy(info->type, "w83792d", I2C_NAME_SIZE);
 
diff --git a/drivers/hwmon/w83793.c b/drivers/hwmon/w83793.c
index 47dd398f7258..9a2022b67495 100644
--- a/drivers/hwmon/w83793.c
+++ b/drivers/hwmon/w83793.c
@@ -41,7 +41,6 @@ static const unsigned short normal_i2c[] = { 0x2c, 0x2d, 0x2e, 0x2f,
 						I2C_CLIENT_END };
 
 /* Insmod parameters */
-I2C_CLIENT_INSMOD_1(w83793);
 
 static unsigned short force_subclients[4];
 module_param_array(force_subclients, short, NULL, 0);
@@ -230,7 +229,7 @@ static u8 w83793_read_value(struct i2c_client *client, u16 reg);
 static int w83793_write_value(struct i2c_client *client, u16 reg, u8 value);
 static int w83793_probe(struct i2c_client *client,
 			const struct i2c_device_id *id);
-static int w83793_detect(struct i2c_client *client, int kind,
+static int w83793_detect(struct i2c_client *client,
 			 struct i2c_board_info *info);
 static int w83793_remove(struct i2c_client *client);
 static void w83793_init_client(struct i2c_client *client);
@@ -238,7 +237,7 @@ static void w83793_update_nonvolatile(struct device *dev);
 static struct w83793_data *w83793_update_device(struct device *dev);
 
 static const struct i2c_device_id w83793_id[] = {
-	{ "w83793", w83793 },
+	{ "w83793", 0 },
 	{ }
 };
 MODULE_DEVICE_TABLE(i2c, w83793_id);
@@ -252,7 +251,7 @@ static struct i2c_driver w83793_driver = {
 	.remove		= w83793_remove,
 	.id_table	= w83793_id,
 	.detect		= w83793_detect,
-	.address_data	= &addr_data,
+	.address_list	= normal_i2c,
 };
 
 static ssize_t
@@ -1161,10 +1160,10 @@ ERROR_SC_0:
 }
 
 /* Return 0 if detection is successful, -ENODEV otherwise */
-static int w83793_detect(struct i2c_client *client, int kind,
+static int w83793_detect(struct i2c_client *client,
 			 struct i2c_board_info *info)
 {
-	u8 tmp, bank;
+	u8 tmp, bank, chip_id;
 	struct i2c_adapter *adapter = client->adapter;
 	unsigned short address = client->addr;
 
@@ -1174,44 +1173,27 @@ static int w83793_detect(struct i2c_client *client, int kind,
 
 	bank = i2c_smbus_read_byte_data(client, W83793_REG_BANKSEL);
 
-	if (kind < 0) {
-		tmp = bank & 0x80 ? 0x5c : 0xa3;
-		/* Check Winbond vendor ID */
-		if (tmp != i2c_smbus_read_byte_data(client,
-							W83793_REG_VENDORID)) {
-			pr_debug("w83793: Detection failed at check "
-				 "vendor id\n");
-			return -ENODEV;
-		}
-
-		/* If Winbond chip, address of chip and W83793_REG_I2C_ADDR
-		   should match */
-		if ((bank & 0x07) == 0
-		 && i2c_smbus_read_byte_data(client, W83793_REG_I2C_ADDR) !=
-		    (address << 1)) {
-			pr_debug("w83793: Detection failed at check "
-				 "i2c addr\n");
-			return -ENODEV;
-		}
-
+	tmp = bank & 0x80 ? 0x5c : 0xa3;
+	/* Check Winbond vendor ID */
+	if (tmp != i2c_smbus_read_byte_data(client, W83793_REG_VENDORID)) {
+		pr_debug("w83793: Detection failed at check vendor id\n");
+		return -ENODEV;
 	}
 
-	/* We have either had a force parameter, or we have already detected the
-	   Winbond. Determine the chip type now */
-
-	if (kind <= 0) {
-		if (0x7b == i2c_smbus_read_byte_data(client,
-						     W83793_REG_CHIPID)) {
-			kind = w83793;
-		} else {
-			if (kind == 0)
-				dev_warn(&adapter->dev, "w83793: Ignoring "
-					 "'force' parameter for unknown chip "
-					 "at address 0x%02x\n", address);
-			return -ENODEV;
-		}
+	/* If Winbond chip, address of chip and W83793_REG_I2C_ADDR
+	   should match */
+	if ((bank & 0x07) == 0
+	 && i2c_smbus_read_byte_data(client, W83793_REG_I2C_ADDR) !=
+	    (address << 1)) {
+		pr_debug("w83793: Detection failed at check i2c addr\n");
+		return -ENODEV;
 	}
 
+	/* Determine the chip type now */
+	chip_id = i2c_smbus_read_byte_data(client, W83793_REG_CHIPID);
+	if (chip_id != 0x7b)
+		return -ENODEV;
+
 	strlcpy(info->type, "w83793", I2C_NAME_SIZE);
 
 	return 0;
diff --git a/drivers/hwmon/w83l785ts.c b/drivers/hwmon/w83l785ts.c
index ea295b9fc4f4..20781def65ed 100644
--- a/drivers/hwmon/w83l785ts.c
+++ b/drivers/hwmon/w83l785ts.c
@@ -1,7 +1,7 @@
 /*
  * w83l785ts.c - Part of lm_sensors, Linux kernel modules for hardware
  *               monitoring
- * Copyright (C) 2003-2004  Jean Delvare <khali@linux-fr.org>
+ * Copyright (C) 2003-2009  Jean Delvare <khali@linux-fr.org>
  *
  * Inspired from the lm83 driver. The W83L785TS-S is a sensor chip made
  * by Winbond. It reports a single external temperature with a 1 deg
@@ -52,12 +52,6 @@
 static const unsigned short normal_i2c[] = { 0x2e, I2C_CLIENT_END };
 
 /*
- * Insmod parameters
- */
-
-I2C_CLIENT_INSMOD_1(w83l785ts);
-
-/*
  * The W83L785TS-S registers
  * Manufacturer ID is 0x5CA3 for Winbond.
  */
@@ -83,7 +77,7 @@ I2C_CLIENT_INSMOD_1(w83l785ts);
 
 static int w83l785ts_probe(struct i2c_client *client,
 			   const struct i2c_device_id *id);
-static int w83l785ts_detect(struct i2c_client *client, int kind,
+static int w83l785ts_detect(struct i2c_client *client,
 			    struct i2c_board_info *info);
 static int w83l785ts_remove(struct i2c_client *client);
 static u8 w83l785ts_read_value(struct i2c_client *client, u8 reg, u8 defval);
@@ -94,7 +88,7 @@ static struct w83l785ts_data *w83l785ts_update_device(struct device *dev);
  */
  
 static const struct i2c_device_id w83l785ts_id[] = {
-	{ "w83l785ts", w83l785ts },
+	{ "w83l785ts", 0 },
 	{ }
 };
 MODULE_DEVICE_TABLE(i2c, w83l785ts_id);
@@ -108,7 +102,7 @@ static struct i2c_driver w83l785ts_driver = {
 	.remove		= w83l785ts_remove,
 	.id_table	= w83l785ts_id,
 	.detect		= w83l785ts_detect,
-	.address_data	= &addr_data,
+	.address_list	= normal_i2c,
 };
 
 /*
@@ -146,60 +140,36 @@ static SENSOR_DEVICE_ATTR(temp1_max, S_IRUGO, show_temp, NULL, 1);
  */
 
 /* Return 0 if detection is successful, -ENODEV otherwise */
-static int w83l785ts_detect(struct i2c_client *new_client, int kind,
+static int w83l785ts_detect(struct i2c_client *client,
 			    struct i2c_board_info *info)
 {
-	struct i2c_adapter *adapter = new_client->adapter;
+	struct i2c_adapter *adapter = client->adapter;
+	u16 man_id;
+	u8 chip_id;
 
 	if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA))
 		return -ENODEV;
 
-	/*
-	 * Now we do the remaining detection. A negative kind means that
-	 * the driver was loaded with no force parameter (default), so we
-	 * must both detect and identify the chip (actually there is only
-	 * one possible kind of chip for now, W83L785TS-S). A zero kind means
-	 * that the driver was loaded with the force parameter, the detection
-	 * step shall be skipped. A positive kind means that the driver
-	 * was loaded with the force parameter and a given kind of chip is
-	 * requested, so both the detection and the identification steps
-	 * are skipped.
-	 */
-	if (kind < 0) { /* detection */
-		if (((w83l785ts_read_value(new_client,
-		      W83L785TS_REG_CONFIG, 0) & 0x80) != 0x00)
-		 || ((w83l785ts_read_value(new_client,
-		      W83L785TS_REG_TYPE, 0) & 0xFC) != 0x00)) {
-			dev_dbg(&adapter->dev,
-				"W83L785TS-S detection failed at 0x%02x.\n",
-				new_client->addr);
-			return -ENODEV;
-		}
+	/* detection */
+	if ((w83l785ts_read_value(client, W83L785TS_REG_CONFIG, 0) & 0x80)
+	 || (w83l785ts_read_value(client, W83L785TS_REG_TYPE, 0) & 0xFC)) {
+		dev_dbg(&adapter->dev,
+			"W83L785TS-S detection failed at 0x%02x\n",
+			client->addr);
+		return -ENODEV;
 	}
 
-	if (kind <= 0) { /* identification */
-		u16 man_id;
-		u8 chip_id;
-
-		man_id = (w83l785ts_read_value(new_client,
-			 W83L785TS_REG_MAN_ID1, 0) << 8) +
-			 w83l785ts_read_value(new_client,
-			 W83L785TS_REG_MAN_ID2, 0);
-		chip_id = w83l785ts_read_value(new_client,
-			  W83L785TS_REG_CHIP_ID, 0);
-
-		if (man_id == 0x5CA3) { /* Winbond */
-			if (chip_id == 0x70) { /* W83L785TS-S */
-				kind = w83l785ts;			
-			}
-		}
-	
-		if (kind <= 0) { /* identification failed */
-			dev_info(&adapter->dev,
-				 "Unsupported chip (man_id=0x%04X, "
-				 "chip_id=0x%02X).\n", man_id, chip_id);
-			return -ENODEV;
-		}
+	/* Identification */
+	man_id = (w83l785ts_read_value(client, W83L785TS_REG_MAN_ID1, 0) << 8)
+	       + w83l785ts_read_value(client, W83L785TS_REG_MAN_ID2, 0);
+	chip_id = w83l785ts_read_value(client, W83L785TS_REG_CHIP_ID, 0);
+
+	if (man_id != 0x5CA3		/* Winbond */
+	 || chip_id != 0x70) {		/* W83L785TS-S */
+		dev_dbg(&adapter->dev,
+			"Unsupported chip (man_id=0x%04X, chip_id=0x%02X)\n",
+			man_id, chip_id);
+		return -ENODEV;
 	}
 
 	strlcpy(info->type, "w83l785ts", I2C_NAME_SIZE);
diff --git a/drivers/hwmon/w83l786ng.c b/drivers/hwmon/w83l786ng.c
index badca769f350..0254e181893d 100644
--- a/drivers/hwmon/w83l786ng.c
+++ b/drivers/hwmon/w83l786ng.c
@@ -38,7 +38,6 @@
 static const unsigned short normal_i2c[] = { 0x2e, 0x2f, I2C_CLIENT_END };
 
 /* Insmod parameters */
-I2C_CLIENT_INSMOD_1(w83l786ng);
 
 static int reset;
 module_param(reset, bool, 0);
@@ -147,14 +146,14 @@ struct w83l786ng_data {
 
 static int w83l786ng_probe(struct i2c_client *client,
 			   const struct i2c_device_id *id);
-static int w83l786ng_detect(struct i2c_client *client, int kind,
+static int w83l786ng_detect(struct i2c_client *client,
 			    struct i2c_board_info *info);
 static int w83l786ng_remove(struct i2c_client *client);
 static void w83l786ng_init_client(struct i2c_client *client);
 static struct w83l786ng_data *w83l786ng_update_device(struct device *dev);
 
 static const struct i2c_device_id w83l786ng_id[] = {
-	{ "w83l786ng", w83l786ng },
+	{ "w83l786ng", 0 },
 	{ }
 };
 MODULE_DEVICE_TABLE(i2c, w83l786ng_id);
@@ -168,7 +167,7 @@ static struct i2c_driver w83l786ng_driver = {
 	.remove		= w83l786ng_remove,
 	.id_table	= w83l786ng_id,
 	.detect		= w83l786ng_detect,
-	.address_data	= &addr_data,
+	.address_list	= normal_i2c,
 };
 
 static u8
@@ -586,57 +585,34 @@ static const struct attribute_group w83l786ng_group = {
 };
 
 static int
-w83l786ng_detect(struct i2c_client *client, int kind,
-		 struct i2c_board_info *info)
+w83l786ng_detect(struct i2c_client *client, struct i2c_board_info *info)
 {
 	struct i2c_adapter *adapter = client->adapter;
+	u16 man_id;
+	u8 chip_id;
 
 	if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA)) {
 		return -ENODEV;
 	}
 
-	/*
-	 * Now we do the remaining detection. A negative kind means that
-	 * the driver was loaded with no force parameter (default), so we
-	 * must both detect and identify the chip (actually there is only
-	 * one possible kind of chip for now, W83L786NG). A zero kind means
-	 * that the driver was loaded with the force parameter, the detection
-	 * step shall be skipped. A positive kind means that the driver
-	 * was loaded with the force parameter and a given kind of chip is
-	 * requested, so both the detection and the identification steps
-	 * are skipped.
-	 */
-	if (kind < 0) { /* detection */
-		if (((w83l786ng_read_value(client,
-		    W83L786NG_REG_CONFIG) & 0x80) != 0x00)) {
-			dev_dbg(&adapter->dev,
-				"W83L786NG detection failed at 0x%02x.\n",
-				client->addr);
-			return -ENODEV;
-		}
+	/* Detection */
+	if ((w83l786ng_read_value(client, W83L786NG_REG_CONFIG) & 0x80)) {
+		dev_dbg(&adapter->dev, "W83L786NG detection failed at 0x%02x\n",
+			client->addr);
+		return -ENODEV;
 	}
 
-	if (kind <= 0) { /* identification */
-		u16 man_id;
-		u8 chip_id;
-
-		man_id = (w83l786ng_read_value(client,
-		    W83L786NG_REG_MAN_ID1) << 8) +
-		    w83l786ng_read_value(client, W83L786NG_REG_MAN_ID2);
-		chip_id = w83l786ng_read_value(client, W83L786NG_REG_CHIP_ID);
-
-		if (man_id == 0x5CA3) { /* Winbond */
-			if (chip_id == 0x80) { /* W83L786NG */
-				kind = w83l786ng;
-			}
-		}
+	/* Identification */
+	man_id = (w83l786ng_read_value(client, W83L786NG_REG_MAN_ID1) << 8) +
+		 w83l786ng_read_value(client, W83L786NG_REG_MAN_ID2);
+	chip_id = w83l786ng_read_value(client, W83L786NG_REG_CHIP_ID);
 
-		if (kind <= 0) { /* identification failed */
-			dev_info(&adapter->dev,
-			    "Unsupported chip (man_id=0x%04X, "
-			    "chip_id=0x%02X).\n", man_id, chip_id);
-			return -ENODEV;
-		}
+	if (man_id != 0x5CA3 ||		/* Winbond */
+	    chip_id != 0x80) {		/* W83L786NG */
+		dev_dbg(&adapter->dev,
+			"Unsupported chip (man_id=0x%04X, chip_id=0x%02X)\n",
+			man_id, chip_id);
+		return -ENODEV;
 	}
 
 	strlcpy(info->type, "w83l786ng", I2C_NAME_SIZE);
diff --git a/drivers/i2c/busses/i2c-ali1563.c b/drivers/i2c/busses/i2c-ali1563.c
index f70f46582c6c..4687af40dd50 100644
--- a/drivers/i2c/busses/i2c-ali1563.c
+++ b/drivers/i2c/busses/i2c-ali1563.c
@@ -87,9 +87,9 @@ static int ali1563_transaction(struct i2c_adapter * a, int size)
 	outb_p(inb_p(SMB_HST_CNTL2) | HST_CNTL2_START, SMB_HST_CNTL2);
 
 	timeout = ALI1563_MAX_TIMEOUT;
-	do
+	do {
 		msleep(1);
-	while (((data = inb_p(SMB_HST_STS)) & HST_STS_BUSY) && --timeout);
+	} while (((data = inb_p(SMB_HST_STS)) & HST_STS_BUSY) && --timeout);
 
 	dev_dbg(&a->dev, "Transaction (post): STS=%02x, CNTL1=%02x, "
 		"CNTL2=%02x, CMD=%02x, ADD=%02x, DAT0=%02x, DAT1=%02x\n",
@@ -157,9 +157,9 @@ static int ali1563_block_start(struct i2c_adapter * a)
 	outb_p(inb_p(SMB_HST_CNTL2) | HST_CNTL2_START, SMB_HST_CNTL2);
 
 	timeout = ALI1563_MAX_TIMEOUT;
-	do
+	do {
 		msleep(1);
-	while (!((data = inb_p(SMB_HST_STS)) & HST_STS_DONE) && --timeout);
+	} while (!((data = inb_p(SMB_HST_STS)) & HST_STS_DONE) && --timeout);
 
 	dev_dbg(&a->dev, "Block (post): STS=%02x, CNTL1=%02x, "
 		"CNTL2=%02x, CMD=%02x, ADD=%02x, DAT0=%02x, DAT1=%02x\n",
diff --git a/drivers/i2c/busses/i2c-bfin-twi.c b/drivers/i2c/busses/i2c-bfin-twi.c
index b309ac2c3d5c..fe3fb567317d 100644
--- a/drivers/i2c/busses/i2c-bfin-twi.c
+++ b/drivers/i2c/busses/i2c-bfin-twi.c
@@ -693,13 +693,13 @@ static int i2c_bfin_twi_probe(struct platform_device *pdev)
 	}
 
 	/* Set TWI internal clock as 10MHz */
-	write_CONTROL(iface, ((get_sclk() / 1024 / 1024 + 5) / 10) & 0x7F);
+	write_CONTROL(iface, ((get_sclk() / 1000 / 1000 + 5) / 10) & 0x7F);
 
 	/*
 	 * We will not end up with a CLKDIV=0 because no one will specify
-	 * 20kHz SCL or less in Kconfig now. (5 * 1024 / 20 = 0x100)
+	 * 20kHz SCL or less in Kconfig now. (5 * 1000 / 20 = 250)
 	 */
-	clkhilow = 5 * 1024 / CONFIG_I2C_BLACKFIN_TWI_CLK_KHZ;
+	clkhilow = ((10 * 1000 / CONFIG_I2C_BLACKFIN_TWI_CLK_KHZ) + 1) / 2;
 
 	/* Set Twi interface clock as specified */
 	write_CLKDIV(iface, (clkhilow << 8) | clkhilow);
diff --git a/drivers/i2c/busses/i2c-designware.c b/drivers/i2c/busses/i2c-designware.c
index b444762e9b9f..9e18ef97f156 100644
--- a/drivers/i2c/busses/i2c-designware.c
+++ b/drivers/i2c/busses/i2c-designware.c
@@ -1,5 +1,5 @@
 /*
- * Synopsys Designware I2C adapter driver (master only).
+ * Synopsys DesignWare I2C adapter driver (master only).
  *
  * Based on the TI DAVINCI I2C adapter driver.
  *
@@ -49,7 +49,20 @@
 #define DW_IC_FS_SCL_LCNT	0x20
 #define DW_IC_INTR_STAT		0x2c
 #define DW_IC_INTR_MASK		0x30
+#define DW_IC_RAW_INTR_STAT	0x34
+#define DW_IC_RX_TL		0x38
+#define DW_IC_TX_TL		0x3c
 #define DW_IC_CLR_INTR		0x40
+#define DW_IC_CLR_RX_UNDER	0x44
+#define DW_IC_CLR_RX_OVER	0x48
+#define DW_IC_CLR_TX_OVER	0x4c
+#define DW_IC_CLR_RD_REQ	0x50
+#define DW_IC_CLR_TX_ABRT	0x54
+#define DW_IC_CLR_RX_DONE	0x58
+#define DW_IC_CLR_ACTIVITY	0x5c
+#define DW_IC_CLR_STOP_DET	0x60
+#define DW_IC_CLR_START_DET	0x64
+#define DW_IC_CLR_GEN_CALL	0x68
 #define DW_IC_ENABLE		0x6c
 #define DW_IC_STATUS		0x70
 #define DW_IC_TXFLR		0x74
@@ -64,9 +77,23 @@
 #define DW_IC_CON_RESTART_EN		0x20
 #define DW_IC_CON_SLAVE_DISABLE		0x40
 
-#define DW_IC_INTR_TX_EMPTY	0x10
-#define DW_IC_INTR_TX_ABRT	0x40
+#define DW_IC_INTR_RX_UNDER	0x001
+#define DW_IC_INTR_RX_OVER	0x002
+#define DW_IC_INTR_RX_FULL	0x004
+#define DW_IC_INTR_TX_OVER	0x008
+#define DW_IC_INTR_TX_EMPTY	0x010
+#define DW_IC_INTR_RD_REQ	0x020
+#define DW_IC_INTR_TX_ABRT	0x040
+#define DW_IC_INTR_RX_DONE	0x080
+#define DW_IC_INTR_ACTIVITY	0x100
 #define DW_IC_INTR_STOP_DET	0x200
+#define DW_IC_INTR_START_DET	0x400
+#define DW_IC_INTR_GEN_CALL	0x800
+
+#define DW_IC_INTR_DEFAULT_MASK		(DW_IC_INTR_RX_FULL | \
+					 DW_IC_INTR_TX_EMPTY | \
+					 DW_IC_INTR_TX_ABRT | \
+					 DW_IC_INTR_STOP_DET)
 
 #define DW_IC_STATUS_ACTIVITY	0x1
 
@@ -96,31 +123,49 @@
 #define ABRT_SBYTE_ACKDET	7
 #define ABRT_SBYTE_NORSTRT	9
 #define ABRT_10B_RD_NORSTRT	10
-#define ARB_MASTER_DIS		11
+#define ABRT_MASTER_DIS		11
 #define ARB_LOST		12
 
+#define DW_IC_TX_ABRT_7B_ADDR_NOACK	(1UL << ABRT_7B_ADDR_NOACK)
+#define DW_IC_TX_ABRT_10ADDR1_NOACK	(1UL << ABRT_10ADDR1_NOACK)
+#define DW_IC_TX_ABRT_10ADDR2_NOACK	(1UL << ABRT_10ADDR2_NOACK)
+#define DW_IC_TX_ABRT_TXDATA_NOACK	(1UL << ABRT_TXDATA_NOACK)
+#define DW_IC_TX_ABRT_GCALL_NOACK	(1UL << ABRT_GCALL_NOACK)
+#define DW_IC_TX_ABRT_GCALL_READ	(1UL << ABRT_GCALL_READ)
+#define DW_IC_TX_ABRT_SBYTE_ACKDET	(1UL << ABRT_SBYTE_ACKDET)
+#define DW_IC_TX_ABRT_SBYTE_NORSTRT	(1UL << ABRT_SBYTE_NORSTRT)
+#define DW_IC_TX_ABRT_10B_RD_NORSTRT	(1UL << ABRT_10B_RD_NORSTRT)
+#define DW_IC_TX_ABRT_MASTER_DIS	(1UL << ABRT_MASTER_DIS)
+#define DW_IC_TX_ARB_LOST		(1UL << ARB_LOST)
+
+#define DW_IC_TX_ABRT_NOACK		(DW_IC_TX_ABRT_7B_ADDR_NOACK | \
+					 DW_IC_TX_ABRT_10ADDR1_NOACK | \
+					 DW_IC_TX_ABRT_10ADDR2_NOACK | \
+					 DW_IC_TX_ABRT_TXDATA_NOACK | \
+					 DW_IC_TX_ABRT_GCALL_NOACK)
+
 static char *abort_sources[] = {
-	[ABRT_7B_ADDR_NOACK]	=
+	[ABRT_7B_ADDR_NOACK] =
 		"slave address not acknowledged (7bit mode)",
-	[ABRT_10ADDR1_NOACK]	=
+	[ABRT_10ADDR1_NOACK] =
 		"first address byte not acknowledged (10bit mode)",
-	[ABRT_10ADDR2_NOACK]	=
+	[ABRT_10ADDR2_NOACK] =
 		"second address byte not acknowledged (10bit mode)",
-	[ABRT_TXDATA_NOACK]		=
+	[ABRT_TXDATA_NOACK] =
 		"data not acknowledged",
-	[ABRT_GCALL_NOACK]		=
+	[ABRT_GCALL_NOACK] =
 		"no acknowledgement for a general call",
-	[ABRT_GCALL_READ]		=
+	[ABRT_GCALL_READ] =
 		"read after general call",
-	[ABRT_SBYTE_ACKDET]		=
+	[ABRT_SBYTE_ACKDET] =
 		"start byte acknowledged",
-	[ABRT_SBYTE_NORSTRT]	=
+	[ABRT_SBYTE_NORSTRT] =
 		"trying to send start byte when restart is disabled",
-	[ABRT_10B_RD_NORSTRT]	=
+	[ABRT_10B_RD_NORSTRT] =
 		"trying to read when restart is disabled (10bit mode)",
-	[ARB_MASTER_DIS]		=
+	[ABRT_MASTER_DIS] =
 		"trying to use disabled adapter",
-	[ARB_LOST]			=
+	[ARB_LOST] =
 		"lost arbitration",
 };
 
@@ -129,7 +174,6 @@ static char *abort_sources[] = {
  * @dev: driver model device node
  * @base: IO registers pointer
  * @cmd_complete: tx completion indicator
- * @pump_msg: continue in progress transfers
  * @lock: protect this struct and IO registers
  * @clk: input reference clock
  * @cmd_err: run time hadware error code
@@ -155,27 +199,81 @@ struct dw_i2c_dev {
 	struct device		*dev;
 	void __iomem		*base;
 	struct completion	cmd_complete;
-	struct tasklet_struct	pump_msg;
 	struct mutex		lock;
 	struct clk		*clk;
 	int			cmd_err;
 	struct i2c_msg		*msgs;
 	int			msgs_num;
 	int			msg_write_idx;
-	u16			tx_buf_len;
+	u32			tx_buf_len;
 	u8			*tx_buf;
 	int			msg_read_idx;
-	u16			rx_buf_len;
+	u32			rx_buf_len;
 	u8			*rx_buf;
 	int			msg_err;
 	unsigned int		status;
-	u16			abort_source;
+	u32			abort_source;
 	int			irq;
 	struct i2c_adapter	adapter;
 	unsigned int		tx_fifo_depth;
 	unsigned int		rx_fifo_depth;
 };
 
+static u32
+i2c_dw_scl_hcnt(u32 ic_clk, u32 tSYMBOL, u32 tf, int cond, int offset)
+{
+	/*
+	 * DesignWare I2C core doesn't seem to have solid strategy to meet
+	 * the tHD;STA timing spec.  Configuring _HCNT based on tHIGH spec
+	 * will result in violation of the tHD;STA spec.
+	 */
+	if (cond)
+		/*
+		 * Conditional expression:
+		 *
+		 *   IC_[FS]S_SCL_HCNT + (1+4+3) >= IC_CLK * tHIGH
+		 *
+		 * This is based on the DW manuals, and represents an ideal
+		 * configuration.  The resulting I2C bus speed will be
+		 * faster than any of the others.
+		 *
+		 * If your hardware is free from tHD;STA issue, try this one.
+		 */
+		return (ic_clk * tSYMBOL + 5000) / 10000 - 8 + offset;
+	else
+		/*
+		 * Conditional expression:
+		 *
+		 *   IC_[FS]S_SCL_HCNT + 3 >= IC_CLK * (tHD;STA + tf)
+		 *
+		 * This is just experimental rule; the tHD;STA period turned
+		 * out to be proportinal to (_HCNT + 3).  With this setting,
+		 * we could meet both tHIGH and tHD;STA timing specs.
+		 *
+		 * If unsure, you'd better to take this alternative.
+		 *
+		 * The reason why we need to take into account "tf" here,
+		 * is the same as described in i2c_dw_scl_lcnt().
+		 */
+		return (ic_clk * (tSYMBOL + tf) + 5000) / 10000 - 3 + offset;
+}
+
+static u32 i2c_dw_scl_lcnt(u32 ic_clk, u32 tLOW, u32 tf, int offset)
+{
+	/*
+	 * Conditional expression:
+	 *
+	 *   IC_[FS]S_SCL_LCNT + 1 >= IC_CLK * (tLOW + tf)
+	 *
+	 * DW I2C core starts counting the SCL CNTs for the LOW period
+	 * of the SCL clock (tLOW) as soon as it pulls the SCL line.
+	 * In order to meet the tLOW timing spec, we need to take into
+	 * account the fall time of SCL signal (tf).  Default tf value
+	 * should be 0.3 us, for safety.
+	 */
+	return ((ic_clk * (tLOW + tf) + 5000) / 10000) - 1 + offset;
+}
+
 /**
  * i2c_dw_init() - initialize the designware i2c master hardware
  * @dev: device private data
@@ -187,25 +285,49 @@ struct dw_i2c_dev {
 static void i2c_dw_init(struct dw_i2c_dev *dev)
 {
 	u32 input_clock_khz = clk_get_rate(dev->clk) / 1000;
-	u16 ic_con;
+	u32 ic_con, hcnt, lcnt;
 
 	/* Disable the adapter */
-	writeb(0, dev->base + DW_IC_ENABLE);
+	writel(0, dev->base + DW_IC_ENABLE);
 
 	/* set standard and fast speed deviders for high/low periods */
-	writew((input_clock_khz * 40 / 10000)+1, /* std speed high, 4us */
-			dev->base + DW_IC_SS_SCL_HCNT);
-	writew((input_clock_khz * 47 / 10000)+1, /* std speed low, 4.7us */
-			dev->base + DW_IC_SS_SCL_LCNT);
-	writew((input_clock_khz *  6 / 10000)+1, /* fast speed high, 0.6us */
-			dev->base + DW_IC_FS_SCL_HCNT);
-	writew((input_clock_khz * 13 / 10000)+1, /* fast speed low, 1.3us */
-			dev->base + DW_IC_FS_SCL_LCNT);
+
+	/* Standard-mode */
+	hcnt = i2c_dw_scl_hcnt(input_clock_khz,
+				40,	/* tHD;STA = tHIGH = 4.0 us */
+				3,	/* tf = 0.3 us */
+				0,	/* 0: DW default, 1: Ideal */
+				0);	/* No offset */
+	lcnt = i2c_dw_scl_lcnt(input_clock_khz,
+				47,	/* tLOW = 4.7 us */
+				3,	/* tf = 0.3 us */
+				0);	/* No offset */
+	writel(hcnt, dev->base + DW_IC_SS_SCL_HCNT);
+	writel(lcnt, dev->base + DW_IC_SS_SCL_LCNT);
+	dev_dbg(dev->dev, "Standard-mode HCNT:LCNT = %d:%d\n", hcnt, lcnt);
+
+	/* Fast-mode */
+	hcnt = i2c_dw_scl_hcnt(input_clock_khz,
+				6,	/* tHD;STA = tHIGH = 0.6 us */
+				3,	/* tf = 0.3 us */
+				0,	/* 0: DW default, 1: Ideal */
+				0);	/* No offset */
+	lcnt = i2c_dw_scl_lcnt(input_clock_khz,
+				13,	/* tLOW = 1.3 us */
+				3,	/* tf = 0.3 us */
+				0);	/* No offset */
+	writel(hcnt, dev->base + DW_IC_FS_SCL_HCNT);
+	writel(lcnt, dev->base + DW_IC_FS_SCL_LCNT);
+	dev_dbg(dev->dev, "Fast-mode HCNT:LCNT = %d:%d\n", hcnt, lcnt);
+
+	/* Configure Tx/Rx FIFO threshold levels */
+	writel(dev->tx_fifo_depth - 1, dev->base + DW_IC_TX_TL);
+	writel(0, dev->base + DW_IC_RX_TL);
 
 	/* configure the i2c master */
 	ic_con = DW_IC_CON_MASTER | DW_IC_CON_SLAVE_DISABLE |
 		DW_IC_CON_RESTART_EN | DW_IC_CON_SPEED_FAST;
-	writew(ic_con, dev->base + DW_IC_CON);
+	writel(ic_con, dev->base + DW_IC_CON);
 }
 
 /*
@@ -215,7 +337,7 @@ static int i2c_dw_wait_bus_not_busy(struct dw_i2c_dev *dev)
 {
 	int timeout = TIMEOUT;
 
-	while (readb(dev->base + DW_IC_STATUS) & DW_IC_STATUS_ACTIVITY) {
+	while (readl(dev->base + DW_IC_STATUS) & DW_IC_STATUS_ACTIVITY) {
 		if (timeout <= 0) {
 			dev_warn(dev->dev, "timeout waiting for bus ready\n");
 			return -ETIMEDOUT;
@@ -227,106 +349,125 @@ static int i2c_dw_wait_bus_not_busy(struct dw_i2c_dev *dev)
 	return 0;
 }
 
+static void i2c_dw_xfer_init(struct dw_i2c_dev *dev)
+{
+	struct i2c_msg *msgs = dev->msgs;
+	u32 ic_con;
+
+	/* Disable the adapter */
+	writel(0, dev->base + DW_IC_ENABLE);
+
+	/* set the slave (target) address */
+	writel(msgs[dev->msg_write_idx].addr, dev->base + DW_IC_TAR);
+
+	/* if the slave address is ten bit address, enable 10BITADDR */
+	ic_con = readl(dev->base + DW_IC_CON);
+	if (msgs[dev->msg_write_idx].flags & I2C_M_TEN)
+		ic_con |= DW_IC_CON_10BITADDR_MASTER;
+	else
+		ic_con &= ~DW_IC_CON_10BITADDR_MASTER;
+	writel(ic_con, dev->base + DW_IC_CON);
+
+	/* Enable the adapter */
+	writel(1, dev->base + DW_IC_ENABLE);
+
+	/* Enable interrupts */
+	writel(DW_IC_INTR_DEFAULT_MASK, dev->base + DW_IC_INTR_MASK);
+}
+
 /*
- * Initiate low level master read/write transaction.
- * This function is called from i2c_dw_xfer when starting a transfer.
- * This function is also called from dw_i2c_pump_msg to continue a transfer
- * that is longer than the size of the TX FIFO.
+ * Initiate (and continue) low level master read/write transaction.
+ * This function is only called from i2c_dw_isr, and pumping i2c_msg
+ * messages into the tx buffer.  Even if the size of i2c_msg data is
+ * longer than the size of the tx buffer, it handles everything.
  */
 static void
-i2c_dw_xfer_msg(struct i2c_adapter *adap)
+i2c_dw_xfer_msg(struct dw_i2c_dev *dev)
 {
-	struct dw_i2c_dev *dev = i2c_get_adapdata(adap);
 	struct i2c_msg *msgs = dev->msgs;
-	int num = dev->msgs_num;
-	u16 ic_con, intr_mask;
-	int tx_limit = dev->tx_fifo_depth - readb(dev->base + DW_IC_TXFLR);
-	int rx_limit = dev->rx_fifo_depth - readb(dev->base + DW_IC_RXFLR);
-	u16 addr = msgs[dev->msg_write_idx].addr;
-	u16 buf_len = dev->tx_buf_len;
-
-	if (!(dev->status & STATUS_WRITE_IN_PROGRESS)) {
-		/* Disable the adapter */
-		writeb(0, dev->base + DW_IC_ENABLE);
-
-		/* set the slave (target) address */
-		writew(msgs[dev->msg_write_idx].addr, dev->base + DW_IC_TAR);
+	u32 intr_mask;
+	int tx_limit, rx_limit;
+	u32 addr = msgs[dev->msg_write_idx].addr;
+	u32 buf_len = dev->tx_buf_len;
+	u8 *buf = dev->tx_buf;;
 
-		/* if the slave address is ten bit address, enable 10BITADDR */
-		ic_con = readw(dev->base + DW_IC_CON);
-		if (msgs[dev->msg_write_idx].flags & I2C_M_TEN)
-			ic_con |= DW_IC_CON_10BITADDR_MASTER;
-		else
-			ic_con &= ~DW_IC_CON_10BITADDR_MASTER;
-		writew(ic_con, dev->base + DW_IC_CON);
+	intr_mask = DW_IC_INTR_DEFAULT_MASK;
 
-		/* Enable the adapter */
-		writeb(1, dev->base + DW_IC_ENABLE);
-	}
-
-	for (; dev->msg_write_idx < num; dev->msg_write_idx++) {
-		/* if target address has changed, we need to
+	for (; dev->msg_write_idx < dev->msgs_num; dev->msg_write_idx++) {
+		/*
+		 * if target address has changed, we need to
 		 * reprogram the target address in the i2c
 		 * adapter when we are done with this transfer
 		 */
-		if (msgs[dev->msg_write_idx].addr != addr)
-			return;
+		if (msgs[dev->msg_write_idx].addr != addr) {
+			dev_err(dev->dev,
+				"%s: invalid target address\n", __func__);
+			dev->msg_err = -EINVAL;
+			break;
+		}
 
 		if (msgs[dev->msg_write_idx].len == 0) {
 			dev_err(dev->dev,
 				"%s: invalid message length\n", __func__);
 			dev->msg_err = -EINVAL;
-			return;
+			break;
 		}
 
 		if (!(dev->status & STATUS_WRITE_IN_PROGRESS)) {
 			/* new i2c_msg */
-			dev->tx_buf = msgs[dev->msg_write_idx].buf;
+			buf = msgs[dev->msg_write_idx].buf;
 			buf_len = msgs[dev->msg_write_idx].len;
 		}
 
+		tx_limit = dev->tx_fifo_depth - readl(dev->base + DW_IC_TXFLR);
+		rx_limit = dev->rx_fifo_depth - readl(dev->base + DW_IC_RXFLR);
+
 		while (buf_len > 0 && tx_limit > 0 && rx_limit > 0) {
 			if (msgs[dev->msg_write_idx].flags & I2C_M_RD) {
-				writew(0x100, dev->base + DW_IC_DATA_CMD);
+				writel(0x100, dev->base + DW_IC_DATA_CMD);
 				rx_limit--;
 			} else
-				writew(*(dev->tx_buf++),
-						dev->base + DW_IC_DATA_CMD);
+				writel(*buf++, dev->base + DW_IC_DATA_CMD);
 			tx_limit--; buf_len--;
 		}
+
+		dev->tx_buf = buf;
+		dev->tx_buf_len = buf_len;
+
+		if (buf_len > 0) {
+			/* more bytes to be written */
+			dev->status |= STATUS_WRITE_IN_PROGRESS;
+			break;
+		} else
+			dev->status &= ~STATUS_WRITE_IN_PROGRESS;
 	}
 
-	intr_mask = DW_IC_INTR_STOP_DET | DW_IC_INTR_TX_ABRT;
-	if (buf_len > 0) { /* more bytes to be written */
-		intr_mask |= DW_IC_INTR_TX_EMPTY;
-		dev->status |= STATUS_WRITE_IN_PROGRESS;
-	} else
-		dev->status &= ~STATUS_WRITE_IN_PROGRESS;
-	writew(intr_mask, dev->base + DW_IC_INTR_MASK);
+	/*
+	 * If i2c_msg index search is completed, we don't need TX_EMPTY
+	 * interrupt any more.
+	 */
+	if (dev->msg_write_idx == dev->msgs_num)
+		intr_mask &= ~DW_IC_INTR_TX_EMPTY;
+
+	if (dev->msg_err)
+		intr_mask = 0;
 
-	dev->tx_buf_len = buf_len;
+	writel(intr_mask, dev->base + DW_IC_INTR_MASK);
 }
 
 static void
-i2c_dw_read(struct i2c_adapter *adap)
+i2c_dw_read(struct dw_i2c_dev *dev)
 {
-	struct dw_i2c_dev *dev = i2c_get_adapdata(adap);
 	struct i2c_msg *msgs = dev->msgs;
-	int num = dev->msgs_num;
-	u16 addr = msgs[dev->msg_read_idx].addr;
-	int rx_valid = readw(dev->base + DW_IC_RXFLR);
+	int rx_valid;
 
-	for (; dev->msg_read_idx < num; dev->msg_read_idx++) {
-		u16 len;
+	for (; dev->msg_read_idx < dev->msgs_num; dev->msg_read_idx++) {
+		u32 len;
 		u8 *buf;
 
 		if (!(msgs[dev->msg_read_idx].flags & I2C_M_RD))
 			continue;
 
-		/* different i2c client, reprogram the i2c adapter */
-		if (msgs[dev->msg_read_idx].addr != addr)
-			return;
-
 		if (!(dev->status & STATUS_READ_IN_PROGRESS)) {
 			len = msgs[dev->msg_read_idx].len;
 			buf = msgs[dev->msg_read_idx].buf;
@@ -335,8 +476,10 @@ i2c_dw_read(struct i2c_adapter *adap)
 			buf = dev->rx_buf;
 		}
 
+		rx_valid = readl(dev->base + DW_IC_RXFLR);
+
 		for (; len > 0 && rx_valid > 0; len--, rx_valid--)
-			*buf++ = readb(dev->base + DW_IC_DATA_CMD);
+			*buf++ = readl(dev->base + DW_IC_DATA_CMD);
 
 		if (len > 0) {
 			dev->status |= STATUS_READ_IN_PROGRESS;
@@ -348,6 +491,29 @@ i2c_dw_read(struct i2c_adapter *adap)
 	}
 }
 
+static int i2c_dw_handle_tx_abort(struct dw_i2c_dev *dev)
+{
+	unsigned long abort_source = dev->abort_source;
+	int i;
+
+	if (abort_source & DW_IC_TX_ABRT_NOACK) {
+		for_each_bit(i, &abort_source, ARRAY_SIZE(abort_sources))
+			dev_dbg(dev->dev,
+				"%s: %s\n", __func__, abort_sources[i]);
+		return -EREMOTEIO;
+	}
+
+	for_each_bit(i, &abort_source, ARRAY_SIZE(abort_sources))
+		dev_err(dev->dev, "%s: %s\n", __func__, abort_sources[i]);
+
+	if (abort_source & DW_IC_TX_ARB_LOST)
+		return -EAGAIN;
+	else if (abort_source & DW_IC_TX_ABRT_GCALL_READ)
+		return -EINVAL; /* wrong msgs[] data */
+	else
+		return -EIO;
+}
+
 /*
  * Prepare controller for a transaction and call i2c_dw_xfer_msg
  */
@@ -369,13 +535,14 @@ i2c_dw_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], int num)
 	dev->msg_read_idx = 0;
 	dev->msg_err = 0;
 	dev->status = STATUS_IDLE;
+	dev->abort_source = 0;
 
 	ret = i2c_dw_wait_bus_not_busy(dev);
 	if (ret < 0)
 		goto done;
 
 	/* start the transfers */
-	i2c_dw_xfer_msg(adap);
+	i2c_dw_xfer_init(dev);
 
 	/* wait for tx to complete */
 	ret = wait_for_completion_interruptible_timeout(&dev->cmd_complete, HZ);
@@ -394,23 +561,16 @@ i2c_dw_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], int num)
 
 	/* no error */
 	if (likely(!dev->cmd_err)) {
-		/* read rx fifo, and disable the adapter */
-		do {
-			i2c_dw_read(adap);
-		} while (dev->status & STATUS_READ_IN_PROGRESS);
-		writeb(0, dev->base + DW_IC_ENABLE);
+		/* Disable the adapter */
+		writel(0, dev->base + DW_IC_ENABLE);
 		ret = num;
 		goto done;
 	}
 
 	/* We have an error */
 	if (dev->cmd_err == DW_IC_ERR_TX_ABRT) {
-		unsigned long abort_source = dev->abort_source;
-		int i;
-
-		for_each_bit(i, &abort_source, ARRAY_SIZE(abort_sources)) {
-		    dev_err(dev->dev, "%s: %s\n", __func__, abort_sources[i]);
-		}
+		ret = i2c_dw_handle_tx_abort(dev);
+		goto done;
 	}
 	ret = -EIO;
 
@@ -422,21 +582,67 @@ done:
 
 static u32 i2c_dw_func(struct i2c_adapter *adap)
 {
-	return I2C_FUNC_I2C | I2C_FUNC_10BIT_ADDR;
+	return	I2C_FUNC_I2C |
+		I2C_FUNC_10BIT_ADDR |
+		I2C_FUNC_SMBUS_BYTE |
+		I2C_FUNC_SMBUS_BYTE_DATA |
+		I2C_FUNC_SMBUS_WORD_DATA |
+		I2C_FUNC_SMBUS_I2C_BLOCK;
 }
 
-static void dw_i2c_pump_msg(unsigned long data)
+static u32 i2c_dw_read_clear_intrbits(struct dw_i2c_dev *dev)
 {
-	struct dw_i2c_dev *dev = (struct dw_i2c_dev *) data;
-	u16 intr_mask;
-
-	i2c_dw_read(&dev->adapter);
-	i2c_dw_xfer_msg(&dev->adapter);
-
-	intr_mask = DW_IC_INTR_STOP_DET | DW_IC_INTR_TX_ABRT;
-	if (dev->status & STATUS_WRITE_IN_PROGRESS)
-		intr_mask |= DW_IC_INTR_TX_EMPTY;
-	writew(intr_mask, dev->base + DW_IC_INTR_MASK);
+	u32 stat;
+
+	/*
+	 * The IC_INTR_STAT register just indicates "enabled" interrupts.
+	 * Ths unmasked raw version of interrupt status bits are available
+	 * in the IC_RAW_INTR_STAT register.
+	 *
+	 * That is,
+	 *   stat = readl(IC_INTR_STAT);
+	 * equals to,
+	 *   stat = readl(IC_RAW_INTR_STAT) & readl(IC_INTR_MASK);
+	 *
+	 * The raw version might be useful for debugging purposes.
+	 */
+	stat = readl(dev->base + DW_IC_INTR_STAT);
+
+	/*
+	 * Do not use the IC_CLR_INTR register to clear interrupts, or
+	 * you'll miss some interrupts, triggered during the period from
+	 * readl(IC_INTR_STAT) to readl(IC_CLR_INTR).
+	 *
+	 * Instead, use the separately-prepared IC_CLR_* registers.
+	 */
+	if (stat & DW_IC_INTR_RX_UNDER)
+		readl(dev->base + DW_IC_CLR_RX_UNDER);
+	if (stat & DW_IC_INTR_RX_OVER)
+		readl(dev->base + DW_IC_CLR_RX_OVER);
+	if (stat & DW_IC_INTR_TX_OVER)
+		readl(dev->base + DW_IC_CLR_TX_OVER);
+	if (stat & DW_IC_INTR_RD_REQ)
+		readl(dev->base + DW_IC_CLR_RD_REQ);
+	if (stat & DW_IC_INTR_TX_ABRT) {
+		/*
+		 * The IC_TX_ABRT_SOURCE register is cleared whenever
+		 * the IC_CLR_TX_ABRT is read.  Preserve it beforehand.
+		 */
+		dev->abort_source = readl(dev->base + DW_IC_TX_ABRT_SOURCE);
+		readl(dev->base + DW_IC_CLR_TX_ABRT);
+	}
+	if (stat & DW_IC_INTR_RX_DONE)
+		readl(dev->base + DW_IC_CLR_RX_DONE);
+	if (stat & DW_IC_INTR_ACTIVITY)
+		readl(dev->base + DW_IC_CLR_ACTIVITY);
+	if (stat & DW_IC_INTR_STOP_DET)
+		readl(dev->base + DW_IC_CLR_STOP_DET);
+	if (stat & DW_IC_INTR_START_DET)
+		readl(dev->base + DW_IC_CLR_START_DET);
+	if (stat & DW_IC_INTR_GEN_CALL)
+		readl(dev->base + DW_IC_CLR_GEN_CALL);
+
+	return stat;
 }
 
 /*
@@ -446,20 +652,37 @@ static void dw_i2c_pump_msg(unsigned long data)
 static irqreturn_t i2c_dw_isr(int this_irq, void *dev_id)
 {
 	struct dw_i2c_dev *dev = dev_id;
-	u16 stat;
+	u32 stat;
 
-	stat = readw(dev->base + DW_IC_INTR_STAT);
+	stat = i2c_dw_read_clear_intrbits(dev);
 	dev_dbg(dev->dev, "%s: stat=0x%x\n", __func__, stat);
+
 	if (stat & DW_IC_INTR_TX_ABRT) {
-		dev->abort_source = readw(dev->base + DW_IC_TX_ABRT_SOURCE);
 		dev->cmd_err |= DW_IC_ERR_TX_ABRT;
 		dev->status = STATUS_IDLE;
-	} else if (stat & DW_IC_INTR_TX_EMPTY)
-		tasklet_schedule(&dev->pump_msg);
 
-	readb(dev->base + DW_IC_CLR_INTR);	/* clear interrupts */
-	writew(0, dev->base + DW_IC_INTR_MASK);	/* disable interrupts */
-	if (stat & (DW_IC_INTR_TX_ABRT | DW_IC_INTR_STOP_DET))
+		/*
+		 * Anytime TX_ABRT is set, the contents of the tx/rx
+		 * buffers are flushed.  Make sure to skip them.
+		 */
+		writel(0, dev->base + DW_IC_INTR_MASK);
+		goto tx_aborted;
+	}
+
+	if (stat & DW_IC_INTR_RX_FULL)
+		i2c_dw_read(dev);
+
+	if (stat & DW_IC_INTR_TX_EMPTY)
+		i2c_dw_xfer_msg(dev);
+
+	/*
+	 * No need to modify or disable the interrupt mask here.
+	 * i2c_dw_xfer_msg() will take care of it according to
+	 * the current transmit status.
+	 */
+
+tx_aborted:
+	if ((stat & (DW_IC_INTR_TX_ABRT | DW_IC_INTR_STOP_DET)) || dev->msg_err)
 		complete(&dev->cmd_complete);
 
 	return IRQ_HANDLED;
@@ -474,8 +697,8 @@ static int __devinit dw_i2c_probe(struct platform_device *pdev)
 {
 	struct dw_i2c_dev *dev;
 	struct i2c_adapter *adap;
-	struct resource *mem, *irq, *ioarea;
-	int r;
+	struct resource *mem, *ioarea;
+	int irq, r;
 
 	/* NOTE: driver uses the static register mapping */
 	mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
@@ -484,10 +707,10 @@ static int __devinit dw_i2c_probe(struct platform_device *pdev)
 		return -EINVAL;
 	}
 
-	irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
-	if (!irq) {
+	irq = platform_get_irq(pdev, 0);
+	if (irq < 0) {
 		dev_err(&pdev->dev, "no irq resource?\n");
-		return -EINVAL;
+		return irq; /* -ENXIO */
 	}
 
 	ioarea = request_mem_region(mem->start, resource_size(mem),
@@ -504,10 +727,9 @@ static int __devinit dw_i2c_probe(struct platform_device *pdev)
 	}
 
 	init_completion(&dev->cmd_complete);
-	tasklet_init(&dev->pump_msg, dw_i2c_pump_msg, (unsigned long) dev);
 	mutex_init(&dev->lock);
 	dev->dev = get_device(&pdev->dev);
-	dev->irq = irq->start;
+	dev->irq = irq;
 	platform_set_drvdata(pdev, dev);
 
 	dev->clk = clk_get(&pdev->dev, NULL);
@@ -531,8 +753,8 @@ static int __devinit dw_i2c_probe(struct platform_device *pdev)
 	}
 	i2c_dw_init(dev);
 
-	writew(0, dev->base + DW_IC_INTR_MASK); /* disable IRQ */
-	r = request_irq(dev->irq, i2c_dw_isr, 0, pdev->name, dev);
+	writel(0, dev->base + DW_IC_INTR_MASK); /* disable IRQ */
+	r = request_irq(dev->irq, i2c_dw_isr, IRQF_DISABLED, pdev->name, dev);
 	if (r) {
 		dev_err(&pdev->dev, "failure requesting irq %i\n", dev->irq);
 		goto err_iounmap;
@@ -587,7 +809,7 @@ static int __devexit dw_i2c_remove(struct platform_device *pdev)
 	clk_put(dev->clk);
 	dev->clk = NULL;
 
-	writeb(0, dev->base + DW_IC_ENABLE);
+	writel(0, dev->base + DW_IC_ENABLE);
 	free_irq(dev->irq, dev);
 	kfree(dev);
 
diff --git a/drivers/i2c/busses/i2c-omap.c b/drivers/i2c/busses/i2c-omap.c
index 827da0858136..0037e31076ba 100644
--- a/drivers/i2c/busses/i2c-omap.c
+++ b/drivers/i2c/busses/i2c-omap.c
@@ -178,6 +178,12 @@ struct omap_i2c_dev {
 	unsigned		b_hw:1;		/* bad h/w fixes */
 	unsigned		idle:1;
 	u16			iestate;	/* Saved interrupt register */
+	u16			pscstate;
+	u16			scllstate;
+	u16			sclhstate;
+	u16			bufstate;
+	u16			syscstate;
+	u16			westate;
 };
 
 static inline void omap_i2c_write_reg(struct omap_i2c_dev *i2c_dev,
@@ -230,7 +236,22 @@ static void omap_i2c_unidle(struct omap_i2c_dev *dev)
 
 	clk_enable(dev->iclk);
 	clk_enable(dev->fclk);
+	if (cpu_is_omap34xx()) {
+		omap_i2c_write_reg(dev, OMAP_I2C_CON_REG, 0);
+		omap_i2c_write_reg(dev, OMAP_I2C_PSC_REG, dev->pscstate);
+		omap_i2c_write_reg(dev, OMAP_I2C_SCLL_REG, dev->scllstate);
+		omap_i2c_write_reg(dev, OMAP_I2C_SCLH_REG, dev->sclhstate);
+		omap_i2c_write_reg(dev, OMAP_I2C_BUF_REG, dev->bufstate);
+		omap_i2c_write_reg(dev, OMAP_I2C_SYSC_REG, dev->syscstate);
+		omap_i2c_write_reg(dev, OMAP_I2C_WE_REG, dev->westate);
+		omap_i2c_write_reg(dev, OMAP_I2C_CON_REG, OMAP_I2C_CON_EN);
+	}
 	dev->idle = 0;
+
+	/*
+	 * Don't write to this register if the IE state is 0 as it can
+	 * cause deadlock.
+	 */
 	if (dev->iestate)
 		omap_i2c_write_reg(dev, OMAP_I2C_IE_REG, dev->iestate);
 }
@@ -258,13 +279,18 @@ static void omap_i2c_idle(struct omap_i2c_dev *dev)
 
 static int omap_i2c_init(struct omap_i2c_dev *dev)
 {
-	u16 psc = 0, scll = 0, sclh = 0;
+	u16 psc = 0, scll = 0, sclh = 0, buf = 0;
 	u16 fsscll = 0, fssclh = 0, hsscll = 0, hssclh = 0;
 	unsigned long fclk_rate = 12000000;
 	unsigned long timeout;
 	unsigned long internal_clk = 0;
 
 	if (dev->rev >= OMAP_I2C_REV_2) {
+		/* Disable I2C controller before soft reset */
+		omap_i2c_write_reg(dev, OMAP_I2C_CON_REG,
+			omap_i2c_read_reg(dev, OMAP_I2C_CON_REG) &
+				~(OMAP_I2C_CON_EN));
+
 		omap_i2c_write_reg(dev, OMAP_I2C_SYSC_REG, SYSC_SOFTRESET_MASK);
 		/* For some reason we need to set the EN bit before the
 		 * reset done bit gets set. */
@@ -287,24 +313,22 @@ static int omap_i2c_init(struct omap_i2c_dev *dev)
 					   SYSC_AUTOIDLE_MASK);
 
 		} else if (dev->rev >= OMAP_I2C_REV_ON_3430) {
-			u32 v;
-
-			v = SYSC_AUTOIDLE_MASK;
-			v |= SYSC_ENAWAKEUP_MASK;
-			v |= (SYSC_IDLEMODE_SMART <<
+			dev->syscstate = SYSC_AUTOIDLE_MASK;
+			dev->syscstate |= SYSC_ENAWAKEUP_MASK;
+			dev->syscstate |= (SYSC_IDLEMODE_SMART <<
 			      __ffs(SYSC_SIDLEMODE_MASK));
-			v |= (SYSC_CLOCKACTIVITY_FCLK <<
+			dev->syscstate |= (SYSC_CLOCKACTIVITY_FCLK <<
 			      __ffs(SYSC_CLOCKACTIVITY_MASK));
 
-			omap_i2c_write_reg(dev, OMAP_I2C_SYSC_REG, v);
+			omap_i2c_write_reg(dev, OMAP_I2C_SYSC_REG,
+							dev->syscstate);
 			/*
 			 * Enabling all wakup sources to stop I2C freezing on
 			 * WFI instruction.
 			 * REVISIT: Some wkup sources might not be needed.
 			 */
-			omap_i2c_write_reg(dev, OMAP_I2C_WE_REG,
-							OMAP_I2C_WE_ALL);
-
+			dev->westate = OMAP_I2C_WE_ALL;
+			omap_i2c_write_reg(dev, OMAP_I2C_WE_REG, dev->westate);
 		}
 	}
 	omap_i2c_write_reg(dev, OMAP_I2C_CON_REG, 0);
@@ -394,23 +418,28 @@ static int omap_i2c_init(struct omap_i2c_dev *dev)
 	omap_i2c_write_reg(dev, OMAP_I2C_SCLL_REG, scll);
 	omap_i2c_write_reg(dev, OMAP_I2C_SCLH_REG, sclh);
 
-	if (dev->fifo_size)
-		/* Note: setup required fifo size - 1 */
-		omap_i2c_write_reg(dev, OMAP_I2C_BUF_REG,
-					(dev->fifo_size - 1) << 8 | /* RTRSH */
-					OMAP_I2C_BUF_RXFIF_CLR |
-					(dev->fifo_size - 1) | /* XTRSH */
-					OMAP_I2C_BUF_TXFIF_CLR);
+	if (dev->fifo_size) {
+		/* Note: setup required fifo size - 1. RTRSH and XTRSH */
+		buf = (dev->fifo_size - 1) << 8 | OMAP_I2C_BUF_RXFIF_CLR |
+			(dev->fifo_size - 1) | OMAP_I2C_BUF_TXFIF_CLR;
+		omap_i2c_write_reg(dev, OMAP_I2C_BUF_REG, buf);
+	}
 
 	/* Take the I2C module out of reset: */
 	omap_i2c_write_reg(dev, OMAP_I2C_CON_REG, OMAP_I2C_CON_EN);
 
 	/* Enable interrupts */
-	omap_i2c_write_reg(dev, OMAP_I2C_IE_REG,
-			(OMAP_I2C_IE_XRDY | OMAP_I2C_IE_RRDY |
+	dev->iestate = (OMAP_I2C_IE_XRDY | OMAP_I2C_IE_RRDY |
 			OMAP_I2C_IE_ARDY | OMAP_I2C_IE_NACK |
 			OMAP_I2C_IE_AL)  | ((dev->fifo_size) ?
-				(OMAP_I2C_IE_RDR | OMAP_I2C_IE_XDR) : 0));
+				(OMAP_I2C_IE_RDR | OMAP_I2C_IE_XDR) : 0);
+	omap_i2c_write_reg(dev, OMAP_I2C_IE_REG, dev->iestate);
+	if (cpu_is_omap34xx()) {
+		dev->pscstate = psc;
+		dev->scllstate = scll;
+		dev->sclhstate = sclh;
+		dev->bufstate = buf;
+	}
 	return 0;
 }
 
diff --git a/drivers/i2c/busses/i2c-pca-isa.c b/drivers/i2c/busses/i2c-pca-isa.c
index 0ed68e2ccd22..f7346a9bd95f 100644
--- a/drivers/i2c/busses/i2c-pca-isa.c
+++ b/drivers/i2c/busses/i2c-pca-isa.c
@@ -75,7 +75,7 @@ static int pca_isa_waitforcompletion(void *pd)
 	unsigned long timeout;
 
 	if (irq > -1) {
-		ret = wait_event_interruptible_timeout(pca_wait,
+		ret = wait_event_timeout(pca_wait,
 				pca_isa_readbyte(pd, I2C_PCA_CON)
 				& I2C_PCA_CON_SI, pca_isa_ops.timeout);
 	} else {
@@ -96,7 +96,7 @@ static void pca_isa_resetchip(void *pd)
 }
 
 static irqreturn_t pca_handler(int this_irq, void *dev_id) {
-	wake_up_interruptible(&pca_wait);
+	wake_up(&pca_wait);
 	return IRQ_HANDLED;
 }
 
diff --git a/drivers/i2c/busses/i2c-pca-platform.c b/drivers/i2c/busses/i2c-pca-platform.c
index c4df9d411cd5..5b2213df5ed0 100644
--- a/drivers/i2c/busses/i2c-pca-platform.c
+++ b/drivers/i2c/busses/i2c-pca-platform.c
@@ -84,7 +84,7 @@ static int i2c_pca_pf_waitforcompletion(void *pd)
 	unsigned long timeout;
 
 	if (i2c->irq) {
-		ret = wait_event_interruptible_timeout(i2c->wait,
+		ret = wait_event_timeout(i2c->wait,
 			i2c->algo_data.read_byte(i2c, I2C_PCA_CON)
 			& I2C_PCA_CON_SI, i2c->adap.timeout);
 	} else {
@@ -122,7 +122,7 @@ static irqreturn_t i2c_pca_pf_handler(int this_irq, void *dev_id)
 	if ((i2c->algo_data.read_byte(i2c, I2C_PCA_CON) & I2C_PCA_CON_SI) == 0)
 		return IRQ_NONE;
 
-	wake_up_interruptible(&i2c->wait);
+	wake_up(&i2c->wait);
 
 	return IRQ_HANDLED;
 }
diff --git a/drivers/i2c/busses/i2c-piix4.c b/drivers/i2c/busses/i2c-piix4.c
index 1e245e9cad31..e56e4b6823ca 100644
--- a/drivers/i2c/busses/i2c-piix4.c
+++ b/drivers/i2c/busses/i2c-piix4.c
@@ -324,12 +324,12 @@ static int piix4_transaction(void)
 	else
 		msleep(1);
 
-	while ((timeout++ < MAX_TIMEOUT) &&
+	while ((++timeout < MAX_TIMEOUT) &&
 	       ((temp = inb_p(SMBHSTSTS)) & 0x01))
 		msleep(1);
 
 	/* If the SMBus is still busy, we give up */
-	if (timeout >= MAX_TIMEOUT) {
+	if (timeout == MAX_TIMEOUT) {
 		dev_err(&piix4_adapter.dev, "SMBus Timeout!\n");
 		result = -ETIMEDOUT;
 	}
diff --git a/drivers/i2c/busses/i2c-pnx.c b/drivers/i2c/busses/i2c-pnx.c
index fbab6846ae64..5d1c2603a130 100644
--- a/drivers/i2c/busses/i2c-pnx.c
+++ b/drivers/i2c/busses/i2c-pnx.c
@@ -638,7 +638,8 @@ static int __devinit i2c_pnx_probe(struct platform_device *pdev)
 
 	/* Register this adapter with the I2C subsystem */
 	i2c_pnx->adapter->dev.parent = &pdev->dev;
-	ret = i2c_add_adapter(i2c_pnx->adapter);
+	i2c_pnx->adapter->nr = pdev->id;
+	ret = i2c_add_numbered_adapter(i2c_pnx->adapter);
 	if (ret < 0) {
 		dev_err(&pdev->dev, "I2C: Failed to add bus\n");
 		goto out_irq;
diff --git a/drivers/i2c/busses/i2c-pxa.c b/drivers/i2c/busses/i2c-pxa.c
index 049555777f67..7647a20523a0 100644
--- a/drivers/i2c/busses/i2c-pxa.c
+++ b/drivers/i2c/busses/i2c-pxa.c
@@ -1155,7 +1155,7 @@ static int i2c_pxa_resume_noirq(struct device *dev)
 	return 0;
 }
 
-static struct dev_pm_ops i2c_pxa_dev_pm_ops = {
+static const struct dev_pm_ops i2c_pxa_dev_pm_ops = {
 	.suspend_noirq = i2c_pxa_suspend_noirq,
 	.resume_noirq = i2c_pxa_resume_noirq,
 };
diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c
index 96aafb91b69a..1d8c98613fa0 100644
--- a/drivers/i2c/busses/i2c-s3c2410.c
+++ b/drivers/i2c/busses/i2c-s3c2410.c
@@ -967,7 +967,7 @@ static int s3c24xx_i2c_resume(struct device *dev)
 	return 0;
 }
 
-static struct dev_pm_ops s3c24xx_i2c_dev_pm_ops = {
+static const struct dev_pm_ops s3c24xx_i2c_dev_pm_ops = {
 	.suspend_noirq = s3c24xx_i2c_suspend_noirq,
 	.resume = s3c24xx_i2c_resume,
 };
diff --git a/drivers/i2c/busses/i2c-scmi.c b/drivers/i2c/busses/i2c-scmi.c
index b4a55d407bf5..365e0becaf12 100644
--- a/drivers/i2c/busses/i2c-scmi.c
+++ b/drivers/i2c/busses/i2c-scmi.c
@@ -363,7 +363,7 @@ static int acpi_smbus_cmi_add(struct acpi_device *device)
 	smbus_cmi->cap_write = 0;
 
 	acpi_walk_namespace(ACPI_TYPE_METHOD, smbus_cmi->handle, 1,
-			    acpi_smbus_cmi_query_methods, smbus_cmi, NULL);
+			    acpi_smbus_cmi_query_methods, NULL, smbus_cmi, NULL);
 
 	if (smbus_cmi->cap_info == 0)
 		goto err;
diff --git a/drivers/i2c/busses/i2c-sh_mobile.c b/drivers/i2c/busses/i2c-sh_mobile.c
index 86a9d4e81472..ccc46418ef7f 100644
--- a/drivers/i2c/busses/i2c-sh_mobile.c
+++ b/drivers/i2c/busses/i2c-sh_mobile.c
@@ -647,7 +647,7 @@ static int sh_mobile_i2c_runtime_nop(struct device *dev)
 	return 0;
 }
 
-static struct dev_pm_ops sh_mobile_i2c_dev_pm_ops = {
+static const struct dev_pm_ops sh_mobile_i2c_dev_pm_ops = {
 	.runtime_suspend = sh_mobile_i2c_runtime_nop,
 	.runtime_resume = sh_mobile_i2c_runtime_nop,
 };
diff --git a/drivers/i2c/busses/i2c-viapro.c b/drivers/i2c/busses/i2c-viapro.c
index e4b1543015af..a84a909e1234 100644
--- a/drivers/i2c/busses/i2c-viapro.c
+++ b/drivers/i2c/busses/i2c-viapro.c
@@ -165,10 +165,10 @@ static int vt596_transaction(u8 size)
 	do {
 		msleep(1);
 		temp = inb_p(SMBHSTSTS);
-	} while ((temp & 0x01) && (timeout++ < MAX_TIMEOUT));
+	} while ((temp & 0x01) && (++timeout < MAX_TIMEOUT));
 
 	/* If the SMBus is still busy, we give up */
-	if (timeout >= MAX_TIMEOUT) {
+	if (timeout == MAX_TIMEOUT) {
 		result = -ETIMEDOUT;
 		dev_err(&vt596_adapter.dev, "SMBus timeout!\n");
 	}
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index 4f34823e86b1..10be7b5fbe97 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -155,6 +155,35 @@ static void i2c_device_shutdown(struct device *dev)
 		driver->shutdown(client);
 }
 
+#ifdef CONFIG_SUSPEND
+static int i2c_device_pm_suspend(struct device *dev)
+{
+	const struct dev_pm_ops *pm;
+
+	if (!dev->driver)
+		return 0;
+	pm = dev->driver->pm;
+	if (!pm || !pm->suspend)
+		return 0;
+	return pm->suspend(dev);
+}
+
+static int i2c_device_pm_resume(struct device *dev)
+{
+	const struct dev_pm_ops *pm;
+
+	if (!dev->driver)
+		return 0;
+	pm = dev->driver->pm;
+	if (!pm || !pm->resume)
+		return 0;
+	return pm->resume(dev);
+}
+#else
+#define i2c_device_pm_suspend	NULL
+#define i2c_device_pm_resume	NULL
+#endif
+
 static int i2c_device_suspend(struct device *dev, pm_message_t mesg)
 {
 	struct i2c_client *client = i2c_verify_client(dev);
@@ -219,6 +248,11 @@ static const struct attribute_group *i2c_dev_attr_groups[] = {
 	NULL
 };
 
+static const struct dev_pm_ops i2c_device_pm_ops = {
+	.suspend = i2c_device_pm_suspend,
+	.resume = i2c_device_pm_resume,
+};
+
 struct bus_type i2c_bus_type = {
 	.name		= "i2c",
 	.match		= i2c_device_match,
@@ -227,6 +261,7 @@ struct bus_type i2c_bus_type = {
 	.shutdown	= i2c_device_shutdown,
 	.suspend	= i2c_device_suspend,
 	.resume		= i2c_device_resume,
+	.pm		= &i2c_device_pm_ops,
 };
 EXPORT_SYMBOL_GPL(i2c_bus_type);
 
@@ -808,6 +843,9 @@ int i2c_del_adapter(struct i2c_adapter *adap)
 				 adap->dev.parent);
 #endif
 
+	/* device name is gone after device_unregister */
+	dev_dbg(&adap->dev, "adapter [%s] unregistered\n", adap->name);
+
 	/* clean up the sysfs representation */
 	init_completion(&adap->dev_released);
 	device_unregister(&adap->dev);
@@ -820,8 +858,6 @@ int i2c_del_adapter(struct i2c_adapter *adap)
 	idr_remove(&i2c_adapter_idr, adap->nr);
 	mutex_unlock(&core_lock);
 
-	dev_dbg(&adap->dev, "adapter [%s] unregistered\n", adap->name);
-
 	/* Clear the device structure in case this adapter is ever going to be
 	   added again */
 	memset(&adap->dev, 0, sizeof(adap->dev));
@@ -1184,7 +1220,7 @@ static int i2c_detect_address(struct i2c_client *temp_client,
 	/* Finally call the custom detection function */
 	memset(&info, 0, sizeof(struct i2c_board_info));
 	info.addr = addr;
-	err = driver->detect(temp_client, -1, &info);
+	err = driver->detect(temp_client, &info);
 	if (err) {
 		/* -ENODEV is returned if the detection fails. We catch it
 		   here as this isn't an error. */
@@ -1214,13 +1250,13 @@ static int i2c_detect_address(struct i2c_client *temp_client,
 
 static int i2c_detect(struct i2c_adapter *adapter, struct i2c_driver *driver)
 {
-	const struct i2c_client_address_data *address_data;
+	const unsigned short *address_list;
 	struct i2c_client *temp_client;
 	int i, err = 0;
 	int adap_id = i2c_adapter_id(adapter);
 
-	address_data = driver->address_data;
-	if (!driver->detect || !address_data)
+	address_list = driver->address_list;
+	if (!driver->detect || !address_list)
 		return 0;
 
 	/* Set up a temporary client to help detect callback */
@@ -1235,7 +1271,7 @@ static int i2c_detect(struct i2c_adapter *adapter, struct i2c_driver *driver)
 
 	/* Stop here if we can't use SMBUS_QUICK */
 	if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_QUICK)) {
-		if (address_data->normal_i2c[0] == I2C_CLIENT_END)
+		if (address_list[0] == I2C_CLIENT_END)
 			goto exit_free;
 
 		dev_warn(&adapter->dev, "SMBus Quick command not supported, "
@@ -1244,11 +1280,10 @@ static int i2c_detect(struct i2c_adapter *adapter, struct i2c_driver *driver)
 		goto exit_free;
 	}
 
-	for (i = 0; address_data->normal_i2c[i] != I2C_CLIENT_END; i += 1) {
+	for (i = 0; address_list[i] != I2C_CLIENT_END; i += 1) {
 		dev_dbg(&adapter->dev, "found normal entry for adapter %d, "
-			"addr 0x%02x\n", adap_id,
-			address_data->normal_i2c[i]);
-		temp_client->addr = address_data->normal_i2c[i];
+			"addr 0x%02x\n", adap_id, address_list[i]);
+		temp_client->addr = address_list[i];
 		err = i2c_detect_address(temp_client, driver);
 		if (err)
 			goto exit_free;
diff --git a/drivers/ide/Kconfig b/drivers/ide/Kconfig
index 9a5d0aaac9d0..98ccfeb3f5aa 100644
--- a/drivers/ide/Kconfig
+++ b/drivers/ide/Kconfig
@@ -7,50 +7,25 @@ config HAVE_IDE
 	bool
 
 menuconfig IDE
-	tristate "ATA/ATAPI/MFM/RLL support"
+	tristate "ATA/ATAPI/MFM/RLL support (DEPRECATED)"
 	depends on HAVE_IDE
 	depends on BLOCK
 	---help---
-	  If you say Y here, your kernel will be able to manage low cost mass
-	  storage units such as ATA/(E)IDE and ATAPI units. The most common
-	  cases are IDE hard drives and ATAPI CD-ROM drives.
-
-	  If your system is pure SCSI and doesn't use these interfaces, you
-	  can say N here.
-
-	  Integrated Disk Electronics (IDE aka ATA-1) is a connecting standard
-	  for mass storage units such as hard disks. It was designed by
-	  Western Digital and Compaq Computer in 1984. It was then named
-	  ST506. Quite a number of disks use the IDE interface.
-
-	  AT Attachment (ATA) is the superset of the IDE specifications.
-	  ST506 was also called ATA-1.
-
-	  Fast-IDE is ATA-2 (also named Fast ATA), Enhanced IDE (EIDE) is
-	  ATA-3. It provides support for larger disks (up to 8.4GB by means of
-	  the LBA standard), more disks (4 instead of 2) and for other mass
-	  storage units such as tapes and cdrom. UDMA/33 (aka UltraDMA/33) is
-	  ATA-4 and provides faster (and more CPU friendly) transfer modes
-	  than previous PIO (Programmed processor Input/Output) from previous
-	  ATA/IDE standards by means of fast DMA controllers.
-
-	  ATA Packet Interface (ATAPI) is a protocol used by EIDE tape and
-	  CD-ROM drives, similar in many respects to the SCSI protocol.
-
-	  SMART IDE (Self Monitoring, Analysis and Reporting Technology) was
-	  designed in order to prevent data corruption and disk crash by
-	  detecting pre hardware failure conditions (heat, access time, and
-	  the like...). Disks built since June 1995 may follow this standard.
-	  The kernel itself doesn't manage this; however there are quite a
-	  number of user programs such as smart that can query the status of
-	  SMART parameters from disk drives.
+	  If you say Y here, your kernel will be able to manage ATA/(E)IDE and
+	  ATAPI units. The most common cases are IDE hard drives and ATAPI
+	  CD-ROM drives.
+
+	  This subsystem is currently in maintenance mode with only bug fix
+	  changes applied. Users of ATA hardware are encouraged to migrate to
+	  the newer ATA subsystem ("Serial ATA (prod) and Parallel ATA
+	  (experimental) drivers") which is more actively maintained.
 
 	  To compile this driver as a module, choose M here: the
 	  module will be called ide-core.
 
 	  For further information, please read <file:Documentation/ide/ide.txt>.
 
-	  If unsure, say Y.
+	  If unsure, say N.
 
 if IDE
 
diff --git a/drivers/ide/alim15x3.c b/drivers/ide/alim15x3.c
index e59b6dee9ae2..0abc43f3101e 100644
--- a/drivers/ide/alim15x3.c
+++ b/drivers/ide/alim15x3.c
@@ -40,16 +40,6 @@
 #define DRV_NAME "alim15x3"
 
 /*
- * Allow UDMA on M1543C-E chipset for WDC disks that ignore CRC checking
- * (this is DANGEROUS and could result in data corruption).
- */
-static int wdc_udma;
-
-module_param(wdc_udma, bool, 0);
-MODULE_PARM_DESC(wdc_udma,
-		 "allow UDMA on M1543C-E chipset for WDC disks (DANGEROUS)");
-
-/*
  *	ALi devices are not plug in. Otherwise these static values would
  *	need to go. They ought to go away anyway
  */
@@ -132,7 +122,7 @@ static u8 ali_udma_filter(ide_drive_t *drive)
 	if (m5229_revision > 0x20 && m5229_revision < 0xC2) {
 		if (drive->media != ide_disk)
 			return 0;
-		if (wdc_udma == 0 && chip_is_1543c_e &&
+		if (chip_is_1543c_e &&
 		    strstr((char *)&drive->id[ATA_ID_PROD], "WDC "))
 			return 0;
 	}
diff --git a/drivers/ide/au1xxx-ide.c b/drivers/ide/au1xxx-ide.c
index 58121bd6c115..87cef0c440ad 100644
--- a/drivers/ide/au1xxx-ide.c
+++ b/drivers/ide/au1xxx-ide.c
@@ -532,14 +532,13 @@ static int au_ide_probe(struct platform_device *dev)
 		goto out;
 	}
 
-	if (!request_mem_region(res->start, res->end - res->start + 1,
-				dev->name)) {
+	if (!request_mem_region(res->start, resource_size(res), dev->name)) {
 		pr_debug("%s: request_mem_region failed\n", DRV_NAME);
 		ret =  -EBUSY;
 		goto out;
 	}
 
-	ahwif->regbase = (u32)ioremap(res->start, res->end - res->start + 1);
+	ahwif->regbase = (u32)ioremap(res->start, resource_size(res));
 	if (ahwif->regbase == 0) {
 		ret = -ENOMEM;
 		goto out;
@@ -575,7 +574,7 @@ static int au_ide_remove(struct platform_device *dev)
 	iounmap((void *)ahwif->regbase);
 
 	res = platform_get_resource(dev, IORESOURCE_MEM, 0);
-	release_mem_region(res->start, res->end - res->start + 1);
+	release_mem_region(res->start, resource_size(res));
 
 	return 0;
 }
diff --git a/drivers/ide/cmd64x.c b/drivers/ide/cmd64x.c
index ca0c46f6580a..f2500c8826bb 100644
--- a/drivers/ide/cmd64x.c
+++ b/drivers/ide/cmd64x.c
@@ -20,14 +20,6 @@
 
 #define DRV_NAME "cmd64x"
 
-#define CMD_DEBUG 0
-
-#if CMD_DEBUG
-#define cmdprintk(x...)	printk(x)
-#else
-#define cmdprintk(x...)
-#endif
-
 /*
  * CMD64x specific registers definition.
  */
@@ -76,9 +68,6 @@ static void program_cycle_times (ide_drive_t *drive, int cycle_time, int active_
 		{15, 15, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 0};
 	static const u8 drwtim_regs[4] = {DRWTIM0, DRWTIM1, DRWTIM2, DRWTIM3};
 
-	cmdprintk("program_cycle_times parameters: total=%d, active=%d\n",
-		  cycle_time, active_time);
-
 	cycle_count	= quantize_timing( cycle_time, clock_time);
 	active_count	= quantize_timing(active_time, clock_time);
 	recovery_count	= cycle_count - active_count;
@@ -94,9 +83,6 @@ static void program_cycle_times (ide_drive_t *drive, int cycle_time, int active_
 	if (active_count > 16)		/* shouldn't actually happen... */
 	 	active_count = 16;
 
-	cmdprintk("Final counts: total=%d, active=%d, recovery=%d\n",
-		  cycle_count, active_count, recovery_count);
-
 	/*
 	 * Convert values to internal chipset representation
 	 */
@@ -106,7 +92,6 @@ static void program_cycle_times (ide_drive_t *drive, int cycle_time, int active_
 	/* Program the active/recovery counts into the DRWTIM register */
 	drwtim = (active_count << 4) | recovery_count;
 	(void) pci_write_config_byte(dev, drwtim_regs[drive->dn], drwtim);
-	cmdprintk("Write 0x%02x to reg 0x%x\n", drwtim, drwtim_regs[drive->dn]);
 }
 
 /*
@@ -150,7 +135,6 @@ static void cmd64x_tune_pio(ide_drive_t *drive, const u8 pio)
 
 	if (setup_count > 5)		/* shouldn't actually happen... */
 		setup_count = 5;
-	cmdprintk("Final address setup count: %d\n", setup_count);
 
 	/*
 	 * Program the address setup clocks into the ARTTIM registers.
@@ -162,7 +146,6 @@ static void cmd64x_tune_pio(ide_drive_t *drive, const u8 pio)
 	arttim &= ~0xc0;
 	arttim |= setup_values[setup_count];
 	(void) pci_write_config_byte(dev, arttim_regs[drive->dn], arttim);
-	cmdprintk("Write 0x%02x to reg 0x%x\n", arttim, arttim_regs[drive->dn]);
 }
 
 /*
diff --git a/drivers/ide/cs5535.c b/drivers/ide/cs5535.c
index 983d957a0189..b883838adc24 100644
--- a/drivers/ide/cs5535.c
+++ b/drivers/ide/cs5535.c
@@ -187,6 +187,7 @@ static int __devinit cs5535_init_one(struct pci_dev *dev,
 
 static const struct pci_device_id cs5535_pci_tbl[] = {
 	{ PCI_VDEVICE(NS, PCI_DEVICE_ID_NS_CS5535_IDE), 0 },
+	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_CS5535_IDE), },
 	{ 0, },
 };
 
diff --git a/drivers/ide/cy82c693.c b/drivers/ide/cy82c693.c
index 74fc5401f407..d6e2cbbc53a0 100644
--- a/drivers/ide/cy82c693.c
+++ b/drivers/ide/cy82c693.c
@@ -51,11 +51,6 @@
 #define DRV_NAME "cy82c693"
 
 /*
- *	The following are used to debug the driver.
- */
-#define CY82C693_DEBUG_INFO	0
-
-/*
  *	NOTE: the value for busmaster timeout is tricky and I got it by
  *	trial and error!  By using a to low value will cause DMA timeouts
  *	and drop IDE performance, and by using a to high value will cause
@@ -176,11 +171,6 @@ static void cy82c693_set_dma_mode(ide_drive_t *drive, const u8 mode)
 	outb(index, CY82_INDEX_PORT);
 	outb(data, CY82_DATA_PORT);
 
-#if CY82C693_DEBUG_INFO
-	printk(KERN_INFO "%s (ch=%d, dev=%d): set DMA mode to %d (single=%d)\n",
-		drive->name, hwif->channel, drive->dn & 1, mode & 3, single);
-#endif /* CY82C693_DEBUG_INFO */
-
 	/*
 	 * note: below we set the value for Bus Master IDE TimeOut Register
 	 * I'm not absolutly sure what this does, but it solved my problem
@@ -194,11 +184,6 @@ static void cy82c693_set_dma_mode(ide_drive_t *drive, const u8 mode)
 	data = BUSMASTER_TIMEOUT;
 	outb(CY82_INDEX_TIMEOUT, CY82_INDEX_PORT);
 	outb(data, CY82_DATA_PORT);
-
-#if CY82C693_DEBUG_INFO
-	printk(KERN_INFO "%s: Set IDE Bus Master TimeOut Register to 0x%X\n",
-		drive->name, data);
-#endif /* CY82C693_DEBUG_INFO */
 }
 
 static void cy82c693_set_pio_mode(ide_drive_t *drive, const u8 pio)
@@ -239,8 +224,6 @@ static void cy82c693_set_pio_mode(ide_drive_t *drive, const u8 pio)
 		pci_write_config_byte(dev, CY82_IDE_MASTER_IOR, pclk.time_16r);
 		pci_write_config_byte(dev, CY82_IDE_MASTER_IOW, pclk.time_16w);
 		pci_write_config_byte(dev, CY82_IDE_MASTER_8BIT, pclk.time_8);
-
-		addrCtrl &= 0xF;
 	} else {
 		/*
 		 * set slave drive
@@ -257,17 +240,7 @@ static void cy82c693_set_pio_mode(ide_drive_t *drive, const u8 pio)
 		pci_write_config_byte(dev, CY82_IDE_SLAVE_IOR, pclk.time_16r);
 		pci_write_config_byte(dev, CY82_IDE_SLAVE_IOW, pclk.time_16w);
 		pci_write_config_byte(dev, CY82_IDE_SLAVE_8BIT, pclk.time_8);
-
-		addrCtrl >>= 4;
-		addrCtrl &= 0xF;
 	}
-
-#if CY82C693_DEBUG_INFO
-	printk(KERN_INFO "%s (ch=%d, dev=%d): set PIO timing to "
-		"(addr=0x%X, ior=0x%X, iow=0x%X, 8bit=0x%X)\n",
-		drive->name, hwif->channel, drive->dn & 1,
-		addrCtrl, pclk.time_16r, pclk.time_16w, pclk.time_8);
-#endif /* CY82C693_DEBUG_INFO */
 }
 
 static void __devinit init_iops_cy82c693(ide_hwif_t *hwif)
diff --git a/drivers/ide/hpt366.c b/drivers/ide/hpt366.c
index 7ce68ef6b904..4d90ac2dbb1b 100644
--- a/drivers/ide/hpt366.c
+++ b/drivers/ide/hpt366.c
@@ -297,68 +297,6 @@ static u32 twenty_five_base_hpt36x[] = {
 	/* XFER_PIO_0 */	0xc0d08585
 };
 
-#if 0
-/* These are the timing tables from the HighPoint open source drivers... */
-static u32 thirty_three_base_hpt37x[] = {
-	/* XFER_UDMA_6 */	0x12446231,	/* 0x12646231 ?? */
-	/* XFER_UDMA_5 */	0x12446231,
-	/* XFER_UDMA_4 */	0x12446231,
-	/* XFER_UDMA_3 */	0x126c6231,
-	/* XFER_UDMA_2 */	0x12486231,
-	/* XFER_UDMA_1 */	0x124c6233,
-	/* XFER_UDMA_0 */	0x12506297,
-
-	/* XFER_MW_DMA_2 */	0x22406c31,
-	/* XFER_MW_DMA_1 */	0x22406c33,
-	/* XFER_MW_DMA_0 */	0x22406c97,
-
-	/* XFER_PIO_4 */	0x06414e31,
-	/* XFER_PIO_3 */	0x06414e42,
-	/* XFER_PIO_2 */	0x06414e53,
-	/* XFER_PIO_1 */	0x06814e93,
-	/* XFER_PIO_0 */	0x06814ea7
-};
-
-static u32 fifty_base_hpt37x[] = {
-	/* XFER_UDMA_6 */	0x12848242,
-	/* XFER_UDMA_5 */	0x12848242,
-	/* XFER_UDMA_4 */	0x12ac8242,
-	/* XFER_UDMA_3 */	0x128c8242,
-	/* XFER_UDMA_2 */	0x120c8242,
-	/* XFER_UDMA_1 */	0x12148254,
-	/* XFER_UDMA_0 */	0x121882ea,
-
-	/* XFER_MW_DMA_2 */	0x22808242,
-	/* XFER_MW_DMA_1 */	0x22808254,
-	/* XFER_MW_DMA_0 */	0x228082ea,
-
-	/* XFER_PIO_4 */	0x0a81f442,
-	/* XFER_PIO_3 */	0x0a81f443,
-	/* XFER_PIO_2 */	0x0a81f454,
-	/* XFER_PIO_1 */	0x0ac1f465,
-	/* XFER_PIO_0 */	0x0ac1f48a
-};
-
-static u32 sixty_six_base_hpt37x[] = {
-	/* XFER_UDMA_6 */	0x1c869c62,
-	/* XFER_UDMA_5 */	0x1cae9c62,	/* 0x1c8a9c62 */
-	/* XFER_UDMA_4 */	0x1c8a9c62,
-	/* XFER_UDMA_3 */	0x1c8e9c62,
-	/* XFER_UDMA_2 */	0x1c929c62,
-	/* XFER_UDMA_1 */	0x1c9a9c62,
-	/* XFER_UDMA_0 */	0x1c829c62,
-
-	/* XFER_MW_DMA_2 */	0x2c829c62,
-	/* XFER_MW_DMA_1 */	0x2c829c66,
-	/* XFER_MW_DMA_0 */	0x2c829d2e,
-
-	/* XFER_PIO_4 */	0x0c829c62,
-	/* XFER_PIO_3 */	0x0c829c84,
-	/* XFER_PIO_2 */	0x0c829ca6,
-	/* XFER_PIO_1 */	0x0d029d26,
-	/* XFER_PIO_0 */	0x0d029d5e
-};
-#else
 /*
  * The following are the new timing tables with PIO mode data/taskfile transfer
  * overclocking fixed...
@@ -424,16 +362,13 @@ static u32 sixty_six_base_hpt37x[] = {
 	/* XFER_PIO_1 */	0x0d02ff26,
 	/* XFER_PIO_0 */	0x0d42ff7f
 };
-#endif
 
-#define HPT366_DEBUG_DRIVE_INFO		0
 #define HPT371_ALLOW_ATA133_6		1
 #define HPT302_ALLOW_ATA133_6		1
 #define HPT372_ALLOW_ATA133_6		1
 #define HPT370_ALLOW_ATA100_5		0
 #define HPT366_ALLOW_ATA66_4		1
 #define HPT366_ALLOW_ATA66_3		1
-#define HPT366_MAX_DEVS			8
 
 /* Supported ATA clock frequencies */
 enum ata_clock {
diff --git a/drivers/ide/ide-tape.c b/drivers/ide/ide-tape.c
index 58fc920d5c32..6a0e62542167 100644
--- a/drivers/ide/ide-tape.c
+++ b/drivers/ide/ide-tape.c
@@ -221,6 +221,8 @@ typedef struct ide_tape_obj {
 
 static DEFINE_MUTEX(idetape_ref_mutex);
 
+static DEFINE_MUTEX(idetape_chrdev_mutex);
+
 static struct class *idetape_sysfs_class;
 
 static void ide_tape_release(struct device *);
@@ -1457,10 +1459,11 @@ static int idetape_chrdev_open(struct inode *inode, struct file *filp)
 	if (i >= MAX_HWIFS * MAX_DRIVES)
 		return -ENXIO;
 
-	lock_kernel();
+	mutex_lock(&idetape_chrdev_mutex);
+
 	tape = ide_tape_get(NULL, true, i);
 	if (!tape) {
-		unlock_kernel();
+		mutex_unlock(&idetape_chrdev_mutex);
 		return -ENXIO;
 	}
 
@@ -1519,12 +1522,15 @@ static int idetape_chrdev_open(struct inode *inode, struct file *filp)
 				tape->door_locked = DOOR_LOCKED;
 		}
 	}
-	unlock_kernel();
+	mutex_unlock(&idetape_chrdev_mutex);
+
 	return 0;
 
 out_put_tape:
 	ide_tape_put(tape);
-	unlock_kernel();
+
+	mutex_unlock(&idetape_chrdev_mutex);
+
 	return retval;
 }
 
@@ -1551,7 +1557,8 @@ static int idetape_chrdev_release(struct inode *inode, struct file *filp)
 	ide_drive_t *drive = tape->drive;
 	unsigned int minor = iminor(inode);
 
-	lock_kernel();
+	mutex_lock(&idetape_chrdev_mutex);
+
 	tape = drive->driver_data;
 
 	ide_debug_log(IDE_DBG_FUNC, "enter");
@@ -1575,7 +1582,9 @@ static int idetape_chrdev_release(struct inode *inode, struct file *filp)
 	}
 	clear_bit(ilog2(IDE_AFLAG_BUSY), &drive->atapi_flags);
 	ide_tape_put(tape);
-	unlock_kernel();
+
+	mutex_unlock(&idetape_chrdev_mutex);
+
 	return 0;
 }
 
diff --git a/drivers/ide/ide_platform.c b/drivers/ide/ide_platform.c
index b579fbe88370..42965b3e30b9 100644
--- a/drivers/ide/ide_platform.c
+++ b/drivers/ide/ide_platform.c
@@ -81,14 +81,14 @@ static int __devinit plat_ide_probe(struct platform_device *pdev)
 
 	if (mmio) {
 		base = devm_ioremap(&pdev->dev,
-			res_base->start, res_base->end - res_base->start + 1);
+			res_base->start, resource_size(res_base));
 		alt_base = devm_ioremap(&pdev->dev,
-			res_alt->start, res_alt->end - res_alt->start + 1);
+			res_alt->start, resource_size(res_alt));
 	} else {
 		base = devm_ioport_map(&pdev->dev,
-			res_base->start, res_base->end - res_base->start + 1);
+			res_base->start, resource_size(res_base));
 		alt_base = devm_ioport_map(&pdev->dev,
-			res_alt->start, res_alt->end - res_alt->start + 1);
+			res_alt->start, resource_size(res_alt));
 	}
 
 	memset(&hw, 0, sizeof(hw));
diff --git a/drivers/ide/pdc202xx_old.c b/drivers/ide/pdc202xx_old.c
index cb812f3700e8..35161dd840a0 100644
--- a/drivers/ide/pdc202xx_old.c
+++ b/drivers/ide/pdc202xx_old.c
@@ -21,8 +21,6 @@
 
 #define DRV_NAME "pdc202xx_old"
 
-#define PDC202XX_DEBUG_DRIVE_INFO	0
-
 static void pdc_old_disable_66MHz_clock(ide_hwif_t *);
 
 static void pdc202xx_set_mode(ide_drive_t *drive, const u8 speed)
@@ -34,11 +32,6 @@ static void pdc202xx_set_mode(ide_drive_t *drive, const u8 speed)
 	u8			AP = 0, BP = 0, CP = 0;
 	u8			TA = 0, TB = 0, TC = 0;
 
-#if PDC202XX_DEBUG_DRIVE_INFO
-	u32			drive_conf = 0;
-	pci_read_config_dword(dev, drive_pci, &drive_conf);
-#endif
-
 	/*
 	 * TODO: do this once per channel
 	 */
@@ -89,14 +82,6 @@ static void pdc202xx_set_mode(ide_drive_t *drive, const u8 speed)
 		pci_write_config_byte(dev, drive_pci + 1, BP | TB);
 		pci_write_config_byte(dev, drive_pci + 2, CP | TC);
 	}
-
-#if PDC202XX_DEBUG_DRIVE_INFO
-	printk(KERN_DEBUG "%s: %s drive%d 0x%08x ",
-		drive->name, ide_xfer_verbose(speed),
-		drive->dn, drive_conf);
-	pci_read_config_dword(dev, drive_pci, &drive_conf);
-	printk("0x%08x\n", drive_conf);
-#endif
 }
 
 static void pdc202xx_set_pio_mode(ide_drive_t *drive, const u8 pio)
diff --git a/drivers/ide/pmac.c b/drivers/ide/pmac.c
index 97642a7a79c4..7a4e788cab2f 100644
--- a/drivers/ide/pmac.c
+++ b/drivers/ide/pmac.c
@@ -43,10 +43,7 @@
 #include <asm/pmac_feature.h>
 #include <asm/sections.h>
 #include <asm/irq.h>
-
-#ifndef CONFIG_PPC64
 #include <asm/mediabay.h>
-#endif
 
 #define DRV_NAME "ide-pmac"
 
@@ -59,13 +56,14 @@ typedef struct pmac_ide_hwif {
 	int				irq;
 	int				kind;
 	int				aapl_bus_id;
-	unsigned			mediabay : 1;
 	unsigned			broken_dma : 1;
 	unsigned			broken_dma_warn : 1;
 	struct device_node*		node;
 	struct macio_dev		*mdev;
 	u32				timings[4];
 	volatile u32 __iomem *		*kauai_fcr;
+	ide_hwif_t			*hwif;
+
 	/* Those fields are duplicating what is in hwif. We currently
 	 * can't use the hwif ones because of some assumptions that are
 	 * beeing done by the generic code about the kind of dma controller
@@ -854,6 +852,11 @@ sanitize_timings(pmac_ide_hwif_t *pmif)
 	pmif->timings[2] = pmif->timings[3] = value2;
 }
 
+static int on_media_bay(pmac_ide_hwif_t *pmif)
+{
+	return pmif->mdev && pmif->mdev->media_bay != NULL;
+}
+
 /* Suspend call back, should be called after the child devices
  * have actually been suspended
  */
@@ -866,7 +869,7 @@ static int pmac_ide_do_suspend(pmac_ide_hwif_t *pmif)
 	disable_irq(pmif->irq);
 
 	/* The media bay will handle itself just fine */
-	if (pmif->mediabay)
+	if (on_media_bay(pmif))
 		return 0;
 	
 	/* Kauai has bus control FCRs directly here */
@@ -889,7 +892,7 @@ static int pmac_ide_do_suspend(pmac_ide_hwif_t *pmif)
 static int pmac_ide_do_resume(pmac_ide_hwif_t *pmif)
 {
 	/* Hard reset & re-enable controller (do we really need to reset ? -BenH) */
-	if (!pmif->mediabay) {
+	if (!on_media_bay(pmif)) {
 		ppc_md.feature_call(PMAC_FTR_IDE_RESET, pmif->node, pmif->aapl_bus_id, 1);
 		ppc_md.feature_call(PMAC_FTR_IDE_ENABLE, pmif->node, pmif->aapl_bus_id, 1);
 		msleep(10);
@@ -950,13 +953,11 @@ static void pmac_ide_init_dev(ide_drive_t *drive)
 	pmac_ide_hwif_t *pmif =
 		(pmac_ide_hwif_t *)dev_get_drvdata(hwif->gendev.parent);
 
-	if (pmif->mediabay) {
-#ifdef CONFIG_PMAC_MEDIABAY
-		if (check_media_bay_by_base(pmif->regbase, MB_CD) == 0) {
+	if (on_media_bay(pmif)) {
+		if (check_media_bay(pmif->mdev->media_bay) == MB_CD) {
 			drive->dev_flags &= ~IDE_DFLAG_NOPROBE;
 			return;
 		}
-#endif
 		drive->dev_flags |= IDE_DFLAG_NOPROBE;
 	}
 }
@@ -1072,26 +1073,23 @@ static int __devinit pmac_ide_setup_device(pmac_ide_hwif_t *pmif,
 		writel(KAUAI_FCR_UATA_MAGIC |
 		       KAUAI_FCR_UATA_RESET_N |
 		       KAUAI_FCR_UATA_ENABLE, pmif->kauai_fcr);
-
-	pmif->mediabay = 0;
 	
 	/* Make sure we have sane timings */
 	sanitize_timings(pmif);
 
+	/* If we are on a media bay, wait for it to settle and lock it */
+	if (pmif->mdev)
+		lock_media_bay(pmif->mdev->media_bay);
+
 	host = ide_host_alloc(&d, hws, 1);
-	if (host == NULL)
-		return -ENOMEM;
-	hwif = host->ports[0];
+	if (host == NULL) {
+		rc = -ENOMEM;
+		goto bail;
+	}
+	hwif = pmif->hwif = host->ports[0];
 
-#ifndef CONFIG_PPC64
-	/* XXX FIXME: Media bay stuff need re-organizing */
-	if (np->parent && np->parent->name
-	    && strcasecmp(np->parent->name, "media-bay") == 0) {
-#ifdef CONFIG_PMAC_MEDIABAY
-		media_bay_set_ide_infos(np->parent, pmif->regbase, pmif->irq,
-					hwif);
-#endif /* CONFIG_PMAC_MEDIABAY */
-		pmif->mediabay = 1;
+	if (on_media_bay(pmif)) {
+		/* Fixup bus ID for media bay */
 		if (!bidp)
 			pmif->aapl_bus_id = 1;
 	} else if (pmif->kind == controller_ohare) {
@@ -1100,9 +1098,7 @@ static int __devinit pmac_ide_setup_device(pmac_ide_hwif_t *pmif,
 		 * units, I keep the old way
 		 */
 		ppc_md.feature_call(PMAC_FTR_IDE_ENABLE, np, 0, 1);
-	} else
-#endif
-	{
+	} else {
  		/* This is necessary to enable IDE when net-booting */
 		ppc_md.feature_call(PMAC_FTR_IDE_RESET, np, pmif->aapl_bus_id, 1);
 		ppc_md.feature_call(PMAC_FTR_IDE_ENABLE, np, pmif->aapl_bus_id, 1);
@@ -1112,17 +1108,21 @@ static int __devinit pmac_ide_setup_device(pmac_ide_hwif_t *pmif,
 	}
 
 	printk(KERN_INFO DRV_NAME ": Found Apple %s controller (%s), "
-			 "bus ID %d%s, irq %d\n", model_name[pmif->kind],
-			 pmif->mdev ? "macio" : "PCI", pmif->aapl_bus_id,
-			 pmif->mediabay ? " (mediabay)" : "", hw->irq);
+	       "bus ID %d%s, irq %d\n", model_name[pmif->kind],
+	       pmif->mdev ? "macio" : "PCI", pmif->aapl_bus_id,
+	       on_media_bay(pmif) ? " (mediabay)" : "", hw->irq);
 
 	rc = ide_host_register(host, &d, hws);
-	if (rc) {
-		ide_host_free(host);
-		return rc;
-	}
+	if (rc)
+		pmif->hwif = NULL;
 
-	return 0;
+	if (pmif->mdev)
+		unlock_media_bay(pmif->mdev->media_bay);
+
+ bail:
+	if (rc && host)
+		ide_host_free(host);
+	return rc;
 }
 
 static void __devinit pmac_ide_init_ports(struct ide_hw *hw, unsigned long base)
@@ -1362,6 +1362,25 @@ pmac_ide_pci_resume(struct pci_dev *pdev)
 	return rc;
 }
 
+#ifdef CONFIG_PMAC_MEDIABAY
+static void pmac_ide_macio_mb_event(struct macio_dev* mdev, int mb_state)
+{
+	pmac_ide_hwif_t *pmif =
+		(pmac_ide_hwif_t *)dev_get_drvdata(&mdev->ofdev.dev);
+
+	switch(mb_state) {
+	case MB_CD:
+		if (!pmif->hwif->present)
+			ide_port_scan(pmif->hwif);
+		break;
+	default:
+		if (pmif->hwif->present)
+			ide_port_unregister_devices(pmif->hwif);
+	}
+}
+#endif /* CONFIG_PMAC_MEDIABAY */
+
+
 static struct of_device_id pmac_ide_macio_match[] = 
 {
 	{
@@ -1386,6 +1405,9 @@ static struct macio_driver pmac_ide_macio_driver =
 	.probe		= pmac_ide_macio_attach,
 	.suspend	= pmac_ide_macio_suspend,
 	.resume		= pmac_ide_macio_resume,
+#ifdef CONFIG_PMAC_MEDIABAY
+	.mediabay_event	= pmac_ide_macio_mb_event,
+#endif
 };
 
 static const struct pci_device_id pmac_ide_pci_match[] = {
diff --git a/drivers/ide/sis5513.c b/drivers/ide/sis5513.c
index 3b88eba04c9c..468706082fb5 100644
--- a/drivers/ide/sis5513.c
+++ b/drivers/ide/sis5513.c
@@ -632,12 +632,3 @@ module_exit(sis5513_ide_exit);
 MODULE_AUTHOR("Lionel Bouton, L C Chang, Andre Hedrick, Vojtech Pavlik");
 MODULE_DESCRIPTION("PCI driver module for SIS IDE");
 MODULE_LICENSE("GPL");
-
-/*
- * TODO:
- *	- CLEANUP
- *	- More checks in the config registers (force values instead of
- *	  relying on the BIOS setting them correctly).
- *	- Further optimisations ?
- *	  . for example ATA66+ regs 0x48 & 0x4A
- */
diff --git a/drivers/ide/sl82c105.c b/drivers/ide/sl82c105.c
index d698da470d6f..3c2bbf0057ea 100644
--- a/drivers/ide/sl82c105.c
+++ b/drivers/ide/sl82c105.c
@@ -24,13 +24,6 @@
 
 #define DRV_NAME "sl82c105"
 
-#undef DEBUG
-
-#ifdef DEBUG
-#define DBG(arg) printk arg
-#else
-#define DBG(fmt,...)
-#endif
 /*
  * SL82C105 PCI config register 0x40 bits.
  */
@@ -104,9 +97,6 @@ static void sl82c105_set_dma_mode(ide_drive_t *drive, const u8 speed)
 	unsigned long timings = (unsigned long)ide_get_drivedata(drive);
 	u16 drv_ctrl;
 
- 	DBG(("sl82c105_tune_chipset(drive:%s, speed:%s)\n",
-	     drive->name, ide_xfer_verbose(speed)));
-
 	drv_ctrl = mwdma_timings[speed - XFER_MW_DMA_0];
 
 	/*
@@ -196,8 +186,6 @@ static void sl82c105_dma_start(ide_drive_t *drive)
 	struct pci_dev *dev	= to_pci_dev(hwif->dev);
 	int reg 		= 0x44 + drive->dn * 4;
 
-	DBG(("%s(drive:%s)\n", __func__, drive->name));
-
 	pci_write_config_word(dev, reg,
 			      (unsigned long)ide_get_drivedata(drive) >> 16);
 
@@ -209,8 +197,6 @@ static void sl82c105_dma_clear(ide_drive_t *drive)
 {
 	struct pci_dev *dev = to_pci_dev(drive->hwif->dev);
 
-	DBG(("sl82c105_dma_clear(drive:%s)\n", drive->name));
-
 	sl82c105_reset_host(dev);
 }
 
@@ -218,11 +204,7 @@ static int sl82c105_dma_end(ide_drive_t *drive)
 {
 	struct pci_dev *dev	= to_pci_dev(drive->hwif->dev);
 	int reg 		= 0x44 + drive->dn * 4;
-	int ret;
-
-	DBG(("%s(drive:%s)\n", __func__, drive->name));
-
-	ret = ide_dma_end(drive);
+	int ret			= ide_dma_end(drive);
 
 	pci_write_config_word(dev, reg,
 			      (unsigned long)ide_get_drivedata(drive));
@@ -239,8 +221,6 @@ static void sl82c105_resetproc(ide_drive_t *drive)
 	struct pci_dev *dev = to_pci_dev(drive->hwif->dev);
 	u32 val;
 
-	DBG(("sl82c105_resetproc(drive:%s)\n", drive->name));
-
 	pci_read_config_dword(dev, 0x40, &val);
 	val |= (CTRL_P1F16 | CTRL_P0F16);
 	pci_write_config_dword(dev, 0x40, val);
@@ -291,8 +271,6 @@ static int init_chipset_sl82c105(struct pci_dev *dev)
 {
 	u32 val;
 
-	DBG(("init_chipset_sl82c105()\n"));
-
 	pci_read_config_dword(dev, 0x40, &val);
 	val |= CTRL_P0EN | CTRL_P0F16 | CTRL_P1F16;
 	pci_write_config_dword(dev, 0x40, val);
diff --git a/drivers/ide/slc90e66.c b/drivers/ide/slc90e66.c
index 9aec78d3bcff..1ccfb40e7215 100644
--- a/drivers/ide/slc90e66.c
+++ b/drivers/ide/slc90e66.c
@@ -91,8 +91,7 @@ static void slc90e66_set_dma_mode(ide_drive_t *drive, const u8 speed)
 
 		if (!(reg48 & u_flag))
 			pci_write_config_word(dev, 0x48, reg48|u_flag);
-		/* FIXME: (reg4a & a_speed) ? */
-		if ((reg4a & u_speed) != u_speed) {
+		if ((reg4a & a_speed) != u_speed) {
 			pci_write_config_word(dev, 0x4a, reg4a & ~a_speed);
 			pci_read_config_word(dev, 0x4a, &reg4a);
 			pci_write_config_word(dev, 0x4a, reg4a|u_speed);
diff --git a/drivers/ide/tx4938ide.c b/drivers/ide/tx4938ide.c
index ea89fddeed91..fd59c0d235b5 100644
--- a/drivers/ide/tx4938ide.c
+++ b/drivers/ide/tx4938ide.c
@@ -146,7 +146,7 @@ static int __init tx4938ide_probe(struct platform_device *pdev)
 		return -ENODEV;
 
 	if (!devm_request_mem_region(&pdev->dev, res->start,
-				     res->end - res->start + 1, "tx4938ide"))
+				     resource_size(res), "tx4938ide"))
 		return -EBUSY;
 	mapbase = (unsigned long)devm_ioremap(&pdev->dev, res->start,
 					      8 << pdata->ioport_shift);
diff --git a/drivers/idle/i7300_idle.c b/drivers/idle/i7300_idle.c
index 1f20a042a4f5..dd253002cd50 100644
--- a/drivers/idle/i7300_idle.c
+++ b/drivers/idle/i7300_idle.c
@@ -81,7 +81,7 @@ static u8 i7300_idle_thrtctl_saved;
 static u8 i7300_idle_thrtlow_saved;
 static u32 i7300_idle_mc_saved;
 
-static cpumask_t idle_cpumask;
+static cpumask_var_t idle_cpumask;
 static ktime_t start_ktime;
 static unsigned long avg_idle_us;
 
@@ -459,9 +459,9 @@ static int i7300_idle_notifier(struct notifier_block *nb, unsigned long val,
 	spin_lock_irqsave(&i7300_idle_lock, flags);
 	if (val == IDLE_START) {
 
-		cpu_set(smp_processor_id(), idle_cpumask);
+		cpumask_set_cpu(smp_processor_id(), idle_cpumask);
 
-		if (cpus_weight(idle_cpumask) != num_online_cpus())
+		if (cpumask_weight(idle_cpumask) != num_online_cpus())
 			goto end;
 
 		now_ktime = ktime_get();
@@ -478,8 +478,8 @@ static int i7300_idle_notifier(struct notifier_block *nb, unsigned long val,
 		i7300_idle_ioat_start();
 
 	} else if (val == IDLE_END) {
-		cpu_clear(smp_processor_id(), idle_cpumask);
-		if (cpus_weight(idle_cpumask) == (num_online_cpus() - 1)) {
+		cpumask_clear_cpu(smp_processor_id(), idle_cpumask);
+		if (cpumask_weight(idle_cpumask) == (num_online_cpus() - 1)) {
 			/* First CPU coming out of idle */
 			u64 idle_duration_us;
 
@@ -553,7 +553,6 @@ struct debugfs_file_info {
 static int __init i7300_idle_init(void)
 {
 	spin_lock_init(&i7300_idle_lock);
-	cpus_clear(idle_cpumask);
 	total_us = 0;
 
 	if (i7300_idle_platform_probe(&fbd_dev, &ioat_dev, forceload))
@@ -565,6 +564,9 @@ static int __init i7300_idle_init(void)
 	if (i7300_idle_ioat_init())
 		return -ENODEV;
 
+	if (!zalloc_cpumask_var(&idle_cpumask, GFP_KERNEL))
+		return -ENOMEM;
+
 	debugfs_dir = debugfs_create_dir("i7300_idle", NULL);
 	if (debugfs_dir) {
 		int i = 0;
@@ -589,6 +591,7 @@ static int __init i7300_idle_init(void)
 static void __exit i7300_idle_exit(void)
 {
 	idle_notifier_unregister(&i7300_idle_nb);
+	free_cpumask_var(idle_cpumask);
 
 	if (debugfs_dir) {
 		int i = 0;
diff --git a/drivers/ieee1394/Kconfig b/drivers/ieee1394/Kconfig
index f102fcc7e52a..e02096cf7d95 100644
--- a/drivers/ieee1394/Kconfig
+++ b/drivers/ieee1394/Kconfig
@@ -1,8 +1,3 @@
-menu "IEEE 1394 (FireWire) support"
-	depends on PCI || BROKEN
-
-source "drivers/firewire/Kconfig"
-
 config IEEE1394
 	tristate "Legacy alternative FireWire driver stack"
 	depends on PCI || BROKEN
@@ -16,8 +11,13 @@ config IEEE1394
 	  is the core support only, you will also need to select a driver for
 	  your IEEE 1394 adapter.
 
-	  To compile this driver as a module, say M here: the
-	  module will be called ieee1394.
+	  To compile this driver as a module, say M here: the module will be
+	  called ieee1394.
+
+	  NOTE:
+	  ieee1394 is superseded by the newer firewire-core driver.  See
+	  http://ieee1394.wiki.kernel.org/index.php/Juju_Migration for
+	  further information on how to switch to the new FireWire drivers.
 
 config IEEE1394_OHCI1394
 	tristate "OHCI-1394 controllers"
@@ -29,19 +29,23 @@ config IEEE1394_OHCI1394
 	  use one of these chipsets.  It should work with any OHCI-1394
 	  compliant card, however.
 
-	  To compile this driver as a module, say M here: the
-	  module will be called ohci1394.
+	  To compile this driver as a module, say M here: the module will be
+	  called ohci1394.
 
 	  NOTE:
+	  ohci1394 is superseded by the newer firewire-ohci driver.  See
+	  http://ieee1394.wiki.kernel.org/index.php/Juju_Migration for
+	  further information on how to switch to the new FireWire drivers.
+
 	  If you want to install firewire-ohci and ohci1394 together, you
 	  should configure them only as modules and blacklist the driver(s)
 	  which you don't want to have auto-loaded.  Add either
 
-	      blacklist firewire-ohci
-	  or
 	      blacklist ohci1394
 	      blacklist video1394
 	      blacklist dv1394
+	  or
+	      blacklist firewire-ohci
 
 	  to /etc/modprobe.conf or /etc/modprobe.d/* and update modprobe.conf
 	  depending on your distribution.
@@ -58,8 +62,8 @@ config IEEE1394_PCILYNX
 	  Instruments PCILynx chip.  Note: this driver is written for revision
 	  2 of this chip and may not work with revision 0.
 
-	  To compile this driver as a module, say M here: the
-	  module will be called pcilynx.
+	  To compile this driver as a module, say M here: the module will be
+	  called pcilynx.
 
 	  Only some old and now very rare PCI and CardBus cards and
 	  PowerMacs G3 B&W contain the PCILynx controller.  Therefore
@@ -79,6 +83,14 @@ config IEEE1394_SBP2
 	  You should also enable support for disks, CD-ROMs, etc. in the SCSI
 	  configuration section.
 
+	  To compile this driver as a module, say M here: the module will be
+	  called sbp2.
+
+	  NOTE:
+	  sbp2 is superseded by the newer firewire-sbp2 driver. See
+	  http://ieee1394.wiki.kernel.org/index.php/Juju_Migration for
+	  further information on how to switch to the new FireWire drivers.
+
 config IEEE1394_SBP2_PHYS_DMA
 	bool "Enable replacement for physical DMA in SBP2"
 	depends on IEEE1394_SBP2 && VIRT_TO_BUS && EXPERIMENTAL
@@ -111,6 +123,11 @@ config IEEE1394_ETH1394
 
 	  The module is called eth1394 although it does not emulate Ethernet.
 
+	  NOTE:
+	  eth1394 is superseded by the newer firewire-net driver. See
+	  http://ieee1394.wiki.kernel.org/index.php/Juju_Migration for
+	  further information on how to switch to the new FireWire drivers.
+
 config IEEE1394_RAWIO
 	tristate "raw1394 userspace interface"
 	depends on IEEE1394
@@ -123,6 +140,11 @@ config IEEE1394_RAWIO
 	  To compile this driver as a module, say M here: the module will be
 	  called raw1394.
 
+	  NOTE:
+	  raw1394 is superseded by the newer firewire-core driver. See
+	  http://ieee1394.wiki.kernel.org/index.php/Juju_Migration for
+	  further information on how to switch to the new FireWire drivers.
+
 config IEEE1394_VIDEO1394
 	tristate "video1394 userspace interface"
 	depends on IEEE1394 && IEEE1394_OHCI1394
@@ -136,13 +158,18 @@ config IEEE1394_VIDEO1394
 	  To compile this driver as a module, say M here: the module will be
 	  called video1394.
 
+	  NOTE:
+	  video1394 is superseded by the newer firewire-core driver. See
+	  http://ieee1394.wiki.kernel.org/index.php/Juju_Migration for
+	  further information on how to switch to the new FireWire drivers.
+
 config IEEE1394_DV1394
 	tristate "dv1394 userspace interface (deprecated)"
 	depends on IEEE1394 && IEEE1394_OHCI1394
 	help
 	  The dv1394 driver is unsupported and may be removed from Linux in a
-	  future release.  Its functionality is now provided by raw1394 together
-	  with libraries such as libiec61883.
+	  future release.  Its functionality is now provided by either
+	  raw1394 or firewire-core together with libraries such as libiec61883.
 
 config IEEE1394_VERBOSEDEBUG
 	bool "Excessive debugging output"
@@ -153,5 +180,3 @@ config IEEE1394_VERBOSEDEBUG
 	  will quickly result in large amounts of data sent to the system log.
 
 	  Say Y if you really need the debugging output.  Everyone else says N.
-
-endmenu
diff --git a/drivers/ieee1394/dv1394.c b/drivers/ieee1394/dv1394.c
index 2cd00b5b45b4..9fd4a0d3206e 100644
--- a/drivers/ieee1394/dv1394.c
+++ b/drivers/ieee1394/dv1394.c
@@ -125,7 +125,7 @@
    0 - no debugging messages
    1 - some debugging messages, but none during DMA frame transmission
    2 - lots of messages, including during DMA frame transmission
-       (will cause undeflows if your machine is too slow!)
+       (will cause underflows if your machine is too slow!)
 */
 
 #define DV1394_DEBUG_LEVEL 0
diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c
index bd07803e9183..abbb06996f9e 100644
--- a/drivers/infiniband/core/addr.c
+++ b/drivers/infiniband/core/addr.c
@@ -36,7 +36,6 @@
 #include <linux/mutex.h>
 #include <linux/inetdevice.h>
 #include <linux/workqueue.h>
-#include <linux/if_arp.h>
 #include <net/arp.h>
 #include <net/neighbour.h>
 #include <net/route.h>
@@ -92,22 +91,12 @@ EXPORT_SYMBOL(rdma_addr_unregister_client);
 int rdma_copy_addr(struct rdma_dev_addr *dev_addr, struct net_device *dev,
 		     const unsigned char *dst_dev_addr)
 {
-	switch (dev->type) {
-	case ARPHRD_INFINIBAND:
-		dev_addr->dev_type = RDMA_NODE_IB_CA;
-		break;
-	case ARPHRD_ETHER:
-		dev_addr->dev_type = RDMA_NODE_RNIC;
-		break;
-	default:
-		return -EADDRNOTAVAIL;
-	}
-
+	dev_addr->dev_type = dev->type;
 	memcpy(dev_addr->src_dev_addr, dev->dev_addr, MAX_ADDR_LEN);
 	memcpy(dev_addr->broadcast, dev->broadcast, MAX_ADDR_LEN);
 	if (dst_dev_addr)
 		memcpy(dev_addr->dst_dev_addr, dst_dev_addr, MAX_ADDR_LEN);
-	dev_addr->src_dev = dev;
+	dev_addr->bound_dev_if = dev->ifindex;
 	return 0;
 }
 EXPORT_SYMBOL(rdma_copy_addr);
@@ -117,6 +106,15 @@ int rdma_translate_ip(struct sockaddr *addr, struct rdma_dev_addr *dev_addr)
 	struct net_device *dev;
 	int ret = -EADDRNOTAVAIL;
 
+	if (dev_addr->bound_dev_if) {
+		dev = dev_get_by_index(&init_net, dev_addr->bound_dev_if);
+		if (!dev)
+			return -ENODEV;
+		ret = rdma_copy_addr(dev_addr, dev, NULL);
+		dev_put(dev);
+		return ret;
+	}
+
 	switch (addr->sa_family) {
 	case AF_INET:
 		dev = ip_dev_find(&init_net,
@@ -131,6 +129,7 @@ int rdma_translate_ip(struct sockaddr *addr, struct rdma_dev_addr *dev_addr)
 
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
 	case AF_INET6:
+		read_lock(&dev_base_lock);
 		for_each_netdev(&init_net, dev) {
 			if (ipv6_chk_addr(&init_net,
 					  &((struct sockaddr_in6 *) addr)->sin6_addr,
@@ -139,6 +138,7 @@ int rdma_translate_ip(struct sockaddr *addr, struct rdma_dev_addr *dev_addr)
 				break;
 			}
 		}
+		read_unlock(&dev_base_lock);
 		break;
 #endif
 	}
@@ -176,48 +176,9 @@ static void queue_req(struct addr_req *req)
 	mutex_unlock(&lock);
 }
 
-static void addr_send_arp(struct sockaddr *dst_in)
-{
-	struct rtable *rt;
-	struct flowi fl;
-
-	memset(&fl, 0, sizeof fl);
-
-	switch (dst_in->sa_family) {
-	case AF_INET:
-		fl.nl_u.ip4_u.daddr =
-			((struct sockaddr_in *) dst_in)->sin_addr.s_addr;
-
-		if (ip_route_output_key(&init_net, &rt, &fl))
-			return;
-
-		neigh_event_send(rt->u.dst.neighbour, NULL);
-		ip_rt_put(rt);
-		break;
-
-#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
-	case AF_INET6:
-	{
-		struct dst_entry *dst;
-
-		fl.nl_u.ip6_u.daddr =
-			((struct sockaddr_in6 *) dst_in)->sin6_addr;
-
-		dst = ip6_route_output(&init_net, NULL, &fl);
-		if (!dst)
-			return;
-
-		neigh_event_send(dst->neighbour, NULL);
-		dst_release(dst);
-		break;
-	}
-#endif
-	}
-}
-
-static int addr4_resolve_remote(struct sockaddr_in *src_in,
-			       struct sockaddr_in *dst_in,
-			       struct rdma_dev_addr *addr)
+static int addr4_resolve(struct sockaddr_in *src_in,
+			 struct sockaddr_in *dst_in,
+			 struct rdma_dev_addr *addr)
 {
 	__be32 src_ip = src_in->sin_addr.s_addr;
 	__be32 dst_ip = dst_in->sin_addr.s_addr;
@@ -229,10 +190,22 @@ static int addr4_resolve_remote(struct sockaddr_in *src_in,
 	memset(&fl, 0, sizeof fl);
 	fl.nl_u.ip4_u.daddr = dst_ip;
 	fl.nl_u.ip4_u.saddr = src_ip;
+	fl.oif = addr->bound_dev_if;
+
 	ret = ip_route_output_key(&init_net, &rt, &fl);
 	if (ret)
 		goto out;
 
+	src_in->sin_family = AF_INET;
+	src_in->sin_addr.s_addr = rt->rt_src;
+
+	if (rt->idev->dev->flags & IFF_LOOPBACK) {
+		ret = rdma_translate_ip((struct sockaddr *) dst_in, addr);
+		if (!ret)
+			memcpy(addr->dst_dev_addr, addr->src_dev_addr, MAX_ADDR_LEN);
+		goto put;
+	}
+
 	/* If the device does ARP internally, return 'done' */
 	if (rt->idev->dev->flags & IFF_NOARP) {
 		rdma_copy_addr(addr, rt->idev->dev, NULL);
@@ -240,21 +213,14 @@ static int addr4_resolve_remote(struct sockaddr_in *src_in,
 	}
 
 	neigh = neigh_lookup(&arp_tbl, &rt->rt_gateway, rt->idev->dev);
-	if (!neigh) {
+	if (!neigh || !(neigh->nud_state & NUD_VALID)) {
+		neigh_event_send(rt->u.dst.neighbour, NULL);
 		ret = -ENODATA;
+		if (neigh)
+			goto release;
 		goto put;
 	}
 
-	if (!(neigh->nud_state & NUD_VALID)) {
-		ret = -ENODATA;
-		goto release;
-	}
-
-	if (!src_ip) {
-		src_in->sin_family = dst_in->sin_family;
-		src_in->sin_addr.s_addr = rt->rt_src;
-	}
-
 	ret = rdma_copy_addr(addr, neigh->dev, neigh->ha);
 release:
 	neigh_release(neigh);
@@ -265,52 +231,77 @@ out:
 }
 
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
-static int addr6_resolve_remote(struct sockaddr_in6 *src_in,
-			       struct sockaddr_in6 *dst_in,
-			       struct rdma_dev_addr *addr)
+static int addr6_resolve(struct sockaddr_in6 *src_in,
+			 struct sockaddr_in6 *dst_in,
+			 struct rdma_dev_addr *addr)
 {
 	struct flowi fl;
 	struct neighbour *neigh;
 	struct dst_entry *dst;
-	int ret = -ENODATA;
+	int ret;
 
 	memset(&fl, 0, sizeof fl);
-	fl.nl_u.ip6_u.daddr = dst_in->sin6_addr;
-	fl.nl_u.ip6_u.saddr = src_in->sin6_addr;
+	ipv6_addr_copy(&fl.fl6_dst, &dst_in->sin6_addr);
+	ipv6_addr_copy(&fl.fl6_src, &src_in->sin6_addr);
+	fl.oif = addr->bound_dev_if;
 
 	dst = ip6_route_output(&init_net, NULL, &fl);
-	if (!dst)
-		return ret;
+	if ((ret = dst->error))
+		goto put;
+
+	if (ipv6_addr_any(&fl.fl6_src)) {
+		ret = ipv6_dev_get_saddr(&init_net, ip6_dst_idev(dst)->dev,
+					 &fl.fl6_dst, 0, &fl.fl6_src);
+		if (ret)
+			goto put;
+
+		src_in->sin6_family = AF_INET6;
+		ipv6_addr_copy(&src_in->sin6_addr, &fl.fl6_src);
+	}
+
+	if (dst->dev->flags & IFF_LOOPBACK) {
+		ret = rdma_translate_ip((struct sockaddr *) dst_in, addr);
+		if (!ret)
+			memcpy(addr->dst_dev_addr, addr->src_dev_addr, MAX_ADDR_LEN);
+		goto put;
+	}
 
+	/* If the device does ARP internally, return 'done' */
 	if (dst->dev->flags & IFF_NOARP) {
 		ret = rdma_copy_addr(addr, dst->dev, NULL);
-	} else {
-		neigh = dst->neighbour;
-		if (neigh && (neigh->nud_state & NUD_VALID))
-			ret = rdma_copy_addr(addr, neigh->dev, neigh->ha);
+		goto put;
+	}
+
+	neigh = dst->neighbour;
+	if (!neigh || !(neigh->nud_state & NUD_VALID)) {
+		neigh_event_send(dst->neighbour, NULL);
+		ret = -ENODATA;
+		goto put;
 	}
 
+	ret = rdma_copy_addr(addr, dst->dev, neigh->ha);
+put:
 	dst_release(dst);
 	return ret;
 }
 #else
-static int addr6_resolve_remote(struct sockaddr_in6 *src_in,
-			       struct sockaddr_in6 *dst_in,
-			       struct rdma_dev_addr *addr)
+static int addr6_resolve(struct sockaddr_in6 *src_in,
+			 struct sockaddr_in6 *dst_in,
+			 struct rdma_dev_addr *addr)
 {
 	return -EADDRNOTAVAIL;
 }
 #endif
 
-static int addr_resolve_remote(struct sockaddr *src_in,
-				struct sockaddr *dst_in,
-				struct rdma_dev_addr *addr)
+static int addr_resolve(struct sockaddr *src_in,
+			struct sockaddr *dst_in,
+			struct rdma_dev_addr *addr)
 {
 	if (src_in->sa_family == AF_INET) {
-		return addr4_resolve_remote((struct sockaddr_in *) src_in,
+		return addr4_resolve((struct sockaddr_in *) src_in,
 			(struct sockaddr_in *) dst_in, addr);
 	} else
-		return addr6_resolve_remote((struct sockaddr_in6 *) src_in,
+		return addr6_resolve((struct sockaddr_in6 *) src_in,
 			(struct sockaddr_in6 *) dst_in, addr);
 }
 
@@ -327,8 +318,7 @@ static void process_req(struct work_struct *work)
 		if (req->status == -ENODATA) {
 			src_in = (struct sockaddr *) &req->src_addr;
 			dst_in = (struct sockaddr *) &req->dst_addr;
-			req->status = addr_resolve_remote(src_in, dst_in,
-							  req->addr);
+			req->status = addr_resolve(src_in, dst_in, req->addr);
 			if (req->status && time_after_eq(jiffies, req->timeout))
 				req->status = -ETIMEDOUT;
 			else if (req->status == -ENODATA)
@@ -352,82 +342,6 @@ static void process_req(struct work_struct *work)
 	}
 }
 
-static int addr_resolve_local(struct sockaddr *src_in,
-			      struct sockaddr *dst_in,
-			      struct rdma_dev_addr *addr)
-{
-	struct net_device *dev;
-	int ret;
-
-	switch (dst_in->sa_family) {
-	case AF_INET:
-	{
-		__be32 src_ip = ((struct sockaddr_in *) src_in)->sin_addr.s_addr;
-		__be32 dst_ip = ((struct sockaddr_in *) dst_in)->sin_addr.s_addr;
-
-		dev = ip_dev_find(&init_net, dst_ip);
-		if (!dev)
-			return -EADDRNOTAVAIL;
-
-		if (ipv4_is_zeronet(src_ip)) {
-			src_in->sa_family = dst_in->sa_family;
-			((struct sockaddr_in *) src_in)->sin_addr.s_addr = dst_ip;
-			ret = rdma_copy_addr(addr, dev, dev->dev_addr);
-		} else if (ipv4_is_loopback(src_ip)) {
-			ret = rdma_translate_ip(dst_in, addr);
-			if (!ret)
-				memcpy(addr->dst_dev_addr, dev->dev_addr, MAX_ADDR_LEN);
-		} else {
-			ret = rdma_translate_ip(src_in, addr);
-			if (!ret)
-				memcpy(addr->dst_dev_addr, dev->dev_addr, MAX_ADDR_LEN);
-		}
-		dev_put(dev);
-		break;
-	}
-
-#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
-	case AF_INET6:
-	{
-		struct in6_addr *a;
-
-		for_each_netdev(&init_net, dev)
-			if (ipv6_chk_addr(&init_net,
-					  &((struct sockaddr_in6 *) dst_in)->sin6_addr,
-					  dev, 1))
-				break;
-
-		if (!dev)
-			return -EADDRNOTAVAIL;
-
-		a = &((struct sockaddr_in6 *) src_in)->sin6_addr;
-
-		if (ipv6_addr_any(a)) {
-			src_in->sa_family = dst_in->sa_family;
-			((struct sockaddr_in6 *) src_in)->sin6_addr =
-				((struct sockaddr_in6 *) dst_in)->sin6_addr;
-			ret = rdma_copy_addr(addr, dev, dev->dev_addr);
-		} else if (ipv6_addr_loopback(a)) {
-			ret = rdma_translate_ip(dst_in, addr);
-			if (!ret)
-				memcpy(addr->dst_dev_addr, dev->dev_addr, MAX_ADDR_LEN);
-		} else  {
-			ret = rdma_translate_ip(src_in, addr);
-			if (!ret)
-				memcpy(addr->dst_dev_addr, dev->dev_addr, MAX_ADDR_LEN);
-		}
-		break;
-	}
-#endif
-
-	default:
-		ret = -EADDRNOTAVAIL;
-		break;
-	}
-
-	return ret;
-}
-
 int rdma_resolve_ip(struct rdma_addr_client *client,
 		    struct sockaddr *src_addr, struct sockaddr *dst_addr,
 		    struct rdma_dev_addr *addr, int timeout_ms,
@@ -443,22 +357,28 @@ int rdma_resolve_ip(struct rdma_addr_client *client,
 	if (!req)
 		return -ENOMEM;
 
-	if (src_addr)
-		memcpy(&req->src_addr, src_addr, ip_addr_size(src_addr));
-	memcpy(&req->dst_addr, dst_addr, ip_addr_size(dst_addr));
+	src_in = (struct sockaddr *) &req->src_addr;
+	dst_in = (struct sockaddr *) &req->dst_addr;
+
+	if (src_addr) {
+		if (src_addr->sa_family != dst_addr->sa_family) {
+			ret = -EINVAL;
+			goto err;
+		}
+
+		memcpy(src_in, src_addr, ip_addr_size(src_addr));
+	} else {
+		src_in->sa_family = dst_addr->sa_family;
+	}
+
+	memcpy(dst_in, dst_addr, ip_addr_size(dst_addr));
 	req->addr = addr;
 	req->callback = callback;
 	req->context = context;
 	req->client = client;
 	atomic_inc(&client->refcount);
 
-	src_in = (struct sockaddr *) &req->src_addr;
-	dst_in = (struct sockaddr *) &req->dst_addr;
-
-	req->status = addr_resolve_local(src_in, dst_in, addr);
-	if (req->status == -EADDRNOTAVAIL)
-		req->status = addr_resolve_remote(src_in, dst_in, addr);
-
+	req->status = addr_resolve(src_in, dst_in, addr);
 	switch (req->status) {
 	case 0:
 		req->timeout = jiffies;
@@ -467,15 +387,16 @@ int rdma_resolve_ip(struct rdma_addr_client *client,
 	case -ENODATA:
 		req->timeout = msecs_to_jiffies(timeout_ms) + jiffies;
 		queue_req(req);
-		addr_send_arp(dst_in);
 		break;
 	default:
 		ret = req->status;
 		atomic_dec(&client->refcount);
-		kfree(req);
-		break;
+		goto err;
 	}
 	return ret;
+err:
+	kfree(req);
+	return ret;
 }
 EXPORT_SYMBOL(rdma_resolve_ip);
 
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 075317884b53..cc9b5940fa97 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -330,17 +330,7 @@ static int cma_acquire_dev(struct rdma_id_private *id_priv)
 	union ib_gid gid;
 	int ret = -ENODEV;
 
-	switch (rdma_node_get_transport(dev_addr->dev_type)) {
-	case RDMA_TRANSPORT_IB:
-		ib_addr_get_sgid(dev_addr, &gid);
-		break;
-	case RDMA_TRANSPORT_IWARP:
-		iw_addr_get_sgid(dev_addr, &gid);
-		break;
-	default:
-		return -ENODEV;
-	}
-
+	rdma_addr_get_sgid(dev_addr, &gid);
 	list_for_each_entry(cma_dev, &dev_list, list) {
 		ret = ib_find_cached_gid(cma_dev->device, &gid,
 					 &id_priv->id.port_num, NULL);
@@ -1032,11 +1022,17 @@ static struct rdma_id_private *cma_new_conn_id(struct rdma_cm_id *listen_id,
 	if (rt->num_paths == 2)
 		rt->path_rec[1] = *ib_event->param.req_rcvd.alternate_path;
 
-	ib_addr_set_dgid(&rt->addr.dev_addr, &rt->path_rec[0].dgid);
-	ret = rdma_translate_ip((struct sockaddr *) &id->route.addr.src_addr,
-				&id->route.addr.dev_addr);
-	if (ret)
-		goto destroy_id;
+	if (cma_any_addr((struct sockaddr *) &rt->addr.src_addr)) {
+		rt->addr.dev_addr.dev_type = ARPHRD_INFINIBAND;
+		rdma_addr_set_sgid(&rt->addr.dev_addr, &rt->path_rec[0].sgid);
+		ib_addr_set_pkey(&rt->addr.dev_addr, rt->path_rec[0].pkey);
+	} else {
+		ret = rdma_translate_ip((struct sockaddr *) &rt->addr.src_addr,
+					&rt->addr.dev_addr);
+		if (ret)
+			goto destroy_id;
+	}
+	rdma_addr_set_dgid(&rt->addr.dev_addr, &rt->path_rec[0].dgid);
 
 	id_priv = container_of(id, struct rdma_id_private, id);
 	id_priv->state = CMA_CONNECT;
@@ -1071,10 +1067,12 @@ static struct rdma_id_private *cma_new_udp_id(struct rdma_cm_id *listen_id,
 	cma_save_net_info(&id->route.addr, &listen_id->route.addr,
 			  ip_ver, port, src, dst);
 
-	ret = rdma_translate_ip((struct sockaddr *) &id->route.addr.src_addr,
-				&id->route.addr.dev_addr);
-	if (ret)
-		goto err;
+	if (!cma_any_addr((struct sockaddr *) &id->route.addr.src_addr)) {
+		ret = rdma_translate_ip((struct sockaddr *) &id->route.addr.src_addr,
+					&id->route.addr.dev_addr);
+		if (ret)
+			goto err;
+	}
 
 	id_priv = container_of(id, struct rdma_id_private, id);
 	id_priv->state = CMA_CONNECT;
@@ -1474,15 +1472,6 @@ static void cma_listen_on_all(struct rdma_id_private *id_priv)
 	mutex_unlock(&lock);
 }
 
-static int cma_bind_any(struct rdma_cm_id *id, sa_family_t af)
-{
-	struct sockaddr_storage addr_in;
-
-	memset(&addr_in, 0, sizeof addr_in);
-	addr_in.ss_family = af;
-	return rdma_bind_addr(id, (struct sockaddr *) &addr_in);
-}
-
 int rdma_listen(struct rdma_cm_id *id, int backlog)
 {
 	struct rdma_id_private *id_priv;
@@ -1490,7 +1479,8 @@ int rdma_listen(struct rdma_cm_id *id, int backlog)
 
 	id_priv = container_of(id, struct rdma_id_private, id);
 	if (id_priv->state == CMA_IDLE) {
-		ret = cma_bind_any(id, AF_INET);
+		((struct sockaddr *) &id->route.addr.src_addr)->sa_family = AF_INET;
+		ret = rdma_bind_addr(id, (struct sockaddr *) &id->route.addr.src_addr);
 		if (ret)
 			return ret;
 	}
@@ -1565,8 +1555,8 @@ static int cma_query_ib_route(struct rdma_id_private *id_priv, int timeout_ms,
 	struct sockaddr_in6 *sin6;
 
 	memset(&path_rec, 0, sizeof path_rec);
-	ib_addr_get_sgid(&addr->dev_addr, &path_rec.sgid);
-	ib_addr_get_dgid(&addr->dev_addr, &path_rec.dgid);
+	rdma_addr_get_sgid(&addr->dev_addr, &path_rec.sgid);
+	rdma_addr_get_dgid(&addr->dev_addr, &path_rec.dgid);
 	path_rec.pkey = cpu_to_be16(ib_addr_get_pkey(&addr->dev_addr));
 	path_rec.numb_path = 1;
 	path_rec.reversible = 1;
@@ -1781,7 +1771,11 @@ port_found:
 	if (ret)
 		goto out;
 
-	ib_addr_set_sgid(&id_priv->id.route.addr.dev_addr, &gid);
+	id_priv->id.route.addr.dev_addr.dev_type =
+		(rdma_node_get_transport(cma_dev->device->node_type) == RDMA_TRANSPORT_IB) ?
+		ARPHRD_INFINIBAND : ARPHRD_ETHER;
+
+	rdma_addr_set_sgid(&id_priv->id.route.addr.dev_addr, &gid);
 	ib_addr_set_pkey(&id_priv->id.route.addr.dev_addr, pkey);
 	id_priv->id.port_num = p;
 	cma_attach_to_dev(id_priv, cma_dev);
@@ -1839,7 +1833,7 @@ out:
 static int cma_resolve_loopback(struct rdma_id_private *id_priv)
 {
 	struct cma_work *work;
-	struct sockaddr_in *src_in, *dst_in;
+	struct sockaddr *src, *dst;
 	union ib_gid gid;
 	int ret;
 
@@ -1853,14 +1847,19 @@ static int cma_resolve_loopback(struct rdma_id_private *id_priv)
 			goto err;
 	}
 
-	ib_addr_get_sgid(&id_priv->id.route.addr.dev_addr, &gid);
-	ib_addr_set_dgid(&id_priv->id.route.addr.dev_addr, &gid);
+	rdma_addr_get_sgid(&id_priv->id.route.addr.dev_addr, &gid);
+	rdma_addr_set_dgid(&id_priv->id.route.addr.dev_addr, &gid);
 
-	if (cma_zero_addr((struct sockaddr *) &id_priv->id.route.addr.src_addr)) {
-		src_in = (struct sockaddr_in *)&id_priv->id.route.addr.src_addr;
-		dst_in = (struct sockaddr_in *)&id_priv->id.route.addr.dst_addr;
-		src_in->sin_family = dst_in->sin_family;
-		src_in->sin_addr.s_addr = dst_in->sin_addr.s_addr;
+	src = (struct sockaddr *) &id_priv->id.route.addr.src_addr;
+	if (cma_zero_addr(src)) {
+		dst = (struct sockaddr *) &id_priv->id.route.addr.dst_addr;
+		if ((src->sa_family = dst->sa_family) == AF_INET) {
+			((struct sockaddr_in *) src)->sin_addr.s_addr =
+				((struct sockaddr_in *) dst)->sin_addr.s_addr;
+		} else {
+			ipv6_addr_copy(&((struct sockaddr_in6 *) src)->sin6_addr,
+				       &((struct sockaddr_in6 *) dst)->sin6_addr);
+		}
 	}
 
 	work->id = id_priv;
@@ -1878,10 +1877,14 @@ err:
 static int cma_bind_addr(struct rdma_cm_id *id, struct sockaddr *src_addr,
 			 struct sockaddr *dst_addr)
 {
-	if (src_addr && src_addr->sa_family)
-		return rdma_bind_addr(id, src_addr);
-	else
-		return cma_bind_any(id, dst_addr->sa_family);
+	if (!src_addr || !src_addr->sa_family) {
+		src_addr = (struct sockaddr *) &id->route.addr.src_addr;
+		if ((src_addr->sa_family = dst_addr->sa_family) == AF_INET6) {
+			((struct sockaddr_in6 *) src_addr)->sin6_scope_id =
+				((struct sockaddr_in6 *) dst_addr)->sin6_scope_id;
+		}
+	}
+	return rdma_bind_addr(id, src_addr);
 }
 
 int rdma_resolve_addr(struct rdma_cm_id *id, struct sockaddr *src_addr,
@@ -2077,6 +2080,25 @@ static int cma_get_port(struct rdma_id_private *id_priv)
 	return ret;
 }
 
+static int cma_check_linklocal(struct rdma_dev_addr *dev_addr,
+			       struct sockaddr *addr)
+{
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+	struct sockaddr_in6 *sin6;
+
+	if (addr->sa_family != AF_INET6)
+		return 0;
+
+	sin6 = (struct sockaddr_in6 *) addr;
+	if ((ipv6_addr_type(&sin6->sin6_addr) & IPV6_ADDR_LINKLOCAL) &&
+	    !sin6->sin6_scope_id)
+			return -EINVAL;
+
+	dev_addr->bound_dev_if = sin6->sin6_scope_id;
+#endif
+	return 0;
+}
+
 int rdma_bind_addr(struct rdma_cm_id *id, struct sockaddr *addr)
 {
 	struct rdma_id_private *id_priv;
@@ -2089,7 +2111,13 @@ int rdma_bind_addr(struct rdma_cm_id *id, struct sockaddr *addr)
 	if (!cma_comp_exch(id_priv, CMA_IDLE, CMA_ADDR_BOUND))
 		return -EINVAL;
 
-	if (!cma_any_addr(addr)) {
+	ret = cma_check_linklocal(&id->route.addr.dev_addr, addr);
+	if (ret)
+		goto err1;
+
+	if (cma_loopback_addr(addr)) {
+		ret = cma_bind_loopback(id_priv);
+	} else if (!cma_zero_addr(addr)) {
 		ret = rdma_translate_ip(addr, &id->route.addr.dev_addr);
 		if (ret)
 			goto err1;
@@ -2108,7 +2136,7 @@ int rdma_bind_addr(struct rdma_cm_id *id, struct sockaddr *addr)
 
 	return 0;
 err2:
-	if (!cma_any_addr(addr)) {
+	if (id_priv->cma_dev) {
 		mutex_lock(&lock);
 		cma_detach_from_dev(id_priv);
 		mutex_unlock(&lock);
@@ -2687,10 +2715,15 @@ static void cma_set_mgid(struct rdma_id_private *id_priv,
 	if (cma_any_addr(addr)) {
 		memset(mgid, 0, sizeof *mgid);
 	} else if ((addr->sa_family == AF_INET6) &&
-		   ((be32_to_cpu(sin6->sin6_addr.s6_addr32[0]) & 0xFF10A01B) ==
+		   ((be32_to_cpu(sin6->sin6_addr.s6_addr32[0]) & 0xFFF0FFFF) ==
 								 0xFF10A01B)) {
 		/* IPv6 address is an SA assigned MGID. */
 		memcpy(mgid, &sin6->sin6_addr, sizeof *mgid);
+	} else if ((addr->sa_family == AF_INET6)) {
+		ipv6_ib_mc_map(&sin6->sin6_addr, dev_addr->broadcast, mc_map);
+		if (id_priv->id.ps == RDMA_PS_UDP)
+			mc_map[7] = 0x01;	/* Use RDMA CM signature */
+		*mgid = *(union ib_gid *) (mc_map + 4);
 	} else {
 		ip_ib_mc_map(sin->sin_addr.s_addr, dev_addr->broadcast, mc_map);
 		if (id_priv->id.ps == RDMA_PS_UDP)
@@ -2716,7 +2749,7 @@ static int cma_join_ib_multicast(struct rdma_id_private *id_priv,
 	cma_set_mgid(id_priv, (struct sockaddr *) &mc->addr, &rec.mgid);
 	if (id_priv->id.ps == RDMA_PS_UDP)
 		rec.qkey = cpu_to_be32(RDMA_UDP_QKEY);
-	ib_addr_get_sgid(dev_addr, &rec.port_gid);
+	rdma_addr_get_sgid(dev_addr, &rec.port_gid);
 	rec.pkey = cpu_to_be16(ib_addr_get_pkey(dev_addr));
 	rec.join_state = 1;
 
@@ -2815,7 +2848,7 @@ static int cma_netdev_change(struct net_device *ndev, struct rdma_id_private *id
 
 	dev_addr = &id_priv->id.route.addr.dev_addr;
 
-	if ((dev_addr->src_dev == ndev) &&
+	if ((dev_addr->bound_dev_if == ndev->ifindex) &&
 	    memcmp(dev_addr->src_dev_addr, ndev->dev_addr, ndev->addr_len)) {
 		printk(KERN_INFO "RDMA CM addr change for ndev %s used by id %p\n",
 		       ndev->name, &id_priv->id);
diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c
index 82543716d59e..7e1ffd8ccd5c 100644
--- a/drivers/infiniband/core/sa_query.c
+++ b/drivers/infiniband/core/sa_query.c
@@ -604,6 +604,12 @@ retry:
 	return ret ? ret : id;
 }
 
+void ib_sa_unpack_path(void *attribute, struct ib_sa_path_rec *rec)
+{
+	ib_unpack(path_rec_table, ARRAY_SIZE(path_rec_table), attribute, rec);
+}
+EXPORT_SYMBOL(ib_sa_unpack_path);
+
 static void ib_sa_path_rec_callback(struct ib_sa_query *sa_query,
 				    int status,
 				    struct ib_sa_mad *mad)
diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index bb96d3c4b0f4..b2e16c332d5b 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -43,6 +43,7 @@
 #include <rdma/rdma_user_cm.h>
 #include <rdma/ib_marshall.h>
 #include <rdma/rdma_cm.h>
+#include <rdma/rdma_cm_ib.h>
 
 MODULE_AUTHOR("Sean Hefty");
 MODULE_DESCRIPTION("RDMA Userspace Connection Manager Access");
@@ -562,10 +563,10 @@ static void ucma_copy_ib_route(struct rdma_ucm_query_route_resp *resp,
 	switch (route->num_paths) {
 	case 0:
 		dev_addr = &route->addr.dev_addr;
-		ib_addr_get_dgid(dev_addr,
-				 (union ib_gid *) &resp->ib_route[0].dgid);
-		ib_addr_get_sgid(dev_addr,
-				 (union ib_gid *) &resp->ib_route[0].sgid);
+		rdma_addr_get_dgid(dev_addr,
+				   (union ib_gid *) &resp->ib_route[0].dgid);
+		rdma_addr_get_sgid(dev_addr,
+				   (union ib_gid *) &resp->ib_route[0].sgid);
 		resp->ib_route[0].pkey = cpu_to_be16(ib_addr_get_pkey(dev_addr));
 		break;
 	case 2:
@@ -812,6 +813,51 @@ static int ucma_set_option_id(struct ucma_context *ctx, int optname,
 	return ret;
 }
 
+static int ucma_set_ib_path(struct ucma_context *ctx,
+			    struct ib_path_rec_data *path_data, size_t optlen)
+{
+	struct ib_sa_path_rec sa_path;
+	struct rdma_cm_event event;
+	int ret;
+
+	if (optlen % sizeof(*path_data))
+		return -EINVAL;
+
+	for (; optlen; optlen -= sizeof(*path_data), path_data++) {
+		if (path_data->flags == (IB_PATH_GMP | IB_PATH_PRIMARY |
+					 IB_PATH_BIDIRECTIONAL))
+			break;
+	}
+
+	if (!optlen)
+		return -EINVAL;
+
+	ib_sa_unpack_path(path_data->path_rec, &sa_path);
+	ret = rdma_set_ib_paths(ctx->cm_id, &sa_path, 1);
+	if (ret)
+		return ret;
+
+	memset(&event, 0, sizeof event);
+	event.event = RDMA_CM_EVENT_ROUTE_RESOLVED;
+	return ucma_event_handler(ctx->cm_id, &event);
+}
+
+static int ucma_set_option_ib(struct ucma_context *ctx, int optname,
+			      void *optval, size_t optlen)
+{
+	int ret;
+
+	switch (optname) {
+	case RDMA_OPTION_IB_PATH:
+		ret = ucma_set_ib_path(ctx, optval, optlen);
+		break;
+	default:
+		ret = -ENOSYS;
+	}
+
+	return ret;
+}
+
 static int ucma_set_option_level(struct ucma_context *ctx, int level,
 				 int optname, void *optval, size_t optlen)
 {
@@ -821,6 +867,9 @@ static int ucma_set_option_level(struct ucma_context *ctx, int level,
 	case RDMA_OPTION_ID:
 		ret = ucma_set_option_id(ctx, optname, optval, optlen);
 		break;
+	case RDMA_OPTION_IB:
+		ret = ucma_set_option_ib(ctx, optname, optval, optlen);
+		break;
 	default:
 		ret = -ENOSYS;
 	}
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index 56feab6c251e..112d3970222a 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -285,7 +285,7 @@ ssize_t ib_uverbs_get_context(struct ib_uverbs_file *file,
 
 	ucontext = ibdev->alloc_ucontext(ibdev, &udata);
 	if (IS_ERR(ucontext)) {
-		ret = PTR_ERR(file->ucontext);
+		ret = PTR_ERR(ucontext);
 		goto err;
 	}
 
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index aec0fbdfe7f0..5f284ffd430e 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -492,6 +492,7 @@ struct file *ib_uverbs_alloc_event_file(struct ib_uverbs_file *uverbs_file,
 					int is_async, int *fd)
 {
 	struct ib_uverbs_event_file *ev_file;
+	struct path path;
 	struct file *filp;
 	int ret;
 
@@ -519,8 +520,10 @@ struct file *ib_uverbs_alloc_event_file(struct ib_uverbs_file *uverbs_file,
 	 * system call on a uverbs file, which will already have a
 	 * module reference.
 	 */
-	filp = alloc_file(uverbs_event_mnt, dget(uverbs_event_mnt->mnt_root),
-			  FMODE_READ, fops_get(&uverbs_event_fops));
+	path.mnt = uverbs_event_mnt;
+	path.dentry = uverbs_event_mnt->mnt_root;
+	path_get(&path);
+	filp = alloc_file(&path, FMODE_READ, fops_get(&uverbs_event_fops));
 	if (!filp) {
 		ret = -ENFILE;
 		goto err_fd;
@@ -531,6 +534,8 @@ struct file *ib_uverbs_alloc_event_file(struct ib_uverbs_file *uverbs_file,
 	return filp;
 
 err_fd:
+	fops_put(&uverbs_event_fops);
+	path_put(&path);
 	put_unused_fd(*fd);
 
 err:
diff --git a/drivers/infiniband/hw/amso1100/c2_qp.c b/drivers/infiniband/hw/amso1100/c2_qp.c
index a6d89440ad2c..ad518868df77 100644
--- a/drivers/infiniband/hw/amso1100/c2_qp.c
+++ b/drivers/infiniband/hw/amso1100/c2_qp.c
@@ -798,8 +798,10 @@ int c2_post_send(struct ib_qp *ibqp, struct ib_send_wr *ib_wr,
 	u8 actual_sge_count;
 	u32 msg_size;
 
-	if (qp->state > IB_QPS_RTS)
-		return -EINVAL;
+	if (qp->state > IB_QPS_RTS) {
+		err = -EINVAL;
+		goto out;
+	}
 
 	while (ib_wr) {
 
@@ -930,6 +932,7 @@ int c2_post_send(struct ib_qp *ibqp, struct ib_send_wr *ib_wr,
 		ib_wr = ib_wr->next;
 	}
 
+out:
 	if (err)
 		*bad_wr = ib_wr;
 	return err;
@@ -944,8 +947,10 @@ int c2_post_receive(struct ib_qp *ibqp, struct ib_recv_wr *ib_wr,
 	unsigned long lock_flags;
 	int err = 0;
 
-	if (qp->state > IB_QPS_RTS)
-		return -EINVAL;
+	if (qp->state > IB_QPS_RTS) {
+		err = -EINVAL;
+		goto out;
+	}
 
 	/*
 	 * Try and post each work request
@@ -998,6 +1003,7 @@ int c2_post_receive(struct ib_qp *ibqp, struct ib_recv_wr *ib_wr,
 		ib_wr = ib_wr->next;
 	}
 
+out:
 	if (err)
 		*bad_wr = ib_wr;
 	return err;
diff --git a/drivers/infiniband/hw/cxgb3/cxio_hal.c b/drivers/infiniband/hw/cxgb3/cxio_hal.c
index 72ed3396b721..0677fc7dfd51 100644
--- a/drivers/infiniband/hw/cxgb3/cxio_hal.c
+++ b/drivers/infiniband/hw/cxgb3/cxio_hal.c
@@ -589,7 +589,7 @@ static int cxio_hal_destroy_ctrl_qp(struct cxio_rdev *rdev_p)
 
 /* write len bytes of data into addr (32B aligned address)
  * If data is NULL, clear len byte of memory to zero.
- * caller aquires the ctrl_qp lock before the call
+ * caller acquires the ctrl_qp lock before the call
  */
 static int cxio_hal_ctrl_qp_write_mem(struct cxio_rdev *rdev_p, u32 addr,
 				      u32 len, void *data)
diff --git a/drivers/infiniband/hw/cxgb3/cxio_hal.h b/drivers/infiniband/hw/cxgb3/cxio_hal.h
index bfd03bf8be54..f3d440cc68f2 100644
--- a/drivers/infiniband/hw/cxgb3/cxio_hal.h
+++ b/drivers/infiniband/hw/cxgb3/cxio_hal.h
@@ -34,6 +34,7 @@
 
 #include <linux/list.h>
 #include <linux/mutex.h>
+#include <linux/kfifo.h>
 
 #include "t3_cpl.h"
 #include "t3cdev.h"
@@ -75,13 +76,13 @@ struct cxio_hal_ctrl_qp {
 };
 
 struct cxio_hal_resource {
-	struct kfifo *tpt_fifo;
+	struct kfifo tpt_fifo;
 	spinlock_t tpt_fifo_lock;
-	struct kfifo *qpid_fifo;
+	struct kfifo qpid_fifo;
 	spinlock_t qpid_fifo_lock;
-	struct kfifo *cqid_fifo;
+	struct kfifo cqid_fifo;
 	spinlock_t cqid_fifo_lock;
-	struct kfifo *pdid_fifo;
+	struct kfifo pdid_fifo;
 	spinlock_t pdid_fifo_lock;
 };
 
diff --git a/drivers/infiniband/hw/cxgb3/cxio_resource.c b/drivers/infiniband/hw/cxgb3/cxio_resource.c
index bd233c087653..31f9201b2980 100644
--- a/drivers/infiniband/hw/cxgb3/cxio_resource.c
+++ b/drivers/infiniband/hw/cxgb3/cxio_resource.c
@@ -39,12 +39,12 @@
 #include "cxio_resource.h"
 #include "cxio_hal.h"
 
-static struct kfifo *rhdl_fifo;
+static struct kfifo rhdl_fifo;
 static spinlock_t rhdl_fifo_lock;
 
 #define RANDOM_SIZE 16
 
-static int __cxio_init_resource_fifo(struct kfifo **fifo,
+static int __cxio_init_resource_fifo(struct kfifo *fifo,
 				   spinlock_t *fifo_lock,
 				   u32 nr, u32 skip_low,
 				   u32 skip_high,
@@ -55,12 +55,11 @@ static int __cxio_init_resource_fifo(struct kfifo **fifo,
 	u32 rarray[16];
 	spin_lock_init(fifo_lock);
 
-	*fifo = kfifo_alloc(nr * sizeof(u32), GFP_KERNEL, fifo_lock);
-	if (IS_ERR(*fifo))
+	if (kfifo_alloc(fifo, nr * sizeof(u32), GFP_KERNEL))
 		return -ENOMEM;
 
 	for (i = 0; i < skip_low + skip_high; i++)
-		__kfifo_put(*fifo, (unsigned char *) &entry, sizeof(u32));
+		kfifo_in(fifo, (unsigned char *) &entry, sizeof(u32));
 	if (random) {
 		j = 0;
 		random_bytes = random32();
@@ -72,33 +71,35 @@ static int __cxio_init_resource_fifo(struct kfifo **fifo,
 				random_bytes = random32();
 			}
 			idx = (random_bytes >> (j * 2)) & 0xF;
-			__kfifo_put(*fifo,
+			kfifo_in(fifo,
 				(unsigned char *) &rarray[idx],
 				sizeof(u32));
 			rarray[idx] = i;
 			j++;
 		}
 		for (i = 0; i < RANDOM_SIZE; i++)
-			__kfifo_put(*fifo,
+			kfifo_in(fifo,
 				(unsigned char *) &rarray[i],
 				sizeof(u32));
 	} else
 		for (i = skip_low; i < nr - skip_high; i++)
-			__kfifo_put(*fifo, (unsigned char *) &i, sizeof(u32));
+			kfifo_in(fifo, (unsigned char *) &i, sizeof(u32));
 
 	for (i = 0; i < skip_low + skip_high; i++)
-		kfifo_get(*fifo, (unsigned char *) &entry, sizeof(u32));
+		if (kfifo_out_locked(fifo, (unsigned char *) &entry,
+				sizeof(u32), fifo_lock) != sizeof(u32))
+					break;
 	return 0;
 }
 
-static int cxio_init_resource_fifo(struct kfifo **fifo, spinlock_t * fifo_lock,
+static int cxio_init_resource_fifo(struct kfifo *fifo, spinlock_t * fifo_lock,
 				   u32 nr, u32 skip_low, u32 skip_high)
 {
 	return (__cxio_init_resource_fifo(fifo, fifo_lock, nr, skip_low,
 					  skip_high, 0));
 }
 
-static int cxio_init_resource_fifo_random(struct kfifo **fifo,
+static int cxio_init_resource_fifo_random(struct kfifo *fifo,
 				   spinlock_t * fifo_lock,
 				   u32 nr, u32 skip_low, u32 skip_high)
 {
@@ -113,15 +114,13 @@ static int cxio_init_qpid_fifo(struct cxio_rdev *rdev_p)
 
 	spin_lock_init(&rdev_p->rscp->qpid_fifo_lock);
 
-	rdev_p->rscp->qpid_fifo = kfifo_alloc(T3_MAX_NUM_QP * sizeof(u32),
-					      GFP_KERNEL,
-					      &rdev_p->rscp->qpid_fifo_lock);
-	if (IS_ERR(rdev_p->rscp->qpid_fifo))
+	if (kfifo_alloc(&rdev_p->rscp->qpid_fifo, T3_MAX_NUM_QP * sizeof(u32),
+					      GFP_KERNEL))
 		return -ENOMEM;
 
 	for (i = 16; i < T3_MAX_NUM_QP; i++)
 		if (!(i & rdev_p->qpmask))
-			__kfifo_put(rdev_p->rscp->qpid_fifo,
+			kfifo_in(&rdev_p->rscp->qpid_fifo,
 				    (unsigned char *) &i, sizeof(u32));
 	return 0;
 }
@@ -134,7 +133,7 @@ int cxio_hal_init_rhdl_resource(u32 nr_rhdl)
 
 void cxio_hal_destroy_rhdl_resource(void)
 {
-	kfifo_free(rhdl_fifo);
+	kfifo_free(&rhdl_fifo);
 }
 
 /* nr_* must be power of 2 */
@@ -167,11 +166,11 @@ int cxio_hal_init_resource(struct cxio_rdev *rdev_p,
 		goto pdid_err;
 	return 0;
 pdid_err:
-	kfifo_free(rscp->cqid_fifo);
+	kfifo_free(&rscp->cqid_fifo);
 cqid_err:
-	kfifo_free(rscp->qpid_fifo);
+	kfifo_free(&rscp->qpid_fifo);
 qpid_err:
-	kfifo_free(rscp->tpt_fifo);
+	kfifo_free(&rscp->tpt_fifo);
 tpt_err:
 	return -ENOMEM;
 }
@@ -179,33 +178,37 @@ tpt_err:
 /*
  * returns 0 if no resource available
  */
-static u32 cxio_hal_get_resource(struct kfifo *fifo)
+static u32 cxio_hal_get_resource(struct kfifo *fifo, spinlock_t * lock)
 {
 	u32 entry;
-	if (kfifo_get(fifo, (unsigned char *) &entry, sizeof(u32)))
+	if (kfifo_out_locked(fifo, (unsigned char *) &entry, sizeof(u32), lock))
 		return entry;
 	else
 		return 0;	/* fifo emptry */
 }
 
-static void cxio_hal_put_resource(struct kfifo *fifo, u32 entry)
+static void cxio_hal_put_resource(struct kfifo *fifo, spinlock_t * lock,
+		u32 entry)
 {
-	BUG_ON(kfifo_put(fifo, (unsigned char *) &entry, sizeof(u32)) == 0);
+	BUG_ON(
+	kfifo_in_locked(fifo, (unsigned char *) &entry, sizeof(u32), lock)
+	== 0);
 }
 
 u32 cxio_hal_get_stag(struct cxio_hal_resource *rscp)
 {
-	return cxio_hal_get_resource(rscp->tpt_fifo);
+	return cxio_hal_get_resource(&rscp->tpt_fifo, &rscp->tpt_fifo_lock);
 }
 
 void cxio_hal_put_stag(struct cxio_hal_resource *rscp, u32 stag)
 {
-	cxio_hal_put_resource(rscp->tpt_fifo, stag);
+	cxio_hal_put_resource(&rscp->tpt_fifo, &rscp->tpt_fifo_lock, stag);
 }
 
 u32 cxio_hal_get_qpid(struct cxio_hal_resource *rscp)
 {
-	u32 qpid = cxio_hal_get_resource(rscp->qpid_fifo);
+	u32 qpid = cxio_hal_get_resource(&rscp->qpid_fifo,
+			&rscp->qpid_fifo_lock);
 	PDBG("%s qpid 0x%x\n", __func__, qpid);
 	return qpid;
 }
@@ -213,35 +216,35 @@ u32 cxio_hal_get_qpid(struct cxio_hal_resource *rscp)
 void cxio_hal_put_qpid(struct cxio_hal_resource *rscp, u32 qpid)
 {
 	PDBG("%s qpid 0x%x\n", __func__, qpid);
-	cxio_hal_put_resource(rscp->qpid_fifo, qpid);
+	cxio_hal_put_resource(&rscp->qpid_fifo, &rscp->qpid_fifo_lock, qpid);
 }
 
 u32 cxio_hal_get_cqid(struct cxio_hal_resource *rscp)
 {
-	return cxio_hal_get_resource(rscp->cqid_fifo);
+	return cxio_hal_get_resource(&rscp->cqid_fifo, &rscp->cqid_fifo_lock);
 }
 
 void cxio_hal_put_cqid(struct cxio_hal_resource *rscp, u32 cqid)
 {
-	cxio_hal_put_resource(rscp->cqid_fifo, cqid);
+	cxio_hal_put_resource(&rscp->cqid_fifo, &rscp->cqid_fifo_lock, cqid);
 }
 
 u32 cxio_hal_get_pdid(struct cxio_hal_resource *rscp)
 {
-	return cxio_hal_get_resource(rscp->pdid_fifo);
+	return cxio_hal_get_resource(&rscp->pdid_fifo, &rscp->pdid_fifo_lock);
 }
 
 void cxio_hal_put_pdid(struct cxio_hal_resource *rscp, u32 pdid)
 {
-	cxio_hal_put_resource(rscp->pdid_fifo, pdid);
+	cxio_hal_put_resource(&rscp->pdid_fifo, &rscp->pdid_fifo_lock, pdid);
 }
 
 void cxio_hal_destroy_resource(struct cxio_hal_resource *rscp)
 {
-	kfifo_free(rscp->tpt_fifo);
-	kfifo_free(rscp->cqid_fifo);
-	kfifo_free(rscp->qpid_fifo);
-	kfifo_free(rscp->pdid_fifo);
+	kfifo_free(&rscp->tpt_fifo);
+	kfifo_free(&rscp->cqid_fifo);
+	kfifo_free(&rscp->qpid_fifo);
+	kfifo_free(&rscp->pdid_fifo);
 	kfree(rscp);
 }
 
diff --git a/drivers/infiniband/hw/cxgb3/iwch_qp.c b/drivers/infiniband/hw/cxgb3/iwch_qp.c
index 1cecf98829ac..3eb8cecf81d7 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_qp.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_qp.c
@@ -365,18 +365,19 @@ int iwch_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
 	spin_lock_irqsave(&qhp->lock, flag);
 	if (qhp->attr.state > IWCH_QP_STATE_RTS) {
 		spin_unlock_irqrestore(&qhp->lock, flag);
-		return -EINVAL;
+		err = -EINVAL;
+		goto out;
 	}
 	num_wrs = Q_FREECNT(qhp->wq.sq_rptr, qhp->wq.sq_wptr,
 		  qhp->wq.sq_size_log2);
 	if (num_wrs <= 0) {
 		spin_unlock_irqrestore(&qhp->lock, flag);
-		return -ENOMEM;
+		err = -ENOMEM;
+		goto out;
 	}
 	while (wr) {
 		if (num_wrs == 0) {
 			err = -ENOMEM;
-			*bad_wr = wr;
 			break;
 		}
 		idx = Q_PTR2IDX(qhp->wq.wptr, qhp->wq.size_log2);
@@ -428,10 +429,8 @@ int iwch_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
 			     wr->opcode);
 			err = -EINVAL;
 		}
-		if (err) {
-			*bad_wr = wr;
+		if (err)
 			break;
-		}
 		wqe->send.wrid.id0.hi = qhp->wq.sq_wptr;
 		sqp->wr_id = wr->wr_id;
 		sqp->opcode = wr2opcode(t3_wr_opcode);
@@ -454,6 +453,10 @@ int iwch_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
 	}
 	spin_unlock_irqrestore(&qhp->lock, flag);
 	ring_doorbell(qhp->wq.doorbell, qhp->wq.qpid);
+
+out:
+	if (err)
+		*bad_wr = wr;
 	return err;
 }
 
@@ -471,18 +474,19 @@ int iwch_post_receive(struct ib_qp *ibqp, struct ib_recv_wr *wr,
 	spin_lock_irqsave(&qhp->lock, flag);
 	if (qhp->attr.state > IWCH_QP_STATE_RTS) {
 		spin_unlock_irqrestore(&qhp->lock, flag);
-		return -EINVAL;
+		err = -EINVAL;
+		goto out;
 	}
 	num_wrs = Q_FREECNT(qhp->wq.rq_rptr, qhp->wq.rq_wptr,
 			    qhp->wq.rq_size_log2) - 1;
 	if (!wr) {
 		spin_unlock_irqrestore(&qhp->lock, flag);
-		return -EINVAL;
+		err = -ENOMEM;
+		goto out;
 	}
 	while (wr) {
 		if (wr->num_sge > T3_MAX_SGE) {
 			err = -EINVAL;
-			*bad_wr = wr;
 			break;
 		}
 		idx = Q_PTR2IDX(qhp->wq.wptr, qhp->wq.size_log2);
@@ -494,10 +498,10 @@ int iwch_post_receive(struct ib_qp *ibqp, struct ib_recv_wr *wr,
 				err = build_zero_stag_recv(qhp, wqe, wr);
 		else
 			err = -ENOMEM;
-		if (err) {
-			*bad_wr = wr;
+
+		if (err)
 			break;
-		}
+
 		build_fw_riwrh((void *) wqe, T3_WR_RCV, T3_COMPLETION_FLAG,
 			       Q_GENBIT(qhp->wq.wptr, qhp->wq.size_log2),
 			       0, sizeof(struct t3_receive_wr) >> 3, T3_SOPEOP);
@@ -511,6 +515,10 @@ int iwch_post_receive(struct ib_qp *ibqp, struct ib_recv_wr *wr,
 	}
 	spin_unlock_irqrestore(&qhp->lock, flag);
 	ring_doorbell(qhp->wq.doorbell, qhp->wq.qpid);
+
+out:
+	if (err)
+		*bad_wr = wr;
 	return err;
 }
 
diff --git a/drivers/infiniband/hw/ehca/ehca_classes.h b/drivers/infiniband/hw/ehca/ehca_classes.h
index c825142a2fb7..0136abd50dd4 100644
--- a/drivers/infiniband/hw/ehca/ehca_classes.h
+++ b/drivers/infiniband/hw/ehca/ehca_classes.h
@@ -375,6 +375,7 @@ extern rwlock_t ehca_qp_idr_lock;
 extern rwlock_t ehca_cq_idr_lock;
 extern struct idr ehca_qp_idr;
 extern struct idr ehca_cq_idr;
+extern spinlock_t shca_list_lock;
 
 extern int ehca_static_rate;
 extern int ehca_port_act_time;
diff --git a/drivers/infiniband/hw/ehca/ehca_eq.c b/drivers/infiniband/hw/ehca/ehca_eq.c
index 523e733c630e..3b87589b8ea0 100644
--- a/drivers/infiniband/hw/ehca/ehca_eq.c
+++ b/drivers/infiniband/hw/ehca/ehca_eq.c
@@ -169,12 +169,15 @@ int ehca_destroy_eq(struct ehca_shca *shca, struct ehca_eq *eq)
 	unsigned long flags;
 	u64 h_ret;
 
-	spin_lock_irqsave(&eq->spinlock, flags);
 	ibmebus_free_irq(eq->ist, (void *)shca);
 
-	h_ret = hipz_h_destroy_eq(shca->ipz_hca_handle, eq);
+	spin_lock_irqsave(&shca_list_lock, flags);
+	eq->is_initialized = 0;
+	spin_unlock_irqrestore(&shca_list_lock, flags);
 
-	spin_unlock_irqrestore(&eq->spinlock, flags);
+	tasklet_kill(&eq->interrupt_task);
+
+	h_ret = hipz_h_destroy_eq(shca->ipz_hca_handle, eq);
 
 	if (h_ret != H_SUCCESS) {
 		ehca_err(&shca->ib_device, "Can't free EQ resources.");
diff --git a/drivers/infiniband/hw/ehca/ehca_irq.c b/drivers/infiniband/hw/ehca/ehca_irq.c
index 4b89b791be6a..42be0b15084b 100644
--- a/drivers/infiniband/hw/ehca/ehca_irq.c
+++ b/drivers/infiniband/hw/ehca/ehca_irq.c
@@ -826,8 +826,7 @@ static void __cpuinit take_over_work(struct ehca_comp_pool *pool, int cpu)
 		cq = list_entry(cct->cq_list.next, struct ehca_cq, entry);
 
 		list_del(&cq->entry);
-		__queue_comp_task(cq, per_cpu_ptr(pool->cpu_comp_tasks,
-						  smp_processor_id()));
+		__queue_comp_task(cq, this_cpu_ptr(pool->cpu_comp_tasks));
 	}
 
 	spin_unlock_irqrestore(&cct->task_lock, flags_cct);
diff --git a/drivers/infiniband/hw/ehca/ehca_main.c b/drivers/infiniband/hw/ehca/ehca_main.c
index fb2d83c5bf01..129a6bebd6e3 100644
--- a/drivers/infiniband/hw/ehca/ehca_main.c
+++ b/drivers/infiniband/hw/ehca/ehca_main.c
@@ -123,7 +123,7 @@ DEFINE_IDR(ehca_qp_idr);
 DEFINE_IDR(ehca_cq_idr);
 
 static LIST_HEAD(shca_list); /* list of all registered ehcas */
-static DEFINE_SPINLOCK(shca_list_lock);
+DEFINE_SPINLOCK(shca_list_lock);
 
 static struct timer_list poll_eqs_timer;
 
diff --git a/drivers/infiniband/hw/ehca/ehca_reqs.c b/drivers/infiniband/hw/ehca/ehca_reqs.c
index 8fd88cd828fd..e3ec7fdd67bd 100644
--- a/drivers/infiniband/hw/ehca/ehca_reqs.c
+++ b/drivers/infiniband/hw/ehca/ehca_reqs.c
@@ -400,7 +400,6 @@ static inline void map_ib_wc_status(u32 cqe_status,
 
 static inline int post_one_send(struct ehca_qp *my_qp,
 			 struct ib_send_wr *cur_send_wr,
-			 struct ib_send_wr **bad_send_wr,
 			 int hidden)
 {
 	struct ehca_wqe *wqe_p;
@@ -412,8 +411,6 @@ static inline int post_one_send(struct ehca_qp *my_qp,
 	wqe_p = ipz_qeit_get_inc(&my_qp->ipz_squeue);
 	if (unlikely(!wqe_p)) {
 		/* too many posted work requests: queue overflow */
-		if (bad_send_wr)
-			*bad_send_wr = cur_send_wr;
 		ehca_err(my_qp->ib_qp.device, "Too many posted WQEs "
 			 "qp_num=%x", my_qp->ib_qp.qp_num);
 		return -ENOMEM;
@@ -433,8 +430,6 @@ static inline int post_one_send(struct ehca_qp *my_qp,
 	 */
 	if (unlikely(ret)) {
 		my_qp->ipz_squeue.current_q_offset = start_offset;
-		if (bad_send_wr)
-			*bad_send_wr = cur_send_wr;
 		ehca_err(my_qp->ib_qp.device, "Could not write WQE "
 			 "qp_num=%x", my_qp->ib_qp.qp_num);
 		return -EINVAL;
@@ -448,7 +443,6 @@ int ehca_post_send(struct ib_qp *qp,
 		   struct ib_send_wr **bad_send_wr)
 {
 	struct ehca_qp *my_qp = container_of(qp, struct ehca_qp, ib_qp);
-	struct ib_send_wr *cur_send_wr;
 	int wqe_cnt = 0;
 	int ret = 0;
 	unsigned long flags;
@@ -457,7 +451,8 @@ int ehca_post_send(struct ib_qp *qp,
 	if (unlikely(my_qp->state < IB_QPS_RTS)) {
 		ehca_err(qp->device, "Invalid QP state  qp_state=%d qpn=%x",
 			 my_qp->state, qp->qp_num);
-		return -EINVAL;
+		ret = -EINVAL;
+		goto out;
 	}
 
 	/* LOCK the QUEUE */
@@ -476,24 +471,21 @@ int ehca_post_send(struct ib_qp *qp,
 		struct ib_send_wr circ_wr;
 		memset(&circ_wr, 0, sizeof(circ_wr));
 		circ_wr.opcode = IB_WR_RDMA_READ;
-		post_one_send(my_qp, &circ_wr, NULL, 1); /* ignore retcode */
+		post_one_send(my_qp, &circ_wr, 1); /* ignore retcode */
 		wqe_cnt++;
 		ehca_dbg(qp->device, "posted circ wr  qp_num=%x", qp->qp_num);
 		my_qp->message_count = my_qp->packet_count = 0;
 	}
 
 	/* loop processes list of send reqs */
-	for (cur_send_wr = send_wr; cur_send_wr != NULL;
-	     cur_send_wr = cur_send_wr->next) {
-		ret = post_one_send(my_qp, cur_send_wr, bad_send_wr, 0);
+	while (send_wr) {
+		ret = post_one_send(my_qp, send_wr, 0);
 		if (unlikely(ret)) {
-			/* if one or more WQEs were successful, don't fail */
-			if (wqe_cnt)
-				ret = 0;
 			goto post_send_exit0;
 		}
 		wqe_cnt++;
-	} /* eof for cur_send_wr */
+		send_wr = send_wr->next;
+	}
 
 post_send_exit0:
 	iosync(); /* serialize GAL register access */
@@ -503,6 +495,10 @@ post_send_exit0:
 			 my_qp, qp->qp_num, wqe_cnt, ret);
 	my_qp->message_count += wqe_cnt;
 	spin_unlock_irqrestore(&my_qp->spinlock_s, flags);
+
+out:
+	if (ret)
+		*bad_send_wr = send_wr;
 	return ret;
 }
 
@@ -511,7 +507,6 @@ static int internal_post_recv(struct ehca_qp *my_qp,
 			      struct ib_recv_wr *recv_wr,
 			      struct ib_recv_wr **bad_recv_wr)
 {
-	struct ib_recv_wr *cur_recv_wr;
 	struct ehca_wqe *wqe_p;
 	int wqe_cnt = 0;
 	int ret = 0;
@@ -522,27 +517,23 @@ static int internal_post_recv(struct ehca_qp *my_qp,
 	if (unlikely(!HAS_RQ(my_qp))) {
 		ehca_err(dev, "QP has no RQ  ehca_qp=%p qp_num=%x ext_type=%d",
 			 my_qp, my_qp->real_qp_num, my_qp->ext_type);
-		return -ENODEV;
+		ret = -ENODEV;
+		goto out;
 	}
 
 	/* LOCK the QUEUE */
 	spin_lock_irqsave(&my_qp->spinlock_r, flags);
 
-	/* loop processes list of send reqs */
-	for (cur_recv_wr = recv_wr; cur_recv_wr != NULL;
-	     cur_recv_wr = cur_recv_wr->next) {
+	/* loop processes list of recv reqs */
+	while (recv_wr) {
 		u64 start_offset = my_qp->ipz_rqueue.current_q_offset;
 		/* get pointer next to free WQE */
 		wqe_p = ipz_qeit_get_inc(&my_qp->ipz_rqueue);
 		if (unlikely(!wqe_p)) {
 			/* too many posted work requests: queue overflow */
-			if (bad_recv_wr)
-				*bad_recv_wr = cur_recv_wr;
-			if (wqe_cnt == 0) {
-				ret = -ENOMEM;
-				ehca_err(dev, "Too many posted WQEs "
-					 "qp_num=%x", my_qp->real_qp_num);
-			}
+			ret = -ENOMEM;
+			ehca_err(dev, "Too many posted WQEs "
+				"qp_num=%x", my_qp->real_qp_num);
 			goto post_recv_exit0;
 		}
 		/*
@@ -552,7 +543,7 @@ static int internal_post_recv(struct ehca_qp *my_qp,
 		rq_map_idx = start_offset / my_qp->ipz_rqueue.qe_size;
 
 		/* write a RECV WQE into the QUEUE */
-		ret = ehca_write_rwqe(&my_qp->ipz_rqueue, wqe_p, cur_recv_wr,
+		ret = ehca_write_rwqe(&my_qp->ipz_rqueue, wqe_p, recv_wr,
 				rq_map_idx);
 		/*
 		 * if something failed,
@@ -560,22 +551,20 @@ static int internal_post_recv(struct ehca_qp *my_qp,
 		 */
 		if (unlikely(ret)) {
 			my_qp->ipz_rqueue.current_q_offset = start_offset;
-			*bad_recv_wr = cur_recv_wr;
-			if (wqe_cnt == 0) {
-				ret = -EINVAL;
-				ehca_err(dev, "Could not write WQE "
-					 "qp_num=%x", my_qp->real_qp_num);
-			}
+			ret = -EINVAL;
+			ehca_err(dev, "Could not write WQE "
+				"qp_num=%x", my_qp->real_qp_num);
 			goto post_recv_exit0;
 		}
 
 		qmap_entry = &my_qp->rq_map.map[rq_map_idx];
-		qmap_entry->app_wr_id = get_app_wr_id(cur_recv_wr->wr_id);
+		qmap_entry->app_wr_id = get_app_wr_id(recv_wr->wr_id);
 		qmap_entry->reported = 0;
 		qmap_entry->cqe_req = 1;
 
 		wqe_cnt++;
-	} /* eof for cur_recv_wr */
+		recv_wr = recv_wr->next;
+	} /* eof for recv_wr */
 
 post_recv_exit0:
 	iosync(); /* serialize GAL register access */
@@ -584,6 +573,11 @@ post_recv_exit0:
 	    ehca_dbg(dev, "ehca_qp=%p qp_num=%x wqe_cnt=%d ret=%i",
 		     my_qp, my_qp->real_qp_num, wqe_cnt, ret);
 	spin_unlock_irqrestore(&my_qp->spinlock_r, flags);
+
+out:
+	if (ret)
+		*bad_recv_wr = recv_wr;
+
 	return ret;
 }
 
@@ -597,6 +591,7 @@ int ehca_post_recv(struct ib_qp *qp,
 	if (unlikely(my_qp->state == IB_QPS_RESET)) {
 		ehca_err(qp->device, "Invalid QP state  qp_state=%d qpn=%x",
 			 my_qp->state, qp->qp_num);
+		*bad_recv_wr = recv_wr;
 		return -EINVAL;
 	}
 
diff --git a/drivers/infiniband/hw/ipath/ipath_driver.c b/drivers/infiniband/hw/ipath/ipath_driver.c
index 013d1380e77c..d2787fe80304 100644
--- a/drivers/infiniband/hw/ipath/ipath_driver.c
+++ b/drivers/infiniband/hw/ipath/ipath_driver.c
@@ -39,6 +39,7 @@
 #include <linux/delay.h>
 #include <linux/netdevice.h>
 #include <linux/vmalloc.h>
+#include <linux/bitmap.h>
 
 #include "ipath_kernel.h"
 #include "ipath_verbs.h"
@@ -1697,7 +1698,7 @@ void ipath_chg_pioavailkernel(struct ipath_devdata *dd, unsigned start,
 			      unsigned len, int avail)
 {
 	unsigned long flags;
-	unsigned end, cnt = 0, next;
+	unsigned end, cnt = 0;
 
 	/* There are two bits per send buffer (busy and generation) */
 	start *= 2;
@@ -1748,12 +1749,7 @@ void ipath_chg_pioavailkernel(struct ipath_devdata *dd, unsigned start,
 
 	if (dd->ipath_pioupd_thresh) {
 		end = 2 * (dd->ipath_piobcnt2k + dd->ipath_piobcnt4k);
-		next = find_first_bit(dd->ipath_pioavailkernel, end);
-		while (next < end) {
-			cnt++;
-			next = find_next_bit(dd->ipath_pioavailkernel, end,
-					next + 1);
-		}
+		cnt = bitmap_weight(dd->ipath_pioavailkernel, end);
 	}
 	spin_unlock_irqrestore(&ipath_pioavail_lock, flags);
 
diff --git a/drivers/infiniband/hw/ipath/ipath_file_ops.c b/drivers/infiniband/hw/ipath/ipath_file_ops.c
index 40dbe54056c7..73933a41ce84 100644
--- a/drivers/infiniband/hw/ipath/ipath_file_ops.c
+++ b/drivers/infiniband/hw/ipath/ipath_file_ops.c
@@ -1821,7 +1821,6 @@ done:
 static int ipath_open(struct inode *in, struct file *fp)
 {
 	/* The real work is performed later in ipath_assign_port() */
-	cycle_kernel_lock();
 	fp->private_data = kzalloc(sizeof(struct ipath_filedata), GFP_KERNEL);
 	return fp->private_data ? 0 : -ENOMEM;
 }
diff --git a/drivers/infiniband/hw/ipath/ipath_iba6110.c b/drivers/infiniband/hw/ipath/ipath_iba6110.c
index 4bd39c8af80f..37d12e5efa49 100644
--- a/drivers/infiniband/hw/ipath/ipath_iba6110.c
+++ b/drivers/infiniband/hw/ipath/ipath_iba6110.c
@@ -381,7 +381,7 @@ static const ipath_err_t infinipath_hwe_htclnkbbyte1crcerr =
 #define IPATH_GPIO_SCL \
 	(1ULL << (_IPATH_GPIO_SCL_NUM+INFINIPATH_EXTC_GPIOOE_SHIFT))
 
-/* keep the code below somewhat more readonable; not used elsewhere */
+/* keep the code below somewhat more readable; not used elsewhere */
 #define _IPATH_HTLINK0_CRCBITS (infinipath_hwe_htclnkabyte0crcerr |	\
 				infinipath_hwe_htclnkabyte1crcerr)
 #define _IPATH_HTLINK1_CRCBITS (infinipath_hwe_htclnkbbyte0crcerr |	\
diff --git a/drivers/infiniband/hw/ipath/ipath_sd7220.c b/drivers/infiniband/hw/ipath/ipath_sd7220.c
index aa47eb549520..2a68d9f624dd 100644
--- a/drivers/infiniband/hw/ipath/ipath_sd7220.c
+++ b/drivers/infiniband/hw/ipath/ipath_sd7220.c
@@ -614,7 +614,7 @@ static int epb_trans(struct ipath_devdata *dd, u16 reg, u64 i_val, u64 *o_vp)
  * @wd: Write Data - value to set in register
  * @mask: ones where data should be spliced into reg.
  *
- * Basic register read/modify/write, with un-needed acesses elided. That is,
+ * Basic register read/modify/write, with un-needed accesses elided. That is,
  * a mask of zero will prevent write, while a mask of 0xFF will prevent read.
  * returns current (presumed, if a write was done) contents of selected
  * register, or <0 if errors.
@@ -989,7 +989,7 @@ static struct rxeq_init {
 	/* Set DFELTHFDR/HDR thresholds */
 	RXEQ_VAL(7, 8,    0, 0, 0, 0), /* FDR */
 	RXEQ_VAL(7, 0x21, 0, 0, 0, 0), /* HDR */
-	/* Set TLTHFDR/HDR theshold */
+	/* Set TLTHFDR/HDR threshold */
 	RXEQ_VAL(7, 9,    2, 2, 2, 2), /* FDR */
 	RXEQ_VAL(7, 0x23, 2, 2, 2, 2), /* HDR */
 	/* Set Preamp setting 2 (ZFR/ZCNT) */
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index 3cb3f47a10b8..e596537ff353 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -103,7 +103,7 @@ static int mlx4_ib_query_device(struct ib_device *ibdev,
 		props->device_cap_flags |= IB_DEVICE_UD_AV_PORT_ENFORCE;
 	if (dev->dev->caps.flags & MLX4_DEV_CAP_FLAG_IPOIB_CSUM)
 		props->device_cap_flags |= IB_DEVICE_UD_IP_CSUM;
-	if (dev->dev->caps.max_gso_sz)
+	if (dev->dev->caps.max_gso_sz && dev->dev->caps.flags & MLX4_DEV_CAP_FLAG_BLH)
 		props->device_cap_flags |= IB_DEVICE_UD_TSO;
 	if (dev->dev->caps.bmme_flags & MLX4_BMME_FLAG_RESERVED_LKEY)
 		props->device_cap_flags |= IB_DEVICE_LOCAL_DMA_LKEY;
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index 219b10397b4d..2a97c964b9ef 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -54,7 +54,8 @@ enum {
 	/*
 	 * Largest possible UD header: send with GRH and immediate data.
 	 */
-	MLX4_IB_UD_HEADER_SIZE		= 72
+	MLX4_IB_UD_HEADER_SIZE		= 72,
+	MLX4_IB_LSO_HEADER_SPARE	= 128,
 };
 
 struct mlx4_ib_sqp {
@@ -67,7 +68,8 @@ struct mlx4_ib_sqp {
 };
 
 enum {
-	MLX4_IB_MIN_SQ_STRIDE = 6
+	MLX4_IB_MIN_SQ_STRIDE	= 6,
+	MLX4_IB_CACHE_LINE_SIZE	= 64,
 };
 
 static const __be32 mlx4_ib_opcode[] = {
@@ -261,7 +263,7 @@ static int send_wqe_overhead(enum ib_qp_type type, u32 flags)
 	case IB_QPT_UD:
 		return sizeof (struct mlx4_wqe_ctrl_seg) +
 			sizeof (struct mlx4_wqe_datagram_seg) +
-			((flags & MLX4_IB_QP_LSO) ? 64 : 0);
+			((flags & MLX4_IB_QP_LSO) ? MLX4_IB_LSO_HEADER_SPARE : 0);
 	case IB_QPT_UC:
 		return sizeof (struct mlx4_wqe_ctrl_seg) +
 			sizeof (struct mlx4_wqe_raddr_seg);
@@ -352,7 +354,7 @@ static int set_kernel_sq_size(struct mlx4_ib_dev *dev, struct ib_qp_cap *cap,
 	 * anymore, so we do this only if selective signaling is off.
 	 *
 	 * Further, on 32-bit platforms, we can't use vmap() to make
-	 * the QP buffer virtually contigious.  Thus we have to use
+	 * the QP buffer virtually contiguous.  Thus we have to use
 	 * constant-sized WRs to make sure a WR is always fully within
 	 * a single page-sized chunk.
 	 *
@@ -897,7 +899,6 @@ static int __mlx4_ib_modify_qp(struct ib_qp *ibqp,
 
 	context->flags = cpu_to_be32((to_mlx4_state(new_state) << 28) |
 				     (to_mlx4_st(ibqp->qp_type) << 16));
-	context->flags     |= cpu_to_be32(1 << 8); /* DE? */
 
 	if (!(attr_mask & IB_QP_PATH_MIG_STATE))
 		context->flags |= cpu_to_be32(MLX4_QP_PM_MIGRATED << 11);
@@ -1467,16 +1468,12 @@ static void __set_data_seg(struct mlx4_wqe_data_seg *dseg, struct ib_sge *sg)
 
 static int build_lso_seg(struct mlx4_wqe_lso_seg *wqe, struct ib_send_wr *wr,
 			 struct mlx4_ib_qp *qp, unsigned *lso_seg_len,
-			 __be32 *lso_hdr_sz)
+			 __be32 *lso_hdr_sz, __be32 *blh)
 {
 	unsigned halign = ALIGN(sizeof *wqe + wr->wr.ud.hlen, 16);
 
-	/*
-	 * This is a temporary limitation and will be removed in
-	 * a forthcoming FW release:
-	 */
-	if (unlikely(halign > 64))
-		return -EINVAL;
+	if (unlikely(halign > MLX4_IB_CACHE_LINE_SIZE))
+		*blh = cpu_to_be32(1 << 6);
 
 	if (unlikely(!(qp->flags & MLX4_IB_QP_LSO) &&
 		     wr->num_sge > qp->sq.max_gs - (halign >> 4)))
@@ -1522,6 +1519,7 @@ int mlx4_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
 	__be32 dummy;
 	__be32 *lso_wqe;
 	__be32 uninitialized_var(lso_hdr_sz);
+	__be32 blh;
 	int i;
 
 	spin_lock_irqsave(&qp->sq.lock, flags);
@@ -1530,6 +1528,7 @@ int mlx4_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
 
 	for (nreq = 0; wr; ++nreq, wr = wr->next) {
 		lso_wqe = &dummy;
+		blh = 0;
 
 		if (mlx4_wq_overflow(&qp->sq, nreq, qp->ibqp.send_cq)) {
 			err = -ENOMEM;
@@ -1616,7 +1615,7 @@ int mlx4_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
 			size += sizeof (struct mlx4_wqe_datagram_seg) / 16;
 
 			if (wr->opcode == IB_WR_LSO) {
-				err = build_lso_seg(wqe, wr, qp, &seglen, &lso_hdr_sz);
+				err = build_lso_seg(wqe, wr, qp, &seglen, &lso_hdr_sz, &blh);
 				if (unlikely(err)) {
 					*bad_wr = wr;
 					goto out;
@@ -1687,7 +1686,7 @@ int mlx4_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
 		}
 
 		ctrl->owner_opcode = mlx4_ib_opcode[wr->opcode] |
-			(ind & qp->sq.wqe_cnt ? cpu_to_be32(1 << 31) : 0);
+			(ind & qp->sq.wqe_cnt ? cpu_to_be32(1 << 31) : 0) | blh;
 
 		stamp = ind + qp->sq_spare_wqes;
 		ind += DIV_ROUND_UP(size * 16, 1U << qp->sq.wqe_shift);
@@ -1753,7 +1752,7 @@ int mlx4_ib_post_recv(struct ib_qp *ibqp, struct ib_recv_wr *wr,
 	ind = qp->rq.head & (qp->rq.wqe_cnt - 1);
 
 	for (nreq = 0; wr; ++nreq, wr = wr->next) {
-		if (mlx4_wq_overflow(&qp->rq, nreq, qp->ibqp.send_cq)) {
+		if (mlx4_wq_overflow(&qp->rq, nreq, qp->ibqp.recv_cq)) {
 			err = -ENOMEM;
 			*bad_wr = wr;
 			goto out;
diff --git a/drivers/infiniband/hw/mlx4/srq.c b/drivers/infiniband/hw/mlx4/srq.c
index d42565258fb7..cf8085bcbd6d 100644
--- a/drivers/infiniband/hw/mlx4/srq.c
+++ b/drivers/infiniband/hw/mlx4/srq.c
@@ -74,6 +74,7 @@ struct ib_srq *mlx4_ib_create_srq(struct ib_pd *pd,
 	struct mlx4_ib_dev *dev = to_mdev(pd->device);
 	struct mlx4_ib_srq *srq;
 	struct mlx4_wqe_srq_next_seg *next;
+	struct mlx4_wqe_data_seg *scatter;
 	int desc_size;
 	int buf_size;
 	int err;
@@ -149,6 +150,11 @@ struct ib_srq *mlx4_ib_create_srq(struct ib_pd *pd,
 			next = get_wqe(srq, i);
 			next->next_wqe_index =
 				cpu_to_be16((i + 1) & (srq->msrq.max - 1));
+
+			for (scatter = (void *) (next + 1);
+			     (void *) scatter < (void *) next + desc_size;
+			     ++scatter)
+				scatter->lkey = cpu_to_be32(MLX4_INVALID_LKEY);
 		}
 
 		err = mlx4_mtt_init(dev->dev, srq->buf.npages, srq->buf.page_shift,
diff --git a/drivers/infiniband/hw/nes/Kconfig b/drivers/infiniband/hw/nes/Kconfig
index d449eb6ec78e..846dc97cf260 100644
--- a/drivers/infiniband/hw/nes/Kconfig
+++ b/drivers/infiniband/hw/nes/Kconfig
@@ -4,14 +4,13 @@ config INFINIBAND_NES
 	select LIBCRC32C
 	select INET_LRO
 	---help---
-	  This is a low-level driver for NetEffect RDMA enabled
-	  Network Interface Cards (RNIC).
+	  This is the RDMA Network Interface Card (RNIC) driver for
+	  NetEffect Ethernet Cluster Server Adapters.
 
 config INFINIBAND_NES_DEBUG
 	bool "Verbose debugging output"
 	depends on INFINIBAND_NES
 	default n
 	---help---
-	  This option causes the NetEffect RNIC driver to produce debug
-	  messages.  Select this if you are developing the driver
-	  or trying to diagnose a problem.
+	  This option enables debug messages from the NetEffect RNIC
+	  driver.  Select this if you are diagnosing a problem.
diff --git a/drivers/infiniband/hw/nes/nes.c b/drivers/infiniband/hw/nes/nes.c
index cbde0cfe27e0..b9d09bafd6c1 100644
--- a/drivers/infiniband/hw/nes/nes.c
+++ b/drivers/infiniband/hw/nes/nes.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006 - 2009 Intel-NE, Inc.  All rights reserved.
+ * Copyright (c) 2006 - 2009 Intel Corporation.  All rights reserved.
  * Copyright (c) 2005 Open Grid Computing, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
@@ -521,7 +521,8 @@ static int __devinit nes_probe(struct pci_dev *pcidev, const struct pci_device_i
 	spin_lock_init(&nesdev->indexed_regs_lock);
 
 	/* Remap the PCI registers in adapter BAR0 to kernel VA space */
-	mmio_regs = ioremap_nocache(pci_resource_start(pcidev, BAR_0), sizeof(mmio_regs));
+	mmio_regs = ioremap_nocache(pci_resource_start(pcidev, BAR_0),
+				    pci_resource_len(pcidev, BAR_0));
 	if (mmio_regs == NULL) {
 		printk(KERN_ERR PFX "Unable to remap BAR0\n");
 		ret = -EIO;
diff --git a/drivers/infiniband/hw/nes/nes.h b/drivers/infiniband/hw/nes/nes.h
index bcc6abc4faff..98840564bb2f 100644
--- a/drivers/infiniband/hw/nes/nes.h
+++ b/drivers/infiniband/hw/nes/nes.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006 - 2009 Intel-NE, Inc.  All rights reserved.
+ * Copyright (c) 2006 - 2009 Intel Corporation.  All rights reserved.
  * Copyright (c) 2005 Open Grid Computing, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
diff --git a/drivers/infiniband/hw/nes/nes_cm.c b/drivers/infiniband/hw/nes/nes_cm.c
index 73473db19863..39468c277036 100644
--- a/drivers/infiniband/hw/nes/nes_cm.c
+++ b/drivers/infiniband/hw/nes/nes_cm.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006 - 2009 Intel-NE, Inc.  All rights reserved.
+ * Copyright (c) 2006 - 2009 Intel Corporation.  All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -52,6 +52,7 @@
 #include <linux/random.h>
 #include <linux/list.h>
 #include <linux/threads.h>
+#include <linux/highmem.h>
 #include <net/arp.h>
 #include <net/neighbour.h>
 #include <net/route.h>
@@ -251,6 +252,33 @@ static int parse_mpa(struct nes_cm_node *cm_node, u8 *buffer, u32 *type,
 
 	mpa_frame = (struct ietf_mpa_frame *)buffer;
 	cm_node->mpa_frame_size = ntohs(mpa_frame->priv_data_len);
+	/* make sure mpa private data len is less than 512 bytes */
+	if (cm_node->mpa_frame_size > IETF_MAX_PRIV_DATA_LEN) {
+		nes_debug(NES_DBG_CM, "The received Length of Private"
+			" Data field exceeds 512 octets\n");
+		return -EINVAL;
+	}
+	/*
+	 * make sure MPA receiver interoperate with the
+	 * received MPA version and MPA key information
+	 *
+	 */
+	if (mpa_frame->rev != mpa_version) {
+		nes_debug(NES_DBG_CM, "The received mpa version"
+				" can not be interoperated\n");
+		return -EINVAL;
+	}
+	if (cm_node->state != NES_CM_STATE_MPAREQ_SENT) {
+		if (memcmp(mpa_frame->key, IEFT_MPA_KEY_REQ, IETF_MPA_KEY_SIZE)) {
+			nes_debug(NES_DBG_CM, "Unexpected MPA Key received \n");
+			return -EINVAL;
+		}
+	} else {
+		if (memcmp(mpa_frame->key, IEFT_MPA_KEY_REP, IETF_MPA_KEY_SIZE)) {
+			nes_debug(NES_DBG_CM, "Unexpected MPA Key received \n");
+			return -EINVAL;
+		}
+	}
 
 	if (cm_node->mpa_frame_size + sizeof(struct ietf_mpa_frame) != len) {
 		nes_debug(NES_DBG_CM, "The received ietf buffer was not right"
@@ -486,6 +514,8 @@ static void nes_retrans_expired(struct nes_cm_node *cm_node)
 		send_reset(cm_node, NULL);
 		break;
 	default:
+		add_ref_cm_node(cm_node);
+		send_reset(cm_node, NULL);
 		create_event(cm_node, NES_CM_EVENT_ABORTED);
 	}
 }
@@ -949,6 +979,7 @@ static int mini_cm_dec_refcnt_listen(struct nes_cm_core *cm_core,
 				reset_entry);
 		{
 			struct nes_cm_node *loopback = cm_node->loopbackpartner;
+			enum nes_cm_node_state old_state;
 			if (NES_CM_STATE_FIN_WAIT1 <= cm_node->state) {
 				rem_ref_cm_node(cm_node->cm_core, cm_node);
 			} else {
@@ -960,11 +991,12 @@ static int mini_cm_dec_refcnt_listen(struct nes_cm_core *cm_core,
 							 NES_CM_STATE_CLOSED;
 						WARN_ON(1);
 					} else {
-						cm_node->state =
-							NES_CM_STATE_CLOSED;
-						rem_ref_cm_node(
-							cm_node->cm_core,
-							cm_node);
+						old_state = cm_node->state;
+						cm_node->state = NES_CM_STATE_LISTENER_DESTROYED;
+						if (old_state != NES_CM_STATE_MPAREQ_RCVD)
+							rem_ref_cm_node(
+								cm_node->cm_core,
+								cm_node);
 					}
 				} else {
 					struct nes_cm_event event;
@@ -980,20 +1012,9 @@ static int mini_cm_dec_refcnt_listen(struct nes_cm_core *cm_core,
 							 loopback->loc_port;
 					event.cm_info.cm_id = loopback->cm_id;
 					cm_event_connect_error(&event);
+					cm_node->state = NES_CM_STATE_LISTENER_DESTROYED;
 					loopback->state = NES_CM_STATE_CLOSED;
 
-					event.cm_node = cm_node;
-					event.cm_info.rem_addr =
-							 cm_node->rem_addr;
-					event.cm_info.loc_addr =
-							 cm_node->loc_addr;
-					event.cm_info.rem_port =
-							 cm_node->rem_port;
-					event.cm_info.loc_port =
-							 cm_node->loc_port;
-					event.cm_info.cm_id = cm_node->cm_id;
-					cm_event_reset(&event);
-
 					rem_ref_cm_node(cm_node->cm_core,
 							 cm_node);
 
@@ -1077,12 +1098,13 @@ static inline int mini_cm_accelerated(struct nes_cm_core *cm_core,
 /**
  * nes_addr_resolve_neigh
  */
-static int nes_addr_resolve_neigh(struct nes_vnic *nesvnic, u32 dst_ip)
+static int nes_addr_resolve_neigh(struct nes_vnic *nesvnic, u32 dst_ip, int arpindex)
 {
 	struct rtable *rt;
 	struct flowi fl;
 	struct neighbour *neigh;
-	int rc = -1;
+	int rc = arpindex;
+	struct nes_adapter *nesadapter = nesvnic->nesdev->nesadapter;
 
 	memset(&fl, 0, sizeof fl);
 	fl.nl_u.ip4_u.daddr = htonl(dst_ip);
@@ -1098,6 +1120,21 @@ static int nes_addr_resolve_neigh(struct nes_vnic *nesvnic, u32 dst_ip)
 			nes_debug(NES_DBG_CM, "Neighbor MAC address for 0x%08X"
 				  " is %pM, Gateway is 0x%08X \n", dst_ip,
 				  neigh->ha, ntohl(rt->rt_gateway));
+
+			if (arpindex >= 0) {
+				if (!memcmp(nesadapter->arp_table[arpindex].mac_addr,
+							neigh->ha, ETH_ALEN)){
+					/* Mac address same as in nes_arp_table */
+					neigh_release(neigh);
+					ip_rt_put(rt);
+					return rc;
+				}
+
+				nes_manage_arp_cache(nesvnic->netdev,
+						nesadapter->arp_table[arpindex].mac_addr,
+						dst_ip, NES_ARP_DELETE);
+			}
+
 			nes_manage_arp_cache(nesvnic->netdev, neigh->ha,
 					     dst_ip, NES_ARP_ADD);
 			rc = nes_arp_table(nesvnic->nesdev, dst_ip, NULL,
@@ -1113,7 +1150,6 @@ static int nes_addr_resolve_neigh(struct nes_vnic *nesvnic, u32 dst_ip)
 	return rc;
 }
 
-
 /**
  * make_cm_node - create a new instance of a cm node
  */
@@ -1123,6 +1159,7 @@ static struct nes_cm_node *make_cm_node(struct nes_cm_core *cm_core,
 {
 	struct nes_cm_node *cm_node;
 	struct timespec ts;
+	int oldarpindex = 0;
 	int arpindex = 0;
 	struct nes_device *nesdev;
 	struct nes_adapter *nesadapter;
@@ -1176,17 +1213,18 @@ static struct nes_cm_node *make_cm_node(struct nes_cm_core *cm_core,
 	nesadapter = nesdev->nesadapter;
 
 	cm_node->loopbackpartner = NULL;
+
 	/* get the mac addr for the remote node */
 	if (ipv4_is_loopback(htonl(cm_node->rem_addr)))
 		arpindex = nes_arp_table(nesdev, ntohl(nesvnic->local_ipaddr), NULL, NES_ARP_RESOLVE);
-	else
-		arpindex = nes_arp_table(nesdev, cm_node->rem_addr, NULL, NES_ARP_RESOLVE);
+	else {
+		oldarpindex = nes_arp_table(nesdev, cm_node->rem_addr, NULL, NES_ARP_RESOLVE);
+		arpindex = nes_addr_resolve_neigh(nesvnic, cm_info->rem_addr, oldarpindex);
+
+	}
 	if (arpindex < 0) {
-		arpindex = nes_addr_resolve_neigh(nesvnic, cm_info->rem_addr);
-		if (arpindex < 0) {
-			kfree(cm_node);
-			return NULL;
-		}
+		kfree(cm_node);
+		return NULL;
 	}
 
 	/* copy the mac addr to node context */
@@ -1333,13 +1371,20 @@ static void handle_fin_pkt(struct nes_cm_node *cm_node)
 	case NES_CM_STATE_SYN_RCVD:
 	case NES_CM_STATE_SYN_SENT:
 	case NES_CM_STATE_ESTABLISHED:
-	case NES_CM_STATE_MPAREQ_SENT:
 	case NES_CM_STATE_MPAREJ_RCVD:
 		cm_node->tcp_cntxt.rcv_nxt++;
 		cleanup_retrans_entry(cm_node);
 		cm_node->state = NES_CM_STATE_LAST_ACK;
 		send_fin(cm_node, NULL);
 		break;
+	case NES_CM_STATE_MPAREQ_SENT:
+		create_event(cm_node, NES_CM_EVENT_ABORTED);
+		cm_node->tcp_cntxt.rcv_nxt++;
+		cleanup_retrans_entry(cm_node);
+		cm_node->state = NES_CM_STATE_CLOSED;
+		add_ref_cm_node(cm_node);
+		send_reset(cm_node, NULL);
+		break;
 	case NES_CM_STATE_FIN_WAIT1:
 		cm_node->tcp_cntxt.rcv_nxt++;
 		cleanup_retrans_entry(cm_node);
@@ -1590,6 +1635,7 @@ static void handle_syn_pkt(struct nes_cm_node *cm_node, struct sk_buff *skb,
 		break;
 	case NES_CM_STATE_CLOSED:
 		cleanup_retrans_entry(cm_node);
+		add_ref_cm_node(cm_node);
 		send_reset(cm_node, skb);
 		break;
 	case NES_CM_STATE_TSA:
@@ -1641,9 +1687,15 @@ static void handle_synack_pkt(struct nes_cm_node *cm_node, struct sk_buff *skb,
 		passive_open_err(cm_node, skb, 1);
 		break;
 	case NES_CM_STATE_LISTENING:
+		cm_node->tcp_cntxt.loc_seq_num = ntohl(tcph->ack_seq);
+		cleanup_retrans_entry(cm_node);
+		cm_node->state = NES_CM_STATE_CLOSED;
+		send_reset(cm_node, skb);
+		break;
 	case NES_CM_STATE_CLOSED:
 		cm_node->tcp_cntxt.loc_seq_num = ntohl(tcph->ack_seq);
 		cleanup_retrans_entry(cm_node);
+		add_ref_cm_node(cm_node);
 		send_reset(cm_node, skb);
 		break;
 	case NES_CM_STATE_ESTABLISHED:
@@ -1712,8 +1764,13 @@ static int handle_ack_pkt(struct nes_cm_node *cm_node, struct sk_buff *skb,
 			dev_kfree_skb_any(skb);
 		break;
 	case NES_CM_STATE_LISTENING:
+		cleanup_retrans_entry(cm_node);
+		cm_node->state = NES_CM_STATE_CLOSED;
+		send_reset(cm_node, skb);
+		break;
 	case NES_CM_STATE_CLOSED:
 		cleanup_retrans_entry(cm_node);
+		add_ref_cm_node(cm_node);
 		send_reset(cm_node, skb);
 		break;
 	case NES_CM_STATE_LAST_ACK:
@@ -1974,7 +2031,7 @@ static struct nes_cm_node *mini_cm_connect(struct nes_cm_core *cm_core,
 	if (!cm_node)
 		return NULL;
 	mpa_frame = &cm_node->mpa_frame;
-	strcpy(mpa_frame->key, IEFT_MPA_KEY_REQ);
+	memcpy(mpa_frame->key, IEFT_MPA_KEY_REQ, IETF_MPA_KEY_SIZE);
 	mpa_frame->flags = IETF_MPA_FLAGS_CRC;
 	mpa_frame->rev =  IETF_MPA_VERSION;
 	mpa_frame->priv_data_len = htons(private_data_len);
@@ -2102,30 +2159,39 @@ static int mini_cm_reject(struct nes_cm_core *cm_core,
 			cm_node->state = NES_CM_STATE_CLOSED;
 			rem_ref_cm_node(cm_core, cm_node);
 		} else {
-			ret = send_mpa_reject(cm_node);
-			if (ret) {
-				cm_node->state = NES_CM_STATE_CLOSED;
-				err = send_reset(cm_node, NULL);
-				if (err)
-					WARN_ON(1);
-			} else
-				cm_id->add_ref(cm_id);
+			if (cm_node->state == NES_CM_STATE_LISTENER_DESTROYED) {
+				rem_ref_cm_node(cm_core, cm_node);
+			} else {
+				ret = send_mpa_reject(cm_node);
+				if (ret) {
+					cm_node->state = NES_CM_STATE_CLOSED;
+					err = send_reset(cm_node, NULL);
+					if (err)
+						WARN_ON(1);
+				} else
+					cm_id->add_ref(cm_id);
+			}
 		}
 	} else {
 		cm_node->cm_id = NULL;
-		event.cm_node = loopback;
-		event.cm_info.rem_addr = loopback->rem_addr;
-		event.cm_info.loc_addr = loopback->loc_addr;
-		event.cm_info.rem_port = loopback->rem_port;
-		event.cm_info.loc_port = loopback->loc_port;
-		event.cm_info.cm_id = loopback->cm_id;
-		cm_event_mpa_reject(&event);
-		rem_ref_cm_node(cm_core, cm_node);
-		loopback->state = NES_CM_STATE_CLOSING;
+		if (cm_node->state == NES_CM_STATE_LISTENER_DESTROYED) {
+			rem_ref_cm_node(cm_core, cm_node);
+			rem_ref_cm_node(cm_core, loopback);
+		} else {
+			event.cm_node = loopback;
+			event.cm_info.rem_addr = loopback->rem_addr;
+			event.cm_info.loc_addr = loopback->loc_addr;
+			event.cm_info.rem_port = loopback->rem_port;
+			event.cm_info.loc_port = loopback->loc_port;
+			event.cm_info.cm_id = loopback->cm_id;
+			cm_event_mpa_reject(&event);
+			rem_ref_cm_node(cm_core, cm_node);
+			loopback->state = NES_CM_STATE_CLOSING;
 
-		cm_id = loopback->cm_id;
-		rem_ref_cm_node(cm_core, loopback);
-		cm_id->rem_ref(cm_id);
+			cm_id = loopback->cm_id;
+			rem_ref_cm_node(cm_core, loopback);
+			cm_id->rem_ref(cm_id);
+		}
 	}
 
 	return ret;
@@ -2164,11 +2230,15 @@ static int mini_cm_close(struct nes_cm_core *cm_core, struct nes_cm_node *cm_nod
 	case NES_CM_STATE_CLOSING:
 		ret = -1;
 		break;
-	case NES_CM_STATE_MPAREJ_RCVD:
 	case NES_CM_STATE_LISTENING:
+		cleanup_retrans_entry(cm_node);
+		send_reset(cm_node, NULL);
+		break;
+	case NES_CM_STATE_MPAREJ_RCVD:
 	case NES_CM_STATE_UNKNOWN:
 	case NES_CM_STATE_INITED:
 	case NES_CM_STATE_CLOSED:
+	case NES_CM_STATE_LISTENER_DESTROYED:
 		ret = rem_ref_cm_node(cm_core, cm_node);
 		break;
 	case NES_CM_STATE_TSA:
@@ -2687,8 +2757,6 @@ int nes_accept(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
 	struct nes_pd *nespd;
 	u64 tagged_offset;
 
-
-
 	ibqp = nes_get_qp(cm_id->device, conn_param->qpn);
 	if (!ibqp)
 		return -EINVAL;
@@ -2704,6 +2772,13 @@ int nes_accept(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
 		"%s\n", cm_node, nesvnic, nesvnic->netdev,
 		nesvnic->netdev->name);
 
+	if (NES_CM_STATE_LISTENER_DESTROYED == cm_node->state) {
+		if (cm_node->loopbackpartner)
+			rem_ref_cm_node(cm_node->cm_core, cm_node->loopbackpartner);
+		rem_ref_cm_node(cm_node->cm_core, cm_node);
+		return -EINVAL;
+	}
+
 	/* associate the node with the QP */
 	nesqp->cm_node = (void *)cm_node;
 	cm_node->nesqp = nesqp;
@@ -2786,6 +2861,10 @@ int nes_accept(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
 			cpu_to_le32(conn_param->private_data_len +
 			sizeof(struct ietf_mpa_frame));
 		wqe->wqe_words[NES_IWARP_SQ_WQE_STAG0_IDX] = ibmr->lkey;
+		if (nesqp->sq_kmapped) {
+			nesqp->sq_kmapped = 0;
+			kunmap(nesqp->page);
+		}
 
 		nesqp->nesqp_context->ird_ord_sizes |=
 			cpu_to_le32(NES_QPCONTEXT_ORDIRD_LSMM_PRESENT |
@@ -2929,7 +3008,7 @@ int nes_reject(struct iw_cm_id *cm_id, const void *pdata, u8 pdata_len)
 	if (cm_node->mpa_frame_size > MAX_CM_BUFFER)
 		return -EINVAL;
 
-	strcpy(&cm_node->mpa_frame.key[0], IEFT_MPA_KEY_REP);
+	memcpy(&cm_node->mpa_frame.key[0], IEFT_MPA_KEY_REP, IETF_MPA_KEY_SIZE);
 	if (loopback) {
 		memcpy(&loopback->mpa_frame.priv_data, pdata, pdata_len);
 		loopback->mpa_frame.priv_data_len = pdata_len;
@@ -2974,6 +3053,9 @@ int nes_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
 	if (!nesdev)
 		return -EINVAL;
 
+	if (!(cm_id->local_addr.sin_port) || !(cm_id->remote_addr.sin_port))
+		return -EINVAL;
+
 	nes_debug(NES_DBG_CM, "QP%u, current IP = 0x%08X, Destination IP = "
 		"0x%08X:0x%04X, local = 0x%08X:0x%04X.\n", nesqp->hwqp.qp_id,
 		ntohl(nesvnic->local_ipaddr),
@@ -3251,6 +3333,11 @@ static void cm_event_connected(struct nes_cm_event *event)
 		wqe->wqe_words[NES_IWARP_SQ_WQE_LENGTH0_IDX] = 0;
 		wqe->wqe_words[NES_IWARP_SQ_WQE_STAG0_IDX] = 0;
 
+		if (nesqp->sq_kmapped) {
+			nesqp->sq_kmapped = 0;
+			kunmap(nesqp->page);
+		}
+
 		/* use the reserved spot on the WQ for the extra first WQE */
 		nesqp->nesqp_context->ird_ord_sizes &=
 			cpu_to_le32(~(NES_QPCONTEXT_ORDIRD_LSMM_PRESENT |
@@ -3346,7 +3433,7 @@ static void cm_event_connect_error(struct nes_cm_event *event)
 	nesqp->cm_id = NULL;
 	cm_id->provider_data = NULL;
 	cm_event.event = IW_CM_EVENT_CONNECT_REPLY;
-	cm_event.status = IW_CM_EVENT_STATUS_REJECTED;
+	cm_event.status = -ECONNRESET;
 	cm_event.provider_data = cm_id->provider_data;
 	cm_event.local_addr = cm_id->local_addr;
 	cm_event.remote_addr = cm_id->remote_addr;
@@ -3390,6 +3477,8 @@ static void cm_event_reset(struct nes_cm_event *event)
 
 	nes_debug(NES_DBG_CM, "%p - cm_id = %p\n", event->cm_node, cm_id);
 	nesqp = cm_id->provider_data;
+	if (!nesqp)
+		return;
 
 	nesqp->cm_id = NULL;
 	/* cm_id->provider_data = NULL; */
@@ -3401,8 +3490,8 @@ static void cm_event_reset(struct nes_cm_event *event)
 	cm_event.private_data = NULL;
 	cm_event.private_data_len = 0;
 
-	ret = cm_id->event_handler(cm_id, &cm_event);
 	cm_id->add_ref(cm_id);
+	ret = cm_id->event_handler(cm_id, &cm_event);
 	atomic_inc(&cm_closes);
 	cm_event.event = IW_CM_EVENT_CLOSE;
 	cm_event.status = IW_CM_EVENT_STATUS_OK;
diff --git a/drivers/infiniband/hw/nes/nes_cm.h b/drivers/infiniband/hw/nes/nes_cm.h
index 90e8e4d8a5ce..d9825fda70a1 100644
--- a/drivers/infiniband/hw/nes/nes_cm.h
+++ b/drivers/infiniband/hw/nes/nes_cm.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006 - 2009 Intel-NE, Inc.  All rights reserved.
+ * Copyright (c) 2006 - 2009 Intel Corporation.  All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -47,6 +47,8 @@
 #define IEFT_MPA_KEY_REP  "MPA ID Rep Frame"
 #define IETF_MPA_KEY_SIZE 16
 #define IETF_MPA_VERSION  1
+#define IETF_MAX_PRIV_DATA_LEN 512
+#define IETF_MPA_FRAME_SIZE     20
 
 enum ietf_mpa_flags {
 	IETF_MPA_FLAGS_MARKERS = 0x80,	/* receive Markers */
@@ -169,7 +171,7 @@ struct nes_timer_entry {
 
 #define NES_CM_DEF_SEQ2      0x18ed5740
 #define NES_CM_DEF_LOCAL_ID2 0xb807
-#define	MAX_CM_BUFFER	512
+#define	MAX_CM_BUFFER	(IETF_MPA_FRAME_SIZE + IETF_MAX_PRIV_DATA_LEN)
 
 
 typedef u32 nes_addr_t;
@@ -198,6 +200,7 @@ enum nes_cm_node_state {
 	NES_CM_STATE_TIME_WAIT,
 	NES_CM_STATE_LAST_ACK,
 	NES_CM_STATE_CLOSING,
+	NES_CM_STATE_LISTENER_DESTROYED,
 	NES_CM_STATE_CLOSED
 };
 
diff --git a/drivers/infiniband/hw/nes/nes_context.h b/drivers/infiniband/hw/nes/nes_context.h
index 0fb8d81d9a62..b4393a16099d 100644
--- a/drivers/infiniband/hw/nes/nes_context.h
+++ b/drivers/infiniband/hw/nes/nes_context.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006 - 2009 Intel-NE, Inc.  All rights reserved.
+ * Copyright (c) 2006 - 2009 Intel Corporation.  All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
diff --git a/drivers/infiniband/hw/nes/nes_hw.c b/drivers/infiniband/hw/nes/nes_hw.c
index 3512d6de3019..b1c2cbb88f09 100644
--- a/drivers/infiniband/hw/nes/nes_hw.c
+++ b/drivers/infiniband/hw/nes/nes_hw.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006 - 2009 Intel-NE, Inc.  All rights reserved.
+ * Copyright (c) 2006 - 2009 Intel Corporation.  All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -424,8 +424,9 @@ struct nes_adapter *nes_init_adapter(struct nes_device *nesdev, u8 hw_rev) {
 
 	nesadapter->base_pd = 1;
 
-	nesadapter->device_cap_flags =
-		IB_DEVICE_LOCAL_DMA_LKEY | IB_DEVICE_MEM_WINDOW;
+	nesadapter->device_cap_flags = IB_DEVICE_LOCAL_DMA_LKEY |
+				       IB_DEVICE_MEM_WINDOW |
+				       IB_DEVICE_MEM_MGT_EXTENSIONS;
 
 	nesadapter->allocated_qps = (unsigned long *)&(((unsigned char *)nesadapter)
 			[(sizeof(struct nes_adapter)+(sizeof(unsigned long)-1))&(~(sizeof(unsigned long)-1))]);
@@ -436,11 +437,12 @@ struct nes_adapter *nes_init_adapter(struct nes_device *nesdev, u8 hw_rev) {
 	nesadapter->qp_table = (struct nes_qp **)(&nesadapter->allocated_arps[BITS_TO_LONGS(arp_table_size)]);
 
 
-	/* mark the usual suspect QPs and CQs as in use */
+	/* mark the usual suspect QPs, MR and CQs as in use */
 	for (u32temp = 0; u32temp < NES_FIRST_QPN; u32temp++) {
 		set_bit(u32temp, nesadapter->allocated_qps);
 		set_bit(u32temp, nesadapter->allocated_cqs);
 	}
+	set_bit(0, nesadapter->allocated_mrs);
 
 	for (u32temp = 0; u32temp < 20; u32temp++)
 		set_bit(u32temp, nesadapter->allocated_pds);
@@ -481,7 +483,7 @@ struct nes_adapter *nes_init_adapter(struct nes_device *nesdev, u8 hw_rev) {
 	nesadapter->max_irrq_wr = (u32temp >> 16) & 3;
 
 	nesadapter->max_sge = 4;
-	nesadapter->max_cqe = 32767;
+	nesadapter->max_cqe = 32766;
 
 	if (nes_read_eeprom_values(nesdev, nesadapter)) {
 		printk(KERN_ERR PFX "Unable to read EEPROM data.\n");
@@ -1355,6 +1357,8 @@ int nes_init_phy(struct nes_device *nesdev)
 	}
 	if ((phy_type == NES_PHY_TYPE_ARGUS) ||
 	    (phy_type == NES_PHY_TYPE_SFP_D)) {
+		u32 first_time = 1;
+
 		/* Check firmware heartbeat */
 		nes_read_10G_phy_reg(nesdev, phy_index, 0x3, 0xd7ee);
 		temp_phy_data = (u16)nes_read_indexed(nesdev, NES_IDX_MAC_MDIO_CONTROL);
@@ -1362,8 +1366,13 @@ int nes_init_phy(struct nes_device *nesdev)
 		nes_read_10G_phy_reg(nesdev, phy_index, 0x3, 0xd7ee);
 		temp_phy_data2 = (u16)nes_read_indexed(nesdev, NES_IDX_MAC_MDIO_CONTROL);
 
-		if (temp_phy_data != temp_phy_data2)
-			return 0;
+		if (temp_phy_data != temp_phy_data2) {
+			nes_read_10G_phy_reg(nesdev, phy_index, 0x3, 0xd7fd);
+			temp_phy_data = (u16)nes_read_indexed(nesdev, NES_IDX_MAC_MDIO_CONTROL);
+			if ((temp_phy_data & 0xff) > 0x20)
+				return 0;
+			printk(PFX "Reinitializing PHY\n");
+		}
 
 		/* no heartbeat, configure the PHY */
 		nes_write_10G_phy_reg(nesdev, phy_index, 0x1, 0x0000, 0x8000);
@@ -1399,7 +1408,7 @@ int nes_init_phy(struct nes_device *nesdev)
 		temp_phy_data = (u16)nes_read_indexed(nesdev, NES_IDX_MAC_MDIO_CONTROL);
 		do {
 			if (counter++ > 150) {
-				nes_debug(NES_DBG_PHY, "No PHY heartbeat\n");
+				printk(PFX "No PHY heartbeat\n");
 				break;
 			}
 			mdelay(1);
@@ -1413,11 +1422,20 @@ int nes_init_phy(struct nes_device *nesdev)
 			nes_read_10G_phy_reg(nesdev, phy_index, 0x3, 0xd7fd);
 			temp_phy_data = (u16)nes_read_indexed(nesdev, NES_IDX_MAC_MDIO_CONTROL);
 			if (counter++ > 300) {
-				nes_debug(NES_DBG_PHY, "PHY did not track\n");
-				break;
+				if (((temp_phy_data & 0xff) == 0x0) && first_time) {
+					first_time = 0;
+					counter = 0;
+					/* reset AMCC PHY and try again */
+					nes_write_10G_phy_reg(nesdev, phy_index, 0x3, 0xe854, 0x00c0);
+					nes_write_10G_phy_reg(nesdev, phy_index, 0x3, 0xe854, 0x0040);
+					continue;
+				} else {
+					printk(PFX "PHY did not track\n");
+					break;
+				}
 			}
 			mdelay(10);
-		} while (((temp_phy_data & 0xff) != 0x50) && ((temp_phy_data & 0xff) != 0x70));
+		} while ((temp_phy_data & 0xff) < 0x30);
 
 		/* setup signal integrity */
 		nes_write_10G_phy_reg(nesdev, phy_index, 0x1, 0xd003, 0x0000);
diff --git a/drivers/infiniband/hw/nes/nes_hw.h b/drivers/infiniband/hw/nes/nes_hw.h
index f28a41ba9fa1..084be0ee689b 100644
--- a/drivers/infiniband/hw/nes/nes_hw.h
+++ b/drivers/infiniband/hw/nes/nes_hw.h
@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2006 - 2009 Intel-NE, Inc.  All rights reserved.
+* Copyright (c) 2006 - 2009 Intel Corporation.  All rights reserved.
 *
 * This software is available to you under a choice of one of two
 * licenses.  You may choose to be licensed under the terms of the GNU
@@ -546,11 +546,23 @@ enum nes_iwarp_sq_fmr_wqe_word_idx {
 	NES_IWARP_SQ_FMR_WQE_PBL_LENGTH_IDX = 14,
 };
 
+enum nes_iwarp_sq_fmr_opcodes {
+	NES_IWARP_SQ_FMR_WQE_ZERO_BASED			= (1<<6),
+	NES_IWARP_SQ_FMR_WQE_PAGE_SIZE_4K		= (0<<7),
+	NES_IWARP_SQ_FMR_WQE_PAGE_SIZE_2M		= (1<<7),
+	NES_IWARP_SQ_FMR_WQE_RIGHTS_ENABLE_LOCAL_READ	= (1<<16),
+	NES_IWARP_SQ_FMR_WQE_RIGHTS_ENABLE_LOCAL_WRITE 	= (1<<17),
+	NES_IWARP_SQ_FMR_WQE_RIGHTS_ENABLE_REMOTE_READ 	= (1<<18),
+	NES_IWARP_SQ_FMR_WQE_RIGHTS_ENABLE_REMOTE_WRITE = (1<<19),
+	NES_IWARP_SQ_FMR_WQE_RIGHTS_ENABLE_WINDOW_BIND 	= (1<<20),
+};
+
+#define NES_IWARP_SQ_FMR_WQE_MR_LENGTH_HIGH_MASK	0xFF;
+
 enum nes_iwarp_sq_locinv_wqe_word_idx {
 	NES_IWARP_SQ_LOCINV_WQE_INV_STAG_IDX = 6,
 };
 
-
 enum nes_iwarp_rq_wqe_word_idx {
 	NES_IWARP_RQ_WQE_TOTAL_PAYLOAD_IDX = 1,
 	NES_IWARP_RQ_WQE_COMP_CTX_LOW_IDX = 2,
@@ -1153,6 +1165,19 @@ struct nes_pbl {
 	/* TODO: need to add list for two level tables */
 };
 
+#define NES_4K_PBL_CHUNK_SIZE	4096
+
+struct nes_fast_mr_wqe_pbl {
+	u64		*kva;
+	dma_addr_t	paddr;
+};
+
+struct nes_ib_fast_reg_page_list {
+	struct ib_fast_reg_page_list	ibfrpl;
+	struct nes_fast_mr_wqe_pbl 	nes_wqe_pbl;
+	u64 				pbl;
+};
+
 struct nes_listener {
 	struct work_struct      work;
 	struct workqueue_struct *wq;
diff --git a/drivers/infiniband/hw/nes/nes_nic.c b/drivers/infiniband/hw/nes/nes_nic.c
index de18fdfdadf2..ab1102780186 100644
--- a/drivers/infiniband/hw/nes/nes_nic.c
+++ b/drivers/infiniband/hw/nes/nes_nic.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006 - 2009 Intel-NE, Inc.  All rights reserved.
+ * Copyright (c) 2006 - 2009 Intel Corporation.  All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
diff --git a/drivers/infiniband/hw/nes/nes_user.h b/drivers/infiniband/hw/nes/nes_user.h
index cc90c14b49eb..71e133ab209b 100644
--- a/drivers/infiniband/hw/nes/nes_user.h
+++ b/drivers/infiniband/hw/nes/nes_user.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006 - 2009 Intel-NE, Inc.  All rights reserved.
+ * Copyright (c) 2006 - 2009 Intel Corporation.  All rights reserved.
  * Copyright (c) 2005 Topspin Communications.  All rights reserved.
  * Copyright (c) 2005 Cisco Systems.  All rights reserved.
  * Copyright (c) 2005 Open Grid Computing, Inc. All rights reserved.
@@ -86,6 +86,7 @@ enum iwnes_memreg_type {
 	IWNES_MEMREG_TYPE_CQ = 0x0002,
 	IWNES_MEMREG_TYPE_MW = 0x0003,
 	IWNES_MEMREG_TYPE_FMR = 0x0004,
+	IWNES_MEMREG_TYPE_FMEM = 0x0005,
 };
 
 struct nes_mem_reg_req {
diff --git a/drivers/infiniband/hw/nes/nes_utils.c b/drivers/infiniband/hw/nes/nes_utils.c
index 9687c397ce1a..729d525c5b70 100644
--- a/drivers/infiniband/hw/nes/nes_utils.c
+++ b/drivers/infiniband/hw/nes/nes_utils.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006 - 2009 Intel-NE, Inc.  All rights reserved.
+ * Copyright (c) 2006 - 2009 Intel Corporation.  All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
diff --git a/drivers/infiniband/hw/nes/nes_verbs.c b/drivers/infiniband/hw/nes/nes_verbs.c
index a680c42d6e8c..64d3136e3747 100644
--- a/drivers/infiniband/hw/nes/nes_verbs.c
+++ b/drivers/infiniband/hw/nes/nes_verbs.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006 - 2009 Intel-NE, Inc.  All rights reserved.
+ * Copyright (c) 2006 - 2009 Intel Corporation.  All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -275,342 +275,236 @@ static int nes_bind_mw(struct ib_qp *ibqp, struct ib_mw *ibmw,
 }
 
 
-/**
- * nes_alloc_fmr
+/*
+ * nes_alloc_fast_mr
  */
-static struct ib_fmr *nes_alloc_fmr(struct ib_pd *ibpd,
-		int ibmr_access_flags,
-		struct ib_fmr_attr *ibfmr_attr)
+static int alloc_fast_reg_mr(struct nes_device *nesdev, struct nes_pd *nespd,
+			     u32 stag, u32 page_count)
 {
-	unsigned long flags;
-	struct nes_pd *nespd = to_nespd(ibpd);
-	struct nes_vnic *nesvnic = to_nesvnic(ibpd->device);
-	struct nes_device *nesdev = nesvnic->nesdev;
-	struct nes_adapter *nesadapter = nesdev->nesadapter;
-	struct nes_fmr *nesfmr;
-	struct nes_cqp_request *cqp_request;
 	struct nes_hw_cqp_wqe *cqp_wqe;
+	struct nes_cqp_request *cqp_request;
+	unsigned long flags;
 	int ret;
-	u32 stag;
-	u32 stag_index = 0;
-	u32 next_stag_index = 0;
-	u32 driver_key = 0;
+	struct nes_adapter *nesadapter = nesdev->nesadapter;
 	u32 opcode = 0;
-	u8 stag_key = 0;
-	int i=0;
-	struct nes_vpbl vpbl;
-
-	get_random_bytes(&next_stag_index, sizeof(next_stag_index));
-	stag_key = (u8)next_stag_index;
-
-	driver_key = 0;
-
-	next_stag_index >>= 8;
-	next_stag_index %= nesadapter->max_mr;
-
-	ret = nes_alloc_resource(nesadapter, nesadapter->allocated_mrs,
-			nesadapter->max_mr, &stag_index, &next_stag_index);
-	if (ret) {
-		goto failed_resource_alloc;
-	}
-
-	nesfmr = kzalloc(sizeof(*nesfmr), GFP_KERNEL);
-	if (!nesfmr) {
-		ret = -ENOMEM;
-		goto failed_fmr_alloc;
-	}
-
-	nesfmr->nesmr.mode = IWNES_MEMREG_TYPE_FMR;
-	if (ibfmr_attr->max_pages == 1) {
-		/* use zero length PBL */
-		nesfmr->nesmr.pbl_4k = 0;
-		nesfmr->nesmr.pbls_used = 0;
-	} else if (ibfmr_attr->max_pages <= 32) {
-		/* use PBL 256 */
-		nesfmr->nesmr.pbl_4k = 0;
-		nesfmr->nesmr.pbls_used = 1;
-	} else if (ibfmr_attr->max_pages <= 512) {
-		/* use 4K PBLs */
-		nesfmr->nesmr.pbl_4k = 1;
-		nesfmr->nesmr.pbls_used = 1;
-	} else {
-		/* use two level 4K PBLs */
-		/* add support for two level 256B PBLs */
-		nesfmr->nesmr.pbl_4k = 1;
-		nesfmr->nesmr.pbls_used = 1 + (ibfmr_attr->max_pages >> 9) +
-				((ibfmr_attr->max_pages & 511) ? 1 : 0);
-	}
-	/* Register the region with the adapter */
-	spin_lock_irqsave(&nesadapter->pbl_lock, flags);
-
-	/* track PBL resources */
-	if (nesfmr->nesmr.pbls_used != 0) {
-		if (nesfmr->nesmr.pbl_4k) {
-			if (nesfmr->nesmr.pbls_used > nesadapter->free_4kpbl) {
-				spin_unlock_irqrestore(&nesadapter->pbl_lock, flags);
-				ret = -ENOMEM;
-				goto failed_vpbl_avail;
-			} else {
-				nesadapter->free_4kpbl -= nesfmr->nesmr.pbls_used;
-			}
-		} else {
-			if (nesfmr->nesmr.pbls_used > nesadapter->free_256pbl) {
-				spin_unlock_irqrestore(&nesadapter->pbl_lock, flags);
-				ret = -ENOMEM;
-				goto failed_vpbl_avail;
-			} else {
-				nesadapter->free_256pbl -= nesfmr->nesmr.pbls_used;
-			}
-		}
-	}
-
-	/* one level pbl */
-	if (nesfmr->nesmr.pbls_used == 0) {
-		nesfmr->root_vpbl.pbl_vbase = NULL;
-		nes_debug(NES_DBG_MR,  "zero level pbl \n");
-	} else if (nesfmr->nesmr.pbls_used == 1) {
-		/* can change it to kmalloc & dma_map_single */
-		nesfmr->root_vpbl.pbl_vbase = pci_alloc_consistent(nesdev->pcidev, 4096,
-				&nesfmr->root_vpbl.pbl_pbase);
-		if (!nesfmr->root_vpbl.pbl_vbase) {
-			spin_unlock_irqrestore(&nesadapter->pbl_lock, flags);
-			ret = -ENOMEM;
-			goto failed_vpbl_alloc;
-		}
-		nesfmr->leaf_pbl_cnt = 0;
-		nes_debug(NES_DBG_MR, "one level pbl, root_vpbl.pbl_vbase=%p \n",
-				nesfmr->root_vpbl.pbl_vbase);
-	}
-	/* two level pbl */
-	else {
-		nesfmr->root_vpbl.pbl_vbase = pci_alloc_consistent(nesdev->pcidev, 8192,
-				&nesfmr->root_vpbl.pbl_pbase);
-		if (!nesfmr->root_vpbl.pbl_vbase) {
-			spin_unlock_irqrestore(&nesadapter->pbl_lock, flags);
-			ret = -ENOMEM;
-			goto failed_vpbl_alloc;
-		}
-
-		nesfmr->leaf_pbl_cnt = nesfmr->nesmr.pbls_used-1;
-		nesfmr->root_vpbl.leaf_vpbl = kzalloc(sizeof(*nesfmr->root_vpbl.leaf_vpbl)*1024, GFP_ATOMIC);
-		if (!nesfmr->root_vpbl.leaf_vpbl) {
-			spin_unlock_irqrestore(&nesadapter->pbl_lock, flags);
-			ret = -ENOMEM;
-			goto failed_leaf_vpbl_alloc;
-		}
-
-		nes_debug(NES_DBG_MR, "two level pbl, root_vpbl.pbl_vbase=%p"
-				" leaf_pbl_cnt=%d root_vpbl.leaf_vpbl=%p\n",
-				nesfmr->root_vpbl.pbl_vbase, nesfmr->leaf_pbl_cnt, nesfmr->root_vpbl.leaf_vpbl);
-
-		for (i=0; i<nesfmr->leaf_pbl_cnt; i++)
-			nesfmr->root_vpbl.leaf_vpbl[i].pbl_vbase = NULL;
-
-		for (i=0; i<nesfmr->leaf_pbl_cnt; i++) {
-			vpbl.pbl_vbase = pci_alloc_consistent(nesdev->pcidev, 4096,
-					&vpbl.pbl_pbase);
-
-			if (!vpbl.pbl_vbase) {
-				ret = -ENOMEM;
-				spin_unlock_irqrestore(&nesadapter->pbl_lock, flags);
-				goto failed_leaf_vpbl_pages_alloc;
-			}
-
-			nesfmr->root_vpbl.pbl_vbase[i].pa_low = cpu_to_le32((u32)vpbl.pbl_pbase);
-			nesfmr->root_vpbl.pbl_vbase[i].pa_high = cpu_to_le32((u32)((((u64)vpbl.pbl_pbase)>>32)));
-			nesfmr->root_vpbl.leaf_vpbl[i] = vpbl;
-
-			nes_debug(NES_DBG_MR, "pbase_low=0x%x, pbase_high=0x%x, vpbl=%p\n",
-					nesfmr->root_vpbl.pbl_vbase[i].pa_low,
-					nesfmr->root_vpbl.pbl_vbase[i].pa_high,
-					&nesfmr->root_vpbl.leaf_vpbl[i]);
-		}
-	}
-	nesfmr->ib_qp = NULL;
-	nesfmr->access_rights =0;
+	u16 major_code;
+	u64 region_length = page_count * PAGE_SIZE;
 
-	stag = stag_index << 8;
-	stag |= driver_key;
-	stag += (u32)stag_key;
 
-	spin_unlock_irqrestore(&nesadapter->pbl_lock, flags);
 	cqp_request = nes_get_cqp_request(nesdev);
 	if (cqp_request == NULL) {
 		nes_debug(NES_DBG_MR, "Failed to get a cqp_request.\n");
-		ret = -ENOMEM;
-		goto failed_leaf_vpbl_pages_alloc;
+		return -ENOMEM;
 	}
+	nes_debug(NES_DBG_MR, "alloc_fast_reg_mr: page_count = %d, "
+			      "region_length = %llu\n",
+			      page_count, region_length);
 	cqp_request->waiting = 1;
 	cqp_wqe = &cqp_request->cqp_wqe;
 
-	nes_debug(NES_DBG_MR, "Registering STag 0x%08X, index = 0x%08X\n",
-			stag, stag_index);
-
-	opcode = NES_CQP_ALLOCATE_STAG | NES_CQP_STAG_VA_TO | NES_CQP_STAG_MR;
-
-	if (nesfmr->nesmr.pbl_4k == 1)
-		opcode |= NES_CQP_STAG_PBL_BLK_SIZE;
-
-	if (ibmr_access_flags & IB_ACCESS_REMOTE_WRITE) {
-		opcode |= NES_CQP_STAG_RIGHTS_REMOTE_WRITE |
-				NES_CQP_STAG_RIGHTS_LOCAL_WRITE | NES_CQP_STAG_REM_ACC_EN;
-		nesfmr->access_rights |=
-				NES_CQP_STAG_RIGHTS_REMOTE_WRITE | NES_CQP_STAG_RIGHTS_LOCAL_WRITE |
-				NES_CQP_STAG_REM_ACC_EN;
+	spin_lock_irqsave(&nesadapter->pbl_lock, flags);
+	if (nesadapter->free_4kpbl > 0) {
+		nesadapter->free_4kpbl--;
+		spin_unlock_irqrestore(&nesadapter->pbl_lock, flags);
+	} else {
+		/* No 4kpbl's available: */
+		spin_unlock_irqrestore(&nesadapter->pbl_lock, flags);
+		nes_debug(NES_DBG_MR, "Out of Pbls\n");
+		nes_free_cqp_request(nesdev, cqp_request);
+		return -ENOMEM;
 	}
 
-	if (ibmr_access_flags & IB_ACCESS_REMOTE_READ) {
-		opcode |= NES_CQP_STAG_RIGHTS_REMOTE_READ |
-				NES_CQP_STAG_RIGHTS_LOCAL_READ | NES_CQP_STAG_REM_ACC_EN;
-		nesfmr->access_rights |=
-				NES_CQP_STAG_RIGHTS_REMOTE_READ | NES_CQP_STAG_RIGHTS_LOCAL_READ |
-				NES_CQP_STAG_REM_ACC_EN;
-	}
+	opcode = NES_CQP_ALLOCATE_STAG | NES_CQP_STAG_MR |
+		 NES_CQP_STAG_PBL_BLK_SIZE | NES_CQP_STAG_VA_TO |
+		 NES_CQP_STAG_REM_ACC_EN;
+	/*
+	 * The current OFED API does not support the zero based TO option.
+	 * If added then need to changed the NES_CQP_STAG_VA* option.  Also,
+	 * the API does not support that ability to have the MR set for local
+	 * access only when created and not allow the SQ op to override. Given
+	 * this the remote enable must be set here.
+	 */
 
 	nes_fill_init_cqp_wqe(cqp_wqe, nesdev);
 	set_wqe_32bit_value(cqp_wqe->wqe_words, NES_CQP_WQE_OPCODE_IDX, opcode);
-	set_wqe_32bit_value(cqp_wqe->wqe_words, NES_CQP_STAG_WQE_LEN_HIGH_PD_IDX, (nespd->pd_id & 0x00007fff));
-	set_wqe_32bit_value(cqp_wqe->wqe_words, NES_CQP_STAG_WQE_STAG_IDX, stag);
+	set_wqe_32bit_value(cqp_wqe->wqe_words, NES_CQP_STAG_WQE_PBL_BLK_COUNT_IDX, 1);
 
-	cqp_wqe->wqe_words[NES_CQP_STAG_WQE_PBL_BLK_COUNT_IDX] =
-			cpu_to_le32((nesfmr->nesmr.pbls_used>1) ?
-			(nesfmr->nesmr.pbls_used-1) : nesfmr->nesmr.pbls_used);
+	cqp_wqe->wqe_words[NES_CQP_STAG_WQE_LEN_HIGH_PD_IDX] =
+			cpu_to_le32((u32)(region_length >> 8) & 0xff000000);
+	cqp_wqe->wqe_words[NES_CQP_STAG_WQE_LEN_HIGH_PD_IDX] |=
+			cpu_to_le32(nespd->pd_id & 0x00007fff);
+
+	set_wqe_32bit_value(cqp_wqe->wqe_words, NES_CQP_STAG_WQE_STAG_IDX, stag);
+	set_wqe_64bit_value(cqp_wqe->wqe_words, NES_CQP_STAG_WQE_VA_LOW_IDX, 0);
+	set_wqe_32bit_value(cqp_wqe->wqe_words, NES_CQP_STAG_WQE_LEN_LOW_IDX, 0);
+	set_wqe_64bit_value(cqp_wqe->wqe_words, NES_CQP_STAG_WQE_PA_LOW_IDX, 0);
+	set_wqe_32bit_value(cqp_wqe->wqe_words, NES_CQP_STAG_WQE_PBL_LEN_IDX, (page_count * 8));
+	cqp_wqe->wqe_words[NES_CQP_WQE_OPCODE_IDX] |= cpu_to_le32(NES_CQP_STAG_PBL_BLK_SIZE);
+	barrier();
 
 	atomic_set(&cqp_request->refcount, 2);
 	nes_post_cqp_request(nesdev, cqp_request);
 
 	/* Wait for CQP */
-	ret = wait_event_timeout(cqp_request->waitq, (cqp_request->request_done != 0),
-			NES_EVENT_TIMEOUT);
-	nes_debug(NES_DBG_MR, "Register STag 0x%08X completed, wait_event_timeout ret = %u,"
-			" CQP Major:Minor codes = 0x%04X:0x%04X.\n",
-			stag, ret, cqp_request->major_code, cqp_request->minor_code);
-
-	if ((!ret) || (cqp_request->major_code)) {
-		nes_put_cqp_request(nesdev, cqp_request);
-		ret = (!ret) ? -ETIME : -EIO;
-		goto failed_leaf_vpbl_pages_alloc;
-	}
+	ret = wait_event_timeout(cqp_request->waitq,
+				 (0 != cqp_request->request_done),
+				 NES_EVENT_TIMEOUT);
+
+	nes_debug(NES_DBG_MR, "Allocate STag 0x%08X completed, "
+		  "wait_event_timeout ret = %u, CQP Major:Minor codes = "
+		  "0x%04X:0x%04X.\n", stag, ret, cqp_request->major_code,
+		  cqp_request->minor_code);
+	major_code = cqp_request->major_code;
 	nes_put_cqp_request(nesdev, cqp_request);
-	nesfmr->nesmr.ibfmr.lkey = stag;
-	nesfmr->nesmr.ibfmr.rkey = stag;
-	nesfmr->attr = *ibfmr_attr;
-
-	return &nesfmr->nesmr.ibfmr;
-
-	failed_leaf_vpbl_pages_alloc:
-	/* unroll all allocated pages */
-	for (i=0; i<nesfmr->leaf_pbl_cnt; i++) {
-		if (nesfmr->root_vpbl.leaf_vpbl[i].pbl_vbase) {
-			pci_free_consistent(nesdev->pcidev, 4096, nesfmr->root_vpbl.leaf_vpbl[i].pbl_vbase,
-					nesfmr->root_vpbl.leaf_vpbl[i].pbl_pbase);
-		}
-	}
-	if (nesfmr->root_vpbl.leaf_vpbl)
-		kfree(nesfmr->root_vpbl.leaf_vpbl);
 
-	failed_leaf_vpbl_alloc:
-	if (nesfmr->leaf_pbl_cnt == 0) {
-		if (nesfmr->root_vpbl.pbl_vbase)
-			pci_free_consistent(nesdev->pcidev, 4096, nesfmr->root_vpbl.pbl_vbase,
-					nesfmr->root_vpbl.pbl_pbase);
-	} else
-		pci_free_consistent(nesdev->pcidev, 8192, nesfmr->root_vpbl.pbl_vbase,
-				nesfmr->root_vpbl.pbl_pbase);
-
-	failed_vpbl_alloc:
-	if (nesfmr->nesmr.pbls_used != 0) {
+	if (!ret || major_code) {
 		spin_lock_irqsave(&nesadapter->pbl_lock, flags);
-		if (nesfmr->nesmr.pbl_4k)
-			nesadapter->free_4kpbl += nesfmr->nesmr.pbls_used;
-		else
-			nesadapter->free_256pbl += nesfmr->nesmr.pbls_used;
+		nesadapter->free_4kpbl++;
 		spin_unlock_irqrestore(&nesadapter->pbl_lock, flags);
 	}
 
-failed_vpbl_avail:
-	kfree(nesfmr);
-
-	failed_fmr_alloc:
-	nes_free_resource(nesadapter, nesadapter->allocated_mrs, stag_index);
-
-	failed_resource_alloc:
-	return ERR_PTR(ret);
+	if (!ret)
+		return -ETIME;
+	else if (major_code)
+		return -EIO;
+	return 0;
 }
 
-
-/**
- * nes_dealloc_fmr
+/*
+ * nes_alloc_fast_reg_mr
  */
-static int nes_dealloc_fmr(struct ib_fmr *ibfmr)
+struct ib_mr *nes_alloc_fast_reg_mr(struct ib_pd *ibpd, int max_page_list_len)
 {
-	unsigned long flags;
-	struct nes_mr *nesmr = to_nesmr_from_ibfmr(ibfmr);
-	struct nes_fmr *nesfmr = to_nesfmr(nesmr);
-	struct nes_vnic *nesvnic = to_nesvnic(ibfmr->device);
+	struct nes_pd *nespd = to_nespd(ibpd);
+	struct nes_vnic *nesvnic = to_nesvnic(ibpd->device);
 	struct nes_device *nesdev = nesvnic->nesdev;
 	struct nes_adapter *nesadapter = nesdev->nesadapter;
-	int i = 0;
-	int rc;
 
-	/* free the resources */
-	if (nesfmr->leaf_pbl_cnt == 0) {
-		/* single PBL case */
-		if (nesfmr->root_vpbl.pbl_vbase)
-			pci_free_consistent(nesdev->pcidev, 4096, nesfmr->root_vpbl.pbl_vbase,
-					nesfmr->root_vpbl.pbl_pbase);
-	} else {
-		for (i = 0; i < nesfmr->leaf_pbl_cnt; i++) {
-			pci_free_consistent(nesdev->pcidev, 4096, nesfmr->root_vpbl.leaf_vpbl[i].pbl_vbase,
-					nesfmr->root_vpbl.leaf_vpbl[i].pbl_pbase);
-		}
-		kfree(nesfmr->root_vpbl.leaf_vpbl);
-		pci_free_consistent(nesdev->pcidev, 8192, nesfmr->root_vpbl.pbl_vbase,
-				nesfmr->root_vpbl.pbl_pbase);
-	}
-	nesmr->ibmw.device = ibfmr->device;
-	nesmr->ibmw.pd = ibfmr->pd;
-	nesmr->ibmw.rkey = ibfmr->rkey;
-	nesmr->ibmw.uobject = NULL;
+	u32 next_stag_index;
+	u8 stag_key = 0;
+	u32 driver_key = 0;
+	int err = 0;
+	u32 stag_index = 0;
+	struct nes_mr *nesmr;
+	u32 stag;
+	int ret;
+	struct ib_mr *ibmr;
+/*
+ * Note:  Set to always use a fixed length single page entry PBL.  This is to allow
+ *	 for the fast_reg_mr operation to always know the size of the PBL.
+ */
+	if (max_page_list_len > (NES_4K_PBL_CHUNK_SIZE / sizeof(u64)))
+		return ERR_PTR(-E2BIG);
 
-	rc = nes_dealloc_mw(&nesmr->ibmw);
+	get_random_bytes(&next_stag_index, sizeof(next_stag_index));
+	stag_key = (u8)next_stag_index;
+	next_stag_index >>= 8;
+	next_stag_index %= nesadapter->max_mr;
 
-	if ((rc == 0) && (nesfmr->nesmr.pbls_used != 0)) {
-		spin_lock_irqsave(&nesadapter->pbl_lock, flags);
-		if (nesfmr->nesmr.pbl_4k) {
-			nesadapter->free_4kpbl += nesfmr->nesmr.pbls_used;
-			WARN_ON(nesadapter->free_4kpbl > nesadapter->max_4kpbl);
-		} else {
-			nesadapter->free_256pbl += nesfmr->nesmr.pbls_used;
-			WARN_ON(nesadapter->free_256pbl > nesadapter->max_256pbl);
-		}
-		spin_unlock_irqrestore(&nesadapter->pbl_lock, flags);
+	err = nes_alloc_resource(nesadapter, nesadapter->allocated_mrs,
+				 nesadapter->max_mr, &stag_index,
+				 &next_stag_index);
+	if (err)
+		return ERR_PTR(err);
+
+	nesmr = kzalloc(sizeof(*nesmr), GFP_KERNEL);
+	if (!nesmr) {
+		nes_free_resource(nesadapter, nesadapter->allocated_mrs, stag_index);
+		return ERR_PTR(-ENOMEM);
 	}
 
-	return rc;
-}
+	stag = stag_index << 8;
+	stag |= driver_key;
+	stag += (u32)stag_key;
 
+	nes_debug(NES_DBG_MR, "Allocating STag 0x%08X index = 0x%08X\n",
+		  stag, stag_index);
 
-/**
- * nes_map_phys_fmr
+	ret = alloc_fast_reg_mr(nesdev, nespd, stag, max_page_list_len);
+
+	if (ret == 0) {
+		nesmr->ibmr.rkey = stag;
+		nesmr->ibmr.lkey = stag;
+		nesmr->mode = IWNES_MEMREG_TYPE_FMEM;
+		ibmr = &nesmr->ibmr;
+	} else {
+		kfree(nesmr);
+		nes_free_resource(nesadapter, nesadapter->allocated_mrs, stag_index);
+		ibmr = ERR_PTR(-ENOMEM);
+	}
+	return ibmr;
+}
+
+/*
+ * nes_alloc_fast_reg_page_list
  */
-static int nes_map_phys_fmr(struct ib_fmr *ibfmr, u64 *page_list,
-		int list_len, u64 iova)
+static struct ib_fast_reg_page_list *nes_alloc_fast_reg_page_list(
+							struct ib_device *ibdev,
+							int page_list_len)
 {
-	return 0;
-}
+	struct nes_vnic *nesvnic = to_nesvnic(ibdev);
+	struct nes_device *nesdev = nesvnic->nesdev;
+	struct ib_fast_reg_page_list *pifrpl;
+	struct nes_ib_fast_reg_page_list *pnesfrpl;
 
+	if (page_list_len > (NES_4K_PBL_CHUNK_SIZE / sizeof(u64)))
+		return ERR_PTR(-E2BIG);
+	/*
+	 * Allocate the ib_fast_reg_page_list structure, the
+	 * nes_fast_bpl structure, and the PLB table.
+	 */
+	pnesfrpl = kmalloc(sizeof(struct nes_ib_fast_reg_page_list) +
+			   page_list_len * sizeof(u64), GFP_KERNEL);
+
+	if (!pnesfrpl)
+		return ERR_PTR(-ENOMEM);
 
-/**
- * nes_unmap_frm
+	pifrpl = &pnesfrpl->ibfrpl;
+	pifrpl->page_list = &pnesfrpl->pbl;
+	pifrpl->max_page_list_len = page_list_len;
+	/*
+	 * Allocate the WQE PBL
+	 */
+	pnesfrpl->nes_wqe_pbl.kva = pci_alloc_consistent(nesdev->pcidev,
+							 page_list_len * sizeof(u64),
+							 &pnesfrpl->nes_wqe_pbl.paddr);
+
+	if (!pnesfrpl->nes_wqe_pbl.kva) {
+		kfree(pnesfrpl);
+		return ERR_PTR(-ENOMEM);
+	}
+	nes_debug(NES_DBG_MR, "nes_alloc_fast_reg_pbl: nes_frpl = %p, "
+		  "ibfrpl = %p, ibfrpl.page_list = %p, pbl.kva = %p, "
+		  "pbl.paddr= %p\n", pnesfrpl, &pnesfrpl->ibfrpl,
+		  pnesfrpl->ibfrpl.page_list, pnesfrpl->nes_wqe_pbl.kva,
+		  (void *)pnesfrpl->nes_wqe_pbl.paddr);
+
+	return pifrpl;
+}
+
+/*
+ * nes_free_fast_reg_page_list
  */
-static int nes_unmap_fmr(struct list_head *ibfmr_list)
+static void nes_free_fast_reg_page_list(struct ib_fast_reg_page_list *pifrpl)
 {
-	return 0;
+	struct nes_vnic *nesvnic = to_nesvnic(pifrpl->device);
+	struct nes_device *nesdev = nesvnic->nesdev;
+	struct nes_ib_fast_reg_page_list *pnesfrpl;
+
+	pnesfrpl = container_of(pifrpl, struct nes_ib_fast_reg_page_list, ibfrpl);
+	/*
+	 * Free the WQE PBL.
+	 */
+	pci_free_consistent(nesdev->pcidev,
+			    pifrpl->max_page_list_len * sizeof(u64),
+			    pnesfrpl->nes_wqe_pbl.kva,
+			    pnesfrpl->nes_wqe_pbl.paddr);
+	/*
+	 * Free the PBL structure
+	 */
+	kfree(pnesfrpl);
 }
 
-
-
 /**
  * nes_query_device
  */
@@ -633,23 +527,23 @@ static int nes_query_device(struct ib_device *ibdev, struct ib_device_attr *prop
 	props->max_qp_wr = nesdev->nesadapter->max_qp_wr - 2;
 	props->max_sge = nesdev->nesadapter->max_sge;
 	props->max_cq = nesibdev->max_cq;
-	props->max_cqe = nesdev->nesadapter->max_cqe - 1;
+	props->max_cqe = nesdev->nesadapter->max_cqe;
 	props->max_mr = nesibdev->max_mr;
 	props->max_mw = nesibdev->max_mr;
 	props->max_pd = nesibdev->max_pd;
 	props->max_sge_rd = 1;
 	switch (nesdev->nesadapter->max_irrq_wr) {
 		case 0:
-			props->max_qp_rd_atom = 1;
+			props->max_qp_rd_atom = 2;
 			break;
 		case 1:
-			props->max_qp_rd_atom = 4;
+			props->max_qp_rd_atom = 8;
 			break;
 		case 2:
-			props->max_qp_rd_atom = 16;
+			props->max_qp_rd_atom = 32;
 			break;
 		case 3:
-			props->max_qp_rd_atom = 32;
+			props->max_qp_rd_atom = 64;
 			break;
 		default:
 			props->max_qp_rd_atom = 0;
@@ -1121,6 +1015,7 @@ static int nes_setup_virt_qp(struct nes_qp *nesqp, struct nes_pbl *nespbl,
 		kunmap(nesqp->page);
 		return -ENOMEM;
 	}
+	nesqp->sq_kmapped = 1;
 	nesqp->hwqp.q2_vbase = mem;
 	mem += 256;
 	memset(nesqp->hwqp.q2_vbase, 0, 256);
@@ -1198,7 +1093,10 @@ static inline void nes_free_qp_mem(struct nes_device *nesdev,
 		pci_free_consistent(nesdev->pcidev, nesqp->qp_mem_size, nesqp->hwqp.q2_vbase, nesqp->hwqp.q2_pbase);
 		pci_free_consistent(nesdev->pcidev, 256, nesqp->pbl_vbase, nesqp->pbl_pbase );
 		nesqp->pbl_vbase = NULL;
-		kunmap(nesqp->page);
+		if (nesqp->sq_kmapped) {
+			nesqp->sq_kmapped = 0;
+			kunmap(nesqp->page);
+		}
 	}
 }
 
@@ -1504,8 +1402,6 @@ static struct ib_qp *nes_create_qp(struct ib_pd *ibpd,
 			nes_debug(NES_DBG_QP, "QP%u structure located @%p.Size = %u.\n",
 					nesqp->hwqp.qp_id, nesqp, (u32)sizeof(*nesqp));
 			spin_lock_init(&nesqp->lock);
-			init_waitqueue_head(&nesqp->state_waitq);
-			init_waitqueue_head(&nesqp->kick_waitq);
 			nes_add_ref(&nesqp->ibqp);
 			break;
 		default:
@@ -1513,6 +1409,8 @@ static struct ib_qp *nes_create_qp(struct ib_pd *ibpd,
 			return ERR_PTR(-EINVAL);
 	}
 
+	nesqp->sig_all = (init_attr->sq_sig_type == IB_SIGNAL_ALL_WR);
+
 	/* update the QP table */
 	nesdev->nesadapter->qp_table[nesqp->hwqp.qp_id-NES_FIRST_QPN] = nesqp;
 	nes_debug(NES_DBG_QP, "netdev refcnt=%u\n",
@@ -1607,8 +1505,10 @@ static int nes_destroy_qp(struct ib_qp *ibqp)
 				nes_ucontext->first_free_wq = nesqp->mmap_sq_db_index;
 			}
 		}
-		if (nesqp->pbl_pbase)
+		if (nesqp->pbl_pbase && nesqp->sq_kmapped) {
+			nesqp->sq_kmapped = 0;
 			kunmap(nesqp->page);
+		}
 	} else {
 		/* Clean any pending completions from the cq(s) */
 		if (nesqp->nesscq)
@@ -1649,6 +1549,9 @@ static struct ib_cq *nes_create_cq(struct ib_device *ibdev, int entries,
 	unsigned long flags;
 	int ret;
 
+	if (entries > nesadapter->max_cqe)
+		return ERR_PTR(-EINVAL);
+
 	err = nes_alloc_resource(nesadapter, nesadapter->allocated_cqs,
 			nesadapter->max_cq, &cq_num, &nesadapter->next_cq);
 	if (err) {
@@ -2606,9 +2509,6 @@ static struct ib_mr *nes_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
 			stag = stag_index << 8;
 			stag |= driver_key;
 			stag += (u32)stag_key;
-			if (stag == 0) {
-				stag = 1;
-			}
 
 			iova_start = virt;
 			/* Make the leaf PBL the root if only one PBL */
@@ -3109,7 +3009,6 @@ int nes_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
 								" already done based on hw state.\n",
 								nesqp->hwqp.qp_id);
 						issue_modify_qp = 0;
-						nesqp->in_disconnect = 0;
 					}
 					switch (nesqp->hw_iwarp_state) {
 						case NES_AEQE_IWARP_STATE_CLOSING:
@@ -3122,7 +3021,6 @@ int nes_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
 							break;
 						default:
 							next_iwarp_state = NES_CQP_QP_IWARP_STATE_CLOSING;
-							nesqp->in_disconnect = 1;
 							nesqp->hw_iwarp_state = NES_AEQE_IWARP_STATE_CLOSING;
 							break;
 					}
@@ -3139,7 +3037,6 @@ int nes_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
 				next_iwarp_state = NES_CQP_QP_IWARP_STATE_TERMINATE;
 				nesqp->hw_iwarp_state = NES_AEQE_IWARP_STATE_TERMINATE;
 				issue_modify_qp = 1;
-				nesqp->in_disconnect = 1;
 				break;
 			case IB_QPS_ERR:
 			case IB_QPS_RESET:
@@ -3162,7 +3059,6 @@ int nes_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
 				if ((nesqp->hw_tcp_state > NES_AEQE_TCP_STATE_CLOSED) &&
 						(nesqp->hw_tcp_state != NES_AEQE_TCP_STATE_TIME_WAIT)) {
 					next_iwarp_state |= NES_CQP_QP_RESET;
-					nesqp->in_disconnect = 1;
 				} else {
 					nes_debug(NES_DBG_MOD_QP, "QP%u NOT setting NES_CQP_QP_RESET since TCP state = %u\n",
 							nesqp->hwqp.qp_id, nesqp->hw_tcp_state);
@@ -3373,21 +3269,17 @@ static int nes_post_send(struct ib_qp *ibqp, struct ib_send_wr *ib_wr,
 	struct nes_device *nesdev = nesvnic->nesdev;
 	struct nes_qp *nesqp = to_nesqp(ibqp);
 	struct nes_hw_qp_wqe *wqe;
-	int err;
+	int err = 0;
 	u32 qsize = nesqp->hwqp.sq_size;
 	u32 head;
-	u32 wqe_misc;
-	u32 wqe_count;
+	u32 wqe_misc = 0;
+	u32 wqe_count = 0;
 	u32 counter;
-	u32 total_payload_length;
-
-	err = 0;
-	wqe_misc = 0;
-	wqe_count = 0;
-	total_payload_length = 0;
 
-	if (nesqp->ibqp_state > IB_QPS_RTS)
-		return -EINVAL;
+	if (nesqp->ibqp_state > IB_QPS_RTS) {
+		err = -EINVAL;
+		goto out;
+	}
 
 	spin_lock_irqsave(&nesqp->lock, flags);
 
@@ -3413,94 +3305,208 @@ static int nes_post_send(struct ib_qp *ibqp, struct ib_send_wr *ib_wr,
 		u64temp = (u64)(ib_wr->wr_id);
 		set_wqe_64bit_value(wqe->wqe_words, NES_IWARP_SQ_WQE_COMP_SCRATCH_LOW_IDX,
 					u64temp);
-			switch (ib_wr->opcode) {
-				case IB_WR_SEND:
-					if (ib_wr->send_flags & IB_SEND_SOLICITED) {
-						wqe_misc = NES_IWARP_SQ_OP_SENDSE;
-					} else {
-						wqe_misc = NES_IWARP_SQ_OP_SEND;
-					}
-					if (ib_wr->num_sge > nesdev->nesadapter->max_sge) {
-						err = -EINVAL;
-						break;
-					}
-					if (ib_wr->send_flags & IB_SEND_FENCE) {
-						wqe_misc |= NES_IWARP_SQ_WQE_LOCAL_FENCE;
-					}
-					if ((ib_wr->send_flags & IB_SEND_INLINE) &&
-							((nes_drv_opt & NES_DRV_OPT_NO_INLINE_DATA) == 0) &&
-							(ib_wr->sg_list[0].length <= 64)) {
-						memcpy(&wqe->wqe_words[NES_IWARP_SQ_WQE_IMM_DATA_START_IDX],
-							       (void *)(unsigned long)ib_wr->sg_list[0].addr, ib_wr->sg_list[0].length);
-						set_wqe_32bit_value(wqe->wqe_words, NES_IWARP_SQ_WQE_TOTAL_PAYLOAD_IDX,
-								ib_wr->sg_list[0].length);
-						wqe_misc |= NES_IWARP_SQ_WQE_IMM_DATA;
-					} else {
-						fill_wqe_sg_send(wqe, ib_wr, 1);
-					}
+		switch (ib_wr->opcode) {
+		case IB_WR_SEND:
+		case IB_WR_SEND_WITH_INV:
+			if (IB_WR_SEND == ib_wr->opcode) {
+				if (ib_wr->send_flags & IB_SEND_SOLICITED)
+					wqe_misc = NES_IWARP_SQ_OP_SENDSE;
+				else
+					wqe_misc = NES_IWARP_SQ_OP_SEND;
+			} else {
+				if (ib_wr->send_flags & IB_SEND_SOLICITED)
+					wqe_misc = NES_IWARP_SQ_OP_SENDSEINV;
+				else
+					wqe_misc = NES_IWARP_SQ_OP_SENDINV;
 
-					break;
-				case IB_WR_RDMA_WRITE:
-					wqe_misc = NES_IWARP_SQ_OP_RDMAW;
-					if (ib_wr->num_sge > nesdev->nesadapter->max_sge) {
-						nes_debug(NES_DBG_IW_TX, "Exceeded max sge, ib_wr=%u, max=%u\n",
-								ib_wr->num_sge,
-								nesdev->nesadapter->max_sge);
-						err = -EINVAL;
-						break;
-					}
-					if (ib_wr->send_flags & IB_SEND_FENCE) {
-						wqe_misc |= NES_IWARP_SQ_WQE_LOCAL_FENCE;
-					}
+				set_wqe_32bit_value(wqe->wqe_words, NES_IWARP_SQ_WQE_INV_STAG_LOW_IDX,
+						    ib_wr->ex.invalidate_rkey);
+			}
 
-					set_wqe_32bit_value(wqe->wqe_words, NES_IWARP_SQ_WQE_RDMA_STAG_IDX,
-							ib_wr->wr.rdma.rkey);
-					set_wqe_64bit_value(wqe->wqe_words, NES_IWARP_SQ_WQE_RDMA_TO_LOW_IDX,
-							ib_wr->wr.rdma.remote_addr);
-
-					if ((ib_wr->send_flags & IB_SEND_INLINE) &&
-							((nes_drv_opt & NES_DRV_OPT_NO_INLINE_DATA) == 0) &&
-							(ib_wr->sg_list[0].length <= 64)) {
-						memcpy(&wqe->wqe_words[NES_IWARP_SQ_WQE_IMM_DATA_START_IDX],
-							       (void *)(unsigned long)ib_wr->sg_list[0].addr, ib_wr->sg_list[0].length);
-						set_wqe_32bit_value(wqe->wqe_words, NES_IWARP_SQ_WQE_TOTAL_PAYLOAD_IDX,
-								ib_wr->sg_list[0].length);
-						wqe_misc |= NES_IWARP_SQ_WQE_IMM_DATA;
-					} else {
-						fill_wqe_sg_send(wqe, ib_wr, 1);
-					}
-					wqe->wqe_words[NES_IWARP_SQ_WQE_RDMA_LENGTH_IDX] =
-							wqe->wqe_words[NES_IWARP_SQ_WQE_TOTAL_PAYLOAD_IDX];
-					break;
-				case IB_WR_RDMA_READ:
-					/* iWARP only supports 1 sge for RDMA reads */
-					if (ib_wr->num_sge > 1) {
-						nes_debug(NES_DBG_IW_TX, "Exceeded max sge, ib_wr=%u, max=1\n",
-								ib_wr->num_sge);
-						err = -EINVAL;
-						break;
-					}
-					wqe_misc = NES_IWARP_SQ_OP_RDMAR;
-					set_wqe_64bit_value(wqe->wqe_words, NES_IWARP_SQ_WQE_RDMA_TO_LOW_IDX,
-							ib_wr->wr.rdma.remote_addr);
-					set_wqe_32bit_value(wqe->wqe_words, NES_IWARP_SQ_WQE_RDMA_STAG_IDX,
-							ib_wr->wr.rdma.rkey);
-					set_wqe_32bit_value(wqe->wqe_words, NES_IWARP_SQ_WQE_RDMA_LENGTH_IDX,
-							ib_wr->sg_list->length);
-					set_wqe_64bit_value(wqe->wqe_words, NES_IWARP_SQ_WQE_FRAG0_LOW_IDX,
-							ib_wr->sg_list->addr);
-					set_wqe_32bit_value(wqe->wqe_words, NES_IWARP_SQ_WQE_STAG0_IDX,
-							ib_wr->sg_list->lkey);
-					break;
-				default:
-					/* error */
-					err = -EINVAL;
-					break;
+			if (ib_wr->num_sge > nesdev->nesadapter->max_sge) {
+				err = -EINVAL;
+				break;
 			}
 
-		if (ib_wr->send_flags & IB_SEND_SIGNALED) {
-			wqe_misc |= NES_IWARP_SQ_WQE_SIGNALED_COMPL;
+			if (ib_wr->send_flags & IB_SEND_FENCE)
+				wqe_misc |= NES_IWARP_SQ_WQE_LOCAL_FENCE;
+
+			if ((ib_wr->send_flags & IB_SEND_INLINE) &&
+			    ((nes_drv_opt & NES_DRV_OPT_NO_INLINE_DATA) == 0) &&
+			     (ib_wr->sg_list[0].length <= 64)) {
+				memcpy(&wqe->wqe_words[NES_IWARP_SQ_WQE_IMM_DATA_START_IDX],
+				       (void *)(unsigned long)ib_wr->sg_list[0].addr, ib_wr->sg_list[0].length);
+				set_wqe_32bit_value(wqe->wqe_words, NES_IWARP_SQ_WQE_TOTAL_PAYLOAD_IDX,
+						    ib_wr->sg_list[0].length);
+				wqe_misc |= NES_IWARP_SQ_WQE_IMM_DATA;
+			} else {
+				fill_wqe_sg_send(wqe, ib_wr, 1);
+			}
+
+			break;
+		case IB_WR_RDMA_WRITE:
+			wqe_misc = NES_IWARP_SQ_OP_RDMAW;
+			if (ib_wr->num_sge > nesdev->nesadapter->max_sge) {
+				nes_debug(NES_DBG_IW_TX, "Exceeded max sge, ib_wr=%u, max=%u\n",
+					  ib_wr->num_sge, nesdev->nesadapter->max_sge);
+				err = -EINVAL;
+				break;
+			}
+
+			if (ib_wr->send_flags & IB_SEND_FENCE)
+				wqe_misc |= NES_IWARP_SQ_WQE_LOCAL_FENCE;
+
+			set_wqe_32bit_value(wqe->wqe_words, NES_IWARP_SQ_WQE_RDMA_STAG_IDX,
+					    ib_wr->wr.rdma.rkey);
+			set_wqe_64bit_value(wqe->wqe_words, NES_IWARP_SQ_WQE_RDMA_TO_LOW_IDX,
+					    ib_wr->wr.rdma.remote_addr);
+
+			if ((ib_wr->send_flags & IB_SEND_INLINE) &&
+			    ((nes_drv_opt & NES_DRV_OPT_NO_INLINE_DATA) == 0) &&
+			     (ib_wr->sg_list[0].length <= 64)) {
+				memcpy(&wqe->wqe_words[NES_IWARP_SQ_WQE_IMM_DATA_START_IDX],
+				       (void *)(unsigned long)ib_wr->sg_list[0].addr, ib_wr->sg_list[0].length);
+				set_wqe_32bit_value(wqe->wqe_words, NES_IWARP_SQ_WQE_TOTAL_PAYLOAD_IDX,
+						    ib_wr->sg_list[0].length);
+				wqe_misc |= NES_IWARP_SQ_WQE_IMM_DATA;
+			} else {
+				fill_wqe_sg_send(wqe, ib_wr, 1);
+			}
+
+			wqe->wqe_words[NES_IWARP_SQ_WQE_RDMA_LENGTH_IDX] =
+				wqe->wqe_words[NES_IWARP_SQ_WQE_TOTAL_PAYLOAD_IDX];
+			break;
+		case IB_WR_RDMA_READ:
+		case IB_WR_RDMA_READ_WITH_INV:
+			/* iWARP only supports 1 sge for RDMA reads */
+			if (ib_wr->num_sge > 1) {
+				nes_debug(NES_DBG_IW_TX, "Exceeded max sge, ib_wr=%u, max=1\n",
+					  ib_wr->num_sge);
+				err = -EINVAL;
+				break;
+			}
+			if (ib_wr->opcode == IB_WR_RDMA_READ) {
+				wqe_misc = NES_IWARP_SQ_OP_RDMAR;
+			} else {
+				wqe_misc = NES_IWARP_SQ_OP_RDMAR_LOCINV;
+				set_wqe_32bit_value(wqe->wqe_words, NES_IWARP_SQ_WQE_INV_STAG_LOW_IDX,
+						    ib_wr->ex.invalidate_rkey);
+			}
+
+			set_wqe_64bit_value(wqe->wqe_words, NES_IWARP_SQ_WQE_RDMA_TO_LOW_IDX,
+					    ib_wr->wr.rdma.remote_addr);
+			set_wqe_32bit_value(wqe->wqe_words, NES_IWARP_SQ_WQE_RDMA_STAG_IDX,
+					    ib_wr->wr.rdma.rkey);
+			set_wqe_32bit_value(wqe->wqe_words, NES_IWARP_SQ_WQE_RDMA_LENGTH_IDX,
+					    ib_wr->sg_list->length);
+			set_wqe_64bit_value(wqe->wqe_words, NES_IWARP_SQ_WQE_FRAG0_LOW_IDX,
+					    ib_wr->sg_list->addr);
+			set_wqe_32bit_value(wqe->wqe_words, NES_IWARP_SQ_WQE_STAG0_IDX,
+					    ib_wr->sg_list->lkey);
+			break;
+		case IB_WR_LOCAL_INV:
+			wqe_misc = NES_IWARP_SQ_OP_LOCINV;
+			set_wqe_32bit_value(wqe->wqe_words,
+					    NES_IWARP_SQ_LOCINV_WQE_INV_STAG_IDX,
+					    ib_wr->ex.invalidate_rkey);
+			break;
+		case IB_WR_FAST_REG_MR:
+		{
+			int i;
+			int flags = ib_wr->wr.fast_reg.access_flags;
+			struct nes_ib_fast_reg_page_list *pnesfrpl =
+				container_of(ib_wr->wr.fast_reg.page_list,
+					     struct nes_ib_fast_reg_page_list,
+					     ibfrpl);
+			u64 *src_page_list = pnesfrpl->ibfrpl.page_list;
+			u64 *dst_page_list = pnesfrpl->nes_wqe_pbl.kva;
+
+			if (ib_wr->wr.fast_reg.page_list_len >
+			    (NES_4K_PBL_CHUNK_SIZE / sizeof(u64))) {
+				nes_debug(NES_DBG_IW_TX, "SQ_FMR: bad page_list_len\n");
+				err = -EINVAL;
+				break;
+			}
+			wqe_misc = NES_IWARP_SQ_OP_FAST_REG;
+			set_wqe_64bit_value(wqe->wqe_words,
+					    NES_IWARP_SQ_FMR_WQE_VA_FBO_LOW_IDX,
+					    ib_wr->wr.fast_reg.iova_start);
+			set_wqe_32bit_value(wqe->wqe_words,
+					    NES_IWARP_SQ_FMR_WQE_LENGTH_LOW_IDX,
+					    ib_wr->wr.fast_reg.length);
+			set_wqe_32bit_value(wqe->wqe_words,
+					    NES_IWARP_SQ_FMR_WQE_MR_STAG_IDX,
+					    ib_wr->wr.fast_reg.rkey);
+			/* Set page size: */
+			if (ib_wr->wr.fast_reg.page_shift == 12) {
+				wqe_misc |= NES_IWARP_SQ_FMR_WQE_PAGE_SIZE_4K;
+			} else if (ib_wr->wr.fast_reg.page_shift == 21) {
+				wqe_misc |= NES_IWARP_SQ_FMR_WQE_PAGE_SIZE_2M;
+			} else {
+				nes_debug(NES_DBG_IW_TX, "Invalid page shift,"
+					  " ib_wr=%u, max=1\n", ib_wr->num_sge);
+				err = -EINVAL;
+				break;
+			}
+			/* Set access_flags */
+			wqe_misc |= NES_IWARP_SQ_FMR_WQE_RIGHTS_ENABLE_LOCAL_READ;
+			if (flags & IB_ACCESS_LOCAL_WRITE)
+				wqe_misc |= NES_IWARP_SQ_FMR_WQE_RIGHTS_ENABLE_LOCAL_WRITE;
+
+			if (flags & IB_ACCESS_REMOTE_WRITE)
+				wqe_misc |= NES_IWARP_SQ_FMR_WQE_RIGHTS_ENABLE_REMOTE_WRITE;
+
+			if (flags & IB_ACCESS_REMOTE_READ)
+				wqe_misc |= NES_IWARP_SQ_FMR_WQE_RIGHTS_ENABLE_REMOTE_READ;
+
+			if (flags & IB_ACCESS_MW_BIND)
+				wqe_misc |= NES_IWARP_SQ_FMR_WQE_RIGHTS_ENABLE_WINDOW_BIND;
+
+			/* Fill in PBL info: */
+			if (ib_wr->wr.fast_reg.page_list_len >
+			    pnesfrpl->ibfrpl.max_page_list_len) {
+				nes_debug(NES_DBG_IW_TX, "Invalid page list length,"
+					  " ib_wr=%p, value=%u, max=%u\n",
+					  ib_wr, ib_wr->wr.fast_reg.page_list_len,
+					  pnesfrpl->ibfrpl.max_page_list_len);
+				err = -EINVAL;
+				break;
+			}
+
+			set_wqe_64bit_value(wqe->wqe_words,
+					    NES_IWARP_SQ_FMR_WQE_PBL_ADDR_LOW_IDX,
+					    pnesfrpl->nes_wqe_pbl.paddr);
+
+			set_wqe_32bit_value(wqe->wqe_words,
+					    NES_IWARP_SQ_FMR_WQE_PBL_LENGTH_IDX,
+					    ib_wr->wr.fast_reg.page_list_len * 8);
+
+			for (i = 0; i < ib_wr->wr.fast_reg.page_list_len; i++)
+				dst_page_list[i] = cpu_to_le64(src_page_list[i]);
+
+			nes_debug(NES_DBG_IW_TX, "SQ_FMR: iova_start: %p, "
+				  "length: %d, rkey: %0x, pgl_paddr: %p, "
+				  "page_list_len: %u, wqe_misc: %x\n",
+				  (void *)ib_wr->wr.fast_reg.iova_start,
+				  ib_wr->wr.fast_reg.length,
+				  ib_wr->wr.fast_reg.rkey,
+				  (void *)pnesfrpl->nes_wqe_pbl.paddr,
+				  ib_wr->wr.fast_reg.page_list_len,
+				  wqe_misc);
+			break;
+		}
+		default:
+			/* error */
+			err = -EINVAL;
+			break;
 		}
+
+		if (err)
+			break;
+
+		if ((ib_wr->send_flags & IB_SEND_SIGNALED) || nesqp->sig_all)
+			wqe_misc |= NES_IWARP_SQ_WQE_SIGNALED_COMPL;
+
 		wqe->wqe_words[NES_IWARP_SQ_WQE_MISC_IDX] = cpu_to_le32(wqe_misc);
 
 		ib_wr = ib_wr->next;
@@ -3522,6 +3528,7 @@ static int nes_post_send(struct ib_qp *ibqp, struct ib_send_wr *ib_wr,
 
 	spin_unlock_irqrestore(&nesqp->lock, flags);
 
+out:
 	if (err)
 		*bad_wr = ib_wr;
 	return err;
@@ -3548,8 +3555,10 @@ static int nes_post_recv(struct ib_qp *ibqp, struct ib_recv_wr *ib_wr,
 	u32 counter;
 	u32 total_payload_length;
 
-	if (nesqp->ibqp_state > IB_QPS_RTS)
-		return -EINVAL;
+	if (nesqp->ibqp_state > IB_QPS_RTS) {
+		err = -EINVAL;
+		goto out;
+	}
 
 	spin_lock_irqsave(&nesqp->lock, flags);
 
@@ -3612,6 +3621,7 @@ static int nes_post_recv(struct ib_qp *ibqp, struct ib_recv_wr *ib_wr,
 
 	spin_unlock_irqrestore(&nesqp->lock, flags);
 
+out:
 	if (err)
 		*bad_wr = ib_wr;
 	return err;
@@ -3720,6 +3730,12 @@ static int nes_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *entry)
 						nes_debug(NES_DBG_CQ, "Operation = Send.\n");
 						entry->opcode = IB_WC_SEND;
 						break;
+					case NES_IWARP_SQ_OP_LOCINV:
+						entry->opcode = IB_WR_LOCAL_INV;
+						break;
+					case NES_IWARP_SQ_OP_FAST_REG:
+						entry->opcode = IB_WC_FAST_REG_MR;
+						break;
 				}
 
 				nesqp->hwqp.sq_tail = (wqe_index+1)&(nesqp->hwqp.sq_size - 1);
@@ -3890,10 +3906,9 @@ struct nes_ib_device *nes_init_ofa_device(struct net_device *netdev)
 	nesibdev->ibdev.dealloc_mw = nes_dealloc_mw;
 	nesibdev->ibdev.bind_mw = nes_bind_mw;
 
-	nesibdev->ibdev.alloc_fmr = nes_alloc_fmr;
-	nesibdev->ibdev.unmap_fmr = nes_unmap_fmr;
-	nesibdev->ibdev.dealloc_fmr = nes_dealloc_fmr;
-	nesibdev->ibdev.map_phys_fmr = nes_map_phys_fmr;
+	nesibdev->ibdev.alloc_fast_reg_mr = nes_alloc_fast_reg_mr;
+	nesibdev->ibdev.alloc_fast_reg_page_list = nes_alloc_fast_reg_page_list;
+	nesibdev->ibdev.free_fast_reg_page_list = nes_free_fast_reg_page_list;
 
 	nesibdev->ibdev.attach_mcast = nes_multicast_attach;
 	nesibdev->ibdev.detach_mcast = nes_multicast_detach;
diff --git a/drivers/infiniband/hw/nes/nes_verbs.h b/drivers/infiniband/hw/nes/nes_verbs.h
index 89822d75f82e..2df9993e0cac 100644
--- a/drivers/infiniband/hw/nes/nes_verbs.h
+++ b/drivers/infiniband/hw/nes/nes_verbs.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006 - 2009 Intel-NE, Inc.  All rights reserved.
+ * Copyright (c) 2006 - 2009 Intel Corporation.  All rights reserved.
  * Copyright (c) 2005 Open Grid Computing, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
@@ -135,19 +135,15 @@ struct nes_qp {
 	struct ib_qp          ibqp;
 	void                  *allocated_buffer;
 	struct iw_cm_id       *cm_id;
-	struct workqueue_struct *wq;
 	struct nes_cq         *nesscq;
 	struct nes_cq         *nesrcq;
 	struct nes_pd         *nespd;
 	void *cm_node; /* handle of the node this QP is associated with */
 	struct ietf_mpa_frame *ietf_frame;
 	dma_addr_t            ietf_frame_pbase;
-	wait_queue_head_t     state_waitq;
 	struct ib_mr          *lsmm_mr;
-	unsigned long         socket;
 	struct nes_hw_qp      hwqp;
 	struct work_struct    work;
-	struct work_struct    ae_work;
 	enum ib_qp_state      ibqp_state;
 	u32                   iwarp_state;
 	u32                   hte_index;
@@ -165,19 +161,20 @@ struct nes_qp {
 	struct page           *page;
 	struct timer_list     terminate_timer;
 	enum ib_event_type    terminate_eventtype;
-	wait_queue_head_t     kick_waitq;
-	u16                   in_disconnect;
+	u16                   active_conn:1;
+	u16                   skip_lsmm:1;
+	u16                   user_mode:1;
+	u16                   hte_added:1;
+	u16                   flush_issued:1;
+	u16                   destroyed:1;
+	u16                   sig_all:1;
+	u16                   rsvd:9;
 	u16                   private_data_len;
 	u16                   term_sq_flush_code;
 	u16                   term_rq_flush_code;
-	u8                    active_conn;
-	u8                    skip_lsmm;
-	u8                    user_mode;
-	u8                    hte_added;
 	u8                    hw_iwarp_state;
-	u8                    flush_issued;
 	u8                    hw_tcp_state;
 	u8                    term_flags;
-	u8                    destroyed;
+	u8                    sq_kmapped;
 };
 #endif			/* NES_VERBS_H */
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 2bf5116deec4..df3eb8c9fd96 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -884,6 +884,7 @@ struct ipoib_neigh *ipoib_neigh_alloc(struct neighbour *neighbour,
 
 	neigh->neighbour = neighbour;
 	neigh->dev = dev;
+	memset(&neigh->dgid.raw, 0, sizeof (union ib_gid));
 	*to_ipoib_neigh(neighbour) = neigh;
 	skb_queue_head_init(&neigh->queue);
 	ipoib_cm_set(neigh, NULL);
diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.c b/drivers/infiniband/ulp/iser/iscsi_iser.c
index add9188663ff..5f7a6fca0a4d 100644
--- a/drivers/infiniband/ulp/iser/iscsi_iser.c
+++ b/drivers/infiniband/ulp/iser/iscsi_iser.c
@@ -625,6 +625,7 @@ static struct iscsi_transport iscsi_iser_transport = {
 				  ISCSI_USERNAME | ISCSI_PASSWORD |
 				  ISCSI_USERNAME_IN | ISCSI_PASSWORD_IN |
 				  ISCSI_FAST_ABORT | ISCSI_ABORT_TMO |
+				  ISCSI_LU_RESET_TMO | ISCSI_TGT_RESET_TMO |
 				  ISCSI_PING_TMO | ISCSI_RECV_TMO |
 				  ISCSI_IFACE_NAME | ISCSI_INITIATOR_NAME,
 	.host_param_mask	= ISCSI_HOST_HWADDRESS |
diff --git a/drivers/infiniband/ulp/iser/iser_memory.c b/drivers/infiniband/ulp/iser/iser_memory.c
index b9453d068e9d..274c883ef3ea 100644
--- a/drivers/infiniband/ulp/iser/iser_memory.c
+++ b/drivers/infiniband/ulp/iser/iser_memory.c
@@ -209,6 +209,8 @@ void iser_finalize_rdma_unaligned_sg(struct iscsi_iser_task *iser_task,
 	mem_copy->copy_buf = NULL;
 }
 
+#define IS_4K_ALIGNED(addr)	((((unsigned long)addr) & ~MASK_4K) == 0)
+
 /**
  * iser_sg_to_page_vec - Translates scatterlist entries to physical addresses
  * and returns the length of resulting physical address array (may be less than
@@ -221,62 +223,52 @@ void iser_finalize_rdma_unaligned_sg(struct iscsi_iser_task *iser_task,
  * where --few fragments of the same page-- are present in the SG as
  * consecutive elements. Also, it handles one entry SG.
  */
+
 static int iser_sg_to_page_vec(struct iser_data_buf *data,
 			       struct iser_page_vec *page_vec,
 			       struct ib_device *ibdev)
 {
-	struct scatterlist *sgl = (struct scatterlist *)data->buf;
-	struct scatterlist *sg;
-	u64 first_addr, last_addr, page;
-	int end_aligned;
-	unsigned int cur_page = 0;
+	struct scatterlist *sg, *sgl = (struct scatterlist *)data->buf;
+	u64 start_addr, end_addr, page, chunk_start = 0;
 	unsigned long total_sz = 0;
-	int i;
+	unsigned int dma_len;
+	int i, new_chunk, cur_page, last_ent = data->dma_nents - 1;
 
 	/* compute the offset of first element */
 	page_vec->offset = (u64) sgl[0].offset & ~MASK_4K;
 
+	new_chunk = 1;
+	cur_page  = 0;
 	for_each_sg(sgl, sg, data->dma_nents, i) {
-		unsigned int dma_len = ib_sg_dma_len(ibdev, sg);
-
+		start_addr = ib_sg_dma_address(ibdev, sg);
+		if (new_chunk)
+			chunk_start = start_addr;
+		dma_len = ib_sg_dma_len(ibdev, sg);
+		end_addr = start_addr + dma_len;
 		total_sz += dma_len;
 
-		first_addr = ib_sg_dma_address(ibdev, sg);
-		last_addr  = first_addr + dma_len;
-
-		end_aligned   = !(last_addr  & ~MASK_4K);
-
-		/* continue to collect page fragments till aligned or SG ends */
-		while (!end_aligned && (i + 1 < data->dma_nents)) {
-			sg = sg_next(sg);
-			i++;
-			dma_len = ib_sg_dma_len(ibdev, sg);
-			total_sz += dma_len;
-			last_addr = ib_sg_dma_address(ibdev, sg) + dma_len;
-			end_aligned = !(last_addr  & ~MASK_4K);
+		/* collect page fragments until aligned or end of SG list */
+		if (!IS_4K_ALIGNED(end_addr) && i < last_ent) {
+			new_chunk = 0;
+			continue;
 		}
-
-		/* handle the 1st page in the 1st DMA element */
-		if (cur_page == 0) {
-			page = first_addr & MASK_4K;
-			page_vec->pages[cur_page] = page;
-			cur_page++;
+		new_chunk = 1;
+
+		/* address of the first page in the contiguous chunk;
+		   masking relevant for the very first SG entry,
+		   which might be unaligned */
+		page = chunk_start & MASK_4K;
+		do {
+			page_vec->pages[cur_page++] = page;
 			page += SIZE_4K;
-		} else
-			page = first_addr;
-
-		for (; page < last_addr; page += SIZE_4K) {
-			page_vec->pages[cur_page] = page;
-			cur_page++;
-		}
-
+		} while (page < end_addr);
 	}
+
 	page_vec->data_size = total_sz;
 	iser_dbg("page_vec->data_size:%d cur_page %d\n", page_vec->data_size,cur_page);
 	return cur_page;
 }
 
-#define IS_4K_ALIGNED(addr)	((((unsigned long)addr) & ~MASK_4K) == 0)
 
 /**
  * iser_data_buf_aligned_len - Tries to determine the maximal correctly aligned
@@ -284,42 +276,40 @@ static int iser_sg_to_page_vec(struct iser_data_buf *data,
  * the number of entries which are aligned correctly. Supports the case where
  * consecutive SG elements are actually fragments of the same physcial page.
  */
-static unsigned int iser_data_buf_aligned_len(struct iser_data_buf *data,
-					      struct ib_device *ibdev)
+static int iser_data_buf_aligned_len(struct iser_data_buf *data,
+				      struct ib_device *ibdev)
 {
-	struct scatterlist *sgl, *sg;
-	u64 end_addr, next_addr;
-	int i, cnt;
-	unsigned int ret_len = 0;
+	struct scatterlist *sgl, *sg, *next_sg = NULL;
+	u64 start_addr, end_addr;
+	int i, ret_len, start_check = 0;
+
+	if (data->dma_nents == 1)
+		return 1;
 
 	sgl = (struct scatterlist *)data->buf;
+	start_addr  = ib_sg_dma_address(ibdev, sgl);
 
-	cnt = 0;
 	for_each_sg(sgl, sg, data->dma_nents, i) {
-		/* iser_dbg("Checking sg iobuf [%d]: phys=0x%08lX "
-		   "offset: %ld sz: %ld\n", i,
-		   (unsigned long)sg_phys(sg),
-		   (unsigned long)sg->offset,
-		   (unsigned long)sg->length); */
-		end_addr = ib_sg_dma_address(ibdev, sg) +
-			   ib_sg_dma_len(ibdev, sg);
-		/* iser_dbg("Checking sg iobuf end address "
-		       "0x%08lX\n", end_addr); */
-		if (i + 1 < data->dma_nents) {
-			next_addr = ib_sg_dma_address(ibdev, sg_next(sg));
-			/* are i, i+1 fragments of the same page? */
-			if (end_addr == next_addr) {
-				cnt++;
-				continue;
-			} else if (!IS_4K_ALIGNED(end_addr)) {
-				ret_len = cnt + 1;
-				break;
-			}
-		}
-		cnt++;
+		if (start_check && !IS_4K_ALIGNED(start_addr))
+			break;
+
+		next_sg = sg_next(sg);
+		if (!next_sg)
+			break;
+
+		end_addr    = start_addr + ib_sg_dma_len(ibdev, sg);
+		start_addr  = ib_sg_dma_address(ibdev, next_sg);
+
+		if (end_addr == start_addr) {
+			start_check = 0;
+			continue;
+		} else
+			start_check = 1;
+
+		if (!IS_4K_ALIGNED(end_addr))
+			break;
 	}
-	if (i == data->dma_nents)
-		ret_len = cnt;	/* loop ended */
+	ret_len = (next_sg) ? i : i+1;
 	iser_dbg("Found %d aligned entries out of %d in sg:0x%p\n",
 		 ret_len, data->dma_nents, data);
 	return ret_len;
diff --git a/drivers/infiniband/ulp/iser/iser_verbs.c b/drivers/infiniband/ulp/iser/iser_verbs.c
index ea9e1556e0d6..8579f32ce38e 100644
--- a/drivers/infiniband/ulp/iser/iser_verbs.c
+++ b/drivers/infiniband/ulp/iser/iser_verbs.c
@@ -499,7 +499,7 @@ void iser_conn_init(struct iser_conn *ib_conn)
 
  /**
  * starts the process of connecting to the target
- * sleeps untill the connection is established or rejected
+ * sleeps until the connection is established or rejected
  */
 int iser_connect(struct iser_conn   *ib_conn,
 		 struct sockaddr_in *src_addr,
diff --git a/drivers/input/Kconfig b/drivers/input/Kconfig
index cd50c00ab20f..07c2cd43109c 100644
--- a/drivers/input/Kconfig
+++ b/drivers/input/Kconfig
@@ -8,7 +8,7 @@ menu "Input device support"
 config INPUT
 	tristate "Generic input layer (needed for keyboard, mouse, ...)" if EMBEDDED
 	default y
-	---help---
+	help
 	  Say Y here if you have any input device (mouse, keyboard, tablet,
 	  joystick, steering wheel ...) connected to your system and want
 	  it to be available to applications. This includes standard PS/2
@@ -27,8 +27,7 @@ if INPUT
 
 config INPUT_FF_MEMLESS
 	tristate "Support for memoryless force-feedback devices"
-	default n
-	---help---
+	help
 	  Say Y here if you have memoryless force-feedback input device
 	  such as Logitech WingMan Force 3D, ThrustMaster FireStorm Dual
 	  Power 2, or similar. You will also need to enable hardware-specific
@@ -52,12 +51,25 @@ config INPUT_POLLDEV
 	  To compile this driver as a module, choose M here: the
 	  module will be called input-polldev.
 
+config INPUT_SPARSEKMAP
+	tristate "Sparse keymap support library"
+	help
+	  Say Y here if you are using a driver for an input
+	  device that uses sparse keymap. This option is only
+	  useful for out-of-tree drivers since in-tree drivers
+	  select it automatically.
+
+	  If unsure, say N.
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called sparse-keymap.
+
 comment "Userland interfaces"
 
 config INPUT_MOUSEDEV
 	tristate "Mouse interface" if EMBEDDED
 	default y
-	---help---
+	help
 	  Say Y here if you want your mouse to be accessible as char devices
 	  13:32+ - /dev/input/mouseX and 13:63 - /dev/input/mice as an
 	  emulated IntelliMouse Explorer PS/2 mouse. That way, all user space
@@ -73,7 +85,7 @@ config INPUT_MOUSEDEV_PSAUX
 	bool "Provide legacy /dev/psaux device"
 	default y
 	depends on INPUT_MOUSEDEV
-	---help---
+	help
 	  Say Y here if you want your mouse also be accessible as char device
 	  10:1 - /dev/psaux. The data available through /dev/psaux is exactly
 	  the same as the data from /dev/input/mice.
@@ -103,7 +115,7 @@ config INPUT_MOUSEDEV_SCREEN_Y
 
 config INPUT_JOYDEV
 	tristate "Joystick interface"
-	---help---
+	help
 	  Say Y here if you want your joystick or gamepad to be
 	  accessible as char device 13:0+ - /dev/input/jsX device.
 
@@ -125,7 +137,7 @@ config INPUT_EVDEV
 
 config INPUT_EVBUG
 	tristate "Event debugging"
-	---help---
+	help
 	  Say Y here if you have a problem with the input subsystem and
 	  want all events (keypresses, mouse movements), to be output to
 	  the system log. While this is useful for debugging, it's also
@@ -140,7 +152,7 @@ config INPUT_EVBUG
 config INPUT_APMPOWER
 	tristate "Input Power Event -> APM Bridge" if EMBEDDED
 	depends on INPUT && APM_EMULATION
-	---help---
+	help
 	  Say Y here if you want suspend key events to trigger a user
 	  requested suspend through APM. This is useful on embedded
 	  systems where such behaviour is desired without userspace
@@ -153,6 +165,7 @@ config XEN_KBDDEV_FRONTEND
 	tristate "Xen virtual keyboard and mouse support"
 	depends on XEN_FBDEV_FRONTEND
 	default y
+	select XEN_XENBUS_FRONTEND
 	help
 	  This driver implements the front-end of the Xen virtual
 	  keyboard and mouse device driver.  It communicates with a back-end
diff --git a/drivers/input/Makefile b/drivers/input/Makefile
index 4c9c745a7020..7ad212d31f99 100644
--- a/drivers/input/Makefile
+++ b/drivers/input/Makefile
@@ -9,6 +9,7 @@ input-core-objs := input.o input-compat.o ff-core.o
 
 obj-$(CONFIG_INPUT_FF_MEMLESS)	+= ff-memless.o
 obj-$(CONFIG_INPUT_POLLDEV)	+= input-polldev.o
+obj-$(CONFIG_INPUT_SPARSEKMAP)	+= sparse-keymap.o
 
 obj-$(CONFIG_INPUT_MOUSEDEV)	+= mousedev.o
 obj-$(CONFIG_INPUT_JOYDEV)	+= joydev.o
diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index dee6706038aa..258c639571b5 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -59,7 +59,8 @@ static void evdev_pass_event(struct evdev_client *client,
 	client->head &= EVDEV_BUFFER_SIZE - 1;
 	spin_unlock(&client->buffer_lock);
 
-	kill_fasync(&client->fasync, SIGIO, POLL_IN);
+	if (event->type == EV_SYN)
+		kill_fasync(&client->fasync, SIGIO, POLL_IN);
 }
 
 /*
diff --git a/drivers/input/ff-core.c b/drivers/input/ff-core.c
index 38df81fcdc3a..b2f07aa1604b 100644
--- a/drivers/input/ff-core.c
+++ b/drivers/input/ff-core.c
@@ -353,7 +353,7 @@ int input_ff_create(struct input_dev *dev, int max_effects)
 EXPORT_SYMBOL_GPL(input_ff_create);
 
 /**
- * input_ff_free() - frees force feedback portion of input device
+ * input_ff_destroy() - frees force feedback portion of input device
  * @dev: input device supporting force feedback
  *
  * This function is only needed in error path as input core will
@@ -369,6 +369,7 @@ void input_ff_destroy(struct input_dev *dev)
 		if (ff->destroy)
 			ff->destroy(ff);
 		kfree(ff->private);
+		kfree(ff->effects);
 		kfree(ff);
 		dev->ff = NULL;
 	}
diff --git a/drivers/input/ff-memless.c b/drivers/input/ff-memless.c
index b483b2995fa9..f967008f332e 100644
--- a/drivers/input/ff-memless.c
+++ b/drivers/input/ff-memless.c
@@ -221,11 +221,27 @@ static int get_compatible_type(struct ff_device *ff, int effect_type)
 }
 
 /*
+ * Only left/right direction should be used (under/over 0x8000) for
+ * forward/reverse motor direction (to keep calculation fast & simple).
+ */
+static u16 ml_calculate_direction(u16 direction, u16 force,
+				  u16 new_direction, u16 new_force)
+{
+	if (!force)
+		return new_direction;
+	if (!new_force)
+		return direction;
+	return (((u32)(direction >> 1) * force +
+		 (new_direction >> 1) * new_force) /
+		(force + new_force)) << 1;
+}
+
+/*
  * Combine two effects and apply gain.
  */
 static void ml_combine_effects(struct ff_effect *effect,
 			       struct ml_effect_state *state,
-			       unsigned int gain)
+			       int gain)
 {
 	struct ff_effect *new = state->effect;
 	unsigned int strong, weak, i;
@@ -252,8 +268,21 @@ static void ml_combine_effects(struct ff_effect *effect,
 		break;
 
 	case FF_RUMBLE:
-		strong = new->u.rumble.strong_magnitude * gain / 0xffff;
-		weak = new->u.rumble.weak_magnitude * gain / 0xffff;
+		strong = (u32)new->u.rumble.strong_magnitude * gain / 0xffff;
+		weak = (u32)new->u.rumble.weak_magnitude * gain / 0xffff;
+
+		if (effect->u.rumble.strong_magnitude + strong)
+			effect->direction = ml_calculate_direction(
+				effect->direction,
+				effect->u.rumble.strong_magnitude,
+				new->direction, strong);
+		else if (effect->u.rumble.weak_magnitude + weak)
+			effect->direction = ml_calculate_direction(
+				effect->direction,
+				effect->u.rumble.weak_magnitude,
+				new->direction, weak);
+		else
+			effect->direction = 0;
 		effect->u.rumble.strong_magnitude =
 			min(strong + effect->u.rumble.strong_magnitude,
 			    0xffffU);
@@ -268,6 +297,13 @@ static void ml_combine_effects(struct ff_effect *effect,
 		/* here we also scale it 0x7fff => 0xffff */
 		i = i * gain / 0x7fff;
 
+		if (effect->u.rumble.strong_magnitude + i)
+			effect->direction = ml_calculate_direction(
+				effect->direction,
+				effect->u.rumble.strong_magnitude,
+				new->direction, i);
+		else
+			effect->direction = 0;
 		effect->u.rumble.strong_magnitude =
 			min(i + effect->u.rumble.strong_magnitude, 0xffffU);
 		effect->u.rumble.weak_magnitude =
@@ -411,8 +447,6 @@ static int ml_ff_playback(struct input_dev *dev, int effect_id, int value)
 				 msecs_to_jiffies(state->effect->replay.length);
 		state->adj_at = state->play_at;
 
-		ml_schedule_timer(ml);
-
 	} else {
 		debug("initiated stop");
 
@@ -420,10 +454,10 @@ static int ml_ff_playback(struct input_dev *dev, int effect_id, int value)
 			__set_bit(FF_EFFECT_ABORTING, &state->flags);
 		else
 			__clear_bit(FF_EFFECT_STARTED, &state->flags);
-
-		ml_play_effects(ml);
 	}
 
+	ml_play_effects(ml);
+
 	return 0;
 }
 
diff --git a/drivers/input/input-polldev.c b/drivers/input/input-polldev.c
index 0d3ce7a50fb1..aa6713b4a988 100644
--- a/drivers/input/input-polldev.c
+++ b/drivers/input/input-polldev.c
@@ -56,14 +56,10 @@ static void input_polldev_stop_workqueue(void)
 	mutex_unlock(&polldev_mutex);
 }
 
-static void input_polled_device_work(struct work_struct *work)
+static void input_polldev_queue_work(struct input_polled_dev *dev)
 {
-	struct input_polled_dev *dev =
-		container_of(work, struct input_polled_dev, work.work);
 	unsigned long delay;
 
-	dev->poll(dev);
-
 	delay = msecs_to_jiffies(dev->poll_interval);
 	if (delay >= HZ)
 		delay = round_jiffies_relative(delay);
@@ -71,6 +67,15 @@ static void input_polled_device_work(struct work_struct *work)
 	queue_delayed_work(polldev_wq, &dev->work, delay);
 }
 
+static void input_polled_device_work(struct work_struct *work)
+{
+	struct input_polled_dev *dev =
+		container_of(work, struct input_polled_dev, work.work);
+
+	dev->poll(dev);
+	input_polldev_queue_work(dev);
+}
+
 static int input_open_polled_device(struct input_dev *input)
 {
 	struct input_polled_dev *dev = input_get_drvdata(input);
@@ -80,11 +85,12 @@ static int input_open_polled_device(struct input_dev *input)
 	if (error)
 		return error;
 
-	if (dev->flush)
-		dev->flush(dev);
+	if (dev->open)
+		dev->open(dev);
 
-	queue_delayed_work(polldev_wq, &dev->work,
-			   msecs_to_jiffies(dev->poll_interval));
+	/* Only start polling if polling is enabled */
+	if (dev->poll_interval > 0)
+		queue_delayed_work(polldev_wq, &dev->work, 0);
 
 	return 0;
 }
@@ -95,8 +101,88 @@ static void input_close_polled_device(struct input_dev *input)
 
 	cancel_delayed_work_sync(&dev->work);
 	input_polldev_stop_workqueue();
+
+	if (dev->close)
+		dev->close(dev);
 }
 
+/* SYSFS interface */
+
+static ssize_t input_polldev_get_poll(struct device *dev,
+				      struct device_attribute *attr, char *buf)
+{
+	struct input_polled_dev *polldev = dev_get_drvdata(dev);
+
+	return sprintf(buf, "%d\n", polldev->poll_interval);
+}
+
+static ssize_t input_polldev_set_poll(struct device *dev,
+				struct device_attribute *attr, const char *buf,
+				size_t count)
+{
+	struct input_polled_dev *polldev = dev_get_drvdata(dev);
+	struct input_dev *input = polldev->input;
+	unsigned long interval;
+
+	if (strict_strtoul(buf, 0, &interval))
+		return -EINVAL;
+
+	if (interval < polldev->poll_interval_min)
+		return -EINVAL;
+
+	if (interval > polldev->poll_interval_max)
+		return -EINVAL;
+
+	mutex_lock(&input->mutex);
+
+	polldev->poll_interval = interval;
+
+	if (input->users) {
+		cancel_delayed_work_sync(&polldev->work);
+		if (polldev->poll_interval > 0)
+			input_polldev_queue_work(polldev);
+	}
+
+	mutex_unlock(&input->mutex);
+
+	return count;
+}
+
+static DEVICE_ATTR(poll, S_IRUGO | S_IWUSR, input_polldev_get_poll,
+					    input_polldev_set_poll);
+
+
+static ssize_t input_polldev_get_max(struct device *dev,
+				     struct device_attribute *attr, char *buf)
+{
+	struct input_polled_dev *polldev = dev_get_drvdata(dev);
+
+	return sprintf(buf, "%d\n", polldev->poll_interval_max);
+}
+
+static DEVICE_ATTR(max, S_IRUGO, input_polldev_get_max, NULL);
+
+static ssize_t input_polldev_get_min(struct device *dev,
+				     struct device_attribute *attr, char *buf)
+{
+	struct input_polled_dev *polldev = dev_get_drvdata(dev);
+
+	return sprintf(buf, "%d\n", polldev->poll_interval_min);
+}
+
+static DEVICE_ATTR(min, S_IRUGO, input_polldev_get_min, NULL);
+
+static struct attribute *sysfs_attrs[] = {
+	&dev_attr_poll.attr,
+	&dev_attr_max.attr,
+	&dev_attr_min.attr,
+	NULL
+};
+
+static struct attribute_group input_polldev_attribute_group = {
+	.attrs = sysfs_attrs
+};
+
 /**
  * input_allocate_polled_device - allocated memory polled device
  *
@@ -126,7 +212,7 @@ EXPORT_SYMBOL(input_allocate_polled_device);
  * @dev: device to free
  *
  * The function frees memory allocated for polling device and drops
- * reference to the associated input device (if present).
+ * reference to the associated input device.
  */
 void input_free_polled_device(struct input_polled_dev *dev)
 {
@@ -150,15 +236,38 @@ EXPORT_SYMBOL(input_free_polled_device);
 int input_register_polled_device(struct input_polled_dev *dev)
 {
 	struct input_dev *input = dev->input;
+	int error;
 
 	input_set_drvdata(input, dev);
 	INIT_DELAYED_WORK(&dev->work, input_polled_device_work);
 	if (!dev->poll_interval)
 		dev->poll_interval = 500;
+	if (!dev->poll_interval_max)
+		dev->poll_interval_max = dev->poll_interval;
 	input->open = input_open_polled_device;
 	input->close = input_close_polled_device;
 
-	return input_register_device(input);
+	error = input_register_device(input);
+	if (error)
+		return error;
+
+	error = sysfs_create_group(&input->dev.kobj,
+				   &input_polldev_attribute_group);
+	if (error) {
+		input_unregister_device(input);
+		return error;
+	}
+
+	/*
+	 * Take extra reference to the underlying input device so
+	 * that it survives call to input_unregister_polled_device()
+	 * and is deleted only after input_free_polled_device()
+	 * has been invoked. This is needed to ease task of freeing
+	 * sparse keymaps.
+	 */
+	input_get_device(input);
+
+	return 0;
 }
 EXPORT_SYMBOL(input_register_polled_device);
 
@@ -169,13 +278,13 @@ EXPORT_SYMBOL(input_register_polled_device);
  * The function unregisters previously registered polled input
  * device from input layer. Polling is stopped and device is
  * ready to be freed with call to input_free_polled_device().
- * Callers should not attempt to access dev->input pointer
- * after calling this function.
  */
 void input_unregister_polled_device(struct input_polled_dev *dev)
 {
+	sysfs_remove_group(&dev->input->dev.kobj,
+			   &input_polldev_attribute_group);
+
 	input_unregister_device(dev->input);
-	dev->input = NULL;
 }
 EXPORT_SYMBOL(input_unregister_polled_device);
 
diff --git a/drivers/input/input.c b/drivers/input/input.c
index 2266ecbfbc01..30b503b8d67b 100644
--- a/drivers/input/input.c
+++ b/drivers/input/input.c
@@ -24,6 +24,7 @@
 #include <linux/mutex.h>
 #include <linux/rcupdate.h>
 #include <linux/smp_lock.h>
+#include "input-compat.h"
 
 MODULE_AUTHOR("Vojtech Pavlik <vojtech@suse.cz>");
 MODULE_DESCRIPTION("Input core");
@@ -296,9 +297,15 @@ static void input_handle_event(struct input_dev *dev,
  * @value: value of the event
  *
  * This function should be used by drivers implementing various input
- * devices. See also input_inject_event().
+ * devices to report input events. See also input_inject_event().
+ *
+ * NOTE: input_event() may be safely used right after input device was
+ * allocated with input_allocate_device(), even before it is registered
+ * with input_register_device(), but the event will not reach any of the
+ * input handlers. Such early invocation of input_event() may be used
+ * to 'seed' initial state of a switch or initial position of absolute
+ * axis, etc.
  */
-
 void input_event(struct input_dev *dev,
 		 unsigned int type, unsigned int code, int value)
 {
@@ -758,6 +765,40 @@ static int input_attach_handler(struct input_dev *dev, struct input_handler *han
 	return error;
 }
 
+#ifdef CONFIG_COMPAT
+
+static int input_bits_to_string(char *buf, int buf_size,
+				unsigned long bits, bool skip_empty)
+{
+	int len = 0;
+
+	if (INPUT_COMPAT_TEST) {
+		u32 dword = bits >> 32;
+		if (dword || !skip_empty)
+			len += snprintf(buf, buf_size, "%x ", dword);
+
+		dword = bits & 0xffffffffUL;
+		if (dword || !skip_empty || len)
+			len += snprintf(buf + len, max(buf_size - len, 0),
+					"%x", dword);
+	} else {
+		if (bits || !skip_empty)
+			len += snprintf(buf, buf_size, "%lx", bits);
+	}
+
+	return len;
+}
+
+#else /* !CONFIG_COMPAT */
+
+static int input_bits_to_string(char *buf, int buf_size,
+				unsigned long bits, bool skip_empty)
+{
+	return bits || !skip_empty ?
+		snprintf(buf, buf_size, "%lx", bits) : 0;
+}
+
+#endif
 
 #ifdef CONFIG_PROC_FS
 
@@ -826,14 +867,25 @@ static void input_seq_print_bitmap(struct seq_file *seq, const char *name,
 				   unsigned long *bitmap, int max)
 {
 	int i;
-
-	for (i = BITS_TO_LONGS(max) - 1; i > 0; i--)
-		if (bitmap[i])
-			break;
+	bool skip_empty = true;
+	char buf[18];
 
 	seq_printf(seq, "B: %s=", name);
-	for (; i >= 0; i--)
-		seq_printf(seq, "%lx%s", bitmap[i], i > 0 ? " " : "");
+
+	for (i = BITS_TO_LONGS(max) - 1; i >= 0; i--) {
+		if (input_bits_to_string(buf, sizeof(buf),
+					 bitmap[i], skip_empty)) {
+			skip_empty = false;
+			seq_printf(seq, "%s%s", buf, i > 0 ? " " : "");
+		}
+	}
+
+	/*
+	 * If no output was produced print a single 0.
+	 */
+	if (skip_empty)
+		seq_puts(seq, "0");
+
 	seq_putc(seq, '\n');
 }
 
@@ -1122,14 +1174,23 @@ static int input_print_bitmap(char *buf, int buf_size, unsigned long *bitmap,
 {
 	int i;
 	int len = 0;
+	bool skip_empty = true;
+
+	for (i = BITS_TO_LONGS(max) - 1; i >= 0; i--) {
+		len += input_bits_to_string(buf + len, max(buf_size - len, 0),
+					    bitmap[i], skip_empty);
+		if (len) {
+			skip_empty = false;
+			if (i > 0)
+				len += snprintf(buf + len, max(buf_size - len, 0), " ");
+		}
+	}
 
-	for (i = BITS_TO_LONGS(max) - 1; i > 0; i--)
-		if (bitmap[i])
-			break;
-
-	for (; i >= 0; i--)
-		len += snprintf(buf + len, max(buf_size - len, 0),
-				"%lx%s", bitmap[i], i > 0 ? " " : "");
+	/*
+	 * If no output was produced print a single 0.
+	 */
+	if (len == 0)
+		len = snprintf(buf, buf_size, "%d", 0);
 
 	if (add_cr)
 		len += snprintf(buf + len, max(buf_size - len, 0), "\n");
@@ -1144,7 +1205,8 @@ static ssize_t input_dev_show_cap_##bm(struct device *dev,		\
 {									\
 	struct input_dev *input_dev = to_input_dev(dev);		\
 	int len = input_print_bitmap(buf, PAGE_SIZE,			\
-				     input_dev->bm##bit, ev##_MAX, 1);	\
+				     input_dev->bm##bit, ev##_MAX,	\
+				     true);				\
 	return min_t(int, len, PAGE_SIZE);				\
 }									\
 static DEVICE_ATTR(bm, S_IRUGO, input_dev_show_cap_##bm, NULL)
@@ -1208,7 +1270,7 @@ static int input_add_uevent_bm_var(struct kobj_uevent_env *env,
 
 	len = input_print_bitmap(&env->buf[env->buflen - 1],
 				 sizeof(env->buf) - env->buflen,
-				 bitmap, max, 0);
+				 bitmap, max, false);
 	if (len >= (sizeof(env->buf) - env->buflen))
 		return -ENOMEM;
 
@@ -1658,6 +1720,38 @@ void input_unregister_handler(struct input_handler *handler)
 EXPORT_SYMBOL(input_unregister_handler);
 
 /**
+ * input_handler_for_each_handle - handle iterator
+ * @handler: input handler to iterate
+ * @data: data for the callback
+ * @fn: function to be called for each handle
+ *
+ * Iterate over @bus's list of devices, and call @fn for each, passing
+ * it @data and stop when @fn returns a non-zero value. The function is
+ * using RCU to traverse the list and therefore may be usind in atonic
+ * contexts. The @fn callback is invoked from RCU critical section and
+ * thus must not sleep.
+ */
+int input_handler_for_each_handle(struct input_handler *handler, void *data,
+				  int (*fn)(struct input_handle *, void *))
+{
+	struct input_handle *handle;
+	int retval = 0;
+
+	rcu_read_lock();
+
+	list_for_each_entry_rcu(handle, &handler->h_list, h_node) {
+		retval = fn(handle, data);
+		if (retval)
+			break;
+	}
+
+	rcu_read_unlock();
+
+	return retval;
+}
+EXPORT_SYMBOL(input_handler_for_each_handle);
+
+/**
  * input_register_handle - register a new input handle
  * @handle: handle to register
  *
@@ -1690,7 +1784,7 @@ int input_register_handle(struct input_handle *handle)
 	 * we can't be racing with input_unregister_handle()
 	 * and so separate lock is not needed here.
 	 */
-	list_add_tail(&handle->h_node, &handler->h_list);
+	list_add_tail_rcu(&handle->h_node, &handler->h_list);
 
 	if (handler->start)
 		handler->start(handle);
@@ -1713,7 +1807,7 @@ void input_unregister_handle(struct input_handle *handle)
 {
 	struct input_dev *dev = handle->dev;
 
-	list_del_init(&handle->h_node);
+	list_del_rcu(&handle->h_node);
 
 	/*
 	 * Take dev->mutex to prevent race with input_release_device().
@@ -1721,6 +1815,7 @@ void input_unregister_handle(struct input_handle *handle)
 	mutex_lock(&dev->mutex);
 	list_del_rcu(&handle->d_node);
 	mutex_unlock(&dev->mutex);
+
 	synchronize_rcu();
 }
 EXPORT_SYMBOL(input_unregister_handle);
diff --git a/drivers/input/joystick/gf2k.c b/drivers/input/joystick/gf2k.c
index 67c207f5b1a1..45ac70eae0aa 100644
--- a/drivers/input/joystick/gf2k.c
+++ b/drivers/input/joystick/gf2k.c
@@ -277,7 +277,7 @@ static int gf2k_connect(struct gameport *gameport, struct gameport_driver *drv)
 	}
 
 #ifdef RESET_WORKS
-	if ((gf2k->id != (GB(19,2,0) | GB(15,3,2) | GB(12,3,5))) ||
+	if ((gf2k->id != (GB(19,2,0) | GB(15,3,2) | GB(12,3,5))) &&
 	    (gf2k->id != (GB(31,2,0) | GB(27,3,2) | GB(24,3,5)))) {
 		err = -ENODEV;
 		goto fail2;
diff --git a/drivers/input/joystick/iforce/iforce-main.c b/drivers/input/joystick/iforce/iforce-main.c
index f6c688cae334..b1edd778639c 100644
--- a/drivers/input/joystick/iforce/iforce-main.c
+++ b/drivers/input/joystick/iforce/iforce-main.c
@@ -210,7 +210,7 @@ static int iforce_open(struct input_dev *dev)
 	return 0;
 }
 
-static void iforce_release(struct input_dev *dev)
+static void iforce_close(struct input_dev *dev)
 {
 	struct iforce *iforce = input_get_drvdata(dev);
 	int i;
@@ -228,30 +228,17 @@ static void iforce_release(struct input_dev *dev)
 
 		/* Disable force feedback playback */
 		iforce_send_packet(iforce, FF_CMD_ENABLE, "\001");
+		/* Wait for the command to complete */
+		wait_event_interruptible(iforce->wait,
+			!test_bit(IFORCE_XMIT_RUNNING, iforce->xmit_flags));
 	}
 
 	switch (iforce->bus) {
 #ifdef CONFIG_JOYSTICK_IFORCE_USB
-		case IFORCE_USB:
-			usb_kill_urb(iforce->irq);
-
-			/* The device was unplugged before the file
-			 * was released */
-			if (iforce->usbdev == NULL) {
-				iforce_delete_device(iforce);
-				kfree(iforce);
-			}
-		break;
-#endif
-	}
-}
-
-void iforce_delete_device(struct iforce *iforce)
-{
-	switch (iforce->bus) {
-#ifdef CONFIG_JOYSTICK_IFORCE_USB
 	case IFORCE_USB:
-		iforce_usb_delete(iforce);
+		usb_kill_urb(iforce->irq);
+		usb_kill_urb(iforce->out);
+		usb_kill_urb(iforce->ctrl);
 		break;
 #endif
 #ifdef CONFIG_JOYSTICK_IFORCE_232
@@ -303,7 +290,7 @@ int iforce_init_device(struct iforce *iforce)
 
 	input_dev->name = "Unknown I-Force device";
 	input_dev->open = iforce_open;
-	input_dev->close = iforce_release;
+	input_dev->close = iforce_close;
 
 /*
  * On-device memory allocation.
diff --git a/drivers/input/joystick/iforce/iforce-usb.c b/drivers/input/joystick/iforce/iforce-usb.c
index 9f289d8f52c6..b41303d3ec54 100644
--- a/drivers/input/joystick/iforce/iforce-usb.c
+++ b/drivers/input/joystick/iforce/iforce-usb.c
@@ -109,6 +109,7 @@ static void iforce_usb_out(struct urb *urb)
 	struct iforce *iforce = urb->context;
 
 	if (urb->status) {
+		clear_bit(IFORCE_XMIT_RUNNING, iforce->xmit_flags);
 		dbg("urb->status %d, exiting", urb->status);
 		return;
 	}
@@ -186,33 +187,19 @@ fail:
 	return err;
 }
 
-/* Called by iforce_delete() */
-void iforce_usb_delete(struct iforce* iforce)
-{
-	usb_kill_urb(iforce->irq);
-	usb_kill_urb(iforce->out);
-	usb_kill_urb(iforce->ctrl);
-
-	usb_free_urb(iforce->irq);
-	usb_free_urb(iforce->out);
-	usb_free_urb(iforce->ctrl);
-}
-
 static void iforce_usb_disconnect(struct usb_interface *intf)
 {
 	struct iforce *iforce = usb_get_intfdata(intf);
-	int open = 0; /* FIXME! iforce->dev.handle->open; */
 
 	usb_set_intfdata(intf, NULL);
-	if (iforce) {
-		iforce->usbdev = NULL;
-		input_unregister_device(iforce->dev);
 
-		if (!open) {
-			iforce_delete_device(iforce);
-			kfree(iforce);
-		}
-	}
+	input_unregister_device(iforce->dev);
+
+	usb_free_urb(iforce->irq);
+	usb_free_urb(iforce->out);
+	usb_free_urb(iforce->ctrl);
+
+	kfree(iforce);
 }
 
 static struct usb_device_id iforce_usb_ids [] = {
diff --git a/drivers/input/joystick/iforce/iforce.h b/drivers/input/joystick/iforce/iforce.h
index f2d91f4028ca..9f494b75848a 100644
--- a/drivers/input/joystick/iforce/iforce.h
+++ b/drivers/input/joystick/iforce/iforce.h
@@ -150,11 +150,9 @@ void iforce_serial_xmit(struct iforce *iforce);
 
 /* iforce-usb.c */
 void iforce_usb_xmit(struct iforce *iforce);
-void iforce_usb_delete(struct iforce *iforce);
 
 /* iforce-main.c */
 int iforce_init_device(struct iforce *iforce);
-void iforce_delete_device(struct iforce *iforce);
 
 /* iforce-packets.c */
 int iforce_control_playback(struct iforce*, u16 id, unsigned int);
diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
index 79e3edcced1a..8a28fb7846dc 100644
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -125,6 +125,7 @@ static const struct xpad_device {
 	{ 0x0738, 0x4540, "Mad Catz Beat Pad", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX },
 	{ 0x0738, 0x4556, "Mad Catz Lynx Wireless Controller", MAP_DPAD_TO_AXES, XTYPE_XBOX },
 	{ 0x0738, 0x4716, "Mad Catz Wired Xbox 360 Controller", MAP_DPAD_TO_AXES, XTYPE_XBOX360 },
+	{ 0x0738, 0x4738, "Mad Catz Wired Xbox 360 Controller (SFIV)", MAP_DPAD_TO_AXES, XTYPE_XBOX360 },
 	{ 0x0738, 0x6040, "Mad Catz Beat Pad Pro", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX },
 	{ 0x0c12, 0x8802, "Zeroplus Xbox Controller", MAP_DPAD_TO_AXES, XTYPE_XBOX },
 	{ 0x0c12, 0x880a, "Pelican Eclipse PL-2023", MAP_DPAD_TO_AXES, XTYPE_XBOX },
@@ -146,6 +147,7 @@ static const struct xpad_device {
 	{ 0x146b, 0x0601, "BigBen Interactive XBOX 360 Controller", MAP_DPAD_TO_AXES, XTYPE_XBOX360 },
 	{ 0x045e, 0x028e, "Microsoft X-Box 360 pad", MAP_DPAD_TO_AXES, XTYPE_XBOX360 },
 	{ 0x1bad, 0x0003, "Harmonix Rock Band Drumkit", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 },
+	{ 0x0f0d, 0x0016, "Hori Real Arcade Pro.EX", MAP_DPAD_TO_AXES, XTYPE_XBOX360 },
 	{ 0xffff, 0xffff, "Chinese-made Xbox Controller", MAP_DPAD_TO_AXES, XTYPE_XBOX },
 	{ 0x0000, 0x0000, "Generic X-Box pad", MAP_DPAD_UNKNOWN, XTYPE_UNKNOWN }
 };
@@ -212,6 +214,7 @@ static struct usb_device_id xpad_table [] = {
 	XPAD_XBOX360_VENDOR(0x1430),		/* RedOctane X-Box 360 controllers */
 	XPAD_XBOX360_VENDOR(0x146b),		/* BigBen Interactive Controllers */
 	XPAD_XBOX360_VENDOR(0x1bad),		/* Rock Band Drums */
+	XPAD_XBOX360_VENDOR(0x0f0d),            /* Hori Controllers */
 	{ }
 };
 
@@ -443,7 +446,7 @@ static void xpad_irq_in(struct urb *urb)
 	}
 
 exit:
-	retval = usb_submit_urb (urb, GFP_ATOMIC);
+	retval = usb_submit_urb(urb, GFP_ATOMIC);
 	if (retval)
 		err ("%s - usb_submit_urb failed with result %d",
 		     __func__, retval);
@@ -568,7 +571,7 @@ static int xpad_play_effect(struct input_dev *dev, void *data,
 		xpad->odata[6] = 0x00;
 		xpad->odata[7] = 0x00;
 		xpad->irq_out->transfer_buffer_length = 8;
-		usb_submit_urb(xpad->irq_out, GFP_KERNEL);
+		usb_submit_urb(xpad->irq_out, GFP_ATOMIC);
 	}
 
 	return 0;
diff --git a/drivers/input/keyboard/Kconfig b/drivers/input/keyboard/Kconfig
index ee98b1bc5d89..02c836e11813 100644
--- a/drivers/input/keyboard/Kconfig
+++ b/drivers/input/keyboard/Kconfig
@@ -24,6 +24,16 @@ config KEYBOARD_AAED2000
 	  To compile this driver as a module, choose M here: the
 	  module will be called aaed2000_kbd.
 
+config KEYBOARD_ADP5520
+	tristate "Keypad Support for ADP5520 PMIC"
+	depends on PMIC_ADP5520
+	help
+	  This option enables support for the keypad scan matrix
+	  on Analog Devices ADP5520 PMICs.
+
+	  To compile this driver as a module, choose M here: the module will
+	  be called adp5520-keys.
+
 config KEYBOARD_ADP5588
 	tristate "ADP5588 I2C QWERTY Keypad and IO Expander"
 	depends on I2C
@@ -361,6 +371,16 @@ config KEYBOARD_SH_KEYSC
 	  To compile this driver as a module, choose M here: the
 	  module will be called sh_keysc.
 
+config KEYBOARD_DAVINCI
+	tristate "TI DaVinci Key Scan"
+	depends on ARCH_DAVINCI_DM365
+	help
+	  Say Y to enable keypad module support for the TI DaVinci
+	  platforms (DM365).
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called davinci_keyscan.
+
 config KEYBOARD_OMAP
 	tristate "TI OMAP keypad support"
 	depends on (ARCH_OMAP1 || ARCH_OMAP2)
diff --git a/drivers/input/keyboard/Makefile b/drivers/input/keyboard/Makefile
index babad5e58b77..78654ef65206 100644
--- a/drivers/input/keyboard/Makefile
+++ b/drivers/input/keyboard/Makefile
@@ -5,12 +5,14 @@
 # Each configuration option enables a list of files.
 
 obj-$(CONFIG_KEYBOARD_AAED2000)		+= aaed2000_kbd.o
+obj-$(CONFIG_KEYBOARD_ADP5520)		+= adp5520-keys.o
 obj-$(CONFIG_KEYBOARD_ADP5588)		+= adp5588-keys.o
 obj-$(CONFIG_KEYBOARD_AMIGA)		+= amikbd.o
 obj-$(CONFIG_KEYBOARD_ATARI)		+= atakbd.o
 obj-$(CONFIG_KEYBOARD_ATKBD)		+= atkbd.o
 obj-$(CONFIG_KEYBOARD_BFIN)		+= bf54x-keys.o
 obj-$(CONFIG_KEYBOARD_CORGI)		+= corgikbd.o
+obj-$(CONFIG_KEYBOARD_DAVINCI)		+= davinci_keyscan.o
 obj-$(CONFIG_KEYBOARD_EP93XX)		+= ep93xx_keypad.o
 obj-$(CONFIG_KEYBOARD_GPIO)		+= gpio_keys.o
 obj-$(CONFIG_KEYBOARD_HIL)		+= hil_kbd.o
diff --git a/drivers/input/keyboard/adp5520-keys.c b/drivers/input/keyboard/adp5520-keys.c
new file mode 100644
index 000000000000..a7ba27fb4109
--- /dev/null
+++ b/drivers/input/keyboard/adp5520-keys.c
@@ -0,0 +1,220 @@
+/*
+ * Keypad driver for Analog Devices ADP5520 MFD PMICs
+ *
+ * Copyright 2009 Analog Devices Inc.
+ *
+ * Licensed under the GPL-2 or later.
+ */
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/platform_device.h>
+#include <linux/input.h>
+#include <linux/mfd/adp5520.h>
+
+struct adp5520_keys {
+	struct input_dev *input;
+	struct notifier_block notifier;
+	struct device *master;
+	unsigned short keycode[ADP5520_KEYMAPSIZE];
+};
+
+static void adp5520_keys_report_event(struct adp5520_keys *dev,
+					unsigned short keymask, int value)
+{
+	int i;
+
+	for (i = 0; i < ADP5520_MAXKEYS; i++)
+		if (keymask & (1 << i))
+			input_report_key(dev->input, dev->keycode[i], value);
+
+	input_sync(dev->input);
+}
+
+static int adp5520_keys_notifier(struct notifier_block *nb,
+				 unsigned long event, void *data)
+{
+	struct adp5520_keys *dev;
+	uint8_t reg_val_lo, reg_val_hi;
+	unsigned short keymask;
+
+	dev = container_of(nb, struct adp5520_keys, notifier);
+
+	if (event & ADP5520_KP_INT) {
+		adp5520_read(dev->master, ADP5520_KP_INT_STAT_1, &reg_val_lo);
+		adp5520_read(dev->master, ADP5520_KP_INT_STAT_2, &reg_val_hi);
+
+		keymask = (reg_val_hi << 8) | reg_val_lo;
+		/* Read twice to clear */
+		adp5520_read(dev->master, ADP5520_KP_INT_STAT_1, &reg_val_lo);
+		adp5520_read(dev->master, ADP5520_KP_INT_STAT_2, &reg_val_hi);
+		keymask |= (reg_val_hi << 8) | reg_val_lo;
+		adp5520_keys_report_event(dev, keymask, 1);
+	}
+
+	if (event & ADP5520_KR_INT) {
+		adp5520_read(dev->master, ADP5520_KR_INT_STAT_1, &reg_val_lo);
+		adp5520_read(dev->master, ADP5520_KR_INT_STAT_2, &reg_val_hi);
+
+		keymask = (reg_val_hi << 8) | reg_val_lo;
+		/* Read twice to clear */
+		adp5520_read(dev->master, ADP5520_KR_INT_STAT_1, &reg_val_lo);
+		adp5520_read(dev->master, ADP5520_KR_INT_STAT_2, &reg_val_hi);
+		keymask |= (reg_val_hi << 8) | reg_val_lo;
+		adp5520_keys_report_event(dev, keymask, 0);
+	}
+
+	return 0;
+}
+
+static int __devinit adp5520_keys_probe(struct platform_device *pdev)
+{
+	struct adp5520_keys_platform_data *pdata = pdev->dev.platform_data;
+	struct input_dev *input;
+	struct adp5520_keys *dev;
+	int ret, i;
+	unsigned char en_mask, ctl_mask = 0;
+
+	if (pdev->id != ID_ADP5520) {
+		dev_err(&pdev->dev, "only ADP5520 supports Keypad\n");
+		return -EINVAL;
+	}
+
+	if (pdata == NULL) {
+		dev_err(&pdev->dev, "missing platform data\n");
+		return -EINVAL;
+	}
+
+	if (!(pdata->rows_en_mask && pdata->cols_en_mask))
+		return -EINVAL;
+
+	dev = kzalloc(sizeof(*dev), GFP_KERNEL);
+	if (dev == NULL) {
+		dev_err(&pdev->dev, "failed to alloc memory\n");
+		return -ENOMEM;
+	}
+
+	input = input_allocate_device();
+	if (!input) {
+		ret = -ENOMEM;
+		goto err;
+	}
+
+	dev->master = pdev->dev.parent;
+	dev->input = input;
+
+	input->name = pdev->name;
+	input->phys = "adp5520-keys/input0";
+	input->dev.parent = &pdev->dev;
+
+	input_set_drvdata(input, dev);
+
+	input->id.bustype = BUS_I2C;
+	input->id.vendor = 0x0001;
+	input->id.product = 0x5520;
+	input->id.version = 0x0001;
+
+	input->keycodesize = sizeof(dev->keycode[0]);
+	input->keycodemax = pdata->keymapsize;
+	input->keycode = dev->keycode;
+
+	memcpy(dev->keycode, pdata->keymap,
+		pdata->keymapsize * input->keycodesize);
+
+	/* setup input device */
+	__set_bit(EV_KEY, input->evbit);
+
+	if (pdata->repeat)
+		__set_bit(EV_REP, input->evbit);
+
+	for (i = 0; i < input->keycodemax; i++)
+		__set_bit(dev->keycode[i], input->keybit);
+	__clear_bit(KEY_RESERVED, input->keybit);
+
+	ret = input_register_device(input);
+	if (ret) {
+		dev_err(&pdev->dev, "unable to register input device\n");
+		goto err;
+	}
+
+	en_mask = pdata->rows_en_mask | pdata->cols_en_mask;
+
+	ret = adp5520_set_bits(dev->master, ADP5520_GPIO_CFG_1, en_mask);
+
+	if (en_mask & ADP5520_COL_C3)
+		ctl_mask |= ADP5520_C3_MODE;
+
+	if (en_mask & ADP5520_ROW_R3)
+		ctl_mask |= ADP5520_R3_MODE;
+
+	if (ctl_mask)
+		ret |= adp5520_set_bits(dev->master, ADP5520_LED_CONTROL,
+			ctl_mask);
+
+	ret |= adp5520_set_bits(dev->master, ADP5520_GPIO_PULLUP,
+		pdata->rows_en_mask);
+
+	if (ret) {
+		dev_err(&pdev->dev, "failed to write\n");
+		ret = -EIO;
+		goto err1;
+	}
+
+	dev->notifier.notifier_call = adp5520_keys_notifier;
+	ret = adp5520_register_notifier(dev->master, &dev->notifier,
+			ADP5520_KP_IEN | ADP5520_KR_IEN);
+	if (ret) {
+		dev_err(&pdev->dev, "failed to register notifier\n");
+		goto err1;
+	}
+
+	platform_set_drvdata(pdev, dev);
+	return 0;
+
+err1:
+	input_unregister_device(input);
+	input = NULL;
+err:
+	input_free_device(input);
+	kfree(dev);
+	return ret;
+}
+
+static int __devexit adp5520_keys_remove(struct platform_device *pdev)
+{
+	struct adp5520_keys *dev = platform_get_drvdata(pdev);
+
+	adp5520_unregister_notifier(dev->master, &dev->notifier,
+				ADP5520_KP_IEN | ADP5520_KR_IEN);
+
+	input_unregister_device(dev->input);
+	kfree(dev);
+	return 0;
+}
+
+static struct platform_driver adp5520_keys_driver = {
+	.driver	= {
+		.name	= "adp5520-keys",
+		.owner	= THIS_MODULE,
+	},
+	.probe		= adp5520_keys_probe,
+	.remove		= __devexit_p(adp5520_keys_remove),
+};
+
+static int __init adp5520_keys_init(void)
+{
+	return platform_driver_register(&adp5520_keys_driver);
+}
+module_init(adp5520_keys_init);
+
+static void __exit adp5520_keys_exit(void)
+{
+	platform_driver_unregister(&adp5520_keys_driver);
+}
+module_exit(adp5520_keys_exit);
+
+MODULE_AUTHOR("Michael Hennerich <hennerich@blackfin.uclinux.org>");
+MODULE_DESCRIPTION("Keys ADP5520 Driver");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:adp5520-keys");
diff --git a/drivers/input/keyboard/adp5588-keys.c b/drivers/input/keyboard/adp5588-keys.c
index d48c808d5928..1edb596d927b 100644
--- a/drivers/input/keyboard/adp5588-keys.c
+++ b/drivers/input/keyboard/adp5588-keys.c
@@ -319,7 +319,7 @@ static int adp5588_resume(struct device *dev)
 	return 0;
 }
 
-static struct dev_pm_ops adp5588_dev_pm_ops = {
+static const struct dev_pm_ops adp5588_dev_pm_ops = {
 	.suspend = adp5588_suspend,
 	.resume  = adp5588_resume,
 };
diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
index 28e6110d1ff8..7b4056292eaf 100644
--- a/drivers/input/keyboard/atkbd.c
+++ b/drivers/input/keyboard/atkbd.c
@@ -134,7 +134,8 @@ static const unsigned short atkbd_unxlate_table[128] = {
 #define ATKBD_CMD_GETID		0x02f2
 #define ATKBD_CMD_SETREP	0x10f3
 #define ATKBD_CMD_ENABLE	0x00f4
-#define ATKBD_CMD_RESET_DIS	0x00f5
+#define ATKBD_CMD_RESET_DIS	0x00f5	/* Reset to defaults and disable */
+#define ATKBD_CMD_RESET_DEF	0x00f6	/* Reset to defaults */
 #define ATKBD_CMD_SETALL_MBR	0x00fa
 #define ATKBD_CMD_RESET_BAT	0x02ff
 #define ATKBD_CMD_RESEND	0x00fe
@@ -224,8 +225,10 @@ struct atkbd {
 
 	struct delayed_work event_work;
 	unsigned long event_jiffies;
-	struct mutex event_mutex;
 	unsigned long event_mask;
+
+	/* Serializes reconnect(), attr->set() and event work */
+	struct mutex mutex;
 };
 
 /*
@@ -576,7 +579,7 @@ static void atkbd_event_work(struct work_struct *work)
 {
 	struct atkbd *atkbd = container_of(work, struct atkbd, event_work.work);
 
-	mutex_lock(&atkbd->event_mutex);
+	mutex_lock(&atkbd->mutex);
 
 	if (!atkbd->enabled) {
 		/*
@@ -595,7 +598,7 @@ static void atkbd_event_work(struct work_struct *work)
 			atkbd_set_repeat_rate(atkbd);
 	}
 
-	mutex_unlock(&atkbd->event_mutex);
+	mutex_unlock(&atkbd->mutex);
 }
 
 /*
@@ -611,7 +614,7 @@ static void atkbd_schedule_event_work(struct atkbd *atkbd, int event_bit)
 
 	atkbd->event_jiffies = jiffies;
 	set_bit(event_bit, &atkbd->event_mask);
-	wmb();
+	mb();
 	schedule_delayed_work(&atkbd->event_work, delay);
 }
 
@@ -836,7 +839,7 @@ static void atkbd_cleanup(struct serio *serio)
 	struct atkbd *atkbd = serio_get_drvdata(serio);
 
 	atkbd_disable(atkbd);
-	ps2_command(&atkbd->ps2dev, NULL, ATKBD_CMD_RESET_BAT);
+	ps2_command(&atkbd->ps2dev, NULL, ATKBD_CMD_RESET_DEF);
 }
 
 
@@ -848,13 +851,20 @@ static void atkbd_disconnect(struct serio *serio)
 {
 	struct atkbd *atkbd = serio_get_drvdata(serio);
 
+	sysfs_remove_group(&serio->dev.kobj, &atkbd_attribute_group);
+
 	atkbd_disable(atkbd);
 
-	/* make sure we don't have a command in flight */
+	input_unregister_device(atkbd->dev);
+
+	/*
+	 * Make sure we don't have a command in flight.
+	 * Note that since atkbd->enabled is false event work will keep
+	 * rescheduling itself until it gets canceled and will not try
+	 * accessing freed input device or serio port.
+	 */
 	cancel_delayed_work_sync(&atkbd->event_work);
 
-	sysfs_remove_group(&serio->dev.kobj, &atkbd_attribute_group);
-	input_unregister_device(atkbd->dev);
 	serio_close(serio);
 	serio_set_drvdata(serio, NULL);
 	kfree(atkbd);
@@ -1086,7 +1096,7 @@ static int atkbd_connect(struct serio *serio, struct serio_driver *drv)
 	atkbd->dev = dev;
 	ps2_init(&atkbd->ps2dev, serio);
 	INIT_DELAYED_WORK(&atkbd->event_work, atkbd_event_work);
-	mutex_init(&atkbd->event_mutex);
+	mutex_init(&atkbd->mutex);
 
 	switch (serio->id.type) {
 
@@ -1159,19 +1169,23 @@ static int atkbd_reconnect(struct serio *serio)
 {
 	struct atkbd *atkbd = serio_get_drvdata(serio);
 	struct serio_driver *drv = serio->drv;
+	int retval = -1;
 
 	if (!atkbd || !drv) {
 		printk(KERN_DEBUG "atkbd: reconnect request, but serio is disconnected, ignoring...\n");
 		return -1;
 	}
 
+	mutex_lock(&atkbd->mutex);
+
 	atkbd_disable(atkbd);
 
 	if (atkbd->write) {
 		if (atkbd_probe(atkbd))
-			return -1;
+			goto out;
+
 		if (atkbd->set != atkbd_select_set(atkbd, atkbd->set, atkbd->extra))
-			return -1;
+			goto out;
 
 		atkbd_activate(atkbd);
 
@@ -1189,8 +1203,11 @@ static int atkbd_reconnect(struct serio *serio)
 	}
 
 	atkbd_enable(atkbd);
+	retval = 0;
 
-	return 0;
+ out:
+	mutex_unlock(&atkbd->mutex);
+	return retval;
 }
 
 static struct serio_device_id atkbd_serio_ids[] = {
@@ -1234,47 +1251,28 @@ static ssize_t atkbd_attr_show_helper(struct device *dev, char *buf,
 				ssize_t (*handler)(struct atkbd *, char *))
 {
 	struct serio *serio = to_serio_port(dev);
-	int retval;
-
-	retval = serio_pin_driver(serio);
-	if (retval)
-		return retval;
-
-	if (serio->drv != &atkbd_drv) {
-		retval = -ENODEV;
-		goto out;
-	}
-
-	retval = handler((struct atkbd *)serio_get_drvdata(serio), buf);
+	struct atkbd *atkbd = serio_get_drvdata(serio);
 
-out:
-	serio_unpin_driver(serio);
-	return retval;
+	return handler(atkbd, buf);
 }
 
 static ssize_t atkbd_attr_set_helper(struct device *dev, const char *buf, size_t count,
 				ssize_t (*handler)(struct atkbd *, const char *, size_t))
 {
 	struct serio *serio = to_serio_port(dev);
-	struct atkbd *atkbd;
+	struct atkbd *atkbd = serio_get_drvdata(serio);
 	int retval;
 
-	retval = serio_pin_driver(serio);
+	retval = mutex_lock_interruptible(&atkbd->mutex);
 	if (retval)
 		return retval;
 
-	if (serio->drv != &atkbd_drv) {
-		retval = -ENODEV;
-		goto out;
-	}
-
-	atkbd = serio_get_drvdata(serio);
 	atkbd_disable(atkbd);
 	retval = handler(atkbd, buf, count);
 	atkbd_enable(atkbd);
 
-out:
-	serio_unpin_driver(serio);
+	mutex_unlock(&atkbd->mutex);
+
 	return retval;
 }
 
@@ -1567,9 +1565,8 @@ static int __init atkbd_setup_scancode_fixup(const struct dmi_system_id *id)
 	return 0;
 }
 
-static struct dmi_system_id atkbd_dmi_quirk_table[] __initdata = {
+static const struct dmi_system_id atkbd_dmi_quirk_table[] __initconst = {
 	{
-		.ident = "Dell Laptop",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
 			DMI_MATCH(DMI_CHASSIS_TYPE, "8"), /* Portable */
@@ -1578,7 +1575,6 @@ static struct dmi_system_id atkbd_dmi_quirk_table[] __initdata = {
 		.driver_data = atkbd_dell_laptop_forced_release_keys,
 	},
 	{
-		.ident = "Dell Laptop",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Dell Computer Corporation"),
 			DMI_MATCH(DMI_CHASSIS_TYPE, "8"), /* Portable */
@@ -1587,7 +1583,6 @@ static struct dmi_system_id atkbd_dmi_quirk_table[] __initdata = {
 		.driver_data = atkbd_dell_laptop_forced_release_keys,
 	},
 	{
-		.ident = "HP 2133",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "HP 2133"),
@@ -1596,7 +1591,6 @@ static struct dmi_system_id atkbd_dmi_quirk_table[] __initdata = {
 		.driver_data = atkbd_hp_forced_release_keys,
 	},
 	{
-		.ident = "HP Pavilion ZV6100",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "Pavilion ZV6100"),
@@ -1605,7 +1599,6 @@ static struct dmi_system_id atkbd_dmi_quirk_table[] __initdata = {
 		.driver_data = atkbd_volume_forced_release_keys,
 	},
 	{
-		.ident = "HP Presario R4000",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "Presario R4000"),
@@ -1614,7 +1607,6 @@ static struct dmi_system_id atkbd_dmi_quirk_table[] __initdata = {
 		.driver_data = atkbd_volume_forced_release_keys,
 	},
 	{
-		.ident = "HP Presario R4100",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "Presario R4100"),
@@ -1623,7 +1615,6 @@ static struct dmi_system_id atkbd_dmi_quirk_table[] __initdata = {
 		.driver_data = atkbd_volume_forced_release_keys,
 	},
 	{
-		.ident = "HP Presario R4200",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "Presario R4200"),
@@ -1632,7 +1623,7 @@ static struct dmi_system_id atkbd_dmi_quirk_table[] __initdata = {
 		.driver_data = atkbd_volume_forced_release_keys,
 	},
 	{
-		.ident = "Inventec Symphony",
+		/* Inventec Symphony */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "INVENTEC"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "SYMPHONY 6.0/7.0"),
@@ -1641,7 +1632,7 @@ static struct dmi_system_id atkbd_dmi_quirk_table[] __initdata = {
 		.driver_data = atkbd_volume_forced_release_keys,
 	},
 	{
-		.ident = "Samsung NC10",
+		/* Samsung NC10 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
 			DMI_MATCH(DMI_PRODUCT_NAME, "NC10"),
@@ -1650,7 +1641,7 @@ static struct dmi_system_id atkbd_dmi_quirk_table[] __initdata = {
 		.driver_data = atkbd_samsung_forced_release_keys,
 	},
 	{
-		.ident = "Samsung NC20",
+		/* Samsung NC20 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
 			DMI_MATCH(DMI_PRODUCT_NAME, "NC20"),
@@ -1659,7 +1650,7 @@ static struct dmi_system_id atkbd_dmi_quirk_table[] __initdata = {
 		.driver_data = atkbd_samsung_forced_release_keys,
 	},
 	{
-		.ident = "Samsung SQ45S70S",
+		/* Samsung SQ45S70S */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
 			DMI_MATCH(DMI_PRODUCT_NAME, "SQ45S70S"),
@@ -1668,7 +1659,7 @@ static struct dmi_system_id atkbd_dmi_quirk_table[] __initdata = {
 		.driver_data = atkbd_samsung_forced_release_keys,
 	},
 	{
-		.ident = "Fujitsu Amilo PA 1510",
+		/* Fujitsu Amilo PA 1510 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "AMILO Pa 1510"),
@@ -1677,7 +1668,7 @@ static struct dmi_system_id atkbd_dmi_quirk_table[] __initdata = {
 		.driver_data = atkbd_volume_forced_release_keys,
 	},
 	{
-		.ident = "Fujitsu Amilo Pi 3525",
+		/* Fujitsu Amilo Pi 3525 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "AMILO Pi 3525"),
@@ -1686,7 +1677,7 @@ static struct dmi_system_id atkbd_dmi_quirk_table[] __initdata = {
 		.driver_data = atkbd_amilo_pi3525_forced_release_keys,
 	},
 	{
-		.ident = "Fujitsu Amilo Xi 3650",
+		/* Fujitsu Amilo Xi 3650 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "AMILO Xi 3650"),
@@ -1695,7 +1686,6 @@ static struct dmi_system_id atkbd_dmi_quirk_table[] __initdata = {
 		.driver_data = atkbd_amilo_xi3650_forced_release_keys,
 	},
 	{
-		.ident = "Soltech Corporation TA12",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Soltech Corporation"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "TA12"),
@@ -1704,7 +1694,7 @@ static struct dmi_system_id atkbd_dmi_quirk_table[] __initdata = {
 		.driver_data = atkdb_soltech_ta12_forced_release_keys,
 	},
 	{
-		.ident = "OQO Model 01+",
+		/* OQO Model 01+ */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "OQO"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "ZEPTO"),
diff --git a/drivers/input/keyboard/davinci_keyscan.c b/drivers/input/keyboard/davinci_keyscan.c
new file mode 100644
index 000000000000..d410d7a52f1d
--- /dev/null
+++ b/drivers/input/keyboard/davinci_keyscan.c
@@ -0,0 +1,345 @@
+/*
+ * DaVinci Key Scan Driver for TI platforms
+ *
+ * Copyright (C) 2009 Texas Instruments, Inc
+ *
+ * Author: Miguel Aguilar <miguel.aguilar@ridgerun.com>
+ *
+ * Intial Code: Sandeep Paulraj <s-paulraj@ti.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/interrupt.h>
+#include <linux/types.h>
+#include <linux/input.h>
+#include <linux/kernel.h>
+#include <linux/delay.h>
+#include <linux/platform_device.h>
+#include <linux/errno.h>
+
+#include <asm/irq.h>
+
+#include <mach/hardware.h>
+#include <mach/irqs.h>
+#include <mach/keyscan.h>
+
+/* Key scan registers */
+#define DAVINCI_KEYSCAN_KEYCTRL		0x0000
+#define DAVINCI_KEYSCAN_INTENA		0x0004
+#define DAVINCI_KEYSCAN_INTFLAG		0x0008
+#define DAVINCI_KEYSCAN_INTCLR		0x000c
+#define DAVINCI_KEYSCAN_STRBWIDTH	0x0010
+#define DAVINCI_KEYSCAN_INTERVAL	0x0014
+#define DAVINCI_KEYSCAN_CONTTIME	0x0018
+#define DAVINCI_KEYSCAN_CURRENTST	0x001c
+#define DAVINCI_KEYSCAN_PREVSTATE	0x0020
+#define DAVINCI_KEYSCAN_EMUCTRL		0x0024
+#define DAVINCI_KEYSCAN_IODFTCTRL	0x002c
+
+/* Key Control Register (KEYCTRL) */
+#define DAVINCI_KEYSCAN_KEYEN		0x00000001
+#define DAVINCI_KEYSCAN_PREVMODE	0x00000002
+#define DAVINCI_KEYSCAN_CHATOFF		0x00000004
+#define DAVINCI_KEYSCAN_AUTODET		0x00000008
+#define DAVINCI_KEYSCAN_SCANMODE	0x00000010
+#define DAVINCI_KEYSCAN_OUTTYPE		0x00000020
+
+/* Masks for the interrupts */
+#define DAVINCI_KEYSCAN_INT_CONT	0x00000008
+#define DAVINCI_KEYSCAN_INT_OFF		0x00000004
+#define DAVINCI_KEYSCAN_INT_ON		0x00000002
+#define DAVINCI_KEYSCAN_INT_CHANGE	0x00000001
+#define DAVINCI_KEYSCAN_INT_ALL		0x0000000f
+
+struct davinci_ks {
+	struct input_dev		*input;
+	struct davinci_ks_platform_data	*pdata;
+	int				irq;
+	void __iomem			*base;
+	resource_size_t			pbase;
+	size_t				base_size;
+	unsigned short			keymap[];
+};
+
+/* Initializing the kp Module */
+static int __init davinci_ks_initialize(struct davinci_ks *davinci_ks)
+{
+	struct device *dev = &davinci_ks->input->dev;
+	struct davinci_ks_platform_data *pdata = davinci_ks->pdata;
+	u32 matrix_ctrl;
+
+	/* Enable all interrupts */
+	__raw_writel(DAVINCI_KEYSCAN_INT_ALL,
+		     davinci_ks->base + DAVINCI_KEYSCAN_INTENA);
+
+	/* Clear interrupts if any */
+	__raw_writel(DAVINCI_KEYSCAN_INT_ALL,
+		     davinci_ks->base + DAVINCI_KEYSCAN_INTCLR);
+
+	/* Setup the scan period = strobe + interval */
+	__raw_writel(pdata->strobe,
+		     davinci_ks->base + DAVINCI_KEYSCAN_STRBWIDTH);
+	__raw_writel(pdata->interval,
+		     davinci_ks->base + DAVINCI_KEYSCAN_INTERVAL);
+	__raw_writel(0x01,
+		     davinci_ks->base + DAVINCI_KEYSCAN_CONTTIME);
+
+	/* Define matrix type */
+	switch (pdata->matrix_type) {
+	case DAVINCI_KEYSCAN_MATRIX_4X4:
+		matrix_ctrl = 0;
+		break;
+	case DAVINCI_KEYSCAN_MATRIX_5X3:
+		matrix_ctrl = (1 << 6);
+		break;
+	default:
+		dev_err(dev->parent, "wrong matrix type\n");
+		return -EINVAL;
+	}
+
+	/* Enable key scan module and set matrix type */
+	__raw_writel(DAVINCI_KEYSCAN_AUTODET | DAVINCI_KEYSCAN_KEYEN |
+		     matrix_ctrl, davinci_ks->base + DAVINCI_KEYSCAN_KEYCTRL);
+
+	return 0;
+}
+
+static irqreturn_t davinci_ks_interrupt(int irq, void *dev_id)
+{
+	struct davinci_ks *davinci_ks = dev_id;
+	struct device *dev = &davinci_ks->input->dev;
+	unsigned short *keymap = davinci_ks->keymap;
+	int keymapsize = davinci_ks->pdata->keymapsize;
+	u32 prev_status, new_status, changed;
+	bool release;
+	int keycode = KEY_UNKNOWN;
+	int i;
+
+	/* Disable interrupt */
+	__raw_writel(0x0, davinci_ks->base + DAVINCI_KEYSCAN_INTENA);
+
+	/* Reading previous and new status of the key scan */
+	prev_status = __raw_readl(davinci_ks->base + DAVINCI_KEYSCAN_PREVSTATE);
+	new_status = __raw_readl(davinci_ks->base + DAVINCI_KEYSCAN_CURRENTST);
+
+	changed = prev_status ^ new_status;
+
+	if (changed) {
+		/*
+		 * It goes through all bits in 'changed' to ensure
+		 * that no key changes are being missed
+		 */
+		for (i = 0 ; i < keymapsize; i++) {
+			if ((changed>>i) & 0x1) {
+				keycode = keymap[i];
+				release = (new_status >> i) & 0x1;
+				dev_dbg(dev->parent, "key %d %s\n", keycode,
+					release ? "released" : "pressed");
+				input_report_key(davinci_ks->input, keycode,
+						 !release);
+				input_sync(davinci_ks->input);
+			}
+		}
+		/* Clearing interrupt */
+		__raw_writel(DAVINCI_KEYSCAN_INT_ALL,
+			     davinci_ks->base + DAVINCI_KEYSCAN_INTCLR);
+	}
+
+	/* Enable interrupts */
+	__raw_writel(0x1, davinci_ks->base + DAVINCI_KEYSCAN_INTENA);
+
+	return IRQ_HANDLED;
+}
+
+static int __init davinci_ks_probe(struct platform_device *pdev)
+{
+	struct davinci_ks *davinci_ks;
+	struct input_dev *key_dev;
+	struct resource *res, *mem;
+	struct device *dev = &pdev->dev;
+	struct davinci_ks_platform_data *pdata = pdev->dev.platform_data;
+	int error, i;
+
+	if (pdata->device_enable) {
+		error = pdata->device_enable(dev);
+		if (error < 0) {
+			dev_dbg(dev, "device enable function failed\n");
+			return error;
+		}
+	}
+
+	if (!pdata->keymap) {
+		dev_dbg(dev, "no keymap from pdata\n");
+		return -EINVAL;
+	}
+
+	davinci_ks = kzalloc(sizeof(struct davinci_ks) +
+		sizeof(unsigned short) * pdata->keymapsize, GFP_KERNEL);
+	if (!davinci_ks) {
+		dev_dbg(dev, "could not allocate memory for private data\n");
+		return -ENOMEM;
+	}
+
+	memcpy(davinci_ks->keymap, pdata->keymap,
+		sizeof(unsigned short) * pdata->keymapsize);
+
+	key_dev = input_allocate_device();
+	if (!key_dev) {
+		dev_dbg(dev, "could not allocate input device\n");
+		error = -ENOMEM;
+		goto fail1;
+	}
+
+	davinci_ks->input = key_dev;
+
+	davinci_ks->irq = platform_get_irq(pdev, 0);
+	if (davinci_ks->irq < 0) {
+		dev_err(dev, "no key scan irq\n");
+		error = davinci_ks->irq;
+		goto fail2;
+	}
+
+	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	if (!res) {
+		dev_err(dev, "no mem resource\n");
+		error = -EINVAL;
+		goto fail2;
+	}
+
+	davinci_ks->pbase = res->start;
+	davinci_ks->base_size = resource_size(res);
+
+	mem = request_mem_region(davinci_ks->pbase, davinci_ks->base_size,
+				 pdev->name);
+	if (!mem) {
+		dev_err(dev, "key scan registers at %08x are not free\n",
+			davinci_ks->pbase);
+		error = -EBUSY;
+		goto fail2;
+	}
+
+	davinci_ks->base = ioremap(davinci_ks->pbase, davinci_ks->base_size);
+	if (!davinci_ks->base) {
+		dev_err(dev, "can't ioremap MEM resource.\n");
+		error = -ENOMEM;
+		goto fail3;
+	}
+
+	/* Enable auto repeat feature of Linux input subsystem */
+	if (pdata->rep)
+		__set_bit(EV_REP, key_dev->evbit);
+
+	/* Setup input device */
+	__set_bit(EV_KEY, key_dev->evbit);
+
+	/* Setup the platform data */
+	davinci_ks->pdata = pdata;
+
+	for (i = 0; i < davinci_ks->pdata->keymapsize; i++)
+		__set_bit(davinci_ks->pdata->keymap[i], key_dev->keybit);
+
+	key_dev->name = "davinci_keyscan";
+	key_dev->phys = "davinci_keyscan/input0";
+	key_dev->dev.parent = &pdev->dev;
+	key_dev->id.bustype = BUS_HOST;
+	key_dev->id.vendor = 0x0001;
+	key_dev->id.product = 0x0001;
+	key_dev->id.version = 0x0001;
+	key_dev->keycode = davinci_ks->keymap;
+	key_dev->keycodesize = sizeof(davinci_ks->keymap[0]);
+	key_dev->keycodemax = davinci_ks->pdata->keymapsize;
+
+	error = input_register_device(davinci_ks->input);
+	if (error < 0) {
+		dev_err(dev, "unable to register davinci key scan device\n");
+		goto fail4;
+	}
+
+	error = request_irq(davinci_ks->irq, davinci_ks_interrupt,
+			  IRQF_DISABLED, pdev->name, davinci_ks);
+	if (error < 0) {
+		dev_err(dev, "unable to register davinci key scan interrupt\n");
+		goto fail5;
+	}
+
+	error = davinci_ks_initialize(davinci_ks);
+	if (error < 0) {
+		dev_err(dev, "unable to initialize davinci key scan device\n");
+		goto fail6;
+	}
+
+	platform_set_drvdata(pdev, davinci_ks);
+	return 0;
+
+fail6:
+	free_irq(davinci_ks->irq, davinci_ks);
+fail5:
+	input_unregister_device(davinci_ks->input);
+	key_dev = NULL;
+fail4:
+	iounmap(davinci_ks->base);
+fail3:
+	release_mem_region(davinci_ks->pbase, davinci_ks->base_size);
+fail2:
+	input_free_device(key_dev);
+fail1:
+	kfree(davinci_ks);
+
+	return error;
+}
+
+static int __devexit davinci_ks_remove(struct platform_device *pdev)
+{
+	struct davinci_ks *davinci_ks = platform_get_drvdata(pdev);
+
+	free_irq(davinci_ks->irq, davinci_ks);
+
+	input_unregister_device(davinci_ks->input);
+
+	iounmap(davinci_ks->base);
+	release_mem_region(davinci_ks->pbase, davinci_ks->base_size);
+
+	platform_set_drvdata(pdev, NULL);
+
+	kfree(davinci_ks);
+
+	return 0;
+}
+
+static struct platform_driver davinci_ks_driver = {
+	.driver	= {
+		.name = "davinci_keyscan",
+		.owner = THIS_MODULE,
+	},
+	.remove	= __devexit_p(davinci_ks_remove),
+};
+
+static int __init davinci_ks_init(void)
+{
+	return platform_driver_probe(&davinci_ks_driver, davinci_ks_probe);
+}
+module_init(davinci_ks_init);
+
+static void __exit davinci_ks_exit(void)
+{
+	platform_driver_unregister(&davinci_ks_driver);
+}
+module_exit(davinci_ks_exit);
+
+MODULE_AUTHOR("Miguel Aguilar");
+MODULE_DESCRIPTION("Texas Instruments DaVinci Key Scan Driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/input/keyboard/ep93xx_keypad.c b/drivers/input/keyboard/ep93xx_keypad.c
index 181d30e3018e..e45740429f7e 100644
--- a/drivers/input/keyboard/ep93xx_keypad.c
+++ b/drivers/input/keyboard/ep93xx_keypad.c
@@ -22,11 +22,11 @@
 
 #include <linux/platform_device.h>
 #include <linux/interrupt.h>
-#include <linux/input.h>
 #include <linux/clk.h>
+#include <linux/io.h>
+#include <linux/input/matrix_keypad.h>
 
 #include <mach/hardware.h>
-#include <mach/gpio.h>
 #include <mach/ep93xx_keypad.h>
 
 /*
@@ -60,38 +60,37 @@
 #define KEY_REG_KEY1_MASK	(0x0000003f)
 #define KEY_REG_KEY1_SHIFT	(0)
 
-#define keypad_readl(off)	__raw_readl(keypad->mmio_base + (off))
-#define keypad_writel(v, off)	__raw_writel((v), keypad->mmio_base + (off))
-
-#define MAX_MATRIX_KEY_NUM	(MAX_MATRIX_KEY_ROWS * MAX_MATRIX_KEY_COLS)
+#define EP93XX_MATRIX_SIZE	(EP93XX_MATRIX_ROWS * EP93XX_MATRIX_COLS)
 
 struct ep93xx_keypad {
 	struct ep93xx_keypad_platform_data *pdata;
-
-	struct clk *clk;
 	struct input_dev *input_dev;
+	struct clk *clk;
+
 	void __iomem *mmio_base;
 
-	int irq;
-	int enabled;
+	unsigned int matrix_keycodes[EP93XX_MATRIX_SIZE];
 
 	int key1;
 	int key2;
 
-	unsigned int matrix_keycodes[MAX_MATRIX_KEY_NUM];
+	int irq;
+
+	bool enabled;
 };
 
 static void ep93xx_keypad_build_keycode(struct ep93xx_keypad *keypad)
 {
 	struct ep93xx_keypad_platform_data *pdata = keypad->pdata;
 	struct input_dev *input_dev = keypad->input_dev;
+	unsigned int *key;
 	int i;
 
-	for (i = 0; i < pdata->matrix_key_map_size; i++) {
-		unsigned int key = pdata->matrix_key_map[i];
-		int row = (key >> 28) & 0xf;
-		int col = (key >> 24) & 0xf;
-		int code = key & 0xffffff;
+	key = &pdata->matrix_key_map[0];
+	for (i = 0; i < pdata->matrix_key_map_size; i++, key++) {
+		int row = KEY_ROW(*key);
+		int col = KEY_COL(*key);
+		int code = KEY_VAL(*key);
 
 		keypad->matrix_keycodes[(row << 3) + col] = code;
 		__set_bit(code, input_dev->keybit);
@@ -102,9 +101,11 @@ static irqreturn_t ep93xx_keypad_irq_handler(int irq, void *dev_id)
 {
 	struct ep93xx_keypad *keypad = dev_id;
 	struct input_dev *input_dev = keypad->input_dev;
-	unsigned int status = keypad_readl(KEY_REG);
+	unsigned int status;
 	int keycode, key1, key2;
 
+	status = __raw_readl(keypad->mmio_base + KEY_REG);
+
 	keycode = (status & KEY_REG_KEY1_MASK) >> KEY_REG_KEY1_SHIFT;
 	key1 = keypad->matrix_keycodes[keycode];
 
@@ -152,7 +153,10 @@ static void ep93xx_keypad_config(struct ep93xx_keypad *keypad)
 	struct ep93xx_keypad_platform_data *pdata = keypad->pdata;
 	unsigned int val = 0;
 
-	clk_set_rate(keypad->clk, pdata->flags & EP93XX_KEYPAD_KDIV);
+	if (pdata->flags & EP93XX_KEYPAD_KDIV)
+		clk_set_rate(keypad->clk, EP93XX_KEYTCHCLK_DIV4);
+	else
+		clk_set_rate(keypad->clk, EP93XX_KEYTCHCLK_DIV16);
 
 	if (pdata->flags & EP93XX_KEYPAD_DISABLE_3_KEY)
 		val |= KEY_INIT_DIS3KY;
@@ -167,7 +171,7 @@ static void ep93xx_keypad_config(struct ep93xx_keypad *keypad)
 
 	val |= ((pdata->prescale << KEY_INIT_PRSCL_SHIFT) & KEY_INIT_PRSCL_MASK);
 
-	keypad_writel(val, KEY_INIT);
+	__raw_writel(val, keypad->mmio_base + KEY_INIT);
 }
 
 static int ep93xx_keypad_open(struct input_dev *pdev)
@@ -177,7 +181,7 @@ static int ep93xx_keypad_open(struct input_dev *pdev)
 	if (!keypad->enabled) {
 		ep93xx_keypad_config(keypad);
 		clk_enable(keypad->clk);
-		keypad->enabled = 1;
+		keypad->enabled = true;
 	}
 
 	return 0;
@@ -189,7 +193,7 @@ static void ep93xx_keypad_close(struct input_dev *pdev)
 
 	if (keypad->enabled) {
 		clk_disable(keypad->clk);
-		keypad->enabled = 0;
+		keypad->enabled = false;
 	}
 }
 
@@ -211,7 +215,7 @@ static int ep93xx_keypad_suspend(struct platform_device *pdev,
 
 	if (keypad->enabled) {
 		clk_disable(keypad->clk);
-		keypad->enabled = 0;
+		keypad->enabled = false;
 	}
 
 	mutex_unlock(&input_dev->mutex);
@@ -236,7 +240,7 @@ static int ep93xx_keypad_resume(struct platform_device *pdev)
 		if (!keypad->enabled) {
 			ep93xx_keypad_config(keypad);
 			clk_enable(keypad->clk);
-			keypad->enabled = 1;
+			keypad->enabled = true;
 		}
 	}
 
@@ -252,88 +256,56 @@ static int ep93xx_keypad_resume(struct platform_device *pdev)
 static int __devinit ep93xx_keypad_probe(struct platform_device *pdev)
 {
 	struct ep93xx_keypad *keypad;
-	struct ep93xx_keypad_platform_data *pdata = pdev->dev.platform_data;
 	struct input_dev *input_dev;
 	struct resource *res;
-	int irq, err, i, gpio;
-
-	if (!pdata ||
-	    !pdata->matrix_key_rows ||
-	    pdata->matrix_key_rows > MAX_MATRIX_KEY_ROWS ||
-	    !pdata->matrix_key_cols ||
-	    pdata->matrix_key_cols > MAX_MATRIX_KEY_COLS) {
-		dev_err(&pdev->dev, "invalid or missing platform data\n");
-		return -EINVAL;
-	}
+	int err;
 
 	keypad = kzalloc(sizeof(struct ep93xx_keypad), GFP_KERNEL);
-	if (!keypad) {
-		dev_err(&pdev->dev, "failed to allocate driver data\n");
+	if (!keypad)
 		return -ENOMEM;
-	}
 
-	keypad->pdata = pdata;
+	keypad->pdata = pdev->dev.platform_data;
+	if (!keypad->pdata) {
+		err = -EINVAL;
+		goto failed_free;
+	}
 
-	irq = platform_get_irq(pdev, 0);
-	if (irq < 0) {
-		dev_err(&pdev->dev, "failed to get keypad irq\n");
+	keypad->irq = platform_get_irq(pdev, 0);
+	if (!keypad->irq) {
 		err = -ENXIO;
 		goto failed_free;
 	}
 
 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 	if (!res) {
-		dev_err(&pdev->dev, "failed to get I/O memory\n");
 		err = -ENXIO;
 		goto failed_free;
 	}
 
 	res = request_mem_region(res->start, resource_size(res), pdev->name);
 	if (!res) {
-		dev_err(&pdev->dev, "failed to request I/O memory\n");
 		err = -EBUSY;
 		goto failed_free;
 	}
 
 	keypad->mmio_base = ioremap(res->start, resource_size(res));
 	if (keypad->mmio_base == NULL) {
-		dev_err(&pdev->dev, "failed to remap I/O memory\n");
 		err = -ENXIO;
 		goto failed_free_mem;
 	}
 
-	/* Request the needed GPIO's */
-	gpio = EP93XX_GPIO_LINE_ROW0;
-	for (i = 0; i < keypad->pdata->matrix_key_rows; i++, gpio++) {
-		err = gpio_request(gpio, pdev->name);
-		if (err) {
-			dev_err(&pdev->dev, "failed to request gpio-%d\n",
-				gpio);
-			goto failed_free_rows;
-		}
-	}
-
-	gpio = EP93XX_GPIO_LINE_COL0;
-	for (i = 0; i < keypad->pdata->matrix_key_cols; i++, gpio++) {
-		err = gpio_request(gpio, pdev->name);
-		if (err) {
-			dev_err(&pdev->dev, "failed to request gpio-%d\n",
-				gpio);
-			goto failed_free_cols;
-		}
-	}
+	err = ep93xx_keypad_acquire_gpio(pdev);
+	if (err)
+		goto failed_free_io;
 
-	keypad->clk = clk_get(&pdev->dev, "key_clk");
+	keypad->clk = clk_get(&pdev->dev, NULL);
 	if (IS_ERR(keypad->clk)) {
-		dev_err(&pdev->dev, "failed to get keypad clock\n");
 		err = PTR_ERR(keypad->clk);
-		goto failed_free_io;
+		goto failed_free_gpio;
 	}
 
-	/* Create and register the input driver */
 	input_dev = input_allocate_device();
 	if (!input_dev) {
-		dev_err(&pdev->dev, "failed to allocate input device\n");
 		err = -ENOMEM;
 		goto failed_put_clk;
 	}
@@ -358,44 +330,29 @@ static int __devinit ep93xx_keypad_probe(struct platform_device *pdev)
 	ep93xx_keypad_build_keycode(keypad);
 	platform_set_drvdata(pdev, keypad);
 
-	err = request_irq(irq, ep93xx_keypad_irq_handler, IRQF_DISABLED,
-				pdev->name, keypad);
-	if (err) {
-		dev_err(&pdev->dev, "failed to request IRQ\n");
+	err = request_irq(keypad->irq, ep93xx_keypad_irq_handler,
+			  IRQF_DISABLED, pdev->name, keypad);
+	if (err)
 		goto failed_free_dev;
-	}
-
-	keypad->irq = irq;
 
-	/* Register the input device */
 	err = input_register_device(input_dev);
-	if (err) {
-		dev_err(&pdev->dev, "failed to register input device\n");
+	if (err)
 		goto failed_free_irq;
-	}
 
 	device_init_wakeup(&pdev->dev, 1);
 
 	return 0;
 
 failed_free_irq:
-	free_irq(irq, pdev);
+	free_irq(keypad->irq, pdev);
 	platform_set_drvdata(pdev, NULL);
 failed_free_dev:
 	input_free_device(input_dev);
 failed_put_clk:
 	clk_put(keypad->clk);
+failed_free_gpio:
+	ep93xx_keypad_release_gpio(pdev);
 failed_free_io:
-	i = keypad->pdata->matrix_key_cols - 1;
-	gpio = EP93XX_GPIO_LINE_COL0 + i;
-failed_free_cols:
-	for ( ; i >= 0; i--, gpio--)
-		gpio_free(gpio);
-	i = keypad->pdata->matrix_key_rows - 1;
-	gpio = EP93XX_GPIO_LINE_ROW0 + i;
-failed_free_rows:
-	for ( ; i >= 0; i--, gpio--)
-		gpio_free(gpio);
 	iounmap(keypad->mmio_base);
 failed_free_mem:
 	release_mem_region(res->start, resource_size(res));
@@ -408,7 +365,6 @@ static int __devexit ep93xx_keypad_remove(struct platform_device *pdev)
 {
 	struct ep93xx_keypad *keypad = platform_get_drvdata(pdev);
 	struct resource *res;
-	int i, gpio;
 
 	free_irq(keypad->irq, pdev);
 
@@ -420,15 +376,7 @@ static int __devexit ep93xx_keypad_remove(struct platform_device *pdev)
 
 	input_unregister_device(keypad->input_dev);
 
-	i = keypad->pdata->matrix_key_cols - 1;
-	gpio = EP93XX_GPIO_LINE_COL0 + i;
-	for ( ; i >= 0; i--, gpio--)
-		gpio_free(gpio);
-
-	i = keypad->pdata->matrix_key_rows - 1;
-	gpio = EP93XX_GPIO_LINE_ROW0 + i;
-	for ( ; i >= 0; i--, gpio--)
-		gpio_free(gpio);
+	ep93xx_keypad_release_gpio(pdev);
 
 	iounmap(keypad->mmio_base);
 
diff --git a/drivers/input/keyboard/gpio_keys.c b/drivers/input/keyboard/gpio_keys.c
index 77d130914259..1aff3b76effd 100644
--- a/drivers/input/keyboard/gpio_keys.c
+++ b/drivers/input/keyboard/gpio_keys.c
@@ -23,8 +23,7 @@
 #include <linux/input.h>
 #include <linux/gpio_keys.h>
 #include <linux/workqueue.h>
-
-#include <asm/gpio.h>
+#include <linux/gpio.h>
 
 struct gpio_button_data {
 	struct gpio_keys_button *button;
@@ -38,10 +37,8 @@ struct gpio_keys_drvdata {
 	struct gpio_button_data data[0];
 };
 
-static void gpio_keys_report_event(struct work_struct *work)
+static void gpio_keys_report_event(struct gpio_button_data *bdata)
 {
-	struct gpio_button_data *bdata =
-		container_of(work, struct gpio_button_data, work);
 	struct gpio_keys_button *button = bdata->button;
 	struct input_dev *input = bdata->input;
 	unsigned int type = button->type ?: EV_KEY;
@@ -51,6 +48,14 @@ static void gpio_keys_report_event(struct work_struct *work)
 	input_sync(input);
 }
 
+static void gpio_keys_work_func(struct work_struct *work)
+{
+	struct gpio_button_data *bdata =
+		container_of(work, struct gpio_button_data, work);
+
+	gpio_keys_report_event(bdata);
+}
+
 static void gpio_keys_timer(unsigned long _data)
 {
 	struct gpio_button_data *data = (struct gpio_button_data *)_data;
@@ -74,10 +79,62 @@ static irqreturn_t gpio_keys_isr(int irq, void *dev_id)
 	return IRQ_HANDLED;
 }
 
+static int __devinit gpio_keys_setup_key(struct device *dev,
+					 struct gpio_button_data *bdata,
+					 struct gpio_keys_button *button)
+{
+	char *desc = button->desc ? button->desc : "gpio_keys";
+	int irq, error;
+
+	setup_timer(&bdata->timer, gpio_keys_timer, (unsigned long)bdata);
+	INIT_WORK(&bdata->work, gpio_keys_work_func);
+
+	error = gpio_request(button->gpio, desc);
+	if (error < 0) {
+		dev_err(dev, "failed to request GPIO %d, error %d\n",
+			button->gpio, error);
+		goto fail2;
+	}
+
+	error = gpio_direction_input(button->gpio);
+	if (error < 0) {
+		dev_err(dev, "failed to configure"
+			" direction for GPIO %d, error %d\n",
+			button->gpio, error);
+		goto fail3;
+	}
+
+	irq = gpio_to_irq(button->gpio);
+	if (irq < 0) {
+		error = irq;
+		dev_err(dev, "Unable to get irq number for GPIO %d, error %d\n",
+			button->gpio, error);
+		goto fail3;
+	}
+
+	error = request_irq(irq, gpio_keys_isr,
+			    IRQF_SHARED |
+			    IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING,
+			    desc, bdata);
+	if (error) {
+		dev_err(dev, "Unable to claim irq %d; error %d\n",
+			irq, error);
+		goto fail3;
+	}
+
+	return 0;
+
+fail3:
+	gpio_free(button->gpio);
+fail2:
+	return error;
+}
+
 static int __devinit gpio_keys_probe(struct platform_device *pdev)
 {
 	struct gpio_keys_platform_data *pdata = pdev->dev.platform_data;
 	struct gpio_keys_drvdata *ddata;
+	struct device *dev = &pdev->dev;
 	struct input_dev *input;
 	int i, error;
 	int wakeup = 0;
@@ -87,6 +144,7 @@ static int __devinit gpio_keys_probe(struct platform_device *pdev)
 			GFP_KERNEL);
 	input = input_allocate_device();
 	if (!ddata || !input) {
+		dev_err(dev, "failed to allocate state\n");
 		error = -ENOMEM;
 		goto fail1;
 	}
@@ -111,52 +169,14 @@ static int __devinit gpio_keys_probe(struct platform_device *pdev)
 	for (i = 0; i < pdata->nbuttons; i++) {
 		struct gpio_keys_button *button = &pdata->buttons[i];
 		struct gpio_button_data *bdata = &ddata->data[i];
-		int irq;
 		unsigned int type = button->type ?: EV_KEY;
 
 		bdata->input = input;
 		bdata->button = button;
-		setup_timer(&bdata->timer,
-			    gpio_keys_timer, (unsigned long)bdata);
-		INIT_WORK(&bdata->work, gpio_keys_report_event);
-
-		error = gpio_request(button->gpio, button->desc ?: "gpio_keys");
-		if (error < 0) {
-			pr_err("gpio-keys: failed to request GPIO %d,"
-				" error %d\n", button->gpio, error);
-			goto fail2;
-		}
-
-		error = gpio_direction_input(button->gpio);
-		if (error < 0) {
-			pr_err("gpio-keys: failed to configure input"
-				" direction for GPIO %d, error %d\n",
-				button->gpio, error);
-			gpio_free(button->gpio);
-			goto fail2;
-		}
-
-		irq = gpio_to_irq(button->gpio);
-		if (irq < 0) {
-			error = irq;
-			pr_err("gpio-keys: Unable to get irq number"
-				" for GPIO %d, error %d\n",
-				button->gpio, error);
-			gpio_free(button->gpio);
-			goto fail2;
-		}
 
-		error = request_irq(irq, gpio_keys_isr,
-				    IRQF_SHARED |
-				    IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING,
-				    button->desc ? button->desc : "gpio_keys",
-				    bdata);
-		if (error) {
-			pr_err("gpio-keys: Unable to claim irq %d; error %d\n",
-				irq, error);
-			gpio_free(button->gpio);
+		error = gpio_keys_setup_key(dev, bdata, button);
+		if (error)
 			goto fail2;
-		}
 
 		if (button->wakeup)
 			wakeup = 1;
@@ -166,11 +186,16 @@ static int __devinit gpio_keys_probe(struct platform_device *pdev)
 
 	error = input_register_device(input);
 	if (error) {
-		pr_err("gpio-keys: Unable to register input device, "
+		dev_err(dev, "Unable to register input device, "
 			"error: %d\n", error);
 		goto fail2;
 	}
 
+	/* get current state of buttons */
+	for (i = 0; i < pdata->nbuttons; i++)
+		gpio_keys_report_event(&ddata->data[i]);
+	input_sync(input);
+
 	device_init_wakeup(&pdev->dev, wakeup);
 
 	return 0;
@@ -239,18 +264,21 @@ static int gpio_keys_suspend(struct device *dev)
 static int gpio_keys_resume(struct device *dev)
 {
 	struct platform_device *pdev = to_platform_device(dev);
+	struct gpio_keys_drvdata *ddata = platform_get_drvdata(pdev);
 	struct gpio_keys_platform_data *pdata = pdev->dev.platform_data;
 	int i;
 
-	if (device_may_wakeup(&pdev->dev)) {
-		for (i = 0; i < pdata->nbuttons; i++) {
-			struct gpio_keys_button *button = &pdata->buttons[i];
-			if (button->wakeup) {
-				int irq = gpio_to_irq(button->gpio);
-				disable_irq_wake(irq);
-			}
+	for (i = 0; i < pdata->nbuttons; i++) {
+
+		struct gpio_keys_button *button = &pdata->buttons[i];
+		if (button->wakeup && device_may_wakeup(&pdev->dev)) {
+			int irq = gpio_to_irq(button->gpio);
+			disable_irq_wake(irq);
 		}
+
+		gpio_keys_report_event(&ddata->data[i]);
 	}
+	input_sync(ddata->input);
 
 	return 0;
 }
diff --git a/drivers/input/keyboard/lkkbd.c b/drivers/input/keyboard/lkkbd.c
index f9847e0fb553..fa9bb6d235e2 100644
--- a/drivers/input/keyboard/lkkbd.c
+++ b/drivers/input/keyboard/lkkbd.c
@@ -72,9 +72,9 @@
 
 #define DRIVER_DESC	"LK keyboard driver"
 
-MODULE_AUTHOR ("Jan-Benedict Glaw <jbglaw@lug-owl.de>");
-MODULE_DESCRIPTION (DRIVER_DESC);
-MODULE_LICENSE ("GPL");
+MODULE_AUTHOR("Jan-Benedict Glaw <jbglaw@lug-owl.de>");
+MODULE_DESCRIPTION(DRIVER_DESC);
+MODULE_LICENSE("GPL");
 
 /*
  * Known parameters:
@@ -85,27 +85,27 @@ MODULE_LICENSE ("GPL");
  * Please notice that there's not yet an API to set these at runtime.
  */
 static int bell_volume = 100; /* % */
-module_param (bell_volume, int, 0);
-MODULE_PARM_DESC (bell_volume, "Bell volume (in %). default is 100%");
+module_param(bell_volume, int, 0);
+MODULE_PARM_DESC(bell_volume, "Bell volume (in %). default is 100%");
 
 static int keyclick_volume = 100; /* % */
-module_param (keyclick_volume, int, 0);
-MODULE_PARM_DESC (keyclick_volume, "Keyclick volume (in %), default is 100%");
+module_param(keyclick_volume, int, 0);
+MODULE_PARM_DESC(keyclick_volume, "Keyclick volume (in %), default is 100%");
 
 static int ctrlclick_volume = 100; /* % */
-module_param (ctrlclick_volume, int, 0);
-MODULE_PARM_DESC (ctrlclick_volume, "Ctrlclick volume (in %), default is 100%");
+module_param(ctrlclick_volume, int, 0);
+MODULE_PARM_DESC(ctrlclick_volume, "Ctrlclick volume (in %), default is 100%");
 
 static int lk201_compose_is_alt;
-module_param (lk201_compose_is_alt, int, 0);
-MODULE_PARM_DESC (lk201_compose_is_alt, "If set non-zero, LK201' Compose key "
-		"will act as an Alt key");
+module_param(lk201_compose_is_alt, int, 0);
+MODULE_PARM_DESC(lk201_compose_is_alt,
+		 "If set non-zero, LK201' Compose key will act as an Alt key");
 
 
 
 #undef LKKBD_DEBUG
 #ifdef LKKBD_DEBUG
-#define DBG(x...) printk (x)
+#define DBG(x...) printk(x)
 #else
 #define DBG(x...) do {} while (0)
 #endif
@@ -122,7 +122,7 @@ MODULE_PARM_DESC (lk201_compose_is_alt, "If set non-zero, LK201' Compose key "
 #define LK_MODE_DOWN		0x80
 #define LK_MODE_AUTODOWN	0x82
 #define LK_MODE_UPDOWN		0x86
-#define LK_CMD_SET_MODE(mode,div)	((mode) | ((div) << 3))
+#define LK_CMD_SET_MODE(mode, div)	((mode) | ((div) << 3))
 
 /* Misc commands */
 #define LK_CMD_ENABLE_KEYCLICK	0x1b
@@ -152,11 +152,8 @@ MODULE_PARM_DESC (lk201_compose_is_alt, "If set non-zero, LK201' Compose key "
 
 #define LK_NUM_KEYCODES		256
 #define LK_NUM_IGNORE_BYTES	6
-typedef u_int16_t lk_keycode_t;
 
-
-
-static lk_keycode_t lkkbd_keycode[LK_NUM_KEYCODES] = {
+static unsigned short lkkbd_keycode[LK_NUM_KEYCODES] = {
 	[0x56] = KEY_F1,
 	[0x57] = KEY_F2,
 	[0x58] = KEY_F3,
@@ -268,7 +265,7 @@ static lk_keycode_t lkkbd_keycode[LK_NUM_KEYCODES] = {
 };
 
 #define CHECK_LED(LK, VAR_ON, VAR_OFF, LED, BITS) do {		\
-	if (test_bit (LED, (LK)->dev->led))			\
+	if (test_bit(LED, (LK)->dev->led))			\
 		VAR_ON |= BITS;					\
 	else							\
 		VAR_OFF |= BITS;				\
@@ -278,7 +275,7 @@ static lk_keycode_t lkkbd_keycode[LK_NUM_KEYCODES] = {
  * Per-keyboard data
  */
 struct lkkbd {
-	lk_keycode_t keycode[LK_NUM_KEYCODES];
+	unsigned short keycode[LK_NUM_KEYCODES];
 	int ignore_bytes;
 	unsigned char id[LK_NUM_IGNORE_BYTES];
 	struct input_dev *dev;
@@ -301,26 +298,25 @@ static struct {
 	unsigned char *name;
 } lk_response[] = {
 #define RESPONSE(x) { .value = (x), .name = #x, }
-	RESPONSE (LK_STUCK_KEY),
-	RESPONSE (LK_SELFTEST_FAILED),
-	RESPONSE (LK_ALL_KEYS_UP),
-	RESPONSE (LK_METRONOME),
-	RESPONSE (LK_OUTPUT_ERROR),
-	RESPONSE (LK_INPUT_ERROR),
-	RESPONSE (LK_KBD_LOCKED),
-	RESPONSE (LK_KBD_TEST_MODE_ACK),
-	RESPONSE (LK_PREFIX_KEY_DOWN),
-	RESPONSE (LK_MODE_CHANGE_ACK),
-	RESPONSE (LK_RESPONSE_RESERVED),
+	RESPONSE(LK_STUCK_KEY),
+	RESPONSE(LK_SELFTEST_FAILED),
+	RESPONSE(LK_ALL_KEYS_UP),
+	RESPONSE(LK_METRONOME),
+	RESPONSE(LK_OUTPUT_ERROR),
+	RESPONSE(LK_INPUT_ERROR),
+	RESPONSE(LK_KBD_LOCKED),
+	RESPONSE(LK_KBD_TEST_MODE_ACK),
+	RESPONSE(LK_PREFIX_KEY_DOWN),
+	RESPONSE(LK_MODE_CHANGE_ACK),
+	RESPONSE(LK_RESPONSE_RESERVED),
 #undef RESPONSE
 };
 
-static unsigned char *
-response_name (unsigned char value)
+static unsigned char *response_name(unsigned char value)
 {
 	int i;
 
-	for (i = 0; i < ARRAY_SIZE (lk_response); i++)
+	for (i = 0; i < ARRAY_SIZE(lk_response); i++)
 		if (lk_response[i].value == value)
 			return lk_response[i].name;
 
@@ -331,8 +327,7 @@ response_name (unsigned char value)
 /*
  * Calculate volume parameter byte for a given volume.
  */
-static unsigned char
-volume_to_hw (int volume_percent)
+static unsigned char volume_to_hw(int volume_percent)
 {
 	unsigned char ret = 0;
 
@@ -363,8 +358,7 @@ volume_to_hw (int volume_percent)
 	return ret;
 }
 
-static void
-lkkbd_detection_done (struct lkkbd *lk)
+static void lkkbd_detection_done(struct lkkbd *lk)
 {
 	int i;
 
@@ -377,190 +371,202 @@ lkkbd_detection_done (struct lkkbd *lk)
 	 * Print keyboard name and modify Compose=Alt on user's request.
 	 */
 	switch (lk->id[4]) {
-		case 1:
-			strlcpy (lk->name, "DEC LK201 keyboard",
-				 sizeof (lk->name));
-
-			if (lk201_compose_is_alt)
-				lk->keycode[0xb1] = KEY_LEFTALT;
-			break;
-
-		case 2:
-			strlcpy (lk->name, "DEC LK401 keyboard",
-				 sizeof (lk->name));
-			break;
-
-		default:
-			strlcpy (lk->name, "Unknown DEC keyboard",
-				 sizeof (lk->name));
-			printk (KERN_ERR "lkkbd: keyboard on %s is unknown, "
-					"please report to Jan-Benedict Glaw "
-					"<jbglaw@lug-owl.de>\n", lk->phys);
-			printk (KERN_ERR "lkkbd: keyboard ID'ed as:");
-			for (i = 0; i < LK_NUM_IGNORE_BYTES; i++)
-				printk (" 0x%02x", lk->id[i]);
-			printk ("\n");
-			break;
+	case 1:
+		strlcpy(lk->name, "DEC LK201 keyboard", sizeof(lk->name));
+
+		if (lk201_compose_is_alt)
+			lk->keycode[0xb1] = KEY_LEFTALT;
+		break;
+
+	case 2:
+		strlcpy(lk->name, "DEC LK401 keyboard", sizeof(lk->name));
+		break;
+
+	default:
+		strlcpy(lk->name, "Unknown DEC keyboard", sizeof(lk->name));
+		printk(KERN_ERR
+			"lkkbd: keyboard on %s is unknown, please report to "
+			"Jan-Benedict Glaw <jbglaw@lug-owl.de>\n", lk->phys);
+		printk(KERN_ERR "lkkbd: keyboard ID'ed as:");
+		for (i = 0; i < LK_NUM_IGNORE_BYTES; i++)
+			printk(" 0x%02x", lk->id[i]);
+		printk("\n");
+		break;
 	}
-	printk (KERN_INFO "lkkbd: keyboard on %s identified as: %s\n",
-			lk->phys, lk->name);
+
+	printk(KERN_INFO "lkkbd: keyboard on %s identified as: %s\n",
+		lk->phys, lk->name);
 
 	/*
 	 * Report errors during keyboard boot-up.
 	 */
 	switch (lk->id[2]) {
-		case 0x00:
-			/* All okay */
-			break;
-
-		case LK_STUCK_KEY:
-			printk (KERN_ERR "lkkbd: Stuck key on keyboard at "
-					"%s\n", lk->phys);
-			break;
-
-		case LK_SELFTEST_FAILED:
-			printk (KERN_ERR "lkkbd: Selftest failed on keyboard "
-					"at %s, keyboard may not work "
-					"properly\n", lk->phys);
-			break;
-
-		default:
-			printk (KERN_ERR "lkkbd: Unknown error %02x on "
-					"keyboard at %s\n", lk->id[2],
-					lk->phys);
-			break;
+	case 0x00:
+		/* All okay */
+		break;
+
+	case LK_STUCK_KEY:
+		printk(KERN_ERR "lkkbd: Stuck key on keyboard at %s\n",
+			lk->phys);
+		break;
+
+	case LK_SELFTEST_FAILED:
+		printk(KERN_ERR
+			"lkkbd: Selftest failed on keyboard at %s, "
+			"keyboard may not work properly\n", lk->phys);
+		break;
+
+	default:
+		printk(KERN_ERR
+			"lkkbd: Unknown error %02x on keyboard at %s\n",
+			lk->id[2], lk->phys);
+		break;
 	}
 
 	/*
 	 * Try to hint user if there's a stuck key.
 	 */
 	if (lk->id[2] == LK_STUCK_KEY && lk->id[3] != 0)
-		printk (KERN_ERR "Scancode of stuck key is 0x%02x, keycode "
-				"is 0x%04x\n", lk->id[3],
-				lk->keycode[lk->id[3]]);
-
-	return;
+		printk(KERN_ERR
+			"Scancode of stuck key is 0x%02x, keycode is 0x%04x\n",
+			lk->id[3], lk->keycode[lk->id[3]]);
 }
 
 /*
  * lkkbd_interrupt() is called by the low level driver when a character
  * is received.
  */
-static irqreturn_t
-lkkbd_interrupt (struct serio *serio, unsigned char data, unsigned int flags)
+static irqreturn_t lkkbd_interrupt(struct serio *serio,
+				   unsigned char data, unsigned int flags)
 {
-	struct lkkbd *lk = serio_get_drvdata (serio);
+	struct lkkbd *lk = serio_get_drvdata(serio);
+	struct input_dev *input_dev = lk->dev;
+	unsigned int keycode;
 	int i;
 
-	DBG (KERN_INFO "Got byte 0x%02x\n", data);
+	DBG(KERN_INFO "Got byte 0x%02x\n", data);
 
 	if (lk->ignore_bytes > 0) {
-		DBG (KERN_INFO "Ignoring a byte on %s\n", lk->name);
+		DBG(KERN_INFO "Ignoring a byte on %s\n", lk->name);
 		lk->id[LK_NUM_IGNORE_BYTES - lk->ignore_bytes--] = data;
 
 		if (lk->ignore_bytes == 0)
-			lkkbd_detection_done (lk);
+			lkkbd_detection_done(lk);
 
 		return IRQ_HANDLED;
 	}
 
 	switch (data) {
-		case LK_ALL_KEYS_UP:
-			for (i = 0; i < ARRAY_SIZE (lkkbd_keycode); i++)
-				if (lk->keycode[i] != KEY_RESERVED)
-					input_report_key (lk->dev, lk->keycode[i], 0);
-			input_sync (lk->dev);
-			break;
-
-		case 0x01:
-			DBG (KERN_INFO "Got 0x01, scheduling re-initialization\n");
-			lk->ignore_bytes = LK_NUM_IGNORE_BYTES;
-			lk->id[LK_NUM_IGNORE_BYTES - lk->ignore_bytes--] = data;
-			schedule_work (&lk->tq);
-			break;
-
-		case LK_METRONOME:
-		case LK_OUTPUT_ERROR:
-		case LK_INPUT_ERROR:
-		case LK_KBD_LOCKED:
-		case LK_KBD_TEST_MODE_ACK:
-		case LK_PREFIX_KEY_DOWN:
-		case LK_MODE_CHANGE_ACK:
-		case LK_RESPONSE_RESERVED:
-			DBG (KERN_INFO "Got %s and don't know how to handle...\n",
-					response_name (data));
-			break;
-
-		default:
-			if (lk->keycode[data] != KEY_RESERVED) {
-				if (!test_bit (lk->keycode[data], lk->dev->key))
-					input_report_key (lk->dev, lk->keycode[data], 1);
-				else
-					input_report_key (lk->dev, lk->keycode[data], 0);
-				input_sync (lk->dev);
-                        } else
-                                printk (KERN_WARNING "%s: Unknown key with "
-						"scancode 0x%02x on %s.\n",
-						__FILE__, data, lk->name);
+	case LK_ALL_KEYS_UP:
+		for (i = 0; i < ARRAY_SIZE(lkkbd_keycode); i++)
+			input_report_key(input_dev, lk->keycode[i], 0);
+		input_sync(input_dev);
+		break;
+
+	case 0x01:
+		DBG(KERN_INFO "Got 0x01, scheduling re-initialization\n");
+		lk->ignore_bytes = LK_NUM_IGNORE_BYTES;
+		lk->id[LK_NUM_IGNORE_BYTES - lk->ignore_bytes--] = data;
+		schedule_work(&lk->tq);
+		break;
+
+	case LK_METRONOME:
+	case LK_OUTPUT_ERROR:
+	case LK_INPUT_ERROR:
+	case LK_KBD_LOCKED:
+	case LK_KBD_TEST_MODE_ACK:
+	case LK_PREFIX_KEY_DOWN:
+	case LK_MODE_CHANGE_ACK:
+	case LK_RESPONSE_RESERVED:
+		DBG(KERN_INFO "Got %s and don't know how to handle...\n",
+			response_name(data));
+		break;
+
+	default:
+		keycode = lk->keycode[data];
+		if (keycode != KEY_RESERVED) {
+			input_report_key(input_dev, keycode,
+					 !test_bit(keycode, input_dev->key));
+			input_sync(input_dev);
+		} else {
+			printk(KERN_WARNING
+				"%s: Unknown key with scancode 0x%02x on %s.\n",
+				__FILE__, data, lk->name);
+		}
 	}
 
 	return IRQ_HANDLED;
 }
 
+static void lkkbd_toggle_leds(struct lkkbd *lk)
+{
+	struct serio *serio = lk->serio;
+	unsigned char leds_on = 0;
+	unsigned char leds_off = 0;
+
+	CHECK_LED(lk, leds_on, leds_off, LED_CAPSL, LK_LED_SHIFTLOCK);
+	CHECK_LED(lk, leds_on, leds_off, LED_COMPOSE, LK_LED_COMPOSE);
+	CHECK_LED(lk, leds_on, leds_off, LED_SCROLLL, LK_LED_SCROLLLOCK);
+	CHECK_LED(lk, leds_on, leds_off, LED_SLEEP, LK_LED_WAIT);
+	if (leds_on != 0) {
+		serio_write(serio, LK_CMD_LED_ON);
+		serio_write(serio, leds_on);
+	}
+	if (leds_off != 0) {
+		serio_write(serio, LK_CMD_LED_OFF);
+		serio_write(serio, leds_off);
+	}
+}
+
+static void lkkbd_toggle_keyclick(struct lkkbd *lk, bool on)
+{
+	struct serio *serio = lk->serio;
+
+	if (on) {
+		DBG("%s: Activating key clicks\n", __func__);
+		serio_write(serio, LK_CMD_ENABLE_KEYCLICK);
+		serio_write(serio, volume_to_hw(lk->keyclick_volume));
+		serio_write(serio, LK_CMD_ENABLE_CTRCLICK);
+		serio_write(serio, volume_to_hw(lk->ctrlclick_volume));
+	} else {
+		DBG("%s: Deactivating key clicks\n", __func__);
+		serio_write(serio, LK_CMD_DISABLE_KEYCLICK);
+		serio_write(serio, LK_CMD_DISABLE_CTRCLICK);
+	}
+
+}
+
 /*
  * lkkbd_event() handles events from the input module.
  */
-static int
-lkkbd_event (struct input_dev *dev, unsigned int type, unsigned int code,
-		int value)
+static int lkkbd_event(struct input_dev *dev,
+			unsigned int type, unsigned int code, int value)
 {
-	struct lkkbd *lk = input_get_drvdata (dev);
-	unsigned char leds_on = 0;
-	unsigned char leds_off = 0;
+	struct lkkbd *lk = input_get_drvdata(dev);
 
 	switch (type) {
-		case EV_LED:
-			CHECK_LED (lk, leds_on, leds_off, LED_CAPSL, LK_LED_SHIFTLOCK);
-			CHECK_LED (lk, leds_on, leds_off, LED_COMPOSE, LK_LED_COMPOSE);
-			CHECK_LED (lk, leds_on, leds_off, LED_SCROLLL, LK_LED_SCROLLLOCK);
-			CHECK_LED (lk, leds_on, leds_off, LED_SLEEP, LK_LED_WAIT);
-			if (leds_on != 0) {
-				serio_write (lk->serio, LK_CMD_LED_ON);
-				serio_write (lk->serio, leds_on);
-			}
-			if (leds_off != 0) {
-				serio_write (lk->serio, LK_CMD_LED_OFF);
-				serio_write (lk->serio, leds_off);
-			}
+	case EV_LED:
+		lkkbd_toggle_leds(lk);
+		return 0;
+
+	case EV_SND:
+		switch (code) {
+		case SND_CLICK:
+			lkkbd_toggle_keyclick(lk, value);
 			return 0;
 
-		case EV_SND:
-			switch (code) {
-				case SND_CLICK:
-					if (value == 0) {
-						DBG ("%s: Deactivating key clicks\n", __func__);
-						serio_write (lk->serio, LK_CMD_DISABLE_KEYCLICK);
-						serio_write (lk->serio, LK_CMD_DISABLE_CTRCLICK);
-					} else {
-						DBG ("%s: Activating key clicks\n", __func__);
-						serio_write (lk->serio, LK_CMD_ENABLE_KEYCLICK);
-						serio_write (lk->serio, volume_to_hw (lk->keyclick_volume));
-						serio_write (lk->serio, LK_CMD_ENABLE_CTRCLICK);
-						serio_write (lk->serio, volume_to_hw (lk->ctrlclick_volume));
-					}
-					return 0;
-
-				case SND_BELL:
-					if (value != 0)
-						serio_write (lk->serio, LK_CMD_SOUND_BELL);
-
-					return 0;
-			}
-			break;
-
-		default:
-			printk (KERN_ERR "%s (): Got unknown type %d, code %d, value %d\n",
-					__func__, type, code, value);
+		case SND_BELL:
+			if (value != 0)
+				serio_write(lk->serio, LK_CMD_SOUND_BELL);
+
+			return 0;
+		}
+
+		break;
+
+	default:
+		printk(KERN_ERR "%s(): Got unknown type %d, code %d, value %d\n",
+			__func__, type, code, value);
 	}
 
 	return -1;
@@ -570,79 +576,56 @@ lkkbd_event (struct input_dev *dev, unsigned int type, unsigned int code,
  * lkkbd_reinit() sets leds and beeps to a state the computer remembers they
  * were in.
  */
-static void
-lkkbd_reinit (struct work_struct *work)
+static void lkkbd_reinit(struct work_struct *work)
 {
 	struct lkkbd *lk = container_of(work, struct lkkbd, tq);
 	int division;
-	unsigned char leds_on = 0;
-	unsigned char leds_off = 0;
 
 	/* Ask for ID */
-	serio_write (lk->serio, LK_CMD_REQUEST_ID);
+	serio_write(lk->serio, LK_CMD_REQUEST_ID);
 
 	/* Reset parameters */
-	serio_write (lk->serio, LK_CMD_SET_DEFAULTS);
+	serio_write(lk->serio, LK_CMD_SET_DEFAULTS);
 
 	/* Set LEDs */
-	CHECK_LED (lk, leds_on, leds_off, LED_CAPSL, LK_LED_SHIFTLOCK);
-	CHECK_LED (lk, leds_on, leds_off, LED_COMPOSE, LK_LED_COMPOSE);
-	CHECK_LED (lk, leds_on, leds_off, LED_SCROLLL, LK_LED_SCROLLLOCK);
-	CHECK_LED (lk, leds_on, leds_off, LED_SLEEP, LK_LED_WAIT);
-	if (leds_on != 0) {
-		serio_write (lk->serio, LK_CMD_LED_ON);
-		serio_write (lk->serio, leds_on);
-	}
-	if (leds_off != 0) {
-		serio_write (lk->serio, LK_CMD_LED_OFF);
-		serio_write (lk->serio, leds_off);
-	}
+	lkkbd_toggle_leds(lk);
 
 	/*
 	 * Try to activate extended LK401 mode. This command will
 	 * only work with a LK401 keyboard and grants access to
 	 * LAlt, RAlt, RCompose and RShift.
 	 */
-	serio_write (lk->serio, LK_CMD_ENABLE_LK401);
+	serio_write(lk->serio, LK_CMD_ENABLE_LK401);
 
 	/* Set all keys to UPDOWN mode */
 	for (division = 1; division <= 14; division++)
-		serio_write (lk->serio, LK_CMD_SET_MODE (LK_MODE_UPDOWN,
-					division));
+		serio_write(lk->serio,
+			    LK_CMD_SET_MODE(LK_MODE_UPDOWN, division));
 
 	/* Enable bell and set volume */
-	serio_write (lk->serio, LK_CMD_ENABLE_BELL);
-	serio_write (lk->serio, volume_to_hw (lk->bell_volume));
+	serio_write(lk->serio, LK_CMD_ENABLE_BELL);
+	serio_write(lk->serio, volume_to_hw(lk->bell_volume));
 
 	/* Enable/disable keyclick (and possibly set volume) */
-	if (test_bit (SND_CLICK, lk->dev->snd)) {
-		serio_write (lk->serio, LK_CMD_ENABLE_KEYCLICK);
-		serio_write (lk->serio, volume_to_hw (lk->keyclick_volume));
-		serio_write (lk->serio, LK_CMD_ENABLE_CTRCLICK);
-		serio_write (lk->serio, volume_to_hw (lk->ctrlclick_volume));
-	} else {
-		serio_write (lk->serio, LK_CMD_DISABLE_KEYCLICK);
-		serio_write (lk->serio, LK_CMD_DISABLE_CTRCLICK);
-	}
+	lkkbd_toggle_keyclick(lk, test_bit(SND_CLICK, lk->dev->snd));
 
 	/* Sound the bell if needed */
-	if (test_bit (SND_BELL, lk->dev->snd))
-		serio_write (lk->serio, LK_CMD_SOUND_BELL);
+	if (test_bit(SND_BELL, lk->dev->snd))
+		serio_write(lk->serio, LK_CMD_SOUND_BELL);
 }
 
 /*
  * lkkbd_connect() probes for a LK keyboard and fills the necessary structures.
  */
-static int
-lkkbd_connect (struct serio *serio, struct serio_driver *drv)
+static int lkkbd_connect(struct serio *serio, struct serio_driver *drv)
 {
 	struct lkkbd *lk;
 	struct input_dev *input_dev;
 	int i;
 	int err;
 
-	lk = kzalloc (sizeof (struct lkkbd), GFP_KERNEL);
-	input_dev = input_allocate_device ();
+	lk = kzalloc(sizeof(struct lkkbd), GFP_KERNEL);
+	input_dev = input_allocate_device();
 	if (!lk || !input_dev) {
 		err = -ENOMEM;
 		goto fail1;
@@ -650,14 +633,14 @@ lkkbd_connect (struct serio *serio, struct serio_driver *drv)
 
 	lk->serio = serio;
 	lk->dev = input_dev;
-	INIT_WORK (&lk->tq, lkkbd_reinit);
+	INIT_WORK(&lk->tq, lkkbd_reinit);
 	lk->bell_volume = bell_volume;
 	lk->keyclick_volume = keyclick_volume;
 	lk->ctrlclick_volume = ctrlclick_volume;
-	memcpy (lk->keycode, lkkbd_keycode, sizeof (lk_keycode_t) * LK_NUM_KEYCODES);
+	memcpy(lk->keycode, lkkbd_keycode, sizeof(lk->keycode));
 
-	strlcpy (lk->name, "DEC LK keyboard", sizeof(lk->name));
-	snprintf (lk->phys, sizeof(lk->phys), "%s/input0", serio->phys);
+	strlcpy(lk->name, "DEC LK keyboard", sizeof(lk->name));
+	snprintf(lk->phys, sizeof(lk->phys), "%s/input0", serio->phys);
 
 	input_dev->name = lk->name;
 	input_dev->phys = lk->phys;
@@ -668,62 +651,61 @@ lkkbd_connect (struct serio *serio, struct serio_driver *drv)
 	input_dev->dev.parent = &serio->dev;
 	input_dev->event = lkkbd_event;
 
-	input_set_drvdata (input_dev, lk);
+	input_set_drvdata(input_dev, lk);
 
-	set_bit (EV_KEY, input_dev->evbit);
-	set_bit (EV_LED, input_dev->evbit);
-	set_bit (EV_SND, input_dev->evbit);
-	set_bit (EV_REP, input_dev->evbit);
-	set_bit (LED_CAPSL, input_dev->ledbit);
-	set_bit (LED_SLEEP, input_dev->ledbit);
-	set_bit (LED_COMPOSE, input_dev->ledbit);
-	set_bit (LED_SCROLLL, input_dev->ledbit);
-	set_bit (SND_BELL, input_dev->sndbit);
-	set_bit (SND_CLICK, input_dev->sndbit);
+	__set_bit(EV_KEY, input_dev->evbit);
+	__set_bit(EV_LED, input_dev->evbit);
+	__set_bit(EV_SND, input_dev->evbit);
+	__set_bit(EV_REP, input_dev->evbit);
+	__set_bit(LED_CAPSL, input_dev->ledbit);
+	__set_bit(LED_SLEEP, input_dev->ledbit);
+	__set_bit(LED_COMPOSE, input_dev->ledbit);
+	__set_bit(LED_SCROLLL, input_dev->ledbit);
+	__set_bit(SND_BELL, input_dev->sndbit);
+	__set_bit(SND_CLICK, input_dev->sndbit);
 
 	input_dev->keycode = lk->keycode;
-	input_dev->keycodesize = sizeof (lk_keycode_t);
-	input_dev->keycodemax = LK_NUM_KEYCODES;
+	input_dev->keycodesize = sizeof(lk->keycode[0]);
+	input_dev->keycodemax = ARRAY_SIZE(lk->keycode);
 
 	for (i = 0; i < LK_NUM_KEYCODES; i++)
-		__set_bit (lk->keycode[i], input_dev->keybit);
+		__set_bit(lk->keycode[i], input_dev->keybit);
 	__clear_bit(KEY_RESERVED, input_dev->keybit);
 
-	serio_set_drvdata (serio, lk);
+	serio_set_drvdata(serio, lk);
 
-	err = serio_open (serio, drv);
+	err = serio_open(serio, drv);
 	if (err)
 		goto fail2;
 
-	err = input_register_device (lk->dev);
+	err = input_register_device(lk->dev);
 	if (err)
 		goto fail3;
 
-	serio_write (lk->serio, LK_CMD_POWERCYCLE_RESET);
+	serio_write(lk->serio, LK_CMD_POWERCYCLE_RESET);
 
 	return 0;
 
- fail3:	serio_close (serio);
- fail2:	serio_set_drvdata (serio, NULL);
- fail1:	input_free_device (input_dev);
-	kfree (lk);
+ fail3:	serio_close(serio);
+ fail2:	serio_set_drvdata(serio, NULL);
+ fail1:	input_free_device(input_dev);
+	kfree(lk);
 	return err;
 }
 
 /*
  * lkkbd_disconnect() unregisters and closes behind us.
  */
-static void
-lkkbd_disconnect (struct serio *serio)
+static void lkkbd_disconnect(struct serio *serio)
 {
-	struct lkkbd *lk = serio_get_drvdata (serio);
-
-	input_get_device (lk->dev);
-	input_unregister_device (lk->dev);
-	serio_close (serio);
-	serio_set_drvdata (serio, NULL);
-	input_put_device (lk->dev);
-	kfree (lk);
+	struct lkkbd *lk = serio_get_drvdata(serio);
+
+	input_get_device(lk->dev);
+	input_unregister_device(lk->dev);
+	serio_close(serio);
+	serio_set_drvdata(serio, NULL);
+	input_put_device(lk->dev);
+	kfree(lk);
 }
 
 static struct serio_device_id lkkbd_serio_ids[] = {
@@ -752,18 +734,16 @@ static struct serio_driver lkkbd_drv = {
 /*
  * The functions for insering/removing us as a module.
  */
-static int __init
-lkkbd_init (void)
+static int __init lkkbd_init(void)
 {
 	return serio_register_driver(&lkkbd_drv);
 }
 
-static void __exit
-lkkbd_exit (void)
+static void __exit lkkbd_exit(void)
 {
 	serio_unregister_driver(&lkkbd_drv);
 }
 
-module_init (lkkbd_init);
-module_exit (lkkbd_exit);
+module_init(lkkbd_init);
+module_exit(lkkbd_exit);
 
diff --git a/drivers/input/keyboard/matrix_keypad.c b/drivers/input/keyboard/matrix_keypad.c
index 91cfe5170265..d3c8b61a941d 100644
--- a/drivers/input/keyboard/matrix_keypad.c
+++ b/drivers/input/keyboard/matrix_keypad.c
@@ -29,11 +29,13 @@ struct matrix_keypad {
 	unsigned short *keycodes;
 	unsigned int row_shift;
 
+	DECLARE_BITMAP(disabled_gpios, MATRIX_MAX_ROWS);
+
 	uint32_t last_key_state[MATRIX_MAX_COLS];
 	struct delayed_work work;
+	spinlock_t lock;
 	bool scan_pending;
 	bool stopped;
-	spinlock_t lock;
 };
 
 /*
@@ -213,38 +215,53 @@ static void matrix_keypad_stop(struct input_dev *dev)
 }
 
 #ifdef CONFIG_PM
-static int matrix_keypad_suspend(struct platform_device *pdev, pm_message_t state)
+static int matrix_keypad_suspend(struct device *dev)
 {
+	struct platform_device *pdev = to_platform_device(dev);
 	struct matrix_keypad *keypad = platform_get_drvdata(pdev);
 	const struct matrix_keypad_platform_data *pdata = keypad->pdata;
 	int i;
 
 	matrix_keypad_stop(keypad->input_dev);
 
-	if (device_may_wakeup(&pdev->dev))
-		for (i = 0; i < pdata->num_row_gpios; i++)
-			enable_irq_wake(gpio_to_irq(pdata->row_gpios[i]));
+	if (device_may_wakeup(&pdev->dev)) {
+		for (i = 0; i < pdata->num_row_gpios; i++) {
+			if (!test_bit(i, keypad->disabled_gpios)) {
+				unsigned int gpio = pdata->row_gpios[i];
+
+				if (enable_irq_wake(gpio_to_irq(gpio)) == 0)
+					__set_bit(i, keypad->disabled_gpios);
+			}
+		}
+	}
 
 	return 0;
 }
 
-static int matrix_keypad_resume(struct platform_device *pdev)
+static int matrix_keypad_resume(struct device *dev)
 {
+	struct platform_device *pdev = to_platform_device(dev);
 	struct matrix_keypad *keypad = platform_get_drvdata(pdev);
 	const struct matrix_keypad_platform_data *pdata = keypad->pdata;
 	int i;
 
-	if (device_may_wakeup(&pdev->dev))
-		for (i = 0; i < pdata->num_row_gpios; i++)
-			disable_irq_wake(gpio_to_irq(pdata->row_gpios[i]));
+	if (device_may_wakeup(&pdev->dev)) {
+		for (i = 0; i < pdata->num_row_gpios; i++) {
+			if (test_and_clear_bit(i, keypad->disabled_gpios)) {
+				unsigned int gpio = pdata->row_gpios[i];
+
+				disable_irq_wake(gpio_to_irq(gpio));
+			}
+		}
+	}
 
 	matrix_keypad_start(keypad->input_dev);
 
 	return 0;
 }
-#else
-#define matrix_keypad_suspend	NULL
-#define matrix_keypad_resume	NULL
+
+static const SIMPLE_DEV_PM_OPS(matrix_keypad_pm_ops,
+				matrix_keypad_suspend, matrix_keypad_resume);
 #endif
 
 static int __devinit init_matrix_gpio(struct platform_device *pdev,
@@ -417,11 +434,12 @@ static int __devexit matrix_keypad_remove(struct platform_device *pdev)
 static struct platform_driver matrix_keypad_driver = {
 	.probe		= matrix_keypad_probe,
 	.remove		= __devexit_p(matrix_keypad_remove),
-	.suspend	= matrix_keypad_suspend,
-	.resume		= matrix_keypad_resume,
 	.driver		= {
 		.name	= "matrix-keypad",
 		.owner	= THIS_MODULE,
+#ifdef CONFIG_PM
+		.pm	= &matrix_keypad_pm_ops,
+#endif
 	},
 };
 
diff --git a/drivers/input/keyboard/sh_keysc.c b/drivers/input/keyboard/sh_keysc.c
index 887af79b7bff..8e9380bfed40 100644
--- a/drivers/input/keyboard/sh_keysc.c
+++ b/drivers/input/keyboard/sh_keysc.c
@@ -18,9 +18,9 @@
 #include <linux/delay.h>
 #include <linux/platform_device.h>
 #include <linux/input.h>
+#include <linux/input/sh_keysc.h>
 #include <linux/clk.h>
 #include <linux/io.h>
-#include <asm/sh_keysc.h>
 
 #define KYCR1_OFFS   0x00
 #define KYCR2_OFFS   0x04
@@ -295,7 +295,7 @@ static int sh_keysc_resume(struct device *dev)
 	return 0;
 }
 
-static struct dev_pm_ops sh_keysc_dev_pm_ops = {
+static const struct dev_pm_ops sh_keysc_dev_pm_ops = {
 	.suspend = sh_keysc_suspend,
 	.resume = sh_keysc_resume,
 };
diff --git a/drivers/input/keyboard/twl4030_keypad.c b/drivers/input/keyboard/twl4030_keypad.c
index 9a2977c21696..21d6184efa96 100644
--- a/drivers/input/keyboard/twl4030_keypad.c
+++ b/drivers/input/keyboard/twl4030_keypad.c
@@ -31,7 +31,7 @@
 #include <linux/interrupt.h>
 #include <linux/input.h>
 #include <linux/platform_device.h>
-#include <linux/i2c/twl4030.h>
+#include <linux/i2c/twl.h>
 
 
 /*
@@ -133,7 +133,7 @@ struct twl4030_keypad {
 static int twl4030_kpread(struct twl4030_keypad *kp,
 		u8 *data, u32 reg, u8 num_bytes)
 {
-	int ret = twl4030_i2c_read(TWL4030_MODULE_KEYPAD, data, reg, num_bytes);
+	int ret = twl_i2c_read(TWL4030_MODULE_KEYPAD, data, reg, num_bytes);
 
 	if (ret < 0)
 		dev_warn(kp->dbg_dev,
@@ -145,7 +145,7 @@ static int twl4030_kpread(struct twl4030_keypad *kp,
 
 static int twl4030_kpwrite_u8(struct twl4030_keypad *kp, u8 data, u32 reg)
 {
-	int ret = twl4030_i2c_write_u8(TWL4030_MODULE_KEYPAD, data, reg);
+	int ret = twl_i2c_write_u8(TWL4030_MODULE_KEYPAD, data, reg);
 
 	if (ret < 0)
 		dev_warn(kp->dbg_dev,
@@ -253,14 +253,6 @@ static irqreturn_t do_kp_irq(int irq, void *_kp)
 	u8 reg;
 	int ret;
 
-#ifdef CONFIG_LOCKDEP
-	/* WORKAROUND for lockdep forcing IRQF_DISABLED on us, which
-	 * we don't want and can't tolerate.  Although it might be
-	 * friendlier not to borrow this thread context...
-	 */
-	local_irq_enable();
-#endif
-
 	/* Read & Clear TWL4030 pending interrupt */
 	ret = twl4030_kpread(kp, &reg, KEYP_ISR1, 1);
 
@@ -403,7 +395,8 @@ static int __devinit twl4030_kp_probe(struct platform_device *pdev)
 	 *
 	 * NOTE:  we assume this host is wired to TWL4040 INT1, not INT2 ...
 	 */
-	error = request_irq(kp->irq, do_kp_irq, 0, pdev->name, kp);
+	error = request_threaded_irq(kp->irq, NULL, do_kp_irq,
+			0, pdev->name, kp);
 	if (error) {
 		dev_info(kp->dbg_dev, "request_irq failed for irq no=%d\n",
 			kp->irq);
diff --git a/drivers/input/misc/Kconfig b/drivers/input/misc/Kconfig
index a9bb2544b2de..16ec5233441c 100644
--- a/drivers/input/misc/Kconfig
+++ b/drivers/input/misc/Kconfig
@@ -80,6 +80,7 @@ config INPUT_WISTRON_BTNS
 	tristate "x86 Wistron laptop button interface"
 	depends on X86 && !X86_64
 	select INPUT_POLLDEV
+	select INPUT_SPARSEKMAP
 	select NEW_LEDS
 	select LEDS_CLASS
 	select CHECK_SIGNATURE
@@ -281,6 +282,7 @@ config INPUT_RB532_BUTTON
 config INPUT_DM355EVM
 	tristate "TI DaVinci DM355 EVM Keypad and IR Remote"
 	depends on MFD_DM355EVM_MSP
+	select INPUT_SPARSEKMAP
 	help
 	  Supports the pushbuttons and IR remote used with
 	  the DM355 EVM board.
diff --git a/drivers/input/misc/ati_remote.c b/drivers/input/misc/ati_remote.c
index e290fde35e74..614b65d78fe9 100644
--- a/drivers/input/misc/ati_remote.c
+++ b/drivers/input/misc/ati_remote.c
@@ -766,7 +766,7 @@ static int ati_remote_probe(struct usb_interface *interface, const struct usb_de
 	ati_remote->interface = interface;
 
 	usb_make_path(udev, ati_remote->phys, sizeof(ati_remote->phys));
-	strlcpy(ati_remote->phys, "/input0", sizeof(ati_remote->phys));
+	strlcat(ati_remote->phys, "/input0", sizeof(ati_remote->phys));
 
 	if (udev->manufacturer)
 		strlcpy(ati_remote->name, udev->manufacturer, sizeof(ati_remote->name));
diff --git a/drivers/input/misc/bfin_rotary.c b/drivers/input/misc/bfin_rotary.c
index 690f3fafa03b..61d10177fa83 100644
--- a/drivers/input/misc/bfin_rotary.c
+++ b/drivers/input/misc/bfin_rotary.c
@@ -247,7 +247,7 @@ static int bfin_rotary_resume(struct device *dev)
 	return 0;
 }
 
-static struct dev_pm_ops bfin_rotary_pm_ops = {
+static const struct dev_pm_ops bfin_rotary_pm_ops = {
 	.suspend	= bfin_rotary_suspend,
 	.resume		= bfin_rotary_resume,
 };
diff --git a/drivers/input/misc/dm355evm_keys.c b/drivers/input/misc/dm355evm_keys.c
index f2b67dc81d80..766c06911f41 100644
--- a/drivers/input/misc/dm355evm_keys.c
+++ b/drivers/input/misc/dm355evm_keys.c
@@ -11,6 +11,7 @@
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/input.h>
+#include <linux/input/sparse-keymap.h>
 #include <linux/platform_device.h>
 #include <linux/interrupt.h>
 
@@ -33,12 +34,8 @@ struct dm355evm_keys {
 	int			irq;
 };
 
-/* These initial keycodes can be remapped by dm355evm_setkeycode(). */
-static struct {
-	u16	event;
-	u16	keycode;
-} dm355evm_keys[] = {
-
+/* These initial keycodes can be remapped */
+static const struct key_entry dm355evm_keys[] = {
 	/*
 	 * Pushbuttons on the EVM board ... note that the labels for these
 	 * are SW10/SW11/etc on the PC board.  The left/right orientation
@@ -47,11 +44,11 @@ static struct {
 	 * is to the right.  (That is, rotate the board counter-clockwise
 	 * by 90 degrees from the SW10/etc and "DM355 EVM" labels.)
 	 */
-	{ 0x00d8, KEY_OK, },		/* SW12 */
-	{ 0x00b8, KEY_UP, },		/* SW13 */
-	{ 0x00e8, KEY_DOWN, },		/* SW11 */
-	{ 0x0078, KEY_LEFT, },		/* SW14 */
-	{ 0x00f0, KEY_RIGHT, },		/* SW10 */
+	{ KE_KEY, 0x00d8, { KEY_OK } },		/* SW12 */
+	{ KE_KEY, 0x00b8, { KEY_UP } },		/* SW13 */
+	{ KE_KEY, 0x00e8, { KEY_DOWN } },	/* SW11 */
+	{ KE_KEY, 0x0078, { KEY_LEFT } },	/* SW14 */
+	{ KE_KEY, 0x00f0, { KEY_RIGHT } },	/* SW10 */
 
 	/*
 	 * IR buttons ... codes assigned to match the universal remote
@@ -65,35 +62,35 @@ static struct {
 	 * RC5 codes are 14 bits, with two start bits (0x3 prefix)
 	 * and a toggle bit (masked out below).
 	 */
-	{ 0x300c, KEY_POWER, },		/* NOTE: docs omit this */
-	{ 0x3000, KEY_NUMERIC_0, },
-	{ 0x3001, KEY_NUMERIC_1, },
-	{ 0x3002, KEY_NUMERIC_2, },
-	{ 0x3003, KEY_NUMERIC_3, },
-	{ 0x3004, KEY_NUMERIC_4, },
-	{ 0x3005, KEY_NUMERIC_5, },
-	{ 0x3006, KEY_NUMERIC_6, },
-	{ 0x3007, KEY_NUMERIC_7, },
-	{ 0x3008, KEY_NUMERIC_8, },
-	{ 0x3009, KEY_NUMERIC_9, },
-	{ 0x3022, KEY_ENTER, },
-	{ 0x30ec, KEY_MODE, },		/* "tv/vcr/..." */
-	{ 0x300f, KEY_SELECT, },	/* "info" */
-	{ 0x3020, KEY_CHANNELUP, },	/* "up" */
-	{ 0x302e, KEY_MENU, },		/* "in/out" */
-	{ 0x3011, KEY_VOLUMEDOWN, },	/* "left" */
-	{ 0x300d, KEY_MUTE, },		/* "ok" */
-	{ 0x3010, KEY_VOLUMEUP, },	/* "right" */
-	{ 0x301e, KEY_SUBTITLE, },	/* "cc" */
-	{ 0x3021, KEY_CHANNELDOWN, },	/* "down" */
-	{ 0x3022, KEY_PREVIOUS, },
-	{ 0x3026, KEY_SLEEP, },
-	{ 0x3172, KEY_REWIND, },	/* NOTE: docs wrongly say 0x30ca */
-	{ 0x3175, KEY_PLAY, },
-	{ 0x3174, KEY_FASTFORWARD, },
-	{ 0x3177, KEY_RECORD, },
-	{ 0x3176, KEY_STOP, },
-	{ 0x3169, KEY_PAUSE, },
+	{ KE_KEY, 0x300c, { KEY_POWER } },	/* NOTE: docs omit this */
+	{ KE_KEY, 0x3000, { KEY_NUMERIC_0 } },
+	{ KE_KEY, 0x3001, { KEY_NUMERIC_1 } },
+	{ KE_KEY, 0x3002, { KEY_NUMERIC_2 } },
+	{ KE_KEY, 0x3003, { KEY_NUMERIC_3 } },
+	{ KE_KEY, 0x3004, { KEY_NUMERIC_4 } },
+	{ KE_KEY, 0x3005, { KEY_NUMERIC_5 } },
+	{ KE_KEY, 0x3006, { KEY_NUMERIC_6 } },
+	{ KE_KEY, 0x3007, { KEY_NUMERIC_7 } },
+	{ KE_KEY, 0x3008, { KEY_NUMERIC_8 } },
+	{ KE_KEY, 0x3009, { KEY_NUMERIC_9 } },
+	{ KE_KEY, 0x3022, { KEY_ENTER } },
+	{ KE_KEY, 0x30ec, { KEY_MODE } },	/* "tv/vcr/..." */
+	{ KE_KEY, 0x300f, { KEY_SELECT } },	/* "info" */
+	{ KE_KEY, 0x3020, { KEY_CHANNELUP } },	/* "up" */
+	{ KE_KEY, 0x302e, { KEY_MENU } },	/* "in/out" */
+	{ KE_KEY, 0x3011, { KEY_VOLUMEDOWN } },	/* "left" */
+	{ KE_KEY, 0x300d, { KEY_MUTE } },	/* "ok" */
+	{ KE_KEY, 0x3010, { KEY_VOLUMEUP } },	/* "right" */
+	{ KE_KEY, 0x301e, { KEY_SUBTITLE } },	/* "cc" */
+	{ KE_KEY, 0x3021, { KEY_CHANNELDOWN } },/* "down" */
+	{ KE_KEY, 0x3022, { KEY_PREVIOUS } },
+	{ KE_KEY, 0x3026, { KEY_SLEEP } },
+	{ KE_KEY, 0x3172, { KEY_REWIND } },	/* NOTE: docs wrongly say 0x30ca */
+	{ KE_KEY, 0x3175, { KEY_PLAY } },
+	{ KE_KEY, 0x3174, { KEY_FASTFORWARD } },
+	{ KE_KEY, 0x3177, { KEY_RECORD } },
+	{ KE_KEY, 0x3176, { KEY_STOP } },
+	{ KE_KEY, 0x3169, { KEY_PAUSE } },
 };
 
 /*
@@ -105,19 +102,18 @@ static struct {
  */
 static irqreturn_t dm355evm_keys_irq(int irq, void *_keys)
 {
-	struct dm355evm_keys	*keys = _keys;
-	int			status;
+	static u16 last_event;
+	struct dm355evm_keys *keys = _keys;
+	const struct key_entry *ke;
+	unsigned int keycode;
+	int status;
+	u16 event;
 
 	/* For simplicity we ignore INPUT_COUNT and just read
 	 * events until we get the "queue empty" indicator.
 	 * Reading INPUT_LOW decrements the count.
 	 */
 	for (;;) {
-		static u16	last_event;
-		u16		event;
-		int		keycode;
-		int		i;
-
 		status = dm355evm_msp_read(DM355EVM_MSP_INPUT_HIGH);
 		if (status < 0) {
 			dev_dbg(keys->dev, "input high err %d\n",
@@ -156,14 +152,9 @@ static irqreturn_t dm355evm_keys_irq(int irq, void *_keys)
 		/* ignore the RC5 toggle bit */
 		event &= ~0x0800;
 
-		/* find the key, or leave it as unknown */
-		keycode = KEY_UNKNOWN;
-		for (i = 0; i < ARRAY_SIZE(dm355evm_keys); i++) {
-			if (dm355evm_keys[i].event != event)
-				continue;
-			keycode = dm355evm_keys[i].keycode;
-			break;
-		}
+		/* find the key, or report it as unknown */
+		ke = sparse_keymap_entry_from_scancode(keys->input, event);
+		keycode = ke ? ke->keycode : KEY_UNKNOWN;
 		dev_dbg(keys->dev,
 			"input event 0x%04x--> keycode %d\n",
 			event, keycode);
@@ -174,36 +165,8 @@ static irqreturn_t dm355evm_keys_irq(int irq, void *_keys)
 		input_report_key(keys->input, keycode, 0);
 		input_sync(keys->input);
 	}
-	return IRQ_HANDLED;
-}
 
-static int dm355evm_setkeycode(struct input_dev *dev, int index, int keycode)
-{
-	u16		old_keycode;
-	unsigned	i;
-
-	if (((unsigned)index) >= ARRAY_SIZE(dm355evm_keys))
-		return -EINVAL;
-
-	old_keycode = dm355evm_keys[index].keycode;
-	dm355evm_keys[index].keycode = keycode;
-	set_bit(keycode, dev->keybit);
-
-	for (i = 0; i < ARRAY_SIZE(dm355evm_keys); i++) {
-		if (dm355evm_keys[index].keycode == old_keycode)
-			goto done;
-	}
-	clear_bit(old_keycode, dev->keybit);
-done:
-	return 0;
-}
-
-static int dm355evm_getkeycode(struct input_dev *dev, int index, int *keycode)
-{
-	if (((unsigned)index) >= ARRAY_SIZE(dm355evm_keys))
-		return -EINVAL;
-
-	return dm355evm_keys[index].keycode;
+	return IRQ_HANDLED;
 }
 
 /*----------------------------------------------------------------------*/
@@ -213,7 +176,6 @@ static int __devinit dm355evm_keys_probe(struct platform_device *pdev)
 	struct dm355evm_keys	*keys;
 	struct input_dev	*input;
 	int			status;
-	int			i;
 
 	/* allocate instance struct and input dev */
 	keys = kzalloc(sizeof *keys, GFP_KERNEL);
@@ -242,31 +204,30 @@ static int __devinit dm355evm_keys_probe(struct platform_device *pdev)
 	input->id.product = 0x0355;
 	input->id.version = dm355evm_msp_read(DM355EVM_MSP_FIRMREV);
 
-	input->evbit[0] = BIT(EV_KEY);
-	for (i = 0; i < ARRAY_SIZE(dm355evm_keys); i++)
-		__set_bit(dm355evm_keys[i].keycode, input->keybit);
-
-	input->setkeycode = dm355evm_setkeycode;
-	input->getkeycode = dm355evm_getkeycode;
+	status = sparse_keymap_setup(input, dm355evm_keys, NULL);
+	if (status)
+		goto fail1;
 
 	/* REVISIT:  flush the event queue? */
 
 	status = request_threaded_irq(keys->irq, NULL, dm355evm_keys_irq,
 			IRQF_TRIGGER_FALLING, dev_name(&pdev->dev), keys);
 	if (status < 0)
-		goto fail1;
+		goto fail2;
 
 	/* register */
 	status = input_register_device(input);
 	if (status < 0)
-		goto fail2;
+		goto fail3;
 
 	platform_set_drvdata(pdev, keys);
 
 	return 0;
 
-fail2:
+fail3:
 	free_irq(keys->irq, keys);
+fail2:
+	sparse_keymap_free(input);
 fail1:
 	input_free_device(input);
 	kfree(keys);
@@ -280,6 +241,7 @@ static int __devexit dm355evm_keys_remove(struct platform_device *pdev)
 	struct dm355evm_keys	*keys = platform_get_drvdata(pdev);
 
 	free_irq(keys->irq, keys);
+	sparse_keymap_free(keys->input);
 	input_unregister_device(keys->input);
 	kfree(keys);
 
diff --git a/drivers/input/misc/hp_sdc_rtc.c b/drivers/input/misc/hp_sdc_rtc.c
index ea821b546969..ad730e15afc0 100644
--- a/drivers/input/misc/hp_sdc_rtc.c
+++ b/drivers/input/misc/hp_sdc_rtc.c
@@ -35,7 +35,6 @@
 
 #include <linux/hp_sdc.h>
 #include <linux/errno.h>
-#include <linux/smp_lock.h>
 #include <linux/types.h>
 #include <linux/init.h>
 #include <linux/module.h>
@@ -409,7 +408,6 @@ static unsigned int hp_sdc_rtc_poll(struct file *file, poll_table *wait)
 
 static int hp_sdc_rtc_open(struct inode *inode, struct file *file)
 {
-	cycle_kernel_lock();
         return 0;
 }
 
diff --git a/drivers/input/misc/pcf50633-input.c b/drivers/input/misc/pcf50633-input.c
index 039dcb00ebd9..008de0c5834b 100644
--- a/drivers/input/misc/pcf50633-input.c
+++ b/drivers/input/misc/pcf50633-input.c
@@ -55,7 +55,6 @@ pcf50633_input_irq(int irq, void *data)
 static int __devinit pcf50633_input_probe(struct platform_device *pdev)
 {
 	struct pcf50633_input *input;
-	struct pcf50633_subdev_pdata *pdata = pdev->dev.platform_data;
 	struct input_dev *input_dev;
 	int ret;
 
@@ -71,7 +70,7 @@ static int __devinit pcf50633_input_probe(struct platform_device *pdev)
 	}
 
 	platform_set_drvdata(pdev, input);
-	input->pcf = pdata->pcf;
+	input->pcf = dev_to_pcf50633(pdev->dev.parent);
 	input->input_dev = input_dev;
 
 	input_dev->name = "PCF50633 PMU events";
@@ -85,9 +84,9 @@ static int __devinit pcf50633_input_probe(struct platform_device *pdev)
 		kfree(input);
 		return ret;
 	}
-	pcf50633_register_irq(pdata->pcf, PCF50633_IRQ_ONKEYR,
+	pcf50633_register_irq(input->pcf, PCF50633_IRQ_ONKEYR,
 				pcf50633_input_irq, input);
-	pcf50633_register_irq(pdata->pcf, PCF50633_IRQ_ONKEYF,
+	pcf50633_register_irq(input->pcf, PCF50633_IRQ_ONKEYF,
 				pcf50633_input_irq, input);
 
 	return 0;
diff --git a/drivers/input/misc/pcspkr.c b/drivers/input/misc/pcspkr.c
index 21cb755a54fb..ea4e1fd12651 100644
--- a/drivers/input/misc/pcspkr.c
+++ b/drivers/input/misc/pcspkr.c
@@ -127,7 +127,7 @@ static void pcspkr_shutdown(struct platform_device *dev)
 	pcspkr_event(NULL, EV_SND, SND_BELL, 0);
 }
 
-static struct dev_pm_ops pcspkr_pm_ops = {
+static const struct dev_pm_ops pcspkr_pm_ops = {
 	.suspend = pcspkr_suspend,
 };
 
diff --git a/drivers/input/misc/powermate.c b/drivers/input/misc/powermate.c
index a53c4885fbad..668913d12044 100644
--- a/drivers/input/misc/powermate.c
+++ b/drivers/input/misc/powermate.c
@@ -338,7 +338,7 @@ static int powermate_probe(struct usb_interface *intf, const struct usb_device_i
 	pm->input = input_dev;
 
 	usb_make_path(udev, pm->phys, sizeof(pm->phys));
-	strlcpy(pm->phys, "/input0", sizeof(pm->phys));
+	strlcat(pm->phys, "/input0", sizeof(pm->phys));
 
 	spin_lock_init(&pm->lock);
 
diff --git a/drivers/input/misc/twl4030-pwrbutton.c b/drivers/input/misc/twl4030-pwrbutton.c
index f5fc9974a111..e9069b87fde2 100644
--- a/drivers/input/misc/twl4030-pwrbutton.c
+++ b/drivers/input/misc/twl4030-pwrbutton.c
@@ -27,7 +27,7 @@
 #include <linux/input.h>
 #include <linux/interrupt.h>
 #include <linux/platform_device.h>
-#include <linux/i2c/twl4030.h>
+#include <linux/i2c/twl.h>
 
 #define PWR_PWRON_IRQ (1 << 0)
 
@@ -39,18 +39,8 @@ static irqreturn_t powerbutton_irq(int irq, void *_pwr)
 	int err;
 	u8 value;
 
-#ifdef CONFIG_LOCKDEP
-	/* WORKAROUND for lockdep forcing IRQF_DISABLED on us, which
-	 * we don't want and can't tolerate since this is a threaded
-	 * IRQ and can sleep due to the i2c reads it has to issue.
-	 * Although it might be friendlier not to borrow this thread
-	 * context...
-	 */
-	local_irq_enable();
-#endif
-
-	err = twl4030_i2c_read_u8(TWL4030_MODULE_PM_MASTER, &value,
-				  STS_HW_CONDITIONS);
+	err = twl_i2c_read_u8(TWL4030_MODULE_PM_MASTER, &value,
+				STS_HW_CONDITIONS);
 	if (!err)  {
 		input_report_key(pwr, KEY_POWER, value & PWR_PWRON_IRQ);
 		input_sync(pwr);
@@ -80,7 +70,7 @@ static int __devinit twl4030_pwrbutton_probe(struct platform_device *pdev)
 	pwr->phys = "twl4030_pwrbutton/input0";
 	pwr->dev.parent = &pdev->dev;
 
-	err = request_irq(irq, powerbutton_irq,
+	err = request_threaded_irq(irq, NULL, powerbutton_irq,
 			IRQF_TRIGGER_FALLING | IRQF_TRIGGER_RISING,
 			"twl4030_pwrbutton", pwr);
 	if (err < 0) {
diff --git a/drivers/input/misc/wistron_btns.c b/drivers/input/misc/wistron_btns.c
index a932179c4c9e..c0afb71a3a6d 100644
--- a/drivers/input/misc/wistron_btns.c
+++ b/drivers/input/misc/wistron_btns.c
@@ -21,6 +21,7 @@
 #include <linux/dmi.h>
 #include <linux/init.h>
 #include <linux/input-polldev.h>
+#include <linux/input/sparse-keymap.h>
 #include <linux/interrupt.h>
 #include <linux/jiffies.h>
 #include <linux/kernel.h>
@@ -224,19 +225,8 @@ static void bios_set_state(u8 subsys, int enable)
 
 /* Hardware database */
 
-struct key_entry {
-	char type;		/* See KE_* below */
-	u8 code;
-	union {
-		u16 keycode;		/* For KE_KEY */
-		struct {		/* For KE_SW */
-			u8 code;
-			u8 value;
-		} sw;
-	};
-};
-
-enum { KE_END, KE_KEY, KE_SW, KE_WIFI, KE_BLUETOOTH };
+#define KE_WIFI		(KE_LAST + 1)
+#define KE_BLUETOOTH	(KE_LAST + 2)
 
 #define FE_MAIL_LED 0x01
 #define FE_WIFI_LED 0x02
@@ -644,10 +634,10 @@ static struct key_entry keymap_prestigio[] __initdata = {
  * a list of buttons and their key codes (reported when loading this module
  * with force=1) and the output of dmidecode to $MODULE_AUTHOR.
  */
-static struct dmi_system_id dmi_ids[] __initdata = {
+static const struct dmi_system_id __initconst dmi_ids[] = {
 	{
+		/* Fujitsu-Siemens Amilo Pro V2000 */
 		.callback = dmi_matched,
-		.ident = "Fujitsu-Siemens Amilo Pro V2000",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "AMILO Pro V2000"),
@@ -655,8 +645,8 @@ static struct dmi_system_id dmi_ids[] __initdata = {
 		.driver_data = keymap_fs_amilo_pro_v2000
 	},
 	{
+		/* Fujitsu-Siemens Amilo Pro Edition V3505 */
 		.callback = dmi_matched,
-		.ident = "Fujitsu-Siemens Amilo Pro Edition V3505",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "AMILO Pro Edition V3505"),
@@ -664,8 +654,8 @@ static struct dmi_system_id dmi_ids[] __initdata = {
 		.driver_data = keymap_fs_amilo_pro_v3505
 	},
 	{
+		/* Fujitsu-Siemens Amilo M7400 */
 		.callback = dmi_matched,
-		.ident = "Fujitsu-Siemens Amilo M7400",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "AMILO M        "),
@@ -673,8 +663,8 @@ static struct dmi_system_id dmi_ids[] __initdata = {
 		.driver_data = keymap_fs_amilo_pro_v2000
 	},
 	{
+		/* Maxdata Pro 7000 DX */
 		.callback = dmi_matched,
-		.ident = "Maxdata Pro 7000 DX",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "MAXDATA"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "Pro 7000"),
@@ -682,8 +672,8 @@ static struct dmi_system_id dmi_ids[] __initdata = {
 		.driver_data = keymap_fs_amilo_pro_v2000
 	},
 	{
+		/* Fujitsu N3510 */
 		.callback = dmi_matched,
-		.ident = "Fujitsu N3510",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "N3510"),
@@ -691,8 +681,8 @@ static struct dmi_system_id dmi_ids[] __initdata = {
 		.driver_data = keymap_fujitsu_n3510
 	},
 	{
+		/* Acer Aspire 1500 */
 		.callback = dmi_matched,
-		.ident = "Acer Aspire 1500",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 1500"),
@@ -700,8 +690,8 @@ static struct dmi_system_id dmi_ids[] __initdata = {
 		.driver_data = keymap_acer_aspire_1500
 	},
 	{
+		/* Acer Aspire 1600 */
 		.callback = dmi_matched,
-		.ident = "Acer Aspire 1600",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 1600"),
@@ -709,8 +699,8 @@ static struct dmi_system_id dmi_ids[] __initdata = {
 		.driver_data = keymap_acer_aspire_1600
 	},
 	{
+		/* Acer Aspire 3020 */
 		.callback = dmi_matched,
-		.ident = "Acer Aspire 3020",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 3020"),
@@ -718,8 +708,8 @@ static struct dmi_system_id dmi_ids[] __initdata = {
 		.driver_data = keymap_acer_aspire_5020
 	},
 	{
+		/* Acer Aspire 5020 */
 		.callback = dmi_matched,
-		.ident = "Acer Aspire 5020",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5020"),
@@ -727,8 +717,8 @@ static struct dmi_system_id dmi_ids[] __initdata = {
 		.driver_data = keymap_acer_aspire_5020
 	},
 	{
+		/* Acer TravelMate 2100 */
 		.callback = dmi_matched,
-		.ident = "Acer TravelMate 2100",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 2100"),
@@ -736,8 +726,8 @@ static struct dmi_system_id dmi_ids[] __initdata = {
 		.driver_data = keymap_acer_aspire_5020
 	},
 	{
+		/* Acer TravelMate 2410 */
 		.callback = dmi_matched,
-		.ident = "Acer TravelMate 2410",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 2410"),
@@ -745,8 +735,8 @@ static struct dmi_system_id dmi_ids[] __initdata = {
 		.driver_data = keymap_acer_travelmate_2410
 	},
 	{
+		/* Acer TravelMate C300 */
 		.callback = dmi_matched,
-		.ident = "Acer TravelMate C300",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate C300"),
@@ -754,8 +744,8 @@ static struct dmi_system_id dmi_ids[] __initdata = {
 		.driver_data = keymap_acer_travelmate_300
 	},
 	{
+		/* Acer TravelMate C100 */
 		.callback = dmi_matched,
-		.ident = "Acer TravelMate C100",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate C100"),
@@ -763,8 +753,8 @@ static struct dmi_system_id dmi_ids[] __initdata = {
 		.driver_data = keymap_acer_travelmate_300
 	},
 	{
+		/* Acer TravelMate C110 */
 		.callback = dmi_matched,
-		.ident = "Acer TravelMate C110",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate C110"),
@@ -772,8 +762,8 @@ static struct dmi_system_id dmi_ids[] __initdata = {
 		.driver_data = keymap_acer_travelmate_110
 	},
 	{
+		/* Acer TravelMate 380 */
 		.callback = dmi_matched,
-		.ident = "Acer TravelMate 380",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 380"),
@@ -781,8 +771,8 @@ static struct dmi_system_id dmi_ids[] __initdata = {
 		.driver_data = keymap_acer_travelmate_380
 	},
 	{
+		/* Acer TravelMate 370 */
 		.callback = dmi_matched,
-		.ident = "Acer TravelMate 370",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 370"),
@@ -790,8 +780,8 @@ static struct dmi_system_id dmi_ids[] __initdata = {
 		.driver_data = keymap_acer_travelmate_380 /* keyboard minus 1 key */
 	},
 	{
+		/* Acer TravelMate 220 */
 		.callback = dmi_matched,
-		.ident = "Acer TravelMate 220",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 220"),
@@ -799,8 +789,8 @@ static struct dmi_system_id dmi_ids[] __initdata = {
 		.driver_data = keymap_acer_travelmate_220
 	},
 	{
+		/* Acer TravelMate 260 */
 		.callback = dmi_matched,
-		.ident = "Acer TravelMate 260",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 260"),
@@ -808,8 +798,8 @@ static struct dmi_system_id dmi_ids[] __initdata = {
 		.driver_data = keymap_acer_travelmate_220
 	},
 	{
+		/* Acer TravelMate 230 */
 		.callback = dmi_matched,
-		.ident = "Acer TravelMate 230",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 230"),
@@ -818,8 +808,8 @@ static struct dmi_system_id dmi_ids[] __initdata = {
 		.driver_data = keymap_acer_travelmate_230
 	},
 	{
+		/* Acer TravelMate 280 */
 		.callback = dmi_matched,
-		.ident = "Acer TravelMate 280",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 280"),
@@ -827,8 +817,8 @@ static struct dmi_system_id dmi_ids[] __initdata = {
 		.driver_data = keymap_acer_travelmate_230
 	},
 	{
+		/* Acer TravelMate 240 */
 		.callback = dmi_matched,
-		.ident = "Acer TravelMate 240",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 240"),
@@ -836,8 +826,8 @@ static struct dmi_system_id dmi_ids[] __initdata = {
 		.driver_data = keymap_acer_travelmate_240
 	},
 	{
+		/* Acer TravelMate 250 */
 		.callback = dmi_matched,
-		.ident = "Acer TravelMate 250",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 250"),
@@ -845,8 +835,8 @@ static struct dmi_system_id dmi_ids[] __initdata = {
 		.driver_data = keymap_acer_travelmate_240
 	},
 	{
+		/* Acer TravelMate 2424NWXCi */
 		.callback = dmi_matched,
-		.ident = "Acer TravelMate 2424NWXCi",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 2420"),
@@ -854,8 +844,8 @@ static struct dmi_system_id dmi_ids[] __initdata = {
 		.driver_data = keymap_acer_travelmate_240
 	},
 	{
+		/* Acer TravelMate 350 */
 		.callback = dmi_matched,
-		.ident = "Acer TravelMate 350",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 350"),
@@ -863,8 +853,8 @@ static struct dmi_system_id dmi_ids[] __initdata = {
 		.driver_data = keymap_acer_travelmate_350
 	},
 	{
+		/* Acer TravelMate 360 */
 		.callback = dmi_matched,
-		.ident = "Acer TravelMate 360",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 360"),
@@ -872,8 +862,8 @@ static struct dmi_system_id dmi_ids[] __initdata = {
 		.driver_data = keymap_acer_travelmate_360
 	},
 	{
+		/* Acer TravelMate 610 */
 		.callback = dmi_matched,
-		.ident = "Acer TravelMate 610",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "ACER"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 610"),
@@ -881,8 +871,8 @@ static struct dmi_system_id dmi_ids[] __initdata = {
 		.driver_data = keymap_acer_travelmate_610
 	},
 	{
+		/* Acer TravelMate 620 */
 		.callback = dmi_matched,
-		.ident = "Acer TravelMate 620",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 620"),
@@ -890,8 +880,8 @@ static struct dmi_system_id dmi_ids[] __initdata = {
 		.driver_data = keymap_acer_travelmate_630
 	},
 	{
+		/* Acer TravelMate 630 */
 		.callback = dmi_matched,
-		.ident = "Acer TravelMate 630",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 630"),
@@ -899,8 +889,8 @@ static struct dmi_system_id dmi_ids[] __initdata = {
 		.driver_data = keymap_acer_travelmate_630
 	},
 	{
+		/* AOpen 1559AS */
 		.callback = dmi_matched,
-		.ident = "AOpen 1559AS",
 		.matches = {
 			DMI_MATCH(DMI_PRODUCT_NAME, "E2U"),
 			DMI_MATCH(DMI_BOARD_NAME, "E2U"),
@@ -908,8 +898,8 @@ static struct dmi_system_id dmi_ids[] __initdata = {
 		.driver_data = keymap_aopen_1559as
 	},
 	{
+		/* Medion MD 9783 */
 		.callback = dmi_matched,
-		.ident = "Medion MD 9783",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "MEDIONNB"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "MD 9783"),
@@ -917,8 +907,8 @@ static struct dmi_system_id dmi_ids[] __initdata = {
 		.driver_data = keymap_wistron_ms2111
 	},
 	{
+		/* Medion MD 40100 */
 		.callback = dmi_matched,
-		.ident = "Medion MD 40100",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "MEDIONNB"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "WID2000"),
@@ -926,8 +916,8 @@ static struct dmi_system_id dmi_ids[] __initdata = {
 		.driver_data = keymap_wistron_md40100
 	},
 	{
+		/* Medion MD 2900 */
 		.callback = dmi_matched,
-		.ident = "Medion MD 2900",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "MEDIONNB"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "WIM 2000"),
@@ -935,8 +925,8 @@ static struct dmi_system_id dmi_ids[] __initdata = {
 		.driver_data = keymap_wistron_md2900
 	},
 	{
+		/* Medion MD 42200 */
 		.callback = dmi_matched,
-		.ident = "Medion MD 42200",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Medion"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "WIM 2030"),
@@ -944,8 +934,8 @@ static struct dmi_system_id dmi_ids[] __initdata = {
 		.driver_data = keymap_fs_amilo_pro_v2000
 	},
 	{
+		/* Medion MD 96500 */
 		.callback = dmi_matched,
-		.ident = "Medion MD 96500",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "MEDIONPC"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "WIM 2040"),
@@ -953,8 +943,8 @@ static struct dmi_system_id dmi_ids[] __initdata = {
 		.driver_data = keymap_wistron_md96500
 	},
 	{
+		/* Medion MD 95400 */
 		.callback = dmi_matched,
-		.ident = "Medion MD 95400",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "MEDIONPC"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "WIM 2050"),
@@ -962,8 +952,8 @@ static struct dmi_system_id dmi_ids[] __initdata = {
 		.driver_data = keymap_wistron_md96500
 	},
 	{
+		/* Fujitsu Siemens Amilo D7820 */
 		.callback = dmi_matched,
-		.ident = "Fujitsu Siemens Amilo D7820",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"), /* not sure */
 			DMI_MATCH(DMI_PRODUCT_NAME, "Amilo D"),
@@ -971,8 +961,8 @@ static struct dmi_system_id dmi_ids[] __initdata = {
 		.driver_data = keymap_fs_amilo_d88x0
 	},
 	{
+		/* Fujitsu Siemens Amilo D88x0 */
 		.callback = dmi_matched,
-		.ident = "Fujitsu Siemens Amilo D88x0",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "AMILO D"),
@@ -1037,21 +1027,6 @@ static unsigned long jiffies_last_press;
 static bool wifi_enabled;
 static bool bluetooth_enabled;
 
-static void report_key(struct input_dev *dev, unsigned int keycode)
-{
-	input_report_key(dev, keycode, 1);
-	input_sync(dev);
-	input_report_key(dev, keycode, 0);
-	input_sync(dev);
-}
-
-static void report_switch(struct input_dev *dev, unsigned int code, int value)
-{
-	input_report_switch(dev, code, value);
-	input_sync(dev);
-}
-
-
  /* led management */
 static void wistron_mail_led_set(struct led_classdev *led_cdev,
 				enum led_brightness value)
@@ -1128,43 +1103,13 @@ static inline void wistron_led_resume(void)
 		led_classdev_resume(&wistron_wifi_led);
 }
 
-static struct key_entry *wistron_get_entry_by_scancode(int code)
-{
-	struct key_entry *key;
-
-	for (key = keymap; key->type != KE_END; key++)
-		if (code == key->code)
-			return key;
-
-	return NULL;
-}
-
-static struct key_entry *wistron_get_entry_by_keycode(int keycode)
-{
-	struct key_entry *key;
-
-	for (key = keymap; key->type != KE_END; key++)
-		if (key->type == KE_KEY && keycode == key->keycode)
-			return key;
-
-	return NULL;
-}
-
 static void handle_key(u8 code)
 {
-	const struct key_entry *key = wistron_get_entry_by_scancode(code);
+	const struct key_entry *key =
+		sparse_keymap_entry_from_scancode(wistron_idev->input, code);
 
 	if (key) {
 		switch (key->type) {
-		case KE_KEY:
-			report_key(wistron_idev->input, key->keycode);
-			break;
-
-		case KE_SW:
-			report_switch(wistron_idev->input,
-				      key->sw.code, key->sw.value);
-			break;
-
 		case KE_WIFI:
 			if (have_wifi) {
 				wifi_enabled = !wifi_enabled;
@@ -1180,7 +1125,9 @@ static void handle_key(u8 code)
 			break;
 
 		default:
-			BUG();
+			sparse_keymap_report_entry(wistron_idev->input,
+						   key, 1, true);
+			break;
 		}
 		jiffies_last_press = jiffies;
 	} else
@@ -1220,42 +1167,39 @@ static void wistron_poll(struct input_polled_dev *dev)
 		dev->poll_interval = POLL_INTERVAL_DEFAULT;
 }
 
-static int wistron_getkeycode(struct input_dev *dev, int scancode, int *keycode)
+static int __devinit wistron_setup_keymap(struct input_dev *dev,
+					  struct key_entry *entry)
 {
-	const struct key_entry *key = wistron_get_entry_by_scancode(scancode);
-
-	if (key && key->type == KE_KEY) {
-		*keycode = key->keycode;
-		return 0;
-	}
+	switch (entry->type) {
 
-	return -EINVAL;
-}
+	/* if wifi or bluetooth are not available, create normal keys */
+	case KE_WIFI:
+		if (!have_wifi) {
+			entry->type = KE_KEY;
+			entry->keycode = KEY_WLAN;
+		}
+		break;
 
-static int wistron_setkeycode(struct input_dev *dev, int scancode, int keycode)
-{
-	struct key_entry *key;
-	int old_keycode;
-
-	if (keycode < 0 || keycode > KEY_MAX)
-		return -EINVAL;
-
-	key = wistron_get_entry_by_scancode(scancode);
-	if (key && key->type == KE_KEY) {
-		old_keycode = key->keycode;
-		key->keycode = keycode;
-		set_bit(keycode, dev->keybit);
-		if (!wistron_get_entry_by_keycode(old_keycode))
-			clear_bit(old_keycode, dev->keybit);
-		return 0;
+	case KE_BLUETOOTH:
+		if (!have_bluetooth) {
+			entry->type = KE_KEY;
+			entry->keycode = KEY_BLUETOOTH;
+		}
+		break;
+
+	case KE_END:
+		if (entry->code & FE_UNTESTED)
+			printk(KERN_WARNING "Untested laptop multimedia keys, "
+				"please report success or failure to "
+				"eric.piel@tremplin-utc.net\n");
+		break;
 	}
 
-	return -EINVAL;
+	return 0;
 }
 
 static int __devinit setup_input_dev(void)
 {
-	struct key_entry *key;
 	struct input_dev *input_dev;
 	int error;
 
@@ -1263,7 +1207,7 @@ static int __devinit setup_input_dev(void)
 	if (!wistron_idev)
 		return -ENOMEM;
 
-	wistron_idev->flush = wistron_flush;
+	wistron_idev->open = wistron_flush;
 	wistron_idev->poll = wistron_poll;
 	wistron_idev->poll_interval = POLL_INTERVAL_DEFAULT;
 
@@ -1273,56 +1217,21 @@ static int __devinit setup_input_dev(void)
 	input_dev->id.bustype = BUS_HOST;
 	input_dev->dev.parent = &wistron_device->dev;
 
-	input_dev->getkeycode = wistron_getkeycode;
-	input_dev->setkeycode = wistron_setkeycode;
-
-	for (key = keymap; key->type != KE_END; key++) {
-		switch (key->type) {
-			case KE_KEY:
-				set_bit(EV_KEY, input_dev->evbit);
-				set_bit(key->keycode, input_dev->keybit);
-				break;
-
-			case KE_SW:
-				set_bit(EV_SW, input_dev->evbit);
-				set_bit(key->sw.code, input_dev->swbit);
-				break;
-
-			/* if wifi or bluetooth are not available, create normal keys */
-			case KE_WIFI:
-				if (!have_wifi) {
-					key->type = KE_KEY;
-					key->keycode = KEY_WLAN;
-					key--;
-				}
-				break;
-
-			case KE_BLUETOOTH:
-				if (!have_bluetooth) {
-					key->type = KE_KEY;
-					key->keycode = KEY_BLUETOOTH;
-					key--;
-				}
-				break;
-
-			default:
-				break;
-		}
-	}
-
-	/* reads information flags on KE_END */
-	if (key->code & FE_UNTESTED)
-		printk(KERN_WARNING "Untested laptop multimedia keys, "
-			"please report success or failure to eric.piel"
-			"@tremplin-utc.net\n");
+	error = sparse_keymap_setup(input_dev, keymap, wistron_setup_keymap);
+	if (error)
+		goto err_free_dev;
 
 	error = input_register_polled_device(wistron_idev);
-	if (error) {
-		input_free_polled_device(wistron_idev);
-		return error;
-	}
+	if (error)
+		goto err_free_keymap;
 
 	return 0;
+
+ err_free_keymap:
+	sparse_keymap_free(input_dev);
+ err_free_dev:
+	input_free_polled_device(wistron_idev);
+	return error;
 }
 
 /* Driver core */
@@ -1371,6 +1280,7 @@ static int __devexit wistron_remove(struct platform_device *dev)
 {
 	wistron_led_remove();
 	input_unregister_polled_device(wistron_idev);
+	sparse_keymap_free(wistron_idev->input);
 	input_free_polled_device(wistron_idev);
 	bios_detach();
 
@@ -1418,7 +1328,7 @@ static struct platform_driver wistron_driver = {
 	.driver		= {
 		.name	= "wistron-bios",
 		.owner	= THIS_MODULE,
-#if CONFIG_PM
+#ifdef CONFIG_PM
 		.pm	= &wistron_pm_ops,
 #endif
 	},
diff --git a/drivers/input/mouse/Kconfig b/drivers/input/mouse/Kconfig
index 3feeb3af8abd..c714ca2407f8 100644
--- a/drivers/input/mouse/Kconfig
+++ b/drivers/input/mouse/Kconfig
@@ -70,7 +70,7 @@ config MOUSE_PS2_SYNAPTICS
 config MOUSE_PS2_LIFEBOOK
 	bool "Fujitsu Lifebook PS/2 mouse protocol extension" if EMBEDDED
 	default y
-	depends on MOUSE_PS2 && X86
+	depends on MOUSE_PS2 && X86 && DMI
 	help
 	  Say Y here if you have a Fujitsu B-series Lifebook PS/2
 	  TouchScreen connected to your system.
diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
index f36110689aae..f93c2c0daf1f 100644
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -5,6 +5,7 @@
  * Copyright (c) 2003-2005 Peter Osterlund <petero2@telia.com>
  * Copyright (c) 2004 Dmitry Torokhov <dtor@mail.ru>
  * Copyright (c) 2005 Vojtech Pavlik <vojtech@suse.cz>
+ * Copyright (c) 2009 Sebastian Kapfer <sebastian_kapfer@gmx.net>
  *
  * ALPS detection, tap switching and status querying info is taken from
  * tpconfig utility (by C. Scott Ananian and Bruce Kall).
@@ -28,13 +29,16 @@
 #define dbg(format, arg...) do {} while (0)
 #endif
 
-#define ALPS_DUALPOINT	0x01
-#define ALPS_WHEEL	0x02
-#define ALPS_FW_BK_1	0x04
-#define ALPS_4BTN	0x08
-#define ALPS_OLDPROTO	0x10
-#define ALPS_PASS	0x20
-#define ALPS_FW_BK_2	0x40
+#define ALPS_OLDPROTO		0x01	/* old style input */
+#define ALPS_DUALPOINT		0x02	/* touchpad has trackstick */
+#define ALPS_PASS		0x04	/* device has a pass-through port */
+
+#define ALPS_WHEEL		0x08	/* hardware wheel present */
+#define ALPS_FW_BK_1		0x10	/* front & back buttons present */
+#define ALPS_FW_BK_2		0x20	/* front & back buttons present */
+#define ALPS_FOUR_BUTTONS	0x40	/* 4 direction button present */
+#define ALPS_PS2_INTERLEAVED	0x80	/* 3-byte PS/2 packet interleaved with
+					   6-byte ALPS packet */
 
 static const struct alps_model_info alps_model_data[] = {
 	{ { 0x32, 0x02, 0x14 },	0xf8, 0xf8, ALPS_PASS | ALPS_DUALPOINT }, /* Toshiba Salellite Pro M10 */
@@ -55,8 +59,10 @@ static const struct alps_model_info alps_model_data[] = {
 	{ { 0x20, 0x02, 0x0e },	0xf8, 0xf8, ALPS_PASS | ALPS_DUALPOINT }, /* XXX */
 	{ { 0x22, 0x02, 0x0a },	0xf8, 0xf8, ALPS_PASS | ALPS_DUALPOINT },
 	{ { 0x22, 0x02, 0x14 }, 0xff, 0xff, ALPS_PASS | ALPS_DUALPOINT }, /* Dell Latitude D600 */
-	{ { 0x62, 0x02, 0x14 }, 0xcf, 0xcf, ALPS_PASS | ALPS_DUALPOINT }, /* Dell Latitude E6500 */
-	{ { 0x73, 0x02, 0x50 }, 0xcf, 0xcf, ALPS_FW_BK_1 },		  /* Dell Vostro 1400 */
+	/* Dell Latitude E5500, E6400, E6500, Precision M4400 */
+	{ { 0x62, 0x02, 0x14 }, 0xcf, 0xcf,
+		ALPS_PASS | ALPS_DUALPOINT | ALPS_PS2_INTERLEAVED },
+	{ { 0x73, 0x02, 0x50 }, 0xcf, 0xcf, ALPS_FOUR_BUTTONS },	  /* Dell Vostro 1400 */
 };
 
 /*
@@ -66,42 +72,99 @@ static const struct alps_model_info alps_model_data[] = {
  */
 
 /*
- * ALPS abolute Mode - new format
+ * PS/2 packet format
+ *
+ * byte 0:  0    0 YSGN XSGN    1    M    R    L
+ * byte 1: X7   X6   X5   X4   X3   X2   X1   X0
+ * byte 2: Y7   Y6   Y5   Y4   Y3   Y2   Y1   Y0
+ *
+ * Note that the device never signals overflow condition.
+ *
+ * ALPS absolute Mode - new format
  *
  * byte 0:  1    ?    ?    ?    1    ?    ?    ?
  * byte 1:  0   x6   x5   x4   x3   x2   x1   x0
- * byte 2:  0   x10  x9   x8   x7    ?  fin  ges
+ * byte 2:  0  x10   x9   x8   x7    ?  fin  ges
  * byte 3:  0   y9   y8   y7    1    M    R    L
  * byte 4:  0   y6   y5   y4   y3   y2   y1   y0
  * byte 5:  0   z6   z5   z4   z3   z2   z1   z0
  *
+ * Dualpoint device -- interleaved packet format
+ *
+ * byte 0:    1    1    0    0    1    1    1    1
+ * byte 1:    0   x6   x5   x4   x3   x2   x1   x0
+ * byte 2:    0  x10   x9   x8   x7    0  fin  ges
+ * byte 3:    0    0 YSGN XSGN    1    1    1    1
+ * byte 4:   X7   X6   X5   X4   X3   X2   X1   X0
+ * byte 5:   Y7   Y6   Y5   Y4   Y3   Y2   Y1   Y0
+ * byte 6:    0   y9   y8   y7    1    m    r    l
+ * byte 7:    0   y6   y5   y4   y3   y2   y1   y0
+ * byte 8:    0   z6   z5   z4   z3   z2   z1   z0
+ *
+ * CAPITALS = stick, miniscules = touchpad
+ *
  * ?'s can have different meanings on different models,
  * such as wheel rotation, extra buttons, stick buttons
  * on a dualpoint, etc.
  */
 
+static bool alps_is_valid_first_byte(const struct alps_model_info *model,
+				     unsigned char data)
+{
+	return (data & model->mask0) == model->byte0;
+}
+
+static void alps_report_buttons(struct psmouse *psmouse,
+				struct input_dev *dev1, struct input_dev *dev2,
+				int left, int right, int middle)
+{
+	struct alps_data *priv = psmouse->private;
+	const struct alps_model_info *model = priv->i;
+
+	if (model->flags & ALPS_PS2_INTERLEAVED) {
+		struct input_dev *dev;
+
+		/*
+		 * If shared button has already been reported on the
+		 * other device (dev2) then this event should be also
+		 * sent through that device.
+		 */
+		dev = test_bit(BTN_LEFT, dev2->key) ? dev2 : dev1;
+		input_report_key(dev, BTN_LEFT, left);
+
+		dev = test_bit(BTN_RIGHT, dev2->key) ? dev2 : dev1;
+		input_report_key(dev, BTN_RIGHT, right);
+
+		dev = test_bit(BTN_MIDDLE, dev2->key) ? dev2 : dev1;
+		input_report_key(dev, BTN_MIDDLE, middle);
+
+		/*
+		 * Sync the _other_ device now, we'll do the first
+		 * device later once we report the rest of the events.
+		 */
+		input_sync(dev2);
+	} else {
+		/*
+		 * For devices with non-interleaved packets we know what
+		 * device buttons belong to so we can simply report them.
+		 */
+		input_report_key(dev1, BTN_LEFT, left);
+		input_report_key(dev1, BTN_RIGHT, right);
+		input_report_key(dev1, BTN_MIDDLE, middle);
+	}
+}
+
 static void alps_process_packet(struct psmouse *psmouse)
 {
 	struct alps_data *priv = psmouse->private;
+	const struct alps_model_info *model = priv->i;
 	unsigned char *packet = psmouse->packet;
 	struct input_dev *dev = psmouse->dev;
 	struct input_dev *dev2 = priv->dev2;
 	int x, y, z, ges, fin, left, right, middle;
 	int back = 0, forward = 0;
 
-	if ((packet[0] & 0xc8) == 0x08) {   /* 3-byte PS/2 packet */
-		input_report_key(dev2, BTN_LEFT,   packet[0] & 1);
-		input_report_key(dev2, BTN_RIGHT,  packet[0] & 2);
-		input_report_key(dev2, BTN_MIDDLE, packet[0] & 4);
-		input_report_rel(dev2, REL_X,
-			packet[1] ? packet[1] - ((packet[0] << 4) & 0x100) : 0);
-		input_report_rel(dev2, REL_Y,
-			packet[2] ? ((packet[0] << 3) & 0x100) - packet[2] : 0);
-		input_sync(dev2);
-		return;
-	}
-
-	if (priv->i->flags & ALPS_OLDPROTO) {
+	if (model->flags & ALPS_OLDPROTO) {
 		left = packet[2] & 0x10;
 		right = packet[2] & 0x08;
 		middle = 0;
@@ -117,12 +180,12 @@ static void alps_process_packet(struct psmouse *psmouse)
 		z = packet[5];
 	}
 
-	if (priv->i->flags & ALPS_FW_BK_1) {
+	if (model->flags & ALPS_FW_BK_1) {
 		back = packet[0] & 0x10;
 		forward = packet[2] & 4;
 	}
 
-	if (priv->i->flags & ALPS_FW_BK_2) {
+	if (model->flags & ALPS_FW_BK_2) {
 		back = packet[3] & 4;
 		forward = packet[2] & 4;
 		if ((middle = forward && back))
@@ -132,25 +195,21 @@ static void alps_process_packet(struct psmouse *psmouse)
 	ges = packet[2] & 1;
 	fin = packet[2] & 2;
 
-	if ((priv->i->flags & ALPS_DUALPOINT) && z == 127) {
+	if ((model->flags & ALPS_DUALPOINT) && z == 127) {
 		input_report_rel(dev2, REL_X,  (x > 383 ? (x - 768) : x));
 		input_report_rel(dev2, REL_Y, -(y > 255 ? (y - 512) : y));
 
-		input_report_key(dev2, BTN_LEFT, left);
-		input_report_key(dev2, BTN_RIGHT, right);
-		input_report_key(dev2, BTN_MIDDLE, middle);
+		alps_report_buttons(psmouse, dev2, dev, left, right, middle);
 
-		input_sync(dev);
 		input_sync(dev2);
 		return;
 	}
 
-	input_report_key(dev, BTN_LEFT, left);
-	input_report_key(dev, BTN_RIGHT, right);
-	input_report_key(dev, BTN_MIDDLE, middle);
+	alps_report_buttons(psmouse, dev, dev2, left, right, middle);
 
 	/* Convert hardware tap to a reasonable Z value */
-	if (ges && !fin) z = 40;
+	if (ges && !fin)
+		z = 40;
 
 	/*
 	 * A "tap and drag" operation is reported by the hardware as a transition
@@ -166,8 +225,10 @@ static void alps_process_packet(struct psmouse *psmouse)
 	}
 	priv->prev_fin = fin;
 
-	if (z > 30) input_report_key(dev, BTN_TOUCH, 1);
-	if (z < 25) input_report_key(dev, BTN_TOUCH, 0);
+	if (z > 30)
+		input_report_key(dev, BTN_TOUCH, 1);
+	if (z < 25)
+		input_report_key(dev, BTN_TOUCH, 0);
 
 	if (z > 0) {
 		input_report_abs(dev, ABS_X, x);
@@ -177,36 +238,186 @@ static void alps_process_packet(struct psmouse *psmouse)
 	input_report_abs(dev, ABS_PRESSURE, z);
 	input_report_key(dev, BTN_TOOL_FINGER, z > 0);
 
-	if (priv->i->flags & ALPS_WHEEL)
+	if (model->flags & ALPS_WHEEL)
 		input_report_rel(dev, REL_WHEEL, ((packet[2] << 1) & 0x08) - ((packet[0] >> 4) & 0x07));
 
-	if (priv->i->flags & (ALPS_FW_BK_1 | ALPS_FW_BK_2)) {
+	if (model->flags & (ALPS_FW_BK_1 | ALPS_FW_BK_2)) {
 		input_report_key(dev, BTN_FORWARD, forward);
 		input_report_key(dev, BTN_BACK, back);
 	}
 
+	if (model->flags & ALPS_FOUR_BUTTONS) {
+		input_report_key(dev, BTN_0, packet[2] & 4);
+		input_report_key(dev, BTN_1, packet[0] & 0x10);
+		input_report_key(dev, BTN_2, packet[3] & 4);
+		input_report_key(dev, BTN_3, packet[0] & 0x20);
+	}
+
 	input_sync(dev);
 }
 
+static void alps_report_bare_ps2_packet(struct psmouse *psmouse,
+					unsigned char packet[],
+					bool report_buttons)
+{
+	struct alps_data *priv = psmouse->private;
+	struct input_dev *dev2 = priv->dev2;
+
+	if (report_buttons)
+		alps_report_buttons(psmouse, dev2, psmouse->dev,
+				packet[0] & 1, packet[0] & 2, packet[0] & 4);
+
+	input_report_rel(dev2, REL_X,
+		packet[1] ? packet[1] - ((packet[0] << 4) & 0x100) : 0);
+	input_report_rel(dev2, REL_Y,
+		packet[2] ? ((packet[0] << 3) & 0x100) - packet[2] : 0);
+
+	input_sync(dev2);
+}
+
+static psmouse_ret_t alps_handle_interleaved_ps2(struct psmouse *psmouse)
+{
+	struct alps_data *priv = psmouse->private;
+
+	if (psmouse->pktcnt < 6)
+		return PSMOUSE_GOOD_DATA;
+
+	if (psmouse->pktcnt == 6) {
+		/*
+		 * Start a timer to flush the packet if it ends up last
+		 * 6-byte packet in the stream. Timer needs to fire
+		 * psmouse core times out itself. 20 ms should be enough
+		 * to decide if we are getting more data or not.
+		 */
+		mod_timer(&priv->timer, jiffies + msecs_to_jiffies(20));
+		return PSMOUSE_GOOD_DATA;
+	}
+
+	del_timer(&priv->timer);
+
+	if (psmouse->packet[6] & 0x80) {
+
+		/*
+		 * Highest bit is set - that means we either had
+		 * complete ALPS packet and this is start of the
+		 * next packet or we got garbage.
+		 */
+
+		if (((psmouse->packet[3] |
+		      psmouse->packet[4] |
+		      psmouse->packet[5]) & 0x80) ||
+		    (!alps_is_valid_first_byte(priv->i, psmouse->packet[6]))) {
+			dbg("refusing packet %x %x %x %x "
+			    "(suspected interleaved ps/2)\n",
+			    psmouse->packet[3], psmouse->packet[4],
+			    psmouse->packet[5], psmouse->packet[6]);
+			return PSMOUSE_BAD_DATA;
+		}
+
+		alps_process_packet(psmouse);
+
+		/* Continue with the next packet */
+		psmouse->packet[0] = psmouse->packet[6];
+		psmouse->pktcnt = 1;
+
+	} else {
+
+		/*
+		 * High bit is 0 - that means that we indeed got a PS/2
+		 * packet in the middle of ALPS packet.
+		 *
+		 * There is also possibility that we got 6-byte ALPS
+		 * packet followed  by 3-byte packet from trackpoint. We
+		 * can not distinguish between these 2 scenarios but
+		 * becase the latter is unlikely to happen in course of
+		 * normal operation (user would need to press all
+		 * buttons on the pad and start moving trackpoint
+		 * without touching the pad surface) we assume former.
+		 * Even if we are wrong the wost thing that would happen
+		 * the cursor would jump but we should not get protocol
+		 * desynchronization.
+		 */
+
+		alps_report_bare_ps2_packet(psmouse, &psmouse->packet[3],
+					    false);
+
+		/*
+		 * Continue with the standard ALPS protocol handling,
+		 * but make sure we won't process it as an interleaved
+		 * packet again, which may happen if all buttons are
+		 * pressed. To avoid this let's reset the 4th bit which
+		 * is normally 1.
+		 */
+		psmouse->packet[3] = psmouse->packet[6] & 0xf7;
+		psmouse->pktcnt = 4;
+	}
+
+	return PSMOUSE_GOOD_DATA;
+}
+
+static void alps_flush_packet(unsigned long data)
+{
+	struct psmouse *psmouse = (struct psmouse *)data;
+
+	serio_pause_rx(psmouse->ps2dev.serio);
+
+	if (psmouse->pktcnt == 6) {
+
+		/*
+		 * We did not any more data in reasonable amount of time.
+		 * Validate the last 3 bytes and process as a standard
+		 * ALPS packet.
+		 */
+		if ((psmouse->packet[3] |
+		     psmouse->packet[4] |
+		     psmouse->packet[5]) & 0x80) {
+			dbg("refusing packet %x %x %x "
+			    "(suspected interleaved ps/2)\n",
+			    psmouse->packet[3], psmouse->packet[4],
+			    psmouse->packet[5]);
+		} else {
+			alps_process_packet(psmouse);
+		}
+		psmouse->pktcnt = 0;
+	}
+
+	serio_continue_rx(psmouse->ps2dev.serio);
+}
+
 static psmouse_ret_t alps_process_byte(struct psmouse *psmouse)
 {
 	struct alps_data *priv = psmouse->private;
+	const struct alps_model_info *model = priv->i;
 
 	if ((psmouse->packet[0] & 0xc8) == 0x08) { /* PS/2 packet */
 		if (psmouse->pktcnt == 3) {
-			alps_process_packet(psmouse);
+			alps_report_bare_ps2_packet(psmouse, psmouse->packet,
+						    true);
 			return PSMOUSE_FULL_PACKET;
 		}
 		return PSMOUSE_GOOD_DATA;
 	}
 
-	if ((psmouse->packet[0] & priv->i->mask0) != priv->i->byte0)
+	/* Check for PS/2 packet stuffed in the middle of ALPS packet. */
+
+	if ((model->flags & ALPS_PS2_INTERLEAVED) &&
+	    psmouse->pktcnt >= 4 && (psmouse->packet[3] & 0x0f) == 0x0f) {
+		return alps_handle_interleaved_ps2(psmouse);
+	}
+
+	if (!alps_is_valid_first_byte(model, psmouse->packet[0])) {
+		dbg("refusing packet[0] = %x (mask0 = %x, byte0 = %x)\n",
+		    psmouse->packet[0], model->mask0, model->byte0);
 		return PSMOUSE_BAD_DATA;
+	}
 
 	/* Bytes 2 - 6 should have 0 in the highest bit */
 	if (psmouse->pktcnt >= 2 && psmouse->pktcnt <= 6 &&
-	    (psmouse->packet[psmouse->pktcnt - 1] & 0x80))
+	    (psmouse->packet[psmouse->pktcnt - 1] & 0x80)) {
+		dbg("refusing packet[%i] = %x\n",
+		    psmouse->pktcnt - 1, psmouse->packet[psmouse->pktcnt - 1]);
 		return PSMOUSE_BAD_DATA;
+	}
 
 	if (psmouse->pktcnt == 6) {
 		alps_process_packet(psmouse);
@@ -393,15 +604,12 @@ static int alps_poll(struct psmouse *psmouse)
 	return 0;
 }
 
-static int alps_hw_init(struct psmouse *psmouse, int *version)
+static int alps_hw_init(struct psmouse *psmouse)
 {
 	struct alps_data *priv = psmouse->private;
+	const struct alps_model_info *model = priv->i;
 
-	priv->i = alps_get_model(psmouse, version);
-	if (!priv->i)
-		return -1;
-
-	if ((priv->i->flags & ALPS_PASS) &&
+	if ((model->flags & ALPS_PASS) &&
 	    alps_passthrough_mode(psmouse, true)) {
 		return -1;
 	}
@@ -416,7 +624,7 @@ static int alps_hw_init(struct psmouse *psmouse, int *version)
 		return -1;
 	}
 
-	if ((priv->i->flags & ALPS_PASS) &&
+	if ((model->flags & ALPS_PASS) &&
 	    alps_passthrough_mode(psmouse, false)) {
 		return -1;
 	}
@@ -432,12 +640,15 @@ static int alps_hw_init(struct psmouse *psmouse, int *version)
 
 static int alps_reconnect(struct psmouse *psmouse)
 {
+	const struct alps_model_info *model;
+
 	psmouse_reset(psmouse);
 
-	if (alps_hw_init(psmouse, NULL))
+	model = alps_get_model(psmouse, NULL);
+	if (!model)
 		return -1;
 
-	return 0;
+	return alps_hw_init(psmouse);
 }
 
 static void alps_disconnect(struct psmouse *psmouse)
@@ -445,6 +656,7 @@ static void alps_disconnect(struct psmouse *psmouse)
 	struct alps_data *priv = psmouse->private;
 
 	psmouse_reset(psmouse);
+	del_timer_sync(&priv->timer);
 	input_unregister_device(priv->dev2);
 	kfree(priv);
 }
@@ -452,6 +664,7 @@ static void alps_disconnect(struct psmouse *psmouse)
 int alps_init(struct psmouse *psmouse)
 {
 	struct alps_data *priv;
+	const struct alps_model_info *model;
 	struct input_dev *dev1 = psmouse->dev, *dev2;
 	int version;
 
@@ -461,35 +674,63 @@ int alps_init(struct psmouse *psmouse)
 		goto init_fail;
 
 	priv->dev2 = dev2;
+	setup_timer(&priv->timer, alps_flush_packet, (unsigned long)psmouse);
+
 	psmouse->private = priv;
 
-	if (alps_hw_init(psmouse, &version))
+	model = alps_get_model(psmouse, &version);
+	if (!model)
+		goto init_fail;
+
+	priv->i = model;
+
+	if (alps_hw_init(psmouse))
 		goto init_fail;
 
+	/*
+	 * Undo part of setup done for us by psmouse core since touchpad
+	 * is not a relative device.
+	 */
+	__clear_bit(EV_REL, dev1->evbit);
+	__clear_bit(REL_X, dev1->relbit);
+	__clear_bit(REL_Y, dev1->relbit);
+
+	/*
+	 * Now set up our capabilities.
+	 */
 	dev1->evbit[BIT_WORD(EV_KEY)] |= BIT_MASK(EV_KEY);
 	dev1->keybit[BIT_WORD(BTN_TOUCH)] |= BIT_MASK(BTN_TOUCH);
 	dev1->keybit[BIT_WORD(BTN_TOOL_FINGER)] |= BIT_MASK(BTN_TOOL_FINGER);
-	dev1->keybit[BIT_WORD(BTN_LEFT)] |= BIT_MASK(BTN_LEFT) |
-		BIT_MASK(BTN_MIDDLE) | BIT_MASK(BTN_RIGHT);
+	dev1->keybit[BIT_WORD(BTN_LEFT)] |=
+		BIT_MASK(BTN_LEFT) | BIT_MASK(BTN_RIGHT);
 
 	dev1->evbit[BIT_WORD(EV_ABS)] |= BIT_MASK(EV_ABS);
 	input_set_abs_params(dev1, ABS_X, 0, 1023, 0, 0);
 	input_set_abs_params(dev1, ABS_Y, 0, 767, 0, 0);
 	input_set_abs_params(dev1, ABS_PRESSURE, 0, 127, 0, 0);
 
-	if (priv->i->flags & ALPS_WHEEL) {
+	if (model->flags & ALPS_WHEEL) {
 		dev1->evbit[BIT_WORD(EV_REL)] |= BIT_MASK(EV_REL);
 		dev1->relbit[BIT_WORD(REL_WHEEL)] |= BIT_MASK(REL_WHEEL);
 	}
 
-	if (priv->i->flags & (ALPS_FW_BK_1 | ALPS_FW_BK_2)) {
+	if (model->flags & (ALPS_FW_BK_1 | ALPS_FW_BK_2)) {
 		dev1->keybit[BIT_WORD(BTN_FORWARD)] |= BIT_MASK(BTN_FORWARD);
 		dev1->keybit[BIT_WORD(BTN_BACK)] |= BIT_MASK(BTN_BACK);
 	}
 
+	if (model->flags & ALPS_FOUR_BUTTONS) {
+		dev1->keybit[BIT_WORD(BTN_0)] |= BIT_MASK(BTN_0);
+		dev1->keybit[BIT_WORD(BTN_1)] |= BIT_MASK(BTN_1);
+		dev1->keybit[BIT_WORD(BTN_2)] |= BIT_MASK(BTN_2);
+		dev1->keybit[BIT_WORD(BTN_3)] |= BIT_MASK(BTN_3);
+	} else {
+		dev1->keybit[BIT_WORD(BTN_MIDDLE)] |= BIT_MASK(BTN_MIDDLE);
+	}
+
 	snprintf(priv->phys, sizeof(priv->phys), "%s/input1", psmouse->ps2dev.serio->phys);
 	dev2->phys = priv->phys;
-	dev2->name = (priv->i->flags & ALPS_DUALPOINT) ? "DualPoint Stick" : "PS/2 Mouse";
+	dev2->name = (model->flags & ALPS_DUALPOINT) ? "DualPoint Stick" : "PS/2 Mouse";
 	dev2->id.bustype = BUS_I8042;
 	dev2->id.vendor  = 0x0002;
 	dev2->id.product = PSMOUSE_ALPS;
@@ -497,9 +738,9 @@ int alps_init(struct psmouse *psmouse)
 	dev2->dev.parent = &psmouse->ps2dev.serio->dev;
 
 	dev2->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_REL);
-	dev2->relbit[BIT_WORD(REL_X)] |= BIT_MASK(REL_X) | BIT_MASK(REL_Y);
-	dev2->keybit[BIT_WORD(BTN_LEFT)] |= BIT_MASK(BTN_LEFT) |
-		BIT_MASK(BTN_MIDDLE) | BIT_MASK(BTN_RIGHT);
+	dev2->relbit[BIT_WORD(REL_X)] = BIT_MASK(REL_X) | BIT_MASK(REL_Y);
+	dev2->keybit[BIT_WORD(BTN_LEFT)] =
+		BIT_MASK(BTN_LEFT) | BIT_MASK(BTN_MIDDLE) | BIT_MASK(BTN_RIGHT);
 
 	if (input_register_device(priv->dev2))
 		goto init_fail;
diff --git a/drivers/input/mouse/alps.h b/drivers/input/mouse/alps.h
index bc87936fee1a..904ed8b3c8be 100644
--- a/drivers/input/mouse/alps.h
+++ b/drivers/input/mouse/alps.h
@@ -23,6 +23,7 @@ struct alps_data {
 	char phys[32];			/* Phys */
 	const struct alps_model_info *i;/* Info */
 	int prev_fin;			/* Finger bit from previous packet */
+	struct timer_list timer;
 };
 
 #ifdef CONFIG_MOUSE_PS2_ALPS
diff --git a/drivers/input/mouse/bcm5974.c b/drivers/input/mouse/bcm5974.c
index 0d1d33468b43..4f8fe0886b2a 100644
--- a/drivers/input/mouse/bcm5974.c
+++ b/drivers/input/mouse/bcm5974.c
@@ -139,6 +139,7 @@ struct tp_finger {
 /* trackpad finger data size, empirically at least ten fingers */
 #define SIZEOF_FINGER		sizeof(struct tp_finger)
 #define SIZEOF_ALL_FINGERS	(16 * SIZEOF_FINGER)
+#define MAX_FINGER_ORIENTATION	16384
 
 /* device-specific parameters */
 struct bcm5974_param {
@@ -284,6 +285,26 @@ static void setup_events_to_report(struct input_dev *input_dev,
 	input_set_abs_params(input_dev, ABS_Y,
 				0, cfg->y.dim, cfg->y.fuzz, 0);
 
+	/* finger touch area */
+	input_set_abs_params(input_dev, ABS_MT_TOUCH_MAJOR,
+			     cfg->w.devmin, cfg->w.devmax, 0, 0);
+	input_set_abs_params(input_dev, ABS_MT_TOUCH_MINOR,
+			     cfg->w.devmin, cfg->w.devmax, 0, 0);
+	/* finger approach area */
+	input_set_abs_params(input_dev, ABS_MT_WIDTH_MAJOR,
+			     cfg->w.devmin, cfg->w.devmax, 0, 0);
+	input_set_abs_params(input_dev, ABS_MT_WIDTH_MINOR,
+			     cfg->w.devmin, cfg->w.devmax, 0, 0);
+	/* finger orientation */
+	input_set_abs_params(input_dev, ABS_MT_ORIENTATION,
+			     -MAX_FINGER_ORIENTATION,
+			     MAX_FINGER_ORIENTATION, 0, 0);
+	/* finger position */
+	input_set_abs_params(input_dev, ABS_MT_POSITION_X,
+			     cfg->x.devmin, cfg->x.devmax, 0, 0);
+	input_set_abs_params(input_dev, ABS_MT_POSITION_Y,
+			     cfg->y.devmin, cfg->y.devmax, 0, 0);
+
 	__set_bit(EV_KEY, input_dev->evbit);
 	__set_bit(BTN_TOUCH, input_dev->keybit);
 	__set_bit(BTN_TOOL_FINGER, input_dev->keybit);
@@ -310,13 +331,29 @@ static int report_bt_state(struct bcm5974 *dev, int size)
 	return 0;
 }
 
+static void report_finger_data(struct input_dev *input,
+			       const struct bcm5974_config *cfg,
+			       const struct tp_finger *f)
+{
+	input_report_abs(input, ABS_MT_TOUCH_MAJOR, raw2int(f->force_major));
+	input_report_abs(input, ABS_MT_TOUCH_MINOR, raw2int(f->force_minor));
+	input_report_abs(input, ABS_MT_WIDTH_MAJOR, raw2int(f->size_major));
+	input_report_abs(input, ABS_MT_WIDTH_MINOR, raw2int(f->size_minor));
+	input_report_abs(input, ABS_MT_ORIENTATION,
+			 MAX_FINGER_ORIENTATION - raw2int(f->orientation));
+	input_report_abs(input, ABS_MT_POSITION_X, raw2int(f->abs_x));
+	input_report_abs(input, ABS_MT_POSITION_Y,
+			 cfg->y.devmin + cfg->y.devmax - raw2int(f->abs_y));
+	input_mt_sync(input);
+}
+
 /* report trackpad data as logical trackpad state */
 static int report_tp_state(struct bcm5974 *dev, int size)
 {
 	const struct bcm5974_config *c = &dev->cfg;
 	const struct tp_finger *f;
 	struct input_dev *input = dev->input;
-	int raw_p, raw_w, raw_x, raw_y, raw_n;
+	int raw_p, raw_w, raw_x, raw_y, raw_n, i;
 	int ptest, origin, ibt = 0, nmin = 0, nmax = 0;
 	int abs_p = 0, abs_w = 0, abs_x = 0, abs_y = 0;
 
@@ -329,6 +366,11 @@ static int report_tp_state(struct bcm5974 *dev, int size)
 
 	/* always track the first finger; when detached, start over */
 	if (raw_n) {
+
+		/* report raw trackpad data */
+		for (i = 0; i < raw_n; i++)
+			report_finger_data(input, c, &f[i]);
+
 		raw_p = raw2int(f->force_major);
 		raw_w = raw2int(f->size_major);
 		raw_x = raw2int(f->abs_x);
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index fda35e615abf..b27684f267bf 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -420,6 +420,7 @@ static void elantech_set_input_params(struct psmouse *psmouse)
 
 	__set_bit(EV_KEY, dev->evbit);
 	__set_bit(EV_ABS, dev->evbit);
+	__clear_bit(EV_REL, dev->evbit);
 
 	__set_bit(BTN_LEFT, dev->keybit);
 	__set_bit(BTN_RIGHT, dev->keybit);
diff --git a/drivers/input/mouse/hgpk.c b/drivers/input/mouse/hgpk.c
index de1e553028b7..90be30e93556 100644
--- a/drivers/input/mouse/hgpk.c
+++ b/drivers/input/mouse/hgpk.c
@@ -427,22 +427,8 @@ static void hgpk_recalib_work(struct work_struct *work)
 
 static int hgpk_register(struct psmouse *psmouse)
 {
-	struct input_dev *dev = psmouse->dev;
 	int err;
 
-	/* unset the things that psmouse-base sets which we don't have */
-	__clear_bit(BTN_MIDDLE, dev->keybit);
-
-	/* set the things we do have */
-	__set_bit(EV_KEY, dev->evbit);
-	__set_bit(EV_REL, dev->evbit);
-
-	__set_bit(REL_X, dev->relbit);
-	__set_bit(REL_Y, dev->relbit);
-
-	__set_bit(BTN_LEFT, dev->keybit);
-	__set_bit(BTN_RIGHT, dev->keybit);
-
 	/* register handlers */
 	psmouse->protocol_handler = hgpk_process_byte;
 	psmouse->poll = hgpk_poll;
diff --git a/drivers/input/mouse/lifebook.c b/drivers/input/mouse/lifebook.c
index 82811558ec33..6d7aa10d10f0 100644
--- a/drivers/input/mouse/lifebook.c
+++ b/drivers/input/mouse/lifebook.c
@@ -25,11 +25,13 @@ struct lifebook_data {
 	char phys[32];
 };
 
+static bool lifebook_present;
+
 static const char *desired_serio_phys;
 
-static int lifebook_set_serio_phys(const struct dmi_system_id *d)
+static int lifebook_limit_serio3(const struct dmi_system_id *d)
 {
-	desired_serio_phys = d->driver_data;
+	desired_serio_phys = "isa0060/serio3";
 	return 0;
 }
 
@@ -41,53 +43,52 @@ static int lifebook_set_6byte_proto(const struct dmi_system_id *d)
 	return 0;
 }
 
-static const struct dmi_system_id lifebook_dmi_table[] = {
+static const struct dmi_system_id __initconst lifebook_dmi_table[] = {
 	{
-		.ident = "FLORA-ie 55mi",
+		/* FLORA-ie 55mi */
 		.matches = {
 			DMI_MATCH(DMI_PRODUCT_NAME, "FLORA-ie 55mi"),
 		},
 	},
 	{
-		.ident = "LifeBook B",
+		/* LifeBook B */
 		.matches = {
 			DMI_MATCH(DMI_PRODUCT_NAME, "LifeBook B Series"),
 		},
 	},
 	{
-		.ident = "Lifebook B",
+		/* Lifebook B */
 		.matches = {
 			DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK B Series"),
 		},
 	},
 	{
-		.ident = "Lifebook B-2130",
+		/* Lifebook B-2130 */
 		.matches = {
 			DMI_MATCH(DMI_BOARD_NAME, "ZEPHYR"),
 		},
 	},
 	{
-		.ident = "Lifebook B213x/B2150",
+		/* Lifebook B213x/B2150 */
 		.matches = {
 			DMI_MATCH(DMI_PRODUCT_NAME, "LifeBook B2131/B2133/B2150"),
 		},
 	},
 	{
-		.ident = "Zephyr",
+		/* Zephyr */
 		.matches = {
 			DMI_MATCH(DMI_PRODUCT_NAME, "ZEPHYR"),
 		},
 	},
 	{
-		.ident = "CF-18",
+		/* Panasonic CF-18 */
 		.matches = {
 			DMI_MATCH(DMI_PRODUCT_NAME, "CF-18"),
 		},
-		.callback = lifebook_set_serio_phys,
-		.driver_data = "isa0060/serio3",
+		.callback = lifebook_limit_serio3,
 	},
 	{
-		.ident = "Panasonic CF-28",
+		/* Panasonic CF-28 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Matsushita"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "CF-28"),
@@ -95,7 +96,7 @@ static const struct dmi_system_id lifebook_dmi_table[] = {
 		.callback = lifebook_set_6byte_proto,
 	},
 	{
-		.ident = "Panasonic CF-29",
+		/* Panasonic CF-29 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Matsushita"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "CF-29"),
@@ -103,14 +104,14 @@ static const struct dmi_system_id lifebook_dmi_table[] = {
 		.callback = lifebook_set_6byte_proto,
 	},
 	{
-		.ident = "CF-72",
+		/* Panasonic CF-72 */
 		.matches = {
 			DMI_MATCH(DMI_PRODUCT_NAME, "CF-72"),
 		},
 		.callback = lifebook_set_6byte_proto,
 	},
 	{
-		.ident = "Lifebook B142",
+		/* Lifebook B142 */
 		.matches = {
 			DMI_MATCH(DMI_PRODUCT_NAME, "LifeBook B142"),
 		},
@@ -118,6 +119,11 @@ static const struct dmi_system_id lifebook_dmi_table[] = {
 	{ }
 };
 
+void __init lifebook_module_init(void)
+{
+	lifebook_present = dmi_check_system(lifebook_dmi_table);
+}
+
 static psmouse_ret_t lifebook_process_byte(struct psmouse *psmouse)
 {
 	struct lifebook_data *priv = psmouse->private;
@@ -198,10 +204,10 @@ static int lifebook_absolute_mode(struct psmouse *psmouse)
 		return -1;
 
 	/*
-	   Enable absolute output -- ps2_command fails always but if
-	   you leave this call out the touchsreen will never send
-	   absolute coordinates
-	*/
+	 * Enable absolute output -- ps2_command fails always but if
+	 * you leave this call out the touchsreen will never send
+	 * absolute coordinates
+	 */
 	param = lifebook_use_6byte_proto ? 0x08 : 0x07;
 	ps2_command(ps2dev, &param, PSMOUSE_CMD_SETRES);
 
@@ -243,7 +249,7 @@ static void lifebook_disconnect(struct psmouse *psmouse)
 
 int lifebook_detect(struct psmouse *psmouse, bool set_properties)
 {
-        if (!dmi_check_system(lifebook_dmi_table))
+        if (!lifebook_present)
                 return -1;
 
 	if (desired_serio_phys &&
@@ -283,8 +289,8 @@ static int lifebook_create_relative_device(struct psmouse *psmouse)
 
 	dev2->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_REL);
 	dev2->relbit[BIT_WORD(REL_X)] = BIT_MASK(REL_X) | BIT_MASK(REL_Y);
-	dev2->keybit[BIT_WORD(BTN_LEFT)] = BIT_MASK(BTN_LEFT) |
-		BIT_MASK(BTN_RIGHT);
+	dev2->keybit[BIT_WORD(BTN_LEFT)] =
+				BIT_MASK(BTN_LEFT) | BIT_MASK(BTN_RIGHT);
 
 	error = input_register_device(priv->dev2);
 	if (error)
@@ -309,6 +315,7 @@ int lifebook_init(struct psmouse *psmouse)
 
 	dev1->evbit[0] = BIT_MASK(EV_ABS) | BIT_MASK(EV_KEY);
 	dev1->relbit[0] = 0;
+	dev1->keybit[BIT_WORD(BTN_MOUSE)] = 0;
 	dev1->keybit[BIT_WORD(BTN_TOUCH)] = BIT_MASK(BTN_TOUCH);
 	input_set_abs_params(dev1, ABS_X, 0, max_coord, 0, 0);
 	input_set_abs_params(dev1, ABS_Y, 0, max_coord, 0, 0);
diff --git a/drivers/input/mouse/lifebook.h b/drivers/input/mouse/lifebook.h
index 407cb226bc0a..4c4326c6f504 100644
--- a/drivers/input/mouse/lifebook.h
+++ b/drivers/input/mouse/lifebook.h
@@ -12,9 +12,13 @@
 #define _LIFEBOOK_H
 
 #ifdef CONFIG_MOUSE_PS2_LIFEBOOK
+void lifebook_module_init(void);
 int lifebook_detect(struct psmouse *psmouse, bool set_properties);
 int lifebook_init(struct psmouse *psmouse);
 #else
+inline void lifebook_module_init(void)
+{
+}
 inline int lifebook_detect(struct psmouse *psmouse, bool set_properties)
 {
 	return -ENOSYS;
diff --git a/drivers/input/mouse/logips2pp.c b/drivers/input/mouse/logips2pp.c
index ab5dc5f5fd83..543c240a85f2 100644
--- a/drivers/input/mouse/logips2pp.c
+++ b/drivers/input/mouse/logips2pp.c
@@ -404,8 +404,8 @@ int ps2pp_init(struct psmouse *psmouse, bool set_properties)
 			}
 		}
 
-		if (buttons < 3)
-			__clear_bit(BTN_MIDDLE, psmouse->dev->keybit);
+		if (buttons >= 3)
+			__set_bit(BTN_MIDDLE, psmouse->dev->keybit);
 
 		if (model_info)
 			ps2pp_set_model_properties(psmouse, model_info, use_ps2pp);
diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c
index 07c53798301a..9774bdfaa482 100644
--- a/drivers/input/mouse/psmouse-base.c
+++ b/drivers/input/mouse/psmouse-base.c
@@ -425,6 +425,7 @@ static int genius_detect(struct psmouse *psmouse, bool set_properties)
 		return -1;
 
 	if (set_properties) {
+		__set_bit(BTN_MIDDLE, psmouse->dev->keybit);
 		__set_bit(BTN_EXTRA, psmouse->dev->keybit);
 		__set_bit(BTN_SIDE, psmouse->dev->keybit);
 		__set_bit(REL_WHEEL, psmouse->dev->relbit);
@@ -460,8 +461,10 @@ static int intellimouse_detect(struct psmouse *psmouse, bool set_properties)
 		__set_bit(BTN_MIDDLE, psmouse->dev->keybit);
 		__set_bit(REL_WHEEL, psmouse->dev->relbit);
 
-		if (!psmouse->vendor) psmouse->vendor = "Generic";
-		if (!psmouse->name) psmouse->name = "Wheel Mouse";
+		if (!psmouse->vendor)
+			psmouse->vendor = "Generic";
+		if (!psmouse->name)
+			psmouse->name = "Wheel Mouse";
 		psmouse->pktsize = 4;
 	}
 
@@ -504,8 +507,10 @@ static int im_explorer_detect(struct psmouse *psmouse, bool set_properties)
 		__set_bit(BTN_SIDE, psmouse->dev->keybit);
 		__set_bit(BTN_EXTRA, psmouse->dev->keybit);
 
-		if (!psmouse->vendor) psmouse->vendor = "Generic";
-		if (!psmouse->name) psmouse->name = "Explorer Mouse";
+		if (!psmouse->vendor)
+			psmouse->vendor = "Generic";
+		if (!psmouse->name)
+			psmouse->name = "Explorer Mouse";
 		psmouse->pktsize = 4;
 	}
 
@@ -536,6 +541,7 @@ static int thinking_detect(struct psmouse *psmouse, bool set_properties)
 		return -1;
 
 	if (set_properties) {
+		__set_bit(BTN_MIDDLE, psmouse->dev->keybit);
 		__set_bit(BTN_EXTRA, psmouse->dev->keybit);
 
 		psmouse->vendor = "Kensington";
@@ -551,8 +557,16 @@ static int thinking_detect(struct psmouse *psmouse, bool set_properties)
 static int ps2bare_detect(struct psmouse *psmouse, bool set_properties)
 {
 	if (set_properties) {
-		if (!psmouse->vendor) psmouse->vendor = "Generic";
-		if (!psmouse->name) psmouse->name = "Mouse";
+		if (!psmouse->vendor)
+			psmouse->vendor = "Generic";
+		if (!psmouse->name)
+			psmouse->name = "Mouse";
+
+/*
+ * We have no way of figuring true number of buttons so let's
+ * assume that the device has 3.
+ */
+		__set_bit(BTN_MIDDLE, psmouse->dev->keybit);
 	}
 
 	return 0;
@@ -567,6 +581,8 @@ static int cortron_detect(struct psmouse *psmouse, bool set_properties)
 	if (set_properties) {
 		psmouse->vendor = "Cortron";
 		psmouse->name = "PS/2 Trackball";
+
+		__set_bit(BTN_MIDDLE, psmouse->dev->keybit);
 		__set_bit(BTN_SIDE, psmouse->dev->keybit);
 	}
 
@@ -611,8 +627,15 @@ static int psmouse_extensions(struct psmouse *psmouse,
 		synaptics_hardware = true;
 
 		if (max_proto > PSMOUSE_IMEX) {
-			if (!set_properties || synaptics_init(psmouse) == 0)
+/*
+ * Try activating protocol, but check if support is enabled first, since
+ * we try detecting Synaptics even when protocol is disabled.
+ */
+			if (synaptics_supported() &&
+			    (!set_properties || synaptics_init(psmouse) == 0)) {
 				return PSMOUSE_SYNAPTICS;
+			}
+
 /*
  * Some Synaptics touchpads can emulate extended protocols (like IMPS/2).
  * Unfortunately Logitech/Genius probes confuse some firmware versions so
@@ -667,19 +690,6 @@ static int psmouse_extensions(struct psmouse *psmouse,
 		max_proto = PSMOUSE_IMEX;
 	}
 
-/*
- * Try Finger Sensing Pad
- */
-	if (max_proto > PSMOUSE_IMEX) {
-		if (fsp_detect(psmouse, set_properties) == 0) {
-			if (!set_properties || fsp_init(psmouse) == 0)
-				return PSMOUSE_FSP;
-/*
- * Init failed, try basic relative protocols
- */
-			max_proto = PSMOUSE_IMEX;
-		}
-	}
 
 	if (max_proto > PSMOUSE_IMEX) {
 		if (genius_detect(psmouse, set_properties) == 0)
@@ -696,6 +706,21 @@ static int psmouse_extensions(struct psmouse *psmouse,
 	}
 
 /*
+ * Try Finger Sensing Pad. We do it here because its probe upsets
+ * Trackpoint devices (causing TP_READ_ID command to time out).
+ */
+	if (max_proto > PSMOUSE_IMEX) {
+		if (fsp_detect(psmouse, set_properties) == 0) {
+			if (!set_properties || fsp_init(psmouse) == 0)
+				return PSMOUSE_FSP;
+/*
+ * Init failed, try basic relative protocols
+ */
+			max_proto = PSMOUSE_IMEX;
+		}
+	}
+
+/*
  * Reset to defaults in case the device got confused by extended
  * protocol probes. Note that we follow up with full reset because
  * some mice put themselves to sleep when they see PSMOUSE_RESET_DIS.
@@ -1121,7 +1146,10 @@ static void psmouse_cleanup(struct serio *serio)
 	if (psmouse->cleanup)
 		psmouse->cleanup(psmouse);
 
-	psmouse_reset(psmouse);
+/*
+ * Reset the mouse to defaults (bare PS/2 protocol).
+ */
+	ps2_command(&psmouse->ps2dev, NULL, PSMOUSE_CMD_RESET_DIS);
 
 /*
  * Some boxes, such as HP nx7400, get terribly confused if mouse
@@ -1184,15 +1212,16 @@ static void psmouse_disconnect(struct serio *serio)
 	mutex_unlock(&psmouse_mutex);
 }
 
-static int psmouse_switch_protocol(struct psmouse *psmouse, const struct psmouse_protocol *proto)
+static int psmouse_switch_protocol(struct psmouse *psmouse,
+				   const struct psmouse_protocol *proto)
 {
 	struct input_dev *input_dev = psmouse->dev;
 
 	input_dev->dev.parent = &psmouse->ps2dev.serio->dev;
 
 	input_dev->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_REL);
-	input_dev->keybit[BIT_WORD(BTN_MOUSE)] = BIT_MASK(BTN_LEFT) |
-		BIT_MASK(BTN_MIDDLE) | BIT_MASK(BTN_RIGHT);
+	input_dev->keybit[BIT_WORD(BTN_MOUSE)] =
+				BIT_MASK(BTN_LEFT) | BIT_MASK(BTN_RIGHT);
 	input_dev->relbit[0] = BIT_MASK(REL_X) | BIT_MASK(REL_Y);
 
 	psmouse->set_rate = psmouse_set_rate;
@@ -1209,8 +1238,7 @@ static int psmouse_switch_protocol(struct psmouse *psmouse, const struct psmouse
 			return -1;
 
 		psmouse->type = proto->type;
-	}
-	else
+	} else
 		psmouse->type = psmouse_extensions(psmouse,
 						   psmouse_max_proto, true);
 
@@ -1431,24 +1459,10 @@ ssize_t psmouse_attr_show_helper(struct device *dev, struct device_attribute *de
 	struct serio *serio = to_serio_port(dev);
 	struct psmouse_attribute *attr = to_psmouse_attr(devattr);
 	struct psmouse *psmouse;
-	int retval;
-
-	retval = serio_pin_driver(serio);
-	if (retval)
-		return retval;
-
-	if (serio->drv != &psmouse_drv) {
-		retval = -ENODEV;
-		goto out;
-	}
 
 	psmouse = serio_get_drvdata(serio);
 
-	retval = attr->show(psmouse, attr->data, buf);
-
-out:
-	serio_unpin_driver(serio);
-	return retval;
+	return attr->show(psmouse, attr->data, buf);
 }
 
 ssize_t psmouse_attr_set_helper(struct device *dev, struct device_attribute *devattr,
@@ -1459,18 +1473,9 @@ ssize_t psmouse_attr_set_helper(struct device *dev, struct device_attribute *dev
 	struct psmouse *psmouse, *parent = NULL;
 	int retval;
 
-	retval = serio_pin_driver(serio);
-	if (retval)
-		return retval;
-
-	if (serio->drv != &psmouse_drv) {
-		retval = -ENODEV;
-		goto out_unpin;
-	}
-
 	retval = mutex_lock_interruptible(&psmouse_mutex);
 	if (retval)
-		goto out_unpin;
+		goto out;
 
 	psmouse = serio_get_drvdata(serio);
 
@@ -1500,8 +1505,7 @@ ssize_t psmouse_attr_set_helper(struct device *dev, struct device_attribute *dev
 
  out_unlock:
 	mutex_unlock(&psmouse_mutex);
- out_unpin:
-	serio_unpin_driver(serio);
+ out:
 	return retval;
 }
 
@@ -1563,9 +1567,7 @@ static ssize_t psmouse_attr_set_protocol(struct psmouse *psmouse, void *data, co
 		}
 
 		mutex_unlock(&psmouse_mutex);
-		serio_unpin_driver(serio);
 		serio_unregister_child_port(serio);
-		serio_pin_driver_uninterruptible(serio);
 		mutex_lock(&psmouse_mutex);
 
 		if (serio->drv != &psmouse_drv) {
@@ -1680,6 +1682,9 @@ static int __init psmouse_init(void)
 {
 	int err;
 
+	lifebook_module_init();
+	synaptics_module_init();
+
 	kpsmoused_wq = create_singlethread_workqueue("kpsmoused");
 	if (!kpsmoused_wq) {
 		printk(KERN_ERR "psmouse: failed to create kpsmoused workqueue\n");
diff --git a/drivers/input/mouse/sentelic.c b/drivers/input/mouse/sentelic.c
index f84cbd97c884..81a6b81cb2fe 100644
--- a/drivers/input/mouse/sentelic.c
+++ b/drivers/input/mouse/sentelic.c
@@ -2,7 +2,7 @@
  * Finger Sensing Pad PS/2 mouse driver.
  *
  * Copyright (C) 2005-2007 Asia Vital Components Co., Ltd.
- * Copyright (C) 2005-2009 Tai-hwa Liang, Sentelic Corporation.
+ * Copyright (C) 2005-2010 Tai-hwa Liang, Sentelic Corporation.
  *
  *   This program is free software; you can redistribute it and/or
  *   modify it under the terms of the GNU General Public License
@@ -658,9 +658,9 @@ static psmouse_ret_t fsp_process_byte(struct psmouse *psmouse)
 			if (packet[3] & BIT(1))
 				button_status |= 0x0f;	/* wheel up */
 			if (packet[3] & BIT(2))
-				button_status |= BIT(5);/* horizontal left */
+				button_status |= BIT(4);/* horizontal left */
 			if (packet[3] & BIT(3))
-				button_status |= BIT(4);/* horizontal right */
+				button_status |= BIT(5);/* horizontal right */
 			/* push back to packet queue */
 			if (button_status != 0)
 				packet[3] = button_status;
@@ -836,6 +836,7 @@ int fsp_init(struct psmouse *psmouse)
 	priv->flags |= FSPDRV_FLAG_EN_OPC;
 
 	/* Set up various supported input event bits */
+	__set_bit(BTN_MIDDLE, psmouse->dev->keybit);
 	__set_bit(BTN_BACK, psmouse->dev->keybit);
 	__set_bit(BTN_FORWARD, psmouse->dev->keybit);
 	__set_bit(REL_WHEEL, psmouse->dev->relbit);
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index f4a61252bcc9..d3f5243fa093 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -24,6 +24,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/dmi.h>
 #include <linux/input.h>
 #include <linux/serio.h>
 #include <linux/libps2.h>
@@ -629,25 +630,26 @@ static int synaptics_reconnect(struct psmouse *psmouse)
 	return 0;
 }
 
-#if defined(__i386__)
-#include <linux/dmi.h>
-static const struct dmi_system_id toshiba_dmi_table[] = {
+static bool impaired_toshiba_kbc;
+
+static const struct dmi_system_id __initconst toshiba_dmi_table[] = {
+#if defined(CONFIG_DMI) && defined(CONFIG_X86)
 	{
-		.ident = "Toshiba Satellite",
+		/* Toshiba Satellite */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "Satellite"),
 		},
 	},
 	{
-		.ident = "Toshiba Dynabook",
+		/* Toshiba Dynabook */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "dynabook"),
 		},
 	},
 	{
-		.ident = "Toshiba Portege M300",
+		/* Toshiba Portege M300 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "PORTEGE M300"),
@@ -655,7 +657,7 @@ static const struct dmi_system_id toshiba_dmi_table[] = {
 
 	},
 	{
-		.ident = "Toshiba Portege M300",
+		/* Toshiba Portege M300 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "Portable PC"),
@@ -664,8 +666,13 @@ static const struct dmi_system_id toshiba_dmi_table[] = {
 
 	},
 	{ }
-};
 #endif
+};
+
+void __init synaptics_module_init(void)
+{
+	impaired_toshiba_kbc = dmi_check_system(toshiba_dmi_table);
+}
 
 int synaptics_init(struct psmouse *psmouse)
 {
@@ -718,18 +725,16 @@ int synaptics_init(struct psmouse *psmouse)
 	if (SYN_CAP_PASS_THROUGH(priv->capabilities))
 		synaptics_pt_create(psmouse);
 
-#if defined(__i386__)
 	/*
 	 * Toshiba's KBC seems to have trouble handling data from
 	 * Synaptics as full rate, switch to lower rate which is roughly
 	 * thye same as rate of standard PS/2 mouse.
 	 */
-	if (psmouse->rate >= 80 && dmi_check_system(toshiba_dmi_table)) {
+	if (psmouse->rate >= 80 && impaired_toshiba_kbc) {
 		printk(KERN_INFO "synaptics: Toshiba %s detected, limiting rate to 40pps.\n",
 			dmi_get_system_info(DMI_PRODUCT_NAME));
 		psmouse->rate = 40;
 	}
-#endif
 
 	return 0;
 
@@ -738,12 +743,26 @@ int synaptics_init(struct psmouse *psmouse)
 	return -1;
 }
 
+bool synaptics_supported(void)
+{
+	return true;
+}
+
 #else /* CONFIG_MOUSE_PS2_SYNAPTICS */
 
+void __init synaptics_module_init(void)
+{
+}
+
 int synaptics_init(struct psmouse *psmouse)
 {
 	return -ENOSYS;
 }
 
+bool synaptics_supported(void)
+{
+	return false;
+}
+
 #endif /* CONFIG_MOUSE_PS2_SYNAPTICS */
 
diff --git a/drivers/input/mouse/synaptics.h b/drivers/input/mouse/synaptics.h
index 871f6fe377f9..f0f40a331dc8 100644
--- a/drivers/input/mouse/synaptics.h
+++ b/drivers/input/mouse/synaptics.h
@@ -105,8 +105,10 @@ struct synaptics_data {
 	int scroll;
 };
 
+void synaptics_module_init(void);
 int synaptics_detect(struct psmouse *psmouse, bool set_properties);
 int synaptics_init(struct psmouse *psmouse);
 void synaptics_reset(struct psmouse *psmouse);
+bool synaptics_supported(void);
 
 #endif /* _SYNAPTICS_H */
diff --git a/drivers/input/mouse/synaptics_i2c.c b/drivers/input/mouse/synaptics_i2c.c
index 7283c78044af..9867dfe2a638 100644
--- a/drivers/input/mouse/synaptics_i2c.c
+++ b/drivers/input/mouse/synaptics_i2c.c
@@ -420,8 +420,8 @@ static void synaptics_i2c_check_params(struct synaptics_i2c *touch)
 }
 
 /* Control the Device polling rate / Work Handler sleep time */
-unsigned long synaptics_i2c_adjust_delay(struct synaptics_i2c *touch,
-					 bool have_data)
+static unsigned long synaptics_i2c_adjust_delay(struct synaptics_i2c *touch,
+						bool have_data)
 {
 	unsigned long delay, nodata_count_thres;
 
@@ -520,7 +520,7 @@ static void synaptics_i2c_set_input_params(struct synaptics_i2c *touch)
 	__set_bit(BTN_LEFT, input->keybit);
 }
 
-struct synaptics_i2c *synaptics_i2c_touch_create(struct i2c_client *client)
+static struct synaptics_i2c *synaptics_i2c_touch_create(struct i2c_client *client)
 {
 	struct synaptics_i2c *touch;
 
diff --git a/drivers/input/mouse/touchkit_ps2.c b/drivers/input/mouse/touchkit_ps2.c
index 0308a0faa94d..909431c31ab4 100644
--- a/drivers/input/mouse/touchkit_ps2.c
+++ b/drivers/input/mouse/touchkit_ps2.c
@@ -86,7 +86,8 @@ int touchkit_ps2_detect(struct psmouse *psmouse, bool set_properties)
 
 	if (set_properties) {
 		dev->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_ABS);
-		__set_bit(BTN_TOUCH, dev->keybit);
+		dev->keybit[BIT_WORD(BTN_MOUSE)] = 0;
+		dev->keybit[BIT_WORD(BTN_TOUCH)] = BIT_MASK(BTN_TOUCH);
 		input_set_abs_params(dev, ABS_X, 0, TOUCHKIT_MAX_XC, 0, 0);
 		input_set_abs_params(dev, ABS_Y, 0, TOUCHKIT_MAX_YC, 0, 0);
 
diff --git a/drivers/input/mouse/trackpoint.c b/drivers/input/mouse/trackpoint.c
index e354362f2971..63d4a67830f2 100644
--- a/drivers/input/mouse/trackpoint.c
+++ b/drivers/input/mouse/trackpoint.c
@@ -284,7 +284,6 @@ static int trackpoint_reconnect(struct psmouse *psmouse)
 
 int trackpoint_detect(struct psmouse *psmouse, bool set_properties)
 {
-	struct trackpoint_data *priv;
 	struct ps2dev *ps2dev = &psmouse->ps2dev;
 	unsigned char firmware_id;
 	unsigned char button_info;
@@ -301,8 +300,8 @@ int trackpoint_detect(struct psmouse *psmouse, bool set_properties)
 		button_info = 0;
 	}
 
-	psmouse->private = priv = kzalloc(sizeof(struct trackpoint_data), GFP_KERNEL);
-	if (!priv)
+	psmouse->private = kzalloc(sizeof(struct trackpoint_data), GFP_KERNEL);
+	if (!psmouse->private)
 		return -1;
 
 	psmouse->vendor = "IBM";
@@ -311,7 +310,10 @@ int trackpoint_detect(struct psmouse *psmouse, bool set_properties)
 	psmouse->reconnect = trackpoint_reconnect;
 	psmouse->disconnect = trackpoint_disconnect;
 
-	trackpoint_defaults(priv);
+	if ((button_info & 0x0f) >= 3)
+		__set_bit(BTN_MIDDLE, psmouse->dev->keybit);
+
+	trackpoint_defaults(psmouse->private);
 	trackpoint_sync(psmouse);
 
 	error = sysfs_create_group(&ps2dev->serio->dev.kobj, &trackpoint_attr_group);
@@ -319,7 +321,8 @@ int trackpoint_detect(struct psmouse *psmouse, bool set_properties)
 		printk(KERN_ERR
 			"trackpoint.c: failed to create sysfs attributes, error: %d\n",
 			error);
-		kfree(priv);
+		kfree(psmouse->private);
+		psmouse->private = NULL;
 		return -1;
 	}
 
diff --git a/drivers/input/mouse/vsxxxaa.c b/drivers/input/mouse/vsxxxaa.c
index 70111443678e..bf2c0c80d6cc 100644
--- a/drivers/input/mouse/vsxxxaa.c
+++ b/drivers/input/mouse/vsxxxaa.c
@@ -86,27 +86,28 @@
 
 #define DRIVER_DESC "Driver for DEC VSXXX-AA and -GA mice and VSXXX-AB tablet"
 
-MODULE_AUTHOR ("Jan-Benedict Glaw <jbglaw@lug-owl.de>");
-MODULE_DESCRIPTION (DRIVER_DESC);
-MODULE_LICENSE ("GPL");
+MODULE_AUTHOR("Jan-Benedict Glaw <jbglaw@lug-owl.de>");
+MODULE_DESCRIPTION(DRIVER_DESC);
+MODULE_LICENSE("GPL");
 
 #undef VSXXXAA_DEBUG
 #ifdef VSXXXAA_DEBUG
-#define DBG(x...) printk (x)
+#define DBG(x...) printk(x)
 #else
 #define DBG(x...) do {} while (0)
 #endif
 
 #define VSXXXAA_INTRO_MASK	0x80
 #define VSXXXAA_INTRO_HEAD	0x80
-#define IS_HDR_BYTE(x)		(((x) & VSXXXAA_INTRO_MASK)	\
-					== VSXXXAA_INTRO_HEAD)
+#define IS_HDR_BYTE(x)			\
+	(((x) & VSXXXAA_INTRO_MASK) == VSXXXAA_INTRO_HEAD)
 
 #define VSXXXAA_PACKET_MASK	0xe0
 #define VSXXXAA_PACKET_REL	0x80
 #define VSXXXAA_PACKET_ABS	0xc0
 #define VSXXXAA_PACKET_POR	0xa0
-#define MATCH_PACKET_TYPE(data, type)	(((data) & VSXXXAA_PACKET_MASK) == (type))
+#define MATCH_PACKET_TYPE(data, type)	\
+	(((data) & VSXXXAA_PACKET_MASK) == (type))
 
 
 
@@ -123,52 +124,50 @@ struct vsxxxaa {
 	char phys[32];
 };
 
-static void
-vsxxxaa_drop_bytes (struct vsxxxaa *mouse, int num)
+static void vsxxxaa_drop_bytes(struct vsxxxaa *mouse, int num)
 {
-	if (num >= mouse->count)
+	if (num >= mouse->count) {
 		mouse->count = 0;
-	else {
-		memmove (mouse->buf, mouse->buf + num - 1, BUFLEN - num);
+	} else {
+		memmove(mouse->buf, mouse->buf + num - 1, BUFLEN - num);
 		mouse->count -= num;
 	}
 }
 
-static void
-vsxxxaa_queue_byte (struct vsxxxaa *mouse, unsigned char byte)
+static void vsxxxaa_queue_byte(struct vsxxxaa *mouse, unsigned char byte)
 {
 	if (mouse->count == BUFLEN) {
-		printk (KERN_ERR "%s on %s: Dropping a byte of full buffer.\n",
-				mouse->name, mouse->phys);
-		vsxxxaa_drop_bytes (mouse, 1);
+		printk(KERN_ERR "%s on %s: Dropping a byte of full buffer.\n",
+			mouse->name, mouse->phys);
+		vsxxxaa_drop_bytes(mouse, 1);
 	}
-	DBG (KERN_INFO "Queueing byte 0x%02x\n", byte);
+
+	DBG(KERN_INFO "Queueing byte 0x%02x\n", byte);
 
 	mouse->buf[mouse->count++] = byte;
 }
 
-static void
-vsxxxaa_detection_done (struct vsxxxaa *mouse)
+static void vsxxxaa_detection_done(struct vsxxxaa *mouse)
 {
 	switch (mouse->type) {
-		case 0x02:
-			strlcpy (mouse->name, "DEC VSXXX-AA/-GA mouse",
-				 sizeof (mouse->name));
-			break;
-
-		case 0x04:
-			strlcpy (mouse->name, "DEC VSXXX-AB digitizer",
-				 sizeof (mouse->name));
-			break;
-
-		default:
-			snprintf (mouse->name, sizeof (mouse->name),
-				  "unknown DEC pointer device (type = 0x%02x)",
-				  mouse->type);
-			break;
+	case 0x02:
+		strlcpy(mouse->name, "DEC VSXXX-AA/-GA mouse",
+			sizeof(mouse->name));
+		break;
+
+	case 0x04:
+		strlcpy(mouse->name, "DEC VSXXX-AB digitizer",
+			sizeof(mouse->name));
+		break;
+
+	default:
+		snprintf(mouse->name, sizeof(mouse->name),
+			 "unknown DEC pointer device (type = 0x%02x)",
+			 mouse->type);
+		break;
 	}
 
-	printk (KERN_INFO
+	printk(KERN_INFO
 		"Found %s version 0x%02x from country 0x%02x on port %s\n",
 		mouse->name, mouse->version, mouse->country, mouse->phys);
 }
@@ -176,42 +175,38 @@ vsxxxaa_detection_done (struct vsxxxaa *mouse)
 /*
  * Returns number of bytes to be dropped, 0 if packet is okay.
  */
-static int
-vsxxxaa_check_packet (struct vsxxxaa *mouse, int packet_len)
+static int vsxxxaa_check_packet(struct vsxxxaa *mouse, int packet_len)
 {
 	int i;
 
 	/* First byte must be a header byte */
-	if (!IS_HDR_BYTE (mouse->buf[0])) {
-		DBG ("vsck: len=%d, 1st=0x%02x\n", packet_len, mouse->buf[0]);
+	if (!IS_HDR_BYTE(mouse->buf[0])) {
+		DBG("vsck: len=%d, 1st=0x%02x\n", packet_len, mouse->buf[0]);
 		return 1;
 	}
 
 	/* Check all following bytes */
-	if (packet_len > 1) {
-		for (i = 1; i < packet_len; i++) {
-			if (IS_HDR_BYTE (mouse->buf[i])) {
-				printk (KERN_ERR "Need to drop %d bytes "
-						"of a broken packet.\n",
-						i - 1);
-				DBG (KERN_INFO "check: len=%d, b[%d]=0x%02x\n",
-						packet_len, i, mouse->buf[i]);
-				return i - 1;
-			}
+	for (i = 1; i < packet_len; i++) {
+		if (IS_HDR_BYTE(mouse->buf[i])) {
+			printk(KERN_ERR
+				"Need to drop %d bytes of a broken packet.\n",
+				i - 1);
+			DBG(KERN_INFO "check: len=%d, b[%d]=0x%02x\n",
+			    packet_len, i, mouse->buf[i]);
+			return i - 1;
 		}
 	}
 
 	return 0;
 }
 
-static __inline__ int
-vsxxxaa_smells_like_packet (struct vsxxxaa *mouse, unsigned char type, size_t len)
+static inline int vsxxxaa_smells_like_packet(struct vsxxxaa *mouse,
+					     unsigned char type, size_t len)
 {
-	return (mouse->count >= len) && MATCH_PACKET_TYPE (mouse->buf[0], type);
+	return mouse->count >= len && MATCH_PACKET_TYPE(mouse->buf[0], type);
 }
 
-static void
-vsxxxaa_handle_REL_packet (struct vsxxxaa *mouse)
+static void vsxxxaa_handle_REL_packet(struct vsxxxaa *mouse)
 {
 	struct input_dev *dev = mouse->dev;
 	unsigned char *buf = mouse->buf;
@@ -232,43 +227,42 @@ vsxxxaa_handle_REL_packet (struct vsxxxaa *mouse)
 	 * 0, bit 4 of byte 0 is direction.
 	 */
 	dx = buf[1] & 0x7f;
-	dx *= ((buf[0] >> 4) & 0x01)? 1: -1;
+	dx *= ((buf[0] >> 4) & 0x01) ? 1 : -1;
 
 	/*
 	 * Low 7 bit of byte 2 are abs(dy), bit 7 is
 	 * 0, bit 3 of byte 0 is direction.
 	 */
 	dy = buf[2] & 0x7f;
-	dy *= ((buf[0] >> 3) & 0x01)? -1: 1;
+	dy *= ((buf[0] >> 3) & 0x01) ? -1 : 1;
 
 	/*
 	 * Get button state. It's the low three bits
 	 * (for three buttons) of byte 0.
 	 */
-	left	= (buf[0] & 0x04)? 1: 0;
-	middle	= (buf[0] & 0x02)? 1: 0;
-	right	= (buf[0] & 0x01)? 1: 0;
+	left	= buf[0] & 0x04;
+	middle	= buf[0] & 0x02;
+	right	= buf[0] & 0x01;
 
-	vsxxxaa_drop_bytes (mouse, 3);
+	vsxxxaa_drop_bytes(mouse, 3);
 
-	DBG (KERN_INFO "%s on %s: dx=%d, dy=%d, buttons=%s%s%s\n",
-			mouse->name, mouse->phys, dx, dy,
-			left? "L": "l", middle? "M": "m", right? "R": "r");
+	DBG(KERN_INFO "%s on %s: dx=%d, dy=%d, buttons=%s%s%s\n",
+	    mouse->name, mouse->phys, dx, dy,
+	    left ? "L" : "l", middle ? "M" : "m", right ? "R" : "r");
 
 	/*
 	 * Report what we've found so far...
 	 */
-	input_report_key (dev, BTN_LEFT, left);
-	input_report_key (dev, BTN_MIDDLE, middle);
-	input_report_key (dev, BTN_RIGHT, right);
-	input_report_key (dev, BTN_TOUCH, 0);
-	input_report_rel (dev, REL_X, dx);
-	input_report_rel (dev, REL_Y, dy);
-	input_sync (dev);
+	input_report_key(dev, BTN_LEFT, left);
+	input_report_key(dev, BTN_MIDDLE, middle);
+	input_report_key(dev, BTN_RIGHT, right);
+	input_report_key(dev, BTN_TOUCH, 0);
+	input_report_rel(dev, REL_X, dx);
+	input_report_rel(dev, REL_Y, dy);
+	input_sync(dev);
 }
 
-static void
-vsxxxaa_handle_ABS_packet (struct vsxxxaa *mouse)
+static void vsxxxaa_handle_ABS_packet(struct vsxxxaa *mouse)
 {
 	struct input_dev *dev = mouse->dev;
 	unsigned char *buf = mouse->buf;
@@ -296,32 +290,31 @@ vsxxxaa_handle_ABS_packet (struct vsxxxaa *mouse)
 	/*
 	 * Get button state. It's bits <4..1> of byte 0.
 	 */
-	left	= (buf[0] & 0x02)? 1: 0;
-	middle	= (buf[0] & 0x04)? 1: 0;
-	right	= (buf[0] & 0x08)? 1: 0;
-	touch	= (buf[0] & 0x10)? 1: 0;
+	left	= buf[0] & 0x02;
+	middle	= buf[0] & 0x04;
+	right	= buf[0] & 0x08;
+	touch	= buf[0] & 0x10;
 
-	vsxxxaa_drop_bytes (mouse, 5);
+	vsxxxaa_drop_bytes(mouse, 5);
 
-	DBG (KERN_INFO "%s on %s: x=%d, y=%d, buttons=%s%s%s%s\n",
-			mouse->name, mouse->phys, x, y,
-			left? "L": "l", middle? "M": "m",
-			right? "R": "r", touch? "T": "t");
+	DBG(KERN_INFO "%s on %s: x=%d, y=%d, buttons=%s%s%s%s\n",
+	    mouse->name, mouse->phys, x, y,
+	    left ? "L" : "l", middle ? "M" : "m",
+	    right ? "R" : "r", touch ? "T" : "t");
 
 	/*
 	 * Report what we've found so far...
 	 */
-	input_report_key (dev, BTN_LEFT, left);
-	input_report_key (dev, BTN_MIDDLE, middle);
-	input_report_key (dev, BTN_RIGHT, right);
-	input_report_key (dev, BTN_TOUCH, touch);
-	input_report_abs (dev, ABS_X, x);
-	input_report_abs (dev, ABS_Y, y);
-	input_sync (dev);
+	input_report_key(dev, BTN_LEFT, left);
+	input_report_key(dev, BTN_MIDDLE, middle);
+	input_report_key(dev, BTN_RIGHT, right);
+	input_report_key(dev, BTN_TOUCH, touch);
+	input_report_abs(dev, ABS_X, x);
+	input_report_abs(dev, ABS_Y, y);
+	input_sync(dev);
 }
 
-static void
-vsxxxaa_handle_POR_packet (struct vsxxxaa *mouse)
+static void vsxxxaa_handle_POR_packet(struct vsxxxaa *mouse)
 {
 	struct input_dev *dev = mouse->dev;
 	unsigned char *buf = mouse->buf;
@@ -356,24 +349,24 @@ vsxxxaa_handle_POR_packet (struct vsxxxaa *mouse)
 	 * (for three buttons) of byte 0. Maybe even the bit <3>
 	 * has some meaning if a tablet is attached.
 	 */
-	left	= (buf[0] & 0x04)? 1: 0;
-	middle	= (buf[0] & 0x02)? 1: 0;
-	right	= (buf[0] & 0x01)? 1: 0;
+	left	= buf[0] & 0x04;
+	middle	= buf[0] & 0x02;
+	right	= buf[0] & 0x01;
 
-	vsxxxaa_drop_bytes (mouse, 4);
-	vsxxxaa_detection_done (mouse);
+	vsxxxaa_drop_bytes(mouse, 4);
+	vsxxxaa_detection_done(mouse);
 
 	if (error <= 0x1f) {
 		/* No (serious) error. Report buttons */
-		input_report_key (dev, BTN_LEFT, left);
-		input_report_key (dev, BTN_MIDDLE, middle);
-		input_report_key (dev, BTN_RIGHT, right);
-		input_report_key (dev, BTN_TOUCH, 0);
-		input_sync (dev);
+		input_report_key(dev, BTN_LEFT, left);
+		input_report_key(dev, BTN_MIDDLE, middle);
+		input_report_key(dev, BTN_RIGHT, right);
+		input_report_key(dev, BTN_TOUCH, 0);
+		input_sync(dev);
 
 		if (error != 0)
-			printk (KERN_INFO "Your %s on %s reports error=0x%02x\n",
-					mouse->name, mouse->phys, error);
+			printk(KERN_INFO "Your %s on %s reports error=0x%02x\n",
+				mouse->name, mouse->phys, error);
 
 	}
 
@@ -381,18 +374,18 @@ vsxxxaa_handle_POR_packet (struct vsxxxaa *mouse)
 	 * If the mouse was hot-plugged, we need to force differential mode
 	 * now... However, give it a second to recover from it's reset.
 	 */
-	printk (KERN_NOTICE "%s on %s: Forceing standard packet format, "
-			"incremental streaming mode and 72 samples/sec\n",
-			mouse->name, mouse->phys);
-	serio_write (mouse->serio, 'S');	/* Standard format */
-	mdelay (50);
-	serio_write (mouse->serio, 'R');	/* Incremental */
-	mdelay (50);
-	serio_write (mouse->serio, 'L');	/* 72 samples/sec */
+	printk(KERN_NOTICE
+		"%s on %s: Forcing standard packet format, "
+		"incremental streaming mode and 72 samples/sec\n",
+		mouse->name, mouse->phys);
+	serio_write(mouse->serio, 'S');	/* Standard format */
+	mdelay(50);
+	serio_write(mouse->serio, 'R');	/* Incremental */
+	mdelay(50);
+	serio_write(mouse->serio, 'L');	/* 72 samples/sec */
 }
 
-static void
-vsxxxaa_parse_buffer (struct vsxxxaa *mouse)
+static void vsxxxaa_parse_buffer(struct vsxxxaa *mouse)
 {
 	unsigned char *buf = mouse->buf;
 	int stray_bytes;
@@ -409,122 +402,107 @@ vsxxxaa_parse_buffer (struct vsxxxaa *mouse)
 		 * activity on the mouse.
 		 */
 		while (mouse->count > 0 && !IS_HDR_BYTE(buf[0])) {
-			printk (KERN_ERR "%s on %s: Dropping a byte to regain "
-					"sync with mouse data stream...\n",
-					mouse->name, mouse->phys);
-			vsxxxaa_drop_bytes (mouse, 1);
+			printk(KERN_ERR "%s on %s: Dropping a byte to regain "
+				"sync with mouse data stream...\n",
+				mouse->name, mouse->phys);
+			vsxxxaa_drop_bytes(mouse, 1);
 		}
 
 		/*
 		 * Check for packets we know about.
 		 */
 
-		if (vsxxxaa_smells_like_packet (mouse, VSXXXAA_PACKET_REL, 3)) {
+		if (vsxxxaa_smells_like_packet(mouse, VSXXXAA_PACKET_REL, 3)) {
 			/* Check for broken packet */
-			stray_bytes = vsxxxaa_check_packet (mouse, 3);
-			if (stray_bytes > 0) {
-				printk (KERN_ERR "Dropping %d bytes now...\n",
-						stray_bytes);
-				vsxxxaa_drop_bytes (mouse, stray_bytes);
-				continue;
-			}
-
-			vsxxxaa_handle_REL_packet (mouse);
-			continue; /* More to parse? */
-		}
+			stray_bytes = vsxxxaa_check_packet(mouse, 3);
+			if (!stray_bytes)
+				vsxxxaa_handle_REL_packet(mouse);
 
-		if (vsxxxaa_smells_like_packet (mouse, VSXXXAA_PACKET_ABS, 5)) {
+		} else if (vsxxxaa_smells_like_packet(mouse,
+						      VSXXXAA_PACKET_ABS, 5)) {
 			/* Check for broken packet */
-			stray_bytes = vsxxxaa_check_packet (mouse, 5);
-			if (stray_bytes > 0) {
-				printk (KERN_ERR "Dropping %d bytes now...\n",
-						stray_bytes);
-				vsxxxaa_drop_bytes (mouse, stray_bytes);
-				continue;
-			}
-
-			vsxxxaa_handle_ABS_packet (mouse);
-			continue; /* More to parse? */
-		}
+			stray_bytes = vsxxxaa_check_packet(mouse, 5);
+			if (!stray_bytes)
+				vsxxxaa_handle_ABS_packet(mouse);
 
-		if (vsxxxaa_smells_like_packet (mouse, VSXXXAA_PACKET_POR, 4)) {
+		} else if (vsxxxaa_smells_like_packet(mouse,
+						      VSXXXAA_PACKET_POR, 4)) {
 			/* Check for broken packet */
-			stray_bytes = vsxxxaa_check_packet (mouse, 4);
-			if (stray_bytes > 0) {
-				printk (KERN_ERR "Dropping %d bytes now...\n",
-						stray_bytes);
-				vsxxxaa_drop_bytes (mouse, stray_bytes);
-				continue;
-			}
-
-			vsxxxaa_handle_POR_packet (mouse);
-			continue; /* More to parse? */
+			stray_bytes = vsxxxaa_check_packet(mouse, 4);
+			if (!stray_bytes)
+				vsxxxaa_handle_POR_packet(mouse);
+
+		} else {
+			break; /* No REL, ABS or POR packet found */
+		}
+
+		if (stray_bytes > 0) {
+			printk(KERN_ERR "Dropping %d bytes now...\n",
+				stray_bytes);
+			vsxxxaa_drop_bytes(mouse, stray_bytes);
 		}
 
-		break; /* No REL, ABS or POR packet found */
 	} while (1);
 }
 
-static irqreturn_t
-vsxxxaa_interrupt (struct serio *serio, unsigned char data, unsigned int flags)
+static irqreturn_t vsxxxaa_interrupt(struct serio *serio,
+				     unsigned char data, unsigned int flags)
 {
-	struct vsxxxaa *mouse = serio_get_drvdata (serio);
+	struct vsxxxaa *mouse = serio_get_drvdata(serio);
 
-	vsxxxaa_queue_byte (mouse, data);
-	vsxxxaa_parse_buffer (mouse);
+	vsxxxaa_queue_byte(mouse, data);
+	vsxxxaa_parse_buffer(mouse);
 
 	return IRQ_HANDLED;
 }
 
-static void
-vsxxxaa_disconnect (struct serio *serio)
+static void vsxxxaa_disconnect(struct serio *serio)
 {
-	struct vsxxxaa *mouse = serio_get_drvdata (serio);
+	struct vsxxxaa *mouse = serio_get_drvdata(serio);
 
-	serio_close (serio);
-	serio_set_drvdata (serio, NULL);
-	input_unregister_device (mouse->dev);
-	kfree (mouse);
+	serio_close(serio);
+	serio_set_drvdata(serio, NULL);
+	input_unregister_device(mouse->dev);
+	kfree(mouse);
 }
 
-static int
-vsxxxaa_connect (struct serio *serio, struct serio_driver *drv)
+static int vsxxxaa_connect(struct serio *serio, struct serio_driver *drv)
 {
 	struct vsxxxaa *mouse;
 	struct input_dev *input_dev;
 	int err = -ENOMEM;
 
-	mouse = kzalloc (sizeof (struct vsxxxaa), GFP_KERNEL);
-	input_dev = input_allocate_device ();
+	mouse = kzalloc(sizeof(struct vsxxxaa), GFP_KERNEL);
+	input_dev = input_allocate_device();
 	if (!mouse || !input_dev)
 		goto fail1;
 
 	mouse->dev = input_dev;
 	mouse->serio = serio;
-	strlcat (mouse->name, "DEC VSXXX-AA/-GA mouse or VSXXX-AB digitizer",
-		 sizeof (mouse->name));
-	snprintf (mouse->phys, sizeof (mouse->phys), "%s/input0", serio->phys);
+	strlcat(mouse->name, "DEC VSXXX-AA/-GA mouse or VSXXX-AB digitizer",
+		 sizeof(mouse->name));
+	snprintf(mouse->phys, sizeof(mouse->phys), "%s/input0", serio->phys);
 
 	input_dev->name = mouse->name;
 	input_dev->phys = mouse->phys;
 	input_dev->id.bustype = BUS_RS232;
 	input_dev->dev.parent = &serio->dev;
 
-	set_bit (EV_KEY, input_dev->evbit);		/* We have buttons */
-	set_bit (EV_REL, input_dev->evbit);
-	set_bit (EV_ABS, input_dev->evbit);
-	set_bit (BTN_LEFT, input_dev->keybit);		/* We have 3 buttons */
-	set_bit (BTN_MIDDLE, input_dev->keybit);
-	set_bit (BTN_RIGHT, input_dev->keybit);
-	set_bit (BTN_TOUCH, input_dev->keybit);		/* ...and Tablet */
-	set_bit (REL_X, input_dev->relbit);
-	set_bit (REL_Y, input_dev->relbit);
-	input_set_abs_params (input_dev, ABS_X, 0, 1023, 0, 0);
-	input_set_abs_params (input_dev, ABS_Y, 0, 1023, 0, 0);
-
-	serio_set_drvdata (serio, mouse);
-
-	err = serio_open (serio, drv);
+	__set_bit(EV_KEY, input_dev->evbit);		/* We have buttons */
+	__set_bit(EV_REL, input_dev->evbit);
+	__set_bit(EV_ABS, input_dev->evbit);
+	__set_bit(BTN_LEFT, input_dev->keybit);		/* We have 3 buttons */
+	__set_bit(BTN_MIDDLE, input_dev->keybit);
+	__set_bit(BTN_RIGHT, input_dev->keybit);
+	__set_bit(BTN_TOUCH, input_dev->keybit);	/* ...and Tablet */
+	__set_bit(REL_X, input_dev->relbit);
+	__set_bit(REL_Y, input_dev->relbit);
+	input_set_abs_params(input_dev, ABS_X, 0, 1023, 0, 0);
+	input_set_abs_params(input_dev, ABS_Y, 0, 1023, 0, 0);
+
+	serio_set_drvdata(serio, mouse);
+
+	err = serio_open(serio, drv);
 	if (err)
 		goto fail2;
 
@@ -532,18 +510,18 @@ vsxxxaa_connect (struct serio *serio, struct serio_driver *drv)
 	 * Request selftest. Standard packet format and differential
 	 * mode will be requested after the device ID'ed successfully.
 	 */
-	serio_write (serio, 'T'); /* Test */
+	serio_write(serio, 'T'); /* Test */
 
-	err = input_register_device (input_dev);
+	err = input_register_device(input_dev);
 	if (err)
 		goto fail3;
 
 	return 0;
 
- fail3:	serio_close (serio);
- fail2:	serio_set_drvdata (serio, NULL);
- fail1:	input_free_device (input_dev);
-	kfree (mouse);
+ fail3:	serio_close(serio);
+ fail2:	serio_set_drvdata(serio, NULL);
+ fail1:	input_free_device(input_dev);
+	kfree(mouse);
 	return err;
 }
 
@@ -570,18 +548,16 @@ static struct serio_driver vsxxxaa_drv = {
 	.disconnect	= vsxxxaa_disconnect,
 };
 
-static int __init
-vsxxxaa_init (void)
+static int __init vsxxxaa_init(void)
 {
 	return serio_register_driver(&vsxxxaa_drv);
 }
 
-static void __exit
-vsxxxaa_exit (void)
+static void __exit vsxxxaa_exit(void)
 {
 	serio_unregister_driver(&vsxxxaa_drv);
 }
 
-module_init (vsxxxaa_init);
-module_exit (vsxxxaa_exit);
+module_init(vsxxxaa_init);
+module_exit(vsxxxaa_exit);
 
diff --git a/drivers/input/serio/Kconfig b/drivers/input/serio/Kconfig
index aa533ceffe34..7e319d65ec57 100644
--- a/drivers/input/serio/Kconfig
+++ b/drivers/input/serio/Kconfig
@@ -201,4 +201,12 @@ config SERIO_XILINX_XPS_PS2
 	  To compile this driver as a module, choose M here: the
 	  module will be called xilinx_ps2.
 
+config SERIO_ALTERA_PS2
+	tristate "Altera UP PS/2 controller"
+	help
+	  Say Y here if you have Altera University Program PS/2 ports.
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called altera_ps2.
+
 endif
diff --git a/drivers/input/serio/Makefile b/drivers/input/serio/Makefile
index 9b6c8135955f..bf945f789d05 100644
--- a/drivers/input/serio/Makefile
+++ b/drivers/input/serio/Makefile
@@ -22,3 +22,4 @@ obj-$(CONFIG_SERIO_MACEPS2)	+= maceps2.o
 obj-$(CONFIG_SERIO_LIBPS2)	+= libps2.o
 obj-$(CONFIG_SERIO_RAW)		+= serio_raw.o
 obj-$(CONFIG_SERIO_XILINX_XPS_PS2)	+= xilinx_ps2.o
+obj-$(CONFIG_SERIO_ALTERA_PS2)	+= altera_ps2.o
diff --git a/drivers/input/serio/altera_ps2.c b/drivers/input/serio/altera_ps2.c
new file mode 100644
index 000000000000..320b7ca48bf8
--- /dev/null
+++ b/drivers/input/serio/altera_ps2.c
@@ -0,0 +1,203 @@
+/*
+ * Altera University Program PS2 controller driver
+ *
+ * Copyright (C) 2008 Thomas Chou <thomas@wytron.com.tw>
+ *
+ * Based on sa1111ps2.c, which is:
+ * Copyright (C) 2002 Russell King
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/input.h>
+#include <linux/serio.h>
+#include <linux/interrupt.h>
+#include <linux/platform_device.h>
+#include <linux/io.h>
+
+#define DRV_NAME "altera_ps2"
+
+struct ps2if {
+	struct serio *io;
+	struct resource *iomem_res;
+	void __iomem *base;
+	unsigned irq;
+};
+
+/*
+ * Read all bytes waiting in the PS2 port.  There should be
+ * at the most one, but we loop for safety.
+ */
+static irqreturn_t altera_ps2_rxint(int irq, void *dev_id)
+{
+	struct ps2if *ps2if = dev_id;
+	unsigned int status;
+	int handled = IRQ_NONE;
+
+	while ((status = readl(ps2if->base)) & 0xffff0000) {
+		serio_interrupt(ps2if->io, status & 0xff, 0);
+		handled = IRQ_HANDLED;
+	}
+
+	return handled;
+}
+
+/*
+ * Write a byte to the PS2 port.
+ */
+static int altera_ps2_write(struct serio *io, unsigned char val)
+{
+	struct ps2if *ps2if = io->port_data;
+
+	writel(val, ps2if->base);
+	return 0;
+}
+
+static int altera_ps2_open(struct serio *io)
+{
+	struct ps2if *ps2if = io->port_data;
+
+	/* clear fifo */
+	while (readl(ps2if->base) & 0xffff0000)
+		/* empty */;
+
+	writel(1, ps2if->base + 4); /* enable rx irq */
+	return 0;
+}
+
+static void altera_ps2_close(struct serio *io)
+{
+	struct ps2if *ps2if = io->port_data;
+
+	writel(0, ps2if->base); /* disable rx irq */
+}
+
+/*
+ * Add one device to this driver.
+ */
+static int __devinit altera_ps2_probe(struct platform_device *pdev)
+{
+	struct ps2if *ps2if;
+	struct serio *serio;
+	int error, irq;
+
+	ps2if = kzalloc(sizeof(struct ps2if), GFP_KERNEL);
+	serio = kzalloc(sizeof(struct serio), GFP_KERNEL);
+	if (!ps2if || !serio) {
+		error = -ENOMEM;
+		goto err_free_mem;
+	}
+
+	serio->id.type		= SERIO_8042;
+	serio->write		= altera_ps2_write;
+	serio->open		= altera_ps2_open;
+	serio->close		= altera_ps2_close;
+	strlcpy(serio->name, dev_name(&pdev->dev), sizeof(serio->name));
+	strlcpy(serio->phys, dev_name(&pdev->dev), sizeof(serio->phys));
+	serio->port_data	= ps2if;
+	serio->dev.parent	= &pdev->dev;
+	ps2if->io		= serio;
+
+	ps2if->iomem_res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	if (ps2if->iomem_res == NULL) {
+		error = -ENOENT;
+		goto err_free_mem;
+	}
+
+
+	irq = platform_get_irq(pdev, 0);
+	if (irq < 0) {
+		error = -ENXIO;
+		goto err_free_mem;
+	}
+	ps2if->irq = irq;
+
+	if (!request_mem_region(ps2if->iomem_res->start,
+				resource_size(ps2if->iomem_res), pdev->name)) {
+		error = -EBUSY;
+		goto err_free_mem;
+	}
+
+	ps2if->base = ioremap(ps2if->iomem_res->start,
+			      resource_size(ps2if->iomem_res));
+	if (!ps2if->base) {
+		error = -ENOMEM;
+		goto err_free_res;
+	}
+
+	error = request_irq(ps2if->irq, altera_ps2_rxint, 0, pdev->name, ps2if);
+	if (error) {
+		dev_err(&pdev->dev, "could not allocate IRQ %d: %d\n",
+			ps2if->irq, error);
+		goto err_unmap;
+	}
+
+	dev_info(&pdev->dev, "base %p, irq %d\n", ps2if->base, ps2if->irq);
+
+	serio_register_port(ps2if->io);
+	platform_set_drvdata(pdev, ps2if);
+
+	return 0;
+
+ err_unmap:
+	iounmap(ps2if->base);
+ err_free_res:
+	release_mem_region(ps2if->iomem_res->start,
+			   resource_size(ps2if->iomem_res));
+ err_free_mem:
+	kfree(ps2if);
+	kfree(serio);
+	return error;
+}
+
+/*
+ * Remove one device from this driver.
+ */
+static int __devexit altera_ps2_remove(struct platform_device *pdev)
+{
+	struct ps2if *ps2if = platform_get_drvdata(pdev);
+
+	platform_set_drvdata(pdev, NULL);
+	serio_unregister_port(ps2if->io);
+	free_irq(ps2if->irq, ps2if);
+	iounmap(ps2if->base);
+	release_mem_region(ps2if->iomem_res->start,
+			   resource_size(ps2if->iomem_res));
+	kfree(ps2if);
+
+	return 0;
+}
+
+/*
+ * Our device driver structure
+ */
+static struct platform_driver altera_ps2_driver = {
+	.probe		= altera_ps2_probe,
+	.remove		= __devexit_p(altera_ps2_remove),
+	.driver	= {
+		.name	= DRV_NAME,
+		.owner	= THIS_MODULE,
+	},
+};
+
+static int __init altera_ps2_init(void)
+{
+	return platform_driver_register(&altera_ps2_driver);
+}
+
+static void __exit altera_ps2_exit(void)
+{
+	platform_driver_unregister(&altera_ps2_driver);
+}
+
+module_init(altera_ps2_init);
+module_exit(altera_ps2_exit);
+
+MODULE_DESCRIPTION("Altera University Program PS2 controller driver");
+MODULE_AUTHOR("Thomas Chou <thomas@wytron.com.tw>");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:" DRV_NAME);
diff --git a/drivers/input/serio/ambakmi.c b/drivers/input/serio/ambakmi.c
index 89b394183a75..92563a681d65 100644
--- a/drivers/input/serio/ambakmi.c
+++ b/drivers/input/serio/ambakmi.c
@@ -107,7 +107,7 @@ static void amba_kmi_close(struct serio *io)
 	clk_disable(kmi->clk);
 }
 
-static int amba_kmi_probe(struct amba_device *dev, struct amba_id *id)
+static int __devinit amba_kmi_probe(struct amba_device *dev, struct amba_id *id)
 {
 	struct amba_kmi_port *kmi;
 	struct serio *io;
@@ -134,7 +134,7 @@ static int amba_kmi_probe(struct amba_device *dev, struct amba_id *id)
 	io->port_data	= kmi;
 	io->dev.parent	= &dev->dev;
 
-	kmi->io 	= io;
+	kmi->io		= io;
 	kmi->base	= ioremap(dev->res.start, resource_size(&dev->res));
 	if (!kmi->base) {
 		ret = -ENOMEM;
@@ -162,7 +162,7 @@ static int amba_kmi_probe(struct amba_device *dev, struct amba_id *id)
 	return ret;
 }
 
-static int amba_kmi_remove(struct amba_device *dev)
+static int __devexit amba_kmi_remove(struct amba_device *dev)
 {
 	struct amba_kmi_port *kmi = amba_get_drvdata(dev);
 
@@ -197,10 +197,11 @@ static struct amba_id amba_kmi_idtable[] = {
 static struct amba_driver ambakmi_driver = {
 	.drv		= {
 		.name	= "kmi-pl050",
+		.owner	= THIS_MODULE,
 	},
 	.id_table	= amba_kmi_idtable,
 	.probe		= amba_kmi_probe,
-	.remove		= amba_kmi_remove,
+	.remove		= __devexit_p(amba_kmi_remove),
 	.resume		= amba_kmi_resume,
 };
 
diff --git a/drivers/input/serio/at32psif.c b/drivers/input/serio/at32psif.c
index a6fb7a3dcc46..b54452a8c771 100644
--- a/drivers/input/serio/at32psif.c
+++ b/drivers/input/serio/at32psif.c
@@ -137,7 +137,7 @@ static int psif_write(struct serio *io, unsigned char val)
 	spin_lock_irqsave(&psif->lock, flags);
 
 	while (!(psif_readl(psif, SR) & PSIF_BIT(TXEMPTY)) && timeout--)
-		msleep(10);
+		udelay(50);
 
 	if (timeout >= 0) {
 		psif_writel(psif, THR, val);
@@ -352,6 +352,7 @@ static struct platform_driver psif_driver = {
 	.remove		= __exit_p(psif_remove),
 	.driver		= {
 		.name	= "atmel_psif",
+		.owner	= THIS_MODULE,
 	},
 	.suspend	= psif_suspend,
 	.resume		= psif_resume,
diff --git a/drivers/input/serio/gscps2.c b/drivers/input/serio/gscps2.c
index bd0f92d9f40f..06addfa7cc47 100644
--- a/drivers/input/serio/gscps2.c
+++ b/drivers/input/serio/gscps2.c
@@ -6,7 +6,7 @@
  * Copyright (c) 2002 Thibaut Varene <varenet@parisc-linux.org>
  *
  * Pieces of code based on linux-2.4's hp_mouse.c & hp_keyb.c
- * 	Copyright (c) 1999 Alex deVries <alex@onefishtwo.ca>
+ *	Copyright (c) 1999 Alex deVries <alex@onefishtwo.ca>
  *	Copyright (c) 1999-2000 Philipp Rumpf <prumpf@tux.org>
  *	Copyright (c) 2000 Xavier Debacker <debackex@esiee.fr>
  *	Copyright (c) 2000-2001 Thomas Marteau <marteaut@esiee.fr>
@@ -326,7 +326,7 @@ static void gscps2_close(struct serio *port)
  * @return: success/error report
  */
 
-static int __init gscps2_probe(struct parisc_device *dev)
+static int __devinit gscps2_probe(struct parisc_device *dev)
 {
 	struct gscps2port *ps2port;
 	struct serio *serio;
@@ -443,7 +443,7 @@ static struct parisc_driver parisc_ps2_driver = {
 	.name		= "gsc_ps2",
 	.id_table	= gscps2_device_tbl,
 	.probe		= gscps2_probe,
-	.remove		= gscps2_remove,
+	.remove		= __devexit_p(gscps2_remove),
 };
 
 static int __init gscps2_init(void)
diff --git a/drivers/input/serio/hil_mlc.c b/drivers/input/serio/hil_mlc.c
index 7ba9f2b2c041..6cd03ebaf5fb 100644
--- a/drivers/input/serio/hil_mlc.c
+++ b/drivers/input/serio/hil_mlc.c
@@ -993,10 +993,8 @@ int hil_mlc_unregister(hil_mlc *mlc)
 
 static int __init hil_mlc_init(void)
 {
-	init_timer(&hil_mlcs_kicker);
-	hil_mlcs_kicker.expires = jiffies + HZ;
-	hil_mlcs_kicker.function = &hil_mlcs_timer;
-	add_timer(&hil_mlcs_kicker);
+	setup_timer(&hil_mlcs_kicker, &hil_mlcs_timer, 0);
+	mod_timer(&hil_mlcs_kicker, jiffies + HZ);
 
 	tasklet_enable(&hil_mlcs_tasklet);
 
@@ -1005,7 +1003,7 @@ static int __init hil_mlc_init(void)
 
 static void __exit hil_mlc_exit(void)
 {
-	del_timer(&hil_mlcs_kicker);
+	del_timer_sync(&hil_mlcs_kicker);
 
 	tasklet_disable(&hil_mlcs_tasklet);
 	tasklet_kill(&hil_mlcs_tasklet);
diff --git a/drivers/input/serio/hp_sdc.c b/drivers/input/serio/hp_sdc.c
index 1c9410d1822c..bcc2d30ec245 100644
--- a/drivers/input/serio/hp_sdc.c
+++ b/drivers/input/serio/hp_sdc.c
@@ -955,7 +955,7 @@ static int __init hp_sdc_init_hppa(struct parisc_device *d)
 	INIT_DELAYED_WORK(&moduleloader_work, request_module_delayed);
 
 	ret = hp_sdc_init();
-	/* after sucessfull initialization give SDC some time to settle
+	/* after successfull initialization give SDC some time to settle
 	 * and then load the hp_sdc_mlc upper layer driver */
 	if (!ret)
 		schedule_delayed_work(&moduleloader_work,
diff --git a/drivers/input/serio/hp_sdc_mlc.c b/drivers/input/serio/hp_sdc_mlc.c
index 820e51673b26..7d2b820ef58d 100644
--- a/drivers/input/serio/hp_sdc_mlc.c
+++ b/drivers/input/serio/hp_sdc_mlc.c
@@ -125,7 +125,7 @@ static void hp_sdc_mlc_isr (int irq, void *dev_id,
 		break;
 
 	default:
-		printk(KERN_WARNING PREFIX "Unkown HIL Error status (%x)!\n", data);
+		printk(KERN_WARNING PREFIX "Unknown HIL Error status (%x)!\n", data);
 		break;
 	}
 
diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
index 2bcf1ace27c0..2a5982e532f8 100644
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -67,10 +67,12 @@ static inline void i8042_write_command(int val)
 
 #include <linux/dmi.h>
 
-static struct dmi_system_id __initdata i8042_dmi_noloop_table[] = {
+static const struct dmi_system_id __initconst i8042_dmi_noloop_table[] = {
 	{
-		/* AUX LOOP command does not raise AUX IRQ */
-		.ident = "Arima-Rioworks HDAMB",
+		/*
+		 * Arima-Rioworks HDAMB -
+		 * AUX LOOP command does not raise AUX IRQ
+		 */
 		.matches = {
 			DMI_MATCH(DMI_BOARD_VENDOR, "RIOWORKS"),
 			DMI_MATCH(DMI_BOARD_NAME, "HDAMB"),
@@ -78,7 +80,7 @@ static struct dmi_system_id __initdata i8042_dmi_noloop_table[] = {
 		},
 	},
 	{
-		.ident = "ASUS G1S",
+		/* ASUS G1S */
 		.matches = {
 			DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK Computer Inc."),
 			DMI_MATCH(DMI_BOARD_NAME, "G1S"),
@@ -86,8 +88,7 @@ static struct dmi_system_id __initdata i8042_dmi_noloop_table[] = {
 		},
 	},
 	{
-		/* AUX LOOP command does not raise AUX IRQ */
-		.ident = "ASUS P65UP5",
+		/* ASUS P65UP5 - AUX LOOP command does not raise AUX IRQ */
 		.matches = {
 			DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK Computer INC."),
 			DMI_MATCH(DMI_BOARD_NAME, "P/I-P65UP5"),
@@ -95,7 +96,6 @@ static struct dmi_system_id __initdata i8042_dmi_noloop_table[] = {
 		},
 	},
 	{
-		.ident = "Compaq Proliant 8500",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Compaq"),
 			DMI_MATCH(DMI_PRODUCT_NAME , "ProLiant"),
@@ -103,7 +103,6 @@ static struct dmi_system_id __initdata i8042_dmi_noloop_table[] = {
 		},
 	},
 	{
-		.ident = "Compaq Proliant DL760",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Compaq"),
 			DMI_MATCH(DMI_PRODUCT_NAME , "ProLiant"),
@@ -111,7 +110,7 @@ static struct dmi_system_id __initdata i8042_dmi_noloop_table[] = {
 		},
 	},
 	{
-		.ident = "OQO Model 01",
+		/* OQO Model 01 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "OQO"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "ZEPTO"),
@@ -119,8 +118,7 @@ static struct dmi_system_id __initdata i8042_dmi_noloop_table[] = {
 		},
 	},
 	{
-		/* AUX LOOP does not work properly */
-		.ident = "ULI EV4873",
+		/* ULI EV4873 - AUX LOOP does not work properly */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "ULI"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "EV4873"),
@@ -128,7 +126,7 @@ static struct dmi_system_id __initdata i8042_dmi_noloop_table[] = {
 		},
 	},
 	{
-		.ident = "Microsoft Virtual Machine",
+		/* Microsoft Virtual Machine */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "Virtual Machine"),
@@ -136,7 +134,7 @@ static struct dmi_system_id __initdata i8042_dmi_noloop_table[] = {
 		},
 	},
 	{
-		.ident = "Medion MAM 2070",
+		/* Medion MAM 2070 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Notebook"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "MAM 2070"),
@@ -144,7 +142,7 @@ static struct dmi_system_id __initdata i8042_dmi_noloop_table[] = {
 		},
 	},
 	{
-		.ident = "Blue FB5601",
+		/* Blue FB5601 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "blue"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "FB5601"),
@@ -152,7 +150,7 @@ static struct dmi_system_id __initdata i8042_dmi_noloop_table[] = {
 		},
 	},
 	{
-		.ident = "Gigabyte M912",
+		/* Gigabyte M912 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "M912"),
@@ -160,7 +158,14 @@ static struct dmi_system_id __initdata i8042_dmi_noloop_table[] = {
 		},
 	},
 	{
-		.ident = "HP DV9700",
+		/* Gigabyte M1022M netbook */
+		.matches = {
+			DMI_MATCH(DMI_BOARD_VENDOR, "Gigabyte Technology Co.,Ltd."),
+			DMI_MATCH(DMI_BOARD_NAME, "M1022E"),
+			DMI_MATCH(DMI_BOARD_VERSION, "1.02"),
+		},
+	},
+	{
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv9700"),
@@ -177,72 +182,72 @@ static struct dmi_system_id __initdata i8042_dmi_noloop_table[] = {
  * ... apparently some Toshibas don't like MUX mode either and
  * die horrible death on reboot.
  */
-static struct dmi_system_id __initdata i8042_dmi_nomux_table[] = {
+static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = {
 	{
-		.ident = "Fujitsu Lifebook P7010/P7010D",
+		/* Fujitsu Lifebook P7010/P7010D */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "P7010"),
 		},
 	},
 	{
-		.ident = "Fujitsu Lifebook P7010",
+		/* Fujitsu Lifebook P7010 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "0000000000"),
 		},
 	},
 	{
-		.ident = "Fujitsu Lifebook P5020D",
+		/* Fujitsu Lifebook P5020D */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "LifeBook P Series"),
 		},
 	},
 	{
-		.ident = "Fujitsu Lifebook S2000",
+		/* Fujitsu Lifebook S2000 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "LifeBook S Series"),
 		},
 	},
 	{
-		.ident = "Fujitsu Lifebook S6230",
+		/* Fujitsu Lifebook S6230 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "LifeBook S6230"),
 		},
 	},
 	{
-		.ident = "Fujitsu T70H",
+		/* Fujitsu T70H */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "FMVLT70H"),
 		},
 	},
 	{
-		.ident = "Fujitsu-Siemens Lifebook T3010",
+		/* Fujitsu-Siemens Lifebook T3010 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK T3010"),
 		},
 	},
 	{
-		.ident = "Fujitsu-Siemens Lifebook E4010",
+		/* Fujitsu-Siemens Lifebook E4010 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK E4010"),
 		},
 	},
 	{
-		.ident = "Fujitsu-Siemens Amilo Pro 2010",
+		/* Fujitsu-Siemens Amilo Pro 2010 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "AMILO Pro V2010"),
 		},
 	},
 	{
-		.ident = "Fujitsu-Siemens Amilo Pro 2030",
+		/* Fujitsu-Siemens Amilo Pro 2030 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "AMILO PRO V2030"),
@@ -253,7 +258,7 @@ static struct dmi_system_id __initdata i8042_dmi_nomux_table[] = {
 		 * No data is coming from the touchscreen unless KBC
 		 * is in legacy mode.
 		 */
-		.ident = "Panasonic CF-29",
+		/* Panasonic CF-29 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Matsushita"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "CF-29"),
@@ -261,10 +266,10 @@ static struct dmi_system_id __initdata i8042_dmi_nomux_table[] = {
 	},
 	{
 		/*
-		 * Errors on MUX ports are reported without raising AUXDATA
+		 * HP Pavilion DV4017EA -
+		 * errors on MUX ports are reported without raising AUXDATA
 		 * causing "spurious NAK" messages.
 		 */
-		.ident = "HP Pavilion DV4017EA",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "Pavilion dv4000 (EA032EA#ABF)"),
@@ -272,9 +277,9 @@ static struct dmi_system_id __initdata i8042_dmi_nomux_table[] = {
 	},
 	{
 		/*
-		 * Like DV4017EA does not raise AUXERR for errors on MUX ports.
+		 * HP Pavilion ZT1000 -
+		 * like DV4017EA does not raise AUXERR for errors on MUX ports.
 		 */
-		.ident = "HP Pavilion ZT1000",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion Notebook PC"),
@@ -283,44 +288,41 @@ static struct dmi_system_id __initdata i8042_dmi_nomux_table[] = {
 	},
 	{
 		/*
-		 * Like DV4017EA does not raise AUXERR for errors on MUX ports.
+		 * HP Pavilion DV4270ca -
+		 * like DV4017EA does not raise AUXERR for errors on MUX ports.
 		 */
-		.ident = "HP Pavilion DV4270ca",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "Pavilion dv4000 (EH476UA#ABL)"),
 		},
 	},
 	{
-		.ident = "Toshiba P10",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "Satellite P10"),
 		},
 	},
 	{
-		.ident = "Toshiba Equium A110",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "EQUIUM A110"),
 		},
 	},
 	{
-		.ident = "Alienware Sentia",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "ALIENWARE"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "Sentia"),
 		},
 	},
 	{
-		.ident = "Sharp Actius MM20",
+		/* Sharp Actius MM20 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "SHARP"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "PC-MM20 Series"),
 		},
 	},
 	{
-		.ident = "Sony Vaio FS-115b",
+		/* Sony Vaio FS-115b */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "VGN-FS115B"),
@@ -328,73 +330,72 @@ static struct dmi_system_id __initdata i8042_dmi_nomux_table[] = {
 	},
 	{
 		/*
-		 * Reset and GET ID commands issued via KBD port are
+		 * Sony Vaio FZ-240E -
+		 * reset and GET ID commands issued via KBD port are
 		 * sometimes being delivered to AUX3.
 		 */
-		.ident = "Sony Vaio FZ-240E",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "VGN-FZ240E"),
 		},
 	},
 	{
-		.ident = "Amoi M636/A737",
+		/* Amoi M636/A737 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Amoi Electronics CO.,LTD."),
 			DMI_MATCH(DMI_PRODUCT_NAME, "M636/A737 platform"),
 		},
 	},
 	{
-		.ident = "Lenovo 3000 n100",
+		/* Lenovo 3000 n100 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "076804U"),
 		},
 	},
 	{
-		.ident = "Acer Aspire 1360",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 1360"),
 		},
 	},
 	{
-		.ident = "Gericom Bellagio",
+		/* Gericom Bellagio */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Gericom"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "N34AS6"),
 		},
 	},
 	{
-		.ident = "IBM 2656",
+		/* IBM 2656 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "IBM"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "2656"),
 		},
 	},
 	{
-		.ident = "Dell XPS M1530",
+		/* Dell XPS M1530 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
 			DMI_MATCH(DMI_PRODUCT_NAME, "XPS M1530"),
 		},
 	},
 	{
-		.ident = "Compal HEL80I",
+		/* Compal HEL80I */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "COMPAL"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "HEL80I"),
 		},
 	},
 	{
-		.ident = "Dell Vostro 1510",
+		/* Dell Vostro 1510 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
 			DMI_MATCH(DMI_PRODUCT_NAME, "Vostro1510"),
 		},
 	},
 	{
-		.ident = "Acer Aspire 5536",
+		/* Acer Aspire 5536 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5536"),
@@ -404,65 +405,65 @@ static struct dmi_system_id __initdata i8042_dmi_nomux_table[] = {
 	{ }
 };
 
-static struct dmi_system_id __initdata i8042_dmi_reset_table[] = {
+static const struct dmi_system_id __initconst i8042_dmi_reset_table[] = {
 	{
-		.ident = "MSI Wind U-100",
+		/* MSI Wind U-100 */
 		.matches = {
 			DMI_MATCH(DMI_BOARD_NAME, "U-100"),
 			DMI_MATCH(DMI_BOARD_VENDOR, "MICRO-STAR INTERNATIONAL CO., LTD"),
 		},
 	},
 	{
-		.ident = "LG Electronics X110",
+		/* LG Electronics X110 */
 		.matches = {
 			DMI_MATCH(DMI_BOARD_NAME, "X110"),
 			DMI_MATCH(DMI_BOARD_VENDOR, "LG Electronics Inc."),
 		},
 	},
 	{
-		.ident = "Acer Aspire One 150",
+		/* Acer Aspire One 150 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "AOA150"),
 		},
 	},
 	{
-		.ident = "Advent 4211",
+		/* Advent 4211 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "DIXONSXP"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "Advent 4211"),
 		},
 	},
 	{
-		.ident = "Medion Akoya Mini E1210",
+		/* Medion Akoya Mini E1210 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "MEDION"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "E1210"),
 		},
 	},
 	{
-		.ident = "Mivvy M310",
+		/* Mivvy M310 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "VIOOO"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "N10"),
 		},
 	},
 	{
-		.ident = "Dell Vostro 1320",
+		/* Dell Vostro 1320 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
 			DMI_MATCH(DMI_PRODUCT_NAME, "Vostro 1320"),
 		},
 	},
 	{
-		.ident = "Dell Vostro 1520",
+		/* Dell Vostro 1520 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
 			DMI_MATCH(DMI_PRODUCT_NAME, "Vostro 1520"),
 		},
 	},
 	{
-		.ident = "Dell Vostro 1720",
+		/* Dell Vostro 1720 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
 			DMI_MATCH(DMI_PRODUCT_NAME, "Vostro 1720"),
@@ -472,16 +473,16 @@ static struct dmi_system_id __initdata i8042_dmi_reset_table[] = {
 };
 
 #ifdef CONFIG_PNP
-static struct dmi_system_id __initdata i8042_dmi_nopnp_table[] = {
+static const struct dmi_system_id __initconst i8042_dmi_nopnp_table[] = {
 	{
-		.ident = "Intel MBO Desktop D845PESV",
+		/* Intel MBO Desktop D845PESV */
 		.matches = {
 			DMI_MATCH(DMI_BOARD_NAME, "D845PESV"),
 			DMI_MATCH(DMI_BOARD_VENDOR, "Intel Corporation"),
 		},
 	},
 	{
-		.ident = "MSI Wind U-100",
+		/* MSI Wind U-100 */
 		.matches = {
 			DMI_MATCH(DMI_BOARD_NAME, "U-100"),
 			DMI_MATCH(DMI_BOARD_VENDOR, "MICRO-STAR INTERNATIONAL CO., LTD"),
@@ -490,27 +491,23 @@ static struct dmi_system_id __initdata i8042_dmi_nopnp_table[] = {
 	{ }
 };
 
-static struct dmi_system_id __initdata i8042_dmi_laptop_table[] = {
+static const struct dmi_system_id __initconst i8042_dmi_laptop_table[] = {
 	{
-		.ident = "Portable",
 		.matches = {
 			DMI_MATCH(DMI_CHASSIS_TYPE, "8"), /* Portable */
 		},
 	},
 	{
-		.ident = "Laptop",
 		.matches = {
 			DMI_MATCH(DMI_CHASSIS_TYPE, "9"), /* Laptop */
 		},
 	},
 	{
-		.ident = "Notebook",
 		.matches = {
 			DMI_MATCH(DMI_CHASSIS_TYPE, "10"), /* Notebook */
 		},
 	},
 	{
-		.ident = "Sub-Notebook",
 		.matches = {
 			DMI_MATCH(DMI_CHASSIS_TYPE, "14"), /* Sub-Notebook */
 		},
@@ -525,58 +522,65 @@ static struct dmi_system_id __initdata i8042_dmi_laptop_table[] = {
  * Originally, this was just confined to older laptops, but a few Acer laptops
  * have turned up in 2007 that also need this again.
  */
-static struct dmi_system_id __initdata i8042_dmi_dritek_table[] = {
+static const struct dmi_system_id __initconst i8042_dmi_dritek_table[] = {
+	{
+		/* Acer Aspire 5610 */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5610"),
+		},
+	},
 	{
-		.ident = "Acer Aspire 5630",
+		/* Acer Aspire 5630 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5630"),
 		},
 	},
 	{
-		.ident = "Acer Aspire 5650",
+		/* Acer Aspire 5650 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5650"),
 		},
 	},
 	{
-		.ident = "Acer Aspire 5680",
+		/* Acer Aspire 5680 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5680"),
 		},
 	},
 	{
-		.ident = "Acer Aspire 5720",
+		/* Acer Aspire 5720 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5720"),
 		},
 	},
 	{
-		.ident = "Acer Aspire 9110",
+		/* Acer Aspire 9110 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 9110"),
 		},
 	},
 	{
-		.ident = "Acer TravelMate 660",
+		/* Acer TravelMate 660 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 660"),
 		},
 	},
 	{
-		.ident = "Acer TravelMate 2490",
+		/* Acer TravelMate 2490 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 2490"),
 		},
 	},
 	{
-		.ident = "Acer TravelMate 4280",
+		/* Acer TravelMate 4280 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 4280"),
diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
index 1df02d25aca5..d84a36e545f6 100644
--- a/drivers/input/serio/i8042.c
+++ b/drivers/input/serio/i8042.c
@@ -126,6 +126,8 @@ static unsigned char i8042_suppress_kbd_ack;
 static struct platform_device *i8042_platform_device;
 
 static irqreturn_t i8042_interrupt(int irq, void *dev_id);
+static bool (*i8042_platform_filter)(unsigned char data, unsigned char str,
+				     struct serio *serio);
 
 void i8042_lock_chip(void)
 {
@@ -139,6 +141,48 @@ void i8042_unlock_chip(void)
 }
 EXPORT_SYMBOL(i8042_unlock_chip);
 
+int i8042_install_filter(bool (*filter)(unsigned char data, unsigned char str,
+					struct serio *serio))
+{
+	unsigned long flags;
+	int ret = 0;
+
+	spin_lock_irqsave(&i8042_lock, flags);
+
+	if (i8042_platform_filter) {
+		ret = -EBUSY;
+		goto out;
+	}
+
+	i8042_platform_filter = filter;
+
+out:
+	spin_unlock_irqrestore(&i8042_lock, flags);
+	return ret;
+}
+EXPORT_SYMBOL(i8042_install_filter);
+
+int i8042_remove_filter(bool (*filter)(unsigned char data, unsigned char str,
+				       struct serio *port))
+{
+	unsigned long flags;
+	int ret = 0;
+
+	spin_lock_irqsave(&i8042_lock, flags);
+
+	if (i8042_platform_filter != filter) {
+		ret = -EINVAL;
+		goto out;
+	}
+
+	i8042_platform_filter = NULL;
+
+out:
+	spin_unlock_irqrestore(&i8042_lock, flags);
+	return ret;
+}
+EXPORT_SYMBOL(i8042_remove_filter);
+
 /*
  * The i8042_wait_read() and i8042_wait_write functions wait for the i8042 to
  * be ready for reading values from it / writing values to it.
@@ -369,6 +413,31 @@ static void i8042_stop(struct serio *serio)
 }
 
 /*
+ * i8042_filter() filters out unwanted bytes from the input data stream.
+ * It is called from i8042_interrupt and thus is running with interrupts
+ * off and i8042_lock held.
+ */
+static bool i8042_filter(unsigned char data, unsigned char str,
+			 struct serio *serio)
+{
+	if (unlikely(i8042_suppress_kbd_ack)) {
+		if ((~str & I8042_STR_AUXDATA) &&
+		    (data == 0xfa || data == 0xfe)) {
+			i8042_suppress_kbd_ack--;
+			dbg("Extra keyboard ACK - filtered out\n");
+			return true;
+		}
+	}
+
+	if (i8042_platform_filter && i8042_platform_filter(data, str, serio)) {
+		dbg("Filtered out by platfrom filter\n");
+		return true;
+	}
+
+	return false;
+}
+
+/*
  * i8042_interrupt() is the most important function in this driver -
  * it handles the interrupts from the i8042, and sends incoming bytes
  * to the upper layers.
@@ -377,13 +446,16 @@ static void i8042_stop(struct serio *serio)
 static irqreturn_t i8042_interrupt(int irq, void *dev_id)
 {
 	struct i8042_port *port;
+	struct serio *serio;
 	unsigned long flags;
 	unsigned char str, data;
 	unsigned int dfl;
 	unsigned int port_no;
+	bool filtered;
 	int ret = 1;
 
 	spin_lock_irqsave(&i8042_lock, flags);
+
 	str = i8042_read_status();
 	if (unlikely(~str & I8042_STR_OBF)) {
 		spin_unlock_irqrestore(&i8042_lock, flags);
@@ -391,8 +463,8 @@ static irqreturn_t i8042_interrupt(int irq, void *dev_id)
 		ret = 0;
 		goto out;
 	}
+
 	data = i8042_read_data();
-	spin_unlock_irqrestore(&i8042_lock, flags);
 
 	if (i8042_mux_present && (str & I8042_STR_AUXDATA)) {
 		static unsigned long last_transmit;
@@ -441,21 +513,19 @@ static irqreturn_t i8042_interrupt(int irq, void *dev_id)
 	}
 
 	port = &i8042_ports[port_no];
+	serio = port->exists ? port->serio : NULL;
 
 	dbg("%02x <- i8042 (interrupt, %d, %d%s%s)",
 	    data, port_no, irq,
 	    dfl & SERIO_PARITY ? ", bad parity" : "",
 	    dfl & SERIO_TIMEOUT ? ", timeout" : "");
 
-	if (unlikely(i8042_suppress_kbd_ack))
-		if (port_no == I8042_KBD_PORT_NO &&
-		    (data == 0xfa || data == 0xfe)) {
-			i8042_suppress_kbd_ack--;
-			goto out;
-		}
+	filtered = i8042_filter(data, str, serio);
+
+	spin_unlock_irqrestore(&i8042_lock, flags);
 
-	if (likely(port->exists))
-		serio_interrupt(port->serio, data, dfl);
+	if (likely(port->exists && !filtered))
+		serio_interrupt(serio, data, dfl);
 
  out:
 	return IRQ_RETVAL(ret);
diff --git a/drivers/input/serio/sa1111ps2.c b/drivers/input/serio/sa1111ps2.c
index f412c69478a8..d55874e5d1c2 100644
--- a/drivers/input/serio/sa1111ps2.c
+++ b/drivers/input/serio/sa1111ps2.c
@@ -180,8 +180,8 @@ static void __devinit ps2_clear_input(struct ps2if *ps2if)
 	}
 }
 
-static inline unsigned int
-ps2_test_one(struct ps2if *ps2if, unsigned int mask)
+static unsigned int __devinit ps2_test_one(struct ps2if *ps2if,
+					   unsigned int mask)
 {
 	unsigned int val;
 
@@ -197,7 +197,7 @@ ps2_test_one(struct ps2if *ps2if, unsigned int mask)
  * Test the keyboard interface.  We basically check to make sure that
  * we can drive each line to the keyboard independently of each other.
  */
-static int __init ps2_test(struct ps2if *ps2if)
+static int __devinit ps2_test(struct ps2if *ps2if)
 {
 	unsigned int stat;
 	int ret = 0;
@@ -312,7 +312,7 @@ static int __devinit ps2_probe(struct sa1111_dev *dev)
 /*
  * Remove one device from this driver.
  */
-static int ps2_remove(struct sa1111_dev *dev)
+static int __devexit ps2_remove(struct sa1111_dev *dev)
 {
 	struct ps2if *ps2if = sa1111_get_drvdata(dev);
 
@@ -335,7 +335,7 @@ static struct sa1111_driver ps2_driver = {
 	},
 	.devid		= SA1111_DEVID_PS2,
 	.probe		= ps2_probe,
-	.remove		= ps2_remove,
+	.remove		= __devexit_p(ps2_remove),
 };
 
 static int __init ps2_init(void)
diff --git a/drivers/input/serio/serio.c b/drivers/input/serio/serio.c
index 0236f0d5fd91..e0f30186d513 100644
--- a/drivers/input/serio/serio.c
+++ b/drivers/input/serio/serio.c
@@ -284,13 +284,7 @@ static void serio_handle_event(void)
 
 	mutex_lock(&serio_mutex);
 
-	/*
-	 * Note that we handle only one event here to give swsusp
-	 * a chance to freeze kseriod thread. Serio events should
-	 * be pretty rare so we are not concerned about taking
-	 * performance hit.
-	 */
-	if ((event = serio_get_event())) {
+	while ((event = serio_get_event())) {
 
 		switch (event->type) {
 			case SERIO_REGISTER_PORT:
@@ -380,10 +374,9 @@ static struct serio *serio_get_pending_child(struct serio *parent)
 
 static int serio_thread(void *nothing)
 {
-	set_freezable();
 	do {
 		serio_handle_event();
-		wait_event_freezable(serio_wait,
+		wait_event_interruptible(serio_wait,
 			kthread_should_stop() || !list_empty(&serio_event_list));
 	} while (!kthread_should_stop());
 
diff --git a/drivers/input/sparse-keymap.c b/drivers/input/sparse-keymap.c
new file mode 100644
index 000000000000..fbd3987af57f
--- /dev/null
+++ b/drivers/input/sparse-keymap.c
@@ -0,0 +1,250 @@
+/*
+ * Generic support for sparse keymaps
+ *
+ * Copyright (c) 2009 Dmitry Torokhov
+ *
+ * Derived from wistron button driver:
+ * Copyright (C) 2005 Miloslav Trmac <mitr@volny.cz>
+ * Copyright (C) 2005 Bernhard Rosenkraenzer <bero@arklinux.org>
+ * Copyright (C) 2005 Dmitry Torokhov <dtor@mail.ru>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation.
+ */
+
+#include <linux/input.h>
+#include <linux/input/sparse-keymap.h>
+
+MODULE_AUTHOR("Dmitry Torokhov <dtor@mail.ru>");
+MODULE_DESCRIPTION("Generic support for sparse keymaps");
+MODULE_LICENSE("GPL v2");
+MODULE_VERSION("0.1");
+
+/**
+ * sparse_keymap_entry_from_scancode - perform sparse keymap lookup
+ * @dev: Input device using sparse keymap
+ * @code: Scan code
+ *
+ * This function is used to perform &struct key_entry lookup in an
+ * input device using sparse keymap.
+ */
+struct key_entry *sparse_keymap_entry_from_scancode(struct input_dev *dev,
+						    unsigned int code)
+{
+	struct key_entry *key;
+
+	for (key = dev->keycode; key->type != KE_END; key++)
+		if (code == key->code)
+			return key;
+
+	return NULL;
+}
+EXPORT_SYMBOL(sparse_keymap_entry_from_scancode);
+
+/**
+ * sparse_keymap_entry_from_keycode - perform sparse keymap lookup
+ * @dev: Input device using sparse keymap
+ * @keycode: Key code
+ *
+ * This function is used to perform &struct key_entry lookup in an
+ * input device using sparse keymap.
+ */
+struct key_entry *sparse_keymap_entry_from_keycode(struct input_dev *dev,
+						   unsigned int keycode)
+{
+	struct key_entry *key;
+
+	for (key = dev->keycode; key->type != KE_END; key++)
+		if (key->type == KE_KEY && keycode == key->keycode)
+			return key;
+
+	return NULL;
+}
+EXPORT_SYMBOL(sparse_keymap_entry_from_keycode);
+
+static int sparse_keymap_getkeycode(struct input_dev *dev,
+				    int scancode, int *keycode)
+{
+	const struct key_entry *key =
+			sparse_keymap_entry_from_scancode(dev, scancode);
+
+	if (key && key->type == KE_KEY) {
+		*keycode = key->keycode;
+		return 0;
+	}
+
+	return -EINVAL;
+}
+
+static int sparse_keymap_setkeycode(struct input_dev *dev,
+				    int scancode, int keycode)
+{
+	struct key_entry *key;
+	int old_keycode;
+
+	if (keycode < 0 || keycode > KEY_MAX)
+		return -EINVAL;
+
+	key = sparse_keymap_entry_from_scancode(dev, scancode);
+	if (key && key->type == KE_KEY) {
+		old_keycode = key->keycode;
+		key->keycode = keycode;
+		set_bit(keycode, dev->keybit);
+		if (!sparse_keymap_entry_from_keycode(dev, old_keycode))
+			clear_bit(old_keycode, dev->keybit);
+		return 0;
+	}
+
+	return -EINVAL;
+}
+
+/**
+ * sparse_keymap_setup - set up sparse keymap for an input device
+ * @dev: Input device
+ * @keymap: Keymap in form of array of &key_entry structures ending
+ *	with %KE_END type entry
+ * @setup: Function that can be used to adjust keymap entries
+ *	depending on device's deeds, may be %NULL
+ *
+ * The function calculates size and allocates copy of the original
+ * keymap after which sets up input device event bits appropriately.
+ * Before destroying input device allocated keymap should be freed
+ * with a call to sparse_keymap_free().
+ */
+int sparse_keymap_setup(struct input_dev *dev,
+			const struct key_entry *keymap,
+			int (*setup)(struct input_dev *, struct key_entry *))
+{
+	size_t map_size = 1; /* to account for the last KE_END entry */
+	const struct key_entry *e;
+	struct key_entry *map, *entry;
+	int i;
+	int error;
+
+	for (e = keymap; e->type != KE_END; e++)
+		map_size++;
+
+	map = kcalloc(map_size, sizeof (struct key_entry), GFP_KERNEL);
+	if (!map)
+		return -ENOMEM;
+
+	memcpy(map, keymap, map_size * sizeof (struct key_entry));
+
+	for (i = 0; i < map_size; i++) {
+		entry = &map[i];
+
+		if (setup) {
+			error = setup(dev, entry);
+			if (error)
+				goto err_out;
+		}
+
+		switch (entry->type) {
+		case KE_KEY:
+			__set_bit(EV_KEY, dev->evbit);
+			__set_bit(entry->keycode, dev->keybit);
+			break;
+
+		case KE_SW:
+			__set_bit(EV_SW, dev->evbit);
+			__set_bit(entry->sw.code, dev->swbit);
+			break;
+		}
+	}
+
+	dev->keycode = map;
+	dev->keycodemax = map_size;
+	dev->getkeycode = sparse_keymap_getkeycode;
+	dev->setkeycode = sparse_keymap_setkeycode;
+
+	return 0;
+
+ err_out:
+	kfree(keymap);
+	return error;
+
+}
+EXPORT_SYMBOL(sparse_keymap_setup);
+
+/**
+ * sparse_keymap_free - free memory allocated for sparse keymap
+ * @dev: Input device using sparse keymap
+ *
+ * This function is used to free memory allocated by sparse keymap
+ * in an input device that was set up by sparse_keymap_setup().
+ */
+void sparse_keymap_free(struct input_dev *dev)
+{
+	kfree(dev->keycode);
+	dev->keycode = NULL;
+	dev->keycodemax = 0;
+	dev->getkeycode = NULL;
+	dev->setkeycode = NULL;
+}
+EXPORT_SYMBOL(sparse_keymap_free);
+
+/**
+ * sparse_keymap_report_entry - report event corresponding to given key entry
+ * @dev: Input device for which event should be reported
+ * @ke: key entry describing event
+ * @value: Value that should be reported (ignored by %KE_SW entries)
+ * @autorelease: Signals whether release event should be emitted for %KE_KEY
+ *	entries right after reporting press event, ignored by all other
+ *	entries
+ *
+ * This function is used to report input event described by given
+ * &struct key_entry.
+ */
+void sparse_keymap_report_entry(struct input_dev *dev, const struct key_entry *ke,
+				unsigned int value, bool autorelease)
+{
+	switch (ke->type) {
+	case KE_KEY:
+		input_report_key(dev, ke->keycode, value);
+		input_sync(dev);
+		if (value && autorelease) {
+			input_report_key(dev, ke->keycode, 0);
+			input_sync(dev);
+		}
+		break;
+
+	case KE_SW:
+		value = ke->sw.value;
+		/* fall through */
+
+	case KE_VSW:
+		input_report_switch(dev, ke->sw.code, value);
+		break;
+	}
+}
+EXPORT_SYMBOL(sparse_keymap_report_entry);
+
+/**
+ * sparse_keymap_report_event - report event corresponding to given scancode
+ * @dev: Input device using sparse keymap
+ * @code: Scan code
+ * @value: Value that should be reported (ignored by %KE_SW entries)
+ * @autorelease: Signals whether release event should be emitted for %KE_KEY
+ *	entries right after reporting press event, ignored by all other
+ *	entries
+ *
+ * This function is used to perform lookup in an input device using sparse
+ * keymap and report corresponding event. Returns %true if lookup was
+ * successful and %false otherwise.
+ */
+bool sparse_keymap_report_event(struct input_dev *dev, unsigned int code,
+				unsigned int value, bool autorelease)
+{
+	const struct key_entry *ke =
+		sparse_keymap_entry_from_scancode(dev, code);
+
+	if (ke) {
+		sparse_keymap_report_entry(dev, ke, value, autorelease);
+		return true;
+	}
+
+	return false;
+}
+EXPORT_SYMBOL(sparse_keymap_report_event);
+
diff --git a/drivers/input/tablet/wacom.h b/drivers/input/tablet/wacom.h
index 9114ae1c7488..16310f368dab 100644
--- a/drivers/input/tablet/wacom.h
+++ b/drivers/input/tablet/wacom.h
@@ -1,7 +1,7 @@
 /*
  * drivers/input/tablet/wacom.h
  *
- *  USB Wacom Graphire and Wacom Intuos tablet support
+ *  USB Wacom tablet support
  *
  *  Copyright (c) 2000-2004 Vojtech Pavlik	<vojtech@ucw.cz>
  *  Copyright (c) 2000 Andreas Bach Aaen	<abach@stofanet.dk>
@@ -69,6 +69,9 @@
  *      v1.49 (pc) - Added support for USB Tablet PC (0x90, 0x93, and 0x9A)
  *      v1.50 (pc) - Fixed a TabletPC touch bug in 2.6.28
  *      v1.51 (pc) - Added support for Intuos4
+ *      v1.52 (pc) - Query Wacom data upon system resume
+ *                 - add defines for features->type
+ *                 - add new devices (0x9F, 0xE2, and 0XE3)
  */
 
 /*
@@ -89,9 +92,9 @@
 /*
  * Version Information
  */
-#define DRIVER_VERSION "v1.51"
+#define DRIVER_VERSION "v1.52"
 #define DRIVER_AUTHOR "Vojtech Pavlik <vojtech@ucw.cz>"
-#define DRIVER_DESC "USB Wacom Graphire and Wacom Intuos tablet driver"
+#define DRIVER_DESC "USB Wacom tablet driver"
 #define DRIVER_LICENSE "GPL"
 
 MODULE_AUTHOR(DRIVER_AUTHOR);
@@ -133,6 +136,8 @@ extern void input_dev_i4s(struct input_dev *input_dev, struct wacom_wac *wacom_w
 extern void input_dev_i4(struct input_dev *input_dev, struct wacom_wac *wacom_wac);
 extern void input_dev_pl(struct input_dev *input_dev, struct wacom_wac *wacom_wac);
 extern void input_dev_pt(struct input_dev *input_dev, struct wacom_wac *wacom_wac);
+extern void input_dev_tpc(struct input_dev *input_dev, struct wacom_wac *wacom_wac);
+extern void input_dev_tpc2fg(struct input_dev *input_dev, struct wacom_wac *wacom_wac);
 extern void input_dev_mo(struct input_dev *input_dev, struct wacom_wac *wacom_wac);
 extern void input_dev_bee(struct input_dev *input_dev, struct wacom_wac *wacom_wac);
 extern __u16 wacom_le16_to_cpu(unsigned char *data);
diff --git a/drivers/input/tablet/wacom_sys.c b/drivers/input/tablet/wacom_sys.c
index ea30c983a33e..072f33b3b2b0 100644
--- a/drivers/input/tablet/wacom_sys.c
+++ b/drivers/input/tablet/wacom_sys.c
@@ -1,7 +1,7 @@
 /*
  * drivers/input/tablet/wacom_sys.c
  *
- *  USB Wacom Graphire and Wacom Intuos tablet support - system specific code
+ *  USB Wacom tablet support - system specific code
  */
 
 /*
@@ -209,6 +209,7 @@ void input_dev_g(struct input_dev *input_dev, struct wacom_wac *wacom_wac)
 	input_dev->keybit[BIT_WORD(BTN_MOUSE)] |= BIT_MASK(BTN_LEFT) |
 		BIT_MASK(BTN_RIGHT) | BIT_MASK(BTN_MIDDLE);
 	input_dev->keybit[BIT_WORD(BTN_DIGI)] |= BIT_MASK(BTN_TOOL_RUBBER) |
+		BIT_MASK(BTN_TOOL_PEN) | BIT_MASK(BTN_STYLUS) |
 		BIT_MASK(BTN_TOOL_MOUSE) | BIT_MASK(BTN_STYLUS2);
 	input_set_abs_params(input_dev, ABS_DISTANCE, 0, wacom_wac->features->distance_max, 0, 0);
 }
@@ -256,6 +257,7 @@ void input_dev_i(struct input_dev *input_dev, struct wacom_wac *wacom_wac)
 		BIT_MASK(BTN_RIGHT) | BIT_MASK(BTN_MIDDLE) |
 		BIT_MASK(BTN_SIDE) | BIT_MASK(BTN_EXTRA);
 	input_dev->keybit[BIT_WORD(BTN_DIGI)] |= BIT_MASK(BTN_TOOL_RUBBER) |
+		BIT_MASK(BTN_TOOL_PEN) | BIT_MASK(BTN_STYLUS) |
 		BIT_MASK(BTN_TOOL_MOUSE) | BIT_MASK(BTN_TOOL_BRUSH) |
 		BIT_MASK(BTN_TOOL_PENCIL) | BIT_MASK(BTN_TOOL_AIRBRUSH) |
 		BIT_MASK(BTN_TOOL_LENS) | BIT_MASK(BTN_STYLUS2);
@@ -269,7 +271,8 @@ void input_dev_i(struct input_dev *input_dev, struct wacom_wac *wacom_wac)
 
 void input_dev_pl(struct input_dev *input_dev, struct wacom_wac *wacom_wac)
 {
-	input_dev->keybit[BIT_WORD(BTN_DIGI)] |= BIT_MASK(BTN_STYLUS2);
+	input_dev->keybit[BIT_WORD(BTN_DIGI)] |= BIT_MASK(BTN_TOOL_PEN) |
+		BIT_MASK(BTN_STYLUS) | BIT_MASK(BTN_STYLUS2);
 }
 
 void input_dev_pt(struct input_dev *input_dev, struct wacom_wac *wacom_wac)
@@ -277,12 +280,32 @@ void input_dev_pt(struct input_dev *input_dev, struct wacom_wac *wacom_wac)
 	input_dev->keybit[BIT_WORD(BTN_DIGI)] |= BIT_MASK(BTN_TOOL_RUBBER);
 }
 
+void input_dev_tpc(struct input_dev *input_dev, struct wacom_wac *wacom_wac)
+{
+	if (wacom_wac->features->device_type == BTN_TOOL_DOUBLETAP ||
+	    wacom_wac->features->device_type == BTN_TOOL_TRIPLETAP) {
+		input_set_abs_params(input_dev, ABS_RX, 0, wacom_wac->features->x_phy, 0, 0);
+		input_set_abs_params(input_dev, ABS_RY, 0, wacom_wac->features->y_phy, 0, 0);
+		input_dev->keybit[BIT_WORD(BTN_DIGI)] |= BIT_MASK(BTN_TOOL_DOUBLETAP);
+	}
+}
+
+void input_dev_tpc2fg(struct input_dev *input_dev, struct wacom_wac *wacom_wac)
+{
+	if (wacom_wac->features->device_type == BTN_TOOL_TRIPLETAP) {
+		input_dev->keybit[BIT_WORD(BTN_DIGI)] |= BIT_MASK(BTN_TOOL_TRIPLETAP);
+		input_dev->evbit[0] |= BIT_MASK(EV_MSC);
+		input_dev->mscbit[0] |= BIT_MASK(MSC_SERIAL);
+	}
+}
+
 static int wacom_parse_hid(struct usb_interface *intf, struct hid_descriptor *hid_desc,
-			   struct wacom_wac *wacom_wac)
+			   struct wacom_features *features)
 {
 	struct usb_device *dev = interface_to_usbdev(intf);
-	struct wacom_features *features = wacom_wac->features;
-	char limit = 0, result = 0;
+	char limit = 0;
+	/* result has to be defined as int for some devices */
+	int result = 0;
 	int i = 0, usage = WCM_UNDEFINED, finger = 0, pen = 0;
 	unsigned char *report;
 
@@ -328,13 +351,24 @@ static int wacom_parse_hid(struct usb_interface *intf, struct hid_descriptor *hi
 			case HID_USAGE_X:
 				if (usage == WCM_DESKTOP) {
 					if (finger) {
-						features->touch_x_max =
-							features->touch_y_max =
-							wacom_le16_to_cpu(&report[i + 3]);
+						features->device_type = BTN_TOOL_DOUBLETAP;
+						if (features->type == TABLETPC2FG) {
+							/* need to reset back */
+							features->pktlen = WACOM_PKGLEN_TPC2FG;
+							features->device_type = BTN_TOOL_TRIPLETAP;
+						}
 						features->x_max =
+							wacom_le16_to_cpu(&report[i + 3]);
+						features->x_phy =
 							wacom_le16_to_cpu(&report[i + 6]);
-						i += 7;
+						features->unit = report[i + 9];
+						features->unitExpo = report[i + 11];
+						i += 12;
 					} else if (pen) {
+						/* penabled only accepts exact bytes of data */
+						if (features->type == TABLETPC2FG)
+							features->pktlen = WACOM_PKGLEN_PENABLED;
+						features->device_type = BTN_TOOL_PEN;
 						features->x_max =
 							wacom_le16_to_cpu(&report[i + 3]);
 						i += 4;
@@ -350,10 +384,35 @@ static int wacom_parse_hid(struct usb_interface *intf, struct hid_descriptor *hi
 				break;
 
 			case HID_USAGE_Y:
-				if (usage == WCM_DESKTOP)
-					features->y_max =
-						wacom_le16_to_cpu(&report[i + 3]);
-				i += 4;
+				if (usage == WCM_DESKTOP) {
+					if (finger) {
+						features->device_type = BTN_TOOL_DOUBLETAP;
+						if (features->type == TABLETPC2FG) {
+							/* need to reset back */
+							features->pktlen = WACOM_PKGLEN_TPC2FG;
+							features->device_type = BTN_TOOL_TRIPLETAP;
+							features->y_max =
+								wacom_le16_to_cpu(&report[i + 3]);
+							features->y_phy =
+								wacom_le16_to_cpu(&report[i + 6]);
+							i += 7;
+						} else {
+							features->y_max =
+								features->x_max;
+							features->y_phy =
+								wacom_le16_to_cpu(&report[i + 3]);
+							i += 4;
+						}
+					} else if (pen) {
+						/* penabled only accepts exact bytes of data */
+						if (features->type == TABLETPC2FG)
+							features->pktlen = WACOM_PKGLEN_PENABLED;
+						features->device_type = BTN_TOOL_PEN;
+						features->y_max =
+							wacom_le16_to_cpu(&report[i + 3]);
+						i += 4;
+					}
+				}
 				break;
 
 			case HID_USAGE_FINGER:
@@ -376,7 +435,7 @@ static int wacom_parse_hid(struct usb_interface *intf, struct hid_descriptor *hi
 			break;
 
 		case HID_COLLECTION:
-			/* reset UsagePage ans Finger */
+			/* reset UsagePage and Finger */
 			finger = usage = 0;
 			break;
 		}
@@ -388,43 +447,92 @@ static int wacom_parse_hid(struct usb_interface *intf, struct hid_descriptor *hi
 	return result;
 }
 
-static int wacom_query_tablet_data(struct usb_interface *intf)
+static int wacom_query_tablet_data(struct usb_interface *intf, struct wacom_features *features)
 {
 	unsigned char *rep_data;
-	int limit = 0;
-	int error;
+	int limit = 0, report_id = 2;
+	int error = -ENOMEM;
 
 	rep_data = kmalloc(2, GFP_KERNEL);
 	if (!rep_data)
-		return -ENOMEM;
-
-	do {
-		rep_data[0] = 2;
-		rep_data[1] = 2;
-		error = usb_set_report(intf, WAC_HID_FEATURE_REPORT,
-					2, rep_data, 2);
-		if (error >= 0)
-			error = usb_get_report(intf,
-						WAC_HID_FEATURE_REPORT, 2,
-						rep_data, 2);
-	} while ((error < 0 || rep_data[1] != 2) && limit++ < 5);
+		return error;
+
+	/* ask to report tablet data if it is 2FGT or not a Tablet PC */
+	if (features->device_type == BTN_TOOL_TRIPLETAP) {
+		do {
+			rep_data[0] = 3;
+			rep_data[1] = 4;
+			report_id = 3;
+			error = usb_set_report(intf, WAC_HID_FEATURE_REPORT,
+				report_id, rep_data, 2);
+			if (error >= 0)
+				error = usb_get_report(intf,
+					WAC_HID_FEATURE_REPORT, report_id,
+					rep_data, 3);
+		} while ((error < 0 || rep_data[1] != 4) && limit++ < 5);
+	} else if (features->type != TABLETPC && features->type != TABLETPC2FG) {
+		do {
+			rep_data[0] = 2;
+			rep_data[1] = 2;
+			error = usb_set_report(intf, WAC_HID_FEATURE_REPORT,
+				report_id, rep_data, 2);
+			if (error >= 0)
+				error = usb_get_report(intf,
+					WAC_HID_FEATURE_REPORT, report_id,
+					rep_data, 2);
+		} while ((error < 0 || rep_data[1] != 2) && limit++ < 5);
+	}
 
 	kfree(rep_data);
 
 	return error < 0 ? error : 0;
 }
 
+static int wacom_retrieve_hid_descriptor(struct usb_interface *intf,
+		struct wacom_features *features)
+{
+	int error = 0;
+	struct usb_host_interface *interface = intf->cur_altsetting;
+	struct hid_descriptor *hid_desc;
+
+	/* default device to penabled */
+	features->device_type = BTN_TOOL_PEN;
+
+	/* only Tablet PCs need to retrieve the info */
+	if ((features->type != TABLETPC) && (features->type != TABLETPC2FG))
+		goto out;
+
+	if (usb_get_extra_descriptor(interface, HID_DEVICET_HID, &hid_desc)) {
+		if (usb_get_extra_descriptor(&interface->endpoint[0],
+				HID_DEVICET_REPORT, &hid_desc)) {
+			printk("wacom: can not retrieve extra class descriptor\n");
+			error = 1;
+			goto out;
+		}
+	}
+	error = wacom_parse_hid(intf, hid_desc, features);
+	if (error)
+		goto out;
+
+	/* touch device found but size is not defined. use default */
+	if (features->device_type == BTN_TOOL_DOUBLETAP && !features->x_max) {
+		features->x_max = 1023;
+		features->y_max = 1023;
+	}
+
+ out:
+	return error;
+}
+
 static int wacom_probe(struct usb_interface *intf, const struct usb_device_id *id)
 {
 	struct usb_device *dev = interface_to_usbdev(intf);
-	struct usb_host_interface *interface = intf->cur_altsetting;
 	struct usb_endpoint_descriptor *endpoint;
 	struct wacom *wacom;
 	struct wacom_wac *wacom_wac;
 	struct wacom_features *features;
 	struct input_dev *input_dev;
 	int error = -ENOMEM;
-	struct hid_descriptor *hid_desc;
 
 	wacom = kzalloc(sizeof(struct wacom), GFP_KERNEL);
 	wacom_wac = kzalloc(sizeof(struct wacom_wac), GFP_KERNEL);
@@ -432,7 +540,7 @@ static int wacom_probe(struct usb_interface *intf, const struct usb_device_id *i
 	if (!wacom || !input_dev || !wacom_wac)
 		goto fail1;
 
-	wacom_wac->data = usb_buffer_alloc(dev, 10, GFP_KERNEL, &wacom->data_dma);
+	wacom_wac->data = usb_buffer_alloc(dev, WACOM_PKGLEN_MAX, GFP_KERNEL, &wacom->data_dma);
 	if (!wacom_wac->data)
 		goto fail1;
 
@@ -448,7 +556,7 @@ static int wacom_probe(struct usb_interface *intf, const struct usb_device_id *i
 	strlcat(wacom->phys, "/input0", sizeof(wacom->phys));
 
 	wacom_wac->features = features = get_wacom_feature(id);
-	BUG_ON(features->pktlen > 10);
+	BUG_ON(features->pktlen > WACOM_PKGLEN_MAX);
 
 	input_dev->name = wacom_wac->features->name;
 	wacom->wacom_wac = wacom_wac;
@@ -463,47 +571,24 @@ static int wacom_probe(struct usb_interface *intf, const struct usb_device_id *i
 
 	endpoint = &intf->cur_altsetting->endpoint[0].desc;
 
-	/* Initialize touch_x_max and touch_y_max in case it is not defined */
-	if (wacom_wac->features->type == TABLETPC) {
-		features->touch_x_max = 1023;
-		features->touch_y_max = 1023;
-	} else {
-		features->touch_x_max = 0;
-		features->touch_y_max = 0;
-	}
-
-	/* TabletPC need to retrieve the physical and logical maximum from report descriptor */
-	if (wacom_wac->features->type == TABLETPC) {
-		if (usb_get_extra_descriptor(interface, HID_DEVICET_HID, &hid_desc)) {
-			if (usb_get_extra_descriptor(&interface->endpoint[0],
-						     HID_DEVICET_REPORT, &hid_desc)) {
-				printk("wacom: can not retrive extra class descriptor\n");
-				goto fail2;
-			}
-		}
-		error = wacom_parse_hid(intf, hid_desc, wacom_wac);
-		if (error)
-			goto fail2;
-	}
+	/* Retrieve the physical and logical size for OEM devices */
+	error = wacom_retrieve_hid_descriptor(intf, features);
+	if (error)
+		goto fail2;
 
 	input_dev->evbit[0] |= BIT_MASK(EV_KEY) | BIT_MASK(EV_ABS);
-	input_dev->keybit[BIT_WORD(BTN_DIGI)] |= BIT_MASK(BTN_TOOL_PEN) |
-		BIT_MASK(BTN_TOUCH) | BIT_MASK(BTN_STYLUS);
+	input_dev->keybit[BIT_WORD(BTN_DIGI)] |= BIT_MASK(BTN_TOUCH);
+
 	input_set_abs_params(input_dev, ABS_X, 0, features->x_max, 4, 0);
 	input_set_abs_params(input_dev, ABS_Y, 0, features->y_max, 4, 0);
 	input_set_abs_params(input_dev, ABS_PRESSURE, 0, features->pressure_max, 0, 0);
-	if (features->type == TABLETPC) {
-		input_dev->keybit[BIT_WORD(BTN_DIGI)] |= BIT_MASK(BTN_TOOL_DOUBLETAP);
-		input_set_abs_params(input_dev, ABS_RX, 0, features->touch_x_max, 4, 0);
-		input_set_abs_params(input_dev, ABS_RY, 0, features->touch_y_max, 4, 0);
-	}
 	input_dev->absbit[BIT_WORD(ABS_MISC)] |= BIT_MASK(ABS_MISC);
 
 	wacom_init_input_dev(input_dev, wacom_wac);
 
 	usb_fill_int_urb(wacom->irq, dev,
 			 usb_rcvintpipe(dev, endpoint->bEndpointAddress),
-			 wacom_wac->data, wacom_wac->features->pktlen,
+			 wacom_wac->data, features->pktlen,
 			 wacom_sys_irq, wacom, endpoint->bInterval);
 	wacom->irq->transfer_dma = wacom->data_dma;
 	wacom->irq->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
@@ -512,18 +597,14 @@ static int wacom_probe(struct usb_interface *intf, const struct usb_device_id *i
 	if (error)
 		goto fail3;
 
-	/*
-	 * Ask the tablet to report tablet data if it is not a Tablet PC.
-	 * Note that if query fails it is not a hard failure.
-	 */
-	if (wacom_wac->features->type != TABLETPC)
-		wacom_query_tablet_data(intf);
+	/* Note that if query fails it is not a hard failure */
+	wacom_query_tablet_data(intf, features);
 
 	usb_set_intfdata(intf, wacom);
 	return 0;
 
  fail3:	usb_free_urb(wacom->irq);
- fail2:	usb_buffer_free(dev, 10, wacom_wac->data, wacom->data_dma);
+ fail2:	usb_buffer_free(dev, WACOM_PKGLEN_MAX, wacom_wac->data, wacom->data_dma);
  fail1:	input_free_device(input_dev);
 	kfree(wacom);
 	kfree(wacom_wac);
@@ -539,7 +620,7 @@ static void wacom_disconnect(struct usb_interface *intf)
 	usb_kill_urb(wacom->irq);
 	input_unregister_device(wacom->dev);
 	usb_free_urb(wacom->irq);
-	usb_buffer_free(interface_to_usbdev(intf), 10,
+	usb_buffer_free(interface_to_usbdev(intf), WACOM_PKGLEN_MAX,
 			wacom->wacom_wac->data, wacom->data_dma);
 	kfree(wacom->wacom_wac);
 	kfree(wacom);
@@ -559,12 +640,16 @@ static int wacom_suspend(struct usb_interface *intf, pm_message_t message)
 static int wacom_resume(struct usb_interface *intf)
 {
 	struct wacom *wacom = usb_get_intfdata(intf);
+	struct wacom_features *features = wacom->wacom_wac->features;
 	int rv;
 
 	mutex_lock(&wacom->lock);
-	if (wacom->open)
+	if (wacom->open) {
 		rv = usb_submit_urb(wacom->irq, GFP_NOIO);
-	else
+		/* switch to wacom mode if needed */
+		if (!wacom_retrieve_hid_descriptor(intf, features))
+			wacom_query_tablet_data(intf, features);
+	} else
 		rv = 0;
 	mutex_unlock(&wacom->lock);
 
diff --git a/drivers/input/tablet/wacom_wac.c b/drivers/input/tablet/wacom_wac.c
index c896d6a21b7e..1056f149fe31 100644
--- a/drivers/input/tablet/wacom_wac.c
+++ b/drivers/input/tablet/wacom_wac.c
@@ -1,7 +1,7 @@
 /*
  * drivers/input/tablet/wacom_wac.c
  *
- *  USB Wacom Graphire and Wacom Intuos tablet support - Wacom specific code
+ *  USB Wacom tablet support - Wacom specific code
  *
  */
 
@@ -58,16 +58,15 @@ static int wacom_pl_irq(struct wacom_wac *wacom, void *wcombo)
 	unsigned char *data = wacom->data;
 	int prox, pressure;
 
-	if (data[0] != 2) {
+	if (data[0] != WACOM_REPORT_PENABLED) {
 		dbg("wacom_pl_irq: received unknown report #%d", data[0]);
 		return 0;
 	}
 
 	prox = data[1] & 0x40;
 
-	wacom->id[0] = ERASER_DEVICE_ID;
 	if (prox) {
-
+		wacom->id[0] = ERASER_DEVICE_ID;
 		pressure = (signed char)((data[7] << 1) | ((data[4] >> 2) & 1));
 		if (wacom->features->pressure_max > 255)
 			pressure = (pressure << 1) | ((data[4] >> 6) & 1);
@@ -128,7 +127,7 @@ static int wacom_ptu_irq(struct wacom_wac *wacom, void *wcombo)
 {
 	unsigned char *data = wacom->data;
 
-	if (data[0] != 2) {
+	if (data[0] != WACOM_REPORT_PENABLED) {
 		printk(KERN_INFO "wacom_ptu_irq: received unknown report #%d\n", data[0]);
 		return 0;
 	}
@@ -155,14 +154,16 @@ static int wacom_graphire_irq(struct wacom_wac *wacom, void *wcombo)
 {
 	unsigned char *data = wacom->data;
 	int x, y, rw;
+	static int penData = 0;
 
-	if (data[0] != 2) {
+	if (data[0] != WACOM_REPORT_PENABLED) {
 		dbg("wacom_graphire_irq: received unknown report #%d", data[0]);
 		return 0;
 	}
 
 	if (data[1] & 0x80) {
 		/* in prox and not a pad data */
+		penData = 1;
 
 		switch ((data[1] >> 5) & 3) {
 
@@ -232,7 +233,11 @@ static int wacom_graphire_irq(struct wacom_wac *wacom, void *wcombo)
 	switch (wacom->features->type) {
 	    case WACOM_G4:
 		if (data[7] & 0xf8) {
-			wacom_input_sync(wcombo); /* sync last event */
+			if (penData) {
+				wacom_input_sync(wcombo); /* sync last event */
+				if (!wacom->id[0])
+					penData = 0;
+			}
 			wacom->id[1] = PAD_DEVICE_ID;
 			wacom_report_key(wcombo, BTN_0, (data[7] & 0x40));
 			wacom_report_key(wcombo, BTN_4, (data[7] & 0x80));
@@ -242,10 +247,15 @@ static int wacom_graphire_irq(struct wacom_wac *wacom, void *wcombo)
 			wacom_report_abs(wcombo, ABS_MISC, wacom->id[1]);
 			wacom_input_event(wcombo, EV_MSC, MSC_SERIAL, 0xf0);
 		} else if (wacom->id[1]) {
-			wacom_input_sync(wcombo); /* sync last event */
+			if (penData) {
+				wacom_input_sync(wcombo); /* sync last event */
+				if (!wacom->id[0])
+					penData = 0;
+			}
 			wacom->id[1] = 0;
 			wacom_report_key(wcombo, BTN_0, (data[7] & 0x40));
 			wacom_report_key(wcombo, BTN_4, (data[7] & 0x80));
+			wacom_report_rel(wcombo, REL_WHEEL, 0);
 			wacom_report_key(wcombo, BTN_TOOL_FINGER, 0);
 			wacom_report_abs(wcombo, ABS_MISC, 0);
 			wacom_input_event(wcombo, EV_MSC, MSC_SERIAL, 0xf0);
@@ -253,7 +263,11 @@ static int wacom_graphire_irq(struct wacom_wac *wacom, void *wcombo)
 		break;
 	    case WACOM_MO:
 		if ((data[7] & 0xf8) || (data[8] & 0xff)) {
-			wacom_input_sync(wcombo); /* sync last event */
+			if (penData) {
+				wacom_input_sync(wcombo); /* sync last event */
+				if (!wacom->id[0])
+					penData = 0;
+			}
 			wacom->id[1] = PAD_DEVICE_ID;
 			wacom_report_key(wcombo, BTN_0, (data[7] & 0x08));
 			wacom_report_key(wcombo, BTN_1, (data[7] & 0x20));
@@ -264,7 +278,11 @@ static int wacom_graphire_irq(struct wacom_wac *wacom, void *wcombo)
 			wacom_report_abs(wcombo, ABS_MISC, wacom->id[1]);
 			wacom_input_event(wcombo, EV_MSC, MSC_SERIAL, 0xf0);
 		} else if (wacom->id[1]) {
-			wacom_input_sync(wcombo); /* sync last event */
+			if (penData) {
+				wacom_input_sync(wcombo); /* sync last event */
+				if (!wacom->id[0])
+					penData = 0;
+			}
 			wacom->id[1] = 0;
 			wacom_report_key(wcombo, BTN_0, (data[7] & 0x08));
 			wacom_report_key(wcombo, BTN_1, (data[7] & 0x20));
@@ -432,7 +450,8 @@ static int wacom_intuos_irq(struct wacom_wac *wacom, void *wcombo)
 	unsigned int t;
 	int idx = 0, result;
 
-	if (data[0] != 2 && data[0] != 5 && data[0] != 6 && data[0] != 12) {
+	if (data[0] != WACOM_REPORT_PENABLED && data[0] != WACOM_REPORT_INTUOSREAD
+		&& data[0] != WACOM_REPORT_INTUOSWRITE && data[0] != WACOM_REPORT_INTUOSPAD) {
 		dbg("wacom_intuos_irq: received unknown report #%d", data[0]);
                 return 0;
 	}
@@ -442,7 +461,7 @@ static int wacom_intuos_irq(struct wacom_wac *wacom, void *wcombo)
 		idx = data[1] & 0x01;
 
 	/* pad packets. Works as a second tool and is always in prox */
-	if (data[0] == 12) {
+	if (data[0] == WACOM_REPORT_INTUOSPAD) {
 		/* initiate the pad as a device */
 		if (wacom->tool[1] != BTN_TOOL_FINGER)
 			wacom->tool[1] = BTN_TOOL_FINGER;
@@ -608,95 +627,163 @@ static int wacom_intuos_irq(struct wacom_wac *wacom, void *wcombo)
 	return 1;
 }
 
+
+static void wacom_tpc_finger_in(struct wacom_wac *wacom, void *wcombo, char *data, int idx)
+{
+	wacom_report_abs(wcombo, ABS_X,
+		(data[2 + idx * 2] & 0xff) | ((data[3 + idx * 2] & 0x7f) << 8));
+	wacom_report_abs(wcombo, ABS_Y,
+		(data[6 + idx * 2] & 0xff) | ((data[7 + idx * 2] & 0x7f) << 8));
+	wacom_report_abs(wcombo, ABS_MISC, wacom->id[0]);
+	wacom_report_key(wcombo, wacom->tool[idx], 1);
+	if (idx)
+		wacom_input_event(wcombo, EV_MSC, MSC_SERIAL, 0xf0);
+	else
+		wacom_report_key(wcombo, BTN_TOUCH, 1);
+}
+
+static void wacom_tpc_touch_out(struct wacom_wac *wacom, void *wcombo, int idx)
+{
+	wacom_report_abs(wcombo, ABS_X, 0);
+	wacom_report_abs(wcombo, ABS_Y, 0);
+	wacom_report_abs(wcombo, ABS_MISC, 0);
+	wacom_report_key(wcombo, wacom->tool[idx], 0);
+	if (idx)
+		wacom_input_event(wcombo, EV_MSC, MSC_SERIAL, 0xf0);
+	else
+		wacom_report_key(wcombo, BTN_TOUCH, 0);
+	return;
+}
+
+static void wacom_tpc_touch_in(struct wacom_wac *wacom, void *wcombo)
+{
+	char *data = wacom->data;
+	struct urb *urb = ((struct wacom_combo *)wcombo)->urb;
+	static int firstFinger = 0;
+	static int secondFinger = 0;
+
+	wacom->tool[0] = BTN_TOOL_DOUBLETAP;
+	wacom->id[0] = TOUCH_DEVICE_ID;
+	wacom->tool[1] = BTN_TOOL_TRIPLETAP;
+
+	if (urb->actual_length != WACOM_PKGLEN_TPC1FG) {
+		switch (data[0]) {
+			case WACOM_REPORT_TPC1FG:
+				wacom_report_abs(wcombo, ABS_X, wacom_le16_to_cpu(&data[2]));
+				wacom_report_abs(wcombo, ABS_Y, wacom_le16_to_cpu(&data[4]));
+				wacom_report_abs(wcombo, ABS_PRESSURE, wacom_le16_to_cpu(&data[6]));
+				wacom_report_key(wcombo, BTN_TOUCH, wacom_le16_to_cpu(&data[6]));
+				wacom_report_abs(wcombo, ABS_MISC, wacom->id[0]);
+				wacom_report_key(wcombo, wacom->tool[0], 1);
+				break;
+			case WACOM_REPORT_TPC2FG:
+				/* keep this byte to send proper out-prox event */
+				wacom->id[1] = data[1] & 0x03;
+
+				if (data[1] & 0x01) {
+					wacom_tpc_finger_in(wacom, wcombo, data, 0);
+					firstFinger = 1;
+				} else if (firstFinger) {
+					wacom_tpc_touch_out(wacom, wcombo, 0);
+				}
+
+				if (data[1] & 0x02) {
+					/* sync first finger data */
+					if (firstFinger)
+						wacom_input_sync(wcombo);
+
+					wacom_tpc_finger_in(wacom, wcombo, data, 1);
+					secondFinger = 1;
+				} else if (secondFinger) {
+					/* sync first finger data */
+					if (firstFinger)
+						wacom_input_sync(wcombo);
+
+					wacom_tpc_touch_out(wacom, wcombo, 1);
+					secondFinger = 0;
+				}
+				if (!(data[1] & 0x01))
+					firstFinger = 0;
+				break;
+		}
+	} else {
+		wacom_report_abs(wcombo, ABS_X, wacom_le16_to_cpu(&data[1]));
+		wacom_report_abs(wcombo, ABS_Y, wacom_le16_to_cpu(&data[3]));
+		wacom_report_key(wcombo, BTN_TOUCH, 1);
+		wacom_report_abs(wcombo, ABS_MISC, wacom->id[0]);
+		wacom_report_key(wcombo, wacom->tool[0], 1);
+	}
+	return;
+}
+
 static int wacom_tpc_irq(struct wacom_wac *wacom, void *wcombo)
 {
 	char *data = wacom->data;
-	int prox = 0, pressure;
+	int prox = 0, pressure, idx = -1;
 	static int stylusInProx, touchInProx = 1, touchOut;
 	struct urb *urb = ((struct wacom_combo *)wcombo)->urb;
 
 	dbg("wacom_tpc_irq: received report #%d", data[0]);
 
-	if (urb->actual_length == 5 || data[0] == 6) { /* Touch data */
-		if (urb->actual_length == 5) {  /* with touch */
-			prox = data[0] & 0x03;
+	if (urb->actual_length == WACOM_PKGLEN_TPC1FG || /* single touch */
+	    data[0] == WACOM_REPORT_TPC1FG ||		 /* single touch */
+	    data[0] == WACOM_REPORT_TPC2FG) {		 /* 2FG touch */
+		if (urb->actual_length == WACOM_PKGLEN_TPC1FG) {  /* with touch */
+			prox = data[0] & 0x01;
 		} else {  /* with capacity */
-			prox = data[1] & 0x03;
+			if (data[0] == WACOM_REPORT_TPC1FG)
+				/* single touch */
+				prox = data[1] & 0x01;
+			else
+				/* 2FG touch data */
+				prox = data[1] & 0x03;
 		}
 
 		if (!stylusInProx) { /* stylus not in prox */
 			if (prox) {
 				if (touchInProx) {
-					wacom->tool[1] = BTN_TOOL_DOUBLETAP;
-					wacom->id[0] = TOUCH_DEVICE_ID;
-					if (urb->actual_length != 5) {
-						wacom_report_abs(wcombo, ABS_X, wacom_le16_to_cpu(&data[2]));
-						wacom_report_abs(wcombo, ABS_Y, wacom_le16_to_cpu(&data[4]));
-						wacom_report_abs(wcombo, ABS_PRESSURE, wacom_le16_to_cpu(&data[6]));
-						wacom_report_key(wcombo, BTN_TOUCH, wacom_le16_to_cpu(&data[6]));
-					} else {
-						wacom_report_abs(wcombo, ABS_X, wacom_le16_to_cpu(&data[1]));
-						wacom_report_abs(wcombo, ABS_Y, wacom_le16_to_cpu(&data[3]));
-						wacom_report_key(wcombo, BTN_TOUCH, 1);
-					}
-					wacom_report_abs(wcombo, ABS_MISC, wacom->id[0]);
-					wacom_report_key(wcombo, wacom->tool[1], prox & 0x01);
+					wacom_tpc_touch_in(wacom, wcombo);
 					touchOut = 1;
 					return 1;
 				}
 			} else {
-				wacom_report_abs(wcombo, ABS_MISC, wacom->id[0]);
-				wacom_report_key(wcombo, wacom->tool[1], prox & 0x01);
-				wacom_report_key(wcombo, BTN_TOUCH, 0);
+				/* 2FGT out-prox */
+				if (data[0] == WACOM_REPORT_TPC2FG) {
+					idx = (wacom->id[1] & 0x01) - 1;
+					if (idx == 0) {
+						wacom_tpc_touch_out(wacom, wcombo, idx);
+						/* sync first finger event */
+						if (wacom->id[1] & 0x02)
+							wacom_input_sync(wcombo);
+					}
+					idx = (wacom->id[1] & 0x02) - 1;
+					if (idx == 1)
+						wacom_tpc_touch_out(wacom, wcombo, idx);
+				} else /* one finger touch */
+					wacom_tpc_touch_out(wacom, wcombo, 0);
 				touchOut = 0;
 				touchInProx = 1;
 				return 1;
 			}
 		} else if (touchOut || !prox) { /* force touch out-prox */
-			wacom_report_abs(wcombo, ABS_MISC, TOUCH_DEVICE_ID);
-			wacom_report_key(wcombo, wacom->tool[1], 0);
-			wacom_report_key(wcombo, BTN_TOUCH, 0);
+			wacom_tpc_touch_out(wacom, wcombo, 0);
 			touchOut = 0;
 			touchInProx = 1;
 			return 1;
 		}
-	} else if (data[0] == 2) { /* Penabled */
+	} else if (data[0] == WACOM_REPORT_PENABLED) { /* Penabled */
 		prox = data[1] & 0x20;
 
 		touchInProx = 0;
 
-		wacom->id[0] = ERASER_DEVICE_ID;
-
-		/*
-		 * if going from out of proximity into proximity select between the eraser
-		 * and the pen based on the state of the stylus2 button, choose eraser if
-		 * pressed else choose pen. if not a proximity change from out to in, send
-		 * an out of proximity for previous tool then a in for new tool.
-		 */
 		if (prox) { /* in prox */
-			if (!wacom->tool[0]) {
+			if (!wacom->id[0]) {
 				/* Going into proximity select tool */
-				wacom->tool[1] = (data[1] & 0x08) ? BTN_TOOL_RUBBER : BTN_TOOL_PEN;
-				if (wacom->tool[1] == BTN_TOOL_PEN)
+				wacom->tool[0] = (data[1] & 0x0c) ? BTN_TOOL_RUBBER : BTN_TOOL_PEN;
+				if (wacom->tool[0] == BTN_TOOL_PEN)
 					wacom->id[0] = STYLUS_DEVICE_ID;
-			} else if (wacom->tool[1] == BTN_TOOL_RUBBER && !(data[1] & 0x08)) {
-				/*
-				 * was entered with stylus2 pressed
-				 * report out proximity for previous tool
-				*/
-				wacom_report_abs(wcombo, ABS_MISC, wacom->id[0]);
-				wacom_report_key(wcombo, wacom->tool[1], 0);
-				wacom_input_sync(wcombo);
-
-				/* set new tool */
-				wacom->tool[1] = BTN_TOOL_PEN;
-				wacom->id[0] = STYLUS_DEVICE_ID;
-				return 0;
-			}
-			if (wacom->tool[1] != BTN_TOOL_RUBBER) {
-				/* Unknown tool selected default to pen tool */
-				wacom->tool[1] = BTN_TOOL_PEN;
-				wacom->id[0] = STYLUS_DEVICE_ID;
+				else
+					wacom->id[0] = ERASER_DEVICE_ID;
 			}
 			wacom_report_key(wcombo, BTN_STYLUS, data[1] & 0x02);
 			wacom_report_key(wcombo, BTN_STYLUS2, data[1] & 0x10);
@@ -706,17 +793,21 @@ static int wacom_tpc_irq(struct wacom_wac *wacom, void *wcombo)
 			if (pressure < 0)
 				pressure = wacom->features->pressure_max + pressure + 1;
 			wacom_report_abs(wcombo, ABS_PRESSURE, pressure);
-			wacom_report_key(wcombo, BTN_TOUCH, pressure);
+			wacom_report_key(wcombo, BTN_TOUCH, data[1] & 0x05);
 		} else {
+			wacom_report_abs(wcombo, ABS_X, 0);
+			wacom_report_abs(wcombo, ABS_Y, 0);
 			wacom_report_abs(wcombo, ABS_PRESSURE, 0);
 			wacom_report_key(wcombo, BTN_STYLUS, 0);
 			wacom_report_key(wcombo, BTN_STYLUS2, 0);
 			wacom_report_key(wcombo, BTN_TOUCH, 0);
+			wacom->id[0] = 0;
+			/* pen is out so touch can be enabled now */
+			touchInProx = 1;
 		}
-		wacom_report_key(wcombo, wacom->tool[1], prox);
+		wacom_report_key(wcombo, wacom->tool[0], prox);
 		wacom_report_abs(wcombo, ABS_MISC, wacom->id[0]);
 		stylusInProx = prox;
-		wacom->tool[0] = prox;
 		return 1;
 	}
 	return 0;
@@ -751,6 +842,7 @@ int wacom_wac_irq(struct wacom_wac *wacom_wac, void *wcombo)
 			return wacom_intuos_irq(wacom_wac, wcombo);
 
 		case TABLETPC:
+		case TABLETPC2FG:
 			return wacom_tpc_irq(wacom_wac, wcombo);
 
 		default:
@@ -791,9 +883,17 @@ void wacom_init_input_dev(struct input_dev *input_dev, struct wacom_wac *wacom_w
 			input_dev_i4s(input_dev, wacom_wac);
 			input_dev_i(input_dev, wacom_wac);
 			break;
+		case TABLETPC2FG:
+			input_dev_tpc2fg(input_dev, wacom_wac);
+			/* fall through */
+		case TABLETPC:
+			input_dev_tpc(input_dev, wacom_wac);
+			if (wacom_wac->features->device_type != BTN_TOOL_PEN)
+				break;  /* no need to process stylus stuff */
+
+			/* fall through */
 		case PL:
 		case PTU:
-		case TABLETPC:
 			input_dev_pl(input_dev, wacom_wac);
 			/* fall through */
 		case PENPARTNER:
@@ -804,66 +904,69 @@ void wacom_init_input_dev(struct input_dev *input_dev, struct wacom_wac *wacom_w
 }
 
 static struct wacom_features wacom_features[] = {
-	{ "Wacom Penpartner",    7,   5040,  3780,  255,  0, PENPARTNER },
-        { "Wacom Graphire",      8,  10206,  7422,  511, 63, GRAPHIRE },
-	{ "Wacom Graphire2 4x5", 8,  10206,  7422,  511, 63, GRAPHIRE },
-	{ "Wacom Graphire2 5x7", 8,  13918, 10206,  511, 63, GRAPHIRE },
-	{ "Wacom Graphire3",     8,  10208,  7424,  511, 63, GRAPHIRE },
-	{ "Wacom Graphire3 6x8", 8,  16704, 12064,  511, 63, GRAPHIRE },
-	{ "Wacom Graphire4 4x5", 8,  10208,  7424,  511, 63, WACOM_G4 },
-	{ "Wacom Graphire4 6x8", 8,  16704, 12064,  511, 63, WACOM_G4 },
-	{ "Wacom BambooFun 4x5", 9,  14760,  9225,  511, 63, WACOM_MO },
-	{ "Wacom BambooFun 6x8", 9,  21648, 13530,  511, 63, WACOM_MO },
-	{ "Wacom Bamboo1 Medium",8,  16704, 12064,  511, 63, GRAPHIRE },
-	{ "Wacom Volito",        8,   5104,  3712,  511, 63, GRAPHIRE },
-	{ "Wacom PenStation2",   8,   3250,  2320,  255, 63, GRAPHIRE },
-	{ "Wacom Volito2 4x5",   8,   5104,  3712,  511, 63, GRAPHIRE },
-	{ "Wacom Volito2 2x3",   8,   3248,  2320,  511, 63, GRAPHIRE },
-	{ "Wacom PenPartner2",   8,   3250,  2320,  511, 63, GRAPHIRE },
-	{ "Wacom Bamboo",        9,  14760,  9225,  511, 63, WACOM_MO },
-	{ "Wacom Bamboo1",       8,   5104,  3712,  511, 63, GRAPHIRE },
-	{ "Wacom Intuos 4x5",   10,  12700, 10600, 1023, 31, INTUOS },
-	{ "Wacom Intuos 6x8",   10,  20320, 16240, 1023, 31, INTUOS },
-	{ "Wacom Intuos 9x12",  10,  30480, 24060, 1023, 31, INTUOS },
-	{ "Wacom Intuos 12x12", 10,  30480, 31680, 1023, 31, INTUOS },
-	{ "Wacom Intuos 12x18", 10,  45720, 31680, 1023, 31, INTUOS },
-	{ "Wacom PL400",         8,   5408,  4056,  255,  0, PL },
-	{ "Wacom PL500",         8,   6144,  4608,  255,  0, PL },
-	{ "Wacom PL600",         8,   6126,  4604,  255,  0, PL },
-	{ "Wacom PL600SX",       8,   6260,  5016,  255,  0, PL },
-	{ "Wacom PL550",         8,   6144,  4608,  511,  0, PL },
-	{ "Wacom PL800",         8,   7220,  5780,  511,  0, PL },
-	{ "Wacom PL700",         8,   6758,  5406,  511,  0, PL },
-	{ "Wacom PL510",         8,   6282,  4762,  511,  0, PL },
-	{ "Wacom DTU710",        8,  34080, 27660,  511,  0, PL },
-	{ "Wacom DTF521",        8,   6282,  4762,  511,  0, PL },
-	{ "Wacom DTF720",        8,   6858,  5506,  511,  0, PL },
-	{ "Wacom DTF720a",       8,   6858,  5506,  511,  0, PL },
-	{ "Wacom Cintiq Partner",8,  20480, 15360,  511,  0, PTU },
-	{ "Wacom Intuos2 4x5",   10, 12700, 10600, 1023, 31, INTUOS },
-	{ "Wacom Intuos2 6x8",   10, 20320, 16240, 1023, 31, INTUOS },
-	{ "Wacom Intuos2 9x12",  10, 30480, 24060, 1023, 31, INTUOS },
-	{ "Wacom Intuos2 12x12", 10, 30480, 31680, 1023, 31, INTUOS },
-	{ "Wacom Intuos2 12x18", 10, 45720, 31680, 1023, 31, INTUOS },
-	{ "Wacom Intuos3 4x5",   10, 25400, 20320, 1023, 63, INTUOS3S },
-	{ "Wacom Intuos3 6x8",   10, 40640, 30480, 1023, 63, INTUOS3 },
-	{ "Wacom Intuos3 9x12",  10, 60960, 45720, 1023, 63, INTUOS3 },
-	{ "Wacom Intuos3 12x12", 10, 60960, 60960, 1023, 63, INTUOS3L },
-	{ "Wacom Intuos3 12x19", 10, 97536, 60960, 1023, 63, INTUOS3L },
-	{ "Wacom Intuos3 6x11",  10, 54204, 31750, 1023, 63, INTUOS3 },
-	{ "Wacom Intuos3 4x6",   10, 31496, 19685, 1023, 63, INTUOS3S },
-	{ "Wacom Intuos4 4x6",   10, 31496, 19685, 2047, 63, INTUOS4S },
-	{ "Wacom Intuos4 6x9",   10, 44704, 27940, 2047, 63, INTUOS4 },
-	{ "Wacom Intuos4 8x13",  10, 65024, 40640, 2047, 63, INTUOS4L },
-	{ "Wacom Intuos4 12x19", 10, 97536, 60960, 2047, 63, INTUOS4L },
-	{ "Wacom Cintiq 21UX",   10, 87200, 65600, 1023, 63, CINTIQ },
-	{ "Wacom Cintiq 20WSX",  10, 86680, 54180, 1023, 63, WACOM_BEE },
-	{ "Wacom Cintiq 12WX",   10, 53020, 33440, 1023, 63, WACOM_BEE },
-	{ "Wacom DTU1931",        8, 37832, 30305,  511,  0, PL },
-	{ "Wacom ISDv4 90",       8, 26202, 16325,  255,  0, TABLETPC },
-	{ "Wacom ISDv4 93",       8, 26202, 16325,  255,  0, TABLETPC },
-	{ "Wacom ISDv4 9A",       8, 26202, 16325,  255,  0, TABLETPC },
-	{ "Wacom Intuos2 6x8",   10, 20320, 16240, 1023, 31, INTUOS },
+	{ "Wacom Penpartner",     WACOM_PKGLEN_PENPRTN,    5040,  3780,  255,  0, PENPARTNER },
+	{ "Wacom Graphire",       WACOM_PKGLEN_GRAPHIRE,  10206,  7422,  511, 63, GRAPHIRE },
+	{ "Wacom Graphire2 4x5",  WACOM_PKGLEN_GRAPHIRE,  10206,  7422,  511, 63, GRAPHIRE },
+	{ "Wacom Graphire2 5x7",  WACOM_PKGLEN_GRAPHIRE,  13918, 10206,  511, 63, GRAPHIRE },
+	{ "Wacom Graphire3",      WACOM_PKGLEN_GRAPHIRE,  10208,  7424,  511, 63, GRAPHIRE },
+	{ "Wacom Graphire3 6x8",  WACOM_PKGLEN_GRAPHIRE,  16704, 12064,  511, 63, GRAPHIRE },
+	{ "Wacom Graphire4 4x5",  WACOM_PKGLEN_GRAPHIRE,  10208,  7424,  511, 63, WACOM_G4 },
+	{ "Wacom Graphire4 6x8",  WACOM_PKGLEN_GRAPHIRE,  16704, 12064,  511, 63, WACOM_G4 },
+	{ "Wacom BambooFun 4x5",  WACOM_PKGLEN_BBFUN,     14760,  9225,  511, 63, WACOM_MO },
+	{ "Wacom BambooFun 6x8",  WACOM_PKGLEN_BBFUN,     21648, 13530,  511, 63, WACOM_MO },
+	{ "Wacom Bamboo1 Medium", WACOM_PKGLEN_GRAPHIRE,  16704, 12064,  511, 63, GRAPHIRE },
+	{ "Wacom Volito",         WACOM_PKGLEN_GRAPHIRE,   5104,  3712,  511, 63, GRAPHIRE },
+	{ "Wacom PenStation2",    WACOM_PKGLEN_GRAPHIRE,   3250,  2320,  255, 63, GRAPHIRE },
+	{ "Wacom Volito2 4x5",    WACOM_PKGLEN_GRAPHIRE,   5104,  3712,  511, 63, GRAPHIRE },
+	{ "Wacom Volito2 2x3",    WACOM_PKGLEN_GRAPHIRE,   3248,  2320,  511, 63, GRAPHIRE },
+	{ "Wacom PenPartner2",    WACOM_PKGLEN_GRAPHIRE,   3250,  2320,  511, 63, GRAPHIRE },
+	{ "Wacom Bamboo",         WACOM_PKGLEN_BBFUN,     14760,  9225,  511, 63, WACOM_MO },
+	{ "Wacom Bamboo1",        WACOM_PKGLEN_GRAPHIRE,   5104,  3712,  511, 63, GRAPHIRE },
+	{ "Wacom Intuos 4x5",     WACOM_PKGLEN_INTUOS,    12700, 10600, 1023, 31, INTUOS },
+	{ "Wacom Intuos 6x8",     WACOM_PKGLEN_INTUOS,    20320, 16240, 1023, 31, INTUOS },
+	{ "Wacom Intuos 9x12",    WACOM_PKGLEN_INTUOS,    30480, 24060, 1023, 31, INTUOS },
+	{ "Wacom Intuos 12x12",   WACOM_PKGLEN_INTUOS,    30480, 31680, 1023, 31, INTUOS },
+	{ "Wacom Intuos 12x18",   WACOM_PKGLEN_INTUOS,    45720, 31680, 1023, 31, INTUOS },
+	{ "Wacom PL400",          WACOM_PKGLEN_GRAPHIRE,   5408,  4056,  255,  0, PL },
+	{ "Wacom PL500",          WACOM_PKGLEN_GRAPHIRE,   6144,  4608,  255,  0, PL },
+	{ "Wacom PL600",          WACOM_PKGLEN_GRAPHIRE,   6126,  4604,  255,  0, PL },
+	{ "Wacom PL600SX",        WACOM_PKGLEN_GRAPHIRE,   6260,  5016,  255,  0, PL },
+	{ "Wacom PL550",          WACOM_PKGLEN_GRAPHIRE,   6144,  4608,  511,  0, PL },
+	{ "Wacom PL800",          WACOM_PKGLEN_GRAPHIRE,   7220,  5780,  511,  0, PL },
+	{ "Wacom PL700",          WACOM_PKGLEN_GRAPHIRE,   6758,  5406,  511,  0, PL },
+	{ "Wacom PL510",          WACOM_PKGLEN_GRAPHIRE,   6282,  4762,  511,  0, PL },
+	{ "Wacom DTU710",         WACOM_PKGLEN_GRAPHIRE,  34080, 27660,  511,  0, PL },
+	{ "Wacom DTF521",         WACOM_PKGLEN_GRAPHIRE,   6282,  4762,  511,  0, PL },
+	{ "Wacom DTF720",         WACOM_PKGLEN_GRAPHIRE,   6858,  5506,  511,  0, PL },
+	{ "Wacom DTF720a",        WACOM_PKGLEN_GRAPHIRE,   6858,  5506,  511,  0, PL },
+	{ "Wacom Cintiq Partner", WACOM_PKGLEN_GRAPHIRE,  20480, 15360,  511,  0, PTU },
+	{ "Wacom Intuos2 4x5",    WACOM_PKGLEN_INTUOS,    12700, 10600, 1023, 31, INTUOS },
+	{ "Wacom Intuos2 6x8",    WACOM_PKGLEN_INTUOS,    20320, 16240, 1023, 31, INTUOS },
+	{ "Wacom Intuos2 9x12",   WACOM_PKGLEN_INTUOS,    30480, 24060, 1023, 31, INTUOS },
+	{ "Wacom Intuos2 12x12",  WACOM_PKGLEN_INTUOS,    30480, 31680, 1023, 31, INTUOS },
+	{ "Wacom Intuos2 12x18",  WACOM_PKGLEN_INTUOS,    45720, 31680, 1023, 31, INTUOS },
+	{ "Wacom Intuos3 4x5",    WACOM_PKGLEN_INTUOS,    25400, 20320, 1023, 63, INTUOS3S },
+	{ "Wacom Intuos3 6x8",    WACOM_PKGLEN_INTUOS,    40640, 30480, 1023, 63, INTUOS3 },
+	{ "Wacom Intuos3 9x12",   WACOM_PKGLEN_INTUOS,    60960, 45720, 1023, 63, INTUOS3 },
+	{ "Wacom Intuos3 12x12",  WACOM_PKGLEN_INTUOS,    60960, 60960, 1023, 63, INTUOS3L },
+	{ "Wacom Intuos3 12x19",  WACOM_PKGLEN_INTUOS,    97536, 60960, 1023, 63, INTUOS3L },
+	{ "Wacom Intuos3 6x11",   WACOM_PKGLEN_INTUOS,    54204, 31750, 1023, 63, INTUOS3 },
+	{ "Wacom Intuos3 4x6",    WACOM_PKGLEN_INTUOS,    31496, 19685, 1023, 63, INTUOS3S },
+	{ "Wacom Intuos4 4x6",    WACOM_PKGLEN_INTUOS,    31496, 19685, 2047, 63, INTUOS4S },
+	{ "Wacom Intuos4 6x9",    WACOM_PKGLEN_INTUOS,    44704, 27940, 2047, 63, INTUOS4 },
+	{ "Wacom Intuos4 8x13",   WACOM_PKGLEN_INTUOS,    65024, 40640, 2047, 63, INTUOS4L },
+	{ "Wacom Intuos4 12x19",  WACOM_PKGLEN_INTUOS,    97536, 60960, 2047, 63, INTUOS4L },
+	{ "Wacom Cintiq 21UX",    WACOM_PKGLEN_INTUOS,    87200, 65600, 1023, 63, CINTIQ },
+	{ "Wacom Cintiq 20WSX",   WACOM_PKGLEN_INTUOS,    86680, 54180, 1023, 63, WACOM_BEE },
+	{ "Wacom Cintiq 12WX",    WACOM_PKGLEN_INTUOS,    53020, 33440, 1023, 63, WACOM_BEE },
+	{ "Wacom DTU1931",        WACOM_PKGLEN_GRAPHIRE,  37832, 30305,  511,  0, PL },
+	{ "Wacom ISDv4 90",       WACOM_PKGLEN_GRAPHIRE,  26202, 16325,  255,  0, TABLETPC },
+	{ "Wacom ISDv4 93",       WACOM_PKGLEN_GRAPHIRE,  26202, 16325,  255,  0, TABLETPC },
+	{ "Wacom ISDv4 9A",       WACOM_PKGLEN_GRAPHIRE,  26202, 16325,  255,  0, TABLETPC },
+	{ "Wacom ISDv4 9F",       WACOM_PKGLEN_PENABLED,  26202, 16325,  255,  0, TABLETPC },
+	{ "Wacom ISDv4 E2",       WACOM_PKGLEN_TPC2FG,    26202, 16325,  255,  0, TABLETPC2FG },
+	{ "Wacom ISDv4 E3",       WACOM_PKGLEN_TPC2FG,    26202, 16325,  255,  0, TABLETPC2FG },
+	{ "Wacom Intuos2 6x8",    WACOM_PKGLEN_INTUOS,    20320, 16240, 1023, 31, INTUOS },
 	{ }
 };
 
@@ -927,6 +1030,9 @@ static struct usb_device_id wacom_ids[] = {
 	{ USB_DEVICE(USB_VENDOR_ID_WACOM, 0x90) },
 	{ USB_DEVICE(USB_VENDOR_ID_WACOM, 0x93) },
 	{ USB_DEVICE(USB_VENDOR_ID_WACOM, 0x9A) },
+	{ USB_DEVICE(USB_VENDOR_ID_WACOM, 0x9F) },
+	{ USB_DEVICE(USB_VENDOR_ID_WACOM, 0xE2) },
+	{ USB_DEVICE(USB_VENDOR_ID_WACOM, 0xE3) },
 	{ USB_DEVICE(USB_VENDOR_ID_WACOM, 0x47) },
 	{ }
 };
diff --git a/drivers/input/tablet/wacom_wac.h b/drivers/input/tablet/wacom_wac.h
index c10235aba7e5..ee01e1902785 100644
--- a/drivers/input/tablet/wacom_wac.h
+++ b/drivers/input/tablet/wacom_wac.h
@@ -9,12 +9,33 @@
 #ifndef WACOM_WAC_H
 #define WACOM_WAC_H
 
+/* maximum packet length for USB devices */
+#define WACOM_PKGLEN_MAX	32
+
+/* packet length for individual models */
+#define WACOM_PKGLEN_PENPRTN	 7
+#define WACOM_PKGLEN_GRAPHIRE	 8
+#define WACOM_PKGLEN_BBFUN 	 9
+#define WACOM_PKGLEN_INTUOS 	10
+#define WACOM_PKGLEN_PENABLED	 8
+#define WACOM_PKGLEN_TPC1FG	 5
+#define WACOM_PKGLEN_TPC2FG 	14
+
+/* device IDs */
 #define STYLUS_DEVICE_ID	0x02
 #define TOUCH_DEVICE_ID		0x03
 #define CURSOR_DEVICE_ID	0x06
 #define ERASER_DEVICE_ID	0x0A
 #define PAD_DEVICE_ID		0x0F
 
+/* wacom data packet report IDs */
+#define WACOM_REPORT_PENABLED		2
+#define WACOM_REPORT_INTUOSREAD		5
+#define WACOM_REPORT_INTUOSWRITE	6
+#define WACOM_REPORT_INTUOSPAD		12
+#define WACOM_REPORT_TPC1FG		6
+#define WACOM_REPORT_TPC2FG		13
+
 enum {
 	PENPARTNER = 0,
 	GRAPHIRE,
@@ -32,6 +53,7 @@ enum {
 	WACOM_BEE,
 	WACOM_MO,
 	TABLETPC,
+	TABLETPC2FG,
 	MAX_TYPE
 };
 
@@ -43,8 +65,11 @@ struct wacom_features {
 	int pressure_max;
 	int distance_max;
 	int type;
-	int touch_x_max;
-	int touch_y_max;
+	int device_type;
+	int x_phy;
+	int y_phy;
+	unsigned char unit;
+	unsigned char unitExpo;
 };
 
 struct wacom_wac {
diff --git a/drivers/input/touchscreen/Kconfig b/drivers/input/touchscreen/Kconfig
index 8cc453c85ea7..dfafc76da4fb 100644
--- a/drivers/input/touchscreen/Kconfig
+++ b/drivers/input/touchscreen/Kconfig
@@ -111,6 +111,18 @@ config TOUCHSCREEN_DA9034
 	  Say Y here to enable the support for the touchscreen found
 	  on Dialog Semiconductor DA9034 PMIC.
 
+config TOUCHSCREEN_DYNAPRO
+	tristate "Dynapro serial touchscreen"
+	select SERIO
+	help
+	  Say Y here if you have a Dynapro serial touchscreen connected to
+	  your system.
+
+	  If unsure, say N.
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called dynapro.
+
 config TOUCHSCREEN_EETI
 	tristate "EETI touchscreen panel support"
 	depends on I2C
@@ -133,6 +145,18 @@ config TOUCHSCREEN_FUJITSU
 	  To compile this driver as a module, choose M here: the
 	  module will be called fujitsu-ts.
 
+config TOUCHSCREEN_S3C2410
+	tristate "Samsung S3C2410 touchscreen input driver"
+	depends on ARCH_S3C2410
+	select S3C24XX_ADC
+	help
+	  Say Y here if you have the s3c2410 touchscreen.
+
+	  If unsure, say N.
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called s3c2410_ts.
+
 config TOUCHSCREEN_GUNZE
 	tristate "Gunze AHL-51S touchscreen"
 	select SERIO
@@ -297,7 +321,7 @@ config TOUCHSCREEN_TOUCHWIN
 
 config TOUCHSCREEN_ATMEL_TSADCC
 	tristate "Atmel Touchscreen Interface"
-	depends on ARCH_AT91SAM9RL
+	depends on ARCH_AT91SAM9RL || ARCH_AT91SAM9G45
 	help
 	  Say Y here if you have a 4-wire touchscreen connected to the
           ADC Controller on your Atmel SoC (such as the AT91SAM9RL).
@@ -418,6 +442,7 @@ config TOUCHSCREEN_USB_COMPOSITE
 	  - IdealTEK URTC1000
 	  - GoTop Super_Q2/GogoPen/PenPower tablets
 	  - JASTEC USB Touch Controller/DigiTech DTR-02U
+	  - Zytronic controllers
 
 	  Have a look at <http://linux.chapter7.ch/touchkit/> for
 	  a usage description and the required user-space stuff.
@@ -425,6 +450,18 @@ config TOUCHSCREEN_USB_COMPOSITE
 	  To compile this driver as a module, choose M here: the
 	  module will be called usbtouchscreen.
 
+config TOUCHSCREEN_MC13783
+	tristate "Freescale MC13783 touchscreen input driver"
+	depends on MFD_MC13783
+	help
+	  Say Y here if you have an Freescale MC13783 PMIC on your
+	  board and want to use its touchscreen
+
+	  If unsure, say N.
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called mc13783_ts.
+
 config TOUCHSCREEN_USB_EGALAX
 	default y
 	bool "eGalax, eTurboTouch CT-410/510/700 device support" if EMBEDDED
@@ -490,6 +527,16 @@ config TOUCHSCREEN_USB_E2I
 	bool "e2i Touchscreen controller (e.g. from Mimo 740)"
 	depends on TOUCHSCREEN_USB_COMPOSITE
 
+config TOUCHSCREEN_USB_ZYTRONIC
+	default y
+	bool "Zytronic controller" if EMBEDDED
+	depends on TOUCHSCREEN_USB_COMPOSITE
+
+config TOUCHSCREEN_USB_ETT_TC5UH
+	default y
+	bool "ET&T TC5UH touchscreen controler support" if EMBEDDED
+	depends on TOUCHSCREEN_USB_COMPOSITE
+
 config TOUCHSCREEN_TOUCHIT213
 	tristate "Sahara TouchIT-213 touchscreen"
 	select SERIO
diff --git a/drivers/input/touchscreen/Makefile b/drivers/input/touchscreen/Makefile
index 15fa62cffc77..d61a3b4def9a 100644
--- a/drivers/input/touchscreen/Makefile
+++ b/drivers/input/touchscreen/Makefile
@@ -12,11 +12,13 @@ obj-$(CONFIG_TOUCHSCREEN_ADS7846)	+= ads7846.o
 obj-$(CONFIG_TOUCHSCREEN_ATMEL_TSADCC)	+= atmel_tsadcc.o
 obj-$(CONFIG_TOUCHSCREEN_BITSY)		+= h3600_ts_input.o
 obj-$(CONFIG_TOUCHSCREEN_CORGI)		+= corgi_ts.o
+obj-$(CONFIG_TOUCHSCREEN_DYNAPRO)	+= dynapro.o
 obj-$(CONFIG_TOUCHSCREEN_GUNZE)		+= gunze.o
 obj-$(CONFIG_TOUCHSCREEN_EETI)		+= eeti_ts.o
 obj-$(CONFIG_TOUCHSCREEN_ELO)		+= elo.o
 obj-$(CONFIG_TOUCHSCREEN_FUJITSU)	+= fujitsu_ts.o
 obj-$(CONFIG_TOUCHSCREEN_INEXIO)	+= inexio.o
+obj-$(CONFIG_TOUCHSCREEN_MC13783)	+= mc13783_ts.o
 obj-$(CONFIG_TOUCHSCREEN_MCS5000)	+= mcs5000_ts.o
 obj-$(CONFIG_TOUCHSCREEN_MIGOR)		+= migor_ts.o
 obj-$(CONFIG_TOUCHSCREEN_MTOUCH)	+= mtouch.o
@@ -25,7 +27,9 @@ obj-$(CONFIG_TOUCHSCREEN_HP600)		+= hp680_ts_input.o
 obj-$(CONFIG_TOUCHSCREEN_HP7XX)		+= jornada720_ts.o
 obj-$(CONFIG_TOUCHSCREEN_HTCPEN)	+= htcpen.o
 obj-$(CONFIG_TOUCHSCREEN_USB_COMPOSITE)	+= usbtouchscreen.o
+obj-$(CONFIG_TOUCHSCREEN_PCAP)		+= pcap_ts.o
 obj-$(CONFIG_TOUCHSCREEN_PENMOUNT)	+= penmount.o
+obj-$(CONFIG_TOUCHSCREEN_S3C2410)	+= s3c2410_ts.o
 obj-$(CONFIG_TOUCHSCREEN_TOUCHIT213)	+= touchit213.o
 obj-$(CONFIG_TOUCHSCREEN_TOUCHRIGHT)	+= touchright.o
 obj-$(CONFIG_TOUCHSCREEN_TOUCHWIN)	+= touchwin.o
@@ -41,4 +45,3 @@ obj-$(CONFIG_TOUCHSCREEN_WM97XX_ATMEL)	+= atmel-wm97xx.o
 obj-$(CONFIG_TOUCHSCREEN_WM97XX_MAINSTONE)	+= mainstone-wm97xx.o
 obj-$(CONFIG_TOUCHSCREEN_WM97XX_ZYLONITE)	+= zylonite-wm97xx.o
 obj-$(CONFIG_TOUCHSCREEN_W90X900)	+= w90p910_ts.o
-obj-$(CONFIG_TOUCHSCREEN_PCAP)		+= pcap_ts.o
diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
index 09c810999b92..52d2ca147d8f 100644
--- a/drivers/input/touchscreen/ads7846.c
+++ b/drivers/input/touchscreen/ads7846.c
@@ -29,10 +29,9 @@
 #include <linux/spi/ads7846.h>
 #include <asm/irq.h>
 
-
 /*
  * This code has been heavily tested on a Nokia 770, and lightly
- * tested on other ads7846 devices (OSK/Mistral, Lubbock).
+ * tested on other ads7846 devices (OSK/Mistral, Lubbock, Spitz).
  * TSC2046 is just newer ads7846 silicon.
  * Support for ads7843 tested on Atmel at91sam926x-EK.
  * Support for ads7845 has only been stubbed in.
@@ -43,7 +42,7 @@
  * have to maintain our own SW IRQ disabled status. This should be
  * removed as soon as the affected platform's IRQ handling is fixed.
  *
- * app note sbaa036 talks in more detail about accurate sampling...
+ * App note sbaa036 talks in more detail about accurate sampling...
  * that ought to help in situations like LCDs inducing noise (which
  * can also be helped by using synch signals) and more generally.
  * This driver tries to utilize the measures described in the app
@@ -566,10 +565,8 @@ static void ads7846_rx(void *ads)
 	 * once more the measurement
 	 */
 	if (packet->tc.ignore || Rt > ts->pressure_max) {
-#ifdef VERBOSE
-		pr_debug("%s: ignored %d pressure %d\n",
-			dev_name(&ts->spi->dev), packet->tc.ignore, Rt);
-#endif
+		dev_vdbg(&ts->spi->dev, "ignored %d pressure %d\n",
+			 packet->tc.ignore, Rt);
 		hrtimer_start(&ts->timer, ktime_set(0, TS_POLL_PERIOD),
 			      HRTIMER_MODE_REL);
 		return;
@@ -598,9 +595,7 @@ static void ads7846_rx(void *ads)
 		if (!ts->pendown) {
 			input_report_key(input, BTN_TOUCH, 1);
 			ts->pendown = 1;
-#ifdef VERBOSE
-			dev_dbg(&ts->spi->dev, "DOWN\n");
-#endif
+			dev_vdbg(&ts->spi->dev, "DOWN\n");
 		}
 
 		if (ts->swap_xy)
@@ -608,12 +603,10 @@ static void ads7846_rx(void *ads)
 
 		input_report_abs(input, ABS_X, x);
 		input_report_abs(input, ABS_Y, y);
-		input_report_abs(input, ABS_PRESSURE, Rt);
+		input_report_abs(input, ABS_PRESSURE, ts->pressure_max - Rt);
 
 		input_sync(input);
-#ifdef VERBOSE
-		dev_dbg(&ts->spi->dev, "%4d/%4d/%4d\n", x, y, Rt);
-#endif
+		dev_vdbg(&ts->spi->dev, "%4d/%4d/%4d\n", x, y, Rt);
 	}
 
 	hrtimer_start(&ts->timer, ktime_set(0, TS_POLL_PERIOD),
@@ -723,9 +716,7 @@ static enum hrtimer_restart ads7846_timer(struct hrtimer *handle)
 			input_sync(input);
 
 			ts->pendown = 0;
-#ifdef VERBOSE
-			dev_dbg(&ts->spi->dev, "UP\n");
-#endif
+			dev_vdbg(&ts->spi->dev, "UP\n");
 		}
 
 		/* measurement cycle ended */
diff --git a/drivers/input/touchscreen/atmel-wm97xx.c b/drivers/input/touchscreen/atmel-wm97xx.c
index 35377f583e28..a12242f77e23 100644
--- a/drivers/input/touchscreen/atmel-wm97xx.c
+++ b/drivers/input/touchscreen/atmel-wm97xx.c
@@ -59,7 +59,7 @@
 #define ATMEL_WM97XX_AC97C_IRQ		(29)
 #define ATMEL_WM97XX_GPIO_DEFAULT	(32+16) /* Pin 16 on port B. */
 #else
-#error Unkown CPU, this driver only supports AT32AP700X CPUs.
+#error Unknown CPU, this driver only supports AT32AP700X CPUs.
 #endif
 
 struct continuous {
diff --git a/drivers/input/touchscreen/atmel_tsadcc.c b/drivers/input/touchscreen/atmel_tsadcc.c
index 9c7fce4d74d0..3d9b5166ebe9 100644
--- a/drivers/input/touchscreen/atmel_tsadcc.c
+++ b/drivers/input/touchscreen/atmel_tsadcc.c
@@ -22,6 +22,8 @@
 #include <linux/clk.h>
 #include <linux/platform_device.h>
 #include <linux/io.h>
+#include <mach/board.h>
+#include <mach/cpu.h>
 
 /* Register definitions based on AT91SAM9RL64 preliminary draft datasheet */
 
@@ -36,7 +38,9 @@
 #define	  ATMEL_TSADCC_LOWRES	(1    <<  4)	/* Resolution selection */
 #define	  ATMEL_TSADCC_SLEEP	(1    <<  5)	/* Sleep mode */
 #define	  ATMEL_TSADCC_PENDET	(1    <<  6)	/* Pen Detect selection */
+#define	  ATMEL_TSADCC_PRES	(1    <<  7)	/* Pressure Measurement Selection */
 #define	  ATMEL_TSADCC_PRESCAL	(0x3f <<  8)	/* Prescalar Rate Selection */
+#define	  ATMEL_TSADCC_EPRESCAL	(0xff <<  8)	/* Prescalar Rate Selection (Extended) */
 #define	  ATMEL_TSADCC_STARTUP	(0x7f << 16)	/* Start Up time */
 #define	  ATMEL_TSADCC_SHTIM	(0xf  << 24)	/* Sample & Hold time */
 #define	  ATMEL_TSADCC_PENDBC	(0xf  << 28)	/* Pen Detect debouncing time */
@@ -84,7 +88,13 @@
 #define ATMEL_TSADCC_CDR4	0x40	/* Channel Data 4 */
 #define ATMEL_TSADCC_CDR5	0x44	/* Channel Data 5 */
 
-#define ADC_CLOCK	1000000
+#define ATMEL_TSADCC_XPOS	0x50
+#define ATMEL_TSADCC_Z1DAT	0x54
+#define ATMEL_TSADCC_Z2DAT	0x58
+
+#define PRESCALER_VAL(x)	((x) >> 8)
+
+#define ADC_DEFAULT_CLOCK	100000
 
 struct atmel_tsadcc {
 	struct input_dev	*input;
@@ -172,6 +182,7 @@ static int __devinit atmel_tsadcc_probe(struct platform_device *pdev)
 	struct atmel_tsadcc	*ts_dev;
 	struct input_dev	*input_dev;
 	struct resource		*res;
+	struct at91_tsadcc_data *pdata = pdev->dev.platform_data;
 	int		err = 0;
 	unsigned int	prsc;
 	unsigned int	reg;
@@ -242,31 +253,49 @@ static int __devinit atmel_tsadcc_probe(struct platform_device *pdev)
 	input_dev->phys = ts_dev->phys;
 	input_dev->dev.parent = &pdev->dev;
 
-	input_dev->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_ABS);
-	input_dev->keybit[BIT_WORD(BTN_TOUCH)] = BIT_MASK(BTN_TOUCH);
-
+	__set_bit(EV_ABS, input_dev->evbit);
 	input_set_abs_params(input_dev, ABS_X, 0, 0x3FF, 0, 0);
 	input_set_abs_params(input_dev, ABS_Y, 0, 0x3FF, 0, 0);
 
+	input_set_capability(input_dev, EV_KEY, BTN_TOUCH);
+
 	/* clk_enable() always returns 0, no need to check it */
 	clk_enable(ts_dev->clk);
 
 	prsc = clk_get_rate(ts_dev->clk);
 	dev_info(&pdev->dev, "Master clock is set at: %d Hz\n", prsc);
 
-	prsc = prsc / ADC_CLOCK / 2 - 1;
+	if (!pdata)
+		goto err_fail;
+
+	if (!pdata->adc_clock)
+		pdata->adc_clock = ADC_DEFAULT_CLOCK;
+
+	prsc = (prsc / (2 * pdata->adc_clock)) - 1;
+
+	/* saturate if this value is too high */
+	if (cpu_is_at91sam9rl()) {
+		if (prsc > PRESCALER_VAL(ATMEL_TSADCC_PRESCAL))
+			prsc = PRESCALER_VAL(ATMEL_TSADCC_PRESCAL);
+	} else {
+		if (prsc > PRESCALER_VAL(ATMEL_TSADCC_EPRESCAL))
+			prsc = PRESCALER_VAL(ATMEL_TSADCC_EPRESCAL);
+	}
+
+	dev_info(&pdev->dev, "Prescaler is set at: %d\n", prsc);
 
 	reg = ATMEL_TSADCC_TSAMOD_TS_ONLY_MODE		|
 		((0x00 << 5) & ATMEL_TSADCC_SLEEP)	|	/* Normal Mode */
 		((0x01 << 6) & ATMEL_TSADCC_PENDET)	|	/* Enable Pen Detect */
-		((prsc << 8) & ATMEL_TSADCC_PRESCAL)	|	/* PRESCAL */
-		((0x13 << 16) & ATMEL_TSADCC_STARTUP)	|	/* STARTUP */
-		((0x0F << 28) & ATMEL_TSADCC_PENDBC);		/* PENDBC */
+		(prsc << 8)				|
+		((0x26 << 16) & ATMEL_TSADCC_STARTUP)	|
+		((pdata->pendet_debounce << 28) & ATMEL_TSADCC_PENDBC);
 
 	atmel_tsadcc_write(ATMEL_TSADCC_CR, ATMEL_TSADCC_SWRST);
 	atmel_tsadcc_write(ATMEL_TSADCC_MR, reg);
 	atmel_tsadcc_write(ATMEL_TSADCC_TRGR, ATMEL_TSADCC_TRGMOD_NONE);
-	atmel_tsadcc_write(ATMEL_TSADCC_TSR, (0x3 << 24) & ATMEL_TSADCC_TSSHTIM);
+	atmel_tsadcc_write(ATMEL_TSADCC_TSR,
+		(pdata->ts_sample_hold_time << 24) & ATMEL_TSADCC_TSSHTIM);
 
 	atmel_tsadcc_read(ATMEL_TSADCC_SR);
 	atmel_tsadcc_write(ATMEL_TSADCC_IER, ATMEL_TSADCC_PENCNT);
diff --git a/drivers/input/touchscreen/dynapro.c b/drivers/input/touchscreen/dynapro.c
new file mode 100644
index 000000000000..455353908bdf
--- /dev/null
+++ b/drivers/input/touchscreen/dynapro.c
@@ -0,0 +1,206 @@
+/*
+ * Dynapro serial touchscreen driver
+ *
+ * Copyright (c) 2009 Tias Guns
+ * Based on the inexio driver (c) Vojtech Pavlik and Dan Streetman and
+ * Richard Lemon
+ *
+ */
+
+/*
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation.
+ */
+
+/*
+ * 2009/09/19 Tias Guns <tias@ulyssis.org>
+ *   Copied inexio.c and edited for Dynapro protocol (from retired Xorg module)
+ */
+
+#include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/input.h>
+#include <linux/serio.h>
+#include <linux/init.h>
+
+#define DRIVER_DESC	"Dynapro serial touchscreen driver"
+
+MODULE_AUTHOR("Tias Guns <tias@ulyssis.org>");
+MODULE_DESCRIPTION(DRIVER_DESC);
+MODULE_LICENSE("GPL");
+
+/*
+ * Definitions & global arrays.
+ */
+
+#define DYNAPRO_FORMAT_TOUCH_BIT 0x40
+#define DYNAPRO_FORMAT_LENGTH 3
+#define DYNAPRO_RESPONSE_BEGIN_BYTE 0x80
+
+#define DYNAPRO_MIN_XC 0
+#define DYNAPRO_MAX_XC 0x3ff
+#define DYNAPRO_MIN_YC 0
+#define DYNAPRO_MAX_YC 0x3ff
+
+#define DYNAPRO_GET_XC(data) (data[1] | ((data[0] & 0x38) << 4))
+#define DYNAPRO_GET_YC(data) (data[2] | ((data[0] & 0x07) << 7))
+#define DYNAPRO_GET_TOUCHED(data) (DYNAPRO_FORMAT_TOUCH_BIT & data[0])
+
+/*
+ * Per-touchscreen data.
+ */
+
+struct dynapro {
+	struct input_dev *dev;
+	struct serio *serio;
+	int idx;
+	unsigned char data[DYNAPRO_FORMAT_LENGTH];
+	char phys[32];
+};
+
+static void dynapro_process_data(struct dynapro *pdynapro)
+{
+	struct input_dev *dev = pdynapro->dev;
+
+	if (DYNAPRO_FORMAT_LENGTH == ++pdynapro->idx) {
+		input_report_abs(dev, ABS_X, DYNAPRO_GET_XC(pdynapro->data));
+		input_report_abs(dev, ABS_Y, DYNAPRO_GET_YC(pdynapro->data));
+		input_report_key(dev, BTN_TOUCH,
+				 DYNAPRO_GET_TOUCHED(pdynapro->data));
+		input_sync(dev);
+
+		pdynapro->idx = 0;
+	}
+}
+
+static irqreturn_t dynapro_interrupt(struct serio *serio,
+		unsigned char data, unsigned int flags)
+{
+	struct dynapro *pdynapro = serio_get_drvdata(serio);
+
+	pdynapro->data[pdynapro->idx] = data;
+
+	if (DYNAPRO_RESPONSE_BEGIN_BYTE & pdynapro->data[0])
+		dynapro_process_data(pdynapro);
+	else
+		dev_dbg(&serio->dev, "unknown/unsynchronized data: %x\n",
+			pdynapro->data[0]);
+
+	return IRQ_HANDLED;
+}
+
+static void dynapro_disconnect(struct serio *serio)
+{
+	struct dynapro *pdynapro = serio_get_drvdata(serio);
+
+	input_get_device(pdynapro->dev);
+	input_unregister_device(pdynapro->dev);
+	serio_close(serio);
+	serio_set_drvdata(serio, NULL);
+	input_put_device(pdynapro->dev);
+	kfree(pdynapro);
+}
+
+/*
+ * dynapro_connect() is the routine that is called when someone adds a
+ * new serio device that supports dynapro protocol and registers it as
+ * an input device. This is usually accomplished using inputattach.
+ */
+
+static int dynapro_connect(struct serio *serio, struct serio_driver *drv)
+{
+	struct dynapro *pdynapro;
+	struct input_dev *input_dev;
+	int err;
+
+	pdynapro = kzalloc(sizeof(struct dynapro), GFP_KERNEL);
+	input_dev = input_allocate_device();
+	if (!pdynapro || !input_dev) {
+		err = -ENOMEM;
+		goto fail1;
+	}
+
+	pdynapro->serio = serio;
+	pdynapro->dev = input_dev;
+	snprintf(pdynapro->phys, sizeof(pdynapro->phys),
+		 "%s/input0", serio->phys);
+
+	input_dev->name = "Dynapro Serial TouchScreen";
+	input_dev->phys = pdynapro->phys;
+	input_dev->id.bustype = BUS_RS232;
+	input_dev->id.vendor = SERIO_DYNAPRO;
+	input_dev->id.product = 0;
+	input_dev->id.version = 0x0001;
+	input_dev->dev.parent = &serio->dev;
+	input_dev->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_ABS);
+	input_dev->keybit[BIT_WORD(BTN_TOUCH)] = BIT_MASK(BTN_TOUCH);
+	input_set_abs_params(pdynapro->dev, ABS_X,
+			     DYNAPRO_MIN_XC, DYNAPRO_MAX_XC, 0, 0);
+	input_set_abs_params(pdynapro->dev, ABS_Y,
+			     DYNAPRO_MIN_YC, DYNAPRO_MAX_YC, 0, 0);
+
+	serio_set_drvdata(serio, pdynapro);
+
+	err = serio_open(serio, drv);
+	if (err)
+		goto fail2;
+
+	err = input_register_device(pdynapro->dev);
+	if (err)
+		goto fail3;
+
+	return 0;
+
+ fail3:	serio_close(serio);
+ fail2:	serio_set_drvdata(serio, NULL);
+ fail1:	input_free_device(input_dev);
+	kfree(pdynapro);
+	return err;
+}
+
+/*
+ * The serio driver structure.
+ */
+
+static struct serio_device_id dynapro_serio_ids[] = {
+	{
+		.type	= SERIO_RS232,
+		.proto	= SERIO_DYNAPRO,
+		.id	= SERIO_ANY,
+		.extra	= SERIO_ANY,
+	},
+	{ 0 }
+};
+
+MODULE_DEVICE_TABLE(serio, dynapro_serio_ids);
+
+static struct serio_driver dynapro_drv = {
+	.driver		= {
+		.name	= "dynapro",
+	},
+	.description	= DRIVER_DESC,
+	.id_table	= dynapro_serio_ids,
+	.interrupt	= dynapro_interrupt,
+	.connect	= dynapro_connect,
+	.disconnect	= dynapro_disconnect,
+};
+
+/*
+ * The functions for inserting/removing us as a module.
+ */
+
+static int __init dynapro_init(void)
+{
+	return serio_register_driver(&dynapro_drv);
+}
+
+static void __exit dynapro_exit(void)
+{
+	serio_unregister_driver(&dynapro_drv);
+}
+
+module_init(dynapro_init);
+module_exit(dynapro_exit);
diff --git a/drivers/input/touchscreen/mainstone-wm97xx.c b/drivers/input/touchscreen/mainstone-wm97xx.c
index 8fc3b08deb3b..6cdcf2a6e036 100644
--- a/drivers/input/touchscreen/mainstone-wm97xx.c
+++ b/drivers/input/touchscreen/mainstone-wm97xx.c
@@ -14,7 +14,7 @@
  *
  * Notes:
  *     This is a wm97xx extended touch driver to capture touch
- *     data in a continuous manner on the Intel XScale archictecture
+ *     data in a continuous manner on the Intel XScale architecture
  *
  *  Features:
  *       - codecs supported:- WM9705, WM9712, WM9713
@@ -131,7 +131,7 @@ static int wm97xx_acc_pen_down(struct wm97xx *wm)
 	/* When the AC97 queue has been drained we need to allow time
 	 * to buffer up samples otherwise we end up spinning polling
 	 * for samples.  The controller can't have a suitably low
-	 * threashold set to use the notifications it gives.
+	 * threshold set to use the notifications it gives.
 	 */
 	schedule_timeout_uninterruptible(1);
 
diff --git a/drivers/input/touchscreen/mc13783_ts.c b/drivers/input/touchscreen/mc13783_ts.c
new file mode 100644
index 000000000000..be115b3b65eb
--- /dev/null
+++ b/drivers/input/touchscreen/mc13783_ts.c
@@ -0,0 +1,258 @@
+/*
+ * Driver for the Freescale Semiconductor MC13783 touchscreen.
+ *
+ * Copyright 2004-2007 Freescale Semiconductor, Inc. All Rights Reserved.
+ * Copyright (C) 2009 Sascha Hauer, Pengutronix
+ *
+ * Initial development of this code was funded by
+ * Phytec Messtechnik GmbH, http://www.phytec.de/
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation.
+ */
+#include <linux/platform_device.h>
+#include <linux/mfd/mc13783.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/input.h>
+#include <linux/sched.h>
+#include <linux/init.h>
+
+#define MC13783_TS_NAME	"mc13783-ts"
+
+#define DEFAULT_SAMPLE_TOLERANCE 300
+
+static unsigned int sample_tolerance = DEFAULT_SAMPLE_TOLERANCE;
+module_param(sample_tolerance, uint, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(sample_tolerance,
+		"If the minimal and maximal value read out for one axis (out "
+		"of three) differ by this value (default: "
+		__stringify(DEFAULT_SAMPLE_TOLERANCE) ") or more, the reading "
+		"is supposed to be wrong and is discarded.  Set to 0 to "
+		"disable this check.");
+
+struct mc13783_ts_priv {
+	struct input_dev *idev;
+	struct mc13783 *mc13783;
+	struct delayed_work work;
+	struct workqueue_struct *workq;
+	unsigned int sample[4];
+};
+
+static irqreturn_t mc13783_ts_handler(int irq, void *data)
+{
+	struct mc13783_ts_priv *priv = data;
+
+	mc13783_ackirq(priv->mc13783, irq);
+
+	/*
+	 * Kick off reading coordinates. Note that if work happens already
+	 * be queued for future execution (it rearms itself) it will not
+	 * be rescheduled for immediate execution here. However the rearm
+	 * delay is HZ / 50 which is acceptable.
+	 */
+	queue_delayed_work(priv->workq, &priv->work, 0);
+
+	return IRQ_HANDLED;
+}
+
+#define sort3(a0, a1, a2) ({						\
+		if (a0 > a1)						\
+			swap(a0, a1);					\
+		if (a1 > a2)						\
+			swap(a1, a2);					\
+		if (a0 > a1)						\
+			swap(a0, a1);					\
+		})
+
+static void mc13783_ts_report_sample(struct mc13783_ts_priv *priv)
+{
+	struct input_dev *idev = priv->idev;
+	int x0, x1, x2, y0, y1, y2;
+	int cr0, cr1;
+
+	/*
+	 * the values are 10-bit wide only, but the two least significant
+	 * bits are for future 12 bit use and reading yields 0
+	 */
+	x0 = priv->sample[0] & 0xfff;
+	x1 = priv->sample[1] & 0xfff;
+	x2 = priv->sample[2] & 0xfff;
+	y0 = priv->sample[3] & 0xfff;
+	y1 = (priv->sample[0] >> 12) & 0xfff;
+	y2 = (priv->sample[1] >> 12) & 0xfff;
+	cr0 = (priv->sample[2] >> 12) & 0xfff;
+	cr1 = (priv->sample[3] >> 12) & 0xfff;
+
+	dev_dbg(&idev->dev,
+		"x: (% 4d,% 4d,% 4d) y: (% 4d, % 4d,% 4d) cr: (% 4d, % 4d)\n",
+		x0, x1, x2, y0, y1, y2, cr0, cr1);
+
+	sort3(x0, x1, x2);
+	sort3(y0, y1, y2);
+
+	cr0 = (cr0 + cr1) / 2;
+
+	if (!cr0 || !sample_tolerance ||
+			(x2 - x0 < sample_tolerance &&
+			 y2 - y0 < sample_tolerance)) {
+		/* report the median coordinate and average pressure */
+		if (cr0) {
+			input_report_abs(idev, ABS_X, x1);
+			input_report_abs(idev, ABS_Y, y1);
+
+			dev_dbg(&idev->dev, "report (%d, %d, %d)\n",
+					x1, y1, 0x1000 - cr0);
+			queue_delayed_work(priv->workq, &priv->work, HZ / 50);
+		} else
+			dev_dbg(&idev->dev, "report release\n");
+
+		input_report_abs(idev, ABS_PRESSURE,
+				cr0 ? 0x1000 - cr0 : cr0);
+		input_report_key(idev, BTN_TOUCH, cr0);
+		input_sync(idev);
+	} else
+		dev_dbg(&idev->dev, "discard event\n");
+}
+
+static void mc13783_ts_work(struct work_struct *work)
+{
+	struct mc13783_ts_priv *priv =
+		container_of(work, struct mc13783_ts_priv, work.work);
+	unsigned int mode = MC13783_ADC_MODE_TS;
+	unsigned int channel = 12;
+
+	if (mc13783_adc_do_conversion(priv->mc13783,
+				mode, channel, priv->sample) == 0)
+		mc13783_ts_report_sample(priv);
+}
+
+static int mc13783_ts_open(struct input_dev *dev)
+{
+	struct mc13783_ts_priv *priv = input_get_drvdata(dev);
+	int ret;
+
+	mc13783_lock(priv->mc13783);
+
+	mc13783_ackirq(priv->mc13783, MC13783_IRQ_TS);
+
+	ret = mc13783_irq_request(priv->mc13783, MC13783_IRQ_TS,
+		mc13783_ts_handler, MC13783_TS_NAME, priv);
+	if (ret)
+		goto out;
+
+	ret = mc13783_reg_rmw(priv->mc13783, MC13783_ADC0,
+			MC13783_ADC0_TSMOD_MASK, MC13783_ADC0_TSMOD0);
+	if (ret)
+		mc13783_irq_free(priv->mc13783, MC13783_IRQ_TS, priv);
+out:
+	mc13783_unlock(priv->mc13783);
+	return ret;
+}
+
+static void mc13783_ts_close(struct input_dev *dev)
+{
+	struct mc13783_ts_priv *priv = input_get_drvdata(dev);
+
+	mc13783_lock(priv->mc13783);
+	mc13783_reg_rmw(priv->mc13783, MC13783_ADC0,
+			MC13783_ADC0_TSMOD_MASK, 0);
+	mc13783_irq_free(priv->mc13783, MC13783_IRQ_TS, priv);
+	mc13783_unlock(priv->mc13783);
+
+	cancel_delayed_work_sync(&priv->work);
+}
+
+static int __init mc13783_ts_probe(struct platform_device *pdev)
+{
+	struct mc13783_ts_priv *priv;
+	struct input_dev *idev;
+	int ret = -ENOMEM;
+
+	priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+	idev = input_allocate_device();
+	if (!priv || !idev)
+		goto err_free_mem;
+
+	INIT_DELAYED_WORK(&priv->work, mc13783_ts_work);
+	priv->mc13783 = dev_get_drvdata(pdev->dev.parent);
+	priv->idev = idev;
+
+	/*
+	 * We need separate workqueue because mc13783_adc_do_conversion
+	 * uses keventd and thus would deadlock.
+	 */
+	priv->workq = create_singlethread_workqueue("mc13783_ts");
+	if (!priv->workq)
+		goto err_free_mem;
+
+	idev->name = MC13783_TS_NAME;
+	idev->dev.parent = &pdev->dev;
+
+	idev->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_ABS);
+	idev->keybit[BIT_WORD(BTN_TOUCH)] = BIT_MASK(BTN_TOUCH);
+	input_set_abs_params(idev, ABS_X, 0, 0xfff, 0, 0);
+	input_set_abs_params(idev, ABS_Y, 0, 0xfff, 0, 0);
+	input_set_abs_params(idev, ABS_PRESSURE, 0, 0xfff, 0, 0);
+
+	idev->open = mc13783_ts_open;
+	idev->close = mc13783_ts_close;
+
+	input_set_drvdata(idev, priv);
+
+	ret = input_register_device(priv->idev);
+	if (ret) {
+		dev_err(&pdev->dev,
+			"register input device failed with %d\n", ret);
+		goto err_destroy_wq;
+	}
+
+	platform_set_drvdata(pdev, priv);
+	return 0;
+
+err_destroy_wq:
+	destroy_workqueue(priv->workq);
+err_free_mem:
+	input_free_device(idev);
+	kfree(priv);
+	return ret;
+}
+
+static int __devexit mc13783_ts_remove(struct platform_device *pdev)
+{
+	struct mc13783_ts_priv *priv = platform_get_drvdata(pdev);
+
+	platform_set_drvdata(pdev, NULL);
+
+	destroy_workqueue(priv->workq);
+	input_unregister_device(priv->idev);
+	kfree(priv);
+
+	return 0;
+}
+
+static struct platform_driver mc13783_ts_driver = {
+	.remove		= __devexit_p(mc13783_ts_remove),
+	.driver		= {
+		.owner	= THIS_MODULE,
+		.name	= MC13783_TS_NAME,
+	},
+};
+
+static int __init mc13783_ts_init(void)
+{
+	return platform_driver_probe(&mc13783_ts_driver, &mc13783_ts_probe);
+}
+module_init(mc13783_ts_init);
+
+static void __exit mc13783_ts_exit(void)
+{
+	platform_driver_unregister(&mc13783_ts_driver);
+}
+module_exit(mc13783_ts_exit);
+
+MODULE_DESCRIPTION("MC13783 input touchscreen driver");
+MODULE_AUTHOR("Sascha Hauer <s.hauer@pengutronix.de>");
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:" MC13783_TS_NAME);
diff --git a/drivers/input/touchscreen/pcap_ts.c b/drivers/input/touchscreen/pcap_ts.c
index 67fcd33595de..b79097e3028a 100644
--- a/drivers/input/touchscreen/pcap_ts.c
+++ b/drivers/input/touchscreen/pcap_ts.c
@@ -233,7 +233,7 @@ static int pcap_ts_resume(struct device *dev)
 	return 0;
 }
 
-static struct dev_pm_ops pcap_ts_pm_ops = {
+static const struct dev_pm_ops pcap_ts_pm_ops = {
 	.suspend	= pcap_ts_suspend,
 	.resume		= pcap_ts_resume,
 };
diff --git a/drivers/input/touchscreen/s3c2410_ts.c b/drivers/input/touchscreen/s3c2410_ts.c
new file mode 100644
index 000000000000..6386b441ef85
--- /dev/null
+++ b/drivers/input/touchscreen/s3c2410_ts.c
@@ -0,0 +1,457 @@
+/*
+ * Samsung S3C24XX touchscreen driver
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the term of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ *
+ * Copyright 2004 Arnaud Patard <arnaud.patard@rtp-net.org>
+ * Copyright 2008 Ben Dooks <ben-linux@fluff.org>
+ * Copyright 2009 Simtec Electronics <linux@simtec.co.uk>
+ *
+ * Additional work by Herbert Pötzl <herbert@13thfloor.at> and
+ * Harald Welte <laforge@openmoko.org>
+ */
+
+#include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/gpio.h>
+#include <linux/input.h>
+#include <linux/init.h>
+#include <linux/delay.h>
+#include <linux/interrupt.h>
+#include <linux/platform_device.h>
+#include <linux/clk.h>
+#include <linux/io.h>
+
+#include <plat/adc.h>
+#include <plat/regs-adc.h>
+
+#include <mach/regs-gpio.h>
+#include <mach/ts.h>
+
+#define TSC_SLEEP  (S3C2410_ADCTSC_PULL_UP_DISABLE | S3C2410_ADCTSC_XY_PST(0))
+
+#define INT_DOWN	(0)
+#define INT_UP		(1 << 8)
+
+#define WAIT4INT	(S3C2410_ADCTSC_YM_SEN | \
+			 S3C2410_ADCTSC_YP_SEN | \
+			 S3C2410_ADCTSC_XP_SEN | \
+			 S3C2410_ADCTSC_XY_PST(3))
+
+#define AUTOPST		(S3C2410_ADCTSC_YM_SEN | \
+			 S3C2410_ADCTSC_YP_SEN | \
+			 S3C2410_ADCTSC_XP_SEN | \
+			 S3C2410_ADCTSC_AUTO_PST | \
+			 S3C2410_ADCTSC_XY_PST(0))
+
+/* Per-touchscreen data. */
+
+/**
+ * struct s3c2410ts - driver touchscreen state.
+ * @client: The ADC client we registered with the core driver.
+ * @dev: The device we are bound to.
+ * @input: The input device we registered with the input subsystem.
+ * @clock: The clock for the adc.
+ * @io: Pointer to the IO base.
+ * @xp: The accumulated X position data.
+ * @yp: The accumulated Y position data.
+ * @irq_tc: The interrupt number for pen up/down interrupt
+ * @count: The number of samples collected.
+ * @shift: The log2 of the maximum count to read in one go.
+ */
+struct s3c2410ts {
+	struct s3c_adc_client *client;
+	struct device *dev;
+	struct input_dev *input;
+	struct clk *clock;
+	void __iomem *io;
+	unsigned long xp;
+	unsigned long yp;
+	int irq_tc;
+	int count;
+	int shift;
+};
+
+static struct s3c2410ts ts;
+
+/**
+ * s3c2410_ts_connect - configure gpio for s3c2410 systems
+ *
+ * Configure the GPIO for the S3C2410 system, where we have external FETs
+ * connected to the device (later systems such as the S3C2440 integrate
+ * these into the device).
+*/
+static inline void s3c2410_ts_connect(void)
+{
+	s3c2410_gpio_cfgpin(S3C2410_GPG(12), S3C2410_GPG12_XMON);
+	s3c2410_gpio_cfgpin(S3C2410_GPG(13), S3C2410_GPG13_nXPON);
+	s3c2410_gpio_cfgpin(S3C2410_GPG(14), S3C2410_GPG14_YMON);
+	s3c2410_gpio_cfgpin(S3C2410_GPG(15), S3C2410_GPG15_nYPON);
+}
+
+/**
+ * get_down - return the down state of the pen
+ * @data0: The data read from ADCDAT0 register.
+ * @data1: The data read from ADCDAT1 register.
+ *
+ * Return non-zero if both readings show that the pen is down.
+ */
+static inline bool get_down(unsigned long data0, unsigned long data1)
+{
+	/* returns true if both data values show stylus down */
+	return (!(data0 & S3C2410_ADCDAT0_UPDOWN) &&
+		!(data1 & S3C2410_ADCDAT0_UPDOWN));
+}
+
+static void touch_timer_fire(unsigned long data)
+{
+	unsigned long data0;
+	unsigned long data1;
+	bool down;
+
+	data0 = readl(ts.io + S3C2410_ADCDAT0);
+	data1 = readl(ts.io + S3C2410_ADCDAT1);
+
+	down = get_down(data0, data1);
+
+	if (ts.count == (1 << ts.shift)) {
+		ts.xp >>= ts.shift;
+		ts.yp >>= ts.shift;
+
+		dev_dbg(ts.dev, "%s: X=%lu, Y=%lu, count=%d\n",
+			__func__, ts.xp, ts.yp, ts.count);
+
+		input_report_abs(ts.input, ABS_X, ts.xp);
+		input_report_abs(ts.input, ABS_Y, ts.yp);
+
+		input_report_key(ts.input, BTN_TOUCH, 1);
+		input_sync(ts.input);
+
+		ts.xp = 0;
+		ts.yp = 0;
+		ts.count = 0;
+	}
+
+	if (down) {
+		s3c_adc_start(ts.client, 0, 1 << ts.shift);
+	} else {
+		ts.count = 0;
+
+		input_report_key(ts.input, BTN_TOUCH, 0);
+		input_sync(ts.input);
+
+		writel(WAIT4INT | INT_DOWN, ts.io + S3C2410_ADCTSC);
+	}
+}
+
+static DEFINE_TIMER(touch_timer, touch_timer_fire, 0, 0);
+
+/**
+ * stylus_irq - touchscreen stylus event interrupt
+ * @irq: The interrupt number
+ * @dev_id: The device ID.
+ *
+ * Called when the IRQ_TC is fired for a pen up or down event.
+ */
+static irqreturn_t stylus_irq(int irq, void *dev_id)
+{
+	unsigned long data0;
+	unsigned long data1;
+	bool down;
+
+	data0 = readl(ts.io + S3C2410_ADCDAT0);
+	data1 = readl(ts.io + S3C2410_ADCDAT1);
+
+	down = get_down(data0, data1);
+
+	/* TODO we should never get an interrupt with down set while
+	 * the timer is running, but maybe we ought to verify that the
+	 * timer isn't running anyways. */
+
+	if (down)
+		s3c_adc_start(ts.client, 0, 1 << ts.shift);
+	else
+		dev_info(ts.dev, "%s: count=%d\n", __func__, ts.count);
+
+	return IRQ_HANDLED;
+}
+
+/**
+ * s3c24xx_ts_conversion - ADC conversion callback
+ * @client: The client that was registered with the ADC core.
+ * @data0: The reading from ADCDAT0.
+ * @data1: The reading from ADCDAT1.
+ * @left: The number of samples left.
+ *
+ * Called when a conversion has finished.
+ */
+static void s3c24xx_ts_conversion(struct s3c_adc_client *client,
+				  unsigned data0, unsigned data1,
+				  unsigned *left)
+{
+	dev_dbg(ts.dev, "%s: %d,%d\n", __func__, data0, data1);
+
+	ts.xp += data0;
+	ts.yp += data1;
+
+	ts.count++;
+
+	/* From tests, it seems that it is unlikely to get a pen-up
+	 * event during the conversion process which means we can
+	 * ignore any pen-up events with less than the requisite
+	 * count done.
+	 *
+	 * In several thousand conversions, no pen-ups where detected
+	 * before count completed.
+	 */
+}
+
+/**
+ * s3c24xx_ts_select - ADC selection callback.
+ * @client: The client that was registered with the ADC core.
+ * @select: The reason for select.
+ *
+ * Called when the ADC core selects (or deslects) us as a client.
+ */
+static void s3c24xx_ts_select(struct s3c_adc_client *client, unsigned select)
+{
+	if (select) {
+		writel(S3C2410_ADCTSC_PULL_UP_DISABLE | AUTOPST,
+		       ts.io + S3C2410_ADCTSC);
+	} else {
+		mod_timer(&touch_timer, jiffies+1);
+		writel(WAIT4INT | INT_UP, ts.io + S3C2410_ADCTSC);
+	}
+}
+
+/**
+ * s3c2410ts_probe - device core probe entry point
+ * @pdev: The device we are being bound to.
+ *
+ * Initialise, find and allocate any resources we need to run and then
+ * register with the ADC and input systems.
+ */
+static int __devinit s3c2410ts_probe(struct platform_device *pdev)
+{
+	struct s3c2410_ts_mach_info *info;
+	struct device *dev = &pdev->dev;
+	struct input_dev *input_dev;
+	struct resource *res;
+	int ret = -EINVAL;
+
+	/* Initialise input stuff */
+	memset(&ts, 0, sizeof(struct s3c2410ts));
+
+	ts.dev = dev;
+
+	info = pdev->dev.platform_data;
+	if (!info) {
+		dev_err(dev, "no platform data, cannot attach\n");
+		return -EINVAL;
+	}
+
+	dev_dbg(dev, "initialising touchscreen\n");
+
+	ts.clock = clk_get(dev, "adc");
+	if (IS_ERR(ts.clock)) {
+		dev_err(dev, "cannot get adc clock source\n");
+		return -ENOENT;
+	}
+
+	clk_enable(ts.clock);
+	dev_dbg(dev, "got and enabled clocks\n");
+
+	ts.irq_tc = ret = platform_get_irq(pdev, 0);
+	if (ret < 0) {
+		dev_err(dev, "no resource for interrupt\n");
+		goto err_clk;
+	}
+
+	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	if (!res) {
+		dev_err(dev, "no resource for registers\n");
+		ret = -ENOENT;
+		goto err_clk;
+	}
+
+	ts.io = ioremap(res->start, resource_size(res));
+	if (ts.io == NULL) {
+		dev_err(dev, "cannot map registers\n");
+		ret = -ENOMEM;
+		goto err_clk;
+	}
+
+	/* Configure the touchscreen external FETs on the S3C2410 */
+	if (!platform_get_device_id(pdev)->driver_data)
+		s3c2410_ts_connect();
+
+	ts.client = s3c_adc_register(pdev, s3c24xx_ts_select,
+				     s3c24xx_ts_conversion, 1);
+	if (IS_ERR(ts.client)) {
+		dev_err(dev, "failed to register adc client\n");
+		ret = PTR_ERR(ts.client);
+		goto err_iomap;
+	}
+
+	/* Initialise registers */
+	if ((info->delay & 0xffff) > 0)
+		writel(info->delay & 0xffff, ts.io + S3C2410_ADCDLY);
+
+	writel(WAIT4INT | INT_DOWN, ts.io + S3C2410_ADCTSC);
+
+	input_dev = input_allocate_device();
+	if (!input_dev) {
+		dev_err(dev, "Unable to allocate the input device !!\n");
+		ret = -ENOMEM;
+		goto err_iomap;
+	}
+
+	ts.input = input_dev;
+	ts.input->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_ABS);
+	ts.input->keybit[BIT_WORD(BTN_TOUCH)] = BIT_MASK(BTN_TOUCH);
+	input_set_abs_params(ts.input, ABS_X, 0, 0x3FF, 0, 0);
+	input_set_abs_params(ts.input, ABS_Y, 0, 0x3FF, 0, 0);
+
+	ts.input->name = "S3C24XX TouchScreen";
+	ts.input->id.bustype = BUS_HOST;
+	ts.input->id.vendor = 0xDEAD;
+	ts.input->id.product = 0xBEEF;
+	ts.input->id.version = 0x0102;
+
+	ts.shift = info->oversampling_shift;
+
+	ret = request_irq(ts.irq_tc, stylus_irq, IRQF_DISABLED,
+			  "s3c2410_ts_pen", ts.input);
+	if (ret) {
+		dev_err(dev, "cannot get TC interrupt\n");
+		goto err_inputdev;
+	}
+
+	dev_info(dev, "driver attached, registering input device\n");
+
+	/* All went ok, so register to the input system */
+	ret = input_register_device(ts.input);
+	if (ret < 0) {
+		dev_err(dev, "failed to register input device\n");
+		ret = -EIO;
+		goto err_tcirq;
+	}
+
+	return 0;
+
+ err_tcirq:
+	free_irq(ts.irq_tc, ts.input);
+ err_inputdev:
+	input_unregister_device(ts.input);
+ err_iomap:
+	iounmap(ts.io);
+ err_clk:
+	del_timer_sync(&touch_timer);
+	clk_put(ts.clock);
+	return ret;
+}
+
+/**
+ * s3c2410ts_remove - device core removal entry point
+ * @pdev: The device we are being removed from.
+ *
+ * Free up our state ready to be removed.
+ */
+static int __devexit s3c2410ts_remove(struct platform_device *pdev)
+{
+	free_irq(ts.irq_tc, ts.input);
+	del_timer_sync(&touch_timer);
+
+	clk_disable(ts.clock);
+	clk_put(ts.clock);
+
+	input_unregister_device(ts.input);
+	iounmap(ts.io);
+
+	return 0;
+}
+
+#ifdef CONFIG_PM
+static int s3c2410ts_suspend(struct device *dev)
+{
+	writel(TSC_SLEEP, ts.io + S3C2410_ADCTSC);
+	disable_irq(ts.irq_tc);
+	clk_disable(ts.clock);
+
+	return 0;
+}
+
+static int s3c2410ts_resume(struct device *dev)
+{
+	struct platform_device *pdev = to_platform_device(dev);
+	struct s3c2410_ts_mach_info *info = pdev->dev.platform_data;
+
+	clk_enable(ts.clock);
+
+	/* Initialise registers */
+	if ((info->delay & 0xffff) > 0)
+		writel(info->delay & 0xffff, ts.io + S3C2410_ADCDLY);
+
+	writel(WAIT4INT | INT_DOWN, ts.io + S3C2410_ADCTSC);
+
+	return 0;
+}
+
+static struct dev_pm_ops s3c_ts_pmops = {
+	.suspend	= s3c2410ts_suspend,
+	.resume		= s3c2410ts_resume,
+};
+#endif
+
+static struct platform_device_id s3cts_driver_ids[] = {
+	{ "s3c2410-ts", 0 },
+	{ "s3c2440-ts", 1 },
+	{ }
+};
+MODULE_DEVICE_TABLE(platform, s3cts_driver_ids);
+
+static struct platform_driver s3c_ts_driver = {
+	.driver         = {
+		.name   = "s3c24xx-ts",
+		.owner  = THIS_MODULE,
+#ifdef CONFIG_PM
+		.pm	= &s3c_ts_pmops,
+#endif
+	},
+	.id_table	= s3cts_driver_ids,
+	.probe		= s3c2410ts_probe,
+	.remove		= __devexit_p(s3c2410ts_remove),
+};
+
+static int __init s3c2410ts_init(void)
+{
+	return platform_driver_register(&s3c_ts_driver);
+}
+
+static void __exit s3c2410ts_exit(void)
+{
+	platform_driver_unregister(&s3c_ts_driver);
+}
+
+module_init(s3c2410ts_init);
+module_exit(s3c2410ts_exit);
+
+MODULE_AUTHOR("Arnaud Patard <arnaud.patard@rtp-net.org>, "
+	      "Ben Dooks <ben@simtec.co.uk>, "
+	      "Simtec Electronics <linux@simtec.co.uk>");
+MODULE_DESCRIPTION("S3C24XX Touchscreen driver");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/input/touchscreen/ucb1400_ts.c b/drivers/input/touchscreen/ucb1400_ts.c
index 095f84b1f56e..89dcbe7b4b02 100644
--- a/drivers/input/touchscreen/ucb1400_ts.c
+++ b/drivers/input/touchscreen/ucb1400_ts.c
@@ -355,10 +355,13 @@ static int ucb1400_ts_probe(struct platform_device *dev)
 		goto err;
 	}
 
-	error = ucb1400_ts_detect_irq(ucb);
-	if (error) {
-		printk(KERN_ERR "UCB1400: IRQ probe failed\n");
-		goto err_free_devs;
+	/* Only in case the IRQ line wasn't supplied, try detecting it */
+	if (ucb->irq < 0) {
+		error = ucb1400_ts_detect_irq(ucb);
+		if (error) {
+			printk(KERN_ERR "UCB1400: IRQ probe failed\n");
+			goto err_free_devs;
+		}
 	}
 
 	init_waitqueue_head(&ucb->ts_wait);
diff --git a/drivers/input/touchscreen/usbtouchscreen.c b/drivers/input/touchscreen/usbtouchscreen.c
index 68ece5801a58..09a5e7341bd5 100644
--- a/drivers/input/touchscreen/usbtouchscreen.c
+++ b/drivers/input/touchscreen/usbtouchscreen.c
@@ -14,6 +14,7 @@
  *  - General Touch
  *  - GoTop Super_Q2/GogoPen/PenPower tablets
  *  - JASTEC USB touch controller/DigiTech DTR-02U
+ *  - Zytronic capacitive touchscreen
  *
  * Copyright (C) 2004-2007 by Daniel Ritz <daniel.ritz@gmx.ch>
  * Copyright (C) by Todd E. Johnson (mtouchusb.c)
@@ -73,6 +74,15 @@ struct usbtouch_device_info {
 	int min_press, max_press;
 	int rept_size;
 
+	/*
+	 * Always service the USB devices irq not just when the input device is
+	 * open. This is useful when devices have a watchdog which prevents us
+	 * from periodically polling the device. Leave this unset unless your
+	 * touchscreen device requires it, as it does consume more of the USB
+	 * bandwidth.
+	 */
+	bool irq_always;
+
 	void (*process_pkt) (struct usbtouch_usb *usbtouch, unsigned char *pkt, int len);
 
 	/*
@@ -121,6 +131,8 @@ enum {
 	DEVTYPE_GOTOP,
 	DEVTYPE_JASTEC,
 	DEVTYPE_E2I,
+	DEVTYPE_ZYTRONIC,
+	DEVTYPE_TC5UH,
 };
 
 #define USB_DEVICE_HID_CLASS(vend, prod) \
@@ -201,6 +213,15 @@ static struct usb_device_id usbtouch_devices[] = {
 #ifdef CONFIG_TOUCHSCREEN_USB_E2I
 	{USB_DEVICE(0x1ac7, 0x0001), .driver_info = DEVTYPE_E2I},
 #endif
+
+#ifdef CONFIG_TOUCHSCREEN_USB_ZYTRONIC
+	{USB_DEVICE(0x14c8, 0x0003), .driver_info = DEVTYPE_ZYTRONIC},
+#endif
+
+#ifdef CONFIG_TOUCHSCREEN_USB_ETT_TC5UH
+	{USB_DEVICE(0x0664, 0x0309), .driver_info = DEVTYPE_TC5UH},
+#endif
+
 	{}
 };
 
@@ -538,6 +559,19 @@ static int irtouch_read_data(struct usbtouch_usb *dev, unsigned char *pkt)
 }
 #endif
 
+/*****************************************************************************
+ * ET&T TC5UH part
+ */
+#ifdef CONFIG_TOUCHSCREEN_USB_ETT_TC5UH
+static int tc5uh_read_data(struct usbtouch_usb *dev, unsigned char *pkt)
+{
+	dev->x = ((pkt[2] & 0x0F) << 8) | pkt[1];
+	dev->y = ((pkt[4] & 0x0F) << 8) | pkt[3];
+	dev->touch = pkt[0] & 0x01;
+
+	return 1;
+}
+#endif
 
 /*****************************************************************************
  * IdealTEK URTC1000 Part
@@ -621,6 +655,39 @@ static int jastec_read_data(struct usbtouch_usb *dev, unsigned char *pkt)
 }
 #endif
 
+/*****************************************************************************
+ * Zytronic Part
+ */
+#ifdef CONFIG_TOUCHSCREEN_USB_ZYTRONIC
+static int zytronic_read_data(struct usbtouch_usb *dev, unsigned char *pkt)
+{
+	switch (pkt[0]) {
+	case 0x3A: /* command response */
+		dbg("%s: Command response %d", __func__, pkt[1]);
+		break;
+
+	case 0xC0: /* down */
+		dev->x = (pkt[1] & 0x7f) | ((pkt[2] & 0x07) << 7);
+		dev->y = (pkt[3] & 0x7f) | ((pkt[4] & 0x07) << 7);
+		dev->touch = 1;
+		dbg("%s: down %d,%d", __func__, dev->x, dev->y);
+		return 1;
+
+	case 0x80: /* up */
+		dev->x = (pkt[1] & 0x7f) | ((pkt[2] & 0x07) << 7);
+		dev->y = (pkt[3] & 0x7f) | ((pkt[4] & 0x07) << 7);
+		dev->touch = 0;
+		dbg("%s: up %d,%d", __func__, dev->x, dev->y);
+		return 1;
+
+	default:
+		dbg("%s: Unknown return %d", __func__, pkt[0]);
+		break;
+	}
+
+	return 0;
+}
+#endif
 
 /*****************************************************************************
  * the different device descriptors
@@ -783,6 +850,29 @@ static struct usbtouch_device_info usbtouch_dev_info[] = {
 		.read_data	= e2i_read_data,
 	},
 #endif
+
+#ifdef CONFIG_TOUCHSCREEN_USB_ZYTRONIC
+	[DEVTYPE_ZYTRONIC] = {
+		.min_xc		= 0x0,
+		.max_xc		= 0x03ff,
+		.min_yc		= 0x0,
+		.max_yc		= 0x03ff,
+		.rept_size	= 5,
+		.read_data	= zytronic_read_data,
+		.irq_always     = true,
+	},
+#endif
+
+#ifdef CONFIG_TOUCHSCREEN_USB_ETT_TC5UH
+	[DEVTYPE_TC5UH] = {
+		.min_xc		= 0x0,
+		.max_xc		= 0x0fff,
+		.min_yc		= 0x0,
+		.max_yc		= 0x0fff,
+		.rept_size	= 5,
+		.read_data	= tc5uh_read_data,
+	},
+#endif
 };
 
 
@@ -933,8 +1023,10 @@ static int usbtouch_open(struct input_dev *input)
 
 	usbtouch->irq->dev = usbtouch->udev;
 
-	if (usb_submit_urb(usbtouch->irq, GFP_KERNEL))
-		return -EIO;
+	if (!usbtouch->type->irq_always) {
+		if (usb_submit_urb(usbtouch->irq, GFP_KERNEL))
+		  return -EIO;
+	}
 
 	return 0;
 }
@@ -943,7 +1035,8 @@ static void usbtouch_close(struct input_dev *input)
 {
 	struct usbtouch_usb *usbtouch = input_get_drvdata(input);
 
-	usb_kill_urb(usbtouch->irq);
+	if (!usbtouch->type->irq_always)
+		usb_kill_urb(usbtouch->irq);
 }
 
 
@@ -1066,6 +1159,9 @@ static int usbtouch_probe(struct usb_interface *intf,
 
 	usb_set_intfdata(intf, usbtouch);
 
+	if (usbtouch->type->irq_always)
+		usb_submit_urb(usbtouch->irq, GFP_KERNEL);
+
 	return 0;
 
 out_free_buffers:
@@ -1087,7 +1183,7 @@ static void usbtouch_disconnect(struct usb_interface *intf)
 
 	dbg("%s - usbtouch is initialized, cleaning up", __func__);
 	usb_set_intfdata(intf, NULL);
-	usb_kill_urb(usbtouch->irq);
+	/* this will stop IO via close */
 	input_unregister_device(usbtouch->input);
 	usb_free_urb(usbtouch->irq);
 	usbtouch_free_buffers(interface_to_usbdev(intf), usbtouch);
diff --git a/drivers/input/touchscreen/zylonite-wm97xx.c b/drivers/input/touchscreen/zylonite-wm97xx.c
index 41e4359c277c..eca54dbdf493 100644
--- a/drivers/input/touchscreen/zylonite-wm97xx.c
+++ b/drivers/input/touchscreen/zylonite-wm97xx.c
@@ -96,7 +96,7 @@ static int wm97xx_acc_pen_down(struct wm97xx *wm)
 	/* When the AC97 queue has been drained we need to allow time
 	 * to buffer up samples otherwise we end up spinning polling
 	 * for samples.  The controller can't have a suitably low
-	 * threashold set to use the notifications it gives.
+	 * threshold set to use the notifications it gives.
 	 */
 	msleep(1);
 
diff --git a/drivers/input/xen-kbdfront.c b/drivers/input/xen-kbdfront.c
index b115726dc088..c721c0a23eb8 100644
--- a/drivers/input/xen-kbdfront.c
+++ b/drivers/input/xen-kbdfront.c
@@ -21,7 +21,10 @@
 #include <linux/errno.h>
 #include <linux/module.h>
 #include <linux/input.h>
+
 #include <asm/xen/hypervisor.h>
+
+#include <xen/xen.h>
 #include <xen/events.h>
 #include <xen/page.h>
 #include <xen/interface/io/fbif.h>
diff --git a/drivers/isdn/act2000/Kconfig b/drivers/isdn/act2000/Kconfig
index 3fc1a5434ef7..fa2673fc69c2 100644
--- a/drivers/isdn/act2000/Kconfig
+++ b/drivers/isdn/act2000/Kconfig
@@ -1,6 +1,3 @@
-#
-# Config.in for IBM Active 2000 ISDN driver
-#
 config ISDN_DRV_ACT2000
 	tristate "IBM Active 2000 support"
 	depends on ISA
@@ -10,4 +7,3 @@ config ISDN_DRV_ACT2000
 	  into the card using a utility which is part of the latest
 	  isdn4k-utils package. Please read the file
 	  <file:Documentation/isdn/README.act2000> for more information.
-
diff --git a/drivers/isdn/capi/Kconfig b/drivers/isdn/capi/Kconfig
index e1afd60924fb..b2a04755c96a 100644
--- a/drivers/isdn/capi/Kconfig
+++ b/drivers/isdn/capi/Kconfig
@@ -1,6 +1,3 @@
-#
-# Config.in for the CAPI subsystem
-#
 config ISDN_DRV_AVMB1_VERBOSE_REASON
 	bool "Verbose reason code reporting"
 	default y
@@ -59,4 +56,3 @@ config ISDN_CAPI_CAPIDRV
 	  the legacy isdn4linux link layer.  If you have a card which is
 	  supported by a CAPI driver, but still want to use old features like
 	  ippp interfaces or ttyI emulation, say Y/M here.
-
diff --git a/drivers/isdn/capi/capidrv.c b/drivers/isdn/capi/capidrv.c
index 3e6d17f42a98..66b7d7a86474 100644
--- a/drivers/isdn/capi/capidrv.c
+++ b/drivers/isdn/capi/capidrv.c
@@ -830,7 +830,7 @@ static void handle_controller(_cmsg * cmsg)
 		      case 0: break;
 		      case 1: s = "unknown class"; break;
 		      case 2: s = "unknown function"; break;
-		      default: s = "unkown error"; break;
+		      default: s = "unknown error"; break;
 		   }
 		   if (s)
 	           printk(KERN_INFO "capidrv-%d: %s from controller 0x%x function %d: %s\n",
diff --git a/drivers/isdn/hardware/avm/avm_cs.c b/drivers/isdn/hardware/avm/avm_cs.c
index 5a6ae646a636..94b796d84053 100644
--- a/drivers/isdn/hardware/avm/avm_cs.c
+++ b/drivers/isdn/hardware/avm/avm_cs.c
@@ -108,8 +108,7 @@ static int avmcs_probe(struct pcmcia_device *p_dev)
     p_dev->io.NumPorts2 = 0;
 
     /* Interrupt setup */
-    p_dev->irq.Attributes = IRQ_TYPE_EXCLUSIVE;
-    p_dev->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING|IRQ_FIRST_SHARED;
+    p_dev->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
 
     /* General socket configuration */
     p_dev->conf.Attributes = CONF_ENABLE_IRQ;
diff --git a/drivers/isdn/hardware/eicon/di.c b/drivers/isdn/hardware/eicon/di.c
index b029d130eb21..cb14ae3e7154 100644
--- a/drivers/isdn/hardware/eicon/di.c
+++ b/drivers/isdn/hardware/eicon/di.c
@@ -806,7 +806,7 @@ static void xdi_xlog_request (byte Adapter, byte Id,
           DELIVERY - indication entered isdn_rc function
           RNR=...  - application had returned RNR=... after the
                      look ahead callback
-          RNum=0   - aplication had not returned any buffer to copy
+          RNum=0   - application had not returned any buffer to copy
                      this indication and will copy it self
           COMPLETE - XDI had copied the data to the buffers provided
                      bu the application and is about to issue the
diff --git a/drivers/isdn/hardware/eicon/maintidi.c b/drivers/isdn/hardware/eicon/maintidi.c
index 41c26e756452..534978bdf382 100644
--- a/drivers/isdn/hardware/eicon/maintidi.c
+++ b/drivers/isdn/hardware/eicon/maintidi.c
@@ -385,7 +385,7 @@ static int SuperTraceMessageInput (void* hLib) {
                   }
                   break;
                 default:
-                  diva_mnt_internal_dprintf (0, DLI_ERR, "Unknon IDI Ind (DMA mode): %02x", Ind);
+                  diva_mnt_internal_dprintf (0, DLI_ERR, "Unknown IDI Ind (DMA mode): %02x", Ind);
               }
               p += (this_ind_length+1);
               total_length -= (4 + this_ind_length);
@@ -420,7 +420,7 @@ static int SuperTraceMessageInput (void* hLib) {
             }
             break;
           default:
-            diva_mnt_internal_dprintf (0, DLI_ERR, "Unknon IDI Ind: %02x", Ind);
+            diva_mnt_internal_dprintf (0, DLI_ERR, "Unknown IDI Ind: %02x", Ind);
         }
       }
     }
diff --git a/drivers/isdn/hardware/mISDN/hfcmulti.c b/drivers/isdn/hardware/mISDN/hfcmulti.c
index a6624ad252c5..1a1420d7a828 100644
--- a/drivers/isdn/hardware/mISDN/hfcmulti.c
+++ b/drivers/isdn/hardware/mISDN/hfcmulti.c
@@ -3152,7 +3152,7 @@ static void
 hfcmulti_pcm(struct hfc_multi *hc, int ch, int slot_tx, int bank_tx,
     int slot_rx, int bank_rx)
 {
-	if (slot_rx < 0 || slot_rx < 0 || bank_tx < 0 || bank_rx < 0) {
+	if (slot_tx < 0 || slot_rx < 0 || bank_tx < 0 || bank_rx < 0) {
 		/* disable PCM */
 		mode_hfcmulti(hc, ch, hc->chan[ch].protocol, -1, 0, -1, 0);
 		return;
diff --git a/drivers/isdn/hardware/mISDN/hfcsusb.c b/drivers/isdn/hardware/mISDN/hfcsusb.c
index fc46a26cb14f..a64bb6c67ba7 100644
--- a/drivers/isdn/hardware/mISDN/hfcsusb.c
+++ b/drivers/isdn/hardware/mISDN/hfcsusb.c
@@ -721,7 +721,7 @@ hfcsusb_setup_bch(struct bchannel *bch, int protocol)
 	switch (protocol) {
 	case (-1):	/* used for init */
 		bch->state = -1;
-		/* fall trough */
+		/* fall through */
 	case (ISDN_P_NONE):
 		if (bch->state == ISDN_P_NONE)
 			return 0; /* already in idle state */
diff --git a/drivers/isdn/hardware/mISDN/hfcsusb.h b/drivers/isdn/hardware/mISDN/hfcsusb.h
index 43efe7358fa3..369196adae03 100644
--- a/drivers/isdn/hardware/mISDN/hfcsusb.h
+++ b/drivers/isdn/hardware/mISDN/hfcsusb.h
@@ -150,7 +150,7 @@ symbolic(struct hfcusb_symbolic_list list[], const int num)
 	for (i = 0; list[i].name != NULL; i++)
 		if (list[i].num == num)
 			return list[i].name;
-	return "<unkown USB Error>";
+	return "<unknown USB Error>";
 }
 
 /* USB descriptor need to contain one of the following EndPoint combination: */
diff --git a/drivers/isdn/hardware/mISDN/mISDNisar.c b/drivers/isdn/hardware/mISDN/mISDNisar.c
index de352a17673a..09095c747110 100644
--- a/drivers/isdn/hardware/mISDN/mISDNisar.c
+++ b/drivers/isdn/hardware/mISDN/mISDNisar.c
@@ -860,7 +860,7 @@ isar_pump_statev_modem(struct isar_ch *ch, u8 devt) {
 		pr_debug("%s: pump stev GSTN CLEAR\n", ch->is->name);
 		break;
 	default:
-		pr_info("u%s: nknown pump stev %x\n", ch->is->name, devt);
+		pr_info("u%s: unknown pump stev %x\n", ch->is->name, devt);
 		break;
 	}
 }
diff --git a/drivers/isdn/hisax/avma1_cs.c b/drivers/isdn/hisax/avma1_cs.c
index f9bdff39cf4a..e5deb15cf40c 100644
--- a/drivers/isdn/hisax/avma1_cs.c
+++ b/drivers/isdn/hisax/avma1_cs.c
@@ -120,8 +120,7 @@ static int avma1cs_probe(struct pcmcia_device *p_dev)
     p_dev->io.IOAddrLines = 5;
 
     /* Interrupt setup */
-    p_dev->irq.Attributes = IRQ_TYPE_EXCLUSIVE;
-    p_dev->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING|IRQ_FIRST_SHARED;
+    p_dev->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
 
     /* General socket configuration */
     p_dev->conf.Attributes = CONF_ENABLE_IRQ;
diff --git a/drivers/isdn/hisax/elsa_cs.c b/drivers/isdn/hisax/elsa_cs.c
index a2f709f53974..c9a30b1c9237 100644
--- a/drivers/isdn/hisax/elsa_cs.c
+++ b/drivers/isdn/hisax/elsa_cs.c
@@ -137,7 +137,7 @@ static int elsa_cs_probe(struct pcmcia_device *link)
     local->cardnr = -1;
 
     /* Interrupt setup */
-    link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING|IRQ_FIRST_SHARED;
+    link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
     link->irq.Handler = NULL;
 
     /*
diff --git a/drivers/isdn/hisax/hfc_usb.c b/drivers/isdn/hisax/hfc_usb.c
index a420b64472e3..aaaeaafd86f4 100644
--- a/drivers/isdn/hisax/hfc_usb.c
+++ b/drivers/isdn/hisax/hfc_usb.c
@@ -1086,7 +1086,7 @@ hfc_usb_l2l1(struct hisax_if *my_hisax_if, int pr, void *arg)
 			break;
 		default:
 			DBG(HFCUSB_DBG_STATES,
-			       "HFC_USB: hfc_usb_d_l2l1: unkown state : %#x", pr);
+			       "HFC_USB: hfc_usb_d_l2l1: unknown state : %#x", pr);
 			break;
 	}
 }
diff --git a/drivers/isdn/hisax/sedlbauer_cs.c b/drivers/isdn/hisax/sedlbauer_cs.c
index af5d393cc2d0..7836ec3c7f86 100644
--- a/drivers/isdn/hisax/sedlbauer_cs.c
+++ b/drivers/isdn/hisax/sedlbauer_cs.c
@@ -144,7 +144,7 @@ static int sedlbauer_probe(struct pcmcia_device *link)
     link->priv = local;
 
     /* Interrupt setup */
-    link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING|IRQ_FIRST_SHARED;
+    link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
     link->irq.Handler = NULL;
 
     /*
diff --git a/drivers/isdn/hisax/teles_cs.c b/drivers/isdn/hisax/teles_cs.c
index ea705394ce2b..b0c5976cbdb3 100644
--- a/drivers/isdn/hisax/teles_cs.c
+++ b/drivers/isdn/hisax/teles_cs.c
@@ -127,7 +127,7 @@ static int teles_probe(struct pcmcia_device *link)
     link->priv = local;
 
     /* Interrupt setup */
-    link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING|IRQ_FIRST_SHARED;
+    link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING;
     link->irq.Handler = NULL;
 
     /*
diff --git a/drivers/isdn/hysdn/Kconfig b/drivers/isdn/hysdn/Kconfig
index c9e4231968ef..e86bc6583d71 100644
--- a/drivers/isdn/hysdn/Kconfig
+++ b/drivers/isdn/hysdn/Kconfig
@@ -1,6 +1,3 @@
-#
-# Config.in for HYSDN ISDN driver
-#
 config HYSDN
 	tristate "Hypercope HYSDN cards (Champ, Ergo, Metro) support (module only)"
 	depends on m && PROC_FS && PCI
@@ -15,4 +12,3 @@ config HYSDN_CAPI
 	depends on HYSDN && ISDN_CAPI
 	help
 	  Say Y here if you like to use Hypercope's CAPI 2.0 interface.
-
diff --git a/drivers/isdn/i4l/isdn_net.c b/drivers/isdn/i4l/isdn_net.c
index 90b56ed8651f..507e13d9a57c 100644
--- a/drivers/isdn/i4l/isdn_net.c
+++ b/drivers/isdn/i4l/isdn_net.c
@@ -1563,7 +1563,7 @@ isdn_net_ciscohdlck_slarp_send_keepalive(unsigned long data)
 	*(__be32 *)(p +  4) = cpu_to_be32(CISCO_SLARP_KEEPALIVE);
 	*(__be32 *)(p +  8) = cpu_to_be32(lp->cisco_myseq);
 	*(__be32 *)(p + 12) = cpu_to_be32(lp->cisco_yourseq);
-	*(__be16 *)(p + 16) = cpu_to_be16(0xffff); // reliablity, always 0xffff
+	*(__be16 *)(p + 16) = cpu_to_be16(0xffff); // reliability, always 0xffff
 	p += 18;
 
 	isdn_net_write_super(lp, skb);
diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c
index 642d5aaf53ce..45df6675e8ed 100644
--- a/drivers/isdn/i4l/isdn_ppp.c
+++ b/drivers/isdn/i4l/isdn_ppp.c
@@ -836,7 +836,7 @@ isdn_ppp_write(int min, struct file *file, const char __user *buf, int count)
 			unsigned short hl;
 			struct sk_buff *skb;
 			/*
-			 * we need to reserve enought space in front of
+			 * we need to reserve enough space in front of
 			 * sk_buff. old call to dev_alloc_skb only reserved
 			 * 16 bytes, now we are looking what the driver want
 			 */
@@ -1326,7 +1326,7 @@ isdn_ppp_xmit(struct sk_buff *skb, struct net_device *netdev)
 		struct sk_buff *new_skb;
 	        unsigned short hl;
 		/*
-		 * we need to reserve enought space in front of
+		 * we need to reserve enough space in front of
 		 * sk_buff. old call to dev_alloc_skb only reserved
 		 * 16 bytes, now we are looking what the driver want.
 		 */
@@ -1674,7 +1674,7 @@ static void isdn_ppp_mp_receive(isdn_net_dev * net_dev, isdn_net_local * lp,
 	 * - insert new fragment into the proper sequence slot (once that's done
 	 *   newfrag will be set to NULL)
 	 * - reassemble any complete fragment sequence (non-null 'start'
-	 *   indicates there is a continguous sequence present)
+	 *   indicates there is a contiguous sequence present)
 	 * - discard any incomplete sequences that are below minseq -- due
 	 *   to the fact that sender always increment sequence number, if there
 	 *   is an incomplete sequence below minseq, no new fragments would
diff --git a/drivers/isdn/i4l/isdn_ttyfax.c b/drivers/isdn/i4l/isdn_ttyfax.c
index 78f7660c1d0e..4c41f191d4e2 100644
--- a/drivers/isdn/i4l/isdn_ttyfax.c
+++ b/drivers/isdn/i4l/isdn_ttyfax.c
@@ -470,7 +470,7 @@ isdn_tty_cmd_FCLASS2(char **p, modem_info * info)
 		}
 		return 0;
 	}
-	/* BADMUL=value - dummy 0=disable errorchk disabled (treshold multiplier) */
+	/* BADMUL=value - dummy 0=disable errorchk disabled (threshold multiplier) */
 	if (!strncmp(p[0], "BADMUL", 6)) {
 		p[0] += 6;
 		switch (*p[0]) {
diff --git a/drivers/isdn/icn/Kconfig b/drivers/isdn/icn/Kconfig
index 89d15eed765e..4534f21a1852 100644
--- a/drivers/isdn/icn/Kconfig
+++ b/drivers/isdn/icn/Kconfig
@@ -1,6 +1,3 @@
-#
-# Config.in for ICN ISDN driver
-#
 config ISDN_DRV_ICN
 	tristate "ICN 2B and 4B support"
 	depends on ISA
@@ -13,4 +10,3 @@ config ISDN_DRV_ICN
 	  separately.  See <file:Documentation/isdn/README> and
 	  <file:Documentation/isdn/README.icn> for more
 	  information.
-
diff --git a/drivers/isdn/mISDN/dsp_core.c b/drivers/isdn/mISDN/dsp_core.c
index 77ee2867c8b4..43ff4d3b046e 100644
--- a/drivers/isdn/mISDN/dsp_core.c
+++ b/drivers/isdn/mISDN/dsp_core.c
@@ -110,7 +110,7 @@
  * crossconnections and conferences via software if not possible through
  * hardware. If hardware capability is available, hardware is used.
  *
- * Echo: Is generated by CMX and is used to check performane of hard and
+ * Echo: Is generated by CMX and is used to check performance of hard and
  * software CMX.
  *
  * The CMX has special functions for conferences with one, two and more
diff --git a/drivers/isdn/mISDN/l1oip_core.c b/drivers/isdn/mISDN/l1oip_core.c
index 7e5f30dbc0a0..f1e8af54dff0 100644
--- a/drivers/isdn/mISDN/l1oip_core.c
+++ b/drivers/isdn/mISDN/l1oip_core.c
@@ -661,7 +661,7 @@ l1oip_socket_thread(void *data)
 	size_t recvbuf_size = 1500;
 	int recvlen;
 	struct socket *socket = NULL;
-	DECLARE_COMPLETION(wait);
+	DECLARE_COMPLETION_ONSTACK(wait);
 
 	/* allocate buffer memory */
 	recvbuf = kmalloc(recvbuf_size, GFP_KERNEL);
diff --git a/drivers/isdn/mISDN/tei.c b/drivers/isdn/mISDN/tei.c
index e04bad6c5baf..6d4da6095885 100644
--- a/drivers/isdn/mISDN/tei.c
+++ b/drivers/isdn/mISDN/tei.c
@@ -725,7 +725,7 @@ tei_id_ver_tout_net(struct FsmInst *fi, int event, void *arg)
 	if (tm->rcnt == 1) {
 		if (*debug & DEBUG_L2_TEI)
 			tm->tei_m.printdebug(fi,
-			    "check req for tei %d sucessful\n", tm->l2->tei);
+			    "check req for tei %d successful\n", tm->l2->tei);
 		mISDN_FsmChangeState(fi, ST_TEI_NOP);
 	} else if (tm->rcnt > 1) {
 		/* duplicate assignment; remove */
diff --git a/drivers/isdn/pcbit/Kconfig b/drivers/isdn/pcbit/Kconfig
index ffba6eca1244..e9b2dd85d410 100644
--- a/drivers/isdn/pcbit/Kconfig
+++ b/drivers/isdn/pcbit/Kconfig
@@ -1,6 +1,3 @@
-#
-# Config.in for PCBIT ISDN driver
-#
 config ISDN_DRV_PCBIT
 	tristate "PCBIT-D support"
 	depends on ISA && (BROKEN || X86)
@@ -11,4 +8,3 @@ config ISDN_DRV_PCBIT
 	  the card using a utility which is distributed separately.  See
 	  <file:Documentation/isdn/README> and
 	  <file:Documentation/isdn/README.pcbit> for more information.
-
diff --git a/drivers/isdn/sc/Kconfig b/drivers/isdn/sc/Kconfig
index e6510ca7bf43..7469863a7925 100644
--- a/drivers/isdn/sc/Kconfig
+++ b/drivers/isdn/sc/Kconfig
@@ -1,6 +1,3 @@
-#
-# Config.in for Spellcaster ISDN driver
-#
 config ISDN_DRV_SC
 	tristate "Spellcaster support"
 	depends on ISA
@@ -9,4 +6,3 @@ config ISDN_DRV_SC
 	  driver currently builds only in a modularized version.
 	  To build it, choose M here: the module will be called sc.
 	  See <file:Documentation/isdn/README.sc> for more information.
-
diff --git a/drivers/leds/Kconfig b/drivers/leds/Kconfig
index e4f599f20e38..8a0e1ec95e4a 100644
--- a/drivers/leds/Kconfig
+++ b/drivers/leds/Kconfig
@@ -229,6 +229,12 @@ config LEDS_PWM
 	help
 	  This option enables support for pwm driven LEDs
 
+config LEDS_REGULATOR
+	tristate "REGULATOR driven LED support"
+	depends on LEDS_CLASS && REGULATOR
+	help
+	  This option enables support for regulator driven LEDs.
+
 config LEDS_BD2802
 	tristate "LED driver for BD2802 RGB LED"
 	depends on LEDS_CLASS && I2C
@@ -236,6 +242,33 @@ config LEDS_BD2802
 	  This option enables support for BD2802GU RGB LED driver chips
 	  accessed via the I2C bus.
 
+config LEDS_INTEL_SS4200
+	tristate "LED driver for Intel NAS SS4200 series"
+	depends on LEDS_CLASS && PCI && DMI
+	help
+	  This option enables support for the Intel SS4200 series of
+	  Network Attached Storage servers.  You may control the hard
+	  drive or power LEDs on the front panel.  Using this driver
+	  can stop the front LED from blinking after startup.
+
+config LEDS_LT3593
+	tristate "LED driver for LT3593 controllers"
+	depends on LEDS_CLASS && GENERIC_GPIO
+	help
+	  This option enables support for LEDs driven by a Linear Technology
+	  LT3593 controller. This controller uses a special one-wire pulse
+	  coding protocol to set the brightness.
+
+config LEDS_ADP5520
+	tristate "LED Support for ADP5520/ADP5501 PMIC"
+	depends on LEDS_CLASS && PMIC_ADP5520
+	help
+	  This option enables support for on-chip LED drivers found
+	  on Analog Devices ADP5520/ADP5501 PMICs.
+
+	  To compile this driver as a module, choose M here: the module will
+	  be called leds-adp5520.
+
 comment "LED Triggers"
 
 config LEDS_TRIGGERS
diff --git a/drivers/leds/Makefile b/drivers/leds/Makefile
index 46d72704d606..9e63869d7c0d 100644
--- a/drivers/leds/Makefile
+++ b/drivers/leds/Makefile
@@ -29,6 +29,10 @@ obj-$(CONFIG_LEDS_DA903X)		+= leds-da903x.o
 obj-$(CONFIG_LEDS_WM831X_STATUS)	+= leds-wm831x-status.o
 obj-$(CONFIG_LEDS_WM8350)		+= leds-wm8350.o
 obj-$(CONFIG_LEDS_PWM)			+= leds-pwm.o
+obj-$(CONFIG_LEDS_REGULATOR)		+= leds-regulator.o
+obj-$(CONFIG_LEDS_INTEL_SS4200)		+= leds-ss4200.o
+obj-$(CONFIG_LEDS_LT3593)		+= leds-lt3593.o
+obj-$(CONFIG_LEDS_ADP5520)		+= leds-adp5520.o
 
 # LED SPI Drivers
 obj-$(CONFIG_LEDS_DAC124S085)		+= leds-dac124s085.o
diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c
index f2cc13d76810..782f95822eab 100644
--- a/drivers/leds/led-class.c
+++ b/drivers/leds/led-class.c
@@ -50,7 +50,7 @@ static ssize_t led_brightness_store(struct device *dev,
 	unsigned long state = simple_strtoul(buf, &after, 10);
 	size_t count = after - buf;
 
-	if (*after && isspace(*after))
+	if (isspace(*after))
 		count++;
 
 	if (count == size) {
diff --git a/drivers/leds/leds-adp5520.c b/drivers/leds/leds-adp5520.c
new file mode 100644
index 000000000000..a8f315902131
--- /dev/null
+++ b/drivers/leds/leds-adp5520.c
@@ -0,0 +1,230 @@
+/*
+ * LEDs driver for Analog Devices ADP5520/ADP5501 MFD PMICs
+ *
+ * Copyright 2009 Analog Devices Inc.
+ *
+ * Loosely derived from leds-da903x:
+ * Copyright (C) 2008 Compulab, Ltd.
+ * 	Mike Rapoport <mike@compulab.co.il>
+ *
+ * Copyright (C) 2006-2008 Marvell International Ltd.
+ * 	Eric Miao <eric.miao@marvell.com>
+ *
+ * Licensed under the GPL-2 or later.
+ */
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/platform_device.h>
+#include <linux/leds.h>
+#include <linux/workqueue.h>
+#include <linux/mfd/adp5520.h>
+
+struct adp5520_led {
+	struct led_classdev	cdev;
+	struct work_struct	work;
+	struct device		*master;
+	enum led_brightness	new_brightness;
+	int			id;
+	int			flags;
+};
+
+static void adp5520_led_work(struct work_struct *work)
+{
+	struct adp5520_led *led = container_of(work, struct adp5520_led, work);
+	adp5520_write(led->master, ADP5520_LED1_CURRENT + led->id - 1,
+			 led->new_brightness >> 2);
+}
+
+static void adp5520_led_set(struct led_classdev *led_cdev,
+			   enum led_brightness value)
+{
+	struct adp5520_led *led;
+
+	led = container_of(led_cdev, struct adp5520_led, cdev);
+	led->new_brightness = value;
+	schedule_work(&led->work);
+}
+
+static int adp5520_led_setup(struct adp5520_led *led)
+{
+	struct device *dev = led->master;
+	int flags = led->flags;
+	int ret = 0;
+
+	switch (led->id) {
+	case FLAG_ID_ADP5520_LED1_ADP5501_LED0:
+		ret |= adp5520_set_bits(dev, ADP5520_LED_TIME,
+					(flags >> ADP5520_FLAG_OFFT_SHIFT) &
+					ADP5520_FLAG_OFFT_MASK);
+		ret |= adp5520_set_bits(dev, ADP5520_LED_CONTROL,
+					ADP5520_LED1_EN);
+		break;
+	case FLAG_ID_ADP5520_LED2_ADP5501_LED1:
+		ret |= adp5520_set_bits(dev,  ADP5520_LED_TIME,
+					((flags >> ADP5520_FLAG_OFFT_SHIFT) &
+					ADP5520_FLAG_OFFT_MASK) << 2);
+		ret |= adp5520_clr_bits(dev, ADP5520_LED_CONTROL,
+					 ADP5520_R3_MODE);
+		ret |= adp5520_set_bits(dev, ADP5520_LED_CONTROL,
+					ADP5520_LED2_EN);
+		break;
+	case FLAG_ID_ADP5520_LED3_ADP5501_LED2:
+		ret |= adp5520_set_bits(dev,  ADP5520_LED_TIME,
+					((flags >> ADP5520_FLAG_OFFT_SHIFT) &
+					ADP5520_FLAG_OFFT_MASK) << 4);
+		ret |= adp5520_clr_bits(dev, ADP5520_LED_CONTROL,
+					ADP5520_C3_MODE);
+		ret |= adp5520_set_bits(dev, ADP5520_LED_CONTROL,
+					ADP5520_LED3_EN);
+		break;
+	}
+
+	return ret;
+}
+
+static int __devinit adp5520_led_prepare(struct platform_device *pdev)
+{
+	struct adp5520_leds_platform_data *pdata = pdev->dev.platform_data;
+	struct device *dev = pdev->dev.parent;
+	int ret = 0;
+
+	ret |= adp5520_write(dev, ADP5520_LED1_CURRENT, 0);
+	ret |= adp5520_write(dev, ADP5520_LED2_CURRENT, 0);
+	ret |= adp5520_write(dev, ADP5520_LED3_CURRENT, 0);
+	ret |= adp5520_write(dev, ADP5520_LED_TIME, pdata->led_on_time << 6);
+	ret |= adp5520_write(dev, ADP5520_LED_FADE, FADE_VAL(pdata->fade_in,
+		 pdata->fade_out));
+
+	return ret;
+}
+
+static int __devinit adp5520_led_probe(struct platform_device *pdev)
+{
+	struct adp5520_leds_platform_data *pdata = pdev->dev.platform_data;
+	struct adp5520_led *led, *led_dat;
+	struct led_info *cur_led;
+	int ret, i;
+
+	if (pdata == NULL) {
+		dev_err(&pdev->dev, "missing platform data\n");
+		return -ENODEV;
+	}
+
+	if (pdata->num_leds > ADP5520_01_MAXLEDS) {
+		dev_err(&pdev->dev, "can't handle more than %d LEDS\n",
+				 ADP5520_01_MAXLEDS);
+		return -EFAULT;
+	}
+
+	led = kzalloc(sizeof(*led) * pdata->num_leds, GFP_KERNEL);
+	if (led == NULL) {
+		dev_err(&pdev->dev, "failed to alloc memory\n");
+		return -ENOMEM;
+	}
+
+	ret = adp5520_led_prepare(pdev);
+
+	if (ret) {
+		dev_err(&pdev->dev, "failed to write\n");
+		goto err_free;
+	}
+
+	for (i = 0; i < pdata->num_leds; ++i) {
+		cur_led = &pdata->leds[i];
+		led_dat = &led[i];
+
+		led_dat->cdev.name = cur_led->name;
+		led_dat->cdev.default_trigger = cur_led->default_trigger;
+		led_dat->cdev.brightness_set = adp5520_led_set;
+		led_dat->cdev.brightness = LED_OFF;
+
+		if (cur_led->flags & ADP5520_FLAG_LED_MASK)
+			led_dat->flags = cur_led->flags;
+		else
+			led_dat->flags = i + 1;
+
+		led_dat->id = led_dat->flags & ADP5520_FLAG_LED_MASK;
+
+		led_dat->master = pdev->dev.parent;
+		led_dat->new_brightness = LED_OFF;
+
+		INIT_WORK(&led_dat->work, adp5520_led_work);
+
+		ret = led_classdev_register(led_dat->master, &led_dat->cdev);
+		if (ret) {
+			dev_err(&pdev->dev, "failed to register LED %d\n",
+				led_dat->id);
+			goto err;
+		}
+
+		ret = adp5520_led_setup(led_dat);
+		if (ret) {
+			dev_err(&pdev->dev, "failed to write\n");
+			i++;
+			goto err;
+		}
+	}
+
+	platform_set_drvdata(pdev, led);
+	return 0;
+
+err:
+	if (i > 0) {
+		for (i = i - 1; i >= 0; i--) {
+			led_classdev_unregister(&led[i].cdev);
+			cancel_work_sync(&led[i].work);
+		}
+	}
+
+err_free:
+	kfree(led);
+	return ret;
+}
+
+static int __devexit adp5520_led_remove(struct platform_device *pdev)
+{
+	struct adp5520_leds_platform_data *pdata = pdev->dev.platform_data;
+	struct adp5520_led *led;
+	int i;
+
+	led = platform_get_drvdata(pdev);
+
+	adp5520_clr_bits(led->master, ADP5520_LED_CONTROL,
+		 ADP5520_LED1_EN | ADP5520_LED2_EN | ADP5520_LED3_EN);
+
+	for (i = 0; i < pdata->num_leds; i++) {
+		led_classdev_unregister(&led[i].cdev);
+		cancel_work_sync(&led[i].work);
+	}
+
+	kfree(led);
+	return 0;
+}
+
+static struct platform_driver adp5520_led_driver = {
+	.driver	= {
+		.name	= "adp5520-led",
+		.owner	= THIS_MODULE,
+	},
+	.probe		= adp5520_led_probe,
+	.remove		= __devexit_p(adp5520_led_remove),
+};
+
+static int __init adp5520_led_init(void)
+{
+	return platform_driver_register(&adp5520_led_driver);
+}
+module_init(adp5520_led_init);
+
+static void __exit adp5520_led_exit(void)
+{
+	platform_driver_unregister(&adp5520_led_driver);
+}
+module_exit(adp5520_led_exit);
+
+MODULE_AUTHOR("Michael Hennerich <hennerich@blackfin.uclinux.org>");
+MODULE_DESCRIPTION("LEDS ADP5520(01) Driver");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:adp5520-led");
diff --git a/drivers/leds/leds-alix2.c b/drivers/leds/leds-alix2.c
index 731d4eef3425..f59ffadf5125 100644
--- a/drivers/leds/leds-alix2.c
+++ b/drivers/leds/leds-alix2.c
@@ -11,11 +11,24 @@
 #include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/string.h>
+#include <linux/pci.h>
 
 static int force = 0;
 module_param(force, bool, 0444);
 MODULE_PARM_DESC(force, "Assume system has ALIX.2/ALIX.3 style LEDs");
 
+#define MSR_LBAR_GPIO		0x5140000C
+#define CS5535_GPIO_SIZE	256
+
+static u32 gpio_base;
+
+static struct pci_device_id divil_pci[] = {
+	{ PCI_DEVICE(PCI_VENDOR_ID_NS,  PCI_DEVICE_ID_NS_CS5535_ISA) },
+	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_CS5536_ISA) },
+	{ } /* NULL entry */
+};
+MODULE_DEVICE_TABLE(pci, divil_pci);
+
 struct alix_led {
 	struct led_classdev cdev;
 	unsigned short port;
@@ -30,9 +43,9 @@ static void alix_led_set(struct led_classdev *led_cdev,
 		container_of(led_cdev, struct alix_led, cdev);
 
 	if (brightness)
-		outl(led_dev->on_value, led_dev->port);
+		outl(led_dev->on_value, gpio_base + led_dev->port);
 	else
-		outl(led_dev->off_value, led_dev->port);
+		outl(led_dev->off_value, gpio_base + led_dev->port);
 }
 
 static struct alix_led alix_leds[] = {
@@ -41,7 +54,7 @@ static struct alix_led alix_leds[] = {
 			.name = "alix:1",
 			.brightness_set = alix_led_set,
 		},
-		.port = 0x6100,
+		.port = 0x00,
 		.on_value = 1 << 22,
 		.off_value = 1 << 6,
 	},
@@ -50,7 +63,7 @@ static struct alix_led alix_leds[] = {
 			.name = "alix:2",
 			.brightness_set = alix_led_set,
 		},
-		.port = 0x6180,
+		.port = 0x80,
 		.on_value = 1 << 25,
 		.off_value = 1 << 9,
 	},
@@ -59,7 +72,7 @@ static struct alix_led alix_leds[] = {
 			.name = "alix:3",
 			.brightness_set = alix_led_set,
 		},
-		.port = 0x6180,
+		.port = 0x80,
 		.on_value = 1 << 27,
 		.off_value = 1 << 11,
 	},
@@ -101,64 +114,104 @@ static struct platform_driver alix_led_driver = {
 	},
 };
 
-static int __init alix_present(void)
+static int __init alix_present(unsigned long bios_phys,
+				const char *alix_sig,
+				size_t alix_sig_len)
 {
-	const unsigned long bios_phys = 0x000f0000;
 	const size_t bios_len = 0x00010000;
-	const char alix_sig[] = "PC Engines ALIX.";
-	const size_t alix_sig_len = sizeof(alix_sig) - 1;
-
 	const char *bios_virt;
 	const char *scan_end;
 	const char *p;
-	int ret = 0;
+	char name[64];
 
 	if (force) {
 		printk(KERN_NOTICE "%s: forced to skip BIOS test, "
 		       "assume system has ALIX.2 style LEDs\n",
 		       KBUILD_MODNAME);
-		ret = 1;
-		goto out;
+		return 1;
 	}
 
 	bios_virt = phys_to_virt(bios_phys);
 	scan_end = bios_virt + bios_len - (alix_sig_len + 2);
 	for (p = bios_virt; p < scan_end; p++) {
 		const char *tail;
+		char *a;
 
-		if (memcmp(p, alix_sig, alix_sig_len) != 0) {
+		if (memcmp(p, alix_sig, alix_sig_len) != 0)
 			continue;
-		}
+
+		memcpy(name, p, sizeof(name));
+
+		/* remove the first \0 character from string */
+		a = strchr(name, '\0');
+		if (a)
+			*a = ' ';
+
+		/* cut the string at a newline */
+		a = strchr(name, '\r');
+		if (a)
+			*a = '\0';
 
 		tail = p + alix_sig_len;
-		if ((tail[0] == '2' || tail[0] == '3') && tail[1] == '\0') {
+		if ((tail[0] == '2' || tail[0] == '3')) {
 			printk(KERN_INFO
 			       "%s: system is recognized as \"%s\"\n",
-			       KBUILD_MODNAME, p);
-			ret = 1;
-			break;
+			       KBUILD_MODNAME, name);
+			return 1;
 		}
 	}
 
-out:
-	return ret;
+	return 0;
 }
 
 static struct platform_device *pdev;
 
-static int __init alix_led_init(void)
+static int __init alix_pci_led_init(void)
 {
-	int ret;
+	u32 low, hi;
 
-	if (!alix_present()) {
-		ret = -ENODEV;
-		goto out;
+	if (pci_dev_present(divil_pci) == 0) {
+		printk(KERN_WARNING KBUILD_MODNAME": DIVIL not found\n");
+		return -ENODEV;
 	}
 
-	/* enable output on GPIO for LED 1,2,3 */
-	outl(1 << 6, 0x6104);
-	outl(1 << 9, 0x6184);
-	outl(1 << 11, 0x6184);
+	/* Grab the GPIO I/O range */
+	rdmsr(MSR_LBAR_GPIO, low, hi);
+
+	/* Check the mask and whether GPIO is enabled (sanity check) */
+	if (hi != 0x0000f001) {
+		printk(KERN_WARNING KBUILD_MODNAME": GPIO not enabled\n");
+		return -ENODEV;
+	}
+
+	/* Mask off the IO base address */
+	gpio_base = low & 0x0000ff00;
+
+	if (!request_region(gpio_base, CS5535_GPIO_SIZE, KBUILD_MODNAME)) {
+		printk(KERN_ERR KBUILD_MODNAME": can't allocate I/O for GPIO\n");
+		return -ENODEV;
+	}
+
+	/* Set GPIO function to output */
+	outl(1 << 6, gpio_base + 0x04);
+	outl(1 << 9, gpio_base + 0x84);
+	outl(1 << 11, gpio_base + 0x84);
+
+	return 0;
+}
+
+static int __init alix_led_init(void)
+{
+	int ret = -ENODEV;
+	const char tinybios_sig[] = "PC Engines ALIX.";
+	const char coreboot_sig[] = "PC Engines\0ALIX.";
+
+	if (alix_present(0xf0000, tinybios_sig, sizeof(tinybios_sig) - 1) ||
+	    alix_present(0x500, coreboot_sig, sizeof(coreboot_sig) - 1))
+		ret = alix_pci_led_init();
+
+	if (ret < 0)
+		return ret;
 
 	pdev = platform_device_register_simple(KBUILD_MODNAME, -1, NULL, 0);
 	if (!IS_ERR(pdev)) {
@@ -168,7 +221,6 @@ static int __init alix_led_init(void)
 	} else
 		ret = PTR_ERR(pdev);
 
-out:
 	return ret;
 }
 
@@ -176,6 +228,7 @@ static void __exit alix_led_exit(void)
 {
 	platform_device_unregister(pdev);
 	platform_driver_unregister(&alix_led_driver);
+	release_region(gpio_base, CS5535_GPIO_SIZE);
 }
 
 module_init(alix_led_init);
diff --git a/drivers/leds/leds-cobalt-qube.c b/drivers/leds/leds-cobalt-qube.c
index 8816806accd2..da5fb016b1a5 100644
--- a/drivers/leds/leds-cobalt-qube.c
+++ b/drivers/leds/leds-cobalt-qube.c
@@ -31,7 +31,7 @@ static struct led_classdev qube_front_led = {
 	.name			= "qube::front",
 	.brightness		= LED_FULL,
 	.brightness_set		= qube_front_led_set,
-	.default_trigger	= "ide-disk",
+	.default_trigger	= "default-on",
 };
 
 static int __devinit cobalt_qube_led_probe(struct platform_device *pdev)
@@ -43,7 +43,7 @@ static int __devinit cobalt_qube_led_probe(struct platform_device *pdev)
 	if (!res)
 		return -EBUSY;
 
-	led_port = ioremap(res->start, res->end - res->start + 1);
+	led_port = ioremap(res->start, resource_size(res));
 	if (!led_port)
 		return -ENOMEM;
 
diff --git a/drivers/leds/leds-cobalt-raq.c b/drivers/leds/leds-cobalt-raq.c
index defc212105f3..438d48384636 100644
--- a/drivers/leds/leds-cobalt-raq.c
+++ b/drivers/leds/leds-cobalt-raq.c
@@ -84,7 +84,7 @@ static int __devinit cobalt_raq_led_probe(struct platform_device *pdev)
 	if (!res)
 		return -EBUSY;
 
-	led_port = ioremap(res->start, res->end - res->start + 1);
+	led_port = ioremap(res->start, resource_size(res));
 	if (!led_port)
 		return -ENOMEM;
 
diff --git a/drivers/leds/leds-fsg.c b/drivers/leds/leds-fsg.c
index 5f7c9c5c09b1..d11d05be0dee 100644
--- a/drivers/leds/leds-fsg.c
+++ b/drivers/leds/leds-fsg.c
@@ -22,6 +22,13 @@
 #include <mach/hardware.h>
 #include <asm/io.h>
 
+#define FSG_LED_WLAN_BIT	0
+#define FSG_LED_WAN_BIT		1
+#define FSG_LED_SATA_BIT	2
+#define FSG_LED_USB_BIT		4
+#define FSG_LED_RING_BIT	5
+#define FSG_LED_SYNC_BIT	7
+
 static short __iomem *latch_address;
 static unsigned short latch_value;
 
diff --git a/drivers/leds/leds-lt3593.c b/drivers/leds/leds-lt3593.c
new file mode 100644
index 000000000000..fee40a841959
--- /dev/null
+++ b/drivers/leds/leds-lt3593.c
@@ -0,0 +1,217 @@
+/*
+ * LEDs driver for LT3593 controllers
+ *
+ * See the datasheet at http://cds.linear.com/docs/Datasheet/3593f.pdf
+ *
+ * Copyright (c) 2009 Daniel Mack <daniel@caiaq.de>
+ *
+ * Based on leds-gpio.c,
+ *
+ *   Copyright (C) 2007 8D Technologies inc.
+ *   Raphael Assenat <raph@8d.com>
+ *   Copyright (C) 2008 Freescale Semiconductor, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/platform_device.h>
+#include <linux/leds.h>
+#include <linux/workqueue.h>
+#include <linux/delay.h>
+#include <linux/gpio.h>
+
+struct lt3593_led_data {
+	struct led_classdev cdev;
+	unsigned gpio;
+	struct work_struct work;
+	u8 new_level;
+};
+
+static void lt3593_led_work(struct work_struct *work)
+{
+	int pulses;
+	struct lt3593_led_data *led_dat =
+		container_of(work, struct lt3593_led_data, work);
+
+	/*
+	 * The LT3593 resets its internal current level register to the maximum
+	 * level on the first falling edge on the control pin. Each following
+	 * falling edge decreases the current level by 625uA. Up to 32 pulses
+	 * can be sent, so the maximum power reduction is 20mA.
+	 * After a timeout of 128us, the value is taken from the register and
+	 * applied is to the output driver.
+	 */
+
+	if (led_dat->new_level == 0) {
+		gpio_set_value_cansleep(led_dat->gpio, 0);
+		return;
+	}
+
+	pulses = 32 - (led_dat->new_level * 32) / 255;
+
+	if (pulses == 0) {
+		gpio_set_value_cansleep(led_dat->gpio, 0);
+		mdelay(1);
+		gpio_set_value_cansleep(led_dat->gpio, 1);
+		return;
+	}
+
+	gpio_set_value_cansleep(led_dat->gpio, 1);
+
+	while (pulses--) {
+		gpio_set_value_cansleep(led_dat->gpio, 0);
+		udelay(1);
+		gpio_set_value_cansleep(led_dat->gpio, 1);
+		udelay(1);
+	}
+}
+
+static void lt3593_led_set(struct led_classdev *led_cdev,
+	enum led_brightness value)
+{
+	struct lt3593_led_data *led_dat =
+		container_of(led_cdev, struct lt3593_led_data, cdev);
+
+	led_dat->new_level = value;
+	schedule_work(&led_dat->work);
+}
+
+static int __devinit create_lt3593_led(const struct gpio_led *template,
+	struct lt3593_led_data *led_dat, struct device *parent)
+{
+	int ret, state;
+
+	/* skip leds on GPIOs that aren't available */
+	if (!gpio_is_valid(template->gpio)) {
+		printk(KERN_INFO "%s: skipping unavailable LT3593 LED at gpio %d (%s)\n",
+				KBUILD_MODNAME, template->gpio, template->name);
+		return 0;
+	}
+
+	ret = gpio_request(template->gpio, template->name);
+	if (ret < 0)
+		return ret;
+
+	led_dat->cdev.name = template->name;
+	led_dat->cdev.default_trigger = template->default_trigger;
+	led_dat->gpio = template->gpio;
+
+	led_dat->cdev.brightness_set = lt3593_led_set;
+
+	state = (template->default_state == LEDS_GPIO_DEFSTATE_ON);
+	led_dat->cdev.brightness = state ? LED_FULL : LED_OFF;
+
+	if (!template->retain_state_suspended)
+		led_dat->cdev.flags |= LED_CORE_SUSPENDRESUME;
+
+	ret = gpio_direction_output(led_dat->gpio, state);
+	if (ret < 0)
+		goto err;
+
+	INIT_WORK(&led_dat->work, lt3593_led_work);
+
+	ret = led_classdev_register(parent, &led_dat->cdev);
+	if (ret < 0)
+		goto err;
+
+	printk(KERN_INFO "%s: registered LT3593 LED '%s' at GPIO %d\n",
+		KBUILD_MODNAME, template->name, template->gpio);
+
+	return 0;
+
+err:
+	gpio_free(led_dat->gpio);
+	return ret;
+}
+
+static void delete_lt3593_led(struct lt3593_led_data *led)
+{
+	if (!gpio_is_valid(led->gpio))
+		return;
+
+	led_classdev_unregister(&led->cdev);
+	cancel_work_sync(&led->work);
+	gpio_free(led->gpio);
+}
+
+static int __devinit lt3593_led_probe(struct platform_device *pdev)
+{
+	struct gpio_led_platform_data *pdata = pdev->dev.platform_data;
+	struct lt3593_led_data *leds_data;
+	int i, ret = 0;
+
+	if (!pdata)
+		return -EBUSY;
+
+	leds_data = kzalloc(sizeof(struct lt3593_led_data) * pdata->num_leds,
+				GFP_KERNEL);
+	if (!leds_data)
+		return -ENOMEM;
+
+	for (i = 0; i < pdata->num_leds; i++) {
+		ret = create_lt3593_led(&pdata->leds[i], &leds_data[i],
+				      &pdev->dev);
+		if (ret < 0)
+			goto err;
+	}
+
+	platform_set_drvdata(pdev, leds_data);
+
+	return 0;
+
+err:
+	for (i = i - 1; i >= 0; i--)
+		delete_lt3593_led(&leds_data[i]);
+
+	kfree(leds_data);
+
+	return ret;
+}
+
+static int __devexit lt3593_led_remove(struct platform_device *pdev)
+{
+	int i;
+	struct gpio_led_platform_data *pdata = pdev->dev.platform_data;
+	struct lt3593_led_data *leds_data;
+
+	leds_data = platform_get_drvdata(pdev);
+
+	for (i = 0; i < pdata->num_leds; i++)
+		delete_lt3593_led(&leds_data[i]);
+
+	kfree(leds_data);
+
+	return 0;
+}
+
+static struct platform_driver lt3593_led_driver = {
+	.probe		= lt3593_led_probe,
+	.remove		= __devexit_p(lt3593_led_remove),
+	.driver		= {
+		.name	= "leds-lt3593",
+		.owner	= THIS_MODULE,
+	},
+};
+
+MODULE_ALIAS("platform:leds-lt3593");
+
+static int __init lt3593_led_init(void)
+{
+	return platform_driver_register(&lt3593_led_driver);
+}
+
+static void __exit lt3593_led_exit(void)
+{
+	platform_driver_unregister(&lt3593_led_driver);
+}
+
+module_init(lt3593_led_init);
+module_exit(lt3593_led_exit);
+
+MODULE_AUTHOR("Daniel Mack <daniel@caiaq.de>");
+MODULE_DESCRIPTION("LED driver for LT3593 controllers");
+MODULE_LICENSE("GPL");
diff --git a/drivers/leds/leds-pwm.c b/drivers/leds/leds-pwm.c
index cdfdc8714e10..88b1dd091cfb 100644
--- a/drivers/leds/leds-pwm.c
+++ b/drivers/leds/leds-pwm.c
@@ -27,7 +27,6 @@ struct led_pwm_data {
 	struct pwm_device	*pwm;
 	unsigned int 		active_low;
 	unsigned int		period;
-	unsigned int		max_brightness;
 };
 
 static void led_pwm_set(struct led_classdev *led_cdev,
@@ -35,7 +34,7 @@ static void led_pwm_set(struct led_classdev *led_cdev,
 {
 	struct led_pwm_data *led_dat =
 		container_of(led_cdev, struct led_pwm_data, cdev);
-	unsigned int max = led_dat->max_brightness;
+	unsigned int max = led_dat->cdev.max_brightness;
 	unsigned int period =  led_dat->period;
 
 	if (brightness == 0) {
@@ -77,10 +76,10 @@ static int led_pwm_probe(struct platform_device *pdev)
 		led_dat->cdev.name = cur_led->name;
 		led_dat->cdev.default_trigger = cur_led->default_trigger;
 		led_dat->active_low = cur_led->active_low;
-		led_dat->max_brightness = cur_led->max_brightness;
 		led_dat->period = cur_led->pwm_period_ns;
 		led_dat->cdev.brightness_set = led_pwm_set;
 		led_dat->cdev.brightness = LED_OFF;
+		led_dat->cdev.max_brightness = cur_led->max_brightness;
 		led_dat->cdev.flags |= LED_CORE_SUSPENDRESUME;
 
 		ret = led_classdev_register(&pdev->dev, &led_dat->cdev);
diff --git a/drivers/leds/leds-regulator.c b/drivers/leds/leds-regulator.c
new file mode 100644
index 000000000000..7f00de3ef922
--- /dev/null
+++ b/drivers/leds/leds-regulator.c
@@ -0,0 +1,242 @@
+/*
+ * leds-regulator.c - LED class driver for regulator driven LEDs.
+ *
+ * Copyright (C) 2009 Antonio Ospite <ospite@studenti.unina.it>
+ *
+ * Inspired by leds-wm8350 driver.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/err.h>
+#include <linux/workqueue.h>
+#include <linux/leds.h>
+#include <linux/leds-regulator.h>
+#include <linux/platform_device.h>
+#include <linux/regulator/consumer.h>
+
+#define to_regulator_led(led_cdev) \
+	container_of(led_cdev, struct regulator_led, cdev)
+
+struct regulator_led {
+	struct led_classdev cdev;
+	enum led_brightness value;
+	int enabled;
+	struct mutex mutex;
+	struct work_struct work;
+
+	struct regulator *vcc;
+};
+
+static inline int led_regulator_get_max_brightness(struct regulator *supply)
+{
+	int ret;
+	int voltage = regulator_list_voltage(supply, 0);
+
+	if (voltage <= 0)
+		return 1;
+
+	/* even if regulator can't change voltages,
+	 * we still assume it can change status
+	 * and the LED can be turned on and off.
+	 */
+	ret = regulator_set_voltage(supply, voltage, voltage);
+	if (ret < 0)
+		return 1;
+
+	return regulator_count_voltages(supply);
+}
+
+static int led_regulator_get_voltage(struct regulator *supply,
+		enum led_brightness brightness)
+{
+	if (brightness == 0)
+		return -EINVAL;
+
+	return regulator_list_voltage(supply, brightness - 1);
+}
+
+
+static void regulator_led_enable(struct regulator_led *led)
+{
+	int ret;
+
+	if (led->enabled)
+		return;
+
+	ret = regulator_enable(led->vcc);
+	if (ret != 0) {
+		dev_err(led->cdev.dev, "Failed to enable vcc: %d\n", ret);
+		return;
+	}
+
+	led->enabled = 1;
+}
+
+static void regulator_led_disable(struct regulator_led *led)
+{
+	int ret;
+
+	if (!led->enabled)
+		return;
+
+	ret = regulator_disable(led->vcc);
+	if (ret != 0) {
+		dev_err(led->cdev.dev, "Failed to disable vcc: %d\n", ret);
+		return;
+	}
+
+	led->enabled = 0;
+}
+
+static void regulator_led_set_value(struct regulator_led *led)
+{
+	int voltage;
+	int ret;
+
+	mutex_lock(&led->mutex);
+
+	if (led->value == LED_OFF) {
+		regulator_led_disable(led);
+		goto out;
+	}
+
+	if (led->cdev.max_brightness > 1) {
+		voltage = led_regulator_get_voltage(led->vcc, led->value);
+		dev_dbg(led->cdev.dev, "brightness: %d voltage: %d\n",
+				led->value, voltage);
+
+		ret = regulator_set_voltage(led->vcc, voltage, voltage);
+		if (ret != 0)
+			dev_err(led->cdev.dev, "Failed to set voltage %d: %d\n",
+				voltage, ret);
+	}
+
+	regulator_led_enable(led);
+
+out:
+	mutex_unlock(&led->mutex);
+}
+
+static void led_work(struct work_struct *work)
+{
+	struct regulator_led *led;
+
+	led = container_of(work, struct regulator_led, work);
+	regulator_led_set_value(led);
+}
+
+static void regulator_led_brightness_set(struct led_classdev *led_cdev,
+			   enum led_brightness value)
+{
+	struct regulator_led *led = to_regulator_led(led_cdev);
+
+	led->value = value;
+	schedule_work(&led->work);
+}
+
+static int __devinit regulator_led_probe(struct platform_device *pdev)
+{
+	struct led_regulator_platform_data *pdata = pdev->dev.platform_data;
+	struct regulator_led *led;
+	struct regulator *vcc;
+	int ret = 0;
+
+	if (pdata == NULL) {
+		dev_err(&pdev->dev, "no platform data\n");
+		return -ENODEV;
+	}
+
+	vcc = regulator_get_exclusive(&pdev->dev, "vled");
+	if (IS_ERR(vcc)) {
+		dev_err(&pdev->dev, "Cannot get vcc for %s\n", pdata->name);
+		return PTR_ERR(vcc);
+	}
+
+	led = kzalloc(sizeof(*led), GFP_KERNEL);
+	if (led == NULL) {
+		ret = -ENOMEM;
+		goto err_vcc;
+	}
+
+	led->cdev.max_brightness = led_regulator_get_max_brightness(vcc);
+	if (pdata->brightness > led->cdev.max_brightness) {
+		dev_err(&pdev->dev, "Invalid default brightness %d\n",
+				pdata->brightness);
+		ret = -EINVAL;
+		goto err_led;
+	}
+	led->value = pdata->brightness;
+
+	led->cdev.brightness_set = regulator_led_brightness_set;
+	led->cdev.name = pdata->name;
+	led->cdev.flags |= LED_CORE_SUSPENDRESUME;
+	led->vcc = vcc;
+
+	mutex_init(&led->mutex);
+	INIT_WORK(&led->work, led_work);
+
+	platform_set_drvdata(pdev, led);
+
+	ret = led_classdev_register(&pdev->dev, &led->cdev);
+	if (ret < 0) {
+		cancel_work_sync(&led->work);
+		goto err_led;
+	}
+
+	/* to expose the default value to userspace */
+	led->cdev.brightness = led->value;
+
+	/* Set the default led status */
+	regulator_led_set_value(led);
+
+	return 0;
+
+err_led:
+	kfree(led);
+err_vcc:
+	regulator_put(vcc);
+	return ret;
+}
+
+static int __devexit regulator_led_remove(struct platform_device *pdev)
+{
+	struct regulator_led *led = platform_get_drvdata(pdev);
+
+	led_classdev_unregister(&led->cdev);
+	cancel_work_sync(&led->work);
+	regulator_led_disable(led);
+	regulator_put(led->vcc);
+	kfree(led);
+	return 0;
+}
+
+static struct platform_driver regulator_led_driver = {
+	.driver = {
+		   .name  = "leds-regulator",
+		   .owner = THIS_MODULE,
+		   },
+	.probe  = regulator_led_probe,
+	.remove = __devexit_p(regulator_led_remove),
+};
+
+static int __init regulator_led_init(void)
+{
+	return platform_driver_register(&regulator_led_driver);
+}
+module_init(regulator_led_init);
+
+static void __exit regulator_led_exit(void)
+{
+	platform_driver_unregister(&regulator_led_driver);
+}
+module_exit(regulator_led_exit);
+
+MODULE_AUTHOR("Antonio Ospite <ospite@studenti.unina.it>");
+MODULE_DESCRIPTION("Regulator driven LED driver");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:leds-regulator");
diff --git a/drivers/leds/leds-ss4200.c b/drivers/leds/leds-ss4200.c
new file mode 100644
index 000000000000..97f04984c1ca
--- /dev/null
+++ b/drivers/leds/leds-ss4200.c
@@ -0,0 +1,556 @@
+/*
+ * SS4200-E Hardware API
+ * Copyright (c) 2009, Intel Corporation.
+ * Copyright IBM Corporation, 2009
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Author: Dave Hansen <dave@sr71.net>
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/dmi.h>
+#include <linux/init.h>
+#include <linux/ioport.h>
+#include <linux/kernel.h>
+#include <linux/leds.h>
+#include <linux/module.h>
+#include <linux/pci.h>
+#include <linux/types.h>
+#include <linux/uaccess.h>
+
+MODULE_AUTHOR("Rodney Girod <rgirod@confocus.com>, Dave Hansen <dave@sr71.net>");
+MODULE_DESCRIPTION("Intel NAS/Home Server ICH7 GPIO Driver");
+MODULE_LICENSE("GPL");
+
+/*
+ * ICH7 LPC/GPIO PCI Config register offsets
+ */
+#define PMBASE		0x040
+#define GPIO_BASE	0x048
+#define GPIO_CTRL	0x04c
+#define GPIO_EN		0x010
+
+/*
+ * The ICH7 GPIO register block is 64 bytes in size.
+ */
+#define ICH7_GPIO_SIZE	64
+
+/*
+ * Define register offsets within the ICH7 register block.
+ */
+#define GPIO_USE_SEL	0x000
+#define GP_IO_SEL	0x004
+#define GP_LVL		0x00c
+#define GPO_BLINK	0x018
+#define GPI_INV		0x030
+#define GPIO_USE_SEL2	0x034
+#define GP_IO_SEL2	0x038
+#define GP_LVL2		0x03c
+
+/*
+ * PCI ID of the Intel ICH7 LPC Device within which the GPIO block lives.
+ */
+static struct pci_device_id ich7_lpc_pci_id[] =
+{
+	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICH7_0) },
+	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICH7_1) },
+	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICH7_30) },
+	{ } /* NULL entry */
+};
+
+MODULE_DEVICE_TABLE(pci, ich7_lpc_pci_id);
+
+static int __init ss4200_led_dmi_callback(const struct dmi_system_id *id)
+{
+	pr_info("detected '%s'\n", id->ident);
+	return 1;
+}
+
+static unsigned int __initdata nodetect;
+module_param_named(nodetect, nodetect, bool, 0);
+MODULE_PARM_DESC(nodetect, "Skip DMI-based hardware detection");
+
+/*
+ * struct nas_led_whitelist - List of known good models
+ *
+ * Contains the known good models this driver is compatible with.
+ * When adding a new model try to be as strict as possible. This
+ * makes it possible to keep the false positives (the model is
+ * detected as working, but in reality it is not) as low as
+ * possible.
+ */
+static struct dmi_system_id __initdata nas_led_whitelist[] = {
+	{
+		.callback = ss4200_led_dmi_callback,
+		.ident = "Intel SS4200-E",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Intel"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "SS4200-E"),
+			DMI_MATCH(DMI_PRODUCT_VERSION, "1.00.00")
+		}
+	},
+};
+
+/*
+ * Base I/O address assigned to the Power Management register block
+ */
+static u32 g_pm_io_base;
+
+/*
+ * Base I/O address assigned to the ICH7 GPIO register block
+ */
+static u32 nas_gpio_io_base;
+
+/*
+ * When we successfully register a region, we are returned a resource.
+ * We use these to identify which regions we need to release on our way
+ * back out.
+ */
+static struct resource *gp_gpio_resource;
+
+struct nasgpio_led {
+	char *name;
+	u32 gpio_bit;
+	struct led_classdev led_cdev;
+};
+
+/*
+ * gpio_bit(s) are the ICH7 GPIO bit assignments
+ */
+static struct nasgpio_led nasgpio_leds[] = {
+	{ .name = "hdd1:blue:sata",	.gpio_bit = 0 },
+	{ .name = "hdd1:amber:sata",	.gpio_bit = 1 },
+	{ .name = "hdd2:blue:sata",	.gpio_bit = 2 },
+	{ .name = "hdd2:amber:sata",	.gpio_bit = 3 },
+	{ .name = "hdd3:blue:sata",	.gpio_bit = 4 },
+	{ .name = "hdd3:amber:sata",	.gpio_bit = 5 },
+	{ .name = "hdd4:blue:sata",	.gpio_bit = 6 },
+	{ .name = "hdd4:amber:sata",	.gpio_bit = 7 },
+	{ .name = "power:blue:power",	.gpio_bit = 27},
+	{ .name = "power:amber:power",  .gpio_bit = 28},
+};
+
+#define NAS_RECOVERY	0x00000400	/* GPIO10 */
+
+static struct nasgpio_led *
+led_classdev_to_nasgpio_led(struct led_classdev *led_cdev)
+{
+	return container_of(led_cdev, struct nasgpio_led, led_cdev);
+}
+
+static struct nasgpio_led *get_led_named(char *name)
+{
+	int i;
+	for (i = 0; i < ARRAY_SIZE(nasgpio_leds); i++) {
+		if (strcmp(nasgpio_leds[i].name, name))
+			continue;
+		return &nasgpio_leds[i];
+	}
+	return NULL;
+}
+
+/*
+ * This protects access to the gpio ports.
+ */
+static DEFINE_SPINLOCK(nasgpio_gpio_lock);
+
+/*
+ * There are two gpio ports, one for blinking and the other
+ * for power.  @port tells us if we're doing blinking or
+ * power control.
+ *
+ * Caller must hold nasgpio_gpio_lock
+ */
+static void __nasgpio_led_set_attr(struct led_classdev *led_cdev,
+				   u32 port, u32 value)
+{
+	struct nasgpio_led *led = led_classdev_to_nasgpio_led(led_cdev);
+	u32 gpio_out;
+
+	gpio_out = inl(nas_gpio_io_base + port);
+	if (value)
+		gpio_out |= (1<<led->gpio_bit);
+	else
+		gpio_out &= ~(1<<led->gpio_bit);
+
+	outl(gpio_out, nas_gpio_io_base + port);
+}
+
+static void nasgpio_led_set_attr(struct led_classdev *led_cdev,
+				 u32 port, u32 value)
+{
+	spin_lock(&nasgpio_gpio_lock);
+	__nasgpio_led_set_attr(led_cdev, port, value);
+	spin_unlock(&nasgpio_gpio_lock);
+}
+
+u32 nasgpio_led_get_attr(struct led_classdev *led_cdev, u32 port)
+{
+	struct nasgpio_led *led = led_classdev_to_nasgpio_led(led_cdev);
+	u32 gpio_in;
+
+	spin_lock(&nasgpio_gpio_lock);
+	gpio_in = inl(nas_gpio_io_base + port);
+	spin_unlock(&nasgpio_gpio_lock);
+	if (gpio_in & (1<<led->gpio_bit))
+		return 1;
+	return 0;
+}
+
+/*
+ * There is actual brightness control in the hardware,
+ * but it is via smbus commands and not implemented
+ * in this driver.
+ */
+static void nasgpio_led_set_brightness(struct led_classdev *led_cdev,
+				       enum led_brightness brightness)
+{
+	u32 setting = 0;
+	if (brightness >= LED_HALF)
+		setting = 1;
+	/*
+	 * Hold the lock across both operations.  This ensures
+	 * consistency so that both the "turn off blinking"
+	 * and "turn light off" operations complete as a set.
+	 */
+	spin_lock(&nasgpio_gpio_lock);
+	/*
+	 * LED class documentation asks that past blink state
+	 * be disabled when brightness is turned to zero.
+	 */
+	if (brightness == 0)
+		__nasgpio_led_set_attr(led_cdev, GPO_BLINK, 0);
+	__nasgpio_led_set_attr(led_cdev, GP_LVL, setting);
+	spin_unlock(&nasgpio_gpio_lock);
+}
+
+static int nasgpio_led_set_blink(struct led_classdev *led_cdev,
+				 unsigned long *delay_on,
+				 unsigned long *delay_off)
+{
+	u32 setting = 1;
+	if (!(*delay_on == 0 && *delay_off == 0) &&
+	    !(*delay_on == 500 && *delay_off == 500))
+		return -EINVAL;
+	/*
+	 * These are very approximate.
+	 */
+	*delay_on = 500;
+	*delay_off = 500;
+
+	nasgpio_led_set_attr(led_cdev, GPO_BLINK, setting);
+
+	return 0;
+}
+
+
+/*
+ * Initialize the ICH7 GPIO registers for NAS usage.  The BIOS should have
+ * already taken care of this, but we will do so in a non destructive manner
+ * so that we have what we need whether the BIOS did it or not.
+ */
+static int __devinit ich7_gpio_init(struct device *dev)
+{
+	int i;
+	u32 config_data = 0;
+	u32 all_nas_led = 0;
+
+	for (i = 0; i < ARRAY_SIZE(nasgpio_leds); i++)
+		all_nas_led |= (1<<nasgpio_leds[i].gpio_bit);
+
+	spin_lock(&nasgpio_gpio_lock);
+	/*
+	 * We need to enable all of the GPIO lines used by the NAS box,
+	 * so we will read the current Use Selection and add our usage
+	 * to it.  This should be benign with regard to the original
+	 * BIOS configuration.
+	 */
+	config_data = inl(nas_gpio_io_base + GPIO_USE_SEL);
+	dev_dbg(dev, ": Data read from GPIO_USE_SEL = 0x%08x\n", config_data);
+	config_data |= all_nas_led + NAS_RECOVERY;
+	outl(config_data, nas_gpio_io_base + GPIO_USE_SEL);
+	config_data = inl(nas_gpio_io_base + GPIO_USE_SEL);
+	dev_dbg(dev, ": GPIO_USE_SEL = 0x%08x\n\n", config_data);
+
+	/*
+	 * The LED GPIO outputs need to be configured for output, so we
+	 * will ensure that all LED lines are cleared for output and the
+	 * RECOVERY line ready for input.  This too should be benign with
+	 * regard to BIOS configuration.
+	 */
+	config_data = inl(nas_gpio_io_base + GP_IO_SEL);
+	dev_dbg(dev, ": Data read from GP_IO_SEL = 0x%08x\n",
+					config_data);
+	config_data &= ~all_nas_led;
+	config_data |= NAS_RECOVERY;
+	outl(config_data, nas_gpio_io_base + GP_IO_SEL);
+	config_data = inl(nas_gpio_io_base + GP_IO_SEL);
+	dev_dbg(dev, ": GP_IO_SEL = 0x%08x\n", config_data);
+
+	/*
+	 * In our final system, the BIOS will initialize the state of all
+	 * of the LEDs.  For now, we turn them all off (or Low).
+	 */
+	config_data = inl(nas_gpio_io_base + GP_LVL);
+	dev_dbg(dev, ": Data read from GP_LVL = 0x%08x\n", config_data);
+	/*
+	 * In our final system, the BIOS will initialize the blink state of all
+	 * of the LEDs.  For now, we turn blink off for all of them.
+	 */
+	config_data = inl(nas_gpio_io_base + GPO_BLINK);
+	dev_dbg(dev, ": Data read from GPO_BLINK = 0x%08x\n", config_data);
+
+	/*
+	 * At this moment, I am unsure if anything needs to happen with GPI_INV
+	 */
+	config_data = inl(nas_gpio_io_base + GPI_INV);
+	dev_dbg(dev, ": Data read from GPI_INV = 0x%08x\n", config_data);
+
+	spin_unlock(&nasgpio_gpio_lock);
+	return 0;
+}
+
+static void ich7_lpc_cleanup(struct device *dev)
+{
+	/*
+	 * If we were given exclusive use of the GPIO
+	 * I/O Address range, we must return it.
+	 */
+	if (gp_gpio_resource) {
+		dev_dbg(dev, ": Releasing GPIO I/O addresses\n");
+		release_region(nas_gpio_io_base, ICH7_GPIO_SIZE);
+		gp_gpio_resource = NULL;
+	}
+}
+
+/*
+ * The OS has determined that the LPC of the Intel ICH7 Southbridge is present
+ * so we can retrive the required operational information and prepare the GPIO.
+ */
+static struct pci_dev *nas_gpio_pci_dev;
+static int __devinit ich7_lpc_probe(struct pci_dev *dev,
+				    const struct pci_device_id *id)
+{
+	int status;
+	u32 gc = 0;
+
+	status = pci_enable_device(dev);
+	if (status) {
+		dev_err(&dev->dev, "pci_enable_device failed\n");
+		return -EIO;
+	}
+
+	nas_gpio_pci_dev = dev;
+	status = pci_read_config_dword(dev, PMBASE, &g_pm_io_base);
+	if (status)
+		goto out;
+	g_pm_io_base &= 0x00000ff80;
+
+	status = pci_read_config_dword(dev, GPIO_CTRL, &gc);
+	if (!(GPIO_EN & gc)) {
+		status = -EEXIST;
+		dev_info(&dev->dev,
+			   "ERROR: The LPC GPIO Block has not been enabled.\n");
+		goto out;
+	}
+
+	status = pci_read_config_dword(dev, GPIO_BASE, &nas_gpio_io_base);
+	if (0 > status) {
+		dev_info(&dev->dev, "Unable to read GPIOBASE.\n");
+		goto out;
+	}
+	dev_dbg(&dev->dev, ": GPIOBASE = 0x%08x\n", nas_gpio_io_base);
+	nas_gpio_io_base &= 0x00000ffc0;
+
+	/*
+	 * Insure that we have exclusive access to the GPIO I/O address range.
+	 */
+	gp_gpio_resource = request_region(nas_gpio_io_base, ICH7_GPIO_SIZE,
+					  KBUILD_MODNAME);
+	if (NULL == gp_gpio_resource) {
+		dev_info(&dev->dev,
+			 "ERROR Unable to register GPIO I/O addresses.\n");
+		status = -1;
+		goto out;
+	}
+
+	/*
+	 * Initialize the GPIO for NAS/Home Server Use
+	 */
+	ich7_gpio_init(&dev->dev);
+
+out:
+	if (status) {
+		ich7_lpc_cleanup(&dev->dev);
+		pci_disable_device(dev);
+	}
+	return status;
+}
+
+static void ich7_lpc_remove(struct pci_dev *dev)
+{
+	ich7_lpc_cleanup(&dev->dev);
+	pci_disable_device(dev);
+}
+
+/*
+ * pci_driver structure passed to the PCI modules
+ */
+static struct pci_driver nas_gpio_pci_driver = {
+	.name = KBUILD_MODNAME,
+	.id_table = ich7_lpc_pci_id,
+	.probe = ich7_lpc_probe,
+	.remove = ich7_lpc_remove,
+};
+
+static struct led_classdev *get_classdev_for_led_nr(int nr)
+{
+	struct nasgpio_led *nas_led = &nasgpio_leds[nr];
+	struct led_classdev *led = &nas_led->led_cdev;
+	return led;
+}
+
+
+static void set_power_light_amber_noblink(void)
+{
+	struct nasgpio_led *amber = get_led_named("power:amber:power");
+	struct nasgpio_led *blue = get_led_named("power:blue:power");
+
+	if (!amber || !blue)
+		return;
+	/*
+	 * LED_OFF implies disabling future blinking
+	 */
+	pr_debug("setting blue off and amber on\n");
+
+	nasgpio_led_set_brightness(&blue->led_cdev, LED_OFF);
+	nasgpio_led_set_brightness(&amber->led_cdev, LED_FULL);
+}
+
+static ssize_t nas_led_blink_show(struct device *dev,
+				  struct device_attribute *attr, char *buf)
+{
+	struct led_classdev *led = dev_get_drvdata(dev);
+	int blinking = 0;
+	if (nasgpio_led_get_attr(led, GPO_BLINK))
+		blinking = 1;
+	return sprintf(buf, "%u\n", blinking);
+}
+
+static ssize_t nas_led_blink_store(struct device *dev,
+				   struct device_attribute *attr,
+				   const char *buf, size_t size)
+{
+	int ret;
+	struct led_classdev *led = dev_get_drvdata(dev);
+	unsigned long blink_state;
+
+	ret = strict_strtoul(buf, 10, &blink_state);
+	if (ret)
+		return ret;
+
+	nasgpio_led_set_attr(led, GPO_BLINK, blink_state);
+
+	return size;
+}
+
+static DEVICE_ATTR(blink, 0644, nas_led_blink_show, nas_led_blink_store);
+
+static int register_nasgpio_led(int led_nr)
+{
+	int ret;
+	struct nasgpio_led *nas_led = &nasgpio_leds[led_nr];
+	struct led_classdev *led = get_classdev_for_led_nr(led_nr);
+
+	led->name = nas_led->name;
+	led->brightness = LED_OFF;
+	if (nasgpio_led_get_attr(led, GP_LVL))
+		led->brightness = LED_FULL;
+	led->brightness_set = nasgpio_led_set_brightness;
+	led->blink_set = nasgpio_led_set_blink;
+	ret = led_classdev_register(&nas_gpio_pci_dev->dev, led);
+	if (ret)
+		return ret;
+	ret = device_create_file(led->dev, &dev_attr_blink);
+	if (ret)
+		led_classdev_unregister(led);
+	return ret;
+}
+
+static void unregister_nasgpio_led(int led_nr)
+{
+	struct led_classdev *led = get_classdev_for_led_nr(led_nr);
+	led_classdev_unregister(led);
+	device_remove_file(led->dev, &dev_attr_blink);
+}
+/*
+ * module load/initialization
+ */
+static int __init nas_gpio_init(void)
+{
+	int i;
+	int ret = 0;
+	int nr_devices = 0;
+
+	nr_devices = dmi_check_system(nas_led_whitelist);
+	if (nodetect) {
+		pr_info("skipping hardware autodetection\n");
+		pr_info("Please send 'dmidecode' output to dave@sr71.net\n");
+		nr_devices++;
+	}
+
+	if (nr_devices <= 0) {
+		pr_info("no LED devices found\n");
+		return -ENODEV;
+	}
+
+	pr_info("registering PCI driver\n");
+	ret = pci_register_driver(&nas_gpio_pci_driver);
+	if (ret)
+		return ret;
+	for (i = 0; i < ARRAY_SIZE(nasgpio_leds); i++) {
+		ret = register_nasgpio_led(i);
+		if (ret)
+			goto out_err;
+	}
+	/*
+	 * When the system powers on, the BIOS leaves the power
+	 * light blue and blinking.  This will turn it solid
+	 * amber once the driver is loaded.
+	 */
+	set_power_light_amber_noblink();
+	return 0;
+out_err:
+	for (; i >= 0; i--)
+		unregister_nasgpio_led(i);
+	pci_unregister_driver(&nas_gpio_pci_driver);
+	return ret;
+}
+
+/*
+ * module unload
+ */
+static void __exit nas_gpio_exit(void)
+{
+	int i;
+	pr_info("Unregistering driver\n");
+	for (i = 0; i < ARRAY_SIZE(nasgpio_leds); i++)
+		unregister_nasgpio_led(i);
+	pci_unregister_driver(&nas_gpio_pci_driver);
+}
+
+module_init(nas_gpio_init);
+module_exit(nas_gpio_exit);
diff --git a/drivers/leds/ledtrig-timer.c b/drivers/leds/ledtrig-timer.c
index 3b83406de752..38b3378be442 100644
--- a/drivers/leds/ledtrig-timer.c
+++ b/drivers/leds/ledtrig-timer.c
@@ -83,7 +83,7 @@ static ssize_t led_delay_on_store(struct device *dev,
 	unsigned long state = simple_strtoul(buf, &after, 10);
 	size_t count = after - buf;
 
-	if (*after && isspace(*after))
+	if (isspace(*after))
 		count++;
 
 	if (count == size) {
@@ -127,7 +127,7 @@ static ssize_t led_delay_off_store(struct device *dev,
 	unsigned long state = simple_strtoul(buf, &after, 10);
 	size_t count = after - buf;
 
-	if (*after && isspace(*after))
+	if (isspace(*after))
 		count++;
 
 	if (count == size) {
diff --git a/drivers/lguest/segments.c b/drivers/lguest/segments.c
index 951c57b0a7e0..ede46581351a 100644
--- a/drivers/lguest/segments.c
+++ b/drivers/lguest/segments.c
@@ -179,8 +179,10 @@ void load_guest_gdt_entry(struct lg_cpu *cpu, u32 num, u32 lo, u32 hi)
 	 * We assume the Guest has the same number of GDT entries as the
 	 * Host, otherwise we'd have to dynamically allocate the Guest GDT.
 	 */
-	if (num >= ARRAY_SIZE(cpu->arch.gdt))
+	if (num >= ARRAY_SIZE(cpu->arch.gdt)) {
 		kill_guest(cpu, "too many gdt entries %i", num);
+		return;
+	}
 
 	/* Set it up, then fix it. */
 	cpu->arch.gdt[num].a = lo;
diff --git a/drivers/lguest/x86/core.c b/drivers/lguest/x86/core.c
index 6ae388849a3b..fb2b7ef7868e 100644
--- a/drivers/lguest/x86/core.c
+++ b/drivers/lguest/x86/core.c
@@ -69,7 +69,7 @@ static struct lguest_pages *lguest_pages(unsigned int cpu)
 		  (SWITCHER_ADDR + SHARED_SWITCHER_PAGES*PAGE_SIZE))[cpu]);
 }
 
-static DEFINE_PER_CPU(struct lg_cpu *, last_cpu);
+static DEFINE_PER_CPU(struct lg_cpu *, lg_last_cpu);
 
 /*S:010
  * We approach the Switcher.
@@ -90,8 +90,8 @@ static void copy_in_guest_info(struct lg_cpu *cpu, struct lguest_pages *pages)
 	 * meanwhile).  If that's not the case, we pretend everything in the
 	 * Guest has changed.
 	 */
-	if (__get_cpu_var(last_cpu) != cpu || cpu->last_pages != pages) {
-		__get_cpu_var(last_cpu) = cpu;
+	if (__get_cpu_var(lg_last_cpu) != cpu || cpu->last_pages != pages) {
+		__get_cpu_var(lg_last_cpu) = cpu;
 		cpu->last_pages = pages;
 		cpu->changed = CHANGED_ALL;
 	}
diff --git a/drivers/macintosh/ans-lcd.c b/drivers/macintosh/ans-lcd.c
index 6a8221893256..a3d25da2f275 100644
--- a/drivers/macintosh/ans-lcd.c
+++ b/drivers/macintosh/ans-lcd.c
@@ -3,7 +3,6 @@
  */
 
 #include <linux/types.h>
-#include <linux/smp_lock.h>
 #include <linux/errno.h>
 #include <linux/kernel.h>
 #include <linux/miscdevice.h>
@@ -26,6 +25,7 @@
 static unsigned long anslcd_short_delay = 80;
 static unsigned long anslcd_long_delay = 3280;
 static volatile unsigned char __iomem *anslcd_ptr;
+static DEFINE_MUTEX(anslcd_mutex);
 
 #undef DEBUG
 
@@ -65,26 +65,31 @@ anslcd_write( struct file * file, const char __user * buf,
 
 	if (!access_ok(VERIFY_READ, buf, count))
 		return -EFAULT;
+
+	mutex_lock(&anslcd_mutex);
 	for ( i = *ppos; count > 0; ++i, ++p, --count ) 
 	{
 		char c;
 		__get_user(c, p);
 		anslcd_write_byte_data( c );
 	}
+	mutex_unlock(&anslcd_mutex);
 	*ppos = i;
 	return p - buf;
 }
 
-static int
-anslcd_ioctl( struct inode * inode, struct file * file,
-				unsigned int cmd, unsigned long arg )
+static long
+anslcd_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
 	char ch, __user *temp;
+	long ret = 0;
 
 #ifdef DEBUG
 	printk(KERN_DEBUG "LCD: ioctl(%d,%d)\n",cmd,arg);
 #endif
 
+	mutex_lock(&anslcd_mutex);
+
 	switch ( cmd )
 	{
 	case ANSLCD_CLEAR:
@@ -93,7 +98,7 @@ anslcd_ioctl( struct inode * inode, struct file * file,
 		anslcd_write_byte_ctrl ( 0x06 );
 		anslcd_write_byte_ctrl ( 0x01 );
 		anslcd_write_byte_ctrl ( 0x02 );
-		return 0;
+		break;
 	case ANSLCD_SENDCTRL:
 		temp = (char __user *) arg;
 		__get_user(ch, temp);
@@ -101,33 +106,37 @@ anslcd_ioctl( struct inode * inode, struct file * file,
 			anslcd_write_byte_ctrl ( ch );
 			__get_user(ch, temp);
 		}
-		return 0;
+		break;
 	case ANSLCD_SETSHORTDELAY:
 		if (!capable(CAP_SYS_ADMIN))
-			return -EACCES;
-		anslcd_short_delay=arg;
-		return 0;
+			ret =-EACCES;
+		else
+			anslcd_short_delay=arg;
+		break;
 	case ANSLCD_SETLONGDELAY:
 		if (!capable(CAP_SYS_ADMIN))
-			return -EACCES;
-		anslcd_long_delay=arg;
-		return 0;
+			ret = -EACCES;
+		else
+			anslcd_long_delay=arg;
+		break;
 	default:
-		return -EINVAL;
+		ret = -EINVAL;
 	}
+
+	mutex_unlock(&anslcd_mutex);
+	return ret;
 }
 
 static int
 anslcd_open( struct inode * inode, struct file * file )
 {
-	cycle_kernel_lock();
 	return 0;
 }
 
 const struct file_operations anslcd_fops = {
-	.write	= anslcd_write,
-	.ioctl	= anslcd_ioctl,
-	.open	= anslcd_open,
+	.write		= anslcd_write,
+	.unlocked_ioctl	= anslcd_ioctl,
+	.open		= anslcd_open,
 };
 
 static struct miscdevice anslcd_dev = {
@@ -168,6 +177,7 @@ anslcd_init(void)
 	printk(KERN_DEBUG "LCD: init\n");
 #endif
 
+	mutex_lock(&anslcd_mutex);
 	anslcd_write_byte_ctrl ( 0x38 );
 	anslcd_write_byte_ctrl ( 0x0c );
 	anslcd_write_byte_ctrl ( 0x06 );
@@ -176,6 +186,7 @@ anslcd_init(void)
 	for(a=0;a<80;a++) {
 		anslcd_write_byte_data(anslcd_logo[a]);
 	}
+	mutex_unlock(&anslcd_mutex);
 	return 0;
 }
 
diff --git a/drivers/macintosh/macio_asic.c b/drivers/macintosh/macio_asic.c
index 588a5b0bc4b5..26a303a1d1ab 100644
--- a/drivers/macintosh/macio_asic.c
+++ b/drivers/macintosh/macio_asic.c
@@ -379,6 +379,11 @@ static struct macio_dev * macio_add_one_device(struct macio_chip *chip,
 	dev->ofdev.dev.parent = parent;
 	dev->ofdev.dev.bus = &macio_bus_type;
 	dev->ofdev.dev.release = macio_release_dev;
+	dev->ofdev.dev.dma_parms = &dev->dma_parms;
+
+	/* Standard DMA paremeters */
+	dma_set_max_seg_size(&dev->ofdev.dev, 65536);
+	dma_set_seg_boundary(&dev->ofdev.dev, 0xffffffff);
 
 #ifdef CONFIG_PCI
 	/* Set the DMA ops to the ones from the PCI device, this could be
@@ -538,6 +543,42 @@ void macio_unregister_driver(struct macio_driver *drv)
 	driver_unregister(&drv->driver);
 }
 
+/* Managed MacIO resources */
+struct macio_devres {
+	u32	res_mask;
+};
+
+static void maciom_release(struct device *gendev, void *res)
+{
+	struct macio_dev *dev = to_macio_device(gendev);
+	struct macio_devres *dr = res;
+	int i, max;
+
+	max = min(dev->n_resources, 32);
+	for (i = 0; i < max; i++) {
+		if (dr->res_mask & (1 << i))
+			macio_release_resource(dev, i);
+	}
+}
+
+int macio_enable_devres(struct macio_dev *dev)
+{
+	struct macio_devres *dr;
+
+	dr = devres_find(&dev->ofdev.dev, maciom_release, NULL, NULL);
+	if (!dr) {
+		dr = devres_alloc(maciom_release, sizeof(*dr), GFP_KERNEL);
+		if (!dr)
+			return -ENOMEM;
+	}
+	return devres_get(&dev->ofdev.dev, dr, NULL, NULL) != NULL;
+}
+
+static struct macio_devres * find_macio_dr(struct macio_dev *dev)
+{
+	return devres_find(&dev->ofdev.dev, maciom_release, NULL, NULL);
+}
+
 /**
  *	macio_request_resource - Request an MMIO resource
  * 	@dev: pointer to the device holding the resource
@@ -555,6 +596,8 @@ void macio_unregister_driver(struct macio_driver *drv)
 int macio_request_resource(struct macio_dev *dev, int resource_no,
 			   const char *name)
 {
+	struct macio_devres *dr = find_macio_dr(dev);
+
 	if (macio_resource_len(dev, resource_no) == 0)
 		return 0;
 		
@@ -562,6 +605,9 @@ int macio_request_resource(struct macio_dev *dev, int resource_no,
 				macio_resource_len(dev, resource_no),
 				name))
 		goto err_out;
+
+	if (dr && resource_no < 32)
+		dr->res_mask |= 1 << resource_no;
 	
 	return 0;
 
@@ -582,10 +628,14 @@ err_out:
  */
 void macio_release_resource(struct macio_dev *dev, int resource_no)
 {
+	struct macio_devres *dr = find_macio_dr(dev);
+
 	if (macio_resource_len(dev, resource_no) == 0)
 		return;
 	release_mem_region(macio_resource_start(dev, resource_no),
 			   macio_resource_len(dev, resource_no));
+	if (dr && resource_no < 32)
+		dr->res_mask &= ~(1 << resource_no);
 }
 
 /**
@@ -744,3 +794,5 @@ EXPORT_SYMBOL(macio_request_resource);
 EXPORT_SYMBOL(macio_release_resource);
 EXPORT_SYMBOL(macio_request_resources);
 EXPORT_SYMBOL(macio_release_resources);
+EXPORT_SYMBOL(macio_enable_devres);
+
diff --git a/drivers/macintosh/mediabay.c b/drivers/macintosh/mediabay.c
index 029ad8ce8a7e..08002b88f342 100644
--- a/drivers/macintosh/mediabay.c
+++ b/drivers/macintosh/mediabay.c
@@ -33,15 +33,6 @@
 #include <linux/adb.h>
 #include <linux/pmu.h>
 
-
-#define MB_DEBUG
-
-#ifdef MB_DEBUG
-#define MBDBG(fmt, arg...)	printk(KERN_INFO fmt , ## arg)
-#else
-#define MBDBG(fmt, arg...)	do { } while (0)
-#endif
-
 #define MB_FCR32(bay, r)	((bay)->base + ((r) >> 2))
 #define MB_FCR8(bay, r)		(((volatile u8 __iomem *)((bay)->base)) + (r))
 
@@ -76,28 +67,14 @@ struct media_bay_info {
 	int				index;
 	int				cached_gpio;
 	int				sleeping;
+	int				user_lock;
 	struct mutex			lock;
-#ifdef CONFIG_BLK_DEV_IDE_PMAC
-	ide_hwif_t			*cd_port;
-	void __iomem			*cd_base;
-	int				cd_irq;
-	int				cd_retry;
-#endif
-#if defined(CONFIG_BLK_DEV_IDE_PMAC)
-	int 				cd_index;
-#endif
 };
 
 #define MAX_BAYS	2
 
 static struct media_bay_info media_bays[MAX_BAYS];
-int media_bay_count = 0;
-
-#ifdef CONFIG_BLK_DEV_IDE_PMAC
-/* check the busy bit in the media-bay ide interface
-   (assumes the media-bay contains an ide device) */
-#define MB_IDE_READY(i)	((readb(media_bays[i].cd_base + 0x70) & 0x80) == 0)
-#endif
+static int media_bay_count = 0;
 
 /*
  * Wait that number of ms between each step in normal polling mode
@@ -130,21 +107,11 @@ int media_bay_count = 0;
 
 /*
  * Wait this many ticks after an IDE device (e.g. CD-ROM) is inserted
- * (or until the device is ready) before waiting for busy bit to disappear
+ * (or until the device is ready) before calling into the driver
  */
 #define MB_IDE_WAIT	1000
 
 /*
- * Timeout waiting for busy bit of an IDE device to go down
- */
-#define MB_IDE_TIMEOUT	5000
-
-/*
- * Max retries of the full power up/down sequence for an IDE device
- */
-#define MAX_CD_RETRIES	3
-
-/*
  * States of a media bay
  */
 enum {
@@ -153,7 +120,6 @@ enum {
 	mb_enabling_bay,	/* enable bits set, waiting MB_RESET_DELAY */
 	mb_resetting,		/* reset bit unset, waiting MB_SETUP_DELAY */
 	mb_ide_resetting,	/* IDE reset bit unser, waiting MB_IDE_WAIT */
-	mb_ide_waiting,		/* Waiting for BUSY bit to go away until MB_IDE_TIMEOUT */
 	mb_up,			/* Media bay full */
 	mb_powering_down	/* Powering down (avoid too fast down/up) */
 };
@@ -373,12 +339,12 @@ static inline void set_mb_power(struct media_bay_info* bay, int onoff)
 	if (onoff) {
 		bay->ops->power(bay, 1);
 		bay->state = mb_powering_up;
-		MBDBG("mediabay%d: powering up\n", bay->index);
+		pr_debug("mediabay%d: powering up\n", bay->index);
 	} else { 
 		/* Make sure everything is powered down & disabled */
 		bay->ops->power(bay, 0);
 		bay->state = mb_powering_down;
-		MBDBG("mediabay%d: powering down\n", bay->index);
+		pr_debug("mediabay%d: powering down\n", bay->index);
 	}
 	bay->timer = msecs_to_jiffies(MB_POWER_DELAY);
 }
@@ -387,107 +353,118 @@ static void poll_media_bay(struct media_bay_info* bay)
 {
 	int id = bay->ops->content(bay);
 
-	if (id == bay->last_value) {
-		if (id != bay->content_id) {
-			bay->value_count += msecs_to_jiffies(MB_POLL_DELAY);
-			if (bay->value_count >= msecs_to_jiffies(MB_STABLE_DELAY)) {
-				/* If the device type changes without going thru
-				 * "MB_NO", we force a pass by "MB_NO" to make sure
-				 * things are properly reset
-				 */
-				if ((id != MB_NO) && (bay->content_id != MB_NO)) {
-					id = MB_NO;
-					MBDBG("mediabay%d: forcing MB_NO\n", bay->index);
-				}
-				MBDBG("mediabay%d: switching to %d\n", bay->index, id);
-				set_mb_power(bay, id != MB_NO);
-				bay->content_id = id;
-				if (id == MB_NO) {
-#ifdef CONFIG_BLK_DEV_IDE_PMAC
-					bay->cd_retry = 0;
-#endif
-					printk(KERN_INFO "media bay %d is empty\n", bay->index);
-				}
-			}
-		}
-	} else {
+	static char *mb_content_types[] = {
+		"a floppy drive",
+		"a floppy drive",
+		"an unsuported audio device",
+		"an ATA device",
+		"an unsupported PCI device",
+		"an unknown device",
+	};
+
+	if (id != bay->last_value) {
 		bay->last_value = id;
 		bay->value_count = 0;
+		return;
+	}
+	if (id == bay->content_id)
+		return;
+
+	bay->value_count += msecs_to_jiffies(MB_POLL_DELAY);
+	if (bay->value_count >= msecs_to_jiffies(MB_STABLE_DELAY)) {
+		/* If the device type changes without going thru
+		 * "MB_NO", we force a pass by "MB_NO" to make sure
+		 * things are properly reset
+		 */
+		if ((id != MB_NO) && (bay->content_id != MB_NO)) {
+			id = MB_NO;
+			pr_debug("mediabay%d: forcing MB_NO\n", bay->index);
+		}
+		pr_debug("mediabay%d: switching to %d\n", bay->index, id);
+		set_mb_power(bay, id != MB_NO);
+		bay->content_id = id;
+		if (id >= MB_NO || id < 0)
+			printk(KERN_INFO "mediabay%d: Bay is now empty\n", bay->index);
+		else
+			printk(KERN_INFO "mediabay%d: Bay contains %s\n",
+			       bay->index, mb_content_types[id]);
 	}
 }
 
-#ifdef CONFIG_BLK_DEV_IDE_PMAC
-int check_media_bay(struct device_node *which_bay, int what)
+int check_media_bay(struct macio_dev *baydev)
 {
-	int	i;
+	struct media_bay_info* bay;
+	int id;
 
-	for (i=0; i<media_bay_count; i++)
-		if (media_bays[i].mdev && which_bay == media_bays[i].mdev->ofdev.node) {
-			if ((what == media_bays[i].content_id) && media_bays[i].state == mb_up)
-				return 0;
-			media_bays[i].cd_index = -1;
-			return -EINVAL;
-		}
-	return -ENODEV;
+	if (baydev == NULL)
+		return MB_NO;
+
+	/* This returns an instant snapshot, not locking, sine
+	 * we may be called with the bay lock held. The resulting
+	 * fuzzyness of the result if called at the wrong time is
+	 * not actually a huge deal
+	 */
+	bay = macio_get_drvdata(baydev);
+	if (bay == NULL)
+		return MB_NO;
+	id = bay->content_id;
+	if (bay->state != mb_up)
+		return MB_NO;
+	if (id == MB_FD1)
+		return MB_FD;
+	return id;
 }
-EXPORT_SYMBOL(check_media_bay);
+EXPORT_SYMBOL_GPL(check_media_bay);
 
-int check_media_bay_by_base(unsigned long base, int what)
+void lock_media_bay(struct macio_dev *baydev)
 {
-	int	i;
-
-	for (i=0; i<media_bay_count; i++)
-		if (media_bays[i].mdev && base == (unsigned long) media_bays[i].cd_base) {
-			if ((what == media_bays[i].content_id) && media_bays[i].state == mb_up)
-				return 0;
-			media_bays[i].cd_index = -1;
-			return -EINVAL;
-		} 
+	struct media_bay_info* bay;
 
-	return -ENODEV;
+	if (baydev == NULL)
+		return;
+	bay = macio_get_drvdata(baydev);
+	if (bay == NULL)
+		return;
+	mutex_lock(&bay->lock);
+	bay->user_lock = 1;
 }
-EXPORT_SYMBOL_GPL(check_media_bay_by_base);
+EXPORT_SYMBOL_GPL(lock_media_bay);
 
-int media_bay_set_ide_infos(struct device_node* which_bay, unsigned long base,
-			    int irq, ide_hwif_t *hwif)
+void unlock_media_bay(struct macio_dev *baydev)
 {
-	int	i;
+	struct media_bay_info* bay;
 
-	for (i=0; i<media_bay_count; i++) {
-		struct media_bay_info* bay = &media_bays[i];
-
-		if (bay->mdev && which_bay == bay->mdev->ofdev.node) {
-			int timeout = 5000, index = hwif->index;
-			
-			mutex_lock(&bay->lock);
-
-			bay->cd_port	= hwif;
- 			bay->cd_base	= (void __iomem *) base;
-			bay->cd_irq	= irq;
-
-			if ((MB_CD != bay->content_id) || bay->state != mb_up) {
-				mutex_unlock(&bay->lock);
-				return 0;
-			}
-			printk(KERN_DEBUG "Registered ide%d for media bay %d\n", index, i);
-			do {
-				if (MB_IDE_READY(i)) {
-					bay->cd_index	= index;
-					mutex_unlock(&bay->lock);
-					return 0;
-				}
-				mdelay(1);
-			} while(--timeout);
-			printk(KERN_DEBUG "Timeount waiting IDE in bay %d\n", i);
-			mutex_unlock(&bay->lock);
-			return -ENODEV;
-		}
+	if (baydev == NULL)
+		return;
+	bay = macio_get_drvdata(baydev);
+	if (bay == NULL)
+		return;
+	if (bay->user_lock) {
+		bay->user_lock = 0;
+		mutex_unlock(&bay->lock);
 	}
+}
+EXPORT_SYMBOL_GPL(unlock_media_bay);
 
-	return -ENODEV;
+static int mb_broadcast_hotplug(struct device *dev, void *data)
+{
+	struct media_bay_info* bay = data;
+	struct macio_dev *mdev;
+	struct macio_driver *drv;
+	int state;
+
+	if (dev->bus != &macio_bus_type)
+		return 0;
+
+	state = bay->state == mb_up ? bay->content_id : MB_NO;
+	if (state == MB_FD1)
+		state = MB_FD;
+	mdev = to_macio_device(dev);
+	drv = to_macio_driver(dev->driver);
+	if (dev->driver && drv->mediabay_event)
+		drv->mediabay_event(mdev, state);
+	return 0;
 }
-EXPORT_SYMBOL_GPL(media_bay_set_ide_infos);
-#endif /* CONFIG_BLK_DEV_IDE_PMAC */
 
 static void media_bay_step(int i)
 {
@@ -497,8 +474,8 @@ static void media_bay_step(int i)
 	if (bay->state != mb_powering_down)
 	    poll_media_bay(bay);
 
-	/* If timer expired or polling IDE busy, run state machine */
-	if ((bay->state != mb_ide_waiting) && (bay->timer != 0)) {
+	/* If timer expired run state machine */
+	if (bay->timer != 0) {
 		bay->timer -= msecs_to_jiffies(MB_POLL_DELAY);
 		if (bay->timer > 0)
 			return;
@@ -508,100 +485,50 @@ static void media_bay_step(int i)
 	switch(bay->state) {
 	case mb_powering_up:
 	    	if (bay->ops->setup_bus(bay, bay->last_value) < 0) {
-			MBDBG("mediabay%d: device not supported (kind:%d)\n", i, bay->content_id);
+			pr_debug("mediabay%d: device not supported (kind:%d)\n",
+				 i, bay->content_id);
 	    		set_mb_power(bay, 0);
 	    		break;
 	    	}
 	    	bay->timer = msecs_to_jiffies(MB_RESET_DELAY);
 	    	bay->state = mb_enabling_bay;
-		MBDBG("mediabay%d: enabling (kind:%d)\n", i, bay->content_id);
+		pr_debug("mediabay%d: enabling (kind:%d)\n", i, bay->content_id);
 		break;
 	case mb_enabling_bay:
 		bay->ops->un_reset(bay);
 	    	bay->timer = msecs_to_jiffies(MB_SETUP_DELAY);
 	    	bay->state = mb_resetting;
-		MBDBG("mediabay%d: waiting reset (kind:%d)\n", i, bay->content_id);
+		pr_debug("mediabay%d: releasing bay reset (kind:%d)\n",
+			 i, bay->content_id);
 	    	break;
 	case mb_resetting:
 		if (bay->content_id != MB_CD) {
-			MBDBG("mediabay%d: bay is up (kind:%d)\n", i, bay->content_id);
+			pr_debug("mediabay%d: bay is up (kind:%d)\n", i,
+				 bay->content_id);
 			bay->state = mb_up;
+			device_for_each_child(&bay->mdev->ofdev.dev,
+					      bay, mb_broadcast_hotplug);
 			break;
 	    	}
-#ifdef CONFIG_BLK_DEV_IDE_PMAC
-		MBDBG("mediabay%d: waiting IDE reset (kind:%d)\n", i, bay->content_id);
+		pr_debug("mediabay%d: releasing ATA reset (kind:%d)\n",
+			 i, bay->content_id);
 		bay->ops->un_reset_ide(bay);
 	    	bay->timer = msecs_to_jiffies(MB_IDE_WAIT);
 	    	bay->state = mb_ide_resetting;
-#else
-		printk(KERN_DEBUG "media-bay %d is ide (not compiled in kernel)\n", i);
-		set_mb_power(bay, 0);
-#endif /* CONFIG_BLK_DEV_IDE_PMAC */
 	    	break;
-#ifdef CONFIG_BLK_DEV_IDE_PMAC
+
 	case mb_ide_resetting:
-	    	bay->timer = msecs_to_jiffies(MB_IDE_TIMEOUT);
-	    	bay->state = mb_ide_waiting;
-		MBDBG("mediabay%d: waiting IDE ready (kind:%d)\n", i, bay->content_id);
+		pr_debug("mediabay%d: bay is up (kind:%d)\n", i, bay->content_id);
+		bay->state = mb_up;
+		device_for_each_child(&bay->mdev->ofdev.dev,
+				      bay, mb_broadcast_hotplug);
 	    	break;
-	case mb_ide_waiting:
-		if (bay->cd_base == NULL) {
-			bay->timer = 0;
-			bay->state = mb_up;
-			MBDBG("mediabay%d: up before IDE init\n", i);
-			break;
-		} else if (MB_IDE_READY(i)) {
-			bay->timer = 0;
-			bay->state = mb_up;
-			if (bay->cd_index < 0) {
-				printk("mediabay %d, registering IDE...\n", i);
-				pmu_suspend();
-				ide_port_scan(bay->cd_port);
-				if (bay->cd_port->present)
-					bay->cd_index = bay->cd_port->index;
-				pmu_resume();
-			}
-			if (bay->cd_index == -1) {
-				/* We eventually do a retry */
-				bay->cd_retry++;
-				printk("IDE register error\n");
-				set_mb_power(bay, 0);
-			} else {
-				printk(KERN_DEBUG "media-bay %d is ide%d\n", i, bay->cd_index);
-				MBDBG("mediabay %d IDE ready\n", i);
-			}
-			break;
-	    	} else if (bay->timer > 0)
-			bay->timer -= msecs_to_jiffies(MB_POLL_DELAY);
-	    	if (bay->timer <= 0) {
-			printk("\nIDE Timeout in bay %d !, IDE state is: 0x%02x\n",
-			       i, readb(bay->cd_base + 0x70));
-			MBDBG("mediabay%d: nIDE Timeout !\n", i);
-			set_mb_power(bay, 0);
-			bay->timer = 0;
-	    	}
-		break;
-#endif /* CONFIG_BLK_DEV_IDE_PMAC */
+
 	case mb_powering_down:
 	    	bay->state = mb_empty;
-#ifdef CONFIG_BLK_DEV_IDE_PMAC
-    	        if (bay->cd_index >= 0) {
-			printk(KERN_DEBUG "Unregistering mb %d ide, index:%d\n", i,
-			       bay->cd_index);
-			ide_port_unregister_devices(bay->cd_port);
-			bay->cd_index = -1;
-		}
-	    	if (bay->cd_retry) {
-			if (bay->cd_retry > MAX_CD_RETRIES) {
-				/* Should add an error sound (sort of beep in dmasound) */
-				printk("\nmedia-bay %d, IDE device badly inserted or unrecognised\n", i);
-			} else {
-				/* Force a new power down/up sequence */
-				bay->content_id = MB_NO;
-			}
-	    	}
-#endif /* CONFIG_BLK_DEV_IDE_PMAC */
-		MBDBG("mediabay%d: end of power down\n", i);
+		device_for_each_child(&bay->mdev->ofdev.dev,
+				      bay, mb_broadcast_hotplug);
+		pr_debug("mediabay%d: end of power down\n", i);
 	    	break;
 	}
 }
@@ -676,11 +603,6 @@ static int __devinit media_bay_attach(struct macio_dev *mdev, const struct of_de
 	bay->last_value = bay->ops->content(bay);
 	bay->value_count = msecs_to_jiffies(MB_STABLE_DELAY);
 	bay->state = mb_empty;
-	do {
-		msleep(MB_POLL_DELAY);
-		media_bay_step(i);
-	} while((bay->state != mb_empty) &&
-		(bay->state != mb_up));
 
 	/* Mark us ready by filling our mdev data */
 	macio_set_drvdata(mdev, bay);
@@ -725,7 +647,7 @@ static int media_bay_resume(struct macio_dev *mdev)
 	       	set_mb_power(bay, 0);
 		msleep(MB_POWER_DELAY);
 	       	if (bay->ops->content(bay) != bay->content_id) {
-			printk("mediabay%d: content changed during sleep...\n", bay->index);
+			printk("mediabay%d: Content changed during sleep...\n", bay->index);
 			mutex_unlock(&bay->lock);
 	       		return 0;
 		}
@@ -733,9 +655,6 @@ static int media_bay_resume(struct macio_dev *mdev)
 	       	bay->last_value = bay->content_id;
 	       	bay->value_count = msecs_to_jiffies(MB_STABLE_DELAY);
 	       	bay->timer = msecs_to_jiffies(MB_POWER_DELAY);
-#ifdef CONFIG_BLK_DEV_IDE_PMAC
-	       	bay->cd_retry = 0;
-#endif
 	       	do {
 			msleep(MB_POLL_DELAY);
 	       		media_bay_step(bay->index);
@@ -823,9 +742,6 @@ static int __init media_bay_init(void)
 	for (i=0; i<MAX_BAYS; i++) {
 		memset((char *)&media_bays[i], 0, sizeof(struct media_bay_info));
 		media_bays[i].content_id	= -1;
-#ifdef CONFIG_BLK_DEV_IDE_PMAC
-		media_bays[i].cd_index		= -1;
-#endif
 	}
 	if (!machine_is(powermac))
 		return 0;
diff --git a/drivers/macintosh/nvram.c b/drivers/macintosh/nvram.c
index b195d753d2ed..c876349c32de 100644
--- a/drivers/macintosh/nvram.c
+++ b/drivers/macintosh/nvram.c
@@ -13,7 +13,6 @@
 #include <linux/fcntl.h>
 #include <linux/nvram.h>
 #include <linux/init.h>
-#include <linux/smp_lock.h>
 #include <asm/uaccess.h>
 #include <asm/nvram.h>
 
@@ -21,7 +20,6 @@
 
 static loff_t nvram_llseek(struct file *file, loff_t offset, int origin)
 {
-	lock_kernel();
 	switch (origin) {
 	case 1:
 		offset += file->f_pos;
@@ -30,12 +28,10 @@ static loff_t nvram_llseek(struct file *file, loff_t offset, int origin)
 		offset += NVRAM_SIZE;
 		break;
 	}
-	if (offset < 0) {
-		unlock_kernel();
+	if (offset < 0)
 		return -EINVAL;
-	}
+
 	file->f_pos = offset;
-	unlock_kernel();
 	return file->f_pos;
 }
 
@@ -76,8 +72,7 @@ static ssize_t write_nvram(struct file *file, const char __user *buf,
 	return p - buf;
 }
 
-static int nvram_ioctl(struct inode *inode, struct file *file,
-	unsigned int cmd, unsigned long arg)
+static long nvram_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
 	switch(cmd) {
 		case PMAC_NVRAM_GET_OFFSET:
diff --git a/drivers/macintosh/smu.c b/drivers/macintosh/smu.c
index 96faa799b82a..f96feeb6b9ce 100644
--- a/drivers/macintosh/smu.c
+++ b/drivers/macintosh/smu.c
@@ -660,7 +660,7 @@ static int smu_platform_probe(struct of_device* dev,
 	return 0;
 }
 
-static struct of_device_id smu_platform_match[] =
+static const struct of_device_id smu_platform_match[] =
 {
 	{
 		.type		= "smu",
diff --git a/drivers/macintosh/therm_adt746x.c b/drivers/macintosh/therm_adt746x.c
index 556f0feaa4df..5ff47ba7f2d0 100644
--- a/drivers/macintosh/therm_adt746x.c
+++ b/drivers/macintosh/therm_adt746x.c
@@ -79,6 +79,7 @@ struct thermostat {
 	u8			limits[3];
 	int			last_speed[2];
 	int			last_var[2];
+	int			pwm_inv[2];
 };
 
 static enum {ADT7460, ADT7467} therm_type;
@@ -229,19 +230,23 @@ static void write_fan_speed(struct thermostat *th, int speed, int fan)
 	
 	if (speed >= 0) {
 		manual = read_reg(th, MANUAL_MODE[fan]);
+		manual &= ~INVERT_MASK;
 		write_reg(th, MANUAL_MODE[fan],
-			(manual|MANUAL_MASK) & (~INVERT_MASK));
+			manual | MANUAL_MASK | th->pwm_inv[fan]);
 		write_reg(th, FAN_SPD_SET[fan], speed);
 	} else {
 		/* back to automatic */
 		if(therm_type == ADT7460) {
 			manual = read_reg(th,
 				MANUAL_MODE[fan]) & (~MANUAL_MASK);
-
+			manual &= ~INVERT_MASK;
+			manual |= th->pwm_inv[fan];
 			write_reg(th,
 				MANUAL_MODE[fan], manual|REM_CONTROL[fan]);
 		} else {
 			manual = read_reg(th, MANUAL_MODE[fan]);
+			manual &= ~INVERT_MASK;
+			manual |= th->pwm_inv[fan];
 			write_reg(th, MANUAL_MODE[fan], manual&(~AUTO_MASK));
 		}
 	}
@@ -387,7 +392,7 @@ static int probe_thermostat(struct i2c_client *client,
 	i2c_set_clientdata(client, th);
 	th->clt = client;
 
-	rc = read_reg(th, 0);
+	rc = read_reg(th, CONFIG_REG);
 	if (rc < 0) {
 		dev_err(&client->dev, "Thermostat failed to read config!\n");
 		kfree(th);
@@ -418,6 +423,10 @@ static int probe_thermostat(struct i2c_client *client,
 
 	thermostat = th;
 
+	/* record invert bit status because fw can corrupt it after suspend */
+	th->pwm_inv[0] = read_reg(th, MANUAL_MODE[0]) & INVERT_MASK;
+	th->pwm_inv[1] = read_reg(th, MANUAL_MODE[1]) & INVERT_MASK;
+
 	/* be sure to really write fan speed the first time */
 	th->last_speed[0] = -2;
 	th->last_speed[1] = -2;
diff --git a/drivers/macintosh/therm_pm72.c b/drivers/macintosh/therm_pm72.c
index ea32c7e5a9af..454bc501df3c 100644
--- a/drivers/macintosh/therm_pm72.c
+++ b/drivers/macintosh/therm_pm72.c
@@ -2211,7 +2211,7 @@ static int fcu_of_remove(struct of_device* dev)
 	return 0;
 }
 
-static struct of_device_id fcu_match[] = 
+static const struct of_device_id fcu_match[] = 
 {
 	{
 	.type		= "fcu",
diff --git a/drivers/macintosh/therm_windtunnel.c b/drivers/macintosh/therm_windtunnel.c
index 8b9364434aa0..ba48fd76396e 100644
--- a/drivers/macintosh/therm_windtunnel.c
+++ b/drivers/macintosh/therm_windtunnel.c
@@ -15,7 +15,7 @@
  *
  *	WARNING: This driver has only been testen on Apple's
  *	1.25 MHz Dual G4 (March 03). It is tuned for a CPU
- *	temperatur around 57 C.
+ *	temperature around 57 C.
  *
  *   Copyright (C) 2003, 2004 Samuel Rydh (samuel@ibrium.se)
  *
@@ -457,7 +457,7 @@ therm_of_remove( struct of_device *dev )
 	return 0;
 }
 
-static struct of_device_id therm_of_match[] = {{
+static const struct of_device_id therm_of_match[] = {{
 	.name		= "fan",
 	.compatible	= "adm1030"
     }, {}
diff --git a/drivers/macintosh/via-pmu.c b/drivers/macintosh/via-pmu.c
index 6f308a4757ee..db379c381432 100644
--- a/drivers/macintosh/via-pmu.c
+++ b/drivers/macintosh/via-pmu.c
@@ -36,6 +36,7 @@
 #include <linux/spinlock.h>
 #include <linux/pm.h>
 #include <linux/proc_fs.h>
+#include <linux/seq_file.h>
 #include <linux/init.h>
 #include <linux/interrupt.h>
 #include <linux/device.h>
@@ -186,17 +187,11 @@ static int init_pmu(void);
 static void pmu_start(void);
 static irqreturn_t via_pmu_interrupt(int irq, void *arg);
 static irqreturn_t gpio1_interrupt(int irq, void *arg);
-static int proc_get_info(char *page, char **start, off_t off,
-			  int count, int *eof, void *data);
-static int proc_get_irqstats(char *page, char **start, off_t off,
-			  int count, int *eof, void *data);
+static const struct file_operations pmu_info_proc_fops;
+static const struct file_operations pmu_irqstats_proc_fops;
 static void pmu_pass_intr(unsigned char *data, int len);
-static int proc_get_batt(char *page, char **start, off_t off,
-			int count, int *eof, void *data);
-static int proc_read_options(char *page, char **start, off_t off,
-			int count, int *eof, void *data);
-static int proc_write_options(struct file *file, const char __user *buffer,
-			unsigned long count, void *data);
+static const struct file_operations pmu_battery_proc_fops;
+static const struct file_operations pmu_options_proc_fops;
 
 #ifdef CONFIG_ADB
 struct adb_driver via_pmu_driver = {
@@ -507,19 +502,15 @@ static int __init via_pmu_dev_init(void)
 		for (i=0; i<pmu_battery_count; i++) {
 			char title[16];
 			sprintf(title, "battery_%ld", i);
-			proc_pmu_batt[i] = create_proc_read_entry(title, 0, proc_pmu_root,
-						proc_get_batt, (void *)i);
+			proc_pmu_batt[i] = proc_create_data(title, 0, proc_pmu_root,
+					&pmu_battery_proc_fops, (void *)i);
 		}
 
-		proc_pmu_info = create_proc_read_entry("info", 0, proc_pmu_root,
-					proc_get_info, NULL);
-		proc_pmu_irqstats = create_proc_read_entry("interrupts", 0, proc_pmu_root,
-					proc_get_irqstats, NULL);
-		proc_pmu_options = create_proc_entry("options", 0600, proc_pmu_root);
-		if (proc_pmu_options) {
-			proc_pmu_options->read_proc = proc_read_options;
-			proc_pmu_options->write_proc = proc_write_options;
-		}
+		proc_pmu_info = proc_create("info", 0, proc_pmu_root, &pmu_info_proc_fops);
+		proc_pmu_irqstats = proc_create("interrupts", 0, proc_pmu_root,
+						&pmu_irqstats_proc_fops);
+		proc_pmu_options = proc_create("options", 0600, proc_pmu_root,
+						&pmu_options_proc_fops);
 	}
 	return 0;
 }
@@ -799,27 +790,33 @@ query_battery_state(void)
 			2, PMU_SMART_BATTERY_STATE, pmu_cur_battery+1);
 }
 
-static int
-proc_get_info(char *page, char **start, off_t off,
-		int count, int *eof, void *data)
+static int pmu_info_proc_show(struct seq_file *m, void *v)
 {
-	char* p = page;
-
-	p += sprintf(p, "PMU driver version     : %d\n", PMU_DRIVER_VERSION);
-	p += sprintf(p, "PMU firmware version   : %02x\n", pmu_version);
-	p += sprintf(p, "AC Power               : %d\n",
+	seq_printf(m, "PMU driver version     : %d\n", PMU_DRIVER_VERSION);
+	seq_printf(m, "PMU firmware version   : %02x\n", pmu_version);
+	seq_printf(m, "AC Power               : %d\n",
 		((pmu_power_flags & PMU_PWR_AC_PRESENT) != 0) || pmu_battery_count == 0);
-	p += sprintf(p, "Battery count          : %d\n", pmu_battery_count);
+	seq_printf(m, "Battery count          : %d\n", pmu_battery_count);
+
+	return 0;
+}
 
-	return p - page;
+static int pmu_info_proc_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, pmu_info_proc_show, NULL);
 }
 
-static int
-proc_get_irqstats(char *page, char **start, off_t off,
-		  int count, int *eof, void *data)
+static const struct file_operations pmu_info_proc_fops = {
+	.owner		= THIS_MODULE,
+	.open		= pmu_info_proc_open,
+	.read		= seq_read,
+	.llseek		= seq_lseek,
+	.release	= single_release,
+};
+
+static int pmu_irqstats_proc_show(struct seq_file *m, void *v)
 {
 	int i;
-	char* p = page;
 	static const char *irq_names[] = {
 		"Total CB1 triggered events",
 		"Total GPIO1 triggered events",
@@ -835,60 +832,76 @@ proc_get_irqstats(char *page, char **start, off_t off,
         };
 
 	for (i=0; i<11; i++) {
-		p += sprintf(p, " %2u: %10u (%s)\n",
+		seq_printf(m, " %2u: %10u (%s)\n",
 			     i, pmu_irq_stats[i], irq_names[i]);
 	}
-	return p - page;
+	return 0;
 }
 
-static int
-proc_get_batt(char *page, char **start, off_t off,
-		int count, int *eof, void *data)
+static int pmu_irqstats_proc_open(struct inode *inode, struct file *file)
 {
-	long batnum = (long)data;
-	char *p = page;
+	return single_open(file, pmu_irqstats_proc_show, NULL);
+}
+
+static const struct file_operations pmu_irqstats_proc_fops = {
+	.owner		= THIS_MODULE,
+	.open		= pmu_irqstats_proc_open,
+	.read		= seq_read,
+	.llseek		= seq_lseek,
+	.release	= single_release,
+};
+
+static int pmu_battery_proc_show(struct seq_file *m, void *v)
+{
+	long batnum = (long)m->private;
 	
-	p += sprintf(p, "\n");
-	p += sprintf(p, "flags      : %08x\n",
-		pmu_batteries[batnum].flags);
-	p += sprintf(p, "charge     : %d\n",
-		pmu_batteries[batnum].charge);
-	p += sprintf(p, "max_charge : %d\n",
-		pmu_batteries[batnum].max_charge);
-	p += sprintf(p, "current    : %d\n",
-		pmu_batteries[batnum].amperage);
-	p += sprintf(p, "voltage    : %d\n",
-		pmu_batteries[batnum].voltage);
-	p += sprintf(p, "time rem.  : %d\n",
-		pmu_batteries[batnum].time_remaining);
-
-	return p - page;
+	seq_putc(m, '\n');
+	seq_printf(m, "flags      : %08x\n", pmu_batteries[batnum].flags);
+	seq_printf(m, "charge     : %d\n", pmu_batteries[batnum].charge);
+	seq_printf(m, "max_charge : %d\n", pmu_batteries[batnum].max_charge);
+	seq_printf(m, "current    : %d\n", pmu_batteries[batnum].amperage);
+	seq_printf(m, "voltage    : %d\n", pmu_batteries[batnum].voltage);
+	seq_printf(m, "time rem.  : %d\n", pmu_batteries[batnum].time_remaining);
+	return 0;
 }
 
-static int
-proc_read_options(char *page, char **start, off_t off,
-			int count, int *eof, void *data)
+static int pmu_battery_proc_open(struct inode *inode, struct file *file)
 {
-	char *p = page;
+	return single_open(file, pmu_battery_proc_show, PDE(inode)->data);
+}
 
+static const struct file_operations pmu_battery_proc_fops = {
+	.owner		= THIS_MODULE,
+	.open		= pmu_battery_proc_open,
+	.read		= seq_read,
+	.llseek		= seq_lseek,
+	.release	= single_release,
+};
+
+static int pmu_options_proc_show(struct seq_file *m, void *v)
+{
 #if defined(CONFIG_SUSPEND) && defined(CONFIG_PPC32)
 	if (pmu_kind == PMU_KEYLARGO_BASED &&
 	    pmac_call_feature(PMAC_FTR_SLEEP_STATE,NULL,0,-1) >= 0)
-		p += sprintf(p, "lid_wakeup=%d\n", option_lid_wakeup);
+		seq_printf(m, "lid_wakeup=%d\n", option_lid_wakeup);
 #endif
 	if (pmu_kind == PMU_KEYLARGO_BASED)
-		p += sprintf(p, "server_mode=%d\n", option_server_mode);
+		seq_printf(m, "server_mode=%d\n", option_server_mode);
 
-	return p - page;
+	return 0;
 }
-			
-static int
-proc_write_options(struct file *file, const char __user *buffer,
-			unsigned long count, void *data)
+
+static int pmu_options_proc_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, pmu_options_proc_show, NULL);
+}
+
+static ssize_t pmu_options_proc_write(struct file *file,
+		const char __user *buffer, size_t count, loff_t *pos)
 {
 	char tmp[33];
 	char *label, *val;
-	unsigned long fcount = count;
+	size_t fcount = count;
 	
 	if (!count)
 		return -EINVAL;
@@ -927,6 +940,15 @@ proc_write_options(struct file *file, const char __user *buffer,
 	return fcount;
 }
 
+static const struct file_operations pmu_options_proc_fops = {
+	.owner		= THIS_MODULE,
+	.open		= pmu_options_proc_open,
+	.read		= seq_read,
+	.llseek		= seq_lseek,
+	.release	= single_release,
+	.write		= pmu_options_proc_write,
+};
+
 #ifdef CONFIG_ADB
 /* Send an ADB command */
 static int pmu_send_request(struct adb_request *req, int sync)
diff --git a/drivers/macintosh/windfarm_smu_controls.c b/drivers/macintosh/windfarm_smu_controls.c
index 961fa0e7c2cf..6c68b9e5f5c4 100644
--- a/drivers/macintosh/windfarm_smu_controls.c
+++ b/drivers/macintosh/windfarm_smu_controls.c
@@ -202,6 +202,8 @@ static struct smu_fan_control *smu_fan_create(struct device_node *node,
 		fct->ctrl.name = "cpu-front-fan-1";
 	else if (!strcmp(l, "CPU A PUMP"))
 		fct->ctrl.name = "cpu-pump-0";
+	else if (!strcmp(l, "CPU B PUMP"))
+		fct->ctrl.name = "cpu-pump-1";
 	else if (!strcmp(l, "Slots Fan") || !strcmp(l, "Slots fan") ||
 		 !strcmp(l, "EXPANSION SLOTS INTAKE"))
 		fct->ctrl.name = "slots-fan";
diff --git a/drivers/md/Kconfig b/drivers/md/Kconfig
index 2158377a1359..acb3a4e404ff 100644
--- a/drivers/md/Kconfig
+++ b/drivers/md/Kconfig
@@ -185,11 +185,10 @@ config MD_MULTIPATH
 	tristate "Multipath I/O support"
 	depends on BLK_DEV_MD
 	help
-	  Multipath-IO is the ability of certain devices to address the same
-	  physical disk over multiple 'IO paths'. The code ensures that such
-	  paths can be defined and handled at runtime, and ensures that a
-	  transparent failover to the backup path(s) happens if a IO errors
-	  arrives on the primary path.
+	  MD_MULTIPATH provides a simple multi-path personality for use
+	  the MD framework.  It is not under active development.  New
+	  projects should consider using DM_MULTIPATH which has more
+	  features and more testing.
 
 	  If unsure, say N.
 
diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
index 60e2b322db11..26ac8aad0b19 100644
--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -212,7 +212,7 @@ static void bitmap_checkfree(struct bitmap *bitmap, unsigned long page)
  */
 
 /* IO operations when bitmap is stored near all superblocks */
-static struct page *read_sb_page(mddev_t *mddev, long offset,
+static struct page *read_sb_page(mddev_t *mddev, loff_t offset,
 				 struct page *page,
 				 unsigned long index, int size)
 {
@@ -287,27 +287,36 @@ static int write_sb_page(struct bitmap *bitmap, struct page *page, int wait)
 
 	while ((rdev = next_active_rdev(rdev, mddev)) != NULL) {
 			int size = PAGE_SIZE;
+			loff_t offset = mddev->bitmap_info.offset;
 			if (page->index == bitmap->file_pages-1)
 				size = roundup(bitmap->last_page_size,
 					       bdev_logical_block_size(rdev->bdev));
 			/* Just make sure we aren't corrupting data or
 			 * metadata
 			 */
-			if (bitmap->offset < 0) {
+			if (mddev->external) {
+				/* Bitmap could be anywhere. */
+				if (rdev->sb_start + offset + (page->index *(PAGE_SIZE/512)) >
+				    rdev->data_offset &&
+				    rdev->sb_start + offset < 
+				    rdev->data_offset + mddev->dev_sectors +
+				    (PAGE_SIZE/512))
+					goto bad_alignment;
+			} else if (offset < 0) {
 				/* DATA  BITMAP METADATA  */
-				if (bitmap->offset
+				if (offset
 				    + (long)(page->index * (PAGE_SIZE/512))
 				    + size/512 > 0)
 					/* bitmap runs in to metadata */
 					goto bad_alignment;
 				if (rdev->data_offset + mddev->dev_sectors
-				    > rdev->sb_start + bitmap->offset)
+				    > rdev->sb_start + offset)
 					/* data runs in to bitmap */
 					goto bad_alignment;
 			} else if (rdev->sb_start < rdev->data_offset) {
 				/* METADATA BITMAP DATA */
 				if (rdev->sb_start
-				    + bitmap->offset
+				    + offset
 				    + page->index*(PAGE_SIZE/512) + size/512
 				    > rdev->data_offset)
 					/* bitmap runs in to data */
@@ -316,7 +325,7 @@ static int write_sb_page(struct bitmap *bitmap, struct page *page, int wait)
 				/* DATA METADATA BITMAP - no problems */
 			}
 			md_super_write(mddev, rdev,
-				       rdev->sb_start + bitmap->offset
+				       rdev->sb_start + offset
 				       + page->index * (PAGE_SIZE/512),
 				       size,
 				       page);
@@ -488,6 +497,8 @@ void bitmap_update_sb(struct bitmap *bitmap)
 
 	if (!bitmap || !bitmap->mddev) /* no bitmap for this array */
 		return;
+	if (bitmap->mddev->bitmap_info.external)
+		return;
 	spin_lock_irqsave(&bitmap->lock, flags);
 	if (!bitmap->sb_page) { /* no superblock */
 		spin_unlock_irqrestore(&bitmap->lock, flags);
@@ -501,6 +512,9 @@ void bitmap_update_sb(struct bitmap *bitmap)
 		bitmap->events_cleared = bitmap->mddev->events;
 		sb->events_cleared = cpu_to_le64(bitmap->events_cleared);
 	}
+	/* Just in case these have been changed via sysfs: */
+	sb->daemon_sleep = cpu_to_le32(bitmap->mddev->bitmap_info.daemon_sleep/HZ);
+	sb->write_behind = cpu_to_le32(bitmap->mddev->bitmap_info.max_write_behind);
 	kunmap_atomic(sb, KM_USER0);
 	write_page(bitmap, bitmap->sb_page, 1);
 }
@@ -550,7 +564,8 @@ static int bitmap_read_sb(struct bitmap *bitmap)
 
 		bitmap->sb_page = read_page(bitmap->file, 0, bitmap, bytes);
 	} else {
-		bitmap->sb_page = read_sb_page(bitmap->mddev, bitmap->offset,
+		bitmap->sb_page = read_sb_page(bitmap->mddev,
+					       bitmap->mddev->bitmap_info.offset,
 					       NULL,
 					       0, sizeof(bitmap_super_t));
 	}
@@ -563,7 +578,7 @@ static int bitmap_read_sb(struct bitmap *bitmap)
 	sb = (bitmap_super_t *)kmap_atomic(bitmap->sb_page, KM_USER0);
 
 	chunksize = le32_to_cpu(sb->chunksize);
-	daemon_sleep = le32_to_cpu(sb->daemon_sleep);
+	daemon_sleep = le32_to_cpu(sb->daemon_sleep) * HZ;
 	write_behind = le32_to_cpu(sb->write_behind);
 
 	/* verify that the bitmap-specific fields are valid */
@@ -576,7 +591,7 @@ static int bitmap_read_sb(struct bitmap *bitmap)
 		reason = "bitmap chunksize too small";
 	else if ((1 << ffz(~chunksize)) != chunksize)
 		reason = "bitmap chunksize not a power of 2";
-	else if (daemon_sleep < 1 || daemon_sleep > MAX_SCHEDULE_TIMEOUT / HZ)
+	else if (daemon_sleep < 1 || daemon_sleep > MAX_SCHEDULE_TIMEOUT)
 		reason = "daemon sleep period out of range";
 	else if (write_behind > COUNTER_MAX)
 		reason = "write-behind limit out of range (0 - 16383)";
@@ -610,10 +625,9 @@ static int bitmap_read_sb(struct bitmap *bitmap)
 	}
 success:
 	/* assign fields using values from superblock */
-	bitmap->chunksize = chunksize;
-	bitmap->daemon_sleep = daemon_sleep;
-	bitmap->daemon_lastrun = jiffies;
-	bitmap->max_write_behind = write_behind;
+	bitmap->mddev->bitmap_info.chunksize = chunksize;
+	bitmap->mddev->bitmap_info.daemon_sleep = daemon_sleep;
+	bitmap->mddev->bitmap_info.max_write_behind = write_behind;
 	bitmap->flags |= le32_to_cpu(sb->state);
 	if (le32_to_cpu(sb->version) == BITMAP_MAJOR_HOSTENDIAN)
 		bitmap->flags |= BITMAP_HOSTENDIAN;
@@ -664,16 +678,26 @@ static int bitmap_mask_state(struct bitmap *bitmap, enum bitmap_state bits,
  * general bitmap file operations
  */
 
+/*
+ * on-disk bitmap:
+ *
+ * Use one bit per "chunk" (block set). We do the disk I/O on the bitmap
+ * file a page at a time. There's a superblock at the start of the file.
+ */
 /* calculate the index of the page that contains this bit */
-static inline unsigned long file_page_index(unsigned long chunk)
+static inline unsigned long file_page_index(struct bitmap *bitmap, unsigned long chunk)
 {
-	return CHUNK_BIT_OFFSET(chunk) >> PAGE_BIT_SHIFT;
+	if (!bitmap->mddev->bitmap_info.external)
+		chunk += sizeof(bitmap_super_t) << 3;
+	return chunk >> PAGE_BIT_SHIFT;
 }
 
 /* calculate the (bit) offset of this bit within a page */
-static inline unsigned long file_page_offset(unsigned long chunk)
+static inline unsigned long file_page_offset(struct bitmap *bitmap, unsigned long chunk)
 {
-	return CHUNK_BIT_OFFSET(chunk) & (PAGE_BITS - 1);
+	if (!bitmap->mddev->bitmap_info.external)
+		chunk += sizeof(bitmap_super_t) << 3;
+	return chunk & (PAGE_BITS - 1);
 }
 
 /*
@@ -686,8 +710,9 @@ static inline unsigned long file_page_offset(unsigned long chunk)
 static inline struct page *filemap_get_page(struct bitmap *bitmap,
 					unsigned long chunk)
 {
-	if (file_page_index(chunk) >= bitmap->file_pages) return NULL;
-	return bitmap->filemap[file_page_index(chunk) - file_page_index(0)];
+	if (file_page_index(bitmap, chunk) >= bitmap->file_pages) return NULL;
+	return bitmap->filemap[file_page_index(bitmap, chunk)
+			       - file_page_index(bitmap, 0)];
 }
 
 
@@ -710,7 +735,7 @@ static void bitmap_file_unmap(struct bitmap *bitmap)
 	spin_unlock_irqrestore(&bitmap->lock, flags);
 
 	while (pages--)
-		if (map[pages]->index != 0) /* 0 is sb_page, release it below */
+		if (map[pages] != sb_page) /* 0 is sb_page, release it below */
 			free_buffers(map[pages]);
 	kfree(map);
 	kfree(attr);
@@ -821,7 +846,7 @@ static void bitmap_file_set_bit(struct bitmap *bitmap, sector_t block)
 
 	page = filemap_get_page(bitmap, chunk);
 	if (!page) return;
-	bit = file_page_offset(chunk);
+	bit = file_page_offset(bitmap, chunk);
 
  	/* set the bit */
 	kaddr = kmap_atomic(page, KM_USER0);
@@ -907,7 +932,7 @@ static int bitmap_init_from_disk(struct bitmap *bitmap, sector_t start)
 	chunks = bitmap->chunks;
 	file = bitmap->file;
 
-	BUG_ON(!file && !bitmap->offset);
+	BUG_ON(!file && !bitmap->mddev->bitmap_info.offset);
 
 #ifdef INJECT_FAULTS_3
 	outofdate = 1;
@@ -919,14 +944,17 @@ static int bitmap_init_from_disk(struct bitmap *bitmap, sector_t start)
 			"recovery\n", bmname(bitmap));
 
 	bytes = (chunks + 7) / 8;
+	if (!bitmap->mddev->bitmap_info.external)
+		bytes += sizeof(bitmap_super_t);
 
-	num_pages = (bytes + sizeof(bitmap_super_t) + PAGE_SIZE - 1) / PAGE_SIZE;
+	
+	num_pages = (bytes + PAGE_SIZE - 1) / PAGE_SIZE;
 
-	if (file && i_size_read(file->f_mapping->host) < bytes + sizeof(bitmap_super_t)) {
+	if (file && i_size_read(file->f_mapping->host) < bytes) {
 		printk(KERN_INFO "%s: bitmap file too short %lu < %lu\n",
 			bmname(bitmap),
 			(unsigned long) i_size_read(file->f_mapping->host),
-			bytes + sizeof(bitmap_super_t));
+			bytes);
 		goto err;
 	}
 
@@ -947,17 +975,16 @@ static int bitmap_init_from_disk(struct bitmap *bitmap, sector_t start)
 
 	for (i = 0; i < chunks; i++) {
 		int b;
-		index = file_page_index(i);
-		bit = file_page_offset(i);
+		index = file_page_index(bitmap, i);
+		bit = file_page_offset(bitmap, i);
 		if (index != oldindex) { /* this is a new page, read it in */
 			int count;
 			/* unmap the old page, we're done with it */
 			if (index == num_pages-1)
-				count = bytes + sizeof(bitmap_super_t)
-					- index * PAGE_SIZE;
+				count = bytes - index * PAGE_SIZE;
 			else
 				count = PAGE_SIZE;
-			if (index == 0) {
+			if (index == 0 && bitmap->sb_page) {
 				/*
 				 * if we're here then the superblock page
 				 * contains some bits (PAGE_SIZE != sizeof sb)
@@ -967,14 +994,15 @@ static int bitmap_init_from_disk(struct bitmap *bitmap, sector_t start)
 				offset = sizeof(bitmap_super_t);
 				if (!file)
 					read_sb_page(bitmap->mddev,
-						     bitmap->offset,
+						     bitmap->mddev->bitmap_info.offset,
 						     page,
 						     index, count);
 			} else if (file) {
 				page = read_page(file, index, bitmap, count);
 				offset = 0;
 			} else {
-				page = read_sb_page(bitmap->mddev, bitmap->offset,
+				page = read_sb_page(bitmap->mddev,
+						    bitmap->mddev->bitmap_info.offset,
 						    NULL,
 						    index, count);
 				offset = 0;
@@ -1078,23 +1106,32 @@ static bitmap_counter_t *bitmap_get_counter(struct bitmap *bitmap,
  *			out to disk
  */
 
-void bitmap_daemon_work(struct bitmap *bitmap)
+void bitmap_daemon_work(mddev_t *mddev)
 {
+	struct bitmap *bitmap;
 	unsigned long j;
 	unsigned long flags;
 	struct page *page = NULL, *lastpage = NULL;
 	int blocks;
 	void *paddr;
 
-	if (bitmap == NULL)
+	/* Use a mutex to guard daemon_work against
+	 * bitmap_destroy.
+	 */
+	mutex_lock(&mddev->bitmap_info.mutex);
+	bitmap = mddev->bitmap;
+	if (bitmap == NULL) {
+		mutex_unlock(&mddev->bitmap_info.mutex);
 		return;
-	if (time_before(jiffies, bitmap->daemon_lastrun + bitmap->daemon_sleep*HZ))
+	}
+	if (time_before(jiffies, bitmap->daemon_lastrun
+			+ bitmap->mddev->bitmap_info.daemon_sleep))
 		goto done;
 
 	bitmap->daemon_lastrun = jiffies;
 	if (bitmap->allclean) {
 		bitmap->mddev->thread->timeout = MAX_SCHEDULE_TIMEOUT;
-		return;
+		goto done;
 	}
 	bitmap->allclean = 1;
 
@@ -1142,7 +1179,8 @@ void bitmap_daemon_work(struct bitmap *bitmap)
 			/* We are possibly going to clear some bits, so make
 			 * sure that events_cleared is up-to-date.
 			 */
-			if (bitmap->need_sync) {
+			if (bitmap->need_sync &&
+			    bitmap->mddev->bitmap_info.external == 0) {
 				bitmap_super_t *sb;
 				bitmap->need_sync = 0;
 				sb = kmap_atomic(bitmap->sb_page, KM_USER0);
@@ -1152,7 +1190,8 @@ void bitmap_daemon_work(struct bitmap *bitmap)
 				write_page(bitmap, bitmap->sb_page, 1);
 			}
 			spin_lock_irqsave(&bitmap->lock, flags);
-			clear_page_attr(bitmap, page, BITMAP_PAGE_CLEAN);
+			if (!bitmap->need_sync)
+				clear_page_attr(bitmap, page, BITMAP_PAGE_CLEAN);
 		}
 		bmc = bitmap_get_counter(bitmap,
 					 (sector_t)j << CHUNK_BLOCK_SHIFT(bitmap),
@@ -1167,7 +1206,7 @@ void bitmap_daemon_work(struct bitmap *bitmap)
 			if (*bmc == 2) {
 				*bmc=1; /* maybe clear the bit next time */
 				set_page_attr(bitmap, page, BITMAP_PAGE_CLEAN);
-			} else if (*bmc == 1) {
+			} else if (*bmc == 1 && !bitmap->need_sync) {
 				/* we can clear the bit */
 				*bmc = 0;
 				bitmap_count_page(bitmap,
@@ -1177,9 +1216,11 @@ void bitmap_daemon_work(struct bitmap *bitmap)
 				/* clear the bit */
 				paddr = kmap_atomic(page, KM_USER0);
 				if (bitmap->flags & BITMAP_HOSTENDIAN)
-					clear_bit(file_page_offset(j), paddr);
+					clear_bit(file_page_offset(bitmap, j),
+						  paddr);
 				else
-					ext2_clear_bit(file_page_offset(j), paddr);
+					ext2_clear_bit(file_page_offset(bitmap, j),
+						       paddr);
 				kunmap_atomic(paddr, KM_USER0);
 			}
 		} else
@@ -1202,7 +1243,9 @@ void bitmap_daemon_work(struct bitmap *bitmap)
 
  done:
 	if (bitmap->allclean == 0)
-		bitmap->mddev->thread->timeout = bitmap->daemon_sleep * HZ;
+		bitmap->mddev->thread->timeout = 
+			bitmap->mddev->bitmap_info.daemon_sleep;
+	mutex_unlock(&mddev->bitmap_info.mutex);
 }
 
 static bitmap_counter_t *bitmap_get_counter(struct bitmap *bitmap,
@@ -1332,6 +1375,7 @@ void bitmap_endwrite(struct bitmap *bitmap, sector_t offset, unsigned long secto
 		    bitmap->events_cleared < bitmap->mddev->events) {
 			bitmap->events_cleared = bitmap->mddev->events;
 			bitmap->need_sync = 1;
+			sysfs_notify_dirent(bitmap->sysfs_can_clear);
 		}
 
 		if (!success && ! (*bmc & NEEDED_MASK))
@@ -1470,7 +1514,7 @@ void bitmap_cond_end_sync(struct bitmap *bitmap, sector_t sector)
 		return;
 	}
 	if (time_before(jiffies, (bitmap->last_end_sync
-				  + bitmap->daemon_sleep * HZ)))
+				  + bitmap->mddev->bitmap_info.daemon_sleep)))
 		return;
 	wait_event(bitmap->mddev->recovery_wait,
 		   atomic_read(&bitmap->mddev->recovery_active) == 0);
@@ -1522,6 +1566,12 @@ void bitmap_dirty_bits(struct bitmap *bitmap, unsigned long s, unsigned long e)
 		sector_t sec = (sector_t)chunk << CHUNK_BLOCK_SHIFT(bitmap);
 		bitmap_set_memory_bits(bitmap, sec, 1);
 		bitmap_file_set_bit(bitmap, sec);
+		if (sec < bitmap->mddev->recovery_cp)
+			/* We are asserting that the array is dirty,
+			 * so move the recovery_cp address back so
+			 * that it is obvious that it is dirty
+			 */
+			bitmap->mddev->recovery_cp = sec;
 	}
 }
 
@@ -1531,7 +1581,7 @@ void bitmap_dirty_bits(struct bitmap *bitmap, unsigned long s, unsigned long e)
 void bitmap_flush(mddev_t *mddev)
 {
 	struct bitmap *bitmap = mddev->bitmap;
-	int sleep;
+	long sleep;
 
 	if (!bitmap) /* there was no bitmap */
 		return;
@@ -1539,12 +1589,13 @@ void bitmap_flush(mddev_t *mddev)
 	/* run the daemon_work three time to ensure everything is flushed
 	 * that can be
 	 */
-	sleep = bitmap->daemon_sleep;
-	bitmap->daemon_sleep = 0;
-	bitmap_daemon_work(bitmap);
-	bitmap_daemon_work(bitmap);
-	bitmap_daemon_work(bitmap);
-	bitmap->daemon_sleep = sleep;
+	sleep = mddev->bitmap_info.daemon_sleep * 2;
+	bitmap->daemon_lastrun -= sleep;
+	bitmap_daemon_work(mddev);
+	bitmap->daemon_lastrun -= sleep;
+	bitmap_daemon_work(mddev);
+	bitmap->daemon_lastrun -= sleep;
+	bitmap_daemon_work(mddev);
 	bitmap_update_sb(bitmap);
 }
 
@@ -1574,6 +1625,7 @@ static void bitmap_free(struct bitmap *bitmap)
 	kfree(bp);
 	kfree(bitmap);
 }
+
 void bitmap_destroy(mddev_t *mddev)
 {
 	struct bitmap *bitmap = mddev->bitmap;
@@ -1581,10 +1633,15 @@ void bitmap_destroy(mddev_t *mddev)
 	if (!bitmap) /* there was no bitmap */
 		return;
 
+	mutex_lock(&mddev->bitmap_info.mutex);
 	mddev->bitmap = NULL; /* disconnect from the md device */
+	mutex_unlock(&mddev->bitmap_info.mutex);
 	if (mddev->thread)
 		mddev->thread->timeout = MAX_SCHEDULE_TIMEOUT;
 
+	if (bitmap->sysfs_can_clear)
+		sysfs_put(bitmap->sysfs_can_clear);
+
 	bitmap_free(bitmap);
 }
 
@@ -1598,16 +1655,17 @@ int bitmap_create(mddev_t *mddev)
 	sector_t blocks = mddev->resync_max_sectors;
 	unsigned long chunks;
 	unsigned long pages;
-	struct file *file = mddev->bitmap_file;
+	struct file *file = mddev->bitmap_info.file;
 	int err;
 	sector_t start;
+	struct sysfs_dirent *bm;
 
 	BUILD_BUG_ON(sizeof(bitmap_super_t) != 256);
 
-	if (!file && !mddev->bitmap_offset) /* bitmap disabled, nothing to do */
+	if (!file && !mddev->bitmap_info.offset) /* bitmap disabled, nothing to do */
 		return 0;
 
-	BUG_ON(file && mddev->bitmap_offset);
+	BUG_ON(file && mddev->bitmap_info.offset);
 
 	bitmap = kzalloc(sizeof(*bitmap), GFP_KERNEL);
 	if (!bitmap)
@@ -1620,8 +1678,14 @@ int bitmap_create(mddev_t *mddev)
 
 	bitmap->mddev = mddev;
 
+	bm = sysfs_get_dirent(mddev->kobj.sd, "bitmap");
+	if (bm) {
+		bitmap->sysfs_can_clear = sysfs_get_dirent(bm, "can_clear");
+		sysfs_put(bm);
+	} else
+		bitmap->sysfs_can_clear = NULL;
+
 	bitmap->file = file;
-	bitmap->offset = mddev->bitmap_offset;
 	if (file) {
 		get_file(file);
 		/* As future accesses to this file will use bmap,
@@ -1630,12 +1694,22 @@ int bitmap_create(mddev_t *mddev)
 		 */
 		vfs_fsync(file, file->f_dentry, 1);
 	}
-	/* read superblock from bitmap file (this sets bitmap->chunksize) */
-	err = bitmap_read_sb(bitmap);
+	/* read superblock from bitmap file (this sets mddev->bitmap_info.chunksize) */
+	if (!mddev->bitmap_info.external)
+		err = bitmap_read_sb(bitmap);
+	else {
+		err = 0;
+		if (mddev->bitmap_info.chunksize == 0 ||
+		    mddev->bitmap_info.daemon_sleep == 0)
+			/* chunksize and time_base need to be
+			 * set first. */
+			err = -EINVAL;
+	}
 	if (err)
 		goto error;
 
-	bitmap->chunkshift = ffz(~bitmap->chunksize);
+	bitmap->daemon_lastrun = jiffies;
+	bitmap->chunkshift = ffz(~mddev->bitmap_info.chunksize);
 
 	/* now that chunksize and chunkshift are set, we can use these macros */
  	chunks = (blocks + CHUNK_BLOCK_RATIO(bitmap) - 1) >>
@@ -1677,7 +1751,8 @@ int bitmap_create(mddev_t *mddev)
 
 	mddev->bitmap = bitmap;
 
-	mddev->thread->timeout = bitmap->daemon_sleep * HZ;
+	mddev->thread->timeout = mddev->bitmap_info.daemon_sleep;
+	md_wakeup_thread(mddev->thread);
 
 	bitmap_update_sb(bitmap);
 
@@ -1688,6 +1763,264 @@ int bitmap_create(mddev_t *mddev)
 	return err;
 }
 
+static ssize_t
+location_show(mddev_t *mddev, char *page)
+{
+	ssize_t len;
+	if (mddev->bitmap_info.file) {
+		len = sprintf(page, "file");
+	} else if (mddev->bitmap_info.offset) {
+		len = sprintf(page, "%+lld", (long long)mddev->bitmap_info.offset);
+	} else
+		len = sprintf(page, "none");
+	len += sprintf(page+len, "\n");
+	return len;
+}
+
+static ssize_t
+location_store(mddev_t *mddev, const char *buf, size_t len)
+{
+
+	if (mddev->pers) {
+		if (!mddev->pers->quiesce)
+			return -EBUSY;
+		if (mddev->recovery || mddev->sync_thread)
+			return -EBUSY;
+	}
+
+	if (mddev->bitmap || mddev->bitmap_info.file ||
+	    mddev->bitmap_info.offset) {
+		/* bitmap already configured.  Only option is to clear it */
+		if (strncmp(buf, "none", 4) != 0)
+			return -EBUSY;
+		if (mddev->pers) {
+			mddev->pers->quiesce(mddev, 1);
+			bitmap_destroy(mddev);
+			mddev->pers->quiesce(mddev, 0);
+		}
+		mddev->bitmap_info.offset = 0;
+		if (mddev->bitmap_info.file) {
+			struct file *f = mddev->bitmap_info.file;
+			mddev->bitmap_info.file = NULL;
+			restore_bitmap_write_access(f);
+			fput(f);
+		}
+	} else {
+		/* No bitmap, OK to set a location */
+		long long offset;
+		if (strncmp(buf, "none", 4) == 0)
+			/* nothing to be done */;
+		else if (strncmp(buf, "file:", 5) == 0) {
+			/* Not supported yet */
+			return -EINVAL;
+		} else {
+			int rv;
+			if (buf[0] == '+')
+				rv = strict_strtoll(buf+1, 10, &offset);
+			else
+				rv = strict_strtoll(buf, 10, &offset);
+			if (rv)
+				return rv;
+			if (offset == 0)
+				return -EINVAL;
+			if (mddev->bitmap_info.external == 0 &&
+			    mddev->major_version == 0 &&
+			    offset != mddev->bitmap_info.default_offset)
+				return -EINVAL;
+			mddev->bitmap_info.offset = offset;
+			if (mddev->pers) {
+				mddev->pers->quiesce(mddev, 1);
+				rv = bitmap_create(mddev);
+				if (rv) {
+					bitmap_destroy(mddev);
+					mddev->bitmap_info.offset = 0;
+				}
+				mddev->pers->quiesce(mddev, 0);
+				if (rv)
+					return rv;
+			}
+		}
+	}
+	if (!mddev->external) {
+		/* Ensure new bitmap info is stored in
+		 * metadata promptly.
+		 */
+		set_bit(MD_CHANGE_DEVS, &mddev->flags);
+		md_wakeup_thread(mddev->thread);
+	}
+	return len;
+}
+
+static struct md_sysfs_entry bitmap_location =
+__ATTR(location, S_IRUGO|S_IWUSR, location_show, location_store);
+
+static ssize_t
+timeout_show(mddev_t *mddev, char *page)
+{
+	ssize_t len;
+	unsigned long secs = mddev->bitmap_info.daemon_sleep / HZ;
+	unsigned long jifs = mddev->bitmap_info.daemon_sleep % HZ;
+	
+	len = sprintf(page, "%lu", secs);
+	if (jifs)
+		len += sprintf(page+len, ".%03u", jiffies_to_msecs(jifs));
+	len += sprintf(page+len, "\n");
+	return len;
+}
+
+static ssize_t
+timeout_store(mddev_t *mddev, const char *buf, size_t len)
+{
+	/* timeout can be set at any time */
+	unsigned long timeout;
+	int rv = strict_strtoul_scaled(buf, &timeout, 4);
+	if (rv)
+		return rv;
+
+	/* just to make sure we don't overflow... */
+	if (timeout >= LONG_MAX / HZ)
+		return -EINVAL;
+
+	timeout = timeout * HZ / 10000;
+
+	if (timeout >= MAX_SCHEDULE_TIMEOUT)
+		timeout = MAX_SCHEDULE_TIMEOUT-1;
+	if (timeout < 1)
+		timeout = 1;
+	mddev->bitmap_info.daemon_sleep = timeout;
+	if (mddev->thread) {
+		/* if thread->timeout is MAX_SCHEDULE_TIMEOUT, then
+		 * the bitmap is all clean and we don't need to
+		 * adjust the timeout right now
+		 */
+		if (mddev->thread->timeout < MAX_SCHEDULE_TIMEOUT) {
+			mddev->thread->timeout = timeout;
+			md_wakeup_thread(mddev->thread);
+		}
+	}
+	return len;
+}
+
+static struct md_sysfs_entry bitmap_timeout =
+__ATTR(time_base, S_IRUGO|S_IWUSR, timeout_show, timeout_store);
+
+static ssize_t
+backlog_show(mddev_t *mddev, char *page)
+{
+	return sprintf(page, "%lu\n", mddev->bitmap_info.max_write_behind);
+}
+
+static ssize_t
+backlog_store(mddev_t *mddev, const char *buf, size_t len)
+{
+	unsigned long backlog;
+	int rv = strict_strtoul(buf, 10, &backlog);
+	if (rv)
+		return rv;
+	if (backlog > COUNTER_MAX)
+		return -EINVAL;
+	mddev->bitmap_info.max_write_behind = backlog;
+	return len;
+}
+
+static struct md_sysfs_entry bitmap_backlog =
+__ATTR(backlog, S_IRUGO|S_IWUSR, backlog_show, backlog_store);
+
+static ssize_t
+chunksize_show(mddev_t *mddev, char *page)
+{
+	return sprintf(page, "%lu\n", mddev->bitmap_info.chunksize);
+}
+
+static ssize_t
+chunksize_store(mddev_t *mddev, const char *buf, size_t len)
+{
+	/* Can only be changed when no bitmap is active */
+	int rv;
+	unsigned long csize;
+	if (mddev->bitmap)
+		return -EBUSY;
+	rv = strict_strtoul(buf, 10, &csize);
+	if (rv)
+		return rv;
+	if (csize < 512 ||
+	    !is_power_of_2(csize))
+		return -EINVAL;
+	mddev->bitmap_info.chunksize = csize;
+	return len;
+}
+
+static struct md_sysfs_entry bitmap_chunksize =
+__ATTR(chunksize, S_IRUGO|S_IWUSR, chunksize_show, chunksize_store);
+
+static ssize_t metadata_show(mddev_t *mddev, char *page)
+{
+	return sprintf(page, "%s\n", (mddev->bitmap_info.external
+				      ? "external" : "internal"));
+}
+
+static ssize_t metadata_store(mddev_t *mddev, const char *buf, size_t len)
+{
+	if (mddev->bitmap ||
+	    mddev->bitmap_info.file ||
+	    mddev->bitmap_info.offset)
+		return -EBUSY;
+	if (strncmp(buf, "external", 8) == 0)
+		mddev->bitmap_info.external = 1;
+	else if (strncmp(buf, "internal", 8) == 0)
+		mddev->bitmap_info.external = 0;
+	else
+		return -EINVAL;
+	return len;
+}
+
+static struct md_sysfs_entry bitmap_metadata =
+__ATTR(metadata, S_IRUGO|S_IWUSR, metadata_show, metadata_store);
+
+static ssize_t can_clear_show(mddev_t *mddev, char *page)
+{
+	int len;
+	if (mddev->bitmap)
+		len = sprintf(page, "%s\n", (mddev->bitmap->need_sync ?
+					     "false" : "true"));
+	else
+		len = sprintf(page, "\n");
+	return len;
+}
+
+static ssize_t can_clear_store(mddev_t *mddev, const char *buf, size_t len)
+{
+	if (mddev->bitmap == NULL)
+		return -ENOENT;
+	if (strncmp(buf, "false", 5) == 0)
+		mddev->bitmap->need_sync = 1;
+	else if (strncmp(buf, "true", 4) == 0) {
+		if (mddev->degraded)
+			return -EBUSY;
+		mddev->bitmap->need_sync = 0;
+	} else
+		return -EINVAL;
+	return len;
+}
+
+static struct md_sysfs_entry bitmap_can_clear =
+__ATTR(can_clear, S_IRUGO|S_IWUSR, can_clear_show, can_clear_store);
+
+static struct attribute *md_bitmap_attrs[] = {
+	&bitmap_location.attr,
+	&bitmap_timeout.attr,
+	&bitmap_backlog.attr,
+	&bitmap_chunksize.attr,
+	&bitmap_metadata.attr,
+	&bitmap_can_clear.attr,
+	NULL
+};
+struct attribute_group md_bitmap_group = {
+	.name = "bitmap",
+	.attrs = md_bitmap_attrs,
+};
+
+
 /* the bitmap API -- for raid personalities */
 EXPORT_SYMBOL(bitmap_startwrite);
 EXPORT_SYMBOL(bitmap_endwrite);
diff --git a/drivers/md/bitmap.h b/drivers/md/bitmap.h
index e98900671ca9..cb821d76d1b4 100644
--- a/drivers/md/bitmap.h
+++ b/drivers/md/bitmap.h
@@ -106,7 +106,7 @@ typedef __u16 bitmap_counter_t;
 #define BITMAP_BLOCK_SHIFT 9
 
 /* how many blocks per chunk? (this is variable) */
-#define CHUNK_BLOCK_RATIO(bitmap) ((bitmap)->chunksize >> BITMAP_BLOCK_SHIFT)
+#define CHUNK_BLOCK_RATIO(bitmap) ((bitmap)->mddev->bitmap_info.chunksize >> BITMAP_BLOCK_SHIFT)
 #define CHUNK_BLOCK_SHIFT(bitmap) ((bitmap)->chunkshift - BITMAP_BLOCK_SHIFT)
 #define CHUNK_BLOCK_MASK(bitmap) (CHUNK_BLOCK_RATIO(bitmap) - 1)
 
@@ -118,16 +118,6 @@ typedef __u16 bitmap_counter_t;
 			(CHUNK_BLOCK_SHIFT(bitmap) + PAGE_COUNTER_SHIFT - 1)
 #define PAGEPTR_BLOCK_MASK(bitmap) (PAGEPTR_BLOCK_RATIO(bitmap) - 1)
 
-/*
- * on-disk bitmap:
- *
- * Use one bit per "chunk" (block set). We do the disk I/O on the bitmap
- * file a page at a time. There's a superblock at the start of the file.
- */
-
-/* map chunks (bits) to file pages - offset by the size of the superblock */
-#define CHUNK_BIT_OFFSET(chunk) ((chunk) + (sizeof(bitmap_super_t) << 3))
-
 #endif
 
 /*
@@ -209,7 +199,6 @@ struct bitmap {
 	int counter_bits; /* how many bits per block counter */
 
 	/* bitmap chunksize -- how much data does each bit represent? */
-	unsigned long chunksize;
 	unsigned long chunkshift; /* chunksize = 2^chunkshift (for bitops) */
 	unsigned long chunks; /* total number of data chunks for the array */
 
@@ -226,7 +215,6 @@ struct bitmap {
 	/* bitmap spinlock */
 	spinlock_t lock;
 
-	long offset; /* offset from superblock if file is NULL */
 	struct file *file; /* backing disk file */
 	struct page *sb_page; /* cached copy of the bitmap file superblock */
 	struct page **filemap; /* list of cache pages for the file */
@@ -238,7 +226,6 @@ struct bitmap {
 
 	int allclean;
 
-	unsigned long max_write_behind; /* write-behind mode */
 	atomic_t behind_writes;
 
 	/*
@@ -246,7 +233,6 @@ struct bitmap {
 	 * file, cleaning up bits and flushing out pages to disk as necessary
 	 */
 	unsigned long daemon_lastrun; /* jiffies of last run */
-	unsigned long daemon_sleep; /* how many seconds between updates? */
 	unsigned long last_end_sync; /* when we lasted called end_sync to
 				      * update bitmap with resync progress */
 
@@ -254,6 +240,7 @@ struct bitmap {
 	wait_queue_head_t write_wait;
 	wait_queue_head_t overflow_wait;
 
+	struct sysfs_dirent *sysfs_can_clear;
 };
 
 /* the bitmap API */
@@ -282,7 +269,7 @@ void bitmap_close_sync(struct bitmap *bitmap);
 void bitmap_cond_end_sync(struct bitmap *bitmap, sector_t sector);
 
 void bitmap_unplug(struct bitmap *bitmap);
-void bitmap_daemon_work(struct bitmap *bitmap);
+void bitmap_daemon_work(mddev_t *mddev);
 #endif
 
 #endif
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index ed1038164019..a93637223c8d 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 2003 Christophe Saout <christophe@saout.de>
  * Copyright (C) 2004 Clemens Fruhwirth <clemens@endorphin.org>
- * Copyright (C) 2006-2008 Red Hat, Inc. All rights reserved.
+ * Copyright (C) 2006-2009 Red Hat, Inc. All rights reserved.
  *
  * This file is released under the GPL.
  */
@@ -71,10 +71,21 @@ struct crypt_iv_operations {
 	int (*ctr)(struct crypt_config *cc, struct dm_target *ti,
 		   const char *opts);
 	void (*dtr)(struct crypt_config *cc);
-	const char *(*status)(struct crypt_config *cc);
+	int (*init)(struct crypt_config *cc);
+	int (*wipe)(struct crypt_config *cc);
 	int (*generator)(struct crypt_config *cc, u8 *iv, sector_t sector);
 };
 
+struct iv_essiv_private {
+	struct crypto_cipher *tfm;
+	struct crypto_hash *hash_tfm;
+	u8 *salt;
+};
+
+struct iv_benbi_private {
+	int shift;
+};
+
 /*
  * Crypt: maps a linear range of a block device
  * and encrypts / decrypts at the same time.
@@ -102,8 +113,8 @@ struct crypt_config {
 	struct crypt_iv_operations *iv_gen_ops;
 	char *iv_mode;
 	union {
-		struct crypto_cipher *essiv_tfm;
-		int benbi_shift;
+		struct iv_essiv_private essiv;
+		struct iv_benbi_private benbi;
 	} iv_gen_private;
 	sector_t iv_offset;
 	unsigned int iv_size;
@@ -147,6 +158,9 @@ static void kcryptd_queue_crypt(struct dm_crypt_io *io);
  * plain: the initial vector is the 32-bit little-endian version of the sector
  *        number, padded with zeros if necessary.
  *
+ * plain64: the initial vector is the 64-bit little-endian version of the sector
+ *        number, padded with zeros if necessary.
+ *
  * essiv: "encrypted sector|salt initial vector", the sector number is
  *        encrypted with the bulk cipher using a salt as key. The salt
  *        should be derived from the bulk cipher's key via hashing.
@@ -169,88 +183,123 @@ static int crypt_iv_plain_gen(struct crypt_config *cc, u8 *iv, sector_t sector)
 	return 0;
 }
 
-static int crypt_iv_essiv_ctr(struct crypt_config *cc, struct dm_target *ti,
-			      const char *opts)
+static int crypt_iv_plain64_gen(struct crypt_config *cc, u8 *iv,
+				sector_t sector)
 {
-	struct crypto_cipher *essiv_tfm;
-	struct crypto_hash *hash_tfm;
+	memset(iv, 0, cc->iv_size);
+	*(u64 *)iv = cpu_to_le64(sector);
+
+	return 0;
+}
+
+/* Initialise ESSIV - compute salt but no local memory allocations */
+static int crypt_iv_essiv_init(struct crypt_config *cc)
+{
+	struct iv_essiv_private *essiv = &cc->iv_gen_private.essiv;
 	struct hash_desc desc;
 	struct scatterlist sg;
-	unsigned int saltsize;
-	u8 *salt;
 	int err;
 
-	if (opts == NULL) {
+	sg_init_one(&sg, cc->key, cc->key_size);
+	desc.tfm = essiv->hash_tfm;
+	desc.flags = CRYPTO_TFM_REQ_MAY_SLEEP;
+
+	err = crypto_hash_digest(&desc, &sg, cc->key_size, essiv->salt);
+	if (err)
+		return err;
+
+	return crypto_cipher_setkey(essiv->tfm, essiv->salt,
+				    crypto_hash_digestsize(essiv->hash_tfm));
+}
+
+/* Wipe salt and reset key derived from volume key */
+static int crypt_iv_essiv_wipe(struct crypt_config *cc)
+{
+	struct iv_essiv_private *essiv = &cc->iv_gen_private.essiv;
+	unsigned salt_size = crypto_hash_digestsize(essiv->hash_tfm);
+
+	memset(essiv->salt, 0, salt_size);
+
+	return crypto_cipher_setkey(essiv->tfm, essiv->salt, salt_size);
+}
+
+static void crypt_iv_essiv_dtr(struct crypt_config *cc)
+{
+	struct iv_essiv_private *essiv = &cc->iv_gen_private.essiv;
+
+	crypto_free_cipher(essiv->tfm);
+	essiv->tfm = NULL;
+
+	crypto_free_hash(essiv->hash_tfm);
+	essiv->hash_tfm = NULL;
+
+	kzfree(essiv->salt);
+	essiv->salt = NULL;
+}
+
+static int crypt_iv_essiv_ctr(struct crypt_config *cc, struct dm_target *ti,
+			      const char *opts)
+{
+	struct crypto_cipher *essiv_tfm = NULL;
+	struct crypto_hash *hash_tfm = NULL;
+	u8 *salt = NULL;
+	int err;
+
+	if (!opts) {
 		ti->error = "Digest algorithm missing for ESSIV mode";
 		return -EINVAL;
 	}
 
-	/* Hash the cipher key with the given hash algorithm */
+	/* Allocate hash algorithm */
 	hash_tfm = crypto_alloc_hash(opts, 0, CRYPTO_ALG_ASYNC);
 	if (IS_ERR(hash_tfm)) {
 		ti->error = "Error initializing ESSIV hash";
-		return PTR_ERR(hash_tfm);
+		err = PTR_ERR(hash_tfm);
+		goto bad;
 	}
 
-	saltsize = crypto_hash_digestsize(hash_tfm);
-	salt = kmalloc(saltsize, GFP_KERNEL);
-	if (salt == NULL) {
+	salt = kzalloc(crypto_hash_digestsize(hash_tfm), GFP_KERNEL);
+	if (!salt) {
 		ti->error = "Error kmallocing salt storage in ESSIV";
-		crypto_free_hash(hash_tfm);
-		return -ENOMEM;
+		err = -ENOMEM;
+		goto bad;
 	}
 
-	sg_init_one(&sg, cc->key, cc->key_size);
-	desc.tfm = hash_tfm;
-	desc.flags = CRYPTO_TFM_REQ_MAY_SLEEP;
-	err = crypto_hash_digest(&desc, &sg, cc->key_size, salt);
-	crypto_free_hash(hash_tfm);
-
-	if (err) {
-		ti->error = "Error calculating hash in ESSIV";
-		kfree(salt);
-		return err;
-	}
-
-	/* Setup the essiv_tfm with the given salt */
+	/* Allocate essiv_tfm */
 	essiv_tfm = crypto_alloc_cipher(cc->cipher, 0, CRYPTO_ALG_ASYNC);
 	if (IS_ERR(essiv_tfm)) {
 		ti->error = "Error allocating crypto tfm for ESSIV";
-		kfree(salt);
-		return PTR_ERR(essiv_tfm);
+		err = PTR_ERR(essiv_tfm);
+		goto bad;
 	}
 	if (crypto_cipher_blocksize(essiv_tfm) !=
 	    crypto_ablkcipher_ivsize(cc->tfm)) {
 		ti->error = "Block size of ESSIV cipher does "
 			    "not match IV size of block cipher";
-		crypto_free_cipher(essiv_tfm);
-		kfree(salt);
-		return -EINVAL;
+		err = -EINVAL;
+		goto bad;
 	}
-	err = crypto_cipher_setkey(essiv_tfm, salt, saltsize);
-	if (err) {
-		ti->error = "Failed to set key for ESSIV cipher";
-		crypto_free_cipher(essiv_tfm);
-		kfree(salt);
-		return err;
-	}
-	kfree(salt);
 
-	cc->iv_gen_private.essiv_tfm = essiv_tfm;
+	cc->iv_gen_private.essiv.salt = salt;
+	cc->iv_gen_private.essiv.tfm = essiv_tfm;
+	cc->iv_gen_private.essiv.hash_tfm = hash_tfm;
+
 	return 0;
-}
 
-static void crypt_iv_essiv_dtr(struct crypt_config *cc)
-{
-	crypto_free_cipher(cc->iv_gen_private.essiv_tfm);
-	cc->iv_gen_private.essiv_tfm = NULL;
+bad:
+	if (essiv_tfm && !IS_ERR(essiv_tfm))
+		crypto_free_cipher(essiv_tfm);
+	if (hash_tfm && !IS_ERR(hash_tfm))
+		crypto_free_hash(hash_tfm);
+	kfree(salt);
+	return err;
 }
 
 static int crypt_iv_essiv_gen(struct crypt_config *cc, u8 *iv, sector_t sector)
 {
 	memset(iv, 0, cc->iv_size);
 	*(u64 *)iv = cpu_to_le64(sector);
-	crypto_cipher_encrypt_one(cc->iv_gen_private.essiv_tfm, iv, iv);
+	crypto_cipher_encrypt_one(cc->iv_gen_private.essiv.tfm, iv, iv);
 	return 0;
 }
 
@@ -273,7 +322,7 @@ static int crypt_iv_benbi_ctr(struct crypt_config *cc, struct dm_target *ti,
 		return -EINVAL;
 	}
 
-	cc->iv_gen_private.benbi_shift = 9 - log;
+	cc->iv_gen_private.benbi.shift = 9 - log;
 
 	return 0;
 }
@@ -288,7 +337,7 @@ static int crypt_iv_benbi_gen(struct crypt_config *cc, u8 *iv, sector_t sector)
 
 	memset(iv, 0, cc->iv_size - sizeof(u64)); /* rest is cleared below */
 
-	val = cpu_to_be64(((u64)sector << cc->iv_gen_private.benbi_shift) + 1);
+	val = cpu_to_be64(((u64)sector << cc->iv_gen_private.benbi.shift) + 1);
 	put_unaligned(val, (__be64 *)(iv + cc->iv_size - sizeof(u64)));
 
 	return 0;
@@ -305,9 +354,15 @@ static struct crypt_iv_operations crypt_iv_plain_ops = {
 	.generator = crypt_iv_plain_gen
 };
 
+static struct crypt_iv_operations crypt_iv_plain64_ops = {
+	.generator = crypt_iv_plain64_gen
+};
+
 static struct crypt_iv_operations crypt_iv_essiv_ops = {
 	.ctr       = crypt_iv_essiv_ctr,
 	.dtr       = crypt_iv_essiv_dtr,
+	.init      = crypt_iv_essiv_init,
+	.wipe      = crypt_iv_essiv_wipe,
 	.generator = crypt_iv_essiv_gen
 };
 
@@ -934,14 +989,14 @@ static int crypt_set_key(struct crypt_config *cc, char *key)
 
 	set_bit(DM_CRYPT_KEY_VALID, &cc->flags);
 
-	return 0;
+	return crypto_ablkcipher_setkey(cc->tfm, cc->key, cc->key_size);
 }
 
 static int crypt_wipe_key(struct crypt_config *cc)
 {
 	clear_bit(DM_CRYPT_KEY_VALID, &cc->flags);
 	memset(&cc->key, 0, cc->key_size * sizeof(u8));
-	return 0;
+	return crypto_ablkcipher_setkey(cc->tfm, cc->key, cc->key_size);
 }
 
 /*
@@ -983,12 +1038,7 @@ static int crypt_ctr(struct dm_target *ti, unsigned int argc, char **argv)
 		return -ENOMEM;
 	}
 
- 	if (crypt_set_key(cc, argv[1])) {
-		ti->error = "Error decoding key";
-		goto bad_cipher;
-	}
-
-	/* Compatiblity mode for old dm-crypt cipher strings */
+	/* Compatibility mode for old dm-crypt cipher strings */
 	if (!chainmode || (strcmp(chainmode, "plain") == 0 && !ivmode)) {
 		chainmode = "cbc";
 		ivmode = "plain";
@@ -1015,6 +1065,11 @@ static int crypt_ctr(struct dm_target *ti, unsigned int argc, char **argv)
 	strcpy(cc->chainmode, chainmode);
 	cc->tfm = tfm;
 
+	if (crypt_set_key(cc, argv[1]) < 0) {
+		ti->error = "Error decoding and setting key";
+		goto bad_ivmode;
+	}
+
 	/*
 	 * Choose ivmode. Valid modes: "plain", "essiv:<esshash>", "benbi".
 	 * See comments at iv code
@@ -1024,6 +1079,8 @@ static int crypt_ctr(struct dm_target *ti, unsigned int argc, char **argv)
 		cc->iv_gen_ops = NULL;
 	else if (strcmp(ivmode, "plain") == 0)
 		cc->iv_gen_ops = &crypt_iv_plain_ops;
+	else if (strcmp(ivmode, "plain64") == 0)
+		cc->iv_gen_ops = &crypt_iv_plain64_ops;
 	else if (strcmp(ivmode, "essiv") == 0)
 		cc->iv_gen_ops = &crypt_iv_essiv_ops;
 	else if (strcmp(ivmode, "benbi") == 0)
@@ -1039,6 +1096,12 @@ static int crypt_ctr(struct dm_target *ti, unsigned int argc, char **argv)
 	    cc->iv_gen_ops->ctr(cc, ti, ivopts) < 0)
 		goto bad_ivmode;
 
+	if (cc->iv_gen_ops && cc->iv_gen_ops->init &&
+	    cc->iv_gen_ops->init(cc) < 0) {
+		ti->error = "Error initialising IV";
+		goto bad_slab_pool;
+	}
+
 	cc->iv_size = crypto_ablkcipher_ivsize(tfm);
 	if (cc->iv_size)
 		/* at least a 64 bit sector number should fit in our buffer */
@@ -1085,11 +1148,6 @@ static int crypt_ctr(struct dm_target *ti, unsigned int argc, char **argv)
 		goto bad_bs;
 	}
 
-	if (crypto_ablkcipher_setkey(tfm, cc->key, key_size) < 0) {
-		ti->error = "Error setting key";
-		goto bad_device;
-	}
-
 	if (sscanf(argv[2], "%llu", &tmpll) != 1) {
 		ti->error = "Invalid iv_offset sector";
 		goto bad_device;
@@ -1278,6 +1336,7 @@ static void crypt_resume(struct dm_target *ti)
 static int crypt_message(struct dm_target *ti, unsigned argc, char **argv)
 {
 	struct crypt_config *cc = ti->private;
+	int ret = -EINVAL;
 
 	if (argc < 2)
 		goto error;
@@ -1287,10 +1346,22 @@ static int crypt_message(struct dm_target *ti, unsigned argc, char **argv)
 			DMWARN("not suspended during key manipulation.");
 			return -EINVAL;
 		}
-		if (argc == 3 && !strnicmp(argv[1], MESG_STR("set")))
-			return crypt_set_key(cc, argv[2]);
-		if (argc == 2 && !strnicmp(argv[1], MESG_STR("wipe")))
+		if (argc == 3 && !strnicmp(argv[1], MESG_STR("set"))) {
+			ret = crypt_set_key(cc, argv[2]);
+			if (ret)
+				return ret;
+			if (cc->iv_gen_ops && cc->iv_gen_ops->init)
+				ret = cc->iv_gen_ops->init(cc);
+			return ret;
+		}
+		if (argc == 2 && !strnicmp(argv[1], MESG_STR("wipe"))) {
+			if (cc->iv_gen_ops && cc->iv_gen_ops->wipe) {
+				ret = cc->iv_gen_ops->wipe(cc);
+				if (ret)
+					return ret;
+			}
 			return crypt_wipe_key(cc);
+		}
 	}
 
 error:
diff --git a/drivers/md/dm-exception-store.c b/drivers/md/dm-exception-store.c
index 7dbe652efb5a..2b7907b6dd09 100644
--- a/drivers/md/dm-exception-store.c
+++ b/drivers/md/dm-exception-store.c
@@ -172,7 +172,8 @@ int dm_exception_store_set_chunk_size(struct dm_exception_store *store,
 	}
 
 	/* Validate the chunk size against the device block size */
-	if (chunk_size % (bdev_logical_block_size(store->cow->bdev) >> 9)) {
+	if (chunk_size %
+	    (bdev_logical_block_size(dm_snap_cow(store->snap)->bdev) >> 9)) {
 		*error = "Chunk size is not a multiple of device blocksize";
 		return -EINVAL;
 	}
@@ -190,6 +191,7 @@ int dm_exception_store_set_chunk_size(struct dm_exception_store *store,
 }
 
 int dm_exception_store_create(struct dm_target *ti, int argc, char **argv,
+			      struct dm_snapshot *snap,
 			      unsigned *args_used,
 			      struct dm_exception_store **store)
 {
@@ -198,7 +200,7 @@ int dm_exception_store_create(struct dm_target *ti, int argc, char **argv,
 	struct dm_exception_store *tmp_store;
 	char persistent;
 
-	if (argc < 3) {
+	if (argc < 2) {
 		ti->error = "Insufficient exception store arguments";
 		return -EINVAL;
 	}
@@ -209,14 +211,15 @@ int dm_exception_store_create(struct dm_target *ti, int argc, char **argv,
 		return -ENOMEM;
 	}
 
-	persistent = toupper(*argv[1]);
+	persistent = toupper(*argv[0]);
 	if (persistent == 'P')
 		type = get_type("P");
 	else if (persistent == 'N')
 		type = get_type("N");
 	else {
 		ti->error = "Persistent flag is not P or N";
-		return -EINVAL;
+		r = -EINVAL;
+		goto bad_type;
 	}
 
 	if (!type) {
@@ -226,32 +229,23 @@ int dm_exception_store_create(struct dm_target *ti, int argc, char **argv,
 	}
 
 	tmp_store->type = type;
-	tmp_store->ti = ti;
-
-	r = dm_get_device(ti, argv[0], 0, 0,
-			  FMODE_READ | FMODE_WRITE, &tmp_store->cow);
-	if (r) {
-		ti->error = "Cannot get COW device";
-		goto bad_cow;
-	}
+	tmp_store->snap = snap;
 
-	r = set_chunk_size(tmp_store, argv[2], &ti->error);
+	r = set_chunk_size(tmp_store, argv[1], &ti->error);
 	if (r)
-		goto bad_ctr;
+		goto bad;
 
 	r = type->ctr(tmp_store, 0, NULL);
 	if (r) {
 		ti->error = "Exception store type constructor failed";
-		goto bad_ctr;
+		goto bad;
 	}
 
-	*args_used = 3;
+	*args_used = 2;
 	*store = tmp_store;
 	return 0;
 
-bad_ctr:
-	dm_put_device(ti, tmp_store->cow);
-bad_cow:
+bad:
 	put_type(type);
 bad_type:
 	kfree(tmp_store);
@@ -262,7 +256,6 @@ EXPORT_SYMBOL(dm_exception_store_create);
 void dm_exception_store_destroy(struct dm_exception_store *store)
 {
 	store->type->dtr(store);
-	dm_put_device(store->ti, store->cow);
 	put_type(store->type);
 	kfree(store);
 }
diff --git a/drivers/md/dm-exception-store.h b/drivers/md/dm-exception-store.h
index 8a223a48802c..e8dfa06af3ba 100644
--- a/drivers/md/dm-exception-store.h
+++ b/drivers/md/dm-exception-store.h
@@ -26,7 +26,7 @@ typedef sector_t chunk_t;
  * of chunks that follow contiguously.  Remaining bits hold the number of the
  * chunk within the device.
  */
-struct dm_snap_exception {
+struct dm_exception {
 	struct list_head hash_list;
 
 	chunk_t old_chunk;
@@ -64,17 +64,34 @@ struct dm_exception_store_type {
 	 * Find somewhere to store the next exception.
 	 */
 	int (*prepare_exception) (struct dm_exception_store *store,
-				  struct dm_snap_exception *e);
+				  struct dm_exception *e);
 
 	/*
 	 * Update the metadata with this exception.
 	 */
 	void (*commit_exception) (struct dm_exception_store *store,
-				  struct dm_snap_exception *e,
+				  struct dm_exception *e,
 				  void (*callback) (void *, int success),
 				  void *callback_context);
 
 	/*
+	 * Returns 0 if the exception store is empty.
+	 *
+	 * If there are exceptions still to be merged, sets
+	 * *last_old_chunk and *last_new_chunk to the most recent
+	 * still-to-be-merged chunk and returns the number of
+	 * consecutive previous ones.
+	 */
+	int (*prepare_merge) (struct dm_exception_store *store,
+			      chunk_t *last_old_chunk, chunk_t *last_new_chunk);
+
+	/*
+	 * Clear the last n exceptions.
+	 * nr_merged must be <= the value returned by prepare_merge.
+	 */
+	int (*commit_merge) (struct dm_exception_store *store, int nr_merged);
+
+	/*
 	 * The snapshot is invalid, note this in the metadata.
 	 */
 	void (*drop_snapshot) (struct dm_exception_store *store);
@@ -86,19 +103,19 @@ struct dm_exception_store_type {
 	/*
 	 * Return how full the snapshot is.
 	 */
-	void (*fraction_full) (struct dm_exception_store *store,
-			       sector_t *numerator,
-			       sector_t *denominator);
+	void (*usage) (struct dm_exception_store *store,
+		       sector_t *total_sectors, sector_t *sectors_allocated,
+		       sector_t *metadata_sectors);
 
 	/* For internal device-mapper use only. */
 	struct list_head list;
 };
 
+struct dm_snapshot;
+
 struct dm_exception_store {
 	struct dm_exception_store_type *type;
-	struct dm_target *ti;
-
-	struct dm_dev *cow;
+	struct dm_snapshot *snap;
 
 	/* Size of data blocks saved - must be a power of 2 */
 	unsigned chunk_size;
@@ -109,6 +126,11 @@ struct dm_exception_store {
 };
 
 /*
+ * Obtain the cow device used by a given snapshot.
+ */
+struct dm_dev *dm_snap_cow(struct dm_snapshot *snap);
+
+/*
  * Funtions to manipulate consecutive chunks
  */
 #  if defined(CONFIG_LBDAF) || (BITS_PER_LONG == 64)
@@ -120,18 +142,25 @@ static inline chunk_t dm_chunk_number(chunk_t chunk)
 	return chunk & (chunk_t)((1ULL << DM_CHUNK_NUMBER_BITS) - 1ULL);
 }
 
-static inline unsigned dm_consecutive_chunk_count(struct dm_snap_exception *e)
+static inline unsigned dm_consecutive_chunk_count(struct dm_exception *e)
 {
 	return e->new_chunk >> DM_CHUNK_NUMBER_BITS;
 }
 
-static inline void dm_consecutive_chunk_count_inc(struct dm_snap_exception *e)
+static inline void dm_consecutive_chunk_count_inc(struct dm_exception *e)
 {
 	e->new_chunk += (1ULL << DM_CHUNK_NUMBER_BITS);
 
 	BUG_ON(!dm_consecutive_chunk_count(e));
 }
 
+static inline void dm_consecutive_chunk_count_dec(struct dm_exception *e)
+{
+	BUG_ON(!dm_consecutive_chunk_count(e));
+
+	e->new_chunk -= (1ULL << DM_CHUNK_NUMBER_BITS);
+}
+
 #  else
 #    define DM_CHUNK_CONSECUTIVE_BITS 0
 
@@ -140,12 +169,16 @@ static inline chunk_t dm_chunk_number(chunk_t chunk)
 	return chunk;
 }
 
-static inline unsigned dm_consecutive_chunk_count(struct dm_snap_exception *e)
+static inline unsigned dm_consecutive_chunk_count(struct dm_exception *e)
 {
 	return 0;
 }
 
-static inline void dm_consecutive_chunk_count_inc(struct dm_snap_exception *e)
+static inline void dm_consecutive_chunk_count_inc(struct dm_exception *e)
+{
+}
+
+static inline void dm_consecutive_chunk_count_dec(struct dm_exception *e)
 {
 }
 
@@ -162,7 +195,7 @@ static inline sector_t get_dev_size(struct block_device *bdev)
 static inline chunk_t sector_to_chunk(struct dm_exception_store *store,
 				      sector_t sector)
 {
-	return (sector & ~store->chunk_mask) >> store->chunk_shift;
+	return sector >> store->chunk_shift;
 }
 
 int dm_exception_store_type_register(struct dm_exception_store_type *type);
@@ -173,6 +206,7 @@ int dm_exception_store_set_chunk_size(struct dm_exception_store *store,
 				      char **error);
 
 int dm_exception_store_create(struct dm_target *ti, int argc, char **argv,
+			      struct dm_snapshot *snap,
 			      unsigned *args_used,
 			      struct dm_exception_store **store);
 void dm_exception_store_destroy(struct dm_exception_store *store);
diff --git a/drivers/md/dm-io.c b/drivers/md/dm-io.c
index 3a2e6a2f8bdd..10f457ca6af2 100644
--- a/drivers/md/dm-io.c
+++ b/drivers/md/dm-io.c
@@ -5,6 +5,8 @@
  * This file is released under the GPL.
  */
 
+#include "dm.h"
+
 #include <linux/device-mapper.h>
 
 #include <linux/bio.h>
@@ -14,12 +16,19 @@
 #include <linux/slab.h>
 #include <linux/dm-io.h>
 
+#define DM_MSG_PREFIX "io"
+
+#define DM_IO_MAX_REGIONS	BITS_PER_LONG
+
 struct dm_io_client {
 	mempool_t *pool;
 	struct bio_set *bios;
 };
 
-/* FIXME: can we shrink this ? */
+/*
+ * Aligning 'struct io' reduces the number of bits required to store
+ * its address.  Refer to store_io_and_region_in_bio() below.
+ */
 struct io {
 	unsigned long error_bits;
 	unsigned long eopnotsupp_bits;
@@ -28,7 +37,9 @@ struct io {
 	struct dm_io_client *client;
 	io_notify_fn callback;
 	void *context;
-};
+} __attribute__((aligned(DM_IO_MAX_REGIONS)));
+
+static struct kmem_cache *_dm_io_cache;
 
 /*
  * io contexts are only dynamically allocated for asynchronous
@@ -53,7 +64,7 @@ struct dm_io_client *dm_io_client_create(unsigned num_pages)
 	if (!client)
 		return ERR_PTR(-ENOMEM);
 
-	client->pool = mempool_create_kmalloc_pool(ios, sizeof(struct io));
+	client->pool = mempool_create_slab_pool(ios, _dm_io_cache);
 	if (!client->pool)
 		goto bad;
 
@@ -88,18 +99,29 @@ EXPORT_SYMBOL(dm_io_client_destroy);
 
 /*-----------------------------------------------------------------
  * We need to keep track of which region a bio is doing io for.
- * In order to save a memory allocation we store this the last
- * bvec which we know is unused (blech).
- * XXX This is ugly and can OOPS with some configs... find another way.
+ * To avoid a memory allocation to store just 5 or 6 bits, we
+ * ensure the 'struct io' pointer is aligned so enough low bits are
+ * always zero and then combine it with the region number directly in
+ * bi_private.
  *---------------------------------------------------------------*/
-static inline void bio_set_region(struct bio *bio, unsigned region)
+static void store_io_and_region_in_bio(struct bio *bio, struct io *io,
+				       unsigned region)
 {
-	bio->bi_io_vec[bio->bi_max_vecs].bv_len = region;
+	if (unlikely(!IS_ALIGNED((unsigned long)io, DM_IO_MAX_REGIONS))) {
+		DMCRIT("Unaligned struct io pointer %p", io);
+		BUG();
+	}
+
+	bio->bi_private = (void *)((unsigned long)io | region);
 }
 
-static inline unsigned bio_get_region(struct bio *bio)
+static void retrieve_io_and_region_from_bio(struct bio *bio, struct io **io,
+				       unsigned *region)
 {
-	return bio->bi_io_vec[bio->bi_max_vecs].bv_len;
+	unsigned long val = (unsigned long)bio->bi_private;
+
+	*io = (void *)(val & -(unsigned long)DM_IO_MAX_REGIONS);
+	*region = val & (DM_IO_MAX_REGIONS - 1);
 }
 
 /*-----------------------------------------------------------------
@@ -140,10 +162,8 @@ static void endio(struct bio *bio, int error)
 	/*
 	 * The bio destructor in bio_put() may use the io object.
 	 */
-	io = bio->bi_private;
-	region = bio_get_region(bio);
+	retrieve_io_and_region_from_bio(bio, &io, &region);
 
-	bio->bi_max_vecs++;
 	bio_put(bio);
 
 	dec_count(io, region, error);
@@ -243,7 +263,10 @@ static void vm_dp_init(struct dpages *dp, void *data)
 
 static void dm_bio_destructor(struct bio *bio)
 {
-	struct io *io = bio->bi_private;
+	unsigned region;
+	struct io *io;
+
+	retrieve_io_and_region_from_bio(bio, &io, &region);
 
 	bio_free(bio, io->client->bios);
 }
@@ -286,26 +309,23 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where,
 	unsigned num_bvecs;
 	sector_t remaining = where->count;
 
-	while (remaining) {
+	/*
+	 * where->count may be zero if rw holds a write barrier and we
+	 * need to send a zero-sized barrier.
+	 */
+	do {
 		/*
-		 * Allocate a suitably sized-bio: we add an extra
-		 * bvec for bio_get/set_region() and decrement bi_max_vecs
-		 * to hide it from bio_add_page().
+		 * Allocate a suitably sized-bio.
 		 */
 		num_bvecs = dm_sector_div_up(remaining,
 					     (PAGE_SIZE >> SECTOR_SHIFT));
-		num_bvecs = 1 + min_t(int, bio_get_nr_vecs(where->bdev),
-				      num_bvecs);
-		if (unlikely(num_bvecs > BIO_MAX_PAGES))
-			num_bvecs = BIO_MAX_PAGES;
+		num_bvecs = min_t(int, bio_get_nr_vecs(where->bdev), num_bvecs);
 		bio = bio_alloc_bioset(GFP_NOIO, num_bvecs, io->client->bios);
 		bio->bi_sector = where->sector + (where->count - remaining);
 		bio->bi_bdev = where->bdev;
 		bio->bi_end_io = endio;
-		bio->bi_private = io;
 		bio->bi_destructor = dm_bio_destructor;
-		bio->bi_max_vecs--;
-		bio_set_region(bio, region);
+		store_io_and_region_in_bio(bio, io, region);
 
 		/*
 		 * Try and add as many pages as possible.
@@ -323,7 +343,7 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where,
 
 		atomic_inc(&io->count);
 		submit_bio(rw, bio);
-	}
+	} while (remaining);
 }
 
 static void dispatch_io(int rw, unsigned int num_regions,
@@ -333,6 +353,8 @@ static void dispatch_io(int rw, unsigned int num_regions,
 	int i;
 	struct dpages old_pages = *dp;
 
+	BUG_ON(num_regions > DM_IO_MAX_REGIONS);
+
 	if (sync)
 		rw |= (1 << BIO_RW_SYNCIO) | (1 << BIO_RW_UNPLUG);
 
@@ -342,7 +364,7 @@ static void dispatch_io(int rw, unsigned int num_regions,
 	 */
 	for (i = 0; i < num_regions; i++) {
 		*dp = old_pages;
-		if (where[i].count)
+		if (where[i].count || (rw & (1 << BIO_RW_BARRIER)))
 			do_region(rw, i, where + i, dp, io);
 	}
 
@@ -357,7 +379,14 @@ static int sync_io(struct dm_io_client *client, unsigned int num_regions,
 		   struct dm_io_region *where, int rw, struct dpages *dp,
 		   unsigned long *error_bits)
 {
-	struct io io;
+	/*
+	 * gcc <= 4.3 can't do the alignment for stack variables, so we must
+	 * align it on our own.
+	 * volatile prevents the optimizer from removing or reusing
+	 * "io_" field from the stack frame (allowed in ANSI C).
+	 */
+	volatile char io_[sizeof(struct io) + __alignof__(struct io) - 1];
+	struct io *io = (struct io *)PTR_ALIGN(&io_, __alignof__(struct io));
 
 	if (num_regions > 1 && (rw & RW_MASK) != WRITE) {
 		WARN_ON(1);
@@ -365,33 +394,33 @@ static int sync_io(struct dm_io_client *client, unsigned int num_regions,
 	}
 
 retry:
-	io.error_bits = 0;
-	io.eopnotsupp_bits = 0;
-	atomic_set(&io.count, 1); /* see dispatch_io() */
-	io.sleeper = current;
-	io.client = client;
+	io->error_bits = 0;
+	io->eopnotsupp_bits = 0;
+	atomic_set(&io->count, 1); /* see dispatch_io() */
+	io->sleeper = current;
+	io->client = client;
 
-	dispatch_io(rw, num_regions, where, dp, &io, 1);
+	dispatch_io(rw, num_regions, where, dp, io, 1);
 
 	while (1) {
 		set_current_state(TASK_UNINTERRUPTIBLE);
 
-		if (!atomic_read(&io.count))
+		if (!atomic_read(&io->count))
 			break;
 
 		io_schedule();
 	}
 	set_current_state(TASK_RUNNING);
 
-	if (io.eopnotsupp_bits && (rw & (1 << BIO_RW_BARRIER))) {
+	if (io->eopnotsupp_bits && (rw & (1 << BIO_RW_BARRIER))) {
 		rw &= ~(1 << BIO_RW_BARRIER);
 		goto retry;
 	}
 
 	if (error_bits)
-		*error_bits = io.error_bits;
+		*error_bits = io->error_bits;
 
-	return io.error_bits ? -EIO : 0;
+	return io->error_bits ? -EIO : 0;
 }
 
 static int async_io(struct dm_io_client *client, unsigned int num_regions,
@@ -472,3 +501,18 @@ int dm_io(struct dm_io_request *io_req, unsigned num_regions,
 			&dp, io_req->notify.fn, io_req->notify.context);
 }
 EXPORT_SYMBOL(dm_io);
+
+int __init dm_io_init(void)
+{
+	_dm_io_cache = KMEM_CACHE(io, 0);
+	if (!_dm_io_cache)
+		return -ENOMEM;
+
+	return 0;
+}
+
+void dm_io_exit(void)
+{
+	kmem_cache_destroy(_dm_io_cache);
+	_dm_io_cache = NULL;
+}
diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index a67942931582..1d669322b27c 100644
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -56,6 +56,11 @@ static void dm_hash_remove_all(int keep_open_devices);
  */
 static DECLARE_RWSEM(_hash_lock);
 
+/*
+ * Protects use of mdptr to obtain hash cell name and uuid from mapped device.
+ */
+static DEFINE_MUTEX(dm_hash_cells_mutex);
+
 static void init_buckets(struct list_head *buckets)
 {
 	unsigned int i;
@@ -206,7 +211,9 @@ static int dm_hash_insert(const char *name, const char *uuid, struct mapped_devi
 		list_add(&cell->uuid_list, _uuid_buckets + hash_str(uuid));
 	}
 	dm_get(md);
+	mutex_lock(&dm_hash_cells_mutex);
 	dm_set_mdptr(md, cell);
+	mutex_unlock(&dm_hash_cells_mutex);
 	up_write(&_hash_lock);
 
 	return 0;
@@ -224,9 +231,11 @@ static void __hash_remove(struct hash_cell *hc)
 	/* remove from the dev hash */
 	list_del(&hc->uuid_list);
 	list_del(&hc->name_list);
+	mutex_lock(&dm_hash_cells_mutex);
 	dm_set_mdptr(hc->md, NULL);
+	mutex_unlock(&dm_hash_cells_mutex);
 
-	table = dm_get_table(hc->md);
+	table = dm_get_live_table(hc->md);
 	if (table) {
 		dm_table_event(table);
 		dm_table_put(table);
@@ -321,13 +330,15 @@ static int dm_hash_rename(uint32_t cookie, const char *old, const char *new)
 	 */
 	list_del(&hc->name_list);
 	old_name = hc->name;
+	mutex_lock(&dm_hash_cells_mutex);
 	hc->name = new_name;
+	mutex_unlock(&dm_hash_cells_mutex);
 	list_add(&hc->name_list, _name_buckets + hash_str(new_name));
 
 	/*
 	 * Wake up any dm event waiters.
 	 */
-	table = dm_get_table(hc->md);
+	table = dm_get_live_table(hc->md);
 	if (table) {
 		dm_table_event(table);
 		dm_table_put(table);
@@ -512,8 +523,6 @@ static int list_versions(struct dm_ioctl *param, size_t param_size)
 	return 0;
 }
 
-
-
 static int check_name(const char *name)
 {
 	if (strchr(name, '/')) {
@@ -525,6 +534,40 @@ static int check_name(const char *name)
 }
 
 /*
+ * On successful return, the caller must not attempt to acquire
+ * _hash_lock without first calling dm_table_put, because dm_table_destroy
+ * waits for this dm_table_put and could be called under this lock.
+ */
+static struct dm_table *dm_get_inactive_table(struct mapped_device *md)
+{
+	struct hash_cell *hc;
+	struct dm_table *table = NULL;
+
+	down_read(&_hash_lock);
+	hc = dm_get_mdptr(md);
+	if (!hc || hc->md != md) {
+		DMWARN("device has been removed from the dev hash table.");
+		goto out;
+	}
+
+	table = hc->new_map;
+	if (table)
+		dm_table_get(table);
+
+out:
+	up_read(&_hash_lock);
+
+	return table;
+}
+
+static struct dm_table *dm_get_live_or_inactive_table(struct mapped_device *md,
+						      struct dm_ioctl *param)
+{
+	return (param->flags & DM_QUERY_INACTIVE_TABLE_FLAG) ?
+		dm_get_inactive_table(md) : dm_get_live_table(md);
+}
+
+/*
  * Fills in a dm_ioctl structure, ready for sending back to
  * userland.
  */
@@ -536,7 +579,7 @@ static int __dev_status(struct mapped_device *md, struct dm_ioctl *param)
 	param->flags &= ~(DM_SUSPEND_FLAG | DM_READONLY_FLAG |
 			  DM_ACTIVE_PRESENT_FLAG);
 
-	if (dm_suspended(md))
+	if (dm_suspended_md(md))
 		param->flags |= DM_SUSPEND_FLAG;
 
 	param->dev = huge_encode_dev(disk_devt(disk));
@@ -548,18 +591,30 @@ static int __dev_status(struct mapped_device *md, struct dm_ioctl *param)
 	 */
 	param->open_count = dm_open_count(md);
 
-	if (get_disk_ro(disk))
-		param->flags |= DM_READONLY_FLAG;
-
 	param->event_nr = dm_get_event_nr(md);
+	param->target_count = 0;
 
-	table = dm_get_table(md);
+	table = dm_get_live_table(md);
 	if (table) {
-		param->flags |= DM_ACTIVE_PRESENT_FLAG;
-		param->target_count = dm_table_get_num_targets(table);
+		if (!(param->flags & DM_QUERY_INACTIVE_TABLE_FLAG)) {
+			if (get_disk_ro(disk))
+				param->flags |= DM_READONLY_FLAG;
+			param->target_count = dm_table_get_num_targets(table);
+		}
 		dm_table_put(table);
-	} else
-		param->target_count = 0;
+
+		param->flags |= DM_ACTIVE_PRESENT_FLAG;
+	}
+
+	if (param->flags & DM_QUERY_INACTIVE_TABLE_FLAG) {
+		table = dm_get_inactive_table(md);
+		if (table) {
+			if (!(dm_table_get_mode(table) & FMODE_WRITE))
+				param->flags |= DM_READONLY_FLAG;
+			param->target_count = dm_table_get_num_targets(table);
+			dm_table_put(table);
+		}
+	}
 
 	return 0;
 }
@@ -634,9 +689,9 @@ static struct mapped_device *find_device(struct dm_ioctl *param)
 		 * Sneakily write in both the name and the uuid
 		 * while we have the cell.
 		 */
-		strncpy(param->name, hc->name, sizeof(param->name));
+		strlcpy(param->name, hc->name, sizeof(param->name));
 		if (hc->uuid)
-			strncpy(param->uuid, hc->uuid, sizeof(param->uuid)-1);
+			strlcpy(param->uuid, hc->uuid, sizeof(param->uuid));
 		else
 			param->uuid[0] = '\0';
 
@@ -784,7 +839,7 @@ static int do_suspend(struct dm_ioctl *param)
 	if (param->flags & DM_NOFLUSH_FLAG)
 		suspend_flags |= DM_SUSPEND_NOFLUSH_FLAG;
 
-	if (!dm_suspended(md))
+	if (!dm_suspended_md(md))
 		r = dm_suspend(md, suspend_flags);
 
 	if (!r)
@@ -800,7 +855,7 @@ static int do_resume(struct dm_ioctl *param)
 	unsigned suspend_flags = DM_SUSPEND_LOCKFS_FLAG;
 	struct hash_cell *hc;
 	struct mapped_device *md;
-	struct dm_table *new_map;
+	struct dm_table *new_map, *old_map = NULL;
 
 	down_write(&_hash_lock);
 
@@ -826,14 +881,14 @@ static int do_resume(struct dm_ioctl *param)
 			suspend_flags &= ~DM_SUSPEND_LOCKFS_FLAG;
 		if (param->flags & DM_NOFLUSH_FLAG)
 			suspend_flags |= DM_SUSPEND_NOFLUSH_FLAG;
-		if (!dm_suspended(md))
+		if (!dm_suspended_md(md))
 			dm_suspend(md, suspend_flags);
 
-		r = dm_swap_table(md, new_map);
-		if (r) {
+		old_map = dm_swap_table(md, new_map);
+		if (IS_ERR(old_map)) {
 			dm_table_destroy(new_map);
 			dm_put(md);
-			return r;
+			return PTR_ERR(old_map);
 		}
 
 		if (dm_table_get_mode(new_map) & FMODE_WRITE)
@@ -842,9 +897,11 @@ static int do_resume(struct dm_ioctl *param)
 			set_disk_ro(dm_disk(md), 1);
 	}
 
-	if (dm_suspended(md))
+	if (dm_suspended_md(md))
 		r = dm_resume(md);
 
+	if (old_map)
+		dm_table_destroy(old_map);
 
 	if (!r) {
 		dm_kobject_uevent(md, KOBJ_CHANGE, param->event_nr);
@@ -982,7 +1039,7 @@ static int dev_wait(struct dm_ioctl *param, size_t param_size)
 	if (r)
 		goto out;
 
-	table = dm_get_table(md);
+	table = dm_get_live_or_inactive_table(md, param);
 	if (table) {
 		retrieve_status(table, param, param_size);
 		dm_table_put(table);
@@ -1215,7 +1272,7 @@ static int table_deps(struct dm_ioctl *param, size_t param_size)
 	if (r)
 		goto out;
 
-	table = dm_get_table(md);
+	table = dm_get_live_or_inactive_table(md, param);
 	if (table) {
 		retrieve_deps(table, param, param_size);
 		dm_table_put(table);
@@ -1244,13 +1301,13 @@ static int table_status(struct dm_ioctl *param, size_t param_size)
 	if (r)
 		goto out;
 
-	table = dm_get_table(md);
+	table = dm_get_live_or_inactive_table(md, param);
 	if (table) {
 		retrieve_status(table, param, param_size);
 		dm_table_put(table);
 	}
 
- out:
+out:
 	dm_put(md);
 	return r;
 }
@@ -1288,10 +1345,15 @@ static int target_message(struct dm_ioctl *param, size_t param_size)
 		goto out;
 	}
 
-	table = dm_get_table(md);
+	table = dm_get_live_table(md);
 	if (!table)
 		goto out_argv;
 
+	if (dm_deleting_md(md)) {
+		r = -ENXIO;
+		goto out_table;
+	}
+
 	ti = dm_table_find_target(table, tmsg->sector);
 	if (!dm_target_is_valid(ti)) {
 		DMWARN("Target message sector outside device.");
@@ -1303,6 +1365,7 @@ static int target_message(struct dm_ioctl *param, size_t param_size)
 		r = -EINVAL;
 	}
 
+ out_table:
 	dm_table_put(table);
  out_argv:
 	kfree(argv);
@@ -1582,8 +1645,7 @@ int dm_copy_name_and_uuid(struct mapped_device *md, char *name, char *uuid)
 	if (!md)
 		return -ENXIO;
 
-	dm_get(md);
-	down_read(&_hash_lock);
+	mutex_lock(&dm_hash_cells_mutex);
 	hc = dm_get_mdptr(md);
 	if (!hc || hc->md != md) {
 		r = -ENXIO;
@@ -1596,8 +1658,7 @@ int dm_copy_name_and_uuid(struct mapped_device *md, char *name, char *uuid)
 		strcpy(uuid, hc->uuid ? : "");
 
 out:
-	up_read(&_hash_lock);
-	dm_put(md);
+	mutex_unlock(&dm_hash_cells_mutex);
 
 	return r;
 }
diff --git a/drivers/md/dm-kcopyd.c b/drivers/md/dm-kcopyd.c
index 3e3fc06cb861..addf83475040 100644
--- a/drivers/md/dm-kcopyd.c
+++ b/drivers/md/dm-kcopyd.c
@@ -450,7 +450,10 @@ static void dispatch_job(struct kcopyd_job *job)
 {
 	struct dm_kcopyd_client *kc = job->kc;
 	atomic_inc(&kc->nr_jobs);
-	push(&kc->pages_jobs, job);
+	if (unlikely(!job->source.count))
+		push(&kc->complete_jobs, job);
+	else
+		push(&kc->pages_jobs, job);
 	wake(kc);
 }
 
diff --git a/drivers/md/dm-log.c b/drivers/md/dm-log.c
index 9443896ede07..7035582786fb 100644
--- a/drivers/md/dm-log.c
+++ b/drivers/md/dm-log.c
@@ -145,8 +145,9 @@ int dm_dirty_log_type_unregister(struct dm_dirty_log_type *type)
 EXPORT_SYMBOL(dm_dirty_log_type_unregister);
 
 struct dm_dirty_log *dm_dirty_log_create(const char *type_name,
-					 struct dm_target *ti,
-					 unsigned int argc, char **argv)
+			struct dm_target *ti,
+			int (*flush_callback_fn)(struct dm_target *ti),
+			unsigned int argc, char **argv)
 {
 	struct dm_dirty_log_type *type;
 	struct dm_dirty_log *log;
@@ -161,6 +162,7 @@ struct dm_dirty_log *dm_dirty_log_create(const char *type_name,
 		return NULL;
 	}
 
+	log->flush_callback_fn = flush_callback_fn;
 	log->type = type;
 	if (type->ctr(log, ti, argc, argv)) {
 		kfree(log);
@@ -208,7 +210,9 @@ struct log_header {
 
 struct log_c {
 	struct dm_target *ti;
-	int touched;
+	int touched_dirtied;
+	int touched_cleaned;
+	int flush_failed;
 	uint32_t region_size;
 	unsigned int region_count;
 	region_t sync_count;
@@ -233,6 +237,7 @@ struct log_c {
 	 * Disk log fields
 	 */
 	int log_dev_failed;
+	int log_dev_flush_failed;
 	struct dm_dev *log_dev;
 	struct log_header header;
 
@@ -253,14 +258,14 @@ static inline void log_set_bit(struct log_c *l,
 			       uint32_t *bs, unsigned bit)
 {
 	ext2_set_bit(bit, (unsigned long *) bs);
-	l->touched = 1;
+	l->touched_cleaned = 1;
 }
 
 static inline void log_clear_bit(struct log_c *l,
 				 uint32_t *bs, unsigned bit)
 {
 	ext2_clear_bit(bit, (unsigned long *) bs);
-	l->touched = 1;
+	l->touched_dirtied = 1;
 }
 
 /*----------------------------------------------------------------
@@ -287,6 +292,19 @@ static int rw_header(struct log_c *lc, int rw)
 	return dm_io(&lc->io_req, 1, &lc->header_location, NULL);
 }
 
+static int flush_header(struct log_c *lc)
+{
+	struct dm_io_region null_location = {
+		.bdev = lc->header_location.bdev,
+		.sector = 0,
+		.count = 0,
+	};
+
+	lc->io_req.bi_rw = WRITE_BARRIER;
+
+	return dm_io(&lc->io_req, 1, &null_location, NULL);
+}
+
 static int read_header(struct log_c *log)
 {
 	int r;
@@ -378,7 +396,9 @@ static int create_log_context(struct dm_dirty_log *log, struct dm_target *ti,
 	}
 
 	lc->ti = ti;
-	lc->touched = 0;
+	lc->touched_dirtied = 0;
+	lc->touched_cleaned = 0;
+	lc->flush_failed = 0;
 	lc->region_size = region_size;
 	lc->region_count = region_count;
 	lc->sync = sync;
@@ -406,6 +426,7 @@ static int create_log_context(struct dm_dirty_log *log, struct dm_target *ti,
 	} else {
 		lc->log_dev = dev;
 		lc->log_dev_failed = 0;
+		lc->log_dev_flush_failed = 0;
 		lc->header_location.bdev = lc->log_dev->bdev;
 		lc->header_location.sector = 0;
 
@@ -614,6 +635,11 @@ static int disk_resume(struct dm_dirty_log *log)
 
 	/* write the new header */
 	r = rw_header(lc, WRITE);
+	if (!r) {
+		r = flush_header(lc);
+		if (r)
+			lc->log_dev_flush_failed = 1;
+	}
 	if (r) {
 		DMWARN("%s: Failed to write header on dirty region log device",
 		       lc->log_dev->name);
@@ -656,18 +682,40 @@ static int core_flush(struct dm_dirty_log *log)
 
 static int disk_flush(struct dm_dirty_log *log)
 {
-	int r;
-	struct log_c *lc = (struct log_c *) log->context;
+	int r, i;
+	struct log_c *lc = log->context;
 
 	/* only write if the log has changed */
-	if (!lc->touched)
+	if (!lc->touched_cleaned && !lc->touched_dirtied)
 		return 0;
 
+	if (lc->touched_cleaned && log->flush_callback_fn &&
+	    log->flush_callback_fn(lc->ti)) {
+		/*
+		 * At this point it is impossible to determine which
+		 * regions are clean and which are dirty (without
+		 * re-reading the log off disk). So mark all of them
+		 * dirty.
+		 */
+		lc->flush_failed = 1;
+		for (i = 0; i < lc->region_count; i++)
+			log_clear_bit(lc, lc->clean_bits, i);
+	}
+
 	r = rw_header(lc, WRITE);
 	if (r)
 		fail_log_device(lc);
-	else
-		lc->touched = 0;
+	else {
+		if (lc->touched_dirtied) {
+			r = flush_header(lc);
+			if (r) {
+				lc->log_dev_flush_failed = 1;
+				fail_log_device(lc);
+			} else
+				lc->touched_dirtied = 0;
+		}
+		lc->touched_cleaned = 0;
+	}
 
 	return r;
 }
@@ -681,7 +729,8 @@ static void core_mark_region(struct dm_dirty_log *log, region_t region)
 static void core_clear_region(struct dm_dirty_log *log, region_t region)
 {
 	struct log_c *lc = (struct log_c *) log->context;
-	log_set_bit(lc, lc->clean_bits, region);
+	if (likely(!lc->flush_failed))
+		log_set_bit(lc, lc->clean_bits, region);
 }
 
 static int core_get_resync_work(struct dm_dirty_log *log, region_t *region)
@@ -762,7 +811,9 @@ static int disk_status(struct dm_dirty_log *log, status_type_t status,
 	switch(status) {
 	case STATUSTYPE_INFO:
 		DMEMIT("3 %s %s %c", log->type->name, lc->log_dev->name,
-		       lc->log_dev_failed ? 'D' : 'A');
+		       lc->log_dev_flush_failed ? 'F' :
+		       lc->log_dev_failed ? 'D' :
+		       'A');
 		break;
 
 	case STATUSTYPE_TABLE:
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index 32d0b878eccc..e81345a1d08f 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -93,6 +93,10 @@ struct multipath {
 	 * can resubmit bios on error.
 	 */
 	mempool_t *mpio_pool;
+
+	struct mutex work_mutex;
+
+	unsigned suspended;	/* Don't create new I/O internally when set. */
 };
 
 /*
@@ -198,6 +202,7 @@ static struct multipath *alloc_multipath(struct dm_target *ti)
 		m->queue_io = 1;
 		INIT_WORK(&m->process_queued_ios, process_queued_ios);
 		INIT_WORK(&m->trigger_event, trigger_event);
+		mutex_init(&m->work_mutex);
 		m->mpio_pool = mempool_create_slab_pool(MIN_IOS, _mpio_cache);
 		if (!m->mpio_pool) {
 			kfree(m);
@@ -885,13 +890,18 @@ static int multipath_ctr(struct dm_target *ti, unsigned int argc,
 	return r;
 }
 
-static void multipath_dtr(struct dm_target *ti)
+static void flush_multipath_work(void)
 {
-	struct multipath *m = (struct multipath *) ti->private;
-
 	flush_workqueue(kmpath_handlerd);
 	flush_workqueue(kmultipathd);
 	flush_scheduled_work();
+}
+
+static void multipath_dtr(struct dm_target *ti)
+{
+	struct multipath *m = ti->private;
+
+	flush_multipath_work();
 	free_multipath(m);
 }
 
@@ -1116,8 +1126,9 @@ static int pg_init_limit_reached(struct multipath *m, struct pgpath *pgpath)
 	return limit_reached;
 }
 
-static void pg_init_done(struct dm_path *path, int errors)
+static void pg_init_done(void *data, int errors)
 {
+	struct dm_path *path = data;
 	struct pgpath *pgpath = path_to_pgpath(path);
 	struct priority_group *pg = pgpath->pg;
 	struct multipath *m = pg->m;
@@ -1183,12 +1194,11 @@ static void pg_init_done(struct dm_path *path, int errors)
 
 static void activate_path(struct work_struct *work)
 {
-	int ret;
 	struct pgpath *pgpath =
 		container_of(work, struct pgpath, activate_path);
 
-	ret = scsi_dh_activate(bdev_get_queue(pgpath->path.dev->bdev));
-	pg_init_done(&pgpath->path, ret);
+	scsi_dh_activate(bdev_get_queue(pgpath->path.dev->bdev),
+				pg_init_done, &pgpath->path);
 }
 
 /*
@@ -1261,6 +1271,16 @@ static void multipath_presuspend(struct dm_target *ti)
 	queue_if_no_path(m, 0, 1);
 }
 
+static void multipath_postsuspend(struct dm_target *ti)
+{
+	struct multipath *m = ti->private;
+
+	mutex_lock(&m->work_mutex);
+	m->suspended = 1;
+	flush_multipath_work();
+	mutex_unlock(&m->work_mutex);
+}
+
 /*
  * Restore the queue_if_no_path setting.
  */
@@ -1269,6 +1289,10 @@ static void multipath_resume(struct dm_target *ti)
 	struct multipath *m = (struct multipath *) ti->private;
 	unsigned long flags;
 
+	mutex_lock(&m->work_mutex);
+	m->suspended = 0;
+	mutex_unlock(&m->work_mutex);
+
 	spin_lock_irqsave(&m->lock, flags);
 	m->queue_if_no_path = m->saved_queue_if_no_path;
 	spin_unlock_irqrestore(&m->lock, flags);
@@ -1397,51 +1421,71 @@ static int multipath_status(struct dm_target *ti, status_type_t type,
 
 static int multipath_message(struct dm_target *ti, unsigned argc, char **argv)
 {
-	int r;
+	int r = -EINVAL;
 	struct dm_dev *dev;
 	struct multipath *m = (struct multipath *) ti->private;
 	action_fn action;
 
+	mutex_lock(&m->work_mutex);
+
+	if (m->suspended) {
+		r = -EBUSY;
+		goto out;
+	}
+
+	if (dm_suspended(ti)) {
+		r = -EBUSY;
+		goto out;
+	}
+
 	if (argc == 1) {
-		if (!strnicmp(argv[0], MESG_STR("queue_if_no_path")))
-			return queue_if_no_path(m, 1, 0);
-		else if (!strnicmp(argv[0], MESG_STR("fail_if_no_path")))
-			return queue_if_no_path(m, 0, 0);
+		if (!strnicmp(argv[0], MESG_STR("queue_if_no_path"))) {
+			r = queue_if_no_path(m, 1, 0);
+			goto out;
+		} else if (!strnicmp(argv[0], MESG_STR("fail_if_no_path"))) {
+			r = queue_if_no_path(m, 0, 0);
+			goto out;
+		}
 	}
 
-	if (argc != 2)
-		goto error;
+	if (argc != 2) {
+		DMWARN("Unrecognised multipath message received.");
+		goto out;
+	}
 
-	if (!strnicmp(argv[0], MESG_STR("disable_group")))
-		return bypass_pg_num(m, argv[1], 1);
-	else if (!strnicmp(argv[0], MESG_STR("enable_group")))
-		return bypass_pg_num(m, argv[1], 0);
-	else if (!strnicmp(argv[0], MESG_STR("switch_group")))
-		return switch_pg_num(m, argv[1]);
-	else if (!strnicmp(argv[0], MESG_STR("reinstate_path")))
+	if (!strnicmp(argv[0], MESG_STR("disable_group"))) {
+		r = bypass_pg_num(m, argv[1], 1);
+		goto out;
+	} else if (!strnicmp(argv[0], MESG_STR("enable_group"))) {
+		r = bypass_pg_num(m, argv[1], 0);
+		goto out;
+	} else if (!strnicmp(argv[0], MESG_STR("switch_group"))) {
+		r = switch_pg_num(m, argv[1]);
+		goto out;
+	} else if (!strnicmp(argv[0], MESG_STR("reinstate_path")))
 		action = reinstate_path;
 	else if (!strnicmp(argv[0], MESG_STR("fail_path")))
 		action = fail_path;
-	else
-		goto error;
+	else {
+		DMWARN("Unrecognised multipath message received.");
+		goto out;
+	}
 
 	r = dm_get_device(ti, argv[1], ti->begin, ti->len,
 			  dm_table_get_mode(ti->table), &dev);
 	if (r) {
 		DMWARN("message: error getting device %s",
 		       argv[1]);
-		return -EINVAL;
+		goto out;
 	}
 
 	r = action_dev(m, dev, action);
 
 	dm_put_device(ti, dev);
 
+out:
+	mutex_unlock(&m->work_mutex);
 	return r;
-
-error:
-	DMWARN("Unrecognised multipath message received.");
-	return -EINVAL;
 }
 
 static int multipath_ioctl(struct dm_target *ti, unsigned int cmd,
@@ -1567,13 +1611,14 @@ out:
  *---------------------------------------------------------------*/
 static struct target_type multipath_target = {
 	.name = "multipath",
-	.version = {1, 1, 0},
+	.version = {1, 1, 1},
 	.module = THIS_MODULE,
 	.ctr = multipath_ctr,
 	.dtr = multipath_dtr,
 	.map_rq = multipath_map,
 	.rq_end_io = multipath_end_io,
 	.presuspend = multipath_presuspend,
+	.postsuspend = multipath_postsuspend,
 	.resume = multipath_resume,
 	.status = multipath_status,
 	.message = multipath_message,
diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
index cc9dc79b0784..ad779bd13aec 100644
--- a/drivers/md/dm-raid1.c
+++ b/drivers/md/dm-raid1.c
@@ -35,6 +35,7 @@ static DECLARE_WAIT_QUEUE_HEAD(_kmirrord_recovery_stopped);
  *---------------------------------------------------------------*/
 enum dm_raid1_error {
 	DM_RAID1_WRITE_ERROR,
+	DM_RAID1_FLUSH_ERROR,
 	DM_RAID1_SYNC_ERROR,
 	DM_RAID1_READ_ERROR
 };
@@ -57,6 +58,7 @@ struct mirror_set {
 	struct bio_list reads;
 	struct bio_list writes;
 	struct bio_list failures;
+	struct bio_list holds;	/* bios are waiting until suspend */
 
 	struct dm_region_hash *rh;
 	struct dm_kcopyd_client *kcopyd_client;
@@ -67,6 +69,7 @@ struct mirror_set {
 	region_t nr_regions;
 	int in_sync;
 	int log_failure;
+	int leg_failure;
 	atomic_t suspend;
 
 	atomic_t default_mirror;	/* Default mirror */
@@ -179,6 +182,17 @@ static void set_default_mirror(struct mirror *m)
 	atomic_set(&ms->default_mirror, m - m0);
 }
 
+static struct mirror *get_valid_mirror(struct mirror_set *ms)
+{
+	struct mirror *m;
+
+	for (m = ms->mirror; m < ms->mirror + ms->nr_mirrors; m++)
+		if (!atomic_read(&m->error_count))
+			return m;
+
+	return NULL;
+}
+
 /* fail_mirror
  * @m: mirror device to fail
  * @error_type: one of the enum's, DM_RAID1_*_ERROR
@@ -198,6 +212,8 @@ static void fail_mirror(struct mirror *m, enum dm_raid1_error error_type)
 	struct mirror_set *ms = m->ms;
 	struct mirror *new;
 
+	ms->leg_failure = 1;
+
 	/*
 	 * error_count is used for nothing more than a
 	 * simple way to tell if a device has encountered
@@ -224,19 +240,50 @@ static void fail_mirror(struct mirror *m, enum dm_raid1_error error_type)
 		goto out;
 	}
 
-	for (new = ms->mirror; new < ms->mirror + ms->nr_mirrors; new++)
-		if (!atomic_read(&new->error_count)) {
-			set_default_mirror(new);
-			break;
-		}
-
-	if (unlikely(new == ms->mirror + ms->nr_mirrors))
+	new = get_valid_mirror(ms);
+	if (new)
+		set_default_mirror(new);
+	else
 		DMWARN("All sides of mirror have failed.");
 
 out:
 	schedule_work(&ms->trigger_event);
 }
 
+static int mirror_flush(struct dm_target *ti)
+{
+	struct mirror_set *ms = ti->private;
+	unsigned long error_bits;
+
+	unsigned int i;
+	struct dm_io_region io[ms->nr_mirrors];
+	struct mirror *m;
+	struct dm_io_request io_req = {
+		.bi_rw = WRITE_BARRIER,
+		.mem.type = DM_IO_KMEM,
+		.mem.ptr.bvec = NULL,
+		.client = ms->io_client,
+	};
+
+	for (i = 0, m = ms->mirror; i < ms->nr_mirrors; i++, m++) {
+		io[i].bdev = m->dev->bdev;
+		io[i].sector = 0;
+		io[i].count = 0;
+	}
+
+	error_bits = -1;
+	dm_io(&io_req, ms->nr_mirrors, io, &error_bits);
+	if (unlikely(error_bits != 0)) {
+		for (i = 0; i < ms->nr_mirrors; i++)
+			if (test_bit(i, &error_bits))
+				fail_mirror(ms->mirror + i,
+					    DM_RAID1_FLUSH_ERROR);
+		return -EIO;
+	}
+
+	return 0;
+}
+
 /*-----------------------------------------------------------------
  * Recovery.
  *
@@ -396,6 +443,8 @@ static int mirror_available(struct mirror_set *ms, struct bio *bio)
  */
 static sector_t map_sector(struct mirror *m, struct bio *bio)
 {
+	if (unlikely(!bio->bi_size))
+		return 0;
 	return m->offset + (bio->bi_sector - m->ms->ti->begin);
 }
 
@@ -413,6 +462,27 @@ static void map_region(struct dm_io_region *io, struct mirror *m,
 	io->count = bio->bi_size >> 9;
 }
 
+static void hold_bio(struct mirror_set *ms, struct bio *bio)
+{
+	/*
+	 * If device is suspended, complete the bio.
+	 */
+	if (atomic_read(&ms->suspend)) {
+		if (dm_noflush_suspending(ms->ti))
+			bio_endio(bio, DM_ENDIO_REQUEUE);
+		else
+			bio_endio(bio, -EIO);
+		return;
+	}
+
+	/*
+	 * Hold bio until the suspend is complete.
+	 */
+	spin_lock_irq(&ms->lock);
+	bio_list_add(&ms->holds, bio);
+	spin_unlock_irq(&ms->lock);
+}
+
 /*-----------------------------------------------------------------
  * Reads
  *---------------------------------------------------------------*/
@@ -511,7 +581,6 @@ static void write_callback(unsigned long error, void *context)
 	unsigned i, ret = 0;
 	struct bio *bio = (struct bio *) context;
 	struct mirror_set *ms;
-	int uptodate = 0;
 	int should_wake = 0;
 	unsigned long flags;
 
@@ -524,36 +593,27 @@ static void write_callback(unsigned long error, void *context)
 	 * This way we handle both writes to SYNC and NOSYNC
 	 * regions with the same code.
 	 */
-	if (likely(!error))
-		goto out;
+	if (likely(!error)) {
+		bio_endio(bio, ret);
+		return;
+	}
 
 	for (i = 0; i < ms->nr_mirrors; i++)
 		if (test_bit(i, &error))
 			fail_mirror(ms->mirror + i, DM_RAID1_WRITE_ERROR);
-		else
-			uptodate = 1;
 
-	if (unlikely(!uptodate)) {
-		DMERR("All replicated volumes dead, failing I/O");
-		/* None of the writes succeeded, fail the I/O. */
-		ret = -EIO;
-	} else if (errors_handled(ms)) {
-		/*
-		 * Need to raise event.  Since raising
-		 * events can block, we need to do it in
-		 * the main thread.
-		 */
-		spin_lock_irqsave(&ms->lock, flags);
-		if (!ms->failures.head)
-			should_wake = 1;
-		bio_list_add(&ms->failures, bio);
-		spin_unlock_irqrestore(&ms->lock, flags);
-		if (should_wake)
-			wakeup_mirrord(ms);
-		return;
-	}
-out:
-	bio_endio(bio, ret);
+	/*
+	 * Need to raise event.  Since raising
+	 * events can block, we need to do it in
+	 * the main thread.
+	 */
+	spin_lock_irqsave(&ms->lock, flags);
+	if (!ms->failures.head)
+		should_wake = 1;
+	bio_list_add(&ms->failures, bio);
+	spin_unlock_irqrestore(&ms->lock, flags);
+	if (should_wake)
+		wakeup_mirrord(ms);
 }
 
 static void do_write(struct mirror_set *ms, struct bio *bio)
@@ -562,7 +622,7 @@ static void do_write(struct mirror_set *ms, struct bio *bio)
 	struct dm_io_region io[ms->nr_mirrors], *dest = io;
 	struct mirror *m;
 	struct dm_io_request io_req = {
-		.bi_rw = WRITE,
+		.bi_rw = WRITE | (bio->bi_rw & WRITE_BARRIER),
 		.mem.type = DM_IO_BVEC,
 		.mem.ptr.bvec = bio->bi_io_vec + bio->bi_idx,
 		.notify.fn = write_callback,
@@ -603,6 +663,11 @@ static void do_writes(struct mirror_set *ms, struct bio_list *writes)
 	bio_list_init(&requeue);
 
 	while ((bio = bio_list_pop(writes))) {
+		if (unlikely(bio_empty_barrier(bio))) {
+			bio_list_add(&sync, bio);
+			continue;
+		}
+
 		region = dm_rh_bio_to_region(ms->rh, bio);
 
 		if (log->type->is_remote_recovering &&
@@ -672,8 +737,12 @@ static void do_writes(struct mirror_set *ms, struct bio_list *writes)
 		dm_rh_delay(ms->rh, bio);
 
 	while ((bio = bio_list_pop(&nosync))) {
-		map_bio(get_default_mirror(ms), bio);
-		generic_make_request(bio);
+		if (unlikely(ms->leg_failure) && errors_handled(ms))
+			hold_bio(ms, bio);
+		else {
+			map_bio(get_default_mirror(ms), bio);
+			generic_make_request(bio);
+		}
 	}
 }
 
@@ -681,20 +750,12 @@ static void do_failures(struct mirror_set *ms, struct bio_list *failures)
 {
 	struct bio *bio;
 
-	if (!failures->head)
-		return;
-
-	if (!ms->log_failure) {
-		while ((bio = bio_list_pop(failures))) {
-			ms->in_sync = 0;
-			dm_rh_mark_nosync(ms->rh, bio, bio->bi_size, 0);
-		}
+	if (likely(!failures->head))
 		return;
-	}
 
 	/*
 	 * If the log has failed, unattempted writes are being
-	 * put on the failures list.  We can't issue those writes
+	 * put on the holds list.  We can't issue those writes
 	 * until a log has been marked, so we must store them.
 	 *
 	 * If a 'noflush' suspend is in progress, we can requeue
@@ -709,23 +770,27 @@ static void do_failures(struct mirror_set *ms, struct bio_list *failures)
 	 * for us to treat them the same and requeue them
 	 * as well.
 	 */
-	if (dm_noflush_suspending(ms->ti)) {
-		while ((bio = bio_list_pop(failures)))
-			bio_endio(bio, DM_ENDIO_REQUEUE);
-		return;
-	}
+	while ((bio = bio_list_pop(failures))) {
+		if (!ms->log_failure) {
+			ms->in_sync = 0;
+			dm_rh_mark_nosync(ms->rh, bio);
+		}
 
-	if (atomic_read(&ms->suspend)) {
-		while ((bio = bio_list_pop(failures)))
+		/*
+		 * If all the legs are dead, fail the I/O.
+		 * If we have been told to handle errors, hold the bio
+		 * and wait for userspace to deal with the problem.
+		 * Otherwise pretend that the I/O succeeded. (This would
+		 * be wrong if the failed leg returned after reboot and
+		 * got replicated back to the good legs.)
+		 */
+		if (!get_valid_mirror(ms))
 			bio_endio(bio, -EIO);
-		return;
+		else if (errors_handled(ms))
+			hold_bio(ms, bio);
+		else
+			bio_endio(bio, 0);
 	}
-
-	spin_lock_irq(&ms->lock);
-	bio_list_merge(&ms->failures, failures);
-	spin_unlock_irq(&ms->lock);
-
-	delayed_wake(ms);
 }
 
 static void trigger_event(struct work_struct *work)
@@ -784,12 +849,17 @@ static struct mirror_set *alloc_context(unsigned int nr_mirrors,
 	}
 
 	spin_lock_init(&ms->lock);
+	bio_list_init(&ms->reads);
+	bio_list_init(&ms->writes);
+	bio_list_init(&ms->failures);
+	bio_list_init(&ms->holds);
 
 	ms->ti = ti;
 	ms->nr_mirrors = nr_mirrors;
 	ms->nr_regions = dm_sector_div_up(ti->len, region_size);
 	ms->in_sync = 0;
 	ms->log_failure = 0;
+	ms->leg_failure = 0;
 	atomic_set(&ms->suspend, 0);
 	atomic_set(&ms->default_mirror, DEFAULT_MIRROR);
 
@@ -889,7 +959,8 @@ static struct dm_dirty_log *create_dirty_log(struct dm_target *ti,
 		return NULL;
 	}
 
-	dl = dm_dirty_log_create(argv[0], ti, param_count, argv + 2);
+	dl = dm_dirty_log_create(argv[0], ti, mirror_flush, param_count,
+				 argv + 2);
 	if (!dl) {
 		ti->error = "Error creating mirror dirty log";
 		return NULL;
@@ -995,6 +1066,7 @@ static int mirror_ctr(struct dm_target *ti, unsigned int argc, char **argv)
 
 	ti->private = ms;
 	ti->split_io = dm_rh_get_region_size(ms->rh);
+	ti->num_flush_requests = 1;
 
 	ms->kmirrord_wq = create_singlethread_workqueue("kmirrord");
 	if (!ms->kmirrord_wq) {
@@ -1122,7 +1194,8 @@ static int mirror_end_io(struct dm_target *ti, struct bio *bio,
 	 * We need to dec pending if this was a write.
 	 */
 	if (rw == WRITE) {
-		dm_rh_dec(ms->rh, map_context->ll);
+		if (likely(!bio_empty_barrier(bio)))
+			dm_rh_dec(ms->rh, map_context->ll);
 		return error;
 	}
 
@@ -1180,6 +1253,9 @@ static void mirror_presuspend(struct dm_target *ti)
 	struct mirror_set *ms = (struct mirror_set *) ti->private;
 	struct dm_dirty_log *log = dm_rh_dirty_log(ms->rh);
 
+	struct bio_list holds;
+	struct bio *bio;
+
 	atomic_set(&ms->suspend, 1);
 
 	/*
@@ -1202,6 +1278,22 @@ static void mirror_presuspend(struct dm_target *ti)
 	 * we know that all of our I/O has been pushed.
 	 */
 	flush_workqueue(ms->kmirrord_wq);
+
+	/*
+	 * Now set ms->suspend is set and the workqueue flushed, no more
+	 * entries can be added to ms->hold list, so process it.
+	 *
+	 * Bios can still arrive concurrently with or after this
+	 * presuspend function, but they cannot join the hold list
+	 * because ms->suspend is set.
+	 */
+	spin_lock_irq(&ms->lock);
+	holds = ms->holds;
+	bio_list_init(&ms->holds);
+	spin_unlock_irq(&ms->lock);
+
+	while ((bio = bio_list_pop(&holds)))
+		hold_bio(ms, bio);
 }
 
 static void mirror_postsuspend(struct dm_target *ti)
@@ -1244,7 +1336,8 @@ static char device_status_char(struct mirror *m)
 	if (!atomic_read(&(m->error_count)))
 		return 'A';
 
-	return (test_bit(DM_RAID1_WRITE_ERROR, &(m->error_type))) ? 'D' :
+	return (test_bit(DM_RAID1_FLUSH_ERROR, &(m->error_type))) ? 'F' :
+		(test_bit(DM_RAID1_WRITE_ERROR, &(m->error_type))) ? 'D' :
 		(test_bit(DM_RAID1_SYNC_ERROR, &(m->error_type))) ? 'S' :
 		(test_bit(DM_RAID1_READ_ERROR, &(m->error_type))) ? 'R' : 'U';
 }
diff --git a/drivers/md/dm-region-hash.c b/drivers/md/dm-region-hash.c
index 36dbe29f2fd6..5f19ceb6fe91 100644
--- a/drivers/md/dm-region-hash.c
+++ b/drivers/md/dm-region-hash.c
@@ -79,6 +79,11 @@ struct dm_region_hash {
 	struct list_head recovered_regions;
 	struct list_head failed_recovered_regions;
 
+	/*
+	 * If there was a barrier failure no regions can be marked clean.
+	 */
+	int barrier_failure;
+
 	void *context;
 	sector_t target_begin;
 
@@ -211,6 +216,7 @@ struct dm_region_hash *dm_region_hash_create(
 	INIT_LIST_HEAD(&rh->quiesced_regions);
 	INIT_LIST_HEAD(&rh->recovered_regions);
 	INIT_LIST_HEAD(&rh->failed_recovered_regions);
+	rh->barrier_failure = 0;
 
 	rh->region_pool = mempool_create_kmalloc_pool(MIN_REGIONS,
 						      sizeof(struct dm_region));
@@ -377,8 +383,6 @@ static void complete_resync_work(struct dm_region *reg, int success)
 /* dm_rh_mark_nosync
  * @ms
  * @bio
- * @done
- * @error
  *
  * The bio was written on some mirror(s) but failed on other mirror(s).
  * We can successfully endio the bio but should avoid the region being
@@ -386,8 +390,7 @@ static void complete_resync_work(struct dm_region *reg, int success)
  *
  * This function is _not_ safe in interrupt context!
  */
-void dm_rh_mark_nosync(struct dm_region_hash *rh,
-		       struct bio *bio, unsigned done, int error)
+void dm_rh_mark_nosync(struct dm_region_hash *rh, struct bio *bio)
 {
 	unsigned long flags;
 	struct dm_dirty_log *log = rh->log;
@@ -395,6 +398,11 @@ void dm_rh_mark_nosync(struct dm_region_hash *rh,
 	region_t region = dm_rh_bio_to_region(rh, bio);
 	int recovering = 0;
 
+	if (bio_empty_barrier(bio)) {
+		rh->barrier_failure = 1;
+		return;
+	}
+
 	/* We must inform the log that the sync count has changed. */
 	log->type->set_region_sync(log, region, 0);
 
@@ -419,7 +427,6 @@ void dm_rh_mark_nosync(struct dm_region_hash *rh,
 	BUG_ON(!list_empty(&reg->list));
 	spin_unlock_irqrestore(&rh->region_lock, flags);
 
-	bio_endio(bio, error);
 	if (recovering)
 		complete_resync_work(reg, 0);
 }
@@ -515,8 +522,11 @@ void dm_rh_inc_pending(struct dm_region_hash *rh, struct bio_list *bios)
 {
 	struct bio *bio;
 
-	for (bio = bios->head; bio; bio = bio->bi_next)
+	for (bio = bios->head; bio; bio = bio->bi_next) {
+		if (bio_empty_barrier(bio))
+			continue;
 		rh_inc(rh, dm_rh_bio_to_region(rh, bio));
+	}
 }
 EXPORT_SYMBOL_GPL(dm_rh_inc_pending);
 
@@ -544,7 +554,14 @@ void dm_rh_dec(struct dm_region_hash *rh, region_t region)
 		 */
 
 		/* do nothing for DM_RH_NOSYNC */
-		if (reg->state == DM_RH_RECOVERING) {
+		if (unlikely(rh->barrier_failure)) {
+			/*
+			 * If a write barrier failed some time ago, we
+			 * don't know whether or not this write made it
+			 * to the disk, so we must resync the device.
+			 */
+			reg->state = DM_RH_NOSYNC;
+		} else if (reg->state == DM_RH_RECOVERING) {
 			list_add_tail(&reg->list, &rh->quiesced_regions);
 		} else if (reg->state == DM_RH_DIRTY) {
 			reg->state = DM_RH_CLEAN;
diff --git a/drivers/md/dm-snap-persistent.c b/drivers/md/dm-snap-persistent.c
index 0c746420c008..7d08879689ac 100644
--- a/drivers/md/dm-snap-persistent.c
+++ b/drivers/md/dm-snap-persistent.c
@@ -55,6 +55,8 @@
  */
 #define SNAPSHOT_DISK_VERSION 1
 
+#define NUM_SNAPSHOT_HDR_CHUNKS 1
+
 struct disk_header {
 	uint32_t magic;
 
@@ -120,7 +122,22 @@ struct pstore {
 
 	/*
 	 * The next free chunk for an exception.
+	 *
+	 * When creating exceptions, all the chunks here and above are
+	 * free.  It holds the next chunk to be allocated.  On rare
+	 * occasions (e.g. after a system crash) holes can be left in
+	 * the exception store because chunks can be committed out of
+	 * order.
+	 *
+	 * When merging exceptions, it does not necessarily mean all the
+	 * chunks here and above are free.  It holds the value it would
+	 * have held if all chunks had been committed in order of
+	 * allocation.  Consequently the value may occasionally be
+	 * slightly too low, but since it's only used for 'status' and
+	 * it can never reach its minimum value too early this doesn't
+	 * matter.
 	 */
+
 	chunk_t next_free;
 
 	/*
@@ -214,7 +231,7 @@ static int chunk_io(struct pstore *ps, void *area, chunk_t chunk, int rw,
 		    int metadata)
 {
 	struct dm_io_region where = {
-		.bdev = ps->store->cow->bdev,
+		.bdev = dm_snap_cow(ps->store->snap)->bdev,
 		.sector = ps->store->chunk_size * chunk,
 		.count = ps->store->chunk_size,
 	};
@@ -294,7 +311,8 @@ static int read_header(struct pstore *ps, int *new_snapshot)
 	 */
 	if (!ps->store->chunk_size) {
 		ps->store->chunk_size = max(DM_CHUNK_SIZE_DEFAULT_SECTORS,
-		    bdev_logical_block_size(ps->store->cow->bdev) >> 9);
+		    bdev_logical_block_size(dm_snap_cow(ps->store->snap)->
+					    bdev) >> 9);
 		ps->store->chunk_mask = ps->store->chunk_size - 1;
 		ps->store->chunk_shift = ffs(ps->store->chunk_size) - 1;
 		chunk_size_supplied = 0;
@@ -408,6 +426,15 @@ static void write_exception(struct pstore *ps,
 	e->new_chunk = cpu_to_le64(de->new_chunk);
 }
 
+static void clear_exception(struct pstore *ps, uint32_t index)
+{
+	struct disk_exception *e = get_exception(ps, index);
+
+	/* clear it */
+	e->old_chunk = 0;
+	e->new_chunk = 0;
+}
+
 /*
  * Registers the exceptions that are present in the current area.
  * 'full' is filled in to indicate if the area has been
@@ -489,11 +516,23 @@ static struct pstore *get_info(struct dm_exception_store *store)
 	return (struct pstore *) store->context;
 }
 
-static void persistent_fraction_full(struct dm_exception_store *store,
-				     sector_t *numerator, sector_t *denominator)
+static void persistent_usage(struct dm_exception_store *store,
+			     sector_t *total_sectors,
+			     sector_t *sectors_allocated,
+			     sector_t *metadata_sectors)
 {
-	*numerator = get_info(store)->next_free * store->chunk_size;
-	*denominator = get_dev_size(store->cow->bdev);
+	struct pstore *ps = get_info(store);
+
+	*sectors_allocated = ps->next_free * store->chunk_size;
+	*total_sectors = get_dev_size(dm_snap_cow(store->snap)->bdev);
+
+	/*
+	 * First chunk is the fixed header.
+	 * Then there are (ps->current_area + 1) metadata chunks, each one
+	 * separated from the next by ps->exceptions_per_area data chunks.
+	 */
+	*metadata_sectors = (ps->current_area + 1 + NUM_SNAPSHOT_HDR_CHUNKS) *
+			    store->chunk_size;
 }
 
 static void persistent_dtr(struct dm_exception_store *store)
@@ -552,44 +591,40 @@ static int persistent_read_metadata(struct dm_exception_store *store,
 		ps->current_area = 0;
 		zero_memory_area(ps);
 		r = zero_disk_area(ps, 0);
-		if (r) {
+		if (r)
 			DMWARN("zero_disk_area(0) failed");
-			return r;
-		}
-	} else {
-		/*
-		 * Sanity checks.
-		 */
-		if (ps->version != SNAPSHOT_DISK_VERSION) {
-			DMWARN("unable to handle snapshot disk version %d",
-			       ps->version);
-			return -EINVAL;
-		}
+		return r;
+	}
+	/*
+	 * Sanity checks.
+	 */
+	if (ps->version != SNAPSHOT_DISK_VERSION) {
+		DMWARN("unable to handle snapshot disk version %d",
+		       ps->version);
+		return -EINVAL;
+	}
 
-		/*
-		 * Metadata are valid, but snapshot is invalidated
-		 */
-		if (!ps->valid)
-			return 1;
+	/*
+	 * Metadata are valid, but snapshot is invalidated
+	 */
+	if (!ps->valid)
+		return 1;
 
-		/*
-		 * Read the metadata.
-		 */
-		r = read_exceptions(ps, callback, callback_context);
-		if (r)
-			return r;
-	}
+	/*
+	 * Read the metadata.
+	 */
+	r = read_exceptions(ps, callback, callback_context);
 
-	return 0;
+	return r;
 }
 
 static int persistent_prepare_exception(struct dm_exception_store *store,
-					struct dm_snap_exception *e)
+					struct dm_exception *e)
 {
 	struct pstore *ps = get_info(store);
 	uint32_t stride;
 	chunk_t next_free;
-	sector_t size = get_dev_size(store->cow->bdev);
+	sector_t size = get_dev_size(dm_snap_cow(store->snap)->bdev);
 
 	/* Is there enough room ? */
 	if (size < ((ps->next_free + 1) * store->chunk_size))
@@ -611,7 +646,7 @@ static int persistent_prepare_exception(struct dm_exception_store *store,
 }
 
 static void persistent_commit_exception(struct dm_exception_store *store,
-					struct dm_snap_exception *e,
+					struct dm_exception *e,
 					void (*callback) (void *, int success),
 					void *callback_context)
 {
@@ -672,6 +707,85 @@ static void persistent_commit_exception(struct dm_exception_store *store,
 	ps->callback_count = 0;
 }
 
+static int persistent_prepare_merge(struct dm_exception_store *store,
+				    chunk_t *last_old_chunk,
+				    chunk_t *last_new_chunk)
+{
+	struct pstore *ps = get_info(store);
+	struct disk_exception de;
+	int nr_consecutive;
+	int r;
+
+	/*
+	 * When current area is empty, move back to preceding area.
+	 */
+	if (!ps->current_committed) {
+		/*
+		 * Have we finished?
+		 */
+		if (!ps->current_area)
+			return 0;
+
+		ps->current_area--;
+		r = area_io(ps, READ);
+		if (r < 0)
+			return r;
+		ps->current_committed = ps->exceptions_per_area;
+	}
+
+	read_exception(ps, ps->current_committed - 1, &de);
+	*last_old_chunk = de.old_chunk;
+	*last_new_chunk = de.new_chunk;
+
+	/*
+	 * Find number of consecutive chunks within the current area,
+	 * working backwards.
+	 */
+	for (nr_consecutive = 1; nr_consecutive < ps->current_committed;
+	     nr_consecutive++) {
+		read_exception(ps, ps->current_committed - 1 - nr_consecutive,
+			       &de);
+		if (de.old_chunk != *last_old_chunk - nr_consecutive ||
+		    de.new_chunk != *last_new_chunk - nr_consecutive)
+			break;
+	}
+
+	return nr_consecutive;
+}
+
+static int persistent_commit_merge(struct dm_exception_store *store,
+				   int nr_merged)
+{
+	int r, i;
+	struct pstore *ps = get_info(store);
+
+	BUG_ON(nr_merged > ps->current_committed);
+
+	for (i = 0; i < nr_merged; i++)
+		clear_exception(ps, ps->current_committed - 1 - i);
+
+	r = area_io(ps, WRITE);
+	if (r < 0)
+		return r;
+
+	ps->current_committed -= nr_merged;
+
+	/*
+	 * At this stage, only persistent_usage() uses ps->next_free, so
+	 * we make no attempt to keep ps->next_free strictly accurate
+	 * as exceptions may have been committed out-of-order originally.
+	 * Once a snapshot has become merging, we set it to the value it
+	 * would have held had all the exceptions been committed in order.
+	 *
+	 * ps->current_area does not get reduced by prepare_merge() until
+	 * after commit_merge() has removed the nr_merged previous exceptions.
+	 */
+	ps->next_free = (area_location(ps, ps->current_area) - 1) +
+			(ps->current_committed + 1) + NUM_SNAPSHOT_HDR_CHUNKS;
+
+	return 0;
+}
+
 static void persistent_drop_snapshot(struct dm_exception_store *store)
 {
 	struct pstore *ps = get_info(store);
@@ -697,7 +811,7 @@ static int persistent_ctr(struct dm_exception_store *store,
 	ps->area = NULL;
 	ps->zero_area = NULL;
 	ps->header_area = NULL;
-	ps->next_free = 2;	/* skipping the header and first area */
+	ps->next_free = NUM_SNAPSHOT_HDR_CHUNKS + 1; /* header and 1st area */
 	ps->current_committed = 0;
 
 	ps->callback_count = 0;
@@ -726,8 +840,7 @@ static unsigned persistent_status(struct dm_exception_store *store,
 	case STATUSTYPE_INFO:
 		break;
 	case STATUSTYPE_TABLE:
-		DMEMIT(" %s P %llu", store->cow->name,
-		       (unsigned long long)store->chunk_size);
+		DMEMIT(" P %llu", (unsigned long long)store->chunk_size);
 	}
 
 	return sz;
@@ -741,8 +854,10 @@ static struct dm_exception_store_type _persistent_type = {
 	.read_metadata = persistent_read_metadata,
 	.prepare_exception = persistent_prepare_exception,
 	.commit_exception = persistent_commit_exception,
+	.prepare_merge = persistent_prepare_merge,
+	.commit_merge = persistent_commit_merge,
 	.drop_snapshot = persistent_drop_snapshot,
-	.fraction_full = persistent_fraction_full,
+	.usage = persistent_usage,
 	.status = persistent_status,
 };
 
@@ -754,8 +869,10 @@ static struct dm_exception_store_type _persistent_compat_type = {
 	.read_metadata = persistent_read_metadata,
 	.prepare_exception = persistent_prepare_exception,
 	.commit_exception = persistent_commit_exception,
+	.prepare_merge = persistent_prepare_merge,
+	.commit_merge = persistent_commit_merge,
 	.drop_snapshot = persistent_drop_snapshot,
-	.fraction_full = persistent_fraction_full,
+	.usage = persistent_usage,
 	.status = persistent_status,
 };
 
diff --git a/drivers/md/dm-snap-transient.c b/drivers/md/dm-snap-transient.c
index cde5aa558e6d..a0898a66a2f8 100644
--- a/drivers/md/dm-snap-transient.c
+++ b/drivers/md/dm-snap-transient.c
@@ -36,10 +36,10 @@ static int transient_read_metadata(struct dm_exception_store *store,
 }
 
 static int transient_prepare_exception(struct dm_exception_store *store,
-				       struct dm_snap_exception *e)
+				       struct dm_exception *e)
 {
 	struct transient_c *tc = store->context;
-	sector_t size = get_dev_size(store->cow->bdev);
+	sector_t size = get_dev_size(dm_snap_cow(store->snap)->bdev);
 
 	if (size < (tc->next_free + store->chunk_size))
 		return -1;
@@ -51,7 +51,7 @@ static int transient_prepare_exception(struct dm_exception_store *store,
 }
 
 static void transient_commit_exception(struct dm_exception_store *store,
-				       struct dm_snap_exception *e,
+				       struct dm_exception *e,
 				       void (*callback) (void *, int success),
 				       void *callback_context)
 {
@@ -59,11 +59,14 @@ static void transient_commit_exception(struct dm_exception_store *store,
 	callback(callback_context, 1);
 }
 
-static void transient_fraction_full(struct dm_exception_store *store,
-				    sector_t *numerator, sector_t *denominator)
+static void transient_usage(struct dm_exception_store *store,
+			    sector_t *total_sectors,
+			    sector_t *sectors_allocated,
+			    sector_t *metadata_sectors)
 {
-	*numerator = ((struct transient_c *) store->context)->next_free;
-	*denominator = get_dev_size(store->cow->bdev);
+	*sectors_allocated = ((struct transient_c *) store->context)->next_free;
+	*total_sectors = get_dev_size(dm_snap_cow(store->snap)->bdev);
+	*metadata_sectors = 0;
 }
 
 static int transient_ctr(struct dm_exception_store *store,
@@ -91,8 +94,7 @@ static unsigned transient_status(struct dm_exception_store *store,
 	case STATUSTYPE_INFO:
 		break;
 	case STATUSTYPE_TABLE:
-		DMEMIT(" %s N %llu", store->cow->name,
-		       (unsigned long long)store->chunk_size);
+		DMEMIT(" N %llu", (unsigned long long)store->chunk_size);
 	}
 
 	return sz;
@@ -106,7 +108,7 @@ static struct dm_exception_store_type _transient_type = {
 	.read_metadata = transient_read_metadata,
 	.prepare_exception = transient_prepare_exception,
 	.commit_exception = transient_commit_exception,
-	.fraction_full = transient_fraction_full,
+	.usage = transient_usage,
 	.status = transient_status,
 };
 
@@ -118,7 +120,7 @@ static struct dm_exception_store_type _transient_compat_type = {
 	.read_metadata = transient_read_metadata,
 	.prepare_exception = transient_prepare_exception,
 	.commit_exception = transient_commit_exception,
-	.fraction_full = transient_fraction_full,
+	.usage = transient_usage,
 	.status = transient_status,
 };
 
diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
index 3a3ba46e6d4b..ee8eb283650d 100644
--- a/drivers/md/dm-snap.c
+++ b/drivers/md/dm-snap.c
@@ -25,6 +25,11 @@
 
 #define DM_MSG_PREFIX "snapshots"
 
+static const char dm_snapshot_merge_target_name[] = "snapshot-merge";
+
+#define dm_target_is_snapshot_merge(ti) \
+	((ti)->type->name == dm_snapshot_merge_target_name)
+
 /*
  * The percentage increment we will wake up users at
  */
@@ -49,7 +54,7 @@
 #define DM_TRACKED_CHUNK_HASH(x)	((unsigned long)(x) & \
 					 (DM_TRACKED_CHUNK_HASH_SIZE - 1))
 
-struct exception_table {
+struct dm_exception_table {
 	uint32_t hash_mask;
 	unsigned hash_shift;
 	struct list_head *table;
@@ -59,22 +64,31 @@ struct dm_snapshot {
 	struct rw_semaphore lock;
 
 	struct dm_dev *origin;
+	struct dm_dev *cow;
+
+	struct dm_target *ti;
 
 	/* List of snapshots per Origin */
 	struct list_head list;
 
-	/* You can't use a snapshot if this is 0 (e.g. if full) */
+	/*
+	 * You can't use a snapshot if this is 0 (e.g. if full).
+	 * A snapshot-merge target never clears this.
+	 */
 	int valid;
 
 	/* Origin writes don't trigger exceptions until this is set */
 	int active;
 
+	/* Whether or not owning mapped_device is suspended */
+	int suspended;
+
 	mempool_t *pending_pool;
 
 	atomic_t pending_exceptions_count;
 
-	struct exception_table pending;
-	struct exception_table complete;
+	struct dm_exception_table pending;
+	struct dm_exception_table complete;
 
 	/*
 	 * pe_lock protects all pending_exception operations and access
@@ -95,8 +109,51 @@ struct dm_snapshot {
 	mempool_t *tracked_chunk_pool;
 	spinlock_t tracked_chunk_lock;
 	struct hlist_head tracked_chunk_hash[DM_TRACKED_CHUNK_HASH_SIZE];
+
+	/*
+	 * The merge operation failed if this flag is set.
+	 * Failure modes are handled as follows:
+	 * - I/O error reading the header
+	 *   	=> don't load the target; abort.
+	 * - Header does not have "valid" flag set
+	 *   	=> use the origin; forget about the snapshot.
+	 * - I/O error when reading exceptions
+	 *   	=> don't load the target; abort.
+	 *         (We can't use the intermediate origin state.)
+	 * - I/O error while merging
+	 *	=> stop merging; set merge_failed; process I/O normally.
+	 */
+	int merge_failed;
+
+	/* Wait for events based on state_bits */
+	unsigned long state_bits;
+
+	/* Range of chunks currently being merged. */
+	chunk_t first_merging_chunk;
+	int num_merging_chunks;
+
+	/*
+	 * Incoming bios that overlap with chunks being merged must wait
+	 * for them to be committed.
+	 */
+	struct bio_list bios_queued_during_merge;
 };
 
+/*
+ * state_bits:
+ *   RUNNING_MERGE  - Merge operation is in progress.
+ *   SHUTDOWN_MERGE - Set to signal that merge needs to be stopped;
+ *                    cleared afterwards.
+ */
+#define RUNNING_MERGE          0
+#define SHUTDOWN_MERGE         1
+
+struct dm_dev *dm_snap_cow(struct dm_snapshot *s)
+{
+	return s->cow;
+}
+EXPORT_SYMBOL(dm_snap_cow);
+
 static struct workqueue_struct *ksnapd;
 static void flush_queued_bios(struct work_struct *work);
 
@@ -116,7 +173,7 @@ static int bdev_equal(struct block_device *lhs, struct block_device *rhs)
 }
 
 struct dm_snap_pending_exception {
-	struct dm_snap_exception e;
+	struct dm_exception e;
 
 	/*
 	 * Origin buffers waiting for this to complete are held
@@ -125,28 +182,6 @@ struct dm_snap_pending_exception {
 	struct bio_list origin_bios;
 	struct bio_list snapshot_bios;
 
-	/*
-	 * Short-term queue of pending exceptions prior to submission.
-	 */
-	struct list_head list;
-
-	/*
-	 * The primary pending_exception is the one that holds
-	 * the ref_count and the list of origin_bios for a
-	 * group of pending_exceptions.  It is always last to get freed.
-	 * These fields get set up when writing to the origin.
-	 */
-	struct dm_snap_pending_exception *primary_pe;
-
-	/*
-	 * Number of pending_exceptions processing this chunk.
-	 * When this drops to zero we must complete the origin bios.
-	 * If incrementing or decrementing this, hold pe->snap->lock for
-	 * the sibling concerned and not pe->primary_pe->snap->lock unless
-	 * they are the same.
-	 */
-	atomic_t ref_count;
-
 	/* Pointer back to snapshot context */
 	struct dm_snapshot *snap;
 
@@ -222,6 +257,16 @@ static int __chunk_is_tracked(struct dm_snapshot *s, chunk_t chunk)
 }
 
 /*
+ * This conflicting I/O is extremely improbable in the caller,
+ * so msleep(1) is sufficient and there is no need for a wait queue.
+ */
+static void __check_for_conflicting_io(struct dm_snapshot *s, chunk_t chunk)
+{
+	while (__chunk_is_tracked(s, chunk))
+		msleep(1);
+}
+
+/*
  * One of these per registered origin, held in the snapshot_origins hash
  */
 struct origin {
@@ -243,6 +288,10 @@ struct origin {
 static struct list_head *_origins;
 static struct rw_semaphore _origins_lock;
 
+static DECLARE_WAIT_QUEUE_HEAD(_pending_exceptions_done);
+static DEFINE_SPINLOCK(_pending_exceptions_done_spinlock);
+static uint64_t _pending_exceptions_done_count;
+
 static int init_origin_hash(void)
 {
 	int i;
@@ -291,22 +340,144 @@ static void __insert_origin(struct origin *o)
 }
 
 /*
+ * _origins_lock must be held when calling this function.
+ * Returns number of snapshots registered using the supplied cow device, plus:
+ * snap_src - a snapshot suitable for use as a source of exception handover
+ * snap_dest - a snapshot capable of receiving exception handover.
+ * snap_merge - an existing snapshot-merge target linked to the same origin.
+ *   There can be at most one snapshot-merge target. The parameter is optional.
+ *
+ * Possible return values and states of snap_src and snap_dest.
+ *   0: NULL, NULL  - first new snapshot
+ *   1: snap_src, NULL - normal snapshot
+ *   2: snap_src, snap_dest  - waiting for handover
+ *   2: snap_src, NULL - handed over, waiting for old to be deleted
+ *   1: NULL, snap_dest - source got destroyed without handover
+ */
+static int __find_snapshots_sharing_cow(struct dm_snapshot *snap,
+					struct dm_snapshot **snap_src,
+					struct dm_snapshot **snap_dest,
+					struct dm_snapshot **snap_merge)
+{
+	struct dm_snapshot *s;
+	struct origin *o;
+	int count = 0;
+	int active;
+
+	o = __lookup_origin(snap->origin->bdev);
+	if (!o)
+		goto out;
+
+	list_for_each_entry(s, &o->snapshots, list) {
+		if (dm_target_is_snapshot_merge(s->ti) && snap_merge)
+			*snap_merge = s;
+		if (!bdev_equal(s->cow->bdev, snap->cow->bdev))
+			continue;
+
+		down_read(&s->lock);
+		active = s->active;
+		up_read(&s->lock);
+
+		if (active) {
+			if (snap_src)
+				*snap_src = s;
+		} else if (snap_dest)
+			*snap_dest = s;
+
+		count++;
+	}
+
+out:
+	return count;
+}
+
+/*
+ * On success, returns 1 if this snapshot is a handover destination,
+ * otherwise returns 0.
+ */
+static int __validate_exception_handover(struct dm_snapshot *snap)
+{
+	struct dm_snapshot *snap_src = NULL, *snap_dest = NULL;
+	struct dm_snapshot *snap_merge = NULL;
+
+	/* Does snapshot need exceptions handed over to it? */
+	if ((__find_snapshots_sharing_cow(snap, &snap_src, &snap_dest,
+					  &snap_merge) == 2) ||
+	    snap_dest) {
+		snap->ti->error = "Snapshot cow pairing for exception "
+				  "table handover failed";
+		return -EINVAL;
+	}
+
+	/*
+	 * If no snap_src was found, snap cannot become a handover
+	 * destination.
+	 */
+	if (!snap_src)
+		return 0;
+
+	/*
+	 * Non-snapshot-merge handover?
+	 */
+	if (!dm_target_is_snapshot_merge(snap->ti))
+		return 1;
+
+	/*
+	 * Do not allow more than one merging snapshot.
+	 */
+	if (snap_merge) {
+		snap->ti->error = "A snapshot is already merging.";
+		return -EINVAL;
+	}
+
+	if (!snap_src->store->type->prepare_merge ||
+	    !snap_src->store->type->commit_merge) {
+		snap->ti->error = "Snapshot exception store does not "
+				  "support snapshot-merge.";
+		return -EINVAL;
+	}
+
+	return 1;
+}
+
+static void __insert_snapshot(struct origin *o, struct dm_snapshot *s)
+{
+	struct dm_snapshot *l;
+
+	/* Sort the list according to chunk size, largest-first smallest-last */
+	list_for_each_entry(l, &o->snapshots, list)
+		if (l->store->chunk_size < s->store->chunk_size)
+			break;
+	list_add_tail(&s->list, &l->list);
+}
+
+/*
  * Make a note of the snapshot and its origin so we can look it
  * up when the origin has a write on it.
+ *
+ * Also validate snapshot exception store handovers.
+ * On success, returns 1 if this registration is a handover destination,
+ * otherwise returns 0.
  */
 static int register_snapshot(struct dm_snapshot *snap)
 {
-	struct dm_snapshot *l;
-	struct origin *o, *new_o;
+	struct origin *o, *new_o = NULL;
 	struct block_device *bdev = snap->origin->bdev;
+	int r = 0;
 
 	new_o = kmalloc(sizeof(*new_o), GFP_KERNEL);
 	if (!new_o)
 		return -ENOMEM;
 
 	down_write(&_origins_lock);
-	o = __lookup_origin(bdev);
 
+	r = __validate_exception_handover(snap);
+	if (r < 0) {
+		kfree(new_o);
+		goto out;
+	}
+
+	o = __lookup_origin(bdev);
 	if (o)
 		kfree(new_o);
 	else {
@@ -320,14 +491,27 @@ static int register_snapshot(struct dm_snapshot *snap)
 		__insert_origin(o);
 	}
 
-	/* Sort the list according to chunk size, largest-first smallest-last */
-	list_for_each_entry(l, &o->snapshots, list)
-		if (l->store->chunk_size < snap->store->chunk_size)
-			break;
-	list_add_tail(&snap->list, &l->list);
+	__insert_snapshot(o, snap);
+
+out:
+	up_write(&_origins_lock);
+
+	return r;
+}
+
+/*
+ * Move snapshot to correct place in list according to chunk size.
+ */
+static void reregister_snapshot(struct dm_snapshot *s)
+{
+	struct block_device *bdev = s->origin->bdev;
+
+	down_write(&_origins_lock);
+
+	list_del(&s->list);
+	__insert_snapshot(__lookup_origin(bdev), s);
 
 	up_write(&_origins_lock);
-	return 0;
 }
 
 static void unregister_snapshot(struct dm_snapshot *s)
@@ -338,7 +522,7 @@ static void unregister_snapshot(struct dm_snapshot *s)
 	o = __lookup_origin(s->origin->bdev);
 
 	list_del(&s->list);
-	if (list_empty(&o->snapshots)) {
+	if (o && list_empty(&o->snapshots)) {
 		list_del(&o->hash_list);
 		kfree(o);
 	}
@@ -351,8 +535,8 @@ static void unregister_snapshot(struct dm_snapshot *s)
  * The lowest hash_shift bits of the chunk number are ignored, allowing
  * some consecutive chunks to be grouped together.
  */
-static int init_exception_table(struct exception_table *et, uint32_t size,
-				unsigned hash_shift)
+static int dm_exception_table_init(struct dm_exception_table *et,
+				   uint32_t size, unsigned hash_shift)
 {
 	unsigned int i;
 
@@ -368,10 +552,11 @@ static int init_exception_table(struct exception_table *et, uint32_t size,
 	return 0;
 }
 
-static void exit_exception_table(struct exception_table *et, struct kmem_cache *mem)
+static void dm_exception_table_exit(struct dm_exception_table *et,
+				    struct kmem_cache *mem)
 {
 	struct list_head *slot;
-	struct dm_snap_exception *ex, *next;
+	struct dm_exception *ex, *next;
 	int i, size;
 
 	size = et->hash_mask + 1;
@@ -385,19 +570,12 @@ static void exit_exception_table(struct exception_table *et, struct kmem_cache *
 	vfree(et->table);
 }
 
-static uint32_t exception_hash(struct exception_table *et, chunk_t chunk)
+static uint32_t exception_hash(struct dm_exception_table *et, chunk_t chunk)
 {
 	return (chunk >> et->hash_shift) & et->hash_mask;
 }
 
-static void insert_exception(struct exception_table *eh,
-			     struct dm_snap_exception *e)
-{
-	struct list_head *l = &eh->table[exception_hash(eh, e->old_chunk)];
-	list_add(&e->hash_list, l);
-}
-
-static void remove_exception(struct dm_snap_exception *e)
+static void dm_remove_exception(struct dm_exception *e)
 {
 	list_del(&e->hash_list);
 }
@@ -406,11 +584,11 @@ static void remove_exception(struct dm_snap_exception *e)
  * Return the exception data for a sector, or NULL if not
  * remapped.
  */
-static struct dm_snap_exception *lookup_exception(struct exception_table *et,
-						  chunk_t chunk)
+static struct dm_exception *dm_lookup_exception(struct dm_exception_table *et,
+						chunk_t chunk)
 {
 	struct list_head *slot;
-	struct dm_snap_exception *e;
+	struct dm_exception *e;
 
 	slot = &et->table[exception_hash(et, chunk)];
 	list_for_each_entry (e, slot, hash_list)
@@ -421,9 +599,9 @@ static struct dm_snap_exception *lookup_exception(struct exception_table *et,
 	return NULL;
 }
 
-static struct dm_snap_exception *alloc_exception(void)
+static struct dm_exception *alloc_completed_exception(void)
 {
-	struct dm_snap_exception *e;
+	struct dm_exception *e;
 
 	e = kmem_cache_alloc(exception_cache, GFP_NOIO);
 	if (!e)
@@ -432,7 +610,7 @@ static struct dm_snap_exception *alloc_exception(void)
 	return e;
 }
 
-static void free_exception(struct dm_snap_exception *e)
+static void free_completed_exception(struct dm_exception *e)
 {
 	kmem_cache_free(exception_cache, e);
 }
@@ -457,12 +635,11 @@ static void free_pending_exception(struct dm_snap_pending_exception *pe)
 	atomic_dec(&s->pending_exceptions_count);
 }
 
-static void insert_completed_exception(struct dm_snapshot *s,
-				       struct dm_snap_exception *new_e)
+static void dm_insert_exception(struct dm_exception_table *eh,
+				struct dm_exception *new_e)
 {
-	struct exception_table *eh = &s->complete;
 	struct list_head *l;
-	struct dm_snap_exception *e = NULL;
+	struct dm_exception *e = NULL;
 
 	l = &eh->table[exception_hash(eh, new_e->old_chunk)];
 
@@ -478,7 +655,7 @@ static void insert_completed_exception(struct dm_snapshot *s,
 		    new_e->new_chunk == (dm_chunk_number(e->new_chunk) +
 					 dm_consecutive_chunk_count(e) + 1)) {
 			dm_consecutive_chunk_count_inc(e);
-			free_exception(new_e);
+			free_completed_exception(new_e);
 			return;
 		}
 
@@ -488,7 +665,7 @@ static void insert_completed_exception(struct dm_snapshot *s,
 			dm_consecutive_chunk_count_inc(e);
 			e->old_chunk--;
 			e->new_chunk--;
-			free_exception(new_e);
+			free_completed_exception(new_e);
 			return;
 		}
 
@@ -507,9 +684,9 @@ out:
 static int dm_add_exception(void *context, chunk_t old, chunk_t new)
 {
 	struct dm_snapshot *s = context;
-	struct dm_snap_exception *e;
+	struct dm_exception *e;
 
-	e = alloc_exception();
+	e = alloc_completed_exception();
 	if (!e)
 		return -ENOMEM;
 
@@ -518,11 +695,30 @@ static int dm_add_exception(void *context, chunk_t old, chunk_t new)
 	/* Consecutive_count is implicitly initialised to zero */
 	e->new_chunk = new;
 
-	insert_completed_exception(s, e);
+	dm_insert_exception(&s->complete, e);
 
 	return 0;
 }
 
+#define min_not_zero(l, r) (((l) == 0) ? (r) : (((r) == 0) ? (l) : min(l, r)))
+
+/*
+ * Return a minimum chunk size of all snapshots that have the specified origin.
+ * Return zero if the origin has no snapshots.
+ */
+static sector_t __minimum_chunk_size(struct origin *o)
+{
+	struct dm_snapshot *snap;
+	unsigned chunk_size = 0;
+
+	if (o)
+		list_for_each_entry(snap, &o->snapshots, list)
+			chunk_size = min_not_zero(chunk_size,
+						  snap->store->chunk_size);
+
+	return chunk_size;
+}
+
 /*
  * Hard coded magic.
  */
@@ -546,16 +742,18 @@ static int init_hash_tables(struct dm_snapshot *s)
 	 * Calculate based on the size of the original volume or
 	 * the COW volume...
 	 */
-	cow_dev_size = get_dev_size(s->store->cow->bdev);
+	cow_dev_size = get_dev_size(s->cow->bdev);
 	origin_dev_size = get_dev_size(s->origin->bdev);
 	max_buckets = calc_max_buckets();
 
 	hash_size = min(origin_dev_size, cow_dev_size) >> s->store->chunk_shift;
 	hash_size = min(hash_size, max_buckets);
 
+	if (hash_size < 64)
+		hash_size = 64;
 	hash_size = rounddown_pow_of_two(hash_size);
-	if (init_exception_table(&s->complete, hash_size,
-				 DM_CHUNK_CONSECUTIVE_BITS))
+	if (dm_exception_table_init(&s->complete, hash_size,
+				    DM_CHUNK_CONSECUTIVE_BITS))
 		return -ENOMEM;
 
 	/*
@@ -566,14 +764,284 @@ static int init_hash_tables(struct dm_snapshot *s)
 	if (hash_size < 64)
 		hash_size = 64;
 
-	if (init_exception_table(&s->pending, hash_size, 0)) {
-		exit_exception_table(&s->complete, exception_cache);
+	if (dm_exception_table_init(&s->pending, hash_size, 0)) {
+		dm_exception_table_exit(&s->complete, exception_cache);
 		return -ENOMEM;
 	}
 
 	return 0;
 }
 
+static void merge_shutdown(struct dm_snapshot *s)
+{
+	clear_bit_unlock(RUNNING_MERGE, &s->state_bits);
+	smp_mb__after_clear_bit();
+	wake_up_bit(&s->state_bits, RUNNING_MERGE);
+}
+
+static struct bio *__release_queued_bios_after_merge(struct dm_snapshot *s)
+{
+	s->first_merging_chunk = 0;
+	s->num_merging_chunks = 0;
+
+	return bio_list_get(&s->bios_queued_during_merge);
+}
+
+/*
+ * Remove one chunk from the index of completed exceptions.
+ */
+static int __remove_single_exception_chunk(struct dm_snapshot *s,
+					   chunk_t old_chunk)
+{
+	struct dm_exception *e;
+
+	e = dm_lookup_exception(&s->complete, old_chunk);
+	if (!e) {
+		DMERR("Corruption detected: exception for block %llu is "
+		      "on disk but not in memory",
+		      (unsigned long long)old_chunk);
+		return -EINVAL;
+	}
+
+	/*
+	 * If this is the only chunk using this exception, remove exception.
+	 */
+	if (!dm_consecutive_chunk_count(e)) {
+		dm_remove_exception(e);
+		free_completed_exception(e);
+		return 0;
+	}
+
+	/*
+	 * The chunk may be either at the beginning or the end of a
+	 * group of consecutive chunks - never in the middle.  We are
+	 * removing chunks in the opposite order to that in which they
+	 * were added, so this should always be true.
+	 * Decrement the consecutive chunk counter and adjust the
+	 * starting point if necessary.
+	 */
+	if (old_chunk == e->old_chunk) {
+		e->old_chunk++;
+		e->new_chunk++;
+	} else if (old_chunk != e->old_chunk +
+		   dm_consecutive_chunk_count(e)) {
+		DMERR("Attempt to merge block %llu from the "
+		      "middle of a chunk range [%llu - %llu]",
+		      (unsigned long long)old_chunk,
+		      (unsigned long long)e->old_chunk,
+		      (unsigned long long)
+		      e->old_chunk + dm_consecutive_chunk_count(e));
+		return -EINVAL;
+	}
+
+	dm_consecutive_chunk_count_dec(e);
+
+	return 0;
+}
+
+static void flush_bios(struct bio *bio);
+
+static int remove_single_exception_chunk(struct dm_snapshot *s)
+{
+	struct bio *b = NULL;
+	int r;
+	chunk_t old_chunk = s->first_merging_chunk + s->num_merging_chunks - 1;
+
+	down_write(&s->lock);
+
+	/*
+	 * Process chunks (and associated exceptions) in reverse order
+	 * so that dm_consecutive_chunk_count_dec() accounting works.
+	 */
+	do {
+		r = __remove_single_exception_chunk(s, old_chunk);
+		if (r)
+			goto out;
+	} while (old_chunk-- > s->first_merging_chunk);
+
+	b = __release_queued_bios_after_merge(s);
+
+out:
+	up_write(&s->lock);
+	if (b)
+		flush_bios(b);
+
+	return r;
+}
+
+static int origin_write_extent(struct dm_snapshot *merging_snap,
+			       sector_t sector, unsigned chunk_size);
+
+static void merge_callback(int read_err, unsigned long write_err,
+			   void *context);
+
+static uint64_t read_pending_exceptions_done_count(void)
+{
+	uint64_t pending_exceptions_done;
+
+	spin_lock(&_pending_exceptions_done_spinlock);
+	pending_exceptions_done = _pending_exceptions_done_count;
+	spin_unlock(&_pending_exceptions_done_spinlock);
+
+	return pending_exceptions_done;
+}
+
+static void increment_pending_exceptions_done_count(void)
+{
+	spin_lock(&_pending_exceptions_done_spinlock);
+	_pending_exceptions_done_count++;
+	spin_unlock(&_pending_exceptions_done_spinlock);
+
+	wake_up_all(&_pending_exceptions_done);
+}
+
+static void snapshot_merge_next_chunks(struct dm_snapshot *s)
+{
+	int i, linear_chunks;
+	chunk_t old_chunk, new_chunk;
+	struct dm_io_region src, dest;
+	sector_t io_size;
+	uint64_t previous_count;
+
+	BUG_ON(!test_bit(RUNNING_MERGE, &s->state_bits));
+	if (unlikely(test_bit(SHUTDOWN_MERGE, &s->state_bits)))
+		goto shut;
+
+	/*
+	 * valid flag never changes during merge, so no lock required.
+	 */
+	if (!s->valid) {
+		DMERR("Snapshot is invalid: can't merge");
+		goto shut;
+	}
+
+	linear_chunks = s->store->type->prepare_merge(s->store, &old_chunk,
+						      &new_chunk);
+	if (linear_chunks <= 0) {
+		if (linear_chunks < 0) {
+			DMERR("Read error in exception store: "
+			      "shutting down merge");
+			down_write(&s->lock);
+			s->merge_failed = 1;
+			up_write(&s->lock);
+		}
+		goto shut;
+	}
+
+	/* Adjust old_chunk and new_chunk to reflect start of linear region */
+	old_chunk = old_chunk + 1 - linear_chunks;
+	new_chunk = new_chunk + 1 - linear_chunks;
+
+	/*
+	 * Use one (potentially large) I/O to copy all 'linear_chunks'
+	 * from the exception store to the origin
+	 */
+	io_size = linear_chunks * s->store->chunk_size;
+
+	dest.bdev = s->origin->bdev;
+	dest.sector = chunk_to_sector(s->store, old_chunk);
+	dest.count = min(io_size, get_dev_size(dest.bdev) - dest.sector);
+
+	src.bdev = s->cow->bdev;
+	src.sector = chunk_to_sector(s->store, new_chunk);
+	src.count = dest.count;
+
+	/*
+	 * Reallocate any exceptions needed in other snapshots then
+	 * wait for the pending exceptions to complete.
+	 * Each time any pending exception (globally on the system)
+	 * completes we are woken and repeat the process to find out
+	 * if we can proceed.  While this may not seem a particularly
+	 * efficient algorithm, it is not expected to have any
+	 * significant impact on performance.
+	 */
+	previous_count = read_pending_exceptions_done_count();
+	while (origin_write_extent(s, dest.sector, io_size)) {
+		wait_event(_pending_exceptions_done,
+			   (read_pending_exceptions_done_count() !=
+			    previous_count));
+		/* Retry after the wait, until all exceptions are done. */
+		previous_count = read_pending_exceptions_done_count();
+	}
+
+	down_write(&s->lock);
+	s->first_merging_chunk = old_chunk;
+	s->num_merging_chunks = linear_chunks;
+	up_write(&s->lock);
+
+	/* Wait until writes to all 'linear_chunks' drain */
+	for (i = 0; i < linear_chunks; i++)
+		__check_for_conflicting_io(s, old_chunk + i);
+
+	dm_kcopyd_copy(s->kcopyd_client, &src, 1, &dest, 0, merge_callback, s);
+	return;
+
+shut:
+	merge_shutdown(s);
+}
+
+static void error_bios(struct bio *bio);
+
+static void merge_callback(int read_err, unsigned long write_err, void *context)
+{
+	struct dm_snapshot *s = context;
+	struct bio *b = NULL;
+
+	if (read_err || write_err) {
+		if (read_err)
+			DMERR("Read error: shutting down merge.");
+		else
+			DMERR("Write error: shutting down merge.");
+		goto shut;
+	}
+
+	if (s->store->type->commit_merge(s->store,
+					 s->num_merging_chunks) < 0) {
+		DMERR("Write error in exception store: shutting down merge");
+		goto shut;
+	}
+
+	if (remove_single_exception_chunk(s) < 0)
+		goto shut;
+
+	snapshot_merge_next_chunks(s);
+
+	return;
+
+shut:
+	down_write(&s->lock);
+	s->merge_failed = 1;
+	b = __release_queued_bios_after_merge(s);
+	up_write(&s->lock);
+	error_bios(b);
+
+	merge_shutdown(s);
+}
+
+static void start_merge(struct dm_snapshot *s)
+{
+	if (!test_and_set_bit(RUNNING_MERGE, &s->state_bits))
+		snapshot_merge_next_chunks(s);
+}
+
+static int wait_schedule(void *ptr)
+{
+	schedule();
+
+	return 0;
+}
+
+/*
+ * Stop the merging process and wait until it finishes.
+ */
+static void stop_merge(struct dm_snapshot *s)
+{
+	set_bit(SHUTDOWN_MERGE, &s->state_bits);
+	wait_on_bit(&s->state_bits, RUNNING_MERGE, wait_schedule,
+		    TASK_UNINTERRUPTIBLE);
+	clear_bit(SHUTDOWN_MERGE, &s->state_bits);
+}
+
 /*
  * Construct a snapshot mapping: <origin_dev> <COW-dev> <p/n> <chunk-size>
  */
@@ -582,50 +1050,73 @@ static int snapshot_ctr(struct dm_target *ti, unsigned int argc, char **argv)
 	struct dm_snapshot *s;
 	int i;
 	int r = -EINVAL;
-	char *origin_path;
-	struct dm_exception_store *store;
-	unsigned args_used;
+	char *origin_path, *cow_path;
+	unsigned args_used, num_flush_requests = 1;
+	fmode_t origin_mode = FMODE_READ;
 
 	if (argc != 4) {
 		ti->error = "requires exactly 4 arguments";
 		r = -EINVAL;
-		goto bad_args;
+		goto bad;
+	}
+
+	if (dm_target_is_snapshot_merge(ti)) {
+		num_flush_requests = 2;
+		origin_mode = FMODE_WRITE;
 	}
 
 	origin_path = argv[0];
 	argv++;
 	argc--;
 
-	r = dm_exception_store_create(ti, argc, argv, &args_used, &store);
+	s = kmalloc(sizeof(*s), GFP_KERNEL);
+	if (!s) {
+		ti->error = "Cannot allocate snapshot context private "
+		    "structure";
+		r = -ENOMEM;
+		goto bad;
+	}
+
+	cow_path = argv[0];
+	argv++;
+	argc--;
+
+	r = dm_get_device(ti, cow_path, 0, 0,
+			  FMODE_READ | FMODE_WRITE, &s->cow);
+	if (r) {
+		ti->error = "Cannot get COW device";
+		goto bad_cow;
+	}
+
+	r = dm_exception_store_create(ti, argc, argv, s, &args_used, &s->store);
 	if (r) {
 		ti->error = "Couldn't create exception store";
 		r = -EINVAL;
-		goto bad_args;
+		goto bad_store;
 	}
 
 	argv += args_used;
 	argc -= args_used;
 
-	s = kmalloc(sizeof(*s), GFP_KERNEL);
-	if (!s) {
-		ti->error = "Cannot allocate snapshot context private "
-		    "structure";
-		r = -ENOMEM;
-		goto bad_snap;
-	}
-
-	r = dm_get_device(ti, origin_path, 0, ti->len, FMODE_READ, &s->origin);
+	r = dm_get_device(ti, origin_path, 0, ti->len, origin_mode, &s->origin);
 	if (r) {
 		ti->error = "Cannot get origin device";
 		goto bad_origin;
 	}
 
-	s->store = store;
+	s->ti = ti;
 	s->valid = 1;
 	s->active = 0;
+	s->suspended = 0;
 	atomic_set(&s->pending_exceptions_count, 0);
 	init_rwsem(&s->lock);
+	INIT_LIST_HEAD(&s->list);
 	spin_lock_init(&s->pe_lock);
+	s->state_bits = 0;
+	s->merge_failed = 0;
+	s->first_merging_chunk = 0;
+	s->num_merging_chunks = 0;
+	bio_list_init(&s->bios_queued_during_merge);
 
 	/* Allocate hash table for COW data */
 	if (init_hash_tables(s)) {
@@ -659,39 +1150,55 @@ static int snapshot_ctr(struct dm_target *ti, unsigned int argc, char **argv)
 
 	spin_lock_init(&s->tracked_chunk_lock);
 
-	/* Metadata must only be loaded into one table at once */
+	bio_list_init(&s->queued_bios);
+	INIT_WORK(&s->queued_bios_work, flush_queued_bios);
+
+	ti->private = s;
+	ti->num_flush_requests = num_flush_requests;
+
+	/* Add snapshot to the list of snapshots for this origin */
+	/* Exceptions aren't triggered till snapshot_resume() is called */
+	r = register_snapshot(s);
+	if (r == -ENOMEM) {
+		ti->error = "Snapshot origin struct allocation failed";
+		goto bad_load_and_register;
+	} else if (r < 0) {
+		/* invalid handover, register_snapshot has set ti->error */
+		goto bad_load_and_register;
+	}
+
+	/*
+	 * Metadata must only be loaded into one table at once, so skip this
+	 * if metadata will be handed over during resume.
+	 * Chunk size will be set during the handover - set it to zero to
+	 * ensure it's ignored.
+	 */
+	if (r > 0) {
+		s->store->chunk_size = 0;
+		return 0;
+	}
+
 	r = s->store->type->read_metadata(s->store, dm_add_exception,
 					  (void *)s);
 	if (r < 0) {
 		ti->error = "Failed to read snapshot metadata";
-		goto bad_load_and_register;
+		goto bad_read_metadata;
 	} else if (r > 0) {
 		s->valid = 0;
 		DMWARN("Snapshot is marked invalid.");
 	}
 
-	bio_list_init(&s->queued_bios);
-	INIT_WORK(&s->queued_bios_work, flush_queued_bios);
-
 	if (!s->store->chunk_size) {
 		ti->error = "Chunk size not set";
-		goto bad_load_and_register;
-	}
-
-	/* Add snapshot to the list of snapshots for this origin */
-	/* Exceptions aren't triggered till snapshot_resume() is called */
-	if (register_snapshot(s)) {
-		r = -EINVAL;
-		ti->error = "Cannot register snapshot origin";
-		goto bad_load_and_register;
+		goto bad_read_metadata;
 	}
-
-	ti->private = s;
 	ti->split_io = s->store->chunk_size;
-	ti->num_flush_requests = 1;
 
 	return 0;
 
+bad_read_metadata:
+	unregister_snapshot(s);
+
 bad_load_and_register:
 	mempool_destroy(s->tracked_chunk_pool);
 
@@ -702,19 +1209,22 @@ bad_pending_pool:
 	dm_kcopyd_client_destroy(s->kcopyd_client);
 
 bad_kcopyd:
-	exit_exception_table(&s->pending, pending_cache);
-	exit_exception_table(&s->complete, exception_cache);
+	dm_exception_table_exit(&s->pending, pending_cache);
+	dm_exception_table_exit(&s->complete, exception_cache);
 
 bad_hash_tables:
 	dm_put_device(ti, s->origin);
 
 bad_origin:
-	kfree(s);
+	dm_exception_store_destroy(s->store);
 
-bad_snap:
-	dm_exception_store_destroy(store);
+bad_store:
+	dm_put_device(ti, s->cow);
+
+bad_cow:
+	kfree(s);
 
-bad_args:
+bad:
 	return r;
 }
 
@@ -723,8 +1233,39 @@ static void __free_exceptions(struct dm_snapshot *s)
 	dm_kcopyd_client_destroy(s->kcopyd_client);
 	s->kcopyd_client = NULL;
 
-	exit_exception_table(&s->pending, pending_cache);
-	exit_exception_table(&s->complete, exception_cache);
+	dm_exception_table_exit(&s->pending, pending_cache);
+	dm_exception_table_exit(&s->complete, exception_cache);
+}
+
+static void __handover_exceptions(struct dm_snapshot *snap_src,
+				  struct dm_snapshot *snap_dest)
+{
+	union {
+		struct dm_exception_table table_swap;
+		struct dm_exception_store *store_swap;
+	} u;
+
+	/*
+	 * Swap all snapshot context information between the two instances.
+	 */
+	u.table_swap = snap_dest->complete;
+	snap_dest->complete = snap_src->complete;
+	snap_src->complete = u.table_swap;
+
+	u.store_swap = snap_dest->store;
+	snap_dest->store = snap_src->store;
+	snap_src->store = u.store_swap;
+
+	snap_dest->store->snap = snap_dest;
+	snap_src->store->snap = snap_src;
+
+	snap_dest->ti->split_io = snap_dest->store->chunk_size;
+	snap_dest->valid = snap_src->valid;
+
+	/*
+	 * Set source invalid to ensure it receives no further I/O.
+	 */
+	snap_src->valid = 0;
 }
 
 static void snapshot_dtr(struct dm_target *ti)
@@ -733,9 +1274,24 @@ static void snapshot_dtr(struct dm_target *ti)
 	int i;
 #endif
 	struct dm_snapshot *s = ti->private;
+	struct dm_snapshot *snap_src = NULL, *snap_dest = NULL;
 
 	flush_workqueue(ksnapd);
 
+	down_read(&_origins_lock);
+	/* Check whether exception handover must be cancelled */
+	(void) __find_snapshots_sharing_cow(s, &snap_src, &snap_dest, NULL);
+	if (snap_src && snap_dest && (s == snap_src)) {
+		down_write(&snap_dest->lock);
+		snap_dest->valid = 0;
+		up_write(&snap_dest->lock);
+		DMERR("Cancelling snapshot handover.");
+	}
+	up_read(&_origins_lock);
+
+	if (dm_target_is_snapshot_merge(ti))
+		stop_merge(s);
+
 	/* Prevent further origin writes from using this snapshot. */
 	/* After this returns there can be no new kcopyd jobs. */
 	unregister_snapshot(s);
@@ -763,6 +1319,8 @@ static void snapshot_dtr(struct dm_target *ti)
 
 	dm_exception_store_destroy(s->store);
 
+	dm_put_device(ti, s->cow);
+
 	kfree(s);
 }
 
@@ -795,6 +1353,26 @@ static void flush_queued_bios(struct work_struct *work)
 	flush_bios(queued_bios);
 }
 
+static int do_origin(struct dm_dev *origin, struct bio *bio);
+
+/*
+ * Flush a list of buffers.
+ */
+static void retry_origin_bios(struct dm_snapshot *s, struct bio *bio)
+{
+	struct bio *n;
+	int r;
+
+	while (bio) {
+		n = bio->bi_next;
+		bio->bi_next = NULL;
+		r = do_origin(s->origin, bio);
+		if (r == DM_MAPIO_REMAPPED)
+			generic_make_request(bio);
+		bio = n;
+	}
+}
+
 /*
  * Error a list of buffers.
  */
@@ -825,45 +1403,12 @@ static void __invalidate_snapshot(struct dm_snapshot *s, int err)
 
 	s->valid = 0;
 
-	dm_table_event(s->store->ti->table);
-}
-
-static void get_pending_exception(struct dm_snap_pending_exception *pe)
-{
-	atomic_inc(&pe->ref_count);
-}
-
-static struct bio *put_pending_exception(struct dm_snap_pending_exception *pe)
-{
-	struct dm_snap_pending_exception *primary_pe;
-	struct bio *origin_bios = NULL;
-
-	primary_pe = pe->primary_pe;
-
-	/*
-	 * If this pe is involved in a write to the origin and
-	 * it is the last sibling to complete then release
-	 * the bios for the original write to the origin.
-	 */
-	if (primary_pe &&
-	    atomic_dec_and_test(&primary_pe->ref_count)) {
-		origin_bios = bio_list_get(&primary_pe->origin_bios);
-		free_pending_exception(primary_pe);
-	}
-
-	/*
-	 * Free the pe if it's not linked to an origin write or if
-	 * it's not itself a primary pe.
-	 */
-	if (!primary_pe || primary_pe != pe)
-		free_pending_exception(pe);
-
-	return origin_bios;
+	dm_table_event(s->ti->table);
 }
 
 static void pending_complete(struct dm_snap_pending_exception *pe, int success)
 {
-	struct dm_snap_exception *e;
+	struct dm_exception *e;
 	struct dm_snapshot *s = pe->snap;
 	struct bio *origin_bios = NULL;
 	struct bio *snapshot_bios = NULL;
@@ -877,7 +1422,7 @@ static void pending_complete(struct dm_snap_pending_exception *pe, int success)
 		goto out;
 	}
 
-	e = alloc_exception();
+	e = alloc_completed_exception();
 	if (!e) {
 		down_write(&s->lock);
 		__invalidate_snapshot(s, -ENOMEM);
@@ -888,28 +1433,27 @@ static void pending_complete(struct dm_snap_pending_exception *pe, int success)
 
 	down_write(&s->lock);
 	if (!s->valid) {
-		free_exception(e);
+		free_completed_exception(e);
 		error = 1;
 		goto out;
 	}
 
-	/*
-	 * Check for conflicting reads. This is extremely improbable,
-	 * so msleep(1) is sufficient and there is no need for a wait queue.
-	 */
-	while (__chunk_is_tracked(s, pe->e.old_chunk))
-		msleep(1);
+	/* Check for conflicting reads */
+	__check_for_conflicting_io(s, pe->e.old_chunk);
 
 	/*
 	 * Add a proper exception, and remove the
 	 * in-flight exception from the list.
 	 */
-	insert_completed_exception(s, e);
+	dm_insert_exception(&s->complete, e);
 
  out:
-	remove_exception(&pe->e);
+	dm_remove_exception(&pe->e);
 	snapshot_bios = bio_list_get(&pe->snapshot_bios);
-	origin_bios = put_pending_exception(pe);
+	origin_bios = bio_list_get(&pe->origin_bios);
+	free_pending_exception(pe);
+
+	increment_pending_exceptions_done_count();
 
 	up_write(&s->lock);
 
@@ -919,7 +1463,7 @@ static void pending_complete(struct dm_snap_pending_exception *pe, int success)
 	else
 		flush_bios(snapshot_bios);
 
-	flush_bios(origin_bios);
+	retry_origin_bios(s, origin_bios);
 }
 
 static void commit_callback(void *context, int success)
@@ -963,7 +1507,7 @@ static void start_copy(struct dm_snap_pending_exception *pe)
 	src.sector = chunk_to_sector(s->store, pe->e.old_chunk);
 	src.count = min((sector_t)s->store->chunk_size, dev_size - src.sector);
 
-	dest.bdev = s->store->cow->bdev;
+	dest.bdev = s->cow->bdev;
 	dest.sector = chunk_to_sector(s->store, pe->e.new_chunk);
 	dest.count = src.count;
 
@@ -975,7 +1519,7 @@ static void start_copy(struct dm_snap_pending_exception *pe)
 static struct dm_snap_pending_exception *
 __lookup_pending_exception(struct dm_snapshot *s, chunk_t chunk)
 {
-	struct dm_snap_exception *e = lookup_exception(&s->pending, chunk);
+	struct dm_exception *e = dm_lookup_exception(&s->pending, chunk);
 
 	if (!e)
 		return NULL;
@@ -1006,8 +1550,6 @@ __find_pending_exception(struct dm_snapshot *s,
 	pe->e.old_chunk = chunk;
 	bio_list_init(&pe->origin_bios);
 	bio_list_init(&pe->snapshot_bios);
-	pe->primary_pe = NULL;
-	atomic_set(&pe->ref_count, 0);
 	pe->started = 0;
 
 	if (s->store->type->prepare_exception(s->store, &pe->e)) {
@@ -1015,16 +1557,15 @@ __find_pending_exception(struct dm_snapshot *s,
 		return NULL;
 	}
 
-	get_pending_exception(pe);
-	insert_exception(&s->pending, &pe->e);
+	dm_insert_exception(&s->pending, &pe->e);
 
 	return pe;
 }
 
-static void remap_exception(struct dm_snapshot *s, struct dm_snap_exception *e,
+static void remap_exception(struct dm_snapshot *s, struct dm_exception *e,
 			    struct bio *bio, chunk_t chunk)
 {
-	bio->bi_bdev = s->store->cow->bdev;
+	bio->bi_bdev = s->cow->bdev;
 	bio->bi_sector = chunk_to_sector(s->store,
 					 dm_chunk_number(e->new_chunk) +
 					 (chunk - e->old_chunk)) +
@@ -1035,14 +1576,14 @@ static void remap_exception(struct dm_snapshot *s, struct dm_snap_exception *e,
 static int snapshot_map(struct dm_target *ti, struct bio *bio,
 			union map_info *map_context)
 {
-	struct dm_snap_exception *e;
+	struct dm_exception *e;
 	struct dm_snapshot *s = ti->private;
 	int r = DM_MAPIO_REMAPPED;
 	chunk_t chunk;
 	struct dm_snap_pending_exception *pe = NULL;
 
 	if (unlikely(bio_empty_barrier(bio))) {
-		bio->bi_bdev = s->store->cow->bdev;
+		bio->bi_bdev = s->cow->bdev;
 		return DM_MAPIO_REMAPPED;
 	}
 
@@ -1063,7 +1604,7 @@ static int snapshot_map(struct dm_target *ti, struct bio *bio,
 	}
 
 	/* If the block is already remapped - use that, else remap it */
-	e = lookup_exception(&s->complete, chunk);
+	e = dm_lookup_exception(&s->complete, chunk);
 	if (e) {
 		remap_exception(s, e, bio, chunk);
 		goto out_unlock;
@@ -1087,7 +1628,7 @@ static int snapshot_map(struct dm_target *ti, struct bio *bio,
 				goto out_unlock;
 			}
 
-			e = lookup_exception(&s->complete, chunk);
+			e = dm_lookup_exception(&s->complete, chunk);
 			if (e) {
 				free_pending_exception(pe);
 				remap_exception(s, e, bio, chunk);
@@ -1125,6 +1666,78 @@ static int snapshot_map(struct dm_target *ti, struct bio *bio,
 	return r;
 }
 
+/*
+ * A snapshot-merge target behaves like a combination of a snapshot
+ * target and a snapshot-origin target.  It only generates new
+ * exceptions in other snapshots and not in the one that is being
+ * merged.
+ *
+ * For each chunk, if there is an existing exception, it is used to
+ * redirect I/O to the cow device.  Otherwise I/O is sent to the origin,
+ * which in turn might generate exceptions in other snapshots.
+ * If merging is currently taking place on the chunk in question, the
+ * I/O is deferred by adding it to s->bios_queued_during_merge.
+ */
+static int snapshot_merge_map(struct dm_target *ti, struct bio *bio,
+			      union map_info *map_context)
+{
+	struct dm_exception *e;
+	struct dm_snapshot *s = ti->private;
+	int r = DM_MAPIO_REMAPPED;
+	chunk_t chunk;
+
+	if (unlikely(bio_empty_barrier(bio))) {
+		if (!map_context->flush_request)
+			bio->bi_bdev = s->origin->bdev;
+		else
+			bio->bi_bdev = s->cow->bdev;
+		map_context->ptr = NULL;
+		return DM_MAPIO_REMAPPED;
+	}
+
+	chunk = sector_to_chunk(s->store, bio->bi_sector);
+
+	down_write(&s->lock);
+
+	/* Full merging snapshots are redirected to the origin */
+	if (!s->valid)
+		goto redirect_to_origin;
+
+	/* If the block is already remapped - use that */
+	e = dm_lookup_exception(&s->complete, chunk);
+	if (e) {
+		/* Queue writes overlapping with chunks being merged */
+		if (bio_rw(bio) == WRITE &&
+		    chunk >= s->first_merging_chunk &&
+		    chunk < (s->first_merging_chunk +
+			     s->num_merging_chunks)) {
+			bio->bi_bdev = s->origin->bdev;
+			bio_list_add(&s->bios_queued_during_merge, bio);
+			r = DM_MAPIO_SUBMITTED;
+			goto out_unlock;
+		}
+
+		remap_exception(s, e, bio, chunk);
+
+		if (bio_rw(bio) == WRITE)
+			map_context->ptr = track_chunk(s, chunk);
+		goto out_unlock;
+	}
+
+redirect_to_origin:
+	bio->bi_bdev = s->origin->bdev;
+
+	if (bio_rw(bio) == WRITE) {
+		up_write(&s->lock);
+		return do_origin(s->origin, bio);
+	}
+
+out_unlock:
+	up_write(&s->lock);
+
+	return r;
+}
+
 static int snapshot_end_io(struct dm_target *ti, struct bio *bio,
 			   int error, union map_info *map_context)
 {
@@ -1137,40 +1750,135 @@ static int snapshot_end_io(struct dm_target *ti, struct bio *bio,
 	return 0;
 }
 
+static void snapshot_merge_presuspend(struct dm_target *ti)
+{
+	struct dm_snapshot *s = ti->private;
+
+	stop_merge(s);
+}
+
+static void snapshot_postsuspend(struct dm_target *ti)
+{
+	struct dm_snapshot *s = ti->private;
+
+	down_write(&s->lock);
+	s->suspended = 1;
+	up_write(&s->lock);
+}
+
+static int snapshot_preresume(struct dm_target *ti)
+{
+	int r = 0;
+	struct dm_snapshot *s = ti->private;
+	struct dm_snapshot *snap_src = NULL, *snap_dest = NULL;
+
+	down_read(&_origins_lock);
+	(void) __find_snapshots_sharing_cow(s, &snap_src, &snap_dest, NULL);
+	if (snap_src && snap_dest) {
+		down_read(&snap_src->lock);
+		if (s == snap_src) {
+			DMERR("Unable to resume snapshot source until "
+			      "handover completes.");
+			r = -EINVAL;
+		} else if (!snap_src->suspended) {
+			DMERR("Unable to perform snapshot handover until "
+			      "source is suspended.");
+			r = -EINVAL;
+		}
+		up_read(&snap_src->lock);
+	}
+	up_read(&_origins_lock);
+
+	return r;
+}
+
 static void snapshot_resume(struct dm_target *ti)
 {
 	struct dm_snapshot *s = ti->private;
+	struct dm_snapshot *snap_src = NULL, *snap_dest = NULL;
+
+	down_read(&_origins_lock);
+	(void) __find_snapshots_sharing_cow(s, &snap_src, &snap_dest, NULL);
+	if (snap_src && snap_dest) {
+		down_write(&snap_src->lock);
+		down_write_nested(&snap_dest->lock, SINGLE_DEPTH_NESTING);
+		__handover_exceptions(snap_src, snap_dest);
+		up_write(&snap_dest->lock);
+		up_write(&snap_src->lock);
+	}
+	up_read(&_origins_lock);
+
+	/* Now we have correct chunk size, reregister */
+	reregister_snapshot(s);
 
 	down_write(&s->lock);
 	s->active = 1;
+	s->suspended = 0;
 	up_write(&s->lock);
 }
 
+static sector_t get_origin_minimum_chunksize(struct block_device *bdev)
+{
+	sector_t min_chunksize;
+
+	down_read(&_origins_lock);
+	min_chunksize = __minimum_chunk_size(__lookup_origin(bdev));
+	up_read(&_origins_lock);
+
+	return min_chunksize;
+}
+
+static void snapshot_merge_resume(struct dm_target *ti)
+{
+	struct dm_snapshot *s = ti->private;
+
+	/*
+	 * Handover exceptions from existing snapshot.
+	 */
+	snapshot_resume(ti);
+
+	/*
+	 * snapshot-merge acts as an origin, so set ti->split_io
+	 */
+	ti->split_io = get_origin_minimum_chunksize(s->origin->bdev);
+
+	start_merge(s);
+}
+
 static int snapshot_status(struct dm_target *ti, status_type_t type,
 			   char *result, unsigned int maxlen)
 {
 	unsigned sz = 0;
 	struct dm_snapshot *snap = ti->private;
 
-	down_write(&snap->lock);
-
 	switch (type) {
 	case STATUSTYPE_INFO:
+
+		down_write(&snap->lock);
+
 		if (!snap->valid)
 			DMEMIT("Invalid");
+		else if (snap->merge_failed)
+			DMEMIT("Merge failed");
 		else {
-			if (snap->store->type->fraction_full) {
-				sector_t numerator, denominator;
-				snap->store->type->fraction_full(snap->store,
-								 &numerator,
-								 &denominator);
-				DMEMIT("%llu/%llu",
-				       (unsigned long long)numerator,
-				       (unsigned long long)denominator);
+			if (snap->store->type->usage) {
+				sector_t total_sectors, sectors_allocated,
+					 metadata_sectors;
+				snap->store->type->usage(snap->store,
+							 &total_sectors,
+							 &sectors_allocated,
+							 &metadata_sectors);
+				DMEMIT("%llu/%llu %llu",
+				       (unsigned long long)sectors_allocated,
+				       (unsigned long long)total_sectors,
+				       (unsigned long long)metadata_sectors);
 			}
 			else
 				DMEMIT("Unknown");
 		}
+
+		up_write(&snap->lock);
+
 		break;
 
 	case STATUSTYPE_TABLE:
@@ -1179,14 +1887,12 @@ static int snapshot_status(struct dm_target *ti, status_type_t type,
 		 * to make private copies if the output is to
 		 * make sense.
 		 */
-		DMEMIT("%s", snap->origin->name);
+		DMEMIT("%s %s", snap->origin->name, snap->cow->name);
 		snap->store->type->status(snap->store, type, result + sz,
 					  maxlen - sz);
 		break;
 	}
 
-	up_write(&snap->lock);
-
 	return 0;
 }
 
@@ -1202,17 +1908,36 @@ static int snapshot_iterate_devices(struct dm_target *ti,
 /*-----------------------------------------------------------------
  * Origin methods
  *---------------------------------------------------------------*/
-static int __origin_write(struct list_head *snapshots, struct bio *bio)
+
+/*
+ * If no exceptions need creating, DM_MAPIO_REMAPPED is returned and any
+ * supplied bio was ignored.  The caller may submit it immediately.
+ * (No remapping actually occurs as the origin is always a direct linear
+ * map.)
+ *
+ * If further exceptions are required, DM_MAPIO_SUBMITTED is returned
+ * and any supplied bio is added to a list to be submitted once all
+ * the necessary exceptions exist.
+ */
+static int __origin_write(struct list_head *snapshots, sector_t sector,
+			  struct bio *bio)
 {
-	int r = DM_MAPIO_REMAPPED, first = 0;
+	int r = DM_MAPIO_REMAPPED;
 	struct dm_snapshot *snap;
-	struct dm_snap_exception *e;
-	struct dm_snap_pending_exception *pe, *next_pe, *primary_pe = NULL;
+	struct dm_exception *e;
+	struct dm_snap_pending_exception *pe;
+	struct dm_snap_pending_exception *pe_to_start_now = NULL;
+	struct dm_snap_pending_exception *pe_to_start_last = NULL;
 	chunk_t chunk;
-	LIST_HEAD(pe_queue);
 
 	/* Do all the snapshots on this origin */
 	list_for_each_entry (snap, snapshots, list) {
+		/*
+		 * Don't make new exceptions in a merging snapshot
+		 * because it has effectively been deleted
+		 */
+		if (dm_target_is_snapshot_merge(snap->ti))
+			continue;
 
 		down_write(&snap->lock);
 
@@ -1221,24 +1946,21 @@ static int __origin_write(struct list_head *snapshots, struct bio *bio)
 			goto next_snapshot;
 
 		/* Nothing to do if writing beyond end of snapshot */
-		if (bio->bi_sector >= dm_table_get_size(snap->store->ti->table))
+		if (sector >= dm_table_get_size(snap->ti->table))
 			goto next_snapshot;
 
 		/*
 		 * Remember, different snapshots can have
 		 * different chunk sizes.
 		 */
-		chunk = sector_to_chunk(snap->store, bio->bi_sector);
+		chunk = sector_to_chunk(snap->store, sector);
 
 		/*
 		 * Check exception table to see if block
 		 * is already remapped in this snapshot
 		 * and trigger an exception if not.
-		 *
-		 * ref_count is initialised to 1 so pending_complete()
-		 * won't destroy the primary_pe while we're inside this loop.
 		 */
-		e = lookup_exception(&snap->complete, chunk);
+		e = dm_lookup_exception(&snap->complete, chunk);
 		if (e)
 			goto next_snapshot;
 
@@ -1253,7 +1975,7 @@ static int __origin_write(struct list_head *snapshots, struct bio *bio)
 				goto next_snapshot;
 			}
 
-			e = lookup_exception(&snap->complete, chunk);
+			e = dm_lookup_exception(&snap->complete, chunk);
 			if (e) {
 				free_pending_exception(pe);
 				goto next_snapshot;
@@ -1266,59 +1988,43 @@ static int __origin_write(struct list_head *snapshots, struct bio *bio)
 			}
 		}
 
-		if (!primary_pe) {
-			/*
-			 * Either every pe here has same
-			 * primary_pe or none has one yet.
-			 */
-			if (pe->primary_pe)
-				primary_pe = pe->primary_pe;
-			else {
-				primary_pe = pe;
-				first = 1;
-			}
-
-			bio_list_add(&primary_pe->origin_bios, bio);
+		r = DM_MAPIO_SUBMITTED;
 
-			r = DM_MAPIO_SUBMITTED;
-		}
+		/*
+		 * If an origin bio was supplied, queue it to wait for the
+		 * completion of this exception, and start this one last,
+		 * at the end of the function.
+		 */
+		if (bio) {
+			bio_list_add(&pe->origin_bios, bio);
+			bio = NULL;
 
-		if (!pe->primary_pe) {
-			pe->primary_pe = primary_pe;
-			get_pending_exception(primary_pe);
+			if (!pe->started) {
+				pe->started = 1;
+				pe_to_start_last = pe;
+			}
 		}
 
 		if (!pe->started) {
 			pe->started = 1;
-			list_add_tail(&pe->list, &pe_queue);
+			pe_to_start_now = pe;
 		}
 
  next_snapshot:
 		up_write(&snap->lock);
-	}
 
-	if (!primary_pe)
-		return r;
-
-	/*
-	 * If this is the first time we're processing this chunk and
-	 * ref_count is now 1 it means all the pending exceptions
-	 * got completed while we were in the loop above, so it falls to
-	 * us here to remove the primary_pe and submit any origin_bios.
-	 */
-
-	if (first && atomic_dec_and_test(&primary_pe->ref_count)) {
-		flush_bios(bio_list_get(&primary_pe->origin_bios));
-		free_pending_exception(primary_pe);
-		/* If we got here, pe_queue is necessarily empty. */
-		return r;
+		if (pe_to_start_now) {
+			start_copy(pe_to_start_now);
+			pe_to_start_now = NULL;
+		}
 	}
 
 	/*
-	 * Now that we have a complete pe list we can start the copying.
+	 * Submit the exception against which the bio is queued last,
+	 * to give the other exceptions a head start.
 	 */
-	list_for_each_entry_safe(pe, next_pe, &pe_queue, list)
-		start_copy(pe);
+	if (pe_to_start_last)
+		start_copy(pe_to_start_last);
 
 	return r;
 }
@@ -1334,13 +2040,48 @@ static int do_origin(struct dm_dev *origin, struct bio *bio)
 	down_read(&_origins_lock);
 	o = __lookup_origin(origin->bdev);
 	if (o)
-		r = __origin_write(&o->snapshots, bio);
+		r = __origin_write(&o->snapshots, bio->bi_sector, bio);
 	up_read(&_origins_lock);
 
 	return r;
 }
 
 /*
+ * Trigger exceptions in all non-merging snapshots.
+ *
+ * The chunk size of the merging snapshot may be larger than the chunk
+ * size of some other snapshot so we may need to reallocate multiple
+ * chunks in other snapshots.
+ *
+ * We scan all the overlapping exceptions in the other snapshots.
+ * Returns 1 if anything was reallocated and must be waited for,
+ * otherwise returns 0.
+ *
+ * size must be a multiple of merging_snap's chunk_size.
+ */
+static int origin_write_extent(struct dm_snapshot *merging_snap,
+			       sector_t sector, unsigned size)
+{
+	int must_wait = 0;
+	sector_t n;
+	struct origin *o;
+
+	/*
+	 * The origin's __minimum_chunk_size() got stored in split_io
+	 * by snapshot_merge_resume().
+	 */
+	down_read(&_origins_lock);
+	o = __lookup_origin(merging_snap->origin->bdev);
+	for (n = 0; n < size; n += merging_snap->ti->split_io)
+		if (__origin_write(&o->snapshots, sector + n, NULL) ==
+		    DM_MAPIO_SUBMITTED)
+			must_wait = 1;
+	up_read(&_origins_lock);
+
+	return must_wait;
+}
+
+/*
  * Origin: maps a linear range of a device, with hooks for snapshotting.
  */
 
@@ -1391,8 +2132,6 @@ static int origin_map(struct dm_target *ti, struct bio *bio,
 	return (bio_rw(bio) == WRITE) ? do_origin(dev, bio) : DM_MAPIO_REMAPPED;
 }
 
-#define min_not_zero(l, r) (l == 0) ? r : ((r == 0) ? l : min(l, r))
-
 /*
  * Set the target "split_io" field to the minimum of all the snapshots'
  * chunk sizes.
@@ -1400,19 +2139,8 @@ static int origin_map(struct dm_target *ti, struct bio *bio,
 static void origin_resume(struct dm_target *ti)
 {
 	struct dm_dev *dev = ti->private;
-	struct dm_snapshot *snap;
-	struct origin *o;
-	unsigned chunk_size = 0;
-
-	down_read(&_origins_lock);
-	o = __lookup_origin(dev->bdev);
-	if (o)
-		list_for_each_entry (snap, &o->snapshots, list)
-			chunk_size = min_not_zero(chunk_size,
-						  snap->store->chunk_size);
-	up_read(&_origins_lock);
 
-	ti->split_io = chunk_size;
+	ti->split_io = get_origin_minimum_chunksize(dev->bdev);
 }
 
 static int origin_status(struct dm_target *ti, status_type_t type, char *result,
@@ -1455,17 +2183,35 @@ static struct target_type origin_target = {
 
 static struct target_type snapshot_target = {
 	.name    = "snapshot",
-	.version = {1, 7, 0},
+	.version = {1, 9, 0},
 	.module  = THIS_MODULE,
 	.ctr     = snapshot_ctr,
 	.dtr     = snapshot_dtr,
 	.map     = snapshot_map,
 	.end_io  = snapshot_end_io,
+	.postsuspend = snapshot_postsuspend,
+	.preresume  = snapshot_preresume,
 	.resume  = snapshot_resume,
 	.status  = snapshot_status,
 	.iterate_devices = snapshot_iterate_devices,
 };
 
+static struct target_type merge_target = {
+	.name    = dm_snapshot_merge_target_name,
+	.version = {1, 0, 0},
+	.module  = THIS_MODULE,
+	.ctr     = snapshot_ctr,
+	.dtr     = snapshot_dtr,
+	.map     = snapshot_merge_map,
+	.end_io  = snapshot_end_io,
+	.presuspend = snapshot_merge_presuspend,
+	.postsuspend = snapshot_postsuspend,
+	.preresume  = snapshot_preresume,
+	.resume  = snapshot_merge_resume,
+	.status  = snapshot_status,
+	.iterate_devices = snapshot_iterate_devices,
+};
+
 static int __init dm_snapshot_init(void)
 {
 	int r;
@@ -1477,7 +2223,7 @@ static int __init dm_snapshot_init(void)
 	}
 
 	r = dm_register_target(&snapshot_target);
-	if (r) {
+	if (r < 0) {
 		DMERR("snapshot target register failed %d", r);
 		goto bad_register_snapshot_target;
 	}
@@ -1485,34 +2231,40 @@ static int __init dm_snapshot_init(void)
 	r = dm_register_target(&origin_target);
 	if (r < 0) {
 		DMERR("Origin target register failed %d", r);
-		goto bad1;
+		goto bad_register_origin_target;
+	}
+
+	r = dm_register_target(&merge_target);
+	if (r < 0) {
+		DMERR("Merge target register failed %d", r);
+		goto bad_register_merge_target;
 	}
 
 	r = init_origin_hash();
 	if (r) {
 		DMERR("init_origin_hash failed.");
-		goto bad2;
+		goto bad_origin_hash;
 	}
 
-	exception_cache = KMEM_CACHE(dm_snap_exception, 0);
+	exception_cache = KMEM_CACHE(dm_exception, 0);
 	if (!exception_cache) {
 		DMERR("Couldn't create exception cache.");
 		r = -ENOMEM;
-		goto bad3;
+		goto bad_exception_cache;
 	}
 
 	pending_cache = KMEM_CACHE(dm_snap_pending_exception, 0);
 	if (!pending_cache) {
 		DMERR("Couldn't create pending cache.");
 		r = -ENOMEM;
-		goto bad4;
+		goto bad_pending_cache;
 	}
 
 	tracked_chunk_cache = KMEM_CACHE(dm_snap_tracked_chunk, 0);
 	if (!tracked_chunk_cache) {
 		DMERR("Couldn't create cache to track chunks in use.");
 		r = -ENOMEM;
-		goto bad5;
+		goto bad_tracked_chunk_cache;
 	}
 
 	ksnapd = create_singlethread_workqueue("ksnapd");
@@ -1526,19 +2278,21 @@ static int __init dm_snapshot_init(void)
 
 bad_pending_pool:
 	kmem_cache_destroy(tracked_chunk_cache);
-bad5:
+bad_tracked_chunk_cache:
 	kmem_cache_destroy(pending_cache);
-bad4:
+bad_pending_cache:
 	kmem_cache_destroy(exception_cache);
-bad3:
+bad_exception_cache:
 	exit_origin_hash();
-bad2:
+bad_origin_hash:
+	dm_unregister_target(&merge_target);
+bad_register_merge_target:
 	dm_unregister_target(&origin_target);
-bad1:
+bad_register_origin_target:
 	dm_unregister_target(&snapshot_target);
-
 bad_register_snapshot_target:
 	dm_exception_store_exit();
+
 	return r;
 }
 
@@ -1548,6 +2302,7 @@ static void __exit dm_snapshot_exit(void)
 
 	dm_unregister_target(&snapshot_target);
 	dm_unregister_target(&origin_target);
+	dm_unregister_target(&merge_target);
 
 	exit_origin_hash();
 	kmem_cache_destroy(pending_cache);
diff --git a/drivers/md/dm-sysfs.c b/drivers/md/dm-sysfs.c
index 4b045903a4e2..f53392df7b97 100644
--- a/drivers/md/dm-sysfs.c
+++ b/drivers/md/dm-sysfs.c
@@ -59,7 +59,7 @@ static ssize_t dm_attr_uuid_show(struct mapped_device *md, char *buf)
 
 static ssize_t dm_attr_suspended_show(struct mapped_device *md, char *buf)
 {
-	sprintf(buf, "%d\n", dm_suspended(md));
+	sprintf(buf, "%d\n", dm_suspended_md(md));
 
 	return strlen(buf);
 }
@@ -80,12 +80,20 @@ static struct sysfs_ops dm_sysfs_ops = {
 };
 
 /*
+ * The sysfs structure is embedded in md struct, nothing to do here
+ */
+static void dm_sysfs_release(struct kobject *kobj)
+{
+}
+
+/*
  * dm kobject is embedded in mapped_device structure
  * no need to define release function here
  */
 static struct kobj_type dm_ktype = {
 	.sysfs_ops	= &dm_sysfs_ops,
 	.default_attrs	= dm_attrs,
+	.release	= dm_sysfs_release
 };
 
 /*
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index 1a6cb3c7822e..4b22feb01a0c 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -12,6 +12,7 @@
 #include <linux/blkdev.h>
 #include <linux/namei.h>
 #include <linux/ctype.h>
+#include <linux/string.h>
 #include <linux/slab.h>
 #include <linux/interrupt.h>
 #include <linux/mutex.h>
@@ -237,6 +238,9 @@ void dm_table_destroy(struct dm_table *t)
 {
 	unsigned int i;
 
+	if (!t)
+		return;
+
 	while (atomic_read(&t->holders))
 		msleep(1);
 	smp_mb();
@@ -499,16 +503,15 @@ int dm_set_device_limits(struct dm_target *ti, struct dm_dev *dev,
 		return 0;
 	}
 
-	if (blk_stack_limits(limits, &q->limits, start << 9) < 0)
-		DMWARN("%s: target device %s is misaligned: "
+	if (bdev_stack_limits(limits, bdev, start) < 0)
+		DMWARN("%s: adding target device %s caused an alignment inconsistency: "
 		       "physical_block_size=%u, logical_block_size=%u, "
 		       "alignment_offset=%u, start=%llu",
 		       dm_device_name(ti->table->md), bdevname(bdev, b),
 		       q->limits.physical_block_size,
 		       q->limits.logical_block_size,
 		       q->limits.alignment_offset,
-		       (unsigned long long) start << 9);
-
+		       (unsigned long long) start << SECTOR_SHIFT);
 
 	/*
 	 * Check if merge fn is supported.
@@ -600,11 +603,8 @@ int dm_split_args(int *argc, char ***argvp, char *input)
 		return -ENOMEM;
 
 	while (1) {
-		start = end;
-
 		/* Skip whitespace */
-		while (*start && isspace(*start))
-			start++;
+		start = skip_spaces(end);
 
 		if (!*start)
 			break;	/* success, we hit the end */
@@ -1025,9 +1025,9 @@ combine_limits:
 		 * for the table.
 		 */
 		if (blk_stack_limits(limits, &ti_limits, 0) < 0)
-			DMWARN("%s: target device "
+			DMWARN("%s: adding target device "
 			       "(start sect %llu len %llu) "
-			       "is misaligned",
+			       "caused an alignment inconsistency",
 			       dm_device_name(table->md),
 			       (unsigned long long) ti->begin,
 			       (unsigned long long) ti->len);
@@ -1079,15 +1079,6 @@ void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q,
 			       struct queue_limits *limits)
 {
 	/*
-	 * Each target device in the table has a data area that should normally
-	 * be aligned such that the DM device's alignment_offset is 0.
-	 * FIXME: Propagate alignment_offsets up the stack and warn of
-	 *	  sub-optimal or inconsistent settings.
-	 */
-	limits->alignment_offset = 0;
-	limits->misaligned = 0;
-
-	/*
 	 * Copy table's limits to the DM device's request_queue
 	 */
 	q->limits = *limits;
diff --git a/drivers/md/dm-uevent.c b/drivers/md/dm-uevent.c
index 6f65883aef12..c7c555a8c7b2 100644
--- a/drivers/md/dm-uevent.c
+++ b/drivers/md/dm-uevent.c
@@ -139,14 +139,13 @@ void dm_send_uevents(struct list_head *events, struct kobject *kobj)
 		list_del_init(&event->elist);
 
 		/*
-		 * Need to call dm_copy_name_and_uuid from here for now.
-		 * Context of previous var adds and locking used for
-		 * hash_cell not compatable.
+		 * When a device is being removed this copy fails and we
+		 * discard these unsent events.
 		 */
 		if (dm_copy_name_and_uuid(event->md, event->name,
 					  event->uuid)) {
-			DMERR("%s: dm_copy_name_and_uuid() failed",
-			      __func__);
+			DMINFO("%s: skipping sending uevent for lost device",
+			       __func__);
 			goto uevent_free;
 		}
 
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 724efc63904d..3167480b532c 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -143,9 +143,19 @@ struct mapped_device {
 	int barrier_error;
 
 	/*
+	 * Protect barrier_error from concurrent endio processing
+	 * in request-based dm.
+	 */
+	spinlock_t barrier_error_lock;
+
+	/*
 	 * Processing queue (flush/barriers)
 	 */
 	struct workqueue_struct *wq;
+	struct work_struct barrier_work;
+
+	/* A pointer to the currently processing pre/post flush request */
+	struct request *flush_request;
 
 	/*
 	 * The current mapping.
@@ -178,9 +188,6 @@ struct mapped_device {
 	/* forced geometry settings */
 	struct hd_geometry geometry;
 
-	/* marker of flush suspend for request-based dm */
-	struct request suspend_rq;
-
 	/* For saving the address of __make_request for request based dm */
 	make_request_fn *saved_make_request_fn;
 
@@ -275,6 +282,7 @@ static int (*_inits[])(void) __initdata = {
 	dm_target_init,
 	dm_linear_init,
 	dm_stripe_init,
+	dm_io_init,
 	dm_kcopyd_init,
 	dm_interface_init,
 };
@@ -284,6 +292,7 @@ static void (*_exits[])(void) = {
 	dm_target_exit,
 	dm_linear_exit,
 	dm_stripe_exit,
+	dm_io_exit,
 	dm_kcopyd_exit,
 	dm_interface_exit,
 };
@@ -320,6 +329,11 @@ static void __exit dm_exit(void)
 /*
  * Block device functions
  */
+int dm_deleting_md(struct mapped_device *md)
+{
+	return test_bit(DMF_DELETING, &md->flags);
+}
+
 static int dm_blk_open(struct block_device *bdev, fmode_t mode)
 {
 	struct mapped_device *md;
@@ -331,7 +345,7 @@ static int dm_blk_open(struct block_device *bdev, fmode_t mode)
 		goto out;
 
 	if (test_bit(DMF_FREEING, &md->flags) ||
-	    test_bit(DMF_DELETING, &md->flags)) {
+	    dm_deleting_md(md)) {
 		md = NULL;
 		goto out;
 	}
@@ -388,7 +402,7 @@ static int dm_blk_ioctl(struct block_device *bdev, fmode_t mode,
 			unsigned int cmd, unsigned long arg)
 {
 	struct mapped_device *md = bdev->bd_disk->private_data;
-	struct dm_table *map = dm_get_table(md);
+	struct dm_table *map = dm_get_live_table(md);
 	struct dm_target *tgt;
 	int r = -ENOTTY;
 
@@ -401,7 +415,7 @@ static int dm_blk_ioctl(struct block_device *bdev, fmode_t mode,
 
 	tgt = dm_table_get_target(map, 0);
 
-	if (dm_suspended(md)) {
+	if (dm_suspended_md(md)) {
 		r = -EAGAIN;
 		goto out;
 	}
@@ -430,9 +444,10 @@ static void free_tio(struct mapped_device *md, struct dm_target_io *tio)
 	mempool_free(tio, md->tio_pool);
 }
 
-static struct dm_rq_target_io *alloc_rq_tio(struct mapped_device *md)
+static struct dm_rq_target_io *alloc_rq_tio(struct mapped_device *md,
+					    gfp_t gfp_mask)
 {
-	return mempool_alloc(md->tio_pool, GFP_ATOMIC);
+	return mempool_alloc(md->tio_pool, gfp_mask);
 }
 
 static void free_rq_tio(struct dm_rq_target_io *tio)
@@ -450,6 +465,12 @@ static void free_bio_info(struct dm_rq_clone_bio_info *info)
 	mempool_free(info, info->tio->md->io_pool);
 }
 
+static int md_in_flight(struct mapped_device *md)
+{
+	return atomic_read(&md->pending[READ]) +
+	       atomic_read(&md->pending[WRITE]);
+}
+
 static void start_io_acct(struct dm_io *io)
 {
 	struct mapped_device *md = io->md;
@@ -512,7 +533,7 @@ static void queue_io(struct mapped_device *md, struct bio *bio)
  * function to access the md->map field, and make sure they call
  * dm_table_put() when finished.
  */
-struct dm_table *dm_get_table(struct mapped_device *md)
+struct dm_table *dm_get_live_table(struct mapped_device *md)
 {
 	struct dm_table *t;
 	unsigned long flags;
@@ -716,28 +737,38 @@ static void end_clone_bio(struct bio *clone, int error)
 	blk_update_request(tio->orig, 0, nr_bytes);
 }
 
+static void store_barrier_error(struct mapped_device *md, int error)
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(&md->barrier_error_lock, flags);
+	/*
+	 * Basically, the first error is taken, but:
+	 *   -EOPNOTSUPP supersedes any I/O error.
+	 *   Requeue request supersedes any I/O error but -EOPNOTSUPP.
+	 */
+	if (!md->barrier_error || error == -EOPNOTSUPP ||
+	    (md->barrier_error != -EOPNOTSUPP &&
+	     error == DM_ENDIO_REQUEUE))
+		md->barrier_error = error;
+	spin_unlock_irqrestore(&md->barrier_error_lock, flags);
+}
+
 /*
  * Don't touch any member of the md after calling this function because
  * the md may be freed in dm_put() at the end of this function.
  * Or do dm_get() before calling this function and dm_put() later.
  */
-static void rq_completed(struct mapped_device *md, int run_queue)
+static void rq_completed(struct mapped_device *md, int rw, int run_queue)
 {
-	int wakeup_waiters = 0;
-	struct request_queue *q = md->queue;
-	unsigned long flags;
-
-	spin_lock_irqsave(q->queue_lock, flags);
-	if (!queue_in_flight(q))
-		wakeup_waiters = 1;
-	spin_unlock_irqrestore(q->queue_lock, flags);
+	atomic_dec(&md->pending[rw]);
 
 	/* nudge anyone waiting on suspend queue */
-	if (wakeup_waiters)
+	if (!md_in_flight(md))
 		wake_up(&md->wait);
 
 	if (run_queue)
-		blk_run_queue(q);
+		blk_run_queue(md->queue);
 
 	/*
 	 * dm_put() must be at the end of this function. See the comment above
@@ -753,6 +784,44 @@ static void free_rq_clone(struct request *clone)
 	free_rq_tio(tio);
 }
 
+/*
+ * Complete the clone and the original request.
+ * Must be called without queue lock.
+ */
+static void dm_end_request(struct request *clone, int error)
+{
+	int rw = rq_data_dir(clone);
+	int run_queue = 1;
+	bool is_barrier = blk_barrier_rq(clone);
+	struct dm_rq_target_io *tio = clone->end_io_data;
+	struct mapped_device *md = tio->md;
+	struct request *rq = tio->orig;
+
+	if (blk_pc_request(rq) && !is_barrier) {
+		rq->errors = clone->errors;
+		rq->resid_len = clone->resid_len;
+
+		if (rq->sense)
+			/*
+			 * We are using the sense buffer of the original
+			 * request.
+			 * So setting the length of the sense data is enough.
+			 */
+			rq->sense_len = clone->sense_len;
+	}
+
+	free_rq_clone(clone);
+
+	if (unlikely(is_barrier)) {
+		if (unlikely(error))
+			store_barrier_error(md, error);
+		run_queue = 0;
+	} else
+		blk_end_request_all(rq, error);
+
+	rq_completed(md, rw, run_queue);
+}
+
 static void dm_unprep_request(struct request *rq)
 {
 	struct request *clone = rq->special;
@@ -768,12 +837,23 @@ static void dm_unprep_request(struct request *rq)
  */
 void dm_requeue_unmapped_request(struct request *clone)
 {
+	int rw = rq_data_dir(clone);
 	struct dm_rq_target_io *tio = clone->end_io_data;
 	struct mapped_device *md = tio->md;
 	struct request *rq = tio->orig;
 	struct request_queue *q = rq->q;
 	unsigned long flags;
 
+	if (unlikely(blk_barrier_rq(clone))) {
+		/*
+		 * Barrier clones share an original request.
+		 * Leave it to dm_end_request(), which handles this special
+		 * case.
+		 */
+		dm_end_request(clone, DM_ENDIO_REQUEUE);
+		return;
+	}
+
 	dm_unprep_request(rq);
 
 	spin_lock_irqsave(q->queue_lock, flags);
@@ -782,7 +862,7 @@ void dm_requeue_unmapped_request(struct request *clone)
 	blk_requeue_request(q, rq);
 	spin_unlock_irqrestore(q->queue_lock, flags);
 
-	rq_completed(md, 0);
+	rq_completed(md, rw, 0);
 }
 EXPORT_SYMBOL_GPL(dm_requeue_unmapped_request);
 
@@ -815,34 +895,28 @@ static void start_queue(struct request_queue *q)
 	spin_unlock_irqrestore(q->queue_lock, flags);
 }
 
-/*
- * Complete the clone and the original request.
- * Must be called without queue lock.
- */
-static void dm_end_request(struct request *clone, int error)
+static void dm_done(struct request *clone, int error, bool mapped)
 {
+	int r = error;
 	struct dm_rq_target_io *tio = clone->end_io_data;
-	struct mapped_device *md = tio->md;
-	struct request *rq = tio->orig;
+	dm_request_endio_fn rq_end_io = tio->ti->type->rq_end_io;
 
-	if (blk_pc_request(rq)) {
-		rq->errors = clone->errors;
-		rq->resid_len = clone->resid_len;
+	if (mapped && rq_end_io)
+		r = rq_end_io(tio->ti, clone, error, &tio->info);
 
-		if (rq->sense)
-			/*
-			 * We are using the sense buffer of the original
-			 * request.
-			 * So setting the length of the sense data is enough.
-			 */
-			rq->sense_len = clone->sense_len;
+	if (r <= 0)
+		/* The target wants to complete the I/O */
+		dm_end_request(clone, r);
+	else if (r == DM_ENDIO_INCOMPLETE)
+		/* The target will handle the I/O */
+		return;
+	else if (r == DM_ENDIO_REQUEUE)
+		/* The target wants to requeue the I/O */
+		dm_requeue_unmapped_request(clone);
+	else {
+		DMWARN("unimplemented target endio return value: %d", r);
+		BUG();
 	}
-
-	free_rq_clone(clone);
-
-	blk_end_request_all(rq, error);
-
-	rq_completed(md, 1);
 }
 
 /*
@@ -850,27 +924,14 @@ static void dm_end_request(struct request *clone, int error)
  */
 static void dm_softirq_done(struct request *rq)
 {
+	bool mapped = true;
 	struct request *clone = rq->completion_data;
 	struct dm_rq_target_io *tio = clone->end_io_data;
-	dm_request_endio_fn rq_end_io = tio->ti->type->rq_end_io;
-	int error = tio->error;
 
-	if (!(rq->cmd_flags & REQ_FAILED) && rq_end_io)
-		error = rq_end_io(tio->ti, clone, error, &tio->info);
+	if (rq->cmd_flags & REQ_FAILED)
+		mapped = false;
 
-	if (error <= 0)
-		/* The target wants to complete the I/O */
-		dm_end_request(clone, error);
-	else if (error == DM_ENDIO_INCOMPLETE)
-		/* The target will handle the I/O */
-		return;
-	else if (error == DM_ENDIO_REQUEUE)
-		/* The target wants to requeue the I/O */
-		dm_requeue_unmapped_request(clone);
-	else {
-		DMWARN("unimplemented target endio return value: %d", error);
-		BUG();
-	}
+	dm_done(clone, tio->error, mapped);
 }
 
 /*
@@ -882,6 +943,19 @@ static void dm_complete_request(struct request *clone, int error)
 	struct dm_rq_target_io *tio = clone->end_io_data;
 	struct request *rq = tio->orig;
 
+	if (unlikely(blk_barrier_rq(clone))) {
+		/*
+		 * Barrier clones share an original request.  So can't use
+		 * softirq_done with the original.
+		 * Pass the clone to dm_done() directly in this special case.
+		 * It is safe (even if clone->q->queue_lock is held here)
+		 * because there is no I/O dispatching during the completion
+		 * of barrier clone.
+		 */
+		dm_done(clone, error, true);
+		return;
+	}
+
 	tio->error = error;
 	rq->completion_data = clone;
 	blk_complete_request(rq);
@@ -898,6 +972,17 @@ void dm_kill_unmapped_request(struct request *clone, int error)
 	struct dm_rq_target_io *tio = clone->end_io_data;
 	struct request *rq = tio->orig;
 
+	if (unlikely(blk_barrier_rq(clone))) {
+		/*
+		 * Barrier clones share an original request.
+		 * Leave it to dm_end_request(), which handles this special
+		 * case.
+		 */
+		BUG_ON(error > 0);
+		dm_end_request(clone, error);
+		return;
+	}
+
 	rq->cmd_flags |= REQ_FAILED;
 	dm_complete_request(clone, error);
 }
@@ -1214,7 +1299,7 @@ static void __split_and_process_bio(struct mapped_device *md, struct bio *bio)
 	struct clone_info ci;
 	int error = 0;
 
-	ci.map = dm_get_table(md);
+	ci.map = dm_get_live_table(md);
 	if (unlikely(!ci.map)) {
 		if (!bio_rw_flagged(bio, BIO_RW_BARRIER))
 			bio_io_error(bio);
@@ -1255,7 +1340,7 @@ static int dm_merge_bvec(struct request_queue *q,
 			 struct bio_vec *biovec)
 {
 	struct mapped_device *md = q->queuedata;
-	struct dm_table *map = dm_get_table(md);
+	struct dm_table *map = dm_get_live_table(md);
 	struct dm_target *ti;
 	sector_t max_sectors;
 	int max_size = 0;
@@ -1352,11 +1437,6 @@ static int dm_make_request(struct request_queue *q, struct bio *bio)
 {
 	struct mapped_device *md = q->queuedata;
 
-	if (unlikely(bio_rw_flagged(bio, BIO_RW_BARRIER))) {
-		bio_endio(bio, -EOPNOTSUPP);
-		return 0;
-	}
-
 	return md->saved_make_request_fn(q, bio); /* call __make_request() */
 }
 
@@ -1375,6 +1455,25 @@ static int dm_request(struct request_queue *q, struct bio *bio)
 	return _dm_request(q, bio);
 }
 
+/*
+ * Mark this request as flush request, so that dm_request_fn() can
+ * recognize.
+ */
+static void dm_rq_prepare_flush(struct request_queue *q, struct request *rq)
+{
+	rq->cmd_type = REQ_TYPE_LINUX_BLOCK;
+	rq->cmd[0] = REQ_LB_OP_FLUSH;
+}
+
+static bool dm_rq_is_flush_request(struct request *rq)
+{
+	if (rq->cmd_type == REQ_TYPE_LINUX_BLOCK &&
+	    rq->cmd[0] == REQ_LB_OP_FLUSH)
+		return true;
+	else
+		return false;
+}
+
 void dm_dispatch_request(struct request *rq)
 {
 	int r;
@@ -1420,25 +1519,54 @@ static int dm_rq_bio_constructor(struct bio *bio, struct bio *bio_orig,
 static int setup_clone(struct request *clone, struct request *rq,
 		       struct dm_rq_target_io *tio)
 {
-	int r = blk_rq_prep_clone(clone, rq, tio->md->bs, GFP_ATOMIC,
-				  dm_rq_bio_constructor, tio);
+	int r;
 
-	if (r)
-		return r;
+	if (dm_rq_is_flush_request(rq)) {
+		blk_rq_init(NULL, clone);
+		clone->cmd_type = REQ_TYPE_FS;
+		clone->cmd_flags |= (REQ_HARDBARRIER | WRITE);
+	} else {
+		r = blk_rq_prep_clone(clone, rq, tio->md->bs, GFP_ATOMIC,
+				      dm_rq_bio_constructor, tio);
+		if (r)
+			return r;
+
+		clone->cmd = rq->cmd;
+		clone->cmd_len = rq->cmd_len;
+		clone->sense = rq->sense;
+		clone->buffer = rq->buffer;
+	}
 
-	clone->cmd = rq->cmd;
-	clone->cmd_len = rq->cmd_len;
-	clone->sense = rq->sense;
-	clone->buffer = rq->buffer;
 	clone->end_io = end_clone_request;
 	clone->end_io_data = tio;
 
 	return 0;
 }
 
-static int dm_rq_flush_suspending(struct mapped_device *md)
+static struct request *clone_rq(struct request *rq, struct mapped_device *md,
+				gfp_t gfp_mask)
 {
-	return !md->suspend_rq.special;
+	struct request *clone;
+	struct dm_rq_target_io *tio;
+
+	tio = alloc_rq_tio(md, gfp_mask);
+	if (!tio)
+		return NULL;
+
+	tio->md = md;
+	tio->ti = NULL;
+	tio->orig = rq;
+	tio->error = 0;
+	memset(&tio->info, 0, sizeof(tio->info));
+
+	clone = &tio->clone;
+	if (setup_clone(clone, rq, tio)) {
+		/* -ENOMEM */
+		free_rq_tio(tio);
+		return NULL;
+	}
+
+	return clone;
 }
 
 /*
@@ -1447,39 +1575,19 @@ static int dm_rq_flush_suspending(struct mapped_device *md)
 static int dm_prep_fn(struct request_queue *q, struct request *rq)
 {
 	struct mapped_device *md = q->queuedata;
-	struct dm_rq_target_io *tio;
 	struct request *clone;
 
-	if (unlikely(rq == &md->suspend_rq)) {
-		if (dm_rq_flush_suspending(md))
-			return BLKPREP_OK;
-		else
-			/* The flush suspend was interrupted */
-			return BLKPREP_KILL;
-	}
+	if (unlikely(dm_rq_is_flush_request(rq)))
+		return BLKPREP_OK;
 
 	if (unlikely(rq->special)) {
 		DMWARN("Already has something in rq->special.");
 		return BLKPREP_KILL;
 	}
 
-	tio = alloc_rq_tio(md); /* Only one for each original request */
-	if (!tio)
-		/* -ENOMEM */
-		return BLKPREP_DEFER;
-
-	tio->md = md;
-	tio->ti = NULL;
-	tio->orig = rq;
-	tio->error = 0;
-	memset(&tio->info, 0, sizeof(tio->info));
-
-	clone = &tio->clone;
-	if (setup_clone(clone, rq, tio)) {
-		/* -ENOMEM */
-		free_rq_tio(tio);
+	clone = clone_rq(rq, md, GFP_ATOMIC);
+	if (!clone)
 		return BLKPREP_DEFER;
-	}
 
 	rq->special = clone;
 	rq->cmd_flags |= REQ_DONTPREP;
@@ -1487,11 +1595,10 @@ static int dm_prep_fn(struct request_queue *q, struct request *rq)
 	return BLKPREP_OK;
 }
 
-static void map_request(struct dm_target *ti, struct request *rq,
+static void map_request(struct dm_target *ti, struct request *clone,
 			struct mapped_device *md)
 {
 	int r;
-	struct request *clone = rq->special;
 	struct dm_rq_target_io *tio = clone->end_io_data;
 
 	/*
@@ -1511,6 +1618,8 @@ static void map_request(struct dm_target *ti, struct request *rq,
 		break;
 	case DM_MAPIO_REMAPPED:
 		/* The target has remapped the I/O so dispatch it */
+		trace_block_rq_remap(clone->q, clone, disk_devt(dm_disk(md)),
+				     blk_rq_pos(tio->orig));
 		dm_dispatch_request(clone);
 		break;
 	case DM_MAPIO_REQUEUE:
@@ -1536,29 +1645,26 @@ static void map_request(struct dm_target *ti, struct request *rq,
 static void dm_request_fn(struct request_queue *q)
 {
 	struct mapped_device *md = q->queuedata;
-	struct dm_table *map = dm_get_table(md);
+	struct dm_table *map = dm_get_live_table(md);
 	struct dm_target *ti;
-	struct request *rq;
+	struct request *rq, *clone;
 
 	/*
-	 * For noflush suspend, check blk_queue_stopped() to immediately
-	 * quit I/O dispatching.
+	 * For suspend, check blk_queue_stopped() and increment
+	 * ->pending within a single queue_lock not to increment the
+	 * number of in-flight I/Os after the queue is stopped in
+	 * dm_suspend().
 	 */
 	while (!blk_queue_plugged(q) && !blk_queue_stopped(q)) {
 		rq = blk_peek_request(q);
 		if (!rq)
 			goto plug_and_out;
 
-		if (unlikely(rq == &md->suspend_rq)) { /* Flush suspend maker */
-			if (queue_in_flight(q))
-				/* Not quiet yet.  Wait more */
-				goto plug_and_out;
-
-			/* This device should be quiet now */
-			__stop_queue(q);
+		if (unlikely(dm_rq_is_flush_request(rq))) {
+			BUG_ON(md->flush_request);
+			md->flush_request = rq;
 			blk_start_request(rq);
-			__blk_end_request_all(rq, 0);
-			wake_up(&md->wait);
+			queue_work(md->wq, &md->barrier_work);
 			goto out;
 		}
 
@@ -1567,8 +1673,11 @@ static void dm_request_fn(struct request_queue *q)
 			goto plug_and_out;
 
 		blk_start_request(rq);
+		clone = rq->special;
+		atomic_inc(&md->pending[rq_data_dir(clone)]);
+
 		spin_unlock(q->queue_lock);
-		map_request(ti, rq, md);
+		map_request(ti, clone, md);
 		spin_lock_irq(q->queue_lock);
 	}
 
@@ -1595,7 +1704,7 @@ static int dm_lld_busy(struct request_queue *q)
 {
 	int r;
 	struct mapped_device *md = q->queuedata;
-	struct dm_table *map = dm_get_table(md);
+	struct dm_table *map = dm_get_live_table(md);
 
 	if (!map || test_bit(DMF_BLOCK_IO_FOR_SUSPEND, &md->flags))
 		r = 1;
@@ -1610,7 +1719,7 @@ static int dm_lld_busy(struct request_queue *q)
 static void dm_unplug_all(struct request_queue *q)
 {
 	struct mapped_device *md = q->queuedata;
-	struct dm_table *map = dm_get_table(md);
+	struct dm_table *map = dm_get_live_table(md);
 
 	if (map) {
 		if (dm_request_based(md))
@@ -1628,7 +1737,7 @@ static int dm_any_congested(void *congested_data, int bdi_bits)
 	struct dm_table *map;
 
 	if (!test_bit(DMF_BLOCK_IO_FOR_SUSPEND, &md->flags)) {
-		map = dm_get_table(md);
+		map = dm_get_live_table(md);
 		if (map) {
 			/*
 			 * Request-based dm cares about only own queue for
@@ -1725,6 +1834,7 @@ out:
 static const struct block_device_operations dm_blk_dops;
 
 static void dm_wq_work(struct work_struct *work);
+static void dm_rq_barrier_work(struct work_struct *work);
 
 /*
  * Allocate and initialise a blank device with a given minor.
@@ -1754,6 +1864,7 @@ static struct mapped_device *alloc_dev(int minor)
 	init_rwsem(&md->io_lock);
 	mutex_init(&md->suspend_lock);
 	spin_lock_init(&md->deferred_lock);
+	spin_lock_init(&md->barrier_error_lock);
 	rwlock_init(&md->map_lock);
 	atomic_set(&md->holders, 1);
 	atomic_set(&md->open_count, 0);
@@ -1788,6 +1899,8 @@ static struct mapped_device *alloc_dev(int minor)
 	blk_queue_softirq_done(md->queue, dm_softirq_done);
 	blk_queue_prep_rq(md->queue, dm_prep_fn);
 	blk_queue_lld_busy(md->queue, dm_lld_busy);
+	blk_queue_ordered(md->queue, QUEUE_ORDERED_DRAIN_FLUSH,
+			  dm_rq_prepare_flush);
 
 	md->disk = alloc_disk(1);
 	if (!md->disk)
@@ -1797,6 +1910,7 @@ static struct mapped_device *alloc_dev(int minor)
 	atomic_set(&md->pending[1], 0);
 	init_waitqueue_head(&md->wait);
 	INIT_WORK(&md->work, dm_wq_work);
+	INIT_WORK(&md->barrier_work, dm_rq_barrier_work);
 	init_waitqueue_head(&md->eventq);
 
 	md->disk->major = _major;
@@ -1921,9 +2035,13 @@ static void __set_size(struct mapped_device *md, sector_t size)
 	mutex_unlock(&md->bdev->bd_inode->i_mutex);
 }
 
-static int __bind(struct mapped_device *md, struct dm_table *t,
-		  struct queue_limits *limits)
+/*
+ * Returns old map, which caller must destroy.
+ */
+static struct dm_table *__bind(struct mapped_device *md, struct dm_table *t,
+			       struct queue_limits *limits)
 {
+	struct dm_table *old_map;
 	struct request_queue *q = md->queue;
 	sector_t size;
 	unsigned long flags;
@@ -1938,11 +2056,6 @@ static int __bind(struct mapped_device *md, struct dm_table *t,
 
 	__set_size(md, size);
 
-	if (!size) {
-		dm_table_destroy(t);
-		return 0;
-	}
-
 	dm_table_event_callback(t, event_callback, md);
 
 	/*
@@ -1958,26 +2071,31 @@ static int __bind(struct mapped_device *md, struct dm_table *t,
 	__bind_mempools(md, t);
 
 	write_lock_irqsave(&md->map_lock, flags);
+	old_map = md->map;
 	md->map = t;
 	dm_table_set_restrictions(t, q, limits);
 	write_unlock_irqrestore(&md->map_lock, flags);
 
-	return 0;
+	return old_map;
 }
 
-static void __unbind(struct mapped_device *md)
+/*
+ * Returns unbound table for the caller to free.
+ */
+static struct dm_table *__unbind(struct mapped_device *md)
 {
 	struct dm_table *map = md->map;
 	unsigned long flags;
 
 	if (!map)
-		return;
+		return NULL;
 
 	dm_table_event_callback(map, NULL, NULL);
 	write_lock_irqsave(&md->map_lock, flags);
 	md->map = NULL;
 	write_unlock_irqrestore(&md->map_lock, flags);
-	dm_table_destroy(map);
+
+	return map;
 }
 
 /*
@@ -2059,18 +2177,18 @@ void dm_put(struct mapped_device *md)
 	BUG_ON(test_bit(DMF_FREEING, &md->flags));
 
 	if (atomic_dec_and_lock(&md->holders, &_minor_lock)) {
-		map = dm_get_table(md);
+		map = dm_get_live_table(md);
 		idr_replace(&_minor_idr, MINOR_ALLOCED,
 			    MINOR(disk_devt(dm_disk(md))));
 		set_bit(DMF_FREEING, &md->flags);
 		spin_unlock(&_minor_lock);
-		if (!dm_suspended(md)) {
+		if (!dm_suspended_md(md)) {
 			dm_table_presuspend_targets(map);
 			dm_table_postsuspend_targets(map);
 		}
 		dm_sysfs_exit(md);
 		dm_table_put(map);
-		__unbind(md);
+		dm_table_destroy(__unbind(md));
 		free_dev(md);
 	}
 }
@@ -2080,8 +2198,6 @@ static int dm_wait_for_completion(struct mapped_device *md, int interruptible)
 {
 	int r = 0;
 	DECLARE_WAITQUEUE(wait, current);
-	struct request_queue *q = md->queue;
-	unsigned long flags;
 
 	dm_unplug_all(md->queue);
 
@@ -2091,15 +2207,7 @@ static int dm_wait_for_completion(struct mapped_device *md, int interruptible)
 		set_current_state(interruptible);
 
 		smp_mb();
-		if (dm_request_based(md)) {
-			spin_lock_irqsave(q->queue_lock, flags);
-			if (!queue_in_flight(q) && blk_queue_stopped(q)) {
-				spin_unlock_irqrestore(q->queue_lock, flags);
-				break;
-			}
-			spin_unlock_irqrestore(q->queue_lock, flags);
-		} else if (!atomic_read(&md->pending[0]) &&
-					!atomic_read(&md->pending[1]))
+		if (!md_in_flight(md))
 			break;
 
 		if (interruptible == TASK_INTERRUPTIBLE &&
@@ -2194,98 +2302,106 @@ static void dm_queue_flush(struct mapped_device *md)
 	queue_work(md->wq, &md->work);
 }
 
-/*
- * Swap in a new table (destroying old one).
- */
-int dm_swap_table(struct mapped_device *md, struct dm_table *table)
+static void dm_rq_set_flush_nr(struct request *clone, unsigned flush_nr)
 {
-	struct queue_limits limits;
-	int r = -EINVAL;
+	struct dm_rq_target_io *tio = clone->end_io_data;
 
-	mutex_lock(&md->suspend_lock);
+	tio->info.flush_request = flush_nr;
+}
 
-	/* device must be suspended */
-	if (!dm_suspended(md))
-		goto out;
+/* Issue barrier requests to targets and wait for their completion. */
+static int dm_rq_barrier(struct mapped_device *md)
+{
+	int i, j;
+	struct dm_table *map = dm_get_live_table(md);
+	unsigned num_targets = dm_table_get_num_targets(map);
+	struct dm_target *ti;
+	struct request *clone;
 
-	r = dm_calculate_queue_limits(table, &limits);
-	if (r)
-		goto out;
+	md->barrier_error = 0;
 
-	/* cannot change the device type, once a table is bound */
-	if (md->map &&
-	    (dm_table_get_type(md->map) != dm_table_get_type(table))) {
-		DMWARN("can't change the device type after a table is bound");
-		goto out;
+	for (i = 0; i < num_targets; i++) {
+		ti = dm_table_get_target(map, i);
+		for (j = 0; j < ti->num_flush_requests; j++) {
+			clone = clone_rq(md->flush_request, md, GFP_NOIO);
+			dm_rq_set_flush_nr(clone, j);
+			atomic_inc(&md->pending[rq_data_dir(clone)]);
+			map_request(ti, clone, md);
+		}
 	}
 
-	__unbind(md);
-	r = __bind(md, table, &limits);
-
-out:
-	mutex_unlock(&md->suspend_lock);
-	return r;
-}
+	dm_wait_for_completion(md, TASK_UNINTERRUPTIBLE);
+	dm_table_put(map);
 
-static void dm_rq_invalidate_suspend_marker(struct mapped_device *md)
-{
-	md->suspend_rq.special = (void *)0x1;
+	return md->barrier_error;
 }
 
-static void dm_rq_abort_suspend(struct mapped_device *md, int noflush)
+static void dm_rq_barrier_work(struct work_struct *work)
 {
+	int error;
+	struct mapped_device *md = container_of(work, struct mapped_device,
+						barrier_work);
 	struct request_queue *q = md->queue;
+	struct request *rq;
 	unsigned long flags;
 
-	spin_lock_irqsave(q->queue_lock, flags);
-	if (!noflush)
-		dm_rq_invalidate_suspend_marker(md);
-	__start_queue(q);
-	spin_unlock_irqrestore(q->queue_lock, flags);
-}
+	/*
+	 * Hold the md reference here and leave it at the last part so that
+	 * the md can't be deleted by device opener when the barrier request
+	 * completes.
+	 */
+	dm_get(md);
 
-static void dm_rq_start_suspend(struct mapped_device *md, int noflush)
-{
-	struct request *rq = &md->suspend_rq;
-	struct request_queue *q = md->queue;
+	error = dm_rq_barrier(md);
 
-	if (noflush)
-		stop_queue(q);
-	else {
-		blk_rq_init(q, rq);
-		blk_insert_request(q, rq, 0, NULL);
-	}
+	rq = md->flush_request;
+	md->flush_request = NULL;
+
+	if (error == DM_ENDIO_REQUEUE) {
+		spin_lock_irqsave(q->queue_lock, flags);
+		blk_requeue_request(q, rq);
+		spin_unlock_irqrestore(q->queue_lock, flags);
+	} else
+		blk_end_request_all(rq, error);
+
+	blk_run_queue(q);
+
+	dm_put(md);
 }
 
-static int dm_rq_suspend_available(struct mapped_device *md, int noflush)
+/*
+ * Swap in a new table, returning the old one for the caller to destroy.
+ */
+struct dm_table *dm_swap_table(struct mapped_device *md, struct dm_table *table)
 {
-	int r = 1;
-	struct request *rq = &md->suspend_rq;
-	struct request_queue *q = md->queue;
-	unsigned long flags;
+	struct dm_table *map = ERR_PTR(-EINVAL);
+	struct queue_limits limits;
+	int r;
 
-	if (noflush)
-		return r;
+	mutex_lock(&md->suspend_lock);
 
-	/* The marker must be protected by queue lock if it is in use */
-	spin_lock_irqsave(q->queue_lock, flags);
-	if (unlikely(rq->ref_count)) {
-		/*
-		 * This can happen, when the previous flush suspend was
-		 * interrupted, the marker is still in the queue and
-		 * this flush suspend has been invoked, because we don't
-		 * remove the marker at the time of suspend interruption.
-		 * We have only one marker per mapped_device, so we can't
-		 * start another flush suspend while it is in use.
-		 */
-		BUG_ON(!rq->special); /* The marker should be invalidated */
-		DMWARN("Invalidating the previous flush suspend is still in"
-		       " progress.  Please retry later.");
-		r = 0;
+	/* device must be suspended */
+	if (!dm_suspended_md(md))
+		goto out;
+
+	r = dm_calculate_queue_limits(table, &limits);
+	if (r) {
+		map = ERR_PTR(r);
+		goto out;
 	}
-	spin_unlock_irqrestore(q->queue_lock, flags);
 
-	return r;
+	/* cannot change the device type, once a table is bound */
+	if (md->map &&
+	    (dm_table_get_type(md->map) != dm_table_get_type(table))) {
+		DMWARN("can't change the device type after a table is bound");
+		goto out;
+	}
+
+	map = __bind(md, table, &limits);
+
+out:
+	mutex_unlock(&md->suspend_lock);
+	return map;
 }
 
 /*
@@ -2330,49 +2446,11 @@ static void unlock_fs(struct mapped_device *md)
 /*
  * Suspend mechanism in request-based dm.
  *
- * After the suspend starts, further incoming requests are kept in
- * the request_queue and deferred.
- * Remaining requests in the request_queue at the start of suspend are flushed
- * if it is flush suspend.
- * The suspend completes when the following conditions have been satisfied,
- * so wait for it:
- *    1. q->in_flight is 0 (which means no in_flight request)
- *    2. queue has been stopped (which means no request dispatching)
- *
+ * 1. Flush all I/Os by lock_fs() if needed.
+ * 2. Stop dispatching any I/O by stopping the request_queue.
+ * 3. Wait for all in-flight I/Os to be completed or requeued.
  *
- * Noflush suspend
- * ---------------
- * Noflush suspend doesn't need to dispatch remaining requests.
- * So stop the queue immediately.  Then, wait for all in_flight requests
- * to be completed or requeued.
- *
- * To abort noflush suspend, start the queue.
- *
- *
- * Flush suspend
- * -------------
- * Flush suspend needs to dispatch remaining requests.  So stop the queue
- * after the remaining requests are completed. (Requeued request must be also
- * re-dispatched and completed.  Until then, we can't stop the queue.)
- *
- * During flushing the remaining requests, further incoming requests are also
- * inserted to the same queue.  To distinguish which requests are to be
- * flushed, we insert a marker request to the queue at the time of starting
- * flush suspend, like a barrier.
- * The dispatching is blocked when the marker is found on the top of the queue.
- * And the queue is stopped when all in_flight requests are completed, since
- * that means the remaining requests are completely flushed.
- * Then, the marker is removed from the queue.
- *
- * To abort flush suspend, we also need to take care of the marker, not only
- * starting the queue.
- * We don't remove the marker forcibly from the queue since it's against
- * the block-layer manner.  Instead, we put a invalidated mark on the marker.
- * When the invalidated marker is found on the top of the queue, it is
- * immediately removed from the queue, so it doesn't block dispatching.
- * Because we have only one marker per mapped_device, we can't start another
- * flush suspend until the invalidated marker is removed from the queue.
- * So fail and return with -EBUSY in such a case.
+ * To abort suspend, start the request_queue.
  */
 int dm_suspend(struct mapped_device *md, unsigned suspend_flags)
 {
@@ -2383,17 +2461,12 @@ int dm_suspend(struct mapped_device *md, unsigned suspend_flags)
 
 	mutex_lock(&md->suspend_lock);
 
-	if (dm_suspended(md)) {
+	if (dm_suspended_md(md)) {
 		r = -EINVAL;
 		goto out_unlock;
 	}
 
-	if (dm_request_based(md) && !dm_rq_suspend_available(md, noflush)) {
-		r = -EBUSY;
-		goto out_unlock;
-	}
-
-	map = dm_get_table(md);
+	map = dm_get_live_table(md);
 
 	/*
 	 * DMF_NOFLUSH_SUSPENDING must be set before presuspend.
@@ -2406,8 +2479,10 @@ int dm_suspend(struct mapped_device *md, unsigned suspend_flags)
 	dm_table_presuspend_targets(map);
 
 	/*
-	 * Flush I/O to the device. noflush supersedes do_lockfs,
-	 * because lock_fs() needs to flush I/Os.
+	 * Flush I/O to the device.
+	 * Any I/O submitted after lock_fs() may not be flushed.
+	 * noflush takes precedence over do_lockfs.
+	 * (lock_fs() flushes I/Os and waits for them to complete.)
 	 */
 	if (!noflush && do_lockfs) {
 		r = lock_fs(md);
@@ -2436,10 +2511,15 @@ int dm_suspend(struct mapped_device *md, unsigned suspend_flags)
 	set_bit(DMF_QUEUE_IO_TO_THREAD, &md->flags);
 	up_write(&md->io_lock);
 
-	flush_workqueue(md->wq);
-
+	/*
+	 * Request-based dm uses md->wq for barrier (dm_rq_barrier_work) which
+	 * can be kicked until md->queue is stopped.  So stop md->queue before
+	 * flushing md->wq.
+	 */
 	if (dm_request_based(md))
-		dm_rq_start_suspend(md, noflush);
+		stop_queue(md->queue);
+
+	flush_workqueue(md->wq);
 
 	/*
 	 * At this point no more requests are entering target request routines.
@@ -2458,7 +2538,7 @@ int dm_suspend(struct mapped_device *md, unsigned suspend_flags)
 		dm_queue_flush(md);
 
 		if (dm_request_based(md))
-			dm_rq_abort_suspend(md, noflush);
+			start_queue(md->queue);
 
 		unlock_fs(md);
 		goto out; /* pushback list is already flushed, so skip flush */
@@ -2470,10 +2550,10 @@ int dm_suspend(struct mapped_device *md, unsigned suspend_flags)
 	 * requests are being added to md->deferred list.
 	 */
 
-	dm_table_postsuspend_targets(map);
-
 	set_bit(DMF_SUSPENDED, &md->flags);
 
+	dm_table_postsuspend_targets(map);
+
 out:
 	dm_table_put(map);
 
@@ -2488,10 +2568,10 @@ int dm_resume(struct mapped_device *md)
 	struct dm_table *map = NULL;
 
 	mutex_lock(&md->suspend_lock);
-	if (!dm_suspended(md))
+	if (!dm_suspended_md(md))
 		goto out;
 
-	map = dm_get_table(md);
+	map = dm_get_live_table(md);
 	if (!map || !dm_table_get_size(map))
 		goto out;
 
@@ -2592,18 +2672,29 @@ struct mapped_device *dm_get_from_kobject(struct kobject *kobj)
 		return NULL;
 
 	if (test_bit(DMF_FREEING, &md->flags) ||
-	    test_bit(DMF_DELETING, &md->flags))
+	    dm_deleting_md(md))
 		return NULL;
 
 	dm_get(md);
 	return md;
 }
 
-int dm_suspended(struct mapped_device *md)
+int dm_suspended_md(struct mapped_device *md)
 {
 	return test_bit(DMF_SUSPENDED, &md->flags);
 }
 
+int dm_suspended(struct dm_target *ti)
+{
+	struct mapped_device *md = dm_table_get_md(ti->table);
+	int r = dm_suspended_md(md);
+
+	dm_put(md);
+
+	return r;
+}
+EXPORT_SYMBOL_GPL(dm_suspended);
+
 int dm_noflush_suspending(struct dm_target *ti)
 {
 	struct mapped_device *md = dm_table_get_md(ti->table);
diff --git a/drivers/md/dm.h b/drivers/md/dm.h
index a7663eba17e2..8dadaa5bc396 100644
--- a/drivers/md/dm.h
+++ b/drivers/md/dm.h
@@ -89,6 +89,16 @@ int dm_target_iterate(void (*iter_func)(struct target_type *tt,
 int dm_split_args(int *argc, char ***argvp, char *input);
 
 /*
+ * Is this mapped_device being deleted?
+ */
+int dm_deleting_md(struct mapped_device *md);
+
+/*
+ * Is this mapped_device suspended?
+ */
+int dm_suspended_md(struct mapped_device *md);
+
+/*
  * The device-mapper can be driven through one of two interfaces;
  * ioctl or filesystem, depending which patch you have applied.
  */
@@ -118,6 +128,9 @@ int dm_lock_for_deletion(struct mapped_device *md);
 void dm_kobject_uevent(struct mapped_device *md, enum kobject_action action,
 		       unsigned cookie);
 
+int dm_io_init(void);
+void dm_io_exit(void);
+
 int dm_kcopyd_init(void);
 void dm_kcopyd_exit(void);
 
diff --git a/drivers/md/faulty.c b/drivers/md/faulty.c
index 87d88dbb667f..713acd02ab39 100644
--- a/drivers/md/faulty.c
+++ b/drivers/md/faulty.c
@@ -360,6 +360,7 @@ static void raid_exit(void)
 module_init(raid_init);
 module_exit(raid_exit);
 MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("Fault injection personality for MD");
 MODULE_ALIAS("md-personality-10"); /* faulty */
 MODULE_ALIAS("md-faulty");
 MODULE_ALIAS("md-level--5");
diff --git a/drivers/md/linear.c b/drivers/md/linear.c
index 1ceceb334d5e..00435bd20699 100644
--- a/drivers/md/linear.c
+++ b/drivers/md/linear.c
@@ -292,7 +292,7 @@ static int linear_make_request (struct request_queue *q, struct bio *bio)
 	int cpu;
 
 	if (unlikely(bio_rw_flagged(bio, BIO_RW_BARRIER))) {
-		bio_endio(bio, -EOPNOTSUPP);
+		md_barrier_request(mddev, bio);
 		return 0;
 	}
 
@@ -383,6 +383,7 @@ static void linear_exit (void)
 module_init(linear_init);
 module_exit(linear_exit);
 MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("Linear device concatenation personality for MD");
 MODULE_ALIAS("md-personality-1"); /* LINEAR - deprecated*/
 MODULE_ALIAS("md-linear");
 MODULE_ALIAS("md-level--1");
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 5f154ef1e4be..dd3dfe42d5a9 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -39,11 +39,13 @@
 #include <linux/buffer_head.h> /* for invalidate_bdev */
 #include <linux/poll.h>
 #include <linux/ctype.h>
+#include <linux/string.h>
 #include <linux/hdreg.h>
 #include <linux/proc_fs.h>
 #include <linux/random.h>
 #include <linux/reboot.h>
 #include <linux/file.h>
+#include <linux/compat.h>
 #include <linux/delay.h>
 #include <linux/raid/md_p.h>
 #include <linux/raid/md_u.h>
@@ -68,6 +70,12 @@ static DECLARE_WAIT_QUEUE_HEAD(resync_wait);
 #define MD_BUG(x...) { printk("md: bug in file %s, line %d\n", __FILE__, __LINE__); md_print_devices(); }
 
 /*
+ * Default number of read corrections we'll attempt on an rdev
+ * before ejecting it from the array. We divide the read error
+ * count by 2 for every hour elapsed between read errors.
+ */
+#define MD_DEFAULT_MAX_CORRECTED_READ_ERRORS 20
+/*
  * Current RAID-1,4,5 parallel reconstruction 'guaranteed speed limit'
  * is 1000 KB/sec, so the extra system load does not show up that much.
  * Increase it if you want to have more _guaranteed_ speed. Note that
@@ -213,12 +221,12 @@ static int md_make_request(struct request_queue *q, struct bio *bio)
 		return 0;
 	}
 	rcu_read_lock();
-	if (mddev->suspended) {
+	if (mddev->suspended || mddev->barrier) {
 		DEFINE_WAIT(__wait);
 		for (;;) {
 			prepare_to_wait(&mddev->sb_wait, &__wait,
 					TASK_UNINTERRUPTIBLE);
-			if (!mddev->suspended)
+			if (!mddev->suspended && !mddev->barrier)
 				break;
 			rcu_read_unlock();
 			schedule();
@@ -260,10 +268,110 @@ static void mddev_resume(mddev_t *mddev)
 
 int mddev_congested(mddev_t *mddev, int bits)
 {
+	if (mddev->barrier)
+		return 1;
 	return mddev->suspended;
 }
 EXPORT_SYMBOL(mddev_congested);
 
+/*
+ * Generic barrier handling for md
+ */
+
+#define POST_REQUEST_BARRIER ((void*)1)
+
+static void md_end_barrier(struct bio *bio, int err)
+{
+	mdk_rdev_t *rdev = bio->bi_private;
+	mddev_t *mddev = rdev->mddev;
+	if (err == -EOPNOTSUPP && mddev->barrier != POST_REQUEST_BARRIER)
+		set_bit(BIO_EOPNOTSUPP, &mddev->barrier->bi_flags);
+
+	rdev_dec_pending(rdev, mddev);
+
+	if (atomic_dec_and_test(&mddev->flush_pending)) {
+		if (mddev->barrier == POST_REQUEST_BARRIER) {
+			/* This was a post-request barrier */
+			mddev->barrier = NULL;
+			wake_up(&mddev->sb_wait);
+		} else
+			/* The pre-request barrier has finished */
+			schedule_work(&mddev->barrier_work);
+	}
+	bio_put(bio);
+}
+
+static void submit_barriers(mddev_t *mddev)
+{
+	mdk_rdev_t *rdev;
+
+	rcu_read_lock();
+	list_for_each_entry_rcu(rdev, &mddev->disks, same_set)
+		if (rdev->raid_disk >= 0 &&
+		    !test_bit(Faulty, &rdev->flags)) {
+			/* Take two references, one is dropped
+			 * when request finishes, one after
+			 * we reclaim rcu_read_lock
+			 */
+			struct bio *bi;
+			atomic_inc(&rdev->nr_pending);
+			atomic_inc(&rdev->nr_pending);
+			rcu_read_unlock();
+			bi = bio_alloc(GFP_KERNEL, 0);
+			bi->bi_end_io = md_end_barrier;
+			bi->bi_private = rdev;
+			bi->bi_bdev = rdev->bdev;
+			atomic_inc(&mddev->flush_pending);
+			submit_bio(WRITE_BARRIER, bi);
+			rcu_read_lock();
+			rdev_dec_pending(rdev, mddev);
+		}
+	rcu_read_unlock();
+}
+
+static void md_submit_barrier(struct work_struct *ws)
+{
+	mddev_t *mddev = container_of(ws, mddev_t, barrier_work);
+	struct bio *bio = mddev->barrier;
+
+	atomic_set(&mddev->flush_pending, 1);
+
+	if (test_bit(BIO_EOPNOTSUPP, &bio->bi_flags))
+		bio_endio(bio, -EOPNOTSUPP);
+	else if (bio->bi_size == 0)
+		/* an empty barrier - all done */
+		bio_endio(bio, 0);
+	else {
+		bio->bi_rw &= ~(1<<BIO_RW_BARRIER);
+		if (mddev->pers->make_request(mddev->queue, bio))
+			generic_make_request(bio);
+		mddev->barrier = POST_REQUEST_BARRIER;
+		submit_barriers(mddev);
+	}
+	if (atomic_dec_and_test(&mddev->flush_pending)) {
+		mddev->barrier = NULL;
+		wake_up(&mddev->sb_wait);
+	}
+}
+
+void md_barrier_request(mddev_t *mddev, struct bio *bio)
+{
+	spin_lock_irq(&mddev->write_lock);
+	wait_event_lock_irq(mddev->sb_wait,
+			    !mddev->barrier,
+			    mddev->write_lock, /*nothing*/);
+	mddev->barrier = bio;
+	spin_unlock_irq(&mddev->write_lock);
+
+	atomic_set(&mddev->flush_pending, 1);
+	INIT_WORK(&mddev->barrier_work, md_submit_barrier);
+
+	submit_barriers(mddev);
+
+	if (atomic_dec_and_test(&mddev->flush_pending))
+		schedule_work(&mddev->barrier_work);
+}
+EXPORT_SYMBOL(md_barrier_request);
 
 static inline mddev_t *mddev_get(mddev_t *mddev)
 {
@@ -278,7 +386,9 @@ static void mddev_put(mddev_t *mddev)
 	if (!atomic_dec_and_lock(&mddev->active, &all_mddevs_lock))
 		return;
 	if (!mddev->raid_disks && list_empty(&mddev->disks) &&
-	    !mddev->hold_active) {
+	    mddev->ctime == 0 && !mddev->hold_active) {
+		/* Array is not configured at all, and not held active,
+		 * so destroy it */
 		list_del(&mddev->all_mddevs);
 		if (mddev->gendisk) {
 			/* we did a probe so need to clean up.
@@ -363,6 +473,7 @@ static mddev_t * mddev_find(dev_t unit)
 
 	mutex_init(&new->open_mutex);
 	mutex_init(&new->reconfig_mutex);
+	mutex_init(&new->bitmap_info.mutex);
 	INIT_LIST_HEAD(&new->disks);
 	INIT_LIST_HEAD(&new->all_mddevs);
 	init_timer(&new->safemode_timer);
@@ -370,6 +481,7 @@ static mddev_t * mddev_find(dev_t unit)
 	atomic_set(&new->openers, 0);
 	atomic_set(&new->active_io, 0);
 	spin_lock_init(&new->write_lock);
+	atomic_set(&new->flush_pending, 0);
 	init_waitqueue_head(&new->sb_wait);
 	init_waitqueue_head(&new->recovery_wait);
 	new->reshape_position = MaxSector;
@@ -748,7 +860,7 @@ struct super_type  {
  */
 int md_check_no_bitmap(mddev_t *mddev)
 {
-	if (!mddev->bitmap_file && !mddev->bitmap_offset)
+	if (!mddev->bitmap_info.file && !mddev->bitmap_info.offset)
 		return 0;
 	printk(KERN_ERR "%s: bitmaps are not supported for %s\n",
 		mdname(mddev), mddev->pers->name);
@@ -876,8 +988,8 @@ static int super_90_validate(mddev_t *mddev, mdk_rdev_t *rdev)
 		mddev->raid_disks = sb->raid_disks;
 		mddev->dev_sectors = sb->size * 2;
 		mddev->events = ev1;
-		mddev->bitmap_offset = 0;
-		mddev->default_bitmap_offset = MD_SB_BYTES >> 9;
+		mddev->bitmap_info.offset = 0;
+		mddev->bitmap_info.default_offset = MD_SB_BYTES >> 9;
 
 		if (mddev->minor_version >= 91) {
 			mddev->reshape_position = sb->reshape_position;
@@ -911,8 +1023,9 @@ static int super_90_validate(mddev_t *mddev, mdk_rdev_t *rdev)
 		mddev->max_disks = MD_SB_DISKS;
 
 		if (sb->state & (1<<MD_SB_BITMAP_PRESENT) &&
-		    mddev->bitmap_file == NULL)
-			mddev->bitmap_offset = mddev->default_bitmap_offset;
+		    mddev->bitmap_info.file == NULL)
+			mddev->bitmap_info.offset =
+				mddev->bitmap_info.default_offset;
 
 	} else if (mddev->pers == NULL) {
 		/* Insist on good event counter while assembling */
@@ -1029,7 +1142,7 @@ static void super_90_sync(mddev_t *mddev, mdk_rdev_t *rdev)
 	sb->layout = mddev->layout;
 	sb->chunk_size = mddev->chunk_sectors << 9;
 
-	if (mddev->bitmap && mddev->bitmap_file == NULL)
+	if (mddev->bitmap && mddev->bitmap_info.file == NULL)
 		sb->state |= (1<<MD_SB_BITMAP_PRESENT);
 
 	sb->disks[0].state = (1<<MD_DISK_REMOVED);
@@ -1107,7 +1220,7 @@ super_90_rdev_size_change(mdk_rdev_t *rdev, sector_t num_sectors)
 {
 	if (num_sectors && num_sectors < rdev->mddev->dev_sectors)
 		return 0; /* component must fit device */
-	if (rdev->mddev->bitmap_offset)
+	if (rdev->mddev->bitmap_info.offset)
 		return 0; /* can't move bitmap */
 	rdev->sb_start = calc_dev_sboffset(rdev->bdev);
 	if (!num_sectors || num_sectors > rdev->sb_start)
@@ -1286,8 +1399,8 @@ static int super_1_validate(mddev_t *mddev, mdk_rdev_t *rdev)
 		mddev->raid_disks = le32_to_cpu(sb->raid_disks);
 		mddev->dev_sectors = le64_to_cpu(sb->size);
 		mddev->events = ev1;
-		mddev->bitmap_offset = 0;
-		mddev->default_bitmap_offset = 1024 >> 9;
+		mddev->bitmap_info.offset = 0;
+		mddev->bitmap_info.default_offset = 1024 >> 9;
 		
 		mddev->recovery_cp = le64_to_cpu(sb->resync_offset);
 		memcpy(mddev->uuid, sb->set_uuid, 16);
@@ -1295,8 +1408,9 @@ static int super_1_validate(mddev_t *mddev, mdk_rdev_t *rdev)
 		mddev->max_disks =  (4096-256)/2;
 
 		if ((le32_to_cpu(sb->feature_map) & MD_FEATURE_BITMAP_OFFSET) &&
-		    mddev->bitmap_file == NULL )
-			mddev->bitmap_offset = (__s32)le32_to_cpu(sb->bitmap_offset);
+		    mddev->bitmap_info.file == NULL )
+			mddev->bitmap_info.offset =
+				(__s32)le32_to_cpu(sb->bitmap_offset);
 
 		if ((le32_to_cpu(sb->feature_map) & MD_FEATURE_RESHAPE_ACTIVE)) {
 			mddev->reshape_position = le64_to_cpu(sb->reshape_position);
@@ -1390,19 +1504,17 @@ static void super_1_sync(mddev_t *mddev, mdk_rdev_t *rdev)
 	sb->level = cpu_to_le32(mddev->level);
 	sb->layout = cpu_to_le32(mddev->layout);
 
-	if (mddev->bitmap && mddev->bitmap_file == NULL) {
-		sb->bitmap_offset = cpu_to_le32((__u32)mddev->bitmap_offset);
+	if (mddev->bitmap && mddev->bitmap_info.file == NULL) {
+		sb->bitmap_offset = cpu_to_le32((__u32)mddev->bitmap_info.offset);
 		sb->feature_map = cpu_to_le32(MD_FEATURE_BITMAP_OFFSET);
 	}
 
 	if (rdev->raid_disk >= 0 &&
 	    !test_bit(In_sync, &rdev->flags)) {
-		if (rdev->recovery_offset > 0) {
-			sb->feature_map |=
-				cpu_to_le32(MD_FEATURE_RECOVERY_OFFSET);
-			sb->recovery_offset =
-				cpu_to_le64(rdev->recovery_offset);
-		}
+		sb->feature_map |=
+			cpu_to_le32(MD_FEATURE_RECOVERY_OFFSET);
+		sb->recovery_offset =
+			cpu_to_le64(rdev->recovery_offset);
 	}
 
 	if (mddev->reshape_position != MaxSector) {
@@ -1436,7 +1548,7 @@ static void super_1_sync(mddev_t *mddev, mdk_rdev_t *rdev)
 			sb->dev_roles[i] = cpu_to_le16(0xfffe);
 		else if (test_bit(In_sync, &rdev2->flags))
 			sb->dev_roles[i] = cpu_to_le16(rdev2->raid_disk);
-		else if (rdev2->raid_disk >= 0 && rdev2->recovery_offset > 0)
+		else if (rdev2->raid_disk >= 0)
 			sb->dev_roles[i] = cpu_to_le16(rdev2->raid_disk);
 		else
 			sb->dev_roles[i] = cpu_to_le16(0xffff);
@@ -1458,7 +1570,7 @@ super_1_rdev_size_change(mdk_rdev_t *rdev, sector_t num_sectors)
 		max_sectors -= rdev->data_offset;
 		if (!num_sectors || num_sectors > max_sectors)
 			num_sectors = max_sectors;
-	} else if (rdev->mddev->bitmap_offset) {
+	} else if (rdev->mddev->bitmap_info.offset) {
 		/* minor version 0 with bitmap we can't move */
 		return 0;
 	} else {
@@ -1826,15 +1938,11 @@ static void print_sb_1(struct mdp_superblock_1 *sb)
 
 	uuid = sb->set_uuid;
 	printk(KERN_INFO
-	       "md:  SB: (V:%u) (F:0x%08x) Array-ID:<%02x%02x%02x%02x"
-	       ":%02x%02x:%02x%02x:%02x%02x:%02x%02x%02x%02x%02x%02x>\n"
+	       "md:  SB: (V:%u) (F:0x%08x) Array-ID:<%pU>\n"
 	       "md:    Name: \"%s\" CT:%llu\n",
 		le32_to_cpu(sb->major_version),
 		le32_to_cpu(sb->feature_map),
-		uuid[0], uuid[1], uuid[2], uuid[3],
-		uuid[4], uuid[5], uuid[6], uuid[7],
-		uuid[8], uuid[9], uuid[10], uuid[11],
-		uuid[12], uuid[13], uuid[14], uuid[15],
+		uuid,
 		sb->set_name,
 		(unsigned long long)le64_to_cpu(sb->ctime)
 		       & MD_SUPERBLOCK_1_TIME_SEC_MASK);
@@ -1843,8 +1951,7 @@ static void print_sb_1(struct mdp_superblock_1 *sb)
 	printk(KERN_INFO
 	       "md:       L%u SZ%llu RD:%u LO:%u CS:%u DO:%llu DS:%llu SO:%llu"
 			" RO:%llu\n"
-	       "md:     Dev:%08x UUID: %02x%02x%02x%02x:%02x%02x:%02x%02x:%02x%02x"
-	                ":%02x%02x%02x%02x%02x%02x\n"
+	       "md:     Dev:%08x UUID: %pU\n"
 	       "md:       (F:0x%08x) UT:%llu Events:%llu ResyncOffset:%llu CSUM:0x%08x\n"
 	       "md:         (MaxDev:%u) \n",
 		le32_to_cpu(sb->level),
@@ -1857,10 +1964,7 @@ static void print_sb_1(struct mdp_superblock_1 *sb)
 		(unsigned long long)le64_to_cpu(sb->super_offset),
 		(unsigned long long)le64_to_cpu(sb->recovery_offset),
 		le32_to_cpu(sb->dev_number),
-		uuid[0], uuid[1], uuid[2], uuid[3],
-		uuid[4], uuid[5], uuid[6], uuid[7],
-		uuid[8], uuid[9], uuid[10], uuid[11],
-		uuid[12], uuid[13], uuid[14], uuid[15],
+		uuid,
 		sb->devflags,
 		(unsigned long long)le64_to_cpu(sb->utime) & MD_SUPERBLOCK_1_TIME_SEC_MASK,
 		(unsigned long long)le64_to_cpu(sb->events),
@@ -2442,12 +2546,49 @@ rdev_size_store(mdk_rdev_t *rdev, const char *buf, size_t len)
 static struct rdev_sysfs_entry rdev_size =
 __ATTR(size, S_IRUGO|S_IWUSR, rdev_size_show, rdev_size_store);
 
+
+static ssize_t recovery_start_show(mdk_rdev_t *rdev, char *page)
+{
+	unsigned long long recovery_start = rdev->recovery_offset;
+
+	if (test_bit(In_sync, &rdev->flags) ||
+	    recovery_start == MaxSector)
+		return sprintf(page, "none\n");
+
+	return sprintf(page, "%llu\n", recovery_start);
+}
+
+static ssize_t recovery_start_store(mdk_rdev_t *rdev, const char *buf, size_t len)
+{
+	unsigned long long recovery_start;
+
+	if (cmd_match(buf, "none"))
+		recovery_start = MaxSector;
+	else if (strict_strtoull(buf, 10, &recovery_start))
+		return -EINVAL;
+
+	if (rdev->mddev->pers &&
+	    rdev->raid_disk >= 0)
+		return -EBUSY;
+
+	rdev->recovery_offset = recovery_start;
+	if (recovery_start == MaxSector)
+		set_bit(In_sync, &rdev->flags);
+	else
+		clear_bit(In_sync, &rdev->flags);
+	return len;
+}
+
+static struct rdev_sysfs_entry rdev_recovery_start =
+__ATTR(recovery_start, S_IRUGO|S_IWUSR, recovery_start_show, recovery_start_store);
+
 static struct attribute *rdev_default_attrs[] = {
 	&rdev_state.attr,
 	&rdev_errors.attr,
 	&rdev_slot.attr,
 	&rdev_offset.attr,
 	&rdev_size.attr,
+	&rdev_recovery_start.attr,
 	NULL,
 };
 static ssize_t
@@ -2549,6 +2690,8 @@ static mdk_rdev_t *md_import_device(dev_t newdev, int super_format, int super_mi
 	rdev->flags = 0;
 	rdev->data_offset = 0;
 	rdev->sb_events = 0;
+	rdev->last_read_error.tv_sec  = 0;
+	rdev->last_read_error.tv_nsec = 0;
 	atomic_set(&rdev->nr_pending, 0);
 	atomic_set(&rdev->read_errors, 0);
 	atomic_set(&rdev->corrected_errors, 0);
@@ -2659,6 +2802,47 @@ static void analyze_sbs(mddev_t * mddev)
 	}
 }
 
+/* Read a fixed-point number.
+ * Numbers in sysfs attributes should be in "standard" units where
+ * possible, so time should be in seconds.
+ * However we internally use a a much smaller unit such as 
+ * milliseconds or jiffies.
+ * This function takes a decimal number with a possible fractional
+ * component, and produces an integer which is the result of
+ * multiplying that number by 10^'scale'.
+ * all without any floating-point arithmetic.
+ */
+int strict_strtoul_scaled(const char *cp, unsigned long *res, int scale)
+{
+	unsigned long result = 0;
+	long decimals = -1;
+	while (isdigit(*cp) || (*cp == '.' && decimals < 0)) {
+		if (*cp == '.')
+			decimals = 0;
+		else if (decimals < scale) {
+			unsigned int value;
+			value = *cp - '0';
+			result = result * 10 + value;
+			if (decimals >= 0)
+				decimals++;
+		}
+		cp++;
+	}
+	if (*cp == '\n')
+		cp++;
+	if (*cp)
+		return -EINVAL;
+	if (decimals < 0)
+		decimals = 0;
+	while (decimals < scale) {
+		result *= 10;
+		decimals ++;
+	}
+	*res = result;
+	return 0;
+}
+
+
 static void md_safemode_timeout(unsigned long data);
 
 static ssize_t
@@ -2670,31 +2854,10 @@ safe_delay_show(mddev_t *mddev, char *page)
 static ssize_t
 safe_delay_store(mddev_t *mddev, const char *cbuf, size_t len)
 {
-	int scale=1;
-	int dot=0;
-	int i;
 	unsigned long msec;
-	char buf[30];
 
-	/* remove a period, and count digits after it */
-	if (len >= sizeof(buf))
+	if (strict_strtoul_scaled(cbuf, &msec, 3) < 0)
 		return -EINVAL;
-	strlcpy(buf, cbuf, sizeof(buf));
-	for (i=0; i<len; i++) {
-		if (dot) {
-			if (isdigit(buf[i])) {
-				buf[i-1] = buf[i];
-				scale *= 10;
-			}
-			buf[i] = 0;
-		} else if (buf[i] == '.') {
-			dot=1;
-			buf[i] = 0;
-		}
-	}
-	if (strict_strtoul(buf, 10, &msec) < 0)
-		return -EINVAL;
-	msec = (msec * 1000) / scale;
 	if (msec == 0)
 		mddev->safemode_delay = 0;
 	else {
@@ -2970,7 +3133,9 @@ resync_start_store(mddev_t *mddev, const char *buf, size_t len)
 
 	if (mddev->pers)
 		return -EBUSY;
-	if (!*buf || (*e && *e != '\n'))
+	if (cmd_match(buf, "none"))
+		n = MaxSector;
+	else if (!*buf || (*e && *e != '\n'))
 		return -EINVAL;
 
 	mddev->recovery_cp = n;
@@ -3166,6 +3331,29 @@ static struct md_sysfs_entry md_array_state =
 __ATTR(array_state, S_IRUGO|S_IWUSR, array_state_show, array_state_store);
 
 static ssize_t
+max_corrected_read_errors_show(mddev_t *mddev, char *page) {
+	return sprintf(page, "%d\n",
+		       atomic_read(&mddev->max_corr_read_errors));
+}
+
+static ssize_t
+max_corrected_read_errors_store(mddev_t *mddev, const char *buf, size_t len)
+{
+	char *e;
+	unsigned long n = simple_strtoul(buf, &e, 10);
+
+	if (*buf && (*e == 0 || *e == '\n')) {
+		atomic_set(&mddev->max_corr_read_errors, n);
+		return len;
+	}
+	return -EINVAL;
+}
+
+static struct md_sysfs_entry max_corr_read_errors =
+__ATTR(max_read_errors, S_IRUGO|S_IWUSR, max_corrected_read_errors_show,
+	max_corrected_read_errors_store);
+
+static ssize_t
 null_show(mddev_t *mddev, char *page)
 {
 	return -EINVAL;
@@ -3246,8 +3434,7 @@ bitmap_store(mddev_t *mddev, const char *buf, size_t len)
 		}
 		if (*end && !isspace(*end)) break;
 		bitmap_dirty_bits(mddev->bitmap, chunk, end_chunk);
-		buf = end;
-		while (isspace(*buf)) buf++;
+		buf = skip_spaces(end);
 	}
 	bitmap_unplug(mddev->bitmap); /* flush the bits to disk */
 out:
@@ -3790,6 +3977,7 @@ static struct attribute *md_default_attrs[] = {
 	&md_array_state.attr,
 	&md_reshape_position.attr,
 	&md_array_size.attr,
+	&max_corr_read_errors.attr,
 	NULL,
 };
 
@@ -3894,6 +4082,7 @@ static void mddev_delayed_delete(struct work_struct *ws)
 		mddev->sysfs_action = NULL;
 		mddev->private = NULL;
 	}
+	sysfs_remove_group(&mddev->kobj, &md_bitmap_group);
 	kobject_del(&mddev->kobj);
 	kobject_put(&mddev->kobj);
 }
@@ -3985,6 +4174,8 @@ static int md_alloc(dev_t dev, char *name)
 		       disk->disk_name);
 		error = 0;
 	}
+	if (sysfs_create_group(&mddev->kobj, &md_bitmap_group))
+		printk(KERN_DEBUG "pointless warning\n");
  abort:
 	mutex_unlock(&disks_mutex);
 	if (!error) {
@@ -4166,7 +4357,7 @@ static int do_md_run(mddev_t * mddev)
 	mddev->barriers_work = 1;
 	mddev->ok_start_degraded = start_dirty_degraded;
 
-	if (start_readonly)
+	if (start_readonly && mddev->ro == 0)
 		mddev->ro = 2; /* read-only, but switch on first write */
 
 	err = mddev->pers->run(mddev);
@@ -4206,6 +4397,8 @@ static int do_md_run(mddev_t * mddev)
 		mddev->ro = 0;
 
  	atomic_set(&mddev->writes_pending,0);
+	atomic_set(&mddev->max_corr_read_errors,
+		   MD_DEFAULT_MAX_CORRECTED_READ_ERRORS);
 	mddev->safemode = 0;
 	mddev->safemode_timer.function = md_safemode_timeout;
 	mddev->safemode_timer.data = (unsigned long) mddev;
@@ -4228,33 +4421,6 @@ static int do_md_run(mddev_t * mddev)
 
 	set_capacity(disk, mddev->array_sectors);
 
-	/* If there is a partially-recovered drive we need to
-	 * start recovery here.  If we leave it to md_check_recovery,
-	 * it will remove the drives and not do the right thing
-	 */
-	if (mddev->degraded && !mddev->sync_thread) {
-		int spares = 0;
-		list_for_each_entry(rdev, &mddev->disks, same_set)
-			if (rdev->raid_disk >= 0 &&
-			    !test_bit(In_sync, &rdev->flags) &&
-			    !test_bit(Faulty, &rdev->flags))
-				/* complete an interrupted recovery */
-				spares++;
-		if (spares && mddev->pers->sync_request) {
-			mddev->recovery = 0;
-			set_bit(MD_RECOVERY_RUNNING, &mddev->recovery);
-			mddev->sync_thread = md_register_thread(md_do_sync,
-								mddev,
-								"resync");
-			if (!mddev->sync_thread) {
-				printk(KERN_ERR "%s: could not start resync"
-				       " thread...\n",
-				       mdname(mddev));
-				/* leave the spares where they are, it shouldn't hurt */
-				mddev->recovery = 0;
-			}
-		}
-	}
 	md_wakeup_thread(mddev->thread);
 	md_wakeup_thread(mddev->sync_thread); /* possibly kick off a reshape */
 
@@ -4310,7 +4476,7 @@ static int deny_bitmap_write_access(struct file * file)
 	return 0;
 }
 
-static void restore_bitmap_write_access(struct file *file)
+void restore_bitmap_write_access(struct file *file)
 {
 	struct inode *inode = file->f_mapping->host;
 
@@ -4405,12 +4571,12 @@ out:
 		printk(KERN_INFO "md: %s stopped.\n", mdname(mddev));
 
 		bitmap_destroy(mddev);
-		if (mddev->bitmap_file) {
-			restore_bitmap_write_access(mddev->bitmap_file);
-			fput(mddev->bitmap_file);
-			mddev->bitmap_file = NULL;
+		if (mddev->bitmap_info.file) {
+			restore_bitmap_write_access(mddev->bitmap_info.file);
+			fput(mddev->bitmap_info.file);
+			mddev->bitmap_info.file = NULL;
 		}
-		mddev->bitmap_offset = 0;
+		mddev->bitmap_info.offset = 0;
 
 		/* make sure all md_delayed_delete calls have finished */
 		flush_scheduled_work();
@@ -4451,6 +4617,11 @@ out:
 		mddev->degraded = 0;
 		mddev->barriers_work = 0;
 		mddev->safemode = 0;
+		mddev->bitmap_info.offset = 0;
+		mddev->bitmap_info.default_offset = 0;
+		mddev->bitmap_info.chunksize = 0;
+		mddev->bitmap_info.daemon_sleep = 0;
+		mddev->bitmap_info.max_write_behind = 0;
 		kobject_uevent(&disk_to_dev(mddev->gendisk)->kobj, KOBJ_CHANGE);
 		if (mddev->hold_active == UNTIL_STOP)
 			mddev->hold_active = 0;
@@ -4636,7 +4807,7 @@ static int get_array_info(mddev_t * mddev, void __user * arg)
 	info.state         = 0;
 	if (mddev->in_sync)
 		info.state = (1<<MD_SB_CLEAN);
-	if (mddev->bitmap && mddev->bitmap_offset)
+	if (mddev->bitmap && mddev->bitmap_info.offset)
 		info.state = (1<<MD_SB_BITMAP_PRESENT);
 	info.active_disks  = insync;
 	info.working_disks = working;
@@ -4994,23 +5165,23 @@ static int set_bitmap_file(mddev_t *mddev, int fd)
 	if (fd >= 0) {
 		if (mddev->bitmap)
 			return -EEXIST; /* cannot add when bitmap is present */
-		mddev->bitmap_file = fget(fd);
+		mddev->bitmap_info.file = fget(fd);
 
-		if (mddev->bitmap_file == NULL) {
+		if (mddev->bitmap_info.file == NULL) {
 			printk(KERN_ERR "%s: error: failed to get bitmap file\n",
 			       mdname(mddev));
 			return -EBADF;
 		}
 
-		err = deny_bitmap_write_access(mddev->bitmap_file);
+		err = deny_bitmap_write_access(mddev->bitmap_info.file);
 		if (err) {
 			printk(KERN_ERR "%s: error: bitmap file is already in use\n",
 			       mdname(mddev));
-			fput(mddev->bitmap_file);
-			mddev->bitmap_file = NULL;
+			fput(mddev->bitmap_info.file);
+			mddev->bitmap_info.file = NULL;
 			return err;
 		}
-		mddev->bitmap_offset = 0; /* file overrides offset */
+		mddev->bitmap_info.offset = 0; /* file overrides offset */
 	} else if (mddev->bitmap == NULL)
 		return -ENOENT; /* cannot remove what isn't there */
 	err = 0;
@@ -5025,11 +5196,11 @@ static int set_bitmap_file(mddev_t *mddev, int fd)
 		mddev->pers->quiesce(mddev, 0);
 	}
 	if (fd < 0) {
-		if (mddev->bitmap_file) {
-			restore_bitmap_write_access(mddev->bitmap_file);
-			fput(mddev->bitmap_file);
+		if (mddev->bitmap_info.file) {
+			restore_bitmap_write_access(mddev->bitmap_info.file);
+			fput(mddev->bitmap_info.file);
 		}
-		mddev->bitmap_file = NULL;
+		mddev->bitmap_info.file = NULL;
 	}
 
 	return err;
@@ -5066,6 +5237,10 @@ static int set_array_info(mddev_t * mddev, mdu_array_info_t *info)
 		mddev->minor_version = info->minor_version;
 		mddev->patch_version = info->patch_version;
 		mddev->persistent = !info->not_persistent;
+		/* ensure mddev_put doesn't delete this now that there
+		 * is some minimal configuration.
+		 */
+		mddev->ctime         = get_seconds();
 		return 0;
 	}
 	mddev->major_version = MD_MAJOR_VERSION;
@@ -5096,8 +5271,8 @@ static int set_array_info(mddev_t * mddev, mdu_array_info_t *info)
 		mddev->flags         = 0;
 	set_bit(MD_CHANGE_DEVS, &mddev->flags);
 
-	mddev->default_bitmap_offset = MD_SB_BYTES >> 9;
-	mddev->bitmap_offset = 0;
+	mddev->bitmap_info.default_offset = MD_SB_BYTES >> 9;
+	mddev->bitmap_info.offset = 0;
 
 	mddev->reshape_position = MaxSector;
 
@@ -5197,7 +5372,7 @@ static int update_array_info(mddev_t *mddev, mdu_array_info_t *info)
 	int state = 0;
 
 	/* calculate expected state,ignoring low bits */
-	if (mddev->bitmap && mddev->bitmap_offset)
+	if (mddev->bitmap && mddev->bitmap_info.offset)
 		state |= (1 << MD_SB_BITMAP_PRESENT);
 
 	if (mddev->major_version != info->major_version ||
@@ -5256,9 +5431,10 @@ static int update_array_info(mddev_t *mddev, mdu_array_info_t *info)
 			/* add the bitmap */
 			if (mddev->bitmap)
 				return -EEXIST;
-			if (mddev->default_bitmap_offset == 0)
+			if (mddev->bitmap_info.default_offset == 0)
 				return -EINVAL;
-			mddev->bitmap_offset = mddev->default_bitmap_offset;
+			mddev->bitmap_info.offset =
+				mddev->bitmap_info.default_offset;
 			mddev->pers->quiesce(mddev, 1);
 			rv = bitmap_create(mddev);
 			if (rv)
@@ -5273,7 +5449,7 @@ static int update_array_info(mddev_t *mddev, mdu_array_info_t *info)
 			mddev->pers->quiesce(mddev, 1);
 			bitmap_destroy(mddev);
 			mddev->pers->quiesce(mddev, 0);
-			mddev->bitmap_offset = 0;
+			mddev->bitmap_info.offset = 0;
 		}
 	}
 	md_update_sb(mddev, 1);
@@ -5524,6 +5700,25 @@ done:
 abort:
 	return err;
 }
+#ifdef CONFIG_COMPAT
+static int md_compat_ioctl(struct block_device *bdev, fmode_t mode,
+		    unsigned int cmd, unsigned long arg)
+{
+	switch (cmd) {
+	case HOT_REMOVE_DISK:
+	case HOT_ADD_DISK:
+	case SET_DISK_FAULTY:
+	case SET_BITMAP_FILE:
+		/* These take in integer arg, do not convert */
+		break;
+	default:
+		arg = (unsigned long)compat_ptr(arg);
+		break;
+	}
+
+	return md_ioctl(bdev, mode, cmd, arg);
+}
+#endif /* CONFIG_COMPAT */
 
 static int md_open(struct block_device *bdev, fmode_t mode)
 {
@@ -5589,6 +5784,9 @@ static const struct block_device_operations md_fops =
 	.open		= md_open,
 	.release	= md_release,
 	.ioctl		= md_ioctl,
+#ifdef CONFIG_COMPAT
+	.compat_ioctl	= md_compat_ioctl,
+#endif
 	.getgeo		= md_getgeo,
 	.media_changed	= md_media_changed,
 	.revalidate_disk= md_revalidate,
@@ -5982,14 +6180,14 @@ static int md_seq_show(struct seq_file *seq, void *v)
 			unsigned long chunk_kb;
 			unsigned long flags;
 			spin_lock_irqsave(&bitmap->lock, flags);
-			chunk_kb = bitmap->chunksize >> 10;
+			chunk_kb = mddev->bitmap_info.chunksize >> 10;
 			seq_printf(seq, "bitmap: %lu/%lu pages [%luKB], "
 				"%lu%s chunk",
 				bitmap->pages - bitmap->missing_pages,
 				bitmap->pages,
 				(bitmap->pages - bitmap->missing_pages)
 					<< (PAGE_SHIFT - 10),
-				chunk_kb ? chunk_kb : bitmap->chunksize,
+				chunk_kb ? chunk_kb : mddev->bitmap_info.chunksize,
 				chunk_kb ? "KB" : "B");
 			if (bitmap->file) {
 				seq_printf(seq, ", file: ");
@@ -6275,10 +6473,11 @@ void md_do_sync(mddev_t *mddev)
 		mddev->curr_resync = 2;
 
 	try_again:
-		if (kthread_should_stop()) {
+		if (kthread_should_stop())
 			set_bit(MD_RECOVERY_INTR, &mddev->recovery);
+
+		if (test_bit(MD_RECOVERY_INTR, &mddev->recovery))
 			goto skip;
-		}
 		for_each_mddev(mddev2, tmp) {
 			if (mddev2 == mddev)
 				continue;
@@ -6338,12 +6537,14 @@ void md_do_sync(mddev_t *mddev)
 		/* recovery follows the physical size of devices */
 		max_sectors = mddev->dev_sectors;
 		j = MaxSector;
-		list_for_each_entry(rdev, &mddev->disks, same_set)
+		rcu_read_lock();
+		list_for_each_entry_rcu(rdev, &mddev->disks, same_set)
 			if (rdev->raid_disk >= 0 &&
 			    !test_bit(Faulty, &rdev->flags) &&
 			    !test_bit(In_sync, &rdev->flags) &&
 			    rdev->recovery_offset < j)
 				j = rdev->recovery_offset;
+		rcu_read_unlock();
 	}
 
 	printk(KERN_INFO "md: %s of RAID array %s\n", desc, mdname(mddev));
@@ -6380,6 +6581,7 @@ void md_do_sync(mddev_t *mddev)
 		       desc, mdname(mddev));
 		mddev->curr_resync = j;
 	}
+	mddev->curr_resync_completed = mddev->curr_resync;
 
 	while (j < max_sectors) {
 		sector_t sectors;
@@ -6512,22 +6714,29 @@ void md_do_sync(mddev_t *mddev)
 		} else {
 			if (!test_bit(MD_RECOVERY_INTR, &mddev->recovery))
 				mddev->curr_resync = MaxSector;
-			list_for_each_entry(rdev, &mddev->disks, same_set)
+			rcu_read_lock();
+			list_for_each_entry_rcu(rdev, &mddev->disks, same_set)
 				if (rdev->raid_disk >= 0 &&
 				    !test_bit(Faulty, &rdev->flags) &&
 				    !test_bit(In_sync, &rdev->flags) &&
 				    rdev->recovery_offset < mddev->curr_resync)
 					rdev->recovery_offset = mddev->curr_resync;
+			rcu_read_unlock();
 		}
 	}
 	set_bit(MD_CHANGE_DEVS, &mddev->flags);
 
  skip:
+	if (!test_bit(MD_RECOVERY_INTR, &mddev->recovery)) {
+		/* We completed so min/max setting can be forgotten if used. */
+		if (test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery))
+			mddev->resync_min = 0;
+		mddev->resync_max = MaxSector;
+	} else if (test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery))
+		mddev->resync_min = mddev->curr_resync_completed;
 	mddev->curr_resync = 0;
-	mddev->curr_resync_completed = 0;
 	if (!test_bit(MD_RECOVERY_INTR, &mddev->recovery))
-		/* We completed so max setting can be forgotten. */
-		mddev->resync_max = MaxSector;
+		mddev->curr_resync_completed = 0;
 	sysfs_notify(&mddev->kobj, NULL, "sync_completed");
 	wake_up(&resync_wait);
 	set_bit(MD_RECOVERY_DONE, &mddev->recovery);
@@ -6590,6 +6799,7 @@ static int remove_and_add_spares(mddev_t *mddev)
 						       nm, mdname(mddev));
 					spares++;
 					md_new_event(mddev);
+					set_bit(MD_CHANGE_DEVS, &mddev->flags);
 				} else
 					break;
 			}
@@ -6625,7 +6835,7 @@ void md_check_recovery(mddev_t *mddev)
 
 
 	if (mddev->bitmap)
-		bitmap_daemon_work(mddev->bitmap);
+		bitmap_daemon_work(mddev);
 
 	if (mddev->ro)
 		return;
@@ -6995,5 +7205,6 @@ EXPORT_SYMBOL(md_unregister_thread);
 EXPORT_SYMBOL(md_wakeup_thread);
 EXPORT_SYMBOL(md_check_recovery);
 MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("MD RAID framework");
 MODULE_ALIAS("md");
 MODULE_ALIAS_BLOCKDEV_MAJOR(MD_MAJOR);
diff --git a/drivers/md/md.h b/drivers/md/md.h
index f184b69ef337..8e4c75c00d46 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -97,6 +97,9 @@ struct mdk_rdev_s
 	atomic_t	read_errors;	/* number of consecutive read errors that
 					 * we have tried to ignore.
 					 */
+	struct timespec last_read_error;	/* monotonic time since our
+						 * last read error
+						 */
 	atomic_t	corrected_errors; /* number of corrected read errors,
 					   * for reporting to userspace and storing
 					   * in superblock.
@@ -280,17 +283,38 @@ struct mddev_s
 	unsigned int                    max_write_behind; /* 0 = sync */
 
 	struct bitmap                   *bitmap; /* the bitmap for the device */
-	struct file			*bitmap_file; /* the bitmap file */
-	long				bitmap_offset; /* offset from superblock of
-							* start of bitmap. May be
-							* negative, but not '0'
-							*/
-	long				default_bitmap_offset; /* this is the offset to use when
-								* hot-adding a bitmap.  It should
-								* eventually be settable by sysfs.
-								*/
-
+	struct {
+		struct file		*file; /* the bitmap file */
+		loff_t			offset; /* offset from superblock of
+						 * start of bitmap. May be
+						 * negative, but not '0'
+						 * For external metadata, offset
+						 * from start of device. 
+						 */
+		loff_t			default_offset; /* this is the offset to use when
+							 * hot-adding a bitmap.  It should
+							 * eventually be settable by sysfs.
+							 */
+		struct mutex		mutex;
+		unsigned long		chunksize;
+		unsigned long		daemon_sleep; /* how many seconds between updates? */
+		unsigned long		max_write_behind; /* write-behind mode */
+		int			external;
+	} bitmap_info;
+
+	atomic_t 			max_corr_read_errors; /* max read retries */
 	struct list_head		all_mddevs;
+
+	/* Generic barrier handling.
+	 * If there is a pending barrier request, all other
+	 * writes are blocked while the devices are flushed.
+	 * The last to finish a flush schedules a worker to
+	 * submit the barrier request (without the barrier flag),
+	 * then submit more flush requests.
+	 */
+	struct bio *barrier;
+	atomic_t flush_pending;
+	struct work_struct barrier_work;
 };
 
 
@@ -353,7 +377,7 @@ struct md_sysfs_entry {
 	ssize_t (*show)(mddev_t *, char *);
 	ssize_t (*store)(mddev_t *, const char *, size_t);
 };
-
+extern struct attribute_group md_bitmap_group;
 
 static inline char * mdname (mddev_t * mddev)
 {
@@ -431,6 +455,7 @@ extern void md_done_sync(mddev_t *mddev, int blocks, int ok);
 extern void md_error(mddev_t *mddev, mdk_rdev_t *rdev);
 
 extern int mddev_congested(mddev_t *mddev, int bits);
+extern void md_barrier_request(mddev_t *mddev, struct bio *bio);
 extern void md_super_write(mddev_t *mddev, mdk_rdev_t *rdev,
 			   sector_t sector, int size, struct page *page);
 extern void md_super_wait(mddev_t *mddev);
@@ -443,6 +468,8 @@ extern void md_wait_for_blocked_rdev(mdk_rdev_t *rdev, mddev_t *mddev);
 extern void md_set_array_sectors(mddev_t *mddev, sector_t array_sectors);
 extern int md_check_no_bitmap(mddev_t *mddev);
 extern int md_integrity_register(mddev_t *mddev);
-void md_integrity_add_rdev(mdk_rdev_t *rdev, mddev_t *mddev);
+extern void md_integrity_add_rdev(mdk_rdev_t *rdev, mddev_t *mddev);
+extern int strict_strtoul_scaled(const char *cp, unsigned long *res, int scale);
+extern void restore_bitmap_write_access(struct file *file);
 
 #endif /* _MD_MD_H */
diff --git a/drivers/md/multipath.c b/drivers/md/multipath.c
index ee7646f974a0..32a662fc55c9 100644
--- a/drivers/md/multipath.c
+++ b/drivers/md/multipath.c
@@ -145,7 +145,7 @@ static int multipath_make_request (struct request_queue *q, struct bio * bio)
 	int cpu;
 
 	if (unlikely(bio_rw_flagged(bio, BIO_RW_BARRIER))) {
-		bio_endio(bio, -EOPNOTSUPP);
+		md_barrier_request(mddev, bio);
 		return 0;
 	}
 
@@ -581,6 +581,7 @@ static void __exit multipath_exit (void)
 module_init(multipath_init);
 module_exit(multipath_exit);
 MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("simple multi-path personality for MD");
 MODULE_ALIAS("md-personality-7"); /* MULTIPATH */
 MODULE_ALIAS("md-multipath");
 MODULE_ALIAS("md-level--4");
diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
index d3a4ce06015a..77605cdceaf1 100644
--- a/drivers/md/raid0.c
+++ b/drivers/md/raid0.c
@@ -453,7 +453,7 @@ static int raid0_make_request(struct request_queue *q, struct bio *bio)
 	int cpu;
 
 	if (unlikely(bio_rw_flagged(bio, BIO_RW_BARRIER))) {
-		bio_endio(bio, -EOPNOTSUPP);
+		md_barrier_request(mddev, bio);
 		return 0;
 	}
 
@@ -567,6 +567,7 @@ static void raid0_exit (void)
 module_init(raid0_init);
 module_exit(raid0_exit);
 MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("RAID0 (striping) personality for MD");
 MODULE_ALIAS("md-personality-2"); /* RAID0 */
 MODULE_ALIAS("md-raid0");
 MODULE_ALIAS("md-level-0");
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index e07ce2e033a9..859bd3ffe435 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -677,6 +677,7 @@ static void raise_barrier(conf_t *conf)
 static void lower_barrier(conf_t *conf)
 {
 	unsigned long flags;
+	BUG_ON(conf->barrier <= 0);
 	spin_lock_irqsave(&conf->resync_lock, flags);
 	conf->barrier--;
 	spin_unlock_irqrestore(&conf->resync_lock, flags);
@@ -801,6 +802,25 @@ static int make_request(struct request_queue *q, struct bio * bio)
 
 	md_write_start(mddev, bio); /* wait on superblock update early */
 
+	if (bio_data_dir(bio) == WRITE &&
+	    bio->bi_sector + bio->bi_size/512 > mddev->suspend_lo &&
+	    bio->bi_sector < mddev->suspend_hi) {
+		/* As the suspend_* range is controlled by
+		 * userspace, we want an interruptible
+		 * wait.
+		 */
+		DEFINE_WAIT(w);
+		for (;;) {
+			flush_signals(current);
+			prepare_to_wait(&conf->wait_barrier,
+					&w, TASK_INTERRUPTIBLE);
+			if (bio->bi_sector + bio->bi_size/512 <= mddev->suspend_lo ||
+			    bio->bi_sector >= mddev->suspend_hi)
+				break;
+			schedule();
+		}
+		finish_wait(&conf->wait_barrier, &w);
+	}
 	if (unlikely(!mddev->barriers_work &&
 		     bio_rw_flagged(bio, BIO_RW_BARRIER))) {
 		if (rw == WRITE)
@@ -923,7 +943,8 @@ static int make_request(struct request_queue *q, struct bio * bio)
 
 	/* do behind I/O ? */
 	if (bitmap &&
-	    atomic_read(&bitmap->behind_writes) < bitmap->max_write_behind &&
+	    (atomic_read(&bitmap->behind_writes)
+	     < mddev->bitmap_info.max_write_behind) &&
 	    (behind_pages = alloc_behind_pages(bio)) != NULL)
 		set_bit(R1BIO_BehindIO, &r1_bio->state);
 
@@ -1941,74 +1962,48 @@ static sector_t raid1_size(mddev_t *mddev, sector_t sectors, int raid_disks)
 	return mddev->dev_sectors;
 }
 
-static int run(mddev_t *mddev)
+static conf_t *setup_conf(mddev_t *mddev)
 {
 	conf_t *conf;
-	int i, j, disk_idx;
+	int i;
 	mirror_info_t *disk;
 	mdk_rdev_t *rdev;
+	int err = -ENOMEM;
 
-	if (mddev->level != 1) {
-		printk("raid1: %s: raid level not set to mirroring (%d)\n",
-		       mdname(mddev), mddev->level);
-		goto out;
-	}
-	if (mddev->reshape_position != MaxSector) {
-		printk("raid1: %s: reshape_position set but not supported\n",
-		       mdname(mddev));
-		goto out;
-	}
-	/*
-	 * copy the already verified devices into our private RAID1
-	 * bookkeeping area. [whatever we allocate in run(),
-	 * should be freed in stop()]
-	 */
 	conf = kzalloc(sizeof(conf_t), GFP_KERNEL);
-	mddev->private = conf;
 	if (!conf)
-		goto out_no_mem;
+		goto abort;
 
 	conf->mirrors = kzalloc(sizeof(struct mirror_info)*mddev->raid_disks,
 				 GFP_KERNEL);
 	if (!conf->mirrors)
-		goto out_no_mem;
+		goto abort;
 
 	conf->tmppage = alloc_page(GFP_KERNEL);
 	if (!conf->tmppage)
-		goto out_no_mem;
+		goto abort;
 
-	conf->poolinfo = kmalloc(sizeof(*conf->poolinfo), GFP_KERNEL);
+	conf->poolinfo = kzalloc(sizeof(*conf->poolinfo), GFP_KERNEL);
 	if (!conf->poolinfo)
-		goto out_no_mem;
-	conf->poolinfo->mddev = NULL;
+		goto abort;
 	conf->poolinfo->raid_disks = mddev->raid_disks;
 	conf->r1bio_pool = mempool_create(NR_RAID1_BIOS, r1bio_pool_alloc,
 					  r1bio_pool_free,
 					  conf->poolinfo);
 	if (!conf->r1bio_pool)
-		goto out_no_mem;
+		goto abort;
+
 	conf->poolinfo->mddev = mddev;
 
 	spin_lock_init(&conf->device_lock);
-	mddev->queue->queue_lock = &conf->device_lock;
-
 	list_for_each_entry(rdev, &mddev->disks, same_set) {
-		disk_idx = rdev->raid_disk;
+		int disk_idx = rdev->raid_disk;
 		if (disk_idx >= mddev->raid_disks
 		    || disk_idx < 0)
 			continue;
 		disk = conf->mirrors + disk_idx;
 
 		disk->rdev = rdev;
-		disk_stack_limits(mddev->gendisk, rdev->bdev,
-				  rdev->data_offset << 9);
-		/* as we don't honour merge_bvec_fn, we must never risk
-		 * violating it, so limit ->max_sector to one PAGE, as
-		 * a one page request is never in violation.
-		 */
-		if (rdev->bdev->bd_disk->queue->merge_bvec_fn &&
-		    queue_max_sectors(mddev->queue) > (PAGE_SIZE>>9))
-			blk_queue_max_sectors(mddev->queue, PAGE_SIZE>>9);
 
 		disk->head_position = 0;
 	}
@@ -2022,8 +2017,7 @@ static int run(mddev_t *mddev)
 	bio_list_init(&conf->pending_bio_list);
 	bio_list_init(&conf->flushing_bio_list);
 
-
-	mddev->degraded = 0;
+	conf->last_used = -1;
 	for (i = 0; i < conf->raid_disks; i++) {
 
 		disk = conf->mirrors + i;
@@ -2031,38 +2025,97 @@ static int run(mddev_t *mddev)
 		if (!disk->rdev ||
 		    !test_bit(In_sync, &disk->rdev->flags)) {
 			disk->head_position = 0;
-			mddev->degraded++;
 			if (disk->rdev)
 				conf->fullsync = 1;
-		}
+		} else if (conf->last_used < 0)
+			/*
+			 * The first working device is used as a
+			 * starting point to read balancing.
+			 */
+			conf->last_used = i;
 	}
-	if (mddev->degraded == conf->raid_disks) {
+
+	err = -EIO;
+	if (conf->last_used < 0) {
 		printk(KERN_ERR "raid1: no operational mirrors for %s\n",
-			mdname(mddev));
-		goto out_free_conf;
+		       mdname(mddev));
+		goto abort;
 	}
-	if (conf->raid_disks - mddev->degraded == 1)
-		mddev->recovery_cp = MaxSector;
+	err = -ENOMEM;
+	conf->thread = md_register_thread(raid1d, mddev, NULL);
+	if (!conf->thread) {
+		printk(KERN_ERR
+		       "raid1: couldn't allocate thread for %s\n",
+		       mdname(mddev));
+		goto abort;
+	}
+
+	return conf;
+
+ abort:
+	if (conf) {
+		if (conf->r1bio_pool)
+			mempool_destroy(conf->r1bio_pool);
+		kfree(conf->mirrors);
+		safe_put_page(conf->tmppage);
+		kfree(conf->poolinfo);
+		kfree(conf);
+	}
+	return ERR_PTR(err);
+}
 
+static int run(mddev_t *mddev)
+{
+	conf_t *conf;
+	int i;
+	mdk_rdev_t *rdev;
+
+	if (mddev->level != 1) {
+		printk("raid1: %s: raid level not set to mirroring (%d)\n",
+		       mdname(mddev), mddev->level);
+		return -EIO;
+	}
+	if (mddev->reshape_position != MaxSector) {
+		printk("raid1: %s: reshape_position set but not supported\n",
+		       mdname(mddev));
+		return -EIO;
+	}
 	/*
-	 * find the first working one and use it as a starting point
-	 * to read balancing.
+	 * copy the already verified devices into our private RAID1
+	 * bookkeeping area. [whatever we allocate in run(),
+	 * should be freed in stop()]
 	 */
-	for (j = 0; j < conf->raid_disks &&
-		     (!conf->mirrors[j].rdev ||
-		      !test_bit(In_sync, &conf->mirrors[j].rdev->flags)) ; j++)
-		/* nothing */;
-	conf->last_used = j;
+	if (mddev->private == NULL)
+		conf = setup_conf(mddev);
+	else
+		conf = mddev->private;
 
+	if (IS_ERR(conf))
+		return PTR_ERR(conf);
 
-	mddev->thread = md_register_thread(raid1d, mddev, NULL);
-	if (!mddev->thread) {
-		printk(KERN_ERR
-		       "raid1: couldn't allocate thread for %s\n",
-		       mdname(mddev));
-		goto out_free_conf;
+	mddev->queue->queue_lock = &conf->device_lock;
+	list_for_each_entry(rdev, &mddev->disks, same_set) {
+		disk_stack_limits(mddev->gendisk, rdev->bdev,
+				  rdev->data_offset << 9);
+		/* as we don't honour merge_bvec_fn, we must never risk
+		 * violating it, so limit ->max_sector to one PAGE, as
+		 * a one page request is never in violation.
+		 */
+		if (rdev->bdev->bd_disk->queue->merge_bvec_fn &&
+		    queue_max_sectors(mddev->queue) > (PAGE_SIZE>>9))
+			blk_queue_max_sectors(mddev->queue, PAGE_SIZE>>9);
 	}
 
+	mddev->degraded = 0;
+	for (i=0; i < conf->raid_disks; i++)
+		if (conf->mirrors[i].rdev == NULL ||
+		    !test_bit(In_sync, &conf->mirrors[i].rdev->flags) ||
+		    test_bit(Faulty, &conf->mirrors[i].rdev->flags))
+			mddev->degraded++;
+
+	if (conf->raid_disks - mddev->degraded == 1)
+		mddev->recovery_cp = MaxSector;
+
 	if (mddev->recovery_cp != MaxSector)
 		printk(KERN_NOTICE "raid1: %s is not clean"
 		       " -- starting background reconstruction\n",
@@ -2071,9 +2124,14 @@ static int run(mddev_t *mddev)
 		"raid1: raid set %s active with %d out of %d mirrors\n",
 		mdname(mddev), mddev->raid_disks - mddev->degraded, 
 		mddev->raid_disks);
+
 	/*
 	 * Ok, everything is just fine now
 	 */
+	mddev->thread = conf->thread;
+	conf->thread = NULL;
+	mddev->private = conf;
+
 	md_set_array_sectors(mddev, raid1_size(mddev, 0, 0));
 
 	mddev->queue->unplug_fn = raid1_unplug;
@@ -2081,23 +2139,6 @@ static int run(mddev_t *mddev)
 	mddev->queue->backing_dev_info.congested_data = mddev;
 	md_integrity_register(mddev);
 	return 0;
-
-out_no_mem:
-	printk(KERN_ERR "raid1: couldn't allocate memory for %s\n",
-	       mdname(mddev));
-
-out_free_conf:
-	if (conf) {
-		if (conf->r1bio_pool)
-			mempool_destroy(conf->r1bio_pool);
-		kfree(conf->mirrors);
-		safe_put_page(conf->tmppage);
-		kfree(conf->poolinfo);
-		kfree(conf);
-		mddev->private = NULL;
-	}
-out:
-	return -EIO;
 }
 
 static int stop(mddev_t *mddev)
@@ -2271,6 +2312,9 @@ static void raid1_quiesce(mddev_t *mddev, int state)
 	conf_t *conf = mddev->private;
 
 	switch(state) {
+	case 2: /* wake for suspend */
+		wake_up(&conf->wait_barrier);
+		break;
 	case 1:
 		raise_barrier(conf);
 		break;
@@ -2280,6 +2324,23 @@ static void raid1_quiesce(mddev_t *mddev, int state)
 	}
 }
 
+static void *raid1_takeover(mddev_t *mddev)
+{
+	/* raid1 can take over:
+	 *  raid5 with 2 devices, any layout or chunk size
+	 */
+	if (mddev->level == 5 && mddev->raid_disks == 2) {
+		conf_t *conf;
+		mddev->new_level = 1;
+		mddev->new_layout = 0;
+		mddev->new_chunk_sectors = 0;
+		conf = setup_conf(mddev);
+		if (!IS_ERR(conf))
+			conf->barrier = 1;
+		return conf;
+	}
+	return ERR_PTR(-EINVAL);
+}
 
 static struct mdk_personality raid1_personality =
 {
@@ -2299,6 +2360,7 @@ static struct mdk_personality raid1_personality =
 	.size		= raid1_size,
 	.check_reshape	= raid1_reshape,
 	.quiesce	= raid1_quiesce,
+	.takeover	= raid1_takeover,
 };
 
 static int __init raid_init(void)
@@ -2314,6 +2376,7 @@ static void raid_exit(void)
 module_init(raid_init);
 module_exit(raid_exit);
 MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("RAID1 (mirroring) personality for MD");
 MODULE_ALIAS("md-personality-3"); /* RAID1 */
 MODULE_ALIAS("md-raid1");
 MODULE_ALIAS("md-level-1");
diff --git a/drivers/md/raid1.h b/drivers/md/raid1.h
index e87b84deff68..5f2d443ae28a 100644
--- a/drivers/md/raid1.h
+++ b/drivers/md/raid1.h
@@ -59,6 +59,11 @@ struct r1_private_data_s {
 
 	mempool_t *r1bio_pool;
 	mempool_t *r1buf_pool;
+
+	/* When taking over an array from a different personality, we store
+	 * the new thread here until we fully activate the array.
+	 */
+	struct mdk_thread_s	*thread;
 };
 
 typedef struct r1_private_data_s conf_t;
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index c2cb7b87b440..d119b7b75e71 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -804,7 +804,7 @@ static int make_request(struct request_queue *q, struct bio * bio)
 	mdk_rdev_t *blocked_rdev;
 
 	if (unlikely(bio_rw_flagged(bio, BIO_RW_BARRIER))) {
-		bio_endio(bio, -EOPNOTSUPP);
+		md_barrier_request(mddev, bio);
 		return 0;
 	}
 
@@ -1432,6 +1432,43 @@ static void recovery_request_write(mddev_t *mddev, r10bio_t *r10_bio)
 
 
 /*
+ * Used by fix_read_error() to decay the per rdev read_errors.
+ * We halve the read error count for every hour that has elapsed
+ * since the last recorded read error.
+ *
+ */
+static void check_decay_read_errors(mddev_t *mddev, mdk_rdev_t *rdev)
+{
+	struct timespec cur_time_mon;
+	unsigned long hours_since_last;
+	unsigned int read_errors = atomic_read(&rdev->read_errors);
+
+	ktime_get_ts(&cur_time_mon);
+
+	if (rdev->last_read_error.tv_sec == 0 &&
+	    rdev->last_read_error.tv_nsec == 0) {
+		/* first time we've seen a read error */
+		rdev->last_read_error = cur_time_mon;
+		return;
+	}
+
+	hours_since_last = (cur_time_mon.tv_sec -
+			    rdev->last_read_error.tv_sec) / 3600;
+
+	rdev->last_read_error = cur_time_mon;
+
+	/*
+	 * if hours_since_last is > the number of bits in read_errors
+	 * just set read errors to 0. We do this to avoid
+	 * overflowing the shift of read_errors by hours_since_last.
+	 */
+	if (hours_since_last >= 8 * sizeof(read_errors))
+		atomic_set(&rdev->read_errors, 0);
+	else
+		atomic_set(&rdev->read_errors, read_errors >> hours_since_last);
+}
+
+/*
  * This is a kernel thread which:
  *
  *	1.	Retries failed read operations on working mirrors.
@@ -1444,6 +1481,43 @@ static void fix_read_error(conf_t *conf, mddev_t *mddev, r10bio_t *r10_bio)
 	int sect = 0; /* Offset from r10_bio->sector */
 	int sectors = r10_bio->sectors;
 	mdk_rdev_t*rdev;
+	int max_read_errors = atomic_read(&mddev->max_corr_read_errors);
+
+	rcu_read_lock();
+	{
+		int d = r10_bio->devs[r10_bio->read_slot].devnum;
+		char b[BDEVNAME_SIZE];
+		int cur_read_error_count = 0;
+
+		rdev = rcu_dereference(conf->mirrors[d].rdev);
+		bdevname(rdev->bdev, b);
+
+		if (test_bit(Faulty, &rdev->flags)) {
+			rcu_read_unlock();
+			/* drive has already been failed, just ignore any
+			   more fix_read_error() attempts */
+			return;
+		}
+
+		check_decay_read_errors(mddev, rdev);
+		atomic_inc(&rdev->read_errors);
+		cur_read_error_count = atomic_read(&rdev->read_errors);
+		if (cur_read_error_count > max_read_errors) {
+			rcu_read_unlock();
+			printk(KERN_NOTICE
+			       "raid10: %s: Raid device exceeded "
+			       "read_error threshold "
+			       "[cur %d:max %d]\n",
+			       b, cur_read_error_count, max_read_errors);
+			printk(KERN_NOTICE
+			       "raid10: %s: Failing raid "
+			       "device\n", b);
+			md_error(mddev, conf->mirrors[d].rdev);
+			return;
+		}
+	}
+	rcu_read_unlock();
+
 	while(sectors) {
 		int s = sectors;
 		int sl = r10_bio->read_slot;
@@ -1488,6 +1562,7 @@ static void fix_read_error(conf_t *conf, mddev_t *mddev, r10bio_t *r10_bio)
 		/* write it back and re-read */
 		rcu_read_lock();
 		while (sl != r10_bio->read_slot) {
+			char b[BDEVNAME_SIZE];
 			int d;
 			if (sl==0)
 				sl = conf->copies;
@@ -1503,9 +1578,21 @@ static void fix_read_error(conf_t *conf, mddev_t *mddev, r10bio_t *r10_bio)
 						 r10_bio->devs[sl].addr +
 						 sect + rdev->data_offset,
 						 s<<9, conf->tmppage, WRITE)
-				    == 0)
+				    == 0) {
 					/* Well, this device is dead */
+					printk(KERN_NOTICE
+					       "raid10:%s: read correction "
+					       "write failed"
+					       " (%d sectors at %llu on %s)\n",
+					       mdname(mddev), s,
+					       (unsigned long long)(sect+
+					       rdev->data_offset),
+					       bdevname(rdev->bdev, b));
+					printk(KERN_NOTICE "raid10:%s: failing "
+					       "drive\n",
+					       bdevname(rdev->bdev, b));
 					md_error(mddev, rdev);
+				}
 				rdev_dec_pending(rdev, mddev);
 				rcu_read_lock();
 			}
@@ -1526,10 +1613,22 @@ static void fix_read_error(conf_t *conf, mddev_t *mddev, r10bio_t *r10_bio)
 				if (sync_page_io(rdev->bdev,
 						 r10_bio->devs[sl].addr +
 						 sect + rdev->data_offset,
-						 s<<9, conf->tmppage, READ) == 0)
+						 s<<9, conf->tmppage,
+						 READ) == 0) {
 					/* Well, this device is dead */
+					printk(KERN_NOTICE
+					       "raid10:%s: unable to read back "
+					       "corrected sectors"
+					       " (%d sectors at %llu on %s)\n",
+					       mdname(mddev), s,
+					       (unsigned long long)(sect+
+						    rdev->data_offset),
+					       bdevname(rdev->bdev, b));
+					printk(KERN_NOTICE "raid10:%s: failing drive\n",
+					       bdevname(rdev->bdev, b));
+
 					md_error(mddev, rdev);
-				else
+				} else {
 					printk(KERN_INFO
 					       "raid10:%s: read error corrected"
 					       " (%d sectors at %llu on %s)\n",
@@ -1537,6 +1636,7 @@ static void fix_read_error(conf_t *conf, mddev_t *mddev, r10bio_t *r10_bio)
 					       (unsigned long long)(sect+
 					            rdev->data_offset),
 					       bdevname(rdev->bdev, b));
+				}
 
 				rdev_dec_pending(rdev, mddev);
 				rcu_read_lock();
@@ -2275,13 +2375,6 @@ static void raid10_quiesce(mddev_t *mddev, int state)
 		lower_barrier(conf);
 		break;
 	}
-	if (mddev->thread) {
-		if (mddev->bitmap)
-			mddev->thread->timeout = mddev->bitmap->daemon_sleep * HZ;
-		else
-			mddev->thread->timeout = MAX_SCHEDULE_TIMEOUT;
-		md_wakeup_thread(mddev->thread);
-	}
 }
 
 static struct mdk_personality raid10_personality =
@@ -2315,6 +2408,7 @@ static void raid_exit(void)
 module_init(raid_init);
 module_exit(raid_exit);
 MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("RAID10 (striped mirror) personality for MD");
 MODULE_ALIAS("md-personality-9"); /* RAID10 */
 MODULE_ALIAS("md-raid10");
 MODULE_ALIAS("md-level-10");
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index d29215d966da..e84204eb12df 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -2947,6 +2947,7 @@ static void handle_stripe5(struct stripe_head *sh)
 	struct r5dev *dev;
 	mdk_rdev_t *blocked_rdev = NULL;
 	int prexor;
+	int dec_preread_active = 0;
 
 	memset(&s, 0, sizeof(s));
 	pr_debug("handling stripe %llu, state=%#lx cnt=%d, pd_idx=%d check:%d "
@@ -3096,12 +3097,8 @@ static void handle_stripe5(struct stripe_head *sh)
 					set_bit(STRIPE_INSYNC, &sh->state);
 			}
 		}
-		if (test_and_clear_bit(STRIPE_PREREAD_ACTIVE, &sh->state)) {
-			atomic_dec(&conf->preread_active_stripes);
-			if (atomic_read(&conf->preread_active_stripes) <
-				IO_THRESHOLD)
-				md_wakeup_thread(conf->mddev->thread);
-		}
+		if (test_and_clear_bit(STRIPE_PREREAD_ACTIVE, &sh->state))
+			dec_preread_active = 1;
 	}
 
 	/* Now to consider new write requests and what else, if anything
@@ -3208,6 +3205,16 @@ static void handle_stripe5(struct stripe_head *sh)
 
 	ops_run_io(sh, &s);
 
+	if (dec_preread_active) {
+		/* We delay this until after ops_run_io so that if make_request
+		 * is waiting on a barrier, it won't continue until the writes
+		 * have actually been submitted.
+		 */
+		atomic_dec(&conf->preread_active_stripes);
+		if (atomic_read(&conf->preread_active_stripes) <
+		    IO_THRESHOLD)
+			md_wakeup_thread(conf->mddev->thread);
+	}
 	return_io(return_bi);
 }
 
@@ -3221,6 +3228,7 @@ static void handle_stripe6(struct stripe_head *sh)
 	struct r6_state r6s;
 	struct r5dev *dev, *pdev, *qdev;
 	mdk_rdev_t *blocked_rdev = NULL;
+	int dec_preread_active = 0;
 
 	pr_debug("handling stripe %llu, state=%#lx cnt=%d, "
 		"pd_idx=%d, qd_idx=%d\n, check:%d, reconstruct:%d\n",
@@ -3358,7 +3366,6 @@ static void handle_stripe6(struct stripe_head *sh)
 	 * completed
 	 */
 	if (sh->reconstruct_state == reconstruct_state_drain_result) {
-		int qd_idx = sh->qd_idx;
 
 		sh->reconstruct_state = reconstruct_state_idle;
 		/* All the 'written' buffers and the parity blocks are ready to
@@ -3380,12 +3387,8 @@ static void handle_stripe6(struct stripe_head *sh)
 					set_bit(STRIPE_INSYNC, &sh->state);
 			}
 		}
-		if (test_and_clear_bit(STRIPE_PREREAD_ACTIVE, &sh->state)) {
-			atomic_dec(&conf->preread_active_stripes);
-			if (atomic_read(&conf->preread_active_stripes) <
-				IO_THRESHOLD)
-				md_wakeup_thread(conf->mddev->thread);
-		}
+		if (test_and_clear_bit(STRIPE_PREREAD_ACTIVE, &sh->state))
+			dec_preread_active = 1;
 	}
 
 	/* Now to consider new write requests and what else, if anything
@@ -3494,6 +3497,18 @@ static void handle_stripe6(struct stripe_head *sh)
 
 	ops_run_io(sh, &s);
 
+
+	if (dec_preread_active) {
+		/* We delay this until after ops_run_io so that if make_request
+		 * is waiting on a barrier, it won't continue until the writes
+		 * have actually been submitted.
+		 */
+		atomic_dec(&conf->preread_active_stripes);
+		if (atomic_read(&conf->preread_active_stripes) <
+		    IO_THRESHOLD)
+			md_wakeup_thread(conf->mddev->thread);
+	}
+
 	return_io(return_bi);
 }
 
@@ -3741,7 +3756,7 @@ static int chunk_aligned_read(struct request_queue *q, struct bio * raid_bio)
 {
 	mddev_t *mddev = q->queuedata;
 	raid5_conf_t *conf = mddev->private;
-	unsigned int dd_idx;
+	int dd_idx;
 	struct bio* align_bi;
 	mdk_rdev_t *rdev;
 
@@ -3866,7 +3881,13 @@ static int make_request(struct request_queue *q, struct bio * bi)
 	int cpu, remaining;
 
 	if (unlikely(bio_rw_flagged(bi, BIO_RW_BARRIER))) {
-		bio_endio(bi, -EOPNOTSUPP);
+		/* Drain all pending writes.  We only really need
+		 * to ensure they have been submitted, but this is
+		 * easier.
+		 */
+		mddev->pers->quiesce(mddev, 1);
+		mddev->pers->quiesce(mddev, 0);
+		md_barrier_request(mddev, bi);
 		return 0;
 	}
 
@@ -3990,6 +4011,9 @@ static int make_request(struct request_queue *q, struct bio * bi)
 			finish_wait(&conf->wait_for_overlap, &w);
 			set_bit(STRIPE_HANDLE, &sh->state);
 			clear_bit(STRIPE_DELAYED, &sh->state);
+			if (mddev->barrier && 
+			    !test_and_set_bit(STRIPE_PREREAD_ACTIVE, &sh->state))
+				atomic_inc(&conf->preread_active_stripes);
 			release_stripe(sh);
 		} else {
 			/* cannot get stripe for read-ahead, just give-up */
@@ -4009,6 +4033,14 @@ static int make_request(struct request_queue *q, struct bio * bi)
 
 		bio_endio(bi, 0);
 	}
+
+	if (mddev->barrier) {
+		/* We need to wait for the stripes to all be handled.
+		 * So: wait for preread_active_stripes to drop to 0.
+		 */
+		wait_event(mddev->thread->wqueue,
+			   atomic_read(&conf->preread_active_stripes) == 0);
+	}
 	return 0;
 }
 
@@ -5860,6 +5892,7 @@ static void raid5_exit(void)
 module_init(raid5_init);
 module_exit(raid5_exit);
 MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("RAID4/5/6 (striping with parity) personality for MD");
 MODULE_ALIAS("md-personality-4"); /* RAID5 */
 MODULE_ALIAS("md-raid5");
 MODULE_ALIAS("md-raid4");
diff --git a/drivers/md/raid6algos.c b/drivers/md/raid6algos.c
index 866215ac7f25..bffc61bff5ab 100644
--- a/drivers/md/raid6algos.c
+++ b/drivers/md/raid6algos.c
@@ -31,25 +31,6 @@ EXPORT_SYMBOL(raid6_empty_zero_page);
 struct raid6_calls raid6_call;
 EXPORT_SYMBOL_GPL(raid6_call);
 
-/* Various routine sets */
-extern const struct raid6_calls raid6_intx1;
-extern const struct raid6_calls raid6_intx2;
-extern const struct raid6_calls raid6_intx4;
-extern const struct raid6_calls raid6_intx8;
-extern const struct raid6_calls raid6_intx16;
-extern const struct raid6_calls raid6_intx32;
-extern const struct raid6_calls raid6_mmxx1;
-extern const struct raid6_calls raid6_mmxx2;
-extern const struct raid6_calls raid6_sse1x1;
-extern const struct raid6_calls raid6_sse1x2;
-extern const struct raid6_calls raid6_sse2x1;
-extern const struct raid6_calls raid6_sse2x2;
-extern const struct raid6_calls raid6_sse2x4;
-extern const struct raid6_calls raid6_altivec1;
-extern const struct raid6_calls raid6_altivec2;
-extern const struct raid6_calls raid6_altivec4;
-extern const struct raid6_calls raid6_altivec8;
-
 const struct raid6_calls * const raid6_algos[] = {
 	&raid6_intx1,
 	&raid6_intx2,
@@ -169,3 +150,4 @@ static void raid6_exit(void)
 subsys_initcall(raid6_select_algo);
 module_exit(raid6_exit);
 MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("RAID6 Q-syndrome calculations");
diff --git a/drivers/media/IR/Kconfig b/drivers/media/IR/Kconfig
new file mode 100644
index 000000000000..4dde7d180a32
--- /dev/null
+++ b/drivers/media/IR/Kconfig
@@ -0,0 +1,9 @@
+config IR_CORE
+	tristate
+	depends on INPUT
+	default INPUT
+
+config VIDEO_IR
+	tristate
+	depends on IR_CORE
+	default IR_CORE
diff --git a/drivers/media/IR/Makefile b/drivers/media/IR/Makefile
new file mode 100644
index 000000000000..df5ddb4bbbf7
--- /dev/null
+++ b/drivers/media/IR/Makefile
@@ -0,0 +1,5 @@
+ir-common-objs  := ir-functions.o ir-keymaps.o
+ir-core-objs	:= ir-keytable.o
+
+obj-$(CONFIG_IR_CORE) += ir-core.o
+obj-$(CONFIG_VIDEO_IR) += ir-common.o
diff --git a/drivers/media/common/ir-functions.c b/drivers/media/IR/ir-functions.c
index abd4791acb0e..776a136616d6 100644
--- a/drivers/media/common/ir-functions.c
+++ b/drivers/media/IR/ir-functions.c
@@ -34,22 +34,16 @@ static int repeat = 1;
 module_param(repeat, int, 0444);
 MODULE_PARM_DESC(repeat,"auto-repeat for IR keys (default: on)");
 
-static int debug;    /* debug level (0,1,2) */
-module_param(debug, int, 0644);
-
-#define dprintk(level, fmt, arg...)	if (debug >= level) \
-	printk(KERN_DEBUG fmt , ## arg)
-
 /* -------------------------------------------------------------------------- */
 
 static void ir_input_key_event(struct input_dev *dev, struct ir_input_state *ir)
 {
 	if (KEY_RESERVED == ir->keycode) {
-		printk(KERN_INFO "%s: unknown key: key=0x%02x raw=0x%02x down=%d\n",
-		       dev->name,ir->ir_key,ir->ir_raw,ir->keypressed);
+		printk(KERN_INFO "%s: unknown key: key=0x%02x down=%d\n",
+		       dev->name, ir->ir_key, ir->keypressed);
 		return;
 	}
-	dprintk(1,"%s: key event code=%d down=%d\n",
+	IR_dprintk(1,"%s: key event code=%d down=%d\n",
 		dev->name,ir->keycode,ir->keypressed);
 	input_report_key(dev,ir->keycode,ir->keypressed);
 	input_sync(dev);
@@ -57,39 +51,19 @@ static void ir_input_key_event(struct input_dev *dev, struct ir_input_state *ir)
 
 /* -------------------------------------------------------------------------- */
 
-void ir_input_init(struct input_dev *dev, struct ir_input_state *ir,
-		   int ir_type, struct ir_scancode_table *ir_codes)
+int ir_input_init(struct input_dev *dev, struct ir_input_state *ir,
+		   int ir_type)
 {
-	int i;
-
 	ir->ir_type = ir_type;
 
-	memset(ir->ir_codes, 0, sizeof(ir->ir_codes));
-
-	/*
-	 * FIXME: This is a temporary workaround to use the new IR tables
-	 * with the old approach. Later patches will replace this to a
-	 * proper method
-	 */
-
-	if (ir_codes)
-		for (i = 0; i < ir_codes->size; i++)
-			if (ir_codes->scan[i].scancode < IR_KEYTAB_SIZE)
-				ir->ir_codes[ir_codes->scan[i].scancode] = ir_codes->scan[i].keycode;
-
-	dev->keycode     = ir->ir_codes;
-	dev->keycodesize = sizeof(IR_KEYTAB_TYPE);
-	dev->keycodemax  = IR_KEYTAB_SIZE;
-	for (i = 0; i < IR_KEYTAB_SIZE; i++)
-		set_bit(ir->ir_codes[i], dev->keybit);
-	clear_bit(0, dev->keybit);
-
-	set_bit(EV_KEY, dev->evbit);
 	if (repeat)
 		set_bit(EV_REP, dev->evbit);
+
+	return 0;
 }
 EXPORT_SYMBOL_GPL(ir_input_init);
 
+
 void ir_input_nokey(struct input_dev *dev, struct ir_input_state *ir)
 {
 	if (ir->keypressed) {
@@ -100,9 +74,9 @@ void ir_input_nokey(struct input_dev *dev, struct ir_input_state *ir)
 EXPORT_SYMBOL_GPL(ir_input_nokey);
 
 void ir_input_keydown(struct input_dev *dev, struct ir_input_state *ir,
-		      u32 ir_key, u32 ir_raw)
+		      u32 ir_key)
 {
-	u32 keycode = IR_KEYCODE(ir->ir_codes, ir_key);
+	u32 keycode = ir_g_keycode_from_table(dev, ir_key);
 
 	if (ir->keypressed && ir->keycode != keycode) {
 		ir->keypressed = 0;
@@ -110,7 +84,6 @@ void ir_input_keydown(struct input_dev *dev, struct ir_input_state *ir,
 	}
 	if (!ir->keypressed) {
 		ir->ir_key  = ir_key;
-		ir->ir_raw  = ir_raw;
 		ir->keycode = keycode;
 		ir->keypressed = 1;
 		ir_input_key_event(dev,ir);
@@ -275,7 +248,7 @@ EXPORT_SYMBOL_GPL(ir_decode_biphase);
  * saa7134 */
 
 /* decode raw bit pattern to RC5 code */
-static u32 ir_rc5_decode(unsigned int code)
+u32 ir_rc5_decode(unsigned int code)
 {
 	unsigned int org_code = code;
 	unsigned int pair;
@@ -295,15 +268,16 @@ static u32 ir_rc5_decode(unsigned int code)
 			rc5 |= 1;
 			break;
 		case 3:
-			dprintk(1, "ir-common: ir_rc5_decode(%x) bad code\n", org_code);
+			IR_dprintk(1, "ir-common: ir_rc5_decode(%x) bad code\n", org_code);
 			return 0;
 		}
 	}
-	dprintk(1, "ir-common: code=%x, rc5=%x, start=%x, toggle=%x, address=%x, "
+	IR_dprintk(1, "ir-common: code=%x, rc5=%x, start=%x, toggle=%x, address=%x, "
 		"instr=%x\n", rc5, org_code, RC5_START(rc5),
 		RC5_TOGGLE(rc5), RC5_ADDR(rc5), RC5_INSTR(rc5));
 	return rc5;
 }
+EXPORT_SYMBOL_GPL(ir_rc5_decode);
 
 void ir_rc5_timer_end(unsigned long data)
 {
@@ -330,20 +304,20 @@ void ir_rc5_timer_end(unsigned long data)
 
 	/* Allow some timer jitter (RC5 is ~24ms anyway so this is ok) */
 	if (gap < 28000) {
-		dprintk(1, "ir-common: spurious timer_end\n");
+		IR_dprintk(1, "ir-common: spurious timer_end\n");
 		return;
 	}
 
 	if (ir->last_bit < 20) {
 		/* ignore spurious codes (caused by light/other remotes) */
-		dprintk(1, "ir-common: short code: %x\n", ir->code);
+		IR_dprintk(1, "ir-common: short code: %x\n", ir->code);
 	} else {
 		ir->code = (ir->code << ir->shift_by) | 1;
 		rc5 = ir_rc5_decode(ir->code);
 
 		/* two start bits? */
 		if (RC5_START(rc5) != ir->start) {
-			dprintk(1, "ir-common: rc5 start bits invalid: %u\n", RC5_START(rc5));
+			IR_dprintk(1, "ir-common: rc5 start bits invalid: %u\n", RC5_START(rc5));
 
 			/* right address? */
 		} else if (RC5_ADDR(rc5) == ir->addr) {
@@ -353,11 +327,10 @@ void ir_rc5_timer_end(unsigned long data)
 			/* Good code, decide if repeat/repress */
 			if (toggle != RC5_TOGGLE(ir->last_rc5) ||
 			    instr != RC5_INSTR(ir->last_rc5)) {
-				dprintk(1, "ir-common: instruction %x, toggle %x\n", instr,
+				IR_dprintk(1, "ir-common: instruction %x, toggle %x\n", instr,
 					toggle);
 				ir_input_nokey(ir->dev, &ir->ir);
-				ir_input_keydown(ir->dev, &ir->ir, instr,
-						 instr);
+				ir_input_keydown(ir->dev, &ir->ir, instr);
 			}
 
 			/* Set/reset key-up timer */
@@ -376,7 +349,7 @@ void ir_rc5_timer_keyup(unsigned long data)
 {
 	struct card_ir *ir = (struct card_ir *)data;
 
-	dprintk(1, "ir-common: key released\n");
+	IR_dprintk(1, "ir-common: key released\n");
 	ir_input_nokey(ir->dev, &ir->ir);
 }
 EXPORT_SYMBOL_GPL(ir_rc5_timer_keyup);
diff --git a/drivers/media/common/ir-keymaps.c b/drivers/media/IR/ir-keymaps.c
index f6790172736a..9bbe6b1e9871 100644
--- a/drivers/media/common/ir-keymaps.c
+++ b/drivers/media/IR/ir-keymaps.c
@@ -1705,6 +1705,7 @@ static struct ir_scancode ir_codes_winfast[] = {
 	{ 0x37, KEY_RADIO },		/* FM */
 	{ 0x38, KEY_DVD },
 
+	{ 0x1a, KEY_MODE},		/* change to MCE mode on Y04G0051 */
 	{ 0x3e, KEY_F21 },		/* MCE +VOL, on Y04G0033 */
 	{ 0x3a, KEY_F22 },		/* MCE -VOL, on Y04G0033 */
 	{ 0x3b, KEY_F23 },		/* MCE +CH,  on Y04G0033 */
@@ -2964,6 +2965,101 @@ struct ir_scancode_table ir_codes_dm1105_nec_table = {
 };
 EXPORT_SYMBOL_GPL(ir_codes_dm1105_nec_table);
 
+static struct ir_scancode ir_codes_tevii_nec[] = {
+	{ 0x0a, KEY_POWER2},
+	{ 0x0c, KEY_MUTE},
+	{ 0x11, KEY_1},
+	{ 0x12, KEY_2},
+	{ 0x13, KEY_3},
+	{ 0x14, KEY_4},
+	{ 0x15, KEY_5},
+	{ 0x16, KEY_6},
+	{ 0x17, KEY_7},
+	{ 0x18, KEY_8},
+	{ 0x19, KEY_9},
+	{ 0x10, KEY_0},
+	{ 0x1c, KEY_MENU},
+	{ 0x0f, KEY_VOLUMEDOWN},
+	{ 0x1a, KEY_LAST},
+	{ 0x0e, KEY_OPEN},
+	{ 0x04, KEY_RECORD},
+	{ 0x09, KEY_VOLUMEUP},
+	{ 0x08, KEY_CHANNELUP},
+	{ 0x07, KEY_PVR},
+	{ 0x0b, KEY_TIME},
+	{ 0x02, KEY_RIGHT},
+	{ 0x03, KEY_LEFT},
+	{ 0x00, KEY_UP},
+	{ 0x1f, KEY_OK},
+	{ 0x01, KEY_DOWN},
+	{ 0x05, KEY_TUNER},
+	{ 0x06, KEY_CHANNELDOWN},
+	{ 0x40, KEY_PLAYPAUSE},
+	{ 0x1e, KEY_REWIND},
+	{ 0x1b, KEY_FAVORITES},
+	{ 0x1d, KEY_BACK},
+	{ 0x4d, KEY_FASTFORWARD},
+	{ 0x44, KEY_EPG},
+	{ 0x4c, KEY_INFO},
+	{ 0x41, KEY_AB},
+	{ 0x43, KEY_AUDIO},
+	{ 0x45, KEY_SUBTITLE},
+	{ 0x4a, KEY_LIST},
+	{ 0x46, KEY_F1},
+	{ 0x47, KEY_F2},
+	{ 0x5e, KEY_F3},
+	{ 0x5c, KEY_F4},
+	{ 0x52, KEY_F5},
+	{ 0x5a, KEY_F6},
+	{ 0x56, KEY_MODE},
+	{ 0x58, KEY_SWITCHVIDEOMODE},
+};
+struct ir_scancode_table ir_codes_tevii_nec_table = {
+	.scan = ir_codes_tevii_nec,
+	.size = ARRAY_SIZE(ir_codes_tevii_nec),
+};
+EXPORT_SYMBOL_GPL(ir_codes_tevii_nec_table);
+
+static struct ir_scancode ir_codes_tbs_nec[] = {
+	{ 0x04, KEY_POWER2},	/*power*/
+	{ 0x14, KEY_MUTE},	/*mute*/
+	{ 0x07, KEY_1},
+	{ 0x06, KEY_2},
+	{ 0x05, KEY_3},
+	{ 0x0b, KEY_4},
+	{ 0x0a, KEY_5},
+	{ 0x09, KEY_6},
+	{ 0x0f, KEY_7},
+	{ 0x0e, KEY_8},
+	{ 0x0d, KEY_9},
+	{ 0x12, KEY_0},
+	{ 0x16, KEY_CHANNELUP},	/*ch+*/
+	{ 0x11, KEY_CHANNELDOWN},/*ch-*/
+	{ 0x13, KEY_VOLUMEUP},	/*vol+*/
+	{ 0x0c, KEY_VOLUMEDOWN},/*vol-*/
+	{ 0x03, KEY_RECORD},	/*rec*/
+	{ 0x18, KEY_PAUSE},	/*pause*/
+	{ 0x19, KEY_OK},	/*ok*/
+	{ 0x1a, KEY_CAMERA},	/* snapshot */
+	{ 0x01, KEY_UP},
+	{ 0x10, KEY_LEFT},
+	{ 0x02, KEY_RIGHT},
+	{ 0x08, KEY_DOWN},
+	{ 0x15, KEY_FAVORITES},
+	{ 0x17, KEY_SUBTITLE},
+	{ 0x1d, KEY_ZOOM},
+	{ 0x1f, KEY_EXIT},
+	{ 0x1e, KEY_MENU},
+	{ 0x1c, KEY_EPG},
+	{ 0x00, KEY_PREVIOUS},
+	{ 0x1b, KEY_MODE},
+};
+struct ir_scancode_table ir_codes_tbs_nec_table = {
+	.scan = ir_codes_tbs_nec,
+	.size = ARRAY_SIZE(ir_codes_tbs_nec),
+};
+EXPORT_SYMBOL_GPL(ir_codes_tbs_nec_table);
+
 /* Terratec Cinergy Hybrid T USB XS
    Devin Heitmueller <dheitmueller@linuxtv.org>
  */
@@ -3147,3 +3243,153 @@ struct ir_scancode_table ir_codes_gadmei_rm008z_table = {
 	.size = ARRAY_SIZE(ir_codes_gadmei_rm008z),
 };
 EXPORT_SYMBOL_GPL(ir_codes_gadmei_rm008z_table);
+
+/*************************************************************
+ *		COMPLETE SCANCODE TABLES
+ * Instead of just a partial scancode, the tables bellow
+ * contains the complete scancode and the receiver protocol
+ *************************************************************/
+
+/*
+ * Hauppauge:the newer, gray remotes (seems there are multiple
+ * slightly different versions), shipped with cx88+ivtv cards.
+ *
+ * This table contains the complete RC5 code, instead of just the data part
+ */
+static struct ir_scancode ir_codes_rc5_hauppauge_new[] = {
+	/* Keys 0 to 9 */
+	{ 0x1e00, KEY_0 },
+	{ 0x1e01, KEY_1 },
+	{ 0x1e02, KEY_2 },
+	{ 0x1e03, KEY_3 },
+	{ 0x1e04, KEY_4 },
+	{ 0x1e05, KEY_5 },
+	{ 0x1e06, KEY_6 },
+	{ 0x1e07, KEY_7 },
+	{ 0x1e08, KEY_8 },
+	{ 0x1e09, KEY_9 },
+
+	{ 0x1e0a, KEY_TEXT },		/* keypad asterisk as well */
+	{ 0x1e0b, KEY_RED },		/* red button */
+	{ 0x1e0c, KEY_RADIO },
+	{ 0x1e0d, KEY_MENU },
+	{ 0x1e0e, KEY_SUBTITLE },		/* also the # key */
+	{ 0x1e0f, KEY_MUTE },
+	{ 0x1e10, KEY_VOLUMEUP },
+	{ 0x1e11, KEY_VOLUMEDOWN },
+	{ 0x1e12, KEY_PREVIOUS },		/* previous channel */
+	{ 0x1e14, KEY_UP },
+	{ 0x1e15, KEY_DOWN },
+	{ 0x1e16, KEY_LEFT },
+	{ 0x1e17, KEY_RIGHT },
+	{ 0x1e18, KEY_VIDEO },		/* Videos */
+	{ 0x1e19, KEY_AUDIO },		/* Music */
+	/* 0x1e1a: Pictures - presume this means
+	   "Multimedia Home Platform" -
+	   no "PICTURES" key in input.h
+	 */
+	{ 0x1e1a, KEY_MHP },
+
+	{ 0x1e1b, KEY_EPG },		/* Guide */
+	{ 0x1e1c, KEY_TV },
+	{ 0x1e1e, KEY_NEXTSONG },		/* skip >| */
+	{ 0x1e1f, KEY_EXIT },		/* back/exit */
+	{ 0x1e20, KEY_CHANNELUP },	/* channel / program + */
+	{ 0x1e21, KEY_CHANNELDOWN },	/* channel / program - */
+	{ 0x1e22, KEY_CHANNEL },		/* source (old black remote) */
+	{ 0x1e24, KEY_PREVIOUSSONG },	/* replay |< */
+	{ 0x1e25, KEY_ENTER },		/* OK */
+	{ 0x1e26, KEY_SLEEP },		/* minimize (old black remote) */
+	{ 0x1e29, KEY_BLUE },		/* blue key */
+	{ 0x1e2e, KEY_GREEN },		/* green button */
+	{ 0x1e30, KEY_PAUSE },		/* pause */
+	{ 0x1e32, KEY_REWIND },		/* backward << */
+	{ 0x1e34, KEY_FASTFORWARD },	/* forward >> */
+	{ 0x1e35, KEY_PLAY },
+	{ 0x1e36, KEY_STOP },
+	{ 0x1e37, KEY_RECORD },		/* recording */
+	{ 0x1e38, KEY_YELLOW },		/* yellow key */
+	{ 0x1e3b, KEY_SELECT },		/* top right button */
+	{ 0x1e3c, KEY_ZOOM },		/* full */
+	{ 0x1e3d, KEY_POWER },		/* system power (green button) */
+};
+
+struct ir_scancode_table ir_codes_rc5_hauppauge_new_table = {
+	.scan = ir_codes_rc5_hauppauge_new,
+	.size = ARRAY_SIZE(ir_codes_rc5_hauppauge_new),
+	.ir_type = IR_TYPE_RC5,
+};
+EXPORT_SYMBOL_GPL(ir_codes_rc5_hauppauge_new_table);
+
+/* Terratec Cinergy Hybrid T USB XS FM
+   Mauro Carvalho Chehab <mchehab@redhat.com>
+ */
+static struct ir_scancode ir_codes_nec_terratec_cinergy_xs[] = {
+	{ 0x1441, KEY_HOME},
+	{ 0x1401, KEY_POWER2},
+
+	{ 0x1442, KEY_MENU},		/* DVD menu */
+	{ 0x1443, KEY_SUBTITLE},
+	{ 0x1444, KEY_TEXT},		/* Teletext */
+	{ 0x1445, KEY_DELETE},
+
+	{ 0x1402, KEY_1},
+	{ 0x1403, KEY_2},
+	{ 0x1404, KEY_3},
+	{ 0x1405, KEY_4},
+	{ 0x1406, KEY_5},
+	{ 0x1407, KEY_6},
+	{ 0x1408, KEY_7},
+	{ 0x1409, KEY_8},
+	{ 0x140a, KEY_9},
+	{ 0x140c, KEY_0},
+
+	{ 0x140b, KEY_TUNER},		/* AV */
+	{ 0x140d, KEY_MODE},		/* A.B */
+
+	{ 0x1446, KEY_TV},
+	{ 0x1447, KEY_DVD},
+	{ 0x1449, KEY_VIDEO},
+	{ 0x144a, KEY_RADIO},		/* Music */
+	{ 0x144b, KEY_CAMERA},		/* PIC */
+
+	{ 0x1410, KEY_UP},
+	{ 0x1411, KEY_LEFT},
+	{ 0x1412, KEY_OK},
+	{ 0x1413, KEY_RIGHT},
+	{ 0x1414, KEY_DOWN},
+
+	{ 0x140f, KEY_EPG},
+	{ 0x1416, KEY_INFO},
+	{ 0x144d, KEY_BACKSPACE},
+
+	{ 0x141c, KEY_VOLUMEUP},
+	{ 0x141e, KEY_VOLUMEDOWN},
+
+	{ 0x144c, KEY_PLAY},
+	{ 0x141d, KEY_MUTE},
+
+	{ 0x141b, KEY_CHANNELUP},
+	{ 0x141f, KEY_CHANNELDOWN},
+
+	{ 0x1417, KEY_RED},
+	{ 0x1418, KEY_GREEN},
+	{ 0x1419, KEY_YELLOW},
+	{ 0x141a, KEY_BLUE},
+
+	{ 0x1458, KEY_RECORD},
+	{ 0x1448, KEY_STOP},
+	{ 0x1440, KEY_PAUSE},
+
+	{ 0x1454, KEY_LAST},
+	{ 0x144e, KEY_REWIND},
+	{ 0x144f, KEY_FASTFORWARD},
+	{ 0x145c, KEY_NEXT},
+};
+struct ir_scancode_table ir_codes_nec_terratec_cinergy_xs_table = {
+	.scan = ir_codes_nec_terratec_cinergy_xs,
+	.size = ARRAY_SIZE(ir_codes_nec_terratec_cinergy_xs),
+	.ir_type = IR_TYPE_NEC,
+};
+EXPORT_SYMBOL_GPL(ir_codes_nec_terratec_cinergy_xs_table);
+
diff --git a/drivers/media/IR/ir-keytable.c b/drivers/media/IR/ir-keytable.c
new file mode 100644
index 000000000000..b521ed9d6e2e
--- /dev/null
+++ b/drivers/media/IR/ir-keytable.c
@@ -0,0 +1,485 @@
+/* ir-register.c - handle IR scancode->keycode tables
+ *
+ * Copyright (C) 2009 by Mauro Carvalho Chehab <mchehab@redhat.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation version 2 of the License.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ */
+
+
+#include <linux/input.h>
+#include <media/ir-common.h>
+
+#define IR_TAB_MIN_SIZE	32
+#define IR_TAB_MAX_SIZE	1024
+
+/**
+ * ir_seek_table() - returns the element order on the table
+ * @rc_tab:	the ir_scancode_table with the keymap to be used
+ * @scancode:	the scancode that we're seeking
+ *
+ * This routine is used by the input routines when a key is pressed at the
+ * IR. The scancode is received and needs to be converted into a keycode.
+ * If the key is not found, it returns KEY_UNKNOWN. Otherwise, returns the
+ * corresponding keycode from the table.
+ */
+static int ir_seek_table(struct ir_scancode_table *rc_tab, u32 scancode)
+{
+	int rc;
+	unsigned long flags;
+	struct ir_scancode *keymap = rc_tab->scan;
+
+	spin_lock_irqsave(&rc_tab->lock, flags);
+
+	/* FIXME: replace it by a binary search */
+
+	for (rc = 0; rc < rc_tab->size; rc++)
+		if (keymap[rc].scancode == scancode)
+			goto exit;
+
+	/* Not found */
+	rc = -EINVAL;
+
+exit:
+	spin_unlock_irqrestore(&rc_tab->lock, flags);
+	return rc;
+}
+
+/**
+ * ir_roundup_tablesize() - gets an optimum value for the table size
+ * @n_elems:		minimum number of entries to store keycodes
+ *
+ * This routine is used to choose the keycode table size.
+ *
+ * In order to have some empty space for new keycodes,
+ * and knowing in advance that kmalloc allocates only power of two
+ * segments, it optimizes the allocated space to have some spare space
+ * for those new keycodes by using the maximum number of entries that
+ * will be effectively be allocated by kmalloc.
+ * In order to reduce the quantity of table resizes, it has a minimum
+ * table size of IR_TAB_MIN_SIZE.
+ */
+int ir_roundup_tablesize(int n_elems)
+{
+	size_t size;
+
+	if (n_elems < IR_TAB_MIN_SIZE)
+		n_elems = IR_TAB_MIN_SIZE;
+
+	/*
+	 * As kmalloc only allocates sizes of power of two, get as
+	 * much entries as possible for the allocated memory segment
+	 */
+	size = roundup_pow_of_two(n_elems * sizeof(struct ir_scancode));
+	n_elems = size / sizeof(struct ir_scancode);
+
+	return n_elems;
+}
+EXPORT_SYMBOL_GPL(ir_roundup_tablesize);
+
+/**
+ * ir_copy_table() - copies a keytable, discarding the unused entries
+ * @destin:	destin table
+ * @origin:	origin table
+ *
+ * Copies all entries where the keycode is not KEY_UNKNOWN/KEY_RESERVED
+ */
+
+int ir_copy_table(struct ir_scancode_table *destin,
+		 const struct ir_scancode_table *origin)
+{
+	int i, j = 0;
+
+	for (i = 0; i < origin->size; i++) {
+		if (origin->scan[i].keycode == KEY_UNKNOWN ||
+		   origin->scan[i].keycode == KEY_RESERVED)
+			continue;
+
+		memcpy(&destin->scan[j], &origin->scan[i], sizeof(struct ir_scancode));
+		j++;
+	}
+	destin->size = j;
+
+	IR_dprintk(1, "Copied %d scancodes to the new keycode table\n", destin->size);
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(ir_copy_table);
+
+/**
+ * ir_getkeycode() - get a keycode at the evdev scancode ->keycode table
+ * @dev:	the struct input_dev device descriptor
+ * @scancode:	the desired scancode
+ * @keycode:	the keycode to be retorned.
+ *
+ * This routine is used to handle evdev EVIOCGKEY ioctl.
+ * If the key is not found, returns -EINVAL, otherwise, returns 0.
+ */
+static int ir_getkeycode(struct input_dev *dev,
+			 int scancode, int *keycode)
+{
+	int elem;
+	struct ir_input_dev *ir_dev = input_get_drvdata(dev);
+	struct ir_scancode_table *rc_tab = &ir_dev->rc_tab;
+
+	elem = ir_seek_table(rc_tab, scancode);
+	if (elem >= 0) {
+		*keycode = rc_tab->scan[elem].keycode;
+		return 0;
+	}
+
+	/*
+	 * Scancode not found and table can't be expanded
+	 */
+	if (elem < 0 && rc_tab->size == IR_TAB_MAX_SIZE)
+		return -EINVAL;
+
+	/*
+	 * If is there extra space, returns KEY_RESERVED,
+	 * otherwise, input core won't let ir_setkeycode to work
+	 */
+	*keycode = KEY_RESERVED;
+	return 0;
+}
+
+/**
+ * ir_is_resize_needed() - Check if the table needs rezise
+ * @table:		keycode table that may need to resize
+ * @n_elems:		minimum number of entries to store keycodes
+ *
+ * Considering that kmalloc uses power of two storage areas, this
+ * routine detects if the real alloced size will change. If not, it
+ * just returns without doing nothing. Otherwise, it will extend or
+ * reduce the table size to meet the new needs.
+ *
+ * It returns 0 if no resize is needed, 1 otherwise.
+ */
+static int ir_is_resize_needed(struct ir_scancode_table *table, int n_elems)
+{
+	int cur_size = ir_roundup_tablesize(table->size);
+	int new_size = ir_roundup_tablesize(n_elems);
+
+	if (cur_size == new_size)
+		return 0;
+
+	/* Resize is needed */
+	return 1;
+}
+
+/**
+ * ir_delete_key() - remove a keycode from the table
+ * @rc_tab:		keycode table
+ * @elem:		element to be removed
+ *
+ */
+static void ir_delete_key(struct ir_scancode_table *rc_tab, int elem)
+{
+	unsigned long flags = 0;
+	int newsize = rc_tab->size - 1;
+	int resize = ir_is_resize_needed(rc_tab, newsize);
+	struct ir_scancode *oldkeymap = rc_tab->scan;
+	struct ir_scancode *newkeymap;
+
+	if (resize) {
+		newkeymap = kzalloc(ir_roundup_tablesize(newsize) *
+				    sizeof(*newkeymap), GFP_ATOMIC);
+
+		/* There's no memory for resize. Keep the old table */
+		if (!newkeymap)
+			resize = 0;
+	}
+
+	if (!resize) {
+		newkeymap = oldkeymap;
+
+		/* We'll modify the live table. Lock it */
+		spin_lock_irqsave(&rc_tab->lock, flags);
+	}
+
+	/*
+	 * Copy the elements before the one that will be deleted
+	 * if (!resize), both oldkeymap and newkeymap points
+	 * to the same place, so, there's no need to copy
+	 */
+	if (resize && elem > 0)
+		memcpy(newkeymap, oldkeymap,
+		       elem * sizeof(*newkeymap));
+
+	/*
+	 * Copy the other elements overwriting the element to be removed
+	 * This operation applies to both resize and non-resize case
+	 */
+	if (elem < newsize)
+		memcpy(&newkeymap[elem], &oldkeymap[elem + 1],
+		       (newsize - elem) * sizeof(*newkeymap));
+
+	if (resize) {
+		/*
+		 * As the copy happened to a temporary table, only here
+		 * it needs to lock while replacing the table pointers
+		 * to use the new table
+		 */
+		spin_lock_irqsave(&rc_tab->lock, flags);
+		rc_tab->size = newsize;
+		rc_tab->scan = newkeymap;
+		spin_unlock_irqrestore(&rc_tab->lock, flags);
+
+		/* Frees the old keytable */
+		kfree(oldkeymap);
+	} else {
+		rc_tab->size = newsize;
+		spin_unlock_irqrestore(&rc_tab->lock, flags);
+	}
+}
+
+/**
+ * ir_insert_key() - insert a keycode at the table
+ * @rc_tab:		keycode table
+ * @scancode:	the desired scancode
+ * @keycode:	the keycode to be retorned.
+ *
+ */
+static int ir_insert_key(struct ir_scancode_table *rc_tab,
+			  int scancode, int keycode)
+{
+	unsigned long flags;
+	int elem = rc_tab->size;
+	int newsize = rc_tab->size + 1;
+	int resize = ir_is_resize_needed(rc_tab, newsize);
+	struct ir_scancode *oldkeymap = rc_tab->scan;
+	struct ir_scancode *newkeymap;
+
+	if (resize) {
+		newkeymap = kzalloc(ir_roundup_tablesize(newsize) *
+				    sizeof(*newkeymap), GFP_ATOMIC);
+		if (!newkeymap)
+			return -ENOMEM;
+
+		memcpy(newkeymap, oldkeymap,
+		       rc_tab->size * sizeof(*newkeymap));
+	} else
+		newkeymap  = oldkeymap;
+
+	/* Stores the new code at the table */
+	IR_dprintk(1, "#%d: New scan 0x%04x with key 0x%04x\n",
+		   rc_tab->size, scancode, keycode);
+
+	spin_lock_irqsave(&rc_tab->lock, flags);
+	rc_tab->size = newsize;
+	if (resize) {
+		rc_tab->scan = newkeymap;
+		kfree(oldkeymap);
+	}
+	newkeymap[elem].scancode = scancode;
+	newkeymap[elem].keycode  = keycode;
+	spin_unlock_irqrestore(&rc_tab->lock, flags);
+
+	return 0;
+}
+
+/**
+ * ir_setkeycode() - set a keycode at the evdev scancode ->keycode table
+ * @dev:	the struct input_dev device descriptor
+ * @scancode:	the desired scancode
+ * @keycode:	the keycode to be retorned.
+ *
+ * This routine is used to handle evdev EVIOCSKEY ioctl.
+ * There's one caveat here: how can we increase the size of the table?
+ * If the key is not found, returns -EINVAL, otherwise, returns 0.
+ */
+static int ir_setkeycode(struct input_dev *dev,
+			 int scancode, int keycode)
+{
+	int rc = 0;
+	struct ir_input_dev *ir_dev = input_get_drvdata(dev);
+	struct ir_scancode_table *rc_tab = &ir_dev->rc_tab;
+	struct ir_scancode *keymap = rc_tab->scan;
+	unsigned long flags;
+
+	/*
+	 * Handle keycode table deletions
+	 *
+	 * If userspace is adding a KEY_UNKNOWN or KEY_RESERVED,
+	 * deal as a trial to remove an existing scancode attribution
+	 * if table become too big, reduce it to save space
+	 */
+	if (keycode == KEY_UNKNOWN || keycode == KEY_RESERVED) {
+		rc = ir_seek_table(rc_tab, scancode);
+		if (rc < 0)
+			return 0;
+
+		IR_dprintk(1, "#%d: Deleting scan 0x%04x\n", rc, scancode);
+		clear_bit(keymap[rc].keycode, dev->keybit);
+		ir_delete_key(rc_tab, rc);
+
+		return 0;
+	}
+
+	/*
+	 * Handle keycode replacements
+	 *
+	 * If the scancode exists, just replace by the new value
+	 */
+	rc = ir_seek_table(rc_tab, scancode);
+	if (rc >= 0) {
+		IR_dprintk(1, "#%d: Replacing scan 0x%04x with key 0x%04x\n",
+			rc, scancode, keycode);
+
+		clear_bit(keymap[rc].keycode, dev->keybit);
+
+		spin_lock_irqsave(&rc_tab->lock, flags);
+		keymap[rc].keycode = keycode;
+		spin_unlock_irqrestore(&rc_tab->lock, flags);
+
+		set_bit(keycode, dev->keybit);
+
+		return 0;
+	}
+
+	/*
+	 * Handle new scancode inserts
+	 *
+	 * reallocate table if needed and insert a new keycode
+	 */
+
+	/* Avoid growing the table indefinitely */
+	if (rc_tab->size + 1 > IR_TAB_MAX_SIZE)
+		return -EINVAL;
+
+	rc = ir_insert_key(rc_tab, scancode, keycode);
+	if (rc < 0)
+		return rc;
+	set_bit(keycode, dev->keybit);
+
+	return 0;
+}
+
+/**
+ * ir_g_keycode_from_table() - gets the keycode that corresponds to a scancode
+ * @input_dev:	the struct input_dev descriptor of the device
+ * @scancode:	the scancode that we're seeking
+ *
+ * This routine is used by the input routines when a key is pressed at the
+ * IR. The scancode is received and needs to be converted into a keycode.
+ * If the key is not found, it returns KEY_UNKNOWN. Otherwise, returns the
+ * corresponding keycode from the table.
+ */
+u32 ir_g_keycode_from_table(struct input_dev *dev, u32 scancode)
+{
+	struct ir_input_dev *ir_dev = input_get_drvdata(dev);
+	struct ir_scancode_table *rc_tab = &ir_dev->rc_tab;
+	struct ir_scancode *keymap = rc_tab->scan;
+	int elem;
+
+	elem = ir_seek_table(rc_tab, scancode);
+	if (elem >= 0) {
+		IR_dprintk(1, "%s: scancode 0x%04x keycode 0x%02x\n",
+			   dev->name, scancode, keymap[elem].keycode);
+
+		return rc_tab->scan[elem].keycode;
+	}
+
+	printk(KERN_INFO "%s: unknown key for scancode 0x%04x\n",
+	       dev->name, scancode);
+
+	/* Reports userspace that an unknown keycode were got */
+	return KEY_RESERVED;
+}
+EXPORT_SYMBOL_GPL(ir_g_keycode_from_table);
+
+/**
+ * ir_input_register() - sets the IR keycode table and add the handlers
+ *			    for keymap table get/set
+ * @input_dev:	the struct input_dev descriptor of the device
+ * @rc_tab:	the struct ir_scancode_table table of scancode/keymap
+ *
+ * This routine is used to initialize the input infrastructure to work with
+ * an IR.
+ * It should be called before registering the IR device.
+ */
+int ir_input_register(struct input_dev *input_dev,
+		      struct ir_scancode_table *rc_tab)
+{
+	struct ir_input_dev *ir_dev;
+	struct ir_scancode  *keymap    = rc_tab->scan;
+	int i, rc;
+
+	if (rc_tab->scan == NULL || !rc_tab->size)
+		return -EINVAL;
+
+	ir_dev = kzalloc(sizeof(*ir_dev), GFP_KERNEL);
+	if (!ir_dev)
+		return -ENOMEM;
+
+	spin_lock_init(&rc_tab->lock);
+
+	ir_dev->rc_tab.size = ir_roundup_tablesize(rc_tab->size);
+	ir_dev->rc_tab.scan = kzalloc(ir_dev->rc_tab.size *
+				    sizeof(struct ir_scancode), GFP_KERNEL);
+	if (!ir_dev->rc_tab.scan)
+		return -ENOMEM;
+
+	IR_dprintk(1, "Allocated space for %d keycode entries (%zd bytes)\n",
+		ir_dev->rc_tab.size,
+		ir_dev->rc_tab.size * sizeof(ir_dev->rc_tab.scan));
+
+	ir_copy_table(&ir_dev->rc_tab, rc_tab);
+
+	/* set the bits for the keys */
+	IR_dprintk(1, "key map size: %d\n", rc_tab->size);
+	for (i = 0; i < rc_tab->size; i++) {
+		IR_dprintk(1, "#%d: setting bit for keycode 0x%04x\n",
+			i, keymap[i].keycode);
+		set_bit(keymap[i].keycode, input_dev->keybit);
+	}
+	clear_bit(0, input_dev->keybit);
+
+	set_bit(EV_KEY, input_dev->evbit);
+
+	input_dev->getkeycode = ir_getkeycode;
+	input_dev->setkeycode = ir_setkeycode;
+	input_set_drvdata(input_dev, ir_dev);
+
+	rc = input_register_device(input_dev);
+	if (rc < 0) {
+		kfree(rc_tab->scan);
+		kfree(ir_dev);
+		input_set_drvdata(input_dev, NULL);
+	}
+
+	return rc;
+}
+EXPORT_SYMBOL_GPL(ir_input_register);
+
+void ir_input_unregister(struct input_dev *dev)
+{
+	struct ir_input_dev *ir_dev = input_get_drvdata(dev);
+	struct ir_scancode_table *rc_tab;
+
+	if (!ir_dev)
+		return;
+
+	IR_dprintk(1, "Freed keycode table\n");
+
+	rc_tab = &ir_dev->rc_tab;
+	rc_tab->size = 0;
+	kfree(rc_tab->scan);
+	rc_tab->scan = NULL;
+
+	kfree(ir_dev);
+	input_unregister_device(dev);
+}
+EXPORT_SYMBOL_GPL(ir_input_unregister);
+
+int ir_core_debug;    /* ir_debug level (0,1,2) */
+EXPORT_SYMBOL_GPL(ir_core_debug);
+module_param_named(debug, ir_core_debug, int, 0644);
+
+MODULE_AUTHOR("Mauro Carvalho Chehab <mchehab@redhat.com>");
+MODULE_LICENSE("GPL");
diff --git a/drivers/media/Kconfig b/drivers/media/Kconfig
index ba69beeb0e21..a28541b2b1a2 100644
--- a/drivers/media/Kconfig
+++ b/drivers/media/Kconfig
@@ -99,6 +99,7 @@ config VIDEO_MEDIA
 comment "Multimedia drivers"
 
 source "drivers/media/common/Kconfig"
+source "drivers/media/IR/Kconfig"
 
 #
 # Tuner drivers for DVB and V4L
diff --git a/drivers/media/Makefile b/drivers/media/Makefile
index 09a829d8a7e7..499b0810d019 100644
--- a/drivers/media/Makefile
+++ b/drivers/media/Makefile
@@ -2,7 +2,7 @@
 # Makefile for the kernel multimedia device drivers.
 #
 
-obj-y += common/ video/
+obj-y += common/ IR/ video/
 
 obj-$(CONFIG_VIDEO_DEV) += radio/
 obj-$(CONFIG_DVB_CORE)  += dvb/
diff --git a/drivers/media/common/Makefile b/drivers/media/common/Makefile
index 351b98b9b302..e3ec9639321b 100644
--- a/drivers/media/common/Makefile
+++ b/drivers/media/common/Makefile
@@ -1,8 +1,6 @@
 saa7146-objs    := saa7146_i2c.o saa7146_core.o
 saa7146_vv-objs := saa7146_fops.o saa7146_video.o saa7146_hlp.o saa7146_vbi.o
-ir-common-objs  := ir-functions.o ir-keymaps.o
 
 obj-y += tuners/
 obj-$(CONFIG_VIDEO_SAA7146) += saa7146.o
 obj-$(CONFIG_VIDEO_SAA7146_VV) += saa7146_vv.o
-obj-$(CONFIG_VIDEO_IR) += ir-common.o
diff --git a/drivers/media/common/saa7146_fops.c b/drivers/media/common/saa7146_fops.c
index 620f655fa9c5..7364b9642d00 100644
--- a/drivers/media/common/saa7146_fops.c
+++ b/drivers/media/common/saa7146_fops.c
@@ -1,7 +1,5 @@
 #include <media/saa7146_vv.h>
 
-#define BOARD_CAN_DO_VBI(dev)   (dev->revision != 0 && dev->vv_data->vbi_minor != -1)
-
 /****************************************************************************/
 /* resource management functions, shamelessly stolen from saa7134 driver */
 
@@ -194,43 +192,24 @@ void saa7146_buffer_timeout(unsigned long data)
 
 static int fops_open(struct file *file)
 {
-	unsigned int minor = video_devdata(file)->minor;
-	struct saa7146_dev *h = NULL, *dev = NULL;
-	struct list_head *list;
+	struct video_device *vdev = video_devdata(file);
+	struct saa7146_dev *dev = video_drvdata(file);
 	struct saa7146_fh *fh = NULL;
 	int result = 0;
 
-	enum v4l2_buf_type type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
+	enum v4l2_buf_type type;
 
-	DEB_EE(("file:%p, minor:%d\n", file, minor));
+	DEB_EE(("file:%p, dev:%s\n", file, video_device_node_name(vdev)));
 
 	if (mutex_lock_interruptible(&saa7146_devices_lock))
 		return -ERESTARTSYS;
 
-	list_for_each(list,&saa7146_devices) {
-		h = list_entry(list, struct saa7146_dev, item);
-		if( NULL == h->vv_data ) {
-			DEB_D(("device %p has not registered video devices.\n",h));
-			continue;
-		}
-		DEB_D(("trying: %p @ major %d,%d\n",h,h->vv_data->video_minor,h->vv_data->vbi_minor));
-
-		if (h->vv_data->video_minor == minor) {
-			dev = h;
-		}
-		if (h->vv_data->vbi_minor == minor) {
-			type = V4L2_BUF_TYPE_VBI_CAPTURE;
-			dev = h;
-		}
-	}
-	if (NULL == dev) {
-		DEB_S(("no such video device.\n"));
-		result = -ENODEV;
-		goto out;
-	}
-
 	DEB_D(("using: %p\n",dev));
 
+	type = vdev->vfl_type == VFL_TYPE_GRABBER
+	     ? V4L2_BUF_TYPE_VIDEO_CAPTURE
+	     : V4L2_BUF_TYPE_VBI_CAPTURE;
+
 	/* check if an extension is registered */
 	if( NULL == dev->ext ) {
 		DEB_S(("no extension registered for this device.\n"));
@@ -474,9 +453,6 @@ int saa7146_vv_init(struct saa7146_dev* dev, struct saa7146_ext_vv *ext_vv)
 	   configuration data) */
 	dev->ext_vv_data = ext_vv;
 
-	vv->video_minor = -1;
-	vv->vbi_minor = -1;
-
 	vv->d_clipping.cpu_addr = pci_alloc_consistent(dev->pci, SAA7146_CLIPPING_MEM, &vv->d_clipping.dma_handle);
 	if( NULL == vv->d_clipping.cpu_addr ) {
 		ERR(("out of memory. aborting.\n"));
@@ -515,7 +491,6 @@ EXPORT_SYMBOL_GPL(saa7146_vv_release);
 int saa7146_register_device(struct video_device **vid, struct saa7146_dev* dev,
 			    char *name, int type)
 {
-	struct saa7146_vv *vv = dev->vv_data;
 	struct video_device *vfd;
 	int err;
 	int i;
@@ -543,15 +518,8 @@ int saa7146_register_device(struct video_device **vid, struct saa7146_dev* dev,
 		return err;
 	}
 
-	if( VFL_TYPE_GRABBER == type ) {
-		vv->video_minor = vfd->minor;
-		INFO(("%s: registered device video%d [v4l2]\n",
-			dev->name, vfd->num));
-	} else {
-		vv->vbi_minor = vfd->minor;
-		INFO(("%s: registered device vbi%d [v4l2]\n",
-			dev->name, vfd->num));
-	}
+	INFO(("%s: registered device %s [v4l2]\n",
+		dev->name, video_device_node_name(vfd)));
 
 	*vid = vfd;
 	return 0;
@@ -560,16 +528,8 @@ EXPORT_SYMBOL_GPL(saa7146_register_device);
 
 int saa7146_unregister_device(struct video_device **vid, struct saa7146_dev* dev)
 {
-	struct saa7146_vv *vv = dev->vv_data;
-
 	DEB_EE(("dev:%p\n",dev));
 
-	if ((*vid)->vfl_type == VFL_TYPE_GRABBER) {
-		vv->video_minor = -1;
-	} else {
-		vv->vbi_minor = -1;
-	}
-
 	video_unregister_device(*vid);
 	*vid = NULL;
 
diff --git a/drivers/media/common/saa7146_i2c.c b/drivers/media/common/saa7146_i2c.c
index 7e8f56815998..48cb154c7a46 100644
--- a/drivers/media/common/saa7146_i2c.c
+++ b/drivers/media/common/saa7146_i2c.c
@@ -98,7 +98,7 @@ static int saa7146_i2c_msg_cleanup(const struct i2c_msg *m, int num, __le32 *op)
 
 		op_count++;
 
-		/* loop throgh all bytes of message i */
+		/* loop through all bytes of message i */
 		for(j = 0; j < m[i].len; j++) {
 			/* write back all bytes that could have been read */
 			m[i].buf[j] = (le32_to_cpu(op[op_count/3]) >> ((3-(op_count%3))*8));
diff --git a/drivers/media/common/saa7146_video.c b/drivers/media/common/saa7146_video.c
index 552dab442d78..becbaadb3b77 100644
--- a/drivers/media/common/saa7146_video.c
+++ b/drivers/media/common/saa7146_video.c
@@ -1205,6 +1205,13 @@ static int buffer_activate (struct saa7146_dev *dev,
 	return 0;
 }
 
+static void release_all_pagetables(struct saa7146_dev *dev, struct saa7146_buf *buf)
+{
+	saa7146_pgtable_free(dev->pci, &buf->pt[0]);
+	saa7146_pgtable_free(dev->pci, &buf->pt[1]);
+	saa7146_pgtable_free(dev->pci, &buf->pt[2]);
+}
+
 static int buffer_prepare(struct videobuf_queue *q,
 			  struct videobuf_buffer *vb, enum v4l2_field field)
 {
@@ -1257,16 +1264,12 @@ static int buffer_prepare(struct videobuf_queue *q,
 
 		sfmt = format_by_fourcc(dev,buf->fmt->pixelformat);
 
+		release_all_pagetables(dev, buf);
 		if( 0 != IS_PLANAR(sfmt->trans)) {
-			saa7146_pgtable_free(dev->pci, &buf->pt[0]);
-			saa7146_pgtable_free(dev->pci, &buf->pt[1]);
-			saa7146_pgtable_free(dev->pci, &buf->pt[2]);
-
 			saa7146_pgtable_alloc(dev->pci, &buf->pt[0]);
 			saa7146_pgtable_alloc(dev->pci, &buf->pt[1]);
 			saa7146_pgtable_alloc(dev->pci, &buf->pt[2]);
 		} else {
-			saa7146_pgtable_free(dev->pci, &buf->pt[0]);
 			saa7146_pgtable_alloc(dev->pci, &buf->pt[0]);
 		}
 
@@ -1329,6 +1332,9 @@ static void buffer_release(struct videobuf_queue *q, struct videobuf_buffer *vb)
 	struct saa7146_buf *buf = (struct saa7146_buf *)vb;
 
 	DEB_CAP(("vbuf:%p\n",vb));
+
+	release_all_pagetables(dev, buf);
+
 	saa7146_dma_free(dev,q,buf);
 }
 
diff --git a/drivers/media/common/tuners/Kconfig b/drivers/media/common/tuners/Kconfig
index 607d319ce8ed..409a4261e5b5 100644
--- a/drivers/media/common/tuners/Kconfig
+++ b/drivers/media/common/tuners/Kconfig
@@ -172,4 +172,11 @@ config MEDIA_TUNER_MC44S803
 	help
 	  Say Y here to support the Freescale MC44S803 based tuners
 
+config MEDIA_TUNER_MAX2165
+	tristate "Maxim MAX2165 silicon tuner"
+	depends on VIDEO_MEDIA && I2C
+	default m if MEDIA_TUNER_CUSTOMISE
+	help
+	  A driver for the silicon tuner MAX2165 from Maxim.
+
 endif # MEDIA_TUNER_CUSTOMISE
diff --git a/drivers/media/common/tuners/Makefile b/drivers/media/common/tuners/Makefile
index 4132b2be79e5..a5438523f30d 100644
--- a/drivers/media/common/tuners/Makefile
+++ b/drivers/media/common/tuners/Makefile
@@ -23,6 +23,7 @@ obj-$(CONFIG_MEDIA_TUNER_MT2131) += mt2131.o
 obj-$(CONFIG_MEDIA_TUNER_MXL5005S) += mxl5005s.o
 obj-$(CONFIG_MEDIA_TUNER_MXL5007T) += mxl5007t.o
 obj-$(CONFIG_MEDIA_TUNER_MC44S803) += mc44s803.o
+obj-$(CONFIG_MEDIA_TUNER_MAX2165) += max2165.o
 
 EXTRA_CFLAGS += -Idrivers/media/dvb/dvb-core
 EXTRA_CFLAGS += -Idrivers/media/dvb/frontends
diff --git a/drivers/media/common/tuners/max2165.c b/drivers/media/common/tuners/max2165.c
new file mode 100644
index 000000000000..3d03640cf1fe
--- /dev/null
+++ b/drivers/media/common/tuners/max2165.c
@@ -0,0 +1,442 @@
+/*
+ *  Driver for Maxim MAX2165 silicon tuner
+ *
+ *  Copyright (c) 2009 David T. L. Wong <davidtlwong@gmail.com>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/videodev2.h>
+#include <linux/delay.h>
+#include <linux/dvb/frontend.h>
+#include <linux/i2c.h>
+
+#include "dvb_frontend.h"
+
+#include "max2165.h"
+#include "max2165_priv.h"
+#include "tuner-i2c.h"
+
+#define dprintk(args...) \
+	do { \
+		if (debug) \
+			printk(KERN_DEBUG "max2165: " args); \
+	} while (0)
+
+static int debug;
+module_param(debug, int, 0644);
+MODULE_PARM_DESC(debug, "Turn on/off debugging (default:off).");
+
+static int max2165_write_reg(struct max2165_priv *priv, u8 reg, u8 data)
+{
+	int ret;
+	u8 buf[] = { reg, data };
+	struct i2c_msg msg = { .flags = 0, .buf = buf, .len = 2 };
+
+	msg.addr = priv->config->i2c_address;
+
+	if (debug >= 2)
+		printk(KERN_DEBUG "%s: reg=0x%02X, data=0x%02X\n",
+			__func__, reg, data);
+
+	ret = i2c_transfer(priv->i2c, &msg, 1);
+
+	if (ret != 1)
+		dprintk(KERN_DEBUG "%s: error reg=0x%x, data=0x%x, ret=%i\n",
+			__func__, reg, data, ret);
+
+	return (ret != 1) ? -EIO : 0;
+}
+
+static int max2165_read_reg(struct max2165_priv *priv, u8 reg, u8 *p_data)
+{
+	int ret;
+	u8 dev_addr = priv->config->i2c_address;
+
+	u8 b0[] = { reg };
+	u8 b1[] = { 0 };
+	struct i2c_msg msg[] = {
+		{ .addr = dev_addr, .flags = 0, .buf = b0, .len = 1 },
+		{ .addr = dev_addr, .flags = I2C_M_RD, .buf = b1, .len = 1 },
+	};
+
+	ret = i2c_transfer(priv->i2c, msg, 2);
+	if (ret != 2) {
+		dprintk(KERN_DEBUG "%s: error reg=0x%x, ret=%i\n",
+			__func__, reg, ret);
+		return -EIO;
+	}
+
+	*p_data = b1[0];
+	if (debug >= 2)
+		printk(KERN_DEBUG "%s: reg=0x%02X, data=0x%02X\n",
+			__func__, reg, b1[0]);
+	return 0;
+}
+
+static int max2165_mask_write_reg(struct max2165_priv *priv, u8 reg,
+	u8 mask, u8 data)
+{
+	int ret;
+	u8 v;
+
+	data &= mask;
+	ret = max2165_read_reg(priv, reg, &v);
+	if (ret != 0)
+		return ret;
+	v &= ~mask;
+	v |= data;
+	ret = max2165_write_reg(priv, reg, v);
+
+	return ret;
+}
+
+static int max2165_read_rom_table(struct max2165_priv *priv)
+{
+	u8 dat[3];
+	int i;
+
+	for (i = 0; i < 3; i++) {
+		max2165_write_reg(priv, REG_ROM_TABLE_ADDR, i + 1);
+		max2165_read_reg(priv, REG_ROM_TABLE_DATA, &dat[i]);
+	}
+
+	priv->tf_ntch_low_cfg = dat[0] >> 4;
+	priv->tf_ntch_hi_cfg = dat[0] & 0x0F;
+	priv->tf_balun_low_ref = dat[1] & 0x0F;
+	priv->tf_balun_hi_ref = dat[1] >> 4;
+	priv->bb_filter_7mhz_cfg = dat[2] & 0x0F;
+	priv->bb_filter_8mhz_cfg = dat[2] >> 4;
+
+	dprintk("tf_ntch_low_cfg = 0x%X\n", priv->tf_ntch_low_cfg);
+	dprintk("tf_ntch_hi_cfg = 0x%X\n", priv->tf_ntch_hi_cfg);
+	dprintk("tf_balun_low_ref = 0x%X\n", priv->tf_balun_low_ref);
+	dprintk("tf_balun_hi_ref = 0x%X\n", priv->tf_balun_hi_ref);
+	dprintk("bb_filter_7mhz_cfg = 0x%X\n", priv->bb_filter_7mhz_cfg);
+	dprintk("bb_filter_8mhz_cfg = 0x%X\n", priv->bb_filter_8mhz_cfg);
+
+	return 0;
+}
+
+static int max2165_set_osc(struct max2165_priv *priv, u8 osc /*MHz*/)
+{
+	u8 v;
+
+	v = (osc / 2);
+	if (v == 2)
+		v = 0x7;
+	else
+		v -= 8;
+
+	max2165_mask_write_reg(priv, REG_PLL_CFG, 0x07, v);
+
+	return 0;
+}
+
+static int max2165_set_bandwidth(struct max2165_priv *priv, u32 bw)
+{
+	u8 val;
+
+	if (bw == BANDWIDTH_8_MHZ)
+		val = priv->bb_filter_8mhz_cfg;
+	else
+		val = priv->bb_filter_7mhz_cfg;
+
+	max2165_mask_write_reg(priv, REG_BASEBAND_CTRL, 0xF0, val << 4);
+
+	return 0;
+}
+
+int fixpt_div32(u32 dividend, u32 divisor, u32 *quotient, u32 *fraction)
+{
+	u32 remainder;
+	u32 q, f = 0;
+	int i;
+
+	if (0 == divisor)
+		return -1;
+
+	q = dividend / divisor;
+	remainder = dividend - q * divisor;
+
+	for (i = 0; i < 31; i++) {
+		remainder <<= 1;
+		if (remainder >= divisor) {
+			f += 1;
+			remainder -= divisor;
+		}
+		f <<= 1;
+	}
+
+	*quotient = q;
+	*fraction = f;
+
+	return 0;
+}
+
+static int max2165_set_rf(struct max2165_priv *priv, u32 freq)
+{
+	u8 tf;
+	u8 tf_ntch;
+	u32 t;
+	u32 quotient, fraction;
+
+	/* Set PLL divider according to RF frequency */
+	fixpt_div32(freq / 1000, priv->config->osc_clk * 1000,
+		&quotient, &fraction);
+
+	/* 20-bit fraction */
+	fraction >>= 12;
+
+	max2165_write_reg(priv, REG_NDIV_INT, quotient);
+	max2165_mask_write_reg(priv, REG_NDIV_FRAC2, 0x0F, fraction >> 16);
+	max2165_write_reg(priv, REG_NDIV_FRAC1, fraction >> 8);
+	max2165_write_reg(priv, REG_NDIV_FRAC0, fraction);
+
+	/* Norch Filter */
+	tf_ntch = (freq < 725000000) ?
+		priv->tf_ntch_low_cfg : priv->tf_ntch_hi_cfg;
+
+	/* Tracking filter balun */
+	t = priv->tf_balun_low_ref;
+	t += (priv->tf_balun_hi_ref - priv->tf_balun_low_ref)
+		* (freq / 1000 - 470000) / (780000 - 470000);
+
+	tf = t;
+	dprintk("tf = %X\n", tf);
+	tf |= tf_ntch << 4;
+
+	max2165_write_reg(priv, REG_TRACK_FILTER, tf);
+
+	return 0;
+}
+
+static void max2165_debug_status(struct max2165_priv *priv)
+{
+	u8 status, autotune;
+	u8 auto_vco_success, auto_vco_active;
+	u8 pll_locked;
+	u8 dc_offset_low, dc_offset_hi;
+	u8 signal_lv_over_threshold;
+	u8 vco, vco_sub_band, adc;
+
+	max2165_read_reg(priv, REG_STATUS, &status);
+	max2165_read_reg(priv, REG_AUTOTUNE, &autotune);
+
+	auto_vco_success = (status >> 6) & 0x01;
+	auto_vco_active = (status >> 5) & 0x01;
+	pll_locked = (status >> 4) & 0x01;
+	dc_offset_low = (status >> 3) & 0x01;
+	dc_offset_hi = (status >> 2) & 0x01;
+	signal_lv_over_threshold = status & 0x01;
+
+	vco = autotune >> 6;
+	vco_sub_band = (autotune >> 3) & 0x7;
+	adc = autotune & 0x7;
+
+	dprintk("auto VCO active: %d, auto VCO success: %d\n",
+		auto_vco_active, auto_vco_success);
+	dprintk("PLL locked: %d\n", pll_locked);
+	dprintk("DC offset low: %d, DC offset high: %d\n",
+		dc_offset_low, dc_offset_hi);
+	dprintk("Signal lvl over threshold: %d\n", signal_lv_over_threshold);
+	dprintk("VCO: %d, VCO Sub-band: %d, ADC: %d\n", vco, vco_sub_band, adc);
+}
+
+static int max2165_set_params(struct dvb_frontend *fe,
+	struct dvb_frontend_parameters *params)
+{
+	struct max2165_priv *priv = fe->tuner_priv;
+	int ret;
+
+	dprintk("%s() frequency=%d (Hz)\n", __func__, params->frequency);
+	if (fe->ops.info.type == FE_ATSC) {
+			return -EINVAL;
+	} else if (fe->ops.info.type == FE_OFDM) {
+		dprintk("%s() OFDM\n", __func__);
+		switch (params->u.ofdm.bandwidth) {
+		case BANDWIDTH_6_MHZ:
+			return -EINVAL;
+		case BANDWIDTH_7_MHZ:
+		case BANDWIDTH_8_MHZ:
+			priv->frequency = params->frequency;
+			priv->bandwidth = params->u.ofdm.bandwidth;
+			break;
+		default:
+			printk(KERN_ERR "MAX2165 bandwidth not set!\n");
+			return -EINVAL;
+		}
+	} else {
+		printk(KERN_ERR "MAX2165 modulation type not supported!\n");
+		return -EINVAL;
+	}
+
+	dprintk("%s() frequency=%d\n", __func__, priv->frequency);
+
+	if (fe->ops.i2c_gate_ctrl)
+		fe->ops.i2c_gate_ctrl(fe, 1);
+	max2165_set_bandwidth(priv, priv->bandwidth);
+	ret = max2165_set_rf(priv, priv->frequency);
+	mdelay(50);
+	max2165_debug_status(priv);
+	if (fe->ops.i2c_gate_ctrl)
+		fe->ops.i2c_gate_ctrl(fe, 0);
+
+	if (ret != 0)
+		return -EREMOTEIO;
+
+	return 0;
+}
+
+static int max2165_get_frequency(struct dvb_frontend *fe, u32 *freq)
+{
+	struct max2165_priv *priv = fe->tuner_priv;
+	dprintk("%s()\n", __func__);
+	*freq = priv->frequency;
+	return 0;
+}
+
+static int max2165_get_bandwidth(struct dvb_frontend *fe, u32 *bw)
+{
+	struct max2165_priv *priv = fe->tuner_priv;
+	dprintk("%s()\n", __func__);
+
+	*bw = priv->bandwidth;
+	return 0;
+}
+
+static int max2165_get_status(struct dvb_frontend *fe, u32 *status)
+{
+	struct max2165_priv *priv = fe->tuner_priv;
+	u16 lock_status = 0;
+
+	dprintk("%s()\n", __func__);
+
+	if (fe->ops.i2c_gate_ctrl)
+			fe->ops.i2c_gate_ctrl(fe, 1);
+
+	max2165_debug_status(priv);
+	*status = lock_status;
+
+	if (fe->ops.i2c_gate_ctrl)
+			fe->ops.i2c_gate_ctrl(fe, 0);
+
+	return 0;
+}
+
+static int max2165_sleep(struct dvb_frontend *fe)
+{
+	dprintk("%s()\n", __func__);
+	return 0;
+}
+
+static int max2165_init(struct dvb_frontend *fe)
+{
+	struct max2165_priv *priv = fe->tuner_priv;
+	dprintk("%s()\n", __func__);
+
+	if (fe->ops.i2c_gate_ctrl)
+		fe->ops.i2c_gate_ctrl(fe, 1);
+
+	/* Setup initial values */
+	/* Fractional Mode on */
+	max2165_write_reg(priv, REG_NDIV_FRAC2, 0x18);
+	/* LNA on */
+	max2165_write_reg(priv, REG_LNA, 0x01);
+	max2165_write_reg(priv, REG_PLL_CFG, 0x7A);
+	max2165_write_reg(priv, REG_TEST, 0x08);
+	max2165_write_reg(priv, REG_SHUTDOWN, 0x40);
+	max2165_write_reg(priv, REG_VCO_CTRL, 0x84);
+	max2165_write_reg(priv, REG_BASEBAND_CTRL, 0xC3);
+	max2165_write_reg(priv, REG_DC_OFFSET_CTRL, 0x75);
+	max2165_write_reg(priv, REG_DC_OFFSET_DAC, 0x00);
+	max2165_write_reg(priv, REG_ROM_TABLE_ADDR, 0x00);
+
+	max2165_set_osc(priv, priv->config->osc_clk);
+
+	max2165_read_rom_table(priv);
+
+	max2165_set_bandwidth(priv, BANDWIDTH_8_MHZ);
+
+	if (fe->ops.i2c_gate_ctrl)
+			fe->ops.i2c_gate_ctrl(fe, 0);
+
+	return 0;
+}
+
+static int max2165_release(struct dvb_frontend *fe)
+{
+	struct max2165_priv *priv = fe->tuner_priv;
+	dprintk("%s()\n", __func__);
+
+	kfree(priv);
+	fe->tuner_priv = NULL;
+
+	return 0;
+}
+
+static const struct dvb_tuner_ops max2165_tuner_ops = {
+	.info = {
+		.name           = "Maxim MAX2165",
+		.frequency_min  = 470000000,
+		.frequency_max  = 780000000,
+		.frequency_step =     50000,
+	},
+
+	.release	   = max2165_release,
+	.init		   = max2165_init,
+	.sleep		   = max2165_sleep,
+
+	.set_params	   = max2165_set_params,
+	.set_analog_params = NULL,
+	.get_frequency	   = max2165_get_frequency,
+	.get_bandwidth	   = max2165_get_bandwidth,
+	.get_status	   = max2165_get_status
+};
+
+struct dvb_frontend *max2165_attach(struct dvb_frontend *fe,
+				   struct i2c_adapter *i2c,
+				   struct max2165_config *cfg)
+{
+	struct max2165_priv *priv = NULL;
+
+	dprintk("%s(%d-%04x)\n", __func__,
+		i2c ? i2c_adapter_id(i2c) : -1,
+		cfg ? cfg->i2c_address : -1);
+
+	priv = kzalloc(sizeof(struct max2165_priv), GFP_KERNEL);
+	if (priv == NULL)
+		return NULL;
+
+	memcpy(&fe->ops.tuner_ops, &max2165_tuner_ops,
+		sizeof(struct dvb_tuner_ops));
+
+	priv->config = cfg;
+	priv->i2c = i2c;
+	fe->tuner_priv = priv;
+
+	max2165_init(fe);
+	max2165_debug_status(priv);
+
+	return fe;
+}
+EXPORT_SYMBOL(max2165_attach);
+
+MODULE_AUTHOR("David T. L. Wong <davidtlwong@gmail.com>");
+MODULE_DESCRIPTION("Maxim MAX2165 silicon tuner driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/media/common/tuners/max2165.h b/drivers/media/common/tuners/max2165.h
new file mode 100644
index 000000000000..c063c36a93d3
--- /dev/null
+++ b/drivers/media/common/tuners/max2165.h
@@ -0,0 +1,48 @@
+/*
+ *  Driver for Maxim MAX2165 silicon tuner
+ *
+ *  Copyright (c) 2009 David T. L. Wong <davidtlwong@gmail.com>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#ifndef __MAX2165_H__
+#define __MAX2165_H__
+
+struct dvb_frontend;
+struct i2c_adapter;
+
+struct max2165_config {
+	u8 i2c_address;
+	u8 osc_clk; /* in MHz, selectable values: 4,16,18,20,22,24,26,28 */
+};
+
+#if defined(CONFIG_MEDIA_TUNER_MAX2165) || \
+    (defined(CONFIG_MEDIA_TUNER_MAX2165_MODULE) && defined(MODULE))
+extern struct dvb_frontend *max2165_attach(struct dvb_frontend *fe,
+	struct i2c_adapter *i2c,
+	struct max2165_config *cfg);
+#else
+static inline struct dvb_frontend *max2165_attach(struct dvb_frontend *fe,
+	struct i2c_adapter *i2c,
+	struct max2165_config *cfg)
+{
+	printk(KERN_WARNING "%s: driver disabled by Kconfig\n", __func__);
+	return NULL;
+}
+#endif
+
+#endif
diff --git a/drivers/media/common/tuners/max2165_priv.h b/drivers/media/common/tuners/max2165_priv.h
new file mode 100644
index 000000000000..91bbe021a08d
--- /dev/null
+++ b/drivers/media/common/tuners/max2165_priv.h
@@ -0,0 +1,60 @@
+/*
+ *  Driver for Maxim MAX2165 silicon tuner
+ *
+ *  Copyright (c) 2009 David T. L. Wong <davidtlwong@gmail.com>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#ifndef __MAX2165_PRIV_H__
+#define __MAX2165_PRIV_H__
+
+#define REG_NDIV_INT 0x00
+#define REG_NDIV_FRAC2 0x01
+#define REG_NDIV_FRAC1 0x02
+#define REG_NDIV_FRAC0 0x03
+#define REG_TRACK_FILTER 0x04
+#define REG_LNA 0x05
+#define REG_PLL_CFG 0x06
+#define REG_TEST 0x07
+#define REG_SHUTDOWN 0x08
+#define REG_VCO_CTRL 0x09
+#define REG_BASEBAND_CTRL 0x0A
+#define REG_DC_OFFSET_CTRL 0x0B
+#define REG_DC_OFFSET_DAC 0x0C
+#define REG_ROM_TABLE_ADDR 0x0D
+
+/* Read Only Registers */
+#define REG_ROM_TABLE_DATA 0x10
+#define REG_STATUS 0x11
+#define REG_AUTOTUNE 0x12
+
+struct max2165_priv {
+	struct max2165_config *config;
+	struct i2c_adapter *i2c;
+
+	u32 frequency;
+	u32 bandwidth;
+
+	u8 tf_ntch_low_cfg;
+	u8 tf_ntch_hi_cfg;
+	u8 tf_balun_low_ref;
+	u8 tf_balun_hi_ref;
+	u8 bb_filter_7mhz_cfg;
+	u8 bb_filter_8mhz_cfg;
+};
+
+#endif
diff --git a/drivers/media/common/tuners/mxl5005s.c b/drivers/media/common/tuners/mxl5005s.c
index 0803dab58fff..605e28b73263 100644
--- a/drivers/media/common/tuners/mxl5005s.c
+++ b/drivers/media/common/tuners/mxl5005s.c
@@ -2789,7 +2789,10 @@ static u16 MXL_TuneRF(struct dvb_frontend *fe, u32 RF_Freq)
 
 	/* add for 2.6.5 Special setting for QAM */
 	if (state->Mod_Type == MXL_QAM) {
-		if (state->RF_IN < 680000000)
+		if (state->config->qam_gain != 0)
+			status += MXL_ControlWrite(fe, RFSYN_CHP_GAIN,
+						   state->config->qam_gain);
+		else if (state->RF_IN < 680000000)
 			status += MXL_ControlWrite(fe, RFSYN_CHP_GAIN, 3);
 		else
 			status += MXL_ControlWrite(fe, RFSYN_CHP_GAIN, 2);
diff --git a/drivers/media/common/tuners/mxl5005s.h b/drivers/media/common/tuners/mxl5005s.h
index 7ac6815b30aa..fc8a1ffc53b4 100644
--- a/drivers/media/common/tuners/mxl5005s.h
+++ b/drivers/media/common/tuners/mxl5005s.h
@@ -108,6 +108,10 @@ struct mxl5005s_config {
 #define MXL_LOW_IF  1
 	u8 if_mode;
 
+	/* Some boards need to override the built-in logic for determining
+	   the gain when in QAM mode (the HVR-1600 is one such case) */
+	u8 qam_gain;
+
 	/* Stuff I don't know what to do with */
 	u8 AgcMasterByte;
 };
diff --git a/drivers/media/common/tuners/mxl5007t.c b/drivers/media/common/tuners/mxl5007t.c
index 2d02698d4f4f..7eb1bf75cd07 100644
--- a/drivers/media/common/tuners/mxl5007t.c
+++ b/drivers/media/common/tuners/mxl5007t.c
@@ -196,7 +196,7 @@ static void copy_reg_bits(struct reg_pair_t *reg_pair1,
 	i = j = 0;
 
 	while (reg_pair1[i].reg || reg_pair1[i].val) {
-		while (reg_pair2[j].reg || reg_pair2[j].reg) {
+		while (reg_pair2[j].reg || reg_pair2[j].val) {
 			if (reg_pair1[i].reg != reg_pair2[j].reg) {
 				j++;
 				continue;
diff --git a/drivers/media/common/tuners/tda18271-common.c b/drivers/media/common/tuners/tda18271-common.c
index 155c93eb75da..e1f678281a58 100644
--- a/drivers/media/common/tuners/tda18271-common.c
+++ b/drivers/media/common/tuners/tda18271-common.c
@@ -326,12 +326,24 @@ int tda18271_init_regs(struct dvb_frontend *fe)
 	regs[R_EB22] = 0x48;
 	regs[R_EB23] = 0xb0;
 
-	if (priv->small_i2c) {
+	switch (priv->small_i2c) {
+	case TDA18271_08_BYTE_CHUNK_INIT:
+		tda18271_write_regs(fe, 0x00, 0x08);
+		tda18271_write_regs(fe, 0x08, 0x08);
+		tda18271_write_regs(fe, 0x10, 0x08);
+		tda18271_write_regs(fe, 0x18, 0x08);
+		tda18271_write_regs(fe, 0x20, 0x07);
+		break;
+	case TDA18271_16_BYTE_CHUNK_INIT:
 		tda18271_write_regs(fe, 0x00, 0x10);
 		tda18271_write_regs(fe, 0x10, 0x10);
 		tda18271_write_regs(fe, 0x20, 0x07);
-	} else
+		break;
+	case TDA18271_39_BYTE_CHUNK_INIT:
+	default:
 		tda18271_write_regs(fe, 0x00, TDA18271_NUM_REGS);
+		break;
+	}
 
 	/* setup agc1 gain */
 	regs[R_EB17] = 0x00;
diff --git a/drivers/media/common/tuners/tda18271-fe.c b/drivers/media/common/tuners/tda18271-fe.c
index 3a50ce96fcb9..b2e15456d5f3 100644
--- a/drivers/media/common/tuners/tda18271-fe.c
+++ b/drivers/media/common/tuners/tda18271-fe.c
@@ -256,8 +256,9 @@ static int tda18271c2_rf_tracking_filters_correction(struct dvb_frontend *fe,
 	struct tda18271_priv *priv = fe->tuner_priv;
 	struct tda18271_rf_tracking_filter_cal *map = priv->rf_cal_state;
 	unsigned char *regs = priv->tda18271_regs;
-	int tm_current, rfcal_comp, approx, i, ret;
-	u8 dc_over_dt, rf_tab;
+	int i, ret;
+	u8 tm_current, dc_over_dt, rf_tab;
+	s32 rfcal_comp, approx;
 
 	/* power up */
 	ret = tda18271_set_standby_mode(fe, 0, 0, 0);
@@ -277,11 +278,11 @@ static int tda18271c2_rf_tracking_filters_correction(struct dvb_frontend *fe,
 		return i;
 
 	if ((0 == map[i].rf3) || (freq / 1000 < map[i].rf2)) {
-		approx = map[i].rf_a1 *
-			(freq / 1000 - map[i].rf1) + map[i].rf_b1 + rf_tab;
+		approx = map[i].rf_a1 * (s32)(freq / 1000 - map[i].rf1) +
+			map[i].rf_b1 + rf_tab;
 	} else {
-		approx = map[i].rf_a2 *
-			(freq / 1000 - map[i].rf2) + map[i].rf_b2 + rf_tab;
+		approx = map[i].rf_a2 * (s32)(freq / 1000 - map[i].rf2) +
+			map[i].rf_b2 + rf_tab;
 	}
 
 	if (approx < 0)
@@ -292,9 +293,9 @@ static int tda18271c2_rf_tracking_filters_correction(struct dvb_frontend *fe,
 	tda18271_lookup_map(fe, RF_CAL_DC_OVER_DT, &freq, &dc_over_dt);
 
 	/* calculate temperature compensation */
-	rfcal_comp = dc_over_dt * (tm_current - priv->tm_rfcal) / 1000;
+	rfcal_comp = dc_over_dt * (s32)(tm_current - priv->tm_rfcal) / 1000;
 
-	regs[R_EB14] = approx + rfcal_comp;
+	regs[R_EB14] = (unsigned char)(approx + rfcal_comp);
 	ret = tda18271_write_regs(fe, R_EB14, 1);
 fail:
 	return ret;
@@ -572,6 +573,7 @@ static int tda18271_rf_tracking_filters_init(struct dvb_frontend *fe, u32 freq)
 	struct tda18271_rf_tracking_filter_cal *map = priv->rf_cal_state;
 	unsigned char *regs = priv->tda18271_regs;
 	int bcal, rf, i;
+	s32 divisor, dividend;
 #define RF1 0
 #define RF2 1
 #define RF3 2
@@ -610,20 +612,22 @@ static int tda18271_rf_tracking_filters_init(struct dvb_frontend *fe, u32 freq)
 		switch (rf) {
 		case RF1:
 			map[i].rf_a1 = 0;
-			map[i].rf_b1 = prog_cal[RF1] - prog_tab[RF1];
+			map[i].rf_b1 = (s32)(prog_cal[RF1] - prog_tab[RF1]);
 			map[i].rf1   = rf_freq[RF1] / 1000;
 			break;
 		case RF2:
-			map[i].rf_a1 = (prog_cal[RF2] - prog_tab[RF2] -
-					prog_cal[RF1] + prog_tab[RF1]) /
-				(s32)((rf_freq[RF2] - rf_freq[RF1]) / 1000);
+			dividend = (s32)(prog_cal[RF2] - prog_tab[RF2]) -
+				   (s32)(prog_cal[RF1] + prog_tab[RF1]);
+			divisor = (s32)(rf_freq[RF2] - rf_freq[RF1]) / 1000;
+			map[i].rf_a1 = (dividend / divisor);
 			map[i].rf2   = rf_freq[RF2] / 1000;
 			break;
 		case RF3:
-			map[i].rf_a2 = (prog_cal[RF3] - prog_tab[RF3] -
-					prog_cal[RF2] + prog_tab[RF2]) /
-				(s32)((rf_freq[RF3] - rf_freq[RF2]) / 1000);
-			map[i].rf_b2 = prog_cal[RF2] - prog_tab[RF2];
+			dividend = (s32)(prog_cal[RF3] - prog_tab[RF3]) -
+				   (s32)(prog_cal[RF2] + prog_tab[RF2]);
+			divisor = (s32)(rf_freq[RF3] - rf_freq[RF2]) / 1000;
+			map[i].rf_a2 = (dividend / divisor);
+			map[i].rf_b2 = (s32)(prog_cal[RF2] - prog_tab[RF2]);
 			map[i].rf3   = rf_freq[RF3] / 1000;
 			break;
 		default:
@@ -1181,6 +1185,48 @@ static int tda18271_get_id(struct dvb_frontend *fe)
 	return ret;
 }
 
+static int tda18271_setup_configuration(struct dvb_frontend *fe,
+					struct tda18271_config *cfg)
+{
+	struct tda18271_priv *priv = fe->tuner_priv;
+
+	priv->gate = (cfg) ? cfg->gate : TDA18271_GATE_AUTO;
+	priv->role = (cfg) ? cfg->role : TDA18271_MASTER;
+	priv->config = (cfg) ? cfg->config : 0;
+	priv->small_i2c = (cfg) ?
+		cfg->small_i2c : TDA18271_39_BYTE_CHUNK_INIT;
+	priv->output_opt = (cfg) ?
+		cfg->output_opt : TDA18271_OUTPUT_LT_XT_ON;
+
+	return 0;
+}
+
+static inline int tda18271_need_cal_on_startup(struct tda18271_config *cfg)
+{
+	/* tda18271_cal_on_startup == -1 when cal module option is unset */
+	return ((tda18271_cal_on_startup == -1) ?
+		/* honor configuration setting */
+		((cfg) && (cfg->rf_cal_on_startup)) :
+		/* module option overrides configuration setting */
+		(tda18271_cal_on_startup)) ? 1 : 0;
+}
+
+static int tda18271_set_config(struct dvb_frontend *fe, void *priv_cfg)
+{
+	struct tda18271_config *cfg = (struct tda18271_config *) priv_cfg;
+
+	tda18271_setup_configuration(fe, cfg);
+
+	if (tda18271_need_cal_on_startup(cfg))
+		tda18271_init(fe);
+
+	/* override default std map with values in config struct */
+	if ((cfg) && (cfg->std_map))
+		tda18271_update_std_map(fe, cfg->std_map);
+
+	return 0;
+}
+
 static struct dvb_tuner_ops tda18271_tuner_ops = {
 	.info = {
 		.name = "NXP TDA18271HD",
@@ -1193,6 +1239,7 @@ static struct dvb_tuner_ops tda18271_tuner_ops = {
 	.set_params        = tda18271_set_params,
 	.set_analog_params = tda18271_set_analog_params,
 	.release           = tda18271_release,
+	.set_config        = tda18271_set_config,
 	.get_frequency     = tda18271_get_frequency,
 	.get_bandwidth     = tda18271_get_bandwidth,
 };
@@ -1213,33 +1260,14 @@ struct dvb_frontend *tda18271_attach(struct dvb_frontend *fe, u8 addr,
 	case 0:
 		goto fail;
 	case 1:
-	{
 		/* new tuner instance */
-		int rf_cal_on_startup;
-
-		priv->gate = (cfg) ? cfg->gate : TDA18271_GATE_AUTO;
-		priv->role = (cfg) ? cfg->role : TDA18271_MASTER;
-		priv->config = (cfg) ? cfg->config : 0;
-		priv->small_i2c = (cfg) ? cfg->small_i2c : 0;
-		priv->output_opt = (cfg) ?
-			cfg->output_opt : TDA18271_OUTPUT_LT_XT_ON;
-
-		/* tda18271_cal_on_startup == -1 when cal
-		 * module option is unset */
-		if (tda18271_cal_on_startup == -1) {
-			/* honor attach-time configuration */
-			rf_cal_on_startup =
-				((cfg) && (cfg->rf_cal_on_startup)) ? 1 : 0;
-		} else {
-			/* module option overrides attach configuration */
-			rf_cal_on_startup = tda18271_cal_on_startup;
-		}
+		fe->tuner_priv = priv;
+
+		tda18271_setup_configuration(fe, cfg);
 
 		priv->cal_initialized = false;
 		mutex_init(&priv->lock);
 
-		fe->tuner_priv = priv;
-
 		if (tda_fail(tda18271_get_id(fe)))
 			goto fail;
 
@@ -1249,12 +1277,12 @@ struct dvb_frontend *tda18271_attach(struct dvb_frontend *fe, u8 addr,
 		mutex_lock(&priv->lock);
 		tda18271_init_regs(fe);
 
-		if ((rf_cal_on_startup) && (priv->id == TDA18271HDC2))
+		if ((tda18271_need_cal_on_startup(cfg)) &&
+		    (priv->id == TDA18271HDC2))
 			tda18271c2_rf_cal_init(fe);
 
 		mutex_unlock(&priv->lock);
 		break;
-	}
 	default:
 		/* existing tuner instance */
 		fe->tuner_priv = priv;
@@ -1271,7 +1299,11 @@ struct dvb_frontend *tda18271_attach(struct dvb_frontend *fe, u8 addr,
 				priv->small_i2c = cfg->small_i2c;
 			if (cfg->output_opt)
 				priv->output_opt = cfg->output_opt;
+			if (cfg->std_map)
+				tda18271_update_std_map(fe, cfg->std_map);
 		}
+		if (tda18271_need_cal_on_startup(cfg))
+			tda18271_init(fe);
 		break;
 	}
 
@@ -1298,7 +1330,7 @@ EXPORT_SYMBOL_GPL(tda18271_attach);
 MODULE_DESCRIPTION("NXP TDA18271HD analog / digital tuner driver");
 MODULE_AUTHOR("Michael Krufky <mkrufky@linuxtv.org>");
 MODULE_LICENSE("GPL");
-MODULE_VERSION("0.3");
+MODULE_VERSION("0.4");
 
 /*
  * Overrides for Emacs so that we follow Linus's tabbing style.
diff --git a/drivers/media/common/tuners/tda18271-maps.c b/drivers/media/common/tuners/tda18271-maps.c
index e21fdeff3ddf..e7f84c705da8 100644
--- a/drivers/media/common/tuners/tda18271-maps.c
+++ b/drivers/media/common/tuners/tda18271-maps.c
@@ -978,6 +978,7 @@ static struct tda18271_cid_target_map tda18271_cid_target[] = {
 int tda18271_lookup_cid_target(struct dvb_frontend *fe,
 			       u32 *freq, u8 *cid_target, u16 *count_limit)
 {
+	struct tda18271_priv *priv = fe->tuner_priv;
 	int i = 0;
 
 	while ((tda18271_cid_target[i].rfmax * 1000) < *freq) {
diff --git a/drivers/media/common/tuners/tda18271-priv.h b/drivers/media/common/tuners/tda18271-priv.h
index 2bee229acd91..9589ab0576d2 100644
--- a/drivers/media/common/tuners/tda18271-priv.h
+++ b/drivers/media/common/tuners/tda18271-priv.h
@@ -80,10 +80,10 @@ struct tda18271_rf_tracking_filter_cal {
 	u32 rf1;
 	u32 rf2;
 	u32 rf3;
-	int rf_a1;
-	int rf_b1;
-	int rf_a2;
-	int rf_b2;
+	s32 rf_a1;
+	s32 rf_b1;
+	s32 rf_a2;
+	s32 rf_b2;
 };
 
 enum tda18271_pll {
@@ -109,11 +109,12 @@ struct tda18271_priv {
 	enum tda18271_i2c_gate gate;
 	enum tda18271_ver id;
 	enum tda18271_output_options output_opt;
+	enum tda18271_small_i2c small_i2c;
 
 	unsigned int config; /* interface to saa713x / tda829x */
-	unsigned int tm_rfcal;
 	unsigned int cal_initialized:1;
-	unsigned int small_i2c:1;
+
+	u8 tm_rfcal;
 
 	struct tda18271_map_layout *maps;
 	struct tda18271_std_map std;
@@ -135,27 +136,37 @@ extern int tda18271_debug;
 #define DBG_ADV  8
 #define DBG_CAL  16
 
-#define tda_printk(kern, fmt, arg...) \
-	printk(kern "%s: " fmt, __func__, ##arg)
-
-#define tda_dprintk(lvl, fmt, arg...) do {\
+#define tda_printk(st, kern, fmt, arg...) do {\
+	if (st) { \
+		struct tda18271_priv *state = st; \
+		printk(kern "%s: [%d-%04x|%s] " fmt, __func__, \
+			i2c_adapter_id(state->i2c_props.adap), \
+			state->i2c_props.addr, \
+			(state->role == TDA18271_MASTER) \
+			? "M" : "S", ##arg); \
+	} else \
+		printk(kern "%s: " fmt, __func__, ##arg); \
+} while (0)
+
+#define tda_dprintk(st, lvl, fmt, arg...) do {\
 	if (tda18271_debug & lvl) \
-		tda_printk(KERN_DEBUG, fmt, ##arg); } while (0)
+		tda_printk(st, KERN_DEBUG, fmt, ##arg); } while (0)
 
 #define tda_info(fmt, arg...)     printk(KERN_INFO     fmt, ##arg)
-#define tda_warn(fmt, arg...) tda_printk(KERN_WARNING, fmt, ##arg)
-#define tda_err(fmt, arg...)  tda_printk(KERN_ERR,     fmt, ##arg)
-#define tda_dbg(fmt, arg...)  tda_dprintk(DBG_INFO,    fmt, ##arg)
-#define tda_map(fmt, arg...)  tda_dprintk(DBG_MAP,     fmt, ##arg)
-#define tda_reg(fmt, arg...)  tda_dprintk(DBG_REG,     fmt, ##arg)
-#define tda_cal(fmt, arg...)  tda_dprintk(DBG_CAL,     fmt, ##arg)
+#define tda_warn(fmt, arg...) tda_printk(priv, KERN_WARNING, fmt, ##arg)
+#define tda_err(fmt, arg...)  tda_printk(priv, KERN_ERR,     fmt, ##arg)
+#define tda_dbg(fmt, arg...)  tda_dprintk(priv, DBG_INFO,    fmt, ##arg)
+#define tda_map(fmt, arg...)  tda_dprintk(priv, DBG_MAP,     fmt, ##arg)
+#define tda_reg(fmt, arg...)  tda_dprintk(priv, DBG_REG,     fmt, ##arg)
+#define tda_cal(fmt, arg...)  tda_dprintk(priv, DBG_CAL,     fmt, ##arg)
 
 #define tda_fail(ret)							     \
 ({									     \
 	int __ret;							     \
 	__ret = (ret < 0);						     \
 	if (__ret)							     \
-		tda_printk(KERN_ERR, "error %d on line %d\n", ret, __LINE__);\
+		tda_printk(priv, KERN_ERR,				     \
+			   "error %d on line %d\n", ret, __LINE__);	     \
 	__ret;								     \
 })
 
diff --git a/drivers/media/common/tuners/tda18271.h b/drivers/media/common/tuners/tda18271.h
index 323f2912128d..d7fcc36dc6e6 100644
--- a/drivers/media/common/tuners/tda18271.h
+++ b/drivers/media/common/tuners/tda18271.h
@@ -78,6 +78,12 @@ enum tda18271_output_options {
 	TDA18271_OUTPUT_XT_OFF = 2,
 };
 
+enum tda18271_small_i2c {
+	TDA18271_39_BYTE_CHUNK_INIT = 0,
+	TDA18271_16_BYTE_CHUNK_INIT = 1,
+	TDA18271_08_BYTE_CHUNK_INIT = 2,
+};
+
 struct tda18271_config {
 	/* override default if freq / std settings (optional) */
 	struct tda18271_std_map *std_map;
@@ -91,12 +97,12 @@ struct tda18271_config {
 	/* output options that can be disabled */
 	enum tda18271_output_options output_opt;
 
+	/* some i2c providers cant write all 39 registers at once */
+	enum tda18271_small_i2c small_i2c;
+
 	/* force rf tracking filter calibration on startup */
 	unsigned int rf_cal_on_startup:1;
 
-	/* some i2c providers cant write all 39 registers at once */
-	unsigned int small_i2c:1;
-
 	/* interface to saa713x / tda829x */
 	unsigned int config;
 };
diff --git a/drivers/media/common/tuners/tda8290.c b/drivers/media/common/tuners/tda8290.c
index 064d14c8d7b2..2833137fa819 100644
--- a/drivers/media/common/tuners/tda8290.c
+++ b/drivers/media/common/tuners/tda8290.c
@@ -33,6 +33,7 @@ module_param(debug, int, 0644);
 MODULE_PARM_DESC(debug, "enable verbose debug messages");
 
 static int deemphasis_50;
+module_param(deemphasis_50, int, 0644);
 MODULE_PARM_DESC(deemphasis_50, "0 - 75us deemphasis; 1 - 50us deemphasis");
 
 /* ---------------------------------------------------------------------- */
@@ -143,7 +144,8 @@ static void set_audio(struct dvb_frontend *fe,
 	}
 
 	if (params->mode == V4L2_TUNER_RADIO) {
-		priv->tda8290_easy_mode = 0x01;		/* Start with MN values */
+		/* Set TDA8295 to FM radio; Start TDA8290 with MN values */
+		priv->tda8290_easy_mode = (priv->ver & TDA8295) ? 0x80 : 0x01;
 		tuner_dbg("setting to radio FM\n");
 	} else {
 		tuner_dbg("setting tda829x to system %s\n", mode);
@@ -671,16 +673,19 @@ static int tda8290_probe(struct tuner_i2c_props *i2c_props)
 static int tda8295_probe(struct tuner_i2c_props *i2c_props)
 {
 #define TDA8295_ID 0x8a
+#define TDA8295C2_ID 0x8b
 	unsigned char tda8295_id[] = { 0x2f, 0x00 };
 
 	/* detect tda8295 */
 	tuner_i2c_xfer_send(i2c_props, &tda8295_id[0], 1);
 	tuner_i2c_xfer_recv(i2c_props, &tda8295_id[1], 1);
 
-	if (tda8295_id[1] == TDA8295_ID) {
+	if ((tda8295_id[1] & 0xfe) == TDA8295_ID) {
 		if (debug)
-			printk(KERN_DEBUG "%s: tda8295 detected @ %d-%04x\n",
-			       __func__, i2c_adapter_id(i2c_props->adap),
+			printk(KERN_DEBUG "%s: %s detected @ %d-%04x\n",
+			       __func__, (tda8295_id[1] == TDA8295_ID) ?
+			       "tda8295c1" : "tda8295c2",
+			       i2c_adapter_id(i2c_props->adap),
 			       i2c_props->addr);
 		return 0;
 	}
diff --git a/drivers/media/common/tuners/tda9887.c b/drivers/media/common/tuners/tda9887.c
index 544cdbe88a6c..a71c100c95df 100644
--- a/drivers/media/common/tuners/tda9887.c
+++ b/drivers/media/common/tuners/tda9887.c
@@ -463,7 +463,7 @@ static int tda9887_set_insmod(struct dvb_frontend *fe)
 			buf[1] &= ~cQSS;
 	}
 
-	if (adjust >= 0x00 && adjust < 0x20) {
+	if (adjust < 0x20) {
 		buf[2] &= ~cTopMask;
 		buf[2] |= adjust;
 	}
diff --git a/drivers/media/common/tuners/xc5000.c b/drivers/media/common/tuners/xc5000.c
index f4ffcdc9b848..432003dded7c 100644
--- a/drivers/media/common/tuners/xc5000.c
+++ b/drivers/media/common/tuners/xc5000.c
@@ -61,6 +61,7 @@ struct xc5000_priv {
 	u32 bandwidth;
 	u8  video_standard;
 	u8  rf_mode;
+	u8  radio_input;
 };
 
 /* Misc Defines */
@@ -632,8 +633,12 @@ static int xc5000_set_params(struct dvb_frontend *fe,
 	struct xc5000_priv *priv = fe->tuner_priv;
 	int ret;
 
-	if (xc5000_is_firmware_loaded(fe) != XC_RESULT_SUCCESS)
-		xc_load_fw_and_init_tuner(fe);
+	if (xc5000_is_firmware_loaded(fe) != XC_RESULT_SUCCESS) {
+		if (xc_load_fw_and_init_tuner(fe) != XC_RESULT_SUCCESS) {
+			dprintk(1, "Unable to load firmware and init tuner\n");
+			return -EINVAL;
+		}
+	}
 
 	dprintk(1, "%s() frequency=%d (Hz)\n", __func__, params->frequency);
 
@@ -739,15 +744,12 @@ static int xc5000_is_firmware_loaded(struct dvb_frontend *fe)
 	return ret;
 }
 
-static int xc5000_set_analog_params(struct dvb_frontend *fe,
+static int xc5000_set_tv_freq(struct dvb_frontend *fe,
 	struct analog_parameters *params)
 {
 	struct xc5000_priv *priv = fe->tuner_priv;
 	int ret;
 
-	if (xc5000_is_firmware_loaded(fe) != XC_RESULT_SUCCESS)
-		xc_load_fw_and_init_tuner(fe);
-
 	dprintk(1, "%s() frequency=%d (in units of 62.5khz)\n",
 		__func__, params->frequency);
 
@@ -827,6 +829,86 @@ tune_channel:
 	return 0;
 }
 
+static int xc5000_set_radio_freq(struct dvb_frontend *fe,
+	struct analog_parameters *params)
+{
+	struct xc5000_priv *priv = fe->tuner_priv;
+	int ret = -EINVAL;
+	u8 radio_input;
+
+	dprintk(1, "%s() frequency=%d (in units of khz)\n",
+		__func__, params->frequency);
+
+	if (priv->radio_input == XC5000_RADIO_NOT_CONFIGURED) {
+		dprintk(1, "%s() radio input not configured\n", __func__);
+		return -EINVAL;
+	}
+
+	if (priv->radio_input == XC5000_RADIO_FM1)
+		radio_input = FM_Radio_INPUT1;
+	else if  (priv->radio_input == XC5000_RADIO_FM2)
+		radio_input = FM_Radio_INPUT2;
+	else {
+		dprintk(1, "%s() unknown radio input %d\n", __func__,
+			priv->radio_input);
+		return -EINVAL;
+	}
+
+	priv->freq_hz = params->frequency * 125 / 2;
+
+	priv->rf_mode = XC_RF_MODE_AIR;
+
+	ret = xc_SetTVStandard(priv, XC5000_Standard[radio_input].VideoMode,
+			       XC5000_Standard[radio_input].AudioMode);
+
+	if (ret != XC_RESULT_SUCCESS) {
+		printk(KERN_ERR "xc5000: xc_SetTVStandard failed\n");
+		return -EREMOTEIO;
+	}
+
+	ret = xc_SetSignalSource(priv, priv->rf_mode);
+	if (ret != XC_RESULT_SUCCESS) {
+		printk(KERN_ERR
+			"xc5000: xc_SetSignalSource(%d) failed\n",
+			priv->rf_mode);
+		return -EREMOTEIO;
+	}
+
+	xc_tune_channel(priv, priv->freq_hz, XC_TUNE_ANALOG);
+
+	return 0;
+}
+
+static int xc5000_set_analog_params(struct dvb_frontend *fe,
+			     struct analog_parameters *params)
+{
+	struct xc5000_priv *priv = fe->tuner_priv;
+	int ret = -EINVAL;
+
+	if (priv->i2c_props.adap == NULL)
+		return -EINVAL;
+
+	if (xc5000_is_firmware_loaded(fe) != XC_RESULT_SUCCESS) {
+		if (xc_load_fw_and_init_tuner(fe) != XC_RESULT_SUCCESS) {
+			dprintk(1, "Unable to load firmware and init tuner\n");
+			return -EINVAL;
+		}
+	}
+
+	switch (params->mode) {
+	case V4L2_TUNER_RADIO:
+		ret = xc5000_set_radio_freq(fe, params);
+		break;
+	case V4L2_TUNER_ANALOG_TV:
+	case V4L2_TUNER_DIGITAL_TV:
+		ret = xc5000_set_tv_freq(fe, params);
+		break;
+	}
+
+	return ret;
+}
+
+
 static int xc5000_get_frequency(struct dvb_frontend *fe, u32 *freq)
 {
 	struct xc5000_priv *priv = fe->tuner_priv;
@@ -1000,6 +1082,9 @@ struct dvb_frontend *xc5000_attach(struct dvb_frontend *fe,
 		priv->if_khz = cfg->if_khz;
 	}
 
+	if (priv->radio_input == 0)
+		priv->radio_input = cfg->radio_input;
+
 	/* Check if firmware has been loaded. It is possible that another
 	   instance of the driver has loaded the firmware.
 	 */
diff --git a/drivers/media/common/tuners/xc5000.h b/drivers/media/common/tuners/xc5000.h
index f4c146698a00..e6d7236c9ea1 100644
--- a/drivers/media/common/tuners/xc5000.h
+++ b/drivers/media/common/tuners/xc5000.h
@@ -30,11 +30,17 @@ struct i2c_adapter;
 struct xc5000_config {
 	u8   i2c_address;
 	u32  if_khz;
+	u8   radio_input;
 };
 
 /* xc5000 callback command */
 #define XC5000_TUNER_RESET		0
 
+/* Possible Radio inputs */
+#define XC5000_RADIO_NOT_CONFIGURED		0
+#define XC5000_RADIO_FM1			1
+#define XC5000_RADIO_FM2			2
+
 /* For each bridge framework, when it attaches either analog or digital,
  * it has to store a reference back to its _core equivalent structure,
  * so that it can service the hardware by steering gpio's etc.
diff --git a/drivers/media/dvb/Kconfig b/drivers/media/dvb/Kconfig
index 35d0817126e9..cf8f65f309da 100644
--- a/drivers/media/dvb/Kconfig
+++ b/drivers/media/dvb/Kconfig
@@ -72,6 +72,10 @@ comment "Supported Earthsoft PT1 Adapters"
 	depends on DVB_CORE && PCI && I2C
 source "drivers/media/dvb/pt1/Kconfig"
 
+comment "Supported Mantis Adapters"
+	depends on DVB_CORE && PCI && I2C
+	source "drivers/media/dvb/mantis/Kconfig"
+
 comment "Supported DVB Frontends"
 	depends on DVB_CORE
 source "drivers/media/dvb/frontends/Kconfig"
diff --git a/drivers/media/dvb/Makefile b/drivers/media/dvb/Makefile
index 16d262ddb45d..c12922c3659b 100644
--- a/drivers/media/dvb/Makefile
+++ b/drivers/media/dvb/Makefile
@@ -2,6 +2,18 @@
 # Makefile for the kernel multimedia device drivers.
 #
 
-obj-y        := dvb-core/ frontends/ ttpci/ ttusb-dec/ ttusb-budget/ b2c2/ bt8xx/ dvb-usb/ pluto2/ siano/ dm1105/ pt1/
+obj-y        := dvb-core/	\
+		frontends/	\
+		ttpci/		\
+		ttusb-dec/	\
+		ttusb-budget/	\
+		b2c2/		\
+		bt8xx/		\
+		dvb-usb/	\
+		pluto2/		\
+		siano/		\
+		dm1105/		\
+		pt1/		\
+		mantis/
 
 obj-$(CONFIG_DVB_FIREDTV)	+= firewire/
diff --git a/drivers/media/dvb/bt8xx/dvb-bt8xx.c b/drivers/media/dvb/bt8xx/dvb-bt8xx.c
index b1857c19bbd2..78fc469f0f69 100644
--- a/drivers/media/dvb/bt8xx/dvb-bt8xx.c
+++ b/drivers/media/dvb/bt8xx/dvb-bt8xx.c
@@ -215,7 +215,7 @@ static int cx24108_tuner_set_params(struct dvb_frontend* fe, struct dvb_frontend
 		freq = 2150000; /* satellite IF is 950..2150MHz */
 
 	/* decide which VCO to use for the input frequency */
-	for(i = 1; (i < ARRAY_SIZE(osci)) && (osci[i] < freq); i++);
+	for(i = 1; (i < ARRAY_SIZE(osci) - 1) && (osci[i] < freq); i++);
 	printk("cx24108 debug: select vco #%d (f=%d)\n",i,freq);
 	band=bandsel[i];
 	/* the gain values must be set by SetSymbolrate */
diff --git a/drivers/media/dvb/dm1105/dm1105.c b/drivers/media/dvb/dm1105/dm1105.c
index 2d099e271751..f0f483ac8b89 100644
--- a/drivers/media/dvb/dm1105/dm1105.c
+++ b/drivers/media/dvb/dm1105/dm1105.c
@@ -510,7 +510,7 @@ static void dm1105_emit_key(struct work_struct *work)
 
 	data = (ircom >> 8) & 0x7f;
 
-	ir_input_keydown(ir->input_dev, &ir->ir, data, data);
+	ir_input_keydown(ir->input_dev, &ir->ir, data);
 	ir_input_nokey(ir->input_dev, &ir->ir);
 }
 
@@ -589,7 +589,12 @@ int __devinit dm1105_ir_init(struct dm1105dvb *dm1105)
 	snprintf(dm1105->ir.input_phys, sizeof(dm1105->ir.input_phys),
 		"pci-%s/ir0", pci_name(dm1105->pdev));
 
-	ir_input_init(input_dev, &dm1105->ir.ir, ir_type, ir_codes);
+	err = ir_input_init(input_dev, &dm1105->ir.ir, ir_type);
+	if (err < 0) {
+		input_free_device(input_dev);
+		return err;
+	}
+
 	input_dev->name = "DVB on-card IR receiver";
 	input_dev->phys = dm1105->ir.input_phys;
 	input_dev->id.bustype = BUS_PCI;
@@ -606,19 +611,14 @@ int __devinit dm1105_ir_init(struct dm1105dvb *dm1105)
 
 	INIT_WORK(&dm1105->ir.work, dm1105_emit_key);
 
-	err = input_register_device(input_dev);
-	if (err) {
-		input_free_device(input_dev);
-		return err;
-	}
+	err = ir_input_register(input_dev, ir_codes);
 
-	return 0;
+	return err;
 }
 
 void __devexit dm1105_ir_exit(struct dm1105dvb *dm1105)
 {
-	input_unregister_device(dm1105->ir.input_dev);
-
+	ir_input_unregister(dm1105->ir.input_dev);
 }
 
 static int __devinit dm1105dvb_hw_init(struct dm1105dvb *dm1105dvb)
diff --git a/drivers/media/dvb/dvb-core/dvb_demux.c b/drivers/media/dvb/dvb-core/dvb_demux.c
index 91c537bca8ad..b78cfb7d1897 100644
--- a/drivers/media/dvb/dvb-core/dvb_demux.c
+++ b/drivers/media/dvb/dvb-core/dvb_demux.c
@@ -30,6 +30,7 @@
 #include <linux/string.h>
 #include <linux/crc32.h>
 #include <asm/uaccess.h>
+#include <asm/div64.h>
 
 #include "dvb_demux.h"
 
@@ -44,6 +45,11 @@ module_param(dvb_demux_tscheck, int, 0644);
 MODULE_PARM_DESC(dvb_demux_tscheck,
 		"enable transport stream continuity and TEI check");
 
+static int dvb_demux_speedcheck;
+module_param(dvb_demux_speedcheck, int, 0644);
+MODULE_PARM_DESC(dvb_demux_speedcheck,
+		"enable transport stream speed check");
+
 #define dprintk_tscheck(x...) do {                              \
 		if (dvb_demux_tscheck && printk_ratelimit())    \
 			printk(x);                              \
@@ -387,6 +393,39 @@ static void dvb_dmx_swfilter_packet(struct dvb_demux *demux, const u8 *buf)
 	u16 pid = ts_pid(buf);
 	int dvr_done = 0;
 
+	if (dvb_demux_speedcheck) {
+		struct timespec cur_time, delta_time;
+		u64 speed_bytes, speed_timedelta;
+
+		demux->speed_pkts_cnt++;
+
+		/* show speed every SPEED_PKTS_INTERVAL packets */
+		if (!(demux->speed_pkts_cnt % SPEED_PKTS_INTERVAL)) {
+			cur_time = current_kernel_time();
+
+			if (demux->speed_last_time.tv_sec != 0 &&
+					demux->speed_last_time.tv_nsec != 0) {
+				delta_time = timespec_sub(cur_time,
+						demux->speed_last_time);
+				speed_bytes = (u64)demux->speed_pkts_cnt
+					* 188 * 8;
+				/* convert to 1024 basis */
+				speed_bytes = 1000 * div64_u64(speed_bytes,
+						1024);
+				speed_timedelta =
+					(u64)timespec_to_ns(&delta_time);
+				speed_timedelta = div64_u64(speed_timedelta,
+						1000000); /* nsec -> usec */
+				printk(KERN_INFO "TS speed %llu Kbits/sec \n",
+						div64_u64(speed_bytes,
+							speed_timedelta));
+			};
+
+			demux->speed_last_time = cur_time;
+			demux->speed_pkts_cnt = 0;
+		};
+	};
+
 	if (dvb_demux_tscheck) {
 		if (!demux->cnt_storage)
 			demux->cnt_storage = vmalloc(MAX_PID + 1);
diff --git a/drivers/media/dvb/dvb-core/dvb_demux.h b/drivers/media/dvb/dvb-core/dvb_demux.h
index 2fe05d03240d..a7d876fd02dd 100644
--- a/drivers/media/dvb/dvb-core/dvb_demux.h
+++ b/drivers/media/dvb/dvb-core/dvb_demux.h
@@ -44,6 +44,8 @@
 
 #define MAX_PID 0x1fff
 
+#define SPEED_PKTS_INTERVAL 50000
+
 struct dvb_demux_filter {
 	struct dmx_section_filter filter;
 	u8 maskandmode[DMX_MAX_FILTER_SIZE];
@@ -131,6 +133,9 @@ struct dvb_demux {
 	spinlock_t lock;
 
 	uint8_t *cnt_storage; /* for TS continuity check */
+
+	struct timespec speed_last_time; /* for TS speed check */
+	uint32_t speed_pkts_cnt; /* for TS speed check */
 };
 
 int dvb_dmx_init(struct dvb_demux *dvbdemux);
diff --git a/drivers/media/dvb/dvb-core/dvb_frontend.c b/drivers/media/dvb/dvb-core/dvb_frontend.c
index 98082416aa52..07461222a7f5 100644
--- a/drivers/media/dvb/dvb-core/dvb_frontend.c
+++ b/drivers/media/dvb/dvb-core/dvb_frontend.c
@@ -895,104 +895,27 @@ static int dvb_frontend_clear_cache(struct dvb_frontend *fe)
 }
 
 static struct dtv_cmds_h dtv_cmds[] = {
-	[DTV_TUNE] = {
-		.name	= "DTV_TUNE",
-		.cmd	= DTV_TUNE,
-		.set	= 1,
-	},
-	[DTV_CLEAR] = {
-		.name	= "DTV_CLEAR",
-		.cmd	= DTV_CLEAR,
-		.set	= 1,
-	},
+	_DTV_CMD(DTV_TUNE, 1, 0),
+	_DTV_CMD(DTV_CLEAR, 1, 0),
 
 	/* Set */
-	[DTV_FREQUENCY] = {
-		.name	= "DTV_FREQUENCY",
-		.cmd	= DTV_FREQUENCY,
-		.set	= 1,
-	},
-	[DTV_BANDWIDTH_HZ] = {
-		.name	= "DTV_BANDWIDTH_HZ",
-		.cmd	= DTV_BANDWIDTH_HZ,
-		.set	= 1,
-	},
-	[DTV_MODULATION] = {
-		.name	= "DTV_MODULATION",
-		.cmd	= DTV_MODULATION,
-		.set	= 1,
-	},
-	[DTV_INVERSION] = {
-		.name	= "DTV_INVERSION",
-		.cmd	= DTV_INVERSION,
-		.set	= 1,
-	},
-	[DTV_DISEQC_MASTER] = {
-		.name	= "DTV_DISEQC_MASTER",
-		.cmd	= DTV_DISEQC_MASTER,
-		.set	= 1,
-		.buffer	= 1,
-	},
-	[DTV_SYMBOL_RATE] = {
-		.name	= "DTV_SYMBOL_RATE",
-		.cmd	= DTV_SYMBOL_RATE,
-		.set	= 1,
-	},
-	[DTV_INNER_FEC] = {
-		.name	= "DTV_INNER_FEC",
-		.cmd	= DTV_INNER_FEC,
-		.set	= 1,
-	},
-	[DTV_VOLTAGE] = {
-		.name	= "DTV_VOLTAGE",
-		.cmd	= DTV_VOLTAGE,
-		.set	= 1,
-	},
-	[DTV_TONE] = {
-		.name	= "DTV_TONE",
-		.cmd	= DTV_TONE,
-		.set	= 1,
-	},
-	[DTV_PILOT] = {
-		.name	= "DTV_PILOT",
-		.cmd	= DTV_PILOT,
-		.set	= 1,
-	},
-	[DTV_ROLLOFF] = {
-		.name	= "DTV_ROLLOFF",
-		.cmd	= DTV_ROLLOFF,
-		.set	= 1,
-	},
-	[DTV_DELIVERY_SYSTEM] = {
-		.name	= "DTV_DELIVERY_SYSTEM",
-		.cmd	= DTV_DELIVERY_SYSTEM,
-		.set	= 1,
-	},
-	[DTV_HIERARCHY] = {
-		.name	= "DTV_HIERARCHY",
-		.cmd	= DTV_HIERARCHY,
-		.set	= 1,
-	},
-	[DTV_CODE_RATE_HP] = {
-		.name	= "DTV_CODE_RATE_HP",
-		.cmd	= DTV_CODE_RATE_HP,
-		.set	= 1,
-	},
-	[DTV_CODE_RATE_LP] = {
-		.name	= "DTV_CODE_RATE_LP",
-		.cmd	= DTV_CODE_RATE_LP,
-		.set	= 1,
-	},
-	[DTV_GUARD_INTERVAL] = {
-		.name	= "DTV_GUARD_INTERVAL",
-		.cmd	= DTV_GUARD_INTERVAL,
-		.set	= 1,
-	},
-	[DTV_TRANSMISSION_MODE] = {
-		.name	= "DTV_TRANSMISSION_MODE",
-		.cmd	= DTV_TRANSMISSION_MODE,
-		.set	= 1,
-	},
+	_DTV_CMD(DTV_FREQUENCY, 1, 0),
+	_DTV_CMD(DTV_BANDWIDTH_HZ, 1, 0),
+	_DTV_CMD(DTV_MODULATION, 1, 0),
+	_DTV_CMD(DTV_INVERSION, 1, 0),
+	_DTV_CMD(DTV_DISEQC_MASTER, 1, 1),
+	_DTV_CMD(DTV_SYMBOL_RATE, 1, 0),
+	_DTV_CMD(DTV_INNER_FEC, 1, 0),
+	_DTV_CMD(DTV_VOLTAGE, 1, 0),
+	_DTV_CMD(DTV_TONE, 1, 0),
+	_DTV_CMD(DTV_PILOT, 1, 0),
+	_DTV_CMD(DTV_ROLLOFF, 1, 0),
+	_DTV_CMD(DTV_DELIVERY_SYSTEM, 1, 0),
+	_DTV_CMD(DTV_HIERARCHY, 1, 0),
+	_DTV_CMD(DTV_CODE_RATE_HP, 1, 0),
+	_DTV_CMD(DTV_CODE_RATE_LP, 1, 0),
+	_DTV_CMD(DTV_GUARD_INTERVAL, 1, 0),
+	_DTV_CMD(DTV_TRANSMISSION_MODE, 1, 0),
 
 	_DTV_CMD(DTV_ISDBT_PARTIAL_RECEPTION, 1, 0),
 	_DTV_CMD(DTV_ISDBT_SOUND_BROADCASTING, 1, 0),
@@ -1035,43 +958,13 @@ static struct dtv_cmds_h dtv_cmds[] = {
 	_DTV_CMD(DTV_ISDBS_TS_ID, 1, 0),
 
 	/* Get */
-	[DTV_DISEQC_SLAVE_REPLY] = {
-		.name	= "DTV_DISEQC_SLAVE_REPLY",
-		.cmd	= DTV_DISEQC_SLAVE_REPLY,
-		.set	= 0,
-		.buffer	= 1,
-	},
-
-	[DTV_API_VERSION] = {
-		.name	= "DTV_API_VERSION",
-		.cmd	= DTV_API_VERSION,
-		.set	= 0,
-	},
-	[DTV_CODE_RATE_HP] = {
-		.name	= "DTV_CODE_RATE_HP",
-		.cmd	= DTV_CODE_RATE_HP,
-		.set	= 0,
-	},
-	[DTV_CODE_RATE_LP] = {
-		.name	= "DTV_CODE_RATE_LP",
-		.cmd	= DTV_CODE_RATE_LP,
-		.set	= 0,
-	},
-	[DTV_GUARD_INTERVAL] = {
-		.name	= "DTV_GUARD_INTERVAL",
-		.cmd	= DTV_GUARD_INTERVAL,
-		.set	= 0,
-	},
-	[DTV_TRANSMISSION_MODE] = {
-		.name	= "DTV_TRANSMISSION_MODE",
-		.cmd	= DTV_TRANSMISSION_MODE,
-		.set	= 0,
-	},
-	[DTV_HIERARCHY] = {
-		.name	= "DTV_HIERARCHY",
-		.cmd	= DTV_HIERARCHY,
-		.set	= 0,
-	},
+	_DTV_CMD(DTV_DISEQC_SLAVE_REPLY, 0, 1),
+	_DTV_CMD(DTV_API_VERSION, 0, 0),
+	_DTV_CMD(DTV_CODE_RATE_HP, 0, 0),
+	_DTV_CMD(DTV_CODE_RATE_LP, 0, 0),
+	_DTV_CMD(DTV_GUARD_INTERVAL, 0, 0),
+	_DTV_CMD(DTV_TRANSMISSION_MODE, 0, 0),
+	_DTV_CMD(DTV_HIERARCHY, 0, 0),
 };
 
 static void dtv_property_dump(struct dtv_property *tvp)
@@ -1712,7 +1605,18 @@ static int dvb_frontend_ioctl_legacy(struct inode *inode, struct file *file,
 	struct dvb_device *dvbdev = file->private_data;
 	struct dvb_frontend *fe = dvbdev->priv;
 	struct dvb_frontend_private *fepriv = fe->frontend_priv;
-	int err = -EOPNOTSUPP;
+	int cb_err, err = -EOPNOTSUPP;
+
+	if (fe->dvb->fe_ioctl_override) {
+		cb_err = fe->dvb->fe_ioctl_override(fe, cmd, parg,
+						    DVB_FE_IOCTL_PRE);
+		if (cb_err < 0)
+			return cb_err;
+		if (cb_err > 0)
+			return 0;
+		/* fe_ioctl_override returning 0 allows
+		 * dvb-core to continue handling the ioctl */
+	}
 
 	switch (cmd) {
 	case FE_GET_INFO: {
@@ -1978,6 +1882,13 @@ static int dvb_frontend_ioctl_legacy(struct inode *inode, struct file *file,
 		break;
 	};
 
+	if (fe->dvb->fe_ioctl_override) {
+		cb_err = fe->dvb->fe_ioctl_override(fe, cmd, parg,
+						    DVB_FE_IOCTL_POST);
+		if (cb_err < 0)
+			return cb_err;
+	}
+
 	return err;
 }
 
diff --git a/drivers/media/dvb/dvb-core/dvb_frontend.h b/drivers/media/dvb/dvb-core/dvb_frontend.h
index 810f07d63246..52e4ce4304ee 100644
--- a/drivers/media/dvb/dvb-core/dvb_frontend.h
+++ b/drivers/media/dvb/dvb-core/dvb_frontend.h
@@ -160,7 +160,7 @@ struct tuner_state {
  * search callback possible return status
  *
  * DVBFE_ALGO_SEARCH_SUCCESS
- * The frontend search algorithm completed and returned succesfully
+ * The frontend search algorithm completed and returned successfully
  *
  * DVBFE_ALGO_SEARCH_ASLEEP
  * The frontend search algorithm is sleeping
diff --git a/drivers/media/dvb/dvb-core/dvb_net.c b/drivers/media/dvb/dvb-core/dvb_net.c
index 0241a7c5c34a..8b8558fcb042 100644
--- a/drivers/media/dvb/dvb-core/dvb_net.c
+++ b/drivers/media/dvb/dvb-core/dvb_net.c
@@ -1396,7 +1396,7 @@ static int dvb_net_do_ioctl(struct inode *inode, struct file *file,
 		return ret;
 	}
 
-	/* binary compatiblity cruft */
+	/* binary compatibility cruft */
 	case __NET_ADD_IF_OLD:
 	{
 		struct __dvb_net_if_old *dvbnetif = parg;
diff --git a/drivers/media/dvb/dvb-core/dvbdev.h b/drivers/media/dvb/dvb-core/dvbdev.h
index 01fc70484743..f7b499d4a3c0 100644
--- a/drivers/media/dvb/dvb-core/dvbdev.h
+++ b/drivers/media/dvb/dvb-core/dvbdev.h
@@ -54,6 +54,8 @@
 	module_param_array(adapter_nr, short, NULL, 0444); \
 	MODULE_PARM_DESC(adapter_nr, "DVB adapter numbers")
 
+struct dvb_frontend;
+
 struct dvb_adapter {
 	int num;
 	struct list_head list_head;
@@ -69,6 +71,32 @@ struct dvb_adapter {
 	int mfe_shared;			/* indicates mutually exclusive frontends */
 	struct dvb_device *mfe_dvbdev;	/* frontend device in use */
 	struct mutex mfe_lock;		/* access lock for thread creation */
+
+	/* Allow the adapter/bridge driver to perform an action before and/or
+	 * after the core handles an ioctl:
+	 *
+	 * DVB_FE_IOCTL_PRE indicates that the ioctl has not yet been handled.
+	 * DVB_FE_IOCTL_POST indicates that the ioctl has been handled.
+	 *
+	 * When DVB_FE_IOCTL_PRE is passed to the callback as the stage arg:
+	 *
+	 * return 0 to allow dvb-core to handle the ioctl.
+	 * return a positive int to prevent dvb-core from handling the ioctl,
+	 * 	and exit without error.
+	 * return a negative int to prevent dvb-core from handling the ioctl,
+	 * 	and return that value as an error.
+	 *
+	 * When DVB_FE_IOCTL_POST is passed to the callback as the stage arg:
+	 *
+	 * return 0 to allow the dvb_frontend ioctl handler to exit normally.
+	 * return a negative int to cause the dvb_frontend ioctl handler to
+	 * 	return that value as an error.
+	 */
+#define DVB_FE_IOCTL_PRE 0
+#define DVB_FE_IOCTL_POST 1
+	int (*fe_ioctl_override)(struct dvb_frontend *fe,
+				 unsigned int cmd, void *parg,
+				 unsigned int stage);
 };
 
 
diff --git a/drivers/media/dvb/dvb-usb/Kconfig b/drivers/media/dvb/dvb-usb/Kconfig
index 0e4b97fba384..1b249897c9fb 100644
--- a/drivers/media/dvb/dvb-usb/Kconfig
+++ b/drivers/media/dvb/dvb-usb/Kconfig
@@ -265,9 +265,13 @@ config DVB_USB_DW2102
 	select DVB_TDA10021 if !DVB_FE_CUSTOMISE
 	select DVB_MT312 if !DVB_FE_CUSTOMISE
 	select DVB_ZL10039 if !DVB_FE_CUSTOMISE
+	select DVB_DS3000 if !DVB_FE_CUSTOMISE
+	select DVB_STB6100 if !DVB_FE_CUSTOMISE
+	select DVB_STV6110 if !DVB_FE_CUSTOMISE
+	select DVB_STV0900 if !DVB_FE_CUSTOMISE
 	help
-	  Say Y here to support the DvbWorld DVB-S/S2 USB2.0 receivers
-	  and the TeVii S650, S630.
+	  Say Y here to support the DvbWorld, TeVii, Prof DVB-S/S2 USB2.0
+	  receivers.
 
 config DVB_USB_CINERGY_T2
 	tristate "Terratec CinergyT2/qanu USB 2.0 DVB-T receiver"
@@ -322,3 +326,11 @@ config DVB_USB_FRIIO
 	depends on DVB_USB
 	help
 	  Say Y here to support the Japanese DTV receiver Friio.
+
+config DVB_USB_EC168
+	tristate "E3C EC168 DVB-T USB2.0 support"
+	depends on DVB_USB && EXPERIMENTAL
+	select DVB_EC100
+	select MEDIA_TUNER_MXL5005S if !MEDIA_TUNER_CUSTOMISE
+	help
+	  Say Y here to support the E3C EC168 DVB-T USB2.0 receiver.
diff --git a/drivers/media/dvb/dvb-usb/Makefile b/drivers/media/dvb/dvb-usb/Makefile
index 85b83a43d55d..72c92cb69a22 100644
--- a/drivers/media/dvb/dvb-usb/Makefile
+++ b/drivers/media/dvb/dvb-usb/Makefile
@@ -82,6 +82,9 @@ obj-$(CONFIG_DVB_USB_CE6230) += dvb-usb-ce6230.o
 dvb-usb-friio-objs = friio.o friio-fe.o
 obj-$(CONFIG_DVB_USB_FRIIO) += dvb-usb-friio.o
 
+dvb-usb-ec168-objs = ec168.o
+obj-$(CONFIG_DVB_USB_EC168) += dvb-usb-ec168.o
+
 EXTRA_CFLAGS += -Idrivers/media/dvb/dvb-core/ -Idrivers/media/dvb/frontends/
 # due to tuner-xc3028
 EXTRA_CFLAGS += -Idrivers/media/common/tuners
diff --git a/drivers/media/dvb/dvb-usb/af9015.c b/drivers/media/dvb/dvb-usb/af9015.c
index cf042b309b46..8b60a601fb82 100644
--- a/drivers/media/dvb/dvb-usb/af9015.c
+++ b/drivers/media/dvb/dvb-usb/af9015.c
@@ -730,7 +730,7 @@ static int af9015_read_config(struct usb_device *udev)
 		goto error;
 	deb_info("%s: IR mode:%d\n", __func__, val);
 	for (i = 0; i < af9015_properties_count; i++) {
-		if (val == AF9015_IR_MODE_DISABLED || val == 0x04) {
+		if (val == AF9015_IR_MODE_DISABLED) {
 			af9015_properties[i].rc_key_map = NULL;
 			af9015_properties[i].rc_key_map_size  = 0;
 		} else if (dvb_usb_af9015_remote) {
@@ -868,6 +868,16 @@ static int af9015_read_config(struct usb_device *udev)
 				af9015_config.ir_table_size =
 				  ARRAY_SIZE(af9015_ir_table_avermedia);
 				break;
+			case USB_VID_MSI_2:
+				af9015_properties[i].rc_key_map =
+				  af9015_rc_keys_msi_digivox_iii;
+				af9015_properties[i].rc_key_map_size =
+				  ARRAY_SIZE(af9015_rc_keys_msi_digivox_iii);
+				af9015_config.ir_table =
+				  af9015_ir_table_msi_digivox_iii;
+				af9015_config.ir_table_size =
+				  ARRAY_SIZE(af9015_ir_table_msi_digivox_iii);
+				break;
 			}
 		}
 	}
@@ -1283,6 +1293,8 @@ static struct usb_device_id af9015_usb_table[] = {
 	{USB_DEVICE(USB_VID_KWORLD_2,  USB_PID_KWORLD_MC810)},
 	{USB_DEVICE(USB_VID_KYE,       USB_PID_GENIUS_TVGO_DVB_T03)},
 /* 25 */{USB_DEVICE(USB_VID_KWORLD_2,  USB_PID_KWORLD_399U_2)},
+	{USB_DEVICE(USB_VID_KWORLD_2,  USB_PID_KWORLD_PC160_T)},
+	{USB_DEVICE(USB_VID_KWORLD_2,  USB_PID_SVEON_STV20)},
 	{0},
 };
 MODULE_DEVICE_TABLE(usb, af9015_usb_table);
@@ -1296,7 +1308,7 @@ static struct dvb_usb_device_properties af9015_properties[] = {
 		.firmware = "dvb-usb-af9015.fw",
 		.no_reconnect = 1,
 
-		.size_of_priv = sizeof(struct af9015_state), \
+		.size_of_priv = sizeof(struct af9015_state),
 
 		.num_adapters = 2,
 		.adapter = {
@@ -1402,7 +1414,7 @@ static struct dvb_usb_device_properties af9015_properties[] = {
 		.firmware = "dvb-usb-af9015.fw",
 		.no_reconnect = 1,
 
-		.size_of_priv = sizeof(struct af9015_state), \
+		.size_of_priv = sizeof(struct af9015_state),
 
 		.num_adapters = 2,
 		.adapter = {
@@ -1508,7 +1520,7 @@ static struct dvb_usb_device_properties af9015_properties[] = {
 		.firmware = "dvb-usb-af9015.fw",
 		.no_reconnect = 1,
 
-		.size_of_priv = sizeof(struct af9015_state), \
+		.size_of_priv = sizeof(struct af9015_state),
 
 		.num_adapters = 2,
 		.adapter = {
@@ -1554,7 +1566,7 @@ static struct dvb_usb_device_properties af9015_properties[] = {
 
 		.i2c_algo = &af9015_i2c_algo,
 
-		.num_device_descs = 4, /* max 9 */
+		.num_device_descs = 6, /* max 9 */
 		.devices = {
 			{
 				.name = "AverMedia AVerTV Volar GPS 805 (A805)",
@@ -1577,6 +1589,17 @@ static struct dvb_usb_device_properties af9015_properties[] = {
 				.cold_ids = {&af9015_usb_table[24], NULL},
 				.warm_ids = {NULL},
 			},
+			{
+				.name = "KWorld PlusTV DVB-T PCI Pro Card " \
+					"(DVB-T PC160-T)",
+				.cold_ids = {&af9015_usb_table[26], NULL},
+				.warm_ids = {NULL},
+			},
+			{
+				.name = "Sveon STV20 Tuner USB DVB-T HDTV",
+				.cold_ids = {&af9015_usb_table[27], NULL},
+				.warm_ids = {NULL},
+			},
 		}
 	},
 };
diff --git a/drivers/media/dvb/dvb-usb/af9015.h b/drivers/media/dvb/dvb-usb/af9015.h
index c41f30e4a1b8..931c8515830d 100644
--- a/drivers/media/dvb/dvb-usb/af9015.h
+++ b/drivers/media/dvb/dvb-usb/af9015.h
@@ -95,6 +95,7 @@ enum af9015_ir_mode {
 	AF9015_IR_MODE_HID,
 	AF9015_IR_MODE_RLC,
 	AF9015_IR_MODE_RC6,
+	AF9015_IR_MODE_POLLING, /* just guess */
 };
 
 struct af9015_state {
@@ -119,6 +120,7 @@ enum af9015_remote {
 /* 5 */	AF9015_REMOTE_AVERMEDIA_KS,
 };
 
+/* LeadTek - Y04G0051 */
 /* Leadtek WinFast DTV Dongle Gold */
 static struct dvb_usb_rc_key af9015_rc_keys_leadtek[] = {
 	{ 0x001e, KEY_1 },
@@ -131,64 +133,96 @@ static struct dvb_usb_rc_key af9015_rc_keys_leadtek[] = {
 	{ 0x0025, KEY_8 },
 	{ 0x0026, KEY_9 },
 	{ 0x0027, KEY_0 },
-	{ 0x0028, KEY_ENTER },
-	{ 0x004f, KEY_VOLUMEUP },
-	{ 0x0050, KEY_VOLUMEDOWN },
-	{ 0x0051, KEY_CHANNELDOWN },
-	{ 0x0052, KEY_CHANNELUP },
+	{ 0x0028, KEY_OK },
+	{ 0x004f, KEY_RIGHT },
+	{ 0x0050, KEY_LEFT },
+	{ 0x0051, KEY_DOWN },
+	{ 0x0052, KEY_UP },
+	{ 0x011a, KEY_POWER2 },
+	{ 0x04b4, KEY_TV },
+	{ 0x04b3, KEY_RED },
+	{ 0x04b2, KEY_GREEN },
+	{ 0x04b1, KEY_YELLOW },
+	{ 0x04b0, KEY_BLUE },
+	{ 0x003d, KEY_TEXT },
+	{ 0x0113, KEY_SLEEP },
+	{ 0x0010, KEY_MUTE },
+	{ 0x0105, KEY_ESC },
+	{ 0x0009, KEY_SCREEN },
+	{ 0x010f, KEY_MENU },
+	{ 0x003f, KEY_CHANNEL },
+	{ 0x0013, KEY_REWIND },
+	{ 0x0012, KEY_PLAY },
+	{ 0x0011, KEY_FASTFORWARD },
+	{ 0x0005, KEY_PREVIOUS },
+	{ 0x0029, KEY_STOP },
+	{ 0x002b, KEY_NEXT },
+	{ 0x0041, KEY_EPG },
+	{ 0x0019, KEY_VIDEO },
+	{ 0x0016, KEY_AUDIO },
+	{ 0x0037, KEY_DOT },
+	{ 0x002a, KEY_AGAIN },
+	{ 0x002c, KEY_CAMERA },
+	{ 0x003c, KEY_NEW },
+	{ 0x0115, KEY_RECORD },
+	{ 0x010b, KEY_TIME },
+	{ 0x0043, KEY_VOLUMEUP },
+	{ 0x0042, KEY_VOLUMEDOWN },
+	{ 0x004b, KEY_CHANNELUP },
+	{ 0x004e, KEY_CHANNELDOWN },
 };
 
 static u8 af9015_ir_table_leadtek[] = {
-	0x03, 0xfc, 0x00, 0xff, 0x1a, 0x01, 0x00,
-	0x03, 0xfc, 0x56, 0xa9, 0x00, 0x00, 0x00,
-	0x03, 0xfc, 0x4b, 0xb4, 0x00, 0x00, 0x00,
-	0x03, 0xfc, 0x4c, 0xb3, 0xb2, 0x04, 0x00,
-	0x03, 0xfc, 0x4d, 0xb2, 0x00, 0x00, 0x00,
-	0x03, 0xfc, 0x4e, 0xb1, 0x00, 0x00, 0x00,
-	0x03, 0xfc, 0x1f, 0xe0, 0x3d, 0x00, 0x00,
-	0x03, 0xfc, 0x40, 0xbf, 0x13, 0x01, 0x00,
-	0x03, 0xfc, 0x14, 0xeb, 0x10, 0x00, 0x00,
-	0x03, 0xfc, 0x49, 0xb6, 0x05, 0x01, 0x00,
-	0x03, 0xfc, 0x50, 0xaf, 0x29, 0x00, 0x00,
-	0x03, 0xfc, 0x0c, 0xf3, 0x52, 0x00, 0x00,
-	0x03, 0xfc, 0x03, 0xfc, 0x09, 0x00, 0x00,
-	0x03, 0xfc, 0x08, 0xf7, 0x50, 0x00, 0x00,
-	0x03, 0xfc, 0x13, 0xec, 0x28, 0x00, 0x00,
-	0x03, 0xfc, 0x04, 0xfb, 0x4f, 0x00, 0x00,
-	0x03, 0xfc, 0x4f, 0xb0, 0x0f, 0x01, 0x00,
-	0x03, 0xfc, 0x10, 0xef, 0x51, 0x00, 0x00,
-	0x03, 0xfc, 0x51, 0xae, 0x3f, 0x00, 0x00,
-	0x03, 0xfc, 0x42, 0xbd, 0x13, 0x00, 0x00,
-	0x03, 0xfc, 0x43, 0xbc, 0x00, 0x00, 0x00,
-	0x03, 0xfc, 0x44, 0xbb, 0x11, 0x00, 0x00,
-	0x03, 0xfc, 0x52, 0xad, 0x19, 0x00, 0x00,
-	0x03, 0xfc, 0x54, 0xab, 0x05, 0x00, 0x00,
-	0x03, 0xfc, 0x46, 0xb9, 0x29, 0x00, 0x00,
-	0x03, 0xfc, 0x55, 0xaa, 0x2b, 0x00, 0x00,
-	0x03, 0xfc, 0x53, 0xac, 0x41, 0x00, 0x00,
-	0x03, 0xfc, 0x05, 0xfa, 0x1e, 0x00, 0x00,
-	0x03, 0xfc, 0x06, 0xf9, 0x1f, 0x00, 0x00,
-	0x03, 0xfc, 0x07, 0xf8, 0x20, 0x00, 0x00,
-	0x03, 0xfc, 0x1e, 0xe1, 0x19, 0x00, 0x00,
-	0x03, 0xfc, 0x09, 0xf6, 0x21, 0x00, 0x00,
-	0x03, 0xfc, 0x0a, 0xf5, 0x22, 0x00, 0x00,
-	0x03, 0xfc, 0x0b, 0xf4, 0x23, 0x00, 0x00,
-	0x03, 0xfc, 0x1b, 0xe4, 0x16, 0x00, 0x00,
-	0x03, 0xfc, 0x0d, 0xf2, 0x24, 0x00, 0x00,
-	0x03, 0xfc, 0x0e, 0xf1, 0x25, 0x00, 0x00,
-	0x03, 0xfc, 0x0f, 0xf0, 0x26, 0x00, 0x00,
-	0x03, 0xfc, 0x16, 0xe9, 0x28, 0x00, 0x00,
-	0x03, 0xfc, 0x41, 0xbe, 0x37, 0x00, 0x00,
-	0x03, 0xfc, 0x12, 0xed, 0x27, 0x00, 0x00,
-	0x03, 0xfc, 0x11, 0xee, 0x2a, 0x00, 0x00,
-	0x03, 0xfc, 0x48, 0xb7, 0x2c, 0x00, 0x00,
-	0x03, 0xfc, 0x4a, 0xb5, 0x3c, 0x00, 0x00,
-	0x03, 0xfc, 0x47, 0xb8, 0x15, 0x01, 0x00,
-	0x03, 0xfc, 0x45, 0xba, 0x0b, 0x01, 0x00,
-	0x03, 0xfc, 0x5e, 0xa1, 0x43, 0x00, 0x00,
-	0x03, 0xfc, 0x5a, 0xa5, 0x42, 0x00, 0x00,
-	0x03, 0xfc, 0x5b, 0xa4, 0x4b, 0x00, 0x00,
-	0x03, 0xfc, 0x5f, 0xa0, 0x4e, 0x00, 0x00,
+	0x03, 0xfc, 0x00, 0xff, 0x1a, 0x01, 0x00, /* KEY_POWER2 */
+	0x03, 0xfc, 0x56, 0xa9, 0xb4, 0x04, 0x00, /* KEY_TV */
+	0x03, 0xfc, 0x4b, 0xb4, 0xb3, 0x04, 0x00, /* KEY_RED */
+	0x03, 0xfc, 0x4c, 0xb3, 0xb2, 0x04, 0x00, /* KEY_GREEN */
+	0x03, 0xfc, 0x4d, 0xb2, 0xb1, 0x04, 0x00, /* KEY_YELLOW */
+	0x03, 0xfc, 0x4e, 0xb1, 0xb0, 0x04, 0x00, /* KEY_BLUE */
+	0x03, 0xfc, 0x1f, 0xe0, 0x3d, 0x00, 0x00, /* KEY_TEXT */
+	0x03, 0xfc, 0x40, 0xbf, 0x13, 0x01, 0x00, /* KEY_SLEEP */
+	0x03, 0xfc, 0x14, 0xeb, 0x10, 0x00, 0x00, /* KEY_MUTE */
+	0x03, 0xfc, 0x49, 0xb6, 0x05, 0x01, 0x00, /* KEY_ESC */
+	0x03, 0xfc, 0x50, 0xaf, 0x29, 0x00, 0x00, /* KEY_STOP (1)*/
+	0x03, 0xfc, 0x0c, 0xf3, 0x52, 0x00, 0x00, /* KEY_UP */
+	0x03, 0xfc, 0x03, 0xfc, 0x09, 0x00, 0x00, /* KEY_SCREEN */
+	0x03, 0xfc, 0x08, 0xf7, 0x50, 0x00, 0x00, /* KEY_LEFT */
+	0x03, 0xfc, 0x13, 0xec, 0x28, 0x00, 0x00, /* KEY_OK (1) */
+	0x03, 0xfc, 0x04, 0xfb, 0x4f, 0x00, 0x00, /* KEY_RIGHT */
+	0x03, 0xfc, 0x4f, 0xb0, 0x0f, 0x01, 0x00, /* KEY_MENU */
+	0x03, 0xfc, 0x10, 0xef, 0x51, 0x00, 0x00, /* KEY_DOWN */
+	0x03, 0xfc, 0x51, 0xae, 0x3f, 0x00, 0x00, /* KEY_CHANNEL */
+	0x03, 0xfc, 0x42, 0xbd, 0x13, 0x00, 0x00, /* KEY_REWIND */
+	0x03, 0xfc, 0x43, 0xbc, 0x12, 0x00, 0x00, /* KEY_PLAY */
+	0x03, 0xfc, 0x44, 0xbb, 0x11, 0x00, 0x00, /* KEY_FASTFORWARD */
+	0x03, 0xfc, 0x52, 0xad, 0x19, 0x00, 0x00, /* KEY_VIDEO (1) */
+	0x03, 0xfc, 0x54, 0xab, 0x05, 0x00, 0x00, /* KEY_PREVIOUS */
+	0x03, 0xfc, 0x46, 0xb9, 0x29, 0x00, 0x00, /* KEY_STOP (2) */
+	0x03, 0xfc, 0x55, 0xaa, 0x2b, 0x00, 0x00, /* KEY_NEXT */
+	0x03, 0xfc, 0x53, 0xac, 0x41, 0x00, 0x00, /* KEY_EPG */
+	0x03, 0xfc, 0x05, 0xfa, 0x1e, 0x00, 0x00, /* KEY_1 */
+	0x03, 0xfc, 0x06, 0xf9, 0x1f, 0x00, 0x00, /* KEY_2 */
+	0x03, 0xfc, 0x07, 0xf8, 0x20, 0x00, 0x00, /* KEY_3 */
+	0x03, 0xfc, 0x1e, 0xe1, 0x19, 0x00, 0x00, /* KEY_VIDEO (2) */
+	0x03, 0xfc, 0x09, 0xf6, 0x21, 0x00, 0x00, /* KEY_4 */
+	0x03, 0xfc, 0x0a, 0xf5, 0x22, 0x00, 0x00, /* KEY_5 */
+	0x03, 0xfc, 0x0b, 0xf4, 0x23, 0x00, 0x00, /* KEY_6 */
+	0x03, 0xfc, 0x1b, 0xe4, 0x16, 0x00, 0x00, /* KEY_AUDIO */
+	0x03, 0xfc, 0x0d, 0xf2, 0x24, 0x00, 0x00, /* KEY_7 */
+	0x03, 0xfc, 0x0e, 0xf1, 0x25, 0x00, 0x00, /* KEY_8 */
+	0x03, 0xfc, 0x0f, 0xf0, 0x26, 0x00, 0x00, /* KEY_9 */
+	0x03, 0xfc, 0x16, 0xe9, 0x28, 0x00, 0x00, /* KEY_OK (2) */
+	0x03, 0xfc, 0x41, 0xbe, 0x37, 0x00, 0x00, /* KEY_DOT */
+	0x03, 0xfc, 0x12, 0xed, 0x27, 0x00, 0x00, /* KEY_0 */
+	0x03, 0xfc, 0x11, 0xee, 0x2a, 0x00, 0x00, /* KEY_AGAIN */
+	0x03, 0xfc, 0x48, 0xb7, 0x2c, 0x00, 0x00, /* KEY_CAMERA */
+	0x03, 0xfc, 0x4a, 0xb5, 0x3c, 0x00, 0x00, /* KEY_NEW */
+	0x03, 0xfc, 0x47, 0xb8, 0x15, 0x01, 0x00, /* KEY_RECORD */
+	0x03, 0xfc, 0x45, 0xba, 0x0b, 0x01, 0x00, /* KEY_TIME */
+	0x03, 0xfc, 0x5e, 0xa1, 0x43, 0x00, 0x00, /* KEY_VOLUMEUP */
+	0x03, 0xfc, 0x5a, 0xa5, 0x42, 0x00, 0x00, /* KEY_VOLUMEDOWN */
+	0x03, 0xfc, 0x5b, 0xa4, 0x4b, 0x00, 0x00, /* KEY_CHANNELUP */
+	0x03, 0xfc, 0x5f, 0xa0, 0x4e, 0x00, 0x00, /* KEY_CHANNELDOWN */
 };
 
 /* TwinHan AzureWave AD-TU700(704J) */
@@ -746,4 +780,75 @@ static u8 af9015_ir_table_trekstor[] = {
 	0x00, 0xff, 0x84, 0x7b, 0x27, 0x07, 0x00,
 };
 
+/* MSI DIGIVOX mini III */
+static struct dvb_usb_rc_key af9015_rc_keys_msi_digivox_iii[] = {
+	{ 0x0713, KEY_POWER },       /* [red power button] */
+	{ 0x073b, KEY_VIDEO },       /* Source */
+	{ 0x073e, KEY_ZOOM },        /* Zoom */
+	{ 0x070b, KEY_POWER2 },      /* ShutDown */
+	{ 0x071e, KEY_1 },
+	{ 0x071f, KEY_2 },
+	{ 0x0720, KEY_3 },
+	{ 0x0721, KEY_4 },
+	{ 0x0722, KEY_5 },
+	{ 0x0723, KEY_6 },
+	{ 0x0724, KEY_7 },
+	{ 0x0725, KEY_8 },
+	{ 0x0726, KEY_9 },
+	{ 0x0727, KEY_0 },
+	{ 0x0752, KEY_CHANNELUP },   /* CH+ */
+	{ 0x0751, KEY_CHANNELDOWN }, /* CH- */
+	{ 0x0750, KEY_VOLUMEUP },    /* Vol+ */
+	{ 0x074f, KEY_VOLUMEDOWN },  /* Vol- */
+	{ 0x0705, KEY_ESC },         /* [back up arrow] */
+	{ 0x0708, KEY_OK },          /* [enter arrow] */
+	{ 0x073f, KEY_RECORD },      /* Rec */
+	{ 0x0716, KEY_STOP },        /* Stop */
+	{ 0x072a, KEY_PLAY },        /* Play */
+	{ 0x073c, KEY_MUTE },        /* Mute */
+	{ 0x0718, KEY_UP },
+	{ 0x0707, KEY_DOWN },
+	{ 0x070f, KEY_LEFT },
+	{ 0x0715, KEY_RIGHT },
+	{ 0x0736, KEY_RED },
+	{ 0x0737, KEY_GREEN },
+	{ 0x072d, KEY_YELLOW },
+	{ 0x072e, KEY_BLUE },
+};
+
+static u8 af9015_ir_table_msi_digivox_iii[] = {
+	0x61, 0xd6, 0x43, 0xbc, 0x13, 0x07, 0x00, /* KEY_POWER */
+	0x61, 0xd6, 0x01, 0xfe, 0x3b, 0x07, 0x00, /* KEY_VIDEO */
+	0x61, 0xd6, 0x0b, 0xf4, 0x3e, 0x07, 0x00, /* KEY_ZOOM */
+	0x61, 0xd6, 0x03, 0xfc, 0x0b, 0x07, 0x00, /* KEY_POWER2 */
+	0x61, 0xd6, 0x04, 0xfb, 0x1e, 0x07, 0x00, /* KEY_1 */
+	0x61, 0xd6, 0x08, 0xf7, 0x1f, 0x07, 0x00, /* KEY_2 */
+	0x61, 0xd6, 0x02, 0xfd, 0x20, 0x07, 0x00, /* KEY_3 */
+	0x61, 0xd6, 0x0f, 0xf0, 0x21, 0x07, 0x00, /* KEY_4 */
+	0x61, 0xd6, 0x05, 0xfa, 0x22, 0x07, 0x00, /* KEY_5 */
+	0x61, 0xd6, 0x06, 0xf9, 0x23, 0x07, 0x00, /* KEY_6 */
+	0x61, 0xd6, 0x0c, 0xf3, 0x24, 0x07, 0x00, /* KEY_7 */
+	0x61, 0xd6, 0x0d, 0xf2, 0x25, 0x07, 0x00, /* KEY_8 */
+	0x61, 0xd6, 0x0a, 0xf5, 0x26, 0x07, 0x00, /* KEY_9 */
+	0x61, 0xd6, 0x11, 0xee, 0x27, 0x07, 0x00, /* KEY_0 */
+	0x61, 0xd6, 0x09, 0xf6, 0x52, 0x07, 0x00, /* KEY_CHANNELUP */
+	0x61, 0xd6, 0x07, 0xf8, 0x51, 0x07, 0x00, /* KEY_CHANNELDOWN */
+	0x61, 0xd6, 0x0e, 0xf1, 0x50, 0x07, 0x00, /* KEY_VOLUMEUP */
+	0x61, 0xd6, 0x13, 0xec, 0x4f, 0x07, 0x00, /* KEY_VOLUMEDOWN */
+	0x61, 0xd6, 0x10, 0xef, 0x05, 0x07, 0x00, /* KEY_ESC */
+	0x61, 0xd6, 0x12, 0xed, 0x08, 0x07, 0x00, /* KEY_OK */
+	0x61, 0xd6, 0x14, 0xeb, 0x3f, 0x07, 0x00, /* KEY_RECORD */
+	0x61, 0xd6, 0x15, 0xea, 0x16, 0x07, 0x00, /* KEY_STOP */
+	0x61, 0xd6, 0x16, 0xe9, 0x2a, 0x07, 0x00, /* KEY_PLAY */
+	0x61, 0xd6, 0x17, 0xe8, 0x3c, 0x07, 0x00, /* KEY_MUTE */
+	0x61, 0xd6, 0x18, 0xe7, 0x18, 0x07, 0x00, /* KEY_UP */
+	0x61, 0xd6, 0x19, 0xe6, 0x07, 0x07, 0x00, /* KEY_DOWN */
+	0x61, 0xd6, 0x1a, 0xe5, 0x0f, 0x07, 0x00, /* KEY_LEFT */
+	0x61, 0xd6, 0x1b, 0xe4, 0x15, 0x07, 0x00, /* KEY_RIGHT */
+	0x61, 0xd6, 0x1c, 0xe3, 0x36, 0x07, 0x00, /* KEY_RED */
+	0x61, 0xd6, 0x1d, 0xe2, 0x37, 0x07, 0x00, /* KEY_GREEN */
+	0x61, 0xd6, 0x1e, 0xe1, 0x2d, 0x07, 0x00, /* KEY_YELLOW */
+	0x61, 0xd6, 0x1f, 0xe0, 0x2e, 0x07, 0x00, /* KEY_BLUE */
+};
+
 #endif
diff --git a/drivers/media/dvb/dvb-usb/anysee.c b/drivers/media/dvb/dvb-usb/anysee.c
index 2ae7f648effe..bb69f3719f9a 100644
--- a/drivers/media/dvb/dvb-usb/anysee.c
+++ b/drivers/media/dvb/dvb-usb/anysee.c
@@ -344,7 +344,7 @@ static int anysee_frontend_attach(struct dvb_usb_adapter *adap)
 	if (ret)
 		return ret;
 
-	err("Unkown Anysee version: %02x %02x %02x. "\
+	err("Unknown Anysee version: %02x %02x %02x. "\
 	    "Please report the <linux-dvb@linuxtv.org>.",
 	    hw_info[0], hw_info[1], hw_info[2]);
 
diff --git a/drivers/media/dvb/dvb-usb/cxusb.c b/drivers/media/dvb/dvb-usb/cxusb.c
index 2a53dd096eef..05fb28e9c69e 100644
--- a/drivers/media/dvb/dvb-usb/cxusb.c
+++ b/drivers/media/dvb/dvb-usb/cxusb.c
@@ -36,9 +36,11 @@
 #include "tuner-xc2028.h"
 #include "tuner-simple.h"
 #include "mxl5005s.h"
+#include "max2165.h"
 #include "dib7000p.h"
 #include "dib0070.h"
 #include "lgs8gxx.h"
+#include "atbm8830.h"
 
 /* debug */
 static int dvb_usb_cxusb_debug;
@@ -714,6 +716,11 @@ static struct mxl5005s_config d680_dmb_tuner = {
 	.AgcMasterByte   = 0x00,
 };
 
+static struct max2165_config mygica_d689_max2165_cfg = {
+	.i2c_address = 0x60,
+	.osc_clk = 20
+};
+
 /* Callbacks for DVB USB */
 static int cxusb_fmd1216me_tuner_attach(struct dvb_usb_adapter *adap)
 {
@@ -813,6 +820,14 @@ static int cxusb_d680_dmb_tuner_attach(struct dvb_usb_adapter *adap)
 	return (fe == NULL) ? -EIO : 0;
 }
 
+static int cxusb_mygica_d689_tuner_attach(struct dvb_usb_adapter *adap)
+{
+	struct dvb_frontend *fe;
+	fe = dvb_attach(max2165_attach, adap->fe,
+			&adap->dev->i2c_adap, &mygica_d689_max2165_cfg);
+	return (fe == NULL) ? -EIO : 0;
+}
+
 static int cxusb_cx22702_frontend_attach(struct dvb_usb_adapter *adap)
 {
 	u8 b;
@@ -1160,6 +1175,55 @@ static int cxusb_d680_dmb_frontend_attach(struct dvb_usb_adapter *adap)
 	return 0;
 }
 
+static struct atbm8830_config mygica_d689_atbm8830_cfg = {
+	.prod = ATBM8830_PROD_8830,
+	.demod_address = 0x40,
+	.serial_ts = 0,
+	.ts_sampling_edge = 1,
+	.ts_clk_gated = 0,
+	.osc_clk_freq = 30400, /* in kHz */
+	.if_freq = 0, /* zero IF */
+	.zif_swap_iq = 1,
+};
+
+static int cxusb_mygica_d689_frontend_attach(struct dvb_usb_adapter *adap)
+{
+	struct dvb_usb_device *d = adap->dev;
+
+	/* Select required USB configuration */
+	if (usb_set_interface(d->udev, 0, 0) < 0)
+		err("set interface failed");
+
+	/* Unblock all USB pipes */
+	usb_clear_halt(d->udev,
+		usb_sndbulkpipe(d->udev, d->props.generic_bulk_ctrl_endpoint));
+	usb_clear_halt(d->udev,
+		usb_rcvbulkpipe(d->udev, d->props.generic_bulk_ctrl_endpoint));
+	usb_clear_halt(d->udev,
+		usb_rcvbulkpipe(d->udev, d->props.adapter[0].stream.endpoint));
+
+
+	/* Reset the tuner */
+	if (cxusb_d680_dmb_gpio_tuner(d, 0x07, 0) < 0) {
+		err("clear tuner gpio failed");
+		return -EIO;
+	}
+	msleep(100);
+	if (cxusb_d680_dmb_gpio_tuner(d, 0x07, 1) < 0) {
+		err("set tuner gpio failed");
+		return -EIO;
+	}
+	msleep(100);
+
+	/* Attach frontend */
+	adap->fe = dvb_attach(atbm8830_attach, &mygica_d689_atbm8830_cfg,
+		&d->i2c_adap);
+	if (adap->fe == NULL)
+		return -EIO;
+
+	return 0;
+}
+
 /*
  * DViCO has shipped two devices with the same USB ID, but only one of them
  * needs a firmware download.  Check the device class details to see if they
@@ -1240,6 +1304,7 @@ static struct dvb_usb_device_properties cxusb_bluebird_nano2_properties;
 static struct dvb_usb_device_properties cxusb_bluebird_nano2_needsfirmware_properties;
 static struct dvb_usb_device_properties cxusb_aver_a868r_properties;
 static struct dvb_usb_device_properties cxusb_d680_dmb_properties;
+static struct dvb_usb_device_properties cxusb_mygica_d689_properties;
 
 static int cxusb_probe(struct usb_interface *intf,
 		       const struct usb_device_id *id)
@@ -1268,6 +1333,8 @@ static int cxusb_probe(struct usb_interface *intf,
 				     THIS_MODULE, NULL, adapter_nr) ||
 	    0 == dvb_usb_device_init(intf, &cxusb_d680_dmb_properties,
 				     THIS_MODULE, NULL, adapter_nr) ||
+	    0 == dvb_usb_device_init(intf, &cxusb_mygica_d689_properties,
+				     THIS_MODULE, NULL, adapter_nr) ||
 	    0)
 		return 0;
 
@@ -1294,6 +1361,7 @@ static struct usb_device_id cxusb_table [] = {
 	{ USB_DEVICE(USB_VID_AVERMEDIA, USB_PID_AVERMEDIA_VOLAR_A868R) },
 	{ USB_DEVICE(USB_VID_DVICO, USB_PID_DVICO_BLUEBIRD_DUAL_4_REV_2) },
 	{ USB_DEVICE(USB_VID_CONEXANT, USB_PID_CONEXANT_D680_DMB) },
+	{ USB_DEVICE(USB_VID_CONEXANT, USB_PID_MYGICA_D689) },
 	{}		/* Terminating entry */
 };
 MODULE_DEVICE_TABLE (usb, cxusb_table);
@@ -1837,6 +1905,55 @@ static struct dvb_usb_device_properties cxusb_d680_dmb_properties = {
 	}
 };
 
+static struct dvb_usb_device_properties cxusb_mygica_d689_properties = {
+	.caps = DVB_USB_IS_AN_I2C_ADAPTER,
+
+	.usb_ctrl         = CYPRESS_FX2,
+
+	.size_of_priv     = sizeof(struct cxusb_state),
+
+	.num_adapters = 1,
+	.adapter = {
+		{
+			.streaming_ctrl   = cxusb_d680_dmb_streaming_ctrl,
+			.frontend_attach  = cxusb_mygica_d689_frontend_attach,
+			.tuner_attach     = cxusb_mygica_d689_tuner_attach,
+
+			/* parameter for the MPEG2-data transfer */
+			.stream = {
+				.type = USB_BULK,
+				.count = 5,
+				.endpoint = 0x02,
+				.u = {
+					.bulk = {
+						.buffersize = 8192,
+					}
+				}
+			},
+		},
+	},
+
+	.power_ctrl       = cxusb_d680_dmb_power_ctrl,
+
+	.i2c_algo         = &cxusb_i2c_algo,
+
+	.generic_bulk_ctrl_endpoint = 0x01,
+
+	.rc_interval      = 100,
+	.rc_key_map       = d680_dmb_rc_keys,
+	.rc_key_map_size  = ARRAY_SIZE(d680_dmb_rc_keys),
+	.rc_query         = cxusb_d680_dmb_rc_query,
+
+	.num_device_descs = 1,
+	.devices = {
+		{
+			"Mygica D689 DMB-TH",
+			{ NULL },
+			{ &cxusb_table[19], NULL },
+		},
+	}
+};
+
 static struct usb_driver cxusb_driver = {
 	.name		= "dvb_usb_cxusb",
 	.probe		= cxusb_probe,
diff --git a/drivers/media/dvb/dvb-usb/dib0700.h b/drivers/media/dvb/dvb-usb/dib0700.h
index 8b544fe79b0d..495a90577c5f 100644
--- a/drivers/media/dvb/dvb-usb/dib0700.h
+++ b/drivers/media/dvb/dvb-usb/dib0700.h
@@ -20,20 +20,22 @@ extern int dvb_usb_dib0700_debug;
 #define deb_fwdata(args...) dprintk(dvb_usb_dib0700_debug,0x04,args)
 #define deb_data(args...)   dprintk(dvb_usb_dib0700_debug,0x08,args)
 
-#define REQUEST_I2C_READ     0x2
-#define REQUEST_I2C_WRITE    0x3
-#define REQUEST_POLL_RC      0x4 /* deprecated in firmware v1.20 */
-#define REQUEST_JUMPRAM      0x8
-#define REQUEST_SET_CLOCK    0xB
-#define REQUEST_SET_GPIO     0xC
-#define REQUEST_ENABLE_VIDEO 0xF
+#define REQUEST_SET_USB_XFER_LEN    0x0 /* valid only for firmware version */
+					/* higher than 1.21 */
+#define REQUEST_I2C_READ            0x2
+#define REQUEST_I2C_WRITE           0x3
+#define REQUEST_POLL_RC             0x4 /* deprecated in firmware v1.20 */
+#define REQUEST_JUMPRAM             0x8
+#define REQUEST_SET_CLOCK           0xB
+#define REQUEST_SET_GPIO            0xC
+#define REQUEST_ENABLE_VIDEO        0xF
 	// 1 Byte: 4MSB(1 = enable streaming, 0 = disable streaming) 4LSB(Video Mode: 0 = MPEG2 188Bytes, 1 = Analog)
 	// 2 Byte: MPEG2 mode:  4MSB(1 = Master Mode, 0 = Slave Mode) 4LSB(Channel 1 = bit0, Channel 2 = bit1)
 	// 2 Byte: Analog mode: 4MSB(0 = 625 lines, 1 = 525 lines)    4LSB(     "                "           )
-#define REQUEST_SET_RC       0x11
-#define REQUEST_NEW_I2C_READ 0x12
-#define REQUEST_NEW_I2C_WRITE 0x13
-#define REQUEST_GET_VERSION  0x15
+#define REQUEST_SET_RC              0x11
+#define REQUEST_NEW_I2C_READ        0x12
+#define REQUEST_NEW_I2C_WRITE       0x13
+#define REQUEST_GET_VERSION         0x15
 
 struct dib0700_state {
 	u8 channel_state;
@@ -44,6 +46,8 @@ struct dib0700_state {
 	u8 is_dib7000pc;
 	u8 fw_use_new_i2c_api;
 	u8 disable_streaming_master_mode;
+    u32 fw_version;
+    u32 nb_packet_buffer_size;
 };
 
 extern int dib0700_get_version(struct dvb_usb_device *d, u32 *hwversion,
diff --git a/drivers/media/dvb/dvb-usb/dib0700_core.c b/drivers/media/dvb/dvb-usb/dib0700_core.c
index db7f7f79a66c..0d3c9a9a33be 100644
--- a/drivers/media/dvb/dvb-usb/dib0700_core.c
+++ b/drivers/media/dvb/dvb-usb/dib0700_core.c
@@ -17,6 +17,14 @@ int dvb_usb_dib0700_ir_proto = 1;
 module_param(dvb_usb_dib0700_ir_proto, int, 0644);
 MODULE_PARM_DESC(dvb_usb_dib0700_ir_proto, "set ir protocol (0=NEC, 1=RC5 (default), 2=RC6).");
 
+static int nb_packet_buffer_size = 21;
+module_param(nb_packet_buffer_size, int, 0644);
+MODULE_PARM_DESC(nb_packet_buffer_size,
+	"Set the dib0700 driver data buffer size. This parameter "
+	"corresponds to the number of TS packets. The actual size of "
+	"the data buffer corresponds to this parameter "
+	"multiplied by 188 (default: 21)");
+
 DVB_DEFINE_MOD_OPT_ADAPTER_NR(adapter_nr);
 
 
@@ -28,10 +36,14 @@ int dib0700_get_version(struct dvb_usb_device *d, u32 *hwversion,
 				  REQUEST_GET_VERSION,
 				  USB_TYPE_VENDOR | USB_DIR_IN, 0, 0,
 				  b, sizeof(b), USB_CTRL_GET_TIMEOUT);
-	*hwversion  = (b[0] << 24)  | (b[1] << 16)  | (b[2] << 8)  | b[3];
-	*romversion = (b[4] << 24)  | (b[5] << 16)  | (b[6] << 8)  | b[7];
-	*ramversion = (b[8] << 24)  | (b[9] << 16)  | (b[10] << 8) | b[11];
-	*fwtype     = (b[12] << 24) | (b[13] << 16) | (b[14] << 8) | b[15];
+	if (hwversion != NULL)
+		*hwversion  = (b[0] << 24)  | (b[1] << 16)  | (b[2] << 8)  | b[3];
+	if (romversion != NULL)
+		*romversion = (b[4] << 24)  | (b[5] << 16)  | (b[6] << 8)  | b[7];
+	if (ramversion != NULL)
+		*ramversion = (b[8] << 24)  | (b[9] << 16)  | (b[10] << 8) | b[11];
+	if (fwtype != NULL)
+		*fwtype     = (b[12] << 24) | (b[13] << 16) | (b[14] << 8) | b[15];
 	return ret;
 }
 
@@ -97,6 +109,27 @@ int dib0700_set_gpio(struct dvb_usb_device *d, enum dib07x0_gpios gpio, u8 gpio_
 	return dib0700_ctrl_wr(d,buf,3);
 }
 
+static int dib0700_set_usb_xfer_len(struct dvb_usb_device *d, u16 nb_ts_packets)
+{
+    struct dib0700_state *st = d->priv;
+    u8 b[3];
+    int ret;
+
+    if (st->fw_version >= 0x10201) {
+	b[0] = REQUEST_SET_USB_XFER_LEN;
+	b[1] = (nb_ts_packets >> 8)&0xff;
+	b[2] = nb_ts_packets & 0xff;
+
+	deb_info("set the USB xfer len to %i Ts packet\n", nb_ts_packets);
+
+	ret = dib0700_ctrl_wr(d, b, 3);
+    } else {
+	deb_info("this firmware does not allow to change the USB xfer len\n");
+	ret = -EIO;
+    }
+    return ret;
+}
+
 /*
  * I2C master xfer function (supported in 1.20 firmware)
  */
@@ -328,7 +361,9 @@ static int dib0700_jumpram(struct usb_device *udev, u32 address)
 int dib0700_download_firmware(struct usb_device *udev, const struct firmware *fw)
 {
 	struct hexline hx;
-	int pos = 0, ret, act_len;
+	int pos = 0, ret, act_len, i, adap_num;
+	u8 b[16];
+	u32 fw_version;
 
 	u8 buf[260];
 
@@ -364,6 +399,34 @@ int dib0700_download_firmware(struct usb_device *udev, const struct firmware *fw
 	} else
 		ret = -EIO;
 
+	/* the number of ts packet has to be at least 1 */
+	if (nb_packet_buffer_size < 1)
+		nb_packet_buffer_size = 1;
+
+	/* get the fimware version */
+	usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
+				  REQUEST_GET_VERSION,
+				  USB_TYPE_VENDOR | USB_DIR_IN, 0, 0,
+				  b, sizeof(b), USB_CTRL_GET_TIMEOUT);
+	fw_version = (b[8] << 24)  | (b[9] << 16)  | (b[10] << 8) | b[11];
+
+	/* set the buffer size - DVB-USB is allocating URB buffers
+	 * only after the firwmare download was successful */
+	for (i = 0; i < dib0700_device_count; i++) {
+		for (adap_num = 0; adap_num < dib0700_devices[i].num_adapters;
+				adap_num++) {
+			if (fw_version >= 0x10201)
+				dib0700_devices[i].adapter[adap_num].stream.u.bulk.buffersize = 188*nb_packet_buffer_size;
+			else {
+				/* for fw version older than 1.20.1,
+				 * the buffersize has to be n times 512 */
+				dib0700_devices[i].adapter[adap_num].stream.u.bulk.buffersize = ((188*nb_packet_buffer_size+188/2)/512)*512;
+				if (dib0700_devices[i].adapter[adap_num].stream.u.bulk.buffersize < 512)
+					dib0700_devices[i].adapter[adap_num].stream.u.bulk.buffersize = 512;
+			}
+		}
+	}
+
 	return ret;
 }
 
@@ -371,6 +434,18 @@ int dib0700_streaming_ctrl(struct dvb_usb_adapter *adap, int onoff)
 {
 	struct dib0700_state *st = adap->dev->priv;
 	u8 b[4];
+	int ret;
+
+	if ((onoff != 0) && (st->fw_version >= 0x10201)) {
+		/* for firmware later than 1.20.1,
+		 * the USB xfer length can be set  */
+		ret = dib0700_set_usb_xfer_len(adap->dev,
+			st->nb_packet_buffer_size);
+		if (ret < 0) {
+			deb_info("can not set the USB xfer len\n");
+			return ret;
+		}
+	}
 
 	b[0] = REQUEST_ENABLE_VIDEO;
 	b[1] = (onoff << 4) | 0x00; /* this bit gives a kind of command, rather than enabling something or not */
@@ -415,9 +490,21 @@ static int dib0700_probe(struct usb_interface *intf,
 
 	for (i = 0; i < dib0700_device_count; i++)
 		if (dvb_usb_device_init(intf, &dib0700_devices[i], THIS_MODULE,
-					&dev, adapter_nr) == 0)
-		{
+		    &dev, adapter_nr) == 0) {
+			struct dib0700_state *st = dev->priv;
+			u32 hwversion, romversion, fw_version, fwtype;
+
+			dib0700_get_version(dev, &hwversion, &romversion,
+				&fw_version, &fwtype);
+
+			deb_info("Firmware version: %x, %d, 0x%x, %d\n",
+				hwversion, romversion, fw_version, fwtype);
+
+			st->fw_version = fw_version;
+			st->nb_packet_buffer_size = (u32)nb_packet_buffer_size;
+
 			dib0700_rc_setup(dev);
+
 			return 0;
 		}
 
diff --git a/drivers/media/dvb/dvb-usb/dib0700_devices.c b/drivers/media/dvb/dvb-usb/dib0700_devices.c
index 6bd8951ea02b..44972d01bbd0 100644
--- a/drivers/media/dvb/dvb-usb/dib0700_devices.c
+++ b/drivers/media/dvb/dvb-usb/dib0700_devices.c
@@ -18,6 +18,7 @@
 #include "xc5000.h"
 #include "s5h1411.h"
 #include "dib0070.h"
+#include "dib0090.h"
 #include "lgdt3305.h"
 #include "mxl5007t.h"
 
@@ -130,93 +131,95 @@ static int bristol_tuner_attach(struct dvb_usb_adapter *adap)
 /* MT226x */
 static struct dibx000_agc_config stk7700d_7000p_mt2266_agc_config[2] = {
 	{
-		BAND_UHF, // band_caps
+		BAND_UHF,
 
 		/* P_agc_use_sd_mod1=0, P_agc_use_sd_mod2=0, P_agc_freq_pwm_div=1, P_agc_inv_pwm1=1, P_agc_inv_pwm2=1,
 		* P_agc_inh_dc_rv_est=0, P_agc_time_est=3, P_agc_freeze=0, P_agc_nb_est=2, P_agc_write=0 */
-		(0 << 15) | (0 << 14) | (1 << 11) | (1 << 10) | (1 << 9) | (0 << 8) | (3 << 5) | (0 << 4) | (5 << 1) | (0 << 0), // setup
-
-		1130,  // inv_gain
-		21,  // time_stabiliz
-
-		0,  // alpha_level
-		118,  // thlock
-
-		0,     // wbd_inv
-		3530,  // wbd_ref
-		1,     // wbd_sel
-		0,     // wbd_alpha
-
-		65535,  // agc1_max
-		33770,  // agc1_min
-		65535,  // agc2_max
-		23592,  // agc2_min
-
-		0,    // agc1_pt1
-		62,   // agc1_pt2
-		255,  // agc1_pt3
-		64,   // agc1_slope1
-		64,   // agc1_slope2
-		132,  // agc2_pt1
-		192,  // agc2_pt2
-		80,   // agc2_slope1
-		80,   // agc2_slope2
-
-		17,  // alpha_mant
-		27,  // alpha_exp
-		23,  // beta_mant
-		51,  // beta_exp
-
-		1,  // perform_agc_softsplit
+		(0 << 15) | (0 << 14) | (1 << 11) | (1 << 10) | (1 << 9) | (0 << 8)
+	    | (3 << 5) | (0 << 4) | (5 << 1) | (0 << 0),
+
+		1130,
+		21,
+
+		0,
+		118,
+
+		0,
+		3530,
+		1,
+		0,
+
+		65535,
+		33770,
+		65535,
+		23592,
+
+		0,
+		62,
+		255,
+		64,
+		64,
+		132,
+		192,
+		80,
+		80,
+
+		17,
+		27,
+		23,
+		51,
+
+		1,
 	}, {
-		BAND_VHF | BAND_LBAND, // band_caps
+		BAND_VHF | BAND_LBAND,
 
 		/* P_agc_use_sd_mod1=0, P_agc_use_sd_mod2=0, P_agc_freq_pwm_div=1, P_agc_inv_pwm1=1, P_agc_inv_pwm2=1,
 		* P_agc_inh_dc_rv_est=0, P_agc_time_est=3, P_agc_freeze=0, P_agc_nb_est=2, P_agc_write=0 */
-		(0 << 15) | (0 << 14) | (1 << 11) | (1 << 10) | (1 << 9) | (0 << 8) | (3 << 5) | (0 << 4) | (2 << 1) | (0 << 0), // setup
-
-		2372, // inv_gain
-		21,   // time_stabiliz
-
-		0,    // alpha_level
-		118,  // thlock
-
-		0,    // wbd_inv
-		3530, // wbd_ref
-		1,     // wbd_sel
-		0,    // wbd_alpha
-
-		65535, // agc1_max
-		0,     // agc1_min
-		65535, // agc2_max
-		23592, // agc2_min
-
-		0,    // agc1_pt1
-		128,  // agc1_pt2
-		128,  // agc1_pt3
-		128,  // agc1_slope1
-		0,    // agc1_slope2
-		128,  // agc2_pt1
-		253,  // agc2_pt2
-		81,   // agc2_slope1
-		0,    // agc2_slope2
-
-		17,  // alpha_mant
-		27,  // alpha_exp
-		23,  // beta_mant
-		51,  // beta_exp
-
-		1,  // perform_agc_softsplit
+		(0 << 15) | (0 << 14) | (1 << 11) | (1 << 10) | (1 << 9) | (0 << 8)
+	    | (3 << 5) | (0 << 4) | (2 << 1) | (0 << 0),
+
+		2372,
+		21,
+
+		0,
+		118,
+
+		0,
+		3530,
+		1,
+		0,
+
+		65535,
+		0,
+		65535,
+		23592,
+
+		0,
+		128,
+		128,
+		128,
+		0,
+		128,
+		253,
+		81,
+		0,
+
+		17,
+		27,
+		23,
+		51,
+
+		1,
 	}
 };
 
 static struct dibx000_bandwidth_config stk7700d_mt2266_pll_config = {
-	60000, 30000, // internal, sampling
-	1, 8, 3, 1, 0, // pll_cfg: prediv, ratio, range, reset, bypass
-	0, 0, 1, 1, 2, // misc: refdiv, bypclk_div, IO_CLK_en_core, ADClkSrc, modulo
-	(3 << 14) | (1 << 12) | (524 << 0), // sad_cfg: refsel, sel, freq_15k
-	0, // ifreq
-	20452225, // timf
+	60000, 30000,
+	1, 8, 3, 1, 0,
+	0, 0, 1, 1, 2,
+	(3 << 14) | (1 << 12) | (524 << 0),
+	0,
+	20452225,
 };
 
 static struct dib7000p_config stk7700d_dib7000p_mt2266_config[] = {
@@ -558,8 +561,7 @@ static int dib0700_rc_query_legacy(struct dvb_usb_device *d, u32 *event,
 struct dib0700_rc_response {
 	u8 report_id;
 	u8 data_state;
-	u8 system_msb;
-	u8 system_lsb;
+	u16 system;
 	u8 data;
 	u8 not_data;
 };
@@ -589,6 +591,23 @@ static int dib0700_rc_query_v1_20(struct dvb_usb_device *d, u32 *event,
 		return 0;
 	}
 
+
+	switch (dvb_usb_dib0700_ir_proto) {
+	case 0:
+		poll_reply.report_id  = 0;
+		poll_reply.data_state = 1;
+		poll_reply.system     = buf[2];
+		poll_reply.data       = buf[4];
+		poll_reply.not_data   = buf[5];
+
+		/* NEC protocol sends repeat code as 0 0 0 FF */
+		if ((poll_reply.system == 0x00) && (poll_reply.data == 0x00)
+		    && (poll_reply.not_data == 0xff)) {
+			poll_reply.data_state = 2;
+			break;
+		}
+		break;
+	default:
 	if (actlen != sizeof(buf)) {
 		/* We didn't get back the 6 byte message we expected */
 		err("Unexpected RC response size [%d]", actlen);
@@ -597,30 +616,26 @@ static int dib0700_rc_query_v1_20(struct dvb_usb_device *d, u32 *event,
 
 	poll_reply.report_id  = buf[0];
 	poll_reply.data_state = buf[1];
-	poll_reply.system_msb = buf[2];
-	poll_reply.system_lsb = buf[3];
+		poll_reply.system     = (buf[2] << 8) | buf[3];
 	poll_reply.data       = buf[4];
 	poll_reply.not_data   = buf[5];
 
-	/*
-	info("rid=%02x ds=%02x sm=%02x sl=%02x d=%02x nd=%02x\n",
-	     poll_reply.report_id, poll_reply.data_state,
-	     poll_reply.system_msb, poll_reply.system_lsb,
-	     poll_reply.data, poll_reply.not_data);
-	*/
+		break;
+	}
 
 	if ((poll_reply.data + poll_reply.not_data) != 0xff) {
 		/* Key failed integrity check */
-		err("key failed integrity check: %02x %02x %02x %02x",
-		    poll_reply.system_msb, poll_reply.system_lsb,
+		err("key failed integrity check: %04x %02x %02x",
+		    poll_reply.system,
 		    poll_reply.data, poll_reply.not_data);
 		return -1;
 	}
 
+
 	/* Find the key in the map */
 	for (i = 0; i < d->props.rc_key_map_size; i++) {
-		if (rc5_custom(&keymap[i]) == poll_reply.system_lsb &&
-		    rc5_data(&keymap[i]) == poll_reply.data) {
+		if (rc5_custom(&keymap[i]) == (poll_reply.system & 0xff) &&
+			rc5_data(&keymap[i]) == poll_reply.data) {
 			*event = keymap[i].event;
 			found = 1;
 			break;
@@ -628,9 +643,9 @@ static int dib0700_rc_query_v1_20(struct dvb_usb_device *d, u32 *event,
 	}
 
 	if (found == 0) {
-		err("Unknown remote controller key: %02x %02x %02x %02x",
-		    poll_reply.system_msb, poll_reply.system_lsb,
-		    poll_reply.data, poll_reply.not_data);
+		err("Unknown remote controller key: %04x %02x %02x",
+			poll_reply.system,
+			poll_reply.data, poll_reply.not_data);
 		d->last_event = 0;
 		return 0;
 	}
@@ -874,51 +889,95 @@ static struct dvb_usb_rc_key dib0700_rc_keys[] = {
 	{ 0x1d37, KEY_RECORD },
 	{ 0x1d3b, KEY_GOTO },
 	{ 0x1d3d, KEY_POWER },
+
+	/* Key codes for the Pixelview SBTVD remote (proto NEC) */
+	{ 0x8613, KEY_MUTE },
+	{ 0x8612, KEY_POWER },
+	{ 0x8601, KEY_1 },
+	{ 0x8602, KEY_2 },
+	{ 0x8603, KEY_3 },
+	{ 0x8604, KEY_4 },
+	{ 0x8605, KEY_5 },
+	{ 0x8606, KEY_6 },
+	{ 0x8607, KEY_7 },
+	{ 0x8608, KEY_8 },
+	{ 0x8609, KEY_9 },
+	{ 0x8600, KEY_0 },
+	{ 0x860d, KEY_CHANNELUP },
+	{ 0x8619, KEY_CHANNELDOWN },
+	{ 0x8610, KEY_VOLUMEUP },
+	{ 0x860c, KEY_VOLUMEDOWN },
+
+	{ 0x860a, KEY_CAMERA },
+	{ 0x860b, KEY_ZOOM },
+	{ 0x861b, KEY_BACKSPACE },
+	{ 0x8615, KEY_ENTER },
+
+	{ 0x861d, KEY_UP },
+	{ 0x861e, KEY_DOWN },
+	{ 0x860e, KEY_LEFT },
+	{ 0x860f, KEY_RIGHT },
+
+	{ 0x8618, KEY_RECORD },
+	{ 0x861a, KEY_STOP },
+
+	/* Key codes for the EvolutePC TVWay+ remote (proto NEC) */
+	{ 0x7a00, KEY_MENU },
+	{ 0x7a01, KEY_RECORD },
+	{ 0x7a02, KEY_PLAY },
+	{ 0x7a03, KEY_STOP },
+	{ 0x7a10, KEY_CHANNELUP },
+	{ 0x7a11, KEY_CHANNELDOWN },
+	{ 0x7a12, KEY_VOLUMEUP },
+	{ 0x7a13, KEY_VOLUMEDOWN },
+	{ 0x7a40, KEY_POWER },
+	{ 0x7a41, KEY_MUTE },
 };
 
 /* STK7700P: Hauppauge Nova-T Stick, AVerMedia Volar */
 static struct dibx000_agc_config stk7700p_7000m_mt2060_agc_config = {
-	BAND_UHF | BAND_VHF,       // band_caps
+	BAND_UHF | BAND_VHF,
 
 	/* P_agc_use_sd_mod1=0, P_agc_use_sd_mod2=0, P_agc_freq_pwm_div=5, P_agc_inv_pwm1=0, P_agc_inv_pwm2=0,
 	 * P_agc_inh_dc_rv_est=0, P_agc_time_est=3, P_agc_freeze=0, P_agc_nb_est=2, P_agc_write=0 */
-	(0 << 15) | (0 << 14) | (5 << 11) | (0 << 10) | (0 << 9) | (0 << 8) | (3 << 5) | (0 << 4) | (2 << 1) | (0 << 0), // setup
-
-	712,  // inv_gain
-	41,  // time_stabiliz
-
-	0,  // alpha_level
-	118,  // thlock
-
-	0,     // wbd_inv
-	4095,  // wbd_ref
-	0,     // wbd_sel
-	0,     // wbd_alpha
-
-	42598,  // agc1_max
-	17694,  // agc1_min
-	45875,  // agc2_max
-	2621,  // agc2_min
-	0,  // agc1_pt1
-	76,  // agc1_pt2
-	139,  // agc1_pt3
-	52,  // agc1_slope1
-	59,  // agc1_slope2
-	107,  // agc2_pt1
-	172,  // agc2_pt2
-	57,  // agc2_slope1
-	70,  // agc2_slope2
-
-	21,  // alpha_mant
-	25,  // alpha_exp
-	28,  // beta_mant
-	48,  // beta_exp
-
-	1,  // perform_agc_softsplit
-	{  0,     // split_min
-	   107,   // split_max
-	   51800, // global_split_min
-	   24700  // global_split_max
+	(0 << 15) | (0 << 14) | (5 << 11) | (0 << 10) | (0 << 9) | (0 << 8)
+	| (3 << 5) | (0 << 4) | (2 << 1) | (0 << 0),
+
+	712,
+	41,
+
+	0,
+	118,
+
+	0,
+	4095,
+	0,
+	0,
+
+	42598,
+	17694,
+	45875,
+	2621,
+	0,
+	76,
+	139,
+	52,
+	59,
+	107,
+	172,
+	57,
+	70,
+
+	21,
+	25,
+	28,
+	48,
+
+	1,
+	{  0,
+	   107,
+	   51800,
+	   24700
 	},
 };
 
@@ -927,54 +986,55 @@ static struct dibx000_agc_config stk7700p_7000p_mt2060_agc_config = {
 
 	/* P_agc_use_sd_mod1=0, P_agc_use_sd_mod2=0, P_agc_freq_pwm_div=5, P_agc_inv_pwm1=0, P_agc_inv_pwm2=0,
 	 * P_agc_inh_dc_rv_est=0, P_agc_time_est=3, P_agc_freeze=0, P_agc_nb_est=2, P_agc_write=0 */
-	(0 << 15) | (0 << 14) | (5 << 11) | (0 << 10) | (0 << 9) | (0 << 8) | (3 << 5) | (0 << 4) | (2 << 1) | (0 << 0), // setup
+	(0 << 15) | (0 << 14) | (5 << 11) | (0 << 10) | (0 << 9) | (0 << 8)
+	| (3 << 5) | (0 << 4) | (2 << 1) | (0 << 0),
 
-	712, // inv_gain
-	41,  // time_stabiliz
+	712,
+	41,
 
-	0,   // alpha_level
-	118, // thlock
+	0,
+	118,
 
-	0,    // wbd_inv
-	4095, // wbd_ref
-	0,    // wbd_sel
-	0,    // wbd_alpha
+	0,
+	4095,
+	0,
+	0,
 
-	42598, // agc1_max
-	16384, // agc1_min
-	42598, // agc2_max
-	    0, // agc2_min
+	42598,
+	16384,
+	42598,
+	    0,
 
-	  0,   // agc1_pt1
-	137,   // agc1_pt2
-	255,   // agc1_pt3
+	  0,
+	137,
+	255,
 
-	  0,   // agc1_slope1
-	255,   // agc1_slope2
+	  0,
+	255,
 
-	0,     // agc2_pt1
-	0,     // agc2_pt2
+	0,
+	0,
 
-	 0,    // agc2_slope1
-	41,    // agc2_slope2
+	 0,
+	41,
 
-	15, // alpha_mant
-	25, // alpha_exp
+	15,
+	25,
 
-	28, // beta_mant
-	48, // beta_exp
+	28,
+	48,
 
-	0, // perform_agc_softsplit
+	0,
 };
 
 static struct dibx000_bandwidth_config stk7700p_pll_config = {
-	60000, 30000, // internal, sampling
-	1, 8, 3, 1, 0, // pll_cfg: prediv, ratio, range, reset, bypass
-	0, 0, 1, 1, 0, // misc: refdiv, bypclk_div, IO_CLK_en_core, ADClkSrc, modulo
-	(3 << 14) | (1 << 12) | (524 << 0), // sad_cfg: refsel, sel, freq_15k
-	60258167, // ifreq
-	20452225, // timf
-	30000000, // xtal
+	60000, 30000,
+	1, 8, 3, 1, 0,
+	0, 0, 1, 1, 0,
+	(3 << 14) | (1 << 12) | (524 << 0),
+	60258167,
+	20452225,
+	30000000,
 };
 
 static struct dib7000m_config stk7700p_dib7000m_config = {
@@ -1060,41 +1120,42 @@ static struct dibx000_agc_config dib7070_agc_config = {
 	BAND_UHF | BAND_VHF | BAND_LBAND | BAND_SBAND,
 	/* P_agc_use_sd_mod1=0, P_agc_use_sd_mod2=0, P_agc_freq_pwm_div=5, P_agc_inv_pwm1=0, P_agc_inv_pwm2=0,
 	 * P_agc_inh_dc_rv_est=0, P_agc_time_est=3, P_agc_freeze=0, P_agc_nb_est=5, P_agc_write=0 */
-	(0 << 15) | (0 << 14) | (5 << 11) | (0 << 10) | (0 << 9) | (0 << 8) | (3 << 5) | (0 << 4) | (5 << 1) | (0 << 0), // setup
-
-	600, // inv_gain
-	10,  // time_stabiliz
-
-	0,  // alpha_level
-	118,  // thlock
-
-	0,     // wbd_inv
-	3530,  // wbd_ref
-	1,     // wbd_sel
-	5,     // wbd_alpha
-
-	65535,  // agc1_max
-		0,  // agc1_min
-
-	65535,  // agc2_max
-	0,      // agc2_min
-
-	0,      // agc1_pt1
-	40,     // agc1_pt2
-	183,    // agc1_pt3
-	206,    // agc1_slope1
-	255,    // agc1_slope2
-	72,     // agc2_pt1
-	152,    // agc2_pt2
-	88,     // agc2_slope1
-	90,     // agc2_slope2
-
-	17,  // alpha_mant
-	27,  // alpha_exp
-	23,  // beta_mant
-	51,  // beta_exp
-
-	0,  // perform_agc_softsplit
+	(0 << 15) | (0 << 14) | (5 << 11) | (0 << 10) | (0 << 9) | (0 << 8)
+	| (3 << 5) | (0 << 4) | (5 << 1) | (0 << 0),
+
+	600,
+	10,
+
+	0,
+	118,
+
+	0,
+	3530,
+	1,
+	5,
+
+	65535,
+		0,
+
+	65535,
+	0,
+
+	0,
+	40,
+	183,
+	206,
+	255,
+	72,
+	152,
+	88,
+	90,
+
+	17,
+	27,
+	23,
+	51,
+
+	0,
 };
 
 static int dib7070_tuner_reset(struct dvb_frontend *fe, int onoff)
@@ -1133,6 +1194,7 @@ static struct dib0070_config dib7770p_dib0070_config = {
 	 .clock_khz = 12000,
 	 .clock_pad_drive = 0,
 	 .flip_chip = 1,
+	 .charge_pump = 2,
 };
 
 static int dib7070_set_param_override(struct dvb_frontend *fe, struct dvb_frontend_parameters *fep)
@@ -1209,14 +1271,24 @@ static int dib7070p_tuner_attach(struct dvb_usb_adapter *adap)
 	return 0;
 }
 
+static int stk70x0p_pid_filter(struct dvb_usb_adapter *adapter, int index, u16 pid, int onoff)
+{
+    return dib7000p_pid_filter(adapter->fe, index, pid, onoff);
+}
+
+static int stk70x0p_pid_filter_ctrl(struct dvb_usb_adapter *adapter, int onoff)
+{
+    return dib7000p_pid_filter_ctrl(adapter->fe, onoff);
+}
+
 static struct dibx000_bandwidth_config dib7070_bw_config_12_mhz = {
-	60000, 15000, // internal, sampling
-	1, 20, 3, 1, 0, // pll_cfg: prediv, ratio, range, reset, bypass
-	0, 0, 1, 1, 2, // misc: refdiv, bypclk_div, IO_CLK_en_core, ADClkSrc, modulo
-	(3 << 14) | (1 << 12) | (524 << 0), // sad_cfg: refsel, sel, freq_15k
-	(0 << 25) | 0, // ifreq = 0.000000 MHz
-	20452225, // timf
-	12000000, // xtal_hz
+	60000, 15000,
+	1, 20, 3, 1, 0,
+	0, 0, 1, 1, 2,
+	(3 << 14) | (1 << 12) | (524 << 0),
+	(0 << 25) | 0,
+	20452225,
+	12000000,
 };
 
 static struct dib7000p_config dib7070p_dib7000p_config = {
@@ -1410,12 +1482,12 @@ static struct dib8000_config dib807x_dib8000_config[2] = {
 	}
 };
 
-static int dib807x_tuner_reset(struct dvb_frontend *fe, int onoff)
+static int dib80xx_tuner_reset(struct dvb_frontend *fe, int onoff)
 {
 	return dib8000_set_gpio(fe, 5, 0, !onoff);
 }
 
-static int dib807x_tuner_sleep(struct dvb_frontend *fe, int onoff)
+static int dib80xx_tuner_sleep(struct dvb_frontend *fe, int onoff)
 {
 	return dib8000_set_gpio(fe, 0, 0, onoff);
 }
@@ -1428,8 +1500,8 @@ static const struct dib0070_wbd_gain_cfg dib8070_wbd_gain_cfg[] = {
 static struct dib0070_config dib807x_dib0070_config[2] = {
 	{
 		.i2c_address = DEFAULT_DIB0070_I2C_ADDRESS,
-		.reset = dib807x_tuner_reset,
-		.sleep = dib807x_tuner_sleep,
+		.reset = dib80xx_tuner_reset,
+		.sleep = dib80xx_tuner_sleep,
 		.clock_khz = 12000,
 		.clock_pad_drive = 4,
 		.vga_filter = 1,
@@ -1442,8 +1514,8 @@ static struct dib0070_config dib807x_dib0070_config[2] = {
 		.freq_offset_khz_vhf = -100,
 	}, {
 		.i2c_address = DEFAULT_DIB0070_I2C_ADDRESS,
-		.reset = dib807x_tuner_reset,
-		.sleep = dib807x_tuner_sleep,
+		.reset = dib80xx_tuner_reset,
+		.sleep = dib80xx_tuner_sleep,
 		.clock_khz = 12000,
 		.clock_pad_drive = 2,
 		.vga_filter = 1,
@@ -1500,6 +1572,17 @@ static int dib807x_tuner_attach(struct dvb_usb_adapter *adap)
 	return 0;
 }
 
+static int stk80xx_pid_filter(struct dvb_usb_adapter *adapter, int index,
+	u16 pid, int onoff)
+{
+    return dib8000_pid_filter(adapter->fe, index, pid, onoff);
+}
+
+static int stk80xx_pid_filter_ctrl(struct dvb_usb_adapter *adapter,
+	int onoff)
+{
+    return dib8000_pid_filter_ctrl(adapter->fe, onoff);
+}
 
 /* STK807x */
 static int stk807x_frontend_attach(struct dvb_usb_adapter *adap)
@@ -1549,7 +1632,7 @@ static int stk807xpvr_frontend_attach0(struct dvb_usb_adapter *adap)
 	dib0700_set_gpio(adap->dev, GPIO0, GPIO_OUT, 1);
 
 	/* initialize IC 0 */
-	dib8000_i2c_enumeration(&adap->dev->i2c_adap, 1, 0x12, 0x80);
+	dib8000_i2c_enumeration(&adap->dev->i2c_adap, 1, 0x22, 0x80);
 
 	adap->fe = dvb_attach(dib8000_attach, &adap->dev->i2c_adap, 0x80,
 			      &dib807x_dib8000_config[0]);
@@ -1560,7 +1643,7 @@ static int stk807xpvr_frontend_attach0(struct dvb_usb_adapter *adap)
 static int stk807xpvr_frontend_attach1(struct dvb_usb_adapter *adap)
 {
 	/* initialize IC 1 */
-	dib8000_i2c_enumeration(&adap->dev->i2c_adap, 1, 0x22, 0x82);
+	dib8000_i2c_enumeration(&adap->dev->i2c_adap, 1, 0x12, 0x82);
 
 	adap->fe = dvb_attach(dib8000_attach, &adap->dev->i2c_adap, 0x82,
 			      &dib807x_dib8000_config[1]);
@@ -1568,6 +1651,245 @@ static int stk807xpvr_frontend_attach1(struct dvb_usb_adapter *adap)
 	return adap->fe == NULL ? -ENODEV : 0;
 }
 
+/* STK8096GP */
+struct dibx000_agc_config dib8090_agc_config[2] = {
+    {
+	BAND_UHF | BAND_VHF | BAND_LBAND | BAND_SBAND,
+	/* P_agc_use_sd_mod1=0, P_agc_use_sd_mod2=0, P_agc_freq_pwm_div=1,
+     * P_agc_inv_pwm1=0, P_agc_inv_pwm2=0, P_agc_inh_dc_rv_est=0,
+     * P_agc_time_est=3, P_agc_freeze=0, P_agc_nb_est=5, P_agc_write=0 */
+	(0 << 15) | (0 << 14) | (5 << 11) | (0 << 10) | (0 << 9) | (0 << 8)
+	| (3 << 5) | (0 << 4) | (5 << 1) | (0 << 0),
+
+	787,
+	10,
+
+	0,
+	118,
+
+	0,
+	3530,
+	1,
+	5,
+
+	65535,
+	0,
+
+	65535,
+	0,
+
+	0,
+	32,
+	114,
+	143,
+	144,
+	114,
+	227,
+	116,
+	117,
+
+	28,
+	26,
+	31,
+	51,
+
+	0,
+    },
+    {
+	BAND_CBAND,
+	/* P_agc_use_sd_mod1=0, P_agc_use_sd_mod2=0, P_agc_freq_pwm_div=1,
+     * P_agc_inv_pwm1=0, P_agc_inv_pwm2=0, P_agc_inh_dc_rv_est=0,
+     * P_agc_time_est=3, P_agc_freeze=0, P_agc_nb_est=5, P_agc_write=0 */
+	(0 << 15) | (0 << 14) | (5 << 11) | (0 << 10) | (0 << 9) | (0 << 8)
+	| (3 << 5) | (0 << 4) | (5 << 1) | (0 << 0),
+
+	787,
+	10,
+
+	0,
+	118,
+
+	0,
+	3530,
+	1,
+	5,
+
+	0,
+	0,
+
+	65535,
+	0,
+
+	0,
+	32,
+	114,
+	143,
+	144,
+	114,
+	227,
+	116,
+	117,
+
+	28,
+	26,
+	31,
+	51,
+
+	0,
+    }
+};
+
+static struct dibx000_bandwidth_config dib8090_pll_config_12mhz = {
+    54000, 13500,
+    1, 18, 3, 1, 0,
+    0, 0, 1, 1, 2,
+    (3 << 14) | (1 << 12) | (599 << 0),
+    (0 << 25) | 0,
+    20199727,
+    12000000,
+};
+
+static int dib8090_get_adc_power(struct dvb_frontend *fe)
+{
+    return dib8000_get_adc_power(fe, 1);
+}
+
+static struct dib8000_config dib809x_dib8000_config = {
+    .output_mpeg2_in_188_bytes = 1,
+
+    .agc_config_count = 2,
+    .agc = dib8090_agc_config,
+    .agc_control = dib0090_dcc_freq,
+    .pll = &dib8090_pll_config_12mhz,
+    .tuner_is_baseband = 1,
+
+    .gpio_dir = DIB8000_GPIO_DEFAULT_DIRECTIONS,
+    .gpio_val = DIB8000_GPIO_DEFAULT_VALUES,
+    .gpio_pwm_pos = DIB8000_GPIO_DEFAULT_PWM_POS,
+
+    .hostbus_diversity = 1,
+    .div_cfg = 0x31,
+    .output_mode = OUTMODE_MPEG2_FIFO,
+    .drives = 0x2d98,
+    .diversity_delay = 144,
+    .refclksel = 3,
+};
+
+static struct dib0090_config dib809x_dib0090_config = {
+    .io.pll_bypass = 1,
+    .io.pll_range = 1,
+    .io.pll_prediv = 1,
+    .io.pll_loopdiv = 20,
+    .io.adc_clock_ratio = 8,
+    .io.pll_int_loop_filt = 0,
+    .io.clock_khz = 12000,
+    .reset = dib80xx_tuner_reset,
+    .sleep = dib80xx_tuner_sleep,
+    .clkouttobamse = 1,
+    .analog_output = 1,
+    .i2c_address = DEFAULT_DIB0090_I2C_ADDRESS,
+    .wbd_vhf_offset = 100,
+    .wbd_cband_offset = 450,
+    .use_pwm_agc = 1,
+    .clkoutdrive = 1,
+    .get_adc_power = dib8090_get_adc_power,
+	.freq_offset_khz_uhf = 0,
+	.freq_offset_khz_vhf = -143,
+};
+
+static int dib8096_set_param_override(struct dvb_frontend *fe,
+		struct dvb_frontend_parameters *fep)
+{
+    struct dvb_usb_adapter *adap = fe->dvb->priv;
+    struct dib0700_adapter_state *state = adap->priv;
+    u8 band = BAND_OF_FREQUENCY(fep->frequency/1000);
+    u16 offset;
+    int ret = 0;
+    enum frontend_tune_state tune_state = CT_SHUTDOWN;
+    u16 ltgain, rf_gain_limit;
+
+    ret = state->set_param_save(fe, fep);
+    if (ret < 0)
+	return ret;
+
+    switch (band) {
+    case BAND_VHF:
+	    offset = 100;
+	    break;
+    case BAND_UHF:
+	    offset = 550;
+	    break;
+    default:
+	    offset = 0;
+	    break;
+    }
+    offset += (dib0090_get_wbd_offset(fe) * 8 * 18 / 33 + 1) / 2;
+    dib8000_set_wbd_ref(fe, offset);
+
+
+    if (band == BAND_CBAND) {
+	deb_info("tuning in CBAND - soft-AGC startup\n");
+	/* TODO specific wbd target for dib0090 - needed for startup ? */
+	dib0090_set_tune_state(fe, CT_AGC_START);
+	do {
+		ret = dib0090_gain_control(fe);
+		msleep(ret);
+		tune_state = dib0090_get_tune_state(fe);
+		if (tune_state == CT_AGC_STEP_0)
+			dib8000_set_gpio(fe, 6, 0, 1);
+		else if (tune_state == CT_AGC_STEP_1) {
+			dib0090_get_current_gain(fe, NULL, NULL, &rf_gain_limit, &ltgain);
+			if (rf_gain_limit == 0)
+				dib8000_set_gpio(fe, 6, 0, 0);
+		}
+	} while (tune_state < CT_AGC_STOP);
+	dib0090_pwm_gain_reset(fe);
+	dib8000_pwm_agc_reset(fe);
+	dib8000_set_tune_state(fe, CT_DEMOD_START);
+    } else {
+	deb_info("not tuning in CBAND - standard AGC startup\n");
+	dib0090_pwm_gain_reset(fe);
+    }
+
+    return 0;
+}
+
+static int dib809x_tuner_attach(struct dvb_usb_adapter *adap)
+{
+    struct dib0700_adapter_state *st = adap->priv;
+    struct i2c_adapter *tun_i2c = dib8000_get_i2c_master(adap->fe, DIBX000_I2C_INTERFACE_TUNER, 1);
+
+    if (dvb_attach(dib0090_register, adap->fe, tun_i2c, &dib809x_dib0090_config) == NULL)
+	return -ENODEV;
+
+    st->set_param_save = adap->fe->ops.tuner_ops.set_params;
+    adap->fe->ops.tuner_ops.set_params = dib8096_set_param_override;
+    return 0;
+}
+
+static int stk809x_frontend_attach(struct dvb_usb_adapter *adap)
+{
+	dib0700_set_gpio(adap->dev, GPIO6, GPIO_OUT, 1);
+	msleep(10);
+	dib0700_set_gpio(adap->dev, GPIO9, GPIO_OUT, 1);
+	dib0700_set_gpio(adap->dev, GPIO4, GPIO_OUT, 1);
+	dib0700_set_gpio(adap->dev, GPIO7, GPIO_OUT, 1);
+
+	dib0700_set_gpio(adap->dev, GPIO10, GPIO_OUT, 0);
+
+	dib0700_ctrl_clock(adap->dev, 72, 1);
+
+	msleep(10);
+	dib0700_set_gpio(adap->dev, GPIO10, GPIO_OUT, 1);
+	msleep(10);
+	dib0700_set_gpio(adap->dev, GPIO0, GPIO_OUT, 1);
+
+	dib8000_i2c_enumeration(&adap->dev->i2c_adap, 1, 18, 0x80);
+
+	adap->fe = dvb_attach(dib8000_attach, &adap->dev->i2c_adap, 0x80, &dib809x_dib8000_config);
+
+	return adap->fe == NULL ?  -ENODEV : 0;
+}
 
 /* STK7070PD */
 static struct dib7000p_config stk7070pd_dib7000p_config[2] = {
@@ -1854,13 +2176,17 @@ struct usb_device_id dib0700_usb_id_table[] = {
 	{ USB_DEVICE(USB_VID_YUAN,      USB_PID_YUAN_STK7700D) },
 /* 55 */{ USB_DEVICE(USB_VID_YUAN,	USB_PID_YUAN_STK7700D_2) },
 	{ USB_DEVICE(USB_VID_PINNACLE,	USB_PID_PINNACLE_PCTV73A) },
-	{ USB_DEVICE(USB_VID_PINNACLE,	USB_PID_PINNACLE_PCTV73ESE) },
-	{ USB_DEVICE(USB_VID_PINNACLE,	USB_PID_PINNACLE_PCTV282E) },
+	{ USB_DEVICE(USB_VID_PCTV,	USB_PID_PINNACLE_PCTV73ESE) },
+	{ USB_DEVICE(USB_VID_PCTV,	USB_PID_PINNACLE_PCTV282E) },
 	{ USB_DEVICE(USB_VID_DIBCOM,	USB_PID_DIBCOM_STK7770P) },
 /* 60 */{ USB_DEVICE(USB_VID_TERRATEC,	USB_PID_TERRATEC_CINERGY_T_XXS_2) },
 	{ USB_DEVICE(USB_VID_DIBCOM,    USB_PID_DIBCOM_STK807XPVR) },
 	{ USB_DEVICE(USB_VID_DIBCOM,    USB_PID_DIBCOM_STK807XP) },
 	{ USB_DEVICE(USB_VID_PIXELVIEW, USB_PID_PIXELVIEW_SBTVD) },
+	{ USB_DEVICE(USB_VID_EVOLUTEPC, USB_PID_TVWAY_PLUS) },
+/* 65 */{ USB_DEVICE(USB_VID_PINNACLE,	USB_PID_PINNACLE_PCTV73ESE) },
+	{ USB_DEVICE(USB_VID_PINNACLE,	USB_PID_PINNACLE_PCTV282E) },
+	{ USB_DEVICE(USB_VID_DIBCOM,    USB_PID_DIBCOM_STK8096GP) },
 	{ 0 }		/* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, dib0700_usb_id_table);
@@ -1895,6 +2221,10 @@ struct dvb_usb_device_properties dib0700_devices[] = {
 		.num_adapters = 1,
 		.adapter = {
 			{
+				.caps = DVB_USB_ADAP_HAS_PID_FILTER | DVB_USB_ADAP_PID_FILTER_CAN_BE_TURNED_OFF,
+				.pid_filter_count = 32,
+				.pid_filter       = stk70x0p_pid_filter,
+				.pid_filter_ctrl  = stk70x0p_pid_filter_ctrl,
 				.frontend_attach  = stk7700p_frontend_attach,
 				.tuner_attach     = stk7700p_tuner_attach,
 
@@ -1976,11 +2306,19 @@ struct dvb_usb_device_properties dib0700_devices[] = {
 		.num_adapters = 2,
 		.adapter = {
 			{
+				.caps = DVB_USB_ADAP_HAS_PID_FILTER | DVB_USB_ADAP_PID_FILTER_CAN_BE_TURNED_OFF,
+				.pid_filter_count = 32,
+				.pid_filter       = stk70x0p_pid_filter,
+				.pid_filter_ctrl  = stk70x0p_pid_filter_ctrl,
 				.frontend_attach  = stk7700d_frontend_attach,
 				.tuner_attach     = stk7700d_tuner_attach,
 
 				DIB0700_DEFAULT_STREAMING_CONFIG(0x02),
 			}, {
+				.caps = DVB_USB_ADAP_HAS_PID_FILTER | DVB_USB_ADAP_PID_FILTER_CAN_BE_TURNED_OFF,
+				.pid_filter_count = 32,
+				.pid_filter       = stk70x0p_pid_filter,
+				.pid_filter_ctrl  = stk70x0p_pid_filter_ctrl,
 				.frontend_attach  = stk7700d_frontend_attach,
 				.tuner_attach     = stk7700d_tuner_attach,
 
@@ -2023,6 +2361,10 @@ struct dvb_usb_device_properties dib0700_devices[] = {
 		.num_adapters = 1,
 		.adapter = {
 			{
+				.caps = DVB_USB_ADAP_HAS_PID_FILTER | DVB_USB_ADAP_PID_FILTER_CAN_BE_TURNED_OFF,
+				.pid_filter_count = 32,
+				.pid_filter       = stk70x0p_pid_filter,
+				.pid_filter_ctrl  = stk70x0p_pid_filter_ctrl,
 				.frontend_attach  = stk7700P2_frontend_attach,
 				.tuner_attach     = stk7700d_tuner_attach,
 
@@ -2055,6 +2397,10 @@ struct dvb_usb_device_properties dib0700_devices[] = {
 		.num_adapters = 1,
 		.adapter = {
 			{
+				.caps = DVB_USB_ADAP_HAS_PID_FILTER | DVB_USB_ADAP_PID_FILTER_CAN_BE_TURNED_OFF,
+				.pid_filter_count = 32,
+				.pid_filter       = stk70x0p_pid_filter,
+				.pid_filter_ctrl  = stk70x0p_pid_filter_ctrl,
 				.frontend_attach  = stk7070p_frontend_attach,
 				.tuner_attach     = dib7070p_tuner_attach,
 
@@ -2122,6 +2468,10 @@ struct dvb_usb_device_properties dib0700_devices[] = {
 		.num_adapters = 1,
 		.adapter = {
 			{
+				.caps = DVB_USB_ADAP_HAS_PID_FILTER | DVB_USB_ADAP_PID_FILTER_CAN_BE_TURNED_OFF,
+				.pid_filter_count = 32,
+				.pid_filter       = stk70x0p_pid_filter,
+				.pid_filter_ctrl  = stk70x0p_pid_filter_ctrl,
 				.frontend_attach  = stk7070p_frontend_attach,
 				.tuner_attach     = dib7070p_tuner_attach,
 
@@ -2138,11 +2488,11 @@ struct dvb_usb_device_properties dib0700_devices[] = {
 				{ NULL },
 			},
 			{   "Pinnacle PCTV 73e SE",
-				{ &dib0700_usb_id_table[57], NULL },
+				{ &dib0700_usb_id_table[57], &dib0700_usb_id_table[65], NULL },
 				{ NULL },
 			},
 			{   "Pinnacle PCTV 282e",
-				{ &dib0700_usb_id_table[58], NULL },
+				{ &dib0700_usb_id_table[58], &dib0700_usb_id_table[66], NULL },
 				{ NULL },
 			},
 		},
@@ -2157,6 +2507,10 @@ struct dvb_usb_device_properties dib0700_devices[] = {
 		.num_adapters = 2,
 		.adapter = {
 			{
+				.caps = DVB_USB_ADAP_HAS_PID_FILTER | DVB_USB_ADAP_PID_FILTER_CAN_BE_TURNED_OFF,
+				.pid_filter_count = 32,
+				.pid_filter       = stk70x0p_pid_filter,
+				.pid_filter_ctrl  = stk70x0p_pid_filter_ctrl,
 				.frontend_attach  = stk7070pd_frontend_attach0,
 				.tuner_attach     = dib7070p_tuner_attach,
 
@@ -2164,6 +2518,10 @@ struct dvb_usb_device_properties dib0700_devices[] = {
 
 				.size_of_priv     = sizeof(struct dib0700_adapter_state),
 			}, {
+				.caps = DVB_USB_ADAP_HAS_PID_FILTER | DVB_USB_ADAP_PID_FILTER_CAN_BE_TURNED_OFF,
+				.pid_filter_count = 32,
+				.pid_filter       = stk70x0p_pid_filter,
+				.pid_filter_ctrl  = stk70x0p_pid_filter_ctrl,
 				.frontend_attach  = stk7070pd_frontend_attach1,
 				.tuner_attach     = dib7070p_tuner_attach,
 
@@ -2210,6 +2568,10 @@ struct dvb_usb_device_properties dib0700_devices[] = {
 		.num_adapters = 1,
 		.adapter = {
 			{
+				.caps = DVB_USB_ADAP_HAS_PID_FILTER | DVB_USB_ADAP_PID_FILTER_CAN_BE_TURNED_OFF,
+				.pid_filter_count = 32,
+				.pid_filter       = stk70x0p_pid_filter,
+				.pid_filter_ctrl  = stk70x0p_pid_filter_ctrl,
 				.frontend_attach  = stk7700ph_frontend_attach,
 				.tuner_attach     = stk7700ph_tuner_attach,
 
@@ -2322,6 +2684,10 @@ struct dvb_usb_device_properties dib0700_devices[] = {
 		.num_adapters = 1,
 		.adapter = {
 			{
+				.caps = DVB_USB_ADAP_HAS_PID_FILTER | DVB_USB_ADAP_PID_FILTER_CAN_BE_TURNED_OFF,
+				.pid_filter_count = 32,
+				.pid_filter       = stk70x0p_pid_filter,
+				.pid_filter_ctrl  = stk70x0p_pid_filter_ctrl,
 				.frontend_attach  = stk7070p_frontend_attach,
 				.tuner_attach     = dib7770p_tuner_attach,
 
@@ -2353,6 +2719,10 @@ struct dvb_usb_device_properties dib0700_devices[] = {
 		.num_adapters = 1,
 		.adapter = {
 			{
+				.caps  = DVB_USB_ADAP_HAS_PID_FILTER | DVB_USB_ADAP_PID_FILTER_CAN_BE_TURNED_OFF,
+				.pid_filter_count = 32,
+				.pid_filter = stk80xx_pid_filter,
+				.pid_filter_ctrl = stk80xx_pid_filter_ctrl,
 				.frontend_attach  = stk807x_frontend_attach,
 				.tuner_attach     = dib807x_tuner_attach,
 
@@ -2363,7 +2733,7 @@ struct dvb_usb_device_properties dib0700_devices[] = {
 			},
 		},
 
-		.num_device_descs = 2,
+		.num_device_descs = 3,
 		.devices = {
 			{   "DiBcom STK807xP reference design",
 				{ &dib0700_usb_id_table[62], NULL },
@@ -2373,6 +2743,10 @@ struct dvb_usb_device_properties dib0700_devices[] = {
 				{ &dib0700_usb_id_table[63], NULL },
 				{ NULL },
 			},
+			{   "EvolutePC TVWay+",
+				{ &dib0700_usb_id_table[64], NULL },
+				{ NULL },
+			},
 		},
 
 		.rc_interval      = DEFAULT_RC_INTERVAL,
@@ -2384,6 +2758,10 @@ struct dvb_usb_device_properties dib0700_devices[] = {
 		.num_adapters = 2,
 		.adapter = {
 			{
+				.caps  = DVB_USB_ADAP_HAS_PID_FILTER | DVB_USB_ADAP_PID_FILTER_CAN_BE_TURNED_OFF,
+				.pid_filter_count = 32,
+				.pid_filter = stk80xx_pid_filter,
+				.pid_filter_ctrl = stk80xx_pid_filter_ctrl,
 				.frontend_attach  = stk807xpvr_frontend_attach0,
 				.tuner_attach     = dib807x_tuner_attach,
 
@@ -2393,6 +2771,10 @@ struct dvb_usb_device_properties dib0700_devices[] = {
 					sizeof(struct dib0700_adapter_state),
 			},
 			{
+				.caps  = DVB_USB_ADAP_HAS_PID_FILTER | DVB_USB_ADAP_PID_FILTER_CAN_BE_TURNED_OFF,
+				.pid_filter_count = 32,
+				.pid_filter = stk80xx_pid_filter,
+				.pid_filter_ctrl = stk80xx_pid_filter_ctrl,
 				.frontend_attach  = stk807xpvr_frontend_attach1,
 				.tuner_attach     = dib807x_tuner_attach,
 
@@ -2415,6 +2797,37 @@ struct dvb_usb_device_properties dib0700_devices[] = {
 		.rc_key_map       = dib0700_rc_keys,
 		.rc_key_map_size  = ARRAY_SIZE(dib0700_rc_keys),
 		.rc_query         = dib0700_rc_query
+	}, { DIB0700_DEFAULT_DEVICE_PROPERTIES,
+		.num_adapters = 1,
+		.adapter = {
+			{
+				.caps  = DVB_USB_ADAP_HAS_PID_FILTER |
+					DVB_USB_ADAP_PID_FILTER_CAN_BE_TURNED_OFF,
+				.pid_filter_count = 32,
+				.pid_filter = stk80xx_pid_filter,
+				.pid_filter_ctrl = stk80xx_pid_filter_ctrl,
+				.frontend_attach  = stk809x_frontend_attach,
+				.tuner_attach     = dib809x_tuner_attach,
+
+				DIB0700_DEFAULT_STREAMING_CONFIG(0x02),
+
+				.size_of_priv =
+					sizeof(struct dib0700_adapter_state),
+			},
+		},
+
+		.num_device_descs = 1,
+		.devices = {
+			{   "DiBcom STK8096GP reference design",
+				{ &dib0700_usb_id_table[67], NULL },
+				{ NULL },
+			},
+		},
+
+		.rc_interval      = DEFAULT_RC_INTERVAL,
+		.rc_key_map       = dib0700_rc_keys,
+		.rc_key_map_size  = ARRAY_SIZE(dib0700_rc_keys),
+		.rc_query         = dib0700_rc_query
 	},
 };
 
diff --git a/drivers/media/dvb/dvb-usb/dibusb-common.c b/drivers/media/dvb/dvb-usb/dibusb-common.c
index da34979b5337..9143b5631e88 100644
--- a/drivers/media/dvb/dvb-usb/dibusb-common.c
+++ b/drivers/media/dvb/dvb-usb/dibusb-common.c
@@ -142,8 +142,13 @@ static int dibusb_i2c_xfer(struct i2c_adapter *adap,struct i2c_msg msg[],int num
 		} else if ((msg[i].flags & I2C_M_RD) == 0) {
 			if (dibusb_i2c_msg(d, msg[i].addr, msg[i].buf,msg[i].len,NULL,0) < 0)
 				break;
-		} else
-			break;
+		} else if (msg[i].addr != 0x50) {
+			/* 0x50 is the address of the eeprom - we need to protect it
+			 * from dibusb's bad i2c implementation: reads without
+			 * writing the offset before are forbidden */
+			if (dibusb_i2c_msg(d, msg[i].addr, NULL, 0, msg[i].buf, msg[i].len) < 0)
+				break;
+		}
 	}
 
 	mutex_unlock(&d->i2c_mutex);
@@ -243,6 +248,12 @@ static struct dib3000mc_config mod3000p_dib3000p_config = {
 
 int dibusb_dib3000mc_frontend_attach(struct dvb_usb_adapter *adap)
 {
+	if (adap->dev->udev->descriptor.idVendor  == USB_VID_LITEON &&
+			adap->dev->udev->descriptor.idProduct ==
+			USB_PID_LITEON_DVB_T_WARM) {
+		msleep(1000);
+	}
+
 	if ((adap->fe = dvb_attach(dib3000mc_attach, &adap->dev->i2c_adap, DEFAULT_DIB3000P_I2C_ADDRESS,  &mod3000p_dib3000p_config)) != NULL ||
 		(adap->fe = dvb_attach(dib3000mc_attach, &adap->dev->i2c_adap, DEFAULT_DIB3000MC_I2C_ADDRESS, &mod3000p_dib3000p_config)) != NULL) {
 		if (adap->priv != NULL) {
diff --git a/drivers/media/dvb/dvb-usb/dibusb-mb.c b/drivers/media/dvb/dvb-usb/dibusb-mb.c
index eeef50bff4f9..5c0126dc1ff9 100644
--- a/drivers/media/dvb/dvb-usb/dibusb-mb.c
+++ b/drivers/media/dvb/dvb-usb/dibusb-mb.c
@@ -242,7 +242,7 @@ static struct dvb_usb_device_properties dibusb1_1_properties = {
 			{ &dibusb_dib3000mb_table[9],  &dibusb_dib3000mb_table[11], NULL },
 			{ &dibusb_dib3000mb_table[10], &dibusb_dib3000mb_table[12], NULL },
 		},
-		{	"Unkown USB1.1 DVB-T device ???? please report the name to the author",
+		{	"Unknown USB1.1 DVB-T device ???? please report the name to the author",
 			{ &dibusb_dib3000mb_table[13], NULL },
 			{ &dibusb_dib3000mb_table[14], NULL },
 		},
diff --git a/drivers/media/dvb/dvb-usb/dvb-usb-dvb.c b/drivers/media/dvb/dvb-usb/dvb-usb-dvb.c
index 8a7d87bcd1d9..df1ec3e69f4a 100644
--- a/drivers/media/dvb/dvb-usb/dvb-usb-dvb.c
+++ b/drivers/media/dvb/dvb-usb/dvb-usb-dvb.c
@@ -88,6 +88,7 @@ int dvb_usb_adapter_dvb_init(struct dvb_usb_adapter *adap, short *adapter_nums)
 		goto err;
 	}
 	adap->dvb_adap.priv = adap;
+	adap->dvb_adap.fe_ioctl_override = adap->props.fe_ioctl_override;
 
 	if (adap->dev->props.read_mac_address) {
 		if (adap->dev->props.read_mac_address(adap->dev,adap->dvb_adap.proposed_mac) == 0)
diff --git a/drivers/media/dvb/dvb-usb/dvb-usb-ids.h b/drivers/media/dvb/dvb-usb/dvb-usb-ids.h
index a548c14c1944..bc3581d58ced 100644
--- a/drivers/media/dvb/dvb-usb/dvb-usb-ids.h
+++ b/drivers/media/dvb/dvb-usb/dvb-usb-ids.h
@@ -27,6 +27,7 @@
 #define USB_VID_DIBCOM				0x10b8
 #define USB_VID_DPOSH				0x1498
 #define USB_VID_DVICO				0x0fe9
+#define USB_VID_E3C				0x18b4
 #define USB_VID_ELGATO				0x0fd9
 #define USB_VID_EMPIA				0xeb1a
 #define USB_VID_GENPIX				0x09c0
@@ -46,6 +47,7 @@
 #define USB_VID_MSI_2				0x1462
 #define USB_VID_OPERA1				0x695c
 #define USB_VID_PINNACLE			0x2304
+#define USB_VID_PCTV				0x2013
 #define USB_VID_PIXELVIEW			0x1554
 #define USB_VID_TECHNOTREND			0x0b48
 #define USB_VID_TERRATEC			0x0ccd
@@ -61,6 +63,7 @@
 #define USB_VID_XTENSIONS			0x1ae7
 #define USB_VID_HUMAX_COEX			0x10b9
 #define USB_VID_774				0x7a69
+#define USB_VID_EVOLUTEPC			0x1e59
 
 /* Product IDs */
 #define USB_PID_ADSTECH_USB2_COLD			0xa333
@@ -99,10 +102,16 @@
 #define USB_PID_DIBCOM_STK7070PD			0x1ebe
 #define USB_PID_DIBCOM_STK807XP				0x1f90
 #define USB_PID_DIBCOM_STK807XPVR			0x1f98
+#define USB_PID_DIBCOM_STK8096GP                        0x1fa0
 #define USB_PID_DIBCOM_ANCHOR_2135_COLD			0x2131
 #define USB_PID_DIBCOM_STK7770P				0x1e80
 #define USB_PID_DPOSH_M9206_COLD			0x9206
 #define USB_PID_DPOSH_M9206_WARM			0xa090
+#define USB_PID_E3C_EC168				0x1689
+#define USB_PID_E3C_EC168_2				0xfffa
+#define USB_PID_E3C_EC168_3				0xfffb
+#define USB_PID_E3C_EC168_4				0x1001
+#define USB_PID_E3C_EC168_5				0x1002
 #define USB_PID_UNIWILL_STK7700P			0x6003
 #define USB_PID_GENIUS_TVGO_DVB_T03			0x4012
 #define USB_PID_GRANDTEC_DVBT_USB_COLD			0x0fa0
@@ -115,6 +124,7 @@
 #define USB_PID_KWORLD_395U_3				0xe395
 #define USB_PID_KWORLD_MC810				0xc810
 #define USB_PID_KWORLD_PC160_2T				0xc160
+#define USB_PID_KWORLD_PC160_T				0xc161
 #define USB_PID_KWORLD_VSTREAM_COLD			0x17de
 #define USB_PID_KWORLD_VSTREAM_WARM			0x17df
 #define USB_PID_TERRATEC_CINERGY_T_USB_XE		0x0055
@@ -203,6 +213,7 @@
 #define USB_PID_PINNACLE_PCTV801E_SE			0x023b
 #define USB_PID_PINNACLE_PCTV73A			0x0243
 #define USB_PID_PINNACLE_PCTV73ESE			0x0245
+#define USB_PID_PINNACLE_PCTV74E			0x0246
 #define USB_PID_PINNACLE_PCTV282E			0x0248
 #define USB_PID_PIXELVIEW_SBTVD				0x5010
 #define USB_PID_PCTV_200E				0x020e
@@ -271,10 +282,13 @@
 #define USB_PID_TELESTAR_STARSTICK_2			0x8000
 #define USB_PID_MSI_DIGI_VOX_MINI_III                   0x8807
 #define USB_PID_SONY_PLAYTV				0x0003
+#define USB_PID_MYGICA_D689				0xd811
 #define USB_PID_ELGATO_EYETV_DTT			0x0021
 #define USB_PID_ELGATO_EYETV_DTT_Dlx			0x0020
 #define USB_PID_DVB_T_USB_STICK_HIGH_SPEED_COLD		0x5000
 #define USB_PID_DVB_T_USB_STICK_HIGH_SPEED_WARM		0x5001
 #define USB_PID_FRIIO_WHITE				0x0001
+#define USB_PID_TVWAY_PLUS				0x0002
+#define USB_PID_SVEON_STV20				0xe39d
 
 #endif
diff --git a/drivers/media/dvb/dvb-usb/dvb-usb-remote.c b/drivers/media/dvb/dvb-usb/dvb-usb-remote.c
index edde87c6aa3a..6b5ded9e7d5d 100644
--- a/drivers/media/dvb/dvb-usb/dvb-usb-remote.c
+++ b/drivers/media/dvb/dvb-usb/dvb-usb-remote.c
@@ -259,7 +259,7 @@ int dvb_usb_nec_rc_key_to_event(struct dvb_usb_device *d,
 			*state = REMOTE_KEY_REPEAT;
 			break;
 		default:
-			deb_err("unkown type of remote status: %d\n",keybuf[0]);
+			deb_err("unknown type of remote status: %d\n",keybuf[0]);
 			break;
 	}
 	return 0;
diff --git a/drivers/media/dvb/dvb-usb/dvb-usb.h b/drivers/media/dvb/dvb-usb/dvb-usb.h
index fe2b87efb3f1..0143aef19ecd 100644
--- a/drivers/media/dvb/dvb-usb/dvb-usb.h
+++ b/drivers/media/dvb/dvb-usb/dvb-usb.h
@@ -162,6 +162,9 @@ struct dvb_usb_adapter_properties {
 	struct usb_data_stream_properties stream;
 
 	int size_of_priv;
+
+	int (*fe_ioctl_override) (struct dvb_frontend *,
+				  unsigned int, void *, unsigned int);
 };
 
 /**
diff --git a/drivers/media/dvb/dvb-usb/dw2102.c b/drivers/media/dvb/dvb-usb/dw2102.c
index 5bb9479d154e..64132c0cf80d 100644
--- a/drivers/media/dvb/dvb-usb/dw2102.c
+++ b/drivers/media/dvb/dvb-usb/dw2102.c
@@ -20,6 +20,11 @@
 #include "tda1002x.h"
 #include "mt312.h"
 #include "zl10039.h"
+#include "ds3000.h"
+#include "stv0900.h"
+#include "stv6110.h"
+#include "stb6100.h"
+#include "stb6100_proc.h"
 
 #ifndef USB_PID_DW2102
 #define USB_PID_DW2102 0x2102
@@ -37,12 +42,20 @@
 #define USB_PID_CINERGY_S 0x0064
 #endif
 
+#ifndef USB_PID_TEVII_S630
+#define USB_PID_TEVII_S630 0xd630
+#endif
+
 #ifndef USB_PID_TEVII_S650
 #define USB_PID_TEVII_S650 0xd650
 #endif
 
-#ifndef USB_PID_TEVII_S630
-#define USB_PID_TEVII_S630 0xd630
+#ifndef USB_PID_TEVII_S660
+#define USB_PID_TEVII_S660 0xd660
+#endif
+
+#ifndef USB_PID_PROF_1100
+#define USB_PID_PROF_1100 0xb012
 #endif
 
 #define DW210X_READ_MSG 0
@@ -55,6 +68,10 @@
 #define DW2102_VOLTAGE_CTRL (0x1800)
 #define DW2102_RC_QUERY (0x1a00)
 
+#define	err_str "did not find the firmware file. (%s) " \
+		"Please see linux/Documentation/dvb/ for more details " \
+		"on firmware-problems."
+
 struct dvb_usb_rc_keys_table {
 	struct dvb_usb_rc_key *rc_keys;
 	int rc_keys_size;
@@ -71,6 +88,12 @@ static int ir_keymap;
 module_param_named(keymap, ir_keymap, int, 0644);
 MODULE_PARM_DESC(keymap, "set keymap 0=default 1=dvbworld 2=tevii 3=tbs  ...");
 
+/* demod probe */
+static int demod_probe = 1;
+module_param_named(demod, demod_probe, int, 0644);
+MODULE_PARM_DESC(demod, "demod to probe (1=cx24116 2=stv0903+stv6110 "
+			"4=stv0903+stb6100(or-able)).");
+
 DVB_DEFINE_MOD_OPT_ADAPTER_NR(adapter_nr);
 
 static int dw210x_op_rw(struct usb_device *dev, u8 request, u16 value,
@@ -183,7 +206,7 @@ static int dw2102_serit_i2c_transfer(struct i2c_adapter *adap,
 	switch (num) {
 	case 2:
 		/* read si2109 register by number */
-		buf6[0] = 0xd0;
+		buf6[0] = msg[0].addr << 1;
 		buf6[1] = msg[0].len;
 		buf6[2] = msg[0].buf[0];
 		ret = dw210x_op_rw(d->udev, 0xc2, 0, 0,
@@ -198,7 +221,7 @@ static int dw2102_serit_i2c_transfer(struct i2c_adapter *adap,
 		switch (msg[0].addr) {
 		case 0x68:
 			/* write to si2109 register */
-			buf6[0] = 0xd0;
+			buf6[0] = msg[0].addr << 1;
 			buf6[1] = msg[0].len;
 			memcpy(buf6 + 2, msg[0].buf, msg[0].len);
 			ret = dw210x_op_rw(d->udev, 0xc2, 0, 0, buf6,
@@ -239,7 +262,7 @@ static int dw2102_earda_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg ms
 		/* read */
 		/* first write first register number */
 		u8 ibuf[msg[1].len + 2], obuf[3];
-		obuf[0] = 0xd0;
+		obuf[0] = msg[0].addr << 1;
 		obuf[1] = msg[0].len;
 		obuf[2] = msg[0].buf[0];
 		ret = dw210x_op_rw(d->udev, 0xc2, 0, 0,
@@ -256,7 +279,7 @@ static int dw2102_earda_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg ms
 		case 0x68: {
 			/* write to register */
 			u8 obuf[msg[0].len + 2];
-			obuf[0] = 0xd0;
+			obuf[0] = msg[0].addr << 1;
 			obuf[1] = msg[0].len;
 			memcpy(obuf + 2, msg[0].buf, msg[0].len);
 			ret = dw210x_op_rw(d->udev, 0xc2, 0, 0,
@@ -266,7 +289,7 @@ static int dw2102_earda_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg ms
 		case 0x61: {
 			/* write to tuner */
 			u8 obuf[msg[0].len + 2];
-			obuf[0] = 0xc2;
+			obuf[0] = msg[0].addr << 1;
 			obuf[1] = msg[0].len;
 			memcpy(obuf + 2, msg[0].buf, msg[0].len);
 			ret = dw210x_op_rw(d->udev, 0xc2, 0, 0,
@@ -301,78 +324,78 @@ static int dw2104_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], i
 {
 	struct dvb_usb_device *d = i2c_get_adapdata(adap);
 	int ret = 0;
-	int len, i;
+	int len, i, j;
 
 	if (!d)
 		return -ENODEV;
 	if (mutex_lock_interruptible(&d->i2c_mutex) < 0)
 		return -EAGAIN;
 
-	switch (num) {
-	case 2: {
-		/* read */
-		/* first write first register number */
-		u8 ibuf[msg[1].len + 2], obuf[3];
-		obuf[0] = 0xaa;
-		obuf[1] = msg[0].len;
-		obuf[2] = msg[0].buf[0];
-		ret = dw210x_op_rw(d->udev, 0xc2, 0, 0,
-				obuf, msg[0].len + 2, DW210X_WRITE_MSG);
-		/* second read registers */
-		ret = dw210x_op_rw(d->udev, 0xc3, 0xab , 0,
-				ibuf, msg[1].len + 2, DW210X_READ_MSG);
-		memcpy(msg[1].buf, ibuf + 2, msg[1].len);
-
-		break;
-	}
-	case 1:
-		switch (msg[0].addr) {
-		case 0x55: {
-			if (msg[0].buf[0] == 0xf7) {
-				/* firmware */
-				/* Write in small blocks */
-				u8 obuf[19];
-				obuf[0] = 0xaa;
-				obuf[1] = 0x11;
-				obuf[2] = 0xf7;
-				len = msg[0].len - 1;
-				i = 1;
-				do {
-					memcpy(obuf + 3, msg[0].buf + i, (len > 16 ? 16 : len));
-					ret = dw210x_op_rw(d->udev, 0xc2, 0, 0,
-						obuf, (len > 16 ? 16 : len) + 3, DW210X_WRITE_MSG);
-					i += 16;
-					len -= 16;
-				} while (len > 0);
-			} else {
-				/* write to register */
-				u8 obuf[msg[0].len + 2];
-				obuf[0] = 0xaa;
-				obuf[1] = msg[0].len;
-				memcpy(obuf + 2, msg[0].buf, msg[0].len);
-				ret = dw210x_op_rw(d->udev, 0xc2, 0, 0,
-						obuf, msg[0].len + 2, DW210X_WRITE_MSG);
-			}
-			break;
-		}
+	for (j = 0; j < num; j++) {
+		switch (msg[j].addr) {
 		case(DW2102_RC_QUERY): {
 			u8 ibuf[2];
 			ret  = dw210x_op_rw(d->udev, 0xb8, 0, 0,
 					ibuf, 2, DW210X_READ_MSG);
-			memcpy(msg[0].buf, ibuf , 2);
+			memcpy(msg[j].buf, ibuf , 2);
 			break;
 		}
 		case(DW2102_VOLTAGE_CTRL): {
 			u8 obuf[2];
 			obuf[0] = 0x30;
-			obuf[1] = msg[0].buf[0];
+			obuf[1] = msg[j].buf[0];
 			ret = dw210x_op_rw(d->udev, 0xb2, 0, 0,
 					obuf, 2, DW210X_WRITE_MSG);
 			break;
 		}
+		/*case 0x55: cx24116
+		case 0x6a: stv0903
+		case 0x68: ds3000, stv0903
+		case 0x60: ts2020, stv6110, stb6100 */
+		default: {
+			if (msg[j].flags == I2C_M_RD) {
+				/* read registers */
+				u8  ibuf[msg[j].len + 2];
+				ret = dw210x_op_rw(d->udev, 0xc3,
+						(msg[j].addr << 1) + 1, 0,
+						ibuf, msg[j].len + 2,
+						DW210X_READ_MSG);
+				memcpy(msg[j].buf, ibuf + 2, msg[j].len);
+			mdelay(10);
+			} else if (((msg[j].buf[0] == 0xb0) &&
+						(msg[j].addr == 0x68)) ||
+						((msg[j].buf[0] == 0xf7) &&
+						(msg[j].addr == 0x55))) {
+				/* write firmware */
+				u8 obuf[19];
+				obuf[0] = msg[j].addr << 1;
+				obuf[1] = (msg[j].len > 15 ? 17 : msg[j].len);
+				obuf[2] = msg[j].buf[0];
+				len = msg[j].len - 1;
+				i = 1;
+				do {
+					memcpy(obuf + 3, msg[j].buf + i,
+							(len > 16 ? 16 : len));
+					ret = dw210x_op_rw(d->udev, 0xc2, 0, 0,
+						obuf, (len > 16 ? 16 : len) + 3,
+						DW210X_WRITE_MSG);
+					i += 16;
+					len -= 16;
+				} while (len > 0);
+			} else {
+				/* write registers */
+				u8 obuf[msg[j].len + 2];
+				obuf[0] = msg[j].addr << 1;
+				obuf[1] = msg[j].len;
+				memcpy(obuf + 2, msg[j].buf, msg[j].len);
+				ret = dw210x_op_rw(d->udev, 0xc2, 0, 0,
+						obuf, msg[j].len + 2,
+						DW210X_WRITE_MSG);
+			}
+			break;
+		}
 		}
 
-		break;
 	}
 
 	mutex_unlock(&d->i2c_mutex);
@@ -442,63 +465,85 @@ static int dw3101_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
 	return num;
 }
 
-static int s630_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+static int s6x0_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
 								int num)
 {
 	struct dvb_usb_device *d = i2c_get_adapdata(adap);
 	int ret = 0;
+	int len, i, j;
 
 	if (!d)
 		return -ENODEV;
 	if (mutex_lock_interruptible(&d->i2c_mutex) < 0)
 		return -EAGAIN;
 
-	switch (num) {
-	case 2: { /* read */
-		u8 ibuf[msg[1].len], obuf[3];
-		obuf[0] = msg[1].len;
-		obuf[1] = (msg[0].addr << 1);
-		obuf[2] = msg[0].buf[0];
-
-		ret = dw210x_op_rw(d->udev, 0x90, 0, 0,
-					obuf, 3, DW210X_WRITE_MSG);
-		msleep(5);
-		ret = dw210x_op_rw(d->udev, 0x91, 0, 0,
-					ibuf, msg[1].len, DW210X_READ_MSG);
-		memcpy(msg[1].buf, ibuf, msg[1].len);
-		break;
-	}
-	case 1:
-		switch (msg[0].addr) {
-		case 0x60:
-		case 0x0e: {
-			/* write to zl10313, zl10039 register, */
-			u8 obuf[msg[0].len + 2];
-			obuf[0] = msg[0].len + 1;
-			obuf[1] = (msg[0].addr << 1);
-			memcpy(obuf + 2, msg[0].buf, msg[0].len);
-			ret = dw210x_op_rw(d->udev, 0x80, 0, 0,
-					obuf, msg[0].len + 2, DW210X_WRITE_MSG);
-			break;
-		}
+	for (j = 0; j < num; j++) {
+		switch (msg[j].addr) {
 		case (DW2102_RC_QUERY): {
 			u8 ibuf[4];
 			ret  = dw210x_op_rw(d->udev, 0xb8, 0, 0,
 					ibuf, 4, DW210X_READ_MSG);
-			msg[0].buf[0] = ibuf[3];
+			memcpy(msg[j].buf, ibuf + 1, 2);
 			break;
 		}
 		case (DW2102_VOLTAGE_CTRL): {
 			u8 obuf[2];
-			obuf[0] = 0x03;
-			obuf[1] = msg[0].buf[0];
+			obuf[0] = 3;
+			obuf[1] = msg[j].buf[0];
 			ret = dw210x_op_rw(d->udev, 0x8a, 0, 0,
 					obuf, 2, DW210X_WRITE_MSG);
 			break;
 		}
+		/*case 0x55: cx24116
+		case 0x6a: stv0903
+		case 0x68: ds3000, stv0903
+		case 0x60: ts2020, stv6110, stb6100
+		case 0xa0: eeprom */
+		default: {
+			if (msg[j].flags == I2C_M_RD) {
+				/* read registers */
+				u8 ibuf[msg[j].len];
+				ret = dw210x_op_rw(d->udev, 0x91, 0, 0,
+						ibuf, msg[j].len,
+						DW210X_READ_MSG);
+				memcpy(msg[j].buf, ibuf, msg[j].len);
+				break;
+			} else if ((msg[j].buf[0] == 0xb0) &&
+						(msg[j].addr == 0x68)) {
+				/* write firmware */
+				u8 obuf[19];
+				obuf[0] = (msg[j].len > 16 ?
+						18 : msg[j].len + 1);
+				obuf[1] = msg[j].addr << 1;
+				obuf[2] = msg[j].buf[0];
+				len = msg[j].len - 1;
+				i = 1;
+				do {
+					memcpy(obuf + 3, msg[j].buf + i,
+							(len > 16 ? 16 : len));
+					ret = dw210x_op_rw(d->udev, 0x80, 0, 0,
+						obuf, (len > 16 ? 16 : len) + 3,
+						DW210X_WRITE_MSG);
+					i += 16;
+					len -= 16;
+				} while (len > 0);
+			} else {
+				/* write registers */
+				u8 obuf[msg[j].len + 2];
+				obuf[0] = msg[j].len + 1;
+				obuf[1] = (msg[j].addr << 1);
+				memcpy(obuf + 2, msg[j].buf, msg[j].len);
+				ret = dw210x_op_rw(d->udev,
+						(num > 1 ? 0x90 : 0x80), 0, 0,
+						obuf, msg[j].len + 2,
+						DW210X_WRITE_MSG);
+				break;
+			}
+			break;
+		}
 		}
 
-		break;
+		msleep(3);
 	}
 
 	mutex_unlock(&d->i2c_mutex);
@@ -535,8 +580,8 @@ static struct i2c_algorithm dw3101_i2c_algo = {
 	.functionality = dw210x_i2c_func,
 };
 
-static struct i2c_algorithm s630_i2c_algo = {
-	.master_xfer = s630_i2c_transfer,
+static struct i2c_algorithm s6x0_i2c_algo = {
+	.master_xfer = s6x0_i2c_transfer,
 	.functionality = dw210x_i2c_func,
 };
 
@@ -564,25 +609,34 @@ static int dw210x_read_mac_address(struct dvb_usb_device *d, u8 mac[6])
 	return 0;
 };
 
-static int s630_read_mac_address(struct dvb_usb_device *d, u8 mac[6])
+static int s6x0_read_mac_address(struct dvb_usb_device *d, u8 mac[6])
 {
 	int i, ret;
-	u8 buf[3], eeprom[256], eepromline[16];
+	u8 ibuf[] = { 0 }, obuf[] = { 0 };
+	u8 eeprom[256], eepromline[16];
+	struct i2c_msg msg[] = {
+		{
+			.addr = 0xa0 >> 1,
+			.flags = 0,
+			.buf = obuf,
+			.len = 1,
+		}, {
+			.addr = 0xa0 >> 1,
+			.flags = I2C_M_RD,
+			.buf = ibuf,
+			.len = 1,
+		}
+	};
 
 	for (i = 0; i < 256; i++) {
-		buf[0] = 1;
-		buf[1] = 0xa0;
-		buf[2] = i;
-		ret = dw210x_op_rw(d->udev, 0x90, 0, 0,
-					buf, 3, DW210X_WRITE_MSG);
-		ret = dw210x_op_rw(d->udev, 0x91, 0, 0,
-					buf, 1, DW210X_READ_MSG);
-		if (ret < 0) {
+		obuf[0] = i;
+		ret = s6x0_i2c_transfer(&d->i2c_adap, msg, 2);
+		if (ret != 2) {
 			err("read eeprom failed.");
 			return -1;
 		} else {
-			eepromline[i % 16] = buf[0];
-			eeprom[i] = buf[0];
+			eepromline[i % 16] = ibuf[0];
+			eeprom[i] = ibuf[0];
 		}
 
 		if ((i % 16) == 15) {
@@ -644,19 +698,104 @@ static struct mt312_config zl313_config = {
 	.demod_address = 0x0e,
 };
 
+static struct ds3000_config dw2104_ds3000_config = {
+	.demod_address = 0x68,
+};
+
+static struct stv0900_config dw2104a_stv0900_config = {
+	.demod_address = 0x6a,
+	.demod_mode = 0,
+	.xtal = 27000000,
+	.clkmode = 3,/* 0-CLKI, 2-XTALI, else AUTO */
+	.diseqc_mode = 2,/* 2/3 PWM */
+	.tun1_maddress = 0,/* 0x60 */
+	.tun1_adc = 0,/* 2 Vpp */
+	.path1_mode = 3,
+};
+
+static struct stb6100_config dw2104a_stb6100_config = {
+	.tuner_address = 0x60,
+	.refclock = 27000000,
+};
+
+static struct stv0900_config dw2104_stv0900_config = {
+	.demod_address = 0x68,
+	.demod_mode = 0,
+	.xtal = 8000000,
+	.clkmode = 3,
+	.diseqc_mode = 2,
+	.tun1_maddress = 0,
+	.tun1_adc = 1,/* 1 Vpp */
+	.path1_mode = 3,
+};
+
+static struct stv6110_config dw2104_stv6110_config = {
+	.i2c_address = 0x60,
+	.mclk = 16000000,
+	.clk_div = 1,
+};
+
 static int dw2104_frontend_attach(struct dvb_usb_adapter *d)
 {
-	if ((d->fe = dvb_attach(cx24116_attach, &dw2104_config,
-			&d->dev->i2c_adap)) != NULL) {
+	struct dvb_tuner_ops *tuner_ops = NULL;
+
+	if (demod_probe & 4) {
+		d->fe = dvb_attach(stv0900_attach, &dw2104a_stv0900_config,
+				&d->dev->i2c_adap, 0);
+		if (d->fe != NULL) {
+			if (dvb_attach(stb6100_attach, d->fe,
+					&dw2104a_stb6100_config,
+					&d->dev->i2c_adap)) {
+				tuner_ops = &d->fe->ops.tuner_ops;
+				tuner_ops->set_frequency = stb6100_set_freq;
+				tuner_ops->get_frequency = stb6100_get_freq;
+				tuner_ops->set_bandwidth = stb6100_set_bandw;
+				tuner_ops->get_bandwidth = stb6100_get_bandw;
+				d->fe->ops.set_voltage = dw210x_set_voltage;
+				info("Attached STV0900+STB6100!\n");
+				return 0;
+			}
+		}
+	}
+
+	if (demod_probe & 2) {
+		d->fe = dvb_attach(stv0900_attach, &dw2104_stv0900_config,
+				&d->dev->i2c_adap, 0);
+		if (d->fe != NULL) {
+			if (dvb_attach(stv6110_attach, d->fe,
+					&dw2104_stv6110_config,
+					&d->dev->i2c_adap)) {
+				d->fe->ops.set_voltage = dw210x_set_voltage;
+				info("Attached STV0900+STV6110A!\n");
+				return 0;
+			}
+		}
+	}
+
+	if (demod_probe & 1) {
+		d->fe = dvb_attach(cx24116_attach, &dw2104_config,
+				&d->dev->i2c_adap);
+		if (d->fe != NULL) {
+			d->fe->ops.set_voltage = dw210x_set_voltage;
+			info("Attached cx24116!\n");
+			return 0;
+		}
+	}
+
+	d->fe = dvb_attach(ds3000_attach, &dw2104_ds3000_config,
+			&d->dev->i2c_adap);
+	if (d->fe != NULL) {
 		d->fe->ops.set_voltage = dw210x_set_voltage;
-		info("Attached cx24116!\n");
+		info("Attached DS3000!\n");
 		return 0;
 	}
+
 	return -EIO;
 }
 
 static struct dvb_usb_device_properties dw2102_properties;
 static struct dvb_usb_device_properties dw2104_properties;
+static struct dvb_usb_device_properties s6x0_properties;
 
 static int dw2102_frontend_attach(struct dvb_usb_adapter *d)
 {
@@ -670,14 +809,17 @@ static int dw2102_frontend_attach(struct dvb_usb_adapter *d)
 			return 0;
 		}
 	}
+
 	if (dw2102_properties.i2c_algo == &dw2102_earda_i2c_algo) {
-		/*dw2102_properties.adapter->tuner_attach = dw2102_tuner_attach;*/
 		d->fe = dvb_attach(stv0288_attach, &earda_config,
 					&d->dev->i2c_adap);
 		if (d->fe != NULL) {
-			d->fe->ops.set_voltage = dw210x_set_voltage;
-			info("Attached stv0288!\n");
-			return 0;
+			if (dvb_attach(stb6000_attach, d->fe, 0x61,
+					&d->dev->i2c_adap)) {
+				d->fe->ops.set_voltage = dw210x_set_voltage;
+				info("Attached stv0288!\n");
+				return 0;
+			}
 		}
 	}
 
@@ -705,15 +847,38 @@ static int dw3101_frontend_attach(struct dvb_usb_adapter *d)
 	return -EIO;
 }
 
-static int s630_frontend_attach(struct dvb_usb_adapter *d)
+static int s6x0_frontend_attach(struct dvb_usb_adapter *d)
 {
 	d->fe = dvb_attach(mt312_attach, &zl313_config,
-				&d->dev->i2c_adap);
+			&d->dev->i2c_adap);
+	if (d->fe != NULL) {
+		if (dvb_attach(zl10039_attach, d->fe, 0x60,
+				&d->dev->i2c_adap)) {
+			d->fe->ops.set_voltage = dw210x_set_voltage;
+			info("Attached zl100313+zl10039!\n");
+			return 0;
+		}
+	}
+
+	d->fe = dvb_attach(stv0288_attach, &earda_config,
+			&d->dev->i2c_adap);
+	if (d->fe != NULL) {
+		if (dvb_attach(stb6000_attach, d->fe, 0x61,
+				&d->dev->i2c_adap)) {
+			d->fe->ops.set_voltage = dw210x_set_voltage;
+			info("Attached stv0288+stb6000!\n");
+			return 0;
+		}
+	}
+
+	d->fe = dvb_attach(ds3000_attach, &dw2104_ds3000_config,
+			&d->dev->i2c_adap);
 	if (d->fe != NULL) {
 		d->fe->ops.set_voltage = dw210x_set_voltage;
-		info("Attached zl10313!\n");
+		info("Attached ds3000+ds2020!\n");
 		return 0;
 	}
+
 	return -EIO;
 }
 
@@ -724,14 +889,6 @@ static int dw2102_tuner_attach(struct dvb_usb_adapter *adap)
 	return 0;
 }
 
-static int dw2102_earda_tuner_attach(struct dvb_usb_adapter *adap)
-{
-	dvb_attach(stb6000_attach, adap->fe, 0x61,
-		&adap->dev->i2c_adap);
-
-	return 0;
-}
-
 static int dw3101_tuner_attach(struct dvb_usb_adapter *adap)
 {
 	dvb_attach(dvb_pll_attach, adap->fe, 0x60,
@@ -740,14 +897,6 @@ static int dw3101_tuner_attach(struct dvb_usb_adapter *adap)
 	return 0;
 }
 
-static int s630_zl10039_tuner_attach(struct dvb_usb_adapter *adap)
-{
-	dvb_attach(zl10039_attach, adap->fe, 0x60,
-		&adap->dev->i2c_adap);
-
-	return 0;
-}
-
 static struct dvb_usb_rc_key dw210x_rc_keys[] = {
 	{ 0xf80a, KEY_Q },		/*power*/
 	{ 0xf80c, KEY_M },		/*mute*/
@@ -922,6 +1071,8 @@ static struct usb_device_id dw2102_table[] = {
 	{USB_DEVICE(USB_VID_TERRATEC, USB_PID_CINERGY_S)},
 	{USB_DEVICE(USB_VID_CYPRESS, USB_PID_DW3101)},
 	{USB_DEVICE(0x9022, USB_PID_TEVII_S630)},
+	{USB_DEVICE(0x3011, USB_PID_PROF_1100)},
+	{USB_DEVICE(0x9022, USB_PID_TEVII_S660)},
 	{ }
 };
 
@@ -935,15 +1086,13 @@ static int dw2102_load_firmware(struct usb_device *dev,
 	u8 reset;
 	u8 reset16[] = {0, 0, 0, 0, 0, 0, 0};
 	const struct firmware *fw;
-	const char *filename = "dvb-usb-dw2101.fw";
+	const char *fw_2101 = "dvb-usb-dw2101.fw";
 
 	switch (dev->descriptor.idProduct) {
 	case 0x2101:
-		ret = request_firmware(&fw, filename, &dev->dev);
+		ret = request_firmware(&fw, fw_2101, &dev->dev);
 		if (ret != 0) {
-			err("did not find the firmware file. (%s) "
-			"Please see linux/Documentation/dvb/ for more details "
-			"on firmware-problems.", filename);
+			err(err_str, fw_2101);
 			return ret;
 		}
 		break;
@@ -983,6 +1132,11 @@ static int dw2102_load_firmware(struct usb_device *dev,
 		}
 		/* init registers */
 		switch (dev->descriptor.idProduct) {
+		case USB_PID_PROF_1100:
+			s6x0_properties.rc_key_map = tbs_rc_keys;
+			s6x0_properties.rc_key_map_size =
+					ARRAY_SIZE(tbs_rc_keys);
+			break;
 		case USB_PID_TEVII_S650:
 			dw2104_properties.rc_key_map = tevii_rc_keys;
 			dw2104_properties.rc_key_map_size =
@@ -1021,7 +1175,6 @@ static int dw2102_load_firmware(struct usb_device *dev,
 						DW210X_READ_MSG);
 				if (reset16[2] == 0x11) {
 					dw2102_properties.i2c_algo = &dw2102_earda_i2c_algo;
-					dw2102_properties.adapter->tuner_attach = &dw2102_earda_tuner_attach;
 					break;
 				}
 			}
@@ -1184,13 +1337,13 @@ static struct dvb_usb_device_properties dw3101_properties = {
 	}
 };
 
-static struct dvb_usb_device_properties s630_properties = {
+static struct dvb_usb_device_properties s6x0_properties = {
 	.caps = DVB_USB_IS_AN_I2C_ADAPTER,
 	.usb_ctrl = DEVICE_SPECIFIC,
 	.firmware = "dvb-usb-s630.fw",
 	.no_reconnect = 1,
 
-	.i2c_algo = &s630_i2c_algo,
+	.i2c_algo = &s6x0_i2c_algo,
 	.rc_key_map = tevii_rc_keys,
 	.rc_key_map_size = ARRAY_SIZE(tevii_rc_keys),
 	.rc_interval = 150,
@@ -1199,12 +1352,12 @@ static struct dvb_usb_device_properties s630_properties = {
 	.generic_bulk_ctrl_endpoint = 0x81,
 	.num_adapters = 1,
 	.download_firmware = dw2102_load_firmware,
-	.read_mac_address = s630_read_mac_address,
+	.read_mac_address = s6x0_read_mac_address,
 	.adapter = {
 		{
-			.frontend_attach = s630_frontend_attach,
+			.frontend_attach = s6x0_frontend_attach,
 			.streaming_ctrl = NULL,
-			.tuner_attach = s630_zl10039_tuner_attach,
+			.tuner_attach = NULL,
 			.stream = {
 				.type = USB_BULK,
 				.count = 8,
@@ -1217,12 +1370,20 @@ static struct dvb_usb_device_properties s630_properties = {
 			},
 		}
 	},
-	.num_device_descs = 1,
+	.num_device_descs = 3,
 	.devices = {
 		{"TeVii S630 USB",
 			{&dw2102_table[6], NULL},
 			{NULL},
 		},
+		{"Prof 1100 USB ",
+			{&dw2102_table[7], NULL},
+			{NULL},
+		},
+		{"TeVii S660 USB",
+			{&dw2102_table[8], NULL},
+			{NULL},
+		},
 	}
 };
 
@@ -1235,10 +1396,10 @@ static int dw2102_probe(struct usb_interface *intf,
 			THIS_MODULE, NULL, adapter_nr) ||
 	    0 == dvb_usb_device_init(intf, &dw3101_properties,
 			THIS_MODULE, NULL, adapter_nr) ||
-	    0 == dvb_usb_device_init(intf, &s630_properties,
-			THIS_MODULE, NULL, adapter_nr)) {
+	    0 == dvb_usb_device_init(intf, &s6x0_properties,
+			THIS_MODULE, NULL, adapter_nr))
 		return 0;
-	}
+
 	return -ENODEV;
 }
 
@@ -1269,6 +1430,7 @@ module_exit(dw2102_module_exit);
 MODULE_AUTHOR("Igor M. Liplianin (c) liplianin@me.by");
 MODULE_DESCRIPTION("Driver for DVBWorld DVB-S 2101, 2102, DVB-S2 2104,"
 				" DVB-C 3101 USB2.0,"
-				" TeVii S600, S630, S650 USB2.0 devices");
+				" TeVii S600, S630, S650, S660 USB2.0,"
+				" Prof 1100 USB2.0 devices");
 MODULE_VERSION("0.1");
 MODULE_LICENSE("GPL");
diff --git a/drivers/media/dvb/dvb-usb/ec168.c b/drivers/media/dvb/dvb-usb/ec168.c
new file mode 100644
index 000000000000..52f5d4f0f230
--- /dev/null
+++ b/drivers/media/dvb/dvb-usb/ec168.c
@@ -0,0 +1,440 @@
+/*
+ * E3C EC168 DVB USB driver
+ *
+ * Copyright (C) 2009 Antti Palosaari <crope@iki.fi>
+ *
+ *    This program is free software; you can redistribute it and/or modify
+ *    it under the terms of the GNU General Public License as published by
+ *    the Free Software Foundation; either version 2 of the License, or
+ *    (at your option) any later version.
+ *
+ *    This program is distributed in the hope that it will be useful,
+ *    but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *    GNU General Public License for more details.
+ *
+ *    You should have received a copy of the GNU General Public License
+ *    along with this program; if not, write to the Free Software
+ *    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ *
+ */
+
+#include "ec168.h"
+#include "ec100.h"
+#include "mxl5005s.h"
+
+/* debug */
+static int dvb_usb_ec168_debug;
+module_param_named(debug, dvb_usb_ec168_debug, int, 0644);
+MODULE_PARM_DESC(debug, "set debugging level" DVB_USB_DEBUG_STATUS);
+DVB_DEFINE_MOD_OPT_ADAPTER_NR(adapter_nr);
+
+static struct ec100_config ec168_ec100_config;
+
+static int ec168_rw_udev(struct usb_device *udev, struct ec168_req *req)
+{
+	int ret;
+	unsigned int pipe;
+	u8 request, requesttype;
+	u8 buf[req->size];
+
+	switch (req->cmd) {
+	case DOWNLOAD_FIRMWARE:
+	case GPIO:
+	case WRITE_I2C:
+	case STREAMING_CTRL:
+		requesttype = (USB_TYPE_VENDOR | USB_DIR_OUT);
+		request = req->cmd;
+		break;
+	case READ_I2C:
+		requesttype = (USB_TYPE_VENDOR | USB_DIR_IN);
+		request = req->cmd;
+		break;
+	case GET_CONFIG:
+		requesttype = (USB_TYPE_VENDOR | USB_DIR_IN);
+		request = CONFIG;
+		break;
+	case SET_CONFIG:
+		requesttype = (USB_TYPE_VENDOR | USB_DIR_OUT);
+		request = CONFIG;
+		break;
+	case WRITE_DEMOD:
+		requesttype = (USB_TYPE_VENDOR | USB_DIR_OUT);
+		request = DEMOD_RW;
+		break;
+	case READ_DEMOD:
+		requesttype = (USB_TYPE_VENDOR | USB_DIR_IN);
+		request = DEMOD_RW;
+		break;
+	default:
+		err("unknown command:%02x", req->cmd);
+		ret = -EPERM;
+		goto error;
+	}
+
+	if (requesttype == (USB_TYPE_VENDOR | USB_DIR_OUT)) {
+		/* write */
+		memcpy(buf, req->data, req->size);
+		pipe = usb_sndctrlpipe(udev, 0);
+	} else {
+		/* read */
+		pipe = usb_rcvctrlpipe(udev, 0);
+	}
+
+	msleep(1); /* avoid I2C errors */
+
+	ret = usb_control_msg(udev, pipe, request, requesttype, req->value,
+		req->index, buf, sizeof(buf), EC168_USB_TIMEOUT);
+
+	ec168_debug_dump(request, requesttype, req->value, req->index, buf,
+		req->size, deb_xfer);
+
+	if (ret < 0)
+		goto error;
+	else
+		ret = 0;
+
+	/* read request, copy returned data to return buf */
+	if (!ret && requesttype == (USB_TYPE_VENDOR | USB_DIR_IN))
+		memcpy(req->data, buf, req->size);
+
+	return ret;
+error:
+	deb_info("%s: failed:%d\n", __func__, ret);
+	return ret;
+}
+
+static int ec168_ctrl_msg(struct dvb_usb_device *d, struct ec168_req *req)
+{
+	return ec168_rw_udev(d->udev, req);
+}
+
+/* I2C */
+static int ec168_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
+	int num)
+{
+	struct dvb_usb_device *d = i2c_get_adapdata(adap);
+	struct ec168_req req;
+	int i = 0;
+	int ret;
+
+	if (num > 2)
+		return -EINVAL;
+
+	if (mutex_lock_interruptible(&d->i2c_mutex) < 0)
+		return -EAGAIN;
+
+	while (i < num) {
+		if (num > i + 1 && (msg[i+1].flags & I2C_M_RD)) {
+			if (msg[i].addr == ec168_ec100_config.demod_address) {
+				req.cmd = READ_DEMOD;
+				req.value = 0;
+				req.index = 0xff00 + msg[i].buf[0]; /* reg */
+				req.size = msg[i+1].len; /* bytes to read */
+				req.data = &msg[i+1].buf[0];
+				ret = ec168_ctrl_msg(d, &req);
+				i += 2;
+			} else {
+				err("I2C read not implemented");
+				ret = -ENOSYS;
+				i += 2;
+			}
+		} else {
+			if (msg[i].addr == ec168_ec100_config.demod_address) {
+				req.cmd = WRITE_DEMOD;
+				req.value = msg[i].buf[1]; /* val */
+				req.index = 0xff00 + msg[i].buf[0]; /* reg */
+				req.size = 0;
+				req.data = NULL;
+				ret = ec168_ctrl_msg(d, &req);
+				i += 1;
+			} else {
+				req.cmd = WRITE_I2C;
+				req.value = msg[i].buf[0]; /* val */
+				req.index = 0x0100 + msg[i].addr; /* I2C addr */
+				req.size = msg[i].len-1;
+				req.data = &msg[i].buf[1];
+				ret = ec168_ctrl_msg(d, &req);
+				i += 1;
+			}
+		}
+		if (ret)
+			goto error;
+
+	}
+	ret = i;
+
+error:
+	mutex_unlock(&d->i2c_mutex);
+	return i;
+}
+
+
+static u32 ec168_i2c_func(struct i2c_adapter *adapter)
+{
+	return I2C_FUNC_I2C;
+}
+
+static struct i2c_algorithm ec168_i2c_algo = {
+	.master_xfer   = ec168_i2c_xfer,
+	.functionality = ec168_i2c_func,
+};
+
+/* Callbacks for DVB USB */
+static struct ec100_config ec168_ec100_config = {
+	.demod_address = 0xff, /* not real address, demod is integrated */
+};
+
+static int ec168_ec100_frontend_attach(struct dvb_usb_adapter *adap)
+{
+	deb_info("%s:\n", __func__);
+	adap->fe = dvb_attach(ec100_attach, &ec168_ec100_config,
+		&adap->dev->i2c_adap);
+	if (adap->fe == NULL)
+		return -ENODEV;
+
+	return 0;
+}
+
+static struct mxl5005s_config ec168_mxl5003s_config = {
+	.i2c_address     = 0xc6,
+	.if_freq         = IF_FREQ_4570000HZ,
+	.xtal_freq       = CRYSTAL_FREQ_16000000HZ,
+	.agc_mode        = MXL_SINGLE_AGC,
+	.tracking_filter = MXL_TF_OFF,
+	.rssi_enable     = MXL_RSSI_ENABLE,
+	.cap_select      = MXL_CAP_SEL_ENABLE,
+	.div_out         = MXL_DIV_OUT_4,
+	.clock_out       = MXL_CLOCK_OUT_DISABLE,
+	.output_load     = MXL5005S_IF_OUTPUT_LOAD_200_OHM,
+	.top		 = MXL5005S_TOP_25P2,
+	.mod_mode        = MXL_DIGITAL_MODE,
+	.if_mode         = MXL_ZERO_IF,
+	.AgcMasterByte   = 0x00,
+};
+
+static int ec168_mxl5003s_tuner_attach(struct dvb_usb_adapter *adap)
+{
+	deb_info("%s:\n", __func__);
+	return dvb_attach(mxl5005s_attach, adap->fe, &adap->dev->i2c_adap,
+		&ec168_mxl5003s_config) == NULL ? -ENODEV : 0;
+}
+
+static int ec168_streaming_ctrl(struct dvb_usb_adapter *adap, int onoff)
+{
+	struct ec168_req req = {STREAMING_CTRL, 0x7f01, 0x0202, 0, NULL};
+	deb_info("%s: onoff:%d\n", __func__, onoff);
+	if (onoff)
+		req.index = 0x0102;
+	return ec168_ctrl_msg(adap->dev, &req);
+}
+
+static int ec168_download_firmware(struct usb_device *udev,
+	const struct firmware *fw)
+{
+	int i, len, packets, remainder, ret;
+	u16 addr = 0x0000; /* firmware start address */
+	struct ec168_req req = {DOWNLOAD_FIRMWARE, 0, 0, 0, NULL};
+	deb_info("%s:\n", __func__);
+
+	#define FW_PACKET_MAX_DATA  2048
+	packets = fw->size / FW_PACKET_MAX_DATA;
+	remainder = fw->size % FW_PACKET_MAX_DATA;
+	len = FW_PACKET_MAX_DATA;
+	for (i = 0; i <= packets; i++) {
+		if (i == packets)  /* set size of the last packet */
+			len = remainder;
+
+		req.size = len;
+		req.data = (u8 *)(fw->data + i * FW_PACKET_MAX_DATA);
+		req.index = addr;
+		addr += FW_PACKET_MAX_DATA;
+
+		ret = ec168_rw_udev(udev, &req);
+		if (ret) {
+			err("firmware download failed:%d packet:%d", ret, i);
+			goto error;
+		}
+	}
+	req.size = 0;
+
+	/* set "warm"? */
+	req.cmd = SET_CONFIG;
+	req.value = 0;
+	req.index = 0x0001;
+	ret = ec168_rw_udev(udev, &req);
+	if (ret)
+		goto error;
+
+	/* really needed - no idea what does */
+	req.cmd = GPIO;
+	req.value = 0;
+	req.index = 0x0206;
+	ret = ec168_rw_udev(udev, &req);
+	if (ret)
+		goto error;
+
+	/* activate tuner I2C? */
+	req.cmd = WRITE_I2C;
+	req.value = 0;
+	req.index = 0x00c6;
+	ret = ec168_rw_udev(udev, &req);
+	if (ret)
+		goto error;
+
+	return ret;
+error:
+	deb_info("%s: failed:%d\n", __func__, ret);
+	return ret;
+}
+
+static int ec168_identify_state(struct usb_device *udev,
+	struct dvb_usb_device_properties *props,
+	struct dvb_usb_device_description **desc, int *cold)
+{
+	int ret;
+	u8 reply;
+	struct ec168_req req = {GET_CONFIG, 0, 1, sizeof(reply), &reply};
+	deb_info("%s:\n", __func__);
+
+	ret = ec168_rw_udev(udev, &req);
+	if (ret)
+		goto error;
+
+	deb_info("%s: reply:%02x\n", __func__, reply);
+
+	if (reply == 0x01)
+		*cold = 0;
+	else
+		*cold = 1;
+
+	return ret;
+error:
+	deb_info("%s: failed:%d\n", __func__, ret);
+	return ret;
+}
+
+/* DVB USB Driver stuff */
+static struct dvb_usb_device_properties ec168_properties;
+
+static int ec168_probe(struct usb_interface *intf,
+	const struct usb_device_id *id)
+{
+	int ret;
+	deb_info("%s: interface:%d\n", __func__,
+		intf->cur_altsetting->desc.bInterfaceNumber);
+
+	ret = dvb_usb_device_init(intf, &ec168_properties, THIS_MODULE, NULL,
+		adapter_nr);
+	if (ret)
+		goto error;
+
+	return ret;
+error:
+	deb_info("%s: failed:%d\n", __func__, ret);
+	return ret;
+}
+
+#define E3C_EC168_1689                          0
+#define E3C_EC168_FFFA                          1
+#define E3C_EC168_FFFB                          2
+#define E3C_EC168_1001                          3
+#define E3C_EC168_1002                          4
+
+static struct usb_device_id ec168_id[] = {
+	[E3C_EC168_1689] =
+		{USB_DEVICE(USB_VID_E3C, USB_PID_E3C_EC168)},
+	[E3C_EC168_FFFA] =
+		{USB_DEVICE(USB_VID_E3C, USB_PID_E3C_EC168_2)},
+	[E3C_EC168_FFFB] =
+		{USB_DEVICE(USB_VID_E3C, USB_PID_E3C_EC168_3)},
+	[E3C_EC168_1001] =
+		{USB_DEVICE(USB_VID_E3C, USB_PID_E3C_EC168_4)},
+	[E3C_EC168_1002] =
+		{USB_DEVICE(USB_VID_E3C, USB_PID_E3C_EC168_5)},
+	{} /* terminating entry */
+};
+
+MODULE_DEVICE_TABLE(usb, ec168_id);
+
+static struct dvb_usb_device_properties ec168_properties = {
+	.caps = DVB_USB_IS_AN_I2C_ADAPTER,
+
+	.usb_ctrl = DEVICE_SPECIFIC,
+	.download_firmware = ec168_download_firmware,
+	.firmware = "dvb-usb-ec168.fw",
+	.no_reconnect = 1,
+
+	.size_of_priv = 0,
+
+	.num_adapters = 1,
+	.adapter = {
+		{
+			.streaming_ctrl   = ec168_streaming_ctrl,
+			.frontend_attach  = ec168_ec100_frontend_attach,
+			.tuner_attach     = ec168_mxl5003s_tuner_attach,
+			.stream = {
+				.type = USB_BULK,
+				.count = 6,
+				.endpoint = 0x82,
+				.u = {
+					.bulk = {
+						.buffersize = (32*512),
+					}
+				}
+			},
+		}
+	},
+
+	.identify_state = ec168_identify_state,
+
+	.i2c_algo = &ec168_i2c_algo,
+
+	.num_device_descs = 1,
+	.devices = {
+		{
+			.name = "E3C EC168 DVB-T USB2.0 reference design",
+			.cold_ids = {
+				&ec168_id[E3C_EC168_1689],
+				&ec168_id[E3C_EC168_FFFA],
+				&ec168_id[E3C_EC168_FFFB],
+				&ec168_id[E3C_EC168_1001],
+				&ec168_id[E3C_EC168_1002],
+				NULL},
+			.warm_ids = {NULL},
+		},
+	}
+};
+
+static struct usb_driver ec168_driver = {
+	.name       = "dvb_usb_ec168",
+	.probe      = ec168_probe,
+	.disconnect = dvb_usb_device_exit,
+	.id_table   = ec168_id,
+};
+
+/* module stuff */
+static int __init ec168_module_init(void)
+{
+	int ret;
+	deb_info("%s:\n", __func__);
+	ret = usb_register(&ec168_driver);
+	if (ret)
+		err("module init failed:%d", ret);
+
+	return ret;
+}
+
+static void __exit ec168_module_exit(void)
+{
+	deb_info("%s:\n", __func__);
+	/* deregister this driver from the USB subsystem */
+	usb_deregister(&ec168_driver);
+}
+
+module_init(ec168_module_init);
+module_exit(ec168_module_exit);
+
+MODULE_AUTHOR("Antti Palosaari <crope@iki.fi>");
+MODULE_DESCRIPTION("E3C EC168 DVB-T USB2.0 driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/media/dvb/dvb-usb/ec168.h b/drivers/media/dvb/dvb-usb/ec168.h
new file mode 100644
index 000000000000..e7e0b831314e
--- /dev/null
+++ b/drivers/media/dvb/dvb-usb/ec168.h
@@ -0,0 +1,73 @@
+/*
+ * E3C EC168 DVB USB driver
+ *
+ * Copyright (C) 2009 Antti Palosaari <crope@iki.fi>
+ *
+ *    This program is free software; you can redistribute it and/or modify
+ *    it under the terms of the GNU General Public License as published by
+ *    the Free Software Foundation; either version 2 of the License, or
+ *    (at your option) any later version.
+ *
+ *    This program is distributed in the hope that it will be useful,
+ *    but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *    GNU General Public License for more details.
+ *
+ *    You should have received a copy of the GNU General Public License
+ *    along with this program; if not, write to the Free Software
+ *    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ *
+ */
+
+#ifndef EC168_H
+#define EC168_H
+
+#define DVB_USB_LOG_PREFIX "ec168"
+#include "dvb-usb.h"
+
+#define deb_info(args...) dprintk(dvb_usb_ec168_debug, 0x01, args)
+#define deb_rc(args...)   dprintk(dvb_usb_ec168_debug, 0x02, args)
+#define deb_xfer(args...) dprintk(dvb_usb_ec168_debug, 0x04, args)
+#define deb_reg(args...)  dprintk(dvb_usb_ec168_debug, 0x08, args)
+#define deb_i2c(args...)  dprintk(dvb_usb_ec168_debug, 0x10, args)
+#define deb_fw(args...)   dprintk(dvb_usb_ec168_debug, 0x20, args)
+
+#define ec168_debug_dump(r, t, v, i, b, l, func) { \
+	int loop_; \
+	func("%02x %02x %02x %02x %02x %02x %02x %02x", \
+		t, r, v & 0xff, v >> 8, i & 0xff, i >> 8, l & 0xff, l >> 8); \
+	if (t == (USB_TYPE_VENDOR | USB_DIR_OUT)) \
+		func(" >>> "); \
+	else \
+		func(" <<< "); \
+	for (loop_ = 0; loop_ < l; loop_++) \
+		func("%02x ", b[loop_]); \
+	func("\n");\
+}
+
+#define EC168_USB_TIMEOUT 1000
+
+struct ec168_req {
+	u8  cmd;       /* [1] */
+	u16 value;     /* [2|3] */
+	u16 index;     /* [4|5] */
+	u16 size;      /* [6|7] */
+	u8  *data;
+};
+
+enum ec168_cmd {
+	DOWNLOAD_FIRMWARE    = 0x00,
+	CONFIG               = 0x01,
+	DEMOD_RW             = 0x03,
+	GPIO                 = 0x04,
+	STREAMING_CTRL       = 0x10,
+	READ_I2C             = 0x20,
+	WRITE_I2C            = 0x21,
+	HID_DOWNLOAD         = 0x30,
+	GET_CONFIG,
+	SET_CONFIG,
+	READ_DEMOD,
+	WRITE_DEMOD,
+};
+
+#endif
diff --git a/drivers/media/dvb/dvb-usb/friio-fe.c b/drivers/media/dvb/dvb-usb/friio-fe.c
index c4dfe25cf60d..ebb7b9fd115b 100644
--- a/drivers/media/dvb/dvb-usb/friio-fe.c
+++ b/drivers/media/dvb/dvb-usb/friio-fe.c
@@ -134,11 +134,13 @@ static int jdvbt90502_pll_set_freq(struct jdvbt90502_state *state, u32 freq)
 	deb_fe("%s: freq=%d, step=%d\n", __func__, freq,
 	       state->frontend.ops.info.frequency_stepsize);
 	/* freq -> oscilator frequency conversion. */
-	/* freq: 473,000,000 + n*6,000,000 (no 1/7MHz shift to center freq) */
-	/* add 400[1/7 MHZ] = 57.142857MHz.   57MHz for the IF,  */
-	/*                                   1/7MHz for center freq shift */
+	/* freq: 473,000,000 + n*6,000,000 [+ 142857 (center freq. shift)] */
 	f = freq / state->frontend.ops.info.frequency_stepsize;
-	f += 400;
+	/* add 399[1/7 MHZ] = 57MHz for the IF  */
+	f += 399;
+	/* add center frequency shift if necessary */
+	if (f % 7 == 0)
+		f++;
 	pll_freq_cmd[DEMOD_REDIRECT_REG] = JDVBT90502_2ND_I2C_REG; /* 0xFE */
 	pll_freq_cmd[ADDRESS_BYTE] = state->config.pll_address << 1;
 	pll_freq_cmd[DIVIDER_BYTE1] = (f >> 8) & 0x7F;
@@ -232,12 +234,6 @@ static int jdvbt90502_read_status(struct dvb_frontend *fe, fe_status_t *state)
 	return 0;
 }
 
-static int jdvbt90502_read_ber(struct dvb_frontend *fe, u32 *ber)
-{
-	*ber = 0;
-	return 0;
-}
-
 static int jdvbt90502_read_signal_strength(struct dvb_frontend *fe,
 					   u16 *strength)
 {
@@ -264,26 +260,26 @@ static int jdvbt90502_read_signal_strength(struct dvb_frontend *fe,
 	return 0;
 }
 
-static int jdvbt90502_read_snr(struct dvb_frontend *fe, u16 *snr)
-{
-	*snr = 0x0101;
-	return 0;
-}
-
-static int jdvbt90502_read_ucblocks(struct dvb_frontend *fe, u32 *ucblocks)
-{
-	*ucblocks = 0;
-	return 0;
-}
 
-static int jdvbt90502_get_tune_settings(struct dvb_frontend *fe,
-					struct dvb_frontend_tune_settings *fs)
+/* filter out un-supported properties to notify users */
+static int jdvbt90502_set_property(struct dvb_frontend *fe,
+				   struct dtv_property *tvp)
 {
-	fs->min_delay_ms = 500;
-	fs->step_size = 0;
-	fs->max_drift = 0;
-
-	return 0;
+	int r = 0;
+
+	switch (tvp->cmd) {
+	case DTV_DELIVERY_SYSTEM:
+		if (tvp->u.data != SYS_ISDBT)
+			r = -EINVAL;
+		break;
+	case DTV_CLEAR:
+	case DTV_TUNE:
+	case DTV_FREQUENCY:
+		break;
+	default:
+		r = -EINVAL;
+	}
+	return r;
 }
 
 static int jdvbt90502_get_frontend(struct dvb_frontend *fe,
@@ -314,6 +310,9 @@ static int jdvbt90502_set_frontend(struct dvb_frontend *fe,
 
 	deb_fe("%s: Freq:%d\n", __func__, p->frequency);
 
+	/* for recovery from DTV_CLEAN */
+	fe->dtv_property_cache.delivery_system = SYS_ISDBT;
+
 	ret = jdvbt90502_pll_set_freq(state, p->frequency);
 	if (ret) {
 		deb_fe("%s:ret == %d\n", __func__, ret);
@@ -323,12 +322,6 @@ static int jdvbt90502_set_frontend(struct dvb_frontend *fe,
 	return 0;
 }
 
-static int jdvbt90502_sleep(struct dvb_frontend *fe)
-{
-	deb_fe("%s called.\n", __func__);
-	return 0;
-}
-
 
 /**
  * (reg, val) commad list to initialize this module.
@@ -394,6 +387,7 @@ static int jdvbt90502_init(struct dvb_frontend *fe)
 		if (ret != 1)
 			goto error;
 	}
+	fe->dtv_property_cache.delivery_system = SYS_ISDBT;
 	msleep(100);
 
 	return 0;
@@ -468,16 +462,13 @@ static struct dvb_frontend_ops jdvbt90502_ops = {
 	.release = jdvbt90502_release,
 
 	.init = jdvbt90502_init,
-	.sleep = jdvbt90502_sleep,
 	.write = _jdvbt90502_write,
 
+	.set_property = jdvbt90502_set_property,
+
 	.set_frontend = jdvbt90502_set_frontend,
 	.get_frontend = jdvbt90502_get_frontend,
-	.get_tune_settings = jdvbt90502_get_tune_settings,
 
 	.read_status = jdvbt90502_read_status,
-	.read_ber = jdvbt90502_read_ber,
 	.read_signal_strength = jdvbt90502_read_signal_strength,
-	.read_snr = jdvbt90502_read_snr,
-	.read_ucblocks = jdvbt90502_read_ucblocks,
 };
diff --git a/drivers/media/dvb/dvb-usb/gp8psk-fe.c b/drivers/media/dvb/dvb-usb/gp8psk-fe.c
index 20eadf9318e0..7a7f1b2b681c 100644
--- a/drivers/media/dvb/dvb-usb/gp8psk-fe.c
+++ b/drivers/media/dvb/dvb-usb/gp8psk-fe.c
@@ -146,8 +146,8 @@ static int gp8psk_fe_set_frontend(struct dvb_frontend* fe,
 
 	switch (c->delivery_system) {
 	case SYS_DVBS:
-		/* Only QPSK is supported for DVB-S */
-		if (c->modulation != QPSK) {
+		/* Allow QPSK and 8PSK (even for DVB-S) */
+		if (c->modulation != QPSK && c->modulation != PSK_8) {
 			deb_fe("%s: unsupported modulation selected (%d)\n",
 				__func__, c->modulation);
 			return -EOPNOTSUPP;
diff --git a/drivers/media/dvb/dvb-usb/usb-urb.c b/drivers/media/dvb/dvb-usb/usb-urb.c
index 9da2cc95ca13..f9702e3756b6 100644
--- a/drivers/media/dvb/dvb-usb/usb-urb.c
+++ b/drivers/media/dvb/dvb-usb/usb-urb.c
@@ -56,7 +56,7 @@ static void usb_urb_complete(struct urb *urb)
 				stream->complete(stream, b, urb->actual_length);
 			break;
 		default:
-			err("unkown endpoint type in completition handler.");
+			err("unknown endpoint type in completition handler.");
 			return;
 	}
 	usb_submit_urb(urb,GFP_ATOMIC);
@@ -228,7 +228,7 @@ int usb_urb_init(struct usb_data_stream *stream, struct usb_data_stream_properti
 		case USB_ISOC:
 			return usb_isoc_urb_init(stream);
 		default:
-			err("unkown URB-type for data transfer.");
+			err("unknown URB-type for data transfer.");
 			return -EINVAL;
 	}
 }
diff --git a/drivers/media/dvb/firewire/Kconfig b/drivers/media/dvb/firewire/Kconfig
index 69028253e984..4afa29256df1 100644
--- a/drivers/media/dvb/firewire/Kconfig
+++ b/drivers/media/dvb/firewire/Kconfig
@@ -1,6 +1,6 @@
 config DVB_FIREDTV
 	tristate "FireDTV and FloppyDTV"
-	depends on DVB_CORE && IEEE1394
+	depends on DVB_CORE && (FIREWIRE || IEEE1394)
 	help
 	  Support for DVB receivers from Digital Everywhere
 	  which are connected via IEEE 1394 (FireWire).
@@ -13,8 +13,11 @@ config DVB_FIREDTV
 
 if DVB_FIREDTV
 
+config DVB_FIREDTV_FIREWIRE
+	def_bool FIREWIRE = y || (FIREWIRE = m && DVB_FIREDTV = m)
+
 config DVB_FIREDTV_IEEE1394
-	def_bool IEEE1394
+	def_bool IEEE1394 = y || (IEEE1394 = m && DVB_FIREDTV = m)
 
 config DVB_FIREDTV_INPUT
 	def_bool INPUT = y || (INPUT = m && DVB_FIREDTV = m)
diff --git a/drivers/media/dvb/firewire/Makefile b/drivers/media/dvb/firewire/Makefile
index 2034695ba194..da84203d51c6 100644
--- a/drivers/media/dvb/firewire/Makefile
+++ b/drivers/media/dvb/firewire/Makefile
@@ -1,6 +1,7 @@
 obj-$(CONFIG_DVB_FIREDTV) += firedtv.o
 
 firedtv-y := firedtv-avc.o firedtv-ci.o firedtv-dvb.o firedtv-fe.o
+firedtv-$(CONFIG_DVB_FIREDTV_FIREWIRE) += firedtv-fw.o
 firedtv-$(CONFIG_DVB_FIREDTV_IEEE1394) += firedtv-1394.o
 firedtv-$(CONFIG_DVB_FIREDTV_INPUT)    += firedtv-rc.o
 
diff --git a/drivers/media/dvb/firewire/firedtv-1394.c b/drivers/media/dvb/firewire/firedtv-1394.c
index 2b6eeeab5b25..7c5459c27b75 100644
--- a/drivers/media/dvb/firewire/firedtv-1394.c
+++ b/drivers/media/dvb/firewire/firedtv-1394.c
@@ -1,5 +1,5 @@
 /*
- * FireDTV driver (formerly known as FireSAT)
+ * FireDTV driver -- ieee1394 I/O backend
  *
  * Copyright (C) 2004 Andreas Monitzer <andy@monitzer.com>
  * Copyright (C) 2007-2008 Ben Backx <ben@bbackx.com>
@@ -26,13 +26,16 @@
 #include <iso.h>
 #include <nodemgr.h>
 
+#include <dvb_demux.h>
+
 #include "firedtv.h"
 
 static LIST_HEAD(node_list);
 static DEFINE_SPINLOCK(node_list_lock);
 
-#define FIREWIRE_HEADER_SIZE	4
-#define CIP_HEADER_SIZE		8
+#define CIP_HEADER_SIZE			8
+#define MPEG2_TS_HEADER_SIZE		4
+#define MPEG2_TS_SOURCE_PACKET_SIZE	(4 + 188)
 
 static void rawiso_activity_cb(struct hpsb_iso *iso)
 {
@@ -62,20 +65,20 @@ static void rawiso_activity_cb(struct hpsb_iso *iso)
 		buf = dma_region_i(&iso->data_buf, unsigned char,
 			iso->infos[packet].offset + CIP_HEADER_SIZE);
 		count = (iso->infos[packet].len - CIP_HEADER_SIZE) /
-			(188 + FIREWIRE_HEADER_SIZE);
+			MPEG2_TS_SOURCE_PACKET_SIZE;
 
 		/* ignore empty packet */
 		if (iso->infos[packet].len <= CIP_HEADER_SIZE)
 			continue;
 
 		while (count--) {
-			if (buf[FIREWIRE_HEADER_SIZE] == 0x47)
+			if (buf[MPEG2_TS_HEADER_SIZE] == 0x47)
 				dvb_dmx_swfilter_packets(&fdtv->demux,
-						&buf[FIREWIRE_HEADER_SIZE], 1);
+						&buf[MPEG2_TS_HEADER_SIZE], 1);
 			else
 				dev_err(fdtv->device,
 					"skipping invalid packet\n");
-			buf += 188 + FIREWIRE_HEADER_SIZE;
+			buf += MPEG2_TS_SOURCE_PACKET_SIZE;
 		}
 	}
 out:
@@ -87,15 +90,20 @@ static inline struct node_entry *node_of(struct firedtv *fdtv)
 	return container_of(fdtv->device, struct unit_directory, device)->ne;
 }
 
-static int node_lock(struct firedtv *fdtv, u64 addr, void *data, __be32 arg)
+static int node_lock(struct firedtv *fdtv, u64 addr, __be32 data[])
 {
-	return hpsb_node_lock(node_of(fdtv), addr, EXTCODE_COMPARE_SWAP, data,
-			      (__force quadlet_t)arg);
+	int ret;
+
+	ret = hpsb_node_lock(node_of(fdtv), addr, EXTCODE_COMPARE_SWAP,
+		(__force quadlet_t *)&data[1], (__force quadlet_t)data[0]);
+	data[0] = data[1];
+
+	return ret;
 }
 
-static int node_read(struct firedtv *fdtv, u64 addr, void *data, size_t len)
+static int node_read(struct firedtv *fdtv, u64 addr, void *data)
 {
-	return hpsb_node_read(node_of(fdtv), addr, data, len);
+	return hpsb_node_read(node_of(fdtv), addr, data, 4);
 }
 
 static int node_write(struct firedtv *fdtv, u64 addr, void *data, size_t len)
@@ -212,6 +220,7 @@ static int node_probe(struct device *dev)
 		goto fail;
 
 	avc_register_remote_control(fdtv);
+
 	return 0;
 fail:
 	spin_lock_irq(&node_list_lock);
@@ -220,6 +229,7 @@ fail:
 	fdtv_unregister_rc(fdtv);
 fail_free:
 	kfree(fdtv);
+
 	return err;
 }
 
@@ -233,10 +243,9 @@ static int node_remove(struct device *dev)
 	list_del(&fdtv->list);
 	spin_unlock_irq(&node_list_lock);
 
-	cancel_work_sync(&fdtv->remote_ctrl_work);
 	fdtv_unregister_rc(fdtv);
-
 	kfree(fdtv);
+
 	return 0;
 }
 
@@ -252,6 +261,7 @@ static int node_update(struct unit_directory *ud)
 
 static struct hpsb_protocol_driver fdtv_driver = {
 	.name		= "firedtv",
+	.id_table	= fdtv_id_table,
 	.update		= node_update,
 	.driver         = {
 		.probe  = node_probe,
@@ -264,12 +274,11 @@ static struct hpsb_highlevel fdtv_highlevel = {
 	.fcp_request	= fcp_request,
 };
 
-int __init fdtv_1394_init(struct ieee1394_device_id id_table[])
+int __init fdtv_1394_init(void)
 {
 	int ret;
 
 	hpsb_register_highlevel(&fdtv_highlevel);
-	fdtv_driver.id_table = id_table;
 	ret = hpsb_register_protocol(&fdtv_driver);
 	if (ret) {
 		printk(KERN_ERR "firedtv: failed to register protocol\n");
diff --git a/drivers/media/dvb/firewire/firedtv-avc.c b/drivers/media/dvb/firewire/firedtv-avc.c
index 485d061319ab..50c42a4b972b 100644
--- a/drivers/media/dvb/firewire/firedtv-avc.c
+++ b/drivers/media/dvb/firewire/firedtv-avc.c
@@ -1236,14 +1236,14 @@ int avc_ca_get_mmi(struct firedtv *fdtv, char *mmi_object, unsigned int *len)
 
 #define CMP_OUTPUT_PLUG_CONTROL_REG_0	0xfffff0000904ULL
 
-static int cmp_read(struct firedtv *fdtv, void *buf, u64 addr, size_t len)
+static int cmp_read(struct firedtv *fdtv, u64 addr, __be32 *data)
 {
 	int ret;
 
 	if (mutex_lock_interruptible(&fdtv->avc_mutex))
 		return -EINTR;
 
-	ret = fdtv->backend->read(fdtv, addr, buf, len);
+	ret = fdtv->backend->read(fdtv, addr, data);
 	if (ret < 0)
 		dev_err(fdtv->device, "CMP: read I/O error\n");
 
@@ -1251,14 +1251,14 @@ static int cmp_read(struct firedtv *fdtv, void *buf, u64 addr, size_t len)
 	return ret;
 }
 
-static int cmp_lock(struct firedtv *fdtv, void *data, u64 addr, __be32 arg)
+static int cmp_lock(struct firedtv *fdtv, u64 addr, __be32 data[])
 {
 	int ret;
 
 	if (mutex_lock_interruptible(&fdtv->avc_mutex))
 		return -EINTR;
 
-	ret = fdtv->backend->lock(fdtv, addr, data, arg);
+	ret = fdtv->backend->lock(fdtv, addr, data);
 	if (ret < 0)
 		dev_err(fdtv->device, "CMP: lock I/O error\n");
 
@@ -1288,25 +1288,25 @@ static inline void set_opcr(__be32 *opcr, u32 value, u32 mask, u32 shift)
 
 int cmp_establish_pp_connection(struct firedtv *fdtv, int plug, int channel)
 {
-	__be32 old_opcr, opcr;
+	__be32 old_opcr, opcr[2];
 	u64 opcr_address = CMP_OUTPUT_PLUG_CONTROL_REG_0 + (plug << 2);
 	int attempts = 0;
 	int ret;
 
-	ret = cmp_read(fdtv, &opcr, opcr_address, 4);
+	ret = cmp_read(fdtv, opcr_address, opcr);
 	if (ret < 0)
 		return ret;
 
 repeat:
-	if (!get_opcr_online(opcr)) {
+	if (!get_opcr_online(*opcr)) {
 		dev_err(fdtv->device, "CMP: output offline\n");
 		return -EBUSY;
 	}
 
-	old_opcr = opcr;
+	old_opcr = *opcr;
 
-	if (get_opcr_p2p_connections(opcr)) {
-		if (get_opcr_channel(opcr) != channel) {
+	if (get_opcr_p2p_connections(*opcr)) {
+		if (get_opcr_channel(*opcr) != channel) {
 			dev_err(fdtv->device, "CMP: cannot change channel\n");
 			return -EBUSY;
 		}
@@ -1314,11 +1314,11 @@ repeat:
 
 		/* We don't allocate isochronous resources. */
 	} else {
-		set_opcr_channel(&opcr, channel);
-		set_opcr_data_rate(&opcr, 2); /* S400 */
+		set_opcr_channel(opcr, channel);
+		set_opcr_data_rate(opcr, 2); /* S400 */
 
 		/* FIXME: this is for the worst case - optimize */
-		set_opcr_overhead_id(&opcr, 0);
+		set_opcr_overhead_id(opcr, 0);
 
 		/*
 		 * FIXME: allocate isochronous channel and bandwidth at IRM
@@ -1326,13 +1326,16 @@ repeat:
 		 */
 	}
 
-	set_opcr_p2p_connections(&opcr, get_opcr_p2p_connections(opcr) + 1);
+	set_opcr_p2p_connections(opcr, get_opcr_p2p_connections(*opcr) + 1);
 
-	ret = cmp_lock(fdtv, &opcr, opcr_address, old_opcr);
+	opcr[1] = *opcr;
+	opcr[0] = old_opcr;
+
+	ret = cmp_lock(fdtv, opcr_address, opcr);
 	if (ret < 0)
 		return ret;
 
-	if (old_opcr != opcr) {
+	if (old_opcr != *opcr) {
 		/*
 		 * FIXME: if old_opcr.P2P_Connections > 0,
 		 * deallocate isochronous channel and bandwidth at IRM
@@ -1350,27 +1353,30 @@ repeat:
 
 void cmp_break_pp_connection(struct firedtv *fdtv, int plug, int channel)
 {
-	__be32 old_opcr, opcr;
+	__be32 old_opcr, opcr[2];
 	u64 opcr_address = CMP_OUTPUT_PLUG_CONTROL_REG_0 + (plug << 2);
 	int attempts = 0;
 
-	if (cmp_read(fdtv, &opcr, opcr_address, 4) < 0)
+	if (cmp_read(fdtv, opcr_address, opcr) < 0)
 		return;
 
 repeat:
-	if (!get_opcr_online(opcr) || !get_opcr_p2p_connections(opcr) ||
-	    get_opcr_channel(opcr) != channel) {
+	if (!get_opcr_online(*opcr) || !get_opcr_p2p_connections(*opcr) ||
+	    get_opcr_channel(*opcr) != channel) {
 		dev_err(fdtv->device, "CMP: no connection to break\n");
 		return;
 	}
 
-	old_opcr = opcr;
-	set_opcr_p2p_connections(&opcr, get_opcr_p2p_connections(opcr) - 1);
+	old_opcr = *opcr;
+	set_opcr_p2p_connections(opcr, get_opcr_p2p_connections(*opcr) - 1);
+
+	opcr[1] = *opcr;
+	opcr[0] = old_opcr;
 
-	if (cmp_lock(fdtv, &opcr, opcr_address, old_opcr) < 0)
+	if (cmp_lock(fdtv, opcr_address, opcr) < 0)
 		return;
 
-	if (old_opcr != opcr) {
+	if (old_opcr != *opcr) {
 		/*
 		 * FIXME: if old_opcr.P2P_Connections == 1, i.e. we were last
 		 * owner, deallocate isochronous channel and bandwidth at IRM
diff --git a/drivers/media/dvb/firewire/firedtv-dvb.c b/drivers/media/dvb/firewire/firedtv-dvb.c
index 5742fde79d99..fc9996c13e13 100644
--- a/drivers/media/dvb/firewire/firedtv-dvb.c
+++ b/drivers/media/dvb/firewire/firedtv-dvb.c
@@ -297,7 +297,7 @@ struct firedtv *fdtv_alloc(struct device *dev,
 #define AVC_UNIT_SPEC_ID_ENTRY	0x00a02d
 #define AVC_SW_VERSION_ENTRY	0x010001
 
-static struct ieee1394_device_id fdtv_id_table[] = {
+const struct ieee1394_device_id fdtv_id_table[] = {
 	{
 		/* FloppyDTV S/CI and FloppyDTV S2 */
 		.match_flags	= MATCH_FLAGS,
@@ -346,12 +346,23 @@ MODULE_DEVICE_TABLE(ieee1394, fdtv_id_table);
 
 static int __init fdtv_init(void)
 {
-	return fdtv_1394_init(fdtv_id_table);
+	int ret;
+
+	ret = fdtv_fw_init();
+	if (ret < 0)
+		return ret;
+
+	ret = fdtv_1394_init();
+	if (ret < 0)
+		fdtv_fw_exit();
+
+	return ret;
 }
 
 static void __exit fdtv_exit(void)
 {
 	fdtv_1394_exit();
+	fdtv_fw_exit();
 }
 
 module_init(fdtv_init);
diff --git a/drivers/media/dvb/firewire/firedtv-fw.c b/drivers/media/dvb/firewire/firedtv-fw.c
new file mode 100644
index 000000000000..6223bf01efe9
--- /dev/null
+++ b/drivers/media/dvb/firewire/firedtv-fw.c
@@ -0,0 +1,368 @@
+/*
+ * FireDTV driver -- firewire I/O backend
+ */
+
+#include <linux/device.h>
+#include <linux/errno.h>
+#include <linux/firewire.h>
+#include <linux/firewire-constants.h>
+#include <linux/kernel.h>
+#include <linux/list.h>
+#include <linux/mm.h>
+#include <linux/slab.h>
+#include <linux/spinlock.h>
+#include <linux/types.h>
+
+#include <asm/page.h>
+
+#include <dvb_demux.h>
+
+#include "firedtv.h"
+
+static LIST_HEAD(node_list);
+static DEFINE_SPINLOCK(node_list_lock);
+
+static inline struct fw_device *device_of(struct firedtv *fdtv)
+{
+	return fw_device(fdtv->device->parent);
+}
+
+static int node_req(struct firedtv *fdtv, u64 addr, void *data, size_t len,
+		    int tcode)
+{
+	struct fw_device *device = device_of(fdtv);
+	int rcode, generation = device->generation;
+
+	smp_rmb(); /* node_id vs. generation */
+
+	rcode = fw_run_transaction(device->card, tcode, device->node_id,
+			generation, device->max_speed, addr, data, len);
+
+	return rcode != RCODE_COMPLETE ? -EIO : 0;
+}
+
+static int node_lock(struct firedtv *fdtv, u64 addr, __be32 data[])
+{
+	return node_req(fdtv, addr, data, 8, TCODE_LOCK_COMPARE_SWAP);
+}
+
+static int node_read(struct firedtv *fdtv, u64 addr, void *data)
+{
+	return node_req(fdtv, addr, data, 4, TCODE_READ_QUADLET_REQUEST);
+}
+
+static int node_write(struct firedtv *fdtv, u64 addr, void *data, size_t len)
+{
+	return node_req(fdtv, addr, data, len, TCODE_WRITE_BLOCK_REQUEST);
+}
+
+#define ISO_HEADER_SIZE			4
+#define CIP_HEADER_SIZE			8
+#define MPEG2_TS_HEADER_SIZE		4
+#define MPEG2_TS_SOURCE_PACKET_SIZE	(4 + 188)
+
+#define MAX_PACKET_SIZE		1024  /* 776, rounded up to 2^n */
+#define PACKETS_PER_PAGE	(PAGE_SIZE / MAX_PACKET_SIZE)
+#define N_PACKETS		64    /* buffer size */
+#define N_PAGES			DIV_ROUND_UP(N_PACKETS, PACKETS_PER_PAGE)
+#define IRQ_INTERVAL		16
+
+struct firedtv_receive_context {
+	struct fw_iso_context *context;
+	struct fw_iso_buffer buffer;
+	int interrupt_packet;
+	int current_packet;
+	char *pages[N_PAGES];
+};
+
+static int queue_iso(struct firedtv_receive_context *ctx, int index)
+{
+	struct fw_iso_packet p;
+
+	p.payload_length = MAX_PACKET_SIZE;
+	p.interrupt = !(++ctx->interrupt_packet & (IRQ_INTERVAL - 1));
+	p.skip = 0;
+	p.header_length = ISO_HEADER_SIZE;
+
+	return fw_iso_context_queue(ctx->context, &p, &ctx->buffer,
+				    index * MAX_PACKET_SIZE);
+}
+
+static void handle_iso(struct fw_iso_context *context, u32 cycle,
+		       size_t header_length, void *header, void *data)
+{
+	struct firedtv *fdtv = data;
+	struct firedtv_receive_context *ctx = fdtv->backend_data;
+	__be32 *h, *h_end;
+	int length, err, i = ctx->current_packet;
+	char *p, *p_end;
+
+	for (h = header, h_end = h + header_length / 4; h < h_end; h++) {
+		length = be32_to_cpup(h) >> 16;
+		if (unlikely(length > MAX_PACKET_SIZE)) {
+			dev_err(fdtv->device, "length = %d\n", length);
+			length = MAX_PACKET_SIZE;
+		}
+
+		p = ctx->pages[i / PACKETS_PER_PAGE]
+				+ (i % PACKETS_PER_PAGE) * MAX_PACKET_SIZE;
+		p_end = p + length;
+
+		for (p += CIP_HEADER_SIZE + MPEG2_TS_HEADER_SIZE; p < p_end;
+		     p += MPEG2_TS_SOURCE_PACKET_SIZE)
+			dvb_dmx_swfilter_packets(&fdtv->demux, p, 1);
+
+		err = queue_iso(ctx, i);
+		if (unlikely(err))
+			dev_err(fdtv->device, "requeue failed\n");
+
+		i = (i + 1) & (N_PACKETS - 1);
+	}
+	ctx->current_packet = i;
+}
+
+static int start_iso(struct firedtv *fdtv)
+{
+	struct firedtv_receive_context *ctx;
+	struct fw_device *device = device_of(fdtv);
+	int i, err;
+
+	ctx = kmalloc(sizeof(*ctx), GFP_KERNEL);
+	if (!ctx)
+		return -ENOMEM;
+
+	ctx->context = fw_iso_context_create(device->card,
+			FW_ISO_CONTEXT_RECEIVE, fdtv->isochannel,
+			device->max_speed, ISO_HEADER_SIZE, handle_iso, fdtv);
+	if (IS_ERR(ctx->context)) {
+		err = PTR_ERR(ctx->context);
+		goto fail_free;
+	}
+
+	err = fw_iso_buffer_init(&ctx->buffer, device->card,
+				 N_PAGES, DMA_FROM_DEVICE);
+	if (err)
+		goto fail_context_destroy;
+
+	ctx->interrupt_packet = 0;
+	ctx->current_packet = 0;
+
+	for (i = 0; i < N_PAGES; i++)
+		ctx->pages[i] = page_address(ctx->buffer.pages[i]);
+
+	for (i = 0; i < N_PACKETS; i++) {
+		err = queue_iso(ctx, i);
+		if (err)
+			goto fail;
+	}
+
+	err = fw_iso_context_start(ctx->context, -1, 0,
+				   FW_ISO_CONTEXT_MATCH_ALL_TAGS);
+	if (err)
+		goto fail;
+
+	fdtv->backend_data = ctx;
+
+	return 0;
+fail:
+	fw_iso_buffer_destroy(&ctx->buffer, device->card);
+fail_context_destroy:
+	fw_iso_context_destroy(ctx->context);
+fail_free:
+	kfree(ctx);
+
+	return err;
+}
+
+static void stop_iso(struct firedtv *fdtv)
+{
+	struct firedtv_receive_context *ctx = fdtv->backend_data;
+
+	fw_iso_context_stop(ctx->context);
+	fw_iso_buffer_destroy(&ctx->buffer, device_of(fdtv)->card);
+	fw_iso_context_destroy(ctx->context);
+	kfree(ctx);
+}
+
+static const struct firedtv_backend backend = {
+	.lock		= node_lock,
+	.read		= node_read,
+	.write		= node_write,
+	.start_iso	= start_iso,
+	.stop_iso	= stop_iso,
+};
+
+static void handle_fcp(struct fw_card *card, struct fw_request *request,
+		       int tcode, int destination, int source, int generation,
+		       int speed, unsigned long long offset,
+		       void *payload, size_t length, void *callback_data)
+{
+	struct firedtv *f, *fdtv = NULL;
+	struct fw_device *device;
+	unsigned long flags;
+	int su;
+
+	if (length < 2 || (((u8 *)payload)[0] & 0xf0) != 0)
+		return;
+
+	su = ((u8 *)payload)[1] & 0x7;
+
+	spin_lock_irqsave(&node_list_lock, flags);
+	list_for_each_entry(f, &node_list, list) {
+		device = device_of(f);
+		if (device->generation != generation)
+			continue;
+
+		smp_rmb(); /* node_id vs. generation */
+
+		if (device->card == card &&
+		    device->node_id == source &&
+		    (f->subunit == su || (f->subunit == 0 && su == 0x7))) {
+			fdtv = f;
+			break;
+		}
+	}
+	spin_unlock_irqrestore(&node_list_lock, flags);
+
+	if (fdtv)
+		avc_recv(fdtv, payload, length);
+}
+
+static struct fw_address_handler fcp_handler = {
+	.length           = CSR_FCP_END - CSR_FCP_RESPONSE,
+	.address_callback = handle_fcp,
+};
+
+static const struct fw_address_region fcp_region = {
+	.start	= CSR_REGISTER_BASE + CSR_FCP_RESPONSE,
+	.end	= CSR_REGISTER_BASE + CSR_FCP_END,
+};
+
+/* Adjust the template string if models with longer names appear. */
+#define MAX_MODEL_NAME_LEN ((int)DIV_ROUND_UP(sizeof("FireDTV ????"), 4))
+
+static size_t model_name(u32 *directory, __be32 *buffer)
+{
+	struct fw_csr_iterator ci;
+	int i, length, key, value, last_key = 0;
+	u32 *block = NULL;
+
+	fw_csr_iterator_init(&ci, directory);
+	while (fw_csr_iterator_next(&ci, &key, &value)) {
+		if (last_key == CSR_MODEL &&
+		    key == (CSR_DESCRIPTOR | CSR_LEAF))
+			block = ci.p - 1 + value;
+		last_key = key;
+	}
+
+	if (block == NULL)
+		return 0;
+
+	length = min((int)(block[0] >> 16) - 2, MAX_MODEL_NAME_LEN);
+	if (length <= 0)
+		return 0;
+
+	/* fast-forward to text string */
+	block += 3;
+
+	for (i = 0; i < length; i++)
+		buffer[i] = cpu_to_be32(block[i]);
+
+	return length * 4;
+}
+
+static int node_probe(struct device *dev)
+{
+	struct firedtv *fdtv;
+	__be32 name[MAX_MODEL_NAME_LEN];
+	int name_len, err;
+
+	name_len = model_name(fw_unit(dev)->directory, name);
+
+	fdtv = fdtv_alloc(dev, &backend, (char *)name, name_len);
+	if (!fdtv)
+		return -ENOMEM;
+
+	err = fdtv_register_rc(fdtv, dev);
+	if (err)
+		goto fail_free;
+
+	spin_lock_irq(&node_list_lock);
+	list_add_tail(&fdtv->list, &node_list);
+	spin_unlock_irq(&node_list_lock);
+
+	err = avc_identify_subunit(fdtv);
+	if (err)
+		goto fail;
+
+	err = fdtv_dvb_register(fdtv);
+	if (err)
+		goto fail;
+
+	avc_register_remote_control(fdtv);
+
+	return 0;
+fail:
+	spin_lock_irq(&node_list_lock);
+	list_del(&fdtv->list);
+	spin_unlock_irq(&node_list_lock);
+	fdtv_unregister_rc(fdtv);
+fail_free:
+	kfree(fdtv);
+
+	return err;
+}
+
+static int node_remove(struct device *dev)
+{
+	struct firedtv *fdtv = dev_get_drvdata(dev);
+
+	fdtv_dvb_unregister(fdtv);
+
+	spin_lock_irq(&node_list_lock);
+	list_del(&fdtv->list);
+	spin_unlock_irq(&node_list_lock);
+
+	fdtv_unregister_rc(fdtv);
+
+	kfree(fdtv);
+	return 0;
+}
+
+static void node_update(struct fw_unit *unit)
+{
+	struct firedtv *fdtv = dev_get_drvdata(&unit->device);
+
+	if (fdtv->isochannel >= 0)
+		cmp_establish_pp_connection(fdtv, fdtv->subunit,
+					    fdtv->isochannel);
+}
+
+static struct fw_driver fdtv_driver = {
+	.driver   = {
+		.owner  = THIS_MODULE,
+		.name   = "firedtv",
+		.bus    = &fw_bus_type,
+		.probe  = node_probe,
+		.remove = node_remove,
+	},
+	.update   = node_update,
+	.id_table = fdtv_id_table,
+};
+
+int __init fdtv_fw_init(void)
+{
+	int ret;
+
+	ret = fw_core_add_address_handler(&fcp_handler, &fcp_region);
+	if (ret < 0)
+		return ret;
+
+	return driver_register(&fdtv_driver.driver);
+}
+
+void fdtv_fw_exit(void)
+{
+	driver_unregister(&fdtv_driver.driver);
+	fw_core_remove_address_handler(&fcp_handler);
+}
diff --git a/drivers/media/dvb/firewire/firedtv-rc.c b/drivers/media/dvb/firewire/firedtv-rc.c
index 27bca2e283df..599d66e5843d 100644
--- a/drivers/media/dvb/firewire/firedtv-rc.c
+++ b/drivers/media/dvb/firewire/firedtv-rc.c
@@ -14,6 +14,7 @@
 #include <linux/kernel.h>
 #include <linux/string.h>
 #include <linux/types.h>
+#include <linux/workqueue.h>
 
 #include "firedtv.h"
 
@@ -163,6 +164,7 @@ fail:
 
 void fdtv_unregister_rc(struct firedtv *fdtv)
 {
+	cancel_work_sync(&fdtv->remote_ctrl_work);
 	kfree(fdtv->remote_ctrl_dev->keycode);
 	input_unregister_device(fdtv->remote_ctrl_dev);
 }
diff --git a/drivers/media/dvb/firewire/firedtv.h b/drivers/media/dvb/firewire/firedtv.h
index d48530b81e61..35080dbb3c66 100644
--- a/drivers/media/dvb/firewire/firedtv.h
+++ b/drivers/media/dvb/firewire/firedtv.h
@@ -16,6 +16,7 @@
 #include <linux/dvb/dmx.h>
 #include <linux/dvb/frontend.h>
 #include <linux/list.h>
+#include <linux/mod_devicetable.h>
 #include <linux/mutex.h>
 #include <linux/spinlock_types.h>
 #include <linux/types.h>
@@ -72,8 +73,8 @@ struct input_dev;
 struct firedtv;
 
 struct firedtv_backend {
-	int (*lock)(struct firedtv *fdtv, u64 addr, void *data, __be32 arg);
-	int (*read)(struct firedtv *fdtv, u64 addr, void *data, size_t len);
+	int (*lock)(struct firedtv *fdtv, u64 addr, __be32 data[]);
+	int (*read)(struct firedtv *fdtv, u64 addr, void *data);
 	int (*write)(struct firedtv *fdtv, u64 addr, void *data, size_t len);
 	int (*start_iso)(struct firedtv *fdtv);
 	void (*stop_iso)(struct firedtv *fdtv);
@@ -119,10 +120,10 @@ struct firedtv {
 
 /* firedtv-1394.c */
 #ifdef CONFIG_DVB_FIREDTV_IEEE1394
-int fdtv_1394_init(struct ieee1394_device_id id_table[]);
+int fdtv_1394_init(void);
 void fdtv_1394_exit(void);
 #else
-static inline int fdtv_1394_init(struct ieee1394_device_id it[]) { return 0; }
+static inline int fdtv_1394_init(void) { return 0; }
 static inline void fdtv_1394_exit(void) {}
 #endif
 
@@ -163,10 +164,20 @@ struct firedtv *fdtv_alloc(struct device *dev,
 			   const struct firedtv_backend *backend,
 			   const char *name, size_t name_len);
 extern const char *fdtv_model_names[];
+extern const struct ieee1394_device_id fdtv_id_table[];
 
 /* firedtv-fe.c */
 void fdtv_frontend_init(struct firedtv *fdtv);
 
+/* firedtv-fw.c */
+#ifdef CONFIG_DVB_FIREDTV_FIREWIRE
+int fdtv_fw_init(void);
+void fdtv_fw_exit(void);
+#else
+static inline int fdtv_fw_init(void) { return 0; }
+static inline void fdtv_fw_exit(void) {}
+#endif
+
 /* firedtv-rc.c */
 #ifdef CONFIG_DVB_FIREDTV_INPUT
 int fdtv_register_rc(struct firedtv *fdtv, struct device *dev);
diff --git a/drivers/media/dvb/frontends/Kconfig b/drivers/media/dvb/frontends/Kconfig
index d7c4837fa71c..cd7f9b7cbffa 100644
--- a/drivers/media/dvb/frontends/Kconfig
+++ b/drivers/media/dvb/frontends/Kconfig
@@ -201,6 +201,21 @@ config DVB_SI21XX
 	help
 	  A DVB-S tuner module. Say Y when you want to support this frontend.
 
+config DVB_DS3000
+	tristate "Montage Tehnology DS3000 based"
+	depends on DVB_CORE && I2C
+	default m if DVB_FE_CUSTOMISE
+	help
+	  A DVB-S/S2 tuner module. Say Y when you want to support this frontend.
+
+config DVB_MB86A16
+	tristate "Fujitsu MB86A16 based"
+	depends on DVB_CORE && I2C
+	default m if DVB_FE_CUSTOMISE
+	help
+	  A DVB-S/DSS Direct Conversion reveiver.
+	  Say Y when you want to support this frontend.
+
 comment "DVB-T (terrestrial) frontends"
 	depends on DVB_CORE
 
@@ -342,6 +357,13 @@ config DVB_AF9013
 	help
 	  Say Y when you want to support this frontend.
 
+config DVB_EC100
+	tristate "E3C EC100"
+	depends on DVB_CORE && I2C
+	default m if DVB_FE_CUSTOMISE
+	help
+	  Say Y when you want to support this frontend.
+
 comment "DVB-C (cable) frontends"
 	depends on DVB_CORE
 
@@ -512,6 +534,15 @@ config DVB_TUNER_DIB0070
 	  This device is only used inside a SiP called together with a
 	  demodulator for now.
 
+config DVB_TUNER_DIB0090
+	tristate "DiBcom DiB0090 silicon base-band tuner"
+	depends on I2C
+	default m if DVB_FE_CUSTOMISE
+	help
+	  A driver for the silicon baseband tuner DiB0090 from DiBcom.
+	  This device is only used inside a SiP called together with a
+	  demodulator for now.
+
 comment "SEC control devices for DVB-S"
 	depends on DVB_CORE
 
@@ -557,6 +588,24 @@ config DVB_LGS8GXX
 	help
 	  A DMB-TH tuner module. Say Y when you want to support this frontend.
 
+config DVB_ATBM8830
+	tristate "AltoBeam ATBM8830/8831 DMB-TH demodulator"
+	depends on DVB_CORE && I2C
+	default m if DVB_FE_CUSTOMISE
+	help
+	  A DMB-TH tuner module. Say Y when you want to support this frontend.
+
+config DVB_TDA665x
+	tristate "TDA665x tuner"
+	depends on DVB_CORE && I2C
+	default m if DVB_FE_CUSTOMISE
+	help
+	  Support for tuner modules based on Philips TDA6650/TDA6651 chips.
+	  Say Y when you want to support this chip.
+
+	  Currently supported tuners:
+	  * Panasonic ENV57H12D5 (ET-50DT)
+
 comment "Tools to develop new frontends"
 
 config DVB_DUMMY_FE
diff --git a/drivers/media/dvb/frontends/Makefile b/drivers/media/dvb/frontends/Makefile
index 3523767e7a76..874e8ada4d1d 100644
--- a/drivers/media/dvb/frontends/Makefile
+++ b/drivers/media/dvb/frontends/Makefile
@@ -55,6 +55,7 @@ obj-$(CONFIG_DVB_TDA10086) += tda10086.o
 obj-$(CONFIG_DVB_TDA826X) += tda826x.o
 obj-$(CONFIG_DVB_TDA8261) += tda8261.o
 obj-$(CONFIG_DVB_TUNER_DIB0070) += dib0070.o
+obj-$(CONFIG_DVB_TUNER_DIB0090) += dib0090.o
 obj-$(CONFIG_DVB_TUA6100) += tua6100.o
 obj-$(CONFIG_DVB_S5H1409) += s5h1409.o
 obj-$(CONFIG_DVB_TUNER_ITD1000) += itd1000.o
@@ -63,7 +64,9 @@ obj-$(CONFIG_DVB_TDA10048) += tda10048.o
 obj-$(CONFIG_DVB_TUNER_CX24113) += cx24113.o
 obj-$(CONFIG_DVB_S5H1411) += s5h1411.o
 obj-$(CONFIG_DVB_LGS8GL5) += lgs8gl5.o
+obj-$(CONFIG_DVB_TDA665x) += tda665x.o
 obj-$(CONFIG_DVB_LGS8GXX) += lgs8gxx.o
+obj-$(CONFIG_DVB_ATBM8830) += atbm8830.o
 obj-$(CONFIG_DVB_DUMMY_FE) += dvb_dummy_fe.o
 obj-$(CONFIG_DVB_AF9013) += af9013.o
 obj-$(CONFIG_DVB_CX24116) += cx24116.o
@@ -76,3 +79,6 @@ obj-$(CONFIG_DVB_STV0900) += stv0900.o
 obj-$(CONFIG_DVB_STV090x) += stv090x.o
 obj-$(CONFIG_DVB_STV6110x) += stv6110x.o
 obj-$(CONFIG_DVB_ISL6423) += isl6423.o
+obj-$(CONFIG_DVB_EC100) += ec100.o
+obj-$(CONFIG_DVB_DS3000) += ds3000.o
+obj-$(CONFIG_DVB_MB86A16) += mb86a16.o
diff --git a/drivers/media/dvb/frontends/atbm8830.c b/drivers/media/dvb/frontends/atbm8830.c
new file mode 100644
index 000000000000..59881a5944eb
--- /dev/null
+++ b/drivers/media/dvb/frontends/atbm8830.c
@@ -0,0 +1,495 @@
+/*
+ *    Support for AltoBeam GB20600 (a.k.a DMB-TH) demodulator
+ *    ATBM8830, ATBM8831
+ *
+ *    Copyright (C) 2009 David T.L. Wong <davidtlwong@gmail.com>
+ *
+ *    This program is free software; you can redistribute it and/or modify
+ *    it under the terms of the GNU General Public License as published by
+ *    the Free Software Foundation; either version 2 of the License, or
+ *    (at your option) any later version.
+ *
+ *    This program is distributed in the hope that it will be useful,
+ *    but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *    GNU General Public License for more details.
+ *
+ *    You should have received a copy of the GNU General Public License
+ *    along with this program; if not, write to the Free Software
+ *    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include <asm/div64.h>
+#include "dvb_frontend.h"
+
+#include "atbm8830.h"
+#include "atbm8830_priv.h"
+
+#define dprintk(args...) \
+	do { \
+		if (debug) \
+			printk(KERN_DEBUG "atbm8830: " args); \
+	} while (0)
+
+static int debug;
+
+module_param(debug, int, 0644);
+MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off).");
+
+static int atbm8830_write_reg(struct atbm_state *priv, u16 reg, u8 data)
+{
+	int ret = 0;
+	u8 dev_addr;
+	u8 buf1[] = { reg >> 8, reg & 0xFF };
+	u8 buf2[] = { data };
+	struct i2c_msg msg1 = { .flags = 0, .buf = buf1, .len = 2 };
+	struct i2c_msg msg2 = { .flags = 0, .buf = buf2, .len = 1 };
+
+	dev_addr = priv->config->demod_address;
+	msg1.addr = dev_addr;
+	msg2.addr = dev_addr;
+
+	if (debug >= 2)
+		printk(KERN_DEBUG "%s: reg=0x%04X, data=0x%02X\n",
+			__func__, reg, data);
+
+	ret = i2c_transfer(priv->i2c, &msg1, 1);
+	if (ret != 1)
+		return -EIO;
+
+	ret = i2c_transfer(priv->i2c, &msg2, 1);
+	return (ret != 1) ? -EIO : 0;
+}
+
+static int atbm8830_read_reg(struct atbm_state *priv, u16 reg, u8 *p_data)
+{
+	int ret;
+	u8 dev_addr;
+
+	u8 buf1[] = { reg >> 8, reg & 0xFF };
+	u8 buf2[] = { 0 };
+	struct i2c_msg msg1 = { .flags = 0, .buf = buf1, .len = 2 };
+	struct i2c_msg msg2 = { .flags = I2C_M_RD, .buf = buf2, .len = 1 };
+
+	dev_addr = priv->config->demod_address;
+	msg1.addr = dev_addr;
+	msg2.addr = dev_addr;
+
+	ret = i2c_transfer(priv->i2c, &msg1, 1);
+	if (ret != 1) {
+		dprintk(KERN_DEBUG "%s: error reg=0x%04x, ret=%i\n",
+			__func__, reg, ret);
+		return -EIO;
+	}
+
+	ret = i2c_transfer(priv->i2c, &msg2, 1);
+	if (ret != 1)
+		return -EIO;
+
+	*p_data = buf2[0];
+	if (debug >= 2)
+		printk(KERN_DEBUG "%s: reg=0x%04X, data=0x%02X\n",
+			__func__, reg, buf2[0]);
+
+	return 0;
+}
+
+/* Lock register latch so that multi-register read is atomic */
+static inline int atbm8830_reglatch_lock(struct atbm_state *priv, int lock)
+{
+	return atbm8830_write_reg(priv, REG_READ_LATCH, lock ? 1 : 0);
+}
+
+static int set_osc_freq(struct atbm_state *priv, u32 freq /*in kHz*/)
+{
+	u32 val;
+	u64 t;
+
+	/* 0x100000 * freq / 30.4MHz */
+	t = (u64)0x100000 * freq;
+	do_div(t, 30400);
+	val = t;
+
+	atbm8830_write_reg(priv, REG_OSC_CLK, val);
+	atbm8830_write_reg(priv, REG_OSC_CLK + 1, val >> 8);
+	atbm8830_write_reg(priv, REG_OSC_CLK + 2, val >> 16);
+
+	return 0;
+}
+
+static int set_if_freq(struct atbm_state *priv, u32 freq /*in kHz*/)
+{
+
+	u32 fs = priv->config->osc_clk_freq;
+	u64 t;
+	u32 val;
+	u8 dat;
+
+	if (freq != 0) {
+		/* 2 * PI * (freq - fs) / fs * (2 ^ 22) */
+		t = (u64) 2 * 31416 * (freq - fs);
+		t <<= 22;
+		do_div(t, fs);
+		do_div(t, 1000);
+		val = t;
+
+		atbm8830_write_reg(priv, REG_TUNER_BASEBAND, 1);
+		atbm8830_write_reg(priv, REG_IF_FREQ, val);
+		atbm8830_write_reg(priv, REG_IF_FREQ+1, val >> 8);
+		atbm8830_write_reg(priv, REG_IF_FREQ+2, val >> 16);
+
+		atbm8830_read_reg(priv, REG_ADC_CONFIG, &dat);
+		dat &= 0xFC;
+		atbm8830_write_reg(priv, REG_ADC_CONFIG, dat);
+	} else {
+		/* Zero IF */
+		atbm8830_write_reg(priv, REG_TUNER_BASEBAND, 0);
+
+		atbm8830_read_reg(priv, REG_ADC_CONFIG, &dat);
+		dat &= 0xFC;
+		dat |= 0x02;
+		atbm8830_write_reg(priv, REG_ADC_CONFIG, dat);
+
+		if (priv->config->zif_swap_iq)
+			atbm8830_write_reg(priv, REG_SWAP_I_Q, 0x03);
+		else
+			atbm8830_write_reg(priv, REG_SWAP_I_Q, 0x01);
+	}
+
+	return 0;
+}
+
+static int is_locked(struct atbm_state *priv, u8 *locked)
+{
+	u8 status;
+
+	atbm8830_read_reg(priv, REG_LOCK_STATUS, &status);
+
+	if (locked != NULL)
+		*locked = (status == 1);
+	return 0;
+}
+
+
+static int set_static_channel_mode(struct atbm_state *priv)
+{
+	int i;
+
+	for (i = 0; i < 5; i++)
+		atbm8830_write_reg(priv, 0x099B + i, 0x08);
+
+	atbm8830_write_reg(priv, 0x095B, 0x7F);
+	atbm8830_write_reg(priv, 0x09CB, 0x01);
+	atbm8830_write_reg(priv, 0x09CC, 0x7F);
+	atbm8830_write_reg(priv, 0x09CD, 0x7F);
+	atbm8830_write_reg(priv, 0x0E01, 0x20);
+
+	/* For single carrier */
+	atbm8830_write_reg(priv, 0x0B03, 0x0A);
+	atbm8830_write_reg(priv, 0x0935, 0x10);
+	atbm8830_write_reg(priv, 0x0936, 0x08);
+	atbm8830_write_reg(priv, 0x093E, 0x08);
+	atbm8830_write_reg(priv, 0x096E, 0x06);
+
+	/* frame_count_max0 */
+	atbm8830_write_reg(priv, 0x0B09, 0x00);
+	/* frame_count_max1 */
+	atbm8830_write_reg(priv, 0x0B0A, 0x08);
+
+	return 0;
+}
+
+static int set_ts_config(struct atbm_state *priv)
+{
+	const struct atbm8830_config *cfg = priv->config;
+
+	/*Set parallel/serial ts mode*/
+	atbm8830_write_reg(priv, REG_TS_SERIAL, cfg->serial_ts ? 1 : 0);
+	atbm8830_write_reg(priv, REG_TS_CLK_MODE, cfg->serial_ts ? 1 : 0);
+	/*Set ts sampling edge*/
+	atbm8830_write_reg(priv, REG_TS_SAMPLE_EDGE,
+		cfg->ts_sampling_edge ? 1 : 0);
+	/*Set ts clock freerun*/
+	atbm8830_write_reg(priv, REG_TS_CLK_FREERUN,
+		cfg->ts_clk_gated ? 0 : 1);
+
+	return 0;
+}
+
+static int atbm8830_init(struct dvb_frontend *fe)
+{
+	struct atbm_state *priv = fe->demodulator_priv;
+	const struct atbm8830_config *cfg = priv->config;
+
+	/*Set oscillator frequency*/
+	set_osc_freq(priv, cfg->osc_clk_freq);
+
+	/*Set IF frequency*/
+	set_if_freq(priv, cfg->if_freq);
+
+
+	/*Set static channel mode*/
+	set_static_channel_mode(priv);
+
+	set_ts_config(priv);
+	/*Turn off DSP reset*/
+	atbm8830_write_reg(priv, 0x000A, 0);
+
+	/*SW version test*/
+	atbm8830_write_reg(priv, 0x020C, 11);
+
+	/* Run */
+	atbm8830_write_reg(priv, REG_DEMOD_RUN, 1);
+
+	return 0;
+}
+
+
+static void atbm8830_release(struct dvb_frontend *fe)
+{
+	struct atbm_state *state = fe->demodulator_priv;
+	dprintk("%s\n", __func__);
+
+	kfree(state);
+}
+
+static int atbm8830_set_fe(struct dvb_frontend *fe,
+			  struct dvb_frontend_parameters *fe_params)
+{
+	struct atbm_state *priv = fe->demodulator_priv;
+	int i;
+	u8 locked = 0;
+	dprintk("%s\n", __func__);
+
+	/* set frequency */
+	if (fe->ops.tuner_ops.set_params) {
+		if (fe->ops.i2c_gate_ctrl)
+			fe->ops.i2c_gate_ctrl(fe, 1);
+		fe->ops.tuner_ops.set_params(fe, fe_params);
+		if (fe->ops.i2c_gate_ctrl)
+			fe->ops.i2c_gate_ctrl(fe, 0);
+	}
+
+	/* start auto lock */
+	for (i = 0; i < 10; i++) {
+		mdelay(100);
+		dprintk("Try %d\n", i);
+		is_locked(priv, &locked);
+		if (locked != 0) {
+			dprintk("ATBM8830 locked!\n");
+			break;
+		}
+	}
+
+	return 0;
+}
+
+static int atbm8830_get_fe(struct dvb_frontend *fe,
+			  struct dvb_frontend_parameters *fe_params)
+{
+	dprintk("%s\n", __func__);
+
+	/* TODO: get real readings from device */
+	/* inversion status */
+	fe_params->inversion = INVERSION_OFF;
+
+	/* bandwidth */
+	fe_params->u.ofdm.bandwidth = BANDWIDTH_8_MHZ;
+
+	fe_params->u.ofdm.code_rate_HP = FEC_AUTO;
+	fe_params->u.ofdm.code_rate_LP = FEC_AUTO;
+
+	fe_params->u.ofdm.constellation = QAM_AUTO;
+
+	/* transmission mode */
+	fe_params->u.ofdm.transmission_mode = TRANSMISSION_MODE_AUTO;
+
+	/* guard interval */
+	fe_params->u.ofdm.guard_interval = GUARD_INTERVAL_AUTO;
+
+	/* hierarchy */
+	fe_params->u.ofdm.hierarchy_information = HIERARCHY_NONE;
+
+	return 0;
+}
+
+static int atbm8830_get_tune_settings(struct dvb_frontend *fe,
+	struct dvb_frontend_tune_settings *fesettings)
+{
+	fesettings->min_delay_ms = 0;
+	fesettings->step_size = 0;
+	fesettings->max_drift = 0;
+	return 0;
+}
+
+static int atbm8830_read_status(struct dvb_frontend *fe, fe_status_t *fe_status)
+{
+	struct atbm_state *priv = fe->demodulator_priv;
+	u8 locked = 0;
+	u8 agc_locked = 0;
+
+	dprintk("%s\n", __func__);
+	*fe_status = 0;
+
+	is_locked(priv, &locked);
+	if (locked) {
+		*fe_status |= FE_HAS_SIGNAL | FE_HAS_CARRIER |
+			FE_HAS_VITERBI | FE_HAS_SYNC | FE_HAS_LOCK;
+	}
+	dprintk("%s: fe_status=0x%x\n", __func__, *fe_status);
+
+	atbm8830_read_reg(priv, REG_AGC_LOCK, &agc_locked);
+	dprintk("AGC Lock: %d\n", agc_locked);
+
+	return 0;
+}
+
+static int atbm8830_read_ber(struct dvb_frontend *fe, u32 *ber)
+{
+	struct atbm_state *priv = fe->demodulator_priv;
+	u32 frame_err;
+	u8 t;
+
+	dprintk("%s\n", __func__);
+
+	atbm8830_reglatch_lock(priv, 1);
+
+	atbm8830_read_reg(priv, REG_FRAME_ERR_CNT + 1, &t);
+	frame_err = t & 0x7F;
+	frame_err <<= 8;
+	atbm8830_read_reg(priv, REG_FRAME_ERR_CNT, &t);
+	frame_err |= t;
+
+	atbm8830_reglatch_lock(priv, 0);
+
+	*ber = frame_err * 100 / 32767;
+
+	dprintk("%s: ber=0x%x\n", __func__, *ber);
+	return 0;
+}
+
+static int atbm8830_read_signal_strength(struct dvb_frontend *fe, u16 *signal)
+{
+	struct atbm_state *priv = fe->demodulator_priv;
+	u32 pwm;
+	u8 t;
+
+	dprintk("%s\n", __func__);
+	atbm8830_reglatch_lock(priv, 1);
+
+	atbm8830_read_reg(priv, REG_AGC_PWM_VAL + 1, &t);
+	pwm = t & 0x03;
+	pwm <<= 8;
+	atbm8830_read_reg(priv, REG_AGC_PWM_VAL, &t);
+	pwm |= t;
+
+	atbm8830_reglatch_lock(priv, 0);
+
+	dprintk("AGC PWM = 0x%02X\n", pwm);
+	pwm = 0x400 - pwm;
+
+	*signal = pwm * 0x10000 / 0x400;
+
+	return 0;
+}
+
+static int atbm8830_read_snr(struct dvb_frontend *fe, u16 *snr)
+{
+	dprintk("%s\n", __func__);
+	*snr = 0;
+	return 0;
+}
+
+static int atbm8830_read_ucblocks(struct dvb_frontend *fe, u32 *ucblocks)
+{
+	dprintk("%s\n", __func__);
+	*ucblocks = 0;
+	return 0;
+}
+
+static int atbm8830_i2c_gate_ctrl(struct dvb_frontend *fe, int enable)
+{
+	struct atbm_state *priv = fe->demodulator_priv;
+
+	return atbm8830_write_reg(priv, REG_I2C_GATE, enable ? 1 : 0);
+}
+
+static struct dvb_frontend_ops atbm8830_ops = {
+	.info = {
+		.name = "AltoBeam ATBM8830/8831 DMB-TH",
+		.type = FE_OFDM,
+		.frequency_min = 474000000,
+		.frequency_max = 858000000,
+		.frequency_stepsize = 10000,
+		.caps =
+			FE_CAN_FEC_AUTO |
+			FE_CAN_QAM_AUTO |
+			FE_CAN_TRANSMISSION_MODE_AUTO |
+			FE_CAN_GUARD_INTERVAL_AUTO
+	},
+
+	.release = atbm8830_release,
+
+	.init = atbm8830_init,
+	.sleep = NULL,
+	.write = NULL,
+	.i2c_gate_ctrl = atbm8830_i2c_gate_ctrl,
+
+	.set_frontend = atbm8830_set_fe,
+	.get_frontend = atbm8830_get_fe,
+	.get_tune_settings = atbm8830_get_tune_settings,
+
+	.read_status = atbm8830_read_status,
+	.read_ber = atbm8830_read_ber,
+	.read_signal_strength = atbm8830_read_signal_strength,
+	.read_snr = atbm8830_read_snr,
+	.read_ucblocks = atbm8830_read_ucblocks,
+};
+
+struct dvb_frontend *atbm8830_attach(const struct atbm8830_config *config,
+	struct i2c_adapter *i2c)
+{
+	struct atbm_state *priv = NULL;
+	u8 data = 0;
+
+	dprintk("%s()\n", __func__);
+
+	if (config == NULL || i2c == NULL)
+		return NULL;
+
+	priv = kzalloc(sizeof(struct atbm_state), GFP_KERNEL);
+	if (priv == NULL)
+		goto error_out;
+
+	priv->config = config;
+	priv->i2c = i2c;
+
+	/* check if the demod is there */
+	if (atbm8830_read_reg(priv, REG_CHIP_ID, &data) != 0) {
+		dprintk("%s atbm8830/8831 not found at i2c addr 0x%02X\n",
+			__func__, priv->config->demod_address);
+		goto error_out;
+	}
+	dprintk("atbm8830 chip id: 0x%02X\n", data);
+
+	memcpy(&priv->frontend.ops, &atbm8830_ops,
+	       sizeof(struct dvb_frontend_ops));
+	priv->frontend.demodulator_priv = priv;
+
+	atbm8830_init(&priv->frontend);
+
+	atbm8830_i2c_gate_ctrl(&priv->frontend, 1);
+
+	return &priv->frontend;
+
+error_out:
+	dprintk("%s() error_out\n", __func__);
+	kfree(priv);
+	return NULL;
+
+}
+EXPORT_SYMBOL(atbm8830_attach);
+
+MODULE_DESCRIPTION("AltoBeam ATBM8830/8831 GB20600 demodulator driver");
+MODULE_AUTHOR("David T. L. Wong <davidtlwong@gmail.com>");
+MODULE_LICENSE("GPL");
diff --git a/drivers/media/dvb/frontends/atbm8830.h b/drivers/media/dvb/frontends/atbm8830.h
new file mode 100644
index 000000000000..e8149f393300
--- /dev/null
+++ b/drivers/media/dvb/frontends/atbm8830.h
@@ -0,0 +1,76 @@
+/*
+ *    Support for AltoBeam GB20600 (a.k.a DMB-TH) demodulator
+ *    ATBM8830, ATBM8831
+ *
+ *    Copyright (C) 2009 David T.L. Wong <davidtlwong@gmail.com>
+ *
+ *    This program is free software; you can redistribute it and/or modify
+ *    it under the terms of the GNU General Public License as published by
+ *    the Free Software Foundation; either version 2 of the License, or
+ *    (at your option) any later version.
+ *
+ *    This program is distributed in the hope that it will be useful,
+ *    but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *    GNU General Public License for more details.
+ *
+ *    You should have received a copy of the GNU General Public License
+ *    along with this program; if not, write to the Free Software
+ *    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#ifndef __ATBM8830_H__
+#define __ATBM8830_H__
+
+#include <linux/dvb/frontend.h>
+#include <linux/i2c.h>
+
+#define ATBM8830_PROD_8830 0
+#define ATBM8830_PROD_8831 1
+
+struct atbm8830_config {
+
+	/* product type */
+	u8 prod;
+
+	/* the demodulator's i2c address */
+	u8 demod_address;
+
+	/* parallel or serial transport stream */
+	u8 serial_ts;
+
+	/* transport stream clock output only when receving valid stream */
+	u8 ts_clk_gated;
+
+	/* Decoder sample TS data at rising edge of clock */
+	u8 ts_sampling_edge;
+
+	/* Oscillator clock frequency */
+	u32 osc_clk_freq; /* in kHz */
+
+	/* IF frequency */
+	u32 if_freq; /* in kHz */
+
+	/* Swap I/Q for zero IF */
+	u8 zif_swap_iq;
+
+	/* Tuner AGC settings */
+	u8 agc_min;
+	u8 agc_max;
+	u8 agc_hold_loop;
+};
+
+#if defined(CONFIG_DVB_ATBM8830) || \
+	(defined(CONFIG_DVB_ATBM8830_MODULE) && defined(MODULE))
+extern struct dvb_frontend *atbm8830_attach(const struct atbm8830_config *config,
+		struct i2c_adapter *i2c);
+#else
+static inline
+struct dvb_frontend *atbm8830_attach(const struct atbm8830_config *config,
+		struct i2c_adapter *i2c) {
+	printk(KERN_WARNING "%s: driver disabled by Kconfig\n", __func__);
+	return NULL;
+}
+#endif /* CONFIG_DVB_ATBM8830 */
+
+#endif /* __ATBM8830_H__ */
diff --git a/drivers/media/dvb/frontends/atbm8830_priv.h b/drivers/media/dvb/frontends/atbm8830_priv.h
new file mode 100644
index 000000000000..ce960f76092a
--- /dev/null
+++ b/drivers/media/dvb/frontends/atbm8830_priv.h
@@ -0,0 +1,75 @@
+/*
+ *    Support for AltoBeam GB20600 (a.k.a DMB-TH) demodulator
+ *    ATBM8830, ATBM8831
+ *
+ *    Copyright (C) 2009 David T.L. Wong <davidtlwong@gmail.com>
+ *
+ *    This program is free software; you can redistribute it and/or modify
+ *    it under the terms of the GNU General Public License as published by
+ *    the Free Software Foundation; either version 2 of the License, or
+ *    (at your option) any later version.
+ *
+ *    This program is distributed in the hope that it will be useful,
+ *    but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *    GNU General Public License for more details.
+ *
+ *    You should have received a copy of the GNU General Public License
+ *    along with this program; if not, write to the Free Software
+ *    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+ 
+#ifndef __ATBM8830_PRIV_H
+#define __ATBM8830_PRIV_H
+
+struct atbm_state {
+	struct i2c_adapter *i2c;
+	/* configuration settings */
+	const struct atbm8830_config *config;
+	struct dvb_frontend frontend;
+};
+
+#define REG_CHIP_ID	0x0000
+#define REG_TUNER_BASEBAND	0x0001
+#define REG_DEMOD_RUN	0x0004
+#define REG_DSP_RESET	0x0005
+#define REG_RAM_RESET	0x0006
+#define REG_ADC_RESET	0x0007
+#define REG_TSPORT_RESET	0x0008
+#define REG_BLKERR_POL	0x000C
+#define REG_I2C_GATE	0x0103
+#define REG_TS_SAMPLE_EDGE	0x0301
+#define REG_TS_PKT_LEN_204	0x0302
+#define REG_TS_PKT_LEN_AUTO	0x0303
+#define REG_TS_SERIAL	0x0305
+#define REG_TS_CLK_FREERUN	0x0306
+#define REG_TS_VALID_MODE	0x0307
+#define REG_TS_CLK_MODE	0x030B /* 1 for serial, 0 for parallel */
+
+#define REG_TS_ERRBIT_USE	0x030C
+#define REG_LOCK_STATUS	0x030D
+#define REG_ADC_CONFIG	0x0602
+#define REG_CARRIER_OFFSET	0x0827 /* 0x0827-0x0829 little endian */
+#define REG_DETECTED_PN_MODE	0x082D
+#define REG_READ_LATCH	0x084D
+#define REG_IF_FREQ	0x0A00 /* 0x0A00-0x0A02 little endian */
+#define REG_OSC_CLK	0x0A03 /* 0x0A03-0x0A05 little endian */
+#define REG_BYPASS_CCI	0x0A06
+#define REG_ANALOG_LUMA_DETECTED	0x0A25
+#define REG_ANALOG_AUDIO_DETECTED	0x0A26
+#define REG_ANALOG_CHROMA_DETECTED	0x0A39
+#define REG_FRAME_ERR_CNT	0x0B04
+#define REG_USE_EXT_ADC	0x0C00
+#define REG_SWAP_I_Q	0x0C01
+#define REG_TPS_MANUAL	0x0D01
+#define REG_TPS_CONFIG	0x0D02
+#define REG_BYPASS_DEINTERLEAVER	0x0E00
+#define REG_AGC_TARGET	0x1003 /* 0x1003-0x1005 little endian */
+#define REG_AGC_MIN	0x1020
+#define REG_AGC_MAX	0x1023
+#define REG_AGC_LOCK	0x1027
+#define REG_AGC_PWM_VAL	0x1028 /* 0x1028-0x1029 little endian */
+#define REG_AGC_HOLD_LOOP	0x1031
+
+#endif
+
diff --git a/drivers/media/dvb/frontends/au8522_decoder.c b/drivers/media/dvb/frontends/au8522_decoder.c
index 74981ee923c8..24268ef2753d 100644
--- a/drivers/media/dvb/frontends/au8522_decoder.c
+++ b/drivers/media/dvb/frontends/au8522_decoder.c
@@ -23,7 +23,6 @@
 /* Developer notes:
  *
  * VBI support is not yet working
- * Saturation and hue setting are not yet working
  * Enough is implemented here for CVBS and S-Video inputs, but the actual
  *  analog demodulator code isn't implemented (not needed for xc5000 since it
  *  has its own demodulator and outputs CVBS)
@@ -63,7 +62,7 @@ struct au8522_register_config {
    The values are as follows from left to right
    0="ATV RF" 1="ATV RF13" 2="CVBS" 3="S-Video" 4="PAL" 5=CVBS13" 6="SVideo13"
 */
-struct au8522_register_config filter_coef[] = {
+static const struct au8522_register_config filter_coef[] = {
 	{AU8522_FILTER_COEF_R410, {0x25, 0x00, 0x25, 0x25, 0x00, 0x00, 0x00} },
 	{AU8522_FILTER_COEF_R411, {0x20, 0x00, 0x20, 0x20, 0x00, 0x00, 0x00} },
 	{AU8522_FILTER_COEF_R412, {0x03, 0x00, 0x03, 0x03, 0x00, 0x00, 0x00} },
@@ -105,7 +104,7 @@ struct au8522_register_config filter_coef[] = {
    0="SIF" 1="ATVRF/ATVRF13"
    Note: the "ATVRF/ATVRF13" mode has never been tested
 */
-struct au8522_register_config lpfilter_coef[] = {
+static const struct au8522_register_config lpfilter_coef[] = {
 	{0x060b, {0x21, 0x0b} },
 	{0x060c, {0xad, 0xad} },
 	{0x060d, {0x70, 0xf0} },
@@ -236,8 +235,10 @@ static void setup_decoder_defaults(struct au8522_state *state, u8 input_mode)
 	state->contrast = 0x79;
 	au8522_writereg(state, AU8522_TVDEC_SATURATION_CB_REG00CH, 0x80);
 	au8522_writereg(state, AU8522_TVDEC_SATURATION_CR_REG00DH, 0x80);
+	state->saturation = 0x80;
 	au8522_writereg(state, AU8522_TVDEC_HUE_H_REG00EH, 0x00);
 	au8522_writereg(state, AU8522_TVDEC_HUE_L_REG00FH, 0x00);
+	state->hue = 0x00;
 
 	/* Other decoder registers */
 	au8522_writereg(state, AU8522_TVDEC_INT_MASK_REG010H, 0x00);
@@ -315,7 +316,7 @@ static void setup_decoder_defaults(struct au8522_state *state, u8 input_mode)
 	if (input_mode == AU8522_INPUT_CONTROL_REG081H_SVIDEO_CH13 ||
 	    input_mode == AU8522_INPUT_CONTROL_REG081H_SVIDEO_CH24) {
 		/* Despite what the table says, for the HVR-950q we still need
-		   to be in CVBS mode for the S-Video input (reason uknown). */
+		   to be in CVBS mode for the S-Video input (reason unknown). */
 		/* filter_coef_type = 3; */
 		filter_coef_type = 5;
 	} else {
@@ -504,7 +505,19 @@ static int au8522_s_ctrl(struct v4l2_subdev *sd, struct v4l2_control *ctrl)
 				ctrl->value);
 		break;
 	case V4L2_CID_SATURATION:
+		state->saturation = ctrl->value;
+		au8522_writereg(state, AU8522_TVDEC_SATURATION_CB_REG00CH,
+				ctrl->value);
+		au8522_writereg(state, AU8522_TVDEC_SATURATION_CR_REG00DH,
+				ctrl->value);
+		break;
 	case V4L2_CID_HUE:
+		state->hue = ctrl->value;
+		au8522_writereg(state, AU8522_TVDEC_HUE_H_REG00EH,
+				ctrl->value >> 8);
+		au8522_writereg(state, AU8522_TVDEC_HUE_L_REG00FH,
+				ctrl->value & 0xFF);
+		break;
 	case V4L2_CID_AUDIO_VOLUME:
 	case V4L2_CID_AUDIO_BASS:
 	case V4L2_CID_AUDIO_TREBLE:
@@ -534,7 +547,11 @@ static int au8522_g_ctrl(struct v4l2_subdev *sd, struct v4l2_control *ctrl)
 		ctrl->value = state->contrast;
 		break;
 	case V4L2_CID_SATURATION:
+		ctrl->value = state->saturation;
+		break;
 	case V4L2_CID_HUE:
+		ctrl->value = state->hue;
+		break;
 	case V4L2_CID_AUDIO_VOLUME:
 	case V4L2_CID_AUDIO_BASS:
 	case V4L2_CID_AUDIO_TREBLE:
@@ -632,8 +649,9 @@ static int au8522_queryctrl(struct v4l2_subdev *sd, struct v4l2_queryctrl *qc)
 	case V4L2_CID_BRIGHTNESS:
 		return v4l2_ctrl_query_fill(qc, 0, 255, 1, 128);
 	case V4L2_CID_SATURATION:
+		return v4l2_ctrl_query_fill(qc, 0, 255, 1, 128);
 	case V4L2_CID_HUE:
-		/* Not yet implemented */
+		return v4l2_ctrl_query_fill(qc, -32768, 32768, 1, 0);
 	default:
 		break;
 	}
diff --git a/drivers/media/dvb/frontends/au8522_priv.h b/drivers/media/dvb/frontends/au8522_priv.h
index f328f2b3ad3d..c74c4e72fe91 100644
--- a/drivers/media/dvb/frontends/au8522_priv.h
+++ b/drivers/media/dvb/frontends/au8522_priv.h
@@ -62,6 +62,8 @@ struct au8522_state {
 	u32 rev;
 	u8 brightness;
 	u8 contrast;
+	u8 saturation;
+	s16 hue;
 };
 
 /* These are routines shared by both the VSB/QAM demodulator and the analog
diff --git a/drivers/media/dvb/frontends/cx24110.c b/drivers/media/dvb/frontends/cx24110.c
index ffbcfabd83f0..00a4e8f03304 100644
--- a/drivers/media/dvb/frontends/cx24110.c
+++ b/drivers/media/dvb/frontends/cx24110.c
@@ -1,4 +1,4 @@
-	/*
+/*
     cx24110 - Single Chip Satellite Channel Receiver driver module
 
     Copyright (C) 2002 Peter Hettkamp <peter.hettkamp@htp-tel.de> based on
@@ -96,7 +96,7 @@ static struct {u8 reg; u8 data;} cx24110_regdata[]=
 	 {0x42,0x00}, /* @ middle bytes " */
 	 {0x43,0x00}, /* @ LSB          " */
 		      /* leave the carrier tracking loop parameters on default */
-		      /* leave the bit timing loop parameters at gefault */
+		      /* leave the bit timing loop parameters at default */
 	 {0x56,0x4d}, /* set the filtune voltage to 2.7V, as recommended by */
 		      /* the cx24108 data sheet for symbol rates above 15MS/s */
 	 {0x57,0x00}, /* @ Filter sigma delta enabled, positive */
diff --git a/drivers/media/dvb/frontends/cx24113.c b/drivers/media/dvb/frontends/cx24113.c
index 075b2b57cf09..e9ee55592fd3 100644
--- a/drivers/media/dvb/frontends/cx24113.c
+++ b/drivers/media/dvb/frontends/cx24113.c
@@ -589,7 +589,7 @@ struct dvb_frontend *cx24113_attach(struct dvb_frontend *fe,
 		info("detected CX24113 variant\n");
 		break;
 	case REV_CX24113:
-		info("sucessfully detected\n");
+		info("successfully detected\n");
 		break;
 	default:
 		err("unsupported device id: %x\n", state->rev);
diff --git a/drivers/media/dvb/frontends/dib0070.c b/drivers/media/dvb/frontends/dib0070.c
index 2be17b93e0bd..0d12763603b4 100644
--- a/drivers/media/dvb/frontends/dib0070.c
+++ b/drivers/media/dvb/frontends/dib0070.c
@@ -49,21 +49,6 @@ MODULE_PARM_DESC(debug, "turn on debugging (default: 0)");
 #define DIB0070_P1G  0x03
 #define DIB0070S_P1A 0x02
 
-enum frontend_tune_state {
-	CT_TUNER_START = 10,
-	CT_TUNER_STEP_0,
-	CT_TUNER_STEP_1,
-	CT_TUNER_STEP_2,
-	CT_TUNER_STEP_3,
-	CT_TUNER_STEP_4,
-	CT_TUNER_STEP_5,
-	CT_TUNER_STEP_6,
-	CT_TUNER_STEP_7,
-	CT_TUNER_STOP,
-};
-
-#define FE_CALLBACK_TIME_NEVER 0xffffffff
-
 struct dib0070_state {
 	struct i2c_adapter *i2c;
 	struct dvb_frontend *fe;
@@ -71,10 +56,10 @@ struct dib0070_state {
 	u16 wbd_ff_offset;
 	u8 revision;
 
-	enum frontend_tune_state tune_state;
-	u32 current_rf;
+    enum frontend_tune_state tune_state;
+    u32 current_rf;
 
-	/* for the captrim binary search */
+    /* for the captrim binary search */
 	s8 step;
 	u16 adc_diff;
 
@@ -85,7 +70,7 @@ struct dib0070_state {
 	const struct dib0070_tuning *current_tune_table_index;
 	const struct dib0070_lna_match *lna_match;
 
-	u8 wbd_gain_current;
+    u8  wbd_gain_current;
 	u16 wbd_offset_3_3[2];
 };
 
@@ -93,8 +78,8 @@ static uint16_t dib0070_read_reg(struct dib0070_state *state, u8 reg)
 {
 	u8 b[2];
 	struct i2c_msg msg[2] = {
-		{.addr = state->cfg->i2c_address,.flags = 0,.buf = &reg,.len = 1},
-		{.addr = state->cfg->i2c_address,.flags = I2C_M_RD,.buf = b,.len = 2},
+		{ .addr = state->cfg->i2c_address, .flags = 0,        .buf = &reg, .len = 1 },
+		{ .addr = state->cfg->i2c_address, .flags = I2C_M_RD, .buf = b,  .len = 2 },
 	};
 	if (i2c_transfer(state->i2c, msg, 2) != 2) {
 		printk(KERN_WARNING "DiB0070 I2C read failed\n");
@@ -106,7 +91,7 @@ static uint16_t dib0070_read_reg(struct dib0070_state *state, u8 reg)
 static int dib0070_write_reg(struct dib0070_state *state, u8 reg, u16 val)
 {
 	u8 b[3] = { reg, val >> 8, val & 0xff };
-	struct i2c_msg msg = {.addr = state->cfg->i2c_address,.flags = 0,.buf = b,.len = 3 };
+	struct i2c_msg msg = { .addr = state->cfg->i2c_address, .flags = 0, .buf = b, .len = 3 };
 	if (i2c_transfer(state->i2c, &msg, 1) != 1) {
 		printk(KERN_WARNING "DiB0070 I2C write failed\n");
 		return -EREMOTEIO;
@@ -124,30 +109,30 @@ static int dib0070_write_reg(struct dib0070_state *state, u8 reg, u16 val)
 
 static int dib0070_set_bandwidth(struct dvb_frontend *fe, struct dvb_frontend_parameters *ch)
 {
-	struct dib0070_state *state = fe->tuner_priv;
-	u16 tmp = dib0070_read_reg(state, 0x02) & 0x3fff;
-
-	if (state->fe->dtv_property_cache.bandwidth_hz / 1000 > 7000)
-		tmp |= (0 << 14);
-	else if (state->fe->dtv_property_cache.bandwidth_hz / 1000 > 6000)
-		tmp |= (1 << 14);
-	else if (state->fe->dtv_property_cache.bandwidth_hz / 1000 > 5000)
-		tmp |= (2 << 14);
-	else
-		tmp |= (3 << 14);
-
-	dib0070_write_reg(state, 0x02, tmp);
-
-	/* sharpen the BB filter in ISDB-T to have higher immunity to adjacent channels */
-	if (state->fe->dtv_property_cache.delivery_system == SYS_ISDBT) {
-		u16 value = dib0070_read_reg(state, 0x17);
-
-		dib0070_write_reg(state, 0x17, value & 0xfffc);
-		tmp = dib0070_read_reg(state, 0x01) & 0x01ff;
-		dib0070_write_reg(state, 0x01, tmp | (60 << 9));
-
-		dib0070_write_reg(state, 0x17, value);
-	}
+    struct dib0070_state *state = fe->tuner_priv;
+    u16 tmp = dib0070_read_reg(state, 0x02) & 0x3fff;
+
+    if (state->fe->dtv_property_cache.bandwidth_hz/1000 > 7000)
+	tmp |= (0 << 14);
+    else if (state->fe->dtv_property_cache.bandwidth_hz/1000 > 6000)
+	tmp |= (1 << 14);
+    else if (state->fe->dtv_property_cache.bandwidth_hz/1000 > 5000)
+	tmp |= (2 << 14);
+    else
+	tmp |= (3 << 14);
+
+    dib0070_write_reg(state, 0x02, tmp);
+
+    /* sharpen the BB filter in ISDB-T to have higher immunity to adjacent channels */
+    if (state->fe->dtv_property_cache.delivery_system == SYS_ISDBT) {
+	u16 value = dib0070_read_reg(state, 0x17);
+
+	dib0070_write_reg(state, 0x17, value & 0xfffc);
+	tmp = dib0070_read_reg(state, 0x01) & 0x01ff;
+	dib0070_write_reg(state, 0x01, tmp | (60 << 9));
+
+	dib0070_write_reg(state, 0x17, value);
+    }
 	return 0;
 }
 
@@ -160,14 +145,14 @@ static int dib0070_captrim(struct dib0070_state *state, enum frontend_tune_state
 	if (*tune_state == CT_TUNER_STEP_0) {
 
 		dib0070_write_reg(state, 0x0f, 0xed10);
-		dib0070_write_reg(state, 0x17, 0x0034);
+		dib0070_write_reg(state, 0x17,    0x0034);
 
 		dib0070_write_reg(state, 0x18, 0x0032);
 		state->step = state->captrim = state->fcaptrim = 64;
 		state->adc_diff = 3000;
 		ret = 20;
 
-		*tune_state = CT_TUNER_STEP_1;
+	*tune_state = CT_TUNER_STEP_1;
 	} else if (*tune_state == CT_TUNER_STEP_1) {
 		state->step /= 2;
 		dib0070_write_reg(state, 0x14, state->lo4 | state->captrim);
@@ -178,7 +163,7 @@ static int dib0070_captrim(struct dib0070_state *state, enum frontend_tune_state
 
 		adc = dib0070_read_reg(state, 0x19);
 
-		dprintk("CAPTRIM=%hd; ADC = %hd (ADC) & %dmV", state->captrim, adc, (u32) adc * (u32) 1800 / (u32) 1024);
+		dprintk("CAPTRIM=%hd; ADC = %hd (ADC) & %dmV", state->captrim, adc, (u32) adc*(u32)1800/(u32)1024);
 
 		if (adc >= 400) {
 			adc -= 400;
@@ -193,6 +178,8 @@ static int dib0070_captrim(struct dib0070_state *state, enum frontend_tune_state
 			state->adc_diff = adc;
 			state->fcaptrim = state->captrim;
 
+
+
 		}
 		state->captrim += (step_sign * state->step);
 
@@ -213,7 +200,7 @@ static int dib0070_captrim(struct dib0070_state *state, enum frontend_tune_state
 static int dib0070_set_ctrl_lo5(struct dvb_frontend *fe, u8 vco_bias_trim, u8 hf_div_trim, u8 cp_current, u8 third_order_filt)
 {
 	struct dib0070_state *state = fe->tuner_priv;
-	u16 lo5 = (third_order_filt << 14) | (0 << 13) | (1 << 12) | (3 << 9) | (cp_current << 6) | (hf_div_trim << 3) | (vco_bias_trim << 0);
+    u16 lo5 = (third_order_filt << 14) | (0 << 13) | (1 << 12) | (3 << 9) | (cp_current << 6) | (hf_div_trim << 3) | (vco_bias_trim << 0);
 	dprintk("CTRL_LO5: 0x%x", lo5);
 	return dib0070_write_reg(state, 0x15, lo5);
 }
@@ -227,99 +214,99 @@ void dib0070_ctrl_agc_filter(struct dvb_frontend *fe, u8 open)
 		dib0070_write_reg(state, 0x1a, 0x0000);
 	} else {
 		dib0070_write_reg(state, 0x1b, 0x4112);
-		if (state->cfg->vga_filter != 0) {
-			dib0070_write_reg(state, 0x1a, state->cfg->vga_filter);
-			dprintk("vga filter register is set to %x", state->cfg->vga_filter);
-		} else
-			dib0070_write_reg(state, 0x1a, 0x0009);
+	if (state->cfg->vga_filter != 0) {
+		dib0070_write_reg(state, 0x1a, state->cfg->vga_filter);
+		dprintk("vga filter register is set to %x", state->cfg->vga_filter);
+	} else
+		dib0070_write_reg(state, 0x1a, 0x0009);
 	}
 }
 
 EXPORT_SYMBOL(dib0070_ctrl_agc_filter);
 struct dib0070_tuning {
-	u32 max_freq;		/* for every frequency less than or equal to that field: this information is correct */
-	u8 switch_trim;
-	u8 vco_band;
-	u8 hfdiv;
-	u8 vco_multi;
-	u8 presc;
-	u8 wbdmux;
-	u16 tuner_enable;
+    u32 max_freq; /* for every frequency less than or equal to that field: this information is correct */
+    u8 switch_trim;
+    u8 vco_band;
+    u8 hfdiv;
+    u8 vco_multi;
+    u8 presc;
+    u8 wbdmux;
+    u16 tuner_enable;
 };
 
 struct dib0070_lna_match {
-	u32 max_freq;		/* for every frequency less than or equal to that field: this information is correct */
-	u8 lna_band;
+    u32 max_freq; /* for every frequency less than or equal to that field: this information is correct */
+    u8 lna_band;
 };
 
 static const struct dib0070_tuning dib0070s_tuning_table[] = {
-	{570000, 2, 1, 3, 6, 6, 2, 0x4000 | 0x0800},	/* UHF */
-	{700000, 2, 0, 2, 4, 2, 2, 0x4000 | 0x0800},
-	{863999, 2, 1, 2, 4, 2, 2, 0x4000 | 0x0800},
-	{1500000, 0, 1, 1, 2, 2, 4, 0x2000 | 0x0400},	/* LBAND */
-	{1600000, 0, 1, 1, 2, 2, 4, 0x2000 | 0x0400},
-	{2000000, 0, 1, 1, 2, 2, 4, 0x2000 | 0x0400},
-	{0xffffffff, 0, 0, 8, 1, 2, 1, 0x8000 | 0x1000},	/* SBAND */
+    {     570000, 2, 1, 3, 6, 6, 2, 0x4000 | 0x0800 }, /* UHF */
+    {     700000, 2, 0, 2, 4, 2, 2, 0x4000 | 0x0800 },
+    {     863999, 2, 1, 2, 4, 2, 2, 0x4000 | 0x0800 },
+    {    1500000, 0, 1, 1, 2, 2, 4, 0x2000 | 0x0400 }, /* LBAND */
+    {    1600000, 0, 1, 1, 2, 2, 4, 0x2000 | 0x0400 },
+    {    2000000, 0, 1, 1, 2, 2, 4, 0x2000 | 0x0400 },
+    { 0xffffffff, 0, 0, 8, 1, 2, 1, 0x8000 | 0x1000 }, /* SBAND */
 };
 
 static const struct dib0070_tuning dib0070_tuning_table[] = {
-	{115000, 1, 0, 7, 24, 2, 1, 0x8000 | 0x1000},	/* FM below 92MHz cannot be tuned */
-	{179500, 1, 0, 3, 16, 2, 1, 0x8000 | 0x1000},	/* VHF */
-	{189999, 1, 1, 3, 16, 2, 1, 0x8000 | 0x1000},
-	{250000, 1, 0, 6, 12, 2, 1, 0x8000 | 0x1000},
-	{569999, 2, 1, 5, 6, 2, 2, 0x4000 | 0x0800},	/* UHF */
-	{699999, 2, 0, 1, 4, 2, 2, 0x4000 | 0x0800},
-	{863999, 2, 1, 1, 4, 2, 2, 0x4000 | 0x0800},
-	{0xffffffff, 0, 1, 0, 2, 2, 4, 0x2000 | 0x0400},	/* LBAND or everything higher than UHF */
+    {     115000, 1, 0, 7, 24, 2, 1, 0x8000 | 0x1000 }, /* FM below 92MHz cannot be tuned */
+    {     179500, 1, 0, 3, 16, 2, 1, 0x8000 | 0x1000 }, /* VHF */
+    {     189999, 1, 1, 3, 16, 2, 1, 0x8000 | 0x1000 },
+    {     250000, 1, 0, 6, 12, 2, 1, 0x8000 | 0x1000 },
+    {     569999, 2, 1, 5,  6, 2, 2, 0x4000 | 0x0800 }, /* UHF */
+    {     699999, 2, 0, 1,  4, 2, 2, 0x4000 | 0x0800 },
+    {     863999, 2, 1, 1,  4, 2, 2, 0x4000 | 0x0800 },
+    { 0xffffffff, 0, 1, 0,  2, 2, 4, 0x2000 | 0x0400 }, /* LBAND or everything higher than UHF */
 };
 
 static const struct dib0070_lna_match dib0070_lna_flip_chip[] = {
-	{180000, 0},		/* VHF */
-	{188000, 1},
-	{196400, 2},
-	{250000, 3},
-	{550000, 0},		/* UHF */
-	{590000, 1},
-	{666000, 3},
-	{864000, 5},
-	{1500000, 0},		/* LBAND or everything higher than UHF */
-	{1600000, 1},
-	{2000000, 3},
-	{0xffffffff, 7},
+    {     180000, 0 }, /* VHF */
+    {     188000, 1 },
+    {     196400, 2 },
+    {     250000, 3 },
+    {     550000, 0 }, /* UHF */
+    {     590000, 1 },
+    {     666000, 3 },
+    {     864000, 5 },
+    {    1500000, 0 }, /* LBAND or everything higher than UHF */
+    {    1600000, 1 },
+    {    2000000, 3 },
+    { 0xffffffff, 7 },
 };
 
 static const struct dib0070_lna_match dib0070_lna[] = {
-	{180000, 0},		/* VHF */
-	{188000, 1},
-	{196400, 2},
-	{250000, 3},
-	{550000, 2},		/* UHF */
-	{650000, 3},
-	{750000, 5},
-	{850000, 6},
-	{864000, 7},
-	{1500000, 0},		/* LBAND or everything higher than UHF */
-	{1600000, 1},
-	{2000000, 3},
-	{0xffffffff, 7},
+    {     180000, 0 }, /* VHF */
+    {     188000, 1 },
+    {     196400, 2 },
+    {     250000, 3 },
+    {     550000, 2 }, /* UHF */
+    {     650000, 3 },
+    {     750000, 5 },
+    {     850000, 6 },
+    {     864000, 7 },
+    {    1500000, 0 }, /* LBAND or everything higher than UHF */
+    {    1600000, 1 },
+    {    2000000, 3 },
+    { 0xffffffff, 7 },
 };
 
-#define LPF	100		// define for the loop filter 100kHz by default 16-07-06
+#define LPF	100
 static int dib0070_tune_digital(struct dvb_frontend *fe, struct dvb_frontend_parameters *ch)
 {
-	struct dib0070_state *state = fe->tuner_priv;
+    struct dib0070_state *state = fe->tuner_priv;
 
-	const struct dib0070_tuning *tune;
-	const struct dib0070_lna_match *lna_match;
+    const struct dib0070_tuning *tune;
+    const struct dib0070_lna_match *lna_match;
 
-	enum frontend_tune_state *tune_state = &state->tune_state;
-	int ret = 10;		/* 1ms is the default delay most of the time */
+    enum frontend_tune_state *tune_state = &state->tune_state;
+    int ret = 10; /* 1ms is the default delay most of the time */
 
-	u8 band = (u8) BAND_OF_FREQUENCY(fe->dtv_property_cache.frequency / 1000);
-	u32 freq = fe->dtv_property_cache.frequency / 1000 + (band == BAND_VHF ? state->cfg->freq_offset_khz_vhf : state->cfg->freq_offset_khz_uhf);
+    u8  band = (u8)BAND_OF_FREQUENCY(fe->dtv_property_cache.frequency/1000);
+    u32 freq = fe->dtv_property_cache.frequency/1000 + (band == BAND_VHF ? state->cfg->freq_offset_khz_vhf : state->cfg->freq_offset_khz_uhf);
 
 #ifdef CONFIG_SYS_ISDBT
-	if (state->fe->dtv_property_cache.delivery_system == SYS_ISDBT && state->fe->dtv_property_cache.isdbt_sb_mode == 1)
+    if (state->fe->dtv_property_cache.delivery_system == SYS_ISDBT && state->fe->dtv_property_cache.isdbt_sb_mode == 1)
 		if (((state->fe->dtv_property_cache.isdbt_sb_segment_count % 2)
 		     && (state->fe->dtv_property_cache.isdbt_sb_segment_idx == ((state->fe->dtv_property_cache.isdbt_sb_segment_count / 2) + 1)))
 		    || (((state->fe->dtv_property_cache.isdbt_sb_segment_count % 2) == 0)
@@ -328,172 +315,180 @@ static int dib0070_tune_digital(struct dvb_frontend *fe, struct dvb_frontend_par
 			&& (state->fe->dtv_property_cache.isdbt_sb_segment_idx == ((state->fe->dtv_property_cache.isdbt_sb_segment_count / 2) + 1))))
 			freq += 850;
 #endif
+    if (state->current_rf != freq) {
+
+	switch (state->revision) {
+	case DIB0070S_P1A:
+	    tune = dib0070s_tuning_table;
+	    lna_match = dib0070_lna;
+	    break;
+	default:
+	    tune = dib0070_tuning_table;
+	    if (state->cfg->flip_chip)
+		lna_match = dib0070_lna_flip_chip;
+	    else
+		lna_match = dib0070_lna;
+	    break;
+	}
+	while (freq > tune->max_freq) /* find the right one */
+	    tune++;
+	while (freq > lna_match->max_freq) /* find the right one */
+	    lna_match++;
+
+	state->current_tune_table_index = tune;
+	state->lna_match = lna_match;
+    }
+
+    if (*tune_state == CT_TUNER_START) {
+	dprintk("Tuning for Band: %hd (%d kHz)", band, freq);
 	if (state->current_rf != freq) {
+		u8 REFDIV;
+		u32 FBDiv, Rest, FREF, VCOF_kHz;
+		u8 Den;
+
+		state->current_rf = freq;
+		state->lo4 = (state->current_tune_table_index->vco_band << 11) | (state->current_tune_table_index->hfdiv << 7);
+
+
+		dib0070_write_reg(state, 0x17, 0x30);
+
+
+		VCOF_kHz = state->current_tune_table_index->vco_multi * freq * 2;
+
+		switch (band) {
+		case BAND_VHF:
+			REFDIV = (u8) ((state->cfg->clock_khz + 9999) / 10000);
+			break;
+		case BAND_FM:
+			REFDIV = (u8) ((state->cfg->clock_khz) / 1000);
+			break;
+		default:
+			REFDIV = (u8) (state->cfg->clock_khz  / 10000);
+			break;
+		}
+		FREF = state->cfg->clock_khz / REFDIV;
+
+
 
 		switch (state->revision) {
 		case DIB0070S_P1A:
-			tune = dib0070s_tuning_table;
-			lna_match = dib0070_lna;
+			FBDiv = (VCOF_kHz / state->current_tune_table_index->presc / FREF);
+			Rest  = (VCOF_kHz / state->current_tune_table_index->presc) - FBDiv * FREF;
 			break;
+
+		case DIB0070_P1G:
+		case DIB0070_P1F:
 		default:
-			tune = dib0070_tuning_table;
-			if (state->cfg->flip_chip)
-				lna_match = dib0070_lna_flip_chip;
-			else
-				lna_match = dib0070_lna;
+			FBDiv = (freq / (FREF / 2));
+			Rest  = 2 * freq - FBDiv * FREF;
 			break;
 		}
-		while (freq > tune->max_freq)	/* find the right one */
-			tune++;
-		while (freq > lna_match->max_freq)	/* find the right one */
-			lna_match++;
 
-		state->current_tune_table_index = tune;
-		state->lna_match = lna_match;
-	}
+		if (Rest < LPF)
+			Rest = 0;
+		else if (Rest < 2 * LPF)
+			Rest = 2 * LPF;
+		else if (Rest > (FREF - LPF)) {
+			Rest = 0;
+			FBDiv += 1;
+		} else if (Rest > (FREF - 2 * LPF))
+			Rest = FREF - 2 * LPF;
+		Rest = (Rest * 6528) / (FREF / 10);
+
+		Den = 1;
+		if (Rest > 0) {
+			state->lo4 |= (1 << 14) | (1 << 12);
+			Den = 255;
+		}
+
 
-	if (*tune_state == CT_TUNER_START) {
-		dprintk("Tuning for Band: %hd (%d kHz)", band, freq);
-		if (state->current_rf != freq) {
-			u8 REFDIV;
-			u32 FBDiv, Rest, FREF, VCOF_kHz;
-			u8 Den;
-
-			state->current_rf = freq;
-			state->lo4 = (state->current_tune_table_index->vco_band << 11) | (state->current_tune_table_index->hfdiv << 7);
-
-			dib0070_write_reg(state, 0x17, 0x30);
-
-			VCOF_kHz = state->current_tune_table_index->vco_multi * freq * 2;
-
-			switch (band) {
-			case BAND_VHF:
-				REFDIV = (u8) ((state->cfg->clock_khz + 9999) / 10000);
-				break;
-			case BAND_FM:
-				REFDIV = (u8) ((state->cfg->clock_khz) / 1000);
-				break;
-			default:
-				REFDIV = (u8) (state->cfg->clock_khz / 10000);
-				break;
-			}
-			FREF = state->cfg->clock_khz / REFDIV;
-
-			switch (state->revision) {
-			case DIB0070S_P1A:
-				FBDiv = (VCOF_kHz / state->current_tune_table_index->presc / FREF);
-				Rest = (VCOF_kHz / state->current_tune_table_index->presc) - FBDiv * FREF;
-				break;
-
-			case DIB0070_P1G:
-			case DIB0070_P1F:
-			default:
-				FBDiv = (freq / (FREF / 2));
-				Rest = 2 * freq - FBDiv * FREF;
-				break;
-			}
-
-			if (Rest < LPF)
-				Rest = 0;
-			else if (Rest < 2 * LPF)
-				Rest = 2 * LPF;
-			else if (Rest > (FREF - LPF)) {
-				Rest = 0;
-				FBDiv += 1;
-			} else if (Rest > (FREF - 2 * LPF))
-				Rest = FREF - 2 * LPF;
-			Rest = (Rest * 6528) / (FREF / 10);
-
-			Den = 1;
-			if (Rest > 0) {
-				state->lo4 |= (1 << 14) | (1 << 12);
-				Den = 255;
-			}
-
-			dib0070_write_reg(state, 0x11, (u16) FBDiv);
-			dib0070_write_reg(state, 0x12, (Den << 8) | REFDIV);
-			dib0070_write_reg(state, 0x13, (u16) Rest);
-
-			if (state->revision == DIB0070S_P1A) {
-
-				if (band == BAND_SBAND) {
-					dib0070_set_ctrl_lo5(fe, 2, 4, 3, 0);
-					dib0070_write_reg(state, 0x1d, 0xFFFF);
-				} else
-					dib0070_set_ctrl_lo5(fe, 5, 4, 3, 1);
-			}
-
-			dib0070_write_reg(state, 0x20,
-					  0x0040 | 0x0020 | 0x0010 | 0x0008 | 0x0002 | 0x0001 | state->current_tune_table_index->tuner_enable);
-
-			dprintk("REFDIV: %hd, FREF: %d", REFDIV, FREF);
-			dprintk("FBDIV: %d, Rest: %d", FBDiv, Rest);
-			dprintk("Num: %hd, Den: %hd, SD: %hd", (u16) Rest, Den, (state->lo4 >> 12) & 0x1);
-			dprintk("HFDIV code: %hd", state->current_tune_table_index->hfdiv);
-			dprintk("VCO = %hd", state->current_tune_table_index->vco_band);
-			dprintk("VCOF: ((%hd*%d) << 1))", state->current_tune_table_index->vco_multi, freq);
-
-			*tune_state = CT_TUNER_STEP_0;
-		} else {	/* we are already tuned to this frequency - the configuration is correct  */
-			ret = 50;	/* wakeup time */
-			*tune_state = CT_TUNER_STEP_5;
+		dib0070_write_reg(state, 0x11, (u16)FBDiv);
+		dib0070_write_reg(state, 0x12, (Den << 8) | REFDIV);
+		dib0070_write_reg(state, 0x13, (u16) Rest);
+
+		if (state->revision == DIB0070S_P1A) {
+
+			if (band == BAND_SBAND) {
+				dib0070_set_ctrl_lo5(fe, 2, 4, 3, 0);
+				dib0070_write_reg(state, 0x1d, 0xFFFF);
+			} else
+				dib0070_set_ctrl_lo5(fe, 5, 4, 3, 1);
 		}
-	} else if ((*tune_state > CT_TUNER_START) && (*tune_state < CT_TUNER_STEP_4)) {
 
-		ret = dib0070_captrim(state, tune_state);
+		dib0070_write_reg(state, 0x20,
+			0x0040 | 0x0020 | 0x0010 | 0x0008 | 0x0002 | 0x0001 | state->current_tune_table_index->tuner_enable);
 
-	} else if (*tune_state == CT_TUNER_STEP_4) {
-		const struct dib0070_wbd_gain_cfg *tmp = state->cfg->wbd_gain;
-		if (tmp != NULL) {
-			while (freq / 1000 > tmp->freq)	/* find the right one */
-				tmp++;
-			dib0070_write_reg(state, 0x0f,
-					  (0 << 15) | (1 << 14) | (3 << 12) | (tmp->wbd_gain_val << 9) | (0 << 8) | (1 << 7) | (state->
-																current_tune_table_index->
-																wbdmux << 0));
-			state->wbd_gain_current = tmp->wbd_gain_val;
-		} else {
+		dprintk("REFDIV: %hd, FREF: %d", REFDIV, FREF);
+		dprintk("FBDIV: %d, Rest: %d", FBDiv, Rest);
+		dprintk("Num: %hd, Den: %hd, SD: %hd", (u16) Rest, Den, (state->lo4 >> 12) & 0x1);
+		dprintk("HFDIV code: %hd", state->current_tune_table_index->hfdiv);
+		dprintk("VCO = %hd", state->current_tune_table_index->vco_band);
+		dprintk("VCOF: ((%hd*%d) << 1))", state->current_tune_table_index->vco_multi, freq);
+
+		*tune_state = CT_TUNER_STEP_0;
+	} else { /* we are already tuned to this frequency - the configuration is correct  */
+		ret = 50; /* wakeup time */
+		*tune_state = CT_TUNER_STEP_5;
+	}
+    } else if ((*tune_state > CT_TUNER_START) && (*tune_state < CT_TUNER_STEP_4)) {
+
+	ret = dib0070_captrim(state, tune_state);
+
+    } else if (*tune_state == CT_TUNER_STEP_4) {
+	const struct dib0070_wbd_gain_cfg *tmp = state->cfg->wbd_gain;
+	if (tmp != NULL) {
+		while (freq/1000 > tmp->freq) /* find the right one */
+			tmp++;
+		dib0070_write_reg(state, 0x0f,
+			(0 << 15) | (1 << 14) | (3 << 12)
+			| (tmp->wbd_gain_val << 9) | (0 << 8) | (1 << 7)
+			| (state->current_tune_table_index->wbdmux << 0));
+		state->wbd_gain_current = tmp->wbd_gain_val;
+	} else {
 			dib0070_write_reg(state, 0x0f,
 					  (0 << 15) | (1 << 14) | (3 << 12) | (6 << 9) | (0 << 8) | (1 << 7) | (state->current_tune_table_index->
 														wbdmux << 0));
-			state->wbd_gain_current = 6;
-		}
+	    state->wbd_gain_current = 6;
+	}
 
-		dib0070_write_reg(state, 0x06, 0x3fff);
+	dib0070_write_reg(state, 0x06, 0x3fff);
 		dib0070_write_reg(state, 0x07,
 				  (state->current_tune_table_index->switch_trim << 11) | (7 << 8) | (state->lna_match->lna_band << 3) | (3 << 0));
-		dib0070_write_reg(state, 0x08, (state->lna_match->lna_band << 10) | (3 << 7) | (127));
-		dib0070_write_reg(state, 0x0d, 0x0d80);
+	dib0070_write_reg(state, 0x08, (state->lna_match->lna_band << 10) | (3 << 7) | (127));
+	dib0070_write_reg(state, 0x0d, 0x0d80);
 
-		dib0070_write_reg(state, 0x18, 0x07ff);
-		dib0070_write_reg(state, 0x17, 0x0033);
 
-		*tune_state = CT_TUNER_STEP_5;
-	} else if (*tune_state == CT_TUNER_STEP_5) {
-		dib0070_set_bandwidth(fe, ch);
-		*tune_state = CT_TUNER_STOP;
-	} else {
-		ret = FE_CALLBACK_TIME_NEVER;	/* tuner finished, time to call again infinite */
-	}
-	return ret;
+	dib0070_write_reg(state, 0x18,   0x07ff);
+	dib0070_write_reg(state, 0x17, 0x0033);
+
+
+	*tune_state = CT_TUNER_STEP_5;
+    } else if (*tune_state == CT_TUNER_STEP_5) {
+	dib0070_set_bandwidth(fe, ch);
+	*tune_state = CT_TUNER_STOP;
+    } else {
+	ret = FE_CALLBACK_TIME_NEVER; /* tuner finished, time to call again infinite */
+    }
+    return ret;
 }
 
+
 static int dib0070_tune(struct dvb_frontend *fe, struct dvb_frontend_parameters *p)
 {
-	struct dib0070_state *state = fe->tuner_priv;
-	uint32_t ret;
+    struct dib0070_state *state = fe->tuner_priv;
+    uint32_t ret;
 
-	state->tune_state = CT_TUNER_START;
+    state->tune_state = CT_TUNER_START;
 
-	do {
-		ret = dib0070_tune_digital(fe, p);
-		if (ret != FE_CALLBACK_TIME_NEVER)
-			msleep(ret / 10);
-		else
-			break;
-	} while (state->tune_state != CT_TUNER_STOP);
+    do {
+	ret = dib0070_tune_digital(fe, p);
+	if (ret != FE_CALLBACK_TIME_NEVER)
+		msleep(ret/10);
+	else
+	    break;
+    } while (state->tune_state != CT_TUNER_STOP);
 
-	return 0;
+    return 0;
 }
 
 static int dib0070_wakeup(struct dvb_frontend *fe)
@@ -512,92 +507,113 @@ static int dib0070_sleep(struct dvb_frontend *fe)
 	return 0;
 }
 
-static const u16 dib0070_p1f_defaults[] = {
+u8 dib0070_get_rf_output(struct dvb_frontend *fe)
+{
+	struct dib0070_state *state = fe->tuner_priv;
+	return (dib0070_read_reg(state, 0x07) >> 11) & 0x3;
+}
+EXPORT_SYMBOL(dib0070_get_rf_output);
+
+int dib0070_set_rf_output(struct dvb_frontend *fe, u8 no)
+{
+	struct dib0070_state *state = fe->tuner_priv;
+	u16 rxrf2 = dib0070_read_reg(state, 0x07) & 0xfe7ff;
+	if (no > 3)
+		no = 3;
+	if (no < 1)
+		no = 1;
+	return dib0070_write_reg(state, 0x07, rxrf2 | (no << 11));
+}
+EXPORT_SYMBOL(dib0070_set_rf_output);
+
+static const u16 dib0070_p1f_defaults[] =
+
+{
 	7, 0x02,
-	0x0008,
-	0x0000,
-	0x0000,
-	0x0000,
-	0x0000,
-	0x0002,
-	0x0100,
+		0x0008,
+		0x0000,
+		0x0000,
+		0x0000,
+		0x0000,
+		0x0002,
+		0x0100,
 
 	3, 0x0d,
-	0x0d80,
-	0x0001,
-	0x0000,
+		0x0d80,
+		0x0001,
+		0x0000,
 
 	4, 0x11,
-	0x0000,
-	0x0103,
-	0x0000,
-	0x0000,
+		0x0000,
+		0x0103,
+		0x0000,
+		0x0000,
 
 	3, 0x16,
-	0x0004 | 0x0040,
-	0x0030,
-	0x07ff,
+		0x0004 | 0x0040,
+		0x0030,
+		0x07ff,
 
 	6, 0x1b,
-	0x4112,
-	0xff00,
-	0xc07f,
-	0x0000,
-	0x0180,
-	0x4000 | 0x0800 | 0x0040 | 0x0020 | 0x0010 | 0x0008 | 0x0002 | 0x0001,
+		0x4112,
+		0xff00,
+		0xc07f,
+		0x0000,
+		0x0180,
+		0x4000 | 0x0800 | 0x0040 | 0x0020 | 0x0010 | 0x0008 | 0x0002 | 0x0001,
 
 	0,
 };
 
 static u16 dib0070_read_wbd_offset(struct dib0070_state *state, u8 gain)
 {
-	u16 tuner_en = dib0070_read_reg(state, 0x20);
-	u16 offset;
-
-	dib0070_write_reg(state, 0x18, 0x07ff);
-	dib0070_write_reg(state, 0x20, 0x0800 | 0x4000 | 0x0040 | 0x0020 | 0x0010 | 0x0008 | 0x0002 | 0x0001);
-	dib0070_write_reg(state, 0x0f, (1 << 14) | (2 << 12) | (gain << 9) | (1 << 8) | (1 << 7) | (0 << 0));
-	msleep(9);
-	offset = dib0070_read_reg(state, 0x19);
-	dib0070_write_reg(state, 0x20, tuner_en);
-	return offset;
+    u16 tuner_en = dib0070_read_reg(state, 0x20);
+    u16 offset;
+
+    dib0070_write_reg(state, 0x18, 0x07ff);
+    dib0070_write_reg(state, 0x20, 0x0800 | 0x4000 | 0x0040 | 0x0020 | 0x0010 | 0x0008 | 0x0002 | 0x0001);
+    dib0070_write_reg(state, 0x0f, (1 << 14) | (2 << 12) | (gain << 9) | (1 << 8) | (1 << 7) | (0 << 0));
+    msleep(9);
+    offset = dib0070_read_reg(state, 0x19);
+    dib0070_write_reg(state, 0x20, tuner_en);
+    return offset;
 }
 
 static void dib0070_wbd_offset_calibration(struct dib0070_state *state)
 {
-	u8 gain;
-	for (gain = 6; gain < 8; gain++) {
-		state->wbd_offset_3_3[gain - 6] = ((dib0070_read_wbd_offset(state, gain) * 8 * 18 / 33 + 1) / 2);
-		dprintk("Gain: %d, WBDOffset (3.3V) = %hd", gain, state->wbd_offset_3_3[gain - 6]);
-	}
+    u8 gain;
+    for (gain = 6; gain < 8; gain++) {
+	state->wbd_offset_3_3[gain - 6] = ((dib0070_read_wbd_offset(state, gain) * 8 * 18 / 33 + 1) / 2);
+	dprintk("Gain: %d, WBDOffset (3.3V) = %hd", gain, state->wbd_offset_3_3[gain-6]);
+    }
 }
 
 u16 dib0070_wbd_offset(struct dvb_frontend *fe)
 {
-	struct dib0070_state *state = fe->tuner_priv;
-	const struct dib0070_wbd_gain_cfg *tmp = state->cfg->wbd_gain;
-	u32 freq = fe->dtv_property_cache.frequency / 1000;
-
-	if (tmp != NULL) {
-		while (freq / 1000 > tmp->freq)	/* find the right one */
-			tmp++;
-		state->wbd_gain_current = tmp->wbd_gain_val;
+    struct dib0070_state *state = fe->tuner_priv;
+    const struct dib0070_wbd_gain_cfg *tmp = state->cfg->wbd_gain;
+    u32 freq = fe->dtv_property_cache.frequency/1000;
+
+    if (tmp != NULL) {
+	while (freq/1000 > tmp->freq) /* find the right one */
+	    tmp++;
+	state->wbd_gain_current = tmp->wbd_gain_val;
 	} else
-		state->wbd_gain_current = 6;
+	state->wbd_gain_current = 6;
 
-	return state->wbd_offset_3_3[state->wbd_gain_current - 6];
+    return state->wbd_offset_3_3[state->wbd_gain_current - 6];
 }
-
 EXPORT_SYMBOL(dib0070_wbd_offset);
 
 #define pgm_read_word(w) (*w)
 static int dib0070_reset(struct dvb_frontend *fe)
 {
-	struct dib0070_state *state = fe->tuner_priv;
+    struct dib0070_state *state = fe->tuner_priv;
 	u16 l, r, *n;
 
 	HARD_RESET(state);
 
+
 #ifndef FORCE_SBAND_TUNER
 	if ((dib0070_read_reg(state, 0x22) >> 9) & 0x1)
 		state->revision = (dib0070_read_reg(state, 0x1f) >> 8) & 0xff;
@@ -605,7 +621,7 @@ static int dib0070_reset(struct dvb_frontend *fe)
 #else
 #warning forcing SBAND
 #endif
-	state->revision = DIB0070S_P1A;
+		state->revision = DIB0070S_P1A;
 
 	/* P1F or not */
 	dprintk("Revision: %x", state->revision);
@@ -620,7 +636,7 @@ static int dib0070_reset(struct dvb_frontend *fe)
 	while (l) {
 		r = pgm_read_word(n++);
 		do {
-			dib0070_write_reg(state, (u8) r, pgm_read_word(n++));
+			dib0070_write_reg(state, (u8)r, pgm_read_word(n++));
 			r++;
 		} while (--l);
 		l = pgm_read_word(n++);
@@ -633,6 +649,7 @@ static int dib0070_reset(struct dvb_frontend *fe)
 	else
 		r = 2;
 
+
 	r |= state->cfg->osc_buffer_state << 3;
 
 	dib0070_write_reg(state, 0x10, r);
@@ -643,16 +660,24 @@ static int dib0070_reset(struct dvb_frontend *fe)
 		dib0070_write_reg(state, 0x02, r | (1 << 5));
 	}
 
-	if (state->revision == DIB0070S_P1A)
-		dib0070_set_ctrl_lo5(fe, 2, 4, 3, 0);
-	else
+    if (state->revision == DIB0070S_P1A)
+	dib0070_set_ctrl_lo5(fe, 2, 4, 3, 0);
+    else
 		dib0070_set_ctrl_lo5(fe, 5, 4, state->cfg->charge_pump, state->cfg->enable_third_order_filter);
 
 	dib0070_write_reg(state, 0x01, (54 << 9) | 0xc8);
 
-	dib0070_wbd_offset_calibration(state);
+    dib0070_wbd_offset_calibration(state);
 
-	return 0;
+    return 0;
+}
+
+static int dib0070_get_frequency(struct dvb_frontend *fe, u32 *frequency)
+{
+    struct dib0070_state *state = fe->tuner_priv;
+
+    *frequency = 1000 * state->current_rf;
+    return 0;
 }
 
 static int dib0070_release(struct dvb_frontend *fe)
@@ -664,18 +689,18 @@ static int dib0070_release(struct dvb_frontend *fe)
 
 static const struct dvb_tuner_ops dib0070_ops = {
 	.info = {
-		 .name = "DiBcom DiB0070",
-		 .frequency_min = 45000000,
-		 .frequency_max = 860000000,
-		 .frequency_step = 1000,
-		 },
-	.release = dib0070_release,
-
-	.init = dib0070_wakeup,
-	.sleep = dib0070_sleep,
-	.set_params = dib0070_tune,
-
-//      .get_frequency = dib0070_get_frequency,
+		.name           = "DiBcom DiB0070",
+		.frequency_min  =  45000000,
+		.frequency_max  = 860000000,
+		.frequency_step =      1000,
+	},
+	.release       = dib0070_release,
+
+	.init          = dib0070_wakeup,
+	.sleep         = dib0070_sleep,
+	.set_params    = dib0070_tune,
+
+	.get_frequency = dib0070_get_frequency,
 //      .get_bandwidth = dib0070_get_bandwidth
 };
 
@@ -687,7 +712,7 @@ struct dvb_frontend *dib0070_attach(struct dvb_frontend *fe, struct i2c_adapter
 
 	state->cfg = cfg;
 	state->i2c = i2c;
-	state->fe = fe;
+	state->fe  = fe;
 	fe->tuner_priv = state;
 
 	if (dib0070_reset(fe) != 0)
@@ -699,12 +724,11 @@ struct dvb_frontend *dib0070_attach(struct dvb_frontend *fe, struct i2c_adapter
 	fe->tuner_priv = state;
 	return fe;
 
- free_mem:
+free_mem:
 	kfree(state);
 	fe->tuner_priv = NULL;
 	return NULL;
 }
-
 EXPORT_SYMBOL(dib0070_attach);
 
 MODULE_AUTHOR("Patrick Boettcher <pboettcher@dibcom.fr>");
diff --git a/drivers/media/dvb/frontends/dib0070.h b/drivers/media/dvb/frontends/dib0070.h
index eec9e52ffa75..45c31fae3967 100644
--- a/drivers/media/dvb/frontends/dib0070.h
+++ b/drivers/media/dvb/frontends/dib0070.h
@@ -52,6 +52,8 @@ struct dib0070_config {
 extern struct dvb_frontend *dib0070_attach(struct dvb_frontend *fe, struct i2c_adapter *i2c, struct dib0070_config *cfg);
 extern u16 dib0070_wbd_offset(struct dvb_frontend *);
 extern void dib0070_ctrl_agc_filter(struct dvb_frontend *, u8 open);
+extern u8 dib0070_get_rf_output(struct dvb_frontend *fe);
+extern int dib0070_set_rf_output(struct dvb_frontend *fe, u8 no);
 #else
 static inline struct dvb_frontend *dib0070_attach(struct dvb_frontend *fe, struct i2c_adapter *i2c, struct dib0070_config *cfg)
 {
@@ -62,7 +64,7 @@ static inline struct dvb_frontend *dib0070_attach(struct dvb_frontend *fe, struc
 static inline u16 dib0070_wbd_offset(struct dvb_frontend *fe)
 {
 	printk(KERN_WARNING "%s: driver disabled by Kconfig\n", __func__);
-	return -ENODEV;
+	return 0;
 }
 
 static inline void dib0070_ctrl_agc_filter(struct dvb_frontend *fe, u8 open)
diff --git a/drivers/media/dvb/frontends/dib0090.c b/drivers/media/dvb/frontends/dib0090.c
new file mode 100644
index 000000000000..614552709a6f
--- /dev/null
+++ b/drivers/media/dvb/frontends/dib0090.c
@@ -0,0 +1,1522 @@
+/*
+ * Linux-DVB Driver for DiBcom's DiB0090 base-band RF Tuner.
+ *
+ * Copyright (C) 2005-9 DiBcom (http://www.dibcom.fr/)
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ *
+ *
+ * This code is more or less generated from another driver, please
+ * excuse some codingstyle oddities.
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/i2c.h>
+
+#include "dvb_frontend.h"
+
+#include "dib0090.h"
+#include "dibx000_common.h"
+
+static int debug;
+module_param(debug, int, 0644);
+MODULE_PARM_DESC(debug, "turn on debugging (default: 0)");
+
+#define dprintk(args...) do { \
+	if (debug) { \
+		printk(KERN_DEBUG "DiB0090: "); \
+		printk(args); \
+		printk("\n"); \
+	} \
+} while (0)
+
+#define CONFIG_SYS_ISDBT
+#define CONFIG_BAND_CBAND
+#define CONFIG_BAND_VHF
+#define CONFIG_BAND_UHF
+#define CONFIG_DIB0090_USE_PWM_AGC
+
+#define EN_LNA0      0x8000
+#define EN_LNA1      0x4000
+#define EN_LNA2      0x2000
+#define EN_LNA3      0x1000
+#define EN_MIX0      0x0800
+#define EN_MIX1      0x0400
+#define EN_MIX2      0x0200
+#define EN_MIX3      0x0100
+#define EN_IQADC     0x0040
+#define EN_PLL       0x0020
+#define EN_TX        0x0010
+#define EN_BB        0x0008
+#define EN_LO        0x0004
+#define EN_BIAS      0x0001
+
+#define EN_IQANA     0x0002
+#define EN_DIGCLK    0x0080	/* not in the 0x24 reg, only in 0x1b */
+#define EN_CRYSTAL   0x0002
+
+#define EN_UHF		 0x22E9
+#define EN_VHF		 0x44E9
+#define EN_LBD		 0x11E9
+#define EN_SBD		 0x44E9
+#define EN_CAB		 0x88E9
+
+#define pgm_read_word(w) (*w)
+
+struct dc_calibration;
+
+struct dib0090_tuning {
+	u32 max_freq;		/* for every frequency less than or equal to that field: this information is correct */
+	u8 switch_trim;
+	u8 lna_tune;
+	u8 lna_bias;
+	u16 v2i;
+	u16 mix;
+	u16 load;
+	u16 tuner_enable;
+};
+
+struct dib0090_pll {
+	u32 max_freq;		/* for every frequency less than or equal to that field: this information is correct */
+	u8 vco_band;
+	u8 hfdiv_code;
+	u8 hfdiv;
+	u8 topresc;
+};
+
+struct dib0090_state {
+	struct i2c_adapter *i2c;
+	struct dvb_frontend *fe;
+	const struct dib0090_config *config;
+
+	u8 current_band;
+	u16 revision;
+	enum frontend_tune_state tune_state;
+	u32 current_rf;
+
+	u16 wbd_offset;
+	s16 wbd_target;		/* in dB */
+
+	s16 rf_gain_limit;	/* take-over-point: where to split between bb and rf gain */
+	s16 current_gain;	/* keeps the currently programmed gain */
+	u8 agc_step;		/* new binary search */
+
+	u16 gain[2];		/* for channel monitoring */
+
+	const u16 *rf_ramp;
+	const u16 *bb_ramp;
+
+	/* for the software AGC ramps */
+	u16 bb_1_def;
+	u16 rf_lt_def;
+	u16 gain_reg[4];
+
+	/* for the captrim/dc-offset search */
+	s8 step;
+	s16 adc_diff;
+	s16 min_adc_diff;
+
+	s8 captrim;
+	s8 fcaptrim;
+
+	const struct dc_calibration *dc;
+	u16 bb6, bb7;
+
+	const struct dib0090_tuning *current_tune_table_index;
+	const struct dib0090_pll *current_pll_table_index;
+
+	u8 tuner_is_tuned;
+	u8 agc_freeze;
+
+	u8 reset;
+};
+
+static u16 dib0090_read_reg(struct dib0090_state *state, u8 reg)
+{
+	u8 b[2];
+	struct i2c_msg msg[2] = {
+		{.addr = state->config->i2c_address, .flags = 0, .buf = &reg, .len = 1},
+		{.addr = state->config->i2c_address, .flags = I2C_M_RD, .buf = b, .len = 2},
+	};
+	if (i2c_transfer(state->i2c, msg, 2) != 2) {
+		printk(KERN_WARNING "DiB0090 I2C read failed\n");
+		return 0;
+	}
+	return (b[0] << 8) | b[1];
+}
+
+static int dib0090_write_reg(struct dib0090_state *state, u32 reg, u16 val)
+{
+	u8 b[3] = { reg & 0xff, val >> 8, val & 0xff };
+	struct i2c_msg msg = {.addr = state->config->i2c_address, .flags = 0, .buf = b, .len = 3 };
+	if (i2c_transfer(state->i2c, &msg, 1) != 1) {
+		printk(KERN_WARNING "DiB0090 I2C write failed\n");
+		return -EREMOTEIO;
+	}
+	return 0;
+}
+
+#define HARD_RESET(state) do {  if (cfg->reset) {  if (cfg->sleep) cfg->sleep(fe, 0); msleep(10);  cfg->reset(fe, 1); msleep(10);  cfg->reset(fe, 0); msleep(10);  }  } while (0)
+#define ADC_TARGET -220
+#define GAIN_ALPHA 5
+#define WBD_ALPHA 6
+#define LPF	100
+static void dib0090_write_regs(struct dib0090_state *state, u8 r, const u16 * b, u8 c)
+{
+	do {
+		dib0090_write_reg(state, r++, *b++);
+	} while (--c);
+}
+
+static u16 dib0090_identify(struct dvb_frontend *fe)
+{
+	struct dib0090_state *state = fe->tuner_priv;
+	u16 v;
+
+	v = dib0090_read_reg(state, 0x1a);
+
+#ifdef FIRMWARE_FIREFLY
+	/* pll is not locked locked */
+	if (!(v & 0x800))
+		dprintk("FE%d : Identification : pll is not yet locked", fe->id);
+#endif
+
+	/* without PLL lock info */
+	v &= 0x3ff;
+	dprintk("P/V: %04x:", v);
+
+	if ((v >> 8) & 0xf)
+		dprintk("FE%d : Product ID = 0x%x : KROSUS", fe->id, (v >> 8) & 0xf);
+	else
+		return 0xff;
+
+	v &= 0xff;
+	if (((v >> 5) & 0x7) == 0x1)
+		dprintk("FE%d : MP001 : 9090/8096", fe->id);
+	else if (((v >> 5) & 0x7) == 0x4)
+		dprintk("FE%d : MP005 : Single Sband", fe->id);
+	else if (((v >> 5) & 0x7) == 0x6)
+		dprintk("FE%d : MP008 : diversity VHF-UHF-LBAND", fe->id);
+	else if (((v >> 5) & 0x7) == 0x7)
+		dprintk("FE%d : MP009 : diversity 29098 CBAND-UHF-LBAND-SBAND", fe->id);
+	else
+		return 0xff;
+
+	/* revision only */
+	if ((v & 0x1f) == 0x3)
+		dprintk("FE%d : P1-D/E/F detected", fe->id);
+	else if ((v & 0x1f) == 0x1)
+		dprintk("FE%d : P1C detected", fe->id);
+	else if ((v & 0x1f) == 0x0) {
+#ifdef CONFIG_TUNER_DIB0090_P1B_SUPPORT
+		dprintk("FE%d : P1-A/B detected: using previous driver - support will be removed soon", fe->id);
+		dib0090_p1b_register(fe);
+#else
+		dprintk("FE%d : P1-A/B detected: driver is deactivated - not available", fe->id);
+		return 0xff;
+#endif
+	}
+
+	return v;
+}
+
+static void dib0090_reset_digital(struct dvb_frontend *fe, const struct dib0090_config *cfg)
+{
+	struct dib0090_state *state = fe->tuner_priv;
+
+	HARD_RESET(state);
+
+	dib0090_write_reg(state, 0x24, EN_PLL);
+	dib0090_write_reg(state, 0x1b, EN_DIGCLK | EN_PLL | EN_CRYSTAL);	/* PLL, DIG_CLK and CRYSTAL remain */
+
+	/* adcClkOutRatio=8->7, release reset */
+	dib0090_write_reg(state, 0x20, ((cfg->io.adc_clock_ratio - 1) << 11) | (0 << 10) | (1 << 9) | (1 << 8) | (0 << 4) | 0);
+	if (cfg->clkoutdrive != 0)
+		dib0090_write_reg(state, 0x23,
+				  (0 << 15) | ((!cfg->analog_output) << 14) | (1 << 10) | (1 << 9) | (0 << 8) | (cfg->clkoutdrive << 5) | (cfg->
+																	   clkouttobamse
+																	   << 4) | (0
+																		    <<
+																		    2)
+				  | (0));
+	else
+		dib0090_write_reg(state, 0x23,
+				  (0 << 15) | ((!cfg->analog_output) << 14) | (1 << 10) | (1 << 9) | (0 << 8) | (7 << 5) | (cfg->
+															    clkouttobamse << 4) | (0
+																		   <<
+																		   2)
+				  | (0));
+
+	/* enable pll, de-activate reset, ratio: 2/1 = 60MHz */
+	dib0090_write_reg(state, 0x21,
+			  (cfg->io.pll_bypass << 15) | (1 << 13) | (cfg->io.pll_range << 12) | (cfg->io.pll_loopdiv << 6) | (cfg->io.pll_prediv));
+
+}
+
+static int dib0090_wakeup(struct dvb_frontend *fe)
+{
+	struct dib0090_state *state = fe->tuner_priv;
+	if (state->config->sleep)
+		state->config->sleep(fe, 0);
+	return 0;
+}
+
+static int dib0090_sleep(struct dvb_frontend *fe)
+{
+	struct dib0090_state *state = fe->tuner_priv;
+	if (state->config->sleep)
+		state->config->sleep(fe, 1);
+	return 0;
+}
+
+extern void dib0090_dcc_freq(struct dvb_frontend *fe, u8 fast)
+{
+	struct dib0090_state *state = fe->tuner_priv;
+	if (fast)
+		dib0090_write_reg(state, 0x04, 0);
+	else
+		dib0090_write_reg(state, 0x04, 1);
+}
+EXPORT_SYMBOL(dib0090_dcc_freq);
+
+static const u16 rf_ramp_pwm_cband[] = {
+	0,			/* max RF gain in 10th of dB */
+	0,			/* ramp_slope = 1dB of gain -> clock_ticks_per_db = clk_khz / ramp_slope -> 0x2b */
+	0,			/* ramp_max = maximum X used on the ramp */
+	(0 << 10) | 0,		/* 0x2c, LNA 1 = 0dB */
+	(0 << 10) | 0,		/* 0x2d, LNA 1 */
+	(0 << 10) | 0,		/* 0x2e, LNA 2 = 0dB */
+	(0 << 10) | 0,		/* 0x2f, LNA 2 */
+	(0 << 10) | 0,		/* 0x30, LNA 3 = 0dB */
+	(0 << 10) | 0,		/* 0x31, LNA 3 */
+	(0 << 10) | 0,		/* GAIN_4_1, LNA 4 = 0dB */
+	(0 << 10) | 0,		/* GAIN_4_2, LNA 4 */
+};
+
+static const u16 rf_ramp_vhf[] = {
+	412,			/* max RF gain in 10th of dB */
+	132, 307, 127,		/* LNA1,  13.2dB */
+	105, 412, 255,		/* LNA2,  10.5dB */
+	50, 50, 127,		/* LNA3,  5dB */
+	125, 175, 127,		/* LNA4,  12.5dB */
+	0, 0, 127,		/* CBAND, 0dB */
+};
+
+static const u16 rf_ramp_uhf[] = {
+	412,			/* max RF gain in 10th of dB */
+	132, 307, 127,		/* LNA1  : total gain = 13.2dB, point on the ramp where this amp is full gain, value to write to get full gain */
+	105, 412, 255,		/* LNA2  : 10.5 dB */
+	50, 50, 127,		/* LNA3  :  5.0 dB */
+	125, 175, 127,		/* LNA4  : 12.5 dB */
+	0, 0, 127,		/* CBAND :  0.0 dB */
+};
+
+static const u16 rf_ramp_cband[] = {
+	332,			/* max RF gain in 10th of dB */
+	132, 252, 127,		/* LNA1,  dB */
+	80, 332, 255,		/* LNA2,  dB */
+	0, 0, 127,		/* LNA3,  dB */
+	0, 0, 127,		/* LNA4,  dB */
+	120, 120, 127,		/* LT1 CBAND */
+};
+
+static const u16 rf_ramp_pwm_vhf[] = {
+	404,			/* max RF gain in 10th of dB */
+	25,			/* ramp_slope = 1dB of gain -> clock_ticks_per_db = clk_khz / ramp_slope -> 0x2b */
+	1011,			/* ramp_max = maximum X used on the ramp */
+	(6 << 10) | 417,	/* 0x2c, LNA 1 = 13.2dB */
+	(0 << 10) | 756,	/* 0x2d, LNA 1 */
+	(16 << 10) | 756,	/* 0x2e, LNA 2 = 10.5dB */
+	(0 << 10) | 1011,	/* 0x2f, LNA 2 */
+	(16 << 10) | 290,	/* 0x30, LNA 3 = 5dB */
+	(0 << 10) | 417,	/* 0x31, LNA 3 */
+	(7 << 10) | 0,		/* GAIN_4_1, LNA 4 = 12.5dB */
+	(0 << 10) | 290,	/* GAIN_4_2, LNA 4 */
+};
+
+static const u16 rf_ramp_pwm_uhf[] = {
+	404,			/* max RF gain in 10th of dB */
+	25,			/* ramp_slope = 1dB of gain -> clock_ticks_per_db = clk_khz / ramp_slope -> 0x2b */
+	1011,			/* ramp_max = maximum X used on the ramp */
+	(6 << 10) | 417,	/* 0x2c, LNA 1 = 13.2dB */
+	(0 << 10) | 756,	/* 0x2d, LNA 1 */
+	(16 << 10) | 756,	/* 0x2e, LNA 2 = 10.5dB */
+	(0 << 10) | 1011,	/* 0x2f, LNA 2 */
+	(16 << 10) | 0,		/* 0x30, LNA 3 = 5dB */
+	(0 << 10) | 127,	/* 0x31, LNA 3 */
+	(7 << 10) | 127,	/* GAIN_4_1, LNA 4 = 12.5dB */
+	(0 << 10) | 417,	/* GAIN_4_2, LNA 4 */
+};
+
+static const u16 bb_ramp_boost[] = {
+	550,			/* max BB gain in 10th of dB */
+	260, 260, 26,		/* BB1, 26dB */
+	290, 550, 29,		/* BB2, 29dB */
+};
+
+static const u16 bb_ramp_pwm_normal[] = {
+	500,			/* max RF gain in 10th of dB */
+	8,			/* ramp_slope = 1dB of gain -> clock_ticks_per_db = clk_khz / ramp_slope -> 0x34 */
+	400,
+	(2 << 9) | 0,		/* 0x35 = 21dB */
+	(0 << 9) | 168,		/* 0x36 */
+	(2 << 9) | 168,		/* 0x37 = 29dB */
+	(0 << 9) | 400,		/* 0x38 */
+};
+
+struct slope {
+	int16_t range;
+	int16_t slope;
+};
+static u16 slopes_to_scale(const struct slope *slopes, u8 num, s16 val)
+{
+	u8 i;
+	u16 rest;
+	u16 ret = 0;
+	for (i = 0; i < num; i++) {
+		if (val > slopes[i].range)
+			rest = slopes[i].range;
+		else
+			rest = val;
+		ret += (rest * slopes[i].slope) / slopes[i].range;
+		val -= rest;
+	}
+	return ret;
+}
+
+static const struct slope dib0090_wbd_slopes[3] = {
+	{66, 120},		/* -64,-52: offset -   65 */
+	{600, 170},		/* -52,-35: 65     -  665 */
+	{170, 250},		/* -45,-10: 665    - 835 */
+};
+
+static s16 dib0090_wbd_to_db(struct dib0090_state *state, u16 wbd)
+{
+	wbd &= 0x3ff;
+	if (wbd < state->wbd_offset)
+		wbd = 0;
+	else
+		wbd -= state->wbd_offset;
+	/* -64dB is the floor */
+	return -640 + (s16) slopes_to_scale(dib0090_wbd_slopes, ARRAY_SIZE(dib0090_wbd_slopes), wbd);
+}
+
+static void dib0090_wbd_target(struct dib0090_state *state, u32 rf)
+{
+	u16 offset = 250;
+
+	/* TODO : DAB digital N+/-1 interferer perfs : offset = 10 */
+
+	if (state->current_band == BAND_VHF)
+		offset = 650;
+#ifndef FIRMWARE_FIREFLY
+	if (state->current_band == BAND_VHF)
+		offset = state->config->wbd_vhf_offset;
+	if (state->current_band == BAND_CBAND)
+		offset = state->config->wbd_cband_offset;
+#endif
+
+	state->wbd_target = dib0090_wbd_to_db(state, state->wbd_offset + offset);
+	dprintk("wbd-target: %d dB", (u32) state->wbd_target);
+}
+
+static const int gain_reg_addr[4] = {
+	0x08, 0x0a, 0x0f, 0x01
+};
+
+static void dib0090_gain_apply(struct dib0090_state *state, s16 gain_delta, s16 top_delta, u8 force)
+{
+	u16 rf, bb, ref;
+	u16 i, v, gain_reg[4] = { 0 }, gain;
+	const u16 *g;
+
+	if (top_delta < -511)
+		top_delta = -511;
+	if (top_delta > 511)
+		top_delta = 511;
+
+	if (force) {
+		top_delta *= (1 << WBD_ALPHA);
+		gain_delta *= (1 << GAIN_ALPHA);
+	}
+
+	if (top_delta >= ((s16) (state->rf_ramp[0] << WBD_ALPHA) - state->rf_gain_limit))	/* overflow */
+		state->rf_gain_limit = state->rf_ramp[0] << WBD_ALPHA;
+	else
+		state->rf_gain_limit += top_delta;
+
+	if (state->rf_gain_limit < 0)	/*underflow */
+		state->rf_gain_limit = 0;
+
+	/* use gain as a temporary variable and correct current_gain */
+	gain = ((state->rf_gain_limit >> WBD_ALPHA) + state->bb_ramp[0]) << GAIN_ALPHA;
+	if (gain_delta >= ((s16) gain - state->current_gain))	/* overflow */
+		state->current_gain = gain;
+	else
+		state->current_gain += gain_delta;
+	/* cannot be less than 0 (only if gain_delta is less than 0 we can have current_gain < 0) */
+	if (state->current_gain < 0)
+		state->current_gain = 0;
+
+	/* now split total gain to rf and bb gain */
+	gain = state->current_gain >> GAIN_ALPHA;
+
+	/* requested gain is bigger than rf gain limit - ACI/WBD adjustment */
+	if (gain > (state->rf_gain_limit >> WBD_ALPHA)) {
+		rf = state->rf_gain_limit >> WBD_ALPHA;
+		bb = gain - rf;
+		if (bb > state->bb_ramp[0])
+			bb = state->bb_ramp[0];
+	} else {		/* high signal level -> all gains put on RF */
+		rf = gain;
+		bb = 0;
+	}
+
+	state->gain[0] = rf;
+	state->gain[1] = bb;
+
+	/* software ramp */
+	/* Start with RF gains */
+	g = state->rf_ramp + 1;	/* point on RF LNA1 max gain */
+	ref = rf;
+	for (i = 0; i < 7; i++) {	/* Go over all amplifiers => 5RF amps + 2 BB amps = 7 amps */
+		if (g[0] == 0 || ref < (g[1] - g[0]))	/* if total gain of the current amp is null or this amp is not concerned because it starts to work from an higher gain value */
+			v = 0;	/* force the gain to write for the current amp to be null */
+		else if (ref >= g[1])	/* Gain to set is higher than the high working point of this amp */
+			v = g[2];	/* force this amp to be full gain */
+		else		/* compute the value to set to this amp because we are somewhere in his range */
+			v = ((ref - (g[1] - g[0])) * g[2]) / g[0];
+
+		if (i == 0)	/* LNA 1 reg mapping */
+			gain_reg[0] = v;
+		else if (i == 1)	/* LNA 2 reg mapping */
+			gain_reg[0] |= v << 7;
+		else if (i == 2)	/* LNA 3 reg mapping */
+			gain_reg[1] = v;
+		else if (i == 3)	/* LNA 4 reg mapping */
+			gain_reg[1] |= v << 7;
+		else if (i == 4)	/* CBAND LNA reg mapping */
+			gain_reg[2] = v | state->rf_lt_def;
+		else if (i == 5)	/* BB gain 1 reg mapping */
+			gain_reg[3] = v << 3;
+		else if (i == 6)	/* BB gain 2 reg mapping */
+			gain_reg[3] |= v << 8;
+
+		g += 3;		/* go to next gain bloc */
+
+		/* When RF is finished, start with BB */
+		if (i == 4) {
+			g = state->bb_ramp + 1;	/* point on BB gain 1 max gain */
+			ref = bb;
+		}
+	}
+	gain_reg[3] |= state->bb_1_def;
+	gain_reg[3] |= ((bb % 10) * 100) / 125;
+
+#ifdef DEBUG_AGC
+	dprintk("GA CALC: DB: %3d(rf) + %3d(bb) = %3d gain_reg[0]=%04x gain_reg[1]=%04x gain_reg[2]=%04x gain_reg[0]=%04x", rf, bb, rf + bb,
+		gain_reg[0], gain_reg[1], gain_reg[2], gain_reg[3]);
+#endif
+
+	/* Write the amplifier regs */
+	for (i = 0; i < 4; i++) {
+		v = gain_reg[i];
+		if (force || state->gain_reg[i] != v) {
+			state->gain_reg[i] = v;
+			dib0090_write_reg(state, gain_reg_addr[i], v);
+		}
+	}
+}
+
+static void dib0090_set_boost(struct dib0090_state *state, int onoff)
+{
+	state->bb_1_def &= 0xdfff;
+	state->bb_1_def |= onoff << 13;
+}
+
+static void dib0090_set_rframp(struct dib0090_state *state, const u16 * cfg)
+{
+	state->rf_ramp = cfg;
+}
+
+static void dib0090_set_rframp_pwm(struct dib0090_state *state, const u16 * cfg)
+{
+	state->rf_ramp = cfg;
+
+	dib0090_write_reg(state, 0x2a, 0xffff);
+
+	dprintk("total RF gain: %ddB, step: %d", (u32) cfg[0], dib0090_read_reg(state, 0x2a));
+
+	dib0090_write_regs(state, 0x2c, cfg + 3, 6);
+	dib0090_write_regs(state, 0x3e, cfg + 9, 2);
+}
+
+static void dib0090_set_bbramp(struct dib0090_state *state, const u16 * cfg)
+{
+	state->bb_ramp = cfg;
+	dib0090_set_boost(state, cfg[0] > 500);	/* we want the boost if the gain is higher that 50dB */
+}
+
+static void dib0090_set_bbramp_pwm(struct dib0090_state *state, const u16 * cfg)
+{
+	state->bb_ramp = cfg;
+
+	dib0090_set_boost(state, cfg[0] > 500);	/* we want the boost if the gain is higher that 50dB */
+
+	dib0090_write_reg(state, 0x33, 0xffff);
+	dprintk("total BB gain: %ddB, step: %d", (u32) cfg[0], dib0090_read_reg(state, 0x33));
+	dib0090_write_regs(state, 0x35, cfg + 3, 4);
+}
+
+void dib0090_pwm_gain_reset(struct dvb_frontend *fe)
+{
+	struct dib0090_state *state = fe->tuner_priv;
+	/* reset the AGC */
+
+	if (state->config->use_pwm_agc) {
+#ifdef CONFIG_BAND_SBAND
+		if (state->current_band == BAND_SBAND) {
+			dib0090_set_rframp_pwm(state, rf_ramp_pwm_sband);
+			dib0090_set_bbramp_pwm(state, bb_ramp_pwm_boost);
+		} else
+#endif
+#ifdef CONFIG_BAND_CBAND
+		if (state->current_band == BAND_CBAND) {
+			dib0090_set_rframp_pwm(state, rf_ramp_pwm_cband);
+			dib0090_set_bbramp_pwm(state, bb_ramp_pwm_normal);
+		} else
+#endif
+#ifdef CONFIG_BAND_VHF
+		if (state->current_band == BAND_VHF) {
+			dib0090_set_rframp_pwm(state, rf_ramp_pwm_vhf);
+			dib0090_set_bbramp_pwm(state, bb_ramp_pwm_normal);
+		} else
+#endif
+		{
+			dib0090_set_rframp_pwm(state, rf_ramp_pwm_uhf);
+			dib0090_set_bbramp_pwm(state, bb_ramp_pwm_normal);
+		}
+
+		if (state->rf_ramp[0] != 0)
+			dib0090_write_reg(state, 0x32, (3 << 11));
+		else
+			dib0090_write_reg(state, 0x32, (0 << 11));
+
+		dib0090_write_reg(state, 0x39, (1 << 10));
+	}
+}
+EXPORT_SYMBOL(dib0090_pwm_gain_reset);
+
+int dib0090_gain_control(struct dvb_frontend *fe)
+{
+	struct dib0090_state *state = fe->tuner_priv;
+	enum frontend_tune_state *tune_state = &state->tune_state;
+	int ret = 10;
+
+	u16 wbd_val = 0;
+	u8 apply_gain_immediatly = 1;
+	s16 wbd_error = 0, adc_error = 0;
+
+	if (*tune_state == CT_AGC_START) {
+		state->agc_freeze = 0;
+		dib0090_write_reg(state, 0x04, 0x0);
+
+#ifdef CONFIG_BAND_SBAND
+		if (state->current_band == BAND_SBAND) {
+			dib0090_set_rframp(state, rf_ramp_sband);
+			dib0090_set_bbramp(state, bb_ramp_boost);
+		} else
+#endif
+#ifdef CONFIG_BAND_VHF
+		if (state->current_band == BAND_VHF) {
+			dib0090_set_rframp(state, rf_ramp_vhf);
+			dib0090_set_bbramp(state, bb_ramp_boost);
+		} else
+#endif
+#ifdef CONFIG_BAND_CBAND
+		if (state->current_band == BAND_CBAND) {
+			dib0090_set_rframp(state, rf_ramp_cband);
+			dib0090_set_bbramp(state, bb_ramp_boost);
+		} else
+#endif
+		{
+			dib0090_set_rframp(state, rf_ramp_uhf);
+			dib0090_set_bbramp(state, bb_ramp_boost);
+		}
+
+		dib0090_write_reg(state, 0x32, 0);
+		dib0090_write_reg(state, 0x39, 0);
+
+		dib0090_wbd_target(state, state->current_rf);
+
+		state->rf_gain_limit = state->rf_ramp[0] << WBD_ALPHA;
+		state->current_gain = ((state->rf_ramp[0] + state->bb_ramp[0]) / 2) << GAIN_ALPHA;
+
+		*tune_state = CT_AGC_STEP_0;
+	} else if (!state->agc_freeze) {
+		s16 wbd;
+
+		int adc;
+		wbd_val = dib0090_read_reg(state, 0x1d);
+
+		/* read and calc the wbd power */
+		wbd = dib0090_wbd_to_db(state, wbd_val);
+		wbd_error = state->wbd_target - wbd;
+
+		if (*tune_state == CT_AGC_STEP_0) {
+			if (wbd_error < 0 && state->rf_gain_limit > 0) {
+#ifdef CONFIG_BAND_CBAND
+				/* in case of CBAND tune reduce first the lt_gain2 before adjusting the RF gain */
+				u8 ltg2 = (state->rf_lt_def >> 10) & 0x7;
+				if (state->current_band == BAND_CBAND && ltg2) {
+					ltg2 >>= 1;
+					state->rf_lt_def &= ltg2 << 10;	/* reduce in 3 steps from 7 to 0 */
+				}
+#endif
+			} else {
+				state->agc_step = 0;
+				*tune_state = CT_AGC_STEP_1;
+			}
+		} else {
+			/* calc the adc power */
+			adc = state->config->get_adc_power(fe);
+			adc = (adc * ((s32) 355774) + (((s32) 1) << 20)) >> 21;	/* included in [0:-700] */
+
+			adc_error = (s16) (((s32) ADC_TARGET) - adc);
+#ifdef CONFIG_STANDARD_DAB
+			if (state->fe->dtv_property_cache.delivery_system == STANDARD_DAB)
+				adc_error += 130;
+#endif
+#ifdef CONFIG_STANDARD_DVBT
+			if (state->fe->dtv_property_cache.delivery_system == STANDARD_DVBT &&
+			    (state->fe->dtv_property_cache.modulation == QAM_64 || state->fe->dtv_property_cache.modulation == QAM_16))
+				adc_error += 60;
+#endif
+#ifdef CONFIG_SYS_ISDBT
+			if ((state->fe->dtv_property_cache.delivery_system == SYS_ISDBT) && (((state->fe->dtv_property_cache.layer[0].segment_count >
+											       0)
+											      &&
+											      ((state->fe->dtv_property_cache.layer[0].modulation ==
+												QAM_64)
+											       || (state->fe->dtv_property_cache.layer[0].
+												   modulation == QAM_16)))
+											     ||
+											     ((state->fe->dtv_property_cache.layer[1].segment_count >
+											       0)
+											      &&
+											      ((state->fe->dtv_property_cache.layer[1].modulation ==
+												QAM_64)
+											       || (state->fe->dtv_property_cache.layer[1].
+												   modulation == QAM_16)))
+											     ||
+											     ((state->fe->dtv_property_cache.layer[2].segment_count >
+											       0)
+											      &&
+											      ((state->fe->dtv_property_cache.layer[2].modulation ==
+												QAM_64)
+											       || (state->fe->dtv_property_cache.layer[2].
+												   modulation == QAM_16)))
+			    )
+			    )
+				adc_error += 60;
+#endif
+
+			if (*tune_state == CT_AGC_STEP_1) {	/* quickly go to the correct range of the ADC power */
+				if (ABS(adc_error) < 50 || state->agc_step++ > 5) {
+
+#ifdef CONFIG_STANDARD_DAB
+					if (state->fe->dtv_property_cache.delivery_system == STANDARD_DAB) {
+						dib0090_write_reg(state, 0x02, (1 << 15) | (15 << 11) | (31 << 6) | (63));	/* cap value = 63 : narrow BB filter : Fc = 1.8MHz */
+						dib0090_write_reg(state, 0x04, 0x0);
+					} else
+#endif
+					{
+						dib0090_write_reg(state, 0x02, (1 << 15) | (3 << 11) | (6 << 6) | (32));
+						dib0090_write_reg(state, 0x04, 0x01);	/*0 = 1KHz ; 1 = 150Hz ; 2 = 50Hz ; 3 = 50KHz ; 4 = servo fast */
+					}
+
+					*tune_state = CT_AGC_STOP;
+				}
+			} else {
+				/* everything higher than or equal to CT_AGC_STOP means tracking */
+				ret = 100;	/* 10ms interval */
+				apply_gain_immediatly = 0;
+			}
+		}
+#ifdef DEBUG_AGC
+		dprintk
+		    ("FE: %d, tune state %d, ADC = %3ddB (ADC err %3d) WBD %3ddB (WBD err %3d, WBD val SADC: %4d), RFGainLimit (TOP): %3d, signal: %3ddBm",
+		     (u32) fe->id, (u32) *tune_state, (u32) adc, (u32) adc_error, (u32) wbd, (u32) wbd_error, (u32) wbd_val,
+		     (u32) state->rf_gain_limit >> WBD_ALPHA, (s32) 200 + adc - (state->current_gain >> GAIN_ALPHA));
+#endif
+	}
+
+	/* apply gain */
+	if (!state->agc_freeze)
+		dib0090_gain_apply(state, adc_error, wbd_error, apply_gain_immediatly);
+	return ret;
+}
+EXPORT_SYMBOL(dib0090_gain_control);
+
+void dib0090_get_current_gain(struct dvb_frontend *fe, u16 * rf, u16 * bb, u16 * rf_gain_limit, u16 * rflt)
+{
+	struct dib0090_state *state = fe->tuner_priv;
+	if (rf)
+		*rf = state->gain[0];
+	if (bb)
+		*bb = state->gain[1];
+	if (rf_gain_limit)
+		*rf_gain_limit = state->rf_gain_limit;
+	if (rflt)
+		*rflt = (state->rf_lt_def >> 10) & 0x7;
+}
+EXPORT_SYMBOL(dib0090_get_current_gain);
+
+u16 dib0090_get_wbd_offset(struct dvb_frontend *tuner)
+{
+	struct dib0090_state *st = tuner->tuner_priv;
+	return st->wbd_offset;
+}
+EXPORT_SYMBOL(dib0090_get_wbd_offset);
+
+static const u16 dib0090_defaults[] = {
+
+	25, 0x01,
+	0x0000,
+	0x99a0,
+	0x6008,
+	0x0000,
+	0x8acb,
+	0x0000,
+	0x0405,
+	0x0000,
+	0x0000,
+	0x0000,
+	0xb802,
+	0x0300,
+	0x2d12,
+	0xbac0,
+	0x7c00,
+	0xdbb9,
+	0x0954,
+	0x0743,
+	0x8000,
+	0x0001,
+	0x0040,
+	0x0100,
+	0x0000,
+	0xe910,
+	0x149e,
+
+	1, 0x1c,
+	0xff2d,
+
+	1, 0x39,
+	0x0000,
+
+	1, 0x1b,
+	EN_IQADC | EN_BB | EN_BIAS | EN_DIGCLK | EN_PLL | EN_CRYSTAL,
+	2, 0x1e,
+	0x07FF,
+	0x0007,
+
+	1, 0x24,
+	EN_UHF | EN_CRYSTAL,
+
+	2, 0x3c,
+	0x3ff,
+	0x111,
+	0
+};
+
+static int dib0090_reset(struct dvb_frontend *fe)
+{
+	struct dib0090_state *state = fe->tuner_priv;
+	u16 l, r, *n;
+
+	dib0090_reset_digital(fe, state->config);
+	state->revision = dib0090_identify(fe);
+
+	/* Revision definition */
+	if (state->revision == 0xff)
+		return -EINVAL;
+#ifdef EFUSE
+	else if ((state->revision & 0x1f) >= 3)	/* Update the efuse : Only available for KROSUS > P1C */
+		dib0090_set_EFUSE(state);
+#endif
+
+#ifdef CONFIG_TUNER_DIB0090_P1B_SUPPORT
+	if (!(state->revision & 0x1))	/* it is P1B - reset is already done */
+		return 0;
+#endif
+
+	/* Upload the default values */
+	n = (u16 *) dib0090_defaults;
+	l = pgm_read_word(n++);
+	while (l) {
+		r = pgm_read_word(n++);
+		do {
+			/* DEBUG_TUNER */
+			/* dprintk("%d, %d, %d", l, r, pgm_read_word(n)); */
+			dib0090_write_reg(state, r, pgm_read_word(n++));
+			r++;
+		} while (--l);
+		l = pgm_read_word(n++);
+	}
+
+	/* Congigure in function of the crystal */
+	if (state->config->io.clock_khz >= 24000)
+		l = 1;
+	else
+		l = 2;
+	dib0090_write_reg(state, 0x14, l);
+	dprintk("Pll lock : %d", (dib0090_read_reg(state, 0x1a) >> 11) & 0x1);
+
+	state->reset = 3;	/* enable iq-offset-calibration and wbd-calibration when tuning next time */
+
+	return 0;
+}
+
+#define steps(u) (((u) > 15) ? ((u)-16) : (u))
+#define INTERN_WAIT 10
+static int dib0090_get_offset(struct dib0090_state *state, enum frontend_tune_state *tune_state)
+{
+	int ret = INTERN_WAIT * 10;
+
+	switch (*tune_state) {
+	case CT_TUNER_STEP_2:
+		/* Turns to positive */
+		dib0090_write_reg(state, 0x1f, 0x7);
+		*tune_state = CT_TUNER_STEP_3;
+		break;
+
+	case CT_TUNER_STEP_3:
+		state->adc_diff = dib0090_read_reg(state, 0x1d);
+
+		/* Turns to negative */
+		dib0090_write_reg(state, 0x1f, 0x4);
+		*tune_state = CT_TUNER_STEP_4;
+		break;
+
+	case CT_TUNER_STEP_4:
+		state->adc_diff -= dib0090_read_reg(state, 0x1d);
+		*tune_state = CT_TUNER_STEP_5;
+		ret = 0;
+		break;
+
+	default:
+		break;
+	}
+
+	return ret;
+}
+
+struct dc_calibration {
+	uint8_t addr;
+	uint8_t offset;
+	uint8_t pga:1;
+	uint16_t bb1;
+	uint8_t i:1;
+};
+
+static const struct dc_calibration dc_table[] = {
+	/* Step1 BB gain1= 26 with boost 1, gain 2 = 0 */
+	{0x06, 5, 1, (1 << 13) | (0 << 8) | (26 << 3), 1},
+	{0x07, 11, 1, (1 << 13) | (0 << 8) | (26 << 3), 0},
+	/* Step 2 BB gain 1 = 26 with boost = 1 & gain 2 = 29 */
+	{0x06, 0, 0, (1 << 13) | (29 << 8) | (26 << 3), 1},
+	{0x06, 10, 0, (1 << 13) | (29 << 8) | (26 << 3), 0},
+	{0},
+};
+
+static void dib0090_set_trim(struct dib0090_state *state)
+{
+	u16 *val;
+
+	if (state->dc->addr == 0x07)
+		val = &state->bb7;
+	else
+		val = &state->bb6;
+
+	*val &= ~(0x1f << state->dc->offset);
+	*val |= state->step << state->dc->offset;
+
+	dib0090_write_reg(state, state->dc->addr, *val);
+}
+
+static int dib0090_dc_offset_calibration(struct dib0090_state *state, enum frontend_tune_state *tune_state)
+{
+	int ret = 0;
+
+	switch (*tune_state) {
+
+	case CT_TUNER_START:
+		/* init */
+		dprintk("Internal DC calibration");
+
+		/* the LNA is off */
+		dib0090_write_reg(state, 0x24, 0x02ed);
+
+		/* force vcm2 = 0.8V */
+		state->bb6 = 0;
+		state->bb7 = 0x040d;
+
+		state->dc = dc_table;
+
+		*tune_state = CT_TUNER_STEP_0;
+
+		/* fall through */
+
+	case CT_TUNER_STEP_0:
+		dib0090_write_reg(state, 0x01, state->dc->bb1);
+		dib0090_write_reg(state, 0x07, state->bb7 | (state->dc->i << 7));
+
+		state->step = 0;
+
+		state->min_adc_diff = 1023;
+
+		*tune_state = CT_TUNER_STEP_1;
+		ret = 50;
+		break;
+
+	case CT_TUNER_STEP_1:
+		dib0090_set_trim(state);
+
+		*tune_state = CT_TUNER_STEP_2;
+		break;
+
+	case CT_TUNER_STEP_2:
+	case CT_TUNER_STEP_3:
+	case CT_TUNER_STEP_4:
+		ret = dib0090_get_offset(state, tune_state);
+		break;
+
+	case CT_TUNER_STEP_5:	/* found an offset */
+		dprintk("FE%d: IQC read=%d, current=%x", state->fe->id, (u32) state->adc_diff, state->step);
+
+		/* first turn for this frequency */
+		if (state->step == 0) {
+			if (state->dc->pga && state->adc_diff < 0)
+				state->step = 0x10;
+			if (state->dc->pga == 0 && state->adc_diff > 0)
+				state->step = 0x10;
+		}
+
+		state->adc_diff = ABS(state->adc_diff);
+
+		if (state->adc_diff < state->min_adc_diff && steps(state->step) < 15) {	/* stop search when the delta to 0 is increasing */
+			state->step++;
+			state->min_adc_diff = state->adc_diff;
+			*tune_state = CT_TUNER_STEP_1;
+		} else {
+
+			/* the minimum was what we have seen in the step before */
+			state->step--;
+			dib0090_set_trim(state);
+
+			dprintk("FE%d: BB Offset Cal, BBreg=%hd,Offset=%hd,Value Set=%hd", state->fe->id, state->dc->addr, state->adc_diff,
+				state->step);
+
+			state->dc++;
+			if (state->dc->addr == 0)	/* done */
+				*tune_state = CT_TUNER_STEP_6;
+			else
+				*tune_state = CT_TUNER_STEP_0;
+
+		}
+		break;
+
+	case CT_TUNER_STEP_6:
+		dib0090_write_reg(state, 0x07, state->bb7 & ~0x0008);
+		dib0090_write_reg(state, 0x1f, 0x7);
+		*tune_state = CT_TUNER_START;	/* reset done -> real tuning can now begin */
+		state->reset &= ~0x1;
+	default:
+		break;
+	}
+	return ret;
+}
+
+static int dib0090_wbd_calibration(struct dib0090_state *state, enum frontend_tune_state *tune_state)
+{
+	switch (*tune_state) {
+	case CT_TUNER_START:
+		/* WBD-mode=log, Bias=2, Gain=6, Testmode=1, en=1, WBDMUX=1 */
+		dib0090_write_reg(state, 0x10, 0xdb09 | (1 << 10));
+		dib0090_write_reg(state, 0x24, EN_UHF & 0x0fff);
+
+		*tune_state = CT_TUNER_STEP_0;
+		return 90;	/* wait for the WBDMUX to switch and for the ADC to sample */
+	case CT_TUNER_STEP_0:
+		state->wbd_offset = dib0090_read_reg(state, 0x1d);
+		dprintk("WBD calibration offset = %d", state->wbd_offset);
+
+		*tune_state = CT_TUNER_START;	/* reset done -> real tuning can now begin */
+		state->reset &= ~0x2;
+		break;
+	default:
+		break;
+	}
+	return 0;
+}
+
+static void dib0090_set_bandwidth(struct dib0090_state *state)
+{
+	u16 tmp;
+
+	if (state->fe->dtv_property_cache.bandwidth_hz / 1000 <= 5000)
+		tmp = (3 << 14);
+	else if (state->fe->dtv_property_cache.bandwidth_hz / 1000 <= 6000)
+		tmp = (2 << 14);
+	else if (state->fe->dtv_property_cache.bandwidth_hz / 1000 <= 7000)
+		tmp = (1 << 14);
+	else
+		tmp = (0 << 14);
+
+	state->bb_1_def &= 0x3fff;
+	state->bb_1_def |= tmp;
+
+	dib0090_write_reg(state, 0x01, state->bb_1_def);	/* be sure that we have the right bb-filter */
+}
+
+static const struct dib0090_pll dib0090_pll_table[] = {
+#ifdef CONFIG_BAND_CBAND
+	{56000, 0, 9, 48, 6},
+	{70000, 1, 9, 48, 6},
+	{87000, 0, 8, 32, 4},
+	{105000, 1, 8, 32, 4},
+	{115000, 0, 7, 24, 6},
+	{140000, 1, 7, 24, 6},
+	{170000, 0, 6, 16, 4},
+#endif
+#ifdef CONFIG_BAND_VHF
+	{200000, 1, 6, 16, 4},
+	{230000, 0, 5, 12, 6},
+	{280000, 1, 5, 12, 6},
+	{340000, 0, 4, 8, 4},
+	{380000, 1, 4, 8, 4},
+	{450000, 0, 3, 6, 6},
+#endif
+#ifdef CONFIG_BAND_UHF
+	{580000, 1, 3, 6, 6},
+	{700000, 0, 2, 4, 4},
+	{860000, 1, 2, 4, 4},
+#endif
+#ifdef CONFIG_BAND_LBAND
+	{1800000, 1, 0, 2, 4},
+#endif
+#ifdef CONFIG_BAND_SBAND
+	{2900000, 0, 14, 1, 4},
+#endif
+};
+
+static const struct dib0090_tuning dib0090_tuning_table_fm_vhf_on_cband[] = {
+
+#ifdef CONFIG_BAND_CBAND
+	{184000, 4, 1, 15, 0x280, 0x2912, 0xb94e, EN_CAB},
+	{227000, 4, 3, 15, 0x280, 0x2912, 0xb94e, EN_CAB},
+	{380000, 4, 7, 15, 0x280, 0x2912, 0xb94e, EN_CAB},
+#endif
+#ifdef CONFIG_BAND_UHF
+	{520000, 2, 0, 15, 0x300, 0x1d12, 0xb9ce, EN_UHF},
+	{550000, 2, 2, 15, 0x300, 0x1d12, 0xb9ce, EN_UHF},
+	{650000, 2, 3, 15, 0x300, 0x1d12, 0xb9ce, EN_UHF},
+	{750000, 2, 5, 15, 0x300, 0x1d12, 0xb9ce, EN_UHF},
+	{850000, 2, 6, 15, 0x300, 0x1d12, 0xb9ce, EN_UHF},
+	{900000, 2, 7, 15, 0x300, 0x1d12, 0xb9ce, EN_UHF},
+#endif
+#ifdef CONFIG_BAND_LBAND
+	{1500000, 4, 0, 20, 0x300, 0x1912, 0x82c9, EN_LBD},
+	{1600000, 4, 1, 20, 0x300, 0x1912, 0x82c9, EN_LBD},
+	{1800000, 4, 3, 20, 0x300, 0x1912, 0x82c9, EN_LBD},
+#endif
+#ifdef CONFIG_BAND_SBAND
+	{2300000, 1, 4, 20, 0x300, 0x2d2A, 0x82c7, EN_SBD},
+	{2900000, 1, 7, 20, 0x280, 0x2deb, 0x8347, EN_SBD},
+#endif
+};
+
+static const struct dib0090_tuning dib0090_tuning_table[] = {
+
+#ifdef CONFIG_BAND_CBAND
+	{170000, 4, 1, 15, 0x280, 0x2912, 0xb94e, EN_CAB},
+#endif
+#ifdef CONFIG_BAND_VHF
+	{184000, 1, 1, 15, 0x300, 0x4d12, 0xb94e, EN_VHF},
+	{227000, 1, 3, 15, 0x300, 0x4d12, 0xb94e, EN_VHF},
+	{380000, 1, 7, 15, 0x300, 0x4d12, 0xb94e, EN_VHF},
+#endif
+#ifdef CONFIG_BAND_UHF
+	{520000, 2, 0, 15, 0x300, 0x1d12, 0xb9ce, EN_UHF},
+	{550000, 2, 2, 15, 0x300, 0x1d12, 0xb9ce, EN_UHF},
+	{650000, 2, 3, 15, 0x300, 0x1d12, 0xb9ce, EN_UHF},
+	{750000, 2, 5, 15, 0x300, 0x1d12, 0xb9ce, EN_UHF},
+	{850000, 2, 6, 15, 0x300, 0x1d12, 0xb9ce, EN_UHF},
+	{900000, 2, 7, 15, 0x300, 0x1d12, 0xb9ce, EN_UHF},
+#endif
+#ifdef CONFIG_BAND_LBAND
+	{1500000, 4, 0, 20, 0x300, 0x1912, 0x82c9, EN_LBD},
+	{1600000, 4, 1, 20, 0x300, 0x1912, 0x82c9, EN_LBD},
+	{1800000, 4, 3, 20, 0x300, 0x1912, 0x82c9, EN_LBD},
+#endif
+#ifdef CONFIG_BAND_SBAND
+	{2300000, 1, 4, 20, 0x300, 0x2d2A, 0x82c7, EN_SBD},
+	{2900000, 1, 7, 20, 0x280, 0x2deb, 0x8347, EN_SBD},
+#endif
+};
+
+#define WBD     0x781		/* 1 1 1 1 0000 0 0 1 */
+static int dib0090_tune(struct dvb_frontend *fe)
+{
+	struct dib0090_state *state = fe->tuner_priv;
+	const struct dib0090_tuning *tune = state->current_tune_table_index;
+	const struct dib0090_pll *pll = state->current_pll_table_index;
+	enum frontend_tune_state *tune_state = &state->tune_state;
+
+	u32 rf;
+	u16 lo4 = 0xe900, lo5, lo6, Den;
+	u32 FBDiv, Rest, FREF, VCOF_kHz = 0;
+	u16 tmp, adc;
+	int8_t step_sign;
+	int ret = 10;		/* 1ms is the default delay most of the time */
+	u8 c, i;
+
+	state->current_band = (u8) BAND_OF_FREQUENCY(fe->dtv_property_cache.frequency / 1000);
+	rf = fe->dtv_property_cache.frequency / 1000 + (state->current_band ==
+							BAND_UHF ? state->config->freq_offset_khz_uhf : state->config->freq_offset_khz_vhf);
+	/* in any case we first need to do a reset if needed */
+	if (state->reset & 0x1)
+		return dib0090_dc_offset_calibration(state, tune_state);
+	else if (state->reset & 0x2)
+		return dib0090_wbd_calibration(state, tune_state);
+
+    /************************* VCO ***************************/
+	/* Default values for FG                                 */
+	/* from these are needed :                               */
+	/* Cp,HFdiv,VCOband,SD,Num,Den,FB and REFDiv             */
+
+#ifdef CONFIG_SYS_ISDBT
+	if (state->fe->dtv_property_cache.delivery_system == SYS_ISDBT && state->fe->dtv_property_cache.isdbt_sb_mode == 1)
+		rf += 850;
+#endif
+
+	if (state->current_rf != rf) {
+		state->tuner_is_tuned = 0;
+
+		tune = dib0090_tuning_table;
+
+		tmp = (state->revision >> 5) & 0x7;
+		if (tmp == 0x4 || tmp == 0x7) {
+			/* CBAND tuner version for VHF */
+			if (state->current_band == BAND_FM || state->current_band == BAND_VHF) {
+				/* Force CBAND */
+				state->current_band = BAND_CBAND;
+				tune = dib0090_tuning_table_fm_vhf_on_cband;
+			}
+		}
+
+		pll = dib0090_pll_table;
+		/* Look for the interval */
+		while (rf > tune->max_freq)
+			tune++;
+		while (rf > pll->max_freq)
+			pll++;
+		state->current_tune_table_index = tune;
+		state->current_pll_table_index = pll;
+	}
+
+	if (*tune_state == CT_TUNER_START) {
+
+		if (state->tuner_is_tuned == 0)
+			state->current_rf = 0;
+
+		if (state->current_rf != rf) {
+
+			dib0090_write_reg(state, 0x0b, 0xb800 | (tune->switch_trim));
+
+			/* external loop filter, otherwise:
+			 * lo5 = (0 << 15) | (0 << 12) | (0 << 11) | (3 << 9) | (4 << 6) | (3 << 4) | 4;
+			 * lo6 = 0x0e34 */
+			if (pll->vco_band)
+				lo5 = 0x049e;
+			else if (state->config->analog_output)
+				lo5 = 0x041d;
+			else
+				lo5 = 0x041c;
+
+			lo5 |= (pll->hfdiv_code << 11) | (pll->vco_band << 7);	/* bit 15 is the split to the slave, we do not do it here */
+
+			if (!state->config->io.pll_int_loop_filt)
+				lo6 = 0xff28;
+			else
+				lo6 = (state->config->io.pll_int_loop_filt << 3);
+
+			VCOF_kHz = (pll->hfdiv * rf) * 2;
+
+			FREF = state->config->io.clock_khz;
+
+			FBDiv = (VCOF_kHz / pll->topresc / FREF);
+			Rest = (VCOF_kHz / pll->topresc) - FBDiv * FREF;
+
+			if (Rest < LPF)
+				Rest = 0;
+			else if (Rest < 2 * LPF)
+				Rest = 2 * LPF;
+			else if (Rest > (FREF - LPF)) {
+				Rest = 0;
+				FBDiv += 1;
+			} else if (Rest > (FREF - 2 * LPF))
+				Rest = FREF - 2 * LPF;
+			Rest = (Rest * 6528) / (FREF / 10);
+
+			Den = 1;
+
+			dprintk(" *****  ******* Rest value = %d", Rest);
+
+			if (Rest > 0) {
+				if (state->config->analog_output)
+					lo6 |= (1 << 2) | 2;
+				else
+					lo6 |= (1 << 2) | 1;
+				Den = 255;
+			}
+#ifdef CONFIG_BAND_SBAND
+			if (state->current_band == BAND_SBAND)
+				lo6 &= 0xfffb;
+#endif
+
+			dib0090_write_reg(state, 0x15, (u16) FBDiv);
+
+			dib0090_write_reg(state, 0x16, (Den << 8) | 1);
+
+			dib0090_write_reg(state, 0x17, (u16) Rest);
+
+			dib0090_write_reg(state, 0x19, lo5);
+
+			dib0090_write_reg(state, 0x1c, lo6);
+
+			lo6 = tune->tuner_enable;
+			if (state->config->analog_output)
+				lo6 = (lo6 & 0xff9f) | 0x2;
+
+			dib0090_write_reg(state, 0x24, lo6 | EN_LO
+#ifdef CONFIG_DIB0090_USE_PWM_AGC
+					  | state->config->use_pwm_agc * EN_CRYSTAL
+#endif
+			    );
+
+			state->current_rf = rf;
+
+			/* prepare a complete captrim */
+			state->step = state->captrim = state->fcaptrim = 64;
+
+		} else {	/* we are already tuned to this frequency - the configuration is correct  */
+
+			/* do a minimal captrim even if the frequency has not changed */
+			state->step = 4;
+			state->captrim = state->fcaptrim = dib0090_read_reg(state, 0x18) & 0x7f;
+		}
+		state->adc_diff = 3000;
+
+		dib0090_write_reg(state, 0x10, 0x2B1);
+
+		dib0090_write_reg(state, 0x1e, 0x0032);
+
+		ret = 20;
+		*tune_state = CT_TUNER_STEP_1;
+	} else if (*tune_state == CT_TUNER_STEP_0) {
+		/* nothing */
+	} else if (*tune_state == CT_TUNER_STEP_1) {
+		state->step /= 2;
+		dib0090_write_reg(state, 0x18, lo4 | state->captrim);
+		*tune_state = CT_TUNER_STEP_2;
+	} else if (*tune_state == CT_TUNER_STEP_2) {
+
+		adc = dib0090_read_reg(state, 0x1d);
+		dprintk("FE %d CAPTRIM=%d; ADC = %d (ADC) & %dmV", (u32) fe->id, (u32) state->captrim, (u32) adc,
+			(u32) (adc) * (u32) 1800 / (u32) 1024);
+
+		if (adc >= 400) {
+			adc -= 400;
+			step_sign = -1;
+		} else {
+			adc = 400 - adc;
+			step_sign = 1;
+		}
+
+		if (adc < state->adc_diff) {
+			dprintk("FE %d CAPTRIM=%d is closer to target (%d/%d)", (u32) fe->id, (u32) state->captrim, (u32) adc, (u32) state->adc_diff);
+			state->adc_diff = adc;
+			state->fcaptrim = state->captrim;
+
+		}
+
+		state->captrim += step_sign * state->step;
+		if (state->step >= 1)
+			*tune_state = CT_TUNER_STEP_1;
+		else
+			*tune_state = CT_TUNER_STEP_3;
+
+		ret = 15;
+	} else if (*tune_state == CT_TUNER_STEP_3) {
+		/*write the final cptrim config */
+		dib0090_write_reg(state, 0x18, lo4 | state->fcaptrim);
+
+#ifdef CONFIG_TUNER_DIB0090_CAPTRIM_MEMORY
+		state->memory[state->memory_index].cap = state->fcaptrim;
+#endif
+
+		*tune_state = CT_TUNER_STEP_4;
+	} else if (*tune_state == CT_TUNER_STEP_4) {
+		dib0090_write_reg(state, 0x1e, 0x07ff);
+
+		dprintk("FE %d Final Captrim: %d", (u32) fe->id, (u32) state->fcaptrim);
+		dprintk("FE %d HFDIV code: %d", (u32) fe->id, (u32) pll->hfdiv_code);
+		dprintk("FE %d VCO = %d", (u32) fe->id, (u32) pll->vco_band);
+		dprintk("FE %d VCOF in kHz: %d ((%d*%d) << 1))", (u32) fe->id, (u32) ((pll->hfdiv * rf) * 2), (u32) pll->hfdiv, (u32) rf);
+		dprintk("FE %d REFDIV: %d, FREF: %d", (u32) fe->id, (u32) 1, (u32) state->config->io.clock_khz);
+		dprintk("FE %d FBDIV: %d, Rest: %d", (u32) fe->id, (u32) dib0090_read_reg(state, 0x15), (u32) dib0090_read_reg(state, 0x17));
+		dprintk("FE %d Num: %d, Den: %d, SD: %d", (u32) fe->id, (u32) dib0090_read_reg(state, 0x17),
+			(u32) (dib0090_read_reg(state, 0x16) >> 8), (u32) dib0090_read_reg(state, 0x1c) & 0x3);
+
+		c = 4;
+		i = 3;
+#if defined(CONFIG_BAND_LBAND) || defined(CONFIG_BAND_SBAND)
+		if ((state->current_band == BAND_LBAND) || (state->current_band == BAND_SBAND)) {
+			c = 2;
+			i = 2;
+		}
+#endif
+		dib0090_write_reg(state, 0x10, (c << 13) | (i << 11) | (WBD
+#ifdef CONFIG_DIB0090_USE_PWM_AGC
+									| (state->config->use_pwm_agc << 1)
+#endif
+				  ));
+		dib0090_write_reg(state, 0x09, (tune->lna_tune << 5) | (tune->lna_bias << 0));
+		dib0090_write_reg(state, 0x0c, tune->v2i);
+		dib0090_write_reg(state, 0x0d, tune->mix);
+		dib0090_write_reg(state, 0x0e, tune->load);
+
+		*tune_state = CT_TUNER_STEP_5;
+	} else if (*tune_state == CT_TUNER_STEP_5) {
+
+		/* initialize the lt gain register */
+		state->rf_lt_def = 0x7c00;
+		dib0090_write_reg(state, 0x0f, state->rf_lt_def);
+
+		dib0090_set_bandwidth(state);
+		state->tuner_is_tuned = 1;
+		*tune_state = CT_TUNER_STOP;
+	} else
+		ret = FE_CALLBACK_TIME_NEVER;
+	return ret;
+}
+
+static int dib0090_release(struct dvb_frontend *fe)
+{
+	kfree(fe->tuner_priv);
+	fe->tuner_priv = NULL;
+	return 0;
+}
+
+enum frontend_tune_state dib0090_get_tune_state(struct dvb_frontend *fe)
+{
+	struct dib0090_state *state = fe->tuner_priv;
+
+	return state->tune_state;
+}
+EXPORT_SYMBOL(dib0090_get_tune_state);
+
+int dib0090_set_tune_state(struct dvb_frontend *fe, enum frontend_tune_state tune_state)
+{
+	struct dib0090_state *state = fe->tuner_priv;
+
+	state->tune_state = tune_state;
+	return 0;
+}
+EXPORT_SYMBOL(dib0090_set_tune_state);
+
+static int dib0090_get_frequency(struct dvb_frontend *fe, u32 * frequency)
+{
+	struct dib0090_state *state = fe->tuner_priv;
+
+	*frequency = 1000 * state->current_rf;
+	return 0;
+}
+
+static int dib0090_set_params(struct dvb_frontend *fe, struct dvb_frontend_parameters *p)
+{
+	struct dib0090_state *state = fe->tuner_priv;
+	uint32_t ret;
+
+	state->tune_state = CT_TUNER_START;
+
+	do {
+		ret = dib0090_tune(fe);
+		if (ret != FE_CALLBACK_TIME_NEVER)
+			msleep(ret / 10);
+		else
+			break;
+	} while (state->tune_state != CT_TUNER_STOP);
+
+	return 0;
+}
+
+static const struct dvb_tuner_ops dib0090_ops = {
+	.info = {
+		 .name = "DiBcom DiB0090",
+		 .frequency_min = 45000000,
+		 .frequency_max = 860000000,
+		 .frequency_step = 1000,
+		 },
+	.release = dib0090_release,
+
+	.init = dib0090_wakeup,
+	.sleep = dib0090_sleep,
+	.set_params = dib0090_set_params,
+	.get_frequency = dib0090_get_frequency,
+};
+
+struct dvb_frontend *dib0090_register(struct dvb_frontend *fe, struct i2c_adapter *i2c, const struct dib0090_config *config)
+{
+	struct dib0090_state *st = kzalloc(sizeof(struct dib0090_state), GFP_KERNEL);
+	if (st == NULL)
+		return NULL;
+
+	st->config = config;
+	st->i2c = i2c;
+	st->fe = fe;
+	fe->tuner_priv = st;
+
+	if (dib0090_reset(fe) != 0)
+		goto free_mem;
+
+	printk(KERN_INFO "DiB0090: successfully identified\n");
+	memcpy(&fe->ops.tuner_ops, &dib0090_ops, sizeof(struct dvb_tuner_ops));
+
+	return fe;
+ free_mem:
+	kfree(st);
+	fe->tuner_priv = NULL;
+	return NULL;
+}
+EXPORT_SYMBOL(dib0090_register);
+
+MODULE_AUTHOR("Patrick Boettcher <pboettcher@dibcom.fr>");
+MODULE_AUTHOR("Olivier Grenie <olivier.grenie@dibcom.fr>");
+MODULE_DESCRIPTION("Driver for the DiBcom 0090 base-band RF Tuner");
+MODULE_LICENSE("GPL");
diff --git a/drivers/media/dvb/frontends/dib0090.h b/drivers/media/dvb/frontends/dib0090.h
new file mode 100644
index 000000000000..aa7711e88776
--- /dev/null
+++ b/drivers/media/dvb/frontends/dib0090.h
@@ -0,0 +1,108 @@
+/*
+ * Linux-DVB Driver for DiBcom's DiB0090 base-band RF Tuner.
+ *
+ * Copyright (C) 2005-7 DiBcom (http://www.dibcom.fr/)
+ *
+ * This program is free software; you can redistribute it and/or
+ *	modify it under the terms of the GNU General Public License as
+ *	published by the Free Software Foundation, version 2.
+ */
+#ifndef DIB0090_H
+#define DIB0090_H
+
+struct dvb_frontend;
+struct i2c_adapter;
+
+#define DEFAULT_DIB0090_I2C_ADDRESS 0x60
+
+struct dib0090_io_config {
+	u32 clock_khz;
+
+	u8 pll_bypass:1;
+	u8 pll_range:1;
+	u8 pll_prediv:6;
+	u8 pll_loopdiv:6;
+
+	u8 adc_clock_ratio;	/* valid is 8, 7 ,6 */
+	u16 pll_int_loop_filt;
+};
+
+struct dib0090_config {
+	struct dib0090_io_config io;
+	int (*reset) (struct dvb_frontend *, int);
+	int (*sleep) (struct dvb_frontend *, int);
+
+	/*  offset in kHz */
+	int freq_offset_khz_uhf;
+	int freq_offset_khz_vhf;
+
+	int (*get_adc_power) (struct dvb_frontend *);
+
+	u8 clkouttobamse:1;	/* activate or deactivate clock output */
+	u8 analog_output;
+
+	u8 i2c_address;
+	/* add drives and other things if necessary */
+	u16 wbd_vhf_offset;
+	u16 wbd_cband_offset;
+	u8 use_pwm_agc;
+	u8 clkoutdrive;
+};
+
+#if defined(CONFIG_DVB_TUNER_DIB0090) || (defined(CONFIG_DVB_TUNER_DIB0090_MODULE) && defined(MODULE))
+extern struct dvb_frontend *dib0090_register(struct dvb_frontend *fe, struct i2c_adapter *i2c, const struct dib0090_config *config);
+extern void dib0090_dcc_freq(struct dvb_frontend *fe, u8 fast);
+extern void dib0090_pwm_gain_reset(struct dvb_frontend *fe);
+extern u16 dib0090_get_wbd_offset(struct dvb_frontend *tuner);
+extern int dib0090_gain_control(struct dvb_frontend *fe);
+extern enum frontend_tune_state dib0090_get_tune_state(struct dvb_frontend *fe);
+extern int dib0090_set_tune_state(struct dvb_frontend *fe, enum frontend_tune_state tune_state);
+extern void dib0090_get_current_gain(struct dvb_frontend *fe, u16 * rf, u16 * bb, u16 * rf_gain_limit, u16 * rflt);
+#else
+static inline struct dvb_frontend *dib0090_register(struct dvb_frontend *fe, struct i2c_adapter *i2c, struct dib0090_config *config)
+{
+	printk(KERN_WARNING "%s: driver disabled by Kconfig\n", __func__);
+	return NULL;
+}
+
+static inline void dib0090_dcc_freq(struct dvb_frontend *fe, u8 fast)
+{
+	printk(KERN_WARNING "%s: driver disabled by Kconfig\n", __func__);
+}
+
+static inline void dib0090_pwm_gain_reset(struct dvb_frontend *fe)
+{
+	printk(KERN_WARNING "%s: driver disabled by Kconfig\n", __func__);
+}
+
+static inline u16 dib0090_get_wbd_offset(struct dvb_frontend *tuner)
+{
+	printk(KERN_WARNING "%s: driver disabled by Kconfig\n", __func__);
+	return 0;
+}
+
+static inline int dib0090_gain_control(struct dvb_frontend *fe)
+{
+	printk(KERN_WARNING "%s: driver disabled by Kconfig\n", __func__);
+	return -ENODEV;
+}
+
+static inline enum frontend_tune_state dib0090_get_tune_state(struct dvb_frontend *fe)
+{
+	printk(KERN_WARNING "%s: driver disabled by Kconfig\n", __func__);
+	return CT_DONE;
+}
+
+static inline int dib0090_set_tune_state(struct dvb_frontend *fe, enum frontend_tune_state tune_state)
+{
+	printk(KERN_WARNING "%s: driver disabled by Kconfig\n", __func__);
+	return -ENODEV;
+}
+
+static inline void dib0090_get_current_gain(struct dvb_frontend *fe, u16 * rf, u16 * bb, u16 * rf_gain_limit, u16 * rflt)
+{
+	printk(KERN_WARNING "%s: driver disabled by Kconfig\n", __func__);
+}
+#endif
+
+#endif
diff --git a/drivers/media/dvb/frontends/dib3000mb.c b/drivers/media/dvb/frontends/dib3000mb.c
index 136b9d2164d7..ad4c8cfd8090 100644
--- a/drivers/media/dvb/frontends/dib3000mb.c
+++ b/drivers/media/dvb/frontends/dib3000mb.c
@@ -154,7 +154,7 @@ static int dib3000mb_set_frontend(struct dvb_frontend* fe,
 			case BANDWIDTH_AUTO:
 				return -EOPNOTSUPP;
 			default:
-				err("unkown bandwidth value.");
+				err("unknown bandwidth value.");
 				return -EINVAL;
 		}
 	}
diff --git a/drivers/media/dvb/frontends/dib7000p.c b/drivers/media/dvb/frontends/dib7000p.c
index 0781f94e05d2..750ae61a20f4 100644
--- a/drivers/media/dvb/frontends/dib7000p.c
+++ b/drivers/media/dvb/frontends/dib7000p.c
@@ -108,7 +108,7 @@ static int dib7000p_set_output_mode(struct dib7000p_state *state, int mode)
 
 	outreg = 0;
 	fifo_threshold = 1792;
-	smo_mode = (dib7000p_read_word(state, 235) & 0x0010) | (1 << 1);
+	smo_mode = (dib7000p_read_word(state, 235) & 0x0050) | (1 << 1);
 
 	dprintk( "setting output mode for demod %p to %d",
 			&state->demod, mode);
@@ -162,18 +162,19 @@ static int dib7000p_set_diversity_in(struct dvb_frontend *demod, int onoff)
 	if (state->div_force_off) {
 		dprintk( "diversity combination deactivated - forced by COFDM parameters");
 		onoff = 0;
-	}
+		dib7000p_write_word(state, 207, 0);
+	} else
+		dib7000p_write_word(state, 207, (state->div_sync_wait << 4) | (1 << 2) | (2 << 0));
+
 	state->div_state = (u8)onoff;
 
 	if (onoff) {
 		dib7000p_write_word(state, 204, 6);
 		dib7000p_write_word(state, 205, 16);
 		/* P_dvsy_sync_mode = 0, P_dvsy_sync_enable=1, P_dvcb_comb_mode=2 */
-		dib7000p_write_word(state, 207, (state->div_sync_wait << 4) | (1 << 2) | (2 << 0));
 	} else {
 		dib7000p_write_word(state, 204, 1);
 		dib7000p_write_word(state, 205, 0);
-		dib7000p_write_word(state, 207, 0);
 	}
 
 	return 0;
@@ -1188,7 +1189,7 @@ static int dib7000p_read_status(struct dvb_frontend *fe, fe_status_t *stat)
 		*stat |= FE_HAS_VITERBI;
 	if (lock & 0x0010)
 		*stat |= FE_HAS_SYNC;
-	if (lock & 0x0008)
+    if ((lock & 0x0038) == 0x38)
 		*stat |= FE_HAS_LOCK;
 
 	return 0;
@@ -1302,6 +1303,24 @@ struct i2c_adapter * dib7000p_get_i2c_master(struct dvb_frontend *demod, enum di
 }
 EXPORT_SYMBOL(dib7000p_get_i2c_master);
 
+int dib7000p_pid_filter_ctrl(struct dvb_frontend *fe, u8 onoff)
+{
+    struct dib7000p_state *state = fe->demodulator_priv;
+    u16 val = dib7000p_read_word(state, 235) & 0xffef;
+    val |= (onoff & 0x1) << 4;
+    dprintk("PID filter enabled %d", onoff);
+    return dib7000p_write_word(state, 235, val);
+}
+EXPORT_SYMBOL(dib7000p_pid_filter_ctrl);
+
+int dib7000p_pid_filter(struct dvb_frontend *fe, u8 id, u16 pid, u8 onoff)
+{
+    struct dib7000p_state *state = fe->demodulator_priv;
+    dprintk("PID filter: index %x, PID %d, OnOff %d", id, pid, onoff);
+    return dib7000p_write_word(state, 241 + id, onoff ? (1 << 13) | pid : 0);
+}
+EXPORT_SYMBOL(dib7000p_pid_filter);
+
 int dib7000p_i2c_enumeration(struct i2c_adapter *i2c, int no_of_demods, u8 default_addr, struct dib7000p_config cfg[])
 {
 	struct dib7000p_state st = { .i2c_adap = i2c };
@@ -1314,8 +1333,10 @@ int dib7000p_i2c_enumeration(struct i2c_adapter *i2c, int no_of_demods, u8 defau
 		/* designated i2c address */
 		new_addr          = (0x40 + k) << 1;
 		st.i2c_addr = new_addr;
+		dib7000p_write_word(&st, 1287, 0x0003); /* sram lead in, rdy */
 		if (dib7000p_identify(&st) != 0) {
 			st.i2c_addr = default_addr;
+			dib7000p_write_word(&st, 1287, 0x0003); /* sram lead in, rdy */
 			if (dib7000p_identify(&st) != 0) {
 				dprintk("DiB7000P #%d: not identified\n", k);
 				return -EIO;
@@ -1372,6 +1393,8 @@ struct dvb_frontend * dib7000p_attach(struct i2c_adapter *i2c_adap, u8 i2c_addr,
 	demod->demodulator_priv = st;
 	memcpy(&st->demod.ops, &dib7000p_ops, sizeof(struct dvb_frontend_ops));
 
+    dib7000p_write_word(st, 1287, 0x0003); /* sram lead in, rdy */
+
 	if (dib7000p_identify(st) != 0)
 		goto error;
 
diff --git a/drivers/media/dvb/frontends/dib7000p.h b/drivers/media/dvb/frontends/dib7000p.h
index 02a4c82f0c70..805dd13a97ee 100644
--- a/drivers/media/dvb/frontends/dib7000p.h
+++ b/drivers/media/dvb/frontends/dib7000p.h
@@ -51,6 +51,8 @@ extern int dib7000p_i2c_enumeration(struct i2c_adapter *i2c,
 extern int dib7000p_set_gpio(struct dvb_frontend *, u8 num, u8 dir, u8 val);
 extern int dib7000p_set_wbd_ref(struct dvb_frontend *, u16 value);
 extern int dib7000pc_detection(struct i2c_adapter *i2c_adap);
+extern int dib7000p_pid_filter(struct dvb_frontend *, u8 id, u16 pid, u8 onoff);
+extern int dib7000p_pid_filter_ctrl(struct dvb_frontend *fe, u8 onoff);
 #else
 static inline
 struct dvb_frontend *dib7000p_attach(struct i2c_adapter *i2c_adap, u8 i2c_addr,
@@ -95,6 +97,17 @@ static inline int dib7000pc_detection(struct i2c_adapter *i2c_adap)
 	printk(KERN_WARNING "%s: driver disabled by Kconfig\n", __func__);
 	return -ENODEV;
 }
+static inline int dib7000p_pid_filter(struct dvb_frontend *fe, u8 id, u16 pid, u8 onoff)
+{
+    printk(KERN_WARNING "%s: driver disabled by Kconfig\n", __func__);
+    return -ENODEV;
+}
+
+static inline int dib7000p_pid_filter_ctrl(struct dvb_frontend *fe, uint8_t onoff)
+{
+    printk(KERN_WARNING "%s: driver disabled by Kconfig\n", __func__);
+    return -ENODEV;
+}
 #endif
 
 #endif
diff --git a/drivers/media/dvb/frontends/dib8000.c b/drivers/media/dvb/frontends/dib8000.c
index 852c790d09d9..6f6fa29d9ea4 100644
--- a/drivers/media/dvb/frontends/dib8000.c
+++ b/drivers/media/dvb/frontends/dib8000.c
@@ -28,18 +28,6 @@ MODULE_PARM_DESC(debug, "turn on debugging (default: 0)");
 
 #define dprintk(args...) do { if (debug) { printk(KERN_DEBUG "DiB8000: "); printk(args); printk("\n"); } } while (0)
 
-enum frontend_tune_state {
-	CT_AGC_START = 20,
-	CT_AGC_STEP_0,
-	CT_AGC_STEP_1,
-	CT_AGC_STEP_2,
-	CT_AGC_STEP_3,
-	CT_AGC_STEP_4,
-	CT_AGC_STOP,
-
-	CT_DEMOD_START = 30,
-};
-
 #define FE_STATUS_TUNE_FAILED 0
 
 struct i2c_device {
@@ -133,104 +121,104 @@ static int dib8000_write_word(struct dib8000_state *state, u16 reg, u16 val)
 	return dib8000_i2c_write16(&state->i2c, reg, val);
 }
 
-const int16_t coeff_2k_sb_1seg_dqpsk[8] = {
+static const int16_t coeff_2k_sb_1seg_dqpsk[8] = {
 	(769 << 5) | 0x0a, (745 << 5) | 0x03, (595 << 5) | 0x0d, (769 << 5) | 0x0a, (920 << 5) | 0x09, (784 << 5) | 0x02, (519 << 5) | 0x0c,
 	    (920 << 5) | 0x09
 };
 
-const int16_t coeff_2k_sb_1seg[8] = {
+static const int16_t coeff_2k_sb_1seg[8] = {
 	(692 << 5) | 0x0b, (683 << 5) | 0x01, (519 << 5) | 0x09, (692 << 5) | 0x0b, 0 | 0x1f, 0 | 0x1f, 0 | 0x1f, 0 | 0x1f
 };
 
-const int16_t coeff_2k_sb_3seg_0dqpsk_1dqpsk[8] = {
+static const int16_t coeff_2k_sb_3seg_0dqpsk_1dqpsk[8] = {
 	(832 << 5) | 0x10, (912 << 5) | 0x05, (900 << 5) | 0x12, (832 << 5) | 0x10, (-931 << 5) | 0x0f, (912 << 5) | 0x04, (807 << 5) | 0x11,
 	    (-931 << 5) | 0x0f
 };
 
-const int16_t coeff_2k_sb_3seg_0dqpsk[8] = {
+static const int16_t coeff_2k_sb_3seg_0dqpsk[8] = {
 	(622 << 5) | 0x0c, (941 << 5) | 0x04, (796 << 5) | 0x10, (622 << 5) | 0x0c, (982 << 5) | 0x0c, (519 << 5) | 0x02, (572 << 5) | 0x0e,
 	    (982 << 5) | 0x0c
 };
 
-const int16_t coeff_2k_sb_3seg_1dqpsk[8] = {
+static const int16_t coeff_2k_sb_3seg_1dqpsk[8] = {
 	(699 << 5) | 0x14, (607 << 5) | 0x04, (944 << 5) | 0x13, (699 << 5) | 0x14, (-720 << 5) | 0x0d, (640 << 5) | 0x03, (866 << 5) | 0x12,
 	    (-720 << 5) | 0x0d
 };
 
-const int16_t coeff_2k_sb_3seg[8] = {
+static const int16_t coeff_2k_sb_3seg[8] = {
 	(664 << 5) | 0x0c, (925 << 5) | 0x03, (937 << 5) | 0x10, (664 << 5) | 0x0c, (-610 << 5) | 0x0a, (697 << 5) | 0x01, (836 << 5) | 0x0e,
 	    (-610 << 5) | 0x0a
 };
 
-const int16_t coeff_4k_sb_1seg_dqpsk[8] = {
+static const int16_t coeff_4k_sb_1seg_dqpsk[8] = {
 	(-955 << 5) | 0x0e, (687 << 5) | 0x04, (818 << 5) | 0x10, (-955 << 5) | 0x0e, (-922 << 5) | 0x0d, (750 << 5) | 0x03, (665 << 5) | 0x0f,
 	    (-922 << 5) | 0x0d
 };
 
-const int16_t coeff_4k_sb_1seg[8] = {
+static const int16_t coeff_4k_sb_1seg[8] = {
 	(638 << 5) | 0x0d, (683 << 5) | 0x02, (638 << 5) | 0x0d, (638 << 5) | 0x0d, (-655 << 5) | 0x0a, (517 << 5) | 0x00, (698 << 5) | 0x0d,
 	    (-655 << 5) | 0x0a
 };
 
-const int16_t coeff_4k_sb_3seg_0dqpsk_1dqpsk[8] = {
+static const int16_t coeff_4k_sb_3seg_0dqpsk_1dqpsk[8] = {
 	(-707 << 5) | 0x14, (910 << 5) | 0x06, (889 << 5) | 0x16, (-707 << 5) | 0x14, (-958 << 5) | 0x13, (993 << 5) | 0x05, (523 << 5) | 0x14,
 	    (-958 << 5) | 0x13
 };
 
-const int16_t coeff_4k_sb_3seg_0dqpsk[8] = {
+static const int16_t coeff_4k_sb_3seg_0dqpsk[8] = {
 	(-723 << 5) | 0x13, (910 << 5) | 0x05, (777 << 5) | 0x14, (-723 << 5) | 0x13, (-568 << 5) | 0x0f, (547 << 5) | 0x03, (696 << 5) | 0x12,
 	    (-568 << 5) | 0x0f
 };
 
-const int16_t coeff_4k_sb_3seg_1dqpsk[8] = {
+static const int16_t coeff_4k_sb_3seg_1dqpsk[8] = {
 	(-940 << 5) | 0x15, (607 << 5) | 0x05, (915 << 5) | 0x16, (-940 << 5) | 0x15, (-848 << 5) | 0x13, (683 << 5) | 0x04, (543 << 5) | 0x14,
 	    (-848 << 5) | 0x13
 };
 
-const int16_t coeff_4k_sb_3seg[8] = {
+static const int16_t coeff_4k_sb_3seg[8] = {
 	(612 << 5) | 0x12, (910 << 5) | 0x04, (864 << 5) | 0x14, (612 << 5) | 0x12, (-869 << 5) | 0x13, (683 << 5) | 0x02, (869 << 5) | 0x12,
 	    (-869 << 5) | 0x13
 };
 
-const int16_t coeff_8k_sb_1seg_dqpsk[8] = {
+static const int16_t coeff_8k_sb_1seg_dqpsk[8] = {
 	(-835 << 5) | 0x12, (684 << 5) | 0x05, (735 << 5) | 0x14, (-835 << 5) | 0x12, (-598 << 5) | 0x10, (781 << 5) | 0x04, (739 << 5) | 0x13,
 	    (-598 << 5) | 0x10
 };
 
-const int16_t coeff_8k_sb_1seg[8] = {
+static const int16_t coeff_8k_sb_1seg[8] = {
 	(673 << 5) | 0x0f, (683 << 5) | 0x03, (808 << 5) | 0x12, (673 << 5) | 0x0f, (585 << 5) | 0x0f, (512 << 5) | 0x01, (780 << 5) | 0x0f,
 	    (585 << 5) | 0x0f
 };
 
-const int16_t coeff_8k_sb_3seg_0dqpsk_1dqpsk[8] = {
+static const int16_t coeff_8k_sb_3seg_0dqpsk_1dqpsk[8] = {
 	(863 << 5) | 0x17, (930 << 5) | 0x07, (878 << 5) | 0x19, (863 << 5) | 0x17, (0 << 5) | 0x14, (521 << 5) | 0x05, (980 << 5) | 0x18,
 	    (0 << 5) | 0x14
 };
 
-const int16_t coeff_8k_sb_3seg_0dqpsk[8] = {
+static const int16_t coeff_8k_sb_3seg_0dqpsk[8] = {
 	(-924 << 5) | 0x17, (910 << 5) | 0x06, (774 << 5) | 0x17, (-924 << 5) | 0x17, (-877 << 5) | 0x15, (565 << 5) | 0x04, (553 << 5) | 0x15,
 	    (-877 << 5) | 0x15
 };
 
-const int16_t coeff_8k_sb_3seg_1dqpsk[8] = {
+static const int16_t coeff_8k_sb_3seg_1dqpsk[8] = {
 	(-921 << 5) | 0x19, (607 << 5) | 0x06, (881 << 5) | 0x19, (-921 << 5) | 0x19, (-921 << 5) | 0x14, (713 << 5) | 0x05, (1018 << 5) | 0x18,
 	    (-921 << 5) | 0x14
 };
 
-const int16_t coeff_8k_sb_3seg[8] = {
+static const int16_t coeff_8k_sb_3seg[8] = {
 	(514 << 5) | 0x14, (910 << 5) | 0x05, (861 << 5) | 0x17, (514 << 5) | 0x14, (690 << 5) | 0x14, (683 << 5) | 0x03, (662 << 5) | 0x15,
 	    (690 << 5) | 0x14
 };
 
-const int16_t ana_fe_coeff_3seg[24] = {
+static const int16_t ana_fe_coeff_3seg[24] = {
 	81, 80, 78, 74, 68, 61, 54, 45, 37, 28, 19, 11, 4, 1022, 1017, 1013, 1010, 1008, 1008, 1008, 1008, 1010, 1014, 1017
 };
 
-const int16_t ana_fe_coeff_1seg[24] = {
+static const int16_t ana_fe_coeff_1seg[24] = {
 	249, 226, 164, 82, 5, 981, 970, 988, 1018, 20, 31, 26, 8, 1012, 1000, 1018, 1012, 8, 15, 14, 9, 3, 1017, 1003
 };
 
-const int16_t ana_fe_coeff_13seg[24] = {
+static const int16_t ana_fe_coeff_13seg[24] = {
 	396, 305, 105, -51, -77, -12, 41, 31, -11, -30, -11, 14, 15, -2, -13, -7, 5, 8, 1, -6, -7, -3, 0, 1
 };
 
@@ -852,6 +840,14 @@ static int dib8000_set_agc_config(struct dib8000_state *state, u8 band)
 	return 0;
 }
 
+void dib8000_pwm_agc_reset(struct dvb_frontend *fe)
+{
+	struct dib8000_state *state = fe->demodulator_priv;
+	dib8000_set_adc_state(state, DIBX000_ADC_ON);
+	dib8000_set_agc_config(state, (unsigned char)(BAND_OF_FREQUENCY(fe->dtv_property_cache.frequency / 1000)));
+}
+EXPORT_SYMBOL(dib8000_pwm_agc_reset);
+
 static int dib8000_agc_soft_split(struct dib8000_state *state)
 {
 	u16 agc, split_offset;
@@ -939,6 +935,32 @@ static int dib8000_agc_startup(struct dvb_frontend *fe)
 
 }
 
+static const int32_t lut_1000ln_mant[] =
+{
+	908, 7003, 7090, 7170, 7244, 7313, 7377, 7438, 7495, 7549, 7600
+};
+
+int32_t dib8000_get_adc_power(struct dvb_frontend *fe, uint8_t mode)
+{
+    struct dib8000_state *state = fe->demodulator_priv;
+    uint32_t ix = 0, tmp_val = 0, exp = 0, mant = 0;
+    int32_t val;
+
+    val = dib8000_read32(state, 384);
+    /* mode = 1 : ln_agcpower calc using mant-exp conversion and mantis look up table */
+    if (mode) {
+	tmp_val = val;
+	while (tmp_val >>= 1)
+		exp++;
+	mant = (val * 1000 / (1<<exp));
+	ix = (uint8_t)((mant-1000)/100); /* index of the LUT */
+	val = (lut_1000ln_mant[ix] + 693*(exp-20) - 6908); /* 1000 * ln(adcpower_real) ; 693 = 1000ln(2) ; 6908 = 1000*ln(1000) ; 20 comes from adc_real = adc_pow_int / 2**20 */
+	val = (val*256)/1000;
+    }
+    return val;
+}
+EXPORT_SYMBOL(dib8000_get_adc_power);
+
 static void dib8000_update_timf(struct dib8000_state *state)
 {
 	u32 timf = state->timf = dib8000_read32(state, 435);
@@ -954,7 +976,7 @@ static void dib8000_set_channel(struct dib8000_state *state, u8 seq, u8 autosear
 	u8 guard, crate, constellation, timeI;
 	u8 permu_seg[] = { 6, 5, 7, 4, 8, 3, 9, 2, 10, 1, 11, 0, 12 };
 	u16 i, coeff[4], P_cfr_left_edge = 0, P_cfr_right_edge = 0, seg_mask13 = 0x1fff;	// All 13 segments enabled
-	const s16 *ncoeff, *ana_fe;
+	const s16 *ncoeff = NULL, *ana_fe;
 	u16 tmcc_pow = 0;
 	u16 coff_pow = 0x2800;
 	u16 init_prbs = 0xfff;
@@ -1401,10 +1423,9 @@ static void dib8000_set_channel(struct dib8000_state *state, u8 seq, u8 autosear
 			}
 			break;
 		}
-	}
-	if (state->fe.dtv_property_cache.isdbt_sb_mode == 1)
 		for (i = 0; i < 8; i++)
 			dib8000_write_word(state, 343 + i, ncoeff[i]);
+	}
 
 	// P_small_coef_ext_enable=ISDB-Tsb, P_small_narrow_band=ISDB-Tsb, P_small_last_seg=13, P_small_offset_num_car=5
 	dib8000_write_word(state, 351,
@@ -1854,6 +1875,24 @@ static int dib8000_sleep(struct dvb_frontend *fe)
 	}
 }
 
+enum frontend_tune_state dib8000_get_tune_state(struct dvb_frontend *fe)
+{
+	struct dib8000_state *state = fe->demodulator_priv;
+	return state->tune_state;
+}
+EXPORT_SYMBOL(dib8000_get_tune_state);
+
+int dib8000_set_tune_state(struct dvb_frontend *fe, enum frontend_tune_state tune_state)
+{
+	struct dib8000_state *state = fe->demodulator_priv;
+	state->tune_state = tune_state;
+	return 0;
+}
+EXPORT_SYMBOL(dib8000_set_tune_state);
+
+
+
+
 static int dib8000_get_frontend(struct dvb_frontend *fe, struct dvb_frontend_parameters *fep)
 {
 	struct dib8000_state *state = fe->demodulator_priv;
@@ -2043,29 +2082,31 @@ static int dib8000_read_status(struct dvb_frontend *fe, fe_status_t * stat)
 
 	*stat = 0;
 
-	if ((lock >> 14) & 1)	// AGC
+	if ((lock >> 13) & 1)
 		*stat |= FE_HAS_SIGNAL;
 
-	if ((lock >> 8) & 1)	// Equal
+	if ((lock >> 8) & 1) /* Equal */
 		*stat |= FE_HAS_CARRIER;
 
-	if ((lock >> 3) & 1)	// TMCC_SYNC
+	if (((lock >> 1) & 0xf) == 0xf) /* TMCC_SYNC */
 		*stat |= FE_HAS_SYNC;
 
-	if ((lock >> 5) & 7)	// FEC MPEG
+	if (((lock >> 12) & 1) && ((lock >> 5) & 7)) /* FEC MPEG */
 		*stat |= FE_HAS_LOCK;
 
-	lock = dib8000_read_word(state, 554);	// Viterbi Layer A
-	if (lock & 0x01)
-		*stat |= FE_HAS_VITERBI;
+	if ((lock >> 12) & 1) {
+		lock = dib8000_read_word(state, 554); /* Viterbi Layer A */
+		if (lock & 0x01)
+			*stat |= FE_HAS_VITERBI;
 
-	lock = dib8000_read_word(state, 555);	// Viterbi Layer B
-	if (lock & 0x01)
-		*stat |= FE_HAS_VITERBI;
+		lock = dib8000_read_word(state, 555); /* Viterbi Layer B */
+		if (lock & 0x01)
+			*stat |= FE_HAS_VITERBI;
 
-	lock = dib8000_read_word(state, 556);	// Viterbi Layer C
-	if (lock & 0x01)
-		*stat |= FE_HAS_VITERBI;
+		lock = dib8000_read_word(state, 556); /* Viterbi Layer C */
+		if (lock & 0x01)
+			*stat |= FE_HAS_VITERBI;
+	}
 
 	return 0;
 }
@@ -2121,7 +2162,7 @@ static int dib8000_read_snr(struct dvb_frontend *fe, u16 * snr)
 	else
 		result -= intlog10(2) * 10 * noise_exp - 100;
 
-	*snr = result / (1 << 24);
+	*snr = result / ((1 << 24) / 10);
 	return 0;
 }
 
@@ -2195,6 +2236,25 @@ struct i2c_adapter *dib8000_get_i2c_master(struct dvb_frontend *fe, enum dibx000
 
 EXPORT_SYMBOL(dib8000_get_i2c_master);
 
+int dib8000_pid_filter_ctrl(struct dvb_frontend *fe, u8 onoff)
+{
+	struct dib8000_state *st = fe->demodulator_priv;
+    u16 val = dib8000_read_word(st, 299) & 0xffef;
+    val |= (onoff & 0x1) << 4;
+
+    dprintk("pid filter enabled %d", onoff);
+    return dib8000_write_word(st, 299, val);
+}
+EXPORT_SYMBOL(dib8000_pid_filter_ctrl);
+
+int dib8000_pid_filter(struct dvb_frontend *fe, u8 id, u16 pid, u8 onoff)
+{
+	struct dib8000_state *st = fe->demodulator_priv;
+    dprintk("Index %x, PID %d, OnOff %d", id, pid, onoff);
+    return dib8000_write_word(st, 305 + id, onoff ? (1 << 13) | pid : 0);
+}
+EXPORT_SYMBOL(dib8000_pid_filter);
+
 static const struct dvb_frontend_ops dib8000_ops = {
 	.info = {
 		 .name = "DiBcom 8000 ISDB-T",
diff --git a/drivers/media/dvb/frontends/dib8000.h b/drivers/media/dvb/frontends/dib8000.h
index a86de340dd54..b1ee20799639 100644
--- a/drivers/media/dvb/frontends/dib8000.h
+++ b/drivers/media/dvb/frontends/dib8000.h
@@ -44,6 +44,12 @@ extern int dib8000_i2c_enumeration(struct i2c_adapter *host, int no_of_demods, u
 
 extern int dib8000_set_gpio(struct dvb_frontend *, u8 num, u8 dir, u8 val);
 extern int dib8000_set_wbd_ref(struct dvb_frontend *, u16 value);
+extern int dib8000_pid_filter_ctrl(struct dvb_frontend *, u8 onoff);
+extern int dib8000_pid_filter(struct dvb_frontend *, u8 id, u16 pid, u8 onoff);
+extern int dib8000_set_tune_state(struct dvb_frontend *fe, enum frontend_tune_state tune_state);
+extern enum frontend_tune_state dib8000_get_tune_state(struct dvb_frontend *fe);
+extern void dib8000_pwm_agc_reset(struct dvb_frontend *fe);
+extern s32 dib8000_get_adc_power(struct dvb_frontend *fe, u8 mode);
 #else
 static inline struct dvb_frontend *dib8000_attach(struct i2c_adapter *i2c_adap, u8 i2c_addr, struct dib8000_config *cfg)
 {
@@ -57,23 +63,53 @@ static inline struct i2c_adapter *dib8000_get_i2c_master(struct dvb_frontend *fe
 	return NULL;
 }
 
-int dib8000_i2c_enumeration(struct i2c_adapter *host, int no_of_demods, u8 default_addr, u8 first_addr)
+static inline int dib8000_i2c_enumeration(struct i2c_adapter *host, int no_of_demods, u8 default_addr, u8 first_addr)
 {
 	printk(KERN_WARNING "%s: driver disabled by Kconfig\n", __func__);
 	return -ENODEV;
 }
 
-int dib8000_set_gpio(struct dvb_frontend *fe, u8 num, u8 dir, u8 val)
+static inline int dib8000_set_gpio(struct dvb_frontend *fe, u8 num, u8 dir, u8 val)
 {
 	printk(KERN_WARNING "%s: driver disabled by Kconfig\n", __func__);
 	return -ENODEV;
 }
 
-int dib8000_set_wbd_ref(struct dvb_frontend *fe, u16 value)
+static inline int dib8000_set_wbd_ref(struct dvb_frontend *fe, u16 value)
 {
 	printk(KERN_WARNING "%s: driver disabled by Kconfig\n", __func__);
 	return -ENODEV;
 }
+
+static inline int dib8000_pid_filter_ctrl(struct dvb_frontend *fe, u8 onoff)
+{
+	printk(KERN_WARNING "%s: driver disabled by Kconfig\n", __func__);
+	return -ENODEV;
+}
+
+static inline int dib8000_pid_filter(struct dvb_frontend *fe, u8 id, u16 pid, u8 onoff)
+{
+	printk(KERN_WARNING "%s: driver disabled by Kconfig\n", __func__);
+	return -ENODEV;
+}
+static inline int dib8000_set_tune_state(struct dvb_frontend *fe, enum frontend_tune_state tune_state)
+{
+	printk(KERN_WARNING "%s: driver disabled by Kconfig\n", __func__);
+	return -ENODEV;
+}
+static inline enum frontend_tune_state dib8000_get_tune_state(struct dvb_frontend *fe)
+{
+	printk(KERN_WARNING "%s: driver disabled by Kconfig\n", __func__);
+	return CT_SHUTDOWN;
+}
+static inline void dib8000_pwm_agc_reset(struct dvb_frontend *fe)
+{
+	printk(KERN_WARNING "%s: driver disabled by Kconfig\n", __func__);
+}
+static inline s32 dib8000_get_adc_power(struct dvb_frontend *fe, u8 mode)
+{
+	printk(KERN_WARNING "%s: driver disabled by Kconfig\n", __func__);
+}
 #endif
 
 #endif
diff --git a/drivers/media/dvb/frontends/dibx000_common.c b/drivers/media/dvb/frontends/dibx000_common.c
index 4efca30d2127..e6f3d73db9d3 100644
--- a/drivers/media/dvb/frontends/dibx000_common.c
+++ b/drivers/media/dvb/frontends/dibx000_common.c
@@ -6,7 +6,7 @@ static int debug;
 module_param(debug, int, 0644);
 MODULE_PARM_DESC(debug, "turn on debugging (default: 0)");
 
-#define dprintk(args...) do { if (debug) { printk(KERN_DEBUG "DiBX000: "); printk(args); } } while (0)
+#define dprintk(args...) do { if (debug) { printk(KERN_DEBUG "DiBX000: "); printk(args); printk("\n"); } } while (0)
 
 static int dibx000_write_word(struct dibx000_i2c_master *mst, u16 reg, u16 val)
 {
@@ -25,7 +25,7 @@ static int dibx000_i2c_select_interface(struct dibx000_i2c_master *mst,
 					enum dibx000_i2c_interface intf)
 {
 	if (mst->device_rev > DIB3000MC && mst->selected_interface != intf) {
-		dprintk("selecting interface: %d\n", intf);
+		dprintk("selecting interface: %d", intf);
 		mst->selected_interface = intf;
 		return dibx000_write_word(mst, mst->base_reg + 4, intf);
 	}
@@ -171,9 +171,18 @@ void dibx000_exit_i2c_master(struct dibx000_i2c_master *mst)
 {
 	i2c_del_adapter(&mst->gated_tuner_i2c_adap);
 }
-
 EXPORT_SYMBOL(dibx000_exit_i2c_master);
 
+
+u32 systime()
+{
+    struct timespec t;
+
+    t = current_kernel_time();
+    return (t.tv_sec * 10000) + (t.tv_nsec / 100000);
+}
+EXPORT_SYMBOL(systime);
+
 MODULE_AUTHOR("Patrick Boettcher <pboettcher@dibcom.fr>");
 MODULE_DESCRIPTION("Common function the DiBcom demodulator family");
 MODULE_LICENSE("GPL");
diff --git a/drivers/media/dvb/frontends/dibx000_common.h b/drivers/media/dvb/frontends/dibx000_common.h
index 5be10eca07c0..4f5d141a308d 100644
--- a/drivers/media/dvb/frontends/dibx000_common.h
+++ b/drivers/media/dvb/frontends/dibx000_common.h
@@ -36,13 +36,17 @@ extern struct i2c_adapter *dibx000_get_i2c_adapter(struct dibx000_i2c_master
 extern void dibx000_exit_i2c_master(struct dibx000_i2c_master *mst);
 extern void dibx000_reset_i2c_master(struct dibx000_i2c_master *mst);
 
+extern u32 systime(void);
+
 #define BAND_LBAND 0x01
 #define BAND_UHF   0x02
 #define BAND_VHF   0x04
 #define BAND_SBAND 0x08
-#define BAND_FM	   0x10
+#define BAND_FM    0x10
+#define BAND_CBAND 0x20
 
-#define BAND_OF_FREQUENCY(freq_kHz) ( (freq_kHz) <= 115000 ? BAND_FM : \
+#define BAND_OF_FREQUENCY(freq_kHz) ((freq_kHz) <= 170000 ? BAND_CBAND : \
+									(freq_kHz) <= 115000 ? BAND_FM : \
 									(freq_kHz) <= 250000 ? BAND_VHF : \
 									(freq_kHz) <= 863000 ? BAND_UHF : \
 									(freq_kHz) <= 2000000 ? BAND_LBAND : BAND_SBAND )
@@ -149,4 +153,67 @@ enum dibx000_adc_states {
 #define OUTMODE_MPEG2_FIFO          5
 #define OUTMODE_ANALOG_ADC          6
 
+enum frontend_tune_state {
+    CT_TUNER_START = 10,
+    CT_TUNER_STEP_0,
+    CT_TUNER_STEP_1,
+    CT_TUNER_STEP_2,
+    CT_TUNER_STEP_3,
+    CT_TUNER_STEP_4,
+    CT_TUNER_STEP_5,
+    CT_TUNER_STEP_6,
+    CT_TUNER_STEP_7,
+    CT_TUNER_STOP,
+
+    CT_AGC_START = 20,
+    CT_AGC_STEP_0,
+    CT_AGC_STEP_1,
+    CT_AGC_STEP_2,
+    CT_AGC_STEP_3,
+    CT_AGC_STEP_4,
+    CT_AGC_STOP,
+
+	CT_DEMOD_START = 30,
+    CT_DEMOD_STEP_1,
+    CT_DEMOD_STEP_2,
+    CT_DEMOD_STEP_3,
+    CT_DEMOD_STEP_4,
+    CT_DEMOD_STEP_5,
+    CT_DEMOD_STEP_6,
+    CT_DEMOD_STEP_7,
+    CT_DEMOD_STEP_8,
+    CT_DEMOD_STEP_9,
+    CT_DEMOD_STEP_10,
+    CT_DEMOD_SEARCH_NEXT = 41,
+    CT_DEMOD_STEP_LOCKED,
+    CT_DEMOD_STOP,
+
+    CT_DONE = 100,
+    CT_SHUTDOWN,
+
+};
+
+struct dvb_frontend_parametersContext {
+#define CHANNEL_STATUS_PARAMETERS_UNKNOWN   0x01
+#define CHANNEL_STATUS_PARAMETERS_SET       0x02
+    u8 status;
+    u32 tune_time_estimation[2];
+    s32 tps_available;
+    u16 tps[9];
+};
+
+#define FE_STATUS_TUNE_FAILED          0
+#define FE_STATUS_TUNE_TIMED_OUT      -1
+#define FE_STATUS_TUNE_TIME_TOO_SHORT -2
+#define FE_STATUS_TUNE_PENDING        -3
+#define FE_STATUS_STD_SUCCESS         -4
+#define FE_STATUS_FFT_SUCCESS         -5
+#define FE_STATUS_DEMOD_SUCCESS       -6
+#define FE_STATUS_LOCKED              -7
+#define FE_STATUS_DATA_LOCKED         -8
+
+#define FE_CALLBACK_TIME_NEVER 0xffffffff
+
+#define ABS(x) ((x < 0) ? (-x) : (x))
+
 #endif
diff --git a/drivers/media/dvb/frontends/drx397xD.c b/drivers/media/dvb/frontends/drx397xD.c
index 010075535221..868b78bfae75 100644
--- a/drivers/media/dvb/frontends/drx397xD.c
+++ b/drivers/media/dvb/frontends/drx397xD.c
@@ -81,7 +81,7 @@ static struct {
 #include "drx397xD_fw.h"
 };
 
-/* use only with writer lock aquired */
+/* use only with writer lock acquired */
 static void _drx_release_fw(struct drx397xD_state *s, enum fw_ix ix)
 {
 	memset(&fw[ix].data[0], 0, sizeof(fw[0].data));
diff --git a/drivers/media/dvb/frontends/ds3000.c b/drivers/media/dvb/frontends/ds3000.c
new file mode 100644
index 000000000000..cff3535566fe
--- /dev/null
+++ b/drivers/media/dvb/frontends/ds3000.c
@@ -0,0 +1,1367 @@
+/*
+    Montage Technology DS3000/TS2020 - DVBS/S2 Demodulator/Tuner driver
+    Copyright (C) 2009 Konstantin Dimitrov <kosio.dimitrov@gmail.com>
+
+    Copyright (C) 2009 TurboSight.com
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program; if not, write to the Free Software
+    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include <linux/slab.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/init.h>
+#include <linux/firmware.h>
+
+#include "dvb_frontend.h"
+#include "ds3000.h"
+
+static int debug;
+
+#define dprintk(args...) \
+	do { \
+		if (debug) \
+			printk(args); \
+	} while (0)
+
+/* as of March 2009 current DS3000 firmware version is 1.78 */
+/* DS3000 FW v1.78 MD5: a32d17910c4f370073f9346e71d34b80 */
+#define DS3000_DEFAULT_FIRMWARE "dvb-fe-ds3000.fw"
+
+#define DS3000_SAMPLE_RATE 96000 /* in kHz */
+#define DS3000_XTAL_FREQ   27000 /* in kHz */
+
+/* Register values to initialise the demod in DVB-S mode */
+static u8 ds3000_dvbs_init_tab[] = {
+	0x23, 0x05,
+	0x08, 0x03,
+	0x0c, 0x00,
+	0x21, 0x54,
+	0x25, 0x82,
+	0x27, 0x31,
+	0x30, 0x08,
+	0x31, 0x40,
+	0x32, 0x32,
+	0x33, 0x35,
+	0x35, 0xff,
+	0x3a, 0x00,
+	0x37, 0x10,
+	0x38, 0x10,
+	0x39, 0x02,
+	0x42, 0x60,
+	0x4a, 0x40,
+	0x4b, 0x04,
+	0x4d, 0x91,
+	0x5d, 0xc8,
+	0x50, 0x77,
+	0x51, 0x77,
+	0x52, 0x36,
+	0x53, 0x36,
+	0x56, 0x01,
+	0x63, 0x43,
+	0x64, 0x30,
+	0x65, 0x40,
+	0x68, 0x26,
+	0x69, 0x4c,
+	0x70, 0x20,
+	0x71, 0x70,
+	0x72, 0x04,
+	0x73, 0x00,
+	0x70, 0x40,
+	0x71, 0x70,
+	0x72, 0x04,
+	0x73, 0x00,
+	0x70, 0x60,
+	0x71, 0x70,
+	0x72, 0x04,
+	0x73, 0x00,
+	0x70, 0x80,
+	0x71, 0x70,
+	0x72, 0x04,
+	0x73, 0x00,
+	0x70, 0xa0,
+	0x71, 0x70,
+	0x72, 0x04,
+	0x73, 0x00,
+	0x70, 0x1f,
+	0x76, 0x00,
+	0x77, 0xd1,
+	0x78, 0x0c,
+	0x79, 0x80,
+	0x7f, 0x04,
+	0x7c, 0x00,
+	0x80, 0x86,
+	0x81, 0xa6,
+	0x85, 0x04,
+	0xcd, 0xf4,
+	0x90, 0x33,
+	0xa0, 0x44,
+	0xc0, 0x18,
+	0xc3, 0x10,
+	0xc4, 0x08,
+	0xc5, 0x80,
+	0xc6, 0x80,
+	0xc7, 0x0a,
+	0xc8, 0x1a,
+	0xc9, 0x80,
+	0xfe, 0x92,
+	0xe0, 0xf8,
+	0xe6, 0x8b,
+	0xd0, 0x40,
+	0xf8, 0x20,
+	0xfa, 0x0f,
+	0xfd, 0x20,
+	0xad, 0x20,
+	0xae, 0x07,
+	0xb8, 0x00,
+};
+
+/* Register values to initialise the demod in DVB-S2 mode */
+static u8 ds3000_dvbs2_init_tab[] = {
+	0x23, 0x0f,
+	0x08, 0x07,
+	0x0c, 0x00,
+	0x21, 0x54,
+	0x25, 0x82,
+	0x27, 0x31,
+	0x30, 0x08,
+	0x31, 0x32,
+	0x32, 0x32,
+	0x33, 0x35,
+	0x35, 0xff,
+	0x3a, 0x00,
+	0x37, 0x10,
+	0x38, 0x10,
+	0x39, 0x02,
+	0x42, 0x60,
+	0x4a, 0x80,
+	0x4b, 0x04,
+	0x4d, 0x81,
+	0x5d, 0x88,
+	0x50, 0x36,
+	0x51, 0x36,
+	0x52, 0x36,
+	0x53, 0x36,
+	0x63, 0x60,
+	0x64, 0x10,
+	0x65, 0x10,
+	0x68, 0x04,
+	0x69, 0x29,
+	0x70, 0x20,
+	0x71, 0x70,
+	0x72, 0x04,
+	0x73, 0x00,
+	0x70, 0x40,
+	0x71, 0x70,
+	0x72, 0x04,
+	0x73, 0x00,
+	0x70, 0x60,
+	0x71, 0x70,
+	0x72, 0x04,
+	0x73, 0x00,
+	0x70, 0x80,
+	0x71, 0x70,
+	0x72, 0x04,
+	0x73, 0x00,
+	0x70, 0xa0,
+	0x71, 0x70,
+	0x72, 0x04,
+	0x73, 0x00,
+	0x70, 0x1f,
+	0xa0, 0x44,
+	0xc0, 0x08,
+	0xc1, 0x10,
+	0xc2, 0x08,
+	0xc3, 0x10,
+	0xc4, 0x08,
+	0xc5, 0xf0,
+	0xc6, 0xf0,
+	0xc7, 0x0a,
+	0xc8, 0x1a,
+	0xc9, 0x80,
+	0xca, 0x23,
+	0xcb, 0x24,
+	0xce, 0x74,
+	0x90, 0x03,
+	0x76, 0x80,
+	0x77, 0x42,
+	0x78, 0x0a,
+	0x79, 0x80,
+	0xad, 0x40,
+	0xae, 0x07,
+	0x7f, 0xd4,
+	0x7c, 0x00,
+	0x80, 0xa8,
+	0x81, 0xda,
+	0x7c, 0x01,
+	0x80, 0xda,
+	0x81, 0xec,
+	0x7c, 0x02,
+	0x80, 0xca,
+	0x81, 0xeb,
+	0x7c, 0x03,
+	0x80, 0xba,
+	0x81, 0xdb,
+	0x85, 0x08,
+	0x86, 0x00,
+	0x87, 0x02,
+	0x89, 0x80,
+	0x8b, 0x44,
+	0x8c, 0xaa,
+	0x8a, 0x10,
+	0xba, 0x00,
+	0xf5, 0x04,
+	0xfe, 0x44,
+	0xd2, 0x32,
+	0xb8, 0x00,
+};
+
+/* DS3000 doesn't need some parameters as input and auto-detects them */
+/* save input from the application of those parameters */
+struct ds3000_tuning {
+	u32 frequency;
+	u32 symbol_rate;
+	fe_spectral_inversion_t inversion;
+	enum fe_code_rate fec;
+
+	/* input values */
+	u8 inversion_val;
+	fe_modulation_t delivery;
+	u8 rolloff;
+};
+
+struct ds3000_state {
+	struct i2c_adapter *i2c;
+	const struct ds3000_config *config;
+
+	struct dvb_frontend frontend;
+
+	struct ds3000_tuning dcur;
+	struct ds3000_tuning dnxt;
+
+	u8 skip_fw_load;
+
+	/* previous uncorrected block counter for DVB-S2 */
+	u16 prevUCBS2;
+};
+
+static int ds3000_writereg(struct ds3000_state *state, int reg, int data)
+{
+	u8 buf[] = { reg, data };
+	struct i2c_msg msg = { .addr = state->config->demod_address,
+		.flags = 0, .buf = buf, .len = 2 };
+	int err;
+
+	dprintk("%s: write reg 0x%02x, value 0x%02x\n", __func__, reg, data);
+
+	err = i2c_transfer(state->i2c, &msg, 1);
+	if (err != 1) {
+		printk(KERN_ERR "%s: writereg error(err == %i, reg == 0x%02x,"
+			 " value == 0x%02x)\n", __func__, err, reg, data);
+		return -EREMOTEIO;
+	}
+
+	return 0;
+}
+
+static int ds3000_tuner_writereg(struct ds3000_state *state, int reg, int data)
+{
+	u8 buf[] = { reg, data };
+	struct i2c_msg msg = { .addr = 0x60,
+		.flags = 0, .buf = buf, .len = 2 };
+	int err;
+
+	dprintk("%s: write reg 0x%02x, value 0x%02x\n", __func__, reg, data);
+
+	ds3000_writereg(state, 0x03, 0x11);
+	err = i2c_transfer(state->i2c, &msg, 1);
+	if (err != 1) {
+		printk("%s: writereg error(err == %i, reg == 0x%02x,"
+			 " value == 0x%02x)\n", __func__, err, reg, data);
+		return -EREMOTEIO;
+	}
+
+	return 0;
+}
+
+/* I2C write for 8k firmware load */
+static int ds3000_writeFW(struct ds3000_state *state, int reg,
+				const u8 *data, u16 len)
+{
+	int i, ret = -EREMOTEIO;
+	struct i2c_msg msg;
+	u8 *buf;
+
+	buf = kmalloc(3, GFP_KERNEL);
+	if (buf == NULL) {
+		printk(KERN_ERR "Unable to kmalloc\n");
+		ret = -ENOMEM;
+		goto error;
+	}
+
+	*(buf) = reg;
+
+	msg.addr = state->config->demod_address;
+	msg.flags = 0;
+	msg.buf = buf;
+	msg.len = 3;
+
+	for (i = 0; i < len; i += 2) {
+		memcpy(buf + 1, data + i, 2);
+
+		dprintk("%s: write reg 0x%02x, len = %d\n", __func__, reg, len);
+
+		ret = i2c_transfer(state->i2c, &msg, 1);
+		if (ret != 1) {
+			printk(KERN_ERR "%s: write error(err == %i, "
+				"reg == 0x%02x\n", __func__, ret, reg);
+			ret = -EREMOTEIO;
+		}
+	}
+
+error:
+	kfree(buf);
+
+	return ret;
+}
+
+static int ds3000_readreg(struct ds3000_state *state, u8 reg)
+{
+	int ret;
+	u8 b0[] = { reg };
+	u8 b1[] = { 0 };
+	struct i2c_msg msg[] = {
+		{
+			.addr = state->config->demod_address,
+			.flags = 0,
+			.buf = b0,
+			.len = 1
+		}, {
+			.addr = state->config->demod_address,
+			.flags = I2C_M_RD,
+			.buf = b1,
+			.len = 1
+		}
+	};
+
+	ret = i2c_transfer(state->i2c, msg, 2);
+
+	if (ret != 2) {
+		printk(KERN_ERR "%s: reg=0x%x(error=%d)\n", __func__, reg, ret);
+		return ret;
+	}
+
+	dprintk("%s: read reg 0x%02x, value 0x%02x\n", __func__, reg, b1[0]);
+
+	return b1[0];
+}
+
+static int ds3000_tuner_readreg(struct ds3000_state *state, u8 reg)
+{
+	int ret;
+	u8 b0[] = { reg };
+	u8 b1[] = { 0 };
+	struct i2c_msg msg[] = {
+		{
+			.addr = 0x60,
+			.flags = 0,
+			.buf = b0,
+			.len = 1
+		}, {
+			.addr = 0x60,
+			.flags = I2C_M_RD,
+			.buf = b1,
+			.len = 1
+		}
+	};
+
+	ds3000_writereg(state, 0x03, 0x12);
+	ret = i2c_transfer(state->i2c, msg, 2);
+
+	if (ret != 2) {
+		printk(KERN_ERR "%s: reg=0x%x(error=%d)\n", __func__, reg, ret);
+		return ret;
+	}
+
+	dprintk("%s: read reg 0x%02x, value 0x%02x\n", __func__, reg, b1[0]);
+
+	return b1[0];
+}
+
+static int ds3000_set_inversion(struct ds3000_state *state,
+					fe_spectral_inversion_t inversion)
+{
+	dprintk("%s(%d)\n", __func__, inversion);
+
+	switch (inversion) {
+	case INVERSION_OFF:
+	case INVERSION_ON:
+	case INVERSION_AUTO:
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	state->dnxt.inversion = inversion;
+
+	return 0;
+}
+
+static int ds3000_set_symbolrate(struct ds3000_state *state, u32 rate)
+{
+	int ret = 0;
+
+	dprintk("%s()\n", __func__);
+
+	dprintk("%s() symbol_rate = %d\n", __func__, state->dnxt.symbol_rate);
+
+	/*  check if symbol rate is within limits */
+	if ((state->dnxt.symbol_rate >
+				state->frontend.ops.info.symbol_rate_max) ||
+	    (state->dnxt.symbol_rate <
+				state->frontend.ops.info.symbol_rate_min))
+		ret = -EOPNOTSUPP;
+
+	state->dnxt.symbol_rate = rate;
+
+	return ret;
+}
+
+static int ds3000_load_firmware(struct dvb_frontend *fe,
+					const struct firmware *fw);
+
+static int ds3000_firmware_ondemand(struct dvb_frontend *fe)
+{
+	struct ds3000_state *state = fe->demodulator_priv;
+	const struct firmware *fw;
+	int ret = 0;
+
+	dprintk("%s()\n", __func__);
+
+	if (ds3000_readreg(state, 0xb2) <= 0)
+		return ret;
+
+	if (state->skip_fw_load)
+		return 0;
+	/* Load firmware */
+	/* request the firmware, this will block until someone uploads it */
+	printk(KERN_INFO "%s: Waiting for firmware upload (%s)...\n", __func__,
+				DS3000_DEFAULT_FIRMWARE);
+	ret = request_firmware(&fw, DS3000_DEFAULT_FIRMWARE,
+				state->i2c->dev.parent);
+	printk(KERN_INFO "%s: Waiting for firmware upload(2)...\n", __func__);
+	if (ret) {
+		printk(KERN_ERR "%s: No firmware uploaded (timeout or file not "
+				"found?)\n", __func__);
+		return ret;
+	}
+
+	/* Make sure we don't recurse back through here during loading */
+	state->skip_fw_load = 1;
+
+	ret = ds3000_load_firmware(fe, fw);
+	if (ret)
+		printk("%s: Writing firmware to device failed\n", __func__);
+
+	release_firmware(fw);
+
+	dprintk("%s: Firmware upload %s\n", __func__,
+			ret == 0 ? "complete" : "failed");
+
+	/* Ensure firmware is always loaded if required */
+	state->skip_fw_load = 0;
+
+	return ret;
+}
+
+static int ds3000_load_firmware(struct dvb_frontend *fe,
+					const struct firmware *fw)
+{
+	struct ds3000_state *state = fe->demodulator_priv;
+
+	dprintk("%s\n", __func__);
+	dprintk("Firmware is %zu bytes (%02x %02x .. %02x %02x)\n",
+			fw->size,
+			fw->data[0],
+			fw->data[1],
+			fw->data[fw->size - 2],
+			fw->data[fw->size - 1]);
+
+	/* Begin the firmware load process */
+	ds3000_writereg(state, 0xb2, 0x01);
+	/* write the entire firmware */
+	ds3000_writeFW(state, 0xb0, fw->data, fw->size);
+	ds3000_writereg(state, 0xb2, 0x00);
+
+	return 0;
+}
+
+static void ds3000_dump_registers(struct dvb_frontend *fe)
+{
+	struct ds3000_state *state = fe->demodulator_priv;
+	int x, y, reg = 0, val;
+
+	for (y = 0; y < 16; y++) {
+		dprintk("%s: %02x: ", __func__, y);
+		for (x = 0; x < 16; x++) {
+			reg = (y << 4) + x;
+			val = ds3000_readreg(state, reg);
+			if (x != 15)
+				dprintk("%02x ",  val);
+			else
+				dprintk("%02x\n", val);
+		}
+	}
+	dprintk("%s: -- DS3000 DUMP DONE --\n", __func__);
+}
+
+static int ds3000_read_status(struct dvb_frontend *fe, fe_status_t* status)
+{
+	struct ds3000_state *state = fe->demodulator_priv;
+	struct dtv_frontend_properties *c = &fe->dtv_property_cache;
+	int lock;
+
+	*status = 0;
+
+	switch (c->delivery_system) {
+	case SYS_DVBS:
+		lock = ds3000_readreg(state, 0xd1);
+		if ((lock & 0x07) == 0x07)
+			*status = FE_HAS_SIGNAL | FE_HAS_CARRIER |
+				FE_HAS_VITERBI | FE_HAS_SYNC |
+				FE_HAS_LOCK;
+
+		break;
+	case SYS_DVBS2:
+		lock = ds3000_readreg(state, 0x0d);
+		if ((lock & 0x8f) == 0x8f)
+			*status = FE_HAS_SIGNAL | FE_HAS_CARRIER |
+				FE_HAS_VITERBI | FE_HAS_SYNC |
+				FE_HAS_LOCK;
+
+		break;
+	default:
+		return 1;
+	}
+
+	dprintk("%s: status = 0x%02x\n", __func__, lock);
+
+	return 0;
+}
+
+#define FE_IS_TUNED (FE_HAS_SIGNAL + FE_HAS_LOCK)
+static int ds3000_is_tuned(struct dvb_frontend *fe)
+{
+	fe_status_t tunerstat;
+
+	ds3000_read_status(fe, &tunerstat);
+
+	return ((tunerstat & FE_IS_TUNED) == FE_IS_TUNED);
+}
+
+/* read DS3000 BER value */
+static int ds3000_read_ber(struct dvb_frontend *fe, u32* ber)
+{
+	struct ds3000_state *state = fe->demodulator_priv;
+	struct dtv_frontend_properties *c = &fe->dtv_property_cache;
+	u8 data;
+	u32 ber_reading, lpdc_frames;
+
+	dprintk("%s()\n", __func__);
+
+	switch (c->delivery_system) {
+	case SYS_DVBS:
+		/* set the number of bytes checked during
+		BER estimation */
+		ds3000_writereg(state, 0xf9, 0x04);
+		/* read BER estimation status */
+		data = ds3000_readreg(state, 0xf8);
+		/* check if BER estimation is ready */
+		if ((data & 0x10) == 0) {
+			/* this is the number of error bits,
+			to calculate the bit error rate
+			divide to 8388608 */
+			*ber = (ds3000_readreg(state, 0xf7) << 8) |
+				ds3000_readreg(state, 0xf6);
+			/* start counting error bits */
+			/* need to be set twice
+			otherwise it fails sometimes */
+			data |= 0x10;
+			ds3000_writereg(state, 0xf8, data);
+			ds3000_writereg(state, 0xf8, data);
+		} else
+			/* used to indicate that BER estimation
+			is not ready, i.e. BER is unknown */
+			*ber = 0xffffffff;
+		break;
+	case SYS_DVBS2:
+		/* read the number of LPDC decoded frames */
+		lpdc_frames = (ds3000_readreg(state, 0xd7) << 16) |
+				(ds3000_readreg(state, 0xd6) << 8) |
+				ds3000_readreg(state, 0xd5);
+		/* read the number of packets with bad CRC */
+		ber_reading = (ds3000_readreg(state, 0xf8) << 8) |
+				ds3000_readreg(state, 0xf7);
+		if (lpdc_frames > 750) {
+			/* clear LPDC frame counters */
+			ds3000_writereg(state, 0xd1, 0x01);
+			/* clear bad packets counter */
+			ds3000_writereg(state, 0xf9, 0x01);
+			/* enable bad packets counter */
+			ds3000_writereg(state, 0xf9, 0x00);
+			/* enable LPDC frame counters */
+			ds3000_writereg(state, 0xd1, 0x00);
+			*ber = ber_reading;
+		} else
+			/* used to indicate that BER estimation is not ready,
+			i.e. BER is unknown */
+			*ber = 0xffffffff;
+		break;
+	default:
+		return 1;
+	}
+
+	return 0;
+}
+
+/* read TS2020 signal strength */
+static int ds3000_read_signal_strength(struct dvb_frontend *fe,
+						u16 *signal_strength)
+{
+	struct ds3000_state *state = fe->demodulator_priv;
+	u16 sig_reading, sig_strength;
+	u8 rfgain, bbgain;
+
+	dprintk("%s()\n", __func__);
+
+	rfgain = ds3000_tuner_readreg(state, 0x3d) & 0x1f;
+	bbgain = ds3000_tuner_readreg(state, 0x21) & 0x1f;
+
+	if (rfgain > 15)
+		rfgain = 15;
+	if (bbgain > 13)
+		bbgain = 13;
+
+	sig_reading = rfgain * 2 + bbgain * 3;
+
+	sig_strength = 40 + (64 - sig_reading) * 50 / 64 ;
+
+	/* cook the value to be suitable for szap-s2 human readable output */
+	*signal_strength = sig_strength * 1000;
+
+	dprintk("%s: raw / cooked = 0x%04x / 0x%04x\n", __func__,
+			sig_reading, *signal_strength);
+
+	return 0;
+}
+
+/* calculate DS3000 snr value in dB */
+static int ds3000_read_snr(struct dvb_frontend *fe, u16 *snr)
+{
+	struct ds3000_state *state = fe->demodulator_priv;
+	struct dtv_frontend_properties *c = &fe->dtv_property_cache;
+	u8 snr_reading, snr_value;
+	u32 dvbs2_signal_reading, dvbs2_noise_reading, tmp;
+	static const u16 dvbs_snr_tab[] = { /* 20 x Table (rounded up) */
+		0x0000, 0x1b13, 0x2aea, 0x3627, 0x3ede, 0x45fe, 0x4c03,
+		0x513a, 0x55d4, 0x59f2, 0x5dab, 0x6111, 0x6431, 0x6717,
+		0x69c9, 0x6c4e, 0x6eac, 0x70e8, 0x7304, 0x7505
+	};
+	static const u16 dvbs2_snr_tab[] = { /* 80 x Table (rounded up) */
+		0x0000, 0x0bc2, 0x12a3, 0x1785, 0x1b4e, 0x1e65, 0x2103,
+		0x2347, 0x2546, 0x2710, 0x28ae, 0x2a28, 0x2b83, 0x2cc5,
+		0x2df1, 0x2f09, 0x3010, 0x3109, 0x31f4, 0x32d2, 0x33a6,
+		0x3470, 0x3531, 0x35ea, 0x369b, 0x3746, 0x37ea, 0x3888,
+		0x3920, 0x39b3, 0x3a42, 0x3acc, 0x3b51, 0x3bd3, 0x3c51,
+		0x3ccb, 0x3d42, 0x3db6, 0x3e27, 0x3e95, 0x3f00, 0x3f68,
+		0x3fcf, 0x4033, 0x4094, 0x40f4, 0x4151, 0x41ac, 0x4206,
+		0x425e, 0x42b4, 0x4308, 0x435b, 0x43ac, 0x43fc, 0x444a,
+		0x4497, 0x44e2, 0x452d, 0x4576, 0x45bd, 0x4604, 0x4649,
+		0x468e, 0x46d1, 0x4713, 0x4755, 0x4795, 0x47d4, 0x4813,
+		0x4851, 0x488d, 0x48c9, 0x4904, 0x493f, 0x4978, 0x49b1,
+		0x49e9, 0x4a20, 0x4a57
+	};
+
+	dprintk("%s()\n", __func__);
+
+	switch (c->delivery_system) {
+	case SYS_DVBS:
+		snr_reading = ds3000_readreg(state, 0xff);
+		snr_reading /= 8;
+		if (snr_reading == 0)
+			*snr = 0x0000;
+		else {
+			if (snr_reading > 20)
+				snr_reading = 20;
+			snr_value = dvbs_snr_tab[snr_reading - 1] * 10 / 23026;
+			/* cook the value to be suitable for szap-s2
+			human readable output */
+			*snr = snr_value * 8 * 655;
+		}
+		dprintk("%s: raw / cooked = 0x%02x / 0x%04x\n", __func__,
+				snr_reading, *snr);
+		break;
+	case SYS_DVBS2:
+		dvbs2_noise_reading = (ds3000_readreg(state, 0x8c) & 0x3f) +
+				(ds3000_readreg(state, 0x8d) << 4);
+		dvbs2_signal_reading = ds3000_readreg(state, 0x8e);
+		tmp = dvbs2_signal_reading * dvbs2_signal_reading >> 1;
+		if (dvbs2_signal_reading == 0) {
+			*snr = 0x0000;
+			return 0;
+		}
+		if (dvbs2_noise_reading == 0) {
+			snr_value = 0x0013;
+			/* cook the value to be suitable for szap-s2
+			human readable output */
+			*snr = 0xffff;
+			return 0;
+		}
+		if (tmp > dvbs2_noise_reading) {
+			snr_reading = tmp / dvbs2_noise_reading;
+			if (snr_reading > 80)
+				snr_reading = 80;
+			snr_value = dvbs2_snr_tab[snr_reading - 1] / 1000;
+			/* cook the value to be suitable for szap-s2
+			human readable output */
+			*snr = snr_value * 5 * 655;
+		} else {
+			snr_reading = dvbs2_noise_reading / tmp;
+			if (snr_reading > 80)
+				snr_reading = 80;
+			*snr = -(dvbs2_snr_tab[snr_reading] / 1000);
+		}
+		dprintk("%s: raw / cooked = 0x%02x / 0x%04x\n", __func__,
+				snr_reading, *snr);
+		break;
+	default:
+		return 1;
+	}
+
+	return 0;
+}
+
+/* read DS3000 uncorrected blocks */
+static int ds3000_read_ucblocks(struct dvb_frontend *fe, u32 *ucblocks)
+{
+	struct ds3000_state *state = fe->demodulator_priv;
+	struct dtv_frontend_properties *c = &fe->dtv_property_cache;
+	u8 data;
+	u16 _ucblocks;
+
+	dprintk("%s()\n", __func__);
+
+	switch (c->delivery_system) {
+	case SYS_DVBS:
+		*ucblocks = (ds3000_readreg(state, 0xf5) << 8) |
+				ds3000_readreg(state, 0xf4);
+		data = ds3000_readreg(state, 0xf8);
+		/* clear packet counters */
+		data &= ~0x20;
+		ds3000_writereg(state, 0xf8, data);
+		/* enable packet counters */
+		data |= 0x20;
+		ds3000_writereg(state, 0xf8, data);
+		break;
+	case SYS_DVBS2:
+		_ucblocks = (ds3000_readreg(state, 0xe2) << 8) |
+				ds3000_readreg(state, 0xe1);
+		if (_ucblocks > state->prevUCBS2)
+			*ucblocks = _ucblocks - state->prevUCBS2;
+		else
+			*ucblocks = state->prevUCBS2 - _ucblocks;
+		state->prevUCBS2 = _ucblocks;
+		break;
+	default:
+		return 1;
+	}
+
+	return 0;
+}
+
+/* Overwrite the current tuning params, we are about to tune */
+static void ds3000_clone_params(struct dvb_frontend *fe)
+{
+	struct ds3000_state *state = fe->demodulator_priv;
+	memcpy(&state->dcur, &state->dnxt, sizeof(state->dcur));
+}
+
+static int ds3000_set_tone(struct dvb_frontend *fe, fe_sec_tone_mode_t tone)
+{
+	struct ds3000_state *state = fe->demodulator_priv;
+	u8 data;
+
+	dprintk("%s(%d)\n", __func__, tone);
+	if ((tone != SEC_TONE_ON) && (tone != SEC_TONE_OFF)) {
+		printk(KERN_ERR "%s: Invalid, tone=%d\n", __func__, tone);
+		return -EINVAL;
+	}
+
+	data = ds3000_readreg(state, 0xa2);
+	data &= ~0xc0;
+	ds3000_writereg(state, 0xa2, data);
+
+	switch (tone) {
+	case SEC_TONE_ON:
+		dprintk("%s: setting tone on\n", __func__);
+		data = ds3000_readreg(state, 0xa1);
+		data &= ~0x43;
+		data |= 0x04;
+		ds3000_writereg(state, 0xa1, data);
+		break;
+	case SEC_TONE_OFF:
+		dprintk("%s: setting tone off\n", __func__);
+		data = ds3000_readreg(state, 0xa2);
+		data |= 0x80;
+		ds3000_writereg(state, 0xa2, data);
+		break;
+	}
+
+	return 0;
+}
+
+static int ds3000_send_diseqc_msg(struct dvb_frontend *fe,
+				struct dvb_diseqc_master_cmd *d)
+{
+	struct ds3000_state *state = fe->demodulator_priv;
+	int i;
+	u8 data;
+
+	/* Dump DiSEqC message */
+	dprintk("%s(", __func__);
+	for (i = 0 ; i < d->msg_len;) {
+		dprintk("0x%02x", d->msg[i]);
+		if (++i < d->msg_len)
+			dprintk(", ");
+	}
+
+	/* enable DiSEqC message send pin */
+	data = ds3000_readreg(state, 0xa2);
+	data &= ~0xc0;
+	ds3000_writereg(state, 0xa2, data);
+
+	/* DiSEqC message */
+	for (i = 0; i < d->msg_len; i++)
+		ds3000_writereg(state, 0xa3 + i, d->msg[i]);
+
+	data = ds3000_readreg(state, 0xa1);
+	/* clear DiSEqC message length and status,
+	enable DiSEqC message send */
+	data &= ~0xf8;
+	/* set DiSEqC mode, modulation active during 33 pulses,
+	set DiSEqC message length */
+	data |= ((d->msg_len - 1) << 3) | 0x07;
+	ds3000_writereg(state, 0xa1, data);
+
+	/* wait up to 150ms for DiSEqC transmission to complete */
+	for (i = 0; i < 15; i++) {
+		data = ds3000_readreg(state, 0xa1);
+		if ((data & 0x40) == 0)
+			break;
+		msleep(10);
+	}
+
+	/* DiSEqC timeout after 150ms */
+	if (i == 15) {
+		data = ds3000_readreg(state, 0xa1);
+		data &= ~0x80;
+		data |= 0x40;
+		ds3000_writereg(state, 0xa1, data);
+
+		data = ds3000_readreg(state, 0xa2);
+		data &= ~0xc0;
+		data |= 0x80;
+		ds3000_writereg(state, 0xa2, data);
+
+		return 1;
+	}
+
+	data = ds3000_readreg(state, 0xa2);
+	data &= ~0xc0;
+	data |= 0x80;
+	ds3000_writereg(state, 0xa2, data);
+
+	return 0;
+}
+
+/* Send DiSEqC burst */
+static int ds3000_diseqc_send_burst(struct dvb_frontend *fe,
+					fe_sec_mini_cmd_t burst)
+{
+	struct ds3000_state *state = fe->demodulator_priv;
+	int i;
+	u8 data;
+
+	dprintk("%s()\n", __func__);
+
+	data = ds3000_readreg(state, 0xa2);
+	data &= ~0xc0;
+	ds3000_writereg(state, 0xa2, data);
+
+	/* DiSEqC burst */
+	if (burst == SEC_MINI_A)
+		/* Unmodulated tone burst */
+		ds3000_writereg(state, 0xa1, 0x02);
+	else if (burst == SEC_MINI_B)
+		/* Modulated tone burst */
+		ds3000_writereg(state, 0xa1, 0x01);
+	else
+		return -EINVAL;
+
+	msleep(13);
+	for (i = 0; i < 5; i++) {
+		data = ds3000_readreg(state, 0xa1);
+		if ((data & 0x40) == 0)
+			break;
+		msleep(1);
+	}
+
+	if (i == 5) {
+		data = ds3000_readreg(state, 0xa1);
+		data &= ~0x80;
+		data |= 0x40;
+		ds3000_writereg(state, 0xa1, data);
+
+		data = ds3000_readreg(state, 0xa2);
+		data &= ~0xc0;
+		data |= 0x80;
+		ds3000_writereg(state, 0xa2, data);
+
+		return 1;
+	}
+
+	data = ds3000_readreg(state, 0xa2);
+	data &= ~0xc0;
+	data |= 0x80;
+	ds3000_writereg(state, 0xa2, data);
+
+	return 0;
+}
+
+static void ds3000_release(struct dvb_frontend *fe)
+{
+	struct ds3000_state *state = fe->demodulator_priv;
+	dprintk("%s\n", __func__);
+	kfree(state);
+}
+
+static struct dvb_frontend_ops ds3000_ops;
+
+struct dvb_frontend *ds3000_attach(const struct ds3000_config *config,
+				    struct i2c_adapter *i2c)
+{
+	struct ds3000_state *state = NULL;
+	int ret;
+
+	dprintk("%s\n", __func__);
+
+	/* allocate memory for the internal state */
+	state = kmalloc(sizeof(struct ds3000_state), GFP_KERNEL);
+	if (state == NULL) {
+		printk(KERN_ERR "Unable to kmalloc\n");
+		goto error2;
+	}
+
+	/* setup the state */
+	memset(state, 0, sizeof(struct ds3000_state));
+
+	state->config = config;
+	state->i2c = i2c;
+	state->prevUCBS2 = 0;
+
+	/* check if the demod is present */
+	ret = ds3000_readreg(state, 0x00) & 0xfe;
+	if (ret != 0xe0) {
+		printk(KERN_ERR "Invalid probe, probably not a DS3000\n");
+		goto error3;
+	}
+
+	printk(KERN_INFO "DS3000 chip version: %d.%d attached.\n",
+			ds3000_readreg(state, 0x02),
+			ds3000_readreg(state, 0x01));
+
+	memcpy(&state->frontend.ops, &ds3000_ops,
+			sizeof(struct dvb_frontend_ops));
+	state->frontend.demodulator_priv = state;
+	return &state->frontend;
+
+error3:
+	kfree(state);
+error2:
+	return NULL;
+}
+EXPORT_SYMBOL(ds3000_attach);
+
+static int ds3000_set_property(struct dvb_frontend *fe,
+	struct dtv_property *tvp)
+{
+	dprintk("%s(..)\n", __func__);
+	return 0;
+}
+
+static int ds3000_get_property(struct dvb_frontend *fe,
+	struct dtv_property *tvp)
+{
+	dprintk("%s(..)\n", __func__);
+	return 0;
+}
+
+static int ds3000_tune(struct dvb_frontend *fe,
+				struct dvb_frontend_parameters *p)
+{
+	struct ds3000_state *state = fe->demodulator_priv;
+	struct dtv_frontend_properties *c = &fe->dtv_property_cache;
+
+	int ret = 0, retune, i;
+	u8 status, mlpf, mlpf_new, mlpf_max, mlpf_min, nlpf;
+	u16 value, ndiv;
+	u32 f3db;
+
+	dprintk("%s() ", __func__);
+
+	/* Load the firmware if required */
+	ret = ds3000_firmware_ondemand(fe);
+	if (ret != 0) {
+		printk(KERN_ERR "%s: Unable initialise the firmware\n",
+								__func__);
+		return ret;
+	}
+
+	state->dnxt.delivery = c->modulation;
+	state->dnxt.frequency = c->frequency;
+	state->dnxt.rolloff = 2; /* fixme */
+	state->dnxt.fec = c->fec_inner;
+
+	ret = ds3000_set_inversion(state, p->inversion);
+	if (ret !=  0)
+		return ret;
+
+	ret = ds3000_set_symbolrate(state, c->symbol_rate);
+	if (ret !=  0)
+		return ret;
+
+	/* discard the 'current' tuning parameters and prepare to tune */
+	ds3000_clone_params(fe);
+
+	retune = 1;	/* try 1 times */
+	dprintk("%s:   retune = %d\n", __func__, retune);
+	dprintk("%s:   frequency   = %d\n", __func__, state->dcur.frequency);
+	dprintk("%s:   symbol_rate = %d\n", __func__, state->dcur.symbol_rate);
+	dprintk("%s:   FEC	 = %d \n", __func__,
+		state->dcur.fec);
+	dprintk("%s:   Inversion   = %d\n", __func__, state->dcur.inversion);
+
+	do {
+		/* Reset status register */
+		status = 0;
+		/* Tune */
+		/* TS2020 init */
+		ds3000_tuner_writereg(state, 0x42, 0x73);
+		ds3000_tuner_writereg(state, 0x05, 0x01);
+		ds3000_tuner_writereg(state, 0x62, 0xf5);
+		/* unknown */
+		ds3000_tuner_writereg(state, 0x07, 0x02);
+		ds3000_tuner_writereg(state, 0x10, 0x00);
+		ds3000_tuner_writereg(state, 0x60, 0x79);
+		ds3000_tuner_writereg(state, 0x08, 0x01);
+		ds3000_tuner_writereg(state, 0x00, 0x01);
+		/* calculate and set freq divider */
+		if (state->dcur.frequency < 1146000) {
+			ds3000_tuner_writereg(state, 0x10, 0x11);
+			ndiv = ((state->dcur.frequency * (6 + 8) * 4) +
+					(DS3000_XTAL_FREQ / 2)) /
+					DS3000_XTAL_FREQ - 1024;
+		} else {
+			ds3000_tuner_writereg(state, 0x10, 0x01);
+			ndiv = ((state->dcur.frequency * (6 + 8) * 2) +
+					(DS3000_XTAL_FREQ / 2)) /
+					DS3000_XTAL_FREQ - 1024;
+		}
+
+		ds3000_tuner_writereg(state, 0x01, (ndiv & 0x0f00) >> 8);
+		ds3000_tuner_writereg(state, 0x02, ndiv & 0x00ff);
+
+		/* set pll */
+		ds3000_tuner_writereg(state, 0x03, 0x06);
+		ds3000_tuner_writereg(state, 0x51, 0x0f);
+		ds3000_tuner_writereg(state, 0x51, 0x1f);
+		ds3000_tuner_writereg(state, 0x50, 0x10);
+		ds3000_tuner_writereg(state, 0x50, 0x00);
+		msleep(5);
+
+		/* unknown */
+		ds3000_tuner_writereg(state, 0x51, 0x17);
+		ds3000_tuner_writereg(state, 0x51, 0x1f);
+		ds3000_tuner_writereg(state, 0x50, 0x08);
+		ds3000_tuner_writereg(state, 0x50, 0x00);
+		msleep(5);
+
+		value = ds3000_tuner_readreg(state, 0x3d);
+		value &= 0x0f;
+		if ((value > 4) && (value < 15)) {
+			value -= 3;
+			if (value < 4)
+				value = 4;
+			value = ((value << 3) | 0x01) & 0x79;
+		}
+
+		ds3000_tuner_writereg(state, 0x60, value);
+		ds3000_tuner_writereg(state, 0x51, 0x17);
+		ds3000_tuner_writereg(state, 0x51, 0x1f);
+		ds3000_tuner_writereg(state, 0x50, 0x08);
+		ds3000_tuner_writereg(state, 0x50, 0x00);
+
+		/* set low-pass filter period */
+		ds3000_tuner_writereg(state, 0x04, 0x2e);
+		ds3000_tuner_writereg(state, 0x51, 0x1b);
+		ds3000_tuner_writereg(state, 0x51, 0x1f);
+		ds3000_tuner_writereg(state, 0x50, 0x04);
+		ds3000_tuner_writereg(state, 0x50, 0x00);
+		msleep(5);
+
+		f3db = ((state->dcur.symbol_rate / 1000) << 2) / 5 + 2000;
+		if ((state->dcur.symbol_rate / 1000) < 5000)
+			f3db += 3000;
+		if (f3db < 7000)
+			f3db = 7000;
+		if (f3db > 40000)
+			f3db = 40000;
+
+		/* set low-pass filter baseband */
+		value = ds3000_tuner_readreg(state, 0x26);
+		mlpf = 0x2e * 207 / ((value << 1) + 151);
+		mlpf_max = mlpf * 135 / 100;
+		mlpf_min = mlpf * 78 / 100;
+		if (mlpf_max > 63)
+			mlpf_max = 63;
+
+		/* rounded to the closest integer */
+		nlpf = ((mlpf * f3db * 1000) + (2766 * DS3000_XTAL_FREQ / 2))
+				/ (2766 * DS3000_XTAL_FREQ);
+		if (nlpf > 23)
+			nlpf = 23;
+		if (nlpf < 1)
+			nlpf = 1;
+
+		/* rounded to the closest integer */
+		mlpf_new = ((DS3000_XTAL_FREQ * nlpf * 2766) +
+				(1000 * f3db / 2)) / (1000 * f3db);
+
+		if (mlpf_new < mlpf_min) {
+			nlpf++;
+			mlpf_new = ((DS3000_XTAL_FREQ * nlpf * 2766) +
+					(1000 * f3db / 2)) / (1000 * f3db);
+		}
+
+		if (mlpf_new > mlpf_max)
+			mlpf_new = mlpf_max;
+
+		ds3000_tuner_writereg(state, 0x04, mlpf_new);
+		ds3000_tuner_writereg(state, 0x06, nlpf);
+		ds3000_tuner_writereg(state, 0x51, 0x1b);
+		ds3000_tuner_writereg(state, 0x51, 0x1f);
+		ds3000_tuner_writereg(state, 0x50, 0x04);
+		ds3000_tuner_writereg(state, 0x50, 0x00);
+		msleep(5);
+
+		/* unknown */
+		ds3000_tuner_writereg(state, 0x51, 0x1e);
+		ds3000_tuner_writereg(state, 0x51, 0x1f);
+		ds3000_tuner_writereg(state, 0x50, 0x01);
+		ds3000_tuner_writereg(state, 0x50, 0x00);
+		msleep(60);
+
+		/* ds3000 global reset */
+		ds3000_writereg(state, 0x07, 0x80);
+		ds3000_writereg(state, 0x07, 0x00);
+		/* ds3000 build-in uC reset */
+		ds3000_writereg(state, 0xb2, 0x01);
+		/* ds3000 software reset */
+		ds3000_writereg(state, 0x00, 0x01);
+
+		switch (c->delivery_system) {
+		case SYS_DVBS:
+			/* initialise the demod in DVB-S mode */
+			for (i = 0; i < sizeof(ds3000_dvbs_init_tab); i += 2)
+				ds3000_writereg(state,
+					ds3000_dvbs_init_tab[i],
+					ds3000_dvbs_init_tab[i + 1]);
+			value = ds3000_readreg(state, 0xfe);
+			value &= 0xc0;
+			value |= 0x1b;
+			ds3000_writereg(state, 0xfe, value);
+			break;
+		case SYS_DVBS2:
+			/* initialise the demod in DVB-S2 mode */
+			for (i = 0; i < sizeof(ds3000_dvbs2_init_tab); i += 2)
+				ds3000_writereg(state,
+					ds3000_dvbs2_init_tab[i],
+					ds3000_dvbs2_init_tab[i + 1]);
+			ds3000_writereg(state, 0xfe, 0x54);
+			break;
+		default:
+			return 1;
+		}
+
+		/* enable 27MHz clock output */
+		ds3000_writereg(state, 0x29, 0x80);
+		/* enable ac coupling */
+		ds3000_writereg(state, 0x25, 0x8a);
+
+		/* enhance symbol rate performance */
+		if ((state->dcur.symbol_rate / 1000) <= 5000) {
+			value = 29777 / (state->dcur.symbol_rate / 1000) + 1;
+			if (value % 2 != 0)
+				value++;
+			ds3000_writereg(state, 0xc3, 0x0d);
+			ds3000_writereg(state, 0xc8, value);
+			ds3000_writereg(state, 0xc4, 0x10);
+			ds3000_writereg(state, 0xc7, 0x0e);
+		} else if ((state->dcur.symbol_rate / 1000) <= 10000) {
+			value = 92166 / (state->dcur.symbol_rate / 1000) + 1;
+			if (value % 2 != 0)
+				value++;
+			ds3000_writereg(state, 0xc3, 0x07);
+			ds3000_writereg(state, 0xc8, value);
+			ds3000_writereg(state, 0xc4, 0x09);
+			ds3000_writereg(state, 0xc7, 0x12);
+		} else if ((state->dcur.symbol_rate / 1000) <= 20000) {
+			value = 64516 / (state->dcur.symbol_rate / 1000) + 1;
+			ds3000_writereg(state, 0xc3, value);
+			ds3000_writereg(state, 0xc8, 0x0e);
+			ds3000_writereg(state, 0xc4, 0x07);
+			ds3000_writereg(state, 0xc7, 0x18);
+		} else {
+			value = 129032 / (state->dcur.symbol_rate / 1000) + 1;
+			ds3000_writereg(state, 0xc3, value);
+			ds3000_writereg(state, 0xc8, 0x0a);
+			ds3000_writereg(state, 0xc4, 0x05);
+			ds3000_writereg(state, 0xc7, 0x24);
+		}
+
+		/* normalized symbol rate rounded to the closest integer */
+		value = (((state->dcur.symbol_rate / 1000) << 16) +
+				(DS3000_SAMPLE_RATE / 2)) / DS3000_SAMPLE_RATE;
+		ds3000_writereg(state, 0x61, value & 0x00ff);
+		ds3000_writereg(state, 0x62, (value & 0xff00) >> 8);
+
+		/* co-channel interference cancellation disabled */
+		ds3000_writereg(state, 0x56, 0x00);
+
+		/* equalizer disabled */
+		ds3000_writereg(state, 0x76, 0x00);
+
+		/*ds3000_writereg(state, 0x08, 0x03);
+		ds3000_writereg(state, 0xfd, 0x22);
+		ds3000_writereg(state, 0x08, 0x07);
+		ds3000_writereg(state, 0xfd, 0x42);
+		ds3000_writereg(state, 0x08, 0x07);*/
+
+		/* ds3000 out of software reset */
+		ds3000_writereg(state, 0x00, 0x00);
+		/* start ds3000 build-in uC */
+		ds3000_writereg(state, 0xb2, 0x00);
+
+		/* TODO: calculate and set carrier offset */
+
+		/* wait before retrying */
+		for (i = 0; i < 30 ; i++) {
+			if (ds3000_is_tuned(fe)) {
+				dprintk("%s: Tuned\n", __func__);
+				ds3000_dump_registers(fe);
+				goto tuned;
+			}
+			msleep(1);
+		}
+
+		dprintk("%s: Not tuned\n", __func__);
+		ds3000_dump_registers(fe);
+
+	} while (--retune);
+
+tuned:
+	return ret;
+}
+
+static enum dvbfe_algo ds3000_get_algo(struct dvb_frontend *fe)
+{
+	dprintk("%s()\n", __func__);
+	return DVBFE_ALGO_SW;
+}
+
+/*
+ * Initialise or wake up device
+ *
+ * Power config will reset and load initial firmware if required
+ */
+static int ds3000_initfe(struct dvb_frontend *fe)
+{
+	dprintk("%s()\n", __func__);
+	return 0;
+}
+
+/* Put device to sleep */
+static int ds3000_sleep(struct dvb_frontend *fe)
+{
+	dprintk("%s()\n", __func__);
+	return 0;
+}
+
+static struct dvb_frontend_ops ds3000_ops = {
+
+	.info = {
+		.name = "Montage Technology DS3000/TS2020",
+		.type = FE_QPSK,
+		.frequency_min = 950000,
+		.frequency_max = 2150000,
+		.frequency_stepsize = 1011, /* kHz for QPSK frontends */
+		.frequency_tolerance = 5000,
+		.symbol_rate_min = 1000000,
+		.symbol_rate_max = 45000000,
+		.caps = FE_CAN_INVERSION_AUTO |
+			FE_CAN_FEC_1_2 | FE_CAN_FEC_2_3 | FE_CAN_FEC_3_4 |
+			FE_CAN_FEC_4_5 | FE_CAN_FEC_5_6 | FE_CAN_FEC_6_7 |
+			FE_CAN_FEC_7_8 | FE_CAN_FEC_AUTO |
+			FE_CAN_2G_MODULATION |
+			FE_CAN_QPSK | FE_CAN_RECOVER
+	},
+
+	.release = ds3000_release,
+
+	.init = ds3000_initfe,
+	.sleep = ds3000_sleep,
+	.read_status = ds3000_read_status,
+	.read_ber = ds3000_read_ber,
+	.read_signal_strength = ds3000_read_signal_strength,
+	.read_snr = ds3000_read_snr,
+	.read_ucblocks = ds3000_read_ucblocks,
+	.set_tone = ds3000_set_tone,
+	.diseqc_send_master_cmd = ds3000_send_diseqc_msg,
+	.diseqc_send_burst = ds3000_diseqc_send_burst,
+	.get_frontend_algo = ds3000_get_algo,
+
+	.set_property = ds3000_set_property,
+	.get_property = ds3000_get_property,
+	.set_frontend = ds3000_tune,
+};
+
+module_param(debug, int, 0644);
+MODULE_PARM_DESC(debug, "Activates frontend debugging (default:0)");
+
+MODULE_DESCRIPTION("DVB Frontend module for Montage Technology "
+			"DS3000/TS2020 hardware");
+MODULE_AUTHOR("Konstantin Dimitrov");
+MODULE_LICENSE("GPL");
diff --git a/drivers/media/dvb/frontends/ds3000.h b/drivers/media/dvb/frontends/ds3000.h
new file mode 100644
index 000000000000..67f67038740a
--- /dev/null
+++ b/drivers/media/dvb/frontends/ds3000.h
@@ -0,0 +1,45 @@
+/*
+    Montage Technology DS3000/TS2020 - DVBS/S2 Satellite demod/tuner driver
+    Copyright (C) 2009 Konstantin Dimitrov <kosio.dimitrov@gmail.com>
+
+    Copyright (C) 2009 TurboSight.com
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program; if not, write to the Free Software
+    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#ifndef DS3000_H
+#define DS3000_H
+
+#include <linux/dvb/frontend.h>
+
+struct ds3000_config {
+	/* the demodulator's i2c address */
+	u8 demod_address;
+};
+
+#if defined(CONFIG_DVB_DS3000) || \
+			(defined(CONFIG_DVB_DS3000_MODULE) && defined(MODULE))
+extern struct dvb_frontend *ds3000_attach(const struct ds3000_config *config,
+					struct i2c_adapter *i2c);
+#else
+static inline
+struct dvb_frontend *ds3000_attach(const struct ds3000_config *config,
+					struct i2c_adapter *i2c)
+{
+	printk(KERN_WARNING "%s: driver disabled by Kconfig\n", __func__);
+	return NULL;
+}
+#endif /* CONFIG_DVB_DS3000 */
+#endif /* DS3000_H */
diff --git a/drivers/media/dvb/frontends/ec100.c b/drivers/media/dvb/frontends/ec100.c
new file mode 100644
index 000000000000..2414dc6ee5d9
--- /dev/null
+++ b/drivers/media/dvb/frontends/ec100.c
@@ -0,0 +1,335 @@
+/*
+ * E3C EC100 demodulator driver
+ *
+ * Copyright (C) 2009 Antti Palosaari <crope@iki.fi>
+ *
+ *    This program is free software; you can redistribute it and/or modify
+ *    it under the terms of the GNU General Public License as published by
+ *    the Free Software Foundation; either version 2 of the License, or
+ *    (at your option) any later version.
+ *
+ *    This program is distributed in the hope that it will be useful,
+ *    but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *    GNU General Public License for more details.
+ *
+ *    You should have received a copy of the GNU General Public License
+ *    along with this program; if not, write to the Free Software
+ *    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ *
+ */
+
+#include "dvb_frontend.h"
+#include "ec100_priv.h"
+#include "ec100.h"
+
+int ec100_debug;
+module_param_named(debug, ec100_debug, int, 0644);
+MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off).");
+
+struct ec100_state {
+	struct i2c_adapter *i2c;
+	struct dvb_frontend frontend;
+	struct ec100_config config;
+
+	u16 ber;
+};
+
+/* write single register */
+static int ec100_write_reg(struct ec100_state *state, u8 reg, u8 val)
+{
+	u8 buf[2] = {reg, val};
+	struct i2c_msg msg = {
+		.addr = state->config.demod_address,
+		.flags = 0,
+		.len = 2,
+		.buf = buf};
+
+	if (i2c_transfer(state->i2c, &msg, 1) != 1) {
+		warn("I2C write failed reg:%02x", reg);
+		return -EREMOTEIO;
+	}
+	return 0;
+}
+
+/* read single register */
+static int ec100_read_reg(struct ec100_state *state, u8 reg, u8 *val)
+{
+	struct i2c_msg msg[2] = {
+		{
+			.addr = state->config.demod_address,
+			.flags = 0,
+			.len = 1,
+			.buf = &reg
+		}, {
+			.addr = state->config.demod_address,
+			.flags = I2C_M_RD,
+			.len = 1,
+			.buf = val
+		}
+	};
+
+	if (i2c_transfer(state->i2c, msg, 2) != 2) {
+		warn("I2C read failed reg:%02x", reg);
+		return -EREMOTEIO;
+	}
+	return 0;
+}
+
+static int ec100_set_frontend(struct dvb_frontend *fe,
+	struct dvb_frontend_parameters *params)
+{
+	struct ec100_state *state = fe->demodulator_priv;
+	int ret;
+	u8 tmp, tmp2;
+
+	deb_info("%s: freq:%d bw:%d\n", __func__, params->frequency,
+		params->u.ofdm.bandwidth);
+
+	/* program tuner */
+	if (fe->ops.tuner_ops.set_params)
+		fe->ops.tuner_ops.set_params(fe, params);
+
+	ret = ec100_write_reg(state, 0x04, 0x06);
+	if (ret)
+		goto error;
+	ret = ec100_write_reg(state, 0x67, 0x58);
+	if (ret)
+		goto error;
+	ret = ec100_write_reg(state, 0x05, 0x18);
+	if (ret)
+		goto error;
+
+	/* reg/bw |   6  |   7  |   8
+	   -------+------+------+------
+	   A 0x1b | 0xa1 | 0xe7 | 0x2c
+	   A 0x1c | 0x55 | 0x63 | 0x72
+	   -------+------+------+------
+	   B 0x1b | 0xb7 | 0x00 | 0x49
+	   B 0x1c | 0x55 | 0x64 | 0x72 */
+
+	switch (params->u.ofdm.bandwidth) {
+	case BANDWIDTH_6_MHZ:
+		tmp = 0xb7;
+		tmp2 = 0x55;
+		break;
+	case BANDWIDTH_7_MHZ:
+		tmp = 0x00;
+		tmp2 = 0x64;
+		break;
+	case BANDWIDTH_8_MHZ:
+	default:
+		tmp = 0x49;
+		tmp2 = 0x72;
+	}
+
+	ret = ec100_write_reg(state, 0x1b, tmp);
+	if (ret)
+		goto error;
+	ret = ec100_write_reg(state, 0x1c, tmp2);
+	if (ret)
+		goto error;
+
+	ret = ec100_write_reg(state, 0x0c, 0xbb); /* if freq */
+	if (ret)
+		goto error;
+	ret = ec100_write_reg(state, 0x0d, 0x31); /* if freq */
+	if (ret)
+		goto error;
+
+	ret = ec100_write_reg(state, 0x08, 0x24);
+	if (ret)
+		goto error;
+
+	ret = ec100_write_reg(state, 0x00, 0x00); /* go */
+	if (ret)
+		goto error;
+	ret = ec100_write_reg(state, 0x00, 0x20); /* go */
+	if (ret)
+		goto error;
+
+	return ret;
+error:
+	deb_info("%s: failed:%d\n", __func__, ret);
+	return ret;
+}
+
+static int ec100_get_tune_settings(struct dvb_frontend *fe,
+	struct dvb_frontend_tune_settings *fesettings)
+{
+	fesettings->min_delay_ms = 300;
+	fesettings->step_size = 0;
+	fesettings->max_drift = 0;
+
+	return 0;
+}
+
+static int ec100_read_status(struct dvb_frontend *fe, fe_status_t *status)
+{
+	struct ec100_state *state = fe->demodulator_priv;
+	int ret;
+	u8 tmp;
+	*status = 0;
+
+	ret = ec100_read_reg(state, 0x42, &tmp);
+	if (ret)
+		goto error;
+
+	if (tmp & 0x80) {
+		/* bit7 set - have lock */
+		*status |= FE_HAS_SIGNAL | FE_HAS_CARRIER | FE_HAS_VITERBI |
+			FE_HAS_SYNC | FE_HAS_LOCK;
+	} else {
+		ret = ec100_read_reg(state, 0x01, &tmp);
+		if (ret)
+			goto error;
+
+		if (tmp & 0x10) {
+			/* bit4 set - have signal */
+			*status |= FE_HAS_SIGNAL;
+			if (!(tmp & 0x01)) {
+				/* bit0 clear - have ~valid signal */
+				*status |= FE_HAS_CARRIER |  FE_HAS_VITERBI;
+			}
+		}
+	}
+
+	return ret;
+error:
+	deb_info("%s: failed:%d\n", __func__, ret);
+	return ret;
+}
+
+static int ec100_read_ber(struct dvb_frontend *fe, u32 *ber)
+{
+	struct ec100_state *state = fe->demodulator_priv;
+	int ret;
+	u8 tmp, tmp2;
+	u16 ber2;
+
+	*ber = 0;
+
+	ret = ec100_read_reg(state, 0x65, &tmp);
+	if (ret)
+		goto error;
+	ret = ec100_read_reg(state, 0x66, &tmp2);
+	if (ret)
+		goto error;
+
+	ber2 = (tmp2 << 8) | tmp;
+
+	/* if counter overflow or clear */
+	if (ber2 < state->ber)
+		*ber = ber2;
+	else
+		*ber = ber2 - state->ber;
+
+	state->ber = ber2;
+
+	return ret;
+error:
+	deb_info("%s: failed:%d\n", __func__, ret);
+	return ret;
+}
+
+static int ec100_read_signal_strength(struct dvb_frontend *fe, u16 *strength)
+{
+	struct ec100_state *state = fe->demodulator_priv;
+	int ret;
+	u8 tmp;
+
+	ret = ec100_read_reg(state, 0x24, &tmp);
+	if (ret) {
+		*strength = 0;
+		goto error;
+	}
+
+	*strength = ((tmp << 8) | tmp);
+
+	return ret;
+error:
+	deb_info("%s: failed:%d\n", __func__, ret);
+	return ret;
+}
+
+static int ec100_read_snr(struct dvb_frontend *fe, u16 *snr)
+{
+	*snr = 0;
+	return 0;
+}
+
+static int ec100_read_ucblocks(struct dvb_frontend *fe, u32 *ucblocks)
+{
+	*ucblocks = 0;
+	return 0;
+}
+
+static void ec100_release(struct dvb_frontend *fe)
+{
+	struct ec100_state *state = fe->demodulator_priv;
+	kfree(state);
+}
+
+static struct dvb_frontend_ops ec100_ops;
+
+struct dvb_frontend *ec100_attach(const struct ec100_config *config,
+	struct i2c_adapter *i2c)
+{
+	int ret;
+	struct ec100_state *state = NULL;
+	u8 tmp;
+
+	/* allocate memory for the internal state */
+	state = kzalloc(sizeof(struct ec100_state), GFP_KERNEL);
+	if (state == NULL)
+		goto error;
+
+	/* setup the state */
+	state->i2c = i2c;
+	memcpy(&state->config, config, sizeof(struct ec100_config));
+
+	/* check if the demod is there */
+	ret = ec100_read_reg(state, 0x33, &tmp);
+	if (ret || tmp != 0x0b)
+		goto error;
+
+	/* create dvb_frontend */
+	memcpy(&state->frontend.ops, &ec100_ops,
+		sizeof(struct dvb_frontend_ops));
+	state->frontend.demodulator_priv = state;
+
+	return &state->frontend;
+error:
+	kfree(state);
+	return NULL;
+}
+EXPORT_SYMBOL(ec100_attach);
+
+static struct dvb_frontend_ops ec100_ops = {
+	.info = {
+		.name = "E3C EC100 DVB-T",
+		.type = FE_OFDM,
+		.caps =
+			FE_CAN_FEC_1_2 | FE_CAN_FEC_2_3 | FE_CAN_FEC_3_4 |
+			FE_CAN_FEC_5_6 | FE_CAN_FEC_7_8 | FE_CAN_FEC_AUTO |
+			FE_CAN_QPSK | FE_CAN_QAM_16 |
+			FE_CAN_QAM_64 | FE_CAN_QAM_AUTO |
+			FE_CAN_TRANSMISSION_MODE_AUTO |
+			FE_CAN_GUARD_INTERVAL_AUTO |
+			FE_CAN_HIERARCHY_AUTO |
+			FE_CAN_MUTE_TS
+	},
+
+	.release = ec100_release,
+	.set_frontend = ec100_set_frontend,
+	.get_tune_settings = ec100_get_tune_settings,
+	.read_status = ec100_read_status,
+	.read_ber = ec100_read_ber,
+	.read_signal_strength = ec100_read_signal_strength,
+	.read_snr = ec100_read_snr,
+	.read_ucblocks = ec100_read_ucblocks,
+};
+
+MODULE_AUTHOR("Antti Palosaari <crope@iki.fi>");
+MODULE_DESCRIPTION("E3C EC100 DVB-T demodulator driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/media/dvb/frontends/ec100.h b/drivers/media/dvb/frontends/ec100.h
new file mode 100644
index 000000000000..ee8e52417958
--- /dev/null
+++ b/drivers/media/dvb/frontends/ec100.h
@@ -0,0 +1,46 @@
+/*
+ * E3C EC100 demodulator driver
+ *
+ * Copyright (C) 2009 Antti Palosaari <crope@iki.fi>
+ *
+ *    This program is free software; you can redistribute it and/or modify
+ *    it under the terms of the GNU General Public License as published by
+ *    the Free Software Foundation; either version 2 of the License, or
+ *    (at your option) any later version.
+ *
+ *    This program is distributed in the hope that it will be useful,
+ *    but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *    GNU General Public License for more details.
+ *
+ *    You should have received a copy of the GNU General Public License
+ *    along with this program; if not, write to the Free Software
+ *    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ *
+ */
+
+#ifndef EC100_H
+#define EC100_H
+
+#include <linux/dvb/frontend.h>
+
+struct ec100_config {
+	/* demodulator's I2C address */
+	u8 demod_address;
+};
+
+
+#if defined(CONFIG_DVB_EC100) || \
+	(defined(CONFIG_DVB_EC100_MODULE) && defined(MODULE))
+extern struct dvb_frontend *ec100_attach(const struct ec100_config *config,
+	struct i2c_adapter *i2c);
+#else
+static inline struct dvb_frontend *ec100_attach(
+	const struct ec100_config *config, struct i2c_adapter *i2c)
+{
+	printk(KERN_WARNING "%s: driver disabled by Kconfig\n", __func__);
+	return NULL;
+}
+#endif
+
+#endif /* EC100_H */
diff --git a/drivers/media/dvb/frontends/ec100_priv.h b/drivers/media/dvb/frontends/ec100_priv.h
new file mode 100644
index 000000000000..5c990144bc47
--- /dev/null
+++ b/drivers/media/dvb/frontends/ec100_priv.h
@@ -0,0 +1,39 @@
+/*
+ * E3C EC100 demodulator driver
+ *
+ * Copyright (C) 2009 Antti Palosaari <crope@iki.fi>
+ *
+ *    This program is free software; you can redistribute it and/or modify
+ *    it under the terms of the GNU General Public License as published by
+ *    the Free Software Foundation; either version 2 of the License, or
+ *    (at your option) any later version.
+ *
+ *    This program is distributed in the hope that it will be useful,
+ *    but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *    GNU General Public License for more details.
+ *
+ *    You should have received a copy of the GNU General Public License
+ *    along with this program; if not, write to the Free Software
+ *    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ *
+ */
+
+#ifndef EC100_PRIV
+#define EC100_PRIV
+
+#define LOG_PREFIX "ec100"
+
+#define dprintk(var, level, args...) \
+	do { if ((var & level)) printk(args); } while (0)
+
+#define deb_info(args...) dprintk(ec100_debug, 0x01, args)
+
+#undef err
+#define err(f, arg...)  printk(KERN_ERR     LOG_PREFIX": " f "\n" , ## arg)
+#undef info
+#define info(f, arg...) printk(KERN_INFO    LOG_PREFIX": " f "\n" , ## arg)
+#undef warn
+#define warn(f, arg...) printk(KERN_WARNING LOG_PREFIX": " f "\n" , ## arg)
+
+#endif /* EC100_PRIV */
diff --git a/drivers/media/dvb/frontends/lgdt3305.h b/drivers/media/dvb/frontends/lgdt3305.h
index 4fa6e52d1fe8..9cb11c9cae53 100644
--- a/drivers/media/dvb/frontends/lgdt3305.h
+++ b/drivers/media/dvb/frontends/lgdt3305.h
@@ -54,13 +54,13 @@ struct lgdt3305_config {
 	u16 usref_qam256; /* default: 0x2a80 */
 
 	/* disable i2c repeater - 0:repeater enabled 1:repeater disabled */
-	int deny_i2c_rptr:1;
+	unsigned int deny_i2c_rptr:1;
 
 	/* spectral inversion - 0:disabled 1:enabled */
-	int spectral_inversion:1;
+	unsigned int spectral_inversion:1;
 
 	/* use RF AGC loop - 0:disabled 1:enabled */
-	int rf_agc_loop:1;
+	unsigned int rf_agc_loop:1;
 
 	enum lgdt3305_mpeg_mode mpeg_mode;
 	enum lgdt3305_tp_clock_edge tpclk_edge;
diff --git a/drivers/media/dvb/frontends/lgdt330x.c b/drivers/media/dvb/frontends/lgdt330x.c
index 056387b41a8f..43971e63baa7 100644
--- a/drivers/media/dvb/frontends/lgdt330x.c
+++ b/drivers/media/dvb/frontends/lgdt330x.c
@@ -479,7 +479,7 @@ static int lgdt3302_read_status(struct dvb_frontend* fe, fe_status_t* status)
 	switch (state->current_modulation) {
 	case QAM_256:
 	case QAM_64:
-		/* Need to undestand why there are 3 lock levels here */
+		/* Need to understand why there are 3 lock levels here */
 		if ((buf[0] & 0x07) == 0x07)
 			*status |= FE_HAS_CARRIER;
 		break;
@@ -520,7 +520,7 @@ static int lgdt3303_read_status(struct dvb_frontend* fe, fe_status_t* status)
 	switch (state->current_modulation) {
 	case QAM_256:
 	case QAM_64:
-		/* Need to undestand why there are 3 lock levels here */
+		/* Need to understand why there are 3 lock levels here */
 		if ((buf[0] & 0x07) == 0x07)
 			*status |= FE_HAS_CARRIER;
 		else
diff --git a/drivers/media/dvb/frontends/lgs8gxx.c b/drivers/media/dvb/frontends/lgs8gxx.c
index eabcadc425d5..dee53960e7e8 100644
--- a/drivers/media/dvb/frontends/lgs8gxx.c
+++ b/drivers/media/dvb/frontends/lgs8gxx.c
@@ -199,7 +199,7 @@ static int lgs8gxx_set_if_freq(struct lgs8gxx_state *priv, u32 freq /*in kHz*/)
 
 	val = freq;
 	if (freq != 0) {
-		val *= (u64)1 << 32;
+		val <<= 32;
 		if (if_clk != 0)
 			do_div(val, if_clk);
 		v32 = val & 0xFFFFFFFF;
@@ -246,7 +246,7 @@ static int lgs8gxx_get_afc_phase(struct lgs8gxx_state *priv)
 
 	val = v32;
 	val *= priv->config->if_clk_freq;
-	val /= (u64)1 << 32;
+	val >>= 32;
 	dprintk("AFC = %u kHz\n", (u32)val);
 	return 0;
 }
diff --git a/drivers/media/dvb/frontends/lnbp21.c b/drivers/media/dvb/frontends/lnbp21.c
index 71f607fe8fc7..b181bf023ada 100644
--- a/drivers/media/dvb/frontends/lnbp21.c
+++ b/drivers/media/dvb/frontends/lnbp21.c
@@ -1,7 +1,7 @@
 /*
  * lnbp21.c - driver for lnb supply and control ic lnbp21
  *
- * Copyright (C) 2006 Oliver Endriss
+ * Copyright (C) 2006, 2009 Oliver Endriss <o.endriss@gmx.de>
  * Copyright (C) 2009 Igor M. Liplianin <liplianin@netup.ru>
  *
  * This program is free software; you can redistribute it and/or
@@ -91,6 +91,31 @@ static int lnbp21_enable_high_lnb_voltage(struct dvb_frontend *fe, long arg)
 	return (i2c_transfer(lnbp21->i2c, &msg, 1) == 1) ? 0 : -EIO;
 }
 
+static int lnbp21_set_tone(struct dvb_frontend *fe,
+				fe_sec_tone_mode_t tone)
+{
+	struct lnbp21 *lnbp21 = (struct lnbp21 *) fe->sec_priv;
+	struct i2c_msg msg = {	.addr = lnbp21->i2c_addr, .flags = 0,
+				.buf = &lnbp21->config,
+				.len = sizeof(lnbp21->config) };
+
+	switch (tone) {
+	case SEC_TONE_OFF:
+		lnbp21->config &= ~LNBP21_TEN;
+		break;
+	case SEC_TONE_ON:
+		lnbp21->config |= LNBP21_TEN;
+		break;
+	default:
+		return -EINVAL;
+	};
+
+	lnbp21->config |= lnbp21->override_or;
+	lnbp21->config &= lnbp21->override_and;
+
+	return (i2c_transfer(lnbp21->i2c, &msg, 1) == 1) ? 0 : -EIO;
+}
+
 static void lnbp21_release(struct dvb_frontend *fe)
 {
 	/* LNBP power off */
@@ -133,6 +158,7 @@ static struct dvb_frontend *lnbx2x_attach(struct dvb_frontend *fe,
 	/* override frontend ops */
 	fe->ops.set_voltage = lnbp21_set_voltage;
 	fe->ops.enable_high_lnb_voltage = lnbp21_enable_high_lnb_voltage;
+	fe->ops.set_tone = lnbp21_set_tone;
 	printk(KERN_INFO "LNBx2x attached on addr=%x\n", lnbp21->i2c_addr);
 
 	return fe;
diff --git a/drivers/media/dvb/frontends/mb86a16.c b/drivers/media/dvb/frontends/mb86a16.c
new file mode 100644
index 000000000000..d05f7500e0c5
--- /dev/null
+++ b/drivers/media/dvb/frontends/mb86a16.c
@@ -0,0 +1,1878 @@
+/*
+	Fujitsu MB86A16 DVB-S/DSS DC Receiver driver
+
+	Copyright (C) Manu Abraham (abraham.manu@gmail.com)
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+
+#include "dvb_frontend.h"
+#include "mb86a16.h"
+#include "mb86a16_priv.h"
+
+unsigned int verbose = 5;
+module_param(verbose, int, 0644);
+
+#define ABS(x)		((x) < 0 ? (-x) : (x))
+
+struct mb86a16_state {
+	struct i2c_adapter		*i2c_adap;
+	const struct mb86a16_config	*config;
+	struct dvb_frontend		frontend;
+
+	/* tuning parameters */
+	int				frequency;
+	int				srate;
+
+	/* Internal stuff */
+	int				master_clk;
+	int				deci;
+	int				csel;
+	int				rsel;
+};
+
+#define MB86A16_ERROR		0
+#define MB86A16_NOTICE		1
+#define MB86A16_INFO		2
+#define MB86A16_DEBUG		3
+
+#define dprintk(x, y, z, format, arg...) do {						\
+	if (z) {									\
+		if	((x > MB86A16_ERROR) && (x > y))				\
+			printk(KERN_ERR "%s: " format "\n", __func__, ##arg);		\
+		else if ((x > MB86A16_NOTICE) && (x > y))				\
+			printk(KERN_NOTICE "%s: " format "\n", __func__, ##arg);	\
+		else if ((x > MB86A16_INFO) && (x > y))					\
+			printk(KERN_INFO "%s: " format "\n", __func__, ##arg);		\
+		else if ((x > MB86A16_DEBUG) && (x > y))				\
+			printk(KERN_DEBUG "%s: " format "\n", __func__, ##arg);		\
+	} else {									\
+		if (x > y)								\
+			printk(format, ##arg);						\
+	}										\
+} while (0)
+
+#define TRACE_IN	dprintk(verbose, MB86A16_DEBUG, 1, "-->()")
+#define TRACE_OUT	dprintk(verbose, MB86A16_DEBUG, 1, "()-->")
+
+static int mb86a16_write(struct mb86a16_state *state, u8 reg, u8 val)
+{
+	int ret;
+	u8 buf[] = { reg, val };
+
+	struct i2c_msg msg = {
+		.addr = state->config->demod_address,
+		.flags = 0,
+		.buf = buf,
+		.len = 2
+	};
+
+	dprintk(verbose, MB86A16_DEBUG, 1,
+		"writing to [0x%02x],Reg[0x%02x],Data[0x%02x]",
+		state->config->demod_address, buf[0], buf[1]);
+
+	ret = i2c_transfer(state->i2c_adap, &msg, 1);
+
+	return (ret != 1) ? -EREMOTEIO : 0;
+}
+
+static int mb86a16_read(struct mb86a16_state *state, u8 reg, u8 *val)
+{
+	int ret;
+	u8 b0[] = { reg };
+	u8 b1[] = { 0 };
+
+	struct i2c_msg msg[] = {
+		{
+			.addr = state->config->demod_address,
+			.flags = 0,
+			.buf = b0,
+			.len = 1
+		}, {
+			.addr = state->config->demod_address,
+			.flags = I2C_M_RD,
+			.buf = b1,
+			.len = 1
+		}
+	};
+	ret = i2c_transfer(state->i2c_adap, msg, 2);
+	if (ret != 2) {
+		dprintk(verbose, MB86A16_ERROR, 1, "read error(reg=0x%02x, ret=0x%i)",
+			reg, ret);
+
+		return -EREMOTEIO;
+	}
+	*val = b1[0];
+
+	return ret;
+}
+
+static int CNTM_set(struct mb86a16_state *state,
+		    unsigned char timint1,
+		    unsigned char timint2,
+		    unsigned char cnext)
+{
+	unsigned char val;
+
+	val = (timint1 << 4) | (timint2 << 2) | cnext;
+	if (mb86a16_write(state, MB86A16_CNTMR, val) < 0)
+		goto err;
+
+	return 0;
+
+err:
+	dprintk(verbose, MB86A16_ERROR, 1, "I2C transfer error");
+	return -EREMOTEIO;
+}
+
+static int smrt_set(struct mb86a16_state *state, int rate)
+{
+	int tmp ;
+	int m ;
+	unsigned char STOFS0, STOFS1;
+
+	m = 1 << state->deci;
+	tmp = (8192 * state->master_clk - 2 * m * rate * 8192 + state->master_clk / 2) / state->master_clk;
+
+	STOFS0 = tmp & 0x0ff;
+	STOFS1 = (tmp & 0xf00) >> 8;
+
+	if (mb86a16_write(state, MB86A16_SRATE1, (state->deci << 2) |
+				       (state->csel << 1) |
+					state->rsel) < 0)
+		goto err;
+	if (mb86a16_write(state, MB86A16_SRATE2, STOFS0) < 0)
+		goto err;
+	if (mb86a16_write(state, MB86A16_SRATE3, STOFS1) < 0)
+		goto err;
+
+	return 0;
+err:
+	dprintk(verbose, MB86A16_ERROR, 1, "I2C transfer error");
+	return -1;
+}
+
+static int srst(struct mb86a16_state *state)
+{
+	if (mb86a16_write(state, MB86A16_RESET, 0x04) < 0)
+		goto err;
+
+	return 0;
+err:
+	dprintk(verbose, MB86A16_ERROR, 1, "I2C transfer error");
+	return -EREMOTEIO;
+
+}
+
+static int afcex_data_set(struct mb86a16_state *state,
+			  unsigned char AFCEX_L,
+			  unsigned char AFCEX_H)
+{
+	if (mb86a16_write(state, MB86A16_AFCEXL, AFCEX_L) < 0)
+		goto err;
+	if (mb86a16_write(state, MB86A16_AFCEXH, AFCEX_H) < 0)
+		goto err;
+
+	return 0;
+err:
+	dprintk(verbose, MB86A16_ERROR, 1, "I2C transfer error");
+
+	return -1;
+}
+
+static int afcofs_data_set(struct mb86a16_state *state,
+			   unsigned char AFCEX_L,
+			   unsigned char AFCEX_H)
+{
+	if (mb86a16_write(state, 0x58, AFCEX_L) < 0)
+		goto err;
+	if (mb86a16_write(state, 0x59, AFCEX_H) < 0)
+		goto err;
+
+	return 0;
+err:
+	dprintk(verbose, MB86A16_ERROR, 1, "I2C transfer error");
+	return -EREMOTEIO;
+}
+
+static int stlp_set(struct mb86a16_state *state,
+		    unsigned char STRAS,
+		    unsigned char STRBS)
+{
+	if (mb86a16_write(state, MB86A16_STRFILTCOEF1, (STRBS << 3) | (STRAS)) < 0)
+		goto err;
+
+	return 0;
+err:
+	dprintk(verbose, MB86A16_ERROR, 1, "I2C transfer error");
+	return -EREMOTEIO;
+}
+
+static int Vi_set(struct mb86a16_state *state, unsigned char ETH, unsigned char VIA)
+{
+	if (mb86a16_write(state, MB86A16_VISET2, 0x04) < 0)
+		goto err;
+	if (mb86a16_write(state, MB86A16_VISET3, 0xf5) < 0)
+		goto err;
+
+	return 0;
+err:
+	dprintk(verbose, MB86A16_ERROR, 1, "I2C transfer error");
+	return -EREMOTEIO;
+}
+
+static int initial_set(struct mb86a16_state *state)
+{
+	if (stlp_set(state, 5, 7))
+		goto err;
+
+	udelay(100);
+	if (afcex_data_set(state, 0, 0))
+		goto err;
+
+	udelay(100);
+	if (afcofs_data_set(state, 0, 0))
+		goto err;
+
+	udelay(100);
+	if (mb86a16_write(state, MB86A16_CRLFILTCOEF1, 0x16) < 0)
+		goto err;
+	if (mb86a16_write(state, 0x2f, 0x21) < 0)
+		goto err;
+	if (mb86a16_write(state, MB86A16_VIMAG, 0x38) < 0)
+		goto err;
+	if (mb86a16_write(state, MB86A16_FAGCS1, 0x00) < 0)
+		goto err;
+	if (mb86a16_write(state, MB86A16_FAGCS2, 0x1c) < 0)
+		goto err;
+	if (mb86a16_write(state, MB86A16_FAGCS3, 0x20) < 0)
+		goto err;
+	if (mb86a16_write(state, MB86A16_FAGCS4, 0x1e) < 0)
+		goto err;
+	if (mb86a16_write(state, MB86A16_FAGCS5, 0x23) < 0)
+		goto err;
+	if (mb86a16_write(state, 0x54, 0xff) < 0)
+		goto err;
+	if (mb86a16_write(state, MB86A16_TSOUT, 0x00) < 0)
+		goto err;
+
+	return 0;
+
+err:
+	dprintk(verbose, MB86A16_ERROR, 1, "I2C transfer error");
+	return -EREMOTEIO;
+}
+
+static int S01T_set(struct mb86a16_state *state,
+		    unsigned char s1t,
+		    unsigned s0t)
+{
+	if (mb86a16_write(state, 0x33, (s1t << 3) | s0t) < 0)
+		goto err;
+
+	return 0;
+err:
+	dprintk(verbose, MB86A16_ERROR, 1, "I2C transfer error");
+	return -EREMOTEIO;
+}
+
+
+static int EN_set(struct mb86a16_state *state,
+		  int cren,
+		  int afcen)
+{
+	unsigned char val;
+
+	val = 0x7a | (cren << 7) | (afcen << 2);
+	if (mb86a16_write(state, 0x49, val) < 0)
+		goto err;
+
+	return 0;
+err:
+	dprintk(verbose, MB86A16_ERROR, 1, "I2C transfer error");
+	return -EREMOTEIO;
+}
+
+static int AFCEXEN_set(struct mb86a16_state *state,
+		       int afcexen,
+		       int smrt)
+{
+	unsigned char AFCA ;
+
+	if (smrt > 18875)
+		AFCA = 4;
+	else if (smrt > 9375)
+		AFCA = 3;
+	else if (smrt > 2250)
+		AFCA = 2;
+	else
+		AFCA = 1;
+
+	if (mb86a16_write(state, 0x2a, 0x02 | (afcexen << 5) | (AFCA << 2)) < 0)
+		goto err;
+
+	return 0;
+
+err:
+	dprintk(verbose, MB86A16_ERROR, 1, "I2C transfer error");
+	return -EREMOTEIO;
+}
+
+static int DAGC_data_set(struct mb86a16_state *state,
+			 unsigned char DAGCA,
+			 unsigned char DAGCW)
+{
+	if (mb86a16_write(state, 0x2d, (DAGCA << 3) | DAGCW) < 0)
+		goto err;
+
+	return 0;
+
+err:
+	dprintk(verbose, MB86A16_ERROR, 1, "I2C transfer error");
+	return -EREMOTEIO;
+}
+
+static void smrt_info_get(struct mb86a16_state *state, int rate)
+{
+	if (rate >= 37501) {
+		state->deci = 0; state->csel = 0; state->rsel = 0;
+	} else if (rate >= 30001) {
+		state->deci = 0; state->csel = 0; state->rsel = 1;
+	} else if (rate >= 26251) {
+		state->deci = 0; state->csel = 1; state->rsel = 0;
+	} else if (rate >= 22501) {
+		state->deci = 0; state->csel = 1; state->rsel = 1;
+	} else if (rate >= 18751) {
+		state->deci = 1; state->csel = 0; state->rsel = 0;
+	} else if (rate >= 15001) {
+		state->deci = 1; state->csel = 0; state->rsel = 1;
+	} else if (rate >= 13126) {
+		state->deci = 1; state->csel = 1; state->rsel = 0;
+	} else if (rate >= 11251) {
+		state->deci = 1; state->csel = 1; state->rsel = 1;
+	} else if (rate >= 9376) {
+		state->deci = 2; state->csel = 0; state->rsel = 0;
+	} else if (rate >= 7501) {
+		state->deci = 2; state->csel = 0; state->rsel = 1;
+	} else if (rate >= 6563) {
+		state->deci = 2; state->csel = 1; state->rsel = 0;
+	} else if (rate >= 5626) {
+		state->deci = 2; state->csel = 1; state->rsel = 1;
+	} else if (rate >= 4688) {
+		state->deci = 3; state->csel = 0; state->rsel = 0;
+	} else if (rate >= 3751) {
+		state->deci = 3; state->csel = 0; state->rsel = 1;
+	} else if (rate >= 3282) {
+		state->deci = 3; state->csel = 1; state->rsel = 0;
+	} else if (rate >= 2814) {
+		state->deci = 3; state->csel = 1; state->rsel = 1;
+	} else if (rate >= 2344) {
+		state->deci = 4; state->csel = 0; state->rsel = 0;
+	} else if (rate >= 1876) {
+		state->deci = 4; state->csel = 0; state->rsel = 1;
+	} else if (rate >= 1641) {
+		state->deci = 4; state->csel = 1; state->rsel = 0;
+	} else if (rate >= 1407) {
+		state->deci = 4; state->csel = 1; state->rsel = 1;
+	} else if (rate >= 1172) {
+		state->deci = 5; state->csel = 0; state->rsel = 0;
+	} else if (rate >=  939) {
+		state->deci = 5; state->csel = 0; state->rsel = 1;
+	} else if (rate >=  821) {
+		state->deci = 5; state->csel = 1; state->rsel = 0;
+	} else {
+		state->deci = 5; state->csel = 1; state->rsel = 1;
+	}
+
+	if (state->csel == 0)
+		state->master_clk = 92000;
+	else
+		state->master_clk = 61333;
+
+}
+
+static int signal_det(struct mb86a16_state *state,
+		      int smrt,
+		      unsigned char *SIG)
+{
+
+	int ret ;
+	int smrtd ;
+	int wait_sym ;
+
+	u32 wait_t;
+	unsigned char S[3] ;
+	int i ;
+
+	if (*SIG > 45) {
+		if (CNTM_set(state, 2, 1, 2) < 0) {
+			dprintk(verbose, MB86A16_ERROR, 1, "CNTM set Error");
+			return -1;
+		}
+		wait_sym = 40000;
+	} else {
+		if (CNTM_set(state, 3, 1, 2) < 0) {
+			dprintk(verbose, MB86A16_ERROR, 1, "CNTM set Error");
+			return -1;
+		}
+		wait_sym = 80000;
+	}
+	for (i = 0; i < 3; i++) {
+		if (i == 0)
+			smrtd = smrt * 98 / 100;
+		else if (i == 1)
+			smrtd = smrt;
+		else
+			smrtd = smrt * 102 / 100;
+		smrt_info_get(state, smrtd);
+		smrt_set(state, smrtd);
+		srst(state);
+		wait_t = (wait_sym + 99 * smrtd / 100) / smrtd;
+		if (wait_t == 0)
+			wait_t = 1;
+		msleep_interruptible(10);
+		if (mb86a16_read(state, 0x37, &(S[i])) != 2) {
+			dprintk(verbose, MB86A16_ERROR, 1, "I2C transfer error");
+			return -EREMOTEIO;
+		}
+	}
+	if ((S[1] > S[0] * 112 / 100) &&
+	    (S[1] > S[2] * 112 / 100)) {
+
+		ret = 1;
+	} else {
+		ret = 0;
+	}
+	*SIG = S[1];
+
+	if (CNTM_set(state, 0, 1, 2) < 0) {
+		dprintk(verbose, MB86A16_ERROR, 1, "CNTM set Error");
+		return -1;
+	}
+
+	return ret;
+}
+
+static int rf_val_set(struct mb86a16_state *state,
+		      int f,
+		      int smrt,
+		      unsigned char R)
+{
+	unsigned char C, F, B;
+	int M;
+	unsigned char rf_val[5];
+	int ack = -1;
+
+	if (smrt > 37750)
+		C = 1;
+	else if (smrt > 18875)
+		C = 2;
+	else if (smrt > 5500)
+		C = 3;
+	else
+		C = 4;
+
+	if (smrt > 30500)
+		F = 3;
+	else if (smrt > 9375)
+		F = 1;
+	else if (smrt > 4625)
+		F = 0;
+	else
+		F = 2;
+
+	if (f < 1060)
+		B = 0;
+	else if (f < 1175)
+		B = 1;
+	else if (f < 1305)
+		B = 2;
+	else if (f < 1435)
+		B = 3;
+	else if (f < 1570)
+		B = 4;
+	else if (f < 1715)
+		B = 5;
+	else if (f < 1845)
+		B = 6;
+	else if (f < 1980)
+		B = 7;
+	else if (f < 2080)
+		B = 8;
+	else
+		B = 9;
+
+	M = f * (1 << R) / 2;
+
+	rf_val[0] = 0x01 | (C << 3) | (F << 1);
+	rf_val[1] = (R << 5) | ((M & 0x1f000) >> 12);
+	rf_val[2] = (M & 0x00ff0) >> 4;
+	rf_val[3] = ((M & 0x0000f) << 4) | B;
+
+	/* Frequency Set */
+	if (mb86a16_write(state, 0x21, rf_val[0]) < 0)
+		ack = 0;
+	if (mb86a16_write(state, 0x22, rf_val[1]) < 0)
+		ack = 0;
+	if (mb86a16_write(state, 0x23, rf_val[2]) < 0)
+		ack = 0;
+	if (mb86a16_write(state, 0x24, rf_val[3]) < 0)
+		ack = 0;
+	if (mb86a16_write(state, 0x25, 0x01) < 0)
+		ack = 0;
+	if (ack == 0) {
+		dprintk(verbose, MB86A16_ERROR, 1, "RF Setup - I2C transfer error");
+		return -EREMOTEIO;
+	}
+
+	return 0;
+}
+
+static int afcerr_chk(struct mb86a16_state *state)
+{
+	unsigned char AFCM_L, AFCM_H ;
+	int AFCM ;
+	int afcm, afcerr ;
+
+	if (mb86a16_read(state, 0x0e, &AFCM_L) != 2)
+		goto err;
+	if (mb86a16_read(state, 0x0f, &AFCM_H) != 2)
+		goto err;
+
+	AFCM = (AFCM_H << 8) + AFCM_L;
+
+	if (AFCM > 2048)
+		afcm = AFCM - 4096;
+	else
+		afcm = AFCM;
+	afcerr = afcm * state->master_clk / 8192;
+
+	return afcerr;
+
+err:
+	dprintk(verbose, MB86A16_ERROR, 1, "I2C transfer error");
+	return -EREMOTEIO;
+}
+
+static int dagcm_val_get(struct mb86a16_state *state)
+{
+	int DAGCM;
+	unsigned char DAGCM_H, DAGCM_L;
+
+	if (mb86a16_read(state, 0x45, &DAGCM_L) != 2)
+		goto err;
+	if (mb86a16_read(state, 0x46, &DAGCM_H) != 2)
+		goto err;
+
+	DAGCM = (DAGCM_H << 8) + DAGCM_L;
+
+	return DAGCM;
+
+err:
+	dprintk(verbose, MB86A16_ERROR, 1, "I2C transfer error");
+	return -EREMOTEIO;
+}
+
+static int mb86a16_read_status(struct dvb_frontend *fe, fe_status_t *status)
+{
+	u8 stat, stat2;
+	struct mb86a16_state *state = fe->demodulator_priv;
+
+	*status = 0;
+
+	if (mb86a16_read(state, MB86A16_SIG1, &stat) != 2)
+		goto err;
+	if (mb86a16_read(state, MB86A16_SIG2, &stat2) != 2)
+		goto err;
+	if ((stat > 25) && (stat2 > 25))
+		*status |= FE_HAS_SIGNAL;
+	if ((stat > 45) && (stat2 > 45))
+		*status |= FE_HAS_CARRIER;
+
+	if (mb86a16_read(state, MB86A16_STATUS, &stat) != 2)
+		goto err;
+
+	if (stat & 0x01)
+		*status |= FE_HAS_SYNC;
+	if (stat & 0x01)
+		*status |= FE_HAS_VITERBI;
+
+	if (mb86a16_read(state, MB86A16_FRAMESYNC, &stat) != 2)
+		goto err;
+
+	if ((stat & 0x0f) && (*status & FE_HAS_VITERBI))
+		*status |= FE_HAS_LOCK;
+
+	return 0;
+
+err:
+	dprintk(verbose, MB86A16_ERROR, 1, "I2C transfer error");
+	return -EREMOTEIO;
+}
+
+static int sync_chk(struct mb86a16_state *state,
+		    unsigned char *VIRM)
+{
+	unsigned char val;
+	int sync;
+
+	if (mb86a16_read(state, 0x0d, &val) != 2)
+		goto err;
+
+	dprintk(verbose, MB86A16_INFO, 1, "Status = %02x,", val);
+	sync = val & 0x01;
+	*VIRM = (val & 0x1c) >> 2;
+
+	return sync;
+err:
+	dprintk(verbose, MB86A16_ERROR, 1, "I2C transfer error");
+	return -EREMOTEIO;
+
+}
+
+static int freqerr_chk(struct mb86a16_state *state,
+		       int fTP,
+		       int smrt,
+		       int unit)
+{
+	unsigned char CRM, AFCML, AFCMH;
+	unsigned char temp1, temp2, temp3;
+	int crm, afcm, AFCM;
+	int crrerr, afcerr;		/* kHz */
+	int frqerr;			/* MHz */
+	int afcen, afcexen = 0;
+	int R, M, fOSC, fOSC_OFS;
+
+	if (mb86a16_read(state, 0x43, &CRM) != 2)
+		goto err;
+
+	if (CRM > 127)
+		crm = CRM - 256;
+	else
+		crm = CRM;
+
+	crrerr = smrt * crm / 256;
+	if (mb86a16_read(state, 0x49, &temp1) != 2)
+		goto err;
+
+	afcen = (temp1 & 0x04) >> 2;
+	if (afcen == 0) {
+		if (mb86a16_read(state, 0x2a, &temp1) != 2)
+			goto err;
+		afcexen = (temp1 & 0x20) >> 5;
+	}
+
+	if (afcen == 1) {
+		if (mb86a16_read(state, 0x0e, &AFCML) != 2)
+			goto err;
+		if (mb86a16_read(state, 0x0f, &AFCMH) != 2)
+			goto err;
+	} else if (afcexen == 1) {
+		if (mb86a16_read(state, 0x2b, &AFCML) != 2)
+			goto err;
+		if (mb86a16_read(state, 0x2c, &AFCMH) != 2)
+			goto err;
+	}
+	if ((afcen == 1) || (afcexen == 1)) {
+		smrt_info_get(state, smrt);
+		AFCM = ((AFCMH & 0x01) << 8) + AFCML;
+		if (AFCM > 255)
+			afcm = AFCM - 512;
+		else
+			afcm = AFCM;
+
+		afcerr = afcm * state->master_clk / 8192;
+	} else
+		afcerr = 0;
+
+	if (mb86a16_read(state, 0x22, &temp1) != 2)
+		goto err;
+	if (mb86a16_read(state, 0x23, &temp2) != 2)
+		goto err;
+	if (mb86a16_read(state, 0x24, &temp3) != 2)
+		goto err;
+
+	R = (temp1 & 0xe0) >> 5;
+	M = ((temp1 & 0x1f) << 12) + (temp2 << 4) + (temp3 >> 4);
+	if (R == 0)
+		fOSC = 2 * M;
+	else
+		fOSC = M;
+
+	fOSC_OFS = fOSC - fTP;
+
+	if (unit == 0) {	/* MHz */
+		if (crrerr + afcerr + fOSC_OFS * 1000 >= 0)
+			frqerr = (crrerr + afcerr + fOSC_OFS * 1000 + 500) / 1000;
+		else
+			frqerr = (crrerr + afcerr + fOSC_OFS * 1000 - 500) / 1000;
+	} else {	/* kHz */
+		frqerr = crrerr + afcerr + fOSC_OFS * 1000;
+	}
+
+	return frqerr;
+err:
+	dprintk(verbose, MB86A16_ERROR, 1, "I2C transfer error");
+	return -EREMOTEIO;
+}
+
+static unsigned char vco_dev_get(struct mb86a16_state *state, int smrt)
+{
+	unsigned char R;
+
+	if (smrt > 9375)
+		R = 0;
+	else
+		R = 1;
+
+	return R;
+}
+
+static void swp_info_get(struct mb86a16_state *state,
+			 int fOSC_start,
+			 int smrt,
+			 int v, int R,
+			 int swp_ofs,
+			 int *fOSC,
+			 int *afcex_freq,
+			 unsigned char *AFCEX_L,
+			 unsigned char *AFCEX_H)
+{
+	int AFCEX ;
+	int crnt_swp_freq ;
+
+	crnt_swp_freq = fOSC_start * 1000 + v * swp_ofs;
+
+	if (R == 0)
+		*fOSC = (crnt_swp_freq + 1000) / 2000 * 2;
+	else
+		*fOSC = (crnt_swp_freq + 500) / 1000;
+
+	if (*fOSC >= crnt_swp_freq)
+		*afcex_freq = *fOSC * 1000 - crnt_swp_freq;
+	else
+		*afcex_freq = crnt_swp_freq - *fOSC * 1000;
+
+	AFCEX = *afcex_freq * 8192 / state->master_clk;
+	*AFCEX_L =  AFCEX & 0x00ff;
+	*AFCEX_H = (AFCEX & 0x0f00) >> 8;
+}
+
+
+static int swp_freq_calcuation(struct mb86a16_state *state, int i, int v, int *V,  int vmax, int vmin,
+			       int SIGMIN, int fOSC, int afcex_freq, int swp_ofs, unsigned char *SIG1)
+{
+	int swp_freq ;
+
+	if ((i % 2 == 1) && (v <= vmax)) {
+		/* positive v (case 1) */
+		if ((v - 1 == vmin)				&&
+		    (*(V + 30 + v) >= 0)			&&
+		    (*(V + 30 + v - 1) >= 0)			&&
+		    (*(V + 30 + v - 1) > *(V + 30 + v))		&&
+		    (*(V + 30 + v - 1) > SIGMIN)) {
+
+			swp_freq = fOSC * 1000 + afcex_freq - swp_ofs;
+			*SIG1 = *(V + 30 + v - 1);
+		} else if ((v == vmax)				&&
+			   (*(V + 30 + v) >= 0)			&&
+			   (*(V + 30 + v - 1) >= 0)		&&
+			   (*(V + 30 + v) > *(V + 30 + v - 1))	&&
+			   (*(V + 30 + v) > SIGMIN)) {
+			/* (case 2) */
+			swp_freq = fOSC * 1000 + afcex_freq;
+			*SIG1 = *(V + 30 + v);
+		} else if ((*(V + 30 + v) > 0)			&&
+			   (*(V + 30 + v - 1) > 0)		&&
+			   (*(V + 30 + v - 2) > 0)		&&
+			   (*(V + 30 + v - 3) > 0)		&&
+			   (*(V + 30 + v - 1) > *(V + 30 + v))	&&
+			   (*(V + 30 + v - 2) > *(V + 30 + v - 3)) &&
+			   ((*(V + 30 + v - 1) > SIGMIN)	||
+			   (*(V + 30 + v - 2) > SIGMIN))) {
+			/* (case 3) */
+			if (*(V + 30 + v - 1) >= *(V + 30 + v - 2)) {
+				swp_freq = fOSC * 1000 + afcex_freq - swp_ofs;
+				*SIG1 = *(V + 30 + v - 1);
+			} else {
+				swp_freq = fOSC * 1000 + afcex_freq - swp_ofs * 2;
+				*SIG1 = *(V + 30 + v - 2);
+			}
+		} else if ((v == vmax)				&&
+			   (*(V + 30 + v) >= 0)			&&
+			   (*(V + 30 + v - 1) >= 0)		&&
+			   (*(V + 30 + v - 2) >= 0)		&&
+			   (*(V + 30 + v) > *(V + 30 + v - 2))	&&
+			   (*(V + 30 + v - 1) > *(V + 30 + v - 2)) &&
+			   ((*(V + 30 + v) > SIGMIN)		||
+			   (*(V + 30 + v - 1) > SIGMIN))) {
+			/* (case 4) */
+			if (*(V + 30 + v) >= *(V + 30 + v - 1)) {
+				swp_freq = fOSC * 1000 + afcex_freq;
+				*SIG1 = *(V + 30 + v);
+			} else {
+				swp_freq = fOSC * 1000 + afcex_freq - swp_ofs;
+				*SIG1 = *(V + 30 + v - 1);
+			}
+		} else  {
+			swp_freq = -1 ;
+		}
+	} else if ((i % 2 == 0) && (v >= vmin)) {
+		/* Negative v (case 1) */
+		if ((*(V + 30 + v) > 0)				&&
+		    (*(V + 30 + v + 1) > 0)			&&
+		    (*(V + 30 + v + 2) > 0)			&&
+		    (*(V + 30 + v + 1) > *(V + 30 + v))		&&
+		    (*(V + 30 + v + 1) > *(V + 30 + v + 2))	&&
+		    (*(V + 30 + v + 1) > SIGMIN)) {
+
+			swp_freq = fOSC * 1000 + afcex_freq + swp_ofs;
+			*SIG1 = *(V + 30 + v + 1);
+		} else if ((v + 1 == vmax)			&&
+			   (*(V + 30 + v) >= 0)			&&
+			   (*(V + 30 + v + 1) >= 0)		&&
+			   (*(V + 30 + v + 1) > *(V + 30 + v))	&&
+			   (*(V + 30 + v + 1) > SIGMIN)) {
+			/* (case 2) */
+			swp_freq = fOSC * 1000 + afcex_freq + swp_ofs;
+			*SIG1 = *(V + 30 + v);
+		} else if ((v == vmin)				&&
+			   (*(V + 30 + v) > 0)			&&
+			   (*(V + 30 + v + 1) > 0)		&&
+			   (*(V + 30 + v + 2) > 0)		&&
+			   (*(V + 30 + v) > *(V + 30 + v + 1))	&&
+			   (*(V + 30 + v) > *(V + 30 + v + 2))	&&
+			   (*(V + 30 + v) > SIGMIN)) {
+			/* (case 3) */
+			swp_freq = fOSC * 1000 + afcex_freq;
+			*SIG1 = *(V + 30 + v);
+		} else if ((*(V + 30 + v) >= 0)			&&
+			   (*(V + 30 + v + 1) >= 0)		&&
+			   (*(V + 30 + v + 2) >= 0)		&&
+			   (*(V + 30 + v + 3) >= 0)		&&
+			   (*(V + 30 + v + 1) > *(V + 30 + v))	&&
+			   (*(V + 30 + v + 2) > *(V + 30 + v + 3)) &&
+			   ((*(V + 30 + v + 1) > SIGMIN)	||
+			    (*(V + 30 + v + 2) > SIGMIN))) {
+			/* (case 4) */
+			if (*(V + 30 + v + 1) >= *(V + 30 + v + 2)) {
+				swp_freq = fOSC * 1000 + afcex_freq + swp_ofs;
+				*SIG1 = *(V + 30 + v + 1);
+			} else {
+				swp_freq = fOSC * 1000 + afcex_freq + swp_ofs * 2;
+				*SIG1 = *(V + 30 + v + 2);
+			}
+		} else if ((*(V + 30 + v) >= 0)			&&
+			   (*(V + 30 + v + 1) >= 0)		&&
+			   (*(V + 30 + v + 2) >= 0)		&&
+			   (*(V + 30 + v + 3) >= 0)		&&
+			   (*(V + 30 + v) > *(V + 30 + v + 2))	&&
+			   (*(V + 30 + v + 1) > *(V + 30 + v + 2)) &&
+			   (*(V + 30 + v) > *(V + 30 + v + 3))	&&
+			   (*(V + 30 + v + 1) > *(V + 30 + v + 3)) &&
+			   ((*(V + 30 + v) > SIGMIN)		||
+			    (*(V + 30 + v + 1) > SIGMIN))) {
+			/* (case 5) */
+			if (*(V + 30 + v) >= *(V + 30 + v + 1)) {
+				swp_freq = fOSC * 1000 + afcex_freq;
+				*SIG1 = *(V + 30 + v);
+			} else {
+				swp_freq = fOSC * 1000 + afcex_freq + swp_ofs;
+				*SIG1 = *(V + 30 + v + 1);
+			}
+		} else if ((v + 2 == vmin)			&&
+			   (*(V + 30 + v) >= 0)			&&
+			   (*(V + 30 + v + 1) >= 0)		&&
+			   (*(V + 30 + v + 2) >= 0)		&&
+			   (*(V + 30 + v + 1) > *(V + 30 + v))	&&
+			   (*(V + 30 + v + 2) > *(V + 30 + v))	&&
+			   ((*(V + 30 + v + 1) > SIGMIN)	||
+			    (*(V + 30 + v + 2) > SIGMIN))) {
+			/* (case 6) */
+			if (*(V + 30 + v + 1) >= *(V + 30 + v + 2)) {
+				swp_freq = fOSC * 1000 + afcex_freq + swp_ofs;
+				*SIG1 = *(V + 30 + v + 1);
+			} else {
+				swp_freq = fOSC * 1000 + afcex_freq + swp_ofs * 2;
+				*SIG1 = *(V + 30 + v + 2);
+			}
+		} else if ((vmax == 0) && (vmin == 0) && (*(V + 30 + v) > SIGMIN)) {
+			swp_freq = fOSC * 1000;
+			*SIG1 = *(V + 30 + v);
+		} else
+			swp_freq = -1;
+	} else
+		swp_freq = -1;
+
+	return swp_freq;
+}
+
+static void swp_info_get2(struct mb86a16_state *state,
+			  int smrt,
+			  int R,
+			  int swp_freq,
+			  int *afcex_freq,
+			  int *fOSC,
+			  unsigned char *AFCEX_L,
+			  unsigned char *AFCEX_H)
+{
+	int AFCEX ;
+
+	if (R == 0)
+		*fOSC = (swp_freq + 1000) / 2000 * 2;
+	else
+		*fOSC = (swp_freq + 500) / 1000;
+
+	if (*fOSC >= swp_freq)
+		*afcex_freq = *fOSC * 1000 - swp_freq;
+	else
+		*afcex_freq = swp_freq - *fOSC * 1000;
+
+	AFCEX = *afcex_freq * 8192 / state->master_clk;
+	*AFCEX_L =  AFCEX & 0x00ff;
+	*AFCEX_H = (AFCEX & 0x0f00) >> 8;
+}
+
+static void afcex_info_get(struct mb86a16_state *state,
+			   int afcex_freq,
+			   unsigned char *AFCEX_L,
+			   unsigned char *AFCEX_H)
+{
+	int AFCEX ;
+
+	AFCEX = afcex_freq * 8192 / state->master_clk;
+	*AFCEX_L =  AFCEX & 0x00ff;
+	*AFCEX_H = (AFCEX & 0x0f00) >> 8;
+}
+
+static int SEQ_set(struct mb86a16_state *state, unsigned char loop)
+{
+	/* SLOCK0 = 0 */
+	if (mb86a16_write(state, 0x32, 0x02 | (loop << 2)) < 0) {
+		dprintk(verbose, MB86A16_ERROR, 1, "I2C transfer error");
+		return -EREMOTEIO;
+	}
+
+	return 0;
+}
+
+static int iq_vt_set(struct mb86a16_state *state, unsigned char IQINV)
+{
+	/* Viterbi Rate, IQ Settings */
+	if (mb86a16_write(state, 0x06, 0xdf | (IQINV << 5)) < 0) {
+		dprintk(verbose, MB86A16_ERROR, 1, "I2C transfer error");
+		return -EREMOTEIO;
+	}
+
+	return 0;
+}
+
+static int FEC_srst(struct mb86a16_state *state)
+{
+	if (mb86a16_write(state, MB86A16_RESET, 0x02) < 0) {
+		dprintk(verbose, MB86A16_ERROR, 1, "I2C transfer error");
+		return -EREMOTEIO;
+	}
+
+	return 0;
+}
+
+static int S2T_set(struct mb86a16_state *state, unsigned char S2T)
+{
+	if (mb86a16_write(state, 0x34, 0x70 | S2T) < 0) {
+		dprintk(verbose, MB86A16_ERROR, 1, "I2C transfer error");
+		return -EREMOTEIO;
+	}
+
+	return 0;
+}
+
+static int S45T_set(struct mb86a16_state *state, unsigned char S4T, unsigned char S5T)
+{
+	if (mb86a16_write(state, 0x35, 0x00 | (S5T << 4) | S4T) < 0) {
+		dprintk(verbose, MB86A16_ERROR, 1, "I2C transfer error");
+		return -EREMOTEIO;
+	}
+
+	return 0;
+}
+
+
+static int mb86a16_set_fe(struct mb86a16_state *state)
+{
+	u8 agcval, cnmval;
+
+	int i, j;
+	int fOSC = 0;
+	int fOSC_start = 0;
+	int wait_t;
+	int fcp;
+	int swp_ofs;
+	int V[60];
+	u8 SIG1MIN;
+
+	unsigned char CREN, AFCEN, AFCEXEN;
+	unsigned char SIG1;
+	unsigned char TIMINT1, TIMINT2, TIMEXT;
+	unsigned char S0T, S1T;
+	unsigned char S2T;
+/*	unsigned char S2T, S3T; */
+	unsigned char S4T, S5T;
+	unsigned char AFCEX_L, AFCEX_H;
+	unsigned char R;
+	unsigned char VIRM;
+	unsigned char ETH, VIA;
+	unsigned char junk;
+
+	int loop;
+	int ftemp;
+	int v, vmax, vmin;
+	int vmax_his, vmin_his;
+	int swp_freq, prev_swp_freq[20];
+	int prev_freq_num;
+	int signal_dupl;
+	int afcex_freq;
+	int signal;
+	int afcerr;
+	int temp_freq, delta_freq;
+	int dagcm[4];
+	int smrt_d;
+/*	int freq_err; */
+	int n;
+	int ret = -1;
+	int sync;
+
+	dprintk(verbose, MB86A16_INFO, 1, "freq=%d Mhz, symbrt=%d Ksps", state->frequency, state->srate);
+
+	fcp = 3000;
+	swp_ofs = state->srate / 4;
+
+	for (i = 0; i < 60; i++)
+		V[i] = -1;
+
+	for (i = 0; i < 20; i++)
+		prev_swp_freq[i] = 0;
+
+	SIG1MIN = 25;
+
+	for (n = 0; ((n < 3) && (ret == -1)); n++) {
+		SEQ_set(state, 0);
+		iq_vt_set(state, 0);
+
+		CREN = 0;
+		AFCEN = 0;
+		AFCEXEN = 1;
+		TIMINT1 = 0;
+		TIMINT2 = 1;
+		TIMEXT = 2;
+		S1T = 0;
+		S0T = 0;
+
+		if (initial_set(state) < 0) {
+			dprintk(verbose, MB86A16_ERROR, 1, "initial set failed");
+			return -1;
+		}
+		if (DAGC_data_set(state, 3, 2) < 0) {
+			dprintk(verbose, MB86A16_ERROR, 1, "DAGC data set error");
+			return -1;
+		}
+		if (EN_set(state, CREN, AFCEN) < 0) {
+			dprintk(verbose, MB86A16_ERROR, 1, "EN set error");
+			return -1; /* (0, 0) */
+		}
+		if (AFCEXEN_set(state, AFCEXEN, state->srate) < 0) {
+			dprintk(verbose, MB86A16_ERROR, 1, "AFCEXEN set error");
+			return -1; /* (1, smrt) = (1, symbolrate) */
+		}
+		if (CNTM_set(state, TIMINT1, TIMINT2, TIMEXT) < 0) {
+			dprintk(verbose, MB86A16_ERROR, 1, "CNTM set error");
+			return -1; /* (0, 1, 2) */
+		}
+		if (S01T_set(state, S1T, S0T) < 0) {
+			dprintk(verbose, MB86A16_ERROR, 1, "S01T set error");
+			return -1; /* (0, 0) */
+		}
+		smrt_info_get(state, state->srate);
+		if (smrt_set(state, state->srate) < 0) {
+			dprintk(verbose, MB86A16_ERROR, 1, "smrt info get error");
+			return -1;
+		}
+
+		R = vco_dev_get(state, state->srate);
+		if (R == 1)
+			fOSC_start = state->frequency;
+
+		else if (R == 0) {
+			if (state->frequency % 2 == 0) {
+				fOSC_start = state->frequency;
+			} else {
+				fOSC_start = state->frequency + 1;
+				if (fOSC_start > 2150)
+					fOSC_start = state->frequency - 1;
+			}
+		}
+		loop = 1;
+		ftemp = fOSC_start * 1000;
+		vmax = 0 ;
+		while (loop == 1) {
+			ftemp = ftemp + swp_ofs;
+			vmax++;
+
+			/* Upper bound */
+			if (ftemp > 2150000) {
+				loop = 0;
+				vmax--;
+			} else {
+				if ((ftemp == 2150000) ||
+				    (ftemp - state->frequency * 1000 >= fcp + state->srate / 4))
+					loop = 0;
+			}
+		}
+
+		loop = 1;
+		ftemp = fOSC_start * 1000;
+		vmin = 0 ;
+		while (loop == 1) {
+			ftemp = ftemp - swp_ofs;
+			vmin--;
+
+			/* Lower bound */
+			if (ftemp < 950000) {
+				loop = 0;
+				vmin++;
+			} else {
+				if ((ftemp == 950000) ||
+				    (state->frequency * 1000 - ftemp >= fcp + state->srate / 4))
+					loop = 0;
+			}
+		}
+
+		wait_t = (8000 + state->srate / 2) / state->srate;
+		if (wait_t == 0)
+			wait_t = 1;
+
+		i = 0;
+		j = 0;
+		prev_freq_num = 0;
+		loop = 1;
+		signal = 0;
+		vmax_his = 0;
+		vmin_his = 0;
+		v = 0;
+
+		while (loop == 1) {
+			swp_info_get(state, fOSC_start, state->srate,
+				     v, R, swp_ofs, &fOSC,
+				     &afcex_freq, &AFCEX_L, &AFCEX_H);
+
+			udelay(100);
+			if (rf_val_set(state, fOSC, state->srate, R) < 0) {
+				dprintk(verbose, MB86A16_ERROR, 1, "rf val set error");
+				return -1;
+			}
+			udelay(100);
+			if (afcex_data_set(state, AFCEX_L, AFCEX_H) < 0) {
+				dprintk(verbose, MB86A16_ERROR, 1, "afcex data set error");
+				return -1;
+			}
+			if (srst(state) < 0) {
+				dprintk(verbose, MB86A16_ERROR, 1, "srst error");
+				return -1;
+			}
+			msleep_interruptible(wait_t);
+
+			if (mb86a16_read(state, 0x37, &SIG1) != 2) {
+				dprintk(verbose, MB86A16_ERROR, 1, "I2C transfer error");
+				return -1;
+			}
+			V[30 + v] = SIG1 ;
+			swp_freq = swp_freq_calcuation(state, i, v, V, vmax, vmin,
+						      SIG1MIN, fOSC, afcex_freq,
+						      swp_ofs, &SIG1);	/* changed */
+
+			signal_dupl = 0;
+			for (j = 0; j < prev_freq_num; j++) {
+				if ((ABS(prev_swp_freq[j] - swp_freq)) < (swp_ofs * 3 / 2)) {
+					signal_dupl = 1;
+					dprintk(verbose, MB86A16_INFO, 1, "Probably Duplicate Signal, j = %d", j);
+				}
+			}
+			if ((signal_dupl == 0) && (swp_freq > 0) && (ABS(swp_freq - state->frequency * 1000) < fcp + state->srate / 6)) {
+				dprintk(verbose, MB86A16_DEBUG, 1, "------ Signal detect ------ [swp_freq=[%07d, srate=%05d]]", swp_freq, state->srate);
+				prev_swp_freq[prev_freq_num] = swp_freq;
+				prev_freq_num++;
+				swp_info_get2(state, state->srate, R, swp_freq,
+					      &afcex_freq, &fOSC,
+					      &AFCEX_L, &AFCEX_H);
+
+				if (rf_val_set(state, fOSC, state->srate, R) < 0) {
+					dprintk(verbose, MB86A16_ERROR, 1, "rf val set error");
+					return -1;
+				}
+				if (afcex_data_set(state, AFCEX_L, AFCEX_H) < 0) {
+					dprintk(verbose, MB86A16_ERROR, 1, "afcex data set error");
+					return -1;
+				}
+				signal = signal_det(state, state->srate, &SIG1);
+				if (signal == 1) {
+					dprintk(verbose, MB86A16_ERROR, 1, "***** Signal Found *****");
+					loop = 0;
+				} else {
+					dprintk(verbose, MB86A16_ERROR, 1, "!!!!! No signal !!!!!, try again...");
+					smrt_info_get(state, state->srate);
+					if (smrt_set(state, state->srate) < 0) {
+						dprintk(verbose, MB86A16_ERROR, 1, "smrt set error");
+						return -1;
+					}
+				}
+			}
+			if (v > vmax)
+				vmax_his = 1 ;
+			if (v < vmin)
+				vmin_his = 1 ;
+			i++;
+
+			if ((i % 2 == 1) && (vmax_his == 1))
+				i++;
+			if ((i % 2 == 0) && (vmin_his == 1))
+				i++;
+
+			if (i % 2 == 1)
+				v = (i + 1) / 2;
+			else
+				v = -i / 2;
+
+			if ((vmax_his == 1) && (vmin_his == 1))
+				loop = 0 ;
+		}
+
+		if (signal == 1) {
+			dprintk(verbose, MB86A16_INFO, 1, " Start Freq Error Check");
+			S1T = 7 ;
+			S0T = 1 ;
+			CREN = 0 ;
+			AFCEN = 1 ;
+			AFCEXEN = 0 ;
+
+			if (S01T_set(state, S1T, S0T) < 0) {
+				dprintk(verbose, MB86A16_ERROR, 1, "S01T set error");
+				return -1;
+			}
+			smrt_info_get(state, state->srate);
+			if (smrt_set(state, state->srate) < 0) {
+				dprintk(verbose, MB86A16_ERROR, 1, "smrt set error");
+				return -1;
+			}
+			if (EN_set(state, CREN, AFCEN) < 0) {
+				dprintk(verbose, MB86A16_ERROR, 1, "EN set error");
+				return -1;
+			}
+			if (AFCEXEN_set(state, AFCEXEN, state->srate) < 0) {
+				dprintk(verbose, MB86A16_ERROR, 1, "AFCEXEN set error");
+				return -1;
+			}
+			afcex_info_get(state, afcex_freq, &AFCEX_L, &AFCEX_H);
+			if (afcofs_data_set(state, AFCEX_L, AFCEX_H) < 0) {
+				dprintk(verbose, MB86A16_ERROR, 1, "AFCOFS data set error");
+				return -1;
+			}
+			if (srst(state) < 0) {
+				dprintk(verbose, MB86A16_ERROR, 1, "srst error");
+				return -1;
+			}
+			/* delay 4~200 */
+			wait_t = 200000 / state->master_clk + 200000 / state->srate;
+			msleep(wait_t);
+			afcerr = afcerr_chk(state);
+			if (afcerr == -1)
+				return -1;
+
+			swp_freq = fOSC * 1000 + afcerr ;
+			AFCEXEN = 1 ;
+			if (state->srate >= 1500)
+				smrt_d = state->srate / 3;
+			else
+				smrt_d = state->srate / 2;
+			smrt_info_get(state, smrt_d);
+			if (smrt_set(state, smrt_d) < 0) {
+				dprintk(verbose, MB86A16_ERROR, 1, "smrt set error");
+				return -1;
+			}
+			if (AFCEXEN_set(state, AFCEXEN, smrt_d) < 0) {
+				dprintk(verbose, MB86A16_ERROR, 1, "AFCEXEN set error");
+				return -1;
+			}
+			R = vco_dev_get(state, smrt_d);
+			if (DAGC_data_set(state, 2, 0) < 0) {
+				dprintk(verbose, MB86A16_ERROR, 1, "DAGC data set error");
+				return -1;
+			}
+			for (i = 0; i < 3; i++) {
+				temp_freq = swp_freq + (i - 1) * state->srate / 8;
+				swp_info_get2(state, smrt_d, R, temp_freq, &afcex_freq, &fOSC, &AFCEX_L, &AFCEX_H);
+				if (rf_val_set(state, fOSC, smrt_d, R) < 0) {
+					dprintk(verbose, MB86A16_ERROR, 1, "rf val set error");
+					return -1;
+				}
+				if (afcex_data_set(state, AFCEX_L, AFCEX_H) < 0) {
+					dprintk(verbose, MB86A16_ERROR, 1, "afcex data set error");
+					return -1;
+				}
+				wait_t = 200000 / state->master_clk + 40000 / smrt_d;
+				msleep(wait_t);
+				dagcm[i] = dagcm_val_get(state);
+			}
+			if ((dagcm[0] > dagcm[1]) &&
+			    (dagcm[0] > dagcm[2]) &&
+			    (dagcm[0] - dagcm[1] > 2 * (dagcm[2] - dagcm[1]))) {
+
+				temp_freq = swp_freq - 2 * state->srate / 8;
+				swp_info_get2(state, smrt_d, R, temp_freq, &afcex_freq, &fOSC, &AFCEX_L, &AFCEX_H);
+				if (rf_val_set(state, fOSC, smrt_d, R) < 0) {
+					dprintk(verbose, MB86A16_ERROR, 1, "rf val set error");
+					return -1;
+				}
+				if (afcex_data_set(state, AFCEX_L, AFCEX_H) < 0) {
+					dprintk(verbose, MB86A16_ERROR, 1, "afcex data set");
+					return -1;
+				}
+				wait_t = 200000 / state->master_clk + 40000 / smrt_d;
+				msleep(wait_t);
+				dagcm[3] = dagcm_val_get(state);
+				if (dagcm[3] > dagcm[1])
+					delta_freq = (dagcm[2] - dagcm[0] + dagcm[1] - dagcm[3]) * state->srate / 300;
+				else
+					delta_freq = 0;
+			} else if ((dagcm[2] > dagcm[1]) &&
+				   (dagcm[2] > dagcm[0]) &&
+				   (dagcm[2] - dagcm[1] > 2 * (dagcm[0] - dagcm[1]))) {
+
+				temp_freq = swp_freq + 2 * state->srate / 8;
+				swp_info_get2(state, smrt_d, R, temp_freq, &afcex_freq, &fOSC, &AFCEX_L, &AFCEX_H);
+				if (rf_val_set(state, fOSC, smrt_d, R) < 0) {
+					dprintk(verbose, MB86A16_ERROR, 1, "rf val set");
+					return -1;
+				}
+				if (afcex_data_set(state, AFCEX_L, AFCEX_H) < 0) {
+					dprintk(verbose, MB86A16_ERROR, 1, "afcex data set");
+					return -1;
+				}
+				wait_t = 200000 / state->master_clk + 40000 / smrt_d;
+				msleep(wait_t);
+				dagcm[3] = dagcm_val_get(state);
+				if (dagcm[3] > dagcm[1])
+					delta_freq = (dagcm[2] - dagcm[0] + dagcm[3] - dagcm[1]) * state->srate / 300;
+				else
+					delta_freq = 0 ;
+
+			} else {
+				delta_freq = 0 ;
+			}
+			dprintk(verbose, MB86A16_INFO, 1, "SWEEP Frequency = %d", swp_freq);
+			swp_freq += delta_freq;
+			dprintk(verbose, MB86A16_INFO, 1, "Adjusting .., DELTA Freq = %d, SWEEP Freq=%d", delta_freq, swp_freq);
+			if (ABS(state->frequency * 1000 - swp_freq) > 3800) {
+				dprintk(verbose, MB86A16_INFO, 1, "NO  --  SIGNAL !");
+			} else {
+
+				S1T = 0;
+				S0T = 3;
+				CREN = 1;
+				AFCEN = 0;
+				AFCEXEN = 1;
+
+				if (S01T_set(state, S1T, S0T) < 0) {
+					dprintk(verbose, MB86A16_ERROR, 1, "S01T set error");
+					return -1;
+				}
+				if (DAGC_data_set(state, 0, 0) < 0) {
+					dprintk(verbose, MB86A16_ERROR, 1, "DAGC data set error");
+					return -1;
+				}
+				R = vco_dev_get(state, state->srate);
+				smrt_info_get(state, state->srate);
+				if (smrt_set(state, state->srate) < 0) {
+					dprintk(verbose, MB86A16_ERROR, 1, "smrt set error");
+					return -1;
+				}
+				if (EN_set(state, CREN, AFCEN) < 0) {
+					dprintk(verbose, MB86A16_ERROR, 1, "EN set error");
+					return -1;
+				}
+				if (AFCEXEN_set(state, AFCEXEN, state->srate) < 0) {
+					dprintk(verbose, MB86A16_ERROR, 1, "AFCEXEN set error");
+					return -1;
+				}
+				swp_info_get2(state, state->srate, R, swp_freq, &afcex_freq, &fOSC, &AFCEX_L, &AFCEX_H);
+				if (rf_val_set(state, fOSC, state->srate, R) < 0) {
+					dprintk(verbose, MB86A16_ERROR, 1, "rf val set error");
+					return -1;
+				}
+				if (afcex_data_set(state, AFCEX_L, AFCEX_H) < 0) {
+					dprintk(verbose, MB86A16_ERROR, 1, "afcex data set error");
+					return -1;
+				}
+				if (srst(state) < 0) {
+					dprintk(verbose, MB86A16_ERROR, 1, "srst error");
+					return -1;
+				}
+				wait_t = 7 + (10000 + state->srate / 2) / state->srate;
+				if (wait_t == 0)
+					wait_t = 1;
+				msleep_interruptible(wait_t);
+				if (mb86a16_read(state, 0x37, &SIG1) != 2) {
+					dprintk(verbose, MB86A16_ERROR, 1, "I2C transfer error");
+					return -EREMOTEIO;
+				}
+
+				if (SIG1 > 110) {
+					S2T = 4; S4T = 1; S5T = 6; ETH = 4; VIA = 6;
+					wait_t = 7 + (917504 + state->srate / 2) / state->srate;
+				} else if (SIG1 > 105) {
+					S2T = 4; S4T = 2; S5T = 8; ETH = 7; VIA = 2;
+					wait_t = 7 + (1048576 + state->srate / 2) / state->srate;
+				} else if (SIG1 > 85) {
+					S2T = 5; S4T = 2; S5T = 8; ETH = 7; VIA = 2;
+					wait_t = 7 + (1310720 + state->srate / 2) / state->srate;
+				} else if (SIG1 > 65) {
+					S2T = 6; S4T = 2; S5T = 8; ETH = 7; VIA = 2;
+					wait_t = 7 + (1572864 + state->srate / 2) / state->srate;
+				} else {
+					S2T = 7; S4T = 2; S5T = 8; ETH = 7; VIA = 2;
+					wait_t = 7 + (2097152 + state->srate / 2) / state->srate;
+				}
+				wait_t *= 2; /* FOS */
+				S2T_set(state, S2T);
+				S45T_set(state, S4T, S5T);
+				Vi_set(state, ETH, VIA);
+				srst(state);
+				msleep_interruptible(wait_t);
+				sync = sync_chk(state, &VIRM);
+				dprintk(verbose, MB86A16_INFO, 1, "-------- Viterbi=[%d] SYNC=[%d] ---------", VIRM, sync);
+				if (VIRM) {
+					if (VIRM == 4) {
+						/* 5/6 */
+						if (SIG1 > 110)
+							wait_t = (786432 + state->srate / 2) / state->srate;
+						else
+							wait_t = (1572864 + state->srate / 2) / state->srate;
+						if (state->srate < 5000)
+							/* FIXME ! , should be a long wait ! */
+							msleep_interruptible(wait_t);
+						else
+							msleep_interruptible(wait_t);
+
+						if (sync_chk(state, &junk) == 0) {
+							iq_vt_set(state, 1);
+							FEC_srst(state);
+						}
+					}
+					/* 1/2, 2/3, 3/4, 7/8 */
+					if (SIG1 > 110)
+						wait_t = (786432 + state->srate / 2) / state->srate;
+					else
+						wait_t = (1572864 + state->srate / 2) / state->srate;
+					msleep_interruptible(wait_t);
+					SEQ_set(state, 1);
+				} else {
+					dprintk(verbose, MB86A16_INFO, 1, "NO  -- SYNC");
+					SEQ_set(state, 1);
+					ret = -1;
+				}
+			}
+		} else {
+			dprintk(verbose, MB86A16_INFO, 1, "NO  -- SIGNAL");
+			ret = -1;
+		}
+
+		sync = sync_chk(state, &junk);
+		if (sync) {
+			dprintk(verbose, MB86A16_INFO, 1, "******* SYNC *******");
+			freqerr_chk(state, state->frequency, state->srate, 1);
+			ret = 0;
+			break;
+		}
+	}
+
+	mb86a16_read(state, 0x15, &agcval);
+	mb86a16_read(state, 0x26, &cnmval);
+	dprintk(verbose, MB86A16_INFO, 1, "AGC = %02x CNM = %02x", agcval, cnmval);
+
+	return ret;
+}
+
+static int mb86a16_send_diseqc_msg(struct dvb_frontend *fe,
+				   struct dvb_diseqc_master_cmd *cmd)
+{
+	struct mb86a16_state *state = fe->demodulator_priv;
+	int i;
+	u8 regs;
+
+	if (mb86a16_write(state, MB86A16_DCC1, MB86A16_DCC1_DISTA) < 0)
+		goto err;
+	if (mb86a16_write(state, MB86A16_DCCOUT, 0x00) < 0)
+		goto err;
+	if (mb86a16_write(state, MB86A16_TONEOUT2, 0x04) < 0)
+		goto err;
+
+	regs = 0x18;
+
+	if (cmd->msg_len > 5 || cmd->msg_len < 4)
+		return -EINVAL;
+
+	for (i = 0; i < cmd->msg_len; i++) {
+		if (mb86a16_write(state, regs, cmd->msg[i]) < 0)
+			goto err;
+
+		regs++;
+	}
+	i += 0x90;
+
+	msleep_interruptible(10);
+
+	if (mb86a16_write(state, MB86A16_DCC1, i) < 0)
+		goto err;
+	if (mb86a16_write(state, MB86A16_DCCOUT, MB86A16_DCCOUT_DISEN) < 0)
+		goto err;
+
+	return 0;
+
+err:
+	dprintk(verbose, MB86A16_ERROR, 1, "I2C transfer error");
+	return -EREMOTEIO;
+}
+
+static int mb86a16_send_diseqc_burst(struct dvb_frontend *fe, fe_sec_mini_cmd_t burst)
+{
+	struct mb86a16_state *state = fe->demodulator_priv;
+
+	switch (burst) {
+	case SEC_MINI_A:
+		if (mb86a16_write(state, MB86A16_DCC1, MB86A16_DCC1_DISTA |
+						       MB86A16_DCC1_TBEN  |
+						       MB86A16_DCC1_TBO) < 0)
+			goto err;
+		if (mb86a16_write(state, MB86A16_DCCOUT, MB86A16_DCCOUT_DISEN) < 0)
+			goto err;
+		break;
+	case SEC_MINI_B:
+		if (mb86a16_write(state, MB86A16_DCC1, MB86A16_DCC1_DISTA |
+						       MB86A16_DCC1_TBEN) < 0)
+			goto err;
+		if (mb86a16_write(state, MB86A16_DCCOUT, MB86A16_DCCOUT_DISEN) < 0)
+			goto err;
+		break;
+	}
+
+	return 0;
+err:
+	dprintk(verbose, MB86A16_ERROR, 1, "I2C transfer error");
+	return -EREMOTEIO;
+}
+
+static int mb86a16_set_tone(struct dvb_frontend *fe, fe_sec_tone_mode_t tone)
+{
+	struct mb86a16_state *state = fe->demodulator_priv;
+
+	switch (tone) {
+	case SEC_TONE_ON:
+		if (mb86a16_write(state, MB86A16_TONEOUT2, 0x00) < 0)
+			goto err;
+		if (mb86a16_write(state, MB86A16_DCC1, MB86A16_DCC1_DISTA |
+						       MB86A16_DCC1_CTOE) < 0)
+
+			goto err;
+		if (mb86a16_write(state, MB86A16_DCCOUT, MB86A16_DCCOUT_DISEN) < 0)
+			goto err;
+		break;
+	case SEC_TONE_OFF:
+		if (mb86a16_write(state, MB86A16_TONEOUT2, 0x04) < 0)
+			goto err;
+		if (mb86a16_write(state, MB86A16_DCC1, MB86A16_DCC1_DISTA) < 0)
+			goto err;
+		if (mb86a16_write(state, MB86A16_DCCOUT, 0x00) < 0)
+			goto err;
+		break;
+	default:
+		return -EINVAL;
+	}
+	return 0;
+
+err:
+	dprintk(verbose, MB86A16_ERROR, 1, "I2C transfer error");
+	return -EREMOTEIO;
+}
+
+static enum dvbfe_search mb86a16_search(struct dvb_frontend *fe,
+					struct dvb_frontend_parameters *p)
+{
+	struct mb86a16_state *state = fe->demodulator_priv;
+
+	state->frequency = p->frequency / 1000;
+	state->srate = p->u.qpsk.symbol_rate / 1000;
+
+	if (!mb86a16_set_fe(state)) {
+		dprintk(verbose, MB86A16_ERROR, 1, "Succesfully acquired LOCK");
+		return DVBFE_ALGO_SEARCH_SUCCESS;
+	}
+
+	dprintk(verbose, MB86A16_ERROR, 1, "Lock acquisition failed!");
+	return DVBFE_ALGO_SEARCH_FAILED;
+}
+
+static void mb86a16_release(struct dvb_frontend *fe)
+{
+	struct mb86a16_state *state = fe->demodulator_priv;
+	kfree(state);
+}
+
+static int mb86a16_init(struct dvb_frontend *fe)
+{
+	return 0;
+}
+
+static int mb86a16_sleep(struct dvb_frontend *fe)
+{
+	return 0;
+}
+
+static int mb86a16_read_ber(struct dvb_frontend *fe, u32 *ber)
+{
+	u8 ber_mon, ber_tab, ber_lsb, ber_mid, ber_msb, ber_tim, ber_rst;
+	u32 timer;
+
+	struct mb86a16_state *state = fe->demodulator_priv;
+
+	*ber = 0;
+	if (mb86a16_read(state, MB86A16_BERMON, &ber_mon) != 2)
+		goto err;
+	if (mb86a16_read(state, MB86A16_BERTAB, &ber_tab) != 2)
+		goto err;
+	if (mb86a16_read(state, MB86A16_BERLSB, &ber_lsb) != 2)
+		goto err;
+	if (mb86a16_read(state, MB86A16_BERMID, &ber_mid) != 2)
+		goto err;
+	if (mb86a16_read(state, MB86A16_BERMSB, &ber_msb) != 2)
+		goto err;
+	/* BER monitor invalid when BER_EN = 0	*/
+	if (ber_mon & 0x04) {
+		/* coarse, fast calculation	*/
+		*ber = ber_tab & 0x1f;
+		dprintk(verbose, MB86A16_DEBUG, 1, "BER coarse=[0x%02x]", *ber);
+		if (ber_mon & 0x01) {
+			/*
+			 * BER_SEL = 1, The monitored BER is the estimated
+			 * value with a Reed-Solomon decoder error amount at
+			 * the deinterleaver output.
+			 * monitored BER is expressed as a 20 bit output in total
+			 */
+			ber_rst = ber_mon >> 3;
+			*ber = (((ber_msb << 8) | ber_mid) << 8) | ber_lsb;
+			if (ber_rst == 0)
+				timer =  12500000;
+			if (ber_rst == 1)
+				timer =  25000000;
+			if (ber_rst == 2)
+				timer =  50000000;
+			if (ber_rst == 3)
+				timer = 100000000;
+
+			*ber /= timer;
+			dprintk(verbose, MB86A16_DEBUG, 1, "BER fine=[0x%02x]", *ber);
+		} else {
+			/*
+			 * BER_SEL = 0, The monitored BER is the estimated
+			 * value with a Viterbi decoder error amount at the
+			 * QPSK demodulator output.
+			 * monitored BER is expressed as a 24 bit output in total
+			 */
+			ber_tim = ber_mon >> 1;
+			*ber = (((ber_msb << 8) | ber_mid) << 8) | ber_lsb;
+			if (ber_tim == 0)
+				timer = 16;
+			if (ber_tim == 1)
+				timer = 24;
+
+			*ber /= 2 ^ timer;
+			dprintk(verbose, MB86A16_DEBUG, 1, "BER fine=[0x%02x]", *ber);
+		}
+	}
+	return 0;
+err:
+	dprintk(verbose, MB86A16_ERROR, 1, "I2C transfer error");
+	return -EREMOTEIO;
+}
+
+static int mb86a16_read_signal_strength(struct dvb_frontend *fe, u16 *strength)
+{
+	u8 agcm = 0;
+	struct mb86a16_state *state = fe->demodulator_priv;
+
+	*strength = 0;
+	if (mb86a16_read(state, MB86A16_AGCM, &agcm) != 2) {
+		dprintk(verbose, MB86A16_ERROR, 1, "I2C transfer error");
+		return -EREMOTEIO;
+	}
+
+	*strength = ((0xff - agcm) * 100) / 256;
+	dprintk(verbose, MB86A16_DEBUG, 1, "Signal strength=[%d %%]", (u8) *strength);
+	*strength = (0xffff - 0xff) + agcm;
+
+	return 0;
+}
+
+struct cnr {
+	u8 cn_reg;
+	u8 cn_val;
+};
+
+static const struct cnr cnr_tab[] = {
+	{  35,  2 },
+	{  40,  3 },
+	{  50,  4 },
+	{  60,  5 },
+	{  70,  6 },
+	{  80,  7 },
+	{  92,  8 },
+	{ 103,  9 },
+	{ 115, 10 },
+	{ 138, 12 },
+	{ 162, 15 },
+	{ 180, 18 },
+	{ 185, 19 },
+	{ 189, 20 },
+	{ 195, 22 },
+	{ 199, 24 },
+	{ 201, 25 },
+	{ 202, 26 },
+	{ 203, 27 },
+	{ 205, 28 },
+	{ 208, 30 }
+};
+
+static int mb86a16_read_snr(struct dvb_frontend *fe, u16 *snr)
+{
+	struct mb86a16_state *state = fe->demodulator_priv;
+	int i = 0;
+	int low_tide = 2, high_tide = 30, q_level;
+	u8  cn;
+
+	*snr = 0;
+	if (mb86a16_read(state, 0x26, &cn) != 2) {
+		dprintk(verbose, MB86A16_ERROR, 1, "I2C transfer error");
+		return -EREMOTEIO;
+	}
+
+	for (i = 0; i < ARRAY_SIZE(cnr_tab); i++) {
+		if (cn < cnr_tab[i].cn_reg) {
+			*snr = cnr_tab[i].cn_val;
+			break;
+		}
+	}
+	q_level = (*snr * 100) / (high_tide - low_tide);
+	dprintk(verbose, MB86A16_ERROR, 1, "SNR (Quality) = [%d dB], Level=%d %%", *snr, q_level);
+	*snr = (0xffff - 0xff) + *snr;
+
+	return 0;
+}
+
+static int mb86a16_read_ucblocks(struct dvb_frontend *fe, u32 *ucblocks)
+{
+	u8 dist;
+	struct mb86a16_state *state = fe->demodulator_priv;
+
+	if (mb86a16_read(state, MB86A16_DISTMON, &dist) != 2) {
+		dprintk(verbose, MB86A16_ERROR, 1, "I2C transfer error");
+		return -EREMOTEIO;
+	}
+	*ucblocks = dist;
+
+	return 0;
+}
+
+static enum dvbfe_algo mb86a16_frontend_algo(struct dvb_frontend *fe)
+{
+	return DVBFE_ALGO_CUSTOM;
+}
+
+static struct dvb_frontend_ops mb86a16_ops = {
+	.info = {
+		.name			= "Fujitsu MB86A16 DVB-S",
+		.type			= FE_QPSK,
+		.frequency_min		= 950000,
+		.frequency_max		= 2150000,
+		.frequency_stepsize	= 3000,
+		.frequency_tolerance	= 0,
+		.symbol_rate_min	= 1000000,
+		.symbol_rate_max	= 45000000,
+		.symbol_rate_tolerance	= 500,
+		.caps			= FE_CAN_FEC_1_2 | FE_CAN_FEC_2_3 |
+					  FE_CAN_FEC_3_4 | FE_CAN_FEC_5_6 |
+					  FE_CAN_FEC_7_8 | FE_CAN_QPSK    |
+					  FE_CAN_FEC_AUTO
+	},
+	.release			= mb86a16_release,
+
+	.get_frontend_algo		= mb86a16_frontend_algo,
+	.search				= mb86a16_search,
+	.read_status			= mb86a16_read_status,
+	.init				= mb86a16_init,
+	.sleep				= mb86a16_sleep,
+	.read_status			= mb86a16_read_status,
+
+	.read_ber			= mb86a16_read_ber,
+	.read_signal_strength		= mb86a16_read_signal_strength,
+	.read_snr			= mb86a16_read_snr,
+	.read_ucblocks			= mb86a16_read_ucblocks,
+
+	.diseqc_send_master_cmd		= mb86a16_send_diseqc_msg,
+	.diseqc_send_burst		= mb86a16_send_diseqc_burst,
+	.set_tone			= mb86a16_set_tone,
+};
+
+struct dvb_frontend *mb86a16_attach(const struct mb86a16_config *config,
+				    struct i2c_adapter *i2c_adap)
+{
+	u8 dev_id = 0;
+	struct mb86a16_state *state = NULL;
+
+	state = kmalloc(sizeof(struct mb86a16_state), GFP_KERNEL);
+	if (state == NULL)
+		goto error;
+
+	state->config = config;
+	state->i2c_adap = i2c_adap;
+
+	mb86a16_read(state, 0x7f, &dev_id);
+	if (dev_id != 0xfe)
+		goto error;
+
+	memcpy(&state->frontend.ops, &mb86a16_ops, sizeof(struct dvb_frontend_ops));
+	state->frontend.demodulator_priv = state;
+	state->frontend.ops.set_voltage = state->config->set_voltage;
+
+	return &state->frontend;
+error:
+	kfree(state);
+	return NULL;
+}
+EXPORT_SYMBOL(mb86a16_attach);
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Manu Abraham");
diff --git a/drivers/media/dvb/frontends/mb86a16.h b/drivers/media/dvb/frontends/mb86a16.h
new file mode 100644
index 000000000000..6ea8c376394f
--- /dev/null
+++ b/drivers/media/dvb/frontends/mb86a16.h
@@ -0,0 +1,52 @@
+/*
+	Fujitsu MB86A16 DVB-S/DSS DC Receiver driver
+
+	Copyright (C) Manu Abraham (abraham.manu@gmail.com)
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#ifndef __MB86A16_H
+#define __MB86A16_H
+
+#include <linux/dvb/frontend.h>
+#include "dvb_frontend.h"
+
+
+struct mb86a16_config {
+	u8 demod_address;
+
+	int (*set_voltage)(struct dvb_frontend *fe, fe_sec_voltage_t voltage);
+};
+
+
+
+#if defined(CONFIG_DVB_MB86A16) || (defined(CONFIG_DVB_MB86A16_MODULE) && defined(MODULE))
+
+extern struct dvb_frontend *mb86a16_attach(const struct mb86a16_config *config,
+					   struct i2c_adapter *i2c_adap);
+
+#else
+
+static inline struct dvb_frontend *mb86a16_attach(const struct mb86a16_config *config,
+					   struct i2c_adapter *i2c_adap)
+{
+	printk(KERN_WARNING "%s: Driver disabled by Kconfig\n", __func__);
+	return NULL;
+}
+
+#endif /* CONFIG_DVB_MB86A16 */
+
+#endif /* __MB86A16_H */
diff --git a/drivers/media/dvb/frontends/mb86a16_priv.h b/drivers/media/dvb/frontends/mb86a16_priv.h
new file mode 100644
index 000000000000..360a35acfe84
--- /dev/null
+++ b/drivers/media/dvb/frontends/mb86a16_priv.h
@@ -0,0 +1,151 @@
+/*
+	Fujitsu MB86A16 DVB-S/DSS DC Receiver driver
+
+	Copyright (C) Manu Abraham (abraham.manu@gmail.com)
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#ifndef __MB86A16_PRIV_H
+#define __MB86A16_PRIV_H
+
+#define MB86A16_TSOUT		0x00
+#define MB86A16_TSOUT_HIZSEL	(0x01 << 5)
+#define MB86A16_TSOUT_HIZCNTI	(0x01 << 4)
+#define MB86A16_TSOUT_MODE	(0x01 << 3)
+#define MB86A16_TSOUT_ORDER	(0x01 << 2)
+#define MB86A16_TSOUT_ERROR	(0x01 << 1)
+#define Mb86A16_TSOUT_EDGE	(0x01 << 0)
+
+#define MB86A16_FEC		0x01
+#define MB86A16_FEC_FSYNC	(0x01 << 5)
+#define MB86A16_FEC_PCKB8	(0x01 << 4)
+#define MB86A16_FEC_DVDS	(0x01 << 3)
+#define MB86A16_FEC_EREN	(0x01 << 2)
+#define Mb86A16_FEC_RSEN	(0x01 << 1)
+#define MB86A16_FEC_DIEN	(0x01 << 0)
+
+#define MB86A16_AGC		0x02
+#define MB86A16_AGC_AGMD	(0x01 << 6)
+#define MB86A16_AGC_AGCW	(0x0f << 2)
+#define MB86A16_AGC_AGCP	(0x01 << 1)
+#define MB86A16_AGC_AGCR	(0x01 << 0)
+
+#define MB86A16_SRATE1		0x03
+#define MB86A16_SRATE1_DECI	(0x07 << 2)
+#define MB86A16_SRATE1_CSEL	(0x01 << 1)
+#define MB86A16_SRATE1_RSEL	(0x01 << 0)
+
+#define MB86A16_SRATE2		0x04
+#define MB86A16_SRATE2_STOFSL	(0xff << 0)
+
+#define MB86A16_SRATE3		0x05
+#define MB86A16_SRATE2_STOFSH	(0xff << 0)
+
+#define MB86A16_VITERBI		0x06
+#define MB86A16_FRAMESYNC	0x07
+#define MB86A16_CRLFILTCOEF1	0x08
+#define MB86A16_CRLFILTCOEF2	0x09
+#define MB86A16_STRFILTCOEF1	0x0a
+#define MB86A16_STRFILTCOEF2	0x0b
+#define MB86A16_RESET		0x0c
+#define MB86A16_STATUS		0x0d
+#define MB86A16_AFCML		0x0e
+#define MB86A16_AFCMH		0x0f
+#define MB86A16_BERMON		0x10
+#define MB86A16_BERTAB		0x11
+#define MB86A16_BERLSB		0x12
+#define MB86A16_BERMID		0x13
+#define MB86A16_BERMSB		0x14
+#define MB86A16_AGCM		0x15
+
+#define MB86A16_DCC1		0x16
+#define MB86A16_DCC1_DISTA	(0x01 << 7)
+#define MB86A16_DCC1_PRTY	(0x01 << 6)
+#define MB86A16_DCC1_CTOE	(0x01 << 5)
+#define MB86A16_DCC1_TBEN	(0x01 << 4)
+#define MB86A16_DCC1_TBO	(0x01 << 3)
+#define MB86A16_DCC1_NUM	(0x07 << 0)
+
+#define MB86A16_DCC2		0x17
+#define MB86A16_DCC2_DCBST	(0x01 << 0)
+
+#define MB86A16_DCC3		0x18
+#define MB86A16_DCC3_CODE0	(0xff << 0)
+
+#define MB86A16_DCC4		0x19
+#define MB86A16_DCC4_CODE1	(0xff << 0)
+
+#define MB86A16_DCC5		0x1a
+#define MB86A16_DCC5_CODE2	(0xff << 0)
+
+#define MB86A16_DCC6		0x1b
+#define MB86A16_DCC6_CODE3	(0xff << 0)
+
+#define MB86A16_DCC7		0x1c
+#define MB86A16_DCC7_CODE4	(0xff << 0)
+
+#define MB86A16_DCC8		0x1d
+#define MB86A16_DCC8_CODE5	(0xff << 0)
+
+#define MB86A16_DCCOUT		0x1e
+#define MB86A16_DCCOUT_DISEN	(0x01 << 0)
+
+#define MB86A16_TONEOUT1	0x1f
+#define MB86A16_TONE_TDIVL	(0xff << 0)
+
+#define MB86A16_TONEOUT2	0x20
+#define MB86A16_TONE_TMD	(0x03 << 2)
+#define MB86A16_TONE_TDIVH	(0x03 << 0)
+
+#define MB86A16_FREQ1		0x21
+#define MB86A16_FREQ2		0x22
+#define MB86A16_FREQ3		0x23
+#define MB86A16_FREQ4		0x24
+#define MB86A16_FREQSET		0x25
+#define MB86A16_CNM		0x26
+#define MB86A16_PORT0		0x27
+#define MB86A16_PORT1		0x28
+#define MB86A16_DRCFILT		0x29
+#define MB86A16_AFC		0x2a
+#define MB86A16_AFCEXL		0x2b
+#define MB86A16_AFCEXH		0x2c
+#define MB86A16_DAGC		0x2d
+#define MB86A16_SEQMODE		0x32
+#define MB86A16_S0S1T		0x33
+#define MB86A16_S2S3T		0x34
+#define MB86A16_S4S5T		0x35
+#define MB86A16_CNTMR		0x36
+#define MB86A16_SIG1		0x37
+#define MB86A16_SIG2		0x38
+#define MB86A16_VIMAG		0x39
+#define MB86A16_VISET1		0x3a
+#define MB86A16_VISET2		0x3b
+#define MB86A16_VISET3		0x3c
+#define MB86A16_FAGCS1		0x3d
+#define MB86A16_FAGCS2		0x3e
+#define MB86A16_FAGCS3		0x3f
+#define MB86A16_FAGCS4		0x40
+#define MB86A16_FAGCS5		0x41
+#define MB86A16_FAGCS6		0x42
+#define MB86A16_CRM		0x43
+#define MB86A16_STRM		0x44
+#define MB86A16_DAGCML		0x45
+#define MB86A16_DAGCMH		0x46
+#define MB86A16_QPSKTST		0x49
+#define MB86A16_DISTMON		0x52
+#define MB86A16_VERSION		0x7f
+
+#endif /* __MB86A16_PRIV_H */
diff --git a/drivers/media/dvb/frontends/s5h1409.c b/drivers/media/dvb/frontends/s5h1409.c
index fb3011518427..0e2f61a8978f 100644
--- a/drivers/media/dvb/frontends/s5h1409.c
+++ b/drivers/media/dvb/frontends/s5h1409.c
@@ -44,7 +44,15 @@ struct s5h1409_state {
 	int if_freq;
 
 	u32 is_qam_locked;
-	u32 qam_state;
+
+	/* QAM tuning state goes through the following state transitions */
+#define QAM_STATE_UNTUNED 0
+#define QAM_STATE_TUNING_STARTED 1
+#define QAM_STATE_INTERLEAVE_SET 2
+#define QAM_STATE_QAM_OPTIMIZED_L1 3
+#define QAM_STATE_QAM_OPTIMIZED_L2 4
+#define QAM_STATE_QAM_OPTIMIZED_L3 5
+	u8  qam_state;
 };
 
 static int debug;
@@ -347,7 +355,7 @@ static int s5h1409_softreset(struct dvb_frontend *fe)
 	s5h1409_writereg(state, 0xf5, 0);
 	s5h1409_writereg(state, 0xf5, 1);
 	state->is_qam_locked = 0;
-	state->qam_state = 0;
+	state->qam_state = QAM_STATE_UNTUNED;
 	return 0;
 }
 
@@ -474,6 +482,59 @@ static void s5h1409_set_qam_amhum_mode(struct dvb_frontend *fe)
 	struct s5h1409_state *state = fe->demodulator_priv;
 	u16 reg;
 
+	if (state->qam_state < QAM_STATE_INTERLEAVE_SET) {
+		/* We should not perform amhum optimization until
+		   the interleave mode has been configured */
+		return;
+	}
+
+	if (state->qam_state == QAM_STATE_QAM_OPTIMIZED_L3) {
+		/* We've already reached the maximum optimization level, so
+		   dont bother banging on the status registers */
+		return;
+	}
+
+	/* QAM EQ lock check */
+	reg = s5h1409_readreg(state, 0xf0);
+
+	if ((reg >> 13) & 0x1) {
+		reg &= 0xff;
+
+		s5h1409_writereg(state, 0x96, 0x000c);
+		if (reg < 0x68) {
+			if (state->qam_state < QAM_STATE_QAM_OPTIMIZED_L3) {
+				dprintk("%s() setting QAM state to OPT_L3\n",
+					__func__);
+				s5h1409_writereg(state, 0x93, 0x3130);
+				s5h1409_writereg(state, 0x9e, 0x2836);
+				state->qam_state = QAM_STATE_QAM_OPTIMIZED_L3;
+			}
+		} else {
+			if (state->qam_state < QAM_STATE_QAM_OPTIMIZED_L2) {
+				dprintk("%s() setting QAM state to OPT_L2\n",
+					__func__);
+				s5h1409_writereg(state, 0x93, 0x3332);
+				s5h1409_writereg(state, 0x9e, 0x2c37);
+				state->qam_state = QAM_STATE_QAM_OPTIMIZED_L2;
+			}
+		}
+
+	} else {
+		if (state->qam_state < QAM_STATE_QAM_OPTIMIZED_L1) {
+			dprintk("%s() setting QAM state to OPT_L1\n", __func__);
+			s5h1409_writereg(state, 0x96, 0x0008);
+			s5h1409_writereg(state, 0x93, 0x3332);
+			s5h1409_writereg(state, 0x9e, 0x2c37);
+			state->qam_state = QAM_STATE_QAM_OPTIMIZED_L1;
+		}
+	}
+}
+
+static void s5h1409_set_qam_amhum_mode_legacy(struct dvb_frontend *fe)
+{
+	struct s5h1409_state *state = fe->demodulator_priv;
+	u16 reg;
+
 	if (state->is_qam_locked)
 		return;
 
@@ -506,6 +567,44 @@ static void s5h1409_set_qam_interleave_mode(struct dvb_frontend *fe)
 	struct s5h1409_state *state = fe->demodulator_priv;
 	u16 reg, reg1, reg2;
 
+	if (state->qam_state >= QAM_STATE_INTERLEAVE_SET) {
+		/* We've done the optimization already */
+		return;
+	}
+
+	reg = s5h1409_readreg(state, 0xf1);
+
+	/* Master lock */
+	if ((reg >> 15) & 0x1) {
+		if (state->qam_state == QAM_STATE_UNTUNED ||
+		    state->qam_state == QAM_STATE_TUNING_STARTED) {
+			dprintk("%s() setting QAM state to INTERLEAVE_SET\n",
+				__func__);
+			reg1 = s5h1409_readreg(state, 0xb2);
+			reg2 = s5h1409_readreg(state, 0xad);
+
+			s5h1409_writereg(state, 0x96, 0x0020);
+			s5h1409_writereg(state, 0xad,
+				(((reg1 & 0xf000) >> 4) | (reg2 & 0xf0ff)));
+			state->qam_state = QAM_STATE_INTERLEAVE_SET;
+		}
+	} else {
+		if (state->qam_state == QAM_STATE_UNTUNED) {
+			dprintk("%s() setting QAM state to TUNING_STARTED\n",
+				__func__);
+			s5h1409_writereg(state, 0x96, 0x08);
+			s5h1409_writereg(state, 0xab,
+				s5h1409_readreg(state, 0xab) | 0x1001);
+			state->qam_state = QAM_STATE_TUNING_STARTED;
+		}
+	}
+}
+
+static void s5h1409_set_qam_interleave_mode_legacy(struct dvb_frontend *fe)
+{
+	struct s5h1409_state *state = fe->demodulator_priv;
+	u16 reg, reg1, reg2;
+
 	reg = s5h1409_readreg(state, 0xf1);
 
 	/* Master lock */
@@ -553,16 +652,24 @@ static int s5h1409_set_frontend(struct dvb_frontend *fe,
 			fe->ops.i2c_gate_ctrl(fe, 0);
 	}
 
-	/* Optimize the demod for QAM */
-	if (p->u.vsb.modulation != VSB_8) {
-		s5h1409_set_qam_amhum_mode(fe);
-		s5h1409_set_qam_interleave_mode(fe);
-	}
-
 	/* Issue a reset to the demod so it knows to resync against the
 	   newly tuned frequency */
 	s5h1409_softreset(fe);
 
+	/* Optimize the demod for QAM */
+	if (state->current_modulation != VSB_8) {
+		/* This almost certainly applies to all boards, but for now
+		   only do it for the HVR-1600.  Once the other boards are
+		   tested, the "legacy" versions can just go away */
+		if (state->config->hvr1600_opt == S5H1409_HVR1600_OPTIMIZE) {
+			s5h1409_set_qam_interleave_mode(fe);
+			s5h1409_set_qam_amhum_mode(fe);
+		} else {
+			s5h1409_set_qam_amhum_mode_legacy(fe);
+			s5h1409_set_qam_interleave_mode_legacy(fe);
+		}
+	}
+
 	return 0;
 }
 
@@ -614,6 +721,21 @@ static int s5h1409_init(struct dvb_frontend *fe)
 	/* The datasheet says that after initialisation, VSB is default */
 	state->current_modulation = VSB_8;
 
+	/* Optimize for the HVR-1600 if appropriate.  Note that some of these
+	   may get folded into the generic case after testing with other
+	   devices */
+	if (state->config->hvr1600_opt == S5H1409_HVR1600_OPTIMIZE) {
+		/* VSB AGC REF */
+		s5h1409_writereg(state, 0x09, 0x0050);
+
+		/* Unknown but Windows driver does it... */
+		s5h1409_writereg(state, 0x21, 0x0001);
+		s5h1409_writereg(state, 0x50, 0x030e);
+
+		/* QAM AGC REF */
+		s5h1409_writereg(state, 0x82, 0x0800);
+	}
+
 	if (state->config->output_mode == S5H1409_SERIAL_OUTPUT)
 		s5h1409_writereg(state, 0xab,
 			s5h1409_readreg(state, 0xab) | 0x100); /* Serial */
@@ -641,6 +763,17 @@ static int s5h1409_read_status(struct dvb_frontend *fe, fe_status_t *status)
 
 	*status = 0;
 
+	/* Optimize the demod for QAM */
+	if (state->current_modulation != VSB_8) {
+		/* This almost certainly applies to all boards, but for now
+		   only do it for the HVR-1600.  Once the other boards are
+		   tested, the "legacy" versions can just go away */
+		if (state->config->hvr1600_opt == S5H1409_HVR1600_OPTIMIZE) {
+			s5h1409_set_qam_interleave_mode(fe);
+			s5h1409_set_qam_amhum_mode(fe);
+		}
+	}
+
 	/* Get the demodulator status */
 	reg = s5h1409_readreg(state, 0xf1);
 	if (reg & 0x1000)
diff --git a/drivers/media/dvb/frontends/s5h1409.h b/drivers/media/dvb/frontends/s5h1409.h
index 070d9743e330..91f2ebd1a534 100644
--- a/drivers/media/dvb/frontends/s5h1409.h
+++ b/drivers/media/dvb/frontends/s5h1409.h
@@ -57,6 +57,13 @@ struct s5h1409_config {
 #define S5H1409_MPEGTIMING_NONCONTINOUS_INVERTING_CLOCK    2
 #define S5H1409_MPEGTIMING_NONCONTINOUS_NONINVERTING_CLOCK 3
 	u16 mpeg_timing;
+
+	/* HVR-1600 optimizations (to better work with MXL5005s)
+	   Note: some of these are likely to be folded into the generic driver
+	   after being regression tested with other boards */
+#define S5H1409_HVR1600_NOOPTIMIZE 0
+#define S5H1409_HVR1600_OPTIMIZE   1
+	u8 hvr1600_opt;
 };
 
 #if defined(CONFIG_DVB_S5H1409) || (defined(CONFIG_DVB_S5H1409_MODULE) \
diff --git a/drivers/media/dvb/frontends/stb0899_drv.c b/drivers/media/dvb/frontends/stb0899_drv.c
index a04c782fff8d..1570669837ea 100644
--- a/drivers/media/dvb/frontends/stb0899_drv.c
+++ b/drivers/media/dvb/frontends/stb0899_drv.c
@@ -1571,7 +1571,7 @@ static enum dvbfe_search stb0899_search(struct dvb_frontend *fe, struct dvb_fron
  * stb0899_track
  * periodically check the signal level against a specified
  * threshold level and perform derotator centering.
- * called once we have a lock from a succesful search
+ * called once we have a lock from a successful search
  * event.
  *
  * Will be called periodically called to maintain the
diff --git a/drivers/media/dvb/frontends/stb6100_proc.h b/drivers/media/dvb/frontends/stb6100_proc.h
new file mode 100644
index 000000000000..112163a48622
--- /dev/null
+++ b/drivers/media/dvb/frontends/stb6100_proc.h
@@ -0,0 +1,138 @@
+/*
+	STB6100 Silicon Tuner wrapper
+	Copyright (C)2009 Igor M. Liplianin (liplianin@me.by)
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+static int stb6100_get_freq(struct dvb_frontend *fe, u32 *frequency)
+{
+	struct dvb_frontend_ops	*frontend_ops = NULL;
+	struct dvb_tuner_ops	*tuner_ops = NULL;
+	struct tuner_state	state;
+	int err = 0;
+
+	if (&fe->ops)
+		frontend_ops = &fe->ops;
+	if (&frontend_ops->tuner_ops)
+		tuner_ops = &frontend_ops->tuner_ops;
+	if (tuner_ops->get_state) {
+		if (frontend_ops->i2c_gate_ctrl)
+			frontend_ops->i2c_gate_ctrl(fe, 1);
+
+		err = tuner_ops->get_state(fe, DVBFE_TUNER_FREQUENCY, &state);
+		if (err < 0) {
+			printk(KERN_ERR "%s: Invalid parameter\n", __func__);
+			return err;
+		}
+
+		if (frontend_ops->i2c_gate_ctrl)
+			frontend_ops->i2c_gate_ctrl(fe, 0);
+
+		*frequency = state.frequency;
+	}
+
+	return 0;
+}
+
+static int stb6100_set_freq(struct dvb_frontend *fe, u32 frequency)
+{
+	struct dvb_frontend_ops	*frontend_ops = NULL;
+	struct dvb_tuner_ops	*tuner_ops = NULL;
+	struct tuner_state	state;
+	int err = 0;
+
+	state.frequency = frequency;
+	if (&fe->ops)
+		frontend_ops = &fe->ops;
+	if (&frontend_ops->tuner_ops)
+		tuner_ops = &frontend_ops->tuner_ops;
+	if (tuner_ops->set_state) {
+		if (frontend_ops->i2c_gate_ctrl)
+			frontend_ops->i2c_gate_ctrl(fe, 1);
+
+		err = tuner_ops->set_state(fe, DVBFE_TUNER_FREQUENCY, &state);
+		if (err < 0) {
+			printk(KERN_ERR "%s: Invalid parameter\n", __func__);
+			return err;
+		}
+
+		if (frontend_ops->i2c_gate_ctrl)
+			frontend_ops->i2c_gate_ctrl(fe, 0);
+
+	}
+
+	return 0;
+}
+
+static int stb6100_get_bandw(struct dvb_frontend *fe, u32 *bandwidth)
+{
+	struct dvb_frontend_ops	*frontend_ops = NULL;
+	struct dvb_tuner_ops	*tuner_ops = NULL;
+	struct tuner_state	state;
+	int err = 0;
+
+	if (&fe->ops)
+		frontend_ops = &fe->ops;
+	if (&frontend_ops->tuner_ops)
+		tuner_ops = &frontend_ops->tuner_ops;
+	if (tuner_ops->get_state) {
+		if (frontend_ops->i2c_gate_ctrl)
+			frontend_ops->i2c_gate_ctrl(fe, 1);
+
+		err = tuner_ops->get_state(fe, DVBFE_TUNER_BANDWIDTH, &state);
+		if (err < 0) {
+			printk(KERN_ERR "%s: Invalid parameter\n", __func__);
+			return err;
+		}
+
+		if (frontend_ops->i2c_gate_ctrl)
+			frontend_ops->i2c_gate_ctrl(fe, 0);
+
+		*bandwidth = state.bandwidth;
+	}
+
+	return 0;
+}
+
+static int stb6100_set_bandw(struct dvb_frontend *fe, u32 bandwidth)
+{
+	struct dvb_frontend_ops	*frontend_ops = NULL;
+	struct dvb_tuner_ops	*tuner_ops = NULL;
+	struct tuner_state	state;
+	int err = 0;
+
+	state.bandwidth = bandwidth;
+	if (&fe->ops)
+		frontend_ops = &fe->ops;
+	if (&frontend_ops->tuner_ops)
+		tuner_ops = &frontend_ops->tuner_ops;
+	if (tuner_ops->set_state) {
+		if (frontend_ops->i2c_gate_ctrl)
+			frontend_ops->i2c_gate_ctrl(fe, 1);
+
+		err = tuner_ops->set_state(fe, DVBFE_TUNER_BANDWIDTH, &state);
+		if (err < 0) {
+			printk(KERN_ERR "%s: Invalid parameter\n", __func__);
+			return err;
+		}
+
+		if (frontend_ops->i2c_gate_ctrl)
+			frontend_ops->i2c_gate_ctrl(fe, 0);
+
+	}
+
+	return 0;
+}
diff --git a/drivers/media/dvb/frontends/stv0900.h b/drivers/media/dvb/frontends/stv0900.h
index bf4e9b633044..29c3fa85c227 100644
--- a/drivers/media/dvb/frontends/stv0900.h
+++ b/drivers/media/dvb/frontends/stv0900.h
@@ -36,6 +36,7 @@ struct stv0900_reg {
 
 struct stv0900_config {
 	u8 demod_address;
+	u8 demod_mode;
 	u32 xtal;
 	u8 clkmode;/* 0 for CLKI,  2 for XTALI */
 
@@ -48,6 +49,8 @@ struct stv0900_config {
 	u8 tun2_maddress;
 	u8 tun1_adc;/* 1 for stv6110, 2 for stb6100 */
 	u8 tun2_adc;
+	/* Set device param to start dma */
+	int (*set_ts_params)(struct dvb_frontend *fe, int is_punctured);
 };
 
 #if defined(CONFIG_DVB_STV0900) || (defined(CONFIG_DVB_STV0900_MODULE) \
diff --git a/drivers/media/dvb/frontends/stv0900_core.c b/drivers/media/dvb/frontends/stv0900_core.c
index 3bde3324a032..8762c86044a5 100644
--- a/drivers/media/dvb/frontends/stv0900_core.c
+++ b/drivers/media/dvb/frontends/stv0900_core.c
@@ -34,7 +34,7 @@
 #include "stv0900_priv.h"
 #include "stv0900_init.h"
 
-static int stvdebug = 1;
+int stvdebug = 1;
 module_param_named(debug, stvdebug, int, 0644);
 
 /* internal params node */
@@ -105,7 +105,8 @@ static struct stv0900_inode *append_internal(struct stv0900_internal *internal)
 		while (new_node->next_inode != NULL)
 			new_node = new_node->next_inode;
 
-		new_node->next_inode = kmalloc(sizeof(struct stv0900_inode), GFP_KERNEL);
+		new_node->next_inode = kmalloc(sizeof(struct stv0900_inode),
+								GFP_KERNEL);
 		if (new_node->next_inode != NULL)
 			new_node = new_node->next_inode;
 		else
@@ -128,13 +129,13 @@ s32 ge2comp(s32 a, s32 width)
 		return (a >= (1 << (width - 1))) ? (a - (1 << width)) : a;
 }
 
-void stv0900_write_reg(struct stv0900_internal *i_params, u16 reg_addr,
+void stv0900_write_reg(struct stv0900_internal *intp, u16 reg_addr,
 								u8 reg_data)
 {
 	u8 data[3];
 	int ret;
 	struct i2c_msg i2cmsg = {
-		.addr  = i_params->i2c_addr,
+		.addr  = intp->i2c_addr,
 		.flags = 0,
 		.len   = 3,
 		.buf   = data,
@@ -144,33 +145,33 @@ void stv0900_write_reg(struct stv0900_internal *i_params, u16 reg_addr,
 	data[1] = LSB(reg_addr);
 	data[2] = reg_data;
 
-	ret = i2c_transfer(i_params->i2c_adap, &i2cmsg, 1);
+	ret = i2c_transfer(intp->i2c_adap, &i2cmsg, 1);
 	if (ret != 1)
-		dprintk(KERN_ERR "%s: i2c error %d\n", __func__, ret);
+		dprintk("%s: i2c error %d\n", __func__, ret);
 }
 
-u8 stv0900_read_reg(struct stv0900_internal *i_params, u16 reg)
+u8 stv0900_read_reg(struct stv0900_internal *intp, u16 reg)
 {
 	int ret;
 	u8 b0[] = { MSB(reg), LSB(reg) };
 	u8 buf = 0;
 	struct i2c_msg msg[] = {
 		{
-			.addr	= i_params->i2c_addr,
+			.addr	= intp->i2c_addr,
 			.flags	= 0,
 			.buf = b0,
 			.len = 2,
 		}, {
-			.addr	= i_params->i2c_addr,
+			.addr	= intp->i2c_addr,
 			.flags	= I2C_M_RD,
 			.buf = &buf,
 			.len = 1,
 		},
 	};
 
-	ret = i2c_transfer(i_params->i2c_adap, msg, 2);
+	ret = i2c_transfer(intp->i2c_adap, msg, 2);
 	if (ret != 2)
-		dprintk(KERN_ERR "%s: i2c error %d, reg[0x%02x]\n",
+		dprintk("%s: i2c error %d, reg[0x%02x]\n",
 				__func__, ret, reg);
 
 	return buf;
@@ -190,169 +191,165 @@ void extract_mask_pos(u32 label, u8 *mask, u8 *pos)
 	(*pos) = (i - 1);
 }
 
-void stv0900_write_bits(struct stv0900_internal *i_params, u32 label, u8 val)
+void stv0900_write_bits(struct stv0900_internal *intp, u32 label, u8 val)
 {
 	u8 reg, mask, pos;
 
-	reg = stv0900_read_reg(i_params, (label >> 16) & 0xffff);
+	reg = stv0900_read_reg(intp, (label >> 16) & 0xffff);
 	extract_mask_pos(label, &mask, &pos);
 
 	val = mask & (val << pos);
 
 	reg = (reg & (~mask)) | val;
-	stv0900_write_reg(i_params, (label >> 16) & 0xffff, reg);
+	stv0900_write_reg(intp, (label >> 16) & 0xffff, reg);
 
 }
 
-u8 stv0900_get_bits(struct stv0900_internal *i_params, u32 label)
+u8 stv0900_get_bits(struct stv0900_internal *intp, u32 label)
 {
 	u8 val = 0xff;
 	u8 mask, pos;
 
 	extract_mask_pos(label, &mask, &pos);
 
-	val = stv0900_read_reg(i_params, label >> 16);
+	val = stv0900_read_reg(intp, label >> 16);
 	val = (val & mask) >> pos;
 
 	return val;
 }
 
-enum fe_stv0900_error stv0900_initialize(struct stv0900_internal *i_params)
+enum fe_stv0900_error stv0900_initialize(struct stv0900_internal *intp)
 {
 	s32 i;
-	enum fe_stv0900_error error;
-
-	if (i_params != NULL) {
-		i_params->chip_id = stv0900_read_reg(i_params, R0900_MID);
-		if (i_params->errs == STV0900_NO_ERROR) {
-			/*Startup sequence*/
-			stv0900_write_reg(i_params, R0900_P1_DMDISTATE, 0x5c);
-			stv0900_write_reg(i_params, R0900_P2_DMDISTATE, 0x5c);
-			stv0900_write_reg(i_params, R0900_P1_TNRCFG, 0x6c);
-			stv0900_write_reg(i_params, R0900_P2_TNRCFG, 0x6f);
-			stv0900_write_reg(i_params, R0900_P1_I2CRPT, 0x20);
-			stv0900_write_reg(i_params, R0900_P2_I2CRPT, 0x20);
-			stv0900_write_reg(i_params, R0900_NCOARSE, 0x13);
-			msleep(3);
-			stv0900_write_reg(i_params, R0900_I2CCFG, 0x08);
-
-			switch (i_params->clkmode) {
-			case 0:
-			case 2:
-				stv0900_write_reg(i_params, R0900_SYNTCTRL, 0x20
-						| i_params->clkmode);
-				break;
-			default:
-				/* preserve SELOSCI bit */
-				i = 0x02 & stv0900_read_reg(i_params, R0900_SYNTCTRL);
-				stv0900_write_reg(i_params, R0900_SYNTCTRL, 0x20 | i);
-				break;
-			}
 
-			msleep(3);
-			for (i = 0; i < 182; i++)
-				stv0900_write_reg(i_params, STV0900_InitVal[i][0], STV0900_InitVal[i][1]);
+	if (intp == NULL)
+		return STV0900_INVALID_HANDLE;
 
-			if (stv0900_read_reg(i_params, R0900_MID) >= 0x20) {
-				stv0900_write_reg(i_params, R0900_TSGENERAL, 0x0c);
-				for (i = 0; i < 32; i++)
-					stv0900_write_reg(i_params, STV0900_Cut20_AddOnVal[i][0], STV0900_Cut20_AddOnVal[i][1]);
-			}
+	intp->chip_id = stv0900_read_reg(intp, R0900_MID);
 
-			stv0900_write_reg(i_params, R0900_P1_FSPYCFG, 0x6c);
-			stv0900_write_reg(i_params, R0900_P2_FSPYCFG, 0x6c);
-			stv0900_write_reg(i_params, R0900_TSTRES0, 0x80);
-			stv0900_write_reg(i_params, R0900_TSTRES0, 0x00);
-		}
-		error = i_params->errs;
-	} else
-		error = STV0900_INVALID_HANDLE;
+	if (intp->errs != STV0900_NO_ERROR)
+		return intp->errs;
 
-	return error;
+	/*Startup sequence*/
+	stv0900_write_reg(intp, R0900_P1_DMDISTATE, 0x5c);
+	stv0900_write_reg(intp, R0900_P2_DMDISTATE, 0x5c);
+	msleep(3);
+	stv0900_write_reg(intp, R0900_P1_TNRCFG, 0x6c);
+	stv0900_write_reg(intp, R0900_P2_TNRCFG, 0x6f);
+	stv0900_write_reg(intp, R0900_P1_I2CRPT, 0x20);
+	stv0900_write_reg(intp, R0900_P2_I2CRPT, 0x20);
+	stv0900_write_reg(intp, R0900_NCOARSE, 0x13);
+	msleep(3);
+	stv0900_write_reg(intp, R0900_I2CCFG, 0x08);
 
+	switch (intp->clkmode) {
+	case 0:
+	case 2:
+		stv0900_write_reg(intp, R0900_SYNTCTRL, 0x20
+				| intp->clkmode);
+		break;
+	default:
+		/* preserve SELOSCI bit */
+		i = 0x02 & stv0900_read_reg(intp, R0900_SYNTCTRL);
+		stv0900_write_reg(intp, R0900_SYNTCTRL, 0x20 | i);
+		break;
+	}
+
+	msleep(3);
+	for (i = 0; i < 181; i++)
+		stv0900_write_reg(intp, STV0900_InitVal[i][0],
+				STV0900_InitVal[i][1]);
+
+	if (stv0900_read_reg(intp, R0900_MID) >= 0x20) {
+		stv0900_write_reg(intp, R0900_TSGENERAL, 0x0c);
+		for (i = 0; i < 32; i++)
+			stv0900_write_reg(intp, STV0900_Cut20_AddOnVal[i][0],
+					STV0900_Cut20_AddOnVal[i][1]);
+	}
+
+	stv0900_write_reg(intp, R0900_P1_FSPYCFG, 0x6c);
+	stv0900_write_reg(intp, R0900_P2_FSPYCFG, 0x6c);
+
+	stv0900_write_reg(intp, R0900_P1_PDELCTRL2, 0x01);
+	stv0900_write_reg(intp, R0900_P2_PDELCTRL2, 0x21);
+
+	stv0900_write_reg(intp, R0900_P1_PDELCTRL3, 0x20);
+	stv0900_write_reg(intp, R0900_P2_PDELCTRL3, 0x20);
+
+	stv0900_write_reg(intp, R0900_TSTRES0, 0x80);
+	stv0900_write_reg(intp, R0900_TSTRES0, 0x00);
+
+	return STV0900_NO_ERROR;
 }
 
-u32 stv0900_get_mclk_freq(struct stv0900_internal *i_params, u32 ext_clk)
+u32 stv0900_get_mclk_freq(struct stv0900_internal *intp, u32 ext_clk)
 {
 	u32 mclk = 90000000, div = 0, ad_div = 0;
 
-	div = stv0900_get_bits(i_params, F0900_M_DIV);
-	ad_div = ((stv0900_get_bits(i_params, F0900_SELX1RATIO) == 1) ? 4 : 6);
+	div = stv0900_get_bits(intp, F0900_M_DIV);
+	ad_div = ((stv0900_get_bits(intp, F0900_SELX1RATIO) == 1) ? 4 : 6);
 
 	mclk = (div + 1) * ext_clk / ad_div;
 
-	dprintk(KERN_INFO "%s: Calculated Mclk = %d\n", __func__, mclk);
+	dprintk("%s: Calculated Mclk = %d\n", __func__, mclk);
 
 	return mclk;
 }
 
-enum fe_stv0900_error stv0900_set_mclk(struct stv0900_internal *i_params, u32 mclk)
+enum fe_stv0900_error stv0900_set_mclk(struct stv0900_internal *intp, u32 mclk)
 {
-	enum fe_stv0900_error error = STV0900_NO_ERROR;
 	u32 m_div, clk_sel;
 
-	dprintk(KERN_INFO "%s: Mclk set to %d, Quartz = %d\n", __func__, mclk,
-			i_params->quartz);
+	dprintk("%s: Mclk set to %d, Quartz = %d\n", __func__, mclk,
+			intp->quartz);
 
-	if (i_params == NULL)
-		error = STV0900_INVALID_HANDLE;
-	else {
-		if (i_params->errs)
-			error = STV0900_I2C_ERROR;
-		else {
-			clk_sel = ((stv0900_get_bits(i_params, F0900_SELX1RATIO) == 1) ? 4 : 6);
-			m_div = ((clk_sel * mclk) / i_params->quartz) - 1;
-			stv0900_write_bits(i_params, F0900_M_DIV, m_div);
-			i_params->mclk = stv0900_get_mclk_freq(i_params,
-							i_params->quartz);
-
-			/*Set the DiseqC frequency to 22KHz */
-			/*
-				Formula:
-				DiseqC_TX_Freq= MasterClock/(32*F22TX_Reg)
-				DiseqC_RX_Freq= MasterClock/(32*F22RX_Reg)
-			*/
-			m_div = i_params->mclk / 704000;
-			stv0900_write_reg(i_params, R0900_P1_F22TX, m_div);
-			stv0900_write_reg(i_params, R0900_P1_F22RX, m_div);
-
-			stv0900_write_reg(i_params, R0900_P2_F22TX, m_div);
-			stv0900_write_reg(i_params, R0900_P2_F22RX, m_div);
-
-			if ((i_params->errs))
-				error = STV0900_I2C_ERROR;
-		}
-	}
+	if (intp == NULL)
+		return STV0900_INVALID_HANDLE;
 
-	return error;
+	if (intp->errs)
+		return STV0900_I2C_ERROR;
+
+	clk_sel = ((stv0900_get_bits(intp, F0900_SELX1RATIO) == 1) ? 4 : 6);
+	m_div = ((clk_sel * mclk) / intp->quartz) - 1;
+	stv0900_write_bits(intp, F0900_M_DIV, m_div);
+	intp->mclk = stv0900_get_mclk_freq(intp,
+					intp->quartz);
+
+	/*Set the DiseqC frequency to 22KHz */
+	/*
+		Formula:
+		DiseqC_TX_Freq= MasterClock/(32*F22TX_Reg)
+		DiseqC_RX_Freq= MasterClock/(32*F22RX_Reg)
+	*/
+	m_div = intp->mclk / 704000;
+	stv0900_write_reg(intp, R0900_P1_F22TX, m_div);
+	stv0900_write_reg(intp, R0900_P1_F22RX, m_div);
+
+	stv0900_write_reg(intp, R0900_P2_F22TX, m_div);
+	stv0900_write_reg(intp, R0900_P2_F22RX, m_div);
+
+	if ((intp->errs))
+		return STV0900_I2C_ERROR;
+
+	return STV0900_NO_ERROR;
 }
 
-u32 stv0900_get_err_count(struct stv0900_internal *i_params, int cntr,
+u32 stv0900_get_err_count(struct stv0900_internal *intp, int cntr,
 					enum fe_stv0900_demod_num demod)
 {
 	u32 lsb, msb, hsb, err_val;
-	s32 err1field_hsb, err1field_msb, err1field_lsb;
-	s32 err2field_hsb, err2field_msb, err2field_lsb;
-
-	dmd_reg(err1field_hsb, F0900_P1_ERR_CNT12, F0900_P2_ERR_CNT12);
-	dmd_reg(err1field_msb, F0900_P1_ERR_CNT11, F0900_P2_ERR_CNT11);
-	dmd_reg(err1field_lsb, F0900_P1_ERR_CNT10, F0900_P2_ERR_CNT10);
-
-	dmd_reg(err2field_hsb, F0900_P1_ERR_CNT22, F0900_P2_ERR_CNT22);
-	dmd_reg(err2field_msb, F0900_P1_ERR_CNT21, F0900_P2_ERR_CNT21);
-	dmd_reg(err2field_lsb, F0900_P1_ERR_CNT20, F0900_P2_ERR_CNT20);
 
 	switch (cntr) {
 	case 0:
 	default:
-		hsb = stv0900_get_bits(i_params, err1field_hsb);
-		msb = stv0900_get_bits(i_params, err1field_msb);
-		lsb = stv0900_get_bits(i_params, err1field_lsb);
+		hsb = stv0900_get_bits(intp, ERR_CNT12);
+		msb = stv0900_get_bits(intp, ERR_CNT11);
+		lsb = stv0900_get_bits(intp, ERR_CNT10);
 		break;
 	case 1:
-		hsb = stv0900_get_bits(i_params, err2field_hsb);
-		msb = stv0900_get_bits(i_params, err2field_msb);
-		lsb = stv0900_get_bits(i_params, err2field_lsb);
+		hsb = stv0900_get_bits(intp, ERR_CNT22);
+		msb = stv0900_get_bits(intp, ERR_CNT21);
+		lsb = stv0900_get_bits(intp, ERR_CNT20);
 		break;
 	}
 
@@ -364,26 +361,22 @@ u32 stv0900_get_err_count(struct stv0900_internal *i_params, int cntr,
 static int stv0900_i2c_gate_ctrl(struct dvb_frontend *fe, int enable)
 {
 	struct stv0900_state *state = fe->demodulator_priv;
-	struct stv0900_internal *i_params = state->internal;
+	struct stv0900_internal *intp = state->internal;
 	enum fe_stv0900_demod_num demod = state->demod;
 
-	u32 fi2c;
-
-	dmd_reg(fi2c, F0900_P1_I2CT_ON, F0900_P2_I2CT_ON);
-
-	stv0900_write_bits(i_params, fi2c, enable);
+	stv0900_write_bits(intp, I2CT_ON, enable);
 
 	return 0;
 }
 
-static void stv0900_set_ts_parallel_serial(struct stv0900_internal *i_params,
+static void stv0900_set_ts_parallel_serial(struct stv0900_internal *intp,
 					enum fe_stv0900_clock_type path1_ts,
 					enum fe_stv0900_clock_type path2_ts)
 {
 
-	dprintk(KERN_INFO "%s\n", __func__);
+	dprintk("%s\n", __func__);
 
-	if (i_params->chip_id >= 0x20) {
+	if (intp->chip_id >= 0x20) {
 		switch (path1_ts) {
 		case STV0900_PARALLEL_PUNCT_CLOCK:
 		case STV0900_DVBCI_CLOCK:
@@ -391,20 +384,20 @@ static void stv0900_set_ts_parallel_serial(struct stv0900_internal *i_params,
 			case STV0900_SERIAL_PUNCT_CLOCK:
 			case STV0900_SERIAL_CONT_CLOCK:
 			default:
-				stv0900_write_reg(i_params, R0900_TSGENERAL,
+				stv0900_write_reg(intp, R0900_TSGENERAL,
 							0x00);
 				break;
 			case STV0900_PARALLEL_PUNCT_CLOCK:
 			case STV0900_DVBCI_CLOCK:
-				stv0900_write_reg(i_params, R0900_TSGENERAL,
+				stv0900_write_reg(intp, R0900_TSGENERAL,
 							0x06);
-				stv0900_write_bits(i_params,
+				stv0900_write_bits(intp,
 						F0900_P1_TSFIFO_MANSPEED, 3);
-				stv0900_write_bits(i_params,
+				stv0900_write_bits(intp,
 						F0900_P2_TSFIFO_MANSPEED, 0);
-				stv0900_write_reg(i_params,
+				stv0900_write_reg(intp,
 						R0900_P1_TSSPEED, 0x14);
-				stv0900_write_reg(i_params,
+				stv0900_write_reg(intp,
 						R0900_P2_TSSPEED, 0x28);
 				break;
 			}
@@ -416,14 +409,14 @@ static void stv0900_set_ts_parallel_serial(struct stv0900_internal *i_params,
 			case STV0900_SERIAL_PUNCT_CLOCK:
 			case STV0900_SERIAL_CONT_CLOCK:
 			default:
-				stv0900_write_reg(i_params,
+				stv0900_write_reg(intp,
 						R0900_TSGENERAL, 0x0C);
 				break;
 			case STV0900_PARALLEL_PUNCT_CLOCK:
 			case STV0900_DVBCI_CLOCK:
-				stv0900_write_reg(i_params,
+				stv0900_write_reg(intp,
 						R0900_TSGENERAL, 0x0A);
-				dprintk(KERN_INFO "%s: 0x0a\n", __func__);
+				dprintk("%s: 0x0a\n", __func__);
 				break;
 			}
 			break;
@@ -436,20 +429,20 @@ static void stv0900_set_ts_parallel_serial(struct stv0900_internal *i_params,
 			case STV0900_SERIAL_PUNCT_CLOCK:
 			case STV0900_SERIAL_CONT_CLOCK:
 			default:
-				stv0900_write_reg(i_params, R0900_TSGENERAL1X,
+				stv0900_write_reg(intp, R0900_TSGENERAL1X,
 							0x10);
 				break;
 			case STV0900_PARALLEL_PUNCT_CLOCK:
 			case STV0900_DVBCI_CLOCK:
-				stv0900_write_reg(i_params, R0900_TSGENERAL1X,
+				stv0900_write_reg(intp, R0900_TSGENERAL1X,
 							0x16);
-				stv0900_write_bits(i_params,
+				stv0900_write_bits(intp,
 						F0900_P1_TSFIFO_MANSPEED, 3);
-				stv0900_write_bits(i_params,
+				stv0900_write_bits(intp,
 						F0900_P2_TSFIFO_MANSPEED, 0);
-				stv0900_write_reg(i_params, R0900_P1_TSSPEED,
+				stv0900_write_reg(intp, R0900_P1_TSSPEED,
 							0x14);
-				stv0900_write_reg(i_params, R0900_P2_TSSPEED,
+				stv0900_write_reg(intp, R0900_P2_TSSPEED,
 							0x28);
 				break;
 			}
@@ -462,14 +455,14 @@ static void stv0900_set_ts_parallel_serial(struct stv0900_internal *i_params,
 			case STV0900_SERIAL_PUNCT_CLOCK:
 			case STV0900_SERIAL_CONT_CLOCK:
 			default:
-				stv0900_write_reg(i_params, R0900_TSGENERAL1X,
+				stv0900_write_reg(intp, R0900_TSGENERAL1X,
 							0x14);
 				break;
 			case STV0900_PARALLEL_PUNCT_CLOCK:
 			case STV0900_DVBCI_CLOCK:
-				stv0900_write_reg(i_params, R0900_TSGENERAL1X,
+				stv0900_write_reg(intp, R0900_TSGENERAL1X,
 							0x12);
-				dprintk(KERN_INFO "%s: 0x12\n", __func__);
+				dprintk("%s: 0x12\n", __func__);
 				break;
 			}
 
@@ -479,20 +472,20 @@ static void stv0900_set_ts_parallel_serial(struct stv0900_internal *i_params,
 
 	switch (path1_ts) {
 	case STV0900_PARALLEL_PUNCT_CLOCK:
-		stv0900_write_bits(i_params, F0900_P1_TSFIFO_SERIAL, 0x00);
-		stv0900_write_bits(i_params, F0900_P1_TSFIFO_DVBCI, 0x00);
+		stv0900_write_bits(intp, F0900_P1_TSFIFO_SERIAL, 0x00);
+		stv0900_write_bits(intp, F0900_P1_TSFIFO_DVBCI, 0x00);
 		break;
 	case STV0900_DVBCI_CLOCK:
-		stv0900_write_bits(i_params, F0900_P1_TSFIFO_SERIAL, 0x00);
-		stv0900_write_bits(i_params, F0900_P1_TSFIFO_DVBCI, 0x01);
+		stv0900_write_bits(intp, F0900_P1_TSFIFO_SERIAL, 0x00);
+		stv0900_write_bits(intp, F0900_P1_TSFIFO_DVBCI, 0x01);
 		break;
 	case STV0900_SERIAL_PUNCT_CLOCK:
-		stv0900_write_bits(i_params, F0900_P1_TSFIFO_SERIAL, 0x01);
-		stv0900_write_bits(i_params, F0900_P1_TSFIFO_DVBCI, 0x00);
+		stv0900_write_bits(intp, F0900_P1_TSFIFO_SERIAL, 0x01);
+		stv0900_write_bits(intp, F0900_P1_TSFIFO_DVBCI, 0x00);
 		break;
 	case STV0900_SERIAL_CONT_CLOCK:
-		stv0900_write_bits(i_params, F0900_P1_TSFIFO_SERIAL, 0x01);
-		stv0900_write_bits(i_params, F0900_P1_TSFIFO_DVBCI, 0x01);
+		stv0900_write_bits(intp, F0900_P1_TSFIFO_SERIAL, 0x01);
+		stv0900_write_bits(intp, F0900_P1_TSFIFO_DVBCI, 0x01);
 		break;
 	default:
 		break;
@@ -500,29 +493,29 @@ static void stv0900_set_ts_parallel_serial(struct stv0900_internal *i_params,
 
 	switch (path2_ts) {
 	case STV0900_PARALLEL_PUNCT_CLOCK:
-		stv0900_write_bits(i_params, F0900_P2_TSFIFO_SERIAL, 0x00);
-		stv0900_write_bits(i_params, F0900_P2_TSFIFO_DVBCI, 0x00);
+		stv0900_write_bits(intp, F0900_P2_TSFIFO_SERIAL, 0x00);
+		stv0900_write_bits(intp, F0900_P2_TSFIFO_DVBCI, 0x00);
 		break;
 	case STV0900_DVBCI_CLOCK:
-		stv0900_write_bits(i_params, F0900_P2_TSFIFO_SERIAL, 0x00);
-		stv0900_write_bits(i_params, F0900_P2_TSFIFO_DVBCI, 0x01);
+		stv0900_write_bits(intp, F0900_P2_TSFIFO_SERIAL, 0x00);
+		stv0900_write_bits(intp, F0900_P2_TSFIFO_DVBCI, 0x01);
 		break;
 	case STV0900_SERIAL_PUNCT_CLOCK:
-		stv0900_write_bits(i_params, F0900_P2_TSFIFO_SERIAL, 0x01);
-		stv0900_write_bits(i_params, F0900_P2_TSFIFO_DVBCI, 0x00);
+		stv0900_write_bits(intp, F0900_P2_TSFIFO_SERIAL, 0x01);
+		stv0900_write_bits(intp, F0900_P2_TSFIFO_DVBCI, 0x00);
 		break;
 	case STV0900_SERIAL_CONT_CLOCK:
-		stv0900_write_bits(i_params, F0900_P2_TSFIFO_SERIAL, 0x01);
-		stv0900_write_bits(i_params, F0900_P2_TSFIFO_DVBCI, 0x01);
+		stv0900_write_bits(intp, F0900_P2_TSFIFO_SERIAL, 0x01);
+		stv0900_write_bits(intp, F0900_P2_TSFIFO_DVBCI, 0x01);
 		break;
 	default:
 		break;
 	}
 
-	stv0900_write_bits(i_params, F0900_P2_RST_HWARE, 1);
-	stv0900_write_bits(i_params, F0900_P2_RST_HWARE, 0);
-	stv0900_write_bits(i_params, F0900_P1_RST_HWARE, 1);
-	stv0900_write_bits(i_params, F0900_P1_RST_HWARE, 0);
+	stv0900_write_bits(intp, F0900_P2_RST_HWARE, 1);
+	stv0900_write_bits(intp, F0900_P2_RST_HWARE, 0);
+	stv0900_write_bits(intp, F0900_P1_RST_HWARE, 1);
+	stv0900_write_bits(intp, F0900_P1_RST_HWARE, 0);
 }
 
 void stv0900_set_tuner(struct dvb_frontend *fe, u32 frequency,
@@ -574,7 +567,7 @@ void stv0900_set_bandwidth(struct dvb_frontend *fe, u32 bandwidth)
 	}
 }
 
-static s32 stv0900_get_rf_level(struct stv0900_internal *i_params,
+static s32 stv0900_get_rf_level(struct stv0900_internal *intp,
 				const struct stv0900_table *lookup,
 				enum fe_stv0900_demod_num demod)
 {
@@ -584,45 +577,41 @@ static s32 stv0900_get_rf_level(struct stv0900_internal *i_params,
 		i,
 		rf_lvl = 0;
 
-	dprintk(KERN_INFO "%s\n", __func__);
+	dprintk("%s\n", __func__);
 
-	if ((lookup != NULL) && lookup->size) {
-		switch (demod) {
-		case STV0900_DEMOD_1:
-		default:
-			agc_gain = MAKEWORD(stv0900_get_bits(i_params, F0900_P1_AGCIQ_VALUE1),
-						stv0900_get_bits(i_params, F0900_P1_AGCIQ_VALUE0));
-			break;
-		case STV0900_DEMOD_2:
-			agc_gain = MAKEWORD(stv0900_get_bits(i_params, F0900_P2_AGCIQ_VALUE1),
-						stv0900_get_bits(i_params, F0900_P2_AGCIQ_VALUE0));
-			break;
-		}
+	if ((lookup == NULL) || (lookup->size <= 0))
+		return 0;
 
-		imin = 0;
-		imax = lookup->size - 1;
-		if (INRANGE(lookup->table[imin].regval, agc_gain, lookup->table[imax].regval)) {
-			while ((imax - imin) > 1) {
-				i = (imax + imin) >> 1;
+	agc_gain = MAKEWORD(stv0900_get_bits(intp, AGCIQ_VALUE1),
+				stv0900_get_bits(intp, AGCIQ_VALUE0));
 
-				if (INRANGE(lookup->table[imin].regval, agc_gain, lookup->table[i].regval))
-					imax = i;
-				else
-					imin = i;
-			}
+	imin = 0;
+	imax = lookup->size - 1;
+	if (INRANGE(lookup->table[imin].regval, agc_gain,
+					lookup->table[imax].regval)) {
+		while ((imax - imin) > 1) {
+			i = (imax + imin) >> 1;
 
-			rf_lvl = (((s32)agc_gain - lookup->table[imin].regval)
-					* (lookup->table[imax].realval - lookup->table[imin].realval)
-					/ (lookup->table[imax].regval - lookup->table[imin].regval))
-					+ lookup->table[imin].realval;
-		} else if (agc_gain > lookup->table[0].regval)
-			rf_lvl = 5;
-		else if (agc_gain < lookup->table[lookup->size-1].regval)
-			rf_lvl = -100;
+			if (INRANGE(lookup->table[imin].regval,
+					agc_gain,
+					lookup->table[i].regval))
+				imax = i;
+			else
+				imin = i;
+		}
 
-	}
+		rf_lvl = (s32)agc_gain - lookup->table[imin].regval;
+		rf_lvl *= (lookup->table[imax].realval -
+				lookup->table[imin].realval);
+		rf_lvl /= (lookup->table[imax].regval -
+				lookup->table[imin].regval);
+		rf_lvl += lookup->table[imin].realval;
+	} else if (agc_gain > lookup->table[0].regval)
+		rf_lvl = 5;
+	else if (agc_gain < lookup->table[lookup->size-1].regval)
+		rf_lvl = -100;
 
-	dprintk(KERN_INFO "%s: RFLevel = %d\n", __func__, rf_lvl);
+	dprintk("%s: RFLevel = %d\n", __func__, rf_lvl);
 
 	return rf_lvl;
 }
@@ -634,50 +623,51 @@ static int stv0900_read_signal_strength(struct dvb_frontend *fe, u16 *strength)
 	s32 rflevel = stv0900_get_rf_level(internal, &stv0900_rf,
 								state->demod);
 
-	*strength = (rflevel + 100) * (16383 / 105);
+	rflevel = (rflevel + 100) * (65535 / 70);
+	if (rflevel < 0)
+		rflevel = 0;
+
+	if (rflevel > 65535)
+		rflevel = 65535;
+
+	*strength = rflevel;
 
 	return 0;
 }
 
-
 static s32 stv0900_carr_get_quality(struct dvb_frontend *fe,
 					const struct stv0900_table *lookup)
 {
 	struct stv0900_state *state = fe->demodulator_priv;
-	struct stv0900_internal *i_params = state->internal;
+	struct stv0900_internal *intp = state->internal;
 	enum fe_stv0900_demod_num demod = state->demod;
 
-	s32 c_n = -100,
-		regval, imin, imax,
+	s32	c_n = -100,
+		regval,
+		imin,
+		imax,
 		i,
-		lock_flag_field,
 		noise_field1,
 		noise_field0;
 
-	dprintk(KERN_INFO "%s\n", __func__);
+	dprintk("%s\n", __func__);
 
-	dmd_reg(lock_flag_field, F0900_P1_LOCK_DEFINITIF,
-					F0900_P2_LOCK_DEFINITIF);
 	if (stv0900_get_standard(fe, demod) == STV0900_DVBS2_STANDARD) {
-		dmd_reg(noise_field1, F0900_P1_NOSPLHT_NORMED1,
-					F0900_P2_NOSPLHT_NORMED1);
-		dmd_reg(noise_field0, F0900_P1_NOSPLHT_NORMED0,
-					F0900_P2_NOSPLHT_NORMED0);
+		noise_field1 = NOSPLHT_NORMED1;
+		noise_field0 = NOSPLHT_NORMED0;
 	} else {
-		dmd_reg(noise_field1, F0900_P1_NOSDATAT_NORMED1,
-					F0900_P2_NOSDATAT_NORMED1);
-		dmd_reg(noise_field0, F0900_P1_NOSDATAT_NORMED0,
-					F0900_P2_NOSDATAT_NORMED0);
+		noise_field1 = NOSDATAT_NORMED1;
+		noise_field0 = NOSDATAT_NORMED0;
 	}
 
-	if (stv0900_get_bits(i_params, lock_flag_field)) {
+	if (stv0900_get_bits(intp, LOCK_DEFINITIF)) {
 		if ((lookup != NULL) && lookup->size) {
 			regval = 0;
 			msleep(5);
 			for (i = 0; i < 16; i++) {
-				regval += MAKEWORD(stv0900_get_bits(i_params,
+				regval += MAKEWORD(stv0900_get_bits(intp,
 								noise_field1),
-						stv0900_get_bits(i_params,
+						stv0900_get_bits(intp,
 								noise_field0));
 				msleep(1);
 			}
@@ -715,10 +705,9 @@ static s32 stv0900_carr_get_quality(struct dvb_frontend *fe,
 static int stv0900_read_ucblocks(struct dvb_frontend *fe, u32 * ucblocks)
 {
 	struct stv0900_state *state = fe->demodulator_priv;
-	struct stv0900_internal *i_params = state->internal;
+	struct stv0900_internal *intp = state->internal;
 	enum fe_stv0900_demod_num demod = state->demod;
 	u8 err_val1, err_val0;
-	s32 err_field1, err_field0;
 	u32 header_err_val = 0;
 
 	*ucblocks = 0x0;
@@ -726,24 +715,14 @@ static int stv0900_read_ucblocks(struct dvb_frontend *fe, u32 * ucblocks)
 		/* DVB-S2 delineator errors count */
 
 		/* retreiving number for errnous headers */
-		dmd_reg(err_field0, R0900_P1_BBFCRCKO0,
-					R0900_P2_BBFCRCKO0);
-		dmd_reg(err_field1, R0900_P1_BBFCRCKO1,
-					R0900_P2_BBFCRCKO1);
-
-		err_val1 = stv0900_read_reg(i_params, err_field1);
-		err_val0 = stv0900_read_reg(i_params, err_field0);
-		header_err_val = (err_val1<<8) | err_val0;
+		err_val1 = stv0900_read_reg(intp, BBFCRCKO1);
+		err_val0 = stv0900_read_reg(intp, BBFCRCKO0);
+		header_err_val = (err_val1 << 8) | err_val0;
 
 		/* retreiving number for errnous packets */
-		dmd_reg(err_field0, R0900_P1_UPCRCKO0,
-					R0900_P2_UPCRCKO0);
-		dmd_reg(err_field1, R0900_P1_UPCRCKO1,
-					R0900_P2_UPCRCKO1);
-
-		err_val1 = stv0900_read_reg(i_params, err_field1);
-		err_val0 = stv0900_read_reg(i_params, err_field0);
-		*ucblocks = (err_val1<<8) | err_val0;
+		err_val1 = stv0900_read_reg(intp, UPCRCKO1);
+		err_val0 = stv0900_read_reg(intp, UPCRCKO0);
+		*ucblocks = (err_val1 << 8) | err_val0;
 		*ucblocks += header_err_val;
 	}
 
@@ -752,33 +731,27 @@ static int stv0900_read_ucblocks(struct dvb_frontend *fe, u32 * ucblocks)
 
 static int stv0900_read_snr(struct dvb_frontend *fe, u16 *snr)
 {
-	*snr = stv0900_carr_get_quality(fe,
+	s32 snrlcl = stv0900_carr_get_quality(fe,
 			(const struct stv0900_table *)&stv0900_s2_cn);
-	*snr += 30;
-	*snr *= (16383 / 1030);
+	snrlcl = (snrlcl + 30) * 384;
+	if (snrlcl < 0)
+		snrlcl = 0;
+
+	if (snrlcl > 65535)
+		snrlcl = 65535;
+
+	*snr = snrlcl;
 
 	return 0;
 }
 
-static u32 stv0900_get_ber(struct stv0900_internal *i_params,
+static u32 stv0900_get_ber(struct stv0900_internal *intp,
 				enum fe_stv0900_demod_num demod)
 {
 	u32 ber = 10000000, i;
-	s32 dmd_state_reg;
 	s32 demod_state;
-	s32 vstatus_reg;
-	s32 prvit_field;
-	s32 pdel_status_reg;
-	s32 pdel_lock_field;
-
-	dmd_reg(dmd_state_reg, F0900_P1_HEADER_MODE, F0900_P2_HEADER_MODE);
-	dmd_reg(vstatus_reg, R0900_P1_VSTATUSVIT, R0900_P2_VSTATUSVIT);
-	dmd_reg(prvit_field, F0900_P1_PRFVIT, F0900_P2_PRFVIT);
-	dmd_reg(pdel_status_reg, R0900_P1_PDELSTATUS1, R0900_P2_PDELSTATUS1);
-	dmd_reg(pdel_lock_field, F0900_P1_PKTDELIN_LOCK,
-				F0900_P2_PKTDELIN_LOCK);
 
-	demod_state = stv0900_get_bits(i_params, dmd_state_reg);
+	demod_state = stv0900_get_bits(intp, HEADER_MODE);
 
 	switch (demod_state) {
 	case STV0900_SEARCH:
@@ -790,11 +763,11 @@ static u32 stv0900_get_ber(struct stv0900_internal *i_params,
 		ber = 0;
 		for (i = 0; i < 5; i++) {
 			msleep(5);
-			ber += stv0900_get_err_count(i_params, 0, demod);
+			ber += stv0900_get_err_count(intp, 0, demod);
 		}
 
 		ber /= 5;
-		if (stv0900_get_bits(i_params, prvit_field)) {
+		if (stv0900_get_bits(intp, PRFVIT)) {
 			ber *= 9766;
 			ber = ber >> 13;
 		}
@@ -804,11 +777,11 @@ static u32 stv0900_get_ber(struct stv0900_internal *i_params,
 		ber = 0;
 		for (i = 0; i < 5; i++) {
 			msleep(5);
-			ber += stv0900_get_err_count(i_params, 0, demod);
+			ber += stv0900_get_err_count(intp, 0, demod);
 		}
 
 		ber /= 5;
-		if (stv0900_get_bits(i_params, pdel_lock_field)) {
+		if (stv0900_get_bits(intp, PKTDELIN_LOCK)) {
 			ber *= 9766;
 			ber = ber >> 13;
 		}
@@ -829,20 +802,16 @@ static int stv0900_read_ber(struct dvb_frontend *fe, u32 *ber)
 	return 0;
 }
 
-int stv0900_get_demod_lock(struct stv0900_internal *i_params,
+int stv0900_get_demod_lock(struct stv0900_internal *intp,
 			enum fe_stv0900_demod_num demod, s32 time_out)
 {
 	s32 timer = 0,
-		lock = 0,
-		header_field,
-		lock_field;
+		lock = 0;
 
 	enum fe_stv0900_search_state	dmd_state;
 
-	dmd_reg(header_field, F0900_P1_HEADER_MODE, F0900_P2_HEADER_MODE);
-	dmd_reg(lock_field, F0900_P1_LOCK_DEFINITIF, F0900_P2_LOCK_DEFINITIF);
 	while ((timer < time_out) && (lock == 0)) {
-		dmd_state = stv0900_get_bits(i_params, header_field);
+		dmd_state = stv0900_get_bits(intp, HEADER_MODE);
 		dprintk("Demod State = %d\n", dmd_state);
 		switch (dmd_state) {
 		case STV0900_SEARCH:
@@ -852,7 +821,7 @@ int stv0900_get_demod_lock(struct stv0900_internal *i_params,
 			break;
 		case STV0900_DVBS2_FOUND:
 		case STV0900_DVBS_FOUND:
-			lock = stv0900_get_bits(i_params, lock_field);
+			lock = stv0900_get_bits(intp, LOCK_DEFINITIF);
 			break;
 		}
 
@@ -870,56 +839,40 @@ int stv0900_get_demod_lock(struct stv0900_internal *i_params,
 	return lock;
 }
 
-void stv0900_stop_all_s2_modcod(struct stv0900_internal *i_params,
+void stv0900_stop_all_s2_modcod(struct stv0900_internal *intp,
 				enum fe_stv0900_demod_num demod)
 {
 	s32 regflist,
 	i;
 
-	dprintk(KERN_INFO "%s\n", __func__);
+	dprintk("%s\n", __func__);
 
-	dmd_reg(regflist, R0900_P1_MODCODLST0, R0900_P2_MODCODLST0);
+	regflist = MODCODLST0;
 
 	for (i = 0; i < 16; i++)
-		stv0900_write_reg(i_params, regflist + i, 0xff);
+		stv0900_write_reg(intp, regflist + i, 0xff);
 }
 
-void stv0900_activate_s2_modcode(struct stv0900_internal *i_params,
+void stv0900_activate_s2_modcod(struct stv0900_internal *intp,
 				enum fe_stv0900_demod_num demod)
 {
 	u32 matype,
-	mod_code,
-	fmod,
-	reg_index,
-	field_index;
+		mod_code,
+		fmod,
+		reg_index,
+		field_index;
 
-	dprintk(KERN_INFO "%s\n", __func__);
+	dprintk("%s\n", __func__);
 
-	if (i_params->chip_id <= 0x11) {
+	if (intp->chip_id <= 0x11) {
 		msleep(5);
 
-		switch (demod) {
-		case STV0900_DEMOD_1:
-		default:
-			mod_code = stv0900_read_reg(i_params,
-							R0900_P1_PLHMODCOD);
-			matype = mod_code & 0x3;
-			mod_code = (mod_code & 0x7f) >> 2;
-
-			reg_index = R0900_P1_MODCODLSTF - mod_code / 2;
-			field_index = mod_code % 2;
-			break;
-		case STV0900_DEMOD_2:
-			mod_code = stv0900_read_reg(i_params,
-							R0900_P2_PLHMODCOD);
-			matype = mod_code & 0x3;
-			mod_code = (mod_code & 0x7f) >> 2;
-
-			reg_index = R0900_P2_MODCODLSTF - mod_code / 2;
-			field_index = mod_code % 2;
-			break;
-		}
+		mod_code = stv0900_read_reg(intp, PLHMODCOD);
+		matype = mod_code & 0x3;
+		mod_code = (mod_code & 0x7f) >> 2;
 
+		reg_index = MODCODLSTF - mod_code / 2;
+		field_index = mod_code % 2;
 
 		switch (matype) {
 		case 0:
@@ -938,70 +891,41 @@ void stv0900_activate_s2_modcode(struct stv0900_internal *i_params,
 		}
 
 		if ((INRANGE(STV0900_QPSK_12, mod_code, STV0900_8PSK_910))
-							&& (matype <= 1)) {
+						&& (matype <= 1)) {
 			if (field_index == 0)
-				stv0900_write_reg(i_params, reg_index,
+				stv0900_write_reg(intp, reg_index,
 							0xf0 | fmod);
 			else
-				stv0900_write_reg(i_params, reg_index,
+				stv0900_write_reg(intp, reg_index,
 							(fmod << 4) | 0xf);
 		}
-	} else if (i_params->chip_id >= 0x12) {
-		switch (demod) {
-		case STV0900_DEMOD_1:
-		default:
-			for (reg_index = 0; reg_index < 7; reg_index++)
-				stv0900_write_reg(i_params, R0900_P1_MODCODLST0 + reg_index, 0xff);
 
-			stv0900_write_reg(i_params, R0900_P1_MODCODLSTE, 0xff);
-			stv0900_write_reg(i_params, R0900_P1_MODCODLSTF, 0xcf);
-			for (reg_index = 0; reg_index < 8; reg_index++)
-				stv0900_write_reg(i_params, R0900_P1_MODCODLST7 + reg_index, 0xcc);
-
-			break;
-		case STV0900_DEMOD_2:
-			for (reg_index = 0; reg_index < 7; reg_index++)
-				stv0900_write_reg(i_params, R0900_P2_MODCODLST0 + reg_index, 0xff);
+	} else if (intp->chip_id >= 0x12) {
+		for (reg_index = 0; reg_index < 7; reg_index++)
+			stv0900_write_reg(intp, MODCODLST0 + reg_index, 0xff);
 
-			stv0900_write_reg(i_params, R0900_P2_MODCODLSTE, 0xff);
-			stv0900_write_reg(i_params, R0900_P2_MODCODLSTF, 0xcf);
-			for (reg_index = 0; reg_index < 8; reg_index++)
-				stv0900_write_reg(i_params, R0900_P2_MODCODLST7 + reg_index, 0xcc);
+		stv0900_write_reg(intp, MODCODLSTE, 0xff);
+		stv0900_write_reg(intp, MODCODLSTF, 0xcf);
+		for (reg_index = 0; reg_index < 8; reg_index++)
+			stv0900_write_reg(intp, MODCODLST7 + reg_index, 0xcc);
 
-			break;
-		}
 
 	}
 }
 
-void stv0900_activate_s2_modcode_single(struct stv0900_internal *i_params,
+void stv0900_activate_s2_modcod_single(struct stv0900_internal *intp,
 					enum fe_stv0900_demod_num demod)
 {
 	u32 reg_index;
 
-	dprintk(KERN_INFO "%s\n", __func__);
+	dprintk("%s\n", __func__);
 
-	switch (demod) {
-	case STV0900_DEMOD_1:
-	default:
-		stv0900_write_reg(i_params, R0900_P1_MODCODLST0, 0xff);
-		stv0900_write_reg(i_params, R0900_P1_MODCODLST1, 0xf0);
-		stv0900_write_reg(i_params, R0900_P1_MODCODLSTF, 0x0f);
-		for (reg_index = 0; reg_index < 13; reg_index++)
-			stv0900_write_reg(i_params,
-					R0900_P1_MODCODLST2 + reg_index, 0);
+	stv0900_write_reg(intp, MODCODLST0, 0xff);
+	stv0900_write_reg(intp, MODCODLST1, 0xf0);
+	stv0900_write_reg(intp, MODCODLSTF, 0x0f);
+	for (reg_index = 0; reg_index < 13; reg_index++)
+		stv0900_write_reg(intp, MODCODLST2 + reg_index, 0);
 
-		break;
-	case STV0900_DEMOD_2:
-		stv0900_write_reg(i_params, R0900_P2_MODCODLST0, 0xff);
-		stv0900_write_reg(i_params, R0900_P2_MODCODLST1, 0xf0);
-		stv0900_write_reg(i_params, R0900_P2_MODCODLSTF, 0x0f);
-		for (reg_index = 0; reg_index < 13; reg_index++)
-			stv0900_write_reg(i_params,
-					R0900_P2_MODCODLST2 + reg_index, 0);
-
-		break;
-	}
 }
 
 static enum dvbfe_algo stv0900_frontend_algo(struct dvb_frontend *fe)
@@ -1012,7 +936,7 @@ static enum dvbfe_algo stv0900_frontend_algo(struct dvb_frontend *fe)
 static int stb0900_set_property(struct dvb_frontend *fe,
 				struct dtv_property *tvp)
 {
-	dprintk(KERN_INFO "%s(..)\n", __func__);
+	dprintk("%s(..)\n", __func__);
 
 	return 0;
 }
@@ -1020,166 +944,123 @@ static int stb0900_set_property(struct dvb_frontend *fe,
 static int stb0900_get_property(struct dvb_frontend *fe,
 				struct dtv_property *tvp)
 {
-	dprintk(KERN_INFO "%s(..)\n", __func__);
+	dprintk("%s(..)\n", __func__);
 
 	return 0;
 }
 
-void stv0900_start_search(struct stv0900_internal *i_params,
+void stv0900_start_search(struct stv0900_internal *intp,
 				enum fe_stv0900_demod_num demod)
 {
-
-	switch (demod) {
-	case STV0900_DEMOD_1:
-	default:
-		stv0900_write_bits(i_params, F0900_P1_I2C_DEMOD_MODE, 0x1f);
-
-		if (i_params->chip_id == 0x10)
-			stv0900_write_reg(i_params, R0900_P1_CORRELEXP, 0xaa);
-
-		if (i_params->chip_id < 0x20)
-			stv0900_write_reg(i_params, R0900_P1_CARHDR, 0x55);
-
-		if (i_params->dmd1_symbol_rate <= 5000000) {
-			stv0900_write_reg(i_params, R0900_P1_CARCFG, 0x44);
-			stv0900_write_reg(i_params, R0900_P1_CFRUP1, 0x0f);
-			stv0900_write_reg(i_params, R0900_P1_CFRUP0, 0xff);
-			stv0900_write_reg(i_params, R0900_P1_CFRLOW1, 0xf0);
-			stv0900_write_reg(i_params, R0900_P1_CFRLOW0, 0x00);
-			stv0900_write_reg(i_params, R0900_P1_RTCS2, 0x68);
+	u32 freq;
+	s16 freq_s16 ;
+
+	stv0900_write_bits(intp, DEMOD_MODE, 0x1f);
+	if (intp->chip_id == 0x10)
+		stv0900_write_reg(intp, CORRELEXP, 0xaa);
+
+	if (intp->chip_id < 0x20)
+		stv0900_write_reg(intp, CARHDR, 0x55);
+
+	if (intp->chip_id <= 0x20) {
+		if (intp->symbol_rate[0] <= 5000000) {
+			stv0900_write_reg(intp, CARCFG, 0x44);
+			stv0900_write_reg(intp, CFRUP1, 0x0f);
+			stv0900_write_reg(intp, CFRUP0, 0xff);
+			stv0900_write_reg(intp, CFRLOW1, 0xf0);
+			stv0900_write_reg(intp, CFRLOW0, 0x00);
+			stv0900_write_reg(intp, RTCS2, 0x68);
 		} else {
-			stv0900_write_reg(i_params, R0900_P1_CARCFG, 0xc4);
-			stv0900_write_reg(i_params, R0900_P1_RTCS2, 0x44);
+			stv0900_write_reg(intp, CARCFG, 0xc4);
+			stv0900_write_reg(intp, RTCS2, 0x44);
 		}
 
-		stv0900_write_reg(i_params, R0900_P1_CFRINIT1, 0);
-		stv0900_write_reg(i_params, R0900_P1_CFRINIT0, 0);
-
-		if (i_params->chip_id >= 0x20) {
-			stv0900_write_reg(i_params, R0900_P1_EQUALCFG, 0x41);
-			stv0900_write_reg(i_params, R0900_P1_FFECFG, 0x41);
-
-			if ((i_params->dmd1_srch_standard == STV0900_SEARCH_DVBS1) || (i_params->dmd1_srch_standard == STV0900_SEARCH_DSS) || (i_params->dmd1_srch_standard == STV0900_AUTO_SEARCH)) {
-				stv0900_write_reg(i_params, R0900_P1_VITSCALE, 0x82);
-				stv0900_write_reg(i_params, R0900_P1_VAVSRVIT, 0x0);
-			}
-		}
-
-		stv0900_write_reg(i_params, R0900_P1_SFRSTEP, 0x00);
-		stv0900_write_reg(i_params, R0900_P1_TMGTHRISE, 0xe0);
-		stv0900_write_reg(i_params, R0900_P1_TMGTHFALL, 0xc0);
-		stv0900_write_bits(i_params, F0900_P1_SCAN_ENABLE, 0);
-		stv0900_write_bits(i_params, F0900_P1_CFR_AUTOSCAN, 0);
-		stv0900_write_bits(i_params, F0900_P1_S1S2_SEQUENTIAL, 0);
-		stv0900_write_reg(i_params, R0900_P1_RTC, 0x88);
-		if (i_params->chip_id >= 0x20) {
-			if (i_params->dmd1_symbol_rate < 2000000) {
-				stv0900_write_reg(i_params, R0900_P1_CARFREQ, 0x39);
-				stv0900_write_reg(i_params, R0900_P1_CARHDR, 0x40);
-			}
-
-			if (i_params->dmd1_symbol_rate < 10000000) {
-				stv0900_write_reg(i_params, R0900_P1_CARFREQ, 0x4c);
-				stv0900_write_reg(i_params, R0900_P1_CARHDR, 0x20);
-			} else {
-				stv0900_write_reg(i_params, R0900_P1_CARFREQ, 0x4b);
-				stv0900_write_reg(i_params, R0900_P1_CARHDR, 0x20);
-			}
+	} else { /*cut 3.0 above*/
+		if (intp->symbol_rate[demod] <= 5000000)
+			stv0900_write_reg(intp, RTCS2, 0x68);
+		else
+			stv0900_write_reg(intp, RTCS2, 0x44);
 
+		stv0900_write_reg(intp, CARCFG, 0x46);
+		if (intp->srch_algo[demod] == STV0900_WARM_START) {
+			freq = 1000 << 16;
+			freq /= (intp->mclk / 1000);
+			freq_s16 = (s16)freq;
 		} else {
-			if (i_params->dmd1_symbol_rate < 10000000)
-				stv0900_write_reg(i_params, R0900_P1_CARFREQ, 0xef);
+			freq = (intp->srch_range[demod] / 2000);
+			if (intp->symbol_rate[demod] <= 5000000)
+				freq += 80;
 			else
-				stv0900_write_reg(i_params, R0900_P1_CARFREQ, 0xed);
-		}
+				freq += 600;
 
-		switch (i_params->dmd1_srch_algo) {
-		case STV0900_WARM_START:
-			stv0900_write_reg(i_params, R0900_P1_DMDISTATE, 0x1f);
-			stv0900_write_reg(i_params, R0900_P1_DMDISTATE, 0x18);
-			break;
-		case STV0900_COLD_START:
-			stv0900_write_reg(i_params, R0900_P1_DMDISTATE, 0x1f);
-			stv0900_write_reg(i_params, R0900_P1_DMDISTATE, 0x15);
-			break;
-		default:
-			break;
+			freq = freq << 16;
+			freq /= (intp->mclk / 1000);
+			freq_s16 = (s16)freq;
 		}
 
-		break;
-	case STV0900_DEMOD_2:
-		stv0900_write_bits(i_params, F0900_P2_I2C_DEMOD_MODE, 0x1f);
-		if (i_params->chip_id == 0x10)
-			stv0900_write_reg(i_params, R0900_P2_CORRELEXP, 0xaa);
-
-		if (i_params->chip_id < 0x20)
-			stv0900_write_reg(i_params, R0900_P2_CARHDR, 0x55);
-
-		if (i_params->dmd2_symbol_rate <= 5000000) {
-			stv0900_write_reg(i_params, R0900_P2_CARCFG, 0x44);
-			stv0900_write_reg(i_params, R0900_P2_CFRUP1, 0x0f);
-			stv0900_write_reg(i_params, R0900_P2_CFRUP0, 0xff);
-			stv0900_write_reg(i_params, R0900_P2_CFRLOW1, 0xf0);
-			stv0900_write_reg(i_params, R0900_P2_CFRLOW0, 0x00);
-			stv0900_write_reg(i_params, R0900_P2_RTCS2, 0x68);
-		} else {
-			stv0900_write_reg(i_params, R0900_P2_CARCFG, 0xc4);
-			stv0900_write_reg(i_params, R0900_P2_RTCS2, 0x44);
-		}
+		stv0900_write_bits(intp, CFR_UP1, MSB(freq_s16));
+		stv0900_write_bits(intp, CFR_UP0, LSB(freq_s16));
+		freq_s16 *= (-1);
+		stv0900_write_bits(intp, CFR_LOW1, MSB(freq_s16));
+		stv0900_write_bits(intp, CFR_LOW0, LSB(freq_s16));
+	}
 
-		stv0900_write_reg(i_params, R0900_P2_CFRINIT1, 0);
-		stv0900_write_reg(i_params, R0900_P2_CFRINIT0, 0);
+	stv0900_write_reg(intp, CFRINIT1, 0);
+	stv0900_write_reg(intp, CFRINIT0, 0);
 
-		if (i_params->chip_id >= 0x20) {
-			stv0900_write_reg(i_params, R0900_P2_EQUALCFG, 0x41);
-			stv0900_write_reg(i_params, R0900_P2_FFECFG, 0x41);
-			if ((i_params->dmd2_srch_stndrd == STV0900_SEARCH_DVBS1) || (i_params->dmd2_srch_stndrd == STV0900_SEARCH_DSS) || (i_params->dmd2_srch_stndrd == STV0900_AUTO_SEARCH)) {
-				stv0900_write_reg(i_params, R0900_P2_VITSCALE, 0x82);
-				stv0900_write_reg(i_params, R0900_P2_VAVSRVIT, 0x0);
-			}
-		}
-
-		stv0900_write_reg(i_params, R0900_P2_SFRSTEP, 0x00);
-		stv0900_write_reg(i_params, R0900_P2_TMGTHRISE, 0xe0);
-		stv0900_write_reg(i_params, R0900_P2_TMGTHFALL, 0xc0);
-		stv0900_write_bits(i_params, F0900_P2_SCAN_ENABLE, 0);
-		stv0900_write_bits(i_params, F0900_P2_CFR_AUTOSCAN, 0);
-		stv0900_write_bits(i_params, F0900_P2_S1S2_SEQUENTIAL, 0);
-		stv0900_write_reg(i_params, R0900_P2_RTC, 0x88);
-		if (i_params->chip_id >= 0x20) {
-			if (i_params->dmd2_symbol_rate < 2000000) {
-				stv0900_write_reg(i_params, R0900_P2_CARFREQ, 0x39);
-				stv0900_write_reg(i_params, R0900_P2_CARHDR, 0x40);
-			}
+	if (intp->chip_id >= 0x20) {
+		stv0900_write_reg(intp, EQUALCFG, 0x41);
+		stv0900_write_reg(intp, FFECFG, 0x41);
 
-			if (i_params->dmd2_symbol_rate < 10000000) {
-				stv0900_write_reg(i_params, R0900_P2_CARFREQ, 0x4c);
-				stv0900_write_reg(i_params, R0900_P2_CARHDR, 0x20);
-			} else {
-				stv0900_write_reg(i_params, R0900_P2_CARFREQ, 0x4b);
-				stv0900_write_reg(i_params, R0900_P2_CARHDR, 0x20);
-			}
+		if ((intp->srch_standard[demod] == STV0900_SEARCH_DVBS1) ||
+			(intp->srch_standard[demod] == STV0900_SEARCH_DSS) ||
+			(intp->srch_standard[demod] == STV0900_AUTO_SEARCH)) {
+			stv0900_write_reg(intp, VITSCALE,
+								0x82);
+			stv0900_write_reg(intp, VAVSRVIT, 0x0);
+		}
+	}
 
+	stv0900_write_reg(intp, SFRSTEP, 0x00);
+	stv0900_write_reg(intp, TMGTHRISE, 0xe0);
+	stv0900_write_reg(intp, TMGTHFALL, 0xc0);
+	stv0900_write_bits(intp, SCAN_ENABLE, 0);
+	stv0900_write_bits(intp, CFR_AUTOSCAN, 0);
+	stv0900_write_bits(intp, S1S2_SEQUENTIAL, 0);
+	stv0900_write_reg(intp, RTC, 0x88);
+	if (intp->chip_id >= 0x20) {
+		if (intp->symbol_rate[demod] < 2000000) {
+			if (intp->chip_id <= 0x20)
+				stv0900_write_reg(intp, CARFREQ, 0x39);
+			else  /*cut 3.0*/
+				stv0900_write_reg(intp, CARFREQ, 0x89);
+
+			stv0900_write_reg(intp, CARHDR, 0x40);
+		} else if (intp->symbol_rate[demod] < 10000000) {
+			stv0900_write_reg(intp, CARFREQ, 0x4c);
+			stv0900_write_reg(intp, CARHDR, 0x20);
 		} else {
-			if (i_params->dmd2_symbol_rate < 10000000)
-				stv0900_write_reg(i_params, R0900_P2_CARFREQ, 0xef);
-			else
-				stv0900_write_reg(i_params, R0900_P2_CARFREQ, 0xed);
+			stv0900_write_reg(intp, CARFREQ, 0x4b);
+			stv0900_write_reg(intp, CARHDR, 0x20);
 		}
 
-		switch (i_params->dmd2_srch_algo) {
-		case STV0900_WARM_START:
-			stv0900_write_reg(i_params, R0900_P2_DMDISTATE, 0x1f);
-			stv0900_write_reg(i_params, R0900_P2_DMDISTATE, 0x18);
-			break;
-		case STV0900_COLD_START:
-			stv0900_write_reg(i_params, R0900_P2_DMDISTATE, 0x1f);
-			stv0900_write_reg(i_params, R0900_P2_DMDISTATE, 0x15);
-			break;
-		default:
-			break;
-		}
+	} else {
+		if (intp->symbol_rate[demod] < 10000000)
+			stv0900_write_reg(intp, CARFREQ, 0xef);
+		else
+			stv0900_write_reg(intp, CARFREQ, 0xed);
+	}
 
+	switch (intp->srch_algo[demod]) {
+	case STV0900_WARM_START:
+		stv0900_write_reg(intp, DMDISTATE, 0x1f);
+		stv0900_write_reg(intp, DMDISTATE, 0x18);
+		break;
+	case STV0900_COLD_START:
+		stv0900_write_reg(intp, DMDISTATE, 0x1f);
+		stv0900_write_reg(intp, DMDISTATE, 0x15);
+		break;
+	default:
 		break;
 	}
 }
@@ -1188,33 +1069,40 @@ u8 stv0900_get_optim_carr_loop(s32 srate, enum fe_stv0900_modcode modcode,
 							s32 pilot, u8 chip_id)
 {
 	u8 aclc_value = 0x29;
-	s32	i;
-	const struct stv0900_car_loop_optim *car_loop_s2;
-
-	dprintk(KERN_INFO "%s\n", __func__);
-
-	if (chip_id <= 0x12)
-		car_loop_s2 = FE_STV0900_S2CarLoop;
-	else if (chip_id == 0x20)
-		car_loop_s2 = FE_STV0900_S2CarLoopCut20;
-	else
-		car_loop_s2 = FE_STV0900_S2CarLoop;
+	s32 i;
+	const struct stv0900_car_loop_optim *cls2, *cllqs2, *cllas2;
+
+	dprintk("%s\n", __func__);
+
+	if (chip_id <= 0x12) {
+		cls2 = FE_STV0900_S2CarLoop;
+		cllqs2 = FE_STV0900_S2LowQPCarLoopCut30;
+		cllas2 = FE_STV0900_S2APSKCarLoopCut30;
+	} else if (chip_id == 0x20) {
+		cls2 = FE_STV0900_S2CarLoopCut20;
+		cllqs2 = FE_STV0900_S2LowQPCarLoopCut20;
+		cllas2 = FE_STV0900_S2APSKCarLoopCut20;
+	} else {
+		cls2 = FE_STV0900_S2CarLoopCut30;
+		cllqs2 = FE_STV0900_S2LowQPCarLoopCut30;
+		cllas2 = FE_STV0900_S2APSKCarLoopCut30;
+	}
 
 	if (modcode < STV0900_QPSK_12) {
 		i = 0;
-		while ((i < 3) && (modcode != FE_STV0900_S2LowQPCarLoopCut20[i].modcode))
+		while ((i < 3) && (modcode != cllqs2[i].modcode))
 			i++;
 
 		if (i >= 3)
 			i = 2;
 	} else {
 		i = 0;
-		while ((i < 14) && (modcode != car_loop_s2[i].modcode))
+		while ((i < 14) && (modcode != cls2[i].modcode))
 			i++;
 
 		if (i >= 14) {
 			i = 0;
-			while ((i < 11) && (modcode != FE_STV0900_S2APSKCarLoopCut20[i].modcode))
+			while ((i < 11) && (modcode != cllas2[i].modcode))
 				i++;
 
 			if (i >= 11)
@@ -1225,76 +1113,82 @@ u8 stv0900_get_optim_carr_loop(s32 srate, enum fe_stv0900_modcode modcode,
 	if (modcode <= STV0900_QPSK_25) {
 		if (pilot) {
 			if (srate <= 3000000)
-				aclc_value = FE_STV0900_S2LowQPCarLoopCut20[i].car_loop_pilots_on_2;
+				aclc_value = cllqs2[i].car_loop_pilots_on_2;
 			else if (srate <= 7000000)
-				aclc_value = FE_STV0900_S2LowQPCarLoopCut20[i].car_loop_pilots_on_5;
+				aclc_value = cllqs2[i].car_loop_pilots_on_5;
 			else if (srate <= 15000000)
-				aclc_value = FE_STV0900_S2LowQPCarLoopCut20[i].car_loop_pilots_on_10;
+				aclc_value = cllqs2[i].car_loop_pilots_on_10;
 			else if (srate <= 25000000)
-				aclc_value = FE_STV0900_S2LowQPCarLoopCut20[i].car_loop_pilots_on_20;
+				aclc_value = cllqs2[i].car_loop_pilots_on_20;
 			else
-				aclc_value = FE_STV0900_S2LowQPCarLoopCut20[i].car_loop_pilots_on_30;
+				aclc_value = cllqs2[i].car_loop_pilots_on_30;
 		} else {
 			if (srate <= 3000000)
-				aclc_value = FE_STV0900_S2LowQPCarLoopCut20[i].car_loop_pilots_off_2;
+				aclc_value = cllqs2[i].car_loop_pilots_off_2;
 			else if (srate <= 7000000)
-				aclc_value = FE_STV0900_S2LowQPCarLoopCut20[i].car_loop_pilots_off_5;
+				aclc_value = cllqs2[i].car_loop_pilots_off_5;
 			else if (srate <= 15000000)
-				aclc_value = FE_STV0900_S2LowQPCarLoopCut20[i].car_loop_pilots_off_10;
+				aclc_value = cllqs2[i].car_loop_pilots_off_10;
 			else if (srate <= 25000000)
-				aclc_value = FE_STV0900_S2LowQPCarLoopCut20[i].car_loop_pilots_off_20;
+				aclc_value = cllqs2[i].car_loop_pilots_off_20;
 			else
-				aclc_value = FE_STV0900_S2LowQPCarLoopCut20[i].car_loop_pilots_off_30;
+				aclc_value = cllqs2[i].car_loop_pilots_off_30;
 		}
 
 	} else if (modcode <= STV0900_8PSK_910) {
 		if (pilot) {
 			if (srate <= 3000000)
-				aclc_value = car_loop_s2[i].car_loop_pilots_on_2;
+				aclc_value = cls2[i].car_loop_pilots_on_2;
 			else if (srate <= 7000000)
-				aclc_value = car_loop_s2[i].car_loop_pilots_on_5;
+				aclc_value = cls2[i].car_loop_pilots_on_5;
 			else if (srate <= 15000000)
-				aclc_value = car_loop_s2[i].car_loop_pilots_on_10;
+				aclc_value = cls2[i].car_loop_pilots_on_10;
 			else if (srate <= 25000000)
-				aclc_value = car_loop_s2[i].car_loop_pilots_on_20;
+				aclc_value = cls2[i].car_loop_pilots_on_20;
 			else
-				aclc_value = car_loop_s2[i].car_loop_pilots_on_30;
+				aclc_value = cls2[i].car_loop_pilots_on_30;
 		} else {
 			if (srate <= 3000000)
-				aclc_value = car_loop_s2[i].car_loop_pilots_off_2;
+				aclc_value = cls2[i].car_loop_pilots_off_2;
 			else if (srate <= 7000000)
-				aclc_value = car_loop_s2[i].car_loop_pilots_off_5;
+				aclc_value = cls2[i].car_loop_pilots_off_5;
 			else if (srate <= 15000000)
-				aclc_value = car_loop_s2[i].car_loop_pilots_off_10;
+				aclc_value = cls2[i].car_loop_pilots_off_10;
 			else if (srate <= 25000000)
-				aclc_value = car_loop_s2[i].car_loop_pilots_off_20;
+				aclc_value = cls2[i].car_loop_pilots_off_20;
 			else
-				aclc_value = car_loop_s2[i].car_loop_pilots_off_30;
+				aclc_value = cls2[i].car_loop_pilots_off_30;
 		}
 
 	} else {
 		if (srate <= 3000000)
-			aclc_value = FE_STV0900_S2APSKCarLoopCut20[i].car_loop_pilots_on_2;
+			aclc_value = cllas2[i].car_loop_pilots_on_2;
 		else if (srate <= 7000000)
-			aclc_value = FE_STV0900_S2APSKCarLoopCut20[i].car_loop_pilots_on_5;
+			aclc_value = cllas2[i].car_loop_pilots_on_5;
 		else if (srate <= 15000000)
-			aclc_value = FE_STV0900_S2APSKCarLoopCut20[i].car_loop_pilots_on_10;
+			aclc_value = cllas2[i].car_loop_pilots_on_10;
 		else if (srate <= 25000000)
-			aclc_value = FE_STV0900_S2APSKCarLoopCut20[i].car_loop_pilots_on_20;
+			aclc_value = cllas2[i].car_loop_pilots_on_20;
 		else
-			aclc_value = FE_STV0900_S2APSKCarLoopCut20[i].car_loop_pilots_on_30;
+			aclc_value = cllas2[i].car_loop_pilots_on_30;
 	}
 
 	return aclc_value;
 }
 
-u8 stv0900_get_optim_short_carr_loop(s32 srate, enum fe_stv0900_modulation modulation, u8 chip_id)
+u8 stv0900_get_optim_short_carr_loop(s32 srate,
+				enum fe_stv0900_modulation modulation,
+				u8 chip_id)
 {
+	const struct stv0900_short_frames_car_loop_optim *s2scl;
+	const struct stv0900_short_frames_car_loop_optim_vs_mod *s2sclc30;
 	s32 mod_index = 0;
-
 	u8 aclc_value = 0x0b;
 
-	dprintk(KERN_INFO "%s\n", __func__);
+	dprintk("%s\n", __func__);
+
+	s2scl = FE_STV0900_S2ShortCarLoop;
+	s2sclc30 = FE_STV0900_S2ShortCarLoopCut30;
 
 	switch (modulation) {
 	case STV0900_QPSK:
@@ -1312,75 +1206,116 @@ u8 stv0900_get_optim_short_carr_loop(s32 srate, enum fe_stv0900_modulation modul
 		break;
 	}
 
-	switch (chip_id) {
-	case 0x20:
+	if (chip_id >= 0x30) {
 		if (srate <= 3000000)
-			aclc_value = FE_STV0900_S2ShortCarLoop[mod_index].car_loop_cut20_2;
+			aclc_value = s2sclc30[mod_index].car_loop_2;
 		else if (srate <= 7000000)
-			aclc_value = FE_STV0900_S2ShortCarLoop[mod_index].car_loop_cut20_5;
+			aclc_value = s2sclc30[mod_index].car_loop_5;
 		else if (srate <= 15000000)
-			aclc_value = FE_STV0900_S2ShortCarLoop[mod_index].car_loop_cut20_10;
+			aclc_value = s2sclc30[mod_index].car_loop_10;
 		else if (srate <= 25000000)
-			aclc_value = FE_STV0900_S2ShortCarLoop[mod_index].car_loop_cut20_20;
+			aclc_value = s2sclc30[mod_index].car_loop_20;
 		else
-			aclc_value = FE_STV0900_S2ShortCarLoop[mod_index].car_loop_cut20_30;
+			aclc_value = s2sclc30[mod_index].car_loop_30;
 
-		break;
-	case 0x12:
-	default:
+	} else if (chip_id >= 0x20) {
 		if (srate <= 3000000)
-			aclc_value = FE_STV0900_S2ShortCarLoop[mod_index].car_loop_cut12_2;
+			aclc_value = s2scl[mod_index].car_loop_cut20_2;
 		else if (srate <= 7000000)
-			aclc_value = FE_STV0900_S2ShortCarLoop[mod_index].car_loop_cut12_5;
+			aclc_value = s2scl[mod_index].car_loop_cut20_5;
 		else if (srate <= 15000000)
-			aclc_value = FE_STV0900_S2ShortCarLoop[mod_index].car_loop_cut12_10;
+			aclc_value = s2scl[mod_index].car_loop_cut20_10;
 		else if (srate <= 25000000)
-			aclc_value = FE_STV0900_S2ShortCarLoop[mod_index].car_loop_cut12_20;
+			aclc_value = s2scl[mod_index].car_loop_cut20_20;
 		else
-			aclc_value = FE_STV0900_S2ShortCarLoop[mod_index].car_loop_cut12_30;
+			aclc_value = s2scl[mod_index].car_loop_cut20_30;
+
+	} else {
+		if (srate <= 3000000)
+			aclc_value = s2scl[mod_index].car_loop_cut12_2;
+		else if (srate <= 7000000)
+			aclc_value = s2scl[mod_index].car_loop_cut12_5;
+		else if (srate <= 15000000)
+			aclc_value = s2scl[mod_index].car_loop_cut12_10;
+		else if (srate <= 25000000)
+			aclc_value = s2scl[mod_index].car_loop_cut12_20;
+		else
+			aclc_value = s2scl[mod_index].car_loop_cut12_30;
 
-		break;
 	}
 
 	return aclc_value;
 }
 
-static enum fe_stv0900_error stv0900_st_dvbs2_single(struct stv0900_internal *i_params,
+static
+enum fe_stv0900_error stv0900_st_dvbs2_single(struct stv0900_internal *intp,
 					enum fe_stv0900_demod_mode LDPC_Mode,
 					enum fe_stv0900_demod_num demod)
 {
 	enum fe_stv0900_error error = STV0900_NO_ERROR;
+	s32 reg_ind;
 
-	dprintk(KERN_INFO "%s\n", __func__);
+	dprintk("%s\n", __func__);
 
 	switch (LDPC_Mode) {
 	case STV0900_DUAL:
 	default:
-		if ((i_params->demod_mode != STV0900_DUAL)
-			|| (stv0900_get_bits(i_params, F0900_DDEMOD) != 1)) {
-			stv0900_write_reg(i_params, R0900_GENCFG, 0x1d);
-
-			i_params->demod_mode = STV0900_DUAL;
-
-			stv0900_write_bits(i_params, F0900_FRESFEC, 1);
-			stv0900_write_bits(i_params, F0900_FRESFEC, 0);
+		if ((intp->demod_mode != STV0900_DUAL)
+			|| (stv0900_get_bits(intp, F0900_DDEMOD) != 1)) {
+			stv0900_write_reg(intp, R0900_GENCFG, 0x1d);
+
+			intp->demod_mode = STV0900_DUAL;
+
+			stv0900_write_bits(intp, F0900_FRESFEC, 1);
+			stv0900_write_bits(intp, F0900_FRESFEC, 0);
+
+			for (reg_ind = 0; reg_ind < 7; reg_ind++)
+				stv0900_write_reg(intp,
+						R0900_P1_MODCODLST0 + reg_ind,
+						0xff);
+			for (reg_ind = 0; reg_ind < 8; reg_ind++)
+				stv0900_write_reg(intp,
+						R0900_P1_MODCODLST7 + reg_ind,
+						0xcc);
+
+			stv0900_write_reg(intp, R0900_P1_MODCODLSTE, 0xff);
+			stv0900_write_reg(intp, R0900_P1_MODCODLSTF, 0xcf);
+
+			for (reg_ind = 0; reg_ind < 7; reg_ind++)
+				stv0900_write_reg(intp,
+						R0900_P2_MODCODLST0 + reg_ind,
+						0xff);
+			for (reg_ind = 0; reg_ind < 8; reg_ind++)
+				stv0900_write_reg(intp,
+						R0900_P2_MODCODLST7 + reg_ind,
+						0xcc);
+
+			stv0900_write_reg(intp, R0900_P2_MODCODLSTE, 0xff);
+			stv0900_write_reg(intp, R0900_P2_MODCODLSTF, 0xcf);
 		}
 
 		break;
 	case STV0900_SINGLE:
-		if (demod == STV0900_DEMOD_2)
-			stv0900_write_reg(i_params, R0900_GENCFG, 0x06);
-		else
-			stv0900_write_reg(i_params, R0900_GENCFG, 0x04);
+		if (demod == STV0900_DEMOD_2) {
+			stv0900_stop_all_s2_modcod(intp, STV0900_DEMOD_1);
+			stv0900_activate_s2_modcod_single(intp,
+							STV0900_DEMOD_2);
+			stv0900_write_reg(intp, R0900_GENCFG, 0x06);
+		} else {
+			stv0900_stop_all_s2_modcod(intp, STV0900_DEMOD_2);
+			stv0900_activate_s2_modcod_single(intp,
+							STV0900_DEMOD_1);
+			stv0900_write_reg(intp, R0900_GENCFG, 0x04);
+		}
 
-		i_params->demod_mode = STV0900_SINGLE;
+		intp->demod_mode = STV0900_SINGLE;
 
-		stv0900_write_bits(i_params, F0900_FRESFEC, 1);
-		stv0900_write_bits(i_params, F0900_FRESFEC, 0);
-		stv0900_write_bits(i_params, F0900_P1_ALGOSWRST, 1);
-		stv0900_write_bits(i_params, F0900_P1_ALGOSWRST, 0);
-		stv0900_write_bits(i_params, F0900_P2_ALGOSWRST, 1);
-		stv0900_write_bits(i_params, F0900_P2_ALGOSWRST, 0);
+		stv0900_write_bits(intp, F0900_FRESFEC, 1);
+		stv0900_write_bits(intp, F0900_FRESFEC, 0);
+		stv0900_write_bits(intp, F0900_P1_ALGOSWRST, 1);
+		stv0900_write_bits(intp, F0900_P1_ALGOSWRST, 0);
+		stv0900_write_bits(intp, F0900_P2_ALGOSWRST, 1);
+		stv0900_write_bits(intp, F0900_P2_ALGOSWRST, 0);
 		break;
 	}
 
@@ -1393,131 +1328,133 @@ static enum fe_stv0900_error stv0900_init_internal(struct dvb_frontend *fe,
 	struct stv0900_state *state = fe->demodulator_priv;
 	enum fe_stv0900_error error = STV0900_NO_ERROR;
 	enum fe_stv0900_error demodError = STV0900_NO_ERROR;
+	struct stv0900_internal *intp = NULL;
+
 	int selosci, i;
 
 	struct stv0900_inode *temp_int = find_inode(state->i2c_adap,
 						state->config->demod_address);
 
-	dprintk(KERN_INFO "%s\n", __func__);
+	dprintk("%s\n", __func__);
 
-	if (temp_int != NULL) {
+	if ((temp_int != NULL) && (p_init->demod_mode == STV0900_DUAL)) {
 		state->internal = temp_int->internal;
 		(state->internal->dmds_used)++;
-		dprintk(KERN_INFO "%s: Find Internal Structure!\n", __func__);
+		dprintk("%s: Find Internal Structure!\n", __func__);
 		return STV0900_NO_ERROR;
 	} else {
-		state->internal = kmalloc(sizeof(struct stv0900_internal), GFP_KERNEL);
+		state->internal = kmalloc(sizeof(struct stv0900_internal),
+								GFP_KERNEL);
 		temp_int = append_internal(state->internal);
 		state->internal->dmds_used = 1;
 		state->internal->i2c_adap = state->i2c_adap;
 		state->internal->i2c_addr = state->config->demod_address;
 		state->internal->clkmode = state->config->clkmode;
 		state->internal->errs = STV0900_NO_ERROR;
-		dprintk(KERN_INFO "%s: Create New Internal Structure!\n", __func__);
+		dprintk("%s: Create New Internal Structure!\n", __func__);
 	}
 
-	if (state->internal != NULL) {
-		demodError = stv0900_initialize(state->internal);
-		if (demodError == STV0900_NO_ERROR) {
-				error = STV0900_NO_ERROR;
-		} else {
-			if (demodError == STV0900_INVALID_HANDLE)
-				error = STV0900_INVALID_HANDLE;
-			else
-				error = STV0900_I2C_ERROR;
-		}
+	if (state->internal == NULL) {
+		error = STV0900_INVALID_HANDLE;
+		return error;
+	}
 
-		if (state->internal != NULL) {
-			if (error == STV0900_NO_ERROR) {
-				state->internal->demod_mode = p_init->demod_mode;
-
-				stv0900_st_dvbs2_single(state->internal, state->internal->demod_mode, STV0900_DEMOD_1);
-
-				state->internal->chip_id = stv0900_read_reg(state->internal, R0900_MID);
-				state->internal->rolloff = p_init->rolloff;
-				state->internal->quartz = p_init->dmd_ref_clk;
-
-				stv0900_write_bits(state->internal, F0900_P1_ROLLOFF_CONTROL, p_init->rolloff);
-				stv0900_write_bits(state->internal, F0900_P2_ROLLOFF_CONTROL, p_init->rolloff);
-
-				state->internal->ts_config = p_init->ts_config;
-				if (state->internal->ts_config == NULL)
-					stv0900_set_ts_parallel_serial(state->internal,
-							p_init->path1_ts_clock,
-							p_init->path2_ts_clock);
-				else {
-					for (i = 0; state->internal->ts_config[i].addr != 0xffff; i++)
-						stv0900_write_reg(state->internal,
-								state->internal->ts_config[i].addr,
-								state->internal->ts_config[i].val);
-
-					stv0900_write_bits(state->internal, F0900_P2_RST_HWARE, 1);
-					stv0900_write_bits(state->internal, F0900_P2_RST_HWARE, 0);
-					stv0900_write_bits(state->internal, F0900_P1_RST_HWARE, 1);
-					stv0900_write_bits(state->internal, F0900_P1_RST_HWARE, 0);
-				}
+	demodError = stv0900_initialize(state->internal);
+	if (demodError == STV0900_NO_ERROR) {
+			error = STV0900_NO_ERROR;
+	} else {
+		if (demodError == STV0900_INVALID_HANDLE)
+			error = STV0900_INVALID_HANDLE;
+		else
+			error = STV0900_I2C_ERROR;
 
-				stv0900_write_bits(state->internal, F0900_P1_TUN_MADDRESS, p_init->tun1_maddress);
-				switch (p_init->tuner1_adc) {
-				case 1:
-					stv0900_write_reg(state->internal, R0900_TSTTNR1, 0x26);
-					break;
-				default:
-					break;
-				}
+		return error;
+	}
 
-				stv0900_write_bits(state->internal, F0900_P2_TUN_MADDRESS, p_init->tun2_maddress);
-				switch (p_init->tuner2_adc) {
-				case 1:
-					stv0900_write_reg(state->internal, R0900_TSTTNR3, 0x26);
-					break;
-				default:
-					break;
-				}
+	if (state->internal == NULL) {
+		error = STV0900_INVALID_HANDLE;
+		return error;
+	}
 
-				stv0900_write_bits(state->internal, F0900_P1_TUN_IQSWAP, p_init->tun1_iq_inversion);
-				stv0900_write_bits(state->internal, F0900_P2_TUN_IQSWAP, p_init->tun2_iq_inversion);
-				stv0900_set_mclk(state->internal, 135000000);
-				msleep(3);
-
-				switch (state->internal->clkmode) {
-				case 0:
-				case 2:
-					stv0900_write_reg(state->internal, R0900_SYNTCTRL, 0x20 | state->internal->clkmode);
-					break;
-				default:
-					selosci = 0x02 & stv0900_read_reg(state->internal, R0900_SYNTCTRL);
-					stv0900_write_reg(state->internal, R0900_SYNTCTRL, 0x20 | selosci);
-					break;
-				}
-				msleep(3);
+	intp = state->internal;
 
-				state->internal->mclk = stv0900_get_mclk_freq(state->internal, state->internal->quartz);
-				if (state->internal->errs)
-					error = STV0900_I2C_ERROR;
-			}
-		} else {
-			error = STV0900_INVALID_HANDLE;
-		}
+	intp->demod_mode = p_init->demod_mode;
+	stv0900_st_dvbs2_single(intp, intp->demod_mode,	STV0900_DEMOD_1);
+	intp->chip_id = stv0900_read_reg(intp, R0900_MID);
+	intp->rolloff = p_init->rolloff;
+	intp->quartz = p_init->dmd_ref_clk;
+
+	stv0900_write_bits(intp, F0900_P1_ROLLOFF_CONTROL, p_init->rolloff);
+	stv0900_write_bits(intp, F0900_P2_ROLLOFF_CONTROL, p_init->rolloff);
+
+	intp->ts_config = p_init->ts_config;
+	if (intp->ts_config == NULL)
+		stv0900_set_ts_parallel_serial(intp,
+				p_init->path1_ts_clock,
+				p_init->path2_ts_clock);
+	else {
+		for (i = 0; intp->ts_config[i].addr != 0xffff; i++)
+			stv0900_write_reg(intp,
+					intp->ts_config[i].addr,
+					intp->ts_config[i].val);
+
+		stv0900_write_bits(intp, F0900_P2_RST_HWARE, 1);
+		stv0900_write_bits(intp, F0900_P2_RST_HWARE, 0);
+		stv0900_write_bits(intp, F0900_P1_RST_HWARE, 1);
+		stv0900_write_bits(intp, F0900_P1_RST_HWARE, 0);
 	}
 
+	stv0900_write_bits(intp, F0900_P1_TUN_MADDRESS, p_init->tun1_maddress);
+	switch (p_init->tuner1_adc) {
+	case 1:
+		stv0900_write_reg(intp, R0900_TSTTNR1, 0x26);
+		break;
+	default:
+		break;
+	}
+
+	stv0900_write_bits(intp, F0900_P2_TUN_MADDRESS, p_init->tun2_maddress);
+	switch (p_init->tuner2_adc) {
+	case 1:
+		stv0900_write_reg(intp, R0900_TSTTNR3, 0x26);
+		break;
+	default:
+		break;
+	}
+
+	stv0900_write_bits(intp, F0900_P1_TUN_IQSWAP, p_init->tun1_iq_inv);
+	stv0900_write_bits(intp, F0900_P2_TUN_IQSWAP, p_init->tun2_iq_inv);
+	stv0900_set_mclk(intp, 135000000);
+	msleep(3);
+
+	switch (intp->clkmode) {
+	case 0:
+	case 2:
+		stv0900_write_reg(intp, R0900_SYNTCTRL, 0x20 | intp->clkmode);
+		break;
+	default:
+		selosci = 0x02 & stv0900_read_reg(intp, R0900_SYNTCTRL);
+		stv0900_write_reg(intp, R0900_SYNTCTRL, 0x20 | selosci);
+		break;
+	}
+	msleep(3);
+
+	intp->mclk = stv0900_get_mclk_freq(intp, intp->quartz);
+	if (intp->errs)
+		error = STV0900_I2C_ERROR;
+
 	return error;
 }
 
-static int stv0900_status(struct stv0900_internal *i_params,
+static int stv0900_status(struct stv0900_internal *intp,
 					enum fe_stv0900_demod_num demod)
 {
 	enum fe_stv0900_search_state demod_state;
-	s32 mode_field, delin_field, lock_field, fifo_field, lockedvit_field;
 	int locked = FALSE;
+	u8 tsbitrate0_val, tsbitrate1_val;
+	s32 bitrate;
 
-	dmd_reg(mode_field, F0900_P1_HEADER_MODE, F0900_P2_HEADER_MODE);
-	dmd_reg(lock_field, F0900_P1_LOCK_DEFINITIF, F0900_P2_LOCK_DEFINITIF);
-	dmd_reg(delin_field, F0900_P1_PKTDELIN_LOCK, F0900_P2_PKTDELIN_LOCK);
-	dmd_reg(fifo_field, F0900_P1_TSFIFO_LINEOK, F0900_P2_TSFIFO_LINEOK);
-	dmd_reg(lockedvit_field, F0900_P1_LOCKEDVIT, F0900_P2_LOCKEDVIT);
-
-	demod_state = stv0900_get_bits(i_params, mode_field);
+	demod_state = stv0900_get_bits(intp, HEADER_MODE);
 	switch (demod_state) {
 	case STV0900_SEARCH:
 	case STV0900_PLH_DETECTED:
@@ -1525,17 +1462,30 @@ static int stv0900_status(struct stv0900_internal *i_params,
 		locked = FALSE;
 		break;
 	case STV0900_DVBS2_FOUND:
-		locked = stv0900_get_bits(i_params, lock_field) &&
-				stv0900_get_bits(i_params, delin_field) &&
-				stv0900_get_bits(i_params, fifo_field);
+		locked = stv0900_get_bits(intp, LOCK_DEFINITIF) &&
+				stv0900_get_bits(intp, PKTDELIN_LOCK) &&
+				stv0900_get_bits(intp, TSFIFO_LINEOK);
 		break;
 	case STV0900_DVBS_FOUND:
-		locked = stv0900_get_bits(i_params, lock_field) &&
-				stv0900_get_bits(i_params, lockedvit_field) &&
-				stv0900_get_bits(i_params, fifo_field);
+		locked = stv0900_get_bits(intp, LOCK_DEFINITIF) &&
+				stv0900_get_bits(intp, LOCKEDVIT) &&
+				stv0900_get_bits(intp, TSFIFO_LINEOK);
 		break;
 	}
 
+	dprintk("%s: locked = %d\n", __func__, locked);
+
+	if (stvdebug) {
+		/* Print TS bitrate */
+		tsbitrate0_val = stv0900_read_reg(intp, TSBITRATE0);
+		tsbitrate1_val = stv0900_read_reg(intp, TSBITRATE1);
+		/* Formula Bit rate = Mclk * px_tsfifo_bitrate / 16384 */
+		bitrate = (stv0900_get_mclk_freq(intp, intp->quartz)/1000000)
+			* (tsbitrate1_val << 8 | tsbitrate0_val);
+		bitrate /= 16384;
+		dprintk("TS bitrate = %d Mbit/sec \n", bitrate);
+	};
+
 	return locked;
 }
 
@@ -1543,7 +1493,8 @@ static enum dvbfe_search stv0900_search(struct dvb_frontend *fe,
 					struct dvb_frontend_parameters *params)
 {
 	struct stv0900_state *state = fe->demodulator_priv;
-	struct stv0900_internal *i_params = state->internal;
+	struct stv0900_internal *intp = state->internal;
+	enum fe_stv0900_demod_num demod = state->demod;
 	struct dtv_frontend_properties *c = &fe->dtv_property_cache;
 
 	struct stv0900_search_params p_search;
@@ -1551,10 +1502,16 @@ static enum dvbfe_search stv0900_search(struct dvb_frontend *fe,
 
 	enum fe_stv0900_error error = STV0900_NO_ERROR;
 
-	dprintk(KERN_INFO "%s: ", __func__);
+	dprintk("%s: ", __func__);
+
+	if (!(INRANGE(100000, c->symbol_rate, 70000000)))
+		return DVBFE_ALGO_SEARCH_FAILED;
+
+	if (state->config->set_ts_params)
+		state->config->set_ts_params(fe, 0);
 
 	p_result.locked = FALSE;
-	p_search.path = state->demod;
+	p_search.path = demod;
 	p_search.frequency = c->frequency;
 	p_search.symbol_rate = c->symbol_rate;
 	p_search.search_range = 10000000;
@@ -1563,103 +1520,47 @@ static enum dvbfe_search stv0900_search(struct dvb_frontend *fe,
 	p_search.iq_inversion = STV0900_IQ_AUTO;
 	p_search.search_algo = STV0900_BLIND_SEARCH;
 
-	if ((INRANGE(100000, p_search.symbol_rate, 70000000)) &&
-			(INRANGE(100000, p_search.search_range, 50000000))) {
-		switch (p_search.path) {
-		case STV0900_DEMOD_1:
-		default:
-			i_params->dmd1_srch_standard = p_search.standard;
-			i_params->dmd1_symbol_rate = p_search.symbol_rate;
-			i_params->dmd1_srch_range = p_search.search_range;
-			i_params->tuner1_freq = p_search.frequency;
-			i_params->dmd1_srch_algo = p_search.search_algo;
-			i_params->dmd1_srch_iq_inv = p_search.iq_inversion;
-			i_params->dmd1_fec = p_search.fec;
+	intp->srch_standard[demod] = p_search.standard;
+	intp->symbol_rate[demod] = p_search.symbol_rate;
+	intp->srch_range[demod] = p_search.search_range;
+	intp->freq[demod] = p_search.frequency;
+	intp->srch_algo[demod] = p_search.search_algo;
+	intp->srch_iq_inv[demod] = p_search.iq_inversion;
+	intp->fec[demod] = p_search.fec;
+	if ((stv0900_algo(fe) == STV0900_RANGEOK) &&
+				(intp->errs == STV0900_NO_ERROR)) {
+		p_result.locked = intp->result[demod].locked;
+		p_result.standard = intp->result[demod].standard;
+		p_result.frequency = intp->result[demod].frequency;
+		p_result.symbol_rate = intp->result[demod].symbol_rate;
+		p_result.fec = intp->result[demod].fec;
+		p_result.modcode = intp->result[demod].modcode;
+		p_result.pilot = intp->result[demod].pilot;
+		p_result.frame_len = intp->result[demod].frame_len;
+		p_result.spectrum = intp->result[demod].spectrum;
+		p_result.rolloff = intp->result[demod].rolloff;
+		p_result.modulation = intp->result[demod].modulation;
+	} else {
+		p_result.locked = FALSE;
+		switch (intp->err[demod]) {
+		case STV0900_I2C_ERROR:
+			error = STV0900_I2C_ERROR;
 			break;
-
-		case STV0900_DEMOD_2:
-			i_params->dmd2_srch_stndrd = p_search.standard;
-			i_params->dmd2_symbol_rate = p_search.symbol_rate;
-			i_params->dmd2_srch_range = p_search.search_range;
-			i_params->tuner2_freq = p_search.frequency;
-			i_params->dmd2_srch_algo = p_search.search_algo;
-			i_params->dmd2_srch_iq_inv = p_search.iq_inversion;
-			i_params->dmd2_fec = p_search.fec;
+		case STV0900_NO_ERROR:
+		default:
+			error = STV0900_SEARCH_FAILED;
 			break;
 		}
-
-		if ((stv0900_algo(fe) == STV0900_RANGEOK) &&
-					(i_params->errs == STV0900_NO_ERROR)) {
-			switch (p_search.path) {
-			case STV0900_DEMOD_1:
-			default:
-				p_result.locked = i_params->dmd1_rslts.locked;
-				p_result.standard = i_params->dmd1_rslts.standard;
-				p_result.frequency = i_params->dmd1_rslts.frequency;
-				p_result.symbol_rate = i_params->dmd1_rslts.symbol_rate;
-				p_result.fec = i_params->dmd1_rslts.fec;
-				p_result.modcode = i_params->dmd1_rslts.modcode;
-				p_result.pilot = i_params->dmd1_rslts.pilot;
-				p_result.frame_length = i_params->dmd1_rslts.frame_length;
-				p_result.spectrum = i_params->dmd1_rslts.spectrum;
-				p_result.rolloff = i_params->dmd1_rslts.rolloff;
-				p_result.modulation = i_params->dmd1_rslts.modulation;
-				break;
-			case STV0900_DEMOD_2:
-				p_result.locked = i_params->dmd2_rslts.locked;
-				p_result.standard = i_params->dmd2_rslts.standard;
-				p_result.frequency = i_params->dmd2_rslts.frequency;
-				p_result.symbol_rate = i_params->dmd2_rslts.symbol_rate;
-				p_result.fec = i_params->dmd2_rslts.fec;
-				p_result.modcode = i_params->dmd2_rslts.modcode;
-				p_result.pilot = i_params->dmd2_rslts.pilot;
-				p_result.frame_length = i_params->dmd2_rslts.frame_length;
-				p_result.spectrum = i_params->dmd2_rslts.spectrum;
-				p_result.rolloff = i_params->dmd2_rslts.rolloff;
-				p_result.modulation = i_params->dmd2_rslts.modulation;
-				break;
-			}
-
-		} else {
-			p_result.locked = FALSE;
-			switch (p_search.path) {
-			case STV0900_DEMOD_1:
-				switch (i_params->dmd1_err) {
-				case STV0900_I2C_ERROR:
-					error = STV0900_I2C_ERROR;
-					break;
-				case STV0900_NO_ERROR:
-				default:
-					error = STV0900_SEARCH_FAILED;
-					break;
-				}
-				break;
-			case STV0900_DEMOD_2:
-				switch (i_params->dmd2_err) {
-				case STV0900_I2C_ERROR:
-					error = STV0900_I2C_ERROR;
-					break;
-				case STV0900_NO_ERROR:
-				default:
-					error = STV0900_SEARCH_FAILED;
-					break;
-				}
-				break;
-			}
-		}
-
-	} else
-		error = STV0900_BAD_PARAMETER;
+	}
 
 	if ((p_result.locked == TRUE) && (error == STV0900_NO_ERROR)) {
-		dprintk(KERN_INFO "Search Success\n");
+		dprintk("Search Success\n");
 		return DVBFE_ALGO_SEARCH_SUCCESS;
 	} else {
-		dprintk(KERN_INFO "Search Fail\n");
+		dprintk("Search Fail\n");
 		return DVBFE_ALGO_SEARCH_FAILED;
 	}
 
-	return DVBFE_ALGO_SEARCH_ERROR;
 }
 
 static int stv0900_read_status(struct dvb_frontend *fe, enum fe_status *status)
@@ -1690,16 +1591,13 @@ static int stv0900_stop_ts(struct dvb_frontend *fe, int stop_ts)
 {
 
 	struct stv0900_state *state = fe->demodulator_priv;
-	struct stv0900_internal *i_params = state->internal;
+	struct stv0900_internal *intp = state->internal;
 	enum fe_stv0900_demod_num demod = state->demod;
-	s32 rst_field;
-
-	dmd_reg(rst_field, F0900_P1_RST_HWARE, F0900_P2_RST_HWARE);
 
 	if (stop_ts == TRUE)
-		stv0900_write_bits(i_params, rst_field, 1);
+		stv0900_write_bits(intp, RST_HWARE, 1);
 	else
-		stv0900_write_bits(i_params, rst_field, 0);
+		stv0900_write_bits(intp, RST_HWARE, 0);
 
 	return 0;
 }
@@ -1707,23 +1605,19 @@ static int stv0900_stop_ts(struct dvb_frontend *fe, int stop_ts)
 static int stv0900_diseqc_init(struct dvb_frontend *fe)
 {
 	struct stv0900_state *state = fe->demodulator_priv;
-	struct stv0900_internal *i_params = state->internal;
+	struct stv0900_internal *intp = state->internal;
 	enum fe_stv0900_demod_num demod = state->demod;
-	s32 mode_field, reset_field;
 
-	dmd_reg(mode_field, F0900_P1_DISTX_MODE, F0900_P2_DISTX_MODE);
-	dmd_reg(reset_field, F0900_P1_DISEQC_RESET, F0900_P2_DISEQC_RESET);
-
-	stv0900_write_bits(i_params, mode_field, state->config->diseqc_mode);
-	stv0900_write_bits(i_params, reset_field, 1);
-	stv0900_write_bits(i_params, reset_field, 0);
+	stv0900_write_bits(intp, DISTX_MODE, state->config->diseqc_mode);
+	stv0900_write_bits(intp, DISEQC_RESET, 1);
+	stv0900_write_bits(intp, DISEQC_RESET, 0);
 
 	return 0;
 }
 
 static int stv0900_init(struct dvb_frontend *fe)
 {
-	dprintk(KERN_INFO "%s\n", __func__);
+	dprintk("%s\n", __func__);
 
 	stv0900_stop_ts(fe, 1);
 	stv0900_diseqc_init(fe);
@@ -1731,48 +1625,24 @@ static int stv0900_init(struct dvb_frontend *fe)
 	return 0;
 }
 
-static int stv0900_diseqc_send(struct stv0900_internal *i_params , u8 *Data,
+static int stv0900_diseqc_send(struct stv0900_internal *intp , u8 *data,
 				u32 NbData, enum fe_stv0900_demod_num demod)
 {
 	s32 i = 0;
 
-	switch (demod) {
-	case STV0900_DEMOD_1:
-	default:
-		stv0900_write_bits(i_params, F0900_P1_DIS_PRECHARGE, 1);
-		while (i < NbData) {
-			while (stv0900_get_bits(i_params, F0900_P1_FIFO_FULL))
-				;/* checkpatch complains */
-			stv0900_write_reg(i_params, R0900_P1_DISTXDATA, Data[i]);
-			i++;
-		}
-
-		stv0900_write_bits(i_params, F0900_P1_DIS_PRECHARGE, 0);
-		i = 0;
-		while ((stv0900_get_bits(i_params, F0900_P1_TX_IDLE) != 1) && (i < 10)) {
-			msleep(10);
-			i++;
-		}
-
-		break;
-	case STV0900_DEMOD_2:
-		stv0900_write_bits(i_params, F0900_P2_DIS_PRECHARGE, 1);
-
-		while (i < NbData) {
-			while (stv0900_get_bits(i_params, F0900_P2_FIFO_FULL))
-				;/* checkpatch complains */
-			stv0900_write_reg(i_params, R0900_P2_DISTXDATA, Data[i]);
-			i++;
-		}
-
-		stv0900_write_bits(i_params, F0900_P2_DIS_PRECHARGE, 0);
-		i = 0;
-		while ((stv0900_get_bits(i_params, F0900_P2_TX_IDLE) != 1) && (i < 10)) {
-			msleep(10);
-			i++;
-		}
+	stv0900_write_bits(intp, DIS_PRECHARGE, 1);
+	while (i < NbData) {
+		while (stv0900_get_bits(intp, FIFO_FULL))
+			;/* checkpatch complains */
+		stv0900_write_reg(intp, DISTXDATA, data[i]);
+		i++;
+	}
 
-		break;
+	stv0900_write_bits(intp, DIS_PRECHARGE, 0);
+	i = 0;
+	while ((stv0900_get_bits(intp, TX_IDLE) != 1) && (i < 10)) {
+		msleep(10);
+		i++;
 	}
 
 	return 0;
@@ -1792,22 +1662,21 @@ static int stv0900_send_master_cmd(struct dvb_frontend *fe,
 static int stv0900_send_burst(struct dvb_frontend *fe, fe_sec_mini_cmd_t burst)
 {
 	struct stv0900_state *state = fe->demodulator_priv;
-	struct stv0900_internal *i_params = state->internal;
+	struct stv0900_internal *intp = state->internal;
 	enum fe_stv0900_demod_num demod = state->demod;
-	s32 mode_field;
-	u32 diseqc_fifo;
+	u8 data;
 
-	dmd_reg(mode_field, F0900_P1_DISTX_MODE, F0900_P2_DISTX_MODE);
-	dmd_reg(diseqc_fifo, R0900_P1_DISTXDATA, R0900_P2_DISTXDATA);
 
 	switch (burst) {
 	case SEC_MINI_A:
-		stv0900_write_bits(i_params, mode_field, 3);/* Unmodulated */
-		stv0900_write_reg(i_params, diseqc_fifo, 0x00);
+		stv0900_write_bits(intp, DISTX_MODE, 3);/* Unmodulated */
+		data = 0x00;
+		stv0900_diseqc_send(intp, &data, 1, state->demod);
 		break;
 	case SEC_MINI_B:
-		stv0900_write_bits(i_params, mode_field, 2);/* Modulated */
-		stv0900_write_reg(i_params, diseqc_fifo, 0xff);
+		stv0900_write_bits(intp, DISTX_MODE, 2);/* Modulated */
+		data = 0xff;
+		stv0900_diseqc_send(intp, &data, 1, state->demod);
 		break;
 	}
 
@@ -1818,68 +1687,54 @@ static int stv0900_recv_slave_reply(struct dvb_frontend *fe,
 				struct dvb_diseqc_slave_reply *reply)
 {
 	struct stv0900_state *state = fe->demodulator_priv;
-	struct stv0900_internal *i_params = state->internal;
+	struct stv0900_internal *intp = state->internal;
+	enum fe_stv0900_demod_num demod = state->demod;
 	s32 i = 0;
 
-	switch (state->demod) {
-	case STV0900_DEMOD_1:
-	default:
-		reply->msg_len = 0;
-
-		while ((stv0900_get_bits(i_params, F0900_P1_RX_END) != 1) && (i < 10)) {
-			msleep(10);
-			i++;
-		}
-
-		if (stv0900_get_bits(i_params, F0900_P1_RX_END)) {
-			reply->msg_len = stv0900_get_bits(i_params, F0900_P1_FIFO_BYTENBR);
-
-			for (i = 0; i < reply->msg_len; i++)
-				reply->msg[i] = stv0900_read_reg(i_params, R0900_P1_DISRXDATA);
-		}
-		break;
-	case STV0900_DEMOD_2:
-		reply->msg_len = 0;
+	reply->msg_len = 0;
 
-		while ((stv0900_get_bits(i_params, F0900_P2_RX_END) != 1) && (i < 10)) {
-			msleep(10);
-			i++;
-		}
+	while ((stv0900_get_bits(intp, RX_END) != 1) && (i < 10)) {
+		msleep(10);
+		i++;
+	}
 
-		if (stv0900_get_bits(i_params, F0900_P2_RX_END)) {
-			reply->msg_len = stv0900_get_bits(i_params, F0900_P2_FIFO_BYTENBR);
+	if (stv0900_get_bits(intp, RX_END)) {
+		reply->msg_len = stv0900_get_bits(intp, FIFO_BYTENBR);
 
-			for (i = 0; i < reply->msg_len; i++)
-				reply->msg[i] = stv0900_read_reg(i_params, R0900_P2_DISRXDATA);
-		}
-		break;
+		for (i = 0; i < reply->msg_len; i++)
+			reply->msg[i] = stv0900_read_reg(intp, DISRXDATA);
 	}
 
 	return 0;
 }
 
-static int stv0900_set_tone(struct dvb_frontend *fe, fe_sec_tone_mode_t tone)
+static int stv0900_set_tone(struct dvb_frontend *fe, fe_sec_tone_mode_t toneoff)
 {
 	struct stv0900_state *state = fe->demodulator_priv;
-	struct stv0900_internal *i_params = state->internal;
+	struct stv0900_internal *intp = state->internal;
 	enum fe_stv0900_demod_num demod = state->demod;
-	s32 mode_field, reset_field;
-
-	dprintk(KERN_INFO "%s: %s\n", __func__, ((tone == 0) ? "Off" : "On"));
 
-	dmd_reg(mode_field, F0900_P1_DISTX_MODE, F0900_P2_DISTX_MODE);
-	dmd_reg(reset_field, F0900_P1_DISEQC_RESET, F0900_P2_DISEQC_RESET);
+	dprintk("%s: %s\n", __func__, ((toneoff == 0) ? "On" : "Off"));
 
-	if (tone) {
-		/*Set the DiseqC mode to 22Khz continues tone*/
-		stv0900_write_bits(i_params, mode_field, 0);
-		stv0900_write_bits(i_params, reset_field, 1);
+	switch (toneoff) {
+	case SEC_TONE_ON:
+		/*Set the DiseqC mode to 22Khz _continues_ tone*/
+		stv0900_write_bits(intp, DISTX_MODE, 0);
+		stv0900_write_bits(intp, DISEQC_RESET, 1);
 		/*release DiseqC reset to enable the 22KHz tone*/
-		stv0900_write_bits(i_params, reset_field, 0);
-	} else {
-		stv0900_write_bits(i_params, mode_field, 0);
+		stv0900_write_bits(intp, DISEQC_RESET, 0);
+		break;
+	case SEC_TONE_OFF:
+		/*return diseqc mode to config->diseqc_mode.
+		Usually it's without _continues_ tone */
+		stv0900_write_bits(intp, DISTX_MODE,
+				state->config->diseqc_mode);
 		/*maintain the DiseqC reset to disable the 22KHz tone*/
-		stv0900_write_bits(i_params, reset_field, 1);
+		stv0900_write_bits(intp, DISEQC_RESET, 1);
+		stv0900_write_bits(intp, DISEQC_RESET, 0);
+		break;
+	default:
+		return -EINVAL;
 	}
 
 	return 0;
@@ -1889,11 +1744,11 @@ static void stv0900_release(struct dvb_frontend *fe)
 {
 	struct stv0900_state *state = fe->demodulator_priv;
 
-	dprintk(KERN_INFO "%s\n", __func__);
+	dprintk("%s\n", __func__);
 
 	if ((--(state->internal->dmds_used)) <= 0) {
 
-		dprintk(KERN_INFO "%s: Actually removing\n", __func__);
+		dprintk("%s: Actually removing\n", __func__);
 
 		remove_inode(state->internal);
 		kfree(state->internal);
@@ -1963,17 +1818,17 @@ struct dvb_frontend *stv0900_attach(const struct stv0900_config *config,
 	case 0:
 	case 1:
 		init_params.dmd_ref_clk  	= config->xtal;
-		init_params.demod_mode		= STV0900_DUAL;
+		init_params.demod_mode		= config->demod_mode;
 		init_params.rolloff		= STV0900_35;
 		init_params.path1_ts_clock	= config->path1_mode;
 		init_params.tun1_maddress	= config->tun1_maddress;
-		init_params.tun1_iq_inversion	= STV0900_IQ_NORMAL;
+		init_params.tun1_iq_inv		= STV0900_IQ_NORMAL;
 		init_params.tuner1_adc		= config->tun1_adc;
 		init_params.path2_ts_clock	= config->path2_mode;
 		init_params.ts_config		= config->ts_config_regs;
 		init_params.tun2_maddress	= config->tun2_maddress;
 		init_params.tuner2_adc		= config->tun2_adc;
-		init_params.tun2_iq_inversion	= STV0900_IQ_SWAPPED;
+		init_params.tun2_iq_inv		= STV0900_IQ_SWAPPED;
 
 		err_stv0900 = stv0900_init_internal(&state->frontend,
 							&init_params);
diff --git a/drivers/media/dvb/frontends/stv0900_init.h b/drivers/media/dvb/frontends/stv0900_init.h
index ff388b47a4e3..b684df9995d8 100644
--- a/drivers/media/dvb/frontends/stv0900_init.h
+++ b/drivers/media/dvb/frontends/stv0900_init.h
@@ -141,85 +141,228 @@ struct stv0900_short_frames_car_loop_optim {
 
 };
 
+struct stv0900_short_frames_car_loop_optim_vs_mod {
+	enum fe_stv0900_modulation modulation;
+	u8 car_loop_2;	  /* SR<3msps      */
+	u8 car_loop_5;	  /* 3<SR<=7msps   */
+	u8 car_loop_10;   /* 7<SR<=15msps  */
+	u8 car_loop_20;   /* 10<SR<=25msps */
+	u8 car_loop_30;   /* 10<SR<=45msps */
+};
+
 /* Cut 1.x Tracking carrier loop carrier QPSK 1/2 to 8PSK 9/10 long Frame */
-static const struct stv0900_car_loop_optim	FE_STV0900_S2CarLoop[14] = {
-	/*Modcod		2MPon 	2MPoff	5MPon 	5MPoff	10MPon 	10MPoff	20MPon 	20MPoff	30MPon 	30MPoff */
-	{ STV0900_QPSK_12,	0x1C,	0x0D,	0x1B,	0x2C,	0x3A,	0x1C,	0x2A,	0x3B,	0x2A,	0x1B },
-	{ STV0900_QPSK_35,	0x2C,	0x0D,	0x2B,	0x2C,	0x3A,	0x0C,	0x3A,	0x2B,	0x2A,	0x0B },
-	{ STV0900_QPSK_23,	0x2C,	0x0D,	0x2B,	0x2C,	0x0B,	0x0C,	0x3A,	0x1B,	0x2A,	0x3A },
-	{ STV0900_QPSK_34,	0x3C,	0x0D,	0x3B,	0x1C,	0x0B,	0x3B,	0x3A,	0x0B,	0x2A,	0x3A },
-	{ STV0900_QPSK_45,	0x3C,	0x0D,	0x3B,	0x1C,	0x0B,	0x3B,	0x3A,	0x0B,	0x2A,	0x3A },
-	{ STV0900_QPSK_56,	0x0D,	0x0D,	0x3B,	0x1C,	0x0B,	0x3B,	0x3A,	0x0B,	0x2A,	0x3A },
-	{ STV0900_QPSK_89,	0x0D,	0x0D,	0x3B,	0x1C,	0x1B,	0x3B,	0x3A,	0x0B,	0x2A,	0x3A },
-	{ STV0900_QPSK_910,	0x1D,	0x0D,	0x3B,	0x1C,	0x1B,	0x3B,	0x3A,	0x0B,	0x2A,	0x3A },
-	{ STV0900_8PSK_35,	0x29,	0x3B,	0x09,	0x2B,	0x38,	0x0B,	0x18,	0x1A,	0x08,	0x0A },
-	{ STV0900_8PSK_23,	0x0A,	0x3B,	0x29,	0x2B,	0x19,	0x0B,	0x38,	0x1A,	0x18,	0x0A },
-	{ STV0900_8PSK_34,	0x3A,	0x3B,	0x2A,	0x2B,	0x39,	0x0B,	0x19,	0x1A,	0x38,	0x0A },
-	{ STV0900_8PSK_56,	0x1B,	0x3B,	0x0B,	0x2B,	0x1A,	0x0B,	0x39,	0x1A,	0x19,	0x0A },
-	{ STV0900_8PSK_89,	0x3B,	0x3B,	0x0B,	0x2B,	0x2A,	0x0B,	0x39,	0x1A,	0x29,	0x39 },
-	{ STV0900_8PSK_910,	0x3B,	0x3B, 	0x0B,	0x2B, 	0x2A,	0x0B,	0x39,	0x1A,	0x29,	0x39 }
+static const struct stv0900_car_loop_optim FE_STV0900_S2CarLoop[14] = {
+	/*Modcod		2MPon 	2MPoff	5MPon 	5MPoff	10MPon
+				10MPoff	20MPon 	20MPoff	30MPon 	30MPoff */
+	{ STV0900_QPSK_12,	0x1C,	0x0D,	0x1B,	0x2C,	0x3A,
+				0x1C,	0x2A,	0x3B,	0x2A,	0x1B },
+	{ STV0900_QPSK_35,	0x2C,	0x0D,	0x2B,	0x2C,	0x3A,
+				0x0C,	0x3A,	0x2B,	0x2A,	0x0B },
+	{ STV0900_QPSK_23,	0x2C,	0x0D,	0x2B,	0x2C,	0x0B,
+				0x0C,	0x3A,	0x1B,	0x2A,	0x3A },
+	{ STV0900_QPSK_34,	0x3C,	0x0D,	0x3B,	0x1C,	0x0B,
+				0x3B,	0x3A,	0x0B,	0x2A,	0x3A },
+	{ STV0900_QPSK_45,	0x3C,	0x0D,	0x3B,	0x1C,	0x0B,
+				0x3B,	0x3A,	0x0B,	0x2A,	0x3A },
+	{ STV0900_QPSK_56,	0x0D,	0x0D,	0x3B,	0x1C,	0x0B,
+				0x3B,	0x3A,	0x0B,	0x2A,	0x3A },
+	{ STV0900_QPSK_89,	0x0D,	0x0D,	0x3B,	0x1C,	0x1B,
+				0x3B,	0x3A,	0x0B,	0x2A,	0x3A },
+	{ STV0900_QPSK_910,	0x1D,	0x0D,	0x3B,	0x1C,	0x1B,
+				0x3B,	0x3A,	0x0B,	0x2A,	0x3A },
+	{ STV0900_8PSK_35,	0x29,	0x3B,	0x09,	0x2B,	0x38,
+				0x0B,	0x18,	0x1A,	0x08,	0x0A },
+	{ STV0900_8PSK_23,	0x0A,	0x3B,	0x29,	0x2B,	0x19,
+				0x0B,	0x38,	0x1A,	0x18,	0x0A },
+	{ STV0900_8PSK_34,	0x3A,	0x3B,	0x2A,	0x2B,	0x39,
+				0x0B,	0x19,	0x1A,	0x38,	0x0A },
+	{ STV0900_8PSK_56,	0x1B,	0x3B,	0x0B,	0x2B,	0x1A,
+				0x0B,	0x39,	0x1A,	0x19,	0x0A },
+	{ STV0900_8PSK_89,	0x3B,	0x3B,	0x0B,	0x2B,	0x2A,
+				0x0B,	0x39,	0x1A,	0x29,	0x39 },
+	{ STV0900_8PSK_910,	0x3B,	0x3B, 	0x0B,	0x2B, 	0x2A,
+				0x0B,	0x39,	0x1A,	0x29,	0x39 }
 };
 
 
 /* Cut 2.0 Tracking carrier loop carrier QPSK 1/2 to 8PSK 9/10 long Frame */
-static const struct stv0900_car_loop_optim	FE_STV0900_S2CarLoopCut20[14]	= {
-	/* Modcod		2MPon 	2MPoff	5MPon 	5MPoff	10MPon 	10MPoff	20MPon 	20MPoff	30MPon 	30MPoff */
-	{ STV0900_QPSK_12,	0x1F,	0x3F,	0x1E,	0x3F,	0x3D,	0x1F,	0x3D,	0x3E,	0x3D,	0x1E },
-	{ STV0900_QPSK_35,	0x2F,	0x3F,	0x2E,	0x2F,	0x3D,	0x0F,	0x0E,	0x2E,	0x3D,	0x0E },
-	{ STV0900_QPSK_23,	0x2F,	0x3F,	0x2E,	0x2F,	0x0E,	0x0F,	0x0E,	0x1E,	0x3D,	0x3D },
-	{ STV0900_QPSK_34,	0x3F,	0x3F,	0x3E,	0x1F,	0x0E,	0x3E,	0x0E,	0x1E,	0x3D,	0x3D },
-	{ STV0900_QPSK_45,	0x3F,	0x3F,	0x3E,	0x1F,	0x0E,	0x3E,	0x0E,	0x1E,	0x3D,	0x3D },
-	{ STV0900_QPSK_56,	0x3F,	0x3F,	0x3E,	0x1F,	0x0E,	0x3E,	0x0E,	0x1E,	0x3D,	0x3D },
-	{ STV0900_QPSK_89,	0x3F,	0x3F,	0x3E,	0x1F,	0x1E,	0x3E,	0x0E,	0x1E,	0x3D,	0x3D },
-	{ STV0900_QPSK_910,	0x3F,	0x3F,	0x3E,	0x1F,	0x1E,	0x3E,	0x0E,	0x1E,	0x3D,	0x3D },
-	{ STV0900_8PSK_35,	0x3c,	0x0c,	0x1c,	0x3b,	0x0c,	0x3b,	0x2b,	0x2b,	0x1b,	0x2b },
-	{ STV0900_8PSK_23,	0x1d,	0x0c,	0x3c,	0x0c,	0x2c,	0x3b,	0x0c,	0x2b,	0x2b,	0x2b },
-	{ STV0900_8PSK_34,	0x0e,	0x1c,	0x3d,	0x0c,	0x0d,	0x3b,	0x2c,	0x3b,	0x0c,	0x2b },
-	{ STV0900_8PSK_56,	0x2e,	0x3e,	0x1e,	0x2e,	0x2d,	0x1e,	0x3c,	0x2d,	0x2c,	0x1d },
-	{ STV0900_8PSK_89,	0x3e,	0x3e,	0x1e,	0x2e,	0x3d,	0x1e,	0x0d,	0x2d,	0x3c,	0x1d },
-	{ STV0900_8PSK_910,	0x3e,	0x3e, 	0x1e,	0x2e, 	0x3d,	0x1e,	0x1d,	0x2d,	0x0d,	0x1d }
+static const struct stv0900_car_loop_optim FE_STV0900_S2CarLoopCut20[14] = {
+	/* Modcod		2MPon 	2MPoff	5MPon 	5MPoff	10MPon
+				10MPoff	20MPon 	20MPoff	30MPon 	30MPoff */
+	{ STV0900_QPSK_12,	0x1F,	0x3F,	0x1E,	0x3F,	0x3D,
+				0x1F,	0x3D,	0x3E,	0x3D,	0x1E },
+	{ STV0900_QPSK_35,	0x2F,	0x3F,	0x2E,	0x2F,	0x3D,
+				0x0F,	0x0E,	0x2E,	0x3D,	0x0E },
+	{ STV0900_QPSK_23,	0x2F,	0x3F,	0x2E,	0x2F,	0x0E,
+				0x0F,	0x0E,	0x1E,	0x3D,	0x3D },
+	{ STV0900_QPSK_34,	0x3F,	0x3F,	0x3E,	0x1F,	0x0E,
+				0x3E,	0x0E,	0x1E,	0x3D,	0x3D },
+	{ STV0900_QPSK_45,	0x3F,	0x3F,	0x3E,	0x1F,	0x0E,
+				0x3E,	0x0E,	0x1E,	0x3D,	0x3D },
+	{ STV0900_QPSK_56,	0x3F,	0x3F,	0x3E,	0x1F,	0x0E,
+				0x3E,	0x0E,	0x1E,	0x3D,	0x3D },
+	{ STV0900_QPSK_89,	0x3F,	0x3F,	0x3E,	0x1F,	0x1E,
+				0x3E,	0x0E,	0x1E,	0x3D,	0x3D },
+	{ STV0900_QPSK_910,	0x3F,	0x3F,	0x3E,	0x1F,	0x1E,
+				0x3E,	0x0E,	0x1E,	0x3D,	0x3D },
+	{ STV0900_8PSK_35,	0x3c,	0x0c,	0x1c,	0x3b,	0x0c,
+				0x3b,	0x2b,	0x2b,	0x1b,	0x2b },
+	{ STV0900_8PSK_23,	0x1d,	0x0c,	0x3c,	0x0c,	0x2c,
+				0x3b,	0x0c,	0x2b,	0x2b,	0x2b },
+	{ STV0900_8PSK_34,	0x0e,	0x1c,	0x3d,	0x0c,	0x0d,
+				0x3b,	0x2c,	0x3b,	0x0c,	0x2b },
+	{ STV0900_8PSK_56,	0x2e,	0x3e,	0x1e,	0x2e,	0x2d,
+				0x1e,	0x3c,	0x2d,	0x2c,	0x1d },
+	{ STV0900_8PSK_89,	0x3e,	0x3e,	0x1e,	0x2e,	0x3d,
+				0x1e,	0x0d,	0x2d,	0x3c,	0x1d },
+	{ STV0900_8PSK_910,	0x3e,	0x3e, 	0x1e,	0x2e, 	0x3d,
+				0x1e,	0x1d,	0x2d,	0x0d,	0x1d },
 };
 
 
 
 /* Cut 2.0 Tracking carrier loop carrier 16APSK 2/3 to 32APSK 9/10 long Frame */
 static const struct stv0900_car_loop_optim FE_STV0900_S2APSKCarLoopCut20[11] = {
-	/* Modcod		2MPon 	2MPoff	5MPon 	5MPoff	10MPon 	10MPoff	20MPon 	20MPoff	30MPon 	30MPoff */
-	{ STV0900_16APSK_23,	0x0C,	0x0C,	0x0C,	0x0C,	0x1D,	0x0C,	0x3C,	0x0C,	0x2C,	0x0C },
-	{ STV0900_16APSK_34,	0x0C,	0x0C,	0x0C,	0x0C,	0x0E,	0x0C,	0x2D,	0x0C,	0x1D,	0x0C },
-	{ STV0900_16APSK_45,	0x0C,	0x0C,	0x0C,	0x0C,	0x1E,	0x0C,	0x3D,	0x0C,	0x2D,	0x0C },
-	{ STV0900_16APSK_56,	0x0C,	0x0C,	0x0C,	0x0C,	0x1E,	0x0C,	0x3D,	0x0C,	0x2D,	0x0C },
-	{ STV0900_16APSK_89,	0x0C,	0x0C,	0x0C,	0x0C,	0x2E,	0x0C,	0x0E,	0x0C,	0x3D,	0x0C },
-	{ STV0900_16APSK_910,	0x0C,	0x0C,	0x0C,	0x0C,	0x2E,	0x0C,	0x0E,	0x0C,	0x3D,	0x0C },
-	{ STV0900_32APSK_34,	0x0C,	0x0C,	0x0C,	0x0C,	0x0C,	0x0C,	0x0C,	0x0C,	0x0C,	0x0C },
-	{ STV0900_32APSK_45,	0x0C,	0x0C,	0x0C,	0x0C,	0x0C,	0x0C,	0x0C,	0x0C,	0x0C,	0x0C },
-	{ STV0900_32APSK_56,	0x0C,	0x0C,	0x0C,	0x0C,	0x0C,	0x0C,	0x0C,	0x0C,	0x0C,	0x0C },
-	{ STV0900_32APSK_89,	0x0C,	0x0C,	0x0C,	0x0C,	0x0C,	0x0C,	0x0C,	0x0C,	0x0C,	0x0C },
-	{ STV0900_32APSK_910,	0x0C,	0x0C,	0x0C,	0x0C,	0x0C,	0x0C,	0x0C,	0x0C,	0x0C,	0x0C }
+	/* Modcod		2MPon 	2MPoff	5MPon 	5MPoff	10MPon
+				10MPoff	20MPon 	20MPoff	30MPon 	30MPoff */
+	{ STV0900_16APSK_23,	0x0C,	0x0C,	0x0C,	0x0C,	0x1D,
+				0x0C,	0x3C,	0x0C,	0x2C,	0x0C },
+	{ STV0900_16APSK_34,	0x0C,	0x0C,	0x0C,	0x0C,	0x0E,
+				0x0C,	0x2D,	0x0C,	0x1D,	0x0C },
+	{ STV0900_16APSK_45,	0x0C,	0x0C,	0x0C,	0x0C,	0x1E,
+				0x0C,	0x3D,	0x0C,	0x2D,	0x0C },
+	{ STV0900_16APSK_56,	0x0C,	0x0C,	0x0C,	0x0C,	0x1E,
+				0x0C,	0x3D,	0x0C,	0x2D,	0x0C },
+	{ STV0900_16APSK_89,	0x0C,	0x0C,	0x0C,	0x0C,	0x2E,
+				0x0C,	0x0E,	0x0C,	0x3D,	0x0C },
+	{ STV0900_16APSK_910,	0x0C,	0x0C,	0x0C,	0x0C,	0x2E,
+				0x0C,	0x0E,	0x0C,	0x3D,	0x0C },
+	{ STV0900_32APSK_34,	0x0C,	0x0C,	0x0C,	0x0C,	0x0C,
+				0x0C,	0x0C,	0x0C,	0x0C,	0x0C },
+	{ STV0900_32APSK_45,	0x0C,	0x0C,	0x0C,	0x0C,	0x0C,
+				0x0C,	0x0C,	0x0C,	0x0C,	0x0C },
+	{ STV0900_32APSK_56,	0x0C,	0x0C,	0x0C,	0x0C,	0x0C,
+				0x0C,	0x0C,	0x0C,	0x0C,	0x0C },
+	{ STV0900_32APSK_89,	0x0C,	0x0C,	0x0C,	0x0C,	0x0C,
+				0x0C,	0x0C,	0x0C,	0x0C,	0x0C },
+	{ STV0900_32APSK_910,	0x0C,	0x0C,	0x0C,	0x0C,	0x0C,
+				0x0C,	0x0C,	0x0C,	0x0C,	0x0C },
 };
 
 
 /* Cut 2.0 Tracking carrier loop carrier QPSK 1/4 to QPSK 2/5 long Frame */
 static const struct stv0900_car_loop_optim FE_STV0900_S2LowQPCarLoopCut20[3] = {
-	/* Modcod		2MPon 	2MPoff	5MPon 	5MPoff	10MPon 	10MPoff	20MPon 	20MPoff	30MPon 	30MPoff */
-	{ STV0900_QPSK_14,	0x0F,	0x3F,	0x0E,	0x3F,	0x2D,	0x2F,	0x2D,	0x1F,	0x3D,	0x3E },
-	{ STV0900_QPSK_13,	0x0F,	0x3F,	0x0E,	0x3F,	0x2D,	0x2F,	0x3D,	0x0F,	0x3D,	0x2E },
-	{ STV0900_QPSK_25,	0x1F,	0x3F,	0x1E,	0x3F,	0x3D,	0x1F,	0x3D,	0x3E,	0x3D,	0x2E }
+	/* Modcod		2MPon 	2MPoff	5MPon 	5MPoff	10MPon
+				10MPoff	20MPon 	20MPoff	30MPon 	30MPoff */
+	{ STV0900_QPSK_14,	0x0F,	0x3F,	0x0E,	0x3F,	0x2D,
+				0x2F,	0x2D,	0x1F,	0x3D,	0x3E },
+	{ STV0900_QPSK_13,	0x0F,	0x3F,	0x0E,	0x3F,	0x2D,
+				0x2F,	0x3D,	0x0F,	0x3D,	0x2E },
+	{ STV0900_QPSK_25,	0x1F,	0x3F,	0x1E,	0x3F,	0x3D,
+				0x1F,	0x3D,	0x3E,	0x3D,	0x2E }
 };
 
 
 /* Cut 2.0 Tracking carrier loop carrier  short Frame, cut 1.2 and 2.0 */
-static const struct stv0900_short_frames_car_loop_optim FE_STV0900_S2ShortCarLoop[4]	= {
-	/*Mod	2M_cut1.2 2M_cut2.0 5M_cut1.2 5M_cut2.0 10M_cut1.2 10M_cut2.0 20M_cut1.2 20M_cut2.0 30M_cut1.2 30M_cut2.0 */
-	{ STV0900_QPSK,		0x3C,	0x2F,	0x2B,	0x2E,	0x0B,	0x0E,	0x3A,	0x0E,	0x2A,	0x3D },
-	{ STV0900_8PSK,		0x0B,	0x3E,	0x2A,	0x0E,	0x0A,	0x2D,	0x19,	0x0D,	0x09,	0x3C },
-	{ STV0900_16APSK,	0x1B,	0x1E,	0x1B,	0x1E,	0x1B,	0x1E,	0x3A,	0x3D,	0x2A,	0x2D },
-	{ STV0900_32APSK,	0x1B,	0x1E,	0x1B,	0x1E,	0x1B,	0x1E,	0x3A,	0x3D,	0x2A,	0x2D }
+static const
+struct stv0900_short_frames_car_loop_optim FE_STV0900_S2ShortCarLoop[4] = {
+	/*Mod		2Mcut1.2 2Mcut2.0 5Mcut1.2 5Mcut2.0 10Mcut1.2
+			10Mcut2.0 20Mcut1.2 20M_cut2.0 30Mcut1.2 30Mcut2.0*/
+	{ STV0900_QPSK,		0x3C,	0x2F,	0x2B,	0x2E,	0x0B,
+				0x0E,	0x3A,	0x0E,	0x2A,	0x3D },
+	{ STV0900_8PSK,		0x0B,	0x3E,	0x2A,	0x0E,	0x0A,
+				0x2D,	0x19,	0x0D,	0x09,	0x3C },
+	{ STV0900_16APSK,	0x1B,	0x1E,	0x1B,	0x1E,	0x1B,
+				0x1E,	0x3A,	0x3D,	0x2A,	0x2D },
+	{ STV0900_32APSK,	0x1B,	0x1E,	0x1B,	0x1E,	0x1B,
+				0x1E,	0x3A,	0x3D,	0x2A,	0x2D }
+};
+
+static	const struct stv0900_car_loop_optim FE_STV0900_S2CarLoopCut30[14] = {
+	/*Modcod		2MPon 	2MPoff	5MPon 	5MPoff	10MPon
+				10MPoff	20MPon 	20MPoff	30MPon 	30MPoff	*/
+	{ STV0900_QPSK_12,	0x3C,	0x2C,	0x0C,	0x2C,	0x1B,
+				0x2C,	0x1B,	0x1C,	0x0B, 	0x3B },
+	{ STV0900_QPSK_35,	0x0D,	0x0D,	0x0C,	0x0D,	0x1B,
+				0x3C,	0x1B,	0x1C,	0x0B,	0x3B },
+	{ STV0900_QPSK_23,	0x1D,	0x0D,	0x0C,	0x1D,	0x2B,
+				0x3C,	0x1B,	0x1C,	0x0B,	0x3B },
+	{ STV0900_QPSK_34,	0x1D,	0x1D,	0x0C,	0x1D,	0x2B,
+				0x3C,	0x1B,	0x1C,	0x0B,	0x3B },
+	{ STV0900_QPSK_45,	0x2D,	0x1D,	0x1C,	0x1D,	0x2B,
+				0x3C,	0x2B,	0x0C,	0x1B,	0x3B },
+	{ STV0900_QPSK_56,	0x2D,	0x1D,	0x1C,	0x1D,	0x2B,
+				0x3C,	0x2B,	0x0C,	0x1B,	0x3B },
+	{ STV0900_QPSK_89,	0x3D,	0x2D,	0x1C,	0x1D,	0x3B,
+				0x3C,	0x2B,	0x0C,	0x1B,	0x3B },
+	{ STV0900_QPSK_910,	0x3D,	0x2D,	0x1C,	0x1D,	0x3B,
+				0x3C,	0x2B,	0x0C,	0x1B,	0x3B },
+	{ STV0900_8PSK_35,	0x39,	0x19,	0x39,	0x19,	0x19,
+				0x19,	0x19,	0x19,	0x09,	0x19 },
+	{ STV0900_8PSK_23,	0x2A,	0x39,	0x1A,	0x0A,	0x39,
+				0x0A,	0x29,	0x39,	0x29,	0x0A },
+	{ STV0900_8PSK_34,	0x0B,	0x3A,	0x0B,	0x0B,	0x3A,
+				0x1B,	0x1A,	0x0B,	0x1A,	0x3A },
+	{ STV0900_8PSK_56,	0x0C,	0x1B,	0x3B,	0x2B,	0x1B,
+				0x3B,	0x3A,	0x3B,	0x3A,	0x1B },
+	{ STV0900_8PSK_89,	0x2C,	0x2C,	0x2C,	0x1C,	0x2B,
+				0x0C,	0x0B,	0x3B,	0x0B,	0x1B },
+	{ STV0900_8PSK_910,	0x2C,	0x3C,	0x2C,	0x1C,	0x3B,
+				0x1C,	0x0B,	0x3B,	0x0B,	0x1B }
+};
+
+static	const
+struct stv0900_car_loop_optim FE_STV0900_S2APSKCarLoopCut30[11] = {
+	/*Modcod		2MPon 	2MPoff	5MPon 	5MPoff	10MPon
+				10MPoff	20MPon 	20MPoff	30MPon 	30MPoff	*/
+	{ STV0900_16APSK_23,	0x0A,	0x0A,	0x0A,	0x0A,	0x1A,
+				0x0A,	0x3A,	0x0A,	0x2A,	0x0A },
+	{ STV0900_16APSK_34,	0x0A,	0x0A,	0x0A,	0x0A,	0x0B,
+				0x0A,	0x3B,	0x0A,	0x1B,	0x0A },
+	{ STV0900_16APSK_45,	0x0A,	0x0A,	0x0A,	0x0A,	0x1B,
+				0x0A,	0x3B,	0x0A,	0x2B,	0x0A },
+	{ STV0900_16APSK_56,	0x0A,	0x0A,	0x0A,	0x0A,	0x1B,
+				0x0A,	0x3B,	0x0A,	0x2B,	0x0A },
+	{ STV0900_16APSK_89,	0x0A,	0x0A,	0x0A,	0x0A,	0x2B,
+				0x0A,	0x0C,	0x0A,	0x3B,	0x0A },
+	{ STV0900_16APSK_910,	0x0A,	0x0A,	0x0A,	0x0A,	0x2B,
+				0x0A,	0x0C,	0x0A,	0x3B,	0x0A },
+	{ STV0900_32APSK_34,	0x0A,	0x0A,	0x0A,	0x0A,	0x0A,
+				0x0A,	0x0A,	0x0A,	0x0A,	0x0A },
+	{ STV0900_32APSK_45,	0x0A,	0x0A,	0x0A,	0x0A,	0x0A,
+				0x0A,	0x0A,	0x0A,	0x0A,	0x0A },
+	{ STV0900_32APSK_56,	0x0A,	0x0A,	0x0A,	0x0A,	0x0A,
+				0x0A,	0x0A,	0x0A,	0x0A,	0x0A },
+	{ STV0900_32APSK_89,	0x0A,	0x0A,	0x0A,	0x0A,	0x0A,
+				0x0A,	0x0A,	0x0A,	0x0A,	0x0A },
+	{ STV0900_32APSK_910,	0x0A,	0x0A,	0x0A,	0x0A,	0x0A,
+				0x0A,	0x0A,	0x0A,	0x0A,	0x0A }
+};
+
+static	const
+struct stv0900_car_loop_optim FE_STV0900_S2LowQPCarLoopCut30[3] = {
+	/*Modcod		2MPon 	2MPoff	5MPon 	5MPoff	10MPon
+				10MPoff	20MPon 	20MPoff	30MPon 	30MPoff*/
+	{ STV0900_QPSK_14,	0x0C,	0x3C,	0x0B,	0x3C,	0x2A,
+				0x2C,	0x2A,	0x1C,	0x3A,	0x3B },
+	{ STV0900_QPSK_13,	0x0C,	0x3C,	0x0B,	0x3C,	0x2A,
+				0x2C,	0x3A,	0x0C,	0x3A,	0x2B },
+	{ STV0900_QPSK_25,	0x1C,	0x3C,	0x1B,	0x3C,	0x3A,
+				0x1C,	0x3A,	0x3B,	0x3A,	0x2B }
+};
+
+static	const struct stv0900_short_frames_car_loop_optim_vs_mod
+FE_STV0900_S2ShortCarLoopCut30[4] = {
+	/*Mod		2Mcut3.0 5Mcut3.0 10Mcut3.0 20Mcut3.0 30Mcut3.0*/
+	{ STV0900_QPSK,		0x2C,	0x2B,	0x0B,	0x0B,	0x3A },
+	{ STV0900_8PSK,		0x3B,	0x0B,	0x2A,	0x0A,	0x39 },
+	{ STV0900_16APSK,	0x1B,	0x1B,	0x1B,	0x3A,	0x2A },
+	{ STV0900_32APSK,	0x1B,	0x1B,	0x1B,	0x3A,	0x2A },
+
 };
 
-static const u16 STV0900_InitVal[182][2] = {
+static const u16 STV0900_InitVal[181][2] = {
 	{ R0900_OUTCFG		, 0x00	},
-	{ R0900_MODECFG		, 0xff	},
 	{ R0900_AGCRF1CFG	, 0x11	},
 	{ R0900_AGCRF2CFG	, 0x13	},
 	{ R0900_TSGENERAL1X	, 0x14	},
@@ -381,7 +524,7 @@ static const u16 STV0900_InitVal[182][2] = {
 	{ R0900_GAINLLR_NF15	, 0x1A	},
 	{ R0900_GAINLLR_NF16	, 0x1F	},
 	{ R0900_GAINLLR_NF17	, 0x21	},
-	{ R0900_RCCFGH		, 0x20	},
+	{ R0900_RCCFG2		, 0x20	},
 	{ R0900_P1_FECM		, 0x01	}, /*disable DSS modes*/
 	{ R0900_P2_FECM		, 0x01	}, /*disable DSS modes*/
 	{ R0900_P1_PRVIT	, 0x2F	}, /*disable puncture rate 6/7*/
diff --git a/drivers/media/dvb/frontends/stv0900_priv.h b/drivers/media/dvb/frontends/stv0900_priv.h
index 5ed7a145c7d3..d8ba8a984abe 100644
--- a/drivers/media/dvb/frontends/stv0900_priv.h
+++ b/drivers/media/dvb/frontends/stv0900_priv.h
@@ -46,22 +46,6 @@
 #define FALSE (!TRUE)
 #endif
 
-#define	dmd_reg(a, b, c) \
-	do { \
-		a = 0; \
-		switch (demod) { \
-		case STV0900_DEMOD_1: \
-		default: \
-			a = b; \
-			break; \
-		case STV0900_DEMOD_2: \
-			a = c; \
-			break; \
-		} \
-	} while (0)
-
-static int stvdebug;
-
 #define dprintk(args...) \
 	do { \
 		if (stvdebug) \
@@ -70,6 +54,8 @@ static int stvdebug;
 
 #define STV0900_MAXLOOKUPSIZE 500
 #define STV0900_BLIND_SEARCH_AGC2_TH 700
+#define STV0900_BLIND_SEARCH_AGC2_TH_CUT30 1400
+#define IQPOWER_THRESHOLD  30
 
 /* One point of the lookup table */
 struct stv000_lookpoint {
@@ -263,14 +249,14 @@ struct stv0900_init_params{
 	int	tuner1_adc;
 
 	/* IQ from the tuner1 to the demod */
-	enum stv0900_iq_inversion	tun1_iq_inversion;
+	enum stv0900_iq_inversion	tun1_iq_inv;
 	enum fe_stv0900_clock_type	path2_ts_clock;
 
 	u8	tun2_maddress;
 	int	tuner2_adc;
 
 	/* IQ from the tuner2 to the demod */
-	enum stv0900_iq_inversion	tun2_iq_inversion;
+	enum stv0900_iq_inversion	tun2_iq_inv;
 	struct stv0900_reg		*ts_config;
 };
 
@@ -300,7 +286,7 @@ struct stv0900_signal_info {
 	enum fe_stv0900_modcode			modcode;
 	enum fe_stv0900_modulation		modulation;
 	enum fe_stv0900_pilot			pilot;
-	enum fe_stv0900_frame_length		frame_length;
+	enum fe_stv0900_frame_length		frame_len;
 	enum stv0900_iq_inversion		spectrum;
 	enum fe_stv0900_rolloff			rolloff;
 
@@ -318,47 +304,25 @@ struct stv0900_internal{
 	/* Demodulator use for single demod or for dual demod) */
 	enum fe_stv0900_demod_mode	demod_mode;
 
-	/*Demod 1*/
-	s32	tuner1_freq;
-	s32	tuner1_bw;
-	s32	dmd1_symbol_rate;
-	s32	dmd1_srch_range;
+	/*Demods */
+	s32	freq[2];
+	s32	bw[2];
+	s32	symbol_rate[2];
+	s32	srch_range[2];
 
 	/* algorithm for search Blind, Cold or Warm*/
-	enum fe_stv0900_search_algo	dmd1_srch_algo;
+	enum fe_stv0900_search_algo	srch_algo[2];
 	/* search standard: Auto, DVBS1/DSS only or DVBS2 only*/
-	enum fe_stv0900_search_standard	dmd1_srch_standard;
+	enum fe_stv0900_search_standard	srch_standard[2];
 	/* inversion search : auto, auto norma first, normal or inverted */
-	enum fe_stv0900_search_iq	dmd1_srch_iq_inv;
-	enum fe_stv0900_modcode		dmd1_modcode;
-	enum fe_stv0900_modulation	dmd1_modulation;
-	enum fe_stv0900_fec		dmd1_fec;
-
-	struct stv0900_signal_info	dmd1_rslts;
-	enum fe_stv0900_signal_type	dmd1_state;
+	enum fe_stv0900_search_iq	srch_iq_inv[2];
+	enum fe_stv0900_modcode		modcode[2];
+	enum fe_stv0900_modulation	modulation[2];
+	enum fe_stv0900_fec		fec[2];
 
-	enum fe_stv0900_error		dmd1_err;
+	struct stv0900_signal_info	result[2];
+	enum fe_stv0900_error		err[2];
 
-	/*Demod 2*/
-	s32	tuner2_freq;
-	s32	tuner2_bw;
-	s32	dmd2_symbol_rate;
-	s32	dmd2_srch_range;
-
-	enum fe_stv0900_search_algo	dmd2_srch_algo;
-	enum fe_stv0900_search_standard	dmd2_srch_stndrd;
-	/* inversion search : auto, auto normal first, normal or inverted */
-	enum fe_stv0900_search_iq	dmd2_srch_iq_inv;
-	enum fe_stv0900_modcode		dmd2_modcode;
-	enum fe_stv0900_modulation	dmd2_modulation;
-	enum fe_stv0900_fec		dmd2_fec;
-
-	/* results of the search*/
-	struct stv0900_signal_info	dmd2_rslts;
-	/* current state of the search algorithm */
-	enum fe_stv0900_signal_type	dmd2_state;
-
-	enum fe_stv0900_error		dmd2_err;
 
 	struct i2c_adapter	*i2c_adap;
 	u8			i2c_addr;
@@ -379,6 +343,8 @@ struct stv0900_state {
 	int demod;
 };
 
+extern int stvdebug;
+
 extern s32 ge2comp(s32 a, s32 width);
 
 extern void stv0900_write_reg(struct stv0900_internal *i_params,
@@ -418,13 +384,14 @@ extern u8 stv0900_get_optim_short_carr_loop(s32 srate,
 extern void stv0900_stop_all_s2_modcod(struct stv0900_internal *i_params,
 				enum fe_stv0900_demod_num demod);
 
-extern void stv0900_activate_s2_modcode(struct stv0900_internal *i_params,
+extern void stv0900_activate_s2_modcod(struct stv0900_internal *i_params,
 				enum fe_stv0900_demod_num demod);
 
-extern void stv0900_activate_s2_modcode_single(struct stv0900_internal *i_params,
+extern void stv0900_activate_s2_modcod_single(struct stv0900_internal *i_params,
 				enum fe_stv0900_demod_num demod);
 
-extern enum fe_stv0900_tracking_standard stv0900_get_standard(struct dvb_frontend *fe,
+extern enum
+fe_stv0900_tracking_standard stv0900_get_standard(struct dvb_frontend *fe,
 				enum fe_stv0900_demod_num demod);
 
 #endif
diff --git a/drivers/media/dvb/frontends/stv0900_reg.h b/drivers/media/dvb/frontends/stv0900_reg.h
index 264f9cf9a17e..7b8edf192e97 100644
--- a/drivers/media/dvb/frontends/stv0900_reg.h
+++ b/drivers/media/dvb/frontends/stv0900_reg.h
@@ -14,7 +14,7 @@
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  *
  * GNU General Public License for more details.
  *
@@ -26,3762 +26,3950 @@
 #ifndef STV0900_REG_H
 #define STV0900_REG_H
 
+extern s32 shiftx(s32 x, int demod, s32 shift);
+
+#define REGx(x) shiftx(x, demod, 0x200)
+#define FLDx(x) shiftx(x, demod, 0x2000000)
+
 /*MID*/
-#define R0900_MID  0xf100
-#define F0900_MCHIP_IDENT  0xf10000f0
-#define F0900_MRELEASE  0xf100000f
+#define R0900_MID 0xf100
+#define F0900_MCHIP_IDENT 0xf10000f0
+#define F0900_MRELEASE 0xf100000f
 
 /*DACR1*/
-#define R0900_DACR1  0xf113
-#define F0900_DAC_MODE  0xf11300e0
-#define F0900_DAC_VALUE1  0xf113000f
+#define R0900_DACR1 0xf113
+#define F0900_DAC_MODE 0xf11300e0
+#define F0900_DAC_VALUE1 0xf113000f
 
 /*DACR2*/
-#define R0900_DACR2  0xf114
-#define F0900_DAC_VALUE0  0xf11400ff
+#define R0900_DACR2 0xf114
+#define F0900_DAC_VALUE0 0xf11400ff
 
 /*OUTCFG*/
-#define R0900_OUTCFG  0xf11c
-#define F0900_INV_DATA6  0xf11c0080
-#define F0900_OUTSERRS1_HZ  0xf11c0040
-#define F0900_OUTSERRS2_HZ  0xf11c0020
-#define F0900_OUTSERRS3_HZ  0xf11c0010
-#define F0900_OUTPARRS3_HZ  0xf11c0008
-#define F0900_OUTHZ3_CONTROL  0xf11c0007
-
-/*MODECFG*/
-#define R0900_MODECFG  0xf11d
-#define F0900_FECSPY_SEL_2  0xf11d0020
-#define F0900_HWARE_SEL_2  0xf11d0010
-#define F0900_PKTDEL_SEL_2  0xf11d0008
-#define F0900_DISEQC_SEL_2  0xf11d0004
-#define F0900_VIT_SEL_2  0xf11d0002
-#define F0900_DEMOD_SEL_2  0xf11d0001
+#define R0900_OUTCFG 0xf11c
+#define F0900_OUTSERRS1_HZ 0xf11c0040
+#define F0900_OUTSERRS2_HZ 0xf11c0020
+#define F0900_OUTSERRS3_HZ 0xf11c0010
+#define F0900_OUTPARRS3_HZ 0xf11c0008
 
 /*IRQSTATUS3*/
-#define R0900_IRQSTATUS3  0xf120
-#define F0900_SPLL_LOCK  0xf1200020
-#define F0900_SSTREAM_LCK_3  0xf1200010
-#define F0900_SSTREAM_LCK_2  0xf1200008
-#define F0900_SSTREAM_LCK_1  0xf1200004
-#define F0900_SDVBS1_PRF_2  0xf1200002
-#define F0900_SDVBS1_PRF_1  0xf1200001
+#define R0900_IRQSTATUS3 0xf120
+#define F0900_SPLL_LOCK 0xf1200020
+#define F0900_SSTREAM_LCK_3 0xf1200010
+#define F0900_SSTREAM_LCK_2 0xf1200008
+#define F0900_SSTREAM_LCK_1 0xf1200004
+#define F0900_SDVBS1_PRF_2 0xf1200002
+#define F0900_SDVBS1_PRF_1 0xf1200001
 
 /*IRQSTATUS2*/
-#define R0900_IRQSTATUS2  0xf121
-#define F0900_SSPY_ENDSIM_3  0xf1210080
-#define F0900_SSPY_ENDSIM_2  0xf1210040
-#define F0900_SSPY_ENDSIM_1  0xf1210020
-#define F0900_SPKTDEL_ERROR_2  0xf1210010
-#define F0900_SPKTDEL_LOCKB_2  0xf1210008
-#define F0900_SPKTDEL_LOCK_2  0xf1210004
-#define F0900_SPKTDEL_ERROR_1  0xf1210002
-#define F0900_SPKTDEL_LOCKB_1  0xf1210001
+#define R0900_IRQSTATUS2 0xf121
+#define F0900_SSPY_ENDSIM_3 0xf1210080
+#define F0900_SSPY_ENDSIM_2 0xf1210040
+#define F0900_SSPY_ENDSIM_1 0xf1210020
+#define F0900_SPKTDEL_ERROR_2 0xf1210010
+#define F0900_SPKTDEL_LOCKB_2 0xf1210008
+#define F0900_SPKTDEL_LOCK_2 0xf1210004
+#define F0900_SPKTDEL_ERROR_1 0xf1210002
+#define F0900_SPKTDEL_LOCKB_1 0xf1210001
 
 /*IRQSTATUS1*/
-#define R0900_IRQSTATUS1  0xf122
-#define F0900_SPKTDEL_LOCK_1  0xf1220080
-#define F0900_SEXTPINB2  0xf1220040
-#define F0900_SEXTPIN2  0xf1220020
-#define F0900_SEXTPINB1  0xf1220010
-#define F0900_SEXTPIN1  0xf1220008
-#define F0900_SDEMOD_LOCKB_2  0xf1220004
-#define F0900_SDEMOD_LOCK_2  0xf1220002
-#define F0900_SDEMOD_IRQ_2  0xf1220001
+#define R0900_IRQSTATUS1 0xf122
+#define F0900_SPKTDEL_LOCK_1 0xf1220080
+#define F0900_SDEMOD_LOCKB_2 0xf1220004
+#define F0900_SDEMOD_LOCK_2 0xf1220002
+#define F0900_SDEMOD_IRQ_2 0xf1220001
 
 /*IRQSTATUS0*/
-#define R0900_IRQSTATUS0  0xf123
-#define F0900_SDEMOD_LOCKB_1  0xf1230080
-#define F0900_SDEMOD_LOCK_1  0xf1230040
-#define F0900_SDEMOD_IRQ_1  0xf1230020
-#define F0900_SBCH_ERRFLAG  0xf1230010
-#define F0900_SDISEQC2RX_IRQ  0xf1230008
-#define F0900_SDISEQC2TX_IRQ  0xf1230004
-#define F0900_SDISEQC1RX_IRQ  0xf1230002
-#define F0900_SDISEQC1TX_IRQ  0xf1230001
+#define R0900_IRQSTATUS0 0xf123
+#define F0900_SDEMOD_LOCKB_1 0xf1230080
+#define F0900_SDEMOD_LOCK_1 0xf1230040
+#define F0900_SDEMOD_IRQ_1 0xf1230020
+#define F0900_SBCH_ERRFLAG 0xf1230010
+#define F0900_SDISEQC2RX_IRQ 0xf1230008
+#define F0900_SDISEQC2TX_IRQ 0xf1230004
+#define F0900_SDISEQC1RX_IRQ 0xf1230002
+#define F0900_SDISEQC1TX_IRQ 0xf1230001
 
 /*IRQMASK3*/
-#define R0900_IRQMASK3  0xf124
-#define F0900_MPLL_LOCK  0xf1240020
-#define F0900_MSTREAM_LCK_3  0xf1240010
-#define F0900_MSTREAM_LCK_2  0xf1240008
-#define F0900_MSTREAM_LCK_1  0xf1240004
-#define F0900_MDVBS1_PRF_2  0xf1240002
-#define F0900_MDVBS1_PRF_1  0xf1240001
+#define R0900_IRQMASK3 0xf124
+#define F0900_MPLL_LOCK 0xf1240020
+#define F0900_MSTREAM_LCK_3 0xf1240010
+#define F0900_MSTREAM_LCK_2 0xf1240008
+#define F0900_MSTREAM_LCK_1 0xf1240004
+#define F0900_MDVBS1_PRF_2 0xf1240002
+#define F0900_MDVBS1_PRF_1 0xf1240001
 
 /*IRQMASK2*/
-#define R0900_IRQMASK2  0xf125
-#define F0900_MSPY_ENDSIM_3  0xf1250080
-#define F0900_MSPY_ENDSIM_2  0xf1250040
-#define F0900_MSPY_ENDSIM_1  0xf1250020
-#define F0900_MPKTDEL_ERROR_2  0xf1250010
-#define F0900_MPKTDEL_LOCKB_2  0xf1250008
-#define F0900_MPKTDEL_LOCK_2  0xf1250004
-#define F0900_MPKTDEL_ERROR_1  0xf1250002
-#define F0900_MPKTDEL_LOCKB_1  0xf1250001
+#define R0900_IRQMASK2 0xf125
+#define F0900_MSPY_ENDSIM_3 0xf1250080
+#define F0900_MSPY_ENDSIM_2 0xf1250040
+#define F0900_MSPY_ENDSIM_1 0xf1250020
+#define F0900_MPKTDEL_ERROR_2 0xf1250010
+#define F0900_MPKTDEL_LOCKB_2 0xf1250008
+#define F0900_MPKTDEL_LOCK_2 0xf1250004
+#define F0900_MPKTDEL_ERROR_1 0xf1250002
+#define F0900_MPKTDEL_LOCKB_1 0xf1250001
 
 /*IRQMASK1*/
-#define R0900_IRQMASK1  0xf126
-#define F0900_MPKTDEL_LOCK_1  0xf1260080
-#define F0900_MEXTPINB2  0xf1260040
-#define F0900_MEXTPIN2  0xf1260020
-#define F0900_MEXTPINB1  0xf1260010
-#define F0900_MEXTPIN1  0xf1260008
-#define F0900_MDEMOD_LOCKB_2  0xf1260004
-#define F0900_MDEMOD_LOCK_2  0xf1260002
-#define F0900_MDEMOD_IRQ_2  0xf1260001
+#define R0900_IRQMASK1 0xf126
+#define F0900_MPKTDEL_LOCK_1 0xf1260080
+#define F0900_MEXTPINB2 0xf1260040
+#define F0900_MEXTPIN2 0xf1260020
+#define F0900_MEXTPINB1 0xf1260010
+#define F0900_MEXTPIN1 0xf1260008
+#define F0900_MDEMOD_LOCKB_2 0xf1260004
+#define F0900_MDEMOD_LOCK_2 0xf1260002
+#define F0900_MDEMOD_IRQ_2 0xf1260001
 
 /*IRQMASK0*/
-#define R0900_IRQMASK0  0xf127
-#define F0900_MDEMOD_LOCKB_1  0xf1270080
-#define F0900_MDEMOD_LOCK_1  0xf1270040
-#define F0900_MDEMOD_IRQ_1  0xf1270020
-#define F0900_MBCH_ERRFLAG  0xf1270010
-#define F0900_MDISEQC2RX_IRQ  0xf1270008
-#define F0900_MDISEQC2TX_IRQ  0xf1270004
-#define F0900_MDISEQC1RX_IRQ  0xf1270002
-#define F0900_MDISEQC1TX_IRQ  0xf1270001
+#define R0900_IRQMASK0 0xf127
+#define F0900_MDEMOD_LOCKB_1 0xf1270080
+#define F0900_MDEMOD_LOCK_1 0xf1270040
+#define F0900_MDEMOD_IRQ_1 0xf1270020
+#define F0900_MBCH_ERRFLAG 0xf1270010
+#define F0900_MDISEQC2RX_IRQ 0xf1270008
+#define F0900_MDISEQC2TX_IRQ 0xf1270004
+#define F0900_MDISEQC1RX_IRQ 0xf1270002
+#define F0900_MDISEQC1TX_IRQ 0xf1270001
 
 /*I2CCFG*/
-#define R0900_I2CCFG  0xf129
-#define F0900_I2C2_FASTMODE  0xf1290080
-#define F0900_STATUS_WR2  0xf1290040
-#define F0900_I2C2ADDR_INC  0xf1290030
-#define F0900_I2C_FASTMODE  0xf1290008
-#define F0900_STATUS_WR  0xf1290004
-#define F0900_I2CADDR_INC  0xf1290003
+#define R0900_I2CCFG 0xf129
+#define F0900_I2C_FASTMODE 0xf1290008
+#define F0900_I2CADDR_INC 0xf1290003
 
 /*P1_I2CRPT*/
-#define R0900_P1_I2CRPT  0xf12a
-#define F0900_P1_I2CT_ON  0xf12a0080
-#define F0900_P1_ENARPT_LEVEL  0xf12a0070
-#define F0900_P1_SCLT_DELAY  0xf12a0008
-#define F0900_P1_STOP_ENABLE  0xf12a0004
-#define F0900_P1_STOP_SDAT2SDA  0xf12a0002
+#define R0900_P1_I2CRPT 0xf12a
+#define I2CRPT shiftx(R0900_P1_I2CRPT, demod, -1)
+#define F0900_P1_I2CT_ON 0xf12a0080
+#define I2CT_ON shiftx(F0900_P1_I2CT_ON, demod, -0x10000)
+#define F0900_P1_ENARPT_LEVEL 0xf12a0070
+#define F0900_P1_SCLT_DELAY 0xf12a0008
+#define F0900_P1_STOP_ENABLE 0xf12a0004
+#define F0900_P1_STOP_SDAT2SDA 0xf12a0002
 
 /*P2_I2CRPT*/
-#define R0900_P2_I2CRPT  0xf12b
-#define F0900_P2_I2CT_ON  0xf12b0080
-#define F0900_P2_ENARPT_LEVEL  0xf12b0070
-#define F0900_P2_SCLT_DELAY  0xf12b0008
-#define F0900_P2_STOP_ENABLE  0xf12b0004
-#define F0900_P2_STOP_SDAT2SDA  0xf12b0002
+#define R0900_P2_I2CRPT 0xf12b
+#define F0900_P2_I2CT_ON 0xf12b0080
+#define F0900_P2_ENARPT_LEVEL 0xf12b0070
+#define F0900_P2_SCLT_DELAY 0xf12b0008
+#define F0900_P2_STOP_ENABLE 0xf12b0004
+#define F0900_P2_STOP_SDAT2SDA 0xf12b0002
+
+/*IOPVALUE6*/
+#define R0900_IOPVALUE6 0xf138
+#define F0900_VSCL 0xf1380004
+#define F0900_VSDA 0xf1380002
+#define F0900_VDATA3_0 0xf1380001
+
+/*IOPVALUE5*/
+#define R0900_IOPVALUE5 0xf139
+#define F0900_VDATA3_1 0xf1390080
+#define F0900_VDATA3_2 0xf1390040
+#define F0900_VDATA3_3 0xf1390020
+#define F0900_VDATA3_4 0xf1390010
+#define F0900_VDATA3_5 0xf1390008
+#define F0900_VDATA3_6 0xf1390004
+#define F0900_VDATA3_7 0xf1390002
+#define F0900_VCLKOUT3 0xf1390001
+
+/*IOPVALUE4*/
+#define R0900_IOPVALUE4 0xf13a
+#define F0900_VSTROUT3 0xf13a0080
+#define F0900_VDPN3 0xf13a0040
+#define F0900_VERROR3 0xf13a0020
+#define F0900_VDATA2_7 0xf13a0010
+#define F0900_VCLKOUT2 0xf13a0008
+#define F0900_VSTROUT2 0xf13a0004
+#define F0900_VDPN2 0xf13a0002
+#define F0900_VERROR2 0xf13a0001
+
+/*IOPVALUE3*/
+#define R0900_IOPVALUE3 0xf13b
+#define F0900_VDATA1_7 0xf13b0080
+#define F0900_VCLKOUT1 0xf13b0040
+#define F0900_VSTROUT1 0xf13b0020
+#define F0900_VDPN1 0xf13b0010
+#define F0900_VERROR1 0xf13b0008
+#define F0900_VCLKOUT27 0xf13b0004
+#define F0900_VDISEQCOUT2 0xf13b0002
+#define F0900_VSCLT2 0xf13b0001
+
+/*IOPVALUE2*/
+#define R0900_IOPVALUE2 0xf13c
+#define F0900_VSDAT2 0xf13c0080
+#define F0900_VAGCRF2 0xf13c0040
+#define F0900_VDISEQCOUT1 0xf13c0020
+#define F0900_VSCLT1 0xf13c0010
+#define F0900_VSDAT1 0xf13c0008
+#define F0900_VAGCRF1 0xf13c0004
+#define F0900_VDIRCLK 0xf13c0002
+#define F0900_VSTDBY 0xf13c0001
+
+/*IOPVALUE1*/
+#define R0900_IOPVALUE1 0xf13d
+#define F0900_VCS1 0xf13d0080
+#define F0900_VCS0 0xf13d0040
+#define F0900_VGPIO13 0xf13d0020
+#define F0900_VGPIO12 0xf13d0010
+#define F0900_VGPIO11 0xf13d0008
+#define F0900_VGPIO10 0xf13d0004
+#define F0900_VGPIO9 0xf13d0002
+#define F0900_VGPIO8 0xf13d0001
+
+/*IOPVALUE0*/
+#define R0900_IOPVALUE0 0xf13e
+#define F0900_VGPIO7 0xf13e0080
+#define F0900_VGPIO6 0xf13e0040
+#define F0900_VGPIO5 0xf13e0020
+#define F0900_VGPIO4 0xf13e0010
+#define F0900_VGPIO3 0xf13e0008
+#define F0900_VGPIO2 0xf13e0004
+#define F0900_VGPIO1 0xf13e0002
+#define F0900_VCLKI2 0xf13e0001
 
 /*CLKI2CFG*/
-#define R0900_CLKI2CFG  0xf140
-#define F0900_CLKI2_OPD  0xf1400080
-#define F0900_CLKI2_CONFIG  0xf140007e
-#define F0900_CLKI2_XOR  0xf1400001
+#define R0900_CLKI2CFG 0xf140
+#define F0900_CLKI2_OPD 0xf1400080
+#define F0900_CLKI2_CONFIG 0xf140007e
+#define F0900_CLKI2_XOR 0xf1400001
 
 /*GPIO1CFG*/
-#define R0900_GPIO1CFG  0xf141
-#define F0900_GPIO1_OPD  0xf1410080
-#define F0900_GPIO1_CONFIG  0xf141007e
-#define F0900_GPIO1_XOR  0xf1410001
+#define R0900_GPIO1CFG 0xf141
+#define F0900_GPIO1_OPD 0xf1410080
+#define F0900_GPIO1_CONFIG 0xf141007e
+#define F0900_GPIO1_XOR 0xf1410001
 
 /*GPIO2CFG*/
-#define R0900_GPIO2CFG  0xf142
-#define F0900_GPIO2_OPD  0xf1420080
-#define F0900_GPIO2_CONFIG  0xf142007e
-#define F0900_GPIO2_XOR  0xf1420001
+#define R0900_GPIO2CFG 0xf142
+#define F0900_GPIO2_OPD 0xf1420080
+#define F0900_GPIO2_CONFIG 0xf142007e
+#define F0900_GPIO2_XOR 0xf1420001
 
 /*GPIO3CFG*/
-#define R0900_GPIO3CFG  0xf143
-#define F0900_GPIO3_OPD  0xf1430080
-#define F0900_GPIO3_CONFIG  0xf143007e
-#define F0900_GPIO3_XOR  0xf1430001
+#define R0900_GPIO3CFG 0xf143
+#define F0900_GPIO3_OPD 0xf1430080
+#define F0900_GPIO3_CONFIG 0xf143007e
+#define F0900_GPIO3_XOR 0xf1430001
 
 /*GPIO4CFG*/
-#define R0900_GPIO4CFG  0xf144
-#define F0900_GPIO4_OPD  0xf1440080
-#define F0900_GPIO4_CONFIG  0xf144007e
-#define F0900_GPIO4_XOR  0xf1440001
+#define R0900_GPIO4CFG 0xf144
+#define F0900_GPIO4_OPD 0xf1440080
+#define F0900_GPIO4_CONFIG 0xf144007e
+#define F0900_GPIO4_XOR 0xf1440001
 
 /*GPIO5CFG*/
-#define R0900_GPIO5CFG  0xf145
-#define F0900_GPIO5_OPD  0xf1450080
-#define F0900_GPIO5_CONFIG  0xf145007e
-#define F0900_GPIO5_XOR  0xf1450001
+#define R0900_GPIO5CFG 0xf145
+#define F0900_GPIO5_OPD 0xf1450080
+#define F0900_GPIO5_CONFIG 0xf145007e
+#define F0900_GPIO5_XOR 0xf1450001
 
 /*GPIO6CFG*/
-#define R0900_GPIO6CFG  0xf146
-#define F0900_GPIO6_OPD  0xf1460080
-#define F0900_GPIO6_CONFIG  0xf146007e
-#define F0900_GPIO6_XOR  0xf1460001
+#define R0900_GPIO6CFG 0xf146
+#define F0900_GPIO6_OPD 0xf1460080
+#define F0900_GPIO6_CONFIG 0xf146007e
+#define F0900_GPIO6_XOR 0xf1460001
 
 /*GPIO7CFG*/
-#define R0900_GPIO7CFG  0xf147
-#define F0900_GPIO7_OPD  0xf1470080
-#define F0900_GPIO7_CONFIG  0xf147007e
-#define F0900_GPIO7_XOR  0xf1470001
+#define R0900_GPIO7CFG 0xf147
+#define F0900_GPIO7_OPD 0xf1470080
+#define F0900_GPIO7_CONFIG 0xf147007e
+#define F0900_GPIO7_XOR 0xf1470001
 
 /*GPIO8CFG*/
-#define R0900_GPIO8CFG  0xf148
-#define F0900_GPIO8_OPD  0xf1480080
-#define F0900_GPIO8_CONFIG  0xf148007e
-#define F0900_GPIO8_XOR  0xf1480001
+#define R0900_GPIO8CFG 0xf148
+#define F0900_GPIO8_OPD 0xf1480080
+#define F0900_GPIO8_CONFIG 0xf148007e
+#define F0900_GPIO8_XOR 0xf1480001
 
 /*GPIO9CFG*/
-#define R0900_GPIO9CFG  0xf149
-#define F0900_GPIO9_OPD  0xf1490080
-#define F0900_GPIO9_CONFIG  0xf149007e
-#define F0900_GPIO9_XOR  0xf1490001
+#define R0900_GPIO9CFG 0xf149
+#define F0900_GPIO9_OPD 0xf1490080
+#define F0900_GPIO9_CONFIG 0xf149007e
+#define F0900_GPIO9_XOR 0xf1490001
 
 /*GPIO10CFG*/
-#define R0900_GPIO10CFG  0xf14a
-#define F0900_GPIO10_OPD  0xf14a0080
-#define F0900_GPIO10_CONFIG  0xf14a007e
-#define F0900_GPIO10_XOR  0xf14a0001
+#define R0900_GPIO10CFG 0xf14a
+#define F0900_GPIO10_OPD 0xf14a0080
+#define F0900_GPIO10_CONFIG 0xf14a007e
+#define F0900_GPIO10_XOR 0xf14a0001
 
 /*GPIO11CFG*/
-#define R0900_GPIO11CFG  0xf14b
-#define F0900_GPIO11_OPD  0xf14b0080
-#define F0900_GPIO11_CONFIG  0xf14b007e
-#define F0900_GPIO11_XOR  0xf14b0001
+#define R0900_GPIO11CFG 0xf14b
+#define F0900_GPIO11_OPD 0xf14b0080
+#define F0900_GPIO11_CONFIG 0xf14b007e
+#define F0900_GPIO11_XOR 0xf14b0001
 
 /*GPIO12CFG*/
-#define R0900_GPIO12CFG  0xf14c
-#define F0900_GPIO12_OPD  0xf14c0080
-#define F0900_GPIO12_CONFIG  0xf14c007e
-#define F0900_GPIO12_XOR  0xf14c0001
+#define R0900_GPIO12CFG 0xf14c
+#define F0900_GPIO12_OPD 0xf14c0080
+#define F0900_GPIO12_CONFIG 0xf14c007e
+#define F0900_GPIO12_XOR 0xf14c0001
 
 /*GPIO13CFG*/
-#define R0900_GPIO13CFG  0xf14d
-#define F0900_GPIO13_OPD  0xf14d0080
-#define F0900_GPIO13_CONFIG  0xf14d007e
-#define F0900_GPIO13_XOR  0xf14d0001
+#define R0900_GPIO13CFG 0xf14d
+#define F0900_GPIO13_OPD 0xf14d0080
+#define F0900_GPIO13_CONFIG 0xf14d007e
+#define F0900_GPIO13_XOR 0xf14d0001
 
 /*CS0CFG*/
-#define R0900_CS0CFG  0xf14e
-#define F0900_CS0_OPD  0xf14e0080
-#define F0900_CS0_CONFIG  0xf14e007e
-#define F0900_CS0_XOR  0xf14e0001
+#define R0900_CS0CFG 0xf14e
+#define F0900_CS0_OPD 0xf14e0080
+#define F0900_CS0_CONFIG 0xf14e007e
+#define F0900_CS0_XOR 0xf14e0001
 
 /*CS1CFG*/
-#define R0900_CS1CFG  0xf14f
-#define F0900_CS1_OPD  0xf14f0080
-#define F0900_CS1_CONFIG  0xf14f007e
-#define F0900_CS1_XOR  0xf14f0001
+#define R0900_CS1CFG 0xf14f
+#define F0900_CS1_OPD 0xf14f0080
+#define F0900_CS1_CONFIG 0xf14f007e
+#define F0900_CS1_XOR 0xf14f0001
 
 /*STDBYCFG*/
-#define R0900_STDBYCFG  0xf150
-#define F0900_STDBY_OPD  0xf1500080
-#define F0900_STDBY_CONFIG  0xf150007e
-#define F0900_STBDY_XOR  0xf1500001
+#define R0900_STDBYCFG 0xf150
+#define F0900_STDBY_OPD 0xf1500080
+#define F0900_STDBY_CONFIG 0xf150007e
+#define F0900_STBDY_XOR 0xf1500001
 
 /*DIRCLKCFG*/
-#define R0900_DIRCLKCFG  0xf151
-#define F0900_DIRCLK_OPD  0xf1510080
-#define F0900_DIRCLK_CONFIG  0xf151007e
-#define F0900_DIRCLK_XOR  0xf1510001
+#define R0900_DIRCLKCFG 0xf151
+#define F0900_DIRCLK_OPD 0xf1510080
+#define F0900_DIRCLK_CONFIG 0xf151007e
+#define F0900_DIRCLK_XOR 0xf1510001
 
 /*AGCRF1CFG*/
-#define R0900_AGCRF1CFG  0xf152
-#define F0900_AGCRF1_OPD  0xf1520080
-#define F0900_AGCRF1_CONFIG  0xf152007e
-#define F0900_AGCRF1_XOR  0xf1520001
+#define R0900_AGCRF1CFG 0xf152
+#define F0900_AGCRF1_OPD 0xf1520080
+#define F0900_AGCRF1_CONFIG 0xf152007e
+#define F0900_AGCRF1_XOR 0xf1520001
 
 /*SDAT1CFG*/
-#define R0900_SDAT1CFG  0xf153
-#define F0900_SDAT1_OPD  0xf1530080
-#define F0900_SDAT1_CONFIG  0xf153007e
-#define F0900_SDAT1_XOR  0xf1530001
+#define R0900_SDAT1CFG 0xf153
+#define F0900_SDAT1_OPD 0xf1530080
+#define F0900_SDAT1_CONFIG 0xf153007e
+#define F0900_SDAT1_XOR 0xf1530001
 
 /*SCLT1CFG*/
-#define R0900_SCLT1CFG  0xf154
-#define F0900_SCLT1_OPD  0xf1540080
-#define F0900_SCLT1_CONFIG  0xf154007e
-#define F0900_SCLT1_XOR  0xf1540001
+#define R0900_SCLT1CFG 0xf154
+#define F0900_SCLT1_OPD 0xf1540080
+#define F0900_SCLT1_CONFIG 0xf154007e
+#define F0900_SCLT1_XOR 0xf1540001
 
 /*DISEQCO1CFG*/
-#define R0900_DISEQCO1CFG  0xf155
-#define F0900_DISEQCO1_OPD  0xf1550080
-#define F0900_DISEQCO1_CONFIG  0xf155007e
-#define F0900_DISEQC1_XOR  0xf1550001
+#define R0900_DISEQCO1CFG 0xf155
+#define F0900_DISEQCO1_OPD 0xf1550080
+#define F0900_DISEQCO1_CONFIG 0xf155007e
+#define F0900_DISEQC1_XOR 0xf1550001
 
 /*AGCRF2CFG*/
-#define R0900_AGCRF2CFG  0xf156
-#define F0900_AGCRF2_OPD  0xf1560080
-#define F0900_AGCRF2_CONFIG  0xf156007e
-#define F0900_AGCRF2_XOR  0xf1560001
+#define R0900_AGCRF2CFG 0xf156
+#define F0900_AGCRF2_OPD 0xf1560080
+#define F0900_AGCRF2_CONFIG 0xf156007e
+#define F0900_AGCRF2_XOR 0xf1560001
 
 /*SDAT2CFG*/
-#define R0900_SDAT2CFG  0xf157
-#define F0900_SDAT2_OPD  0xf1570080
-#define F0900_SDAT2_CONFIG  0xf157007e
-#define F0900_SDAT2_XOR  0xf1570001
+#define R0900_SDAT2CFG 0xf157
+#define F0900_SDAT2_OPD 0xf1570080
+#define F0900_SDAT2_CONFIG 0xf157007e
+#define F0900_SDAT2_XOR 0xf1570001
 
 /*SCLT2CFG*/
-#define R0900_SCLT2CFG  0xf158
-#define F0900_SCLT2_OPD  0xf1580080
-#define F0900_SCLT2_CONFIG  0xf158007e
-#define F0900_SCLT2_XOR  0xf1580001
+#define R0900_SCLT2CFG 0xf158
+#define F0900_SCLT2_OPD 0xf1580080
+#define F0900_SCLT2_CONFIG 0xf158007e
+#define F0900_SCLT2_XOR 0xf1580001
 
 /*DISEQCO2CFG*/
-#define R0900_DISEQCO2CFG  0xf159
-#define F0900_DISEQCO2_OPD  0xf1590080
-#define F0900_DISEQCO2_CONFIG  0xf159007e
-#define F0900_DISEQC2_XOR  0xf1590001
+#define R0900_DISEQCO2CFG 0xf159
+#define F0900_DISEQCO2_OPD 0xf1590080
+#define F0900_DISEQCO2_CONFIG 0xf159007e
+#define F0900_DISEQC2_XOR 0xf1590001
 
 /*CLKOUT27CFG*/
-#define R0900_CLKOUT27CFG  0xf15a
-#define F0900_CLKOUT27_OPD  0xf15a0080
-#define F0900_CLKOUT27_CONFIG  0xf15a007e
-#define F0900_CLKOUT27_XOR  0xf15a0001
+#define R0900_CLKOUT27CFG 0xf15a
+#define F0900_CLKOUT27_OPD 0xf15a0080
+#define F0900_CLKOUT27_CONFIG 0xf15a007e
+#define F0900_CLKOUT27_XOR 0xf15a0001
 
 /*ERROR1CFG*/
-#define R0900_ERROR1CFG  0xf15b
-#define F0900_ERROR1_OPD  0xf15b0080
-#define F0900_ERROR1_CONFIG  0xf15b007e
-#define F0900_ERROR1_XOR  0xf15b0001
+#define R0900_ERROR1CFG 0xf15b
+#define F0900_ERROR1_OPD 0xf15b0080
+#define F0900_ERROR1_CONFIG 0xf15b007e
+#define F0900_ERROR1_XOR 0xf15b0001
 
 /*DPN1CFG*/
-#define R0900_DPN1CFG  0xf15c
-#define F0900_DPN1_OPD  0xf15c0080
-#define F0900_DPN1_CONFIG  0xf15c007e
-#define F0900_DPN1_XOR  0xf15c0001
+#define R0900_DPN1CFG 0xf15c
+#define F0900_DPN1_OPD 0xf15c0080
+#define F0900_DPN1_CONFIG 0xf15c007e
+#define F0900_DPN1_XOR 0xf15c0001
 
 /*STROUT1CFG*/
-#define R0900_STROUT1CFG  0xf15d
-#define F0900_STROUT1_OPD  0xf15d0080
-#define F0900_STROUT1_CONFIG  0xf15d007e
-#define F0900_STROUT1_XOR  0xf15d0001
+#define R0900_STROUT1CFG 0xf15d
+#define F0900_STROUT1_OPD 0xf15d0080
+#define F0900_STROUT1_CONFIG 0xf15d007e
+#define F0900_STROUT1_XOR 0xf15d0001
 
 /*CLKOUT1CFG*/
-#define R0900_CLKOUT1CFG  0xf15e
-#define F0900_CLKOUT1_OPD  0xf15e0080
-#define F0900_CLKOUT1_CONFIG  0xf15e007e
-#define F0900_CLKOUT1_XOR  0xf15e0001
+#define R0900_CLKOUT1CFG 0xf15e
+#define F0900_CLKOUT1_OPD 0xf15e0080
+#define F0900_CLKOUT1_CONFIG 0xf15e007e
+#define F0900_CLKOUT1_XOR 0xf15e0001
 
 /*DATA71CFG*/
-#define R0900_DATA71CFG  0xf15f
-#define F0900_DATA71_OPD  0xf15f0080
-#define F0900_DATA71_CONFIG  0xf15f007e
-#define F0900_DATA71_XOR  0xf15f0001
+#define R0900_DATA71CFG 0xf15f
+#define F0900_DATA71_OPD 0xf15f0080
+#define F0900_DATA71_CONFIG 0xf15f007e
+#define F0900_DATA71_XOR 0xf15f0001
 
 /*ERROR2CFG*/
-#define R0900_ERROR2CFG  0xf160
-#define F0900_ERROR2_OPD  0xf1600080
-#define F0900_ERROR2_CONFIG  0xf160007e
-#define F0900_ERROR2_XOR  0xf1600001
+#define R0900_ERROR2CFG 0xf160
+#define F0900_ERROR2_OPD 0xf1600080
+#define F0900_ERROR2_CONFIG 0xf160007e
+#define F0900_ERROR2_XOR 0xf1600001
 
 /*DPN2CFG*/
-#define R0900_DPN2CFG  0xf161
-#define F0900_DPN2_OPD  0xf1610080
-#define F0900_DPN2_CONFIG  0xf161007e
-#define F0900_DPN2_XOR  0xf1610001
+#define R0900_DPN2CFG 0xf161
+#define F0900_DPN2_OPD 0xf1610080
+#define F0900_DPN2_CONFIG 0xf161007e
+#define F0900_DPN2_XOR 0xf1610001
 
 /*STROUT2CFG*/
-#define R0900_STROUT2CFG  0xf162
-#define F0900_STROUT2_OPD  0xf1620080
-#define F0900_STROUT2_CONFIG  0xf162007e
-#define F0900_STROUT2_XOR  0xf1620001
+#define R0900_STROUT2CFG 0xf162
+#define F0900_STROUT2_OPD 0xf1620080
+#define F0900_STROUT2_CONFIG 0xf162007e
+#define F0900_STROUT2_XOR 0xf1620001
 
 /*CLKOUT2CFG*/
-#define R0900_CLKOUT2CFG  0xf163
-#define F0900_CLKOUT2_OPD  0xf1630080
-#define F0900_CLKOUT2_CONFIG  0xf163007e
-#define F0900_CLKOUT2_XOR  0xf1630001
+#define R0900_CLKOUT2CFG 0xf163
+#define F0900_CLKOUT2_OPD 0xf1630080
+#define F0900_CLKOUT2_CONFIG 0xf163007e
+#define F0900_CLKOUT2_XOR 0xf1630001
 
 /*DATA72CFG*/
-#define R0900_DATA72CFG  0xf164
-#define F0900_DATA72_OPD  0xf1640080
-#define F0900_DATA72_CONFIG  0xf164007e
-#define F0900_DATA72_XOR  0xf1640001
+#define R0900_DATA72CFG 0xf164
+#define F0900_DATA72_OPD 0xf1640080
+#define F0900_DATA72_CONFIG 0xf164007e
+#define F0900_DATA72_XOR 0xf1640001
 
 /*ERROR3CFG*/
-#define R0900_ERROR3CFG  0xf165
-#define F0900_ERROR3_OPD  0xf1650080
-#define F0900_ERROR3_CONFIG  0xf165007e
-#define F0900_ERROR3_XOR  0xf1650001
+#define R0900_ERROR3CFG 0xf165
+#define F0900_ERROR3_OPD 0xf1650080
+#define F0900_ERROR3_CONFIG 0xf165007e
+#define F0900_ERROR3_XOR 0xf1650001
 
 /*DPN3CFG*/
-#define R0900_DPN3CFG  0xf166
-#define F0900_DPN3_OPD  0xf1660080
-#define F0900_DPN3_CONFIG  0xf166007e
-#define F0900_DPN3_XOR  0xf1660001
+#define R0900_DPN3CFG 0xf166
+#define F0900_DPN3_OPD 0xf1660080
+#define F0900_DPN3_CONFIG 0xf166007e
+#define F0900_DPN3_XOR 0xf1660001
 
 /*STROUT3CFG*/
-#define R0900_STROUT3CFG  0xf167
-#define F0900_STROUT3_OPD  0xf1670080
-#define F0900_STROUT3_CONFIG  0xf167007e
-#define F0900_STROUT3_XOR  0xf1670001
+#define R0900_STROUT3CFG 0xf167
+#define F0900_STROUT3_OPD 0xf1670080
+#define F0900_STROUT3_CONFIG 0xf167007e
+#define F0900_STROUT3_XOR 0xf1670001
 
 /*CLKOUT3CFG*/
-#define R0900_CLKOUT3CFG  0xf168
-#define F0900_CLKOUT3_OPD  0xf1680080
-#define F0900_CLKOUT3_CONFIG  0xf168007e
-#define F0900_CLKOUT3_XOR  0xf1680001
+#define R0900_CLKOUT3CFG 0xf168
+#define F0900_CLKOUT3_OPD 0xf1680080
+#define F0900_CLKOUT3_CONFIG 0xf168007e
+#define F0900_CLKOUT3_XOR 0xf1680001
 
 /*DATA73CFG*/
-#define R0900_DATA73CFG  0xf169
-#define F0900_DATA73_OPD  0xf1690080
-#define F0900_DATA73_CONFIG  0xf169007e
-#define F0900_DATA73_XOR  0xf1690001
+#define R0900_DATA73CFG 0xf169
+#define F0900_DATA73_OPD 0xf1690080
+#define F0900_DATA73_CONFIG 0xf169007e
+#define F0900_DATA73_XOR 0xf1690001
+
+/*STRSTATUS1*/
+#define R0900_STRSTATUS1 0xf16a
+#define F0900_STRSTATUS_SEL2 0xf16a00f0
+#define F0900_STRSTATUS_SEL1 0xf16a000f
+
+/*STRSTATUS2*/
+#define R0900_STRSTATUS2 0xf16b
+#define F0900_STRSTATUS_SEL4 0xf16b00f0
+#define F0900_STRSTATUS_SEL3 0xf16b000f
+
+/*STRSTATUS3*/
+#define R0900_STRSTATUS3 0xf16c
+#define F0900_STRSTATUS_SEL6 0xf16c00f0
+#define F0900_STRSTATUS_SEL5 0xf16c000f
 
 /*FSKTFC2*/
-#define R0900_FSKTFC2  0xf170
-#define F0900_FSKT_KMOD  0xf17000fc
-#define F0900_FSKT_CAR2  0xf1700003
+#define R0900_FSKTFC2 0xf170
+#define F0900_FSKT_KMOD 0xf17000fc
+#define F0900_FSKT_CAR2 0xf1700003
 
 /*FSKTFC1*/
-#define R0900_FSKTFC1  0xf171
-#define F0900_FSKT_CAR1  0xf17100ff
+#define R0900_FSKTFC1 0xf171
+#define F0900_FSKT_CAR1 0xf17100ff
 
 /*FSKTFC0*/
-#define R0900_FSKTFC0  0xf172
-#define F0900_FSKT_CAR0  0xf17200ff
+#define R0900_FSKTFC0 0xf172
+#define F0900_FSKT_CAR0 0xf17200ff
 
 /*FSKTDELTAF1*/
-#define R0900_FSKTDELTAF1  0xf173
-#define F0900_FSKT_DELTAF1  0xf173000f
+#define R0900_FSKTDELTAF1 0xf173
+#define F0900_FSKT_DELTAF1 0xf173000f
 
 /*FSKTDELTAF0*/
-#define R0900_FSKTDELTAF0  0xf174
-#define F0900_FSKT_DELTAF0  0xf17400ff
+#define R0900_FSKTDELTAF0 0xf174
+#define F0900_FSKT_DELTAF0 0xf17400ff
 
 /*FSKTCTRL*/
-#define R0900_FSKTCTRL  0xf175
-#define F0900_FSKT_EN_SGN  0xf1750040
-#define F0900_FSKT_MOD_SGN  0xf1750020
-#define F0900_FSKT_MOD_EN  0xf175001c
-#define F0900_FSKT_DACMODE  0xf1750003
+#define R0900_FSKTCTRL 0xf175
+#define F0900_FSKT_EN_SGN 0xf1750040
+#define F0900_FSKT_MOD_SGN 0xf1750020
+#define F0900_FSKT_MOD_EN 0xf175001c
+#define F0900_FSKT_DACMODE 0xf1750003
 
 /*FSKRFC2*/
-#define R0900_FSKRFC2  0xf176
-#define F0900_FSKR_DETSGN  0xf1760040
-#define F0900_FSKR_OUTSGN  0xf1760020
-#define F0900_FSKR_KAGC  0xf176001c
-#define F0900_FSKR_CAR2  0xf1760003
+#define R0900_FSKRFC2 0xf176
+#define F0900_FSKR_DETSGN 0xf1760040
+#define F0900_FSKR_OUTSGN 0xf1760020
+#define F0900_FSKR_KAGC 0xf176001c
+#define F0900_FSKR_CAR2 0xf1760003
 
 /*FSKRFC1*/
-#define R0900_FSKRFC1  0xf177
-#define F0900_FSKR_CAR1  0xf17700ff
+#define R0900_FSKRFC1 0xf177
+#define F0900_FSKR_CAR1 0xf17700ff
 
 /*FSKRFC0*/
-#define R0900_FSKRFC0  0xf178
-#define F0900_FSKR_CAR0  0xf17800ff
+#define R0900_FSKRFC0 0xf178
+#define F0900_FSKR_CAR0 0xf17800ff
 
 /*FSKRK1*/
-#define R0900_FSKRK1  0xf179
-#define F0900_FSKR_K1_EXP  0xf17900e0
-#define F0900_FSKR_K1_MANT  0xf179001f
+#define R0900_FSKRK1 0xf179
+#define F0900_FSKR_K1_EXP 0xf17900e0
+#define F0900_FSKR_K1_MANT 0xf179001f
 
 /*FSKRK2*/
-#define R0900_FSKRK2  0xf17a
-#define F0900_FSKR_K2_EXP  0xf17a00e0
-#define F0900_FSKR_K2_MANT  0xf17a001f
+#define R0900_FSKRK2 0xf17a
+#define F0900_FSKR_K2_EXP 0xf17a00e0
+#define F0900_FSKR_K2_MANT 0xf17a001f
 
 /*FSKRAGCR*/
-#define R0900_FSKRAGCR  0xf17b
-#define F0900_FSKR_OUTCTL  0xf17b00c0
-#define F0900_FSKR_AGC_REF  0xf17b003f
+#define R0900_FSKRAGCR 0xf17b
+#define F0900_FSKR_OUTCTL 0xf17b00c0
+#define F0900_FSKR_AGC_REF 0xf17b003f
 
 /*FSKRAGC*/
-#define R0900_FSKRAGC  0xf17c
-#define F0900_FSKR_AGC_ACCU  0xf17c00ff
+#define R0900_FSKRAGC 0xf17c
+#define F0900_FSKR_AGC_ACCU 0xf17c00ff
 
 /*FSKRALPHA*/
-#define R0900_FSKRALPHA  0xf17d
-#define F0900_FSKR_ALPHA_EXP  0xf17d001c
-#define F0900_FSKR_ALPHA_M  0xf17d0003
+#define R0900_FSKRALPHA 0xf17d
+#define F0900_FSKR_ALPHA_EXP 0xf17d001c
+#define F0900_FSKR_ALPHA_M 0xf17d0003
 
 /*FSKRPLTH1*/
-#define R0900_FSKRPLTH1  0xf17e
-#define F0900_FSKR_BETA  0xf17e00f0
-#define F0900_FSKR_PLL_TRESH1  0xf17e000f
+#define R0900_FSKRPLTH1 0xf17e
+#define F0900_FSKR_BETA 0xf17e00f0
+#define F0900_FSKR_PLL_TRESH1 0xf17e000f
 
 /*FSKRPLTH0*/
-#define R0900_FSKRPLTH0  0xf17f
-#define F0900_FSKR_PLL_TRESH0  0xf17f00ff
+#define R0900_FSKRPLTH0 0xf17f
+#define F0900_FSKR_PLL_TRESH0 0xf17f00ff
 
 /*FSKRDF1*/
-#define R0900_FSKRDF1  0xf180
-#define F0900_FSKR_OUT  0xf1800080
-#define F0900_FSKR_DELTAF1  0xf180001f
+#define R0900_FSKRDF1 0xf180
+#define F0900_FSKR_OUT 0xf1800080
+#define F0900_FSKR_DELTAF1 0xf180001f
 
 /*FSKRDF0*/
-#define R0900_FSKRDF0  0xf181
-#define F0900_FSKR_DELTAF0  0xf18100ff
+#define R0900_FSKRDF0 0xf181
+#define F0900_FSKR_DELTAF0 0xf18100ff
 
 /*FSKRSTEPP*/
-#define R0900_FSKRSTEPP  0xf182
-#define F0900_FSKR_STEP_PLUS  0xf18200ff
+#define R0900_FSKRSTEPP 0xf182
+#define F0900_FSKR_STEP_PLUS 0xf18200ff
 
 /*FSKRSTEPM*/
-#define R0900_FSKRSTEPM  0xf183
-#define F0900_FSKR_STEP_MINUS  0xf18300ff
+#define R0900_FSKRSTEPM 0xf183
+#define F0900_FSKR_STEP_MINUS 0xf18300ff
 
 /*FSKRDET1*/
-#define R0900_FSKRDET1  0xf184
-#define F0900_FSKR_DETECT  0xf1840080
-#define F0900_FSKR_CARDET_ACCU1  0xf184000f
+#define R0900_FSKRDET1 0xf184
+#define F0900_FSKR_DETECT 0xf1840080
+#define F0900_FSKR_CARDET_ACCU1 0xf184000f
 
 /*FSKRDET0*/
-#define R0900_FSKRDET0  0xf185
-#define F0900_FSKR_CARDET_ACCU0  0xf18500ff
+#define R0900_FSKRDET0 0xf185
+#define F0900_FSKR_CARDET_ACCU0 0xf18500ff
 
 /*FSKRDTH1*/
-#define R0900_FSKRDTH1  0xf186
-#define F0900_FSKR_CARLOSS_THRESH1  0xf18600f0
-#define F0900_FSKR_CARDET_THRESH1  0xf186000f
+#define R0900_FSKRDTH1 0xf186
+#define F0900_FSKR_CARLOSS_THRESH1 0xf18600f0
+#define F0900_FSKR_CARDET_THRESH1 0xf186000f
 
 /*FSKRDTH0*/
-#define R0900_FSKRDTH0  0xf187
-#define F0900_FSKR_CARDET_THRESH0  0xf18700ff
+#define R0900_FSKRDTH0 0xf187
+#define F0900_FSKR_CARDET_THRESH0 0xf18700ff
 
 /*FSKRLOSS*/
-#define R0900_FSKRLOSS  0xf188
-#define F0900_FSKR_CARLOSS_THRESH0  0xf18800ff
+#define R0900_FSKRLOSS 0xf188
+#define F0900_FSKR_CARLOSS_THRESH0 0xf18800ff
 
 /*P2_DISTXCTL*/
-#define R0900_P2_DISTXCTL  0xf190
-#define F0900_P2_TIM_OFF  0xf1900080
-#define F0900_P2_DISEQC_RESET  0xf1900040
-#define F0900_P2_TIM_CMD  0xf1900030
-#define F0900_P2_DIS_PRECHARGE  0xf1900008
-#define F0900_P2_DISTX_MODE  0xf1900007
+#define R0900_P2_DISTXCTL 0xf190
+#define F0900_P2_TIM_OFF 0xf1900080
+#define F0900_P2_DISEQC_RESET 0xf1900040
+#define F0900_P2_TIM_CMD 0xf1900030
+#define F0900_P2_DIS_PRECHARGE 0xf1900008
+#define F0900_P2_DISTX_MODE 0xf1900007
 
 /*P2_DISRXCTL*/
-#define R0900_P2_DISRXCTL  0xf191
-#define F0900_P2_RECEIVER_ON  0xf1910080
-#define F0900_P2_IGNO_SHORT22K  0xf1910040
-#define F0900_P2_ONECHIP_TRX  0xf1910020
-#define F0900_P2_EXT_ENVELOP  0xf1910010
-#define F0900_P2_PIN_SELECT  0xf191000c
-#define F0900_P2_IRQ_RXEND  0xf1910002
-#define F0900_P2_IRQ_4NBYTES  0xf1910001
+#define R0900_P2_DISRXCTL 0xf191
+#define F0900_P2_RECEIVER_ON 0xf1910080
+#define F0900_P2_IGNO_SHORT22K 0xf1910040
+#define F0900_P2_ONECHIP_TRX 0xf1910020
+#define F0900_P2_EXT_ENVELOP 0xf1910010
+#define F0900_P2_PIN_SELECT0 0xf191000c
+#define F0900_P2_IRQ_RXEND 0xf1910002
+#define F0900_P2_IRQ_4NBYTES 0xf1910001
 
 /*P2_DISRX_ST0*/
-#define R0900_P2_DISRX_ST0  0xf194
-#define F0900_P2_RX_END  0xf1940080
-#define F0900_P2_RX_ACTIVE  0xf1940040
-#define F0900_P2_SHORT_22KHZ  0xf1940020
-#define F0900_P2_CONT_TONE  0xf1940010
-#define F0900_P2_FIFO_4BREADY  0xf1940008
-#define F0900_P2_FIFO_EMPTY  0xf1940004
-#define F0900_P2_ABORT_DISRX  0xf1940001
+#define R0900_P2_DISRX_ST0 0xf194
+#define F0900_P2_RX_END 0xf1940080
+#define F0900_P2_RX_ACTIVE 0xf1940040
+#define F0900_P2_SHORT_22KHZ 0xf1940020
+#define F0900_P2_CONT_TONE 0xf1940010
+#define F0900_P2_FIFO_4BREADY 0xf1940008
+#define F0900_P2_FIFO_EMPTY 0xf1940004
+#define F0900_P2_ABORT_DISRX 0xf1940001
 
 /*P2_DISRX_ST1*/
-#define R0900_P2_DISRX_ST1  0xf195
-#define F0900_P2_RX_FAIL  0xf1950080
-#define F0900_P2_FIFO_PARITYFAIL  0xf1950040
-#define F0900_P2_RX_NONBYTE  0xf1950020
-#define F0900_P2_FIFO_OVERFLOW  0xf1950010
-#define F0900_P2_FIFO_BYTENBR  0xf195000f
+#define R0900_P2_DISRX_ST1 0xf195
+#define F0900_P2_RX_FAIL 0xf1950080
+#define F0900_P2_FIFO_PARITYFAIL 0xf1950040
+#define F0900_P2_RX_NONBYTE 0xf1950020
+#define F0900_P2_FIFO_OVERFLOW 0xf1950010
+#define F0900_P2_FIFO_BYTENBR 0xf195000f
 
 /*P2_DISRXDATA*/
-#define R0900_P2_DISRXDATA  0xf196
-#define F0900_P2_DISRX_DATA  0xf19600ff
+#define R0900_P2_DISRXDATA 0xf196
+#define F0900_P2_DISRX_DATA 0xf19600ff
 
 /*P2_DISTXDATA*/
-#define R0900_P2_DISTXDATA  0xf197
-#define F0900_P2_DISEQC_FIFO  0xf19700ff
+#define R0900_P2_DISTXDATA 0xf197
+#define F0900_P2_DISEQC_FIFO 0xf19700ff
 
 /*P2_DISTXSTATUS*/
-#define R0900_P2_DISTXSTATUS  0xf198
-#define F0900_P2_TX_FAIL  0xf1980080
-#define F0900_P2_FIFO_FULL  0xf1980040
-#define F0900_P2_TX_IDLE  0xf1980020
-#define F0900_P2_GAP_BURST  0xf1980010
-#define F0900_P2_TXFIFO_BYTES  0xf198000f
+#define R0900_P2_DISTXSTATUS 0xf198
+#define F0900_P2_TX_FAIL 0xf1980080
+#define F0900_P2_FIFO_FULL 0xf1980040
+#define F0900_P2_TX_IDLE 0xf1980020
+#define F0900_P2_GAP_BURST 0xf1980010
+#define F0900_P2_TXFIFO_BYTES 0xf198000f
 
 /*P2_F22TX*/
-#define R0900_P2_F22TX  0xf199
-#define F0900_P2_F22_REG  0xf19900ff
+#define R0900_P2_F22TX 0xf199
+#define F0900_P2_F22_REG 0xf19900ff
 
 /*P2_F22RX*/
-#define R0900_P2_F22RX  0xf19a
-#define F0900_P2_F22RX_REG  0xf19a00ff
+#define R0900_P2_F22RX 0xf19a
+#define F0900_P2_F22RX_REG 0xf19a00ff
 
 /*P2_ACRPRESC*/
-#define R0900_P2_ACRPRESC  0xf19c
-#define F0900_P2_ACR_CODFRDY  0xf19c0008
-#define F0900_P2_ACR_PRESC  0xf19c0007
+#define R0900_P2_ACRPRESC 0xf19c
+#define F0900_P2_ACR_PRESC 0xf19c0007
 
 /*P2_ACRDIV*/
-#define R0900_P2_ACRDIV  0xf19d
-#define F0900_P2_ACR_DIV  0xf19d00ff
+#define R0900_P2_ACRDIV 0xf19d
+#define F0900_P2_ACR_DIV 0xf19d00ff
 
 /*P1_DISTXCTL*/
-#define R0900_P1_DISTXCTL  0xf1a0
-#define F0900_P1_TIM_OFF  0xf1a00080
-#define F0900_P1_DISEQC_RESET  0xf1a00040
-#define F0900_P1_TIM_CMD  0xf1a00030
-#define F0900_P1_DIS_PRECHARGE  0xf1a00008
-#define F0900_P1_DISTX_MODE  0xf1a00007
+#define R0900_P1_DISTXCTL 0xf1a0
+#define DISTXCTL shiftx(R0900_P1_DISTXCTL, demod, 0x10)
+#define F0900_P1_TIM_OFF 0xf1a00080
+#define F0900_P1_DISEQC_RESET 0xf1a00040
+#define DISEQC_RESET shiftx(F0900_P1_DISEQC_RESET, demod, 0x100000)
+#define F0900_P1_TIM_CMD 0xf1a00030
+#define F0900_P1_DIS_PRECHARGE 0xf1a00008
+#define DIS_PRECHARGE shiftx(F0900_P1_DIS_PRECHARGE, demod, 0x100000)
+#define F0900_P1_DISTX_MODE 0xf1a00007
+#define DISTX_MODE shiftx(F0900_P1_DISTX_MODE, demod, 0x100000)
 
 /*P1_DISRXCTL*/
-#define R0900_P1_DISRXCTL  0xf1a1
-#define F0900_P1_RECEIVER_ON  0xf1a10080
-#define F0900_P1_IGNO_SHORT22K  0xf1a10040
-#define F0900_P1_ONECHIP_TRX  0xf1a10020
-#define F0900_P1_EXT_ENVELOP  0xf1a10010
-#define F0900_P1_PIN_SELECT  0xf1a1000c
-#define F0900_P1_IRQ_RXEND  0xf1a10002
-#define F0900_P1_IRQ_4NBYTES  0xf1a10001
+#define R0900_P1_DISRXCTL 0xf1a1
+#define DISRXCTL shiftx(R0900_P1_DISRXCTL, demod, 0x10)
+#define F0900_P1_RECEIVER_ON 0xf1a10080
+#define F0900_P1_IGNO_SHORT22K 0xf1a10040
+#define F0900_P1_ONECHIP_TRX 0xf1a10020
+#define F0900_P1_EXT_ENVELOP 0xf1a10010
+#define F0900_P1_PIN_SELECT0 0xf1a1000c
+#define F0900_P1_IRQ_RXEND 0xf1a10002
+#define F0900_P1_IRQ_4NBYTES 0xf1a10001
 
 /*P1_DISRX_ST0*/
-#define R0900_P1_DISRX_ST0  0xf1a4
-#define F0900_P1_RX_END  0xf1a40080
-#define F0900_P1_RX_ACTIVE  0xf1a40040
-#define F0900_P1_SHORT_22KHZ  0xf1a40020
-#define F0900_P1_CONT_TONE  0xf1a40010
-#define F0900_P1_FIFO_4BREADY  0xf1a40008
-#define F0900_P1_FIFO_EMPTY  0xf1a40004
-#define F0900_P1_ABORT_DISRX  0xf1a40001
+#define R0900_P1_DISRX_ST0 0xf1a4
+#define DISRX_ST0 shiftx(R0900_P1_DISRX_ST0, demod, 0x10)
+#define F0900_P1_RX_END 0xf1a40080
+#define RX_END shiftx(F0900_P1_RX_END, demod, 0x100000)
+#define F0900_P1_RX_ACTIVE 0xf1a40040
+#define F0900_P1_SHORT_22KHZ 0xf1a40020
+#define F0900_P1_CONT_TONE 0xf1a40010
+#define F0900_P1_FIFO_4BREADY 0xf1a40008
+#define F0900_P1_FIFO_EMPTY 0xf1a40004
+#define F0900_P1_ABORT_DISRX 0xf1a40001
 
 /*P1_DISRX_ST1*/
-#define R0900_P1_DISRX_ST1  0xf1a5
-#define F0900_P1_RX_FAIL  0xf1a50080
-#define F0900_P1_FIFO_PARITYFAIL  0xf1a50040
-#define F0900_P1_RX_NONBYTE  0xf1a50020
-#define F0900_P1_FIFO_OVERFLOW  0xf1a50010
-#define F0900_P1_FIFO_BYTENBR  0xf1a5000f
+#define R0900_P1_DISRX_ST1 0xf1a5
+#define DISRX_ST1 shiftx(R0900_P1_DISRX_ST1, demod, 0x10)
+#define F0900_P1_RX_FAIL 0xf1a50080
+#define F0900_P1_FIFO_PARITYFAIL 0xf1a50040
+#define F0900_P1_RX_NONBYTE 0xf1a50020
+#define F0900_P1_FIFO_OVERFLOW 0xf1a50010
+#define F0900_P1_FIFO_BYTENBR 0xf1a5000f
+#define FIFO_BYTENBR shiftx(F0900_P1_FIFO_BYTENBR, demod, 0x100000)
 
 /*P1_DISRXDATA*/
-#define R0900_P1_DISRXDATA  0xf1a6
-#define F0900_P1_DISRX_DATA  0xf1a600ff
+#define R0900_P1_DISRXDATA 0xf1a6
+#define DISRXDATA shiftx(R0900_P1_DISRXDATA, demod, 0x10)
+#define F0900_P1_DISRX_DATA 0xf1a600ff
 
 /*P1_DISTXDATA*/
-#define R0900_P1_DISTXDATA  0xf1a7
-#define F0900_P1_DISEQC_FIFO  0xf1a700ff
+#define R0900_P1_DISTXDATA 0xf1a7
+#define DISTXDATA shiftx(R0900_P1_DISTXDATA, demod, 0x10)
+#define F0900_P1_DISEQC_FIFO 0xf1a700ff
 
 /*P1_DISTXSTATUS*/
-#define R0900_P1_DISTXSTATUS  0xf1a8
-#define F0900_P1_TX_FAIL  0xf1a80080
-#define F0900_P1_FIFO_FULL  0xf1a80040
-#define F0900_P1_TX_IDLE  0xf1a80020
-#define F0900_P1_GAP_BURST  0xf1a80010
-#define F0900_P1_TXFIFO_BYTES  0xf1a8000f
+#define R0900_P1_DISTXSTATUS 0xf1a8
+#define F0900_P1_TX_FAIL 0xf1a80080
+#define F0900_P1_FIFO_FULL 0xf1a80040
+#define FIFO_FULL shiftx(F0900_P1_FIFO_FULL, demod, 0x100000)
+#define F0900_P1_TX_IDLE 0xf1a80020
+#define TX_IDLE shiftx(F0900_P1_TX_IDLE, demod, 0x100000)
+#define F0900_P1_GAP_BURST 0xf1a80010
+#define F0900_P1_TXFIFO_BYTES 0xf1a8000f
 
 /*P1_F22TX*/
-#define R0900_P1_F22TX  0xf1a9
-#define F0900_P1_F22_REG  0xf1a900ff
+#define R0900_P1_F22TX 0xf1a9
+#define F22TX shiftx(R0900_P1_F22TX, demod, 0x10)
+#define F0900_P1_F22_REG 0xf1a900ff
 
 /*P1_F22RX*/
-#define R0900_P1_F22RX  0xf1aa
-#define F0900_P1_F22RX_REG  0xf1aa00ff
+#define R0900_P1_F22RX 0xf1aa
+#define F22RX shiftx(R0900_P1_F22RX, demod, 0x10)
+#define F0900_P1_F22RX_REG 0xf1aa00ff
 
 /*P1_ACRPRESC*/
-#define R0900_P1_ACRPRESC  0xf1ac
-#define F0900_P1_ACR_CODFRDY  0xf1ac0008
-#define F0900_P1_ACR_PRESC  0xf1ac0007
+#define R0900_P1_ACRPRESC 0xf1ac
+#define ACRPRESC shiftx(R0900_P1_ACRPRESC, demod, 0x10)
+#define F0900_P1_ACR_PRESC 0xf1ac0007
 
 /*P1_ACRDIV*/
-#define R0900_P1_ACRDIV  0xf1ad
-#define F0900_P1_ACR_DIV  0xf1ad00ff
+#define R0900_P1_ACRDIV 0xf1ad
+#define ACRDIV shiftx(R0900_P1_ACRDIV, demod, 0x10)
+#define F0900_P1_ACR_DIV 0xf1ad00ff
 
 /*NCOARSE*/
-#define R0900_NCOARSE  0xf1b3
-#define F0900_M_DIV  0xf1b300ff
+#define R0900_NCOARSE 0xf1b3
+#define F0900_M_DIV 0xf1b300ff
 
 /*SYNTCTRL*/
-#define R0900_SYNTCTRL  0xf1b6
-#define F0900_STANDBY  0xf1b60080
-#define F0900_BYPASSPLLCORE  0xf1b60040
-#define F0900_SELX1RATIO  0xf1b60020
-#define F0900_I2C_TUD  0xf1b60010
-#define F0900_STOP_PLL  0xf1b60008
-#define F0900_BYPASSPLLFSK  0xf1b60004
-#define F0900_SELOSCI  0xf1b60002
-#define F0900_BYPASSPLLADC  0xf1b60001
+#define R0900_SYNTCTRL 0xf1b6
+#define F0900_STANDBY 0xf1b60080
+#define F0900_BYPASSPLLCORE 0xf1b60040
+#define F0900_SELX1RATIO 0xf1b60020
+#define F0900_STOP_PLL 0xf1b60008
+#define F0900_BYPASSPLLFSK 0xf1b60004
+#define F0900_SELOSCI 0xf1b60002
+#define F0900_BYPASSPLLADC 0xf1b60001
 
 /*FILTCTRL*/
-#define R0900_FILTCTRL  0xf1b7
-#define F0900_INV_CLK135  0xf1b70080
-#define F0900_PERM_BYPDIS  0xf1b70040
-#define F0900_SEL_FSKCKDIV  0xf1b70004
-#define F0900_INV_CLKFSK  0xf1b70002
-#define F0900_BYPASS_APPLI  0xf1b70001
+#define R0900_FILTCTRL 0xf1b7
+#define F0900_INV_CLK135 0xf1b70080
+#define F0900_SEL_FSKCKDIV 0xf1b70004
+#define F0900_INV_CLKFSK 0xf1b70002
+#define F0900_BYPASS_APPLI 0xf1b70001
 
 /*PLLSTAT*/
-#define R0900_PLLSTAT  0xf1b8
-#define F0900_ACM_SEL  0xf1b80080
-#define F0900_DTV_SEL  0xf1b80040
-#define F0900_PLLLOCK  0xf1b80001
+#define R0900_PLLSTAT 0xf1b8
+#define F0900_PLLLOCK 0xf1b80001
 
 /*STOPCLK1*/
-#define R0900_STOPCLK1  0xf1c2
-#define F0900_STOP_CLKPKDT2  0xf1c20040
-#define F0900_STOP_CLKPKDT1  0xf1c20020
-#define F0900_STOP_CLKFEC  0xf1c20010
-#define F0900_STOP_CLKADCI2  0xf1c20008
-#define F0900_INV_CLKADCI2  0xf1c20004
-#define F0900_STOP_CLKADCI1  0xf1c20002
-#define F0900_INV_CLKADCI1  0xf1c20001
+#define R0900_STOPCLK1 0xf1c2
+#define F0900_STOP_CLKPKDT2 0xf1c20040
+#define F0900_STOP_CLKPKDT1 0xf1c20020
+#define F0900_STOP_CLKFEC 0xf1c20010
+#define F0900_STOP_CLKADCI2 0xf1c20008
+#define F0900_INV_CLKADCI2 0xf1c20004
+#define F0900_STOP_CLKADCI1 0xf1c20002
+#define F0900_INV_CLKADCI1 0xf1c20001
 
 /*STOPCLK2*/
-#define R0900_STOPCLK2  0xf1c3
-#define F0900_STOP_CLKSAMP2  0xf1c30010
-#define F0900_STOP_CLKSAMP1  0xf1c30008
-#define F0900_STOP_CLKVIT2  0xf1c30004
-#define F0900_STOP_CLKVIT1  0xf1c30002
-#define F0900_STOP_CLKTS  0xf1c30001
+#define R0900_STOPCLK2 0xf1c3
+#define F0900_STOP_CLKSAMP2 0xf1c30010
+#define F0900_STOP_CLKSAMP1 0xf1c30008
+#define F0900_STOP_CLKVIT2 0xf1c30004
+#define F0900_STOP_CLKVIT1 0xf1c30002
+#define STOP_CLKVIT shiftx(F0900_STOP_CLKVIT1, demod, -2)
+#define F0900_STOP_CLKTS 0xf1c30001
 
 /*TSTTNR0*/
-#define R0900_TSTTNR0  0xf1df
-#define F0900_SEL_FSK  0xf1df0080
-#define F0900_FSK_PON  0xf1df0004
-#define F0900_FSK_OPENLOOP  0xf1df0002
+#define R0900_TSTTNR0 0xf1df
+#define F0900_SEL_FSK 0xf1df0080
+#define F0900_FSK_PON 0xf1df0004
 
 /*TSTTNR1*/
-#define R0900_TSTTNR1  0xf1e0
-#define F0900_BYPASS_ADC1  0xf1e00080
-#define F0900_INVADC1_CKOUT  0xf1e00040
-#define F0900_SELIQSRC1  0xf1e00030
-#define F0900_ADC1_PON  0xf1e00002
-#define F0900_ADC1_INMODE  0xf1e00001
+#define R0900_TSTTNR1 0xf1e0
+#define F0900_ADC1_PON 0xf1e00002
+#define F0900_ADC1_INMODE 0xf1e00001
 
 /*TSTTNR2*/
-#define R0900_TSTTNR2  0xf1e1
-#define F0900_DISEQC1_PON  0xf1e10020
-#define F0900_DISEQC1_TEST  0xf1e1001f
+#define R0900_TSTTNR2 0xf1e1
+#define F0900_DISEQC1_PON 0xf1e10020
 
 /*TSTTNR3*/
-#define R0900_TSTTNR3  0xf1e2
-#define F0900_BYPASS_ADC2  0xf1e20080
-#define F0900_INVADC2_CKOUT  0xf1e20040
-#define F0900_SELIQSRC2  0xf1e20030
-#define F0900_ADC2_PON  0xf1e20002
-#define F0900_ADC2_INMODE  0xf1e20001
+#define R0900_TSTTNR3 0xf1e2
+#define F0900_ADC2_PON 0xf1e20002
+#define F0900_ADC2_INMODE 0xf1e20001
 
 /*TSTTNR4*/
-#define R0900_TSTTNR4  0xf1e3
-#define F0900_DISEQC2_PON  0xf1e30020
-#define F0900_DISEQC2_TEST  0xf1e3001f
+#define R0900_TSTTNR4 0xf1e3
+#define F0900_DISEQC2_PON 0xf1e30020
 
 /*P2_IQCONST*/
-#define R0900_P2_IQCONST  0xf200
-#define F0900_P2_CONSTEL_SELECT  0xf2000060
-#define F0900_P2_IQSYMB_SEL  0xf200001f
+#define R0900_P2_IQCONST 0xf200
+#define F0900_P2_CONSTEL_SELECT 0xf2000060
+#define F0900_P2_IQSYMB_SEL 0xf200001f
 
 /*P2_NOSCFG*/
-#define R0900_P2_NOSCFG  0xf201
-#define F0900_P2_DUMMYPL_NOSDATA  0xf2010020
-#define F0900_P2_NOSPLH_BETA  0xf2010018
-#define F0900_P2_NOSDATA_BETA  0xf2010007
+#define R0900_P2_NOSCFG 0xf201
+#define F0900_P2_DUMMYPL_NOSDATA 0xf2010020
+#define F0900_P2_NOSPLH_BETA 0xf2010018
+#define F0900_P2_NOSDATA_BETA 0xf2010007
 
 /*P2_ISYMB*/
-#define R0900_P2_ISYMB  0xf202
-#define F0900_P2_I_SYMBOL  0xf20201ff
+#define R0900_P2_ISYMB 0xf202
+#define F0900_P2_I_SYMBOL 0xf20201ff
 
 /*P2_QSYMB*/
-#define R0900_P2_QSYMB  0xf203
-#define F0900_P2_Q_SYMBOL  0xf20301ff
+#define R0900_P2_QSYMB 0xf203
+#define F0900_P2_Q_SYMBOL 0xf20301ff
 
 /*P2_AGC1CFG*/
-#define R0900_P2_AGC1CFG  0xf204
-#define F0900_P2_DC_FROZEN  0xf2040080
-#define F0900_P2_DC_CORRECT  0xf2040040
-#define F0900_P2_AMM_FROZEN  0xf2040020
-#define F0900_P2_AMM_CORRECT  0xf2040010
-#define F0900_P2_QUAD_FROZEN  0xf2040008
-#define F0900_P2_QUAD_CORRECT  0xf2040004
-#define F0900_P2_DCCOMP_SLOW  0xf2040002
-#define F0900_P2_IQMISM_SLOW  0xf2040001
+#define R0900_P2_AGC1CFG 0xf204
+#define F0900_P2_DC_FROZEN 0xf2040080
+#define F0900_P2_DC_CORRECT 0xf2040040
+#define F0900_P2_AMM_FROZEN 0xf2040020
+#define F0900_P2_AMM_CORRECT 0xf2040010
+#define F0900_P2_QUAD_FROZEN 0xf2040008
+#define F0900_P2_QUAD_CORRECT 0xf2040004
 
 /*P2_AGC1CN*/
-#define R0900_P2_AGC1CN  0xf206
-#define F0900_P2_AGC1_LOCKED  0xf2060080
-#define F0900_P2_AGC1_OVERFLOW  0xf2060040
-#define F0900_P2_AGC1_NOSLOWLK  0xf2060020
-#define F0900_P2_AGC1_MINPOWER  0xf2060010
-#define F0900_P2_AGCOUT_FAST  0xf2060008
-#define F0900_P2_AGCIQ_BETA  0xf2060007
+#define R0900_P2_AGC1CN 0xf206
+#define F0900_P2_AGC1_LOCKED 0xf2060080
+#define F0900_P2_AGC1_MINPOWER 0xf2060010
+#define F0900_P2_AGCOUT_FAST 0xf2060008
+#define F0900_P2_AGCIQ_BETA 0xf2060007
 
 /*P2_AGC1REF*/
-#define R0900_P2_AGC1REF  0xf207
-#define F0900_P2_AGCIQ_REF  0xf20700ff
+#define R0900_P2_AGC1REF 0xf207
+#define F0900_P2_AGCIQ_REF 0xf20700ff
 
 /*P2_IDCCOMP*/
-#define R0900_P2_IDCCOMP  0xf208
-#define F0900_P2_IAVERAGE_ADJ  0xf20801ff
+#define R0900_P2_IDCCOMP 0xf208
+#define F0900_P2_IAVERAGE_ADJ 0xf20801ff
 
 /*P2_QDCCOMP*/
-#define R0900_P2_QDCCOMP  0xf209
-#define F0900_P2_QAVERAGE_ADJ  0xf20901ff
+#define R0900_P2_QDCCOMP 0xf209
+#define F0900_P2_QAVERAGE_ADJ 0xf20901ff
 
 /*P2_POWERI*/
-#define R0900_P2_POWERI  0xf20a
-#define F0900_P2_POWER_I  0xf20a00ff
+#define R0900_P2_POWERI 0xf20a
+#define F0900_P2_POWER_I 0xf20a00ff
 
 /*P2_POWERQ*/
-#define R0900_P2_POWERQ  0xf20b
-#define F0900_P2_POWER_Q  0xf20b00ff
+#define R0900_P2_POWERQ 0xf20b
+#define F0900_P2_POWER_Q 0xf20b00ff
 
 /*P2_AGC1AMM*/
-#define R0900_P2_AGC1AMM  0xf20c
-#define F0900_P2_AMM_VALUE  0xf20c00ff
+#define R0900_P2_AGC1AMM 0xf20c
+#define F0900_P2_AMM_VALUE 0xf20c00ff
 
 /*P2_AGC1QUAD*/
-#define R0900_P2_AGC1QUAD  0xf20d
-#define F0900_P2_QUAD_VALUE  0xf20d01ff
+#define R0900_P2_AGC1QUAD 0xf20d
+#define F0900_P2_QUAD_VALUE 0xf20d01ff
 
 /*P2_AGCIQIN1*/
-#define R0900_P2_AGCIQIN1  0xf20e
-#define F0900_P2_AGCIQ_VALUE1  0xf20e00ff
+#define R0900_P2_AGCIQIN1 0xf20e
+#define F0900_P2_AGCIQ_VALUE1 0xf20e00ff
 
 /*P2_AGCIQIN0*/
-#define R0900_P2_AGCIQIN0  0xf20f
-#define F0900_P2_AGCIQ_VALUE0  0xf20f00ff
+#define R0900_P2_AGCIQIN0 0xf20f
+#define F0900_P2_AGCIQ_VALUE0 0xf20f00ff
 
 /*P2_DEMOD*/
-#define R0900_P2_DEMOD  0xf210
-#define F0900_P2_DEMOD_STOP  0xf2100040
-#define F0900_P2_SPECINV_CONTROL  0xf2100030
-#define F0900_P2_FORCE_ENASAMP  0xf2100008
-#define F0900_P2_MANUAL_ROLLOFF  0xf2100004
-#define F0900_P2_ROLLOFF_CONTROL  0xf2100003
+#define R0900_P2_DEMOD 0xf210
+#define F0900_P2_MANUALS2_ROLLOFF 0xf2100080
+#define F0900_P2_SPECINV_CONTROL 0xf2100030
+#define F0900_P2_FORCE_ENASAMP 0xf2100008
+#define F0900_P2_MANUALSX_ROLLOFF 0xf2100004
+#define F0900_P2_ROLLOFF_CONTROL 0xf2100003
 
 /*P2_DMDMODCOD*/
-#define R0900_P2_DMDMODCOD  0xf211
-#define F0900_P2_MANUAL_MODCOD  0xf2110080
-#define F0900_P2_DEMOD_MODCOD  0xf211007c
-#define F0900_P2_DEMOD_TYPE  0xf2110003
+#define R0900_P2_DMDMODCOD 0xf211
+#define F0900_P2_MANUAL_MODCOD 0xf2110080
+#define F0900_P2_DEMOD_MODCOD 0xf211007c
+#define F0900_P2_DEMOD_TYPE 0xf2110003
 
 /*P2_DSTATUS*/
-#define R0900_P2_DSTATUS  0xf212
-#define F0900_P2_CAR_LOCK  0xf2120080
-#define F0900_P2_TMGLOCK_QUALITY  0xf2120060
-#define F0900_P2_SDVBS1_ENABLE  0xf2120010
-#define F0900_P2_LOCK_DEFINITIF  0xf2120008
-#define F0900_P2_TIMING_IS_LOCKED  0xf2120004
-#define F0900_P2_COARSE_TMGLOCK  0xf2120002
-#define F0900_P2_COARSE_CARLOCK  0xf2120001
+#define R0900_P2_DSTATUS 0xf212
+#define F0900_P2_CAR_LOCK 0xf2120080
+#define F0900_P2_TMGLOCK_QUALITY 0xf2120060
+#define F0900_P2_LOCK_DEFINITIF 0xf2120008
+#define F0900_P2_OVADC_DETECT 0xf2120001
 
 /*P2_DSTATUS2*/
-#define R0900_P2_DSTATUS2  0xf213
-#define F0900_P2_DEMOD_DELOCK  0xf2130080
-#define F0900_P2_DEMOD_TIMEOUT  0xf2130040
-#define F0900_P2_MODCODRQ_SYNCTAG  0xf2130020
-#define F0900_P2_POLYPH_SATEVENT  0xf2130010
-#define F0900_P2_AGC1_NOSIGNALACK  0xf2130008
-#define F0900_P2_AGC2_OVERFLOW  0xf2130004
-#define F0900_P2_CFR_OVERFLOW  0xf2130002
-#define F0900_P2_GAMMA_OVERUNDER  0xf2130001
+#define R0900_P2_DSTATUS2 0xf213
+#define F0900_P2_DEMOD_DELOCK 0xf2130080
+#define F0900_P2_AGC1_NOSIGNALACK 0xf2130008
+#define F0900_P2_AGC2_OVERFLOW 0xf2130004
+#define F0900_P2_CFR_OVERFLOW 0xf2130002
+#define F0900_P2_GAMMA_OVERUNDER 0xf2130001
 
 /*P2_DMDCFGMD*/
-#define R0900_P2_DMDCFGMD  0xf214
-#define F0900_P2_DVBS2_ENABLE  0xf2140080
-#define F0900_P2_DVBS1_ENABLE  0xf2140040
-#define F0900_P2_CFR_AUTOSCAN  0xf2140020
-#define F0900_P2_SCAN_ENABLE  0xf2140010
-#define F0900_P2_TUN_AUTOSCAN  0xf2140008
-#define F0900_P2_NOFORCE_RELOCK  0xf2140004
-#define F0900_P2_TUN_RNG  0xf2140003
+#define R0900_P2_DMDCFGMD 0xf214
+#define F0900_P2_DVBS2_ENABLE 0xf2140080
+#define F0900_P2_DVBS1_ENABLE 0xf2140040
+#define F0900_P2_SCAN_ENABLE 0xf2140010
+#define F0900_P2_CFR_AUTOSCAN 0xf2140008
+#define F0900_P2_TUN_RNG 0xf2140003
 
 /*P2_DMDCFG2*/
-#define R0900_P2_DMDCFG2  0xf215
-#define F0900_P2_AGC1_WAITLOCK  0xf2150080
-#define F0900_P2_S1S2_SEQUENTIAL  0xf2150040
-#define F0900_P2_OVERFLOW_TIMEOUT  0xf2150020
-#define F0900_P2_SCANFAIL_TIMEOUT  0xf2150010
-#define F0900_P2_DMDTOUT_BACK  0xf2150008
-#define F0900_P2_CARLOCK_S1ENABLE  0xf2150004
-#define F0900_P2_COARSE_LK3MODE  0xf2150002
-#define F0900_P2_COARSE_LK2MODE  0xf2150001
+#define R0900_P2_DMDCFG2 0xf215
+#define F0900_P2_S1S2_SEQUENTIAL 0xf2150040
+#define F0900_P2_INFINITE_RELOCK 0xf2150010
 
 /*P2_DMDISTATE*/
-#define R0900_P2_DMDISTATE  0xf216
-#define F0900_P2_I2C_NORESETDMODE  0xf2160080
-#define F0900_P2_FORCE_ETAPED  0xf2160040
-#define F0900_P2_SDMDRST_DIRCLK  0xf2160020
-#define F0900_P2_I2C_DEMOD_MODE  0xf216001f
+#define R0900_P2_DMDISTATE 0xf216
+#define F0900_P2_I2C_DEMOD_MODE 0xf216001f
 
 /*P2_DMDT0M*/
-#define R0900_P2_DMDT0M  0xf217
-#define F0900_P2_DMDT0_MIN  0xf21700ff
+#define R0900_P2_DMDT0M 0xf217
+#define F0900_P2_DMDT0_MIN 0xf21700ff
 
 /*P2_DMDSTATE*/
-#define R0900_P2_DMDSTATE  0xf21b
-#define F0900_P2_DEMOD_LOCKED  0xf21b0080
-#define F0900_P2_HEADER_MODE  0xf21b0060
-#define F0900_P2_DEMOD_MODE  0xf21b001f
+#define R0900_P2_DMDSTATE 0xf21b
+#define F0900_P2_HEADER_MODE 0xf21b0060
 
 /*P2_DMDFLYW*/
-#define R0900_P2_DMDFLYW  0xf21c
-#define F0900_P2_I2C_IRQVAL  0xf21c00f0
-#define F0900_P2_FLYWHEEL_CPT  0xf21c000f
+#define R0900_P2_DMDFLYW 0xf21c
+#define F0900_P2_I2C_IRQVAL 0xf21c00f0
+#define F0900_P2_FLYWHEEL_CPT 0xf21c000f
 
 /*P2_DSTATUS3*/
-#define R0900_P2_DSTATUS3  0xf21d
-#define F0900_P2_CFR_ZIGZAG  0xf21d0080
-#define F0900_P2_DEMOD_CFGMODE  0xf21d0060
-#define F0900_P2_GAMMA_LOWBAUDRATE  0xf21d0010
-#define F0900_P2_RELOCK_MODE  0xf21d0008
-#define F0900_P2_DEMOD_FAIL  0xf21d0004
-#define F0900_P2_ETAPE1A_DVBXMEM  0xf21d0003
+#define R0900_P2_DSTATUS3 0xf21d
+#define F0900_P2_DEMOD_CFGMODE 0xf21d0060
 
 /*P2_DMDCFG3*/
-#define R0900_P2_DMDCFG3  0xf21e
-#define F0900_P2_DVBS1_TMGWAIT  0xf21e0080
-#define F0900_P2_NO_BWCENTERING  0xf21e0040
-#define F0900_P2_INV_SEQSRCH  0xf21e0020
-#define F0900_P2_DIS_SFRUPLOW_TRK  0xf21e0010
-#define F0900_P2_NOSTOP_FIFOFULL  0xf21e0008
-#define F0900_P2_LOCKTIME_MODE  0xf21e0007
+#define R0900_P2_DMDCFG3 0xf21e
+#define F0900_P2_NOSTOP_FIFOFULL 0xf21e0008
 
 /*P2_DMDCFG4*/
-#define R0900_P2_DMDCFG4  0xf21f
-#define F0900_P2_TUNER_NRELAUNCH  0xf21f0008
-#define F0900_P2_DIS_CLKENABLE  0xf21f0004
-#define F0900_P2_DIS_HDRDIVLOCK  0xf21f0002
-#define F0900_P2_NO_TNRWBINIT  0xf21f0001
+#define R0900_P2_DMDCFG4 0xf21f
+#define F0900_P2_TUNER_NRELAUNCH 0xf21f0008
 
 /*P2_CORRELMANT*/
-#define R0900_P2_CORRELMANT  0xf220
-#define F0900_P2_CORREL_MANT  0xf22000ff
+#define R0900_P2_CORRELMANT 0xf220
+#define F0900_P2_CORREL_MANT 0xf22000ff
 
 /*P2_CORRELABS*/
-#define R0900_P2_CORRELABS  0xf221
-#define F0900_P2_CORREL_ABS  0xf22100ff
+#define R0900_P2_CORRELABS 0xf221
+#define F0900_P2_CORREL_ABS 0xf22100ff
 
 /*P2_CORRELEXP*/
-#define R0900_P2_CORRELEXP  0xf222
-#define F0900_P2_CORREL_ABSEXP  0xf22200f0
-#define F0900_P2_CORREL_EXP  0xf222000f
+#define R0900_P2_CORRELEXP 0xf222
+#define F0900_P2_CORREL_ABSEXP 0xf22200f0
+#define F0900_P2_CORREL_EXP 0xf222000f
 
 /*P2_PLHMODCOD*/
-#define R0900_P2_PLHMODCOD  0xf224
-#define F0900_P2_SPECINV_DEMOD  0xf2240080
-#define F0900_P2_PLH_MODCOD  0xf224007c
-#define F0900_P2_PLH_TYPE  0xf2240003
-
-/*P2_AGCK32*/
-#define R0900_P2_AGCK32  0xf22b
-#define F0900_P2_R3ADJOFF_32APSK  0xf22b0080
-#define F0900_P2_R2ADJOFF_32APSK  0xf22b0040
-#define F0900_P2_R1ADJOFF_32APSK  0xf22b0020
-#define F0900_P2_RADJ_32APSK  0xf22b001f
+#define R0900_P2_PLHMODCOD 0xf224
+#define F0900_P2_SPECINV_DEMOD 0xf2240080
+#define F0900_P2_PLH_MODCOD 0xf224007c
+#define F0900_P2_PLH_TYPE 0xf2240003
+
+/*P2_DMDREG*/
+#define R0900_P2_DMDREG 0xf225
+#define F0900_P2_DECIM_PLFRAMES 0xf2250001
 
 /*P2_AGC2O*/
-#define R0900_P2_AGC2O  0xf22c
-#define F0900_P2_AGC2REF_ADJUSTING  0xf22c0080
-#define F0900_P2_AGC2_COARSEFAST  0xf22c0040
-#define F0900_P2_AGC2_LKSQRT  0xf22c0020
-#define F0900_P2_AGC2_LKMODE  0xf22c0010
-#define F0900_P2_AGC2_LKEQUA  0xf22c0008
-#define F0900_P2_AGC2_COEF  0xf22c0007
+#define R0900_P2_AGC2O 0xf22c
+#define F0900_P2_AGC2_COEF 0xf22c0007
 
 /*P2_AGC2REF*/
-#define R0900_P2_AGC2REF  0xf22d
-#define F0900_P2_AGC2_REF  0xf22d00ff
+#define R0900_P2_AGC2REF 0xf22d
+#define F0900_P2_AGC2_REF 0xf22d00ff
 
 /*P2_AGC1ADJ*/
-#define R0900_P2_AGC1ADJ  0xf22e
-#define F0900_P2_AGC1ADJ_MANUAL  0xf22e0080
-#define F0900_P2_AGC1_ADJUSTED  0xf22e017f
+#define R0900_P2_AGC1ADJ 0xf22e
+#define F0900_P2_AGC1_ADJUSTED 0xf22e007f
 
 /*P2_AGC2I1*/
-#define R0900_P2_AGC2I1  0xf236
-#define F0900_P2_AGC2_INTEGRATOR1  0xf23600ff
+#define R0900_P2_AGC2I1 0xf236
+#define F0900_P2_AGC2_INTEGRATOR1 0xf23600ff
 
 /*P2_AGC2I0*/
-#define R0900_P2_AGC2I0  0xf237
-#define F0900_P2_AGC2_INTEGRATOR0  0xf23700ff
+#define R0900_P2_AGC2I0 0xf237
+#define F0900_P2_AGC2_INTEGRATOR0 0xf23700ff
 
 /*P2_CARCFG*/
-#define R0900_P2_CARCFG  0xf238
-#define F0900_P2_CFRUPLOW_AUTO  0xf2380080
-#define F0900_P2_CFRUPLOW_TEST  0xf2380040
-#define F0900_P2_EN_CAR2CENTER  0xf2380020
-#define F0900_P2_CARHDR_NODIV8  0xf2380010
-#define F0900_P2_I2C_ROTA  0xf2380008
-#define F0900_P2_ROTAON  0xf2380004
-#define F0900_P2_PH_DET_ALGO  0xf2380003
+#define R0900_P2_CARCFG 0xf238
+#define F0900_P2_CFRUPLOW_AUTO 0xf2380080
+#define F0900_P2_CFRUPLOW_TEST 0xf2380040
+#define F0900_P2_ROTAON 0xf2380004
+#define F0900_P2_PH_DET_ALGO 0xf2380003
 
 /*P2_ACLC*/
-#define R0900_P2_ACLC  0xf239
-#define F0900_P2_STOP_S2ALPHA  0xf23900c0
-#define F0900_P2_CAR_ALPHA_MANT  0xf2390030
-#define F0900_P2_CAR_ALPHA_EXP  0xf239000f
+#define R0900_P2_ACLC 0xf239
+#define F0900_P2_CAR_ALPHA_MANT 0xf2390030
+#define F0900_P2_CAR_ALPHA_EXP 0xf239000f
 
 /*P2_BCLC*/
-#define R0900_P2_BCLC  0xf23a
-#define F0900_P2_STOP_S2BETA  0xf23a00c0
-#define F0900_P2_CAR_BETA_MANT  0xf23a0030
-#define F0900_P2_CAR_BETA_EXP  0xf23a000f
+#define R0900_P2_BCLC 0xf23a
+#define F0900_P2_CAR_BETA_MANT 0xf23a0030
+#define F0900_P2_CAR_BETA_EXP 0xf23a000f
 
 /*P2_CARFREQ*/
-#define R0900_P2_CARFREQ  0xf23d
-#define F0900_P2_KC_COARSE_EXP  0xf23d00f0
-#define F0900_P2_BETA_FREQ  0xf23d000f
+#define R0900_P2_CARFREQ 0xf23d
+#define F0900_P2_KC_COARSE_EXP 0xf23d00f0
+#define F0900_P2_BETA_FREQ 0xf23d000f
 
 /*P2_CARHDR*/
-#define R0900_P2_CARHDR  0xf23e
-#define F0900_P2_K_FREQ_HDR  0xf23e00ff
+#define R0900_P2_CARHDR 0xf23e
+#define F0900_P2_K_FREQ_HDR 0xf23e00ff
 
 /*P2_LDT*/
-#define R0900_P2_LDT  0xf23f
-#define F0900_P2_CARLOCK_THRES  0xf23f01ff
+#define R0900_P2_LDT 0xf23f
+#define F0900_P2_CARLOCK_THRES 0xf23f01ff
 
 /*P2_LDT2*/
-#define R0900_P2_LDT2  0xf240
-#define F0900_P2_CARLOCK_THRES2  0xf24001ff
+#define R0900_P2_LDT2 0xf240
+#define F0900_P2_CARLOCK_THRES2 0xf24001ff
 
 /*P2_CFRICFG*/
-#define R0900_P2_CFRICFG  0xf241
-#define F0900_P2_CFRINIT_UNVALRNG  0xf2410080
-#define F0900_P2_CFRINIT_LUNVALCPT  0xf2410040
-#define F0900_P2_CFRINIT_ABORTDBL  0xf2410020
-#define F0900_P2_CFRINIT_ABORTPRED  0xf2410010
-#define F0900_P2_CFRINIT_UNVALSKIP  0xf2410008
-#define F0900_P2_CFRINIT_CSTINC  0xf2410004
-#define F0900_P2_NEG_CFRSTEP  0xf2410001
+#define R0900_P2_CFRICFG 0xf241
+#define F0900_P2_NEG_CFRSTEP 0xf2410001
 
 /*P2_CFRUP1*/
-#define R0900_P2_CFRUP1  0xf242
-#define F0900_P2_CFR_UP1  0xf24201ff
+#define R0900_P2_CFRUP1 0xf242
+#define F0900_P2_CFR_UP1 0xf24201ff
 
 /*P2_CFRUP0*/
-#define R0900_P2_CFRUP0  0xf243
-#define F0900_P2_CFR_UP0  0xf24300ff
+#define R0900_P2_CFRUP0 0xf243
+#define F0900_P2_CFR_UP0 0xf24300ff
 
 /*P2_CFRLOW1*/
-#define R0900_P2_CFRLOW1  0xf246
-#define F0900_P2_CFR_LOW1  0xf24601ff
+#define R0900_P2_CFRLOW1 0xf246
+#define F0900_P2_CFR_LOW1 0xf24601ff
 
 /*P2_CFRLOW0*/
-#define R0900_P2_CFRLOW0  0xf247
-#define F0900_P2_CFR_LOW0  0xf24700ff
+#define R0900_P2_CFRLOW0 0xf247
+#define F0900_P2_CFR_LOW0 0xf24700ff
 
 /*P2_CFRINIT1*/
-#define R0900_P2_CFRINIT1  0xf248
-#define F0900_P2_CFR_INIT1  0xf24801ff
+#define R0900_P2_CFRINIT1 0xf248
+#define F0900_P2_CFR_INIT1 0xf24801ff
 
 /*P2_CFRINIT0*/
-#define R0900_P2_CFRINIT0  0xf249
-#define F0900_P2_CFR_INIT0  0xf24900ff
+#define R0900_P2_CFRINIT0 0xf249
+#define F0900_P2_CFR_INIT0 0xf24900ff
 
 /*P2_CFRINC1*/
-#define R0900_P2_CFRINC1  0xf24a
-#define F0900_P2_MANUAL_CFRINC  0xf24a0080
-#define F0900_P2_CFR_INC1  0xf24a017f
+#define R0900_P2_CFRINC1 0xf24a
+#define F0900_P2_MANUAL_CFRINC 0xf24a0080
+#define F0900_P2_CFR_INC1 0xf24a003f
 
 /*P2_CFRINC0*/
-#define R0900_P2_CFRINC0  0xf24b
-#define F0900_P2_CFR_INC0  0xf24b00f0
+#define R0900_P2_CFRINC0 0xf24b
+#define F0900_P2_CFR_INC0 0xf24b00f8
 
 /*P2_CFR2*/
-#define R0900_P2_CFR2  0xf24c
-#define F0900_P2_CAR_FREQ2  0xf24c01ff
+#define R0900_P2_CFR2 0xf24c
+#define F0900_P2_CAR_FREQ2 0xf24c01ff
 
 /*P2_CFR1*/
-#define R0900_P2_CFR1  0xf24d
-#define F0900_P2_CAR_FREQ1  0xf24d00ff
+#define R0900_P2_CFR1 0xf24d
+#define F0900_P2_CAR_FREQ1 0xf24d00ff
 
 /*P2_CFR0*/
-#define R0900_P2_CFR0  0xf24e
-#define F0900_P2_CAR_FREQ0  0xf24e00ff
+#define R0900_P2_CFR0 0xf24e
+#define F0900_P2_CAR_FREQ0 0xf24e00ff
 
 /*P2_LDI*/
-#define R0900_P2_LDI  0xf24f
-#define F0900_P2_LOCK_DET_INTEGR  0xf24f01ff
+#define R0900_P2_LDI 0xf24f
+#define F0900_P2_LOCK_DET_INTEGR 0xf24f01ff
 
 /*P2_TMGCFG*/
-#define R0900_P2_TMGCFG  0xf250
-#define F0900_P2_TMGLOCK_BETA  0xf25000c0
-#define F0900_P2_NOTMG_GROUPDELAY  0xf2500020
-#define F0900_P2_DO_TIMING_CORR  0xf2500010
-#define F0900_P2_MANUAL_SCAN  0xf250000c
-#define F0900_P2_TMG_MINFREQ  0xf2500003
+#define R0900_P2_TMGCFG 0xf250
+#define F0900_P2_TMGLOCK_BETA 0xf25000c0
+#define F0900_P2_DO_TIMING_CORR 0xf2500010
+#define F0900_P2_TMG_MINFREQ 0xf2500003
 
 /*P2_RTC*/
-#define R0900_P2_RTC  0xf251
-#define F0900_P2_TMGALPHA_EXP  0xf25100f0
-#define F0900_P2_TMGBETA_EXP  0xf251000f
+#define R0900_P2_RTC 0xf251
+#define F0900_P2_TMGALPHA_EXP 0xf25100f0
+#define F0900_P2_TMGBETA_EXP 0xf251000f
 
 /*P2_RTCS2*/
-#define R0900_P2_RTCS2  0xf252
-#define F0900_P2_TMGALPHAS2_EXP  0xf25200f0
-#define F0900_P2_TMGBETAS2_EXP  0xf252000f
+#define R0900_P2_RTCS2 0xf252
+#define F0900_P2_TMGALPHAS2_EXP 0xf25200f0
+#define F0900_P2_TMGBETAS2_EXP 0xf252000f
 
 /*P2_TMGTHRISE*/
-#define R0900_P2_TMGTHRISE  0xf253
-#define F0900_P2_TMGLOCK_THRISE  0xf25300ff
+#define R0900_P2_TMGTHRISE 0xf253
+#define F0900_P2_TMGLOCK_THRISE 0xf25300ff
 
 /*P2_TMGTHFALL*/
-#define R0900_P2_TMGTHFALL  0xf254
-#define F0900_P2_TMGLOCK_THFALL  0xf25400ff
+#define R0900_P2_TMGTHFALL 0xf254
+#define F0900_P2_TMGLOCK_THFALL 0xf25400ff
 
 /*P2_SFRUPRATIO*/
-#define R0900_P2_SFRUPRATIO  0xf255
-#define F0900_P2_SFR_UPRATIO  0xf25500ff
+#define R0900_P2_SFRUPRATIO 0xf255
+#define F0900_P2_SFR_UPRATIO 0xf25500ff
 
 /*P2_SFRLOWRATIO*/
-#define R0900_P2_SFRLOWRATIO  0xf256
-#define F0900_P2_SFR_LOWRATIO  0xf25600ff
+#define R0900_P2_SFRLOWRATIO 0xf256
+#define F0900_P2_SFR_LOWRATIO 0xf25600ff
 
 /*P2_KREFTMG*/
-#define R0900_P2_KREFTMG  0xf258
-#define F0900_P2_KREF_TMG  0xf25800ff
+#define R0900_P2_KREFTMG 0xf258
+#define F0900_P2_KREF_TMG 0xf25800ff
 
 /*P2_SFRSTEP*/
-#define R0900_P2_SFRSTEP  0xf259
-#define F0900_P2_SFR_SCANSTEP  0xf25900f0
-#define F0900_P2_SFR_CENTERSTEP  0xf259000f
+#define R0900_P2_SFRSTEP 0xf259
+#define F0900_P2_SFR_SCANSTEP 0xf25900f0
+#define F0900_P2_SFR_CENTERSTEP 0xf259000f
 
 /*P2_TMGCFG2*/
-#define R0900_P2_TMGCFG2  0xf25a
-#define F0900_P2_DIS_AUTOSAMP  0xf25a0008
-#define F0900_P2_SCANINIT_QUART  0xf25a0004
-#define F0900_P2_NOTMG_DVBS1DERAT  0xf25a0002
-#define F0900_P2_SFRRATIO_FINE  0xf25a0001
+#define R0900_P2_TMGCFG2 0xf25a
+#define F0900_P2_SFRRATIO_FINE 0xf25a0001
+
+/*P2_KREFTMG2*/
+#define R0900_P2_KREFTMG2 0xf25b
+#define F0900_P2_KREF_TMG2 0xf25b00ff
 
 /*P2_SFRINIT1*/
-#define R0900_P2_SFRINIT1  0xf25e
-#define F0900_P2_SFR_INIT1  0xf25e00ff
+#define R0900_P2_SFRINIT1 0xf25e
+#define F0900_P2_SFR_INIT1 0xf25e007f
 
 /*P2_SFRINIT0*/
-#define R0900_P2_SFRINIT0  0xf25f
-#define F0900_P2_SFR_INIT0  0xf25f00ff
+#define R0900_P2_SFRINIT0 0xf25f
+#define F0900_P2_SFR_INIT0 0xf25f00ff
 
 /*P2_SFRUP1*/
-#define R0900_P2_SFRUP1  0xf260
-#define F0900_P2_AUTO_GUP  0xf2600080
-#define F0900_P2_SYMB_FREQ_UP1  0xf260007f
+#define R0900_P2_SFRUP1 0xf260
+#define F0900_P2_AUTO_GUP 0xf2600080
+#define F0900_P2_SYMB_FREQ_UP1 0xf260007f
 
 /*P2_SFRUP0*/
-#define R0900_P2_SFRUP0  0xf261
-#define F0900_P2_SYMB_FREQ_UP0  0xf26100ff
+#define R0900_P2_SFRUP0 0xf261
+#define F0900_P2_SYMB_FREQ_UP0 0xf26100ff
 
 /*P2_SFRLOW1*/
-#define R0900_P2_SFRLOW1  0xf262
-#define F0900_P2_AUTO_GLOW  0xf2620080
-#define F0900_P2_SYMB_FREQ_LOW1  0xf262007f
+#define R0900_P2_SFRLOW1 0xf262
+#define F0900_P2_AUTO_GLOW 0xf2620080
+#define F0900_P2_SYMB_FREQ_LOW1 0xf262007f
 
 /*P2_SFRLOW0*/
-#define R0900_P2_SFRLOW0  0xf263
-#define F0900_P2_SYMB_FREQ_LOW0  0xf26300ff
+#define R0900_P2_SFRLOW0 0xf263
+#define F0900_P2_SYMB_FREQ_LOW0 0xf26300ff
 
 /*P2_SFR3*/
-#define R0900_P2_SFR3  0xf264
-#define F0900_P2_SYMB_FREQ3  0xf26400ff
+#define R0900_P2_SFR3 0xf264
+#define F0900_P2_SYMB_FREQ3 0xf26400ff
 
 /*P2_SFR2*/
-#define R0900_P2_SFR2  0xf265
-#define F0900_P2_SYMB_FREQ2  0xf26500ff
+#define R0900_P2_SFR2 0xf265
+#define F0900_P2_SYMB_FREQ2 0xf26500ff
 
 /*P2_SFR1*/
-#define R0900_P2_SFR1  0xf266
-#define F0900_P2_SYMB_FREQ1  0xf26600ff
+#define R0900_P2_SFR1 0xf266
+#define F0900_P2_SYMB_FREQ1 0xf26600ff
 
 /*P2_SFR0*/
-#define R0900_P2_SFR0  0xf267
-#define F0900_P2_SYMB_FREQ0  0xf26700ff
+#define R0900_P2_SFR0 0xf267
+#define F0900_P2_SYMB_FREQ0 0xf26700ff
 
 /*P2_TMGREG2*/
-#define R0900_P2_TMGREG2  0xf268
-#define F0900_P2_TMGREG2  0xf26800ff
+#define R0900_P2_TMGREG2 0xf268
+#define F0900_P2_TMGREG2 0xf26800ff
 
 /*P2_TMGREG1*/
-#define R0900_P2_TMGREG1  0xf269
-#define F0900_P2_TMGREG1  0xf26900ff
+#define R0900_P2_TMGREG1 0xf269
+#define F0900_P2_TMGREG1 0xf26900ff
 
 /*P2_TMGREG0*/
-#define R0900_P2_TMGREG0  0xf26a
-#define F0900_P2_TMGREG0  0xf26a00ff
+#define R0900_P2_TMGREG0 0xf26a
+#define F0900_P2_TMGREG0 0xf26a00ff
 
 /*P2_TMGLOCK1*/
-#define R0900_P2_TMGLOCK1  0xf26b
-#define F0900_P2_TMGLOCK_LEVEL1  0xf26b01ff
+#define R0900_P2_TMGLOCK1 0xf26b
+#define F0900_P2_TMGLOCK_LEVEL1 0xf26b01ff
 
 /*P2_TMGLOCK0*/
-#define R0900_P2_TMGLOCK0  0xf26c
-#define F0900_P2_TMGLOCK_LEVEL0  0xf26c00ff
+#define R0900_P2_TMGLOCK0 0xf26c
+#define F0900_P2_TMGLOCK_LEVEL0 0xf26c00ff
 
 /*P2_TMGOBS*/
-#define R0900_P2_TMGOBS  0xf26d
-#define F0900_P2_ROLLOFF_STATUS  0xf26d00c0
-#define F0900_P2_SCAN_SIGN  0xf26d0030
-#define F0900_P2_TMG_SCANNING  0xf26d0008
-#define F0900_P2_CHCENTERING_MODE  0xf26d0004
-#define F0900_P2_TMG_SCANFAIL  0xf26d0002
+#define R0900_P2_TMGOBS 0xf26d
+#define F0900_P2_ROLLOFF_STATUS 0xf26d00c0
 
 /*P2_EQUALCFG*/
-#define R0900_P2_EQUALCFG  0xf26f
-#define F0900_P2_NOTMG_NEGALWAIT  0xf26f0080
-#define F0900_P2_EQUAL_ON  0xf26f0040
-#define F0900_P2_SEL_EQUALCOR  0xf26f0038
-#define F0900_P2_MU_EQUALDFE  0xf26f0007
+#define R0900_P2_EQUALCFG 0xf26f
+#define F0900_P2_EQUAL_ON 0xf26f0040
+#define F0900_P2_MU_EQUALDFE 0xf26f0007
 
 /*P2_EQUAI1*/
-#define R0900_P2_EQUAI1  0xf270
-#define F0900_P2_EQUA_ACCI1  0xf27001ff
+#define R0900_P2_EQUAI1 0xf270
+#define F0900_P2_EQUA_ACCI1 0xf27001ff
 
 /*P2_EQUAQ1*/
-#define R0900_P2_EQUAQ1  0xf271
-#define F0900_P2_EQUA_ACCQ1  0xf27101ff
+#define R0900_P2_EQUAQ1 0xf271
+#define F0900_P2_EQUA_ACCQ1 0xf27101ff
 
 /*P2_EQUAI2*/
-#define R0900_P2_EQUAI2  0xf272
-#define F0900_P2_EQUA_ACCI2  0xf27201ff
+#define R0900_P2_EQUAI2 0xf272
+#define F0900_P2_EQUA_ACCI2 0xf27201ff
 
 /*P2_EQUAQ2*/
-#define R0900_P2_EQUAQ2  0xf273
-#define F0900_P2_EQUA_ACCQ2  0xf27301ff
+#define R0900_P2_EQUAQ2 0xf273
+#define F0900_P2_EQUA_ACCQ2 0xf27301ff
 
 /*P2_EQUAI3*/
-#define R0900_P2_EQUAI3  0xf274
-#define F0900_P2_EQUA_ACCI3  0xf27401ff
+#define R0900_P2_EQUAI3 0xf274
+#define F0900_P2_EQUA_ACCI3 0xf27401ff
 
 /*P2_EQUAQ3*/
-#define R0900_P2_EQUAQ3  0xf275
-#define F0900_P2_EQUA_ACCQ3  0xf27501ff
+#define R0900_P2_EQUAQ3 0xf275
+#define F0900_P2_EQUA_ACCQ3 0xf27501ff
 
 /*P2_EQUAI4*/
-#define R0900_P2_EQUAI4  0xf276
-#define F0900_P2_EQUA_ACCI4  0xf27601ff
+#define R0900_P2_EQUAI4 0xf276
+#define F0900_P2_EQUA_ACCI4 0xf27601ff
 
 /*P2_EQUAQ4*/
-#define R0900_P2_EQUAQ4  0xf277
-#define F0900_P2_EQUA_ACCQ4  0xf27701ff
+#define R0900_P2_EQUAQ4 0xf277
+#define F0900_P2_EQUA_ACCQ4 0xf27701ff
 
 /*P2_EQUAI5*/
-#define R0900_P2_EQUAI5  0xf278
-#define F0900_P2_EQUA_ACCI5  0xf27801ff
+#define R0900_P2_EQUAI5 0xf278
+#define F0900_P2_EQUA_ACCI5 0xf27801ff
 
 /*P2_EQUAQ5*/
-#define R0900_P2_EQUAQ5  0xf279
-#define F0900_P2_EQUA_ACCQ5  0xf27901ff
+#define R0900_P2_EQUAQ5 0xf279
+#define F0900_P2_EQUA_ACCQ5 0xf27901ff
 
 /*P2_EQUAI6*/
-#define R0900_P2_EQUAI6  0xf27a
-#define F0900_P2_EQUA_ACCI6  0xf27a01ff
+#define R0900_P2_EQUAI6 0xf27a
+#define F0900_P2_EQUA_ACCI6 0xf27a01ff
 
 /*P2_EQUAQ6*/
-#define R0900_P2_EQUAQ6  0xf27b
-#define F0900_P2_EQUA_ACCQ6  0xf27b01ff
+#define R0900_P2_EQUAQ6 0xf27b
+#define F0900_P2_EQUA_ACCQ6 0xf27b01ff
 
 /*P2_EQUAI7*/
-#define R0900_P2_EQUAI7  0xf27c
-#define F0900_P2_EQUA_ACCI7  0xf27c01ff
+#define R0900_P2_EQUAI7 0xf27c
+#define F0900_P2_EQUA_ACCI7 0xf27c01ff
 
 /*P2_EQUAQ7*/
-#define R0900_P2_EQUAQ7  0xf27d
-#define F0900_P2_EQUA_ACCQ7  0xf27d01ff
+#define R0900_P2_EQUAQ7 0xf27d
+#define F0900_P2_EQUA_ACCQ7 0xf27d01ff
 
 /*P2_EQUAI8*/
-#define R0900_P2_EQUAI8  0xf27e
-#define F0900_P2_EQUA_ACCI8  0xf27e01ff
+#define R0900_P2_EQUAI8 0xf27e
+#define F0900_P2_EQUA_ACCI8 0xf27e01ff
 
 /*P2_EQUAQ8*/
-#define R0900_P2_EQUAQ8  0xf27f
-#define F0900_P2_EQUA_ACCQ8  0xf27f01ff
+#define R0900_P2_EQUAQ8 0xf27f
+#define F0900_P2_EQUA_ACCQ8 0xf27f01ff
 
 /*P2_NNOSDATAT1*/
-#define R0900_P2_NNOSDATAT1  0xf280
-#define F0900_P2_NOSDATAT_NORMED1  0xf28000ff
+#define R0900_P2_NNOSDATAT1 0xf280
+#define F0900_P2_NOSDATAT_NORMED1 0xf28000ff
 
 /*P2_NNOSDATAT0*/
-#define R0900_P2_NNOSDATAT0  0xf281
-#define F0900_P2_NOSDATAT_NORMED0  0xf28100ff
+#define R0900_P2_NNOSDATAT0 0xf281
+#define F0900_P2_NOSDATAT_NORMED0 0xf28100ff
 
 /*P2_NNOSDATA1*/
-#define R0900_P2_NNOSDATA1  0xf282
-#define F0900_P2_NOSDATA_NORMED1  0xf28200ff
+#define R0900_P2_NNOSDATA1 0xf282
+#define F0900_P2_NOSDATA_NORMED1 0xf28200ff
 
 /*P2_NNOSDATA0*/
-#define R0900_P2_NNOSDATA0  0xf283
-#define F0900_P2_NOSDATA_NORMED0  0xf28300ff
+#define R0900_P2_NNOSDATA0 0xf283
+#define F0900_P2_NOSDATA_NORMED0 0xf28300ff
 
 /*P2_NNOSPLHT1*/
-#define R0900_P2_NNOSPLHT1  0xf284
-#define F0900_P2_NOSPLHT_NORMED1  0xf28400ff
+#define R0900_P2_NNOSPLHT1 0xf284
+#define F0900_P2_NOSPLHT_NORMED1 0xf28400ff
 
 /*P2_NNOSPLHT0*/
-#define R0900_P2_NNOSPLHT0  0xf285
-#define F0900_P2_NOSPLHT_NORMED0  0xf28500ff
+#define R0900_P2_NNOSPLHT0 0xf285
+#define F0900_P2_NOSPLHT_NORMED0 0xf28500ff
 
 /*P2_NNOSPLH1*/
-#define R0900_P2_NNOSPLH1  0xf286
-#define F0900_P2_NOSPLH_NORMED1  0xf28600ff
+#define R0900_P2_NNOSPLH1 0xf286
+#define F0900_P2_NOSPLH_NORMED1 0xf28600ff
 
 /*P2_NNOSPLH0*/
-#define R0900_P2_NNOSPLH0  0xf287
-#define F0900_P2_NOSPLH_NORMED0  0xf28700ff
+#define R0900_P2_NNOSPLH0 0xf287
+#define F0900_P2_NOSPLH_NORMED0 0xf28700ff
 
 /*P2_NOSDATAT1*/
-#define R0900_P2_NOSDATAT1  0xf288
-#define F0900_P2_NOSDATAT_UNNORMED1  0xf28800ff
+#define R0900_P2_NOSDATAT1 0xf288
+#define F0900_P2_NOSDATAT_UNNORMED1 0xf28800ff
 
 /*P2_NOSDATAT0*/
-#define R0900_P2_NOSDATAT0  0xf289
-#define F0900_P2_NOSDATAT_UNNORMED0  0xf28900ff
+#define R0900_P2_NOSDATAT0 0xf289
+#define F0900_P2_NOSDATAT_UNNORMED0 0xf28900ff
 
 /*P2_NOSDATA1*/
-#define R0900_P2_NOSDATA1  0xf28a
-#define F0900_P2_NOSDATA_UNNORMED1  0xf28a00ff
+#define R0900_P2_NOSDATA1 0xf28a
+#define F0900_P2_NOSDATA_UNNORMED1 0xf28a00ff
 
 /*P2_NOSDATA0*/
-#define R0900_P2_NOSDATA0  0xf28b
-#define F0900_P2_NOSDATA_UNNORMED0  0xf28b00ff
+#define R0900_P2_NOSDATA0 0xf28b
+#define F0900_P2_NOSDATA_UNNORMED0 0xf28b00ff
 
 /*P2_NOSPLHT1*/
-#define R0900_P2_NOSPLHT1  0xf28c
-#define F0900_P2_NOSPLHT_UNNORMED1  0xf28c00ff
+#define R0900_P2_NOSPLHT1 0xf28c
+#define F0900_P2_NOSPLHT_UNNORMED1 0xf28c00ff
 
 /*P2_NOSPLHT0*/
-#define R0900_P2_NOSPLHT0  0xf28d
-#define F0900_P2_NOSPLHT_UNNORMED0  0xf28d00ff
+#define R0900_P2_NOSPLHT0 0xf28d
+#define F0900_P2_NOSPLHT_UNNORMED0 0xf28d00ff
 
 /*P2_NOSPLH1*/
-#define R0900_P2_NOSPLH1  0xf28e
-#define F0900_P2_NOSPLH_UNNORMED1  0xf28e00ff
+#define R0900_P2_NOSPLH1 0xf28e
+#define F0900_P2_NOSPLH_UNNORMED1 0xf28e00ff
 
 /*P2_NOSPLH0*/
-#define R0900_P2_NOSPLH0  0xf28f
-#define F0900_P2_NOSPLH_UNNORMED0  0xf28f00ff
+#define R0900_P2_NOSPLH0 0xf28f
+#define F0900_P2_NOSPLH_UNNORMED0 0xf28f00ff
 
 /*P2_CAR2CFG*/
-#define R0900_P2_CAR2CFG  0xf290
-#define F0900_P2_DESCRAMB_OFF  0xf2900080
-#define F0900_P2_PN4_SELECT  0xf2900040
-#define F0900_P2_CFR2_STOPDVBS1  0xf2900020
-#define F0900_P2_STOP_CFR2UPDATE  0xf2900010
-#define F0900_P2_STOP_NCO2UPDATE  0xf2900008
-#define F0900_P2_ROTA2ON  0xf2900004
-#define F0900_P2_PH_DET_ALGO2  0xf2900003
-
-/*P2_ACLC2*/
-#define R0900_P2_ACLC2  0xf291
-#define F0900_P2_CAR2_PUNCT_ADERAT  0xf2910040
-#define F0900_P2_CAR2_ALPHA_MANT  0xf2910030
-#define F0900_P2_CAR2_ALPHA_EXP  0xf291000f
-
-/*P2_BCLC2*/
-#define R0900_P2_BCLC2  0xf292
-#define F0900_P2_DVBS2_NIP  0xf2920080
-#define F0900_P2_CAR2_PUNCT_BDERAT  0xf2920040
-#define F0900_P2_CAR2_BETA_MANT  0xf2920030
-#define F0900_P2_CAR2_BETA_EXP  0xf292000f
+#define R0900_P2_CAR2CFG 0xf290
+#define F0900_P2_CARRIER3_DISABLE 0xf2900040
+#define F0900_P2_ROTA2ON 0xf2900004
+#define F0900_P2_PH_DET_ALGO2 0xf2900003
+
+/*P2_CFR2CFR1*/
+#define R0900_P2_CFR2CFR1 0xf291
+#define F0900_P2_CFR2TOCFR1_DVBS1 0xf29100c0
+#define F0900_P2_EN_S2CAR2CENTER 0xf2910020
+#define F0900_P2_DIS_BCHERRCFR2 0xf2910010
+#define F0900_P2_CFR2TOCFR1_BETA 0xf2910007
 
 /*P2_CFR22*/
-#define R0900_P2_CFR22  0xf293
-#define F0900_P2_CAR2_FREQ2  0xf29301ff
+#define R0900_P2_CFR22 0xf293
+#define F0900_P2_CAR2_FREQ2 0xf29301ff
 
 /*P2_CFR21*/
-#define R0900_P2_CFR21  0xf294
-#define F0900_P2_CAR2_FREQ1  0xf29400ff
+#define R0900_P2_CFR21 0xf294
+#define F0900_P2_CAR2_FREQ1 0xf29400ff
 
 /*P2_CFR20*/
-#define R0900_P2_CFR20  0xf295
-#define F0900_P2_CAR2_FREQ0  0xf29500ff
+#define R0900_P2_CFR20 0xf295
+#define F0900_P2_CAR2_FREQ0 0xf29500ff
 
 /*P2_ACLC2S2Q*/
-#define R0900_P2_ACLC2S2Q  0xf297
-#define F0900_P2_ENAB_SPSKSYMB  0xf2970080
-#define F0900_P2_CAR2S2_QADERAT  0xf2970040
-#define F0900_P2_CAR2S2_Q_ALPH_M  0xf2970030
-#define F0900_P2_CAR2S2_Q_ALPH_E  0xf297000f
+#define R0900_P2_ACLC2S2Q 0xf297
+#define F0900_P2_ENAB_SPSKSYMB 0xf2970080
+#define F0900_P2_CAR2S2_Q_ALPH_M 0xf2970030
+#define F0900_P2_CAR2S2_Q_ALPH_E 0xf297000f
 
 /*P2_ACLC2S28*/
-#define R0900_P2_ACLC2S28  0xf298
-#define F0900_P2_OLDI3Q_MODE  0xf2980080
-#define F0900_P2_CAR2S2_8ADERAT  0xf2980040
-#define F0900_P2_CAR2S2_8_ALPH_M  0xf2980030
-#define F0900_P2_CAR2S2_8_ALPH_E  0xf298000f
+#define R0900_P2_ACLC2S28 0xf298
+#define F0900_P2_OLDI3Q_MODE 0xf2980080
+#define F0900_P2_CAR2S2_8_ALPH_M 0xf2980030
+#define F0900_P2_CAR2S2_8_ALPH_E 0xf298000f
 
 /*P2_ACLC2S216A*/
-#define R0900_P2_ACLC2S216A  0xf299
-#define F0900_P2_CAR2S2_16ADERAT  0xf2990040
-#define F0900_P2_CAR2S2_16A_ALPH_M  0xf2990030
-#define F0900_P2_CAR2S2_16A_ALPH_E  0xf299000f
+#define R0900_P2_ACLC2S216A 0xf299
+#define F0900_P2_DIS_C3STOPA2 0xf2990080
+#define F0900_P2_CAR2S2_16ADERAT 0xf2990040
+#define F0900_P2_CAR2S2_16A_ALPH_M 0xf2990030
+#define F0900_P2_CAR2S2_16A_ALPH_E 0xf299000f
 
 /*P2_ACLC2S232A*/
-#define R0900_P2_ACLC2S232A  0xf29a
-#define F0900_P2_CAR2S2_32ADERAT  0xf29a0040
-#define F0900_P2_CAR2S2_32A_ALPH_M  0xf29a0030
-#define F0900_P2_CAR2S2_32A_ALPH_E  0xf29a000f
+#define R0900_P2_ACLC2S232A 0xf29a
+#define F0900_P2_CAR2S2_32ADERAT 0xf29a0040
+#define F0900_P2_CAR2S2_32A_ALPH_M 0xf29a0030
+#define F0900_P2_CAR2S2_32A_ALPH_E 0xf29a000f
 
 /*P2_BCLC2S2Q*/
-#define R0900_P2_BCLC2S2Q  0xf29c
-#define F0900_P2_DVBS2S2Q_NIP  0xf29c0080
-#define F0900_P2_CAR2S2_QBDERAT  0xf29c0040
-#define F0900_P2_CAR2S2_Q_BETA_M  0xf29c0030
-#define F0900_P2_CAR2S2_Q_BETA_E  0xf29c000f
+#define R0900_P2_BCLC2S2Q 0xf29c
+#define F0900_P2_CAR2S2_Q_BETA_M 0xf29c0030
+#define F0900_P2_CAR2S2_Q_BETA_E 0xf29c000f
 
 /*P2_BCLC2S28*/
-#define R0900_P2_BCLC2S28  0xf29d
-#define F0900_P2_DVBS2S28_NIP  0xf29d0080
-#define F0900_P2_CAR2S2_8BDERAT  0xf29d0040
-#define F0900_P2_CAR2S2_8_BETA_M  0xf29d0030
-#define F0900_P2_CAR2S2_8_BETA_E  0xf29d000f
+#define R0900_P2_BCLC2S28 0xf29d
+#define F0900_P2_CAR2S2_8_BETA_M 0xf29d0030
+#define F0900_P2_CAR2S2_8_BETA_E 0xf29d000f
 
 /*P2_BCLC2S216A*/
-#define R0900_P2_BCLC2S216A  0xf29e
-#define F0900_P2_DVBS2S216A_NIP  0xf29e0080
-#define F0900_P2_CAR2S2_16BDERAT  0xf29e0040
-#define F0900_P2_CAR2S2_16A_BETA_M  0xf29e0030
-#define F0900_P2_CAR2S2_16A_BETA_E  0xf29e000f
+#define R0900_P2_BCLC2S216A 0xf29e
 
 /*P2_BCLC2S232A*/
-#define R0900_P2_BCLC2S232A  0xf29f
-#define F0900_P2_DVBS2S232A_NIP  0xf29f0080
-#define F0900_P2_CAR2S2_32BDERAT  0xf29f0040
-#define F0900_P2_CAR2S2_32A_BETA_M  0xf29f0030
-#define F0900_P2_CAR2S2_32A_BETA_E  0xf29f000f
+#define R0900_P2_BCLC2S232A 0xf29f
 
 /*P2_PLROOT2*/
-#define R0900_P2_PLROOT2  0xf2ac
-#define F0900_P2_SHORTFR_DISABLE  0xf2ac0080
-#define F0900_P2_LONGFR_DISABLE  0xf2ac0040
-#define F0900_P2_DUMMYPL_DISABLE  0xf2ac0020
-#define F0900_P2_SHORTFR_AVOID  0xf2ac0010
-#define F0900_P2_PLSCRAMB_MODE  0xf2ac000c
-#define F0900_P2_PLSCRAMB_ROOT2  0xf2ac0003
+#define R0900_P2_PLROOT2 0xf2ac
+#define F0900_P2_PLSCRAMB_MODE 0xf2ac000c
+#define F0900_P2_PLSCRAMB_ROOT2 0xf2ac0003
 
 /*P2_PLROOT1*/
-#define R0900_P2_PLROOT1  0xf2ad
-#define F0900_P2_PLSCRAMB_ROOT1  0xf2ad00ff
+#define R0900_P2_PLROOT1 0xf2ad
+#define F0900_P2_PLSCRAMB_ROOT1 0xf2ad00ff
 
 /*P2_PLROOT0*/
-#define R0900_P2_PLROOT0  0xf2ae
-#define F0900_P2_PLSCRAMB_ROOT0  0xf2ae00ff
+#define R0900_P2_PLROOT0 0xf2ae
+#define F0900_P2_PLSCRAMB_ROOT0 0xf2ae00ff
 
 /*P2_MODCODLST0*/
-#define R0900_P2_MODCODLST0  0xf2b0
-#define F0900_P2_EN_TOKEN31  0xf2b00080
-#define F0900_P2_SYNCTAG_SELECT  0xf2b00040
-#define F0900_P2_MODCODRQ_MODE  0xf2b00030
+#define R0900_P2_MODCODLST0 0xf2b0
 
 /*P2_MODCODLST1*/
-#define R0900_P2_MODCODLST1  0xf2b1
-#define F0900_P2_DIS_MODCOD29  0xf2b100f0
-#define F0900_P2_DIS_32PSK_9_10  0xf2b1000f
+#define R0900_P2_MODCODLST1 0xf2b1
+#define F0900_P2_DIS_MODCOD29 0xf2b100f0
+#define F0900_P2_DIS_32PSK_9_10 0xf2b1000f
 
 /*P2_MODCODLST2*/
-#define R0900_P2_MODCODLST2  0xf2b2
-#define F0900_P2_DIS_32PSK_8_9  0xf2b200f0
-#define F0900_P2_DIS_32PSK_5_6  0xf2b2000f
+#define R0900_P2_MODCODLST2 0xf2b2
+#define F0900_P2_DIS_32PSK_8_9 0xf2b200f0
+#define F0900_P2_DIS_32PSK_5_6 0xf2b2000f
 
 /*P2_MODCODLST3*/
-#define R0900_P2_MODCODLST3  0xf2b3
-#define F0900_P2_DIS_32PSK_4_5  0xf2b300f0
-#define F0900_P2_DIS_32PSK_3_4  0xf2b3000f
+#define R0900_P2_MODCODLST3 0xf2b3
+#define F0900_P2_DIS_32PSK_4_5 0xf2b300f0
+#define F0900_P2_DIS_32PSK_3_4 0xf2b3000f
 
 /*P2_MODCODLST4*/
-#define R0900_P2_MODCODLST4  0xf2b4
-#define F0900_P2_DIS_16PSK_9_10  0xf2b400f0
-#define F0900_P2_DIS_16PSK_8_9  0xf2b4000f
+#define R0900_P2_MODCODLST4 0xf2b4
+#define F0900_P2_DIS_16PSK_9_10 0xf2b400f0
+#define F0900_P2_DIS_16PSK_8_9 0xf2b4000f
 
 /*P2_MODCODLST5*/
-#define R0900_P2_MODCODLST5  0xf2b5
-#define F0900_P2_DIS_16PSK_5_6  0xf2b500f0
-#define F0900_P2_DIS_16PSK_4_5  0xf2b5000f
+#define R0900_P2_MODCODLST5 0xf2b5
+#define F0900_P2_DIS_16PSK_5_6 0xf2b500f0
+#define F0900_P2_DIS_16PSK_4_5 0xf2b5000f
 
 /*P2_MODCODLST6*/
-#define R0900_P2_MODCODLST6  0xf2b6
-#define F0900_P2_DIS_16PSK_3_4  0xf2b600f0
-#define F0900_P2_DIS_16PSK_2_3  0xf2b6000f
+#define R0900_P2_MODCODLST6 0xf2b6
+#define F0900_P2_DIS_16PSK_3_4 0xf2b600f0
+#define F0900_P2_DIS_16PSK_2_3 0xf2b6000f
 
 /*P2_MODCODLST7*/
-#define R0900_P2_MODCODLST7  0xf2b7
-#define F0900_P2_DIS_8P_9_10  0xf2b700f0
-#define F0900_P2_DIS_8P_8_9  0xf2b7000f
+#define R0900_P2_MODCODLST7 0xf2b7
+#define F0900_P2_DIS_8P_9_10 0xf2b700f0
+#define F0900_P2_DIS_8P_8_9 0xf2b7000f
 
 /*P2_MODCODLST8*/
-#define R0900_P2_MODCODLST8  0xf2b8
-#define F0900_P2_DIS_8P_5_6  0xf2b800f0
-#define F0900_P2_DIS_8P_3_4  0xf2b8000f
+#define R0900_P2_MODCODLST8 0xf2b8
+#define F0900_P2_DIS_8P_5_6 0xf2b800f0
+#define F0900_P2_DIS_8P_3_4 0xf2b8000f
 
 /*P2_MODCODLST9*/
-#define R0900_P2_MODCODLST9  0xf2b9
-#define F0900_P2_DIS_8P_2_3  0xf2b900f0
-#define F0900_P2_DIS_8P_3_5  0xf2b9000f
+#define R0900_P2_MODCODLST9 0xf2b9
+#define F0900_P2_DIS_8P_2_3 0xf2b900f0
+#define F0900_P2_DIS_8P_3_5 0xf2b9000f
 
 /*P2_MODCODLSTA*/
-#define R0900_P2_MODCODLSTA  0xf2ba
-#define F0900_P2_DIS_QP_9_10  0xf2ba00f0
-#define F0900_P2_DIS_QP_8_9  0xf2ba000f
+#define R0900_P2_MODCODLSTA 0xf2ba
+#define F0900_P2_DIS_QP_9_10 0xf2ba00f0
+#define F0900_P2_DIS_QP_8_9 0xf2ba000f
 
 /*P2_MODCODLSTB*/
-#define R0900_P2_MODCODLSTB  0xf2bb
-#define F0900_P2_DIS_QP_5_6  0xf2bb00f0
-#define F0900_P2_DIS_QP_4_5  0xf2bb000f
+#define R0900_P2_MODCODLSTB 0xf2bb
+#define F0900_P2_DIS_QP_5_6 0xf2bb00f0
+#define F0900_P2_DIS_QP_4_5 0xf2bb000f
 
 /*P2_MODCODLSTC*/
-#define R0900_P2_MODCODLSTC  0xf2bc
-#define F0900_P2_DIS_QP_3_4  0xf2bc00f0
-#define F0900_P2_DIS_QP_2_3  0xf2bc000f
+#define R0900_P2_MODCODLSTC 0xf2bc
+#define F0900_P2_DIS_QP_3_4 0xf2bc00f0
+#define F0900_P2_DIS_QP_2_3 0xf2bc000f
 
 /*P2_MODCODLSTD*/
-#define R0900_P2_MODCODLSTD  0xf2bd
-#define F0900_P2_DIS_QP_3_5  0xf2bd00f0
-#define F0900_P2_DIS_QP_1_2  0xf2bd000f
+#define R0900_P2_MODCODLSTD 0xf2bd
+#define F0900_P2_DIS_QP_3_5 0xf2bd00f0
+#define F0900_P2_DIS_QP_1_2 0xf2bd000f
 
 /*P2_MODCODLSTE*/
-#define R0900_P2_MODCODLSTE  0xf2be
-#define F0900_P2_DIS_QP_2_5  0xf2be00f0
-#define F0900_P2_DIS_QP_1_3  0xf2be000f
+#define R0900_P2_MODCODLSTE 0xf2be
+#define F0900_P2_DIS_QP_2_5 0xf2be00f0
+#define F0900_P2_DIS_QP_1_3 0xf2be000f
 
 /*P2_MODCODLSTF*/
-#define R0900_P2_MODCODLSTF  0xf2bf
-#define F0900_P2_DIS_QP_1_4  0xf2bf00f0
-#define F0900_P2_DDEMOD_SET  0xf2bf0002
-#define F0900_P2_DDEMOD_MASK  0xf2bf0001
+#define R0900_P2_MODCODLSTF 0xf2bf
+#define F0900_P2_DIS_QP_1_4 0xf2bf00f0
+
+/*P2_GAUSSR0*/
+#define R0900_P2_GAUSSR0 0xf2c0
+#define F0900_P2_EN_CCIMODE 0xf2c00080
+#define F0900_P2_R0_GAUSSIEN 0xf2c0007f
+
+/*P2_CCIR0*/
+#define R0900_P2_CCIR0 0xf2c1
+#define F0900_P2_CCIDETECT_PLHONLY 0xf2c10080
+#define F0900_P2_R0_CCI 0xf2c1007f
+
+/*P2_CCIQUANT*/
+#define R0900_P2_CCIQUANT 0xf2c2
+#define F0900_P2_CCI_BETA 0xf2c200e0
+#define F0900_P2_CCI_QUANT 0xf2c2001f
+
+/*P2_CCITHRES*/
+#define R0900_P2_CCITHRES 0xf2c3
+#define F0900_P2_CCI_THRESHOLD 0xf2c300ff
+
+/*P2_CCIACC*/
+#define R0900_P2_CCIACC 0xf2c4
+#define F0900_P2_CCI_VALUE 0xf2c400ff
 
 /*P2_DMDRESCFG*/
-#define R0900_P2_DMDRESCFG  0xf2c6
-#define F0900_P2_DMDRES_RESET  0xf2c60080
-#define F0900_P2_DMDRES_NOISESQR  0xf2c60010
-#define F0900_P2_DMDRES_STRALL  0xf2c60008
-#define F0900_P2_DMDRES_NEWONLY  0xf2c60004
-#define F0900_P2_DMDRES_NOSTORE  0xf2c60002
-#define F0900_P2_DMDRES_AGC2MEM  0xf2c60001
+#define R0900_P2_DMDRESCFG 0xf2c6
+#define F0900_P2_DMDRES_RESET 0xf2c60080
+#define F0900_P2_DMDRES_STRALL 0xf2c60008
+#define F0900_P2_DMDRES_NEWONLY 0xf2c60004
+#define F0900_P2_DMDRES_NOSTORE 0xf2c60002
 
 /*P2_DMDRESADR*/
-#define R0900_P2_DMDRESADR  0xf2c7
-#define F0900_P2_SUSP_PREDCANAL  0xf2c70080
-#define F0900_P2_DMDRES_VALIDCFR  0xf2c70040
-#define F0900_P2_DMDRES_MEMFULL  0xf2c70030
-#define F0900_P2_DMDRES_RESNBR  0xf2c7000f
+#define R0900_P2_DMDRESADR 0xf2c7
+#define F0900_P2_DMDRES_VALIDCFR 0xf2c70040
+#define F0900_P2_DMDRES_MEMFULL 0xf2c70030
+#define F0900_P2_DMDRES_RESNBR 0xf2c7000f
 
 /*P2_DMDRESDATA7*/
-#define R0900_P2_DMDRESDATA7  0xf2c8
-#define F0900_P2_DMDRES_DATA7  0xf2c800ff
+#define R0900_P2_DMDRESDATA7 0xf2c8
+#define F0900_P2_DMDRES_DATA7 0xf2c800ff
 
 /*P2_DMDRESDATA6*/
-#define R0900_P2_DMDRESDATA6  0xf2c9
-#define F0900_P2_DMDRES_DATA6  0xf2c900ff
+#define R0900_P2_DMDRESDATA6 0xf2c9
+#define F0900_P2_DMDRES_DATA6 0xf2c900ff
 
 /*P2_DMDRESDATA5*/
-#define R0900_P2_DMDRESDATA5  0xf2ca
-#define F0900_P2_DMDRES_DATA5  0xf2ca00ff
+#define R0900_P2_DMDRESDATA5 0xf2ca
+#define F0900_P2_DMDRES_DATA5 0xf2ca00ff
 
 /*P2_DMDRESDATA4*/
-#define R0900_P2_DMDRESDATA4  0xf2cb
-#define F0900_P2_DMDRES_DATA4  0xf2cb00ff
+#define R0900_P2_DMDRESDATA4 0xf2cb
+#define F0900_P2_DMDRES_DATA4 0xf2cb00ff
 
 /*P2_DMDRESDATA3*/
-#define R0900_P2_DMDRESDATA3  0xf2cc
-#define F0900_P2_DMDRES_DATA3  0xf2cc00ff
+#define R0900_P2_DMDRESDATA3 0xf2cc
+#define F0900_P2_DMDRES_DATA3 0xf2cc00ff
 
 /*P2_DMDRESDATA2*/
-#define R0900_P2_DMDRESDATA2  0xf2cd
-#define F0900_P2_DMDRES_DATA2  0xf2cd00ff
+#define R0900_P2_DMDRESDATA2 0xf2cd
+#define F0900_P2_DMDRES_DATA2 0xf2cd00ff
 
 /*P2_DMDRESDATA1*/
-#define R0900_P2_DMDRESDATA1  0xf2ce
-#define F0900_P2_DMDRES_DATA1  0xf2ce00ff
+#define R0900_P2_DMDRESDATA1 0xf2ce
+#define F0900_P2_DMDRES_DATA1 0xf2ce00ff
 
 /*P2_DMDRESDATA0*/
-#define R0900_P2_DMDRESDATA0  0xf2cf
-#define F0900_P2_DMDRES_DATA0  0xf2cf00ff
+#define R0900_P2_DMDRESDATA0 0xf2cf
+#define F0900_P2_DMDRES_DATA0 0xf2cf00ff
 
 /*P2_FFEI1*/
-#define R0900_P2_FFEI1  0xf2d0
-#define F0900_P2_FFE_ACCI1  0xf2d001ff
+#define R0900_P2_FFEI1 0xf2d0
+#define F0900_P2_FFE_ACCI1 0xf2d001ff
 
 /*P2_FFEQ1*/
-#define R0900_P2_FFEQ1  0xf2d1
-#define F0900_P2_FFE_ACCQ1  0xf2d101ff
+#define R0900_P2_FFEQ1 0xf2d1
+#define F0900_P2_FFE_ACCQ1 0xf2d101ff
 
 /*P2_FFEI2*/
-#define R0900_P2_FFEI2  0xf2d2
-#define F0900_P2_FFE_ACCI2  0xf2d201ff
+#define R0900_P2_FFEI2 0xf2d2
+#define F0900_P2_FFE_ACCI2 0xf2d201ff
 
 /*P2_FFEQ2*/
-#define R0900_P2_FFEQ2  0xf2d3
-#define F0900_P2_FFE_ACCQ2  0xf2d301ff
+#define R0900_P2_FFEQ2 0xf2d3
+#define F0900_P2_FFE_ACCQ2 0xf2d301ff
 
 /*P2_FFEI3*/
-#define R0900_P2_FFEI3  0xf2d4
-#define F0900_P2_FFE_ACCI3  0xf2d401ff
+#define R0900_P2_FFEI3 0xf2d4
+#define F0900_P2_FFE_ACCI3 0xf2d401ff
 
 /*P2_FFEQ3*/
-#define R0900_P2_FFEQ3  0xf2d5
-#define F0900_P2_FFE_ACCQ3  0xf2d501ff
+#define R0900_P2_FFEQ3 0xf2d5
+#define F0900_P2_FFE_ACCQ3 0xf2d501ff
 
 /*P2_FFEI4*/
-#define R0900_P2_FFEI4  0xf2d6
-#define F0900_P2_FFE_ACCI4  0xf2d601ff
+#define R0900_P2_FFEI4 0xf2d6
+#define F0900_P2_FFE_ACCI4 0xf2d601ff
 
 /*P2_FFEQ4*/
-#define R0900_P2_FFEQ4  0xf2d7
-#define F0900_P2_FFE_ACCQ4  0xf2d701ff
+#define R0900_P2_FFEQ4 0xf2d7
+#define F0900_P2_FFE_ACCQ4 0xf2d701ff
 
 /*P2_FFECFG*/
-#define R0900_P2_FFECFG  0xf2d8
-#define F0900_P2_EQUALFFE_ON  0xf2d80040
-#define F0900_P2_EQUAL_USEDSYMB  0xf2d80030
-#define F0900_P2_MU_EQUALFFE  0xf2d80007
+#define R0900_P2_FFECFG 0xf2d8
+#define F0900_P2_EQUALFFE_ON 0xf2d80040
+#define F0900_P2_MU_EQUALFFE 0xf2d80007
 
 /*P2_TNRCFG*/
-#define R0900_P2_TNRCFG  0xf2e0
-#define F0900_P2_TUN_ACKFAIL  0xf2e00080
-#define F0900_P2_TUN_TYPE  0xf2e00070
-#define F0900_P2_TUN_SECSTOP  0xf2e00008
-#define F0900_P2_TUN_VCOSRCH  0xf2e00004
-#define F0900_P2_TUN_MADDRESS  0xf2e00003
+#define R0900_P2_TNRCFG 0xf2e0
+#define F0900_P2_TUN_ACKFAIL 0xf2e00080
+#define F0900_P2_TUN_TYPE 0xf2e00070
+#define F0900_P2_TUN_SECSTOP 0xf2e00008
+#define F0900_P2_TUN_VCOSRCH 0xf2e00004
+#define F0900_P2_TUN_MADDRESS 0xf2e00003
 
 /*P2_TNRCFG2*/
-#define R0900_P2_TNRCFG2  0xf2e1
-#define F0900_P2_TUN_IQSWAP  0xf2e10080
-#define F0900_P2_STB6110_STEP2MHZ  0xf2e10040
-#define F0900_P2_STB6120_DBLI2C  0xf2e10020
-#define F0900_P2_DIS_FCCK  0xf2e10010
-#define F0900_P2_DIS_LPEN  0xf2e10008
-#define F0900_P2_DIS_BWCALC  0xf2e10004
-#define F0900_P2_SHORT_WAITSTATES  0xf2e10002
-#define F0900_P2_DIS_2BWAGC1  0xf2e10001
+#define R0900_P2_TNRCFG2 0xf2e1
+#define F0900_P2_TUN_IQSWAP 0xf2e10080
+#define F0900_P2_DIS_BWCALC 0xf2e10004
+#define F0900_P2_SHORT_WAITSTATES 0xf2e10002
 
 /*P2_TNRXTAL*/
-#define R0900_P2_TNRXTAL  0xf2e4
-#define F0900_P2_TUN_MCLKDECIMAL  0xf2e400e0
-#define F0900_P2_TUN_XTALFREQ  0xf2e4001f
+#define R0900_P2_TNRXTAL 0xf2e4
+#define F0900_P2_TUN_XTALFREQ 0xf2e4001f
 
 /*P2_TNRSTEPS*/
-#define R0900_P2_TNRSTEPS  0xf2e7
-#define F0900_P2_TUNER_BW1P6  0xf2e70080
-#define F0900_P2_BWINC_OFFSET  0xf2e70070
-#define F0900_P2_SOFTSTEP_RNG  0xf2e70008
-#define F0900_P2_TUN_BWOFFSET  0xf2e70107
+#define R0900_P2_TNRSTEPS 0xf2e7
+#define F0900_P2_TUNER_BW0P125 0xf2e70080
+#define F0900_P2_BWINC_OFFSET 0xf2e70170
+#define F0900_P2_SOFTSTEP_RNG 0xf2e70008
+#define F0900_P2_TUN_BWOFFSET 0xf2e70007
 
 /*P2_TNRGAIN*/
-#define R0900_P2_TNRGAIN  0xf2e8
-#define F0900_P2_TUN_KDIVEN  0xf2e800c0
-#define F0900_P2_STB6X00_OCK  0xf2e80030
-#define F0900_P2_TUN_GAIN  0xf2e8000f
+#define R0900_P2_TNRGAIN 0xf2e8
+#define F0900_P2_TUN_KDIVEN 0xf2e800c0
+#define F0900_P2_STB6X00_OCK 0xf2e80030
+#define F0900_P2_TUN_GAIN 0xf2e8000f
 
 /*P2_TNRRF1*/
-#define R0900_P2_TNRRF1  0xf2e9
-#define F0900_P2_TUN_RFFREQ2  0xf2e900ff
+#define R0900_P2_TNRRF1 0xf2e9
+#define F0900_P2_TUN_RFFREQ2 0xf2e900ff
 
 /*P2_TNRRF0*/
-#define R0900_P2_TNRRF0  0xf2ea
-#define F0900_P2_TUN_RFFREQ1  0xf2ea00ff
+#define R0900_P2_TNRRF0 0xf2ea
+#define F0900_P2_TUN_RFFREQ1 0xf2ea00ff
 
 /*P2_TNRBW*/
-#define R0900_P2_TNRBW  0xf2eb
-#define F0900_P2_TUN_RFFREQ0  0xf2eb00c0
-#define F0900_P2_TUN_BW  0xf2eb003f
+#define R0900_P2_TNRBW 0xf2eb
+#define F0900_P2_TUN_RFFREQ0 0xf2eb00c0
+#define F0900_P2_TUN_BW 0xf2eb003f
 
 /*P2_TNRADJ*/
-#define R0900_P2_TNRADJ  0xf2ec
-#define F0900_P2_STB61X0_RCLK  0xf2ec0080
-#define F0900_P2_STB61X0_CALTIME  0xf2ec0040
-#define F0900_P2_STB6X00_DLB  0xf2ec0038
-#define F0900_P2_STB6000_FCL  0xf2ec0007
+#define R0900_P2_TNRADJ 0xf2ec
+#define F0900_P2_STB61X0_CALTIME 0xf2ec0040
 
 /*P2_TNRCTL2*/
-#define R0900_P2_TNRCTL2  0xf2ed
-#define F0900_P2_STB61X0_LCP1_RCCKOFF  0xf2ed0080
-#define F0900_P2_STB61X0_LCP0  0xf2ed0040
-#define F0900_P2_STB61X0_XTOUT_RFOUTS  0xf2ed0020
-#define F0900_P2_STB61X0_XTON_MCKDV  0xf2ed0010
-#define F0900_P2_STB61X0_CALOFF_DCOFF  0xf2ed0008
-#define F0900_P2_STB6110_LPT  0xf2ed0004
-#define F0900_P2_STB6110_RX  0xf2ed0002
-#define F0900_P2_STB6110_SYN  0xf2ed0001
+#define R0900_P2_TNRCTL2 0xf2ed
+#define F0900_P2_STB61X0_RCCKOFF 0xf2ed0080
+#define F0900_P2_STB61X0_ICP_SDOFF 0xf2ed0040
+#define F0900_P2_STB61X0_DCLOOPOFF 0xf2ed0020
+#define F0900_P2_STB61X0_REFOUTSEL 0xf2ed0010
+#define F0900_P2_STB61X0_CALOFF 0xf2ed0008
+#define F0900_P2_STB6XX0_LPT_BEN 0xf2ed0004
+#define F0900_P2_STB6XX0_RX_OSCP 0xf2ed0002
+#define F0900_P2_STB6XX0_SYN 0xf2ed0001
 
 /*P2_TNRCFG3*/
-#define R0900_P2_TNRCFG3  0xf2ee
-#define F0900_P2_STB6120_DISCTRL1  0xf2ee0080
-#define F0900_P2_STB6120_INVORDER  0xf2ee0040
-#define F0900_P2_STB6120_ENCTRL6  0xf2ee0020
-#define F0900_P2_TUN_PLLFREQ  0xf2ee001c
-#define F0900_P2_TUN_I2CFREQ_MODE  0xf2ee0003
+#define R0900_P2_TNRCFG3 0xf2ee
+#define F0900_P2_TUN_PLLFREQ 0xf2ee001c
+#define F0900_P2_TUN_I2CFREQ_MODE 0xf2ee0003
 
 /*P2_TNRLAUNCH*/
-#define R0900_P2_TNRLAUNCH  0xf2f0
+#define R0900_P2_TNRLAUNCH 0xf2f0
 
 /*P2_TNRLD*/
-#define R0900_P2_TNRLD  0xf2f0
-#define F0900_P2_TUNLD_VCOING  0xf2f00080
-#define F0900_P2_TUN_REG1FAIL  0xf2f00040
-#define F0900_P2_TUN_REG2FAIL  0xf2f00020
-#define F0900_P2_TUN_REG3FAIL  0xf2f00010
-#define F0900_P2_TUN_REG4FAIL  0xf2f00008
-#define F0900_P2_TUN_REG5FAIL  0xf2f00004
-#define F0900_P2_TUN_BWING  0xf2f00002
-#define F0900_P2_TUN_LOCKED  0xf2f00001
+#define R0900_P2_TNRLD 0xf2f0
+#define F0900_P2_TUNLD_VCOING 0xf2f00080
+#define F0900_P2_TUN_REG1FAIL 0xf2f00040
+#define F0900_P2_TUN_REG2FAIL 0xf2f00020
+#define F0900_P2_TUN_REG3FAIL 0xf2f00010
+#define F0900_P2_TUN_REG4FAIL 0xf2f00008
+#define F0900_P2_TUN_REG5FAIL 0xf2f00004
+#define F0900_P2_TUN_BWING 0xf2f00002
+#define F0900_P2_TUN_LOCKED 0xf2f00001
 
 /*P2_TNROBSL*/
-#define R0900_P2_TNROBSL  0xf2f6
-#define F0900_P2_TUN_I2CABORTED  0xf2f60080
-#define F0900_P2_TUN_LPEN  0xf2f60040
-#define F0900_P2_TUN_FCCK  0xf2f60020
-#define F0900_P2_TUN_I2CLOCKED  0xf2f60010
-#define F0900_P2_TUN_PROGDONE  0xf2f6000c
-#define F0900_P2_TUN_RFRESTE1  0xf2f60003
+#define R0900_P2_TNROBSL 0xf2f6
+#define F0900_P2_TUN_I2CABORTED 0xf2f60080
+#define F0900_P2_TUN_LPEN 0xf2f60040
+#define F0900_P2_TUN_FCCK 0xf2f60020
+#define F0900_P2_TUN_I2CLOCKED 0xf2f60010
+#define F0900_P2_TUN_PROGDONE 0xf2f6000c
+#define F0900_P2_TUN_RFRESTE1 0xf2f60003
 
 /*P2_TNRRESTE*/
-#define R0900_P2_TNRRESTE  0xf2f7
-#define F0900_P2_TUN_RFRESTE0  0xf2f700ff
+#define R0900_P2_TNRRESTE 0xf2f7
+#define F0900_P2_TUN_RFRESTE0 0xf2f700ff
 
 /*P2_SMAPCOEF7*/
-#define R0900_P2_SMAPCOEF7  0xf300
-#define F0900_P2_DIS_QSCALE  0xf3000080
-#define F0900_P2_SMAPCOEF_Q_LLR12  0xf300017f
+#define R0900_P2_SMAPCOEF7 0xf300
+#define F0900_P2_DIS_QSCALE 0xf3000080
+#define F0900_P2_SMAPCOEF_Q_LLR12 0xf300017f
 
 /*P2_SMAPCOEF6*/
-#define R0900_P2_SMAPCOEF6  0xf301
-#define F0900_P2_DIS_NEWSCALE  0xf3010008
-#define F0900_P2_ADJ_8PSKLLR1  0xf3010004
-#define F0900_P2_OLD_8PSKLLR1  0xf3010002
-#define F0900_P2_DIS_AB8PSK  0xf3010001
+#define R0900_P2_SMAPCOEF6 0xf301
+#define F0900_P2_ADJ_8PSKLLR1 0xf3010004
+#define F0900_P2_OLD_8PSKLLR1 0xf3010002
+#define F0900_P2_DIS_AB8PSK 0xf3010001
 
 /*P2_SMAPCOEF5*/
-#define R0900_P2_SMAPCOEF5  0xf302
-#define F0900_P2_DIS_8SCALE  0xf3020080
-#define F0900_P2_SMAPCOEF_8P_LLR23  0xf302017f
+#define R0900_P2_SMAPCOEF5 0xf302
+#define F0900_P2_DIS_8SCALE 0xf3020080
+#define F0900_P2_SMAPCOEF_8P_LLR23 0xf302017f
+
+/*P2_NCO2MAX1*/
+#define R0900_P2_NCO2MAX1 0xf314
+#define F0900_P2_TETA2_MAXVABS1 0xf31400ff
+
+/*P2_NCO2MAX0*/
+#define R0900_P2_NCO2MAX0 0xf315
+#define F0900_P2_TETA2_MAXVABS0 0xf31500ff
+
+/*P2_NCO2FR1*/
+#define R0900_P2_NCO2FR1 0xf316
+#define F0900_P2_NCO2FINAL_ANGLE1 0xf31600ff
+
+/*P2_NCO2FR0*/
+#define R0900_P2_NCO2FR0 0xf317
+#define F0900_P2_NCO2FINAL_ANGLE0 0xf31700ff
+
+/*P2_CFR2AVRGE1*/
+#define R0900_P2_CFR2AVRGE1 0xf318
+#define F0900_P2_I2C_CFR2AVERAGE1 0xf31800ff
+
+/*P2_CFR2AVRGE0*/
+#define R0900_P2_CFR2AVRGE0 0xf319
+#define F0900_P2_I2C_CFR2AVERAGE0 0xf31900ff
 
 /*P2_DMDPLHSTAT*/
-#define R0900_P2_DMDPLHSTAT  0xf320
-#define F0900_P2_PLH_STATISTIC  0xf32000ff
+#define R0900_P2_DMDPLHSTAT 0xf320
+#define F0900_P2_PLH_STATISTIC 0xf32000ff
 
 /*P2_LOCKTIME3*/
-#define R0900_P2_LOCKTIME3  0xf322
-#define F0900_P2_DEMOD_LOCKTIME3  0xf32200ff
+#define R0900_P2_LOCKTIME3 0xf322
+#define F0900_P2_DEMOD_LOCKTIME3 0xf32200ff
 
 /*P2_LOCKTIME2*/
-#define R0900_P2_LOCKTIME2  0xf323
-#define F0900_P2_DEMOD_LOCKTIME2  0xf32300ff
+#define R0900_P2_LOCKTIME2 0xf323
+#define F0900_P2_DEMOD_LOCKTIME2 0xf32300ff
 
 /*P2_LOCKTIME1*/
-#define R0900_P2_LOCKTIME1  0xf324
-#define F0900_P2_DEMOD_LOCKTIME1  0xf32400ff
+#define R0900_P2_LOCKTIME1 0xf324
+#define F0900_P2_DEMOD_LOCKTIME1 0xf32400ff
 
 /*P2_LOCKTIME0*/
-#define R0900_P2_LOCKTIME0  0xf325
-#define F0900_P2_DEMOD_LOCKTIME0  0xf32500ff
+#define R0900_P2_LOCKTIME0 0xf325
+#define F0900_P2_DEMOD_LOCKTIME0 0xf32500ff
 
 /*P2_VITSCALE*/
-#define R0900_P2_VITSCALE  0xf332
-#define F0900_P2_NVTH_NOSRANGE  0xf3320080
-#define F0900_P2_VERROR_MAXMODE  0xf3320040
-#define F0900_P2_KDIV_MODE  0xf3320030
-#define F0900_P2_NSLOWSN_LOCKED  0xf3320008
-#define F0900_P2_DELOCK_PRFLOSS  0xf3320004
-#define F0900_P2_DIS_RSFLOCK  0xf3320002
+#define R0900_P2_VITSCALE 0xf332
+#define F0900_P2_NVTH_NOSRANGE 0xf3320080
+#define F0900_P2_VERROR_MAXMODE 0xf3320040
+#define F0900_P2_NSLOWSN_LOCKED 0xf3320008
+#define F0900_P2_DIS_RSFLOCK 0xf3320002
 
 /*P2_FECM*/
-#define R0900_P2_FECM  0xf333
-#define F0900_P2_DSS_DVB  0xf3330080
-#define F0900_P2_DEMOD_BYPASS  0xf3330040
-#define F0900_P2_CMP_SLOWMODE  0xf3330020
-#define F0900_P2_DSS_SRCH  0xf3330010
-#define F0900_P2_DIFF_MODEVIT  0xf3330004
-#define F0900_P2_SYNCVIT  0xf3330002
-#define F0900_P2_IQINV  0xf3330001
+#define R0900_P2_FECM 0xf333
+#define F0900_P2_DSS_DVB 0xf3330080
+#define F0900_P2_DSS_SRCH 0xf3330010
+#define F0900_P2_SYNCVIT 0xf3330002
+#define F0900_P2_IQINV 0xf3330001
 
 /*P2_VTH12*/
-#define R0900_P2_VTH12  0xf334
-#define F0900_P2_VTH12  0xf33400ff
+#define R0900_P2_VTH12 0xf334
+#define F0900_P2_VTH12 0xf33400ff
 
 /*P2_VTH23*/
-#define R0900_P2_VTH23  0xf335
-#define F0900_P2_VTH23  0xf33500ff
+#define R0900_P2_VTH23 0xf335
+#define F0900_P2_VTH23 0xf33500ff
 
 /*P2_VTH34*/
-#define R0900_P2_VTH34  0xf336
-#define F0900_P2_VTH34  0xf33600ff
+#define R0900_P2_VTH34 0xf336
+#define F0900_P2_VTH34 0xf33600ff
 
 /*P2_VTH56*/
-#define R0900_P2_VTH56  0xf337
-#define F0900_P2_VTH56  0xf33700ff
+#define R0900_P2_VTH56 0xf337
+#define F0900_P2_VTH56 0xf33700ff
 
 /*P2_VTH67*/
-#define R0900_P2_VTH67  0xf338
-#define F0900_P2_VTH67  0xf33800ff
+#define R0900_P2_VTH67 0xf338
+#define F0900_P2_VTH67 0xf33800ff
 
 /*P2_VTH78*/
-#define R0900_P2_VTH78  0xf339
-#define F0900_P2_VTH78  0xf33900ff
+#define R0900_P2_VTH78 0xf339
+#define F0900_P2_VTH78 0xf33900ff
 
 /*P2_VITCURPUN*/
-#define R0900_P2_VITCURPUN  0xf33a
-#define F0900_P2_VIT_MAPPING  0xf33a00e0
-#define F0900_P2_VIT_CURPUN  0xf33a001f
+#define R0900_P2_VITCURPUN 0xf33a
+#define F0900_P2_VIT_CURPUN 0xf33a001f
 
 /*P2_VERROR*/
-#define R0900_P2_VERROR  0xf33b
-#define F0900_P2_REGERR_VIT  0xf33b00ff
+#define R0900_P2_VERROR 0xf33b
+#define F0900_P2_REGERR_VIT 0xf33b00ff
 
 /*P2_PRVIT*/
-#define R0900_P2_PRVIT  0xf33c
-#define F0900_P2_DIS_VTHLOCK  0xf33c0040
-#define F0900_P2_E7_8VIT  0xf33c0020
-#define F0900_P2_E6_7VIT  0xf33c0010
-#define F0900_P2_E5_6VIT  0xf33c0008
-#define F0900_P2_E3_4VIT  0xf33c0004
-#define F0900_P2_E2_3VIT  0xf33c0002
-#define F0900_P2_E1_2VIT  0xf33c0001
+#define R0900_P2_PRVIT 0xf33c
+#define F0900_P2_DIS_VTHLOCK 0xf33c0040
+#define F0900_P2_E7_8VIT 0xf33c0020
+#define F0900_P2_E6_7VIT 0xf33c0010
+#define F0900_P2_E5_6VIT 0xf33c0008
+#define F0900_P2_E3_4VIT 0xf33c0004
+#define F0900_P2_E2_3VIT 0xf33c0002
+#define F0900_P2_E1_2VIT 0xf33c0001
 
 /*P2_VAVSRVIT*/
-#define R0900_P2_VAVSRVIT  0xf33d
-#define F0900_P2_AMVIT  0xf33d0080
-#define F0900_P2_FROZENVIT  0xf33d0040
-#define F0900_P2_SNVIT  0xf33d0030
-#define F0900_P2_TOVVIT  0xf33d000c
-#define F0900_P2_HYPVIT  0xf33d0003
+#define R0900_P2_VAVSRVIT 0xf33d
+#define F0900_P2_AMVIT 0xf33d0080
+#define F0900_P2_FROZENVIT 0xf33d0040
+#define F0900_P2_SNVIT 0xf33d0030
+#define F0900_P2_TOVVIT 0xf33d000c
+#define F0900_P2_HYPVIT 0xf33d0003
 
 /*P2_VSTATUSVIT*/
-#define R0900_P2_VSTATUSVIT  0xf33e
-#define F0900_P2_VITERBI_ON  0xf33e0080
-#define F0900_P2_END_LOOPVIT  0xf33e0040
-#define F0900_P2_VITERBI_DEPRF  0xf33e0020
-#define F0900_P2_PRFVIT  0xf33e0010
-#define F0900_P2_LOCKEDVIT  0xf33e0008
-#define F0900_P2_VITERBI_DELOCK  0xf33e0004
-#define F0900_P2_VIT_DEMODSEL  0xf33e0002
-#define F0900_P2_VITERBI_COMPOUT  0xf33e0001
+#define R0900_P2_VSTATUSVIT 0xf33e
+#define F0900_P2_PRFVIT 0xf33e0010
+#define F0900_P2_LOCKEDVIT 0xf33e0008
 
 /*P2_VTHINUSE*/
-#define R0900_P2_VTHINUSE  0xf33f
-#define F0900_P2_VIT_INUSE  0xf33f00ff
+#define R0900_P2_VTHINUSE 0xf33f
+#define F0900_P2_VIT_INUSE 0xf33f00ff
 
 /*P2_KDIV12*/
-#define R0900_P2_KDIV12  0xf340
-#define F0900_P2_KDIV12_MANUAL  0xf3400080
-#define F0900_P2_K_DIVIDER_12  0xf340007f
+#define R0900_P2_KDIV12 0xf340
+#define F0900_P2_K_DIVIDER_12 0xf340007f
 
 /*P2_KDIV23*/
-#define R0900_P2_KDIV23  0xf341
-#define F0900_P2_KDIV23_MANUAL  0xf3410080
-#define F0900_P2_K_DIVIDER_23  0xf341007f
+#define R0900_P2_KDIV23 0xf341
+#define F0900_P2_K_DIVIDER_23 0xf341007f
 
 /*P2_KDIV34*/
-#define R0900_P2_KDIV34  0xf342
-#define F0900_P2_KDIV34_MANUAL  0xf3420080
-#define F0900_P2_K_DIVIDER_34  0xf342007f
+#define R0900_P2_KDIV34 0xf342
+#define F0900_P2_K_DIVIDER_34 0xf342007f
 
 /*P2_KDIV56*/
-#define R0900_P2_KDIV56  0xf343
-#define F0900_P2_KDIV56_MANUAL  0xf3430080
-#define F0900_P2_K_DIVIDER_56  0xf343007f
+#define R0900_P2_KDIV56 0xf343
+#define F0900_P2_K_DIVIDER_56 0xf343007f
 
 /*P2_KDIV67*/
-#define R0900_P2_KDIV67  0xf344
-#define F0900_P2_KDIV67_MANUAL  0xf3440080
-#define F0900_P2_K_DIVIDER_67  0xf344007f
+#define R0900_P2_KDIV67 0xf344
+#define F0900_P2_K_DIVIDER_67 0xf344007f
 
 /*P2_KDIV78*/
-#define R0900_P2_KDIV78  0xf345
-#define F0900_P2_KDIV78_MANUAL  0xf3450080
-#define F0900_P2_K_DIVIDER_78  0xf345007f
+#define R0900_P2_KDIV78 0xf345
+#define F0900_P2_K_DIVIDER_78 0xf345007f
 
 /*P2_PDELCTRL1*/
-#define R0900_P2_PDELCTRL1  0xf350
-#define F0900_P2_INV_MISMASK  0xf3500080
-#define F0900_P2_FORCE_ACCEPTED  0xf3500040
-#define F0900_P2_FILTER_EN  0xf3500020
-#define F0900_P2_FORCE_PKTDELINUSE  0xf3500010
-#define F0900_P2_HYSTEN  0xf3500008
-#define F0900_P2_HYSTSWRST  0xf3500004
-#define F0900_P2_EN_MIS00  0xf3500002
-#define F0900_P2_ALGOSWRST  0xf3500001
+#define R0900_P2_PDELCTRL1 0xf350
+#define F0900_P2_INV_MISMASK 0xf3500080
+#define F0900_P2_FILTER_EN 0xf3500020
+#define F0900_P2_EN_MIS00 0xf3500002
+#define F0900_P2_ALGOSWRST 0xf3500001
 
 /*P2_PDELCTRL2*/
-#define R0900_P2_PDELCTRL2  0xf351
-#define F0900_P2_FORCE_CONTINUOUS  0xf3510080
-#define F0900_P2_RESET_UPKO_COUNT  0xf3510040
-#define F0900_P2_USER_PKTDELIN_NB  0xf3510020
-#define F0900_P2_FORCE_LOCKED  0xf3510010
-#define F0900_P2_DATA_UNBBSCRAM  0xf3510008
-#define F0900_P2_FORCE_LONGPKT  0xf3510004
-#define F0900_P2_FRAME_MODE  0xf3510002
+#define R0900_P2_PDELCTRL2 0xf351
+#define F0900_P2_RESET_UPKO_COUNT 0xf3510040
+#define F0900_P2_FRAME_MODE 0xf3510002
+#define F0900_P2_NOBCHERRFLG_USE 0xf3510001
 
 /*P2_HYSTTHRESH*/
-#define R0900_P2_HYSTTHRESH  0xf354
-#define F0900_P2_UNLCK_THRESH  0xf35400f0
-#define F0900_P2_DELIN_LCK_THRESH  0xf354000f
+#define R0900_P2_HYSTTHRESH 0xf354
+#define F0900_P2_UNLCK_THRESH 0xf35400f0
+#define F0900_P2_DELIN_LCK_THRESH 0xf354000f
 
 /*P2_ISIENTRY*/
-#define R0900_P2_ISIENTRY  0xf35e
-#define F0900_P2_ISI_ENTRY  0xf35e00ff
+#define R0900_P2_ISIENTRY 0xf35e
+#define F0900_P2_ISI_ENTRY 0xf35e00ff
 
 /*P2_ISIBITENA*/
-#define R0900_P2_ISIBITENA  0xf35f
-#define F0900_P2_ISI_BIT_EN  0xf35f00ff
+#define R0900_P2_ISIBITENA 0xf35f
+#define F0900_P2_ISI_BIT_EN 0xf35f00ff
 
 /*P2_MATSTR1*/
-#define R0900_P2_MATSTR1  0xf360
-#define F0900_P2_MATYPE_CURRENT1  0xf36000ff
+#define R0900_P2_MATSTR1 0xf360
+#define F0900_P2_MATYPE_CURRENT1 0xf36000ff
 
 /*P2_MATSTR0*/
-#define R0900_P2_MATSTR0  0xf361
-#define F0900_P2_MATYPE_CURRENT0  0xf36100ff
+#define R0900_P2_MATSTR0 0xf361
+#define F0900_P2_MATYPE_CURRENT0 0xf36100ff
 
 /*P2_UPLSTR1*/
-#define R0900_P2_UPLSTR1  0xf362
-#define F0900_P2_UPL_CURRENT1  0xf36200ff
+#define R0900_P2_UPLSTR1 0xf362
+#define F0900_P2_UPL_CURRENT1 0xf36200ff
 
 /*P2_UPLSTR0*/
-#define R0900_P2_UPLSTR0  0xf363
-#define F0900_P2_UPL_CURRENT0  0xf36300ff
+#define R0900_P2_UPLSTR0 0xf363
+#define F0900_P2_UPL_CURRENT0 0xf36300ff
 
 /*P2_DFLSTR1*/
-#define R0900_P2_DFLSTR1  0xf364
-#define F0900_P2_DFL_CURRENT1  0xf36400ff
+#define R0900_P2_DFLSTR1 0xf364
+#define F0900_P2_DFL_CURRENT1 0xf36400ff
 
 /*P2_DFLSTR0*/
-#define R0900_P2_DFLSTR0  0xf365
-#define F0900_P2_DFL_CURRENT0  0xf36500ff
+#define R0900_P2_DFLSTR0 0xf365
+#define F0900_P2_DFL_CURRENT0 0xf36500ff
 
 /*P2_SYNCSTR*/
-#define R0900_P2_SYNCSTR  0xf366
-#define F0900_P2_SYNC_CURRENT  0xf36600ff
+#define R0900_P2_SYNCSTR 0xf366
+#define F0900_P2_SYNC_CURRENT 0xf36600ff
 
 /*P2_SYNCDSTR1*/
-#define R0900_P2_SYNCDSTR1  0xf367
-#define F0900_P2_SYNCD_CURRENT1  0xf36700ff
+#define R0900_P2_SYNCDSTR1 0xf367
+#define F0900_P2_SYNCD_CURRENT1 0xf36700ff
 
 /*P2_SYNCDSTR0*/
-#define R0900_P2_SYNCDSTR0  0xf368
-#define F0900_P2_SYNCD_CURRENT0  0xf36800ff
+#define R0900_P2_SYNCDSTR0 0xf368
+#define F0900_P2_SYNCD_CURRENT0 0xf36800ff
 
 /*P2_PDELSTATUS1*/
-#define R0900_P2_PDELSTATUS1  0xf369
-#define F0900_P2_PKTDELIN_DELOCK  0xf3690080
-#define F0900_P2_SYNCDUPDFL_BADDFL  0xf3690040
-#define F0900_P2_CONTINUOUS_STREAM  0xf3690020
-#define F0900_P2_UNACCEPTED_STREAM  0xf3690010
-#define F0900_P2_BCH_ERROR_FLAG  0xf3690008
-#define F0900_P2_BBHCRCKO  0xf3690004
-#define F0900_P2_PKTDELIN_LOCK  0xf3690002
-#define F0900_P2_FIRST_LOCK  0xf3690001
+#define R0900_P2_PDELSTATUS1 0xf369
+#define F0900_P2_PKTDELIN_DELOCK 0xf3690080
+#define F0900_P2_SYNCDUPDFL_BADDFL 0xf3690040
+#define F0900_P2_CONTINUOUS_STREAM 0xf3690020
+#define F0900_P2_UNACCEPTED_STREAM 0xf3690010
+#define F0900_P2_BCH_ERROR_FLAG 0xf3690008
+#define F0900_P2_PKTDELIN_LOCK 0xf3690002
+#define F0900_P2_FIRST_LOCK 0xf3690001
 
 /*P2_PDELSTATUS2*/
-#define R0900_P2_PDELSTATUS2  0xf36a
-#define F0900_P2_PKTDEL_DEMODSEL  0xf36a0080
-#define F0900_P2_FRAME_MODCOD  0xf36a007c
-#define F0900_P2_FRAME_TYPE  0xf36a0003
+#define R0900_P2_PDELSTATUS2 0xf36a
+#define F0900_P2_FRAME_MODCOD 0xf36a007c
+#define F0900_P2_FRAME_TYPE 0xf36a0003
 
 /*P2_BBFCRCKO1*/
-#define R0900_P2_BBFCRCKO1  0xf36b
-#define F0900_P2_BBHCRC_KOCNT1  0xf36b00ff
+#define R0900_P2_BBFCRCKO1 0xf36b
+#define F0900_P2_BBHCRC_KOCNT1 0xf36b00ff
 
 /*P2_BBFCRCKO0*/
-#define R0900_P2_BBFCRCKO0  0xf36c
-#define F0900_P2_BBHCRC_KOCNT0  0xf36c00ff
+#define R0900_P2_BBFCRCKO0 0xf36c
+#define F0900_P2_BBHCRC_KOCNT0 0xf36c00ff
 
 /*P2_UPCRCKO1*/
-#define R0900_P2_UPCRCKO1  0xf36d
-#define F0900_P2_PKTCRC_KOCNT1  0xf36d00ff
+#define R0900_P2_UPCRCKO1 0xf36d
+#define F0900_P2_PKTCRC_KOCNT1 0xf36d00ff
 
 /*P2_UPCRCKO0*/
-#define R0900_P2_UPCRCKO0  0xf36e
-#define F0900_P2_PKTCRC_KOCNT0  0xf36e00ff
+#define R0900_P2_UPCRCKO0 0xf36e
+#define F0900_P2_PKTCRC_KOCNT0 0xf36e00ff
+
+/*P2_PDELCTRL3*/
+#define R0900_P2_PDELCTRL3 0xf36f
+#define F0900_P2_PKTDEL_CONTFAIL 0xf36f0080
+#define F0900_P2_NOFIFO_BCHERR 0xf36f0020
 
 /*P2_TSSTATEM*/
-#define R0900_P2_TSSTATEM  0xf370
-#define F0900_P2_TSDIL_ON  0xf3700080
-#define F0900_P2_TSSKIPRS_ON  0xf3700040
-#define F0900_P2_TSRS_ON  0xf3700020
-#define F0900_P2_TSDESCRAMB_ON  0xf3700010
-#define F0900_P2_TSFRAME_MODE  0xf3700008
-#define F0900_P2_TS_DISABLE  0xf3700004
-#define F0900_P2_TSACM_MODE  0xf3700002
-#define F0900_P2_TSOUT_NOSYNC  0xf3700001
+#define R0900_P2_TSSTATEM 0xf370
+#define F0900_P2_TSDIL_ON 0xf3700080
+#define F0900_P2_TSRS_ON 0xf3700020
+#define F0900_P2_TSDESCRAMB_ON 0xf3700010
+#define F0900_P2_TSFRAME_MODE 0xf3700008
+#define F0900_P2_TS_DISABLE 0xf3700004
+#define F0900_P2_TSOUT_NOSYNC 0xf3700001
 
 /*P2_TSCFGH*/
-#define R0900_P2_TSCFGH  0xf372
-#define F0900_P2_TSFIFO_DVBCI  0xf3720080
-#define F0900_P2_TSFIFO_SERIAL  0xf3720040
-#define F0900_P2_TSFIFO_TEIUPDATE  0xf3720020
-#define F0900_P2_TSFIFO_DUTY50  0xf3720010
-#define F0900_P2_TSFIFO_HSGNLOUT  0xf3720008
-#define F0900_P2_TSFIFO_ERRMODE  0xf3720006
-#define F0900_P2_RST_HWARE  0xf3720001
+#define R0900_P2_TSCFGH 0xf372
+#define F0900_P2_TSFIFO_DVBCI 0xf3720080
+#define F0900_P2_TSFIFO_SERIAL 0xf3720040
+#define F0900_P2_TSFIFO_TEIUPDATE 0xf3720020
+#define F0900_P2_TSFIFO_DUTY50 0xf3720010
+#define F0900_P2_TSFIFO_HSGNLOUT 0xf3720008
+#define F0900_P2_TSFIFO_ERRMODE 0xf3720006
+#define F0900_P2_RST_HWARE 0xf3720001
 
 /*P2_TSCFGM*/
-#define R0900_P2_TSCFGM  0xf373
-#define F0900_P2_TSFIFO_MANSPEED  0xf37300c0
-#define F0900_P2_TSFIFO_PERMDATA  0xf3730020
-#define F0900_P2_TSFIFO_NONEWSGNL  0xf3730010
-#define F0900_P2_TSFIFO_BITSPEED  0xf3730008
-#define F0900_P2_NPD_SPECDVBS2  0xf3730004
-#define F0900_P2_TSFIFO_STOPCKDIS  0xf3730002
-#define F0900_P2_TSFIFO_INVDATA  0xf3730001
+#define R0900_P2_TSCFGM 0xf373
+#define F0900_P2_TSFIFO_MANSPEED 0xf37300c0
+#define F0900_P2_TSFIFO_PERMDATA 0xf3730020
+#define F0900_P2_TSFIFO_DPUNACT 0xf3730002
+#define F0900_P2_TSFIFO_INVDATA 0xf3730001
 
 /*P2_TSCFGL*/
-#define R0900_P2_TSCFGL  0xf374
-#define F0900_P2_TSFIFO_BCLKDEL1CK  0xf37400c0
-#define F0900_P2_BCHERROR_MODE  0xf3740030
-#define F0900_P2_TSFIFO_NSGNL2DATA  0xf3740008
-#define F0900_P2_TSFIFO_EMBINDVB  0xf3740004
-#define F0900_P2_TSFIFO_DPUNACT  0xf3740002
-#define F0900_P2_TSFIFO_NPDOFF  0xf3740001
+#define R0900_P2_TSCFGL 0xf374
+#define F0900_P2_TSFIFO_BCLKDEL1CK 0xf37400c0
+#define F0900_P2_BCHERROR_MODE 0xf3740030
+#define F0900_P2_TSFIFO_NSGNL2DATA 0xf3740008
+#define F0900_P2_TSFIFO_EMBINDVB 0xf3740004
+#define F0900_P2_TSFIFO_BITSPEED 0xf3740003
 
 /*P2_TSINSDELH*/
-#define R0900_P2_TSINSDELH  0xf376
-#define F0900_P2_TSDEL_SYNCBYTE  0xf3760080
-#define F0900_P2_TSDEL_XXHEADER  0xf3760040
-#define F0900_P2_TSDEL_BBHEADER  0xf3760020
-#define F0900_P2_TSDEL_DATAFIELD  0xf3760010
-#define F0900_P2_TSINSDEL_ISCR  0xf3760008
-#define F0900_P2_TSINSDEL_NPD  0xf3760004
-#define F0900_P2_TSINSDEL_RSPARITY  0xf3760002
-#define F0900_P2_TSINSDEL_CRC8  0xf3760001
+#define R0900_P2_TSINSDELH 0xf376
+#define F0900_P2_TSDEL_SYNCBYTE 0xf3760080
+#define F0900_P2_TSDEL_XXHEADER 0xf3760040
+#define F0900_P2_TSDEL_BBHEADER 0xf3760020
+#define F0900_P2_TSDEL_DATAFIELD 0xf3760010
+#define F0900_P2_TSINSDEL_ISCR 0xf3760008
+#define F0900_P2_TSINSDEL_NPD 0xf3760004
+#define F0900_P2_TSINSDEL_RSPARITY 0xf3760002
+#define F0900_P2_TSINSDEL_CRC8 0xf3760001
+
+/*P2_TSDIVN*/
+#define R0900_P2_TSDIVN 0xf379
+#define F0900_P2_TSFIFO_SPEEDMODE 0xf37900c0
+
+/*P2_TSCFG4*/
+#define R0900_P2_TSCFG4 0xf37a
+#define F0900_P2_TSFIFO_TSSPEEDMODE 0xf37a00c0
 
 /*P2_TSSPEED*/
-#define R0900_P2_TSSPEED  0xf380
-#define F0900_P2_TSFIFO_OUTSPEED  0xf38000ff
+#define R0900_P2_TSSPEED 0xf380
+#define F0900_P2_TSFIFO_OUTSPEED 0xf38000ff
 
 /*P2_TSSTATUS*/
-#define R0900_P2_TSSTATUS  0xf381
-#define F0900_P2_TSFIFO_LINEOK  0xf3810080
-#define F0900_P2_TSFIFO_ERROR  0xf3810040
-#define F0900_P2_TSFIFO_DATA7  0xf3810020
-#define F0900_P2_TSFIFO_NOSYNC  0xf3810010
-#define F0900_P2_ISCR_INITIALIZED  0xf3810008
-#define F0900_P2_ISCR_UPDATED  0xf3810004
-#define F0900_P2_SOFFIFO_UNREGUL  0xf3810002
-#define F0900_P2_DIL_READY  0xf3810001
+#define R0900_P2_TSSTATUS 0xf381
+#define F0900_P2_TSFIFO_LINEOK 0xf3810080
+#define F0900_P2_TSFIFO_ERROR 0xf3810040
+#define F0900_P2_DIL_READY 0xf3810001
 
 /*P2_TSSTATUS2*/
-#define R0900_P2_TSSTATUS2  0xf382
-#define F0900_P2_TSFIFO_DEMODSEL  0xf3820080
-#define F0900_P2_TSFIFOSPEED_STORE  0xf3820040
-#define F0900_P2_DILXX_RESET  0xf3820020
-#define F0900_P2_TSSERIAL_IMPOS  0xf3820010
-#define F0900_P2_TSFIFO_LINENOK  0xf3820008
-#define F0900_P2_BITSPEED_EVENT  0xf3820004
-#define F0900_P2_SCRAMBDETECT  0xf3820002
-#define F0900_P2_ULDTV67_FALSELOCK  0xf3820001
+#define R0900_P2_TSSTATUS2 0xf382
+#define F0900_P2_TSFIFO_DEMODSEL 0xf3820080
+#define F0900_P2_TSFIFOSPEED_STORE 0xf3820040
+#define F0900_P2_DILXX_RESET 0xf3820020
+#define F0900_P2_TSSERIAL_IMPOS 0xf3820010
+#define F0900_P2_SCRAMBDETECT 0xf3820002
 
 /*P2_TSBITRATE1*/
-#define R0900_P2_TSBITRATE1  0xf383
-#define F0900_P2_TSFIFO_BITRATE1  0xf38300ff
+#define R0900_P2_TSBITRATE1 0xf383
+#define F0900_P2_TSFIFO_BITRATE1 0xf38300ff
 
 /*P2_TSBITRATE0*/
-#define R0900_P2_TSBITRATE0  0xf384
-#define F0900_P2_TSFIFO_BITRATE0  0xf38400ff
+#define R0900_P2_TSBITRATE0 0xf384
+#define F0900_P2_TSFIFO_BITRATE0 0xf38400ff
 
 /*P2_ERRCTRL1*/
-#define R0900_P2_ERRCTRL1  0xf398
-#define F0900_P2_ERR_SOURCE1  0xf39800f0
-#define F0900_P2_NUM_EVENT1  0xf3980007
+#define R0900_P2_ERRCTRL1 0xf398
+#define F0900_P2_ERR_SOURCE1 0xf39800f0
+#define F0900_P2_NUM_EVENT1 0xf3980007
 
 /*P2_ERRCNT12*/
-#define R0900_P2_ERRCNT12  0xf399
-#define F0900_P2_ERRCNT1_OLDVALUE  0xf3990080
-#define F0900_P2_ERR_CNT12  0xf399007f
+#define R0900_P2_ERRCNT12 0xf399
+#define F0900_P2_ERRCNT1_OLDVALUE 0xf3990080
+#define F0900_P2_ERR_CNT12 0xf399007f
 
 /*P2_ERRCNT11*/
-#define R0900_P2_ERRCNT11  0xf39a
-#define F0900_P2_ERR_CNT11  0xf39a00ff
+#define R0900_P2_ERRCNT11 0xf39a
+#define F0900_P2_ERR_CNT11 0xf39a00ff
 
 /*P2_ERRCNT10*/
-#define R0900_P2_ERRCNT10  0xf39b
-#define F0900_P2_ERR_CNT10  0xf39b00ff
+#define R0900_P2_ERRCNT10 0xf39b
+#define F0900_P2_ERR_CNT10 0xf39b00ff
 
 /*P2_ERRCTRL2*/
-#define R0900_P2_ERRCTRL2  0xf39c
-#define F0900_P2_ERR_SOURCE2  0xf39c00f0
-#define F0900_P2_NUM_EVENT2  0xf39c0007
+#define R0900_P2_ERRCTRL2 0xf39c
+#define F0900_P2_ERR_SOURCE2 0xf39c00f0
+#define F0900_P2_NUM_EVENT2 0xf39c0007
 
 /*P2_ERRCNT22*/
-#define R0900_P2_ERRCNT22  0xf39d
-#define F0900_P2_ERRCNT2_OLDVALUE  0xf39d0080
-#define F0900_P2_ERR_CNT22  0xf39d007f
+#define R0900_P2_ERRCNT22 0xf39d
+#define F0900_P2_ERRCNT2_OLDVALUE 0xf39d0080
+#define F0900_P2_ERR_CNT22 0xf39d007f
 
 /*P2_ERRCNT21*/
-#define R0900_P2_ERRCNT21  0xf39e
-#define F0900_P2_ERR_CNT21  0xf39e00ff
+#define R0900_P2_ERRCNT21 0xf39e
+#define F0900_P2_ERR_CNT21 0xf39e00ff
 
 /*P2_ERRCNT20*/
-#define R0900_P2_ERRCNT20  0xf39f
-#define F0900_P2_ERR_CNT20  0xf39f00ff
+#define R0900_P2_ERRCNT20 0xf39f
+#define F0900_P2_ERR_CNT20 0xf39f00ff
 
 /*P2_FECSPY*/
-#define R0900_P2_FECSPY  0xf3a0
-#define F0900_P2_SPY_ENABLE  0xf3a00080
-#define F0900_P2_NO_SYNCBYTE  0xf3a00040
-#define F0900_P2_SERIAL_MODE  0xf3a00020
-#define F0900_P2_UNUSUAL_PACKET  0xf3a00010
-#define F0900_P2_BER_PACKMODE  0xf3a00008
-#define F0900_P2_BERMETER_LMODE  0xf3a00002
-#define F0900_P2_BERMETER_RESET  0xf3a00001
+#define R0900_P2_FECSPY 0xf3a0
+#define F0900_P2_SPY_ENABLE 0xf3a00080
+#define F0900_P2_NO_SYNCBYTE 0xf3a00040
+#define F0900_P2_SERIAL_MODE 0xf3a00020
+#define F0900_P2_UNUSUAL_PACKET 0xf3a00010
+#define F0900_P2_BERMETER_DATAMODE 0xf3a00008
+#define F0900_P2_BERMETER_LMODE 0xf3a00002
+#define F0900_P2_BERMETER_RESET 0xf3a00001
 
 /*P2_FSPYCFG*/
-#define R0900_P2_FSPYCFG  0xf3a1
-#define F0900_P2_FECSPY_INPUT  0xf3a100c0
-#define F0900_P2_RST_ON_ERROR  0xf3a10020
-#define F0900_P2_ONE_SHOT  0xf3a10010
-#define F0900_P2_I2C_MODE  0xf3a1000c
-#define F0900_P2_SPY_HYSTERESIS  0xf3a10003
+#define R0900_P2_FSPYCFG 0xf3a1
+#define F0900_P2_FECSPY_INPUT 0xf3a100c0
+#define F0900_P2_RST_ON_ERROR 0xf3a10020
+#define F0900_P2_ONE_SHOT 0xf3a10010
+#define F0900_P2_I2C_MODE 0xf3a1000c
+#define F0900_P2_SPY_HYSTERESIS 0xf3a10003
 
 /*P2_FSPYDATA*/
-#define R0900_P2_FSPYDATA  0xf3a2
-#define F0900_P2_SPY_STUFFING  0xf3a20080
-#define F0900_P2_NOERROR_PKTJITTER  0xf3a20040
-#define F0900_P2_SPY_CNULLPKT  0xf3a20020
-#define F0900_P2_SPY_OUTDATA_MODE  0xf3a2001f
+#define R0900_P2_FSPYDATA 0xf3a2
+#define F0900_P2_SPY_STUFFING 0xf3a20080
+#define F0900_P2_SPY_CNULLPKT 0xf3a20020
+#define F0900_P2_SPY_OUTDATA_MODE 0xf3a2001f
 
 /*P2_FSPYOUT*/
-#define R0900_P2_FSPYOUT  0xf3a3
-#define F0900_P2_FSPY_DIRECT  0xf3a30080
-#define F0900_P2_SPY_OUTDATA_BUS  0xf3a30038
-#define F0900_P2_STUFF_MODE  0xf3a30007
+#define R0900_P2_FSPYOUT 0xf3a3
+#define F0900_P2_FSPY_DIRECT 0xf3a30080
+#define F0900_P2_STUFF_MODE 0xf3a30007
 
 /*P2_FSTATUS*/
-#define R0900_P2_FSTATUS  0xf3a4
-#define F0900_P2_SPY_ENDSIM  0xf3a40080
-#define F0900_P2_VALID_SIM  0xf3a40040
-#define F0900_P2_FOUND_SIGNAL  0xf3a40020
-#define F0900_P2_DSS_SYNCBYTE  0xf3a40010
-#define F0900_P2_RESULT_STATE  0xf3a4000f
+#define R0900_P2_FSTATUS 0xf3a4
+#define F0900_P2_SPY_ENDSIM 0xf3a40080
+#define F0900_P2_VALID_SIM 0xf3a40040
+#define F0900_P2_FOUND_SIGNAL 0xf3a40020
+#define F0900_P2_DSS_SYNCBYTE 0xf3a40010
+#define F0900_P2_RESULT_STATE 0xf3a4000f
 
 /*P2_FBERCPT4*/
-#define R0900_P2_FBERCPT4  0xf3a8
-#define F0900_P2_FBERMETER_CPT4  0xf3a800ff
+#define R0900_P2_FBERCPT4 0xf3a8
+#define F0900_P2_FBERMETER_CPT4 0xf3a800ff
 
 /*P2_FBERCPT3*/
-#define R0900_P2_FBERCPT3  0xf3a9
-#define F0900_P2_FBERMETER_CPT3  0xf3a900ff
+#define R0900_P2_FBERCPT3 0xf3a9
+#define F0900_P2_FBERMETER_CPT3 0xf3a900ff
 
 /*P2_FBERCPT2*/
-#define R0900_P2_FBERCPT2  0xf3aa
-#define F0900_P2_FBERMETER_CPT2  0xf3aa00ff
+#define R0900_P2_FBERCPT2 0xf3aa
+#define F0900_P2_FBERMETER_CPT2 0xf3aa00ff
 
 /*P2_FBERCPT1*/
-#define R0900_P2_FBERCPT1  0xf3ab
-#define F0900_P2_FBERMETER_CPT1  0xf3ab00ff
+#define R0900_P2_FBERCPT1 0xf3ab
+#define F0900_P2_FBERMETER_CPT1 0xf3ab00ff
 
 /*P2_FBERCPT0*/
-#define R0900_P2_FBERCPT0  0xf3ac
-#define F0900_P2_FBERMETER_CPT0  0xf3ac00ff
+#define R0900_P2_FBERCPT0 0xf3ac
+#define F0900_P2_FBERMETER_CPT0 0xf3ac00ff
 
 /*P2_FBERERR2*/
-#define R0900_P2_FBERERR2  0xf3ad
-#define F0900_P2_FBERMETER_ERR2  0xf3ad00ff
+#define R0900_P2_FBERERR2 0xf3ad
+#define F0900_P2_FBERMETER_ERR2 0xf3ad00ff
 
 /*P2_FBERERR1*/
-#define R0900_P2_FBERERR1  0xf3ae
-#define F0900_P2_FBERMETER_ERR1  0xf3ae00ff
+#define R0900_P2_FBERERR1 0xf3ae
+#define F0900_P2_FBERMETER_ERR1 0xf3ae00ff
 
 /*P2_FBERERR0*/
-#define R0900_P2_FBERERR0  0xf3af
-#define F0900_P2_FBERMETER_ERR0  0xf3af00ff
+#define R0900_P2_FBERERR0 0xf3af
+#define F0900_P2_FBERMETER_ERR0 0xf3af00ff
 
 /*P2_FSPYBER*/
-#define R0900_P2_FSPYBER  0xf3b2
-#define F0900_P2_FSPYOBS_XORREAD  0xf3b20040
-#define F0900_P2_FSPYBER_OBSMODE  0xf3b20020
-#define F0900_P2_FSPYBER_SYNCBYTE  0xf3b20010
-#define F0900_P2_FSPYBER_UNSYNC  0xf3b20008
-#define F0900_P2_FSPYBER_CTIME  0xf3b20007
+#define R0900_P2_FSPYBER 0xf3b2
+#define F0900_P2_FSPYBER_SYNCBYTE 0xf3b20010
+#define F0900_P2_FSPYBER_UNSYNC 0xf3b20008
+#define F0900_P2_FSPYBER_CTIME 0xf3b20007
 
 /*P1_IQCONST*/
-#define R0900_P1_IQCONST  0xf400
-#define F0900_P1_CONSTEL_SELECT  0xf4000060
-#define F0900_P1_IQSYMB_SEL  0xf400001f
+#define R0900_P1_IQCONST 0xf400
+#define IQCONST REGx(R0900_P1_IQCONST)
+#define F0900_P1_CONSTEL_SELECT 0xf4000060
+#define F0900_P1_IQSYMB_SEL 0xf400001f
 
 /*P1_NOSCFG*/
-#define R0900_P1_NOSCFG  0xf401
-#define F0900_P1_DUMMYPL_NOSDATA  0xf4010020
-#define F0900_P1_NOSPLH_BETA  0xf4010018
-#define F0900_P1_NOSDATA_BETA  0xf4010007
+#define R0900_P1_NOSCFG 0xf401
+#define NOSCFG REGx(R0900_P1_NOSCFG)
+#define F0900_P1_DUMMYPL_NOSDATA 0xf4010020
+#define F0900_P1_NOSPLH_BETA 0xf4010018
+#define F0900_P1_NOSDATA_BETA 0xf4010007
 
 /*P1_ISYMB*/
-#define R0900_P1_ISYMB  0xf402
-#define F0900_P1_I_SYMBOL  0xf40201ff
+#define R0900_P1_ISYMB 0xf402
+#define ISYMB REGx(R0900_P1_ISYMB)
+#define F0900_P1_I_SYMBOL 0xf40201ff
 
 /*P1_QSYMB*/
-#define R0900_P1_QSYMB  0xf403
-#define F0900_P1_Q_SYMBOL  0xf40301ff
+#define R0900_P1_QSYMB 0xf403
+#define QSYMB REGx(R0900_P1_QSYMB)
+#define F0900_P1_Q_SYMBOL 0xf40301ff
 
 /*P1_AGC1CFG*/
-#define R0900_P1_AGC1CFG  0xf404
-#define F0900_P1_DC_FROZEN  0xf4040080
-#define F0900_P1_DC_CORRECT  0xf4040040
-#define F0900_P1_AMM_FROZEN  0xf4040020
-#define F0900_P1_AMM_CORRECT  0xf4040010
-#define F0900_P1_QUAD_FROZEN  0xf4040008
-#define F0900_P1_QUAD_CORRECT  0xf4040004
-#define F0900_P1_DCCOMP_SLOW  0xf4040002
-#define F0900_P1_IQMISM_SLOW  0xf4040001
+#define R0900_P1_AGC1CFG 0xf404
+#define AGC1CFG REGx(R0900_P1_AGC1CFG)
+#define F0900_P1_DC_FROZEN 0xf4040080
+#define F0900_P1_DC_CORRECT 0xf4040040
+#define F0900_P1_AMM_FROZEN 0xf4040020
+#define F0900_P1_AMM_CORRECT 0xf4040010
+#define F0900_P1_QUAD_FROZEN 0xf4040008
+#define F0900_P1_QUAD_CORRECT 0xf4040004
 
 /*P1_AGC1CN*/
-#define R0900_P1_AGC1CN  0xf406
-#define F0900_P1_AGC1_LOCKED  0xf4060080
-#define F0900_P1_AGC1_OVERFLOW  0xf4060040
-#define F0900_P1_AGC1_NOSLOWLK  0xf4060020
-#define F0900_P1_AGC1_MINPOWER  0xf4060010
-#define F0900_P1_AGCOUT_FAST  0xf4060008
-#define F0900_P1_AGCIQ_BETA  0xf4060007
+#define R0900_P1_AGC1CN 0xf406
+#define AGC1CN REGx(R0900_P1_AGC1CN)
+#define F0900_P1_AGC1_LOCKED 0xf4060080
+#define F0900_P1_AGC1_MINPOWER 0xf4060010
+#define F0900_P1_AGCOUT_FAST 0xf4060008
+#define F0900_P1_AGCIQ_BETA 0xf4060007
 
 /*P1_AGC1REF*/
-#define R0900_P1_AGC1REF  0xf407
-#define F0900_P1_AGCIQ_REF  0xf40700ff
+#define R0900_P1_AGC1REF 0xf407
+#define AGC1REF REGx(R0900_P1_AGC1REF)
+#define F0900_P1_AGCIQ_REF 0xf40700ff
 
 /*P1_IDCCOMP*/
-#define R0900_P1_IDCCOMP  0xf408
-#define F0900_P1_IAVERAGE_ADJ  0xf40801ff
+#define R0900_P1_IDCCOMP 0xf408
+#define IDCCOMP REGx(R0900_P1_IDCCOMP)
+#define F0900_P1_IAVERAGE_ADJ 0xf40801ff
 
 /*P1_QDCCOMP*/
-#define R0900_P1_QDCCOMP  0xf409
-#define F0900_P1_QAVERAGE_ADJ  0xf40901ff
+#define R0900_P1_QDCCOMP 0xf409
+#define QDCCOMP REGx(R0900_P1_QDCCOMP)
+#define F0900_P1_QAVERAGE_ADJ 0xf40901ff
 
 /*P1_POWERI*/
-#define R0900_P1_POWERI  0xf40a
-#define F0900_P1_POWER_I  0xf40a00ff
+#define R0900_P1_POWERI 0xf40a
+#define POWERI REGx(R0900_P1_POWERI)
+#define F0900_P1_POWER_I 0xf40a00ff
+#define POWER_I FLDx(F0900_P1_POWER_I)
 
 /*P1_POWERQ*/
-#define R0900_P1_POWERQ  0xf40b
-#define F0900_P1_POWER_Q  0xf40b00ff
+#define R0900_P1_POWERQ 0xf40b
+#define POWERQ REGx(R0900_P1_POWERQ)
+#define F0900_P1_POWER_Q 0xf40b00ff
+#define POWER_Q FLDx(F0900_P1_POWER_Q)
 
 /*P1_AGC1AMM*/
-#define R0900_P1_AGC1AMM  0xf40c
-#define F0900_P1_AMM_VALUE  0xf40c00ff
+#define R0900_P1_AGC1AMM 0xf40c
+#define AGC1AMM REGx(R0900_P1_AGC1AMM)
+#define F0900_P1_AMM_VALUE 0xf40c00ff
 
 /*P1_AGC1QUAD*/
-#define R0900_P1_AGC1QUAD  0xf40d
-#define F0900_P1_QUAD_VALUE  0xf40d01ff
+#define R0900_P1_AGC1QUAD 0xf40d
+#define AGC1QUAD REGx(R0900_P1_AGC1QUAD)
+#define F0900_P1_QUAD_VALUE 0xf40d01ff
 
 /*P1_AGCIQIN1*/
-#define R0900_P1_AGCIQIN1  0xf40e
-#define F0900_P1_AGCIQ_VALUE1  0xf40e00ff
+#define R0900_P1_AGCIQIN1 0xf40e
+#define AGCIQIN1 REGx(R0900_P1_AGCIQIN1)
+#define F0900_P1_AGCIQ_VALUE1 0xf40e00ff
+#define AGCIQ_VALUE1 FLDx(F0900_P1_AGCIQ_VALUE1)
 
 /*P1_AGCIQIN0*/
-#define R0900_P1_AGCIQIN0  0xf40f
-#define F0900_P1_AGCIQ_VALUE0  0xf40f00ff
+#define R0900_P1_AGCIQIN0 0xf40f
+#define AGCIQIN0 REGx(R0900_P1_AGCIQIN0)
+#define F0900_P1_AGCIQ_VALUE0 0xf40f00ff
+#define AGCIQ_VALUE0 FLDx(F0900_P1_AGCIQ_VALUE0)
 
 /*P1_DEMOD*/
-#define R0900_P1_DEMOD  0xf410
-#define F0900_P1_DEMOD_STOP  0xf4100040
-#define F0900_P1_SPECINV_CONTROL  0xf4100030
-#define F0900_P1_FORCE_ENASAMP  0xf4100008
-#define F0900_P1_MANUAL_ROLLOFF  0xf4100004
-#define F0900_P1_ROLLOFF_CONTROL  0xf4100003
+#define R0900_P1_DEMOD 0xf410
+#define DEMOD REGx(R0900_P1_DEMOD)
+#define F0900_P1_MANUALS2_ROLLOFF 0xf4100080
+#define MANUALS2_ROLLOFF FLDx(F0900_P1_MANUALS2_ROLLOFF)
+
+#define F0900_P1_SPECINV_CONTROL 0xf4100030
+#define SPECINV_CONTROL FLDx(F0900_P1_SPECINV_CONTROL)
+#define F0900_P1_FORCE_ENASAMP 0xf4100008
+#define F0900_P1_MANUALSX_ROLLOFF 0xf4100004
+#define MANUALSX_ROLLOFF FLDx(F0900_P1_MANUALSX_ROLLOFF)
+#define F0900_P1_ROLLOFF_CONTROL 0xf4100003
+#define ROLLOFF_CONTROL FLDx(F0900_P1_ROLLOFF_CONTROL)
 
 /*P1_DMDMODCOD*/
-#define R0900_P1_DMDMODCOD  0xf411
-#define F0900_P1_MANUAL_MODCOD  0xf4110080
-#define F0900_P1_DEMOD_MODCOD  0xf411007c
-#define F0900_P1_DEMOD_TYPE  0xf4110003
+#define R0900_P1_DMDMODCOD 0xf411
+#define DMDMODCOD REGx(R0900_P1_DMDMODCOD)
+#define F0900_P1_MANUAL_MODCOD 0xf4110080
+#define F0900_P1_DEMOD_MODCOD 0xf411007c
+#define DEMOD_MODCOD FLDx(F0900_P1_DEMOD_MODCOD)
+#define F0900_P1_DEMOD_TYPE 0xf4110003
+#define DEMOD_TYPE FLDx(F0900_P1_DEMOD_TYPE)
 
 /*P1_DSTATUS*/
-#define R0900_P1_DSTATUS  0xf412
-#define F0900_P1_CAR_LOCK  0xf4120080
-#define F0900_P1_TMGLOCK_QUALITY  0xf4120060
-#define F0900_P1_SDVBS1_ENABLE  0xf4120010
-#define F0900_P1_LOCK_DEFINITIF  0xf4120008
-#define F0900_P1_TIMING_IS_LOCKED  0xf4120004
-#define F0900_P1_COARSE_TMGLOCK  0xf4120002
-#define F0900_P1_COARSE_CARLOCK  0xf4120001
+#define R0900_P1_DSTATUS 0xf412
+#define DSTATUS REGx(R0900_P1_DSTATUS)
+#define F0900_P1_CAR_LOCK 0xf4120080
+#define F0900_P1_TMGLOCK_QUALITY 0xf4120060
+#define TMGLOCK_QUALITY FLDx(F0900_P1_TMGLOCK_QUALITY)
+#define F0900_P1_LOCK_DEFINITIF 0xf4120008
+#define LOCK_DEFINITIF FLDx(F0900_P1_LOCK_DEFINITIF)
+#define F0900_P1_OVADC_DETECT 0xf4120001
 
 /*P1_DSTATUS2*/
-#define R0900_P1_DSTATUS2  0xf413
-#define F0900_P1_DEMOD_DELOCK  0xf4130080
-#define F0900_P1_DEMOD_TIMEOUT  0xf4130040
-#define F0900_P1_MODCODRQ_SYNCTAG  0xf4130020
-#define F0900_P1_POLYPH_SATEVENT  0xf4130010
-#define F0900_P1_AGC1_NOSIGNALACK  0xf4130008
-#define F0900_P1_AGC2_OVERFLOW  0xf4130004
-#define F0900_P1_CFR_OVERFLOW  0xf4130002
-#define F0900_P1_GAMMA_OVERUNDER  0xf4130001
+#define R0900_P1_DSTATUS2 0xf413
+#define DSTATUS2 REGx(R0900_P1_DSTATUS2)
+#define F0900_P1_DEMOD_DELOCK 0xf4130080
+#define F0900_P1_AGC1_NOSIGNALACK 0xf4130008
+#define F0900_P1_AGC2_OVERFLOW 0xf4130004
+#define F0900_P1_CFR_OVERFLOW 0xf4130002
+#define F0900_P1_GAMMA_OVERUNDER 0xf4130001
 
 /*P1_DMDCFGMD*/
-#define R0900_P1_DMDCFGMD  0xf414
-#define F0900_P1_DVBS2_ENABLE  0xf4140080
-#define F0900_P1_DVBS1_ENABLE  0xf4140040
-#define F0900_P1_CFR_AUTOSCAN  0xf4140020
-#define F0900_P1_SCAN_ENABLE  0xf4140010
-#define F0900_P1_TUN_AUTOSCAN  0xf4140008
-#define F0900_P1_NOFORCE_RELOCK  0xf4140004
-#define F0900_P1_TUN_RNG  0xf4140003
+#define R0900_P1_DMDCFGMD 0xf414
+#define DMDCFGMD REGx(R0900_P1_DMDCFGMD)
+#define F0900_P1_DVBS2_ENABLE 0xf4140080
+#define DVBS2_ENABLE FLDx(F0900_P1_DVBS2_ENABLE)
+#define F0900_P1_DVBS1_ENABLE 0xf4140040
+#define DVBS1_ENABLE FLDx(F0900_P1_DVBS1_ENABLE)
+#define F0900_P1_SCAN_ENABLE 0xf4140010
+#define SCAN_ENABLE FLDx(F0900_P1_SCAN_ENABLE)
+#define F0900_P1_CFR_AUTOSCAN 0xf4140008
+#define CFR_AUTOSCAN FLDx(F0900_P1_CFR_AUTOSCAN)
+#define F0900_P1_TUN_RNG 0xf4140003
 
 /*P1_DMDCFG2*/
-#define R0900_P1_DMDCFG2  0xf415
-#define F0900_P1_AGC1_WAITLOCK  0xf4150080
-#define F0900_P1_S1S2_SEQUENTIAL  0xf4150040
-#define F0900_P1_OVERFLOW_TIMEOUT  0xf4150020
-#define F0900_P1_SCANFAIL_TIMEOUT  0xf4150010
-#define F0900_P1_DMDTOUT_BACK  0xf4150008
-#define F0900_P1_CARLOCK_S1ENABLE  0xf4150004
-#define F0900_P1_COARSE_LK3MODE  0xf4150002
-#define F0900_P1_COARSE_LK2MODE  0xf4150001
+#define R0900_P1_DMDCFG2 0xf415
+#define DMDCFG2 REGx(R0900_P1_DMDCFG2)
+#define F0900_P1_S1S2_SEQUENTIAL 0xf4150040
+#define S1S2_SEQUENTIAL FLDx(F0900_P1_S1S2_SEQUENTIAL)
+#define F0900_P1_INFINITE_RELOCK 0xf4150010
 
 /*P1_DMDISTATE*/
-#define R0900_P1_DMDISTATE  0xf416
-#define F0900_P1_I2C_NORESETDMODE  0xf4160080
-#define F0900_P1_FORCE_ETAPED  0xf4160040
-#define F0900_P1_SDMDRST_DIRCLK  0xf4160020
-#define F0900_P1_I2C_DEMOD_MODE  0xf416001f
+#define R0900_P1_DMDISTATE 0xf416
+#define DMDISTATE REGx(R0900_P1_DMDISTATE)
+#define F0900_P1_I2C_DEMOD_MODE 0xf416001f
+#define DEMOD_MODE FLDx(F0900_P1_I2C_DEMOD_MODE)
 
 /*P1_DMDT0M*/
-#define R0900_P1_DMDT0M  0xf417
-#define F0900_P1_DMDT0_MIN  0xf41700ff
+#define R0900_P1_DMDT0M 0xf417
+#define DMDT0M REGx(R0900_P1_DMDT0M)
+#define F0900_P1_DMDT0_MIN 0xf41700ff
 
 /*P1_DMDSTATE*/
-#define R0900_P1_DMDSTATE  0xf41b
-#define F0900_P1_DEMOD_LOCKED  0xf41b0080
-#define F0900_P1_HEADER_MODE  0xf41b0060
-#define F0900_P1_DEMOD_MODE  0xf41b001f
+#define R0900_P1_DMDSTATE 0xf41b
+#define DMDSTATE REGx(R0900_P1_DMDSTATE)
+#define F0900_P1_HEADER_MODE 0xf41b0060
+#define HEADER_MODE FLDx(F0900_P1_HEADER_MODE)
 
 /*P1_DMDFLYW*/
-#define R0900_P1_DMDFLYW  0xf41c
-#define F0900_P1_I2C_IRQVAL  0xf41c00f0
-#define F0900_P1_FLYWHEEL_CPT  0xf41c000f
+#define R0900_P1_DMDFLYW 0xf41c
+#define DMDFLYW REGx(R0900_P1_DMDFLYW)
+#define F0900_P1_I2C_IRQVAL 0xf41c00f0
+#define F0900_P1_FLYWHEEL_CPT 0xf41c000f
+#define FLYWHEEL_CPT FLDx(F0900_P1_FLYWHEEL_CPT)
 
 /*P1_DSTATUS3*/
-#define R0900_P1_DSTATUS3  0xf41d
-#define F0900_P1_CFR_ZIGZAG  0xf41d0080
-#define F0900_P1_DEMOD_CFGMODE  0xf41d0060
-#define F0900_P1_GAMMA_LOWBAUDRATE  0xf41d0010
-#define F0900_P1_RELOCK_MODE  0xf41d0008
-#define F0900_P1_DEMOD_FAIL  0xf41d0004
-#define F0900_P1_ETAPE1A_DVBXMEM  0xf41d0003
+#define R0900_P1_DSTATUS3 0xf41d
+#define DSTATUS3 REGx(R0900_P1_DSTATUS3)
+#define F0900_P1_DEMOD_CFGMODE 0xf41d0060
 
 /*P1_DMDCFG3*/
-#define R0900_P1_DMDCFG3  0xf41e
-#define F0900_P1_DVBS1_TMGWAIT  0xf41e0080
-#define F0900_P1_NO_BWCENTERING  0xf41e0040
-#define F0900_P1_INV_SEQSRCH  0xf41e0020
-#define F0900_P1_DIS_SFRUPLOW_TRK  0xf41e0010
-#define F0900_P1_NOSTOP_FIFOFULL  0xf41e0008
-#define F0900_P1_LOCKTIME_MODE  0xf41e0007
+#define R0900_P1_DMDCFG3 0xf41e
+#define DMDCFG3 REGx(R0900_P1_DMDCFG3)
+#define F0900_P1_NOSTOP_FIFOFULL 0xf41e0008
 
 /*P1_DMDCFG4*/
-#define R0900_P1_DMDCFG4  0xf41f
-#define F0900_P1_TUNER_NRELAUNCH  0xf41f0008
-#define F0900_P1_DIS_CLKENABLE  0xf41f0004
-#define F0900_P1_DIS_HDRDIVLOCK  0xf41f0002
-#define F0900_P1_NO_TNRWBINIT  0xf41f0001
+#define R0900_P1_DMDCFG4 0xf41f
+#define DMDCFG4 REGx(R0900_P1_DMDCFG4)
+#define F0900_P1_TUNER_NRELAUNCH 0xf41f0008
 
 /*P1_CORRELMANT*/
-#define R0900_P1_CORRELMANT  0xf420
-#define F0900_P1_CORREL_MANT  0xf42000ff
+#define R0900_P1_CORRELMANT 0xf420
+#define CORRELMANT REGx(R0900_P1_CORRELMANT)
+#define F0900_P1_CORREL_MANT 0xf42000ff
 
 /*P1_CORRELABS*/
-#define R0900_P1_CORRELABS  0xf421
-#define F0900_P1_CORREL_ABS  0xf42100ff
+#define R0900_P1_CORRELABS 0xf421
+#define CORRELABS REGx(R0900_P1_CORRELABS)
+#define F0900_P1_CORREL_ABS 0xf42100ff
 
 /*P1_CORRELEXP*/
-#define R0900_P1_CORRELEXP  0xf422
-#define F0900_P1_CORREL_ABSEXP  0xf42200f0
-#define F0900_P1_CORREL_EXP  0xf422000f
+#define R0900_P1_CORRELEXP 0xf422
+#define CORRELEXP REGx(R0900_P1_CORRELEXP)
+#define F0900_P1_CORREL_ABSEXP 0xf42200f0
+#define F0900_P1_CORREL_EXP 0xf422000f
 
 /*P1_PLHMODCOD*/
-#define R0900_P1_PLHMODCOD  0xf424
-#define F0900_P1_SPECINV_DEMOD  0xf4240080
-#define F0900_P1_PLH_MODCOD  0xf424007c
-#define F0900_P1_PLH_TYPE  0xf4240003
-
-/*P1_AGCK32*/
-#define R0900_P1_AGCK32  0xf42b
-#define F0900_P1_R3ADJOFF_32APSK  0xf42b0080
-#define F0900_P1_R2ADJOFF_32APSK  0xf42b0040
-#define F0900_P1_R1ADJOFF_32APSK  0xf42b0020
-#define F0900_P1_RADJ_32APSK  0xf42b001f
+#define R0900_P1_PLHMODCOD 0xf424
+#define PLHMODCOD REGx(R0900_P1_PLHMODCOD)
+#define F0900_P1_SPECINV_DEMOD 0xf4240080
+#define SPECINV_DEMOD FLDx(F0900_P1_SPECINV_DEMOD)
+#define F0900_P1_PLH_MODCOD 0xf424007c
+#define F0900_P1_PLH_TYPE 0xf4240003
+
+/*P1_DMDREG*/
+#define R0900_P1_DMDREG 0xf425
+#define DMDREG REGx(R0900_P1_DMDREG)
+#define F0900_P1_DECIM_PLFRAMES 0xf4250001
 
 /*P1_AGC2O*/
-#define R0900_P1_AGC2O  0xf42c
-#define F0900_P1_AGC2REF_ADJUSTING  0xf42c0080
-#define F0900_P1_AGC2_COARSEFAST  0xf42c0040
-#define F0900_P1_AGC2_LKSQRT  0xf42c0020
-#define F0900_P1_AGC2_LKMODE  0xf42c0010
-#define F0900_P1_AGC2_LKEQUA  0xf42c0008
-#define F0900_P1_AGC2_COEF  0xf42c0007
+#define R0900_P1_AGC2O 0xf42c
+#define AGC2O REGx(R0900_P1_AGC2O)
+#define F0900_P1_AGC2_COEF 0xf42c0007
 
 /*P1_AGC2REF*/
-#define R0900_P1_AGC2REF  0xf42d
-#define F0900_P1_AGC2_REF  0xf42d00ff
+#define R0900_P1_AGC2REF 0xf42d
+#define AGC2REF REGx(R0900_P1_AGC2REF)
+#define F0900_P1_AGC2_REF 0xf42d00ff
 
 /*P1_AGC1ADJ*/
-#define R0900_P1_AGC1ADJ  0xf42e
-#define F0900_P1_AGC1ADJ_MANUAL  0xf42e0080
-#define F0900_P1_AGC1_ADJUSTED  0xf42e017f
+#define R0900_P1_AGC1ADJ 0xf42e
+#define AGC1ADJ REGx(R0900_P1_AGC1ADJ)
+#define F0900_P1_AGC1_ADJUSTED 0xf42e007f
 
 /*P1_AGC2I1*/
-#define R0900_P1_AGC2I1  0xf436
-#define F0900_P1_AGC2_INTEGRATOR1  0xf43600ff
+#define R0900_P1_AGC2I1 0xf436
+#define AGC2I1 REGx(R0900_P1_AGC2I1)
+#define F0900_P1_AGC2_INTEGRATOR1 0xf43600ff
 
 /*P1_AGC2I0*/
-#define R0900_P1_AGC2I0  0xf437
-#define F0900_P1_AGC2_INTEGRATOR0  0xf43700ff
+#define R0900_P1_AGC2I0 0xf437
+#define AGC2I0 REGx(R0900_P1_AGC2I0)
+#define F0900_P1_AGC2_INTEGRATOR0 0xf43700ff
 
 /*P1_CARCFG*/
-#define R0900_P1_CARCFG  0xf438
-#define F0900_P1_CFRUPLOW_AUTO  0xf4380080
-#define F0900_P1_CFRUPLOW_TEST  0xf4380040
-#define F0900_P1_EN_CAR2CENTER  0xf4380020
-#define F0900_P1_CARHDR_NODIV8  0xf4380010
-#define F0900_P1_I2C_ROTA  0xf4380008
-#define F0900_P1_ROTAON  0xf4380004
-#define F0900_P1_PH_DET_ALGO  0xf4380003
+#define R0900_P1_CARCFG 0xf438
+#define CARCFG REGx(R0900_P1_CARCFG)
+#define F0900_P1_CFRUPLOW_AUTO 0xf4380080
+#define F0900_P1_CFRUPLOW_TEST 0xf4380040
+#define F0900_P1_ROTAON 0xf4380004
+#define F0900_P1_PH_DET_ALGO 0xf4380003
 
 /*P1_ACLC*/
-#define R0900_P1_ACLC  0xf439
-#define F0900_P1_STOP_S2ALPHA  0xf43900c0
-#define F0900_P1_CAR_ALPHA_MANT  0xf4390030
-#define F0900_P1_CAR_ALPHA_EXP  0xf439000f
+#define R0900_P1_ACLC 0xf439
+#define ACLC REGx(R0900_P1_ACLC)
+#define F0900_P1_CAR_ALPHA_MANT 0xf4390030
+#define F0900_P1_CAR_ALPHA_EXP 0xf439000f
 
 /*P1_BCLC*/
-#define R0900_P1_BCLC  0xf43a
-#define F0900_P1_STOP_S2BETA  0xf43a00c0
-#define F0900_P1_CAR_BETA_MANT  0xf43a0030
-#define F0900_P1_CAR_BETA_EXP  0xf43a000f
+#define R0900_P1_BCLC 0xf43a
+#define BCLC REGx(R0900_P1_BCLC)
+#define F0900_P1_CAR_BETA_MANT 0xf43a0030
+#define F0900_P1_CAR_BETA_EXP 0xf43a000f
 
 /*P1_CARFREQ*/
-#define R0900_P1_CARFREQ  0xf43d
-#define F0900_P1_KC_COARSE_EXP  0xf43d00f0
-#define F0900_P1_BETA_FREQ  0xf43d000f
+#define R0900_P1_CARFREQ 0xf43d
+#define CARFREQ REGx(R0900_P1_CARFREQ)
+#define F0900_P1_KC_COARSE_EXP 0xf43d00f0
+#define F0900_P1_BETA_FREQ 0xf43d000f
 
 /*P1_CARHDR*/
-#define R0900_P1_CARHDR  0xf43e
-#define F0900_P1_K_FREQ_HDR  0xf43e00ff
+#define R0900_P1_CARHDR 0xf43e
+#define CARHDR REGx(R0900_P1_CARHDR)
+#define F0900_P1_K_FREQ_HDR 0xf43e00ff
 
 /*P1_LDT*/
-#define R0900_P1_LDT  0xf43f
-#define F0900_P1_CARLOCK_THRES  0xf43f01ff
+#define R0900_P1_LDT 0xf43f
+#define LDT REGx(R0900_P1_LDT)
+#define F0900_P1_CARLOCK_THRES 0xf43f01ff
 
 /*P1_LDT2*/
-#define R0900_P1_LDT2  0xf440
-#define F0900_P1_CARLOCK_THRES2  0xf44001ff
+#define R0900_P1_LDT2 0xf440
+#define LDT2 REGx(R0900_P1_LDT2)
+#define F0900_P1_CARLOCK_THRES2 0xf44001ff
 
 /*P1_CFRICFG*/
-#define R0900_P1_CFRICFG  0xf441
-#define F0900_P1_CFRINIT_UNVALRNG  0xf4410080
-#define F0900_P1_CFRINIT_LUNVALCPT  0xf4410040
-#define F0900_P1_CFRINIT_ABORTDBL  0xf4410020
-#define F0900_P1_CFRINIT_ABORTPRED  0xf4410010
-#define F0900_P1_CFRINIT_UNVALSKIP  0xf4410008
-#define F0900_P1_CFRINIT_CSTINC  0xf4410004
-#define F0900_P1_NEG_CFRSTEP  0xf4410001
+#define R0900_P1_CFRICFG 0xf441
+#define CFRICFG REGx(R0900_P1_CFRICFG)
+#define F0900_P1_NEG_CFRSTEP 0xf4410001
 
 /*P1_CFRUP1*/
-#define R0900_P1_CFRUP1  0xf442
-#define F0900_P1_CFR_UP1  0xf44201ff
+#define R0900_P1_CFRUP1 0xf442
+#define CFRUP1 REGx(R0900_P1_CFRUP1)
+#define F0900_P1_CFR_UP1 0xf44201ff
+#define CFR_UP1 FLDx(F0900_P1_CFR_UP1)
 
 /*P1_CFRUP0*/
-#define R0900_P1_CFRUP0  0xf443
-#define F0900_P1_CFR_UP0  0xf44300ff
+#define R0900_P1_CFRUP0 0xf443
+#define CFRUP0 REGx(R0900_P1_CFRUP0)
+#define F0900_P1_CFR_UP0 0xf44300ff
+#define CFR_UP0 FLDx(F0900_P1_CFR_UP0)
 
 /*P1_CFRLOW1*/
-#define R0900_P1_CFRLOW1  0xf446
-#define F0900_P1_CFR_LOW1  0xf44601ff
+#define R0900_P1_CFRLOW1 0xf446
+#define CFRLOW1 REGx(R0900_P1_CFRLOW1)
+#define F0900_P1_CFR_LOW1 0xf44601ff
+#define CFR_LOW1 FLDx(F0900_P1_CFR_LOW1)
 
 /*P1_CFRLOW0*/
-#define R0900_P1_CFRLOW0  0xf447
-#define F0900_P1_CFR_LOW0  0xf44700ff
+#define R0900_P1_CFRLOW0 0xf447
+#define CFRLOW0 REGx(R0900_P1_CFRLOW0)
+#define F0900_P1_CFR_LOW0 0xf44700ff
+#define CFR_LOW0 FLDx(F0900_P1_CFR_LOW0)
 
 /*P1_CFRINIT1*/
-#define R0900_P1_CFRINIT1  0xf448
-#define F0900_P1_CFR_INIT1  0xf44801ff
+#define R0900_P1_CFRINIT1 0xf448
+#define CFRINIT1 REGx(R0900_P1_CFRINIT1)
+#define F0900_P1_CFR_INIT1 0xf44801ff
+#define CFR_INIT1 FLDx(F0900_P1_CFR_INIT1)
 
 /*P1_CFRINIT0*/
-#define R0900_P1_CFRINIT0  0xf449
-#define F0900_P1_CFR_INIT0  0xf44900ff
+#define R0900_P1_CFRINIT0 0xf449
+#define CFRINIT0 REGx(R0900_P1_CFRINIT0)
+#define F0900_P1_CFR_INIT0 0xf44900ff
+#define CFR_INIT0 FLDx(F0900_P1_CFR_INIT0)
 
 /*P1_CFRINC1*/
-#define R0900_P1_CFRINC1  0xf44a
-#define F0900_P1_MANUAL_CFRINC  0xf44a0080
-#define F0900_P1_CFR_INC1  0xf44a017f
+#define R0900_P1_CFRINC1 0xf44a
+#define CFRINC1 REGx(R0900_P1_CFRINC1)
+#define F0900_P1_MANUAL_CFRINC 0xf44a0080
+#define F0900_P1_CFR_INC1 0xf44a003f
 
 /*P1_CFRINC0*/
-#define R0900_P1_CFRINC0  0xf44b
-#define F0900_P1_CFR_INC0  0xf44b00f0
+#define R0900_P1_CFRINC0 0xf44b
+#define CFRINC0 REGx(R0900_P1_CFRINC0)
+#define F0900_P1_CFR_INC0 0xf44b00f8
 
 /*P1_CFR2*/
-#define R0900_P1_CFR2  0xf44c
-#define F0900_P1_CAR_FREQ2  0xf44c01ff
+#define R0900_P1_CFR2 0xf44c
+#define CFR2 REGx(R0900_P1_CFR2)
+#define F0900_P1_CAR_FREQ2 0xf44c01ff
+#define CAR_FREQ2 FLDx(F0900_P1_CAR_FREQ2)
 
 /*P1_CFR1*/
-#define R0900_P1_CFR1  0xf44d
-#define F0900_P1_CAR_FREQ1  0xf44d00ff
+#define R0900_P1_CFR1 0xf44d
+#define CFR1 REGx(R0900_P1_CFR1)
+#define F0900_P1_CAR_FREQ1 0xf44d00ff
+#define CAR_FREQ1 FLDx(F0900_P1_CAR_FREQ1)
 
 /*P1_CFR0*/
-#define R0900_P1_CFR0  0xf44e
-#define F0900_P1_CAR_FREQ0  0xf44e00ff
+#define R0900_P1_CFR0 0xf44e
+#define CFR0 REGx(R0900_P1_CFR0)
+#define F0900_P1_CAR_FREQ0 0xf44e00ff
+#define CAR_FREQ0 FLDx(F0900_P1_CAR_FREQ0)
 
 /*P1_LDI*/
-#define R0900_P1_LDI  0xf44f
-#define F0900_P1_LOCK_DET_INTEGR  0xf44f01ff
+#define R0900_P1_LDI 0xf44f
+#define LDI REGx(R0900_P1_LDI)
+#define F0900_P1_LOCK_DET_INTEGR 0xf44f01ff
 
 /*P1_TMGCFG*/
-#define R0900_P1_TMGCFG  0xf450
-#define F0900_P1_TMGLOCK_BETA  0xf45000c0
-#define F0900_P1_NOTMG_GROUPDELAY  0xf4500020
-#define F0900_P1_DO_TIMING_CORR  0xf4500010
-#define F0900_P1_MANUAL_SCAN  0xf450000c
-#define F0900_P1_TMG_MINFREQ  0xf4500003
+#define R0900_P1_TMGCFG 0xf450
+#define TMGCFG REGx(R0900_P1_TMGCFG)
+#define F0900_P1_TMGLOCK_BETA 0xf45000c0
+#define F0900_P1_DO_TIMING_CORR 0xf4500010
+#define F0900_P1_TMG_MINFREQ 0xf4500003
 
 /*P1_RTC*/
-#define R0900_P1_RTC  0xf451
-#define F0900_P1_TMGALPHA_EXP  0xf45100f0
-#define F0900_P1_TMGBETA_EXP  0xf451000f
+#define R0900_P1_RTC 0xf451
+#define RTC REGx(R0900_P1_RTC)
+#define F0900_P1_TMGALPHA_EXP 0xf45100f0
+#define F0900_P1_TMGBETA_EXP 0xf451000f
 
 /*P1_RTCS2*/
-#define R0900_P1_RTCS2  0xf452
-#define F0900_P1_TMGALPHAS2_EXP  0xf45200f0
-#define F0900_P1_TMGBETAS2_EXP  0xf452000f
+#define R0900_P1_RTCS2 0xf452
+#define RTCS2 REGx(R0900_P1_RTCS2)
+#define F0900_P1_TMGALPHAS2_EXP 0xf45200f0
+#define F0900_P1_TMGBETAS2_EXP 0xf452000f
 
 /*P1_TMGTHRISE*/
-#define R0900_P1_TMGTHRISE  0xf453
-#define F0900_P1_TMGLOCK_THRISE  0xf45300ff
+#define R0900_P1_TMGTHRISE 0xf453
+#define TMGTHRISE REGx(R0900_P1_TMGTHRISE)
+#define F0900_P1_TMGLOCK_THRISE 0xf45300ff
 
 /*P1_TMGTHFALL*/
-#define R0900_P1_TMGTHFALL  0xf454
-#define F0900_P1_TMGLOCK_THFALL  0xf45400ff
+#define R0900_P1_TMGTHFALL 0xf454
+#define TMGTHFALL REGx(R0900_P1_TMGTHFALL)
+#define F0900_P1_TMGLOCK_THFALL 0xf45400ff
 
 /*P1_SFRUPRATIO*/
-#define R0900_P1_SFRUPRATIO  0xf455
-#define F0900_P1_SFR_UPRATIO  0xf45500ff
+#define R0900_P1_SFRUPRATIO 0xf455
+#define SFRUPRATIO REGx(R0900_P1_SFRUPRATIO)
+#define F0900_P1_SFR_UPRATIO 0xf45500ff
 
 /*P1_SFRLOWRATIO*/
-#define R0900_P1_SFRLOWRATIO  0xf456
-#define F0900_P1_SFR_LOWRATIO  0xf45600ff
+#define R0900_P1_SFRLOWRATIO 0xf456
+#define F0900_P1_SFR_LOWRATIO 0xf45600ff
 
 /*P1_KREFTMG*/
-#define R0900_P1_KREFTMG  0xf458
-#define F0900_P1_KREF_TMG  0xf45800ff
+#define R0900_P1_KREFTMG 0xf458
+#define KREFTMG REGx(R0900_P1_KREFTMG)
+#define F0900_P1_KREF_TMG 0xf45800ff
 
 /*P1_SFRSTEP*/
-#define R0900_P1_SFRSTEP  0xf459
-#define F0900_P1_SFR_SCANSTEP  0xf45900f0
-#define F0900_P1_SFR_CENTERSTEP  0xf459000f
+#define R0900_P1_SFRSTEP 0xf459
+#define SFRSTEP REGx(R0900_P1_SFRSTEP)
+#define F0900_P1_SFR_SCANSTEP 0xf45900f0
+#define F0900_P1_SFR_CENTERSTEP 0xf459000f
 
 /*P1_TMGCFG2*/
-#define R0900_P1_TMGCFG2  0xf45a
-#define F0900_P1_DIS_AUTOSAMP  0xf45a0008
-#define F0900_P1_SCANINIT_QUART  0xf45a0004
-#define F0900_P1_NOTMG_DVBS1DERAT  0xf45a0002
-#define F0900_P1_SFRRATIO_FINE  0xf45a0001
+#define R0900_P1_TMGCFG2 0xf45a
+#define TMGCFG2 REGx(R0900_P1_TMGCFG2)
+#define F0900_P1_SFRRATIO_FINE 0xf45a0001
+
+/*P1_KREFTMG2*/
+#define R0900_P1_KREFTMG2 0xf45b
+#define KREFTMG2 REGx(R0900_P1_KREFTMG2)
+#define F0900_P1_KREF_TMG2 0xf45b00ff
 
 /*P1_SFRINIT1*/
-#define R0900_P1_SFRINIT1  0xf45e
-#define F0900_P1_SFR_INIT1  0xf45e00ff
+#define R0900_P1_SFRINIT1 0xf45e
+#define SFRINIT1 REGx(R0900_P1_SFRINIT1)
+#define F0900_P1_SFR_INIT1 0xf45e007f
 
 /*P1_SFRINIT0*/
-#define R0900_P1_SFRINIT0  0xf45f
-#define F0900_P1_SFR_INIT0  0xf45f00ff
+#define R0900_P1_SFRINIT0 0xf45f
+#define SFRINIT0 REGx(R0900_P1_SFRINIT0)
+#define F0900_P1_SFR_INIT0 0xf45f00ff
 
 /*P1_SFRUP1*/
-#define R0900_P1_SFRUP1  0xf460
-#define F0900_P1_AUTO_GUP  0xf4600080
-#define F0900_P1_SYMB_FREQ_UP1  0xf460007f
+#define R0900_P1_SFRUP1 0xf460
+#define SFRUP1 REGx(R0900_P1_SFRUP1)
+#define F0900_P1_AUTO_GUP 0xf4600080
+#define AUTO_GUP FLDx(F0900_P1_AUTO_GUP)
+#define F0900_P1_SYMB_FREQ_UP1 0xf460007f
 
 /*P1_SFRUP0*/
-#define R0900_P1_SFRUP0  0xf461
-#define F0900_P1_SYMB_FREQ_UP0  0xf46100ff
+#define R0900_P1_SFRUP0 0xf461
+#define SFRUP0 REGx(R0900_P1_SFRUP0)
+#define F0900_P1_SYMB_FREQ_UP0 0xf46100ff
 
 /*P1_SFRLOW1*/
-#define R0900_P1_SFRLOW1  0xf462
-#define F0900_P1_AUTO_GLOW  0xf4620080
-#define F0900_P1_SYMB_FREQ_LOW1  0xf462007f
+#define R0900_P1_SFRLOW1 0xf462
+#define SFRLOW1 REGx(R0900_P1_SFRLOW1)
+#define F0900_P1_AUTO_GLOW 0xf4620080
+#define AUTO_GLOW FLDx(F0900_P1_AUTO_GLOW)
+#define F0900_P1_SYMB_FREQ_LOW1 0xf462007f
 
 /*P1_SFRLOW0*/
-#define R0900_P1_SFRLOW0  0xf463
-#define F0900_P1_SYMB_FREQ_LOW0  0xf46300ff
+#define R0900_P1_SFRLOW0 0xf463
+#define SFRLOW0 REGx(R0900_P1_SFRLOW0)
+#define F0900_P1_SYMB_FREQ_LOW0 0xf46300ff
 
 /*P1_SFR3*/
-#define R0900_P1_SFR3  0xf464
-#define F0900_P1_SYMB_FREQ3  0xf46400ff
+#define R0900_P1_SFR3 0xf464
+#define SFR3 REGx(R0900_P1_SFR3)
+#define F0900_P1_SYMB_FREQ3 0xf46400ff
+#define SYMB_FREQ3 FLDx(F0900_P1_SYMB_FREQ3)
 
 /*P1_SFR2*/
-#define R0900_P1_SFR2  0xf465
-#define F0900_P1_SYMB_FREQ2  0xf46500ff
+#define R0900_P1_SFR2 0xf465
+#define SFR2 REGx(R0900_P1_SFR2)
+#define F0900_P1_SYMB_FREQ2 0xf46500ff
+#define SYMB_FREQ2 FLDx(F0900_P1_SYMB_FREQ2)
 
 /*P1_SFR1*/
-#define R0900_P1_SFR1  0xf466
-#define F0900_P1_SYMB_FREQ1  0xf46600ff
+#define R0900_P1_SFR1 0xf466
+#define SFR1 REGx(R0900_P1_SFR1)
+#define F0900_P1_SYMB_FREQ1 0xf46600ff
+#define SYMB_FREQ1 FLDx(F0900_P1_SYMB_FREQ1)
 
 /*P1_SFR0*/
-#define R0900_P1_SFR0  0xf467
-#define F0900_P1_SYMB_FREQ0  0xf46700ff
+#define R0900_P1_SFR0 0xf467
+#define SFR0 REGx(R0900_P1_SFR0)
+#define F0900_P1_SYMB_FREQ0 0xf46700ff
+#define SYMB_FREQ0 FLDx(F0900_P1_SYMB_FREQ0)
 
 /*P1_TMGREG2*/
-#define R0900_P1_TMGREG2  0xf468
-#define F0900_P1_TMGREG2  0xf46800ff
+#define R0900_P1_TMGREG2 0xf468
+#define TMGREG2 REGx(R0900_P1_TMGREG2)
+#define F0900_P1_TMGREG2 0xf46800ff
 
 /*P1_TMGREG1*/
-#define R0900_P1_TMGREG1  0xf469
-#define F0900_P1_TMGREG1  0xf46900ff
+#define R0900_P1_TMGREG1 0xf469
+#define TMGREG1 REGx(R0900_P1_TMGREG1)
+#define F0900_P1_TMGREG1 0xf46900ff
 
 /*P1_TMGREG0*/
-#define R0900_P1_TMGREG0  0xf46a
-#define F0900_P1_TMGREG0  0xf46a00ff
+#define R0900_P1_TMGREG0 0xf46a
+#define TMGREG0 REGx(R0900_P1_TMGREG0)
+#define F0900_P1_TMGREG0 0xf46a00ff
 
 /*P1_TMGLOCK1*/
-#define R0900_P1_TMGLOCK1  0xf46b
-#define F0900_P1_TMGLOCK_LEVEL1  0xf46b01ff
+#define R0900_P1_TMGLOCK1 0xf46b
+#define TMGLOCK1 REGx(R0900_P1_TMGLOCK1)
+#define F0900_P1_TMGLOCK_LEVEL1 0xf46b01ff
 
 /*P1_TMGLOCK0*/
-#define R0900_P1_TMGLOCK0  0xf46c
-#define F0900_P1_TMGLOCK_LEVEL0  0xf46c00ff
+#define R0900_P1_TMGLOCK0 0xf46c
+#define TMGLOCK0 REGx(R0900_P1_TMGLOCK0)
+#define F0900_P1_TMGLOCK_LEVEL0 0xf46c00ff
 
 /*P1_TMGOBS*/
-#define R0900_P1_TMGOBS  0xf46d
-#define F0900_P1_ROLLOFF_STATUS  0xf46d00c0
-#define F0900_P1_SCAN_SIGN  0xf46d0030
-#define F0900_P1_TMG_SCANNING  0xf46d0008
-#define F0900_P1_CHCENTERING_MODE  0xf46d0004
-#define F0900_P1_TMG_SCANFAIL  0xf46d0002
+#define R0900_P1_TMGOBS 0xf46d
+#define TMGOBS REGx(R0900_P1_TMGOBS)
+#define F0900_P1_ROLLOFF_STATUS 0xf46d00c0
+#define ROLLOFF_STATUS FLDx(F0900_P1_ROLLOFF_STATUS)
 
 /*P1_EQUALCFG*/
-#define R0900_P1_EQUALCFG  0xf46f
-#define F0900_P1_NOTMG_NEGALWAIT  0xf46f0080
-#define F0900_P1_EQUAL_ON  0xf46f0040
-#define F0900_P1_SEL_EQUALCOR  0xf46f0038
-#define F0900_P1_MU_EQUALDFE  0xf46f0007
+#define R0900_P1_EQUALCFG 0xf46f
+#define EQUALCFG REGx(R0900_P1_EQUALCFG)
+#define F0900_P1_EQUAL_ON 0xf46f0040
+#define F0900_P1_MU_EQUALDFE 0xf46f0007
 
 /*P1_EQUAI1*/
-#define R0900_P1_EQUAI1  0xf470
-#define F0900_P1_EQUA_ACCI1  0xf47001ff
+#define R0900_P1_EQUAI1 0xf470
+#define EQUAI1 REGx(R0900_P1_EQUAI1)
+#define F0900_P1_EQUA_ACCI1 0xf47001ff
 
 /*P1_EQUAQ1*/
-#define R0900_P1_EQUAQ1  0xf471
-#define F0900_P1_EQUA_ACCQ1  0xf47101ff
+#define R0900_P1_EQUAQ1 0xf471
+#define EQUAQ1 REGx(R0900_P1_EQUAQ1)
+#define F0900_P1_EQUA_ACCQ1 0xf47101ff
 
 /*P1_EQUAI2*/
-#define R0900_P1_EQUAI2  0xf472
-#define F0900_P1_EQUA_ACCI2  0xf47201ff
+#define R0900_P1_EQUAI2 0xf472
+#define EQUAI2 REGx(R0900_P1_EQUAI2)
+#define F0900_P1_EQUA_ACCI2 0xf47201ff
 
 /*P1_EQUAQ2*/
-#define R0900_P1_EQUAQ2  0xf473
-#define F0900_P1_EQUA_ACCQ2  0xf47301ff
+#define R0900_P1_EQUAQ2 0xf473
+#define EQUAQ2 REGx(R0900_P1_EQUAQ2)
+#define F0900_P1_EQUA_ACCQ2 0xf47301ff
 
 /*P1_EQUAI3*/
-#define R0900_P1_EQUAI3  0xf474
-#define F0900_P1_EQUA_ACCI3  0xf47401ff
+#define R0900_P1_EQUAI3 0xf474
+#define EQUAI3 REGx(R0900_P1_EQUAI3)
+#define F0900_P1_EQUA_ACCI3 0xf47401ff
 
 /*P1_EQUAQ3*/
-#define R0900_P1_EQUAQ3  0xf475
-#define F0900_P1_EQUA_ACCQ3  0xf47501ff
+#define R0900_P1_EQUAQ3 0xf475
+#define EQUAQ3 REGx(R0900_P1_EQUAQ3)
+#define F0900_P1_EQUA_ACCQ3 0xf47501ff
 
 /*P1_EQUAI4*/
-#define R0900_P1_EQUAI4  0xf476
-#define F0900_P1_EQUA_ACCI4  0xf47601ff
+#define R0900_P1_EQUAI4 0xf476
+#define EQUAI4 REGx(R0900_P1_EQUAI4)
+#define F0900_P1_EQUA_ACCI4 0xf47601ff
 
 /*P1_EQUAQ4*/
-#define R0900_P1_EQUAQ4  0xf477
-#define F0900_P1_EQUA_ACCQ4  0xf47701ff
+#define R0900_P1_EQUAQ4 0xf477
+#define EQUAQ4 REGx(R0900_P1_EQUAQ4)
+#define F0900_P1_EQUA_ACCQ4 0xf47701ff
 
 /*P1_EQUAI5*/
-#define R0900_P1_EQUAI5  0xf478
-#define F0900_P1_EQUA_ACCI5  0xf47801ff
+#define R0900_P1_EQUAI5 0xf478
+#define EQUAI5 REGx(R0900_P1_EQUAI5)
+#define F0900_P1_EQUA_ACCI5 0xf47801ff
 
 /*P1_EQUAQ5*/
-#define R0900_P1_EQUAQ5  0xf479
-#define F0900_P1_EQUA_ACCQ5  0xf47901ff
+#define R0900_P1_EQUAQ5 0xf479
+#define EQUAQ5 REGx(R0900_P1_EQUAQ5)
+#define F0900_P1_EQUA_ACCQ5 0xf47901ff
 
 /*P1_EQUAI6*/
-#define R0900_P1_EQUAI6  0xf47a
-#define F0900_P1_EQUA_ACCI6  0xf47a01ff
+#define R0900_P1_EQUAI6 0xf47a
+#define EQUAI6 REGx(R0900_P1_EQUAI6)
+#define F0900_P1_EQUA_ACCI6 0xf47a01ff
 
 /*P1_EQUAQ6*/
-#define R0900_P1_EQUAQ6  0xf47b
-#define F0900_P1_EQUA_ACCQ6  0xf47b01ff
+#define R0900_P1_EQUAQ6 0xf47b
+#define EQUAQ6 REGx(R0900_P1_EQUAQ6)
+#define F0900_P1_EQUA_ACCQ6 0xf47b01ff
 
 /*P1_EQUAI7*/
-#define R0900_P1_EQUAI7  0xf47c
-#define F0900_P1_EQUA_ACCI7  0xf47c01ff
+#define R0900_P1_EQUAI7 0xf47c
+#define EQUAI7 REGx(R0900_P1_EQUAI7)
+#define F0900_P1_EQUA_ACCI7 0xf47c01ff
 
 /*P1_EQUAQ7*/
-#define R0900_P1_EQUAQ7  0xf47d
-#define F0900_P1_EQUA_ACCQ7  0xf47d01ff
+#define R0900_P1_EQUAQ7 0xf47d
+#define EQUAQ7 REGx(R0900_P1_EQUAQ7)
+#define F0900_P1_EQUA_ACCQ7 0xf47d01ff
 
 /*P1_EQUAI8*/
-#define R0900_P1_EQUAI8  0xf47e
-#define F0900_P1_EQUA_ACCI8  0xf47e01ff
+#define R0900_P1_EQUAI8 0xf47e
+#define EQUAI8 REGx(R0900_P1_EQUAI8)
+#define F0900_P1_EQUA_ACCI8 0xf47e01ff
 
 /*P1_EQUAQ8*/
-#define R0900_P1_EQUAQ8  0xf47f
-#define F0900_P1_EQUA_ACCQ8  0xf47f01ff
+#define R0900_P1_EQUAQ8 0xf47f
+#define EQUAQ8 REGx(R0900_P1_EQUAQ8)
+#define F0900_P1_EQUA_ACCQ8 0xf47f01ff
 
 /*P1_NNOSDATAT1*/
-#define R0900_P1_NNOSDATAT1  0xf480
-#define F0900_P1_NOSDATAT_NORMED1  0xf48000ff
+#define R0900_P1_NNOSDATAT1 0xf480
+#define NNOSDATAT1 REGx(R0900_P1_NNOSDATAT1)
+#define F0900_P1_NOSDATAT_NORMED1 0xf48000ff
+#define NOSDATAT_NORMED1 FLDx(F0900_P1_NOSDATAT_NORMED1)
 
 /*P1_NNOSDATAT0*/
-#define R0900_P1_NNOSDATAT0  0xf481
-#define F0900_P1_NOSDATAT_NORMED0  0xf48100ff
+#define R0900_P1_NNOSDATAT0 0xf481
+#define NNOSDATAT0 REGx(R0900_P1_NNOSDATAT0)
+#define F0900_P1_NOSDATAT_NORMED0 0xf48100ff
+#define NOSDATAT_NORMED0 FLDx(F0900_P1_NOSDATAT_NORMED0)
 
 /*P1_NNOSDATA1*/
-#define R0900_P1_NNOSDATA1  0xf482
-#define F0900_P1_NOSDATA_NORMED1  0xf48200ff
+#define R0900_P1_NNOSDATA1 0xf482
+#define NNOSDATA1 REGx(R0900_P1_NNOSDATA1)
+#define F0900_P1_NOSDATA_NORMED1 0xf48200ff
 
 /*P1_NNOSDATA0*/
-#define R0900_P1_NNOSDATA0  0xf483
-#define F0900_P1_NOSDATA_NORMED0  0xf48300ff
+#define R0900_P1_NNOSDATA0 0xf483
+#define NNOSDATA0 REGx(R0900_P1_NNOSDATA0)
+#define F0900_P1_NOSDATA_NORMED0 0xf48300ff
 
 /*P1_NNOSPLHT1*/
-#define R0900_P1_NNOSPLHT1  0xf484
-#define F0900_P1_NOSPLHT_NORMED1  0xf48400ff
+#define R0900_P1_NNOSPLHT1 0xf484
+#define NNOSPLHT1 REGx(R0900_P1_NNOSPLHT1)
+#define F0900_P1_NOSPLHT_NORMED1 0xf48400ff
+#define NOSPLHT_NORMED1 FLDx(F0900_P1_NOSPLHT_NORMED1)
 
 /*P1_NNOSPLHT0*/
-#define R0900_P1_NNOSPLHT0  0xf485
-#define F0900_P1_NOSPLHT_NORMED0  0xf48500ff
+#define R0900_P1_NNOSPLHT0 0xf485
+#define NNOSPLHT0 REGx(R0900_P1_NNOSPLHT0)
+#define F0900_P1_NOSPLHT_NORMED0 0xf48500ff
+#define NOSPLHT_NORMED0 FLDx(F0900_P1_NOSPLHT_NORMED0)
 
 /*P1_NNOSPLH1*/
-#define R0900_P1_NNOSPLH1  0xf486
-#define F0900_P1_NOSPLH_NORMED1  0xf48600ff
+#define R0900_P1_NNOSPLH1 0xf486
+#define NNOSPLH1 REGx(R0900_P1_NNOSPLH1)
+#define F0900_P1_NOSPLH_NORMED1 0xf48600ff
 
 /*P1_NNOSPLH0*/
-#define R0900_P1_NNOSPLH0  0xf487
-#define F0900_P1_NOSPLH_NORMED0  0xf48700ff
+#define R0900_P1_NNOSPLH0 0xf487
+#define NNOSPLH0 REGx(R0900_P1_NNOSPLH0)
+#define F0900_P1_NOSPLH_NORMED0 0xf48700ff
 
 /*P1_NOSDATAT1*/
-#define R0900_P1_NOSDATAT1  0xf488
-#define F0900_P1_NOSDATAT_UNNORMED1  0xf48800ff
+#define R0900_P1_NOSDATAT1 0xf488
+#define NOSDATAT1 REGx(R0900_P1_NOSDATAT1)
+#define F0900_P1_NOSDATAT_UNNORMED1 0xf48800ff
 
 /*P1_NOSDATAT0*/
-#define R0900_P1_NOSDATAT0  0xf489
-#define F0900_P1_NOSDATAT_UNNORMED0  0xf48900ff
+#define R0900_P1_NOSDATAT0 0xf489
+#define NOSDATAT0 REGx(R0900_P1_NOSDATAT0)
+#define F0900_P1_NOSDATAT_UNNORMED0 0xf48900ff
 
 /*P1_NOSDATA1*/
-#define R0900_P1_NOSDATA1  0xf48a
-#define F0900_P1_NOSDATA_UNNORMED1  0xf48a00ff
+#define R0900_P1_NOSDATA1 0xf48a
+#define NOSDATA1 REGx(R0900_P1_NOSDATA1)
+#define F0900_P1_NOSDATA_UNNORMED1 0xf48a00ff
 
 /*P1_NOSDATA0*/
-#define R0900_P1_NOSDATA0  0xf48b
-#define F0900_P1_NOSDATA_UNNORMED0  0xf48b00ff
+#define R0900_P1_NOSDATA0 0xf48b
+#define NOSDATA0 REGx(R0900_P1_NOSDATA0)
+#define F0900_P1_NOSDATA_UNNORMED0 0xf48b00ff
 
 /*P1_NOSPLHT1*/
-#define R0900_P1_NOSPLHT1  0xf48c
-#define F0900_P1_NOSPLHT_UNNORMED1  0xf48c00ff
+#define R0900_P1_NOSPLHT1 0xf48c
+#define NOSPLHT1 REGx(R0900_P1_NOSPLHT1)
+#define F0900_P1_NOSPLHT_UNNORMED1 0xf48c00ff
 
 /*P1_NOSPLHT0*/
-#define R0900_P1_NOSPLHT0  0xf48d
-#define F0900_P1_NOSPLHT_UNNORMED0  0xf48d00ff
+#define R0900_P1_NOSPLHT0 0xf48d
+#define NOSPLHT0 REGx(R0900_P1_NOSPLHT0)
+#define F0900_P1_NOSPLHT_UNNORMED0 0xf48d00ff
 
 /*P1_NOSPLH1*/
-#define R0900_P1_NOSPLH1  0xf48e
-#define F0900_P1_NOSPLH_UNNORMED1  0xf48e00ff
+#define R0900_P1_NOSPLH1 0xf48e
+#define NOSPLH1 REGx(R0900_P1_NOSPLH1)
+#define F0900_P1_NOSPLH_UNNORMED1 0xf48e00ff
 
 /*P1_NOSPLH0*/
-#define R0900_P1_NOSPLH0  0xf48f
-#define F0900_P1_NOSPLH_UNNORMED0  0xf48f00ff
+#define R0900_P1_NOSPLH0 0xf48f
+#define NOSPLH0 REGx(R0900_P1_NOSPLH0)
+#define F0900_P1_NOSPLH_UNNORMED0 0xf48f00ff
 
 /*P1_CAR2CFG*/
-#define R0900_P1_CAR2CFG  0xf490
-#define F0900_P1_DESCRAMB_OFF  0xf4900080
-#define F0900_P1_PN4_SELECT  0xf4900040
-#define F0900_P1_CFR2_STOPDVBS1  0xf4900020
-#define F0900_P1_STOP_CFR2UPDATE  0xf4900010
-#define F0900_P1_STOP_NCO2UPDATE  0xf4900008
-#define F0900_P1_ROTA2ON  0xf4900004
-#define F0900_P1_PH_DET_ALGO2  0xf4900003
-
-/*P1_ACLC2*/
-#define R0900_P1_ACLC2  0xf491
-#define F0900_P1_CAR2_PUNCT_ADERAT  0xf4910040
-#define F0900_P1_CAR2_ALPHA_MANT  0xf4910030
-#define F0900_P1_CAR2_ALPHA_EXP  0xf491000f
-
-/*P1_BCLC2*/
-#define R0900_P1_BCLC2  0xf492
-#define F0900_P1_DVBS2_NIP  0xf4920080
-#define F0900_P1_CAR2_PUNCT_BDERAT  0xf4920040
-#define F0900_P1_CAR2_BETA_MANT  0xf4920030
-#define F0900_P1_CAR2_BETA_EXP  0xf492000f
+#define R0900_P1_CAR2CFG 0xf490
+#define CAR2CFG REGx(R0900_P1_CAR2CFG)
+#define F0900_P1_CARRIER3_DISABLE 0xf4900040
+#define F0900_P1_ROTA2ON 0xf4900004
+#define F0900_P1_PH_DET_ALGO2 0xf4900003
+
+/*P1_CFR2CFR1*/
+#define R0900_P1_CFR2CFR1 0xf491
+#define CFR2CFR1 REGx(R0900_P1_CFR2CFR1)
+#define F0900_P1_CFR2TOCFR1_DVBS1 0xf49100c0
+#define F0900_P1_EN_S2CAR2CENTER 0xf4910020
+#define F0900_P1_DIS_BCHERRCFR2 0xf4910010
+#define F0900_P1_CFR2TOCFR1_BETA 0xf4910007
 
 /*P1_CFR22*/
-#define R0900_P1_CFR22  0xf493
-#define F0900_P1_CAR2_FREQ2  0xf49301ff
+#define R0900_P1_CFR22 0xf493
+#define CFR22 REGx(R0900_P1_CFR22)
+#define F0900_P1_CAR2_FREQ2 0xf49301ff
 
 /*P1_CFR21*/
-#define R0900_P1_CFR21  0xf494
-#define F0900_P1_CAR2_FREQ1  0xf49400ff
+#define R0900_P1_CFR21 0xf494
+#define CFR21 REGx(R0900_P1_CFR21)
+#define F0900_P1_CAR2_FREQ1 0xf49400ff
 
 /*P1_CFR20*/
-#define R0900_P1_CFR20  0xf495
-#define F0900_P1_CAR2_FREQ0  0xf49500ff
+#define R0900_P1_CFR20 0xf495
+#define CFR20 REGx(R0900_P1_CFR20)
+#define F0900_P1_CAR2_FREQ0 0xf49500ff
 
 /*P1_ACLC2S2Q*/
-#define R0900_P1_ACLC2S2Q  0xf497
-#define F0900_P1_ENAB_SPSKSYMB  0xf4970080
-#define F0900_P1_CAR2S2_QADERAT  0xf4970040
-#define F0900_P1_CAR2S2_Q_ALPH_M  0xf4970030
-#define F0900_P1_CAR2S2_Q_ALPH_E  0xf497000f
+#define R0900_P1_ACLC2S2Q 0xf497
+#define ACLC2S2Q REGx(R0900_P1_ACLC2S2Q)
+#define F0900_P1_ENAB_SPSKSYMB 0xf4970080
+#define F0900_P1_CAR2S2_Q_ALPH_M 0xf4970030
+#define F0900_P1_CAR2S2_Q_ALPH_E 0xf497000f
 
 /*P1_ACLC2S28*/
-#define R0900_P1_ACLC2S28  0xf498
-#define F0900_P1_OLDI3Q_MODE  0xf4980080
-#define F0900_P1_CAR2S2_8ADERAT  0xf4980040
-#define F0900_P1_CAR2S2_8_ALPH_M  0xf4980030
-#define F0900_P1_CAR2S2_8_ALPH_E  0xf498000f
+#define R0900_P1_ACLC2S28 0xf498
+#define ACLC2S28 REGx(R0900_P1_ACLC2S28)
+#define F0900_P1_OLDI3Q_MODE 0xf4980080
+#define F0900_P1_CAR2S2_8_ALPH_M 0xf4980030
+#define F0900_P1_CAR2S2_8_ALPH_E 0xf498000f
 
 /*P1_ACLC2S216A*/
-#define R0900_P1_ACLC2S216A  0xf499
-#define F0900_P1_CAR2S2_16ADERAT  0xf4990040
-#define F0900_P1_CAR2S2_16A_ALPH_M  0xf4990030
-#define F0900_P1_CAR2S2_16A_ALPH_E  0xf499000f
+#define R0900_P1_ACLC2S216A 0xf499
+#define ACLC2S216A REGx(R0900_P1_ACLC2S216A)
+#define F0900_P1_DIS_C3STOPA2 0xf4990080
+#define F0900_P1_CAR2S2_16ADERAT 0xf4990040
+#define F0900_P1_CAR2S2_16A_ALPH_M 0xf4990030
+#define F0900_P1_CAR2S2_16A_ALPH_E 0xf499000f
 
 /*P1_ACLC2S232A*/
-#define R0900_P1_ACLC2S232A  0xf49a
-#define F0900_P1_CAR2S2_32ADERAT  0xf49a0040
-#define F0900_P1_CAR2S2_32A_ALPH_M  0xf49a0030
-#define F0900_P1_CAR2S2_32A_ALPH_E  0xf49a000f
+#define R0900_P1_ACLC2S232A 0xf49a
+#define ACLC2S232A REGx(R0900_P1_ACLC2S232A)
+#define F0900_P1_CAR2S2_32ADERAT 0xf49a0040
+#define F0900_P1_CAR2S2_32A_ALPH_M 0xf49a0030
+#define F0900_P1_CAR2S2_32A_ALPH_E 0xf49a000f
 
 /*P1_BCLC2S2Q*/
-#define R0900_P1_BCLC2S2Q  0xf49c
-#define F0900_P1_DVBS2S2Q_NIP  0xf49c0080
-#define F0900_P1_CAR2S2_QBDERAT  0xf49c0040
-#define F0900_P1_CAR2S2_Q_BETA_M  0xf49c0030
-#define F0900_P1_CAR2S2_Q_BETA_E  0xf49c000f
+#define R0900_P1_BCLC2S2Q 0xf49c
+#define BCLC2S2Q REGx(R0900_P1_BCLC2S2Q)
+#define F0900_P1_CAR2S2_Q_BETA_M 0xf49c0030
+#define F0900_P1_CAR2S2_Q_BETA_E 0xf49c000f
 
 /*P1_BCLC2S28*/
-#define R0900_P1_BCLC2S28  0xf49d
-#define F0900_P1_DVBS2S28_NIP  0xf49d0080
-#define F0900_P1_CAR2S2_8BDERAT  0xf49d0040
-#define F0900_P1_CAR2S2_8_BETA_M  0xf49d0030
-#define F0900_P1_CAR2S2_8_BETA_E  0xf49d000f
+#define R0900_P1_BCLC2S28 0xf49d
+#define BCLC2S28 REGx(R0900_P1_BCLC2S28)
+#define F0900_P1_CAR2S2_8_BETA_M 0xf49d0030
+#define F0900_P1_CAR2S2_8_BETA_E 0xf49d000f
 
 /*P1_BCLC2S216A*/
-#define R0900_P1_BCLC2S216A  0xf49e
-#define F0900_P1_DVBS2S216A_NIP  0xf49e0080
-#define F0900_P1_CAR2S2_16BDERAT  0xf49e0040
-#define F0900_P1_CAR2S2_16A_BETA_M  0xf49e0030
-#define F0900_P1_CAR2S2_16A_BETA_E  0xf49e000f
+#define R0900_P1_BCLC2S216A 0xf49e
+#define BCLC2S216A REGx(R0900_P1_BCLC2S216A)
 
 /*P1_BCLC2S232A*/
-#define R0900_P1_BCLC2S232A  0xf49f
-#define F0900_P1_DVBS2S232A_NIP  0xf49f0080
-#define F0900_P1_CAR2S2_32BDERAT  0xf49f0040
-#define F0900_P1_CAR2S2_32A_BETA_M  0xf49f0030
-#define F0900_P1_CAR2S2_32A_BETA_E  0xf49f000f
+#define R0900_P1_BCLC2S232A 0xf49f
+#define BCLC2S232A REGx(R0900_P1_BCLC2S232A)
 
 /*P1_PLROOT2*/
-#define R0900_P1_PLROOT2  0xf4ac
-#define F0900_P1_SHORTFR_DISABLE  0xf4ac0080
-#define F0900_P1_LONGFR_DISABLE  0xf4ac0040
-#define F0900_P1_DUMMYPL_DISABLE  0xf4ac0020
-#define F0900_P1_SHORTFR_AVOID  0xf4ac0010
-#define F0900_P1_PLSCRAMB_MODE  0xf4ac000c
-#define F0900_P1_PLSCRAMB_ROOT2  0xf4ac0003
+#define R0900_P1_PLROOT2 0xf4ac
+#define PLROOT2 REGx(R0900_P1_PLROOT2)
+#define F0900_P1_PLSCRAMB_MODE 0xf4ac000c
+#define F0900_P1_PLSCRAMB_ROOT2 0xf4ac0003
 
 /*P1_PLROOT1*/
-#define R0900_P1_PLROOT1  0xf4ad
-#define F0900_P1_PLSCRAMB_ROOT1  0xf4ad00ff
+#define R0900_P1_PLROOT1 0xf4ad
+#define PLROOT1 REGx(R0900_P1_PLROOT1)
+#define F0900_P1_PLSCRAMB_ROOT1 0xf4ad00ff
 
 /*P1_PLROOT0*/
-#define R0900_P1_PLROOT0  0xf4ae
-#define F0900_P1_PLSCRAMB_ROOT0  0xf4ae00ff
+#define R0900_P1_PLROOT0 0xf4ae
+#define PLROOT0 REGx(R0900_P1_PLROOT0)
+#define F0900_P1_PLSCRAMB_ROOT0 0xf4ae00ff
 
 /*P1_MODCODLST0*/
-#define R0900_P1_MODCODLST0  0xf4b0
-#define F0900_P1_EN_TOKEN31  0xf4b00080
-#define F0900_P1_SYNCTAG_SELECT  0xf4b00040
-#define F0900_P1_MODCODRQ_MODE  0xf4b00030
+#define R0900_P1_MODCODLST0 0xf4b0
+#define MODCODLST0 REGx(R0900_P1_MODCODLST0)
 
 /*P1_MODCODLST1*/
-#define R0900_P1_MODCODLST1  0xf4b1
-#define F0900_P1_DIS_MODCOD29  0xf4b100f0
-#define F0900_P1_DIS_32PSK_9_10  0xf4b1000f
+#define R0900_P1_MODCODLST1 0xf4b1
+#define MODCODLST1 REGx(R0900_P1_MODCODLST1)
+#define F0900_P1_DIS_MODCOD29 0xf4b100f0
+#define F0900_P1_DIS_32PSK_9_10 0xf4b1000f
 
 /*P1_MODCODLST2*/
-#define R0900_P1_MODCODLST2  0xf4b2
-#define F0900_P1_DIS_32PSK_8_9  0xf4b200f0
-#define F0900_P1_DIS_32PSK_5_6  0xf4b2000f
+#define R0900_P1_MODCODLST2 0xf4b2
+#define MODCODLST2 REGx(R0900_P1_MODCODLST2)
+#define F0900_P1_DIS_32PSK_8_9 0xf4b200f0
+#define F0900_P1_DIS_32PSK_5_6 0xf4b2000f
 
 /*P1_MODCODLST3*/
-#define R0900_P1_MODCODLST3  0xf4b3
-#define F0900_P1_DIS_32PSK_4_5  0xf4b300f0
-#define F0900_P1_DIS_32PSK_3_4  0xf4b3000f
+#define R0900_P1_MODCODLST3 0xf4b3
+#define MODCODLST3 REGx(R0900_P1_MODCODLST3)
+#define F0900_P1_DIS_32PSK_4_5 0xf4b300f0
+#define F0900_P1_DIS_32PSK_3_4 0xf4b3000f
 
 /*P1_MODCODLST4*/
-#define R0900_P1_MODCODLST4  0xf4b4
-#define F0900_P1_DIS_16PSK_9_10  0xf4b400f0
-#define F0900_P1_DIS_16PSK_8_9  0xf4b4000f
+#define R0900_P1_MODCODLST4 0xf4b4
+#define MODCODLST4 REGx(R0900_P1_MODCODLST4)
+#define F0900_P1_DIS_16PSK_9_10 0xf4b400f0
+#define F0900_P1_DIS_16PSK_8_9 0xf4b4000f
 
 /*P1_MODCODLST5*/
-#define R0900_P1_MODCODLST5  0xf4b5
-#define F0900_P1_DIS_16PSK_5_6  0xf4b500f0
-#define F0900_P1_DIS_16PSK_4_5  0xf4b5000f
+#define R0900_P1_MODCODLST5 0xf4b5
+#define MODCODLST5 REGx(R0900_P1_MODCODLST5)
+#define F0900_P1_DIS_16PSK_5_6 0xf4b500f0
+#define F0900_P1_DIS_16PSK_4_5 0xf4b5000f
 
 /*P1_MODCODLST6*/
-#define R0900_P1_MODCODLST6  0xf4b6
-#define F0900_P1_DIS_16PSK_3_4  0xf4b600f0
-#define F0900_P1_DIS_16PSK_2_3  0xf4b6000f
+#define R0900_P1_MODCODLST6 0xf4b6
+#define MODCODLST6 REGx(R0900_P1_MODCODLST6)
+#define F0900_P1_DIS_16PSK_3_4 0xf4b600f0
+#define F0900_P1_DIS_16PSK_2_3 0xf4b6000f
 
 /*P1_MODCODLST7*/
-#define R0900_P1_MODCODLST7  0xf4b7
-#define F0900_P1_DIS_8P_9_10  0xf4b700f0
-#define F0900_P1_DIS_8P_8_9  0xf4b7000f
+#define R0900_P1_MODCODLST7 0xf4b7
+#define MODCODLST7 REGx(R0900_P1_MODCODLST7)
+#define F0900_P1_DIS_8P_9_10 0xf4b700f0
+#define F0900_P1_DIS_8P_8_9 0xf4b7000f
 
 /*P1_MODCODLST8*/
-#define R0900_P1_MODCODLST8  0xf4b8
-#define F0900_P1_DIS_8P_5_6  0xf4b800f0
-#define F0900_P1_DIS_8P_3_4  0xf4b8000f
+#define R0900_P1_MODCODLST8 0xf4b8
+#define MODCODLST8 REGx(R0900_P1_MODCODLST8)
+#define F0900_P1_DIS_8P_5_6 0xf4b800f0
+#define F0900_P1_DIS_8P_3_4 0xf4b8000f
 
 /*P1_MODCODLST9*/
-#define R0900_P1_MODCODLST9  0xf4b9
-#define F0900_P1_DIS_8P_2_3  0xf4b900f0
-#define F0900_P1_DIS_8P_3_5  0xf4b9000f
+#define R0900_P1_MODCODLST9 0xf4b9
+#define MODCODLST9 REGx(R0900_P1_MODCODLST9)
+#define F0900_P1_DIS_8P_2_3 0xf4b900f0
+#define F0900_P1_DIS_8P_3_5 0xf4b9000f
 
 /*P1_MODCODLSTA*/
-#define R0900_P1_MODCODLSTA  0xf4ba
-#define F0900_P1_DIS_QP_9_10  0xf4ba00f0
-#define F0900_P1_DIS_QP_8_9  0xf4ba000f
+#define R0900_P1_MODCODLSTA 0xf4ba
+#define MODCODLSTA REGx(R0900_P1_MODCODLSTA)
+#define F0900_P1_DIS_QP_9_10 0xf4ba00f0
+#define F0900_P1_DIS_QP_8_9 0xf4ba000f
 
 /*P1_MODCODLSTB*/
-#define R0900_P1_MODCODLSTB  0xf4bb
-#define F0900_P1_DIS_QP_5_6  0xf4bb00f0
-#define F0900_P1_DIS_QP_4_5  0xf4bb000f
+#define R0900_P1_MODCODLSTB 0xf4bb
+#define MODCODLSTB REGx(R0900_P1_MODCODLSTB)
+#define F0900_P1_DIS_QP_5_6 0xf4bb00f0
+#define F0900_P1_DIS_QP_4_5 0xf4bb000f
 
 /*P1_MODCODLSTC*/
-#define R0900_P1_MODCODLSTC  0xf4bc
-#define F0900_P1_DIS_QP_3_4  0xf4bc00f0
-#define F0900_P1_DIS_QP_2_3  0xf4bc000f
+#define R0900_P1_MODCODLSTC 0xf4bc
+#define MODCODLSTC REGx(R0900_P1_MODCODLSTC)
+#define F0900_P1_DIS_QP_3_4 0xf4bc00f0
+#define F0900_P1_DIS_QP_2_3 0xf4bc000f
 
 /*P1_MODCODLSTD*/
-#define R0900_P1_MODCODLSTD  0xf4bd
-#define F0900_P1_DIS_QP_3_5  0xf4bd00f0
-#define F0900_P1_DIS_QP_1_2  0xf4bd000f
+#define R0900_P1_MODCODLSTD 0xf4bd
+#define MODCODLSTD REGx(R0900_P1_MODCODLSTD)
+#define F0900_P1_DIS_QP_3_5 0xf4bd00f0
+#define F0900_P1_DIS_QP_1_2 0xf4bd000f
 
 /*P1_MODCODLSTE*/
-#define R0900_P1_MODCODLSTE  0xf4be
-#define F0900_P1_DIS_QP_2_5  0xf4be00f0
-#define F0900_P1_DIS_QP_1_3  0xf4be000f
+#define R0900_P1_MODCODLSTE 0xf4be
+#define MODCODLSTE REGx(R0900_P1_MODCODLSTE)
+#define F0900_P1_DIS_QP_2_5 0xf4be00f0
+#define F0900_P1_DIS_QP_1_3 0xf4be000f
 
 /*P1_MODCODLSTF*/
-#define R0900_P1_MODCODLSTF  0xf4bf
-#define F0900_P1_DIS_QP_1_4  0xf4bf00f0
-#define F0900_P1_DDEMOD_SET  0xf4bf0002
-#define F0900_P1_DDEMOD_MASK  0xf4bf0001
+#define R0900_P1_MODCODLSTF 0xf4bf
+#define MODCODLSTF REGx(R0900_P1_MODCODLSTF)
+#define F0900_P1_DIS_QP_1_4 0xf4bf00f0
+
+/*P1_GAUSSR0*/
+#define R0900_P1_GAUSSR0 0xf4c0
+#define GAUSSR0 REGx(R0900_P1_GAUSSR0)
+#define F0900_P1_EN_CCIMODE 0xf4c00080
+#define F0900_P1_R0_GAUSSIEN 0xf4c0007f
+
+/*P1_CCIR0*/
+#define R0900_P1_CCIR0 0xf4c1
+#define CCIR0 REGx(R0900_P1_CCIR0)
+#define F0900_P1_CCIDETECT_PLHONLY 0xf4c10080
+#define F0900_P1_R0_CCI 0xf4c1007f
+
+/*P1_CCIQUANT*/
+#define R0900_P1_CCIQUANT 0xf4c2
+#define CCIQUANT REGx(R0900_P1_CCIQUANT)
+#define F0900_P1_CCI_BETA 0xf4c200e0
+#define F0900_P1_CCI_QUANT 0xf4c2001f
+
+/*P1_CCITHRES*/
+#define R0900_P1_CCITHRES 0xf4c3
+#define CCITHRES REGx(R0900_P1_CCITHRES)
+#define F0900_P1_CCI_THRESHOLD 0xf4c300ff
+
+/*P1_CCIACC*/
+#define R0900_P1_CCIACC 0xf4c4
+#define CCIACC REGx(R0900_P1_CCIACC)
+#define F0900_P1_CCI_VALUE 0xf4c400ff
 
 /*P1_DMDRESCFG*/
-#define R0900_P1_DMDRESCFG  0xf4c6
-#define F0900_P1_DMDRES_RESET  0xf4c60080
-#define F0900_P1_DMDRES_NOISESQR  0xf4c60010
-#define F0900_P1_DMDRES_STRALL  0xf4c60008
-#define F0900_P1_DMDRES_NEWONLY  0xf4c60004
-#define F0900_P1_DMDRES_NOSTORE  0xf4c60002
-#define F0900_P1_DMDRES_AGC2MEM  0xf4c60001
+#define R0900_P1_DMDRESCFG 0xf4c6
+#define DMDRESCFG REGx(R0900_P1_DMDRESCFG)
+#define F0900_P1_DMDRES_RESET 0xf4c60080
+#define F0900_P1_DMDRES_STRALL 0xf4c60008
+#define F0900_P1_DMDRES_NEWONLY 0xf4c60004
+#define F0900_P1_DMDRES_NOSTORE 0xf4c60002
 
 /*P1_DMDRESADR*/
-#define R0900_P1_DMDRESADR  0xf4c7
-#define F0900_P1_SUSP_PREDCANAL  0xf4c70080
-#define F0900_P1_DMDRES_VALIDCFR  0xf4c70040
-#define F0900_P1_DMDRES_MEMFULL  0xf4c70030
-#define F0900_P1_DMDRES_RESNBR  0xf4c7000f
+#define R0900_P1_DMDRESADR 0xf4c7
+#define DMDRESADR REGx(R0900_P1_DMDRESADR)
+#define F0900_P1_DMDRES_VALIDCFR 0xf4c70040
+#define F0900_P1_DMDRES_MEMFULL 0xf4c70030
+#define F0900_P1_DMDRES_RESNBR 0xf4c7000f
 
 /*P1_DMDRESDATA7*/
-#define R0900_P1_DMDRESDATA7  0xf4c8
-#define F0900_P1_DMDRES_DATA7  0xf4c800ff
+#define R0900_P1_DMDRESDATA7 0xf4c8
+#define F0900_P1_DMDRES_DATA7 0xf4c800ff
 
 /*P1_DMDRESDATA6*/
-#define R0900_P1_DMDRESDATA6  0xf4c9
-#define F0900_P1_DMDRES_DATA6  0xf4c900ff
+#define R0900_P1_DMDRESDATA6 0xf4c9
+#define F0900_P1_DMDRES_DATA6 0xf4c900ff
 
 /*P1_DMDRESDATA5*/
-#define R0900_P1_DMDRESDATA5  0xf4ca
-#define F0900_P1_DMDRES_DATA5  0xf4ca00ff
+#define R0900_P1_DMDRESDATA5 0xf4ca
+#define F0900_P1_DMDRES_DATA5 0xf4ca00ff
 
 /*P1_DMDRESDATA4*/
-#define R0900_P1_DMDRESDATA4  0xf4cb
-#define F0900_P1_DMDRES_DATA4  0xf4cb00ff
+#define R0900_P1_DMDRESDATA4 0xf4cb
+#define F0900_P1_DMDRES_DATA4 0xf4cb00ff
 
 /*P1_DMDRESDATA3*/
-#define R0900_P1_DMDRESDATA3  0xf4cc
-#define F0900_P1_DMDRES_DATA3  0xf4cc00ff
+#define R0900_P1_DMDRESDATA3 0xf4cc
+#define F0900_P1_DMDRES_DATA3 0xf4cc00ff
 
 /*P1_DMDRESDATA2*/
-#define R0900_P1_DMDRESDATA2  0xf4cd
-#define F0900_P1_DMDRES_DATA2  0xf4cd00ff
+#define R0900_P1_DMDRESDATA2 0xf4cd
+#define F0900_P1_DMDRES_DATA2 0xf4cd00ff
 
 /*P1_DMDRESDATA1*/
-#define R0900_P1_DMDRESDATA1  0xf4ce
-#define F0900_P1_DMDRES_DATA1  0xf4ce00ff
+#define R0900_P1_DMDRESDATA1 0xf4ce
+#define F0900_P1_DMDRES_DATA1 0xf4ce00ff
 
 /*P1_DMDRESDATA0*/
-#define R0900_P1_DMDRESDATA0  0xf4cf
-#define F0900_P1_DMDRES_DATA0  0xf4cf00ff
+#define R0900_P1_DMDRESDATA0 0xf4cf
+#define F0900_P1_DMDRES_DATA0 0xf4cf00ff
 
 /*P1_FFEI1*/
-#define R0900_P1_FFEI1  0xf4d0
-#define F0900_P1_FFE_ACCI1  0xf4d001ff
+#define R0900_P1_FFEI1 0xf4d0
+#define FFEI1 REGx(R0900_P1_FFEI1)
+#define F0900_P1_FFE_ACCI1 0xf4d001ff
 
 /*P1_FFEQ1*/
-#define R0900_P1_FFEQ1  0xf4d1
-#define F0900_P1_FFE_ACCQ1  0xf4d101ff
+#define R0900_P1_FFEQ1 0xf4d1
+#define FFEQ1 REGx(R0900_P1_FFEQ1)
+#define F0900_P1_FFE_ACCQ1 0xf4d101ff
 
 /*P1_FFEI2*/
-#define R0900_P1_FFEI2  0xf4d2
-#define F0900_P1_FFE_ACCI2  0xf4d201ff
+#define R0900_P1_FFEI2 0xf4d2
+#define FFEI2 REGx(R0900_P1_FFEI2)
+#define F0900_P1_FFE_ACCI2 0xf4d201ff
 
 /*P1_FFEQ2*/
-#define R0900_P1_FFEQ2  0xf4d3
-#define F0900_P1_FFE_ACCQ2  0xf4d301ff
+#define R0900_P1_FFEQ2 0xf4d3
+#define FFEQ2 REGx(R0900_P1_FFEQ2)
+#define F0900_P1_FFE_ACCQ2 0xf4d301ff
 
 /*P1_FFEI3*/
-#define R0900_P1_FFEI3  0xf4d4
-#define F0900_P1_FFE_ACCI3  0xf4d401ff
+#define R0900_P1_FFEI3 0xf4d4
+#define FFEI3 REGx(R0900_P1_FFEI3)
+#define F0900_P1_FFE_ACCI3 0xf4d401ff
 
 /*P1_FFEQ3*/
-#define R0900_P1_FFEQ3  0xf4d5
-#define F0900_P1_FFE_ACCQ3  0xf4d501ff
+#define R0900_P1_FFEQ3 0xf4d5
+#define FFEQ3 REGx(R0900_P1_FFEQ3)
+#define F0900_P1_FFE_ACCQ3 0xf4d501ff
 
 /*P1_FFEI4*/
-#define R0900_P1_FFEI4  0xf4d6
-#define F0900_P1_FFE_ACCI4  0xf4d601ff
+#define R0900_P1_FFEI4 0xf4d6
+#define FFEI4 REGx(R0900_P1_FFEI4)
+#define F0900_P1_FFE_ACCI4 0xf4d601ff
 
 /*P1_FFEQ4*/
-#define R0900_P1_FFEQ4  0xf4d7
-#define F0900_P1_FFE_ACCQ4  0xf4d701ff
+#define R0900_P1_FFEQ4 0xf4d7
+#define FFEQ4 REGx(R0900_P1_FFEQ4)
+#define F0900_P1_FFE_ACCQ4 0xf4d701ff
 
 /*P1_FFECFG*/
-#define R0900_P1_FFECFG  0xf4d8
-#define F0900_P1_EQUALFFE_ON  0xf4d80040
-#define F0900_P1_EQUAL_USEDSYMB  0xf4d80030
-#define F0900_P1_MU_EQUALFFE  0xf4d80007
+#define R0900_P1_FFECFG 0xf4d8
+#define FFECFG REGx(R0900_P1_FFECFG)
+#define F0900_P1_EQUALFFE_ON 0xf4d80040
+#define F0900_P1_MU_EQUALFFE 0xf4d80007
 
 /*P1_TNRCFG*/
-#define R0900_P1_TNRCFG  0xf4e0
-#define F0900_P1_TUN_ACKFAIL  0xf4e00080
-#define F0900_P1_TUN_TYPE  0xf4e00070
-#define F0900_P1_TUN_SECSTOP  0xf4e00008
-#define F0900_P1_TUN_VCOSRCH  0xf4e00004
-#define F0900_P1_TUN_MADDRESS  0xf4e00003
+#define R0900_P1_TNRCFG 0xf4e0
+#define TNRCFG REGx(R0900_P1_TNRCFG)
+#define F0900_P1_TUN_ACKFAIL 0xf4e00080
+#define F0900_P1_TUN_TYPE 0xf4e00070
+#define F0900_P1_TUN_SECSTOP 0xf4e00008
+#define F0900_P1_TUN_VCOSRCH 0xf4e00004
+#define F0900_P1_TUN_MADDRESS 0xf4e00003
 
 /*P1_TNRCFG2*/
-#define R0900_P1_TNRCFG2  0xf4e1
-#define F0900_P1_TUN_IQSWAP  0xf4e10080
-#define F0900_P1_STB6110_STEP2MHZ  0xf4e10040
-#define F0900_P1_STB6120_DBLI2C  0xf4e10020
-#define F0900_P1_DIS_FCCK  0xf4e10010
-#define F0900_P1_DIS_LPEN  0xf4e10008
-#define F0900_P1_DIS_BWCALC  0xf4e10004
-#define F0900_P1_SHORT_WAITSTATES  0xf4e10002
-#define F0900_P1_DIS_2BWAGC1  0xf4e10001
+#define R0900_P1_TNRCFG2 0xf4e1
+#define TNRCFG2 REGx(R0900_P1_TNRCFG2)
+#define F0900_P1_TUN_IQSWAP 0xf4e10080
+#define F0900_P1_DIS_BWCALC 0xf4e10004
+#define F0900_P1_SHORT_WAITSTATES 0xf4e10002
 
 /*P1_TNRXTAL*/
-#define R0900_P1_TNRXTAL  0xf4e4
-#define F0900_P1_TUN_MCLKDECIMAL  0xf4e400e0
-#define F0900_P1_TUN_XTALFREQ  0xf4e4001f
+#define R0900_P1_TNRXTAL 0xf4e4
+#define TNRXTAL REGx(R0900_P1_TNRXTAL)
+#define F0900_P1_TUN_XTALFREQ 0xf4e4001f
 
 /*P1_TNRSTEPS*/
-#define R0900_P1_TNRSTEPS  0xf4e7
-#define F0900_P1_TUNER_BW1P6  0xf4e70080
-#define F0900_P1_BWINC_OFFSET  0xf4e70070
-#define F0900_P1_SOFTSTEP_RNG  0xf4e70008
-#define F0900_P1_TUN_BWOFFSET  0xf4e70107
+#define R0900_P1_TNRSTEPS 0xf4e7
+#define TNRSTEPS REGx(R0900_P1_TNRSTEPS)
+#define F0900_P1_TUNER_BW0P125 0xf4e70080
+#define F0900_P1_BWINC_OFFSET 0xf4e70170
+#define F0900_P1_SOFTSTEP_RNG 0xf4e70008
+#define F0900_P1_TUN_BWOFFSET 0xf4e70007
 
 /*P1_TNRGAIN*/
-#define R0900_P1_TNRGAIN  0xf4e8
-#define F0900_P1_TUN_KDIVEN  0xf4e800c0
-#define F0900_P1_STB6X00_OCK  0xf4e80030
-#define F0900_P1_TUN_GAIN  0xf4e8000f
+#define R0900_P1_TNRGAIN 0xf4e8
+#define TNRGAIN REGx(R0900_P1_TNRGAIN)
+#define F0900_P1_TUN_KDIVEN 0xf4e800c0
+#define F0900_P1_STB6X00_OCK 0xf4e80030
+#define F0900_P1_TUN_GAIN 0xf4e8000f
 
 /*P1_TNRRF1*/
-#define R0900_P1_TNRRF1  0xf4e9
-#define F0900_P1_TUN_RFFREQ2  0xf4e900ff
+#define R0900_P1_TNRRF1 0xf4e9
+#define TNRRF1 REGx(R0900_P1_TNRRF1)
+#define F0900_P1_TUN_RFFREQ2 0xf4e900ff
 
 /*P1_TNRRF0*/
-#define R0900_P1_TNRRF0  0xf4ea
-#define F0900_P1_TUN_RFFREQ1  0xf4ea00ff
+#define R0900_P1_TNRRF0 0xf4ea
+#define TNRRF0 REGx(R0900_P1_TNRRF0)
+#define F0900_P1_TUN_RFFREQ1 0xf4ea00ff
 
 /*P1_TNRBW*/
-#define R0900_P1_TNRBW  0xf4eb
-#define F0900_P1_TUN_RFFREQ0  0xf4eb00c0
-#define F0900_P1_TUN_BW  0xf4eb003f
+#define R0900_P1_TNRBW 0xf4eb
+#define TNRBW REGx(R0900_P1_TNRBW)
+#define F0900_P1_TUN_RFFREQ0 0xf4eb00c0
+#define F0900_P1_TUN_BW 0xf4eb003f
 
 /*P1_TNRADJ*/
-#define R0900_P1_TNRADJ  0xf4ec
-#define F0900_P1_STB61X0_RCLK  0xf4ec0080
-#define F0900_P1_STB61X0_CALTIME  0xf4ec0040
-#define F0900_P1_STB6X00_DLB  0xf4ec0038
-#define F0900_P1_STB6000_FCL  0xf4ec0007
+#define R0900_P1_TNRADJ 0xf4ec
+#define TNRADJ REGx(R0900_P1_TNRADJ)
+#define F0900_P1_STB61X0_CALTIME 0xf4ec0040
 
 /*P1_TNRCTL2*/
-#define R0900_P1_TNRCTL2  0xf4ed
-#define F0900_P1_STB61X0_LCP1_RCCKOFF  0xf4ed0080
-#define F0900_P1_STB61X0_LCP0  0xf4ed0040
-#define F0900_P1_STB61X0_XTOUT_RFOUTS  0xf4ed0020
-#define F0900_P1_STB61X0_XTON_MCKDV  0xf4ed0010
-#define F0900_P1_STB61X0_CALOFF_DCOFF  0xf4ed0008
-#define F0900_P1_STB6110_LPT  0xf4ed0004
-#define F0900_P1_STB6110_RX  0xf4ed0002
-#define F0900_P1_STB6110_SYN  0xf4ed0001
+#define R0900_P1_TNRCTL2 0xf4ed
+#define TNRCTL2 REGx(R0900_P1_TNRCTL2)
+#define F0900_P1_STB61X0_RCCKOFF 0xf4ed0080
+#define F0900_P1_STB61X0_ICP_SDOFF 0xf4ed0040
+#define F0900_P1_STB61X0_DCLOOPOFF 0xf4ed0020
+#define F0900_P1_STB61X0_REFOUTSEL 0xf4ed0010
+#define F0900_P1_STB61X0_CALOFF 0xf4ed0008
+#define F0900_P1_STB6XX0_LPT_BEN 0xf4ed0004
+#define F0900_P1_STB6XX0_RX_OSCP 0xf4ed0002
+#define F0900_P1_STB6XX0_SYN 0xf4ed0001
 
 /*P1_TNRCFG3*/
-#define R0900_P1_TNRCFG3  0xf4ee
-#define F0900_P1_STB6120_DISCTRL1  0xf4ee0080
-#define F0900_P1_STB6120_INVORDER  0xf4ee0040
-#define F0900_P1_STB6120_ENCTRL6  0xf4ee0020
-#define F0900_P1_TUN_PLLFREQ  0xf4ee001c
-#define F0900_P1_TUN_I2CFREQ_MODE  0xf4ee0003
+#define R0900_P1_TNRCFG3 0xf4ee
+#define TNRCFG3 REGx(R0900_P1_TNRCFG3)
+#define F0900_P1_TUN_PLLFREQ 0xf4ee001c
+#define F0900_P1_TUN_I2CFREQ_MODE 0xf4ee0003
 
 /*P1_TNRLAUNCH*/
-#define R0900_P1_TNRLAUNCH  0xf4f0
+#define R0900_P1_TNRLAUNCH 0xf4f0
+#define TNRLAUNCH REGx(R0900_P1_TNRLAUNCH)
 
 /*P1_TNRLD*/
-#define R0900_P1_TNRLD  0xf4f0
-#define F0900_P1_TUNLD_VCOING  0xf4f00080
-#define F0900_P1_TUN_REG1FAIL  0xf4f00040
-#define F0900_P1_TUN_REG2FAIL  0xf4f00020
-#define F0900_P1_TUN_REG3FAIL  0xf4f00010
-#define F0900_P1_TUN_REG4FAIL  0xf4f00008
-#define F0900_P1_TUN_REG5FAIL  0xf4f00004
-#define F0900_P1_TUN_BWING  0xf4f00002
-#define F0900_P1_TUN_LOCKED  0xf4f00001
+#define R0900_P1_TNRLD 0xf4f0
+#define TNRLD REGx(R0900_P1_TNRLD)
+#define F0900_P1_TUNLD_VCOING 0xf4f00080
+#define F0900_P1_TUN_REG1FAIL 0xf4f00040
+#define F0900_P1_TUN_REG2FAIL 0xf4f00020
+#define F0900_P1_TUN_REG3FAIL 0xf4f00010
+#define F0900_P1_TUN_REG4FAIL 0xf4f00008
+#define F0900_P1_TUN_REG5FAIL 0xf4f00004
+#define F0900_P1_TUN_BWING 0xf4f00002
+#define F0900_P1_TUN_LOCKED 0xf4f00001
 
 /*P1_TNROBSL*/
-#define R0900_P1_TNROBSL  0xf4f6
-#define F0900_P1_TUN_I2CABORTED  0xf4f60080
-#define F0900_P1_TUN_LPEN  0xf4f60040
-#define F0900_P1_TUN_FCCK  0xf4f60020
-#define F0900_P1_TUN_I2CLOCKED  0xf4f60010
-#define F0900_P1_TUN_PROGDONE  0xf4f6000c
-#define F0900_P1_TUN_RFRESTE1  0xf4f60003
+#define R0900_P1_TNROBSL 0xf4f6
+#define TNROBSL REGx(R0900_P1_TNROBSL)
+#define F0900_P1_TUN_I2CABORTED 0xf4f60080
+#define F0900_P1_TUN_LPEN 0xf4f60040
+#define F0900_P1_TUN_FCCK 0xf4f60020
+#define F0900_P1_TUN_I2CLOCKED 0xf4f60010
+#define F0900_P1_TUN_PROGDONE 0xf4f6000c
+#define F0900_P1_TUN_RFRESTE1 0xf4f60003
 
 /*P1_TNRRESTE*/
-#define R0900_P1_TNRRESTE  0xf4f7
-#define F0900_P1_TUN_RFRESTE0  0xf4f700ff
+#define R0900_P1_TNRRESTE 0xf4f7
+#define TNRRESTE REGx(R0900_P1_TNRRESTE)
+#define F0900_P1_TUN_RFRESTE0 0xf4f700ff
 
 /*P1_SMAPCOEF7*/
-#define R0900_P1_SMAPCOEF7  0xf500
-#define F0900_P1_DIS_QSCALE  0xf5000080
-#define F0900_P1_SMAPCOEF_Q_LLR12  0xf500017f
+#define R0900_P1_SMAPCOEF7 0xf500
+#define SMAPCOEF7 REGx(R0900_P1_SMAPCOEF7)
+#define F0900_P1_DIS_QSCALE 0xf5000080
+#define F0900_P1_SMAPCOEF_Q_LLR12 0xf500017f
 
 /*P1_SMAPCOEF6*/
-#define R0900_P1_SMAPCOEF6  0xf501
-#define F0900_P1_DIS_NEWSCALE  0xf5010008
-#define F0900_P1_ADJ_8PSKLLR1  0xf5010004
-#define F0900_P1_OLD_8PSKLLR1  0xf5010002
-#define F0900_P1_DIS_AB8PSK  0xf5010001
+#define R0900_P1_SMAPCOEF6 0xf501
+#define SMAPCOEF6 REGx(R0900_P1_SMAPCOEF6)
+#define F0900_P1_ADJ_8PSKLLR1 0xf5010004
+#define F0900_P1_OLD_8PSKLLR1 0xf5010002
+#define F0900_P1_DIS_AB8PSK 0xf5010001
 
 /*P1_SMAPCOEF5*/
-#define R0900_P1_SMAPCOEF5  0xf502
-#define F0900_P1_DIS_8SCALE  0xf5020080
-#define F0900_P1_SMAPCOEF_8P_LLR23  0xf502017f
+#define R0900_P1_SMAPCOEF5 0xf502
+#define SMAPCOEF5 REGx(R0900_P1_SMAPCOEF5)
+#define F0900_P1_DIS_8SCALE 0xf5020080
+#define F0900_P1_SMAPCOEF_8P_LLR23 0xf502017f
+
+/*P1_NCO2MAX1*/
+#define R0900_P1_NCO2MAX1 0xf514
+#define NCO2MAX1 REGx(R0900_P1_NCO2MAX1)
+#define F0900_P1_TETA2_MAXVABS1 0xf51400ff
+
+/*P1_NCO2MAX0*/
+#define R0900_P1_NCO2MAX0 0xf515
+#define NCO2MAX0 REGx(R0900_P1_NCO2MAX0)
+#define F0900_P1_TETA2_MAXVABS0 0xf51500ff
+
+/*P1_NCO2FR1*/
+#define R0900_P1_NCO2FR1 0xf516
+#define NCO2FR1 REGx(R0900_P1_NCO2FR1)
+#define F0900_P1_NCO2FINAL_ANGLE1 0xf51600ff
+
+/*P1_NCO2FR0*/
+#define R0900_P1_NCO2FR0 0xf517
+#define NCO2FR0 REGx(R0900_P1_NCO2FR0)
+#define F0900_P1_NCO2FINAL_ANGLE0 0xf51700ff
+
+/*P1_CFR2AVRGE1*/
+#define R0900_P1_CFR2AVRGE1 0xf518
+#define CFR2AVRGE1 REGx(R0900_P1_CFR2AVRGE1)
+#define F0900_P1_I2C_CFR2AVERAGE1 0xf51800ff
+
+/*P1_CFR2AVRGE0*/
+#define R0900_P1_CFR2AVRGE0 0xf519
+#define CFR2AVRGE0 REGx(R0900_P1_CFR2AVRGE0)
+#define F0900_P1_I2C_CFR2AVERAGE0 0xf51900ff
 
 /*P1_DMDPLHSTAT*/
-#define R0900_P1_DMDPLHSTAT  0xf520
-#define F0900_P1_PLH_STATISTIC  0xf52000ff
+#define R0900_P1_DMDPLHSTAT 0xf520
+#define DMDPLHSTAT REGx(R0900_P1_DMDPLHSTAT)
+#define F0900_P1_PLH_STATISTIC 0xf52000ff
 
 /*P1_LOCKTIME3*/
-#define R0900_P1_LOCKTIME3  0xf522
-#define F0900_P1_DEMOD_LOCKTIME3  0xf52200ff
+#define R0900_P1_LOCKTIME3 0xf522
+#define LOCKTIME3 REGx(R0900_P1_LOCKTIME3)
+#define F0900_P1_DEMOD_LOCKTIME3 0xf52200ff
 
 /*P1_LOCKTIME2*/
-#define R0900_P1_LOCKTIME2  0xf523
-#define F0900_P1_DEMOD_LOCKTIME2  0xf52300ff
+#define R0900_P1_LOCKTIME2 0xf523
+#define LOCKTIME2 REGx(R0900_P1_LOCKTIME2)
+#define F0900_P1_DEMOD_LOCKTIME2 0xf52300ff
 
 /*P1_LOCKTIME1*/
-#define R0900_P1_LOCKTIME1  0xf524
-#define F0900_P1_DEMOD_LOCKTIME1  0xf52400ff
+#define R0900_P1_LOCKTIME1 0xf524
+#define LOCKTIME1 REGx(R0900_P1_LOCKTIME1)
+#define F0900_P1_DEMOD_LOCKTIME1 0xf52400ff
 
 /*P1_LOCKTIME0*/
-#define R0900_P1_LOCKTIME0  0xf525
-#define F0900_P1_DEMOD_LOCKTIME0  0xf52500ff
+#define R0900_P1_LOCKTIME0 0xf525
+#define LOCKTIME0 REGx(R0900_P1_LOCKTIME0)
+#define F0900_P1_DEMOD_LOCKTIME0 0xf52500ff
 
 /*P1_VITSCALE*/
-#define R0900_P1_VITSCALE  0xf532
-#define F0900_P1_NVTH_NOSRANGE  0xf5320080
-#define F0900_P1_VERROR_MAXMODE  0xf5320040
-#define F0900_P1_KDIV_MODE  0xf5320030
-#define F0900_P1_NSLOWSN_LOCKED  0xf5320008
-#define F0900_P1_DELOCK_PRFLOSS  0xf5320004
-#define F0900_P1_DIS_RSFLOCK  0xf5320002
+#define R0900_P1_VITSCALE 0xf532
+#define VITSCALE REGx(R0900_P1_VITSCALE)
+#define F0900_P1_NVTH_NOSRANGE 0xf5320080
+#define F0900_P1_VERROR_MAXMODE 0xf5320040
+#define F0900_P1_NSLOWSN_LOCKED 0xf5320008
+#define F0900_P1_DIS_RSFLOCK 0xf5320002
 
 /*P1_FECM*/
-#define R0900_P1_FECM  0xf533
-#define F0900_P1_DSS_DVB  0xf5330080
-#define F0900_P1_DEMOD_BYPASS  0xf5330040
-#define F0900_P1_CMP_SLOWMODE  0xf5330020
-#define F0900_P1_DSS_SRCH  0xf5330010
-#define F0900_P1_DIFF_MODEVIT  0xf5330004
-#define F0900_P1_SYNCVIT  0xf5330002
-#define F0900_P1_IQINV  0xf5330001
+#define R0900_P1_FECM 0xf533
+#define FECM REGx(R0900_P1_FECM)
+#define F0900_P1_DSS_DVB 0xf5330080
+#define DSS_DVB FLDx(F0900_P1_DSS_DVB)
+#define F0900_P1_DSS_SRCH 0xf5330010
+#define F0900_P1_SYNCVIT 0xf5330002
+#define F0900_P1_IQINV 0xf5330001
+#define IQINV FLDx(F0900_P1_IQINV)
 
 /*P1_VTH12*/
-#define R0900_P1_VTH12  0xf534
-#define F0900_P1_VTH12  0xf53400ff
+#define R0900_P1_VTH12 0xf534
+#define VTH12 REGx(R0900_P1_VTH12)
+#define F0900_P1_VTH12 0xf53400ff
 
 /*P1_VTH23*/
-#define R0900_P1_VTH23  0xf535
-#define F0900_P1_VTH23  0xf53500ff
+#define R0900_P1_VTH23 0xf535
+#define VTH23 REGx(R0900_P1_VTH23)
+#define F0900_P1_VTH23 0xf53500ff
 
 /*P1_VTH34*/
-#define R0900_P1_VTH34  0xf536
-#define F0900_P1_VTH34  0xf53600ff
+#define R0900_P1_VTH34 0xf536
+#define VTH34 REGx(R0900_P1_VTH34)
+#define F0900_P1_VTH34 0xf53600ff
 
 /*P1_VTH56*/
-#define R0900_P1_VTH56  0xf537
-#define F0900_P1_VTH56  0xf53700ff
+#define R0900_P1_VTH56 0xf537
+#define VTH56 REGx(R0900_P1_VTH56)
+#define F0900_P1_VTH56 0xf53700ff
 
 /*P1_VTH67*/
-#define R0900_P1_VTH67  0xf538
-#define F0900_P1_VTH67  0xf53800ff
+#define R0900_P1_VTH67 0xf538
+#define VTH67 REGx(R0900_P1_VTH67)
+#define F0900_P1_VTH67 0xf53800ff
 
 /*P1_VTH78*/
-#define R0900_P1_VTH78  0xf539
-#define F0900_P1_VTH78  0xf53900ff
+#define R0900_P1_VTH78 0xf539
+#define VTH78 REGx(R0900_P1_VTH78)
+#define F0900_P1_VTH78 0xf53900ff
 
 /*P1_VITCURPUN*/
-#define R0900_P1_VITCURPUN  0xf53a
-#define F0900_P1_VIT_MAPPING  0xf53a00e0
-#define F0900_P1_VIT_CURPUN  0xf53a001f
+#define R0900_P1_VITCURPUN 0xf53a
+#define VITCURPUN REGx(R0900_P1_VITCURPUN)
+#define F0900_P1_VIT_CURPUN 0xf53a001f
+#define VIT_CURPUN FLDx(F0900_P1_VIT_CURPUN)
 
 /*P1_VERROR*/
-#define R0900_P1_VERROR  0xf53b
-#define F0900_P1_REGERR_VIT  0xf53b00ff
+#define R0900_P1_VERROR 0xf53b
+#define VERROR REGx(R0900_P1_VERROR)
+#define F0900_P1_REGERR_VIT 0xf53b00ff
 
 /*P1_PRVIT*/
-#define R0900_P1_PRVIT  0xf53c
-#define F0900_P1_DIS_VTHLOCK  0xf53c0040
-#define F0900_P1_E7_8VIT  0xf53c0020
-#define F0900_P1_E6_7VIT  0xf53c0010
-#define F0900_P1_E5_6VIT  0xf53c0008
-#define F0900_P1_E3_4VIT  0xf53c0004
-#define F0900_P1_E2_3VIT  0xf53c0002
-#define F0900_P1_E1_2VIT  0xf53c0001
+#define R0900_P1_PRVIT 0xf53c
+#define PRVIT REGx(R0900_P1_PRVIT)
+#define F0900_P1_DIS_VTHLOCK 0xf53c0040
+#define F0900_P1_E7_8VIT 0xf53c0020
+#define F0900_P1_E6_7VIT 0xf53c0010
+#define F0900_P1_E5_6VIT 0xf53c0008
+#define F0900_P1_E3_4VIT 0xf53c0004
+#define F0900_P1_E2_3VIT 0xf53c0002
+#define F0900_P1_E1_2VIT 0xf53c0001
 
 /*P1_VAVSRVIT*/
-#define R0900_P1_VAVSRVIT  0xf53d
-#define F0900_P1_AMVIT  0xf53d0080
-#define F0900_P1_FROZENVIT  0xf53d0040
-#define F0900_P1_SNVIT  0xf53d0030
-#define F0900_P1_TOVVIT  0xf53d000c
-#define F0900_P1_HYPVIT  0xf53d0003
+#define R0900_P1_VAVSRVIT 0xf53d
+#define VAVSRVIT REGx(R0900_P1_VAVSRVIT)
+#define F0900_P1_AMVIT 0xf53d0080
+#define F0900_P1_FROZENVIT 0xf53d0040
+#define F0900_P1_SNVIT 0xf53d0030
+#define F0900_P1_TOVVIT 0xf53d000c
+#define F0900_P1_HYPVIT 0xf53d0003
 
 /*P1_VSTATUSVIT*/
-#define R0900_P1_VSTATUSVIT  0xf53e
-#define F0900_P1_VITERBI_ON  0xf53e0080
-#define F0900_P1_END_LOOPVIT  0xf53e0040
-#define F0900_P1_VITERBI_DEPRF  0xf53e0020
-#define F0900_P1_PRFVIT  0xf53e0010
-#define F0900_P1_LOCKEDVIT  0xf53e0008
-#define F0900_P1_VITERBI_DELOCK  0xf53e0004
-#define F0900_P1_VIT_DEMODSEL  0xf53e0002
-#define F0900_P1_VITERBI_COMPOUT  0xf53e0001
+#define R0900_P1_VSTATUSVIT 0xf53e
+#define VSTATUSVIT REGx(R0900_P1_VSTATUSVIT)
+#define F0900_P1_PRFVIT 0xf53e0010
+#define PRFVIT FLDx(F0900_P1_PRFVIT)
+#define F0900_P1_LOCKEDVIT 0xf53e0008
+#define LOCKEDVIT FLDx(F0900_P1_LOCKEDVIT)
 
 /*P1_VTHINUSE*/
-#define R0900_P1_VTHINUSE  0xf53f
-#define F0900_P1_VIT_INUSE  0xf53f00ff
+#define R0900_P1_VTHINUSE 0xf53f
+#define VTHINUSE REGx(R0900_P1_VTHINUSE)
+#define F0900_P1_VIT_INUSE 0xf53f00ff
 
 /*P1_KDIV12*/
-#define R0900_P1_KDIV12  0xf540
-#define F0900_P1_KDIV12_MANUAL  0xf5400080
-#define F0900_P1_K_DIVIDER_12  0xf540007f
+#define R0900_P1_KDIV12 0xf540
+#define KDIV12 REGx(R0900_P1_KDIV12)
+#define F0900_P1_K_DIVIDER_12 0xf540007f
 
 /*P1_KDIV23*/
-#define R0900_P1_KDIV23  0xf541
-#define F0900_P1_KDIV23_MANUAL  0xf5410080
-#define F0900_P1_K_DIVIDER_23  0xf541007f
+#define R0900_P1_KDIV23 0xf541
+#define KDIV23 REGx(R0900_P1_KDIV23)
+#define F0900_P1_K_DIVIDER_23 0xf541007f
 
 /*P1_KDIV34*/
-#define R0900_P1_KDIV34  0xf542
-#define F0900_P1_KDIV34_MANUAL  0xf5420080
-#define F0900_P1_K_DIVIDER_34  0xf542007f
+#define R0900_P1_KDIV34 0xf542
+#define KDIV34 REGx(R0900_P1_KDIV34)
+#define F0900_P1_K_DIVIDER_34 0xf542007f
 
 /*P1_KDIV56*/
-#define R0900_P1_KDIV56  0xf543
-#define F0900_P1_KDIV56_MANUAL  0xf5430080
-#define F0900_P1_K_DIVIDER_56  0xf543007f
+#define R0900_P1_KDIV56 0xf543
+#define KDIV56 REGx(R0900_P1_KDIV56)
+#define F0900_P1_K_DIVIDER_56 0xf543007f
 
 /*P1_KDIV67*/
-#define R0900_P1_KDIV67  0xf544
-#define F0900_P1_KDIV67_MANUAL  0xf5440080
-#define F0900_P1_K_DIVIDER_67  0xf544007f
+#define R0900_P1_KDIV67 0xf544
+#define KDIV67 REGx(R0900_P1_KDIV67)
+#define F0900_P1_K_DIVIDER_67 0xf544007f
 
 /*P1_KDIV78*/
-#define R0900_P1_KDIV78  0xf545
-#define F0900_P1_KDIV78_MANUAL  0xf5450080
-#define F0900_P1_K_DIVIDER_78  0xf545007f
+#define R0900_P1_KDIV78 0xf545
+#define KDIV78 REGx(R0900_P1_KDIV78)
+#define F0900_P1_K_DIVIDER_78 0xf545007f
 
 /*P1_PDELCTRL1*/
-#define R0900_P1_PDELCTRL1  0xf550
-#define F0900_P1_INV_MISMASK  0xf5500080
-#define F0900_P1_FORCE_ACCEPTED  0xf5500040
-#define F0900_P1_FILTER_EN  0xf5500020
-#define F0900_P1_FORCE_PKTDELINUSE  0xf5500010
-#define F0900_P1_HYSTEN  0xf5500008
-#define F0900_P1_HYSTSWRST  0xf5500004
-#define F0900_P1_EN_MIS00  0xf5500002
-#define F0900_P1_ALGOSWRST  0xf5500001
+#define R0900_P1_PDELCTRL1 0xf550
+#define PDELCTRL1 REGx(R0900_P1_PDELCTRL1)
+#define F0900_P1_INV_MISMASK 0xf5500080
+#define F0900_P1_FILTER_EN 0xf5500020
+#define F0900_P1_EN_MIS00 0xf5500002
+#define F0900_P1_ALGOSWRST 0xf5500001
+#define ALGOSWRST FLDx(F0900_P1_ALGOSWRST)
 
 /*P1_PDELCTRL2*/
-#define R0900_P1_PDELCTRL2  0xf551
-#define F0900_P1_FORCE_CONTINUOUS  0xf5510080
-#define F0900_P1_RESET_UPKO_COUNT  0xf5510040
-#define F0900_P1_USER_PKTDELIN_NB  0xf5510020
-#define F0900_P1_FORCE_LOCKED  0xf5510010
-#define F0900_P1_DATA_UNBBSCRAM  0xf5510008
-#define F0900_P1_FORCE_LONGPKT  0xf5510004
-#define F0900_P1_FRAME_MODE  0xf5510002
+#define R0900_P1_PDELCTRL2 0xf551
+#define PDELCTRL2 REGx(R0900_P1_PDELCTRL2)
+#define F0900_P1_RESET_UPKO_COUNT 0xf5510040
+#define RESET_UPKO_COUNT FLDx(F0900_P1_RESET_UPKO_COUNT)
+#define F0900_P1_FRAME_MODE 0xf5510002
+#define F0900_P1_NOBCHERRFLG_USE 0xf5510001
 
 /*P1_HYSTTHRESH*/
-#define R0900_P1_HYSTTHRESH  0xf554
-#define F0900_P1_UNLCK_THRESH  0xf55400f0
-#define F0900_P1_DELIN_LCK_THRESH  0xf554000f
+#define R0900_P1_HYSTTHRESH 0xf554
+#define HYSTTHRESH REGx(R0900_P1_HYSTTHRESH)
+#define F0900_P1_UNLCK_THRESH 0xf55400f0
+#define F0900_P1_DELIN_LCK_THRESH 0xf554000f
 
 /*P1_ISIENTRY*/
-#define R0900_P1_ISIENTRY  0xf55e
-#define F0900_P1_ISI_ENTRY  0xf55e00ff
+#define R0900_P1_ISIENTRY 0xf55e
+#define ISIENTRY REGx(R0900_P1_ISIENTRY)
+#define F0900_P1_ISI_ENTRY 0xf55e00ff
 
 /*P1_ISIBITENA*/
-#define R0900_P1_ISIBITENA  0xf55f
-#define F0900_P1_ISI_BIT_EN  0xf55f00ff
+#define R0900_P1_ISIBITENA 0xf55f
+#define ISIBITENA REGx(R0900_P1_ISIBITENA)
+#define F0900_P1_ISI_BIT_EN 0xf55f00ff
 
 /*P1_MATSTR1*/
-#define R0900_P1_MATSTR1  0xf560
-#define F0900_P1_MATYPE_CURRENT1  0xf56000ff
+#define R0900_P1_MATSTR1 0xf560
+#define MATSTR1 REGx(R0900_P1_MATSTR1)
+#define F0900_P1_MATYPE_CURRENT1 0xf56000ff
 
 /*P1_MATSTR0*/
-#define R0900_P1_MATSTR0  0xf561
-#define F0900_P1_MATYPE_CURRENT0  0xf56100ff
+#define R0900_P1_MATSTR0 0xf561
+#define MATSTR0 REGx(R0900_P1_MATSTR0)
+#define F0900_P1_MATYPE_CURRENT0 0xf56100ff
 
 /*P1_UPLSTR1*/
-#define R0900_P1_UPLSTR1  0xf562
-#define F0900_P1_UPL_CURRENT1  0xf56200ff
+#define R0900_P1_UPLSTR1 0xf562
+#define UPLSTR1 REGx(R0900_P1_UPLSTR1)
+#define F0900_P1_UPL_CURRENT1 0xf56200ff
 
 /*P1_UPLSTR0*/
-#define R0900_P1_UPLSTR0  0xf563
-#define F0900_P1_UPL_CURRENT0  0xf56300ff
+#define R0900_P1_UPLSTR0 0xf563
+#define UPLSTR0 REGx(R0900_P1_UPLSTR0)
+#define F0900_P1_UPL_CURRENT0 0xf56300ff
 
 /*P1_DFLSTR1*/
-#define R0900_P1_DFLSTR1  0xf564
-#define F0900_P1_DFL_CURRENT1  0xf56400ff
+#define R0900_P1_DFLSTR1 0xf564
+#define DFLSTR1 REGx(R0900_P1_DFLSTR1)
+#define F0900_P1_DFL_CURRENT1 0xf56400ff
 
 /*P1_DFLSTR0*/
-#define R0900_P1_DFLSTR0  0xf565
-#define F0900_P1_DFL_CURRENT0  0xf56500ff
+#define R0900_P1_DFLSTR0 0xf565
+#define DFLSTR0 REGx(R0900_P1_DFLSTR0)
+#define F0900_P1_DFL_CURRENT0 0xf56500ff
 
 /*P1_SYNCSTR*/
-#define R0900_P1_SYNCSTR  0xf566
-#define F0900_P1_SYNC_CURRENT  0xf56600ff
+#define R0900_P1_SYNCSTR 0xf566
+#define SYNCSTR REGx(R0900_P1_SYNCSTR)
+#define F0900_P1_SYNC_CURRENT 0xf56600ff
 
 /*P1_SYNCDSTR1*/
-#define R0900_P1_SYNCDSTR1  0xf567
-#define F0900_P1_SYNCD_CURRENT1  0xf56700ff
+#define R0900_P1_SYNCDSTR1 0xf567
+#define SYNCDSTR1 REGx(R0900_P1_SYNCDSTR1)
+#define F0900_P1_SYNCD_CURRENT1 0xf56700ff
 
 /*P1_SYNCDSTR0*/
-#define R0900_P1_SYNCDSTR0  0xf568
-#define F0900_P1_SYNCD_CURRENT0  0xf56800ff
+#define R0900_P1_SYNCDSTR0 0xf568
+#define SYNCDSTR0 REGx(R0900_P1_SYNCDSTR0)
+#define F0900_P1_SYNCD_CURRENT0 0xf56800ff
 
 /*P1_PDELSTATUS1*/
-#define R0900_P1_PDELSTATUS1  0xf569
-#define F0900_P1_PKTDELIN_DELOCK  0xf5690080
-#define F0900_P1_SYNCDUPDFL_BADDFL  0xf5690040
-#define F0900_P1_CONTINUOUS_STREAM  0xf5690020
-#define F0900_P1_UNACCEPTED_STREAM  0xf5690010
-#define F0900_P1_BCH_ERROR_FLAG  0xf5690008
-#define F0900_P1_BBHCRCKO  0xf5690004
-#define F0900_P1_PKTDELIN_LOCK  0xf5690002
-#define F0900_P1_FIRST_LOCK  0xf5690001
+#define R0900_P1_PDELSTATUS1 0xf569
+#define F0900_P1_PKTDELIN_DELOCK 0xf5690080
+#define F0900_P1_SYNCDUPDFL_BADDFL 0xf5690040
+#define F0900_P1_CONTINUOUS_STREAM 0xf5690020
+#define F0900_P1_UNACCEPTED_STREAM 0xf5690010
+#define F0900_P1_BCH_ERROR_FLAG 0xf5690008
+#define F0900_P1_PKTDELIN_LOCK 0xf5690002
+#define PKTDELIN_LOCK FLDx(F0900_P1_PKTDELIN_LOCK)
+#define F0900_P1_FIRST_LOCK 0xf5690001
 
 /*P1_PDELSTATUS2*/
-#define R0900_P1_PDELSTATUS2  0xf56a
-#define F0900_P1_PKTDEL_DEMODSEL  0xf56a0080
-#define F0900_P1_FRAME_MODCOD  0xf56a007c
-#define F0900_P1_FRAME_TYPE  0xf56a0003
+#define R0900_P1_PDELSTATUS2 0xf56a
+#define F0900_P1_FRAME_MODCOD 0xf56a007c
+#define F0900_P1_FRAME_TYPE 0xf56a0003
 
 /*P1_BBFCRCKO1*/
-#define R0900_P1_BBFCRCKO1  0xf56b
-#define F0900_P1_BBHCRC_KOCNT1  0xf56b00ff
+#define R0900_P1_BBFCRCKO1 0xf56b
+#define BBFCRCKO1 REGx(R0900_P1_BBFCRCKO1)
+#define F0900_P1_BBHCRC_KOCNT1 0xf56b00ff
 
 /*P1_BBFCRCKO0*/
-#define R0900_P1_BBFCRCKO0  0xf56c
-#define F0900_P1_BBHCRC_KOCNT0  0xf56c00ff
+#define R0900_P1_BBFCRCKO0 0xf56c
+#define BBFCRCKO0 REGx(R0900_P1_BBFCRCKO0)
+#define F0900_P1_BBHCRC_KOCNT0 0xf56c00ff
 
 /*P1_UPCRCKO1*/
-#define R0900_P1_UPCRCKO1  0xf56d
-#define F0900_P1_PKTCRC_KOCNT1  0xf56d00ff
+#define R0900_P1_UPCRCKO1 0xf56d
+#define UPCRCKO1 REGx(R0900_P1_UPCRCKO1)
+#define F0900_P1_PKTCRC_KOCNT1 0xf56d00ff
 
 /*P1_UPCRCKO0*/
-#define R0900_P1_UPCRCKO0  0xf56e
-#define F0900_P1_PKTCRC_KOCNT0  0xf56e00ff
+#define R0900_P1_UPCRCKO0 0xf56e
+#define UPCRCKO0 REGx(R0900_P1_UPCRCKO0)
+#define F0900_P1_PKTCRC_KOCNT0 0xf56e00ff
+
+/*P1_PDELCTRL3*/
+#define R0900_P1_PDELCTRL3 0xf56f
+#define PDELCTRL3 REGx(R0900_P1_PDELCTRL3)
+#define F0900_P1_PKTDEL_CONTFAIL 0xf56f0080
+#define F0900_P1_NOFIFO_BCHERR 0xf56f0020
 
 /*P1_TSSTATEM*/
-#define R0900_P1_TSSTATEM  0xf570
-#define F0900_P1_TSDIL_ON  0xf5700080
-#define F0900_P1_TSSKIPRS_ON  0xf5700040
-#define F0900_P1_TSRS_ON  0xf5700020
-#define F0900_P1_TSDESCRAMB_ON  0xf5700010
-#define F0900_P1_TSFRAME_MODE  0xf5700008
-#define F0900_P1_TS_DISABLE  0xf5700004
-#define F0900_P1_TSACM_MODE  0xf5700002
-#define F0900_P1_TSOUT_NOSYNC  0xf5700001
+#define R0900_P1_TSSTATEM 0xf570
+#define TSSTATEM REGx(R0900_P1_TSSTATEM)
+#define F0900_P1_TSDIL_ON 0xf5700080
+#define F0900_P1_TSRS_ON 0xf5700020
+#define F0900_P1_TSDESCRAMB_ON 0xf5700010
+#define F0900_P1_TSFRAME_MODE 0xf5700008
+#define F0900_P1_TS_DISABLE 0xf5700004
+#define F0900_P1_TSOUT_NOSYNC 0xf5700001
 
 /*P1_TSCFGH*/
-#define R0900_P1_TSCFGH  0xf572
-#define F0900_P1_TSFIFO_DVBCI  0xf5720080
-#define F0900_P1_TSFIFO_SERIAL  0xf5720040
-#define F0900_P1_TSFIFO_TEIUPDATE  0xf5720020
-#define F0900_P1_TSFIFO_DUTY50  0xf5720010
-#define F0900_P1_TSFIFO_HSGNLOUT  0xf5720008
-#define F0900_P1_TSFIFO_ERRMODE  0xf5720006
-#define F0900_P1_RST_HWARE  0xf5720001
+#define R0900_P1_TSCFGH 0xf572
+#define TSCFGH REGx(R0900_P1_TSCFGH)
+#define F0900_P1_TSFIFO_DVBCI 0xf5720080
+#define F0900_P1_TSFIFO_SERIAL 0xf5720040
+#define F0900_P1_TSFIFO_TEIUPDATE 0xf5720020
+#define F0900_P1_TSFIFO_DUTY50 0xf5720010
+#define F0900_P1_TSFIFO_HSGNLOUT 0xf5720008
+#define F0900_P1_TSFIFO_ERRMODE 0xf5720006
+#define F0900_P1_RST_HWARE 0xf5720001
+#define RST_HWARE FLDx(F0900_P1_RST_HWARE)
 
 /*P1_TSCFGM*/
-#define R0900_P1_TSCFGM  0xf573
-#define F0900_P1_TSFIFO_MANSPEED  0xf57300c0
-#define F0900_P1_TSFIFO_PERMDATA  0xf5730020
-#define F0900_P1_TSFIFO_NONEWSGNL  0xf5730010
-#define F0900_P1_TSFIFO_BITSPEED  0xf5730008
-#define F0900_P1_NPD_SPECDVBS2  0xf5730004
-#define F0900_P1_TSFIFO_STOPCKDIS  0xf5730002
-#define F0900_P1_TSFIFO_INVDATA  0xf5730001
+#define R0900_P1_TSCFGM 0xf573
+#define TSCFGM REGx(R0900_P1_TSCFGM)
+#define F0900_P1_TSFIFO_MANSPEED 0xf57300c0
+#define F0900_P1_TSFIFO_PERMDATA 0xf5730020
+#define F0900_P1_TSFIFO_DPUNACT 0xf5730002
+#define F0900_P1_TSFIFO_INVDATA 0xf5730001
 
 /*P1_TSCFGL*/
-#define R0900_P1_TSCFGL  0xf574
-#define F0900_P1_TSFIFO_BCLKDEL1CK  0xf57400c0
-#define F0900_P1_BCHERROR_MODE  0xf5740030
-#define F0900_P1_TSFIFO_NSGNL2DATA  0xf5740008
-#define F0900_P1_TSFIFO_EMBINDVB  0xf5740004
-#define F0900_P1_TSFIFO_DPUNACT  0xf5740002
-#define F0900_P1_TSFIFO_NPDOFF  0xf5740001
+#define R0900_P1_TSCFGL 0xf574
+#define TSCFGL REGx(R0900_P1_TSCFGL)
+#define F0900_P1_TSFIFO_BCLKDEL1CK 0xf57400c0
+#define F0900_P1_BCHERROR_MODE 0xf5740030
+#define F0900_P1_TSFIFO_NSGNL2DATA 0xf5740008
+#define F0900_P1_TSFIFO_EMBINDVB 0xf5740004
+#define F0900_P1_TSFIFO_BITSPEED 0xf5740003
 
 /*P1_TSINSDELH*/
-#define R0900_P1_TSINSDELH  0xf576
-#define F0900_P1_TSDEL_SYNCBYTE  0xf5760080
-#define F0900_P1_TSDEL_XXHEADER  0xf5760040
-#define F0900_P1_TSDEL_BBHEADER  0xf5760020
-#define F0900_P1_TSDEL_DATAFIELD  0xf5760010
-#define F0900_P1_TSINSDEL_ISCR  0xf5760008
-#define F0900_P1_TSINSDEL_NPD  0xf5760004
-#define F0900_P1_TSINSDEL_RSPARITY  0xf5760002
-#define F0900_P1_TSINSDEL_CRC8  0xf5760001
+#define R0900_P1_TSINSDELH 0xf576
+#define TSINSDELH REGx(R0900_P1_TSINSDELH)
+#define F0900_P1_TSDEL_SYNCBYTE 0xf5760080
+#define F0900_P1_TSDEL_XXHEADER 0xf5760040
+#define F0900_P1_TSDEL_BBHEADER 0xf5760020
+#define F0900_P1_TSDEL_DATAFIELD 0xf5760010
+#define F0900_P1_TSINSDEL_ISCR 0xf5760008
+#define F0900_P1_TSINSDEL_NPD 0xf5760004
+#define F0900_P1_TSINSDEL_RSPARITY 0xf5760002
+#define F0900_P1_TSINSDEL_CRC8 0xf5760001
+
+/*P1_TSDIVN*/
+#define R0900_P1_TSDIVN 0xf579
+#define TSDIVN REGx(R0900_P1_TSDIVN)
+#define F0900_P1_TSFIFO_SPEEDMODE 0xf57900c0
+
+/*P1_TSCFG4*/
+#define R0900_P1_TSCFG4 0xf57a
+#define TSCFG4 REGx(R0900_P1_TSCFG4)
+#define F0900_P1_TSFIFO_TSSPEEDMODE 0xf57a00c0
 
 /*P1_TSSPEED*/
-#define R0900_P1_TSSPEED  0xf580
-#define F0900_P1_TSFIFO_OUTSPEED  0xf58000ff
+#define R0900_P1_TSSPEED 0xf580
+#define TSSPEED REGx(R0900_P1_TSSPEED)
+#define F0900_P1_TSFIFO_OUTSPEED 0xf58000ff
 
 /*P1_TSSTATUS*/
-#define R0900_P1_TSSTATUS  0xf581
-#define F0900_P1_TSFIFO_LINEOK  0xf5810080
-#define F0900_P1_TSFIFO_ERROR  0xf5810040
-#define F0900_P1_TSFIFO_DATA7  0xf5810020
-#define F0900_P1_TSFIFO_NOSYNC  0xf5810010
-#define F0900_P1_ISCR_INITIALIZED  0xf5810008
-#define F0900_P1_ISCR_UPDATED  0xf5810004
-#define F0900_P1_SOFFIFO_UNREGUL  0xf5810002
-#define F0900_P1_DIL_READY  0xf5810001
+#define R0900_P1_TSSTATUS 0xf581
+#define TSSTATUS REGx(R0900_P1_TSSTATUS)
+#define F0900_P1_TSFIFO_LINEOK 0xf5810080
+#define TSFIFO_LINEOK FLDx(F0900_P1_TSFIFO_LINEOK)
+#define F0900_P1_TSFIFO_ERROR 0xf5810040
+#define F0900_P1_DIL_READY 0xf5810001
 
 /*P1_TSSTATUS2*/
-#define R0900_P1_TSSTATUS2  0xf582
-#define F0900_P1_TSFIFO_DEMODSEL  0xf5820080
-#define F0900_P1_TSFIFOSPEED_STORE  0xf5820040
-#define F0900_P1_DILXX_RESET  0xf5820020
-#define F0900_P1_TSSERIAL_IMPOS  0xf5820010
-#define F0900_P1_TSFIFO_LINENOK  0xf5820008
-#define F0900_P1_BITSPEED_EVENT  0xf5820004
-#define F0900_P1_SCRAMBDETECT  0xf5820002
-#define F0900_P1_ULDTV67_FALSELOCK  0xf5820001
+#define R0900_P1_TSSTATUS2 0xf582
+#define TSSTATUS2 REGx(R0900_P1_TSSTATUS2)
+#define F0900_P1_TSFIFO_DEMODSEL 0xf5820080
+#define F0900_P1_TSFIFOSPEED_STORE 0xf5820040
+#define F0900_P1_DILXX_RESET 0xf5820020
+#define F0900_P1_TSSERIAL_IMPOS 0xf5820010
+#define F0900_P1_SCRAMBDETECT 0xf5820002
 
 /*P1_TSBITRATE1*/
-#define R0900_P1_TSBITRATE1  0xf583
-#define F0900_P1_TSFIFO_BITRATE1  0xf58300ff
+#define R0900_P1_TSBITRATE1 0xf583
+#define TSBITRATE1 REGx(R0900_P1_TSBITRATE1)
+#define F0900_P1_TSFIFO_BITRATE1 0xf58300ff
 
 /*P1_TSBITRATE0*/
-#define R0900_P1_TSBITRATE0  0xf584
-#define F0900_P1_TSFIFO_BITRATE0  0xf58400ff
+#define R0900_P1_TSBITRATE0 0xf584
+#define TSBITRATE0 REGx(R0900_P1_TSBITRATE0)
+#define F0900_P1_TSFIFO_BITRATE0 0xf58400ff
 
 /*P1_ERRCTRL1*/
-#define R0900_P1_ERRCTRL1  0xf598
-#define F0900_P1_ERR_SOURCE1  0xf59800f0
-#define F0900_P1_NUM_EVENT1  0xf5980007
+#define R0900_P1_ERRCTRL1 0xf598
+#define ERRCTRL1 REGx(R0900_P1_ERRCTRL1)
+#define F0900_P1_ERR_SOURCE1 0xf59800f0
+#define F0900_P1_NUM_EVENT1 0xf5980007
 
 /*P1_ERRCNT12*/
-#define R0900_P1_ERRCNT12  0xf599
-#define F0900_P1_ERRCNT1_OLDVALUE  0xf5990080
-#define F0900_P1_ERR_CNT12  0xf599007f
+#define R0900_P1_ERRCNT12 0xf599
+#define ERRCNT12 REGx(R0900_P1_ERRCNT12)
+#define F0900_P1_ERRCNT1_OLDVALUE 0xf5990080
+#define F0900_P1_ERR_CNT12 0xf599007f
+#define ERR_CNT12 FLDx(F0900_P1_ERR_CNT12)
 
 /*P1_ERRCNT11*/
-#define R0900_P1_ERRCNT11  0xf59a
-#define F0900_P1_ERR_CNT11  0xf59a00ff
+#define R0900_P1_ERRCNT11 0xf59a
+#define ERRCNT11 REGx(R0900_P1_ERRCNT11)
+#define F0900_P1_ERR_CNT11 0xf59a00ff
+#define ERR_CNT11 FLDx(F0900_P1_ERR_CNT11)
 
 /*P1_ERRCNT10*/
-#define R0900_P1_ERRCNT10  0xf59b
-#define F0900_P1_ERR_CNT10  0xf59b00ff
+#define R0900_P1_ERRCNT10 0xf59b
+#define ERRCNT10 REGx(R0900_P1_ERRCNT10)
+#define F0900_P1_ERR_CNT10 0xf59b00ff
+#define ERR_CNT10 FLDx(F0900_P1_ERR_CNT10)
 
 /*P1_ERRCTRL2*/
-#define R0900_P1_ERRCTRL2  0xf59c
-#define F0900_P1_ERR_SOURCE2  0xf59c00f0
-#define F0900_P1_NUM_EVENT2  0xf59c0007
+#define R0900_P1_ERRCTRL2 0xf59c
+#define ERRCTRL2 REGx(R0900_P1_ERRCTRL2)
+#define F0900_P1_ERR_SOURCE2 0xf59c00f0
+#define F0900_P1_NUM_EVENT2 0xf59c0007
 
 /*P1_ERRCNT22*/
-#define R0900_P1_ERRCNT22  0xf59d
-#define F0900_P1_ERRCNT2_OLDVALUE  0xf59d0080
-#define F0900_P1_ERR_CNT22  0xf59d007f
+#define R0900_P1_ERRCNT22 0xf59d
+#define ERRCNT22 REGx(R0900_P1_ERRCNT22)
+#define F0900_P1_ERRCNT2_OLDVALUE 0xf59d0080
+#define F0900_P1_ERR_CNT22 0xf59d007f
+#define ERR_CNT22 FLDx(F0900_P1_ERR_CNT22)
 
 /*P1_ERRCNT21*/
-#define R0900_P1_ERRCNT21  0xf59e
-#define F0900_P1_ERR_CNT21  0xf59e00ff
+#define R0900_P1_ERRCNT21 0xf59e
+#define ERRCNT21 REGx(R0900_P1_ERRCNT21)
+#define F0900_P1_ERR_CNT21 0xf59e00ff
+#define ERR_CNT21 FLDx(F0900_P1_ERR_CNT21)
 
 /*P1_ERRCNT20*/
-#define R0900_P1_ERRCNT20  0xf59f
-#define F0900_P1_ERR_CNT20  0xf59f00ff
+#define R0900_P1_ERRCNT20 0xf59f
+#define ERRCNT20 REGx(R0900_P1_ERRCNT20)
+#define F0900_P1_ERR_CNT20 0xf59f00ff
+#define ERR_CNT20 FLDx(F0900_P1_ERR_CNT20)
 
 /*P1_FECSPY*/
-#define R0900_P1_FECSPY  0xf5a0
-#define F0900_P1_SPY_ENABLE  0xf5a00080
-#define F0900_P1_NO_SYNCBYTE  0xf5a00040
-#define F0900_P1_SERIAL_MODE  0xf5a00020
-#define F0900_P1_UNUSUAL_PACKET  0xf5a00010
-#define F0900_P1_BER_PACKMODE  0xf5a00008
-#define F0900_P1_BERMETER_LMODE  0xf5a00002
-#define F0900_P1_BERMETER_RESET  0xf5a00001
+#define R0900_P1_FECSPY 0xf5a0
+#define FECSPY REGx(R0900_P1_FECSPY)
+#define F0900_P1_SPY_ENABLE 0xf5a00080
+#define F0900_P1_NO_SYNCBYTE 0xf5a00040
+#define F0900_P1_SERIAL_MODE 0xf5a00020
+#define F0900_P1_UNUSUAL_PACKET 0xf5a00010
+#define F0900_P1_BERMETER_DATAMODE 0xf5a00008
+#define F0900_P1_BERMETER_LMODE 0xf5a00002
+#define F0900_P1_BERMETER_RESET 0xf5a00001
 
 /*P1_FSPYCFG*/
-#define R0900_P1_FSPYCFG  0xf5a1
-#define F0900_P1_FECSPY_INPUT  0xf5a100c0
-#define F0900_P1_RST_ON_ERROR  0xf5a10020
-#define F0900_P1_ONE_SHOT  0xf5a10010
-#define F0900_P1_I2C_MODE  0xf5a1000c
-#define F0900_P1_SPY_HYSTERESIS  0xf5a10003
+#define R0900_P1_FSPYCFG 0xf5a1
+#define FSPYCFG REGx(R0900_P1_FSPYCFG)
+#define F0900_P1_FECSPY_INPUT 0xf5a100c0
+#define F0900_P1_RST_ON_ERROR 0xf5a10020
+#define F0900_P1_ONE_SHOT 0xf5a10010
+#define F0900_P1_I2C_MODE 0xf5a1000c
+#define F0900_P1_SPY_HYSTERESIS 0xf5a10003
 
 /*P1_FSPYDATA*/
-#define R0900_P1_FSPYDATA  0xf5a2
-#define F0900_P1_SPY_STUFFING  0xf5a20080
-#define F0900_P1_NOERROR_PKTJITTER  0xf5a20040
-#define F0900_P1_SPY_CNULLPKT  0xf5a20020
-#define F0900_P1_SPY_OUTDATA_MODE  0xf5a2001f
+#define R0900_P1_FSPYDATA 0xf5a2
+#define FSPYDATA REGx(R0900_P1_FSPYDATA)
+#define F0900_P1_SPY_STUFFING 0xf5a20080
+#define F0900_P1_SPY_CNULLPKT 0xf5a20020
+#define F0900_P1_SPY_OUTDATA_MODE 0xf5a2001f
 
 /*P1_FSPYOUT*/
-#define R0900_P1_FSPYOUT  0xf5a3
-#define F0900_P1_FSPY_DIRECT  0xf5a30080
-#define F0900_P1_SPY_OUTDATA_BUS  0xf5a30038
-#define F0900_P1_STUFF_MODE  0xf5a30007
+#define R0900_P1_FSPYOUT 0xf5a3
+#define FSPYOUT REGx(R0900_P1_FSPYOUT)
+#define F0900_P1_FSPY_DIRECT 0xf5a30080
+#define F0900_P1_STUFF_MODE 0xf5a30007
 
 /*P1_FSTATUS*/
-#define R0900_P1_FSTATUS  0xf5a4
-#define F0900_P1_SPY_ENDSIM  0xf5a40080
-#define F0900_P1_VALID_SIM  0xf5a40040
-#define F0900_P1_FOUND_SIGNAL  0xf5a40020
-#define F0900_P1_DSS_SYNCBYTE  0xf5a40010
-#define F0900_P1_RESULT_STATE  0xf5a4000f
+#define R0900_P1_FSTATUS 0xf5a4
+#define FSTATUS REGx(R0900_P1_FSTATUS)
+#define F0900_P1_SPY_ENDSIM 0xf5a40080
+#define F0900_P1_VALID_SIM 0xf5a40040
+#define F0900_P1_FOUND_SIGNAL 0xf5a40020
+#define F0900_P1_DSS_SYNCBYTE 0xf5a40010
+#define F0900_P1_RESULT_STATE 0xf5a4000f
 
 /*P1_FBERCPT4*/
-#define R0900_P1_FBERCPT4  0xf5a8
-#define F0900_P1_FBERMETER_CPT4  0xf5a800ff
+#define R0900_P1_FBERCPT4 0xf5a8
+#define FBERCPT4 REGx(R0900_P1_FBERCPT4)
+#define F0900_P1_FBERMETER_CPT4 0xf5a800ff
 
 /*P1_FBERCPT3*/
-#define R0900_P1_FBERCPT3  0xf5a9
-#define F0900_P1_FBERMETER_CPT3  0xf5a900ff
+#define R0900_P1_FBERCPT3 0xf5a9
+#define FBERCPT3 REGx(R0900_P1_FBERCPT3)
+#define F0900_P1_FBERMETER_CPT3 0xf5a900ff
 
 /*P1_FBERCPT2*/
-#define R0900_P1_FBERCPT2  0xf5aa
-#define F0900_P1_FBERMETER_CPT2  0xf5aa00ff
+#define R0900_P1_FBERCPT2 0xf5aa
+#define FBERCPT2 REGx(R0900_P1_FBERCPT2)
+#define F0900_P1_FBERMETER_CPT2 0xf5aa00ff
 
 /*P1_FBERCPT1*/
-#define R0900_P1_FBERCPT1  0xf5ab
-#define F0900_P1_FBERMETER_CPT1  0xf5ab00ff
+#define R0900_P1_FBERCPT1 0xf5ab
+#define FBERCPT1 REGx(R0900_P1_FBERCPT1)
+#define F0900_P1_FBERMETER_CPT1 0xf5ab00ff
 
 /*P1_FBERCPT0*/
-#define R0900_P1_FBERCPT0  0xf5ac
-#define F0900_P1_FBERMETER_CPT0  0xf5ac00ff
+#define R0900_P1_FBERCPT0 0xf5ac
+#define FBERCPT0 REGx(R0900_P1_FBERCPT0)
+#define F0900_P1_FBERMETER_CPT0 0xf5ac00ff
 
 /*P1_FBERERR2*/
-#define R0900_P1_FBERERR2  0xf5ad
-#define F0900_P1_FBERMETER_ERR2  0xf5ad00ff
+#define R0900_P1_FBERERR2 0xf5ad
+#define FBERERR2 REGx(R0900_P1_FBERERR2)
+#define F0900_P1_FBERMETER_ERR2 0xf5ad00ff
 
 /*P1_FBERERR1*/
-#define R0900_P1_FBERERR1  0xf5ae
-#define F0900_P1_FBERMETER_ERR1  0xf5ae00ff
+#define R0900_P1_FBERERR1 0xf5ae
+#define FBERERR1 REGx(R0900_P1_FBERERR1)
+#define F0900_P1_FBERMETER_ERR1 0xf5ae00ff
 
 /*P1_FBERERR0*/
-#define R0900_P1_FBERERR0  0xf5af
-#define F0900_P1_FBERMETER_ERR0  0xf5af00ff
+#define R0900_P1_FBERERR0 0xf5af
+#define FBERERR0 REGx(R0900_P1_FBERERR0)
+#define F0900_P1_FBERMETER_ERR0 0xf5af00ff
 
 /*P1_FSPYBER*/
-#define R0900_P1_FSPYBER  0xf5b2
-#define F0900_P1_FSPYOBS_XORREAD  0xf5b20040
-#define F0900_P1_FSPYBER_OBSMODE  0xf5b20020
-#define F0900_P1_FSPYBER_SYNCBYTE  0xf5b20010
-#define F0900_P1_FSPYBER_UNSYNC  0xf5b20008
-#define F0900_P1_FSPYBER_CTIME  0xf5b20007
-
-/*RCCFGH*/
-#define R0900_RCCFGH  0xf600
-#define F0900_TSRCFIFO_DVBCI  0xf6000080
-#define F0900_TSRCFIFO_SERIAL  0xf6000040
-#define F0900_TSRCFIFO_DISABLE  0xf6000020
-#define F0900_TSFIFO_2TORC  0xf6000010
-#define F0900_TSRCFIFO_HSGNLOUT  0xf6000008
-#define F0900_TSRCFIFO_ERRMODE  0xf6000006
+#define R0900_P1_FSPYBER 0xf5b2
+#define FSPYBER REGx(R0900_P1_FSPYBER)
+#define F0900_P1_FSPYBER_SYNCBYTE 0xf5b20010
+#define F0900_P1_FSPYBER_UNSYNC 0xf5b20008
+#define F0900_P1_FSPYBER_CTIME 0xf5b20007
+
+/*RCCFG2*/
+#define R0900_RCCFG2 0xf600
 
 /*TSGENERAL*/
-#define R0900_TSGENERAL  0xf630
-#define F0900_TSFIFO_BCLK1ALL  0xf6300020
-#define F0900_MUXSTREAM_OUTMODE  0xf6300008
-#define F0900_TSFIFO_PERMPARAL  0xf6300006
-#define F0900_RST_REEDSOLO  0xf6300001
+#define R0900_TSGENERAL 0xf630
+#define F0900_TSFIFO_DISTS2PAR 0xf6300040
+#define F0900_MUXSTREAM_OUTMODE 0xf6300008
+#define F0900_TSFIFO_PERMPARAL 0xf6300006
 
 /*TSGENERAL1X*/
-#define R0900_TSGENERAL1X  0xf670
-#define F0900_TSFIFO1X_BCLK1ALL  0xf6700020
-#define F0900_MUXSTREAM1X_OUTMODE  0xf6700008
-#define F0900_TSFIFO1X_PERMPARAL  0xf6700006
-#define F0900_RST1X_REEDSOLO  0xf6700001
+#define R0900_TSGENERAL1X 0xf670
 
 /*NBITER_NF4*/
-#define R0900_NBITER_NF4  0xfa03
-#define F0900_NBITER_NF_QP_1_2  0xfa0300ff
+#define R0900_NBITER_NF4 0xfa03
+#define F0900_NBITER_NF_QP_1_2 0xfa0300ff
 
 /*NBITER_NF5*/
-#define R0900_NBITER_NF5  0xfa04
-#define F0900_NBITER_NF_QP_3_5  0xfa0400ff
+#define R0900_NBITER_NF5 0xfa04
+#define F0900_NBITER_NF_QP_3_5 0xfa0400ff
 
 /*NBITER_NF6*/
-#define R0900_NBITER_NF6  0xfa05
-#define F0900_NBITER_NF_QP_2_3  0xfa0500ff
+#define R0900_NBITER_NF6 0xfa05
+#define F0900_NBITER_NF_QP_2_3 0xfa0500ff
 
 /*NBITER_NF7*/
-#define R0900_NBITER_NF7  0xfa06
-#define F0900_NBITER_NF_QP_3_4  0xfa0600ff
+#define R0900_NBITER_NF7 0xfa06
+#define F0900_NBITER_NF_QP_3_4 0xfa0600ff
 
 /*NBITER_NF8*/
-#define R0900_NBITER_NF8  0xfa07
-#define F0900_NBITER_NF_QP_4_5  0xfa0700ff
+#define R0900_NBITER_NF8 0xfa07
+#define F0900_NBITER_NF_QP_4_5 0xfa0700ff
 
 /*NBITER_NF9*/
-#define R0900_NBITER_NF9  0xfa08
-#define F0900_NBITER_NF_QP_5_6  0xfa0800ff
+#define R0900_NBITER_NF9 0xfa08
+#define F0900_NBITER_NF_QP_5_6 0xfa0800ff
 
 /*NBITER_NF10*/
-#define R0900_NBITER_NF10  0xfa09
-#define F0900_NBITER_NF_QP_8_9  0xfa0900ff
+#define R0900_NBITER_NF10 0xfa09
+#define F0900_NBITER_NF_QP_8_9 0xfa0900ff
 
 /*NBITER_NF11*/
-#define R0900_NBITER_NF11  0xfa0a
-#define F0900_NBITER_NF_QP_9_10  0xfa0a00ff
+#define R0900_NBITER_NF11 0xfa0a
+#define F0900_NBITER_NF_QP_9_10 0xfa0a00ff
 
 /*NBITER_NF12*/
-#define R0900_NBITER_NF12  0xfa0b
-#define F0900_NBITER_NF_8P_3_5  0xfa0b00ff
+#define R0900_NBITER_NF12 0xfa0b
+#define F0900_NBITER_NF_8P_3_5 0xfa0b00ff
 
 /*NBITER_NF13*/
-#define R0900_NBITER_NF13  0xfa0c
-#define F0900_NBITER_NF_8P_2_3  0xfa0c00ff
+#define R0900_NBITER_NF13 0xfa0c
+#define F0900_NBITER_NF_8P_2_3 0xfa0c00ff
 
 /*NBITER_NF14*/
-#define R0900_NBITER_NF14  0xfa0d
-#define F0900_NBITER_NF_8P_3_4  0xfa0d00ff
+#define R0900_NBITER_NF14 0xfa0d
+#define F0900_NBITER_NF_8P_3_4 0xfa0d00ff
 
 /*NBITER_NF15*/
-#define R0900_NBITER_NF15  0xfa0e
-#define F0900_NBITER_NF_8P_5_6  0xfa0e00ff
+#define R0900_NBITER_NF15 0xfa0e
+#define F0900_NBITER_NF_8P_5_6 0xfa0e00ff
 
 /*NBITER_NF16*/
-#define R0900_NBITER_NF16  0xfa0f
-#define F0900_NBITER_NF_8P_8_9  0xfa0f00ff
+#define R0900_NBITER_NF16 0xfa0f
+#define F0900_NBITER_NF_8P_8_9 0xfa0f00ff
 
 /*NBITER_NF17*/
-#define R0900_NBITER_NF17  0xfa10
-#define F0900_NBITER_NF_8P_9_10  0xfa1000ff
+#define R0900_NBITER_NF17 0xfa10
+#define F0900_NBITER_NF_8P_9_10 0xfa1000ff
 
 /*NBITERNOERR*/
-#define R0900_NBITERNOERR  0xfa3f
-#define F0900_NBITER_STOP_CRIT  0xfa3f000f
+#define R0900_NBITERNOERR 0xfa3f
+#define F0900_NBITER_STOP_CRIT 0xfa3f000f
 
 /*GAINLLR_NF4*/
-#define R0900_GAINLLR_NF4  0xfa43
-#define F0900_GAINLLR_NF_QP_1_2  0xfa43007f
+#define R0900_GAINLLR_NF4 0xfa43
+#define F0900_GAINLLR_NF_QP_1_2 0xfa43007f
 
 /*GAINLLR_NF5*/
-#define R0900_GAINLLR_NF5  0xfa44
-#define F0900_GAINLLR_NF_QP_3_5  0xfa44007f
+#define R0900_GAINLLR_NF5 0xfa44
+#define F0900_GAINLLR_NF_QP_3_5 0xfa44007f
 
 /*GAINLLR_NF6*/
-#define R0900_GAINLLR_NF6  0xfa45
-#define F0900_GAINLLR_NF_QP_2_3  0xfa45007f
+#define R0900_GAINLLR_NF6 0xfa45
+#define F0900_GAINLLR_NF_QP_2_3 0xfa45007f
 
 /*GAINLLR_NF7*/
-#define R0900_GAINLLR_NF7  0xfa46
-#define F0900_GAINLLR_NF_QP_3_4  0xfa46007f
+#define R0900_GAINLLR_NF7 0xfa46
+#define F0900_GAINLLR_NF_QP_3_4 0xfa46007f
 
 /*GAINLLR_NF8*/
-#define R0900_GAINLLR_NF8  0xfa47
-#define F0900_GAINLLR_NF_QP_4_5  0xfa47007f
+#define R0900_GAINLLR_NF8 0xfa47
+#define F0900_GAINLLR_NF_QP_4_5 0xfa47007f
 
 /*GAINLLR_NF9*/
-#define R0900_GAINLLR_NF9  0xfa48
-#define F0900_GAINLLR_NF_QP_5_6  0xfa48007f
+#define R0900_GAINLLR_NF9 0xfa48
+#define F0900_GAINLLR_NF_QP_5_6 0xfa48007f
 
 /*GAINLLR_NF10*/
-#define R0900_GAINLLR_NF10  0xfa49
-#define F0900_GAINLLR_NF_QP_8_9  0xfa49007f
+#define R0900_GAINLLR_NF10 0xfa49
+#define F0900_GAINLLR_NF_QP_8_9 0xfa49007f
 
 /*GAINLLR_NF11*/
-#define R0900_GAINLLR_NF11  0xfa4a
-#define F0900_GAINLLR_NF_QP_9_10  0xfa4a007f
+#define R0900_GAINLLR_NF11 0xfa4a
+#define F0900_GAINLLR_NF_QP_9_10 0xfa4a007f
 
 /*GAINLLR_NF12*/
-#define R0900_GAINLLR_NF12  0xfa4b
-#define F0900_GAINLLR_NF_8P_3_5  0xfa4b007f
+#define R0900_GAINLLR_NF12 0xfa4b
+#define F0900_GAINLLR_NF_8P_3_5 0xfa4b007f
 
 /*GAINLLR_NF13*/
-#define R0900_GAINLLR_NF13  0xfa4c
-#define F0900_GAINLLR_NF_8P_2_3  0xfa4c007f
+#define R0900_GAINLLR_NF13 0xfa4c
+#define F0900_GAINLLR_NF_8P_2_3 0xfa4c007f
 
 /*GAINLLR_NF14*/
-#define R0900_GAINLLR_NF14  0xfa4d
-#define F0900_GAINLLR_NF_8P_3_4  0xfa4d007f
+#define R0900_GAINLLR_NF14 0xfa4d
+#define F0900_GAINLLR_NF_8P_3_4 0xfa4d007f
 
 /*GAINLLR_NF15*/
-#define R0900_GAINLLR_NF15  0xfa4e
-#define F0900_GAINLLR_NF_8P_5_6  0xfa4e007f
+#define R0900_GAINLLR_NF15 0xfa4e
+#define F0900_GAINLLR_NF_8P_5_6 0xfa4e007f
 
 /*GAINLLR_NF16*/
-#define R0900_GAINLLR_NF16  0xfa4f
-#define F0900_GAINLLR_NF_8P_8_9  0xfa4f007f
+#define R0900_GAINLLR_NF16 0xfa4f
+#define F0900_GAINLLR_NF_8P_8_9 0xfa4f007f
 
 /*GAINLLR_NF17*/
-#define R0900_GAINLLR_NF17  0xfa50
-#define F0900_GAINLLR_NF_8P_9_10  0xfa50007f
+#define R0900_GAINLLR_NF17 0xfa50
+#define F0900_GAINLLR_NF_8P_9_10 0xfa50007f
 
 /*CFGEXT*/
-#define R0900_CFGEXT  0xfa80
-#define F0900_STAGMODE  0xfa800080
-#define F0900_BYPBCH  0xfa800040
-#define F0900_BYPLDPC  0xfa800020
-#define F0900_LDPCMODE  0xfa800010
-#define F0900_INVLLRSIGN  0xfa800008
-#define F0900_SHORTMULT  0xfa800004
-#define F0900_EXTERNTX  0xfa800001
+#define R0900_CFGEXT 0xfa80
+#define F0900_STAGMODE 0xfa800080
+#define F0900_BYPBCH 0xfa800040
+#define F0900_BYPLDPC 0xfa800020
+#define F0900_LDPCMODE 0xfa800010
+#define F0900_INVLLRSIGN 0xfa800008
+#define F0900_SHORTMULT 0xfa800004
+#define F0900_EXTERNTX 0xfa800001
 
 /*GENCFG*/
-#define R0900_GENCFG  0xfa86
-#define F0900_BROADCAST  0xfa860010
-#define F0900_NOSHFRD2  0xfa860008
-#define F0900_BCHERRFLAG  0xfa860004
-#define F0900_PRIORITY  0xfa860002
-#define F0900_DDEMOD  0xfa860001
+#define R0900_GENCFG 0xfa86
+#define F0900_BROADCAST 0xfa860010
+#define F0900_PRIORITY 0xfa860002
+#define F0900_DDEMOD 0xfa860001
 
 /*LDPCERR1*/
-#define R0900_LDPCERR1  0xfa96
-#define F0900_LDPC_ERRORS_COUNTER1  0xfa9600ff
+#define R0900_LDPCERR1 0xfa96
+#define F0900_LDPC_ERRORS_COUNTER1 0xfa9600ff
 
 /*LDPCERR0*/
-#define R0900_LDPCERR0  0xfa97
-#define F0900_LDPC_ERRORS_COUNTER0  0xfa9700ff
+#define R0900_LDPCERR0 0xfa97
+#define F0900_LDPC_ERRORS_COUNTER0 0xfa9700ff
 
 /*BCHERR*/
-#define R0900_BCHERR  0xfa98
-#define F0900_ERRORFLAG  0xfa980010
-#define F0900_BCH_ERRORS_COUNTER  0xfa98000f
+#define R0900_BCHERR 0xfa98
+#define F0900_ERRORFLAG 0xfa980010
+#define F0900_BCH_ERRORS_COUNTER 0xfa98000f
 
 /*TSTRES0*/
-#define R0900_TSTRES0  0xff11
-#define F0900_FRESFEC  0xff110080
-#define F0900_FRESTS  0xff110040
-#define F0900_FRESVIT1  0xff110020
-#define F0900_FRESVIT2  0xff110010
-#define F0900_FRESSYM1  0xff110008
-#define F0900_FRESSYM2  0xff110004
-#define F0900_FRESMAS  0xff110002
-#define F0900_FRESINT  0xff110001
+#define R0900_TSTRES0 0xff11
+#define F0900_FRESFEC 0xff110080
+
+/*P2_TCTL4*/
+#define R0900_P2_TCTL4 0xff28
+#define F0900_P2_PN4_SELECT 0xff280020
+
+/*P1_TCTL4*/
+#define R0900_P1_TCTL4 0xff48
+#define TCTL4 shiftx(R0900_P1_TCTL4, demod, 0x20)
+#define F0900_P1_PN4_SELECT 0xff480020
 
 /*P2_TSTDISRX*/
-#define R0900_P2_TSTDISRX  0xff65
-#define F0900_P2_EN_DISRX  0xff650080
-#define F0900_P2_TST_CURRSRC  0xff650040
-#define F0900_P2_IN_DIGSIGNAL  0xff650020
-#define F0900_P2_HIZ_CURRENTSRC  0xff650010
-#define F0900_TST_P2_PIN_SELECT  0xff650008
-#define F0900_P2_TST_DISRX  0xff650007
+#define R0900_P2_TSTDISRX 0xff65
+#define F0900_P2_PIN_SELECT1 0xff650008
 
 /*P1_TSTDISRX*/
-#define R0900_P1_TSTDISRX  0xff67
-#define F0900_P1_EN_DISRX  0xff670080
-#define F0900_P1_TST_CURRSRC  0xff670040
-#define F0900_P1_IN_DIGSIGNAL  0xff670020
-#define F0900_P1_HIZ_CURRENTSRC  0xff670010
-#define F0900_TST_P1_PIN_SELECT  0xff670008
-#define F0900_P1_TST_DISRX  0xff670007
-
-#define STV0900_NBREGS		684
-#define STV0900_NBFIELDS		1702
+#define R0900_P1_TSTDISRX 0xff67
+#define TSTDISRX shiftx(R0900_P1_TSTDISRX, demod, 2)
+#define F0900_P1_PIN_SELECT1 0xff670008
+#define PIN_SELECT1 shiftx(F0900_P1_PIN_SELECT1, demod, 0x20000)
+
+#define STV0900_NBREGS 723
+#define STV0900_NBFIELDS 1420
 
 #endif
 
diff --git a/drivers/media/dvb/frontends/stv0900_sw.c b/drivers/media/dvb/frontends/stv0900_sw.c
index 962fde1437ce..b8da87fa637f 100644
--- a/drivers/media/dvb/frontends/stv0900_sw.c
+++ b/drivers/media/dvb/frontends/stv0900_sw.c
@@ -27,56 +27,45 @@
 #include "stv0900_reg.h"
 #include "stv0900_priv.h"
 
-int stv0900_check_signal_presence(struct stv0900_internal *i_params,
+s32 shiftx(s32 x, int demod, s32 shift)
+{
+	if (demod == 1)
+		return x - shift;
+
+	return x;
+}
+
+int stv0900_check_signal_presence(struct stv0900_internal *intp,
 					enum fe_stv0900_demod_num demod)
 {
-	s32 carr_offset,
-	agc2_integr,
-	max_carrier;
+	s32	carr_offset,
+		agc2_integr,
+		max_carrier;
 
-	int no_signal;
+	int no_signal = FALSE;
 
-	switch (demod) {
-	case STV0900_DEMOD_1:
-	default:
-		carr_offset = (stv0900_read_reg(i_params, R0900_P1_CFR2) << 8)
-						| stv0900_read_reg(i_params,
-						R0900_P1_CFR1);
-		carr_offset = ge2comp(carr_offset, 16);
-		agc2_integr = (stv0900_read_reg(i_params, R0900_P1_AGC2I1) << 8)
-						| stv0900_read_reg(i_params,
-						R0900_P1_AGC2I0);
-		max_carrier = i_params->dmd1_srch_range / 1000;
-		break;
-	case STV0900_DEMOD_2:
-		carr_offset = (stv0900_read_reg(i_params, R0900_P2_CFR2) << 8)
-						| stv0900_read_reg(i_params,
-						R0900_P2_CFR1);
-		carr_offset = ge2comp(carr_offset, 16);
-		agc2_integr = (stv0900_read_reg(i_params, R0900_P2_AGC2I1) << 8)
-						| stv0900_read_reg(i_params,
-						R0900_P2_AGC2I0);
-		max_carrier = i_params->dmd2_srch_range / 1000;
-		break;
-	}
+	carr_offset = (stv0900_read_reg(intp, CFR2) << 8)
+					| stv0900_read_reg(intp, CFR1);
+	carr_offset = ge2comp(carr_offset, 16);
+	agc2_integr = (stv0900_read_reg(intp, AGC2I1) << 8)
+					| stv0900_read_reg(intp, AGC2I0);
+	max_carrier = intp->srch_range[demod] / 1000;
 
 	max_carrier += (max_carrier / 10);
 	max_carrier = 65536 * (max_carrier / 2);
-	max_carrier /= i_params->mclk / 1000;
+	max_carrier /= intp->mclk / 1000;
 	if (max_carrier > 0x4000)
 		max_carrier = 0x4000;
 
 	if ((agc2_integr > 0x2000)
-			|| (carr_offset > + 2*max_carrier)
-			|| (carr_offset < -2*max_carrier))
+			|| (carr_offset > (2 * max_carrier))
+			|| (carr_offset < (-2 * max_carrier)))
 		no_signal = TRUE;
-	else
-		no_signal = FALSE;
 
 	return no_signal;
 }
 
-static void stv0900_get_sw_loop_params(struct stv0900_internal *i_params,
+static void stv0900_get_sw_loop_params(struct stv0900_internal *intp,
 				s32 *frequency_inc, s32 *sw_timeout,
 				s32 *steps,
 				enum fe_stv0900_demod_num demod)
@@ -85,30 +74,19 @@ static void stv0900_get_sw_loop_params(struct stv0900_internal *i_params,
 
 	enum fe_stv0900_search_standard	standard;
 
-	switch (demod) {
-	case STV0900_DEMOD_1:
-	default:
-		srate = i_params->dmd1_symbol_rate;
-		max_carrier = i_params->dmd1_srch_range / 1000;
-		max_carrier += max_carrier / 10;
-		standard = i_params->dmd1_srch_standard;
-		break;
-	case STV0900_DEMOD_2:
-		srate = i_params->dmd2_symbol_rate;
-		max_carrier = i_params->dmd2_srch_range / 1000;
-		max_carrier += max_carrier / 10;
-		standard = i_params->dmd2_srch_stndrd;
-		break;
-	}
+	srate = intp->symbol_rate[demod];
+	max_carrier = intp->srch_range[demod] / 1000;
+	max_carrier += max_carrier / 10;
+	standard = intp->srch_standard[demod];
 
 	max_carrier = 65536 * (max_carrier / 2);
-	max_carrier /= i_params->mclk / 1000;
+	max_carrier /= intp->mclk / 1000;
 
 	if (max_carrier > 0x4000)
 		max_carrier = 0x4000;
 
 	freq_inc = srate;
-	freq_inc /= i_params->mclk >> 10;
+	freq_inc /= intp->mclk >> 10;
 	freq_inc = freq_inc << 6;
 
 	switch (standard) {
@@ -154,7 +132,7 @@ static void stv0900_get_sw_loop_params(struct stv0900_internal *i_params,
 
 }
 
-static int stv0900_search_carr_sw_loop(struct stv0900_internal *i_params,
+static int stv0900_search_carr_sw_loop(struct stv0900_internal *intp,
 				s32 FreqIncr, s32 Timeout, int zigzag,
 				s32 MaxStep, enum fe_stv0900_demod_num demod)
 {
@@ -164,20 +142,11 @@ static int stv0900_search_carr_sw_loop(struct stv0900_internal *i_params,
 		freqOffset,
 		max_carrier;
 
-	switch (demod) {
-	case STV0900_DEMOD_1:
-	default:
-		max_carrier = i_params->dmd1_srch_range / 1000;
-		max_carrier += (max_carrier / 10);
-		break;
-	case STV0900_DEMOD_2:
-		max_carrier = i_params->dmd2_srch_range / 1000;
-		max_carrier += (max_carrier / 10);
-		break;
-	}
+	max_carrier = intp->srch_range[demod] / 1000;
+	max_carrier += (max_carrier / 10);
 
 	max_carrier = 65536 * (max_carrier / 2);
-	max_carrier /= i_params->mclk / 1000;
+	max_carrier /= intp->mclk / 1000;
 
 	if (max_carrier > 0x4000)
 		max_carrier = 0x4000;
@@ -190,40 +159,15 @@ static int stv0900_search_carr_sw_loop(struct stv0900_internal *i_params,
 	stepCpt = 0;
 
 	do {
-		switch (demod) {
-		case STV0900_DEMOD_1:
-		default:
-			stv0900_write_reg(i_params, R0900_P1_DMDISTATE, 0x1C);
-			stv0900_write_reg(i_params, R0900_P1_CFRINIT1,
-					(freqOffset / 256) & 0xFF);
-			stv0900_write_reg(i_params, R0900_P1_CFRINIT0,
-					 freqOffset & 0xFF);
-			stv0900_write_reg(i_params, R0900_P1_DMDISTATE, 0x18);
-			stv0900_write_bits(i_params, F0900_P1_ALGOSWRST, 1);
-
-			if (i_params->chip_id == 0x12) {
-				stv0900_write_bits(i_params,
-						F0900_P1_RST_HWARE, 1);
-				stv0900_write_bits(i_params,
-						F0900_P1_RST_HWARE, 0);
-			}
-			break;
-		case STV0900_DEMOD_2:
-			stv0900_write_reg(i_params, R0900_P2_DMDISTATE, 0x1C);
-			stv0900_write_reg(i_params, R0900_P2_CFRINIT1,
-					(freqOffset / 256) & 0xFF);
-			stv0900_write_reg(i_params, R0900_P2_CFRINIT0,
-					freqOffset & 0xFF);
-			stv0900_write_reg(i_params, R0900_P2_DMDISTATE, 0x18);
-			stv0900_write_bits(i_params, F0900_P2_ALGOSWRST, 1);
-
-			if (i_params->chip_id == 0x12) {
-				stv0900_write_bits(i_params,
-						F0900_P2_RST_HWARE, 1);
-				stv0900_write_bits(i_params,
-						F0900_P2_RST_HWARE, 0);
-			}
-			break;
+		stv0900_write_reg(intp, DMDISTATE, 0x1c);
+		stv0900_write_reg(intp, CFRINIT1, (freqOffset / 256) & 0xff);
+		stv0900_write_reg(intp, CFRINIT0, freqOffset & 0xff);
+		stv0900_write_reg(intp, DMDISTATE, 0x18);
+		stv0900_write_bits(intp, ALGOSWRST, 1);
+
+		if (intp->chip_id == 0x12) {
+			stv0900_write_bits(intp, RST_HWARE, 1);
+			stv0900_write_bits(intp, RST_HWARE, 0);
 		}
 
 		if (zigzag == TRUE) {
@@ -235,8 +179,8 @@ static int stv0900_search_carr_sw_loop(struct stv0900_internal *i_params,
 			freqOffset += + 2 * FreqIncr;
 
 		stepCpt++;
-		lock = stv0900_get_demod_lock(i_params, demod, Timeout);
-		no_signal = stv0900_check_signal_presence(i_params, demod);
+		lock = stv0900_get_demod_lock(intp, demod, Timeout);
+		no_signal = stv0900_check_signal_presence(intp, demod);
 
 	} while ((lock == FALSE)
 			&& (no_signal == FALSE)
@@ -244,269 +188,138 @@ static int stv0900_search_carr_sw_loop(struct stv0900_internal *i_params,
 			&& ((freqOffset + FreqIncr) > -max_carrier)
 			&& (stepCpt < MaxStep));
 
-	switch (demod) {
-	case STV0900_DEMOD_1:
-	default:
-		stv0900_write_bits(i_params, F0900_P1_ALGOSWRST, 0);
-		break;
-	case STV0900_DEMOD_2:
-		stv0900_write_bits(i_params, F0900_P2_ALGOSWRST, 0);
-		break;
-	}
+	stv0900_write_bits(intp, ALGOSWRST, 0);
 
 	return lock;
 }
 
-int stv0900_sw_algo(struct stv0900_internal *i_params,
+int stv0900_sw_algo(struct stv0900_internal *intp,
 				enum fe_stv0900_demod_num demod)
 {
-	int lock = FALSE;
-
-	int no_signal,
-	zigzag;
-	s32 dvbs2_fly_wheel;
-
-	s32 freqIncrement, softStepTimeout, trialCounter, max_steps;
-
-	stv0900_get_sw_loop_params(i_params, &freqIncrement, &softStepTimeout,
+	int	lock = FALSE,
+		no_signal,
+		zigzag;
+	s32	s2fw,
+		fqc_inc,
+		sft_stp_tout,
+		trial_cntr,
+		max_steps;
+
+	stv0900_get_sw_loop_params(intp, &fqc_inc, &sft_stp_tout,
 					&max_steps, demod);
-	switch (demod) {
-	case STV0900_DEMOD_1:
-	default:
-		switch (i_params->dmd1_srch_standard) {
-		case STV0900_SEARCH_DVBS1:
-		case STV0900_SEARCH_DSS:
-			if (i_params->chip_id >= 0x20)
-				stv0900_write_reg(i_params, R0900_P1_CARFREQ,
-						0x3B);
-			else
-				stv0900_write_reg(i_params, R0900_P1_CARFREQ,
-						0xef);
-
-			stv0900_write_reg(i_params, R0900_P1_DMDCFGMD, 0x49);
-			zigzag = FALSE;
-			break;
-		case STV0900_SEARCH_DVBS2:
-			if (i_params->chip_id >= 0x20)
-				stv0900_write_reg(i_params, R0900_P1_CORRELABS,
-						0x79);
-			else
-				stv0900_write_reg(i_params, R0900_P1_CORRELABS,
-						0x68);
+	switch (intp->srch_standard[demod]) {
+	case STV0900_SEARCH_DVBS1:
+	case STV0900_SEARCH_DSS:
+		if (intp->chip_id >= 0x20)
+			stv0900_write_reg(intp, CARFREQ, 0x3b);
+		else
+			stv0900_write_reg(intp, CARFREQ, 0xef);
 
-			stv0900_write_reg(i_params, R0900_P1_DMDCFGMD,
-						0x89);
+		stv0900_write_reg(intp, DMDCFGMD, 0x49);
+		zigzag = FALSE;
+		break;
+	case STV0900_SEARCH_DVBS2:
+		if (intp->chip_id >= 0x20)
+			stv0900_write_reg(intp, CORRELABS, 0x79);
+		else
+			stv0900_write_reg(intp, CORRELABS, 0x68);
 
-			zigzag = TRUE;
-			break;
-		case STV0900_AUTO_SEARCH:
-		default:
-			if (i_params->chip_id >= 0x20) {
-				stv0900_write_reg(i_params, R0900_P1_CARFREQ,
-							0x3B);
-				stv0900_write_reg(i_params, R0900_P1_CORRELABS,
-							0x79);
-			} else {
-				stv0900_write_reg(i_params, R0900_P1_CARFREQ,
-							0xef);
-				stv0900_write_reg(i_params, R0900_P1_CORRELABS,
-							0x68);
-			}
+		stv0900_write_reg(intp, DMDCFGMD, 0x89);
 
-			stv0900_write_reg(i_params, R0900_P1_DMDCFGMD,
-							0xc9);
-			zigzag = FALSE;
-			break;
+		zigzag = TRUE;
+		break;
+	case STV0900_AUTO_SEARCH:
+	default:
+		if (intp->chip_id >= 0x20) {
+			stv0900_write_reg(intp, CARFREQ, 0x3b);
+			stv0900_write_reg(intp, CORRELABS, 0x79);
+		} else {
+			stv0900_write_reg(intp, CARFREQ, 0xef);
+			stv0900_write_reg(intp, CORRELABS, 0x68);
 		}
 
-		trialCounter = 0;
-		do {
-			lock = stv0900_search_carr_sw_loop(i_params,
-							freqIncrement,
-							softStepTimeout,
-							zigzag,
-							max_steps,
-							demod);
-			no_signal = stv0900_check_signal_presence(i_params,
-								demod);
-			trialCounter++;
-			if ((lock == TRUE)
-					|| (no_signal == TRUE)
-					|| (trialCounter == 2)) {
-
-				if (i_params->chip_id >= 0x20) {
-					stv0900_write_reg(i_params,
-							R0900_P1_CARFREQ,
-							0x49);
-					stv0900_write_reg(i_params,
-							R0900_P1_CORRELABS,
-							0x9e);
-				} else {
-					stv0900_write_reg(i_params,
-							R0900_P1_CARFREQ,
-							0xed);
-					stv0900_write_reg(i_params,
-							R0900_P1_CORRELABS,
-							0x88);
-				}
-
-				if ((lock == TRUE) && (stv0900_get_bits(i_params, F0900_P1_HEADER_MODE) == STV0900_DVBS2_FOUND)) {
-					msleep(softStepTimeout);
-					dvbs2_fly_wheel = stv0900_get_bits(i_params, F0900_P1_FLYWHEEL_CPT);
-
-					if (dvbs2_fly_wheel < 0xd) {
-						msleep(softStepTimeout);
-						dvbs2_fly_wheel = stv0900_get_bits(i_params, F0900_P1_FLYWHEEL_CPT);
-					}
-
-					if (dvbs2_fly_wheel < 0xd) {
-						lock = FALSE;
-
-						if (trialCounter < 2) {
-							if (i_params->chip_id >= 0x20)
-								stv0900_write_reg(i_params, R0900_P1_CORRELABS, 0x79);
-							else
-								stv0900_write_reg(i_params, R0900_P1_CORRELABS, 0x68);
-
-							stv0900_write_reg(i_params, R0900_P1_DMDCFGMD, 0x89);
-						}
-					}
-				}
-			}
-
-		} while ((lock == FALSE)
-			&& (trialCounter < 2)
-			&& (no_signal == FALSE));
-
+		stv0900_write_reg(intp, DMDCFGMD, 0xc9);
+		zigzag = FALSE;
 		break;
-	case STV0900_DEMOD_2:
-		switch (i_params->dmd2_srch_stndrd) {
-		case STV0900_SEARCH_DVBS1:
-		case STV0900_SEARCH_DSS:
-			if (i_params->chip_id >= 0x20)
-				stv0900_write_reg(i_params, R0900_P2_CARFREQ,
-						0x3b);
-			else
-				stv0900_write_reg(i_params, R0900_P2_CARFREQ,
-						0xef);
-
-			stv0900_write_reg(i_params, R0900_P2_DMDCFGMD,
-						0x49);
-			zigzag = FALSE;
-			break;
-		case STV0900_SEARCH_DVBS2:
-			if (i_params->chip_id >= 0x20)
-				stv0900_write_reg(i_params, R0900_P2_CORRELABS,
-						0x79);
-			else
-				stv0900_write_reg(i_params, R0900_P2_CORRELABS,
-						0x68);
+	}
 
-			stv0900_write_reg(i_params, R0900_P2_DMDCFGMD, 0x89);
-			zigzag = TRUE;
-			break;
-		case STV0900_AUTO_SEARCH:
-		default:
-			if (i_params->chip_id >= 0x20) {
-				stv0900_write_reg(i_params, R0900_P2_CARFREQ,
-						0x3b);
-				stv0900_write_reg(i_params, R0900_P2_CORRELABS,
-						0x79);
+	trial_cntr = 0;
+	do {
+		lock = stv0900_search_carr_sw_loop(intp,
+						fqc_inc,
+						sft_stp_tout,
+						zigzag,
+						max_steps,
+						demod);
+		no_signal = stv0900_check_signal_presence(intp, demod);
+		trial_cntr++;
+		if ((lock == TRUE)
+				|| (no_signal == TRUE)
+				|| (trial_cntr == 2)) {
+
+			if (intp->chip_id >= 0x20) {
+				stv0900_write_reg(intp, CARFREQ, 0x49);
+				stv0900_write_reg(intp, CORRELABS, 0x9e);
 			} else {
-				stv0900_write_reg(i_params, R0900_P2_CARFREQ,
-						0xef);
-				stv0900_write_reg(i_params, R0900_P2_CORRELABS,
-						0x68);
+				stv0900_write_reg(intp, CARFREQ, 0xed);
+				stv0900_write_reg(intp, CORRELABS, 0x88);
 			}
 
-			stv0900_write_reg(i_params, R0900_P2_DMDCFGMD, 0xc9);
-
-			zigzag = FALSE;
-			break;
-		}
+			if ((stv0900_get_bits(intp, HEADER_MODE) ==
+						STV0900_DVBS2_FOUND) &&
+							(lock == TRUE)) {
+				msleep(sft_stp_tout);
+				s2fw = stv0900_get_bits(intp, FLYWHEEL_CPT);
 
-		trialCounter = 0;
-
-		do {
-			lock = stv0900_search_carr_sw_loop(i_params,
-							freqIncrement,
-							softStepTimeout,
-							zigzag,
-							max_steps,
-							demod);
-			no_signal = stv0900_check_signal_presence(i_params,
-								demod);
-			trialCounter++;
-			if ((lock == TRUE)
-					|| (no_signal == TRUE)
-					|| (trialCounter == 2)) {
-				if (i_params->chip_id >= 0x20) {
-					stv0900_write_reg(i_params,
-							R0900_P2_CARFREQ,
-							0x49);
-					stv0900_write_reg(i_params,
-							R0900_P2_CORRELABS,
-							0x9e);
-				} else {
-					stv0900_write_reg(i_params,
-							R0900_P2_CARFREQ,
-							0xed);
-					stv0900_write_reg(i_params,
-							R0900_P2_CORRELABS,
-							0x88);
+				if (s2fw < 0xd) {
+					msleep(sft_stp_tout);
+					s2fw = stv0900_get_bits(intp,
+								FLYWHEEL_CPT);
 				}
 
-				if ((lock == TRUE) && (stv0900_get_bits(i_params, F0900_P2_HEADER_MODE) == STV0900_DVBS2_FOUND)) {
-					msleep(softStepTimeout);
-					dvbs2_fly_wheel = stv0900_get_bits(i_params, F0900_P2_FLYWHEEL_CPT);
-					if (dvbs2_fly_wheel < 0xd) {
-						msleep(softStepTimeout);
-						dvbs2_fly_wheel = stv0900_get_bits(i_params, F0900_P2_FLYWHEEL_CPT);
-					}
+				if (s2fw < 0xd) {
+					lock = FALSE;
 
-					if (dvbs2_fly_wheel < 0xd) {
-						lock = FALSE;
-						if (trialCounter < 2) {
-							if (i_params->chip_id >= 0x20)
-								stv0900_write_reg(i_params, R0900_P2_CORRELABS, 0x79);
-							else
-								stv0900_write_reg(i_params, R0900_P2_CORRELABS, 0x68);
+					if (trial_cntr < 2) {
+						if (intp->chip_id >= 0x20)
+							stv0900_write_reg(intp,
+								CORRELABS,
+								0x79);
+						else
+							stv0900_write_reg(intp,
+								CORRELABS,
+								0x68);
 
-							stv0900_write_reg(i_params, R0900_P2_DMDCFGMD, 0x89);
-						}
+						stv0900_write_reg(intp,
+								DMDCFGMD,
+								0x89);
 					}
 				}
 			}
+		}
 
-		} while ((lock == FALSE) && (trialCounter < 2) && (no_signal == FALSE));
-
-		break;
-	}
+	} while ((lock == FALSE)
+		&& (trial_cntr < 2)
+		&& (no_signal == FALSE));
 
 	return lock;
 }
 
-static u32 stv0900_get_symbol_rate(struct stv0900_internal *i_params,
+static u32 stv0900_get_symbol_rate(struct stv0900_internal *intp,
 					u32 mclk,
 					enum fe_stv0900_demod_num demod)
 {
-	s32 sfr_field3, sfr_field2, sfr_field1, sfr_field0,
-	rem1, rem2, intval1, intval2, srate;
-
-	dmd_reg(sfr_field3, F0900_P1_SYMB_FREQ3, F0900_P2_SYMB_FREQ3);
-	dmd_reg(sfr_field2, F0900_P1_SYMB_FREQ2, F0900_P2_SYMB_FREQ2);
-	dmd_reg(sfr_field1, F0900_P1_SYMB_FREQ1, F0900_P2_SYMB_FREQ1);
-	dmd_reg(sfr_field0, F0900_P1_SYMB_FREQ0, F0900_P2_SYMB_FREQ0);
-
-	srate = (stv0900_get_bits(i_params, sfr_field3) << 24) +
-		(stv0900_get_bits(i_params, sfr_field2) << 16) +
-		(stv0900_get_bits(i_params, sfr_field1) << 8) +
-		(stv0900_get_bits(i_params, sfr_field0));
+	s32	rem1, rem2, intval1, intval2, srate;
+
+	srate = (stv0900_get_bits(intp, SYMB_FREQ3) << 24) +
+		(stv0900_get_bits(intp, SYMB_FREQ2) << 16) +
+		(stv0900_get_bits(intp, SYMB_FREQ1) << 8) +
+		(stv0900_get_bits(intp, SYMB_FREQ0));
 	dprintk("lock: srate=%d r0=0x%x r1=0x%x r2=0x%x r3=0x%x \n",
-		srate, stv0900_get_bits(i_params, sfr_field0),
-		stv0900_get_bits(i_params, sfr_field1),
-		stv0900_get_bits(i_params, sfr_field2),
-		stv0900_get_bits(i_params, sfr_field3));
+		srate, stv0900_get_bits(intp, SYMB_FREQ0),
+		stv0900_get_bits(intp, SYMB_FREQ1),
+		stv0900_get_bits(intp, SYMB_FREQ2),
+		stv0900_get_bits(intp, SYMB_FREQ3));
 
 	intval1 = (mclk) >> 16;
 	intval2 = (srate) >> 16;
@@ -520,18 +333,15 @@ static u32 stv0900_get_symbol_rate(struct stv0900_internal *i_params,
 	return srate;
 }
 
-static void stv0900_set_symbol_rate(struct stv0900_internal *i_params,
+static void stv0900_set_symbol_rate(struct stv0900_internal *intp,
 					u32 mclk, u32 srate,
 					enum fe_stv0900_demod_num demod)
 {
-	s32 sfr_init_reg;
 	u32 symb;
 
-	dprintk(KERN_INFO "%s: Mclk %d, SR %d, Dmd %d\n", __func__, mclk,
+	dprintk("%s: Mclk %d, SR %d, Dmd %d\n", __func__, mclk,
 							srate, demod);
 
-	dmd_reg(sfr_init_reg, R0900_P1_SFRINIT1, R0900_P2_SFRINIT1);
-
 	if (srate > 60000000) {
 		symb = srate << 4;
 		symb /= (mclk >> 12);
@@ -543,19 +353,16 @@ static void stv0900_set_symbol_rate(struct stv0900_internal *i_params,
 		symb /= (mclk >> 7);
 	}
 
-	stv0900_write_reg(i_params, sfr_init_reg, (symb >> 8) & 0x7F);
-	stv0900_write_reg(i_params, sfr_init_reg + 1, (symb & 0xFF));
+	stv0900_write_reg(intp, SFRINIT1, (symb >> 8) & 0x7f);
+	stv0900_write_reg(intp, SFRINIT1 + 1, (symb & 0xff));
 }
 
-static void stv0900_set_max_symbol_rate(struct stv0900_internal *i_params,
+static void stv0900_set_max_symbol_rate(struct stv0900_internal *intp,
 					u32 mclk, u32 srate,
 					enum fe_stv0900_demod_num demod)
 {
-	s32 sfr_max_reg;
 	u32 symb;
 
-	dmd_reg(sfr_max_reg, R0900_P1_SFRUP1, R0900_P2_SFRUP1);
-
 	srate = 105 * (srate / 100);
 
 	if (srate > 60000000) {
@@ -570,23 +377,20 @@ static void stv0900_set_max_symbol_rate(struct stv0900_internal *i_params,
 	}
 
 	if (symb < 0x7fff) {
-		stv0900_write_reg(i_params, sfr_max_reg, (symb >> 8) & 0x7F);
-		stv0900_write_reg(i_params, sfr_max_reg + 1, (symb & 0xFF));
+		stv0900_write_reg(intp, SFRUP1, (symb >> 8) & 0x7f);
+		stv0900_write_reg(intp, SFRUP1 + 1, (symb & 0xff));
 	} else {
-		stv0900_write_reg(i_params, sfr_max_reg, 0x7F);
-		stv0900_write_reg(i_params, sfr_max_reg + 1, 0xFF);
+		stv0900_write_reg(intp, SFRUP1, 0x7f);
+		stv0900_write_reg(intp, SFRUP1 + 1, 0xff);
 	}
 }
 
-static void stv0900_set_min_symbol_rate(struct stv0900_internal *i_params,
+static void stv0900_set_min_symbol_rate(struct stv0900_internal *intp,
 					u32 mclk, u32 srate,
 					enum fe_stv0900_demod_num demod)
 {
-	s32 sfr_min_reg;
 	u32	symb;
 
-	dmd_reg(sfr_min_reg, R0900_P1_SFRLOW1, R0900_P2_SFRLOW1);
-
 	srate = 95 * (srate / 100);
 	if (srate > 60000000) {
 		symb = srate << 4;
@@ -601,22 +405,20 @@ static void stv0900_set_min_symbol_rate(struct stv0900_internal *i_params,
 		symb /= (mclk >> 7);
 	}
 
-	stv0900_write_reg(i_params, sfr_min_reg, (symb >> 8) & 0xFF);
-	stv0900_write_reg(i_params, sfr_min_reg + 1, (symb & 0xFF));
+	stv0900_write_reg(intp, SFRLOW1, (symb >> 8) & 0xff);
+	stv0900_write_reg(intp, SFRLOW1 + 1, (symb & 0xff));
 }
 
-static s32 stv0900_get_timing_offst(struct stv0900_internal *i_params,
+static s32 stv0900_get_timing_offst(struct stv0900_internal *intp,
 					u32 srate,
 					enum fe_stv0900_demod_num demod)
 {
-	s32 tmgreg,
-	timingoffset;
+	s32 timingoffset;
 
-	dmd_reg(tmgreg, R0900_P1_TMGREG2, R0900_P2_TMGREG2);
 
-	timingoffset = (stv0900_read_reg(i_params, tmgreg) << 16) +
-		       (stv0900_read_reg(i_params, tmgreg + 1) << 8) +
-		       (stv0900_read_reg(i_params, tmgreg + 2));
+	timingoffset = (stv0900_read_reg(intp, TMGREG2) << 16) +
+		       (stv0900_read_reg(intp, TMGREG2 + 1) << 8) +
+		       (stv0900_read_reg(intp, TMGREG2 + 2));
 
 	timingoffset = ge2comp(timingoffset, 24);
 
@@ -630,22 +432,19 @@ static s32 stv0900_get_timing_offst(struct stv0900_internal *i_params,
 	return timingoffset;
 }
 
-static void stv0900_set_dvbs2_rolloff(struct stv0900_internal *i_params,
+static void stv0900_set_dvbs2_rolloff(struct stv0900_internal *intp,
 					enum fe_stv0900_demod_num demod)
 {
-	s32 rolloff, man_fld, matstr_reg, rolloff_ctl_fld;
-
-	dmd_reg(man_fld, F0900_P1_MANUAL_ROLLOFF, F0900_P2_MANUAL_ROLLOFF);
-	dmd_reg(matstr_reg, R0900_P1_MATSTR1, R0900_P2_MATSTR1);
-	dmd_reg(rolloff_ctl_fld, F0900_P1_ROLLOFF_CONTROL,
-				F0900_P2_ROLLOFF_CONTROL);
-
-	if (i_params->chip_id == 0x10) {
-		stv0900_write_bits(i_params, man_fld, 1);
-		rolloff = stv0900_read_reg(i_params, matstr_reg) & 0x03;
-		stv0900_write_bits(i_params, rolloff_ctl_fld, rolloff);
-	} else
-		stv0900_write_bits(i_params, man_fld, 0);
+	s32 rolloff;
+
+	if (intp->chip_id == 0x10) {
+		stv0900_write_bits(intp, MANUALSX_ROLLOFF, 1);
+		rolloff = stv0900_read_reg(intp, MATSTR1) & 0x03;
+		stv0900_write_bits(intp, ROLLOFF_CONTROL, rolloff);
+	} else if (intp->chip_id <= 0x20)
+		stv0900_write_bits(intp, MANUALSX_ROLLOFF, 0);
+	else /* cut 3.0 */
+		stv0900_write_bits(intp, MANUALS2_ROLLOFF, 0);
 }
 
 static u32 stv0900_carrier_width(u32 srate, enum fe_stv0900_rolloff ro)
@@ -668,84 +467,47 @@ static u32 stv0900_carrier_width(u32 srate, enum fe_stv0900_rolloff ro)
 	return srate  + (srate * rolloff) / 100;
 }
 
-static int stv0900_check_timing_lock(struct stv0900_internal *i_params,
+static int stv0900_check_timing_lock(struct stv0900_internal *intp,
 				enum fe_stv0900_demod_num demod)
 {
 	int timingLock = FALSE;
-	s32 i,
-	timingcpt = 0;
-	u8 carFreq,
-	tmgTHhigh,
-	tmgTHLow;
-
-	switch (demod) {
-	case STV0900_DEMOD_1:
-	default:
-		carFreq = stv0900_read_reg(i_params, R0900_P1_CARFREQ);
-		tmgTHhigh = stv0900_read_reg(i_params, R0900_P1_TMGTHRISE);
-		tmgTHLow = stv0900_read_reg(i_params, R0900_P1_TMGTHFALL);
-		stv0900_write_reg(i_params, R0900_P1_TMGTHRISE, 0x20);
-		stv0900_write_reg(i_params, R0900_P1_TMGTHFALL, 0x0);
-		stv0900_write_bits(i_params, F0900_P1_CFR_AUTOSCAN, 0);
-		stv0900_write_reg(i_params, R0900_P1_RTC, 0x80);
-		stv0900_write_reg(i_params, R0900_P1_RTCS2, 0x40);
-		stv0900_write_reg(i_params, R0900_P1_CARFREQ, 0x0);
-		stv0900_write_reg(i_params, R0900_P1_CFRINIT1, 0x0);
-		stv0900_write_reg(i_params, R0900_P1_CFRINIT0, 0x0);
-		stv0900_write_reg(i_params, R0900_P1_AGC2REF, 0x65);
-		stv0900_write_reg(i_params, R0900_P1_DMDISTATE, 0x18);
-		msleep(7);
-
-		for (i = 0; i < 10; i++) {
-			if (stv0900_get_bits(i_params, F0900_P1_TMGLOCK_QUALITY) >= 2)
-				timingcpt++;
-
-			msleep(1);
-		}
-
-		if (timingcpt >= 3)
-			timingLock = TRUE;
-
-		stv0900_write_reg(i_params, R0900_P1_AGC2REF, 0x38);
-		stv0900_write_reg(i_params, R0900_P1_RTC, 0x88);
-		stv0900_write_reg(i_params, R0900_P1_RTCS2, 0x68);
-		stv0900_write_reg(i_params, R0900_P1_CARFREQ, carFreq);
-		stv0900_write_reg(i_params, R0900_P1_TMGTHRISE, tmgTHhigh);
-		stv0900_write_reg(i_params, R0900_P1_TMGTHFALL, tmgTHLow);
-		break;
-	case STV0900_DEMOD_2:
-		carFreq = stv0900_read_reg(i_params, R0900_P2_CARFREQ);
-		tmgTHhigh = stv0900_read_reg(i_params, R0900_P2_TMGTHRISE);
-		tmgTHLow = stv0900_read_reg(i_params, R0900_P2_TMGTHFALL);
-		stv0900_write_reg(i_params, R0900_P2_TMGTHRISE, 0x20);
-		stv0900_write_reg(i_params, R0900_P2_TMGTHFALL, 0);
-		stv0900_write_bits(i_params, F0900_P2_CFR_AUTOSCAN, 0);
-		stv0900_write_reg(i_params, R0900_P2_RTC, 0x80);
-		stv0900_write_reg(i_params, R0900_P2_RTCS2, 0x40);
-		stv0900_write_reg(i_params, R0900_P2_CARFREQ, 0x0);
-		stv0900_write_reg(i_params, R0900_P2_CFRINIT1, 0x0);
-		stv0900_write_reg(i_params, R0900_P2_CFRINIT0, 0x0);
-		stv0900_write_reg(i_params, R0900_P2_AGC2REF, 0x65);
-		stv0900_write_reg(i_params, R0900_P2_DMDISTATE, 0x18);
-		msleep(5);
-		for (i = 0; i < 10; i++) {
-			if (stv0900_get_bits(i_params, F0900_P2_TMGLOCK_QUALITY) >= 2)
-				timingcpt++;
+	s32	i,
+		timingcpt = 0;
+	u8	car_freq,
+		tmg_th_high,
+		tmg_th_low;
+
+	car_freq = stv0900_read_reg(intp, CARFREQ);
+	tmg_th_high = stv0900_read_reg(intp, TMGTHRISE);
+	tmg_th_low = stv0900_read_reg(intp, TMGTHFALL);
+	stv0900_write_reg(intp, TMGTHRISE, 0x20);
+	stv0900_write_reg(intp, TMGTHFALL, 0x0);
+	stv0900_write_bits(intp, CFR_AUTOSCAN, 0);
+	stv0900_write_reg(intp, RTC, 0x80);
+	stv0900_write_reg(intp, RTCS2, 0x40);
+	stv0900_write_reg(intp, CARFREQ, 0x0);
+	stv0900_write_reg(intp, CFRINIT1, 0x0);
+	stv0900_write_reg(intp, CFRINIT0, 0x0);
+	stv0900_write_reg(intp, AGC2REF, 0x65);
+	stv0900_write_reg(intp, DMDISTATE, 0x18);
+	msleep(7);
+
+	for (i = 0; i < 10; i++) {
+		if (stv0900_get_bits(intp, TMGLOCK_QUALITY) >= 2)
+			timingcpt++;
+
+		msleep(1);
+	}
 
-			msleep(1);
-		}
+	if (timingcpt >= 3)
+		timingLock = TRUE;
 
-		if (timingcpt >= 3)
-			timingLock = TRUE;
-
-		stv0900_write_reg(i_params, R0900_P2_AGC2REF, 0x38);
-		stv0900_write_reg(i_params, R0900_P2_RTC, 0x88);
-		stv0900_write_reg(i_params, R0900_P2_RTCS2, 0x68);
-		stv0900_write_reg(i_params, R0900_P2_CARFREQ, carFreq);
-		stv0900_write_reg(i_params, R0900_P2_TMGTHRISE, tmgTHhigh);
-		stv0900_write_reg(i_params, R0900_P2_TMGTHFALL, tmgTHLow);
-		break;
-	}
+	stv0900_write_reg(intp, AGC2REF, 0x38);
+	stv0900_write_reg(intp, RTC, 0x88);
+	stv0900_write_reg(intp, RTCS2, 0x68);
+	stv0900_write_reg(intp, CARFREQ, car_freq);
+	stv0900_write_reg(intp, TMGTHRISE, tmg_th_high);
+	stv0900_write_reg(intp, TMGTHFALL, tmg_th_low);
 
 	return	timingLock;
 }
@@ -754,142 +516,114 @@ static int stv0900_get_demod_cold_lock(struct dvb_frontend *fe,
 					s32 demod_timeout)
 {
 	struct stv0900_state *state = fe->demodulator_priv;
-	struct stv0900_internal *i_params = state->internal;
+	struct stv0900_internal *intp = state->internal;
 	enum fe_stv0900_demod_num demod = state->demod;
+	int	lock = FALSE,
+		d = demod;
+	s32	srate,
+		search_range,
+		locktimeout,
+		currier_step,
+		nb_steps,
+		current_step,
+		direction,
+		tuner_freq,
+		timeout,
+		freq;
 
-	int lock = FALSE;
-	s32 srate, search_range, locktimeout,
-		currier_step, nb_steps, current_step,
-		direction, tuner_freq, timeout;
-
-	switch (demod) {
-	case STV0900_DEMOD_1:
-	default:
-		srate = i_params->dmd1_symbol_rate;
-		search_range = i_params->dmd1_srch_range;
-		break;
-
-	case STV0900_DEMOD_2:
-		srate = i_params->dmd2_symbol_rate;
-		search_range = i_params->dmd2_srch_range;
-		break;
-	}
+	srate = intp->symbol_rate[d];
+	search_range = intp->srch_range[d];
 
 	if (srate >= 10000000)
 		locktimeout = demod_timeout / 3;
 	else
 		locktimeout = demod_timeout / 2;
 
-	lock = stv0900_get_demod_lock(i_params, demod, locktimeout);
-
-	if (lock == FALSE) {
-		if (srate >= 10000000) {
-			if (stv0900_check_timing_lock(i_params, demod) == TRUE) {
-				switch (demod) {
-				case STV0900_DEMOD_1:
-				default:
-					stv0900_write_reg(i_params, R0900_P1_DMDISTATE, 0x1f);
-					stv0900_write_reg(i_params, R0900_P1_DMDISTATE, 0x15);
-					break;
-				case STV0900_DEMOD_2:
-					stv0900_write_reg(i_params, R0900_P2_DMDISTATE, 0x1f);
-					stv0900_write_reg(i_params, R0900_P2_DMDISTATE, 0x15);
-					break;
-				}
+	lock = stv0900_get_demod_lock(intp, d, locktimeout);
 
-				lock = stv0900_get_demod_lock(i_params, demod, demod_timeout);
-			} else
-				lock = FALSE;
-		} else {
-			if (srate <= 4000000)
-				currier_step = 1000;
-			else if (srate <= 7000000)
-				currier_step = 2000;
-			else if (srate <= 10000000)
-				currier_step = 3000;
-			else
-				currier_step = 5000;
-
-			nb_steps = ((search_range / 1000) / currier_step);
-			nb_steps /= 2;
-			nb_steps = (2 * (nb_steps + 1));
-			if (nb_steps < 0)
-				nb_steps = 2;
-			else if (nb_steps > 12)
-				nb_steps = 12;
-
-			current_step = 1;
-			direction = 1;
+	if (lock != FALSE)
+		return lock;
+
+	if (srate >= 10000000) {
+		if (stv0900_check_timing_lock(intp, d) == TRUE) {
+			stv0900_write_reg(intp, DMDISTATE, 0x1f);
+			stv0900_write_reg(intp, DMDISTATE, 0x15);
+			lock = stv0900_get_demod_lock(intp, d, demod_timeout);
+		} else
+			lock = FALSE;
+
+		return lock;
+	}
+
+	if (intp->chip_id <= 0x20) {
+		if (srate <= 1000000)
+			currier_step = 500;
+		else if (srate <= 4000000)
+			currier_step = 1000;
+		else if (srate <= 7000000)
+			currier_step = 2000;
+		else if (srate <= 10000000)
+			currier_step = 3000;
+		else
+			currier_step = 5000;
+
+		if (srate >= 2000000) {
 			timeout = (demod_timeout / 3);
 			if (timeout > 1000)
 				timeout = 1000;
+		} else
+			timeout = (demod_timeout / 2);
+	} else {
+		/*cut 3.0 */
+		currier_step = srate / 4000;
+		timeout = (demod_timeout * 3) / 4;
+	}
 
-			switch (demod) {
-			case STV0900_DEMOD_1:
-			default:
-				if (lock == FALSE) {
-					tuner_freq = i_params->tuner1_freq;
-					i_params->tuner1_bw = stv0900_carrier_width(i_params->dmd1_symbol_rate, i_params->rolloff) + i_params->dmd1_symbol_rate;
+	nb_steps = ((search_range / 1000) / currier_step);
 
-					while ((current_step <= nb_steps) && (lock == FALSE)) {
+	if ((nb_steps % 2) != 0)
+		nb_steps += 1;
 
-						if (direction > 0)
-							tuner_freq += (current_step * currier_step);
-						else
-							tuner_freq -= (current_step * currier_step);
-
-						stv0900_set_tuner(fe, tuner_freq, i_params->tuner1_bw);
-						stv0900_write_reg(i_params, R0900_P1_DMDISTATE, 0x1C);
-						if (i_params->dmd1_srch_standard == STV0900_SEARCH_DVBS2) {
-							stv0900_write_bits(i_params, F0900_P1_DVBS1_ENABLE, 0);
-							stv0900_write_bits(i_params, F0900_P1_DVBS2_ENABLE, 0);
-							stv0900_write_bits(i_params, F0900_P1_DVBS1_ENABLE, 1);
-							stv0900_write_bits(i_params, F0900_P1_DVBS2_ENABLE, 1);
-						}
-
-						stv0900_write_reg(i_params, R0900_P1_CFRINIT1, 0);
-						stv0900_write_reg(i_params, R0900_P1_CFRINIT0, 0);
-						stv0900_write_reg(i_params, R0900_P1_DMDISTATE, 0x1F);
-						stv0900_write_reg(i_params, R0900_P1_DMDISTATE, 0x15);
-						lock = stv0900_get_demod_lock(i_params, demod, timeout);
-						direction *= -1;
-						current_step++;
-					}
-				}
-				break;
-			case STV0900_DEMOD_2:
-				if (lock == FALSE) {
-					tuner_freq = i_params->tuner2_freq;
-					i_params->tuner2_bw = stv0900_carrier_width(srate, i_params->rolloff) + srate;
+	if (nb_steps <= 0)
+		nb_steps = 2;
+	else if (nb_steps > 12)
+		nb_steps = 12;
 
-					while ((current_step <= nb_steps) && (lock == FALSE)) {
+	current_step = 1;
+	direction = 1;
 
-						if (direction > 0)
-							tuner_freq += (current_step * currier_step);
-						else
-							tuner_freq -= (current_step * currier_step);
-
-						stv0900_set_tuner(fe, tuner_freq, i_params->tuner2_bw);
-						stv0900_write_reg(i_params, R0900_P2_DMDISTATE, 0x1C);
-						if (i_params->dmd2_srch_stndrd == STV0900_SEARCH_DVBS2) {
-							stv0900_write_bits(i_params, F0900_P2_DVBS1_ENABLE, 0);
-							stv0900_write_bits(i_params, F0900_P2_DVBS2_ENABLE, 0);
-							stv0900_write_bits(i_params, F0900_P2_DVBS1_ENABLE, 1);
-							stv0900_write_bits(i_params, F0900_P2_DVBS2_ENABLE, 1);
-						}
-
-						stv0900_write_reg(i_params, R0900_P2_CFRINIT1, 0);
-						stv0900_write_reg(i_params, R0900_P2_CFRINIT0, 0);
-						stv0900_write_reg(i_params, R0900_P2_DMDISTATE, 0x1F);
-						stv0900_write_reg(i_params, R0900_P2_DMDISTATE, 0x15);
-						lock = stv0900_get_demod_lock(i_params, demod, timeout);
-						direction *= -1;
-						current_step++;
-					}
-				}
-				break;
-			}
+	if (intp->chip_id <= 0x20) {
+		tuner_freq = intp->freq[d];
+		intp->bw[d] = stv0900_carrier_width(intp->symbol_rate[d],
+				intp->rolloff) + intp->symbol_rate[d];
+	} else
+		tuner_freq = 0;
+
+	while ((current_step <= nb_steps) && (lock == FALSE)) {
+		if (direction > 0)
+			tuner_freq += (current_step * currier_step);
+		else
+			tuner_freq -= (current_step * currier_step);
+
+		if (intp->chip_id <= 0x20) {
+			stv0900_set_tuner(fe, tuner_freq, intp->bw[d]);
+			stv0900_write_reg(intp, DMDISTATE, 0x1c);
+			stv0900_write_reg(intp, CFRINIT1, 0);
+			stv0900_write_reg(intp, CFRINIT0, 0);
+			stv0900_write_reg(intp, DMDISTATE, 0x1f);
+			stv0900_write_reg(intp, DMDISTATE, 0x15);
+		} else {
+			stv0900_write_reg(intp, DMDISTATE, 0x1c);
+			freq = (tuner_freq * 65536) / (intp->mclk / 1000);
+			stv0900_write_bits(intp, CFR_INIT1, MSB(freq));
+			stv0900_write_bits(intp, CFR_INIT0, LSB(freq));
+			stv0900_write_reg(intp, DMDISTATE, 0x1f);
+			stv0900_write_reg(intp, DMDISTATE, 0x05);
 		}
+
+		lock = stv0900_get_demod_lock(intp, d, timeout);
+		direction *= -1;
+		current_step++;
 	}
 
 	return	lock;
@@ -931,9 +665,7 @@ static void stv0900_get_lock_timeout(s32 *demod_timeout, s32 *fec_timeout,
 		} else if (srate <= 20000000) {
 			(*demod_timeout) = 400;
 			(*fec_timeout) = 130;
-		}
-
-		else {
+		} else {
 			(*demod_timeout) = 300;
 			(*fec_timeout) = 100;
 		}
@@ -946,95 +678,77 @@ static void stv0900_get_lock_timeout(s32 *demod_timeout, s32 *fec_timeout,
 		(*demod_timeout) /= 2;
 }
 
-static void stv0900_set_viterbi_tracq(struct stv0900_internal *i_params,
+static void stv0900_set_viterbi_tracq(struct stv0900_internal *intp,
 					enum fe_stv0900_demod_num demod)
 {
 
-	s32 vth_reg;
+	s32 vth_reg = VTH12;
 
-	dprintk(KERN_INFO "%s\n", __func__);
+	dprintk("%s\n", __func__);
 
-	dmd_reg(vth_reg, R0900_P1_VTH12, R0900_P2_VTH12);
-
-	stv0900_write_reg(i_params, vth_reg++, 0xd0);
-	stv0900_write_reg(i_params, vth_reg++, 0x7d);
-	stv0900_write_reg(i_params, vth_reg++, 0x53);
-	stv0900_write_reg(i_params, vth_reg++, 0x2F);
-	stv0900_write_reg(i_params, vth_reg++, 0x24);
-	stv0900_write_reg(i_params, vth_reg++, 0x1F);
+	stv0900_write_reg(intp, vth_reg++, 0xd0);
+	stv0900_write_reg(intp, vth_reg++, 0x7d);
+	stv0900_write_reg(intp, vth_reg++, 0x53);
+	stv0900_write_reg(intp, vth_reg++, 0x2f);
+	stv0900_write_reg(intp, vth_reg++, 0x24);
+	stv0900_write_reg(intp, vth_reg++, 0x1f);
 }
 
-static void stv0900_set_viterbi_standard(struct stv0900_internal *i_params,
-				   enum fe_stv0900_search_standard Standard,
-				   enum fe_stv0900_fec PunctureRate,
+static void stv0900_set_viterbi_standard(struct stv0900_internal *intp,
+				   enum fe_stv0900_search_standard standard,
+				   enum fe_stv0900_fec fec,
 				   enum fe_stv0900_demod_num demod)
 {
+	dprintk("%s: ViterbiStandard = ", __func__);
 
-	s32 fecmReg,
-	prvitReg;
-
-	dprintk(KERN_INFO "%s: ViterbiStandard = ", __func__);
-
-	switch (demod) {
-	case STV0900_DEMOD_1:
-	default:
-		fecmReg = R0900_P1_FECM;
-		prvitReg = R0900_P1_PRVIT;
-		break;
-	case STV0900_DEMOD_2:
-		fecmReg = R0900_P2_FECM;
-		prvitReg = R0900_P2_PRVIT;
-		break;
-	}
-
-	switch (Standard) {
+	switch (standard) {
 	case STV0900_AUTO_SEARCH:
 		dprintk("Auto\n");
-		stv0900_write_reg(i_params, fecmReg, 0x10);
-		stv0900_write_reg(i_params, prvitReg, 0x3F);
+		stv0900_write_reg(intp, FECM, 0x10);
+		stv0900_write_reg(intp, PRVIT, 0x3f);
 		break;
 	case STV0900_SEARCH_DVBS1:
 		dprintk("DVBS1\n");
-		stv0900_write_reg(i_params, fecmReg, 0x00);
-		switch (PunctureRate) {
+		stv0900_write_reg(intp, FECM, 0x00);
+		switch (fec) {
 		case STV0900_FEC_UNKNOWN:
 		default:
-			stv0900_write_reg(i_params, prvitReg, 0x2F);
+			stv0900_write_reg(intp, PRVIT, 0x2f);
 			break;
 		case STV0900_FEC_1_2:
-			stv0900_write_reg(i_params, prvitReg, 0x01);
+			stv0900_write_reg(intp, PRVIT, 0x01);
 			break;
 		case STV0900_FEC_2_3:
-			stv0900_write_reg(i_params, prvitReg, 0x02);
+			stv0900_write_reg(intp, PRVIT, 0x02);
 			break;
 		case STV0900_FEC_3_4:
-			stv0900_write_reg(i_params, prvitReg, 0x04);
+			stv0900_write_reg(intp, PRVIT, 0x04);
 			break;
 		case STV0900_FEC_5_6:
-			stv0900_write_reg(i_params, prvitReg, 0x08);
+			stv0900_write_reg(intp, PRVIT, 0x08);
 			break;
 		case STV0900_FEC_7_8:
-			stv0900_write_reg(i_params, prvitReg, 0x20);
+			stv0900_write_reg(intp, PRVIT, 0x20);
 			break;
 		}
 
 		break;
 	case STV0900_SEARCH_DSS:
 		dprintk("DSS\n");
-		stv0900_write_reg(i_params, fecmReg, 0x80);
-		switch (PunctureRate) {
+		stv0900_write_reg(intp, FECM, 0x80);
+		switch (fec) {
 		case STV0900_FEC_UNKNOWN:
 		default:
-			stv0900_write_reg(i_params, prvitReg, 0x13);
+			stv0900_write_reg(intp, PRVIT, 0x13);
 			break;
 		case STV0900_FEC_1_2:
-			stv0900_write_reg(i_params, prvitReg, 0x01);
+			stv0900_write_reg(intp, PRVIT, 0x01);
 			break;
 		case STV0900_FEC_2_3:
-			stv0900_write_reg(i_params, prvitReg, 0x02);
+			stv0900_write_reg(intp, PRVIT, 0x02);
 			break;
 		case STV0900_FEC_6_7:
-			stv0900_write_reg(i_params, prvitReg, 0x10);
+			stv0900_write_reg(intp, PRVIT, 0x10);
 			break;
 		}
 		break;
@@ -1043,340 +757,277 @@ static void stv0900_set_viterbi_standard(struct stv0900_internal *i_params,
 	}
 }
 
-static void stv0900_track_optimization(struct dvb_frontend *fe)
+static enum fe_stv0900_fec stv0900_get_vit_fec(struct stv0900_internal *intp,
+						enum fe_stv0900_demod_num demod)
 {
-	struct stv0900_state *state = fe->demodulator_priv;
-	struct stv0900_internal *i_params = state->internal;
-	enum fe_stv0900_demod_num demod = state->demod;
+	enum fe_stv0900_fec prate;
+	s32 rate_fld = stv0900_get_bits(intp, VIT_CURPUN);
 
-	s32 srate, pilots, aclc, freq1, freq0,
-		i = 0, timed, timef, blindTunSw = 0;
+	switch (rate_fld) {
+	case 13:
+		prate = STV0900_FEC_1_2;
+		break;
+	case 18:
+		prate = STV0900_FEC_2_3;
+		break;
+	case 21:
+		prate = STV0900_FEC_3_4;
+		break;
+	case 24:
+		prate = STV0900_FEC_5_6;
+		break;
+	case 25:
+		prate = STV0900_FEC_6_7;
+		break;
+	case 26:
+		prate = STV0900_FEC_7_8;
+		break;
+	default:
+		prate = STV0900_FEC_UNKNOWN;
+		break;
+	}
 
-	enum fe_stv0900_rolloff rolloff;
-	enum fe_stv0900_modcode foundModcod;
+	return prate;
+}
 
-	dprintk(KERN_INFO "%s\n", __func__);
+void stv0900_set_dvbs1_track_car_loop(struct stv0900_internal *intp,
+					enum fe_stv0900_demod_num demod,
+					u32 srate)
+{
+	if (intp->chip_id >= 0x30) {
+		if (srate >= 15000000) {
+			stv0900_write_reg(intp, ACLC, 0x2b);
+			stv0900_write_reg(intp, BCLC, 0x1a);
+		} else if ((srate >= 7000000) && (15000000 > srate)) {
+			stv0900_write_reg(intp, ACLC, 0x0c);
+			stv0900_write_reg(intp, BCLC, 0x1b);
+		} else if (srate < 7000000) {
+			stv0900_write_reg(intp, ACLC, 0x2c);
+			stv0900_write_reg(intp, BCLC, 0x1c);
+		}
 
-	srate = stv0900_get_symbol_rate(i_params, i_params->mclk, demod);
-	srate += stv0900_get_timing_offst(i_params, srate, demod);
+	} else { /*cut 2.0 and 1.x*/
+		stv0900_write_reg(intp, ACLC, 0x1a);
+		stv0900_write_reg(intp, BCLC, 0x09);
+	}
 
-	switch (demod) {
-	case STV0900_DEMOD_1:
-	default:
-		switch (i_params->dmd1_rslts.standard) {
-		case STV0900_DVBS1_STANDARD:
-			if (i_params->dmd1_srch_standard == STV0900_AUTO_SEARCH) {
-				stv0900_write_bits(i_params, F0900_P1_DVBS1_ENABLE, 1);
-				stv0900_write_bits(i_params, F0900_P1_DVBS2_ENABLE, 0);
-			}
+}
 
-			stv0900_write_bits(i_params, F0900_P1_ROLLOFF_CONTROL, i_params->rolloff);
-			stv0900_write_bits(i_params, F0900_P1_MANUAL_ROLLOFF, 1);
-			stv0900_write_reg(i_params, R0900_P1_ERRCTRL1, 0x75);
-			break;
-		case STV0900_DSS_STANDARD:
-			if (i_params->dmd1_srch_standard == STV0900_AUTO_SEARCH) {
-				stv0900_write_bits(i_params, F0900_P1_DVBS1_ENABLE, 1);
-				stv0900_write_bits(i_params, F0900_P1_DVBS2_ENABLE, 0);
-			}
+static void stv0900_track_optimization(struct dvb_frontend *fe)
+{
+	struct stv0900_state *state = fe->demodulator_priv;
+	struct stv0900_internal *intp = state->internal;
+	enum fe_stv0900_demod_num demod = state->demod;
 
-			stv0900_write_bits(i_params, F0900_P1_ROLLOFF_CONTROL, i_params->rolloff);
-			stv0900_write_bits(i_params, F0900_P1_MANUAL_ROLLOFF, 1);
-			stv0900_write_reg(i_params, R0900_P1_ERRCTRL1, 0x75);
-			break;
-		case STV0900_DVBS2_STANDARD:
-			stv0900_write_bits(i_params, F0900_P1_DVBS1_ENABLE, 0);
-			stv0900_write_bits(i_params, F0900_P1_DVBS2_ENABLE, 1);
-			stv0900_write_reg(i_params, R0900_P1_ACLC, 0);
-			stv0900_write_reg(i_params, R0900_P1_BCLC, 0);
-			if (i_params->dmd1_rslts.frame_length == STV0900_LONG_FRAME) {
-				foundModcod = stv0900_get_bits(i_params, F0900_P1_DEMOD_MODCOD);
-				pilots = stv0900_get_bits(i_params, F0900_P1_DEMOD_TYPE) & 0x01;
-				aclc = stv0900_get_optim_carr_loop(srate, foundModcod, pilots, i_params->chip_id);
-				if (foundModcod <= STV0900_QPSK_910)
-					stv0900_write_reg(i_params, R0900_P1_ACLC2S2Q, aclc);
-				else if (foundModcod <= STV0900_8PSK_910) {
-					stv0900_write_reg(i_params, R0900_P1_ACLC2S2Q, 0x2a);
-					stv0900_write_reg(i_params, R0900_P1_ACLC2S28, aclc);
-				}
+	s32	srate,
+		pilots,
+		aclc,
+		freq1,
+		freq0,
+		i = 0,
+		timed,
+		timef,
+		blind_tun_sw = 0,
+		modulation;
 
-				if ((i_params->demod_mode == STV0900_SINGLE) && (foundModcod > STV0900_8PSK_910)) {
-					if (foundModcod <= STV0900_16APSK_910) {
-						stv0900_write_reg(i_params, R0900_P1_ACLC2S2Q, 0x2a);
-						stv0900_write_reg(i_params, R0900_P1_ACLC2S216A, aclc);
-					} else if (foundModcod <= STV0900_32APSK_910) {
-						stv0900_write_reg(i_params, R0900_P1_ACLC2S2Q, 0x2a);
-						stv0900_write_reg(i_params, R0900_P1_ACLC2S232A, aclc);
-					}
-				}
+	enum fe_stv0900_rolloff rolloff;
+	enum fe_stv0900_modcode foundModcod;
 
-			} else {
-				aclc = stv0900_get_optim_short_carr_loop(srate, i_params->dmd1_rslts.modulation, i_params->chip_id);
-				if (i_params->dmd1_rslts.modulation == STV0900_QPSK)
-					stv0900_write_reg(i_params, R0900_P1_ACLC2S2Q, aclc);
-
-				else if (i_params->dmd1_rslts.modulation == STV0900_8PSK) {
-					stv0900_write_reg(i_params, R0900_P1_ACLC2S2Q, 0x2a);
-					stv0900_write_reg(i_params, R0900_P1_ACLC2S28, aclc);
-				} else if (i_params->dmd1_rslts.modulation == STV0900_16APSK) {
-					stv0900_write_reg(i_params, R0900_P1_ACLC2S2Q, 0x2a);
-					stv0900_write_reg(i_params, R0900_P1_ACLC2S216A, aclc);
-				} else if (i_params->dmd1_rslts.modulation == STV0900_32APSK) {
-					stv0900_write_reg(i_params, R0900_P1_ACLC2S2Q, 0x2a);
-					stv0900_write_reg(i_params, R0900_P1_ACLC2S232A, aclc);
-				}
+	dprintk("%s\n", __func__);
 
-			}
+	srate = stv0900_get_symbol_rate(intp, intp->mclk, demod);
+	srate += stv0900_get_timing_offst(intp, srate, demod);
 
-			if (i_params->chip_id <= 0x11) {
-				if (i_params->demod_mode != STV0900_SINGLE)
-					stv0900_activate_s2_modcode(i_params, demod);
+	switch (intp->result[demod].standard) {
+	case STV0900_DVBS1_STANDARD:
+	case STV0900_DSS_STANDARD:
+		dprintk("%s: found DVB-S or DSS\n", __func__);
+		if (intp->srch_standard[demod] == STV0900_AUTO_SEARCH) {
+			stv0900_write_bits(intp, DVBS1_ENABLE, 1);
+			stv0900_write_bits(intp, DVBS2_ENABLE, 0);
+		}
 
-			}
+		stv0900_write_bits(intp, ROLLOFF_CONTROL, intp->rolloff);
+		stv0900_write_bits(intp, MANUALSX_ROLLOFF, 1);
 
-			stv0900_write_reg(i_params, R0900_P1_ERRCTRL1, 0x67);
-			break;
-		case STV0900_UNKNOWN_STANDARD:
-		default:
-			stv0900_write_bits(i_params, F0900_P1_DVBS1_ENABLE, 1);
-			stv0900_write_bits(i_params, F0900_P1_DVBS2_ENABLE, 1);
+		if (intp->chip_id < 0x30) {
+			stv0900_write_reg(intp, ERRCTRL1, 0x75);
 			break;
 		}
 
-		freq1 = stv0900_read_reg(i_params, R0900_P1_CFR2);
-		freq0 = stv0900_read_reg(i_params, R0900_P1_CFR1);
-		rolloff = stv0900_get_bits(i_params, F0900_P1_ROLLOFF_STATUS);
-		if (i_params->dmd1_srch_algo == STV0900_BLIND_SEARCH) {
-			stv0900_write_reg(i_params, R0900_P1_SFRSTEP, 0x00);
-			stv0900_write_bits(i_params, F0900_P1_SCAN_ENABLE, 0);
-			stv0900_write_bits(i_params, F0900_P1_CFR_AUTOSCAN, 0);
-			stv0900_write_reg(i_params, R0900_P1_TMGCFG2, 0x01);
-			stv0900_set_symbol_rate(i_params, i_params->mclk, srate, demod);
-			stv0900_set_max_symbol_rate(i_params, i_params->mclk, srate, demod);
-			stv0900_set_min_symbol_rate(i_params, i_params->mclk, srate, demod);
-			blindTunSw = 1;
+		if (stv0900_get_vit_fec(intp, demod) == STV0900_FEC_1_2) {
+			stv0900_write_reg(intp, GAUSSR0, 0x98);
+			stv0900_write_reg(intp, CCIR0, 0x18);
+		} else {
+			stv0900_write_reg(intp, GAUSSR0, 0x18);
+			stv0900_write_reg(intp, CCIR0, 0x18);
 		}
 
-		if (i_params->chip_id >= 0x20) {
-			if ((i_params->dmd1_srch_standard == STV0900_SEARCH_DVBS1) || (i_params->dmd1_srch_standard == STV0900_SEARCH_DSS) || (i_params->dmd1_srch_standard == STV0900_AUTO_SEARCH)) {
-				stv0900_write_reg(i_params, R0900_P1_VAVSRVIT, 0x0a);
-				stv0900_write_reg(i_params, R0900_P1_VITSCALE, 0x0);
+		stv0900_write_reg(intp, ERRCTRL1, 0x75);
+		break;
+	case STV0900_DVBS2_STANDARD:
+		dprintk("%s: found DVB-S2\n", __func__);
+		stv0900_write_bits(intp, DVBS1_ENABLE, 0);
+		stv0900_write_bits(intp, DVBS2_ENABLE, 1);
+		stv0900_write_reg(intp, ACLC, 0);
+		stv0900_write_reg(intp, BCLC, 0);
+		if (intp->result[demod].frame_len == STV0900_LONG_FRAME) {
+			foundModcod = stv0900_get_bits(intp, DEMOD_MODCOD);
+			pilots = stv0900_get_bits(intp, DEMOD_TYPE) & 0x01;
+			aclc = stv0900_get_optim_carr_loop(srate,
+							foundModcod,
+							pilots,
+							intp->chip_id);
+			if (foundModcod <= STV0900_QPSK_910)
+				stv0900_write_reg(intp, ACLC2S2Q, aclc);
+			else if (foundModcod <= STV0900_8PSK_910) {
+				stv0900_write_reg(intp, ACLC2S2Q, 0x2a);
+				stv0900_write_reg(intp, ACLC2S28, aclc);
 			}
-		}
-
-		if (i_params->chip_id < 0x20)
-			stv0900_write_reg(i_params, R0900_P1_CARHDR, 0x08);
-
-		if (i_params->chip_id == 0x10)
-			stv0900_write_reg(i_params, R0900_P1_CORRELEXP, 0x0A);
 
-		stv0900_write_reg(i_params, R0900_P1_AGC2REF, 0x38);
-
-		if ((i_params->chip_id >= 0x20) || (blindTunSw == 1) || (i_params->dmd1_symbol_rate < 10000000)) {
-			stv0900_write_reg(i_params, R0900_P1_CFRINIT1, freq1);
-			stv0900_write_reg(i_params, R0900_P1_CFRINIT0, freq0);
-			i_params->tuner1_bw = stv0900_carrier_width(srate, i_params->rolloff) + 10000000;
-
-			if ((i_params->chip_id >= 0x20) || (blindTunSw == 1)) {
-				if (i_params->dmd1_srch_algo != STV0900_WARM_START)
-					stv0900_set_bandwidth(fe, i_params->tuner1_bw);
+			if ((intp->demod_mode == STV0900_SINGLE) &&
+					(foundModcod > STV0900_8PSK_910)) {
+				if (foundModcod <= STV0900_16APSK_910) {
+					stv0900_write_reg(intp, ACLC2S2Q, 0x2a);
+					stv0900_write_reg(intp, ACLC2S216A,
+									aclc);
+				} else if (foundModcod <= STV0900_32APSK_910) {
+					stv0900_write_reg(intp, ACLC2S2Q, 0x2a);
+					stv0900_write_reg(intp,	ACLC2S232A,
+									aclc);
+				}
 			}
 
-			if ((i_params->dmd1_srch_algo == STV0900_BLIND_SEARCH) || (i_params->dmd1_symbol_rate < 10000000))
-				msleep(50);
-			else
-				msleep(5);
-
-			stv0900_get_lock_timeout(&timed, &timef, srate, STV0900_WARM_START);
-
-			if (stv0900_get_demod_lock(i_params, demod, timed / 2) == FALSE) {
-				stv0900_write_reg(i_params, R0900_P1_DMDISTATE, 0x1F);
-				stv0900_write_reg(i_params, R0900_P1_CFRINIT1, freq1);
-				stv0900_write_reg(i_params, R0900_P1_CFRINIT0, freq0);
-				stv0900_write_reg(i_params, R0900_P1_DMDISTATE, 0x18);
-				i = 0;
-				while ((stv0900_get_demod_lock(i_params, demod, timed / 2) == FALSE) && (i <= 2)) {
-					stv0900_write_reg(i_params, R0900_P1_DMDISTATE, 0x1F);
-					stv0900_write_reg(i_params, R0900_P1_CFRINIT1, freq1);
-					stv0900_write_reg(i_params, R0900_P1_CFRINIT0, freq0);
-					stv0900_write_reg(i_params, R0900_P1_DMDISTATE, 0x18);
-					i++;
-				}
+		} else {
+			modulation = intp->result[demod].modulation;
+			aclc = stv0900_get_optim_short_carr_loop(srate,
+					modulation, intp->chip_id);
+			if (modulation == STV0900_QPSK)
+				stv0900_write_reg(intp, ACLC2S2Q, aclc);
+			else if (modulation == STV0900_8PSK) {
+				stv0900_write_reg(intp, ACLC2S2Q, 0x2a);
+				stv0900_write_reg(intp, ACLC2S28, aclc);
+			} else if (modulation == STV0900_16APSK) {
+				stv0900_write_reg(intp, ACLC2S2Q, 0x2a);
+				stv0900_write_reg(intp, ACLC2S216A, aclc);
+			} else if (modulation == STV0900_32APSK) {
+				stv0900_write_reg(intp, ACLC2S2Q, 0x2a);
+				stv0900_write_reg(intp, ACLC2S232A, aclc);
 			}
 
 		}
 
-		if (i_params->chip_id >= 0x20)
-			stv0900_write_reg(i_params, R0900_P1_CARFREQ, 0x49);
+		if (intp->chip_id <= 0x11) {
+			if (intp->demod_mode != STV0900_SINGLE)
+				stv0900_activate_s2_modcod(intp, demod);
 
-		if ((i_params->dmd1_rslts.standard == STV0900_DVBS1_STANDARD) || (i_params->dmd1_rslts.standard == STV0900_DSS_STANDARD))
-			stv0900_set_viterbi_tracq(i_params, demod);
+		}
 
+		stv0900_write_reg(intp, ERRCTRL1, 0x67);
 		break;
+	case STV0900_UNKNOWN_STANDARD:
+	default:
+		dprintk("%s: found unknown standard\n", __func__);
+		stv0900_write_bits(intp, DVBS1_ENABLE, 1);
+		stv0900_write_bits(intp, DVBS2_ENABLE, 1);
+		break;
+	}
 
-	case STV0900_DEMOD_2:
-		switch (i_params->dmd2_rslts.standard) {
-		case STV0900_DVBS1_STANDARD:
-
-			if (i_params->dmd2_srch_stndrd == STV0900_AUTO_SEARCH) {
-				stv0900_write_bits(i_params, F0900_P2_DVBS1_ENABLE, 1);
-				stv0900_write_bits(i_params, F0900_P2_DVBS2_ENABLE, 0);
-			}
-
-			stv0900_write_bits(i_params, F0900_P2_ROLLOFF_CONTROL, i_params->rolloff);
-			stv0900_write_bits(i_params, F0900_P2_MANUAL_ROLLOFF, 1);
-			stv0900_write_reg(i_params, R0900_P2_ERRCTRL1, 0x75);
-			break;
-		case STV0900_DSS_STANDARD:
-			if (i_params->dmd2_srch_stndrd == STV0900_AUTO_SEARCH) {
-				stv0900_write_bits(i_params, F0900_P2_DVBS1_ENABLE, 1);
-				stv0900_write_bits(i_params, F0900_P2_DVBS2_ENABLE, 0);
-			}
-
-			stv0900_write_bits(i_params, F0900_P2_ROLLOFF_CONTROL, i_params->rolloff);
-			stv0900_write_bits(i_params, F0900_P2_MANUAL_ROLLOFF, 1);
-			stv0900_write_reg(i_params, R0900_P2_ERRCTRL1, 0x75);
-			break;
-		case STV0900_DVBS2_STANDARD:
-			stv0900_write_bits(i_params, F0900_P2_DVBS1_ENABLE, 0);
-			stv0900_write_bits(i_params, F0900_P2_DVBS2_ENABLE, 1);
-			stv0900_write_reg(i_params, R0900_P2_ACLC, 0);
-			stv0900_write_reg(i_params, R0900_P2_BCLC, 0);
-			if (i_params->dmd2_rslts.frame_length == STV0900_LONG_FRAME) {
-				foundModcod = stv0900_get_bits(i_params, F0900_P2_DEMOD_MODCOD);
-				pilots = stv0900_get_bits(i_params, F0900_P2_DEMOD_TYPE) & 0x01;
-				aclc = stv0900_get_optim_carr_loop(srate, foundModcod, pilots, i_params->chip_id);
-				if (foundModcod <= STV0900_QPSK_910)
-					stv0900_write_reg(i_params, R0900_P2_ACLC2S2Q, aclc);
-				else if (foundModcod <= STV0900_8PSK_910) {
-					stv0900_write_reg(i_params, R0900_P2_ACLC2S2Q, 0x2a);
-					stv0900_write_reg(i_params, R0900_P2_ACLC2S28, aclc);
-				}
+	freq1 = stv0900_read_reg(intp, CFR2);
+	freq0 = stv0900_read_reg(intp, CFR1);
+	rolloff = stv0900_get_bits(intp, ROLLOFF_STATUS);
+	if (intp->srch_algo[demod] == STV0900_BLIND_SEARCH) {
+		stv0900_write_reg(intp, SFRSTEP, 0x00);
+		stv0900_write_bits(intp, SCAN_ENABLE, 0);
+		stv0900_write_bits(intp, CFR_AUTOSCAN, 0);
+		stv0900_write_reg(intp, TMGCFG2, 0xc1);
+		stv0900_set_symbol_rate(intp, intp->mclk, srate, demod);
+		blind_tun_sw = 1;
+		if (intp->result[demod].standard != STV0900_DVBS2_STANDARD)
+			stv0900_set_dvbs1_track_car_loop(intp, demod, srate);
 
-				if ((i_params->demod_mode == STV0900_SINGLE) && (foundModcod > STV0900_8PSK_910)) {
-					if (foundModcod <= STV0900_16APSK_910) {
-						stv0900_write_reg(i_params, R0900_P2_ACLC2S2Q, 0x2a);
-						stv0900_write_reg(i_params, R0900_P2_ACLC2S216A, aclc);
-					} else if (foundModcod <= STV0900_32APSK_910) {
-						stv0900_write_reg(i_params, R0900_P2_ACLC2S2Q, 0x2a);
-						stv0900_write_reg(i_params, R0900_P2_ACLC2S232A, aclc);
-					}
+	}
 
-				}
+	if (intp->chip_id >= 0x20) {
+		if ((intp->srch_standard[demod] == STV0900_SEARCH_DVBS1) ||
+				(intp->srch_standard[demod] ==
+							STV0900_SEARCH_DSS) ||
+				(intp->srch_standard[demod] ==
+							STV0900_AUTO_SEARCH)) {
+			stv0900_write_reg(intp, VAVSRVIT, 0x0a);
+			stv0900_write_reg(intp, VITSCALE, 0x0);
+		}
+	}
 
-			} else {
-				aclc = stv0900_get_optim_short_carr_loop(srate,
-									i_params->dmd2_rslts.modulation,
-									i_params->chip_id);
-
-				if (i_params->dmd2_rslts.modulation == STV0900_QPSK)
-					stv0900_write_reg(i_params, R0900_P2_ACLC2S2Q, aclc);
-
-				else if (i_params->dmd2_rslts.modulation == STV0900_8PSK) {
-					stv0900_write_reg(i_params, R0900_P2_ACLC2S2Q, 0x2a);
-					stv0900_write_reg(i_params, R0900_P2_ACLC2S28, aclc);
-				} else if (i_params->dmd2_rslts.modulation == STV0900_16APSK) {
-					stv0900_write_reg(i_params, R0900_P2_ACLC2S2Q, 0x2a);
-					stv0900_write_reg(i_params, R0900_P2_ACLC2S216A, aclc);
-				} else if (i_params->dmd2_rslts.modulation == STV0900_32APSK) {
-					stv0900_write_reg(i_params, R0900_P2_ACLC2S2Q, 0x2a);
-					stv0900_write_reg(i_params, R0900_P2_ACLC2S232A, aclc);
-				}
-			}
+	if (intp->chip_id < 0x20)
+		stv0900_write_reg(intp, CARHDR, 0x08);
 
-			stv0900_write_reg(i_params, R0900_P2_ERRCTRL1, 0x67);
+	if (intp->chip_id == 0x10)
+		stv0900_write_reg(intp, CORRELEXP, 0x0a);
 
-			break;
-		case STV0900_UNKNOWN_STANDARD:
-		default:
-			stv0900_write_bits(i_params, F0900_P2_DVBS1_ENABLE, 1);
-			stv0900_write_bits(i_params, F0900_P2_DVBS2_ENABLE, 1);
-			break;
-		}
+	stv0900_write_reg(intp, AGC2REF, 0x38);
 
-		freq1 = stv0900_read_reg(i_params, R0900_P2_CFR2);
-		freq0 = stv0900_read_reg(i_params, R0900_P2_CFR1);
-		rolloff = stv0900_get_bits(i_params, F0900_P2_ROLLOFF_STATUS);
-		if (i_params->dmd2_srch_algo == STV0900_BLIND_SEARCH) {
-			stv0900_write_reg(i_params, R0900_P2_SFRSTEP, 0x00);
-			stv0900_write_bits(i_params, F0900_P2_SCAN_ENABLE, 0);
-			stv0900_write_bits(i_params, F0900_P2_CFR_AUTOSCAN, 0);
-			stv0900_write_reg(i_params, R0900_P2_TMGCFG2, 0x01);
-			stv0900_set_symbol_rate(i_params, i_params->mclk, srate, demod);
-			stv0900_set_max_symbol_rate(i_params, i_params->mclk, srate, demod);
-			stv0900_set_min_symbol_rate(i_params, i_params->mclk, srate, demod);
-			blindTunSw = 1;
-		}
+	if ((intp->chip_id >= 0x20) ||
+			(blind_tun_sw == 1) ||
+			(intp->symbol_rate[demod] < 10000000)) {
+		stv0900_write_reg(intp, CFRINIT1, freq1);
+		stv0900_write_reg(intp, CFRINIT0, freq0);
+		intp->bw[demod] = stv0900_carrier_width(srate,
+					intp->rolloff) + 10000000;
 
-		if (i_params->chip_id >= 0x20) {
-			if ((i_params->dmd2_srch_stndrd == STV0900_SEARCH_DVBS1) || (i_params->dmd2_srch_stndrd == STV0900_SEARCH_DSS) || (i_params->dmd2_srch_stndrd == STV0900_AUTO_SEARCH)) {
-				stv0900_write_reg(i_params, R0900_P2_VAVSRVIT, 0x0a);
-				stv0900_write_reg(i_params, R0900_P2_VITSCALE, 0x0);
-			}
+		if ((intp->chip_id >= 0x20) || (blind_tun_sw == 1)) {
+			if (intp->srch_algo[demod] != STV0900_WARM_START)
+				stv0900_set_bandwidth(fe, intp->bw[demod]);
 		}
 
-		if (i_params->chip_id < 0x20)
-			stv0900_write_reg(i_params, R0900_P2_CARHDR, 0x08);
-
-		if (i_params->chip_id == 0x10)
-			stv0900_write_reg(i_params, R0900_P2_CORRELEXP, 0x0a);
-
-		stv0900_write_reg(i_params, R0900_P2_AGC2REF, 0x38);
-		if ((i_params->chip_id >= 0x20) || (blindTunSw == 1) || (i_params->dmd2_symbol_rate < 10000000)) {
-			stv0900_write_reg(i_params, R0900_P2_CFRINIT1, freq1);
-			stv0900_write_reg(i_params, R0900_P2_CFRINIT0, freq0);
-			i_params->tuner2_bw = stv0900_carrier_width(srate, i_params->rolloff) + 10000000;
+		if ((intp->srch_algo[demod] == STV0900_BLIND_SEARCH) ||
+				(intp->symbol_rate[demod] < 10000000))
+			msleep(50);
+		else
+			msleep(5);
 
-			if ((i_params->chip_id >= 0x20) || (blindTunSw == 1)) {
-				if (i_params->dmd2_srch_algo != STV0900_WARM_START)
-					stv0900_set_bandwidth(fe, i_params->tuner2_bw);
-			}
+		stv0900_get_lock_timeout(&timed, &timef, srate,
+						STV0900_WARM_START);
 
-			if ((i_params->dmd2_srch_algo == STV0900_BLIND_SEARCH) || (i_params->dmd2_symbol_rate < 10000000))
-				msleep(50);
-			else
-				msleep(5);
-
-			stv0900_get_lock_timeout(&timed, &timef, srate, STV0900_WARM_START);
-			if (stv0900_get_demod_lock(i_params, demod, timed / 2) == FALSE) {
-				stv0900_write_reg(i_params, R0900_P2_DMDISTATE, 0x1F);
-				stv0900_write_reg(i_params, R0900_P2_CFRINIT1, freq1);
-				stv0900_write_reg(i_params, R0900_P2_CFRINIT0, freq0);
-				stv0900_write_reg(i_params, R0900_P2_DMDISTATE, 0x18);
-				i = 0;
-				while ((stv0900_get_demod_lock(i_params, demod, timed / 2) == FALSE) && (i <= 2)) {
-					stv0900_write_reg(i_params, R0900_P2_DMDISTATE, 0x1F);
-					stv0900_write_reg(i_params, R0900_P2_CFRINIT1, freq1);
-					stv0900_write_reg(i_params, R0900_P2_CFRINIT0, freq0);
-					stv0900_write_reg(i_params, R0900_P2_DMDISTATE, 0x18);
-					i++;
-				}
+		if (stv0900_get_demod_lock(intp, demod, timed / 2) == FALSE) {
+			stv0900_write_reg(intp, DMDISTATE, 0x1f);
+			stv0900_write_reg(intp, CFRINIT1, freq1);
+			stv0900_write_reg(intp, CFRINIT0, freq0);
+			stv0900_write_reg(intp, DMDISTATE, 0x18);
+			i = 0;
+			while ((stv0900_get_demod_lock(intp,
+							demod,
+							timed / 2) == FALSE) &&
+						(i <= 2)) {
+				stv0900_write_reg(intp, DMDISTATE, 0x1f);
+				stv0900_write_reg(intp, CFRINIT1, freq1);
+				stv0900_write_reg(intp, CFRINIT0, freq0);
+				stv0900_write_reg(intp, DMDISTATE, 0x18);
+				i++;
 			}
 		}
 
-		if (i_params->chip_id >= 0x20)
-			stv0900_write_reg(i_params, R0900_P2_CARFREQ, 0x49);
+	}
 
-		if ((i_params->dmd2_rslts.standard == STV0900_DVBS1_STANDARD) || (i_params->dmd2_rslts.standard == STV0900_DSS_STANDARD))
-			stv0900_set_viterbi_tracq(i_params, demod);
+	if (intp->chip_id >= 0x20)
+		stv0900_write_reg(intp, CARFREQ, 0x49);
+
+	if ((intp->result[demod].standard == STV0900_DVBS1_STANDARD) ||
+			(intp->result[demod].standard == STV0900_DSS_STANDARD))
+		stv0900_set_viterbi_tracq(intp, demod);
 
-		break;
-	}
 }
 
-static int stv0900_get_fec_lock(struct stv0900_internal *i_params, enum fe_stv0900_demod_num demod, s32 time_out)
+static int stv0900_get_fec_lock(struct stv0900_internal *intp,
+				enum fe_stv0900_demod_num demod, s32 time_out)
 {
-	s32 timer = 0, lock = 0, header_field, pktdelin_field, lock_vit_field;
+	s32 timer = 0, lock = 0;
 
 	enum fe_stv0900_search_state dmd_state;
 
-	dprintk(KERN_INFO "%s\n", __func__);
+	dprintk("%s\n", __func__);
 
-	dmd_reg(header_field, F0900_P1_HEADER_MODE, F0900_P2_HEADER_MODE);
-	dmd_reg(pktdelin_field, F0900_P1_PKTDELIN_LOCK, F0900_P2_PKTDELIN_LOCK);
-	dmd_reg(lock_vit_field, F0900_P1_LOCKEDVIT, F0900_P2_LOCKEDVIT);
-
-	dmd_state = stv0900_get_bits(i_params, header_field);
+	dmd_state = stv0900_get_bits(intp, HEADER_MODE);
 
 	while ((timer < time_out) && (lock == 0)) {
 		switch (dmd_state) {
@@ -1386,10 +1037,10 @@ static int stv0900_get_fec_lock(struct stv0900_internal *i_params, enum fe_stv09
 			lock = 0;
 			break;
 		case STV0900_DVBS2_FOUND:
-			lock = stv0900_get_bits(i_params, pktdelin_field);
+			lock = stv0900_get_bits(intp, PKTDELIN_LOCK);
 			break;
 		case STV0900_DVBS_FOUND:
-			lock = stv0900_get_bits(i_params, lock_vit_field);
+			lock = stv0900_get_bits(intp, LOCKEDVIT);
 			break;
 		}
 
@@ -1400,46 +1051,44 @@ static int stv0900_get_fec_lock(struct stv0900_internal *i_params, enum fe_stv09
 	}
 
 	if (lock)
-		dprintk("DEMOD FEC LOCK OK\n");
+		dprintk("%s: DEMOD FEC LOCK OK\n", __func__);
 	else
-		dprintk("DEMOD FEC LOCK FAIL\n");
+		dprintk("%s: DEMOD FEC LOCK FAIL\n", __func__);
 
 	return lock;
 }
 
-static int stv0900_wait_for_lock(struct stv0900_internal *i_params,
+static int stv0900_wait_for_lock(struct stv0900_internal *intp,
 				enum fe_stv0900_demod_num demod,
 				s32 dmd_timeout, s32 fec_timeout)
 {
 
-	s32 timer = 0, lock = 0, str_merg_rst_fld, str_merg_lock_fld;
-
-	dprintk(KERN_INFO "%s\n", __func__);
+	s32 timer = 0, lock = 0;
 
-	dmd_reg(str_merg_rst_fld, F0900_P1_RST_HWARE, F0900_P2_RST_HWARE);
-	dmd_reg(str_merg_lock_fld, F0900_P1_TSFIFO_LINEOK, F0900_P2_TSFIFO_LINEOK);
+	dprintk("%s\n", __func__);
 
-	lock = stv0900_get_demod_lock(i_params, demod, dmd_timeout);
+	lock = stv0900_get_demod_lock(intp, demod, dmd_timeout);
 
 	if (lock)
-		lock = lock && stv0900_get_fec_lock(i_params, demod, fec_timeout);
+		lock = lock && stv0900_get_fec_lock(intp, demod, fec_timeout);
 
 	if (lock) {
 		lock = 0;
 
-		dprintk(KERN_INFO "%s: Timer = %d, time_out = %d\n", __func__, timer, fec_timeout);
+		dprintk("%s: Timer = %d, time_out = %d\n",
+				__func__, timer, fec_timeout);
 
 		while ((timer < fec_timeout) && (lock == 0)) {
-			lock = stv0900_get_bits(i_params, str_merg_lock_fld);
+			lock = stv0900_get_bits(intp, TSFIFO_LINEOK);
 			msleep(1);
 			timer++;
 		}
 	}
 
 	if (lock)
-		dprintk(KERN_INFO "%s: DEMOD LOCK OK\n", __func__);
+		dprintk("%s: DEMOD LOCK OK\n", __func__);
 	else
-		dprintk(KERN_INFO "%s: DEMOD LOCK FAIL\n", __func__);
+		dprintk("%s: DEMOD LOCK FAIL\n", __func__);
 
 	if (lock)
 		return TRUE;
@@ -1451,43 +1100,43 @@ enum fe_stv0900_tracking_standard stv0900_get_standard(struct dvb_frontend *fe,
 						enum fe_stv0900_demod_num demod)
 {
 	struct stv0900_state *state = fe->demodulator_priv;
-	struct stv0900_internal *i_params = state->internal;
+	struct stv0900_internal *intp = state->internal;
 	enum fe_stv0900_tracking_standard fnd_standard;
-	s32 state_field,
-	dss_dvb_field;
 
-	dprintk(KERN_INFO "%s\n", __func__);
+	int hdr_mode = stv0900_get_bits(intp, HEADER_MODE);
 
-	dmd_reg(state_field, F0900_P1_HEADER_MODE, F0900_P2_HEADER_MODE);
-	dmd_reg(dss_dvb_field, F0900_P1_DSS_DVB, F0900_P2_DSS_DVB);
-
-	if (stv0900_get_bits(i_params, state_field) == 2)
+	switch (hdr_mode) {
+	case 2:
 		fnd_standard = STV0900_DVBS2_STANDARD;
-
-	else if (stv0900_get_bits(i_params, state_field) == 3) {
-		if (stv0900_get_bits(i_params, dss_dvb_field) == 1)
+		break;
+	case 3:
+		if (stv0900_get_bits(intp, DSS_DVB) == 1)
 			fnd_standard = STV0900_DSS_STANDARD;
 		else
 			fnd_standard = STV0900_DVBS1_STANDARD;
-	} else
+
+		break;
+	default:
 		fnd_standard = STV0900_UNKNOWN_STANDARD;
+	}
+
+	dprintk("%s: standard %d\n", __func__, fnd_standard);
 
 	return fnd_standard;
 }
 
-static s32 stv0900_get_carr_freq(struct stv0900_internal *i_params, u32 mclk,
+static s32 stv0900_get_carr_freq(struct stv0900_internal *intp, u32 mclk,
 					enum fe_stv0900_demod_num demod)
 {
-	s32 cfr_field2, cfr_field1, cfr_field0,
-		derot, rem1, rem2, intval1, intval2;
+	s32	derot,
+		rem1,
+		rem2,
+		intval1,
+		intval2;
 
-	dmd_reg(cfr_field2, F0900_P1_CAR_FREQ2, F0900_P2_CAR_FREQ2);
-	dmd_reg(cfr_field1, F0900_P1_CAR_FREQ1, F0900_P2_CAR_FREQ1);
-	dmd_reg(cfr_field0, F0900_P1_CAR_FREQ0, F0900_P2_CAR_FREQ0);
-
-	derot = (stv0900_get_bits(i_params, cfr_field2) << 16) +
-		(stv0900_get_bits(i_params, cfr_field1) << 8) +
-		(stv0900_get_bits(i_params, cfr_field0));
+	derot = (stv0900_get_bits(intp, CAR_FREQ2) << 16) +
+		(stv0900_get_bits(intp, CAR_FREQ1) << 8) +
+		(stv0900_get_bits(intp, CAR_FREQ0));
 
 	derot = ge2comp(derot, 24);
 	intval1 = mclk >> 12;
@@ -1505,7 +1154,7 @@ static u32 stv0900_get_tuner_freq(struct dvb_frontend *fe)
 {
 	struct dvb_frontend_ops	*frontend_ops = NULL;
 	struct dvb_tuner_ops *tuner_ops = NULL;
-	u32 frequency = 0;
+	u32 freq = 0;
 
 	if (&fe->ops)
 		frontend_ops = &fe->ops;
@@ -1514,304 +1163,159 @@ static u32 stv0900_get_tuner_freq(struct dvb_frontend *fe)
 		tuner_ops = &frontend_ops->tuner_ops;
 
 	if (tuner_ops->get_frequency) {
-		if ((tuner_ops->get_frequency(fe, &frequency)) < 0)
+		if ((tuner_ops->get_frequency(fe, &freq)) < 0)
 			dprintk("%s: Invalid parameter\n", __func__);
 		else
-			dprintk("%s: Frequency=%d\n", __func__, frequency);
-
-	}
-
-	return frequency;
-}
-
-static enum fe_stv0900_fec stv0900_get_vit_fec(struct stv0900_internal *i_params,
-						enum fe_stv0900_demod_num demod)
-{
-	s32 rate_fld, vit_curpun_fld;
-	enum fe_stv0900_fec prate;
+			dprintk("%s: Frequency=%d\n", __func__, freq);
 
-	dmd_reg(vit_curpun_fld, F0900_P1_VIT_CURPUN, F0900_P2_VIT_CURPUN);
-	rate_fld = stv0900_get_bits(i_params, vit_curpun_fld);
-
-	switch (rate_fld) {
-	case 13:
-		prate = STV0900_FEC_1_2;
-		break;
-	case 18:
-		prate = STV0900_FEC_2_3;
-		break;
-	case 21:
-		prate = STV0900_FEC_3_4;
-		break;
-	case 24:
-		prate = STV0900_FEC_5_6;
-		break;
-	case 25:
-		prate = STV0900_FEC_6_7;
-		break;
-	case 26:
-		prate = STV0900_FEC_7_8;
-		break;
-	default:
-		prate = STV0900_FEC_UNKNOWN;
-		break;
 	}
 
-	return prate;
+	return freq;
 }
 
-static enum fe_stv0900_signal_type stv0900_get_signal_params(struct dvb_frontend *fe)
+static enum
+fe_stv0900_signal_type stv0900_get_signal_params(struct dvb_frontend *fe)
 {
 	struct stv0900_state *state = fe->demodulator_priv;
-	struct stv0900_internal *i_params = state->internal;
+	struct stv0900_internal *intp = state->internal;
 	enum fe_stv0900_demod_num demod = state->demod;
 	enum fe_stv0900_signal_type range = STV0900_OUTOFRANGE;
-	s32 offsetFreq,
-	srate_offset,
-	i = 0;
+	struct stv0900_signal_info *result = &intp->result[demod];
+	s32	offsetFreq,
+		srate_offset;
+	int	i = 0,
+		d = demod;
 
 	u8 timing;
 
 	msleep(5);
-	switch (demod) {
-	case STV0900_DEMOD_1:
-	default:
-		if (i_params->dmd1_srch_algo == STV0900_BLIND_SEARCH) {
-			timing = stv0900_read_reg(i_params, R0900_P1_TMGREG2);
-			i = 0;
-			stv0900_write_reg(i_params, R0900_P1_SFRSTEP, 0x5c);
-
-			while ((i <= 50) && (timing != 0) && (timing != 0xFF)) {
-				timing = stv0900_read_reg(i_params, R0900_P1_TMGREG2);
-				msleep(5);
-				i += 5;
-			}
+	if (intp->srch_algo[d] == STV0900_BLIND_SEARCH) {
+		timing = stv0900_read_reg(intp, TMGREG2);
+		i = 0;
+		stv0900_write_reg(intp, SFRSTEP, 0x5c);
+
+		while ((i <= 50) && (timing != 0) && (timing != 0xff)) {
+			timing = stv0900_read_reg(intp, TMGREG2);
+			msleep(5);
+			i += 5;
 		}
+	}
 
-		i_params->dmd1_rslts.standard = stv0900_get_standard(fe, demod);
-		i_params->dmd1_rslts.frequency = stv0900_get_tuner_freq(fe);
-		offsetFreq = stv0900_get_carr_freq(i_params, i_params->mclk, demod) / 1000;
-		i_params->dmd1_rslts.frequency += offsetFreq;
-		i_params->dmd1_rslts.symbol_rate = stv0900_get_symbol_rate(i_params, i_params->mclk, demod);
-		srate_offset = stv0900_get_timing_offst(i_params, i_params->dmd1_rslts.symbol_rate, demod);
-		i_params->dmd1_rslts.symbol_rate += srate_offset;
-		i_params->dmd1_rslts.fec = stv0900_get_vit_fec(i_params, demod);
-		i_params->dmd1_rslts.modcode = stv0900_get_bits(i_params, F0900_P1_DEMOD_MODCOD);
-		i_params->dmd1_rslts.pilot = stv0900_get_bits(i_params, F0900_P1_DEMOD_TYPE) & 0x01;
-		i_params->dmd1_rslts.frame_length = ((u32)stv0900_get_bits(i_params, F0900_P1_DEMOD_TYPE)) >> 1;
-		i_params->dmd1_rslts.rolloff = stv0900_get_bits(i_params, F0900_P1_ROLLOFF_STATUS);
-		switch (i_params->dmd1_rslts.standard) {
-		case STV0900_DVBS2_STANDARD:
-			i_params->dmd1_rslts.spectrum = stv0900_get_bits(i_params, F0900_P1_SPECINV_DEMOD);
-			if (i_params->dmd1_rslts.modcode <= STV0900_QPSK_910)
-				i_params->dmd1_rslts.modulation = STV0900_QPSK;
-			else if (i_params->dmd1_rslts.modcode <= STV0900_8PSK_910)
-				i_params->dmd1_rslts.modulation = STV0900_8PSK;
-			else if (i_params->dmd1_rslts.modcode <= STV0900_16APSK_910)
-				i_params->dmd1_rslts.modulation = STV0900_16APSK;
-			else if (i_params->dmd1_rslts.modcode <= STV0900_32APSK_910)
-				i_params->dmd1_rslts.modulation = STV0900_32APSK;
-			else
-				i_params->dmd1_rslts.modulation = STV0900_UNKNOWN;
-			break;
-		case STV0900_DVBS1_STANDARD:
-		case STV0900_DSS_STANDARD:
-			i_params->dmd1_rslts.spectrum = stv0900_get_bits(i_params, F0900_P1_IQINV);
-			i_params->dmd1_rslts.modulation = STV0900_QPSK;
-			break;
-		default:
-			break;
-		}
-
-		if ((i_params->dmd1_srch_algo == STV0900_BLIND_SEARCH) || (i_params->dmd1_symbol_rate < 10000000)) {
-			offsetFreq =	i_params->dmd1_rslts.frequency - i_params->tuner1_freq;
-			i_params->tuner1_freq = stv0900_get_tuner_freq(fe);
-			if (ABS(offsetFreq) <= ((i_params->dmd1_srch_range / 2000) + 500))
-				range = STV0900_RANGEOK;
-			else
-				if (ABS(offsetFreq) <= (stv0900_carrier_width(i_params->dmd1_rslts.symbol_rate, i_params->dmd1_rslts.rolloff) / 2000))
-					range = STV0900_RANGEOK;
-				else
-					range = STV0900_OUTOFRANGE;
-
-		} else {
-			if (ABS(offsetFreq) <= ((i_params->dmd1_srch_range / 2000) + 500))
-				range = STV0900_RANGEOK;
-			else
-				range = STV0900_OUTOFRANGE;
-		}
+	result->standard = stv0900_get_standard(fe, d);
+	result->frequency = stv0900_get_tuner_freq(fe);
+	offsetFreq = stv0900_get_carr_freq(intp, intp->mclk, d) / 1000;
+	result->frequency += offsetFreq;
+	result->symbol_rate = stv0900_get_symbol_rate(intp, intp->mclk, d);
+	srate_offset = stv0900_get_timing_offst(intp, result->symbol_rate, d);
+	result->symbol_rate += srate_offset;
+	result->fec = stv0900_get_vit_fec(intp, d);
+	result->modcode = stv0900_get_bits(intp, DEMOD_MODCOD);
+	result->pilot = stv0900_get_bits(intp, DEMOD_TYPE) & 0x01;
+	result->frame_len = ((u32)stv0900_get_bits(intp, DEMOD_TYPE)) >> 1;
+	result->rolloff = stv0900_get_bits(intp, ROLLOFF_STATUS);
+	switch (result->standard) {
+	case STV0900_DVBS2_STANDARD:
+		result->spectrum = stv0900_get_bits(intp, SPECINV_DEMOD);
+		if (result->modcode <= STV0900_QPSK_910)
+			result->modulation = STV0900_QPSK;
+		else if (result->modcode <= STV0900_8PSK_910)
+			result->modulation = STV0900_8PSK;
+		else if (result->modcode <= STV0900_16APSK_910)
+			result->modulation = STV0900_16APSK;
+		else if (result->modcode <= STV0900_32APSK_910)
+			result->modulation = STV0900_32APSK;
+		else
+			result->modulation = STV0900_UNKNOWN;
 		break;
-	case STV0900_DEMOD_2:
-		if (i_params->dmd2_srch_algo == STV0900_BLIND_SEARCH) {
-			timing = stv0900_read_reg(i_params, R0900_P2_TMGREG2);
-			i = 0;
-			stv0900_write_reg(i_params, R0900_P2_SFRSTEP, 0x5c);
-
-			while ((i <= 50) && (timing != 0) && (timing != 0xff)) {
-				timing = stv0900_read_reg(i_params, R0900_P2_TMGREG2);
-				msleep(5);
-				i += 5;
-			}
-		}
-
-		i_params->dmd2_rslts.standard = stv0900_get_standard(fe, demod);
-		i_params->dmd2_rslts.frequency = stv0900_get_tuner_freq(fe);
-		offsetFreq = stv0900_get_carr_freq(i_params, i_params->mclk, demod) / 1000;
-		i_params->dmd2_rslts.frequency += offsetFreq;
-		i_params->dmd2_rslts.symbol_rate = stv0900_get_symbol_rate(i_params, i_params->mclk, demod);
-		srate_offset = stv0900_get_timing_offst(i_params, i_params->dmd2_rslts.symbol_rate, demod);
-		i_params->dmd2_rslts.symbol_rate += srate_offset;
-		i_params->dmd2_rslts.fec = stv0900_get_vit_fec(i_params, demod);
-		i_params->dmd2_rslts.modcode = stv0900_get_bits(i_params, F0900_P2_DEMOD_MODCOD);
-		i_params->dmd2_rslts.pilot = stv0900_get_bits(i_params, F0900_P2_DEMOD_TYPE) & 0x01;
-		i_params->dmd2_rslts.frame_length = ((u32)stv0900_get_bits(i_params, F0900_P2_DEMOD_TYPE)) >> 1;
-		i_params->dmd2_rslts.rolloff = stv0900_get_bits(i_params, F0900_P2_ROLLOFF_STATUS);
-		switch (i_params->dmd2_rslts.standard) {
-		case STV0900_DVBS2_STANDARD:
-			i_params->dmd2_rslts.spectrum = stv0900_get_bits(i_params, F0900_P2_SPECINV_DEMOD);
-			if (i_params->dmd2_rslts.modcode <= STV0900_QPSK_910)
-				i_params->dmd2_rslts.modulation = STV0900_QPSK;
-			else if (i_params->dmd2_rslts.modcode <= STV0900_8PSK_910)
-				i_params->dmd2_rslts.modulation = STV0900_8PSK;
-			else if (i_params->dmd2_rslts.modcode <= STV0900_16APSK_910)
-				i_params->dmd2_rslts.modulation = STV0900_16APSK;
-			else if (i_params->dmd2_rslts.modcode <= STV0900_32APSK_910)
-				i_params->dmd2_rslts.modulation = STV0900_32APSK;
-			else
-				i_params->dmd2_rslts.modulation = STV0900_UNKNOWN;
-			break;
-		case STV0900_DVBS1_STANDARD:
-		case STV0900_DSS_STANDARD:
-			i_params->dmd2_rslts.spectrum = stv0900_get_bits(i_params, F0900_P2_IQINV);
-			i_params->dmd2_rslts.modulation = STV0900_QPSK;
-			break;
-		default:
-			break;
-		}
+	case STV0900_DVBS1_STANDARD:
+	case STV0900_DSS_STANDARD:
+		result->spectrum = stv0900_get_bits(intp, IQINV);
+		result->modulation = STV0900_QPSK;
+		break;
+	default:
+		break;
+	}
 
-		if ((i_params->dmd2_srch_algo == STV0900_BLIND_SEARCH) || (i_params->dmd2_symbol_rate < 10000000)) {
-			offsetFreq =	i_params->dmd2_rslts.frequency - i_params->tuner2_freq;
-			i_params->tuner2_freq = stv0900_get_tuner_freq(fe);
+	if ((intp->srch_algo[d] == STV0900_BLIND_SEARCH) ||
+				(intp->symbol_rate[d] < 10000000)) {
+		offsetFreq = result->frequency - intp->freq[d];
+		intp->freq[d] = stv0900_get_tuner_freq(fe);
+		if (ABS(offsetFreq) <= ((intp->srch_range[d] / 2000) + 500))
+			range = STV0900_RANGEOK;
+		else if (ABS(offsetFreq) <=
+				(stv0900_carrier_width(result->symbol_rate,
+						result->rolloff) / 2000))
+			range = STV0900_RANGEOK;
 
-			if (ABS(offsetFreq) <= ((i_params->dmd2_srch_range / 2000) + 500))
-				range = STV0900_RANGEOK;
-			else
-				if (ABS(offsetFreq) <= (stv0900_carrier_width(i_params->dmd2_rslts.symbol_rate, i_params->dmd2_rslts.rolloff) / 2000))
-					range = STV0900_RANGEOK;
-				else
-					range = STV0900_OUTOFRANGE;
-		} else {
-			if (ABS(offsetFreq) <= ((i_params->dmd2_srch_range / 2000) + 500))
-				range = STV0900_RANGEOK;
-			else
-				range = STV0900_OUTOFRANGE;
-		}
+	} else if (ABS(offsetFreq) <= ((intp->srch_range[d] / 2000) + 500))
+		range = STV0900_RANGEOK;
 
-		break;
-	}
+	dprintk("%s: range %d\n", __func__, range);
 
 	return range;
 }
 
-static enum fe_stv0900_signal_type stv0900_dvbs1_acq_workaround(struct dvb_frontend *fe)
+static enum
+fe_stv0900_signal_type stv0900_dvbs1_acq_workaround(struct dvb_frontend *fe)
 {
 	struct stv0900_state *state = fe->demodulator_priv;
-	struct stv0900_internal *i_params = state->internal;
+	struct stv0900_internal *intp = state->internal;
 	enum fe_stv0900_demod_num demod = state->demod;
-
-	s32 srate, demod_timeout,
-		fec_timeout, freq1, freq0;
 	enum fe_stv0900_signal_type signal_type = STV0900_NODATA;
 
-	switch (demod) {
-	case STV0900_DEMOD_1:
-	default:
-		i_params->dmd1_rslts.locked = FALSE;
-		if (stv0900_get_bits(i_params, F0900_P1_HEADER_MODE) == STV0900_DVBS_FOUND) {
-			srate = stv0900_get_symbol_rate(i_params, i_params->mclk, demod);
-			srate += stv0900_get_timing_offst(i_params, srate, demod);
-			if (i_params->dmd1_srch_algo == STV0900_BLIND_SEARCH)
-				stv0900_set_symbol_rate(i_params, i_params->mclk, srate, demod);
-
-			stv0900_get_lock_timeout(&demod_timeout, &fec_timeout, srate, STV0900_WARM_START);
-			freq1 = stv0900_read_reg(i_params, R0900_P1_CFR2);
-			freq0 = stv0900_read_reg(i_params, R0900_P1_CFR1);
-			stv0900_write_bits(i_params, F0900_P1_CFR_AUTOSCAN, 0);
-			stv0900_write_bits(i_params, F0900_P1_SPECINV_CONTROL, STV0900_IQ_FORCE_SWAPPED);
-			stv0900_write_reg(i_params, R0900_P1_DMDISTATE, 0x1C);
-			stv0900_write_reg(i_params, R0900_P1_CFRINIT1, freq1);
-			stv0900_write_reg(i_params, R0900_P1_CFRINIT0, freq0);
-			stv0900_write_reg(i_params, R0900_P1_DMDISTATE, 0x18);
-			if (stv0900_wait_for_lock(i_params, demod, demod_timeout, fec_timeout) == TRUE) {
-				i_params->dmd1_rslts.locked = TRUE;
-				signal_type = stv0900_get_signal_params(fe);
-				stv0900_track_optimization(fe);
-			} else {
-				stv0900_write_bits(i_params, F0900_P1_SPECINV_CONTROL, STV0900_IQ_FORCE_NORMAL);
-				stv0900_write_reg(i_params, R0900_P1_DMDISTATE, 0x1c);
-				stv0900_write_reg(i_params, R0900_P1_CFRINIT1, freq1);
-				stv0900_write_reg(i_params, R0900_P1_CFRINIT0, freq0);
-				stv0900_write_reg(i_params, R0900_P1_DMDISTATE, 0x18);
-				if (stv0900_wait_for_lock(i_params, demod, demod_timeout, fec_timeout) == TRUE) {
-					i_params->dmd1_rslts.locked = TRUE;
-					signal_type = stv0900_get_signal_params(fe);
-					stv0900_track_optimization(fe);
-				}
-
-			}
-
-		} else
-			i_params->dmd1_rslts.locked = FALSE;
-
-		break;
-	case STV0900_DEMOD_2:
-		i_params->dmd2_rslts.locked = FALSE;
-		if (stv0900_get_bits(i_params, F0900_P2_HEADER_MODE) == STV0900_DVBS_FOUND) {
-			srate = stv0900_get_symbol_rate(i_params, i_params->mclk, demod);
-			srate += stv0900_get_timing_offst(i_params, srate, demod);
-
-			if (i_params->dmd2_srch_algo == STV0900_BLIND_SEARCH)
-				stv0900_set_symbol_rate(i_params, i_params->mclk, srate, demod);
-
-			stv0900_get_lock_timeout(&demod_timeout, &fec_timeout, srate, STV0900_WARM_START);
-			freq1 = stv0900_read_reg(i_params, R0900_P2_CFR2);
-			freq0 = stv0900_read_reg(i_params, R0900_P2_CFR1);
-			stv0900_write_bits(i_params, F0900_P2_CFR_AUTOSCAN, 0);
-			stv0900_write_bits(i_params, F0900_P2_SPECINV_CONTROL, STV0900_IQ_FORCE_SWAPPED);
-			stv0900_write_reg(i_params, R0900_P2_DMDISTATE, 0x1C);
-			stv0900_write_reg(i_params, R0900_P2_CFRINIT1, freq1);
-			stv0900_write_reg(i_params, R0900_P2_CFRINIT0, freq0);
-			stv0900_write_reg(i_params, R0900_P2_DMDISTATE, 0x18);
-
-			if (stv0900_wait_for_lock(i_params, demod, demod_timeout, fec_timeout) == TRUE) {
-				i_params->dmd2_rslts.locked = TRUE;
+	s32	srate,
+		demod_timeout,
+		fec_timeout,
+		freq1,
+		freq0;
+
+	intp->result[demod].locked = FALSE;
+
+	if (stv0900_get_bits(intp, HEADER_MODE) == STV0900_DVBS_FOUND) {
+		srate = stv0900_get_symbol_rate(intp, intp->mclk, demod);
+		srate += stv0900_get_timing_offst(intp, srate, demod);
+		if (intp->srch_algo[demod] == STV0900_BLIND_SEARCH)
+			stv0900_set_symbol_rate(intp, intp->mclk, srate, demod);
+
+		stv0900_get_lock_timeout(&demod_timeout, &fec_timeout,
+					srate, STV0900_WARM_START);
+		freq1 = stv0900_read_reg(intp, CFR2);
+		freq0 = stv0900_read_reg(intp, CFR1);
+		stv0900_write_bits(intp, CFR_AUTOSCAN, 0);
+		stv0900_write_bits(intp, SPECINV_CONTROL,
+					STV0900_IQ_FORCE_SWAPPED);
+		stv0900_write_reg(intp, DMDISTATE, 0x1c);
+		stv0900_write_reg(intp, CFRINIT1, freq1);
+		stv0900_write_reg(intp, CFRINIT0, freq0);
+		stv0900_write_reg(intp, DMDISTATE, 0x18);
+		if (stv0900_wait_for_lock(intp, demod,
+				demod_timeout, fec_timeout) == TRUE) {
+			intp->result[demod].locked = TRUE;
+			signal_type = stv0900_get_signal_params(fe);
+			stv0900_track_optimization(fe);
+		} else {
+			stv0900_write_bits(intp, SPECINV_CONTROL,
+					STV0900_IQ_FORCE_NORMAL);
+			stv0900_write_reg(intp, DMDISTATE, 0x1c);
+			stv0900_write_reg(intp, CFRINIT1, freq1);
+			stv0900_write_reg(intp, CFRINIT0, freq0);
+			stv0900_write_reg(intp, DMDISTATE, 0x18);
+			if (stv0900_wait_for_lock(intp, demod,
+					demod_timeout, fec_timeout) == TRUE) {
+				intp->result[demod].locked = TRUE;
 				signal_type = stv0900_get_signal_params(fe);
 				stv0900_track_optimization(fe);
-			} else {
-				stv0900_write_bits(i_params, F0900_P2_SPECINV_CONTROL, STV0900_IQ_FORCE_NORMAL);
-				stv0900_write_reg(i_params, R0900_P2_DMDISTATE, 0x1c);
-				stv0900_write_reg(i_params, R0900_P2_CFRINIT1, freq1);
-				stv0900_write_reg(i_params, R0900_P2_CFRINIT0, freq0);
-				stv0900_write_reg(i_params, R0900_P2_DMDISTATE, 0x18);
-
-				if (stv0900_wait_for_lock(i_params, demod, demod_timeout, fec_timeout) == TRUE) {
-					i_params->dmd2_rslts.locked = TRUE;
-					signal_type = stv0900_get_signal_params(fe);
-					stv0900_track_optimization(fe);
-				}
-
 			}
 
-		} else
-			i_params->dmd1_rslts.locked = FALSE;
+		}
 
-		break;
-	}
+	} else
+		intp->result[demod].locked = FALSE;
 
 	return signal_type;
 }
 
-static u16 stv0900_blind_check_agc2_min_level(struct stv0900_internal *i_params,
+static u16 stv0900_blind_check_agc2_min_level(struct stv0900_internal *intp,
 					enum fe_stv0900_demod_num demod)
 {
 	u32 minagc2level = 0xffff,
@@ -1820,105 +1324,54 @@ static u16 stv0900_blind_check_agc2_min_level(struct stv0900_internal *i_params,
 
 	s32 i, j, nb_steps, direction;
 
-	dprintk(KERN_INFO "%s\n", __func__);
-
-	switch (demod) {
-	case STV0900_DEMOD_1:
-	default:
-		stv0900_write_reg(i_params, R0900_P1_AGC2REF, 0x38);
-		stv0900_write_bits(i_params, F0900_P1_SCAN_ENABLE, 1);
-		stv0900_write_bits(i_params, F0900_P1_CFR_AUTOSCAN, 1);
-
-		stv0900_write_reg(i_params, R0900_P1_SFRUP1, 0x83);
-		stv0900_write_reg(i_params, R0900_P1_SFRUP0, 0xc0);
-
-		stv0900_write_reg(i_params, R0900_P1_SFRLOW1, 0x82);
-		stv0900_write_reg(i_params, R0900_P1_SFRLOW0, 0xa0);
-		stv0900_write_reg(i_params, R0900_P1_DMDT0M, 0x0);
+	dprintk("%s\n", __func__);
 
-		stv0900_set_symbol_rate(i_params, i_params->mclk, 1000000, demod);
-		nb_steps = -1 + (i_params->dmd1_srch_range / 1000000);
-		nb_steps /= 2;
-		nb_steps = (2 * nb_steps) + 1;
+	stv0900_write_reg(intp, AGC2REF, 0x38);
+	stv0900_write_bits(intp, SCAN_ENABLE, 0);
+	stv0900_write_bits(intp, CFR_AUTOSCAN, 0);
 
-		if (nb_steps < 0)
-			nb_steps = 1;
+	stv0900_write_bits(intp, AUTO_GUP, 1);
+	stv0900_write_bits(intp, AUTO_GLOW, 1);
 
-		direction = 1;
+	stv0900_write_reg(intp, DMDT0M, 0x0);
 
-		freq_step = (1000000 << 8) / (i_params->mclk >> 8);
+	stv0900_set_symbol_rate(intp, intp->mclk, 1000000, demod);
+	nb_steps = -1 + (intp->srch_range[demod] / 1000000);
+	nb_steps /= 2;
+	nb_steps = (2 * nb_steps) + 1;
 
-		init_freq = 0;
+	if (nb_steps < 0)
+		nb_steps = 1;
 
-		for (i = 0; i < nb_steps; i++) {
-			if (direction > 0)
-				init_freq = init_freq + (freq_step * i);
-			else
-				init_freq = init_freq - (freq_step * i);
+	direction = 1;
 
-			direction *= -1;
-			stv0900_write_reg(i_params, R0900_P1_DMDISTATE, 0x5C);
-			stv0900_write_reg(i_params, R0900_P1_CFRINIT1, (init_freq >> 8) & 0xff);
-			stv0900_write_reg(i_params, R0900_P1_CFRINIT0, init_freq  & 0xff);
-			stv0900_write_reg(i_params, R0900_P1_DMDISTATE, 0x58);
-			msleep(10);
-			agc2level = 0;
+	freq_step = (1000000 << 8) / (intp->mclk >> 8);
 
-			for (j = 0; j < 10; j++)
-				agc2level += (stv0900_read_reg(i_params, R0900_P1_AGC2I1) << 8)
-						| stv0900_read_reg(i_params, R0900_P1_AGC2I0);
+	init_freq = 0;
 
-			agc2level /= 10;
-
-			if (agc2level < minagc2level)
-				minagc2level = agc2level;
-		}
-		break;
-	case STV0900_DEMOD_2:
-		stv0900_write_reg(i_params, R0900_P2_AGC2REF, 0x38);
-		stv0900_write_bits(i_params, F0900_P2_SCAN_ENABLE, 1);
-		stv0900_write_bits(i_params, F0900_P2_CFR_AUTOSCAN, 1);
-		stv0900_write_reg(i_params, R0900_P2_SFRUP1, 0x83);
-		stv0900_write_reg(i_params, R0900_P2_SFRUP0, 0xc0);
-		stv0900_write_reg(i_params, R0900_P2_SFRLOW1, 0x82);
-		stv0900_write_reg(i_params, R0900_P2_SFRLOW0, 0xa0);
-		stv0900_write_reg(i_params, R0900_P2_DMDT0M, 0x0);
-		stv0900_set_symbol_rate(i_params, i_params->mclk, 1000000, demod);
-		nb_steps = -1 + (i_params->dmd2_srch_range / 1000000);
-		nb_steps /= 2;
-		nb_steps = (2 * nb_steps) + 1;
-
-		if (nb_steps < 0)
-			nb_steps = 1;
-
-		direction = 1;
-		freq_step = (1000000 << 8) / (i_params->mclk >> 8);
-		init_freq = 0;
-		for (i = 0; i < nb_steps; i++) {
-			if (direction > 0)
-				init_freq = init_freq + (freq_step * i);
-			else
-				init_freq = init_freq - (freq_step * i);
+	for (i = 0; i < nb_steps; i++) {
+		if (direction > 0)
+			init_freq = init_freq + (freq_step * i);
+		else
+			init_freq = init_freq - (freq_step * i);
 
-			direction *= -1;
+		direction *= -1;
+		stv0900_write_reg(intp, DMDISTATE, 0x5C);
+		stv0900_write_reg(intp, CFRINIT1, (init_freq >> 8) & 0xff);
+		stv0900_write_reg(intp, CFRINIT0, init_freq  & 0xff);
+		stv0900_write_reg(intp, DMDISTATE, 0x58);
+		msleep(10);
+		agc2level = 0;
 
-			stv0900_write_reg(i_params, R0900_P2_DMDISTATE, 0x5C);
-			stv0900_write_reg(i_params, R0900_P2_CFRINIT1, (init_freq >> 8) & 0xff);
-			stv0900_write_reg(i_params, R0900_P2_CFRINIT0, init_freq  & 0xff);
-			stv0900_write_reg(i_params, R0900_P2_DMDISTATE, 0x58);
+		for (j = 0; j < 10; j++)
+			agc2level += (stv0900_read_reg(intp, AGC2I1) << 8)
+					| stv0900_read_reg(intp, AGC2I0);
 
-			msleep(10);
-			agc2level = 0;
-			for (j = 0; j < 10; j++)
-				agc2level += (stv0900_read_reg(i_params, R0900_P2_AGC2I1) << 8)
-						| stv0900_read_reg(i_params, R0900_P2_AGC2I0);
+		agc2level /= 10;
 
-			agc2level /= 10;
+		if (agc2level < minagc2level)
+			minagc2level = agc2level;
 
-			if (agc2level < minagc2level)
-				minagc2level = agc2level;
-		}
-		break;
 	}
 
 	return (u16)minagc2level;
@@ -1927,336 +1380,192 @@ static u16 stv0900_blind_check_agc2_min_level(struct stv0900_internal *i_params,
 static u32 stv0900_search_srate_coarse(struct dvb_frontend *fe)
 {
 	struct stv0900_state *state = fe->demodulator_priv;
-	struct stv0900_internal *i_params = state->internal;
+	struct stv0900_internal *intp = state->internal;
 	enum fe_stv0900_demod_num demod = state->demod;
-	int timingLock = FALSE;
+	int timing_lck = FALSE;
 	s32 i, timingcpt = 0,
 		direction = 1,
 		nb_steps,
 		current_step = 0,
 		tuner_freq;
+	u32 agc2_th,
+		coarse_srate = 0,
+		agc2_integr = 0,
+		currier_step = 1200;
 
-	u32 coarse_srate = 0, agc2_integr = 0, currier_step = 1200;
-
-	switch (demod) {
-	case STV0900_DEMOD_1:
-	default:
-		stv0900_write_bits(i_params, F0900_P1_I2C_DEMOD_MODE, 0x1F);
-		stv0900_write_reg(i_params, R0900_P1_TMGCFG, 0x12);
-		stv0900_write_reg(i_params, R0900_P1_TMGTHRISE, 0xf0);
-		stv0900_write_reg(i_params, R0900_P1_TMGTHFALL, 0xe0);
-		stv0900_write_bits(i_params, F0900_P1_SCAN_ENABLE, 1);
-		stv0900_write_bits(i_params, F0900_P1_CFR_AUTOSCAN, 1);
-		stv0900_write_reg(i_params, R0900_P1_SFRUP1, 0x83);
-		stv0900_write_reg(i_params, R0900_P1_SFRUP0, 0xc0);
-		stv0900_write_reg(i_params, R0900_P1_SFRLOW1, 0x82);
-		stv0900_write_reg(i_params, R0900_P1_SFRLOW0, 0xa0);
-		stv0900_write_reg(i_params, R0900_P1_DMDT0M, 0x0);
-		stv0900_write_reg(i_params, R0900_P1_AGC2REF, 0x50);
-
-		if (i_params->chip_id >= 0x20) {
-			stv0900_write_reg(i_params, R0900_P1_CARFREQ, 0x6a);
-			stv0900_write_reg(i_params, R0900_P1_SFRSTEP, 0x95);
-		} else {
-			stv0900_write_reg(i_params, R0900_P1_CARFREQ, 0xed);
-			stv0900_write_reg(i_params, R0900_P1_SFRSTEP, 0x73);
-		}
+	if (intp->chip_id >= 0x30)
+		agc2_th = 0x2e00;
+	else
+		agc2_th = 0x1f00;
+
+	stv0900_write_bits(intp, DEMOD_MODE, 0x1f);
+	stv0900_write_reg(intp, TMGCFG, 0x12);
+	stv0900_write_reg(intp, TMGTHRISE, 0xf0);
+	stv0900_write_reg(intp, TMGTHFALL, 0xe0);
+	stv0900_write_bits(intp, SCAN_ENABLE, 1);
+	stv0900_write_bits(intp, CFR_AUTOSCAN, 1);
+	stv0900_write_reg(intp, SFRUP1, 0x83);
+	stv0900_write_reg(intp, SFRUP0, 0xc0);
+	stv0900_write_reg(intp, SFRLOW1, 0x82);
+	stv0900_write_reg(intp, SFRLOW0, 0xa0);
+	stv0900_write_reg(intp, DMDT0M, 0x0);
+	stv0900_write_reg(intp, AGC2REF, 0x50);
+
+	if (intp->chip_id >= 0x30) {
+		stv0900_write_reg(intp, CARFREQ, 0x99);
+		stv0900_write_reg(intp, SFRSTEP, 0x98);
+	} else if (intp->chip_id >= 0x20) {
+		stv0900_write_reg(intp, CARFREQ, 0x6a);
+		stv0900_write_reg(intp, SFRSTEP, 0x95);
+	} else {
+		stv0900_write_reg(intp, CARFREQ, 0xed);
+		stv0900_write_reg(intp, SFRSTEP, 0x73);
+	}
 
-		if (i_params->dmd1_symbol_rate <= 2000000)
-			currier_step = 1000;
-		else if (i_params->dmd1_symbol_rate <= 5000000)
-			currier_step = 2000;
-		else if (i_params->dmd1_symbol_rate <= 12000000)
-			currier_step = 3000;
-		else
+	if (intp->symbol_rate[demod] <= 2000000)
+		currier_step = 1000;
+	else if (intp->symbol_rate[demod] <= 5000000)
+		currier_step = 2000;
+	else if (intp->symbol_rate[demod] <= 12000000)
+		currier_step = 3000;
+	else
 			currier_step = 5000;
 
-		nb_steps = -1 + ((i_params->dmd1_srch_range / 1000) / currier_step);
-		nb_steps /= 2;
-		nb_steps = (2 * nb_steps) + 1;
-
-		if (nb_steps < 0)
-			nb_steps = 1;
-
-		else if (nb_steps > 10) {
-			nb_steps = 11;
-			currier_step = (i_params->dmd1_srch_range / 1000) / 10;
-		}
-
-		current_step = 0;
-
-		direction = 1;
-		tuner_freq = i_params->tuner1_freq;
-
-		while ((timingLock == FALSE) && (current_step < nb_steps)) {
-			stv0900_write_reg(i_params, R0900_P1_DMDISTATE, 0x5F);
-			stv0900_write_bits(i_params, F0900_P1_I2C_DEMOD_MODE, 0x0);
-
-			msleep(50);
-
-			for (i = 0; i < 10; i++) {
-				if (stv0900_get_bits(i_params, F0900_P1_TMGLOCK_QUALITY) >= 2)
-					timingcpt++;
-
-				agc2_integr += (stv0900_read_reg(i_params, R0900_P1_AGC2I1) << 8) | stv0900_read_reg(i_params, R0900_P1_AGC2I0);
-
-			}
+	nb_steps = -1 + ((intp->srch_range[demod] / 1000) / currier_step);
+	nb_steps /= 2;
+	nb_steps = (2 * nb_steps) + 1;
 
-			agc2_integr /= 10;
-			coarse_srate = stv0900_get_symbol_rate(i_params, i_params->mclk, demod);
-			current_step++;
-			direction *= -1;
+	if (nb_steps < 0)
+		nb_steps = 1;
+	else if (nb_steps > 10) {
+		nb_steps = 11;
+		currier_step = (intp->srch_range[demod] / 1000) / 10;
+	}
 
-			dprintk("lock: I2C_DEMOD_MODE_FIELD =0. Search started. tuner freq=%d agc2=0x%x srate_coarse=%d tmg_cpt=%d\n", tuner_freq, agc2_integr, coarse_srate, timingcpt);
+	current_step = 0;
+	direction = 1;
 
-			if ((timingcpt >= 5) && (agc2_integr < 0x1F00) && (coarse_srate < 55000000) && (coarse_srate > 850000)) {
-				timingLock = TRUE;
-			}
+	tuner_freq = intp->freq[demod];
 
-			else if (current_step < nb_steps) {
-				if (direction > 0)
-					tuner_freq += (current_step * currier_step);
-				else
-					tuner_freq -= (current_step * currier_step);
+	while ((timing_lck == FALSE) && (current_step < nb_steps)) {
+		stv0900_write_reg(intp, DMDISTATE, 0x5f);
+		stv0900_write_bits(intp, DEMOD_MODE, 0);
 
-				stv0900_set_tuner(fe, tuner_freq, i_params->tuner1_bw);
-			}
-		}
+		msleep(50);
 
-		if (timingLock == FALSE)
-			coarse_srate = 0;
-		else
-			coarse_srate = stv0900_get_symbol_rate(i_params, i_params->mclk, demod);
-		break;
-	case STV0900_DEMOD_2:
-		stv0900_write_bits(i_params, F0900_P2_I2C_DEMOD_MODE, 0x1F);
-		stv0900_write_reg(i_params, R0900_P2_TMGCFG, 0x12);
-		stv0900_write_reg(i_params, R0900_P2_TMGTHRISE, 0xf0);
-		stv0900_write_reg(i_params, R0900_P2_TMGTHFALL, 0xe0);
-		stv0900_write_bits(i_params, F0900_P2_SCAN_ENABLE, 1);
-		stv0900_write_bits(i_params, F0900_P2_CFR_AUTOSCAN, 1);
-		stv0900_write_reg(i_params, R0900_P2_SFRUP1, 0x83);
-		stv0900_write_reg(i_params, R0900_P2_SFRUP0, 0xc0);
-		stv0900_write_reg(i_params, R0900_P2_SFRLOW1, 0x82);
-		stv0900_write_reg(i_params, R0900_P2_SFRLOW0, 0xa0);
-		stv0900_write_reg(i_params, R0900_P2_DMDT0M, 0x0);
-		stv0900_write_reg(i_params, R0900_P2_AGC2REF, 0x50);
-
-		if (i_params->chip_id >= 0x20) {
-			stv0900_write_reg(i_params, R0900_P2_CARFREQ, 0x6a);
-			stv0900_write_reg(i_params, R0900_P2_SFRSTEP, 0x95);
-		} else {
-			stv0900_write_reg(i_params, R0900_P2_CARFREQ, 0xed);
-			stv0900_write_reg(i_params, R0900_P2_SFRSTEP, 0x73);
-		}
-
-		if (i_params->dmd2_symbol_rate <= 2000000)
-			currier_step = 1000;
-		else if (i_params->dmd2_symbol_rate <= 5000000)
-			currier_step = 2000;
-		else if (i_params->dmd2_symbol_rate <= 12000000)
-			currier_step = 3000;
-		else
-			currier_step = 5000;
-
-
-		nb_steps = -1 + ((i_params->dmd2_srch_range / 1000) / currier_step);
-		nb_steps /= 2;
-		nb_steps = (2 * nb_steps) + 1;
+		for (i = 0; i < 10; i++) {
+			if (stv0900_get_bits(intp, TMGLOCK_QUALITY) >= 2)
+				timingcpt++;
 
-		if (nb_steps < 0)
-			nb_steps = 1;
-		else if (nb_steps > 10) {
-			nb_steps = 11;
-			currier_step = (i_params->dmd2_srch_range / 1000) / 10;
+			agc2_integr += (stv0900_read_reg(intp, AGC2I1) << 8) |
+					stv0900_read_reg(intp, AGC2I0);
 		}
 
-		current_step = 0;
-		direction = 1;
-		tuner_freq = i_params->tuner2_freq;
-
-		while ((timingLock == FALSE) && (current_step < nb_steps)) {
-			stv0900_write_reg(i_params, R0900_P2_DMDISTATE, 0x5F);
-			stv0900_write_bits(i_params, F0900_P2_I2C_DEMOD_MODE, 0x0);
-
-			msleep(50);
-			timingcpt = 0;
-
-			for (i = 0; i < 20; i++) {
-				if (stv0900_get_bits(i_params, F0900_P2_TMGLOCK_QUALITY) >= 2)
-					timingcpt++;
-				agc2_integr += (stv0900_read_reg(i_params, R0900_P2_AGC2I1) << 8)
-								| stv0900_read_reg(i_params, R0900_P2_AGC2I0);
-			}
-
-			agc2_integr /= 20;
-			coarse_srate = stv0900_get_symbol_rate(i_params, i_params->mclk, demod);
-			if ((timingcpt >= 10) && (agc2_integr < 0x1F00) && (coarse_srate < 55000000) && (coarse_srate > 850000))
-				timingLock = TRUE;
-			else {
-				current_step++;
-				direction *= -1;
-
-				if (direction > 0)
-					tuner_freq += (current_step * currier_step);
-				else
-					tuner_freq -= (current_step * currier_step);
+		agc2_integr /= 10;
+		coarse_srate = stv0900_get_symbol_rate(intp, intp->mclk, demod);
+		current_step++;
+		direction *= -1;
+
+		dprintk("lock: I2C_DEMOD_MODE_FIELD =0. Search started."
+			" tuner freq=%d agc2=0x%x srate_coarse=%d tmg_cpt=%d\n",
+			tuner_freq, agc2_integr, coarse_srate, timingcpt);
+
+		if ((timingcpt >= 5) &&
+				(agc2_integr < agc2_th) &&
+				(coarse_srate < 55000000) &&
+				(coarse_srate > 850000))
+			timing_lck = TRUE;
+		else if (current_step < nb_steps) {
+			if (direction > 0)
+				tuner_freq += (current_step * currier_step);
+			else
+				tuner_freq -= (current_step * currier_step);
 
-				stv0900_set_tuner(fe, tuner_freq, i_params->tuner2_bw);
-			}
+			stv0900_set_tuner(fe, tuner_freq, intp->bw[demod]);
 		}
-
-		if (timingLock == FALSE)
-			coarse_srate = 0;
-		else
-			coarse_srate = stv0900_get_symbol_rate(i_params, i_params->mclk, demod);
-		break;
 	}
 
+	if (timing_lck == FALSE)
+		coarse_srate = 0;
+	else
+		coarse_srate = stv0900_get_symbol_rate(intp, intp->mclk, demod);
+
 	return coarse_srate;
 }
 
 static u32 stv0900_search_srate_fine(struct dvb_frontend *fe)
 {
 	struct stv0900_state *state = fe->demodulator_priv;
-	struct stv0900_internal *i_params = state->internal;
+	struct stv0900_internal *intp = state->internal;
 	enum fe_stv0900_demod_num demod = state->demod;
-	u32 coarse_srate,
-	coarse_freq,
-	symb;
+	u32	coarse_srate,
+		coarse_freq,
+		symb,
+		symbmax,
+		symbmin,
+		symbcomp;
+
+	coarse_srate = stv0900_get_symbol_rate(intp, intp->mclk, demod);
+
+	if (coarse_srate > 3000000) {
+		symbmax = 13 * (coarse_srate / 10);
+		symbmax = (symbmax / 1000) * 65536;
+		symbmax /= (intp->mclk / 1000);
+
+		symbmin = 10 * (coarse_srate / 13);
+		symbmin = (symbmin / 1000)*65536;
+		symbmin /= (intp->mclk / 1000);
+
+		symb = (coarse_srate / 1000) * 65536;
+		symb /= (intp->mclk / 1000);
+	} else {
+		symbmax = 13 * (coarse_srate / 10);
+		symbmax = (symbmax / 100) * 65536;
+		symbmax /= (intp->mclk / 100);
 
-	coarse_srate = stv0900_get_symbol_rate(i_params, i_params->mclk, demod);
+		symbmin = 10 * (coarse_srate / 14);
+		symbmin = (symbmin / 100) * 65536;
+		symbmin /= (intp->mclk / 100);
 
-	switch (demod) {
-	case STV0900_DEMOD_1:
-	default:
-		coarse_freq = (stv0900_read_reg(i_params, R0900_P1_CFR2) << 8)
-						| stv0900_read_reg(i_params, R0900_P1_CFR1);
-		symb = 13 * (coarse_srate / 10);
-
-		if (symb < i_params->dmd1_symbol_rate)
-			coarse_srate = 0;
-		else {
-			stv0900_write_reg(i_params, R0900_P1_DMDISTATE, 0x1F);
-			stv0900_write_reg(i_params, R0900_P1_TMGCFG2, 0x01);
-			stv0900_write_reg(i_params, R0900_P1_TMGTHRISE, 0x20);
-			stv0900_write_reg(i_params, R0900_P1_TMGTHFALL, 0x00);
-			stv0900_write_reg(i_params, R0900_P1_TMGCFG, 0xd2);
-			stv0900_write_bits(i_params, F0900_P1_CFR_AUTOSCAN, 0);
-
-			if (i_params->chip_id >= 0x20)
-				stv0900_write_reg(i_params, R0900_P1_CARFREQ, 0x49);
-			else
-				stv0900_write_reg(i_params, R0900_P1_CARFREQ, 0xed);
-
-			if (coarse_srate > 3000000) {
-				symb = 13 * (coarse_srate / 10);
-				symb = (symb / 1000) * 65536;
-				symb /= (i_params->mclk / 1000);
-				stv0900_write_reg(i_params, R0900_P1_SFRUP1, (symb >> 8) & 0x7F);
-				stv0900_write_reg(i_params, R0900_P1_SFRUP0, (symb & 0xFF));
-
-				symb = 10 * (coarse_srate / 13);
-				symb = (symb / 1000) * 65536;
-				symb /= (i_params->mclk / 1000);
-
-				stv0900_write_reg(i_params, R0900_P1_SFRLOW1, (symb >> 8) & 0x7F);
-				stv0900_write_reg(i_params, R0900_P1_SFRLOW0, (symb & 0xFF));
-
-				symb = (coarse_srate / 1000) * 65536;
-				symb /= (i_params->mclk / 1000);
-				stv0900_write_reg(i_params, R0900_P1_SFRINIT1, (symb >> 8) & 0xFF);
-				stv0900_write_reg(i_params, R0900_P1_SFRINIT0, (symb & 0xFF));
-			} else {
-				symb = 13 * (coarse_srate / 10);
-				symb = (symb / 100) * 65536;
-				symb /= (i_params->mclk / 100);
-				stv0900_write_reg(i_params, R0900_P1_SFRUP1, (symb >> 8) & 0x7F);
-				stv0900_write_reg(i_params, R0900_P1_SFRUP0, (symb & 0xFF));
-
-				symb = 10 * (coarse_srate / 14);
-				symb = (symb / 100) * 65536;
-				symb /= (i_params->mclk / 100);
-				stv0900_write_reg(i_params, R0900_P1_SFRLOW1, (symb >> 8) & 0x7F);
-				stv0900_write_reg(i_params, R0900_P1_SFRLOW0, (symb & 0xFF));
-
-				symb = (coarse_srate / 100) * 65536;
-				symb /= (i_params->mclk / 100);
-				stv0900_write_reg(i_params, R0900_P1_SFRINIT1, (symb >> 8) & 0xFF);
-				stv0900_write_reg(i_params, R0900_P1_SFRINIT0, (symb & 0xFF));
-			}
+		symb = (coarse_srate / 100) * 65536;
+		symb /= (intp->mclk / 100);
+	}
 
-			stv0900_write_reg(i_params, R0900_P1_DMDT0M, 0x20);
-			stv0900_write_reg(i_params, R0900_P1_CFRINIT1, (coarse_freq >> 8) & 0xff);
-			stv0900_write_reg(i_params, R0900_P1_CFRINIT0, coarse_freq  & 0xff);
-			stv0900_write_reg(i_params, R0900_P1_DMDISTATE, 0x15);
-		}
-		break;
-	case STV0900_DEMOD_2:
-		coarse_freq = (stv0900_read_reg(i_params, R0900_P2_CFR2) << 8)
-						| stv0900_read_reg(i_params, R0900_P2_CFR1);
-
-		symb = 13 * (coarse_srate / 10);
-
-		if (symb < i_params->dmd2_symbol_rate)
-			coarse_srate = 0;
-		else {
-			stv0900_write_reg(i_params, R0900_P2_DMDISTATE, 0x1F);
-			stv0900_write_reg(i_params, R0900_P2_TMGCFG2, 0x01);
-			stv0900_write_reg(i_params, R0900_P2_TMGTHRISE, 0x20);
-			stv0900_write_reg(i_params, R0900_P2_TMGTHFALL, 0x00);
-			stv0900_write_reg(i_params, R0900_P2_TMGCFG, 0xd2);
-			stv0900_write_bits(i_params, F0900_P2_CFR_AUTOSCAN, 0);
-
-			if (i_params->chip_id >= 0x20)
-				stv0900_write_reg(i_params, R0900_P2_CARFREQ, 0x49);
-			else
-				stv0900_write_reg(i_params, R0900_P2_CARFREQ, 0xed);
-
-			if (coarse_srate > 3000000) {
-				symb = 13 * (coarse_srate / 10);
-				symb = (symb / 1000) * 65536;
-				symb /= (i_params->mclk / 1000);
-				stv0900_write_reg(i_params, R0900_P2_SFRUP1, (symb >> 8) & 0x7F);
-				stv0900_write_reg(i_params, R0900_P2_SFRUP0, (symb & 0xFF));
-
-				symb = 10 * (coarse_srate / 13);
-				symb = (symb / 1000) * 65536;
-				symb /= (i_params->mclk / 1000);
-
-				stv0900_write_reg(i_params, R0900_P2_SFRLOW1, (symb >> 8) & 0x7F);
-				stv0900_write_reg(i_params, R0900_P2_SFRLOW0, (symb & 0xFF));
-
-				symb = (coarse_srate / 1000) * 65536;
-				symb /= (i_params->mclk / 1000);
-				stv0900_write_reg(i_params, R0900_P2_SFRINIT1, (symb >> 8) & 0xFF);
-				stv0900_write_reg(i_params, R0900_P2_SFRINIT0, (symb & 0xFF));
-			} else {
-				symb = 13 * (coarse_srate / 10);
-				symb = (symb / 100) * 65536;
-				symb /= (i_params->mclk / 100);
-				stv0900_write_reg(i_params, R0900_P2_SFRUP1, (symb >> 8) & 0x7F);
-				stv0900_write_reg(i_params, R0900_P2_SFRUP0, (symb & 0xFF));
-
-				symb = 10 * (coarse_srate / 14);
-				symb = (symb / 100) * 65536;
-				symb /= (i_params->mclk / 100);
-				stv0900_write_reg(i_params, R0900_P2_SFRLOW1, (symb >> 8) & 0x7F);
-				stv0900_write_reg(i_params, R0900_P2_SFRLOW0, (symb & 0xFF));
-
-				symb = (coarse_srate / 100) * 65536;
-				symb /= (i_params->mclk / 100);
-				stv0900_write_reg(i_params, R0900_P2_SFRINIT1, (symb >> 8) & 0xFF);
-				stv0900_write_reg(i_params, R0900_P2_SFRINIT0, (symb & 0xFF));
-			}
+	symbcomp = 13 * (coarse_srate / 10);
+		coarse_freq = (stv0900_read_reg(intp, CFR2) << 8)
+					| stv0900_read_reg(intp, CFR1);
+
+	if (symbcomp < intp->symbol_rate[demod])
+		coarse_srate = 0;
+	else {
+		stv0900_write_reg(intp, DMDISTATE, 0x1f);
+		stv0900_write_reg(intp, TMGCFG2, 0xc1);
+		stv0900_write_reg(intp, TMGTHRISE, 0x20);
+		stv0900_write_reg(intp, TMGTHFALL, 0x00);
+		stv0900_write_reg(intp, TMGCFG, 0xd2);
+		stv0900_write_bits(intp, CFR_AUTOSCAN, 0);
+		stv0900_write_reg(intp, AGC2REF, 0x38);
+
+		if (intp->chip_id >= 0x30)
+			stv0900_write_reg(intp, CARFREQ, 0x79);
+		else if (intp->chip_id >= 0x20)
+			stv0900_write_reg(intp, CARFREQ, 0x49);
+		else
+			stv0900_write_reg(intp, CARFREQ, 0xed);
 
-			stv0900_write_reg(i_params, R0900_P2_DMDT0M, 0x20);
-			stv0900_write_reg(i_params, R0900_P2_CFRINIT1, (coarse_freq >> 8) & 0xff);
-			stv0900_write_reg(i_params, R0900_P2_CFRINIT0, coarse_freq  & 0xff);
-			stv0900_write_reg(i_params, R0900_P2_DMDISTATE, 0x15);
-		}
+		stv0900_write_reg(intp, SFRUP1, (symbmax >> 8) & 0x7f);
+		stv0900_write_reg(intp, SFRUP0, (symbmax & 0xff));
 
-		break;
+		stv0900_write_reg(intp, SFRLOW1, (symbmin >> 8) & 0x7f);
+		stv0900_write_reg(intp, SFRLOW0, (symbmin & 0xff));
+
+		stv0900_write_reg(intp, SFRINIT1, (symb >> 8) & 0xff);
+		stv0900_write_reg(intp, SFRINIT0, (symb & 0xff));
+
+		stv0900_write_reg(intp, DMDT0M, 0x20);
+		stv0900_write_reg(intp, CFRINIT1, (coarse_freq >> 8) & 0xff);
+		stv0900_write_reg(intp, CFRINIT0, coarse_freq  & 0xff);
+		stv0900_write_reg(intp, DMDISTATE, 0x15);
 	}
 
 	return coarse_srate;
@@ -2265,163 +1574,135 @@ static u32 stv0900_search_srate_fine(struct dvb_frontend *fe)
 static int stv0900_blind_search_algo(struct dvb_frontend *fe)
 {
 	struct stv0900_state *state = fe->demodulator_priv;
-	struct stv0900_internal *i_params = state->internal;
+	struct stv0900_internal *intp = state->internal;
 	enum fe_stv0900_demod_num demod = state->demod;
-	u8 k_ref_tmg, k_ref_tmg_max, k_ref_tmg_min;
-	u32 coarse_srate;
-	int lock = FALSE, coarse_fail = FALSE;
-	s32 demod_timeout = 500, fec_timeout = 50, kref_tmg_reg, fail_cpt, i, agc2_overflow;
-	u16 agc2_integr;
-	u8 dstatus2;
-
-	dprintk(KERN_INFO "%s\n", __func__);
-
-	if (i_params->chip_id < 0x20) {
+	u8	k_ref_tmg,
+		k_ref_tmg_max,
+		k_ref_tmg_min;
+	u32	coarse_srate,
+		agc2_th;
+	int	lock = FALSE,
+		coarse_fail = FALSE;
+	s32	demod_timeout = 500,
+		fec_timeout = 50,
+		fail_cpt,
+		i,
+		agc2_overflow;
+	u16	agc2_int;
+	u8	dstatus2;
+
+	dprintk("%s\n", __func__);
+
+	if (intp->chip_id < 0x20) {
 		k_ref_tmg_max = 233;
 		k_ref_tmg_min = 143;
 	} else {
-		k_ref_tmg_max = 120;
-		k_ref_tmg_min = 30;
+		k_ref_tmg_max = 110;
+		k_ref_tmg_min = 10;
 	}
 
-	agc2_integr = stv0900_blind_check_agc2_min_level(i_params, demod);
-
-	if (agc2_integr > STV0900_BLIND_SEARCH_AGC2_TH) {
-		lock = FALSE;
-
-	} else {
-		switch (demod) {
-		case STV0900_DEMOD_1:
-		default:
-			if (i_params->chip_id == 0x10)
-				stv0900_write_reg(i_params, R0900_P1_CORRELEXP, 0xAA);
-
-			if (i_params->chip_id < 0x20)
-				stv0900_write_reg(i_params, R0900_P1_CARHDR, 0x55);
-
-			stv0900_write_reg(i_params, R0900_P1_CARCFG, 0xC4);
-			stv0900_write_reg(i_params, R0900_P1_RTCS2, 0x44);
-
-			if (i_params->chip_id >= 0x20) {
-				stv0900_write_reg(i_params, R0900_P1_EQUALCFG, 0x41);
-				stv0900_write_reg(i_params, R0900_P1_FFECFG, 0x41);
-				stv0900_write_reg(i_params, R0900_P1_VITSCALE, 0x82);
-				stv0900_write_reg(i_params, R0900_P1_VAVSRVIT, 0x0);
-			}
-
-			kref_tmg_reg = R0900_P1_KREFTMG;
-			break;
-		case STV0900_DEMOD_2:
-			if (i_params->chip_id == 0x10)
-				stv0900_write_reg(i_params, R0900_P2_CORRELEXP, 0xAA);
-
-			if (i_params->chip_id < 0x20)
-				stv0900_write_reg(i_params, R0900_P2_CARHDR, 0x55);
+	if (intp->chip_id <= 0x20)
+		agc2_th = STV0900_BLIND_SEARCH_AGC2_TH;
+	else
+		agc2_th = STV0900_BLIND_SEARCH_AGC2_TH_CUT30;
 
-			stv0900_write_reg(i_params, R0900_P2_CARCFG, 0xC4);
-			stv0900_write_reg(i_params, R0900_P2_RTCS2, 0x44);
+	agc2_int = stv0900_blind_check_agc2_min_level(intp, demod);
 
-			if (i_params->chip_id >= 0x20) {
-				stv0900_write_reg(i_params, R0900_P2_EQUALCFG, 0x41);
-				stv0900_write_reg(i_params, R0900_P2_FFECFG, 0x41);
-				stv0900_write_reg(i_params, R0900_P2_VITSCALE, 0x82);
-				stv0900_write_reg(i_params, R0900_P2_VAVSRVIT, 0x0);
-			}
+	if (agc2_int > STV0900_BLIND_SEARCH_AGC2_TH)
+		return FALSE;
 
-			kref_tmg_reg = R0900_P2_KREFTMG;
-			break;
-		}
+	if (intp->chip_id == 0x10)
+		stv0900_write_reg(intp, CORRELEXP, 0xaa);
 
-		k_ref_tmg = k_ref_tmg_max;
+	if (intp->chip_id < 0x20)
+		stv0900_write_reg(intp, CARHDR, 0x55);
+	else
+		stv0900_write_reg(intp, CARHDR, 0x20);
 
-		do {
-			stv0900_write_reg(i_params, kref_tmg_reg, k_ref_tmg);
-			if (stv0900_search_srate_coarse(fe) != 0) {
-				coarse_srate = stv0900_search_srate_fine(fe);
+	if (intp->chip_id <= 0x20)
+		stv0900_write_reg(intp, CARCFG, 0xc4);
+	else
+		stv0900_write_reg(intp, CARCFG, 0x6);
 
-				if (coarse_srate != 0) {
-					stv0900_get_lock_timeout(&demod_timeout, &fec_timeout, coarse_srate, STV0900_BLIND_SEARCH);
-					lock = stv0900_get_demod_lock(i_params, demod, demod_timeout);
-				} else
-					lock = FALSE;
-			} else {
-				fail_cpt = 0;
-				agc2_overflow = 0;
+	stv0900_write_reg(intp, RTCS2, 0x44);
 
-				switch (demod) {
-				case STV0900_DEMOD_1:
-				default:
-					for (i = 0; i < 10; i++) {
-						agc2_integr = (stv0900_read_reg(i_params, R0900_P1_AGC2I1) << 8)
-								| stv0900_read_reg(i_params, R0900_P1_AGC2I0);
+	if (intp->chip_id >= 0x20) {
+		stv0900_write_reg(intp, EQUALCFG, 0x41);
+		stv0900_write_reg(intp, FFECFG, 0x41);
+		stv0900_write_reg(intp, VITSCALE, 0x82);
+		stv0900_write_reg(intp, VAVSRVIT, 0x0);
+	}
 
-						if (agc2_integr >= 0xff00)
-							agc2_overflow++;
+	k_ref_tmg = k_ref_tmg_max;
 
-						dstatus2 = stv0900_read_reg(i_params, R0900_P1_DSTATUS2);
+	do {
+		stv0900_write_reg(intp, KREFTMG, k_ref_tmg);
+		if (stv0900_search_srate_coarse(fe) != 0) {
+			coarse_srate = stv0900_search_srate_fine(fe);
+
+			if (coarse_srate != 0) {
+				stv0900_get_lock_timeout(&demod_timeout,
+							&fec_timeout,
+							coarse_srate,
+							STV0900_BLIND_SEARCH);
+				lock = stv0900_get_demod_lock(intp,
+							demod,
+							demod_timeout);
+			} else
+				lock = FALSE;
+		} else {
+			fail_cpt = 0;
+			agc2_overflow = 0;
 
-						if (((dstatus2 & 0x1) == 0x1) && ((dstatus2 >> 7) == 1))
-							fail_cpt++;
-					}
-					break;
-				case STV0900_DEMOD_2:
-					for (i = 0; i < 10; i++) {
-						agc2_integr = (stv0900_read_reg(i_params, R0900_P2_AGC2I1) << 8)
-								| stv0900_read_reg(i_params, R0900_P2_AGC2I0);
+			for (i = 0; i < 10; i++) {
+				agc2_int = (stv0900_read_reg(intp, AGC2I1) << 8)
+					| stv0900_read_reg(intp, AGC2I0);
 
-						if (agc2_integr >= 0xff00)
-							agc2_overflow++;
+				if (agc2_int >= 0xff00)
+					agc2_overflow++;
 
-						dstatus2 = stv0900_read_reg(i_params, R0900_P2_DSTATUS2);
+				dstatus2 = stv0900_read_reg(intp, DSTATUS2);
 
-						if (((dstatus2 & 0x1) == 0x1) && ((dstatus2 >> 7) == 1))
-							fail_cpt++;
-					}
-					break;
-				}
+				if (((dstatus2 & 0x1) == 0x1) &&
+						((dstatus2 >> 7) == 1))
+					fail_cpt++;
+			}
 
-				if ((fail_cpt > 7) || (agc2_overflow > 7))
-					coarse_fail = TRUE;
+			if ((fail_cpt > 7) || (agc2_overflow > 7))
+				coarse_fail = TRUE;
 
-				lock = FALSE;
-			}
-			k_ref_tmg -= 30;
-		} while ((k_ref_tmg >= k_ref_tmg_min) && (lock == FALSE) && (coarse_fail == FALSE));
-	}
+			lock = FALSE;
+		}
+		k_ref_tmg -= 30;
+	} while ((k_ref_tmg >= k_ref_tmg_min) &&
+				(lock == FALSE) &&
+				(coarse_fail == FALSE));
 
 	return lock;
 }
 
-static void stv0900_set_viterbi_acq(struct stv0900_internal *i_params,
+static void stv0900_set_viterbi_acq(struct stv0900_internal *intp,
 					enum fe_stv0900_demod_num demod)
 {
-	s32 vth_reg;
+	s32 vth_reg = VTH12;
 
-	dprintk(KERN_INFO "%s\n", __func__);
+	dprintk("%s\n", __func__);
 
-	dmd_reg(vth_reg, R0900_P1_VTH12, R0900_P2_VTH12);
-
-	stv0900_write_reg(i_params, vth_reg++, 0x96);
-	stv0900_write_reg(i_params, vth_reg++, 0x64);
-	stv0900_write_reg(i_params, vth_reg++, 0x36);
-	stv0900_write_reg(i_params, vth_reg++, 0x23);
-	stv0900_write_reg(i_params, vth_reg++, 0x1E);
-	stv0900_write_reg(i_params, vth_reg++, 0x19);
+	stv0900_write_reg(intp, vth_reg++, 0x96);
+	stv0900_write_reg(intp, vth_reg++, 0x64);
+	stv0900_write_reg(intp, vth_reg++, 0x36);
+	stv0900_write_reg(intp, vth_reg++, 0x23);
+	stv0900_write_reg(intp, vth_reg++, 0x1e);
+	stv0900_write_reg(intp, vth_reg++, 0x19);
 }
 
-static void stv0900_set_search_standard(struct stv0900_internal *i_params,
+static void stv0900_set_search_standard(struct stv0900_internal *intp,
 					enum fe_stv0900_demod_num demod)
 {
 
-	int sstndrd;
-
-	dprintk(KERN_INFO "%s\n", __func__);
+	dprintk("%s\n", __func__);
 
-	sstndrd = i_params->dmd1_srch_standard;
-	if (demod == 1)
-		sstndrd = i_params->dmd2_srch_stndrd;
-
-	switch (sstndrd) {
+	switch (intp->srch_standard[demod]) {
 	case STV0900_SEARCH_DVBS1:
 		dprintk("Search Standard = DVBS1\n");
 		break;
@@ -2436,129 +1717,74 @@ static void stv0900_set_search_standard(struct stv0900_internal *i_params,
 		break;
 	}
 
-	switch (demod) {
-	case STV0900_DEMOD_1:
-	default:
-		switch (i_params->dmd1_srch_standard) {
-		case STV0900_SEARCH_DVBS1:
-		case STV0900_SEARCH_DSS:
-			stv0900_write_bits(i_params, F0900_P1_DVBS1_ENABLE, 1);
-			stv0900_write_bits(i_params, F0900_P1_DVBS2_ENABLE, 0);
-
-			stv0900_write_bits(i_params, F0900_STOP_CLKVIT1, 0);
-			stv0900_write_reg(i_params, R0900_P1_ACLC, 0x1a);
-			stv0900_write_reg(i_params, R0900_P1_BCLC, 0x09);
-			stv0900_write_reg(i_params, R0900_P1_CAR2CFG, 0x22);
-
-			stv0900_set_viterbi_acq(i_params, demod);
-			stv0900_set_viterbi_standard(i_params,
-						i_params->dmd1_srch_standard,
-						i_params->dmd1_fec, demod);
-
-			break;
-		case STV0900_SEARCH_DVBS2:
-			stv0900_write_bits(i_params, F0900_P1_DVBS1_ENABLE, 0);
-			stv0900_write_bits(i_params, F0900_P1_DVBS2_ENABLE, 0);
-			stv0900_write_bits(i_params, F0900_P1_DVBS1_ENABLE, 1);
-			stv0900_write_bits(i_params, F0900_P1_DVBS2_ENABLE, 1);
-			stv0900_write_bits(i_params, F0900_STOP_CLKVIT1, 1);
-			stv0900_write_reg(i_params, R0900_P1_ACLC, 0x1a);
-			stv0900_write_reg(i_params, R0900_P1_BCLC, 0x09);
-			stv0900_write_reg(i_params, R0900_P1_CAR2CFG, 0x26);
-			if (i_params->demod_mode != STV0900_SINGLE) {
-				if (i_params->chip_id <= 0x11)
-					stv0900_stop_all_s2_modcod(i_params, demod);
-				else
-					stv0900_activate_s2_modcode(i_params, demod);
-
-			} else
-				stv0900_activate_s2_modcode_single(i_params, demod);
-
-			stv0900_set_viterbi_tracq(i_params, demod);
-
-			break;
-		case STV0900_AUTO_SEARCH:
-		default:
-			stv0900_write_bits(i_params, F0900_P1_DVBS1_ENABLE, 0);
-			stv0900_write_bits(i_params, F0900_P1_DVBS2_ENABLE, 0);
-			stv0900_write_bits(i_params, F0900_P1_DVBS1_ENABLE, 1);
-			stv0900_write_bits(i_params, F0900_P1_DVBS2_ENABLE, 1);
-			stv0900_write_bits(i_params, F0900_STOP_CLKVIT1, 0);
-			stv0900_write_reg(i_params, R0900_P1_ACLC, 0x1a);
-			stv0900_write_reg(i_params, R0900_P1_BCLC, 0x09);
-			stv0900_write_reg(i_params, R0900_P1_CAR2CFG, 0x26);
-			if (i_params->demod_mode != STV0900_SINGLE) {
-				if (i_params->chip_id <= 0x11)
-					stv0900_stop_all_s2_modcod(i_params, demod);
-				else
-					stv0900_activate_s2_modcode(i_params, demod);
+	switch (intp->srch_standard[demod]) {
+	case STV0900_SEARCH_DVBS1:
+	case STV0900_SEARCH_DSS:
+		stv0900_write_bits(intp, DVBS1_ENABLE, 1);
+		stv0900_write_bits(intp, DVBS2_ENABLE, 0);
+		stv0900_write_bits(intp, STOP_CLKVIT, 0);
+		stv0900_set_dvbs1_track_car_loop(intp,
+						demod,
+						intp->symbol_rate[demod]);
+		stv0900_write_reg(intp, CAR2CFG, 0x22);
+
+		stv0900_set_viterbi_acq(intp, demod);
+		stv0900_set_viterbi_standard(intp,
+					intp->srch_standard[demod],
+					intp->fec[demod], demod);
 
-			} else
-				stv0900_activate_s2_modcode_single(i_params, demod);
+		break;
+	case STV0900_SEARCH_DVBS2:
+		stv0900_write_bits(intp, DVBS1_ENABLE, 0);
+		stv0900_write_bits(intp, DVBS2_ENABLE, 1);
+		stv0900_write_bits(intp, STOP_CLKVIT, 1);
+		stv0900_write_reg(intp, ACLC, 0x1a);
+		stv0900_write_reg(intp, BCLC, 0x09);
+		if (intp->chip_id <= 0x20) /*cut 1.x and 2.0*/
+			stv0900_write_reg(intp, CAR2CFG, 0x26);
+		else
+			stv0900_write_reg(intp, CAR2CFG, 0x66);
 
-			if (i_params->dmd1_symbol_rate >= 2000000)
-				stv0900_set_viterbi_acq(i_params, demod);
+		if (intp->demod_mode != STV0900_SINGLE) {
+			if (intp->chip_id <= 0x11)
+				stv0900_stop_all_s2_modcod(intp, demod);
 			else
-				stv0900_set_viterbi_tracq(i_params, demod);
+				stv0900_activate_s2_modcod(intp, demod);
 
-			stv0900_set_viterbi_standard(i_params, i_params->dmd1_srch_standard, i_params->dmd1_fec, demod);
+		} else
+			stv0900_activate_s2_modcod_single(intp, demod);
 
-			break;
-		}
-		break;
-	case STV0900_DEMOD_2:
-		switch (i_params->dmd2_srch_stndrd) {
-		case STV0900_SEARCH_DVBS1:
-		case STV0900_SEARCH_DSS:
-			stv0900_write_bits(i_params, F0900_P2_DVBS1_ENABLE, 1);
-			stv0900_write_bits(i_params, F0900_P2_DVBS2_ENABLE, 0);
-			stv0900_write_bits(i_params, F0900_STOP_CLKVIT2, 0);
-			stv0900_write_reg(i_params, R0900_P2_ACLC, 0x1a);
-			stv0900_write_reg(i_params, R0900_P2_BCLC, 0x09);
-			stv0900_write_reg(i_params, R0900_P2_CAR2CFG, 0x22);
-			stv0900_set_viterbi_acq(i_params, demod);
-			stv0900_set_viterbi_standard(i_params, i_params->dmd2_srch_stndrd, i_params->dmd2_fec, demod);
-			break;
-		case STV0900_SEARCH_DVBS2:
-			stv0900_write_bits(i_params, F0900_P2_DVBS1_ENABLE, 0);
-			stv0900_write_bits(i_params, F0900_P2_DVBS2_ENABLE, 0);
-			stv0900_write_bits(i_params, F0900_P2_DVBS1_ENABLE, 1);
-			stv0900_write_bits(i_params, F0900_P2_DVBS2_ENABLE, 1);
-			stv0900_write_bits(i_params, F0900_STOP_CLKVIT2, 1);
-			stv0900_write_reg(i_params, R0900_P2_ACLC, 0x1a);
-			stv0900_write_reg(i_params, R0900_P2_BCLC, 0x09);
-			stv0900_write_reg(i_params, R0900_P2_CAR2CFG, 0x26);
-			if (i_params->demod_mode != STV0900_SINGLE)
-				stv0900_activate_s2_modcode(i_params, demod);
-			else
-				stv0900_activate_s2_modcode_single(i_params, demod);
+		stv0900_set_viterbi_tracq(intp, demod);
 
-			stv0900_set_viterbi_tracq(i_params, demod);
-			break;
-		case STV0900_AUTO_SEARCH:
-		default:
-			stv0900_write_bits(i_params, F0900_P2_DVBS1_ENABLE, 0);
-			stv0900_write_bits(i_params, F0900_P2_DVBS2_ENABLE, 0);
-			stv0900_write_bits(i_params, F0900_P2_DVBS1_ENABLE, 1);
-			stv0900_write_bits(i_params, F0900_P2_DVBS2_ENABLE, 1);
-			stv0900_write_bits(i_params, F0900_STOP_CLKVIT2, 0);
-			stv0900_write_reg(i_params, R0900_P2_ACLC, 0x1a);
-			stv0900_write_reg(i_params, R0900_P2_BCLC, 0x09);
-			stv0900_write_reg(i_params, R0900_P2_CAR2CFG, 0x26);
-			if (i_params->demod_mode != STV0900_SINGLE)
-				stv0900_activate_s2_modcode(i_params, demod);
-			else
-				stv0900_activate_s2_modcode_single(i_params, demod);
+		break;
+	case STV0900_AUTO_SEARCH:
+	default:
+		stv0900_write_bits(intp, DVBS1_ENABLE, 1);
+		stv0900_write_bits(intp, DVBS2_ENABLE, 1);
+		stv0900_write_bits(intp, STOP_CLKVIT, 0);
+		stv0900_write_reg(intp, ACLC, 0x1a);
+		stv0900_write_reg(intp, BCLC, 0x09);
+		stv0900_set_dvbs1_track_car_loop(intp,
+						demod,
+						intp->symbol_rate[demod]);
+		if (intp->chip_id <= 0x20) /*cut 1.x and 2.0*/
+			stv0900_write_reg(intp, CAR2CFG, 0x26);
+		else
+			stv0900_write_reg(intp, CAR2CFG, 0x66);
 
-			if (i_params->dmd2_symbol_rate >= 2000000)
-				stv0900_set_viterbi_acq(i_params, demod);
+		if (intp->demod_mode != STV0900_SINGLE) {
+			if (intp->chip_id <= 0x11)
+				stv0900_stop_all_s2_modcod(intp, demod);
 			else
-				stv0900_set_viterbi_tracq(i_params, demod);
+				stv0900_activate_s2_modcod(intp, demod);
 
-			stv0900_set_viterbi_standard(i_params, i_params->dmd2_srch_stndrd, i_params->dmd2_fec, demod);
+		} else
+			stv0900_activate_s2_modcod_single(intp, demod);
 
-			break;
-		}
+		stv0900_set_viterbi_tracq(intp, demod);
+		stv0900_set_viterbi_standard(intp,
+						intp->srch_standard[demod],
+						intp->fec[demod], demod);
 
 		break;
 	}
@@ -2567,10 +1793,11 @@ static void stv0900_set_search_standard(struct stv0900_internal *i_params,
 enum fe_stv0900_signal_type stv0900_algo(struct dvb_frontend *fe)
 {
 	struct stv0900_state *state = fe->demodulator_priv;
-	struct stv0900_internal *i_params = state->internal;
+	struct stv0900_internal *intp = state->internal;
 	enum fe_stv0900_demod_num demod = state->demod;
 
-	s32 demod_timeout = 500, fec_timeout = 50, stream_merger_field;
+	s32 demod_timeout = 500, fec_timeout = 50;
+	s32 aq_power, agc1_power, i;
 
 	int lock = FALSE, low_sr = FALSE;
 
@@ -2578,157 +1805,117 @@ enum fe_stv0900_signal_type stv0900_algo(struct dvb_frontend *fe)
 	enum fe_stv0900_search_algo algo;
 	int no_signal = FALSE;
 
-	dprintk(KERN_INFO "%s\n", __func__);
-
-	switch (demod) {
-	case STV0900_DEMOD_1:
-	default:
-		algo = i_params->dmd1_srch_algo;
+	dprintk("%s\n", __func__);
 
-		stv0900_write_bits(i_params, F0900_P1_RST_HWARE, 1);
-		stream_merger_field = F0900_P1_RST_HWARE;
-
-		stv0900_write_reg(i_params, R0900_P1_DMDISTATE, 0x5C);
-
-		if (i_params->chip_id >= 0x20)
-			stv0900_write_reg(i_params, R0900_P1_CORRELABS, 0x9e);
+	algo = intp->srch_algo[demod];
+	stv0900_write_bits(intp, RST_HWARE, 1);
+	stv0900_write_reg(intp, DMDISTATE, 0x5c);
+	if (intp->chip_id >= 0x20) {
+		if (intp->symbol_rate[demod] > 5000000)
+			stv0900_write_reg(intp, CORRELABS, 0x9e);
 		else
-			stv0900_write_reg(i_params, R0900_P1_CORRELABS, 0x88);
-
-		stv0900_get_lock_timeout(&demod_timeout, &fec_timeout, i_params->dmd1_symbol_rate, i_params->dmd1_srch_algo);
-
-		if (i_params->dmd1_srch_algo == STV0900_BLIND_SEARCH) {
-			i_params->tuner1_bw = 2 * 36000000;
-
-			stv0900_write_reg(i_params, R0900_P1_TMGCFG2, 0x00);
-			stv0900_write_reg(i_params, R0900_P1_CORRELMANT, 0x70);
-
-			stv0900_set_symbol_rate(i_params, i_params->mclk, 1000000, demod);
-		} else {
-			stv0900_write_reg(i_params, R0900_P1_DMDT0M, 0x20);
-			stv0900_write_reg(i_params, R0900_P1_TMGCFG, 0xd2);
-
-			if (i_params->dmd1_symbol_rate < 2000000)
-				stv0900_write_reg(i_params, R0900_P1_CORRELMANT, 0x63);
-			else
-				stv0900_write_reg(i_params, R0900_P1_CORRELMANT, 0x70);
-
-			stv0900_write_reg(i_params, R0900_P1_AGC2REF, 0x38);
-			if (i_params->chip_id >= 0x20) {
-				stv0900_write_reg(i_params, R0900_P1_KREFTMG, 0x5a);
-
-				if (i_params->dmd1_srch_algo == STV0900_COLD_START)
-					i_params->tuner1_bw = (15 * (stv0900_carrier_width(i_params->dmd1_symbol_rate, i_params->rolloff) + 10000000)) / 10;
-				else if (i_params->dmd1_srch_algo == STV0900_WARM_START)
-					i_params->tuner1_bw = stv0900_carrier_width(i_params->dmd1_symbol_rate, i_params->rolloff) + 10000000;
-			} else {
-				stv0900_write_reg(i_params, R0900_P1_KREFTMG, 0xc1);
-				i_params->tuner1_bw = (15 * (stv0900_carrier_width(i_params->dmd1_symbol_rate, i_params->rolloff) + 10000000)) / 10;
-			}
-
-			stv0900_write_reg(i_params, R0900_P1_TMGCFG2, 0x01);
-
-			stv0900_set_symbol_rate(i_params, i_params->mclk, i_params->dmd1_symbol_rate, demod);
-			stv0900_set_max_symbol_rate(i_params, i_params->mclk, i_params->dmd1_symbol_rate, demod);
-			stv0900_set_min_symbol_rate(i_params, i_params->mclk, i_params->dmd1_symbol_rate, demod);
-			if (i_params->dmd1_symbol_rate >= 10000000)
-				low_sr = FALSE;
-			else
-				low_sr = TRUE;
-
-		}
-
-		stv0900_set_tuner(fe, i_params->tuner1_freq, i_params->tuner1_bw);
-
-		stv0900_write_bits(i_params, F0900_P1_SPECINV_CONTROL, i_params->dmd1_srch_iq_inv);
-		stv0900_write_bits(i_params, F0900_P1_MANUAL_ROLLOFF, 1);
-
-		stv0900_set_search_standard(i_params, demod);
+			stv0900_write_reg(intp, CORRELABS, 0x82);
+	} else
+		stv0900_write_reg(intp, CORRELABS, 0x88);
 
-		if (i_params->dmd1_srch_algo != STV0900_BLIND_SEARCH)
-			stv0900_start_search(i_params, demod);
-		break;
-	case STV0900_DEMOD_2:
-		algo = i_params->dmd2_srch_algo;
+	stv0900_get_lock_timeout(&demod_timeout, &fec_timeout,
+				intp->symbol_rate[demod],
+				intp->srch_algo[demod]);
 
-		stv0900_write_bits(i_params, F0900_P2_RST_HWARE, 1);
+	if (intp->srch_algo[demod] == STV0900_BLIND_SEARCH) {
+		intp->bw[demod] = 2 * 36000000;
 
-		stream_merger_field = F0900_P2_RST_HWARE;
+		stv0900_write_reg(intp, TMGCFG2, 0xc0);
+		stv0900_write_reg(intp, CORRELMANT, 0x70);
 
-		stv0900_write_reg(i_params, R0900_P2_DMDISTATE, 0x5C);
+		stv0900_set_symbol_rate(intp, intp->mclk, 1000000, demod);
+	} else {
+		stv0900_write_reg(intp, DMDT0M, 0x20);
+		stv0900_write_reg(intp, TMGCFG, 0xd2);
 
-		if (i_params->chip_id >= 0x20)
-			stv0900_write_reg(i_params, R0900_P2_CORRELABS, 0x9e);
+		if (intp->symbol_rate[demod] < 2000000)
+			stv0900_write_reg(intp, CORRELMANT, 0x63);
 		else
-			stv0900_write_reg(i_params, R0900_P2_CORRELABS, 0x88);
+			stv0900_write_reg(intp, CORRELMANT, 0x70);
 
-		stv0900_get_lock_timeout(&demod_timeout, &fec_timeout, i_params->dmd2_symbol_rate, i_params->dmd2_srch_algo);
+		stv0900_write_reg(intp, AGC2REF, 0x38);
 
-		if (i_params->dmd2_srch_algo == STV0900_BLIND_SEARCH) {
-			i_params->tuner2_bw = 2 * 36000000;
+		intp->bw[demod] =
+				stv0900_carrier_width(intp->symbol_rate[demod],
+								intp->rolloff);
+		if (intp->chip_id >= 0x20) {
+			stv0900_write_reg(intp, KREFTMG, 0x5a);
 
-			stv0900_write_reg(i_params, R0900_P2_TMGCFG2, 0x00);
-			stv0900_write_reg(i_params, R0900_P2_CORRELMANT, 0x70);
+			if (intp->srch_algo[demod] == STV0900_COLD_START) {
+				intp->bw[demod] += 10000000;
+				intp->bw[demod] *= 15;
+				intp->bw[demod] /= 10;
+			} else if (intp->srch_algo[demod] == STV0900_WARM_START)
+				intp->bw[demod] += 10000000;
 
-			stv0900_set_symbol_rate(i_params, i_params->mclk, 1000000, demod);
 		} else {
-			stv0900_write_reg(i_params, R0900_P2_DMDT0M, 0x20);
-			stv0900_write_reg(i_params, R0900_P2_TMGCFG, 0xd2);
+			stv0900_write_reg(intp, KREFTMG, 0xc1);
+			intp->bw[demod] += 10000000;
+			intp->bw[demod] *= 15;
+			intp->bw[demod] /= 10;
+		}
 
-			if (i_params->dmd2_symbol_rate < 2000000)
-				stv0900_write_reg(i_params, R0900_P2_CORRELMANT, 0x63);
-			else
-				stv0900_write_reg(i_params, R0900_P2_CORRELMANT, 0x70);
+		stv0900_write_reg(intp, TMGCFG2, 0xc1);
 
-			if (i_params->dmd2_symbol_rate >= 10000000)
-				stv0900_write_reg(i_params, R0900_P2_AGC2REF, 0x38);
-			else
-				stv0900_write_reg(i_params, R0900_P2_AGC2REF, 0x60);
+		stv0900_set_symbol_rate(intp, intp->mclk,
+					intp->symbol_rate[demod], demod);
+		stv0900_set_max_symbol_rate(intp, intp->mclk,
+					intp->symbol_rate[demod], demod);
+		stv0900_set_min_symbol_rate(intp, intp->mclk,
+					intp->symbol_rate[demod], demod);
+		if (intp->symbol_rate[demod] >= 10000000)
+			low_sr = FALSE;
+		else
+			low_sr = TRUE;
 
-			if (i_params->chip_id >= 0x20) {
-				stv0900_write_reg(i_params, R0900_P2_KREFTMG, 0x5a);
+	}
 
-				if (i_params->dmd2_srch_algo == STV0900_COLD_START)
-					i_params->tuner2_bw = (15 * (stv0900_carrier_width(i_params->dmd2_symbol_rate,
-							i_params->rolloff) + 10000000)) / 10;
-				else if (i_params->dmd2_srch_algo == STV0900_WARM_START)
-					i_params->tuner2_bw = stv0900_carrier_width(i_params->dmd2_symbol_rate,
-							i_params->rolloff) + 10000000;
-			} else {
-				stv0900_write_reg(i_params, R0900_P2_KREFTMG, 0xc1);
-				i_params->tuner2_bw = (15 * (stv0900_carrier_width(i_params->dmd2_symbol_rate,
-									i_params->rolloff) + 10000000)) / 10;
-			}
+	stv0900_set_tuner(fe, intp->freq[demod], intp->bw[demod]);
 
-			stv0900_write_reg(i_params, R0900_P2_TMGCFG2, 0x01);
+	agc1_power = MAKEWORD(stv0900_get_bits(intp, AGCIQ_VALUE1),
+				stv0900_get_bits(intp, AGCIQ_VALUE0));
 
-			stv0900_set_symbol_rate(i_params, i_params->mclk, i_params->dmd2_symbol_rate, demod);
-			stv0900_set_max_symbol_rate(i_params, i_params->mclk, i_params->dmd2_symbol_rate, demod);
-			stv0900_set_min_symbol_rate(i_params, i_params->mclk, i_params->dmd2_symbol_rate, demod);
-			if (i_params->dmd2_symbol_rate >= 10000000)
-				low_sr = FALSE;
-			else
-				low_sr = TRUE;
+	aq_power = 0;
 
-		}
+	if (agc1_power == 0) {
+		for (i = 0; i < 5; i++)
+			aq_power += (stv0900_get_bits(intp, POWER_I) +
+					stv0900_get_bits(intp, POWER_Q)) / 2;
 
-		stv0900_set_tuner(fe, i_params->tuner2_freq, i_params->tuner2_bw);
+		aq_power /= 5;
+	}
 
-		stv0900_write_bits(i_params, F0900_P2_SPECINV_CONTROL, i_params->dmd2_srch_iq_inv);
-		stv0900_write_bits(i_params, F0900_P2_MANUAL_ROLLOFF, 1);
+	if ((agc1_power == 0) && (aq_power < IQPOWER_THRESHOLD)) {
+		intp->result[demod].locked = FALSE;
+		signal_type = STV0900_NOAGC1;
+		dprintk("%s: NO AGC1, POWERI, POWERQ\n", __func__);
+	} else {
+		stv0900_write_bits(intp, SPECINV_CONTROL,
+					intp->srch_iq_inv[demod]);
+		if (intp->chip_id <= 0x20) /*cut 2.0*/
+			stv0900_write_bits(intp, MANUALSX_ROLLOFF, 1);
+		else /*cut 3.0*/
+			stv0900_write_bits(intp, MANUALS2_ROLLOFF, 1);
 
-		stv0900_set_search_standard(i_params, demod);
+		stv0900_set_search_standard(intp, demod);
 
-		if (i_params->dmd2_srch_algo != STV0900_BLIND_SEARCH)
-			stv0900_start_search(i_params, demod);
-		break;
+		if (intp->srch_algo[demod] != STV0900_BLIND_SEARCH)
+			stv0900_start_search(intp, demod);
 	}
 
-	if (i_params->chip_id == 0x12) {
-		stv0900_write_bits(i_params, stream_merger_field, 0);
+	if (signal_type == STV0900_NOAGC1)
+		return signal_type;
+
+	if (intp->chip_id == 0x12) {
+		stv0900_write_bits(intp, RST_HWARE, 0);
 		msleep(3);
-		stv0900_write_bits(i_params, stream_merger_field, 1);
-		stv0900_write_bits(i_params, stream_merger_field, 0);
+		stv0900_write_bits(intp, RST_HWARE, 1);
+		stv0900_write_bits(intp, RST_HWARE, 0);
 	}
 
 	if (algo == STV0900_BLIND_SEARCH)
@@ -2736,12 +1923,12 @@ enum fe_stv0900_signal_type stv0900_algo(struct dvb_frontend *fe)
 	else if (algo == STV0900_COLD_START)
 		lock = stv0900_get_demod_cold_lock(fe, demod_timeout);
 	else if (algo == STV0900_WARM_START)
-		lock = stv0900_get_demod_lock(i_params, demod, demod_timeout);
+		lock = stv0900_get_demod_lock(intp, demod, demod_timeout);
 
 	if ((lock == FALSE) && (algo == STV0900_COLD_START)) {
 		if (low_sr == FALSE) {
-			if (stv0900_check_timing_lock(i_params, demod) == TRUE)
-				lock = stv0900_sw_algo(i_params, demod);
+			if (stv0900_check_timing_lock(intp, demod) == TRUE)
+				lock = stv0900_sw_algo(intp, demod);
 		}
 	}
 
@@ -2750,98 +1937,64 @@ enum fe_stv0900_signal_type stv0900_algo(struct dvb_frontend *fe)
 
 	if ((lock == TRUE) && (signal_type == STV0900_RANGEOK)) {
 		stv0900_track_optimization(fe);
-		if (i_params->chip_id <= 0x11) {
-			if ((stv0900_get_standard(fe, STV0900_DEMOD_1) == STV0900_DVBS1_STANDARD) && (stv0900_get_standard(fe, STV0900_DEMOD_2) == STV0900_DVBS1_STANDARD)) {
+		if (intp->chip_id <= 0x11) {
+			if ((stv0900_get_standard(fe, 0) ==
+						STV0900_DVBS1_STANDARD) &&
+			   (stv0900_get_standard(fe, 1) ==
+						STV0900_DVBS1_STANDARD)) {
 				msleep(20);
-				stv0900_write_bits(i_params, stream_merger_field, 0);
+				stv0900_write_bits(intp, RST_HWARE, 0);
 			} else {
-				stv0900_write_bits(i_params, stream_merger_field, 0);
+				stv0900_write_bits(intp, RST_HWARE, 0);
 				msleep(3);
-				stv0900_write_bits(i_params, stream_merger_field, 1);
-				stv0900_write_bits(i_params, stream_merger_field, 0);
+				stv0900_write_bits(intp, RST_HWARE, 1);
+				stv0900_write_bits(intp, RST_HWARE, 0);
 			}
-		} else if (i_params->chip_id == 0x20) {
-			stv0900_write_bits(i_params, stream_merger_field, 0);
+
+		} else if (intp->chip_id >= 0x20) {
+			stv0900_write_bits(intp, RST_HWARE, 0);
 			msleep(3);
-			stv0900_write_bits(i_params, stream_merger_field, 1);
-			stv0900_write_bits(i_params, stream_merger_field, 0);
+			stv0900_write_bits(intp, RST_HWARE, 1);
+			stv0900_write_bits(intp, RST_HWARE, 0);
 		}
 
-		if (stv0900_wait_for_lock(i_params, demod, fec_timeout, fec_timeout) == TRUE) {
+		if (stv0900_wait_for_lock(intp, demod,
+					fec_timeout, fec_timeout) == TRUE) {
 			lock = TRUE;
-			switch (demod) {
-			case STV0900_DEMOD_1:
-			default:
-				i_params->dmd1_rslts.locked = TRUE;
-				if (i_params->dmd1_rslts.standard == STV0900_DVBS2_STANDARD) {
-					stv0900_set_dvbs2_rolloff(i_params, demod);
-					stv0900_write_reg(i_params, R0900_P1_PDELCTRL2, 0x40);
-					stv0900_write_reg(i_params, R0900_P1_PDELCTRL2, 0);
-					stv0900_write_reg(i_params, R0900_P1_ERRCTRL1, 0x67);
-				} else {
-					stv0900_write_reg(i_params, R0900_P1_ERRCTRL1, 0x75);
-				}
-
-				stv0900_write_reg(i_params, R0900_P1_FBERCPT4, 0);
-				stv0900_write_reg(i_params, R0900_P1_ERRCTRL2, 0xc1);
-				break;
-			case STV0900_DEMOD_2:
-				i_params->dmd2_rslts.locked = TRUE;
-
-				if (i_params->dmd2_rslts.standard == STV0900_DVBS2_STANDARD) {
-					stv0900_set_dvbs2_rolloff(i_params, demod);
-					stv0900_write_reg(i_params, R0900_P2_PDELCTRL2, 0x60);
-					stv0900_write_reg(i_params, R0900_P2_PDELCTRL2, 0x20);
-					stv0900_write_reg(i_params, R0900_P2_ERRCTRL1, 0x67);
-				} else {
-					stv0900_write_reg(i_params, R0900_P2_ERRCTRL1, 0x75);
-				}
-
-				stv0900_write_reg(i_params, R0900_P2_FBERCPT4, 0);
-
-				stv0900_write_reg(i_params, R0900_P2_ERRCTRL2, 0xc1);
-				break;
+			intp->result[demod].locked = TRUE;
+			if (intp->result[demod].standard ==
+						STV0900_DVBS2_STANDARD) {
+				stv0900_set_dvbs2_rolloff(intp, demod);
+				stv0900_write_bits(intp, RESET_UPKO_COUNT, 1);
+				stv0900_write_bits(intp, RESET_UPKO_COUNT, 0);
+				stv0900_write_reg(intp, ERRCTRL1, 0x67);
+			} else {
+				stv0900_write_reg(intp, ERRCTRL1, 0x75);
 			}
+
+			stv0900_write_reg(intp, FBERCPT4, 0);
+			stv0900_write_reg(intp, ERRCTRL2, 0xc1);
 		} else {
 			lock = FALSE;
 			signal_type = STV0900_NODATA;
-			no_signal = stv0900_check_signal_presence(i_params, demod);
-
-			switch (demod) {
-			case STV0900_DEMOD_1:
-			default:
-				i_params->dmd1_rslts.locked = FALSE;
-				break;
-			case STV0900_DEMOD_2:
-				i_params->dmd2_rslts.locked = FALSE;
-				break;
-			}
+			no_signal = stv0900_check_signal_presence(intp, demod);
+
+				intp->result[demod].locked = FALSE;
 		}
 	}
 
-	if ((signal_type == STV0900_NODATA) && (no_signal == FALSE)) {
-		switch (demod) {
-		case STV0900_DEMOD_1:
-		default:
-			if (i_params->chip_id <= 0x11) {
-				if ((stv0900_get_bits(i_params, F0900_P1_HEADER_MODE) == STV0900_DVBS_FOUND) &&
-						(i_params->dmd1_srch_iq_inv <= STV0900_IQ_AUTO_NORMAL_FIRST))
-					signal_type = stv0900_dvbs1_acq_workaround(fe);
-			} else
-				i_params->dmd1_rslts.locked = FALSE;
+	if ((signal_type != STV0900_NODATA) || (no_signal != FALSE))
+		return signal_type;
 
-			break;
-		case STV0900_DEMOD_2:
-			if (i_params->chip_id <= 0x11) {
-				if ((stv0900_get_bits(i_params, F0900_P2_HEADER_MODE) == STV0900_DVBS_FOUND) &&
-						(i_params->dmd2_srch_iq_inv <= STV0900_IQ_AUTO_NORMAL_FIRST))
-					signal_type = stv0900_dvbs1_acq_workaround(fe);
-			} else
-				i_params->dmd2_rslts.locked = FALSE;
-			break;
-		}
+	if (intp->chip_id > 0x11) {
+		intp->result[demod].locked = FALSE;
+		return signal_type;
 	}
 
+	if ((stv0900_get_bits(intp, HEADER_MODE) == STV0900_DVBS_FOUND) &&
+	   (intp->srch_iq_inv[demod] <= STV0900_IQ_AUTO_NORMAL_FIRST))
+		signal_type = stv0900_dvbs1_acq_workaround(fe);
+
 	return signal_type;
 }
 
diff --git a/drivers/media/dvb/frontends/stv090x.c b/drivers/media/dvb/frontends/stv090x.c
index 488bdfb34fb3..1573466a5c74 100644
--- a/drivers/media/dvb/frontends/stv090x.c
+++ b/drivers/media/dvb/frontends/stv090x.c
@@ -825,7 +825,7 @@ static int stv090x_set_min_srate(struct stv090x_state *state, u32 clk, u32 srate
 		sym /= (state->mclk >> 7);
 	}
 
-	if (STV090x_WRITE_DEMOD(state, SFRLOW1, ((sym >> 8) & 0xff)) < 0) /* MSB */
+	if (STV090x_WRITE_DEMOD(state, SFRLOW1, ((sym >> 8) & 0x7f)) < 0) /* MSB */
 		goto err;
 	if (STV090x_WRITE_DEMOD(state, SFRLOW0, (sym & 0xff)) < 0) /* LSB */
 		goto err;
@@ -1238,6 +1238,8 @@ static int stv090x_delivery_search(struct stv090x_state *state)
 				goto err;
 		}
 
+		if (stv090x_set_vit_thtracq(state) < 0)
+			goto err;
 		break;
 
 	case STV090x_SEARCH_AUTO:
@@ -1278,17 +1280,8 @@ static int stv090x_delivery_search(struct stv090x_state *state)
 				goto err;
 		}
 
-		if (state->srate >= 2000000) {
-			/* Srate >= 2MSPS, Viterbi threshold to acquire */
-			if (stv090x_set_vit_thacq(state) < 0)
-				goto err;
-		} else {
-			/* Srate < 2MSPS, Reset Viterbi thresholdto track
-			 * and then re-acquire
-			 */
-			if (stv090x_set_vit_thtracq(state) < 0)
-				goto err;
-		}
+		if (stv090x_set_vit_thacq(state) < 0)
+			goto err;
 
 		if (stv090x_set_viterbi(state) < 0)
 			goto err;
@@ -1317,7 +1310,7 @@ static int stv090x_start_search(struct stv090x_state *state)
 				goto err;
 			if (STV090x_WRITE_DEMOD(state, CFRUP1, 0x0f) < 0)
 				goto err;
-			if (STV090x_WRITE_DEMOD(state, CFRUP1, 0xff) < 0)
+			if (STV090x_WRITE_DEMOD(state, CFRUP0, 0xff) < 0)
 				goto err;
 			if (STV090x_WRITE_DEMOD(state, CFRLOW1, 0xf0) < 0)
 				goto err;
@@ -1371,7 +1364,7 @@ static int stv090x_start_search(struct stv090x_state *state)
 
 		if (STV090x_WRITE_DEMOD(state, CFRUP1, MSB(freq)) < 0)
 			goto err;
-		if (STV090x_WRITE_DEMOD(state, CFRUP1, LSB(freq)) < 0)
+		if (STV090x_WRITE_DEMOD(state, CFRUP0, LSB(freq)) < 0)
 			goto err;
 
 		freq *= -1;
@@ -1422,6 +1415,9 @@ static int stv090x_start_search(struct stv090x_state *state)
 	if (STV090x_WRITE_DEMOD(state, DMDCFG2, reg) < 0)
 		goto err;
 
+	if (STV090x_WRITE_DEMOD(state, RTC, 0x88) < 0)
+		goto err;
+
 	if (state->dev_ver >= 0x20) {
 		/*Frequency offset detector setting*/
 		if (state->srate < 2000000) {
@@ -1430,20 +1426,22 @@ static int stv090x_start_search(struct stv090x_state *state)
 				if (STV090x_WRITE_DEMOD(state, CARFREQ, 0x39) < 0)
 					goto err;
 			} else {
-				/* Cut 2 */
+				/* Cut 3 */
 				if (STV090x_WRITE_DEMOD(state, CARFREQ, 0x89) < 0)
 					goto err;
 			}
 			if (STV090x_WRITE_DEMOD(state, CARHDR, 0x40) < 0)
 				goto err;
-		}
-
-		if (state->srate < 10000000) {
+		} else if (state->srate < 10000000) {
 			if (STV090x_WRITE_DEMOD(state, CARFREQ, 0x4c) < 0)
 				goto err;
+			if (STV090x_WRITE_DEMOD(state, CARHDR, 0x20) < 0)
+				goto err;
 		} else {
 			if (STV090x_WRITE_DEMOD(state, CARFREQ, 0x4b) < 0)
 				goto err;
+			if (STV090x_WRITE_DEMOD(state, CARHDR, 0x20) < 0)
+				goto err;
 		}
 	} else {
 		if (state->srate < 10000000) {
@@ -1485,14 +1483,14 @@ err:
 
 static int stv090x_get_agc2_min_level(struct stv090x_state *state)
 {
-	u32 agc2_min = 0, agc2 = 0, freq_init, freq_step, reg;
+	u32 agc2_min = 0xffff, agc2 = 0, freq_init, freq_step, reg;
 	s32 i, j, steps, dir;
 
 	if (STV090x_WRITE_DEMOD(state, AGC2REF, 0x38) < 0)
 		goto err;
 	reg = STV090x_READ_DEMOD(state, DMDCFGMD);
-	STV090x_SETFIELD_Px(reg, SCAN_ENABLE_FIELD, 1);
-	STV090x_SETFIELD_Px(reg, CFR_AUTOSCAN_FIELD, 1);
+	STV090x_SETFIELD_Px(reg, SCAN_ENABLE_FIELD, 0);
+	STV090x_SETFIELD_Px(reg, CFR_AUTOSCAN_FIELD, 0);
 	if (STV090x_WRITE_DEMOD(state, DMDCFGMD, reg) < 0)
 		goto err;
 
@@ -1509,10 +1507,8 @@ static int stv090x_get_agc2_min_level(struct stv090x_state *state)
 	if (stv090x_set_srate(state, 1000000) < 0)
 		goto err;
 
-	steps  = -1 + state->search_range / 1000000;
-	steps /= 2;
-	steps  = (2 * steps) + 1;
-	if (steps < 0)
+	steps  = state->search_range / 1000000;
+	if (steps <= 0)
 		steps = 1;
 
 	dir = 1;
@@ -1525,7 +1521,7 @@ static int stv090x_get_agc2_min_level(struct stv090x_state *state)
 		else
 			freq_init = freq_init - (freq_step * i);
 
-		dir = -1;
+		dir *= -1;
 
 		if (STV090x_WRITE_DEMOD(state, DMDISTATE, 0x5c) < 0) /* Demod RESET */
 			goto err;
@@ -1536,13 +1532,14 @@ static int stv090x_get_agc2_min_level(struct stv090x_state *state)
 		if (STV090x_WRITE_DEMOD(state, DMDISTATE, 0x58) < 0) /* Demod RESET */
 			goto err;
 		msleep(10);
+
+		agc2 = 0;
 		for (j = 0; j < 10; j++) {
-			agc2 += STV090x_READ_DEMOD(state, AGC2I1) << 8;
-			agc2 |= STV090x_READ_DEMOD(state, AGC2I0);
+			agc2 += (STV090x_READ_DEMOD(state, AGC2I1) << 8) |
+				STV090x_READ_DEMOD(state, AGC2I0);
 		}
 		agc2 /= 10;
-		agc2_min = 0xffff;
-		if (agc2 < 0xffff)
+		if (agc2 < agc2_min)
 			agc2_min = agc2;
 	}
 
@@ -1584,6 +1581,12 @@ static u32 stv090x_srate_srch_coarse(struct stv090x_state *state)
 	int tmg_lock = 0, i;
 	s32 tmg_cpt = 0, dir = 1, steps, cur_step = 0, freq;
 	u32 srate_coarse = 0, agc2 = 0, car_step = 1200, reg;
+	u32 agc2th;
+
+	if (state->dev_ver >= 0x30)
+		agc2th = 0x2e00;
+	else
+		agc2th = 0x1f00;
 
 	reg = STV090x_READ_DEMOD(state, DMDISTATE);
 	STV090x_SETFIELD_Px(reg, I2C_DEMOD_MODE_FIELD, 0x1f); /* Demod RESET */
@@ -1591,13 +1594,15 @@ static u32 stv090x_srate_srch_coarse(struct stv090x_state *state)
 		goto err;
 	if (STV090x_WRITE_DEMOD(state, TMGCFG, 0x12) < 0)
 		goto err;
+	if (STV090x_WRITE_DEMOD(state, TMGCFG2, 0xc0) < 0)
+		goto err;
 	if (STV090x_WRITE_DEMOD(state, TMGTHRISE, 0xf0) < 0)
 		goto err;
 	if (STV090x_WRITE_DEMOD(state, TMGTHFALL, 0xe0) < 0)
 		goto err;
 	reg = STV090x_READ_DEMOD(state, DMDCFGMD);
 	STV090x_SETFIELD_Px(reg, SCAN_ENABLE_FIELD, 1);
-	STV090x_SETFIELD_Px(reg, CFR_AUTOSCAN_FIELD, 1);
+	STV090x_SETFIELD_Px(reg, CFR_AUTOSCAN_FIELD, 0);
 	if (STV090x_WRITE_DEMOD(state, DMDCFGMD, reg) < 0)
 		goto err;
 
@@ -1611,13 +1616,13 @@ static u32 stv090x_srate_srch_coarse(struct stv090x_state *state)
 		goto err;
 	if (STV090x_WRITE_DEMOD(state, DMDTOM, 0x00) < 0)
 		goto err;
-	if (STV090x_WRITE_DEMOD(state, AGC2REF, 0x60) < 0)
+	if (STV090x_WRITE_DEMOD(state, AGC2REF, 0x50) < 0)
 		goto err;
 
 	if (state->dev_ver >= 0x30) {
 		if (STV090x_WRITE_DEMOD(state, CARFREQ, 0x99) < 0)
 			goto err;
-		if (STV090x_WRITE_DEMOD(state, SFRSTEP, 0x95) < 0)
+		if (STV090x_WRITE_DEMOD(state, SFRSTEP, 0x98) < 0)
 			goto err;
 
 	} else if (state->dev_ver >= 0x20) {
@@ -1652,23 +1657,31 @@ static u32 stv090x_srate_srch_coarse(struct stv090x_state *state)
 	while ((!tmg_lock) && (cur_step < steps)) {
 		if (STV090x_WRITE_DEMOD(state, DMDISTATE, 0x5f) < 0) /* Demod RESET */
 			goto err;
-		reg = STV090x_READ_DEMOD(state, DMDISTATE);
-		STV090x_SETFIELD_Px(reg, I2C_DEMOD_MODE_FIELD, 0x00); /* trigger acquisition */
-		if (STV090x_WRITE_DEMOD(state, DMDISTATE, reg) < 0)
+		if (STV090x_WRITE_DEMOD(state, CFRINIT1, 0x00) < 0)
+			goto err;
+		if (STV090x_WRITE_DEMOD(state, CFRINIT0, 0x00) < 0)
+			goto err;
+		if (STV090x_WRITE_DEMOD(state, SFRINIT1, 0x00) < 0)
+			goto err;
+		if (STV090x_WRITE_DEMOD(state, SFRINIT0, 0x00) < 0)
+			goto err;
+		/* trigger acquisition */
+		if (STV090x_WRITE_DEMOD(state, DMDISTATE, 0x40) < 0)
 			goto err;
 		msleep(50);
 		for (i = 0; i < 10; i++) {
 			reg = STV090x_READ_DEMOD(state, DSTATUS);
 			if (STV090x_GETFIELD_Px(reg, TMGLOCK_QUALITY_FIELD) >= 2)
 				tmg_cpt++;
-			agc2 += STV090x_READ_DEMOD(state, AGC2I1) << 8;
-			agc2 |= STV090x_READ_DEMOD(state, AGC2I0);
+			agc2 += (STV090x_READ_DEMOD(state, AGC2I1) << 8) |
+				STV090x_READ_DEMOD(state, AGC2I0);
 		}
 		agc2 /= 10;
 		srate_coarse = stv090x_get_srate(state, state->mclk);
 		cur_step++;
 		dir *= -1;
-		if ((tmg_cpt >= 5) && (agc2 < 0x1f00) && (srate_coarse < 55000000) && (srate_coarse > 850000))
+		if ((tmg_cpt >= 5) && (agc2 < agc2th) &&
+		    (srate_coarse < 50000000) && (srate_coarse > 850000))
 			tmg_lock = 1;
 		else if (cur_step < steps) {
 			if (dir > 0)
@@ -1681,7 +1694,7 @@ static u32 stv090x_srate_srch_coarse(struct stv090x_state *state)
 				goto err;
 
 			if (state->config->tuner_set_frequency) {
-				if (state->config->tuner_set_frequency(fe, state->frequency) < 0)
+				if (state->config->tuner_set_frequency(fe, freq) < 0)
 					goto err;
 			}
 
@@ -1738,7 +1751,7 @@ static u32 stv090x_srate_srch_fine(struct stv090x_state *state)
 	else {
 		if (STV090x_WRITE_DEMOD(state, DMDISTATE, 0x1f) < 0) /* Demod RESET */
 			goto err;
-		if (STV090x_WRITE_DEMOD(state, TMGCFG2, 0x01) < 0)
+		if (STV090x_WRITE_DEMOD(state, TMGCFG2, 0xc1) < 0)
 			goto err;
 		if (STV090x_WRITE_DEMOD(state, TMGTHRISE, 0x20) < 0)
 			goto err;
@@ -1751,6 +1764,9 @@ static u32 stv090x_srate_srch_fine(struct stv090x_state *state)
 		if (STV090x_WRITE_DEMOD(state, DMDCFGMD, reg) < 0)
 			goto err;
 
+		if (STV090x_WRITE_DEMOD(state, AGC2REF, 0x38) < 0)
+			goto err;
+
 		if (state->dev_ver >= 0x30) {
 			if (STV090x_WRITE_DEMOD(state, CARFREQ, 0x79) < 0)
 				goto err;
@@ -1856,12 +1872,12 @@ static int stv090x_get_dmdlock(struct stv090x_state *state, s32 timeout)
 static int stv090x_blind_search(struct stv090x_state *state)
 {
 	u32 agc2, reg, srate_coarse;
-	s32 timeout_dmd = 500, cpt_fail, agc2_ovflw, i;
+	s32 cpt_fail, agc2_ovflw, i;
 	u8 k_ref, k_max, k_min;
 	int coarse_fail, lock;
 
-	k_max = 120;
-	k_min = 30;
+	k_max = 110;
+	k_min = 10;
 
 	agc2 = stv090x_get_agc2_min_level(state);
 
@@ -1900,7 +1916,8 @@ static int stv090x_blind_search(struct stv090x_state *state)
 				srate_coarse = stv090x_srate_srch_fine(state);
 				if (srate_coarse != 0) {
 					stv090x_get_lock_tmg(state);
-					lock = stv090x_get_dmdlock(state, timeout_dmd);
+					lock = stv090x_get_dmdlock(state,
+							state->DemodTimeout);
 				} else {
 					lock = 0;
 				}
@@ -1908,8 +1925,8 @@ static int stv090x_blind_search(struct stv090x_state *state)
 				cpt_fail = 0;
 				agc2_ovflw = 0;
 				for (i = 0; i < 10; i++) {
-					agc2  = STV090x_READ_DEMOD(state, AGC2I1) << 8;
-					agc2 |= STV090x_READ_DEMOD(state, AGC2I0);
+					agc2 += (STV090x_READ_DEMOD(state, AGC2I1) << 8) |
+						STV090x_READ_DEMOD(state, AGC2I0);
 					if (agc2 >= 0xff00)
 						agc2_ovflw++;
 					reg = STV090x_READ_DEMOD(state, DSTATUS2);
@@ -1923,7 +1940,7 @@ static int stv090x_blind_search(struct stv090x_state *state)
 
 				lock = 0;
 			}
-			k_ref -= 30;
+			k_ref -= 20;
 		} while ((k_ref >= k_min) && (!lock) && (!coarse_fail));
 	}
 
@@ -2062,7 +2079,7 @@ static int stv090x_get_coldlock(struct stv090x_state *state, s32 timeout_dmd)
 						goto err;
 
 					if (state->config->tuner_set_frequency) {
-						if (state->config->tuner_set_frequency(fe, state->frequency) < 0)
+						if (state->config->tuner_set_frequency(fe, freq) < 0)
 							goto err;
 					}
 
@@ -2093,17 +2110,6 @@ static int stv090x_get_coldlock(struct stv090x_state *state, s32 timeout_dmd)
 						goto err;
 
 					STV090x_WRITE_DEMOD(state, DMDISTATE, 0x1c);
-					if (state->delsys == STV090x_DVBS2) {
-						reg = STV090x_READ_DEMOD(state, DMDCFGMD);
-						STV090x_SETFIELD_Px(reg, DVBS1_ENABLE_FIELD, 0);
-						STV090x_SETFIELD_Px(reg, DVBS2_ENABLE_FIELD, 0);
-						if (STV090x_WRITE_DEMOD(state, DMDCFGMD, reg) < 0)
-							goto err;
-						STV090x_SETFIELD_Px(reg, DVBS1_ENABLE_FIELD, 1);
-						STV090x_SETFIELD_Px(reg, DVBS2_ENABLE_FIELD, 1);
-						if (STV090x_WRITE_DEMOD(state, DMDCFGMD, reg) < 0)
-							goto err;
-					}
 					if (STV090x_WRITE_DEMOD(state, CFRINIT1, 0x00) < 0)
 						goto err;
 					if (STV090x_WRITE_DEMOD(state, CFRINIT0, 0x00) < 0)
@@ -2425,7 +2431,7 @@ static s32 stv090x_get_car_freq(struct stv090x_state *state, u32 mclk)
 
 	derot = (int_1 * int_2) +
 		((int_1 * tmp_2) >> 12) +
-		((int_1 * tmp_1) >> 12);
+		((int_2 * tmp_1) >> 12);
 
 	return derot;
 }
@@ -2732,7 +2738,7 @@ static int stv090x_optimize_track(struct stv090x_state *state)
 	switch (state->delsys) {
 	case STV090x_DVBS1:
 	case STV090x_DSS:
-		if (state->algo == STV090x_SEARCH_AUTO) {
+		if (state->search_mode == STV090x_SEARCH_AUTO) {
 			reg = STV090x_READ_DEMOD(state, DMDCFGMD);
 			STV090x_SETFIELD_Px(reg, DVBS1_ENABLE_FIELD, 1);
 			STV090x_SETFIELD_Px(reg, DVBS2_ENABLE_FIELD, 0);
@@ -2857,6 +2863,9 @@ static int stv090x_optimize_track(struct stv090x_state *state)
 		if (stv090x_set_srate(state, srate) < 0)
 			goto err;
 		blind_tune = 1;
+
+		if (stv090x_dvbs_track_crl(state) < 0)
+			goto err;
 	}
 
 	if (state->dev_ver >= 0x20) {
@@ -3042,7 +3051,7 @@ static enum stv090x_signal_state stv090x_algo(struct stv090x_state *state)
 	struct dvb_frontend *fe = &state->frontend;
 	enum stv090x_signal_state signal_state = STV090x_NOCARRIER;
 	u32 reg;
-	s32 timeout_dmd = 500, timeout_fec = 50, agc1_power, power_iq = 0, i;
+	s32 agc1_power, power_iq = 0, i;
 	int lock = 0, low_sr = 0, no_signal = 0;
 
 	reg = STV090x_READ_DEMOD(state, TSCFGH);
@@ -3054,8 +3063,13 @@ static enum stv090x_signal_state stv090x_algo(struct stv090x_state *state)
 		goto err;
 
 	if (state->dev_ver >= 0x20) {
-		if (STV090x_WRITE_DEMOD(state, CORRELABS, 0x9e) < 0) /* cut 2.0 */
-			goto err;
+		if (state->srate > 5000000) {
+			if (STV090x_WRITE_DEMOD(state, CORRELABS, 0x9e) < 0)
+				goto err;
+		} else {
+			if (STV090x_WRITE_DEMOD(state, CORRELABS, 0x82) < 0)
+				goto err;
+		}
 	}
 
 	stv090x_get_lock_tmg(state);
@@ -3175,7 +3189,7 @@ static enum stv090x_signal_state stv090x_algo(struct stv090x_state *state)
 	if ((agc1_power == 0) && (power_iq < STV090x_IQPOWER_THRESHOLD)) {
 		dprintk(FE_ERROR, 1, "No Signal: POWER_IQ=0x%02x", power_iq);
 		lock = 0;
-
+		signal_state = STV090x_NOAGC1;
 	} else {
 		reg = STV090x_READ_DEMOD(state, DEMOD);
 		STV090x_SETFIELD_Px(reg, SPECINV_CONTROL_FIELD, state->inversion);
@@ -3199,18 +3213,17 @@ static enum stv090x_signal_state stv090x_algo(struct stv090x_state *state)
 		}
 	}
 
-	/* need to check for AGC1 state */
-
-
+	if (signal_state == STV090x_NOAGC1)
+		return signal_state;
 
 	if (state->algo == STV090x_BLIND_SEARCH)
 		lock = stv090x_blind_search(state);
 
 	else if (state->algo == STV090x_COLD_SEARCH)
-		lock = stv090x_get_coldlock(state, timeout_dmd);
+		lock = stv090x_get_coldlock(state, state->DemodTimeout);
 
 	else if (state->algo == STV090x_WARM_SEARCH)
-		lock = stv090x_get_dmdlock(state, timeout_dmd);
+		lock = stv090x_get_dmdlock(state, state->DemodTimeout);
 
 	if ((!lock) && (state->algo == STV090x_COLD_SEARCH)) {
 		if (!low_sr) {
@@ -3245,8 +3258,9 @@ static enum stv090x_signal_state stv090x_algo(struct stv090x_state *state)
 				goto err;
 		}
 
-		if (stv090x_get_lock(state, timeout_fec, timeout_fec)) {
-			lock = 1;
+		lock = stv090x_get_lock(state, state->FecTimeout,
+				state->FecTimeout);
+		if (lock) {
 			if (state->delsys == STV090x_DVBS2) {
 				stv090x_set_s2rolloff(state);
 
@@ -3273,7 +3287,6 @@ static enum stv090x_signal_state stv090x_algo(struct stv090x_state *state)
 			if (STV090x_WRITE_DEMOD(state, ERRCTRL2, 0xc1) < 0)
 				goto err;
 		} else {
-			lock = 0;
 			signal_state = STV090x_NODATA;
 			no_signal = stv090x_chk_signal(state);
 		}
@@ -3296,7 +3309,13 @@ static enum dvbfe_search stv090x_search(struct dvb_frontend *fe, struct dvb_fron
 	state->search_mode = STV090x_SEARCH_AUTO;
 	state->algo = STV090x_COLD_SEARCH;
 	state->fec = STV090x_PRERR;
-	state->search_range = 2000000;
+	if (state->srate > 10000000) {
+		dprintk(FE_DEBUG, 1, "Search range: 10 MHz");
+		state->search_range = 10000000;
+	} else {
+		dprintk(FE_DEBUG, 1, "Search range: 5 MHz");
+		state->search_range = 5000000;
+	}
 
 	if (stv090x_algo(state) == STV090x_RANGEOK) {
 		dprintk(FE_DEBUG, 1, "Search success!");
@@ -3309,7 +3328,6 @@ static enum dvbfe_search stv090x_search(struct dvb_frontend *fe, struct dvb_fron
 	return DVBFE_ALGO_SEARCH_ERROR;
 }
 
-/* FIXME! */
 static int stv090x_read_status(struct dvb_frontend *fe, enum fe_status *status)
 {
 	struct stv090x_state *state = fe->demodulator_priv;
@@ -3331,9 +3349,15 @@ static int stv090x_read_status(struct dvb_frontend *fe, enum fe_status *status)
 		dprintk(FE_DEBUG, 1, "Delivery system: DVB-S2");
 		reg = STV090x_READ_DEMOD(state, DSTATUS);
 		if (STV090x_GETFIELD_Px(reg, LOCK_DEFINITIF_FIELD)) {
-			reg = STV090x_READ_DEMOD(state, TSSTATUS);
-			if (STV090x_GETFIELD_Px(reg, TSFIFO_LINEOK_FIELD)) {
-				*status = FE_HAS_CARRIER | FE_HAS_VITERBI | FE_HAS_SYNC | FE_HAS_LOCK;
+			reg = STV090x_READ_DEMOD(state, PDELSTATUS1);
+			if (STV090x_GETFIELD_Px(reg, PKTDELIN_LOCK_FIELD)) {
+				reg = STV090x_READ_DEMOD(state, TSSTATUS);
+				if (STV090x_GETFIELD_Px(reg, TSFIFO_LINEOK_FIELD)) {
+					*status = FE_HAS_CARRIER |
+						  FE_HAS_VITERBI |
+						  FE_HAS_SYNC |
+						  FE_HAS_LOCK;
+				}
 			}
 		}
 		break;
@@ -3412,14 +3436,12 @@ static int stv090x_table_lookup(const struct stv090x_tab *tab, int max, int val)
 	int res = 0;
 	int min = 0, med;
 
-	if (val < tab[min].read)
-		res = tab[min].real;
-	else if (val >= tab[max].read)
-		res = tab[max].real;
-	else {
+	if ((val >= tab[min].read && val < tab[max].read) ||
+	    (val >= tab[max].read && val < tab[min].read)) {
 		while ((max - min) > 1) {
 			med = (max + min) / 2;
-			if (val >= tab[min].read && val < tab[med].read)
+			if ((val >= tab[min].read && val < tab[med].read) ||
+			    (val >= tab[med].read && val < tab[min].read))
 				max = med;
 			else
 				min = med;
@@ -3428,6 +3450,18 @@ static int stv090x_table_lookup(const struct stv090x_tab *tab, int max, int val)
 		       (tab[max].real - tab[min].real) /
 		       (tab[max].read - tab[min].read)) +
 			tab[min].real;
+	} else {
+		if (tab[min].read < tab[max].read) {
+			if (val < tab[min].read)
+				res = tab[min].real;
+			else if (val >= tab[max].read)
+				res = tab[max].real;
+		} else {
+			if (val >= tab[min].read)
+				res = tab[min].real;
+			else if (val < tab[max].read)
+				res = tab[max].real;
+		}
 	}
 
 	return res;
@@ -3437,16 +3471,22 @@ static int stv090x_read_signal_strength(struct dvb_frontend *fe, u16 *strength)
 {
 	struct stv090x_state *state = fe->demodulator_priv;
 	u32 reg;
-	s32 agc;
+	s32 agc_0, agc_1, agc;
+	s32 str;
 
 	reg = STV090x_READ_DEMOD(state, AGCIQIN1);
-	agc = STV090x_GETFIELD_Px(reg, AGCIQ_VALUE_FIELD);
+	agc_1 = STV090x_GETFIELD_Px(reg, AGCIQ_VALUE_FIELD);
+	reg = STV090x_READ_DEMOD(state, AGCIQIN0);
+	agc_0 = STV090x_GETFIELD_Px(reg, AGCIQ_VALUE_FIELD);
+	agc = MAKEWORD16(agc_1, agc_0);
 
-	*strength = stv090x_table_lookup(stv090x_rf_tab, ARRAY_SIZE(stv090x_rf_tab) - 1, agc);
+	str = stv090x_table_lookup(stv090x_rf_tab,
+		ARRAY_SIZE(stv090x_rf_tab) - 1, agc);
 	if (agc > stv090x_rf_tab[0].read)
-		*strength = 5;
+		str = 0;
 	else if (agc < stv090x_rf_tab[ARRAY_SIZE(stv090x_rf_tab) - 1].read)
-		*strength = -100;
+		str = -100;
+	*strength = (str + 100) * 0xFFFF / 100;
 
 	return 0;
 }
@@ -3457,6 +3497,8 @@ static int stv090x_read_cnr(struct dvb_frontend *fe, u16 *cnr)
 	u32 reg_0, reg_1, reg, i;
 	s32 val_0, val_1, val = 0;
 	u8 lock_f;
+	s32 div;
+	u32 last;
 
 	switch (state->delsys) {
 	case STV090x_DVBS2:
@@ -3468,14 +3510,15 @@ static int stv090x_read_cnr(struct dvb_frontend *fe, u16 *cnr)
 				reg_1 = STV090x_READ_DEMOD(state, NNOSPLHT1);
 				val_1 = STV090x_GETFIELD_Px(reg_1, NOSPLHT_NORMED_FIELD);
 				reg_0 = STV090x_READ_DEMOD(state, NNOSPLHT0);
-				val_0 = STV090x_GETFIELD_Px(reg_1, NOSPLHT_NORMED_FIELD);
+				val_0 = STV090x_GETFIELD_Px(reg_0, NOSPLHT_NORMED_FIELD);
 				val  += MAKEWORD16(val_1, val_0);
 				msleep(1);
 			}
 			val /= 16;
-			*cnr = stv090x_table_lookup(stv090x_s2cn_tab, ARRAY_SIZE(stv090x_s2cn_tab) - 1, val);
-			if (val < stv090x_s2cn_tab[ARRAY_SIZE(stv090x_s2cn_tab) - 1].read)
-				*cnr = 1000;
+			last = ARRAY_SIZE(stv090x_s2cn_tab) - 1;
+			div = stv090x_s2cn_tab[0].read -
+			      stv090x_s2cn_tab[last].read;
+			*cnr = 0xFFFF - ((val * 0xFFFF) / div);
 		}
 		break;
 
@@ -3489,14 +3532,15 @@ static int stv090x_read_cnr(struct dvb_frontend *fe, u16 *cnr)
 				reg_1 = STV090x_READ_DEMOD(state, NOSDATAT1);
 				val_1 = STV090x_GETFIELD_Px(reg_1, NOSDATAT_UNNORMED_FIELD);
 				reg_0 = STV090x_READ_DEMOD(state, NOSDATAT0);
-				val_0 = STV090x_GETFIELD_Px(reg_1, NOSDATAT_UNNORMED_FIELD);
+				val_0 = STV090x_GETFIELD_Px(reg_0, NOSDATAT_UNNORMED_FIELD);
 				val  += MAKEWORD16(val_1, val_0);
 				msleep(1);
 			}
 			val /= 16;
-			*cnr = stv090x_table_lookup(stv090x_s1cn_tab, ARRAY_SIZE(stv090x_s1cn_tab) - 1, val);
-			if (val < stv090x_s2cn_tab[ARRAY_SIZE(stv090x_s1cn_tab) - 1].read)
-				*cnr = 1000;
+			last = ARRAY_SIZE(stv090x_s1cn_tab) - 1;
+			div = stv090x_s1cn_tab[0].read -
+			      stv090x_s1cn_tab[last].read;
+			*cnr = 0xFFFF - ((val * 0xFFFF) / div);
 		}
 		break;
 	default:
@@ -3553,7 +3597,8 @@ static int stv090x_send_diseqc_msg(struct dvb_frontend *fe, struct dvb_diseqc_ma
 
 	reg = STV090x_READ_DEMOD(state, DISTXCTL);
 
-	STV090x_SETFIELD_Px(reg, DISTX_MODE_FIELD, 2);
+	STV090x_SETFIELD_Px(reg, DISTX_MODE_FIELD,
+		(state->config->diseqc_envelope_mode) ? 4 : 2);
 	STV090x_SETFIELD_Px(reg, DISEQC_RESET_FIELD, 1);
 	if (STV090x_WRITE_DEMOD(state, DISTXCTL, reg) < 0)
 		goto err;
@@ -3605,10 +3650,10 @@ static int stv090x_send_diseqc_burst(struct dvb_frontend *fe, fe_sec_mini_cmd_t
 	reg = STV090x_READ_DEMOD(state, DISTXCTL);
 
 	if (burst == SEC_MINI_A) {
-		mode = 3;
+		mode = (state->config->diseqc_envelope_mode) ? 5 : 3;
 		value = 0x00;
 	} else {
-		mode = 2;
+		mode = (state->config->diseqc_envelope_mode) ? 4 : 2;
 		value = 0xFF;
 	}
 
@@ -3732,6 +3777,8 @@ static int stv090x_ldpc_mode(struct stv090x_state *state, enum stv090x_mode ldpc
 {
 	u32 reg = 0;
 
+	reg = stv090x_read_reg(state, STV090x_GENCFG);
+
 	switch (ldpc_mode) {
 	case STV090x_DUAL:
 	default:
diff --git a/drivers/media/dvb/frontends/stv090x.h b/drivers/media/dvb/frontends/stv090x.h
index e968c98bb70f..b133807663ea 100644
--- a/drivers/media/dvb/frontends/stv090x.h
+++ b/drivers/media/dvb/frontends/stv090x.h
@@ -75,6 +75,8 @@ struct stv090x_config {
 
 	enum stv090x_i2crpt	repeater_level;
 
+	bool diseqc_envelope_mode;
+
 	int (*tuner_init) (struct dvb_frontend *fe);
 	int (*tuner_set_mode) (struct dvb_frontend *fe, enum tuner_mode mode);
 	int (*tuner_set_frequency) (struct dvb_frontend *fe, u32 frequency);
diff --git a/drivers/media/dvb/frontends/stv090x_priv.h b/drivers/media/dvb/frontends/stv090x_priv.h
index 5a4a01740d88..5921a8d6c89f 100644
--- a/drivers/media/dvb/frontends/stv090x_priv.h
+++ b/drivers/media/dvb/frontends/stv090x_priv.h
@@ -83,7 +83,7 @@
 
 #define STV090x_IQPOWER_THRESHOLD	  30
 #define STV090x_SEARCH_AGC2_TH_CUT20	 700
-#define STV090x_SEARCH_AGC2_TH_CUT30	1200
+#define STV090x_SEARCH_AGC2_TH_CUT30	1400
 
 #define STV090x_SEARCH_AGC2_TH(__ver)	\
 	((__ver <= 0x20) ?		\
@@ -91,6 +91,7 @@
 	STV090x_SEARCH_AGC2_TH_CUT30)
 
 enum stv090x_signal_state {
+	STV090x_NOAGC1,
 	STV090x_NOCARRIER,
 	STV090x_NODATA,
 	STV090x_DATAOK,
diff --git a/drivers/media/dvb/frontends/stv090x_reg.h b/drivers/media/dvb/frontends/stv090x_reg.h
index 57b6abbbd32d..2502855dd784 100644
--- a/drivers/media/dvb/frontends/stv090x_reg.h
+++ b/drivers/media/dvb/frontends/stv090x_reg.h
@@ -44,7 +44,7 @@
 #define STV090x_OFFST_OUTSERRS2_HZ_FIELD	5
 #define STV090x_WIDTH_OUTSERRS2_HZ_FIELD	1
 #define STV090x_OFFST_OUTSERRS3_HZ_FIELD	4
-#define STV090x_WIDTH_OUTPARRS3_HZ_FIELD	1
+#define STV090x_WIDTH_OUTSERRS3_HZ_FIELD	1
 #define STV090x_OFFST_OUTPARRS3_HZ_FIELD	3
 #define STV090x_WIDTH_OUTPARRS3_HZ_FIELD	1
 
@@ -113,24 +113,24 @@
 #define STV090x_IRQMASK3			0xf124
 #define STV090x_OFFST_MPLL_LOCK_FIELD		5
 #define STV090x_WIDTH_MPLL_LOCK_FIELD		1
-#define STV090x_OFFST_MSTREAM_LCK_3_FIELD	2
-#define STV090x_WIDTH_MSTREAM_LCK_3_FIELD	3
-#define STV090x_OFFST_MSTREAM_LCK_2_FIELD	2
-#define STV090x_WIDTH_MSTREAM_LCK_2_FIELD	3
+#define STV090x_OFFST_MSTREAM_LCK_3_FIELD	4
+#define STV090x_WIDTH_MSTREAM_LCK_3_FIELD	1
+#define STV090x_OFFST_MSTREAM_LCK_2_FIELD	3
+#define STV090x_WIDTH_MSTREAM_LCK_2_FIELD	1
 #define STV090x_OFFST_MSTREAM_LCK_1_FIELD	2
-#define STV090x_WIDTH_MSTREAM_LCK_1_FIELD	3
+#define STV090x_WIDTH_MSTREAM_LCK_1_FIELD	1
 #define STV090x_OFFST_MDVBS1_PRF_2_FIELD	1
 #define STV090x_WIDTH_MDVBS1_PRF_2_FIELD	1
 #define STV090x_OFFST_MDVBS1_PRF_1_FIELD	0
 #define STV090x_WIDTH_MDVBS1_PRF_1_FIELD	1
 
 #define STV090x_IRQMASK2			0xf125
-#define STV090x_OFFST_MSPY_ENDSIM_3_FIELD	5
-#define STV090x_WIDTH_MSPY_ENDSIM_3_FIELD	3
-#define STV090x_OFFST_MSPY_ENDSIM_2_FIELD	5
-#define STV090x_WIDTH_MSPY_ENDSIM_2_FIELD	3
+#define STV090x_OFFST_MSPY_ENDSIM_3_FIELD	7
+#define STV090x_WIDTH_MSPY_ENDSIM_3_FIELD	1
+#define STV090x_OFFST_MSPY_ENDSIM_2_FIELD	6
+#define STV090x_WIDTH_MSPY_ENDSIM_2_FIELD	1
 #define STV090x_OFFST_MSPY_ENDSIM_1_FIELD	5
-#define STV090x_WIDTH_MSPY_ENDSIM_1_FIELD	3
+#define STV090x_WIDTH_MSPY_ENDSIM_1_FIELD	1
 #define STV090x_OFFST_MPKTDEL_ERROR_2_FIELD	4
 #define STV090x_WIDTH_MPKTDEL_ERROR_2_FIELD	1
 #define STV090x_OFFST_MPKTDEL_LOCKB_2_FIELD	3
@@ -370,7 +370,7 @@
 #define STV090x_OFFST_SELX1RATIO_FIELD		5
 #define STV090x_WIDTH_SELX1RATIO_FIELD		1
 #define STV090x_OFFST_STOP_PLL_FIELD		3
-#define STV090x_WIDTH_SELX1RATIO_FIELD		1
+#define STV090x_WIDTH_STOP_PLL_FIELD		1
 #define STV090x_OFFST_BYPASSPLLFSK_FIELD	2
 #define STV090x_WIDTH_BYPASSPLLFSK_FIELD	1
 #define STV090x_OFFST_SELOSCI_FIELD		1
@@ -616,7 +616,7 @@
 #define STV090x_OFFST_Px_CONT_TONE_FIELD	4
 #define STV090x_WIDTH_Px_CONT_TONE_FIELD	1
 #define STV090x_OFFST_Px_FIFO_4BREADY_FIELD	3
-#define STV090x_WIDTH_Px_FIFO_4BREADY_FIELD	2
+#define STV090x_WIDTH_Px_FIFO_4BREADY_FIELD	1
 #define STV090x_OFFST_Px_FIFO_EMPTY_FIELD	2
 #define STV090x_WIDTH_Px_FIFO_EMPTY_FIELD	1
 #define STV090x_OFFST_Px_ABORT_DISRX_FIELD	0
@@ -847,12 +847,10 @@
 #define STV090x_WIDTH_Px_DVBS2_ENABLE_FIELD	1
 #define STV090x_OFFST_Px_DVBS1_ENABLE_FIELD	6
 #define STV090x_WIDTH_Px_DVBS1_ENABLE_FIELD	1
-#define STV090x_OFFST_Px_CFR_AUTOSCAN_FIELD	5 /* check */
-#define STV090x_WIDTH_Px_CFR_AUTOSCAN_FIELD	1
-#define STV090x_OFFST_Px_SCAN_ENABLE_FIELD	4 /* check */
+#define STV090x_OFFST_Px_SCAN_ENABLE_FIELD	4
 #define STV090x_WIDTH_Px_SCAN_ENABLE_FIELD	1
-#define STV090x_OFFST_Px_TUN_AUTOSCAN_FIELD	3
-#define STV090x_WIDTH_Px_TUN_AUTOSCAN_FIELD	1
+#define STV090x_OFFST_Px_CFR_AUTOSCAN_FIELD	3
+#define STV090x_WIDTH_Px_CFR_AUTOSCAN_FIELD	1
 #define STV090x_OFFST_Px_NOFORCE_RELOCK_FIELD	2
 #define STV090x_WIDTH_Px_NOFORCE_RELOCK_FIELD	1
 #define STV090x_OFFST_Px_TUN_RNG_FIELD		0
@@ -885,7 +883,7 @@
 #define STV090x_P2_DMDFLYW			STV090x_Px_DMDFLYW(2)
 #define STV090x_OFFST_Px_I2C_IRQVAL_FIELD	4
 #define STV090x_WIDTH_Px_I2C_IRQVAL_FIELD	4
-#define STV090x_OFFST_Px_FLYWHEEL_CPT_FIELD	0 /* check */
+#define STV090x_OFFST_Px_FLYWHEEL_CPT_FIELD	0
 #define STV090x_WIDTH_Px_FLYWHEEL_CPT_FIELD	4
 
 #define STV090x_Px_DSTATUS3(__x)		(0xF41D - (__x - 1) * 0x200)
@@ -1048,12 +1046,12 @@
 #define STV090x_P1_CFRINC1			STV090x_Px_CFRINC1(1)
 #define STV090x_P2_CFRINC1			STV090x_Px_CFRINC1(2)
 #define STV090x_OFFST_Px_CFR_INC1_FIELD		0
-#define STV090x_WIDTH_Px_CFR_INC1_FIELD		7
+#define STV090x_WIDTH_Px_CFR_INC1_FIELD		7 /* check */
 
 #define STV090x_Px_CFRINC0(__x)			(0xF44B - (__x - 1) * 0x200)
 #define STV090x_P1_CFRINC0			STV090x_Px_CFRINC0(1)
 #define STV090x_P2_CFRINC0			STV090x_Px_CFRINC0(2)
-#define STV090x_OFFST_Px_CFR_INC0_FIELD		4
+#define STV090x_OFFST_Px_CFR_INC0_FIELD		4 /* check */
 #define STV090x_WIDTH_Px_CFR_INC0_FIELD		4
 
 #define STV090x_Pn_CFRy(__x, __y)		(0xF44E - (__x - 1) * 0x200 - __y * 0x1)
@@ -1145,14 +1143,14 @@
 #define STV090x_Px_SFRINIT1(__x)		(0xF45E - (__x - 1) * 0x200)
 #define STV090x_P1_SFRINIT1			STV090x_Px_SFRINIT1(1)
 #define STV090x_P2_SFRINIT1			STV090x_Px_SFRINIT1(2)
-#define STV090x_OFFST_Px_SFR_INIT_FIELD		0
-#define STV090x_WIDTH_Px_SFR_INIT_FIELD		8
+#define STV090x_OFFST_Px_SFR_INIT1_FIELD	0
+#define STV090x_WIDTH_Px_SFR_INIT1_FIELD	7
 
 #define STV090x_Px_SFRINIT0(__x)		(0xF45F - (__x - 1) * 0x200)
 #define STV090x_P1_SFRINIT0			STV090x_Px_SFRINIT0(1)
 #define STV090x_P2_SFRINIT0			STV090x_Px_SFRINIT0(2)
-#define STV090x_OFFST_Px_SFR_INIT_FIELD		0
-#define STV090x_WIDTH_Px_SFR_INIT_FIELD		8
+#define STV090x_OFFST_Px_SFR_INIT0_FIELD	0
+#define STV090x_WIDTH_Px_SFR_INIT0_FIELD	8
 
 #define STV090x_Px_SFRUP1(__x)			(0xF460 - (__x - 1) * 0x200)
 #define STV090x_P1_SFRUP1			STV090x_Px_SFRUP1(1)
@@ -1178,7 +1176,7 @@
 #define STV090x_OFFST_Px_SYMB_FREQ_LOW0_FIELD	0
 #define STV090x_WIDTH_Px_SYMB_FREQ_LOW0_FIELD	8
 
-#define STV090x_Px_SFRy(__x, __y)		(0xF464 - (__x-1) * 0x200 + (3 - __y))
+#define STV090x_Px_SFRy(__x, __y)		(0xF467 - (__x-1) * 0x200 - __y)
 #define STV090x_P1_SFR0				STV090x_Px_SFRy(1, 0)
 #define STV090x_P1_SFR1				STV090x_Px_SFRy(1, 1)
 #define STV090x_P1_SFR2				STV090x_Px_SFRy(1, 2)
@@ -1188,7 +1186,7 @@
 #define STV090x_P2_SFR2				STV090x_Px_SFRy(2, 2)
 #define STV090x_P2_SFR3				STV090x_Px_SFRy(2, 3)
 #define STV090x_OFFST_Px_SYMB_FREQ_FIELD	0
-#define STV090x_WIDTH_Px_SYMB_FREQ_FIELD	32
+#define STV090x_WIDTH_Px_SYMB_FREQ_FIELD	8
 
 #define STV090x_Px_TMGREG2(__x)			(0xF468 - (__x - 1) * 0x200)
 #define STV090x_P1_TMGREG2			STV090x_Px_TMGREG2(1)
@@ -1198,7 +1196,7 @@
 
 #define STV090x_Px_TMGREG1(__x)			(0xF469 - (__x - 1) * 0x200)
 #define STV090x_P1_TMGREG1			STV090x_Px_TMGREG1(1)
-#define STV090x_P2_TMGREG1				STV090x_Px_TMGREG1(2)
+#define STV090x_P2_TMGREG1			STV090x_Px_TMGREG1(2)
 #define STV090x_OFFST_Px_TMGREG_FIELD		0
 #define STV090x_WIDTH_Px_TMGREG_FIELD		8
 
@@ -1230,7 +1228,7 @@
 #define STV090x_OFFST_Px_MU_EQUALDFE_FIELD	0
 #define STV090x_WIDTH_Px_MU_EQUALDFE_FIELD	3
 
-#define STV090x_Px_EQUAIy(__x, __y)		(0xf470 - (__x - 1) * 0x200 + (__y - 1))
+#define STV090x_Px_EQUAIy(__x, __y)	(0xf470 - (__x-1) * 0x200 + 2 * (__y-1))
 #define STV090x_P1_EQUAI1			STV090x_Px_EQUAIy(1, 1)
 #define STV090x_P1_EQUAI2			STV090x_Px_EQUAIy(1, 2)
 #define STV090x_P1_EQUAI3			STV090x_Px_EQUAIy(1, 3)
@@ -1251,7 +1249,7 @@
 #define STV090x_OFFST_Px_EQUA_ACCIy_FIELD	0
 #define STV090x_WIDTH_Px_EQUA_ACCIy_FIELD	8
 
-#define STV090x_Px_EQUAQy(__x, __y)		(0xf471 - (__x - 1) * 0x200 + (__y - 1))
+#define STV090x_Px_EQUAQy(__x, __y)	(0xf471 - (__x-1) * 0x200 + 2 * (__y-1))
 #define STV090x_P1_EQUAQ1			STV090x_Px_EQUAQy(1, 1)
 #define STV090x_P1_EQUAQ2			STV090x_Px_EQUAQy(1, 2)
 #define STV090x_P1_EQUAQ3			STV090x_Px_EQUAQy(1, 3)
@@ -1390,7 +1388,7 @@
 #define STV090x_OFFST_Px_CAR2S2_16A_ALPH_E_FIELD	0
 #define STV090x_WIDTH_Px_CAR2S2_16A_ALPH_E_FIELD	4
 
-#define STV090x_Px_ACLC2S232A(__x)		(0xf499 - (__x - 1) * 0x200)
+#define STV090x_Px_ACLC2S232A(__x)		(0xf49A - (__x - 1) * 0x200)
 #define STV090x_P1_ACLC2S232A			STV090x_Px_ACLC2S232A(1)
 #define STV090x_P2_ACLC2S232A			STV090x_Px_ACLC2S232A(2)
 #define STV090x_OFFST_Px_CAR2S2_32A_ALPH_M_FIELD	4
@@ -1414,7 +1412,7 @@
 #define STV090x_OFFST_Px_CAR2S2_8_BETA_E_FIELD	0
 #define STV090x_WIDTH_Px_CAR2S2_8_BETA_E_FIELD	4
 
-#define STV090x_Px_BCLC2S216A(__x)		(0xf49d - (__x - 1) * 0x200)
+#define STV090x_Px_BCLC2S216A(__x)		(0xf49e - (__x - 1) * 0x200)
 #define STV090x_P1_BCLC2S216A			STV090x_Px_BCLC2S216A(1)
 #define STV090x_P2_BCLC2S216A			STV090x_Px_BCLC2S216A(1)
 #define STV090x_OFFST_Px_CAR2S2_16A_BETA_M_FIELD	4
@@ -1422,7 +1420,7 @@
 #define STV090x_OFFST_Px_CAR2S2_16A_BETA_E_FIELD	0
 #define STV090x_WIDTH_Px_CAR2S2_16A_BETA_E_FIELD	4
 
-#define STV090x_Px_BCLC2S232A(__x)		(0xf49d - (__x - 1) * 0x200)
+#define STV090x_Px_BCLC2S232A(__x)		(0xf49f - (__x - 1) * 0x200)
 #define STV090x_P1_BCLC2S232A			STV090x_Px_BCLC2S232A(1)
 #define STV090x_P2_BCLC2S232A			STV090x_Px_BCLC2S232A(1)
 #define STV090x_OFFST_Px_CAR2S2_32A_BETA_M_FIELD	4
@@ -1458,7 +1456,7 @@
 #define STV090x_P1_MODCODLST1			STV090x_Px_MODCODLST1(1)
 #define STV090x_P2_MODCODLST1			STV090x_Px_MODCODLST1(2)
 #define STV090x_OFFST_Px_DIS_MODCOD29_FIELD	4
-#define STV090x_WIDTH_Px_DIS_MODCOD29T_FIELD	4
+#define STV090x_WIDTH_Px_DIS_MODCOD29_FIELD	4
 #define STV090x_OFFST_Px_DIS_32PSK_9_10_FIELD	0
 #define STV090x_WIDTH_Px_DIS_32PSK_9_10_FIELD	4
 
@@ -2180,7 +2178,7 @@
 #define STV090x_WIDTH_Px_TSFIFOSPEED_STORE_FIELD	1
 #define STV090x_OFFST_Px_DILXX_RESET_FIELD		5
 #define STV090x_WIDTH_Px_DILXX_RESET_FIELD		1
-#define STV090x_OFFST_Px_TSSERIAL_IMPOS_FIELD		5
+#define STV090x_OFFST_Px_TSSERIAL_IMPOS_FIELD		4
 #define STV090x_WIDTH_Px_TSSERIAL_IMPOS_FIELD		1
 #define STV090x_OFFST_Px_SCRAMBDETECT_FIELD		1
 #define STV090x_WIDTH_Px_SCRAMBDETECT_FIELD		1
@@ -2190,7 +2188,7 @@
 #define STV090x_P1_TSBITRATE1				STV090x_Px_TSBITRATEy(1, 1)
 #define STV090x_P2_TSBITRATE0				STV090x_Px_TSBITRATEy(2, 0)
 #define STV090x_P2_TSBITRATE1				STV090x_Px_TSBITRATEy(2, 1)
-#define STV090x_OFFST_Px_TSFIFO_BITRATE_FIELD		7
+#define STV090x_OFFST_Px_TSFIFO_BITRATE_FIELD		0
 #define STV090x_WIDTH_Px_TSFIFO_BITRATE_FIELD		8
 
 #define STV090x_Px_ERRCTRL1(__x)			(0xF598 - (__x - 1) * 0x200)
diff --git a/drivers/media/dvb/frontends/stv6110.c b/drivers/media/dvb/frontends/stv6110.c
index dcf1b21ea974..bef0cc838471 100644
--- a/drivers/media/dvb/frontends/stv6110.c
+++ b/drivers/media/dvb/frontends/stv6110.c
@@ -37,6 +37,7 @@ struct stv6110_priv {
 
 	u32 mclk;
 	u8 clk_div;
+	u8 gain;
 	u8 regs[8];
 };
 
@@ -255,7 +256,7 @@ static int stv6110_set_frequency(struct dvb_frontend *fe, u32 frequency)
 	u8 ret = 0x04;
 	u32 divider, ref, p, presc, i, result_freq, vco_freq;
 	s32 p_calc, p_calc_opt = 1000, r_div, r_div_opt = 0, p_val;
-	s32 srate; u8 gain;
+	s32 srate;
 
 	dprintk("%s, freq=%d kHz, mclk=%d Hz\n", __func__,
 						frequency, priv->mclk);
@@ -273,15 +274,8 @@ static int stv6110_set_frequency(struct dvb_frontend *fe, u32 frequency)
 	} else
 		srate = 15000000;
 
-	if (srate >= 15000000)
-		gain = 3; /* +6 dB */
-	else if (srate >= 5000000)
-		gain = 3; /* +6 dB */
-	else
-		gain = 3; /* +6 dB */
-
 	priv->regs[RSTV6110_CTRL2] &= ~0x0f;
-	priv->regs[RSTV6110_CTRL2] |= (gain & 0x0f);
+	priv->regs[RSTV6110_CTRL2] |= (priv->gain & 0x0f);
 
 	if (frequency <= 1023000) {
 		p = 1;
@@ -436,6 +430,7 @@ struct dvb_frontend *stv6110_attach(struct dvb_frontend *fe,
 	priv->i2c = i2c;
 	priv->mclk = config->mclk;
 	priv->clk_div = config->clk_div;
+	priv->gain = config->gain;
 
 	memcpy(&priv->regs, &reg0[1], 8);
 
diff --git a/drivers/media/dvb/frontends/stv6110.h b/drivers/media/dvb/frontends/stv6110.h
index 9db2402410f6..fe71bba6a26e 100644
--- a/drivers/media/dvb/frontends/stv6110.h
+++ b/drivers/media/dvb/frontends/stv6110.h
@@ -41,6 +41,7 @@
 struct stv6110_config {
 	u8 i2c_address;
 	u32 mclk;
+	u8 gain;
 	u8 clk_div;	/* divisor value for the output clock */
 };
 
diff --git a/drivers/media/dvb/frontends/stv6110x.c b/drivers/media/dvb/frontends/stv6110x.c
index 3d8a2e01c9c4..bcfcb652464c 100644
--- a/drivers/media/dvb/frontends/stv6110x.c
+++ b/drivers/media/dvb/frontends/stv6110x.c
@@ -95,7 +95,7 @@ static int stv6110x_set_frequency(struct dvb_frontend *fe, u32 frequency)
 {
 	struct stv6110x_state *stv6110x = fe->tuner_priv;
 	u32 rDiv, divider;
-	s32 pVal, pCalc, rDivOpt = 0;
+	s32 pVal, pCalc, rDivOpt = 0, pCalcOpt = 1000;
 	u8 i;
 
 	STV6110x_SETFIELD(stv6110x_regs[STV6110x_CTRL1], CTRL1_K, (REFCLOCK_MHz - 16));
@@ -121,8 +121,10 @@ static int stv6110x_set_frequency(struct dvb_frontend *fe, u32 frequency)
 	for (rDiv = 0; rDiv <= 3; rDiv++) {
 		pCalc = (REFCLOCK_kHz / 100) / R_DIV(rDiv);
 
-		if ((abs((s32)(pCalc - pVal))) < (abs((s32)(1000 - pVal))))
+		if ((abs((s32)(pCalc - pVal))) < (abs((s32)(pCalcOpt - pVal))))
 			rDivOpt = rDiv;
+
+		pCalcOpt = (REFCLOCK_kHz / 100) / R_DIV(rDivOpt);
 	}
 
 	divider = (frequency * R_DIV(rDivOpt) * pVal) / REFCLOCK_kHz;
diff --git a/drivers/media/dvb/frontends/tda10021.c b/drivers/media/dvb/frontends/tda10021.c
index 6c1dbf9288d8..6ca533ea0f0e 100644
--- a/drivers/media/dvb/frontends/tda10021.c
+++ b/drivers/media/dvb/frontends/tda10021.c
@@ -426,6 +426,10 @@ struct dvb_frontend* tda10021_attach(const struct tda1002x_config* config,
 	id = tda10021_readreg(state, 0x1a);
 	if ((id & 0xf0) != 0x70) goto error;
 
+	/* Don't claim TDA10023 */
+	if (id == 0x7d)
+		goto error;
+
 	printk("TDA10021: i2c-addr = 0x%02x, id = 0x%02x\n",
 	       state->config->demod_address, id);
 
diff --git a/drivers/media/dvb/frontends/tda665x.c b/drivers/media/dvb/frontends/tda665x.c
new file mode 100644
index 000000000000..87d52739c828
--- /dev/null
+++ b/drivers/media/dvb/frontends/tda665x.c
@@ -0,0 +1,257 @@
+/*
+	TDA665x tuner driver
+	Copyright (C) Manu Abraham (abraham.manu@gmail.com)
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+
+#include "dvb_frontend.h"
+#include "tda665x.h"
+
+struct tda665x_state {
+	struct dvb_frontend		*fe;
+	struct i2c_adapter		*i2c;
+	const struct tda665x_config	*config;
+
+	u32 frequency;
+	u32 bandwidth;
+};
+
+static int tda665x_read(struct tda665x_state *state, u8 *buf)
+{
+	const struct tda665x_config *config = state->config;
+	int err = 0;
+	struct i2c_msg msg = { .addr = config->addr, .flags = I2C_M_RD, .buf = buf, .len = 2 };
+
+	err = i2c_transfer(state->i2c, &msg, 1);
+	if (err != 1)
+		goto exit;
+
+	return err;
+exit:
+	printk(KERN_ERR "%s: I/O Error err=<%d>\n", __func__, err);
+	return err;
+}
+
+static int tda665x_write(struct tda665x_state *state, u8 *buf, u8 length)
+{
+	const struct tda665x_config *config = state->config;
+	int err = 0;
+	struct i2c_msg msg = { .addr = config->addr, .flags = 0, .buf = buf, .len = length };
+
+	err = i2c_transfer(state->i2c, &msg, 1);
+	if (err != 1)
+		goto exit;
+
+	return err;
+exit:
+	printk(KERN_ERR "%s: I/O Error err=<%d>\n", __func__, err);
+	return err;
+}
+
+static int tda665x_get_state(struct dvb_frontend *fe,
+			     enum tuner_param param,
+			     struct tuner_state *tstate)
+{
+	struct tda665x_state *state = fe->tuner_priv;
+	int err = 0;
+
+	switch (param) {
+	case DVBFE_TUNER_FREQUENCY:
+		tstate->frequency = state->frequency;
+		break;
+	case DVBFE_TUNER_BANDWIDTH:
+		break;
+	default:
+		printk(KERN_ERR "%s: Unknown parameter (param=%d)\n", __func__, param);
+		err = -EINVAL;
+		break;
+	}
+
+	return err;
+}
+
+static int tda665x_get_status(struct dvb_frontend *fe, u32 *status)
+{
+	struct tda665x_state *state = fe->tuner_priv;
+	u8 result = 0;
+	int err = 0;
+
+	*status = 0;
+
+	err = tda665x_read(state, &result);
+	if (err < 0)
+		goto exit;
+
+	if ((result >> 6) & 0x01) {
+		printk(KERN_DEBUG "%s: Tuner Phase Locked\n", __func__);
+		*status = 1;
+	}
+
+	return err;
+exit:
+	printk(KERN_ERR "%s: I/O Error\n", __func__);
+	return err;
+}
+
+static int tda665x_set_state(struct dvb_frontend *fe,
+			     enum tuner_param param,
+			     struct tuner_state *tstate)
+{
+	struct tda665x_state *state = fe->tuner_priv;
+	const struct tda665x_config *config = state->config;
+	u32 frequency, status = 0;
+	u8 buf[4];
+	int err = 0;
+
+	if (param & DVBFE_TUNER_FREQUENCY) {
+
+		frequency = tstate->frequency;
+		if ((frequency < config->frequency_max) || (frequency > config->frequency_min)) {
+			printk(KERN_ERR "%s: Frequency beyond limits, frequency=%d\n", __func__, frequency);
+			return -EINVAL;
+		}
+
+		frequency += config->frequency_offst;
+		frequency *= config->ref_multiplier;
+		frequency += config->ref_divider >> 1;
+		frequency /= config->ref_divider;
+
+		buf[0] = (u8) (frequency & 0x7f00) >> 8;
+		buf[1] = (u8) (frequency & 0x00ff) >> 0;
+		buf[2] = 0x80 | 0x40 | 0x02;
+		buf[3] = 0x00;
+
+		/* restore frequency */
+		frequency = tstate->frequency;
+
+		if (frequency < 153000000) {
+			/* VHF-L */
+			buf[3] |= 0x01; /* fc, Low Band, 47 - 153 MHz */
+			if (frequency < 68000000)
+				buf[3] |= 0x40; /* 83uA */
+			if (frequency < 1040000000)
+				buf[3] |= 0x60; /* 122uA */
+			if (frequency < 1250000000)
+				buf[3] |= 0x80; /* 163uA */
+			else
+				buf[3] |= 0xa0; /* 254uA */
+		} else if (frequency < 438000000) {
+			/* VHF-H */
+			buf[3] |= 0x02; /* fc, Mid Band, 153 - 438 MHz */
+			if (frequency < 230000000)
+				buf[3] |= 0x40;
+			if (frequency < 300000000)
+				buf[3] |= 0x60;
+			else
+				buf[3] |= 0x80;
+		} else {
+			/* UHF */
+			buf[3] |= 0x04; /* fc, High Band, 438 - 862 MHz */
+			if (frequency < 470000000)
+				buf[3] |= 0x60;
+			if (frequency < 526000000)
+				buf[3] |= 0x80;
+			else
+				buf[3] |= 0xa0;
+		}
+
+		/* Set params */
+		err = tda665x_write(state, buf, 5);
+		if (err < 0)
+			goto exit;
+
+		/* sleep for some time */
+		printk(KERN_DEBUG "%s: Waiting to Phase LOCK\n", __func__);
+		msleep(20);
+		/* check status */
+		err = tda665x_get_status(fe, &status);
+		if (err < 0)
+			goto exit;
+
+		if (status == 1) {
+			printk(KERN_DEBUG "%s: Tuner Phase locked: status=%d\n", __func__, status);
+			state->frequency = frequency; /* cache successful state */
+		} else {
+			printk(KERN_ERR "%s: No Phase lock: status=%d\n", __func__, status);
+		}
+	} else {
+		printk(KERN_ERR "%s: Unknown parameter (param=%d)\n", __func__, param);
+		return -EINVAL;
+	}
+
+	return 0;
+exit:
+	printk(KERN_ERR "%s: I/O Error\n", __func__);
+	return err;
+}
+
+static int tda665x_release(struct dvb_frontend *fe)
+{
+	struct tda665x_state *state = fe->tuner_priv;
+
+	fe->tuner_priv = NULL;
+	kfree(state);
+	return 0;
+}
+
+static struct dvb_tuner_ops tda665x_ops = {
+
+	.set_state	= tda665x_set_state,
+	.get_state	= tda665x_get_state,
+	.get_status	= tda665x_get_status,
+	.release	= tda665x_release
+};
+
+struct dvb_frontend *tda665x_attach(struct dvb_frontend *fe,
+				    const struct tda665x_config *config,
+				    struct i2c_adapter *i2c)
+{
+	struct tda665x_state *state = NULL;
+	struct dvb_tuner_info *info;
+
+	state = kzalloc(sizeof(struct tda665x_state), GFP_KERNEL);
+	if (state == NULL)
+		goto exit;
+
+	state->config		= config;
+	state->i2c		= i2c;
+	state->fe		= fe;
+	fe->tuner_priv		= state;
+	fe->ops.tuner_ops	= tda665x_ops;
+	info			 = &fe->ops.tuner_ops.info;
+
+	memcpy(info->name, config->name, sizeof(config->name));
+	info->frequency_min	= config->frequency_min;
+	info->frequency_max	= config->frequency_max;
+	info->frequency_step	= config->frequency_offst;
+
+	printk(KERN_DEBUG "%s: Attaching TDA665x (%s) tuner\n", __func__, info->name);
+
+	return fe;
+
+exit:
+	kfree(state);
+	return NULL;
+}
+EXPORT_SYMBOL(tda665x_attach);
+
+MODULE_DESCRIPTION("TDA665x driver");
+MODULE_AUTHOR("Manu Abraham");
+MODULE_LICENSE("GPL");
diff --git a/drivers/media/dvb/frontends/tda665x.h b/drivers/media/dvb/frontends/tda665x.h
new file mode 100644
index 000000000000..ec7927aa75ae
--- /dev/null
+++ b/drivers/media/dvb/frontends/tda665x.h
@@ -0,0 +1,52 @@
+/*
+	TDA665x tuner driver
+	Copyright (C) Manu Abraham (abraham.manu@gmail.com)
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#ifndef __TDA665x_H
+#define __TDA665x_H
+
+struct tda665x_config {
+	char name[128];
+
+	u8	addr;
+	u32	frequency_min;
+	u32	frequency_max;
+	u32	frequency_offst;
+	u32	ref_multiplier;
+	u32	ref_divider;
+};
+
+#if defined(CONFIG_DVB_TDA665x) || (defined(CONFIG_DVB_TDA665x_MODULE) && defined(MODULE))
+
+extern struct dvb_frontend *tda665x_attach(struct dvb_frontend *fe,
+					   const struct tda665x_config *config,
+					   struct i2c_adapter *i2c);
+
+#else
+
+static inline struct dvb_frontend *tda665x_attach(struct dvb_frontend *fe,
+						  const struct tda665x_config *config,
+						  struct i2c_adapter *i2c)
+{
+	printk(KERN_WARNING "%s: Driver disabled by Kconfig\n", __func__);
+	return NULL;
+}
+
+#endif /* CONFIG_DVB_TDA665x */
+
+#endif /* __TDA665x_H */
diff --git a/drivers/media/dvb/mantis/Kconfig b/drivers/media/dvb/mantis/Kconfig
new file mode 100644
index 000000000000..f7b72a32adf3
--- /dev/null
+++ b/drivers/media/dvb/mantis/Kconfig
@@ -0,0 +1,32 @@
+config MANTIS_CORE
+	tristate "Mantis/Hopper PCI bridge based devices"
+	depends on PCI && I2C && INPUT
+
+	help
+	  Support for PCI cards based on the Mantis and Hopper PCi bridge.
+
+	  Say Y if you own such a device and want to use it.
+
+config DVB_MANTIS
+	tristate "MANTIS based cards"
+	depends on MANTIS_CORE && DVB_CORE && PCI && I2C
+	select DVB_MB86A16
+	select DVB_ZL10353
+	select DVB_STV0299
+	select DVB_PLL
+	help
+	  Support for PCI cards based on the Mantis PCI bridge.
+	  Say Y when you have a Mantis based DVB card and want to use it.
+
+	  If unsure say N.
+
+config DVB_HOPPER
+	tristate "HOPPER based cards"
+	depends on MANTIS_CORE && DVB_CORE && PCI && I2C
+	select DVB_ZL10353
+	select DVB_PLL
+	help
+	  Support for PCI cards based on the Hopper  PCI bridge.
+	  Say Y when you have a Hopper based DVB card and want to use it.
+
+	  If unsure say N
diff --git a/drivers/media/dvb/mantis/Makefile b/drivers/media/dvb/mantis/Makefile
new file mode 100644
index 000000000000..98dc5cd258ac
--- /dev/null
+++ b/drivers/media/dvb/mantis/Makefile
@@ -0,0 +1,28 @@
+mantis_core-objs :=	mantis_ioc.o	\
+			mantis_uart.o	\
+			mantis_dma.o	\
+			mantis_pci.o	\
+			mantis_i2c.o	\
+			mantis_dvb.o	\
+			mantis_evm.o	\
+			mantis_hif.o	\
+			mantis_ca.o	\
+			mantis_pcmcia.o	\
+			mantis_input.o
+
+mantis-objs	:=	mantis_cards.o	\
+			mantis_vp1033.o	\
+			mantis_vp1034.o	\
+			mantis_vp1041.o	\
+			mantis_vp2033.o	\
+			mantis_vp2040.o	\
+			mantis_vp3030.o
+
+hopper-objs	:=	hopper_cards.o	\
+			hopper_vp3028.o
+
+obj-$(CONFIG_MANTIS_CORE)	+= mantis_core.o
+obj-$(CONFIG_DVB_MANTIS)	+= mantis.o
+obj-$(CONFIG_DVB_HOPPER)	+= hopper.o
+
+EXTRA_CFLAGS = -Idrivers/media/dvb/dvb-core/ -Idrivers/media/dvb/frontends/
diff --git a/drivers/media/dvb/mantis/hopper_cards.c b/drivers/media/dvb/mantis/hopper_cards.c
new file mode 100644
index 000000000000..d073c61e3c0d
--- /dev/null
+++ b/drivers/media/dvb/mantis/hopper_cards.c
@@ -0,0 +1,275 @@
+/*
+	Hopper PCI bridge driver
+
+	Copyright (C) Manu Abraham (abraham.manu@gmail.com)
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/kernel.h>
+#include <linux/pci.h>
+#include <asm/irq.h>
+#include <linux/interrupt.h>
+
+#include "dmxdev.h"
+#include "dvbdev.h"
+#include "dvb_demux.h"
+#include "dvb_frontend.h"
+#include "dvb_net.h"
+
+#include "mantis_common.h"
+#include "hopper_vp3028.h"
+#include "mantis_dma.h"
+#include "mantis_dvb.h"
+#include "mantis_uart.h"
+#include "mantis_ioc.h"
+#include "mantis_pci.h"
+#include "mantis_i2c.h"
+#include "mantis_reg.h"
+
+static unsigned int verbose;
+module_param(verbose, int, 0644);
+MODULE_PARM_DESC(verbose, "verbose startup messages, default is 1 (yes)");
+
+#define DRIVER_NAME	"Hopper"
+
+static char *label[10] = {
+	"DMA",
+	"IRQ-0",
+	"IRQ-1",
+	"OCERR",
+	"PABRT",
+	"RIPRR",
+	"PPERR",
+	"FTRGT",
+	"RISCI",
+	"RACK"
+};
+
+static int devs;
+
+static irqreturn_t hopper_irq_handler(int irq, void *dev_id)
+{
+	u32 stat = 0, mask = 0, lstat = 0, mstat = 0;
+	u32 rst_stat = 0, rst_mask = 0;
+
+	struct mantis_pci *mantis;
+	struct mantis_ca *ca;
+
+	mantis = (struct mantis_pci *) dev_id;
+	if (unlikely(mantis == NULL)) {
+		dprintk(MANTIS_ERROR, 1, "Mantis == NULL");
+		return IRQ_NONE;
+	}
+	ca = mantis->mantis_ca;
+
+	stat = mmread(MANTIS_INT_STAT);
+	mask = mmread(MANTIS_INT_MASK);
+	mstat = lstat = stat & ~MANTIS_INT_RISCSTAT;
+	if (!(stat & mask))
+		return IRQ_NONE;
+
+	rst_mask  = MANTIS_GPIF_WRACK  |
+		    MANTIS_GPIF_OTHERR |
+		    MANTIS_SBUF_WSTO   |
+		    MANTIS_GPIF_EXTIRQ;
+
+	rst_stat  = mmread(MANTIS_GPIF_STATUS);
+	rst_stat &= rst_mask;
+	mmwrite(rst_stat, MANTIS_GPIF_STATUS);
+
+	mantis->mantis_int_stat = stat;
+	mantis->mantis_int_mask = mask;
+	dprintk(MANTIS_DEBUG, 0, "\n-- Stat=<%02x> Mask=<%02x> --", stat, mask);
+	if (stat & MANTIS_INT_RISCEN) {
+		dprintk(MANTIS_DEBUG, 0, "<%s>", label[0]);
+	}
+	if (stat & MANTIS_INT_IRQ0) {
+		dprintk(MANTIS_DEBUG, 0, "<%s>", label[1]);
+		mantis->gpif_status = rst_stat;
+		wake_up(&ca->hif_write_wq);
+		schedule_work(&ca->hif_evm_work);
+	}
+	if (stat & MANTIS_INT_IRQ1) {
+		dprintk(MANTIS_DEBUG, 0, "<%s>", label[2]);
+		schedule_work(&mantis->uart_work);
+	}
+	if (stat & MANTIS_INT_OCERR) {
+		dprintk(MANTIS_DEBUG, 0, "<%s>", label[3]);
+	}
+	if (stat & MANTIS_INT_PABORT) {
+		dprintk(MANTIS_DEBUG, 0, "<%s>", label[4]);
+	}
+	if (stat & MANTIS_INT_RIPERR) {
+		dprintk(MANTIS_DEBUG, 0, "<%s>", label[5]);
+	}
+	if (stat & MANTIS_INT_PPERR) {
+		dprintk(MANTIS_DEBUG, 0, "<%s>", label[6]);
+	}
+	if (stat & MANTIS_INT_FTRGT) {
+		dprintk(MANTIS_DEBUG, 0, "<%s>", label[7]);
+	}
+	if (stat & MANTIS_INT_RISCI) {
+		dprintk(MANTIS_DEBUG, 0, "<%s>", label[8]);
+		mantis->finished_block = (stat & MANTIS_INT_RISCSTAT) >> 28;
+		tasklet_schedule(&mantis->tasklet);
+	}
+	if (stat & MANTIS_INT_I2CDONE) {
+		dprintk(MANTIS_DEBUG, 0, "<%s>", label[9]);
+		wake_up(&mantis->i2c_wq);
+	}
+	mmwrite(stat, MANTIS_INT_STAT);
+	stat &= ~(MANTIS_INT_RISCEN   | MANTIS_INT_I2CDONE |
+		  MANTIS_INT_I2CRACK  | MANTIS_INT_PCMCIA7 |
+		  MANTIS_INT_PCMCIA6  | MANTIS_INT_PCMCIA5 |
+		  MANTIS_INT_PCMCIA4  | MANTIS_INT_PCMCIA3 |
+		  MANTIS_INT_PCMCIA2  | MANTIS_INT_PCMCIA1 |
+		  MANTIS_INT_PCMCIA0  | MANTIS_INT_IRQ1	   |
+		  MANTIS_INT_IRQ0     | MANTIS_INT_OCERR   |
+		  MANTIS_INT_PABORT   | MANTIS_INT_RIPERR  |
+		  MANTIS_INT_PPERR    | MANTIS_INT_FTRGT   |
+		  MANTIS_INT_RISCI);
+
+	if (stat)
+		dprintk(MANTIS_DEBUG, 0, "<Unknown> Stat=<%02x> Mask=<%02x>", stat, mask);
+
+	dprintk(MANTIS_DEBUG, 0, "\n");
+	return IRQ_HANDLED;
+}
+
+static int __devinit hopper_pci_probe(struct pci_dev *pdev, const struct pci_device_id *pci_id)
+{
+	struct mantis_pci *mantis;
+	struct mantis_hwconfig *config;
+	int err = 0;
+
+	mantis = kzalloc(sizeof(struct mantis_pci), GFP_KERNEL);
+	if (mantis == NULL) {
+		printk(KERN_ERR "%s ERROR: Out of memory\n", __func__);
+		err = -ENOMEM;
+		goto fail0;
+	}
+
+	mantis->num		= devs;
+	mantis->verbose		= verbose;
+	mantis->pdev		= pdev;
+	config			= (struct mantis_hwconfig *) pci_id->driver_data;
+	config->irq_handler	= &hopper_irq_handler;
+	mantis->hwconfig	= config;
+
+	err = mantis_pci_init(mantis);
+	if (err) {
+		dprintk(MANTIS_ERROR, 1, "ERROR: Mantis PCI initialization failed <%d>", err);
+		goto fail1;
+	}
+
+	err = mantis_stream_control(mantis, STREAM_TO_HIF);
+	if (err < 0) {
+		dprintk(MANTIS_ERROR, 1, "ERROR: Mantis stream control failed <%d>", err);
+		goto fail1;
+	}
+
+	err = mantis_i2c_init(mantis);
+	if (err < 0) {
+		dprintk(MANTIS_ERROR, 1, "ERROR: Mantis I2C initialization failed <%d>", err);
+		goto fail2;
+	}
+
+	err = mantis_get_mac(mantis);
+	if (err < 0) {
+		dprintk(MANTIS_ERROR, 1, "ERROR: Mantis MAC address read failed <%d>", err);
+		goto fail2;
+	}
+
+	err = mantis_dma_init(mantis);
+	if (err < 0) {
+		dprintk(MANTIS_ERROR, 1, "ERROR: Mantis DMA initialization failed <%d>", err);
+		goto fail3;
+	}
+
+	err = mantis_dvb_init(mantis);
+	if (err < 0) {
+		dprintk(MANTIS_ERROR, 1, "ERROR: Mantis DVB initialization failed <%d>", err);
+		goto fail4;
+	}
+	devs++;
+
+	return err;
+
+fail4:
+	dprintk(MANTIS_ERROR, 1, "ERROR: Mantis DMA exit! <%d>", err);
+	mantis_dma_exit(mantis);
+
+fail3:
+	dprintk(MANTIS_ERROR, 1, "ERROR: Mantis I2C exit! <%d>", err);
+	mantis_i2c_exit(mantis);
+
+fail2:
+	dprintk(MANTIS_ERROR, 1, "ERROR: Mantis PCI exit! <%d>", err);
+	mantis_pci_exit(mantis);
+
+fail1:
+	dprintk(MANTIS_ERROR, 1, "ERROR: Mantis free! <%d>", err);
+	kfree(mantis);
+
+fail0:
+	return err;
+}
+
+static void __devexit hopper_pci_remove(struct pci_dev *pdev)
+{
+	struct mantis_pci *mantis = pci_get_drvdata(pdev);
+
+	if (mantis) {
+		mantis_dvb_exit(mantis);
+		mantis_dma_exit(mantis);
+		mantis_i2c_exit(mantis);
+		mantis_pci_exit(mantis);
+		kfree(mantis);
+	}
+	return;
+
+}
+
+static struct pci_device_id hopper_pci_table[] = {
+	MAKE_ENTRY(TWINHAN_TECHNOLOGIES, MANTIS_VP_3028_DVB_T, &vp3028_config),
+	{ }
+};
+
+static struct pci_driver hopper_pci_driver = {
+	.name		= DRIVER_NAME,
+	.id_table	= hopper_pci_table,
+	.probe		= hopper_pci_probe,
+	.remove		= hopper_pci_remove,
+};
+
+static int __devinit hopper_init(void)
+{
+	return pci_register_driver(&hopper_pci_driver);
+}
+
+static void __devexit hopper_exit(void)
+{
+	return pci_unregister_driver(&hopper_pci_driver);
+}
+
+module_init(hopper_init);
+module_exit(hopper_exit);
+
+MODULE_DESCRIPTION("HOPPER driver");
+MODULE_AUTHOR("Manu Abraham");
+MODULE_LICENSE("GPL");
diff --git a/drivers/media/dvb/mantis/hopper_vp3028.c b/drivers/media/dvb/mantis/hopper_vp3028.c
new file mode 100644
index 000000000000..96674c78e86b
--- /dev/null
+++ b/drivers/media/dvb/mantis/hopper_vp3028.c
@@ -0,0 +1,88 @@
+/*
+	Hopper VP-3028 driver
+
+	Copyright (C) Manu Abraham (abraham.manu@gmail.com)
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#include <linux/signal.h>
+#include <linux/sched.h>
+#include <linux/interrupt.h>
+
+#include "dmxdev.h"
+#include "dvbdev.h"
+#include "dvb_demux.h"
+#include "dvb_frontend.h"
+#include "dvb_net.h"
+
+#include "zl10353.h"
+#include "mantis_common.h"
+#include "mantis_ioc.h"
+#include "mantis_dvb.h"
+#include "hopper_vp3028.h"
+
+struct zl10353_config hopper_vp3028_config = {
+	.demod_address	= 0x0f,
+};
+
+#define MANTIS_MODEL_NAME	"VP-3028"
+#define MANTIS_DEV_TYPE		"DVB-T"
+
+static int vp3028_frontend_init(struct mantis_pci *mantis, struct dvb_frontend *fe)
+{
+	struct i2c_adapter *adapter	= &mantis->adapter;
+	struct mantis_hwconfig *config	= mantis->hwconfig;
+	int err = 0;
+
+	gpio_set_bits(mantis, config->reset, 0);
+	msleep(100);
+	err = mantis_frontend_power(mantis, POWER_ON);
+	msleep(100);
+	gpio_set_bits(mantis, config->reset, 1);
+
+	err = mantis_frontend_power(mantis, POWER_ON);
+	if (err == 0) {
+		msleep(250);
+		dprintk(MANTIS_ERROR, 1, "Probing for 10353 (DVB-T)");
+		fe = zl10353_attach(&hopper_vp3028_config, adapter);
+
+		if (!fe)
+			return -1;
+	} else {
+		dprintk(MANTIS_ERROR, 1, "Frontend on <%s> POWER ON failed! <%d>",
+			adapter->name,
+			err);
+
+		return -EIO;
+	}
+	dprintk(MANTIS_ERROR, 1, "Done!");
+
+	return 0;
+}
+
+struct mantis_hwconfig vp3028_config = {
+	.model_name	= MANTIS_MODEL_NAME,
+	.dev_type	= MANTIS_DEV_TYPE,
+	.ts_size	= MANTIS_TS_188,
+
+	.baud_rate	= MANTIS_BAUD_9600,
+	.parity		= MANTIS_PARITY_NONE,
+	.bytes		= 0,
+
+	.frontend_init	= vp3028_frontend_init,
+	.power		= GPIF_A00,
+	.reset		= GPIF_A03,
+};
diff --git a/drivers/media/dvb/mantis/hopper_vp3028.h b/drivers/media/dvb/mantis/hopper_vp3028.h
new file mode 100644
index 000000000000..57239498bc87
--- /dev/null
+++ b/drivers/media/dvb/mantis/hopper_vp3028.h
@@ -0,0 +1,30 @@
+/*
+	Hopper VP-3028 driver
+
+	Copyright (C) Manu Abraham (abraham.manu@gmail.com)
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#ifndef __MANTIS_VP3028_H
+#define __MANTIS_VP3028_H
+
+#include "mantis_common.h"
+
+#define MANTIS_VP_3028_DVB_T	0x0028
+
+extern struct mantis_hwconfig vp3028_config;
+
+#endif /* __MANTIS_VP3028_H */
diff --git a/drivers/media/dvb/mantis/mantis_ca.c b/drivers/media/dvb/mantis/mantis_ca.c
new file mode 100644
index 000000000000..403ce043d00e
--- /dev/null
+++ b/drivers/media/dvb/mantis/mantis_ca.c
@@ -0,0 +1,207 @@
+/*
+	Mantis PCI bridge driver
+
+	Copyright (C) Manu Abraham (abraham.manu@gmail.com)
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#include <linux/signal.h>
+#include <linux/sched.h>
+#include <linux/interrupt.h>
+
+#include "dmxdev.h"
+#include "dvbdev.h"
+#include "dvb_demux.h"
+#include "dvb_frontend.h"
+#include "dvb_net.h"
+
+#include "mantis_common.h"
+#include "mantis_link.h"
+#include "mantis_hif.h"
+#include "mantis_reg.h"
+
+#include "mantis_ca.h"
+
+static int mantis_ca_read_attr_mem(struct dvb_ca_en50221 *en50221, int slot, int addr)
+{
+	struct mantis_ca *ca = en50221->data;
+	struct mantis_pci *mantis = ca->ca_priv;
+
+	dprintk(MANTIS_DEBUG, 1, "Slot(%d): Request Attribute Mem Read", slot);
+
+	if (slot != 0)
+		return -EINVAL;
+
+	return mantis_hif_read_mem(ca, addr);
+}
+
+static int mantis_ca_write_attr_mem(struct dvb_ca_en50221 *en50221, int slot, int addr, u8 data)
+{
+	struct mantis_ca *ca = en50221->data;
+	struct mantis_pci *mantis = ca->ca_priv;
+
+	dprintk(MANTIS_DEBUG, 1, "Slot(%d): Request Attribute Mem Write", slot);
+
+	if (slot != 0)
+		return -EINVAL;
+
+	return mantis_hif_write_mem(ca, addr, data);
+}
+
+static int mantis_ca_read_cam_ctl(struct dvb_ca_en50221 *en50221, int slot, u8 addr)
+{
+	struct mantis_ca *ca = en50221->data;
+	struct mantis_pci *mantis = ca->ca_priv;
+
+	dprintk(MANTIS_DEBUG, 1, "Slot(%d): Request CAM control Read", slot);
+
+	if (slot != 0)
+		return -EINVAL;
+
+	return mantis_hif_read_iom(ca, addr);
+}
+
+static int mantis_ca_write_cam_ctl(struct dvb_ca_en50221 *en50221, int slot, u8 addr, u8 data)
+{
+	struct mantis_ca *ca = en50221->data;
+	struct mantis_pci *mantis = ca->ca_priv;
+
+	dprintk(MANTIS_DEBUG, 1, "Slot(%d): Request CAM control Write", slot);
+
+	if (slot != 0)
+		return -EINVAL;
+
+	return mantis_hif_write_iom(ca, addr, data);
+}
+
+static int mantis_ca_slot_reset(struct dvb_ca_en50221 *en50221, int slot)
+{
+	struct mantis_ca *ca = en50221->data;
+	struct mantis_pci *mantis = ca->ca_priv;
+
+	dprintk(MANTIS_DEBUG, 1, "Slot(%d): Slot RESET", slot);
+	udelay(500); /* Wait.. */
+	mmwrite(0xda, MANTIS_PCMCIA_RESET); /* Leading edge assert */
+	udelay(500);
+	mmwrite(0x00, MANTIS_PCMCIA_RESET); /* Trailing edge deassert */
+	msleep(1000);
+	dvb_ca_en50221_camready_irq(&ca->en50221, 0);
+
+	return 0;
+}
+
+static int mantis_ca_slot_shutdown(struct dvb_ca_en50221 *en50221, int slot)
+{
+	struct mantis_ca *ca = en50221->data;
+	struct mantis_pci *mantis = ca->ca_priv;
+
+	dprintk(MANTIS_DEBUG, 1, "Slot(%d): Slot shutdown", slot);
+
+	return 0;
+}
+
+static int mantis_ts_control(struct dvb_ca_en50221 *en50221, int slot)
+{
+	struct mantis_ca *ca = en50221->data;
+	struct mantis_pci *mantis = ca->ca_priv;
+
+	dprintk(MANTIS_DEBUG, 1, "Slot(%d): TS control", slot);
+/*	mantis_set_direction(mantis, 1); */ /* Enable TS through CAM */
+
+	return 0;
+}
+
+static int mantis_slot_status(struct dvb_ca_en50221 *en50221, int slot, int open)
+{
+	struct mantis_ca *ca = en50221->data;
+	struct mantis_pci *mantis = ca->ca_priv;
+
+	dprintk(MANTIS_DEBUG, 1, "Slot(%d): Poll Slot status", slot);
+
+	if (ca->slot_state == MODULE_INSERTED) {
+		dprintk(MANTIS_DEBUG, 1, "CA Module present and ready");
+		return DVB_CA_EN50221_POLL_CAM_PRESENT | DVB_CA_EN50221_POLL_CAM_READY;
+	} else {
+		dprintk(MANTIS_DEBUG, 1, "CA Module not present or not ready");
+	}
+
+	return 0;
+}
+
+int mantis_ca_init(struct mantis_pci *mantis)
+{
+	struct dvb_adapter *dvb_adapter	= &mantis->dvb_adapter;
+	struct mantis_ca *ca;
+	int ca_flags = 0, result;
+
+	dprintk(MANTIS_DEBUG, 1, "Initializing Mantis CA");
+	ca = kzalloc(sizeof(struct mantis_ca), GFP_KERNEL);
+	if (!ca) {
+		dprintk(MANTIS_ERROR, 1, "Out of memory!, exiting ..");
+		result = -ENOMEM;
+		goto err;
+	}
+
+	ca->ca_priv		= mantis;
+	mantis->mantis_ca	= ca;
+	ca_flags		= DVB_CA_EN50221_FLAG_IRQ_CAMCHANGE;
+	/* register CA interface */
+	ca->en50221.owner		= THIS_MODULE;
+	ca->en50221.read_attribute_mem	= mantis_ca_read_attr_mem;
+	ca->en50221.write_attribute_mem	= mantis_ca_write_attr_mem;
+	ca->en50221.read_cam_control	= mantis_ca_read_cam_ctl;
+	ca->en50221.write_cam_control	= mantis_ca_write_cam_ctl;
+	ca->en50221.slot_reset		= mantis_ca_slot_reset;
+	ca->en50221.slot_shutdown	= mantis_ca_slot_shutdown;
+	ca->en50221.slot_ts_enable	= mantis_ts_control;
+	ca->en50221.poll_slot_status	= mantis_slot_status;
+	ca->en50221.data		= ca;
+
+	mutex_init(&ca->ca_lock);
+
+	init_waitqueue_head(&ca->hif_data_wq);
+	init_waitqueue_head(&ca->hif_opdone_wq);
+	init_waitqueue_head(&ca->hif_write_wq);
+
+	dprintk(MANTIS_ERROR, 1, "Registering EN50221 device");
+	result = dvb_ca_en50221_init(dvb_adapter, &ca->en50221, ca_flags, 1);
+	if (result != 0) {
+		dprintk(MANTIS_ERROR, 1, "EN50221: Initialization failed <%d>", result);
+		goto err;
+	}
+	dprintk(MANTIS_ERROR, 1, "Registered EN50221 device");
+	mantis_evmgr_init(ca);
+	return 0;
+err:
+	kfree(ca);
+	return result;
+}
+EXPORT_SYMBOL_GPL(mantis_ca_init);
+
+void mantis_ca_exit(struct mantis_pci *mantis)
+{
+	struct mantis_ca *ca = mantis->mantis_ca;
+
+	dprintk(MANTIS_DEBUG, 1, "Mantis CA exit");
+
+	mantis_evmgr_exit(ca);
+	dprintk(MANTIS_ERROR, 1, "Unregistering EN50221 device");
+	if (ca)
+		dvb_ca_en50221_release(&ca->en50221);
+
+	kfree(ca);
+}
+EXPORT_SYMBOL_GPL(mantis_ca_exit);
diff --git a/drivers/media/dvb/mantis/mantis_ca.h b/drivers/media/dvb/mantis/mantis_ca.h
new file mode 100644
index 000000000000..dc63e55f7eca
--- /dev/null
+++ b/drivers/media/dvb/mantis/mantis_ca.h
@@ -0,0 +1,27 @@
+/*
+	Mantis PCI bridge driver
+
+	Copyright (C) Manu Abraham (abraham.manu@gmail.com)
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#ifndef __MANTIS_CA_H
+#define __MANTIS_CA_H
+
+extern int mantis_ca_init(struct mantis_pci *mantis);
+extern void mantis_ca_exit(struct mantis_pci *mantis);
+
+#endif /* __MANTIS_CA_H */
diff --git a/drivers/media/dvb/mantis/mantis_cards.c b/drivers/media/dvb/mantis/mantis_cards.c
new file mode 100644
index 000000000000..16f1708fd3bc
--- /dev/null
+++ b/drivers/media/dvb/mantis/mantis_cards.c
@@ -0,0 +1,305 @@
+/*
+	Mantis PCI bridge driver
+
+	Copyright (C) Manu Abraham (abraham.manu@gmail.com)
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/kernel.h>
+#include <linux/pci.h>
+#include <asm/irq.h>
+#include <linux/interrupt.h>
+
+#include "dmxdev.h"
+#include "dvbdev.h"
+#include "dvb_demux.h"
+#include "dvb_frontend.h"
+#include "dvb_net.h"
+
+#include "mantis_common.h"
+
+#include "mantis_vp1033.h"
+#include "mantis_vp1034.h"
+#include "mantis_vp1041.h"
+#include "mantis_vp2033.h"
+#include "mantis_vp2040.h"
+#include "mantis_vp3030.h"
+
+#include "mantis_dma.h"
+#include "mantis_ca.h"
+#include "mantis_dvb.h"
+#include "mantis_uart.h"
+#include "mantis_ioc.h"
+#include "mantis_pci.h"
+#include "mantis_i2c.h"
+#include "mantis_reg.h"
+
+static unsigned int verbose;
+module_param(verbose, int, 0644);
+MODULE_PARM_DESC(verbose, "verbose startup messages, default is 1 (yes)");
+
+static int devs;
+
+#define DRIVER_NAME	"Mantis"
+
+static char *label[10] = {
+	"DMA",
+	"IRQ-0",
+	"IRQ-1",
+	"OCERR",
+	"PABRT",
+	"RIPRR",
+	"PPERR",
+	"FTRGT",
+	"RISCI",
+	"RACK"
+};
+
+static irqreturn_t mantis_irq_handler(int irq, void *dev_id)
+{
+	u32 stat = 0, mask = 0, lstat = 0, mstat = 0;
+	u32 rst_stat = 0, rst_mask = 0;
+
+	struct mantis_pci *mantis;
+	struct mantis_ca *ca;
+
+	mantis = (struct mantis_pci *) dev_id;
+	if (unlikely(mantis == NULL)) {
+		dprintk(MANTIS_ERROR, 1, "Mantis == NULL");
+		return IRQ_NONE;
+	}
+	ca = mantis->mantis_ca;
+
+	stat = mmread(MANTIS_INT_STAT);
+	mask = mmread(MANTIS_INT_MASK);
+	mstat = lstat = stat & ~MANTIS_INT_RISCSTAT;
+	if (!(stat & mask))
+		return IRQ_NONE;
+
+	rst_mask  = MANTIS_GPIF_WRACK  |
+		    MANTIS_GPIF_OTHERR |
+		    MANTIS_SBUF_WSTO   |
+		    MANTIS_GPIF_EXTIRQ;
+
+	rst_stat  = mmread(MANTIS_GPIF_STATUS);
+	rst_stat &= rst_mask;
+	mmwrite(rst_stat, MANTIS_GPIF_STATUS);
+
+	mantis->mantis_int_stat = stat;
+	mantis->mantis_int_mask = mask;
+	dprintk(MANTIS_DEBUG, 0, "\n-- Stat=<%02x> Mask=<%02x> --", stat, mask);
+	if (stat & MANTIS_INT_RISCEN) {
+		dprintk(MANTIS_DEBUG, 0, "<%s>", label[0]);
+	}
+	if (stat & MANTIS_INT_IRQ0) {
+		dprintk(MANTIS_DEBUG, 0, "<%s>", label[1]);
+		mantis->gpif_status = rst_stat;
+		wake_up(&ca->hif_write_wq);
+		schedule_work(&ca->hif_evm_work);
+	}
+	if (stat & MANTIS_INT_IRQ1) {
+		dprintk(MANTIS_DEBUG, 0, "<%s>", label[2]);
+		schedule_work(&mantis->uart_work);
+	}
+	if (stat & MANTIS_INT_OCERR) {
+		dprintk(MANTIS_DEBUG, 0, "<%s>", label[3]);
+	}
+	if (stat & MANTIS_INT_PABORT) {
+		dprintk(MANTIS_DEBUG, 0, "<%s>", label[4]);
+	}
+	if (stat & MANTIS_INT_RIPERR) {
+		dprintk(MANTIS_DEBUG, 0, "<%s>", label[5]);
+	}
+	if (stat & MANTIS_INT_PPERR) {
+		dprintk(MANTIS_DEBUG, 0, "<%s>", label[6]);
+	}
+	if (stat & MANTIS_INT_FTRGT) {
+		dprintk(MANTIS_DEBUG, 0, "<%s>", label[7]);
+	}
+	if (stat & MANTIS_INT_RISCI) {
+		dprintk(MANTIS_DEBUG, 0, "<%s>", label[8]);
+		mantis->finished_block = (stat & MANTIS_INT_RISCSTAT) >> 28;
+		tasklet_schedule(&mantis->tasklet);
+	}
+	if (stat & MANTIS_INT_I2CDONE) {
+		dprintk(MANTIS_DEBUG, 0, "<%s>", label[9]);
+		wake_up(&mantis->i2c_wq);
+	}
+	mmwrite(stat, MANTIS_INT_STAT);
+	stat &= ~(MANTIS_INT_RISCEN   | MANTIS_INT_I2CDONE |
+		  MANTIS_INT_I2CRACK  | MANTIS_INT_PCMCIA7 |
+		  MANTIS_INT_PCMCIA6  | MANTIS_INT_PCMCIA5 |
+		  MANTIS_INT_PCMCIA4  | MANTIS_INT_PCMCIA3 |
+		  MANTIS_INT_PCMCIA2  | MANTIS_INT_PCMCIA1 |
+		  MANTIS_INT_PCMCIA0  | MANTIS_INT_IRQ1	   |
+		  MANTIS_INT_IRQ0     | MANTIS_INT_OCERR   |
+		  MANTIS_INT_PABORT   | MANTIS_INT_RIPERR  |
+		  MANTIS_INT_PPERR    | MANTIS_INT_FTRGT   |
+		  MANTIS_INT_RISCI);
+
+	if (stat)
+		dprintk(MANTIS_DEBUG, 0, "<Unknown> Stat=<%02x> Mask=<%02x>", stat, mask);
+
+	dprintk(MANTIS_DEBUG, 0, "\n");
+	return IRQ_HANDLED;
+}
+
+static int __devinit mantis_pci_probe(struct pci_dev *pdev, const struct pci_device_id *pci_id)
+{
+	struct mantis_pci *mantis;
+	struct mantis_hwconfig *config;
+	int err = 0;
+
+	mantis = kzalloc(sizeof(struct mantis_pci), GFP_KERNEL);
+	if (mantis == NULL) {
+		printk(KERN_ERR "%s ERROR: Out of memory\n", __func__);
+		err = -ENOMEM;
+		goto fail0;
+	}
+
+	mantis->num		= devs;
+	mantis->verbose		= verbose;
+	mantis->pdev		= pdev;
+	config			= (struct mantis_hwconfig *) pci_id->driver_data;
+	config->irq_handler	= &mantis_irq_handler;
+	mantis->hwconfig	= config;
+
+	err = mantis_pci_init(mantis);
+	if (err) {
+		dprintk(MANTIS_ERROR, 1, "ERROR: Mantis PCI initialization failed <%d>", err);
+		goto fail1;
+	}
+
+	err = mantis_stream_control(mantis, STREAM_TO_HIF);
+	if (err < 0) {
+		dprintk(MANTIS_ERROR, 1, "ERROR: Mantis stream control failed <%d>", err);
+		goto fail1;
+	}
+
+	err = mantis_i2c_init(mantis);
+	if (err < 0) {
+		dprintk(MANTIS_ERROR, 1, "ERROR: Mantis I2C initialization failed <%d>", err);
+		goto fail2;
+	}
+
+	err = mantis_get_mac(mantis);
+	if (err < 0) {
+		dprintk(MANTIS_ERROR, 1, "ERROR: Mantis MAC address read failed <%d>", err);
+		goto fail2;
+	}
+
+	err = mantis_dma_init(mantis);
+	if (err < 0) {
+		dprintk(MANTIS_ERROR, 1, "ERROR: Mantis DMA initialization failed <%d>", err);
+		goto fail3;
+	}
+
+	err = mantis_dvb_init(mantis);
+	if (err < 0) {
+		dprintk(MANTIS_ERROR, 1, "ERROR: Mantis DVB initialization failed <%d>", err);
+		goto fail4;
+	}
+	err = mantis_uart_init(mantis);
+	if (err < 0) {
+		dprintk(MANTIS_ERROR, 1, "ERROR: Mantis UART initialization failed <%d>", err);
+		goto fail6;
+	}
+
+	devs++;
+
+	return err;
+
+
+	dprintk(MANTIS_ERROR, 1, "ERROR: Mantis UART exit! <%d>", err);
+	mantis_uart_exit(mantis);
+
+fail6:
+fail4:
+	dprintk(MANTIS_ERROR, 1, "ERROR: Mantis DMA exit! <%d>", err);
+	mantis_dma_exit(mantis);
+
+fail3:
+	dprintk(MANTIS_ERROR, 1, "ERROR: Mantis I2C exit! <%d>", err);
+	mantis_i2c_exit(mantis);
+
+fail2:
+	dprintk(MANTIS_ERROR, 1, "ERROR: Mantis PCI exit! <%d>", err);
+	mantis_pci_exit(mantis);
+
+fail1:
+	dprintk(MANTIS_ERROR, 1, "ERROR: Mantis free! <%d>", err);
+	kfree(mantis);
+
+fail0:
+	return err;
+}
+
+static void __devexit mantis_pci_remove(struct pci_dev *pdev)
+{
+	struct mantis_pci *mantis = pci_get_drvdata(pdev);
+
+	if (mantis) {
+
+		mantis_uart_exit(mantis);
+		mantis_dvb_exit(mantis);
+		mantis_dma_exit(mantis);
+		mantis_i2c_exit(mantis);
+		mantis_pci_exit(mantis);
+		kfree(mantis);
+	}
+	return;
+}
+
+static struct pci_device_id mantis_pci_table[] = {
+	MAKE_ENTRY(TWINHAN_TECHNOLOGIES, MANTIS_VP_1033_DVB_S, &vp1033_config),
+	MAKE_ENTRY(TWINHAN_TECHNOLOGIES, MANTIS_VP_1034_DVB_S, &vp1034_config),
+	MAKE_ENTRY(TWINHAN_TECHNOLOGIES, MANTIS_VP_1041_DVB_S2, &vp1041_config),
+	MAKE_ENTRY(TECHNISAT, SKYSTAR_HD2_10, &vp1041_config),
+	MAKE_ENTRY(TECHNISAT, SKYSTAR_HD2_20, &vp1041_config),
+	MAKE_ENTRY(TERRATEC, CINERGY_S2_PCI_HD, &vp1041_config),
+	MAKE_ENTRY(TWINHAN_TECHNOLOGIES, MANTIS_VP_2033_DVB_C, &vp2033_config),
+	MAKE_ENTRY(TWINHAN_TECHNOLOGIES, MANTIS_VP_2040_DVB_C, &vp2040_config),
+	MAKE_ENTRY(TECHNISAT, CABLESTAR_HD2, &vp2040_config),
+	MAKE_ENTRY(TERRATEC, CINERGY_C, &vp2033_config),
+	MAKE_ENTRY(TWINHAN_TECHNOLOGIES, MANTIS_VP_3030_DVB_T, &vp3030_config),
+	{ }
+};
+
+static struct pci_driver mantis_pci_driver = {
+	.name		= DRIVER_NAME,
+	.id_table	= mantis_pci_table,
+	.probe		= mantis_pci_probe,
+	.remove		= mantis_pci_remove,
+};
+
+static int __devinit mantis_init(void)
+{
+	return pci_register_driver(&mantis_pci_driver);
+}
+
+static void __devexit mantis_exit(void)
+{
+	return pci_unregister_driver(&mantis_pci_driver);
+}
+
+module_init(mantis_init);
+module_exit(mantis_exit);
+
+MODULE_DESCRIPTION("MANTIS driver");
+MODULE_AUTHOR("Manu Abraham");
+MODULE_LICENSE("GPL");
diff --git a/drivers/media/dvb/mantis/mantis_common.h b/drivers/media/dvb/mantis/mantis_common.h
new file mode 100644
index 000000000000..d0b645a483c9
--- /dev/null
+++ b/drivers/media/dvb/mantis/mantis_common.h
@@ -0,0 +1,179 @@
+/*
+	Mantis PCI bridge driver
+
+	Copyright (C) Manu Abraham (abraham.manu@gmail.com)
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#ifndef __MANTIS_COMMON_H
+#define __MANTIS_COMMON_H
+
+#include <linux/mutex.h>
+#include <linux/workqueue.h>
+
+#include "mantis_uart.h"
+
+#include "mantis_link.h"
+
+#define MANTIS_ERROR		0
+#define MANTIS_NOTICE		1
+#define MANTIS_INFO		2
+#define MANTIS_DEBUG		3
+#define MANTIS_TMG		9
+
+#define dprintk(y, z, format, arg...) do {								\
+	if (z) {											\
+		if	((mantis->verbose > MANTIS_ERROR) && (mantis->verbose > y))			\
+			printk(KERN_ERR "%s (%d): " format "\n" , __func__ , mantis->num , ##arg);	\
+		else if	((mantis->verbose > MANTIS_NOTICE) && (mantis->verbose > y))			\
+			printk(KERN_NOTICE "%s (%d): " format "\n" , __func__ , mantis->num , ##arg);	\
+		else if ((mantis->verbose > MANTIS_INFO) && (mantis->verbose > y))			\
+			printk(KERN_INFO "%s (%d): " format "\n" , __func__ , mantis->num , ##arg);	\
+		else if ((mantis->verbose > MANTIS_DEBUG) && (mantis->verbose > y))			\
+			printk(KERN_DEBUG "%s (%d): " format "\n" , __func__ , mantis->num , ##arg);	\
+		else if ((mantis->verbose > MANTIS_TMG) && (mantis->verbose > y))			\
+			printk(KERN_DEBUG "%s (%d): " format "\n" , __func__ , mantis->num , ##arg);	\
+	} else {											\
+		if (mantis->verbose > y)								\
+			printk(format , ##arg);								\
+	}												\
+} while(0)
+
+#define mwrite(dat, addr)	writel((dat), addr)
+#define mread(addr)		readl(addr)
+
+#define mmwrite(dat, addr)	mwrite((dat), (mantis->mmio + (addr)))
+#define mmread(addr)		mread(mantis->mmio + (addr))
+
+#define MANTIS_TS_188		0
+#define MANTIS_TS_204		1
+
+#define TWINHAN_TECHNOLOGIES	0x1822
+#define MANTIS			0x4e35
+
+#define TECHNISAT		0x1ae4
+#define TERRATEC		0x153b
+
+#define MAKE_ENTRY(__subven, __subdev, __configptr) {			\
+		.vendor		= TWINHAN_TECHNOLOGIES,			\
+		.device		= MANTIS,				\
+		.subvendor	= (__subven),				\
+		.subdevice	= (__subdev),				\
+		.driver_data	= (unsigned long) (__configptr)		\
+}
+
+enum mantis_i2c_mode {
+	MANTIS_PAGE_MODE = 0,
+	MANTIS_BYTE_MODE,
+};
+
+struct mantis_pci;
+
+struct mantis_hwconfig {
+	char			*model_name;
+	char			*dev_type;
+	u32			ts_size;
+
+	enum mantis_baud	baud_rate;
+	enum mantis_parity	parity;
+	u32			bytes;
+
+	irqreturn_t (*irq_handler)(int irq, void *dev_id);
+	int (*frontend_init)(struct mantis_pci *mantis, struct dvb_frontend *fe);
+
+	u8			power;
+	u8			reset;
+
+	enum mantis_i2c_mode	i2c_mode;
+};
+
+struct mantis_pci {
+	unsigned int		verbose;
+
+	/*	PCI stuff		*/
+	u16			vendor_id;
+	u16			device_id;
+	u16			subsystem_vendor;
+	u16			subsystem_device;
+
+	u8			latency;
+
+	struct pci_dev		*pdev;
+
+	unsigned long		mantis_addr;
+	void __iomem		*mmio;
+
+	u8			irq;
+	u8			revision;
+
+	unsigned int		num;
+
+	/*	RISC Core		*/
+	u32			finished_block;
+	u32			last_block;
+	u32			line_bytes;
+	u32			line_count;
+	u32			risc_pos;
+	u8			*buf_cpu;
+	dma_addr_t		buf_dma;
+	u32			*risc_cpu;
+	dma_addr_t		risc_dma;
+
+	struct tasklet_struct	tasklet;
+
+	struct i2c_adapter	adapter;
+	int			i2c_rc;
+	wait_queue_head_t	i2c_wq;
+	struct mutex		i2c_lock;
+
+	/*	DVB stuff		*/
+	struct dvb_adapter	dvb_adapter;
+	struct dvb_frontend	*fe;
+	struct dvb_demux	demux;
+	struct dmxdev		dmxdev;
+	struct dmx_frontend	fe_hw;
+	struct dmx_frontend	fe_mem;
+	struct dvb_net		dvbnet;
+
+	u8			feeds;
+
+	struct mantis_hwconfig	*hwconfig;
+
+	u32			mantis_int_stat;
+	u32			mantis_int_mask;
+
+	/*	board specific		*/
+	u8			mac_address[8];
+	u32			sub_vendor_id;
+	u32			sub_device_id;
+
+	 /*	A12 A13 A14		*/
+	u32			gpio_status;
+
+	u32			gpif_status;
+
+	struct mantis_ca	*mantis_ca;
+
+	wait_queue_head_t	uart_wq;
+	struct work_struct	uart_work;
+	spinlock_t		uart_lock;
+
+	struct input_dev	*rc;
+};
+
+#define MANTIS_HIF_STATUS	(mantis->gpio_status)
+
+#endif /* __MANTIS_COMMON_H */
diff --git a/drivers/media/dvb/mantis/mantis_core.c b/drivers/media/dvb/mantis/mantis_core.c
new file mode 100644
index 000000000000..8113b23ce448
--- /dev/null
+++ b/drivers/media/dvb/mantis/mantis_core.c
@@ -0,0 +1,238 @@
+/*
+	Mantis PCI bridge driver
+
+	Copyright (C) Manu Abraham (abraham.manu@gmail.com)
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#include "mantis_common.h"
+#include "mantis_core.h"
+#include "mantis_vp1033.h"
+#include "mantis_vp1034.h"
+#include "mantis_vp1041.h"
+#include "mantis_vp2033.h"
+#include "mantis_vp2040.h"
+#include "mantis_vp3030.h"
+
+static int read_eeprom_byte(struct mantis_pci *mantis, u8 *data, u8 length)
+{
+	int err;
+	struct i2c_msg msg[] = {
+		{
+			.addr = 0x50,
+			.flags = 0,
+			.buf = data,
+			.len = 1
+		}, {
+			.addr = 0x50,
+			.flags = I2C_M_RD,
+			.buf = data,
+			.len = length
+		},
+	};
+
+	err = i2c_transfer(&mantis->adapter, msg, 2);
+	if (err < 0) {
+		dprintk(verbose, MANTIS_ERROR, 1,
+			"ERROR: i2c read: < err=%i d0=0x%02x d1=0x%02x >",
+			err, data[0], data[1]);
+
+		return err;
+	}
+
+	return 0;
+}
+
+static int write_eeprom_byte(struct mantis_pci *mantis, u8 *data, u8 length)
+{
+	int err;
+
+	struct i2c_msg msg = {
+		.addr = 0x50,
+		.flags = 0,
+		.buf = data,
+		.len = length
+	};
+
+	err = i2c_transfer(&mantis->adapter, &msg, 1);
+	if (err < 0) {
+		dprintk(verbose, MANTIS_ERROR, 1,
+			"ERROR: i2c write: < err=%i length=0x%02x d0=0x%02x, d1=0x%02x >",
+			err, length, data[0], data[1]);
+
+		return err;
+	}
+
+	return 0;
+}
+
+static int get_mac_address(struct mantis_pci *mantis)
+{
+	int err;
+
+	mantis->mac_address[0] = 0x08;
+	err = read_eeprom_byte(mantis, &mantis->mac_address[0], 6);
+	if (err < 0) {
+		dprintk(verbose, MANTIS_ERROR, 1, "Mantis EEPROM read error");
+
+		return err;
+	}
+	dprintk(verbose, MANTIS_ERROR, 0,
+		"    MAC Address=[%02x:%02x:%02x:%02x:%02x:%02x]\n",
+		mantis->mac_address[0], mantis->mac_address[1],
+		mantis->mac_address[2],	mantis->mac_address[3],
+		mantis->mac_address[4], mantis->mac_address[5]);
+
+	return 0;
+}
+
+#define MANTIS_MODEL_UNKNOWN	"UNKNOWN"
+#define MANTIS_DEV_UNKNOWN	"UNKNOWN"
+
+struct mantis_hwconfig unknown_device = {
+	.model_name	= MANTIS_MODEL_UNKNOWN,
+	.dev_type	= MANTIS_DEV_UNKNOWN,
+};
+
+static void mantis_load_config(struct mantis_pci *mantis)
+{
+	switch (mantis->subsystem_device) {
+	case MANTIS_VP_1033_DVB_S:	/* VP-1033 */
+		mantis->hwconfig = &vp1033_mantis_config;
+		break;
+	case MANTIS_VP_1034_DVB_S:	/* VP-1034 */
+		mantis->hwconfig = &vp1034_mantis_config;
+		break;
+	case MANTIS_VP_1041_DVB_S2:	/* VP-1041 */
+	case TECHNISAT_SKYSTAR_HD2:
+		mantis->hwconfig = &vp1041_mantis_config;
+		break;
+	case MANTIS_VP_2033_DVB_C:	/* VP-2033 */
+		mantis->hwconfig = &vp2033_mantis_config;
+		break;
+	case MANTIS_VP_2040_DVB_C:	/* VP-2040 */
+	case TERRATEC_CINERGY_C_PCI:	/* VP-2040 clone */
+	case TECHNISAT_CABLESTAR_HD2:
+		mantis->hwconfig = &vp2040_mantis_config;
+		break;
+	case MANTIS_VP_3030_DVB_T:	/* VP-3030 */
+		mantis->hwconfig = &vp3030_mantis_config;
+		break;
+	default:
+		mantis->hwconfig = &unknown_device;
+		break;
+	}
+}
+
+int mantis_core_init(struct mantis_pci *mantis)
+{
+	int err = 0;
+
+	mantis_load_config(mantis);
+	dprintk(verbose, MANTIS_ERROR, 0, "found a %s PCI %s device on (%02x:%02x.%x),\n",
+		mantis->hwconfig->model_name, mantis->hwconfig->dev_type,
+		mantis->pdev->bus->number, PCI_SLOT(mantis->pdev->devfn), PCI_FUNC(mantis->pdev->devfn));
+	dprintk(verbose, MANTIS_ERROR, 0, "    Mantis Rev %d [%04x:%04x], ",
+		mantis->revision,
+		mantis->subsystem_vendor, mantis->subsystem_device);
+	dprintk(verbose, MANTIS_ERROR, 0,
+		"irq: %d, latency: %d\n    memory: 0x%lx, mmio: 0x%p\n",
+		mantis->pdev->irq, mantis->latency,
+		mantis->mantis_addr, mantis->mantis_mmio);
+
+	err = mantis_i2c_init(mantis);
+	if (err < 0) {
+		dprintk(verbose, MANTIS_ERROR, 1, "Mantis I2C init failed");
+		return err;
+	}
+	err = get_mac_address(mantis);
+	if (err < 0) {
+		dprintk(verbose, MANTIS_ERROR, 1, "get MAC address failed");
+		return err;
+	}
+	err = mantis_dma_init(mantis);
+	if (err < 0) {
+		dprintk(verbose, MANTIS_ERROR, 1, "Mantis DMA init failed");
+		return err;
+	}
+	err = mantis_dvb_init(mantis);
+	if (err < 0) {
+		dprintk(verbose, MANTIS_DEBUG, 1, "Mantis DVB init failed");
+		return err;
+	}
+	err = mantis_uart_init(mantis);
+	if (err < 0) {
+		dprintk(verbose, MANTIS_DEBUG, 1, "Mantis UART init failed");
+		return err;
+	}
+
+	return 0;
+}
+
+int mantis_core_exit(struct mantis_pci *mantis)
+{
+	mantis_dma_stop(mantis);
+	dprintk(verbose, MANTIS_ERROR, 1, "DMA engine stopping");
+
+	mantis_uart_exit(mantis);
+	dprintk(verbose, MANTIS_ERROR, 1, "UART exit failed");
+
+	if (mantis_dma_exit(mantis) < 0)
+		dprintk(verbose, MANTIS_ERROR, 1, "DMA exit failed");
+	if (mantis_dvb_exit(mantis) < 0)
+		dprintk(verbose, MANTIS_ERROR, 1, "DVB exit failed");
+	if (mantis_i2c_exit(mantis) < 0)
+		dprintk(verbose, MANTIS_ERROR, 1, "I2C adapter delete.. failed");
+
+	return 0;
+}
+
+/* Turn the given bit on or off. */
+void gpio_set_bits(struct mantis_pci *mantis, u32 bitpos, u8 value)
+{
+	u32 cur;
+
+	cur = mmread(MANTIS_GPIF_ADDR);
+	if (value)
+		mantis->gpio_status = cur | (1 << bitpos);
+	else
+		mantis->gpio_status = cur & (~(1 << bitpos));
+
+	mmwrite(mantis->gpio_status, MANTIS_GPIF_ADDR);
+	mmwrite(0x00, MANTIS_GPIF_DOUT);
+	udelay(100);
+}
+
+/* direction = 0 , no CI passthrough ; 1 , CI passthrough */
+void mantis_set_direction(struct mantis_pci *mantis, int direction)
+{
+	u32 reg;
+
+	reg = mmread(0x28);
+	dprintk(verbose, MANTIS_DEBUG, 1, "TS direction setup");
+	if (direction == 0x01) {
+		/* to CI */
+		reg |= 0x04;
+		mmwrite(reg, 0x28);
+		reg &= 0xff - 0x04;
+		mmwrite(reg, 0x28);
+	} else {
+		reg &= 0xff - 0x04;
+		mmwrite(reg, 0x28);
+		reg |= 0x04;
+		mmwrite(reg, 0x28);
+	}
+}
diff --git a/drivers/media/dvb/mantis/mantis_core.h b/drivers/media/dvb/mantis/mantis_core.h
new file mode 100644
index 000000000000..833ee42e694e
--- /dev/null
+++ b/drivers/media/dvb/mantis/mantis_core.h
@@ -0,0 +1,57 @@
+/*
+	Mantis PCI bridge driver
+
+	Copyright (C) Manu Abraham (abraham.manu@gmail.com)
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#ifndef __MANTIS_CORE_H
+#define __MANTIS_CORE_H
+
+#include "mantis_common.h"
+
+
+#define FE_TYPE_SAT	0
+#define FE_TYPE_CAB	1
+#define FE_TYPE_TER	2
+
+#define FE_TYPE_TS204	0
+#define FE_TYPE_TS188	1
+
+
+struct vendorname {
+	u8  *sub_vendor_name;
+	u32 sub_vendor_id;
+};
+
+struct devicetype {
+	u8  *sub_device_name;
+	u32 sub_device_id;
+	u8  device_type;
+	u32 type_flags;
+};
+
+
+extern int mantis_dma_init(struct mantis_pci *mantis);
+extern int mantis_dma_exit(struct mantis_pci *mantis);
+extern void mantis_dma_start(struct mantis_pci *mantis);
+extern void mantis_dma_stop(struct mantis_pci *mantis);
+extern int mantis_i2c_init(struct mantis_pci *mantis);
+extern int mantis_i2c_exit(struct mantis_pci *mantis);
+extern int mantis_core_init(struct mantis_pci *mantis);
+extern int mantis_core_exit(struct mantis_pci *mantis);
+
+#endif /* __MANTIS_CORE_H */
diff --git a/drivers/media/dvb/mantis/mantis_dma.c b/drivers/media/dvb/mantis/mantis_dma.c
new file mode 100644
index 000000000000..46202a4012aa
--- /dev/null
+++ b/drivers/media/dvb/mantis/mantis_dma.c
@@ -0,0 +1,256 @@
+/*
+	Mantis PCI bridge driver
+
+	Copyright (C) Manu Abraham (abraham.manu@gmail.com)
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#include <linux/kernel.h>
+#include <asm/page.h>
+#include <linux/vmalloc.h>
+#include <linux/pci.h>
+
+#include <asm/irq.h>
+#include <linux/signal.h>
+#include <linux/sched.h>
+#include <linux/interrupt.h>
+
+#include "dmxdev.h"
+#include "dvbdev.h"
+#include "dvb_demux.h"
+#include "dvb_frontend.h"
+#include "dvb_net.h"
+
+#include "mantis_common.h"
+#include "mantis_reg.h"
+#include "mantis_dma.h"
+
+#define RISC_WRITE		(0x01 << 28)
+#define RISC_JUMP		(0x07 << 28)
+#define RISC_IRQ		(0x01 << 24)
+
+#define RISC_STATUS(status)	((((~status) & 0x0f) << 20) | ((status & 0x0f) << 16))
+#define RISC_FLUSH()		(mantis->risc_pos = 0)
+#define RISC_INSTR(opcode)	(mantis->risc_cpu[mantis->risc_pos++] = cpu_to_le32(opcode))
+
+#define MANTIS_BUF_SIZE		(64 * 1024)
+#define MANTIS_BLOCK_BYTES	(MANTIS_BUF_SIZE >> 4)
+#define MANTIS_BLOCK_COUNT	(1 << 4)
+#define MANTIS_RISC_SIZE	PAGE_SIZE
+
+int mantis_dma_exit(struct mantis_pci *mantis)
+{
+	if (mantis->buf_cpu) {
+		dprintk(MANTIS_ERROR, 1,
+			"DMA=0x%lx cpu=0x%p size=%d",
+			(unsigned long) mantis->buf_dma,
+			 mantis->buf_cpu,
+			 MANTIS_BUF_SIZE);
+
+		pci_free_consistent(mantis->pdev, MANTIS_BUF_SIZE,
+				    mantis->buf_cpu, mantis->buf_dma);
+
+		mantis->buf_cpu = NULL;
+	}
+	if (mantis->risc_cpu) {
+		dprintk(MANTIS_ERROR, 1,
+			"RISC=0x%lx cpu=0x%p size=%lx",
+			(unsigned long) mantis->risc_dma,
+			mantis->risc_cpu,
+			MANTIS_RISC_SIZE);
+
+		pci_free_consistent(mantis->pdev, MANTIS_RISC_SIZE,
+				    mantis->risc_cpu, mantis->risc_dma);
+
+		mantis->risc_cpu = NULL;
+	}
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(mantis_dma_exit);
+
+static inline int mantis_alloc_buffers(struct mantis_pci *mantis)
+{
+	if (!mantis->buf_cpu) {
+		mantis->buf_cpu = pci_alloc_consistent(mantis->pdev,
+						       MANTIS_BUF_SIZE,
+						       &mantis->buf_dma);
+		if (!mantis->buf_cpu) {
+			dprintk(MANTIS_ERROR, 1,
+				"DMA buffer allocation failed");
+
+			goto err;
+		}
+		dprintk(MANTIS_ERROR, 1,
+			"DMA=0x%lx cpu=0x%p size=%d",
+			(unsigned long) mantis->buf_dma,
+			mantis->buf_cpu, MANTIS_BUF_SIZE);
+	}
+	if (!mantis->risc_cpu) {
+		mantis->risc_cpu = pci_alloc_consistent(mantis->pdev,
+							MANTIS_RISC_SIZE,
+							&mantis->risc_dma);
+
+		if (!mantis->risc_cpu) {
+			dprintk(MANTIS_ERROR, 1,
+				"RISC program allocation failed");
+
+			mantis_dma_exit(mantis);
+
+			goto err;
+		}
+		dprintk(MANTIS_ERROR, 1,
+			"RISC=0x%lx cpu=0x%p size=%lx",
+			(unsigned long) mantis->risc_dma,
+			mantis->risc_cpu, MANTIS_RISC_SIZE);
+	}
+
+	return 0;
+err:
+	dprintk(MANTIS_ERROR, 1, "Out of memory (?) .....");
+	return -ENOMEM;
+}
+
+static inline int mantis_calc_lines(struct mantis_pci *mantis)
+{
+	mantis->line_bytes = MANTIS_BLOCK_BYTES;
+	mantis->line_count = MANTIS_BLOCK_COUNT;
+
+	while (mantis->line_bytes > 4095) {
+		mantis->line_bytes >>= 1;
+		mantis->line_count <<= 1;
+	}
+
+	dprintk(MANTIS_DEBUG, 1, "Mantis RISC block bytes=[%d], line bytes=[%d], line count=[%d]",
+		MANTIS_BLOCK_BYTES, mantis->line_bytes, mantis->line_count);
+
+	if (mantis->line_count > 255) {
+		dprintk(MANTIS_ERROR, 1, "Buffer size error");
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+int mantis_dma_init(struct mantis_pci *mantis)
+{
+	int err = 0;
+
+	dprintk(MANTIS_DEBUG, 1, "Mantis DMA init");
+	if (mantis_alloc_buffers(mantis) < 0) {
+		dprintk(MANTIS_ERROR, 1, "Error allocating DMA buffer");
+
+		/* Stop RISC Engine */
+		mmwrite(0, MANTIS_DMA_CTL);
+
+		goto err;
+	}
+	err = mantis_calc_lines(mantis);
+	if (err < 0) {
+		dprintk(MANTIS_ERROR, 1, "Mantis calc lines failed");
+
+		goto err;
+	}
+
+	return 0;
+err:
+	return err;
+}
+EXPORT_SYMBOL_GPL(mantis_dma_init);
+
+static inline void mantis_risc_program(struct mantis_pci *mantis)
+{
+	u32 buf_pos = 0;
+	u32 line;
+
+	dprintk(MANTIS_DEBUG, 1, "Mantis create RISC program");
+	RISC_FLUSH();
+
+	dprintk(MANTIS_DEBUG, 1, "risc len lines %u, bytes per line %u",
+		mantis->line_count, mantis->line_bytes);
+
+	for (line = 0; line < mantis->line_count; line++) {
+		dprintk(MANTIS_DEBUG, 1, "RISC PROG line=[%d]", line);
+		if (!(buf_pos % MANTIS_BLOCK_BYTES)) {
+			RISC_INSTR(RISC_WRITE	|
+				   RISC_IRQ	|
+				   RISC_STATUS(((buf_pos / MANTIS_BLOCK_BYTES) +
+				   (MANTIS_BLOCK_COUNT - 1)) %
+				    MANTIS_BLOCK_COUNT) |
+				    mantis->line_bytes);
+		} else {
+			RISC_INSTR(RISC_WRITE	| mantis->line_bytes);
+		}
+		RISC_INSTR(mantis->buf_dma + buf_pos);
+		buf_pos += mantis->line_bytes;
+	}
+	RISC_INSTR(RISC_JUMP);
+	RISC_INSTR(mantis->risc_dma);
+}
+
+void mantis_dma_start(struct mantis_pci *mantis)
+{
+	dprintk(MANTIS_DEBUG, 1, "Mantis Start DMA engine");
+
+	mantis_risc_program(mantis);
+	mmwrite(mantis->risc_dma, MANTIS_RISC_START);
+	mmwrite(mmread(MANTIS_GPIF_ADDR) | MANTIS_GPIF_HIFRDWRN, MANTIS_GPIF_ADDR);
+
+	mmwrite(0, MANTIS_DMA_CTL);
+	mantis->last_block = mantis->finished_block = 0;
+
+	mmwrite(mmread(MANTIS_INT_MASK) | MANTIS_INT_RISCI, MANTIS_INT_MASK);
+
+	mmwrite(MANTIS_FIFO_EN | MANTIS_DCAP_EN
+			       | MANTIS_RISC_EN, MANTIS_DMA_CTL);
+
+}
+
+void mantis_dma_stop(struct mantis_pci *mantis)
+{
+	u32 stat = 0, mask = 0;
+
+	stat = mmread(MANTIS_INT_STAT);
+	mask = mmread(MANTIS_INT_MASK);
+	dprintk(MANTIS_DEBUG, 1, "Mantis Stop DMA engine");
+
+	mmwrite((mmread(MANTIS_GPIF_ADDR) & (~(MANTIS_GPIF_HIFRDWRN))), MANTIS_GPIF_ADDR);
+
+	mmwrite((mmread(MANTIS_DMA_CTL) & ~(MANTIS_FIFO_EN |
+					    MANTIS_DCAP_EN |
+					    MANTIS_RISC_EN)), MANTIS_DMA_CTL);
+
+	mmwrite(mmread(MANTIS_INT_STAT), MANTIS_INT_STAT);
+
+	mmwrite(mmread(MANTIS_INT_MASK) & ~(MANTIS_INT_RISCI |
+					    MANTIS_INT_RISCEN), MANTIS_INT_MASK);
+}
+
+
+void mantis_dma_xfer(unsigned long data)
+{
+	struct mantis_pci *mantis = (struct mantis_pci *) data;
+	struct mantis_hwconfig *config = mantis->hwconfig;
+
+	while (mantis->last_block != mantis->finished_block) {
+		dprintk(MANTIS_DEBUG, 1, "last block=[%d] finished block=[%d]",
+			mantis->last_block, mantis->finished_block);
+
+		(config->ts_size ? dvb_dmx_swfilter_204 : dvb_dmx_swfilter)
+		(&mantis->demux, &mantis->buf_cpu[mantis->last_block * MANTIS_BLOCK_BYTES], MANTIS_BLOCK_BYTES);
+		mantis->last_block = (mantis->last_block + 1) % MANTIS_BLOCK_COUNT;
+	}
+}
diff --git a/drivers/media/dvb/mantis/mantis_dma.h b/drivers/media/dvb/mantis/mantis_dma.h
new file mode 100644
index 000000000000..6be00fa82094
--- /dev/null
+++ b/drivers/media/dvb/mantis/mantis_dma.h
@@ -0,0 +1,30 @@
+/*
+	Mantis PCI bridge driver
+
+	Copyright (C) Manu Abraham (abraham.manu@gmail.com)
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#ifndef __MANTIS_DMA_H
+#define __MANTIS_DMA_H
+
+extern int mantis_dma_init(struct mantis_pci *mantis);
+extern int mantis_dma_exit(struct mantis_pci *mantis);
+extern void mantis_dma_start(struct mantis_pci *mantis);
+extern void mantis_dma_stop(struct mantis_pci *mantis);
+extern void mantis_dma_xfer(unsigned long data);
+
+#endif /* __MANTIS_DMA_H */
diff --git a/drivers/media/dvb/mantis/mantis_dvb.c b/drivers/media/dvb/mantis/mantis_dvb.c
new file mode 100644
index 000000000000..99d82eec3b03
--- /dev/null
+++ b/drivers/media/dvb/mantis/mantis_dvb.c
@@ -0,0 +1,296 @@
+/*
+	Mantis PCI bridge driver
+	Copyright (C) Manu Abraham (abraham.manu@gmail.com)
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#include <linux/kernel.h>
+#include <linux/bitops.h>
+
+#include <linux/signal.h>
+#include <linux/sched.h>
+#include <linux/interrupt.h>
+#include <linux/pci.h>
+#include <linux/i2c.h>
+
+#include "dmxdev.h"
+#include "dvbdev.h"
+#include "dvb_demux.h"
+#include "dvb_frontend.h"
+#include "dvb_net.h"
+
+#include "mantis_common.h"
+#include "mantis_dma.h"
+#include "mantis_ca.h"
+#include "mantis_ioc.h"
+#include "mantis_dvb.h"
+
+DVB_DEFINE_MOD_OPT_ADAPTER_NR(adapter_nr);
+
+int mantis_frontend_power(struct mantis_pci *mantis, enum mantis_power power)
+{
+	struct mantis_hwconfig *config = mantis->hwconfig;
+
+	switch (power) {
+	case POWER_ON:
+		dprintk(MANTIS_DEBUG, 1, "Power ON");
+		gpio_set_bits(mantis, config->power, POWER_ON);
+		msleep(100);
+		gpio_set_bits(mantis, config->power, POWER_ON);
+		msleep(100);
+		break;
+
+	case POWER_OFF:
+		dprintk(MANTIS_DEBUG, 1, "Power OFF");
+		gpio_set_bits(mantis, config->power, POWER_OFF);
+		msleep(100);
+		break;
+
+	default:
+		dprintk(MANTIS_DEBUG, 1, "Unknown state <%02x>", power);
+		return -1;
+	}
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(mantis_frontend_power);
+
+void mantis_frontend_soft_reset(struct mantis_pci *mantis)
+{
+	struct mantis_hwconfig *config = mantis->hwconfig;
+
+	dprintk(MANTIS_DEBUG, 1, "Frontend RESET");
+	gpio_set_bits(mantis, config->reset, 0);
+	msleep(100);
+	gpio_set_bits(mantis, config->reset, 0);
+	msleep(100);
+	gpio_set_bits(mantis, config->reset, 1);
+	msleep(100);
+	gpio_set_bits(mantis, config->reset, 1);
+	msleep(100);
+
+	return;
+}
+EXPORT_SYMBOL_GPL(mantis_frontend_soft_reset);
+
+static int mantis_frontend_shutdown(struct mantis_pci *mantis)
+{
+	int err;
+
+	mantis_frontend_soft_reset(mantis);
+	err = mantis_frontend_power(mantis, POWER_OFF);
+	if (err != 0) {
+		dprintk(MANTIS_ERROR, 1, "Frontend POWER OFF failed! <%d>", err);
+		return 1;
+	}
+
+	return 0;
+}
+
+static int mantis_dvb_start_feed(struct dvb_demux_feed *dvbdmxfeed)
+{
+	struct dvb_demux *dvbdmx = dvbdmxfeed->demux;
+	struct mantis_pci *mantis = dvbdmx->priv;
+
+	dprintk(MANTIS_DEBUG, 1, "Mantis DVB Start feed");
+	if (!dvbdmx->dmx.frontend) {
+		dprintk(MANTIS_DEBUG, 1, "no frontend ?");
+		return -EINVAL;
+	}
+
+	mantis->feeds++;
+	dprintk(MANTIS_DEBUG, 1, "mantis start feed, feeds=%d",	mantis->feeds);
+
+	if (mantis->feeds == 1)	 {
+		dprintk(MANTIS_DEBUG, 1, "mantis start feed & dma");
+		mantis_dma_start(mantis);
+	}
+
+	return mantis->feeds;
+}
+
+static int mantis_dvb_stop_feed(struct dvb_demux_feed *dvbdmxfeed)
+{
+	struct dvb_demux *dvbdmx = dvbdmxfeed->demux;
+	struct mantis_pci *mantis = dvbdmx->priv;
+
+	dprintk(MANTIS_DEBUG, 1, "Mantis DVB Stop feed");
+	if (!dvbdmx->dmx.frontend) {
+		dprintk(MANTIS_DEBUG, 1, "no frontend ?");
+		return -EINVAL;
+	}
+
+	mantis->feeds--;
+	if (mantis->feeds == 0) {
+		dprintk(MANTIS_DEBUG, 1, "mantis stop feed and dma");
+		mantis_dma_stop(mantis);
+	}
+
+	return 0;
+}
+
+int __devinit mantis_dvb_init(struct mantis_pci *mantis)
+{
+	struct mantis_hwconfig *config = mantis->hwconfig;
+	int result = -1;
+
+	dprintk(MANTIS_DEBUG, 1, "dvb_register_adapter");
+
+	result = dvb_register_adapter(&mantis->dvb_adapter,
+				      "Mantis DVB adapter",
+				      THIS_MODULE,
+				      &mantis->pdev->dev,
+				      adapter_nr);
+
+	if (result < 0) {
+
+		dprintk(MANTIS_ERROR, 1, "Error registering adapter");
+		return -ENODEV;
+	}
+
+	mantis->dvb_adapter.priv	= mantis;
+	mantis->demux.dmx.capabilities	= DMX_TS_FILTERING	|
+					 DMX_SECTION_FILTERING	|
+					 DMX_MEMORY_BASED_FILTERING;
+
+	mantis->demux.priv		= mantis;
+	mantis->demux.filternum		= 256;
+	mantis->demux.feednum		= 256;
+	mantis->demux.start_feed	= mantis_dvb_start_feed;
+	mantis->demux.stop_feed		= mantis_dvb_stop_feed;
+	mantis->demux.write_to_decoder	= NULL;
+
+	dprintk(MANTIS_DEBUG, 1, "dvb_dmx_init");
+	result = dvb_dmx_init(&mantis->demux);
+	if (result < 0) {
+		dprintk(MANTIS_ERROR, 1, "dvb_dmx_init failed, ERROR=%d", result);
+
+		goto err0;
+	}
+
+	mantis->dmxdev.filternum	= 256;
+	mantis->dmxdev.demux		= &mantis->demux.dmx;
+	mantis->dmxdev.capabilities	= 0;
+	dprintk(MANTIS_DEBUG, 1, "dvb_dmxdev_init");
+
+	result = dvb_dmxdev_init(&mantis->dmxdev, &mantis->dvb_adapter);
+	if (result < 0) {
+
+		dprintk(MANTIS_ERROR, 1, "dvb_dmxdev_init failed, ERROR=%d", result);
+		goto err1;
+	}
+
+	mantis->fe_hw.source		= DMX_FRONTEND_0;
+	result = mantis->demux.dmx.add_frontend(&mantis->demux.dmx, &mantis->fe_hw);
+	if (result < 0) {
+
+		dprintk(MANTIS_ERROR, 1, "dvb_dmx_init failed, ERROR=%d", result);
+		goto err2;
+	}
+
+	mantis->fe_mem.source		= DMX_MEMORY_FE;
+	result = mantis->demux.dmx.add_frontend(&mantis->demux.dmx, &mantis->fe_mem);
+	if (result < 0) {
+		dprintk(MANTIS_ERROR, 1, "dvb_dmx_init failed, ERROR=%d", result);
+		goto err3;
+	}
+
+	result = mantis->demux.dmx.connect_frontend(&mantis->demux.dmx, &mantis->fe_hw);
+	if (result < 0) {
+		dprintk(MANTIS_ERROR, 1, "dvb_dmx_init failed, ERROR=%d", result);
+		goto err4;
+	}
+
+	dvb_net_init(&mantis->dvb_adapter, &mantis->dvbnet, &mantis->demux.dmx);
+	tasklet_init(&mantis->tasklet, mantis_dma_xfer, (unsigned long) mantis);
+	if (mantis->hwconfig) {
+		result = config->frontend_init(mantis, mantis->fe);
+		if (result < 0) {
+			dprintk(MANTIS_ERROR, 1, "!!! NO Frontends found !!!");
+			goto err5;
+		} else {
+			if (mantis->fe == NULL) {
+				dprintk(MANTIS_ERROR, 1, "FE <NULL>");
+				goto err5;
+			}
+
+			if (dvb_register_frontend(&mantis->dvb_adapter, mantis->fe)) {
+				dprintk(MANTIS_ERROR, 1, "ERROR: Frontend registration failed");
+
+				if (mantis->fe->ops.release)
+					mantis->fe->ops.release(mantis->fe);
+
+				mantis->fe = NULL;
+				goto err5;
+			}
+		}
+	}
+
+	return 0;
+
+	/* Error conditions ..	*/
+err5:
+	tasklet_kill(&mantis->tasklet);
+	dvb_net_release(&mantis->dvbnet);
+	dvb_unregister_frontend(mantis->fe);
+	dvb_frontend_detach(mantis->fe);
+err4:
+	mantis->demux.dmx.remove_frontend(&mantis->demux.dmx, &mantis->fe_mem);
+
+err3:
+	mantis->demux.dmx.remove_frontend(&mantis->demux.dmx, &mantis->fe_hw);
+
+err2:
+	dvb_dmxdev_release(&mantis->dmxdev);
+
+err1:
+	dvb_dmx_release(&mantis->demux);
+
+err0:
+	dvb_unregister_adapter(&mantis->dvb_adapter);
+
+	return result;
+}
+EXPORT_SYMBOL_GPL(mantis_dvb_init);
+
+int __devexit mantis_dvb_exit(struct mantis_pci *mantis)
+{
+	int err;
+
+	if (mantis->fe) {
+		/* mantis_ca_exit(mantis); */
+		err = mantis_frontend_shutdown(mantis);
+		if (err != 0)
+			dprintk(MANTIS_ERROR, 1, "Frontend exit while POWER ON! <%d>", err);
+		dvb_unregister_frontend(mantis->fe);
+		dvb_frontend_detach(mantis->fe);
+	}
+
+	tasklet_kill(&mantis->tasklet);
+	dvb_net_release(&mantis->dvbnet);
+
+	mantis->demux.dmx.remove_frontend(&mantis->demux.dmx, &mantis->fe_mem);
+	mantis->demux.dmx.remove_frontend(&mantis->demux.dmx, &mantis->fe_hw);
+
+	dvb_dmxdev_release(&mantis->dmxdev);
+	dvb_dmx_release(&mantis->demux);
+
+	dprintk(MANTIS_DEBUG, 1, "dvb_unregister_adapter");
+	dvb_unregister_adapter(&mantis->dvb_adapter);
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(mantis_dvb_exit);
diff --git a/drivers/media/dvb/mantis/mantis_dvb.h b/drivers/media/dvb/mantis/mantis_dvb.h
new file mode 100644
index 000000000000..464199db304e
--- /dev/null
+++ b/drivers/media/dvb/mantis/mantis_dvb.h
@@ -0,0 +1,35 @@
+/*
+	Mantis PCI bridge driver
+
+	Copyright (C) Manu Abraham (abraham.manu@gmail.com)
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#ifndef __MANTIS_DVB_H
+#define __MANTIS_DVB_H
+
+enum mantis_power {
+	POWER_OFF	= 0,
+	POWER_ON	= 1
+};
+
+extern int mantis_frontend_power(struct mantis_pci *mantis, enum mantis_power power);
+extern void mantis_frontend_soft_reset(struct mantis_pci *mantis);
+
+extern int mantis_dvb_init(struct mantis_pci *mantis);
+extern int mantis_dvb_exit(struct mantis_pci *mantis);
+
+#endif /* __MANTIS_DVB_H */
diff --git a/drivers/media/dvb/mantis/mantis_evm.c b/drivers/media/dvb/mantis/mantis_evm.c
new file mode 100644
index 000000000000..a7b369a439d6
--- /dev/null
+++ b/drivers/media/dvb/mantis/mantis_evm.c
@@ -0,0 +1,117 @@
+/*
+	Mantis PCI bridge driver
+
+	Copyright (C) Manu Abraham (abraham.manu@gmail.com)
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#include <linux/kernel.h>
+
+#include <linux/signal.h>
+#include <linux/sched.h>
+#include <linux/interrupt.h>
+
+#include "dmxdev.h"
+#include "dvbdev.h"
+#include "dvb_demux.h"
+#include "dvb_frontend.h"
+#include "dvb_net.h"
+
+#include "mantis_common.h"
+#include "mantis_link.h"
+#include "mantis_hif.h"
+#include "mantis_reg.h"
+
+static void mantis_hifevm_work(struct work_struct *work)
+{
+	struct mantis_ca *ca = container_of(work, struct mantis_ca, hif_evm_work);
+	struct mantis_pci *mantis = ca->ca_priv;
+
+	u32 gpif_stat, gpif_mask;
+
+	gpif_stat = mmread(MANTIS_GPIF_STATUS);
+	gpif_mask = mmread(MANTIS_GPIF_IRQCFG);
+
+	if (gpif_stat & MANTIS_GPIF_DETSTAT) {
+		if (gpif_stat & MANTIS_CARD_PLUGIN) {
+			dprintk(MANTIS_DEBUG, 1, "Event Mgr: Adapter(%d) Slot(0): CAM Plugin", mantis->num);
+			mmwrite(0xdada0000, MANTIS_CARD_RESET);
+			mantis_event_cam_plugin(ca);
+			dvb_ca_en50221_camchange_irq(&ca->en50221,
+						     0,
+						     DVB_CA_EN50221_CAMCHANGE_INSERTED);
+		}
+	} else {
+		if (gpif_stat & MANTIS_CARD_PLUGOUT) {
+			dprintk(MANTIS_DEBUG, 1, "Event Mgr: Adapter(%d) Slot(0): CAM Unplug", mantis->num);
+			mmwrite(0xdada0000, MANTIS_CARD_RESET);
+			mantis_event_cam_unplug(ca);
+			dvb_ca_en50221_camchange_irq(&ca->en50221,
+						     0,
+						     DVB_CA_EN50221_CAMCHANGE_REMOVED);
+		}
+	}
+
+	if (mantis->gpif_status & MANTIS_GPIF_EXTIRQ)
+		dprintk(MANTIS_DEBUG, 1, "Event Mgr: Adapter(%d) Slot(0): Ext IRQ", mantis->num);
+
+	if (mantis->gpif_status & MANTIS_SBUF_WSTO)
+		dprintk(MANTIS_DEBUG, 1, "Event Mgr: Adapter(%d) Slot(0): Smart Buffer Timeout", mantis->num);
+
+	if (mantis->gpif_status & MANTIS_GPIF_OTHERR)
+		dprintk(MANTIS_DEBUG, 1, "Event Mgr: Adapter(%d) Slot(0): Alignment Error", mantis->num);
+
+	if (gpif_stat & MANTIS_SBUF_OVFLW)
+		dprintk(MANTIS_DEBUG, 1, "Event Mgr: Adapter(%d) Slot(0): Smart Buffer Overflow", mantis->num);
+
+	if (gpif_stat & MANTIS_GPIF_BRRDY)
+		dprintk(MANTIS_DEBUG, 1, "Event Mgr: Adapter(%d) Slot(0): Smart Buffer Read Ready", mantis->num);
+
+	if (gpif_stat & MANTIS_GPIF_INTSTAT)
+		dprintk(MANTIS_DEBUG, 1, "Event Mgr: Adapter(%d) Slot(0): GPIF IRQ", mantis->num);
+
+	if (gpif_stat & MANTIS_SBUF_EMPTY)
+		dprintk(MANTIS_DEBUG, 1, "Event Mgr: Adapter(%d) Slot(0): Smart Buffer Empty", mantis->num);
+
+	if (gpif_stat & MANTIS_SBUF_OPDONE) {
+		dprintk(MANTIS_DEBUG, 1, "Event Mgr: Adapter(%d) Slot(0): Smart Buffer operation complete", mantis->num);
+		ca->sbuf_status = MANTIS_SBUF_DATA_AVAIL;
+		ca->hif_event = MANTIS_SBUF_OPDONE;
+		wake_up(&ca->hif_opdone_wq);
+	}
+}
+
+int mantis_evmgr_init(struct mantis_ca *ca)
+{
+	struct mantis_pci *mantis = ca->ca_priv;
+
+	dprintk(MANTIS_DEBUG, 1, "Initializing Mantis Host I/F Event manager");
+	INIT_WORK(&ca->hif_evm_work, mantis_hifevm_work);
+	mantis_pcmcia_init(ca);
+	schedule_work(&ca->hif_evm_work);
+	mantis_hif_init(ca);
+	return 0;
+}
+
+void mantis_evmgr_exit(struct mantis_ca *ca)
+{
+	struct mantis_pci *mantis = ca->ca_priv;
+
+	dprintk(MANTIS_DEBUG, 1, "Mantis Host I/F Event manager exiting");
+	flush_scheduled_work();
+	mantis_hif_exit(ca);
+	mantis_pcmcia_exit(ca);
+}
diff --git a/drivers/media/dvb/mantis/mantis_hif.c b/drivers/media/dvb/mantis/mantis_hif.c
new file mode 100644
index 000000000000..7477dac628b4
--- /dev/null
+++ b/drivers/media/dvb/mantis/mantis_hif.c
@@ -0,0 +1,240 @@
+/*
+	Mantis PCI bridge driver
+
+	Copyright (C) Manu Abraham (abraham.manu@gmail.com)
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#include <linux/kernel.h>
+#include <linux/signal.h>
+#include <linux/sched.h>
+
+#include <linux/signal.h>
+#include <linux/sched.h>
+#include <linux/interrupt.h>
+
+#include "dmxdev.h"
+#include "dvbdev.h"
+#include "dvb_demux.h"
+#include "dvb_frontend.h"
+#include "dvb_net.h"
+
+#include "mantis_common.h"
+
+#include "mantis_hif.h"
+#include "mantis_link.h" /* temporary due to physical layer stuff */
+
+#include "mantis_reg.h"
+
+
+static int mantis_hif_sbuf_opdone_wait(struct mantis_ca *ca)
+{
+	struct mantis_pci *mantis = ca->ca_priv;
+	int rc = 0;
+
+	if (wait_event_timeout(ca->hif_opdone_wq,
+			       ca->hif_event & MANTIS_SBUF_OPDONE,
+			       msecs_to_jiffies(500)) == -ERESTARTSYS) {
+
+		dprintk(MANTIS_ERROR, 1, "Adapter(%d) Slot(0): Smart buffer operation timeout !", mantis->num);
+		rc = -EREMOTEIO;
+	}
+	dprintk(MANTIS_DEBUG, 1, "Smart Buffer Operation complete");
+	ca->hif_event &= ~MANTIS_SBUF_OPDONE;
+	return rc;
+}
+
+static int mantis_hif_write_wait(struct mantis_ca *ca)
+{
+	struct mantis_pci *mantis = ca->ca_priv;
+	u32 opdone = 0, timeout = 0;
+	int rc = 0;
+
+	if (wait_event_timeout(ca->hif_write_wq,
+			       mantis->gpif_status & MANTIS_GPIF_WRACK,
+			       msecs_to_jiffies(500)) == -ERESTARTSYS) {
+
+		dprintk(MANTIS_ERROR, 1, "Adapter(%d) Slot(0): Write ACK timed out !", mantis->num);
+		rc = -EREMOTEIO;
+	}
+	dprintk(MANTIS_DEBUG, 1, "Write Acknowledged");
+	mantis->gpif_status &= ~MANTIS_GPIF_WRACK;
+	while (!opdone) {
+		opdone = (mmread(MANTIS_GPIF_STATUS) & MANTIS_SBUF_OPDONE);
+		udelay(500);
+		timeout++;
+		if (timeout > 100) {
+			dprintk(MANTIS_ERROR, 1, "Adater(%d) Slot(0): Write operation timed out!", mantis->num);
+			rc = -ETIMEDOUT;
+			break;
+		}
+	}
+	dprintk(MANTIS_DEBUG, 1, "HIF Write success");
+	return rc;
+}
+
+
+int mantis_hif_read_mem(struct mantis_ca *ca, u32 addr)
+{
+	struct mantis_pci *mantis = ca->ca_priv;
+	u32 hif_addr = 0, data, count = 4;
+
+	dprintk(MANTIS_DEBUG, 1, "Adapter(%d) Slot(0): Request HIF Mem Read", mantis->num);
+	mutex_lock(&ca->ca_lock);
+	hif_addr &= ~MANTIS_GPIF_PCMCIAREG;
+	hif_addr &= ~MANTIS_GPIF_PCMCIAIOM;
+	hif_addr |=  MANTIS_HIF_STATUS;
+	hif_addr |=  addr;
+
+	mmwrite(hif_addr, MANTIS_GPIF_BRADDR);
+	mmwrite(count, MANTIS_GPIF_BRBYTES);
+	udelay(20);
+	mmwrite(hif_addr | MANTIS_GPIF_HIFRDWRN, MANTIS_GPIF_ADDR);
+
+	if (mantis_hif_sbuf_opdone_wait(ca) != 0) {
+		dprintk(MANTIS_ERROR, 1, "Adapter(%d) Slot(0): GPIF Smart Buffer operation failed", mantis->num);
+		mutex_unlock(&ca->ca_lock);
+		return -EREMOTEIO;
+	}
+	data = mmread(MANTIS_GPIF_DIN);
+	mutex_unlock(&ca->ca_lock);
+	dprintk(MANTIS_DEBUG, 1, "Mem Read: 0x%02x", data);
+	return (data >> 24) & 0xff;
+}
+
+int mantis_hif_write_mem(struct mantis_ca *ca, u32 addr, u8 data)
+{
+	struct mantis_slot *slot = ca->slot;
+	struct mantis_pci *mantis = ca->ca_priv;
+	u32 hif_addr = 0;
+
+	dprintk(MANTIS_DEBUG, 1, "Adapter(%d) Slot(0): Request HIF Mem Write", mantis->num);
+	mutex_lock(&ca->ca_lock);
+	hif_addr &= ~MANTIS_GPIF_HIFRDWRN;
+	hif_addr &= ~MANTIS_GPIF_PCMCIAREG;
+	hif_addr &= ~MANTIS_GPIF_PCMCIAIOM;
+	hif_addr |=  MANTIS_HIF_STATUS;
+	hif_addr |=  addr;
+
+	mmwrite(slot->slave_cfg, MANTIS_GPIF_CFGSLA); /* Slot0 alone for now */
+	mmwrite(hif_addr, MANTIS_GPIF_ADDR);
+	mmwrite(data, MANTIS_GPIF_DOUT);
+
+	if (mantis_hif_write_wait(ca) != 0) {
+		dprintk(MANTIS_ERROR, 1, "Adapter(%d) Slot(0): HIF Smart Buffer operation failed", mantis->num);
+		mutex_unlock(&ca->ca_lock);
+		return -EREMOTEIO;
+	}
+	dprintk(MANTIS_DEBUG, 1, "Mem Write: (0x%02x to 0x%02x)", data, addr);
+	mutex_unlock(&ca->ca_lock);
+
+	return 0;
+}
+
+int mantis_hif_read_iom(struct mantis_ca *ca, u32 addr)
+{
+	struct mantis_pci *mantis = ca->ca_priv;
+	u32 data, hif_addr = 0;
+
+	dprintk(MANTIS_DEBUG, 1, "Adapter(%d) Slot(0): Request HIF I/O Read", mantis->num);
+	mutex_lock(&ca->ca_lock);
+	hif_addr &= ~MANTIS_GPIF_PCMCIAREG;
+	hif_addr |=  MANTIS_GPIF_PCMCIAIOM;
+	hif_addr |=  MANTIS_HIF_STATUS;
+	hif_addr |=  addr;
+
+	mmwrite(hif_addr, MANTIS_GPIF_BRADDR);
+	mmwrite(1, MANTIS_GPIF_BRBYTES);
+	udelay(20);
+	mmwrite(hif_addr | MANTIS_GPIF_HIFRDWRN, MANTIS_GPIF_ADDR);
+
+	if (mantis_hif_sbuf_opdone_wait(ca) != 0) {
+		dprintk(MANTIS_ERROR, 1, "Adapter(%d) Slot(0): HIF Smart Buffer operation failed", mantis->num);
+		mutex_unlock(&ca->ca_lock);
+		return -EREMOTEIO;
+	}
+	data = mmread(MANTIS_GPIF_DIN);
+	dprintk(MANTIS_DEBUG, 1, "I/O Read: 0x%02x", data);
+	udelay(50);
+	mutex_unlock(&ca->ca_lock);
+
+	return (u8) data;
+}
+
+int mantis_hif_write_iom(struct mantis_ca *ca, u32 addr, u8 data)
+{
+	struct mantis_pci *mantis = ca->ca_priv;
+	u32 hif_addr = 0;
+
+	dprintk(MANTIS_DEBUG, 1, "Adapter(%d) Slot(0): Request HIF I/O Write", mantis->num);
+	mutex_lock(&ca->ca_lock);
+	hif_addr &= ~MANTIS_GPIF_PCMCIAREG;
+	hif_addr &= ~MANTIS_GPIF_HIFRDWRN;
+	hif_addr |=  MANTIS_GPIF_PCMCIAIOM;
+	hif_addr |=  MANTIS_HIF_STATUS;
+	hif_addr |=  addr;
+
+	mmwrite(hif_addr, MANTIS_GPIF_ADDR);
+	mmwrite(data, MANTIS_GPIF_DOUT);
+
+	if (mantis_hif_write_wait(ca) != 0) {
+		dprintk(MANTIS_ERROR, 1, "Adapter(%d) Slot(0): HIF Smart Buffer operation failed", mantis->num);
+		mutex_unlock(&ca->ca_lock);
+		return -EREMOTEIO;
+	}
+	dprintk(MANTIS_DEBUG, 1, "I/O Write: (0x%02x to 0x%02x)", data, addr);
+	mutex_unlock(&ca->ca_lock);
+	udelay(50);
+
+	return 0;
+}
+
+int mantis_hif_init(struct mantis_ca *ca)
+{
+	struct mantis_slot *slot = ca->slot;
+	struct mantis_pci *mantis = ca->ca_priv;
+	u32 irqcfg;
+
+	slot[0].slave_cfg = 0x70773028;
+	dprintk(MANTIS_ERROR, 1, "Adapter(%d) Initializing Mantis Host Interface", mantis->num);
+
+	mutex_lock(&ca->ca_lock);
+	irqcfg = mmread(MANTIS_GPIF_IRQCFG);
+	irqcfg = MANTIS_MASK_BRRDY	|
+		 MANTIS_MASK_WRACK	|
+		 MANTIS_MASK_EXTIRQ	|
+		 MANTIS_MASK_WSTO	|
+		 MANTIS_MASK_OTHERR	|
+		 MANTIS_MASK_OVFLW;
+
+	mmwrite(irqcfg, MANTIS_GPIF_IRQCFG);
+	mutex_unlock(&ca->ca_lock);
+
+	return 0;
+}
+
+void mantis_hif_exit(struct mantis_ca *ca)
+{
+	struct mantis_pci *mantis = ca->ca_priv;
+	u32 irqcfg;
+
+	dprintk(MANTIS_ERROR, 1, "Adapter(%d) Exiting Mantis Host Interface", mantis->num);
+	mutex_lock(&ca->ca_lock);
+	irqcfg = mmread(MANTIS_GPIF_IRQCFG);
+	irqcfg &= ~MANTIS_MASK_BRRDY;
+	mmwrite(irqcfg, MANTIS_GPIF_IRQCFG);
+	mutex_unlock(&ca->ca_lock);
+}
diff --git a/drivers/media/dvb/mantis/mantis_hif.h b/drivers/media/dvb/mantis/mantis_hif.h
new file mode 100644
index 000000000000..9094f9ed2362
--- /dev/null
+++ b/drivers/media/dvb/mantis/mantis_hif.h
@@ -0,0 +1,29 @@
+/*
+	Mantis PCI bridge driver
+
+	Copyright (C) Manu Abraham (abraham.manu@gmail.com)
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#ifndef __MANTIS_HIF_H
+#define __MANTIS_HIF_H
+
+#define MANTIS_HIF_MEMRD		1
+#define MANTIS_HIF_MEMWR		2
+#define MANTIS_HIF_IOMRD		3
+#define MANTIS_HIF_IOMWR		4
+
+#endif /* __MANTIS_HIF_H */
diff --git a/drivers/media/dvb/mantis/mantis_i2c.c b/drivers/media/dvb/mantis/mantis_i2c.c
new file mode 100644
index 000000000000..7870bcf9689a
--- /dev/null
+++ b/drivers/media/dvb/mantis/mantis_i2c.c
@@ -0,0 +1,267 @@
+/*
+	Mantis PCI bridge driver
+
+	Copyright (C) Manu Abraham (abraham.manu@gmail.com)
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#include <asm/io.h>
+#include <linux/ioport.h>
+#include <linux/pci.h>
+#include <linux/i2c.h>
+
+#include "dmxdev.h"
+#include "dvbdev.h"
+#include "dvb_demux.h"
+#include "dvb_frontend.h"
+#include "dvb_net.h"
+
+#include "mantis_common.h"
+#include "mantis_reg.h"
+#include "mantis_i2c.h"
+
+#define TRIALS			10000
+
+static int mantis_i2c_read(struct mantis_pci *mantis, const struct i2c_msg *msg)
+{
+	u32 rxd, i, stat, trials;
+
+	dprintk(MANTIS_INFO, 0, "        %s:  Address=[0x%02x] <R>[ ",
+		__func__, msg->addr);
+
+	for (i = 0; i < msg->len; i++) {
+		rxd = (msg->addr << 25) | (1 << 24)
+					| MANTIS_I2C_RATE_3
+					| MANTIS_I2C_STOP
+					| MANTIS_I2C_PGMODE;
+
+		if (i == (msg->len - 1))
+			rxd &= ~MANTIS_I2C_STOP;
+
+		mmwrite(MANTIS_INT_I2CDONE, MANTIS_INT_STAT);
+		mmwrite(rxd, MANTIS_I2CDATA_CTL);
+
+		/* wait for xfer completion */
+		for (trials = 0; trials < TRIALS; trials++) {
+			stat = mmread(MANTIS_INT_STAT);
+			if (stat & MANTIS_INT_I2CDONE)
+				break;
+		}
+
+		dprintk(MANTIS_TMG, 0, "I2CDONE: trials=%d\n", trials);
+
+		/* wait for xfer completion */
+		for (trials = 0; trials < TRIALS; trials++) {
+			stat = mmread(MANTIS_INT_STAT);
+			if (stat & MANTIS_INT_I2CRACK)
+				break;
+		}
+
+		dprintk(MANTIS_TMG, 0, "I2CRACK: trials=%d\n", trials);
+
+		rxd = mmread(MANTIS_I2CDATA_CTL);
+		msg->buf[i] = (u8)((rxd >> 8) & 0xFF);
+		dprintk(MANTIS_INFO, 0, "%02x ", msg->buf[i]);
+	}
+	dprintk(MANTIS_INFO, 0, "]\n");
+
+	return 0;
+}
+
+static int mantis_i2c_write(struct mantis_pci *mantis, const struct i2c_msg *msg)
+{
+	int i;
+	u32 txd = 0, stat, trials;
+
+	dprintk(MANTIS_INFO, 0, "        %s: Address=[0x%02x] <W>[ ",
+		__func__, msg->addr);
+
+	for (i = 0; i < msg->len; i++) {
+		dprintk(MANTIS_INFO, 0, "%02x ", msg->buf[i]);
+		txd = (msg->addr << 25) | (msg->buf[i] << 8)
+					| MANTIS_I2C_RATE_3
+					| MANTIS_I2C_STOP
+					| MANTIS_I2C_PGMODE;
+
+		if (i == (msg->len - 1))
+			txd &= ~MANTIS_I2C_STOP;
+
+		mmwrite(MANTIS_INT_I2CDONE, MANTIS_INT_STAT);
+		mmwrite(txd, MANTIS_I2CDATA_CTL);
+
+		/* wait for xfer completion */
+		for (trials = 0; trials < TRIALS; trials++) {
+			stat = mmread(MANTIS_INT_STAT);
+			if (stat & MANTIS_INT_I2CDONE)
+				break;
+		}
+
+		dprintk(MANTIS_TMG, 0, "I2CDONE: trials=%d\n", trials);
+
+		/* wait for xfer completion */
+		for (trials = 0; trials < TRIALS; trials++) {
+			stat = mmread(MANTIS_INT_STAT);
+			if (stat & MANTIS_INT_I2CRACK)
+				break;
+		}
+
+		dprintk(MANTIS_TMG, 0, "I2CRACK: trials=%d\n", trials);
+	}
+	dprintk(MANTIS_INFO, 0, "]\n");
+
+	return 0;
+}
+
+static int mantis_i2c_xfer(struct i2c_adapter *adapter, struct i2c_msg *msgs, int num)
+{
+	int ret = 0, i = 0, trials;
+	u32 stat, data, txd;
+	struct mantis_pci *mantis;
+	struct mantis_hwconfig *config;
+
+	mantis = i2c_get_adapdata(adapter);
+	BUG_ON(!mantis);
+	config = mantis->hwconfig;
+	BUG_ON(!config);
+
+	dprintk(MANTIS_DEBUG, 1, "Messages:%d", num);
+	mutex_lock(&mantis->i2c_lock);
+
+	while (i < num) {
+		/* Byte MODE */
+		if ((config->i2c_mode & MANTIS_BYTE_MODE) &&
+		    ((i + 1) < num)			&&
+		    (msgs[i].len < 2)			&&
+		    (msgs[i + 1].len < 2)		&&
+		    (msgs[i + 1].flags & I2C_M_RD)) {
+
+			dprintk(MANTIS_DEBUG, 0, "        Byte MODE:\n");
+
+			/* Read operation */
+			txd = msgs[i].addr << 25 | (0x1 << 24)
+						 | (msgs[i].buf[0] << 16)
+						 | MANTIS_I2C_RATE_3;
+
+			mmwrite(txd, MANTIS_I2CDATA_CTL);
+			/* wait for xfer completion */
+			for (trials = 0; trials < TRIALS; trials++) {
+				stat = mmread(MANTIS_INT_STAT);
+				if (stat & MANTIS_INT_I2CDONE)
+					break;
+			}
+
+			/* check for xfer completion */
+			if (stat & MANTIS_INT_I2CDONE) {
+				/* check xfer was acknowledged */
+				if (stat & MANTIS_INT_I2CRACK) {
+					data = mmread(MANTIS_I2CDATA_CTL);
+					msgs[i + 1].buf[0] = (data >> 8) & 0xff;
+					dprintk(MANTIS_DEBUG, 0, "        Byte <%d> RXD=0x%02x  [%02x]\n", 0x0, data, msgs[i + 1].buf[0]);
+				} else {
+					/* I/O error */
+					dprintk(MANTIS_ERROR, 1, "        I/O error, LINE:%d", __LINE__);
+					ret = -EIO;
+					break;
+				}
+			} else {
+				/* I/O error */
+				dprintk(MANTIS_ERROR, 1, "        I/O error, LINE:%d", __LINE__);
+				ret = -EIO;
+				break;
+			}
+			i += 2; /* Write/Read operation in one go */
+		}
+
+		if (i < num) {
+			if (msgs[i].flags & I2C_M_RD)
+				ret = mantis_i2c_read(mantis, &msgs[i]);
+			else
+				ret = mantis_i2c_write(mantis, &msgs[i]);
+
+			i++;
+			if (ret < 0)
+				goto bail_out;
+		}
+
+	}
+
+	mutex_unlock(&mantis->i2c_lock);
+
+	return num;
+
+bail_out:
+	mutex_unlock(&mantis->i2c_lock);
+	return ret;
+}
+
+static u32 mantis_i2c_func(struct i2c_adapter *adapter)
+{
+	return I2C_FUNC_SMBUS_EMUL;
+}
+
+static struct i2c_algorithm mantis_algo = {
+	.master_xfer		= mantis_i2c_xfer,
+	.functionality		= mantis_i2c_func,
+};
+
+int __devinit mantis_i2c_init(struct mantis_pci *mantis)
+{
+	u32 intstat, intmask;
+	struct i2c_adapter *i2c_adapter = &mantis->adapter;
+	struct pci_dev *pdev		= mantis->pdev;
+
+	init_waitqueue_head(&mantis->i2c_wq);
+	mutex_init(&mantis->i2c_lock);
+	strncpy(i2c_adapter->name, "Mantis I2C", sizeof(i2c_adapter->name));
+	i2c_set_adapdata(i2c_adapter, mantis);
+
+	i2c_adapter->owner	= THIS_MODULE;
+	i2c_adapter->class	= I2C_CLASS_TV_DIGITAL;
+	i2c_adapter->algo	= &mantis_algo;
+	i2c_adapter->algo_data	= NULL;
+	i2c_adapter->timeout	= 500;
+	i2c_adapter->retries	= 3;
+	i2c_adapter->dev.parent	= &pdev->dev;
+
+	mantis->i2c_rc		= i2c_add_adapter(i2c_adapter);
+	if (mantis->i2c_rc < 0)
+		return mantis->i2c_rc;
+
+	dprintk(MANTIS_DEBUG, 1, "Initializing I2C ..");
+
+	intstat = mmread(MANTIS_INT_STAT);
+	intmask = mmread(MANTIS_INT_MASK);
+	mmwrite(intstat, MANTIS_INT_STAT);
+	dprintk(MANTIS_DEBUG, 1, "Disabling I2C interrupt");
+	intmask = mmread(MANTIS_INT_MASK);
+	mmwrite((intmask & ~MANTIS_INT_I2CDONE), MANTIS_INT_MASK);
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(mantis_i2c_init);
+
+int mantis_i2c_exit(struct mantis_pci *mantis)
+{
+	u32 intmask;
+
+	dprintk(MANTIS_DEBUG, 1, "Disabling I2C interrupt");
+	intmask = mmread(MANTIS_INT_MASK);
+	mmwrite((intmask & ~MANTIS_INT_I2CDONE), MANTIS_INT_MASK);
+
+	dprintk(MANTIS_DEBUG, 1, "Removing I2C adapter");
+	return i2c_del_adapter(&mantis->adapter);
+}
+EXPORT_SYMBOL_GPL(mantis_i2c_exit);
diff --git a/drivers/media/dvb/mantis/mantis_i2c.h b/drivers/media/dvb/mantis/mantis_i2c.h
new file mode 100644
index 000000000000..1342df2faed8
--- /dev/null
+++ b/drivers/media/dvb/mantis/mantis_i2c.h
@@ -0,0 +1,30 @@
+/*
+	Mantis PCI bridge driver
+
+	Copyright (C) Manu Abraham (abraham.manu@gmail.com)
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#ifndef __MANTIS_I2C_H
+#define __MANTIS_I2C_H
+
+#define I2C_STOP		(1 <<  0)
+#define I2C_READ		(1 <<  1)
+
+extern int mantis_i2c_init(struct mantis_pci *mantis);
+extern int mantis_i2c_exit(struct mantis_pci *mantis);
+
+#endif /* __MANTIS_I2C_H */
diff --git a/drivers/media/dvb/mantis/mantis_input.c b/drivers/media/dvb/mantis/mantis_input.c
new file mode 100644
index 000000000000..6a9df779441f
--- /dev/null
+++ b/drivers/media/dvb/mantis/mantis_input.c
@@ -0,0 +1,148 @@
+/*
+	Mantis PCI bridge driver
+
+	Copyright (C) Manu Abraham (abraham.manu@gmail.com)
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#include <linux/input.h>
+#include <media/ir-common.h>
+#include <linux/pci.h>
+
+#include "dmxdev.h"
+#include "dvbdev.h"
+#include "dvb_demux.h"
+#include "dvb_frontend.h"
+#include "dvb_net.h"
+
+#include "mantis_common.h"
+#include "mantis_reg.h"
+#include "mantis_uart.h"
+
+static struct ir_scancode mantis_ir_table[] = {
+	{ 0x29, KEY_POWER	},
+	{ 0x28, KEY_FAVORITES	},
+	{ 0x30, KEY_TEXT	},
+	{ 0x17, KEY_INFO	}, /* Preview */
+	{ 0x23, KEY_EPG		},
+	{ 0x3b, KEY_F22		}, /* Record List */
+	{ 0x3c, KEY_1		},
+	{ 0x3e, KEY_2		},
+	{ 0x39, KEY_3		},
+	{ 0x36, KEY_4		},
+	{ 0x22, KEY_5		},
+	{ 0x20, KEY_6		},
+	{ 0x32, KEY_7		},
+	{ 0x26, KEY_8		},
+	{ 0x24, KEY_9		},
+	{ 0x2a, KEY_0		},
+
+	{ 0x33, KEY_CANCEL	},
+	{ 0x2c, KEY_BACK	},
+	{ 0x15, KEY_CLEAR	},
+	{ 0x3f, KEY_TAB		},
+	{ 0x10, KEY_ENTER	},
+	{ 0x14, KEY_UP		},
+	{ 0x0d, KEY_RIGHT	},
+	{ 0x0e, KEY_DOWN	},
+	{ 0x11, KEY_LEFT	},
+
+	{ 0x21, KEY_VOLUMEUP	},
+	{ 0x35, KEY_VOLUMEDOWN	},
+	{ 0x3d, KEY_CHANNELDOWN	},
+	{ 0x3a, KEY_CHANNELUP	},
+	{ 0x2e, KEY_RECORD	},
+	{ 0x2b, KEY_PLAY	},
+	{ 0x13, KEY_PAUSE	},
+	{ 0x25, KEY_STOP	},
+
+	{ 0x1f, KEY_REWIND	},
+	{ 0x2d, KEY_FASTFORWARD	},
+	{ 0x1e, KEY_PREVIOUS	}, /* Replay |< */
+	{ 0x1d, KEY_NEXT	}, /* Skip   >| */
+
+	{ 0x0b, KEY_CAMERA	}, /* Capture */
+	{ 0x0f, KEY_LANGUAGE	}, /* SAP */
+	{ 0x18, KEY_MODE	}, /* PIP */
+	{ 0x12, KEY_ZOOM	}, /* Full screen */
+	{ 0x1c, KEY_SUBTITLE	},
+	{ 0x2f, KEY_MUTE	},
+	{ 0x16, KEY_F20		}, /* L/R */
+	{ 0x38, KEY_F21		}, /* Hibernate */
+
+	{ 0x37, KEY_SWITCHVIDEOMODE }, /* A/V */
+	{ 0x31, KEY_AGAIN	}, /* Recall */
+	{ 0x1a, KEY_KPPLUS	}, /* Zoom+ */
+	{ 0x19, KEY_KPMINUS	}, /* Zoom- */
+	{ 0x27, KEY_RED		},
+	{ 0x0C, KEY_GREEN	},
+	{ 0x01, KEY_YELLOW	},
+	{ 0x00, KEY_BLUE	},
+};
+
+struct ir_scancode_table ir_mantis = {
+	.scan = mantis_ir_table,
+	.size = ARRAY_SIZE(mantis_ir_table),
+};
+EXPORT_SYMBOL_GPL(ir_mantis);
+
+int mantis_input_init(struct mantis_pci *mantis)
+{
+	struct input_dev *rc;
+	struct ir_input_state rc_state;
+	char name[80], dev[80];
+	int err;
+
+	rc = input_allocate_device();
+	if (!rc) {
+		dprintk(MANTIS_ERROR, 1, "Input device allocate failed");
+		return -ENOMEM;
+	}
+
+	sprintf(name, "Mantis %s IR receiver", mantis->hwconfig->model_name);
+	sprintf(dev, "pci-%s/ir0", pci_name(mantis->pdev));
+
+	rc->name = name;
+	rc->phys = dev;
+
+	ir_input_init(rc, &rc_state, IR_TYPE_OTHER);
+
+	rc->id.bustype	= BUS_PCI;
+	rc->id.vendor	= mantis->vendor_id;
+	rc->id.product	= mantis->device_id;
+	rc->id.version	= 1;
+	rc->dev		= mantis->pdev->dev;
+
+	err = ir_input_register(rc, &ir_mantis);
+	if (err) {
+		dprintk(MANTIS_ERROR, 1, "IR device registration failed, ret = %d", err);
+		input_free_device(rc);
+		return -ENODEV;
+	}
+
+	mantis->rc = rc;
+
+	return 0;
+}
+
+int mantis_exit(struct mantis_pci *mantis)
+{
+	struct input_dev *rc = mantis->rc;
+
+	ir_input_unregister(rc);
+
+	return 0;
+}
diff --git a/drivers/media/dvb/mantis/mantis_ioc.c b/drivers/media/dvb/mantis/mantis_ioc.c
new file mode 100644
index 000000000000..de148ded52d8
--- /dev/null
+++ b/drivers/media/dvb/mantis/mantis_ioc.c
@@ -0,0 +1,130 @@
+/*
+	Mantis PCI bridge driver
+
+	Copyright (C) Manu Abraham (abraham.manu@gmail.com)
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#include <linux/kernel.h>
+#include <linux/i2c.h>
+
+#include <linux/signal.h>
+#include <linux/sched.h>
+#include <linux/interrupt.h>
+
+#include "dmxdev.h"
+#include "dvbdev.h"
+#include "dvb_demux.h"
+#include "dvb_frontend.h"
+#include "dvb_net.h"
+
+#include "mantis_common.h"
+#include "mantis_reg.h"
+#include "mantis_ioc.h"
+
+static int read_eeprom_bytes(struct mantis_pci *mantis, u8 reg, u8 *data, u8 length)
+{
+	struct i2c_adapter *adapter = &mantis->adapter;
+	int err;
+	u8 buf = reg;
+
+	struct i2c_msg msg[] = {
+		{ .addr = 0x50, .flags = 0, .buf = &buf, .len = 1 },
+		{ .addr = 0x50, .flags = I2C_M_RD, .buf = data, .len = length },
+	};
+
+	err = i2c_transfer(adapter, msg, 2);
+	if (err < 0) {
+		dprintk(MANTIS_ERROR, 1, "ERROR: i2c read: < err=%i d0=0x%02x d1=0x%02x >",
+			err, data[0], data[1]);
+
+		return err;
+	}
+
+	return 0;
+}
+int mantis_get_mac(struct mantis_pci *mantis)
+{
+	int err;
+	u8 mac_addr[6] = {0};
+
+	err = read_eeprom_bytes(mantis, 0x08, mac_addr, 6);
+	if (err < 0) {
+		dprintk(MANTIS_ERROR, 1, "ERROR: Mantis EEPROM read error <%d>", err);
+
+		return err;
+	}
+
+	dprintk(MANTIS_ERROR, 0,
+		"    MAC Address=[%02x:%02x:%02x:%02x:%02x:%02x]\n",
+		mac_addr[0],
+		mac_addr[1],
+		mac_addr[2],
+		mac_addr[3],
+		mac_addr[4],
+		mac_addr[5]);
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(mantis_get_mac);
+
+/* Turn the given bit on or off. */
+void gpio_set_bits(struct mantis_pci *mantis, u32 bitpos, u8 value)
+{
+	u32 cur;
+
+	dprintk(MANTIS_DEBUG, 1, "Set Bit <%d> to <%d>", bitpos, value);
+	cur = mmread(MANTIS_GPIF_ADDR);
+	if (value)
+		mantis->gpio_status = cur | (1 << bitpos);
+	else
+		mantis->gpio_status = cur & (~(1 << bitpos));
+
+	dprintk(MANTIS_DEBUG, 1, "GPIO Value <%02x>", mantis->gpio_status);
+	mmwrite(mantis->gpio_status, MANTIS_GPIF_ADDR);
+	mmwrite(0x00, MANTIS_GPIF_DOUT);
+}
+EXPORT_SYMBOL_GPL(gpio_set_bits);
+
+int mantis_stream_control(struct mantis_pci *mantis, enum mantis_stream_control stream_ctl)
+{
+	u32 reg;
+
+	reg = mmread(MANTIS_CONTROL);
+	switch (stream_ctl) {
+	case STREAM_TO_HIF:
+		dprintk(MANTIS_DEBUG, 1, "Set stream to HIF");
+		reg &= 0xff - MANTIS_BYPASS;
+		mmwrite(reg, MANTIS_CONTROL);
+		reg |= MANTIS_BYPASS;
+		mmwrite(reg, MANTIS_CONTROL);
+		break;
+
+	case STREAM_TO_CAM:
+		dprintk(MANTIS_DEBUG, 1, "Set stream to CAM");
+		reg |= MANTIS_BYPASS;
+		mmwrite(reg, MANTIS_CONTROL);
+		reg &= 0xff - MANTIS_BYPASS;
+		mmwrite(reg, MANTIS_CONTROL);
+		break;
+	default:
+		dprintk(MANTIS_ERROR, 1, "Unknown MODE <%02x>", stream_ctl);
+		return -1;
+	}
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(mantis_stream_control);
diff --git a/drivers/media/dvb/mantis/mantis_ioc.h b/drivers/media/dvb/mantis/mantis_ioc.h
new file mode 100644
index 000000000000..188fe5a81614
--- /dev/null
+++ b/drivers/media/dvb/mantis/mantis_ioc.h
@@ -0,0 +1,51 @@
+/*
+	Mantis PCI bridge driver
+
+	Copyright (C) Manu Abraham (abraham.manu@gmail.com)
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#ifndef __MANTIS_IOC_H
+#define __MANTIS_IOC_H
+
+#define GPIF_A00		0x00
+#define GPIF_A01		0x01
+#define GPIF_A02		0x02
+#define GPIF_A03		0x03
+#define GPIF_A04		0x04
+#define GPIF_A05		0x05
+#define GPIF_A06		0x06
+#define GPIF_A07		0x07
+#define GPIF_A08		0x08
+#define GPIF_A09		0x09
+#define GPIF_A10		0x0a
+#define GPIF_A11		0x0b
+
+#define GPIF_A12		0x0c
+#define GPIF_A13		0x0d
+#define GPIF_A14		0x0e
+
+enum mantis_stream_control {
+	STREAM_TO_HIF = 0,
+	STREAM_TO_CAM
+};
+
+extern int mantis_get_mac(struct mantis_pci *mantis);
+extern void gpio_set_bits(struct mantis_pci *mantis, u32 bitpos, u8 value);
+
+extern int mantis_stream_control(struct mantis_pci *mantis, enum mantis_stream_control stream_ctl);
+
+#endif /* __MANTIS_IOC_H */
diff --git a/drivers/media/dvb/mantis/mantis_link.h b/drivers/media/dvb/mantis/mantis_link.h
new file mode 100644
index 000000000000..2a814774a001
--- /dev/null
+++ b/drivers/media/dvb/mantis/mantis_link.h
@@ -0,0 +1,83 @@
+/*
+	Mantis PCI bridge driver
+
+	Copyright (C) Manu Abraham (abraham.manu@gmail.com)
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#ifndef __MANTIS_LINK_H
+#define __MANTIS_LINK_H
+
+#include <linux/mutex.h>
+#include <linux/workqueue.h>
+#include "dvb_ca_en50221.h"
+
+enum mantis_sbuf_status {
+	MANTIS_SBUF_DATA_AVAIL		= 1,
+	MANTIS_SBUF_DATA_EMPTY		= 2,
+	MANTIS_SBUF_DATA_OVFLW		= 3
+};
+
+struct mantis_slot {
+	u32				timeout;
+	u32				slave_cfg;
+	u32				bar;
+};
+
+/* Physical layer */
+enum mantis_slot_state {
+	MODULE_INSERTED			= 3,
+	MODULE_XTRACTED			= 4
+};
+
+struct mantis_ca {
+	struct mantis_slot		slot[4];
+
+	struct work_struct		hif_evm_work;
+
+	u32				hif_event;
+	wait_queue_head_t		hif_opdone_wq;
+	wait_queue_head_t		hif_brrdyw_wq;
+	wait_queue_head_t		hif_data_wq;
+	wait_queue_head_t		hif_write_wq; /* HIF Write op */
+
+	enum mantis_sbuf_status		sbuf_status;
+
+	enum mantis_slot_state		slot_state;
+
+	void				*ca_priv;
+
+	struct dvb_ca_en50221		en50221;
+	struct mutex			ca_lock;
+};
+
+/* CA */
+extern void mantis_event_cam_plugin(struct mantis_ca *ca);
+extern void mantis_event_cam_unplug(struct mantis_ca *ca);
+extern int mantis_pcmcia_init(struct mantis_ca *ca);
+extern void mantis_pcmcia_exit(struct mantis_ca *ca);
+extern int mantis_evmgr_init(struct mantis_ca *ca);
+extern void mantis_evmgr_exit(struct mantis_ca *ca);
+
+/* HIF */
+extern int mantis_hif_init(struct mantis_ca *ca);
+extern void mantis_hif_exit(struct mantis_ca *ca);
+extern int mantis_hif_read_mem(struct mantis_ca *ca, u32 addr);
+extern int mantis_hif_write_mem(struct mantis_ca *ca, u32 addr, u8 data);
+extern int mantis_hif_read_iom(struct mantis_ca *ca, u32 addr);
+extern int mantis_hif_write_iom(struct mantis_ca *ca, u32 addr, u8 data);
+
+#endif /* __MANTIS_LINK_H */
diff --git a/drivers/media/dvb/mantis/mantis_pci.c b/drivers/media/dvb/mantis/mantis_pci.c
new file mode 100644
index 000000000000..6c7534af6b44
--- /dev/null
+++ b/drivers/media/dvb/mantis/mantis_pci.c
@@ -0,0 +1,177 @@
+/*
+	Mantis PCI bridge driver
+
+	Copyright (C) Manu Abraham (abraham.manu@gmail.com)
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/kernel.h>
+#include <asm/io.h>
+#include <asm/pgtable.h>
+#include <asm/page.h>
+#include <linux/kmod.h>
+#include <linux/vmalloc.h>
+#include <linux/init.h>
+#include <linux/device.h>
+#include <linux/pci.h>
+
+#include <asm/irq.h>
+#include <linux/signal.h>
+#include <linux/sched.h>
+#include <linux/interrupt.h>
+
+#include "dmxdev.h"
+#include "dvbdev.h"
+#include "dvb_demux.h"
+#include "dvb_frontend.h"
+#include "dvb_net.h"
+
+#include <asm/irq.h>
+#include <linux/signal.h>
+#include <linux/sched.h>
+#include <linux/interrupt.h>
+
+#include "mantis_common.h"
+#include "mantis_reg.h"
+#include "mantis_pci.h"
+
+#define DRIVER_NAME		"Mantis Core"
+
+int __devinit mantis_pci_init(struct mantis_pci *mantis)
+{
+	u8 revision, latency;
+	struct mantis_hwconfig *config	= mantis->hwconfig;
+	struct pci_dev *pdev		= mantis->pdev;
+	int err, ret = 0;
+
+	dprintk(MANTIS_ERROR, 0, "found a %s PCI %s device on (%02x:%02x.%x),\n",
+		config->model_name,
+		config->dev_type,
+		mantis->pdev->bus->number,
+		PCI_SLOT(mantis->pdev->devfn),
+		PCI_FUNC(mantis->pdev->devfn));
+
+	err = pci_enable_device(pdev);
+	if (err != 0) {
+		ret = -ENODEV;
+		dprintk(MANTIS_ERROR, 1, "ERROR: PCI enable failed <%i>", err);
+		goto fail0;
+	}
+
+	err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32));
+	if (err != 0) {
+		dprintk(MANTIS_ERROR, 1, "ERROR: Unable to obtain 32 bit DMA <%i>", err);
+		ret = -ENOMEM;
+		goto fail1;
+	}
+
+	pci_set_master(pdev);
+
+	if (!request_mem_region(pci_resource_start(pdev, 0),
+				pci_resource_len(pdev, 0),
+				DRIVER_NAME)) {
+
+		dprintk(MANTIS_ERROR, 1, "ERROR: BAR0 Request failed !");
+		ret = -ENODEV;
+		goto fail1;
+	}
+
+	mantis->mmio = ioremap(pci_resource_start(pdev, 0),
+			       pci_resource_len(pdev, 0));
+
+	if (!mantis->mmio) {
+		dprintk(MANTIS_ERROR, 1, "ERROR: BAR0 remap failed !");
+		ret = -ENODEV;
+		goto fail2;
+	}
+
+	pci_read_config_byte(pdev, PCI_LATENCY_TIMER, &latency);
+	pci_read_config_byte(pdev, PCI_CLASS_REVISION, &revision);
+	mantis->latency = latency;
+	mantis->revision = revision;
+
+	dprintk(MANTIS_ERROR, 0, "    Mantis Rev %d [%04x:%04x], ",
+		mantis->revision,
+		mantis->pdev->subsystem_vendor,
+		mantis->pdev->subsystem_device);
+
+	dprintk(MANTIS_ERROR, 0,
+		"irq: %d, latency: %d\n    memory: 0x%lx, mmio: 0x%p\n",
+		mantis->pdev->irq,
+		mantis->latency,
+		mantis->mantis_addr,
+		mantis->mmio);
+
+	err = request_irq(pdev->irq,
+			  config->irq_handler,
+			  IRQF_SHARED,
+			  DRIVER_NAME,
+			  mantis);
+
+	if (err != 0) {
+
+		dprintk(MANTIS_ERROR, 1, "ERROR: IRQ registration failed ! <%d>", err);
+		ret = -ENODEV;
+		goto fail3;
+	}
+
+	pci_set_drvdata(pdev, mantis);
+	return ret;
+
+	/* Error conditions */
+fail3:
+	dprintk(MANTIS_ERROR, 1, "ERROR: <%d> I/O unmap", ret);
+	if (mantis->mmio)
+		iounmap(mantis->mmio);
+
+fail2:
+	dprintk(MANTIS_ERROR, 1, "ERROR: <%d> releasing regions", ret);
+	release_mem_region(pci_resource_start(pdev, 0),
+			   pci_resource_len(pdev, 0));
+
+fail1:
+	dprintk(MANTIS_ERROR, 1, "ERROR: <%d> disabling device", ret);
+	pci_disable_device(pdev);
+
+fail0:
+	dprintk(MANTIS_ERROR, 1, "ERROR: <%d> exiting", ret);
+	pci_set_drvdata(pdev, NULL);
+	return ret;
+}
+EXPORT_SYMBOL_GPL(mantis_pci_init);
+
+void mantis_pci_exit(struct mantis_pci *mantis)
+{
+	struct pci_dev *pdev = mantis->pdev;
+
+	dprintk(MANTIS_NOTICE, 1, " mem: 0x%p", mantis->mmio);
+	free_irq(pdev->irq, mantis);
+	if (mantis->mmio) {
+		iounmap(mantis->mmio);
+		release_mem_region(pci_resource_start(pdev, 0),
+				   pci_resource_len(pdev, 0));
+	}
+
+	pci_disable_device(pdev);
+	pci_set_drvdata(pdev, NULL);
+}
+EXPORT_SYMBOL_GPL(mantis_pci_exit);
+
+MODULE_DESCRIPTION("Mantis PCI DTV bridge driver");
+MODULE_AUTHOR("Manu Abraham");
+MODULE_LICENSE("GPL");
diff --git a/drivers/media/dvb/mantis/mantis_pci.h b/drivers/media/dvb/mantis/mantis_pci.h
new file mode 100644
index 000000000000..65f004519086
--- /dev/null
+++ b/drivers/media/dvb/mantis/mantis_pci.h
@@ -0,0 +1,27 @@
+/*
+	Mantis PCI bridge driver
+
+	Copyright (C) Manu Abraham (abraham.manu@gmail.com)
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#ifndef __MANTIS_PCI_H
+#define __MANTIS_PCI_H
+
+extern int mantis_pci_init(struct mantis_pci *mantis);
+extern void mantis_pci_exit(struct mantis_pci *mantis);
+
+#endif /* __MANTIS_PCI_H */
diff --git a/drivers/media/dvb/mantis/mantis_pcmcia.c b/drivers/media/dvb/mantis/mantis_pcmcia.c
new file mode 100644
index 000000000000..5cb545b913f6
--- /dev/null
+++ b/drivers/media/dvb/mantis/mantis_pcmcia.c
@@ -0,0 +1,120 @@
+/*
+	Mantis PCI bridge driver
+
+	Copyright (C) Manu Abraham (abraham.manu@gmail.com)
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#include <linux/kernel.h>
+
+#include <linux/signal.h>
+#include <linux/sched.h>
+#include <linux/interrupt.h>
+
+#include "dmxdev.h"
+#include "dvbdev.h"
+#include "dvb_demux.h"
+#include "dvb_frontend.h"
+#include "dvb_net.h"
+
+#include "mantis_common.h"
+#include "mantis_link.h" /* temporary due to physical layer stuff */
+#include "mantis_reg.h"
+
+/*
+ * If Slot state is already PLUG_IN event and we are called
+ * again, definitely it is jitter alone
+ */
+void mantis_event_cam_plugin(struct mantis_ca *ca)
+{
+	struct mantis_pci *mantis = ca->ca_priv;
+
+	u32 gpif_irqcfg;
+
+	if (ca->slot_state == MODULE_XTRACTED) {
+		dprintk(MANTIS_DEBUG, 1, "Event: CAM Plugged IN: Adapter(%d) Slot(0)", mantis->num);
+		udelay(50);
+		mmwrite(0xda000000, MANTIS_CARD_RESET);
+		gpif_irqcfg  = mmread(MANTIS_GPIF_IRQCFG);
+		gpif_irqcfg |= MANTIS_MASK_PLUGOUT;
+		gpif_irqcfg &= ~MANTIS_MASK_PLUGIN;
+		mmwrite(gpif_irqcfg, MANTIS_GPIF_IRQCFG);
+		udelay(500);
+		ca->slot_state = MODULE_INSERTED;
+	}
+	udelay(100);
+}
+
+/*
+ * If Slot state is already UN_PLUG event and we are called
+ * again, definitely it is jitter alone
+ */
+void mantis_event_cam_unplug(struct mantis_ca *ca)
+{
+	struct mantis_pci *mantis = ca->ca_priv;
+
+	u32 gpif_irqcfg;
+
+	if (ca->slot_state == MODULE_INSERTED) {
+		dprintk(MANTIS_DEBUG, 1, "Event: CAM Unplugged: Adapter(%d) Slot(0)", mantis->num);
+		udelay(50);
+		mmwrite(0x00da0000, MANTIS_CARD_RESET);
+		gpif_irqcfg  = mmread(MANTIS_GPIF_IRQCFG);
+		gpif_irqcfg |= MANTIS_MASK_PLUGIN;
+		gpif_irqcfg &= ~MANTIS_MASK_PLUGOUT;
+		mmwrite(gpif_irqcfg, MANTIS_GPIF_IRQCFG);
+		udelay(500);
+		ca->slot_state = MODULE_XTRACTED;
+	}
+	udelay(100);
+}
+
+int mantis_pcmcia_init(struct mantis_ca *ca)
+{
+	struct mantis_pci *mantis = ca->ca_priv;
+
+	u32 gpif_stat, card_stat;
+
+	mmwrite(mmread(MANTIS_INT_MASK) | MANTIS_INT_IRQ0, MANTIS_INT_MASK);
+	gpif_stat = mmread(MANTIS_GPIF_STATUS);
+	card_stat = mmread(MANTIS_GPIF_IRQCFG);
+
+	if (gpif_stat & MANTIS_GPIF_DETSTAT) {
+		dprintk(MANTIS_DEBUG, 1, "CAM found on Adapter(%d) Slot(0)", mantis->num);
+		mmwrite(card_stat | MANTIS_MASK_PLUGOUT, MANTIS_GPIF_IRQCFG);
+		ca->slot_state = MODULE_INSERTED;
+		dvb_ca_en50221_camchange_irq(&ca->en50221,
+					     0,
+					     DVB_CA_EN50221_CAMCHANGE_INSERTED);
+	} else {
+		dprintk(MANTIS_DEBUG, 1, "Empty Slot on Adapter(%d) Slot(0)", mantis->num);
+		mmwrite(card_stat | MANTIS_MASK_PLUGIN, MANTIS_GPIF_IRQCFG);
+		ca->slot_state = MODULE_XTRACTED;
+		dvb_ca_en50221_camchange_irq(&ca->en50221,
+					     0,
+					     DVB_CA_EN50221_CAMCHANGE_REMOVED);
+	}
+
+	return 0;
+}
+
+void mantis_pcmcia_exit(struct mantis_ca *ca)
+{
+	struct mantis_pci *mantis = ca->ca_priv;
+
+	mmwrite(mmread(MANTIS_GPIF_STATUS) & (~MANTIS_CARD_PLUGOUT | ~MANTIS_CARD_PLUGIN), MANTIS_GPIF_STATUS);
+	mmwrite(mmread(MANTIS_INT_MASK) & ~MANTIS_INT_IRQ0, MANTIS_INT_MASK);
+}
diff --git a/drivers/media/dvb/mantis/mantis_reg.h b/drivers/media/dvb/mantis/mantis_reg.h
new file mode 100644
index 000000000000..7761f9dc7fe0
--- /dev/null
+++ b/drivers/media/dvb/mantis/mantis_reg.h
@@ -0,0 +1,197 @@
+/*
+	Mantis PCI bridge driver
+
+	Copyright (C) Manu Abraham (abraham.manu@gmail.com)
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#ifndef __MANTIS_REG_H
+#define __MANTIS_REG_H
+
+/* Interrupts */
+#define MANTIS_INT_STAT			0x00
+#define MANTIS_INT_MASK			0x04
+
+#define MANTIS_INT_RISCSTAT		(0x0f << 28)
+#define MANTIS_INT_RISCEN		(0x01 << 27)
+#define MANTIS_INT_I2CRACK		(0x01 << 26)
+
+/* #define MANTIS_INT_GPIF			(0xff << 12) */
+
+#define MANTIS_INT_PCMCIA7		(0x01 << 19)
+#define MANTIS_INT_PCMCIA6		(0x01 << 18)
+#define MANTIS_INT_PCMCIA5		(0x01 << 17)
+#define MANTIS_INT_PCMCIA4		(0x01 << 16)
+#define MANTIS_INT_PCMCIA3		(0x01 << 15)
+#define MANTIS_INT_PCMCIA2		(0x01 << 14)
+#define MANTIS_INT_PCMCIA1		(0x01 << 13)
+#define MANTIS_INT_PCMCIA0		(0x01 << 12)
+#define MANTIS_INT_IRQ1			(0x01 << 11)
+#define MANTIS_INT_IRQ0			(0x01 << 10)
+#define MANTIS_INT_OCERR		(0x01 <<  8)
+#define MANTIS_INT_PABORT		(0x01 <<  7)
+#define MANTIS_INT_RIPERR		(0x01 <<  6)
+#define MANTIS_INT_PPERR		(0x01 <<  5)
+#define MANTIS_INT_FTRGT		(0x01 <<  3)
+#define MANTIS_INT_RISCI		(0x01 <<  1)
+#define MANTIS_INT_I2CDONE		(0x01 <<  0)
+
+/* DMA */
+#define MANTIS_DMA_CTL			0x08
+#define MANTIS_GPIF_RD			(0xff << 24)
+#define MANTIS_GPIF_WR			(0xff << 16)
+#define MANTIS_CPU_DO			(0x01 << 10)
+#define MANTIS_DRV_DO			(0x01 <<  9)
+#define	MANTIS_I2C_RD			(0x01 <<  7)
+#define MANTIS_I2C_WR			(0x01 <<  6)
+#define MANTIS_DCAP_MODE		(0x01 <<  5)
+#define MANTIS_FIFO_TP_4		(0x00 <<  3)
+#define MANTIS_FIFO_TP_8		(0x01 <<  3)
+#define MANTIS_FIFO_TP_16		(0x02 <<  3)
+#define MANTIS_FIFO_EN			(0x01 <<  2)
+#define MANTIS_DCAP_EN			(0x01 <<  1)
+#define MANTIS_RISC_EN			(0x01 <<  0)
+
+/* DEBUG */
+#define MANTIS_DEBUGREG			0x0c
+#define MANTIS_DATINV			(0x0e <<  7)
+#define MANTIS_TOP_DEBUGSEL		(0x07 <<  4)
+#define MANTIS_PCMCIA_DEBUGSEL		(0x0f <<  0)
+
+#define MANTIS_RISC_START		0x10
+#define MANTIS_RISC_PC			0x14
+
+/* I2C */
+#define MANTIS_I2CDATA_CTL		0x18
+#define MANTIS_I2C_RATE_1		(0x00 <<  6)
+#define MANTIS_I2C_RATE_2		(0x01 <<  6)
+#define MANTIS_I2C_RATE_3		(0x02 <<  6)
+#define MANTIS_I2C_RATE_4		(0x03 <<  6)
+#define MANTIS_I2C_STOP			(0x01 <<  5)
+#define MANTIS_I2C_PGMODE		(0x01 <<  3)
+
+/* DATA */
+#define MANTIS_CMD_DATA_R1		0x20
+#define MANTIS_CMD_DATA_3		(0xff << 24)
+#define MANTIS_CMD_DATA_2		(0xff << 16)
+#define MANTIS_CMD_DATA_1		(0xff <<  8)
+#define MANTIS_CMD_DATA_0		(0xff <<  0)
+
+#define MANTIS_CMD_DATA_R2		0x24
+#define MANTIS_CMD_DATA_7		(0xff << 24)
+#define MANTIS_CMD_DATA_6		(0xff << 16)
+#define MANTIS_CMD_DATA_5		(0xff <<  8)
+#define MANTIS_CMD_DATA_4		(0xff <<  0)
+
+#define MANTIS_CONTROL			0x28
+#define MANTIS_DET			(0x01 <<  7)
+#define MANTIS_DAT_CF_EN		(0x01 <<  6)
+#define MANTIS_ACS			(0x03 <<  4)
+#define MANTIS_VCCEN			(0x01 <<  3)
+#define MANTIS_BYPASS			(0x01 <<  2)
+#define MANTIS_MRST			(0x01 <<  1)
+#define MANTIS_CRST_INT			(0x01 <<  0)
+
+#define MANTIS_GPIF_CFGSLA		0x84
+#define MANTIS_GPIF_WAITSMPL		(0x07 << 28)
+#define MANTIS_GPIF_BYTEADDRSUB		(0x01 << 25)
+#define MANTIS_GPIF_WAITPOL		(0x01 << 24)
+#define MANTIS_GPIF_NCDELAY		(0x07 << 20)
+#define MANTIS_GPIF_RW2CSDELAY		(0x07 << 16)
+#define MANTIS_GPIF_SLFTIMEDMODE	(0x01 << 15)
+#define MANTIS_GPIF_SLFTIMEDDELY	(0x7f <<  8)
+#define MANTIS_GPIF_DEVTYPE		(0x07 <<  4)
+#define MANTIS_GPIF_BIGENDIAN		(0x01 <<  3)
+#define MANTIS_GPIF_FETCHCMD		(0x03 <<  1)
+#define MANTIS_GPIF_HWORDDEV		(0x01 <<  0)
+
+#define MANTIS_GPIF_WSTOPER		0x90
+#define MANTIS_GPIF_WSTOPERWREN3	(0x01 << 31)
+#define MANTIS_GPIF_PARBOOTN		(0x01 << 29)
+#define MANTIS_GPIF_WSTOPERSLID3	(0x1f << 24)
+#define MANTIS_GPIF_WSTOPERWREN2	(0x01 << 23)
+#define MANTIS_GPIF_WSTOPERSLID2	(0x1f << 16)
+#define MANTIS_GPIF_WSTOPERWREN1	(0x01 << 15)
+#define MANTIS_GPIF_WSTOPERSLID1	(0x1f <<  8)
+#define MANTIS_GPIF_WSTOPERWREN0	(0x01 <<  7)
+#define MANTIS_GPIF_WSTOPERSLID0	(0x1f <<  0)
+
+#define MANTIS_GPIF_CS2RW		0x94
+#define MANTIS_GPIF_CS2RWWREN3		(0x01 << 31)
+#define MANTIS_GPIF_CS2RWDELY3		(0x3f << 24)
+#define MANTIS_GPIF_CS2RWWREN2		(0x01 << 23)
+#define MANTIS_GPIF_CS2RWDELY2		(0x3f << 16)
+#define MANTIS_GPIF_CS2RWWREN1		(0x01 << 15)
+#define MANTIS_GPIF_CS2RWDELY1		(0x3f <<  8)
+#define MANTIS_GPIF_CS2RWWREN0		(0x01 <<  7)
+#define MANTIS_GPIF_CS2RWDELY0		(0x3f <<  0)
+
+#define MANTIS_GPIF_IRQCFG		0x98
+#define MANTIS_GPIF_IRQPOL		(0x01 <<  8)
+#define MANTIS_MASK_WRACK		(0x01 <<  7)
+#define MANTIS_MASK_BRRDY		(0x01 <<  6)
+#define MANTIS_MASK_OVFLW		(0x01 <<  5)
+#define MANTIS_MASK_OTHERR		(0x01 <<  4)
+#define MANTIS_MASK_WSTO		(0x01 <<  3)
+#define MANTIS_MASK_EXTIRQ		(0x01 <<  2)
+#define MANTIS_MASK_PLUGIN		(0x01 <<  1)
+#define MANTIS_MASK_PLUGOUT		(0x01 <<  0)
+
+#define MANTIS_GPIF_STATUS		0x9c
+#define MANTIS_SBUF_KILLOP		(0x01 << 15)
+#define MANTIS_SBUF_OPDONE		(0x01 << 14)
+#define MANTIS_SBUF_EMPTY		(0x01 << 13)
+#define MANTIS_GPIF_DETSTAT		(0x01 <<  9)
+#define MANTIS_GPIF_INTSTAT		(0x01 <<  8)
+#define MANTIS_GPIF_WRACK		(0x01 <<  7)
+#define MANTIS_GPIF_BRRDY		(0x01 <<  6)
+#define MANTIS_SBUF_OVFLW		(0x01 <<  5)
+#define MANTIS_GPIF_OTHERR		(0x01 <<  4)
+#define MANTIS_SBUF_WSTO		(0x01 <<  3)
+#define MANTIS_GPIF_EXTIRQ		(0x01 <<  2)
+#define MANTIS_CARD_PLUGIN		(0x01 <<  1)
+#define MANTIS_CARD_PLUGOUT		(0x01 <<  0)
+
+#define MANTIS_GPIF_BRADDR		0xa0
+#define MANTIS_GPIF_PCMCIAREG		(0x01 		<< 27)
+#define MANTIS_GPIF_PCMCIAIOM		(0x01 		<< 26)
+#define MANTIS_GPIF_BR_ADDR		(0xfffffff	<<  0)
+
+#define MANTIS_GPIF_BRBYTES		0xa4
+#define MANTIS_GPIF_BRCNT		(0xfff 		<<  0)
+
+#define MANTIS_PCMCIA_RESET		0xa8
+#define MANTIS_PCMCIA_RSTVAL		(0xff << 0)
+
+#define MANTIS_CARD_RESET		0xac
+
+#define MANTIS_GPIF_ADDR		0xb0
+#define MANTIS_GPIF_HIFRDWRN		(0x01		<< 31)
+#define MANTIS_GPIF_PCMCIAREG		(0x01		<< 27)
+#define MANTIS_GPIF_PCMCIAIOM		(0x01		<< 26)
+#define MANTIS_GPIF_HIFADDR		(0xfffffff	<<  0)
+
+#define MANTIS_GPIF_DOUT		0xb4
+#define MANTIS_GPIF_HIFDOUT		(0xfffffff	<<  0)
+
+#define MANTIS_GPIF_DIN			0xb8
+#define MANTIS_GPIF_HIFDIN		(0xfffffff	<<  0)
+
+#define MANTIS_GPIF_SPARE		0xbc
+#define MANTIS_GPIF_LOGICRD		(0xffff		<< 16)
+#define MANTIS_GPIF_LOGICRW		(0xffff		<<  0)
+
+#endif /* __MANTIS_REG_H */
diff --git a/drivers/media/dvb/mantis/mantis_uart.c b/drivers/media/dvb/mantis/mantis_uart.c
new file mode 100644
index 000000000000..7d2f2398fa8b
--- /dev/null
+++ b/drivers/media/dvb/mantis/mantis_uart.c
@@ -0,0 +1,186 @@
+/*
+	Mantis PCI bridge driver
+
+	Copyright (C) Manu Abraham (abraham.manu@gmail.com)
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#include <linux/kernel.h>
+#include <linux/spinlock.h>
+
+#include <linux/signal.h>
+#include <linux/sched.h>
+#include <linux/interrupt.h>
+
+#include "dmxdev.h"
+#include "dvbdev.h"
+#include "dvb_demux.h"
+#include "dvb_frontend.h"
+#include "dvb_net.h"
+
+#include "mantis_common.h"
+#include "mantis_reg.h"
+#include "mantis_uart.h"
+
+struct mantis_uart_params {
+	enum mantis_baud	baud_rate;
+	enum mantis_parity	parity;
+};
+
+static struct {
+	char string[7];
+} rates[5] = {
+	{ "9600" },
+	{ "19200" },
+	{ "38400" },
+	{ "57600" },
+	{ "115200" }
+};
+
+static struct {
+	char string[5];
+} parity[3] = {
+	{ "NONE" },
+	{ "ODD" },
+	{ "EVEN" }
+};
+
+#define UART_MAX_BUF			16
+
+int mantis_uart_read(struct mantis_pci *mantis, u8 *data)
+{
+	struct mantis_hwconfig *config = mantis->hwconfig;
+	u32 stat = 0, i;
+
+	/* get data */
+	for (i = 0; i < (config->bytes + 1); i++) {
+
+		stat = mmread(MANTIS_UART_STAT);
+
+		if (stat & MANTIS_UART_RXFIFO_FULL) {
+			dprintk(MANTIS_ERROR, 1, "RX Fifo FULL");
+		}
+		data[i] = mmread(MANTIS_UART_RXD) & 0x3f;
+
+		dprintk(MANTIS_DEBUG, 1, "Reading ... <%02x>", data[i] & 0x3f);
+
+		if (data[i] & (1 << 7)) {
+			dprintk(MANTIS_ERROR, 1, "UART framing error");
+			return -EINVAL;
+		}
+		if (data[i] & (1 << 6)) {
+			dprintk(MANTIS_ERROR, 1, "UART parity error");
+			return -EINVAL;
+		}
+	}
+
+	return 0;
+}
+
+static void mantis_uart_work(struct work_struct *work)
+{
+	struct mantis_pci *mantis = container_of(work, struct mantis_pci, uart_work);
+	struct mantis_hwconfig *config = mantis->hwconfig;
+	u8 buf[16];
+	int i;
+
+	mantis_uart_read(mantis, buf);
+
+	for (i = 0; i < (config->bytes + 1); i++)
+		dprintk(MANTIS_INFO, 1, "UART BUF:%d <%02x> ", i, buf[i]);
+
+	dprintk(MANTIS_DEBUG, 0, "\n");
+}
+
+static int mantis_uart_setup(struct mantis_pci *mantis,
+			     struct mantis_uart_params *params)
+{
+	u32 reg;
+
+	mmwrite((mmread(MANTIS_UART_CTL) | (params->parity & 0x3)), MANTIS_UART_CTL);
+
+	reg = mmread(MANTIS_UART_BAUD);
+
+	switch (params->baud_rate) {
+	case MANTIS_BAUD_9600:
+		reg |= 0xd8;
+		break;
+	case MANTIS_BAUD_19200:
+		reg |= 0x6c;
+		break;
+	case MANTIS_BAUD_38400:
+		reg |= 0x36;
+		break;
+	case MANTIS_BAUD_57600:
+		reg |= 0x23;
+		break;
+	case MANTIS_BAUD_115200:
+		reg |= 0x11;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	mmwrite(reg, MANTIS_UART_BAUD);
+
+	return 0;
+}
+
+int mantis_uart_init(struct mantis_pci *mantis)
+{
+	struct mantis_hwconfig *config = mantis->hwconfig;
+	struct mantis_uart_params params;
+
+	/* default parity: */
+	params.baud_rate = config->baud_rate;
+	params.parity = config->parity;
+	dprintk(MANTIS_INFO, 1, "Initializing UART @ %sbps parity:%s",
+		rates[params.baud_rate].string,
+		parity[params.parity].string);
+
+	init_waitqueue_head(&mantis->uart_wq);
+	spin_lock_init(&mantis->uart_lock);
+
+	INIT_WORK(&mantis->uart_work, mantis_uart_work);
+
+	/* disable interrupt */
+	mmwrite(mmread(MANTIS_UART_CTL) & 0xffef, MANTIS_UART_CTL);
+
+	mantis_uart_setup(mantis, &params);
+
+	/* default 1 byte */
+	mmwrite((mmread(MANTIS_UART_BAUD) | (config->bytes << 8)), MANTIS_UART_BAUD);
+
+	/* flush buffer */
+	mmwrite((mmread(MANTIS_UART_CTL) | MANTIS_UART_RXFLUSH), MANTIS_UART_CTL);
+
+	/* enable interrupt */
+	mmwrite(mmread(MANTIS_INT_MASK) | 0x800, MANTIS_INT_MASK);
+	mmwrite(mmread(MANTIS_UART_CTL) | MANTIS_UART_RXINT, MANTIS_UART_CTL);
+
+	schedule_work(&mantis->uart_work);
+	dprintk(MANTIS_DEBUG, 1, "UART succesfully initialized");
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(mantis_uart_init);
+
+void mantis_uart_exit(struct mantis_pci *mantis)
+{
+	/* disable interrupt */
+	mmwrite(mmread(MANTIS_UART_CTL) & 0xffef, MANTIS_UART_CTL);
+}
+EXPORT_SYMBOL_GPL(mantis_uart_exit);
diff --git a/drivers/media/dvb/mantis/mantis_uart.h b/drivers/media/dvb/mantis/mantis_uart.h
new file mode 100644
index 000000000000..ffb62a0a5a13
--- /dev/null
+++ b/drivers/media/dvb/mantis/mantis_uart.h
@@ -0,0 +1,58 @@
+/*
+	Mantis PCI bridge driver
+
+	Copyright (C) Manu Abraham (abraham.manu@gmail.com)
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#ifndef __MANTIS_UART_H
+#define __MANTIS_UART_H
+
+#define MANTIS_UART_CTL			0xe0
+#define MANTIS_UART_RXINT		(1 << 4)
+#define MANTIS_UART_RXFLUSH		(1 << 2)
+
+#define MANTIS_UART_RXD			0xe8
+#define MANTIS_UART_BAUD		0xec
+
+#define MANTIS_UART_STAT		0xf0
+#define MANTIS_UART_RXFIFO_DATA		(1 << 7)
+#define MANTIS_UART_RXFIFO_EMPTY	(1 << 6)
+#define MANTIS_UART_RXFIFO_FULL		(1 << 3)
+#define MANTIS_UART_FRAME_ERR		(1 << 2)
+#define MANTIS_UART_PARITY_ERR		(1 << 1)
+#define MANTIS_UART_RXTHRESH_INT	(1 << 0)
+
+enum mantis_baud {
+	MANTIS_BAUD_9600	= 0,
+	MANTIS_BAUD_19200,
+	MANTIS_BAUD_38400,
+	MANTIS_BAUD_57600,
+	MANTIS_BAUD_115200
+};
+
+enum mantis_parity {
+	MANTIS_PARITY_NONE	= 0,
+	MANTIS_PARITY_EVEN,
+	MANTIS_PARITY_ODD,
+};
+
+struct mantis_pci;
+
+extern int mantis_uart_init(struct mantis_pci *mantis);
+extern void mantis_uart_exit(struct mantis_pci *mantis);
+
+#endif /* __MANTIS_UART_H */
diff --git a/drivers/media/dvb/mantis/mantis_vp1033.c b/drivers/media/dvb/mantis/mantis_vp1033.c
new file mode 100644
index 000000000000..4a723bda0031
--- /dev/null
+++ b/drivers/media/dvb/mantis/mantis_vp1033.c
@@ -0,0 +1,212 @@
+/*
+	Mantis VP-1033 driver
+
+	Copyright (C) Manu Abraham (abraham.manu@gmail.com)
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#include <linux/signal.h>
+#include <linux/sched.h>
+#include <linux/interrupt.h>
+
+#include "dmxdev.h"
+#include "dvbdev.h"
+#include "dvb_demux.h"
+#include "dvb_frontend.h"
+#include "dvb_net.h"
+
+#include "stv0299.h"
+#include "mantis_common.h"
+#include "mantis_ioc.h"
+#include "mantis_dvb.h"
+#include "mantis_vp1033.h"
+#include "mantis_reg.h"
+
+u8 lgtdqcs001f_inittab[] = {
+	0x01, 0x15,
+	0x02, 0x00,
+	0x03, 0x00,
+	0x04, 0x2a,
+	0x05, 0x85,
+	0x06, 0x02,
+	0x07, 0x00,
+	0x08, 0x00,
+	0x0c, 0x01,
+	0x0d, 0x81,
+	0x0e, 0x44,
+	0x0f, 0x94,
+	0x10, 0x3c,
+	0x11, 0x84,
+	0x12, 0xb9,
+	0x13, 0xb5,
+	0x14, 0x4f,
+	0x15, 0xc9,
+	0x16, 0x80,
+	0x17, 0x36,
+	0x18, 0xfb,
+	0x19, 0xcf,
+	0x1a, 0xbc,
+	0x1c, 0x2b,
+	0x1d, 0x27,
+	0x1e, 0x00,
+	0x1f, 0x0b,
+	0x20, 0xa1,
+	0x21, 0x60,
+	0x22, 0x00,
+	0x23, 0x00,
+	0x28, 0x00,
+	0x29, 0x28,
+	0x2a, 0x14,
+	0x2b, 0x0f,
+	0x2c, 0x09,
+	0x2d, 0x05,
+	0x31, 0x1f,
+	0x32, 0x19,
+	0x33, 0xfc,
+	0x34, 0x13,
+	0xff, 0xff,
+};
+
+#define MANTIS_MODEL_NAME	"VP-1033"
+#define MANTIS_DEV_TYPE		"DVB-S/DSS"
+
+int lgtdqcs001f_tuner_set(struct dvb_frontend *fe,
+			  struct dvb_frontend_parameters *params)
+{
+	struct mantis_pci *mantis	= fe->dvb->priv;
+	struct i2c_adapter *adapter	= &mantis->adapter;
+
+	u8 buf[4];
+	u32 div;
+
+
+	struct i2c_msg msg = {.addr = 0x61, .flags = 0, .buf = buf, .len = sizeof(buf)};
+
+	div = params->frequency / 250;
+
+	buf[0] = (div >> 8) & 0x7f;
+	buf[1] =  div & 0xff;
+	buf[2] =  0x83;
+	buf[3] =  0xc0;
+
+	if (params->frequency < 1531000)
+		buf[3] |= 0x04;
+	else
+		buf[3] &= ~0x04;
+	if (i2c_transfer(adapter, &msg, 1) < 0) {
+		dprintk(MANTIS_ERROR, 1, "Write: I2C Transfer failed");
+		return -EIO;
+	}
+	msleep_interruptible(100);
+
+	return 0;
+}
+
+int lgtdqcs001f_set_symbol_rate(struct dvb_frontend *fe,
+				u32 srate, u32 ratio)
+{
+	u8 aclk = 0;
+	u8 bclk = 0;
+
+	if (srate < 1500000) {
+		aclk = 0xb7;
+		bclk = 0x47;
+	} else if (srate < 3000000) {
+		aclk = 0xb7;
+		bclk = 0x4b;
+	} else if (srate < 7000000) {
+		aclk = 0xb7;
+		bclk = 0x4f;
+	} else if (srate < 14000000) {
+		aclk = 0xb7;
+		bclk = 0x53;
+	} else if (srate < 30000000) {
+		aclk = 0xb6;
+		bclk = 0x53;
+	} else if (srate < 45000000) {
+		aclk = 0xb4;
+		bclk = 0x51;
+	}
+	stv0299_writereg(fe, 0x13, aclk);
+	stv0299_writereg(fe, 0x14, bclk);
+
+	stv0299_writereg(fe, 0x1f, (ratio >> 16) & 0xff);
+	stv0299_writereg(fe, 0x20, (ratio >>  8) & 0xff);
+	stv0299_writereg(fe, 0x21,  ratio & 0xf0);
+
+	return 0;
+}
+
+struct stv0299_config lgtdqcs001f_config = {
+	.demod_address		= 0x68,
+	.inittab		= lgtdqcs001f_inittab,
+	.mclk			= 88000000UL,
+	.invert			= 0,
+	.skip_reinit		= 0,
+	.volt13_op0_op1		= STV0299_VOLT13_OP0,
+	.min_delay_ms		= 100,
+	.set_symbol_rate	= lgtdqcs001f_set_symbol_rate,
+};
+
+static int vp1033_frontend_init(struct mantis_pci *mantis, struct dvb_frontend *fe)
+{
+	struct i2c_adapter *adapter	= &mantis->adapter;
+
+	int err = 0;
+
+	err = mantis_frontend_power(mantis, POWER_ON);
+	if (err == 0) {
+		mantis_frontend_soft_reset(mantis);
+		msleep(250);
+
+		dprintk(MANTIS_ERROR, 1, "Probing for STV0299 (DVB-S)");
+		fe = stv0299_attach(&lgtdqcs001f_config, adapter);
+
+		if (fe) {
+			fe->ops.tuner_ops.set_params = lgtdqcs001f_tuner_set;
+			dprintk(MANTIS_ERROR, 1, "found STV0299 DVB-S frontend @ 0x%02x",
+				lgtdqcs001f_config.demod_address);
+
+			dprintk(MANTIS_ERROR, 1, "Mantis DVB-S STV0299 frontend attach success");
+		} else {
+			return -1;
+		}
+	} else {
+		dprintk(MANTIS_ERROR, 1, "Frontend on <%s> POWER ON failed! <%d>",
+			adapter->name,
+			err);
+
+		return -EIO;
+	}
+	mantis->fe = fe;
+	dprintk(MANTIS_ERROR, 1, "Done!");
+
+	return 0;
+}
+
+struct mantis_hwconfig vp1033_config = {
+	.model_name		= MANTIS_MODEL_NAME,
+	.dev_type		= MANTIS_DEV_TYPE,
+	.ts_size		= MANTIS_TS_204,
+
+	.baud_rate		= MANTIS_BAUD_9600,
+	.parity			= MANTIS_PARITY_NONE,
+	.bytes			= 0,
+
+	.frontend_init		= vp1033_frontend_init,
+	.power			= GPIF_A12,
+	.reset			= GPIF_A13,
+};
diff --git a/drivers/media/dvb/mantis/mantis_vp1033.h b/drivers/media/dvb/mantis/mantis_vp1033.h
new file mode 100644
index 000000000000..7daaa1bf127d
--- /dev/null
+++ b/drivers/media/dvb/mantis/mantis_vp1033.h
@@ -0,0 +1,30 @@
+/*
+	Mantis VP-1033 driver
+
+	Copyright (C) Manu Abraham (abraham.manu@gmail.com)
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#ifndef __MANTIS_VP1033_H
+#define __MANTIS_VP1033_H
+
+#include "mantis_common.h"
+
+#define MANTIS_VP_1033_DVB_S	0x0016
+
+extern struct mantis_hwconfig vp1033_config;
+
+#endif /* __MANTIS_VP1033_H */
diff --git a/drivers/media/dvb/mantis/mantis_vp1034.c b/drivers/media/dvb/mantis/mantis_vp1034.c
new file mode 100644
index 000000000000..8e6ae558ee57
--- /dev/null
+++ b/drivers/media/dvb/mantis/mantis_vp1034.c
@@ -0,0 +1,119 @@
+/*
+	Mantis VP-1034 driver
+
+	Copyright (C) Manu Abraham (abraham.manu@gmail.com)
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#include <linux/signal.h>
+#include <linux/sched.h>
+#include <linux/interrupt.h>
+
+#include "dmxdev.h"
+#include "dvbdev.h"
+#include "dvb_demux.h"
+#include "dvb_frontend.h"
+#include "dvb_net.h"
+
+#include "mb86a16.h"
+#include "mantis_common.h"
+#include "mantis_ioc.h"
+#include "mantis_dvb.h"
+#include "mantis_vp1034.h"
+#include "mantis_reg.h"
+
+struct mb86a16_config vp1034_mb86a16_config = {
+	.demod_address	= 0x08,
+	.set_voltage	= vp1034_set_voltage,
+};
+
+#define MANTIS_MODEL_NAME	"VP-1034"
+#define MANTIS_DEV_TYPE		"DVB-S/DSS"
+
+int vp1034_set_voltage(struct dvb_frontend *fe, fe_sec_voltage_t voltage)
+{
+	struct mantis_pci *mantis = fe->dvb->priv;
+
+	switch (voltage) {
+	case SEC_VOLTAGE_13:
+		dprintk(MANTIS_ERROR, 1, "Polarization=[13V]");
+		gpio_set_bits(mantis, 13, 1);
+		gpio_set_bits(mantis, 14, 0);
+		break;
+	case SEC_VOLTAGE_18:
+		dprintk(MANTIS_ERROR, 1, "Polarization=[18V]");
+		gpio_set_bits(mantis, 13, 1);
+		gpio_set_bits(mantis, 14, 1);
+		break;
+	case SEC_VOLTAGE_OFF:
+		dprintk(MANTIS_ERROR, 1, "Frontend (dummy) POWERDOWN");
+		break;
+	default:
+		dprintk(MANTIS_ERROR, 1, "Invalid = (%d)", (u32) voltage);
+		return -EINVAL;
+	}
+	mmwrite(0x00, MANTIS_GPIF_DOUT);
+
+	return 0;
+}
+
+static int vp1034_frontend_init(struct mantis_pci *mantis, struct dvb_frontend *fe)
+{
+	struct i2c_adapter *adapter	= &mantis->adapter;
+
+	int err = 0;
+
+	err = mantis_frontend_power(mantis, POWER_ON);
+	if (err == 0) {
+		mantis_frontend_soft_reset(mantis);
+		msleep(250);
+
+		dprintk(MANTIS_ERROR, 1, "Probing for MB86A16 (DVB-S/DSS)");
+		fe = mb86a16_attach(&vp1034_mb86a16_config, adapter);
+		if (fe) {
+			dprintk(MANTIS_ERROR, 1,
+			"found MB86A16 DVB-S/DSS frontend @0x%02x",
+			vp1034_mb86a16_config.demod_address);
+
+		} else {
+			return -1;
+		}
+	} else {
+		dprintk(MANTIS_ERROR, 1, "Frontend on <%s> POWER ON failed! <%d>",
+			adapter->name,
+			err);
+
+		return -EIO;
+	}
+	mantis->fe = fe;
+	dprintk(MANTIS_ERROR, 1, "Done!");
+
+	return 0;
+}
+
+struct mantis_hwconfig vp1034_config = {
+	.model_name	= MANTIS_MODEL_NAME,
+	.dev_type	= MANTIS_DEV_TYPE,
+	.ts_size	= MANTIS_TS_204,
+
+	.baud_rate	= MANTIS_BAUD_9600,
+	.parity		= MANTIS_PARITY_NONE,
+	.bytes		= 0,
+
+	.frontend_init	= vp1034_frontend_init,
+	.power		= GPIF_A12,
+	.reset		= GPIF_A13,
+};
diff --git a/drivers/media/dvb/mantis/mantis_vp1034.h b/drivers/media/dvb/mantis/mantis_vp1034.h
new file mode 100644
index 000000000000..323f38ef8e3d
--- /dev/null
+++ b/drivers/media/dvb/mantis/mantis_vp1034.h
@@ -0,0 +1,33 @@
+/*
+	Mantis VP-1034 driver
+
+	Copyright (C) Manu Abraham (abraham.manu@gmail.com)
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#ifndef __MANTIS_VP1034_H
+#define __MANTIS_VP1034_H
+
+#include "dvb_frontend.h"
+#include "mantis_common.h"
+
+
+#define MANTIS_VP_1034_DVB_S	0x0014
+
+extern struct mantis_hwconfig vp1034_config;
+extern int vp1034_set_voltage(struct dvb_frontend *fe, fe_sec_voltage_t voltage);
+
+#endif /* __MANTIS_VP1034_H */
diff --git a/drivers/media/dvb/mantis/mantis_vp1041.c b/drivers/media/dvb/mantis/mantis_vp1041.c
new file mode 100644
index 000000000000..515346dd31d0
--- /dev/null
+++ b/drivers/media/dvb/mantis/mantis_vp1041.c
@@ -0,0 +1,358 @@
+/*
+	Mantis VP-1041 driver
+
+	Copyright (C) Manu Abraham (abraham.manu@gmail.com)
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#include <linux/signal.h>
+#include <linux/sched.h>
+#include <linux/interrupt.h>
+
+#include "dmxdev.h"
+#include "dvbdev.h"
+#include "dvb_demux.h"
+#include "dvb_frontend.h"
+#include "dvb_net.h"
+
+#include "mantis_common.h"
+#include "mantis_ioc.h"
+#include "mantis_dvb.h"
+#include "mantis_vp1041.h"
+#include "stb0899_reg.h"
+#include "stb0899_drv.h"
+#include "stb0899_cfg.h"
+#include "stb6100_cfg.h"
+#include "stb6100.h"
+#include "lnbp21.h"
+
+#define MANTIS_MODEL_NAME	"VP-1041"
+#define MANTIS_DEV_TYPE		"DSS/DVB-S/DVB-S2"
+
+static const struct stb0899_s1_reg vp1041_stb0899_s1_init_1[] = {
+
+	/* 0x0000000b, *//* SYSREG */
+	{ STB0899_DEV_ID		, 0x30 },
+	{ STB0899_DISCNTRL1		, 0x32 },
+	{ STB0899_DISCNTRL2     	, 0x80 },
+	{ STB0899_DISRX_ST0     	, 0x04 },
+	{ STB0899_DISRX_ST1     	, 0x00 },
+	{ STB0899_DISPARITY     	, 0x00 },
+	{ STB0899_DISFIFO       	, 0x00 },
+	{ STB0899_DISSTATUS		, 0x20 },
+	{ STB0899_DISF22        	, 0x99 },
+	{ STB0899_DISF22RX      	, 0xa8 },
+	/* SYSREG ? */
+	{ STB0899_ACRPRESC      	, 0x11 },
+	{ STB0899_ACRDIV1       	, 0x0a },
+	{ STB0899_ACRDIV2       	, 0x05 },
+	{ STB0899_DACR1         	, 0x00 },
+	{ STB0899_DACR2         	, 0x00 },
+	{ STB0899_OUTCFG        	, 0x00 },
+	{ STB0899_MODECFG       	, 0x00 },
+	{ STB0899_IRQSTATUS_3		, 0xfe },
+	{ STB0899_IRQSTATUS_2		, 0x03 },
+	{ STB0899_IRQSTATUS_1		, 0x7c },
+	{ STB0899_IRQSTATUS_0		, 0xf4 },
+	{ STB0899_IRQMSK_3      	, 0xf3 },
+	{ STB0899_IRQMSK_2      	, 0xfc },
+	{ STB0899_IRQMSK_1      	, 0xff },
+	{ STB0899_IRQMSK_0		, 0xff },
+	{ STB0899_IRQCFG		, 0x00 },
+	{ STB0899_I2CCFG        	, 0x88 },
+	{ STB0899_I2CRPT        	, 0x58 },
+	{ STB0899_IOPVALUE5		, 0x00 },
+	{ STB0899_IOPVALUE4		, 0x33 },
+	{ STB0899_IOPVALUE3		, 0x6d },
+	{ STB0899_IOPVALUE2		, 0x90 },
+	{ STB0899_IOPVALUE1		, 0x60 },
+	{ STB0899_IOPVALUE0		, 0x00 },
+	{ STB0899_GPIO00CFG     	, 0x82 },
+	{ STB0899_GPIO01CFG     	, 0x82 },
+	{ STB0899_GPIO02CFG     	, 0x82 },
+	{ STB0899_GPIO03CFG     	, 0x82 },
+	{ STB0899_GPIO04CFG     	, 0x82 },
+	{ STB0899_GPIO05CFG     	, 0x82 },
+	{ STB0899_GPIO06CFG     	, 0x82 },
+	{ STB0899_GPIO07CFG     	, 0x82 },
+	{ STB0899_GPIO08CFG     	, 0x82 },
+	{ STB0899_GPIO09CFG     	, 0x82 },
+	{ STB0899_GPIO10CFG     	, 0x82 },
+	{ STB0899_GPIO11CFG     	, 0x82 },
+	{ STB0899_GPIO12CFG     	, 0x82 },
+	{ STB0899_GPIO13CFG     	, 0x82 },
+	{ STB0899_GPIO14CFG     	, 0x82 },
+	{ STB0899_GPIO15CFG     	, 0x82 },
+	{ STB0899_GPIO16CFG     	, 0x82 },
+	{ STB0899_GPIO17CFG     	, 0x82 },
+	{ STB0899_GPIO18CFG     	, 0x82 },
+	{ STB0899_GPIO19CFG     	, 0x82 },
+	{ STB0899_GPIO20CFG     	, 0x82 },
+	{ STB0899_SDATCFG       	, 0xb8 },
+	{ STB0899_SCLTCFG       	, 0xba },
+	{ STB0899_AGCRFCFG      	, 0x1c }, /* 0x11 */
+	{ STB0899_GPIO22        	, 0x82 }, /* AGCBB2CFG */
+	{ STB0899_GPIO21        	, 0x91 }, /* AGCBB1CFG */
+	{ STB0899_DIRCLKCFG     	, 0x82 },
+	{ STB0899_CLKOUT27CFG   	, 0x7e },
+	{ STB0899_STDBYCFG      	, 0x82 },
+	{ STB0899_CS0CFG        	, 0x82 },
+	{ STB0899_CS1CFG        	, 0x82 },
+	{ STB0899_DISEQCOCFG    	, 0x20 },
+	{ STB0899_GPIO32CFG		, 0x82 },
+	{ STB0899_GPIO33CFG		, 0x82 },
+	{ STB0899_GPIO34CFG		, 0x82 },
+	{ STB0899_GPIO35CFG		, 0x82 },
+	{ STB0899_GPIO36CFG		, 0x82 },
+	{ STB0899_GPIO37CFG		, 0x82 },
+	{ STB0899_GPIO38CFG		, 0x82 },
+	{ STB0899_GPIO39CFG		, 0x82 },
+	{ STB0899_NCOARSE       	, 0x17 }, /* 0x15 = 27 Mhz Clock, F/3 = 198MHz, F/6 = 99MHz */
+	{ STB0899_SYNTCTRL      	, 0x02 }, /* 0x00 = CLK from CLKI, 0x02 = CLK from XTALI */
+	{ STB0899_FILTCTRL      	, 0x00 },
+	{ STB0899_SYSCTRL       	, 0x01 },
+	{ STB0899_STOPCLK1      	, 0x20 },
+	{ STB0899_STOPCLK2      	, 0x00 },
+	{ STB0899_INTBUFSTATUS		, 0x00 },
+	{ STB0899_INTBUFCTRL    	, 0x0a },
+	{ 0xffff			, 0xff },
+};
+
+static const struct stb0899_s1_reg vp1041_stb0899_s1_init_3[] = {
+	{ STB0899_DEMOD         	, 0x00 },
+	{ STB0899_RCOMPC        	, 0xc9 },
+	{ STB0899_AGC1CN        	, 0x01 },
+	{ STB0899_AGC1REF       	, 0x10 },
+	{ STB0899_RTC	        	, 0x23 },
+	{ STB0899_TMGCFG        	, 0x4e },
+	{ STB0899_AGC2REF       	, 0x34 },
+	{ STB0899_TLSR          	, 0x84 },
+	{ STB0899_CFD           	, 0xf7 },
+	{ STB0899_ACLC	        	, 0x87 },
+	{ STB0899_BCLC          	, 0x94 },
+	{ STB0899_EQON          	, 0x41 },
+	{ STB0899_LDT           	, 0xf1 },
+	{ STB0899_LDT2          	, 0xe3 },
+	{ STB0899_EQUALREF      	, 0xb4 },
+	{ STB0899_TMGRAMP       	, 0x10 },
+	{ STB0899_TMGTHD        	, 0x30 },
+	{ STB0899_IDCCOMP		, 0xfd },
+	{ STB0899_QDCCOMP		, 0xff },
+	{ STB0899_POWERI		, 0x0c },
+	{ STB0899_POWERQ		, 0x0f },
+	{ STB0899_RCOMP			, 0x6c },
+	{ STB0899_AGCIQIN		, 0x80 },
+	{ STB0899_AGC2I1		, 0x06 },
+	{ STB0899_AGC2I2		, 0x00 },
+	{ STB0899_TLIR			, 0x30 },
+	{ STB0899_RTF			, 0x7f },
+	{ STB0899_DSTATUS		, 0x00 },
+	{ STB0899_LDI			, 0xbc },
+	{ STB0899_CFRM			, 0xea },
+	{ STB0899_CFRL			, 0x31 },
+	{ STB0899_NIRM			, 0x2b },
+	{ STB0899_NIRL			, 0x80 },
+	{ STB0899_ISYMB			, 0x1d },
+	{ STB0899_QSYMB			, 0xa6 },
+	{ STB0899_SFRH          	, 0x2f },
+	{ STB0899_SFRM          	, 0x68 },
+	{ STB0899_SFRL          	, 0x40 },
+	{ STB0899_SFRUPH        	, 0x2f },
+	{ STB0899_SFRUPM        	, 0x68 },
+	{ STB0899_SFRUPL        	, 0x40 },
+	{ STB0899_EQUAI1		, 0x02 },
+	{ STB0899_EQUAQ1		, 0xff },
+	{ STB0899_EQUAI2		, 0x04 },
+	{ STB0899_EQUAQ2		, 0x05 },
+	{ STB0899_EQUAI3		, 0x02 },
+	{ STB0899_EQUAQ3		, 0xfd },
+	{ STB0899_EQUAI4		, 0x03 },
+	{ STB0899_EQUAQ4		, 0x07 },
+	{ STB0899_EQUAI5		, 0x08 },
+	{ STB0899_EQUAQ5		, 0xf5 },
+	{ STB0899_DSTATUS2		, 0x00 },
+	{ STB0899_VSTATUS       	, 0x00 },
+	{ STB0899_VERROR		, 0x86 },
+	{ STB0899_IQSWAP		, 0x2a },
+	{ STB0899_ECNT1M		, 0x00 },
+	{ STB0899_ECNT1L		, 0x00 },
+	{ STB0899_ECNT2M		, 0x00 },
+	{ STB0899_ECNT2L		, 0x00 },
+	{ STB0899_ECNT3M		, 0x0a },
+	{ STB0899_ECNT3L		, 0xad },
+	{ STB0899_FECAUTO1      	, 0x06 },
+	{ STB0899_FECM	        	, 0x01 },
+	{ STB0899_VTH12         	, 0xb0 },
+	{ STB0899_VTH23         	, 0x7a },
+	{ STB0899_VTH34	        	, 0x58 },
+	{ STB0899_VTH56         	, 0x38 },
+	{ STB0899_VTH67         	, 0x34 },
+	{ STB0899_VTH78         	, 0x24 },
+	{ STB0899_PRVIT         	, 0xff },
+	{ STB0899_VITSYNC       	, 0x19 },
+	{ STB0899_RSULC         	, 0xb1 }, /* DVB = 0xb1, DSS = 0xa1 */
+	{ STB0899_TSULC         	, 0x42 },
+	{ STB0899_RSLLC         	, 0x41 },
+	{ STB0899_TSLPL	        	, 0x12 },
+	{ STB0899_TSCFGH        	, 0x0c },
+	{ STB0899_TSCFGM        	, 0x00 },
+	{ STB0899_TSCFGL        	, 0x00 },
+	{ STB0899_TSOUT			, 0x69 }, /* 0x0d for CAM */
+	{ STB0899_RSSYNCDEL     	, 0x00 },
+	{ STB0899_TSINHDELH     	, 0x02 },
+	{ STB0899_TSINHDELM		, 0x00 },
+	{ STB0899_TSINHDELL		, 0x00 },
+	{ STB0899_TSLLSTKM		, 0x1b },
+	{ STB0899_TSLLSTKL		, 0xb3 },
+	{ STB0899_TSULSTKM		, 0x00 },
+	{ STB0899_TSULSTKL		, 0x00 },
+	{ STB0899_PCKLENUL		, 0xbc },
+	{ STB0899_PCKLENLL		, 0xcc },
+	{ STB0899_RSPCKLEN		, 0xbd },
+	{ STB0899_TSSTATUS		, 0x90 },
+	{ STB0899_ERRCTRL1      	, 0xb6 },
+	{ STB0899_ERRCTRL2      	, 0x95 },
+	{ STB0899_ERRCTRL3      	, 0x8d },
+	{ STB0899_DMONMSK1		, 0x27 },
+	{ STB0899_DMONMSK0		, 0x03 },
+	{ STB0899_DEMAPVIT      	, 0x5c },
+	{ STB0899_PLPARM		, 0x19 },
+	{ STB0899_PDELCTRL      	, 0x48 },
+	{ STB0899_PDELCTRL2     	, 0x00 },
+	{ STB0899_BBHCTRL1      	, 0x00 },
+	{ STB0899_BBHCTRL2      	, 0x00 },
+	{ STB0899_HYSTTHRESH    	, 0x77 },
+	{ STB0899_MATCSTM		, 0x00 },
+	{ STB0899_MATCSTL		, 0x00 },
+	{ STB0899_UPLCSTM		, 0x00 },
+	{ STB0899_UPLCSTL		, 0x00 },
+	{ STB0899_DFLCSTM		, 0x00 },
+	{ STB0899_DFLCSTL		, 0x00 },
+	{ STB0899_SYNCCST		, 0x00 },
+	{ STB0899_SYNCDCSTM		, 0x00 },
+	{ STB0899_SYNCDCSTL		, 0x00 },
+	{ STB0899_ISI_ENTRY		, 0x00 },
+	{ STB0899_ISI_BIT_EN		, 0x00 },
+	{ STB0899_MATSTRM		, 0xf0 },
+	{ STB0899_MATSTRL		, 0x02 },
+	{ STB0899_UPLSTRM		, 0x45 },
+	{ STB0899_UPLSTRL		, 0x60 },
+	{ STB0899_DFLSTRM		, 0xe3 },
+	{ STB0899_DFLSTRL		, 0x00 },
+	{ STB0899_SYNCSTR		, 0x47 },
+	{ STB0899_SYNCDSTRM		, 0x05 },
+	{ STB0899_SYNCDSTRL		, 0x18 },
+	{ STB0899_CFGPDELSTATUS1	, 0x19 },
+	{ STB0899_CFGPDELSTATUS2	, 0x2b },
+	{ STB0899_BBFERRORM		, 0x00 },
+	{ STB0899_BBFERRORL		, 0x01 },
+	{ STB0899_UPKTERRORM		, 0x00 },
+	{ STB0899_UPKTERRORL		, 0x00 },
+	{ 0xffff			, 0xff },
+};
+
+struct stb0899_config vp1041_stb0899_config = {
+	.init_dev		= vp1041_stb0899_s1_init_1,
+	.init_s2_demod		= stb0899_s2_init_2,
+	.init_s1_demod		= vp1041_stb0899_s1_init_3,
+	.init_s2_fec		= stb0899_s2_init_4,
+	.init_tst		= stb0899_s1_init_5,
+
+	.demod_address 		= 0x68, /*  0xd0 >> 1 */
+
+	.xtal_freq		= 27000000,
+	.inversion		= IQ_SWAP_ON, /* 1 */
+
+	.lo_clk			= 76500000,
+	.hi_clk			= 99000000,
+
+	.esno_ave		= STB0899_DVBS2_ESNO_AVE,
+	.esno_quant		= STB0899_DVBS2_ESNO_QUANT,
+	.avframes_coarse	= STB0899_DVBS2_AVFRAMES_COARSE,
+	.avframes_fine		= STB0899_DVBS2_AVFRAMES_FINE,
+	.miss_threshold		= STB0899_DVBS2_MISS_THRESHOLD,
+	.uwp_threshold_acq	= STB0899_DVBS2_UWP_THRESHOLD_ACQ,
+	.uwp_threshold_track	= STB0899_DVBS2_UWP_THRESHOLD_TRACK,
+	.uwp_threshold_sof	= STB0899_DVBS2_UWP_THRESHOLD_SOF,
+	.sof_search_timeout	= STB0899_DVBS2_SOF_SEARCH_TIMEOUT,
+
+	.btr_nco_bits		= STB0899_DVBS2_BTR_NCO_BITS,
+	.btr_gain_shift_offset	= STB0899_DVBS2_BTR_GAIN_SHIFT_OFFSET,
+	.crl_nco_bits		= STB0899_DVBS2_CRL_NCO_BITS,
+	.ldpc_max_iter		= STB0899_DVBS2_LDPC_MAX_ITER,
+
+	.tuner_get_frequency	= stb6100_get_frequency,
+	.tuner_set_frequency	= stb6100_set_frequency,
+	.tuner_set_bandwidth	= stb6100_set_bandwidth,
+	.tuner_get_bandwidth	= stb6100_get_bandwidth,
+	.tuner_set_rfsiggain	= NULL,
+};
+
+struct stb6100_config vp1041_stb6100_config = {
+	.tuner_address	= 0x60,
+	.refclock	= 27000000,
+};
+
+static int vp1041_frontend_init(struct mantis_pci *mantis, struct dvb_frontend *fe)
+{
+	struct i2c_adapter *adapter	= &mantis->adapter;
+
+	int err = 0;
+
+	err = mantis_frontend_power(mantis, POWER_ON);
+	if (err == 0) {
+		mantis_frontend_soft_reset(mantis);
+		msleep(250);
+		mantis->fe = stb0899_attach(&vp1041_stb0899_config, adapter);
+		if (mantis->fe) {
+			dprintk(MANTIS_ERROR, 1,
+				"found STB0899 DVB-S/DVB-S2 frontend @0x%02x",
+				vp1041_stb0899_config.demod_address);
+
+			if (stb6100_attach(mantis->fe, &vp1041_stb6100_config, adapter)) {
+				if (!lnbp21_attach(mantis->fe, adapter, 0, 0))
+					dprintk(MANTIS_ERROR, 1, "No LNBP21 found!");
+			}
+		} else {
+			return -EREMOTEIO;
+		}
+	} else {
+		dprintk(MANTIS_ERROR, 1, "Frontend on <%s> POWER ON failed! <%d>",
+			adapter->name,
+			err);
+
+		return -EIO;
+	}
+
+
+	dprintk(MANTIS_ERROR, 1, "Done!");
+
+	return 0;
+}
+
+struct mantis_hwconfig vp1041_config = {
+	.model_name	= MANTIS_MODEL_NAME,
+	.dev_type	= MANTIS_DEV_TYPE,
+	.ts_size	= MANTIS_TS_188,
+
+	.baud_rate	= MANTIS_BAUD_9600,
+	.parity		= MANTIS_PARITY_NONE,
+	.bytes		= 0,
+
+	.frontend_init	= vp1041_frontend_init,
+	.power		= GPIF_A12,
+	.reset		= GPIF_A13,
+};
diff --git a/drivers/media/dvb/mantis/mantis_vp1041.h b/drivers/media/dvb/mantis/mantis_vp1041.h
new file mode 100644
index 000000000000..1ae5b3de8081
--- /dev/null
+++ b/drivers/media/dvb/mantis/mantis_vp1041.h
@@ -0,0 +1,33 @@
+/*
+	Mantis VP-1041 driver
+
+	Copyright (C) Manu Abraham (abraham.manu@gmail.com)
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#ifndef __MANTIS_VP1041_H
+#define __MANTIS_VP1041_H
+
+#include "mantis_common.h"
+
+#define MANTIS_VP_1041_DVB_S2	0x0031
+#define SKYSTAR_HD2_10		0x0001
+#define SKYSTAR_HD2_20		0x0003
+#define CINERGY_S2_PCI_HD	0x1179
+
+extern struct mantis_hwconfig vp1041_config;
+
+#endif /* __MANTIS_VP1041_H */
diff --git a/drivers/media/dvb/mantis/mantis_vp2033.c b/drivers/media/dvb/mantis/mantis_vp2033.c
new file mode 100644
index 000000000000..10ce81790a8c
--- /dev/null
+++ b/drivers/media/dvb/mantis/mantis_vp2033.c
@@ -0,0 +1,187 @@
+/*
+	Mantis VP-2033 driver
+
+	Copyright (C) Manu Abraham (abraham.manu@gmail.com)
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#include <linux/signal.h>
+#include <linux/sched.h>
+#include <linux/interrupt.h>
+
+#include "dmxdev.h"
+#include "dvbdev.h"
+#include "dvb_demux.h"
+#include "dvb_frontend.h"
+#include "dvb_net.h"
+
+#include "tda1002x.h"
+#include "mantis_common.h"
+#include "mantis_ioc.h"
+#include "mantis_dvb.h"
+#include "mantis_vp2033.h"
+
+#define MANTIS_MODEL_NAME	"VP-2033"
+#define MANTIS_DEV_TYPE		"DVB-C"
+
+struct tda1002x_config vp2033_tda1002x_cu1216_config = {
+	.demod_address = 0x18 >> 1,
+	.invert = 1,
+};
+
+struct tda10023_config vp2033_tda10023_cu1216_config = {
+	.demod_address = 0x18 >> 1,
+	.invert = 1,
+};
+
+static u8 read_pwm(struct mantis_pci *mantis)
+{
+	struct i2c_adapter *adapter = &mantis->adapter;
+
+	u8 b = 0xff;
+	u8 pwm;
+	struct i2c_msg msg[] = {
+		{.addr = 0x50, .flags = 0, .buf = &b, .len = 1},
+		{.addr = 0x50, .flags = I2C_M_RD, .buf = &pwm, .len = 1}
+	};
+
+	if ((i2c_transfer(adapter, msg, 2) != 2)
+	    || (pwm == 0xff))
+		pwm = 0x48;
+
+	return pwm;
+}
+
+static int tda1002x_cu1216_tuner_set(struct dvb_frontend *fe, struct dvb_frontend_parameters *params)
+{
+	struct mantis_pci *mantis = fe->dvb->priv;
+	struct i2c_adapter *adapter = &mantis->adapter;
+
+	u8 buf[6];
+	struct i2c_msg msg = {.addr = 0x60, .flags = 0, .buf = buf, .len = sizeof(buf)};
+	int i;
+
+#define CU1216_IF 36125000
+#define TUNER_MUL 62500
+
+	u32 div = (params->frequency + CU1216_IF + TUNER_MUL / 2) / TUNER_MUL;
+
+	buf[0] = (div >> 8) & 0x7f;
+	buf[1] = div & 0xff;
+	buf[2] = 0xce;
+	buf[3] = (params->frequency < 150000000 ? 0x01 :
+		  params->frequency < 445000000 ? 0x02 : 0x04);
+	buf[4] = 0xde;
+	buf[5] = 0x20;
+
+	if (fe->ops.i2c_gate_ctrl)
+		fe->ops.i2c_gate_ctrl(fe, 1);
+
+	if (i2c_transfer(adapter, &msg, 1) != 1)
+		return -EIO;
+
+	/* wait for the pll lock */
+	msg.flags = I2C_M_RD;
+	msg.len = 1;
+	for (i = 0; i < 20; i++) {
+		if (fe->ops.i2c_gate_ctrl)
+			fe->ops.i2c_gate_ctrl(fe, 1);
+
+		if (i2c_transfer(adapter, &msg, 1) == 1 && (buf[0] & 0x40))
+			break;
+
+		msleep(10);
+	}
+
+	/* switch the charge pump to the lower current */
+	msg.flags = 0;
+	msg.len = 2;
+	msg.buf = &buf[2];
+	buf[2] &= ~0x40;
+	if (fe->ops.i2c_gate_ctrl)
+		fe->ops.i2c_gate_ctrl(fe, 1);
+
+	if (i2c_transfer(adapter, &msg, 1) != 1)
+		return -EIO;
+
+	return 0;
+}
+
+static int vp2033_frontend_init(struct mantis_pci *mantis, struct dvb_frontend *fe)
+{
+	struct i2c_adapter *adapter = &mantis->adapter;
+
+	int err = 0;
+
+	err = mantis_frontend_power(mantis, POWER_ON);
+	if (err == 0) {
+		mantis_frontend_soft_reset(mantis);
+		msleep(250);
+
+		dprintk(MANTIS_ERROR, 1, "Probing for CU1216 (DVB-C)");
+		fe = tda10021_attach(&vp2033_tda1002x_cu1216_config,
+				     adapter,
+				     read_pwm(mantis));
+
+		if (fe) {
+			dprintk(MANTIS_ERROR, 1,
+				"found Philips CU1216 DVB-C frontend (TDA10021) @ 0x%02x",
+				vp2033_tda1002x_cu1216_config.demod_address);
+		} else {
+			fe = tda10023_attach(&vp2033_tda10023_cu1216_config,
+					     adapter,
+					     read_pwm(mantis));
+
+			if (fe) {
+				dprintk(MANTIS_ERROR, 1,
+					"found Philips CU1216 DVB-C frontend (TDA10023) @ 0x%02x",
+					vp2033_tda1002x_cu1216_config.demod_address);
+			}
+		}
+
+		if (fe) {
+			fe->ops.tuner_ops.set_params = tda1002x_cu1216_tuner_set;
+			dprintk(MANTIS_ERROR, 1, "Mantis DVB-C Philips CU1216 frontend attach success");
+		} else {
+			return -1;
+		}
+	} else {
+		dprintk(MANTIS_ERROR, 1, "Frontend on <%s> POWER ON failed! <%d>",
+			adapter->name,
+			err);
+
+		return -EIO;
+	}
+
+	mantis->fe = fe;
+	dprintk(MANTIS_DEBUG, 1, "Done!");
+
+	return 0;
+}
+
+struct mantis_hwconfig vp2033_config = {
+	.model_name	= MANTIS_MODEL_NAME,
+	.dev_type	= MANTIS_DEV_TYPE,
+	.ts_size	= MANTIS_TS_204,
+
+	.baud_rate	= MANTIS_BAUD_9600,
+	.parity		= MANTIS_PARITY_NONE,
+	.bytes		= 0,
+
+	.frontend_init	= vp2033_frontend_init,
+	.power		= GPIF_A12,
+	.reset		= GPIF_A13,
+};
diff --git a/drivers/media/dvb/mantis/mantis_vp2033.h b/drivers/media/dvb/mantis/mantis_vp2033.h
new file mode 100644
index 000000000000..c55242b79d54
--- /dev/null
+++ b/drivers/media/dvb/mantis/mantis_vp2033.h
@@ -0,0 +1,30 @@
+/*
+	Mantis VP-2033 driver
+
+	Copyright (C) Manu Abraham (abraham.manu@gmail.com)
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#ifndef __MANTIS_VP2033_H
+#define __MANTIS_VP2033_H
+
+#include "mantis_common.h"
+
+#define MANTIS_VP_2033_DVB_C	0x0008
+
+extern struct mantis_hwconfig vp2033_config;
+
+#endif /* __MANTIS_VP2033_H */
diff --git a/drivers/media/dvb/mantis/mantis_vp2040.c b/drivers/media/dvb/mantis/mantis_vp2040.c
new file mode 100644
index 000000000000..a7ca233e800b
--- /dev/null
+++ b/drivers/media/dvb/mantis/mantis_vp2040.c
@@ -0,0 +1,186 @@
+/*
+	Mantis VP-2040 driver
+
+	Copyright (C) Manu Abraham (abraham.manu@gmail.com)
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#include <linux/signal.h>
+#include <linux/sched.h>
+#include <linux/interrupt.h>
+
+#include "dmxdev.h"
+#include "dvbdev.h"
+#include "dvb_demux.h"
+#include "dvb_frontend.h"
+#include "dvb_net.h"
+
+#include "tda1002x.h"
+#include "mantis_common.h"
+#include "mantis_ioc.h"
+#include "mantis_dvb.h"
+#include "mantis_vp2040.h"
+
+#define MANTIS_MODEL_NAME	"VP-2040"
+#define MANTIS_DEV_TYPE		"DVB-C"
+
+struct tda1002x_config vp2040_tda1002x_cu1216_config = {
+	.demod_address	= 0x18 >> 1,
+	.invert		= 1,
+};
+
+struct tda10023_config vp2040_tda10023_cu1216_config = {
+	.demod_address	= 0x18 >> 1,
+	.invert		= 1,
+};
+
+static int tda1002x_cu1216_tuner_set(struct dvb_frontend *fe, struct dvb_frontend_parameters *params)
+{
+	struct mantis_pci *mantis	= fe->dvb->priv;
+	struct i2c_adapter *adapter	= &mantis->adapter;
+
+	u8 buf[6];
+	struct i2c_msg msg = {.addr = 0x60, .flags = 0, .buf = buf, .len = sizeof(buf)};
+	int i;
+
+#define CU1216_IF 36125000
+#define TUNER_MUL 62500
+
+	u32 div = (params->frequency + CU1216_IF + TUNER_MUL / 2) / TUNER_MUL;
+
+	buf[0] = (div >> 8) & 0x7f;
+	buf[1] = div & 0xff;
+	buf[2] = 0xce;
+	buf[3] = (params->frequency < 150000000 ? 0x01 :
+		  params->frequency < 445000000 ? 0x02 : 0x04);
+	buf[4] = 0xde;
+	buf[5] = 0x20;
+
+	if (fe->ops.i2c_gate_ctrl)
+		fe->ops.i2c_gate_ctrl(fe, 1);
+
+	if (i2c_transfer(adapter, &msg, 1) != 1)
+		return -EIO;
+
+	/* wait for the pll lock */
+	msg.flags = I2C_M_RD;
+	msg.len = 1;
+	for (i = 0; i < 20; i++) {
+		if (fe->ops.i2c_gate_ctrl)
+			fe->ops.i2c_gate_ctrl(fe, 1);
+
+		if (i2c_transfer(adapter, &msg, 1) == 1 && (buf[0] & 0x40))
+			break;
+
+		msleep(10);
+	}
+
+	/* switch the charge pump to the lower current */
+	msg.flags = 0;
+	msg.len = 2;
+	msg.buf = &buf[2];
+	buf[2] &= ~0x40;
+	if (fe->ops.i2c_gate_ctrl)
+		fe->ops.i2c_gate_ctrl(fe, 1);
+
+	if (i2c_transfer(adapter, &msg, 1) != 1)
+		return -EIO;
+
+	return 0;
+}
+
+static u8 read_pwm(struct mantis_pci *mantis)
+{
+	struct i2c_adapter *adapter = &mantis->adapter;
+
+	u8 b = 0xff;
+	u8 pwm;
+	struct i2c_msg msg[] = {
+		{.addr = 0x50, .flags = 0, .buf = &b, .len = 1},
+		{.addr = 0x50, .flags = I2C_M_RD, .buf = &pwm, .len = 1}
+	};
+
+	if ((i2c_transfer(adapter, msg, 2) != 2)
+	    || (pwm == 0xff))
+		pwm = 0x48;
+
+	return pwm;
+}
+
+static int vp2040_frontend_init(struct mantis_pci *mantis, struct dvb_frontend *fe)
+{
+	struct i2c_adapter *adapter = &mantis->adapter;
+
+	int err = 0;
+
+	err = mantis_frontend_power(mantis, POWER_ON);
+	if (err == 0) {
+		mantis_frontend_soft_reset(mantis);
+		msleep(250);
+
+		dprintk(MANTIS_ERROR, 1, "Probing for CU1216 (DVB-C)");
+		fe = tda10021_attach(&vp2040_tda1002x_cu1216_config,
+				     adapter,
+				     read_pwm(mantis));
+
+		if (fe) {
+			dprintk(MANTIS_ERROR, 1,
+				"found Philips CU1216 DVB-C frontend (TDA10021) @ 0x%02x",
+				vp2040_tda1002x_cu1216_config.demod_address);
+		} else {
+			fe = tda10023_attach(&vp2040_tda10023_cu1216_config,
+					     adapter,
+					     read_pwm(mantis));
+
+			if (fe) {
+				dprintk(MANTIS_ERROR, 1,
+					"found Philips CU1216 DVB-C frontend (TDA10023) @ 0x%02x",
+					vp2040_tda1002x_cu1216_config.demod_address);
+			}
+		}
+
+		if (fe) {
+			fe->ops.tuner_ops.set_params = tda1002x_cu1216_tuner_set;
+			dprintk(MANTIS_ERROR, 1, "Mantis DVB-C Philips CU1216 frontend attach success");
+		} else {
+			return -1;
+		}
+	} else {
+		dprintk(MANTIS_ERROR, 1, "Frontend on <%s> POWER ON failed! <%d>",
+			adapter->name,
+			err);
+
+		return -EIO;
+	}
+	mantis->fe = fe;
+	dprintk(MANTIS_DEBUG, 1, "Done!");
+
+	return 0;
+}
+
+struct mantis_hwconfig vp2040_config = {
+	.model_name	= MANTIS_MODEL_NAME,
+	.dev_type	= MANTIS_DEV_TYPE,
+	.ts_size	= MANTIS_TS_204,
+
+	.baud_rate	= MANTIS_BAUD_9600,
+	.parity		= MANTIS_PARITY_NONE,
+	.bytes		= 0,
+
+	.frontend_init	= vp2040_frontend_init,
+	.power		= GPIF_A12,
+	.reset		= GPIF_A13,
+};
diff --git a/drivers/media/dvb/mantis/mantis_vp2040.h b/drivers/media/dvb/mantis/mantis_vp2040.h
new file mode 100644
index 000000000000..d125e219b685
--- /dev/null
+++ b/drivers/media/dvb/mantis/mantis_vp2040.h
@@ -0,0 +1,32 @@
+/*
+	Mantis VP-2040 driver
+
+	Copyright (C) Manu Abraham (abraham.manu@gmail.com)
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#ifndef __MANTIS_VP2040_H
+#define __MANTIS_VP2040_H
+
+#include "mantis_common.h"
+
+#define MANTIS_VP_2040_DVB_C	0x0043
+#define CINERGY_C		0x1178
+#define CABLESTAR_HD2		0x0002
+
+extern struct mantis_hwconfig vp2040_config;
+
+#endif /* __MANTIS_VP2040_H */
diff --git a/drivers/media/dvb/mantis/mantis_vp3028.c b/drivers/media/dvb/mantis/mantis_vp3028.c
new file mode 100644
index 000000000000..4155c838a18a
--- /dev/null
+++ b/drivers/media/dvb/mantis/mantis_vp3028.c
@@ -0,0 +1,38 @@
+/*
+	Mantis VP-3028 driver
+
+	Copyright (C) Manu Abraham (abraham.manu@gmail.com)
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#include "mantis_common.h"
+#include "mantis_vp3028.h"
+
+struct zl10353_config mantis_vp3028_config = {
+	.demod_address	= 0x0f,
+};
+
+#define MANTIS_MODEL_NAME	"VP-3028"
+#define MANTIS_DEV_TYPE		"DVB-T"
+
+struct mantis_hwconfig vp3028_mantis_config = {
+	.model_name	= MANTIS_MODEL_NAME,
+	.dev_type	= MANTIS_DEV_TYPE,
+	.ts_size	= MANTIS_TS_188,
+	.baud_rate	= MANTIS_BAUD_9600,
+	.parity		= MANTIS_PARITY_NONE,
+	.bytes		= 0,
+};
diff --git a/drivers/media/dvb/mantis/mantis_vp3028.h b/drivers/media/dvb/mantis/mantis_vp3028.h
new file mode 100644
index 000000000000..b07be6adc522
--- /dev/null
+++ b/drivers/media/dvb/mantis/mantis_vp3028.h
@@ -0,0 +1,33 @@
+/*
+	Mantis VP-3028 driver
+
+	Copyright (C) Manu Abraham (abraham.manu@gmail.com)
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#ifndef __MANTIS_VP3028_H
+#define __MANTIS_VP3028_H
+
+#include "dvb_frontend.h"
+#include "mantis_common.h"
+#include "zl10353.h"
+
+#define MANTIS_VP_3028_DVB_T	0x0028
+
+extern struct zl10353_config mantis_vp3028_config;
+extern struct mantis_hwconfig vp3028_mantis_config;
+
+#endif /* __MANTIS_VP3028_H */
diff --git a/drivers/media/dvb/mantis/mantis_vp3030.c b/drivers/media/dvb/mantis/mantis_vp3030.c
new file mode 100644
index 000000000000..1f4334214953
--- /dev/null
+++ b/drivers/media/dvb/mantis/mantis_vp3030.c
@@ -0,0 +1,105 @@
+/*
+	Mantis VP-3030 driver
+
+	Copyright (C) Manu Abraham (abraham.manu@gmail.com)
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#include <linux/signal.h>
+#include <linux/sched.h>
+#include <linux/interrupt.h>
+
+#include "dmxdev.h"
+#include "dvbdev.h"
+#include "dvb_demux.h"
+#include "dvb_frontend.h"
+#include "dvb_net.h"
+
+#include "zl10353.h"
+#include "tda665x.h"
+#include "mantis_common.h"
+#include "mantis_ioc.h"
+#include "mantis_dvb.h"
+#include "mantis_vp3030.h"
+
+struct zl10353_config mantis_vp3030_config = {
+	.demod_address		= 0x0f,
+};
+
+struct tda665x_config env57h12d5_config = {
+	.name			= "ENV57H12D5 (ET-50DT)",
+	.addr			= 0x60,
+	.frequency_min		=  47000000,
+	.frequency_max		= 862000000,
+	.frequency_offst	=   3616667,
+	.ref_multiplier		= 6, /* 1/6 MHz */
+	.ref_divider		= 100000, /* 1/6 MHz */
+};
+
+#define MANTIS_MODEL_NAME	"VP-3030"
+#define MANTIS_DEV_TYPE		"DVB-T"
+
+
+static int vp3030_frontend_init(struct mantis_pci *mantis, struct dvb_frontend *fe)
+{
+	struct i2c_adapter *adapter	= &mantis->adapter;
+	struct mantis_hwconfig *config	= mantis->hwconfig;
+	int err = 0;
+
+	gpio_set_bits(mantis, config->reset, 0);
+	msleep(100);
+	err = mantis_frontend_power(mantis, POWER_ON);
+	msleep(100);
+	gpio_set_bits(mantis, config->reset, 1);
+
+	if (err == 0) {
+		msleep(250);
+		dprintk(MANTIS_ERROR, 1, "Probing for 10353 (DVB-T)");
+		fe = zl10353_attach(&mantis_vp3030_config, adapter);
+
+		if (!fe)
+			return -1;
+
+		tda665x_attach(fe, &env57h12d5_config, adapter);
+	} else {
+		dprintk(MANTIS_ERROR, 1, "Frontend on <%s> POWER ON failed! <%d>",
+			adapter->name,
+			err);
+
+		return -EIO;
+
+	}
+	mantis->fe = fe;
+	dprintk(MANTIS_ERROR, 1, "Done!");
+
+	return 0;
+}
+
+struct mantis_hwconfig vp3030_config = {
+	.model_name	= MANTIS_MODEL_NAME,
+	.dev_type	= MANTIS_DEV_TYPE,
+	.ts_size	= MANTIS_TS_188,
+
+	.baud_rate	= MANTIS_BAUD_9600,
+	.parity		= MANTIS_PARITY_NONE,
+	.bytes		= 0,
+
+	.frontend_init	= vp3030_frontend_init,
+	.power		= GPIF_A12,
+	.reset		= GPIF_A13,
+
+	.i2c_mode	= MANTIS_BYTE_MODE
+};
diff --git a/drivers/media/dvb/mantis/mantis_vp3030.h b/drivers/media/dvb/mantis/mantis_vp3030.h
new file mode 100644
index 000000000000..5f12c4266277
--- /dev/null
+++ b/drivers/media/dvb/mantis/mantis_vp3030.h
@@ -0,0 +1,30 @@
+/*
+	Mantis VP-3030 driver
+
+	Copyright (C) Manu Abraham (abraham.manu@gmail.com)
+
+	This program is free software; you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation; either version 2 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program; if not, write to the Free Software
+	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#ifndef __MANTIS_VP3030_H
+#define __MANTIS_VP3030_H
+
+#include "mantis_common.h"
+
+#define MANTIS_VP_3030_DVB_T	0x0024
+
+extern struct mantis_hwconfig vp3030_config;
+
+#endif /* __MANTIS_VP3030_H */
diff --git a/drivers/media/dvb/pt1/pt1.c b/drivers/media/dvb/pt1/pt1.c
index 1fd8306371e2..81e623a90f09 100644
--- a/drivers/media/dvb/pt1/pt1.c
+++ b/drivers/media/dvb/pt1/pt1.c
@@ -27,7 +27,6 @@
 #include <linux/pci.h>
 #include <linux/kthread.h>
 #include <linux/freezer.h>
-#include <linux/vmalloc.h>
 
 #include "dvbdev.h"
 #include "dvb_demux.h"
diff --git a/drivers/media/dvb/pt1/va1j5jf8007s.c b/drivers/media/dvb/pt1/va1j5jf8007s.c
index 2db940f8635f..fc6594996e79 100644
--- a/drivers/media/dvb/pt1/va1j5jf8007s.c
+++ b/drivers/media/dvb/pt1/va1j5jf8007s.c
@@ -48,6 +48,60 @@ struct va1j5jf8007s_state {
 	enum va1j5jf8007s_tune_state tune_state;
 };
 
+static int va1j5jf8007s_read_snr(struct dvb_frontend *fe, u16 *snr)
+{
+	struct va1j5jf8007s_state *state;
+	u8 addr;
+	int i;
+	u8 write_buf[1], read_buf[1];
+	struct i2c_msg msgs[2];
+	s32 word, x1, x2, x3, x4, x5, y;
+
+	state = fe->demodulator_priv;
+	addr = state->config->demod_address;
+
+	word = 0;
+	for (i = 0; i < 2; i++) {
+		write_buf[0] = 0xbc + i;
+
+		msgs[0].addr = addr;
+		msgs[0].flags = 0;
+		msgs[0].len = sizeof(write_buf);
+		msgs[0].buf = write_buf;
+
+		msgs[1].addr = addr;
+		msgs[1].flags = I2C_M_RD;
+		msgs[1].len = sizeof(read_buf);
+		msgs[1].buf = read_buf;
+
+		if (i2c_transfer(state->adap, msgs, 2) != 2)
+			return -EREMOTEIO;
+
+		word <<= 8;
+		word |= read_buf[0];
+	}
+
+	word -= 3000;
+	if (word < 0)
+		word = 0;
+
+	x1 = int_sqrt(word << 16) * ((15625ll << 21) / 1000000);
+	x2 = (s64)x1 * x1 >> 31;
+	x3 = (s64)x2 * x1 >> 31;
+	x4 = (s64)x2 * x2 >> 31;
+	x5 = (s64)x4 * x1 >> 31;
+
+	y = (58857ll << 23) / 1000;
+	y -= (s64)x1 * ((89565ll << 24) / 1000) >> 30;
+	y += (s64)x2 * ((88977ll << 24) / 1000) >> 28;
+	y -= (s64)x3 * ((50259ll << 25) / 1000) >> 27;
+	y += (s64)x4 * ((14341ll << 27) / 1000) >> 27;
+	y -= (s64)x5 * ((16346ll << 30) / 10000) >> 28;
+
+	*snr = y < 0 ? 0 : y >> 15;
+	return 0;
+}
+
 static int va1j5jf8007s_get_frontend_algo(struct dvb_frontend *fe)
 {
 	return DVBFE_ALGO_HW;
@@ -337,7 +391,7 @@ va1j5jf8007s_tune(struct dvb_frontend *fe,
 {
 	struct va1j5jf8007s_state *state;
 	int ret;
-	int lock;
+	int lock = 0;
 
 	state = fe->demodulator_priv;
 
@@ -536,6 +590,7 @@ static struct dvb_frontend_ops va1j5jf8007s_ops = {
 			FE_CAN_GUARD_INTERVAL_AUTO | FE_CAN_HIERARCHY_AUTO,
 	},
 
+	.read_snr = va1j5jf8007s_read_snr,
 	.get_frontend_algo = va1j5jf8007s_get_frontend_algo,
 	.read_status = va1j5jf8007s_read_status,
 	.tune = va1j5jf8007s_tune,
diff --git a/drivers/media/dvb/pt1/va1j5jf8007t.c b/drivers/media/dvb/pt1/va1j5jf8007t.c
index 71117f4ca7e6..3db4f3e34e8f 100644
--- a/drivers/media/dvb/pt1/va1j5jf8007t.c
+++ b/drivers/media/dvb/pt1/va1j5jf8007t.c
@@ -46,6 +46,52 @@ struct va1j5jf8007t_state {
 	enum va1j5jf8007t_tune_state tune_state;
 };
 
+static int va1j5jf8007t_read_snr(struct dvb_frontend *fe, u16 *snr)
+{
+	struct va1j5jf8007t_state *state;
+	u8 addr;
+	int i;
+	u8 write_buf[1], read_buf[1];
+	struct i2c_msg msgs[2];
+	s32 word, x, y;
+
+	state = fe->demodulator_priv;
+	addr = state->config->demod_address;
+
+	word = 0;
+	for (i = 0; i < 3; i++) {
+		write_buf[0] = 0x8b + i;
+
+		msgs[0].addr = addr;
+		msgs[0].flags = 0;
+		msgs[0].len = sizeof(write_buf);
+		msgs[0].buf = write_buf;
+
+		msgs[1].addr = addr;
+		msgs[1].flags = I2C_M_RD;
+		msgs[1].len = sizeof(read_buf);
+		msgs[1].buf = read_buf;
+
+		if (i2c_transfer(state->adap, msgs, 2) != 2)
+			return -EREMOTEIO;
+
+		word <<= 8;
+		word |= read_buf[0];
+	}
+
+	if (!word)
+		return -EIO;
+
+	x = 10 * (intlog10(0x540000 * 100 / word) - (2 << 24));
+	y = (24ll << 46) / 1000000;
+	y = ((s64)y * x >> 30) - (16ll << 40) / 10000;
+	y = ((s64)y * x >> 29) + (398ll << 35) / 10000;
+	y = ((s64)y * x >> 30) + (5491ll << 29) / 10000;
+	y = ((s64)y * x >> 30) + (30965ll << 23) / 10000;
+	*snr = y >> 15;
+	return 0;
+}
+
 static int va1j5jf8007t_get_frontend_algo(struct dvb_frontend *fe)
 {
 	return DVBFE_ALGO_HW;
@@ -224,7 +270,7 @@ va1j5jf8007t_tune(struct dvb_frontend *fe,
 {
 	struct va1j5jf8007t_state *state;
 	int ret;
-	int lock, retry;
+	int lock = 0, retry = 0;
 
 	state = fe->demodulator_priv;
 
@@ -393,6 +439,7 @@ static struct dvb_frontend_ops va1j5jf8007t_ops = {
 			FE_CAN_GUARD_INTERVAL_AUTO | FE_CAN_HIERARCHY_AUTO,
 	},
 
+	.read_snr = va1j5jf8007t_read_snr,
 	.get_frontend_algo = va1j5jf8007t_get_frontend_algo,
 	.read_status = va1j5jf8007t_read_status,
 	.tune = va1j5jf8007t_tune,
diff --git a/drivers/media/dvb/siano/sms-cards.c b/drivers/media/dvb/siano/sms-cards.c
index 0420e2885e75..1067b22eb0c6 100644
--- a/drivers/media/dvb/siano/sms-cards.c
+++ b/drivers/media/dvb/siano/sms-cards.c
@@ -97,7 +97,7 @@ static struct sms_board sms_boards[] = {
 	},
 };
 
-struct sms_board *sms_get_board(int id)
+struct sms_board *sms_get_board(unsigned id)
 {
 	BUG_ON(id >= ARRAY_SIZE(sms_boards));
 
@@ -294,6 +294,8 @@ int sms_board_load_modules(int id)
 	case SMS1XXX_BOARD_HAUPPAUGE_OKEMO_A:
 	case SMS1XXX_BOARD_HAUPPAUGE_OKEMO_B:
 	case SMS1XXX_BOARD_HAUPPAUGE_WINDHAM:
+	case SMS1XXX_BOARD_HAUPPAUGE_TIGER_MINICARD:
+	case SMS1XXX_BOARD_HAUPPAUGE_TIGER_MINICARD_R2:
 		request_module("smsdvb");
 		break;
 	default:
diff --git a/drivers/media/dvb/siano/sms-cards.h b/drivers/media/dvb/siano/sms-cards.h
index 38f062f6ad68..8f19fc000b46 100644
--- a/drivers/media/dvb/siano/sms-cards.h
+++ b/drivers/media/dvb/siano/sms-cards.h
@@ -81,7 +81,7 @@ struct sms_board {
 	int led_power, led_hi, led_lo, lna_ctrl, rf_switch;
 };
 
-struct sms_board *sms_get_board(int id);
+struct sms_board *sms_get_board(unsigned id);
 
 extern struct smscore_device_t *coredev;
 
diff --git a/drivers/media/dvb/siano/smscoreapi.c b/drivers/media/dvb/siano/smscoreapi.c
index fa6a62369a78..ca758bcb48c9 100644
--- a/drivers/media/dvb/siano/smscoreapi.c
+++ b/drivers/media/dvb/siano/smscoreapi.c
@@ -1373,7 +1373,7 @@ static int GetGpioPinParams(u32 PinNum, u32 *pTranslatedPinNum,
 
 	*pGroupCfg = 1;
 
-	if (PinNum >= 0 && PinNum <= 1)	{
+	if (PinNum <= 1)	{
 		*pTranslatedPinNum = 0;
 		*pGroupNum = 9;
 		*pGroupCfg = 2;
diff --git a/drivers/media/dvb/siano/smsdvb.c b/drivers/media/dvb/siano/smsdvb.c
index 266033ae2784..68bf9fbd8fed 100644
--- a/drivers/media/dvb/siano/smsdvb.c
+++ b/drivers/media/dvb/siano/smsdvb.c
@@ -662,7 +662,7 @@ adapter_error:
 	return rc;
 }
 
-int smsdvb_module_init(void)
+static int __init smsdvb_module_init(void)
 {
 	int rc;
 
@@ -676,7 +676,7 @@ int smsdvb_module_init(void)
 	return rc;
 }
 
-void smsdvb_module_exit(void)
+static void __exit smsdvb_module_exit(void)
 {
 	smscore_unregister_hotplug(smsdvb_hotplug);
 
diff --git a/drivers/media/dvb/siano/smssdio.c b/drivers/media/dvb/siano/smssdio.c
index d1d652e7f890..195244a3e69b 100644
--- a/drivers/media/dvb/siano/smssdio.c
+++ b/drivers/media/dvb/siano/smssdio.c
@@ -48,7 +48,7 @@
 #define SMSSDIO_INT		0x04
 #define SMSSDIO_BLOCK_SIZE	128
 
-static const struct sdio_device_id smssdio_ids[] = {
+static const struct sdio_device_id smssdio_ids[] __devinitconst = {
 	{SDIO_DEVICE(SDIO_VENDOR_ID_SIANO, SDIO_DEVICE_ID_SIANO_STELLAR),
 	 .driver_data = SMS1XXX_BOARD_SIANO_STELLAR},
 	{SDIO_DEVICE(SDIO_VENDOR_ID_SIANO, SDIO_DEVICE_ID_SIANO_NOVA_A0),
@@ -78,7 +78,7 @@ struct smssdio_device {
 
 static int smssdio_sendrequest(void *context, void *buffer, size_t size)
 {
-	int ret;
+	int ret = 0;
 	struct smssdio_device *smsdev;
 
 	smsdev = context;
@@ -222,7 +222,7 @@ static void smssdio_interrupt(struct sdio_func *func)
 	smscore_onresponse(smsdev->coredev, cb);
 }
 
-static int smssdio_probe(struct sdio_func *func,
+static int __devinit smssdio_probe(struct sdio_func *func,
 			 const struct sdio_device_id *id)
 {
 	int ret;
@@ -338,7 +338,7 @@ static struct sdio_driver smssdio_driver = {
 /* Module functions                                                */
 /*******************************************************************/
 
-int smssdio_module_init(void)
+static int __init smssdio_module_init(void)
 {
 	int ret = 0;
 
@@ -350,7 +350,7 @@ int smssdio_module_init(void)
 	return ret;
 }
 
-void smssdio_module_exit(void)
+static void __exit smssdio_module_exit(void)
 {
 	sdio_unregister_driver(&smssdio_driver);
 }
diff --git a/drivers/media/dvb/siano/smsusb.c b/drivers/media/dvb/siano/smsusb.c
index 8f88a586b0dd..5eac27287d9c 100644
--- a/drivers/media/dvb/siano/smsusb.c
+++ b/drivers/media/dvb/siano/smsusb.c
@@ -390,7 +390,7 @@ static int smsusb_init_device(struct usb_interface *intf, int board_id)
 	return rc;
 }
 
-static int smsusb_probe(struct usb_interface *intf,
+static int __devinit smsusb_probe(struct usb_interface *intf,
 			const struct usb_device_id *id)
 {
 	struct usb_device *udev = interface_to_usbdev(intf);
@@ -484,7 +484,7 @@ static int smsusb_resume(struct usb_interface *intf)
 	return 0;
 }
 
-struct usb_device_id smsusb_id_table[] = {
+static const struct usb_device_id smsusb_id_table[] __devinitconst = {
 	{ USB_DEVICE(0x187f, 0x0010),
 		.driver_info = SMS1XXX_BOARD_SIANO_STELLAR },
 	{ USB_DEVICE(0x187f, 0x0100),
@@ -533,8 +533,18 @@ struct usb_device_id smsusb_id_table[] = {
 		.driver_info = SMS1XXX_BOARD_HAUPPAUGE_WINDHAM },
 	{ USB_DEVICE(0x2040, 0xb910),
 		.driver_info = SMS1XXX_BOARD_HAUPPAUGE_WINDHAM },
+	{ USB_DEVICE(0x2040, 0xb980),
+		.driver_info = SMS1XXX_BOARD_HAUPPAUGE_WINDHAM },
+	{ USB_DEVICE(0x2040, 0xb990),
+		.driver_info = SMS1XXX_BOARD_HAUPPAUGE_WINDHAM },
 	{ USB_DEVICE(0x2040, 0xc000),
 		.driver_info = SMS1XXX_BOARD_HAUPPAUGE_WINDHAM },
+	{ USB_DEVICE(0x2040, 0xc010),
+		.driver_info = SMS1XXX_BOARD_HAUPPAUGE_WINDHAM },
+	{ USB_DEVICE(0x2040, 0xc080),
+		.driver_info = SMS1XXX_BOARD_HAUPPAUGE_WINDHAM },
+	{ USB_DEVICE(0x2040, 0xc090),
+		.driver_info = SMS1XXX_BOARD_HAUPPAUGE_WINDHAM },
 	{ } /* Terminating entry */
 	};
 
@@ -550,7 +560,7 @@ static struct usb_driver smsusb_driver = {
 	.resume			= smsusb_resume,
 };
 
-int smsusb_module_init(void)
+static int __init smsusb_module_init(void)
 {
 	int rc = usb_register(&smsusb_driver);
 	if (rc)
@@ -561,7 +571,7 @@ int smsusb_module_init(void)
 	return rc;
 }
 
-void smsusb_module_exit(void)
+static void __exit smsusb_module_exit(void)
 {
 	/* Regular USB Cleanup */
 	usb_deregister(&smsusb_driver);
diff --git a/drivers/media/dvb/ttpci/av7110.c b/drivers/media/dvb/ttpci/av7110.c
index 8d65c652ba50..baf3159a3aa6 100644
--- a/drivers/media/dvb/ttpci/av7110.c
+++ b/drivers/media/dvb/ttpci/av7110.c
@@ -2425,7 +2425,7 @@ static int __devinit av7110_attach(struct saa7146_dev* dev,
 		 * use 0x15 to track VPE  interrupts - increase by 1 every vpeirq() is called
 		 */
 		saa7146_write(dev, EC1SSR, (0x03<<2) | 3 );
-		/* set event counter 1 treshold to maximum allowed value        (rEC p55) */
+		/* set event counter 1 threshold to maximum allowed value        (rEC p55) */
 		saa7146_write(dev, ECT1R,  0x3fff );
 #endif
 		/* Set RPS1 Address register to point to RPS code               (r108 p42) */
@@ -2559,7 +2559,7 @@ static int __devinit av7110_attach(struct saa7146_dev* dev,
 		 * use 0x15 to track VPE  interrupts - increase by 1 every vpeirq() is called
 		 */
 		saa7146_write(dev, EC1SSR, (0x03<<2) | 3 );
-		/* set event counter 1 treshold to maximum allowed value        (rEC p55) */
+		/* set event counter 1 threshold to maximum allowed value        (rEC p55) */
 		saa7146_write(dev, ECT1R,  0x3fff );
 #endif
 		/* Setup BUDGETPATCH MAIN RPS1 "program" (p35) */
diff --git a/drivers/media/dvb/ttpci/budget-av.c b/drivers/media/dvb/ttpci/budget-av.c
index 8ea915227674..983672aa2450 100644
--- a/drivers/media/dvb/ttpci/budget-av.c
+++ b/drivers/media/dvb/ttpci/budget-av.c
@@ -1055,7 +1055,7 @@ static const struct stb0899_s1_reg knc1_stb0899_s1_init_3[] = {
 	{ STB0899_TSCFGH		, 0x0c },
 	{ STB0899_TSCFGM		, 0x00 },
 	{ STB0899_TSCFGL		, 0x0c },
-	{ STB0899_TSOUT			, 0x0d }, /* 0x0d for CAM */
+	{ STB0899_TSOUT			, 0x4d }, /* 0x0d for CAM */
 	{ STB0899_RSSYNCDEL		, 0x00 },
 	{ STB0899_TSINHDELH		, 0x02 },
 	{ STB0899_TSINHDELM		, 0x00 },
diff --git a/drivers/media/dvb/ttpci/budget-ci.c b/drivers/media/dvb/ttpci/budget-ci.c
index b5c681372b6c..9782e0593733 100644
--- a/drivers/media/dvb/ttpci/budget-ci.c
+++ b/drivers/media/dvb/ttpci/budget-ci.c
@@ -178,7 +178,7 @@ static void msp430_ir_interrupt(unsigned long data)
 	if (budget_ci->ir.last_raw != raw || !timer_pending(&budget_ci->ir.timer_keyup)) {
 		ir_input_nokey(dev, &budget_ci->ir.state);
 		ir_input_keydown(dev, &budget_ci->ir.state,
-				 budget_ci->ir.ir_key, raw);
+				 budget_ci->ir.ir_key);
 		budget_ci->ir.last_raw = raw;
 	}
 
@@ -190,12 +190,13 @@ static int msp430_ir_init(struct budget_ci *budget_ci)
 	struct saa7146_dev *saa = budget_ci->budget.dev;
 	struct input_dev *input_dev = budget_ci->ir.dev;
 	int error;
+	struct ir_scancode_table *ir_codes;
+
 
 	budget_ci->ir.dev = input_dev = input_allocate_device();
 	if (!input_dev) {
 		printk(KERN_ERR "budget_ci: IR interface initialisation failed\n");
-		error = -ENOMEM;
-		goto out1;
+		return -ENOMEM;
 	}
 
 	snprintf(budget_ci->ir.name, sizeof(budget_ci->ir.name),
@@ -217,6 +218,11 @@ static int msp430_ir_init(struct budget_ci *budget_ci)
 	}
 	input_dev->dev.parent = &saa->pci->dev;
 
+	if (rc5_device < 0)
+		budget_ci->ir.rc5_device = IR_DEVICE_ANY;
+	else
+		budget_ci->ir.rc5_device = rc5_device;
+
 	/* Select keymap and address */
 	switch (budget_ci->budget.dev->pci->subsystem_device) {
 	case 0x100c:
@@ -224,47 +230,34 @@ static int msp430_ir_init(struct budget_ci *budget_ci)
 	case 0x1011:
 	case 0x1012:
 		/* The hauppauge keymap is a superset of these remotes */
-		ir_input_init(input_dev, &budget_ci->ir.state,
-			      IR_TYPE_RC5, &ir_codes_hauppauge_new_table);
+		ir_codes = &ir_codes_hauppauge_new_table;
 
 		if (rc5_device < 0)
 			budget_ci->ir.rc5_device = 0x1f;
-		else
-			budget_ci->ir.rc5_device = rc5_device;
 		break;
 	case 0x1010:
 	case 0x1017:
 	case 0x101a:
 		/* for the Technotrend 1500 bundled remote */
-		ir_input_init(input_dev, &budget_ci->ir.state,
-			      IR_TYPE_RC5, &ir_codes_tt_1500_table);
-
-		if (rc5_device < 0)
-			budget_ci->ir.rc5_device = IR_DEVICE_ANY;
-		else
-			budget_ci->ir.rc5_device = rc5_device;
+		ir_codes = &ir_codes_tt_1500_table;
 		break;
 	default:
 		/* unknown remote */
-		ir_input_init(input_dev, &budget_ci->ir.state,
-			      IR_TYPE_RC5, &ir_codes_budget_ci_old_table);
-
-		if (rc5_device < 0)
-			budget_ci->ir.rc5_device = IR_DEVICE_ANY;
-		else
-			budget_ci->ir.rc5_device = rc5_device;
+		ir_codes = &ir_codes_budget_ci_old_table;
 		break;
 	}
 
+	ir_input_init(input_dev, &budget_ci->ir.state, IR_TYPE_RC5);
+
 	/* initialise the key-up timeout handler */
 	init_timer(&budget_ci->ir.timer_keyup);
 	budget_ci->ir.timer_keyup.function = msp430_ir_keyup;
 	budget_ci->ir.timer_keyup.data = (unsigned long) &budget_ci->ir;
 	budget_ci->ir.last_raw = 0xffff; /* An impossible value */
-	error = input_register_device(input_dev);
+	error = ir_input_register(input_dev, ir_codes);
 	if (error) {
 		printk(KERN_ERR "budget_ci: could not init driver for IR device (code %d)\n", error);
-		goto out2;
+		return error;
 	}
 
 	/* note: these must be after input_register_device */
@@ -278,11 +271,6 @@ static int msp430_ir_init(struct budget_ci *budget_ci)
 	saa7146_setgpio(saa, 3, SAA7146_GPIO_IRQHI);
 
 	return 0;
-
-out2:
-	input_free_device(input_dev);
-out1:
-	return error;
 }
 
 static void msp430_ir_deinit(struct budget_ci *budget_ci)
@@ -297,7 +285,7 @@ static void msp430_ir_deinit(struct budget_ci *budget_ci)
 	del_timer_sync(&dev->timer);
 	ir_input_nokey(dev, &budget_ci->ir.state);
 
-	input_unregister_device(dev);
+	ir_input_unregister(dev);
 }
 
 static int ciintf_read_attribute_mem(struct dvb_ca_en50221 *ca, int slot, int address)
@@ -1248,7 +1236,7 @@ static const struct stb0899_s1_reg tt3200_stb0899_s1_init_3[] = {
 	{ STB0899_TSCFGH        	, 0x0c },
 	{ STB0899_TSCFGM        	, 0x00 },
 	{ STB0899_TSCFGL        	, 0x0c },
-	{ STB0899_TSOUT			, 0x0d }, /* 0x0d for CAM */
+	{ STB0899_TSOUT			, 0x4d }, /* 0x0d for CAM */
 	{ STB0899_RSSYNCDEL     	, 0x00 },
 	{ STB0899_TSINHDELH     	, 0x02 },
 	{ STB0899_TSINHDELM		, 0x00 },
diff --git a/drivers/media/dvb/ttpci/budget-patch.c b/drivers/media/dvb/ttpci/budget-patch.c
index 60136688a9a4..9c92f9ddd223 100644
--- a/drivers/media/dvb/ttpci/budget-patch.c
+++ b/drivers/media/dvb/ttpci/budget-patch.c
@@ -456,7 +456,7 @@ static int budget_patch_attach (struct saa7146_dev* dev, struct saa7146_pci_exte
 	// use 0x03 to track RPS1 interrupts - increase by 1 every gpio3 is toggled
 	// use 0x15 to track VPE  interrupts - increase by 1 every vpeirq() is called
 	saa7146_write(dev, EC1SSR, (0x03<<2) | 3 );
-	// set event counter 1 treshold to maximum allowed value        (rEC p55)
+	// set event counter 1 threshold to maximum allowed value        (rEC p55)
 	saa7146_write(dev, ECT1R,  0x3fff );
 #endif
 	// Fix VSYNC level
diff --git a/drivers/media/dvb/ttusb-dec/ttusb_dec.c b/drivers/media/dvb/ttusb-dec/ttusb_dec.c
index d91e0638448f..53baccbab17f 100644
--- a/drivers/media/dvb/ttusb-dec/ttusb_dec.c
+++ b/drivers/media/dvb/ttusb-dec/ttusb_dec.c
@@ -1198,7 +1198,7 @@ static int ttusb_init_rc( struct ttusb_dec *dec)
 	int err;
 
 	usb_make_path(dec->udev, dec->rc_phys, sizeof(dec->rc_phys));
-	strlcpy(dec->rc_phys, "/input0", sizeof(dec->rc_phys));
+	strlcat(dec->rc_phys, "/input0", sizeof(dec->rc_phys));
 
 	input_dev = input_allocate_device();
 	if (!input_dev)
diff --git a/drivers/media/radio/Kconfig b/drivers/media/radio/Kconfig
index b134553eb3b5..3f40f375981b 100644
--- a/drivers/media/radio/Kconfig
+++ b/drivers/media/radio/Kconfig
@@ -197,7 +197,8 @@ config RADIO_MAESTRO
 
 config RADIO_MIROPCM20
 	tristate "miroSOUND PCM20 radio"
-	depends on ISA && VIDEO_V4L2
+	depends on ISA && VIDEO_V4L2 && SND
+	select SND_ISA
 	select SND_MIRO
 	---help---
 	  Choose Y here if you have this FM radio card. You also need to enable
@@ -214,13 +215,10 @@ config RADIO_MIROPCM20
 	  module will be called radio-miropcm20.
 
 config RADIO_SF16FMI
-	tristate "SF16FMI Radio"
+	tristate "SF16-FMI/SF16-FMP Radio"
 	depends on ISA && VIDEO_V4L2
 	---help---
-	  Choose Y here if you have one of these FM radio cards.  If you
-	  compile the driver into the kernel and your card is not PnP one, you
-	  have to add "sf16fm=<io>" to the kernel command line (I/O address is
-	  0x284 or 0x384).
+	  Choose Y here if you have one of these FM radio cards.
 
 	  In order to control your radio card, you will need to use programs
 	  that are compatible with the Video For Linux API.  Information on
@@ -419,4 +417,16 @@ config RADIO_TEA5764_XTAL
 	  Say Y here if TEA5764 have a 32768 Hz crystal in circuit, say N
 	  here if TEA5764 reference frequency is connected in FREQIN.
 
+config RADIO_TEF6862
+	tristate "TEF6862 Car Radio Enhanced Selectivity Tuner"
+	depends on I2C && VIDEO_V4L2
+	---help---
+	  Say Y here if you want to use the TEF6862 Car Radio Enhanced
+	  Selectivity Tuner, found for instance on the Russellville development
+	  board. On the russellville the device is connected to internal
+	  timberdale I2C bus.
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called TEF6862.
+
 endif # RADIO_ADAPTERS
diff --git a/drivers/media/radio/Makefile b/drivers/media/radio/Makefile
index 8a63d543ae41..01922ada6914 100644
--- a/drivers/media/radio/Makefile
+++ b/drivers/media/radio/Makefile
@@ -23,5 +23,6 @@ obj-$(CONFIG_USB_DSBR) += dsbr100.o
 obj-$(CONFIG_RADIO_SI470X) += si470x/
 obj-$(CONFIG_USB_MR800) += radio-mr800.o
 obj-$(CONFIG_RADIO_TEA5764) += radio-tea5764.o
+obj-$(CONFIG_RADIO_TEF6862) += tef6862.o
 
 EXTRA_CFLAGS += -Isound
diff --git a/drivers/media/radio/radio-aimslab.c b/drivers/media/radio/radio-aimslab.c
index 35edee009ba8..5bf4985daede 100644
--- a/drivers/media/radio/radio-aimslab.c
+++ b/drivers/media/radio/radio-aimslab.c
@@ -268,6 +268,8 @@ static int vidioc_s_frequency(struct file *file, void *priv,
 {
 	struct rtrack *rt = video_drvdata(file);
 
+	if (f->tuner != 0 || f->type != V4L2_TUNER_RADIO)
+		return -EINVAL;
 	rt_setfreq(rt, f->frequency);
 	return 0;
 }
@@ -277,6 +279,8 @@ static int vidioc_g_frequency(struct file *file, void *priv,
 {
 	struct rtrack *rt = video_drvdata(file);
 
+	if (f->tuner != 0)
+		return -EINVAL;
 	f->type = V4L2_TUNER_RADIO;
 	f->frequency = rt->curfreq;
 	return 0;
diff --git a/drivers/media/radio/radio-aztech.c b/drivers/media/radio/radio-aztech.c
index 8daf809eb01a..c22311393624 100644
--- a/drivers/media/radio/radio-aztech.c
+++ b/drivers/media/radio/radio-aztech.c
@@ -254,6 +254,8 @@ static int vidioc_s_frequency(struct file *file, void *priv,
 {
 	struct aztech *az = video_drvdata(file);
 
+	if (f->tuner != 0 || f->type != V4L2_TUNER_RADIO)
+		return -EINVAL;
 	az_setfreq(az, f->frequency);
 	return 0;
 }
@@ -263,6 +265,8 @@ static int vidioc_g_frequency(struct file *file, void *priv,
 {
 	struct aztech *az = video_drvdata(file);
 
+	if (f->tuner != 0)
+		return -EINVAL;
 	f->type = V4L2_TUNER_RADIO;
 	f->frequency = az->curfreq;
 	return 0;
diff --git a/drivers/media/radio/radio-gemtek-pci.c b/drivers/media/radio/radio-gemtek-pci.c
index c6cf11661868..000f4d34087c 100644
--- a/drivers/media/radio/radio-gemtek-pci.c
+++ b/drivers/media/radio/radio-gemtek-pci.c
@@ -240,6 +240,8 @@ static int vidioc_s_frequency(struct file *file, void *priv,
 {
 	struct gemtek_pci *card = video_drvdata(file);
 
+	if (f->tuner != 0 || f->type != V4L2_TUNER_RADIO)
+		return -EINVAL;
 	if (f->frequency < GEMTEK_PCI_RANGE_LOW ||
 	    f->frequency > GEMTEK_PCI_RANGE_HIGH)
 		return -EINVAL;
@@ -253,6 +255,8 @@ static int vidioc_g_frequency(struct file *file, void *priv,
 {
 	struct gemtek_pci *card = video_drvdata(file);
 
+	if (f->tuner != 0)
+		return -EINVAL;
 	f->type = V4L2_TUNER_RADIO;
 	f->frequency = card->current_frequency;
 	return 0;
diff --git a/drivers/media/radio/radio-maestro.c b/drivers/media/radio/radio-maestro.c
index 64d737c35acf..f8213b7c8ddc 100644
--- a/drivers/media/radio/radio-maestro.c
+++ b/drivers/media/radio/radio-maestro.c
@@ -200,6 +200,8 @@ static int vidioc_s_frequency(struct file *file, void *priv,
 {
 	struct maestro *dev = video_drvdata(file);
 
+	if (f->tuner != 0 || f->type != V4L2_TUNER_RADIO)
+		return -EINVAL;
 	if (f->frequency < FREQ_LO || f->frequency > FREQ_HI)
 		return -EINVAL;
 	mutex_lock(&dev->lock);
@@ -213,6 +215,8 @@ static int vidioc_g_frequency(struct file *file, void *priv,
 {
 	struct maestro *dev = video_drvdata(file);
 
+	if (f->tuner != 0)
+		return -EINVAL;
 	f->type = V4L2_TUNER_RADIO;
 	mutex_lock(&dev->lock);
 	f->frequency = BITS2FREQ(radio_bits_get(dev));
diff --git a/drivers/media/radio/radio-maxiradio.c b/drivers/media/radio/radio-maxiradio.c
index 3da51fe8fb93..44b4dbedb322 100644
--- a/drivers/media/radio/radio-maxiradio.c
+++ b/drivers/media/radio/radio-maxiradio.c
@@ -262,6 +262,8 @@ static int vidioc_s_frequency(struct file *file, void *priv,
 {
 	struct maxiradio *dev = video_drvdata(file);
 
+	if (f->tuner != 0 || f->type != V4L2_TUNER_RADIO)
+		return -EINVAL;
 	if (f->frequency < FREQ_LO || f->frequency > FREQ_HI) {
 		dprintk(dev, 1, "radio freq (%d.%02d MHz) out of range (%d-%d)\n",
 					f->frequency / 16000,
@@ -285,6 +287,8 @@ static int vidioc_g_frequency(struct file *file, void *priv,
 {
 	struct maxiradio *dev = video_drvdata(file);
 
+	if (f->tuner != 0)
+		return -EINVAL;
 	f->type = V4L2_TUNER_RADIO;
 	f->frequency = dev->freq;
 
diff --git a/drivers/media/radio/radio-mr800.c b/drivers/media/radio/radio-mr800.c
index a1239083472d..02a9cefc9a00 100644
--- a/drivers/media/radio/radio-mr800.c
+++ b/drivers/media/radio/radio-mr800.c
@@ -28,7 +28,7 @@
  * http://av-usbradio.sourceforge.net/index.php
  * http://sourceforge.net/projects/av-usbradio/
  * Latest release of theirs project was in 2005.
- * Probably, this driver could be improved trough using their
+ * Probably, this driver could be improved through using their
  * achievements (specifications given).
  * Also, Faidon Liambotis <paravoid@debian.org> wrote nice driver for this radio
  * in 2007. He allowed to use his driver to improve current mr800 radio driver.
@@ -85,6 +85,9 @@ MODULE_LICENSE("GPL");
 #define amradio_dev_warn(dev, fmt, arg...)				\
 		dev_warn(dev, MR800_DRIVER_NAME " - " fmt, ##arg)
 
+#define amradio_dev_err(dev, fmt, arg...) \
+		dev_err(dev, MR800_DRIVER_NAME " - " fmt, ##arg)
+
 /* Probably USB_TIMEOUT should be modified in module parameter */
 #define BUFFER_LENGTH 8
 #define USB_TIMEOUT 500
@@ -129,18 +132,20 @@ static int usb_amradio_resume(struct usb_interface *intf);
 struct amradio_device {
 	/* reference to USB and video device */
 	struct usb_device *usbdev;
-	struct video_device *videodev;
+	struct usb_interface *intf;
+	struct video_device videodev;
 	struct v4l2_device v4l2_dev;
 
 	unsigned char *buffer;
 	struct mutex lock;	/* buffer locking */
 	int curfreq;
 	int stereo;
-	int users;
-	int removed;
 	int muted;
+	int initialized;
 };
 
+#define vdev_to_amradio(r) container_of(r, struct amradio_device, videodev)
+
 /* USB Device ID List */
 static struct usb_device_id usb_amradio_device_table[] = {
 	{USB_DEVICE_AND_INTERFACE_INFO(USB_AMRADIO_VENDOR, USB_AMRADIO_PRODUCT,
@@ -159,7 +164,7 @@ static struct usb_driver usb_amradio_driver = {
 	.resume			= usb_amradio_resume,
 	.reset_resume		= usb_amradio_resume,
 	.id_table		= usb_amradio_device_table,
-	.supports_autosuspend	= 0,
+	.supports_autosuspend	= 1,
 };
 
 /* switch on/off the radio. Send 8 bytes to device */
@@ -168,11 +173,7 @@ static int amradio_set_mute(struct amradio_device *radio, char argument)
 	int retval;
 	int size;
 
-	/* safety check */
-	if (radio->removed)
-		return -EIO;
-
-	mutex_lock(&radio->lock);
+	BUG_ON(!mutex_is_locked(&radio->lock));
 
 	radio->buffer[0] = 0x00;
 	radio->buffer[1] = 0x55;
@@ -187,14 +188,12 @@ static int amradio_set_mute(struct amradio_device *radio, char argument)
 		(void *) (radio->buffer), BUFFER_LENGTH, &size, USB_TIMEOUT);
 
 	if (retval < 0 || size != BUFFER_LENGTH) {
-		mutex_unlock(&radio->lock);
+		amradio_dev_warn(&radio->videodev.dev, "set mute failed\n");
 		return retval;
 	}
 
 	radio->muted = argument;
 
-	mutex_unlock(&radio->lock);
-
 	return retval;
 }
 
@@ -205,11 +204,7 @@ static int amradio_setfreq(struct amradio_device *radio, int freq)
 	int size;
 	unsigned short freq_send = 0x10 + (freq >> 3) / 25;
 
-	/* safety check */
-	if (radio->removed)
-		return -EIO;
-
-	mutex_lock(&radio->lock);
+	BUG_ON(!mutex_is_locked(&radio->lock));
 
 	radio->buffer[0] = 0x00;
 	radio->buffer[1] = 0x55;
@@ -223,10 +218,8 @@ static int amradio_setfreq(struct amradio_device *radio, int freq)
 	retval = usb_bulk_msg(radio->usbdev, usb_sndintpipe(radio->usbdev, 2),
 		(void *) (radio->buffer), BUFFER_LENGTH, &size, USB_TIMEOUT);
 
-	if (retval < 0 || size != BUFFER_LENGTH) {
-		mutex_unlock(&radio->lock);
-		return retval;
-	}
+	if (retval < 0 || size != BUFFER_LENGTH)
+		goto out_err;
 
 	/* frequency is calculated from freq_send and placed in first 2 bytes */
 	radio->buffer[0] = (freq_send >> 8) & 0xff;
@@ -240,13 +233,15 @@ static int amradio_setfreq(struct amradio_device *radio, int freq)
 	retval = usb_bulk_msg(radio->usbdev, usb_sndintpipe(radio->usbdev, 2),
 		(void *) (radio->buffer), BUFFER_LENGTH, &size, USB_TIMEOUT);
 
-	if (retval < 0 || size != BUFFER_LENGTH) {
-		mutex_unlock(&radio->lock);
-		return retval;
-	}
+	if (retval < 0 || size != BUFFER_LENGTH)
+		goto out_err;
 
-	mutex_unlock(&radio->lock);
+	radio->curfreq = freq;
+	goto out;
 
+out_err:
+	amradio_dev_warn(&radio->videodev.dev, "set frequency failed\n");
+out:
 	return retval;
 }
 
@@ -255,11 +250,7 @@ static int amradio_set_stereo(struct amradio_device *radio, char argument)
 	int retval;
 	int size;
 
-	/* safety check */
-	if (radio->removed)
-		return -EIO;
-
-	mutex_lock(&radio->lock);
+	BUG_ON(!mutex_is_locked(&radio->lock));
 
 	radio->buffer[0] = 0x00;
 	radio->buffer[1] = 0x55;
@@ -274,14 +265,14 @@ static int amradio_set_stereo(struct amradio_device *radio, char argument)
 		(void *) (radio->buffer), BUFFER_LENGTH, &size, USB_TIMEOUT);
 
 	if (retval < 0 || size != BUFFER_LENGTH) {
-		radio->stereo = -1;
-		mutex_unlock(&radio->lock);
+		amradio_dev_warn(&radio->videodev.dev, "set stereo failed\n");
 		return retval;
 	}
 
-	radio->stereo = 1;
-
-	mutex_unlock(&radio->lock);
+	if (argument == WANT_STEREO)
+		radio->stereo = 1;
+	else
+		radio->stereo = 0;
 
 	return retval;
 }
@@ -296,19 +287,19 @@ static void usb_amradio_disconnect(struct usb_interface *intf)
 	struct amradio_device *radio = usb_get_intfdata(intf);
 
 	mutex_lock(&radio->lock);
-	radio->removed = 1;
+	radio->usbdev = NULL;
 	mutex_unlock(&radio->lock);
 
 	usb_set_intfdata(intf, NULL);
-	video_unregister_device(radio->videodev);
 	v4l2_device_disconnect(&radio->v4l2_dev);
+	video_unregister_device(&radio->videodev);
 }
 
 /* vidioc_querycap - query device capabilities */
 static int vidioc_querycap(struct file *file, void *priv,
 					struct v4l2_capability *v)
 {
-	struct amradio_device *radio = video_drvdata(file);
+	struct amradio_device *radio = file->private_data;
 
 	strlcpy(v->driver, "radio-mr800", sizeof(v->driver));
 	strlcpy(v->card, "AverMedia MR 800 USB FM Radio", sizeof(v->card));
@@ -322,13 +313,9 @@ static int vidioc_querycap(struct file *file, void *priv,
 static int vidioc_g_tuner(struct file *file, void *priv,
 				struct v4l2_tuner *v)
 {
-	struct amradio_device *radio = video_get_drvdata(video_devdata(file));
+	struct amradio_device *radio = file->private_data;
 	int retval;
 
-	/* safety check */
-	if (radio->removed)
-		return -EIO;
-
 	if (v->index > 0)
 		return -EINVAL;
 
@@ -341,9 +328,6 @@ static int vidioc_g_tuner(struct file *file, void *priv,
  * amradio_set_stereo shouldn't be here
  */
 	retval = amradio_set_stereo(radio, WANT_STEREO);
-	if (retval < 0)
-		amradio_dev_warn(&radio->videodev->dev,
-			"set stereo failed\n");
 
 	strcpy(v->name, "FM");
 	v->type = V4L2_TUNER_RADIO;
@@ -357,19 +341,16 @@ static int vidioc_g_tuner(struct file *file, void *priv,
 		v->audmode = V4L2_TUNER_MODE_MONO;
 	v->signal = 0xffff;     /* Can't get the signal strength, sad.. */
 	v->afc = 0; /* Don't know what is this */
-	return 0;
+
+	return retval;
 }
 
 /* vidioc_s_tuner - set tuner attributes */
 static int vidioc_s_tuner(struct file *file, void *priv,
 				struct v4l2_tuner *v)
 {
-	struct amradio_device *radio = video_get_drvdata(video_devdata(file));
-	int retval;
-
-	/* safety check */
-	if (radio->removed)
-		return -EIO;
+	struct amradio_device *radio = file->private_data;
+	int retval = -EINVAL;
 
 	if (v->index > 0)
 		return -EINVAL;
@@ -378,57 +359,37 @@ static int vidioc_s_tuner(struct file *file, void *priv,
 	switch (v->audmode) {
 	case V4L2_TUNER_MODE_MONO:
 		retval = amradio_set_stereo(radio, WANT_MONO);
-		if (retval < 0)
-			amradio_dev_warn(&radio->videodev->dev,
-				"set mono failed\n");
 		break;
 	case V4L2_TUNER_MODE_STEREO:
 		retval = amradio_set_stereo(radio, WANT_STEREO);
-		if (retval < 0)
-			amradio_dev_warn(&radio->videodev->dev,
-				"set stereo failed\n");
 		break;
-	default:
-		return -EINVAL;
 	}
 
-	return 0;
+	return retval;
 }
 
 /* vidioc_s_frequency - set tuner radio frequency */
 static int vidioc_s_frequency(struct file *file, void *priv,
 				struct v4l2_frequency *f)
 {
-	struct amradio_device *radio = video_get_drvdata(video_devdata(file));
-	int retval;
-
-	/* safety check */
-	if (radio->removed)
-		return -EIO;
+	struct amradio_device *radio = file->private_data;
 
-	mutex_lock(&radio->lock);
-	radio->curfreq = f->frequency;
-	mutex_unlock(&radio->lock);
-
-	retval = amradio_setfreq(radio, radio->curfreq);
-	if (retval < 0)
-		amradio_dev_warn(&radio->videodev->dev,
-			"set frequency failed\n");
-	return 0;
+	if (f->tuner != 0 || f->type != V4L2_TUNER_RADIO)
+		return -EINVAL;
+	return amradio_setfreq(radio, f->frequency);
 }
 
 /* vidioc_g_frequency - get tuner radio frequency */
 static int vidioc_g_frequency(struct file *file, void *priv,
 				struct v4l2_frequency *f)
 {
-	struct amradio_device *radio = video_get_drvdata(video_devdata(file));
-
-	/* safety check */
-	if (radio->removed)
-		return -EIO;
+	struct amradio_device *radio = file->private_data;
 
+	if (f->tuner != 0)
+		return -EINVAL;
 	f->type = V4L2_TUNER_RADIO;
 	f->frequency = radio->curfreq;
+
 	return 0;
 }
 
@@ -448,17 +409,14 @@ static int vidioc_queryctrl(struct file *file, void *priv,
 static int vidioc_g_ctrl(struct file *file, void *priv,
 				struct v4l2_control *ctrl)
 {
-	struct amradio_device *radio = video_get_drvdata(video_devdata(file));
-
-	/* safety check */
-	if (radio->removed)
-		return -EIO;
+	struct amradio_device *radio = file->private_data;
 
 	switch (ctrl->id) {
 	case V4L2_CID_AUDIO_MUTE:
 		ctrl->value = radio->muted;
 		return 0;
 	}
+
 	return -EINVAL;
 }
 
@@ -466,33 +424,20 @@ static int vidioc_g_ctrl(struct file *file, void *priv,
 static int vidioc_s_ctrl(struct file *file, void *priv,
 				struct v4l2_control *ctrl)
 {
-	struct amradio_device *radio = video_get_drvdata(video_devdata(file));
-	int retval;
-
-	/* safety check */
-	if (radio->removed)
-		return -EIO;
+	struct amradio_device *radio = file->private_data;
+	int retval = -EINVAL;
 
 	switch (ctrl->id) {
 	case V4L2_CID_AUDIO_MUTE:
-		if (ctrl->value) {
+		if (ctrl->value)
 			retval = amradio_set_mute(radio, AMRADIO_STOP);
-			if (retval < 0) {
-				amradio_dev_warn(&radio->videodev->dev,
-					"amradio_stop failed\n");
-				return -1;
-			}
-		} else {
+		else
 			retval = amradio_set_mute(radio, AMRADIO_START);
-			if (retval < 0) {
-				amradio_dev_warn(&radio->videodev->dev,
-					"amradio_start failed\n");
-				return -1;
-			}
-		}
-		return 0;
+
+		break;
 	}
-	return -EINVAL;
+
+	return retval;
 }
 
 /* vidioc_g_audio - get audio attributes */
@@ -531,75 +476,108 @@ static int vidioc_s_input(struct file *filp, void *priv, unsigned int i)
 	return 0;
 }
 
-/* open device - amradio_start() and amradio_setfreq() */
-static int usb_amradio_open(struct file *file)
+static int usb_amradio_init(struct amradio_device *radio)
 {
-	struct amradio_device *radio = video_get_drvdata(video_devdata(file));
 	int retval;
 
-	lock_kernel();
+	retval = amradio_set_mute(radio, AMRADIO_STOP);
+	if (retval)
+		goto out_err;
 
-	radio->users = 1;
-	radio->muted = 1;
+	retval = amradio_set_stereo(radio, WANT_STEREO);
+	if (retval)
+		goto out_err;
 
-	retval = amradio_set_mute(radio, AMRADIO_START);
-	if (retval < 0) {
-		amradio_dev_warn(&radio->videodev->dev,
-			"radio did not start up properly\n");
-		radio->users = 0;
-		unlock_kernel();
-		return -EIO;
+	radio->initialized = 1;
+	goto out;
+
+out_err:
+	amradio_dev_err(&radio->videodev.dev, "initialization failed\n");
+out:
+	return retval;
+}
+
+/* open device - amradio_start() and amradio_setfreq() */
+static int usb_amradio_open(struct file *file)
+{
+	struct amradio_device *radio = vdev_to_amradio(video_devdata(file));
+	int retval = 0;
+
+	mutex_lock(&radio->lock);
+
+	if (!radio->usbdev) {
+		retval = -EIO;
+		goto unlock;
 	}
 
-	retval = amradio_set_stereo(radio, WANT_STEREO);
-	if (retval < 0)
-		amradio_dev_warn(&radio->videodev->dev,
-			"set stereo failed\n");
+	file->private_data = radio;
+	retval = usb_autopm_get_interface(radio->intf);
+	if (retval)
+		goto unlock;
 
-	retval = amradio_setfreq(radio, radio->curfreq);
-	if (retval < 0)
-		amradio_dev_warn(&radio->videodev->dev,
-			"set frequency failed\n");
+	if (unlikely(!radio->initialized)) {
+		retval = usb_amradio_init(radio);
+		if (retval)
+			usb_autopm_put_interface(radio->intf);
+	}
 
-	unlock_kernel();
-	return 0;
+unlock:
+	mutex_unlock(&radio->lock);
+	return retval;
 }
 
 /*close device */
 static int usb_amradio_close(struct file *file)
 {
-	struct amradio_device *radio = video_get_drvdata(video_devdata(file));
-	int retval;
-
-	if (!radio)
-		return -ENODEV;
+	struct amradio_device *radio = file->private_data;
+	int retval = 0;
 
 	mutex_lock(&radio->lock);
-	radio->users = 0;
+
+	if (!radio->usbdev)
+		retval = -EIO;
+	else
+		usb_autopm_put_interface(radio->intf);
+
 	mutex_unlock(&radio->lock);
+	return retval;
+}
+
+static long usb_amradio_ioctl(struct file *file, unsigned int cmd,
+				unsigned long arg)
+{
+	struct amradio_device *radio = file->private_data;
+	long retval = 0;
 
-	if (!radio->removed) {
-		retval = amradio_set_mute(radio, AMRADIO_STOP);
-		if (retval < 0)
-			amradio_dev_warn(&radio->videodev->dev,
-				"amradio_stop failed\n");
+	mutex_lock(&radio->lock);
+
+	if (!radio->usbdev) {
+		retval = -EIO;
+		goto unlock;
 	}
 
-	return 0;
+	retval = video_ioctl2(file, cmd, arg);
+
+unlock:
+	mutex_unlock(&radio->lock);
+	return retval;
 }
 
 /* Suspend device - stop device. Need to be checked and fixed */
 static int usb_amradio_suspend(struct usb_interface *intf, pm_message_t message)
 {
 	struct amradio_device *radio = usb_get_intfdata(intf);
-	int retval;
 
-	retval = amradio_set_mute(radio, AMRADIO_STOP);
-	if (retval < 0)
-		dev_warn(&intf->dev, "amradio_stop failed\n");
+	mutex_lock(&radio->lock);
+
+	if (!radio->muted && radio->initialized) {
+		amradio_set_mute(radio, AMRADIO_STOP);
+		radio->muted = 0;
+	}
 
 	dev_info(&intf->dev, "going into suspend..\n");
 
+	mutex_unlock(&radio->lock);
 	return 0;
 }
 
@@ -607,14 +585,26 @@ static int usb_amradio_suspend(struct usb_interface *intf, pm_message_t message)
 static int usb_amradio_resume(struct usb_interface *intf)
 {
 	struct amradio_device *radio = usb_get_intfdata(intf);
-	int retval;
 
-	retval = amradio_set_mute(radio, AMRADIO_START);
-	if (retval < 0)
-		dev_warn(&intf->dev, "amradio_start failed\n");
+	mutex_lock(&radio->lock);
+
+	if (unlikely(!radio->initialized))
+		goto unlock;
+
+	if (radio->stereo)
+		amradio_set_stereo(radio, WANT_STEREO);
+	else
+		amradio_set_stereo(radio, WANT_MONO);
+
+	amradio_setfreq(radio, radio->curfreq);
+
+	if (!radio->muted)
+		amradio_set_mute(radio, AMRADIO_START);
 
+unlock:
 	dev_info(&intf->dev, "coming out of suspend..\n");
 
+	mutex_unlock(&radio->lock);
 	return 0;
 }
 
@@ -623,7 +613,7 @@ static const struct v4l2_file_operations usb_amradio_fops = {
 	.owner		= THIS_MODULE,
 	.open		= usb_amradio_open,
 	.release	= usb_amradio_close,
-	.ioctl		= video_ioctl2,
+	.ioctl		= usb_amradio_ioctl,
 };
 
 static const struct v4l2_ioctl_ops usb_amradio_ioctl_ops = {
@@ -643,10 +633,7 @@ static const struct v4l2_ioctl_ops usb_amradio_ioctl_ops = {
 
 static void usb_amradio_video_device_release(struct video_device *videodev)
 {
-	struct amradio_device *radio = video_get_drvdata(videodev);
-
-	/* we call v4l to free radio->videodev */
-	video_device_release(videodev);
+	struct amradio_device *radio = vdev_to_amradio(videodev);
 
 	v4l2_device_unregister(&radio->v4l2_dev);
 
@@ -660,70 +647,63 @@ static int usb_amradio_probe(struct usb_interface *intf,
 				const struct usb_device_id *id)
 {
 	struct amradio_device *radio;
-	struct v4l2_device *v4l2_dev;
-	int retval;
+	int retval = 0;
 
 	radio = kzalloc(sizeof(struct amradio_device), GFP_KERNEL);
 
 	if (!radio) {
 		dev_err(&intf->dev, "kmalloc for amradio_device failed\n");
-		return -ENOMEM;
+		retval = -ENOMEM;
+		goto err;
 	}
 
 	radio->buffer = kmalloc(BUFFER_LENGTH, GFP_KERNEL);
 
 	if (!radio->buffer) {
 		dev_err(&intf->dev, "kmalloc for radio->buffer failed\n");
-		kfree(radio);
-		return -ENOMEM;
+		retval = -ENOMEM;
+		goto err_nobuf;
 	}
 
-	v4l2_dev = &radio->v4l2_dev;
-	retval = v4l2_device_register(&intf->dev, v4l2_dev);
+	retval = v4l2_device_register(&intf->dev, &radio->v4l2_dev);
 	if (retval < 0) {
 		dev_err(&intf->dev, "couldn't register v4l2_device\n");
-		kfree(radio->buffer);
-		kfree(radio);
-		return retval;
-	}
-
-	radio->videodev = video_device_alloc();
-
-	if (!radio->videodev) {
-		dev_err(&intf->dev, "video_device_alloc failed\n");
-		kfree(radio->buffer);
-		kfree(radio);
-		return -ENOMEM;
+		goto err_v4l2;
 	}
 
-	strlcpy(radio->videodev->name, v4l2_dev->name, sizeof(radio->videodev->name));
-	radio->videodev->v4l2_dev = v4l2_dev;
-	radio->videodev->fops = &usb_amradio_fops;
-	radio->videodev->ioctl_ops = &usb_amradio_ioctl_ops;
-	radio->videodev->release = usb_amradio_video_device_release;
+	strlcpy(radio->videodev.name, radio->v4l2_dev.name,
+		sizeof(radio->videodev.name));
+	radio->videodev.v4l2_dev = &radio->v4l2_dev;
+	radio->videodev.fops = &usb_amradio_fops;
+	radio->videodev.ioctl_ops = &usb_amradio_ioctl_ops;
+	radio->videodev.release = usb_amradio_video_device_release;
 
-	radio->removed = 0;
-	radio->users = 0;
 	radio->usbdev = interface_to_usbdev(intf);
+	radio->intf = intf;
 	radio->curfreq = 95.16 * FREQ_MUL;
-	radio->stereo = -1;
 
 	mutex_init(&radio->lock);
 
-	video_set_drvdata(radio->videodev, radio);
+	video_set_drvdata(&radio->videodev, radio);
 
-	retval = video_register_device(radio->videodev,	VFL_TYPE_RADIO,	radio_nr);
+	retval = video_register_device(&radio->videodev, VFL_TYPE_RADIO,
+					radio_nr);
 	if (retval < 0) {
 		dev_err(&intf->dev, "could not register video device\n");
-		video_device_release(radio->videodev);
-		v4l2_device_unregister(v4l2_dev);
-		kfree(radio->buffer);
-		kfree(radio);
-		return -EIO;
+		goto err_vdev;
 	}
 
 	usb_set_intfdata(intf, radio);
 	return 0;
+
+err_vdev:
+	v4l2_device_unregister(&radio->v4l2_dev);
+err_v4l2:
+	kfree(radio->buffer);
+err_nobuf:
+	kfree(radio);
+err:
+	return retval;
 }
 
 static int __init amradio_init(void)
diff --git a/drivers/media/radio/radio-rtrack2.c b/drivers/media/radio/radio-rtrack2.c
index 9cb193fa6e33..a79296aac9a9 100644
--- a/drivers/media/radio/radio-rtrack2.c
+++ b/drivers/media/radio/radio-rtrack2.c
@@ -167,6 +167,8 @@ static int vidioc_s_frequency(struct file *file, void *priv,
 {
 	struct rtrack2 *rt = video_drvdata(file);
 
+	if (f->tuner != 0 || f->type != V4L2_TUNER_RADIO)
+		return -EINVAL;
 	rt_setfreq(rt, f->frequency);
 	return 0;
 }
@@ -176,6 +178,8 @@ static int vidioc_g_frequency(struct file *file, void *priv,
 {
 	struct rtrack2 *rt = video_drvdata(file);
 
+	if (f->tuner != 0)
+		return -EINVAL;
 	f->type = V4L2_TUNER_RADIO;
 	f->frequency = rt->curfreq;
 	return 0;
diff --git a/drivers/media/radio/radio-sf16fmi.c b/drivers/media/radio/radio-sf16fmi.c
index 49c4aab95dab..985359d18aa5 100644
--- a/drivers/media/radio/radio-sf16fmi.c
+++ b/drivers/media/radio/radio-sf16fmi.c
@@ -1,4 +1,4 @@
-/* SF16FMI radio driver for Linux radio support
+/* SF16-FMI and SF16-FMP radio driver for Linux radio support
  * heavily based on rtrack driver...
  * (c) 1997 M. Kirkwood
  * (c) 1998 Petr Vandrovec, vandrove@vc.cvut.cz
@@ -11,7 +11,7 @@
  *
  *  Frequency control is done digitally -- ie out(port,encodefreq(95.8));
  *  No volume control - only mute/unmute - you have to use line volume
- *  control on SB-part of SF16FMI
+ *  control on SB-part of SF16-FMI/SF16-FMP
  *
  * Converted to V4L2 API by Mauro Carvalho Chehab <mchehab@infradead.org>
  */
@@ -30,14 +30,14 @@
 #include <media/v4l2-ioctl.h>
 
 MODULE_AUTHOR("Petr Vandrovec, vandrove@vc.cvut.cz and M. Kirkwood");
-MODULE_DESCRIPTION("A driver for the SF16MI radio.");
+MODULE_DESCRIPTION("A driver for the SF16-FMI and SF16-FMP radio.");
 MODULE_LICENSE("GPL");
 
 static int io = -1;
 static int radio_nr = -1;
 
 module_param(io, int, 0);
-MODULE_PARM_DESC(io, "I/O address of the SF16MI card (0x284 or 0x384)");
+MODULE_PARM_DESC(io, "I/O address of the SF16-FMI or SF16-FMP card (0x284 or 0x384)");
 module_param(radio_nr, int, 0);
 
 #define RADIO_VERSION KERNEL_VERSION(0, 0, 2)
@@ -47,13 +47,14 @@ struct fmi
 	struct v4l2_device v4l2_dev;
 	struct video_device vdev;
 	int io;
-	int curvol; /* 1 or 0 */
+	bool mute;
 	unsigned long curfreq; /* freq in kHz */
 	struct mutex lock;
 };
 
 static struct fmi fmi_card;
 static struct pnp_dev *dev;
+bool pnp_attached;
 
 /* freq is in 1/16 kHz to internal number, hw precision is 50 kHz */
 /* It is only useful to give freq in interval of 800 (=0.05Mhz),
@@ -105,7 +106,7 @@ static inline int fmi_setfreq(struct fmi *fmi, unsigned long freq)
 	outbits(8, 0xC0, fmi->io);
 	msleep(143);		/* was schedule_timeout(HZ/7) */
 	mutex_unlock(&fmi->lock);
-	if (fmi->curvol)
+	if (!fmi->mute)
 		fmi_unmute(fmi);
 	return 0;
 }
@@ -116,7 +117,7 @@ static inline int fmi_getsigstr(struct fmi *fmi)
 	int res;
 
 	mutex_lock(&fmi->lock);
-	val = fmi->curvol ? 0x08 : 0x00;	/* unmute/mute */
+	val = fmi->mute ? 0x00 : 0x08;	/* mute/unmute */
 	outb(val, fmi->io);
 	outb(val | 0x10, fmi->io);
 	msleep(143); 		/* was schedule_timeout(HZ/7) */
@@ -168,6 +169,8 @@ static int vidioc_s_frequency(struct file *file, void *priv,
 {
 	struct fmi *fmi = video_drvdata(file);
 
+	if (f->tuner != 0 || f->type != V4L2_TUNER_RADIO)
+		return -EINVAL;
 	if (f->frequency < RSF16_MINFREQ ||
 			f->frequency > RSF16_MAXFREQ)
 		return -EINVAL;
@@ -182,6 +185,8 @@ static int vidioc_g_frequency(struct file *file, void *priv,
 {
 	struct fmi *fmi = video_drvdata(file);
 
+	if (f->tuner != 0)
+		return -EINVAL;
 	f->type = V4L2_TUNER_RADIO;
 	f->frequency = fmi->curfreq;
 	return 0;
@@ -204,7 +209,7 @@ static int vidioc_g_ctrl(struct file *file, void *priv,
 
 	switch (ctrl->id) {
 	case V4L2_CID_AUDIO_MUTE:
-		ctrl->value = fmi->curvol;
+		ctrl->value = fmi->mute;
 		return 0;
 	}
 	return -EINVAL;
@@ -221,7 +226,7 @@ static int vidioc_s_ctrl(struct file *file, void *priv,
 			fmi_mute(fmi);
 		else
 			fmi_unmute(fmi);
-		fmi->curvol = ctrl->value;
+		fmi->mute = ctrl->value;
 		return 0;
 	}
 	return -EINVAL;
@@ -316,26 +321,54 @@ static int __init fmi_init(void)
 {
 	struct fmi *fmi = &fmi_card;
 	struct v4l2_device *v4l2_dev = &fmi->v4l2_dev;
-	int res;
+	int res, i;
+	int probe_ports[] = { 0, 0x284, 0x384 };
+
+	if (io < 0) {
+		for (i = 0; i < ARRAY_SIZE(probe_ports); i++) {
+			io = probe_ports[i];
+			if (io == 0) {
+				io = isapnp_fmi_probe();
+				if (io < 0)
+					continue;
+				pnp_attached = 1;
+			}
+			if (!request_region(io, 2, "radio-sf16fmi")) {
+				if (pnp_attached)
+					pnp_device_detach(dev);
+				io = -1;
+				continue;
+			}
+			if (pnp_attached ||
+			    ((inb(io) & 0xf9) == 0xf9 && (inb(io) & 0x4) == 0))
+				break;
+			release_region(io, 2);
+			io = -1;
+		}
+	} else {
+		if (!request_region(io, 2, "radio-sf16fmi")) {
+			printk(KERN_ERR "radio-sf16fmi: port %#x already in use\n", io);
+			return -EBUSY;
+		}
+		if (inb(io) == 0xff) {
+			printk(KERN_ERR "radio-sf16fmi: card not present at %#x\n", io);
+			release_region(io, 2);
+			return -ENODEV;
+		}
+	}
+	if (io < 0) {
+		printk(KERN_ERR "radio-sf16fmi: no cards found\n");
+		return -ENODEV;
+	}
 
-	if (io < 0)
-		io = isapnp_fmi_probe();
 	strlcpy(v4l2_dev->name, "sf16fmi", sizeof(v4l2_dev->name));
 	fmi->io = io;
-	if (fmi->io < 0) {
-		v4l2_err(v4l2_dev, "No PnP card found.\n");
-		return fmi->io;
-	}
-	if (!request_region(io, 2, "radio-sf16fmi")) {
-		v4l2_err(v4l2_dev, "port 0x%x already in use\n", fmi->io);
-		pnp_device_detach(dev);
-		return -EBUSY;
-	}
 
 	res = v4l2_device_register(NULL, v4l2_dev);
 	if (res < 0) {
 		release_region(fmi->io, 2);
-		pnp_device_detach(dev);
+		if (pnp_attached)
+			pnp_device_detach(dev);
 		v4l2_err(v4l2_dev, "Could not register v4l2_device\n");
 		return res;
 	}
@@ -352,7 +385,8 @@ static int __init fmi_init(void)
 	if (video_register_device(&fmi->vdev, VFL_TYPE_RADIO, radio_nr) < 0) {
 		v4l2_device_unregister(v4l2_dev);
 		release_region(fmi->io, 2);
-		pnp_device_detach(dev);
+		if (pnp_attached)
+			pnp_device_detach(dev);
 		return -EINVAL;
 	}
 
@@ -369,7 +403,7 @@ static void __exit fmi_exit(void)
 	video_unregister_device(&fmi->vdev);
 	v4l2_device_unregister(&fmi->v4l2_dev);
 	release_region(fmi->io, 2);
-	if (dev)
+	if (dev && pnp_attached)
 		pnp_device_detach(dev);
 }
 
diff --git a/drivers/media/radio/radio-sf16fmr2.c b/drivers/media/radio/radio-sf16fmr2.c
index a11414f648d4..52c7bbb32b8b 100644
--- a/drivers/media/radio/radio-sf16fmr2.c
+++ b/drivers/media/radio/radio-sf16fmr2.c
@@ -251,6 +251,8 @@ static int vidioc_s_frequency(struct file *file, void *priv,
 {
 	struct fmr2 *fmr2 = video_drvdata(file);
 
+	if (f->tuner != 0 || f->type != V4L2_TUNER_RADIO)
+		return -EINVAL;
 	if (f->frequency < RSF16_MINFREQ ||
 			f->frequency > RSF16_MAXFREQ)
 		return -EINVAL;
@@ -272,6 +274,8 @@ static int vidioc_g_frequency(struct file *file, void *priv,
 {
 	struct fmr2 *fmr2 = video_drvdata(file);
 
+	if (f->tuner != 0)
+		return -EINVAL;
 	f->type = V4L2_TUNER_RADIO;
 	f->frequency = fmr2->curfreq;
 	return 0;
diff --git a/drivers/media/radio/radio-tea5764.c b/drivers/media/radio/radio-tea5764.c
index 3cd76dddb6aa..8e718bfcdad3 100644
--- a/drivers/media/radio/radio-tea5764.c
+++ b/drivers/media/radio/radio-tea5764.c
@@ -314,7 +314,7 @@ static int vidioc_g_tuner(struct file *file, void *priv,
 	if (v->index > 0)
 		return -EINVAL;
 
-	memset(v, 0, sizeof(v));
+	memset(v, 0, sizeof(*v));
 	strcpy(v->name, "FM");
 	v->type = V4L2_TUNER_RADIO;
 	tea5764_i2c_read(radio);
@@ -349,7 +349,7 @@ static int vidioc_s_frequency(struct file *file, void *priv,
 {
 	struct tea5764_device *radio = video_drvdata(file);
 
-	if (f->tuner != 0)
+	if (f->tuner != 0 || f->type != V4L2_TUNER_RADIO)
 		return -EINVAL;
 	if (f->frequency == 0) {
 		/* We special case this as a power down control. */
@@ -370,8 +370,10 @@ static int vidioc_g_frequency(struct file *file, void *priv,
 	struct tea5764_device *radio = video_drvdata(file);
 	struct tea5764_regs *r = &radio->regs;
 
+	if (f->tuner != 0)
+		return -EINVAL;
 	tea5764_i2c_read(radio);
-	memset(f, 0, sizeof(f));
+	memset(f, 0, sizeof(*f));
 	f->type = V4L2_TUNER_RADIO;
 	if (r->tnctrl & TEA5764_TNCTRL_PUPD0)
 		f->frequency = (tea5764_get_freq(radio) * 2) / 125;
@@ -458,12 +460,8 @@ static int vidioc_s_audio(struct file *file, void *priv,
 static int tea5764_open(struct file *file)
 {
 	/* Currently we support only one device */
-	int minor = video_devdata(file)->minor;
 	struct tea5764_device *radio = video_drvdata(file);
 
-	if (radio->videodev->minor != minor)
-		return -ENODEV;
-
 	mutex_lock(&radio->mutex);
 	/* Only exclusive access */
 	if (radio->users) {
diff --git a/drivers/media/radio/radio-terratec.c b/drivers/media/radio/radio-terratec.c
index 699db9acaaf7..fc1c860fd438 100644
--- a/drivers/media/radio/radio-terratec.c
+++ b/drivers/media/radio/radio-terratec.c
@@ -240,6 +240,8 @@ static int vidioc_s_frequency(struct file *file, void *priv,
 {
 	struct terratec *tt = video_drvdata(file);
 
+	if (f->tuner != 0 || f->type != V4L2_TUNER_RADIO)
+		return -EINVAL;
 	tt_setfreq(tt, f->frequency);
 	return 0;
 }
@@ -249,6 +251,8 @@ static int vidioc_g_frequency(struct file *file, void *priv,
 {
 	struct terratec *tt = video_drvdata(file);
 
+	if (f->tuner != 0)
+		return -EINVAL;
 	f->type = V4L2_TUNER_RADIO;
 	f->frequency = tt->curfreq;
 	return 0;
diff --git a/drivers/media/radio/radio-trust.c b/drivers/media/radio/radio-trust.c
index 6f9ecc359356..9d6dcf8af5b0 100644
--- a/drivers/media/radio/radio-trust.c
+++ b/drivers/media/radio/radio-trust.c
@@ -239,6 +239,8 @@ static int vidioc_s_frequency(struct file *file, void *priv,
 {
 	struct trust *tr = video_drvdata(file);
 
+	if (f->tuner != 0 || f->type != V4L2_TUNER_RADIO)
+		return -EINVAL;
 	tr_setfreq(tr, f->frequency);
 	return 0;
 }
@@ -248,6 +250,8 @@ static int vidioc_g_frequency(struct file *file, void *priv,
 {
 	struct trust *tr = video_drvdata(file);
 
+	if (f->tuner != 0)
+		return -EINVAL;
 	f->type = V4L2_TUNER_RADIO;
 	f->frequency = tr->curfreq;
 	return 0;
diff --git a/drivers/media/radio/radio-typhoon.c b/drivers/media/radio/radio-typhoon.c
index 3a98f1399495..03439282dfce 100644
--- a/drivers/media/radio/radio-typhoon.c
+++ b/drivers/media/radio/radio-typhoon.c
@@ -207,6 +207,8 @@ static int vidioc_g_frequency(struct file *file, void *priv,
 {
 	struct typhoon *dev = video_drvdata(file);
 
+	if (f->tuner != 0)
+		return -EINVAL;
 	f->type = V4L2_TUNER_RADIO;
 	f->frequency = dev->curfreq;
 	return 0;
@@ -217,6 +219,8 @@ static int vidioc_s_frequency(struct file *file, void *priv,
 {
 	struct typhoon *dev = video_drvdata(file);
 
+	if (f->tuner != 0 || f->type != V4L2_TUNER_RADIO)
+		return -EINVAL;
 	dev->curfreq = f->frequency;
 	typhoon_setfreq(dev, dev->curfreq);
 	return 0;
diff --git a/drivers/media/radio/radio-zoltrix.c b/drivers/media/radio/radio-zoltrix.c
index 80e98b6422fe..f31eab99c943 100644
--- a/drivers/media/radio/radio-zoltrix.c
+++ b/drivers/media/radio/radio-zoltrix.c
@@ -266,6 +266,8 @@ static int vidioc_s_frequency(struct file *file, void *priv,
 {
 	struct zoltrix *zol = video_drvdata(file);
 
+	if (f->tuner != 0 || f->type != V4L2_TUNER_RADIO)
+		return -EINVAL;
 	if (zol_setfreq(zol, f->frequency) != 0)
 		return -EINVAL;
 	return 0;
@@ -276,6 +278,8 @@ static int vidioc_g_frequency(struct file *file, void *priv,
 {
 	struct zoltrix *zol = video_drvdata(file);
 
+	if (f->tuner != 0)
+		return -EINVAL;
 	f->type = V4L2_TUNER_RADIO;
 	f->frequency = zol->curfreq;
 	return 0;
diff --git a/drivers/media/radio/si470x/radio-si470x-common.c b/drivers/media/radio/si470x/radio-si470x-common.c
index f33315f2c543..4da0f150c6e2 100644
--- a/drivers/media/radio/si470x/radio-si470x-common.c
+++ b/drivers/media/radio/si470x/radio-si470x-common.c
@@ -426,6 +426,104 @@ int si470x_rds_on(struct si470x_device *radio)
 
 
 /**************************************************************************
+ * File Operations Interface
+ **************************************************************************/
+
+/*
+ * si470x_fops_read - read RDS data
+ */
+static ssize_t si470x_fops_read(struct file *file, char __user *buf,
+		size_t count, loff_t *ppos)
+{
+	struct si470x_device *radio = video_drvdata(file);
+	int retval = 0;
+	unsigned int block_count = 0;
+
+	/* switch on rds reception */
+	if ((radio->registers[SYSCONFIG1] & SYSCONFIG1_RDS) == 0)
+		si470x_rds_on(radio);
+
+	/* block if no new data available */
+	while (radio->wr_index == radio->rd_index) {
+		if (file->f_flags & O_NONBLOCK) {
+			retval = -EWOULDBLOCK;
+			goto done;
+		}
+		if (wait_event_interruptible(radio->read_queue,
+			radio->wr_index != radio->rd_index) < 0) {
+			retval = -EINTR;
+			goto done;
+		}
+	}
+
+	/* calculate block count from byte count */
+	count /= 3;
+
+	/* copy RDS block out of internal buffer and to user buffer */
+	mutex_lock(&radio->lock);
+	while (block_count < count) {
+		if (radio->rd_index == radio->wr_index)
+			break;
+
+		/* always transfer rds complete blocks */
+		if (copy_to_user(buf, &radio->buffer[radio->rd_index], 3))
+			/* retval = -EFAULT; */
+			break;
+
+		/* increment and wrap read pointer */
+		radio->rd_index += 3;
+		if (radio->rd_index >= radio->buf_size)
+			radio->rd_index = 0;
+
+		/* increment counters */
+		block_count++;
+		buf += 3;
+		retval += 3;
+	}
+	mutex_unlock(&radio->lock);
+
+done:
+	return retval;
+}
+
+
+/*
+ * si470x_fops_poll - poll RDS data
+ */
+static unsigned int si470x_fops_poll(struct file *file,
+		struct poll_table_struct *pts)
+{
+	struct si470x_device *radio = video_drvdata(file);
+	int retval = 0;
+
+	/* switch on rds reception */
+	if ((radio->registers[SYSCONFIG1] & SYSCONFIG1_RDS) == 0)
+		si470x_rds_on(radio);
+
+	poll_wait(file, &radio->read_queue, pts);
+
+	if (radio->rd_index != radio->wr_index)
+		retval = POLLIN | POLLRDNORM;
+
+	return retval;
+}
+
+
+/*
+ * si470x_fops - file operations interface
+ */
+static const struct v4l2_file_operations si470x_fops = {
+	.owner			= THIS_MODULE,
+	.read			= si470x_fops_read,
+	.poll			= si470x_fops_poll,
+	.ioctl			= video_ioctl2,
+	.open			= si470x_fops_open,
+	.release		= si470x_fops_release,
+};
+
+
+
+/**************************************************************************
  * Video4Linux Interface
  **************************************************************************/
 
diff --git a/drivers/media/radio/si470x/radio-si470x-i2c.c b/drivers/media/radio/si470x/radio-si470x-i2c.c
index 2d53b6a9409b..5466015346a1 100644
--- a/drivers/media/radio/si470x/radio-si470x-i2c.c
+++ b/drivers/media/radio/si470x/radio-si470x-i2c.c
@@ -22,22 +22,17 @@
  */
 
 
-/*
- * ToDo:
- * - RDS support
- */
-
-
 /* driver definitions */
 #define DRIVER_AUTHOR "Joonyoung Shim <jy0922.shim@samsung.com>";
-#define DRIVER_KERNEL_VERSION KERNEL_VERSION(1, 0, 0)
+#define DRIVER_KERNEL_VERSION KERNEL_VERSION(1, 0, 1)
 #define DRIVER_CARD "Silicon Labs Si470x FM Radio Receiver"
 #define DRIVER_DESC "I2C radio driver for Si470x FM Radio Receivers"
-#define DRIVER_VERSION "1.0.0"
+#define DRIVER_VERSION "1.0.1"
 
 /* kernel includes */
 #include <linux/i2c.h>
 #include <linux/delay.h>
+#include <linux/interrupt.h>
 
 #include "radio-si470x.h"
 
@@ -62,6 +57,20 @@ static int radio_nr = -1;
 module_param(radio_nr, int, 0444);
 MODULE_PARM_DESC(radio_nr, "Radio Nr");
 
+/* RDS buffer blocks */
+static unsigned int rds_buf = 100;
+module_param(rds_buf, uint, 0444);
+MODULE_PARM_DESC(rds_buf, "RDS buffer entries: *100*");
+
+/* RDS maximum block errors */
+static unsigned short max_rds_errors = 1;
+/* 0 means   0  errors requiring correction */
+/* 1 means 1-2  errors requiring correction (used by original USBRadio.exe) */
+/* 2 means 3-5  errors requiring correction */
+/* 3 means   6+ errors or errors in checkword, correction not possible */
+module_param(max_rds_errors, ushort, 0644);
+MODULE_PARM_DESC(max_rds_errors, "RDS maximum block errors: *1*");
+
 
 
 /**************************************************************************
@@ -173,7 +182,7 @@ int si470x_disconnect_check(struct si470x_device *radio)
 /*
  * si470x_fops_open - file open
  */
-static int si470x_fops_open(struct file *file)
+int si470x_fops_open(struct file *file)
 {
 	struct si470x_device *radio = video_drvdata(file);
 	int retval = 0;
@@ -181,12 +190,21 @@ static int si470x_fops_open(struct file *file)
 	mutex_lock(&radio->lock);
 	radio->users++;
 
-	if (radio->users == 1)
+	if (radio->users == 1) {
 		/* start radio */
 		retval = si470x_start(radio);
+		if (retval < 0)
+			goto done;
+
+		/* enable RDS interrupt */
+		radio->registers[SYSCONFIG1] |= SYSCONFIG1_RDSIEN;
+		radio->registers[SYSCONFIG1] &= ~SYSCONFIG1_GPIO2;
+		radio->registers[SYSCONFIG1] |= 0x1 << 2;
+		retval = si470x_set_register(radio, SYSCONFIG1);
+	}
 
+done:
 	mutex_unlock(&radio->lock);
-
 	return retval;
 }
 
@@ -194,7 +212,7 @@ static int si470x_fops_open(struct file *file)
 /*
  * si470x_fops_release - file release
  */
-static int si470x_fops_release(struct file *file)
+int si470x_fops_release(struct file *file)
 {
 	struct si470x_device *radio = video_drvdata(file);
 	int retval = 0;
@@ -215,17 +233,6 @@ static int si470x_fops_release(struct file *file)
 }
 
 
-/*
- * si470x_fops - file operations interface
- */
-const struct v4l2_file_operations si470x_fops = {
-	.owner		= THIS_MODULE,
-	.ioctl		= video_ioctl2,
-	.open		= si470x_fops_open,
-	.release	= si470x_fops_release,
-};
-
-
 
 /**************************************************************************
  * Video4Linux Interface
@@ -253,6 +260,105 @@ int si470x_vidioc_querycap(struct file *file, void *priv,
  **************************************************************************/
 
 /*
+ * si470x_i2c_interrupt_work - rds processing function
+ */
+static void si470x_i2c_interrupt_work(struct work_struct *work)
+{
+	struct si470x_device *radio = container_of(work,
+			struct si470x_device, radio_work);
+	unsigned char regnr;
+	unsigned char blocknum;
+	unsigned short bler; /* rds block errors */
+	unsigned short rds;
+	unsigned char tmpbuf[3];
+	int retval = 0;
+
+	/* safety checks */
+	if ((radio->registers[SYSCONFIG1] & SYSCONFIG1_RDS) == 0)
+		return;
+
+	/* Update RDS registers */
+	for (regnr = 0; regnr < RDS_REGISTER_NUM; regnr++) {
+		retval = si470x_get_register(radio, STATUSRSSI + regnr);
+		if (retval < 0)
+			return;
+	}
+
+	/* get rds blocks */
+	if ((radio->registers[STATUSRSSI] & STATUSRSSI_RDSR) == 0)
+		/* No RDS group ready, better luck next time */
+		return;
+
+	for (blocknum = 0; blocknum < 4; blocknum++) {
+		switch (blocknum) {
+		default:
+			bler = (radio->registers[STATUSRSSI] &
+					STATUSRSSI_BLERA) >> 9;
+			rds = radio->registers[RDSA];
+			break;
+		case 1:
+			bler = (radio->registers[READCHAN] &
+					READCHAN_BLERB) >> 14;
+			rds = radio->registers[RDSB];
+			break;
+		case 2:
+			bler = (radio->registers[READCHAN] &
+					READCHAN_BLERC) >> 12;
+			rds = radio->registers[RDSC];
+			break;
+		case 3:
+			bler = (radio->registers[READCHAN] &
+					READCHAN_BLERD) >> 10;
+			rds = radio->registers[RDSD];
+			break;
+		};
+
+		/* Fill the V4L2 RDS buffer */
+		put_unaligned_le16(rds, &tmpbuf);
+		tmpbuf[2] = blocknum;		/* offset name */
+		tmpbuf[2] |= blocknum << 3;	/* received offset */
+		if (bler > max_rds_errors)
+			tmpbuf[2] |= 0x80;	/* uncorrectable errors */
+		else if (bler > 0)
+			tmpbuf[2] |= 0x40;	/* corrected error(s) */
+
+		/* copy RDS block to internal buffer */
+		memcpy(&radio->buffer[radio->wr_index], &tmpbuf, 3);
+		radio->wr_index += 3;
+
+		/* wrap write pointer */
+		if (radio->wr_index >= radio->buf_size)
+			radio->wr_index = 0;
+
+		/* check for overflow */
+		if (radio->wr_index == radio->rd_index) {
+			/* increment and wrap read pointer */
+			radio->rd_index += 3;
+			if (radio->rd_index >= radio->buf_size)
+				radio->rd_index = 0;
+		}
+	}
+
+	if (radio->wr_index != radio->rd_index)
+		wake_up_interruptible(&radio->read_queue);
+}
+
+
+/*
+ * si470x_i2c_interrupt - interrupt handler
+ */
+static irqreturn_t si470x_i2c_interrupt(int irq, void *dev_id)
+{
+	struct si470x_device *radio = dev_id;
+
+	if (!work_pending(&radio->radio_work))
+		schedule_work(&radio->radio_work);
+
+	return IRQ_HANDLED;
+}
+
+
+/*
  * si470x_i2c_probe - probe for the device
  */
 static int __devinit si470x_i2c_probe(struct i2c_client *client,
@@ -268,6 +374,8 @@ static int __devinit si470x_i2c_probe(struct i2c_client *client,
 		retval = -ENOMEM;
 		goto err_initial;
 	}
+
+	INIT_WORK(&radio->radio_work, si470x_i2c_interrupt_work);
 	radio->users = 0;
 	radio->client = client;
 	mutex_init(&radio->lock);
@@ -319,6 +427,26 @@ static int __devinit si470x_i2c_probe(struct i2c_client *client,
 	/* set initial frequency */
 	si470x_set_freq(radio, 87.5 * FREQ_MUL); /* available in all regions */
 
+	/* rds buffer allocation */
+	radio->buf_size = rds_buf * 3;
+	radio->buffer = kmalloc(radio->buf_size, GFP_KERNEL);
+	if (!radio->buffer) {
+		retval = -EIO;
+		goto err_video;
+	}
+
+	/* rds buffer configuration */
+	radio->wr_index = 0;
+	radio->rd_index = 0;
+	init_waitqueue_head(&radio->read_queue);
+
+	retval = request_irq(client->irq, si470x_i2c_interrupt,
+			IRQF_TRIGGER_FALLING, DRIVER_NAME, radio);
+	if (retval) {
+		dev_err(&client->dev, "Failed to register interrupt\n");
+		goto err_rds;
+	}
+
 	/* register video device */
 	retval = video_register_device(radio->videodev, VFL_TYPE_RADIO,
 			radio_nr);
@@ -330,6 +458,9 @@ static int __devinit si470x_i2c_probe(struct i2c_client *client,
 
 	return 0;
 err_all:
+	free_irq(client->irq, radio);
+err_rds:
+	kfree(radio->buffer);
 err_video:
 	video_device_release(radio->videodev);
 err_radio:
@@ -346,6 +477,8 @@ static __devexit int si470x_i2c_remove(struct i2c_client *client)
 {
 	struct si470x_device *radio = i2c_get_clientdata(client);
 
+	free_irq(client->irq, radio);
+	cancel_work_sync(&radio->radio_work);
 	video_unregister_device(radio->videodev);
 	kfree(radio);
 	i2c_set_clientdata(client, NULL);
@@ -354,6 +487,44 @@ static __devexit int si470x_i2c_remove(struct i2c_client *client)
 }
 
 
+#ifdef CONFIG_PM
+/*
+ * si470x_i2c_suspend - suspend the device
+ */
+static int si470x_i2c_suspend(struct i2c_client *client, pm_message_t mesg)
+{
+	struct si470x_device *radio = i2c_get_clientdata(client);
+
+	/* power down */
+	radio->registers[POWERCFG] |= POWERCFG_DISABLE;
+	if (si470x_set_register(radio, POWERCFG) < 0)
+		return -EIO;
+
+	return 0;
+}
+
+
+/*
+ * si470x_i2c_resume - resume the device
+ */
+static int si470x_i2c_resume(struct i2c_client *client)
+{
+	struct si470x_device *radio = i2c_get_clientdata(client);
+
+	/* power up : need 110ms */
+	radio->registers[POWERCFG] |= POWERCFG_ENABLE;
+	if (si470x_set_register(radio, POWERCFG) < 0)
+		return -EIO;
+	msleep(110);
+
+	return 0;
+}
+#else
+#define si470x_i2c_suspend	NULL
+#define si470x_i2c_resume	NULL
+#endif
+
+
 /*
  * si470x_i2c_driver - i2c driver interface
  */
@@ -364,6 +535,8 @@ static struct i2c_driver si470x_i2c_driver = {
 	},
 	.probe			= si470x_i2c_probe,
 	.remove			= __devexit_p(si470x_i2c_remove),
+	.suspend		= si470x_i2c_suspend,
+	.resume			= si470x_i2c_resume,
 	.id_table		= si470x_i2c_id,
 };
 
diff --git a/drivers/media/radio/si470x/radio-si470x-usb.c b/drivers/media/radio/si470x/radio-si470x-usb.c
index f2d0e1ddb301..a96e1b9dd646 100644
--- a/drivers/media/radio/si470x/radio-si470x-usb.c
+++ b/drivers/media/radio/si470x/radio-si470x-usb.c
@@ -509,89 +509,9 @@ resubmit:
  **************************************************************************/
 
 /*
- * si470x_fops_read - read RDS data
- */
-static ssize_t si470x_fops_read(struct file *file, char __user *buf,
-		size_t count, loff_t *ppos)
-{
-	struct si470x_device *radio = video_drvdata(file);
-	int retval = 0;
-	unsigned int block_count = 0;
-
-	/* switch on rds reception */
-	if ((radio->registers[SYSCONFIG1] & SYSCONFIG1_RDS) == 0)
-		si470x_rds_on(radio);
-
-	/* block if no new data available */
-	while (radio->wr_index == radio->rd_index) {
-		if (file->f_flags & O_NONBLOCK) {
-			retval = -EWOULDBLOCK;
-			goto done;
-		}
-		if (wait_event_interruptible(radio->read_queue,
-			radio->wr_index != radio->rd_index) < 0) {
-			retval = -EINTR;
-			goto done;
-		}
-	}
-
-	/* calculate block count from byte count */
-	count /= 3;
-
-	/* copy RDS block out of internal buffer and to user buffer */
-	mutex_lock(&radio->lock);
-	while (block_count < count) {
-		if (radio->rd_index == radio->wr_index)
-			break;
-
-		/* always transfer rds complete blocks */
-		if (copy_to_user(buf, &radio->buffer[radio->rd_index], 3))
-			/* retval = -EFAULT; */
-			break;
-
-		/* increment and wrap read pointer */
-		radio->rd_index += 3;
-		if (radio->rd_index >= radio->buf_size)
-			radio->rd_index = 0;
-
-		/* increment counters */
-		block_count++;
-		buf += 3;
-		retval += 3;
-	}
-	mutex_unlock(&radio->lock);
-
-done:
-	return retval;
-}
-
-
-/*
- * si470x_fops_poll - poll RDS data
- */
-static unsigned int si470x_fops_poll(struct file *file,
-		struct poll_table_struct *pts)
-{
-	struct si470x_device *radio = video_drvdata(file);
-	int retval = 0;
-
-	/* switch on rds reception */
-	if ((radio->registers[SYSCONFIG1] & SYSCONFIG1_RDS) == 0)
-		si470x_rds_on(radio);
-
-	poll_wait(file, &radio->read_queue, pts);
-
-	if (radio->rd_index != radio->wr_index)
-		retval = POLLIN | POLLRDNORM;
-
-	return retval;
-}
-
-
-/*
  * si470x_fops_open - file open
  */
-static int si470x_fops_open(struct file *file)
+int si470x_fops_open(struct file *file)
 {
 	struct si470x_device *radio = video_drvdata(file);
 	int retval;
@@ -645,7 +565,7 @@ done:
 /*
  * si470x_fops_release - file release
  */
-static int si470x_fops_release(struct file *file)
+int si470x_fops_release(struct file *file)
 {
 	struct si470x_device *radio = video_drvdata(file);
 	int retval = 0;
@@ -688,19 +608,6 @@ done:
 }
 
 
-/*
- * si470x_fops - file operations interface
- */
-const struct v4l2_file_operations si470x_fops = {
-	.owner		= THIS_MODULE,
-	.read		= si470x_fops_read,
-	.poll		= si470x_fops_poll,
-	.ioctl		= video_ioctl2,
-	.open		= si470x_fops_open,
-	.release	= si470x_fops_release,
-};
-
-
 
 /**************************************************************************
  * Video4Linux Interface
diff --git a/drivers/media/radio/si470x/radio-si470x.h b/drivers/media/radio/si470x/radio-si470x.h
index d0af194d194c..3cd0a29cd6e7 100644
--- a/drivers/media/radio/si470x/radio-si470x.h
+++ b/drivers/media/radio/si470x/radio-si470x.h
@@ -29,6 +29,7 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/init.h>
+#include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/smp_lock.h>
 #include <linux/input.h>
@@ -181,6 +182,7 @@ struct si470x_device {
 
 #if defined(CONFIG_I2C_SI470X) || defined(CONFIG_I2C_SI470X_MODULE)
 	struct i2c_client *client;
+	struct work_struct radio_work;
 #endif
 };
 
@@ -212,7 +214,6 @@ struct si470x_device {
 /**************************************************************************
  * Common Functions
  **************************************************************************/
-extern const struct v4l2_file_operations si470x_fops;
 extern struct video_device si470x_viddev_template;
 int si470x_get_register(struct si470x_device *radio, int regnr);
 int si470x_set_register(struct si470x_device *radio, int regnr);
@@ -221,5 +222,7 @@ int si470x_set_freq(struct si470x_device *radio, unsigned int freq);
 int si470x_start(struct si470x_device *radio);
 int si470x_stop(struct si470x_device *radio);
 int si470x_rds_on(struct si470x_device *radio);
+int si470x_fops_open(struct file *file);
+int si470x_fops_release(struct file *file);
 int si470x_vidioc_querycap(struct file *file, void *priv,
 		struct v4l2_capability *capability);
diff --git a/drivers/media/radio/tef6862.c b/drivers/media/radio/tef6862.c
new file mode 100644
index 000000000000..6e607ff0c169
--- /dev/null
+++ b/drivers/media/radio/tef6862.c
@@ -0,0 +1,232 @@
+/*
+ * tef6862.c Philips TEF6862 Car Radio Enhanced Selectivity Tuner
+ * Copyright (c) 2009 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/interrupt.h>
+#include <linux/i2c.h>
+#include <linux/i2c-id.h>
+#include <media/v4l2-ioctl.h>
+#include <media/v4l2-device.h>
+#include <media/v4l2-chip-ident.h>
+
+#define DRIVER_NAME "tef6862"
+
+#define FREQ_MUL 16000
+
+#define TEF6862_LO_FREQ (875 * FREQ_MUL / 10)
+#define TEF6862_HI_FREQ (108 * FREQ_MUL)
+
+/* Write mode sub addresses */
+#define WM_SUB_BANDWIDTH	0x0
+#define WM_SUB_PLLM		0x1
+#define WM_SUB_PLLL		0x2
+#define WM_SUB_DAA		0x3
+#define WM_SUB_AGC		0x4
+#define WM_SUB_BAND		0x5
+#define WM_SUB_CONTROL		0x6
+#define WM_SUB_LEVEL		0x7
+#define WM_SUB_IFCF		0x8
+#define WM_SUB_IFCAP		0x9
+#define WM_SUB_ACD		0xA
+#define WM_SUB_TEST		0xF
+
+/* Different modes of the MSA register */
+#define MODE_BUFFER		0x0
+#define MODE_PRESET		0x1
+#define MODE_SEARCH		0x2
+#define MODE_AF_UPDATE		0x3
+#define MODE_JUMP		0x4
+#define MODE_CHECK		0x5
+#define MODE_LOAD		0x6
+#define MODE_END		0x7
+#define MODE_SHIFT		5
+
+struct tef6862_state {
+	struct v4l2_subdev sd;
+	unsigned long freq;
+};
+
+static inline struct tef6862_state *to_state(struct v4l2_subdev *sd)
+{
+	return container_of(sd, struct tef6862_state, sd);
+}
+
+static u16 tef6862_sigstr(struct i2c_client *client)
+{
+	u8 buf[4];
+	int err = i2c_master_recv(client, buf, sizeof(buf));
+	if (err == sizeof(buf))
+		return buf[3] << 8;
+	return 0;
+}
+
+static int tef6862_g_tuner(struct v4l2_subdev *sd, struct v4l2_tuner *v)
+{
+	if (v->index > 0)
+		return -EINVAL;
+
+	/* only support FM for now */
+	strlcpy(v->name, "FM", sizeof(v->name));
+	v->type = V4L2_TUNER_RADIO;
+	v->rangelow = TEF6862_LO_FREQ;
+	v->rangehigh = TEF6862_HI_FREQ;
+	v->rxsubchans = V4L2_TUNER_SUB_MONO;
+	v->capability = V4L2_TUNER_CAP_LOW;
+	v->audmode = V4L2_TUNER_MODE_STEREO;
+	v->signal = tef6862_sigstr(v4l2_get_subdevdata(sd));
+
+	return 0;
+}
+
+static int tef6862_s_tuner(struct v4l2_subdev *sd, struct v4l2_tuner *v)
+{
+	return v->index ? -EINVAL : 0;
+}
+
+static int tef6862_s_frequency(struct v4l2_subdev *sd, struct v4l2_frequency *f)
+{
+	struct tef6862_state *state = to_state(sd);
+	struct i2c_client *client = v4l2_get_subdevdata(sd);
+	u16 pll;
+	u8 i2cmsg[3];
+	int err;
+
+	if (f->tuner != 0)
+		return -EINVAL;
+
+	pll = 1964 + ((f->frequency - TEF6862_LO_FREQ) * 20) / FREQ_MUL;
+	i2cmsg[0] = (MODE_PRESET << MODE_SHIFT) | WM_SUB_PLLM;
+	i2cmsg[1] = (pll >> 8) & 0xff;
+	i2cmsg[2] = pll & 0xff;
+
+	err = i2c_master_send(client, i2cmsg, sizeof(i2cmsg));
+	if (!err)
+		state->freq = f->frequency;
+	return err;
+}
+
+static int tef6862_g_frequency(struct v4l2_subdev *sd, struct v4l2_frequency *f)
+{
+	struct tef6862_state *state = to_state(sd);
+
+	if (f->tuner != 0)
+		return -EINVAL;
+	f->type = V4L2_TUNER_RADIO;
+	f->frequency = state->freq;
+	return 0;
+}
+
+static int tef6862_g_chip_ident(struct v4l2_subdev *sd,
+	struct v4l2_dbg_chip_ident *chip)
+{
+	struct i2c_client *client = v4l2_get_subdevdata(sd);
+
+	return v4l2_chip_ident_i2c_client(client, chip, V4L2_IDENT_TEF6862, 0);
+}
+
+static const struct v4l2_subdev_tuner_ops tef6862_tuner_ops = {
+	.g_tuner = tef6862_g_tuner,
+	.s_tuner = tef6862_s_tuner,
+	.s_frequency = tef6862_s_frequency,
+	.g_frequency = tef6862_g_frequency,
+};
+
+static const struct v4l2_subdev_core_ops tef6862_core_ops = {
+	.g_chip_ident = tef6862_g_chip_ident,
+};
+
+static const struct v4l2_subdev_ops tef6862_ops = {
+	.core = &tef6862_core_ops,
+	.tuner = &tef6862_tuner_ops,
+};
+
+/*
+ * Generic i2c probe
+ * concerning the addresses: i2c wants 7 bit (without the r/w bit), so '>>1'
+ */
+
+static int __devinit tef6862_probe(struct i2c_client *client,
+			const struct i2c_device_id *id)
+{
+	struct tef6862_state *state;
+	struct v4l2_subdev *sd;
+
+	/* Check if the adapter supports the needed features */
+	if (!i2c_check_functionality(client->adapter, I2C_FUNC_SMBUS_BYTE_DATA))
+		return -EIO;
+
+	v4l_info(client, "chip found @ 0x%02x (%s)\n",
+			client->addr << 1, client->adapter->name);
+
+	state = kmalloc(sizeof(struct tef6862_state), GFP_KERNEL);
+	if (state == NULL)
+		return -ENOMEM;
+	state->freq = TEF6862_LO_FREQ;
+
+	sd = &state->sd;
+	v4l2_i2c_subdev_init(sd, client, &tef6862_ops);
+
+	return 0;
+}
+
+static int __devexit tef6862_remove(struct i2c_client *client)
+{
+	struct v4l2_subdev *sd = i2c_get_clientdata(client);
+
+	v4l2_device_unregister_subdev(sd);
+	kfree(to_state(sd));
+	return 0;
+}
+
+static const struct i2c_device_id tef6862_id[] = {
+	{DRIVER_NAME, 0},
+	{},
+};
+
+MODULE_DEVICE_TABLE(i2c, tef6862_id);
+
+static struct i2c_driver tef6862_driver = {
+	.driver = {
+		.owner	= THIS_MODULE,
+		.name	= DRIVER_NAME,
+	},
+	.probe		= tef6862_probe,
+	.remove		= tef6862_remove,
+	.id_table	= tef6862_id,
+};
+
+static __init int tef6862_init(void)
+{
+	return i2c_add_driver(&tef6862_driver);
+}
+
+static __exit void tef6862_exit(void)
+{
+	i2c_del_driver(&tef6862_driver);
+}
+
+module_init(tef6862_init);
+module_exit(tef6862_exit);
+
+MODULE_DESCRIPTION("TEF6862 Car Radio Enhanced Selectivity Tuner");
+MODULE_AUTHOR("Mocean Laboratories");
+MODULE_LICENSE("GPL v2");
+
diff --git a/drivers/media/video/Kconfig b/drivers/media/video/Kconfig
index e6186b338a12..2f83be766d9f 100644
--- a/drivers/media/video/Kconfig
+++ b/drivers/media/video/Kconfig
@@ -37,10 +37,6 @@ config VIDEO_BTCX
 	depends on PCI
 	tristate
 
-config VIDEO_IR
-	tristate
-	depends on INPUT
-
 config VIDEO_TVEEPROM
 	tristate
 	depends on I2C
@@ -600,7 +596,7 @@ source "drivers/media/video/bt8xx/Kconfig"
 
 config VIDEO_PMS
 	tristate "Mediavision Pro Movie Studio Video For Linux"
-	depends on ISA && VIDEO_V4L1
+	depends on ISA && VIDEO_V4L2
 	help
 	  Say Y if you have such a thing.
 
@@ -840,6 +836,12 @@ config SOC_CAMERA_MT9T031
 	help
 	  This driver supports MT9T031 cameras from Micron.
 
+config SOC_CAMERA_MT9T112
+	tristate "mt9t112 support"
+	depends on SOC_CAMERA && I2C
+	help
+	  This driver supports MT9T112 cameras from Aptina.
+
 config SOC_CAMERA_MT9V022
 	tristate "mt9v022 support"
 	depends on SOC_CAMERA && I2C
@@ -847,6 +849,12 @@ config SOC_CAMERA_MT9V022
 	help
 	  This driver supports MT9V022 cameras from Micron
 
+config SOC_CAMERA_RJ54N1
+	tristate "rj54n1cb0c support"
+	depends on SOC_CAMERA && I2C
+	help
+	  This is a rj54n1cb0c video driver
+
 config SOC_CAMERA_TW9910
 	tristate "tw9910 support"
 	depends on SOC_CAMERA && I2C
@@ -865,6 +873,12 @@ config SOC_CAMERA_OV772X
 	help
 	  This is a ov772x camera driver
 
+config SOC_CAMERA_OV9640
+	tristate "ov9640 camera support"
+	depends on SOC_CAMERA && I2C
+	help
+	  This is a ov9640 camera driver
+
 config MX1_VIDEO
 	bool
 
@@ -939,9 +953,14 @@ source "drivers/media/video/usbvideo/Kconfig"
 source "drivers/media/video/et61x251/Kconfig"
 
 config VIDEO_OVCAMCHIP
-	tristate "OmniVision Camera Chip support"
+	tristate "OmniVision Camera Chip support (DEPRECATED)"
 	depends on I2C && VIDEO_V4L1
 	---help---
+	  This driver is DEPRECATED please use the gspca ov519 module
+	  instead. Note that for the ov511 / ov518 support of the gspca module
+	  you need atleast version 0.6.0 of libv4l and for the w9968cf
+	  atleast version 0.6.3 of libv4l.
+
 	  Support for the OmniVision OV6xxx and OV7xxx series of camera chips.
 	  This driver is intended to be used with the ov511 and w9968cf USB
 	  camera drivers.
@@ -950,9 +969,13 @@ config VIDEO_OVCAMCHIP
 	  module will be called ovcamchip.
 
 config USB_W9968CF
-	tristate "USB W996[87]CF JPEG Dual Mode Camera support"
+	tristate "USB W996[87]CF JPEG Dual Mode Camera support (DEPRECATED)"
 	depends on VIDEO_V4L1 && I2C && VIDEO_OVCAMCHIP
 	---help---
+	  This driver is DEPRECATED please use the gspca ov519 module
+	  instead. Note that for the w9968cf support of the gspca module
+	  you need atleast version 0.6.3 of libv4l.
+
 	  Say Y here if you want support for cameras based on OV681 or
 	  Winbond W9967CF/W9968CF JPEG USB Dual Mode Camera Chips.
 
@@ -995,9 +1018,13 @@ config USB_SE401
 source "drivers/media/video/sn9c102/Kconfig"
 
 config USB_STV680
-	tristate "USB STV680 (Pencam) Camera support"
+	tristate "USB STV680 (Pencam) Camera support (DEPRECATED)"
 	depends on VIDEO_V4L1
 	---help---
+	  This driver is DEPRECATED please use the gspca stv0680 module
+	  instead. Note that for the gspca stv0680 module you need
+	  atleast version 0.6.3 of libv4l.
+
 	  Say Y here if you want to connect this type of camera to your
 	  computer's USB port. This includes the Pencam line of cameras.
 	  See <file:Documentation/video4linux/stv680.txt> for more information
diff --git a/drivers/media/video/Makefile b/drivers/media/video/Makefile
index e541932a789b..2af68ee84122 100644
--- a/drivers/media/video/Makefile
+++ b/drivers/media/video/Makefile
@@ -75,8 +75,11 @@ obj-$(CONFIG_VIDEO_MT9V011) += mt9v011.o
 obj-$(CONFIG_SOC_CAMERA_MT9M001)	+= mt9m001.o
 obj-$(CONFIG_SOC_CAMERA_MT9M111)	+= mt9m111.o
 obj-$(CONFIG_SOC_CAMERA_MT9T031)	+= mt9t031.o
+obj-$(CONFIG_SOC_CAMERA_MT9T112)	+= mt9t112.o
 obj-$(CONFIG_SOC_CAMERA_MT9V022)	+= mt9v022.o
 obj-$(CONFIG_SOC_CAMERA_OV772X)		+= ov772x.o
+obj-$(CONFIG_SOC_CAMERA_OV9640)		+= ov9640.o
+obj-$(CONFIG_SOC_CAMERA_RJ54N1)		+= rj54n1cb0c.o
 obj-$(CONFIG_SOC_CAMERA_TW9910)		+= tw9910.o
 
 # And now the v4l2 drivers:
@@ -147,7 +150,7 @@ obj-$(CONFIG_VIDEO_VIVI) += vivi.o
 obj-$(CONFIG_VIDEO_CX23885) += cx23885/
 
 obj-$(CONFIG_VIDEO_OMAP2)		+= omap2cam.o
-obj-$(CONFIG_SOC_CAMERA)		+= soc_camera.o
+obj-$(CONFIG_SOC_CAMERA)		+= soc_camera.o soc_mediabus.o
 obj-$(CONFIG_SOC_CAMERA_PLATFORM)	+= soc_camera_platform.o
 # soc-camera host drivers have to be linked after camera drivers
 obj-$(CONFIG_VIDEO_MX1)			+= mx1_camera.o
diff --git a/drivers/media/video/adv7180.c b/drivers/media/video/adv7180.c
index 1b3cbd02a7fd..0826f0dabc17 100644
--- a/drivers/media/video/adv7180.c
+++ b/drivers/media/video/adv7180.c
@@ -27,17 +27,40 @@
 #include <linux/videodev2.h>
 #include <media/v4l2-device.h>
 #include <media/v4l2-chip-ident.h>
+#include <linux/mutex.h>
 
 #define DRIVER_NAME "adv7180"
 
-#define ADV7180_INPUT_CONTROL_REG	0x00
-#define ADV7180_INPUT_CONTROL_PAL_BG_NTSC_J_SECAM	0x00
-#define ADV7180_AUTODETECT_ENABLE_REG	0x07
-#define ADV7180_AUTODETECT_DEFAULT	0x7f
-
-
-#define ADV7180_STATUS1_REG 0x10
-#define ADV7180_STATUS1_AUTOD_MASK 0x70
+#define ADV7180_INPUT_CONTROL_REG			0x00
+#define ADV7180_INPUT_CONTROL_AD_PAL_BG_NTSC_J_SECAM	0x00
+#define ADV7180_INPUT_CONTROL_AD_PAL_BG_NTSC_J_SECAM_PED 0x10
+#define ADV7180_INPUT_CONTROL_AD_PAL_N_NTSC_J_SECAM	0x20
+#define ADV7180_INPUT_CONTROL_AD_PAL_N_NTSC_M_SECAM	0x30
+#define ADV7180_INPUT_CONTROL_NTSC_J			0x40
+#define ADV7180_INPUT_CONTROL_NTSC_M			0x50
+#define ADV7180_INPUT_CONTROL_PAL60			0x60
+#define ADV7180_INPUT_CONTROL_NTSC_443			0x70
+#define ADV7180_INPUT_CONTROL_PAL_BG			0x80
+#define ADV7180_INPUT_CONTROL_PAL_N			0x90
+#define ADV7180_INPUT_CONTROL_PAL_M			0xa0
+#define ADV7180_INPUT_CONTROL_PAL_M_PED			0xb0
+#define ADV7180_INPUT_CONTROL_PAL_COMB_N		0xc0
+#define ADV7180_INPUT_CONTROL_PAL_COMB_N_PED		0xd0
+#define ADV7180_INPUT_CONTROL_PAL_SECAM			0xe0
+#define ADV7180_INPUT_CONTROL_PAL_SECAM_PED		0xf0
+
+#define ADV7180_EXTENDED_OUTPUT_CONTROL_REG		0x04
+#define ADV7180_EXTENDED_OUTPUT_CONTROL_NTSCDIS		0xC5
+
+#define ADV7180_AUTODETECT_ENABLE_REG			0x07
+#define ADV7180_AUTODETECT_DEFAULT			0x7f
+
+#define ADV7180_ADI_CTRL_REG				0x0e
+#define ADV7180_ADI_CTRL_IRQ_SPACE			0x20
+
+#define ADV7180_STATUS1_REG				0x10
+#define ADV7180_STATUS1_IN_LOCK		0x01
+#define ADV7180_STATUS1_AUTOD_MASK	0x70
 #define ADV7180_STATUS1_AUTOD_NTSM_M_J	0x00
 #define ADV7180_STATUS1_AUTOD_NTSC_4_43 0x10
 #define ADV7180_STATUS1_AUTOD_PAL_M	0x20
@@ -50,18 +73,37 @@
 #define ADV7180_IDENT_REG 0x11
 #define ADV7180_ID_7180 0x18
 
+#define ADV7180_ICONF1_ADI		0x40
+#define ADV7180_ICONF1_ACTIVE_LOW	0x01
+#define ADV7180_ICONF1_PSYNC_ONLY	0x10
+#define ADV7180_ICONF1_ACTIVE_TO_CLR	0xC0
+
+#define ADV7180_IRQ1_LOCK	0x01
+#define ADV7180_IRQ1_UNLOCK	0x02
+#define ADV7180_ISR1_ADI	0x42
+#define ADV7180_ICR1_ADI	0x43
+#define ADV7180_IMR1_ADI	0x44
+#define ADV7180_IMR2_ADI	0x48
+#define ADV7180_IRQ3_AD_CHANGE	0x08
+#define ADV7180_ISR3_ADI	0x4A
+#define ADV7180_ICR3_ADI	0x4B
+#define ADV7180_IMR3_ADI	0x4C
+#define ADV7180_IMR4_ADI	0x50
 
 struct adv7180_state {
-	struct v4l2_subdev sd;
+	struct v4l2_subdev	sd;
+	struct work_struct	work;
+	struct mutex		mutex; /* mutual excl. when accessing chip */
+	int			irq;
+	v4l2_std_id		curr_norm;
+	bool			autodetect;
 };
 
-static v4l2_std_id determine_norm(struct i2c_client *client)
+static v4l2_std_id adv7180_std_to_v4l2(u8 status1)
 {
-	u8 status1 = i2c_smbus_read_byte_data(client, ADV7180_STATUS1_REG);
-
 	switch (status1 & ADV7180_STATUS1_AUTOD_MASK) {
 	case ADV7180_STATUS1_AUTOD_NTSM_M_J:
-		return V4L2_STD_NTSC_M_JP;
+		return V4L2_STD_NTSC;
 	case ADV7180_STATUS1_AUTOD_NTSC_4_43:
 		return V4L2_STD_NTSC_443;
 	case ADV7180_STATUS1_AUTOD_PAL_M:
@@ -81,6 +123,53 @@ static v4l2_std_id determine_norm(struct i2c_client *client)
 	}
 }
 
+static int v4l2_std_to_adv7180(v4l2_std_id std)
+{
+	if (std == V4L2_STD_PAL_60)
+		return ADV7180_INPUT_CONTROL_PAL60;
+	if (std == V4L2_STD_NTSC_443)
+		return ADV7180_INPUT_CONTROL_NTSC_443;
+	if (std == V4L2_STD_PAL_N)
+		return ADV7180_INPUT_CONTROL_PAL_N;
+	if (std == V4L2_STD_PAL_M)
+		return ADV7180_INPUT_CONTROL_PAL_M;
+	if (std == V4L2_STD_PAL_Nc)
+		return ADV7180_INPUT_CONTROL_PAL_COMB_N;
+
+	if (std & V4L2_STD_PAL)
+		return ADV7180_INPUT_CONTROL_PAL_BG;
+	if (std & V4L2_STD_NTSC)
+		return ADV7180_INPUT_CONTROL_NTSC_M;
+	if (std & V4L2_STD_SECAM)
+		return ADV7180_INPUT_CONTROL_PAL_SECAM;
+
+	return -EINVAL;
+}
+
+static u32 adv7180_status_to_v4l2(u8 status1)
+{
+	if (!(status1 & ADV7180_STATUS1_IN_LOCK))
+		return V4L2_IN_ST_NO_SIGNAL;
+
+	return 0;
+}
+
+static int __adv7180_status(struct i2c_client *client, u32 *status,
+	v4l2_std_id *std)
+{
+	int status1 = i2c_smbus_read_byte_data(client, ADV7180_STATUS1_REG);
+
+	if (status1 < 0)
+		return status1;
+
+	if (status)
+		*status = adv7180_status_to_v4l2(status1);
+	if (std)
+		*std = adv7180_std_to_v4l2(status1);
+
+	return 0;
+}
+
 static inline struct adv7180_state *to_state(struct v4l2_subdev *sd)
 {
 	return container_of(sd, struct adv7180_state, sd);
@@ -88,10 +177,31 @@ static inline struct adv7180_state *to_state(struct v4l2_subdev *sd)
 
 static int adv7180_querystd(struct v4l2_subdev *sd, v4l2_std_id *std)
 {
-	struct i2c_client *client = v4l2_get_subdevdata(sd);
+	struct adv7180_state *state = to_state(sd);
+	int err = mutex_lock_interruptible(&state->mutex);
+	if (err)
+		return err;
+
+	/* when we are interrupt driven we know the state */
+	if (!state->autodetect || state->irq > 0)
+		*std = state->curr_norm;
+	else
+		err = __adv7180_status(v4l2_get_subdevdata(sd), NULL, std);
+
+	mutex_unlock(&state->mutex);
+	return err;
+}
 
-	*std = determine_norm(client);
-	return 0;
+static int adv7180_g_input_status(struct v4l2_subdev *sd, u32 *status)
+{
+	struct adv7180_state *state = to_state(sd);
+	int ret = mutex_lock_interruptible(&state->mutex);
+	if (ret)
+		return ret;
+
+	ret = __adv7180_status(v4l2_get_subdevdata(sd), status, NULL);
+	mutex_unlock(&state->mutex);
+	return ret;
 }
 
 static int adv7180_g_chip_ident(struct v4l2_subdev *sd,
@@ -102,12 +212,51 @@ static int adv7180_g_chip_ident(struct v4l2_subdev *sd,
 	return v4l2_chip_ident_i2c_client(client, chip, V4L2_IDENT_ADV7180, 0);
 }
 
+static int adv7180_s_std(struct v4l2_subdev *sd, v4l2_std_id std)
+{
+	struct adv7180_state *state = to_state(sd);
+	struct i2c_client *client = v4l2_get_subdevdata(sd);
+	int ret = mutex_lock_interruptible(&state->mutex);
+	if (ret)
+		return ret;
+
+	/* all standards -> autodetect */
+	if (std == V4L2_STD_ALL) {
+		ret = i2c_smbus_write_byte_data(client,
+			ADV7180_INPUT_CONTROL_REG,
+			ADV7180_INPUT_CONTROL_AD_PAL_BG_NTSC_J_SECAM);
+		if (ret < 0)
+			goto out;
+
+		__adv7180_status(client, NULL, &state->curr_norm);
+		state->autodetect = true;
+	} else {
+		ret = v4l2_std_to_adv7180(std);
+		if (ret < 0)
+			goto out;
+
+		ret = i2c_smbus_write_byte_data(client,
+			ADV7180_INPUT_CONTROL_REG, ret);
+		if (ret < 0)
+			goto out;
+
+		state->curr_norm = std;
+		state->autodetect = false;
+	}
+	ret = 0;
+out:
+	mutex_unlock(&state->mutex);
+	return ret;
+}
+
 static const struct v4l2_subdev_video_ops adv7180_video_ops = {
 	.querystd = adv7180_querystd,
+	.g_input_status = adv7180_g_input_status,
 };
 
 static const struct v4l2_subdev_core_ops adv7180_core_ops = {
 	.g_chip_ident = adv7180_g_chip_ident,
+	.s_std = adv7180_s_std,
 };
 
 static const struct v4l2_subdev_ops adv7180_ops = {
@@ -115,12 +264,45 @@ static const struct v4l2_subdev_ops adv7180_ops = {
 	.video = &adv7180_video_ops,
 };
 
+static void adv7180_work(struct work_struct *work)
+{
+	struct adv7180_state *state = container_of(work, struct adv7180_state,
+		work);
+	struct i2c_client *client = v4l2_get_subdevdata(&state->sd);
+	u8 isr3;
+
+	mutex_lock(&state->mutex);
+	i2c_smbus_write_byte_data(client, ADV7180_ADI_CTRL_REG,
+		ADV7180_ADI_CTRL_IRQ_SPACE);
+	isr3 = i2c_smbus_read_byte_data(client, ADV7180_ISR3_ADI);
+	/* clear */
+	i2c_smbus_write_byte_data(client, ADV7180_ICR3_ADI, isr3);
+	i2c_smbus_write_byte_data(client, ADV7180_ADI_CTRL_REG, 0);
+
+	if (isr3 & ADV7180_IRQ3_AD_CHANGE && state->autodetect)
+		__adv7180_status(client, NULL, &state->curr_norm);
+	mutex_unlock(&state->mutex);
+
+	enable_irq(state->irq);
+}
+
+static irqreturn_t adv7180_irq(int irq, void *devid)
+{
+	struct adv7180_state *state = devid;
+
+	schedule_work(&state->work);
+
+	disable_irq_nosync(state->irq);
+
+	return IRQ_HANDLED;
+}
+
 /*
  * Generic i2c probe
  * concerning the addresses: i2c wants 7 bit (without the r/w bit), so '>>1'
  */
 
-static int adv7180_probe(struct i2c_client *client,
+static __devinit int adv7180_probe(struct i2c_client *client,
 			const struct i2c_device_id *id)
 {
 	struct adv7180_state *state;
@@ -135,32 +317,111 @@ static int adv7180_probe(struct i2c_client *client,
 			client->addr << 1, client->adapter->name);
 
 	state = kzalloc(sizeof(struct adv7180_state), GFP_KERNEL);
-	if (state == NULL)
-		return -ENOMEM;
+	if (state == NULL) {
+		ret = -ENOMEM;
+		goto err;
+	}
+
+	state->irq = client->irq;
+	INIT_WORK(&state->work, adv7180_work);
+	mutex_init(&state->mutex);
+	state->autodetect = true;
 	sd = &state->sd;
 	v4l2_i2c_subdev_init(sd, client, &adv7180_ops);
 
 	/* Initialize adv7180 */
-	/* enable autodetection */
+	/* Enable autodetection */
 	ret = i2c_smbus_write_byte_data(client, ADV7180_INPUT_CONTROL_REG,
-		ADV7180_INPUT_CONTROL_PAL_BG_NTSC_J_SECAM);
-	if (ret > 0)
-		ret = i2c_smbus_write_byte_data(client,
-			ADV7180_AUTODETECT_ENABLE_REG,
-			ADV7180_AUTODETECT_DEFAULT);
-	if (ret < 0) {
-		printk(KERN_ERR DRIVER_NAME
-			": Failed to communicate to chip: %d\n", ret);
-		return ret;
+		ADV7180_INPUT_CONTROL_AD_PAL_BG_NTSC_J_SECAM);
+	if (ret < 0)
+		goto err_unreg_subdev;
+
+	ret = i2c_smbus_write_byte_data(client, ADV7180_AUTODETECT_ENABLE_REG,
+		ADV7180_AUTODETECT_DEFAULT);
+	if (ret < 0)
+		goto err_unreg_subdev;
+
+	/* ITU-R BT.656-4 compatible */
+	ret = i2c_smbus_write_byte_data(client,
+		ADV7180_EXTENDED_OUTPUT_CONTROL_REG,
+		ADV7180_EXTENDED_OUTPUT_CONTROL_NTSCDIS);
+	if (ret < 0)
+		goto err_unreg_subdev;
+
+	/* read current norm */
+	__adv7180_status(client, NULL, &state->curr_norm);
+
+	/* register for interrupts */
+	if (state->irq > 0) {
+		ret = request_irq(state->irq, adv7180_irq, 0, DRIVER_NAME,
+			state);
+		if (ret)
+			goto err_unreg_subdev;
+
+		ret = i2c_smbus_write_byte_data(client, ADV7180_ADI_CTRL_REG,
+			ADV7180_ADI_CTRL_IRQ_SPACE);
+		if (ret < 0)
+			goto err_unreg_subdev;
+
+		/* config the Interrupt pin to be active low */
+		ret = i2c_smbus_write_byte_data(client, ADV7180_ICONF1_ADI,
+			ADV7180_ICONF1_ACTIVE_LOW | ADV7180_ICONF1_PSYNC_ONLY);
+		if (ret < 0)
+			goto err_unreg_subdev;
+
+		ret = i2c_smbus_write_byte_data(client, ADV7180_IMR1_ADI, 0);
+		if (ret < 0)
+			goto err_unreg_subdev;
+
+		ret = i2c_smbus_write_byte_data(client, ADV7180_IMR2_ADI, 0);
+		if (ret < 0)
+			goto err_unreg_subdev;
+
+		/* enable AD change interrupts interrupts */
+		ret = i2c_smbus_write_byte_data(client, ADV7180_IMR3_ADI,
+			ADV7180_IRQ3_AD_CHANGE);
+		if (ret < 0)
+			goto err_unreg_subdev;
+
+		ret = i2c_smbus_write_byte_data(client, ADV7180_IMR4_ADI, 0);
+		if (ret < 0)
+			goto err_unreg_subdev;
+
+		ret = i2c_smbus_write_byte_data(client, ADV7180_ADI_CTRL_REG,
+			0);
+		if (ret < 0)
+			goto err_unreg_subdev;
 	}
 
 	return 0;
+
+err_unreg_subdev:
+	mutex_destroy(&state->mutex);
+	v4l2_device_unregister_subdev(sd);
+	kfree(state);
+err:
+	printk(KERN_ERR DRIVER_NAME ": Failed to probe: %d\n", ret);
+	return ret;
 }
 
-static int adv7180_remove(struct i2c_client *client)
+static __devexit int adv7180_remove(struct i2c_client *client)
 {
 	struct v4l2_subdev *sd = i2c_get_clientdata(client);
+	struct adv7180_state *state = to_state(sd);
+
+	if (state->irq > 0) {
+		free_irq(client->irq, state);
+		if (cancel_work_sync(&state->work)) {
+			/*
+			 * Work was pending, therefore we need to enable
+			 * IRQ here to balance the disable_irq() done in the
+			 * interrupt handler.
+			 */
+			enable_irq(state->irq);
+		}
+	}
 
+	mutex_destroy(&state->mutex);
 	v4l2_device_unregister_subdev(sd);
 	kfree(to_state(sd));
 	return 0;
@@ -179,7 +440,7 @@ static struct i2c_driver adv7180_driver = {
 		.name	= DRIVER_NAME,
 	},
 	.probe		= adv7180_probe,
-	.remove		= adv7180_remove,
+	.remove		= __devexit_p(adv7180_remove),
 	.id_table	= adv7180_id,
 };
 
diff --git a/drivers/media/video/arv.c b/drivers/media/video/arv.c
index d137bac84511..a356d6bd3131 100644
--- a/drivers/media/video/arv.c
+++ b/drivers/media/video/arv.c
@@ -767,7 +767,6 @@ static struct video_device ar_template = {
 	.name		= "Colour AR VGA",
 	.fops		= &ar_fops,
 	.release	= ar_release,
-	.minor		= -1,
 };
 
 #define ALIGN4(x)	((((int)(x)) & 0x3) == 0)
@@ -860,8 +859,8 @@ static int __init ar_init(void)
 		goto out_dev;
 	}
 
-	printk("video%d: Found M64278 VGA (IRQ %d, Freq %dMHz).\n",
-		ar->vdev->num, M32R_IRQ_INT3, freq);
+	printk("%s: Found M64278 VGA (IRQ %d, Freq %dMHz).\n",
+		video_device_node_name(ar->vdev), M32R_IRQ_INT3, freq);
 
 	return 0;
 
diff --git a/drivers/media/video/au0828/au0828-video.c b/drivers/media/video/au0828/au0828-video.c
index 51527d7b55a7..dc67bc40f36f 100644
--- a/drivers/media/video/au0828/au0828-video.c
+++ b/drivers/media/video/au0828/au0828-video.c
@@ -40,7 +40,6 @@
 #include "au0828.h"
 #include "au0828-reg.h"
 
-static LIST_HEAD(au0828_devlist);
 static DEFINE_MUTEX(au0828_sysfs_lock);
 
 #define AU0828_VERSION_CODE KERNEL_VERSION(0, 0, 1)
@@ -693,10 +692,8 @@ void au0828_analog_unregister(struct au0828_dev *dev)
 	dprintk(1, "au0828_release_resources called\n");
 	mutex_lock(&au0828_sysfs_lock);
 
-	if (dev->vdev) {
-		list_del(&dev->au0828list);
+	if (dev->vdev)
 		video_unregister_device(dev->vdev);
-	}
 	if (dev->vbi_dev)
 		video_unregister_device(dev->vbi_dev);
 
@@ -737,29 +734,15 @@ static void res_free(struct au0828_fh *fh)
 
 static int au0828_v4l2_open(struct file *filp)
 {
-	int minor = video_devdata(filp)->minor;
 	int ret = 0;
-	struct au0828_dev *h, *dev = NULL;
+	struct au0828_dev *dev = video_drvdata(filp);
 	struct au0828_fh *fh;
-	int type = 0;
-	struct list_head *list;
-
-	list_for_each(list, &au0828_devlist) {
-		h = list_entry(list, struct au0828_dev, au0828list);
-		if (h->vdev->minor == minor) {
-			dev = h;
-			type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
-		}
+	int type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
+
 #ifdef VBI_IS_WORKING
-		if (h->vbi_dev->minor == minor) {
-			dev = h;
-			type = V4L2_BUF_TYPE_VBI_CAPTURE;
-		}
+	if (video_devdata(filp)->vfl_type == VFL_TYPE_GRABBER)
+		type = V4L2_BUF_TYPE_VBI_CAPTURE;
 #endif
-	}
-
-	if (NULL == dev)
-		return -ENODEV;
 
 	fh = kzalloc(sizeof(struct au0828_fh), GFP_KERNEL);
 	if (NULL == fh) {
@@ -830,7 +813,7 @@ static int au0828_v4l2_close(struct file *filp)
 		au0828_uninit_isoc(dev);
 
 		/* Save some power by putting tuner to sleep */
-		v4l2_device_call_all(&dev->v4l2_dev, 0, tuner, s_standby);
+		v4l2_device_call_all(&dev->v4l2_dev, 0, core, s_power, 0);
 
 		/* When close the device, set the usb intf0 into alt0 to free
 		   USB bandwidth */
@@ -1587,7 +1570,6 @@ static const struct video_device au0828_video_template = {
 	.fops                       = &au0828_v4l_fops,
 	.release                    = video_device_release,
 	.ioctl_ops 		    = &video_ioctl_ops,
-	.minor                      = -1,
 	.tvnorms                    = V4L2_STD_NTSC_M,
 	.current_norm               = V4L2_STD_NTSC_M,
 };
@@ -1676,25 +1658,23 @@ int au0828_analog_register(struct au0828_dev *dev,
 	strcpy(dev->vbi_dev->name, "au0828a vbi");
 #endif
 
-	list_add_tail(&dev->au0828list, &au0828_devlist);
-
 	/* Register the v4l2 device */
+	video_set_drvdata(dev->vdev, dev);
 	retval = video_register_device(dev->vdev, VFL_TYPE_GRABBER, -1);
 	if (retval != 0) {
 		dprintk(1, "unable to register video device (error = %d).\n",
 			retval);
-		list_del(&dev->au0828list);
 		video_device_release(dev->vdev);
 		return -ENODEV;
 	}
 
 #ifdef VBI_IS_WORKING
 	/* Register the vbi device */
+	video_set_drvdata(dev->vbi_dev, dev);
 	retval = video_register_device(dev->vbi_dev, VFL_TYPE_VBI, -1);
 	if (retval != 0) {
 		dprintk(1, "unable to register vbi device (error = %d).\n",
 			retval);
-		list_del(&dev->au0828list);
 		video_device_release(dev->vbi_dev);
 		video_device_release(dev->vdev);
 		return -ENODEV;
diff --git a/drivers/media/video/au0828/au0828.h b/drivers/media/video/au0828/au0828.h
index b977915efbd0..207f32dec6a6 100644
--- a/drivers/media/video/au0828/au0828.h
+++ b/drivers/media/video/au0828/au0828.h
@@ -192,7 +192,6 @@ struct au0828_dev {
 	struct au0828_dvb		dvb;
 
 	/* Analog */
-	struct list_head au0828list;
 	struct v4l2_device v4l2_dev;
 	int users;
 	unsigned int stream_on:1;	/* Locks streams */
diff --git a/drivers/media/video/bt819.c b/drivers/media/video/bt819.c
index f9330e3529c3..5bb0f9e71583 100644
--- a/drivers/media/video/bt819.c
+++ b/drivers/media/video/bt819.c
@@ -299,7 +299,7 @@ static int bt819_s_routing(struct v4l2_subdev *sd,
 
 	v4l2_dbg(1, debug, sd, "set input %x\n", input);
 
-	if (input < 0 || input > 7)
+	if (input > 7)
 		return -EINVAL;
 
 	if (sd->v4l2_dev == NULL || sd->v4l2_dev->notify == NULL)
diff --git a/drivers/media/video/bt8xx/bttv-driver.c b/drivers/media/video/bt8xx/bttv-driver.c
index a6724019c66f..3182a406bdd1 100644
--- a/drivers/media/video/bt8xx/bttv-driver.c
+++ b/drivers/media/video/bt8xx/bttv-driver.c
@@ -3206,24 +3206,24 @@ err:
 
 static int bttv_open(struct file *file)
 {
-	int minor = video_devdata(file)->minor;
+	struct video_device *vdev = video_devdata(file);
 	struct bttv *btv = video_drvdata(file);
 	struct bttv_fh *fh;
 	enum v4l2_buf_type type = 0;
 
-	dprintk(KERN_DEBUG "bttv: open minor=%d\n",minor);
+	dprintk(KERN_DEBUG "bttv: open dev=%s\n", video_device_node_name(vdev));
 
-	lock_kernel();
-	if (btv->video_dev->minor == minor) {
+	if (vdev->vfl_type == VFL_TYPE_GRABBER) {
 		type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
-	} else if (btv->vbi_dev->minor == minor) {
+	} else if (vdev->vfl_type == VFL_TYPE_VBI) {
 		type = V4L2_BUF_TYPE_VBI_CAPTURE;
 	} else {
 		WARN_ON(1);
-		unlock_kernel();
 		return -ENODEV;
 	}
 
+	lock_kernel();
+
 	dprintk(KERN_DEBUG "bttv%d: open called (type=%s)\n",
 		btv->c.nr,v4l2_type_names[type]);
 
@@ -3397,7 +3397,6 @@ static const struct v4l2_ioctl_ops bttv_ioctl_ops = {
 
 static struct video_device bttv_video_template = {
 	.fops         = &bttv_fops,
-	.minor        = -1,
 	.ioctl_ops    = &bttv_ioctl_ops,
 	.tvnorms      = BTTV_NORMS,
 	.current_norm = V4L2_STD_PAL,
@@ -3408,18 +3407,13 @@ static struct video_device bttv_video_template = {
 
 static int radio_open(struct file *file)
 {
-	int minor = video_devdata(file)->minor;
+	struct video_device *vdev = video_devdata(file);
 	struct bttv *btv = video_drvdata(file);
 	struct bttv_fh *fh;
 
-	dprintk("bttv: open minor=%d\n",minor);
+	dprintk("bttv: open dev=%s\n", video_device_node_name(vdev));
 
 	lock_kernel();
-	WARN_ON(btv->radio_dev && btv->radio_dev->minor != minor);
-	if (!btv->radio_dev || btv->radio_dev->minor != minor) {
-		unlock_kernel();
-		return -ENODEV;
-	}
 
 	dprintk("bttv%d: open called (radio)\n",btv->c.nr);
 
@@ -3640,7 +3634,6 @@ static const struct v4l2_ioctl_ops radio_ioctl_ops = {
 
 static struct video_device radio_template = {
 	.fops      = &radio_fops,
-	.minor     = -1,
 	.ioctl_ops = &radio_ioctl_ops,
 };
 
@@ -4208,21 +4201,21 @@ static struct video_device *vdev_init(struct bttv *btv,
 static void bttv_unregister_video(struct bttv *btv)
 {
 	if (btv->video_dev) {
-		if (-1 != btv->video_dev->minor)
+		if (video_is_registered(btv->video_dev))
 			video_unregister_device(btv->video_dev);
 		else
 			video_device_release(btv->video_dev);
 		btv->video_dev = NULL;
 	}
 	if (btv->vbi_dev) {
-		if (-1 != btv->vbi_dev->minor)
+		if (video_is_registered(btv->vbi_dev))
 			video_unregister_device(btv->vbi_dev);
 		else
 			video_device_release(btv->vbi_dev);
 		btv->vbi_dev = NULL;
 	}
 	if (btv->radio_dev) {
-		if (-1 != btv->radio_dev->minor)
+		if (video_is_registered(btv->radio_dev))
 			video_unregister_device(btv->radio_dev);
 		else
 			video_device_release(btv->radio_dev);
@@ -4244,8 +4237,8 @@ static int __devinit bttv_register_video(struct bttv *btv)
 	if (video_register_device(btv->video_dev, VFL_TYPE_GRABBER,
 				  video_nr[btv->c.nr]) < 0)
 		goto err;
-	printk(KERN_INFO "bttv%d: registered device video%d\n",
-	       btv->c.nr, btv->video_dev->num);
+	printk(KERN_INFO "bttv%d: registered device %s\n",
+	       btv->c.nr, video_device_node_name(btv->video_dev));
 	if (device_create_file(&btv->video_dev->dev,
 				     &dev_attr_card)<0) {
 		printk(KERN_ERR "bttv%d: device_create_file 'card' "
@@ -4261,8 +4254,8 @@ static int __devinit bttv_register_video(struct bttv *btv)
 	if (video_register_device(btv->vbi_dev, VFL_TYPE_VBI,
 				  vbi_nr[btv->c.nr]) < 0)
 		goto err;
-	printk(KERN_INFO "bttv%d: registered device vbi%d\n",
-	       btv->c.nr, btv->vbi_dev->num);
+	printk(KERN_INFO "bttv%d: registered device %s\n",
+	       btv->c.nr, video_device_node_name(btv->vbi_dev));
 
 	if (!btv->has_radio)
 		return 0;
@@ -4273,8 +4266,8 @@ static int __devinit bttv_register_video(struct bttv *btv)
 	if (video_register_device(btv->radio_dev, VFL_TYPE_RADIO,
 				  radio_nr[btv->c.nr]) < 0)
 		goto err;
-	printk(KERN_INFO "bttv%d: registered device radio%d\n",
-	       btv->c.nr, btv->radio_dev->num);
+	printk(KERN_INFO "bttv%d: registered device %s\n",
+	       btv->c.nr, video_device_node_name(btv->radio_dev));
 
 	/* all done */
 	return 0;
diff --git a/drivers/media/video/bt8xx/bttv-i2c.c b/drivers/media/video/bt8xx/bttv-i2c.c
index beda363418b0..63aa31a041e8 100644
--- a/drivers/media/video/bt8xx/bttv-i2c.c
+++ b/drivers/media/video/bt8xx/bttv-i2c.c
@@ -40,7 +40,7 @@ static int i2c_debug;
 static int i2c_hw;
 static int i2c_scan;
 module_param(i2c_debug, int, 0644);
-MODULE_PARM_DESC(i2c_hw,"configure i2c debug level");
+MODULE_PARM_DESC(i2c_debug, "configure i2c debug level");
 module_param(i2c_hw,    int, 0444);
 MODULE_PARM_DESC(i2c_hw,"force use of hardware i2c support, "
 			"instead of software bitbang");
@@ -400,7 +400,7 @@ int __devinit init_bttv_i2c(struct bttv *btv)
 		   That's why we probe 0x1a (~0x34) first. CB
 		*/
 		const unsigned short addr_list[] = {
-			0x1a, 0x18, 0x4b, 0x64, 0x30,
+			0x1a, 0x18, 0x4b, 0x64, 0x30, 0x71,
 			I2C_CLIENT_END
 		};
 
diff --git a/drivers/media/video/bt8xx/bttv-input.c b/drivers/media/video/bt8xx/bttv-input.c
index ebd51afe8761..277a092e1214 100644
--- a/drivers/media/video/bt8xx/bttv-input.c
+++ b/drivers/media/video/bt8xx/bttv-input.c
@@ -73,12 +73,12 @@ static void ir_handle_key(struct bttv *btv)
 
 	if ((ir->mask_keydown  &&  (0 != (gpio & ir->mask_keydown))) ||
 	    (ir->mask_keyup    &&  (0 == (gpio & ir->mask_keyup)))) {
-		ir_input_keydown(ir->dev,&ir->ir,data,data);
+		ir_input_keydown(ir->dev, &ir->ir, data);
 	} else {
 		/* HACK: Probably, ir->mask_keydown is missing
 		   for this board */
 		if (btv->c.type == BTTV_BOARD_WINFAST2000)
-			ir_input_keydown(ir->dev, &ir->ir, data, data);
+			ir_input_keydown(ir->dev, &ir->ir, data);
 
 		ir_input_nokey(ir->dev,&ir->ir);
 	}
@@ -104,7 +104,7 @@ static void ir_enltv_handle_key(struct bttv *btv)
 			gpio, data,
 			(gpio & ir->mask_keyup) ? " up" : "up/down");
 
-		ir_input_keydown(ir->dev, &ir->ir, data, data);
+		ir_input_keydown(ir->dev, &ir->ir, data);
 		if (keyup)
 			ir_input_nokey(ir->dev, &ir->ir);
 	} else {
@@ -118,7 +118,7 @@ static void ir_enltv_handle_key(struct bttv *btv)
 		if (keyup)
 			ir_input_nokey(ir->dev, &ir->ir);
 		else
-			ir_input_keydown(ir->dev, &ir->ir, data, data);
+			ir_input_keydown(ir->dev, &ir->ir, data);
 	}
 
 	ir->last_gpio = data | keyup;
@@ -368,7 +368,10 @@ int bttv_input_init(struct bttv *btv)
 	snprintf(ir->phys, sizeof(ir->phys), "pci-%s/ir0",
 		 pci_name(btv->c.pci));
 
-	ir_input_init(input_dev, &ir->ir, ir_type, ir_codes);
+	err = ir_input_init(input_dev, &ir->ir, ir_type);
+	if (err < 0)
+		goto err_out_free;
+
 	input_dev->name = ir->name;
 	input_dev->phys = ir->phys;
 	input_dev->id.bustype = BUS_PCI;
@@ -386,7 +389,7 @@ int bttv_input_init(struct bttv *btv)
 	bttv_ir_start(btv, ir);
 
 	/* all done */
-	err = input_register_device(btv->remote->dev);
+	err = ir_input_register(btv->remote->dev, ir_codes);
 	if (err)
 		goto err_out_stop;
 
@@ -400,7 +403,6 @@ int bttv_input_init(struct bttv *btv)
 	bttv_ir_stop(btv);
 	btv->remote = NULL;
  err_out_free:
-	input_free_device(input_dev);
 	kfree(ir);
 	return err;
 }
@@ -411,7 +413,7 @@ void bttv_input_fini(struct bttv *btv)
 		return;
 
 	bttv_ir_stop(btv);
-	input_unregister_device(btv->remote->dev);
+	ir_input_unregister(btv->remote->dev);
 	kfree(btv->remote);
 	btv->remote = NULL;
 }
diff --git a/drivers/media/video/c-qcam.c b/drivers/media/video/c-qcam.c
index 85cf1778827a..e2cbebab959b 100644
--- a/drivers/media/video/c-qcam.c
+++ b/drivers/media/video/c-qcam.c
@@ -809,8 +809,8 @@ static int init_cqcam(struct parport *port)
 		return -ENODEV;
 	}
 
-	printk(KERN_INFO "video%d: Colour QuickCam found on %s\n",
-	       qcam->vdev.num, qcam->pport->name);
+	printk(KERN_INFO "%s: Colour QuickCam found on %s\n",
+	       video_device_node_name(&qcam->vdev), qcam->pport->name);
 
 	qcams[num_cams++] = qcam;
 
diff --git a/drivers/media/video/cafe_ccic.c b/drivers/media/video/cafe_ccic.c
index 10230cb3d210..7bb9c1ec7819 100644
--- a/drivers/media/video/cafe_ccic.c
+++ b/drivers/media/video/cafe_ccic.c
@@ -1723,7 +1723,6 @@ static const struct v4l2_ioctl_ops cafe_v4l_ioctl_ops = {
 
 static struct video_device cafe_v4l_template = {
 	.name = "cafe",
-	.minor = -1, /* Get one dynamically */
 	.tvnorms = V4L2_STD_NTSC_M,
 	.current_norm = V4L2_STD_NTSC_M,  /* make mplayer happy */
 
diff --git a/drivers/media/video/cpia.c b/drivers/media/video/cpia.c
index 2377313c041a..551ddf216a4b 100644
--- a/drivers/media/video/cpia.c
+++ b/drivers/media/video/cpia.c
@@ -32,6 +32,7 @@
 #include <linux/fs.h>
 #include <linux/vmalloc.h>
 #include <linux/sched.h>
+#include <linux/seq_file.h>
 #include <linux/slab.h>
 #include <linux/proc_fs.h>
 #include <linux/ctype.h>
@@ -244,72 +245,67 @@ static void rvfree(void *mem, unsigned long size)
 #ifdef CONFIG_PROC_FS
 static struct proc_dir_entry *cpia_proc_root=NULL;
 
-static int cpia_read_proc(char *page, char **start, off_t off,
-			  int count, int *eof, void *data)
+static int cpia_proc_show(struct seq_file *m, void *v)
 {
-	char *out = page;
-	int len, tmp;
-	struct cam_data *cam = data;
+	struct cam_data *cam = m->private;
+	int tmp;
 	char tmpstr[29];
 
-	/* IMPORTANT: This output MUST be kept under PAGE_SIZE
-	 *            or we need to get more sophisticated. */
-
-	out += sprintf(out, "read-only\n-----------------------\n");
-	out += sprintf(out, "V4L Driver version:       %d.%d.%d\n",
+	seq_printf(m, "read-only\n-----------------------\n");
+	seq_printf(m, "V4L Driver version:       %d.%d.%d\n",
 		       CPIA_MAJ_VER, CPIA_MIN_VER, CPIA_PATCH_VER);
-	out += sprintf(out, "CPIA Version:             %d.%02d (%d.%d)\n",
+	seq_printf(m, "CPIA Version:             %d.%02d (%d.%d)\n",
 		       cam->params.version.firmwareVersion,
 		       cam->params.version.firmwareRevision,
 		       cam->params.version.vcVersion,
 		       cam->params.version.vcRevision);
-	out += sprintf(out, "CPIA PnP-ID:              %04x:%04x:%04x\n",
+	seq_printf(m, "CPIA PnP-ID:              %04x:%04x:%04x\n",
 		       cam->params.pnpID.vendor, cam->params.pnpID.product,
 		       cam->params.pnpID.deviceRevision);
-	out += sprintf(out, "VP-Version:               %d.%d %04x\n",
+	seq_printf(m, "VP-Version:               %d.%d %04x\n",
 		       cam->params.vpVersion.vpVersion,
 		       cam->params.vpVersion.vpRevision,
 		       cam->params.vpVersion.cameraHeadID);
 
-	out += sprintf(out, "system_state:             %#04x\n",
+	seq_printf(m, "system_state:             %#04x\n",
 		       cam->params.status.systemState);
-	out += sprintf(out, "grab_state:               %#04x\n",
+	seq_printf(m, "grab_state:               %#04x\n",
 		       cam->params.status.grabState);
-	out += sprintf(out, "stream_state:             %#04x\n",
+	seq_printf(m, "stream_state:             %#04x\n",
 		       cam->params.status.streamState);
-	out += sprintf(out, "fatal_error:              %#04x\n",
+	seq_printf(m, "fatal_error:              %#04x\n",
 		       cam->params.status.fatalError);
-	out += sprintf(out, "cmd_error:                %#04x\n",
+	seq_printf(m, "cmd_error:                %#04x\n",
 		       cam->params.status.cmdError);
-	out += sprintf(out, "debug_flags:              %#04x\n",
+	seq_printf(m, "debug_flags:              %#04x\n",
 		       cam->params.status.debugFlags);
-	out += sprintf(out, "vp_status:                %#04x\n",
+	seq_printf(m, "vp_status:                %#04x\n",
 		       cam->params.status.vpStatus);
-	out += sprintf(out, "error_code:               %#04x\n",
+	seq_printf(m, "error_code:               %#04x\n",
 		       cam->params.status.errorCode);
 	/* QX3 specific entries */
 	if (cam->params.qx3.qx3_detected) {
-		out += sprintf(out, "button:                   %4d\n",
+		seq_printf(m, "button:                   %4d\n",
 			       cam->params.qx3.button);
-		out += sprintf(out, "cradled:                  %4d\n",
+		seq_printf(m, "cradled:                  %4d\n",
 			       cam->params.qx3.cradled);
 	}
-	out += sprintf(out, "video_size:               %s\n",
+	seq_printf(m, "video_size:               %s\n",
 		       cam->params.format.videoSize == VIDEOSIZE_CIF ?
 		       "CIF " : "QCIF");
-	out += sprintf(out, "roi:                      (%3d, %3d) to (%3d, %3d)\n",
+	seq_printf(m, "roi:                      (%3d, %3d) to (%3d, %3d)\n",
 		       cam->params.roi.colStart*8,
 		       cam->params.roi.rowStart*4,
 		       cam->params.roi.colEnd*8,
 		       cam->params.roi.rowEnd*4);
-	out += sprintf(out, "actual_fps:               %3d\n", cam->fps);
-	out += sprintf(out, "transfer_rate:            %4dkB/s\n",
+	seq_printf(m, "actual_fps:               %3d\n", cam->fps);
+	seq_printf(m, "transfer_rate:            %4dkB/s\n",
 		       cam->transfer_rate);
 
-	out += sprintf(out, "\nread-write\n");
-	out += sprintf(out, "-----------------------  current       min"
+	seq_printf(m, "\nread-write\n");
+	seq_printf(m, "-----------------------  current       min"
 		       "       max   default  comment\n");
-	out += sprintf(out, "brightness:             %8d  %8d  %8d  %8d\n",
+	seq_printf(m, "brightness:             %8d  %8d  %8d  %8d\n",
 		       cam->params.colourParams.brightness, 0, 100, 50);
 	if (cam->params.version.firmwareVersion == 1 &&
 	   cam->params.version.firmwareRevision == 2)
@@ -318,26 +314,26 @@ static int cpia_read_proc(char *page, char **start, off_t off,
 	else
 		tmp = 96;
 
-	out += sprintf(out, "contrast:               %8d  %8d  %8d  %8d"
+	seq_printf(m, "contrast:               %8d  %8d  %8d  %8d"
 		       "  steps of 8\n",
 		       cam->params.colourParams.contrast, 0, tmp, 48);
-	out += sprintf(out, "saturation:             %8d  %8d  %8d  %8d\n",
+	seq_printf(m, "saturation:             %8d  %8d  %8d  %8d\n",
 		       cam->params.colourParams.saturation, 0, 100, 50);
 	tmp = (25000+5000*cam->params.sensorFps.baserate)/
 	      (1<<cam->params.sensorFps.divisor);
-	out += sprintf(out, "sensor_fps:             %4d.%03d  %8d  %8d  %8d\n",
+	seq_printf(m, "sensor_fps:             %4d.%03d  %8d  %8d  %8d\n",
 		       tmp/1000, tmp%1000, 3, 30, 15);
-	out += sprintf(out, "stream_start_line:      %8d  %8d  %8d  %8d\n",
+	seq_printf(m, "stream_start_line:      %8d  %8d  %8d  %8d\n",
 		       2*cam->params.streamStartLine, 0,
 		       cam->params.format.videoSize == VIDEOSIZE_CIF ? 288:144,
 		       cam->params.format.videoSize == VIDEOSIZE_CIF ? 240:120);
-	out += sprintf(out, "sub_sample:             %8s  %8s  %8s  %8s\n",
+	seq_printf(m, "sub_sample:             %8s  %8s  %8s  %8s\n",
 		       cam->params.format.subSample == SUBSAMPLE_420 ?
 		       "420" : "422", "420", "422", "422");
-	out += sprintf(out, "yuv_order:              %8s  %8s  %8s  %8s\n",
+	seq_printf(m, "yuv_order:              %8s  %8s  %8s  %8s\n",
 		       cam->params.format.yuvOrder == YUVORDER_YUYV ?
 		       "YUYV" : "UYVY", "YUYV" , "UYVY", "YUYV");
-	out += sprintf(out, "ecp_timing:             %8s  %8s  %8s  %8s\n",
+	seq_printf(m, "ecp_timing:             %8s  %8s  %8s  %8s\n",
 		       cam->params.ecpTiming ? "slow" : "normal", "slow",
 		       "normal", "normal");
 
@@ -346,13 +342,13 @@ static int cpia_read_proc(char *page, char **start, off_t off,
 	} else {
 		sprintf(tmpstr, "manual");
 	}
-	out += sprintf(out, "color_balance_mode:     %8s  %8s  %8s"
+	seq_printf(m, "color_balance_mode:     %8s  %8s  %8s"
 		       "  %8s\n",  tmpstr, "manual", "auto", "auto");
-	out += sprintf(out, "red_gain:               %8d  %8d  %8d  %8d\n",
+	seq_printf(m, "red_gain:               %8d  %8d  %8d  %8d\n",
 		       cam->params.colourBalance.redGain, 0, 212, 32);
-	out += sprintf(out, "green_gain:             %8d  %8d  %8d  %8d\n",
+	seq_printf(m, "green_gain:             %8d  %8d  %8d  %8d\n",
 		       cam->params.colourBalance.greenGain, 0, 212, 6);
-	out += sprintf(out, "blue_gain:              %8d  %8d  %8d  %8d\n",
+	seq_printf(m, "blue_gain:              %8d  %8d  %8d  %8d\n",
 		       cam->params.colourBalance.blueGain, 0, 212, 92);
 
 	if (cam->params.version.firmwareVersion == 1 &&
@@ -363,10 +359,10 @@ static int cpia_read_proc(char *page, char **start, off_t off,
 		sprintf(tmpstr, "%8d  %8d  %8d", 1, 8, 2);
 
 	if (cam->params.exposure.gainMode == 0)
-		out += sprintf(out, "max_gain:                unknown  %28s"
+		seq_printf(m, "max_gain:                unknown  %28s"
 			       "  powers of 2\n", tmpstr);
 	else
-		out += sprintf(out, "max_gain:               %8d  %28s"
+		seq_printf(m, "max_gain:               %8d  %28s"
 			       "  1,2,4 or 8 \n",
 			       1<<(cam->params.exposure.gainMode-1), tmpstr);
 
@@ -382,12 +378,12 @@ static int cpia_read_proc(char *page, char **start, off_t off,
 		sprintf(tmpstr, "unknown");
 		break;
 	}
-	out += sprintf(out, "exposure_mode:          %8s  %8s  %8s"
+	seq_printf(m, "exposure_mode:          %8s  %8s  %8s"
 		       "  %8s\n",  tmpstr, "manual", "auto", "auto");
-	out += sprintf(out, "centre_weight:          %8s  %8s  %8s  %8s\n",
+	seq_printf(m, "centre_weight:          %8s  %8s  %8s  %8s\n",
 		       (2-cam->params.exposure.centreWeight) ? "on" : "off",
 		       "off", "on", "on");
-	out += sprintf(out, "gain:                   %8d  %8d  max_gain  %8d  1,2,4,8 possible\n",
+	seq_printf(m, "gain:                   %8d  %8d  max_gain  %8d  1,2,4,8 possible\n",
 		       1<<cam->params.exposure.gain, 1, 1);
 	if (cam->params.version.firmwareVersion == 1 &&
 	   cam->params.version.firmwareRevision == 2)
@@ -396,7 +392,7 @@ static int cpia_read_proc(char *page, char **start, off_t off,
 	else
 		tmp = 510;
 
-	out += sprintf(out, "fine_exp:               %8d  %8d  %8d  %8d\n",
+	seq_printf(m, "fine_exp:               %8d  %8d  %8d  %8d\n",
 		       cam->params.exposure.fineExp*2, 0, tmp, 0);
 	if (cam->params.version.firmwareVersion == 1 &&
 	   cam->params.version.firmwareRevision == 2)
@@ -405,127 +401,122 @@ static int cpia_read_proc(char *page, char **start, off_t off,
 	else
 		tmp = MAX_EXP;
 
-	out += sprintf(out, "coarse_exp:             %8d  %8d  %8d"
+	seq_printf(m, "coarse_exp:             %8d  %8d  %8d"
 		       "  %8d\n", cam->params.exposure.coarseExpLo+
 		       256*cam->params.exposure.coarseExpHi, 0, tmp, 185);
-	out += sprintf(out, "red_comp:               %8d  %8d  %8d  %8d\n",
+	seq_printf(m, "red_comp:               %8d  %8d  %8d  %8d\n",
 		       cam->params.exposure.redComp, COMP_RED, 255, COMP_RED);
-	out += sprintf(out, "green1_comp:            %8d  %8d  %8d  %8d\n",
+	seq_printf(m, "green1_comp:            %8d  %8d  %8d  %8d\n",
 		       cam->params.exposure.green1Comp, COMP_GREEN1, 255,
 		       COMP_GREEN1);
-	out += sprintf(out, "green2_comp:            %8d  %8d  %8d  %8d\n",
+	seq_printf(m, "green2_comp:            %8d  %8d  %8d  %8d\n",
 		       cam->params.exposure.green2Comp, COMP_GREEN2, 255,
 		       COMP_GREEN2);
-	out += sprintf(out, "blue_comp:              %8d  %8d  %8d  %8d\n",
+	seq_printf(m, "blue_comp:              %8d  %8d  %8d  %8d\n",
 		       cam->params.exposure.blueComp, COMP_BLUE, 255, COMP_BLUE);
 
-	out += sprintf(out, "apcor_gain1:            %#8x  %#8x  %#8x  %#8x\n",
+	seq_printf(m, "apcor_gain1:            %#8x  %#8x  %#8x  %#8x\n",
 		       cam->params.apcor.gain1, 0, 0xff, 0x1c);
-	out += sprintf(out, "apcor_gain2:            %#8x  %#8x  %#8x  %#8x\n",
+	seq_printf(m, "apcor_gain2:            %#8x  %#8x  %#8x  %#8x\n",
 		       cam->params.apcor.gain2, 0, 0xff, 0x1a);
-	out += sprintf(out, "apcor_gain4:            %#8x  %#8x  %#8x  %#8x\n",
+	seq_printf(m, "apcor_gain4:            %#8x  %#8x  %#8x  %#8x\n",
 		       cam->params.apcor.gain4, 0, 0xff, 0x2d);
-	out += sprintf(out, "apcor_gain8:            %#8x  %#8x  %#8x  %#8x\n",
+	seq_printf(m, "apcor_gain8:            %#8x  %#8x  %#8x  %#8x\n",
 		       cam->params.apcor.gain8, 0, 0xff, 0x2a);
-	out += sprintf(out, "vl_offset_gain1:        %8d  %8d  %8d  %8d\n",
+	seq_printf(m, "vl_offset_gain1:        %8d  %8d  %8d  %8d\n",
 		       cam->params.vlOffset.gain1, 0, 255, 24);
-	out += sprintf(out, "vl_offset_gain2:        %8d  %8d  %8d  %8d\n",
+	seq_printf(m, "vl_offset_gain2:        %8d  %8d  %8d  %8d\n",
 		       cam->params.vlOffset.gain2, 0, 255, 28);
-	out += sprintf(out, "vl_offset_gain4:        %8d  %8d  %8d  %8d\n",
+	seq_printf(m, "vl_offset_gain4:        %8d  %8d  %8d  %8d\n",
 		       cam->params.vlOffset.gain4, 0, 255, 30);
-	out += sprintf(out, "vl_offset_gain8:        %8d  %8d  %8d  %8d\n",
+	seq_printf(m, "vl_offset_gain8:        %8d  %8d  %8d  %8d\n",
 		       cam->params.vlOffset.gain8, 0, 255, 30);
-	out += sprintf(out, "flicker_control:        %8s  %8s  %8s  %8s\n",
+	seq_printf(m, "flicker_control:        %8s  %8s  %8s  %8s\n",
 		       cam->params.flickerControl.flickerMode ? "on" : "off",
 		       "off", "on", "off");
-	out += sprintf(out, "mains_frequency:        %8d  %8d  %8d  %8d"
+	seq_printf(m, "mains_frequency:        %8d  %8d  %8d  %8d"
 		       " only 50/60\n",
 		       cam->mainsFreq ? 60 : 50, 50, 60, 50);
 	if(cam->params.flickerControl.allowableOverExposure < 0)
-		out += sprintf(out, "allowable_overexposure: %4dauto      auto  %8d      auto\n",
+		seq_printf(m, "allowable_overexposure: %4dauto      auto  %8d      auto\n",
 			       -cam->params.flickerControl.allowableOverExposure,
 			       255);
 	else
-		out += sprintf(out, "allowable_overexposure: %8d      auto  %8d      auto\n",
+		seq_printf(m, "allowable_overexposure: %8d      auto  %8d      auto\n",
 			       cam->params.flickerControl.allowableOverExposure,
 			       255);
-	out += sprintf(out, "compression_mode:       ");
+	seq_printf(m, "compression_mode:       ");
 	switch(cam->params.compression.mode) {
 	case CPIA_COMPRESSION_NONE:
-		out += sprintf(out, "%8s", "none");
+		seq_printf(m, "%8s", "none");
 		break;
 	case CPIA_COMPRESSION_AUTO:
-		out += sprintf(out, "%8s", "auto");
+		seq_printf(m, "%8s", "auto");
 		break;
 	case CPIA_COMPRESSION_MANUAL:
-		out += sprintf(out, "%8s", "manual");
+		seq_printf(m, "%8s", "manual");
 		break;
 	default:
-		out += sprintf(out, "%8s", "unknown");
+		seq_printf(m, "%8s", "unknown");
 		break;
 	}
-	out += sprintf(out, "    none,auto,manual      auto\n");
-	out += sprintf(out, "decimation_enable:      %8s  %8s  %8s  %8s\n",
+	seq_printf(m, "    none,auto,manual      auto\n");
+	seq_printf(m, "decimation_enable:      %8s  %8s  %8s  %8s\n",
 		       cam->params.compression.decimation ==
 		       DECIMATION_ENAB ? "on":"off", "off", "on",
 		       "off");
-	out += sprintf(out, "compression_target:    %9s %9s %9s %9s\n",
+	seq_printf(m, "compression_target:    %9s %9s %9s %9s\n",
 		       cam->params.compressionTarget.frTargeting  ==
 		       CPIA_COMPRESSION_TARGET_FRAMERATE ?
 		       "framerate":"quality",
 		       "framerate", "quality", "quality");
-	out += sprintf(out, "target_framerate:       %8d  %8d  %8d  %8d\n",
+	seq_printf(m, "target_framerate:       %8d  %8d  %8d  %8d\n",
 		       cam->params.compressionTarget.targetFR, 1, 30, 15);
-	out += sprintf(out, "target_quality:         %8d  %8d  %8d  %8d\n",
+	seq_printf(m, "target_quality:         %8d  %8d  %8d  %8d\n",
 		       cam->params.compressionTarget.targetQ, 1, 64, 5);
-	out += sprintf(out, "y_threshold:            %8d  %8d  %8d  %8d\n",
+	seq_printf(m, "y_threshold:            %8d  %8d  %8d  %8d\n",
 		       cam->params.yuvThreshold.yThreshold, 0, 31, 6);
-	out += sprintf(out, "uv_threshold:           %8d  %8d  %8d  %8d\n",
+	seq_printf(m, "uv_threshold:           %8d  %8d  %8d  %8d\n",
 		       cam->params.yuvThreshold.uvThreshold, 0, 31, 6);
-	out += sprintf(out, "hysteresis:             %8d  %8d  %8d  %8d\n",
+	seq_printf(m, "hysteresis:             %8d  %8d  %8d  %8d\n",
 		       cam->params.compressionParams.hysteresis, 0, 255, 3);
-	out += sprintf(out, "threshold_max:          %8d  %8d  %8d  %8d\n",
+	seq_printf(m, "threshold_max:          %8d  %8d  %8d  %8d\n",
 		       cam->params.compressionParams.threshMax, 0, 255, 11);
-	out += sprintf(out, "small_step:             %8d  %8d  %8d  %8d\n",
+	seq_printf(m, "small_step:             %8d  %8d  %8d  %8d\n",
 		       cam->params.compressionParams.smallStep, 0, 255, 1);
-	out += sprintf(out, "large_step:             %8d  %8d  %8d  %8d\n",
+	seq_printf(m, "large_step:             %8d  %8d  %8d  %8d\n",
 		       cam->params.compressionParams.largeStep, 0, 255, 3);
-	out += sprintf(out, "decimation_hysteresis:  %8d  %8d  %8d  %8d\n",
+	seq_printf(m, "decimation_hysteresis:  %8d  %8d  %8d  %8d\n",
 		       cam->params.compressionParams.decimationHysteresis,
 		       0, 255, 2);
-	out += sprintf(out, "fr_diff_step_thresh:    %8d  %8d  %8d  %8d\n",
+	seq_printf(m, "fr_diff_step_thresh:    %8d  %8d  %8d  %8d\n",
 		       cam->params.compressionParams.frDiffStepThresh,
 		       0, 255, 5);
-	out += sprintf(out, "q_diff_step_thresh:     %8d  %8d  %8d  %8d\n",
+	seq_printf(m, "q_diff_step_thresh:     %8d  %8d  %8d  %8d\n",
 		       cam->params.compressionParams.qDiffStepThresh,
 		       0, 255, 3);
-	out += sprintf(out, "decimation_thresh_mod:  %8d  %8d  %8d  %8d\n",
+	seq_printf(m, "decimation_thresh_mod:  %8d  %8d  %8d  %8d\n",
 		       cam->params.compressionParams.decimationThreshMod,
 		       0, 255, 2);
 	/* QX3 specific entries */
 	if (cam->params.qx3.qx3_detected) {
-		out += sprintf(out, "toplight:               %8s  %8s  %8s  %8s\n",
+		seq_printf(m, "toplight:               %8s  %8s  %8s  %8s\n",
 			       cam->params.qx3.toplight ? "on" : "off",
 			       "off", "on", "off");
-		out += sprintf(out, "bottomlight:            %8s  %8s  %8s  %8s\n",
+		seq_printf(m, "bottomlight:            %8s  %8s  %8s  %8s\n",
 			       cam->params.qx3.bottomlight ? "on" : "off",
 			       "off", "on", "off");
 	}
 
-	len = out - page;
-	len -= off;
-	if (len < count) {
-		*eof = 1;
-		if (len <= 0) return 0;
-	} else
-		len = count;
-
-	*start = page + off;
-	return len;
+	return 0;
 }
 
+static int cpia_proc_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, cpia_proc_show, PDE(inode)->data);
+}
 
-static int match(char *checkstr, char **buffer, unsigned long *count,
+static int match(char *checkstr, char **buffer, size_t *count,
 		 int *find_colon, int *err)
 {
 	int ret, colon_found = 1;
@@ -551,7 +542,7 @@ static int match(char *checkstr, char **buffer, unsigned long *count,
 	return ret;
 }
 
-static unsigned long int value(char **buffer, unsigned long *count, int *err)
+static unsigned long int value(char **buffer, size_t *count, int *err)
 {
 	char *p;
 	unsigned long int ret;
@@ -565,10 +556,10 @@ static unsigned long int value(char **buffer, unsigned long *count, int *err)
 	return ret;
 }
 
-static int cpia_write_proc(struct file *file, const char __user *buf,
-			   unsigned long count, void *data)
+static ssize_t cpia_proc_write(struct file *file, const char __user *buf,
+			       size_t count, loff_t *pos)
 {
-	struct cam_data *cam = data;
+	struct cam_data *cam = PDE(file->f_path.dentry->d_inode)->data;
 	struct cam_params new_params;
 	char *page, *buffer;
 	int retval, find_colon;
@@ -582,7 +573,7 @@ static int cpia_write_proc(struct file *file, const char __user *buf,
 	 * from the comx driver
 	 */
 	if (count > PAGE_SIZE) {
-		printk(KERN_ERR "count is %lu > %d!!!\n", count, (int)PAGE_SIZE);
+		printk(KERN_ERR "count is %zu > %d!!!\n", count, (int)PAGE_SIZE);
 		return -ENOSPC;
 	}
 
@@ -1340,23 +1331,28 @@ out:
 	return retval;
 }
 
+static const struct file_operations cpia_proc_fops = {
+	.owner		= THIS_MODULE,
+	.open		= cpia_proc_open,
+	.read		= seq_read,
+	.llseek		= seq_lseek,
+	.release	= single_release,
+	.write		= cpia_proc_write,
+};
+
 static void create_proc_cpia_cam(struct cam_data *cam)
 {
-	char name[5 + 1 + 10 + 1];
 	struct proc_dir_entry *ent;
 
 	if (!cpia_proc_root || !cam)
 		return;
 
-	snprintf(name, sizeof(name), "video%d", cam->vdev.num);
-
-	ent = create_proc_entry(name, S_IFREG|S_IRUGO|S_IWUSR, cpia_proc_root);
+	ent = proc_create_data(video_device_node_name(&cam->vdev),
+			       S_IRUGO|S_IWUSR, cpia_proc_root,
+			       &cpia_proc_fops, cam);
 	if (!ent)
 		return;
 
-	ent->data = cam;
-	ent->read_proc = cpia_read_proc;
-	ent->write_proc = cpia_write_proc;
 	/*
 	   size of the proc entry is 3736 bytes for the standard webcam;
 	   the extra features of the QX3 microscope add 189 bytes.
@@ -1368,13 +1364,10 @@ static void create_proc_cpia_cam(struct cam_data *cam)
 
 static void destroy_proc_cpia_cam(struct cam_data *cam)
 {
-	char name[5 + 1 + 10 + 1];
-
 	if (!cam || !cam->proc_entry)
 		return;
 
-	snprintf(name, sizeof(name), "video%d", cam->vdev.num);
-	remove_proc_entry(name, cpia_proc_root);
+	remove_proc_entry(video_device_node_name(&cam->vdev), cpia_proc_root);
 	cam->proc_entry = NULL;
 }
 
@@ -3999,7 +3992,7 @@ void cpia_unregister_camera(struct cam_data *cam)
 	}
 
 #ifdef CONFIG_PROC_FS
-	DBG("destroying /proc/cpia/video%d\n", cam->vdev.num);
+	DBG("destroying /proc/cpia/%s\n", video_device_node_name(&cam->vdev));
 	destroy_proc_cpia_cam(cam);
 #endif
 	if (!cam->open_count) {
diff --git a/drivers/media/video/cpia2/cpia2_v4l.c b/drivers/media/video/cpia2/cpia2_v4l.c
index 0b4a8f309cfa..6f91415eb7b4 100644
--- a/drivers/media/video/cpia2/cpia2_v4l.c
+++ b/drivers/media/video/cpia2/cpia2_v4l.c
@@ -38,17 +38,12 @@
 #include <linux/slab.h>
 #include <linux/init.h>
 #include <linux/videodev.h>
+#include <linux/stringify.h>
 #include <media/v4l2-ioctl.h>
 
 #include "cpia2.h"
 #include "cpia2dev.h"
 
-
-//#define _CPIA2_DEBUG_
-
-#define MAKE_STRING_1(x)	#x
-#define MAKE_STRING(x)	MAKE_STRING_1(x)
-
 static int video_nr = -1;
 module_param(video_nr, int, 0);
 MODULE_PARM_DESC(video_nr,"video device to register (0=/dev/video0, etc)");
@@ -60,26 +55,26 @@ MODULE_PARM_DESC(buffer_size, "Size for each frame buffer in bytes (default 68k)
 static int num_buffers = 3;
 module_param(num_buffers, int, 0);
 MODULE_PARM_DESC(num_buffers, "Number of frame buffers (1-"
-		 MAKE_STRING(VIDEO_MAX_FRAME) ", default 3)");
+		 __stringify(VIDEO_MAX_FRAME) ", default 3)");
 
 static int alternate = DEFAULT_ALT;
 module_param(alternate, int, 0);
-MODULE_PARM_DESC(alternate, "USB Alternate (" MAKE_STRING(USBIF_ISO_1) "-"
-		 MAKE_STRING(USBIF_ISO_6) ", default "
-		 MAKE_STRING(DEFAULT_ALT) ")");
+MODULE_PARM_DESC(alternate, "USB Alternate (" __stringify(USBIF_ISO_1) "-"
+		 __stringify(USBIF_ISO_6) ", default "
+		 __stringify(DEFAULT_ALT) ")");
 
 static int flicker_freq = 60;
 module_param(flicker_freq, int, 0);
-MODULE_PARM_DESC(flicker_freq, "Flicker frequency (" MAKE_STRING(50) "or"
-		 MAKE_STRING(60) ", default "
-		 MAKE_STRING(60) ")");
+MODULE_PARM_DESC(flicker_freq, "Flicker frequency (" __stringify(50) "or"
+		 __stringify(60) ", default "
+		 __stringify(60) ")");
 
 static int flicker_mode = NEVER_FLICKER;
 module_param(flicker_mode, int, 0);
 MODULE_PARM_DESC(flicker_mode,
-		 "Flicker supression (" MAKE_STRING(NEVER_FLICKER) "or"
-		 MAKE_STRING(ANTI_FLICKER_ON) ", default "
-		 MAKE_STRING(NEVER_FLICKER) ")");
+		 "Flicker supression (" __stringify(NEVER_FLICKER) "or"
+		 __stringify(ANTI_FLICKER_ON) ", default "
+		 __stringify(NEVER_FLICKER) ")");
 
 MODULE_AUTHOR("Steve Miller (STMicroelectronics) <steve.miller@st.com>");
 MODULE_DESCRIPTION("V4L-driver for STMicroelectronics CPiA2 based cameras");
@@ -1926,7 +1921,6 @@ static const struct v4l2_file_operations fops_template = {
 static struct video_device cpia2_template = {
 	/* I could not find any place for the old .initialize initializer?? */
 	.name=		"CPiA2 Camera",
-	.minor=		-1,
 	.fops=		&fops_template,
 	.release=	video_device_release,
 };
@@ -1967,9 +1961,9 @@ void cpia2_unregister_camera(struct camera_data *cam)
 	if (!cam->open_count) {
 		video_unregister_device(cam->vdev);
 	} else {
-		LOG("/dev/video%d removed while open, "
-		    "deferring video_unregister_device\n",
-		    cam->vdev->num);
+		LOG("%s removed while open, deferring "
+		    "video_unregister_device\n",
+		    video_device_node_name(cam->vdev));
 	}
 }
 
diff --git a/drivers/media/video/cx18/cx18-av-core.c b/drivers/media/video/cx18/cx18-av-core.c
index 536dedb23ba3..4392c76af5df 100644
--- a/drivers/media/video/cx18/cx18-av-core.c
+++ b/drivers/media/video/cx18/cx18-av-core.c
@@ -99,10 +99,8 @@ int cx18_av_and_or4(struct cx18 *cx, u16 addr, u32 and_mask,
 			     or_value);
 }
 
-static int cx18_av_init(struct v4l2_subdev *sd, u32 val)
+static void cx18_av_init(struct cx18 *cx)
 {
-	struct cx18 *cx = v4l2_get_subdevdata(sd);
-
 	/*
 	 * The crystal freq used in calculations in this driver will be
 	 * 28.636360 MHz.
@@ -125,7 +123,6 @@ static int cx18_av_init(struct v4l2_subdev *sd, u32 val)
 
 	/* SA_MCLK_SEL=1, SA_MCLK_DIV=0x16 */
 	cx18_av_write(cx, CXADEC_I2S_MCLK, 0x56);
-	return 0;
 }
 
 static void cx18_av_initialize(struct v4l2_subdev *sd)
@@ -198,7 +195,7 @@ static void cx18_av_initialize(struct v4l2_subdev *sd)
 	cx18_av_and_or4(cx, CXADEC_CHIP_CTRL, 0xFFFBFFFF, 0x00120000);
 
 	/* Setup the Video and and Aux/Audio PLLs */
-	cx18_av_init(sd, 0);
+	cx18_av_init(cx);
 
 	/* set video to auto-detect */
 	/* Clear bits 11-12 to enable slow locking mode.  Set autodetect mode */
@@ -1355,7 +1352,6 @@ static int cx18_av_s_register(struct v4l2_subdev *sd,
 static const struct v4l2_subdev_core_ops cx18_av_general_ops = {
 	.g_chip_ident = cx18_av_g_chip_ident,
 	.log_status = cx18_av_log_status,
-	.init = cx18_av_init,
 	.load_fw = cx18_av_load_fw,
 	.reset = cx18_av_reset,
 	.queryctrl = cx18_av_queryctrl,
@@ -1399,6 +1395,7 @@ int cx18_av_probe(struct cx18 *cx)
 {
 	struct cx18_av_state *state = &cx->av_state;
 	struct v4l2_subdev *sd;
+	int err;
 
 	state->rev = cx18_av_read4(cx, CXADEC_CHIP_CTRL) & 0xffff;
 	state->id = ((state->rev >> 4) == CXADEC_CHIP_TYPE_MAKO)
@@ -1417,5 +1414,8 @@ int cx18_av_probe(struct cx18 *cx)
 	snprintf(sd->name, sizeof(sd->name),
 		 "%s %03x", cx->v4l2_dev.name, (state->rev >> 4));
 	sd->grp_id = CX18_HW_418_AV;
-	return v4l2_device_register_subdev(&cx->v4l2_dev, sd);
+	err = v4l2_device_register_subdev(&cx->v4l2_dev, sd);
+	if (!err)
+		cx18_av_init(cx);
+	return err;
 }
diff --git a/drivers/media/video/cx18/cx18-av-core.h b/drivers/media/video/cx18/cx18-av-core.h
index 9b84a0c58e0e..cafb7e99b9a0 100644
--- a/drivers/media/video/cx18/cx18-av-core.h
+++ b/drivers/media/video/cx18/cx18-av-core.h
@@ -294,7 +294,7 @@ struct cx18_av_state {
 #define CXADEC_QAM_CONST_DEC       0x924
 #define CXADEC_QAM_ROTATOR_FREQ    0x948
 
-/* Bit defintions / settings used in Mako Audio */
+/* Bit definitions / settings used in Mako Audio */
 #define CXADEC_PREF_MODE_MONO_LANGA        0
 #define CXADEC_PREF_MODE_MONO_LANGB        1
 #define CXADEC_PREF_MODE_MONO_LANGC        2
diff --git a/drivers/media/video/cx18/cx18-cards.h b/drivers/media/video/cx18/cx18-cards.h
index 444e3c7c563e..af3d71607dc9 100644
--- a/drivers/media/video/cx18/cx18-cards.h
+++ b/drivers/media/video/cx18/cx18-cards.h
@@ -34,6 +34,9 @@
 #define CX18_HW_Z8F0811_IR_HAUP	(CX18_HW_Z8F0811_IR_RX_HAUP | \
 				 CX18_HW_Z8F0811_IR_TX_HAUP)
 
+#define CX18_HW_IR_ANY (CX18_HW_Z8F0811_IR_RX_HAUP | \
+			CX18_HW_Z8F0811_IR_TX_HAUP)
+
 /* video inputs */
 #define	CX18_CARD_INPUT_VID_TUNER	1
 #define	CX18_CARD_INPUT_SVIDEO1 	2
diff --git a/drivers/media/video/cx18/cx18-driver.c b/drivers/media/video/cx18/cx18-driver.c
index 6dd51e27582c..7f65a47f12e1 100644
--- a/drivers/media/video/cx18/cx18-driver.c
+++ b/drivers/media/video/cx18/cx18-driver.c
@@ -87,7 +87,6 @@ static int enc_ts_bufsize = CX18_DEFAULT_ENC_TS_BUFSIZE;
 static int enc_mpg_bufsize = CX18_DEFAULT_ENC_MPG_BUFSIZE;
 static int enc_idx_bufsize = CX18_DEFAULT_ENC_IDX_BUFSIZE;
 static int enc_yuv_bufsize = CX18_DEFAULT_ENC_YUV_BUFSIZE;
-/* VBI bufsize based on standards supported by card tuner for now */
 static int enc_pcm_bufsize = CX18_DEFAULT_ENC_PCM_BUFSIZE;
 
 static int enc_ts_bufs = -1;
@@ -128,7 +127,6 @@ module_param(enc_ts_bufsize, int, 0644);
 module_param(enc_mpg_bufsize, int, 0644);
 module_param(enc_idx_bufsize, int, 0644);
 module_param(enc_yuv_bufsize, int, 0644);
-/* VBI bufsize based on standards supported by card tuner for now */
 module_param(enc_pcm_bufsize, int, 0644);
 
 module_param(enc_ts_bufs, int, 0644);
@@ -211,7 +209,9 @@ MODULE_PARM_DESC(enc_yuv_buffers,
 		 "\t\t\tDefault: " __stringify(CX18_DEFAULT_ENC_YUV_BUFFERS));
 MODULE_PARM_DESC(enc_yuv_bufsize,
 		 "Size of an encoder YUV buffer (kB)\n"
-		 "\t\t\tDefault: " __stringify(CX18_DEFAULT_ENC_YUV_BUFSIZE));
+		 "\t\t\tAllowed values are multiples of 33.75 kB rounded up\n"
+		 "\t\t\t(multiples of size required for 32 screen lines)\n"
+		 "\t\t\tDefault: 102");
 MODULE_PARM_DESC(enc_yuv_bufs,
 		 "Number of encoder YUV buffers\n"
 		 "\t\t\tDefault is computed from other enc_yuv_* parameters");
@@ -220,7 +220,7 @@ MODULE_PARM_DESC(enc_vbi_buffers,
 		 "\t\t\tDefault: " __stringify(CX18_DEFAULT_ENC_VBI_BUFFERS));
 MODULE_PARM_DESC(enc_vbi_bufs,
 		 "Number of encoder VBI buffers\n"
-		 "\t\t\tDefault is computed from enc_vbi_buffers & tuner std");
+		 "\t\t\tDefault is computed from enc_vbi_buffers");
 MODULE_PARM_DESC(enc_pcm_buffers,
 		 "Encoder PCM buffer memory (MB). (enc_pcm_bufs can override)\n"
 		 "\t\t\tDefault: " __stringify(CX18_DEFAULT_ENC_PCM_BUFFERS));
@@ -499,10 +499,27 @@ static void cx18_process_options(struct cx18 *cx)
 			continue;
 		}
 		/*
+		 * YUV is a special case where the stream_buf_size needs to be
+		 * an integral multiple of 33.75 kB (storage for 32 screens
+		 * lines to maintain alignment in case of lost buffers
+		 */
+		if (i == CX18_ENC_STREAM_TYPE_YUV) {
+			cx->stream_buf_size[i] *= 1024;
+			cx->stream_buf_size[i] -=
+			   (cx->stream_buf_size[i] % CX18_UNIT_ENC_YUV_BUFSIZE);
+
+			if (cx->stream_buf_size[i] < CX18_UNIT_ENC_YUV_BUFSIZE)
+				cx->stream_buf_size[i] =
+						CX18_UNIT_ENC_YUV_BUFSIZE;
+		}
+		/*
+		 * YUV is a special case where the stream_buf_size is
+		 * now in bytes.
 		 * VBI is a special case where the stream_buf_size is fixed
 		 * and already in bytes
 		 */
-		if (i == CX18_ENC_STREAM_TYPE_VBI) {
+		if (i == CX18_ENC_STREAM_TYPE_VBI ||
+		    i == CX18_ENC_STREAM_TYPE_YUV) {
 			if (cx->stream_buffers[i] < 0) {
 				cx->stream_buffers[i] =
 					cx->options.megabytes[i] * 1024 * 1024
@@ -513,18 +530,24 @@ static void cx18_process_options(struct cx18 *cx)
 					cx->stream_buffers[i]
 					* cx->stream_buf_size[i]/(1024 * 1024);
 			}
-			continue;
-		}
-		/* All other streams have stream_buf_size in kB at this point */
-		if (cx->stream_buffers[i] < 0) {
-			cx->stream_buffers[i] = cx->options.megabytes[i] * 1024
-						/ cx->stream_buf_size[i];
 		} else {
-			/* N.B. This might round down to 0 */
-			cx->options.megabytes[i] =
-			  cx->stream_buffers[i] * cx->stream_buf_size[i] / 1024;
+			/* All other streams have stream_buf_size in kB here */
+			if (cx->stream_buffers[i] < 0) {
+				cx->stream_buffers[i] =
+						cx->options.megabytes[i] * 1024
+						/ cx->stream_buf_size[i];
+			} else {
+				/* N.B. This might round down to 0 */
+				cx->options.megabytes[i] =
+						cx->stream_buffers[i]
+						* cx->stream_buf_size[i] / 1024;
+			}
+			/* convert from kB to bytes */
+			cx->stream_buf_size[i] *= 1024;
 		}
-		cx->stream_buf_size[i] *= 1024; /* convert from kB to bytes */
+		CX18_DEBUG_INFO("Stream type %d options: %d MB, %d buffers, "
+				"%d bytes\n", i, cx->options.megabytes[i],
+				cx->stream_buffers[i], cx->stream_buf_size[i]);
 	}
 
 	cx->options.cardtype = cardtype[cx->instance];
@@ -669,6 +692,12 @@ static int __devinit cx18_init_struct1(struct cx18 *cx)
 	cx->vbi.in.type = V4L2_BUF_TYPE_VBI_CAPTURE;
 	cx->vbi.sliced_in = &cx->vbi.in.fmt.sliced;
 
+	/* IVTV style VBI insertion into MPEG streams */
+	INIT_LIST_HEAD(&cx->vbi.sliced_mpeg_buf.list);
+	INIT_LIST_HEAD(&cx->vbi.sliced_mpeg_mdl.list);
+	INIT_LIST_HEAD(&cx->vbi.sliced_mpeg_mdl.buf_list);
+	list_add(&cx->vbi.sliced_mpeg_buf.list,
+		 &cx->vbi.sliced_mpeg_mdl.buf_list);
 	return 0;
 }
 
@@ -883,7 +912,6 @@ static int __devinit cx18_probe(struct pci_dev *pci_dev,
 		CX18_ERR("Could not register A/V decoder subdevice\n");
 		goto free_map;
 	}
-	cx18_call_hw(cx, CX18_HW_418_AV, core, init, 0);
 
 	/* Initialize GPIO Reset Controller to do chip resets during i2c init */
 	if (cx->card->hw_all & CX18_HW_GPIO_RESET_CTRL) {
@@ -1200,7 +1228,7 @@ static struct pci_driver cx18_pci_driver = {
       .remove =   cx18_remove,
 };
 
-static int module_start(void)
+static int __init module_start(void)
 {
 	printk(KERN_INFO "cx18:  Start initialization, version %s\n", CX18_VERSION);
 
@@ -1224,7 +1252,7 @@ static int module_start(void)
 	return 0;
 }
 
-static void module_cleanup(void)
+static void __exit module_cleanup(void)
 {
 	pci_unregister_driver(&cx18_pci_driver);
 }
diff --git a/drivers/media/video/cx18/cx18-driver.h b/drivers/media/video/cx18/cx18-driver.h
index c6a1e907f63a..e3f7911a7385 100644
--- a/drivers/media/video/cx18/cx18-driver.h
+++ b/drivers/media/video/cx18/cx18-driver.h
@@ -50,6 +50,7 @@
 #include <media/v4l2-ioctl.h>
 #include <media/v4l2-device.h>
 #include <media/tuner.h>
+#include <media/ir-kbd-i2c.h>
 #include "cx18-mailbox.h"
 #include "cx18-av-core.h"
 #include "cx23418.h"
@@ -120,12 +121,16 @@
 /* Maximum firmware DMA buffers per stream */
 #define CX18_MAX_FW_MDLS_PER_STREAM 63
 
+/* YUV buffer sizes in bytes to ensure integer # of frames per buffer */
+#define CX18_UNIT_ENC_YUV_BUFSIZE	(720 *  32 * 3 / 2) /* bytes */
+#define CX18_625_LINE_ENC_YUV_BUFSIZE	(CX18_UNIT_ENC_YUV_BUFSIZE * 576/32)
+#define CX18_525_LINE_ENC_YUV_BUFSIZE	(CX18_UNIT_ENC_YUV_BUFSIZE * 480/32)
+
 /* DMA buffer, default size in kB allocated */
 #define CX18_DEFAULT_ENC_TS_BUFSIZE   32
 #define CX18_DEFAULT_ENC_MPG_BUFSIZE  32
 #define CX18_DEFAULT_ENC_IDX_BUFSIZE  32
-#define CX18_DEFAULT_ENC_YUV_BUFSIZE 128
-/* Default VBI bufsize based on standards supported by card tuner for now */
+#define CX18_DEFAULT_ENC_YUV_BUFSIZE  (CX18_UNIT_ENC_YUV_BUFSIZE * 3 / 1024 + 1)
 #define CX18_DEFAULT_ENC_PCM_BUFSIZE   4
 
 /* i2c stuff */
@@ -246,8 +251,8 @@ struct cx18_options {
 	int radio;		/* enable/disable radio */
 };
 
-/* per-buffer bit flags */
-#define CX18_F_B_NEED_BUF_SWAP  0	/* this buffer should be byte swapped */
+/* per-mdl bit flags */
+#define CX18_F_M_NEED_SWAP  0	/* mdl buffer data must be endianess swapped */
 
 /* per-stream, s_flags */
 #define CX18_F_S_CLAIMED 	3	/* this stream is claimed */
@@ -274,18 +279,29 @@ struct cx18_options {
 struct cx18_buffer {
 	struct list_head list;
 	dma_addr_t dma_handle;
-	u32 id;
-	unsigned long b_flags;
-	unsigned skipped;
 	char *buf;
 
 	u32 bytesused;
 	u32 readpos;
 };
 
+struct cx18_mdl {
+	struct list_head list;
+	u32 id;		/* index into cx->scb->cpu_mdl[] of 1st cx18_mdl_ent */
+
+	unsigned int skipped;
+	unsigned long m_flags;
+
+	struct list_head buf_list;
+	struct cx18_buffer *curr_buf; /* current buffer in list for reading */
+
+	u32 bytesused;
+	u32 readpos;
+};
+
 struct cx18_queue {
 	struct list_head list;
-	atomic_t buffers;
+	atomic_t depth;
 	u32 bytesused;
 	spinlock_t lock;
 };
@@ -337,7 +353,7 @@ struct cx18_stream {
 	const char *name;		/* name of the stream */
 	int type;			/* stream type */
 	u32 handle;			/* task handle */
-	unsigned mdl_offset;
+	unsigned int mdl_base_idx;
 
 	u32 id;
 	unsigned long s_flags;	/* status flags, see above */
@@ -346,14 +362,20 @@ struct cx18_stream {
 				   PCI_DMA_NONE */
 	wait_queue_head_t waitq;
 
-	/* Buffer Stats */
-	u32 buffers;
-	u32 buf_size;
+	/* Buffers */
+	struct list_head buf_pool;	/* buffers not attached to an MDL */
+	u32 buffers;			/* total buffers owned by this stream */
+	u32 buf_size;			/* size in bytes of a single buffer */
+
+	/* MDL sizes - all stream MDLs are the same size */
+	u32 bufs_per_mdl;
+	u32 mdl_size;		/* total bytes in all buffers in a mdl */
 
-	/* Buffer Queues */
-	struct cx18_queue q_free;	/* free buffers */
-	struct cx18_queue q_busy;	/* busy buffers - in use by firmware */
-	struct cx18_queue q_full;	/* full buffers - data for user apps */
+	/* MDL Queues */
+	struct cx18_queue q_free;	/* free - in rotation, not committed */
+	struct cx18_queue q_busy;	/* busy - in use by firmware */
+	struct cx18_queue q_full;	/* full - data for user apps */
+	struct cx18_queue q_idle;	/* idle - not in rotation */
 
 	struct work_struct out_work_order;
 
@@ -481,10 +503,11 @@ struct vbi_info {
 	u32 inserted_frame;
 
 	/*
-	 * A dummy driver stream transfer buffer with a copy of the next
+	 * A dummy driver stream transfer mdl & buffer with a copy of the next
 	 * sliced_mpeg_data[] buffer for output to userland apps.
 	 * Only used in cx18-fileops.c, but its state needs to persist at times.
 	 */
+	struct cx18_mdl sliced_mpeg_mdl;
 	struct cx18_buffer sliced_mpeg_buf;
 };
 
@@ -511,10 +534,9 @@ struct cx18 {
 	u8 is_60hz;
 	u8 nof_inputs;		/* number of video inputs */
 	u8 nof_audio_inputs;	/* number of audio inputs */
-	u16 buffer_id;		/* buffer ID counter */
 	u32 v4l2_cap;		/* V4L2 capabilities of card */
 	u32 hw_flags; 		/* Hardware description of the board */
-	unsigned mdl_offset;
+	unsigned int free_mdl_idx;
 	struct cx18_scb __iomem *scb; /* pointer to SCB */
 	struct mutex epu2apu_mb_lock; /* protect driver to chip mailbox in SCB*/
 	struct mutex epu2cpu_mb_lock; /* protect driver to chip mailbox in SCB*/
@@ -585,6 +607,8 @@ struct cx18 {
 	struct i2c_algo_bit_data i2c_algo[2];
 	struct cx18_i2c_algo_callback_data i2c_algo_cb_data[2];
 
+	struct IR_i2c_init_data ir_i2c_init_data;
+
 	/* gpio */
 	u32 gpio_dir;
 	u32 gpio_val;
diff --git a/drivers/media/video/cx18/cx18-dvb.c b/drivers/media/video/cx18/cx18-dvb.c
index 51a0c33b25b7..71ad2d1b4c2c 100644
--- a/drivers/media/video/cx18/cx18-dvb.c
+++ b/drivers/media/video/cx18/cx18-dvb.c
@@ -61,6 +61,7 @@ static struct mxl5005s_config hauppauge_hvr1600_tuner = {
 	.top		 = MXL5005S_TOP_25P2,
 	.mod_mode        = MXL_DIGITAL_MODE,
 	.if_mode         = MXL_ZERO_IF,
+	.qam_gain        = 0x02,
 	.AgcMasterByte   = 0x00,
 };
 
@@ -71,7 +72,8 @@ static struct s5h1409_config hauppauge_hvr1600_config = {
 	.qam_if        = 44000,
 	.inversion     = S5H1409_INVERSION_OFF,
 	.status_mode   = S5H1409_DEMODLOCKING,
-	.mpeg_timing   = S5H1409_MPEGTIMING_CONTINOUS_NONINVERTING_CLOCK
+	.mpeg_timing   = S5H1409_MPEGTIMING_CONTINOUS_NONINVERTING_CLOCK,
+	.hvr1600_opt   = S5H1409_HVR1600_OPTIMIZE
 };
 
 /*
@@ -360,9 +362,10 @@ int cx18_dvb_register(struct cx18_stream *stream)
 	dvb_net_init(dvb_adapter, &dvb->dvbnet, dmx);
 
 	CX18_INFO("DVB Frontend registered\n");
-	CX18_INFO("Registered DVB adapter%d for %s (%d x %d kB)\n",
+	CX18_INFO("Registered DVB adapter%d for %s (%d x %d.%02d kB)\n",
 		  stream->dvb.dvb_adapter.num, stream->name,
-		  stream->buffers, stream->buf_size/1024);
+		  stream->buffers, stream->buf_size/1024,
+		  (stream->buf_size * 100 / 1024) % 100);
 
 	mutex_init(&dvb->feedlock);
 	dvb->enabled = 1;
diff --git a/drivers/media/video/cx18/cx18-fileops.c b/drivers/media/video/cx18/cx18-fileops.c
index 04d9c2508b86..c0885c69fd89 100644
--- a/drivers/media/video/cx18/cx18-fileops.c
+++ b/drivers/media/video/cx18/cx18-fileops.c
@@ -166,11 +166,12 @@ static void cx18_dualwatch(struct cx18 *cx)
 }
 
 
-static struct cx18_buffer *cx18_get_buffer(struct cx18_stream *s, int non_block, int *err)
+static struct cx18_mdl *cx18_get_mdl(struct cx18_stream *s, int non_block,
+				     int *err)
 {
 	struct cx18 *cx = s->cx;
 	struct cx18_stream *s_vbi = &cx->streams[CX18_ENC_STREAM_TYPE_VBI];
-	struct cx18_buffer *buf;
+	struct cx18_mdl *mdl;
 	DEFINE_WAIT(wait);
 
 	*err = 0;
@@ -185,32 +186,33 @@ static struct cx18_buffer *cx18_get_buffer(struct cx18_stream *s, int non_block,
 			}
 			if (test_bit(CX18_F_S_INTERNAL_USE, &s_vbi->s_flags) &&
 			    !test_bit(CX18_F_S_APPL_IO, &s_vbi->s_flags)) {
-				while ((buf = cx18_dequeue(s_vbi, &s_vbi->q_full))) {
+				while ((mdl = cx18_dequeue(s_vbi,
+							   &s_vbi->q_full))) {
 					/* byteswap and process VBI data */
-					cx18_process_vbi_data(cx, buf,
+					cx18_process_vbi_data(cx, mdl,
 							      s_vbi->type);
-					cx18_stream_put_buf_fw(s_vbi, buf);
+					cx18_stream_put_mdl_fw(s_vbi, mdl);
 				}
 			}
-			buf = &cx->vbi.sliced_mpeg_buf;
-			if (buf->readpos != buf->bytesused)
-				return buf;
+			mdl = &cx->vbi.sliced_mpeg_mdl;
+			if (mdl->readpos != mdl->bytesused)
+				return mdl;
 		}
 
 		/* do we have new data? */
-		buf = cx18_dequeue(s, &s->q_full);
-		if (buf) {
-			if (!test_and_clear_bit(CX18_F_B_NEED_BUF_SWAP,
-						&buf->b_flags))
-				return buf;
+		mdl = cx18_dequeue(s, &s->q_full);
+		if (mdl) {
+			if (!test_and_clear_bit(CX18_F_M_NEED_SWAP,
+						&mdl->m_flags))
+				return mdl;
 			if (s->type == CX18_ENC_STREAM_TYPE_MPG)
 				/* byteswap MPG data */
-				cx18_buf_swap(buf);
+				cx18_mdl_swap(mdl);
 			else {
 				/* byteswap and process VBI data */
-				cx18_process_vbi_data(cx, buf, s->type);
+				cx18_process_vbi_data(cx, mdl, s->type);
 			}
-			return buf;
+			return mdl;
 		}
 
 		/* return if end of stream */
@@ -229,7 +231,7 @@ static struct cx18_buffer *cx18_get_buffer(struct cx18_stream *s, int non_block,
 		prepare_to_wait(&s->waitq, &wait, TASK_INTERRUPTIBLE);
 		/* New buffers might have become available before we were added
 		   to the waitqueue */
-		if (!atomic_read(&s->q_full.buffers))
+		if (!atomic_read(&s->q_full.depth))
 			schedule();
 		finish_wait(&s->waitq, &wait);
 		if (signal_pending(current)) {
@@ -241,21 +243,28 @@ static struct cx18_buffer *cx18_get_buffer(struct cx18_stream *s, int non_block,
 	}
 }
 
-static void cx18_setup_sliced_vbi_buf(struct cx18 *cx)
+static void cx18_setup_sliced_vbi_mdl(struct cx18 *cx)
 {
+	struct cx18_mdl *mdl = &cx->vbi.sliced_mpeg_mdl;
+	struct cx18_buffer *buf = &cx->vbi.sliced_mpeg_buf;
 	int idx = cx->vbi.inserted_frame % CX18_VBI_FRAMES;
 
-	cx->vbi.sliced_mpeg_buf.buf = cx->vbi.sliced_mpeg_data[idx];
-	cx->vbi.sliced_mpeg_buf.bytesused = cx->vbi.sliced_mpeg_size[idx];
-	cx->vbi.sliced_mpeg_buf.readpos = 0;
+	buf->buf = cx->vbi.sliced_mpeg_data[idx];
+	buf->bytesused = cx->vbi.sliced_mpeg_size[idx];
+	buf->readpos = 0;
+
+	mdl->curr_buf = NULL;
+	mdl->bytesused = cx->vbi.sliced_mpeg_size[idx];
+	mdl->readpos = 0;
 }
 
 static size_t cx18_copy_buf_to_user(struct cx18_stream *s,
-		struct cx18_buffer *buf, char __user *ubuf, size_t ucount)
+	struct cx18_buffer *buf, char __user *ubuf, size_t ucount, bool *stop)
 {
 	struct cx18 *cx = s->cx;
 	size_t len = buf->bytesused - buf->readpos;
 
+	*stop = false;
 	if (len > ucount)
 		len = ucount;
 	if (cx->vbi.insert_mpeg && s->type == CX18_ENC_STREAM_TYPE_MPG &&
@@ -335,7 +344,8 @@ static size_t cx18_copy_buf_to_user(struct cx18_stream *s,
 				/* We declare we actually found a Program Pack*/
 				cx->search_pack_header = 0; /* expect vid PES */
 				len = (char *)q - start;
-				cx18_setup_sliced_vbi_buf(cx);
+				cx18_setup_sliced_vbi_mdl(cx);
+				*stop = true;
 				break;
 			}
 		}
@@ -352,6 +362,60 @@ static size_t cx18_copy_buf_to_user(struct cx18_stream *s,
 	return len;
 }
 
+/**
+ * list_entry_is_past_end - check if a previous loop cursor is off list end
+ * @pos:	the type * previously used as a loop cursor.
+ * @head:	the head for your list.
+ * @member:	the name of the list_struct within the struct.
+ *
+ * Check if the entry's list_head is the head of the list, thus it's not a
+ * real entry but was the loop cursor that walked past the end
+ */
+#define list_entry_is_past_end(pos, head, member) \
+	(&pos->member == (head))
+
+static size_t cx18_copy_mdl_to_user(struct cx18_stream *s,
+		struct cx18_mdl *mdl, char __user *ubuf, size_t ucount)
+{
+	size_t tot_written = 0;
+	int rc;
+	bool stop = false;
+
+	if (mdl->curr_buf == NULL)
+		mdl->curr_buf = list_first_entry(&mdl->buf_list,
+						 struct cx18_buffer, list);
+
+	if (list_entry_is_past_end(mdl->curr_buf, &mdl->buf_list, list)) {
+		/*
+		 * For some reason we've exhausted the buffers, but the MDL
+		 * object still said some data was unread.
+		 * Fix that and bail out.
+		 */
+		mdl->readpos = mdl->bytesused;
+		return 0;
+	}
+
+	list_for_each_entry_from(mdl->curr_buf, &mdl->buf_list, list) {
+
+		if (mdl->curr_buf->readpos >= mdl->curr_buf->bytesused)
+			continue;
+
+		rc = cx18_copy_buf_to_user(s, mdl->curr_buf, ubuf + tot_written,
+					   ucount - tot_written, &stop);
+		if (rc < 0)
+			return rc;
+		mdl->readpos += rc;
+		tot_written += rc;
+
+		if (stop ||	/* Forced stopping point for VBI insertion */
+		    tot_written >= ucount ||	/* Reader request statisfied */
+		    mdl->curr_buf->readpos < mdl->curr_buf->bytesused ||
+		    mdl->readpos >= mdl->bytesused) /* MDL buffers drained */
+			break;
+	}
+	return tot_written;
+}
+
 static ssize_t cx18_read(struct cx18_stream *s, char __user *ubuf,
 		size_t tot_count, int non_block)
 {
@@ -373,12 +437,12 @@ static ssize_t cx18_read(struct cx18_stream *s, char __user *ubuf,
 		single_frame = 1;
 
 	for (;;) {
-		struct cx18_buffer *buf;
+		struct cx18_mdl *mdl;
 		int rc;
 
-		buf = cx18_get_buffer(s, non_block, &rc);
+		mdl = cx18_get_mdl(s, non_block, &rc);
 		/* if there is no data available... */
-		if (buf == NULL) {
+		if (mdl == NULL) {
 			/* if we got data, then return that regardless */
 			if (tot_written)
 				break;
@@ -392,20 +456,20 @@ static ssize_t cx18_read(struct cx18_stream *s, char __user *ubuf,
 			return rc;
 		}
 
-		rc = cx18_copy_buf_to_user(s, buf, ubuf + tot_written,
+		rc = cx18_copy_mdl_to_user(s, mdl, ubuf + tot_written,
 				tot_count - tot_written);
 
-		if (buf != &cx->vbi.sliced_mpeg_buf) {
-			if (buf->readpos == buf->bytesused)
-				cx18_stream_put_buf_fw(s, buf);
+		if (mdl != &cx->vbi.sliced_mpeg_mdl) {
+			if (mdl->readpos == mdl->bytesused)
+				cx18_stream_put_mdl_fw(s, mdl);
 			else
-				cx18_push(s, buf, &s->q_full);
-		} else if (buf->readpos == buf->bytesused) {
+				cx18_push(s, mdl, &s->q_full);
+		} else if (mdl->readpos == mdl->bytesused) {
 			int idx = cx->vbi.inserted_frame % CX18_VBI_FRAMES;
 
 			cx->vbi.sliced_mpeg_size[idx] = 0;
 			cx->vbi.inserted_frame++;
-			cx->vbi_data_inserted += buf->bytesused;
+			cx->vbi_data_inserted += mdl->bytesused;
 		}
 		if (rc < 0)
 			return rc;
@@ -543,7 +607,7 @@ unsigned int cx18_v4l2_enc_poll(struct file *filp, poll_table *wait)
 	CX18_DEBUG_HI_FILE("Encoder poll\n");
 	poll_wait(filp, &s->waitq, wait);
 
-	if (atomic_read(&s->q_full.buffers))
+	if (atomic_read(&s->q_full.depth))
 		return POLLIN | POLLRDNORM;
 	if (eof)
 		return POLLHUP;
@@ -694,8 +758,8 @@ int cx18_v4l2_open(struct file *filp)
 
 	mutex_lock(&cx->serialize_lock);
 	if (cx18_init_on_first_open(cx)) {
-		CX18_ERR("Failed to initialize on minor %d\n",
-			 video_dev->minor);
+		CX18_ERR("Failed to initialize on %s\n",
+			 video_device_node_name(video_dev));
 		mutex_unlock(&cx->serialize_lock);
 		return -ENXIO;
 	}
diff --git a/drivers/media/video/cx18/cx18-i2c.c b/drivers/media/video/cx18/cx18-i2c.c
index 2477461e84d7..eecf29af916c 100644
--- a/drivers/media/video/cx18/cx18-i2c.c
+++ b/drivers/media/video/cx18/cx18-i2c.c
@@ -28,7 +28,6 @@
 #include "cx18-gpio.h"
 #include "cx18-i2c.h"
 #include "cx18-irq.h"
-#include <media/ir-kbd-i2c.h>
 
 #define CX18_REG_I2C_1_WR   0xf15000
 #define CX18_REG_I2C_1_RD   0xf15008
@@ -97,17 +96,11 @@ static const char * const hw_devicenames[] = {
 	"ir_rx_z8f0811_haup",
 };
 
-static const struct IR_i2c_init_data z8f0811_ir_init_data = {
-	.ir_codes = &ir_codes_hauppauge_new_table,
-	.internal_get_key_func = IR_KBD_GET_KEY_HAUP_XVR,
-	.type = IR_TYPE_RC5,
-	.name = "CX23418 Z8F0811 Hauppauge",
-};
-
-static int cx18_i2c_new_ir(struct i2c_adapter *adap, u32 hw, const char *type,
-			   u8 addr)
+static int cx18_i2c_new_ir(struct cx18 *cx, struct i2c_adapter *adap, u32 hw,
+			   const char *type, u8 addr)
 {
 	struct i2c_board_info info;
+	struct IR_i2c_init_data *init_data = &cx->ir_i2c_init_data;
 	unsigned short addr_list[2] = { addr, I2C_CLIENT_END };
 
 	memset(&info, 0, sizeof(struct i2c_board_info));
@@ -116,9 +109,11 @@ static int cx18_i2c_new_ir(struct i2c_adapter *adap, u32 hw, const char *type,
 	/* Our default information for ir-kbd-i2c.c to use */
 	switch (hw) {
 	case CX18_HW_Z8F0811_IR_RX_HAUP:
-		info.platform_data = (void *) &z8f0811_ir_init_data;
-		break;
-	default:
+		init_data->ir_codes = &ir_codes_hauppauge_new_table;
+		init_data->internal_get_key_func = IR_KBD_GET_KEY_HAUP_XVR;
+		init_data->type = IR_TYPE_RC5;
+		init_data->name = cx->card_name;
+		info.platform_data = init_data;
 		break;
 	}
 
@@ -154,8 +149,8 @@ int cx18_i2c_register(struct cx18 *cx, unsigned idx)
 		return sd != NULL ? 0 : -1;
 	}
 
-	if (hw & CX18_HW_Z8F0811_IR_HAUP)
-		return cx18_i2c_new_ir(adap, hw, type, hw_addrs[idx]);
+	if (hw & CX18_HW_IR_ANY)
+		return cx18_i2c_new_ir(cx, adap, hw, type, hw_addrs[idx]);
 
 	/* Is it not an I2C device or one we do not wish to register? */
 	if (!hw_addrs[idx])
diff --git a/drivers/media/video/cx18/cx18-ioctl.c b/drivers/media/video/cx18/cx18-ioctl.c
index fc76e4d6ffa7..3e4fc192fdec 100644
--- a/drivers/media/video/cx18/cx18-ioctl.c
+++ b/drivers/media/video/cx18/cx18-ioctl.c
@@ -910,7 +910,8 @@ static int cx18_log_status(struct file *file, void *fh)
 			continue;
 		CX18_INFO("Stream %s: status 0x%04lx, %d%% of %d KiB (%d buffers) in use\n",
 			  s->name, s->s_flags,
-			  atomic_read(&s->q_full.buffers) * 100 / s->buffers,
+			  atomic_read(&s->q_full.depth) * s->bufs_per_mdl * 100
+			   / s->buffers,
 			  (s->buffers * s->buf_size) / 1024, s->buffers);
 	}
 	CX18_INFO("Read MPEG/VBI: %lld/%lld bytes\n",
diff --git a/drivers/media/video/cx18/cx18-mailbox.c b/drivers/media/video/cx18/cx18-mailbox.c
index afe46c3d4057..f231dd09c720 100644
--- a/drivers/media/video/cx18/cx18-mailbox.c
+++ b/drivers/media/video/cx18/cx18-mailbox.c
@@ -131,13 +131,39 @@ static void dump_mb(struct cx18 *cx, struct cx18_mailbox *mb, char *name)
  * Functions that run in a work_queue work handling context
  */
 
+static void cx18_mdl_send_to_dvb(struct cx18_stream *s, struct cx18_mdl *mdl)
+{
+	struct cx18_buffer *buf;
+
+	if (!s->dvb.enabled || mdl->bytesused == 0)
+		return;
+
+	/* We ignore mdl and buf readpos accounting here - it doesn't matter */
+
+	/* The likely case */
+	if (list_is_singular(&mdl->buf_list)) {
+		buf = list_first_entry(&mdl->buf_list, struct cx18_buffer,
+				       list);
+		if (buf->bytesused)
+			dvb_dmx_swfilter(&s->dvb.demux,
+					 buf->buf, buf->bytesused);
+		return;
+	}
+
+	list_for_each_entry(buf, &mdl->buf_list, list) {
+		if (buf->bytesused == 0)
+			break;
+		dvb_dmx_swfilter(&s->dvb.demux, buf->buf, buf->bytesused);
+	}
+}
+
 static void epu_dma_done(struct cx18 *cx, struct cx18_in_work_order *order)
 {
 	u32 handle, mdl_ack_count, id;
 	struct cx18_mailbox *mb;
 	struct cx18_mdl_ack *mdl_ack;
 	struct cx18_stream *s;
-	struct cx18_buffer *buf;
+	struct cx18_mdl *mdl;
 	int i;
 
 	mb = &order->mb;
@@ -158,7 +184,7 @@ static void epu_dma_done(struct cx18 *cx, struct cx18_in_work_order *order)
 		id = mdl_ack->id;
 		/*
 		 * Simple integrity check for processing a stale (and possibly
-		 * inconsistent mailbox): make sure the buffer id is in the
+		 * inconsistent mailbox): make sure the MDL id is in the
 		 * valid range for the stream.
 		 *
 		 * We go through the trouble of dealing with stale mailboxes
@@ -169,44 +195,42 @@ static void epu_dma_done(struct cx18 *cx, struct cx18_in_work_order *order)
 		 * There are occasions when we get a half changed mailbox,
 		 * which this check catches for a handle & id mismatch.  If the
 		 * handle and id do correspond, the worst case is that we
-		 * completely lost the old buffer, but pick up the new buffer
+		 * completely lost the old MDL, but pick up the new MDL
 		 * early (but the new mdl_ack is guaranteed to be good in this
 		 * case as the firmware wouldn't point us to a new mdl_ack until
 		 * it's filled in).
 		 *
-		 * cx18_queue_get buf() will detect the lost buffers
+		 * cx18_queue_get_mdl() will detect the lost MDLs
 		 * and send them back to q_free for fw rotation eventually.
 		 */
 		if ((order->flags & CX18_F_EWO_MB_STALE_UPON_RECEIPT) &&
-		    !(id >= s->mdl_offset &&
-		      id < (s->mdl_offset + s->buffers))) {
+		    !(id >= s->mdl_base_idx &&
+		      id < (s->mdl_base_idx + s->buffers))) {
 			CX18_WARN("Fell behind! Ignoring stale mailbox with "
-				  " inconsistent data. Lost buffer for mailbox "
+				  " inconsistent data. Lost MDL for mailbox "
 				  "seq no %d\n", mb->request);
 			break;
 		}
-		buf = cx18_queue_get_buf(s, id, mdl_ack->data_used);
+		mdl = cx18_queue_get_mdl(s, id, mdl_ack->data_used);
 
-		CX18_DEBUG_HI_DMA("DMA DONE for %s (buffer %d)\n", s->name, id);
-		if (buf == NULL) {
-			CX18_WARN("Could not find buf %d for stream %s\n",
+		CX18_DEBUG_HI_DMA("DMA DONE for %s (MDL %d)\n", s->name, id);
+		if (mdl == NULL) {
+			CX18_WARN("Could not find MDL %d for stream %s\n",
 				  id, s->name);
 			continue;
 		}
 
 		CX18_DEBUG_HI_DMA("%s recv bytesused = %d\n",
-				  s->name, buf->bytesused);
+				  s->name, mdl->bytesused);
 
 		if (s->type != CX18_ENC_STREAM_TYPE_TS)
-			cx18_enqueue(s, buf, &s->q_full);
+			cx18_enqueue(s, mdl, &s->q_full);
 		else {
-			if (s->dvb.enabled)
-				dvb_dmx_swfilter(&s->dvb.demux, buf->buf,
-						 buf->bytesused);
-			cx18_enqueue(s, buf, &s->q_free);
+			cx18_mdl_send_to_dvb(s, mdl);
+			cx18_enqueue(s, mdl, &s->q_free);
 		}
 	}
-	/* Put as many buffers as possible back into fw use */
+	/* Put as many MDLs as possible back into fw use */
 	cx18_stream_load_fw_queue(s);
 
 	wake_up(&cx->dma_waitq);
@@ -616,7 +640,7 @@ static int cx18_api_call(struct cx18 *cx, u32 cmd, int args, u32 data[])
 
 	/*
 	 * Wait for XPU to perform extra actions for the caller in some cases.
-	 * e.g. CX18_CPU_DE_RELEASE_MDL will cause the CPU to send all buffers
+	 * e.g. CX18_CPU_DE_RELEASE_MDL will cause the CPU to send all MDLs
 	 * back in a burst shortly thereafter
 	 */
 	if (info->flags & API_SLOW)
diff --git a/drivers/media/video/cx18/cx18-mailbox.h b/drivers/media/video/cx18/cx18-mailbox.h
index e23aaac5b280..33a3491c4537 100644
--- a/drivers/media/video/cx18/cx18-mailbox.h
+++ b/drivers/media/video/cx18/cx18-mailbox.h
@@ -39,14 +39,14 @@
 struct cx18;
 
 /*
- * This structure is used by CPU to provide completed buffers information
- * Its structure is dictrated by the layout of the SCB, required by the
- * firmware, but its defintion needs to be here, instead of in cx18-scb.h,
+ * This structure is used by CPU to provide completed MDL & buffers information.
+ * Its structure is dictated by the layout of the SCB, required by the
+ * firmware, but its definition needs to be here, instead of in cx18-scb.h,
  * for mailbox work order scheduling
  */
 struct cx18_mdl_ack {
     u32 id;        /* ID of a completed MDL */
-    u32 data_used; /* Total data filled in the MDL for buffer 'id' */
+    u32 data_used; /* Total data filled in the MDL with 'id' */
 };
 
 /* The cx18_mailbox struct is the mailbox structure which is used for passing
diff --git a/drivers/media/video/cx18/cx18-queue.c b/drivers/media/video/cx18/cx18-queue.c
index fa1ed7897d97..63304823cef5 100644
--- a/drivers/media/video/cx18/cx18-queue.c
+++ b/drivers/media/video/cx18/cx18-queue.c
@@ -26,6 +26,7 @@
 #include "cx18-queue.h"
 #include "cx18-streams.h"
 #include "cx18-scb.h"
+#include "cx18-io.h"
 
 void cx18_buf_swap(struct cx18_buffer *buf)
 {
@@ -35,151 +36,312 @@ void cx18_buf_swap(struct cx18_buffer *buf)
 		swab32s((u32 *)(buf->buf + i));
 }
 
+void _cx18_mdl_swap(struct cx18_mdl *mdl)
+{
+	struct cx18_buffer *buf;
+
+	list_for_each_entry(buf, &mdl->buf_list, list) {
+		if (buf->bytesused == 0)
+			break;
+		cx18_buf_swap(buf);
+	}
+}
+
 void cx18_queue_init(struct cx18_queue *q)
 {
 	INIT_LIST_HEAD(&q->list);
-	atomic_set(&q->buffers, 0);
+	atomic_set(&q->depth, 0);
 	q->bytesused = 0;
 }
 
-struct cx18_queue *_cx18_enqueue(struct cx18_stream *s, struct cx18_buffer *buf,
+struct cx18_queue *_cx18_enqueue(struct cx18_stream *s, struct cx18_mdl *mdl,
 				 struct cx18_queue *q, int to_front)
 {
-	/* clear the buffer if it is not to be enqueued to the full queue */
+	/* clear the mdl if it is not to be enqueued to the full queue */
 	if (q != &s->q_full) {
-		buf->bytesused = 0;
-		buf->readpos = 0;
-		buf->b_flags = 0;
-		buf->skipped = 0;
+		mdl->bytesused = 0;
+		mdl->readpos = 0;
+		mdl->m_flags = 0;
+		mdl->skipped = 0;
+		mdl->curr_buf = NULL;
 	}
 
 	/* q_busy is restricted to a max buffer count imposed by firmware */
 	if (q == &s->q_busy &&
-	    atomic_read(&q->buffers) >= CX18_MAX_FW_MDLS_PER_STREAM)
+	    atomic_read(&q->depth) >= CX18_MAX_FW_MDLS_PER_STREAM)
 		q = &s->q_free;
 
 	spin_lock(&q->lock);
 
 	if (to_front)
-		list_add(&buf->list, &q->list); /* LIFO */
+		list_add(&mdl->list, &q->list); /* LIFO */
 	else
-		list_add_tail(&buf->list, &q->list); /* FIFO */
-	q->bytesused += buf->bytesused - buf->readpos;
-	atomic_inc(&q->buffers);
+		list_add_tail(&mdl->list, &q->list); /* FIFO */
+	q->bytesused += mdl->bytesused - mdl->readpos;
+	atomic_inc(&q->depth);
 
 	spin_unlock(&q->lock);
 	return q;
 }
 
-struct cx18_buffer *cx18_dequeue(struct cx18_stream *s, struct cx18_queue *q)
+struct cx18_mdl *cx18_dequeue(struct cx18_stream *s, struct cx18_queue *q)
 {
-	struct cx18_buffer *buf = NULL;
+	struct cx18_mdl *mdl = NULL;
 
 	spin_lock(&q->lock);
 	if (!list_empty(&q->list)) {
-		buf = list_first_entry(&q->list, struct cx18_buffer, list);
-		list_del_init(&buf->list);
-		q->bytesused -= buf->bytesused - buf->readpos;
-		buf->skipped = 0;
-		atomic_dec(&q->buffers);
+		mdl = list_first_entry(&q->list, struct cx18_mdl, list);
+		list_del_init(&mdl->list);
+		q->bytesused -= mdl->bytesused - mdl->readpos;
+		mdl->skipped = 0;
+		atomic_dec(&q->depth);
 	}
 	spin_unlock(&q->lock);
-	return buf;
+	return mdl;
+}
+
+static void _cx18_mdl_update_bufs_for_cpu(struct cx18_stream *s,
+					  struct cx18_mdl *mdl)
+{
+	struct cx18_buffer *buf;
+	u32 buf_size = s->buf_size;
+	u32 bytesused = mdl->bytesused;
+
+	list_for_each_entry(buf, &mdl->buf_list, list) {
+		buf->readpos = 0;
+		if (bytesused >= buf_size) {
+			buf->bytesused = buf_size;
+			bytesused -= buf_size;
+		} else {
+			buf->bytesused = bytesused;
+			bytesused = 0;
+		}
+		cx18_buf_sync_for_cpu(s, buf);
+	}
+}
+
+static inline void cx18_mdl_update_bufs_for_cpu(struct cx18_stream *s,
+						struct cx18_mdl *mdl)
+{
+	struct cx18_buffer *buf;
+
+	if (list_is_singular(&mdl->buf_list)) {
+		buf = list_first_entry(&mdl->buf_list, struct cx18_buffer,
+				       list);
+		buf->bytesused = mdl->bytesused;
+		buf->readpos = 0;
+		cx18_buf_sync_for_cpu(s, buf);
+	} else {
+		_cx18_mdl_update_bufs_for_cpu(s, mdl);
+	}
 }
 
-struct cx18_buffer *cx18_queue_get_buf(struct cx18_stream *s, u32 id,
+struct cx18_mdl *cx18_queue_get_mdl(struct cx18_stream *s, u32 id,
 	u32 bytesused)
 {
 	struct cx18 *cx = s->cx;
-	struct cx18_buffer *buf;
-	struct cx18_buffer *tmp;
-	struct cx18_buffer *ret = NULL;
+	struct cx18_mdl *mdl;
+	struct cx18_mdl *tmp;
+	struct cx18_mdl *ret = NULL;
 	LIST_HEAD(sweep_up);
 
 	/*
 	 * We don't have to acquire multiple q locks here, because we are
 	 * serialized by the single threaded work handler.
-	 * Buffers from the firmware will thus remain in order as
+	 * MDLs from the firmware will thus remain in order as
 	 * they are moved from q_busy to q_full or to the dvb ring buffer.
 	 */
 	spin_lock(&s->q_busy.lock);
-	list_for_each_entry_safe(buf, tmp, &s->q_busy.list, list) {
+	list_for_each_entry_safe(mdl, tmp, &s->q_busy.list, list) {
 		/*
 		 * We should find what the firmware told us is done,
 		 * right at the front of the queue.  If we don't, we likely have
-		 * missed a buffer done message from the firmware.
-		 * Once we skip a buffer repeatedly, relative to the size of
+		 * missed an mdl done message from the firmware.
+		 * Once we skip an mdl repeatedly, relative to the size of
 		 * q_busy, we have high confidence we've missed it.
 		 */
-		if (buf->id != id) {
-			buf->skipped++;
-			if (buf->skipped >= atomic_read(&s->q_busy.buffers)-1) {
-				/* buffer must have fallen out of rotation */
-				CX18_WARN("Skipped %s, buffer %d, %d "
+		if (mdl->id != id) {
+			mdl->skipped++;
+			if (mdl->skipped >= atomic_read(&s->q_busy.depth)-1) {
+				/* mdl must have fallen out of rotation */
+				CX18_WARN("Skipped %s, MDL %d, %d "
 					  "times - it must have dropped out of "
-					  "rotation\n", s->name, buf->id,
-					  buf->skipped);
+					  "rotation\n", s->name, mdl->id,
+					  mdl->skipped);
 				/* Sweep it up to put it back into rotation */
-				list_move_tail(&buf->list, &sweep_up);
-				atomic_dec(&s->q_busy.buffers);
+				list_move_tail(&mdl->list, &sweep_up);
+				atomic_dec(&s->q_busy.depth);
 			}
 			continue;
 		}
 		/*
-		 * We pull the desired buffer off of the queue here.  Something
+		 * We pull the desired mdl off of the queue here.  Something
 		 * will have to put it back on a queue later.
 		 */
-		list_del_init(&buf->list);
-		atomic_dec(&s->q_busy.buffers);
-		ret = buf;
+		list_del_init(&mdl->list);
+		atomic_dec(&s->q_busy.depth);
+		ret = mdl;
 		break;
 	}
 	spin_unlock(&s->q_busy.lock);
 
 	/*
-	 * We found the buffer for which we were looking.  Get it ready for
+	 * We found the mdl for which we were looking.  Get it ready for
 	 * the caller to put on q_full or in the dvb ring buffer.
 	 */
 	if (ret != NULL) {
 		ret->bytesused = bytesused;
 		ret->skipped = 0;
-		/* readpos and b_flags were 0'ed when the buf went on q_busy */
-		cx18_buf_sync_for_cpu(s, ret);
+		/* 0'ed readpos, m_flags & curr_buf when mdl went on q_busy */
+		cx18_mdl_update_bufs_for_cpu(s, ret);
 		if (s->type != CX18_ENC_STREAM_TYPE_TS)
-			set_bit(CX18_F_B_NEED_BUF_SWAP, &ret->b_flags);
+			set_bit(CX18_F_M_NEED_SWAP, &ret->m_flags);
 	}
 
-	/* Put any buffers the firmware is ignoring back into normal rotation */
-	list_for_each_entry_safe(buf, tmp, &sweep_up, list) {
-		list_del_init(&buf->list);
-		cx18_enqueue(s, buf, &s->q_free);
+	/* Put any mdls the firmware is ignoring back into normal rotation */
+	list_for_each_entry_safe(mdl, tmp, &sweep_up, list) {
+		list_del_init(&mdl->list);
+		cx18_enqueue(s, mdl, &s->q_free);
 	}
 	return ret;
 }
 
-/* Move all buffers of a queue to q_free, while flushing the buffers */
-static void cx18_queue_flush(struct cx18_stream *s, struct cx18_queue *q)
+/* Move all mdls of a queue, while flushing the mdl */
+static void cx18_queue_flush(struct cx18_stream *s,
+			     struct cx18_queue *q_src, struct cx18_queue *q_dst)
 {
-	struct cx18_buffer *buf;
+	struct cx18_mdl *mdl;
 
-	if (q == &s->q_free)
+	/* It only makes sense to flush to q_free or q_idle */
+	if (q_src == q_dst || q_dst == &s->q_full || q_dst == &s->q_busy)
 		return;
 
-	spin_lock(&q->lock);
-	while (!list_empty(&q->list)) {
-		buf = list_first_entry(&q->list, struct cx18_buffer, list);
-		list_move_tail(&buf->list, &s->q_free.list);
-		buf->bytesused = buf->readpos = buf->b_flags = buf->skipped = 0;
-		atomic_inc(&s->q_free.buffers);
+	spin_lock(&q_src->lock);
+	spin_lock(&q_dst->lock);
+	while (!list_empty(&q_src->list)) {
+		mdl = list_first_entry(&q_src->list, struct cx18_mdl, list);
+		list_move_tail(&mdl->list, &q_dst->list);
+		mdl->bytesused = 0;
+		mdl->readpos = 0;
+		mdl->m_flags = 0;
+		mdl->skipped = 0;
+		mdl->curr_buf = NULL;
+		atomic_inc(&q_dst->depth);
 	}
-	cx18_queue_init(q);
-	spin_unlock(&q->lock);
+	cx18_queue_init(q_src);
+	spin_unlock(&q_src->lock);
+	spin_unlock(&q_dst->lock);
 }
 
 void cx18_flush_queues(struct cx18_stream *s)
 {
-	cx18_queue_flush(s, &s->q_busy);
-	cx18_queue_flush(s, &s->q_full);
+	cx18_queue_flush(s, &s->q_busy, &s->q_free);
+	cx18_queue_flush(s, &s->q_full, &s->q_free);
+}
+
+/*
+ * Note, s->buf_pool is not protected by a lock,
+ * the stream better not have *anything* going on when calling this
+ */
+void cx18_unload_queues(struct cx18_stream *s)
+{
+	struct cx18_queue *q_idle = &s->q_idle;
+	struct cx18_mdl *mdl;
+	struct cx18_buffer *buf;
+
+	/* Move all MDLS to q_idle */
+	cx18_queue_flush(s, &s->q_busy, q_idle);
+	cx18_queue_flush(s, &s->q_full, q_idle);
+	cx18_queue_flush(s, &s->q_free, q_idle);
+
+	/* Reset MDL id's and move all buffers back to the stream's buf_pool */
+	spin_lock(&q_idle->lock);
+	list_for_each_entry(mdl, &q_idle->list, list) {
+		while (!list_empty(&mdl->buf_list)) {
+			buf = list_first_entry(&mdl->buf_list,
+					       struct cx18_buffer, list);
+			list_move_tail(&buf->list, &s->buf_pool);
+			buf->bytesused = 0;
+			buf->readpos = 0;
+		}
+		mdl->id = s->mdl_base_idx; /* reset id to a "safe" value */
+		/* all other mdl fields were cleared by cx18_queue_flush() */
+	}
+	spin_unlock(&q_idle->lock);
+}
+
+/*
+ * Note, s->buf_pool is not protected by a lock,
+ * the stream better not have *anything* going on when calling this
+ */
+void cx18_load_queues(struct cx18_stream *s)
+{
+	struct cx18 *cx = s->cx;
+	struct cx18_mdl *mdl;
+	struct cx18_buffer *buf;
+	int mdl_id;
+	int i;
+	u32 partial_buf_size;
+
+	/*
+	 * Attach buffers to MDLs, give the MDLs ids, and add MDLs to q_free
+	 * Excess MDLs are left on q_idle
+	 * Excess buffers are left in buf_pool and/or on an MDL in q_idle
+	 */
+	mdl_id = s->mdl_base_idx;
+	for (mdl = cx18_dequeue(s, &s->q_idle), i = s->bufs_per_mdl;
+	     mdl != NULL && i == s->bufs_per_mdl;
+	     mdl = cx18_dequeue(s, &s->q_idle)) {
+
+		mdl->id = mdl_id;
+
+		for (i = 0; i < s->bufs_per_mdl; i++) {
+			if (list_empty(&s->buf_pool))
+				break;
+
+			buf = list_first_entry(&s->buf_pool, struct cx18_buffer,
+					       list);
+			list_move_tail(&buf->list, &mdl->buf_list);
+
+			/* update the firmware's MDL array with this buffer */
+			cx18_writel(cx, buf->dma_handle,
+				    &cx->scb->cpu_mdl[mdl_id + i].paddr);
+			cx18_writel(cx, s->buf_size,
+				    &cx->scb->cpu_mdl[mdl_id + i].length);
+		}
+
+		if (i == s->bufs_per_mdl) {
+			/*
+			 * The encoder doesn't honor s->mdl_size.  So in the
+			 * case of a non-integral number of buffers to meet
+			 * mdl_size, we lie about the size of the last buffer
+			 * in the MDL to get the encoder to really only send
+			 * us mdl_size bytes per MDL transfer.
+			 */
+			partial_buf_size = s->mdl_size % s->buf_size;
+			if (partial_buf_size) {
+				cx18_writel(cx, partial_buf_size,
+				      &cx->scb->cpu_mdl[mdl_id + i - 1].length);
+			}
+			cx18_enqueue(s, mdl, &s->q_free);
+		} else {
+			/* Not enough buffers for this MDL; we won't use it */
+			cx18_push(s, mdl, &s->q_idle);
+		}
+		mdl_id += i;
+	}
+}
+
+void _cx18_mdl_sync_for_device(struct cx18_stream *s, struct cx18_mdl *mdl)
+{
+	int dma = s->dma;
+	u32 buf_size = s->buf_size;
+	struct pci_dev *pci_dev = s->cx->pci_dev;
+	struct cx18_buffer *buf;
+
+	list_for_each_entry(buf, &mdl->buf_list, list)
+		pci_dma_sync_single_for_device(pci_dev, buf->dma_handle,
+					       buf_size, dma);
 }
 
 int cx18_stream_alloc(struct cx18_stream *s)
@@ -190,44 +352,62 @@ int cx18_stream_alloc(struct cx18_stream *s)
 	if (s->buffers == 0)
 		return 0;
 
-	CX18_DEBUG_INFO("Allocate %s stream: %d x %d buffers (%dkB total)\n",
+	CX18_DEBUG_INFO("Allocate %s stream: %d x %d buffers "
+			"(%d.%02d kB total)\n",
 		s->name, s->buffers, s->buf_size,
-		s->buffers * s->buf_size / 1024);
+		s->buffers * s->buf_size / 1024,
+		(s->buffers * s->buf_size * 100 / 1024) % 100);
 
-	if (((char __iomem *)&cx->scb->cpu_mdl[cx->mdl_offset + s->buffers] -
+	if (((char __iomem *)&cx->scb->cpu_mdl[cx->free_mdl_idx + s->buffers] -
 				(char __iomem *)cx->scb) > SCB_RESERVED_SIZE) {
 		unsigned bufsz = (((char __iomem *)cx->scb) + SCB_RESERVED_SIZE -
 					((char __iomem *)cx->scb->cpu_mdl));
 
 		CX18_ERR("Too many buffers, cannot fit in SCB area\n");
 		CX18_ERR("Max buffers = %zd\n",
-			bufsz / sizeof(struct cx18_mdl));
+			bufsz / sizeof(struct cx18_mdl_ent));
 		return -ENOMEM;
 	}
 
-	s->mdl_offset = cx->mdl_offset;
+	s->mdl_base_idx = cx->free_mdl_idx;
 
-	/* allocate stream buffers. Initially all buffers are in q_free. */
+	/* allocate stream buffers and MDLs */
 	for (i = 0; i < s->buffers; i++) {
-		struct cx18_buffer *buf = kzalloc(sizeof(struct cx18_buffer),
-						GFP_KERNEL|__GFP_NOWARN);
+		struct cx18_mdl *mdl;
+		struct cx18_buffer *buf;
 
-		if (buf == NULL)
+		/* 1 MDL per buffer to handle the worst & also default case */
+		mdl = kzalloc(sizeof(struct cx18_mdl), GFP_KERNEL|__GFP_NOWARN);
+		if (mdl == NULL)
 			break;
+
+		buf = kzalloc(sizeof(struct cx18_buffer),
+				GFP_KERNEL|__GFP_NOWARN);
+		if (buf == NULL) {
+			kfree(mdl);
+			break;
+		}
+
 		buf->buf = kmalloc(s->buf_size, GFP_KERNEL|__GFP_NOWARN);
 		if (buf->buf == NULL) {
+			kfree(mdl);
 			kfree(buf);
 			break;
 		}
-		buf->id = cx->buffer_id++;
+
+		INIT_LIST_HEAD(&mdl->list);
+		INIT_LIST_HEAD(&mdl->buf_list);
+		mdl->id = s->mdl_base_idx; /* a somewhat safe value */
+		cx18_enqueue(s, mdl, &s->q_idle);
+
 		INIT_LIST_HEAD(&buf->list);
 		buf->dma_handle = pci_map_single(s->cx->pci_dev,
 				buf->buf, s->buf_size, s->dma);
 		cx18_buf_sync_for_cpu(s, buf);
-		cx18_enqueue(s, buf, &s->q_free);
+		list_add_tail(&buf->list, &s->buf_pool);
 	}
 	if (i == s->buffers) {
-		cx->mdl_offset += s->buffers;
+		cx->free_mdl_idx += s->buffers;
 		return 0;
 	}
 	CX18_ERR("Couldn't allocate buffers for %s stream\n", s->name);
@@ -237,13 +417,21 @@ int cx18_stream_alloc(struct cx18_stream *s)
 
 void cx18_stream_free(struct cx18_stream *s)
 {
+	struct cx18_mdl *mdl;
 	struct cx18_buffer *buf;
 
-	/* move all buffers to q_free */
-	cx18_flush_queues(s);
+	/* move all buffers to buf_pool and all MDLs to q_idle */
+	cx18_unload_queues(s);
+
+	/* empty q_idle */
+	while ((mdl = cx18_dequeue(s, &s->q_idle)))
+		kfree(mdl);
+
+	/* empty buf_pool */
+	while (!list_empty(&s->buf_pool)) {
+		buf = list_first_entry(&s->buf_pool, struct cx18_buffer, list);
+		list_del_init(&buf->list);
 
-	/* empty q_free */
-	while ((buf = cx18_dequeue(s, &s->q_free))) {
 		pci_unmap_single(s->cx->pci_dev, buf->dma_handle,
 				s->buf_size, s->dma);
 		kfree(buf->buf);
diff --git a/drivers/media/video/cx18/cx18-queue.h b/drivers/media/video/cx18/cx18-queue.h
index 4de06269d88f..88a6d34ad3bb 100644
--- a/drivers/media/video/cx18/cx18-queue.h
+++ b/drivers/media/video/cx18/cx18-queue.h
@@ -40,32 +40,59 @@ static inline void cx18_buf_sync_for_device(struct cx18_stream *s,
 				s->buf_size, s->dma);
 }
 
+void _cx18_mdl_sync_for_device(struct cx18_stream *s, struct cx18_mdl *mdl);
+
+static inline void cx18_mdl_sync_for_device(struct cx18_stream *s,
+					    struct cx18_mdl *mdl)
+{
+	if (list_is_singular(&mdl->buf_list))
+		cx18_buf_sync_for_device(s, list_first_entry(&mdl->buf_list,
+							     struct cx18_buffer,
+							     list));
+	else
+		_cx18_mdl_sync_for_device(s, mdl);
+}
+
 void cx18_buf_swap(struct cx18_buffer *buf);
+void _cx18_mdl_swap(struct cx18_mdl *mdl);
+
+static inline void cx18_mdl_swap(struct cx18_mdl *mdl)
+{
+	if (list_is_singular(&mdl->buf_list))
+		cx18_buf_swap(list_first_entry(&mdl->buf_list,
+					       struct cx18_buffer, list));
+	else
+		_cx18_mdl_swap(mdl);
+}
 
 /* cx18_queue utility functions */
-struct cx18_queue *_cx18_enqueue(struct cx18_stream *s, struct cx18_buffer *buf,
+struct cx18_queue *_cx18_enqueue(struct cx18_stream *s, struct cx18_mdl *mdl,
 				 struct cx18_queue *q, int to_front);
 
 static inline
-struct cx18_queue *cx18_enqueue(struct cx18_stream *s, struct cx18_buffer *buf,
+struct cx18_queue *cx18_enqueue(struct cx18_stream *s, struct cx18_mdl *mdl,
 				struct cx18_queue *q)
 {
-	return _cx18_enqueue(s, buf, q, 0); /* FIFO */
+	return _cx18_enqueue(s, mdl, q, 0); /* FIFO */
 }
 
 static inline
-struct cx18_queue *cx18_push(struct cx18_stream *s, struct cx18_buffer *buf,
+struct cx18_queue *cx18_push(struct cx18_stream *s, struct cx18_mdl *mdl,
 			     struct cx18_queue *q)
 {
-	return _cx18_enqueue(s, buf, q, 1); /* LIFO */
+	return _cx18_enqueue(s, mdl, q, 1); /* LIFO */
 }
 
 void cx18_queue_init(struct cx18_queue *q);
-struct cx18_buffer *cx18_dequeue(struct cx18_stream *s, struct cx18_queue *q);
-struct cx18_buffer *cx18_queue_get_buf(struct cx18_stream *s, u32 id,
+struct cx18_mdl *cx18_dequeue(struct cx18_stream *s, struct cx18_queue *q);
+struct cx18_mdl *cx18_queue_get_mdl(struct cx18_stream *s, u32 id,
 	u32 bytesused);
 void cx18_flush_queues(struct cx18_stream *s);
 
+/* queue MDL reconfiguration helpers */
+void cx18_unload_queues(struct cx18_stream *s);
+void cx18_load_queues(struct cx18_stream *s);
+
 /* cx18_stream utility functions */
 int cx18_stream_alloc(struct cx18_stream *s);
 void cx18_stream_free(struct cx18_stream *s);
diff --git a/drivers/media/video/cx18/cx18-scb.h b/drivers/media/video/cx18/cx18-scb.h
index 1dc1c431f5a1..368f23d08709 100644
--- a/drivers/media/video/cx18/cx18-scb.h
+++ b/drivers/media/video/cx18/cx18-scb.h
@@ -81,7 +81,7 @@
 
 
 /* This structure is used by EPU to provide memory descriptors in its memory */
-struct cx18_mdl {
+struct cx18_mdl_ent {
     u32 paddr;  /* Physical address of a buffer segment */
     u32 length; /* Length of the buffer segment */
 };
@@ -272,7 +272,7 @@ struct cx18_scb {
 	struct cx18_mailbox  ppu2epu_mb;
 
 	struct cx18_mdl_ack  cpu_mdl_ack[CX18_MAX_STREAMS][CX18_MAX_MDL_ACKS];
-	struct cx18_mdl      cpu_mdl[1];
+	struct cx18_mdl_ent  cpu_mdl[1];
 };
 
 void cx18_init_scb(struct cx18 *cx);
diff --git a/drivers/media/video/cx18/cx18-streams.c b/drivers/media/video/cx18/cx18-streams.c
index 7df513a2dba8..987a9308d938 100644
--- a/drivers/media/video/cx18/cx18-streams.c
+++ b/drivers/media/video/cx18/cx18-streams.c
@@ -115,6 +115,9 @@ static void cx18_stream_init(struct cx18 *cx, int type)
 	s->dma = cx18_stream_info[type].dma;
 	s->buffers = cx->stream_buffers[type];
 	s->buf_size = cx->stream_buf_size[type];
+	INIT_LIST_HEAD(&s->buf_pool);
+	s->bufs_per_mdl = 1;
+	s->mdl_size = s->buf_size * s->bufs_per_mdl;
 
 	init_waitqueue_head(&s->waitq);
 	s->id = -1;
@@ -124,6 +127,8 @@ static void cx18_stream_init(struct cx18 *cx, int type)
 	cx18_queue_init(&s->q_busy);
 	spin_lock_init(&s->q_full.lock);
 	cx18_queue_init(&s->q_full);
+	spin_lock_init(&s->q_idle.lock);
+	cx18_queue_init(&s->q_idle);
 
 	INIT_WORK(&s->out_work_order, cx18_out_work_handler);
 }
@@ -214,6 +219,7 @@ static int cx18_reg_dev(struct cx18 *cx, int type)
 {
 	struct cx18_stream *s = &cx->streams[type];
 	int vfl_type = cx18_stream_info[type].vfl_type;
+	const char *name;
 	int num, ret;
 
 	/* TODO: Shouldn't this be a VFL_TYPE_TRANSPORT or something?
@@ -253,29 +259,30 @@ static int cx18_reg_dev(struct cx18 *cx, int type)
 		s->video_dev = NULL;
 		return ret;
 	}
-	num = s->video_dev->num;
+
+	name = video_device_node_name(s->video_dev);
 
 	switch (vfl_type) {
 	case VFL_TYPE_GRABBER:
-		CX18_INFO("Registered device video%d for %s (%d x %d kB)\n",
-			  num, s->name, cx->stream_buffers[type],
-			  cx->stream_buf_size[type]/1024);
+		CX18_INFO("Registered device %s for %s (%d x %d.%02d kB)\n",
+			  name, s->name, cx->stream_buffers[type],
+			  cx->stream_buf_size[type] / 1024,
+			  (cx->stream_buf_size[type] * 100 / 1024) % 100);
 		break;
 
 	case VFL_TYPE_RADIO:
-		CX18_INFO("Registered device radio%d for %s\n",
-			num, s->name);
+		CX18_INFO("Registered device %s for %s\n", name, s->name);
 		break;
 
 	case VFL_TYPE_VBI:
 		if (cx->stream_buffers[type])
-			CX18_INFO("Registered device vbi%d for %s "
+			CX18_INFO("Registered device %s for %s "
 				  "(%d x %d bytes)\n",
-				  num, s->name, cx->stream_buffers[type],
+				  name, s->name, cx->stream_buffers[type],
 				  cx->stream_buf_size[type]);
 		else
-			CX18_INFO("Registered device vbi%d for %s\n",
-				num, s->name);
+			CX18_INFO("Registered device %s for %s\n",
+				name, s->name);
 		break;
 	}
 
@@ -441,8 +448,8 @@ static void cx18_vbi_setup(struct cx18_stream *s)
 }
 
 static
-struct cx18_queue *_cx18_stream_put_buf_fw(struct cx18_stream *s,
-					   struct cx18_buffer *buf)
+struct cx18_queue *_cx18_stream_put_mdl_fw(struct cx18_stream *s,
+					   struct cx18_mdl *mdl)
 {
 	struct cx18 *cx = s->cx;
 	struct cx18_queue *q;
@@ -451,16 +458,16 @@ struct cx18_queue *_cx18_stream_put_buf_fw(struct cx18_stream *s,
 	if (s->handle == CX18_INVALID_TASK_HANDLE ||
 	    test_bit(CX18_F_S_STOPPING, &s->s_flags) ||
 	    !test_bit(CX18_F_S_STREAMING, &s->s_flags))
-		return cx18_enqueue(s, buf, &s->q_free);
+		return cx18_enqueue(s, mdl, &s->q_free);
 
-	q = cx18_enqueue(s, buf, &s->q_busy);
+	q = cx18_enqueue(s, mdl, &s->q_busy);
 	if (q != &s->q_busy)
-		return q; /* The firmware has the max buffers it can handle */
+		return q; /* The firmware has the max MDLs it can handle */
 
-	cx18_buf_sync_for_device(s, buf);
+	cx18_mdl_sync_for_device(s, mdl);
 	cx18_vapi(cx, CX18_CPU_DE_SET_MDL, 5, s->handle,
-		  (void __iomem *) &cx->scb->cpu_mdl[buf->id] - cx->enc_mem,
-		  1, buf->id, s->buf_size);
+		  (void __iomem *) &cx->scb->cpu_mdl[mdl->id] - cx->enc_mem,
+		  s->bufs_per_mdl, mdl->id, s->mdl_size);
 	return q;
 }
 
@@ -468,19 +475,19 @@ static
 void _cx18_stream_load_fw_queue(struct cx18_stream *s)
 {
 	struct cx18_queue *q;
-	struct cx18_buffer *buf;
+	struct cx18_mdl *mdl;
 
-	if (atomic_read(&s->q_free.buffers) == 0 ||
-	    atomic_read(&s->q_busy.buffers) >= CX18_MAX_FW_MDLS_PER_STREAM)
+	if (atomic_read(&s->q_free.depth) == 0 ||
+	    atomic_read(&s->q_busy.depth) >= CX18_MAX_FW_MDLS_PER_STREAM)
 		return;
 
 	/* Move from q_free to q_busy notifying the firmware, until the limit */
 	do {
-		buf = cx18_dequeue(s, &s->q_free);
-		if (buf == NULL)
+		mdl = cx18_dequeue(s, &s->q_free);
+		if (mdl == NULL)
 			break;
-		q = _cx18_stream_put_buf_fw(s, buf);
-	} while (atomic_read(&s->q_busy.buffers) < CX18_MAX_FW_MDLS_PER_STREAM
+		q = _cx18_stream_put_mdl_fw(s, mdl);
+	} while (atomic_read(&s->q_busy.depth) < CX18_MAX_FW_MDLS_PER_STREAM
 		 && q == &s->q_busy);
 }
 
@@ -492,11 +499,51 @@ void cx18_out_work_handler(struct work_struct *work)
 	_cx18_stream_load_fw_queue(s);
 }
 
+static void cx18_stream_configure_mdls(struct cx18_stream *s)
+{
+	cx18_unload_queues(s);
+
+	switch (s->type) {
+	case CX18_ENC_STREAM_TYPE_YUV:
+		/*
+		 * Height should be a multiple of 32 lines.
+		 * Set the MDL size to the exact size needed for one frame.
+		 * Use enough buffers per MDL to cover the MDL size
+		 */
+		s->mdl_size = 720 * s->cx->params.height * 3 / 2;
+		s->bufs_per_mdl = s->mdl_size / s->buf_size;
+		if (s->mdl_size % s->buf_size)
+			s->bufs_per_mdl++;
+		break;
+	case CX18_ENC_STREAM_TYPE_VBI:
+		s->bufs_per_mdl = 1;
+		if  (cx18_raw_vbi(s->cx)) {
+			s->mdl_size = (s->cx->is_60hz ? 12 : 18)
+						       * 2 * vbi_active_samples;
+		} else {
+			/*
+			 * See comment in cx18_vbi_setup() below about the
+			 * extra lines we capture in sliced VBI mode due to
+			 * the lines on which EAV RP codes toggle.
+			*/
+			s->mdl_size = s->cx->is_60hz
+				   ? (21 - 4 + 1) * 2 * vbi_hblank_samples_60Hz
+				   : (23 - 2 + 1) * 2 * vbi_hblank_samples_50Hz;
+		}
+		break;
+	default:
+		s->bufs_per_mdl = 1;
+		s->mdl_size = s->buf_size * s->bufs_per_mdl;
+		break;
+	}
+
+	cx18_load_queues(s);
+}
+
 int cx18_start_v4l2_encode_stream(struct cx18_stream *s)
 {
 	u32 data[MAX_MB_ARGUMENTS];
 	struct cx18 *cx = s->cx;
-	struct cx18_buffer *buf;
 	int captype = 0;
 	struct cx18_api_func_private priv;
 
@@ -619,14 +666,7 @@ int cx18_start_v4l2_encode_stream(struct cx18_stream *s)
 		(void __iomem *)&cx->scb->cpu_mdl_ack[s->type][1] - cx->enc_mem);
 
 	/* Init all the cpu_mdls for this stream */
-	cx18_flush_queues(s);
-	spin_lock(&s->q_free.lock);
-	list_for_each_entry(buf, &s->q_free.list, list) {
-		cx18_writel(cx, buf->dma_handle,
-					&cx->scb->cpu_mdl[buf->id].paddr);
-		cx18_writel(cx, s->buf_size, &cx->scb->cpu_mdl[buf->id].length);
-	}
-	spin_unlock(&s->q_free.lock);
+	cx18_stream_configure_mdls(s);
 	_cx18_stream_load_fw_queue(s);
 
 	/* begin_capture */
diff --git a/drivers/media/video/cx18/cx18-streams.h b/drivers/media/video/cx18/cx18-streams.h
index 1afc3fd9d822..4a01db5e5a35 100644
--- a/drivers/media/video/cx18/cx18-streams.h
+++ b/drivers/media/video/cx18/cx18-streams.h
@@ -28,18 +28,18 @@ int cx18_streams_setup(struct cx18 *cx);
 int cx18_streams_register(struct cx18 *cx);
 void cx18_streams_cleanup(struct cx18 *cx, int unregister);
 
-/* Related to submission of buffers to firmware */
+/* Related to submission of mdls to firmware */
 static inline void cx18_stream_load_fw_queue(struct cx18_stream *s)
 {
 	struct cx18 *cx = s->cx;
 	queue_work(cx->out_work_queue, &s->out_work_order);
 }
 
-static inline void cx18_stream_put_buf_fw(struct cx18_stream *s,
-					  struct cx18_buffer *buf)
+static inline void cx18_stream_put_mdl_fw(struct cx18_stream *s,
+					  struct cx18_mdl *mdl)
 {
-	/* Put buf on q_free; the out work handler will move buf(s) to q_busy */
-	cx18_enqueue(s, buf, &s->q_free);
+	/* Put mdl on q_free; the out work handler will move mdl(s) to q_busy */
+	cx18_enqueue(s, mdl, &s->q_free);
 	cx18_stream_load_fw_queue(s);
 }
 
diff --git a/drivers/media/video/cx18/cx18-vbi.c b/drivers/media/video/cx18/cx18-vbi.c
index c2aef4add31d..574c1c6974f8 100644
--- a/drivers/media/video/cx18/cx18-vbi.c
+++ b/drivers/media/video/cx18/cx18-vbi.c
@@ -105,6 +105,7 @@ static void copy_vbi_data(struct cx18 *cx, int lines, u32 pts_stamp)
 
 /* Compress raw VBI format, removes leading SAV codes and surplus space
    after the frame.  Returns new compressed size. */
+/* FIXME - this function ignores the input size. */
 static u32 compress_raw_buf(struct cx18 *cx, u8 *buf, u32 size, u32 hdr_size)
 {
 	u32 line_size = vbi_active_samples;
@@ -185,8 +186,7 @@ static u32 compress_sliced_buf(struct cx18 *cx, u8 *buf, u32 size,
 	return line;
 }
 
-void cx18_process_vbi_data(struct cx18 *cx, struct cx18_buffer *buf,
-			   int streamtype)
+static void _cx18_process_vbi_data(struct cx18 *cx, struct cx18_buffer *buf)
 {
 	/*
 	 * The CX23418 provides a 12 byte header in its raw VBI buffers to us:
@@ -203,9 +203,6 @@ void cx18_process_vbi_data(struct cx18 *cx, struct cx18_buffer *buf,
 	u32 pts;
 	int lines;
 
-	if (streamtype != CX18_ENC_STREAM_TYPE_VBI)
-		return;
-
 	/*
 	 * The CX23418 sends us data that is 32 bit little-endian swapped,
 	 * but we want the raw VBI bytes in the order they were in the raster
@@ -250,3 +247,31 @@ void cx18_process_vbi_data(struct cx18 *cx, struct cx18_buffer *buf,
 		copy_vbi_data(cx, lines, pts);
 	cx->vbi.frame++;
 }
+
+void cx18_process_vbi_data(struct cx18 *cx, struct cx18_mdl *mdl,
+			   int streamtype)
+{
+	struct cx18_buffer *buf;
+	u32 orig_used;
+
+	if (streamtype != CX18_ENC_STREAM_TYPE_VBI)
+		return;
+
+	/*
+	 * Big assumption here:
+	 * Every buffer hooked to the MDL's buf_list is a complete VBI frame
+	 * that ends at the end of the buffer.
+	 *
+	 * To assume anything else would make the code in this file
+	 * more complex, or require extra memcpy()'s to make the
+	 * buffers satisfy the above assumption.  It's just simpler to set
+	 * up the encoder buffer transfers to make the assumption true.
+	 */
+	list_for_each_entry(buf, &mdl->buf_list, list) {
+		orig_used = buf->bytesused;
+		if (orig_used == 0)
+			break;
+		_cx18_process_vbi_data(cx, buf);
+		mdl->bytesused -= (orig_used - buf->bytesused);
+	}
+}
diff --git a/drivers/media/video/cx18/cx18-vbi.h b/drivers/media/video/cx18/cx18-vbi.h
index e7e1ae427f34..b365cf4b4668 100644
--- a/drivers/media/video/cx18/cx18-vbi.h
+++ b/drivers/media/video/cx18/cx18-vbi.h
@@ -21,6 +21,6 @@
  *  02111-1307  USA
  */
 
-void cx18_process_vbi_data(struct cx18 *cx, struct cx18_buffer *buf,
+void cx18_process_vbi_data(struct cx18 *cx, struct cx18_mdl *mdl,
 			   int streamtype);
 int cx18_used_line(struct cx18 *cx, int line, int field);
diff --git a/drivers/media/video/cx18/cx18-version.h b/drivers/media/video/cx18/cx18-version.h
index 45494b094e7f..9c0b5bb1b019 100644
--- a/drivers/media/video/cx18/cx18-version.h
+++ b/drivers/media/video/cx18/cx18-version.h
@@ -24,7 +24,7 @@
 
 #define CX18_DRIVER_NAME "cx18"
 #define CX18_DRIVER_VERSION_MAJOR 1
-#define CX18_DRIVER_VERSION_MINOR 2
+#define CX18_DRIVER_VERSION_MINOR 3
 #define CX18_DRIVER_VERSION_PATCHLEVEL 0
 
 #define CX18_VERSION __stringify(CX18_DRIVER_VERSION_MAJOR) "." __stringify(CX18_DRIVER_VERSION_MINOR) "." __stringify(CX18_DRIVER_VERSION_PATCHLEVEL)
diff --git a/drivers/media/video/cx18/cx23418.h b/drivers/media/video/cx18/cx23418.h
index 9956abf576c5..868806effdcf 100644
--- a/drivers/media/video/cx18/cx23418.h
+++ b/drivers/media/video/cx18/cx23418.h
@@ -363,7 +363,7 @@
 /* Description: This command provides the offset to a Memory Descriptor List
    IN[0] - Task handle. Handle of the task to start
    IN[1] - Offset of the MDL from the beginning of the local DDR.
-   IN[2] - Number of cx18_mdl structures in the array pointed to by IN[1]
+   IN[2] - Number of cx18_mdl_ent structures in the array pointed to by IN[1]
    IN[3] - Buffer ID
    IN[4] - Total buffer length
    ReturnCode - One of the ERR_DE_... */
diff --git a/drivers/media/video/cx231xx/cx231xx-avcore.c b/drivers/media/video/cx231xx/cx231xx-avcore.c
index 28f48f41f218..c2174413ab29 100644
--- a/drivers/media/video/cx231xx/cx231xx-avcore.c
+++ b/drivers/media/video/cx231xx/cx231xx-avcore.c
@@ -2414,9 +2414,11 @@ int cx231xx_gpio_i2c_read_ack(struct cx231xx *dev)
 		cx231xx_info("No ACK after %d msec -GPIO I2C failed!",
 			     nInit * 10);
 
-	/* readAck
-	   throuth clock stretch ,slave has given a SCL signal,
-	   so the SDA data can be directly read.  */
+	/*
+	 * readAck
+	 * through clock stretch, slave has given a SCL signal,
+	 * so the SDA data can be directly read.
+	 */
 	status = cx231xx_get_gpio_bit(dev, dev->gpio_dir, (u8 *)&dev->gpio_val);
 
 	if ((dev->gpio_val & 1 << dev->board.tuner_sda_gpio) == 0) {
diff --git a/drivers/media/video/cx231xx/cx231xx-cards.c b/drivers/media/video/cx231xx/cx231xx-cards.c
index 319c459459e0..a54908235009 100644
--- a/drivers/media/video/cx231xx/cx231xx-cards.c
+++ b/drivers/media/video/cx231xx/cx231xx-cards.c
@@ -68,19 +68,19 @@ struct cx231xx_board cx231xx_boards[] = {
 				.type = CX231XX_VMUX_TELEVISION,
 				.vmux = CX231XX_VIN_3_1,
 				.amux = CX231XX_AMUX_VIDEO,
-				.gpio = 0,
+				.gpio = NULL,
 			}, {
 				.type = CX231XX_VMUX_COMPOSITE1,
 				.vmux = CX231XX_VIN_2_1,
 				.amux = CX231XX_AMUX_LINE_IN,
-				.gpio = 0,
+				.gpio = NULL,
 			}, {
 				.type = CX231XX_VMUX_SVIDEO,
 				.vmux = CX231XX_VIN_1_1 |
 					(CX231XX_VIN_1_2 << 8) |
 					CX25840_SVIDEO_ON,
 				.amux = CX231XX_AMUX_LINE_IN,
-				.gpio = 0,
+				.gpio = NULL,
 			}
 		},
 	},
@@ -107,19 +107,19 @@ struct cx231xx_board cx231xx_boards[] = {
 				.type = CX231XX_VMUX_TELEVISION,
 				.vmux = CX231XX_VIN_3_1,
 				.amux = CX231XX_AMUX_VIDEO,
-				.gpio = 0,
+				.gpio = NULL,
 			}, {
 				.type = CX231XX_VMUX_COMPOSITE1,
 				.vmux = CX231XX_VIN_2_1,
 				.amux = CX231XX_AMUX_LINE_IN,
-				.gpio = 0,
+				.gpio = NULL,
 			}, {
 				.type = CX231XX_VMUX_SVIDEO,
 				.vmux = CX231XX_VIN_1_1 |
 					(CX231XX_VIN_1_2 << 8) |
 					CX25840_SVIDEO_ON,
 				.amux = CX231XX_AMUX_LINE_IN,
-				.gpio = 0,
+				.gpio = NULL,
 			}
 		},
 	},
@@ -147,19 +147,19 @@ struct cx231xx_board cx231xx_boards[] = {
 				.type = CX231XX_VMUX_TELEVISION,
 				.vmux = CX231XX_VIN_3_1,
 				.amux = CX231XX_AMUX_VIDEO,
-				.gpio = 0,
+				.gpio = NULL,
 			}, {
 				.type = CX231XX_VMUX_COMPOSITE1,
 				.vmux = CX231XX_VIN_2_1,
 				.amux = CX231XX_AMUX_LINE_IN,
-				.gpio = 0,
+				.gpio = NULL,
 			}, {
 				.type = CX231XX_VMUX_SVIDEO,
 				.vmux = CX231XX_VIN_1_1 |
 					(CX231XX_VIN_1_2 << 8) |
 					CX25840_SVIDEO_ON,
 				.amux = CX231XX_AMUX_LINE_IN,
-				.gpio = 0,
+				.gpio = NULL,
 			}
 		},
 	},
@@ -856,8 +856,9 @@ static void cx231xx_usb_disconnect(struct usb_interface *interface)
 
 	if (dev->users) {
 		cx231xx_warn
-		    ("device /dev/video%d is open! Deregistration and memory "
-		     "deallocation are deferred on close.\n", dev->vdev->num);
+		    ("device %s is open! Deregistration and memory "
+		     "deallocation are deferred on close.\n",
+		     video_device_node_name(dev->vdev));
 
 		dev->state |= DEV_MISCONFIGURED;
 		cx231xx_uninit_isoc(dev);
diff --git a/drivers/media/video/cx231xx/cx231xx-core.c b/drivers/media/video/cx231xx/cx231xx-core.c
index 0d333e679f70..4a60dfbc347d 100644
--- a/drivers/media/video/cx231xx/cx231xx-core.c
+++ b/drivers/media/video/cx231xx/cx231xx-core.c
@@ -66,32 +66,6 @@ MODULE_PARM_DESC(alt, "alternate setting to use for video endpoint");
 static LIST_HEAD(cx231xx_devlist);
 static DEFINE_MUTEX(cx231xx_devlist_mutex);
 
-struct cx231xx *cx231xx_get_device(int minor,
-				   enum v4l2_buf_type *fh_type, int *has_radio)
-{
-	struct cx231xx *h, *dev = NULL;
-
-	*fh_type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
-	*has_radio = 0;
-
-	mutex_lock(&cx231xx_devlist_mutex);
-	list_for_each_entry(h, &cx231xx_devlist, devlist) {
-		if (h->vdev->minor == minor)
-			dev = h;
-		if (h->vbi_dev->minor == minor) {
-			dev = h;
-			*fh_type = V4L2_BUF_TYPE_VBI_CAPTURE;
-		}
-		if (h->radio_dev && h->radio_dev->minor == minor) {
-			dev = h;
-			*has_radio = 1;
-		}
-	}
-	mutex_unlock(&cx231xx_devlist_mutex);
-
-	return dev;
-}
-
 /*
  * cx231xx_realease_resources()
  * unregisters the v4l2,i2c and usb devices
diff --git a/drivers/media/video/cx231xx/cx231xx-input.c b/drivers/media/video/cx231xx/cx231xx-input.c
index 48f22fa38e6c..15826f98b688 100644
--- a/drivers/media/video/cx231xx/cx231xx-input.c
+++ b/drivers/media/video/cx231xx/cx231xx-input.c
@@ -126,8 +126,7 @@ static void cx231xx_ir_handle_key(struct cx231xx_IR *ir)
 
 	if (do_sendkey) {
 		dprintk("sending keypress\n");
-		ir_input_keydown(ir->input, &ir->ir, poll_result.rc_data[0],
-				 poll_result.rc_data[0]);
+		ir_input_keydown(ir->input, &ir->ir, poll_result.rc_data[0]);
 		ir_input_nokey(ir->input, &ir->ir);
 	}
 
@@ -198,7 +197,10 @@ int cx231xx_ir_init(struct cx231xx *dev)
 	usb_make_path(dev->udev, ir->phys, sizeof(ir->phys));
 	strlcat(ir->phys, "/input0", sizeof(ir->phys));
 
-	ir_input_init(input_dev, &ir->ir, IR_TYPE_OTHER, dev->board.ir_codes);
+	err = ir_input_init(input_dev, &ir->ir, IR_TYPE_OTHER);
+	if (err < 0)
+		goto err_out_free;
+
 	input_dev->name = ir->name;
 	input_dev->phys = ir->phys;
 	input_dev->id.bustype = BUS_USB;
@@ -214,7 +216,7 @@ int cx231xx_ir_init(struct cx231xx *dev)
 	cx231xx_ir_start(ir);
 
 	/* all done */
-	err = input_register_device(ir->input);
+	err = ir_input_register(ir->input, dev->board.ir_codes);
 	if (err)
 		goto err_out_stop;
 
@@ -223,7 +225,6 @@ err_out_stop:
 	cx231xx_ir_stop(ir);
 	dev->ir = NULL;
 err_out_free:
-	input_free_device(input_dev);
 	kfree(ir);
 	return err;
 }
@@ -237,7 +238,7 @@ int cx231xx_ir_fini(struct cx231xx *dev)
 		return 0;
 
 	cx231xx_ir_stop(ir);
-	input_unregister_device(ir->input);
+	ir_input_unregister(ir->input);
 	kfree(ir);
 
 	/* done */
diff --git a/drivers/media/video/cx231xx/cx231xx-video.c b/drivers/media/video/cx231xx/cx231xx-video.c
index 36503725d973..d4f546f11d74 100644
--- a/drivers/media/video/cx231xx/cx231xx-video.c
+++ b/drivers/media/video/cx231xx/cx231xx-video.c
@@ -1916,20 +1916,29 @@ static int radio_queryctrl(struct file *file, void *priv,
  */
 static int cx231xx_v4l2_open(struct file *filp)
 {
-	int minor = video_devdata(filp)->minor;
 	int errCode = 0, radio = 0;
-	struct cx231xx *dev = NULL;
+	struct video_device *vdev = video_devdata(filp);
+	struct cx231xx *dev = video_drvdata(filp);
 	struct cx231xx_fh *fh;
 	enum v4l2_buf_type fh_type = 0;
 
-	dev = cx231xx_get_device(minor, &fh_type, &radio);
-	if (NULL == dev)
-		return -ENODEV;
+	switch (vdev->vfl_type) {
+	case VFL_TYPE_GRABBER:
+		fh_type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
+		break;
+	case VFL_TYPE_VBI:
+		fh_type = V4L2_BUF_TYPE_VBI_CAPTURE;
+		break;
+	case VFL_TYPE_RADIO:
+		radio = 1;
+		break;
+	}
 
 	mutex_lock(&dev->lock);
 
-	cx231xx_videodbg("open minor=%d type=%s users=%d\n",
-			 minor, v4l2_type_names[fh_type], dev->users);
+	cx231xx_videodbg("open dev=%s type=%s users=%d\n",
+			 video_device_node_name(vdev), v4l2_type_names[fh_type],
+			 dev->users);
 
 #if 0
 	errCode = cx231xx_set_mode(dev, CX231XX_ANALOG_MODE);
@@ -2020,25 +2029,25 @@ void cx231xx_release_analog_resources(struct cx231xx *dev)
 	/*FIXME: I2C IR should be disconnected */
 
 	if (dev->radio_dev) {
-		if (-1 != dev->radio_dev->minor)
+		if (video_is_registered(dev->radio_dev))
 			video_unregister_device(dev->radio_dev);
 		else
 			video_device_release(dev->radio_dev);
 		dev->radio_dev = NULL;
 	}
 	if (dev->vbi_dev) {
-		cx231xx_info("V4L2 device /dev/vbi%d deregistered\n",
-			     dev->vbi_dev->num);
-		if (-1 != dev->vbi_dev->minor)
+		cx231xx_info("V4L2 device %s deregistered\n",
+			     video_device_node_name(dev->vbi_dev));
+		if (video_is_registered(dev->vbi_dev))
 			video_unregister_device(dev->vbi_dev);
 		else
 			video_device_release(dev->vbi_dev);
 		dev->vbi_dev = NULL;
 	}
 	if (dev->vdev) {
-		cx231xx_info("V4L2 device /dev/video%d deregistered\n",
-			     dev->vdev->num);
-		if (-1 != dev->vdev->minor)
+		cx231xx_info("V4L2 device %s deregistered\n",
+			     video_device_node_name(dev->vdev));
+		if (video_is_registered(dev->vdev))
 			video_unregister_device(dev->vdev);
 		else
 			video_device_release(dev->vdev);
@@ -2106,7 +2115,7 @@ static int cx231xx_v4l2_close(struct file *filp)
 		}
 
 		/* Save some power by putting tuner to sleep */
-		call_all(dev, tuner, s_standby);
+		call_all(dev, core, s_power, 0);
 
 		/* do this before setting alternate! */
 		cx231xx_uninit_isoc(dev);
@@ -2268,7 +2277,6 @@ static const struct video_device cx231xx_video_template = {
 	.fops         = &cx231xx_v4l_fops,
 	.release      = video_device_release,
 	.ioctl_ops    = &video_ioctl_ops,
-	.minor        = -1,
 	.tvnorms      = V4L2_STD_ALL,
 	.current_norm = V4L2_STD_PAL,
 };
@@ -2303,7 +2311,6 @@ static struct video_device cx231xx_radio_template = {
 	.name      = "cx231xx-radio",
 	.fops      = &radio_fops,
 	.ioctl_ops = &radio_ioctl_ops,
-	.minor     = -1,
 };
 
 /******************************** usb interface ******************************/
@@ -2319,13 +2326,13 @@ static struct video_device *cx231xx_vdev_init(struct cx231xx *dev,
 		return NULL;
 
 	*vfd = *template;
-	vfd->minor = -1;
 	vfd->v4l2_dev = &dev->v4l2_dev;
 	vfd->release = video_device_release;
 	vfd->debug = video_debug;
 
 	snprintf(vfd->name, sizeof(vfd->name), "%s %s", dev->name, type_name);
 
+	video_set_drvdata(vfd, dev);
 	return vfd;
 }
 
@@ -2374,8 +2381,8 @@ int cx231xx_register_analog_devices(struct cx231xx *dev)
 		return ret;
 	}
 
-	cx231xx_info("%s/0: registered device video%d [v4l2]\n",
-		     dev->name, dev->vdev->num);
+	cx231xx_info("%s/0: registered device %s [v4l2]\n",
+		     dev->name, video_device_node_name(dev->vdev));
 
 	/* Initialize VBI template */
 	memcpy(&cx231xx_vbi_template, &cx231xx_video_template,
@@ -2393,8 +2400,8 @@ int cx231xx_register_analog_devices(struct cx231xx *dev)
 		return ret;
 	}
 
-	cx231xx_info("%s/0: registered device vbi%d\n",
-		     dev->name, dev->vbi_dev->num);
+	cx231xx_info("%s/0: registered device %s\n",
+		     dev->name, video_device_node_name(dev->vbi_dev));
 
 	if (cx231xx_boards[dev->model].radio.type == CX231XX_RADIO) {
 		dev->radio_dev = cx231xx_vdev_init(dev, &cx231xx_radio_template,
@@ -2409,12 +2416,13 @@ int cx231xx_register_analog_devices(struct cx231xx *dev)
 			cx231xx_errdev("can't register radio device\n");
 			return ret;
 		}
-		cx231xx_info("Registered radio device as /dev/radio%d\n",
-			     dev->radio_dev->num);
+		cx231xx_info("Registered radio device as %s\n",
+			     video_device_node_name(dev->radio_dev));
 	}
 
-	cx231xx_info("V4L2 device registered as /dev/video%d and /dev/vbi%d\n",
-		     dev->vdev->num, dev->vbi_dev->num);
+	cx231xx_info("V4L2 device registered as %s and %s\n",
+		     video_device_node_name(dev->vdev),
+		     video_device_node_name(dev->vbi_dev));
 
 	return 0;
 }
diff --git a/drivers/media/video/cx231xx/cx231xx.h b/drivers/media/video/cx231xx/cx231xx.h
index 64e2ddd3c401..17d4d1a800ce 100644
--- a/drivers/media/video/cx231xx/cx231xx.h
+++ b/drivers/media/video/cx231xx/cx231xx.h
@@ -689,8 +689,6 @@ void cx231xx_release_analog_resources(struct cx231xx *dev);
 int cx231xx_register_analog_devices(struct cx231xx *dev);
 void cx231xx_remove_from_devlist(struct cx231xx *dev);
 void cx231xx_add_into_devlist(struct cx231xx *dev);
-struct cx231xx *cx231xx_get_device(int minor,
-				   enum v4l2_buf_type *fh_type, int *has_radio);
 void cx231xx_init_extension(struct cx231xx *dev);
 void cx231xx_close_extension(struct cx231xx *dev);
 
diff --git a/drivers/media/video/cx23885/Kconfig b/drivers/media/video/cx23885/Kconfig
index fd3fc3e3198a..bcdda9a9aa96 100644
--- a/drivers/media/video/cx23885/Kconfig
+++ b/drivers/media/video/cx23885/Kconfig
@@ -18,7 +18,9 @@ config VIDEO_CX23885
 	select DVB_TDA10048 if !DVB_FE_CUSTOMISE
 	select DVB_LNBP21 if !DVB_FE_CUSTOMISE
 	select DVB_STV6110 if !DVB_FE_CUSTOMISE
+	select DVB_CX24116 if !DVB_FE_CUSTOMISE
 	select DVB_STV0900 if !DVB_FE_CUSTOMISE
+	select DVB_DS3000 if !DVB_FE_CUSTOMISE
 	select MEDIA_TUNER_MT2131 if !MEDIA_TUNER_CUSTOMISE
 	select MEDIA_TUNER_XC2028 if !MEDIA_TUNER_CUSTOMISE
 	select MEDIA_TUNER_TDA8290 if !MEDIA_TUNER_CUSTOMISE
diff --git a/drivers/media/video/cx23885/Makefile b/drivers/media/video/cx23885/Makefile
index ab8ea35c9bfb..5787ae243631 100644
--- a/drivers/media/video/cx23885/Makefile
+++ b/drivers/media/video/cx23885/Makefile
@@ -1,6 +1,7 @@
 cx23885-objs	:= cx23885-cards.o cx23885-video.o cx23885-vbi.o \
 		    cx23885-core.o cx23885-i2c.o cx23885-dvb.o cx23885-417.o \
-		    netup-init.o cimax2.o netup-eeprom.o
+		    cx23885-ioctl.o cx23885-ir.o cx23885-input.o cx23888-ir.o \
+		    netup-init.o cimax2.o netup-eeprom.o cx23885-f300.o
 
 obj-$(CONFIG_VIDEO_CX23885) += cx23885.o
 
diff --git a/drivers/media/video/cx23885/cimax2.c b/drivers/media/video/cx23885/cimax2.c
index c04222ffb286..d4a9d2c5947c 100644
--- a/drivers/media/video/cx23885/cimax2.c
+++ b/drivers/media/video/cx23885/cimax2.c
@@ -53,6 +53,8 @@
 #define NETUP_CI_CTL		0x04
 #define NETUP_CI_RD		1
 
+#define NETUP_IRQ_DETAM 	0x1
+#define NETUP_IRQ_IRQAM		0x4
 
 static unsigned int ci_dbg;
 module_param(ci_dbg, int, 0644);
@@ -73,6 +75,9 @@ struct netup_ci_state {
 	int status;
 	struct work_struct work;
 	void *priv;
+	u8 current_irq_mode;
+	int current_ci_flag;
+	unsigned long next_status_checked_time;
 };
 
 
@@ -169,24 +174,26 @@ int netup_ci_op_cam(struct dvb_ca_en50221 *en50221, int slot,
 	if (0 != slot)
 		return -EINVAL;
 
-	ret = netup_read_i2c(state->i2c_adap, state->ci_i2c_addr,
-							0, &store, 1);
-	if (ret != 0)
-		return ret;
+	if (state->current_ci_flag != flag) {
+		ret = netup_read_i2c(state->i2c_adap, state->ci_i2c_addr,
+				0, &store, 1);
+		if (ret != 0)
+			return ret;
 
-	store &= ~0x0c;
-	store |= flag;
+		store &= ~0x0c;
+		store |= flag;
 
-	ret = netup_write_i2c(state->i2c_adap, state->ci_i2c_addr,
-							0, &store, 1);
-	if (ret != 0)
-		return ret;
+		ret = netup_write_i2c(state->i2c_adap, state->ci_i2c_addr,
+				0, &store, 1);
+		if (ret != 0)
+			return ret;
+	};
+	state->current_ci_flag = flag;
 
 	mutex_lock(&dev->gpio_lock);
 
 	/* write addr */
 	cx_write(MC417_OEN, NETUP_EN_ALL);
-	msleep(2);
 	cx_write(MC417_RWD, NETUP_CTRL_OFF |
 				NETUP_ADLO | (0xff & addr));
 	cx_clear(MC417_RWD, NETUP_ADLO);
@@ -196,7 +203,6 @@ int netup_ci_op_cam(struct dvb_ca_en50221 *en50221, int slot,
 
 	if (read) { /* data in */
 		cx_write(MC417_OEN, NETUP_EN_ALL | NETUP_DATA);
-		msleep(2);
 	} else /* data out */
 		cx_write(MC417_RWD, NETUP_CTRL_OFF | data);
 
@@ -213,8 +219,8 @@ int netup_ci_op_cam(struct dvb_ca_en50221 *en50221, int slot,
 		if (mem < 0)
 			return -EREMOTEIO;
 
-	ci_dbg_print("%s: %s: addr=[0x%02x], %s=%x\n", __func__,
-			(read) ? "read" : "write", addr,
+	ci_dbg_print("%s: %s: chipaddr=[0x%x] addr=[0x%02x], %s=%x\n", __func__,
+			(read) ? "read" : "write", state->ci_i2c_addr, addr,
 			(flag == NETUP_CI_CTL) ? "ctl" : "mem",
 			(read) ? mem : data);
 
@@ -283,14 +289,39 @@ int netup_ci_slot_shutdown(struct dvb_ca_en50221 *en50221, int slot)
 	return 0;
 }
 
+int netup_ci_set_irq(struct dvb_ca_en50221 *en50221, u8 irq_mode)
+{
+	struct netup_ci_state *state = en50221->data;
+	int ret;
+
+	if (irq_mode == state->current_irq_mode)
+		return 0;
+
+	ci_dbg_print("%s: chipaddr=[0x%x] setting ci IRQ to [0x%x] \n",
+			__func__, state->ci_i2c_addr, irq_mode);
+	ret = netup_write_i2c(state->i2c_adap, state->ci_i2c_addr,
+							0x1b, &irq_mode, 1);
+
+	if (ret != 0)
+		return ret;
+
+	state->current_irq_mode = irq_mode;
+
+	return 0;
+}
+
 int netup_ci_slot_ts_ctl(struct dvb_ca_en50221 *en50221, int slot)
 {
 	struct netup_ci_state *state = en50221->data;
-	u8 buf = 0x60;
+	u8 buf;
 
 	if (0 != slot)
 		return -EINVAL;
 
+	netup_read_i2c(state->i2c_adap, state->ci_i2c_addr,
+			0, &buf, 1);
+	buf |= 0x60;
+
 	return netup_write_i2c(state->i2c_adap, state->ci_i2c_addr,
 							0, &buf, 1);
 }
@@ -303,21 +334,35 @@ static void netup_read_ci_status(struct work_struct *work)
 	u8 buf[33];
 	int ret;
 
-	ret = netup_read_i2c(state->i2c_adap, state->ci_i2c_addr,
-							0, &buf[0], 33);
+	/* CAM module IRQ processing. fast operation */
+	dvb_ca_en50221_frda_irq(&state->ca, 0);
 
-	if (ret != 0)
-		return;
+	/* CAM module INSERT/REMOVE processing. slow operation because of i2c
+	 * transfers */
+	if (time_after(jiffies, state->next_status_checked_time)
+			|| !state->status) {
+		ret = netup_read_i2c(state->i2c_adap, state->ci_i2c_addr,
+				0, &buf[0], 33);
+
+		state->next_status_checked_time = jiffies
+			+ msecs_to_jiffies(1000);
+
+		if (ret != 0)
+			return;
 
-	ci_dbg_print("%s: Slot Status Addr=[0x%04x], Reg=[0x%02x], data=%02x, "
-		"TS config = %02x\n", __func__, state->ci_i2c_addr, 0, buf[0],
-		buf[32]);
+		ci_dbg_print("%s: Slot Status Addr=[0x%04x], "
+				"Reg=[0x%02x], data=%02x, "
+				"TS config = %02x\n", __func__,
+				state->ci_i2c_addr, 0, buf[0],
+				buf[0]);
 
-	if (buf[0] & 1)
-		state->status = DVB_CA_EN50221_POLL_CAM_PRESENT |
-			DVB_CA_EN50221_POLL_CAM_READY;
-	else
-		state->status = 0;
+
+		if (buf[0] & 1)
+			state->status = DVB_CA_EN50221_POLL_CAM_PRESENT |
+				DVB_CA_EN50221_POLL_CAM_READY;
+		else
+			state->status = 0;
+	};
 }
 
 /* CI irq handler */
@@ -347,6 +392,9 @@ int netup_poll_ci_slot_status(struct dvb_ca_en50221 *en50221, int slot, int open
 	if (0 != slot)
 		return -EINVAL;
 
+	netup_ci_set_irq(en50221, open ? (NETUP_IRQ_DETAM | NETUP_IRQ_IRQAM)
+			: NETUP_IRQ_DETAM);
+
 	return state->status;
 }
 
@@ -381,8 +429,8 @@ int netup_ci_init(struct cx23885_tsport *port)
 		0x01, /* power on (use it like store place) */
 		0x00, /* RFU */
 		0x00, /* int status read only */
-		0x01, /* all int unmasked */
-		0x04, /* int config */
+		NETUP_IRQ_IRQAM | NETUP_IRQ_DETAM, /* DETAM, IRQAM unmasked */
+		0x05, /* EXTINT=active-high, INT=push-pull */
 		0x00, /* USCG1 */
 		0x04, /* ack active low */
 		0x00, /* LOCK = 0 */
@@ -422,6 +470,7 @@ int netup_ci_init(struct cx23885_tsport *port)
 	state->ca.poll_slot_status = netup_poll_ci_slot_status;
 	state->ca.data = state;
 	state->priv = port;
+	state->current_irq_mode = NETUP_IRQ_IRQAM | NETUP_IRQ_DETAM;
 
 	ret = netup_write_i2c(state->i2c_adap, state->ci_i2c_addr,
 						0, &cimax_init[0], 34);
diff --git a/drivers/media/video/cx23885/cx23885-417.c b/drivers/media/video/cx23885/cx23885-417.c
index 6c3b51ce3372..88c0d2481118 100644
--- a/drivers/media/video/cx23885/cx23885-417.c
+++ b/drivers/media/video/cx23885/cx23885-417.c
@@ -37,6 +37,7 @@
 #include <media/cx2341x.h>
 
 #include "cx23885.h"
+#include "cx23885-ioctl.h"
 
 #define CX23885_FIRM_IMAGE_SIZE 376836
 #define CX23885_FIRM_IMAGE_NAME "v4l-cx23885-enc.fw"
@@ -318,7 +319,7 @@ static int mc417_wait_ready(struct cx23885_dev *dev)
 	}
 }
 
-static int mc417_register_write(struct cx23885_dev *dev, u16 address, u32 value)
+int mc417_register_write(struct cx23885_dev *dev, u16 address, u32 value)
 {
 	u32 regval;
 
@@ -382,7 +383,7 @@ static int mc417_register_write(struct cx23885_dev *dev, u16 address, u32 value)
 	return mc417_wait_ready(dev);
 }
 
-static int mc417_register_read(struct cx23885_dev *dev, u16 address, u32 *value)
+int mc417_register_read(struct cx23885_dev *dev, u16 address, u32 *value)
 {
 	int retval;
 	u32 regval;
@@ -1567,28 +1568,11 @@ static int vidioc_queryctrl(struct file *file, void *priv,
 
 static int mpeg_open(struct file *file)
 {
-	int minor = video_devdata(file)->minor;
-	struct cx23885_dev *h, *dev = NULL;
-	struct list_head *list;
+	struct cx23885_dev *dev = video_drvdata(file);
 	struct cx23885_fh *fh;
 
 	dprintk(2, "%s()\n", __func__);
 
-	lock_kernel();
-	list_for_each(list, &cx23885_devlist) {
-		h = list_entry(list, struct cx23885_dev, devlist);
-		if (h->v4l_device &&
-		    h->v4l_device->minor == minor) {
-			dev = h;
-			break;
-		}
-	}
-
-	if (dev == NULL) {
-		unlock_kernel();
-		return -ENODEV;
-	}
-
 	/* allocate + initialize per filehandle data */
 	fh = kzalloc(sizeof(*fh), GFP_KERNEL);
 	if (NULL == fh) {
@@ -1596,6 +1580,8 @@ static int mpeg_open(struct file *file)
 		return -ENOMEM;
 	}
 
+	lock_kernel();
+
 	file->private_data = fh;
 	fh->dev      = dev;
 
@@ -1724,13 +1710,17 @@ static const struct v4l2_ioctl_ops mpeg_ioctl_ops = {
 	.vidioc_log_status	 = vidioc_log_status,
 	.vidioc_querymenu	 = vidioc_querymenu,
 	.vidioc_queryctrl	 = vidioc_queryctrl,
+	.vidioc_g_chip_ident	 = cx23885_g_chip_ident,
+#ifdef CONFIG_VIDEO_ADV_DEBUG
+	.vidioc_g_register	 = cx23885_g_register,
+	.vidioc_s_register	 = cx23885_s_register,
+#endif
 };
 
 static struct video_device cx23885_mpeg_template = {
 	.name          = "cx23885",
 	.fops          = &mpeg_fops,
 	.ioctl_ops     = &mpeg_ioctl_ops,
-	.minor         = -1,
 	.tvnorms       = CX23885_NORMS,
 	.current_norm  = V4L2_STD_NTSC_M,
 };
@@ -1740,7 +1730,7 @@ void cx23885_417_unregister(struct cx23885_dev *dev)
 	dprintk(1, "%s()\n", __func__);
 
 	if (dev->v4l_device) {
-		if (-1 != dev->v4l_device->minor)
+		if (video_is_registered(dev->v4l_device))
 			video_unregister_device(dev->v4l_device);
 		else
 			video_device_release(dev->v4l_device);
@@ -1797,6 +1787,7 @@ int cx23885_417_register(struct cx23885_dev *dev)
 	/* Allocate and initialize V4L video device */
 	dev->v4l_device = cx23885_video_dev_alloc(tsport,
 		dev->pci, &cx23885_mpeg_template, "mpeg");
+	video_set_drvdata(dev->v4l_device, dev);
 	err = video_register_device(dev->v4l_device,
 		VFL_TYPE_GRABBER, -1);
 	if (err < 0) {
@@ -1804,8 +1795,8 @@ int cx23885_417_register(struct cx23885_dev *dev)
 		return err;
 	}
 
-	printk(KERN_INFO "%s: registered device video%d [mpeg]\n",
-	       dev->name, dev->v4l_device->num);
+	printk(KERN_INFO "%s: registered device %s [mpeg]\n",
+	       dev->name, video_device_node_name(dev->v4l_device));
 
 	return 0;
 }
diff --git a/drivers/media/video/cx23885/cx23885-cards.c b/drivers/media/video/cx23885/cx23885-cards.c
index bfdf79f1033c..1ec48169277d 100644
--- a/drivers/media/video/cx23885/cx23885-cards.c
+++ b/drivers/media/video/cx23885/cx23885-cards.c
@@ -28,6 +28,7 @@
 #include "cx23885.h"
 #include "tuner-xc2028.h"
 #include "netup-init.h"
+#include "cx23888-ir.h"
 
 /* ------------------------------------------------------------------ */
 /* board config info                                                  */
@@ -199,11 +200,61 @@ struct cx23885_board cx23885_boards[] = {
 	},
 	[CX23885_BOARD_MYGICA_X8506] = {
 		.name		= "Mygica X8506 DMB-TH",
+		.tuner_type = TUNER_XC5000,
+		.tuner_addr = 0x61,
+		.porta		= CX23885_ANALOG_VIDEO,
 		.portb		= CX23885_MPEG_DVB,
+		.input		= {
+			{
+				.type   = CX23885_VMUX_TELEVISION,
+				.vmux   = CX25840_COMPOSITE2,
+			},
+			{
+				.type   = CX23885_VMUX_COMPOSITE1,
+				.vmux   = CX25840_COMPOSITE8,
+			},
+			{
+				.type   = CX23885_VMUX_SVIDEO,
+				.vmux   = CX25840_SVIDEO_LUMA3 |
+						CX25840_SVIDEO_CHROMA4,
+			},
+			{
+				.type   = CX23885_VMUX_COMPONENT,
+				.vmux   = CX25840_COMPONENT_ON |
+					CX25840_VIN1_CH1 |
+					CX25840_VIN6_CH2 |
+					CX25840_VIN7_CH3,
+			},
+		},
 	},
 	[CX23885_BOARD_MAGICPRO_PROHDTVE2] = {
 		.name		= "Magic-Pro ProHDTV Extreme 2",
+		.tuner_type = TUNER_XC5000,
+		.tuner_addr = 0x61,
+		.porta		= CX23885_ANALOG_VIDEO,
 		.portb		= CX23885_MPEG_DVB,
+		.input		= {
+			{
+				.type   = CX23885_VMUX_TELEVISION,
+				.vmux   = CX25840_COMPOSITE2,
+			},
+			{
+				.type   = CX23885_VMUX_COMPOSITE1,
+				.vmux   = CX25840_COMPOSITE8,
+			},
+			{
+				.type   = CX23885_VMUX_SVIDEO,
+				.vmux   = CX25840_SVIDEO_LUMA3 |
+						CX25840_SVIDEO_CHROMA4,
+			},
+			{
+				.type   = CX23885_VMUX_COMPONENT,
+				.vmux   = CX25840_COMPONENT_ON |
+					CX25840_VIN1_CH1 |
+					CX25840_VIN6_CH2 |
+					CX25840_VIN7_CH3,
+			},
+		},
 	},
 	[CX23885_BOARD_HAUPPAUGE_HVR1850] = {
 		.name		= "Hauppauge WinTV-HVR1850",
@@ -214,6 +265,15 @@ struct cx23885_board cx23885_boards[] = {
 		.name		= "Compro VideoMate E800",
 		.portc		= CX23885_MPEG_DVB,
 	},
+	[CX23885_BOARD_HAUPPAUGE_HVR1290] = {
+		.name		= "Hauppauge WinTV-HVR1290",
+		.portc		= CX23885_MPEG_DVB,
+	},
+	[CX23885_BOARD_MYGICA_X8558PRO] = {
+		.name		= "Mygica X8558 PRO DMB-TH",
+		.portb		= CX23885_MPEG_DVB,
+		.portc		= CX23885_MPEG_DVB,
+	},
 };
 const unsigned int cx23885_bcount = ARRAY_SIZE(cx23885_boards);
 
@@ -349,6 +409,14 @@ struct cx23885_subid cx23885_subids[] = {
 		.subvendor = 0x1858,
 		.subdevice = 0xe800,
 		.card      = CX23885_BOARD_COMPRO_VIDEOMATE_E800,
+	}, {
+		.subvendor = 0x0070,
+		.subdevice = 0x8551,
+		.card      = CX23885_BOARD_HAUPPAUGE_HVR1290,
+	}, {
+		.subvendor = 0x14f1,
+		.subdevice = 0x8578,
+		.card      = CX23885_BOARD_MYGICA_X8558PRO,
 	},
 };
 const unsigned int cx23885_idcount = ARRAY_SIZE(cx23885_subids);
@@ -509,9 +577,13 @@ static void hauppauge_eeprom(struct cx23885_dev *dev, u8 *eeprom_data)
 		 * DVB-T and MPEG2 HW Encoder */
 		break;
 	case 85021:
-		/* WinTV-HVR1850 (PCIe, OEM, RCA in, IR, FM,
+		/* WinTV-HVR1850 (PCIe, Retail, 3.5mm in, IR, FM,
 			Dual channel ATSC and MPEG2 HW Encoder */
 		break;
+	case 85721:
+		/* WinTV-HVR1290 (PCIe, OEM, RCA in, IR,
+			Dual channel ATSC and Basic analog */
+		break;
 	default:
 		printk(KERN_WARNING "%s: warning: "
 			"unknown hauppauge model #%d\n",
@@ -710,10 +782,14 @@ void cx23885_gpio_setup(struct cx23885_dev *dev)
 		cx_set(GP0_IO, 0x00040004);
 		break;
 	case CX23885_BOARD_TBS_6920:
-	case CX23885_BOARD_TEVII_S470:
 		cx_write(MC417_CTL, 0x00000036);
 		cx_write(MC417_OEN, 0x00001000);
-		cx_write(MC417_RWD, 0x00001800);
+		cx_set(MC417_RWD, 0x00000002);
+		mdelay(200);
+		cx_clear(MC417_RWD, 0x00000800);
+		mdelay(200);
+		cx_set(MC417_RWD, 0x00000800);
+		mdelay(200);
 		break;
 	case CX23885_BOARD_NETUP_DUAL_DVBS2_CI:
 		/* GPIO-0 INTA from CiMax1
@@ -758,15 +834,26 @@ void cx23885_gpio_setup(struct cx23885_dev *dev)
 		break;
 	case CX23885_BOARD_MYGICA_X8506:
 	case CX23885_BOARD_MAGICPRO_PROHDTVE2:
+		/* GPIO-0 (0)Analog / (1)Digital TV */
 		/* GPIO-1 reset XC5000 */
 		/* GPIO-2 reset LGS8GL5 / LGS8G75 */
-		cx_set(GP0_IO, 0x00060000);
-		cx_clear(GP0_IO, 0x00000006);
+		cx23885_gpio_enable(dev, GPIO_0 | GPIO_1 | GPIO_2, 1);
+		cx23885_gpio_clear(dev, GPIO_1 | GPIO_2);
 		mdelay(100);
-		cx_set(GP0_IO, 0x00060006);
+		cx23885_gpio_set(dev, GPIO_0 | GPIO_1 | GPIO_2);
+		mdelay(100);
+		break;
+	case CX23885_BOARD_MYGICA_X8558PRO:
+		/* GPIO-0 reset first ATBM8830 */
+		/* GPIO-1 reset second ATBM8830 */
+		cx23885_gpio_enable(dev, GPIO_0 | GPIO_1, 1);
+		cx23885_gpio_clear(dev, GPIO_0 | GPIO_1);
+		mdelay(100);
+		cx23885_gpio_set(dev, GPIO_0 | GPIO_1);
 		mdelay(100);
 		break;
 	case CX23885_BOARD_HAUPPAUGE_HVR1850:
+	case CX23885_BOARD_HAUPPAUGE_HVR1290:
 		/* GPIO-0 656_CLK */
 		/* GPIO-1 656_D0 */
 		/* GPIO-2 Wake# */
@@ -801,6 +888,7 @@ void cx23885_gpio_setup(struct cx23885_dev *dev)
 
 int cx23885_ir_init(struct cx23885_dev *dev)
 {
+	int ret = 0;
 	switch (dev->board) {
 	case CX23885_BOARD_HAUPPAUGE_HVR1250:
 	case CX23885_BOARD_HAUPPAUGE_HVR1500:
@@ -812,15 +900,46 @@ int cx23885_ir_init(struct cx23885_dev *dev)
 	case CX23885_BOARD_HAUPPAUGE_HVR1275:
 	case CX23885_BOARD_HAUPPAUGE_HVR1255:
 	case CX23885_BOARD_HAUPPAUGE_HVR1210:
-	case CX23885_BOARD_HAUPPAUGE_HVR1850:
 		/* FIXME: Implement me */
 		break;
+	case CX23885_BOARD_HAUPPAUGE_HVR1850:
+	case CX23885_BOARD_HAUPPAUGE_HVR1290:
+		ret = cx23888_ir_probe(dev);
+		if (ret)
+			break;
+		dev->sd_ir = cx23885_find_hw(dev, CX23885_HW_888_IR);
+		dev->pci_irqmask |= PCI_MSK_IR;
+		break;
 	case CX23885_BOARD_DVICO_FUSIONHDTV_DVB_T_DUAL_EXP:
 		request_module("ir-kbd-i2c");
 		break;
 	}
 
-	return 0;
+	return ret;
+}
+
+void cx23885_ir_fini(struct cx23885_dev *dev)
+{
+	switch (dev->board) {
+	case CX23885_BOARD_HAUPPAUGE_HVR1850:
+	case CX23885_BOARD_HAUPPAUGE_HVR1290:
+		dev->pci_irqmask &= ~PCI_MSK_IR;
+		cx_clear(PCI_INT_MSK, PCI_MSK_IR);
+		cx23888_ir_remove(dev);
+		dev->sd_ir = NULL;
+		break;
+	}
+}
+
+void cx23885_ir_pci_int_enable(struct cx23885_dev *dev)
+{
+	switch (dev->board) {
+	case CX23885_BOARD_HAUPPAUGE_HVR1850:
+	case CX23885_BOARD_HAUPPAUGE_HVR1290:
+		if (dev->sd_ir && (dev->pci_irqmask & PCI_MSK_IR))
+			cx_set(PCI_INT_MSK, PCI_MSK_IR);
+		break;
+	}
 }
 
 void cx23885_card_setup(struct cx23885_dev *dev)
@@ -853,6 +972,7 @@ void cx23885_card_setup(struct cx23885_dev *dev)
 	case CX23885_BOARD_HAUPPAUGE_HVR1255:
 	case CX23885_BOARD_HAUPPAUGE_HVR1210:
 	case CX23885_BOARD_HAUPPAUGE_HVR1850:
+	case CX23885_BOARD_HAUPPAUGE_HVR1290:
 		if (dev->i2c_bus[0].i2c_rc == 0)
 			hauppauge_eeprom(dev, eeprom+0xc0);
 		break;
@@ -886,8 +1006,12 @@ void cx23885_card_setup(struct cx23885_dev *dev)
 		ts2->ts_clk_en_val = 0x1; /* Enable TS_CLK */
 		ts2->src_sel_val   = CX23885_SRC_SEL_PARALLEL_MPEG_VIDEO;
 		break;
-	case CX23885_BOARD_TEVII_S470:
 	case CX23885_BOARD_TBS_6920:
+		ts1->gen_ctrl_val  = 0x4; /* Parallel */
+		ts1->ts_clk_en_val = 0x1; /* Enable TS_CLK */
+		ts1->src_sel_val   = CX23885_SRC_SEL_PARALLEL_MPEG_VIDEO;
+		break;
+	case CX23885_BOARD_TEVII_S470:
 	case CX23885_BOARD_DVBWORLD_2005:
 		ts1->gen_ctrl_val  = 0x5; /* Parallel */
 		ts1->ts_clk_en_val = 0x1; /* Enable TS_CLK */
@@ -907,6 +1031,14 @@ void cx23885_card_setup(struct cx23885_dev *dev)
 		ts1->ts_clk_en_val = 0x1; /* Enable TS_CLK */
 		ts1->src_sel_val   = CX23885_SRC_SEL_PARALLEL_MPEG_VIDEO;
 		break;
+	case CX23885_BOARD_MYGICA_X8558PRO:
+		ts1->gen_ctrl_val  = 0x5; /* Parallel */
+		ts1->ts_clk_en_val = 0x1; /* Enable TS_CLK */
+		ts1->src_sel_val   = CX23885_SRC_SEL_PARALLEL_MPEG_VIDEO;
+		ts2->gen_ctrl_val  = 0xc; /* Serial bus + punctured clock */
+		ts2->ts_clk_en_val = 0x1; /* Enable TS_CLK */
+		ts2->src_sel_val   = CX23885_SRC_SEL_PARALLEL_MPEG_VIDEO;
+		break;
 	case CX23885_BOARD_HAUPPAUGE_HVR1250:
 	case CX23885_BOARD_HAUPPAUGE_HVR1500:
 	case CX23885_BOARD_HAUPPAUGE_HVR1500Q:
@@ -922,6 +1054,7 @@ void cx23885_card_setup(struct cx23885_dev *dev)
 	case CX23885_BOARD_HAUPPAUGE_HVR1210:
 	case CX23885_BOARD_HAUPPAUGE_HVR1850:
 	case CX23885_BOARD_COMPRO_VIDEOMATE_E800:
+	case CX23885_BOARD_HAUPPAUGE_HVR1290:
 	default:
 		ts2->gen_ctrl_val  = 0xc; /* Serial bus + punctured clock */
 		ts2->ts_clk_en_val = 0x1; /* Enable TS_CLK */
@@ -939,6 +1072,10 @@ void cx23885_card_setup(struct cx23885_dev *dev)
 	case CX23885_BOARD_COMPRO_VIDEOMATE_E650F:
 	case CX23885_BOARD_NETUP_DUAL_DVBS2_CI:
 	case CX23885_BOARD_COMPRO_VIDEOMATE_E800:
+	case CX23885_BOARD_HAUPPAUGE_HVR1850:
+	case CX23885_BOARD_MYGICA_X8506:
+	case CX23885_BOARD_MAGICPRO_PROHDTVE2:
+	case CX23885_BOARD_HAUPPAUGE_HVR1290:
 		dev->sd_cx25840 = v4l2_i2c_new_subdev(&dev->v4l2_dev,
 				&dev->i2c_bus[2].i2c_adap,
 				"cx25840", "cx25840", 0x88 >> 1, NULL);
diff --git a/drivers/media/video/cx23885/cx23885-core.c b/drivers/media/video/cx23885/cx23885-core.c
index c31284ba19dd..0dde57e96d30 100644
--- a/drivers/media/video/cx23885/cx23885-core.c
+++ b/drivers/media/video/cx23885/cx23885-core.c
@@ -32,6 +32,9 @@
 
 #include "cx23885.h"
 #include "cimax2.h"
+#include "cx23888-ir.h"
+#include "cx23885-ir.h"
+#include "cx23885-input.h"
 
 MODULE_DESCRIPTION("Driver for cx23885 based TV cards");
 MODULE_AUTHOR("Steven Toth <stoth@linuxtv.org>");
@@ -52,9 +55,6 @@ MODULE_PARM_DESC(card, "card type");
 
 static unsigned int cx23885_devcount;
 
-static DEFINE_MUTEX(devlist);
-LIST_HEAD(cx23885_devlist);
-
 #define NO_SYNC_LINE (-1U)
 
 /* FIXME, these allocations will change when
@@ -753,6 +753,23 @@ static void cx23885_dev_checkrevision(struct cx23885_dev *dev)
 			__func__, dev->hwrevision);
 }
 
+/* Find the first v4l2_subdev member of the group id in hw */
+struct v4l2_subdev *cx23885_find_hw(struct cx23885_dev *dev, u32 hw)
+{
+	struct v4l2_subdev *result = NULL;
+	struct v4l2_subdev *sd;
+
+	spin_lock(&dev->v4l2_dev.lock);
+	v4l2_device_for_each_subdev(sd, &dev->v4l2_dev) {
+		if (sd->grp_id == hw) {
+			result = sd;
+			break;
+		}
+	}
+	spin_unlock(&dev->v4l2_dev.lock);
+	return result;
+}
+
 static int cx23885_dev_setup(struct cx23885_dev *dev)
 {
 	int i;
@@ -765,10 +782,6 @@ static int cx23885_dev_setup(struct cx23885_dev *dev)
 	dev->nr = cx23885_devcount++;
 	sprintf(dev->name, "cx23885[%d]", dev->nr);
 
-	mutex_lock(&devlist);
-	list_add_tail(&dev->devlist, &cx23885_devlist);
-	mutex_unlock(&devlist);
-
 	/* Configure the internal memory */
 	if (dev->pci->device == 0x8880) {
 		/* Could be 887 or 888, assume a default */
@@ -899,7 +912,7 @@ static int cx23885_dev_setup(struct cx23885_dev *dev)
 	cx23885_i2c_register(&dev->i2c_bus[1]);
 	cx23885_i2c_register(&dev->i2c_bus[2]);
 	cx23885_card_setup(dev);
-	call_all(dev, tuner, s_standby);
+	call_all(dev, core, s_power, 0);
 	cx23885_ir_init(dev);
 
 	if (cx23885_boards[dev->board].porta == CX23885_ANALOG_VIDEO) {
@@ -1637,6 +1650,7 @@ static irqreturn_t cx23885_irq(int irq, void *dev_id)
 	u32 ts1_status, ts1_mask;
 	u32 ts2_status, ts2_mask;
 	int vida_count = 0, ts1_count = 0, ts2_count = 0, handled = 0;
+	bool ir_handled = false;
 
 	pci_status = cx_read(PCI_INT_STAT);
 	pci_mask = cx_read(PCI_INT_MSK);
@@ -1662,18 +1676,12 @@ static irqreturn_t cx23885_irq(int irq, void *dev_id)
 	dprintk(7, "ts2_status: 0x%08x  ts2_mask: 0x%08x count: 0x%x\n",
 		ts2_status, ts2_mask, ts2_count);
 
-	if ((pci_status & PCI_MSK_RISC_RD) ||
-	    (pci_status & PCI_MSK_RISC_WR) ||
-	    (pci_status & PCI_MSK_AL_RD) ||
-	    (pci_status & PCI_MSK_AL_WR) ||
-	    (pci_status & PCI_MSK_APB_DMA) ||
-	    (pci_status & PCI_MSK_VID_C) ||
-	    (pci_status & PCI_MSK_VID_B) ||
-	    (pci_status & PCI_MSK_VID_A) ||
-	    (pci_status & PCI_MSK_AUD_INT) ||
-	    (pci_status & PCI_MSK_AUD_EXT) ||
-	    (pci_status & PCI_MSK_GPIO0) ||
-	    (pci_status & PCI_MSK_GPIO1)) {
+	if (pci_status & (PCI_MSK_RISC_RD | PCI_MSK_RISC_WR |
+			  PCI_MSK_AL_RD   | PCI_MSK_AL_WR   | PCI_MSK_APB_DMA |
+			  PCI_MSK_VID_C   | PCI_MSK_VID_B   | PCI_MSK_VID_A   |
+			  PCI_MSK_AUD_INT | PCI_MSK_AUD_EXT |
+			  PCI_MSK_GPIO0   | PCI_MSK_GPIO1   |
+			  PCI_MSK_IR)) {
 
 		if (pci_status & PCI_MSK_RISC_RD)
 			dprintk(7, " (PCI_MSK_RISC_RD   0x%08x)\n",
@@ -1722,6 +1730,10 @@ static irqreturn_t cx23885_irq(int irq, void *dev_id)
 		if (pci_status & PCI_MSK_GPIO1)
 			dprintk(7, " (PCI_MSK_GPIO1     0x%08x)\n",
 				PCI_MSK_GPIO1);
+
+		if (pci_status & PCI_MSK_IR)
+			dprintk(7, " (PCI_MSK_IR        0x%08x)\n",
+				PCI_MSK_IR);
 	}
 
 	if (cx23885_boards[dev->board].cimax > 0 &&
@@ -1752,12 +1764,48 @@ static irqreturn_t cx23885_irq(int irq, void *dev_id)
 	if (vida_status)
 		handled += cx23885_video_irq(dev, vida_status);
 
+	if (pci_status & PCI_MSK_IR) {
+		v4l2_subdev_call(dev->sd_ir, ir, interrupt_service_routine,
+				 pci_status, &ir_handled);
+		if (ir_handled)
+			handled++;
+	}
+
 	if (handled)
 		cx_write(PCI_INT_STAT, pci_status);
 out:
 	return IRQ_RETVAL(handled);
 }
 
+static void cx23885_v4l2_dev_notify(struct v4l2_subdev *sd,
+				    unsigned int notification, void *arg)
+{
+	struct cx23885_dev *dev;
+
+	if (sd == NULL)
+		return;
+
+	dev = to_cx23885(sd->v4l2_dev);
+
+	switch (notification) {
+	case V4L2_SUBDEV_IR_RX_NOTIFY: /* Called in an IRQ context */
+		if (sd == dev->sd_ir)
+			cx23885_ir_rx_v4l2_dev_notify(sd, *(u32 *)arg);
+		break;
+	case V4L2_SUBDEV_IR_TX_NOTIFY: /* Called in an IRQ context */
+		if (sd == dev->sd_ir)
+			cx23885_ir_tx_v4l2_dev_notify(sd, *(u32 *)arg);
+		break;
+	}
+}
+
+static void cx23885_v4l2_dev_notify_init(struct cx23885_dev *dev)
+{
+	INIT_WORK(&dev->ir_rx_work, cx23885_ir_rx_work_handler);
+	INIT_WORK(&dev->ir_tx_work, cx23885_ir_tx_work_handler);
+	dev->v4l2_dev.notify = cx23885_v4l2_dev_notify;
+}
+
 static inline int encoder_on_portb(struct cx23885_dev *dev)
 {
 	return cx23885_boards[dev->board].portb == CX23885_MPEG_ENCODER;
@@ -1816,6 +1864,26 @@ void cx23885_gpio_clear(struct cx23885_dev *dev, u32 mask)
 		printk(KERN_INFO "%s: Unsupported\n", dev->name);
 }
 
+u32 cx23885_gpio_get(struct cx23885_dev *dev, u32 mask)
+{
+	if (mask & 0x00000007)
+		return (cx_read(GP0_IO) >> 8) & mask & 0x7;
+
+	if (mask & 0x0007fff8) {
+		if (encoder_on_portb(dev) || encoder_on_portc(dev))
+			printk(KERN_ERR
+				"%s: Reading GPIO moving on encoder ports\n",
+				dev->name);
+		return (cx_read(MC417_RWD) & ((mask & 0x7fff8) >> 3)) << 3;
+	}
+
+	/* TODO: 23-19 */
+	if (mask & 0x00f80000)
+		printk(KERN_INFO "%s: Unsupported\n", dev->name);
+
+	return 0;
+}
+
 void cx23885_gpio_enable(struct cx23885_dev *dev, u32 mask, int asoutput)
 {
 	if ((mask & 0x00000007) && asoutput)
@@ -1854,6 +1922,9 @@ static int __devinit cx23885_initdev(struct pci_dev *pci_dev,
 	if (err < 0)
 		goto fail_free;
 
+	/* Prepare to handle notifications from subdevices */
+	cx23885_v4l2_dev_notify_init(dev);
+
 	/* pci init */
 	dev->pci = pci_dev;
 	if (pci_enable_device(pci_dev)) {
@@ -1896,6 +1967,14 @@ static int __devinit cx23885_initdev(struct pci_dev *pci_dev,
 		break;
 	}
 
+	/*
+	 * The CX2388[58] IR controller can start firing interrupts when
+	 * enabled, so these have to take place after the cx23885_irq() handler
+	 * is hooked up by the call to request_irq() above.
+	 */
+	cx23885_ir_pci_int_enable(dev);
+	cx23885_input_init(dev);
+
 	return 0;
 
 fail_irq:
@@ -1912,6 +1991,9 @@ static void __devexit cx23885_finidev(struct pci_dev *pci_dev)
 	struct v4l2_device *v4l2_dev = pci_get_drvdata(pci_dev);
 	struct cx23885_dev *dev = to_cx23885(v4l2_dev);
 
+	cx23885_input_fini(dev);
+	cx23885_ir_fini(dev);
+
 	cx23885_shutdown(dev);
 
 	pci_disable_device(pci_dev);
@@ -1919,10 +2001,6 @@ static void __devexit cx23885_finidev(struct pci_dev *pci_dev)
 	/* unregister stuff */
 	free_irq(pci_dev->irq, dev);
 
-	mutex_lock(&devlist);
-	list_del(&dev->devlist);
-	mutex_unlock(&devlist);
-
 	cx23885_dev_unregister(dev);
 	v4l2_device_unregister(v4l2_dev);
 	kfree(dev);
@@ -1957,7 +2035,7 @@ static struct pci_driver cx23885_pci_driver = {
 	.resume   = NULL,
 };
 
-static int cx23885_init(void)
+static int __init cx23885_init(void)
 {
 	printk(KERN_INFO "cx23885 driver version %d.%d.%d loaded\n",
 	       (CX23885_VERSION_CODE >> 16) & 0xff,
@@ -1970,7 +2048,7 @@ static int cx23885_init(void)
 	return pci_register_driver(&cx23885_pci_driver);
 }
 
-static void cx23885_fini(void)
+static void __exit cx23885_fini(void)
 {
 	pci_unregister_driver(&cx23885_pci_driver);
 }
diff --git a/drivers/media/video/cx23885/cx23885-dvb.c b/drivers/media/video/cx23885/cx23885-dvb.c
index 45e13ee66dc7..e45d2df08138 100644
--- a/drivers/media/video/cx23885/cx23885-dvb.c
+++ b/drivers/media/video/cx23885/cx23885-dvb.c
@@ -38,6 +38,7 @@
 #include "tda18271.h"
 #include "lgdt330x.h"
 #include "xc5000.h"
+#include "max2165.h"
 #include "tda10048.h"
 #include "tuner-xc2028.h"
 #include "tuner-simple.h"
@@ -54,6 +55,9 @@
 #include "netup-eeprom.h"
 #include "netup-init.h"
 #include "lgdt3305.h"
+#include "atbm8830.h"
+#include "ds3000.h"
+#include "cx23885-f300.h"
 
 static unsigned int debug;
 
@@ -400,6 +404,7 @@ static struct stv0900_reg stv0900_ts_regs[] = {
 
 static struct stv0900_config netup_stv0900_config = {
 	.demod_address = 0x68,
+	.demod_mode = 1, /* dual */
 	.xtal = 8000000,
 	.clkmode = 3,/* 0-CLKI, 2-XTALI, else AUTO */
 	.diseqc_mode = 2,/* 2/3 PWM */
@@ -414,34 +419,22 @@ static struct stv6110_config netup_stv6110_tunerconfig_a = {
 	.i2c_address = 0x60,
 	.mclk = 16000000,
 	.clk_div = 1,
+	.gain = 8, /* +16 dB  - maximum gain */
 };
 
 static struct stv6110_config netup_stv6110_tunerconfig_b = {
 	.i2c_address = 0x63,
 	.mclk = 16000000,
 	.clk_div = 1,
+	.gain = 8, /* +16 dB  - maximum gain */
 };
 
-static int tbs_set_voltage(struct dvb_frontend *fe, fe_sec_voltage_t voltage)
-{
-	struct cx23885_tsport *port = fe->dvb->priv;
-	struct cx23885_dev *dev = port->dev;
-
-	if (voltage == SEC_VOLTAGE_18)
-		cx_write(MC417_RWD, 0x00001e00);/* GPIO-13 high */
-	else if (voltage == SEC_VOLTAGE_13)
-		cx_write(MC417_RWD, 0x00001a00);/* GPIO-13 low */
-	else
-		cx_write(MC417_RWD, 0x00001800);/* GPIO-12 low */
-	return 0;
-}
-
 static struct cx24116_config tbs_cx24116_config = {
-	.demod_address = 0x05,
+	.demod_address = 0x55,
 };
 
-static struct cx24116_config tevii_cx24116_config = {
-	.demod_address = 0x55,
+static struct ds3000_config tevii_ds3000_config = {
+	.demod_address = 0x68,
 };
 
 static struct cx24116_config dvbworld_cx24116_config = {
@@ -486,11 +479,40 @@ static int cx23885_dvb_set_frontend(struct dvb_frontend *fe,
 			break;
 		}
 		break;
+	case CX23885_BOARD_MYGICA_X8506:
+	case CX23885_BOARD_MAGICPRO_PROHDTVE2:
+		/* Select Digital TV */
+		cx23885_gpio_set(dev, GPIO_0);
+		break;
 	}
-	return (port->set_frontend_save) ?
-		port->set_frontend_save(fe, param) : -ENODEV;
+	return 0;
 }
 
+static int cx23885_dvb_fe_ioctl_override(struct dvb_frontend *fe,
+					 unsigned int cmd, void *parg,
+					 unsigned int stage)
+{
+	int err = 0;
+
+	switch (stage) {
+	case DVB_FE_IOCTL_PRE:
+
+		switch (cmd) {
+		case FE_SET_FRONTEND:
+			err = cx23885_dvb_set_frontend(fe,
+				(struct dvb_frontend_parameters *) parg);
+			break;
+		}
+		break;
+
+	case DVB_FE_IOCTL_POST:
+		/* no post-ioctl handling required */
+		break;
+	}
+	return err;
+};
+
+
 static struct lgs8gxx_config magicpro_prohdtve2_lgs8g75_config = {
 	.prod = LGS8GXX_PROD_LGS8G75,
 	.demod_address = 0x19,
@@ -511,6 +533,38 @@ static struct xc5000_config magicpro_prohdtve2_xc5000_config = {
 	.if_khz = 6500,
 };
 
+static struct atbm8830_config mygica_x8558pro_atbm8830_cfg1 = {
+	.prod = ATBM8830_PROD_8830,
+	.demod_address = 0x44,
+	.serial_ts = 0,
+	.ts_sampling_edge = 1,
+	.ts_clk_gated = 0,
+	.osc_clk_freq = 30400, /* in kHz */
+	.if_freq = 0, /* zero IF */
+	.zif_swap_iq = 1,
+};
+
+static struct max2165_config mygic_x8558pro_max2165_cfg1 = {
+	.i2c_address = 0x60,
+	.osc_clk = 20
+};
+
+static struct atbm8830_config mygica_x8558pro_atbm8830_cfg2 = {
+	.prod = ATBM8830_PROD_8830,
+	.demod_address = 0x44,
+	.serial_ts = 1,
+	.ts_sampling_edge = 1,
+	.ts_clk_gated = 0,
+	.osc_clk_freq = 30400, /* in kHz */
+	.if_freq = 0, /* zero IF */
+	.zif_swap_iq = 1,
+};
+
+static struct max2165_config mygic_x8558pro_max2165_cfg2 = {
+	.i2c_address = 0x60,
+	.osc_clk = 20
+};
+
 static int dvb_register(struct cx23885_tsport *port)
 {
 	struct cx23885_dev *dev = port->dev;
@@ -550,12 +604,6 @@ static int dvb_register(struct cx23885_tsport *port)
 				   0x60, &dev->i2c_bus[1].i2c_adap,
 				   &hauppauge_hvr127x_config);
 		}
-
-		/* FIXME: temporary hack */
-		/* define bridge override to set_frontend */
-		port->set_frontend_save = fe0->dvb.frontend->ops.set_frontend;
-		fe0->dvb.frontend->ops.set_frontend = cx23885_dvb_set_frontend;
-
 		break;
 	case CX23885_BOARD_HAUPPAUGE_HVR1255:
 		i2c_bus = &dev->i2c_bus[0];
@@ -772,23 +820,23 @@ static int dvb_register(struct cx23885_tsport *port)
 		}
 		break;
 	case CX23885_BOARD_TBS_6920:
-		i2c_bus = &dev->i2c_bus[0];
+		i2c_bus = &dev->i2c_bus[1];
 
 		fe0->dvb.frontend = dvb_attach(cx24116_attach,
-			&tbs_cx24116_config,
-			&i2c_bus->i2c_adap);
+					&tbs_cx24116_config,
+					&i2c_bus->i2c_adap);
 		if (fe0->dvb.frontend != NULL)
-			fe0->dvb.frontend->ops.set_voltage = tbs_set_voltage;
+			fe0->dvb.frontend->ops.set_voltage = f300_set_voltage;
 
 		break;
 	case CX23885_BOARD_TEVII_S470:
 		i2c_bus = &dev->i2c_bus[1];
 
-		fe0->dvb.frontend = dvb_attach(cx24116_attach,
-			&tevii_cx24116_config,
-			&i2c_bus->i2c_adap);
+		fe0->dvb.frontend = dvb_attach(ds3000_attach,
+					&tevii_ds3000_config,
+					&i2c_bus->i2c_adap);
 		if (fe0->dvb.frontend != NULL)
-			fe0->dvb.frontend->ops.set_voltage = tbs_set_voltage;
+			fe0->dvb.frontend->ops.set_voltage = f300_set_voltage;
 
 		break;
 	case CX23885_BOARD_DVBWORLD_2005:
@@ -814,8 +862,8 @@ static int dvb_register(struct cx23885_tsport *port)
 					if (!dvb_attach(lnbh24_attach,
 							fe0->dvb.frontend,
 							&i2c_bus->i2c_adap,
-							LNBH24_PCL,
-							LNBH24_TTX, 0x09))
+							LNBH24_PCL | LNBH24_TTX,
+							LNBH24_TEN, 0x09))
 						printk(KERN_ERR
 							"No LNBH24 found!\n");
 
@@ -835,8 +883,8 @@ static int dvb_register(struct cx23885_tsport *port)
 					if (!dvb_attach(lnbh24_attach,
 							fe0->dvb.frontend,
 							&i2c_bus->i2c_adap,
-							LNBH24_PCL,
-							LNBH24_TTX, 0x0a))
+							LNBH24_PCL | LNBH24_TTX,
+							LNBH24_TEN, 0x0a))
 						printk(KERN_ERR
 							"No LNBH24 found!\n");
 
@@ -872,6 +920,7 @@ static int dvb_register(struct cx23885_tsport *port)
 		}
 		break;
 	case CX23885_BOARD_HAUPPAUGE_HVR1850:
+	case CX23885_BOARD_HAUPPAUGE_HVR1290:
 		i2c_bus = &dev->i2c_bus[0];
 		fe0->dvb.frontend = dvb_attach(s5h1411_attach,
 			&hcw_s5h1411_config,
@@ -881,6 +930,36 @@ static int dvb_register(struct cx23885_tsport *port)
 				0x60, &dev->i2c_bus[0].i2c_adap,
 				&hauppauge_tda18271_config);
 		break;
+	case CX23885_BOARD_MYGICA_X8558PRO:
+		switch (port->nr) {
+		/* port B */
+		case 1:
+			i2c_bus = &dev->i2c_bus[0];
+			fe0->dvb.frontend = dvb_attach(atbm8830_attach,
+				&mygica_x8558pro_atbm8830_cfg1,
+				&i2c_bus->i2c_adap);
+			if (fe0->dvb.frontend != NULL) {
+				dvb_attach(max2165_attach,
+					fe0->dvb.frontend,
+					&i2c_bus->i2c_adap,
+					&mygic_x8558pro_max2165_cfg1);
+			}
+			break;
+		/* port C */
+		case 2:
+			i2c_bus = &dev->i2c_bus[1];
+			fe0->dvb.frontend = dvb_attach(atbm8830_attach,
+				&mygica_x8558pro_atbm8830_cfg2,
+				&i2c_bus->i2c_adap);
+			if (fe0->dvb.frontend != NULL) {
+				dvb_attach(max2165_attach,
+					fe0->dvb.frontend,
+					&i2c_bus->i2c_adap,
+					&mygic_x8558pro_max2165_cfg2);
+			}
+			break;
+		}
+		break;
 
 	default:
 		printk(KERN_INFO "%s: The frontend of your DVB/ATSC card "
@@ -897,14 +976,15 @@ static int dvb_register(struct cx23885_tsport *port)
 	fe0->dvb.frontend->callback = cx23885_tuner_callback;
 
 	/* Put the analog decoder in standby to keep it quiet */
-	call_all(dev, tuner, s_standby);
+	call_all(dev, core, s_power, 0);
 
 	if (fe0->dvb.frontend->ops.analog_ops.standby)
 		fe0->dvb.frontend->ops.analog_ops.standby(fe0->dvb.frontend);
 
 	/* register everything */
 	ret = videobuf_dvb_register_bus(&port->frontends, THIS_MODULE, port,
-		&dev->pci->dev, adapter_nr, 0);
+					&dev->pci->dev, adapter_nr, 0,
+					cx23885_dvb_fe_ioctl_override);
 
 	/* init CI & MAC */
 	switch (dev->board) {
@@ -940,7 +1020,7 @@ int cx23885_dvb_register(struct cx23885_tsport *port)
 	int err, i;
 
 	/* Here we need to allocate the correct number of frontends,
-	 * as reflected in the cards struct. The reality is that currrently
+	 * as reflected in the cards struct. The reality is that currently
 	 * no cx23885 boards support this - yet. But, if we don't modify this
 	 * code then the second frontend would never be allocated (later)
 	 * and fail with error before the attach in dvb_register().
diff --git a/drivers/media/video/cx23885/cx23885-f300.c b/drivers/media/video/cx23885/cx23885-f300.c
new file mode 100644
index 000000000000..93998f220986
--- /dev/null
+++ b/drivers/media/video/cx23885/cx23885-f300.c
@@ -0,0 +1,177 @@
+/*
+ * Driver for Silicon Labs C8051F300 microcontroller.
+ *
+ * It is used for LNB power control in TeVii S470,
+ * TBS 6920 PCIe DVB-S2 cards.
+ *
+ * Microcontroller connected to cx23885 GPIO pins:
+ * GPIO0 - data		- P0.3 F300
+ * GPIO1 - reset	- P0.2 F300
+ * GPIO2 - clk		- P0.1 F300
+ * GPIO3 - busy		- P0.0 F300
+ *
+ * Copyright (C) 2009 Igor M. Liplianin <liplianin@me.by>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include "cx23885.h"
+
+#define F300_DATA	GPIO_0
+#define F300_RESET	GPIO_1
+#define F300_CLK	GPIO_2
+#define F300_BUSY	GPIO_3
+
+static void f300_set_line(struct cx23885_dev *dev, u32 line, u8 lvl)
+{
+	cx23885_gpio_enable(dev, line, 1);
+	if (lvl == 1)
+		cx23885_gpio_set(dev, line);
+	else
+		cx23885_gpio_clear(dev, line);
+}
+
+static u8 f300_get_line(struct cx23885_dev *dev, u32 line)
+{
+	cx23885_gpio_enable(dev, line, 0);
+
+	return cx23885_gpio_get(dev, line);
+}
+
+static void f300_send_byte(struct cx23885_dev *dev, u8 dta)
+{
+	u8 i;
+
+	for (i = 0; i < 8; i++) {
+		f300_set_line(dev, F300_CLK, 0);
+		udelay(30);
+		f300_set_line(dev, F300_DATA, (dta & 0x80) >> 7);/* msb first */
+		udelay(30);
+		dta <<= 1;
+		f300_set_line(dev, F300_CLK, 1);
+		udelay(30);
+	}
+}
+
+static u8 f300_get_byte(struct cx23885_dev *dev)
+{
+	u8 i, dta = 0;
+
+	for (i = 0; i < 8; i++) {
+		f300_set_line(dev, F300_CLK, 0);
+		udelay(30);
+		dta <<= 1;
+		f300_set_line(dev, F300_CLK, 1);
+		udelay(30);
+		dta |= f300_get_line(dev, F300_DATA);/* msb first */
+
+	}
+
+	return dta;
+}
+
+static u8 f300_xfer(struct dvb_frontend *fe, u8 *buf)
+{
+	struct cx23885_tsport *port = fe->dvb->priv;
+	struct cx23885_dev *dev = port->dev;
+	u8 i, temp, ret = 0;
+
+	temp = buf[0];
+	for (i = 0; i < buf[0]; i++)
+		temp += buf[i + 1];
+	temp = (~temp + 1);/* get check sum */
+	buf[1 + buf[0]] = temp;
+
+	f300_set_line(dev, F300_RESET, 1);
+	f300_set_line(dev, F300_CLK, 1);
+	udelay(30);
+	f300_set_line(dev, F300_DATA, 1);
+	msleep(1);
+
+	/* question: */
+	f300_set_line(dev, F300_RESET, 0);/* begin to send data */
+	msleep(1);
+
+	f300_send_byte(dev, 0xe0);/* the slave address is 0xe0, write */
+	msleep(1);
+
+	temp = buf[0];
+	temp += 2;
+	for (i = 0; i < temp; i++)
+		f300_send_byte(dev, buf[i]);
+
+	f300_set_line(dev, F300_RESET, 1);/* sent data over */
+	f300_set_line(dev, F300_DATA, 1);
+
+	/* answer: */
+	temp = 0;
+	for (i = 0; ((i < 8) & (temp == 0)); i++) {
+		msleep(1);
+		if (f300_get_line(dev, F300_BUSY) == 0)
+			temp = 1;
+	}
+
+	if (i > 7) {
+		printk(KERN_ERR "%s: timeout, the slave no response\n",
+								__func__);
+		ret = 1; /* timeout, the slave no response */
+	} else { /* the slave not busy, prepare for getting data */
+		f300_set_line(dev, F300_RESET, 0);/*ready...*/
+		msleep(1);
+		f300_send_byte(dev, 0xe1);/* 0xe1 is Read */
+		msleep(1);
+		temp = f300_get_byte(dev);/*get the data length */
+		if (temp > 14)
+			temp = 14;
+
+		for (i = 0; i < (temp + 1); i++)
+			f300_get_byte(dev);/* get data to empty buffer */
+
+		f300_set_line(dev, F300_RESET, 1);/* received data over */
+		f300_set_line(dev, F300_DATA, 1);
+	}
+
+	return ret;
+}
+
+int f300_set_voltage(struct dvb_frontend *fe, fe_sec_voltage_t voltage)
+{
+	u8 buf[16];
+
+	buf[0] = 0x05;
+	buf[1] = 0x38;/* write port */
+	buf[2] = 0x01;/* A port, lnb power */
+
+	switch (voltage) {
+	case SEC_VOLTAGE_13:
+		buf[3] = 0x01;/* power on */
+		buf[4] = 0x02;/* B port, H/V */
+		buf[5] = 0x00;/*13V v*/
+		break;
+	case SEC_VOLTAGE_18:
+		buf[3] = 0x01;
+		buf[4] = 0x02;
+		buf[5] = 0x01;/* 18V h*/
+		break;
+	case SEC_VOLTAGE_OFF:
+		buf[3] = 0x00;/* power off */
+		buf[4] = 0x00;
+		buf[5] = 0x00;
+		break;
+	}
+
+	return f300_xfer(fe, buf);
+}
diff --git a/drivers/media/video/cx23885/cx23885-f300.h b/drivers/media/video/cx23885/cx23885-f300.h
new file mode 100644
index 000000000000..e73344c94963
--- /dev/null
+++ b/drivers/media/video/cx23885/cx23885-f300.h
@@ -0,0 +1,2 @@
+extern int f300_set_voltage(struct dvb_frontend *fe,
+				fe_sec_voltage_t voltage);
diff --git a/drivers/media/video/cx23885/cx23885-input.c b/drivers/media/video/cx23885/cx23885-input.c
new file mode 100644
index 000000000000..768eec92ccf9
--- /dev/null
+++ b/drivers/media/video/cx23885/cx23885-input.c
@@ -0,0 +1,424 @@
+/*
+ *  Driver for the Conexant CX23885/7/8 PCIe bridge
+ *
+ *  Infrared remote control input device
+ *
+ *  Most of this file is
+ *
+ *  Copyright (C) 2009  Andy Walls <awalls@radix.net>
+ *
+ *  However, the cx23885_input_{init,fini} functions contained herein are
+ *  derived from Linux kernel files linux/media/video/.../...-input.c marked as:
+ *
+ *  Copyright (C) 2008 <srinivasa.deevi at conexant dot com>
+ *  Copyright (C) 2005 Ludovico Cavedon <cavedon@sssup.it>
+ *		       Markus Rechberger <mrechberger@gmail.com>
+ *		       Mauro Carvalho Chehab <mchehab@infradead.org>
+ *		       Sascha Sommer <saschasommer@freenet.de>
+ *  Copyright (C) 2004, 2005 Chris Pascoe
+ *  Copyright (C) 2003, 2004 Gerd Knorr
+ *  Copyright (C) 2003 Pavel Machek
+ *
+ *  This program is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU General Public License
+ *  as published by the Free Software Foundation; either version 2
+ *  of the License, or (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ *  02110-1301, USA.
+ */
+
+#include <linux/input.h>
+#include <media/ir-common.h>
+#include <media/v4l2-subdev.h>
+
+#include "cx23885.h"
+
+#define RC5_BITS		14
+#define RC5_HALF_BITS		(2*RC5_BITS)
+#define RC5_HALF_BITS_MASK	((1 << RC5_HALF_BITS) - 1)
+
+#define RC5_START_BITS_NORMAL	0x3 /* Command range  0 -  63 */
+#define RC5_START_BITS_EXTENDED	0x2 /* Command range 64 - 127 */
+
+#define RC5_EXTENDED_COMMAND_OFFSET	64
+
+static inline unsigned int rc5_command(u32 rc5_baseband)
+{
+	return RC5_INSTR(rc5_baseband) +
+		((RC5_START(rc5_baseband) == RC5_START_BITS_EXTENDED)
+			? RC5_EXTENDED_COMMAND_OFFSET : 0);
+}
+
+static void cx23885_input_process_raw_rc5(struct cx23885_dev *dev)
+{
+	struct card_ir *ir_input = dev->ir_input;
+	unsigned int code, command;
+	u32 rc5;
+
+	/* Ignore codes that are too short to be valid RC-5 */
+	if (ir_input->last_bit < (RC5_HALF_BITS - 1))
+		return;
+
+	/* The library has the manchester coding backwards; XOR to adapt. */
+	code = (ir_input->code & RC5_HALF_BITS_MASK) ^ RC5_HALF_BITS_MASK;
+	rc5 = ir_rc5_decode(code);
+
+	switch (RC5_START(rc5)) {
+	case RC5_START_BITS_NORMAL:
+		break;
+	case RC5_START_BITS_EXTENDED:
+		/* Don't allow if the remote only emits standard commands */
+		if (ir_input->start == RC5_START_BITS_NORMAL)
+			return;
+		break;
+	default:
+		return;
+	}
+
+	if (ir_input->addr != RC5_ADDR(rc5))
+		return;
+
+	/* Don't generate a keypress for RC-5 auto-repeated keypresses */
+	command = rc5_command(rc5);
+	if (RC5_TOGGLE(rc5) != RC5_TOGGLE(ir_input->last_rc5) ||
+	    command != rc5_command(ir_input->last_rc5) ||
+	    /* Catch T == 0, CMD == 0 (e.g. '0') as first keypress after init */
+	    RC5_START(ir_input->last_rc5) == 0) {
+		/* This keypress is differnet: not an auto repeat */
+		ir_input_nokey(ir_input->dev, &ir_input->ir);
+		ir_input_keydown(ir_input->dev, &ir_input->ir, command);
+	}
+	ir_input->last_rc5 = rc5;
+
+	/* Schedule when we should do the key up event: ir_input_nokey() */
+	mod_timer(&ir_input->timer_keyup,
+		  jiffies + msecs_to_jiffies(ir_input->rc5_key_timeout));
+}
+
+static void cx23885_input_next_pulse_width_rc5(struct cx23885_dev *dev,
+					       u32 ns_pulse)
+{
+	const int rc5_quarterbit_ns = 444444; /* 32 cycles/36 kHz/2 = 444 us */
+	struct card_ir *ir_input = dev->ir_input;
+	int i, level, quarterbits, halfbits;
+
+	if (!ir_input->active) {
+		ir_input->active = 1;
+		/* assume an initial space that we may not detect or measure */
+		ir_input->code = 0;
+		ir_input->last_bit = 0;
+	}
+
+	if (ns_pulse == V4L2_SUBDEV_IR_PULSE_RX_SEQ_END) {
+		ir_input->last_bit++; /* Account for the final space */
+		ir_input->active = 0;
+		cx23885_input_process_raw_rc5(dev);
+		return;
+	}
+
+	level = (ns_pulse & V4L2_SUBDEV_IR_PULSE_LEVEL_MASK) ? 1 : 0;
+
+	/* Skip any leading space to sync to the start bit */
+	if (ir_input->last_bit == 0 && level == 0)
+		return;
+
+	/*
+	 * With valid RC-5 we can get up to two consecutive half-bits in a
+	 * single pulse measurment.  Experiments have shown that the duration
+	 * of a half-bit can vary.  Make sure we always end up with an even
+	 * number of quarter bits at the same level (mark or space).
+	 */
+	ns_pulse &= V4L2_SUBDEV_IR_PULSE_MAX_WIDTH_NS;
+	quarterbits = ns_pulse / rc5_quarterbit_ns;
+	if (quarterbits & 1)
+		quarterbits++;
+	halfbits = quarterbits / 2;
+
+	for (i = 0; i < halfbits; i++) {
+		ir_input->last_bit++;
+		ir_input->code |= (level << ir_input->last_bit);
+
+		if (ir_input->last_bit >= RC5_HALF_BITS-1) {
+			ir_input->active = 0;
+			cx23885_input_process_raw_rc5(dev);
+			/*
+			 * If level is 1, a leading mark is invalid for RC5.
+			 * If level is 0, we scan past extra intial space.
+			 * Either way we don't want to reactivate collecting
+			 * marks or spaces here with any left over half-bits.
+			 */
+			break;
+		}
+	}
+}
+
+static void cx23885_input_process_pulse_widths_rc5(struct cx23885_dev *dev,
+						   bool add_eom)
+{
+	struct card_ir *ir_input = dev->ir_input;
+	struct ir_input_state *ir_input_state = &ir_input->ir;
+
+	u32 ns_pulse[RC5_HALF_BITS+1];
+	ssize_t num = 0;
+	int count, i;
+
+	do {
+		v4l2_subdev_call(dev->sd_ir, ir, rx_read, (u8 *) ns_pulse,
+				 sizeof(ns_pulse), &num);
+
+		count = num / sizeof(u32);
+
+		/* Append an end of Rx seq, if the caller requested */
+		if (add_eom && count < ARRAY_SIZE(ns_pulse)) {
+			ns_pulse[count] = V4L2_SUBDEV_IR_PULSE_RX_SEQ_END;
+			count++;
+		}
+
+		/* Just drain the Rx FIFO, if we're called, but not RC-5 */
+		if (ir_input_state->ir_type != IR_TYPE_RC5)
+			continue;
+
+		for (i = 0; i < count; i++)
+			cx23885_input_next_pulse_width_rc5(dev, ns_pulse[i]);
+	} while (num != 0);
+}
+
+void cx23885_input_rx_work_handler(struct cx23885_dev *dev, u32 events)
+{
+	struct v4l2_subdev_ir_parameters params;
+	int overrun, data_available;
+
+	if (dev->sd_ir == NULL || events == 0)
+		return;
+
+	switch (dev->board) {
+	case CX23885_BOARD_HAUPPAUGE_HVR1850:
+	case CX23885_BOARD_HAUPPAUGE_HVR1290:
+		/*
+		 * The only board we handle right now.  However other boards
+		 * using the CX2388x integrated IR controller should be similar
+		 */
+		break;
+	default:
+		return;
+	}
+
+	overrun = events & (V4L2_SUBDEV_IR_RX_SW_FIFO_OVERRUN |
+			    V4L2_SUBDEV_IR_RX_HW_FIFO_OVERRUN);
+
+	data_available = events & (V4L2_SUBDEV_IR_RX_END_OF_RX_DETECTED |
+				   V4L2_SUBDEV_IR_RX_FIFO_SERVICE_REQ);
+
+	if (overrun) {
+		/* If there was a FIFO overrun, stop the device */
+		v4l2_subdev_call(dev->sd_ir, ir, rx_g_parameters, &params);
+		params.enable = false;
+		/* Mitigate race with cx23885_input_ir_stop() */
+		params.shutdown = atomic_read(&dev->ir_input_stopping);
+		v4l2_subdev_call(dev->sd_ir, ir, rx_s_parameters, &params);
+	}
+
+	if (data_available)
+		cx23885_input_process_pulse_widths_rc5(dev, overrun);
+
+	if (overrun) {
+		/* If there was a FIFO overrun, clear & restart the device */
+		params.enable = true;
+		/* Mitigate race with cx23885_input_ir_stop() */
+		params.shutdown = atomic_read(&dev->ir_input_stopping);
+		v4l2_subdev_call(dev->sd_ir, ir, rx_s_parameters, &params);
+	}
+}
+
+static void cx23885_input_ir_start(struct cx23885_dev *dev)
+{
+	struct card_ir *ir_input = dev->ir_input;
+	struct ir_input_state *ir_input_state = &ir_input->ir;
+	struct v4l2_subdev_ir_parameters params;
+
+	if (dev->sd_ir == NULL)
+		return;
+
+	atomic_set(&dev->ir_input_stopping, 0);
+
+	/* keyup timer set up, if needed */
+	switch (dev->board) {
+	case CX23885_BOARD_HAUPPAUGE_HVR1850:
+	case CX23885_BOARD_HAUPPAUGE_HVR1290:
+		setup_timer(&ir_input->timer_keyup,
+			    ir_rc5_timer_keyup,	/* Not actually RC-5 specific */
+			    (unsigned long) ir_input);
+		if (ir_input_state->ir_type == IR_TYPE_RC5) {
+			/*
+			 * RC-5 repeats a held key every
+			 * 64 bits * (2 * 32/36000) sec/bit = 113.778 ms
+			 */
+			ir_input->rc5_key_timeout = 115;
+		}
+		break;
+	}
+
+	v4l2_subdev_call(dev->sd_ir, ir, rx_g_parameters, &params);
+	switch (dev->board) {
+	case CX23885_BOARD_HAUPPAUGE_HVR1850:
+	case CX23885_BOARD_HAUPPAUGE_HVR1290:
+		/*
+		 * The IR controller on this board only returns pulse widths.
+		 * Any other mode setting will fail to set up the device.
+		*/
+		params.mode = V4L2_SUBDEV_IR_MODE_PULSE_WIDTH;
+		params.enable = true;
+		params.interrupt_enable = true;
+		params.shutdown = false;
+
+		/* Setup for baseband compatible with both RC-5 and RC-6A */
+		params.modulation = false;
+		/* RC-5:  2,222,222 ns = 1/36 kHz * 32 cycles * 2 marks * 1.25*/
+		/* RC-6A: 3,333,333 ns = 1/36 kHz * 16 cycles * 6 marks * 1.25*/
+		params.max_pulse_width = 3333333; /* ns */
+		/* RC-5:    666,667 ns = 1/36 kHz * 32 cycles * 1 mark * 0.75 */
+		/* RC-6A:   333,333 ns = 1/36 kHz * 16 cycles * 1 mark * 0.75 */
+		params.noise_filter_min_width = 333333; /* ns */
+		/*
+		 * This board has inverted receive sense:
+		 * mark is received as low logic level;
+		 * falling edges are detected as rising edges; etc.
+		 */
+		params.invert = true;
+		break;
+	}
+	v4l2_subdev_call(dev->sd_ir, ir, rx_s_parameters, &params);
+}
+
+static void cx23885_input_ir_stop(struct cx23885_dev *dev)
+{
+	struct card_ir *ir_input = dev->ir_input;
+	struct v4l2_subdev_ir_parameters params;
+
+	if (dev->sd_ir == NULL)
+		return;
+
+	/*
+	 * Stop the sd_ir subdevice from generating notifications and
+	 * scheduling work.
+	 * It is shutdown this way in order to mitigate a race with
+	 * cx23885_input_rx_work_handler() in the overrun case, which could
+	 * re-enable the subdevice.
+	 */
+	atomic_set(&dev->ir_input_stopping, 1);
+	v4l2_subdev_call(dev->sd_ir, ir, rx_g_parameters, &params);
+	while (params.shutdown == false) {
+		params.enable = false;
+		params.interrupt_enable = false;
+		params.shutdown = true;
+		v4l2_subdev_call(dev->sd_ir, ir, rx_s_parameters, &params);
+		v4l2_subdev_call(dev->sd_ir, ir, rx_g_parameters, &params);
+	}
+
+	flush_scheduled_work();
+
+	switch (dev->board) {
+	case CX23885_BOARD_HAUPPAUGE_HVR1850:
+	case CX23885_BOARD_HAUPPAUGE_HVR1290:
+		del_timer_sync(&ir_input->timer_keyup);
+		break;
+	}
+}
+
+int cx23885_input_init(struct cx23885_dev *dev)
+{
+	struct card_ir *ir;
+	struct input_dev *input_dev;
+	struct ir_scancode_table *ir_codes = NULL;
+	int ir_type, ir_addr, ir_start;
+	int ret;
+
+	/*
+	 * If the IR device (hardware registers, chip, GPIO lines, etc.) isn't
+	 * encapsulated in a v4l2_subdev, then I'm not going to deal with it.
+	 */
+	if (dev->sd_ir == NULL)
+		return -ENODEV;
+
+	switch (dev->board) {
+	case CX23885_BOARD_HAUPPAUGE_HVR1850:
+	case CX23885_BOARD_HAUPPAUGE_HVR1290:
+		/* Parameters for the grey Hauppauge remote for the HVR-1850 */
+		ir_codes = &ir_codes_hauppauge_new_table;
+		ir_type = IR_TYPE_RC5;
+		ir_addr = 0x1e; /* RC-5 system bits emitted by the remote */
+		ir_start = RC5_START_BITS_NORMAL; /* A basic RC-5 remote */
+		break;
+	}
+	if (ir_codes == NULL)
+		return -ENODEV;
+
+	ir = kzalloc(sizeof(*ir), GFP_KERNEL);
+	input_dev = input_allocate_device();
+	if (!ir || !input_dev) {
+		ret = -ENOMEM;
+		goto err_out_free;
+	}
+
+	ir->dev = input_dev;
+	ir->addr = ir_addr;
+	ir->start = ir_start;
+
+	/* init input device */
+	snprintf(ir->name, sizeof(ir->name), "cx23885 IR (%s)",
+		 cx23885_boards[dev->board].name);
+	snprintf(ir->phys, sizeof(ir->phys), "pci-%s/ir0", pci_name(dev->pci));
+
+	ret = ir_input_init(input_dev, &ir->ir, ir_type);
+	if (ret < 0)
+		goto err_out_free;
+
+	input_dev->name = ir->name;
+	input_dev->phys = ir->phys;
+	input_dev->id.bustype = BUS_PCI;
+	input_dev->id.version = 1;
+	if (dev->pci->subsystem_vendor) {
+		input_dev->id.vendor  = dev->pci->subsystem_vendor;
+		input_dev->id.product = dev->pci->subsystem_device;
+	} else {
+		input_dev->id.vendor  = dev->pci->vendor;
+		input_dev->id.product = dev->pci->device;
+	}
+	input_dev->dev.parent = &dev->pci->dev;
+
+	dev->ir_input = ir;
+	cx23885_input_ir_start(dev);
+
+	ret = ir_input_register(ir->dev, ir_codes);
+	if (ret)
+		goto err_out_stop;
+
+	return 0;
+
+err_out_stop:
+	cx23885_input_ir_stop(dev);
+	dev->ir_input = NULL;
+err_out_free:
+	kfree(ir);
+	return ret;
+}
+
+void cx23885_input_fini(struct cx23885_dev *dev)
+{
+	/* Always stop the IR hardware from generating interrupts */
+	cx23885_input_ir_stop(dev);
+
+	if (dev->ir_input == NULL)
+		return;
+	ir_input_unregister(dev->ir_input->dev);
+	kfree(dev->ir_input);
+	dev->ir_input = NULL;
+}
diff --git a/drivers/media/video/cx23885/cx23885-input.h b/drivers/media/video/cx23885/cx23885-input.h
new file mode 100644
index 000000000000..3572cb1ecfc2
--- /dev/null
+++ b/drivers/media/video/cx23885/cx23885-input.h
@@ -0,0 +1,30 @@
+/*
+ *  Driver for the Conexant CX23885/7/8 PCIe bridge
+ *
+ *  Infrared remote control input device
+ *
+ *  Copyright (C) 2009  Andy Walls <awalls@radix.net>
+ *
+ *  This program is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU General Public License
+ *  as published by the Free Software Foundation; either version 2
+ *  of the License, or (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ *  02110-1301, USA.
+ */
+
+#ifndef _CX23885_INPUT_H_
+#define _CX23885_INPUT_H_
+int cx23885_input_rx_work_handler(struct cx23885_dev *dev, u32 events);
+
+int cx23885_input_init(struct cx23885_dev *dev);
+void cx23885_input_fini(struct cx23885_dev *dev);
+#endif
diff --git a/drivers/media/video/cx23885/cx23885-ioctl.c b/drivers/media/video/cx23885/cx23885-ioctl.c
new file mode 100644
index 000000000000..dfb4627fb340
--- /dev/null
+++ b/drivers/media/video/cx23885/cx23885-ioctl.c
@@ -0,0 +1,208 @@
+/*
+ *  Driver for the Conexant CX23885/7/8 PCIe bridge
+ *
+ *  Various common ioctl() support functions
+ *
+ *  Copyright (c) 2009 Andy Walls <awalls@radix.net>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include "cx23885.h"
+#include <media/v4l2-chip-ident.h>
+
+int cx23885_g_chip_ident(struct file *file, void *fh,
+			 struct v4l2_dbg_chip_ident *chip)
+{
+	struct cx23885_dev *dev = ((struct cx23885_fh *)fh)->dev;
+	int err = 0;
+	u8 rev;
+
+	chip->ident = V4L2_IDENT_NONE;
+	chip->revision = 0;
+	switch (chip->match.type) {
+	case V4L2_CHIP_MATCH_HOST:
+		switch (chip->match.addr) {
+		case 0:
+			rev = cx_read(RDR_CFG2) & 0xff;
+			switch (dev->pci->device) {
+			case 0x8852:
+				/* rev 0x04 could be '885 or '888. Pick '888. */
+				if (rev == 0x04)
+					chip->ident = V4L2_IDENT_CX23888;
+				else
+					chip->ident = V4L2_IDENT_CX23885;
+				break;
+			case 0x8880:
+				if (rev == 0x0e || rev == 0x0f)
+					chip->ident = V4L2_IDENT_CX23887;
+				else
+					chip->ident = V4L2_IDENT_CX23888;
+				break;
+			default:
+				chip->ident = V4L2_IDENT_UNKNOWN;
+				break;
+			}
+			chip->revision = (dev->pci->device << 16) | (rev << 8) |
+					 (dev->hwrevision & 0xff);
+			break;
+		case 1:
+			if (dev->v4l_device != NULL) {
+				chip->ident = V4L2_IDENT_CX23417;
+				chip->revision = 0;
+			}
+			break;
+		case 2:
+			/*
+			 * The integrated IR controller on the CX23888 is
+			 * host chip 2.  It may not be used/initialized or sd_ir
+			 * may be pointing at the cx25840 subdevice for the
+			 * IR controller on the CX23885.  Thus we find it
+			 * without using the dev->sd_ir pointer.
+			 */
+			call_hw(dev, CX23885_HW_888_IR, core, g_chip_ident,
+				chip);
+			break;
+		default:
+			err = -EINVAL; /* per V4L2 spec */
+			break;
+		}
+		break;
+	case V4L2_CHIP_MATCH_I2C_DRIVER:
+		/* If needed, returns V4L2_IDENT_AMBIGUOUS without extra work */
+		call_all(dev, core, g_chip_ident, chip);
+		break;
+	case V4L2_CHIP_MATCH_I2C_ADDR:
+		/*
+		 * We could return V4L2_IDENT_UNKNOWN, but we don't do the work
+		 * to look if a chip is at the address with no driver.  That's a
+		 * dangerous thing to do with EEPROMs anyway.
+		 */
+		call_all(dev, core, g_chip_ident, chip);
+		break;
+	default:
+		err = -EINVAL;
+		break;
+	}
+	return err;
+}
+
+#ifdef CONFIG_VIDEO_ADV_DEBUG
+static int cx23885_g_host_register(struct cx23885_dev *dev,
+				   struct v4l2_dbg_register *reg)
+{
+	if ((reg->reg & 0x3) != 0 || reg->reg >= pci_resource_len(dev->pci, 0))
+		return -EINVAL;
+
+	reg->size = 4;
+	reg->val = cx_read(reg->reg);
+	return 0;
+}
+
+static int cx23417_g_register(struct cx23885_dev *dev,
+			      struct v4l2_dbg_register *reg)
+{
+	u32 value;
+
+	if (dev->v4l_device == NULL)
+		return -EINVAL;
+
+	if ((reg->reg & 0x3) != 0 || reg->reg >= 0x10000)
+		return -EINVAL;
+
+	if (mc417_register_read(dev, (u16) reg->reg, &value))
+		return -EINVAL; /* V4L2 spec, but -EREMOTEIO really */
+
+	reg->size = 4;
+	reg->val = value;
+	return 0;
+}
+
+int cx23885_g_register(struct file *file, void *fh,
+		       struct v4l2_dbg_register *reg)
+{
+	struct cx23885_dev *dev = ((struct cx23885_fh *)fh)->dev;
+
+	if (!capable(CAP_SYS_ADMIN))
+		return -EPERM;
+
+	if (reg->match.type == V4L2_CHIP_MATCH_HOST) {
+		switch (reg->match.addr) {
+		case 0:
+			return cx23885_g_host_register(dev, reg);
+		case 1:
+			return cx23417_g_register(dev, reg);
+		default:
+			break;
+		}
+	}
+
+	/* FIXME - any error returns should not be ignored */
+	call_all(dev, core, g_register, reg);
+	return 0;
+}
+
+static int cx23885_s_host_register(struct cx23885_dev *dev,
+				   struct v4l2_dbg_register *reg)
+{
+	if ((reg->reg & 0x3) != 0 || reg->reg >= pci_resource_len(dev->pci, 0))
+		return -EINVAL;
+
+	reg->size = 4;
+	cx_write(reg->reg, reg->val);
+	return 0;
+}
+
+static int cx23417_s_register(struct cx23885_dev *dev,
+			      struct v4l2_dbg_register *reg)
+{
+	if (dev->v4l_device == NULL)
+		return -EINVAL;
+
+	if ((reg->reg & 0x3) != 0 || reg->reg >= 0x10000)
+		return -EINVAL;
+
+	if (mc417_register_write(dev, (u16) reg->reg, (u32) reg->val))
+		return -EINVAL; /* V4L2 spec, but -EREMOTEIO really */
+
+	reg->size = 4;
+	return 0;
+}
+
+int cx23885_s_register(struct file *file, void *fh,
+		       struct v4l2_dbg_register *reg)
+{
+	struct cx23885_dev *dev = ((struct cx23885_fh *)fh)->dev;
+
+	if (!capable(CAP_SYS_ADMIN))
+		return -EPERM;
+
+	if (reg->match.type == V4L2_CHIP_MATCH_HOST) {
+		switch (reg->match.addr) {
+		case 0:
+			return cx23885_s_host_register(dev, reg);
+		case 1:
+			return cx23417_s_register(dev, reg);
+		default:
+			break;
+		}
+	}
+
+	/* FIXME - any error returns should not be ignored */
+	call_all(dev, core, s_register, reg);
+	return 0;
+}
+#endif
diff --git a/drivers/media/video/cx23885/cx23885-ioctl.h b/drivers/media/video/cx23885/cx23885-ioctl.h
new file mode 100644
index 000000000000..80b0f4923c6a
--- /dev/null
+++ b/drivers/media/video/cx23885/cx23885-ioctl.h
@@ -0,0 +1,39 @@
+/*
+ *  Driver for the Conexant CX23885/7/8 PCIe bridge
+ *
+ *  Various common ioctl() support functions
+ *
+ *  Copyright (c) 2009 Andy Walls <awalls@radix.net>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#ifndef _CX23885_IOCTL_H_
+#define _CX23885_IOCTL_H_
+
+int cx23885_g_chip_ident(struct file *file, void *fh,
+			 struct v4l2_dbg_chip_ident *chip);
+
+#ifdef CONFIG_VIDEO_ADV_DEBUG
+int cx23885_g_register(struct file *file, void *fh,
+		       struct v4l2_dbg_register *reg);
+
+
+int cx23885_s_register(struct file *file, void *fh,
+		       struct v4l2_dbg_register *reg);
+
+#endif
+#endif
diff --git a/drivers/media/video/cx23885/cx23885-ir.c b/drivers/media/video/cx23885/cx23885-ir.c
new file mode 100644
index 000000000000..6ae982cc9856
--- /dev/null
+++ b/drivers/media/video/cx23885/cx23885-ir.c
@@ -0,0 +1,101 @@
+/*
+ *  Driver for the Conexant CX23885/7/8 PCIe bridge
+ *
+ *  Infrared device support routines - non-input, non-vl42_subdev routines
+ *
+ *  Copyright (C) 2009  Andy Walls <awalls@radix.net>
+ *
+ *  This program is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU General Public License
+ *  as published by the Free Software Foundation; either version 2
+ *  of the License, or (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ *  02110-1301, USA.
+ */
+
+#include <media/v4l2-device.h>
+
+#include "cx23885.h"
+#include "cx23885-input.h"
+
+#define CX23885_IR_RX_FIFO_SERVICE_REQ		0
+#define CX23885_IR_RX_END_OF_RX_DETECTED	1
+#define CX23885_IR_RX_HW_FIFO_OVERRUN		2
+#define CX23885_IR_RX_SW_FIFO_OVERRUN		3
+
+#define CX23885_IR_TX_FIFO_SERVICE_REQ		0
+
+
+void cx23885_ir_rx_work_handler(struct work_struct *work)
+{
+	struct cx23885_dev *dev =
+			     container_of(work, struct cx23885_dev, ir_rx_work);
+	u32 events = 0;
+	unsigned long *notifications = &dev->ir_rx_notifications;
+
+	if (test_and_clear_bit(CX23885_IR_RX_SW_FIFO_OVERRUN, notifications))
+		events |= V4L2_SUBDEV_IR_RX_SW_FIFO_OVERRUN;
+	if (test_and_clear_bit(CX23885_IR_RX_HW_FIFO_OVERRUN, notifications))
+		events |= V4L2_SUBDEV_IR_RX_HW_FIFO_OVERRUN;
+	if (test_and_clear_bit(CX23885_IR_RX_END_OF_RX_DETECTED, notifications))
+		events |= V4L2_SUBDEV_IR_RX_END_OF_RX_DETECTED;
+	if (test_and_clear_bit(CX23885_IR_RX_FIFO_SERVICE_REQ, notifications))
+		events |= V4L2_SUBDEV_IR_RX_FIFO_SERVICE_REQ;
+
+	if (events == 0)
+		return;
+
+	if (dev->ir_input)
+		cx23885_input_rx_work_handler(dev, events);
+}
+
+void cx23885_ir_tx_work_handler(struct work_struct *work)
+{
+	struct cx23885_dev *dev =
+			     container_of(work, struct cx23885_dev, ir_tx_work);
+	u32 events = 0;
+	unsigned long *notifications = &dev->ir_tx_notifications;
+
+	if (test_and_clear_bit(CX23885_IR_TX_FIFO_SERVICE_REQ, notifications))
+		events |= V4L2_SUBDEV_IR_TX_FIFO_SERVICE_REQ;
+
+	if (events == 0)
+		return;
+
+}
+
+/* Called in an IRQ context */
+void cx23885_ir_rx_v4l2_dev_notify(struct v4l2_subdev *sd, u32 events)
+{
+	struct cx23885_dev *dev = to_cx23885(sd->v4l2_dev);
+	unsigned long *notifications = &dev->ir_rx_notifications;
+
+	if (events & V4L2_SUBDEV_IR_RX_FIFO_SERVICE_REQ)
+		set_bit(CX23885_IR_RX_FIFO_SERVICE_REQ, notifications);
+	if (events & V4L2_SUBDEV_IR_RX_END_OF_RX_DETECTED)
+		set_bit(CX23885_IR_RX_END_OF_RX_DETECTED, notifications);
+	if (events & V4L2_SUBDEV_IR_RX_HW_FIFO_OVERRUN)
+		set_bit(CX23885_IR_RX_HW_FIFO_OVERRUN, notifications);
+	if (events & V4L2_SUBDEV_IR_RX_SW_FIFO_OVERRUN)
+		set_bit(CX23885_IR_RX_SW_FIFO_OVERRUN, notifications);
+	schedule_work(&dev->ir_rx_work);
+}
+
+/* Called in an IRQ context */
+void cx23885_ir_tx_v4l2_dev_notify(struct v4l2_subdev *sd, u32 events)
+{
+	struct cx23885_dev *dev = to_cx23885(sd->v4l2_dev);
+	unsigned long *notifications = &dev->ir_tx_notifications;
+
+	if (events & V4L2_SUBDEV_IR_TX_FIFO_SERVICE_REQ)
+		set_bit(CX23885_IR_TX_FIFO_SERVICE_REQ, notifications);
+	schedule_work(&dev->ir_tx_work);
+}
diff --git a/drivers/media/video/cx23885/cx23885-ir.h b/drivers/media/video/cx23885/cx23885-ir.h
new file mode 100644
index 000000000000..9b8a6d5d1ef6
--- /dev/null
+++ b/drivers/media/video/cx23885/cx23885-ir.h
@@ -0,0 +1,31 @@
+/*
+ *  Driver for the Conexant CX23885/7/8 PCIe bridge
+ *
+ *  Infrared device support routines - non-input, non-vl42_subdev routines
+ *
+ *  Copyright (C) 2009  Andy Walls <awalls@radix.net>
+ *
+ *  This program is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU General Public License
+ *  as published by the Free Software Foundation; either version 2
+ *  of the License, or (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ *  02110-1301, USA.
+ */
+
+#ifndef _CX23885_IR_H_
+#define _CX23885_IR_H_
+void cx23885_ir_rx_v4l2_dev_notify(struct v4l2_subdev *sd, u32 events);
+void cx23885_ir_tx_v4l2_dev_notify(struct v4l2_subdev *sd, u32 events);
+
+void cx23885_ir_rx_work_handler(struct work_struct *work);
+void cx23885_ir_tx_work_handler(struct work_struct *work);
+#endif
diff --git a/drivers/media/video/cx23885/cx23885-reg.h b/drivers/media/video/cx23885/cx23885-reg.h
index eafbe5226bae..c0bc9a068954 100644
--- a/drivers/media/video/cx23885/cx23885-reg.h
+++ b/drivers/media/video/cx23885/cx23885-reg.h
@@ -212,8 +212,9 @@ Channel manager Data Structure entry = 20 DWORD
 
 #define DEV_CNTRL2	0x00040000
 
-#define PCI_MSK_GPIO1   (1 << 24)
-#define PCI_MSK_GPIO0   (1 << 23)
+#define PCI_MSK_IR        (1 << 28)
+#define PCI_MSK_GPIO1     (1 << 24)
+#define PCI_MSK_GPIO0     (1 << 23)
 #define PCI_MSK_APB_DMA   (1 << 12)
 #define PCI_MSK_AL_WR     (1 << 11)
 #define PCI_MSK_AL_RD     (1 << 10)
diff --git a/drivers/media/video/cx23885/cx23885-video.c b/drivers/media/video/cx23885/cx23885-video.c
index 654cc253cd50..8934d61cf660 100644
--- a/drivers/media/video/cx23885/cx23885-video.c
+++ b/drivers/media/video/cx23885/cx23885-video.c
@@ -35,6 +35,7 @@
 #include "cx23885.h"
 #include <media/v4l2-common.h>
 #include <media/v4l2-ioctl.h>
+#include "cx23885-ioctl.h"
 
 MODULE_DESCRIPTION("v4l2 driver module for cx23885 based TV cards");
 MODULE_AUTHOR("Steven Toth <stoth@linuxtv.org>");
@@ -317,11 +318,11 @@ static struct video_device *cx23885_vdev_init(struct cx23885_dev *dev,
 	if (NULL == vfd)
 		return NULL;
 	*vfd = *template;
-	vfd->minor = -1;
 	vfd->v4l2_dev = &dev->v4l2_dev;
 	vfd->release = video_device_release;
 	snprintf(vfd->name, sizeof(vfd->name), "%s %s (%s)",
 		 dev->name, type, cx23885_boards[dev->board].name);
+	video_set_drvdata(vfd, dev);
 	return vfd;
 }
 
@@ -401,6 +402,13 @@ static int cx23885_video_mux(struct cx23885_dev *dev, unsigned int input)
 		INPUT(input)->gpio2, INPUT(input)->gpio3);
 	dev->input = input;
 
+	if (dev->board == CX23885_BOARD_MYGICA_X8506 ||
+		dev->board == CX23885_BOARD_MAGICPRO_PROHDTVE2) {
+		/* Select Analog TV */
+		if (INPUT(input)->type == CX23885_VMUX_TELEVISION)
+			cx23885_gpio_clear(dev, GPIO_0);
+	}
+
 	/* Tell the internal A/V decoder */
 	v4l2_subdev_call(dev->sd_cx25840, video, s_routing,
 			INPUT(input)->vmux, 0, 0);
@@ -708,46 +716,34 @@ static int get_resource(struct cx23885_fh *fh)
 
 static int video_open(struct file *file)
 {
-	int minor = video_devdata(file)->minor;
-	struct cx23885_dev *h, *dev = NULL;
+	struct video_device *vdev = video_devdata(file);
+	struct cx23885_dev *dev = video_drvdata(file);
 	struct cx23885_fh *fh;
-	struct list_head *list;
 	enum v4l2_buf_type type = 0;
 	int radio = 0;
 
-	lock_kernel();
-	list_for_each(list, &cx23885_devlist) {
-		h = list_entry(list, struct cx23885_dev, devlist);
-		if (h->video_dev &&
-		    h->video_dev->minor == minor) {
-			dev  = h;
-			type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
-		}
-		if (h->vbi_dev &&
-		    h->vbi_dev->minor == minor) {
-			dev  = h;
-			type = V4L2_BUF_TYPE_VBI_CAPTURE;
-		}
-		if (h->radio_dev &&
-		    h->radio_dev->minor == minor) {
-			radio = 1;
-			dev   = h;
-		}
-	}
-	if (NULL == dev) {
-		unlock_kernel();
-		return -ENODEV;
+	switch (vdev->vfl_type) {
+	case VFL_TYPE_GRABBER:
+		type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
+		break;
+	case VFL_TYPE_VBI:
+		type = V4L2_BUF_TYPE_VBI_CAPTURE;
+		break;
+	case VFL_TYPE_RADIO:
+		radio = 1;
+		break;
 	}
 
-	dprintk(1, "open minor=%d radio=%d type=%s\n",
-		minor, radio, v4l2_type_names[type]);
+	dprintk(1, "open dev=%s radio=%d type=%s\n",
+		video_device_node_name(vdev), radio, v4l2_type_names[type]);
 
 	/* allocate + initialize per filehandle data */
 	fh = kzalloc(sizeof(*fh), GFP_KERNEL);
-	if (NULL == fh) {
-		unlock_kernel();
+	if (NULL == fh)
 		return -ENOMEM;
-	}
+
+	lock_kernel();
+
 	file->private_data = fh;
 	fh->dev      = dev;
 	fh->radio    = radio;
@@ -1144,6 +1140,7 @@ static int cx23885_enum_input(struct cx23885_dev *dev, struct v4l2_input *i)
 		[CX23885_VMUX_COMPOSITE3] = "Composite3",
 		[CX23885_VMUX_COMPOSITE4] = "Composite4",
 		[CX23885_VMUX_SVIDEO]     = "S-Video",
+		[CX23885_VMUX_COMPONENT]  = "Component",
 		[CX23885_VMUX_TELEVISION] = "Television",
 		[CX23885_VMUX_CABLE]      = "Cable TV",
 		[CX23885_VMUX_DVB]        = "DVB",
@@ -1312,34 +1309,6 @@ static int vidioc_s_frequency(struct file *file, void *priv,
 		cx23885_set_freq(dev, f);
 }
 
-#ifdef CONFIG_VIDEO_ADV_DEBUG
-static int vidioc_g_register(struct file *file, void *fh,
-				struct v4l2_dbg_register *reg)
-{
-	struct cx23885_dev *dev = ((struct cx23885_fh *)fh)->dev;
-
-	if (!v4l2_chip_match_host(&reg->match))
-		return -EINVAL;
-
-	call_all(dev, core, g_register, reg);
-
-	return 0;
-}
-
-static int vidioc_s_register(struct file *file, void *fh,
-				struct v4l2_dbg_register *reg)
-{
-	struct cx23885_dev *dev = ((struct cx23885_fh *)fh)->dev;
-
-	if (!v4l2_chip_match_host(&reg->match))
-		return -EINVAL;
-
-	call_all(dev, core, s_register, reg);
-
-	return 0;
-}
-#endif
-
 /* ----------------------------------------------------------- */
 
 static void cx23885_vid_timeout(unsigned long data)
@@ -1449,9 +1418,10 @@ static const struct v4l2_ioctl_ops video_ioctl_ops = {
 	.vidioc_s_tuner       = vidioc_s_tuner,
 	.vidioc_g_frequency   = vidioc_g_frequency,
 	.vidioc_s_frequency   = vidioc_s_frequency,
+	.vidioc_g_chip_ident  = cx23885_g_chip_ident,
 #ifdef CONFIG_VIDEO_ADV_DEBUG
-	.vidioc_g_register    = vidioc_g_register,
-	.vidioc_s_register    = vidioc_s_register,
+	.vidioc_g_register    = cx23885_g_register,
+	.vidioc_s_register    = cx23885_s_register,
 #endif
 };
 
@@ -1459,7 +1429,6 @@ static struct video_device cx23885_vbi_template;
 static struct video_device cx23885_video_template = {
 	.name                 = "cx23885-video",
 	.fops                 = &video_fops,
-	.minor                = -1,
 	.ioctl_ops 	      = &video_ioctl_ops,
 	.tvnorms              = CX23885_NORMS,
 	.current_norm         = V4L2_STD_NTSC_M,
@@ -1479,7 +1448,7 @@ void cx23885_video_unregister(struct cx23885_dev *dev)
 	cx_clear(PCI_INT_MSK, 1);
 
 	if (dev->video_dev) {
-		if (-1 != dev->video_dev->minor)
+		if (video_is_registered(dev->video_dev))
 			video_unregister_device(dev->video_dev);
 		else
 			video_device_release(dev->video_dev);
@@ -1529,9 +1498,11 @@ int cx23885_video_register(struct cx23885_dev *dev)
 		if (sd) {
 			struct tuner_setup tun_setup;
 
+			memset(&tun_setup, 0, sizeof(tun_setup));
 			tun_setup.mode_mask = T_ANALOG_TV;
 			tun_setup.type = dev->tuner_type;
 			tun_setup.addr = v4l2_i2c_subdev_addr(sd);
+			tun_setup.tuner_callback = cx23885_tuner_callback;
 
 			v4l2_subdev_call(sd, tuner, s_type_addr, &tun_setup);
 		}
@@ -1548,8 +1519,8 @@ int cx23885_video_register(struct cx23885_dev *dev)
 			dev->name);
 		goto fail_unreg;
 	}
-	printk(KERN_INFO "%s/0: registered device video%d [v4l2]\n",
-	       dev->name, dev->video_dev->num);
+	printk(KERN_INFO "%s/0: registered device %s [v4l2]\n",
+	       dev->name, video_device_node_name(dev->video_dev));
 	/* initial device configuration */
 	mutex_lock(&dev->lock);
 	cx23885_set_tvnorm(dev, dev->tvnorm);
diff --git a/drivers/media/video/cx23885/cx23885.h b/drivers/media/video/cx23885/cx23885.h
index cc7a165561ff..08b3f6b136a0 100644
--- a/drivers/media/video/cx23885/cx23885.h
+++ b/drivers/media/video/cx23885/cx23885.h
@@ -79,6 +79,8 @@
 #define CX23885_BOARD_MAGICPRO_PROHDTVE2       23
 #define CX23885_BOARD_HAUPPAUGE_HVR1850        24
 #define CX23885_BOARD_COMPRO_VIDEOMATE_E800    25
+#define CX23885_BOARD_HAUPPAUGE_HVR1290        26
+#define CX23885_BOARD_MYGICA_X8558PRO          27
 
 #define GPIO_0 0x00000001
 #define GPIO_1 0x00000002
@@ -157,6 +159,7 @@ enum cx23885_itype {
 	CX23885_VMUX_COMPOSITE3,
 	CX23885_VMUX_COMPOSITE4,
 	CX23885_VMUX_SVIDEO,
+	CX23885_VMUX_COMPONENT,
 	CX23885_VMUX_TELEVISION,
 	CX23885_VMUX_CABLE,
 	CX23885_VMUX_DVB,
@@ -297,14 +300,9 @@ struct cx23885_tsport {
 	/* Allow a single tsport to have multiple frontends */
 	u32                        num_frontends;
 	void                       *port_priv;
-
-	/* FIXME: temporary hack */
-	int (*set_frontend_save) (struct dvb_frontend *,
-				  struct dvb_frontend_parameters *);
 };
 
 struct cx23885_dev {
-	struct list_head           devlist;
 	atomic_t                   refcount;
 	struct v4l2_device 	   v4l2_dev;
 
@@ -356,6 +354,16 @@ struct cx23885_dev {
 	unsigned int               has_radio;
 	struct v4l2_subdev 	   *sd_cx25840;
 
+	/* Infrared */
+	struct v4l2_subdev         *sd_ir;
+	struct work_struct	   ir_rx_work;
+	unsigned long		   ir_rx_notifications;
+	struct work_struct	   ir_tx_work;
+	unsigned long		   ir_tx_notifications;
+
+	struct card_ir		   *ir_input;
+	atomic_t		   ir_input_stopping;
+
 	/* V4l */
 	u32                        freq;
 	struct video_device        *video_dev;
@@ -383,7 +391,12 @@ static inline struct cx23885_dev *to_cx23885(struct v4l2_device *v4l2_dev)
 #define call_all(dev, o, f, args...) \
 	v4l2_device_call_all(&dev->v4l2_dev, 0, o, f, ##args)
 
-extern struct list_head cx23885_devlist;
+#define CX23885_HW_888_IR (1 << 0)
+
+#define call_hw(dev, grpid, o, f, args...) \
+	v4l2_device_call_all(&dev->v4l2_dev, grpid, o, f, ##args)
+
+extern struct v4l2_subdev *cx23885_find_hw(struct cx23885_dev *dev, u32 hw);
 
 #define SRAM_CH01  0 /* Video A */
 #define SRAM_CH02  1 /* VBI A */
@@ -455,6 +468,7 @@ extern void cx23885_wakeup(struct cx23885_tsport *port,
 
 extern void cx23885_gpio_set(struct cx23885_dev *dev, u32 mask);
 extern void cx23885_gpio_clear(struct cx23885_dev *dev, u32 mask);
+extern u32 cx23885_gpio_get(struct cx23885_dev *dev, u32 mask);
 extern void cx23885_gpio_enable(struct cx23885_dev *dev, u32 mask,
 	int asoutput);
 
@@ -471,6 +485,8 @@ extern int cx23885_tuner_callback(void *priv, int component,
 	int command, int arg);
 extern void cx23885_card_list(struct cx23885_dev *dev);
 extern int  cx23885_ir_init(struct cx23885_dev *dev);
+extern void cx23885_ir_pci_int_enable(struct cx23885_dev *dev);
+extern void cx23885_ir_fini(struct cx23885_dev *dev);
 extern void cx23885_gpio_setup(struct cx23885_dev *dev);
 extern void cx23885_card_setup(struct cx23885_dev *dev);
 extern void cx23885_card_setup_pre_i2c(struct cx23885_dev *dev);
@@ -515,6 +531,10 @@ extern void cx23885_417_check_encoder(struct cx23885_dev *dev);
 extern void cx23885_mc417_init(struct cx23885_dev *dev);
 extern int mc417_memory_read(struct cx23885_dev *dev, u32 address, u32 *value);
 extern int mc417_memory_write(struct cx23885_dev *dev, u32 address, u32 value);
+extern int mc417_register_read(struct cx23885_dev *dev,
+				u16 address, u32 *value);
+extern int mc417_register_write(struct cx23885_dev *dev,
+				u16 address, u32 value);
 extern void mc417_gpio_set(struct cx23885_dev *dev, u32 mask);
 extern void mc417_gpio_clear(struct cx23885_dev *dev, u32 mask);
 extern void mc417_gpio_enable(struct cx23885_dev *dev, u32 mask, int asoutput);
diff --git a/drivers/media/video/cx23885/cx23888-ir.c b/drivers/media/video/cx23885/cx23888-ir.c
new file mode 100644
index 000000000000..2bf57a4527d3
--- /dev/null
+++ b/drivers/media/video/cx23885/cx23888-ir.c
@@ -0,0 +1,1233 @@
+/*
+ *  Driver for the Conexant CX23885/7/8 PCIe bridge
+ *
+ *  CX23888 Integrated Consumer Infrared Controller
+ *
+ *  Copyright (C) 2009  Andy Walls <awalls@radix.net>
+ *
+ *  This program is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU General Public License
+ *  as published by the Free Software Foundation; either version 2
+ *  of the License, or (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ *  02110-1301, USA.
+ */
+
+#include <linux/kfifo.h>
+
+#include <media/v4l2-device.h>
+#include <media/v4l2-chip-ident.h>
+
+#include "cx23885.h"
+
+static unsigned int ir_888_debug;
+module_param(ir_888_debug, int, 0644);
+MODULE_PARM_DESC(ir_888_debug, "enable debug messages [CX23888 IR controller]");
+
+#define CX23888_IR_REG_BASE 	0x170000
+/*
+ * These CX23888 register offsets have a straightforward one to one mapping
+ * to the CX23885 register offsets of 0x200 through 0x218
+ */
+#define CX23888_IR_CNTRL_REG	0x170000
+#define CNTRL_WIN_3_3	0x00000000
+#define CNTRL_WIN_4_3	0x00000001
+#define CNTRL_WIN_3_4	0x00000002
+#define CNTRL_WIN_4_4	0x00000003
+#define CNTRL_WIN	0x00000003
+#define CNTRL_EDG_NONE	0x00000000
+#define CNTRL_EDG_FALL	0x00000004
+#define CNTRL_EDG_RISE	0x00000008
+#define CNTRL_EDG_BOTH	0x0000000C
+#define CNTRL_EDG	0x0000000C
+#define CNTRL_DMD	0x00000010
+#define CNTRL_MOD	0x00000020
+#define CNTRL_RFE	0x00000040
+#define CNTRL_TFE	0x00000080
+#define CNTRL_RXE	0x00000100
+#define CNTRL_TXE	0x00000200
+#define CNTRL_RIC	0x00000400
+#define CNTRL_TIC	0x00000800
+#define CNTRL_CPL	0x00001000
+#define CNTRL_LBM	0x00002000
+#define CNTRL_R		0x00004000
+
+#define CX23888_IR_TXCLK_REG	0x170004
+#define TXCLK_TCD	0x0000FFFF
+
+#define CX23888_IR_RXCLK_REG	0x170008
+#define RXCLK_RCD	0x0000FFFF
+
+#define CX23888_IR_CDUTY_REG	0x17000C
+#define CDUTY_CDC	0x0000000F
+
+#define CX23888_IR_STATS_REG	0x170010
+#define STATS_RTO	0x00000001
+#define STATS_ROR	0x00000002
+#define STATS_RBY	0x00000004
+#define STATS_TBY	0x00000008
+#define STATS_RSR	0x00000010
+#define STATS_TSR	0x00000020
+
+#define CX23888_IR_IRQEN_REG	0x170014
+#define IRQEN_RTE	0x00000001
+#define IRQEN_ROE	0x00000002
+#define IRQEN_RSE	0x00000010
+#define IRQEN_TSE	0x00000020
+
+#define CX23888_IR_FILTR_REG	0x170018
+#define FILTR_LPF	0x0000FFFF
+
+/* This register doesn't follow the pattern; it's 0x23C on a CX23885 */
+#define CX23888_IR_FIFO_REG	0x170040
+#define FIFO_RXTX	0x0000FFFF
+#define FIFO_RXTX_LVL	0x00010000
+#define FIFO_RXTX_RTO	0x0001FFFF
+#define FIFO_RX_NDV	0x00020000
+#define FIFO_RX_DEPTH	8
+#define FIFO_TX_DEPTH	8
+
+/* CX23888 unique registers */
+#define CX23888_IR_SEEDP_REG	0x17001C
+#define CX23888_IR_TIMOL_REG	0x170020
+#define CX23888_IR_WAKE0_REG	0x170024
+#define CX23888_IR_WAKE1_REG	0x170028
+#define CX23888_IR_WAKE2_REG	0x17002C
+#define CX23888_IR_MASK0_REG	0x170030
+#define CX23888_IR_MASK1_REG	0x170034
+#define CX23888_IR_MAKS2_REG	0x170038
+#define CX23888_IR_DPIPG_REG	0x17003C
+#define CX23888_IR_LEARN_REG	0x170044
+
+#define CX23888_VIDCLK_FREQ	108000000 /* 108 MHz, BT.656 */
+#define CX23888_IR_REFCLK_FREQ	(CX23888_VIDCLK_FREQ / 2)
+
+#define CX23888_IR_RX_KFIFO_SIZE	(512 * sizeof(u32))
+#define CX23888_IR_TX_KFIFO_SIZE	(512 * sizeof(u32))
+
+struct cx23888_ir_state {
+	struct v4l2_subdev sd;
+	struct cx23885_dev *dev;
+	u32 id;
+	u32 rev;
+
+	struct v4l2_subdev_ir_parameters rx_params;
+	struct mutex rx_params_lock;
+	atomic_t rxclk_divider;
+	atomic_t rx_invert;
+
+	struct kfifo rx_kfifo;
+	spinlock_t rx_kfifo_lock;
+
+	struct v4l2_subdev_ir_parameters tx_params;
+	struct mutex tx_params_lock;
+	atomic_t txclk_divider;
+};
+
+static inline struct cx23888_ir_state *to_state(struct v4l2_subdev *sd)
+{
+	return v4l2_get_subdevdata(sd);
+}
+
+/*
+ * IR register block read and write functions
+ */
+static
+inline int cx23888_ir_write4(struct cx23885_dev *dev, u32 addr, u32 value)
+{
+	cx_write(addr, value);
+	return 0;
+}
+
+static inline u32 cx23888_ir_read4(struct cx23885_dev *dev, u32 addr)
+{
+	return cx_read(addr);
+}
+
+static inline int cx23888_ir_and_or4(struct cx23885_dev *dev, u32 addr,
+				     u32 and_mask, u32 or_value)
+{
+	cx_andor(addr, ~and_mask, or_value);
+	return 0;
+}
+
+/*
+ * Rx and Tx Clock Divider register computations
+ *
+ * Note the largest clock divider value of 0xffff corresponds to:
+ * 	(0xffff + 1) * 1000 / 108/2 MHz = 1,213,629.629... ns
+ * which fits in 21 bits, so we'll use unsigned int for time arguments.
+ */
+static inline u16 count_to_clock_divider(unsigned int d)
+{
+	if (d > RXCLK_RCD + 1)
+		d = RXCLK_RCD;
+	else if (d < 2)
+		d = 1;
+	else
+		d--;
+	return (u16) d;
+}
+
+static inline u16 ns_to_clock_divider(unsigned int ns)
+{
+	return count_to_clock_divider(
+		DIV_ROUND_CLOSEST(CX23888_IR_REFCLK_FREQ / 1000000 * ns, 1000));
+}
+
+static inline unsigned int clock_divider_to_ns(unsigned int divider)
+{
+	/* Period of the Rx or Tx clock in ns */
+	return DIV_ROUND_CLOSEST((divider + 1) * 1000,
+				 CX23888_IR_REFCLK_FREQ / 1000000);
+}
+
+static inline u16 carrier_freq_to_clock_divider(unsigned int freq)
+{
+	return count_to_clock_divider(
+			  DIV_ROUND_CLOSEST(CX23888_IR_REFCLK_FREQ, freq * 16));
+}
+
+static inline unsigned int clock_divider_to_carrier_freq(unsigned int divider)
+{
+	return DIV_ROUND_CLOSEST(CX23888_IR_REFCLK_FREQ, (divider + 1) * 16);
+}
+
+static inline u16 freq_to_clock_divider(unsigned int freq,
+					unsigned int rollovers)
+{
+	return count_to_clock_divider(
+		   DIV_ROUND_CLOSEST(CX23888_IR_REFCLK_FREQ, freq * rollovers));
+}
+
+static inline unsigned int clock_divider_to_freq(unsigned int divider,
+						 unsigned int rollovers)
+{
+	return DIV_ROUND_CLOSEST(CX23888_IR_REFCLK_FREQ,
+				 (divider + 1) * rollovers);
+}
+
+/*
+ * Low Pass Filter register calculations
+ *
+ * Note the largest count value of 0xffff corresponds to:
+ * 	0xffff * 1000 / 108/2 MHz = 1,213,611.11... ns
+ * which fits in 21 bits, so we'll use unsigned int for time arguments.
+ */
+static inline u16 count_to_lpf_count(unsigned int d)
+{
+	if (d > FILTR_LPF)
+		d = FILTR_LPF;
+	else if (d < 4)
+		d = 0;
+	return (u16) d;
+}
+
+static inline u16 ns_to_lpf_count(unsigned int ns)
+{
+	return count_to_lpf_count(
+		DIV_ROUND_CLOSEST(CX23888_IR_REFCLK_FREQ / 1000000 * ns, 1000));
+}
+
+static inline unsigned int lpf_count_to_ns(unsigned int count)
+{
+	/* Duration of the Low Pass Filter rejection window in ns */
+	return DIV_ROUND_CLOSEST(count * 1000,
+				 CX23888_IR_REFCLK_FREQ / 1000000);
+}
+
+static inline unsigned int lpf_count_to_us(unsigned int count)
+{
+	/* Duration of the Low Pass Filter rejection window in us */
+	return DIV_ROUND_CLOSEST(count, CX23888_IR_REFCLK_FREQ / 1000000);
+}
+
+/*
+ * FIFO register pulse width count compuations
+ */
+static u32 clock_divider_to_resolution(u16 divider)
+{
+	/*
+	 * Resolution is the duration of 1 tick of the readable portion of
+	 * of the pulse width counter as read from the FIFO.  The two lsb's are
+	 * not readable, hence the << 2.  This function returns ns.
+	 */
+	return DIV_ROUND_CLOSEST((1 << 2)  * ((u32) divider + 1) * 1000,
+				 CX23888_IR_REFCLK_FREQ / 1000000);
+}
+
+static u64 pulse_width_count_to_ns(u16 count, u16 divider)
+{
+	u64 n;
+	u32 rem;
+
+	/*
+	 * The 2 lsb's of the pulse width timer count are not readable, hence
+	 * the (count << 2) | 0x3
+	 */
+	n = (((u64) count << 2) | 0x3) * (divider + 1) * 1000; /* millicycles */
+	rem = do_div(n, CX23888_IR_REFCLK_FREQ / 1000000);     /* / MHz => ns */
+	if (rem >= CX23888_IR_REFCLK_FREQ / 1000000 / 2)
+		n++;
+	return n;
+}
+
+static unsigned int pulse_width_count_to_us(u16 count, u16 divider)
+{
+	u64 n;
+	u32 rem;
+
+	/*
+	 * The 2 lsb's of the pulse width timer count are not readable, hence
+	 * the (count << 2) | 0x3
+	 */
+	n = (((u64) count << 2) | 0x3) * (divider + 1);    /* cycles      */
+	rem = do_div(n, CX23888_IR_REFCLK_FREQ / 1000000); /* / MHz => us */
+	if (rem >= CX23888_IR_REFCLK_FREQ / 1000000 / 2)
+		n++;
+	return (unsigned int) n;
+}
+
+/*
+ * Pulse Clocks computations: Combined Pulse Width Count & Rx Clock Counts
+ *
+ * The total pulse clock count is an 18 bit pulse width timer count as the most
+ * significant part and (up to) 16 bit clock divider count as a modulus.
+ * When the Rx clock divider ticks down to 0, it increments the 18 bit pulse
+ * width timer count's least significant bit.
+ */
+static u64 ns_to_pulse_clocks(u32 ns)
+{
+	u64 clocks;
+	u32 rem;
+	clocks = CX23888_IR_REFCLK_FREQ / 1000000 * (u64) ns; /* millicycles  */
+	rem = do_div(clocks, 1000);                         /* /1000 = cycles */
+	if (rem >= 1000 / 2)
+		clocks++;
+	return clocks;
+}
+
+static u16 pulse_clocks_to_clock_divider(u64 count)
+{
+	u32 rem;
+
+	rem = do_div(count, (FIFO_RXTX << 2) | 0x3);
+
+	/* net result needs to be rounded down and decremented by 1 */
+	if (count > RXCLK_RCD + 1)
+		count = RXCLK_RCD;
+	else if (count < 2)
+		count = 1;
+	else
+		count--;
+	return (u16) count;
+}
+
+/*
+ * IR Control Register helpers
+ */
+enum tx_fifo_watermark {
+	TX_FIFO_HALF_EMPTY = 0,
+	TX_FIFO_EMPTY      = CNTRL_TIC,
+};
+
+enum rx_fifo_watermark {
+	RX_FIFO_HALF_FULL = 0,
+	RX_FIFO_NOT_EMPTY = CNTRL_RIC,
+};
+
+static inline void control_tx_irq_watermark(struct cx23885_dev *dev,
+					    enum tx_fifo_watermark level)
+{
+	cx23888_ir_and_or4(dev, CX23888_IR_CNTRL_REG, ~CNTRL_TIC, level);
+}
+
+static inline void control_rx_irq_watermark(struct cx23885_dev *dev,
+					    enum rx_fifo_watermark level)
+{
+	cx23888_ir_and_or4(dev, CX23888_IR_CNTRL_REG, ~CNTRL_RIC, level);
+}
+
+static inline void control_tx_enable(struct cx23885_dev *dev, bool enable)
+{
+	cx23888_ir_and_or4(dev, CX23888_IR_CNTRL_REG, ~(CNTRL_TXE | CNTRL_TFE),
+			   enable ? (CNTRL_TXE | CNTRL_TFE) : 0);
+}
+
+static inline void control_rx_enable(struct cx23885_dev *dev, bool enable)
+{
+	cx23888_ir_and_or4(dev, CX23888_IR_CNTRL_REG, ~(CNTRL_RXE | CNTRL_RFE),
+			   enable ? (CNTRL_RXE | CNTRL_RFE) : 0);
+}
+
+static inline void control_tx_modulation_enable(struct cx23885_dev *dev,
+						bool enable)
+{
+	cx23888_ir_and_or4(dev, CX23888_IR_CNTRL_REG, ~CNTRL_MOD,
+			   enable ? CNTRL_MOD : 0);
+}
+
+static inline void control_rx_demodulation_enable(struct cx23885_dev *dev,
+						  bool enable)
+{
+	cx23888_ir_and_or4(dev, CX23888_IR_CNTRL_REG, ~CNTRL_DMD,
+			   enable ? CNTRL_DMD : 0);
+}
+
+static inline void control_rx_s_edge_detection(struct cx23885_dev *dev,
+					       u32 edge_types)
+{
+	cx23888_ir_and_or4(dev, CX23888_IR_CNTRL_REG, ~CNTRL_EDG_BOTH,
+			   edge_types & CNTRL_EDG_BOTH);
+}
+
+static void control_rx_s_carrier_window(struct cx23885_dev *dev,
+					unsigned int carrier,
+					unsigned int *carrier_range_low,
+					unsigned int *carrier_range_high)
+{
+	u32 v;
+	unsigned int c16 = carrier * 16;
+
+	if (*carrier_range_low < DIV_ROUND_CLOSEST(c16, 16 + 3)) {
+		v = CNTRL_WIN_3_4;
+		*carrier_range_low = DIV_ROUND_CLOSEST(c16, 16 + 4);
+	} else {
+		v = CNTRL_WIN_3_3;
+		*carrier_range_low = DIV_ROUND_CLOSEST(c16, 16 + 3);
+	}
+
+	if (*carrier_range_high > DIV_ROUND_CLOSEST(c16, 16 - 3)) {
+		v |= CNTRL_WIN_4_3;
+		*carrier_range_high = DIV_ROUND_CLOSEST(c16, 16 - 4);
+	} else {
+		v |= CNTRL_WIN_3_3;
+		*carrier_range_high = DIV_ROUND_CLOSEST(c16, 16 - 3);
+	}
+	cx23888_ir_and_or4(dev, CX23888_IR_CNTRL_REG, ~CNTRL_WIN, v);
+}
+
+static inline void control_tx_polarity_invert(struct cx23885_dev *dev,
+					      bool invert)
+{
+	cx23888_ir_and_or4(dev, CX23888_IR_CNTRL_REG, ~CNTRL_CPL,
+			   invert ? CNTRL_CPL : 0);
+}
+
+/*
+ * IR Rx & Tx Clock Register helpers
+ */
+static unsigned int txclk_tx_s_carrier(struct cx23885_dev *dev,
+				       unsigned int freq,
+				       u16 *divider)
+{
+	*divider = carrier_freq_to_clock_divider(freq);
+	cx23888_ir_write4(dev, CX23888_IR_TXCLK_REG, *divider);
+	return clock_divider_to_carrier_freq(*divider);
+}
+
+static unsigned int rxclk_rx_s_carrier(struct cx23885_dev *dev,
+				       unsigned int freq,
+				       u16 *divider)
+{
+	*divider = carrier_freq_to_clock_divider(freq);
+	cx23888_ir_write4(dev, CX23888_IR_RXCLK_REG, *divider);
+	return clock_divider_to_carrier_freq(*divider);
+}
+
+static u32 txclk_tx_s_max_pulse_width(struct cx23885_dev *dev, u32 ns,
+				      u16 *divider)
+{
+	u64 pulse_clocks;
+
+	if (ns > V4L2_SUBDEV_IR_PULSE_MAX_WIDTH_NS)
+		ns = V4L2_SUBDEV_IR_PULSE_MAX_WIDTH_NS;
+	pulse_clocks = ns_to_pulse_clocks(ns);
+	*divider = pulse_clocks_to_clock_divider(pulse_clocks);
+	cx23888_ir_write4(dev, CX23888_IR_TXCLK_REG, *divider);
+	return (u32) pulse_width_count_to_ns(FIFO_RXTX, *divider);
+}
+
+static u32 rxclk_rx_s_max_pulse_width(struct cx23885_dev *dev, u32 ns,
+				      u16 *divider)
+{
+	u64 pulse_clocks;
+
+	if (ns > V4L2_SUBDEV_IR_PULSE_MAX_WIDTH_NS)
+		ns = V4L2_SUBDEV_IR_PULSE_MAX_WIDTH_NS;
+	pulse_clocks = ns_to_pulse_clocks(ns);
+	*divider = pulse_clocks_to_clock_divider(pulse_clocks);
+	cx23888_ir_write4(dev, CX23888_IR_RXCLK_REG, *divider);
+	return (u32) pulse_width_count_to_ns(FIFO_RXTX, *divider);
+}
+
+/*
+ * IR Tx Carrier Duty Cycle register helpers
+ */
+static unsigned int cduty_tx_s_duty_cycle(struct cx23885_dev *dev,
+					  unsigned int duty_cycle)
+{
+	u32 n;
+	n = DIV_ROUND_CLOSEST(duty_cycle * 100, 625); /* 16ths of 100% */
+	if (n != 0)
+		n--;
+	if (n > 15)
+		n = 15;
+	cx23888_ir_write4(dev, CX23888_IR_CDUTY_REG, n);
+	return DIV_ROUND_CLOSEST((n + 1) * 100, 16);
+}
+
+/*
+ * IR Filter Register helpers
+ */
+static u32 filter_rx_s_min_width(struct cx23885_dev *dev, u32 min_width_ns)
+{
+	u32 count = ns_to_lpf_count(min_width_ns);
+	cx23888_ir_write4(dev, CX23888_IR_FILTR_REG, count);
+	return lpf_count_to_ns(count);
+}
+
+/*
+ * IR IRQ Enable Register helpers
+ */
+static inline void irqenable_rx(struct cx23885_dev *dev, u32 mask)
+{
+	mask &= (IRQEN_RTE | IRQEN_ROE | IRQEN_RSE);
+	cx23888_ir_and_or4(dev, CX23888_IR_IRQEN_REG,
+			   ~(IRQEN_RTE | IRQEN_ROE | IRQEN_RSE), mask);
+}
+
+static inline void irqenable_tx(struct cx23885_dev *dev, u32 mask)
+{
+	mask &= IRQEN_TSE;
+	cx23888_ir_and_or4(dev, CX23888_IR_IRQEN_REG, ~IRQEN_TSE, mask);
+}
+
+/*
+ * V4L2 Subdevice IR Ops
+ */
+static int cx23888_ir_irq_handler(struct v4l2_subdev *sd, u32 status,
+				  bool *handled)
+{
+	struct cx23888_ir_state *state = to_state(sd);
+	struct cx23885_dev *dev = state->dev;
+	unsigned long flags;
+
+	u32 cntrl = cx23888_ir_read4(dev, CX23888_IR_CNTRL_REG);
+	u32 irqen = cx23888_ir_read4(dev, CX23888_IR_IRQEN_REG);
+	u32 stats = cx23888_ir_read4(dev, CX23888_IR_STATS_REG);
+
+	u32 rx_data[FIFO_RX_DEPTH];
+	int i, j, k;
+	u32 events, v;
+	int tsr, rsr, rto, ror, tse, rse, rte, roe, kror;
+
+	tsr = stats & STATS_TSR; /* Tx FIFO Service Request */
+	rsr = stats & STATS_RSR; /* Rx FIFO Service Request */
+	rto = stats & STATS_RTO; /* Rx Pulse Width Timer Time Out */
+	ror = stats & STATS_ROR; /* Rx FIFO Over Run */
+
+	tse = irqen & IRQEN_TSE; /* Tx FIFO Service Request IRQ Enable */
+	rse = irqen & IRQEN_RSE; /* Rx FIFO Service Reuqest IRQ Enable */
+	rte = irqen & IRQEN_RTE; /* Rx Pulse Width Timer Time Out IRQ Enable */
+	roe = irqen & IRQEN_ROE; /* Rx FIFO Over Run IRQ Enable */
+
+	*handled = false;
+	v4l2_dbg(2, ir_888_debug, sd, "IRQ Status:  %s %s %s %s %s %s\n",
+		 tsr ? "tsr" : "   ", rsr ? "rsr" : "   ",
+		 rto ? "rto" : "   ", ror ? "ror" : "   ",
+		 stats & STATS_TBY ? "tby" : "   ",
+		 stats & STATS_RBY ? "rby" : "   ");
+
+	v4l2_dbg(2, ir_888_debug, sd, "IRQ Enables: %s %s %s %s\n",
+		 tse ? "tse" : "   ", rse ? "rse" : "   ",
+		 rte ? "rte" : "   ", roe ? "roe" : "   ");
+
+	/*
+	 * Transmitter interrupt service
+	 */
+	if (tse && tsr) {
+		/*
+		 * TODO:
+		 * Check the watermark threshold setting
+		 * Pull FIFO_TX_DEPTH or FIFO_TX_DEPTH/2 entries from tx_kfifo
+		 * Push the data to the hardware FIFO.
+		 * If there was nothing more to send in the tx_kfifo, disable
+		 *	the TSR IRQ and notify the v4l2_device.
+		 * If there was something in the tx_kfifo, check the tx_kfifo
+		 *      level and notify the v4l2_device, if it is low.
+		 */
+		/* For now, inhibit TSR interrupt until Tx is implemented */
+		irqenable_tx(dev, 0);
+		events = V4L2_SUBDEV_IR_TX_FIFO_SERVICE_REQ;
+		v4l2_subdev_notify(sd, V4L2_SUBDEV_IR_TX_NOTIFY, &events);
+		*handled = true;
+	}
+
+	/*
+	 * Receiver interrupt service
+	 */
+	kror = 0;
+	if ((rse && rsr) || (rte && rto)) {
+		/*
+		 * Receive data on RSR to clear the STATS_RSR.
+		 * Receive data on RTO, since we may not have yet hit the RSR
+		 * watermark when we receive the RTO.
+		 */
+		for (i = 0, v = FIFO_RX_NDV;
+		     (v & FIFO_RX_NDV) && !kror; i = 0) {
+			for (j = 0;
+			     (v & FIFO_RX_NDV) && j < FIFO_RX_DEPTH; j++) {
+				v = cx23888_ir_read4(dev, CX23888_IR_FIFO_REG);
+				rx_data[i++] = v & ~FIFO_RX_NDV;
+			}
+			if (i == 0)
+				break;
+			j = i * sizeof(u32);
+			k = kfifo_in_locked(&state->rx_kfifo,
+				      (unsigned char *) rx_data, j,
+				      &state->rx_kfifo_lock);
+			if (k != j)
+				kror++; /* rx_kfifo over run */
+		}
+		*handled = true;
+	}
+
+	events = 0;
+	v = 0;
+	if (kror) {
+		events |= V4L2_SUBDEV_IR_RX_SW_FIFO_OVERRUN;
+		v4l2_err(sd, "IR receiver software FIFO overrun\n");
+	}
+	if (roe && ror) {
+		/*
+		 * The RX FIFO Enable (CNTRL_RFE) must be toggled to clear
+		 * the Rx FIFO Over Run status (STATS_ROR)
+		 */
+		v |= CNTRL_RFE;
+		events |= V4L2_SUBDEV_IR_RX_HW_FIFO_OVERRUN;
+		v4l2_err(sd, "IR receiver hardware FIFO overrun\n");
+	}
+	if (rte && rto) {
+		/*
+		 * The IR Receiver Enable (CNTRL_RXE) must be toggled to clear
+		 * the Rx Pulse Width Timer Time Out (STATS_RTO)
+		 */
+		v |= CNTRL_RXE;
+		events |= V4L2_SUBDEV_IR_RX_END_OF_RX_DETECTED;
+	}
+	if (v) {
+		/* Clear STATS_ROR & STATS_RTO as needed by reseting hardware */
+		cx23888_ir_write4(dev, CX23888_IR_CNTRL_REG, cntrl & ~v);
+		cx23888_ir_write4(dev, CX23888_IR_CNTRL_REG, cntrl);
+		*handled = true;
+	}
+
+	spin_lock_irqsave(&state->rx_kfifo_lock, flags);
+	if (kfifo_len(&state->rx_kfifo) >= CX23888_IR_RX_KFIFO_SIZE / 2)
+		events |= V4L2_SUBDEV_IR_RX_FIFO_SERVICE_REQ;
+	spin_unlock_irqrestore(&state->rx_kfifo_lock, flags);
+
+	if (events)
+		v4l2_subdev_notify(sd, V4L2_SUBDEV_IR_RX_NOTIFY, &events);
+	return 0;
+}
+
+/* Receiver */
+static int cx23888_ir_rx_read(struct v4l2_subdev *sd, u8 *buf, size_t count,
+			      ssize_t *num)
+{
+	struct cx23888_ir_state *state = to_state(sd);
+	bool invert = (bool) atomic_read(&state->rx_invert);
+	u16 divider = (u16) atomic_read(&state->rxclk_divider);
+
+	unsigned int i, n;
+	u32 *p;
+	u32 u, v;
+
+	n = count / sizeof(u32) * sizeof(u32);
+	if (n == 0) {
+		*num = 0;
+		return 0;
+	}
+
+	n = kfifo_out_locked(&state->rx_kfifo, buf, n, &state->rx_kfifo_lock);
+
+	n /= sizeof(u32);
+	*num = n * sizeof(u32);
+
+	for (p = (u32 *) buf, i = 0; i < n; p++, i++) {
+		if ((*p & FIFO_RXTX_RTO) == FIFO_RXTX_RTO) {
+			*p = V4L2_SUBDEV_IR_PULSE_RX_SEQ_END;
+			v4l2_dbg(2, ir_888_debug, sd, "rx read: end of rx\n");
+			continue;
+		}
+
+		u = (*p & FIFO_RXTX_LVL) ? V4L2_SUBDEV_IR_PULSE_LEVEL_MASK : 0;
+		if (invert)
+			u = u ? 0 : V4L2_SUBDEV_IR_PULSE_LEVEL_MASK;
+
+		v = (u32) pulse_width_count_to_ns((u16) (*p & FIFO_RXTX),
+						  divider);
+		if (v >= V4L2_SUBDEV_IR_PULSE_MAX_WIDTH_NS)
+			v = V4L2_SUBDEV_IR_PULSE_MAX_WIDTH_NS - 1;
+
+		*p = u | v;
+
+		v4l2_dbg(2, ir_888_debug, sd, "rx read: %10u ns  %s\n",
+			 v, u ? "mark" : "space");
+	}
+	return 0;
+}
+
+static int cx23888_ir_rx_g_parameters(struct v4l2_subdev *sd,
+				      struct v4l2_subdev_ir_parameters *p)
+{
+	struct cx23888_ir_state *state = to_state(sd);
+	mutex_lock(&state->rx_params_lock);
+	memcpy(p, &state->rx_params, sizeof(struct v4l2_subdev_ir_parameters));
+	mutex_unlock(&state->rx_params_lock);
+	return 0;
+}
+
+static int cx23888_ir_rx_shutdown(struct v4l2_subdev *sd)
+{
+	struct cx23888_ir_state *state = to_state(sd);
+	struct cx23885_dev *dev = state->dev;
+
+	mutex_lock(&state->rx_params_lock);
+
+	/* Disable or slow down all IR Rx circuits and counters */
+	irqenable_rx(dev, 0);
+	control_rx_enable(dev, false);
+	control_rx_demodulation_enable(dev, false);
+	control_rx_s_edge_detection(dev, CNTRL_EDG_NONE);
+	filter_rx_s_min_width(dev, 0);
+	cx23888_ir_write4(dev, CX23888_IR_RXCLK_REG, RXCLK_RCD);
+
+	state->rx_params.shutdown = true;
+
+	mutex_unlock(&state->rx_params_lock);
+	return 0;
+}
+
+static int cx23888_ir_rx_s_parameters(struct v4l2_subdev *sd,
+				      struct v4l2_subdev_ir_parameters *p)
+{
+	struct cx23888_ir_state *state = to_state(sd);
+	struct cx23885_dev *dev = state->dev;
+	struct v4l2_subdev_ir_parameters *o = &state->rx_params;
+	u16 rxclk_divider;
+
+	if (p->shutdown)
+		return cx23888_ir_rx_shutdown(sd);
+
+	if (p->mode != V4L2_SUBDEV_IR_MODE_PULSE_WIDTH)
+		return -ENOSYS;
+
+	mutex_lock(&state->rx_params_lock);
+
+	o->shutdown = p->shutdown;
+
+	o->mode = p->mode = V4L2_SUBDEV_IR_MODE_PULSE_WIDTH;
+
+	o->bytes_per_data_element = p->bytes_per_data_element = sizeof(u32);
+
+	/* Before we tweak the hardware, we have to disable the receiver */
+	irqenable_rx(dev, 0);
+	control_rx_enable(dev, false);
+
+	control_rx_demodulation_enable(dev, p->modulation);
+	o->modulation = p->modulation;
+
+	if (p->modulation) {
+		p->carrier_freq = rxclk_rx_s_carrier(dev, p->carrier_freq,
+						     &rxclk_divider);
+
+		o->carrier_freq = p->carrier_freq;
+
+		o->duty_cycle = p->duty_cycle = 50;
+
+		control_rx_s_carrier_window(dev, p->carrier_freq,
+					    &p->carrier_range_lower,
+					    &p->carrier_range_upper);
+		o->carrier_range_lower = p->carrier_range_lower;
+		o->carrier_range_upper = p->carrier_range_upper;
+	} else {
+		p->max_pulse_width =
+			    rxclk_rx_s_max_pulse_width(dev, p->max_pulse_width,
+						       &rxclk_divider);
+		o->max_pulse_width = p->max_pulse_width;
+	}
+	atomic_set(&state->rxclk_divider, rxclk_divider);
+
+	p->noise_filter_min_width =
+			  filter_rx_s_min_width(dev, p->noise_filter_min_width);
+	o->noise_filter_min_width = p->noise_filter_min_width;
+
+	p->resolution = clock_divider_to_resolution(rxclk_divider);
+	o->resolution = p->resolution;
+
+	/* FIXME - make this dependent on resolution for better performance */
+	control_rx_irq_watermark(dev, RX_FIFO_HALF_FULL);
+
+	control_rx_s_edge_detection(dev, CNTRL_EDG_BOTH);
+
+	o->invert = p->invert;
+	atomic_set(&state->rx_invert, p->invert);
+
+	o->interrupt_enable = p->interrupt_enable;
+	o->enable = p->enable;
+	if (p->enable) {
+		unsigned long flags;
+
+		spin_lock_irqsave(&state->rx_kfifo_lock, flags);
+		kfifo_reset(&state->rx_kfifo);
+		/* reset tx_fifo too if there is one... */
+		spin_unlock_irqrestore(&state->rx_kfifo_lock, flags);
+		if (p->interrupt_enable)
+			irqenable_rx(dev, IRQEN_RSE | IRQEN_RTE | IRQEN_ROE);
+		control_rx_enable(dev, p->enable);
+	}
+
+	mutex_unlock(&state->rx_params_lock);
+	return 0;
+}
+
+/* Transmitter */
+static int cx23888_ir_tx_write(struct v4l2_subdev *sd, u8 *buf, size_t count,
+			       ssize_t *num)
+{
+	struct cx23888_ir_state *state = to_state(sd);
+	struct cx23885_dev *dev = state->dev;
+	/* For now enable the Tx FIFO Service interrupt & pretend we did work */
+	irqenable_tx(dev, IRQEN_TSE);
+	*num = count;
+	return 0;
+}
+
+static int cx23888_ir_tx_g_parameters(struct v4l2_subdev *sd,
+				      struct v4l2_subdev_ir_parameters *p)
+{
+	struct cx23888_ir_state *state = to_state(sd);
+	mutex_lock(&state->tx_params_lock);
+	memcpy(p, &state->tx_params, sizeof(struct v4l2_subdev_ir_parameters));
+	mutex_unlock(&state->tx_params_lock);
+	return 0;
+}
+
+static int cx23888_ir_tx_shutdown(struct v4l2_subdev *sd)
+{
+	struct cx23888_ir_state *state = to_state(sd);
+	struct cx23885_dev *dev = state->dev;
+
+	mutex_lock(&state->tx_params_lock);
+
+	/* Disable or slow down all IR Tx circuits and counters */
+	irqenable_tx(dev, 0);
+	control_tx_enable(dev, false);
+	control_tx_modulation_enable(dev, false);
+	cx23888_ir_write4(dev, CX23888_IR_TXCLK_REG, TXCLK_TCD);
+
+	state->tx_params.shutdown = true;
+
+	mutex_unlock(&state->tx_params_lock);
+	return 0;
+}
+
+static int cx23888_ir_tx_s_parameters(struct v4l2_subdev *sd,
+				      struct v4l2_subdev_ir_parameters *p)
+{
+	struct cx23888_ir_state *state = to_state(sd);
+	struct cx23885_dev *dev = state->dev;
+	struct v4l2_subdev_ir_parameters *o = &state->tx_params;
+	u16 txclk_divider;
+
+	if (p->shutdown)
+		return cx23888_ir_tx_shutdown(sd);
+
+	if (p->mode != V4L2_SUBDEV_IR_MODE_PULSE_WIDTH)
+		return -ENOSYS;
+
+	mutex_lock(&state->tx_params_lock);
+
+	o->shutdown = p->shutdown;
+
+	o->mode = p->mode = V4L2_SUBDEV_IR_MODE_PULSE_WIDTH;
+
+	o->bytes_per_data_element = p->bytes_per_data_element = sizeof(u32);
+
+	/* Before we tweak the hardware, we have to disable the transmitter */
+	irqenable_tx(dev, 0);
+	control_tx_enable(dev, false);
+
+	control_tx_modulation_enable(dev, p->modulation);
+	o->modulation = p->modulation;
+
+	if (p->modulation) {
+		p->carrier_freq = txclk_tx_s_carrier(dev, p->carrier_freq,
+						     &txclk_divider);
+		o->carrier_freq = p->carrier_freq;
+
+		p->duty_cycle = cduty_tx_s_duty_cycle(dev, p->duty_cycle);
+		o->duty_cycle = p->duty_cycle;
+	} else {
+		p->max_pulse_width =
+			    txclk_tx_s_max_pulse_width(dev, p->max_pulse_width,
+						       &txclk_divider);
+		o->max_pulse_width = p->max_pulse_width;
+	}
+	atomic_set(&state->txclk_divider, txclk_divider);
+
+	p->resolution = clock_divider_to_resolution(txclk_divider);
+	o->resolution = p->resolution;
+
+	/* FIXME - make this dependent on resolution for better performance */
+	control_tx_irq_watermark(dev, TX_FIFO_HALF_EMPTY);
+
+	control_tx_polarity_invert(dev, p->invert);
+	o->invert = p->invert;
+
+	o->interrupt_enable = p->interrupt_enable;
+	o->enable = p->enable;
+	if (p->enable) {
+		if (p->interrupt_enable)
+			irqenable_tx(dev, IRQEN_TSE);
+		control_tx_enable(dev, p->enable);
+	}
+
+	mutex_unlock(&state->tx_params_lock);
+	return 0;
+}
+
+
+/*
+ * V4L2 Subdevice Core Ops
+ */
+static int cx23888_ir_log_status(struct v4l2_subdev *sd)
+{
+	struct cx23888_ir_state *state = to_state(sd);
+	struct cx23885_dev *dev = state->dev;
+	char *s;
+	int i, j;
+
+	u32 cntrl = cx23888_ir_read4(dev, CX23888_IR_CNTRL_REG);
+	u32 txclk = cx23888_ir_read4(dev, CX23888_IR_TXCLK_REG) & TXCLK_TCD;
+	u32 rxclk = cx23888_ir_read4(dev, CX23888_IR_RXCLK_REG) & RXCLK_RCD;
+	u32 cduty = cx23888_ir_read4(dev, CX23888_IR_CDUTY_REG) & CDUTY_CDC;
+	u32 stats = cx23888_ir_read4(dev, CX23888_IR_STATS_REG);
+	u32 irqen = cx23888_ir_read4(dev, CX23888_IR_IRQEN_REG);
+	u32 filtr = cx23888_ir_read4(dev, CX23888_IR_FILTR_REG) & FILTR_LPF;
+
+	v4l2_info(sd, "IR Receiver:\n");
+	v4l2_info(sd, "\tEnabled:                           %s\n",
+		  cntrl & CNTRL_RXE ? "yes" : "no");
+	v4l2_info(sd, "\tDemodulation from a carrier:       %s\n",
+		  cntrl & CNTRL_DMD ? "enabled" : "disabled");
+	v4l2_info(sd, "\tFIFO:                              %s\n",
+		  cntrl & CNTRL_RFE ? "enabled" : "disabled");
+	switch (cntrl & CNTRL_EDG) {
+	case CNTRL_EDG_NONE:
+		s = "disabled";
+		break;
+	case CNTRL_EDG_FALL:
+		s = "falling edge";
+		break;
+	case CNTRL_EDG_RISE:
+		s = "rising edge";
+		break;
+	case CNTRL_EDG_BOTH:
+		s = "rising & falling edges";
+		break;
+	default:
+		s = "??? edge";
+		break;
+	}
+	v4l2_info(sd, "\tPulse timers' start/stop trigger:  %s\n", s);
+	v4l2_info(sd, "\tFIFO data on pulse timer overflow: %s\n",
+		  cntrl & CNTRL_R ? "not loaded" : "overflow marker");
+	v4l2_info(sd, "\tFIFO interrupt watermark:          %s\n",
+		  cntrl & CNTRL_RIC ? "not empty" : "half full or greater");
+	v4l2_info(sd, "\tLoopback mode:                     %s\n",
+		  cntrl & CNTRL_LBM ? "loopback active" : "normal receive");
+	if (cntrl & CNTRL_DMD) {
+		v4l2_info(sd, "\tExpected carrier (16 clocks):      %u Hz\n",
+			  clock_divider_to_carrier_freq(rxclk));
+		switch (cntrl & CNTRL_WIN) {
+		case CNTRL_WIN_3_3:
+			i = 3;
+			j = 3;
+			break;
+		case CNTRL_WIN_4_3:
+			i = 4;
+			j = 3;
+			break;
+		case CNTRL_WIN_3_4:
+			i = 3;
+			j = 4;
+			break;
+		case CNTRL_WIN_4_4:
+			i = 4;
+			j = 4;
+			break;
+		default:
+			i = 0;
+			j = 0;
+			break;
+		}
+		v4l2_info(sd, "\tNext carrier edge window:          16 clocks "
+			  "-%1d/+%1d, %u to %u Hz\n", i, j,
+			  clock_divider_to_freq(rxclk, 16 + j),
+			  clock_divider_to_freq(rxclk, 16 - i));
+	} else {
+		v4l2_info(sd, "\tMax measurable pulse width:        %u us, "
+			  "%llu ns\n",
+			  pulse_width_count_to_us(FIFO_RXTX, rxclk),
+			  pulse_width_count_to_ns(FIFO_RXTX, rxclk));
+	}
+	v4l2_info(sd, "\tLow pass filter:                   %s\n",
+		  filtr ? "enabled" : "disabled");
+	if (filtr)
+		v4l2_info(sd, "\tMin acceptable pulse width (LPF):  %u us, "
+			  "%u ns\n",
+			  lpf_count_to_us(filtr),
+			  lpf_count_to_ns(filtr));
+	v4l2_info(sd, "\tPulse width timer timed-out:       %s\n",
+		  stats & STATS_RTO ? "yes" : "no");
+	v4l2_info(sd, "\tPulse width timer time-out intr:   %s\n",
+		  irqen & IRQEN_RTE ? "enabled" : "disabled");
+	v4l2_info(sd, "\tFIFO overrun:                      %s\n",
+		  stats & STATS_ROR ? "yes" : "no");
+	v4l2_info(sd, "\tFIFO overrun interrupt:            %s\n",
+		  irqen & IRQEN_ROE ? "enabled" : "disabled");
+	v4l2_info(sd, "\tBusy:                              %s\n",
+		  stats & STATS_RBY ? "yes" : "no");
+	v4l2_info(sd, "\tFIFO service requested:            %s\n",
+		  stats & STATS_RSR ? "yes" : "no");
+	v4l2_info(sd, "\tFIFO service request interrupt:    %s\n",
+		  irqen & IRQEN_RSE ? "enabled" : "disabled");
+
+	v4l2_info(sd, "IR Transmitter:\n");
+	v4l2_info(sd, "\tEnabled:                           %s\n",
+		  cntrl & CNTRL_TXE ? "yes" : "no");
+	v4l2_info(sd, "\tModulation onto a carrier:         %s\n",
+		  cntrl & CNTRL_MOD ? "enabled" : "disabled");
+	v4l2_info(sd, "\tFIFO:                              %s\n",
+		  cntrl & CNTRL_TFE ? "enabled" : "disabled");
+	v4l2_info(sd, "\tFIFO interrupt watermark:          %s\n",
+		  cntrl & CNTRL_TIC ? "not empty" : "half full or less");
+	v4l2_info(sd, "\tSignal polarity:                   %s\n",
+		  cntrl & CNTRL_CPL ? "0:mark 1:space" : "0:space 1:mark");
+	if (cntrl & CNTRL_MOD) {
+		v4l2_info(sd, "\tCarrier (16 clocks):               %u Hz\n",
+			  clock_divider_to_carrier_freq(txclk));
+		v4l2_info(sd, "\tCarrier duty cycle:                %2u/16\n",
+			  cduty + 1);
+	} else {
+		v4l2_info(sd, "\tMax pulse width:                   %u us, "
+			  "%llu ns\n",
+			  pulse_width_count_to_us(FIFO_RXTX, txclk),
+			  pulse_width_count_to_ns(FIFO_RXTX, txclk));
+	}
+	v4l2_info(sd, "\tBusy:                              %s\n",
+		  stats & STATS_TBY ? "yes" : "no");
+	v4l2_info(sd, "\tFIFO service requested:            %s\n",
+		  stats & STATS_TSR ? "yes" : "no");
+	v4l2_info(sd, "\tFIFO service request interrupt:    %s\n",
+		  irqen & IRQEN_TSE ? "enabled" : "disabled");
+
+	return 0;
+}
+
+static inline int cx23888_ir_dbg_match(const struct v4l2_dbg_match *match)
+{
+	return match->type == V4L2_CHIP_MATCH_HOST && match->addr == 2;
+}
+
+static int cx23888_ir_g_chip_ident(struct v4l2_subdev *sd,
+				   struct v4l2_dbg_chip_ident *chip)
+{
+	struct cx23888_ir_state *state = to_state(sd);
+
+	if (cx23888_ir_dbg_match(&chip->match)) {
+		chip->ident = state->id;
+		chip->revision = state->rev;
+	}
+	return 0;
+}
+
+#ifdef CONFIG_VIDEO_ADV_DEBUG
+static int cx23888_ir_g_register(struct v4l2_subdev *sd,
+				 struct v4l2_dbg_register *reg)
+{
+	struct cx23888_ir_state *state = to_state(sd);
+	u32 addr = CX23888_IR_REG_BASE + (u32) reg->reg;
+
+	if (!cx23888_ir_dbg_match(&reg->match))
+		return -EINVAL;
+	if ((addr & 0x3) != 0)
+		return -EINVAL;
+	if (addr < CX23888_IR_CNTRL_REG || addr > CX23888_IR_LEARN_REG)
+		return -EINVAL;
+	if (!capable(CAP_SYS_ADMIN))
+		return -EPERM;
+	reg->size = 4;
+	reg->val = cx23888_ir_read4(state->dev, addr);
+	return 0;
+}
+
+static int cx23888_ir_s_register(struct v4l2_subdev *sd,
+				 struct v4l2_dbg_register *reg)
+{
+	struct cx23888_ir_state *state = to_state(sd);
+	u32 addr = CX23888_IR_REG_BASE + (u32) reg->reg;
+
+	if (!cx23888_ir_dbg_match(&reg->match))
+		return -EINVAL;
+	if ((addr & 0x3) != 0)
+		return -EINVAL;
+	if (addr < CX23888_IR_CNTRL_REG || addr > CX23888_IR_LEARN_REG)
+		return -EINVAL;
+	if (!capable(CAP_SYS_ADMIN))
+		return -EPERM;
+	cx23888_ir_write4(state->dev, addr, reg->val);
+	return 0;
+}
+#endif
+
+static const struct v4l2_subdev_core_ops cx23888_ir_core_ops = {
+	.g_chip_ident = cx23888_ir_g_chip_ident,
+	.log_status = cx23888_ir_log_status,
+#ifdef CONFIG_VIDEO_ADV_DEBUG
+	.g_register = cx23888_ir_g_register,
+	.s_register = cx23888_ir_s_register,
+#endif
+};
+
+static const struct v4l2_subdev_ir_ops cx23888_ir_ir_ops = {
+	.interrupt_service_routine = cx23888_ir_irq_handler,
+
+	.rx_read = cx23888_ir_rx_read,
+	.rx_g_parameters = cx23888_ir_rx_g_parameters,
+	.rx_s_parameters = cx23888_ir_rx_s_parameters,
+
+	.tx_write = cx23888_ir_tx_write,
+	.tx_g_parameters = cx23888_ir_tx_g_parameters,
+	.tx_s_parameters = cx23888_ir_tx_s_parameters,
+};
+
+static const struct v4l2_subdev_ops cx23888_ir_controller_ops = {
+	.core = &cx23888_ir_core_ops,
+	.ir = &cx23888_ir_ir_ops,
+};
+
+static const struct v4l2_subdev_ir_parameters default_rx_params = {
+	.bytes_per_data_element = sizeof(u32),
+	.mode = V4L2_SUBDEV_IR_MODE_PULSE_WIDTH,
+
+	.enable = false,
+	.interrupt_enable = false,
+	.shutdown = true,
+
+	.modulation = true,
+	.carrier_freq = 36000, /* 36 kHz - RC-5, RC-6, and RC-6A carrier */
+
+	/* RC-5:    666,667 ns = 1/36 kHz * 32 cycles * 1 mark * 0.75 */
+	/* RC-6A:   333,333 ns = 1/36 kHz * 16 cycles * 1 mark * 0.75 */
+	.noise_filter_min_width = 333333, /* ns */
+	.carrier_range_lower = 35000,
+	.carrier_range_upper = 37000,
+	.invert = false,
+};
+
+static const struct v4l2_subdev_ir_parameters default_tx_params = {
+	.bytes_per_data_element = sizeof(u32),
+	.mode = V4L2_SUBDEV_IR_MODE_PULSE_WIDTH,
+
+	.enable = false,
+	.interrupt_enable = false,
+	.shutdown = true,
+
+	.modulation = true,
+	.carrier_freq = 36000, /* 36 kHz - RC-5 carrier */
+	.duty_cycle = 25,      /* 25 %   - RC-5 carrier */
+	.invert = false,
+};
+
+int cx23888_ir_probe(struct cx23885_dev *dev)
+{
+	struct cx23888_ir_state *state;
+	struct v4l2_subdev *sd;
+	struct v4l2_subdev_ir_parameters default_params;
+	int ret;
+
+	state = kzalloc(sizeof(struct cx23888_ir_state), GFP_KERNEL);
+	if (state == NULL)
+		return -ENOMEM;
+
+	spin_lock_init(&state->rx_kfifo_lock);
+	if (kfifo_alloc(&state->rx_kfifo, CX23888_IR_RX_KFIFO_SIZE, GFP_KERNEL))
+		return -ENOMEM;
+
+	state->dev = dev;
+	state->id = V4L2_IDENT_CX23888_IR;
+	state->rev = 0;
+	sd = &state->sd;
+
+	v4l2_subdev_init(sd, &cx23888_ir_controller_ops);
+	v4l2_set_subdevdata(sd, state);
+	/* FIXME - fix the formatting of dev->v4l2_dev.name and use it */
+	snprintf(sd->name, sizeof(sd->name), "%s/888-ir", dev->name);
+	sd->grp_id = CX23885_HW_888_IR;
+
+	ret = v4l2_device_register_subdev(&dev->v4l2_dev, sd);
+	if (ret == 0) {
+		/*
+		 * Ensure no interrupts arrive from '888 specific conditions,
+		 * since we ignore them in this driver to have commonality with
+		 * similar IR controller cores.
+		 */
+		cx23888_ir_write4(dev, CX23888_IR_IRQEN_REG, 0);
+
+		mutex_init(&state->rx_params_lock);
+		memcpy(&default_params, &default_rx_params,
+		       sizeof(struct v4l2_subdev_ir_parameters));
+		v4l2_subdev_call(sd, ir, rx_s_parameters, &default_params);
+
+		mutex_init(&state->tx_params_lock);
+		memcpy(&default_params, &default_tx_params,
+		       sizeof(struct v4l2_subdev_ir_parameters));
+		v4l2_subdev_call(sd, ir, tx_s_parameters, &default_params);
+	} else {
+		kfifo_free(&state->rx_kfifo);
+	}
+	return ret;
+}
+
+int cx23888_ir_remove(struct cx23885_dev *dev)
+{
+	struct v4l2_subdev *sd;
+	struct cx23888_ir_state *state;
+
+	sd = cx23885_find_hw(dev, CX23885_HW_888_IR);
+	if (sd == NULL)
+		return -ENODEV;
+
+	cx23888_ir_rx_shutdown(sd);
+	cx23888_ir_tx_shutdown(sd);
+
+	state = to_state(sd);
+	v4l2_device_unregister_subdev(sd);
+	kfifo_free(&state->rx_kfifo);
+	kfree(state);
+	/* Nothing more to free() as state held the actual v4l2_subdev object */
+	return 0;
+}
diff --git a/drivers/media/video/cx23885/cx23888-ir.h b/drivers/media/video/cx23885/cx23888-ir.h
new file mode 100644
index 000000000000..3d446f9eb94b
--- /dev/null
+++ b/drivers/media/video/cx23885/cx23888-ir.h
@@ -0,0 +1,28 @@
+/*
+ *  Driver for the Conexant CX23885/7/8 PCIe bridge
+ *
+ *  CX23888 Integrated Consumer Infrared Controller
+ *
+ *  Copyright (C) 2009  Andy Walls <awalls@radix.net>
+ *
+ *  This program is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU General Public License
+ *  as published by the Free Software Foundation; either version 2
+ *  of the License, or (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ *  02110-1301, USA.
+ */
+
+#ifndef _CX23888_IR_H_
+#define _CX23888_IR_H_
+int cx23888_ir_probe(struct cx23885_dev *dev);
+int cx23888_ir_remove(struct cx23885_dev *dev);
+#endif
diff --git a/drivers/media/video/cx25840/cx25840-audio.c b/drivers/media/video/cx25840/cx25840-audio.c
index 2f846f5e0f9f..45608d50529c 100644
--- a/drivers/media/video/cx25840/cx25840-audio.c
+++ b/drivers/media/video/cx25840/cx25840-audio.c
@@ -23,87 +23,137 @@
 
 #include "cx25840-core.h"
 
-static int set_audclk_freq(struct i2c_client *client, u32 freq)
+/*
+ * Note: The PLL and SRC parameters are based on a reference frequency that
+ * would ideally be:
+ *
+ * NTSC Color subcarrier freq * 8 = 4.5 MHz/286 * 455/2 * 8 = 28.63636363... MHz
+ *
+ * However, it's not the exact reference frequency that matters, only that the
+ * firmware and modules that comprise the driver for a particular board all
+ * use the same value (close to the ideal value).
+ *
+ * Comments below will note which reference frequency is assumed for various
+ * parameters.  They will usually be one of
+ *
+ *	ref_freq = 28.636360 MHz
+ *		or
+ *	ref_freq = 28.636363 MHz
+ */
+
+static int cx25840_set_audclk_freq(struct i2c_client *client, u32 freq)
 {
 	struct cx25840_state *state = to_state(i2c_get_clientdata(client));
 
-	if (freq != 32000 && freq != 44100 && freq != 48000)
-		return -EINVAL;
-
-	/* common for all inputs and rates */
-	/* SA_MCLK_SEL=1, SA_MCLK_DIV=0x10 */
-	if (!state->is_cx23885 && !state->is_cx231xx)
-		cx25840_write(client, 0x127, 0x50);
-
 	if (state->aud_input != CX25840_AUDIO_SERIAL) {
 		switch (freq) {
 		case 32000:
-			if (state->is_cx23885) {
-				/* We don't have register values
-				 * so avoid destroying registers. */
-				break;
-			}
-
-			if (!state->is_cx231xx) {
-				/* VID_PLL and AUX_PLL */
-				cx25840_write4(client, 0x108, 0x1006040f);
-
-				/* AUX_PLL_FRAC */
-				cx25840_write4(client, 0x110, 0x01bb39ee);
-			}
-
-			if (state->is_cx25836)
+			/*
+			 * VID_PLL Integer = 0x0f, VID_PLL Post Divider = 0x04
+			 * AUX_PLL Integer = 0x06, AUX PLL Post Divider = 0x10
+			 */
+			cx25840_write4(client, 0x108, 0x1006040f);
+
+			/*
+			 * VID_PLL Fraction (register 0x10c) = 0x2be2fe
+			 * 28636360 * 0xf.15f17f0/4 = 108 MHz
+			 * 432 MHz pre-postdivide
+			 */
+
+			/*
+			 * AUX_PLL Fraction = 0x1bb39ee
+			 * 28636363 * 0x6.dd9cf70/0x10 = 32000 * 384
+			 * 196.6 MHz pre-postdivide
+			 * FIXME < 200 MHz is out of specified valid range
+			 * FIXME 28636363 ref_freq doesn't match VID PLL ref
+			 */
+			cx25840_write4(client, 0x110, 0x01bb39ee);
+
+			/*
+			 * SA_MCLK_SEL = 1
+			 * SA_MCLK_DIV = 0x10 = 384/384 * AUX_PLL post dvivider
+			 */
+			cx25840_write(client, 0x127, 0x50);
+
+			if (is_cx2583x(state))
 				break;
 
-			/* src3/4/6_ctl = 0x0801f77f */
+			/* src3/4/6_ctl */
+			/* 0x1.f77f = (4 * 28636360/8 * 2/455) / 32000 */
 			cx25840_write4(client, 0x900, 0x0801f77f);
 			cx25840_write4(client, 0x904, 0x0801f77f);
 			cx25840_write4(client, 0x90c, 0x0801f77f);
 			break;
 
 		case 44100:
-			if (state->is_cx23885) {
-				/* We don't have register values
-				 * so avoid destroying registers. */
+			/*
+			 * VID_PLL Integer = 0x0f, VID_PLL Post Divider = 0x04
+			 * AUX_PLL Integer = 0x09, AUX PLL Post Divider = 0x10
+			 */
+			cx25840_write4(client, 0x108, 0x1009040f);
+
+			/*
+			 * VID_PLL Fraction (register 0x10c) = 0x2be2fe
+			 * 28636360 * 0xf.15f17f0/4 = 108 MHz
+			 * 432 MHz pre-postdivide
+			 */
+
+			/*
+			 * AUX_PLL Fraction = 0x0ec6bd6
+			 * 28636363 * 0x9.7635eb0/0x10 = 44100 * 384
+			 * 271 MHz pre-postdivide
+			 * FIXME 28636363 ref_freq doesn't match VID PLL ref
+			 */
+			cx25840_write4(client, 0x110, 0x00ec6bd6);
+
+			/*
+			 * SA_MCLK_SEL = 1
+			 * SA_MCLK_DIV = 0x10 = 384/384 * AUX_PLL post dvivider
+			 */
+			cx25840_write(client, 0x127, 0x50);
+
+			if (is_cx2583x(state))
 				break;
-			}
-
-			if (!state->is_cx231xx) {
-				/* VID_PLL and AUX_PLL */
-				cx25840_write4(client, 0x108, 0x1009040f);
-
-				/* AUX_PLL_FRAC */
-				cx25840_write4(client, 0x110, 0x00ec6bd6);
-			}
 
-			if (state->is_cx25836)
-				break;
-
-			/* src3/4/6_ctl = 0x08016d59 */
+			/* src3/4/6_ctl */
+			/* 0x1.6d59 = (4 * 28636360/8 * 2/455) / 44100 */
 			cx25840_write4(client, 0x900, 0x08016d59);
 			cx25840_write4(client, 0x904, 0x08016d59);
 			cx25840_write4(client, 0x90c, 0x08016d59);
 			break;
 
 		case 48000:
-			if (state->is_cx23885) {
-				/* We don't have register values
-				 * so avoid destroying registers. */
-				break;
-			}
-
-			if (!state->is_cx231xx) {
-				/* VID_PLL and AUX_PLL */
-				cx25840_write4(client, 0x108, 0x100a040f);
-
-				/* AUX_PLL_FRAC */
-				cx25840_write4(client, 0x110, 0x0098d6e5);
-			}
-
-			if (state->is_cx25836)
+			/*
+			 * VID_PLL Integer = 0x0f, VID_PLL Post Divider = 0x04
+			 * AUX_PLL Integer = 0x0a, AUX PLL Post Divider = 0x10
+			 */
+			cx25840_write4(client, 0x108, 0x100a040f);
+
+			/*
+			 * VID_PLL Fraction (register 0x10c) = 0x2be2fe
+			 * 28636360 * 0xf.15f17f0/4 = 108 MHz
+			 * 432 MHz pre-postdivide
+			 */
+
+			/*
+			 * AUX_PLL Fraction = 0x098d6e5
+			 * 28636363 * 0xa.4c6b728/0x10 = 48000 * 384
+			 * 295 MHz pre-postdivide
+			 * FIXME 28636363 ref_freq doesn't match VID PLL ref
+			 */
+			cx25840_write4(client, 0x110, 0x0098d6e5);
+
+			/*
+			 * SA_MCLK_SEL = 1
+			 * SA_MCLK_DIV = 0x10 = 384/384 * AUX_PLL post dvivider
+			 */
+			cx25840_write(client, 0x127, 0x50);
+
+			if (is_cx2583x(state))
 				break;
 
-			/* src3/4/6_ctl = 0x08014faa */
+			/* src3/4/6_ctl */
+			/* 0x1.4faa = (4 * 28636360/8 * 2/455) / 48000 */
 			cx25840_write4(client, 0x900, 0x08014faa);
 			cx25840_write4(client, 0x904, 0x08014faa);
 			cx25840_write4(client, 0x90c, 0x08014faa);
@@ -112,91 +162,249 @@ static int set_audclk_freq(struct i2c_client *client, u32 freq)
 	} else {
 		switch (freq) {
 		case 32000:
-			if (state->is_cx23885) {
-				/* We don't have register values
-				 * so avoid destroying registers. */
-				break;
-			}
-
-			if (!state->is_cx231xx) {
-				/* VID_PLL and AUX_PLL */
-				cx25840_write4(client, 0x108, 0x1e08040f);
-
-				/* AUX_PLL_FRAC */
-				cx25840_write4(client, 0x110, 0x012a0869);
-			}
+			/*
+			 * VID_PLL Integer = 0x0f, VID_PLL Post Divider = 0x04
+			 * AUX_PLL Integer = 0x08, AUX PLL Post Divider = 0x1e
+			 */
+			cx25840_write4(client, 0x108, 0x1e08040f);
+
+			/*
+			 * VID_PLL Fraction (register 0x10c) = 0x2be2fe
+			 * 28636360 * 0xf.15f17f0/4 = 108 MHz
+			 * 432 MHz pre-postdivide
+			 */
+
+			/*
+			 * AUX_PLL Fraction = 0x12a0869
+			 * 28636363 * 0x8.9504348/0x1e = 32000 * 256
+			 * 246 MHz pre-postdivide
+			 * FIXME 28636363 ref_freq doesn't match VID PLL ref
+			 */
+			cx25840_write4(client, 0x110, 0x012a0869);
+
+			/*
+			 * SA_MCLK_SEL = 1
+			 * SA_MCLK_DIV = 0x14 = 256/384 * AUX_PLL post dvivider
+			 */
+			cx25840_write(client, 0x127, 0x54);
 
-			if (state->is_cx25836)
+			if (is_cx2583x(state))
 				break;
 
-			/* src1_ctl = 0x08010000 */
+			/* src1_ctl */
+			/* 0x1.0000 = 32000/32000 */
 			cx25840_write4(client, 0x8f8, 0x08010000);
 
-			/* src3/4/6_ctl = 0x08020000 */
+			/* src3/4/6_ctl */
+			/* 0x2.0000 = 2 * (32000/32000) */
 			cx25840_write4(client, 0x900, 0x08020000);
 			cx25840_write4(client, 0x904, 0x08020000);
 			cx25840_write4(client, 0x90c, 0x08020000);
-
-			/* SA_MCLK_SEL=1, SA_MCLK_DIV=0x14 */
-			cx25840_write(client, 0x127, 0x54);
 			break;
 
 		case 44100:
-			if (state->is_cx23885) {
-				/* We don't have register values
-				 * so avoid destroying registers. */
-				break;
-			}
-
-
-			if (!state->is_cx231xx) {
-				/* VID_PLL and AUX_PLL */
-				cx25840_write4(client, 0x108, 0x1809040f);
-
-				/* AUX_PLL_FRAC */
-				cx25840_write4(client, 0x110, 0x00ec6bd6);
-			}
-
-			if (state->is_cx25836)
+			/*
+			 * VID_PLL Integer = 0x0f, VID_PLL Post Divider = 0x04
+			 * AUX_PLL Integer = 0x09, AUX PLL Post Divider = 0x18
+			 */
+			cx25840_write4(client, 0x108, 0x1809040f);
+
+			/*
+			 * VID_PLL Fraction (register 0x10c) = 0x2be2fe
+			 * 28636360 * 0xf.15f17f0/4 = 108 MHz
+			 * 432 MHz pre-postdivide
+			 */
+
+			/*
+			 * AUX_PLL Fraction = 0x0ec6bd6
+			 * 28636363 * 0x9.7635eb0/0x18 = 44100 * 256
+			 * 271 MHz pre-postdivide
+			 * FIXME 28636363 ref_freq doesn't match VID PLL ref
+			 */
+			cx25840_write4(client, 0x110, 0x00ec6bd6);
+
+			/*
+			 * SA_MCLK_SEL = 1
+			 * SA_MCLK_DIV = 0x10 = 256/384 * AUX_PLL post dvivider
+			 */
+			cx25840_write(client, 0x127, 0x50);
+
+			if (is_cx2583x(state))
 				break;
 
-			/* src1_ctl = 0x08010000 */
+			/* src1_ctl */
+			/* 0x1.60cd = 44100/32000 */
 			cx25840_write4(client, 0x8f8, 0x080160cd);
 
-			/* src3/4/6_ctl = 0x08020000 */
+			/* src3/4/6_ctl */
+			/* 0x1.7385 = 2 * (32000/44100) */
 			cx25840_write4(client, 0x900, 0x08017385);
 			cx25840_write4(client, 0x904, 0x08017385);
 			cx25840_write4(client, 0x90c, 0x08017385);
 			break;
 
 		case 48000:
-			if (!state->is_cx23885 && !state->is_cx231xx) {
-				/* VID_PLL and AUX_PLL */
-				cx25840_write4(client, 0x108, 0x180a040f);
+			/*
+			 * VID_PLL Integer = 0x0f, VID_PLL Post Divider = 0x04
+			 * AUX_PLL Integer = 0x0a, AUX PLL Post Divider = 0x18
+			 */
+			cx25840_write4(client, 0x108, 0x180a040f);
+
+			/*
+			 * VID_PLL Fraction (register 0x10c) = 0x2be2fe
+			 * 28636360 * 0xf.15f17f0/4 = 108 MHz
+			 * 432 MHz pre-postdivide
+			 */
+
+			/*
+			 * AUX_PLL Fraction = 0x098d6e5
+			 * 28636363 * 0xa.4c6b728/0x18 = 48000 * 256
+			 * 295 MHz pre-postdivide
+			 * FIXME 28636363 ref_freq doesn't match VID PLL ref
+			 */
+			cx25840_write4(client, 0x110, 0x0098d6e5);
+
+			/*
+			 * SA_MCLK_SEL = 1
+			 * SA_MCLK_DIV = 0x10 = 256/384 * AUX_PLL post dvivider
+			 */
+			cx25840_write(client, 0x127, 0x50);
+
+			if (is_cx2583x(state))
+				break;
 
-				/* AUX_PLL_FRAC */
-				cx25840_write4(client, 0x110, 0x0098d6e5);
-			}
+			/* src1_ctl */
+			/* 0x1.8000 = 48000/32000 */
+			cx25840_write4(client, 0x8f8, 0x08018000);
 
-			if (state->is_cx25836)
-				break;
+			/* src3/4/6_ctl */
+			/* 0x1.5555 = 2 * (32000/48000) */
+			cx25840_write4(client, 0x900, 0x08015555);
+			cx25840_write4(client, 0x904, 0x08015555);
+			cx25840_write4(client, 0x90c, 0x08015555);
+			break;
+		}
+	}
+
+	state->audclk_freq = freq;
+
+	return 0;
+}
+
+static inline int cx25836_set_audclk_freq(struct i2c_client *client, u32 freq)
+{
+	return cx25840_set_audclk_freq(client, freq);
+}
+
+static int cx23885_set_audclk_freq(struct i2c_client *client, u32 freq)
+{
+	struct cx25840_state *state = to_state(i2c_get_clientdata(client));
+
+	if (state->aud_input != CX25840_AUDIO_SERIAL) {
+		switch (freq) {
+		case 32000:
+		case 44100:
+		case 48000:
+			/* We don't have register values
+			 * so avoid destroying registers. */
+			/* FIXME return -EINVAL; */
+			break;
+		}
+	} else {
+		switch (freq) {
+		case 32000:
+		case 44100:
+			/* We don't have register values
+			 * so avoid destroying registers. */
+			/* FIXME return -EINVAL; */
+			break;
+
+		case 48000:
+			/* src1_ctl */
+			/* 0x1.867c = 48000 / (2 * 28636360/8 * 2/455) */
+			cx25840_write4(client, 0x8f8, 0x0801867c);
+
+			/* src3/4/6_ctl */
+			/* 0x1.4faa = (4 * 28636360/8 * 2/455) / 48000 */
+			cx25840_write4(client, 0x900, 0x08014faa);
+			cx25840_write4(client, 0x904, 0x08014faa);
+			cx25840_write4(client, 0x90c, 0x08014faa);
+			break;
+		}
+	}
+
+	state->audclk_freq = freq;
+
+	return 0;
+}
+
+static int cx231xx_set_audclk_freq(struct i2c_client *client, u32 freq)
+{
+	struct cx25840_state *state = to_state(i2c_get_clientdata(client));
+
+	if (state->aud_input != CX25840_AUDIO_SERIAL) {
+		switch (freq) {
+		case 32000:
+			/* src3/4/6_ctl */
+			/* 0x1.f77f = (4 * 28636360/8 * 2/455) / 32000 */
+			cx25840_write4(client, 0x900, 0x0801f77f);
+			cx25840_write4(client, 0x904, 0x0801f77f);
+			cx25840_write4(client, 0x90c, 0x0801f77f);
+			break;
+
+		case 44100:
+			/* src3/4/6_ctl */
+			/* 0x1.6d59 = (4 * 28636360/8 * 2/455) / 44100 */
+			cx25840_write4(client, 0x900, 0x08016d59);
+			cx25840_write4(client, 0x904, 0x08016d59);
+			cx25840_write4(client, 0x90c, 0x08016d59);
+			break;
+
+		case 48000:
+			/* src3/4/6_ctl */
+			/* 0x1.4faa = (4 * 28636360/8 * 2/455) / 48000 */
+			cx25840_write4(client, 0x900, 0x08014faa);
+			cx25840_write4(client, 0x904, 0x08014faa);
+			cx25840_write4(client, 0x90c, 0x08014faa);
+			break;
+		}
+	} else {
+		switch (freq) {
+		/* FIXME These cases make different assumptions about audclk */
+		case 32000:
+			/* src1_ctl */
+			/* 0x1.0000 = 32000/32000 */
+			cx25840_write4(client, 0x8f8, 0x08010000);
 
-			if (!state->is_cx23885 && !state->is_cx231xx) {
-				/* src1_ctl */
-				cx25840_write4(client, 0x8f8, 0x08018000);
+			/* src3/4/6_ctl */
+			/* 0x2.0000 = 2 * (32000/32000) */
+			cx25840_write4(client, 0x900, 0x08020000);
+			cx25840_write4(client, 0x904, 0x08020000);
+			cx25840_write4(client, 0x90c, 0x08020000);
+			break;
 
-				/* src3/4/6_ctl */
-				cx25840_write4(client, 0x900, 0x08015555);
-				cx25840_write4(client, 0x904, 0x08015555);
-				cx25840_write4(client, 0x90c, 0x08015555);
-			} else {
+		case 44100:
+			/* src1_ctl */
+			/* 0x1.60cd = 44100/32000 */
+			cx25840_write4(client, 0x8f8, 0x080160cd);
 
-				cx25840_write4(client, 0x8f8, 0x0801867c);
+			/* src3/4/6_ctl */
+			/* 0x1.7385 = 2 * (32000/44100) */
+			cx25840_write4(client, 0x900, 0x08017385);
+			cx25840_write4(client, 0x904, 0x08017385);
+			cx25840_write4(client, 0x90c, 0x08017385);
+			break;
 
-				cx25840_write4(client, 0x900, 0x08014faa);
-				cx25840_write4(client, 0x904, 0x08014faa);
-				cx25840_write4(client, 0x90c, 0x08014faa);
-			}
+		case 48000:
+			/* src1_ctl */
+			/* 0x1.867c = 48000 / (2 * 28636360/8 * 2/455) */
+			cx25840_write4(client, 0x8f8, 0x0801867c);
+
+			/* src3/4/6_ctl */
+			/* 0x1.4faa = (4 * 28636360/8 * 2/455) / 48000 */
+			cx25840_write4(client, 0x900, 0x08014faa);
+			cx25840_write4(client, 0x904, 0x08014faa);
+			cx25840_write4(client, 0x90c, 0x08014faa);
 			break;
 		}
 	}
@@ -206,6 +414,25 @@ static int set_audclk_freq(struct i2c_client *client, u32 freq)
 	return 0;
 }
 
+static int set_audclk_freq(struct i2c_client *client, u32 freq)
+{
+	struct cx25840_state *state = to_state(i2c_get_clientdata(client));
+
+	if (freq != 32000 && freq != 44100 && freq != 48000)
+		return -EINVAL;
+
+	if (is_cx231xx(state))
+		return cx231xx_set_audclk_freq(client, freq);
+
+	if (is_cx2388x(state))
+		return cx23885_set_audclk_freq(client, freq);
+
+	if (is_cx2583x(state))
+		return cx25836_set_audclk_freq(client, freq);
+
+	return cx25840_set_audclk_freq(client, freq);
+}
+
 void cx25840_audio_set_path(struct i2c_client *client)
 {
 	struct cx25840_state *state = to_state(i2c_get_clientdata(client));
@@ -243,7 +470,7 @@ void cx25840_audio_set_path(struct i2c_client *client)
 	cx25840_and_or(client, 0x810, ~0x1, 0x00);
 
 	/* Ensure the controller is running when we exit */
-	if (state->is_cx23885 || state->is_cx231xx)
+	if (is_cx2388x(state) || is_cx231xx(state))
 		cx25840_and_or(client, 0x803, ~0x10, 0x10);
 }
 
@@ -383,7 +610,7 @@ int cx25840_s_clock_freq(struct v4l2_subdev *sd, u32 freq)
 	struct cx25840_state *state = to_state(sd);
 	int retval;
 
-	if (!state->is_cx25836)
+	if (!is_cx2583x(state))
 		cx25840_and_or(client, 0x810, ~0x1, 1);
 	if (state->aud_input != CX25840_AUDIO_SERIAL) {
 		cx25840_and_or(client, 0x803, ~0x10, 0);
@@ -392,7 +619,7 @@ int cx25840_s_clock_freq(struct v4l2_subdev *sd, u32 freq)
 	retval = set_audclk_freq(client, freq);
 	if (state->aud_input != CX25840_AUDIO_SERIAL)
 		cx25840_and_or(client, 0x803, ~0x10, 0x10);
-	if (!state->is_cx25836)
+	if (!is_cx2583x(state))
 		cx25840_and_or(client, 0x810, ~0x1, 0);
 	return retval;
 }
diff --git a/drivers/media/video/cx25840/cx25840-core.c b/drivers/media/video/cx25840/cx25840-core.c
index 1aeaf18a9bea..385ecd58f1c0 100644
--- a/drivers/media/video/cx25840/cx25840-core.c
+++ b/drivers/media/video/cx25840/cx25840-core.c
@@ -259,6 +259,13 @@ static void cx23885_initialize(struct i2c_client *client)
 	struct cx25840_state *state = to_state(i2c_get_clientdata(client));
 	struct workqueue_struct *q;
 
+	/*
+	 * Come out of digital power down
+	 * The CX23888, at least, needs this, otherwise registers aside from
+	 * 0x0-0x2 can't be read or written.
+	 */
+	cx25840_write(client, 0x000, 0);
+
 	/* Internal Reset */
 	cx25840_and_or(client, 0x102, ~0x01, 0x01);
 	cx25840_and_or(client, 0x102, ~0x01, 0x00);
@@ -269,18 +276,45 @@ static void cx23885_initialize(struct i2c_client *client)
 	/* DIF in reset? */
 	cx25840_write(client, 0x398, 0);
 
-	/* Trust the default xtal, no division */
-	/* This changes for the cx23888 products */
+	/*
+	 * Trust the default xtal, no division
+	 * '885: 28.636363... MHz
+	 * '887: 25.000000 MHz
+	 * '888: 50.000000 MHz
+	 */
 	cx25840_write(client, 0x2, 0x76);
 
-	/* Bring down the regulator for AUX clk */
+	/* Power up all the PLL's and DLL */
 	cx25840_write(client, 0x1, 0x40);
 
-	/* Sys PLL frac */
-	cx25840_write4(client, 0x11c, 0x01d1744c);
-
-	/* Sys PLL int */
-	cx25840_write4(client, 0x118, 0x00000416);
+	/* Sys PLL */
+	switch (state->id) {
+	case V4L2_IDENT_CX23888_AV:
+		/*
+		 * 50.0 MHz * (0xb + 0xe8ba26/0x2000000)/4 = 5 * 28.636363 MHz
+		 * 572.73 MHz before post divide
+		 */
+		cx25840_write4(client, 0x11c, 0x00e8ba26);
+		cx25840_write4(client, 0x118, 0x0000040b);
+		break;
+	case V4L2_IDENT_CX23887_AV:
+		/*
+		 * 25.0 MHz * (0x16 + 0x1d1744c/0x2000000)/4 = 5 * 28.636363 MHz
+		 * 572.73 MHz before post divide
+		 */
+		cx25840_write4(client, 0x11c, 0x01d1744c);
+		cx25840_write4(client, 0x118, 0x00000416);
+		break;
+	case V4L2_IDENT_CX23885_AV:
+	default:
+		/*
+		 * 28.636363 MHz * (0x14 + 0x0/0x2000000)/4 = 5 * 28.636363 MHz
+		 * 572.73 MHz before post divide
+		 */
+		cx25840_write4(client, 0x11c, 0x00000000);
+		cx25840_write4(client, 0x118, 0x00000414);
+		break;
+	}
 
 	/* Disable DIF bypass */
 	cx25840_write4(client, 0x33c, 0x00000001);
@@ -288,11 +322,15 @@ static void cx23885_initialize(struct i2c_client *client)
 	/* DIF Src phase inc */
 	cx25840_write4(client, 0x340, 0x0df7df83);
 
-	/* Vid PLL frac */
-	cx25840_write4(client, 0x10c, 0x01b6db7b);
-
-	/* Vid PLL int */
-	cx25840_write4(client, 0x108, 0x00000512);
+	/*
+	 * Vid PLL
+	 * Setup for a BT.656 pixel clock of 13.5 Mpixels/second
+	 *
+	 * 28.636363 MHz * (0xf + 0x02be2c9/0x2000000)/4 = 8 * 13.5 MHz
+	 * 432.0 MHz before post divide
+	 */
+	cx25840_write4(client, 0x10c, 0x002be2c9);
+	cx25840_write4(client, 0x108, 0x0000040f);
 
 	/* Luma */
 	cx25840_write4(client, 0x414, 0x00107d12);
@@ -300,11 +338,43 @@ static void cx23885_initialize(struct i2c_client *client)
 	/* Chroma */
 	cx25840_write4(client, 0x420, 0x3d008282);
 
-	/* Aux PLL frac */
-	cx25840_write4(client, 0x114, 0x017dbf48);
-
-	/* Aux PLL int */
-	cx25840_write4(client, 0x110, 0x000a030e);
+	/*
+	 * Aux PLL
+	 * Initial setup for audio sample clock:
+	 * 48 ksps, 16 bits/sample, x160 multiplier = 122.88 MHz
+	 * Intial I2S output/master clock(?):
+	 * 48 ksps, 16 bits/sample, x16 multiplier = 12.288 MHz
+	 */
+	switch (state->id) {
+	case V4L2_IDENT_CX23888_AV:
+		/*
+		 * 50.0 MHz * (0x7 + 0x0bedfa4/0x2000000)/3 = 122.88 MHz
+		 * 368.64 MHz before post divide
+		 * 122.88 MHz / 0xa = 12.288 MHz
+		 */
+		cx25840_write4(client, 0x114, 0x00bedfa4);
+		cx25840_write4(client, 0x110, 0x000a0307);
+		break;
+	case V4L2_IDENT_CX23887_AV:
+		/*
+		 * 25.0 MHz * (0xe + 0x17dbf48/0x2000000)/3 = 122.88 MHz
+		 * 368.64 MHz before post divide
+		 * 122.88 MHz / 0xa = 12.288 MHz
+		 */
+		cx25840_write4(client, 0x114, 0x017dbf48);
+		cx25840_write4(client, 0x110, 0x000a030e);
+		break;
+	case V4L2_IDENT_CX23885_AV:
+	default:
+		/*
+		 * 28.636363 MHz * (0xc + 0x1bf0c9e/0x2000000)/3 = 122.88 MHz
+		 * 368.64 MHz before post divide
+		 * 122.88 MHz / 0xa = 12.288 MHz
+		 */
+		cx25840_write4(client, 0x114, 0x01bf0c9e);
+		cx25840_write4(client, 0x110, 0x000a030c);
+		break;
+	};
 
 	/* ADC2 input select */
 	cx25840_write(client, 0x102, 0x10);
@@ -494,7 +564,7 @@ void cx25840_std_setup(struct i2c_client *client)
 	}
 
 	/* DEBUG: Displays configured PLL frequency */
-	if (!state->is_cx231xx) {
+	if (!is_cx231xx(state)) {
 		pll_int = cx25840_read(client, 0x108);
 		pll_frac = cx25840_read4(client, 0x10c) & 0x1ffffff;
 		pll_post = cx25840_read(client, 0x109);
@@ -615,13 +685,30 @@ static void input_change(struct i2c_client *client)
 		}
 		cx25840_write(client, 0x80b, 0x00);
 	} else if (std & V4L2_STD_PAL) {
-		/* Follow tuner change procedure for PAL */
+		/* Autodetect audio standard and audio system */
 		cx25840_write(client, 0x808, 0xff);
-		cx25840_write(client, 0x80b, 0x10);
+		/* Since system PAL-L is pretty much non-existant and
+		   not used by any public broadcast network, force
+		   6.5 MHz carrier to be interpreted as System DK,
+		   this avoids DK audio detection instability */
+	       cx25840_write(client, 0x80b, 0x00);
 	} else if (std & V4L2_STD_SECAM) {
-		/* Select autodetect for SECAM */
+		/* Autodetect audio standard and audio system */
 		cx25840_write(client, 0x808, 0xff);
-		cx25840_write(client, 0x80b, 0x10);
+		/* If only one of SECAM-DK / SECAM-L is required, then force
+		  6.5MHz carrier, else autodetect it */
+		if ((std & V4L2_STD_SECAM_DK) &&
+		    !(std & (V4L2_STD_SECAM_L | V4L2_STD_SECAM_LC))) {
+			/* 6.5 MHz carrier to be interpreted as System DK */
+			cx25840_write(client, 0x80b, 0x00);
+	       } else if (!(std & V4L2_STD_SECAM_DK) &&
+			  (std & (V4L2_STD_SECAM_L | V4L2_STD_SECAM_LC))) {
+			/* 6.5 MHz carrier to be interpreted as System L */
+			cx25840_write(client, 0x80b, 0x08);
+	       } else {
+			/* 6.5 MHz carrier to be autodetected */
+			cx25840_write(client, 0x80b, 0x10);
+	       }
 	}
 
 	cx25840_and_or(client, 0x810, ~0x01, 0);
@@ -633,6 +720,10 @@ static int set_input(struct i2c_client *client, enum cx25840_video_input vid_inp
 	struct cx25840_state *state = to_state(i2c_get_clientdata(client));
 	u8 is_composite = (vid_input >= CX25840_COMPOSITE1 &&
 			   vid_input <= CX25840_COMPOSITE8);
+	u8 is_component = (vid_input & CX25840_COMPONENT_ON) ==
+			CX25840_COMPONENT_ON;
+	int luma = vid_input & 0xf0;
+	int chroma = vid_input & 0xf00;
 	u8 reg;
 
 	v4l_dbg(1, cx25840_debug, client,
@@ -645,18 +736,14 @@ static int set_input(struct i2c_client *client, enum cx25840_video_input vid_inp
 		reg = vid_input & 0xff;
 		if ((vid_input & CX25840_SVIDEO_ON) == CX25840_SVIDEO_ON)
 			is_composite = 0;
-		else
+		else if ((vid_input & CX25840_COMPONENT_ON) == 0)
 			is_composite = 1;
 
 		v4l_dbg(1, cx25840_debug, client, "mux cfg 0x%x comp=%d\n",
 			reg, is_composite);
-	} else
-	if (is_composite) {
+	} else if (is_composite) {
 		reg = 0xf0 + (vid_input - CX25840_COMPOSITE1);
 	} else {
-		int luma = vid_input & 0xf0;
-		int chroma = vid_input & 0xf00;
-
 		if ((vid_input & ~0xff0) ||
 		    luma < CX25840_SVIDEO_LUMA1 || luma > CX25840_SVIDEO_LUMA8 ||
 		    chroma < CX25840_SVIDEO_CHROMA4 || chroma > CX25840_SVIDEO_CHROMA8) {
@@ -678,7 +765,7 @@ static int set_input(struct i2c_client *client, enum cx25840_video_input vid_inp
 	 * configuration in reg (for the cx23885) so we have no
 	 * need to attempt to flip bits for earlier av decoders.
 	 */
-	if (!state->is_cx23885 && !state->is_cx231xx) {
+	if (!is_cx2388x(state) && !is_cx231xx(state)) {
 		switch (aud_input) {
 		case CX25840_AUDIO_SERIAL:
 			/* do nothing, use serial audio input */
@@ -698,10 +785,13 @@ static int set_input(struct i2c_client *client, enum cx25840_video_input vid_inp
 
 	cx25840_write(client, 0x103, reg);
 
-	/* Set INPUT_MODE to Composite (0) or S-Video (1) */
-	cx25840_and_or(client, 0x401, ~0x6, is_composite ? 0 : 0x02);
+	/* Set INPUT_MODE to Composite, S-Video or Component */
+	if (is_component)
+		cx25840_and_or(client, 0x401, ~0x6, 0x6);
+	else
+		cx25840_and_or(client, 0x401, ~0x6, is_composite ? 0 : 0x02);
 
-	if (!state->is_cx23885 && !state->is_cx231xx) {
+	if (!is_cx2388x(state) && !is_cx231xx(state)) {
 		/* Set CH_SEL_ADC2 to 1 if input comes from CH3 */
 		cx25840_and_or(client, 0x102, ~0x2, (reg & 0x80) == 0 ? 2 : 0);
 		/* Set DUAL_MODE_ADC2 to 1 if input comes from both CH2&CH3 */
@@ -710,22 +800,31 @@ static int set_input(struct i2c_client *client, enum cx25840_video_input vid_inp
 		else
 			cx25840_and_or(client, 0x102, ~0x4, 0);
 	} else {
-		if (is_composite)
+		/* Set DUAL_MODE_ADC2 to 1 if component*/
+		cx25840_and_or(client, 0x102, ~0x4, is_component ? 0x4 : 0x0);
+		if (is_composite) {
 			/* ADC2 input select channel 2 */
 			cx25840_and_or(client, 0x102, ~0x2, 0);
-		else
-			/* ADC2 input select channel 3 */
-			cx25840_and_or(client, 0x102, ~0x2, 2);
+		} else if (!is_component) {
+			/* S-Video */
+			if (chroma >= CX25840_SVIDEO_CHROMA7) {
+				/* ADC2 input select channel 3 */
+				cx25840_and_or(client, 0x102, ~0x2, 2);
+			} else {
+				/* ADC2 input select channel 2 */
+				cx25840_and_or(client, 0x102, ~0x2, 0);
+			}
+		}
 	}
 
 	state->vid_input = vid_input;
 	state->aud_input = aud_input;
-	if (!state->is_cx25836) {
+	if (!is_cx2583x(state)) {
 		cx25840_audio_set_path(client);
 		input_change(client);
 	}
 
-	if (state->is_cx23885) {
+	if (is_cx2388x(state)) {
 		/* Audio channel 1 src : Parallel 1 */
 		cx25840_write(client, 0x124, 0x03);
 
@@ -741,7 +840,7 @@ static int set_input(struct i2c_client *client, enum cx25840_video_input vid_inp
 		 */
 		cx25840_write(client, 0x918, 0xa0);
 		cx25840_write(client, 0x919, 0x01);
-	} else if (state->is_cx231xx) {
+	} else if (is_cx231xx(state)) {
 		/* Audio channel 1 src : Parallel 1 */
 		cx25840_write(client, 0x124, 0x03);
 
@@ -805,7 +904,7 @@ static int set_v4lstd(struct i2c_client *client)
 	cx25840_and_or(client, 0x400, ~0xf, fmt);
 	cx25840_and_or(client, 0x403, ~0x3, pal_m);
 	cx25840_std_setup(client);
-	if (!state->is_cx25836)
+	if (!is_cx2583x(state))
 		input_change(client);
 	return 0;
 }
@@ -868,7 +967,7 @@ static int cx25840_s_ctrl(struct v4l2_subdev *sd, struct v4l2_control *ctrl)
 	case V4L2_CID_AUDIO_TREBLE:
 	case V4L2_CID_AUDIO_BALANCE:
 	case V4L2_CID_AUDIO_MUTE:
-		if (state->is_cx25836)
+		if (is_cx2583x(state))
 			return -EINVAL;
 		return cx25840_audio_s_ctrl(sd, ctrl);
 
@@ -905,7 +1004,7 @@ static int cx25840_g_ctrl(struct v4l2_subdev *sd, struct v4l2_control *ctrl)
 	case V4L2_CID_AUDIO_TREBLE:
 	case V4L2_CID_AUDIO_BALANCE:
 	case V4L2_CID_AUDIO_MUTE:
-		if (state->is_cx25836)
+		if (is_cx2583x(state))
 			return -EINVAL;
 		return cx25840_audio_g_ctrl(sd, ctrl);
 	default:
@@ -1209,11 +1308,11 @@ static int cx25840_load_fw(struct v4l2_subdev *sd)
 	if (!state->is_initialized) {
 		/* initialize and load firmware */
 		state->is_initialized = 1;
-		if (state->is_cx25836)
+		if (is_cx2583x(state))
 			cx25836_initialize(client);
-		else if (state->is_cx23885)
+		else if (is_cx2388x(state))
 			cx23885_initialize(client);
-		else if (state->is_cx231xx)
+		else if (is_cx231xx(state))
 			cx231xx_initialize(client);
 		else
 			cx25840_initialize(client);
@@ -1256,17 +1355,17 @@ static int cx25840_s_stream(struct v4l2_subdev *sd, int enable)
 	v4l_dbg(1, cx25840_debug, client, "%s output\n",
 			enable ? "enable" : "disable");
 	if (enable) {
-		if (state->is_cx23885 || state->is_cx231xx) {
+		if (is_cx2388x(state) || is_cx231xx(state)) {
 			u8 v = (cx25840_read(client, 0x421) | 0x0b);
 			cx25840_write(client, 0x421, v);
 		} else {
 			cx25840_write(client, 0x115,
-					state->is_cx25836 ? 0x0c : 0x8c);
+					is_cx2583x(state) ? 0x0c : 0x8c);
 			cx25840_write(client, 0x116,
-					state->is_cx25836 ? 0x04 : 0x07);
+					is_cx2583x(state) ? 0x04 : 0x07);
 		}
 	} else {
-		if (state->is_cx23885 || state->is_cx231xx) {
+		if (is_cx2388x(state) || is_cx231xx(state)) {
 			u8 v = cx25840_read(client, 0x421) & ~(0x0b);
 			cx25840_write(client, 0x421, v);
 		} else {
@@ -1292,7 +1391,7 @@ static int cx25840_queryctrl(struct v4l2_subdev *sd, struct v4l2_queryctrl *qc)
 	default:
 		break;
 	}
-	if (state->is_cx25836)
+	if (is_cx2583x(state))
 		return -EINVAL;
 
 	switch (qc->id) {
@@ -1346,7 +1445,7 @@ static int cx25840_s_audio_routing(struct v4l2_subdev *sd,
 	struct cx25840_state *state = to_state(sd);
 	struct i2c_client *client = v4l2_get_subdevdata(sd);
 
-	if (state->is_cx25836)
+	if (is_cx2583x(state))
 		return -EINVAL;
 	return set_input(client, state->vid_input, input);
 }
@@ -1356,7 +1455,7 @@ static int cx25840_s_frequency(struct v4l2_subdev *sd, struct v4l2_frequency *fr
 	struct cx25840_state *state = to_state(sd);
 	struct i2c_client *client = v4l2_get_subdevdata(sd);
 
-	if (!state->is_cx25836)
+	if (!is_cx2583x(state))
 		input_change(client);
 	return 0;
 }
@@ -1373,7 +1472,7 @@ static int cx25840_g_tuner(struct v4l2_subdev *sd, struct v4l2_tuner *vt)
 		return 0;
 
 	vt->signal = vpres ? 0xffff : 0x0;
-	if (state->is_cx25836)
+	if (is_cx2583x(state))
 		return 0;
 
 	vt->capability |=
@@ -1404,7 +1503,7 @@ static int cx25840_s_tuner(struct v4l2_subdev *sd, struct v4l2_tuner *vt)
 	struct cx25840_state *state = to_state(sd);
 	struct i2c_client *client = v4l2_get_subdevdata(sd);
 
-	if (state->radio || state->is_cx25836)
+	if (state->radio || is_cx2583x(state))
 		return 0;
 
 	switch (vt->audmode) {
@@ -1445,11 +1544,11 @@ static int cx25840_reset(struct v4l2_subdev *sd, u32 val)
 	struct cx25840_state *state = to_state(sd);
 	struct i2c_client *client = v4l2_get_subdevdata(sd);
 
-	if (state->is_cx25836)
+	if (is_cx2583x(state))
 		cx25836_initialize(client);
-	else if (state->is_cx23885)
+	else if (is_cx2388x(state))
 		cx23885_initialize(client);
-	else if (state->is_cx231xx)
+	else if (is_cx231xx(state))
 		cx231xx_initialize(client);
 	else
 		cx25840_initialize(client);
@@ -1470,7 +1569,7 @@ static int cx25840_log_status(struct v4l2_subdev *sd)
 	struct i2c_client *client = v4l2_get_subdevdata(sd);
 
 	log_video_status(client);
-	if (!state->is_cx25836)
+	if (!is_cx2583x(state))
 		log_audio_status(client);
 	return 0;
 }
@@ -1521,12 +1620,50 @@ static const struct v4l2_subdev_ops cx25840_ops = {
 
 /* ----------------------------------------------------------------------- */
 
+static u32 get_cx2388x_ident(struct i2c_client *client)
+{
+	u32 ret;
+
+	/* Come out of digital power down */
+	cx25840_write(client, 0x000, 0);
+
+	/* Detecting whether the part is cx23885/7/8 is more
+	 * difficult than it needs to be. No ID register. Instead we
+	 * probe certain registers indicated in the datasheets to look
+	 * for specific defaults that differ between the silicon designs. */
+
+	/* It's either 885/7 if the IR Tx Clk Divider register exists */
+	if (cx25840_read4(client, 0x204) & 0xffff) {
+		/* CX23885 returns bogus repetitive byte values for the DIF,
+		 * which doesn't exist for it. (Ex. 8a8a8a8a or 31313131) */
+		ret = cx25840_read4(client, 0x300);
+		if (((ret & 0xffff0000) >> 16) == (ret & 0xffff)) {
+			/* No DIF */
+			ret = V4L2_IDENT_CX23885_AV;
+		} else {
+			/* CX23887 has a broken DIF, but the registers
+			 * appear valid (but unsed), good enough to detect. */
+			ret = V4L2_IDENT_CX23887_AV;
+		}
+	} else if (cx25840_read4(client, 0x300) & 0x0fffffff) {
+		/* DIF PLL Freq Word reg exists; chip must be a CX23888 */
+		ret = V4L2_IDENT_CX23888_AV;
+	} else {
+		v4l_err(client, "Unable to detect h/w, assuming cx23887\n");
+		ret = V4L2_IDENT_CX23887_AV;
+	}
+
+	/* Back into digital power down */
+	cx25840_write(client, 0x000, 2);
+	return ret;
+}
+
 static int cx25840_probe(struct i2c_client *client,
 			 const struct i2c_device_id *did)
 {
 	struct cx25840_state *state;
 	struct v4l2_subdev *sd;
-	u32 id;
+	u32 id = V4L2_IDENT_NONE;
 	u16 device_id;
 
 	/* Check if the adapter supports the needed features */
@@ -1543,17 +1680,22 @@ static int cx25840_probe(struct i2c_client *client,
 	 * 0x83 for the cx2583x and 0x84 for the cx2584x */
 	if ((device_id & 0xff00) == 0x8300) {
 		id = V4L2_IDENT_CX25836 + ((device_id >> 4) & 0xf) - 6;
-	}
-	else if ((device_id & 0xff00) == 0x8400) {
+	} else if ((device_id & 0xff00) == 0x8400) {
 		id = V4L2_IDENT_CX25840 + ((device_id >> 4) & 0xf);
 	} else if (device_id == 0x0000) {
-		id = V4L2_IDENT_CX25836 + ((device_id >> 4) & 0xf) - 6;
-	} else if (device_id == 0x1313) {
-		id = V4L2_IDENT_CX25836 + ((device_id >> 4) & 0xf) - 6;
+		id = get_cx2388x_ident(client);
 	} else if ((device_id & 0xfff0) == 0x5A30) {
-		id = V4L2_IDENT_CX25840 + ((device_id >> 4) & 0xf);
-	}
-	else {
+		/* The CX23100 (0x5A3C = 23100) doesn't have an A/V decoder */
+		id = V4L2_IDENT_CX2310X_AV;
+	} else if ((device_id & 0xff) == (device_id >> 8)) {
+		v4l_err(client,
+			"likely a confused/unresponsive cx2388[578] A/V decoder"
+			" found @ 0x%x (%s)\n",
+			client->addr << 1, client->adapter->name);
+		v4l_err(client, "A method to reset it from the cx25840 driver"
+			" software is not known at this time\n");
+		return -ENODEV;
+	} else {
 		v4l_dbg(1, cx25840_debug, client, "cx25840 not found\n");
 		return -ENODEV;
 	}
@@ -1564,17 +1706,45 @@ static int cx25840_probe(struct i2c_client *client,
 
 	sd = &state->sd;
 	v4l2_i2c_subdev_init(sd, client, &cx25840_ops);
-	/* Note: revision '(device_id & 0x0f) == 2' was never built. The
-	   marking skips from 0x1 == 22 to 0x3 == 23. */
-	v4l_info(client, "cx25%3x-2%x found @ 0x%x (%s)\n",
-		    (device_id & 0xfff0) >> 4,
-		    (device_id & 0x0f) < 3 ? (device_id & 0x0f) + 1 : (device_id & 0x0f),
-		    client->addr << 1, client->adapter->name);
+	switch (id) {
+	case V4L2_IDENT_CX23885_AV:
+		v4l_info(client, "cx23885 A/V decoder found @ 0x%x (%s)\n",
+			 client->addr << 1, client->adapter->name);
+		break;
+	case V4L2_IDENT_CX23887_AV:
+		v4l_info(client, "cx23887 A/V decoder found @ 0x%x (%s)\n",
+			 client->addr << 1, client->adapter->name);
+		break;
+	case V4L2_IDENT_CX23888_AV:
+		v4l_info(client, "cx23888 A/V decoder found @ 0x%x (%s)\n",
+			 client->addr << 1, client->adapter->name);
+		break;
+	case V4L2_IDENT_CX2310X_AV:
+		v4l_info(client, "cx%d A/V decoder found @ 0x%x (%s)\n",
+			 device_id, client->addr << 1, client->adapter->name);
+		break;
+	case V4L2_IDENT_CX25840:
+	case V4L2_IDENT_CX25841:
+	case V4L2_IDENT_CX25842:
+	case V4L2_IDENT_CX25843:
+		/* Note: revision '(device_id & 0x0f) == 2' was never built. The
+		   marking skips from 0x1 == 22 to 0x3 == 23. */
+		v4l_info(client, "cx25%3x-2%x found @ 0x%x (%s)\n",
+			 (device_id & 0xfff0) >> 4,
+			 (device_id & 0x0f) < 3 ? (device_id & 0x0f) + 1
+						: (device_id & 0x0f),
+			 client->addr << 1, client->adapter->name);
+		break;
+	case V4L2_IDENT_CX25836:
+	case V4L2_IDENT_CX25837:
+	default:
+		v4l_info(client, "cx25%3x-%x found @ 0x%x (%s)\n",
+			 (device_id & 0xfff0) >> 4, device_id & 0x0f,
+			 client->addr << 1, client->adapter->name);
+		break;
+	}
 
 	state->c = client;
-	state->is_cx25836 = ((device_id & 0xff00) == 0x8300);
-	state->is_cx23885 = (device_id == 0x0000) || (device_id == 0x1313);
-	state->is_cx231xx = (device_id == 0x5a3e);
 	state->vid_input = CX25840_COMPOSITE7;
 	state->aud_input = CX25840_AUDIO8;
 	state->audclk_freq = 48000;
diff --git a/drivers/media/video/cx25840/cx25840-core.h b/drivers/media/video/cx25840/cx25840-core.h
index 814b56536994..55345444417f 100644
--- a/drivers/media/video/cx25840/cx25840-core.h
+++ b/drivers/media/video/cx25840/cx25840-core.h
@@ -23,6 +23,7 @@
 
 #include <linux/videodev2.h>
 #include <media/v4l2-device.h>
+#include <media/v4l2-chip-ident.h>
 #include <linux/i2c.h>
 
 /* ENABLE_PVR150_WORKAROUND activates a workaround for a hardware bug that is
@@ -48,9 +49,6 @@ struct cx25840_state {
 	int vbi_line_offset;
 	u32 id;
 	u32 rev;
-	int is_cx25836;
-	int is_cx23885;
-	int is_cx231xx;
 	int is_initialized;
 	wait_queue_head_t fw_wait;    /* wake up when the fw load is finished */
 	struct work_struct fw_work;   /* work entry for fw load */
@@ -61,6 +59,24 @@ static inline struct cx25840_state *to_state(struct v4l2_subdev *sd)
 	return container_of(sd, struct cx25840_state, sd);
 }
 
+static inline bool is_cx2583x(struct cx25840_state *state)
+{
+	return state->id == V4L2_IDENT_CX25836 ||
+	       state->id == V4L2_IDENT_CX25837;
+}
+
+static inline bool is_cx231xx(struct cx25840_state *state)
+{
+	return state->id == V4L2_IDENT_CX2310X_AV;
+}
+
+static inline bool is_cx2388x(struct cx25840_state *state)
+{
+	return state->id == V4L2_IDENT_CX23885_AV ||
+	       state->id == V4L2_IDENT_CX23887_AV ||
+	       state->id == V4L2_IDENT_CX23888_AV;
+}
+
 /* ----------------------------------------------------------------------- */
 /* cx25850-core.c 							   */
 int cx25840_write(struct i2c_client *client, u16 addr, u8 value);
diff --git a/drivers/media/video/cx25840/cx25840-firmware.c b/drivers/media/video/cx25840/cx25840-firmware.c
index 1f483c1d0dbe..8150200511da 100644
--- a/drivers/media/video/cx25840/cx25840-firmware.c
+++ b/drivers/media/video/cx25840/cx25840-firmware.c
@@ -67,9 +67,9 @@ static const char *get_fw_name(struct i2c_client *client)
 
 	if (firmware[0])
 		return firmware;
-	if (state->is_cx23885)
+	if (is_cx2388x(state))
 		return "v4l-cx23885-avcore-01.fw";
-	if (state->is_cx231xx)
+	if (is_cx231xx(state))
 		return "v4l-cx231xx-avcore-01.fw";
 	return "v4l-cx25840.fw";
 }
@@ -112,13 +112,13 @@ int cx25840_loadfw(struct i2c_client *client)
 	int MAX_BUF_SIZE = FWSEND;
 	u32 gpio_oe = 0, gpio_da = 0;
 
-	if (state->is_cx23885) {
+	if (is_cx2388x(state)) {
 		/* Preserve the GPIO OE and output bits */
 		gpio_oe = cx25840_read(client, 0x160);
 		gpio_da = cx25840_read(client, 0x164);
 	}
 
-	if ((state->is_cx231xx) && MAX_BUF_SIZE > 16) {
+	if (is_cx231xx(state) && MAX_BUF_SIZE > 16) {
 		v4l_err(client, " Firmware download size changed to 16 bytes max length\n");
 		MAX_BUF_SIZE = 16;  /* cx231xx cannot accept more than 16 bytes at a time */
 	}
@@ -156,7 +156,7 @@ int cx25840_loadfw(struct i2c_client *client)
 	size = fw->size;
 	release_firmware(fw);
 
-	if (state->is_cx23885) {
+	if (is_cx2388x(state)) {
 		/* Restore GPIO configuration after f/w load */
 		cx25840_write(client, 0x160, gpio_oe);
 		cx25840_write(client, 0x164, gpio_da);
diff --git a/drivers/media/video/cx88/Kconfig b/drivers/media/video/cx88/Kconfig
index 49952980dab3..c7e5851d3486 100644
--- a/drivers/media/video/cx88/Kconfig
+++ b/drivers/media/video/cx88/Kconfig
@@ -61,6 +61,8 @@ config VIDEO_CX88_DVB
 	select DVB_STV0299 if !DVB_FE_CUSTOMISE
 	select DVB_STV0288 if !DVB_FE_CUSTOMISE
 	select DVB_STB6000 if !DVB_FE_CUSTOMISE
+	select DVB_STV0900 if !DVB_FE_CUSTOMISE
+	select DVB_STB6100 if !DVB_FE_CUSTOMISE
 	select MEDIA_TUNER_SIMPLE if !MEDIA_TUNER_CUSTOMISE
 	---help---
 	  This adds support for DVB/ATSC cards based on the
diff --git a/drivers/media/video/cx88/cx88-blackbird.c b/drivers/media/video/cx88/cx88-blackbird.c
index fbdc1cde56a6..6fe30e6c4262 100644
--- a/drivers/media/video/cx88/cx88-blackbird.c
+++ b/drivers/media/video/cx88/cx88-blackbird.c
@@ -1048,21 +1048,15 @@ static int vidioc_s_std (struct file *file, void *priv, v4l2_std_id *id)
 
 static int mpeg_open(struct file *file)
 {
-	int minor = video_devdata(file)->minor;
-	struct cx8802_dev *dev = NULL;
+	struct video_device *vdev = video_devdata(file);
+	struct cx8802_dev *dev = video_drvdata(file);
 	struct cx8802_fh *fh;
 	struct cx8802_driver *drv = NULL;
 	int err;
 
-	lock_kernel();
-	dev = cx8802_get_device(minor);
-
 	dprintk( 1, "%s\n", __func__);
 
-	if (dev == NULL) {
-		unlock_kernel();
-		return -ENODEV;
-	}
+	lock_kernel();
 
 	/* Make sure we can acquire the hardware */
 	drv = cx8802_get_driver(dev, CX88_MPEG_BLACKBIRD);
@@ -1081,7 +1075,7 @@ static int mpeg_open(struct file *file)
 		unlock_kernel();
 		return -EINVAL;
 	}
-	dprintk(1,"open minor=%d\n",minor);
+	dprintk(1, "open dev=%s\n", video_device_node_name(vdev));
 
 	/* allocate + initialize per filehandle data */
 	fh = kzalloc(sizeof(*fh),GFP_KERNEL);
@@ -1129,10 +1123,6 @@ static int mpeg_release(struct file *file)
 	kfree(fh);
 
 	/* Make sure we release the hardware */
-	dev = cx8802_get_device(video_devdata(file)->minor);
-	if (dev == NULL)
-		return -ENODEV;
-
 	drv = cx8802_get_driver(dev, CX88_MPEG_BLACKBIRD);
 	if (drv)
 		drv->request_release(drv);
@@ -1220,7 +1210,6 @@ static struct video_device cx8802_mpeg_template = {
 	.name                 = "cx8802",
 	.fops                 = &mpeg_fops,
 	.ioctl_ops 	      = &mpeg_ioctl_ops,
-	.minor                = -1,
 	.tvnorms              = CX88_NORMS,
 	.current_norm         = V4L2_STD_NTSC_M,
 };
@@ -1276,7 +1265,7 @@ static int cx8802_blackbird_advise_release(struct cx8802_driver *drv)
 static void blackbird_unregister_video(struct cx8802_dev *dev)
 {
 	if (dev->mpeg_dev) {
-		if (-1 != dev->mpeg_dev->minor)
+		if (video_is_registered(dev->mpeg_dev))
 			video_unregister_device(dev->mpeg_dev);
 		else
 			video_device_release(dev->mpeg_dev);
@@ -1290,14 +1279,15 @@ static int blackbird_register_video(struct cx8802_dev *dev)
 
 	dev->mpeg_dev = cx88_vdev_init(dev->core,dev->pci,
 				       &cx8802_mpeg_template,"mpeg");
+	video_set_drvdata(dev->mpeg_dev, dev);
 	err = video_register_device(dev->mpeg_dev,VFL_TYPE_GRABBER, -1);
 	if (err < 0) {
 		printk(KERN_INFO "%s/2: can't register mpeg device\n",
 		       dev->core->name);
 		return err;
 	}
-	printk(KERN_INFO "%s/2: registered device video%d [mpeg]\n",
-	       dev->core->name, dev->mpeg_dev->num);
+	printk(KERN_INFO "%s/2: registered device %s [mpeg]\n",
+	       dev->core->name, video_device_node_name(dev->mpeg_dev));
 	return 0;
 }
 
diff --git a/drivers/media/video/cx88/cx88-cards.c b/drivers/media/video/cx88/cx88-cards.c
index 33be6369871a..d844f2aaa01d 100644
--- a/drivers/media/video/cx88/cx88-cards.c
+++ b/drivers/media/video/cx88/cx88-cards.c
@@ -2075,6 +2075,18 @@ static const struct cx88_board cx88_boards[] = {
 		},
 		.mpeg           = CX88_MPEG_DVB,
 	},
+	[CX88_BOARD_PROF_7301] = {
+		.name           = "Prof 7301 DVB-S/S2",
+		.tuner_type     = UNSET,
+		.radio_type     = UNSET,
+		.tuner_addr     = ADDR_UNSET,
+		.radio_addr     = ADDR_UNSET,
+		.input          = { {
+			.type   = CX88_VMUX_DVB,
+			.vmux   = 0,
+		} },
+		.mpeg           = CX88_MPEG_DVB,
+	},
 };
 
 /* ------------------------------------------------------------------ */
@@ -2535,6 +2547,10 @@ static const struct cx88_subid cx88_subids[] = {
 		.subvendor = 0x107d,
 		.subdevice = 0x6618,
 		.card      = CX88_BOARD_WINFAST_TV2000_XP_GLOBAL,
+	}, {
+		.subvendor = 0xb034,
+		.subdevice = 0x3034,
+		.card      = CX88_BOARD_PROF_7301,
 	},
 };
 
@@ -3211,6 +3227,7 @@ static void cx88_card_setup(struct cx88_core *core)
 	case  CX88_BOARD_TBS_8920:
 	case  CX88_BOARD_PROF_6200:
 	case  CX88_BOARD_PROF_7300:
+	case  CX88_BOARD_PROF_7301:
 	case  CX88_BOARD_SATTRADE_ST4200:
 		cx_write(MO_GP0_IO, 0x8000);
 		msleep(100);
@@ -3267,7 +3284,7 @@ static void cx88_card_setup(struct cx88_core *core)
 			    ctl.fname);
 		call_all(core, tuner, s_config, &xc2028_cfg);
 	}
-	call_all(core, tuner, s_standby);
+	call_all(core, core, s_power, 0);
 }
 
 /* ------------------------------------------------------------------ */
diff --git a/drivers/media/video/cx88/cx88-core.c b/drivers/media/video/cx88/cx88-core.c
index cf634606ba9a..b35411160f04 100644
--- a/drivers/media/video/cx88/cx88-core.c
+++ b/drivers/media/video/cx88/cx88-core.c
@@ -624,7 +624,7 @@ int cx88_reset(struct cx88_core *core)
 	/* setup image format */
 	cx_andor(MO_COLOR_CTRL, 0x4000, 0x4000);
 
-	/* setup FIFO Threshholds */
+	/* setup FIFO Thresholds */
 	cx_write(MO_PDMA_STHRSH,   0x0807);
 	cx_write(MO_PDMA_DTHRSH,   0x0807);
 
diff --git a/drivers/media/video/cx88/cx88-dvb.c b/drivers/media/video/cx88/cx88-dvb.c
index 518bcfe18bcb..b14296923250 100644
--- a/drivers/media/video/cx88/cx88-dvb.c
+++ b/drivers/media/video/cx88/cx88-dvb.c
@@ -53,6 +53,9 @@
 #include "stv0288.h"
 #include "stb6000.h"
 #include "cx24116.h"
+#include "stv0900.h"
+#include "stb6100.h"
+#include "stb6100_proc.h"
 
 MODULE_DESCRIPTION("driver for cx2388x based DVB cards");
 MODULE_AUTHOR("Chris Pascoe <c.pascoe@itee.uq.edu.au>");
@@ -573,6 +576,15 @@ static int cx24116_set_ts_param(struct dvb_frontend *fe,
 	return 0;
 }
 
+static int stv0900_set_ts_param(struct dvb_frontend *fe,
+	int is_punctured)
+{
+	struct cx8802_dev *dev = fe->dvb->priv;
+	dev->ts_gen_cntrl = 0;
+
+	return 0;
+}
+
 static int cx24116_reset_device(struct dvb_frontend *fe)
 {
 	struct cx8802_dev *dev = fe->dvb->priv;
@@ -601,6 +613,23 @@ static struct cx24116_config tevii_s460_config = {
 	.reset_device  = cx24116_reset_device,
 };
 
+static struct stv0900_config prof_7301_stv0900_config = {
+	.demod_address = 0x6a,
+/*	demod_mode = 0,*/
+	.xtal = 27000000,
+	.clkmode = 3,/* 0-CLKI, 2-XTALI, else AUTO */
+	.diseqc_mode = 2,/* 2/3 PWM */
+	.tun1_maddress = 0,/* 0x60 */
+	.tun1_adc = 0,/* 2 Vpp */
+	.path1_mode = 3,
+	.set_ts_params = stv0900_set_ts_param,
+};
+
+static struct stb6100_config prof_7301_stb6100_config = {
+	.tuner_address = 0x60,
+	.refclock = 27000000,
+};
+
 static struct stv0299_config tevii_tuner_sharp_config = {
 	.demod_address = 0x68,
 	.inittab = sharp_z0194a_inittab,
@@ -1149,6 +1178,31 @@ static int dvb_register(struct cx8802_dev *dev)
 				goto frontend_detach;
 		}
 		break;
+	case CX88_BOARD_PROF_7301:{
+		struct dvb_tuner_ops *tuner_ops = NULL;
+
+		fe0->dvb.frontend = dvb_attach(stv0900_attach,
+						&prof_7301_stv0900_config,
+						&core->i2c_adap, 0);
+		if (fe0->dvb.frontend != NULL) {
+			if (!dvb_attach(stb6100_attach, fe0->dvb.frontend,
+					&prof_7301_stb6100_config,
+					&core->i2c_adap))
+				goto frontend_detach;
+
+			tuner_ops = &fe0->dvb.frontend->ops.tuner_ops;
+			tuner_ops->set_frequency = stb6100_set_freq;
+			tuner_ops->get_frequency = stb6100_get_freq;
+			tuner_ops->set_bandwidth = stb6100_set_bandw;
+			tuner_ops->get_bandwidth = stb6100_get_bandw;
+
+			core->prev_set_voltage =
+					fe0->dvb.frontend->ops.set_voltage;
+			fe0->dvb.frontend->ops.set_voltage =
+					tevii_dvbs_set_voltage;
+		}
+		break;
+		}
 	default:
 		printk(KERN_ERR "%s/2: The frontend of your DVB/ATSC card isn't supported yet\n",
 		       core->name);
@@ -1170,11 +1224,11 @@ static int dvb_register(struct cx8802_dev *dev)
 		fe1->dvb.frontend->ops.ts_bus_ctrl = cx88_dvb_bus_ctrl;
 
 	/* Put the analog decoder in standby to keep it quiet */
-	call_all(core, tuner, s_standby);
+	call_all(core, core, s_power, 0);
 
 	/* register everything */
 	return videobuf_dvb_register_bus(&dev->frontends, THIS_MODULE, dev,
-		&dev->pci->dev, adapter_nr, mfe_shared);
+					 &dev->pci->dev, adapter_nr, mfe_shared, NULL);
 
 frontend_detach:
 	core->gate_ctrl = NULL;
diff --git a/drivers/media/video/cx88/cx88-input.c b/drivers/media/video/cx88/cx88-input.c
index 78b3635178af..f9fda18b410c 100644
--- a/drivers/media/video/cx88/cx88-input.c
+++ b/drivers/media/video/cx88/cx88-input.c
@@ -118,13 +118,13 @@ static void cx88_ir_handle_key(struct cx88_IR *ir)
 
 		data = (data << 4) | ((gpio_key & 0xf0) >> 4);
 
-		ir_input_keydown(ir->input, &ir->ir, data, data);
+		ir_input_keydown(ir->input, &ir->ir, data);
 		ir_input_nokey(ir->input, &ir->ir);
 
 	} else if (ir->mask_keydown) {
 		/* bit set on keydown */
 		if (gpio & ir->mask_keydown) {
-			ir_input_keydown(ir->input, &ir->ir, data, data);
+			ir_input_keydown(ir->input, &ir->ir, data);
 		} else {
 			ir_input_nokey(ir->input, &ir->ir);
 		}
@@ -132,14 +132,14 @@ static void cx88_ir_handle_key(struct cx88_IR *ir)
 	} else if (ir->mask_keyup) {
 		/* bit cleared on keydown */
 		if (0 == (gpio & ir->mask_keyup)) {
-			ir_input_keydown(ir->input, &ir->ir, data, data);
+			ir_input_keydown(ir->input, &ir->ir, data);
 		} else {
 			ir_input_nokey(ir->input, &ir->ir);
 		}
 
 	} else {
 		/* can't distinguish keydown/up :-/ */
-		ir_input_keydown(ir->input, &ir->ir, data, data);
+		ir_input_keydown(ir->input, &ir->ir, data);
 		ir_input_nokey(ir->input, &ir->ir);
 	}
 }
@@ -303,6 +303,23 @@ int cx88_ir_init(struct cx88_core *core, struct pci_dev *pci)
 		ir->mask_keydown = 0x02;
 		ir->polling      = 50; /* ms */
 		break;
+	case CX88_BOARD_OMICOM_SS4_PCI:
+	case CX88_BOARD_SATTRADE_ST4200:
+	case CX88_BOARD_TBS_8920:
+	case CX88_BOARD_TBS_8910:
+	case CX88_BOARD_PROF_7300:
+	case CX88_BOARD_PROF_7301:
+	case CX88_BOARD_PROF_6200:
+		ir_codes = &ir_codes_tbs_nec_table;
+		ir_type = IR_TYPE_PD;
+		ir->sampling = 0xff00; /* address */
+		break;
+	case CX88_BOARD_TEVII_S460:
+	case CX88_BOARD_TEVII_S420:
+		ir_codes = &ir_codes_tevii_nec_table;
+		ir_type = IR_TYPE_PD;
+		ir->sampling = 0xff00; /* address */
+		break;
 	case CX88_BOARD_DNTV_LIVE_DVB_T_PRO:
 		ir_codes         = &ir_codes_dntv_live_dvbt_pro_table;
 		ir_type          = IR_TYPE_PD;
@@ -343,7 +360,10 @@ int cx88_ir_init(struct cx88_core *core, struct pci_dev *pci)
 	snprintf(ir->name, sizeof(ir->name), "cx88 IR (%s)", core->board.name);
 	snprintf(ir->phys, sizeof(ir->phys), "pci-%s/ir0", pci_name(pci));
 
-	ir_input_init(input_dev, &ir->ir, ir_type, ir_codes);
+	err = ir_input_init(input_dev, &ir->ir, ir_type);
+	if (err < 0)
+		goto err_out_free;
+
 	input_dev->name = ir->name;
 	input_dev->phys = ir->phys;
 	input_dev->id.bustype = BUS_PCI;
@@ -363,7 +383,7 @@ int cx88_ir_init(struct cx88_core *core, struct pci_dev *pci)
 	cx88_ir_start(core, ir);
 
 	/* all done */
-	err = input_register_device(ir->input);
+	err = ir_input_register(ir->input, ir_codes);
 	if (err)
 		goto err_out_stop;
 
@@ -373,7 +393,6 @@ int cx88_ir_init(struct cx88_core *core, struct pci_dev *pci)
 	cx88_ir_stop(core, ir);
 	core->ir = NULL;
  err_out_free:
-	input_free_device(input_dev);
 	kfree(ir);
 	return err;
 }
@@ -387,7 +406,7 @@ int cx88_ir_fini(struct cx88_core *core)
 		return 0;
 
 	cx88_ir_stop(core, ir);
-	input_unregister_device(ir->input);
+	ir_input_unregister(ir->input);
 	kfree(ir);
 
 	/* done */
@@ -432,8 +451,17 @@ void cx88_ir_irq(struct cx88_core *core)
 
 	/* decode it */
 	switch (core->boardnr) {
+	case CX88_BOARD_TEVII_S460:
+	case CX88_BOARD_TEVII_S420:
 	case CX88_BOARD_TERRATEC_CINERGY_1400_DVB_T1:
 	case CX88_BOARD_DNTV_LIVE_DVB_T_PRO:
+	case CX88_BOARD_OMICOM_SS4_PCI:
+	case CX88_BOARD_SATTRADE_ST4200:
+	case CX88_BOARD_TBS_8920:
+	case CX88_BOARD_TBS_8910:
+	case CX88_BOARD_PROF_7300:
+	case CX88_BOARD_PROF_7301:
+	case CX88_BOARD_PROF_6200:
 		ircode = ir_decode_pulsedistance(ir->samples, ir->scount, 1, 4);
 
 		if (ircode == 0xffffffff) { /* decoding error */
@@ -461,7 +489,7 @@ void cx88_ir_irq(struct cx88_core *core)
 
 		ir_dprintk("Key Code: %x\n", (ircode >> 16) & 0x7f);
 
-		ir_input_keydown(ir->input, &ir->ir, (ircode >> 16) & 0x7f, (ircode >> 16) & 0xff);
+		ir_input_keydown(ir->input, &ir->ir, (ircode >> 16) & 0x7f);
 		ir->release = jiffies + msecs_to_jiffies(120);
 		break;
 	case CX88_BOARD_HAUPPAUGE:
@@ -498,7 +526,7 @@ void cx88_ir_irq(struct cx88_core *core)
 		if ( dev != 0x1e && dev != 0x1f )
 			/* not a hauppauge remote */
 			break;
-		ir_input_keydown(ir->input, &ir->ir, code, ircode);
+		ir_input_keydown(ir->input, &ir->ir, code);
 		ir->release = jiffies + msecs_to_jiffies(120);
 		break;
 	case CX88_BOARD_PINNACLE_PCTV_HD_800i:
@@ -506,7 +534,7 @@ void cx88_ir_irq(struct cx88_core *core)
 		ir_dprintk("biphase decoded: %x\n", ircode);
 		if ((ircode & 0xfffff000) != 0x3000)
 			break;
-		ir_input_keydown(ir->input, &ir->ir, ircode & 0x3f, ircode);
+		ir_input_keydown(ir->input, &ir->ir, ircode & 0x3f);
 		ir->release = jiffies + msecs_to_jiffies(120);
 		break;
 	}
diff --git a/drivers/media/video/cx88/cx88-mpeg.c b/drivers/media/video/cx88/cx88-mpeg.c
index de9ff0fc741f..bb5104893411 100644
--- a/drivers/media/video/cx88/cx88-mpeg.c
+++ b/drivers/media/video/cx88/cx88-mpeg.c
@@ -580,21 +580,6 @@ static int cx8802_resume_common(struct pci_dev *pci_dev)
 	return 0;
 }
 
-#if defined(CONFIG_VIDEO_CX88_BLACKBIRD) || \
-    defined(CONFIG_VIDEO_CX88_BLACKBIRD_MODULE)
-struct cx8802_dev *cx8802_get_device(int minor)
-{
-	struct cx8802_dev *dev;
-
-	list_for_each_entry(dev, &cx8802_devlist, devlist)
-		if (dev->mpeg_dev && dev->mpeg_dev->minor == minor)
-			return dev;
-
-	return NULL;
-}
-EXPORT_SYMBOL(cx8802_get_device);
-#endif
-
 struct cx8802_driver * cx8802_get_driver(struct cx8802_dev *dev, enum cx88_board_type btype)
 {
 	struct cx8802_driver *d;
diff --git a/drivers/media/video/cx88/cx88-video.c b/drivers/media/video/cx88/cx88-video.c
index 57e6b1241090..48c450f4a85a 100644
--- a/drivers/media/video/cx88/cx88-video.c
+++ b/drivers/media/video/cx88/cx88-video.c
@@ -75,10 +75,6 @@ MODULE_PARM_DESC(vid_limit,"capture memory limit in megabytes");
 #define dprintk(level,fmt, arg...)	if (video_debug >= level) \
 	printk(KERN_DEBUG "%s/0: " fmt, core->name , ## arg)
 
-/* ------------------------------------------------------------------ */
-
-static LIST_HEAD(cx8800_devlist);
-
 /* ------------------------------------------------------------------- */
 /* static data                                                         */
 
@@ -753,38 +749,31 @@ static int get_ressource(struct cx8800_fh *fh)
 
 static int video_open(struct file *file)
 {
-	int minor = video_devdata(file)->minor;
-	struct cx8800_dev *h,*dev = NULL;
+	struct video_device *vdev = video_devdata(file);
+	struct cx8800_dev *dev = video_drvdata(file);
 	struct cx88_core *core;
 	struct cx8800_fh *fh;
 	enum v4l2_buf_type type = 0;
 	int radio = 0;
 
-	lock_kernel();
-	list_for_each_entry(h, &cx8800_devlist, devlist) {
-		if (h->video_dev->minor == minor) {
-			dev  = h;
-			type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
-		}
-		if (h->vbi_dev->minor == minor) {
-			dev  = h;
-			type = V4L2_BUF_TYPE_VBI_CAPTURE;
-		}
-		if (h->radio_dev &&
-		    h->radio_dev->minor == minor) {
-			radio = 1;
-			dev   = h;
-		}
-	}
-	if (NULL == dev) {
-		unlock_kernel();
-		return -ENODEV;
+	switch (vdev->vfl_type) {
+	case VFL_TYPE_GRABBER:
+		type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
+		break;
+	case VFL_TYPE_VBI:
+		type = V4L2_BUF_TYPE_VBI_CAPTURE;
+		break;
+	case VFL_TYPE_RADIO:
+		radio = 1;
+		break;
 	}
 
+	lock_kernel();
+
 	core = dev->core;
 
-	dprintk(1,"open minor=%d radio=%d type=%s\n",
-		minor,radio,v4l2_type_names[type]);
+	dprintk(1, "open dev=%s radio=%d type=%s\n",
+		video_device_node_name(vdev), radio, v4l2_type_names[type]);
 
 	/* allocate + initialize per filehandle data */
 	fh = kzalloc(sizeof(*fh),GFP_KERNEL);
@@ -935,7 +924,7 @@ static int video_release(struct file *file)
 
 	mutex_lock(&dev->core->lock);
 	if(atomic_dec_and_test(&dev->core->users))
-		call_all(dev->core, tuner, s_standby);
+		call_all(dev->core, core, s_power, 0);
 	mutex_unlock(&dev->core->lock);
 
 	return 0;
@@ -1733,7 +1722,6 @@ static struct video_device cx8800_vbi_template;
 static struct video_device cx8800_video_template = {
 	.name                 = "cx8800-video",
 	.fops                 = &video_fops,
-	.minor                = -1,
 	.ioctl_ops 	      = &video_ioctl_ops,
 	.tvnorms              = CX88_NORMS,
 	.current_norm         = V4L2_STD_NTSC_M,
@@ -1769,7 +1757,6 @@ static const struct v4l2_ioctl_ops radio_ioctl_ops = {
 static struct video_device cx8800_radio_template = {
 	.name                 = "cx8800-radio",
 	.fops                 = &radio_fops,
-	.minor                = -1,
 	.ioctl_ops 	      = &radio_ioctl_ops,
 };
 
@@ -1778,21 +1765,21 @@ static struct video_device cx8800_radio_template = {
 static void cx8800_unregister_video(struct cx8800_dev *dev)
 {
 	if (dev->radio_dev) {
-		if (-1 != dev->radio_dev->minor)
+		if (video_is_registered(dev->radio_dev))
 			video_unregister_device(dev->radio_dev);
 		else
 			video_device_release(dev->radio_dev);
 		dev->radio_dev = NULL;
 	}
 	if (dev->vbi_dev) {
-		if (-1 != dev->vbi_dev->minor)
+		if (video_is_registered(dev->vbi_dev))
 			video_unregister_device(dev->vbi_dev);
 		else
 			video_device_release(dev->vbi_dev);
 		dev->vbi_dev = NULL;
 	}
 	if (dev->video_dev) {
-		if (-1 != dev->video_dev->minor)
+		if (video_is_registered(dev->video_dev))
 			video_unregister_device(dev->video_dev);
 		else
 			video_device_release(dev->video_dev);
@@ -1909,6 +1896,7 @@ static int __devinit cx8800_initdev(struct pci_dev *pci_dev,
 	/* register v4l devices */
 	dev->video_dev = cx88_vdev_init(core,dev->pci,
 					&cx8800_video_template,"video");
+	video_set_drvdata(dev->video_dev, dev);
 	err = video_register_device(dev->video_dev,VFL_TYPE_GRABBER,
 				    video_nr[core->nr]);
 	if (err < 0) {
@@ -1916,10 +1904,11 @@ static int __devinit cx8800_initdev(struct pci_dev *pci_dev,
 		       core->name);
 		goto fail_unreg;
 	}
-	printk(KERN_INFO "%s/0: registered device video%d [v4l2]\n",
-	       core->name, dev->video_dev->num);
+	printk(KERN_INFO "%s/0: registered device %s [v4l2]\n",
+	       core->name, video_device_node_name(dev->video_dev));
 
 	dev->vbi_dev = cx88_vdev_init(core,dev->pci,&cx8800_vbi_template,"vbi");
+	video_set_drvdata(dev->vbi_dev, dev);
 	err = video_register_device(dev->vbi_dev,VFL_TYPE_VBI,
 				    vbi_nr[core->nr]);
 	if (err < 0) {
@@ -1927,12 +1916,13 @@ static int __devinit cx8800_initdev(struct pci_dev *pci_dev,
 		       core->name);
 		goto fail_unreg;
 	}
-	printk(KERN_INFO "%s/0: registered device vbi%d\n",
-	       core->name, dev->vbi_dev->num);
+	printk(KERN_INFO "%s/0: registered device %s\n",
+	       core->name, video_device_node_name(dev->vbi_dev));
 
 	if (core->board.radio.type == CX88_RADIO) {
 		dev->radio_dev = cx88_vdev_init(core,dev->pci,
 						&cx8800_radio_template,"radio");
+		video_set_drvdata(dev->radio_dev, dev);
 		err = video_register_device(dev->radio_dev,VFL_TYPE_RADIO,
 					    radio_nr[core->nr]);
 		if (err < 0) {
@@ -1940,12 +1930,11 @@ static int __devinit cx8800_initdev(struct pci_dev *pci_dev,
 			       core->name);
 			goto fail_unreg;
 		}
-		printk(KERN_INFO "%s/0: registered device radio%d\n",
-		       core->name, dev->radio_dev->num);
+		printk(KERN_INFO "%s/0: registered device %s\n",
+		       core->name, video_device_node_name(dev->radio_dev));
 	}
 
 	/* everything worked */
-	list_add_tail(&dev->devlist,&cx8800_devlist);
 	pci_set_drvdata(pci_dev,dev);
 
 	/* initial device configuration */
@@ -2001,7 +1990,6 @@ static void __devexit cx8800_finidev(struct pci_dev *pci_dev)
 
 	/* free memory */
 	btcx_riscmem_free(dev->pci,&dev->vidq.stopper);
-	list_del(&dev->devlist);
 	cx88_core_put(core,dev->pci);
 	kfree(dev);
 }
diff --git a/drivers/media/video/cx88/cx88.h b/drivers/media/video/cx88/cx88.h
index d5cea41f4207..b1499bf604ea 100644
--- a/drivers/media/video/cx88/cx88.h
+++ b/drivers/media/video/cx88/cx88.h
@@ -238,6 +238,7 @@ extern struct sram_channel cx88_sram_channels[];
 #define CX88_BOARD_HAUPPAUGE_IRONLY        80
 #define CX88_BOARD_WINFAST_DTV1800H        81
 #define CX88_BOARD_WINFAST_DTV2000H_J      82
+#define CX88_BOARD_PROF_7301               83
 
 enum cx88_itype {
 	CX88_VMUX_COMPOSITE1 = 1,
@@ -422,7 +423,6 @@ struct cx8800_suspend_state {
 
 struct cx8800_dev {
 	struct cx88_core           *core;
-	struct list_head           devlist;
 	spinlock_t                 slock;
 
 	/* various device info */
@@ -669,7 +669,6 @@ int cx88_audio_thread(void *data);
 
 int cx8802_register_driver(struct cx8802_driver *drv);
 int cx8802_unregister_driver(struct cx8802_driver *drv);
-struct cx8802_dev *cx8802_get_device(int minor);
 struct cx8802_driver * cx8802_get_driver(struct cx8802_dev *dev, enum cx88_board_type btype);
 
 /* ----------------------------------------------------------- */
diff --git a/drivers/media/video/davinci/dm355_ccdc.c b/drivers/media/video/davinci/dm355_ccdc.c
index 4629cabe3f28..314390016370 100644
--- a/drivers/media/video/davinci/dm355_ccdc.c
+++ b/drivers/media/video/davinci/dm355_ccdc.c
@@ -285,7 +285,7 @@ static int validate_ccdc_param(struct ccdc_config_params_raw *ccdcparam)
 
 	if ((ccdcparam->med_filt_thres < 0) ||
 	   (ccdcparam->med_filt_thres > CCDC_MED_FILT_THRESH)) {
-		dev_dbg(dev, "Invalid value of median filter thresold\n");
+		dev_dbg(dev, "Invalid value of median filter threshold\n");
 		return -EINVAL;
 	}
 
@@ -959,7 +959,7 @@ static struct ccdc_hw_device ccdc_hw_dev = {
 	},
 };
 
-static int dm355_ccdc_init(void)
+static int __init dm355_ccdc_init(void)
 {
 	printk(KERN_NOTICE "dm355_ccdc_init\n");
 	if (vpfe_register_ccdc_device(&ccdc_hw_dev) < 0)
@@ -969,7 +969,7 @@ static int dm355_ccdc_init(void)
 	return 0;
 }
 
-static void dm355_ccdc_exit(void)
+static void __exit dm355_ccdc_exit(void)
 {
 	vpfe_unregister_ccdc_device(&ccdc_hw_dev);
 }
diff --git a/drivers/media/video/davinci/dm644x_ccdc.c b/drivers/media/video/davinci/dm644x_ccdc.c
index 2f19a919f477..d5fa193f32d2 100644
--- a/drivers/media/video/davinci/dm644x_ccdc.c
+++ b/drivers/media/video/davinci/dm644x_ccdc.c
@@ -859,7 +859,7 @@ static struct ccdc_hw_device ccdc_hw_dev = {
 	},
 };
 
-static int dm644x_ccdc_init(void)
+static int __init dm644x_ccdc_init(void)
 {
 	printk(KERN_NOTICE "dm644x_ccdc_init\n");
 	if (vpfe_register_ccdc_device(&ccdc_hw_dev) < 0)
@@ -869,7 +869,7 @@ static int dm644x_ccdc_init(void)
 	return 0;
 }
 
-static void dm644x_ccdc_exit(void)
+static void __exit dm644x_ccdc_exit(void)
 {
 	vpfe_unregister_ccdc_device(&ccdc_hw_dev);
 }
diff --git a/drivers/media/video/davinci/vpfe_capture.c b/drivers/media/video/davinci/vpfe_capture.c
index 402ce43ef38e..de22bc9faf21 100644
--- a/drivers/media/video/davinci/vpfe_capture.c
+++ b/drivers/media/video/davinci/vpfe_capture.c
@@ -70,7 +70,6 @@
 #include <linux/init.h>
 #include <linux/platform_device.h>
 #include <linux/interrupt.h>
-#include <linux/version.h>
 #include <media/v4l2-common.h>
 #include <linux/io.h>
 #include <media/davinci/vpfe_capture.h>
@@ -660,7 +659,7 @@ static void vpfe_detach_irq(struct vpfe_device *vpfe_dev)
 
 	frame_format = ccdc_dev->hw_ops.get_frame_format();
 	if (frame_format == CCDC_FRMFMT_PROGRESSIVE)
-		free_irq(IRQ_VDINT1, vpfe_dev);
+		free_irq(vpfe_dev->ccdc_irq1, vpfe_dev);
 }
 
 static int vpfe_attach_irq(struct vpfe_device *vpfe_dev)
@@ -1338,7 +1337,7 @@ static int vpfe_reqbufs(struct file *file, void *priv,
 	vpfe_dev->memory = req_buf->memory;
 	videobuf_queue_dma_contig_init(&vpfe_dev->buffer_queue,
 				&vpfe_videobuf_qops,
-				NULL,
+				vpfe_dev->pdev,
 				&vpfe_dev->irqlock,
 				req_buf->type,
 				vpfe_dev->fmt.fmt.pix.field,
@@ -1413,6 +1412,41 @@ static int vpfe_dqbuf(struct file *file, void *priv,
 				      buf, file->f_flags & O_NONBLOCK);
 }
 
+static int vpfe_queryctrl(struct file *file, void *priv,
+		struct v4l2_queryctrl *qctrl)
+{
+	struct vpfe_device *vpfe_dev = video_drvdata(file);
+	struct vpfe_subdev_info *sdinfo;
+
+	sdinfo = vpfe_dev->current_subdev;
+
+	return v4l2_device_call_until_err(&vpfe_dev->v4l2_dev, sdinfo->grp_id,
+					 core, queryctrl, qctrl);
+
+}
+
+static int vpfe_g_ctrl(struct file *file, void *priv, struct v4l2_control *ctrl)
+{
+	struct vpfe_device *vpfe_dev = video_drvdata(file);
+	struct vpfe_subdev_info *sdinfo;
+
+	sdinfo = vpfe_dev->current_subdev;
+
+	return v4l2_device_call_until_err(&vpfe_dev->v4l2_dev, sdinfo->grp_id,
+					 core, g_ctrl, ctrl);
+}
+
+static int vpfe_s_ctrl(struct file *file, void *priv, struct v4l2_control *ctrl)
+{
+	struct vpfe_device *vpfe_dev = video_drvdata(file);
+	struct vpfe_subdev_info *sdinfo;
+
+	sdinfo = vpfe_dev->current_subdev;
+
+	return v4l2_device_call_until_err(&vpfe_dev->v4l2_dev, sdinfo->grp_id,
+					 core, s_ctrl, ctrl);
+}
+
 /*
  * vpfe_calculate_offsets : This function calculates buffers offset
  * for top and bottom field
@@ -1577,7 +1611,7 @@ static int vpfe_cropcap(struct file *file, void *priv,
 
 	v4l2_dbg(1, debug, &vpfe_dev->v4l2_dev, "vpfe_cropcap\n");
 
-	if (vpfe_dev->std_index > ARRAY_SIZE(vpfe_standards))
+	if (vpfe_dev->std_index >= ARRAY_SIZE(vpfe_standards))
 		return -EINVAL;
 
 	memset(crop, 0, sizeof(struct v4l2_cropcap));
@@ -1710,6 +1744,9 @@ static const struct v4l2_ioctl_ops vpfe_ioctl_ops = {
 	.vidioc_querystd	 = vpfe_querystd,
 	.vidioc_s_std		 = vpfe_s_std,
 	.vidioc_g_std		 = vpfe_g_std,
+	.vidioc_queryctrl	 = vpfe_queryctrl,
+	.vidioc_g_ctrl		 = vpfe_g_ctrl,
+	.vidioc_s_ctrl		 = vpfe_s_ctrl,
 	.vidioc_reqbufs		 = vpfe_reqbufs,
 	.vidioc_querybuf	 = vpfe_querybuf,
 	.vidioc_qbuf		 = vpfe_qbuf,
@@ -1929,7 +1966,6 @@ static __init int vpfe_probe(struct platform_device *pdev)
 	vfd->release		= video_device_release;
 	vfd->fops		= &vpfe_fops;
 	vfd->ioctl_ops		= &vpfe_ioctl_ops;
-	vfd->minor		= -1;
 	vfd->tvnorms		= 0;
 	vfd->current_norm	= V4L2_STD_PAL;
 	vfd->v4l2_dev 		= &vpfe_dev->v4l2_dev;
@@ -1978,8 +2014,7 @@ static __init int vpfe_probe(struct platform_device *pdev)
 	platform_set_drvdata(pdev, vpfe_dev);
 	/* set driver private data */
 	video_set_drvdata(vpfe_dev->video_dev, vpfe_dev);
-	i2c_adap = i2c_get_adapter(1);
-	vpfe_cfg = pdev->dev.platform_data;
+	i2c_adap = i2c_get_adapter(vpfe_cfg->i2c_adapter_id);
 	num_subdevs = vpfe_cfg->num_subdevs;
 	vpfe_dev->sd = kmalloc(sizeof(struct v4l2_subdev *) * num_subdevs,
 				GFP_KERNEL);
@@ -2034,7 +2069,7 @@ probe_out_video_unregister:
 probe_out_v4l2_unregister:
 	v4l2_device_unregister(&vpfe_dev->v4l2_dev);
 probe_out_video_release:
-	if (vpfe_dev->video_dev->minor == -1)
+	if (!video_is_registered(vpfe_dev->video_dev))
 		video_device_release(vpfe_dev->video_dev);
 probe_out_release_irq:
 	free_irq(vpfe_dev->ccdc_irq0, vpfe_dev);
@@ -2054,7 +2089,7 @@ probe_free_dev_mem:
 /*
  * vpfe_remove : It un-register device from V4L2 driver
  */
-static int vpfe_remove(struct platform_device *pdev)
+static int __devexit vpfe_remove(struct platform_device *pdev)
 {
 	struct vpfe_device *vpfe_dev = platform_get_drvdata(pdev);
 	struct resource *res;
@@ -2090,7 +2125,7 @@ vpfe_resume(struct device *dev)
 	return -1;
 }
 
-static struct dev_pm_ops vpfe_dev_pm_ops = {
+static const struct dev_pm_ops vpfe_dev_pm_ops = {
 	.suspend = vpfe_suspend,
 	.resume = vpfe_resume,
 };
diff --git a/drivers/media/video/davinci/vpif.c b/drivers/media/video/davinci/vpif.c
index 3b8eac31ecae..1f532e31cd49 100644
--- a/drivers/media/video/davinci/vpif.c
+++ b/drivers/media/video/davinci/vpif.c
@@ -266,7 +266,7 @@ fail:
 	return status;
 }
 
-static int vpif_remove(struct platform_device *pdev)
+static int __devexit vpif_remove(struct platform_device *pdev)
 {
 	iounmap(vpif_base);
 	release_mem_region(res->start, res_len);
diff --git a/drivers/media/video/davinci/vpif_capture.c b/drivers/media/video/davinci/vpif_capture.c
index d947ee5e4eb4..78130721f578 100644
--- a/drivers/media/video/davinci/vpif_capture.c
+++ b/drivers/media/video/davinci/vpif_capture.c
@@ -2107,7 +2107,7 @@ vpif_resume(struct device *dev)
 	return -1;
 }
 
-static struct dev_pm_ops vpif_dev_pm_ops = {
+static const struct dev_pm_ops vpif_dev_pm_ops = {
 	.suspend = vpif_suspend,
 	.resume = vpif_resume,
 };
diff --git a/drivers/media/video/davinci/vpif_display.c b/drivers/media/video/davinci/vpif_display.c
index d14cfb200ed0..dfddef7228dd 100644
--- a/drivers/media/video/davinci/vpif_display.c
+++ b/drivers/media/video/davinci/vpif_display.c
@@ -1347,7 +1347,6 @@ static const struct v4l2_file_operations vpif_fops = {
 static struct video_device vpif_video_template = {
 	.name		= "vpif",
 	.fops		= &vpif_fops,
-	.minor		= -1,
 	.ioctl_ops	= &vpif_ioctl_ops,
 	.tvnorms	= DM646X_V4L2_STD,
 	.current_norm	= V4L2_STD_625_50,
diff --git a/drivers/media/video/davinci/vpss.c b/drivers/media/video/davinci/vpss.c
index 6d709ca8cfb0..7ee72ecd3d81 100644
--- a/drivers/media/video/davinci/vpss.c
+++ b/drivers/media/video/davinci/vpss.c
@@ -53,7 +53,7 @@ struct vpss_hw_ops {
 	int (*enable_clock)(enum vpss_clock_sel clock_sel, int en);
 	/* select input to ccdc */
 	void (*select_ccdc_source)(enum vpss_ccdc_source_sel src_sel);
-	/* clear wbl overlflow bit */
+	/* clear wbl overflow bit */
 	int (*clear_wbl_overflow)(enum vpss_wbl_sel wbl_sel);
 };
 
@@ -268,7 +268,7 @@ fail1:
 	return status;
 }
 
-static int vpss_remove(struct platform_device *pdev)
+static int __devexit vpss_remove(struct platform_device *pdev)
 {
 	iounmap(oper_cfg.vpss_bl_regs_base);
 	release_mem_region(oper_cfg.r1->start, oper_cfg.len1);
diff --git a/drivers/media/video/em28xx/em28xx-audio.c b/drivers/media/video/em28xx/em28xx-audio.c
index ac947aecb9c3..bd783387b37d 100644
--- a/drivers/media/video/em28xx/em28xx-audio.c
+++ b/drivers/media/video/em28xx/em28xx-audio.c
@@ -293,7 +293,7 @@ static int snd_em28xx_capture_open(struct snd_pcm_substream *substream)
 	dprintk("opening device and trying to acquire exclusive lock\n");
 
 	if (!dev) {
-		printk(KERN_ERR "BUG: em28xx can't find device struct."
+		em28xx_err("BUG: em28xx can't find device struct."
 				" Can't proceed with open\n");
 		return -ENODEV;
 	}
@@ -325,7 +325,7 @@ static int snd_em28xx_capture_open(struct snd_pcm_substream *substream)
 
 	return 0;
 err:
-	printk(KERN_ERR "Error while configuring em28xx mixer\n");
+	em28xx_err("Error while configuring em28xx mixer\n");
 	return ret;
 }
 
diff --git a/drivers/media/video/em28xx/em28xx-cards.c b/drivers/media/video/em28xx/em28xx-cards.c
index c0fd5c6feeac..25100001ffff 100644
--- a/drivers/media/video/em28xx/em28xx-cards.c
+++ b/drivers/media/video/em28xx/em28xx-cards.c
@@ -225,6 +225,14 @@ static struct em28xx_reg_seq silvercrest_reg_seq[] = {
 	{	-1,		-1,	-1,		-1},
 };
 
+static struct em28xx_reg_seq vc211a_enable[] = {
+	{EM28XX_R08_GPIO,	0xff,	0x07,		10},
+	{EM28XX_R08_GPIO,	0xff,	0x0f,		10},
+	{EM28XX_R08_GPIO,	0xff,	0x0b,		10},
+	{	-1,		-1,	-1,		-1},
+};
+
+
 /*
  *  Board definitions
  */
@@ -829,7 +837,7 @@ struct em28xx_board em28xx_boards[] = {
 		.mts_firmware   = 1,
 		.has_dvb        = 1,
 		.dvb_gpio       = hauppauge_wintv_hvr_900_digital,
-		.ir_codes       = &ir_codes_hauppauge_new_table,
+		.ir_codes       = &ir_codes_rc5_hauppauge_new_table,
 		.decoder        = EM28XX_TVP5150,
 		.input          = { {
 			.type     = EM28XX_VMUX_TELEVISION,
@@ -1009,6 +1017,23 @@ struct em28xx_board em28xx_boards[] = {
 			.amux     = EM28XX_AMUX_LINE_IN,
 		} },
 	},
+	[EM2800_BOARD_VC211A] = {
+		.name         = "Actionmaster/LinXcel/Digitus VC211A",
+		.is_em2800    = 1,
+		.tuner_type   = TUNER_ABSENT,	/* Capture-only board */
+		.decoder      = EM28XX_SAA711X,
+		.input        = { {
+			.type     = EM28XX_VMUX_COMPOSITE1,
+			.vmux     = SAA7115_COMPOSITE0,
+			.amux     = EM28XX_AMUX_LINE_IN,
+			.gpio     = vc211a_enable,
+		}, {
+			.type     = EM28XX_VMUX_SVIDEO,
+			.vmux     = SAA7115_SVIDEO3,
+			.amux     = EM28XX_AMUX_LINE_IN,
+			.gpio     = vc211a_enable,
+		} },
+	},
 	[EM2800_BOARD_LEADTEK_WINFAST_USBII] = {
 		.name         = "Leadtek Winfast USB II",
 		.is_em2800    = 1,
@@ -1381,10 +1406,14 @@ struct em28xx_board em28xx_boards[] = {
 	},
 	[EM2882_BOARD_TERRATEC_HYBRID_XS] = {
 		.name         = "Terratec Hybrid XS (em2882)",
-		.valid        = EM28XX_BOARD_NOT_VALIDATED,
 		.tuner_type   = TUNER_XC2028,
 		.tuner_gpio   = default_tuner_gpio,
+		.mts_firmware = 1,
 		.decoder      = EM28XX_TVP5150,
+		.has_dvb      = 1,
+		.dvb_gpio     = hauppauge_wintv_hvr_900_digital,
+		.ir_codes     = &ir_codes_terratec_cinergy_xs_table,
+		.xclk         = EM28XX_XCLK_FREQUENCY_12MHZ,
 		.input        = { {
 			.type     = EM28XX_VMUX_TELEVISION,
 			.vmux     = TVP5150_COMPOSITE0,
@@ -1608,6 +1637,8 @@ struct usb_device_id em28xx_id_table[] = {
 			.driver_info = EM2820_BOARD_UNKNOWN },
 	{ USB_DEVICE(0xeb1a, 0x2861),
 			.driver_info = EM2820_BOARD_UNKNOWN },
+	{ USB_DEVICE(0xeb1a, 0x2862),
+			.driver_info = EM2820_BOARD_UNKNOWN },
 	{ USB_DEVICE(0xeb1a, 0x2870),
 			.driver_info = EM2820_BOARD_UNKNOWN },
 	{ USB_DEVICE(0xeb1a, 0x2881),
@@ -2050,6 +2081,7 @@ static void em28xx_setup_xc3028(struct em28xx *dev, struct xc2028_ctrl *ctl)
 	switch (dev->model) {
 	case EM2880_BOARD_EMPIRE_DUAL_TV:
 	case EM2880_BOARD_HAUPPAUGE_WINTV_HVR_900:
+	case EM2882_BOARD_TERRATEC_HYBRID_XS:
 		ctl->demod = XC3028_FE_ZARLINK456;
 		break;
 	case EM2880_BOARD_TERRATEC_HYBRID_XS:
@@ -2227,6 +2259,7 @@ static int em28xx_hint_board(struct em28xx *dev)
 /* ----------------------------------------------------------------------- */
 void em28xx_register_i2c_ir(struct em28xx *dev)
 {
+	struct i2c_board_info info;
 	const unsigned short addr_list[] = {
 		 0x30, 0x47, I2C_CLIENT_END
 	};
@@ -2234,9 +2267,9 @@ void em28xx_register_i2c_ir(struct em28xx *dev)
 	if (disable_ir)
 		return;
 
-	memset(&dev->info, 0, sizeof(&dev->info));
+	memset(&info, 0, sizeof(struct i2c_board_info));
 	memset(&dev->init_data, 0, sizeof(dev->init_data));
-	strlcpy(dev->info.type, "ir_video", I2C_NAME_SIZE);
+	strlcpy(info.type, "ir_video", I2C_NAME_SIZE);
 
 	/* detect & configure */
 	switch (dev->model) {
@@ -2252,15 +2285,15 @@ void em28xx_register_i2c_ir(struct em28xx *dev)
 		dev->init_data.name = "i2c IR (EM28XX Pinnacle PCTV)";
 		break;
 	case EM2820_BOARD_HAUPPAUGE_WINTV_USB_2:
-		dev->init_data.ir_codes = &ir_codes_hauppauge_new_table;
+		dev->init_data.ir_codes = &ir_codes_rc5_hauppauge_new_table;
 		dev->init_data.get_key = em28xx_get_key_em_haup;
 		dev->init_data.name = "i2c IR (EM2840 Hauppauge)";
 		break;
 	}
 
 	if (dev->init_data.name)
-		dev->info.platform_data = &dev->init_data;
-	i2c_new_probed_device(&dev->i2c_adap, &dev->info, addr_list);
+		info.platform_data = &dev->init_data;
+	i2c_new_probed_device(&dev->i2c_adap, &info, addr_list);
 }
 
 void em28xx_card_setup(struct em28xx *dev)
@@ -2524,6 +2557,9 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev,
 		dev->chip_id = retval;
 
 		switch (dev->chip_id) {
+		case CHIP_ID_EM2800:
+			em28xx_info("chip ID is em2800\n");
+			break;
 		case CHIP_ID_EM2710:
 			em28xx_info("chip ID is em2710\n");
 			break;
@@ -2617,7 +2653,6 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev,
 	INIT_LIST_HEAD(&dev->vbiq.active);
 	INIT_LIST_HEAD(&dev->vbiq.queued);
 
-
 	if (dev->board.has_msp34xx) {
 		/* Send a reset to other chips via gpio */
 		errCode = em28xx_write_reg(dev, EM28XX_R08_GPIO, 0xf7);
@@ -2650,7 +2685,7 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev,
 	em28xx_init_extension(dev);
 
 	/* Save some power by putting tuner to sleep */
-	v4l2_device_call_all(&dev->v4l2_dev, 0, tuner, s_standby);
+	v4l2_device_call_all(&dev->v4l2_dev, 0, core, s_power, 0);
 
 	return 0;
 
@@ -2887,9 +2922,9 @@ static void em28xx_usb_disconnect(struct usb_interface *interface)
 
 	if (dev->users) {
 		em28xx_warn
-		    ("device /dev/video%d is open! Deregistration and memory "
+		    ("device %s is open! Deregistration and memory "
 		     "deallocation are deferred on close.\n",
-				dev->vdev->num);
+		     video_device_node_name(dev->vdev));
 
 		dev->state |= DEV_MISCONFIGURED;
 		em28xx_uninit_isoc(dev);
diff --git a/drivers/media/video/em28xx/em28xx-core.c b/drivers/media/video/em28xx/em28xx-core.c
index a88257a7d94f..b311d4514bdf 100644
--- a/drivers/media/video/em28xx/em28xx-core.c
+++ b/drivers/media/video/em28xx/em28xx-core.c
@@ -50,7 +50,7 @@ MODULE_PARM_DESC(reg_debug, "enable debug messages [URB reg]");
 		printk(KERN_INFO "%s %s :"fmt, \
 			 dev->name, __func__ , ##arg); } while (0)
 
-static int alt = EM28XX_PINOUT;
+static int alt;
 module_param(alt, int, 0644);
 MODULE_PARM_DESC(alt, "alternate setting to use for video endpoint");
 
@@ -216,7 +216,7 @@ int em28xx_write_reg(struct em28xx *dev, u16 reg, u8 val)
  * sets only some bits (specified by bitmask) of a register, by first reading
  * the actual value
  */
-static int em28xx_write_reg_bits(struct em28xx *dev, u16 reg, u8 val,
+int em28xx_write_reg_bits(struct em28xx *dev, u16 reg, u8 val,
 				 u8 bitmask)
 {
 	int oldval;
@@ -533,8 +533,15 @@ int em28xx_audio_setup(struct em28xx *dev)
 
 	vid1 = em28xx_read_ac97(dev, AC97_VENDOR_ID1);
 	if (vid1 < 0) {
-		/* Device likely doesn't support AC97 */
+		/*
+		 * Device likely doesn't support AC97
+		 * Note: (some) em2800 devices without eeprom reports 0x91 on
+		 *	 CHIPCFG register, even not having an AC97 chip
+		 */
 		em28xx_warn("AC97 chip type couldn't be determined\n");
+		dev->audio_mode.ac97 = EM28XX_NO_AC97;
+		dev->has_alsa_audio = 0;
+		dev->audio_mode.has_audio = 0;
 		goto init_audio;
 	}
 
@@ -778,6 +785,16 @@ int em28xx_set_alternate(struct em28xx *dev)
 	int i;
 	unsigned int min_pkt_size = dev->width * 2 + 4;
 
+	/*
+	 * alt = 0 is used only for control messages, so, only values
+	 * greater than 0 can be used for streaming.
+	 */
+	if (alt && alt < dev->num_alt) {
+		em28xx_coredbg("alternate forced to %d\n", dev->alt);
+		dev->alt = alt;
+		goto set_alt;
+	}
+
 	/* When image size is bigger than a certain value,
 	   the frame size should be increased, otherwise, only
 	   green screen will be received.
@@ -798,6 +815,7 @@ int em28xx_set_alternate(struct em28xx *dev)
 			dev->alt = i;
 	}
 
+set_alt:
 	if (dev->alt != prev_alt) {
 		em28xx_coredbg("minimum isoc packet size: %u (alt=%d)\n",
 				min_pkt_size, dev->alt);
@@ -1118,34 +1136,6 @@ void em28xx_wake_i2c(struct em28xx *dev)
 static LIST_HEAD(em28xx_devlist);
 static DEFINE_MUTEX(em28xx_devlist_mutex);
 
-struct em28xx *em28xx_get_device(int minor,
-				 enum v4l2_buf_type *fh_type,
-				 int *has_radio)
-{
-	struct em28xx *h, *dev = NULL;
-
-	*fh_type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
-	*has_radio = 0;
-
-	mutex_lock(&em28xx_devlist_mutex);
-	list_for_each_entry(h, &em28xx_devlist, devlist) {
-		if (h->vdev->minor == minor)
-			dev = h;
-		if (h->vbi_dev && h->vbi_dev->minor == minor) {
-			dev = h;
-			*fh_type = V4L2_BUF_TYPE_VBI_CAPTURE;
-		}
-		if (h->radio_dev &&
-		    h->radio_dev->minor == minor) {
-			dev = h;
-			*has_radio = 1;
-		}
-	}
-	mutex_unlock(&em28xx_devlist_mutex);
-
-	return dev;
-}
-
 /*
  * em28xx_realease_resources()
  * unregisters the v4l2,i2c and usb devices
diff --git a/drivers/media/video/em28xx/em28xx-dvb.c b/drivers/media/video/em28xx/em28xx-dvb.c
index db749461e5c6..cc0505eb900f 100644
--- a/drivers/media/video/em28xx/em28xx-dvb.c
+++ b/drivers/media/video/em28xx/em28xx-dvb.c
@@ -313,22 +313,20 @@ static int attach_xc3028(u8 addr, struct em28xx *dev)
 	cfg.i2c_addr  = addr;
 
 	if (!dev->dvb->frontend) {
-		printk(KERN_ERR "%s/2: dvb frontend not attached. "
-				"Can't attach xc3028\n",
-		       dev->name);
+		em28xx_errdev("/2: dvb frontend not attached. "
+				"Can't attach xc3028\n");
 		return -EINVAL;
 	}
 
 	fe = dvb_attach(xc2028_attach, dev->dvb->frontend, &cfg);
 	if (!fe) {
-		printk(KERN_ERR "%s/2: xc3028 attach failed\n",
-		       dev->name);
+		em28xx_errdev("/2: xc3028 attach failed\n");
 		dvb_frontend_detach(dev->dvb->frontend);
 		dev->dvb->frontend = NULL;
 		return -EINVAL;
 	}
 
-	printk(KERN_INFO "%s/2: xc3028 attached\n", dev->name);
+	em28xx_info("%s/2: xc3028 attached\n", dev->name);
 
 	return 0;
 }
@@ -463,7 +461,7 @@ static int dvb_init(struct em28xx *dev)
 	dvb = kzalloc(sizeof(struct em28xx_dvb), GFP_KERNEL);
 
 	if (dvb == NULL) {
-		printk(KERN_INFO "em28xx_dvb: memory allocation failed\n");
+		em28xx_info("em28xx_dvb: memory allocation failed\n");
 		return -ENOMEM;
 	}
 	dev->dvb = dvb;
@@ -493,6 +491,7 @@ static int dvb_init(struct em28xx *dev)
 		}
 		break;
 	case EM2880_BOARD_HAUPPAUGE_WINTV_HVR_900:
+	case EM2882_BOARD_TERRATEC_HYBRID_XS:
 	case EM2880_BOARD_EMPIRE_DUAL_TV:
 		dvb->frontend = dvb_attach(zl10353_attach,
 					   &em28xx_zl10353_xc3028_no_i2c_gate,
@@ -569,15 +568,12 @@ static int dvb_init(struct em28xx *dev)
 		}
 		break;
 	default:
-		printk(KERN_ERR "%s/2: The frontend of your DVB/ATSC card"
-				" isn't supported yet\n",
-		       dev->name);
+		em28xx_errdev("/2: The frontend of your DVB/ATSC card"
+				" isn't supported yet\n");
 		break;
 	}
 	if (NULL == dvb->frontend) {
-		printk(KERN_ERR
-		       "%s/2: frontend initialization failed\n",
-		       dev->name);
+		em28xx_errdev("/2: frontend initialization failed\n");
 		result = -EINVAL;
 		goto out_free;
 	}
@@ -591,7 +587,7 @@ static int dvb_init(struct em28xx *dev)
 		goto out_free;
 
 	em28xx_set_mode(dev, EM28XX_SUSPEND);
-	printk(KERN_INFO "Successfully loaded em28xx-dvb\n");
+	em28xx_info("Successfully loaded em28xx-dvb\n");
 	return 0;
 
 out_free:
diff --git a/drivers/media/video/em28xx/em28xx-input.c b/drivers/media/video/em28xx/em28xx-input.c
index 7a0fe3816e3d..af0d935c29be 100644
--- a/drivers/media/video/em28xx/em28xx-input.c
+++ b/drivers/media/video/em28xx/em28xx-input.c
@@ -70,6 +70,7 @@ struct em28xx_IR {
 	int polling;
 	struct delayed_work work;
 	unsigned int last_toggle:1;
+	unsigned int full_code:1;
 	unsigned int last_readcount;
 	unsigned int repeat_interval;
 
@@ -111,10 +112,13 @@ int em28xx_get_key_terratec(struct IR_i2c *ir, u32 *ir_key, u32 *ir_raw)
 int em28xx_get_key_em_haup(struct IR_i2c *ir, u32 *ir_key, u32 *ir_raw)
 {
 	unsigned char buf[2];
-	unsigned char code;
+	u16 code;
+	int size;
 
 	/* poll IR chip */
-	if (2 != i2c_master_recv(ir->c, buf, 2))
+	size = i2c_master_recv(ir->c, buf, sizeof(buf));
+
+	if (size != 2)
 		return -EIO;
 
 	/* Does eliminate repeated parity code */
@@ -123,16 +127,30 @@ int em28xx_get_key_em_haup(struct IR_i2c *ir, u32 *ir_key, u32 *ir_raw)
 
 	ir->old = buf[1];
 
-	/* Rearranges bits to the right order */
-	code =   ((buf[0]&0x01)<<5) | /* 0010 0000 */
-		 ((buf[0]&0x02)<<3) | /* 0001 0000 */
-		 ((buf[0]&0x04)<<1) | /* 0000 1000 */
-		 ((buf[0]&0x08)>>1) | /* 0000 0100 */
-		 ((buf[0]&0x10)>>3) | /* 0000 0010 */
-		 ((buf[0]&0x20)>>5);  /* 0000 0001 */
-
-	i2cdprintk("ir hauppauge (em2840): code=0x%02x (rcv=0x%02x)\n",
-			code, buf[0]);
+	/*
+	 * Rearranges bits to the right order.
+	 * The bit order were determined experimentally by using
+	 * The original Hauppauge Grey IR and another RC5 that uses addr=0x08
+	 * The RC5 code has 14 bits, but we've experimentally determined
+	 * the meaning for only 11 bits.
+	 * So, the code translation is not complete. Yet, it is enough to
+	 * work with the provided RC5 IR.
+	 */
+	code =
+		 ((buf[0] & 0x01) ? 0x0020 : 0) | /* 		0010 0000 */
+		 ((buf[0] & 0x02) ? 0x0010 : 0) | /* 		0001 0000 */
+		 ((buf[0] & 0x04) ? 0x0008 : 0) | /* 		0000 1000 */
+		 ((buf[0] & 0x08) ? 0x0004 : 0) | /* 		0000 0100 */
+		 ((buf[0] & 0x10) ? 0x0002 : 0) | /* 		0000 0010 */
+		 ((buf[0] & 0x20) ? 0x0001 : 0) | /* 		0000 0001 */
+		 ((buf[1] & 0x08) ? 0x1000 : 0) | /* 0001 0000		  */
+		 ((buf[1] & 0x10) ? 0x0800 : 0) | /* 0000 1000		  */
+		 ((buf[1] & 0x20) ? 0x0400 : 0) | /* 0000 0100		  */
+		 ((buf[1] & 0x40) ? 0x0200 : 0) | /* 0000 0010		  */
+		 ((buf[1] & 0x80) ? 0x0100 : 0);  /* 0000 0001		  */
+
+	i2cdprintk("ir hauppauge (em2840): code=0x%02x (rcv=0x%02x%02x)\n",
+			code, buf[1], buf[0]);
 
 	/* return key */
 	*ir_key = code;
@@ -246,9 +264,10 @@ static void em28xx_ir_handle_key(struct em28xx_IR *ir)
 		return;
 	}
 
-	dprintk("ir->get_key result tb=%02x rc=%02x lr=%02x data=%02x\n",
+	dprintk("ir->get_key result tb=%02x rc=%02x lr=%02x data=%02x%02x\n",
 		poll_result.toggle_bit, poll_result.read_count,
-		ir->last_readcount, poll_result.rc_data[0]);
+		ir->last_readcount, poll_result.rc_address,
+		poll_result.rc_data[0]);
 
 	if (ir->dev->chip_id == CHIP_ID_EM2874) {
 		/* The em2874 clears the readcount field every time the
@@ -282,8 +301,15 @@ static void em28xx_ir_handle_key(struct em28xx_IR *ir)
 
 	if (do_sendkey) {
 		dprintk("sending keypress\n");
-		ir_input_keydown(ir->input, &ir->ir, poll_result.rc_data[0],
-				 poll_result.rc_data[0]);
+
+		if (ir->full_code)
+			ir_input_keydown(ir->input, &ir->ir,
+					 poll_result.rc_address << 8 |
+					 poll_result.rc_data[0]);
+		else
+			ir_input_keydown(ir->input, &ir->ir,
+					 poll_result.rc_data[0]);
+
 		ir_input_nokey(ir->input, &ir->ir);
 	}
 
@@ -328,6 +354,19 @@ int em28xx_ir_init(struct em28xx *dev)
 		goto err_out_free;
 
 	ir->input = input_dev;
+	ir_config = EM2874_IR_RC5;
+
+	/* Adjust xclk based o IR table for RC5/NEC tables */
+	if (dev->board.ir_codes->ir_type == IR_TYPE_RC5) {
+		dev->board.xclk |= EM28XX_XCLK_IR_RC5_MODE;
+		ir->full_code = 1;
+	} else  if (dev->board.ir_codes->ir_type == IR_TYPE_NEC) {
+		dev->board.xclk &= ~EM28XX_XCLK_IR_RC5_MODE;
+		ir_config = EM2874_IR_NEC;
+		ir->full_code = 1;
+	}
+	em28xx_write_reg_bits(dev, EM28XX_R0F_XCLK, dev->board.xclk,
+			      EM28XX_XCLK_IR_RC5_MODE);
 
 	/* Setup the proper handler based on the chip */
 	switch (dev->chip_id) {
@@ -337,8 +376,6 @@ int em28xx_ir_init(struct em28xx *dev)
 		break;
 	case CHIP_ID_EM2874:
 		ir->get_key = em2874_polling_getkey;
-		/* For now we only support RC5, so enable it */
-		ir_config = EM2874_IR_RC5;
 		em28xx_write_regs(dev, EM2874_R50_IR_CONFIG, &ir_config, 1);
 		break;
 	default:
@@ -356,7 +393,10 @@ int em28xx_ir_init(struct em28xx *dev)
 	usb_make_path(dev->udev, ir->phys, sizeof(ir->phys));
 	strlcat(ir->phys, "/input0", sizeof(ir->phys));
 
-	ir_input_init(input_dev, &ir->ir, IR_TYPE_OTHER, dev->board.ir_codes);
+	err = ir_input_init(input_dev, &ir->ir, IR_TYPE_OTHER);
+	if (err < 0)
+		goto err_out_free;
+
 	input_dev->name = ir->name;
 	input_dev->phys = ir->phys;
 	input_dev->id.bustype = BUS_USB;
@@ -372,7 +412,7 @@ int em28xx_ir_init(struct em28xx *dev)
 	em28xx_ir_start(ir);
 
 	/* all done */
-	err = input_register_device(ir->input);
+	err = ir_input_register(ir->input, dev->board.ir_codes);
 	if (err)
 		goto err_out_stop;
 
@@ -381,7 +421,6 @@ int em28xx_ir_init(struct em28xx *dev)
 	em28xx_ir_stop(ir);
 	dev->ir = NULL;
  err_out_free:
-	input_free_device(input_dev);
 	kfree(ir);
 	return err;
 }
@@ -395,7 +434,7 @@ int em28xx_ir_fini(struct em28xx *dev)
 		return 0;
 
 	em28xx_ir_stop(ir);
-	input_unregister_device(ir->input);
+	ir_input_unregister(ir->input);
 	kfree(ir);
 
 	/* done */
diff --git a/drivers/media/video/em28xx/em28xx-reg.h b/drivers/media/video/em28xx/em28xx-reg.h
index ed12e7ffcbd0..058ac87639ce 100644
--- a/drivers/media/video/em28xx/em28xx-reg.h
+++ b/drivers/media/video/em28xx/em28xx-reg.h
@@ -192,6 +192,7 @@
 
 /* FIXME: Need to be populated with the other chip ID's */
 enum em28xx_chip_id {
+	CHIP_ID_EM2800 = 7,
 	CHIP_ID_EM2710 = 17,
 	CHIP_ID_EM2820 = 18,	/* Also used by some em2710 */
 	CHIP_ID_EM2840 = 20,
diff --git a/drivers/media/video/em28xx/em28xx-video.c b/drivers/media/video/em28xx/em28xx-video.c
index 3a1dfb7726f8..849b18c94037 100644
--- a/drivers/media/video/em28xx/em28xx-video.c
+++ b/drivers/media/video/em28xx/em28xx-video.c
@@ -1060,12 +1060,6 @@ static int vidioc_try_fmt_vid_cap(struct file *file, void *priv,
 		/* the em2800 can only scale down to 50% */
 		height = height > (3 * maxh / 4) ? maxh : maxh / 2;
 		width = width > (3 * maxw / 4) ? maxw : maxw / 2;
-		/* According to empiatech support the MaxPacketSize is too small
-		 * to support framesizes larger than 640x480 @ 30 fps or 640x576
-		 * @ 25 fps.  As this would cut of a part of the image we prefer
-		 * 360x576 or 360x480 for now */
-		if (width == maxw && height == maxh)
-			width /= 2;
 	} else {
 		/* width must even because of the YUYV format
 		   height must be even because of interlacing */
@@ -2087,22 +2081,30 @@ static int radio_queryctrl(struct file *file, void *priv,
  */
 static int em28xx_v4l2_open(struct file *filp)
 {
-	int minor = video_devdata(filp)->minor;
-	int errCode = 0, radio;
-	struct em28xx *dev;
-	enum v4l2_buf_type fh_type;
+	int errCode = 0, radio = 0;
+	struct video_device *vdev = video_devdata(filp);
+	struct em28xx *dev = video_drvdata(filp);
+	enum v4l2_buf_type fh_type = 0;
 	struct em28xx_fh *fh;
 	enum v4l2_field field;
 
-	dev = em28xx_get_device(minor, &fh_type, &radio);
-
-	if (NULL == dev)
-		return -ENODEV;
+	switch (vdev->vfl_type) {
+	case VFL_TYPE_GRABBER:
+		fh_type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
+		break;
+	case VFL_TYPE_VBI:
+		fh_type = V4L2_BUF_TYPE_VBI_CAPTURE;
+		break;
+	case VFL_TYPE_RADIO:
+		radio = 1;
+		break;
+	}
 
 	mutex_lock(&dev->lock);
 
-	em28xx_videodbg("open minor=%d type=%s users=%d\n",
-				minor, v4l2_type_names[fh_type], dev->users);
+	em28xx_videodbg("open dev=%s type=%s users=%d\n",
+			video_device_node_name(vdev), v4l2_type_names[fh_type],
+			dev->users);
 
 
 	fh = kzalloc(sizeof(struct em28xx_fh), GFP_KERNEL);
@@ -2166,25 +2168,25 @@ void em28xx_release_analog_resources(struct em28xx *dev)
 	/*FIXME: I2C IR should be disconnected */
 
 	if (dev->radio_dev) {
-		if (-1 != dev->radio_dev->minor)
+		if (video_is_registered(dev->radio_dev))
 			video_unregister_device(dev->radio_dev);
 		else
 			video_device_release(dev->radio_dev);
 		dev->radio_dev = NULL;
 	}
 	if (dev->vbi_dev) {
-		em28xx_info("V4L2 device /dev/vbi%d deregistered\n",
-			    dev->vbi_dev->num);
-		if (-1 != dev->vbi_dev->minor)
+		em28xx_info("V4L2 device %s deregistered\n",
+			    video_device_node_name(dev->vbi_dev));
+		if (video_is_registered(dev->vbi_dev))
 			video_unregister_device(dev->vbi_dev);
 		else
 			video_device_release(dev->vbi_dev);
 		dev->vbi_dev = NULL;
 	}
 	if (dev->vdev) {
-		em28xx_info("V4L2 device /dev/video%d deregistered\n",
-			    dev->vdev->num);
-		if (-1 != dev->vdev->minor)
+		em28xx_info("V4L2 device %s deregistered\n",
+			    video_device_node_name(dev->vdev));
+		if (video_is_registered(dev->vdev))
 			video_unregister_device(dev->vdev);
 		else
 			video_device_release(dev->vdev);
@@ -2225,7 +2227,7 @@ static int em28xx_v4l2_close(struct file *filp)
 		}
 
 		/* Save some power by putting tuner to sleep */
-		v4l2_device_call_all(&dev->v4l2_dev, 0, tuner, s_standby);
+		v4l2_device_call_all(&dev->v4l2_dev, 0, core, s_power, 0);
 
 		/* do this before setting alternate! */
 		em28xx_uninit_isoc(dev);
@@ -2403,8 +2405,6 @@ static const struct video_device em28xx_video_template = {
 	.release                    = video_device_release,
 	.ioctl_ops 		    = &video_ioctl_ops,
 
-	.minor                      = -1,
-
 	.tvnorms                    = V4L2_STD_ALL,
 	.current_norm               = V4L2_STD_PAL,
 };
@@ -2439,7 +2439,6 @@ static struct video_device em28xx_radio_template = {
 	.name                 = "em28xx-radio",
 	.fops                 = &radio_fops,
 	.ioctl_ops 	      = &radio_ioctl_ops,
-	.minor                = -1,
 };
 
 /******************************** usb interface ******************************/
@@ -2457,7 +2456,6 @@ static struct video_device *em28xx_vdev_init(struct em28xx *dev,
 		return NULL;
 
 	*vfd		= *template;
-	vfd->minor	= -1;
 	vfd->v4l2_dev	= &dev->v4l2_dev;
 	vfd->release	= video_device_release;
 	vfd->debug	= video_debug;
@@ -2465,6 +2463,7 @@ static struct video_device *em28xx_vdev_init(struct em28xx *dev,
 	snprintf(vfd->name, sizeof(vfd->name), "%s %s",
 		 dev->name, type_name);
 
+	video_set_drvdata(vfd, dev);
 	return vfd;
 }
 
@@ -2546,16 +2545,16 @@ int em28xx_register_analog_devices(struct em28xx *dev)
 			em28xx_errdev("can't register radio device\n");
 			return ret;
 		}
-		em28xx_info("Registered radio device as /dev/radio%d\n",
-			    dev->radio_dev->num);
+		em28xx_info("Registered radio device as %s\n",
+			    video_device_node_name(dev->radio_dev));
 	}
 
-	em28xx_info("V4L2 video device registered as /dev/video%d\n",
-				dev->vdev->num);
+	em28xx_info("V4L2 video device registered as %s\n",
+		    video_device_node_name(dev->vdev));
 
 	if (dev->vbi_dev)
-		em28xx_info("V4L2 VBI device registered as /dev/vbi%d\n",
-			    dev->vbi_dev->num);
+		em28xx_info("V4L2 VBI device registered as %s\n",
+			    video_device_node_name(dev->vbi_dev));
 
 	return 0;
 }
diff --git a/drivers/media/video/em28xx/em28xx.h b/drivers/media/video/em28xx/em28xx.h
index 0a73e8bf0d6e..80d9b4fa1b97 100644
--- a/drivers/media/video/em28xx/em28xx.h
+++ b/drivers/media/video/em28xx/em28xx.h
@@ -110,6 +110,7 @@
 #define EM2820_BOARD_SILVERCREST_WEBCAM           71
 #define EM2861_BOARD_GADMEI_UTV330PLUS           72
 #define EM2870_BOARD_REDDO_DVB_C_USB_BOX          73
+#define EM2800_BOARD_VC211A			  74
 
 /* Limits minimum and default number of buffers */
 #define EM28XX_MIN_BUF 4
@@ -143,9 +144,6 @@
  */
 #define EM28XX_NUM_PACKETS 40
 
-/* default alternate; 0 means choose the best */
-#define EM28XX_PINOUT 0
-
 #define EM28XX_INTERLACED_DEFAULT 1
 
 /*
@@ -615,7 +613,6 @@ struct em28xx {
 	struct em28xx_dvb *dvb;
 
 	/* I2C keyboard data */
-	struct i2c_board_info info;
 	struct IR_i2c_init_data init_data;
 };
 
@@ -646,6 +643,8 @@ int em28xx_write_regs_req(struct em28xx *dev, u8 req, u16 reg, char *buf,
 			  int len);
 int em28xx_write_regs(struct em28xx *dev, u16 reg, char *buf, int len);
 int em28xx_write_reg(struct em28xx *dev, u16 reg, u8 val);
+int em28xx_write_reg_bits(struct em28xx *dev, u16 reg, u8 val,
+				 u8 bitmask);
 
 int em28xx_read_ac97(struct em28xx *dev, u8 reg);
 int em28xx_write_ac97(struct em28xx *dev, u8 reg, u16 val);
@@ -669,9 +668,6 @@ int em28xx_gpio_set(struct em28xx *dev, struct em28xx_reg_seq *gpio);
 void em28xx_wake_i2c(struct em28xx *dev);
 void em28xx_remove_from_devlist(struct em28xx *dev);
 void em28xx_add_into_devlist(struct em28xx *dev);
-struct em28xx *em28xx_get_device(int minor,
-				 enum v4l2_buf_type *fh_type,
-				 int *has_radio);
 int em28xx_register_extension(struct em28xx_ops *dev);
 void em28xx_unregister_extension(struct em28xx_ops *dev);
 void em28xx_init_extension(struct em28xx *dev);
@@ -800,7 +796,7 @@ static inline unsigned int norm_maxw(struct em28xx *dev)
 	if (dev->board.is_webcam)
 		return dev->sensor_xres;
 
-	if (dev->board.max_range_640_480)
+	if (dev->board.max_range_640_480 || dev->board.is_em2800)
 		return 640;
 
 	return 720;
diff --git a/drivers/media/video/et61x251/et61x251_core.c b/drivers/media/video/et61x251/et61x251_core.c
index 88987a57cf7b..e6c23d509862 100644
--- a/drivers/media/video/et61x251/et61x251_core.c
+++ b/drivers/media/video/et61x251/et61x251_core.c
@@ -587,8 +587,8 @@ static int et61x251_stream_interrupt(struct et61x251_device* cam)
 	else if (cam->stream != STREAM_OFF) {
 		cam->state |= DEV_MISCONFIGURED;
 		DBG(1, "URB timeout reached. The camera is misconfigured. To "
-		       "use it, close and open /dev/video%d again.",
-		    cam->v4ldev->num);
+		       "use it, close and open %s again.",
+		    video_device_node_name(cam->v4ldev));
 		return -EIO;
 	}
 
@@ -1195,7 +1195,8 @@ static void et61x251_release_resources(struct kref *kref)
 
 	cam = container_of(kref, struct et61x251_device, kref);
 
-	DBG(2, "V4L2 device /dev/video%d deregistered", cam->v4ldev->num);
+	DBG(2, "V4L2 device %s deregistered",
+	    video_device_node_name(cam->v4ldev));
 	video_set_drvdata(cam->v4ldev, NULL);
 	video_unregister_device(cam->v4ldev);
 	usb_put_dev(cam->usbdev);
@@ -1236,8 +1237,8 @@ static int et61x251_open(struct file *filp)
 	}
 
 	if (cam->users) {
-		DBG(2, "Device /dev/video%d is already in use",
-		       cam->v4ldev->num);
+		DBG(2, "Device %s is already in use",
+		       video_device_node_name(cam->v4ldev));
 		DBG(3, "Simultaneous opens are not supported");
 		if ((filp->f_flags & O_NONBLOCK) ||
 		    (filp->f_flags & O_NDELAY)) {
@@ -1280,7 +1281,8 @@ static int et61x251_open(struct file *filp)
 	cam->frame_count = 0;
 	et61x251_empty_framequeues(cam);
 
-	DBG(3, "Video device /dev/video%d is open", cam->v4ldev->num);
+	DBG(3, "Video device %s is open",
+	    video_device_node_name(cam->v4ldev));
 
 out:
 	mutex_unlock(&cam->open_mutex);
@@ -1304,7 +1306,8 @@ static int et61x251_release(struct file *filp)
 	cam->users--;
 	wake_up_interruptible_nr(&cam->wait_open, 1);
 
-	DBG(3, "Video device /dev/video%d closed", cam->v4ldev->num);
+	DBG(3, "Video device %s closed",
+	    video_device_node_name(cam->v4ldev));
 
 	kref_put(&cam->kref, et61x251_release_resources);
 
@@ -1846,8 +1849,8 @@ et61x251_vidioc_s_crop(struct et61x251_device* cam, void __user * arg)
 	if (err) { /* atomic, no rollback in ioctl() */
 		cam->state |= DEV_MISCONFIGURED;
 		DBG(1, "VIDIOC_S_CROP failed because of hardware problems. To "
-		       "use the camera, close and open /dev/video%d again.",
-		    cam->v4ldev->num);
+		       "use the camera, close and open %s again.",
+		    video_device_node_name(cam->v4ldev));
 		return -EIO;
 	}
 
@@ -1859,8 +1862,8 @@ et61x251_vidioc_s_crop(struct et61x251_device* cam, void __user * arg)
 	    nbuffers != et61x251_request_buffers(cam, nbuffers, cam->io)) {
 		cam->state |= DEV_MISCONFIGURED;
 		DBG(1, "VIDIOC_S_CROP failed because of not enough memory. To "
-		       "use the camera, close and open /dev/video%d again.",
-		    cam->v4ldev->num);
+		       "use the camera, close and open %s again.",
+		    video_device_node_name(cam->v4ldev));
 		return -ENOMEM;
 	}
 
@@ -2069,8 +2072,8 @@ et61x251_vidioc_try_s_fmt(struct et61x251_device* cam, unsigned int cmd,
 	if (err) { /* atomic, no rollback in ioctl() */
 		cam->state |= DEV_MISCONFIGURED;
 		DBG(1, "VIDIOC_S_FMT failed because of hardware problems. To "
-		       "use the camera, close and open /dev/video%d again.",
-		    cam->v4ldev->num);
+		       "use the camera, close and open %s again.",
+		    video_device_node_name(cam->v4ldev));
 		return -EIO;
 	}
 
@@ -2081,8 +2084,8 @@ et61x251_vidioc_try_s_fmt(struct et61x251_device* cam, unsigned int cmd,
 	    nbuffers != et61x251_request_buffers(cam, nbuffers, cam->io)) {
 		cam->state |= DEV_MISCONFIGURED;
 		DBG(1, "VIDIOC_S_FMT failed because of not enough memory. To "
-		       "use the camera, close and open /dev/video%d again.",
-		    cam->v4ldev->num);
+		       "use the camera, close and open %s again.",
+		    video_device_node_name(cam->v4ldev));
 		return -ENOMEM;
 	}
 
@@ -2130,7 +2133,7 @@ et61x251_vidioc_s_jpegcomp(struct et61x251_device* cam, void __user * arg)
 		cam->state |= DEV_MISCONFIGURED;
 		DBG(1, "VIDIOC_S_JPEGCOMP failed because of hardware "
 		       "problems. To use the camera, close and open "
-		       "/dev/video%d again.", cam->v4ldev->num);
+		       "%s again.", video_device_node_name(cam->v4ldev));
 		return -EIO;
 	}
 
@@ -2584,7 +2587,6 @@ et61x251_usb_probe(struct usb_interface* intf, const struct usb_device_id* id)
 
 	strcpy(cam->v4ldev->name, "ET61X[12]51 PC Camera");
 	cam->v4ldev->fops = &et61x251_fops;
-	cam->v4ldev->minor = video_nr[dev_nr];
 	cam->v4ldev->release = video_device_release;
 	cam->v4ldev->parent = &udev->dev;
 	video_set_drvdata(cam->v4ldev, cam);
@@ -2603,7 +2605,8 @@ et61x251_usb_probe(struct usb_interface* intf, const struct usb_device_id* id)
 		goto fail;
 	}
 
-	DBG(2, "V4L2 device registered as /dev/video%d", cam->v4ldev->num);
+	DBG(2, "V4L2 device registered as %s",
+	    video_device_node_name(cam->v4ldev));
 
 	cam->module_param.force_munmap = force_munmap[dev_nr];
 	cam->module_param.frame_timeout = frame_timeout[dev_nr];
@@ -2654,9 +2657,9 @@ static void et61x251_usb_disconnect(struct usb_interface* intf)
 	DBG(2, "Disconnecting %s...", cam->v4ldev->name);
 
 	if (cam->users) {
-		DBG(2, "Device /dev/video%d is open! Deregistration and "
-		       "memory deallocation are deferred.",
-		    cam->v4ldev->num);
+		DBG(2, "Device %s is open! Deregistration and memory "
+		       "deallocation are deferred.",
+		    video_device_node_name(cam->v4ldev));
 		cam->state |= DEV_MISCONFIGURED;
 		et61x251_stop_transfer(cam);
 		cam->state |= DEV_DISCONNECTED;
diff --git a/drivers/media/video/gspca/Kconfig b/drivers/media/video/gspca/Kconfig
index fe2e490ebc52..609d65b0b10d 100644
--- a/drivers/media/video/gspca/Kconfig
+++ b/drivers/media/video/gspca/Kconfig
@@ -76,10 +76,11 @@ config USB_GSPCA_MR97310A
 	  module will be called gspca_mr97310a.
 
 config USB_GSPCA_OV519
-	tristate "OV519 USB Camera Driver"
+	tristate "OV51x / OVFX2 / W996xCF USB Camera Driver"
 	depends on VIDEO_V4L2 && USB_GSPCA
 	help
-	  Say Y here if you want support for cameras based on the OV519 chip.
+	  Say Y here if you want support for cameras based on one of these:
+	  OV511(+), OV518(+), OV519, OVFX2, W9967CF, W9968CF
 
 	  To compile this driver as a module, choose M here: the
 	  module will be called gspca_ov519.
@@ -103,6 +104,15 @@ config USB_GSPCA_PAC207
 	  To compile this driver as a module, choose M here: the
 	  module will be called gspca_pac207.
 
+config USB_GSPCA_PAC7302
+	tristate "Pixart PAC7302 USB Camera Driver"
+	depends on VIDEO_V4L2 && USB_GSPCA
+	help
+	  Say Y here if you want support for cameras based on the PAC7302 chip.
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called gspca_pac7302.
+
 config USB_GSPCA_PAC7311
 	tristate "Pixart PAC7311 USB Camera Driver"
 	depends on VIDEO_V4L2 && USB_GSPCA
@@ -229,6 +239,15 @@ config USB_GSPCA_STK014
 	  To compile this driver as a module, choose M here: the
 	  module will be called gspca_stk014.
 
+config USB_GSPCA_STV0680
+	tristate "STV0680 USB Camera Driver"
+	depends on VIDEO_V4L2 && USB_GSPCA
+	help
+	  Say Y here if you want support for cameras based on the STV0680 chip.
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called gspca_stv0680.
+
 config USB_GSPCA_SUNPLUS
 	tristate "SUNPLUS USB Camera Driver"
 	depends on VIDEO_V4L2 && USB_GSPCA
diff --git a/drivers/media/video/gspca/Makefile b/drivers/media/video/gspca/Makefile
index b7420818037e..ff2c7279d82e 100644
--- a/drivers/media/video/gspca/Makefile
+++ b/drivers/media/video/gspca/Makefile
@@ -8,6 +8,7 @@ obj-$(CONFIG_USB_GSPCA_MR97310A) += gspca_mr97310a.o
 obj-$(CONFIG_USB_GSPCA_OV519)    += gspca_ov519.o
 obj-$(CONFIG_USB_GSPCA_OV534)    += gspca_ov534.o
 obj-$(CONFIG_USB_GSPCA_PAC207)   += gspca_pac207.o
+obj-$(CONFIG_USB_GSPCA_PAC7302)  += gspca_pac7302.o
 obj-$(CONFIG_USB_GSPCA_PAC7311)  += gspca_pac7311.o
 obj-$(CONFIG_USB_GSPCA_SN9C20X)  += gspca_sn9c20x.o
 obj-$(CONFIG_USB_GSPCA_SONIXB)   += gspca_sonixb.o
@@ -22,6 +23,7 @@ obj-$(CONFIG_USB_GSPCA_SQ905)    += gspca_sq905.o
 obj-$(CONFIG_USB_GSPCA_SQ905C)   += gspca_sq905c.o
 obj-$(CONFIG_USB_GSPCA_SUNPLUS)  += gspca_sunplus.o
 obj-$(CONFIG_USB_GSPCA_STK014)   += gspca_stk014.o
+obj-$(CONFIG_USB_GSPCA_STV0680)  += gspca_stv0680.o
 obj-$(CONFIG_USB_GSPCA_T613)     += gspca_t613.o
 obj-$(CONFIG_USB_GSPCA_TV8532)   += gspca_tv8532.o
 obj-$(CONFIG_USB_GSPCA_VC032X)   += gspca_vc032x.o
@@ -37,6 +39,7 @@ gspca_mr97310a-objs := mr97310a.o
 gspca_ov519-objs    := ov519.o
 gspca_ov534-objs    := ov534.o
 gspca_pac207-objs   := pac207.o
+gspca_pac7302-objs  := pac7302.o
 gspca_pac7311-objs  := pac7311.o
 gspca_sn9c20x-objs  := sn9c20x.o
 gspca_sonixb-objs   := sonixb.o
@@ -50,6 +53,7 @@ gspca_spca561-objs  := spca561.o
 gspca_sq905-objs    := sq905.o
 gspca_sq905c-objs   := sq905c.o
 gspca_stk014-objs   := stk014.o
+gspca_stv0680-objs  := stv0680.o
 gspca_sunplus-objs  := sunplus.o
 gspca_t613-objs     := t613.o
 gspca_tv8532-objs   := tv8532.o
diff --git a/drivers/media/video/gspca/conex.c b/drivers/media/video/gspca/conex.c
index eca003566ae3..c98b5d69c438 100644
--- a/drivers/media/video/gspca/conex.c
+++ b/drivers/media/video/gspca/conex.c
@@ -888,8 +888,7 @@ static void sd_stop0(struct gspca_dev *gspca_dev)
 }
 
 static void sd_pkt_scan(struct gspca_dev *gspca_dev,
-			struct gspca_frame *frame,	/* target */
-			__u8 *data,			/* isoc packet */
+			u8 *data,			/* isoc packet */
 			int len)			/* iso packet length */
 {
 	struct sd *sd = (struct sd *) gspca_dev;
@@ -897,16 +896,15 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
 	if (data[0] == 0xff && data[1] == 0xd8) {
 
 		/* start of frame */
-		frame = gspca_frame_add(gspca_dev, LAST_PACKET, frame,
-					data, 0);
+		gspca_frame_add(gspca_dev, LAST_PACKET, NULL, 0);
 
 		/* put the JPEG header in the new frame */
-		gspca_frame_add(gspca_dev, FIRST_PACKET, frame,
-			sd->jpeg_hdr, JPEG_HDR_SZ);
+		gspca_frame_add(gspca_dev, FIRST_PACKET,
+				sd->jpeg_hdr, JPEG_HDR_SZ);
 		data += 2;
 		len -= 2;
 	}
-	gspca_frame_add(gspca_dev, INTER_PACKET, frame, data, len);
+	gspca_frame_add(gspca_dev, INTER_PACKET, data, len);
 }
 
 static void setbrightness(struct gspca_dev*gspca_dev)
@@ -1048,14 +1046,14 @@ static struct sd_desc sd_desc = {
 };
 
 /* -- module initialisation -- */
-static __devinitdata struct usb_device_id device_table[] = {
+static const struct usb_device_id device_table[] __devinitconst = {
 	{USB_DEVICE(0x0572, 0x0041)},
 	{}
 };
 MODULE_DEVICE_TABLE(usb, device_table);
 
 /* -- device connect -- */
-static int sd_probe(struct usb_interface *intf,
+static int __devinit sd_probe(struct usb_interface *intf,
 			const struct usb_device_id *id)
 {
 	return gspca_dev_probe(intf, id, &sd_desc, sizeof(struct sd),
diff --git a/drivers/media/video/gspca/etoms.c b/drivers/media/video/gspca/etoms.c
index c1461e63647f..fdf4c0ec5e7a 100644
--- a/drivers/media/video/gspca/etoms.c
+++ b/drivers/media/video/gspca/etoms.c
@@ -752,8 +752,7 @@ static void do_autogain(struct gspca_dev *gspca_dev)
 #undef LIMIT
 
 static void sd_pkt_scan(struct gspca_dev *gspca_dev,
-			struct gspca_frame *frame,	/* target */
-			__u8 *data,			/* isoc packet */
+			u8 *data,			/* isoc packet */
 			int len)			/* iso packet length */
 {
 	int seqframe;
@@ -767,14 +766,13 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
 		       data[2], data[3], data[4], data[5]);
 		data += 30;
 		/* don't change datalength as the chips provided it */
-		frame = gspca_frame_add(gspca_dev, LAST_PACKET, frame,
-					data, 0);
-		gspca_frame_add(gspca_dev, FIRST_PACKET, frame, data, len);
+		gspca_frame_add(gspca_dev, LAST_PACKET, NULL, 0);
+		gspca_frame_add(gspca_dev, FIRST_PACKET, data, len);
 		return;
 	}
 	if (len) {
 		data += 8;
-		gspca_frame_add(gspca_dev, INTER_PACKET, frame, data, len);
+		gspca_frame_add(gspca_dev, INTER_PACKET, data, len);
 	} else {			/* Drop Packet */
 		gspca_dev->last_packet_type = DISCARD_PACKET;
 	}
@@ -866,7 +864,7 @@ static struct sd_desc sd_desc = {
 };
 
 /* -- module initialisation -- */
-static __devinitdata struct usb_device_id device_table[] = {
+static const struct usb_device_id device_table[] __devinitconst = {
 	{USB_DEVICE(0x102c, 0x6151), .driver_info = SENSOR_PAS106},
 #if !defined CONFIG_USB_ET61X251 && !defined CONFIG_USB_ET61X251_MODULE
 	{USB_DEVICE(0x102c, 0x6251), .driver_info = SENSOR_TAS5130CXX},
@@ -877,7 +875,7 @@ static __devinitdata struct usb_device_id device_table[] = {
 MODULE_DEVICE_TABLE(usb, device_table);
 
 /* -- device connect -- */
-static int sd_probe(struct usb_interface *intf,
+static int __devinit sd_probe(struct usb_interface *intf,
 		    const struct usb_device_id *id)
 {
 	return gspca_dev_probe(intf, id, &sd_desc, sizeof(struct sd),
diff --git a/drivers/media/video/gspca/finepix.c b/drivers/media/video/gspca/finepix.c
index 480ec5c87d0e..5d90e7448579 100644
--- a/drivers/media/video/gspca/finepix.c
+++ b/drivers/media/video/gspca/finepix.c
@@ -82,7 +82,6 @@ static void dostream(struct work_struct *work)
 	struct gspca_dev *gspca_dev = &dev->gspca_dev;
 	struct urb *urb = gspca_dev->urb[0];
 	u8 *data = urb->transfer_buffer;
-	struct gspca_frame *frame;
 	int ret = 0;
 	int len;
 
@@ -118,10 +117,6 @@ again:
 			}
 			if (!gspca_dev->present || !gspca_dev->streaming)
 				goto out;
-			frame = gspca_get_i_frame(&dev->gspca_dev);
-			if (frame == NULL)
-				gspca_dev->last_packet_type = DISCARD_PACKET;
-
 			if (len < FPIX_MAX_TRANSFER ||
 				(data[len - 2] == 0xff &&
 					data[len - 1] == 0xd9)) {
@@ -132,21 +127,17 @@ again:
 				 * but there's nothing we can do. We also end
 				 * here if the the jpeg ends right at the end
 				 * of the frame. */
-				if (frame)
-					frame = gspca_frame_add(gspca_dev,
-							LAST_PACKET,
-							frame,
-							data, len);
+				gspca_frame_add(gspca_dev, LAST_PACKET,
+						data, len);
 				break;
 			}
 
 			/* got a partial image */
-			if (frame)
-				gspca_frame_add(gspca_dev,
-						gspca_dev->last_packet_type
-							== LAST_PACKET
-						? FIRST_PACKET : INTER_PACKET,
-						frame, data, len);
+			gspca_frame_add(gspca_dev,
+					gspca_dev->last_packet_type
+						== LAST_PACKET
+					? FIRST_PACKET : INTER_PACKET,
+					data, len);
 		}
 
 		/* We must wait before trying reading the next
diff --git a/drivers/media/video/gspca/gl860/gl860-mi1320.c b/drivers/media/video/gspca/gl860/gl860-mi1320.c
index 39f6261c1a0c..c276a7debdec 100644
--- a/drivers/media/video/gspca/gl860/gl860-mi1320.c
+++ b/drivers/media/video/gspca/gl860/gl860-mi1320.c
@@ -1,6 +1,5 @@
-/* @file gl860-mi1320.c
- * @author Olivier LORIN from my logs
- * @date 2009-08-27
+/* Subdriver for the GL860 chip with the MI1320 sensor
+ * Author Olivier LORIN from own logs
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -127,49 +126,49 @@ static u8 dat_wbalBL[] =
 
 static u8 dat_hvflip1[] = {0xf0, 0x00, 0xf1, 0x00};
 
-static u8 s000[] =
+static u8 dat_common00[] =
 	"\x00\x01\x07\x6a\x06\x63\x0d\x6a" "\xc0\x00\x10\x10\xc1\x03\xc2\x42"
 	"\xd8\x04\x58\x00\x04\x02";
-static u8 s001[] =
+static u8 dat_common01[] =
 	"\x0d\x00\xf1\x0b\x0d\x00\xf1\x08" "\x35\x00\xf1\x22\x68\x00\xf1\x5d"
 	"\xf0\x00\xf1\x01\x06\x70\xf1\x0e" "\xf0\x00\xf1\x02\xdd\x18\xf1\xe0";
-static u8 s002[] =
+static u8 dat_common02[] =
 	"\x05\x01\xf1\x84\x06\x00\xf1\x44" "\x07\x00\xf1\xbe\x08\x00\xf1\x1e"
 	"\x20\x01\xf1\x03\x21\x84\xf1\x00" "\x22\x0d\xf1\x0f\x24\x80\xf1\x00"
 	"\x34\x18\xf1\x2d\x35\x00\xf1\x22" "\x43\x83\xf1\x83\x59\x00\xf1\xff";
-static u8 s003[] =
+static u8 dat_common03[] =
 	"\xf0\x00\xf1\x02\x39\x06\xf1\x8c" "\x3a\x06\xf1\x8c\x3b\x03\xf1\xda"
 	"\x3c\x05\xf1\x30\x57\x01\xf1\x0c" "\x58\x01\xf1\x42\x59\x01\xf1\x0c"
 	"\x5a\x01\xf1\x42\x5c\x13\xf1\x0e" "\x5d\x17\xf1\x12\x64\x1e\xf1\x1c";
-static u8 s004[] =
+static u8 dat_common04[] =
 	"\xf0\x00\xf1\x02\x24\x5f\xf1\x20" "\x28\xea\xf1\x02\x5f\x41\xf1\x43";
-static u8 s005[] =
+static u8 dat_common05[] =
 	"\x02\x00\xf1\xee\x03\x29\xf1\x1a" "\x04\x02\xf1\xa4\x09\x00\xf1\x68"
 	"\x0a\x00\xf1\x2a\x0b\x00\xf1\x04" "\x0c\x00\xf1\x93\x0d\x00\xf1\x82"
 	"\x0e\x00\xf1\x40\x0f\x00\xf1\x5f" "\x10\x00\xf1\x4e\x11\x00\xf1\x5b";
-static u8 s006[] =
+static u8 dat_common06[] =
 	"\x15\x00\xf1\xc9\x16\x00\xf1\x5e" "\x17\x00\xf1\x9d\x18\x00\xf1\x06"
 	"\x19\x00\xf1\x89\x1a\x00\xf1\x12" "\x1b\x00\xf1\xa1\x1c\x00\xf1\xe4"
 	"\x1d\x00\xf1\x7a\x1e\x00\xf1\x64" "\xf6\x00\xf1\x5f";
-static u8 s007[] =
+static u8 dat_common07[] =
 	"\xf0\x00\xf1\x01\x53\x09\xf1\x03" "\x54\x3d\xf1\x1c\x55\x99\xf1\x72"
 	"\x56\xc1\xf1\xb1\x57\xd8\xf1\xce" "\x58\xe0\xf1\x00\xdc\x0a\xf1\x03"
 	"\xdd\x45\xf1\x20\xde\xae\xf1\x82" "\xdf\xdc\xf1\xc9\xe0\xf6\xf1\xea"
 	"\xe1\xff\xf1\x00";
-static u8 s008[] =
+static u8 dat_common08[] =
 	"\xf0\x00\xf1\x01\x80\x00\xf1\x06" "\x81\xf6\xf1\x08\x82\xfb\xf1\xf7"
 	"\x83\x00\xf1\xfe\xb6\x07\xf1\x03" "\xb7\x18\xf1\x0c\x84\xfb\xf1\x06"
 	"\x85\xfb\xf1\xf9\x86\x00\xf1\xff" "\xb8\x07\xf1\x04\xb9\x16\xf1\x0a";
-static u8 s009[] =
+static u8 dat_common09[] =
 	"\x87\xfa\xf1\x05\x88\xfc\xf1\xf9" "\x89\x00\xf1\xff\xba\x06\xf1\x03"
 	"\xbb\x17\xf1\x09\x8a\xe8\xf1\x14" "\x8b\xf7\xf1\xf0\x8c\xfd\xf1\xfa"
 	"\x8d\x00\xf1\x00\xbc\x05\xf1\x01" "\xbd\x0c\xf1\x08\xbe\x00\xf1\x14";
-static u8 s010[] =
+static u8 dat_common10[] =
 	"\x8e\xea\xf1\x13\x8f\xf7\xf1\xf2" "\x90\xfd\xf1\xfa\x91\x00\xf1\x00"
 	"\xbf\x05\xf1\x01\xc0\x0a\xf1\x08" "\xc1\x00\xf1\x0c\x92\xed\xf1\x0f"
 	"\x93\xf9\xf1\xf4\x94\xfe\xf1\xfb" "\x95\x00\xf1\x00\xc2\x04\xf1\x01"
 	"\xc3\x0a\xf1\x07\xc4\x00\xf1\x10";
-static u8 s011[] =
+static u8 dat_common11[] =
 	"\xf0\x00\xf1\x01\x05\x00\xf1\x06" "\x25\x00\xf1\x55\x34\x10\xf1\x10"
 	"\x35\xf0\xf1\x10\x3a\x02\xf1\x03" "\x3b\x04\xf1\x2a\x9b\x43\xf1\x00"
 	"\xa4\x03\xf1\xc0\xa7\x02\xf1\x81";
@@ -222,26 +221,26 @@ void mi1320_init_settings(struct gspca_dev *gspca_dev)
 
 static void common(struct gspca_dev *gspca_dev)
 {
-	s32 n; /* reserved for FETCH macros */
+	s32 n; /* reserved for FETCH functions */
 
-	ctrl_out(gspca_dev, 0x40, 3, 0x0000, 0x0200, 22, s000);
+	ctrl_out(gspca_dev, 0x40, 3, 0x0000, 0x0200, 22, dat_common00);
 	ctrl_out(gspca_dev, 0x40, 1, 0x0041, 0x0000, 0, NULL);
-	ctrl_out(gspca_dev, 0x40, 3, 0xba00, 0x0200, 32, s001);
+	ctrl_out(gspca_dev, 0x40, 3, 0xba00, 0x0200, 32, dat_common01);
 	n = fetch_validx(gspca_dev, tbl_common, ARRAY_SIZE(tbl_common));
-	ctrl_out(gspca_dev, 0x40, 3, 0xba00, 0x0200, 48, s002);
-	ctrl_out(gspca_dev, 0x40, 3, 0xba00, 0x0200, 48, s003);
-	ctrl_out(gspca_dev, 0x40, 3, 0xba00, 0x0200, 16, s004);
-	ctrl_out(gspca_dev, 0x40, 3, 0xba00, 0x0200, 48, s005);
-	ctrl_out(gspca_dev, 0x40, 3, 0xba00, 0x0200, 44, s006);
+	ctrl_out(gspca_dev, 0x40, 3, 0xba00, 0x0200, 48, dat_common02);
+	ctrl_out(gspca_dev, 0x40, 3, 0xba00, 0x0200, 48, dat_common03);
+	ctrl_out(gspca_dev, 0x40, 3, 0xba00, 0x0200, 16, dat_common04);
+	ctrl_out(gspca_dev, 0x40, 3, 0xba00, 0x0200, 48, dat_common05);
+	ctrl_out(gspca_dev, 0x40, 3, 0xba00, 0x0200, 44, dat_common06);
 	keep_on_fetching_validx(gspca_dev, tbl_common,
 					ARRAY_SIZE(tbl_common), n);
-	ctrl_out(gspca_dev, 0x40, 3, 0xba00, 0x0200, 52, s007);
-	ctrl_out(gspca_dev, 0x40, 3, 0xba00, 0x0200, 48, s008);
-	ctrl_out(gspca_dev, 0x40, 3, 0xba00, 0x0200, 48, s009);
-	ctrl_out(gspca_dev, 0x40, 3, 0xba00, 0x0200, 56, s010);
+	ctrl_out(gspca_dev, 0x40, 3, 0xba00, 0x0200, 52, dat_common07);
+	ctrl_out(gspca_dev, 0x40, 3, 0xba00, 0x0200, 48, dat_common08);
+	ctrl_out(gspca_dev, 0x40, 3, 0xba00, 0x0200, 48, dat_common09);
+	ctrl_out(gspca_dev, 0x40, 3, 0xba00, 0x0200, 56, dat_common10);
 	keep_on_fetching_validx(gspca_dev, tbl_common,
 					ARRAY_SIZE(tbl_common), n);
-	ctrl_out(gspca_dev, 0x40, 3, 0xba00, 0x0200, 40, s011);
+	ctrl_out(gspca_dev, 0x40, 3, 0xba00, 0x0200, 40, dat_common11);
 	keep_on_fetching_validx(gspca_dev, tbl_common,
 					ARRAY_SIZE(tbl_common), n);
 }
@@ -346,7 +345,7 @@ static int mi1320_configure_alt(struct gspca_dev *gspca_dev)
 	return 0;
 }
 
-int mi1320_camera_settings(struct gspca_dev *gspca_dev)
+static int mi1320_camera_settings(struct gspca_dev *gspca_dev)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
 
diff --git a/drivers/media/video/gspca/gl860/gl860-mi2020.c b/drivers/media/video/gspca/gl860/gl860-mi2020.c
index ffb09fed3e8c..7c31b4f2abea 100644
--- a/drivers/media/video/gspca/gl860/gl860-mi2020.c
+++ b/drivers/media/video/gspca/gl860/gl860-mi2020.c
@@ -1,7 +1,6 @@
-/* @file gl860-mi2020.c
- * @author Olivier LORIN, from Ice/Soro2005's logs(A), Fret_saw/Hulkie's
+/* Subdriver for the GL860 chip with the MI2020 sensor
+ * Author Olivier LORIN, from Ice/Soro2005's logs(A), Fret_saw/Hulkie's
  * logs(B) and Tricid"s logs(C). With the help of Kytrix/BUGabundo/Blazercist.
- * @date 2009-08-27
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -41,7 +40,7 @@ static u8 dat_freq1[] = { 0x8c, 0xa4, 0x04 };
 static u8 dat_multi5[] = { 0x8c, 0xa1, 0x03 };
 static u8 dat_multi6[] = { 0x90, 0x00, 0x05 };
 
-static struct validx tbl_common_a[] = {
+static struct validx tbl_common1[] = {
 	{0x0000, 0x0000},
 	{1, 0xffff}, /* msleep(35); */
 	{0x006a, 0x0007}, {0x0063, 0x0006}, {0x006a, 0x000d}, {0x0000, 0x00c0},
@@ -49,7 +48,7 @@ static struct validx tbl_common_a[] = {
 	{0x0000, 0x0058}, {0x0002, 0x0004}, {0x0041, 0x0000},
 };
 
-static struct validx tbl_common_b[] = {
+static struct validx tbl_common2[] = {
 	{0x006a, 0x0007},
 	{35, 0xffff},
 	{0x00ef, 0x0006},
@@ -60,7 +59,7 @@ static struct validx tbl_common_b[] = {
 	{0x0004, 0x00d8}, {0x0000, 0x0058}, {0x0041, 0x0000},
 };
 
-static struct idxdata tbl_common_c[] = {
+static struct idxdata tbl_common3[] = {
 	{0x32, "\x02\x00\x08"}, {0x33, "\xf4\x03\x1d"},
 	{6, "\xff\xff\xff"}, /* 12 */
 	{0x34, "\x1e\x8f\x09"}, {0x34, "\x1c\x01\x28"}, {0x34, "\x1e\x8f\x09"},
@@ -109,7 +108,7 @@ static struct idxdata tbl_common_c[] = {
 	{0x33, "\x8c\xa2\x03"}, {0x33, "\x90\x00\xbb"},
 };
 
-static struct idxdata tbl_common_d[] = {
+static struct idxdata tbl_common4[] = {
 	{0x33, "\x8c\x22\x2e"}, {0x33, "\x90\x00\xa0"}, {0x33, "\x8c\xa4\x08"},
 	{0x33, "\x90\x00\x1f"}, {0x33, "\x8c\xa4\x09"}, {0x33, "\x90\x00\x21"},
 	{0x33, "\x8c\xa4\x0a"}, {0x33, "\x90\x00\x25"}, {0x33, "\x8c\xa4\x0b"},
@@ -118,7 +117,7 @@ static struct idxdata tbl_common_d[] = {
 	{0x33, "\x90\x00\xa0"}, {0x33, "\x8c\x24\x17"}, {0x33, "\x90\x00\xc0"},
 };
 
-static struct idxdata tbl_common_e[] = {
+static struct idxdata tbl_common5[] = {
 	{0x33, "\x8c\xa4\x04"}, {0x33, "\x90\x00\x80"}, {0x33, "\x8c\xa7\x9d"},
 	{0x33, "\x90\x00\x00"}, {0x33, "\x8c\xa7\x9e"}, {0x33, "\x90\x00\x00"},
 	{0x33, "\x8c\xa2\x0c"}, {0x33, "\x90\x00\x17"}, {0x33, "\x8c\xa2\x15"},
@@ -180,7 +179,7 @@ static struct validx tbl_init_at_startup[] = {
 	{53, 0xffff},
 };
 
-static struct idxdata tbl_init_post_alt_low_a[] = {
+static struct idxdata tbl_init_post_alt_low1[] = {
 	{0x33, "\x8c\x27\x15"}, {0x33, "\x90\x00\x25"}, {0x33, "\x8c\x22\x2e"},
 	{0x33, "\x90\x00\x81"}, {0x33, "\x8c\xa4\x08"}, {0x33, "\x90\x00\x17"},
 	{0x33, "\x8c\xa4\x09"}, {0x33, "\x90\x00\x1a"}, {0x33, "\x8c\xa4\x0a"},
@@ -189,7 +188,7 @@ static struct idxdata tbl_init_post_alt_low_a[] = {
 	{0x33, "\x90\x00\x9b"},
 };
 
-static struct idxdata tbl_init_post_alt_low_b[] = {
+static struct idxdata tbl_init_post_alt_low2[] = {
 	{0x33, "\x8c\x27\x03"}, {0x33, "\x90\x03\x24"}, {0x33, "\x8c\x27\x05"},
 	{0x33, "\x90\x02\x58"}, {0x33, "\x8c\xa1\x03"}, {0x33, "\x90\x00\x05"},
 	{2, "\xff\xff\xff"},
@@ -197,7 +196,7 @@ static struct idxdata tbl_init_post_alt_low_b[] = {
 	{2, "\xff\xff\xff"},
 };
 
-static struct idxdata tbl_init_post_alt_low_c[] = {
+static struct idxdata tbl_init_post_alt_low3[] = {
 	{0x34, "\x1e\x8f\x09"}, {0x34, "\x1c\x01\x28"}, {0x34, "\x1e\x8f\x09"},
 	{2, "\xff\xff\xff"},
 	{0x34, "\x1e\x8f\x09"}, {0x32, "\x14\x06\xe6"}, {0x33, "\x8c\xa1\x20"},
@@ -221,7 +220,7 @@ static struct idxdata tbl_init_post_alt_low_c[] = {
 	{1, "\xff\xff\xff"},
 };
 
-static struct idxdata tbl_init_post_alt_low_d[] = {
+static struct idxdata tbl_init_post_alt_low4[] = {
 	{0x32, "\x10\x01\xf8"}, {0x34, "\xce\x01\xa8"}, {0x34, "\xd0\x66\x33"},
 	{0x34, "\xd2\x31\x9a"}, {0x34, "\xd4\x94\x63"}, {0x34, "\xd6\x4b\x25"},
 	{0x34, "\xd8\x26\x70"}, {0x34, "\xda\x72\x4c"}, {0x34, "\xdc\xff\x04"},
@@ -267,7 +266,7 @@ static struct idxdata tbl_init_post_alt_low_d[] = {
 	{0x32, "\x6c\x14\x08"},
 };
 
-static struct idxdata tbl_init_post_alt_big_a[] = {
+static struct idxdata tbl_init_post_alt_big1[] = {
 	{0x33, "\x8c\xa1\x03"}, {0x33, "\x90\x00\x05"},
 	{2, "\xff\xff\xff"},
 	{0x33, "\x8c\xa1\x03"}, {0x33, "\x90\x00\x06"},
@@ -288,7 +287,7 @@ static struct idxdata tbl_init_post_alt_big_a[] = {
 	{0x34, "\x04\x00\x2a"}, {0x33, "\x8c\xa7\x02"}, {0x33, "\x90\x00\x01"},
 };
 
-static struct idxdata tbl_init_post_alt_big_b[] = {
+static struct idxdata tbl_init_post_alt_big2[] = {
 	{0x32, "\x10\x01\xf8"}, {0x34, "\xce\x01\xa8"}, {0x34, "\xd0\x66\x33"},
 	{0x34, "\xd2\x31\x9a"}, {0x34, "\xd4\x94\x63"}, {0x34, "\xd6\x4b\x25"},
 	{0x34, "\xd8\x26\x70"}, {0x34, "\xda\x72\x4c"}, {0x34, "\xdc\xff\x04"},
@@ -317,7 +316,7 @@ static struct idxdata tbl_init_post_alt_big_b[] = {
 	{0x32, "\x10\x01\xfc"}, {0x33, "\x8c\xa1\x18"}, {0x33, "\x90\x00\x3c"},
 };
 
-static struct idxdata tbl_init_post_alt_big_c[] = {
+static struct idxdata tbl_init_post_alt_big3[] = {
 	{0x33, "\x8c\xa1\x02"},
 	{0x33, "\x90\x00\x1f"},
 	{0x33, "\x8c\xa1\x02"},
@@ -388,14 +387,14 @@ static void common(struct gspca_dev *gspca_dev)
 	s32 reso = gspca_dev->cam.cam_mode[(s32) gspca_dev->curr_mode].priv;
 
 	if (_MI2020b_) {
-		fetch_validx(gspca_dev, tbl_common_a, ARRAY_SIZE(tbl_common_a));
+		fetch_validx(gspca_dev, tbl_common1, ARRAY_SIZE(tbl_common1));
 	} else {
 		if (_MI2020_)
 			ctrl_out(gspca_dev, 0x40,  1, 0x0008, 0x0004,  0, NULL);
 		else
 			ctrl_out(gspca_dev, 0x40,  1, 0x0002, 0x0004,  0, NULL);
 		msleep(35);
-		fetch_validx(gspca_dev, tbl_common_b, ARRAY_SIZE(tbl_common_b));
+		fetch_validx(gspca_dev, tbl_common2, ARRAY_SIZE(tbl_common2));
 	}
 	ctrl_out(gspca_dev, 0x40,  3, 0x7a00, 0x0033,  3, "\x86\x25\x01");
 	ctrl_out(gspca_dev, 0x40,  3, 0x7a00, 0x0033,  3, "\x86\x25\x00");
@@ -403,13 +402,13 @@ static void common(struct gspca_dev *gspca_dev)
 	ctrl_out(gspca_dev, 0x40,  3, 0x7a00, 0x0030,  3, "\x1a\x0a\xcc");
 	if (reso == IMAGE_1600)
 		msleep(2); /* 1600 */
-	fetch_idxdata(gspca_dev, tbl_common_c, ARRAY_SIZE(tbl_common_c));
+	fetch_idxdata(gspca_dev, tbl_common3, ARRAY_SIZE(tbl_common3));
 
 	if (_MI2020b_ || _MI2020_)
-		fetch_idxdata(gspca_dev, tbl_common_d,
-				ARRAY_SIZE(tbl_common_d));
+		fetch_idxdata(gspca_dev, tbl_common4,
+				ARRAY_SIZE(tbl_common4));
 
-	fetch_idxdata(gspca_dev, tbl_common_e, ARRAY_SIZE(tbl_common_e));
+	fetch_idxdata(gspca_dev, tbl_common5, ARRAY_SIZE(tbl_common5));
 	if (_MI2020b_ || _MI2020_) {
 		/* Different from fret */
 		ctrl_out(gspca_dev, 0x40, 3, 0x7a00, 0x0033, 3, "\x90\x00\x78");
@@ -525,15 +524,15 @@ static int mi2020_init_post_alt(struct gspca_dev *gspca_dev)
 				12, dat_800);
 
 		if (_MI2020c_)
-			fetch_idxdata(gspca_dev, tbl_init_post_alt_low_a,
-					ARRAY_SIZE(tbl_init_post_alt_low_a));
+			fetch_idxdata(gspca_dev, tbl_init_post_alt_low1,
+					ARRAY_SIZE(tbl_init_post_alt_low1));
 
 		if (reso == IMAGE_800)
-			fetch_idxdata(gspca_dev, tbl_init_post_alt_low_b,
-					ARRAY_SIZE(tbl_init_post_alt_low_b));
+			fetch_idxdata(gspca_dev, tbl_init_post_alt_low2,
+					ARRAY_SIZE(tbl_init_post_alt_low2));
 
-		fetch_idxdata(gspca_dev, tbl_init_post_alt_low_c,
-				ARRAY_SIZE(tbl_init_post_alt_low_c));
+		fetch_idxdata(gspca_dev, tbl_init_post_alt_low3,
+				ARRAY_SIZE(tbl_init_post_alt_low3));
 
 		if (_MI2020b_) {
 			ctrl_out(gspca_dev, 0x40, 1, 0x0001, 0x0010, 0, NULL);
@@ -574,8 +573,8 @@ static int mi2020_init_post_alt(struct gspca_dev *gspca_dev)
 		msleep(5);/* " */
 
 		if (_MI2020c_) {
-			fetch_idxdata(gspca_dev, tbl_init_post_alt_low_d,
-					ARRAY_SIZE(tbl_init_post_alt_low_d));
+			fetch_idxdata(gspca_dev, tbl_init_post_alt_low4,
+					ARRAY_SIZE(tbl_init_post_alt_low4));
 		} else {
 			ctrl_in(gspca_dev, 0xc0, 2, 0x0000, 0x0000, 1, &c);
 			msleep(14); /* 0xd8 */
@@ -644,8 +643,8 @@ static int mi2020_init_post_alt(struct gspca_dev *gspca_dev)
 					3, "\x90\x04\xb0");
 		}
 
-		fetch_idxdata(gspca_dev, tbl_init_post_alt_big_a,
-				ARRAY_SIZE(tbl_init_post_alt_big_a));
+		fetch_idxdata(gspca_dev, tbl_init_post_alt_big1,
+				ARRAY_SIZE(tbl_init_post_alt_big1));
 
 		if (reso == IMAGE_1600)
 			msleep(13); /* 1600 */
@@ -708,8 +707,8 @@ static int mi2020_init_post_alt(struct gspca_dev *gspca_dev)
 		msleep(14);
 
 		if (_MI2020c_)
-			fetch_idxdata(gspca_dev, tbl_init_post_alt_big_b,
-					ARRAY_SIZE(tbl_init_post_alt_big_b));
+			fetch_idxdata(gspca_dev, tbl_init_post_alt_big2,
+					ARRAY_SIZE(tbl_init_post_alt_big2));
 
 		/* flip/mirror */
 		ctrl_out(gspca_dev, 0x40, 3, 0x7a00, 0x0033, 3, dat_hvflip1);
@@ -738,8 +737,8 @@ static int mi2020_init_post_alt(struct gspca_dev *gspca_dev)
 		sd->nbIm = 0;
 
 		if (_MI2020c_)
-			fetch_idxdata(gspca_dev, tbl_init_post_alt_big_c,
-					ARRAY_SIZE(tbl_init_post_alt_big_c));
+			fetch_idxdata(gspca_dev, tbl_init_post_alt_big3,
+					ARRAY_SIZE(tbl_init_post_alt_big3));
 	}
 
 	sd->vold.mirror    = mirror;
@@ -770,7 +769,7 @@ static int mi2020_configure_alt(struct gspca_dev *gspca_dev)
 	return 0;
 }
 
-int mi2020_camera_settings(struct gspca_dev *gspca_dev)
+static int mi2020_camera_settings(struct gspca_dev *gspca_dev)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
 
diff --git a/drivers/media/video/gspca/gl860/gl860-ov2640.c b/drivers/media/video/gspca/gl860/gl860-ov2640.c
index 14b9c373f9f7..768cac5cd72b 100644
--- a/drivers/media/video/gspca/gl860/gl860-ov2640.c
+++ b/drivers/media/video/gspca/gl860/gl860-ov2640.c
@@ -1,6 +1,5 @@
-/* @file gl860-ov2640.c
- * @author Olivier LORIN, from Malmostoso's logs
- * @date 2009-08-27
+/* Subdriver for the GL860 chip with the OV2640 sensor
+ * Author Olivier LORIN, from Malmostoso's logs
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -21,8 +20,12 @@
 #include "gl860.h"
 
 static u8 dat_init1[] = "\x00\x41\x07\x6a\x06\x61\x0d\x6a" "\x10\x10\xc1\x01";
-static u8 dat_init2[] = {0x61}; /* expected */
-static u8 dat_init3[] = {0x51}; /* expected */
+
+static u8 c61[] = {0x61}; /* expected */
+static u8 c51[] = {0x51}; /* expected */
+static u8 c50[] = {0x50}; /* expected */
+static u8 c28[] = {0x28}; /* expected */
+static u8 ca8[] = {0xa8}; /* expected */
 
 static u8 dat_post[] =
 	"\x00\x41\x07\x6a\x06\xef\x0d\x6a" "\x10\x10\xc1\x01";
@@ -32,10 +35,6 @@ static u8 dat_800[]  = "\xd0\x01\xd1\x10\xd2\x58\xd3\x02\xd4\x18\xd5\x21";
 static u8 dat_1280[] = "\xd0\x01\xd1\x18\xd2\xc0\xd3\x02\xd4\x28\xd5\x01";
 static u8 dat_1600[] = "\xd0\x01\xd1\x20\xd2\xb0\xd3\x02\xd4\x30\xd5\x41";
 
-static u8 c50[] = {0x50}; /* expected */
-static u8 c28[] = {0x28}; /* expected */
-static u8 ca8[] = {0xa8}; /* expected */
-
 static struct validx tbl_init_at_startup[] = {
 	{0x0000, 0x0000}, {0x0010, 0x0010}, {0x0008, 0x00c0}, {0x0001, 0x00c1},
 	{0x0001, 0x00c2}, {0x0020, 0x0006}, {0x006a, 0x000d},
@@ -92,7 +91,7 @@ static struct validx tbl_common[] = {
 	{0x6000, 0x0010},
 };
 
-static struct validx tbl_sensor_settings_common_a[] = {
+static struct validx tbl_sensor_settings_common1[] = {
 	{0x0041, 0x0000}, {0x006a, 0x0007}, {0x00ef, 0x0006}, {0x006a, 0x000d},
 	{0x0000, 0x00c0}, {0x0010, 0x0010}, {0x0001, 0x00c1}, {0x0041, 0x00c2},
 	{0x0004, 0x00d8}, {0x0012, 0x0004}, {0x0000, 0x0058}, {0x0041, 0x0000},
@@ -104,40 +103,10 @@ static struct validx tbl_sensor_settings_common_a[] = {
 	{0x0040, 0x0000},
 };
 
-static struct validx tbl_sensor_settings_common_b[] = {
+static struct validx tbl_sensor_settings_common2[] = {
 	{0x6001, 0x00ff}, {0x6038, 0x000c},
 	{10, 0xffff},
 	{0x6000, 0x0011},
-	/* backlight=31/64 */
-	{0x6001, 0x00ff}, {0x603e, 0x0024}, {0x6034, 0x0025},
-	/* bright=0/256 */
-	{0x6000, 0x00ff}, {0x6009, 0x007c}, {0x6000, 0x007d},
-	/* wbal=64/128 */
-	{0x6000, 0x00ff}, {0x6003, 0x007c}, {0x6040, 0x007d},
-	/* cntr=0/256 */
-	{0x6000, 0x00ff}, {0x6007, 0x007c}, {0x6000, 0x007d},
-	/* sat=128/256 */
-	{0x6000, 0x00ff}, {0x6001, 0x007c}, {0x6080, 0x007d},
-	/* sharpness=0/32 */
-	{0x6000, 0x00ff}, {0x6001, 0x0092}, {0x60c0, 0x0093},
-	/* hue=0/256 */
-	{0x6000, 0x00ff}, {0x6002, 0x007c}, {0x6000, 0x007d},
-	/* gam=32/64 */
-	{0x6000, 0x00ff}, {0x6008, 0x007c}, {0x6020, 0x007d},
-	/* image right up */
-	{0xffff, 0xffff},
-	{15, 0xffff},
-	{0x6001, 0x00ff}, {0x6000, 0x8004},
-	{0xffff, 0xffff},
-	{0x60a8, 0x0004},
-	{15, 0xffff},
-	{0x6001, 0x00ff}, {0x6000, 0x8004},
-	{0xffff, 0xffff},
-	{0x60f8, 0x0004},
-	/* image right up */
-	{0xffff, 0xffff},
-	/* backlight=31/64 */
-	{0x6001, 0x00ff}, {0x603e, 0x0024}, {0x6034, 0x0025},
 };
 
 static struct validx tbl_640[] = {
@@ -166,7 +135,7 @@ static struct validx tbl_800[] = {
 	{0x60ff, 0x00dd}, {0x6020, 0x008c}, {0x6001, 0x00ff}, {0x6044, 0x0018},
 };
 
-static struct validx tbl_big_a[] = {
+static struct validx tbl_big1[] = {
 	{0x0002, 0x00c1}, {0x6000, 0x00ff}, {0x60f1, 0x00dd}, {0x6004, 0x00e0},
 	{0x6001, 0x00ff}, {0x6000, 0x0012}, {0x6000, 0x0000}, {0x6000, 0x0045},
 	{0x6000, 0x0010}, {0x6000, 0x0011}, {0x6011, 0x0017}, {0x6075, 0x0018},
@@ -176,14 +145,14 @@ static struct validx tbl_big_a[] = {
 	{0x60c8, 0x00c0}, {0x6096, 0x00c1}, {0x6000, 0x008c},
 };
 
-static struct validx tbl_big_b[] = {
+static struct validx tbl_big2[] = {
 	{0x603d, 0x0086}, {0x6000, 0x0050}, {0x6090, 0x0051}, {0x602c, 0x0052},
 	{0x6000, 0x0053}, {0x6000, 0x0054}, {0x6088, 0x0055}, {0x6000, 0x0057},
 	{0x6040, 0x005a}, {0x60f0, 0x005b}, {0x6001, 0x005c}, {0x6082, 0x00d3},
 	{0x6000, 0x008e},
 };
 
-static struct validx tbl_big_c[] = {
+static struct validx tbl_big3[] = {
 	{0x6004, 0x00da}, {0x6000, 0x00e0}, {0x6067, 0x00e1}, {0x60ff, 0x00dd},
 	{0x6001, 0x00ff}, {0x6000, 0x00ff}, {0x60f1, 0x00dd}, {0x6004, 0x00e0},
 	{0x6001, 0x00ff}, {0x6000, 0x0011}, {0x6000, 0x00ff}, {0x6010, 0x00c7},
@@ -223,17 +192,19 @@ void ov2640_init_settings(struct gspca_dev *gspca_dev)
 	sd->vcur.hue        =   0;
 	sd->vcur.saturation = 128;
 	sd->vcur.whitebal   =  64;
+	sd->vcur.mirror     =   0;
+	sd->vcur.flip       =   0;
 
 	sd->vmax.backlight  =  64;
 	sd->vmax.brightness = 255;
 	sd->vmax.sharpness  =  31;
 	sd->vmax.contrast   = 255;
 	sd->vmax.gamma      =  64;
-	sd->vmax.hue        = 255 + 1;
+	sd->vmax.hue        = 254 + 2;
 	sd->vmax.saturation = 255;
 	sd->vmax.whitebal   = 128;
-	sd->vmax.mirror     = 0;
-	sd->vmax.flip       = 0;
+	sd->vmax.mirror     = 1;
+	sd->vmax.flip       = 1;
 	sd->vmax.AC50Hz     = 0;
 
 	sd->dev_camera_settings = ov2640_camera_settings;
@@ -259,11 +230,11 @@ static int ov2640_init_at_startup(struct gspca_dev *gspca_dev)
 
 	common(gspca_dev);
 
-	ctrl_in(gspca_dev, 0xc0, 2, 0x0000, 0x0006, 1, dat_init2);
+	ctrl_in(gspca_dev, 0xc0, 2, 0x0000, 0x0006, 1, c61);
 
 	ctrl_out(gspca_dev, 0x40, 1, 0x00ef, 0x0006, 0, NULL);
 
-	ctrl_in(gspca_dev, 0xc0, 2, 0x0000, 0x0000, 1, dat_init3);
+	ctrl_in(gspca_dev, 0xc0, 2, 0x0000, 0x0000, 1, c51);
 
 	ctrl_out(gspca_dev, 0x40, 1, 0x0051, 0x0000, 0, NULL);
 /*	ctrl_out(gspca_dev, 0x40, 11, 0x0000, 0x0000, 0, NULL); */
@@ -275,6 +246,8 @@ static int ov2640_init_pre_alt(struct gspca_dev *gspca_dev)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
 
+	sd->mirrorMask = 0;
+
 	sd->vold.backlight  = -1;
 	sd->vold.brightness = -1;
 	sd->vold.sharpness  = -1;
@@ -283,6 +256,8 @@ static int ov2640_init_pre_alt(struct gspca_dev *gspca_dev)
 	sd->vold.gamma    = -1;
 	sd->vold.hue      = -1;
 	sd->vold.whitebal = -1;
+	sd->vold.mirror = -1;
+	sd->vold.flip   = -1;
 
 	ov2640_init_post_alt(gspca_dev);
 
@@ -292,16 +267,16 @@ static int ov2640_init_pre_alt(struct gspca_dev *gspca_dev)
 static int ov2640_init_post_alt(struct gspca_dev *gspca_dev)
 {
 	s32 reso = gspca_dev->cam.cam_mode[(s32) gspca_dev->curr_mode].priv;
-	s32 n; /* reserved for FETCH macros */
+	s32 n; /* reserved for FETCH functions */
 
 	ctrl_out(gspca_dev, 0x40, 5, 0x0001, 0x0000, 0, NULL);
 
-	n = fetch_validx(gspca_dev, tbl_sensor_settings_common_a,
-			ARRAY_SIZE(tbl_sensor_settings_common_a));
+	n = fetch_validx(gspca_dev, tbl_sensor_settings_common1,
+			ARRAY_SIZE(tbl_sensor_settings_common1));
 	ctrl_out(gspca_dev, 0x40, 3, 0x0000, 0x0200, 12, dat_post);
 	common(gspca_dev);
-	keep_on_fetching_validx(gspca_dev, tbl_sensor_settings_common_a,
-				ARRAY_SIZE(tbl_sensor_settings_common_a), n);
+	keep_on_fetching_validx(gspca_dev, tbl_sensor_settings_common1,
+				ARRAY_SIZE(tbl_sensor_settings_common1), n);
 
 	switch (reso) {
 	case IMAGE_640:
@@ -316,18 +291,18 @@ static int ov2640_init_post_alt(struct gspca_dev *gspca_dev)
 
 	case IMAGE_1600:
 	case IMAGE_1280:
-		n = fetch_validx(gspca_dev, tbl_big_a, ARRAY_SIZE(tbl_big_a));
+		n = fetch_validx(gspca_dev, tbl_big1, ARRAY_SIZE(tbl_big1));
 
 		if (reso == IMAGE_1280) {
-			n = fetch_validx(gspca_dev, tbl_big_b,
-					ARRAY_SIZE(tbl_big_b));
+			n = fetch_validx(gspca_dev, tbl_big2,
+					ARRAY_SIZE(tbl_big2));
 		} else {
 			ctrl_out(gspca_dev, 0x40, 1, 0x601d, 0x0086, 0, NULL);
 			ctrl_out(gspca_dev, 0x40, 1, 0x6001, 0x00d7, 0, NULL);
 			ctrl_out(gspca_dev, 0x40, 1, 0x6082, 0x00d3, 0, NULL);
 		}
 
-		n = fetch_validx(gspca_dev, tbl_big_c, ARRAY_SIZE(tbl_big_c));
+		n = fetch_validx(gspca_dev, tbl_big3, ARRAY_SIZE(tbl_big3));
 
 		if (reso == IMAGE_1280) {
 			ctrl_out(gspca_dev, 0x40, 1, 0x6001, 0x00ff, 0, NULL);
@@ -343,20 +318,8 @@ static int ov2640_init_post_alt(struct gspca_dev *gspca_dev)
 		break;
 	}
 
-	n = fetch_validx(gspca_dev, tbl_sensor_settings_common_b,
-			ARRAY_SIZE(tbl_sensor_settings_common_b));
-	ctrl_in(gspca_dev, 0xc0, 2, 0x0000, 0x0000, 1, c50);
-	keep_on_fetching_validx(gspca_dev, tbl_sensor_settings_common_b,
-				ARRAY_SIZE(tbl_sensor_settings_common_b), n);
-	ctrl_in(gspca_dev, 0xc0, 2, 0x6000, 0x8004, 1, c28);
-	keep_on_fetching_validx(gspca_dev, tbl_sensor_settings_common_b,
-				ARRAY_SIZE(tbl_sensor_settings_common_b), n);
-	ctrl_in(gspca_dev, 0xc0, 2, 0x6000, 0x8004, 1, ca8);
-	keep_on_fetching_validx(gspca_dev, tbl_sensor_settings_common_b,
-				ARRAY_SIZE(tbl_sensor_settings_common_b), n);
-	ctrl_in(gspca_dev, 0xc0, 2, 0x0000, 0x0000, 1, c50);
-	keep_on_fetching_validx(gspca_dev, tbl_sensor_settings_common_b,
-				ARRAY_SIZE(tbl_sensor_settings_common_b), n);
+	n = fetch_validx(gspca_dev, tbl_sensor_settings_common2,
+			ARRAY_SIZE(tbl_sensor_settings_common2));
 
 	ov2640_camera_settings(gspca_dev);
 
@@ -393,18 +356,20 @@ static int ov2640_camera_settings(struct gspca_dev *gspca_dev)
 	s32 sat    = sd->vcur.saturation;
 	s32 hue    = sd->vcur.hue;
 	s32 wbal   = sd->vcur.whitebal;
+	s32 mirror = (((sd->vcur.mirror > 0) ^ sd->mirrorMask) == 0);
+	s32 flip   = (((sd->vcur.flip   > 0) ^ sd->mirrorMask) == 0);
 
 	if (backlight != sd->vold.backlight) {
+		/* No sd->vold.backlight=backlight; (to be done again later) */
 		if (backlight < 0 || backlight > sd->vmax.backlight)
 			backlight = 0;
 
 		ctrl_out(gspca_dev, 0x40, 1, 0x6001                 , 0x00ff,
 				0, NULL);
-		ctrl_out(gspca_dev, 0x40, 1, 0x601f + backlight     , 0x0024,
+		ctrl_out(gspca_dev, 0x40, 1, 0x601e + backlight     , 0x0024,
 				0, NULL);
-		ctrl_out(gspca_dev, 0x40, 1, 0x601f + backlight - 10, 0x0025,
+		ctrl_out(gspca_dev, 0x40, 1, 0x601e + backlight - 10, 0x0025,
 				0, NULL);
-		/* No sd->vold.backlight=backlight; (to be done again later) */
 	}
 
 	if (bright != sd->vold.brightness) {
@@ -466,7 +431,7 @@ static int ov2640_camera_settings(struct gspca_dev *gspca_dev)
 		ctrl_out(gspca_dev, 0x40, 1, 0x6002     , 0x007c, 0, NULL);
 		ctrl_out(gspca_dev, 0x40, 1, 0x6000 + hue * (hue < 255), 0x007d,
 				0, NULL);
-		if (hue >= sd->vmax.hue)
+		if (hue >= 255)
 			sd->swapRB = 1;
 		else
 			sd->swapRB = 0;
@@ -482,14 +447,33 @@ static int ov2640_camera_settings(struct gspca_dev *gspca_dev)
 		ctrl_out(gspca_dev, 0x40, 1, 0x6000 + gam, 0x007d, 0, NULL);
 	}
 
+	if (mirror != sd->vold.mirror || flip != sd->vold.flip) {
+		sd->vold.mirror = mirror;
+		sd->vold.flip   = flip;
+
+		mirror = 0x80 * mirror;
+		ctrl_out(gspca_dev, 0x40, 1, 0x6001, 0x00ff, 0, NULL);
+		ctrl_out(gspca_dev, 0x40, 1, 0x6000, 0x8004, 0, NULL);
+		ctrl_in(gspca_dev, 0xc0, 2, 0x6000, 0x8004, 1, c28);
+		ctrl_out(gspca_dev, 0x40, 1, 0x6028 + mirror, 0x0004, 0, NULL);
+
+		flip = 0x50 * flip + mirror;
+		ctrl_out(gspca_dev, 0x40, 1, 0x6001, 0x00ff, 0, NULL);
+		ctrl_out(gspca_dev, 0x40, 1, 0x6000, 0x8004, 0, NULL);
+		ctrl_in(gspca_dev, 0xc0, 2, 0x6000, 0x8004, 1, ca8);
+		ctrl_out(gspca_dev, 0x40, 1, 0x6028 + flip, 0x0004, 0, NULL);
+
+		ctrl_in(gspca_dev, 0xc0, 2, 0x0000, 0x0000, 1, c50);
+	}
+
 	if (backlight != sd->vold.backlight) {
 		sd->vold.backlight = backlight;
 
 		ctrl_out(gspca_dev, 0x40, 1, 0x6001                 , 0x00ff,
 				0, NULL);
-		ctrl_out(gspca_dev, 0x40, 1, 0x601f + backlight     , 0x0024,
+		ctrl_out(gspca_dev, 0x40, 1, 0x601e + backlight     , 0x0024,
 				0, NULL);
-		ctrl_out(gspca_dev, 0x40, 1, 0x601f + backlight - 10, 0x0025,
+		ctrl_out(gspca_dev, 0x40, 1, 0x601e + backlight - 10, 0x0025,
 				0, NULL);
 	}
 
diff --git a/drivers/media/video/gspca/gl860/gl860-ov9655.c b/drivers/media/video/gspca/gl860/gl860-ov9655.c
index eda3346f939c..d412694c50af 100644
--- a/drivers/media/video/gspca/gl860/gl860-ov9655.c
+++ b/drivers/media/video/gspca/gl860/gl860-ov9655.c
@@ -1,7 +1,6 @@
-/* @file gl860-ov9655.c
- * @author Olivier LORIN, from logs done by Simon (Sur3) and Almighurt
+/* Subdriver for the GL860 chip with the OV9655 sensor
+ * Author Olivier LORIN, from logs done by Simon (Sur3) and Almighurt
  * on dsd's weblog
- * @date 2009-08-27
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -104,14 +103,14 @@ static u8 *tbl_800[] = {
 };
 
 static u8 c04[] = {0x04};
-static u8 dat_post_1[] = "\x04\x00\x10\x20\xa1\x00\x00\x02";
-static u8 dat_post_2[] = "\x10\x10\xc1\x02";
-static u8 dat_post_3[] = "\x04\x00\x10\x7c\xa1\x00\x00\x04";
-static u8 dat_post_4[] = "\x10\x02\xc1\x06";
-static u8 dat_post_5[] = "\x04\x00\x10\x7b\xa1\x00\x00\x08";
-static u8 dat_post_6[] = "\x10\x10\xc1\x05";
-static u8 dat_post_7[] = "\x04\x00\x10\x7c\xa1\x00\x00\x08";
-static u8 dat_post_8[] = "\x04\x00\x10\x7c\xa1\x00\x00\x09";
+static u8 dat_post1[] = "\x04\x00\x10\x20\xa1\x00\x00\x02";
+static u8 dat_post2[] = "\x10\x10\xc1\x02";
+static u8 dat_post3[] = "\x04\x00\x10\x7c\xa1\x00\x00\x04";
+static u8 dat_post4[] = "\x10\x02\xc1\x06";
+static u8 dat_post5[] = "\x04\x00\x10\x7b\xa1\x00\x00\x08";
+static u8 dat_post6[] = "\x10\x10\xc1\x05";
+static u8 dat_post7[] = "\x04\x00\x10\x7c\xa1\x00\x00\x08";
+static u8 dat_post8[] = "\x04\x00\x10\x7c\xa1\x00\x00\x09";
 
 static struct validx tbl_init_post_alt[] = {
 	{0x6032, 0x00ff}, {0x6032, 0x00ff}, {0x6032, 0x00ff}, {0x603c, 0x00ff},
@@ -212,7 +211,7 @@ static int ov9655_init_pre_alt(struct gspca_dev *gspca_dev)
 static int ov9655_init_post_alt(struct gspca_dev *gspca_dev)
 {
 	s32 reso = gspca_dev->cam.cam_mode[(s32) gspca_dev->curr_mode].priv;
-	s32 n; /* reserved for FETCH macros */
+	s32 n; /* reserved for FETCH functions */
 	s32 i;
 	u8 **tbl;
 
@@ -243,7 +242,7 @@ static int ov9655_init_post_alt(struct gspca_dev *gspca_dev)
 	ctrl_in(gspca_dev, 0xc0, 2, 0x6000, 0x801e, 1, c04);
 	keep_on_fetching_validx(gspca_dev, tbl_init_post_alt,
 					ARRAY_SIZE(tbl_init_post_alt), n);
-	ctrl_out(gspca_dev, 0x40, 3, 0x6000, 0x0200, 8, dat_post_1);
+	ctrl_out(gspca_dev, 0x40, 3, 0x6000, 0x0200, 8, dat_post1);
 	keep_on_fetching_validx(gspca_dev, tbl_init_post_alt,
 					ARRAY_SIZE(tbl_init_post_alt), n);
 
@@ -259,7 +258,7 @@ static int ov9655_init_post_alt(struct gspca_dev *gspca_dev)
 	ctrl_in(gspca_dev, 0xc0, 2, 0x6000, 0x801e, 1, c04);
 	keep_on_fetching_validx(gspca_dev, tbl_init_post_alt,
 					ARRAY_SIZE(tbl_init_post_alt), n);
-	ctrl_out(gspca_dev, 0x40, 3, 0x6000, 0x0200, 8, dat_post_1);
+	ctrl_out(gspca_dev, 0x40, 3, 0x6000, 0x0200, 8, dat_post1);
 	keep_on_fetching_validx(gspca_dev, tbl_init_post_alt,
 					ARRAY_SIZE(tbl_init_post_alt), n);
 
@@ -270,18 +269,18 @@ static int ov9655_init_post_alt(struct gspca_dev *gspca_dev)
 	keep_on_fetching_validx(gspca_dev, tbl_init_post_alt,
 					ARRAY_SIZE(tbl_init_post_alt), n);
 
-	ctrl_out(gspca_dev, 0x40, 3, 0x6000, 0x0200, 8, dat_post_1);
+	ctrl_out(gspca_dev, 0x40, 3, 0x6000, 0x0200, 8, dat_post1);
 
-	ctrl_out(gspca_dev, 0x40, 3, 0x0000, 0x0200, 4, dat_post_2);
-	ctrl_out(gspca_dev, 0x40, 3, 0x6000, 0x0200, 8, dat_post_3);
+	ctrl_out(gspca_dev, 0x40, 3, 0x0000, 0x0200, 4, dat_post2);
+	ctrl_out(gspca_dev, 0x40, 3, 0x6000, 0x0200, 8, dat_post3);
 
-	ctrl_out(gspca_dev, 0x40, 3, 0x0000, 0x0200, 4, dat_post_4);
-	ctrl_out(gspca_dev, 0x40, 3, 0x6000, 0x0200, 8, dat_post_5);
+	ctrl_out(gspca_dev, 0x40, 3, 0x0000, 0x0200, 4, dat_post4);
+	ctrl_out(gspca_dev, 0x40, 3, 0x6000, 0x0200, 8, dat_post5);
 
-	ctrl_out(gspca_dev, 0x40, 3, 0x0000, 0x0200, 4, dat_post_6);
-	ctrl_out(gspca_dev, 0x40, 3, 0x6000, 0x0200, 8, dat_post_7);
+	ctrl_out(gspca_dev, 0x40, 3, 0x0000, 0x0200, 4, dat_post6);
+	ctrl_out(gspca_dev, 0x40, 3, 0x6000, 0x0200, 8, dat_post7);
 
-	ctrl_out(gspca_dev, 0x40, 3, 0x6000, 0x0200, 8, dat_post_8);
+	ctrl_out(gspca_dev, 0x40, 3, 0x6000, 0x0200, 8, dat_post8);
 
 	ov9655_camera_settings(gspca_dev);
 
diff --git a/drivers/media/video/gspca/gl860/gl860.c b/drivers/media/video/gspca/gl860/gl860.c
index 6ef59ac7f502..4878c8f66543 100644
--- a/drivers/media/video/gspca/gl860/gl860.c
+++ b/drivers/media/video/gspca/gl860/gl860.c
@@ -1,9 +1,7 @@
-/* @file gl860.c
- * @date 2009-08-27
+/* GSPCA subdrivers for Genesys Logic webcams with the GL860 chip
+ * Subdriver core
  *
- * Genesys Logic webcam with gl860 subdrivers
- *
- * Driver by Olivier Lorin <o.lorin@laposte.net>
+ * 2009/09/24 Olivier Lorin <o.lorin@laposte.net>
  * GSPCA by Jean-Francois Moine <http://moinejf.free.fr>
  * Thanks BUGabundo and Malmostoso for your amazing help!
  *
@@ -23,8 +21,8 @@
 #include "gspca.h"
 #include "gl860.h"
 
-MODULE_AUTHOR("Olivier Lorin <lorin@laposte.net>");
-MODULE_DESCRIPTION("GSPCA/Genesys Logic GL860 USB Camera Driver");
+MODULE_AUTHOR("Olivier Lorin <o.lorin@laposte.net>");
+MODULE_DESCRIPTION("Genesys Logic USB PC Camera Driver");
 MODULE_LICENSE("GPL");
 
 /*======================== static function declarations ====================*/
@@ -38,11 +36,11 @@ static int  sd_isoc_init(struct gspca_dev *gspca_dev);
 static int  sd_start(struct gspca_dev *gspca_dev);
 static void sd_stop0(struct gspca_dev *gspca_dev);
 static void sd_pkt_scan(struct gspca_dev *gspca_dev,
-			struct gspca_frame *frame, u8 *data, s32 len);
+			u8 *data, int len);
 static void sd_callback(struct gspca_dev *gspca_dev);
 
 static int gl860_guess_sensor(struct gspca_dev *gspca_dev,
-				s32 vendor_id, s32 product_id);
+				u16 vendor_id, u16 product_id);
 
 /*============================ driver options ==============================*/
 
@@ -53,7 +51,7 @@ MODULE_PARM_DESC(AC50Hz, " Does AC power frequency is 50Hz? (0/1)");
 static char sensor[7];
 module_param_string(sensor, sensor, sizeof(sensor), 0644);
 MODULE_PARM_DESC(sensor,
-		" Driver sensor ('MI1320'/'MI2020'/'OV9655'/'OV2640'/'')");
+		" Driver sensor ('MI1320'/'MI2020'/'OV9655'/'OV2640')");
 
 /*============================ webcam controls =============================*/
 
@@ -156,7 +154,7 @@ static int gl860_build_control_table(struct gspca_dev *gspca_dev)
 	SET_MY_CTRL(V4L2_CID_VFLIP,
 		V4L2_CTRL_TYPE_BOOLEAN, "Flip", flip)
 	SET_MY_CTRL(V4L2_CID_POWER_LINE_FREQUENCY,
-		V4L2_CTRL_TYPE_BOOLEAN, "50Hz", AC50Hz)
+		V4L2_CTRL_TYPE_BOOLEAN, "AC power 50Hz", AC50Hz)
 
 	return nCtrls;
 }
@@ -328,11 +326,11 @@ static int sd_config(struct gspca_dev *gspca_dev,
 {
 	struct sd *sd = (struct sd *) gspca_dev;
 	struct cam *cam;
-	s32 vendor_id, product_id;
+	u16 vendor_id, product_id;
 
 	/* Get USB VendorID and ProductID */
-	vendor_id  = le16_to_cpu(id->idVendor);
-	product_id = le16_to_cpu(id->idProduct);
+	vendor_id  = id->idVendor;
+	product_id = id->idProduct;
 
 	sd->nbRightUp = 1;
 	sd->nbIm = -1;
@@ -435,7 +433,7 @@ static void sd_stop0(struct gspca_dev *gspca_dev)
 
 /* This function is called when an image is being received */
 static void sd_pkt_scan(struct gspca_dev *gspca_dev,
-			struct gspca_frame *frame, u8 *data, s32 len)
+			u8 *data, int len)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
 	static s32 nSkipped;
@@ -447,11 +445,11 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
 	/* Test only against 0202h, so endianess does not matter */
 	switch (*(s16 *) data) {
 	case 0x0202:		/* End of frame, start a new one */
-		frame = gspca_frame_add(gspca_dev, LAST_PACKET, frame, data, 0);
+		gspca_frame_add(gspca_dev, LAST_PACKET, NULL, 0);
 		nSkipped = 0;
 		if (sd->nbIm >= 0 && sd->nbIm < 10)
 			sd->nbIm++;
-		gspca_frame_add(gspca_dev, FIRST_PACKET, frame, data, 0);
+		gspca_frame_add(gspca_dev, FIRST_PACKET, NULL, 0);
 		break;
 
 	default:
@@ -466,7 +464,7 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
 				nSkipped = nToSkip + 1;
 			}
 			gspca_frame_add(gspca_dev,
-				INTER_PACKET, frame, data, len);
+				INTER_PACKET, data, len);
 		}
 		break;
 	}
@@ -536,8 +534,8 @@ static int sd_probe(struct usb_interface *intf,
 		gspca_dev = usb_get_intfdata(intf);
 
 		PDEBUG(D_PROBE,
-			"Camera is now controlling video device /dev/video%d",
-			gspca_dev->vdev.minor);
+			"Camera is now controlling video device %s",
+			video_device_node_name(&gspca_dev->vdev));
 	}
 
 	return ret;
@@ -675,7 +673,7 @@ void fetch_idxdata(struct gspca_dev *gspca_dev, struct idxdata *tbl, int len)
 }
 
 static int gl860_guess_sensor(struct gspca_dev *gspca_dev,
-				s32 vendor_id, s32 product_id)
+				u16 vendor_id, u16 product_id)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
 	u8 probe, nb26, nb96, nOV, ntry;
@@ -702,6 +700,7 @@ static int gl860_guess_sensor(struct gspca_dev *gspca_dev,
 		ctrl_out(gspca_dev, 0x40, 1, 0x006a, 0x000d, 0, NULL);
 		msleep(56);
 
+		PDEBUG(D_PROBE, "probing for sensor MI2020 or OVXXXX");
 		nOV = 0;
 		for (ntry = 0; ntry < 4; ntry++) {
 			ctrl_out(gspca_dev, 0x40, 1, 0x0040, 0x0000, 0, NULL);
@@ -711,14 +710,14 @@ static int gl860_guess_sensor(struct gspca_dev *gspca_dev,
 			ctrl_out(gspca_dev, 0x40, 1, 0x7a00, 0x8030, 0, NULL);
 			msleep(10);
 			ctrl_in(gspca_dev, 0xc0, 2, 0x7a00, 0x8030, 1, &probe);
-			PDEBUG(D_PROBE, "1st probe=%02x", probe);
+			PDEBUG(D_PROBE, "probe=0x%02x", probe);
 			if (probe == 0xff)
 				nOV++;
 		}
 
 		if (nOV) {
-			PDEBUG(D_PROBE, "0xff -> sensor OVXXXX");
-			PDEBUG(D_PROBE, "Probing for sensor OV2640 or OV9655");
+			PDEBUG(D_PROBE, "0xff -> OVXXXX");
+			PDEBUG(D_PROBE, "probing for sensor OV2640 or OV9655");
 
 			nb26 = nb96 = 0;
 			for (ntry = 0; ntry < 4; ntry++) {
@@ -728,40 +727,38 @@ static int gl860_guess_sensor(struct gspca_dev *gspca_dev,
 				ctrl_out(gspca_dev, 0x40, 1, 0x6000, 0x800a,
 						0, NULL);
 				msleep(10);
+
 				/* Wait for 26(OV2640) or 96(OV9655) */
 				ctrl_in(gspca_dev, 0xc0, 2, 0x6000, 0x800a,
 						1, &probe);
 
-				PDEBUG(D_PROBE, "2nd probe=%02x", probe);
-				if (probe == 0x00)
-					nb26++;
 				if (probe == 0x26 || probe == 0x40) {
+					PDEBUG(D_PROBE,
+						"probe=0x%02x -> OV2640",
+						probe);
 					sd->sensor = ID_OV2640;
 					nb26 += 4;
 					break;
 				}
 				if (probe == 0x96 || probe == 0x55) {
+					PDEBUG(D_PROBE,
+						"probe=0x%02x -> OV9655",
+						probe);
 					sd->sensor = ID_OV9655;
 					nb96 += 4;
 					break;
 				}
+				PDEBUG(D_PROBE, "probe=0x%02x", probe);
+				if (probe == 0x00)
+					nb26++;
 				if (probe == 0xff)
 					nb96++;
 				msleep(3);
 			}
-			if (nb26 < 4 && nb96 < 4) {
-				PDEBUG(D_PROBE, "No relevant answer ");
-				PDEBUG(D_PROBE, "* 1.3Mpixels -> use OV9655");
-				PDEBUG(D_PROBE, "* 2.0Mpixels -> use OV2640");
-				PDEBUG(D_PROBE,
-					"To force a sensor, add that line to "
-					"/etc/modprobe.d/options.conf:");
-				PDEBUG(D_PROBE, "options gspca_gl860 "
-					"sensor=\"OV2640\" or \"OV9655\"");
+			if (nb26 < 4 && nb96 < 4)
 				return -1;
-			}
-		} else { /* probe = 0 */
-			PDEBUG(D_PROBE, "No 0xff -> sensor MI2020");
+		} else {
+			PDEBUG(D_PROBE, "Not any 0xff -> MI2020");
 			sd->sensor = ID_MI2020;
 		}
 	}
diff --git a/drivers/media/video/gspca/gl860/gl860.h b/drivers/media/video/gspca/gl860/gl860.h
index cef4e24c1e61..305061ff8387 100644
--- a/drivers/media/video/gspca/gl860/gl860.h
+++ b/drivers/media/video/gspca/gl860/gl860.h
@@ -1,6 +1,7 @@
-/* @file gl860.h
- * @author Olivier LORIN, tiré du pilote Syntek par Nicolas VIVIEN
- * @date 2009-08-27
+/* GSPCA subdrivers for Genesys Logic webcams with the GL860 chip
+ * Subdriver declarations
+ *
+ * 2009/10/14 Olivier LORIN <o.lorin@laposte.net>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
diff --git a/drivers/media/video/gspca/gspca.c b/drivers/media/video/gspca/gspca.c
index 23d3fb776918..bd6214d4ab3b 100644
--- a/drivers/media/video/gspca/gspca.c
+++ b/drivers/media/video/gspca/gspca.c
@@ -47,7 +47,7 @@ MODULE_AUTHOR("Jean-Francois Moine <http://moinejf.free.fr>");
 MODULE_DESCRIPTION("GSPCA USB Camera Driver");
 MODULE_LICENSE("GPL");
 
-#define DRIVER_VERSION_NUMBER	KERNEL_VERSION(2, 7, 0)
+#define DRIVER_VERSION_NUMBER	KERNEL_VERSION(2, 8, 0)
 
 #ifdef GSPCA_DEBUG
 int gspca_debug = D_ERR | D_PROBE;
@@ -74,7 +74,7 @@ static void PDEBUG_MODE(char *txt, __u32 pixfmt, int w, int h)
 #define PDEBUG_MODE(txt, pixfmt, w, h)
 #endif
 
-/* specific memory types - !! should different from V4L2_MEMORY_xxx */
+/* specific memory types - !! should be different from V4L2_MEMORY_xxx */
 #define GSPCA_MEMORY_NO 0	/* V4L2_MEMORY_xxx starts from 1 */
 #define GSPCA_MEMORY_READ 7
 
@@ -126,7 +126,6 @@ EXPORT_SYMBOL(gspca_get_i_frame);
 static void fill_frame(struct gspca_dev *gspca_dev,
 			struct urb *urb)
 {
-	struct gspca_frame *frame;
 	u8 *data;		/* address of data in the iso message */
 	int i, len, st;
 	cam_pkt_op pkt_scan;
@@ -135,21 +134,16 @@ static void fill_frame(struct gspca_dev *gspca_dev,
 		if (urb->status == -ESHUTDOWN)
 			return;		/* disconnection */
 #ifdef CONFIG_PM
-		if (!gspca_dev->frozen)
+		if (gspca_dev->frozen)
+			return;
 #endif
-			PDEBUG(D_ERR|D_PACK, "urb status: %d", urb->status);
-		return;
+		PDEBUG(D_ERR|D_PACK, "urb status: %d", urb->status);
+		urb->status = 0;
+		goto resubmit;
 	}
 	pkt_scan = gspca_dev->sd_desc->pkt_scan;
 	for (i = 0; i < urb->number_of_packets; i++) {
 
-		/* check the availability of the frame buffer */
-		frame = gspca_get_i_frame(gspca_dev);
-		if (!frame) {
-			gspca_dev->last_packet_type = DISCARD_PACKET;
-			break;
-		}
-
 		/* check the packet status and length */
 		len = urb->iso_frame_desc[i].actual_length;
 		if (len == 0) {
@@ -171,9 +165,10 @@ static void fill_frame(struct gspca_dev *gspca_dev,
 			i, urb->iso_frame_desc[i].offset, len);
 		data = (u8 *) urb->transfer_buffer
 					+ urb->iso_frame_desc[i].offset;
-		pkt_scan(gspca_dev, frame, data, len);
+		pkt_scan(gspca_dev, data, len);
 	}
 
+resubmit:
 	/* resubmit the URB */
 	st = usb_submit_urb(urb, GFP_ATOMIC);
 	if (st < 0)
@@ -201,7 +196,6 @@ static void isoc_irq(struct urb *urb)
 static void bulk_irq(struct urb *urb)
 {
 	struct gspca_dev *gspca_dev = (struct gspca_dev *) urb->context;
-	struct gspca_frame *frame;
 	int st;
 
 	PDEBUG(D_PACK, "bulk irq");
@@ -212,29 +206,22 @@ static void bulk_irq(struct urb *urb)
 		break;
 	case -ESHUTDOWN:
 		return;		/* disconnection */
-	case -ECONNRESET:
-		urb->status = 0;
-		break;
 	default:
 #ifdef CONFIG_PM
-		if (!gspca_dev->frozen)
+		if (gspca_dev->frozen)
+			return;
 #endif
-			PDEBUG(D_ERR|D_PACK, "urb status: %d", urb->status);
-		return;
+		PDEBUG(D_ERR|D_PACK, "urb status: %d", urb->status);
+		urb->status = 0;
+		goto resubmit;
 	}
 
-	/* check the availability of the frame buffer */
-	frame = gspca_get_i_frame(gspca_dev);
-	if (!frame) {
-		gspca_dev->last_packet_type = DISCARD_PACKET;
-	} else {
-		PDEBUG(D_PACK, "packet l:%d", urb->actual_length);
-		gspca_dev->sd_desc->pkt_scan(gspca_dev,
-					frame,
-					urb->transfer_buffer,
-					urb->actual_length);
-	}
+	PDEBUG(D_PACK, "packet l:%d", urb->actual_length);
+	gspca_dev->sd_desc->pkt_scan(gspca_dev,
+				urb->transfer_buffer,
+				urb->actual_length);
 
+resubmit:
 	/* resubmit the URB */
 	if (gspca_dev->cam.bulk_nurbs != 0) {
 		st = usb_submit_urb(urb, GFP_ATOMIC);
@@ -255,24 +242,27 @@ static void bulk_irq(struct urb *urb)
  * DISCARD_PACKET invalidates the whole frame.
  * On LAST_PACKET, a new frame is returned.
  */
-struct gspca_frame *gspca_frame_add(struct gspca_dev *gspca_dev,
-				    enum gspca_packet_type packet_type,
-				    struct gspca_frame *frame,
-				    const __u8 *data,
-				    int len)
+void gspca_frame_add(struct gspca_dev *gspca_dev,
+			enum gspca_packet_type packet_type,
+			const u8 *data,
+			int len)
 {
+	struct gspca_frame *frame;
 	int i, j;
 
 	PDEBUG(D_PACK, "add t:%d l:%d",	packet_type, len);
 
+	/* check the availability of the frame buffer */
+	frame = gspca_dev->cur_frame;
+	if ((frame->v4l2_buf.flags & BUF_ALL_FLAGS)
+					!= V4L2_BUF_FLAG_QUEUED) {
+		gspca_dev->last_packet_type = DISCARD_PACKET;
+		return;
+	}
+
 	/* when start of a new frame, if the current frame buffer
 	 * is not queued, discard the whole frame */
 	if (packet_type == FIRST_PACKET) {
-		if ((frame->v4l2_buf.flags & BUF_ALL_FLAGS)
-						!= V4L2_BUF_FLAG_QUEUED) {
-			gspca_dev->last_packet_type = DISCARD_PACKET;
-			return frame;
-		}
 		frame->data_end = frame->data;
 		jiffies_to_timeval(get_jiffies_64(),
 				   &frame->v4l2_buf.timestamp);
@@ -280,7 +270,7 @@ struct gspca_frame *gspca_frame_add(struct gspca_dev *gspca_dev,
 	} else if (gspca_dev->last_packet_type == DISCARD_PACKET) {
 		if (packet_type == LAST_PACKET)
 			gspca_dev->last_packet_type = packet_type;
-		return frame;
+		return;
 	}
 
 	/* append the packet to the frame buffer */
@@ -312,9 +302,8 @@ struct gspca_frame *gspca_frame_add(struct gspca_dev *gspca_dev,
 			i,
 			gspca_dev->fr_o);
 		j = gspca_dev->fr_queue[i];
-		frame = &gspca_dev->frame[j];
+		gspca_dev->cur_frame = &gspca_dev->frame[j];
 	}
-	return frame;
 }
 EXPORT_SYMBOL(gspca_frame_add);
 
@@ -331,7 +320,7 @@ static int gspca_is_compressed(__u32 format)
 	return 0;
 }
 
-static void *rvmalloc(unsigned long size)
+static void *rvmalloc(long size)
 {
 	void *mem;
 	unsigned long adr;
@@ -339,7 +328,7 @@ static void *rvmalloc(unsigned long size)
 	mem = vmalloc_32(size);
 	if (mem != NULL) {
 		adr = (unsigned long) mem;
-		while ((long) size > 0) {
+		while (size > 0) {
 			SetPageReserved(vmalloc_to_page((void *) adr));
 			adr += PAGE_SIZE;
 			size -= PAGE_SIZE;
@@ -395,6 +384,7 @@ static int frame_alloc(struct gspca_dev *gspca_dev,
 		frame->v4l2_buf.m.offset = i * frsz;
 	}
 	gspca_dev->fr_i = gspca_dev->fr_o = gspca_dev->fr_q = 0;
+	gspca_dev->cur_frame = &gspca_dev->frame[0];
 	gspca_dev->last_packet_type = DISCARD_PACKET;
 	gspca_dev->sequence = 0;
 	return 0;
@@ -475,10 +465,18 @@ static struct usb_host_endpoint *get_ep(struct gspca_dev *gspca_dev)
 	xfer = gspca_dev->cam.bulk ? USB_ENDPOINT_XFER_BULK
 				   : USB_ENDPOINT_XFER_ISOC;
 	i = gspca_dev->alt;			/* previous alt setting */
-	while (--i >= 0) {
-		ep = alt_xfer(&intf->altsetting[i], xfer);
-		if (ep)
-			break;
+	if (gspca_dev->cam.reverse_alts) {
+		while (++i < gspca_dev->nbalt) {
+			ep = alt_xfer(&intf->altsetting[i], xfer);
+			if (ep)
+				break;
+		}
+	} else {
+		while (--i >= 0) {
+			ep = alt_xfer(&intf->altsetting[i], xfer);
+			if (ep)
+				break;
+		}
 	}
 	if (ep == NULL) {
 		err("no transfer endpoint found");
@@ -599,7 +597,11 @@ static int gspca_init_transfer(struct gspca_dev *gspca_dev)
 
 	/* set the higher alternate setting and
 	 * loop until urb submit succeeds */
-	gspca_dev->alt = gspca_dev->nbalt;
+	if (gspca_dev->cam.reverse_alts)
+		gspca_dev->alt = 0;
+	else
+		gspca_dev->alt = gspca_dev->nbalt;
+
 	if (gspca_dev->sd_desc->isoc_init) {
 		ret = gspca_dev->sd_desc->isoc_init(gspca_dev);
 		if (ret < 0)
@@ -641,15 +643,19 @@ static int gspca_init_transfer(struct gspca_dev *gspca_dev)
 		}
 		if (ret >= 0)
 			break;
-		PDEBUG(D_ERR|D_STREAM,
-			"usb_submit_urb alt %d err %d", gspca_dev->alt, ret);
 		gspca_dev->streaming = 0;
 		destroy_urbs(gspca_dev);
-		if (ret != -ENOSPC)
+		if (ret != -ENOSPC) {
+			PDEBUG(D_ERR|D_STREAM,
+				"usb_submit_urb alt %d err %d",
+				gspca_dev->alt, ret);
 			goto out;
+		}
 
 		/* the bandwidth is not wide enough
 		 * negociate or try a lower alternate setting */
+		PDEBUG(D_ERR|D_STREAM,
+			"bandwidth not wide enough - trying again");
 		msleep(20);	/* wait for kill complete */
 		if (gspca_dev->sd_desc->isoc_nego) {
 			ret = gspca_dev->sd_desc->isoc_nego(gspca_dev);
@@ -761,6 +767,7 @@ static int vidioc_g_register(struct file *file, void *priv,
 
 	if (mutex_lock_interruptible(&gspca_dev->usb_lock))
 		return -ERESTARTSYS;
+	gspca_dev->usb_err = 0;
 	if (gspca_dev->present)
 		ret = gspca_dev->sd_desc->get_register(gspca_dev, reg);
 	else
@@ -784,6 +791,7 @@ static int vidioc_s_register(struct file *file, void *priv,
 
 	if (mutex_lock_interruptible(&gspca_dev->usb_lock))
 		return -ERESTARTSYS;
+	gspca_dev->usb_err = 0;
 	if (gspca_dev->present)
 		ret = gspca_dev->sd_desc->set_register(gspca_dev, reg);
 	else
@@ -805,6 +813,7 @@ static int vidioc_g_chip_ident(struct file *file, void *priv,
 
 	if (mutex_lock_interruptible(&gspca_dev->usb_lock))
 		return -ERESTARTSYS;
+	gspca_dev->usb_err = 0;
 	if (gspca_dev->present)
 		ret = gspca_dev->sd_desc->get_chip_ident(gspca_dev, chip);
 	else
@@ -976,11 +985,40 @@ static int vidioc_enum_framesizes(struct file *file, void *priv,
 	return -EINVAL;
 }
 
+static int vidioc_enum_frameintervals(struct file *filp, void *priv,
+				      struct v4l2_frmivalenum *fival)
+{
+	struct gspca_dev *gspca_dev = priv;
+	int mode = wxh_to_mode(gspca_dev, fival->width, fival->height);
+	__u32 i;
+
+	if (gspca_dev->cam.mode_framerates == NULL ||
+			gspca_dev->cam.mode_framerates[mode].nrates == 0)
+		return -EINVAL;
+
+	if (fival->pixel_format !=
+			gspca_dev->cam.cam_mode[mode].pixelformat)
+		return -EINVAL;
+
+	for (i = 0; i < gspca_dev->cam.mode_framerates[mode].nrates; i++) {
+		if (fival->index == i) {
+			fival->type = V4L2_FRMSIZE_TYPE_DISCRETE;
+			fival->discrete.numerator = 1;
+			fival->discrete.denominator =
+				gspca_dev->cam.mode_framerates[mode].rates[i];
+			return 0;
+		}
+	}
+
+	return -EINVAL;
+}
+
 static void gspca_release(struct video_device *vfd)
 {
 	struct gspca_dev *gspca_dev = container_of(vfd, struct gspca_dev, vdev);
 
-	PDEBUG(D_STREAM, "device released");
+	PDEBUG(D_PROBE, "%s released",
+		video_device_node_name(&gspca_dev->vdev));
 
 	kfree(gspca_dev->usb_buf);
 	kfree(gspca_dev);
@@ -991,7 +1029,7 @@ static int dev_open(struct file *file)
 	struct gspca_dev *gspca_dev;
 	int ret;
 
-	PDEBUG(D_STREAM, "%s open", current->comm);
+	PDEBUG(D_STREAM, "[%s] open", current->comm);
 	gspca_dev = (struct gspca_dev *) video_devdata(file);
 	if (mutex_lock_interruptible(&gspca_dev->queue_lock))
 		return -ERESTARTSYS;
@@ -1037,7 +1075,7 @@ static int dev_close(struct file *file)
 {
 	struct gspca_dev *gspca_dev = file->private_data;
 
-	PDEBUG(D_STREAM, "%s close", current->comm);
+	PDEBUG(D_STREAM, "[%s] close", current->comm);
 	if (mutex_lock_interruptible(&gspca_dev->queue_lock))
 		return -ERESTARTSYS;
 	gspca_dev->users--;
@@ -1046,6 +1084,7 @@ static int dev_close(struct file *file)
 	if (gspca_dev->capt_file == file) {
 		if (gspca_dev->streaming) {
 			mutex_lock(&gspca_dev->usb_lock);
+			gspca_dev->usb_err = 0;
 			gspca_stream_off(gspca_dev);
 			mutex_unlock(&gspca_dev->usb_lock);
 		}
@@ -1136,12 +1175,17 @@ static int vidioc_queryctrl(struct file *file, void *priv,
 				continue;
 			ctrls = &gspca_dev->sd_desc->ctrls[i];
 		}
+		if (ctrls == NULL)
+			return -EINVAL;
 	} else {
 		ctrls = get_ctrl(gspca_dev, id);
+		if (ctrls == NULL)
+			return -EINVAL;
+		i = ctrls - gspca_dev->sd_desc->ctrls;
 	}
-	if (ctrls == NULL)
-		return -EINVAL;
 	memcpy(q_ctrl, ctrls, sizeof *q_ctrl);
+	if (gspca_dev->ctrl_inac & (1 << i))
+		q_ctrl->flags |= V4L2_CTRL_FLAG_INACTIVE;
 	return 0;
 }
 
@@ -1162,6 +1206,7 @@ static int vidioc_s_ctrl(struct file *file, void *priv,
 	PDEBUG(D_CONF, "set ctrl [%08x] = %d", ctrl->id, ctrl->value);
 	if (mutex_lock_interruptible(&gspca_dev->usb_lock))
 		return -ERESTARTSYS;
+	gspca_dev->usb_err = 0;
 	if (gspca_dev->present)
 		ret = ctrls->set(gspca_dev, ctrl->value);
 	else
@@ -1183,6 +1228,7 @@ static int vidioc_g_ctrl(struct file *file, void *priv,
 
 	if (mutex_lock_interruptible(&gspca_dev->usb_lock))
 		return -ERESTARTSYS;
+	gspca_dev->usb_err = 0;
 	if (gspca_dev->present)
 		ret = ctrls->get(gspca_dev, &ctrl->value);
 	else
@@ -1297,6 +1343,7 @@ static int vidioc_reqbufs(struct file *file, void *priv,
 	/* stop streaming */
 	if (gspca_dev->streaming) {
 		mutex_lock(&gspca_dev->usb_lock);
+		gspca_dev->usb_err = 0;
 		gspca_stream_off(gspca_dev);
 		mutex_unlock(&gspca_dev->usb_lock);
 	}
@@ -1388,6 +1435,7 @@ static int vidioc_streamoff(struct file *file, void *priv,
 		ret = -ERESTARTSYS;
 		goto out;
 	}
+	gspca_dev->usb_err = 0;
 	gspca_stream_off(gspca_dev);
 	mutex_unlock(&gspca_dev->usb_lock);
 
@@ -1413,6 +1461,7 @@ static int vidioc_g_jpegcomp(struct file *file, void *priv,
 		return -EINVAL;
 	if (mutex_lock_interruptible(&gspca_dev->usb_lock))
 		return -ERESTARTSYS;
+	gspca_dev->usb_err = 0;
 	if (gspca_dev->present)
 		ret = gspca_dev->sd_desc->get_jcomp(gspca_dev, jpegcomp);
 	else
@@ -1431,6 +1480,7 @@ static int vidioc_s_jpegcomp(struct file *file, void *priv,
 		return -EINVAL;
 	if (mutex_lock_interruptible(&gspca_dev->usb_lock))
 		return -ERESTARTSYS;
+	gspca_dev->usb_err = 0;
 	if (gspca_dev->present)
 		ret = gspca_dev->sd_desc->set_jcomp(gspca_dev, jpegcomp);
 	else
@@ -1451,6 +1501,7 @@ static int vidioc_g_parm(struct file *filp, void *priv,
 
 		if (mutex_lock_interruptible(&gspca_dev->usb_lock))
 			return -ERESTARTSYS;
+		gspca_dev->usb_err = 0;
 		if (gspca_dev->present)
 			ret = gspca_dev->sd_desc->get_streamparm(gspca_dev,
 								 parm);
@@ -1480,6 +1531,7 @@ static int vidioc_s_parm(struct file *filp, void *priv,
 
 		if (mutex_lock_interruptible(&gspca_dev->usb_lock))
 			return -ERESTARTSYS;
+		gspca_dev->usb_err = 0;
 		if (gspca_dev->present)
 			ret = gspca_dev->sd_desc->set_streamparm(gspca_dev,
 								 parm);
@@ -1651,6 +1703,7 @@ static int frame_wait(struct gspca_dev *gspca_dev,
 
 	if (gspca_dev->sd_desc->dq_callback) {
 		mutex_lock(&gspca_dev->usb_lock);
+		gspca_dev->usb_err = 0;
 		if (gspca_dev->present)
 			gspca_dev->sd_desc->dq_callback(gspca_dev);
 		mutex_unlock(&gspca_dev->usb_lock);
@@ -1762,6 +1815,8 @@ static int vidioc_qbuf(struct file *file, void *priv,
 	/* put the buffer in the 'queued' queue */
 	i = gspca_dev->fr_q;
 	gspca_dev->fr_queue[i] = index;
+	if (gspca_dev->fr_i == i)
+		gspca_dev->cur_frame = frame;
 	gspca_dev->fr_q = (i + 1) % gspca_dev->nframes;
 	PDEBUG(D_FRAM, "qbuf q:%d i:%d o:%d",
 		gspca_dev->fr_q,
@@ -1963,6 +2018,7 @@ static const struct v4l2_ioctl_ops dev_ioctl_ops = {
 	.vidioc_g_parm		= vidioc_g_parm,
 	.vidioc_s_parm		= vidioc_s_parm,
 	.vidioc_enum_framesizes = vidioc_enum_framesizes,
+	.vidioc_enum_frameintervals = vidioc_enum_frameintervals,
 #ifdef CONFIG_VIDEO_ADV_DEBUG
 	.vidioc_g_register	= vidioc_g_register,
 	.vidioc_s_register	= vidioc_s_register,
@@ -1978,7 +2034,6 @@ static struct video_device gspca_template = {
 	.fops = &dev_fops,
 	.ioctl_ops = &dev_ioctl_ops,
 	.release = gspca_release,
-	.minor = -1,
 };
 
 /*
@@ -2001,11 +2056,15 @@ int gspca_dev_probe(struct usb_interface *intf,
 	PDEBUG(D_PROBE, "probing %04x:%04x", id->idVendor, id->idProduct);
 
 	/* we don't handle multi-config cameras */
-	if (dev->descriptor.bNumConfigurations != 1)
+	if (dev->descriptor.bNumConfigurations != 1) {
+		PDEBUG(D_ERR, "Too many config");
 		return -ENODEV;
+	}
 	interface = &intf->cur_altsetting->desc;
-	if (interface->bInterfaceNumber > 0)
+	if (interface->bInterfaceNumber > 0) {
+		PDEBUG(D_ERR, "intf != 0");
 		return -ENODEV;
+	}
 
 	/* create the device */
 	if (dev_size < sizeof *gspca_dev)
@@ -2035,9 +2094,6 @@ int gspca_dev_probe(struct usb_interface *intf,
 	ret = sd_desc->init(gspca_dev);
 	if (ret < 0)
 		goto out;
-	ret = gspca_set_alt0(gspca_dev);
-	if (ret < 0)
-		goto out;
 	gspca_set_default_mode(gspca_dev);
 
 	mutex_init(&gspca_dev->usb_lock);
@@ -2059,7 +2115,7 @@ int gspca_dev_probe(struct usb_interface *intf,
 	}
 
 	usb_set_intfdata(intf, gspca_dev);
-	PDEBUG(D_PROBE, "probe ok");
+	PDEBUG(D_PROBE, "%s created", video_device_node_name(&gspca_dev->vdev));
 	return 0;
 out:
 	kfree(gspca_dev->usb_buf);
@@ -2078,6 +2134,8 @@ void gspca_disconnect(struct usb_interface *intf)
 {
 	struct gspca_dev *gspca_dev = usb_get_intfdata(intf);
 
+	PDEBUG(D_PROBE, "%s disconnect",
+		video_device_node_name(&gspca_dev->vdev));
 	mutex_lock(&gspca_dev->usb_lock);
 	gspca_dev->present = 0;
 
@@ -2096,7 +2154,7 @@ void gspca_disconnect(struct usb_interface *intf)
 	/* (this will call gspca_release() immediatly or on last close) */
 	video_unregister_device(&gspca_dev->vdev);
 
-	PDEBUG(D_PROBE, "disconnect complete");
+/*	PDEBUG(D_PROBE, "disconnect complete"); */
 }
 EXPORT_SYMBOL(gspca_disconnect);
 
diff --git a/drivers/media/video/gspca/gspca.h b/drivers/media/video/gspca/gspca.h
index 70b1fd830876..59c7941da999 100644
--- a/drivers/media/video/gspca/gspca.h
+++ b/drivers/media/video/gspca/gspca.h
@@ -45,11 +45,20 @@ extern int gspca_debug;
 /* image transfers */
 #define MAX_NURBS 4		/* max number of URBs */
 
+
+/* used to list framerates supported by a camera mode (resolution) */
+struct framerates {
+	int *rates;
+	int nrates;
+};
+
 /* device information - set at probe time */
 struct cam {
 	int bulk_size;		/* buffer size when image transfer by bulk */
 	const struct v4l2_pix_format *cam_mode;	/* size nmodes */
 	char nmodes;
+	const struct framerates *mode_framerates; /* must have size nmode,
+						   * just like cam_mode */
 	__u8 bulk_nurbs;	/* number of URBs in bulk mode
 				 * - cannot be > MAX_NURBS
 				 * - when 0 and bulk_size != 0 means
@@ -58,6 +67,7 @@ struct cam {
 	u8 npkt;		/* number of packets in an ISOC message
 				 * 0 is the default value: 32 packets */
 	u32 input_flags;	/* value for ENUM_INPUT status flags */
+	char reverse_alts;	/* Alt settings are in high to low order */
 };
 
 struct gspca_dev;
@@ -78,8 +88,7 @@ typedef int (*cam_streamparm_op) (struct gspca_dev *,
 typedef int (*cam_qmnu_op) (struct gspca_dev *,
 			struct v4l2_querymenu *);
 typedef void (*cam_pkt_op) (struct gspca_dev *gspca_dev,
-				struct gspca_frame *frame,
-				__u8 *data,
+				u8 *data,
 				int len);
 
 struct ctrl {
@@ -142,6 +151,7 @@ struct gspca_dev {
 	struct cam cam;				/* device information */
 	const struct sd_desc *sd_desc;		/* subdriver description */
 	unsigned ctrl_dis;		/* disabled controls (bit map) */
+	unsigned ctrl_inac;		/* inactive controls (bit map) */
 
 #define USB_BUF_SZ 64
 	__u8 *usb_buf;				/* buffer for USB exchanges */
@@ -149,6 +159,7 @@ struct gspca_dev {
 
 	__u8 *frbuf;				/* buffer for nframes */
 	struct gspca_frame frame[GSPCA_MAX_FRAMES];
+	struct gspca_frame *cur_frame;		/* frame beeing filled */
 	__u32 frsz;				/* frame size */
 	char nframes;				/* number of frames */
 	char fr_i;				/* frame being filled */
@@ -169,6 +180,7 @@ struct gspca_dev {
 	struct mutex usb_lock;		/* usb exchange protection */
 	struct mutex read_lock;		/* read protection */
 	struct mutex queue_lock;	/* ISOC queue protection */
+	int usb_err;			/* USB error - protected by usb_lock */
 #ifdef CONFIG_PM
 	char frozen;			/* suspend - resume */
 #endif
@@ -189,11 +201,10 @@ int gspca_dev_probe(struct usb_interface *intf,
 		int dev_size,
 		struct module *module);
 void gspca_disconnect(struct usb_interface *intf);
-struct gspca_frame *gspca_frame_add(struct gspca_dev *gspca_dev,
-				    enum gspca_packet_type packet_type,
-				    struct gspca_frame *frame,
-				    const __u8 *data,
-				    int len);
+void gspca_frame_add(struct gspca_dev *gspca_dev,
+			enum gspca_packet_type packet_type,
+			const u8 *data,
+			int len);
 struct gspca_frame *gspca_get_i_frame(struct gspca_dev *gspca_dev);
 #ifdef CONFIG_PM
 int gspca_suspend(struct usb_interface *intf, pm_message_t message);
diff --git a/drivers/media/video/gspca/jeilinj.c b/drivers/media/video/gspca/jeilinj.c
index a11c97ebeb0f..2019b04f9235 100644
--- a/drivers/media/video/gspca/jeilinj.c
+++ b/drivers/media/video/gspca/jeilinj.c
@@ -181,11 +181,9 @@ static void jlj_dostream(struct work_struct *work)
 {
 	struct sd *dev = container_of(work, struct sd, work_struct);
 	struct gspca_dev *gspca_dev = &dev->gspca_dev;
-	struct gspca_frame *frame;
 	int blocks_left; /* 0x200-sized blocks remaining in current frame. */
 	int size_in_blocks;
 	int act_len;
-	int discarding = 0; /* true if we failed to get space for frame. */
 	int packet_type;
 	int ret;
 	u8 *buffer;
@@ -196,15 +194,6 @@ static void jlj_dostream(struct work_struct *work)
 		goto quit_stream;
 	}
 	while (gspca_dev->present && gspca_dev->streaming) {
-		if (!gspca_dev->present)
-			goto quit_stream;
-		/* Start a new frame, and add the JPEG header, first thing */
-		frame = gspca_get_i_frame(gspca_dev);
-		if (frame && !discarding)
-			gspca_frame_add(gspca_dev, FIRST_PACKET, frame,
-					dev->jpeg_hdr, JPEG_HDR_SZ);
-		 else
-			discarding = 1;
 		/*
 		 * Now request data block 0. Line 0 reports the size
 		 * to download, in blocks of size 0x200, and also tells the
@@ -222,14 +211,15 @@ static void jlj_dostream(struct work_struct *work)
 		size_in_blocks = buffer[0x0a];
 		blocks_left = buffer[0x0a] - 1;
 		PDEBUG(D_STREAM, "blocks_left = 0x%x", blocks_left);
-		packet_type = INTER_PACKET;
-		if (frame && !discarding)
-			/* Toss line 0 of data block 0, keep the rest. */
-			gspca_frame_add(gspca_dev, packet_type,
-				frame, buffer + FRAME_HEADER_LEN,
+
+		/* Start a new frame, and add the JPEG header, first thing */
+		gspca_frame_add(gspca_dev, FIRST_PACKET,
+				dev->jpeg_hdr, JPEG_HDR_SZ);
+		/* Toss line 0 of data block 0, keep the rest. */
+		gspca_frame_add(gspca_dev, INTER_PACKET,
+				buffer + FRAME_HEADER_LEN,
 				JEILINJ_MAX_TRANSFER - FRAME_HEADER_LEN);
-			else
-				discarding = 1;
+
 		while (blocks_left > 0) {
 			if (!gspca_dev->present)
 				goto quit_stream;
@@ -246,12 +236,8 @@ static void jlj_dostream(struct work_struct *work)
 				packet_type = LAST_PACKET;
 			else
 				packet_type = INTER_PACKET;
-			if (frame && !discarding)
-				gspca_frame_add(gspca_dev, packet_type,
-						frame, buffer,
-						JEILINJ_MAX_TRANSFER);
-			else
-				discarding = 1;
+			gspca_frame_add(gspca_dev, packet_type,
+					buffer, JEILINJ_MAX_TRANSFER);
 		}
 	}
 quit_stream:
diff --git a/drivers/media/video/gspca/m5602/m5602_core.c b/drivers/media/video/gspca/m5602/m5602_core.c
index 7f1e5415850b..4294c75e3b11 100644
--- a/drivers/media/video/gspca/m5602/m5602_core.c
+++ b/drivers/media/video/gspca/m5602/m5602_core.c
@@ -81,7 +81,7 @@ int m5602_write_bridge(struct sd *sd, const u8 address, const u8 i2c_data)
 	return (err < 0) ? err : 0;
 }
 
-int m5602_wait_for_i2c(struct sd *sd)
+static int m5602_wait_for_i2c(struct sd *sd)
 {
 	int err;
 	u8 data;
@@ -274,8 +274,7 @@ static int m5602_start_transfer(struct gspca_dev *gspca_dev)
 }
 
 static void m5602_urb_complete(struct gspca_dev *gspca_dev,
-			struct gspca_frame *frame,
-			__u8 *data, int len)
+				u8 *data, int len)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
 
@@ -295,19 +294,27 @@ static void m5602_urb_complete(struct gspca_dev *gspca_dev,
 		len -= 6;
 
 		/* Complete the last frame (if any) */
-		frame = gspca_frame_add(gspca_dev, LAST_PACKET,
-					frame, data, 0);
+		gspca_frame_add(gspca_dev, LAST_PACKET,
+				NULL, 0);
 		sd->frame_count++;
 
 		/* Create a new frame */
-		gspca_frame_add(gspca_dev, FIRST_PACKET, frame, data, len);
+		gspca_frame_add(gspca_dev, FIRST_PACKET, data, len);
 
 		PDEBUG(D_FRAM, "Starting new frame %d",
 		       sd->frame_count);
 
 	} else {
-		int cur_frame_len = frame->data_end - frame->data;
+		struct gspca_frame *frame;
+		int cur_frame_len;
 
+		frame = gspca_get_i_frame(gspca_dev);
+		if (frame == NULL) {
+			gspca_dev->last_packet_type = DISCARD_PACKET;
+			return;
+		}
+
+		cur_frame_len = frame->data_end - frame->data;
 		/* Remove urb header */
 		data += 4;
 		len -= 4;
@@ -316,12 +323,12 @@ static void m5602_urb_complete(struct gspca_dev *gspca_dev,
 			PDEBUG(D_FRAM, "Continuing frame %d copying %d bytes",
 			       sd->frame_count, len);
 
-			gspca_frame_add(gspca_dev, INTER_PACKET, frame,
+			gspca_frame_add(gspca_dev, INTER_PACKET,
 					data, len);
 		} else if (frame->v4l2_buf.length - cur_frame_len > 0) {
 			/* Add the remaining data up to frame size */
-			gspca_frame_add(gspca_dev, INTER_PACKET, frame, data,
-					frame->v4l2_buf.length - cur_frame_len);
+			gspca_frame_add(gspca_dev, INTER_PACKET, data,
+				    frame->v4l2_buf.length - cur_frame_len);
 		}
 	}
 }
@@ -381,7 +388,7 @@ static int m5602_probe(struct usb_interface *intf,
 			       THIS_MODULE);
 }
 
-void m5602_disconnect(struct usb_interface *intf)
+static void m5602_disconnect(struct usb_interface *intf)
 {
 	struct gspca_dev *gspca_dev = usb_get_intfdata(intf);
 	struct sd *sd = (struct sd *) gspca_dev;
diff --git a/drivers/media/video/gspca/m5602/m5602_ov9650.c b/drivers/media/video/gspca/m5602/m5602_ov9650.c
index c2739d6605a1..923cdd5f7a6b 100644
--- a/drivers/media/video/gspca/m5602/m5602_ov9650.c
+++ b/drivers/media/video/gspca/m5602/m5602_ov9650.c
@@ -439,7 +439,7 @@ int ov9650_start(struct sd *sd)
 			err = m5602_write_bridge(sd, res_init_ov9650[i][1],
 				res_init_ov9650[i][2]);
 		else if (res_init_ov9650[i][0] == SENSOR) {
-			u8 data = res_init_ov9650[i][2];
+			data = res_init_ov9650[i][2];
 			err = m5602_write_sensor(sd,
 				res_init_ov9650[i][1], &data, 1);
 		}
diff --git a/drivers/media/video/gspca/m5602/m5602_s5k4aa.c b/drivers/media/video/gspca/m5602/m5602_s5k4aa.c
index a27afeb6f39b..1b536f7d30cf 100644
--- a/drivers/media/video/gspca/m5602/m5602_s5k4aa.c
+++ b/drivers/media/video/gspca/m5602/m5602_s5k4aa.c
@@ -48,6 +48,12 @@ static
 			DMI_MATCH(DMI_PRODUCT_NAME, "AMILO Xa 2528")
 		}
 	}, {
+		.ident = "Fujitsu-Siemens Amilo Xi 2428",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "AMILO Xi 2428")
+		}
+	}, {
 		.ident = "Fujitsu-Siemens Amilo Xi 2528",
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
@@ -525,7 +531,10 @@ static int s5k4aa_set_vflip(struct gspca_dev *gspca_dev, __s32 val)
 	err = m5602_read_sensor(sd, S5K4AA_ROWSTART_LO, &data, 1);
 	if (err < 0)
 		return err;
-	data = (data & 0xfe) | !val;
+	if (val)
+		data &= 0xfe;
+	else
+		data |= 0x01;
 	err = m5602_write_sensor(sd, S5K4AA_ROWSTART_LO, &data, 1);
 	return err;
 }
@@ -570,7 +579,10 @@ static int s5k4aa_set_hflip(struct gspca_dev *gspca_dev, __s32 val)
 	err = m5602_read_sensor(sd, S5K4AA_COLSTART_LO, &data, 1);
 	if (err < 0)
 		return err;
-	data = (data & 0xfe) | !val;
+	if (val)
+		data &= 0xfe;
+	else
+		data |= 0x01;
 	err = m5602_write_sensor(sd, S5K4AA_COLSTART_LO, &data, 1);
 	return err;
 }
diff --git a/drivers/media/video/gspca/mars.c b/drivers/media/video/gspca/mars.c
index de769caf013d..9cf8d68c71bf 100644
--- a/drivers/media/video/gspca/mars.c
+++ b/drivers/media/video/gspca/mars.c
@@ -325,8 +325,7 @@ static void sd_stop0(struct gspca_dev *gspca_dev)
 }
 
 static void sd_pkt_scan(struct gspca_dev *gspca_dev,
-			struct gspca_frame *frame,	/* target */
-			__u8 *data,			/* isoc packet */
+			u8 *data,			/* isoc packet */
 			int len)			/* iso packet length */
 {
 	struct sd *sd = (struct sd *) gspca_dev;
@@ -348,11 +347,11 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
 			    || data[5 + p] == 0x67) {
 				PDEBUG(D_PACK, "sof offset: %d len: %d",
 					p, len);
-				frame = gspca_frame_add(gspca_dev, LAST_PACKET,
-							frame, data, p);
+				gspca_frame_add(gspca_dev, LAST_PACKET,
+						data, p);
 
 				/* put the JPEG header */
-				gspca_frame_add(gspca_dev, FIRST_PACKET, frame,
+				gspca_frame_add(gspca_dev, FIRST_PACKET,
 					sd->jpeg_hdr, JPEG_HDR_SZ);
 				data += p + 16;
 				len -= p + 16;
@@ -360,7 +359,7 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
 			}
 		}
 	}
-	gspca_frame_add(gspca_dev, INTER_PACKET, frame, data, len);
+	gspca_frame_add(gspca_dev, INTER_PACKET, data, len);
 }
 
 static int sd_setbrightness(struct gspca_dev *gspca_dev, __s32 val)
diff --git a/drivers/media/video/gspca/mr97310a.c b/drivers/media/video/gspca/mr97310a.c
index f8328b9efae5..9154870e07d2 100644
--- a/drivers/media/video/gspca/mr97310a.c
+++ b/drivers/media/video/gspca/mr97310a.c
@@ -1,23 +1,30 @@
 /*
  * Mars MR97310A library
  *
+ * The original mr97310a driver, which supported the Aiptek Pencam VGA+, is
  * Copyright (C) 2009 Kyle Guinn <elyk03@gmail.com>
  *
  * Support for the MR97310A cameras in addition to the Aiptek Pencam VGA+
  * and for the routines for detecting and classifying these various cameras,
+ * is Copyright (C) 2009 Theodore Kilgore <kilgota@auburn.edu>
  *
+ * Support for the control settings for the CIF cameras is
+ * Copyright (C) 2009 Hans de Goede <hdgoede@redhat.com> and
+ * Thomas Kaiser <thomas@kaiser-linux.li>
+ *
+ * Support for the control settings for the VGA cameras is
  * Copyright (C) 2009 Theodore Kilgore <kilgota@auburn.edu>
  *
- * Acknowledgements:
+ * Several previously unsupported cameras are owned and have been tested by
+ * Hans de Goede <hdgoede@redhat.com> and
+ * Thomas Kaiser <thomas@kaiser-linux.li> and
+ * Theodore Kilgore <kilgota@auburn.edu> and
+ * Edmond Rodriguez <erodrig_97@yahoo.com> and
+ * Aurelien Jacobs <aurel@gnuage.org>
  *
  * The MR97311A support in gspca/mars.c has been helpful in understanding some
  * of the registers in these cameras.
  *
- * Hans de Goede <hdgoede@redhat.com> and
- * Thomas Kaiser <thomas@kaiser-linux.li>
- * have assisted with their experience. Each of them has also helped by
- * testing a previously unsupported camera.
- *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 2 of the License, or
@@ -40,11 +47,9 @@
 #define CAM_TYPE_CIF			0
 #define CAM_TYPE_VGA			1
 
-#define MR97310A_BRIGHTNESS_MIN		-254
-#define MR97310A_BRIGHTNESS_MAX		255
 #define MR97310A_BRIGHTNESS_DEFAULT	0
 
-#define MR97310A_EXPOSURE_MIN		300
+#define MR97310A_EXPOSURE_MIN		0
 #define MR97310A_EXPOSURE_MAX		4095
 #define MR97310A_EXPOSURE_DEFAULT	1000
 
@@ -52,13 +57,17 @@
 #define MR97310A_GAIN_MAX		31
 #define MR97310A_GAIN_DEFAULT		25
 
+#define MR97310A_MIN_CLOCKDIV_MIN	3
+#define MR97310A_MIN_CLOCKDIV_MAX	8
+#define MR97310A_MIN_CLOCKDIV_DEFAULT	3
+
 MODULE_AUTHOR("Kyle Guinn <elyk03@gmail.com>,"
 	      "Theodore Kilgore <kilgota@auburn.edu>");
 MODULE_DESCRIPTION("GSPCA/Mars-Semi MR97310A USB Camera Driver");
 MODULE_LICENSE("GPL");
 
 /* global parameters */
-int force_sensor_type = -1;
+static int force_sensor_type = -1;
 module_param(force_sensor_type, int, 0644);
 MODULE_PARM_DESC(force_sensor_type, "Force sensor type (-1 (auto), 0 or 1)");
 
@@ -69,10 +78,12 @@ struct sd {
 	u8 cam_type;	/* 0 is CIF and 1 is VGA */
 	u8 sensor_type;	/* We use 0 and 1 here, too. */
 	u8 do_lcd_stop;
+	u8 adj_colors;
 
 	int brightness;
 	u16 exposure;
 	u8 gain;
+	u8 min_clockdiv;
 };
 
 struct sensor_w_data {
@@ -82,26 +93,31 @@ struct sensor_w_data {
 	int len;
 };
 
+static void sd_stopN(struct gspca_dev *gspca_dev);
 static int sd_setbrightness(struct gspca_dev *gspca_dev, __s32 val);
 static int sd_getbrightness(struct gspca_dev *gspca_dev, __s32 *val);
 static int sd_setexposure(struct gspca_dev *gspca_dev, __s32 val);
 static int sd_getexposure(struct gspca_dev *gspca_dev, __s32 *val);
 static int sd_setgain(struct gspca_dev *gspca_dev, __s32 val);
 static int sd_getgain(struct gspca_dev *gspca_dev, __s32 *val);
+static int sd_setmin_clockdiv(struct gspca_dev *gspca_dev, __s32 val);
+static int sd_getmin_clockdiv(struct gspca_dev *gspca_dev, __s32 *val);
 static void setbrightness(struct gspca_dev *gspca_dev);
 static void setexposure(struct gspca_dev *gspca_dev);
 static void setgain(struct gspca_dev *gspca_dev);
 
 /* V4L2 controls supported by the driver */
 static struct ctrl sd_ctrls[] = {
+/* Separate brightness control description for Argus QuickClix as it has
+   different limits from the other mr97310a cameras */
 	{
-#define BRIGHTNESS_IDX 0
+#define NORM_BRIGHTNESS_IDX 0
 		{
 			.id = V4L2_CID_BRIGHTNESS,
 			.type = V4L2_CTRL_TYPE_INTEGER,
 			.name = "Brightness",
-			.minimum = MR97310A_BRIGHTNESS_MIN,
-			.maximum = MR97310A_BRIGHTNESS_MAX,
+			.minimum = -254,
+			.maximum = 255,
 			.step = 1,
 			.default_value = MR97310A_BRIGHTNESS_DEFAULT,
 			.flags = 0,
@@ -110,7 +126,22 @@ static struct ctrl sd_ctrls[] = {
 		.get = sd_getbrightness,
 	},
 	{
-#define EXPOSURE_IDX 1
+#define ARGUS_QC_BRIGHTNESS_IDX 1
+		{
+			.id = V4L2_CID_BRIGHTNESS,
+			.type = V4L2_CTRL_TYPE_INTEGER,
+			.name = "Brightness",
+			.minimum = 0,
+			.maximum = 15,
+			.step = 1,
+			.default_value = MR97310A_BRIGHTNESS_DEFAULT,
+			.flags = 0,
+		},
+		.set = sd_setbrightness,
+		.get = sd_getbrightness,
+	},
+	{
+#define EXPOSURE_IDX 2
 		{
 			.id = V4L2_CID_EXPOSURE,
 			.type = V4L2_CTRL_TYPE_INTEGER,
@@ -125,7 +156,7 @@ static struct ctrl sd_ctrls[] = {
 		.get = sd_getexposure,
 	},
 	{
-#define GAIN_IDX 2
+#define GAIN_IDX 3
 		{
 			.id = V4L2_CID_GAIN,
 			.type = V4L2_CTRL_TYPE_INTEGER,
@@ -139,6 +170,21 @@ static struct ctrl sd_ctrls[] = {
 		.set = sd_setgain,
 		.get = sd_getgain,
 	},
+	{
+#define MIN_CLOCKDIV_IDX 4
+		{
+			.id = V4L2_CID_PRIVATE_BASE,
+			.type = V4L2_CTRL_TYPE_INTEGER,
+			.name = "Minimum Clock Divider",
+			.minimum = MR97310A_MIN_CLOCKDIV_MIN,
+			.maximum = MR97310A_MIN_CLOCKDIV_MAX,
+			.step = 1,
+			.default_value = MR97310A_MIN_CLOCKDIV_DEFAULT,
+			.flags = 0,
+		},
+		.set = sd_setmin_clockdiv,
+		.get = sd_getmin_clockdiv,
+	},
 };
 
 static const struct v4l2_pix_format vga_mode[] = {
@@ -230,12 +276,17 @@ static int sensor_write1(struct gspca_dev *gspca_dev, u8 reg, u8 data)
 	int rc;
 
 	buf = data;
-	rc = sensor_write_reg(gspca_dev, reg, 0x01, &buf, 1);
+	if (sd->cam_type == CAM_TYPE_CIF) {
+		rc = sensor_write_reg(gspca_dev, reg, 0x01, &buf, 1);
+		confirm_reg = sd->sensor_type ? 0x13 : 0x11;
+	} else {
+		rc = sensor_write_reg(gspca_dev, reg, 0x00, &buf, 1);
+		confirm_reg = 0x11;
+	}
 	if (rc < 0)
 		return rc;
 
 	buf = 0x01;
-	confirm_reg = sd->sensor_type ? 0x13 : 0x11;
 	rc = sensor_write_reg(gspca_dev, confirm_reg, 0x00, &buf, 1);
 	if (rc < 0)
 		return rc;
@@ -243,18 +294,26 @@ static int sensor_write1(struct gspca_dev *gspca_dev, u8 reg, u8 data)
 	return 0;
 }
 
-static int cam_get_response16(struct gspca_dev *gspca_dev)
+static int cam_get_response16(struct gspca_dev *gspca_dev, u8 reg, int verbose)
 {
-	__u8 *data = gspca_dev->usb_buf;
 	int err_code;
 
-	data[0] = 0x21;
+	gspca_dev->usb_buf[0] = reg;
 	err_code = mr_write(gspca_dev, 1);
 	if (err_code < 0)
 		return err_code;
 
 	err_code = mr_read(gspca_dev, 16);
-	return err_code;
+	if (err_code < 0)
+		return err_code;
+
+	if (verbose)
+		PDEBUG(D_PROBE, "Register: %02x reads %02x%02x%02x", reg,
+		       gspca_dev->usb_buf[0],
+		       gspca_dev->usb_buf[1],
+		       gspca_dev->usb_buf[2]);
+
+	return 0;
 }
 
 static int zero_the_pointer(struct gspca_dev *gspca_dev)
@@ -264,7 +323,7 @@ static int zero_the_pointer(struct gspca_dev *gspca_dev)
 	u8 status = 0;
 	int tries = 0;
 
-	err_code = cam_get_response16(gspca_dev);
+	err_code = cam_get_response16(gspca_dev, 0x21, 0);
 	if (err_code < 0)
 		return err_code;
 
@@ -275,7 +334,7 @@ static int zero_the_pointer(struct gspca_dev *gspca_dev)
 	if (err_code < 0)
 		return err_code;
 
-	err_code = cam_get_response16(gspca_dev);
+	err_code = cam_get_response16(gspca_dev, 0x21, 0);
 	if (err_code < 0)
 		return err_code;
 
@@ -285,7 +344,7 @@ static int zero_the_pointer(struct gspca_dev *gspca_dev)
 	if (err_code < 0)
 		return err_code;
 
-	err_code = cam_get_response16(gspca_dev);
+	err_code = cam_get_response16(gspca_dev, 0x21, 0);
 	if (err_code < 0)
 		return err_code;
 
@@ -295,7 +354,7 @@ static int zero_the_pointer(struct gspca_dev *gspca_dev)
 	if (err_code < 0)
 		return err_code;
 
-	err_code = cam_get_response16(gspca_dev);
+	err_code = cam_get_response16(gspca_dev, 0x21, 0);
 	if (err_code < 0)
 		return err_code;
 
@@ -306,7 +365,7 @@ static int zero_the_pointer(struct gspca_dev *gspca_dev)
 		return err_code;
 
 	while (status != 0x0a && tries < 256) {
-		err_code = cam_get_response16(gspca_dev);
+		err_code = cam_get_response16(gspca_dev, 0x21, 0);
 		status = data[0];
 		tries++;
 		if (err_code < 0)
@@ -323,7 +382,7 @@ static int zero_the_pointer(struct gspca_dev *gspca_dev)
 		if (err_code < 0)
 			return err_code;
 
-		err_code = cam_get_response16(gspca_dev);
+		err_code = cam_get_response16(gspca_dev, 0x21, 0);
 		status = data[0];
 		tries++;
 		if (err_code < 0)
@@ -342,89 +401,202 @@ static int zero_the_pointer(struct gspca_dev *gspca_dev)
 	return 0;
 }
 
-static u8 get_sensor_id(struct gspca_dev *gspca_dev)
+static int stream_start(struct gspca_dev *gspca_dev)
 {
-	int err_code;
-
-	gspca_dev->usb_buf[0] = 0x1e;
-	err_code = mr_write(gspca_dev, 1);
-	if (err_code < 0)
-		return err_code;
+	gspca_dev->usb_buf[0] = 0x01;
+	gspca_dev->usb_buf[1] = 0x01;
+	return mr_write(gspca_dev, 2);
+}
 
-	err_code = mr_read(gspca_dev, 16);
-	if (err_code < 0)
-		return err_code;
+static void stream_stop(struct gspca_dev *gspca_dev)
+{
+	gspca_dev->usb_buf[0] = 0x01;
+	gspca_dev->usb_buf[1] = 0x00;
+	if (mr_write(gspca_dev, 2) < 0)
+		PDEBUG(D_ERR, "Stream Stop failed");
+}
 
-	PDEBUG(D_PROBE, "Byte zero reported is %01x", gspca_dev->usb_buf[0]);
+static void lcd_stop(struct gspca_dev *gspca_dev)
+{
+	gspca_dev->usb_buf[0] = 0x19;
+	gspca_dev->usb_buf[1] = 0x54;
+	if (mr_write(gspca_dev, 2) < 0)
+		PDEBUG(D_ERR, "LCD Stop failed");
+}
 
-	return gspca_dev->usb_buf[0];
+static int isoc_enable(struct gspca_dev *gspca_dev)
+{
+	gspca_dev->usb_buf[0] = 0x00;
+	gspca_dev->usb_buf[1] = 0x4d;  /* ISOC transfering enable... */
+	return mr_write(gspca_dev, 2);
 }
 
-/* this function is called at probe time */
+/* This function is called at probe time */
 static int sd_config(struct gspca_dev *gspca_dev,
 		     const struct usb_device_id *id)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
 	struct cam *cam;
-	__u8 *data = gspca_dev->usb_buf;
 	int err_code;
 
 	cam = &gspca_dev->cam;
 	cam->cam_mode = vga_mode;
 	cam->nmodes = ARRAY_SIZE(vga_mode);
+	sd->do_lcd_stop = 0;
+
+	/* Several of the supported CIF cameras share the same USB ID but
+	 * require different initializations and different control settings.
+	 * The same is true of the VGA cameras. Therefore, we are forced
+	 * to start the initialization process in order to determine which
+	 * camera is present. Some of the supported cameras require the
+	 * memory pointer to be set to 0 as the very first item of business
+	 * or else they will not stream. So we do that immediately.
+	 */
+	err_code = zero_the_pointer(gspca_dev);
+	if (err_code < 0)
+		return err_code;
+
+	err_code = stream_start(gspca_dev);
+	if (err_code < 0)
+		return err_code;
 
-	if (id->idProduct == 0x010e) {
+	if (id->idProduct == 0x0110 || id->idProduct == 0x010e) {
 		sd->cam_type = CAM_TYPE_CIF;
 		cam->nmodes--;
-
-		data[0] = 0x01;
-		data[1] = 0x01;
-		err_code = mr_write(gspca_dev, 2);
+		err_code = cam_get_response16(gspca_dev, 0x06, 1);
 		if (err_code < 0)
 			return err_code;
-
-		msleep(200);
-		data[0] = get_sensor_id(gspca_dev);
 		/*
-		 * Known CIF cameras. If you have another to report, please do
+		 * All but one of the known CIF cameras share the same USB ID,
+		 * but two different init routines are in use, and the control
+		 * settings are different, too. We need to detect which camera
+		 * of the two known varieties is connected!
 		 *
-		 * Name			byte just read		sd->sensor_type
-		 *					reported by
-		 * Sakar Spy-shot	0x28		T. Kilgore	0
-		 * Innovage		0xf5 (unstable)	T. Kilgore	0
-		 * Vivitar Mini		0x53		H. De Goede	0
-		 * Vivitar Mini		0x04 / 0x24	E. Rodriguez	0
-		 * Vivitar Mini		0x08		T. Kilgore	1
-		 * Elta-Media 8212dc	0x23		T. Kaiser	1
-		 * Philips dig. keych.	0x37		T. Kilgore	1
+		 * A list of known CIF cameras follows. They all report either
+		 * 0002 for type 0 or 0003 for type 1.
+		 * If you have another to report, please do
+		 *
+		 * Name		sd->sensor_type		reported by
+		 *
+		 * Sakar Spy-shot	0		T. Kilgore
+		 * Innovage		0		T. Kilgore
+		 * Vivitar Mini		0		H. De Goede
+		 * Vivitar Mini		0		E. Rodriguez
+		 * Vivitar Mini		1		T. Kilgore
+		 * Elta-Media 8212dc	1		T. Kaiser
+		 * Philips dig. keych.	1		T. Kilgore
+		 * Trust Spyc@m 100	1		A. Jacobs
 		 */
-		if ((data[0] & 0x78) == 8 ||
-		    ((data[0] & 0x2) == 0x2 && data[0] != 0x53))
-			sd->sensor_type = 1;
-		else
+		switch (gspca_dev->usb_buf[1]) {
+		case 2:
 			sd->sensor_type = 0;
-
+			break;
+		case 3:
+			sd->sensor_type = 1;
+			break;
+		default:
+			PDEBUG(D_ERR, "Unknown CIF Sensor id : %02x",
+			       gspca_dev->usb_buf[1]);
+			return -ENODEV;
+		}
 		PDEBUG(D_PROBE, "MR97310A CIF camera detected, sensor: %d",
 		       sd->sensor_type);
+	} else {
+		sd->cam_type = CAM_TYPE_VGA;
 
-		if (force_sensor_type != -1) {
-			sd->sensor_type = !! force_sensor_type;
-			PDEBUG(D_PROBE, "Forcing sensor type to: %d",
-			       sd->sensor_type);
+		err_code = cam_get_response16(gspca_dev, 0x07, 1);
+		if (err_code < 0)
+			return err_code;
+
+		/*
+		 * Here is a table of the responses to the previous command
+		 * from the known MR97310A VGA cameras.
+		 *
+		 * Name			gspca_dev->usb_buf[]	sd->sensor_type
+		 *				sd->do_lcd_stop
+		 * Aiptek Pencam VGA+	0300		0		1
+		 * ION digital		0350		0		1
+		 * Argus DC-1620	0450		1		0
+		 * Argus QuickClix	0420		1		1
+		 *
+		 * Based upon these results, we assume default settings
+		 * and then correct as necessary, as follows.
+		 *
+		 */
+
+		sd->sensor_type = 1;
+		sd->do_lcd_stop = 0;
+		sd->adj_colors = 0;
+		if ((gspca_dev->usb_buf[0] != 0x03) &&
+					(gspca_dev->usb_buf[0] != 0x04)) {
+			PDEBUG(D_ERR, "Unknown VGA Sensor id Byte 0: %02x",
+					gspca_dev->usb_buf[1]);
+			PDEBUG(D_ERR, "Defaults assumed, may not work");
+			PDEBUG(D_ERR, "Please report this");
+		}
+		/* Sakar Digital color needs to be adjusted. */
+		if ((gspca_dev->usb_buf[0] == 0x03) &&
+					(gspca_dev->usb_buf[1] == 0x50))
+			sd->adj_colors = 1;
+		if (gspca_dev->usb_buf[0] == 0x04) {
+			sd->do_lcd_stop = 1;
+			switch (gspca_dev->usb_buf[1]) {
+			case 0x50:
+				sd->sensor_type = 0;
+				PDEBUG(D_PROBE, "sensor_type corrected to 0");
+				break;
+			case 0x20:
+				/* Nothing to do here. */
+				break;
+			default:
+				PDEBUG(D_ERR,
+					"Unknown VGA Sensor id Byte 1: %02x",
+					gspca_dev->usb_buf[1]);
+				PDEBUG(D_ERR,
+					"Defaults assumed, may not work");
+				PDEBUG(D_ERR, "Please report this");
+			}
 		}
+		PDEBUG(D_PROBE, "MR97310A VGA camera detected, sensor: %d",
+		       sd->sensor_type);
+	}
+	/* Stop streaming as we've started it to probe the sensor type. */
+	sd_stopN(gspca_dev);
+
+	if (force_sensor_type != -1) {
+		sd->sensor_type = !!force_sensor_type;
+		PDEBUG(D_PROBE, "Forcing sensor type to: %d",
+		       sd->sensor_type);
+	}
 
+	/* Setup controls depending on camera type */
+	if (sd->cam_type == CAM_TYPE_CIF) {
+		/* No brightness for sensor_type 0 */
 		if (sd->sensor_type == 0)
-			gspca_dev->ctrl_dis = (1 << BRIGHTNESS_IDX);
+			gspca_dev->ctrl_dis = (1 << NORM_BRIGHTNESS_IDX) |
+					      (1 << ARGUS_QC_BRIGHTNESS_IDX);
+		else
+			gspca_dev->ctrl_dis = (1 << ARGUS_QC_BRIGHTNESS_IDX) |
+					      (1 << MIN_CLOCKDIV_IDX);
 	} else {
-		sd->cam_type = CAM_TYPE_VGA;
-		PDEBUG(D_PROBE, "MR97310A VGA camera detected");
-		gspca_dev->ctrl_dis = (1 << BRIGHTNESS_IDX) |
-				      (1 << EXPOSURE_IDX) | (1 << GAIN_IDX);
+		/* All controls need to be disabled if VGA sensor_type is 0 */
+		if (sd->sensor_type == 0)
+			gspca_dev->ctrl_dis = (1 << NORM_BRIGHTNESS_IDX) |
+					      (1 << ARGUS_QC_BRIGHTNESS_IDX) |
+					      (1 << EXPOSURE_IDX) |
+					      (1 << GAIN_IDX) |
+					      (1 << MIN_CLOCKDIV_IDX);
+		else if (sd->do_lcd_stop)
+			/* Argus QuickClix has different brightness limits */
+			gspca_dev->ctrl_dis = (1 << NORM_BRIGHTNESS_IDX);
+		else
+			gspca_dev->ctrl_dis = (1 << ARGUS_QC_BRIGHTNESS_IDX);
 	}
 
 	sd->brightness = MR97310A_BRIGHTNESS_DEFAULT;
 	sd->exposure = MR97310A_EXPOSURE_DEFAULT;
 	sd->gain = MR97310A_GAIN_DEFAULT;
+	sd->min_clockdiv = MR97310A_MIN_CLOCKDIV_DEFAULT;
 
 	return 0;
 }
@@ -455,11 +627,6 @@ static int start_cif_cam(struct gspca_dev *gspca_dev)
 	};
 
 	/* Note: Some of the above descriptions guessed from MR97113A driver */
-	data[0] = 0x01;
-	data[1] = 0x01;
-	err_code = mr_write(gspca_dev, 2);
-	if (err_code < 0)
-		return err_code;
 
 	memcpy(data, startup_string, 11);
 	if (sd->sensor_type)
@@ -533,22 +700,7 @@ static int start_cif_cam(struct gspca_dev *gspca_dev)
 		err_code = sensor_write_regs(gspca_dev, cif_sensor1_init_data,
 					 ARRAY_SIZE(cif_sensor1_init_data));
 	}
-	if (err_code < 0)
-		return err_code;
-
-	setbrightness(gspca_dev);
-	setexposure(gspca_dev);
-	setgain(gspca_dev);
-
-	msleep(200);
-
-	data[0] = 0x00;
-	data[1] = 0x4d;  /* ISOC transfering enable... */
-	err_code = mr_write(gspca_dev, 2);
-	if (err_code < 0)
-		return err_code;
-
-	return 0;
+	return err_code;
 }
 
 static int start_vga_cam(struct gspca_dev *gspca_dev)
@@ -558,84 +710,8 @@ static int start_vga_cam(struct gspca_dev *gspca_dev)
 	int err_code;
 	const __u8 startup_string[] = {0x00, 0x0d, 0x01, 0x00, 0x00, 0x2b,
 				       0x00, 0x00, 0x00, 0x50, 0xc0};
-
 	/* What some of these mean is explained in start_cif_cam(), above */
-	sd->sof_read = 0;
-
-	/*
-	 * We have to know which camera we have, because the register writes
-	 * depend upon the camera. This test, run before we actually enter
-	 * the initialization routine, distinguishes most of the cameras, If
-	 * needed, another routine is done later, too.
-	 */
-	memset(data, 0, 16);
-	data[0] = 0x20;
-	err_code = mr_write(gspca_dev, 1);
-	if (err_code < 0)
-		return err_code;
-
-	err_code = mr_read(gspca_dev, 16);
-	if (err_code < 0)
-		return err_code;
-
-	PDEBUG(D_PROBE, "Byte reported is %02x", data[0]);
-
-	msleep(200);
-	/*
-	 * Known VGA cameras. If you have another to report, please do
-	 *
-	 * Name			byte just read		sd->sensor_type
-	 *				sd->do_lcd_stop
-	 * Aiptek Pencam VGA+	0x31		0	1
-	 * ION digital		0x31		0	1
-	 * Argus DC-1620	0x30		1	0
-	 * Argus QuickClix	0x30		1	1 (not caught here)
-	 */
-	sd->sensor_type = data[0] & 1;
-	sd->do_lcd_stop = (~data[0]) & 1;
-
-
-
-	/* Streaming setup begins here. */
-
-
-	data[0] = 0x01;
-	data[1] = 0x01;
-	err_code = mr_write(gspca_dev, 2);
-	if (err_code < 0)
-		return err_code;
 
-	/*
-	 * A second test can now resolve any remaining ambiguity in the
-	 * identification of the camera type,
-	 */
-	if (!sd->sensor_type) {
-		data[0] = get_sensor_id(gspca_dev);
-		if (data[0] == 0x7f) {
-			sd->sensor_type = 1;
-			PDEBUG(D_PROBE, "sensor_type corrected to 1");
-		}
-		msleep(200);
-	}
-
-	if (force_sensor_type != -1) {
-		sd->sensor_type = !! force_sensor_type;
-		PDEBUG(D_PROBE, "Forcing sensor type to: %d",
-		       sd->sensor_type);
-	}
-
-	/*
-	 * Known VGA cameras.
-	 * This test is only run if the previous test returned 0x30, but
-	 * here is the information for all others, too, just for reference.
-	 *
-	 * Name			byte just read		sd->sensor_type
-	 *
-	 * Aiptek Pencam VGA+	0xfb	(this test not run)	1
-	 * ION digital		0xbd	(this test not run)	1
-	 * Argus DC-1620	0xe5	(no change)		0
-	 * Argus QuickClix	0x7f	(reclassified)		1
-	 */
 	memcpy(data, startup_string, 11);
 	if (!sd->sensor_type) {
 		data[5]  = 0x00;
@@ -689,29 +765,44 @@ static int start_vga_cam(struct gspca_dev *gspca_dev)
 		err_code = sensor_write_regs(gspca_dev, vga_sensor0_init_data,
 					 ARRAY_SIZE(vga_sensor0_init_data));
 	} else {	/* sd->sensor_type = 1 */
-		const struct sensor_w_data vga_sensor1_init_data[] = {
+		const struct sensor_w_data color_adj[] = {
 			{0x02, 0x00, {0x06, 0x59, 0x0c, 0x16, 0x00,
-				0x07, 0x00, 0x01}, 8},
+				/* adjusted blue, green, red gain correct
+				   too much blue from the Sakar Digital */
+				0x05, 0x01, 0x04}, 8}
+		};
+
+		const struct sensor_w_data color_no_adj[] = {
+			{0x02, 0x00, {0x06, 0x59, 0x0c, 0x16, 0x00,
+				/* default blue, green, red gain settings */
+				0x07, 0x00, 0x01}, 8}
+		};
+
+		const struct sensor_w_data vga_sensor1_init_data[] = {
 			{0x11, 0x04, {0x01}, 1},
-			/*{0x0a, 0x00, {0x00, 0x01, 0x00, 0x00, 0x01, */
-			{0x0a, 0x00, {0x01, 0x06, 0x00, 0x00, 0x01,
+			{0x0a, 0x00, {0x00, 0x01, 0x00, 0x00, 0x01,
+			/* These settings may be better for some cameras */
+			/* {0x0a, 0x00, {0x01, 0x06, 0x00, 0x00, 0x01, */
 				0x00, 0x0a}, 7},
 			{0x11, 0x04, {0x01}, 1},
 			{0x12, 0x00, {0x00, 0x63, 0x00, 0x70, 0x00, 0x00}, 6},
 			{0x11, 0x04, {0x01}, 1},
 			{0, 0, {0}, 0}
 		};
+
+		if (sd->adj_colors)
+			err_code = sensor_write_regs(gspca_dev, color_adj,
+					 ARRAY_SIZE(color_adj));
+		else
+			err_code = sensor_write_regs(gspca_dev, color_no_adj,
+					 ARRAY_SIZE(color_no_adj));
+
+		if (err_code < 0)
+			return err_code;
+
 		err_code = sensor_write_regs(gspca_dev, vga_sensor1_init_data,
 					 ARRAY_SIZE(vga_sensor1_init_data));
 	}
-	if (err_code < 0)
-		return err_code;
-
-	msleep(200);
-	data[0] = 0x00;
-	data[1] = 0x4d;  /* ISOC transfering enable... */
-	err_code = mr_write(gspca_dev, 2);
-
 	return err_code;
 }
 
@@ -719,97 +810,120 @@ static int sd_start(struct gspca_dev *gspca_dev)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
 	int err_code;
-	struct cam *cam;
 
-	cam = &gspca_dev->cam;
 	sd->sof_read = 0;
-	/*
-	 * Some of the supported cameras require the memory pointer to be
-	 * set to 0, or else they will not stream.
-	 */
-	zero_the_pointer(gspca_dev);
-	msleep(200);
+
+	/* Some of the VGA cameras require the memory pointer
+	 * to be set to 0 again. We have been forced to start the
+	 * stream in sd_config() to detect the hardware, and closed it.
+	 * Thus, we need here to do a completely fresh and clean start. */
+	err_code = zero_the_pointer(gspca_dev);
+	if (err_code < 0)
+		return err_code;
+
+	err_code = stream_start(gspca_dev);
+	if (err_code < 0)
+		return err_code;
+
 	if (sd->cam_type == CAM_TYPE_CIF) {
 		err_code = start_cif_cam(gspca_dev);
 	} else {
 		err_code = start_vga_cam(gspca_dev);
 	}
-	return err_code;
+	if (err_code < 0)
+		return err_code;
+
+	setbrightness(gspca_dev);
+	setexposure(gspca_dev);
+	setgain(gspca_dev);
+
+	return isoc_enable(gspca_dev);
 }
 
 static void sd_stopN(struct gspca_dev *gspca_dev)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
-	int result;
-
-	gspca_dev->usb_buf[0] = 1;
-	gspca_dev->usb_buf[1] = 0;
-	result = mr_write(gspca_dev, 2);
-	if (result < 0)
-		PDEBUG(D_ERR, "Camera Stop failed");
 
+	stream_stop(gspca_dev);
 	/* Not all the cams need this, but even if not, probably a good idea */
 	zero_the_pointer(gspca_dev);
-	if (sd->do_lcd_stop) {
-		gspca_dev->usb_buf[0] = 0x19;
-		gspca_dev->usb_buf[1] = 0x54;
-		result = mr_write(gspca_dev, 2);
-		if (result < 0)
-			PDEBUG(D_ERR, "Camera Stop failed");
-	}
+	if (sd->do_lcd_stop)
+		lcd_stop(gspca_dev);
 }
 
 static void setbrightness(struct gspca_dev *gspca_dev)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
 	u8 val;
-
-	if (gspca_dev->ctrl_dis & (1 << BRIGHTNESS_IDX))
+	u8 sign_reg = 7;  /* This reg and the next one used on CIF cams. */
+	u8 value_reg = 8; /* VGA cams seem to use regs 0x0b and 0x0c */
+	const u8 quick_clix_table[] =
+	/*	  0  1  2   3  4  5  6  7  8  9  10  11  12  13  14  15 */
+		{ 0, 4, 8, 12, 1, 2, 3, 5, 6, 9,  7, 10, 13, 11, 14, 15};
+	/*
+	 * This control is disabled for CIF type 1 and VGA type 0 cameras.
+	 * It does not quite act linearly for the Argus QuickClix camera,
+	 * but it does control brightness. The values are 0 - 15 only, and
+	 * the table above makes them act consecutively.
+	 */
+	if ((gspca_dev->ctrl_dis & (1 << NORM_BRIGHTNESS_IDX)) &&
+	    (gspca_dev->ctrl_dis & (1 << ARGUS_QC_BRIGHTNESS_IDX)))
 		return;
 
-	/* Note register 7 is also seen as 0x8x or 0xCx in dumps */
+	if (sd->cam_type == CAM_TYPE_VGA) {
+		sign_reg += 4;
+		value_reg += 4;
+	}
+
+	/* Note register 7 is also seen as 0x8x or 0xCx in some dumps */
 	if (sd->brightness > 0) {
-		sensor_write1(gspca_dev, 7, 0x00);
+		sensor_write1(gspca_dev, sign_reg, 0x00);
 		val = sd->brightness;
 	} else {
-		sensor_write1(gspca_dev, 7, 0x01);
-		val = 257 - sd->brightness;
+		sensor_write1(gspca_dev, sign_reg, 0x01);
+		val = (257 - sd->brightness);
 	}
-	sensor_write1(gspca_dev, 8, val);
+	/* Use lookup table for funky Argus QuickClix brightness */
+	if (sd->do_lcd_stop)
+		val = quick_clix_table[val];
+
+	sensor_write1(gspca_dev, value_reg, val);
 }
 
 static void setexposure(struct gspca_dev *gspca_dev)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
-	u8 val;
+	int exposure;
+	u8 buf[2];
 
 	if (gspca_dev->ctrl_dis & (1 << EXPOSURE_IDX))
 		return;
 
-	if (sd->sensor_type) {
-		val = sd->exposure >> 4;
-		sensor_write1(gspca_dev, 3, val);
-		val = sd->exposure & 0xf;
-		sensor_write1(gspca_dev, 4, val);
+	if (sd->cam_type == CAM_TYPE_CIF && sd->sensor_type == 1) {
+		/* This cam does not like exposure settings < 300,
+		   so scale 0 - 4095 to 300 - 4095 */
+		exposure = (sd->exposure * 9267) / 10000 + 300;
+		sensor_write1(gspca_dev, 3, exposure >> 4);
+		sensor_write1(gspca_dev, 4, exposure & 0x0f);
 	} else {
-		u8 clockdiv;
-		int exposure;
-
 		/* We have both a clock divider and an exposure register.
 		   We first calculate the clock divider, as that determines
-		   the maximum exposure and then we calculayte the exposure
+		   the maximum exposure and then we calculate the exposure
 		   register setting (which goes from 0 - 511).
 
 		   Note our 0 - 4095 exposure is mapped to 0 - 511
 		   milliseconds exposure time */
-		clockdiv = (60 * sd->exposure + 7999) / 8000;
+		u8 clockdiv = (60 * sd->exposure + 7999) / 8000;
 
 		/* Limit framerate to not exceed usb bandwidth */
-		if (clockdiv < 3 && gspca_dev->width >= 320)
-			clockdiv = 3;
+		if (clockdiv < sd->min_clockdiv && gspca_dev->width >= 320)
+			clockdiv = sd->min_clockdiv;
 		else if (clockdiv < 2)
 			clockdiv = 2;
 
+		if (sd->cam_type == CAM_TYPE_VGA && clockdiv < 4)
+			clockdiv = 4;
+
 		/* Frame exposure time in ms = 1000 * clockdiv / 60 ->
 		exposure = (sd->exposure / 8) * 511 / (1000 * clockdiv / 60) */
 		exposure = (60 * 511 * sd->exposure) / (8000 * clockdiv);
@@ -819,9 +933,10 @@ static void setexposure(struct gspca_dev *gspca_dev)
 		/* exposure register value is reversed! */
 		exposure = 511 - exposure;
 
+		buf[0] = exposure & 0xff;
+		buf[1] = exposure >> 8;
+		sensor_write_reg(gspca_dev, 0x0e, 0, buf, 2);
 		sensor_write1(gspca_dev, 0x02, clockdiv);
-		sensor_write1(gspca_dev, 0x0e, exposure & 0xff);
-		sensor_write1(gspca_dev, 0x0f, exposure >> 8);
 	}
 }
 
@@ -832,7 +947,7 @@ static void setgain(struct gspca_dev *gspca_dev)
 	if (gspca_dev->ctrl_dis & (1 << GAIN_IDX))
 		return;
 
-	if (sd->sensor_type) {
+	if (sd->cam_type == CAM_TYPE_CIF && sd->sensor_type == 1) {
 		sensor_write1(gspca_dev, 0x0e, sd->gain);
 	} else {
 		sensor_write1(gspca_dev, 0x10, sd->gain);
@@ -893,17 +1008,35 @@ static int sd_getgain(struct gspca_dev *gspca_dev, __s32 *val)
 	return 0;
 }
 
+static int sd_setmin_clockdiv(struct gspca_dev *gspca_dev, __s32 val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	sd->min_clockdiv = val;
+	if (gspca_dev->streaming)
+		setexposure(gspca_dev);
+	return 0;
+}
+
+static int sd_getmin_clockdiv(struct gspca_dev *gspca_dev, __s32 *val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	*val = sd->min_clockdiv;
+	return 0;
+}
+
 /* Include pac common sof detection functions */
 #include "pac_common.h"
 
 static void sd_pkt_scan(struct gspca_dev *gspca_dev,
-			struct gspca_frame *frame,    /* target */
-			__u8 *data,                   /* isoc packet */
-			int len)                      /* iso packet length */
+			u8 *data,		/* isoc packet */
+			int len)		/* iso packet length */
 {
+	struct sd *sd = (struct sd *) gspca_dev;
 	unsigned char *sof;
 
-	sof = pac_find_sof(gspca_dev, data, len);
+	sof = pac_find_sof(&sd->sof_read, data, len);
 	if (sof) {
 		int n;
 
@@ -913,15 +1046,15 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
 			n -= sizeof pac_sof_marker;
 		else
 			n = 0;
-		frame = gspca_frame_add(gspca_dev, LAST_PACKET, frame,
+		gspca_frame_add(gspca_dev, LAST_PACKET,
 					data, n);
 		/* Start next frame. */
-		gspca_frame_add(gspca_dev, FIRST_PACKET, frame,
+		gspca_frame_add(gspca_dev, FIRST_PACKET,
 			pac_sof_marker, sizeof pac_sof_marker);
 		len -= sof - data;
 		data = sof;
 	}
-	gspca_frame_add(gspca_dev, INTER_PACKET, frame, data, len);
+	gspca_frame_add(gspca_dev, INTER_PACKET, data, len);
 }
 
 /* sub-driver description */
@@ -938,6 +1071,7 @@ static const struct sd_desc sd_desc = {
 
 /* -- module initialisation -- */
 static const __devinitdata struct usb_device_id device_table[] = {
+	{USB_DEVICE(0x08ca, 0x0110)},	/* Trust Spyc@m 100 */
 	{USB_DEVICE(0x08ca, 0x0111)},	/* Aiptek Pencam VGA+ */
 	{USB_DEVICE(0x093a, 0x010f)},	/* All other known MR97310A VGA cams */
 	{USB_DEVICE(0x093a, 0x010e)},	/* All known MR97310A CIF cams */
diff --git a/drivers/media/video/gspca/ov519.c b/drivers/media/video/gspca/ov519.c
index a5c190e93799..b4f965731244 100644
--- a/drivers/media/video/gspca/ov519.c
+++ b/drivers/media/video/gspca/ov519.c
@@ -2,14 +2,19 @@
  * OV519 driver
  *
  * Copyright (C) 2008 Jean-Francois Moine (http://moinejf.free.fr)
+ * Copyright (C) 2009 Hans de Goede <hdegoede@redhat.com>
  *
  * This module is adapted from the ov51x-jpeg package, which itself
  * was adapted from the ov511 driver.
  *
  * Original copyright for the ov511 driver is:
  *
- * Copyright (c) 1999-2004 Mark W. McClelland
+ * Copyright (c) 1999-2006 Mark W. McClelland
  * Support for OV519, OV8610 Copyright (c) 2003 Joerg Heckenbach
+ * Many improvements by Bret Wallach <bwallac1@san.rr.com>
+ * Color fixes by by Orion Sky Lawlor <olawlor@acm.org> (2/26/2000)
+ * OV7620 fixes by Charl P. Botha <cpbotha@ieee.org>
+ * Changes by Claudio Matsuoka <claudio@conectiva.com>
  *
  * ov51x-jpeg original copyright is:
  *
@@ -58,6 +63,8 @@ struct sd {
 #define BRIDGE_OV518		2
 #define BRIDGE_OV518PLUS	3
 #define BRIDGE_OV519		4
+#define BRIDGE_OVFX2		5
+#define BRIDGE_W9968CF		6
 #define BRIDGE_MASK		7
 
 	char invert_led;
@@ -73,6 +80,10 @@ struct sd {
 	__u8 vflip;
 	__u8 autobrightness;
 	__u8 freq;
+	__u8 quality;
+#define QUALITY_MIN 50
+#define QUALITY_MAX 70
+#define QUALITY_DEF 50
 
 	__u8 stopped;		/* Streaming is temporarily paused */
 
@@ -81,17 +92,31 @@ struct sd {
 
 	char sensor;		/* Type of image sensor chip (SEN_*) */
 #define SEN_UNKNOWN 0
-#define SEN_OV6620 1
-#define SEN_OV6630 2
-#define SEN_OV66308AF 3
-#define SEN_OV7610 4
-#define SEN_OV7620 5
-#define SEN_OV7640 6
-#define SEN_OV7670 7
-#define SEN_OV76BE 8
-#define SEN_OV8610 9
+#define SEN_OV2610 1
+#define SEN_OV3610 2
+#define SEN_OV6620 3
+#define SEN_OV6630 4
+#define SEN_OV66308AF 5
+#define SEN_OV7610 6
+#define SEN_OV7620 7
+#define SEN_OV7640 8
+#define SEN_OV7670 9
+#define SEN_OV76BE 10
+#define SEN_OV8610 11
+
+	u8 sensor_addr;
+	int sensor_width;
+	int sensor_height;
+	int sensor_reg_cache[256];
+
+	u8 *jpeg_hdr;
 };
 
+/* Note this is a bit of a hack, but the w9968cf driver needs the code for all
+   the ov sensors which is already present here. When we have the time we
+   really should move the sensor drivers to v4l2 sub drivers. */
+#include "w996Xcf.c"
+
 /* V4L2 controls supported by the driver */
 static int sd_setbrightness(struct gspca_dev *gspca_dev, __s32 val);
 static int sd_getbrightness(struct gspca_dev *gspca_dev, __s32 *val);
@@ -345,6 +370,75 @@ static const struct v4l2_pix_format ov511_sif_mode[] = {
 		.priv = 0},
 };
 
+static const struct v4l2_pix_format ovfx2_vga_mode[] = {
+	{320, 240, V4L2_PIX_FMT_SBGGR8, V4L2_FIELD_NONE,
+		.bytesperline = 320,
+		.sizeimage = 320 * 240,
+		.colorspace = V4L2_COLORSPACE_SRGB,
+		.priv = 1},
+	{640, 480, V4L2_PIX_FMT_SBGGR8, V4L2_FIELD_NONE,
+		.bytesperline = 640,
+		.sizeimage = 640 * 480,
+		.colorspace = V4L2_COLORSPACE_SRGB,
+		.priv = 0},
+};
+static const struct v4l2_pix_format ovfx2_cif_mode[] = {
+	{160, 120, V4L2_PIX_FMT_SBGGR8, V4L2_FIELD_NONE,
+		.bytesperline = 160,
+		.sizeimage = 160 * 120,
+		.colorspace = V4L2_COLORSPACE_SRGB,
+		.priv = 3},
+	{176, 144, V4L2_PIX_FMT_SBGGR8, V4L2_FIELD_NONE,
+		.bytesperline = 176,
+		.sizeimage = 176 * 144,
+		.colorspace = V4L2_COLORSPACE_SRGB,
+		.priv = 1},
+	{320, 240, V4L2_PIX_FMT_SBGGR8, V4L2_FIELD_NONE,
+		.bytesperline = 320,
+		.sizeimage = 320 * 240,
+		.colorspace = V4L2_COLORSPACE_SRGB,
+		.priv = 2},
+	{352, 288, V4L2_PIX_FMT_SBGGR8, V4L2_FIELD_NONE,
+		.bytesperline = 352,
+		.sizeimage = 352 * 288,
+		.colorspace = V4L2_COLORSPACE_SRGB,
+		.priv = 0},
+};
+static const struct v4l2_pix_format ovfx2_ov2610_mode[] = {
+	{1600, 1200, V4L2_PIX_FMT_SBGGR8, V4L2_FIELD_NONE,
+		.bytesperline = 1600,
+		.sizeimage = 1600 * 1200,
+		.colorspace = V4L2_COLORSPACE_SRGB},
+};
+static const struct v4l2_pix_format ovfx2_ov3610_mode[] = {
+	{640, 480, V4L2_PIX_FMT_SBGGR8, V4L2_FIELD_NONE,
+		.bytesperline = 640,
+		.sizeimage = 640 * 480,
+		.colorspace = V4L2_COLORSPACE_SRGB,
+		.priv = 1},
+	{800, 600, V4L2_PIX_FMT_SBGGR8, V4L2_FIELD_NONE,
+		.bytesperline = 800,
+		.sizeimage = 800 * 600,
+		.colorspace = V4L2_COLORSPACE_SRGB,
+		.priv = 1},
+	{1024, 768, V4L2_PIX_FMT_SBGGR8, V4L2_FIELD_NONE,
+		.bytesperline = 1024,
+		.sizeimage = 1024 * 768,
+		.colorspace = V4L2_COLORSPACE_SRGB,
+		.priv = 1},
+	{1600, 1200, V4L2_PIX_FMT_SBGGR8, V4L2_FIELD_NONE,
+		.bytesperline = 1600,
+		.sizeimage = 1600 * 1200,
+		.colorspace = V4L2_COLORSPACE_SRGB,
+		.priv = 0},
+	{2048, 1536, V4L2_PIX_FMT_SBGGR8, V4L2_FIELD_NONE,
+		.bytesperline = 2048,
+		.sizeimage = 2048 * 1536,
+		.colorspace = V4L2_COLORSPACE_SRGB,
+		.priv = 0},
+};
+
+
 /* Registers common to OV511 / OV518 */
 #define R51x_FIFO_PSIZE			0x30	/* 2 bytes wide w/ OV518(+) */
 #define R51x_SYS_RESET          	0x50
@@ -406,6 +500,30 @@ static const struct v4l2_pix_format ov511_sif_mode[] = {
 
 #define OV511_ENDPOINT_ADDRESS  1	/* Isoc endpoint number */
 
+/*
+ * The FX2 chip does not give us a zero length read at end of frame.
+ * It does, however, give a short read at the end of a frame, if
+ * neccessary, rather than run two frames together.
+ *
+ * By choosing the right bulk transfer size, we are guaranteed to always
+ * get a short read for the last read of each frame.  Frame sizes are
+ * always a composite number (width * height, or a multiple) so if we
+ * choose a prime number, we are guaranteed that the last read of a
+ * frame will be short.
+ *
+ * But it isn't that easy: the 2.6 kernel requires a multiple of 4KB,
+ * otherwise EOVERFLOW "babbling" errors occur.  I have not been able
+ * to figure out why.  [PMiller]
+ *
+ * The constant (13 * 4096) is the largest "prime enough" number less than 64KB.
+ *
+ * It isn't enough to know the number of bytes per frame, in case we
+ * have data dropouts or buffer overruns (even though the FX2 double
+ * buffers, there are some pretty strict real time constraints for
+ * isochronous transfer for larger frame sizes).
+ */
+#define OVFX2_BULK_SIZE (13 * 4096)
+
 /* I2C registers */
 #define R51x_I2C_W_SID		0x41
 #define R51x_I2C_SADDR_3	0x42
@@ -413,9 +531,11 @@ static const struct v4l2_pix_format ov511_sif_mode[] = {
 #define R51x_I2C_R_SID		0x44
 #define R51x_I2C_DATA		0x45
 #define R518_I2C_CTL		0x47	/* OV518(+) only */
+#define OVFX2_I2C_ADDR		0x00
 
 /* I2C ADDRESSES */
 #define OV7xx0_SID   0x42
+#define OV_HIRES_SID 0x60		/* OV9xxx / OV2xxx / OV3xxx */
 #define OV8xx0_SID   0xa0
 #define OV6xx0_SID   0xc0
 
@@ -508,6 +628,696 @@ struct ov_i2c_regvals {
 	__u8 val;
 };
 
+/* Settings for OV2610 camera chip */
+static const struct ov_i2c_regvals norm_2610[] =
+{
+	{ 0x12, 0x80 },	/* reset */
+};
+
+static const struct ov_i2c_regvals norm_3620b[] =
+{
+	/*
+	 * From the datasheet: "Note that after writing to register COMH
+	 * (0x12) to change the sensor mode, registers related to the
+	 * sensor’s cropping window will be reset back to their default
+	 * values."
+	 *
+	 * "wait 4096 external clock ... to make sure the sensor is
+	 * stable and ready to access registers" i.e. 160us at 24MHz
+	 */
+
+	{ 0x12, 0x80 }, /* COMH reset */
+	{ 0x12, 0x00 }, /* QXGA, master */
+
+	/*
+	 * 11 CLKRC "Clock Rate Control"
+	 * [7] internal frequency doublers: on
+	 * [6] video port mode: master
+	 * [5:0] clock divider: 1
+	 */
+	{ 0x11, 0x80 },
+
+	/*
+	 * 13 COMI "Common Control I"
+	 *                  = 192 (0xC0) 11000000
+	 *    COMI[7] "AEC speed selection"
+	 *                  =   1 (0x01) 1....... "Faster AEC correction"
+	 *    COMI[6] "AEC speed step selection"
+	 *                  =   1 (0x01) .1...... "Big steps, fast"
+	 *    COMI[5] "Banding filter on off"
+	 *                  =   0 (0x00) ..0..... "Off"
+	 *    COMI[4] "Banding filter option"
+	 *                  =   0 (0x00) ...0.... "Main clock is 48 MHz and
+	 *                                         the PLL is ON"
+	 *    COMI[3] "Reserved"
+	 *                  =   0 (0x00) ....0...
+	 *    COMI[2] "AGC auto manual control selection"
+	 *                  =   0 (0x00) .....0.. "Manual"
+	 *    COMI[1] "AWB auto manual control selection"
+	 *                  =   0 (0x00) ......0. "Manual"
+	 *    COMI[0] "Exposure control"
+	 *                  =   0 (0x00) .......0 "Manual"
+	 */
+	{ 0x13, 0xC0 },
+
+	/*
+	 * 09 COMC "Common Control C"
+	 *                  =   8 (0x08) 00001000
+	 *    COMC[7:5] "Reserved"
+	 *                  =   0 (0x00) 000.....
+	 *    COMC[4] "Sleep Mode Enable"
+	 *                  =   0 (0x00) ...0.... "Normal mode"
+	 *    COMC[3:2] "Sensor sampling reset timing selection"
+	 *                  =   2 (0x02) ....10.. "Longer reset time"
+	 *    COMC[1:0] "Output drive current select"
+	 *                  =   0 (0x00) ......00 "Weakest"
+	 */
+	{ 0x09, 0x08 },
+
+	/*
+	 * 0C COMD "Common Control D"
+	 *                  =   8 (0x08) 00001000
+	 *    COMD[7] "Reserved"
+	 *                  =   0 (0x00) 0.......
+	 *    COMD[6] "Swap MSB and LSB at the output port"
+	 *                  =   0 (0x00) .0...... "False"
+	 *    COMD[5:3] "Reserved"
+	 *                  =   1 (0x01) ..001...
+	 *    COMD[2] "Output Average On Off"
+	 *                  =   0 (0x00) .....0.. "Output Normal"
+	 *    COMD[1] "Sensor precharge voltage selection"
+	 *                  =   0 (0x00) ......0. "Selects internal
+	 *                                         reference precharge
+	 *                                         voltage"
+	 *    COMD[0] "Snapshot option"
+	 *                  =   0 (0x00) .......0 "Enable live video output
+	 *                                         after snapshot sequence"
+	 */
+	{ 0x0c, 0x08 },
+
+	/*
+	 * 0D COME "Common Control E"
+	 *                  = 161 (0xA1) 10100001
+	 *    COME[7] "Output average option"
+	 *                  =   1 (0x01) 1....... "Output average of 4 pixels"
+	 *    COME[6] "Anti-blooming control"
+	 *                  =   0 (0x00) .0...... "Off"
+	 *    COME[5:3] "Reserved"
+	 *                  =   4 (0x04) ..100...
+	 *    COME[2] "Clock output power down pin status"
+	 *                  =   0 (0x00) .....0.. "Tri-state data output pin
+	 *                                         on power down"
+	 *    COME[1] "Data output pin status selection at power down"
+	 *                  =   0 (0x00) ......0. "Tri-state VSYNC, PCLK,
+	 *                                         HREF, and CHSYNC pins on
+	 *                                         power down"
+	 *    COME[0] "Auto zero circuit select"
+	 *                  =   1 (0x01) .......1 "On"
+	 */
+	{ 0x0d, 0xA1 },
+
+	/*
+	 * 0E COMF "Common Control F"
+	 *                  = 112 (0x70) 01110000
+	 *    COMF[7] "System clock selection"
+	 *                  =   0 (0x00) 0....... "Use 24 MHz system clock"
+	 *    COMF[6:4] "Reserved"
+	 *                  =   7 (0x07) .111....
+	 *    COMF[3] "Manual auto negative offset canceling selection"
+	 *                  =   0 (0x00) ....0... "Auto detect negative
+	 *                                         offset and cancel it"
+	 *    COMF[2:0] "Reserved"
+	 *                  =   0 (0x00) .....000
+	 */
+	{ 0x0e, 0x70 },
+
+	/*
+	 * 0F COMG "Common Control G"
+	 *                  =  66 (0x42) 01000010
+	 *    COMG[7] "Optical black output selection"
+	 *                  =   0 (0x00) 0....... "Disable"
+	 *    COMG[6] "Black level calibrate selection"
+	 *                  =   1 (0x01) .1...... "Use optical black pixels
+	 *                                         to calibrate"
+	 *    COMG[5:4] "Reserved"
+	 *                  =   0 (0x00) ..00....
+	 *    COMG[3] "Channel offset adjustment"
+	 *                  =   0 (0x00) ....0... "Disable offset adjustment"
+	 *    COMG[2] "ADC black level calibration option"
+	 *                  =   0 (0x00) .....0.. "Use B/G line and G/R
+	 *                                         line to calibrate each
+	 *                                         channel's black level"
+	 *    COMG[1] "Reserved"
+	 *                  =   1 (0x01) ......1.
+	 *    COMG[0] "ADC black level calibration enable"
+	 *                  =   0 (0x00) .......0 "Disable"
+	 */
+	{ 0x0f, 0x42 },
+
+	/*
+	 * 14 COMJ "Common Control J"
+	 *                  = 198 (0xC6) 11000110
+	 *    COMJ[7:6] "AGC gain ceiling"
+	 *                  =   3 (0x03) 11...... "8x"
+	 *    COMJ[5:4] "Reserved"
+	 *                  =   0 (0x00) ..00....
+	 *    COMJ[3] "Auto banding filter"
+	 *                  =   0 (0x00) ....0... "Banding filter is always
+	 *                                         on off depending on
+	 *                                         COMI[5] setting"
+	 *    COMJ[2] "VSYNC drop option"
+	 *                  =   1 (0x01) .....1.. "SYNC is dropped if frame
+	 *                                         data is dropped"
+	 *    COMJ[1] "Frame data drop"
+	 *                  =   1 (0x01) ......1. "Drop frame data if
+	 *                                         exposure is not within
+	 *                                         tolerance.  In AEC mode,
+	 *                                         data is normally dropped
+	 *                                         when data is out of
+	 *                                         range."
+	 *    COMJ[0] "Reserved"
+	 *                  =   0 (0x00) .......0
+	 */
+	{ 0x14, 0xC6 },
+
+	/*
+	 * 15 COMK "Common Control K"
+	 *                  =   2 (0x02) 00000010
+	 *    COMK[7] "CHSYNC pin output swap"
+	 *                  =   0 (0x00) 0....... "CHSYNC"
+	 *    COMK[6] "HREF pin output swap"
+	 *                  =   0 (0x00) .0...... "HREF"
+	 *    COMK[5] "PCLK output selection"
+	 *                  =   0 (0x00) ..0..... "PCLK always output"
+	 *    COMK[4] "PCLK edge selection"
+	 *                  =   0 (0x00) ...0.... "Data valid on falling edge"
+	 *    COMK[3] "HREF output polarity"
+	 *                  =   0 (0x00) ....0... "positive"
+	 *    COMK[2] "Reserved"
+	 *                  =   0 (0x00) .....0..
+	 *    COMK[1] "VSYNC polarity"
+	 *                  =   1 (0x01) ......1. "negative"
+	 *    COMK[0] "HSYNC polarity"
+	 *                  =   0 (0x00) .......0 "positive"
+	 */
+	{ 0x15, 0x02 },
+
+	/*
+	 * 33 CHLF "Current Control"
+	 *                  =   9 (0x09) 00001001
+	 *    CHLF[7:6] "Sensor current control"
+	 *                  =   0 (0x00) 00......
+	 *    CHLF[5] "Sensor current range control"
+	 *                  =   0 (0x00) ..0..... "normal range"
+	 *    CHLF[4] "Sensor current"
+	 *                  =   0 (0x00) ...0.... "normal current"
+	 *    CHLF[3] "Sensor buffer current control"
+	 *                  =   1 (0x01) ....1... "half current"
+	 *    CHLF[2] "Column buffer current control"
+	 *                  =   0 (0x00) .....0.. "normal current"
+	 *    CHLF[1] "Analog DSP current control"
+	 *                  =   0 (0x00) ......0. "normal current"
+	 *    CHLF[1] "ADC current control"
+	 *                  =   0 (0x00) ......0. "normal current"
+	 */
+	{ 0x33, 0x09 },
+
+	/*
+	 * 34 VBLM "Blooming Control"
+	 *                  =  80 (0x50) 01010000
+	 *    VBLM[7] "Hard soft reset switch"
+	 *                  =   0 (0x00) 0....... "Hard reset"
+	 *    VBLM[6:4] "Blooming voltage selection"
+	 *                  =   5 (0x05) .101....
+	 *    VBLM[3:0] "Sensor current control"
+	 *                  =   0 (0x00) ....0000
+	 */
+	{ 0x34, 0x50 },
+
+	/*
+	 * 36 VCHG "Sensor Precharge Voltage Control"
+	 *                  =   0 (0x00) 00000000
+	 *    VCHG[7] "Reserved"
+	 *                  =   0 (0x00) 0.......
+	 *    VCHG[6:4] "Sensor precharge voltage control"
+	 *                  =   0 (0x00) .000....
+	 *    VCHG[3:0] "Sensor array common reference"
+	 *                  =   0 (0x00) ....0000
+	 */
+	{ 0x36, 0x00 },
+
+	/*
+	 * 37 ADC "ADC Reference Control"
+	 *                  =   4 (0x04) 00000100
+	 *    ADC[7:4] "Reserved"
+	 *                  =   0 (0x00) 0000....
+	 *    ADC[3] "ADC input signal range"
+	 *                  =   0 (0x00) ....0... "Input signal 1.0x"
+	 *    ADC[2:0] "ADC range control"
+	 *                  =   4 (0x04) .....100
+	 */
+	{ 0x37, 0x04 },
+
+	/*
+	 * 38 ACOM "Analog Common Ground"
+	 *                  =  82 (0x52) 01010010
+	 *    ACOM[7] "Analog gain control"
+	 *                  =   0 (0x00) 0....... "Gain 1x"
+	 *    ACOM[6] "Analog black level calibration"
+	 *                  =   1 (0x01) .1...... "On"
+	 *    ACOM[5:0] "Reserved"
+	 *                  =  18 (0x12) ..010010
+	 */
+	{ 0x38, 0x52 },
+
+	/*
+	 * 3A FREFA "Internal Reference Adjustment"
+	 *                  =   0 (0x00) 00000000
+	 *    FREFA[7:0] "Range"
+	 *                  =   0 (0x00) 00000000
+	 */
+	{ 0x3a, 0x00 },
+
+	/*
+	 * 3C FVOPT "Internal Reference Adjustment"
+	 *                  =  31 (0x1F) 00011111
+	 *    FVOPT[7:0] "Range"
+	 *                  =  31 (0x1F) 00011111
+	 */
+	{ 0x3c, 0x1F },
+
+	/*
+	 * 44 Undocumented  =   0 (0x00) 00000000
+	 *    44[7:0] "It's a secret"
+	 *                  =   0 (0x00) 00000000
+	 */
+	{ 0x44, 0x00 },
+
+	/*
+	 * 40 Undocumented  =   0 (0x00) 00000000
+	 *    40[7:0] "It's a secret"
+	 *                  =   0 (0x00) 00000000
+	 */
+	{ 0x40, 0x00 },
+
+	/*
+	 * 41 Undocumented  =   0 (0x00) 00000000
+	 *    41[7:0] "It's a secret"
+	 *                  =   0 (0x00) 00000000
+	 */
+	{ 0x41, 0x00 },
+
+	/*
+	 * 42 Undocumented  =   0 (0x00) 00000000
+	 *    42[7:0] "It's a secret"
+	 *                  =   0 (0x00) 00000000
+	 */
+	{ 0x42, 0x00 },
+
+	/*
+	 * 43 Undocumented  =   0 (0x00) 00000000
+	 *    43[7:0] "It's a secret"
+	 *                  =   0 (0x00) 00000000
+	 */
+	{ 0x43, 0x00 },
+
+	/*
+	 * 45 Undocumented  = 128 (0x80) 10000000
+	 *    45[7:0] "It's a secret"
+	 *                  = 128 (0x80) 10000000
+	 */
+	{ 0x45, 0x80 },
+
+	/*
+	 * 48 Undocumented  = 192 (0xC0) 11000000
+	 *    48[7:0] "It's a secret"
+	 *                  = 192 (0xC0) 11000000
+	 */
+	{ 0x48, 0xC0 },
+
+	/*
+	 * 49 Undocumented  =  25 (0x19) 00011001
+	 *    49[7:0] "It's a secret"
+	 *                  =  25 (0x19) 00011001
+	 */
+	{ 0x49, 0x19 },
+
+	/*
+	 * 4B Undocumented  = 128 (0x80) 10000000
+	 *    4B[7:0] "It's a secret"
+	 *                  = 128 (0x80) 10000000
+	 */
+	{ 0x4B, 0x80 },
+
+	/*
+	 * 4D Undocumented  = 196 (0xC4) 11000100
+	 *    4D[7:0] "It's a secret"
+	 *                  = 196 (0xC4) 11000100
+	 */
+	{ 0x4D, 0xC4 },
+
+	/*
+	 * 35 VREF "Reference Voltage Control"
+	 *                  =  76 (0x4C) 01001100
+	 *    VREF[7:5] "Column high reference control"
+	 *                  =   2 (0x02) 010..... "higher voltage"
+	 *    VREF[4:2] "Column low reference control"
+	 *                  =   3 (0x03) ...011.. "Highest voltage"
+	 *    VREF[1:0] "Reserved"
+	 *                  =   0 (0x00) ......00
+	 */
+	{ 0x35, 0x4C },
+
+	/*
+	 * 3D Undocumented  =   0 (0x00) 00000000
+	 *    3D[7:0] "It's a secret"
+	 *                  =   0 (0x00) 00000000
+	 */
+	{ 0x3D, 0x00 },
+
+	/*
+	 * 3E Undocumented  =   0 (0x00) 00000000
+	 *    3E[7:0] "It's a secret"
+	 *                  =   0 (0x00) 00000000
+	 */
+	{ 0x3E, 0x00 },
+
+	/*
+	 * 3B FREFB "Internal Reference Adjustment"
+	 *                  =  24 (0x18) 00011000
+	 *    FREFB[7:0] "Range"
+	 *                  =  24 (0x18) 00011000
+	 */
+	{ 0x3b, 0x18 },
+
+	/*
+	 * 33 CHLF "Current Control"
+	 *                  =  25 (0x19) 00011001
+	 *    CHLF[7:6] "Sensor current control"
+	 *                  =   0 (0x00) 00......
+	 *    CHLF[5] "Sensor current range control"
+	 *                  =   0 (0x00) ..0..... "normal range"
+	 *    CHLF[4] "Sensor current"
+	 *                  =   1 (0x01) ...1.... "double current"
+	 *    CHLF[3] "Sensor buffer current control"
+	 *                  =   1 (0x01) ....1... "half current"
+	 *    CHLF[2] "Column buffer current control"
+	 *                  =   0 (0x00) .....0.. "normal current"
+	 *    CHLF[1] "Analog DSP current control"
+	 *                  =   0 (0x00) ......0. "normal current"
+	 *    CHLF[1] "ADC current control"
+	 *                  =   0 (0x00) ......0. "normal current"
+	 */
+	{ 0x33, 0x19 },
+
+	/*
+	 * 34 VBLM "Blooming Control"
+	 *                  =  90 (0x5A) 01011010
+	 *    VBLM[7] "Hard soft reset switch"
+	 *                  =   0 (0x00) 0....... "Hard reset"
+	 *    VBLM[6:4] "Blooming voltage selection"
+	 *                  =   5 (0x05) .101....
+	 *    VBLM[3:0] "Sensor current control"
+	 *                  =  10 (0x0A) ....1010
+	 */
+	{ 0x34, 0x5A },
+
+	/*
+	 * 3B FREFB "Internal Reference Adjustment"
+	 *                  =   0 (0x00) 00000000
+	 *    FREFB[7:0] "Range"
+	 *                  =   0 (0x00) 00000000
+	 */
+	{ 0x3b, 0x00 },
+
+	/*
+	 * 33 CHLF "Current Control"
+	 *                  =   9 (0x09) 00001001
+	 *    CHLF[7:6] "Sensor current control"
+	 *                  =   0 (0x00) 00......
+	 *    CHLF[5] "Sensor current range control"
+	 *                  =   0 (0x00) ..0..... "normal range"
+	 *    CHLF[4] "Sensor current"
+	 *                  =   0 (0x00) ...0.... "normal current"
+	 *    CHLF[3] "Sensor buffer current control"
+	 *                  =   1 (0x01) ....1... "half current"
+	 *    CHLF[2] "Column buffer current control"
+	 *                  =   0 (0x00) .....0.. "normal current"
+	 *    CHLF[1] "Analog DSP current control"
+	 *                  =   0 (0x00) ......0. "normal current"
+	 *    CHLF[1] "ADC current control"
+	 *                  =   0 (0x00) ......0. "normal current"
+	 */
+	{ 0x33, 0x09 },
+
+	/*
+	 * 34 VBLM "Blooming Control"
+	 *                  =  80 (0x50) 01010000
+	 *    VBLM[7] "Hard soft reset switch"
+	 *                  =   0 (0x00) 0....... "Hard reset"
+	 *    VBLM[6:4] "Blooming voltage selection"
+	 *                  =   5 (0x05) .101....
+	 *    VBLM[3:0] "Sensor current control"
+	 *                  =   0 (0x00) ....0000
+	 */
+	{ 0x34, 0x50 },
+
+	/*
+	 * 12 COMH "Common Control H"
+	 *                  =  64 (0x40) 01000000
+	 *    COMH[7] "SRST"
+	 *                  =   0 (0x00) 0....... "No-op"
+	 *    COMH[6:4] "Resolution selection"
+	 *                  =   4 (0x04) .100.... "XGA"
+	 *    COMH[3] "Master slave selection"
+	 *                  =   0 (0x00) ....0... "Master mode"
+	 *    COMH[2] "Internal B/R channel option"
+	 *                  =   0 (0x00) .....0.. "B/R use same channel"
+	 *    COMH[1] "Color bar test pattern"
+	 *                  =   0 (0x00) ......0. "Off"
+	 *    COMH[0] "Reserved"
+	 *                  =   0 (0x00) .......0
+	 */
+	{ 0x12, 0x40 },
+
+	/*
+	 * 17 HREFST "Horizontal window start"
+	 *                  =  31 (0x1F) 00011111
+	 *    HREFST[7:0] "Horizontal window start, 8 MSBs"
+	 *                  =  31 (0x1F) 00011111
+	 */
+	{ 0x17, 0x1F },
+
+	/*
+	 * 18 HREFEND "Horizontal window end"
+	 *                  =  95 (0x5F) 01011111
+	 *    HREFEND[7:0] "Horizontal Window End, 8 MSBs"
+	 *                  =  95 (0x5F) 01011111
+	 */
+	{ 0x18, 0x5F },
+
+	/*
+	 * 19 VSTRT "Vertical window start"
+	 *                  =   0 (0x00) 00000000
+	 *    VSTRT[7:0] "Vertical Window Start, 8 MSBs"
+	 *                  =   0 (0x00) 00000000
+	 */
+	{ 0x19, 0x00 },
+
+	/*
+	 * 1A VEND "Vertical window end"
+	 *                  =  96 (0x60) 01100000
+	 *    VEND[7:0] "Vertical Window End, 8 MSBs"
+	 *                  =  96 (0x60) 01100000
+	 */
+	{ 0x1a, 0x60 },
+
+	/*
+	 * 32 COMM "Common Control M"
+	 *                  =  18 (0x12) 00010010
+	 *    COMM[7:6] "Pixel clock divide option"
+	 *                  =   0 (0x00) 00...... "/1"
+	 *    COMM[5:3] "Horizontal window end position, 3 LSBs"
+	 *                  =   2 (0x02) ..010...
+	 *    COMM[2:0] "Horizontal window start position, 3 LSBs"
+	 *                  =   2 (0x02) .....010
+	 */
+	{ 0x32, 0x12 },
+
+	/*
+	 * 03 COMA "Common Control A"
+	 *                  =  74 (0x4A) 01001010
+	 *    COMA[7:4] "AWB Update Threshold"
+	 *                  =   4 (0x04) 0100....
+	 *    COMA[3:2] "Vertical window end line control 2 LSBs"
+	 *                  =   2 (0x02) ....10..
+	 *    COMA[1:0] "Vertical window start line control 2 LSBs"
+	 *                  =   2 (0x02) ......10
+	 */
+	{ 0x03, 0x4A },
+
+	/*
+	 * 11 CLKRC "Clock Rate Control"
+	 *                  = 128 (0x80) 10000000
+	 *    CLKRC[7] "Internal frequency doublers on off seclection"
+	 *                  =   1 (0x01) 1....... "On"
+	 *    CLKRC[6] "Digital video master slave selection"
+	 *                  =   0 (0x00) .0...... "Master mode, sensor
+	 *                                         provides PCLK"
+	 *    CLKRC[5:0] "Clock divider { CLK = PCLK/(1+CLKRC[5:0]) }"
+	 *                  =   0 (0x00) ..000000
+	 */
+	{ 0x11, 0x80 },
+
+	/*
+	 * 12 COMH "Common Control H"
+	 *                  =   0 (0x00) 00000000
+	 *    COMH[7] "SRST"
+	 *                  =   0 (0x00) 0....... "No-op"
+	 *    COMH[6:4] "Resolution selection"
+	 *                  =   0 (0x00) .000.... "QXGA"
+	 *    COMH[3] "Master slave selection"
+	 *                  =   0 (0x00) ....0... "Master mode"
+	 *    COMH[2] "Internal B/R channel option"
+	 *                  =   0 (0x00) .....0.. "B/R use same channel"
+	 *    COMH[1] "Color bar test pattern"
+	 *                  =   0 (0x00) ......0. "Off"
+	 *    COMH[0] "Reserved"
+	 *                  =   0 (0x00) .......0
+	 */
+	{ 0x12, 0x00 },
+
+	/*
+	 * 12 COMH "Common Control H"
+	 *                  =  64 (0x40) 01000000
+	 *    COMH[7] "SRST"
+	 *                  =   0 (0x00) 0....... "No-op"
+	 *    COMH[6:4] "Resolution selection"
+	 *                  =   4 (0x04) .100.... "XGA"
+	 *    COMH[3] "Master slave selection"
+	 *                  =   0 (0x00) ....0... "Master mode"
+	 *    COMH[2] "Internal B/R channel option"
+	 *                  =   0 (0x00) .....0.. "B/R use same channel"
+	 *    COMH[1] "Color bar test pattern"
+	 *                  =   0 (0x00) ......0. "Off"
+	 *    COMH[0] "Reserved"
+	 *                  =   0 (0x00) .......0
+	 */
+	{ 0x12, 0x40 },
+
+	/*
+	 * 17 HREFST "Horizontal window start"
+	 *                  =  31 (0x1F) 00011111
+	 *    HREFST[7:0] "Horizontal window start, 8 MSBs"
+	 *                  =  31 (0x1F) 00011111
+	 */
+	{ 0x17, 0x1F },
+
+	/*
+	 * 18 HREFEND "Horizontal window end"
+	 *                  =  95 (0x5F) 01011111
+	 *    HREFEND[7:0] "Horizontal Window End, 8 MSBs"
+	 *                  =  95 (0x5F) 01011111
+	 */
+	{ 0x18, 0x5F },
+
+	/*
+	 * 19 VSTRT "Vertical window start"
+	 *                  =   0 (0x00) 00000000
+	 *    VSTRT[7:0] "Vertical Window Start, 8 MSBs"
+	 *                  =   0 (0x00) 00000000
+	 */
+	{ 0x19, 0x00 },
+
+	/*
+	 * 1A VEND "Vertical window end"
+	 *                  =  96 (0x60) 01100000
+	 *    VEND[7:0] "Vertical Window End, 8 MSBs"
+	 *                  =  96 (0x60) 01100000
+	 */
+	{ 0x1a, 0x60 },
+
+	/*
+	 * 32 COMM "Common Control M"
+	 *                  =  18 (0x12) 00010010
+	 *    COMM[7:6] "Pixel clock divide option"
+	 *                  =   0 (0x00) 00...... "/1"
+	 *    COMM[5:3] "Horizontal window end position, 3 LSBs"
+	 *                  =   2 (0x02) ..010...
+	 *    COMM[2:0] "Horizontal window start position, 3 LSBs"
+	 *                  =   2 (0x02) .....010
+	 */
+	{ 0x32, 0x12 },
+
+	/*
+	 * 03 COMA "Common Control A"
+	 *                  =  74 (0x4A) 01001010
+	 *    COMA[7:4] "AWB Update Threshold"
+	 *                  =   4 (0x04) 0100....
+	 *    COMA[3:2] "Vertical window end line control 2 LSBs"
+	 *                  =   2 (0x02) ....10..
+	 *    COMA[1:0] "Vertical window start line control 2 LSBs"
+	 *                  =   2 (0x02) ......10
+	 */
+	{ 0x03, 0x4A },
+
+	/*
+	 * 02 RED "Red Gain Control"
+	 *                  = 175 (0xAF) 10101111
+	 *    RED[7] "Action"
+	 *                  =   1 (0x01) 1....... "gain = 1/(1+bitrev([6:0]))"
+	 *    RED[6:0] "Value"
+	 *                  =  47 (0x2F) .0101111
+	 */
+	{ 0x02, 0xAF },
+
+	/*
+	 * 2D ADDVSL "VSYNC Pulse Width"
+	 *                  = 210 (0xD2) 11010010
+	 *    ADDVSL[7:0] "VSYNC pulse width, LSB"
+	 *                  = 210 (0xD2) 11010010
+	 */
+	{ 0x2d, 0xD2 },
+
+	/*
+	 * 00 GAIN          =  24 (0x18) 00011000
+	 *    GAIN[7:6] "Reserved"
+	 *                  =   0 (0x00) 00......
+	 *    GAIN[5] "Double"
+	 *                  =   0 (0x00) ..0..... "False"
+	 *    GAIN[4] "Double"
+	 *                  =   1 (0x01) ...1.... "True"
+	 *    GAIN[3:0] "Range"
+	 *                  =   8 (0x08) ....1000
+	 */
+	{ 0x00, 0x18 },
+
+	/*
+	 * 01 BLUE "Blue Gain Control"
+	 *                  = 240 (0xF0) 11110000
+	 *    BLUE[7] "Action"
+	 *                  =   1 (0x01) 1....... "gain = 1/(1+bitrev([6:0]))"
+	 *    BLUE[6:0] "Value"
+	 *                  = 112 (0x70) .1110000
+	 */
+	{ 0x01, 0xF0 },
+
+	/*
+	 * 10 AEC "Automatic Exposure Control"
+	 *                  =  10 (0x0A) 00001010
+	 *    AEC[7:0] "Automatic Exposure Control, 8 MSBs"
+	 *                  =  10 (0x0A) 00001010
+	 */
+	{ 0x10, 0x0A },
+
+	{ 0xE1, 0x67 },
+	{ 0xE3, 0x03 },
+	{ 0xE4, 0x26 },
+	{ 0xE5, 0x3E },
+	{ 0xF8, 0x01 },
+	{ 0xFF, 0x01 },
+};
+
 static const struct ov_i2c_regvals norm_6x20[] = {
 	{ 0x12, 0x80 }, /* reset */
 	{ 0x11, 0x01 },
@@ -678,6 +1488,7 @@ static const struct ov_i2c_regvals norm_7610[] = {
 };
 
 static const struct ov_i2c_regvals norm_7620[] = {
+	{ 0x12, 0x80 },		/* reset */
 	{ 0x00, 0x00 },		/* gain */
 	{ 0x01, 0x80 },		/* blue gain */
 	{ 0x02, 0x80 },		/* red gain */
@@ -1042,10 +1853,28 @@ static unsigned char ov7670_abs_to_sm(unsigned char v)
 }
 
 /* Write a OV519 register */
-static int reg_w(struct sd *sd, __u16 index, __u8 value)
+static int reg_w(struct sd *sd, __u16 index, __u16 value)
 {
-	int ret;
-	int req = (sd->bridge <= BRIDGE_OV511PLUS) ? 2 : 1;
+	int ret, req = 0;
+
+	switch (sd->bridge) {
+	case BRIDGE_OV511:
+	case BRIDGE_OV511PLUS:
+		req = 2;
+		break;
+	case BRIDGE_OVFX2:
+		req = 0x0a;
+		/* fall through */
+	case BRIDGE_W9968CF:
+		ret = usb_control_msg(sd->gspca_dev.dev,
+			usb_sndctrlpipe(sd->gspca_dev.dev, 0),
+			req,
+			USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+			value, index, NULL, 0, 500);
+		goto leave;
+	default:
+		req = 1;
+	}
 
 	sd->gspca_dev.usb_buf[0] = value;
 	ret = usb_control_msg(sd->gspca_dev.dev,
@@ -1054,17 +1883,35 @@ static int reg_w(struct sd *sd, __u16 index, __u8 value)
 			USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
 			0, index,
 			sd->gspca_dev.usb_buf, 1, 500);
-	if (ret < 0)
-		PDEBUG(D_ERR, "Write reg [%02x] %02x failed", index, value);
-	return ret;
+leave:
+	if (ret < 0) {
+		PDEBUG(D_ERR, "Write reg 0x%04x -> [0x%02x] failed",
+		       value, index);
+		return ret;
+	}
+
+	PDEBUG(D_USBO, "Write reg 0x%04x -> [0x%02x]", value, index);
+	return 0;
 }
 
-/* Read from a OV519 register */
+/* Read from a OV519 register, note not valid for the w9968cf!! */
 /* returns: negative is error, pos or zero is data */
 static int reg_r(struct sd *sd, __u16 index)
 {
 	int ret;
-	int req = (sd->bridge <= BRIDGE_OV511PLUS) ? 3 : 1;
+	int req;
+
+	switch (sd->bridge) {
+	case BRIDGE_OV511:
+	case BRIDGE_OV511PLUS:
+		req = 3;
+		break;
+	case BRIDGE_OVFX2:
+		req = 0x0b;
+		break;
+	default:
+		req = 1;
+	}
 
 	ret = usb_control_msg(sd->gspca_dev.dev,
 			usb_rcvctrlpipe(sd->gspca_dev.dev, 0),
@@ -1072,10 +1919,12 @@ static int reg_r(struct sd *sd, __u16 index)
 			USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
 			0, index, sd->gspca_dev.usb_buf, 1, 500);
 
-	if (ret >= 0)
+	if (ret >= 0) {
 		ret = sd->gspca_dev.usb_buf[0];
-	else
+		PDEBUG(D_USBI, "Read reg [0x%02X] -> 0x%04X", index, ret);
+	} else
 		PDEBUG(D_ERR, "Read reg [0x%02x] failed", index);
+
 	return ret;
 }
 
@@ -1095,6 +1944,7 @@ static int reg_r8(struct sd *sd,
 		ret = sd->gspca_dev.usb_buf[0];
 	else
 		PDEBUG(D_ERR, "Read reg 8 [0x%02x] failed", index);
+
 	return ret;
 }
 
@@ -1132,7 +1982,7 @@ static int ov518_reg_w32(struct sd *sd, __u16 index, u32 value, int n)
 {
 	int ret;
 
-	*((u32 *)sd->gspca_dev.usb_buf) = __cpu_to_le32(value);
+	*((__le32 *) sd->gspca_dev.usb_buf) = __cpu_to_le32(value);
 
 	ret = usb_control_msg(sd->gspca_dev.dev,
 			usb_sndctrlpipe(sd->gspca_dev.dev, 0),
@@ -1140,9 +1990,12 @@ static int ov518_reg_w32(struct sd *sd, __u16 index, u32 value, int n)
 			USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
 			0, index,
 			sd->gspca_dev.usb_buf, n, 500);
-	if (ret < 0)
+	if (ret < 0) {
 		PDEBUG(D_ERR, "Write reg32 [%02x] %08x failed", index, value);
-	return ret;
+		return ret;
+	}
+
+	return 0;
 }
 
 static int ov511_i2c_w(struct sd *sd, __u8 reg, __u8 value)
@@ -1168,9 +2021,9 @@ static int ov511_i2c_w(struct sd *sd, __u8 reg, __u8 value)
 		if (rc < 0)
 			return rc;
 
-		do
+		do {
 			rc = reg_r(sd, R511_I2C_CTL);
-		while (rc > 0 && ((rc & 1) == 0)); /* Retry until idle */
+		} while (rc > 0 && ((rc & 1) == 0)); /* Retry until idle */
 
 		if (rc < 0)
 			return rc;
@@ -1202,9 +2055,9 @@ static int ov511_i2c_r(struct sd *sd, __u8 reg)
 		if (rc < 0)
 			return rc;
 
-		do
+		do {
 			rc = reg_r(sd, R511_I2C_CTL);
-		while (rc > 0 && ((rc & 1) == 0)); /* Retry until idle */
+		} while (rc > 0 && ((rc & 1) == 0)); /* Retry until idle */
 
 		if (rc < 0)
 			return rc;
@@ -1228,9 +2081,9 @@ static int ov511_i2c_r(struct sd *sd, __u8 reg)
 		if (rc < 0)
 			return rc;
 
-		do
+		do {
 			rc = reg_r(sd, R511_I2C_CTL);
-		while (rc > 0 && ((rc & 1) == 0)); /* Retry until idle */
+		} while (rc > 0 && ((rc & 1) == 0)); /* Retry until idle */
 
 		if (rc < 0)
 			return rc;
@@ -1324,32 +2177,110 @@ static int ov518_i2c_r(struct sd *sd, __u8 reg)
 	return value;
 }
 
+static int ovfx2_i2c_w(struct sd *sd, __u8 reg, __u8 value)
+{
+	int ret;
+
+	ret = usb_control_msg(sd->gspca_dev.dev,
+			usb_sndctrlpipe(sd->gspca_dev.dev, 0),
+			0x02,
+			USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+			(__u16)value, (__u16)reg, NULL, 0, 500);
+
+	if (ret < 0) {
+		PDEBUG(D_ERR, "i2c 0x%02x -> [0x%02x] failed", value, reg);
+		return ret;
+	}
+
+	PDEBUG(D_USBO, "i2c 0x%02x -> [0x%02x]", value, reg);
+	return 0;
+}
+
+static int ovfx2_i2c_r(struct sd *sd, __u8 reg)
+{
+	int ret;
+
+	ret = usb_control_msg(sd->gspca_dev.dev,
+			usb_rcvctrlpipe(sd->gspca_dev.dev, 0),
+			0x03,
+			USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+			0, (__u16)reg, sd->gspca_dev.usb_buf, 1, 500);
+
+	if (ret >= 0) {
+		ret = sd->gspca_dev.usb_buf[0];
+		PDEBUG(D_USBI, "i2c [0x%02X] -> 0x%02X", reg, ret);
+	} else
+		PDEBUG(D_ERR, "i2c read [0x%02x] failed", reg);
+
+	return ret;
+}
+
 static int i2c_w(struct sd *sd, __u8 reg, __u8 value)
 {
+	int ret = -1;
+
+	if (sd->sensor_reg_cache[reg] == value)
+		return 0;
+
 	switch (sd->bridge) {
 	case BRIDGE_OV511:
 	case BRIDGE_OV511PLUS:
-		return ov511_i2c_w(sd, reg, value);
+		ret = ov511_i2c_w(sd, reg, value);
+		break;
 	case BRIDGE_OV518:
 	case BRIDGE_OV518PLUS:
 	case BRIDGE_OV519:
-		return ov518_i2c_w(sd, reg, value);
+		ret = ov518_i2c_w(sd, reg, value);
+		break;
+	case BRIDGE_OVFX2:
+		ret = ovfx2_i2c_w(sd, reg, value);
+		break;
+	case BRIDGE_W9968CF:
+		ret = w9968cf_i2c_w(sd, reg, value);
+		break;
 	}
-	return -1; /* Should never happen */
+
+	if (ret >= 0) {
+		/* Up on sensor reset empty the register cache */
+		if (reg == 0x12 && (value & 0x80))
+			memset(sd->sensor_reg_cache, -1,
+			       sizeof(sd->sensor_reg_cache));
+		else
+			sd->sensor_reg_cache[reg] = value;
+	}
+
+	return ret;
 }
 
 static int i2c_r(struct sd *sd, __u8 reg)
 {
+	int ret = -1;
+
+	if (sd->sensor_reg_cache[reg] != -1)
+		return sd->sensor_reg_cache[reg];
+
 	switch (sd->bridge) {
 	case BRIDGE_OV511:
 	case BRIDGE_OV511PLUS:
-		return ov511_i2c_r(sd, reg);
+		ret = ov511_i2c_r(sd, reg);
+		break;
 	case BRIDGE_OV518:
 	case BRIDGE_OV518PLUS:
 	case BRIDGE_OV519:
-		return ov518_i2c_r(sd, reg);
+		ret = ov518_i2c_r(sd, reg);
+		break;
+	case BRIDGE_OVFX2:
+		ret = ovfx2_i2c_r(sd, reg);
+		break;
+	case BRIDGE_W9968CF:
+		ret = w9968cf_i2c_r(sd, reg);
+		break;
 	}
-	return -1; /* Should never happen */
+
+	if (ret >= 0)
+		sd->sensor_reg_cache[reg] = ret;
+
+	return ret;
 }
 
 /* Writes bits at positions specified by mask to an I2C reg. Bits that are in
@@ -1389,6 +2320,10 @@ static inline int ov51x_stop(struct sd *sd)
 		return reg_w_mask(sd, R51x_SYS_RESET, 0x3a, 0x3a);
 	case BRIDGE_OV519:
 		return reg_w(sd, OV519_SYS_RESET1, 0x0f);
+	case BRIDGE_OVFX2:
+		return reg_w_mask(sd, 0x0f, 0x00, 0x02);
+	case BRIDGE_W9968CF:
+		return reg_w(sd, 0x3c, 0x0a05); /* stop USB transfer */
 	}
 
 	return 0;
@@ -1418,18 +2353,27 @@ static inline int ov51x_restart(struct sd *sd)
 		return reg_w(sd, R51x_SYS_RESET, 0x00);
 	case BRIDGE_OV519:
 		return reg_w(sd, OV519_SYS_RESET1, 0x00);
+	case BRIDGE_OVFX2:
+		return reg_w_mask(sd, 0x0f, 0x02, 0x02);
+	case BRIDGE_W9968CF:
+		return reg_w(sd, 0x3c, 0x8a05); /* USB FIFO enable */
 	}
 
 	return 0;
 }
 
+static int ov51x_set_slave_ids(struct sd *sd, __u8 slave);
+
 /* This does an initial reset of an OmniVision sensor and ensures that I2C
  * is synchronized. Returns <0 on failure.
  */
-static int init_ov_sensor(struct sd *sd)
+static int init_ov_sensor(struct sd *sd, __u8 slave)
 {
 	int i;
 
+	if (ov51x_set_slave_ids(sd, slave) < 0)
+		return -EIO;
+
 	/* Reset the sensor */
 	if (i2c_w(sd, 0x12, 0x80) < 0)
 		return -EIO;
@@ -1466,6 +2410,14 @@ static int ov51x_set_slave_ids(struct sd *sd,
 {
 	int rc;
 
+	switch (sd->bridge) {
+	case BRIDGE_OVFX2:
+		return reg_w(sd, OVFX2_I2C_ADDR, slave);
+	case BRIDGE_W9968CF:
+		sd->sensor_addr = slave;
+		return 0;
+	}
+
 	rc = reg_w(sd, R51x_I2C_W_SID, slave);
 	if (rc < 0)
 		return rc;
@@ -1508,6 +2460,39 @@ static int write_i2c_regvals(struct sd *sd,
  *
  ***************************************************************************/
 
+/* This initializes the OV2x10 / OV3610 / OV3620 */
+static int ov_hires_configure(struct sd *sd)
+{
+	int high, low;
+
+	if (sd->bridge != BRIDGE_OVFX2) {
+		PDEBUG(D_ERR, "error hires sensors only supported with ovfx2");
+		return -1;
+	}
+
+	PDEBUG(D_PROBE, "starting ov hires configuration");
+
+	/* Detect sensor (sub)type */
+	high = i2c_r(sd, 0x0a);
+	low = i2c_r(sd, 0x0b);
+	/* info("%x, %x", high, low); */
+	if (high == 0x96 && low == 0x40) {
+		PDEBUG(D_PROBE, "Sensor is an OV2610");
+		sd->sensor = SEN_OV2610;
+	} else if (high == 0x36 && (low & 0x0f) == 0x00) {
+		PDEBUG(D_PROBE, "Sensor is an OV3610");
+		sd->sensor = SEN_OV3610;
+	} else {
+		PDEBUG(D_ERR, "Error unknown sensor type: 0x%02x%02x",
+		       high, low);
+		return -1;
+	}
+
+	/* Set sensor-specific vars */
+	return 0;
+}
+
+
 /* This initializes the OV8110, OV8610 sensor. The OV8110 uses
  * the same register settings as the OV8610, since they are very similar.
  */
@@ -1966,12 +2951,29 @@ static int ov519_configure(struct sd *sd)
 	return write_regvals(sd, init_519, ARRAY_SIZE(init_519));
 }
 
+static int ovfx2_configure(struct sd *sd)
+{
+	static const struct ov_regvals init_fx2[] = {
+		{ 0x00, 0x60 },
+		{ 0x02, 0x01 },
+		{ 0x0f, 0x1d },
+		{ 0xe9, 0x82 },
+		{ 0xea, 0xc7 },
+		{ 0xeb, 0x10 },
+		{ 0xec, 0xf6 },
+	};
+
+	sd->stopped = 1;
+
+	return write_regvals(sd, init_fx2, ARRAY_SIZE(init_fx2));
+}
+
 /* this function is called at probe time */
 static int sd_config(struct gspca_dev *gspca_dev,
 			const struct usb_device_id *id)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
-	struct cam *cam;
+	struct cam *cam = &gspca_dev->cam;
 	int ret = 0;
 
 	sd->bridge = id->driver_info & BRIDGE_MASK;
@@ -1989,6 +2991,16 @@ static int sd_config(struct gspca_dev *gspca_dev,
 	case BRIDGE_OV519:
 		ret = ov519_configure(sd);
 		break;
+	case BRIDGE_OVFX2:
+		ret = ovfx2_configure(sd);
+		cam->bulk_size = OVFX2_BULK_SIZE;
+		cam->bulk_nurbs = MAX_NURBS;
+		cam->bulk = 1;
+		break;
+	case BRIDGE_W9968CF:
+		ret = w9968cf_configure(sd);
+		cam->reverse_alts = 1;
+		break;
 	}
 
 	if (ret)
@@ -1996,49 +3008,39 @@ static int sd_config(struct gspca_dev *gspca_dev,
 
 	ov51x_led_control(sd, 0);	/* turn LED off */
 
-	/* Test for 76xx */
-	if (ov51x_set_slave_ids(sd, OV7xx0_SID) < 0)
-		goto error;
-
 	/* The OV519 must be more aggressive about sensor detection since
 	 * I2C write will never fail if the sensor is not present. We have
 	 * to try to initialize the sensor to detect its presence */
-	if (init_ov_sensor(sd) >= 0) {
+
+	/* Test for 76xx */
+	if (init_ov_sensor(sd, OV7xx0_SID) >= 0) {
 		if (ov7xx0_configure(sd) < 0) {
 			PDEBUG(D_ERR, "Failed to configure OV7xx0");
 			goto error;
 		}
-	} else {
-
-		/* Test for 6xx0 */
-		if (ov51x_set_slave_ids(sd, OV6xx0_SID) < 0)
+	/* Test for 6xx0 */
+	} else if (init_ov_sensor(sd, OV6xx0_SID) >= 0) {
+		if (ov6xx0_configure(sd) < 0) {
+			PDEBUG(D_ERR, "Failed to configure OV6xx0");
+			goto error;
+		}
+	/* Test for 8xx0 */
+	} else if (init_ov_sensor(sd, OV8xx0_SID) >= 0) {
+		if (ov8xx0_configure(sd) < 0) {
+			PDEBUG(D_ERR, "Failed to configure OV8xx0");
 			goto error;
-
-		if (init_ov_sensor(sd) >= 0) {
-			if (ov6xx0_configure(sd) < 0) {
-				PDEBUG(D_ERR, "Failed to configure OV6xx0");
-				goto error;
-			}
-		} else {
-
-			/* Test for 8xx0 */
-			if (ov51x_set_slave_ids(sd, OV8xx0_SID) < 0)
-				goto error;
-
-			if (init_ov_sensor(sd) < 0) {
-				PDEBUG(D_ERR,
-					"Can't determine sensor slave IDs");
-				goto error;
-			}
-			if (ov8xx0_configure(sd) < 0) {
-				PDEBUG(D_ERR,
-					"Failed to configure OV8xx0 sensor");
-				goto error;
-			}
 		}
+	/* Test for 3xxx / 2xxx */
+	} else if (init_ov_sensor(sd, OV_HIRES_SID) >= 0) {
+		if (ov_hires_configure(sd) < 0) {
+			PDEBUG(D_ERR, "Failed to configure high res OV");
+			goto error;
+		}
+	} else {
+		PDEBUG(D_ERR, "Can't determine sensor slave IDs");
+		goto error;
 	}
 
-	cam = &gspca_dev->cam;
 	switch (sd->bridge) {
 	case BRIDGE_OV511:
 	case BRIDGE_OV511PLUS:
@@ -2069,6 +3071,31 @@ static int sd_config(struct gspca_dev *gspca_dev,
 			cam->nmodes = ARRAY_SIZE(ov519_sif_mode);
 		}
 		break;
+	case BRIDGE_OVFX2:
+		if (sd->sensor == SEN_OV2610) {
+			cam->cam_mode = ovfx2_ov2610_mode;
+			cam->nmodes = ARRAY_SIZE(ovfx2_ov2610_mode);
+		} else if (sd->sensor == SEN_OV3610) {
+			cam->cam_mode = ovfx2_ov3610_mode;
+			cam->nmodes = ARRAY_SIZE(ovfx2_ov3610_mode);
+		} else if (!sd->sif) {
+			cam->cam_mode = ov519_vga_mode;
+			cam->nmodes = ARRAY_SIZE(ov519_vga_mode);
+		} else {
+			cam->cam_mode = ov519_sif_mode;
+			cam->nmodes = ARRAY_SIZE(ov519_sif_mode);
+		}
+		break;
+	case BRIDGE_W9968CF:
+		cam->cam_mode = w9968cf_vga_mode;
+		cam->nmodes = ARRAY_SIZE(w9968cf_vga_mode);
+		if (sd->sif)
+			cam->nmodes--;
+
+		/* w9968cf needs initialisation once the sensor is known */
+		if (w9968cf_init(sd) < 0)
+			goto error;
+		break;
 	}
 	sd->brightness = BRIGHTNESS_DEF;
 	if (sd->sensor == SEN_OV6630 || sd->sensor == SEN_OV66308AF)
@@ -2087,11 +3114,15 @@ static int sd_config(struct gspca_dev *gspca_dev,
 		gspca_dev->ctrl_dis = (1 << HFLIP_IDX) | (1 << VFLIP_IDX) |
 				      (1 << OV7670_FREQ_IDX);
 	}
+	sd->quality = QUALITY_DEF;
 	if (sd->sensor == SEN_OV7640 || sd->sensor == SEN_OV7670)
 		gspca_dev->ctrl_dis |= 1 << AUTOBRIGHT_IDX;
 	/* OV8610 Frequency filter control should work but needs testing */
 	if (sd->sensor == SEN_OV8610)
 		gspca_dev->ctrl_dis |= 1 << FREQ_IDX;
+	/* No controls for the OV2610/OV3610 */
+	if (sd->sensor == SEN_OV2610 || sd->sensor == SEN_OV3610)
+		gspca_dev->ctrl_dis |= 0xFF;
 
 	return 0;
 error:
@@ -2106,6 +3137,20 @@ static int sd_init(struct gspca_dev *gspca_dev)
 
 	/* initialize the sensor */
 	switch (sd->sensor) {
+	case SEN_OV2610:
+		if (write_i2c_regvals(sd, norm_2610, ARRAY_SIZE(norm_2610)))
+			return -EIO;
+		/* Enable autogain, autoexpo, awb, bandfilter */
+		if (i2c_w_mask(sd, 0x13, 0x27, 0x27) < 0)
+			return -EIO;
+		break;
+	case SEN_OV3610:
+		if (write_i2c_regvals(sd, norm_3620b, ARRAY_SIZE(norm_3620b)))
+			return -EIO;
+		/* Enable autogain, autoexpo, awb, bandfilter */
+		if (i2c_w_mask(sd, 0x13, 0x27, 0x27) < 0)
+			return -EIO;
+		break;
 	case SEN_OV6620:
 		if (write_i2c_regvals(sd, norm_6x20, ARRAY_SIZE(norm_6x20)))
 			return -EIO;
@@ -2548,19 +3593,60 @@ static int ov519_mode_init_regs(struct sd *sd)
 static int mode_init_ov_sensor_regs(struct sd *sd)
 {
 	struct gspca_dev *gspca_dev;
-	int qvga;
+	int qvga, xstart, xend, ystart, yend;
+	__u8 v;
 
 	gspca_dev = &sd->gspca_dev;
 	qvga = gspca_dev->cam.cam_mode[(int) gspca_dev->curr_mode].priv & 1;
 
 	/******** Mode (VGA/QVGA) and sensor specific regs ********/
 	switch (sd->sensor) {
+	case SEN_OV2610:
+		i2c_w_mask(sd, 0x14, qvga ? 0x20 : 0x00, 0x20);
+		i2c_w_mask(sd, 0x28, qvga ? 0x00 : 0x20, 0x20);
+		i2c_w(sd, 0x24, qvga ? 0x20 : 0x3a);
+		i2c_w(sd, 0x25, qvga ? 0x30 : 0x60);
+		i2c_w_mask(sd, 0x2d, qvga ? 0x40 : 0x00, 0x40);
+		i2c_w_mask(sd, 0x67, qvga ? 0xf0 : 0x90, 0xf0);
+		i2c_w_mask(sd, 0x74, qvga ? 0x20 : 0x00, 0x20);
+		return 0;
+	case SEN_OV3610:
+		if (qvga) {
+			xstart = (1040 - gspca_dev->width) / 2 + (0x1f << 4);
+			ystart = (776 - gspca_dev->height) / 2;
+		} else {
+			xstart = (2076 - gspca_dev->width) / 2 + (0x10 << 4);
+			ystart = (1544 - gspca_dev->height) / 2;
+		}
+		xend = xstart + gspca_dev->width;
+		yend = ystart + gspca_dev->height;
+		/* Writing to the COMH register resets the other windowing regs
+		   to their default values, so we must do this first. */
+		i2c_w_mask(sd, 0x12, qvga ? 0x40 : 0x00, 0xf0);
+		i2c_w_mask(sd, 0x32,
+			   (((xend >> 1) & 7) << 3) | ((xstart >> 1) & 7),
+			   0x3f);
+		i2c_w_mask(sd, 0x03,
+			   (((yend >> 1) & 3) << 2) | ((ystart >> 1) & 3),
+			   0x0f);
+		i2c_w(sd, 0x17, xstart >> 4);
+		i2c_w(sd, 0x18, xend >> 4);
+		i2c_w(sd, 0x19, ystart >> 3);
+		i2c_w(sd, 0x1a, yend >> 3);
+		return 0;
 	case SEN_OV8610:
 		/* For OV8610 qvga means qsvga */
 		i2c_w_mask(sd, OV7610_REG_COM_C, qvga ? (1 << 5) : 0, 1 << 5);
+		i2c_w_mask(sd, 0x13, 0x00, 0x20); /* Select 16 bit data bus */
+		i2c_w_mask(sd, 0x12, 0x04, 0x06); /* AWB: 1 Test pattern: 0 */
+		i2c_w_mask(sd, 0x2d, 0x00, 0x40); /* from windrv 090403 */
+		i2c_w_mask(sd, 0x28, 0x20, 0x20); /* progressive mode on */
 		break;
 	case SEN_OV7610:
 		i2c_w_mask(sd, 0x14, qvga ? 0x20 : 0x00, 0x20);
+		i2c_w(sd, 0x35, qvga?0x1e:0x9e);
+		i2c_w_mask(sd, 0x13, 0x00, 0x20); /* Select 16 bit data bus */
+		i2c_w_mask(sd, 0x12, 0x04, 0x06); /* AWB: 1 Test pattern: 0 */
 		break;
 	case SEN_OV7620:
 	case SEN_OV76BE:
@@ -2571,6 +3657,10 @@ static int mode_init_ov_sensor_regs(struct sd *sd)
 		i2c_w_mask(sd, 0x2d, qvga ? 0x40 : 0x00, 0x40);
 		i2c_w_mask(sd, 0x67, qvga ? 0xb0 : 0x90, 0xf0);
 		i2c_w_mask(sd, 0x74, qvga ? 0x20 : 0x00, 0x20);
+		i2c_w_mask(sd, 0x13, 0x00, 0x20); /* Select 16 bit data bus */
+		i2c_w_mask(sd, 0x12, 0x04, 0x06); /* AWB: 1 Test pattern: 0 */
+		if (sd->sensor == SEN_OV76BE)
+			i2c_w(sd, 0x35, qvga ? 0x1e : 0x9e);
 		break;
 	case SEN_OV7640:
 		i2c_w_mask(sd, 0x14, qvga ? 0x20 : 0x00, 0x20);
@@ -2580,6 +3670,7 @@ static int mode_init_ov_sensor_regs(struct sd *sd)
 /*		i2c_w_mask(sd, 0x2d, qvga ? 0x40 : 0x00, 0x40); */
 /*		i2c_w_mask(sd, 0x67, qvga ? 0xf0 : 0x90, 0xf0); */
 /*		i2c_w_mask(sd, 0x74, qvga ? 0x20 : 0x00, 0x20); */
+		i2c_w_mask(sd, 0x12, 0x04, 0x04); /* AWB: 1 */
 		break;
 	case SEN_OV7670:
 		/* set COM7_FMT_VGA or COM7_FMT_QVGA
@@ -2588,55 +3679,56 @@ static int mode_init_ov_sensor_regs(struct sd *sd)
 		i2c_w_mask(sd, OV7670_REG_COM7,
 			 qvga ? OV7670_COM7_FMT_QVGA : OV7670_COM7_FMT_VGA,
 			 OV7670_COM7_FMT_MASK);
+		i2c_w_mask(sd, 0x13, 0x00, 0x20); /* Select 16 bit data bus */
+		i2c_w_mask(sd, OV7670_REG_COM8, OV7670_COM8_AWB,
+				OV7670_COM8_AWB);
+		if (qvga) {		/* QVGA from ov7670.c by
+					 * Jonathan Corbet */
+			xstart = 164;
+			xend = 28;
+			ystart = 14;
+			yend = 494;
+		} else {		/* VGA */
+			xstart = 158;
+			xend = 14;
+			ystart = 10;
+			yend = 490;
+		}
+		/* OV7670 hardware window registers are split across
+		 * multiple locations */
+		i2c_w(sd, OV7670_REG_HSTART, xstart >> 3);
+		i2c_w(sd, OV7670_REG_HSTOP, xend >> 3);
+		v = i2c_r(sd, OV7670_REG_HREF);
+		v = (v & 0xc0) | ((xend & 0x7) << 3) | (xstart & 0x07);
+		msleep(10);	/* need to sleep between read and write to
+				 * same reg! */
+		i2c_w(sd, OV7670_REG_HREF, v);
+
+		i2c_w(sd, OV7670_REG_VSTART, ystart >> 2);
+		i2c_w(sd, OV7670_REG_VSTOP, yend >> 2);
+		v = i2c_r(sd, OV7670_REG_VREF);
+		v = (v & 0xc0) | ((yend & 0x3) << 2) | (ystart & 0x03);
+		msleep(10);	/* need to sleep between read and write to
+				 * same reg! */
+		i2c_w(sd, OV7670_REG_VREF, v);
 		break;
 	case SEN_OV6620:
+		i2c_w_mask(sd, 0x14, qvga ? 0x20 : 0x00, 0x20);
+		i2c_w_mask(sd, 0x13, 0x00, 0x20); /* Select 16 bit data bus */
+		i2c_w_mask(sd, 0x12, 0x04, 0x06); /* AWB: 1 Test pattern: 0 */
+		break;
 	case SEN_OV6630:
 	case SEN_OV66308AF:
 		i2c_w_mask(sd, 0x14, qvga ? 0x20 : 0x00, 0x20);
+		i2c_w_mask(sd, 0x12, 0x04, 0x06); /* AWB: 1 Test pattern: 0 */
 		break;
 	default:
 		return -EINVAL;
 	}
 
-	/******** Palette-specific regs ********/
-
-	/* The OV518 needs special treatment. Although both the OV518
-	 * and the OV6630 support a 16-bit video bus, only the 8 bit Y
-	 * bus is actually used. The UV bus is tied to ground.
-	 * Therefore, the OV6630 needs to be in 8-bit multiplexed
-	 * output mode */
-
-	/* OV7640 is 8-bit only */
-
-	if (sd->sensor != SEN_OV6630 && sd->sensor != SEN_OV66308AF &&
-					sd->sensor != SEN_OV7640)
-		i2c_w_mask(sd, 0x13, 0x00, 0x20);
-
 	/******** Clock programming ********/
 	i2c_w(sd, 0x11, sd->clockdiv);
 
-	/******** Special Features ********/
-/* no evidence this is possible with OV7670, either */
-	/* Test Pattern */
-	if (sd->sensor != SEN_OV7640 && sd->sensor != SEN_OV7670)
-		i2c_w_mask(sd, 0x12, 0x00, 0x02);
-
-	/* Enable auto white balance */
-	if (sd->sensor == SEN_OV7670)
-		i2c_w_mask(sd, OV7670_REG_COM8, OV7670_COM8_AWB,
-				OV7670_COM8_AWB);
-	else
-		i2c_w_mask(sd, 0x12, 0x04, 0x04);
-
-	/* This will go away as soon as ov51x_mode_init_sensor_regs() */
-	/* is fully tested. */
-	/* 7620/6620/6630? don't have register 0x35, so play it safe */
-	if (sd->sensor == SEN_OV7610 || sd->sensor == SEN_OV76BE) {
-		if (!qvga)
-			i2c_w(sd, 0x35, 0x9e);
-		else
-			i2c_w(sd, 0x35, 0x1e);
-	}
 	return 0;
 }
 
@@ -2659,8 +3751,12 @@ static int set_ov_sensor_window(struct sd *sd)
 	struct gspca_dev *gspca_dev;
 	int qvga, crop;
 	int hwsbase, hwebase, vwsbase, vwebase, hwscale, vwscale;
-	int ret, hstart, hstop, vstop, vstart;
-	__u8 v;
+	int ret;
+
+	/* mode setup is fully handled in mode_init_ov_sensor_regs for these */
+	if (sd->sensor == SEN_OV2610 || sd->sensor == SEN_OV3610 ||
+	    sd->sensor == SEN_OV7670)
+		return mode_init_ov_sensor_regs(sd);
 
 	gspca_dev = &sd->gspca_dev;
 	qvga = gspca_dev->cam.cam_mode[(int) gspca_dev->curr_mode].priv & 1;
@@ -2708,11 +3804,6 @@ static int set_ov_sensor_window(struct sd *sd)
 		hwebase = 0x1a;
 		vwsbase = vwebase = 0x03;
 		break;
-	case SEN_OV7670:
-		/*handling of OV7670 hardware sensor start and stop values
-		 * is very odd, compared to the other OV sensors */
-		vwsbase = vwebase = hwebase = hwsbase = 0x00;
-		break;
 	default:
 		return -EINVAL;
 	}
@@ -2753,58 +3844,11 @@ static int set_ov_sensor_window(struct sd *sd)
 	if (ret < 0)
 		return ret;
 
-	if (sd->sensor == SEN_OV8610) {
-		i2c_w_mask(sd, 0x2d, 0x05, 0x40);
-				/* old 0x95, new 0x05 from windrv 090403 */
-						/* bits 5-7: reserved */
-		i2c_w_mask(sd, 0x28, 0x20, 0x20);
-					/* bit 5: progressive mode on */
-	}
-
-	/* The below is wrong for OV7670s because their window registers
-	 * only store the high bits in 0x17 to 0x1a */
-
-	/* SRH Use sd->max values instead of requested win values */
-	/* SCS Since we're sticking with only the max hardware widths
-	 * for a given mode */
-	/* I can hard code this for OV7670s */
-	/* Yes, these numbers do look odd, but they're tested and work! */
-	if (sd->sensor == SEN_OV7670) {
-		if (qvga) {		/* QVGA from ov7670.c by
-					 * Jonathan Corbet */
-			hstart = 164;
-			hstop = 28;
-			vstart = 14;
-			vstop = 494;
-		} else {		/* VGA */
-			hstart = 158;
-			hstop = 14;
-			vstart = 10;
-			vstop = 490;
-		}
-		/* OV7670 hardware window registers are split across
-		 * multiple locations */
-		i2c_w(sd, OV7670_REG_HSTART, hstart >> 3);
-		i2c_w(sd, OV7670_REG_HSTOP, hstop >> 3);
-		v = i2c_r(sd, OV7670_REG_HREF);
-		v = (v & 0xc0) | ((hstop & 0x7) << 3) | (hstart & 0x07);
-		msleep(10);	/* need to sleep between read and write to
-				 * same reg! */
-		i2c_w(sd, OV7670_REG_HREF, v);
+	i2c_w(sd, 0x17, hwsbase);
+	i2c_w(sd, 0x18, hwebase + (sd->sensor_width >> hwscale));
+	i2c_w(sd, 0x19, vwsbase);
+	i2c_w(sd, 0x1a, vwebase + (sd->sensor_height >> vwscale));
 
-		i2c_w(sd, OV7670_REG_VSTART, vstart >> 2);
-		i2c_w(sd, OV7670_REG_VSTOP, vstop >> 2);
-		v = i2c_r(sd, OV7670_REG_VREF);
-		v = (v & 0xc0) | ((vstop & 0x3) << 2) | (vstart & 0x03);
-		msleep(10);	/* need to sleep between read and write to
-				 * same reg! */
-		i2c_w(sd, OV7670_REG_VREF, v);
-	} else {
-		i2c_w(sd, 0x17, hwsbase);
-		i2c_w(sd, 0x18, hwebase + (sd->gspca_dev.width >> hwscale));
-		i2c_w(sd, 0x19, vwsbase);
-		i2c_w(sd, 0x1a, vwebase + (sd->gspca_dev.height >> vwscale));
-	}
 	return 0;
 }
 
@@ -2814,6 +3858,10 @@ static int sd_start(struct gspca_dev *gspca_dev)
 	struct sd *sd = (struct sd *) gspca_dev;
 	int ret = 0;
 
+	/* Default for most bridges, allow bridge_mode_init_regs to override */
+	sd->sensor_width = sd->gspca_dev.width;
+	sd->sensor_height = sd->gspca_dev.height;
+
 	switch (sd->bridge) {
 	case BRIDGE_OV511:
 	case BRIDGE_OV511PLUS:
@@ -2826,6 +3874,10 @@ static int sd_start(struct gspca_dev *gspca_dev)
 	case BRIDGE_OV519:
 		ret = ov519_mode_init_regs(sd);
 		break;
+	/* case BRIDGE_OVFX2: nothing to do */
+	case BRIDGE_W9968CF:
+		ret = w9968cf_mode_init_regs(sd);
+		break;
 	}
 	if (ret < 0)
 		goto out;
@@ -2859,10 +3911,17 @@ static void sd_stopN(struct gspca_dev *gspca_dev)
 	ov51x_led_control(sd, 0);
 }
 
+static void sd_stop0(struct gspca_dev *gspca_dev)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	if (sd->bridge == BRIDGE_W9968CF)
+		w9968cf_stop0(sd);
+}
+
 static void ov511_pkt_scan(struct gspca_dev *gspca_dev,
-			struct gspca_frame *frame,	/* target */
-			__u8 *in,			/* isoc packet */
-			int len)			/* iso packet length */
+			u8 *in,			/* isoc packet */
+			int len)		/* iso packet length */
 {
 	struct sd *sd = (struct sd *) gspca_dev;
 
@@ -2893,11 +3952,11 @@ static void ov511_pkt_scan(struct gspca_dev *gspca_dev,
 				return;
 			}
 			/* Add 11 byte footer to frame, might be usefull */
-			gspca_frame_add(gspca_dev, LAST_PACKET, frame, in, 11);
+			gspca_frame_add(gspca_dev, LAST_PACKET, in, 11);
 			return;
 		} else {
 			/* Frame start */
-			gspca_frame_add(gspca_dev, FIRST_PACKET, frame, in, 0);
+			gspca_frame_add(gspca_dev, FIRST_PACKET, in, 0);
 			sd->packet_nr = 0;
 		}
 	}
@@ -2906,12 +3965,11 @@ static void ov511_pkt_scan(struct gspca_dev *gspca_dev,
 	len--;
 
 	/* intermediate packet */
-	gspca_frame_add(gspca_dev, INTER_PACKET, frame, in, len);
+	gspca_frame_add(gspca_dev, INTER_PACKET, in, len);
 }
 
 static void ov518_pkt_scan(struct gspca_dev *gspca_dev,
-			struct gspca_frame *frame,	/* target */
-			__u8 *data,			/* isoc packet */
+			u8 *data,			/* isoc packet */
 			int len)			/* iso packet length */
 {
 	struct sd *sd = (struct sd *) gspca_dev;
@@ -2919,8 +3977,8 @@ static void ov518_pkt_scan(struct gspca_dev *gspca_dev,
 	/* A false positive here is likely, until OVT gives me
 	 * the definitive SOF/EOF format */
 	if ((!(data[0] | data[1] | data[2] | data[3] | data[5])) && data[6]) {
-		frame = gspca_frame_add(gspca_dev, LAST_PACKET, frame, data, 0);
-		gspca_frame_add(gspca_dev, FIRST_PACKET, frame, data, 0);
+		gspca_frame_add(gspca_dev, LAST_PACKET, NULL, 0);
+		gspca_frame_add(gspca_dev, FIRST_PACKET, NULL, 0);
 		sd->packet_nr = 0;
 	}
 
@@ -2944,12 +4002,11 @@ static void ov518_pkt_scan(struct gspca_dev *gspca_dev,
 	}
 
 	/* intermediate packet */
-	gspca_frame_add(gspca_dev, INTER_PACKET, frame, data, len);
+	gspca_frame_add(gspca_dev, INTER_PACKET, data, len);
 }
 
 static void ov519_pkt_scan(struct gspca_dev *gspca_dev,
-			struct gspca_frame *frame,	/* target */
-			__u8 *data,			/* isoc packet */
+			u8 *data,			/* isoc packet */
 			int len)			/* iso packet length */
 {
 	/* Header of ov519 is 16 bytes:
@@ -2972,7 +4029,7 @@ static void ov519_pkt_scan(struct gspca_dev *gspca_dev,
 			len -= HDRSZ;
 #undef HDRSZ
 			if (data[0] == 0xff || data[1] == 0xd8)
-				gspca_frame_add(gspca_dev, FIRST_PACKET, frame,
+				gspca_frame_add(gspca_dev, FIRST_PACKET,
 						data, len);
 			else
 				gspca_dev->last_packet_type = DISCARD_PACKET;
@@ -2980,20 +4037,31 @@ static void ov519_pkt_scan(struct gspca_dev *gspca_dev,
 		case 0x51:		/* end of frame */
 			if (data[9] != 0)
 				gspca_dev->last_packet_type = DISCARD_PACKET;
-			gspca_frame_add(gspca_dev, LAST_PACKET, frame,
-					data, 0);
+			gspca_frame_add(gspca_dev, LAST_PACKET,
+					NULL, 0);
 			return;
 		}
 	}
 
 	/* intermediate packet */
-	gspca_frame_add(gspca_dev, INTER_PACKET, frame,
-			data, len);
+	gspca_frame_add(gspca_dev, INTER_PACKET, data, len);
+}
+
+static void ovfx2_pkt_scan(struct gspca_dev *gspca_dev,
+			u8 *data,			/* isoc packet */
+			int len)			/* iso packet length */
+{
+	/* A short read signals EOF */
+	if (len < OVFX2_BULK_SIZE) {
+		gspca_frame_add(gspca_dev, LAST_PACKET, data, len);
+		gspca_frame_add(gspca_dev, FIRST_PACKET, NULL, 0);
+		return;
+	}
+	gspca_frame_add(gspca_dev, INTER_PACKET, data, len);
 }
 
 static void sd_pkt_scan(struct gspca_dev *gspca_dev,
-			struct gspca_frame *frame,	/* target */
-			__u8 *data,			/* isoc packet */
+			u8 *data,			/* isoc packet */
 			int len)			/* iso packet length */
 {
 	struct sd *sd = (struct sd *) gspca_dev;
@@ -3001,14 +4069,20 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
 	switch (sd->bridge) {
 	case BRIDGE_OV511:
 	case BRIDGE_OV511PLUS:
-		ov511_pkt_scan(gspca_dev, frame, data, len);
+		ov511_pkt_scan(gspca_dev, data, len);
 		break;
 	case BRIDGE_OV518:
 	case BRIDGE_OV518PLUS:
-		ov518_pkt_scan(gspca_dev, frame, data, len);
+		ov518_pkt_scan(gspca_dev, data, len);
 		break;
 	case BRIDGE_OV519:
-		ov519_pkt_scan(gspca_dev, frame, data, len);
+		ov519_pkt_scan(gspca_dev, data, len);
+		break;
+	case BRIDGE_OVFX2:
+		ovfx2_pkt_scan(gspca_dev, data, len);
+		break;
+	case BRIDGE_W9968CF:
+		w9968cf_pkt_scan(gspca_dev, data, len);
 		break;
 	}
 }
@@ -3124,7 +4198,8 @@ static void setcolors(struct gspca_dev *gspca_dev)
 
 static void setautobrightness(struct sd *sd)
 {
-	if (sd->sensor == SEN_OV7640 || sd->sensor == SEN_OV7670)
+	if (sd->sensor == SEN_OV7640 || sd->sensor == SEN_OV7670 ||
+	    sd->sensor == SEN_OV2610 || sd->sensor == SEN_OV3610)
 		return;
 
 	i2c_w_mask(sd, 0x2d, sd->autobrightness ? 0x10 : 0x00, 0x10);
@@ -3132,6 +4207,9 @@ static void setautobrightness(struct sd *sd)
 
 static void setfreq(struct sd *sd)
 {
+	if (sd->sensor == SEN_OV2610 || sd->sensor == SEN_OV3610)
+		return;
+
 	if (sd->sensor == SEN_OV7670) {
 		switch (sd->freq) {
 		case 0: /* Banding filter disabled */
@@ -3301,8 +4379,12 @@ static int sd_setfreq(struct gspca_dev *gspca_dev, __s32 val)
 	struct sd *sd = (struct sd *) gspca_dev;
 
 	sd->freq = val;
-	if (gspca_dev->streaming)
+	if (gspca_dev->streaming) {
 		setfreq(sd);
+		/* Ugly but necessary */
+		if (sd->bridge == BRIDGE_W9968CF)
+			w9968cf_set_crop_window(sd);
+	}
 	return 0;
 }
 
@@ -3343,6 +4425,45 @@ static int sd_querymenu(struct gspca_dev *gspca_dev,
 	return -EINVAL;
 }
 
+static int sd_get_jcomp(struct gspca_dev *gspca_dev,
+			struct v4l2_jpegcompression *jcomp)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	if (sd->bridge != BRIDGE_W9968CF)
+		return -EINVAL;
+
+	memset(jcomp, 0, sizeof *jcomp);
+	jcomp->quality = sd->quality;
+	jcomp->jpeg_markers = V4L2_JPEG_MARKER_DHT | V4L2_JPEG_MARKER_DQT |
+			      V4L2_JPEG_MARKER_DRI;
+	return 0;
+}
+
+static int sd_set_jcomp(struct gspca_dev *gspca_dev,
+			struct v4l2_jpegcompression *jcomp)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	if (sd->bridge != BRIDGE_W9968CF)
+		return -EINVAL;
+
+	if (gspca_dev->streaming)
+		return -EBUSY;
+
+	if (jcomp->quality < QUALITY_MIN)
+		sd->quality = QUALITY_MIN;
+	else if (jcomp->quality > QUALITY_MAX)
+		sd->quality = QUALITY_MAX;
+	else
+		sd->quality = jcomp->quality;
+
+	/* Return resulting jcomp params to app */
+	sd_get_jcomp(gspca_dev, jcomp);
+
+	return 0;
+}
+
 /* sub-driver description */
 static const struct sd_desc sd_desc = {
 	.name = MODULE_NAME,
@@ -3352,18 +4473,23 @@ static const struct sd_desc sd_desc = {
 	.init = sd_init,
 	.start = sd_start,
 	.stopN = sd_stopN,
+	.stop0 = sd_stop0,
 	.pkt_scan = sd_pkt_scan,
 	.querymenu = sd_querymenu,
+	.get_jcomp = sd_get_jcomp,
+	.set_jcomp = sd_set_jcomp,
 };
 
 /* -- module initialisation -- */
 static const __devinitdata struct usb_device_id device_table[] = {
+	{USB_DEVICE(0x041e, 0x4003), .driver_info = BRIDGE_W9968CF },
 	{USB_DEVICE(0x041e, 0x4052), .driver_info = BRIDGE_OV519 },
 	{USB_DEVICE(0x041e, 0x405f), .driver_info = BRIDGE_OV519 },
 	{USB_DEVICE(0x041e, 0x4060), .driver_info = BRIDGE_OV519 },
 	{USB_DEVICE(0x041e, 0x4061), .driver_info = BRIDGE_OV519 },
 	{USB_DEVICE(0x041e, 0x4064),
 	 .driver_info = BRIDGE_OV519 | BRIDGE_INVERT_LED },
+	{USB_DEVICE(0x041e, 0x4067), .driver_info = BRIDGE_OV519 },
 	{USB_DEVICE(0x041e, 0x4068),
 	 .driver_info = BRIDGE_OV519 | BRIDGE_INVERT_LED },
 	{USB_DEVICE(0x045e, 0x028c), .driver_info = BRIDGE_OV519 },
@@ -3373,11 +4499,16 @@ static const __devinitdata struct usb_device_id device_table[] = {
 	{USB_DEVICE(0x05a9, 0x0518), .driver_info = BRIDGE_OV518 },
 	{USB_DEVICE(0x05a9, 0x0519), .driver_info = BRIDGE_OV519 },
 	{USB_DEVICE(0x05a9, 0x0530), .driver_info = BRIDGE_OV519 },
+	{USB_DEVICE(0x05a9, 0x2800), .driver_info = BRIDGE_OVFX2 },
 	{USB_DEVICE(0x05a9, 0x4519), .driver_info = BRIDGE_OV519 },
 	{USB_DEVICE(0x05a9, 0x8519), .driver_info = BRIDGE_OV519 },
 	{USB_DEVICE(0x05a9, 0xa511), .driver_info = BRIDGE_OV511PLUS },
 	{USB_DEVICE(0x05a9, 0xa518), .driver_info = BRIDGE_OV518PLUS },
 	{USB_DEVICE(0x0813, 0x0002), .driver_info = BRIDGE_OV511PLUS },
+	{USB_DEVICE(0x0b62, 0x0059), .driver_info = BRIDGE_OVFX2 },
+	{USB_DEVICE(0x0e96, 0xc001), .driver_info = BRIDGE_OVFX2 },
+	{USB_DEVICE(0x1046, 0x9967), .driver_info = BRIDGE_W9968CF },
+	{USB_DEVICE(0x8020, 0xEF04), .driver_info = BRIDGE_OVFX2 },
 	{}
 };
 
diff --git a/drivers/media/video/gspca/ov534.c b/drivers/media/video/gspca/ov534.c
index 4b528b372911..0a6b8f07a69d 100644
--- a/drivers/media/video/gspca/ov534.c
+++ b/drivers/media/video/gspca/ov534.c
@@ -1,5 +1,6 @@
 /*
  * ov534 gspca driver
+ *
  * Copyright (C) 2008 Antonio Ospite <ospite@studenti.unina.it>
  * Copyright (C) 2008 Jim Paris <jim@jtan.com>
  * Copyright (C) 2009 Jean-Francois Moine http://moinejf.free.fr
@@ -8,6 +9,10 @@
  * USB protocol reverse engineered by Jim Paris <jim@jtan.com>
  * https://jim.sh/svn/jim/devl/playstation/ps3/eye/test/
  *
+ * PS3 Eye camera enhanced by Richard Kaswy http://kaswy.free.fr
+ * PS3 Eye camera, brightness, contrast, hue, AWB control added
+ *	by Max Thrun <bear24rw@gmail.com>
+ *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 2 of the License, or
@@ -51,16 +56,335 @@ struct sd {
 	u16 last_fid;
 	u8 frame_rate;
 
+	u8 brightness;
+	u8 contrast;
+	u8 gain;
+	u8 exposure;
+	u8 redblc;
+	u8 blueblc;
+	u8 hue;
+	u8 autogain;
+	u8 awb;
+	s8 sharpness;
+	u8 hflip;
+	u8 vflip;
+	u8 satur;
+	u8 lightfreq;
+
 	u8 sensor;
 #define SENSOR_OV772X 0
 #define SENSOR_OV965X 1
 };
 
 /* V4L2 controls supported by the driver */
-static struct ctrl sd_ctrls[] = {
+static int sd_setgain(struct gspca_dev *gspca_dev, __s32 val);
+static int sd_getgain(struct gspca_dev *gspca_dev, __s32 *val);
+static int sd_setexposure(struct gspca_dev *gspca_dev, __s32 val);
+static int sd_getexposure(struct gspca_dev *gspca_dev, __s32 *val);
+static int sd_setredblc(struct gspca_dev *gspca_dev, __s32 val);
+static int sd_getredblc(struct gspca_dev *gspca_dev, __s32 *val);
+static int sd_setblueblc(struct gspca_dev *gspca_dev, __s32 val);
+static int sd_getblueblc(struct gspca_dev *gspca_dev, __s32 *val);
+static int sd_setautogain(struct gspca_dev *gspca_dev, __s32 val);
+static int sd_getautogain(struct gspca_dev *gspca_dev, __s32 *val);
+static int sd_setsharpness(struct gspca_dev *gspca_dev, __s32 val);
+static int sd_getsharpness(struct gspca_dev *gspca_dev, __s32 *val);
+static int sd_sethflip(struct gspca_dev *gspca_dev, __s32 val);
+static int sd_gethflip(struct gspca_dev *gspca_dev, __s32 *val);
+static int sd_setvflip(struct gspca_dev *gspca_dev, __s32 val);
+static int sd_getvflip(struct gspca_dev *gspca_dev, __s32 *val);
+static int sd_sethue(struct gspca_dev *gspca_dev, __s32 val);
+static int sd_gethue(struct gspca_dev *gspca_dev, __s32 *val);
+static int sd_setawb(struct gspca_dev *gspca_dev, __s32 val);
+static int sd_getawb(struct gspca_dev *gspca_dev, __s32 *val);
+static int sd_setbrightness(struct gspca_dev *gspca_dev, __s32 val);
+static int sd_getbrightness(struct gspca_dev *gspca_dev, __s32 *val);
+static int sd_setcontrast(struct gspca_dev *gspca_dev, __s32 val);
+static int sd_getcontrast(struct gspca_dev *gspca_dev, __s32 *val);
+static int sd_setsatur(struct gspca_dev *gspca_dev, __s32 val);
+static int sd_getsatur(struct gspca_dev *gspca_dev, __s32 *val);
+static int sd_setfreq(struct gspca_dev *gspca_dev, __s32 val);
+static int sd_getfreq(struct gspca_dev *gspca_dev, __s32 *val);
+
+static struct ctrl sd_ctrls_ov772x[] = {
+    {							/* 0 */
+	{
+		.id      = V4L2_CID_BRIGHTNESS,
+		.type    = V4L2_CTRL_TYPE_INTEGER,
+		.name    = "Brightness",
+		.minimum = 0,
+		.maximum = 255,
+		.step    = 1,
+#define BRIGHTNESS_77_DEF 20
+		.default_value = BRIGHTNESS_77_DEF,
+	},
+	.set = sd_setbrightness,
+	.get = sd_getbrightness,
+    },
+    {							/* 1 */
+	{
+		.id      = V4L2_CID_CONTRAST,
+		.type    = V4L2_CTRL_TYPE_INTEGER,
+		.name    = "Contrast",
+		.minimum = 0,
+		.maximum = 255,
+		.step    = 1,
+#define CONTRAST_77_DEF 37
+		.default_value = CONTRAST_77_DEF,
+	},
+	.set = sd_setcontrast,
+	.get = sd_getcontrast,
+    },
+    {							/* 2 */
+	{
+	    .id      = V4L2_CID_GAIN,
+	    .type    = V4L2_CTRL_TYPE_INTEGER,
+	    .name    = "Main Gain",
+	    .minimum = 0,
+	    .maximum = 63,
+	    .step    = 1,
+#define GAIN_DEF 20
+	    .default_value = GAIN_DEF,
+	},
+	.set = sd_setgain,
+	.get = sd_getgain,
+    },
+    {							/* 3 */
+	{
+	    .id      = V4L2_CID_EXPOSURE,
+	    .type    = V4L2_CTRL_TYPE_INTEGER,
+	    .name    = "Exposure",
+	    .minimum = 0,
+	    .maximum = 255,
+	    .step    = 1,
+#define EXPO_77_DEF 120
+	    .default_value = EXPO_77_DEF,
+	},
+	.set = sd_setexposure,
+	.get = sd_getexposure,
+    },
+    {							/* 4 */
+	{
+	    .id      = V4L2_CID_RED_BALANCE,
+	    .type    = V4L2_CTRL_TYPE_INTEGER,
+	    .name    = "Red Balance",
+	    .minimum = 0,
+	    .maximum = 255,
+	    .step    = 1,
+#define RED_BALANCE_DEF 128
+	    .default_value = RED_BALANCE_DEF,
+	},
+	.set = sd_setredblc,
+	.get = sd_getredblc,
+    },
+    {							/* 5 */
+	{
+	    .id      = V4L2_CID_BLUE_BALANCE,
+	    .type    = V4L2_CTRL_TYPE_INTEGER,
+	    .name    = "Blue Balance",
+	    .minimum = 0,
+	    .maximum = 255,
+	    .step    = 1,
+#define BLUE_BALANCE_DEF 128
+	    .default_value = BLUE_BALANCE_DEF,
+	},
+	.set = sd_setblueblc,
+	.get = sd_getblueblc,
+    },
+    {							/* 6 */
+	{
+		.id      = V4L2_CID_HUE,
+		.type    = V4L2_CTRL_TYPE_INTEGER,
+		.name    = "Hue",
+		.minimum = 0,
+		.maximum = 255,
+		.step    = 1,
+#define HUE_DEF 143
+		.default_value = HUE_DEF,
+	},
+	.set = sd_sethue,
+	.get = sd_gethue,
+    },
+    {							/* 7 */
+	{
+	    .id      = V4L2_CID_AUTOGAIN,
+	    .type    = V4L2_CTRL_TYPE_BOOLEAN,
+	    .name    = "Autogain",
+	    .minimum = 0,
+	    .maximum = 1,
+	    .step    = 1,
+#define AUTOGAIN_77_DEF 0
+	    .default_value = AUTOGAIN_77_DEF,
+	},
+	.set = sd_setautogain,
+	.get = sd_getautogain,
+    },
+#define AWB_77_IDX 8
+    {							/* 8 */
+	{
+		.id      = V4L2_CID_AUTO_WHITE_BALANCE,
+		.type    = V4L2_CTRL_TYPE_BOOLEAN,
+		.name    = "Auto White Balance",
+		.minimum = 0,
+		.maximum = 1,
+		.step    = 1,
+#define AWB_DEF 0
+		.default_value = AWB_DEF,
+	},
+	.set = sd_setawb,
+	.get = sd_getawb,
+    },
+    {							/* 9 */
+	{
+	    .id      = V4L2_CID_SHARPNESS,
+	    .type    = V4L2_CTRL_TYPE_INTEGER,
+	    .name    = "Sharpness",
+	    .minimum = 0,
+	    .maximum = 63,
+	    .step    = 1,
+#define SHARPNESS_77_DEF 0
+	    .default_value = SHARPNESS_77_DEF,
+	},
+	.set = sd_setsharpness,
+	.get = sd_getsharpness,
+    },
+    {							/* 10 */
+	{
+	    .id      = V4L2_CID_HFLIP,
+	    .type    = V4L2_CTRL_TYPE_BOOLEAN,
+	    .name    = "HFlip",
+	    .minimum = 0,
+	    .maximum = 1,
+	    .step    = 1,
+#define HFLIP_DEF 0
+	    .default_value = HFLIP_DEF,
+	},
+	.set = sd_sethflip,
+	.get = sd_gethflip,
+    },
+    {							/* 11 */
+	{
+	    .id      = V4L2_CID_VFLIP,
+	    .type    = V4L2_CTRL_TYPE_BOOLEAN,
+	    .name    = "VFlip",
+	    .minimum = 0,
+	    .maximum = 1,
+	    .step    = 1,
+#define VFLIP_DEF 0
+	    .default_value = VFLIP_DEF,
+	},
+	.set = sd_setvflip,
+	.get = sd_getvflip,
+    },
+};
+static struct ctrl sd_ctrls_ov965x[] = {
+    {							/* 0 */
+	{
+		.id      = V4L2_CID_BRIGHTNESS,
+		.type    = V4L2_CTRL_TYPE_INTEGER,
+		.name    = "Brightness",
+		.minimum = 0,
+		.maximum = 15,
+		.step    = 1,
+#define BRIGHTNESS_96_DEF 7
+		.default_value = BRIGHTNESS_96_DEF,
+	},
+	.set = sd_setbrightness,
+	.get = sd_getbrightness,
+    },
+    {							/* 1 */
+	{
+		.id      = V4L2_CID_CONTRAST,
+		.type    = V4L2_CTRL_TYPE_INTEGER,
+		.name    = "Contrast",
+		.minimum = 0,
+		.maximum = 15,
+		.step    = 1,
+#define CONTRAST_96_DEF 3
+		.default_value = CONTRAST_96_DEF,
+	},
+	.set = sd_setcontrast,
+	.get = sd_getcontrast,
+    },
+    {							/* 2 */
+	{
+	    .id      = V4L2_CID_AUTOGAIN,
+	    .type    = V4L2_CTRL_TYPE_BOOLEAN,
+	    .name    = "Autogain",
+	    .minimum = 0,
+	    .maximum = 1,
+	    .step    = 1,
+#define AUTOGAIN_96_DEF 1
+	    .default_value = AUTOGAIN_96_DEF,
+	},
+	.set = sd_setautogain,
+	.get = sd_getautogain,
+    },
+#define EXPO_96_IDX 3
+    {							/* 3 */
+	{
+	    .id      = V4L2_CID_EXPOSURE,
+	    .type    = V4L2_CTRL_TYPE_INTEGER,
+	    .name    = "Exposure",
+	    .minimum = 0,
+	    .maximum = 3,
+	    .step    = 1,
+#define EXPO_96_DEF 0
+	    .default_value = EXPO_96_DEF,
+	},
+	.set = sd_setexposure,
+	.get = sd_getexposure,
+    },
+    {							/* 4 */
+	{
+	    .id      = V4L2_CID_SHARPNESS,
+	    .type    = V4L2_CTRL_TYPE_INTEGER,
+	    .name    = "Sharpness",
+	    .minimum = -1,		/* -1 = auto */
+	    .maximum = 4,
+	    .step    = 1,
+#define SHARPNESS_96_DEF -1
+	    .default_value = SHARPNESS_96_DEF,
+	},
+	.set = sd_setsharpness,
+	.get = sd_getsharpness,
+    },
+    {							/* 5 */
+	{
+		.id      = V4L2_CID_SATURATION,
+		.type    = V4L2_CTRL_TYPE_INTEGER,
+		.name    = "Saturation",
+		.minimum = 0,
+		.maximum = 4,
+		.step    = 1,
+#define SATUR_DEF 2
+		.default_value = SATUR_DEF,
+	},
+	.set = sd_setsatur,
+	.get = sd_getsatur,
+    },
+    {
+	{
+		.id	 = V4L2_CID_POWER_LINE_FREQUENCY,
+		.type    = V4L2_CTRL_TYPE_MENU,
+		.name    = "Light frequency filter",
+		.minimum = 0,
+		.maximum = 2,	/* 0: 0, 1: 50Hz, 2:60Hz */
+		.step    = 1,
+#define FREQ_DEF 0
+		.default_value = FREQ_DEF,
+	},
+	.set = sd_setfreq,
+	.get = sd_getfreq,
+    },
 };
 
-static const struct v4l2_pix_format vga_yuyv_mode[] = {
+static const struct v4l2_pix_format ov772x_mode[] = {
+	{320, 240, V4L2_PIX_FMT_YUYV, V4L2_FIELD_NONE,
+	 .bytesperline = 320 * 2,
+	 .sizeimage = 320 * 240 * 2,
+	 .colorspace = V4L2_COLORSPACE_SRGB,
+	 .priv = 1},
 	{640, 480, V4L2_PIX_FMT_YUYV, V4L2_FIELD_NONE,
 	 .bytesperline = 640 * 2,
 	 .sizeimage = 640 * 480 * 2,
@@ -68,20 +392,35 @@ static const struct v4l2_pix_format vga_yuyv_mode[] = {
 	 .priv = 0},
 };
 
-static const struct v4l2_pix_format vga_jpeg_mode[] = {
+static const struct v4l2_pix_format ov965x_mode[] = {
 	{320, 240, V4L2_PIX_FMT_JPEG, V4L2_FIELD_NONE,
 	 .bytesperline = 320,
 	 .sizeimage = 320 * 240 * 3 / 8 + 590,
 	 .colorspace = V4L2_COLORSPACE_JPEG,
-	 .priv = 1},
+	 .priv = 4},
 	{640, 480, V4L2_PIX_FMT_JPEG, V4L2_FIELD_NONE,
 	 .bytesperline = 640,
 	 .sizeimage = 640 * 480 * 3 / 8 + 590,
 	 .colorspace = V4L2_COLORSPACE_JPEG,
+	 .priv = 3},
+	{800, 600, V4L2_PIX_FMT_JPEG, V4L2_FIELD_NONE,
+	 .bytesperline = 800,
+	 .sizeimage = 800 * 600 * 3 / 8 + 590,
+	 .colorspace = V4L2_COLORSPACE_JPEG,
+	 .priv = 2},
+	{1024, 768, V4L2_PIX_FMT_JPEG, V4L2_FIELD_NONE,
+	 .bytesperline = 1024,
+	 .sizeimage = 1024 * 768 * 3 / 8 + 590,
+	 .colorspace = V4L2_COLORSPACE_JPEG,
+	 .priv = 1},
+	{1280, 1024, V4L2_PIX_FMT_JPEG, V4L2_FIELD_NONE,
+	 .bytesperline = 1280,
+	 .sizeimage = 1280 * 1024 * 3 / 8 + 590,
+	 .colorspace = V4L2_COLORSPACE_JPEG,
 	 .priv = 0},
 };
 
-static const u8 bridge_init_ov722x[][2] = {
+static const u8 bridge_init_ov772x[][2] = {
 	{ 0xc2, 0x0c },
 	{ 0x88, 0xf8 },
 	{ 0xc3, 0x69 },
@@ -122,6 +461,7 @@ static const u8 bridge_init_ov722x[][2] = {
 	{ 0x1d, 0x40 },
 	{ 0x1d, 0x02 }, /* payload size 0x0200 * 4 = 2048 bytes */
 	{ 0x1d, 0x00 }, /* payload size */
+
 	{ 0x1d, 0x02 }, /* frame size 0x025800 * 4 = 614400 */
 	{ 0x1d, 0x58 }, /* frame size */
 	{ 0x1d, 0x00 }, /* frame size */
@@ -138,10 +478,20 @@ static const u8 bridge_init_ov722x[][2] = {
 	{ 0xc1, 0x3c },
 	{ 0xc2, 0x0c },
 };
-
-static const u8 sensor_init_ov722x[][2] = {
+static const u8 sensor_init_ov772x[][2] = {
 	{ 0x12, 0x80 },
 	{ 0x11, 0x01 },
+/*fixme: better have a delay?*/
+	{ 0x11, 0x01 },
+	{ 0x11, 0x01 },
+	{ 0x11, 0x01 },
+	{ 0x11, 0x01 },
+	{ 0x11, 0x01 },
+	{ 0x11, 0x01 },
+	{ 0x11, 0x01 },
+	{ 0x11, 0x01 },
+	{ 0x11, 0x01 },
+	{ 0x11, 0x01 },
 
 	{ 0x3d, 0x03 },
 	{ 0x17, 0x26 },
@@ -154,10 +504,10 @@ static const u8 sensor_init_ov722x[][2] = {
 	{ 0x65, 0x20 },
 	{ 0x11, 0x01 },
 	{ 0x42, 0x7f },
-	{ 0x63, 0xe0 },
+	{ 0x63, 0xaa },		/* AWB - was e0 */
 	{ 0x64, 0xff },
 	{ 0x66, 0x00 },
-	{ 0x13, 0xf0 },
+	{ 0x13, 0xf0 },		/* com8 */
 	{ 0x0d, 0x41 },
 	{ 0x0f, 0xc5 },
 	{ 0x14, 0x11 },
@@ -170,7 +520,7 @@ static const u8 sensor_init_ov722x[][2] = {
 	{ 0x2a, 0x00 },
 	{ 0x2b, 0x00 },
 	{ 0x6b, 0xaa },
-	{ 0x13, 0xff },
+	{ 0x13, 0xff },		/* AWB */
 
 	{ 0x90, 0x05 },
 	{ 0x91, 0x01 },
@@ -218,9 +568,51 @@ static const u8 sensor_init_ov722x[][2] = {
 	{ 0x14, 0x41 },
 	{ 0x0e, 0xcd },
 	{ 0xac, 0xbf },
-	{ 0x8e, 0x00 },
+	{ 0x8e, 0x00 },		/* De-noise threshold */
 	{ 0x0c, 0xd0 }
 };
+static const u8 bridge_start_ov772x_vga[][2] = {
+	{0x1c, 0x00},
+	{0x1d, 0x40},
+	{0x1d, 0x02},
+	{0x1d, 0x00},
+	{0x1d, 0x02},
+	{0x1d, 0x58},
+	{0x1d, 0x00},
+	{0xc0, 0x50},
+	{0xc1, 0x3c},
+};
+static const u8 sensor_start_ov772x_vga[][2] = {
+	{0x12, 0x00},
+	{0x17, 0x26},
+	{0x18, 0xa0},
+	{0x19, 0x07},
+	{0x1a, 0xf0},
+	{0x29, 0xa0},
+	{0x2c, 0xf0},
+	{0x65, 0x20},
+};
+static const u8 bridge_start_ov772x_qvga[][2] = {
+	{0x1c, 0x00},
+	{0x1d, 0x40},
+	{0x1d, 0x02},
+	{0x1d, 0x00},
+	{0x1d, 0x01},
+	{0x1d, 0x4b},
+	{0x1d, 0x00},
+	{0xc0, 0x28},
+	{0xc1, 0x1e},
+};
+static const u8 sensor_start_ov772x_qvga[][2] = {
+	{0x12, 0x40},
+	{0x17, 0x3f},
+	{0x18, 0x50},
+	{0x19, 0x03},
+	{0x1a, 0x78},
+	{0x29, 0x50},
+	{0x2c, 0x78},
+	{0x65, 0x2f},
+};
 
 static const u8 bridge_init_ov965x[][2] = {
 	{0x88, 0xf8},
@@ -403,7 +795,7 @@ static const u8 sensor_init_ov965x[][2] = {
 	{0xcb, 0xf0},
 	{0xcc, 0xd8},
 	{0xcd, 0xf1},
-	{0x4f, 0x98},
+	{0x4f, 0x98},	/* matrix */
 	{0x50, 0x98},
 	{0x51, 0x00},
 	{0x52, 0x28},
@@ -412,6 +804,7 @@ static const u8 sensor_init_ov965x[][2] = {
 	{0x58, 0x1a},
 	{0xff, 0x41},	/* read 41, write ff 00 */
 	{0x41, 0x40},	/* com16 */
+
 	{0xc5, 0x03},	/* 60 Hz banding filter */
 	{0x6a, 0x02},	/* 50 Hz banding filter */
 
@@ -455,8 +848,8 @@ static const u8 bridge_init_ov965x_2[][2] = {
 	{0x52, 0x3c},
 	{0x53, 0x00},
 	{0x54, 0x00},
-	{0x55, 0x00},	/* brightness */
-	{0x57, 0x00},	/* contrast 2 */
+	{0x55, 0x00},
+	{0x57, 0x00},
 	{0x5c, 0x00},
 	{0x5a, 0xa0},
 	{0x5b, 0x78},
@@ -479,14 +872,16 @@ static const u8 sensor_init_ov965x_2[][2] = {
 	{0xa3, 0x3e},
 	{0x2d, 0x00},
 	{0xff, 0x42},	/* read 42, write ff 00 */
-	{0x42, 0xc0},
+	{0x42, 0xc0},	/* com17 */
 	{0x2d, 0x00},
 	{0xff, 0x42},	/* read 42, write ff 00 */
-	{0x42, 0xc1},
+	{0x42, 0xc1},	/* com17 */
+/* sharpness */
 	{0x3f, 0x01},
 	{0xff, 0x42},	/* read 42, write ff 00 */
-	{0x42, 0xc1},
-	{0x4f, 0x98},
+	{0x42, 0xc1},	/* com17 */
+/* saturation */
+	{0x4f, 0x98},	/* matrix */
 	{0x50, 0x98},
 	{0x51, 0x00},
 	{0x52, 0x28},
@@ -495,14 +890,17 @@ static const u8 sensor_init_ov965x_2[][2] = {
 	{0x58, 0x1a},
 	{0xff, 0x41},	/* read 41, write ff 00 */
 	{0x41, 0x40},	/* com16 */
+/* contrast */
 	{0x56, 0x40},
+/* brightness */
 	{0x55, 0x8f},
+/* expo */
 	{0x10, 0x25},	/* aech - exposure high bits */
 	{0xff, 0x13},	/* read 13, write ff 00 */
 	{0x13, 0xe7},	/* com8 - everything (AGC, AWB and AEC) */
 };
 
-static const u8 sensor_start_ov965x[][2] = {
+static const u8 sensor_start_ov965x_1_vga[][2] = {	/* same for qvga */
 	{0x12, 0x62},	/* com7 - 30fps VGA YUV */
 	{0x36, 0xfa},	/* aref3 */
 	{0x69, 0x0a},	/* hv */
@@ -523,10 +921,77 @@ static const u8 sensor_start_ov965x[][2] = {
 	{0x1a, 0x3d},	/* vstop */
 	{0x32, 0xff},	/* href */
 	{0xc0, 0xaa},
-	{}
 };
 
-static const u8 bridge_start_ov965x[][2] = {
+static const u8 sensor_start_ov965x_1_svga[][2] = {
+	{0x12, 0x02},	/* com7 - YUYV - VGA 15 full resolution */
+	{0x36, 0xf8},	/* aref3 */
+	{0x69, 0x02},	/* hv */
+	{0x8c, 0x0d},	/* com22 */
+	{0x3e, 0x0c},	/* com14 */
+	{0x41, 0x40},	/* com16 */
+	{0x72, 0x00},
+	{0x73, 0x01},
+	{0x74, 0x3a},
+	{0x75, 0x35},
+	{0x76, 0x01},
+	{0xc7, 0x80},	/* com24 */
+	{0x03, 0x1b},	/* vref */
+	{0x17, 0x1d},	/* hstart */
+	{0x18, 0xbd},	/* hstop */
+	{0x19, 0x01},	/* vstrt */
+	{0x1a, 0x81},	/* vstop */
+	{0x32, 0xff},	/* href */
+	{0xc0, 0xe2},
+};
+
+static const u8 sensor_start_ov965x_1_xga[][2] = {
+	{0x12, 0x02},	/* com7 */
+	{0x36, 0xf8},	/* aref3 */
+	{0x69, 0x02},	/* hv */
+	{0x8c, 0x89},	/* com22 */
+	{0x14, 0x28},	/* com9 */
+	{0x3e, 0x0c},	/* com14 */
+	{0x41, 0x40},	/* com16 */
+	{0x72, 0x00},
+	{0x73, 0x01},
+	{0x74, 0x3a},
+	{0x75, 0x35},
+	{0x76, 0x01},
+	{0xc7, 0x80},	/* com24 */
+	{0x03, 0x1b},	/* vref */
+	{0x17, 0x1d},	/* hstart */
+	{0x18, 0xbd},	/* hstop */
+	{0x19, 0x01},	/* vstrt */
+	{0x1a, 0x81},	/* vstop */
+	{0x32, 0xff},	/* href */
+	{0xc0, 0xe2},
+};
+
+static const u8 sensor_start_ov965x_1_sxga[][2] = {
+	{0x12, 0x02},	/* com7 */
+	{0x36, 0xf8},	/* aref3 */
+	{0x69, 0x02},	/* hv */
+	{0x8c, 0x89},	/* com22 */
+	{0x14, 0x28},	/* com9 */
+	{0x3e, 0x0c},	/* com14 */
+	{0x41, 0x40},	/* com16 */
+	{0x72, 0x00},
+	{0x73, 0x01},
+	{0x74, 0x3a},
+	{0x75, 0x35},
+	{0x76, 0x01},
+	{0xc7, 0x80},	/* com24 */
+	{0x03, 0x1b},	/* vref */
+	{0x17, 0x1d},	/* hstart */
+	{0x18, 0x02},	/* hstop */
+	{0x19, 0x01},	/* vstrt */
+	{0x1a, 0x81},	/* vstop */
+	{0x32, 0xff},	/* href */
+	{0xc0, 0xe2},
+};
+
+static const u8 bridge_start_ov965x_qvga[][2] = {
 	{0x94, 0xaa},
 	{0xf1, 0x60},
 	{0xe5, 0x04},
@@ -535,10 +1000,34 @@ static const u8 bridge_start_ov965x[][2] = {
 	{0x8c, 0x00},
 	{0x8d, 0x1c},
 	{0x34, 0x05},
-	{}
+
+	{0xc2, 0x4c},
+	{0xc3, 0xf9},
+	{0xda, 0x00},
+	{0x50, 0x00},
+	{0x51, 0xa0},
+	{0x52, 0x78},
+	{0x53, 0x00},
+	{0x54, 0x00},
+	{0x55, 0x00},
+	{0x57, 0x00},
+	{0x5c, 0x00},
+	{0x5a, 0x50},
+	{0x5b, 0x3c},
+	{0x35, 0x02},
+	{0xd9, 0x10},
+	{0x94, 0x11},
 };
 
 static const u8 bridge_start_ov965x_vga[][2] = {
+	{0x94, 0xaa},
+	{0xf1, 0x60},
+	{0xe5, 0x04},
+	{0xc0, 0x50},
+	{0xc1, 0x3c},
+	{0x8c, 0x00},
+	{0x8d, 0x1c},
+	{0x34, 0x05},
 	{0xc2, 0x0c},
 	{0xc3, 0xf9},
 	{0xda, 0x01},
@@ -555,30 +1044,98 @@ static const u8 bridge_start_ov965x_vga[][2] = {
 	{0x35, 0x02},
 	{0xd9, 0x10},
 	{0x94, 0x11},
-	{}
 };
 
-static const u8 bridge_start_ov965x_cif[][2] = {
+static const u8 bridge_start_ov965x_svga[][2] = {
+	{0x94, 0xaa},
+	{0xf1, 0x60},
+	{0xe5, 0x04},
+	{0xc0, 0xa0},
+	{0xc1, 0x80},
+	{0x8c, 0x00},
+	{0x8d, 0x1c},
+	{0x34, 0x05},
 	{0xc2, 0x4c},
 	{0xc3, 0xf9},
-	{0xda, 0x00},
 	{0x50, 0x00},
-	{0x51, 0xa0},
-	{0x52, 0x78},
+	{0x51, 0x40},
+	{0x52, 0x00},
 	{0x53, 0x00},
 	{0x54, 0x00},
-	{0x55, 0x00},
+	{0x55, 0x88},
 	{0x57, 0x00},
 	{0x5c, 0x00},
-	{0x5a, 0x50},
-	{0x5b, 0x3c},
+	{0x5a, 0xc8},
+	{0x5b, 0x96},
 	{0x35, 0x02},
 	{0xd9, 0x10},
+	{0xda, 0x00},
 	{0x94, 0x11},
-	{}
 };
 
-static const u8 sensor_start_ov965x_vga[][2] = {
+static const u8 bridge_start_ov965x_xga[][2] = {
+	{0x94, 0xaa},
+	{0xf1, 0x60},
+	{0xe5, 0x04},
+	{0xc0, 0xa0},
+	{0xc1, 0x80},
+	{0x8c, 0x00},
+	{0x8d, 0x1c},
+	{0x34, 0x05},
+	{0xc2, 0x4c},
+	{0xc3, 0xf9},
+	{0x50, 0x00},
+	{0x51, 0x40},
+	{0x52, 0x00},
+	{0x53, 0x00},
+	{0x54, 0x00},
+	{0x55, 0x88},
+	{0x57, 0x00},
+	{0x5c, 0x01},
+	{0x5a, 0x00},
+	{0x5b, 0xc0},
+	{0x35, 0x02},
+	{0xd9, 0x10},
+	{0xda, 0x01},
+	{0x94, 0x11},
+};
+
+static const u8 bridge_start_ov965x_sxga[][2] = {
+	{0x94, 0xaa},
+	{0xf1, 0x60},
+	{0xe5, 0x04},
+	{0xc0, 0xa0},
+	{0xc1, 0x80},
+	{0x8c, 0x00},
+	{0x8d, 0x1c},
+	{0x34, 0x05},
+	{0xc2, 0x0c},
+	{0xc3, 0xf9},
+	{0xda, 0x00},
+	{0x35, 0x02},
+	{0xd9, 0x10},
+	{0x94, 0x11},
+};
+
+static const u8 sensor_start_ov965x_2_qvga[][2] = {
+	{0x3b, 0xe4},	/* com11 - night mode 1/4 frame rate */
+	{0x1e, 0x04},	/* mvfp */
+	{0x13, 0xe0},	/* com8 */
+	{0x00, 0x00},
+	{0x13, 0xe7},	/* com8 - everything (AGC, AWB and AEC) */
+	{0x11, 0x01},	/* clkrc */
+	{0x6b, 0x5a},	/* dblv */
+	{0x6a, 0x02},	/* 50 Hz banding filter */
+	{0xc5, 0x03},	/* 60 Hz banding filter */
+	{0xa2, 0x96},	/* bd50 */
+	{0xa3, 0x7d},	/* bd60 */
+
+	{0xff, 0x13},	/* read 13, write ff 00 */
+	{0x13, 0xe7},
+	{0x3a, 0x80},	/* tslb - yuyv */
+};
+
+static const u8 sensor_start_ov965x_2_vga[][2] = {
 	{0x3b, 0xc4},	/* com11 - night mode 1/4 frame rate */
 	{0x1e, 0x04},	/* mvfp */
 	{0x13, 0xe0},	/* com8 */
@@ -592,35 +1149,36 @@ static const u8 sensor_start_ov965x_vga[][2] = {
 	{0xa3, 0x3e},	/* bd60 */
 
 	{0x2d, 0x00},	/* advfl */
-	{}
 };
 
-static const u8 sensor_start_ov965x_cif[][2] = {
-	{0x3b, 0xe4},	/* com11 - night mode 1/4 frame rate */
+static const u8 sensor_start_ov965x_2_svga[][2] = {	/* same for xga */
+	{0x3b, 0xc4},	/* com11 - night mode 1/4 frame rate */
 	{0x1e, 0x04},	/* mvfp */
 	{0x13, 0xe0},	/* com8 */
 	{0x00, 0x00},
 	{0x13, 0xe7},	/* com8 - everything (AGC, AWB and AEC) */
 	{0x11, 0x01},	/* clkrc */
 	{0x6b, 0x5a},	/* dblv */
-	{0x6a, 0x02},	/* 50 Hz banding filter */
-	{0xc5, 0x03},	/* 60 Hz banding filter */
-	{0xa2, 0x96},	/* bd50 */
-	{0xa3, 0x7d},	/* bd60 */
-
-	{0xff, 0x13},	/* read 13, write ff 00 */
-	{0x13, 0xe7},
-	{0x3a, 0x80},	/* tslb - yuyv */
-	{}
+	{0x6a, 0x0c},	/* 50 Hz banding filter */
+	{0xc5, 0x0f},	/* 60 Hz banding filter */
+	{0xa2, 0x4e},	/* bd50 */
+	{0xa3, 0x41},	/* bd60 */
 };
 
-static const u8 sensor_start_ov965x_2[][2] = {
-	{0xff, 0x42},	/* read 42, write ff 00 */
-	{0x42, 0xc1},	/* com17 - 50 Hz filter */
-	{}
+static const u8 sensor_start_ov965x_2_sxga[][2] = {
+	{0x13, 0xe0},	/* com8 */
+	{0x00, 0x00},
+	{0x13, 0xe7},	/* com8 - everything (AGC, AWB and AEC) */
+	{0x3b, 0xc4},	/* com11 - night mode 1/4 frame rate */
+	{0x1e, 0x04},	/* mvfp */
+	{0x11, 0x01},	/* clkrc */
+	{0x6b, 0x5a},	/* dblv */
+	{0x6a, 0x0c},	/* 50 Hz banding filter */
+	{0xc5, 0x0f},	/* 60 Hz banding filter */
+	{0xa2, 0x4e},	/* bd50 */
+	{0xa3, 0x41},	/* bd60 */
 };
 
-
 static void ov534_reg_write(struct gspca_dev *gspca_dev, u16 reg, u8 val)
 {
 	struct usb_device *udev = gspca_dev->dev;
@@ -753,39 +1311,310 @@ static void sccb_w_array(struct gspca_dev *gspca_dev,
 	}
 }
 
-/* set framerate */
-static void ov534_set_frame_rate(struct gspca_dev *gspca_dev)
+/* ov772x specific controls */
+static void set_frame_rate(struct gspca_dev *gspca_dev)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+	int i;
+	struct rate_s {
+		u8 fps;
+		u8 r11;
+		u8 r0d;
+		u8 re5;
+	};
+	const struct rate_s *r;
+	static const struct rate_s rate_0[] = {	/* 640x480 */
+		{60, 0x01, 0xc1, 0x04},
+		{50, 0x01, 0x41, 0x02},
+		{40, 0x02, 0xc1, 0x04},
+		{30, 0x04, 0x81, 0x02},
+		{15, 0x03, 0x41, 0x04},
+	};
+	static const struct rate_s rate_1[] = {	/* 320x240 */
+		{125, 0x02, 0x81, 0x02},
+		{100, 0x02, 0xc1, 0x04},
+		{75, 0x03, 0xc1, 0x04},
+		{60, 0x04, 0xc1, 0x04},
+		{50, 0x02, 0x41, 0x04},
+		{40, 0x03, 0x41, 0x04},
+		{30, 0x04, 0x41, 0x04},
+	};
+
+	if (gspca_dev->cam.cam_mode[gspca_dev->curr_mode].priv == 0) {
+		r = rate_0;
+		i = ARRAY_SIZE(rate_0);
+	} else {
+		r = rate_1;
+		i = ARRAY_SIZE(rate_1);
+	}
+	while (--i > 0) {
+		if (sd->frame_rate >= r->fps)
+			break;
+		r++;
+	}
+
+	sccb_reg_write(gspca_dev, 0x11, r->r11);
+	sccb_reg_write(gspca_dev, 0x0d, r->r0d);
+	ov534_reg_write(gspca_dev, 0xe5, r->re5);
+
+	PDEBUG(D_PROBE, "frame_rate: %d", r->fps);
+}
+
+static void setbrightness_77(struct gspca_dev *gspca_dev)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	sccb_reg_write(gspca_dev, 0x9B, sd->brightness);
+}
+
+static void setcontrast_77(struct gspca_dev *gspca_dev)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
-	int fr = sd->frame_rate;
 
-	switch (fr) {
-	case 50:
-		sccb_reg_write(gspca_dev, 0x11, 0x01);
-		sccb_reg_write(gspca_dev, 0x0d, 0x41);
-		ov534_reg_write(gspca_dev, 0xe5, 0x02);
+	sccb_reg_write(gspca_dev, 0x9C, sd->contrast);
+}
+
+static void setgain(struct gspca_dev *gspca_dev)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+	u8 val;
+
+	val = sd->gain;
+	switch (val & 0x30) {
+	case 0x00:
+		val &= 0x0f;
 		break;
-	case 40:
-		sccb_reg_write(gspca_dev, 0x11, 0x02);
-		sccb_reg_write(gspca_dev, 0x0d, 0xc1);
-		ov534_reg_write(gspca_dev, 0xe5, 0x04);
+	case 0x10:
+		val &= 0x0f;
+		val |= 0x30;
 		break;
-/*	case 30: */
-	default:
-		fr = 30;
-		sccb_reg_write(gspca_dev, 0x11, 0x04);
-		sccb_reg_write(gspca_dev, 0x0d, 0x81);
-		ov534_reg_write(gspca_dev, 0xe5, 0x02);
+	case 0x20:
+		val &= 0x0f;
+		val |= 0x70;
 		break;
-	case 15:
-		sccb_reg_write(gspca_dev, 0x11, 0x03);
-		sccb_reg_write(gspca_dev, 0x0d, 0x41);
-		ov534_reg_write(gspca_dev, 0xe5, 0x04);
+	default:
+/*	case 0x30: */
+		val &= 0x0f;
+		val |= 0xf0;
 		break;
 	}
+	sccb_reg_write(gspca_dev, 0x00, val);
+}
+
+static void setexposure_77(struct gspca_dev *gspca_dev)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+	u8 val;
+
+	val = sd->exposure;
+	sccb_reg_write(gspca_dev, 0x08, val >> 7);
+	sccb_reg_write(gspca_dev, 0x10, val << 1);
+}
+
+static void setredblc(struct gspca_dev *gspca_dev)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	sccb_reg_write(gspca_dev, 0x43, sd->redblc);
+}
+
+static void setblueblc(struct gspca_dev *gspca_dev)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	sccb_reg_write(gspca_dev, 0x42, sd->blueblc);
+}
+
+static void sethue(struct gspca_dev *gspca_dev)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	sccb_reg_write(gspca_dev, 0x01, sd->hue);
+}
+
+static void setautogain_77(struct gspca_dev *gspca_dev)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	if (sd->autogain) {
+		sccb_reg_write(gspca_dev, 0x13, 0xf7); /* AGC,AEC,AWB ON */
+		sccb_reg_write(gspca_dev, 0x64,
+				sccb_reg_read(gspca_dev, 0x64) | 0x03);
+	} else {
+		sccb_reg_write(gspca_dev, 0x13, 0xf0); /* AGC,AEC,AWB OFF */
+		sccb_reg_write(gspca_dev, 0x64,
+				sccb_reg_read(gspca_dev, 0x64) & 0xfc);
+	}
+}
+
+static void setawb(struct gspca_dev *gspca_dev)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	if (sd->awb)
+		sccb_reg_write(gspca_dev, 0x63, 0xe0);	/* AWB on */
+	else
+		sccb_reg_write(gspca_dev, 0x63, 0xaa);	/* AWB off */
+}
+
+static void setsharpness_77(struct gspca_dev *gspca_dev)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+	u8 val;
+
+	val = sd->sharpness;
+	sccb_reg_write(gspca_dev, 0x91, val);	/* vga noise */
+	sccb_reg_write(gspca_dev, 0x8e, val);	/* qvga noise */
+}
+
+static void sethflip(struct gspca_dev *gspca_dev)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	if (sd->hflip == 0)
+		sccb_reg_write(gspca_dev, 0x0c,
+				sccb_reg_read(gspca_dev, 0x0c) | 0x40);
+	else
+		sccb_reg_write(gspca_dev, 0x0c,
+				sccb_reg_read(gspca_dev, 0x0c) & 0xbf);
+}
+
+static void setvflip(struct gspca_dev *gspca_dev)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	if (sd->vflip == 0)
+		sccb_reg_write(gspca_dev, 0x0c,
+				sccb_reg_read(gspca_dev, 0x0c) | 0x80);
+	else
+		sccb_reg_write(gspca_dev, 0x0c,
+				sccb_reg_read(gspca_dev, 0x0c) & 0x7f);
+}
+
+/* ov965x specific controls */
+static void setbrightness_96(struct gspca_dev *gspca_dev)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+	u8 val;
+
+	val = sd->brightness;
+	if (val < 8)
+		val = 15 - val;		/* f .. 8 */
+	else
+		val = val - 8;		/* 0 .. 7 */
+	sccb_reg_write(gspca_dev, 0x55,	/* brtn - brightness adjustment */
+			0x0f | (val << 4));
+}
+
+static void setcontrast_96(struct gspca_dev *gspca_dev)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	sccb_reg_write(gspca_dev, 0x56,	/* cnst1 - contrast 1 ctrl coeff */
+			sd->contrast << 4);
+}
+
+static void setexposure_96(struct gspca_dev *gspca_dev)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+	u8 val;
+	static const u8 expo[4] = {0x00, 0x25, 0x38, 0x5e};
+
+	sccb_reg_write(gspca_dev, 0x10,			/* aec[9:2] */
+			expo[sd->exposure]);
+	val = sccb_reg_read(gspca_dev, 0x13);		/* com8 */
+	sccb_reg_write(gspca_dev, 0xff, 0x00);
+	sccb_reg_write(gspca_dev, 0x13, val);
+	val = sccb_reg_read(gspca_dev, 0xa1);		/* aech */
+	sccb_reg_write(gspca_dev, 0xff, 0x00);
+	sccb_reg_write(gspca_dev, 0xa1, val & 0xe0);	/* aec[15:10] = 0 */
+}
+
+static void setsharpness_96(struct gspca_dev *gspca_dev)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+	s8 val;
+
+	val = sd->sharpness;
+	if (val < 0) {				/* auto */
+		val = sccb_reg_read(gspca_dev, 0x42);	/* com17 */
+		sccb_reg_write(gspca_dev, 0xff, 0x00);
+		sccb_reg_write(gspca_dev, 0x42, val | 0x40);
+				/* Edge enhancement strength auto adjust */
+		return;
+	}
+	if (val != 0)
+		val = 1 << (val - 1);
+	sccb_reg_write(gspca_dev, 0x3f,	/* edge - edge enhance. factor */
+			val);
+	val = sccb_reg_read(gspca_dev, 0x42);		/* com17 */
+	sccb_reg_write(gspca_dev, 0xff, 0x00);
+	sccb_reg_write(gspca_dev, 0x42, val & 0xbf);
+}
+
+static void setautogain_96(struct gspca_dev *gspca_dev)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+	u8 val;
+
+/*fixme: should adjust agc/awb/aec by different controls */
+	val = sd->autogain;
+	val = sccb_reg_read(gspca_dev, 0x13);		/* com8 */
+	sccb_reg_write(gspca_dev, 0xff, 0x00);
+	if (sd->autogain)
+		val |= 0x05;		/* agc & aec */
+	else
+		val &= 0xfa;
+	sccb_reg_write(gspca_dev, 0x13, val);
+}
+
+static void setsatur(struct gspca_dev *gspca_dev)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+	u8 val1, val2, val3;
+	static const u8 matrix[5][2] = {
+		{0x14, 0x38},
+		{0x1e, 0x54},
+		{0x28, 0x70},
+		{0x32, 0x8c},
+		{0x48, 0x90}
+	};
+
+	val1 = matrix[sd->satur][0];
+	val2 = matrix[sd->satur][1];
+	val3 = val1 + val2;
+	sccb_reg_write(gspca_dev, 0x4f, val3);	/* matrix coeff */
+	sccb_reg_write(gspca_dev, 0x50, val3);
+	sccb_reg_write(gspca_dev, 0x51, 0x00);
+	sccb_reg_write(gspca_dev, 0x52, val1);
+	sccb_reg_write(gspca_dev, 0x53, val2);
+	sccb_reg_write(gspca_dev, 0x54, val3);
+	sccb_reg_write(gspca_dev, 0x58, 0x1a);	/* mtxs - coeff signs */
+	val1 = sccb_reg_read(gspca_dev, 0x41);	/* com16 */
+	sccb_reg_write(gspca_dev, 0xff, 0x00);
+	sccb_reg_write(gspca_dev, 0x41, val1);
+}
+
+static void setfreq(struct gspca_dev *gspca_dev)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+	u8 val;
+
+	val = sccb_reg_read(gspca_dev, 0x13);		/* com8 */
+	sccb_reg_write(gspca_dev, 0xff, 0x00);
+	if (sd->lightfreq == 0) {
+		sccb_reg_write(gspca_dev, 0x13, val & 0xdf);
+		return;
+	}
+	sccb_reg_write(gspca_dev, 0x13, val | 0x20);
 
-	sd->frame_rate = fr;
-	PDEBUG(D_PROBE, "frame_rate: %d", fr);
+	val = sccb_reg_read(gspca_dev, 0x42);		/* com17 */
+	sccb_reg_write(gspca_dev, 0xff, 0x00);
+	if (sd->lightfreq == 1)
+		val |= 0x01;
+	else
+		val &= 0xfe;
+	sccb_reg_write(gspca_dev, 0x42, val);
 }
 
 /* this function is called at probe time */
@@ -800,17 +1629,60 @@ static int sd_config(struct gspca_dev *gspca_dev,
 	cam = &gspca_dev->cam;
 
 	if (sd->sensor == SENSOR_OV772X) {
-		cam->cam_mode = vga_yuyv_mode;
-		cam->nmodes = ARRAY_SIZE(vga_yuyv_mode);
+		cam->cam_mode = ov772x_mode;
+		cam->nmodes = ARRAY_SIZE(ov772x_mode);
 
 		cam->bulk = 1;
 		cam->bulk_size = 16384;
 		cam->bulk_nurbs = 2;
 	} else {		/* ov965x */
-		cam->cam_mode = vga_jpeg_mode;
-		cam->nmodes = ARRAY_SIZE(vga_jpeg_mode);
+		cam->cam_mode = ov965x_mode;
+		cam->nmodes = ARRAY_SIZE(ov965x_mode);
 	}
 
+	sd->frame_rate = 30;
+
+	if (sd->sensor == SENSOR_OV772X) {
+		sd->brightness = BRIGHTNESS_77_DEF;
+		sd->contrast = CONTRAST_77_DEF;
+		sd->gain = GAIN_DEF;
+		sd->exposure = EXPO_77_DEF;
+		sd->redblc = RED_BALANCE_DEF;
+		sd->blueblc = BLUE_BALANCE_DEF;
+		sd->hue = HUE_DEF;
+#if AUTOGAIN_77_DEF != 0
+		sd->autogain = AUTOGAIN_77_DEF;
+#else
+		gspca_dev->ctrl_inac |= (1 << AWB_77_IDX);
+#endif
+#if AWB_DEF != 0
+		sd->awb = AWB_DEF
+#endif
+#if SHARPNESS_77_DEF != 0
+		sd->sharpness = SHARPNESS_77_DEF;
+#endif
+#if HFLIP_DEF != 0
+		sd->hflip = HFLIP_DEF;
+#endif
+#if VFLIP_DEF != 0
+		sd->vflip = VFLIP_DEF;
+#endif
+	} else {
+		sd->brightness = BRIGHTNESS_96_DEF;
+		sd->contrast = CONTRAST_96_DEF;
+#if AUTOGAIN_96_DEF != 0
+		sd->autogain = AUTOGAIN_96_DEF;
+		gspca_dev->ctrl_inac |= (1 << EXPO_96_IDX);
+#endif
+#if EXPO_96_DEF != 0
+		sd->exposure = EXPO_96_DEF;
+#endif
+#if SHARPNESS_96_DEF != 0
+		sd->sharpness = SHARPNESS_96_DEF;
+#endif
+		sd->satur = SATUR_DEF;
+		sd->lightfreq = FREQ_DEF;
+	}
 	return 0;
 }
 
@@ -847,14 +1719,14 @@ static int sd_init(struct gspca_dev *gspca_dev)
 	/* initialize */
 	switch (sd->sensor) {
 	case SENSOR_OV772X:
-		reg_w_array(gspca_dev, bridge_init_ov722x,
-				ARRAY_SIZE(bridge_init_ov722x));
+		reg_w_array(gspca_dev, bridge_init_ov772x,
+				ARRAY_SIZE(bridge_init_ov772x));
 		ov534_set_led(gspca_dev, 1);
-		sccb_w_array(gspca_dev, sensor_init_ov722x,
-				ARRAY_SIZE(sensor_init_ov722x));
+		sccb_w_array(gspca_dev, sensor_init_ov772x,
+				ARRAY_SIZE(sensor_init_ov772x));
 		ov534_reg_write(gspca_dev, 0xe0, 0x09);
 		ov534_set_led(gspca_dev, 0);
-		ov534_set_frame_rate(gspca_dev);
+		set_frame_rate(gspca_dev);
 		break;
 	default:
 /*	case SENSOR_OV965X: */
@@ -875,60 +1747,115 @@ static int sd_init(struct gspca_dev *gspca_dev)
 	return 0;
 }
 
-static int sd_start(struct gspca_dev *gspca_dev)
+static int sd_start_ov772x(struct gspca_dev *gspca_dev)
 {
-	struct sd *sd = (struct sd *) gspca_dev;
 	int mode;
 
-	switch (sd->sensor) {
-	case SENSOR_OV772X:
-		ov534_set_led(gspca_dev, 1);
-		ov534_reg_write(gspca_dev, 0xe0, 0x00);
-		break;
-	default:
-/*	case SENSOR_OV965X: */
-
-		sccb_w_array(gspca_dev, sensor_start_ov965x,
-				ARRAY_SIZE(sensor_start_ov965x));
-		reg_w_array(gspca_dev, bridge_start_ov965x,
-				ARRAY_SIZE(bridge_start_ov965x));
-		mode = gspca_dev->cam.cam_mode[gspca_dev->curr_mode].priv;
-		if (mode != 0) {	/* 320x240 */
-			reg_w_array(gspca_dev, bridge_start_ov965x_cif,
-					ARRAY_SIZE(bridge_start_ov965x_cif));
-			sccb_w_array(gspca_dev, sensor_start_ov965x_cif,
-					ARRAY_SIZE(sensor_start_ov965x_cif));
-		} else {		/* 640x480 */
-			reg_w_array(gspca_dev, bridge_start_ov965x_vga,
-					ARRAY_SIZE(bridge_start_ov965x_vga));
-			sccb_w_array(gspca_dev, sensor_start_ov965x_vga,
-					ARRAY_SIZE(sensor_start_ov965x_vga));
-		}
-		sccb_w_array(gspca_dev, sensor_start_ov965x_2,
-				ARRAY_SIZE(sensor_start_ov965x_2));
-		ov534_reg_write(gspca_dev, 0xe0, 0x00);
-		ov534_reg_write(gspca_dev, 0xe0, 0x00);
-		ov534_set_led(gspca_dev, 1);
+	mode = gspca_dev->cam.cam_mode[gspca_dev->curr_mode].priv;
+	if (mode != 0) {	/* 320x240 */
+		reg_w_array(gspca_dev, bridge_start_ov772x_qvga,
+				ARRAY_SIZE(bridge_start_ov772x_qvga));
+		sccb_w_array(gspca_dev, sensor_start_ov772x_qvga,
+				ARRAY_SIZE(sensor_start_ov772x_qvga));
+	} else {		/* 640x480 */
+		reg_w_array(gspca_dev, bridge_start_ov772x_vga,
+				ARRAY_SIZE(bridge_start_ov772x_vga));
+		sccb_w_array(gspca_dev, sensor_start_ov772x_vga,
+				ARRAY_SIZE(sensor_start_ov772x_vga));
 	}
+	set_frame_rate(gspca_dev);
+
+	setautogain_77(gspca_dev);
+	setawb(gspca_dev);
+	setgain(gspca_dev);
+	setredblc(gspca_dev);
+	setblueblc(gspca_dev);
+	sethue(gspca_dev);
+	setexposure_77(gspca_dev);
+	setbrightness_77(gspca_dev);
+	setcontrast_77(gspca_dev);
+	setsharpness_77(gspca_dev);
+	setvflip(gspca_dev);
+	sethflip(gspca_dev);
+
+	ov534_set_led(gspca_dev, 1);
+	ov534_reg_write(gspca_dev, 0xe0, 0x00);
 	return 0;
 }
 
-static void sd_stopN(struct gspca_dev *gspca_dev)
+static int sd_start_ov965x(struct gspca_dev *gspca_dev)
 {
-	struct sd *sd = (struct sd *) gspca_dev;
+	int mode;
 
-	switch (sd->sensor) {
-	case SENSOR_OV772X:
-		ov534_reg_write(gspca_dev, 0xe0, 0x09);
-		ov534_set_led(gspca_dev, 0);
-		break;
+	mode = gspca_dev->cam.cam_mode[gspca_dev->curr_mode].priv;
+	switch (mode) {
 	default:
-/*	case SENSOR_OV965X: */
-		ov534_reg_write(gspca_dev, 0xe0, 0x01);
-		ov534_set_led(gspca_dev, 0);
-		ov534_reg_write(gspca_dev, 0xe0, 0x00);
+/*	case 4:			 * 320x240 */
+		sccb_w_array(gspca_dev, sensor_start_ov965x_1_vga,
+				ARRAY_SIZE(sensor_start_ov965x_1_vga));
+		reg_w_array(gspca_dev, bridge_start_ov965x_qvga,
+				ARRAY_SIZE(bridge_start_ov965x_qvga));
+		sccb_w_array(gspca_dev, sensor_start_ov965x_2_qvga,
+				ARRAY_SIZE(sensor_start_ov965x_2_qvga));
+		break;
+	case 3:			/* 640x480 */
+		sccb_w_array(gspca_dev, sensor_start_ov965x_1_vga,
+				ARRAY_SIZE(sensor_start_ov965x_1_vga));
+		reg_w_array(gspca_dev, bridge_start_ov965x_vga,
+				ARRAY_SIZE(bridge_start_ov965x_vga));
+		sccb_w_array(gspca_dev, sensor_start_ov965x_2_vga,
+				ARRAY_SIZE(sensor_start_ov965x_2_vga));
+		break;
+	case 2:			/* 800x600 */
+		sccb_w_array(gspca_dev, sensor_start_ov965x_1_svga,
+				ARRAY_SIZE(sensor_start_ov965x_1_svga));
+		reg_w_array(gspca_dev, bridge_start_ov965x_svga,
+				ARRAY_SIZE(bridge_start_ov965x_svga));
+		sccb_w_array(gspca_dev, sensor_start_ov965x_2_svga,
+				ARRAY_SIZE(sensor_start_ov965x_2_svga));
+		break;
+	case 1:			/* 1024x768 */
+		sccb_w_array(gspca_dev, sensor_start_ov965x_1_xga,
+				ARRAY_SIZE(sensor_start_ov965x_1_xga));
+		reg_w_array(gspca_dev, bridge_start_ov965x_xga,
+				ARRAY_SIZE(bridge_start_ov965x_xga));
+		sccb_w_array(gspca_dev, sensor_start_ov965x_2_svga,
+				ARRAY_SIZE(sensor_start_ov965x_2_svga));
+		break;
+	case 0:			/* 1280x1024 */
+		sccb_w_array(gspca_dev, sensor_start_ov965x_1_sxga,
+				ARRAY_SIZE(sensor_start_ov965x_1_sxga));
+		reg_w_array(gspca_dev, bridge_start_ov965x_sxga,
+				ARRAY_SIZE(bridge_start_ov965x_sxga));
+		sccb_w_array(gspca_dev, sensor_start_ov965x_2_sxga,
+				ARRAY_SIZE(sensor_start_ov965x_2_sxga));
 		break;
 	}
+	setfreq(gspca_dev);
+	setautogain_96(gspca_dev);
+	setbrightness_96(gspca_dev);
+	setcontrast_96(gspca_dev);
+	setexposure_96(gspca_dev);
+	setsharpness_96(gspca_dev);
+	setsatur(gspca_dev);
+
+	ov534_reg_write(gspca_dev, 0xe0, 0x00);
+	ov534_reg_write(gspca_dev, 0xe0, 0x00);
+	ov534_set_led(gspca_dev, 1);
+	return 0;
+}
+
+static void sd_stopN_ov772x(struct gspca_dev *gspca_dev)
+{
+	ov534_reg_write(gspca_dev, 0xe0, 0x09);
+	ov534_set_led(gspca_dev, 0);
+}
+
+static void sd_stopN_ov965x(struct gspca_dev *gspca_dev)
+{
+	ov534_reg_write(gspca_dev, 0xe0, 0x01);
+	ov534_set_led(gspca_dev, 0);
+	ov534_reg_write(gspca_dev, 0xe0, 0x00);
 }
 
 /* Values for bmHeaderInfo (Video and Still Image Payload Headers, 2.4.3.3) */
@@ -941,8 +1868,8 @@ static void sd_stopN(struct gspca_dev *gspca_dev)
 #define UVC_STREAM_EOF	(1 << 1)
 #define UVC_STREAM_FID	(1 << 0)
 
-static void sd_pkt_scan(struct gspca_dev *gspca_dev, struct gspca_frame *frame,
-			__u8 *data, int len)
+static void sd_pkt_scan(struct gspca_dev *gspca_dev,
+			u8 *data, int len)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
 	__u32 this_pts;
@@ -983,32 +1910,30 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev, struct gspca_frame *frame,
 		/* If PTS or FID has changed, start a new frame. */
 		if (this_pts != sd->last_pts || this_fid != sd->last_fid) {
 			if (gspca_dev->last_packet_type == INTER_PACKET)
-				frame = gspca_frame_add(gspca_dev,
-							LAST_PACKET, frame,
-							NULL, 0);
+				gspca_frame_add(gspca_dev, LAST_PACKET,
+						NULL, 0);
 			sd->last_pts = this_pts;
 			sd->last_fid = this_fid;
-			gspca_frame_add(gspca_dev, FIRST_PACKET, frame,
+			gspca_frame_add(gspca_dev, FIRST_PACKET,
 					data + 12, len - 12);
 		/* If this packet is marked as EOF, end the frame */
 		} else if (data[1] & UVC_STREAM_EOF) {
 			sd->last_pts = 0;
-			frame = gspca_frame_add(gspca_dev, LAST_PACKET, frame,
-						data + 12, len - 12);
+			gspca_frame_add(gspca_dev, LAST_PACKET,
+					data + 12, len - 12);
 		} else {
 
 			/* Add the data from this payload */
-			gspca_frame_add(gspca_dev, INTER_PACKET, frame,
-						data + 12, len - 12);
+			gspca_frame_add(gspca_dev, INTER_PACKET,
+					data + 12, len - 12);
 		}
 
-
 		/* Done this payload */
 		goto scan_next;
 
 discard:
 		/* Discard data until a new frame starts. */
-		gspca_frame_add(gspca_dev, DISCARD_PACKET, frame, NULL, 0);
+		gspca_dev->last_packet_type = DISCARD_PACKET;
 
 scan_next:
 		remaining_len -= len;
@@ -1016,6 +1941,291 @@ scan_next:
 	} while (remaining_len > 0);
 }
 
+/* controls */
+static int sd_setgain(struct gspca_dev *gspca_dev, __s32 val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	sd->gain = val;
+	if (gspca_dev->streaming)
+		setgain(gspca_dev);
+	return 0;
+}
+
+static int sd_getgain(struct gspca_dev *gspca_dev, __s32 *val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	*val = sd->gain;
+	return 0;
+}
+
+static int sd_setexposure(struct gspca_dev *gspca_dev, __s32 val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	sd->exposure = val;
+	if (gspca_dev->streaming) {
+		if (sd->sensor == SENSOR_OV772X)
+			setexposure_77(gspca_dev);
+		else
+			setexposure_96(gspca_dev);
+	}
+	return 0;
+}
+
+static int sd_getexposure(struct gspca_dev *gspca_dev, __s32 *val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	*val = sd->exposure;
+	return 0;
+}
+
+static int sd_setbrightness(struct gspca_dev *gspca_dev, __s32 val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	sd->brightness = val;
+	if (gspca_dev->streaming) {
+		if (sd->sensor == SENSOR_OV772X)
+			setbrightness_77(gspca_dev);
+		else
+			setbrightness_96(gspca_dev);
+	}
+	return 0;
+}
+
+static int sd_getbrightness(struct gspca_dev *gspca_dev, __s32 *val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	*val = sd->brightness;
+	return 0;
+}
+
+static int sd_setcontrast(struct gspca_dev *gspca_dev, __s32 val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	sd->contrast = val;
+	if (gspca_dev->streaming) {
+		if (sd->sensor == SENSOR_OV772X)
+			setcontrast_77(gspca_dev);
+		else
+			setcontrast_96(gspca_dev);
+	}
+	return 0;
+}
+
+static int sd_getcontrast(struct gspca_dev *gspca_dev, __s32 *val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	*val = sd->contrast;
+	return 0;
+}
+
+static int sd_setsatur(struct gspca_dev *gspca_dev, __s32 val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	sd->satur = val;
+	if (gspca_dev->streaming)
+		setsatur(gspca_dev);
+	return 0;
+}
+
+static int sd_getsatur(struct gspca_dev *gspca_dev, __s32 *val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	*val = sd->satur;
+	return 0;
+}
+static int sd_setfreq(struct gspca_dev *gspca_dev, __s32 val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	sd->lightfreq = val;
+	if (gspca_dev->streaming)
+		setfreq(gspca_dev);
+	return 0;
+}
+
+static int sd_getfreq(struct gspca_dev *gspca_dev, __s32 *val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	*val = sd->lightfreq;
+	return 0;
+}
+
+static int sd_setredblc(struct gspca_dev *gspca_dev, __s32 val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	sd->redblc = val;
+	if (gspca_dev->streaming)
+		setredblc(gspca_dev);
+	return 0;
+}
+
+static int sd_getredblc(struct gspca_dev *gspca_dev, __s32 *val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	*val = sd->redblc;
+	return 0;
+}
+
+static int sd_setblueblc(struct gspca_dev *gspca_dev, __s32 val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	sd->blueblc = val;
+	if (gspca_dev->streaming)
+		setblueblc(gspca_dev);
+	return 0;
+}
+
+static int sd_getblueblc(struct gspca_dev *gspca_dev, __s32 *val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	*val = sd->blueblc;
+	return 0;
+}
+
+static int sd_sethue(struct gspca_dev *gspca_dev, __s32 val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	sd->hue = val;
+	if (gspca_dev->streaming)
+		sethue(gspca_dev);
+	return 0;
+}
+
+static int sd_gethue(struct gspca_dev *gspca_dev, __s32 *val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	*val = sd->hue;
+	return 0;
+}
+
+static int sd_setautogain(struct gspca_dev *gspca_dev, __s32 val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	sd->autogain = val;
+
+	if (gspca_dev->streaming) {
+		if (sd->sensor == SENSOR_OV772X) {
+
+			/* the auto white balance control works only
+			 * when auto gain is set */
+			if (val)
+				gspca_dev->ctrl_inac &= ~(1 << AWB_77_IDX);
+			else
+				gspca_dev->ctrl_inac |= (1 << AWB_77_IDX);
+			setautogain_77(gspca_dev);
+		} else {
+			if (val)
+				gspca_dev->ctrl_inac |= (1 << EXPO_96_IDX);
+			else
+				gspca_dev->ctrl_inac &= ~(1 << EXPO_96_IDX);
+			setautogain_96(gspca_dev);
+		}
+	}
+	return 0;
+}
+
+static int sd_getautogain(struct gspca_dev *gspca_dev, __s32 *val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	*val = sd->autogain;
+	return 0;
+}
+
+static int sd_setawb(struct gspca_dev *gspca_dev, __s32 val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	sd->awb = val;
+	if (gspca_dev->streaming)
+		setawb(gspca_dev);
+	return 0;
+}
+
+static int sd_getawb(struct gspca_dev *gspca_dev, __s32 *val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	*val = sd->awb;
+	return 0;
+}
+
+static int sd_setsharpness(struct gspca_dev *gspca_dev, __s32 val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	sd->sharpness = val;
+	if (gspca_dev->streaming) {
+		if (sd->sensor == SENSOR_OV772X)
+			setsharpness_77(gspca_dev);
+		else
+			setsharpness_96(gspca_dev);
+	}
+	return 0;
+}
+
+static int sd_getsharpness(struct gspca_dev *gspca_dev, __s32 *val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	*val = sd->sharpness;
+	return 0;
+}
+
+static int sd_sethflip(struct gspca_dev *gspca_dev, __s32 val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	sd->hflip = val;
+	if (gspca_dev->streaming)
+		sethflip(gspca_dev);
+	return 0;
+}
+
+static int sd_gethflip(struct gspca_dev *gspca_dev, __s32 *val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	*val = sd->hflip;
+	return 0;
+}
+
+static int sd_setvflip(struct gspca_dev *gspca_dev, __s32 val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	sd->vflip = val;
+	if (gspca_dev->streaming)
+		setvflip(gspca_dev);
+	return 0;
+}
+
+static int sd_getvflip(struct gspca_dev *gspca_dev, __s32 *val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	*val = sd->vflip;
+	return 0;
+}
+
 /* get stream parameters (framerate) */
 static int sd_get_streamparm(struct gspca_dev *gspca_dev,
 			     struct v4l2_streamparm *parm)
@@ -1047,7 +2257,8 @@ static int sd_set_streamparm(struct gspca_dev *gspca_dev,
 
 	/* Set requested framerate */
 	sd->frame_rate = tpf->denominator / tpf->numerator;
-	ov534_set_frame_rate(gspca_dev);
+	if (gspca_dev->streaming && sd->sensor == SENSOR_OV772X)
+		set_frame_rate(gspca_dev);
 
 	/* Return the actual framerate */
 	tpf->numerator = 1;
@@ -1056,20 +2267,53 @@ static int sd_set_streamparm(struct gspca_dev *gspca_dev,
 	return 0;
 }
 
+static int sd_querymenu(struct gspca_dev *gspca_dev,
+			struct v4l2_querymenu *menu)
+{
+	switch (menu->id) {
+	case V4L2_CID_POWER_LINE_FREQUENCY:
+		switch (menu->index) {
+		case 0:		/* V4L2_CID_POWER_LINE_FREQUENCY_DISABLED */
+			strcpy((char *) menu->name, "NoFliker");
+			return 0;
+		case 1:		/* V4L2_CID_POWER_LINE_FREQUENCY_50HZ */
+			strcpy((char *) menu->name, "50 Hz");
+			return 0;
+		case 2:		/* V4L2_CID_POWER_LINE_FREQUENCY_60HZ */
+			strcpy((char *) menu->name, "60 Hz");
+			return 0;
+		}
+		break;
+	}
+	return -EINVAL;
+}
+
 /* sub-driver description */
-static const struct sd_desc sd_desc = {
+static const struct sd_desc sd_desc_ov772x = {
 	.name     = MODULE_NAME,
-	.ctrls    = sd_ctrls,
-	.nctrls   = ARRAY_SIZE(sd_ctrls),
+	.ctrls    = sd_ctrls_ov772x,
+	.nctrls   = ARRAY_SIZE(sd_ctrls_ov772x),
 	.config   = sd_config,
 	.init     = sd_init,
-	.start    = sd_start,
-	.stopN    = sd_stopN,
+	.start    = sd_start_ov772x,
+	.stopN    = sd_stopN_ov772x,
 	.pkt_scan = sd_pkt_scan,
 	.get_streamparm = sd_get_streamparm,
 	.set_streamparm = sd_set_streamparm,
 };
 
+static const struct sd_desc sd_desc_ov965x = {
+	.name     = MODULE_NAME,
+	.ctrls    = sd_ctrls_ov965x,
+	.nctrls   = ARRAY_SIZE(sd_ctrls_ov965x),
+	.config   = sd_config,
+	.init     = sd_init,
+	.start    = sd_start_ov965x,
+	.stopN    = sd_stopN_ov965x,
+	.pkt_scan = sd_pkt_scan,
+	.querymenu = sd_querymenu,
+};
+
 /* -- module initialisation -- */
 static const __devinitdata struct usb_device_id device_table[] = {
 	{USB_DEVICE(0x06f8, 0x3003), .driver_info = SENSOR_OV965X},
@@ -1082,8 +2326,12 @@ MODULE_DEVICE_TABLE(usb, device_table);
 /* -- device connect -- */
 static int sd_probe(struct usb_interface *intf, const struct usb_device_id *id)
 {
-	return gspca_dev_probe(intf, id, &sd_desc, sizeof(struct sd),
-			       THIS_MODULE);
+	return gspca_dev_probe(intf, id,
+				id->driver_info == SENSOR_OV772X
+					? &sd_desc_ov772x
+					: &sd_desc_ov965x,
+				sizeof(struct sd),
+				THIS_MODULE);
 }
 
 static struct usb_driver sd_driver = {
@@ -1101,6 +2349,7 @@ static struct usb_driver sd_driver = {
 static int __init sd_mod_init(void)
 {
 	int ret;
+
 	ret = usb_register(&sd_driver);
 	if (ret < 0)
 		return ret;
diff --git a/drivers/media/video/gspca/pac207.c b/drivers/media/video/gspca/pac207.c
index 96659433d248..4706a823add0 100644
--- a/drivers/media/video/gspca/pac207.c
+++ b/drivers/media/video/gspca/pac207.c
@@ -337,14 +337,13 @@ static void pac207_do_auto_gain(struct gspca_dev *gspca_dev)
 }
 
 static void sd_pkt_scan(struct gspca_dev *gspca_dev,
-			struct gspca_frame *frame,
-			__u8 *data,
+			u8 *data,
 			int len)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
 	unsigned char *sof;
 
-	sof = pac_find_sof(gspca_dev, data, len);
+	sof = pac_find_sof(&sd->sof_read, data, len);
 	if (sof) {
 		int n;
 
@@ -354,10 +353,10 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
 			n -= sizeof pac_sof_marker;
 		else
 			n = 0;
-		frame = gspca_frame_add(gspca_dev, LAST_PACKET, frame,
-					data, n);
+		gspca_frame_add(gspca_dev, LAST_PACKET,
+				data, n);
 		sd->header_read = 0;
-		gspca_frame_add(gspca_dev, FIRST_PACKET, frame, NULL, 0);
+		gspca_frame_add(gspca_dev, FIRST_PACKET, NULL, 0);
 		len -= sof - data;
 		data = sof;
 	}
@@ -381,7 +380,7 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
 		sd->header_read = 11;
 	}
 
-	gspca_frame_add(gspca_dev, INTER_PACKET, frame, data, len);
+	gspca_frame_add(gspca_dev, INTER_PACKET, data, len);
 }
 
 static void setbrightness(struct gspca_dev *gspca_dev)
diff --git a/drivers/media/video/gspca/pac7302.c b/drivers/media/video/gspca/pac7302.c
new file mode 100644
index 000000000000..de0b66c4b56e
--- /dev/null
+++ b/drivers/media/video/gspca/pac7302.c
@@ -0,0 +1,1283 @@
+/*
+ *		Pixart PAC7302 library
+ *		Copyright (C) 2005 Thomas Kaiser thomas@kaiser-linux.li
+ *
+ * V4L2 by Jean-Francois Moine <http://moinejf.free.fr>
+ *
+ * Separated from Pixart PAC7311 library by Márton Németh <nm127@freemail.hu>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+
+/* Some documentation about various registers as determined by trial and error.
+   When the register addresses differ between the 7202 and the 7311 the 2
+   different addresses are written as 7302addr/7311addr, when one of the 2
+   addresses is a - sign that register description is not valid for the
+   matching IC.
+
+   Register page 1:
+
+   Address	Description
+   -/0x08	Unknown compressor related, must always be 8 except when not
+		in 640x480 resolution and page 4 reg 2 <= 3 then set it to 9 !
+   -/0x1b	Auto white balance related, bit 0 is AWB enable (inverted)
+		bits 345 seem to toggle per color gains on/off (inverted)
+   0x78		Global control, bit 6 controls the LED (inverted)
+   -/0x80	JPEG compression ratio ? Best not touched
+
+   Register page 3/4:
+
+   Address	Description
+   0x02		Clock divider 2-63, fps =~ 60 / val. Must be a multiple of 3 on
+		the 7302, so one of 3, 6, 9, ..., except when between 6 and 12?
+   -/0x0f	Master gain 1-245, low value = high gain
+   0x10/-	Master gain 0-31
+   -/0x10	Another gain 0-15, limited influence (1-2x gain I guess)
+   0x21		Bitfield: 0-1 unused, 2-3 vflip/hflip, 4-5 unknown, 6-7 unused
+   -/0x27	Seems to toggle various gains on / off, Setting bit 7 seems to
+		completely disable the analog amplification block. Set to 0x68
+		for max gain, 0x14 for minimal gain.
+
+   The registers are accessed in the following functions:
+
+   Page | Register   | Function
+   -----+------------+---------------------------------------------------
+    0   | 0x0f..0x20 | setcolors()
+    0   | 0xa2..0xab | setbrightcont()
+    0   | 0xc5       | setredbalance()
+    0   | 0xc6       | setwhitebalance()
+    0   | 0xc7       | setbluebalance()
+    0   | 0xdc       | setbrightcont(), setcolors()
+    3   | 0x02       | setexposure()
+    3   | 0x10       | setgain()
+    3   | 0x11       | setcolors(), setgain(), setexposure(), sethvflip()
+    3   | 0x21       | sethvflip()
+*/
+
+#define MODULE_NAME "pac7302"
+
+#include <media/v4l2-chip-ident.h>
+#include "gspca.h"
+
+MODULE_AUTHOR("Thomas Kaiser thomas@kaiser-linux.li");
+MODULE_DESCRIPTION("Pixart PAC7302");
+MODULE_LICENSE("GPL");
+
+/* specific webcam descriptor for pac7302 */
+struct sd {
+	struct gspca_dev gspca_dev;		/* !! must be the first item */
+
+	unsigned char brightness;
+	unsigned char contrast;
+	unsigned char colors;
+	unsigned char white_balance;
+	unsigned char red_balance;
+	unsigned char blue_balance;
+	unsigned char gain;
+	unsigned char exposure;
+	unsigned char autogain;
+	__u8 hflip;
+	__u8 vflip;
+	u8 flags;
+#define FL_HFLIP 0x01		/* mirrored by default */
+#define FL_VFLIP 0x02		/* vertical flipped by default */
+
+	u8 sof_read;
+	u8 autogain_ignore_frames;
+
+	atomic_t avg_lum;
+};
+
+/* V4L2 controls supported by the driver */
+static int sd_setbrightness(struct gspca_dev *gspca_dev, __s32 val);
+static int sd_getbrightness(struct gspca_dev *gspca_dev, __s32 *val);
+static int sd_setcontrast(struct gspca_dev *gspca_dev, __s32 val);
+static int sd_getcontrast(struct gspca_dev *gspca_dev, __s32 *val);
+static int sd_setcolors(struct gspca_dev *gspca_dev, __s32 val);
+static int sd_getcolors(struct gspca_dev *gspca_dev, __s32 *val);
+static int sd_setwhitebalance(struct gspca_dev *gspca_dev, __s32 val);
+static int sd_getwhitebalance(struct gspca_dev *gspca_dev, __s32 *val);
+static int sd_setredbalance(struct gspca_dev *gspca_dev, __s32 val);
+static int sd_getredbalance(struct gspca_dev *gspca_dev, __s32 *val);
+static int sd_setbluebalance(struct gspca_dev *gspca_dev, __s32 val);
+static int sd_getbluebalance(struct gspca_dev *gspca_dev, __s32 *val);
+static int sd_setautogain(struct gspca_dev *gspca_dev, __s32 val);
+static int sd_getautogain(struct gspca_dev *gspca_dev, __s32 *val);
+static int sd_sethflip(struct gspca_dev *gspca_dev, __s32 val);
+static int sd_gethflip(struct gspca_dev *gspca_dev, __s32 *val);
+static int sd_setvflip(struct gspca_dev *gspca_dev, __s32 val);
+static int sd_getvflip(struct gspca_dev *gspca_dev, __s32 *val);
+static int sd_setgain(struct gspca_dev *gspca_dev, __s32 val);
+static int sd_getgain(struct gspca_dev *gspca_dev, __s32 *val);
+static int sd_setexposure(struct gspca_dev *gspca_dev, __s32 val);
+static int sd_getexposure(struct gspca_dev *gspca_dev, __s32 *val);
+
+static struct ctrl sd_ctrls[] = {
+/* This control is pac7302 only */
+	{
+	    {
+		.id      = V4L2_CID_BRIGHTNESS,
+		.type    = V4L2_CTRL_TYPE_INTEGER,
+		.name    = "Brightness",
+		.minimum = 0,
+#define BRIGHTNESS_MAX 0x20
+		.maximum = BRIGHTNESS_MAX,
+		.step    = 1,
+#define BRIGHTNESS_DEF 0x10
+		.default_value = BRIGHTNESS_DEF,
+	    },
+	    .set = sd_setbrightness,
+	    .get = sd_getbrightness,
+	},
+/* This control is for both the 7302 and the 7311 */
+	{
+	    {
+		.id      = V4L2_CID_CONTRAST,
+		.type    = V4L2_CTRL_TYPE_INTEGER,
+		.name    = "Contrast",
+		.minimum = 0,
+#define CONTRAST_MAX 255
+		.maximum = CONTRAST_MAX,
+		.step    = 1,
+#define CONTRAST_DEF 127
+		.default_value = CONTRAST_DEF,
+	    },
+	    .set = sd_setcontrast,
+	    .get = sd_getcontrast,
+	},
+/* This control is pac7302 only */
+	{
+	    {
+		.id      = V4L2_CID_SATURATION,
+		.type    = V4L2_CTRL_TYPE_INTEGER,
+		.name    = "Saturation",
+		.minimum = 0,
+#define COLOR_MAX 255
+		.maximum = COLOR_MAX,
+		.step    = 1,
+#define COLOR_DEF 127
+		.default_value = COLOR_DEF,
+	    },
+	    .set = sd_setcolors,
+	    .get = sd_getcolors,
+	},
+	{
+	    {
+		.id      = V4L2_CID_WHITE_BALANCE_TEMPERATURE,
+		.type    = V4L2_CTRL_TYPE_INTEGER,
+		.name    = "White Balance",
+		.minimum = 0,
+		.maximum = 255,
+		.step    = 1,
+#define WHITEBALANCE_DEF 4
+		.default_value = WHITEBALANCE_DEF,
+	    },
+	    .set = sd_setwhitebalance,
+	    .get = sd_getwhitebalance,
+	},
+	{
+	    {
+		.id      = V4L2_CID_RED_BALANCE,
+		.type    = V4L2_CTRL_TYPE_INTEGER,
+		.name    = "Red",
+		.minimum = 0,
+		.maximum = 3,
+		.step    = 1,
+#define REDBALANCE_DEF 1
+		.default_value = REDBALANCE_DEF,
+	    },
+	    .set = sd_setredbalance,
+	    .get = sd_getredbalance,
+	},
+	{
+	    {
+		.id      = V4L2_CID_BLUE_BALANCE,
+		.type    = V4L2_CTRL_TYPE_INTEGER,
+		.name    = "Blue",
+		.minimum = 0,
+		.maximum = 3,
+		.step    = 1,
+#define BLUEBALANCE_DEF 1
+		.default_value = BLUEBALANCE_DEF,
+	    },
+	    .set = sd_setbluebalance,
+	    .get = sd_getbluebalance,
+	},
+/* All controls below are for both the 7302 and the 7311 */
+	{
+	    {
+		.id      = V4L2_CID_GAIN,
+		.type    = V4L2_CTRL_TYPE_INTEGER,
+		.name    = "Gain",
+		.minimum = 0,
+#define GAIN_MAX 255
+		.maximum = GAIN_MAX,
+		.step    = 1,
+#define GAIN_DEF 127
+#define GAIN_KNEE 255 /* Gain seems to cause little noise on the pac73xx */
+		.default_value = GAIN_DEF,
+	    },
+	    .set = sd_setgain,
+	    .get = sd_getgain,
+	},
+	{
+	    {
+		.id      = V4L2_CID_EXPOSURE,
+		.type    = V4L2_CTRL_TYPE_INTEGER,
+		.name    = "Exposure",
+		.minimum = 0,
+#define EXPOSURE_MAX 255
+		.maximum = EXPOSURE_MAX,
+		.step    = 1,
+#define EXPOSURE_DEF  16 /*  32 ms / 30 fps */
+#define EXPOSURE_KNEE 50 /* 100 ms / 10 fps */
+		.default_value = EXPOSURE_DEF,
+	    },
+	    .set = sd_setexposure,
+	    .get = sd_getexposure,
+	},
+	{
+	    {
+		.id      = V4L2_CID_AUTOGAIN,
+		.type    = V4L2_CTRL_TYPE_BOOLEAN,
+		.name    = "Auto Gain",
+		.minimum = 0,
+		.maximum = 1,
+		.step    = 1,
+#define AUTOGAIN_DEF 1
+		.default_value = AUTOGAIN_DEF,
+	    },
+	    .set = sd_setautogain,
+	    .get = sd_getautogain,
+	},
+	{
+	    {
+		.id      = V4L2_CID_HFLIP,
+		.type    = V4L2_CTRL_TYPE_BOOLEAN,
+		.name    = "Mirror",
+		.minimum = 0,
+		.maximum = 1,
+		.step    = 1,
+#define HFLIP_DEF 0
+		.default_value = HFLIP_DEF,
+	    },
+	    .set = sd_sethflip,
+	    .get = sd_gethflip,
+	},
+	{
+	    {
+		.id      = V4L2_CID_VFLIP,
+		.type    = V4L2_CTRL_TYPE_BOOLEAN,
+		.name    = "Vflip",
+		.minimum = 0,
+		.maximum = 1,
+		.step    = 1,
+#define VFLIP_DEF 0
+		.default_value = VFLIP_DEF,
+	    },
+	    .set = sd_setvflip,
+	    .get = sd_getvflip,
+	},
+};
+
+static const struct v4l2_pix_format vga_mode[] = {
+	{640, 480, V4L2_PIX_FMT_PJPG, V4L2_FIELD_NONE,
+		.bytesperline = 640,
+		.sizeimage = 640 * 480 * 3 / 8 + 590,
+		.colorspace = V4L2_COLORSPACE_JPEG,
+		.priv = 0},
+};
+
+#define LOAD_PAGE3		255
+#define LOAD_PAGE4		254
+#define END_OF_SEQUENCE		0
+
+/* pac 7302 */
+static const __u8 init_7302[] = {
+/*	index,value */
+	0xff, 0x01,		/* page 1 */
+	0x78, 0x00,		/* deactivate */
+	0xff, 0x01,
+	0x78, 0x40,		/* led off */
+};
+static const __u8 start_7302[] = {
+/*	index, len, [value]* */
+	0xff, 1,	0x00,		/* page 0 */
+	0x00, 12,	0x01, 0x40, 0x40, 0x40, 0x01, 0xe0, 0x02, 0x80,
+			0x00, 0x00, 0x00, 0x00,
+	0x0d, 24,	0x03, 0x01, 0x00, 0xb5, 0x07, 0xcb, 0x00, 0x00,
+			0x07, 0xc8, 0x00, 0xea, 0x07, 0xcf, 0x07, 0xf7,
+			0x07, 0x7e, 0x01, 0x0b, 0x00, 0x00, 0x00, 0x11,
+	0x26, 2,	0xaa, 0xaa,
+	0x2e, 1,	0x31,
+	0x38, 1,	0x01,
+	0x3a, 3,	0x14, 0xff, 0x5a,
+	0x43, 11,	0x00, 0x0a, 0x18, 0x11, 0x01, 0x2c, 0x88, 0x11,
+			0x00, 0x54, 0x11,
+	0x55, 1,	0x00,
+	0x62, 4, 	0x10, 0x1e, 0x1e, 0x18,
+	0x6b, 1,	0x00,
+	0x6e, 3,	0x08, 0x06, 0x00,
+	0x72, 3,	0x00, 0xff, 0x00,
+	0x7d, 23,	0x01, 0x01, 0x58, 0x46, 0x50, 0x3c, 0x50, 0x3c,
+			0x54, 0x46, 0x54, 0x56, 0x52, 0x50, 0x52, 0x50,
+			0x56, 0x64, 0xa4, 0x00, 0xda, 0x00, 0x00,
+	0xa2, 10,	0x22, 0x2c, 0x3c, 0x54, 0x69, 0x7c, 0x9c, 0xb9,
+			0xd2, 0xeb,
+	0xaf, 1,	0x02,
+	0xb5, 2,	0x08, 0x08,
+	0xb8, 2,	0x08, 0x88,
+	0xc4, 4,	0xae, 0x01, 0x04, 0x01,
+	0xcc, 1,	0x00,
+	0xd1, 11,	0x01, 0x30, 0x49, 0x5e, 0x6f, 0x7f, 0x8e, 0xa9,
+			0xc1, 0xd7, 0xec,
+	0xdc, 1,	0x01,
+	0xff, 1,	0x01,		/* page 1 */
+	0x12, 3,	0x02, 0x00, 0x01,
+	0x3e, 2,	0x00, 0x00,
+	0x76, 5,	0x01, 0x20, 0x40, 0x00, 0xf2,
+	0x7c, 1,	0x00,
+	0x7f, 10,	0x4b, 0x0f, 0x01, 0x2c, 0x02, 0x58, 0x03, 0x20,
+			0x02, 0x00,
+	0x96, 5,	0x01, 0x10, 0x04, 0x01, 0x04,
+	0xc8, 14,	0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00,
+			0x07, 0x00, 0x01, 0x07, 0x04, 0x01,
+	0xd8, 1,	0x01,
+	0xdb, 2,	0x00, 0x01,
+	0xde, 7,	0x00, 0x01, 0x04, 0x04, 0x00, 0x00, 0x00,
+	0xe6, 4,	0x00, 0x00, 0x00, 0x01,
+	0xeb, 1,	0x00,
+	0xff, 1,	0x02,		/* page 2 */
+	0x22, 1,	0x00,
+	0xff, 1,	0x03,		/* page 3 */
+	0, LOAD_PAGE3,			/* load the page 3 */
+	0x11, 1,	0x01,
+	0xff, 1,	0x02,		/* page 2 */
+	0x13, 1,	0x00,
+	0x22, 4,	0x1f, 0xa4, 0xf0, 0x96,
+	0x27, 2,	0x14, 0x0c,
+	0x2a, 5,	0xc8, 0x00, 0x18, 0x12, 0x22,
+	0x64, 8,	0x00, 0x00, 0xf0, 0x01, 0x14, 0x44, 0x44, 0x44,
+	0x6e, 1,	0x08,
+	0xff, 1,	0x01,		/* page 1 */
+	0x78, 1,	0x00,
+	0, END_OF_SEQUENCE		/* end of sequence */
+};
+
+#define SKIP		0xaa
+/* page 3 - the value SKIP says skip the index - see reg_w_page() */
+static const __u8 page3_7302[] = {
+	0x90, 0x40, 0x03, 0x50, 0xc2, 0x01, 0x14, 0x16,
+	0x14, 0x12, 0x00, 0x00, 0x00, 0x02, 0x33, 0x00,
+	0x0f, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x47, 0x01, 0xb3, 0x01, 0x00,
+	0x00, 0x08, 0x00, 0x00, 0x0d, 0x00, 0x00, 0x21,
+	0x00, 0x00, 0x00, 0x54, 0xf4, 0x02, 0x52, 0x54,
+	0xa4, 0xb8, 0xe0, 0x2a, 0xf6, 0x00, 0x00, 0x00,
+	0x00, 0x1e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0xfc, 0x00, 0xf2, 0x1f, 0x04, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0xc0, 0xc0, 0x10, 0x00, 0x00,
+	0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x40, 0xff, 0x03, 0x19, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0xc8, 0xc8, 0xc8,
+	0xc8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x50,
+	0x08, 0x10, 0x24, 0x40, 0x00, 0x00, 0x00, 0x00,
+	0x01, 0x00, 0x02, 0x47, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x02, 0xfa, 0x00, 0x64, 0x5a, 0x28, 0x00,
+	0x00
+};
+
+static int reg_w_buf(struct gspca_dev *gspca_dev,
+		  __u8 index,
+		  const char *buffer, int len)
+{
+	int ret;
+
+	memcpy(gspca_dev->usb_buf, buffer, len);
+	ret = usb_control_msg(gspca_dev->dev,
+			usb_sndctrlpipe(gspca_dev->dev, 0),
+			1,		/* request */
+			USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+			0,		/* value */
+			index, gspca_dev->usb_buf, len,
+			500);
+	if (ret < 0)
+		PDEBUG(D_ERR, "reg_w_buf(): "
+		"Failed to write registers to index 0x%x, error %i",
+		index, ret);
+	return ret;
+}
+
+
+static int reg_w(struct gspca_dev *gspca_dev,
+		  __u8 index,
+		  __u8 value)
+{
+	int ret;
+
+	gspca_dev->usb_buf[0] = value;
+	ret = usb_control_msg(gspca_dev->dev,
+			usb_sndctrlpipe(gspca_dev->dev, 0),
+			0,			/* request */
+			USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+			0, index, gspca_dev->usb_buf, 1,
+			500);
+	if (ret < 0)
+		PDEBUG(D_ERR, "reg_w(): "
+		"Failed to write register to index 0x%x, value 0x%x, error %i",
+		index, value, ret);
+	return ret;
+}
+
+static int reg_w_seq(struct gspca_dev *gspca_dev,
+		const __u8 *seq, int len)
+{
+	int ret = 0;
+	while (--len >= 0) {
+		if (0 <= ret)
+			ret = reg_w(gspca_dev, seq[0], seq[1]);
+		seq += 2;
+	}
+	return ret;
+}
+
+/* load the beginning of a page */
+static int reg_w_page(struct gspca_dev *gspca_dev,
+			const __u8 *page, int len)
+{
+	int index;
+	int ret = 0;
+
+	for (index = 0; index < len; index++) {
+		if (page[index] == SKIP)		/* skip this index */
+			continue;
+		gspca_dev->usb_buf[0] = page[index];
+		ret = usb_control_msg(gspca_dev->dev,
+				usb_sndctrlpipe(gspca_dev->dev, 0),
+				0,			/* request */
+			USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+				0, index, gspca_dev->usb_buf, 1,
+				500);
+		if (ret < 0) {
+			PDEBUG(D_ERR, "reg_w_page(): "
+			"Failed to write register to index 0x%x, "
+			"value 0x%x, error %i",
+			index, page[index], ret);
+			break;
+		}
+	}
+	return ret;
+}
+
+/* output a variable sequence */
+static int reg_w_var(struct gspca_dev *gspca_dev,
+			const __u8 *seq,
+			const __u8 *page3, unsigned int page3_len,
+			const __u8 *page4, unsigned int page4_len)
+{
+	int index, len;
+	int ret = 0;
+
+	for (;;) {
+		index = *seq++;
+		len = *seq++;
+		switch (len) {
+		case END_OF_SEQUENCE:
+			return ret;
+		case LOAD_PAGE4:
+			ret = reg_w_page(gspca_dev, page4, page4_len);
+			break;
+		case LOAD_PAGE3:
+			ret = reg_w_page(gspca_dev, page3, page3_len);
+			break;
+		default:
+			if (len > USB_BUF_SZ) {
+				PDEBUG(D_ERR|D_STREAM,
+					"Incorrect variable sequence");
+				return -EINVAL;
+			}
+			while (len > 0) {
+				if (len < 8) {
+					ret = reg_w_buf(gspca_dev,
+						index, seq, len);
+					if (ret < 0)
+						return ret;
+					seq += len;
+					break;
+				}
+				ret = reg_w_buf(gspca_dev, index, seq, 8);
+				seq += 8;
+				index += 8;
+				len -= 8;
+			}
+		}
+		if (ret < 0)
+			return ret;
+	}
+	/* not reached */
+}
+
+/* this function is called at probe time for pac7302 */
+static int sd_config(struct gspca_dev *gspca_dev,
+			const struct usb_device_id *id)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+	struct cam *cam;
+
+	cam = &gspca_dev->cam;
+
+	PDEBUG(D_CONF, "Find Sensor PAC7302");
+	cam->cam_mode = vga_mode;	/* only 640x480 */
+	cam->nmodes = ARRAY_SIZE(vga_mode);
+
+	sd->brightness = BRIGHTNESS_DEF;
+	sd->contrast = CONTRAST_DEF;
+	sd->colors = COLOR_DEF;
+	sd->white_balance = WHITEBALANCE_DEF;
+	sd->red_balance = REDBALANCE_DEF;
+	sd->blue_balance = BLUEBALANCE_DEF;
+	sd->gain = GAIN_DEF;
+	sd->exposure = EXPOSURE_DEF;
+	sd->autogain = AUTOGAIN_DEF;
+	sd->hflip = HFLIP_DEF;
+	sd->vflip = VFLIP_DEF;
+	sd->flags = id->driver_info;
+	return 0;
+}
+
+/* This function is used by pac7302 only */
+static int setbrightcont(struct gspca_dev *gspca_dev)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+	int i, v;
+	int ret;
+	static const __u8 max[10] =
+		{0x29, 0x33, 0x42, 0x5a, 0x6e, 0x80, 0x9f, 0xbb,
+		 0xd4, 0xec};
+	static const __u8 delta[10] =
+		{0x35, 0x33, 0x33, 0x2f, 0x2a, 0x25, 0x1e, 0x17,
+		 0x11, 0x0b};
+
+	ret = reg_w(gspca_dev, 0xff, 0x00);	/* page 0 */
+	for (i = 0; i < 10; i++) {
+		v = max[i];
+		v += (sd->brightness - BRIGHTNESS_MAX)
+			* 150 / BRIGHTNESS_MAX;		/* 200 ? */
+		v -= delta[i] * sd->contrast / CONTRAST_MAX;
+		if (v < 0)
+			v = 0;
+		else if (v > 0xff)
+			v = 0xff;
+		if (0 <= ret)
+			ret = reg_w(gspca_dev, 0xa2 + i, v);
+	}
+	if (0 <= ret)
+		ret = reg_w(gspca_dev, 0xdc, 0x01);
+	return ret;
+}
+
+/* This function is used by pac7302 only */
+static int setcolors(struct gspca_dev *gspca_dev)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+	int i, v;
+	int ret;
+	static const int a[9] =
+		{217, -212, 0, -101, 170, -67, -38, -315, 355};
+	static const int b[9] =
+		{19, 106, 0, 19, 106, 1, 19, 106, 1};
+
+	ret = reg_w(gspca_dev, 0xff, 0x03);	/* page 3 */
+	if (0 <= ret)
+		ret = reg_w(gspca_dev, 0x11, 0x01);
+	if (0 <= ret)
+		ret = reg_w(gspca_dev, 0xff, 0x00);	/* page 0 */
+	for (i = 0; i < 9; i++) {
+		v = a[i] * sd->colors / COLOR_MAX + b[i];
+		if (0 <= ret)
+			ret = reg_w(gspca_dev, 0x0f + 2 * i, (v >> 8) & 0x07);
+		if (0 <= ret)
+			ret = reg_w(gspca_dev, 0x0f + 2 * i + 1, v);
+	}
+	if (0 <= ret)
+		ret = reg_w(gspca_dev, 0xdc, 0x01);
+	PDEBUG(D_CONF|D_STREAM, "color: %i", sd->colors);
+	return ret;
+}
+
+static int setwhitebalance(struct gspca_dev *gspca_dev)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+	int ret;
+
+	ret = reg_w(gspca_dev, 0xff, 0x00);	/* page 0 */
+	if (0 <= ret)
+		ret = reg_w(gspca_dev, 0xc6, sd->white_balance);
+
+	if (0 <= ret)
+		ret = reg_w(gspca_dev, 0xdc, 0x01);
+	PDEBUG(D_CONF|D_STREAM, "white_balance: %i", sd->white_balance);
+	return ret;
+}
+
+static int setredbalance(struct gspca_dev *gspca_dev)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+	int ret;
+
+	ret = reg_w(gspca_dev, 0xff, 0x00);	/* page 0 */
+	if (0 <= ret)
+		ret = reg_w(gspca_dev, 0xc5, sd->red_balance);
+
+	if (0 <= ret)
+		ret = reg_w(gspca_dev, 0xdc, 0x01);
+	PDEBUG(D_CONF|D_STREAM, "red_balance: %i", sd->red_balance);
+	return ret;
+}
+
+static int setbluebalance(struct gspca_dev *gspca_dev)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+	int ret;
+
+	ret = reg_w(gspca_dev, 0xff, 0x00);	/* page 0 */
+	if (0 <= ret)
+		ret = reg_w(gspca_dev, 0xc7, sd->blue_balance);
+
+	if (0 <= ret)
+		ret = reg_w(gspca_dev, 0xdc, 0x01);
+	PDEBUG(D_CONF|D_STREAM, "blue_balance: %i", sd->blue_balance);
+	return ret;
+}
+
+static int setgain(struct gspca_dev *gspca_dev)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+	int ret;
+
+	ret = reg_w(gspca_dev, 0xff, 0x03);		/* page 3 */
+	if (0 <= ret)
+		ret = reg_w(gspca_dev, 0x10, sd->gain >> 3);
+
+	/* load registers to sensor (Bit 0, auto clear) */
+	if (0 <= ret)
+		ret = reg_w(gspca_dev, 0x11, 0x01);
+	return ret;
+}
+
+static int setexposure(struct gspca_dev *gspca_dev)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+	int ret;
+	__u8 reg;
+
+	/* register 2 of frame 3/4 contains the clock divider configuring the
+	   no fps according to the formula: 60 / reg. sd->exposure is the
+	   desired exposure time in ms. */
+	reg = 120 * sd->exposure / 1000;
+	if (reg < 2)
+		reg = 2;
+	else if (reg > 63)
+		reg = 63;
+
+	/* On the pac7302 reg2 MUST be a multiple of 3, so round it to
+	   the nearest multiple of 3, except when between 6 and 12? */
+	if (reg < 6 || reg > 12)
+		reg = ((reg + 1) / 3) * 3;
+	ret = reg_w(gspca_dev, 0xff, 0x03);		/* page 3 */
+	if (0 <= ret)
+		ret = reg_w(gspca_dev, 0x02, reg);
+
+	/* load registers to sensor (Bit 0, auto clear) */
+	if (0 <= ret)
+		ret = reg_w(gspca_dev, 0x11, 0x01);
+	return ret;
+}
+
+static int sethvflip(struct gspca_dev *gspca_dev)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+	int ret;
+	u8 data, hflip, vflip;
+
+	hflip = sd->hflip;
+	if (sd->flags & FL_HFLIP)
+		hflip = !hflip;
+	vflip = sd->vflip;
+	if (sd->flags & FL_VFLIP)
+		vflip = !vflip;
+
+	ret = reg_w(gspca_dev, 0xff, 0x03);		/* page 3 */
+	data = (hflip ? 0x08 : 0x00) | (vflip ? 0x04 : 0x00);
+	if (0 <= ret)
+		ret = reg_w(gspca_dev, 0x21, data);
+	/* load registers to sensor (Bit 0, auto clear) */
+	if (0 <= ret)
+		ret = reg_w(gspca_dev, 0x11, 0x01);
+	return ret;
+}
+
+/* this function is called at probe and resume time for pac7302 */
+static int sd_init(struct gspca_dev *gspca_dev)
+{
+	return reg_w_seq(gspca_dev, init_7302, sizeof(init_7302)/2);
+}
+
+static int sd_start(struct gspca_dev *gspca_dev)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+	int ret = 0;
+
+	sd->sof_read = 0;
+
+	ret = reg_w_var(gspca_dev, start_7302,
+		page3_7302, sizeof(page3_7302),
+		NULL, 0);
+	if (0 <= ret)
+		ret = setbrightcont(gspca_dev);
+	if (0 <= ret)
+		ret = setcolors(gspca_dev);
+	if (0 <= ret)
+		ret = setwhitebalance(gspca_dev);
+	if (0 <= ret)
+		ret = setredbalance(gspca_dev);
+	if (0 <= ret)
+		ret = setbluebalance(gspca_dev);
+	if (0 <= ret)
+		ret = setgain(gspca_dev);
+	if (0 <= ret)
+		ret = setexposure(gspca_dev);
+	if (0 <= ret)
+		ret = sethvflip(gspca_dev);
+
+	/* only resolution 640x480 is supported for pac7302 */
+
+	sd->sof_read = 0;
+	sd->autogain_ignore_frames = 0;
+	atomic_set(&sd->avg_lum, -1);
+
+	/* start stream */
+	if (0 <= ret)
+		ret = reg_w(gspca_dev, 0xff, 0x01);
+	if (0 <= ret)
+		ret = reg_w(gspca_dev, 0x78, 0x01);
+
+	return ret;
+}
+
+static void sd_stopN(struct gspca_dev *gspca_dev)
+{
+	int ret;
+
+	/* stop stream */
+	ret = reg_w(gspca_dev, 0xff, 0x01);
+	if (0 <= ret)
+		ret = reg_w(gspca_dev, 0x78, 0x00);
+}
+
+/* called on streamoff with alt 0 and on disconnect for pac7302 */
+static void sd_stop0(struct gspca_dev *gspca_dev)
+{
+	int ret;
+
+	if (!gspca_dev->present)
+		return;
+	ret = reg_w(gspca_dev, 0xff, 0x01);
+	if (0 <= ret)
+		ret = reg_w(gspca_dev, 0x78, 0x40);
+}
+
+/* Include pac common sof detection functions */
+#include "pac_common.h"
+
+static void do_autogain(struct gspca_dev *gspca_dev)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+	int avg_lum = atomic_read(&sd->avg_lum);
+	int desired_lum, deadzone;
+
+	if (avg_lum == -1)
+		return;
+
+	desired_lum = 270 + sd->brightness * 4;
+	/* Hack hack, with the 7202 the first exposure step is
+	   pretty large, so if we're about to make the first
+	   exposure increase make the deadzone large to avoid
+	   oscilating */
+	if (desired_lum > avg_lum && sd->gain == GAIN_DEF &&
+			sd->exposure > EXPOSURE_DEF &&
+			sd->exposure < 42)
+		deadzone = 90;
+	else
+		deadzone = 30;
+
+	if (sd->autogain_ignore_frames > 0)
+		sd->autogain_ignore_frames--;
+	else if (gspca_auto_gain_n_exposure(gspca_dev, avg_lum, desired_lum,
+			deadzone, GAIN_KNEE, EXPOSURE_KNEE))
+		sd->autogain_ignore_frames = PAC_AUTOGAIN_IGNORE_FRAMES;
+}
+
+/* JPEG header, part 1 */
+static const unsigned char pac_jpeg_header1[] = {
+  0xff, 0xd8,		/* SOI: Start of Image */
+
+  0xff, 0xc0,		/* SOF0: Start of Frame (Baseline DCT) */
+  0x00, 0x11,		/* length = 17 bytes (including this length field) */
+  0x08			/* Precision: 8 */
+  /* 2 bytes is placed here: number of image lines */
+  /* 2 bytes is placed here: samples per line */
+};
+
+/* JPEG header, continued */
+static const unsigned char pac_jpeg_header2[] = {
+  0x03,			/* Number of image components: 3 */
+  0x01, 0x21, 0x00,	/* ID=1, Subsampling 1x1, Quantization table: 0 */
+  0x02, 0x11, 0x01,	/* ID=2, Subsampling 2x1, Quantization table: 1 */
+  0x03, 0x11, 0x01,	/* ID=3, Subsampling 2x1, Quantization table: 1 */
+
+  0xff, 0xda,		/* SOS: Start Of Scan */
+  0x00, 0x0c,		/* length = 12 bytes (including this length field) */
+  0x03,			/* number of components: 3 */
+  0x01, 0x00,		/* selector 1, table 0x00 */
+  0x02, 0x11,		/* selector 2, table 0x11 */
+  0x03, 0x11,		/* selector 3, table 0x11 */
+  0x00, 0x3f,		/* Spectral selection: 0 .. 63 */
+  0x00			/* Successive approximation: 0 */
+};
+
+static void pac_start_frame(struct gspca_dev *gspca_dev,
+		struct gspca_frame *frame,
+		__u16 lines, __u16 samples_per_line)
+{
+	unsigned char tmpbuf[4];
+
+	gspca_frame_add(gspca_dev, FIRST_PACKET,
+		pac_jpeg_header1, sizeof(pac_jpeg_header1));
+
+	tmpbuf[0] = lines >> 8;
+	tmpbuf[1] = lines & 0xff;
+	tmpbuf[2] = samples_per_line >> 8;
+	tmpbuf[3] = samples_per_line & 0xff;
+
+	gspca_frame_add(gspca_dev, INTER_PACKET,
+		tmpbuf, sizeof(tmpbuf));
+	gspca_frame_add(gspca_dev, INTER_PACKET,
+		pac_jpeg_header2, sizeof(pac_jpeg_header2));
+}
+
+/* this function is run at interrupt level */
+static void sd_pkt_scan(struct gspca_dev *gspca_dev,
+			u8 *data,			/* isoc packet */
+			int len)			/* iso packet length */
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+	struct gspca_frame *frame;
+	unsigned char *sof;
+
+	sof = pac_find_sof(&sd->sof_read, data, len);
+	if (sof) {
+		int n, lum_offset, footer_length;
+
+		frame = gspca_get_i_frame(gspca_dev);
+		if (frame == NULL) {
+			gspca_dev->last_packet_type = DISCARD_PACKET;
+			return;
+		}
+
+		/* 6 bytes after the FF D9 EOF marker a number of lumination
+		   bytes are send corresponding to different parts of the
+		   image, the 14th and 15th byte after the EOF seem to
+		   correspond to the center of the image */
+		lum_offset = 61 + sizeof pac_sof_marker;
+		footer_length = 74;
+
+		/* Finish decoding current frame */
+		n = (sof - data) - (footer_length + sizeof pac_sof_marker);
+		if (n < 0) {
+			frame->data_end += n;
+			n = 0;
+		}
+		gspca_frame_add(gspca_dev, INTER_PACKET,
+					data, n);
+		if (gspca_dev->last_packet_type != DISCARD_PACKET &&
+				frame->data_end[-2] == 0xff &&
+				frame->data_end[-1] == 0xd9)
+			gspca_frame_add(gspca_dev, LAST_PACKET,
+						NULL, 0);
+
+		n = sof - data;
+		len -= n;
+		data = sof;
+
+		/* Get average lumination */
+		if (gspca_dev->last_packet_type == LAST_PACKET &&
+				n >= lum_offset)
+			atomic_set(&sd->avg_lum, data[-lum_offset] +
+						data[-lum_offset + 1]);
+		else
+			atomic_set(&sd->avg_lum, -1);
+
+		/* Start the new frame with the jpeg header */
+		/* The PAC7302 has the image rotated 90 degrees */
+		pac_start_frame(gspca_dev, frame,
+			gspca_dev->width, gspca_dev->height);
+	}
+	gspca_frame_add(gspca_dev, INTER_PACKET, data, len);
+}
+
+static int sd_setbrightness(struct gspca_dev *gspca_dev, __s32 val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	sd->brightness = val;
+	if (gspca_dev->streaming)
+		setbrightcont(gspca_dev);
+	return 0;
+}
+
+static int sd_getbrightness(struct gspca_dev *gspca_dev, __s32 *val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	*val = sd->brightness;
+	return 0;
+}
+
+static int sd_setcontrast(struct gspca_dev *gspca_dev, __s32 val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	sd->contrast = val;
+	if (gspca_dev->streaming) {
+		setbrightcont(gspca_dev);
+	}
+	return 0;
+}
+
+static int sd_getcontrast(struct gspca_dev *gspca_dev, __s32 *val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	*val = sd->contrast;
+	return 0;
+}
+
+static int sd_setcolors(struct gspca_dev *gspca_dev, __s32 val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	sd->colors = val;
+	if (gspca_dev->streaming)
+		setcolors(gspca_dev);
+	return 0;
+}
+
+static int sd_getcolors(struct gspca_dev *gspca_dev, __s32 *val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	*val = sd->colors;
+	return 0;
+}
+
+static int sd_setwhitebalance(struct gspca_dev *gspca_dev, __s32 val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+	int ret = 0;
+
+	sd->white_balance = val;
+	if (gspca_dev->streaming)
+		ret = setwhitebalance(gspca_dev);
+	if (0 <= ret)
+		ret = 0;
+	return ret;
+}
+
+static int sd_getwhitebalance(struct gspca_dev *gspca_dev, __s32 *val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	*val = sd->white_balance;
+	return 0;
+}
+
+static int sd_setredbalance(struct gspca_dev *gspca_dev, __s32 val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+	int ret = 0;
+
+	sd->red_balance = val;
+	if (gspca_dev->streaming)
+		ret = setredbalance(gspca_dev);
+	if (0 <= ret)
+		ret = 0;
+	return ret;
+}
+
+static int sd_getredbalance(struct gspca_dev *gspca_dev, __s32 *val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	*val = sd->red_balance;
+	return 0;
+}
+
+static int sd_setbluebalance(struct gspca_dev *gspca_dev, __s32 val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+	int ret = 0;
+
+	sd->blue_balance = val;
+	if (gspca_dev->streaming)
+		ret = setbluebalance(gspca_dev);
+	if (0 <= ret)
+		ret = 0;
+	return ret;
+}
+
+static int sd_getbluebalance(struct gspca_dev *gspca_dev, __s32 *val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	*val = sd->blue_balance;
+	return 0;
+}
+
+static int sd_setgain(struct gspca_dev *gspca_dev, __s32 val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	sd->gain = val;
+	if (gspca_dev->streaming)
+		setgain(gspca_dev);
+	return 0;
+}
+
+static int sd_getgain(struct gspca_dev *gspca_dev, __s32 *val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	*val = sd->gain;
+	return 0;
+}
+
+static int sd_setexposure(struct gspca_dev *gspca_dev, __s32 val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	sd->exposure = val;
+	if (gspca_dev->streaming)
+		setexposure(gspca_dev);
+	return 0;
+}
+
+static int sd_getexposure(struct gspca_dev *gspca_dev, __s32 *val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	*val = sd->exposure;
+	return 0;
+}
+
+static int sd_setautogain(struct gspca_dev *gspca_dev, __s32 val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	sd->autogain = val;
+	/* when switching to autogain set defaults to make sure
+	   we are on a valid point of the autogain gain /
+	   exposure knee graph, and give this change time to
+	   take effect before doing autogain. */
+	if (sd->autogain) {
+		sd->exposure = EXPOSURE_DEF;
+		sd->gain = GAIN_DEF;
+		if (gspca_dev->streaming) {
+			sd->autogain_ignore_frames =
+				PAC_AUTOGAIN_IGNORE_FRAMES;
+			setexposure(gspca_dev);
+			setgain(gspca_dev);
+		}
+	}
+
+	return 0;
+}
+
+static int sd_getautogain(struct gspca_dev *gspca_dev, __s32 *val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	*val = sd->autogain;
+	return 0;
+}
+
+static int sd_sethflip(struct gspca_dev *gspca_dev, __s32 val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	sd->hflip = val;
+	if (gspca_dev->streaming)
+		sethvflip(gspca_dev);
+	return 0;
+}
+
+static int sd_gethflip(struct gspca_dev *gspca_dev, __s32 *val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	*val = sd->hflip;
+	return 0;
+}
+
+static int sd_setvflip(struct gspca_dev *gspca_dev, __s32 val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	sd->vflip = val;
+	if (gspca_dev->streaming)
+		sethvflip(gspca_dev);
+	return 0;
+}
+
+static int sd_getvflip(struct gspca_dev *gspca_dev, __s32 *val)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	*val = sd->vflip;
+	return 0;
+}
+
+#ifdef CONFIG_VIDEO_ADV_DEBUG
+static int sd_dbg_s_register(struct gspca_dev *gspca_dev,
+			struct v4l2_dbg_register *reg)
+{
+	int ret = -EINVAL;
+	__u8 index;
+	__u8 value;
+
+	/* reg->reg: bit0..15: reserved for register index (wIndex is 16bit
+			       long on the USB bus)
+	*/
+	if (reg->match.type == V4L2_CHIP_MATCH_HOST &&
+	    reg->match.addr == 0 &&
+	    (reg->reg < 0x000000ff) &&
+	    (reg->val <= 0x000000ff)
+	) {
+		/* Currently writing to page 0 is only supported. */
+		/* reg_w() only supports 8bit index */
+		index = reg->reg & 0x000000ff;
+		value = reg->val & 0x000000ff;
+
+		/* Note that there shall be no access to other page
+		   by any other function between the page swith and
+		   the actual register write */
+		ret = reg_w(gspca_dev, 0xff, 0x00);	/* page 0 */
+		if (0 <= ret)
+			ret = reg_w(gspca_dev, index, value);
+
+		if (0 <= ret)
+			ret = reg_w(gspca_dev, 0xdc, 0x01);
+	}
+	return ret;
+}
+
+static int sd_chip_ident(struct gspca_dev *gspca_dev,
+			struct v4l2_dbg_chip_ident *chip)
+{
+	int ret = -EINVAL;
+
+	if (chip->match.type == V4L2_CHIP_MATCH_HOST &&
+	    chip->match.addr == 0) {
+		chip->revision = 0;
+		chip->ident = V4L2_IDENT_UNKNOWN;
+		ret = 0;
+	}
+	return ret;
+}
+#endif
+
+/* sub-driver description for pac7302 */
+static struct sd_desc sd_desc = {
+	.name = MODULE_NAME,
+	.ctrls = sd_ctrls,
+	.nctrls = ARRAY_SIZE(sd_ctrls),
+	.config = sd_config,
+	.init = sd_init,
+	.start = sd_start,
+	.stopN = sd_stopN,
+	.stop0 = sd_stop0,
+	.pkt_scan = sd_pkt_scan,
+	.dq_callback = do_autogain,
+#ifdef CONFIG_VIDEO_ADV_DEBUG
+	.set_register = sd_dbg_s_register,
+	.get_chip_ident = sd_chip_ident,
+#endif
+};
+
+/* -- module initialisation -- */
+static const struct usb_device_id device_table[] __devinitconst = {
+	{USB_DEVICE(0x06f8, 0x3009)},
+	{USB_DEVICE(0x093a, 0x2620)},
+	{USB_DEVICE(0x093a, 0x2621)},
+	{USB_DEVICE(0x093a, 0x2622), .driver_info = FL_VFLIP},
+	{USB_DEVICE(0x093a, 0x2624), .driver_info = FL_VFLIP},
+	{USB_DEVICE(0x093a, 0x2626)},
+	{USB_DEVICE(0x093a, 0x2628)},
+	{USB_DEVICE(0x093a, 0x2629), .driver_info = FL_VFLIP},
+	{USB_DEVICE(0x093a, 0x262a)},
+	{USB_DEVICE(0x093a, 0x262c)},
+	{}
+};
+MODULE_DEVICE_TABLE(usb, device_table);
+
+/* -- device connect -- */
+static int __devinit sd_probe(struct usb_interface *intf,
+			const struct usb_device_id *id)
+{
+	return gspca_dev_probe(intf, id, &sd_desc, sizeof(struct sd),
+				THIS_MODULE);
+}
+
+static struct usb_driver sd_driver = {
+	.name = MODULE_NAME,
+	.id_table = device_table,
+	.probe = sd_probe,
+	.disconnect = gspca_disconnect,
+#ifdef CONFIG_PM
+	.suspend = gspca_suspend,
+	.resume = gspca_resume,
+#endif
+};
+
+/* -- module insert / remove -- */
+static int __init sd_mod_init(void)
+{
+	int ret;
+	ret = usb_register(&sd_driver);
+	if (ret < 0)
+		return ret;
+	PDEBUG(D_PROBE, "registered");
+	return 0;
+}
+static void __exit sd_mod_exit(void)
+{
+	usb_deregister(&sd_driver);
+	PDEBUG(D_PROBE, "deregistered");
+}
+
+module_init(sd_mod_init);
+module_exit(sd_mod_exit);
diff --git a/drivers/media/video/gspca/pac7311.c b/drivers/media/video/gspca/pac7311.c
index 052714484e83..42cfcdfd8f4f 100644
--- a/drivers/media/video/gspca/pac7311.c
+++ b/drivers/media/video/gspca/pac7311.c
@@ -57,23 +57,17 @@ MODULE_AUTHOR("Thomas Kaiser thomas@kaiser-linux.li");
 MODULE_DESCRIPTION("Pixart PAC7311");
 MODULE_LICENSE("GPL");
 
-/* specific webcam descriptor */
+/* specific webcam descriptor for pac7311 */
 struct sd {
 	struct gspca_dev gspca_dev;		/* !! must be the first item */
 
-	unsigned char brightness;
 	unsigned char contrast;
-	unsigned char colors;
 	unsigned char gain;
 	unsigned char exposure;
 	unsigned char autogain;
 	__u8 hflip;
 	__u8 vflip;
 
-	__u8 sensor;
-#define SENSOR_PAC7302 0
-#define SENSOR_PAC7311 1
-
 	u8 sof_read;
 	u8 autogain_ignore_frames;
 
@@ -81,12 +75,8 @@ struct sd {
 };
 
 /* V4L2 controls supported by the driver */
-static int sd_setbrightness(struct gspca_dev *gspca_dev, __s32 val);
-static int sd_getbrightness(struct gspca_dev *gspca_dev, __s32 *val);
 static int sd_setcontrast(struct gspca_dev *gspca_dev, __s32 val);
 static int sd_getcontrast(struct gspca_dev *gspca_dev, __s32 *val);
-static int sd_setcolors(struct gspca_dev *gspca_dev, __s32 val);
-static int sd_getcolors(struct gspca_dev *gspca_dev, __s32 *val);
 static int sd_setautogain(struct gspca_dev *gspca_dev, __s32 val);
 static int sd_getautogain(struct gspca_dev *gspca_dev, __s32 *val);
 static int sd_sethflip(struct gspca_dev *gspca_dev, __s32 val);
@@ -99,23 +89,6 @@ static int sd_setexposure(struct gspca_dev *gspca_dev, __s32 val);
 static int sd_getexposure(struct gspca_dev *gspca_dev, __s32 *val);
 
 static struct ctrl sd_ctrls[] = {
-/* This control is pac7302 only */
-#define BRIGHTNESS_IDX 0
-	{
-	    {
-		.id      = V4L2_CID_BRIGHTNESS,
-		.type    = V4L2_CTRL_TYPE_INTEGER,
-		.name    = "Brightness",
-		.minimum = 0,
-#define BRIGHTNESS_MAX 0x20
-		.maximum = BRIGHTNESS_MAX,
-		.step    = 1,
-#define BRIGHTNESS_DEF 0x10
-		.default_value = BRIGHTNESS_DEF,
-	    },
-	    .set = sd_setbrightness,
-	    .get = sd_getbrightness,
-	},
 /* This control is for both the 7302 and the 7311 */
 	{
 	    {
@@ -132,23 +105,6 @@ static struct ctrl sd_ctrls[] = {
 	    .set = sd_setcontrast,
 	    .get = sd_getcontrast,
 	},
-/* This control is pac7302 only */
-#define SATURATION_IDX 2
-	{
-	    {
-		.id      = V4L2_CID_SATURATION,
-		.type    = V4L2_CTRL_TYPE_INTEGER,
-		.name    = "Saturation",
-		.minimum = 0,
-#define COLOR_MAX 255
-		.maximum = COLOR_MAX,
-		.step    = 1,
-#define COLOR_DEF 127
-		.default_value = COLOR_DEF,
-	    },
-	    .set = sd_setcolors,
-	    .get = sd_getcolors,
-	},
 /* All controls below are for both the 7302 and the 7311 */
 	{
 	    {
@@ -244,101 +200,9 @@ static const struct v4l2_pix_format vga_mode[] = {
 		.priv = 0},
 };
 
-/* pac 7302 */
-static const __u8 init_7302[] = {
-/*	index,value */
-	0xff, 0x01,		/* page 1 */
-	0x78, 0x00,		/* deactivate */
-	0xff, 0x01,
-	0x78, 0x40,		/* led off */
-};
-static const __u8 start_7302[] = {
-/*	index, len, [value]* */
-	0xff, 1,	0x00,		/* page 0 */
-	0x00, 12,	0x01, 0x40, 0x40, 0x40, 0x01, 0xe0, 0x02, 0x80,
-			0x00, 0x00, 0x00, 0x00,
-	0x0d, 24,	0x03, 0x01, 0x00, 0xb5, 0x07, 0xcb, 0x00, 0x00,
-			0x07, 0xc8, 0x00, 0xea, 0x07, 0xcf, 0x07, 0xf7,
-			0x07, 0x7e, 0x01, 0x0b, 0x00, 0x00, 0x00, 0x11,
-	0x26, 2,	0xaa, 0xaa,
-	0x2e, 1,	0x31,
-	0x38, 1,	0x01,
-	0x3a, 3,	0x14, 0xff, 0x5a,
-	0x43, 11,	0x00, 0x0a, 0x18, 0x11, 0x01, 0x2c, 0x88, 0x11,
-			0x00, 0x54, 0x11,
-	0x55, 1,	0x00,
-	0x62, 4, 	0x10, 0x1e, 0x1e, 0x18,
-	0x6b, 1,	0x00,
-	0x6e, 3,	0x08, 0x06, 0x00,
-	0x72, 3,	0x00, 0xff, 0x00,
-	0x7d, 23,	0x01, 0x01, 0x58, 0x46, 0x50, 0x3c, 0x50, 0x3c,
-			0x54, 0x46, 0x54, 0x56, 0x52, 0x50, 0x52, 0x50,
-			0x56, 0x64, 0xa4, 0x00, 0xda, 0x00, 0x00,
-	0xa2, 10,	0x22, 0x2c, 0x3c, 0x54, 0x69, 0x7c, 0x9c, 0xb9,
-			0xd2, 0xeb,
-	0xaf, 1,	0x02,
-	0xb5, 2,	0x08, 0x08,
-	0xb8, 2,	0x08, 0x88,
-	0xc4, 4,	0xae, 0x01, 0x04, 0x01,
-	0xcc, 1,	0x00,
-	0xd1, 11,	0x01, 0x30, 0x49, 0x5e, 0x6f, 0x7f, 0x8e, 0xa9,
-			0xc1, 0xd7, 0xec,
-	0xdc, 1,	0x01,
-	0xff, 1,	0x01,		/* page 1 */
-	0x12, 3,	0x02, 0x00, 0x01,
-	0x3e, 2,	0x00, 0x00,
-	0x76, 5,	0x01, 0x20, 0x40, 0x00, 0xf2,
-	0x7c, 1,	0x00,
-	0x7f, 10,	0x4b, 0x0f, 0x01, 0x2c, 0x02, 0x58, 0x03, 0x20,
-			0x02, 0x00,
-	0x96, 5,	0x01, 0x10, 0x04, 0x01, 0x04,
-	0xc8, 14,	0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00,
-			0x07, 0x00, 0x01, 0x07, 0x04, 0x01,
-	0xd8, 1,	0x01,
-	0xdb, 2,	0x00, 0x01,
-	0xde, 7,	0x00, 0x01, 0x04, 0x04, 0x00, 0x00, 0x00,
-	0xe6, 4,	0x00, 0x00, 0x00, 0x01,
-	0xeb, 1,	0x00,
-	0xff, 1,	0x02,		/* page 2 */
-	0x22, 1,	0x00,
-	0xff, 1,	0x03,		/* page 3 */
-	0x00, 255,			/* load the page 3 */
-	0x11, 1,	0x01,
-	0xff, 1,	0x02,		/* page 2 */
-	0x13, 1,	0x00,
-	0x22, 4,	0x1f, 0xa4, 0xf0, 0x96,
-	0x27, 2,	0x14, 0x0c,
-	0x2a, 5,	0xc8, 0x00, 0x18, 0x12, 0x22,
-	0x64, 8,	0x00, 0x00, 0xf0, 0x01, 0x14, 0x44, 0x44, 0x44,
-	0x6e, 1,	0x08,
-	0xff, 1,	0x01,		/* page 1 */
-	0x78, 1,	0x00,
-	0, 0				/* end of sequence */
-};
-
-/* page 3 - the value 0xaa says skip the index - see reg_w_page() */
-static const __u8 page3_7302[] = {
-	0x90, 0x40, 0x03, 0x50, 0xc2, 0x01, 0x14, 0x16,
-	0x14, 0x12, 0x00, 0x00, 0x00, 0x02, 0x33, 0x00,
-	0x0f, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	0x00, 0x00, 0x00, 0x47, 0x01, 0xb3, 0x01, 0x00,
-	0x00, 0x08, 0x00, 0x00, 0x0d, 0x00, 0x00, 0x21,
-	0x00, 0x00, 0x00, 0x54, 0xf4, 0x02, 0x52, 0x54,
-	0xa4, 0xb8, 0xe0, 0x2a, 0xf6, 0x00, 0x00, 0x00,
-	0x00, 0x1e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	0x00, 0xfc, 0x00, 0xf2, 0x1f, 0x04, 0x00, 0x00,
-	0x00, 0x00, 0x00, 0xc0, 0xc0, 0x10, 0x00, 0x00,
-	0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	0x00, 0x40, 0xff, 0x03, 0x19, 0x00, 0x00, 0x00,
-	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	0x00, 0x00, 0x00, 0x00, 0x00, 0xc8, 0xc8, 0xc8,
-	0xc8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x50,
-	0x08, 0x10, 0x24, 0x40, 0x00, 0x00, 0x00, 0x00,
-	0x01, 0x00, 0x02, 0x47, 0x00, 0x00, 0x00, 0x00,
-	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	0x00, 0x02, 0xfa, 0x00, 0x64, 0x5a, 0x28, 0x00,
-	0x00
-};
+#define LOAD_PAGE3		255
+#define LOAD_PAGE4		254
+#define END_OF_SEQUENCE		0
 
 /* pac 7311 */
 static const __u8 init_7311[] = {
@@ -378,119 +242,154 @@ static const __u8 start_7311[] = {
 	0xf0, 13,	0x01, 0x00, 0x00, 0x00, 0x22, 0x00, 0x20, 0x00,
 			0x3f, 0x00, 0x0a, 0x01, 0x00,
 	0xff, 1,	0x04,		/* page 4 */
-	0x00, 254,			/* load the page 4 */
+	0, LOAD_PAGE4,			/* load the page 4 */
 	0x11, 1,	0x01,
-	0, 0				/* end of sequence */
+	0, END_OF_SEQUENCE		/* end of sequence */
 };
 
-/* page 4 - the value 0xaa says skip the index - see reg_w_page() */
+#define SKIP		0xaa
+/* page 4 - the value SKIP says skip the index - see reg_w_page() */
 static const __u8 page4_7311[] = {
-	0xaa, 0xaa, 0x04, 0x54, 0x07, 0x2b, 0x09, 0x0f,
-	0x09, 0x00, 0xaa, 0xaa, 0x07, 0x00, 0x00, 0x62,
-	0x08, 0xaa, 0x07, 0x00, 0x00, 0x00, 0x00, 0x00,
-	0x00, 0x00, 0x00, 0x03, 0xa0, 0x01, 0xf4, 0xaa,
-	0xaa, 0x00, 0x08, 0xaa, 0x03, 0xaa, 0x00, 0x68,
+	SKIP, SKIP, 0x04, 0x54, 0x07, 0x2b, 0x09, 0x0f,
+	0x09, 0x00, SKIP, SKIP, 0x07, 0x00, 0x00, 0x62,
+	0x08, SKIP, 0x07, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x03, 0xa0, 0x01, 0xf4, SKIP,
+	SKIP, 0x00, 0x08, SKIP, 0x03, SKIP, 0x00, 0x68,
 	0xca, 0x10, 0x06, 0x78, 0x00, 0x00, 0x00, 0x00,
 	0x23, 0x28, 0x04, 0x11, 0x00, 0x00
 };
 
-static void reg_w_buf(struct gspca_dev *gspca_dev,
+static int reg_w_buf(struct gspca_dev *gspca_dev,
 		  __u8 index,
 		  const char *buffer, int len)
 {
+	int ret;
+
 	memcpy(gspca_dev->usb_buf, buffer, len);
-	usb_control_msg(gspca_dev->dev,
+	ret = usb_control_msg(gspca_dev->dev,
 			usb_sndctrlpipe(gspca_dev->dev, 0),
 			1,		/* request */
 			USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
 			0,		/* value */
 			index, gspca_dev->usb_buf, len,
 			500);
+	if (ret < 0)
+		PDEBUG(D_ERR, "reg_w_buf(): "
+		"Failed to write registers to index 0x%x, error %i",
+		index, ret);
+	return ret;
 }
 
 
-static void reg_w(struct gspca_dev *gspca_dev,
+static int reg_w(struct gspca_dev *gspca_dev,
 		  __u8 index,
 		  __u8 value)
 {
+	int ret;
+
 	gspca_dev->usb_buf[0] = value;
-	usb_control_msg(gspca_dev->dev,
+	ret = usb_control_msg(gspca_dev->dev,
 			usb_sndctrlpipe(gspca_dev->dev, 0),
 			0,			/* request */
 			USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
 			0, index, gspca_dev->usb_buf, 1,
 			500);
+	if (ret < 0)
+		PDEBUG(D_ERR, "reg_w(): "
+		"Failed to write register to index 0x%x, value 0x%x, error %i",
+		index, value, ret);
+	return ret;
 }
 
-static void reg_w_seq(struct gspca_dev *gspca_dev,
+static int reg_w_seq(struct gspca_dev *gspca_dev,
 		const __u8 *seq, int len)
 {
+	int ret = 0;
 	while (--len >= 0) {
-		reg_w(gspca_dev, seq[0], seq[1]);
+		if (0 <= ret)
+			ret = reg_w(gspca_dev, seq[0], seq[1]);
 		seq += 2;
 	}
+	return ret;
 }
 
 /* load the beginning of a page */
-static void reg_w_page(struct gspca_dev *gspca_dev,
+static int reg_w_page(struct gspca_dev *gspca_dev,
 			const __u8 *page, int len)
 {
 	int index;
+	int ret = 0;
 
 	for (index = 0; index < len; index++) {
-		if (page[index] == 0xaa)		/* skip this index */
+		if (page[index] == SKIP)		/* skip this index */
 			continue;
 		gspca_dev->usb_buf[0] = page[index];
-		usb_control_msg(gspca_dev->dev,
+		ret = usb_control_msg(gspca_dev->dev,
 				usb_sndctrlpipe(gspca_dev->dev, 0),
 				0,			/* request */
 			USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
 				0, index, gspca_dev->usb_buf, 1,
 				500);
+		if (ret < 0) {
+			PDEBUG(D_ERR, "reg_w_page(): "
+			"Failed to write register to index 0x%x, "
+			"value 0x%x, error %i",
+			index, page[index], ret);
+			break;
+		}
 	}
+	return ret;
 }
 
 /* output a variable sequence */
-static void reg_w_var(struct gspca_dev *gspca_dev,
-			const __u8 *seq)
+static int reg_w_var(struct gspca_dev *gspca_dev,
+			const __u8 *seq,
+			const __u8 *page3, unsigned int page3_len,
+			const __u8 *page4, unsigned int page4_len)
 {
 	int index, len;
+	int ret = 0;
 
 	for (;;) {
 		index = *seq++;
 		len = *seq++;
 		switch (len) {
-		case 0:
-			return;
-		case 254:
-			reg_w_page(gspca_dev, page4_7311, sizeof page4_7311);
+		case END_OF_SEQUENCE:
+			return ret;
+		case LOAD_PAGE4:
+			ret = reg_w_page(gspca_dev, page4, page4_len);
 			break;
-		case 255:
-			reg_w_page(gspca_dev, page3_7302, sizeof page3_7302);
+		case LOAD_PAGE3:
+			ret = reg_w_page(gspca_dev, page3, page3_len);
 			break;
 		default:
-			if (len > 64) {
+			if (len > USB_BUF_SZ) {
 				PDEBUG(D_ERR|D_STREAM,
 					"Incorrect variable sequence");
-				return;
+				return -EINVAL;
 			}
 			while (len > 0) {
 				if (len < 8) {
-					reg_w_buf(gspca_dev, index, seq, len);
+					ret = reg_w_buf(gspca_dev,
+						index, seq, len);
+					if (ret < 0)
+						return ret;
 					seq += len;
 					break;
 				}
-				reg_w_buf(gspca_dev, index, seq, 8);
+				ret = reg_w_buf(gspca_dev, index, seq, 8);
 				seq += 8;
 				index += 8;
 				len -= 8;
 			}
 		}
+		if (ret < 0)
+			return ret;
 	}
 	/* not reached */
 }
 
-/* this function is called at probe time */
+/* this function is called at probe time for pac7311 */
 static int sd_config(struct gspca_dev *gspca_dev,
 			const struct usb_device_id *id)
 {
@@ -499,22 +398,11 @@ static int sd_config(struct gspca_dev *gspca_dev,
 
 	cam = &gspca_dev->cam;
 
-	sd->sensor = id->driver_info;
-	if (sd->sensor == SENSOR_PAC7302) {
-		PDEBUG(D_CONF, "Find Sensor PAC7302");
-		cam->cam_mode = &vga_mode[2];	/* only 640x480 */
-		cam->nmodes = 1;
-	} else {
-		PDEBUG(D_CONF, "Find Sensor PAC7311");
-		cam->cam_mode = vga_mode;
-		cam->nmodes = ARRAY_SIZE(vga_mode);
-		gspca_dev->ctrl_dis = (1 << BRIGHTNESS_IDX)
-				| (1 << SATURATION_IDX);
-	}
+	PDEBUG(D_CONF, "Find Sensor PAC7311");
+	cam->cam_mode = vga_mode;
+	cam->nmodes = ARRAY_SIZE(vga_mode);
 
-	sd->brightness = BRIGHTNESS_DEF;
 	sd->contrast = CONTRAST_DEF;
-	sd->colors = COLOR_DEF;
 	sd->gain = GAIN_DEF;
 	sd->exposure = EXPOSURE_DEF;
 	sd->autogain = AUTOGAIN_DEF;
@@ -523,91 +411,47 @@ static int sd_config(struct gspca_dev *gspca_dev,
 	return 0;
 }
 
-/* This function is used by pac7302 only */
-static void setbrightcont(struct gspca_dev *gspca_dev)
-{
-	struct sd *sd = (struct sd *) gspca_dev;
-	int i, v;
-	static const __u8 max[10] =
-		{0x29, 0x33, 0x42, 0x5a, 0x6e, 0x80, 0x9f, 0xbb,
-		 0xd4, 0xec};
-	static const __u8 delta[10] =
-		{0x35, 0x33, 0x33, 0x2f, 0x2a, 0x25, 0x1e, 0x17,
-		 0x11, 0x0b};
-
-	reg_w(gspca_dev, 0xff, 0x00);	/* page 0 */
-	for (i = 0; i < 10; i++) {
-		v = max[i];
-		v += (sd->brightness - BRIGHTNESS_MAX)
-			* 150 / BRIGHTNESS_MAX;		/* 200 ? */
-		v -= delta[i] * sd->contrast / CONTRAST_MAX;
-		if (v < 0)
-			v = 0;
-		else if (v > 0xff)
-			v = 0xff;
-		reg_w(gspca_dev, 0xa2 + i, v);
-	}
-	reg_w(gspca_dev, 0xdc, 0x01);
-}
-
 /* This function is used by pac7311 only */
-static void setcontrast(struct gspca_dev *gspca_dev)
+static int setcontrast(struct gspca_dev *gspca_dev)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
+	int ret;
 
-	reg_w(gspca_dev, 0xff, 0x04);
-	reg_w(gspca_dev, 0x10, sd->contrast >> 4);
+	ret = reg_w(gspca_dev, 0xff, 0x04);
+	if (0 <= ret)
+		ret = reg_w(gspca_dev, 0x10, sd->contrast >> 4);
 	/* load registers to sensor (Bit 0, auto clear) */
-	reg_w(gspca_dev, 0x11, 0x01);
+	if (0 <= ret)
+		ret = reg_w(gspca_dev, 0x11, 0x01);
+	return ret;
 }
 
-/* This function is used by pac7302 only */
-static void setcolors(struct gspca_dev *gspca_dev)
+static int setgain(struct gspca_dev *gspca_dev)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
-	int i, v;
-	static const int a[9] =
-		{217, -212, 0, -101, 170, -67, -38, -315, 355};
-	static const int b[9] =
-		{19, 106, 0, 19, 106, 1, 19, 106, 1};
-
-	reg_w(gspca_dev, 0xff, 0x03);	/* page 3 */
-	reg_w(gspca_dev, 0x11, 0x01);
-	reg_w(gspca_dev, 0xff, 0x00);	/* page 0 */
-	reg_w(gspca_dev, 0xff, 0x00);	/* page 0 */
-	for (i = 0; i < 9; i++) {
-		v = a[i] * sd->colors / COLOR_MAX + b[i];
-		reg_w(gspca_dev, 0x0f + 2 * i, (v >> 8) & 0x07);
-		reg_w(gspca_dev, 0x0f + 2 * i + 1, v);
-	}
-	reg_w(gspca_dev, 0xdc, 0x01);
-	PDEBUG(D_CONF|D_STREAM, "color: %i", sd->colors);
-}
+	int gain = GAIN_MAX - sd->gain;
+	int ret;
 
-static void setgain(struct gspca_dev *gspca_dev)
-{
-	struct sd *sd = (struct sd *) gspca_dev;
+	if (gain < 1)
+		gain = 1;
+	else if (gain > 245)
+		gain = 245;
+	ret = reg_w(gspca_dev, 0xff, 0x04);		/* page 4 */
+	if (0 <= ret)
+		ret = reg_w(gspca_dev, 0x0e, 0x00);
+	if (0 <= ret)
+		ret = reg_w(gspca_dev, 0x0f, gain);
 
-	if (sd->sensor == SENSOR_PAC7302) {
-		reg_w(gspca_dev, 0xff, 0x03);		/* page 3 */
-		reg_w(gspca_dev, 0x10, sd->gain >> 3);
-	} else {
-		int gain = GAIN_MAX - sd->gain;
-		if (gain < 1)
-			gain = 1;
-		else if (gain > 245)
-			gain = 245;
-		reg_w(gspca_dev, 0xff, 0x04);		/* page 4 */
-		reg_w(gspca_dev, 0x0e, 0x00);
-		reg_w(gspca_dev, 0x0f, gain);
-	}
 	/* load registers to sensor (Bit 0, auto clear) */
-	reg_w(gspca_dev, 0x11, 0x01);
+	if (0 <= ret)
+		ret = reg_w(gspca_dev, 0x11, 0x01);
+	return ret;
 }
 
-static void setexposure(struct gspca_dev *gspca_dev)
+static int setexposure(struct gspca_dev *gspca_dev)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
+	int ret;
 	__u8 reg;
 
 	/* register 2 of frame 3/4 contains the clock divider configuring the
@@ -619,97 +463,94 @@ static void setexposure(struct gspca_dev *gspca_dev)
 	else if (reg > 63)
 		reg = 63;
 
-	if (sd->sensor == SENSOR_PAC7302) {
-		/* On the pac7302 reg2 MUST be a multiple of 3, so round it to
-		   the nearest multiple of 3, except when between 6 and 12? */
-		if (reg < 6 || reg > 12)
-			reg = ((reg + 1) / 3) * 3;
-		reg_w(gspca_dev, 0xff, 0x03);		/* page 3 */
-		reg_w(gspca_dev, 0x02, reg);
+	ret = reg_w(gspca_dev, 0xff, 0x04);		/* page 4 */
+	if (0 <= ret)
+		ret = reg_w(gspca_dev, 0x02, reg);
+	/* Page 1 register 8 must always be 0x08 except when not in
+	   640x480 mode and Page3/4 reg 2 <= 3 then it must be 9 */
+	if (0 <= ret)
+		ret = reg_w(gspca_dev, 0xff, 0x01);
+	if (gspca_dev->cam.cam_mode[(int)gspca_dev->curr_mode].priv &&
+			reg <= 3) {
+		if (0 <= ret)
+			ret = reg_w(gspca_dev, 0x08, 0x09);
 	} else {
-		reg_w(gspca_dev, 0xff, 0x04);		/* page 4 */
-		reg_w(gspca_dev, 0x02, reg);
-		/* Page 1 register 8 must always be 0x08 except when not in
-		   640x480 mode and Page3/4 reg 2 <= 3 then it must be 9 */
-		reg_w(gspca_dev, 0xff, 0x01);
-		if (gspca_dev->cam.cam_mode[(int)gspca_dev->curr_mode].priv &&
-				reg <= 3)
-			reg_w(gspca_dev, 0x08, 0x09);
-		else
-			reg_w(gspca_dev, 0x08, 0x08);
+		if (0 <= ret)
+			ret = reg_w(gspca_dev, 0x08, 0x08);
 	}
+
 	/* load registers to sensor (Bit 0, auto clear) */
-	reg_w(gspca_dev, 0x11, 0x01);
+	if (0 <= ret)
+		ret = reg_w(gspca_dev, 0x11, 0x01);
+	return ret;
 }
 
-static void sethvflip(struct gspca_dev *gspca_dev)
+static int sethvflip(struct gspca_dev *gspca_dev)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
+	int ret;
 	__u8 data;
 
-	if (sd->sensor == SENSOR_PAC7302) {
-		reg_w(gspca_dev, 0xff, 0x03);		/* page 3 */
-		data = (sd->hflip ? 0x08 : 0x00)
-			| (sd->vflip ? 0x04 : 0x00);
-	} else {
-		reg_w(gspca_dev, 0xff, 0x04);		/* page 4 */
-		data = (sd->hflip ? 0x04 : 0x00)
-			| (sd->vflip ? 0x08 : 0x00);
-	}
-	reg_w(gspca_dev, 0x21, data);
+	ret = reg_w(gspca_dev, 0xff, 0x04);		/* page 4 */
+	data = (sd->hflip ? 0x04 : 0x00) | (sd->vflip ? 0x08 : 0x00);
+	if (0 <= ret)
+		ret = reg_w(gspca_dev, 0x21, data);
 	/* load registers to sensor (Bit 0, auto clear) */
-	reg_w(gspca_dev, 0x11, 0x01);
+	if (0 <= ret)
+		ret = reg_w(gspca_dev, 0x11, 0x01);
+	return ret;
 }
 
-/* this function is called at probe and resume time */
+/* this function is called at probe and resume time for pac7311 */
 static int sd_init(struct gspca_dev *gspca_dev)
 {
-	struct sd *sd = (struct sd *) gspca_dev;
-
-	if (sd->sensor == SENSOR_PAC7302)
-		reg_w_seq(gspca_dev, init_7302, sizeof init_7302);
-	else
-		reg_w_seq(gspca_dev, init_7311, sizeof init_7311);
-
-	return 0;
+	return reg_w_seq(gspca_dev, init_7311, sizeof(init_7311)/2);
 }
 
 static int sd_start(struct gspca_dev *gspca_dev)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
+	int ret;
 
 	sd->sof_read = 0;
 
-	if (sd->sensor == SENSOR_PAC7302) {
-		reg_w_var(gspca_dev, start_7302);
-		setbrightcont(gspca_dev);
-		setcolors(gspca_dev);
-	} else {
-		reg_w_var(gspca_dev, start_7311);
-		setcontrast(gspca_dev);
-	}
-	setgain(gspca_dev);
-	setexposure(gspca_dev);
-	sethvflip(gspca_dev);
+	ret = reg_w_var(gspca_dev, start_7311,
+		NULL, 0,
+		page4_7311, sizeof(page4_7311));
+	if (0 <= ret)
+		ret = setcontrast(gspca_dev);
+	if (0 <= ret)
+		ret = setgain(gspca_dev);
+	if (0 <= ret)
+		ret = setexposure(gspca_dev);
+	if (0 <= ret)
+		ret = sethvflip(gspca_dev);
 
 	/* set correct resolution */
 	switch (gspca_dev->cam.cam_mode[(int) gspca_dev->curr_mode].priv) {
 	case 2:					/* 160x120 pac7311 */
-		reg_w(gspca_dev, 0xff, 0x01);
-		reg_w(gspca_dev, 0x17, 0x20);
-		reg_w(gspca_dev, 0x87, 0x10);
+		if (0 <= ret)
+			ret = reg_w(gspca_dev, 0xff, 0x01);
+		if (0 <= ret)
+			ret = reg_w(gspca_dev, 0x17, 0x20);
+		if (0 <= ret)
+			ret = reg_w(gspca_dev, 0x87, 0x10);
 		break;
 	case 1:					/* 320x240 pac7311 */
-		reg_w(gspca_dev, 0xff, 0x01);
-		reg_w(gspca_dev, 0x17, 0x30);
-		reg_w(gspca_dev, 0x87, 0x11);
+		if (0 <= ret)
+			ret = reg_w(gspca_dev, 0xff, 0x01);
+		if (0 <= ret)
+			ret = reg_w(gspca_dev, 0x17, 0x30);
+		if (0 <= ret)
+			ret = reg_w(gspca_dev, 0x87, 0x11);
 		break;
 	case 0:					/* 640x480 */
-		if (sd->sensor == SENSOR_PAC7302)
-			break;
-		reg_w(gspca_dev, 0xff, 0x01);
-		reg_w(gspca_dev, 0x17, 0x00);
-		reg_w(gspca_dev, 0x87, 0x12);
+		if (0 <= ret)
+			ret = reg_w(gspca_dev, 0xff, 0x01);
+		if (0 <= ret)
+			ret = reg_w(gspca_dev, 0x17, 0x00);
+		if (0 <= ret)
+			ret = reg_w(gspca_dev, 0x87, 0x12);
 		break;
 	}
 
@@ -718,47 +559,42 @@ static int sd_start(struct gspca_dev *gspca_dev)
 	atomic_set(&sd->avg_lum, -1);
 
 	/* start stream */
-	reg_w(gspca_dev, 0xff, 0x01);
-	if (sd->sensor == SENSOR_PAC7302)
-		reg_w(gspca_dev, 0x78, 0x01);
-	else
-		reg_w(gspca_dev, 0x78, 0x05);
-	return 0;
+	if (0 <= ret)
+		ret = reg_w(gspca_dev, 0xff, 0x01);
+	if (0 <= ret)
+		ret = reg_w(gspca_dev, 0x78, 0x05);
+
+	return ret;
 }
 
 static void sd_stopN(struct gspca_dev *gspca_dev)
 {
-	struct sd *sd = (struct sd *) gspca_dev;
-
-	if (sd->sensor == SENSOR_PAC7302) {
-		reg_w(gspca_dev, 0xff, 0x01);
-		reg_w(gspca_dev, 0x78, 0x00);
-		reg_w(gspca_dev, 0x78, 0x00);
-		return;
-	}
-	reg_w(gspca_dev, 0xff, 0x04);
-	reg_w(gspca_dev, 0x27, 0x80);
-	reg_w(gspca_dev, 0x28, 0xca);
-	reg_w(gspca_dev, 0x29, 0x53);
-	reg_w(gspca_dev, 0x2a, 0x0e);
-	reg_w(gspca_dev, 0xff, 0x01);
-	reg_w(gspca_dev, 0x3e, 0x20);
-	reg_w(gspca_dev, 0x78, 0x44); /* Bit_0=start stream, Bit_6=LED */
-	reg_w(gspca_dev, 0x78, 0x44); /* Bit_0=start stream, Bit_6=LED */
-	reg_w(gspca_dev, 0x78, 0x44); /* Bit_0=start stream, Bit_6=LED */
-}
+	int ret;
 
-/* called on streamoff with alt 0 and on disconnect */
+	ret = reg_w(gspca_dev, 0xff, 0x04);
+	if (0 <= ret)
+		ret = reg_w(gspca_dev, 0x27, 0x80);
+	if (0 <= ret)
+		ret = reg_w(gspca_dev, 0x28, 0xca);
+	if (0 <= ret)
+		ret = reg_w(gspca_dev, 0x29, 0x53);
+	if (0 <= ret)
+		ret = reg_w(gspca_dev, 0x2a, 0x0e);
+	if (0 <= ret)
+		ret = reg_w(gspca_dev, 0xff, 0x01);
+	if (0 <= ret)
+		ret = reg_w(gspca_dev, 0x3e, 0x20);
+	if (0 <= ret)
+		ret = reg_w(gspca_dev, 0x78, 0x44); /* Bit_0=start stream, Bit_6=LED */
+	if (0 <= ret)
+		ret = reg_w(gspca_dev, 0x78, 0x44); /* Bit_0=start stream, Bit_6=LED */
+	if (0 <= ret)
+		ret = reg_w(gspca_dev, 0x78, 0x44); /* Bit_0=start stream, Bit_6=LED */
+}
+
+/* called on streamoff with alt 0 and on disconnect for 7311 */
 static void sd_stop0(struct gspca_dev *gspca_dev)
 {
-	struct sd *sd = (struct sd *) gspca_dev;
-
-	if (!gspca_dev->present)
-		return;
-	if (sd->sensor == SENSOR_PAC7302) {
-		reg_w(gspca_dev, 0xff, 0x01);
-		reg_w(gspca_dev, 0x78, 0x40);
-	}
 }
 
 /* Include pac common sof detection functions */
@@ -773,22 +609,8 @@ static void do_autogain(struct gspca_dev *gspca_dev)
 	if (avg_lum == -1)
 		return;
 
-	if (sd->sensor == SENSOR_PAC7302) {
-		desired_lum = 270 + sd->brightness * 4;
-		/* Hack hack, with the 7202 the first exposure step is
-		   pretty large, so if we're about to make the first
-		   exposure increase make the deadzone large to avoid
-		   oscilating */
-		if (desired_lum > avg_lum && sd->gain == GAIN_DEF &&
-				sd->exposure > EXPOSURE_DEF &&
-				sd->exposure < 42)
-			deadzone = 90;
-		else
-			deadzone = 30;
-	} else {
-		desired_lum = 200;
-		deadzone = 20;
-	}
+	desired_lum = 200;
+	deadzone = 20;
 
 	if (sd->autogain_ignore_frames > 0)
 		sd->autogain_ignore_frames--;
@@ -797,53 +619,92 @@ static void do_autogain(struct gspca_dev *gspca_dev)
 		sd->autogain_ignore_frames = PAC_AUTOGAIN_IGNORE_FRAMES;
 }
 
-static const unsigned char pac7311_jpeg_header1[] = {
-  0xff, 0xd8, 0xff, 0xc0, 0x00, 0x11, 0x08
+/* JPEG header, part 1 */
+static const unsigned char pac_jpeg_header1[] = {
+  0xff, 0xd8,		/* SOI: Start of Image */
+
+  0xff, 0xc0,		/* SOF0: Start of Frame (Baseline DCT) */
+  0x00, 0x11,		/* length = 17 bytes (including this length field) */
+  0x08			/* Precision: 8 */
+  /* 2 bytes is placed here: number of image lines */
+  /* 2 bytes is placed here: samples per line */
 };
 
-static const unsigned char pac7311_jpeg_header2[] = {
-  0x03, 0x01, 0x21, 0x00, 0x02, 0x11, 0x01, 0x03, 0x11, 0x01, 0xff, 0xda,
-  0x00, 0x0c, 0x03, 0x01, 0x00, 0x02, 0x11, 0x03, 0x11, 0x00, 0x3f, 0x00
+/* JPEG header, continued */
+static const unsigned char pac_jpeg_header2[] = {
+  0x03,			/* Number of image components: 3 */
+  0x01, 0x21, 0x00,	/* ID=1, Subsampling 1x1, Quantization table: 0 */
+  0x02, 0x11, 0x01,	/* ID=2, Subsampling 2x1, Quantization table: 1 */
+  0x03, 0x11, 0x01,	/* ID=3, Subsampling 2x1, Quantization table: 1 */
+
+  0xff, 0xda,		/* SOS: Start Of Scan */
+  0x00, 0x0c,		/* length = 12 bytes (including this length field) */
+  0x03,			/* number of components: 3 */
+  0x01, 0x00,		/* selector 1, table 0x00 */
+  0x02, 0x11,		/* selector 2, table 0x11 */
+  0x03, 0x11,		/* selector 3, table 0x11 */
+  0x00, 0x3f,		/* Spectral selection: 0 .. 63 */
+  0x00			/* Successive approximation: 0 */
 };
 
+static void pac_start_frame(struct gspca_dev *gspca_dev,
+		struct gspca_frame *frame,
+		__u16 lines, __u16 samples_per_line)
+{
+	unsigned char tmpbuf[4];
+
+	gspca_frame_add(gspca_dev, FIRST_PACKET,
+		pac_jpeg_header1, sizeof(pac_jpeg_header1));
+
+	tmpbuf[0] = lines >> 8;
+	tmpbuf[1] = lines & 0xff;
+	tmpbuf[2] = samples_per_line >> 8;
+	tmpbuf[3] = samples_per_line & 0xff;
+
+	gspca_frame_add(gspca_dev, INTER_PACKET,
+		tmpbuf, sizeof(tmpbuf));
+	gspca_frame_add(gspca_dev, INTER_PACKET,
+		pac_jpeg_header2, sizeof(pac_jpeg_header2));
+}
+
 /* this function is run at interrupt level */
 static void sd_pkt_scan(struct gspca_dev *gspca_dev,
-			struct gspca_frame *frame,	/* target */
-			__u8 *data,			/* isoc packet */
+			u8 *data,			/* isoc packet */
 			int len)			/* iso packet length */
 {
 	struct sd *sd = (struct sd *) gspca_dev;
 	unsigned char *sof;
+	struct gspca_frame *frame;
 
-	sof = pac_find_sof(gspca_dev, data, len);
+	sof = pac_find_sof(&sd->sof_read, data, len);
 	if (sof) {
-		unsigned char tmpbuf[4];
 		int n, lum_offset, footer_length;
 
-		if (sd->sensor == SENSOR_PAC7302) {
-		  /* 6 bytes after the FF D9 EOF marker a number of lumination
-		     bytes are send corresponding to different parts of the
-		     image, the 14th and 15th byte after the EOF seem to
-		     correspond to the center of the image */
-		  lum_offset = 61 + sizeof pac_sof_marker;
-		  footer_length = 74;
-		} else {
-		  lum_offset = 24 + sizeof pac_sof_marker;
-		  footer_length = 26;
+		frame = gspca_get_i_frame(gspca_dev);
+		if (frame == NULL) {
+			gspca_dev->last_packet_type = DISCARD_PACKET;
+			return;
 		}
 
+		/* 6 bytes after the FF D9 EOF marker a number of lumination
+		   bytes are send corresponding to different parts of the
+		   image, the 14th and 15th byte after the EOF seem to
+		   correspond to the center of the image */
+		lum_offset = 24 + sizeof pac_sof_marker;
+		footer_length = 26;
+
 		/* Finish decoding current frame */
 		n = (sof - data) - (footer_length + sizeof pac_sof_marker);
 		if (n < 0) {
 			frame->data_end += n;
 			n = 0;
 		}
-		frame = gspca_frame_add(gspca_dev, INTER_PACKET, frame,
+		gspca_frame_add(gspca_dev, INTER_PACKET,
 					data, n);
 		if (gspca_dev->last_packet_type != DISCARD_PACKET &&
 				frame->data_end[-2] == 0xff &&
 				frame->data_end[-1] == 0xd9)
-			frame = gspca_frame_add(gspca_dev, LAST_PACKET, frame,
+			gspca_frame_add(gspca_dev, LAST_PACKET,
 						NULL, 0);
 
 		n = sof - data;
@@ -859,43 +720,10 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
 			atomic_set(&sd->avg_lum, -1);
 
 		/* Start the new frame with the jpeg header */
-		gspca_frame_add(gspca_dev, FIRST_PACKET, frame,
-			pac7311_jpeg_header1, sizeof(pac7311_jpeg_header1));
-		if (sd->sensor == SENSOR_PAC7302) {
-			/* The PAC7302 has the image rotated 90 degrees */
-			tmpbuf[0] = gspca_dev->width >> 8;
-			tmpbuf[1] = gspca_dev->width & 0xff;
-			tmpbuf[2] = gspca_dev->height >> 8;
-			tmpbuf[3] = gspca_dev->height & 0xff;
-		} else {
-			tmpbuf[0] = gspca_dev->height >> 8;
-			tmpbuf[1] = gspca_dev->height & 0xff;
-			tmpbuf[2] = gspca_dev->width >> 8;
-			tmpbuf[3] = gspca_dev->width & 0xff;
-		}
-		gspca_frame_add(gspca_dev, INTER_PACKET, frame, tmpbuf, 4);
-		gspca_frame_add(gspca_dev, INTER_PACKET, frame,
-			pac7311_jpeg_header2, sizeof(pac7311_jpeg_header2));
+		pac_start_frame(gspca_dev, frame,
+			gspca_dev->height, gspca_dev->width);
 	}
-	gspca_frame_add(gspca_dev, INTER_PACKET, frame, data, len);
-}
-
-static int sd_setbrightness(struct gspca_dev *gspca_dev, __s32 val)
-{
-	struct sd *sd = (struct sd *) gspca_dev;
-
-	sd->brightness = val;
-	if (gspca_dev->streaming)
-		setbrightcont(gspca_dev);
-	return 0;
-}
-
-static int sd_getbrightness(struct gspca_dev *gspca_dev, __s32 *val)
-{
-	struct sd *sd = (struct sd *) gspca_dev;
-
-	*val = sd->brightness;
-	return 0;
+	gspca_frame_add(gspca_dev, INTER_PACKET, data, len);
 }
 
 static int sd_setcontrast(struct gspca_dev *gspca_dev, __s32 val)
@@ -904,10 +732,7 @@ static int sd_setcontrast(struct gspca_dev *gspca_dev, __s32 val)
 
 	sd->contrast = val;
 	if (gspca_dev->streaming) {
-		if (sd->sensor == SENSOR_PAC7302)
-			setbrightcont(gspca_dev);
-		else
-			setcontrast(gspca_dev);
+		setcontrast(gspca_dev);
 	}
 	return 0;
 }
@@ -920,24 +745,6 @@ static int sd_getcontrast(struct gspca_dev *gspca_dev, __s32 *val)
 	return 0;
 }
 
-static int sd_setcolors(struct gspca_dev *gspca_dev, __s32 val)
-{
-	struct sd *sd = (struct sd *) gspca_dev;
-
-	sd->colors = val;
-	if (gspca_dev->streaming)
-		setcolors(gspca_dev);
-	return 0;
-}
-
-static int sd_getcolors(struct gspca_dev *gspca_dev, __s32 *val)
-{
-	struct sd *sd = (struct sd *) gspca_dev;
-
-	*val = sd->colors;
-	return 0;
-}
-
 static int sd_setgain(struct gspca_dev *gspca_dev, __s32 val)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
@@ -1041,7 +848,7 @@ static int sd_getvflip(struct gspca_dev *gspca_dev, __s32 *val)
 	return 0;
 }
 
-/* sub-driver description */
+/* sub-driver description for pac7311 */
 static struct sd_desc sd_desc = {
 	.name = MODULE_NAME,
 	.ctrls = sd_ctrls,
@@ -1056,28 +863,19 @@ static struct sd_desc sd_desc = {
 };
 
 /* -- module initialisation -- */
-static __devinitdata struct usb_device_id device_table[] = {
-	{USB_DEVICE(0x06f8, 0x3009), .driver_info = SENSOR_PAC7302},
-	{USB_DEVICE(0x093a, 0x2600), .driver_info = SENSOR_PAC7311},
-	{USB_DEVICE(0x093a, 0x2601), .driver_info = SENSOR_PAC7311},
-	{USB_DEVICE(0x093a, 0x2603), .driver_info = SENSOR_PAC7311},
-	{USB_DEVICE(0x093a, 0x2608), .driver_info = SENSOR_PAC7311},
-	{USB_DEVICE(0x093a, 0x260e), .driver_info = SENSOR_PAC7311},
-	{USB_DEVICE(0x093a, 0x260f), .driver_info = SENSOR_PAC7311},
-	{USB_DEVICE(0x093a, 0x2620), .driver_info = SENSOR_PAC7302},
-	{USB_DEVICE(0x093a, 0x2621), .driver_info = SENSOR_PAC7302},
-	{USB_DEVICE(0x093a, 0x2622), .driver_info = SENSOR_PAC7302},
-	{USB_DEVICE(0x093a, 0x2624), .driver_info = SENSOR_PAC7302},
-	{USB_DEVICE(0x093a, 0x2626), .driver_info = SENSOR_PAC7302},
-	{USB_DEVICE(0x093a, 0x2629), .driver_info = SENSOR_PAC7302},
-	{USB_DEVICE(0x093a, 0x262a), .driver_info = SENSOR_PAC7302},
-	{USB_DEVICE(0x093a, 0x262c), .driver_info = SENSOR_PAC7302},
+static const struct usb_device_id device_table[] __devinitconst = {
+	{USB_DEVICE(0x093a, 0x2600)},
+	{USB_DEVICE(0x093a, 0x2601)},
+	{USB_DEVICE(0x093a, 0x2603)},
+	{USB_DEVICE(0x093a, 0x2608)},
+	{USB_DEVICE(0x093a, 0x260e)},
+	{USB_DEVICE(0x093a, 0x260f)},
 	{}
 };
 MODULE_DEVICE_TABLE(usb, device_table);
 
 /* -- device connect -- */
-static int sd_probe(struct usb_interface *intf,
+static int __devinit sd_probe(struct usb_interface *intf,
 			const struct usb_device_id *id)
 {
 	return gspca_dev_probe(intf, id, &sd_desc, sizeof(struct sd),
diff --git a/drivers/media/video/gspca/pac_common.h b/drivers/media/video/gspca/pac_common.h
index 34d4b1494cd5..20f67d9b8c06 100644
--- a/drivers/media/video/gspca/pac_common.h
+++ b/drivers/media/video/gspca/pac_common.h
@@ -33,26 +33,101 @@
 static const unsigned char pac_sof_marker[5] =
 		{ 0xff, 0xff, 0x00, 0xff, 0x96 };
 
-static unsigned char *pac_find_sof(struct gspca_dev *gspca_dev,
+/*
+   The following state machine finds the SOF marker sequence
+   0xff, 0xff, 0x00, 0xff, 0x96 in a byte stream.
+
+	   +----------+
+	   | 0: START |<---------------\
+	   +----------+<-\             |
+	     |       \---/otherwise    |
+	     v 0xff                    |
+	   +----------+ otherwise      |
+	   |     1    |--------------->*
+	   |          |                ^
+	   +----------+                |
+	     |                         |
+	     v 0xff                    |
+	   +----------+<-\0xff         |
+	/->|          |--/             |
+	|  |     2    |--------------->*
+	|  |          | otherwise      ^
+	|  +----------+                |
+	|    |                         |
+	|    v 0x00                    |
+	|  +----------+                |
+	|  |     3    |                |
+	|  |          |--------------->*
+	|  +----------+ otherwise      ^
+	|    |                         |
+   0xff |    v 0xff                    |
+	|  +----------+                |
+	\--|     4    |                |
+	   |          |----------------/
+	   +----------+ otherwise
+	     |
+	     v 0x96
+	   +----------+
+	   |  FOUND   |
+	   +----------+
+*/
+
+static unsigned char *pac_find_sof(u8 *sof_read,
 					unsigned char *m, int len)
 {
-	struct sd *sd = (struct sd *) gspca_dev;
 	int i;
 
 	/* Search for the SOF marker (fixed part) in the header */
 	for (i = 0; i < len; i++) {
-		if (m[i] == pac_sof_marker[sd->sof_read]) {
-			sd->sof_read++;
-			if (sd->sof_read == sizeof(pac_sof_marker)) {
+		switch (*sof_read) {
+		case 0:
+			if (m[i] == 0xff)
+				*sof_read = 1;
+			break;
+		case 1:
+			if (m[i] == 0xff)
+				*sof_read = 2;
+			else
+				*sof_read = 0;
+			break;
+		case 2:
+			switch (m[i]) {
+			case 0x00:
+				*sof_read = 3;
+				break;
+			case 0xff:
+				/* stay in this state */
+				break;
+			default:
+				*sof_read = 0;
+			}
+			break;
+		case 3:
+			if (m[i] == 0xff)
+				*sof_read = 4;
+			else
+				*sof_read = 0;
+			break;
+		case 4:
+			switch (m[i]) {
+			case 0x96:
+				/* Pattern found */
 				PDEBUG(D_FRAM,
 					"SOF found, bytes to analyze: %u."
 					" Frame starts at byte #%u",
 					len, i + 1);
-				sd->sof_read = 0;
+				*sof_read = 0;
 				return m + i + 1;
+				break;
+			case 0xff:
+				*sof_read = 2;
+				break;
+			default:
+				*sof_read = 0;
 			}
-		} else {
-			sd->sof_read = 0;
+			break;
+		default:
+			*sof_read = 0;
 		}
 	}
 
diff --git a/drivers/media/video/gspca/sn9c20x.c b/drivers/media/video/gspca/sn9c20x.c
index cdad3db33367..0ca1c06652b1 100644
--- a/drivers/media/video/gspca/sn9c20x.c
+++ b/drivers/media/video/gspca/sn9c20x.c
@@ -1158,7 +1158,7 @@ static int i2c_w2(struct gspca_dev *gspca_dev, u8 reg, u16 val)
 	return i2c_w(gspca_dev, row);
 }
 
-int i2c_r1(struct gspca_dev *gspca_dev, u8 reg, u8 *val)
+static int i2c_r1(struct gspca_dev *gspca_dev, u8 reg, u8 *val)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
 	u8 row[8];
@@ -1183,7 +1183,7 @@ int i2c_r1(struct gspca_dev *gspca_dev, u8 reg, u8 *val)
 	return 0;
 }
 
-int i2c_r2(struct gspca_dev *gspca_dev, u8 reg, u16 *val)
+static int i2c_r2(struct gspca_dev *gspca_dev, u8 reg, u16 *val)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
 	u8 row[8];
@@ -1476,8 +1476,9 @@ static int sn9c20x_input_init(struct gspca_dev *gspca_dev)
 	if (input_register_device(sd->input_dev))
 		return -EINVAL;
 
-	sd->input_task = kthread_run(input_kthread, gspca_dev, "sn9c20x/%d",
-				     gspca_dev->vdev.minor);
+	sd->input_task = kthread_run(input_kthread, gspca_dev, "sn9c20x/%s-%s",
+				     gspca_dev->dev->bus->bus_name,
+				     gspca_dev->dev->devpath);
 
 	if (IS_ERR(sd->input_task))
 		return -EINVAL;
@@ -2174,8 +2175,7 @@ static void configure_sensor_output(struct gspca_dev *gspca_dev, int mode)
 }
 
 #define HW_WIN(mode, hstart, vstart) \
-((const u8 []){hstart & 0xff, hstart >> 8, \
-vstart & 0xff, vstart >> 8, \
+((const u8 []){hstart, 0, vstart, 0, \
 (mode & MODE_SXGA ? 1280 >> 4 : 640 >> 4), \
 (mode & MODE_SXGA ? 1024 >> 3 : 480 >> 3)})
 
@@ -2319,7 +2319,7 @@ static void do_autogain(struct gspca_dev *gspca_dev, u16 avg_lum)
 		}
 	}
 	if (avg_lum > MAX_AVG_LUM) {
-		if (sd->gain - 1 >= 0) {
+		if (sd->gain >= 1) {
 			sd->gain--;
 			set_gain(gspca_dev);
 		}
@@ -2342,7 +2342,6 @@ static void sd_dqcallback(struct gspca_dev *gspca_dev)
 }
 
 static void sd_pkt_scan(struct gspca_dev *gspca_dev,
-			struct gspca_frame *frame,	/* target */
 			u8 *data,			/* isoc packet */
 			int len)			/* iso packet length */
 {
@@ -2378,22 +2377,22 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
 		avg_lum >>= 9;
 		atomic_set(&sd->avg_lum, avg_lum);
 		gspca_frame_add(gspca_dev, LAST_PACKET,
-				frame, data, len);
+				data, len);
 		return;
 	}
 	if (gspca_dev->last_packet_type == LAST_PACKET) {
 		if (gspca_dev->cam.cam_mode[(int) gspca_dev->curr_mode].priv
 				& MODE_JPEG) {
-			gspca_frame_add(gspca_dev, FIRST_PACKET, frame,
+			gspca_frame_add(gspca_dev, FIRST_PACKET,
 				sd->jpeg_hdr, JPEG_HDR_SZ);
-			gspca_frame_add(gspca_dev, INTER_PACKET, frame,
+			gspca_frame_add(gspca_dev, INTER_PACKET,
 				data, len);
 		} else {
-			gspca_frame_add(gspca_dev, FIRST_PACKET, frame,
+			gspca_frame_add(gspca_dev, FIRST_PACKET,
 				data, len);
 		}
 	} else {
-		gspca_frame_add(gspca_dev, INTER_PACKET, frame, data, len);
+		gspca_frame_add(gspca_dev, INTER_PACKET, data, len);
 	}
 }
 
diff --git a/drivers/media/video/gspca/sonixb.c b/drivers/media/video/gspca/sonixb.c
index cf3af8de6e97..ddff2b5ee5c2 100644
--- a/drivers/media/video/gspca/sonixb.c
+++ b/drivers/media/video/gspca/sonixb.c
@@ -304,7 +304,7 @@ static const __u8 initOv6650[] = {
 };
 static const __u8 ov6650_sensor_init[][8] =
 {
-	/* Bright, contrast, etc are set througth SCBB interface.
+	/* Bright, contrast, etc are set through SCBB interface.
 	 * AVCAP on win2 do not send any data on this 	controls. */
 	/* Anyway, some registers appears to alter bright and constrat */
 
@@ -995,8 +995,7 @@ static void sd_stopN(struct gspca_dev *gspca_dev)
 }
 
 static void sd_pkt_scan(struct gspca_dev *gspca_dev,
-			struct gspca_frame *frame,	/* target */
-			unsigned char *data,		/* isoc packet */
+			u8 *data,			/* isoc packet */
 			int len)			/* iso packet length */
 {
 	int i;
@@ -1054,12 +1053,12 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
 					pkt_type = DISCARD_PACKET;
 				}
 
-				frame = gspca_frame_add(gspca_dev, pkt_type,
-							frame, data, 0);
+				gspca_frame_add(gspca_dev, pkt_type,
+						NULL, 0);
 				data += i + fr_h_sz;
 				len -= i + fr_h_sz;
 				gspca_frame_add(gspca_dev, FIRST_PACKET,
-						frame, data, len);
+						data, len);
 				return;
 			}
 		}
@@ -1068,15 +1067,21 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
 	if (cam->cam_mode[gspca_dev->curr_mode].priv & MODE_RAW) {
 		/* In raw mode we sometimes get some garbage after the frame
 		   ignore this */
-		int used = frame->data_end - frame->data;
+		struct gspca_frame *frame;
+		int used;
 		int size = cam->cam_mode[gspca_dev->curr_mode].sizeimage;
 
+		frame = gspca_get_i_frame(gspca_dev);
+		if (frame == NULL) {
+			gspca_dev->last_packet_type = DISCARD_PACKET;
+			return;
+		}
+		used = frame->data_end - frame->data;
 		if (used + len > size)
 			len = size - used;
 	}
 
-	gspca_frame_add(gspca_dev, INTER_PACKET,
-			frame, data, len);
+	gspca_frame_add(gspca_dev, INTER_PACKET, data, len);
 }
 
 static int sd_setbrightness(struct gspca_dev *gspca_dev, __s32 val)
@@ -1221,7 +1226,7 @@ static const struct sd_desc sd_desc = {
 	.driver_info = (SENSOR_ ## sensor << 8) | BRIDGE_ ## bridge
 
 
-static __devinitdata struct usb_device_id device_table[] = {
+static const struct usb_device_id device_table[] __devinitconst = {
 	{USB_DEVICE(0x0c45, 0x6001), SB(TAS5110, 102)}, /* TAS5110C1B */
 	{USB_DEVICE(0x0c45, 0x6005), SB(TAS5110, 101)}, /* TAS5110C1B */
 #if !defined CONFIG_USB_SN9C102 && !defined CONFIG_USB_SN9C102_MODULE
@@ -1252,7 +1257,7 @@ static __devinitdata struct usb_device_id device_table[] = {
 MODULE_DEVICE_TABLE(usb, device_table);
 
 /* -- device connect -- */
-static int sd_probe(struct usb_interface *intf,
+static int __devinit sd_probe(struct usb_interface *intf,
 			const struct usb_device_id *id)
 {
 	return gspca_dev_probe(intf, id, &sd_desc, sizeof(struct sd),
diff --git a/drivers/media/video/gspca/sonixj.c b/drivers/media/video/gspca/sonixj.c
index 33f4d0a1f6fd..0bd36a00dd2a 100644
--- a/drivers/media/video/gspca/sonixj.c
+++ b/drivers/media/video/gspca/sonixj.c
@@ -1,8 +1,8 @@
 /*
- *		Sonix sn9c102p sn9c105 sn9c120 (jpeg) library
- *		Copyright (C) 2005 Michel Xhaard mxhaard@magic.fr
+ * Sonix sn9c102p sn9c105 sn9c120 (jpeg) subdriver
  *
- * V4L2 by Jean-Francois Moine <http://moinejf.free.fr>
+ * Copyright (C) 2009 Jean-Francois Moine <http://moinejf.free.fr>
+ * Copyright (C) 2005 Michel Xhaard mxhaard@magic.fr
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -72,8 +72,9 @@ struct sd {
 #define SENSOR_OV7630 5
 #define SENSOR_OV7648 6
 #define SENSOR_OV7660 7
-#define SENSOR_SP80708 8
-	u8 i2c_base;
+#define SENSOR_PO1030 8
+#define SENSOR_SP80708 9
+	u8 i2c_addr;
 
 	u8 *jpeg_hdr;
 };
@@ -250,7 +251,7 @@ static struct ctrl sd_ctrls[] = {
 		.minimum = 0,
 		.maximum = 2,	/* 0: 0, 1: 50Hz, 2:60Hz */
 		.step    = 1,
-#define FREQ_DEF 2
+#define FREQ_DEF 1
 		.default_value = FREQ_DEF,
 	    },
 	    .set = sd_setfreq,
@@ -277,7 +278,9 @@ static __u32 ctrl_dis[] = {
 	(1 << AUTOGAIN_IDX) | (1 << INFRARED_IDX) | (1 << VFLIP_IDX),
 						/* SENSOR_OV7660 7 */
 	(1 << AUTOGAIN_IDX) | (1 << INFRARED_IDX) | (1 << VFLIP_IDX) |
-			      (1 << FREQ_IDX),	/* SENSOR_SP80708 8 */
+			      (1 << FREQ_IDX),	/* SENSOR_PO1030 8 */
+	(1 << AUTOGAIN_IDX) | (1 << INFRARED_IDX) | (1 << VFLIP_IDX) |
+			      (1 << FREQ_IDX),	/* SENSOR_SP80708 9 */
 };
 
 static const struct v4l2_pix_format vga_mode[] = {
@@ -304,7 +307,7 @@ static const u8 sn_hv7131[0x1c] = {
 /*	reg0	reg1	reg2	reg3	reg4	reg5	reg6	reg7 */
 	0x00,	0x03,	0x64,	0x00,	0x1a,	0x20,	0x20,	0x20,
 /*	reg8	reg9	rega	regb	regc	regd	rege	regf */
-	0xa1,	0x11,	0x02,	0x09,	0x00,	0x00,	0x00,	0x10,
+	0x81,	0x11,	0x00,	0x00,	0x00,	0x00,	0x00,	0x00,
 /*	reg10	reg11	reg12	reg13	reg14	reg15	reg16	reg17 */
 	0x03,	0x00,	0x00,	0x01,	0x03,	0x28,	0x1e,	0x41,
 /*	reg18	reg19	reg1a	reg1b */
@@ -315,7 +318,7 @@ static const u8 sn_mi0360[0x1c] = {
 /*	reg0	reg1	reg2	reg3	reg4	reg5	reg6	reg7 */
 	0x00,	0x61,	0x44,	0x00,	0x1a,	0x20,	0x20,	0x20,
 /*	reg8	reg9	rega	regb	regc	regd	rege	regf */
-	0xb1,	0x5d,	0x07,	0x00,	0x00,	0x00,	0x00,	0x10,
+	0x81,	0x5d,	0x00,	0x00,	0x00,	0x00,	0x00,	0x00,
 /*	reg10	reg11	reg12	reg13	reg14	reg15	reg16	reg17 */
 	0x03,	0x00,	0x00,	0x02,	0x0a,	0x28,	0x1e,	0x61,
 /*	reg18	reg19	reg1a	reg1b */
@@ -337,7 +340,7 @@ static const u8 sn_mt9v111[0x1c] = {
 /*	reg0	reg1	reg2	reg3	reg4	reg5	reg6	reg7 */
 	0x00,	0x61,	0x40,	0x00,	0x1a,	0x20,	0x20,	0x20,
 /*	reg8	reg9	rega	regb	regc	regd	rege	regf */
-	0x81,	0x5c,	0x07,	0x00,	0x00,	0x00,	0x00,	0x00,
+	0x81,	0x5c,	0x00,	0x00,	0x00,	0x00,	0x00,	0x00,
 /*	reg10	reg11	reg12	reg13	reg14	reg15	reg16	reg17 */
 	0x03,	0x00,	0x00,	0x02,	0x1c,	0x28,	0x1e,	0x40,
 /*	reg18	reg19	reg1a	reg1b */
@@ -346,7 +349,7 @@ static const u8 sn_mt9v111[0x1c] = {
 
 static const u8 sn_om6802[0x1c] = {
 /*	reg0	reg1	reg2	reg3	reg4	reg5	reg6	reg7 */
-	0x00,	0x23,	0x72,	0x00,	0x1a,	0x34,	0x27,	0x20,
+	0x00,	0x23,	0x72,	0x00,	0x1a,	0x20,	0x20,	0x19,
 /*	reg8	reg9	rega	regb	regc	regd	rege	regf */
 	0x80,	0x34,	0x00,	0x00,	0x00,	0x00,	0x00,	0x00,
 /*	reg10	reg11	reg12	reg13	reg14	reg15	reg16	reg17 */
@@ -359,7 +362,7 @@ static const u8 sn_ov7630[0x1c] = {
 /*	reg0	reg1	reg2	reg3	reg4	reg5	reg6	reg7 */
 	0x00,	0x21,	0x40,	0x00,	0x1a,	0x20,	0x1f,	0x20,
 /*	reg8	reg9	rega	regb	regc	regd	rege	regf */
-	0xa1,	0x21,	0x76,	0x21,	0x00,	0x00,	0x00,	0x10,
+	0x81,	0x21,	0x00,	0x00,	0x00,	0x00,	0x00,	0x00,
 /*	reg10	reg11	reg12	reg13	reg14	reg15	reg16	reg17 */
 	0x03,	0x00,	0x04,	0x01,	0x0a,	0x28,	0x1e,	0xc2,
 /*	reg18	reg19	reg1a	reg1b */
@@ -370,7 +373,7 @@ static const u8 sn_ov7648[0x1c] = {
 /*	reg0	reg1	reg2	reg3	reg4	reg5	reg6	reg7 */
 	0x00,	0x63,	0x40,	0x00,	0x1a,	0x20,	0x20,	0x20,
 /*	reg8	reg9	rega	regb	regc	regd	rege	regf */
-	0x81,	0x21,	0x00,	0x00,	0x00,	0x00,	0x00,	0x10,
+	0x81,	0x21,	0x00,	0x00,	0x00,	0x00,	0x00,	0x00,
 /*	reg10	reg11	reg12	reg13	reg14	reg15	reg16	reg17 */
 	0x03,	0x00,	0x00,	0x01,	0x00,	0x28,	0x1e,	0x00,
 /*	reg18	reg19	reg1a	reg1b */
@@ -388,11 +391,22 @@ static const u8 sn_ov7660[0x1c] = {
 	0x07,	0x00,	0x00,	0x00
 };
 
+static const u8 sn_po1030[0x1c] = {
+/*	reg0	reg1	reg2	reg3	reg4	reg5	reg6	reg7 */
+	0x00,	0x21,	0x62,	0x00,	0x1a,	0x20,	0x20,	0x20,
+/*	reg8	reg9	rega	regb	regc	regd	rege	regf */
+	0x81,	0x6e,	0x00,	0x00,	0x00,	0x00,	0x00,	0x00,
+/*	reg10	reg11	reg12	reg13	reg14	reg15	reg16	reg17 */
+	0x03,	0x00,	0x00,	0x06,	0x06,	0x28,	0x1e,	0x00,
+/*	reg18	reg19	reg1a	reg1b */
+	0x07,	0x00,	0x00,	0x00
+};
+
 static const u8 sn_sp80708[0x1c] = {
 /*	reg0	reg1	reg2	reg3	reg4	reg5	reg6	reg7 */
 	0x00,	0x63,	0x60,	0x00,	0x1a,	0x20,	0x20,	0x20,
 /*	reg8	reg9	rega	regb	regc	regd	rege	regf */
-	0x81,	0x18,	0x07,	0x00,	0x00,	0x00,	0x00,	0x00,
+	0x81,	0x18,	0x00,	0x00,	0x00,	0x00,	0x00,	0x00,
 /*	reg10	reg11	reg12	reg13	reg14	reg15	reg16	reg17 */
 	0x03,	0x00,	0x00,	0x03,	0x04,	0x28,	0x1e,	0x00,
 /*	reg18	reg19	reg1a	reg1b */
@@ -409,6 +423,7 @@ static const u8 *sn_tb[] = {
 	sn_ov7630,
 	sn_ov7648,
 	sn_ov7660,
+	sn_po1030,
 	sn_sp80708
 };
 
@@ -455,7 +470,7 @@ static const u8 hv7131r_sensor_init[][8] = {
 
 	{0xa1, 0x11, 0x01, 0x08, 0x00, 0x00, 0x00, 0x10},
 	{0xa1, 0x11, 0x20, 0x00, 0x00, 0x00, 0x00, 0x10},
-	{0xa1, 0x11, 0x21, 0xD0, 0x00, 0x00, 0x00, 0x10},
+	{0xa1, 0x11, 0x21, 0xd0, 0x00, 0x00, 0x00, 0x10},
 	{0xa1, 0x11, 0x22, 0x00, 0x00, 0x00, 0x00, 0x10},
 	{0xa1, 0x11, 0x23, 0x09, 0x00, 0x00, 0x00, 0x10},
 
@@ -464,6 +479,8 @@ static const u8 hv7131r_sensor_init[][8] = {
 	{0xa1, 0x11, 0x21, 0xd0, 0x00, 0x00, 0x00, 0x10},
 	{0xa1, 0x11, 0x22, 0x00, 0x00, 0x00, 0x00, 0x10},
 	{0xa1, 0x11, 0x23, 0x10, 0x00, 0x00, 0x00, 0x10},
+	{0xa1, 0x11, 0x01, 0x18, 0x00, 0x00, 0x00, 0x10},
+							/* set sensor clock */
 	{}
 };
 static const u8 mi0360_sensor_init[][8] = {
@@ -545,7 +562,7 @@ static const u8 mo4000_sensor_init[][8] = {
 };
 static const u8 mt9v111_sensor_init[][8] = {
 	{0xb1, 0x5c, 0x0d, 0x00, 0x01, 0x00, 0x00, 0x10}, /* reset? */
-	/* delay 20 ms */
+	{0xdd, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}, /* delay 20ms */
 	{0xb1, 0x5c, 0x0d, 0x00, 0x00, 0x00, 0x00, 0x10},
 	{0xb1, 0x5c, 0x01, 0x00, 0x01, 0x00, 0x00, 0x10}, /* IFP select */
 	{0xb1, 0x5c, 0x08, 0x04, 0x80, 0x00, 0x00, 0x10}, /* output fmt ctrl */
@@ -572,7 +589,9 @@ static const u8 mt9v111_sensor_init[][8] = {
 	{0xb1, 0x5c, 0x1e, 0x00, 0x00, 0x00, 0x00, 0x10}, /* digital zoom */
 	{0xb1, 0x5c, 0x20, 0x00, 0x00, 0x00, 0x00, 0x10}, /* read mode */
 	{0xb1, 0x5c, 0x20, 0x00, 0x00, 0x00, 0x00, 0x10},
-	/*******/
+	{}
+};
+static const u8 mt9v111_sensor_param1[][8] = {
 	{0xb1, 0x5c, 0x20, 0x00, 0x00, 0x00, 0x00, 0x10},
 	{0xb1, 0x5c, 0x20, 0x00, 0x00, 0x00, 0x00, 0x10},
 	{0xb1, 0x5c, 0x09, 0x01, 0x2c, 0x00, 0x00, 0x10},
@@ -585,14 +604,20 @@ static const u8 mt9v111_sensor_init[][8] = {
 	{0xb1, 0x5c, 0x35, 0x01, 0xc0, 0x00, 0x00, 0x10}, /* global gain */
 	{}
 };
+static const u8 om6802_init0[2][8] = {
+/*fixme: variable*/
+	{0xa0, 0x34, 0x29, 0x0e, 0x00, 0x00, 0x00, 0x10},
+	{0xa0, 0x34, 0x23, 0xb0, 0x00, 0x00, 0x00, 0x10},
+};
 static const u8 om6802_sensor_init[][8] = {
-	{0xa0, 0x34, 0x90, 0x05, 0x00, 0x00, 0x00, 0x10},
-	{0xa0, 0x34, 0x49, 0x85, 0x00, 0x00, 0x00, 0x10},
-	{0xa0, 0x34, 0x5a, 0xc0, 0x00, 0x00, 0x00, 0x10},
+	{0xa0, 0x34, 0xdf, 0x6d, 0x00, 0x00, 0x00, 0x10},
+						/* factory mode */
 	{0xa0, 0x34, 0xdd, 0x18, 0x00, 0x00, 0x00, 0x10},
+						/* output raw RGB */
+	{0xa0, 0x34, 0x5a, 0xc0, 0x00, 0x00, 0x00, 0x10},
 /*	{0xa0, 0x34, 0xfb, 0x11, 0x00, 0x00, 0x00, 0x10}, */
 	{0xa0, 0x34, 0xf0, 0x04, 0x00, 0x00, 0x00, 0x10},
-					/* white balance & auto-exposure */
+		/* auto-exposure speed (0) / white balance mode (auto RGB) */
 /*	{0xa0, 0x34, 0xf1, 0x02, 0x00, 0x00, 0x00, 0x10},
 							 * set color mode */
 /*	{0xa0, 0x34, 0xfe, 0x5b, 0x00, 0x00, 0x00, 0x10},
@@ -606,26 +631,29 @@ static const u8 om6802_sensor_init[][8] = {
 /*	{0xa0, 0x34, 0xe8, 0x31, 0x00, 0x00, 0x00, 0x10},
 							 * preset gamma */
 	{0xa0, 0x34, 0xe9, 0x0f, 0x00, 0x00, 0x00, 0x10},
-					/* luminance mode (0x4f = AE) */
+				/* luminance mode (0x4f -> AutoExpo on) */
 	{0xa0, 0x34, 0xe4, 0xff, 0x00, 0x00, 0x00, 0x10},
 							/* preset shutter */
 /*	{0xa0, 0x34, 0xef, 0x00, 0x00, 0x00, 0x00, 0x10},
 							 * auto frame rate */
 /*	{0xa0, 0x34, 0xfb, 0xee, 0x00, 0x00, 0x00, 0x10}, */
-
-/*	{0xa0, 0x34, 0x71, 0x84, 0x00, 0x00, 0x00, 0x10}, */
-/*	{0xa0, 0x34, 0x72, 0x05, 0x00, 0x00, 0x00, 0x10}, */
-/*	{0xa0, 0x34, 0x68, 0x80, 0x00, 0x00, 0x00, 0x10}, */
-/*	{0xa0, 0x34, 0x69, 0x01, 0x00, 0x00, 0x00, 0x10}, */
+	{0xa0, 0x34, 0x5d, 0x80, 0x00, 0x00, 0x00, 0x10},
+	{}
+};
+static const u8 om6802_sensor_param1[][8] = {
+	{0xa0, 0x34, 0x71, 0x84, 0x00, 0x00, 0x00, 0x10},
+	{0xa0, 0x34, 0x72, 0x05, 0x00, 0x00, 0x00, 0x10},
+	{0xa0, 0x34, 0x68, 0x80, 0x00, 0x00, 0x00, 0x10},
+	{0xa0, 0x34, 0x69, 0x01, 0x00, 0x00, 0x00, 0x10},
 	{}
 };
 static const u8 ov7630_sensor_init[][8] = {
 	{0xa1, 0x21, 0x76, 0x01, 0x00, 0x00, 0x00, 0x10},
 	{0xa1, 0x21, 0x12, 0xc8, 0x00, 0x00, 0x00, 0x10},
-/* win: delay 20ms */
+	{0xdd, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}, /* delay 20ms */
 	{0xa1, 0x21, 0x12, 0x48, 0x00, 0x00, 0x00, 0x10},
 	{0xa1, 0x21, 0x12, 0xc8, 0x00, 0x00, 0x00, 0x10},
-/* win: delay 20ms */
+	{0xdd, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}, /* delay 20ms */
 	{0xa1, 0x21, 0x12, 0x48, 0x00, 0x00, 0x00, 0x10},
 /* win: i2c_r from 00 to 80 */
 	{0xd1, 0x21, 0x03, 0x80, 0x10, 0x20, 0x80, 0x10},
@@ -677,6 +705,7 @@ static const u8 ov7630_sensor_init[][8] = {
 static const u8 ov7648_sensor_init[][8] = {
 	{0xa1, 0x21, 0x76, 0x00, 0x00, 0x00, 0x00, 0x10},
 	{0xa1, 0x21, 0x12, 0x80, 0x00, 0x00, 0x00, 0x10},	/* reset */
+	{0xdd, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}, /* delay 20ms */
 	{0xa1, 0x21, 0x12, 0x00, 0x00, 0x00, 0x00, 0x10},
 	{0xd1, 0x21, 0x03, 0xa4, 0x30, 0x88, 0x00, 0x10},
 	{0xb1, 0x21, 0x11, 0x80, 0x08, 0x00, 0x00, 0x10},
@@ -701,7 +730,9 @@ static const u8 ov7648_sensor_init[][8] = {
 /*	{0xd1, 0x21, 0x25, 0x80, 0x32, 0xfe, 0xa0, 0x10}, jfm done */
 /*	{0xd1, 0x21, 0x29, 0x00, 0x91, 0x00, 0x88, 0x10}, jfm done */
 /*	{0xb1, 0x21, 0x2d, 0x85, 0x00, 0x00, 0x00, 0x10}, set by setfreq */
-/*...*/
+	{}
+};
+static const u8 ov7648_sensor_param1[][8] = {
 /*	{0xa1, 0x21, 0x12, 0x08, 0x00, 0x00, 0x00, 0x10}, jfm done */
 /*	{0xa1, 0x21, 0x75, 0x06, 0x00, 0x00, 0x00, 0x10},   * COMN
 							 * set by setvflip */
@@ -723,7 +754,7 @@ static const u8 ov7648_sensor_init[][8] = {
 
 static const u8 ov7660_sensor_init[][8] = {
 	{0xa1, 0x21, 0x12, 0x80, 0x00, 0x00, 0x00, 0x10}, /* reset SCCB */
-/*		(delay 20ms) */
+	{0xdd, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}, /* delay 20ms */
 	{0xa1, 0x21, 0x12, 0x05, 0x00, 0x00, 0x00, 0x10},
 						/* Outformat = rawRGB */
 	{0xa1, 0x21, 0x13, 0xb8, 0x00, 0x00, 0x00, 0x10}, /* init COM8 */
@@ -783,8 +814,11 @@ static const u8 ov7660_sensor_init[][8] = {
 	{0xc1, 0x21, 0x88, 0xaf, 0xc7, 0xdf, 0x00, 0x10}, /* gamma curve */
 	{0xc1, 0x21, 0x8b, 0x99, 0x99, 0xcf, 0x00, 0x10}, /* reserved */
 	{0xb1, 0x21, 0x92, 0x00, 0x00, 0x00, 0x00, 0x10}, /* DM_LNL/H */
+/* not in all ms-win traces*/
 	{0xa1, 0x21, 0xa1, 0x00, 0x00, 0x00, 0x00, 0x10},
-/****** (some exchanges in the win trace) ******/
+	{}
+};
+static const u8 ov7660_sensor_param1[][8] = {
 	{0xa1, 0x21, 0x1e, 0x01, 0x00, 0x00, 0x00, 0x10}, /* MVFP */
 						/* bits[3..0]reserved */
 	{0xa1, 0x21, 0x1e, 0x01, 0x00, 0x00, 0x00, 0x10},
@@ -797,6 +831,7 @@ static const u8 ov7660_sensor_init[][8] = {
 	{0xa1, 0x21, 0x00, 0x1f, 0x00, 0x00, 0x00, 0x10}, /* GAIN */
 /*	{0xb1, 0x21, 0x01, 0x78, 0x78, 0x00, 0x00, 0x10}, * BLUE */
 /****** (some exchanges in the win trace) ******/
+/*fixme:param2*/
 	{0xa1, 0x21, 0x93, 0x00, 0x00, 0x00, 0x00, 0x10},/* dummy line hight */
 	{0xa1, 0x21, 0x92, 0x25, 0x00, 0x00, 0x00, 0x10}, /* dummy line low */
 	{0xa1, 0x21, 0x2a, 0x00, 0x00, 0x00, 0x00, 0x10}, /* EXHCH */
@@ -804,6 +839,7 @@ static const u8 ov7660_sensor_init[][8] = {
 /*	{0xa1, 0x21, 0x02, 0x90, 0x00, 0x00, 0x00, 0x10},  * RED */
 /****** (some exchanges in the win trace) ******/
 /******!! startsensor KO if changed !!****/
+/*fixme: param3*/
 	{0xa1, 0x21, 0x93, 0x01, 0x00, 0x00, 0x00, 0x10},
 	{0xa1, 0x21, 0x92, 0xff, 0x00, 0x00, 0x00, 0x10},
 	{0xa1, 0x21, 0x2a, 0x00, 0x00, 0x00, 0x00, 0x10},
@@ -811,6 +847,60 @@ static const u8 ov7660_sensor_init[][8] = {
 	{}
 };
 
+static const u8 po1030_sensor_init[][8] = {
+/* the sensor registers are described in m5602/m5602_po1030.h */
+	{0xa1, 0x6e, 0x3f, 0x20, 0x00, 0x00, 0x00, 0x10}, /* sensor reset */
+	{0xdd, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}, /* delay 20ms */
+	{0xa1, 0x6e, 0x3f, 0x00, 0x00, 0x00, 0x00, 0x10},
+	{0xa1, 0x6e, 0x3e, 0x00, 0x00, 0x00, 0x00, 0x10},
+	{0xd1, 0x6e, 0x04, 0x02, 0xb1, 0x02, 0x39, 0x10},
+	{0xd1, 0x6e, 0x08, 0x00, 0x01, 0x00, 0x00, 0x10},
+	{0xd1, 0x6e, 0x0c, 0x02, 0x7f, 0x01, 0xe0, 0x10},
+	{0xd1, 0x6e, 0x12, 0x03, 0x02, 0x00, 0x03, 0x10},
+	{0xd1, 0x6e, 0x16, 0x85, 0x40, 0x4a, 0x40, 0x10}, /* r/g1/b/g2 gains */
+	{0xc1, 0x6e, 0x1a, 0x00, 0x80, 0x00, 0x00, 0x10},
+	{0xd1, 0x6e, 0x1d, 0x08, 0x03, 0x00, 0x00, 0x10},
+	{0xd1, 0x6e, 0x23, 0x00, 0xb0, 0x00, 0x94, 0x10},
+	{0xd1, 0x6e, 0x27, 0x58, 0x00, 0x00, 0x00, 0x10},
+	{0xb1, 0x6e, 0x2b, 0x00, 0x00, 0x00, 0x00, 0x10},
+	{0xd1, 0x6e, 0x2d, 0x14, 0x35, 0x61, 0x84, 0x10}, /* gamma corr */
+	{0xd1, 0x6e, 0x31, 0xa2, 0xbd, 0xd8, 0xff, 0x10},
+	{0xd1, 0x6e, 0x35, 0x06, 0x1e, 0x12, 0x02, 0x10}, /* color matrix */
+	{0xd1, 0x6e, 0x39, 0xaa, 0x53, 0x37, 0xd5, 0x10},
+	{0xa1, 0x6e, 0x3d, 0xf2, 0x00, 0x00, 0x00, 0x10},
+	{0xd1, 0x6e, 0x3e, 0x00, 0x00, 0x80, 0x03, 0x10},
+	{0xd1, 0x6e, 0x42, 0x03, 0x00, 0x00, 0x00, 0x10},
+	{0xc1, 0x6e, 0x46, 0x00, 0x80, 0x80, 0x00, 0x10},
+	{0xd1, 0x6e, 0x4b, 0x02, 0xef, 0x08, 0xcd, 0x10},
+	{0xd1, 0x6e, 0x4f, 0x00, 0xd0, 0x00, 0xa0, 0x10},
+	{0xd1, 0x6e, 0x53, 0x01, 0xaa, 0x01, 0x40, 0x10},
+	{0xd1, 0x6e, 0x5a, 0x50, 0x04, 0x30, 0x03, 0x10}, /* raw rgb bayer */
+	{0xa1, 0x6e, 0x5e, 0x00, 0x00, 0x00, 0x00, 0x10},
+	{0xd1, 0x6e, 0x5f, 0x10, 0x40, 0xff, 0x00, 0x10},
+
+	{0xd1, 0x6e, 0x63, 0x40, 0x40, 0x00, 0x00, 0x10},
+	{0xd1, 0x6e, 0x67, 0x00, 0x00, 0x00, 0x00, 0x10},
+	{0xd1, 0x6e, 0x6b, 0x00, 0x00, 0x00, 0x00, 0x10},
+	{0xd1, 0x6e, 0x6f, 0x00, 0x00, 0x00, 0x00, 0x10},
+	{0xc1, 0x6e, 0x73, 0x10, 0x80, 0xeb, 0x00, 0x10},
+	{}
+};
+static const u8 po1030_sensor_param1[][8] = {
+/* from ms-win traces - these values change with auto gain/expo/wb.. */
+	{0xa1, 0x6e, 0x1e, 0x03, 0x00, 0x00, 0x00, 0x10},
+	{0xa1, 0x6e, 0x1e, 0x03, 0x00, 0x00, 0x00, 0x10},
+/* mean values */
+	{0xc1, 0x6e, 0x1a, 0x02, 0xd4, 0xa4, 0x00, 0x10}, /* integlines */
+	{0xa1, 0x6e, 0x15, 0x04, 0x00, 0x00, 0x00, 0x10}, /* global gain */
+	{0xc1, 0x6e, 0x16, 0x40, 0x40, 0x40, 0x00, 0x10}, /* r/g1/b gains */
+
+	{0xa1, 0x6e, 0x1d, 0x08, 0x00, 0x00, 0x00, 0x10}, /* control1 */
+	{0xa1, 0x6e, 0x06, 0x02, 0x00, 0x00, 0x00, 0x10}, /* frameheight */
+	{0xa1, 0x6e, 0x07, 0xd5, 0x00, 0x00, 0x00, 0x10},
+/*	{0xc1, 0x6e, 0x16, 0x49, 0x40, 0x45, 0x00, 0x10}, */
+	{}
+};
+
 static const u8 sp80708_sensor_init[][8] = {
 	{0xa1, 0x18, 0x06, 0xf9, 0x00, 0x00, 0x00, 0x10},
 	{0xa1, 0x18, 0x09, 0x1f, 0x00, 0x00, 0x00, 0x10},
@@ -883,7 +973,9 @@ static const u8 sp80708_sensor_init[][8] = {
 	{0xa1, 0x18, 0x67, 0x24, 0x00, 0x00, 0x00, 0x10},
 	{0xa1, 0x18, 0x68, 0x08, 0x00, 0x00, 0x00, 0x10},
 	{0xa1, 0x18, 0x2f, 0xc9, 0x00, 0x00, 0x00, 0x10},
-	/********/
+	{}
+};
+static const u8 sp80708_sensor_param1[][8] = {
 	{0xa1, 0x18, 0x0c, 0x04, 0x00, 0x00, 0x00, 0x10},
 	{0xa1, 0x18, 0x0c, 0x04, 0x00, 0x00, 0x00, 0x10},
 	{0xa1, 0x18, 0x03, 0x01, 0x00, 0x00, 0x00, 0x10},
@@ -894,6 +986,19 @@ static const u8 sp80708_sensor_init[][8] = {
 	{}
 };
 
+static const u8 (*sensor_init[10])[8] = {
+	hv7131r_sensor_init,	/* HV7131R 0 */
+	mi0360_sensor_init,	/* MI0360 1 */
+	mo4000_sensor_init,	/* MO4000 2 */
+	mt9v111_sensor_init,	/* MT9V111 3 */
+	om6802_sensor_init,	/* OM6802 4 */
+	ov7630_sensor_init,	/* OV7630 5 */
+	ov7648_sensor_init,	/* OV7648 6 */
+	ov7660_sensor_init,	/* OV7660 7 */
+	po1030_sensor_init,	/* PO1030 8 */
+	sp80708_sensor_init,	/* SP80708 9 */
+};
+
 /* read <len> bytes to gspca_dev->usb_buf */
 static void reg_r(struct gspca_dev *gspca_dev,
 		  u16 value, int len)
@@ -958,8 +1063,15 @@ static void i2c_w1(struct gspca_dev *gspca_dev, u8 reg, u8 val)
 	struct sd *sd = (struct sd *) gspca_dev;
 
 	PDEBUG(D_USBO, "i2c_w2 [%02x] = %02x", reg, val);
-	gspca_dev->usb_buf[0] = 0x81 | (2 << 4);	/* = a1 */
-	gspca_dev->usb_buf[1] = sd->i2c_base;
+	switch (sd->sensor) {
+	case SENSOR_OM6802:		/* i2c command = a0 (100 kHz) */
+		gspca_dev->usb_buf[0] = 0x80 | (2 << 4);
+		break;
+	default:			/* i2c command = a1 (400 kHz) */
+		gspca_dev->usb_buf[0] = 0x81 | (2 << 4);
+		break;
+	}
+	gspca_dev->usb_buf[1] = sd->i2c_addr;
 	gspca_dev->usb_buf[2] = reg;
 	gspca_dev->usb_buf[3] = val;
 	gspca_dev->usb_buf[4] = 0;
@@ -991,14 +1103,21 @@ static void i2c_w8(struct gspca_dev *gspca_dev,
 	msleep(2);
 }
 
-/* read 5 bytes in gspca_dev->usb_buf */
-static void i2c_r5(struct gspca_dev *gspca_dev, u8 reg)
+/* sensor read 'len' (1..5) bytes in gspca_dev->usb_buf */
+static void i2c_r(struct gspca_dev *gspca_dev, u8 reg, int len)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
 	u8 mode[8];
 
-	mode[0] = 0x81 | 0x10;
-	mode[1] = sd->i2c_base;
+	switch (sd->sensor) {
+	case SENSOR_OM6802:		/* i2c command = 90 (100 kHz) */
+		mode[0] = 0x80 | 0x10;
+		break;
+	default:			/* i2c command = 91 (400 kHz) */
+		mode[0] = 0x81 | 0x10;
+		break;
+	}
+	mode[1] = sd->i2c_addr;
 	mode[2] = reg;
 	mode[3] = 0;
 	mode[4] = 0;
@@ -1007,33 +1126,43 @@ static void i2c_r5(struct gspca_dev *gspca_dev, u8 reg)
 	mode[7] = 0x10;
 	i2c_w8(gspca_dev, mode);
 	msleep(2);
-	mode[0] = 0x81 | (5 << 4) | 0x02;
+	mode[0] = (mode[0] & 0x81) | (len << 4) | 0x02;
 	mode[2] = 0;
 	i2c_w8(gspca_dev, mode);
 	msleep(2);
 	reg_r(gspca_dev, 0x0a, 5);
 }
 
-static int hv7131r_probe(struct gspca_dev *gspca_dev)
+static void i2c_w_seq(struct gspca_dev *gspca_dev,
+			const u8 (*data)[8])
+{
+	while ((*data)[0] != 0) {
+		if ((*data)[0] != 0xdd)
+			i2c_w8(gspca_dev, *data);
+		else
+			msleep((*data)[1]);
+		data++;
+	}
+}
+
+static void hv7131r_probe(struct gspca_dev *gspca_dev)
 {
 	i2c_w1(gspca_dev, 0x02, 0);			/* sensor wakeup */
 	msleep(10);
 	reg_w1(gspca_dev, 0x02, 0x66);			/* Gpio on */
 	msleep(10);
-	i2c_r5(gspca_dev, 0);				/* read sensor id */
+	i2c_r(gspca_dev, 0, 5);				/* read sensor id */
 	if (gspca_dev->usb_buf[0] == 0x02
 	    && gspca_dev->usb_buf[1] == 0x09
 	    && gspca_dev->usb_buf[2] == 0x01
 	    && gspca_dev->usb_buf[3] == 0x00
 	    && gspca_dev->usb_buf[4] == 0x00) {
-		PDEBUG(D_PROBE, "Find Sensor sn9c102P HV7131R");
-		return 0;
+		PDEBUG(D_PROBE, "Sensor sn9c102P HV7131R found");
+		return;
 	}
-	PDEBUG(D_PROBE, "Find Sensor 0x%02x 0x%02x 0x%02x",
+	PDEBUG(D_PROBE, "Sensor 0x%02x 0x%02x 0x%02x - sn9c102P not found",
 		gspca_dev->usb_buf[0], gspca_dev->usb_buf[1],
 		gspca_dev->usb_buf[2]);
-	PDEBUG(D_PROBE, "Sensor sn9c102P Not found");
-	return -ENODEV;
 }
 
 static void mi0360_probe(struct gspca_dev *gspca_dev)
@@ -1075,7 +1204,6 @@ static void mi0360_probe(struct gspca_dev *gspca_dev)
 	case 0x823a:
 		PDEBUG(D_PROBE, "Sensor mt9v111");
 		sd->sensor = SENSOR_MT9V111;
-		sd->i2c_base = 0x5c;
 		break;
 	case 0x8243:
 		PDEBUG(D_PROBE, "Sensor mi0360");
@@ -1086,7 +1214,42 @@ static void mi0360_probe(struct gspca_dev *gspca_dev)
 	}
 }
 
-static int configure_gpio(struct gspca_dev *gspca_dev,
+static void ov7648_probe(struct gspca_dev *gspca_dev)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	/* check ov76xx */
+	reg_w1(gspca_dev, 0x17, 0x62);
+	reg_w1(gspca_dev, 0x01, 0x08);
+	sd->i2c_addr = 0x21;
+	i2c_r(gspca_dev, 0x0a, 2);
+	if (gspca_dev->usb_buf[3] == 0x76) {	/* ov76xx */
+		PDEBUG(D_PROBE, "Sensor ov%02x%02x",
+			gspca_dev->usb_buf[3], gspca_dev->usb_buf[4]);
+		return;
+	}
+
+	/* reset */
+	reg_w1(gspca_dev, 0x01, 0x29);
+	reg_w1(gspca_dev, 0x17, 0x42);
+
+	/* check po1030 */
+	reg_w1(gspca_dev, 0x17, 0x62);
+	reg_w1(gspca_dev, 0x01, 0x08);
+	sd->i2c_addr = 0x6e;
+	i2c_r(gspca_dev, 0x00, 2);
+	if (gspca_dev->usb_buf[3] == 0x10	/* po1030 */
+	    && gspca_dev->usb_buf[4] == 0x30) {
+		PDEBUG(D_PROBE, "Sensor po1030");
+		sd->sensor = SENSOR_PO1030;
+		return;
+	}
+
+	PDEBUG(D_PROBE, "Unknown sensor %02x%02x",
+		gspca_dev->usb_buf[3], gspca_dev->usb_buf[4]);
+}
+
+static void bridge_init(struct gspca_dev *gspca_dev,
 			  const u8 *sn9c1xx)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
@@ -1103,9 +1266,10 @@ static int configure_gpio(struct gspca_dev *gspca_dev,
 	/* configure gpio */
 	reg_w(gspca_dev, 0x01, &sn9c1xx[1], 2);
 	reg_w(gspca_dev, 0x08, &sn9c1xx[8], 2);
-	reg_w(gspca_dev, 0x17, &sn9c1xx[0x17], 5);	/* jfm len was 3 */
+	reg_w(gspca_dev, 0x17, &sn9c1xx[0x17], 5);
 	switch (sd->sensor) {
 	case SENSOR_OV7660:
+	case SENSOR_PO1030:
 	case SENSOR_SP80708:
 		reg9a = reg9a_spec;
 		break;
@@ -1115,7 +1279,7 @@ static int configure_gpio(struct gspca_dev *gspca_dev,
 	}
 	reg_w(gspca_dev, 0x9a, reg9a, 6);
 
-	reg_w(gspca_dev, 0xd4, regd4, sizeof regd4); /*fixme:jfm was 60 only*/
+	reg_w(gspca_dev, 0xd4, regd4, sizeof regd4);
 
 	reg_w(gspca_dev, 0x03, &sn9c1xx[3], 0x0f);
 
@@ -1127,10 +1291,22 @@ static int configure_gpio(struct gspca_dev *gspca_dev,
 		reg_w1(gspca_dev, 0x01, 0x40);
 		break;
 	case SENSOR_OM6802:
-		reg_w1(gspca_dev, 0x02, 0x71);
-		reg_w1(gspca_dev, 0x01, 0x42);
+		msleep(10);
+		reg_w1(gspca_dev, 0x02, 0x73);
+		reg_w1(gspca_dev, 0x17, 0x60);
+		reg_w1(gspca_dev, 0x01, 0x22);
+		msleep(100);
+		reg_w1(gspca_dev, 0x01, 0x62);
+		reg_w1(gspca_dev, 0x17, 0x64);
 		reg_w1(gspca_dev, 0x17, 0x64);
 		reg_w1(gspca_dev, 0x01, 0x42);
+		msleep(10);
+		reg_w1(gspca_dev, 0x01, 0x42);
+		i2c_w8(gspca_dev, om6802_init0[0]);
+		i2c_w8(gspca_dev, om6802_init0[1]);
+		msleep(15);
+		reg_w1(gspca_dev, 0x02, 0x71);
+		msleep(150);
 		break;
 	case SENSOR_OV7630:
 		reg_w1(gspca_dev, 0x01, 0x61);
@@ -1144,7 +1320,14 @@ static int configure_gpio(struct gspca_dev *gspca_dev,
 		reg_w1(gspca_dev, 0x01, 0x62);
 		reg_w1(gspca_dev, 0x01, 0x42);
 		break;
+	case SENSOR_PO1030:
+		reg_w1(gspca_dev, 0x01, 0x61);
+		reg_w1(gspca_dev, 0x17, 0x20);
+		reg_w1(gspca_dev, 0x01, 0x60);
+		reg_w1(gspca_dev, 0x01, 0x40);
+		break;
 	case SENSOR_OV7660:
+		/* fall thru */
 	case SENSOR_SP80708:
 		reg_w1(gspca_dev, 0x01, 0x63);
 		reg_w1(gspca_dev, 0x17, 0x20);
@@ -1153,143 +1336,18 @@ static int configure_gpio(struct gspca_dev *gspca_dev,
 		msleep(100);
 		reg_w1(gspca_dev, 0x02, 0x62);
 		break;
+	default:
 /*	case SENSOR_HV7131R: */
 /*	case SENSOR_MI0360: */
 /*	case SENSOR_MO4000: */
-	default:
 		reg_w1(gspca_dev, 0x01, 0x43);
 		reg_w1(gspca_dev, 0x17, 0x61);
 		reg_w1(gspca_dev, 0x01, 0x42);
-		if (sd->sensor == SENSOR_HV7131R) {
-			if (hv7131r_probe(gspca_dev) < 0)
-				return -ENODEV;
-		}
+		if (sd->sensor == SENSOR_HV7131R
+		    && sd->bridge == BRIDGE_SN9C102P)
+			hv7131r_probe(gspca_dev);
 		break;
 	}
-	return 0;
-}
-
-static void hv7131R_InitSensor(struct gspca_dev *gspca_dev)
-{
-	int i = 0;
-	static const u8 SetSensorClk[] =	/* 0x08 Mclk */
-		{ 0xa1, 0x11, 0x01, 0x18, 0x00, 0x00, 0x00, 0x10 };
-
-	while (hv7131r_sensor_init[i][0]) {
-		i2c_w8(gspca_dev, hv7131r_sensor_init[i]);
-		i++;
-	}
-	i2c_w8(gspca_dev, SetSensorClk);
-}
-
-static void mi0360_InitSensor(struct gspca_dev *gspca_dev)
-{
-	int i = 0;
-
-	while (mi0360_sensor_init[i][0]) {
-		i2c_w8(gspca_dev, mi0360_sensor_init[i]);
-		i++;
-	}
-}
-
-static void mo4000_InitSensor(struct gspca_dev *gspca_dev)
-{
-	int i = 0;
-
-	while (mo4000_sensor_init[i][0]) {
-		i2c_w8(gspca_dev, mo4000_sensor_init[i]);
-		i++;
-	}
-}
-
-static void mt9v111_InitSensor(struct gspca_dev *gspca_dev)
-{
-	int i = 0;
-
-	i2c_w8(gspca_dev, mt9v111_sensor_init[i]);
-	i++;
-	msleep(20);
-	while (mt9v111_sensor_init[i][0]) {
-		i2c_w8(gspca_dev, mt9v111_sensor_init[i]);
-		i++;
-	}
-}
-
-static void om6802_InitSensor(struct gspca_dev *gspca_dev)
-{
-	int i = 0;
-
-	while (om6802_sensor_init[i][0]) {
-		i2c_w8(gspca_dev, om6802_sensor_init[i]);
-		i++;
-	}
-}
-
-static void ov7630_InitSensor(struct gspca_dev *gspca_dev)
-{
-	int i = 0;
-
-	i2c_w8(gspca_dev, ov7630_sensor_init[i]);	/* 76 01 */
-	i++;
-	i2c_w8(gspca_dev, ov7630_sensor_init[i]);	/* 12 c8 (RGB+SRST) */
-	i++;
-	msleep(20);
-	i2c_w8(gspca_dev, ov7630_sensor_init[i]);	/* 12 48 */
-	i++;
-	i2c_w8(gspca_dev, ov7630_sensor_init[i]);	/* 12 c8 */
-	i++;
-	msleep(20);
-	i2c_w8(gspca_dev, ov7630_sensor_init[i]);	/* 12 48 */
-	i++;
-/*jfm:win i2c_r from 00 to 80*/
-
-	while (ov7630_sensor_init[i][0]) {
-		i2c_w8(gspca_dev, ov7630_sensor_init[i]);
-		i++;
-	}
-}
-
-static void ov7648_InitSensor(struct gspca_dev *gspca_dev)
-{
-	int i = 0;
-
-	i2c_w8(gspca_dev, ov7648_sensor_init[i]);
-	i++;
-/* win: dble reset */
-	i2c_w8(gspca_dev, ov7648_sensor_init[i]);	/* reset */
-	i++;
-	msleep(20);
-/* win: i2c reg read 00..7f */
-	while (ov7648_sensor_init[i][0]) {
-		i2c_w8(gspca_dev, ov7648_sensor_init[i]);
-		i++;
-	}
-}
-
-static void ov7660_InitSensor(struct gspca_dev *gspca_dev)
-{
-	int i = 0;
-
-	i2c_w8(gspca_dev, ov7660_sensor_init[i]);	/* reset SCCB */
-	i++;
-	msleep(20);
-	while (ov7660_sensor_init[i][0]) {
-		i2c_w8(gspca_dev, ov7660_sensor_init[i]);
-		i++;
-	}
-}
-
-static void sp80708_InitSensor(struct gspca_dev *gspca_dev)
-{
-	int i = 0;
-
-	i2c_w8(gspca_dev, sp80708_sensor_init[i]);	/* reset SCCB */
-	i++;
-	msleep(20);
-	while (sp80708_sensor_init[i][0]) {
-		i2c_w8(gspca_dev, sp80708_sensor_init[i]);
-		i++;
-	}
 }
 
 /* this function is called at probe time */
@@ -1305,8 +1363,7 @@ static int sd_config(struct gspca_dev *gspca_dev,
 	cam->npkt = 24;			/* 24 packets per ISOC message */
 
 	sd->bridge = id->driver_info >> 16;
-	sd->sensor = id->driver_info >> 8;
-	sd->i2c_base = id->driver_info;
+	sd->sensor = id->driver_info;
 
 	sd->brightness = BRIGHTNESS_DEF;
 	sd->contrast = CONTRAST_DEF;
@@ -1322,7 +1379,6 @@ static int sd_config(struct gspca_dev *gspca_dev,
 	sd->quality = QUALITY_DEF;
 	sd->jpegqual = 80;
 
-	gspca_dev->ctrl_dis = ctrl_dis[sd->sensor];
 	return 0;
 }
 
@@ -1330,6 +1386,7 @@ static int sd_config(struct gspca_dev *gspca_dev,
 static int sd_init(struct gspca_dev *gspca_dev)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
+	const u8 *sn9c1xx;
 	u8 regGpio[] = { 0x29, 0x74 };
 	u8 regF1;
 
@@ -1356,8 +1413,14 @@ static int sd_init(struct gspca_dev *gspca_dev)
 	case BRIDGE_SN9C120:
 		if (regF1 != 0x12)
 			return -ENODEV;
-		if (sd->sensor == SENSOR_MI0360)
+		switch (sd->sensor) {
+		case SENSOR_MI0360:
 			mi0360_probe(gspca_dev);
+			break;
+		case SENSOR_OV7648:
+			ov7648_probe(gspca_dev);
+			break;
+		}
 		regGpio[1] = 0x70;
 		reg_w(gspca_dev, 0x01, regGpio, 2);
 		break;
@@ -1372,6 +1435,12 @@ static int sd_init(struct gspca_dev *gspca_dev)
 
 	reg_w1(gspca_dev, 0xf1, 0x01);
 
+	/* set the i2c address */
+	sn9c1xx = sn_tb[sd->sensor];
+	sd->i2c_addr = sn9c1xx[9];
+
+	gspca_dev->ctrl_dis = ctrl_dis[sd->sensor];
+
 	return 0;
 }
 
@@ -1383,7 +1452,7 @@ static u32 setexposure(struct gspca_dev *gspca_dev,
 	switch (sd->sensor) {
 	case SENSOR_HV7131R: {
 		u8 Expodoit[] =
-			{ 0xc1, 0x11, 0x25, 0x07, 0x27, 0xc0, 0x00, 0x16 };
+			{ 0xc1, 0x11, 0x25, 0x00, 0x00, 0x00, 0x00, 0x16 };
 
 		Expodoit[3] = expo >> 16;
 		Expodoit[4] = expo >> 8;
@@ -1393,7 +1462,7 @@ static u32 setexposure(struct gspca_dev *gspca_dev,
 	    }
 	case SENSOR_MI0360: {
 		u8 expoMi[] =		/* exposure 0x0635 -> 4 fp/s 0x10 */
-			{ 0xb1, 0x5d, 0x09, 0x06, 0x35, 0x00, 0x00, 0x16 };
+			{ 0xb1, 0x5d, 0x09, 0x00, 0x00, 0x00, 0x00, 0x16 };
 		static const u8 doit[] =		/* update sensor */
 			{ 0xb1, 0x5d, 0x07, 0x00, 0x03, 0x00, 0x00, 0x10 };
 		static const u8 sensorgo[] =		/* sensor on */
@@ -1412,9 +1481,9 @@ static u32 setexposure(struct gspca_dev *gspca_dev,
 	    }
 	case SENSOR_MO4000: {
 		u8 expoMof[] =
-			{ 0xa1, 0x21, 0x0f, 0x20, 0x00, 0x00, 0x00, 0x10 };
+			{ 0xa1, 0x21, 0x0f, 0x00, 0x00, 0x00, 0x00, 0x10 };
 		u8 expoMo10[] =
-			{ 0xa1, 0x21, 0x10, 0x20, 0x00, 0x00, 0x00, 0x10 };
+			{ 0xa1, 0x21, 0x10, 0x00, 0x00, 0x00, 0x00, 0x10 };
 		static const u8 gainMo[] =
 			{ 0xa1, 0x21, 0x00, 0x10, 0x00, 0x00, 0x00, 0x1d };
 
@@ -1450,6 +1519,7 @@ static u32 setexposure(struct gspca_dev *gspca_dev,
 	case SENSOR_OM6802: {
 		u8 gainOm[] =
 			{ 0xa0, 0x34, 0xe5, 0x00, 0x00, 0x00, 0x00, 0x10 };
+				/* preset AGC - works when AutoExpo = off */
 
 		if (expo > 0x03ff)
 			expo = 0x03ff;
@@ -1457,7 +1527,7 @@ static u32 setexposure(struct gspca_dev *gspca_dev,
 			expo = 0x0001;
 		gainOm[3] = expo >> 2;
 		i2c_w8(gspca_dev, gainOm);
-		reg_w1(gspca_dev, 0x96, (expo >> 5) & 0x1f);
+		reg_w1(gspca_dev, 0x96, expo >> 5);
 		PDEBUG(D_FRAM, "set exposure %d", gainOm[3]);
 		break;
 	    }
@@ -1489,7 +1559,7 @@ static void setbrightness(struct gspca_dev *gspca_dev)
 	case SENSOR_MT9V111:
 		expo = sd->brightness >> 8;
 		sd->exposure = setexposure(gspca_dev, expo);
-		break;
+		return;			/* don't set the Y offset */
 	case SENSOR_OM6802:
 		expo = sd->brightness >> 6;
 		sd->exposure = setexposure(gspca_dev, expo);
@@ -1497,8 +1567,7 @@ static void setbrightness(struct gspca_dev *gspca_dev)
 		break;
 	}
 
-	if (sd->sensor != SENSOR_MT9V111)
-		reg_w1(gspca_dev, 0x96, k2);	/* color matrix Y offset */
+	reg_w1(gspca_dev, 0x96, k2);	/* color matrix Y offset */
 }
 
 static void setcontrast(struct gspca_dev *gspca_dev)
@@ -1526,6 +1595,7 @@ static void setcolors(struct gspca_dev *gspca_dev)
 		-24, -38, 64,		/* UR UG UB */
 		 62, -51, -9		/* VR VG VB */
 	};
+
 	for (i = 0; i < 6; i++) {
 		v = uv[i] * sd->colors / COLOR_DEF;
 		reg8a[i * 2] = v;
@@ -1605,6 +1675,8 @@ static void setvflip(struct sd *sd)
 {
 	u8 comn;
 
+	if (sd->gspca_dev.ctrl_dis & (1 << VFLIP_IDX))
+		return;
 	if (sd->sensor == SENSOR_OV7630) {
 		comn = 0x02;
 		if (!sd->vflip)
@@ -1726,8 +1798,9 @@ static int sd_start(struct gspca_dev *gspca_dev)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
 	int i;
-	u8 reg1, reg17;
+	u8 reg1, reg2, reg17;
 	const u8 *sn9c1xx;
+	const u8 (*init)[8];
 	int mode;
 	static const u8 C0[] = { 0x2d, 0x2d, 0x3a, 0x05, 0x04, 0x3f };
 	static const u8 CA[] = { 0x28, 0xd8, 0x14, 0xec };
@@ -1743,8 +1816,26 @@ static int sd_start(struct gspca_dev *gspca_dev)
 			0x21);		/* JPEG 422 */
 	jpeg_set_qual(sd->jpeg_hdr, sd->quality);
 
-	sn9c1xx = sn_tb[(int) sd->sensor];
-	configure_gpio(gspca_dev, sn9c1xx);
+	/* initialize the bridge */
+	sn9c1xx = sn_tb[sd->sensor];
+	bridge_init(gspca_dev, sn9c1xx);
+
+	/* initialize the sensor */
+	i2c_w_seq(gspca_dev, sensor_init[sd->sensor]);
+
+	switch (sd->sensor) {
+	case SENSOR_OM6802:
+		reg2 = 0x71;
+		break;
+	case SENSOR_SP80708:
+		reg2 = 0x62;
+		break;
+	default:
+		reg2 = 0x40;
+		break;
+	}
+	reg_w1(gspca_dev, 0x02, reg2);
+	reg_w1(gspca_dev, 0x02, reg2);
 
 	reg_w1(gspca_dev, 0x15, sn9c1xx[0x15]);
 	reg_w1(gspca_dev, 0x16, sn9c1xx[0x16]);
@@ -1771,6 +1862,9 @@ static int sd_start(struct gspca_dev *gspca_dev)
 	case SENSOR_OV7660:
 		reg17 = 0xa0;
 		break;
+	case SENSOR_PO1030:
+		reg17 = 0xa0;
+		break;
 	default:
 		reg17 = 0x60;
 		break;
@@ -1791,6 +1885,10 @@ static int sd_start(struct gspca_dev *gspca_dev)
 		reg_w1(gspca_dev, 0x9a, 0x07);
 		reg_w1(gspca_dev, 0x99, 0x59);
 		break;
+	case SENSOR_OM6802:
+		reg_w1(gspca_dev, 0x9a, 0x08);
+		reg_w1(gspca_dev, 0x99, 0x10);
+		break;
 	case SENSOR_OV7648:
 		reg_w1(gspca_dev, 0x9a, 0x0a);
 		reg_w1(gspca_dev, 0x99, 0x60);
@@ -1806,21 +1904,20 @@ static int sd_start(struct gspca_dev *gspca_dev)
 		break;
 	}
 
-	mode = gspca_dev->cam.cam_mode[(int) gspca_dev->curr_mode].priv;
+	reg_w(gspca_dev, 0x84, reg84, sizeof reg84);
+	reg_w1(gspca_dev, 0x05, sn9c1xx[5]);	/* red */
+	reg_w1(gspca_dev, 0x07, sn9c1xx[7]);	/* green */
+	reg_w1(gspca_dev, 0x06, sn9c1xx[6]);	/* blue */
+
+	init = NULL;
+	mode = gspca_dev->cam.cam_mode[gspca_dev->curr_mode].priv;
 	if (mode)
 		reg1 = 0x46;	/* 320x240: clk 48Mhz, video trf enable */
 	else
 		reg1 = 0x06;	/* 640x480: clk 24Mhz, video trf enable */
 	reg17 = 0x61;		/* 0x:20: enable sensor clock */
 	switch (sd->sensor) {
-	case SENSOR_HV7131R:
-		hv7131R_InitSensor(gspca_dev);
-		break;
-	case SENSOR_MI0360:
-		mi0360_InitSensor(gspca_dev);
-		break;
 	case SENSOR_MO4000:
-		mo4000_InitSensor(gspca_dev);
 		if (mode) {
 /*			reg1 = 0x46;	 * 320 clk 48Mhz 60fp/s */
 			reg1 = 0x06;	/* clk 24Mz */
@@ -1830,7 +1927,7 @@ static int sd_start(struct gspca_dev *gspca_dev)
 		}
 		break;
 	case SENSOR_MT9V111:
-		mt9v111_InitSensor(gspca_dev);
+		init = mt9v111_sensor_param1;
 		if (mode) {
 			reg1 = 0x04;	/* 320 clk 48Mhz */
 		} else {
@@ -1839,22 +1936,21 @@ static int sd_start(struct gspca_dev *gspca_dev)
 		}
 		break;
 	case SENSOR_OM6802:
-		om6802_InitSensor(gspca_dev);
+		init = om6802_sensor_param1;
 		reg17 = 0x64;		/* 640 MCKSIZE */
 		break;
 	case SENSOR_OV7630:
-		ov7630_InitSensor(gspca_dev);
 		setvflip(sd);
 		reg17 = 0xe2;
 		reg1 = 0x44;
 		break;
 	case SENSOR_OV7648:
-		ov7648_InitSensor(gspca_dev);
+		init = ov7648_sensor_param1;
 		reg17 = 0x21;
 /*		reg1 = 0x42;		 * 42 - 46? */
 		break;
 	case SENSOR_OV7660:
-		ov7660_InitSensor(gspca_dev);
+		init = ov7660_sensor_param1;
 		if (sd->bridge == BRIDGE_SN9C120) {
 			if (mode) {		/* 320x240 - 160x120 */
 				reg17 = 0xa2;
@@ -1866,9 +1962,14 @@ static int sd_start(struct gspca_dev *gspca_dev)
 					 * inverse power down */
 		}
 		break;
+	case SENSOR_PO1030:
+		init = po1030_sensor_param1;
+		reg17 = 0xa2;
+		reg1 = 0x44;
+		break;
 	default:
 /*	case SENSOR_SP80708: */
-		sp80708_InitSensor(gspca_dev);
+		init = sp80708_sensor_param1;
 		if (mode) {
 /*??			reg1 = 0x04;	 * 320 clk 48Mhz */
 		} else {
@@ -1877,6 +1978,13 @@ static int sd_start(struct gspca_dev *gspca_dev)
 		}
 		break;
 	}
+
+	/* more sensor initialization - param1 */
+	if (init != NULL) {
+		i2c_w_seq(gspca_dev, init);
+/*		init = NULL; */
+	}
+
 	reg_w(gspca_dev, 0xc0, C0, 6);
 	reg_w(gspca_dev, 0xca, CA, 4);
 	switch (sd->sensor) {
@@ -1891,6 +1999,7 @@ static int sd_start(struct gspca_dev *gspca_dev)
 		break;
 	}
 
+
 	/* here change size mode 0 -> VGA; 1 -> CIF */
 	sd->reg18 = sn9c1xx[0x18] | (mode << 4) | 0x40;
 	reg_w1(gspca_dev, 0x18, sd->reg18);
@@ -1898,6 +2007,7 @@ static int sd_start(struct gspca_dev *gspca_dev)
 
 	reg_w1(gspca_dev, 0x17, reg17);
 	reg_w1(gspca_dev, 0x01, reg1);
+
 	switch (sd->sensor) {
 	case SENSOR_OV7630:
 		setvflip(sd);
@@ -1937,14 +2047,11 @@ static void sd_stopN(struct gspca_dev *gspca_dev)
 		/* fall thru */
 	case SENSOR_MT9V111:
 	case SENSOR_OV7630:
+	case SENSOR_PO1030:
 		data = 0x29;
 		break;
-	default:
-/*	case SENSOR_MO4000: */
-/*	case SENSOR_OV7660: */
-		break;
 	}
-	sn9c1xx = sn_tb[(int) sd->sensor];
+	sn9c1xx = sn_tb[sd->sensor];
 	reg_w1(gspca_dev, 0x01, sn9c1xx[1]);
 	reg_w1(gspca_dev, 0x17, sn9c1xx[0x17]);
 	reg_w1(gspca_dev, 0x01, sn9c1xx[1]);
@@ -1987,11 +2094,19 @@ static void do_autogain(struct gspca_dev *gspca_dev)
 			sd->exposure = setexposure(gspca_dev,
 					(unsigned int) (expotimes << 8));
 			break;
+		case SENSOR_OM6802:
+			expotimes = sd->exposure;
+			expotimes += (luma_mean - delta) >> 2;
+			if (expotimes < 0)
+				expotimes = 0;
+			sd->exposure = setexposure(gspca_dev,
+						   (unsigned int) expotimes);
+			setredblue(gspca_dev);
+			break;
 		default:
 /*		case SENSOR_MO4000: */
 /*		case SENSOR_MI0360: */
 /*		case SENSOR_MT9V111: */
-/*		case SENSOR_OM6802: */
 			expotimes = sd->exposure;
 			expotimes += (luma_mean - delta) >> 6;
 			if (expotimes < 0)
@@ -2007,7 +2122,6 @@ static void do_autogain(struct gspca_dev *gspca_dev)
 /* scan the URB packets */
 /* This function is run at interrupt level. */
 static void sd_pkt_scan(struct gspca_dev *gspca_dev,
-			struct gspca_frame *frame,	/* target */
 			u8 *data,			/* isoc packet */
 			int len)			/* iso packet length */
 {
@@ -2019,7 +2133,7 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
 
 		/* end of frame */
 		gspca_frame_add(gspca_dev, LAST_PACKET,
-				frame, data, sof + 2);
+				data, sof + 2);
 		if (sd->ag_cnt < 0)
 			return;
 /* w1 w2 w3 */
@@ -2042,10 +2156,10 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
 	if (gspca_dev->last_packet_type == LAST_PACKET) {
 
 		/* put the JPEG 422 header */
-		gspca_frame_add(gspca_dev, FIRST_PACKET, frame,
+		gspca_frame_add(gspca_dev, FIRST_PACKET,
 			sd->jpeg_hdr, JPEG_HDR_SZ);
 	}
-	gspca_frame_add(gspca_dev, INTER_PACKET, frame, data, len);
+	gspca_frame_add(gspca_dev, INTER_PACKET, data, len);
 }
 
 static int sd_setbrightness(struct gspca_dev *gspca_dev, __s32 val)
@@ -2295,69 +2409,69 @@ static const struct sd_desc sd_desc = {
 };
 
 /* -- module initialisation -- */
-#define BSI(bridge, sensor, i2c_addr) \
+#define BS(bridge, sensor) \
 	.driver_info = (BRIDGE_ ## bridge << 16) \
-			| (SENSOR_ ## sensor << 8) \
-			| (i2c_addr)
+			| SENSOR_ ## sensor
 static const __devinitdata struct usb_device_id device_table[] = {
 #if !defined CONFIG_USB_SN9C102 && !defined CONFIG_USB_SN9C102_MODULE
-	{USB_DEVICE(0x0458, 0x7025), BSI(SN9C120, MI0360, 0x5d)},
-	{USB_DEVICE(0x0458, 0x702e), BSI(SN9C120, OV7660, 0x21)},
+	{USB_DEVICE(0x0458, 0x7025), BS(SN9C120, MI0360)},
+	{USB_DEVICE(0x0458, 0x702e), BS(SN9C120, OV7660)},
 #endif
-	{USB_DEVICE(0x045e, 0x00f5), BSI(SN9C105, OV7660, 0x21)},
-	{USB_DEVICE(0x045e, 0x00f7), BSI(SN9C105, OV7660, 0x21)},
-	{USB_DEVICE(0x0471, 0x0327), BSI(SN9C105, MI0360, 0x5d)},
-	{USB_DEVICE(0x0471, 0x0328), BSI(SN9C105, MI0360, 0x5d)},
-	{USB_DEVICE(0x0471, 0x0330), BSI(SN9C105, MI0360, 0x5d)},
-	{USB_DEVICE(0x06f8, 0x3004), BSI(SN9C105, OV7660, 0x21)},
-	{USB_DEVICE(0x06f8, 0x3008), BSI(SN9C105, OV7660, 0x21)},
-	{USB_DEVICE(0x0c45, 0x6040), BSI(SN9C102P, HV7131R, 0x11)},
-/* bw600.inf:
-	{USB_DEVICE(0x0c45, 0x6040), BSI(SN9C102P, MI0360, 0x5d)}, */
-/*	{USB_DEVICE(0x0c45, 0x603a), BSI(SN9C102P, OV7648, 0x??)}, */
-/*	{USB_DEVICE(0x0c45, 0x607a), BSI(SN9C102P, OV7648, 0x??)}, */
-	{USB_DEVICE(0x0c45, 0x607c), BSI(SN9C102P, HV7131R, 0x11)},
-/*	{USB_DEVICE(0x0c45, 0x607e), BSI(SN9C102P, OV7630, 0x??)}, */
-	{USB_DEVICE(0x0c45, 0x60c0), BSI(SN9C105, MI0360, 0x5d)},
-/*	{USB_DEVICE(0x0c45, 0x60c8), BSI(SN9C105, OM6802, 0x??)}, */
-/*	{USB_DEVICE(0x0c45, 0x60cc), BSI(SN9C105, HV7131GP, 0x??)}, */
-	{USB_DEVICE(0x0c45, 0x60ec), BSI(SN9C105, MO4000, 0x21)},
-/*	{USB_DEVICE(0x0c45, 0x60ef), BSI(SN9C105, ICM105C, 0x??)}, */
-/*	{USB_DEVICE(0x0c45, 0x60fa), BSI(SN9C105, OV7648, 0x??)}, */
-	{USB_DEVICE(0x0c45, 0x60fb), BSI(SN9C105, OV7660, 0x21)},
+	{USB_DEVICE(0x045e, 0x00f5), BS(SN9C105, OV7660)},
+	{USB_DEVICE(0x045e, 0x00f7), BS(SN9C105, OV7660)},
+	{USB_DEVICE(0x0471, 0x0327), BS(SN9C105, MI0360)},
+	{USB_DEVICE(0x0471, 0x0328), BS(SN9C105, MI0360)},
+	{USB_DEVICE(0x0471, 0x0330), BS(SN9C105, MI0360)},
+	{USB_DEVICE(0x06f8, 0x3004), BS(SN9C105, OV7660)},
+	{USB_DEVICE(0x06f8, 0x3008), BS(SN9C105, OV7660)},
+/*	{USB_DEVICE(0x0c45, 0x603a), BS(SN9C102P, OV7648)}, */
+	{USB_DEVICE(0x0c45, 0x6040), BS(SN9C102P, HV7131R)},
+/*	{USB_DEVICE(0x0c45, 0x607a), BS(SN9C102P, OV7648)}, */
+/*	{USB_DEVICE(0x0c45, 0x607b), BS(SN9C102P, OV7660)}, */
+	{USB_DEVICE(0x0c45, 0x607c), BS(SN9C102P, HV7131R)},
+/*	{USB_DEVICE(0x0c45, 0x607e), BS(SN9C102P, OV7630)}, */
+	{USB_DEVICE(0x0c45, 0x60c0), BS(SN9C105, MI0360)},
+/*	{USB_DEVICE(0x0c45, 0x60c2), BS(SN9C105, P1030xC)}, */
+/*	{USB_DEVICE(0x0c45, 0x60c8), BS(SN9C105, OM6802)}, */
+/*	{USB_DEVICE(0x0c45, 0x60cc), BS(SN9C105, HV7131GP)}, */
+	{USB_DEVICE(0x0c45, 0x60ec), BS(SN9C105, MO4000)},
+/*	{USB_DEVICE(0x0c45, 0x60ef), BS(SN9C105, ICM105C)}, */
+/*	{USB_DEVICE(0x0c45, 0x60fa), BS(SN9C105, OV7648)}, */
+	{USB_DEVICE(0x0c45, 0x60fb), BS(SN9C105, OV7660)},
 #if !defined CONFIG_USB_SN9C102 && !defined CONFIG_USB_SN9C102_MODULE
-	{USB_DEVICE(0x0c45, 0x60fc), BSI(SN9C105, HV7131R, 0x11)},
-	{USB_DEVICE(0x0c45, 0x60fe), BSI(SN9C105, OV7630, 0x21)},
+	{USB_DEVICE(0x0c45, 0x60fc), BS(SN9C105, HV7131R)},
+	{USB_DEVICE(0x0c45, 0x60fe), BS(SN9C105, OV7630)},
 #endif
-	{USB_DEVICE(0x0c45, 0x6100), BSI(SN9C120, MI0360, 0x5d)}, /*sn9c128*/
-/*	{USB_DEVICE(0x0c45, 0x6102), BSI(SN9C120, PO2030N, ??)}, */
-/*	{USB_DEVICE(0x0c45, 0x6108), BSI(SN9C120, OM6802, 0x21)}, */
-	{USB_DEVICE(0x0c45, 0x610a), BSI(SN9C120, OV7648, 0x21)}, /*sn9c128*/
-	{USB_DEVICE(0x0c45, 0x610b), BSI(SN9C120, OV7660, 0x21)}, /*sn9c128*/
-	{USB_DEVICE(0x0c45, 0x610c), BSI(SN9C120, HV7131R, 0x11)}, /*sn9c128*/
-	{USB_DEVICE(0x0c45, 0x610e), BSI(SN9C120, OV7630, 0x21)}, /*sn9c128*/
-/*	{USB_DEVICE(0x0c45, 0x6122), BSI(SN9C110, ICM105C, 0x??)}, */
-/*	{USB_DEVICE(0x0c45, 0x6123), BSI(SN9C110, SanyoCCD, 0x??)}, */
-	{USB_DEVICE(0x0c45, 0x6128), BSI(SN9C110, OM6802, 0x21)}, /*sn9c325?*/
+	{USB_DEVICE(0x0c45, 0x6100), BS(SN9C120, MI0360)},	/*sn9c128*/
+/*	{USB_DEVICE(0x0c45, 0x6102), BS(SN9C120, P1030xC)}, */
+/*	{USB_DEVICE(0x0c45, 0x6108), BS(SN9C120, OM6802)}, */
+	{USB_DEVICE(0x0c45, 0x610a), BS(SN9C120, OV7648)},	/*sn9c128*/
+	{USB_DEVICE(0x0c45, 0x610b), BS(SN9C120, OV7660)},	/*sn9c128*/
+	{USB_DEVICE(0x0c45, 0x610c), BS(SN9C120, HV7131R)},	/*sn9c128*/
+	{USB_DEVICE(0x0c45, 0x610e), BS(SN9C120, OV7630)},	/*sn9c128*/
+/*	{USB_DEVICE(0x0c45, 0x610f), BS(SN9C120, S5K53BEB)}, */
+/*	{USB_DEVICE(0x0c45, 0x6122), BS(SN9C110, ICM105C)}, */
+/*	{USB_DEVICE(0x0c45, 0x6123), BS(SN9C110, SanyoCCD)}, */
+	{USB_DEVICE(0x0c45, 0x6128), BS(SN9C120, OM6802)},	/*sn9c325?*/
 /*bw600.inf:*/
-	{USB_DEVICE(0x0c45, 0x612a), BSI(SN9C120, OV7648, 0x21)}, /*sn9c110?*/
-	{USB_DEVICE(0x0c45, 0x612c), BSI(SN9C110, MO4000, 0x21)},
-	{USB_DEVICE(0x0c45, 0x612e), BSI(SN9C110, OV7630, 0x21)},
-/*	{USB_DEVICE(0x0c45, 0x612f), BSI(SN9C110, ICM105C, 0x??)}, */
+	{USB_DEVICE(0x0c45, 0x612a), BS(SN9C120, OV7648)},	/*sn9c325?*/
+	{USB_DEVICE(0x0c45, 0x612c), BS(SN9C110, MO4000)},
+	{USB_DEVICE(0x0c45, 0x612e), BS(SN9C110, OV7630)},
+/*	{USB_DEVICE(0x0c45, 0x612f), BS(SN9C110, ICM105C)}, */
 #if !defined CONFIG_USB_SN9C102 && !defined CONFIG_USB_SN9C102_MODULE
-	{USB_DEVICE(0x0c45, 0x6130), BSI(SN9C120, MI0360, 0x5d)},
+	{USB_DEVICE(0x0c45, 0x6130), BS(SN9C120, MI0360)},
 #endif
-/*	{USB_DEVICE(0x0c45, 0x6132), BSI(SN9C120, OV7670, 0x21)}, */
-	{USB_DEVICE(0x0c45, 0x6138), BSI(SN9C120, MO4000, 0x21)},
-	{USB_DEVICE(0x0c45, 0x613a), BSI(SN9C120, OV7648, 0x21)},
+/*	{USB_DEVICE(0x0c45, 0x6132), BS(SN9C120, OV7670)}, */
+	{USB_DEVICE(0x0c45, 0x6138), BS(SN9C120, MO4000)},
+	{USB_DEVICE(0x0c45, 0x613a), BS(SN9C120, OV7648)},
 #if !defined CONFIG_USB_SN9C102 && !defined CONFIG_USB_SN9C102_MODULE
-	{USB_DEVICE(0x0c45, 0x613b), BSI(SN9C120, OV7660, 0x21)},
+	{USB_DEVICE(0x0c45, 0x613b), BS(SN9C120, OV7660)},
 #endif
-	{USB_DEVICE(0x0c45, 0x613c), BSI(SN9C120, HV7131R, 0x11)},
-	{USB_DEVICE(0x0c45, 0x613e), BSI(SN9C120, OV7630, 0x21)},
-/*	{USB_DEVICE(0x0c45, 0x6142), BSI(SN9C120, PO2030N, ??)}, *sn9c120b*/
-	{USB_DEVICE(0x0c45, 0x6143), BSI(SN9C120, SP80708, 0x18)}, /*sn9c120b*/
-	{USB_DEVICE(0x0c45, 0x6148), BSI(SN9C120, OM6802, 0x21)}, /*sn9c120b*/
+	{USB_DEVICE(0x0c45, 0x613c), BS(SN9C120, HV7131R)},
+	{USB_DEVICE(0x0c45, 0x613e), BS(SN9C120, OV7630)},
+/*	{USB_DEVICE(0x0c45, 0x6142), BS(SN9C120, PO2030N)},	 *sn9c120b*/
+	{USB_DEVICE(0x0c45, 0x6143), BS(SN9C120, SP80708)},	/*sn9c120b*/
+	{USB_DEVICE(0x0c45, 0x6148), BS(SN9C120, OM6802)},	/*sn9c120b*/
 	{}
 };
 MODULE_DEVICE_TABLE(usb, device_table);
diff --git a/drivers/media/video/gspca/spca500.c b/drivers/media/video/gspca/spca500.c
index fab7ef85a6c1..fe46868a87f2 100644
--- a/drivers/media/video/gspca/spca500.c
+++ b/drivers/media/video/gspca/spca500.c
@@ -589,7 +589,7 @@ static void spca500_reinit(struct gspca_dev *gspca_dev)
 	int err;
 	__u8 Data;
 
-	/* some unknow command from Aiptek pocket dv and family300 */
+	/* some unknown command from Aiptek pocket dv and family300 */
 
 	reg_w(gspca_dev, 0x00, 0x0d01, 0x01);
 	reg_w(gspca_dev, 0x00, 0x0d03, 0x00);
@@ -899,8 +899,7 @@ static void sd_stop0(struct gspca_dev *gspca_dev)
 }
 
 static void sd_pkt_scan(struct gspca_dev *gspca_dev,
-			struct gspca_frame *frame,	/* target */
-			__u8 *data,			/* isoc packet */
+			u8 *data,			/* isoc packet */
 			int len)			/* iso packet length */
 {
 	struct sd *sd = (struct sd *) gspca_dev;
@@ -913,11 +912,11 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
 /*			gspca_dev->last_packet_type = DISCARD_PACKET; */
 			return;
 		}
-		frame = gspca_frame_add(gspca_dev, LAST_PACKET, frame,
+		gspca_frame_add(gspca_dev, LAST_PACKET,
 					ffd9, 2);
 
 		/* put the JPEG header in the new frame */
-		gspca_frame_add(gspca_dev, FIRST_PACKET, frame,
+		gspca_frame_add(gspca_dev, FIRST_PACKET,
 			sd->jpeg_hdr, JPEG_HDR_SZ);
 
 		data += SPCA500_OFFSET_DATA;
@@ -931,7 +930,7 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
 	i = 0;
 	do {
 		if (data[i] == 0xff) {
-			gspca_frame_add(gspca_dev, INTER_PACKET, frame,
+			gspca_frame_add(gspca_dev, INTER_PACKET,
 					data, i + 1);
 			len -= i;
 			data += i;
@@ -940,7 +939,7 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
 		}
 		i++;
 	} while (i < len);
-	gspca_frame_add(gspca_dev, INTER_PACKET, frame, data, len);
+	gspca_frame_add(gspca_dev, INTER_PACKET, data, len);
 }
 
 static void setbrightness(struct gspca_dev *gspca_dev)
diff --git a/drivers/media/video/gspca/spca501.c b/drivers/media/video/gspca/spca501.c
index b74a34218da0..6761a3048a98 100644
--- a/drivers/media/video/gspca/spca501.c
+++ b/drivers/media/video/gspca/spca501.c
@@ -1636,7 +1636,7 @@ static const __u16 spca501c_arowana_init_data[][3] = {
 	{}
 };
 
-/* Unknow camera from Ori Usbid 0x0000:0x0000 */
+/* Unknown camera from Ori Usbid 0x0000:0x0000 */
 /* Based on snoops from Ori Cohen */
 static const __u16 spca501c_mysterious_open_data[][3] = {
 	{0x02, 0x000f, 0x0005},
@@ -1945,7 +1945,7 @@ static int sd_init(struct gspca_dev *gspca_dev)
 			goto error;
 		break;
 	case MystFromOriUnknownCamera:
-		/* UnKnow Ori CMOS Camera data */
+		/* Unknown Ori CMOS Camera data */
 		if (write_vector(gspca_dev, spca501c_mysterious_open_data))
 			goto error;
 		break;
@@ -1978,7 +1978,7 @@ static int sd_start(struct gspca_dev *gspca_dev)
 		write_vector(gspca_dev, spca501c_arowana_open_data);
 		break;
 	case MystFromOriUnknownCamera:
-		/* UnKnow  CMOS Camera data */
+		/* Unknown CMOS Camera data */
 		write_vector(gspca_dev, spca501c_mysterious_init_data);
 		break;
 	default:
@@ -2032,20 +2032,15 @@ static void sd_stop0(struct gspca_dev *gspca_dev)
 }
 
 static void sd_pkt_scan(struct gspca_dev *gspca_dev,
-			struct gspca_frame *frame,	/* target */
-			__u8 *data,			/* isoc packet */
+			u8 *data,			/* isoc packet */
 			int len)			/* iso packet length */
 {
 	switch (data[0]) {
 	case 0:				/* start of frame */
-		frame = gspca_frame_add(gspca_dev,
-					LAST_PACKET,
-					frame,
-					data, 0);
+		gspca_frame_add(gspca_dev, LAST_PACKET, NULL, 0);
 		data += SPCA501_OFFSET_DATA;
 		len -= SPCA501_OFFSET_DATA;
-		gspca_frame_add(gspca_dev, FIRST_PACKET, frame,
-				data, len);
+		gspca_frame_add(gspca_dev, FIRST_PACKET, data, len);
 		return;
 	case 0xff:			/* drop */
 /*		gspca_dev->last_packet_type = DISCARD_PACKET; */
@@ -2053,8 +2048,7 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
 	}
 	data++;
 	len--;
-	gspca_frame_add(gspca_dev, INTER_PACKET, frame,
-			data, len);
+	gspca_frame_add(gspca_dev, INTER_PACKET, data, len);
 }
 
 static int sd_setbrightness(struct gspca_dev *gspca_dev, __s32 val)
diff --git a/drivers/media/video/gspca/spca505.c b/drivers/media/video/gspca/spca505.c
index ea8c9fe2e961..0f9232ff1281 100644
--- a/drivers/media/video/gspca/spca505.c
+++ b/drivers/media/video/gspca/spca505.c
@@ -739,26 +739,22 @@ static void sd_stop0(struct gspca_dev *gspca_dev)
 }
 
 static void sd_pkt_scan(struct gspca_dev *gspca_dev,
-			struct gspca_frame *frame,	/* target */
 			u8 *data,			/* isoc packet */
 			int len)			/* iso packet length */
 {
 	switch (data[0]) {
 	case 0:				/* start of frame */
-		frame = gspca_frame_add(gspca_dev, LAST_PACKET, frame,
-					data, 0);
+		gspca_frame_add(gspca_dev, LAST_PACKET, NULL, 0);
 		data += SPCA50X_OFFSET_DATA;
 		len -= SPCA50X_OFFSET_DATA;
-		gspca_frame_add(gspca_dev, FIRST_PACKET, frame,
-				data, len);
+		gspca_frame_add(gspca_dev, FIRST_PACKET, data, len);
 		break;
 	case 0xff:			/* drop */
 		break;
 	default:
 		data += 1;
 		len -= 1;
-		gspca_frame_add(gspca_dev, INTER_PACKET, frame,
-				data, len);
+		gspca_frame_add(gspca_dev, INTER_PACKET, data, len);
 		break;
 	}
 }
diff --git a/drivers/media/video/gspca/spca506.c b/drivers/media/video/gspca/spca506.c
index a199298a6419..39257e4e074f 100644
--- a/drivers/media/video/gspca/spca506.c
+++ b/drivers/media/video/gspca/spca506.c
@@ -543,18 +543,15 @@ static void sd_stopN(struct gspca_dev *gspca_dev)
 }
 
 static void sd_pkt_scan(struct gspca_dev *gspca_dev,
-			struct gspca_frame *frame,	/* target */
-			__u8 *data,			/* isoc packet */
+			u8 *data,			/* isoc packet */
 			int len)			/* iso packet length */
 {
 	switch (data[0]) {
 	case 0:				/* start of frame */
-		frame = gspca_frame_add(gspca_dev, LAST_PACKET, frame,
-					data, 0);
+		gspca_frame_add(gspca_dev, LAST_PACKET, NULL, 0);
 		data += SPCA50X_OFFSET_DATA;
 		len -= SPCA50X_OFFSET_DATA;
-		gspca_frame_add(gspca_dev, FIRST_PACKET, frame,
-				data, len);
+		gspca_frame_add(gspca_dev, FIRST_PACKET, data, len);
 		break;
 	case 0xff:			/* drop */
 /*		gspca_dev->last_packet_type = DISCARD_PACKET; */
@@ -562,8 +559,7 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
 	default:
 		data += 1;
 		len -= 1;
-		gspca_frame_add(gspca_dev, INTER_PACKET, frame,
-				data, len);
+		gspca_frame_add(gspca_dev, INTER_PACKET, data, len);
 		break;
 	}
 }
@@ -689,7 +685,7 @@ static struct sd_desc sd_desc = {
 };
 
 /* -- module initialisation -- */
-static __devinitdata struct usb_device_id device_table[] = {
+static const struct usb_device_id device_table[] __devinitconst = {
 	{USB_DEVICE(0x06e1, 0xa190)},
 /*fixme: may be IntelPCCameraPro BRIDGE_SPCA505
 	{USB_DEVICE(0x0733, 0x0430)}, */
@@ -700,7 +696,7 @@ static __devinitdata struct usb_device_id device_table[] = {
 MODULE_DEVICE_TABLE(usb, device_table);
 
 /* -- device connect -- */
-static int sd_probe(struct usb_interface *intf,
+static int __devinit sd_probe(struct usb_interface *intf,
 			const struct usb_device_id *id)
 {
 	return gspca_dev_probe(intf, id, &sd_desc, sizeof(struct sd),
diff --git a/drivers/media/video/gspca/spca508.c b/drivers/media/video/gspca/spca508.c
index 9696c4caf5c9..4d8e6cf75d55 100644
--- a/drivers/media/video/gspca/spca508.c
+++ b/drivers/media/video/gspca/spca508.c
@@ -1447,26 +1447,22 @@ static void sd_stopN(struct gspca_dev *gspca_dev)
 }
 
 static void sd_pkt_scan(struct gspca_dev *gspca_dev,
-			struct gspca_frame *frame,	/* target */
 			u8 *data,			/* isoc packet */
 			int len)			/* iso packet length */
 {
 	switch (data[0]) {
 	case 0:				/* start of frame */
-		frame = gspca_frame_add(gspca_dev, LAST_PACKET, frame,
-					data, 0);
+		gspca_frame_add(gspca_dev, LAST_PACKET, NULL, 0);
 		data += SPCA508_OFFSET_DATA;
 		len -= SPCA508_OFFSET_DATA;
-		gspca_frame_add(gspca_dev, FIRST_PACKET, frame,
-				data, len);
+		gspca_frame_add(gspca_dev, FIRST_PACKET, data, len);
 		break;
 	case 0xff:			/* drop */
 		break;
 	default:
 		data += 1;
 		len -= 1;
-		gspca_frame_add(gspca_dev, INTER_PACKET, frame,
-				data, len);
+		gspca_frame_add(gspca_dev, INTER_PACKET, data, len);
 		break;
 	}
 }
diff --git a/drivers/media/video/gspca/spca561.c b/drivers/media/video/gspca/spca561.c
index 27e82b35f3e7..58c2f0039af1 100644
--- a/drivers/media/video/gspca/spca561.c
+++ b/drivers/media/video/gspca/spca561.c
@@ -779,8 +779,7 @@ static void do_autogain(struct gspca_dev *gspca_dev)
 }
 
 static void sd_pkt_scan(struct gspca_dev *gspca_dev,
-			struct gspca_frame *frame, /* target */
-			__u8 *data,		/* isoc packet */
+			u8 *data,		/* isoc packet */
 			int len)		/* iso packet length */
 {
 	struct sd *sd = (struct sd *) gspca_dev;
@@ -788,12 +787,10 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
 	len--;
 	switch (*data++) {			/* sequence number */
 	case 0:					/* start of frame */
-		frame = gspca_frame_add(gspca_dev, LAST_PACKET, frame,
-					data, 0);
+		gspca_frame_add(gspca_dev, LAST_PACKET, NULL, 0);
 		if (data[1] & 0x10) {
 			/* compressed bayer */
-			gspca_frame_add(gspca_dev, FIRST_PACKET,
-					frame, data, len);
+			gspca_frame_add(gspca_dev, FIRST_PACKET, data, len);
 		} else {
 			/* raw bayer (with a header, which we skip) */
 			if (sd->chip_revision == Rev012A) {
@@ -803,14 +800,13 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
 				data += 16;
 				len -= 16;
 			}
-			gspca_frame_add(gspca_dev, FIRST_PACKET,
-						frame, data, len);
+			gspca_frame_add(gspca_dev, FIRST_PACKET, data, len);
 		}
 		return;
 	case 0xff:			/* drop (empty mpackets) */
 		return;
 	}
-	gspca_frame_add(gspca_dev, INTER_PACKET, frame, data, len);
+	gspca_frame_add(gspca_dev, INTER_PACKET, data, len);
 }
 
 /* rev 72a only */
diff --git a/drivers/media/video/gspca/sq905.c b/drivers/media/video/gspca/sq905.c
index 715a68f0156e..1fcaca6a87f7 100644
--- a/drivers/media/video/gspca/sq905.c
+++ b/drivers/media/video/gspca/sq905.c
@@ -168,18 +168,22 @@ static int sq905_ack_frame(struct gspca_dev *gspca_dev)
  *  request and read a block of data - see warning on sq905_command.
  */
 static int
-sq905_read_data(struct gspca_dev *gspca_dev, u8 *data, int size)
+sq905_read_data(struct gspca_dev *gspca_dev, u8 *data, int size, int need_lock)
 {
 	int ret;
 	int act_len;
 
 	gspca_dev->usb_buf[0] = '\0';
+	if (need_lock)
+		mutex_lock(&gspca_dev->usb_lock);
 	ret = usb_control_msg(gspca_dev->dev,
 			      usb_sndctrlpipe(gspca_dev->dev, 0),
 			      USB_REQ_SYNCH_FRAME,                /* request */
 			      USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
 			      SQ905_BULK_READ, size, gspca_dev->usb_buf,
 			      1, SQ905_CMD_TIMEOUT);
+	if (need_lock)
+		mutex_unlock(&gspca_dev->usb_lock);
 	if (ret < 0) {
 		PDEBUG(D_ERR, "%s: usb_control_msg failed (%d)", __func__, ret);
 		return ret;
@@ -210,11 +214,9 @@ static void sq905_dostream(struct work_struct *work)
 {
 	struct sd *dev = container_of(work, struct sd, work_struct);
 	struct gspca_dev *gspca_dev = &dev->gspca_dev;
-	struct gspca_frame *frame;
 	int bytes_left; /* bytes remaining in current frame. */
 	int data_len;   /* size to use for the next read. */
 	int header_read; /* true if we have already read the frame header. */
-	int discarding; /* true if we failed to get space for frame. */
 	int packet_type;
 	int frame_sz;
 	int ret;
@@ -222,7 +224,6 @@ static void sq905_dostream(struct work_struct *work)
 	u8 *buffer;
 
 	buffer = kmalloc(SQ905_MAX_TRANSFER, GFP_KERNEL | GFP_DMA);
-	mutex_lock(&gspca_dev->usb_lock);
 	if (!buffer) {
 		PDEBUG(D_ERR, "Couldn't allocate USB buffer");
 		goto quit_stream;
@@ -232,28 +233,22 @@ static void sq905_dostream(struct work_struct *work)
 			+ FRAME_HEADER_LEN;
 
 	while (gspca_dev->present && gspca_dev->streaming) {
-		/* Need a short delay to ensure streaming flag was set by
-		 * gspca and to make sure gspca can grab the mutex. */
-		mutex_unlock(&gspca_dev->usb_lock);
-		msleep(1);
-
 		/* request some data and then read it until we have
 		 * a complete frame. */
 		bytes_left = frame_sz;
 		header_read = 0;
-		discarding = 0;
 
-		while (bytes_left > 0) {
+		/* Note we do not check for gspca_dev->streaming here, as
+		   we must finish reading an entire frame, otherwise the
+		   next time we stream we start reading in the middle of a
+		   frame. */
+		while (bytes_left > 0 && gspca_dev->present) {
 			data_len = bytes_left > SQ905_MAX_TRANSFER ?
 				SQ905_MAX_TRANSFER : bytes_left;
-			mutex_lock(&gspca_dev->usb_lock);
-			if (!gspca_dev->present)
-				goto quit_stream;
-			ret = sq905_read_data(gspca_dev, buffer, data_len);
+			ret = sq905_read_data(gspca_dev, buffer, data_len, 1);
 			if (ret < 0)
 				goto quit_stream;
-			mutex_unlock(&gspca_dev->usb_lock);
-			PDEBUG(D_STREAM,
+			PDEBUG(D_PACK,
 				"Got %d bytes out of %d for frame",
 				data_len, bytes_left);
 			bytes_left -= data_len;
@@ -270,34 +265,30 @@ static void sq905_dostream(struct work_struct *work)
 			} else {
 				packet_type = INTER_PACKET;
 			}
-			frame = gspca_get_i_frame(gspca_dev);
-			if (frame && !discarding) {
-				frame = gspca_frame_add(gspca_dev, packet_type,
-						frame, data, data_len);
-				/* If entire frame fits in one packet we still
-				   need to add a LAST_PACKET */
-				if (packet_type == FIRST_PACKET &&
-				    bytes_left == 0)
-					frame = gspca_frame_add(gspca_dev,
-							LAST_PACKET,
-							frame, data, 0);
-			} else {
-				discarding = 1;
-			}
+			gspca_frame_add(gspca_dev, packet_type,
+					data, data_len);
+			/* If entire frame fits in one packet we still
+			   need to add a LAST_PACKET */
+			if (packet_type == FIRST_PACKET &&
+			    bytes_left == 0)
+				gspca_frame_add(gspca_dev, LAST_PACKET,
+						NULL, 0);
+		}
+		if (gspca_dev->present) {
+			/* acknowledge the frame */
+			mutex_lock(&gspca_dev->usb_lock);
+			ret = sq905_ack_frame(gspca_dev);
+			mutex_unlock(&gspca_dev->usb_lock);
+			if (ret < 0)
+				goto quit_stream;
 		}
-		/* acknowledge the frame */
-		mutex_lock(&gspca_dev->usb_lock);
-		if (!gspca_dev->present)
-			goto quit_stream;
-		ret = sq905_ack_frame(gspca_dev);
-		if (ret < 0)
-			goto quit_stream;
 	}
 quit_stream:
-	/* the usb_lock is already acquired */
-	if (gspca_dev->present)
+	if (gspca_dev->present) {
+		mutex_lock(&gspca_dev->usb_lock);
 		sq905_command(gspca_dev, SQ905_CLEAR);
-	mutex_unlock(&gspca_dev->usb_lock);
+		mutex_unlock(&gspca_dev->usb_lock);
+	}
 	kfree(buffer);
 }
 
@@ -346,7 +337,7 @@ static int sd_init(struct gspca_dev *gspca_dev)
 	ret = sq905_command(gspca_dev, SQ905_ID);
 	if (ret < 0)
 		return ret;
-	ret = sq905_read_data(gspca_dev, gspca_dev->usb_buf, 4);
+	ret = sq905_read_data(gspca_dev, gspca_dev->usb_buf, 4, 0);
 	if (ret < 0)
 		return ret;
 	/* usb_buf is allocated with kmalloc so is aligned.
diff --git a/drivers/media/video/gspca/sq905c.c b/drivers/media/video/gspca/sq905c.c
index 916892505432..d70b156872d6 100644
--- a/drivers/media/video/gspca/sq905c.c
+++ b/drivers/media/video/gspca/sq905c.c
@@ -115,11 +115,9 @@ static void sq905c_dostream(struct work_struct *work)
 {
 	struct sd *dev = container_of(work, struct sd, work_struct);
 	struct gspca_dev *gspca_dev = &dev->gspca_dev;
-	struct gspca_frame *frame;
 	int bytes_left; /* bytes remaining in current frame. */
 	int data_len;   /* size to use for the next read. */
 	int act_len;
-	int discarding = 0; /* true if we failed to get space for frame. */
 	int packet_type;
 	int ret;
 	u8 *buffer;
@@ -131,8 +129,6 @@ static void sq905c_dostream(struct work_struct *work)
 	}
 
 	while (gspca_dev->present && gspca_dev->streaming) {
-		if (!gspca_dev->present)
-			goto quit_stream;
 		/* Request the header, which tells the size to download */
 		ret = usb_bulk_msg(gspca_dev->dev,
 				usb_rcvbulkpipe(gspca_dev->dev, 0x81),
@@ -149,17 +145,11 @@ static void sq905c_dostream(struct work_struct *work)
 		PDEBUG(D_STREAM, "bytes_left = 0x%x", bytes_left);
 		/* We keep the header. It has other information, too. */
 		packet_type = FIRST_PACKET;
-		frame = gspca_get_i_frame(gspca_dev);
-		if (frame && !discarding) {
-			gspca_frame_add(gspca_dev, packet_type,
-				frame, buffer, FRAME_HEADER_LEN);
-			} else
-				discarding = 1;
-		while (bytes_left > 0) {
+		gspca_frame_add(gspca_dev, packet_type,
+				buffer, FRAME_HEADER_LEN);
+		while (bytes_left > 0 && gspca_dev->present) {
 			data_len = bytes_left > SQ905C_MAX_TRANSFER ?
 				SQ905C_MAX_TRANSFER : bytes_left;
-			if (!gspca_dev->present)
-				goto quit_stream;
 			ret = usb_bulk_msg(gspca_dev->dev,
 				usb_rcvbulkpipe(gspca_dev->dev, 0x81),
 				buffer, data_len, &act_len,
@@ -174,19 +164,16 @@ static void sq905c_dostream(struct work_struct *work)
 				packet_type = LAST_PACKET;
 			else
 				packet_type = INTER_PACKET;
-			frame = gspca_get_i_frame(gspca_dev);
-			if (frame && !discarding)
-				gspca_frame_add(gspca_dev, packet_type,
-						frame, buffer, data_len);
-			else
-				discarding = 1;
+			gspca_frame_add(gspca_dev, packet_type,
+					buffer, data_len);
 		}
 	}
 quit_stream:
-	mutex_lock(&gspca_dev->usb_lock);
-	if (gspca_dev->present)
+	if (gspca_dev->present) {
+		mutex_lock(&gspca_dev->usb_lock);
 		sq905c_command(gspca_dev, SQ905C_CLEAR, 0);
-	mutex_unlock(&gspca_dev->usb_lock);
+		mutex_unlock(&gspca_dev->usb_lock);
+	}
 	kfree(buffer);
 }
 
diff --git a/drivers/media/video/gspca/stk014.c b/drivers/media/video/gspca/stk014.c
index 47628964801e..2e2935532d99 100644
--- a/drivers/media/video/gspca/stk014.c
+++ b/drivers/media/video/gspca/stk014.c
@@ -126,12 +126,14 @@ static const struct v4l2_pix_format vga_mode[] = {
 };
 
 /* -- read a register -- */
-static int reg_r(struct gspca_dev *gspca_dev,
+static u8 reg_r(struct gspca_dev *gspca_dev,
 			__u16 index)
 {
 	struct usb_device *dev = gspca_dev->dev;
 	int ret;
 
+	if (gspca_dev->usb_err < 0)
+		return 0;
 	ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
 			0x00,
 			USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
@@ -141,18 +143,21 @@ static int reg_r(struct gspca_dev *gspca_dev,
 			500);
 	if (ret < 0) {
 		PDEBUG(D_ERR, "reg_r err %d", ret);
-		return ret;
+		gspca_dev->usb_err = ret;
+		return 0;
 	}
 	return gspca_dev->usb_buf[0];
 }
 
 /* -- write a register -- */
-static int reg_w(struct gspca_dev *gspca_dev,
+static void reg_w(struct gspca_dev *gspca_dev,
 			__u16 index, __u16 value)
 {
 	struct usb_device *dev = gspca_dev->dev;
 	int ret;
 
+	if (gspca_dev->usb_err < 0)
+		return;
 	ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
 			0x01,
 			USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
@@ -161,13 +166,14 @@ static int reg_w(struct gspca_dev *gspca_dev,
 			NULL,
 			0,
 			500);
-	if (ret < 0)
+	if (ret < 0) {
 		PDEBUG(D_ERR, "reg_w err %d", ret);
-	return ret;
+		gspca_dev->usb_err = ret;
+	}
 }
 
 /* -- get a bulk value (4 bytes) -- */
-static int rcv_val(struct gspca_dev *gspca_dev,
+static void rcv_val(struct gspca_dev *gspca_dev,
 			int ads)
 {
 	struct usb_device *dev = gspca_dev->dev;
@@ -182,17 +188,22 @@ static int rcv_val(struct gspca_dev *gspca_dev,
 	reg_w(gspca_dev, 0x63a, 0);
 	reg_w(gspca_dev, 0x63b, 0);
 	reg_w(gspca_dev, 0x630, 5);
+	if (gspca_dev->usb_err < 0)
+		return;
 	ret = usb_bulk_msg(dev,
 			usb_rcvbulkpipe(dev, 0x05),
 			gspca_dev->usb_buf,
 			4,		/* length */
 			&alen,
 			500);		/* timeout in milliseconds */
-	return ret;
+	if (ret < 0) {
+		PDEBUG(D_ERR, "rcv_val err %d", ret);
+		gspca_dev->usb_err = ret;
+	}
 }
 
 /* -- send a bulk value -- */
-static int snd_val(struct gspca_dev *gspca_dev,
+static void snd_val(struct gspca_dev *gspca_dev,
 			int ads,
 			unsigned int val)
 {
@@ -201,16 +212,9 @@ static int snd_val(struct gspca_dev *gspca_dev,
 	__u8 seq = 0;
 
 	if (ads == 0x003f08) {
-		ret = reg_r(gspca_dev, 0x0704);
-		if (ret < 0)
-			goto ko;
-		ret = reg_r(gspca_dev, 0x0705);
-		if (ret < 0)
-			goto ko;
-		seq = ret;		/* keep the sequence number */
-		ret = reg_r(gspca_dev, 0x0650);
-		if (ret < 0)
-			goto ko;
+		reg_r(gspca_dev, 0x0704);
+		seq = reg_r(gspca_dev, 0x0705);
+		reg_r(gspca_dev, 0x0650);
 		reg_w(gspca_dev, 0x654, seq);
 	} else {
 		reg_w(gspca_dev, 0x654, (ads >> 16) & 0xff);
@@ -223,6 +227,8 @@ static int snd_val(struct gspca_dev *gspca_dev,
 	reg_w(gspca_dev, 0x65a, 0);
 	reg_w(gspca_dev, 0x65b, 0);
 	reg_w(gspca_dev, 0x650, 5);
+	if (gspca_dev->usb_err < 0)
+		return;
 	gspca_dev->usb_buf[0] = val >> 24;
 	gspca_dev->usb_buf[1] = val >> 16;
 	gspca_dev->usb_buf[2] = val >> 8;
@@ -233,24 +239,23 @@ static int snd_val(struct gspca_dev *gspca_dev,
 			4,
 			&alen,
 			500);	/* timeout in milliseconds */
-	if (ret < 0)
-		goto ko;
-	if (ads == 0x003f08) {
-		seq += 4;
-		seq &= 0x3f;
-		reg_w(gspca_dev, 0x705, seq);
+	if (ret < 0) {
+		PDEBUG(D_ERR, "snd_val err %d", ret);
+		gspca_dev->usb_err = ret;
+	} else {
+		if (ads == 0x003f08) {
+			seq += 4;
+			seq &= 0x3f;
+			reg_w(gspca_dev, 0x705, seq);
+		}
 	}
-	return ret;
-ko:
-	PDEBUG(D_ERR, "snd_val err %d", ret);
-	return ret;
 }
 
 /* set a camera parameter */
-static int set_par(struct gspca_dev *gspca_dev,
+static void set_par(struct gspca_dev *gspca_dev,
 		   int parval)
 {
-	return snd_val(gspca_dev, 0x003f08, parval);
+	snd_val(gspca_dev, 0x003f08, parval);
 }
 
 static void setbrightness(struct gspca_dev *gspca_dev)
@@ -311,18 +316,18 @@ static int sd_config(struct gspca_dev *gspca_dev,
 /* this function is called at probe and resume time */
 static int sd_init(struct gspca_dev *gspca_dev)
 {
-	int ret;
+	u8 ret;
 
 	/* check if the device responds */
 	usb_set_interface(gspca_dev->dev, gspca_dev->iface, 1);
 	ret = reg_r(gspca_dev, 0x0740);
-	if (ret < 0)
-		return ret;
-	if (ret != 0xff) {
-		PDEBUG(D_ERR|D_STREAM, "init reg: 0x%02x", ret);
-		return -1;
+	if (gspca_dev->usb_err >= 0) {
+		if (ret != 0xff) {
+			PDEBUG(D_ERR|D_STREAM, "init reg: 0x%02x", ret);
+			gspca_dev->usb_err = -EIO;
+		}
 	}
-	return 0;
+	return gspca_dev->usb_err;
 }
 
 /* -- start the camera -- */
@@ -357,15 +362,12 @@ static int sd_start(struct gspca_dev *gspca_dev)
 	if (ret < 0) {
 		PDEBUG(D_ERR|D_STREAM, "set intf %d %d failed",
 			gspca_dev->iface, gspca_dev->alt);
+		gspca_dev->usb_err = ret;
 		goto out;
 	}
-	ret = reg_r(gspca_dev, 0x0630);
-	if (ret < 0)
-		goto out;
+	 reg_r(gspca_dev, 0x0630);
 	rcv_val(gspca_dev, 0x000020);	/* << (value ff ff ff ff) */
-	ret = reg_r(gspca_dev, 0x0650);
-	if (ret < 0)
-		goto out;
+	reg_r(gspca_dev, 0x0650);
 	snd_val(gspca_dev, 0x000020, 0xffffffff);
 	reg_w(gspca_dev, 0x0620, 0);
 	reg_w(gspca_dev, 0x0630, 0);
@@ -384,11 +386,11 @@ static int sd_start(struct gspca_dev *gspca_dev)
 	/* start the video flow */
 	set_par(gspca_dev, 0x01000000);
 	set_par(gspca_dev, 0x01000000);
-	PDEBUG(D_STREAM, "camera started alt: 0x%02x", gspca_dev->alt);
-	return 0;
+	if (gspca_dev->usb_err >= 0)
+		PDEBUG(D_STREAM, "camera started alt: 0x%02x",
+				gspca_dev->alt);
 out:
-	PDEBUG(D_ERR|D_STREAM, "camera start err %d", ret);
-	return ret;
+	return gspca_dev->usb_err;
 }
 
 static void sd_stopN(struct gspca_dev *gspca_dev)
@@ -418,8 +420,7 @@ static void sd_stop0(struct gspca_dev *gspca_dev)
 }
 
 static void sd_pkt_scan(struct gspca_dev *gspca_dev,
-			struct gspca_frame *frame,	/* target */
-			__u8 *data,			/* isoc packet */
+			u8 *data,			/* isoc packet */
 			int len)			/* iso packet length */
 {
 	struct sd *sd = (struct sd *) gspca_dev;
@@ -435,11 +436,11 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
 	 *		(without ending - ff d9)
 	 */
 	if (data[0] == 0xff && data[1] == 0xfe) {
-		frame = gspca_frame_add(gspca_dev, LAST_PACKET, frame,
-					ffd9, 2);
+		gspca_frame_add(gspca_dev, LAST_PACKET,
+				ffd9, 2);
 
 		/* put the JPEG 411 header */
-		gspca_frame_add(gspca_dev, FIRST_PACKET, frame,
+		gspca_frame_add(gspca_dev, FIRST_PACKET,
 			sd->jpeg_hdr, JPEG_HDR_SZ);
 
 		/* beginning of the frame */
@@ -447,7 +448,7 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
 		data += STKHDRSZ;
 		len -= STKHDRSZ;
 	}
-	gspca_frame_add(gspca_dev, INTER_PACKET, frame, data, len);
+	gspca_frame_add(gspca_dev, INTER_PACKET, data, len);
 }
 
 static int sd_setbrightness(struct gspca_dev *gspca_dev, __s32 val)
@@ -457,7 +458,7 @@ static int sd_setbrightness(struct gspca_dev *gspca_dev, __s32 val)
 	sd->brightness = val;
 	if (gspca_dev->streaming)
 		setbrightness(gspca_dev);
-	return 0;
+	return gspca_dev->usb_err;
 }
 
 static int sd_getbrightness(struct gspca_dev *gspca_dev, __s32 *val)
@@ -475,7 +476,7 @@ static int sd_setcontrast(struct gspca_dev *gspca_dev, __s32 val)
 	sd->contrast = val;
 	if (gspca_dev->streaming)
 		setcontrast(gspca_dev);
-	return 0;
+	return gspca_dev->usb_err;
 }
 
 static int sd_getcontrast(struct gspca_dev *gspca_dev, __s32 *val)
@@ -493,7 +494,7 @@ static int sd_setcolors(struct gspca_dev *gspca_dev, __s32 val)
 	sd->colors = val;
 	if (gspca_dev->streaming)
 		setcolors(gspca_dev);
-	return 0;
+	return gspca_dev->usb_err;
 }
 
 static int sd_getcolors(struct gspca_dev *gspca_dev, __s32 *val)
@@ -511,7 +512,7 @@ static int sd_setfreq(struct gspca_dev *gspca_dev, __s32 val)
 	sd->lightfreq = val;
 	if (gspca_dev->streaming)
 		setfreq(gspca_dev);
-	return 0;
+	return gspca_dev->usb_err;
 }
 
 static int sd_getfreq(struct gspca_dev *gspca_dev, __s32 *val)
@@ -553,7 +554,7 @@ static int sd_set_jcomp(struct gspca_dev *gspca_dev,
 		sd->quality = jcomp->quality;
 	if (gspca_dev->streaming)
 		jpeg_set_qual(sd->jpeg_hdr, sd->quality);
-	return 0;
+	return gspca_dev->usb_err;
 }
 
 static int sd_get_jcomp(struct gspca_dev *gspca_dev,
diff --git a/drivers/media/video/gspca/stv0680.c b/drivers/media/video/gspca/stv0680.c
new file mode 100644
index 000000000000..2a69d7ccb50d
--- /dev/null
+++ b/drivers/media/video/gspca/stv0680.c
@@ -0,0 +1,364 @@
+/*
+ * STV0680 USB Camera Driver
+ *
+ * Copyright (C) 2009 Hans de Goede <hdgoede@redhat.com>
+ *
+ * This module is adapted from the in kernel v4l1 stv680 driver:
+ *
+ *  STV0680 USB Camera Driver, by Kevin Sisson (kjsisson@bellsouth.net)
+ *
+ * Thanks to STMicroelectronics for information on the usb commands, and
+ * to Steve Miller at STM for his help and encouragement while I was
+ * writing this driver.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ */
+
+#define MODULE_NAME "stv0680"
+
+#include "gspca.h"
+
+MODULE_AUTHOR("Hans de Goede <hdgoede@redhat.com>");
+MODULE_DESCRIPTION("STV0680 USB Camera Driver");
+MODULE_LICENSE("GPL");
+
+/* specific webcam descriptor */
+struct sd {
+	struct gspca_dev gspca_dev;		/* !! must be the first item */
+	struct v4l2_pix_format mode;
+	u8 orig_mode;
+	u8 video_mode;
+	u8 current_mode;
+};
+
+/* V4L2 controls supported by the driver */
+static struct ctrl sd_ctrls[] = {
+};
+
+static int stv_sndctrl(struct gspca_dev *gspca_dev, int set, u8 req, u16 val,
+		       int size)
+{
+	int ret = -1;
+	u8 req_type = 0;
+
+	switch (set) {
+	case 0: /*  0xc1  */
+		req_type = USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_ENDPOINT;
+		break;
+	case 1: /*  0x41  */
+		req_type = USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_ENDPOINT;
+		break;
+	case 2:	/*  0x80  */
+		req_type = USB_DIR_IN | USB_RECIP_DEVICE;
+		break;
+	case 3:	/*  0x40  */
+		req_type = USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE;
+		break;
+	}
+
+	ret = usb_control_msg(gspca_dev->dev,
+			      usb_rcvctrlpipe(gspca_dev->dev, 0),
+			      req, req_type,
+			      val, 0, gspca_dev->usb_buf, size, 500);
+
+	if ((ret < 0) && (req != 0x0a))
+		PDEBUG(D_ERR,
+		       "usb_control_msg error %i, request = 0x%x, error = %i",
+		       set, req, ret);
+
+	return ret;
+}
+
+static int stv0680_handle_error(struct gspca_dev *gspca_dev, int ret)
+{
+	stv_sndctrl(gspca_dev, 0, 0x80, 0, 0x02); /* Get Last Error */
+	PDEBUG(D_ERR, "last error: %i,  command = 0x%x",
+	       gspca_dev->usb_buf[0], gspca_dev->usb_buf[1]);
+	return ret;
+}
+
+static int stv0680_get_video_mode(struct gspca_dev *gspca_dev)
+{
+	/* Note not sure if this init of usb_buf is really necessary */
+	memset(gspca_dev->usb_buf, 0, 8);
+	gspca_dev->usb_buf[0] = 0x0f;
+
+	if (stv_sndctrl(gspca_dev, 0, 0x87, 0, 0x08) != 0x08) {
+		PDEBUG(D_ERR, "Get_Camera_Mode failed");
+		return stv0680_handle_error(gspca_dev, -EIO);
+	}
+
+	return gspca_dev->usb_buf[0]; /* 01 = VGA, 03 = QVGA, 00 = CIF */
+}
+
+static int stv0680_set_video_mode(struct gspca_dev *gspca_dev, u8 mode)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	if (sd->current_mode == mode)
+		return 0;
+
+	memset(gspca_dev->usb_buf, 0, 8);
+	gspca_dev->usb_buf[0] = mode;
+
+	if (stv_sndctrl(gspca_dev, 3, 0x07, 0x0100, 0x08) != 0x08) {
+		PDEBUG(D_ERR, "Set_Camera_Mode failed");
+		return stv0680_handle_error(gspca_dev, -EIO);
+	}
+
+	/* Verify we got what we've asked for */
+	if (stv0680_get_video_mode(gspca_dev) != mode) {
+		PDEBUG(D_ERR, "Error setting camera video mode!");
+		return -EIO;
+	}
+
+	sd->current_mode = mode;
+
+	return 0;
+}
+
+/* this function is called at probe time */
+static int sd_config(struct gspca_dev *gspca_dev,
+			const struct usb_device_id *id)
+{
+	int ret;
+	struct sd *sd = (struct sd *) gspca_dev;
+	struct cam *cam = &gspca_dev->cam;
+
+	/* ping camera to be sure STV0680 is present */
+	if (stv_sndctrl(gspca_dev, 0, 0x88, 0x5678, 0x02) != 0x02 ||
+	    gspca_dev->usb_buf[0] != 0x56 || gspca_dev->usb_buf[1] != 0x78) {
+		PDEBUG(D_ERR, "STV(e): camera ping failed!!");
+		return stv0680_handle_error(gspca_dev, -ENODEV);
+	}
+
+	/* get camera descriptor */
+	if (stv_sndctrl(gspca_dev, 2, 0x06, 0x0200, 0x09) != 0x09)
+		return stv0680_handle_error(gspca_dev, -ENODEV);
+
+	if (stv_sndctrl(gspca_dev, 2, 0x06, 0x0200, 0x22) != 0x22 ||
+	    gspca_dev->usb_buf[7] != 0xa0 || gspca_dev->usb_buf[8] != 0x23) {
+		PDEBUG(D_ERR, "Could not get descriptor 0200.");
+		return stv0680_handle_error(gspca_dev, -ENODEV);
+	}
+	if (stv_sndctrl(gspca_dev, 0, 0x8a, 0, 0x02) != 0x02)
+		return stv0680_handle_error(gspca_dev, -ENODEV);
+	if (stv_sndctrl(gspca_dev, 0, 0x8b, 0, 0x24) != 0x24)
+		return stv0680_handle_error(gspca_dev, -ENODEV);
+	if (stv_sndctrl(gspca_dev, 0, 0x85, 0, 0x10) != 0x10)
+		return stv0680_handle_error(gspca_dev, -ENODEV);
+
+	if (!(gspca_dev->usb_buf[7] & 0x09)) {
+		PDEBUG(D_ERR, "Camera supports neither CIF nor QVGA mode");
+		return -ENODEV;
+	}
+	if (gspca_dev->usb_buf[7] & 0x01)
+		PDEBUG(D_PROBE, "Camera supports CIF mode");
+	if (gspca_dev->usb_buf[7] & 0x02)
+		PDEBUG(D_PROBE, "Camera supports VGA mode");
+	if (gspca_dev->usb_buf[7] & 0x08)
+		PDEBUG(D_PROBE, "Camera supports QVGA mode");
+
+	if (gspca_dev->usb_buf[7] & 0x01)
+		sd->video_mode = 0x00; /* CIF */
+	else
+		sd->video_mode = 0x03; /* QVGA */
+
+	/* FW rev, ASIC rev, sensor ID  */
+	PDEBUG(D_PROBE, "Firmware rev is %i.%i",
+	       gspca_dev->usb_buf[0], gspca_dev->usb_buf[1]);
+	PDEBUG(D_PROBE, "ASIC rev is %i.%i",
+	       gspca_dev->usb_buf[2], gspca_dev->usb_buf[3]);
+	PDEBUG(D_PROBE, "Sensor ID is %i",
+	       (gspca_dev->usb_buf[4]*16) + (gspca_dev->usb_buf[5]>>4));
+
+
+	ret = stv0680_get_video_mode(gspca_dev);
+	if (ret < 0)
+		return ret;
+	sd->current_mode = sd->orig_mode = ret;
+
+	ret = stv0680_set_video_mode(gspca_dev, sd->video_mode);
+	if (ret < 0)
+		return ret;
+
+	/* Get mode details */
+	if (stv_sndctrl(gspca_dev, 0, 0x8f, 0, 0x10) != 0x10)
+		return stv0680_handle_error(gspca_dev, -EIO);
+
+	cam->bulk = 1;
+	cam->bulk_nurbs = 1; /* The cam cannot handle more */
+	cam->bulk_size = (gspca_dev->usb_buf[0] << 24) |
+			 (gspca_dev->usb_buf[1] << 16) |
+			 (gspca_dev->usb_buf[2] << 8) |
+			 (gspca_dev->usb_buf[3]);
+	sd->mode.width = (gspca_dev->usb_buf[4] << 8) |
+			 (gspca_dev->usb_buf[5]);  /* 322, 356, 644 */
+	sd->mode.height = (gspca_dev->usb_buf[6] << 8) |
+			  (gspca_dev->usb_buf[7]); /* 242, 292, 484 */
+	sd->mode.pixelformat = V4L2_PIX_FMT_STV0680;
+	sd->mode.field = V4L2_FIELD_NONE;
+	sd->mode.bytesperline = sd->mode.width;
+	sd->mode.sizeimage = cam->bulk_size;
+	sd->mode.colorspace = V4L2_COLORSPACE_SRGB;
+
+	/* origGain = gspca_dev->usb_buf[12]; */
+
+	cam->cam_mode = &sd->mode;
+	cam->nmodes = 1;
+
+
+	ret = stv0680_set_video_mode(gspca_dev, sd->orig_mode);
+	if (ret < 0)
+		return ret;
+
+	if (stv_sndctrl(gspca_dev, 2, 0x06, 0x0100, 0x12) != 0x12 ||
+	    gspca_dev->usb_buf[8] != 0x53 || gspca_dev->usb_buf[9] != 0x05) {
+		PDEBUG(D_ERR, "Could not get descriptor 0100.");
+		return stv0680_handle_error(gspca_dev, -EIO);
+	}
+
+	return 0;
+}
+
+/* this function is called at probe and resume time */
+static int sd_init(struct gspca_dev *gspca_dev)
+{
+	return 0;
+}
+
+/* -- start the camera -- */
+static int sd_start(struct gspca_dev *gspca_dev)
+{
+	int ret;
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	ret = stv0680_set_video_mode(gspca_dev, sd->video_mode);
+	if (ret < 0)
+		return ret;
+
+	if (stv_sndctrl(gspca_dev, 0, 0x85, 0, 0x10) != 0x10)
+		return stv0680_handle_error(gspca_dev, -EIO);
+
+	/* Start stream at:
+	   0x0000 = CIF (352x288)
+	   0x0100 = VGA (640x480)
+	   0x0300 = QVGA (320x240) */
+	if (stv_sndctrl(gspca_dev, 1, 0x09, sd->video_mode << 8, 0x0) != 0x0)
+		return stv0680_handle_error(gspca_dev, -EIO);
+
+	return 0;
+}
+
+static void sd_stopN(struct gspca_dev *gspca_dev)
+{
+	/* This is a high priority command; it stops all lower order cmds */
+	if (stv_sndctrl(gspca_dev, 1, 0x04, 0x0000, 0x0) != 0x0)
+		stv0680_handle_error(gspca_dev, -EIO);
+}
+
+static void sd_stop0(struct gspca_dev *gspca_dev)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	if (!sd->gspca_dev.present)
+		return;
+
+	stv0680_set_video_mode(gspca_dev, sd->orig_mode);
+}
+
+static void sd_pkt_scan(struct gspca_dev *gspca_dev,
+			u8 *data,
+			int len)
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	/* Every now and then the camera sends a 16 byte packet, no idea
+	   what it contains, but it is not image data, when this
+	   happens the frame received before this packet is corrupt,
+	   so discard it. */
+	if (len != sd->mode.sizeimage) {
+		gspca_dev->last_packet_type = DISCARD_PACKET;
+		return;
+	}
+
+	/* Finish the previous frame, we do this upon reception of the next
+	   packet, even though it is already complete so that the strange 16
+	   byte packets send after a corrupt frame can discard it. */
+	gspca_frame_add(gspca_dev, LAST_PACKET, NULL, 0);
+
+	/* Store the just received frame */
+	gspca_frame_add(gspca_dev, FIRST_PACKET, data, len);
+}
+
+/* sub-driver description */
+static const struct sd_desc sd_desc = {
+	.name = MODULE_NAME,
+	.ctrls = sd_ctrls,
+	.nctrls = ARRAY_SIZE(sd_ctrls),
+	.config = sd_config,
+	.init = sd_init,
+	.start = sd_start,
+	.stopN = sd_stopN,
+	.stop0 = sd_stop0,
+	.pkt_scan = sd_pkt_scan,
+};
+
+/* -- module initialisation -- */
+static const __devinitdata struct usb_device_id device_table[] = {
+	{USB_DEVICE(0x0553, 0x0202)},
+	{USB_DEVICE(0x041e, 0x4007)},
+	{}
+};
+MODULE_DEVICE_TABLE(usb, device_table);
+
+/* -- device connect -- */
+static int sd_probe(struct usb_interface *intf,
+			const struct usb_device_id *id)
+{
+	return gspca_dev_probe(intf, id, &sd_desc, sizeof(struct sd),
+				THIS_MODULE);
+}
+
+static struct usb_driver sd_driver = {
+	.name = MODULE_NAME,
+	.id_table = device_table,
+	.probe = sd_probe,
+	.disconnect = gspca_disconnect,
+#ifdef CONFIG_PM
+	.suspend = gspca_suspend,
+	.resume = gspca_resume,
+#endif
+};
+
+/* -- module insert / remove -- */
+static int __init sd_mod_init(void)
+{
+	int ret;
+	ret = usb_register(&sd_driver);
+	if (ret < 0)
+		return ret;
+	PDEBUG(D_PROBE, "registered");
+	return 0;
+}
+static void __exit sd_mod_exit(void)
+{
+	usb_deregister(&sd_driver);
+	PDEBUG(D_PROBE, "deregistered");
+}
+
+module_init(sd_mod_init);
+module_exit(sd_mod_exit);
diff --git a/drivers/media/video/gspca/stv06xx/stv06xx.c b/drivers/media/video/gspca/stv06xx/stv06xx.c
index bfae63f5584c..5d0241bb1611 100644
--- a/drivers/media/video/gspca/stv06xx/stv06xx.c
+++ b/drivers/media/video/gspca/stv06xx/stv06xx.c
@@ -312,8 +312,7 @@ out:
  * The 0005 and 0100 chunks seem to appear only in compressed stream.
  */
 static void stv06xx_pkt_scan(struct gspca_dev *gspca_dev,
-			struct gspca_frame *frame,	/* target */
-			__u8 *data,			/* isoc packet */
+			u8 *data,			/* isoc packet */
 			int len)			/* iso packet length */
 {
 	struct sd *sd = (struct sd *) gspca_dev;
@@ -366,7 +365,7 @@ frame_data:
 				sd->to_skip -= skip;
 			}
 
-			gspca_frame_add(gspca_dev, INTER_PACKET, frame,
+			gspca_frame_add(gspca_dev, INTER_PACKET,
 					data, chunk_len);
 			break;
 
@@ -378,7 +377,7 @@ frame_data:
 
 			/* Create a new frame, chunk length should be zero */
 			gspca_frame_add(gspca_dev, FIRST_PACKET,
-					frame, data, 0);
+					NULL, 0);
 
 			if (sd->bridge == BRIDGE_ST6422)
 				sd->to_skip = gspca_dev->width * 4;
@@ -394,8 +393,8 @@ frame_data:
 			PDEBUG(D_PACK, "End of frame detected");
 
 			/* Complete the last frame (if any) */
-			frame = gspca_frame_add(gspca_dev, LAST_PACKET,
-						frame, data, 0);
+			gspca_frame_add(gspca_dev, LAST_PACKET,
+					NULL, 0);
 
 			if (chunk_len)
 				PDEBUG(D_ERR, "Chunk length is "
diff --git a/drivers/media/video/gspca/stv06xx/stv06xx_vv6410.h b/drivers/media/video/gspca/stv06xx/stv06xx_vv6410.h
index 487d40555343..96c61926d372 100644
--- a/drivers/media/video/gspca/stv06xx/stv06xx_vv6410.h
+++ b/drivers/media/video/gspca/stv06xx/stv06xx_vv6410.h
@@ -228,6 +228,7 @@ static const struct stv_init stv_bridge_init[] = {
 	/* This reg is written twice. Some kind of reset? */
 	{NULL,  0x1620, 0x80},
 	{NULL,  0x1620, 0x00},
+	{NULL,  0x1443, 0x00},
 	{NULL,  0x1423, 0x04},
 	{x1500, 0x1500, ARRAY_SIZE(x1500)},
 	{x1536, 0x1536, ARRAY_SIZE(x1536)},
diff --git a/drivers/media/video/gspca/sunplus.c b/drivers/media/video/gspca/sunplus.c
index aa8f995ce04e..306b7d75b4aa 100644
--- a/drivers/media/video/gspca/sunplus.c
+++ b/drivers/media/video/gspca/sunplus.c
@@ -460,13 +460,17 @@ static void reg_r(struct gspca_dev *gspca_dev,
 		  u16 index,
 		  u16 len)
 {
+	int ret;
+
 #ifdef GSPCA_DEBUG
 	if (len > USB_BUF_SZ) {
 		err("reg_r: buffer overflow");
 		return;
 	}
 #endif
-	usb_control_msg(gspca_dev->dev,
+	if (gspca_dev->usb_err < 0)
+		return;
+	ret = usb_control_msg(gspca_dev->dev,
 			usb_rcvctrlpipe(gspca_dev->dev, 0),
 			req,
 			USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
@@ -474,6 +478,10 @@ static void reg_r(struct gspca_dev *gspca_dev,
 			index,
 			len ? gspca_dev->usb_buf : NULL, len,
 			500);
+	if (ret < 0) {
+		PDEBUG(D_ERR, "reg_r err %d", ret);
+		gspca_dev->usb_err = ret;
+	}
 }
 
 /* write one byte */
@@ -483,40 +491,55 @@ static void reg_w_1(struct gspca_dev *gspca_dev,
 		   u16 index,
 		   u16 byte)
 {
+	int ret;
+
+	if (gspca_dev->usb_err < 0)
+		return;
 	gspca_dev->usb_buf[0] = byte;
-	usb_control_msg(gspca_dev->dev,
+	ret = usb_control_msg(gspca_dev->dev,
 			usb_sndctrlpipe(gspca_dev->dev, 0),
 			req,
 			USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
 			value, index,
 			gspca_dev->usb_buf, 1,
 			500);
+	if (ret < 0) {
+		PDEBUG(D_ERR, "reg_w_1 err %d", ret);
+		gspca_dev->usb_err = ret;
+	}
 }
 
 /* write req / index / value */
-static int reg_w_riv(struct usb_device *dev,
+static void reg_w_riv(struct gspca_dev *gspca_dev,
 		     u8 req, u16 index, u16 value)
 {
+	struct usb_device *dev = gspca_dev->dev;
 	int ret;
 
+	if (gspca_dev->usb_err < 0)
+		return;
 	ret = usb_control_msg(dev,
 			usb_sndctrlpipe(dev, 0),
 			req,
 			USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
 			value, index, NULL, 0, 500);
-	PDEBUG(D_USBO, "reg write: 0x%02x,0x%02x:0x%02x, %d",
-		req, index, value, ret);
-	if (ret < 0)
-		PDEBUG(D_ERR, "reg write: error %d", ret);
-	return ret;
+	if (ret < 0) {
+		PDEBUG(D_ERR, "reg_w_riv err %d", ret);
+		gspca_dev->usb_err = ret;
+		return;
+	}
+	PDEBUG(D_USBO, "reg_w_riv: 0x%02x,0x%04x:0x%04x",
+		req, index, value);
 }
 
 /* read 1 byte */
-static int reg_r_1(struct gspca_dev *gspca_dev,
+static u8 reg_r_1(struct gspca_dev *gspca_dev,
 			u16 value)	/* wValue */
 {
 	int ret;
 
+	if (gspca_dev->usb_err < 0)
+		return 0;
 	ret = usb_control_msg(gspca_dev->dev,
 			usb_rcvctrlpipe(gspca_dev->dev, 0),
 			0x20,			/* request */
@@ -527,19 +550,22 @@ static int reg_r_1(struct gspca_dev *gspca_dev,
 			500);			/* timeout */
 	if (ret < 0) {
 		PDEBUG(D_ERR, "reg_r_1 err %d", ret);
+		gspca_dev->usb_err = ret;
 		return 0;
 	}
 	return gspca_dev->usb_buf[0];
 }
 
-/* read 1 or 2 bytes - returns < 0 if error */
-static int reg_r_12(struct gspca_dev *gspca_dev,
+/* read 1 or 2 bytes */
+static u16 reg_r_12(struct gspca_dev *gspca_dev,
 			u8 req,		/* bRequest */
 			u16 index,	/* wIndex */
 			u16 length)	/* wLength (1 or 2 only) */
 {
 	int ret;
 
+	if (gspca_dev->usb_err < 0)
+		return 0;
 	gspca_dev->usb_buf[1] = 0;
 	ret = usb_control_msg(gspca_dev->dev,
 			usb_rcvctrlpipe(gspca_dev->dev, 0),
@@ -550,62 +576,44 @@ static int reg_r_12(struct gspca_dev *gspca_dev,
 			gspca_dev->usb_buf, length,
 			500);
 	if (ret < 0) {
-		PDEBUG(D_ERR, "reg_read err %d", ret);
-		return -1;
+		PDEBUG(D_ERR, "reg_r_12 err %d", ret);
+		gspca_dev->usb_err = ret;
+		return 0;
 	}
 	return (gspca_dev->usb_buf[1] << 8) + gspca_dev->usb_buf[0];
 }
 
-static int write_vector(struct gspca_dev *gspca_dev,
+static void write_vector(struct gspca_dev *gspca_dev,
 			const struct cmd *data, int ncmds)
 {
-	struct usb_device *dev = gspca_dev->dev;
-	int ret;
-
 	while (--ncmds >= 0) {
-		ret = reg_w_riv(dev, data->req, data->idx, data->val);
-		if (ret < 0) {
-			PDEBUG(D_ERR,
-			   "Register write failed for 0x%02x, 0x%04x, 0x%04x",
-				data->req, data->val, data->idx);
-			return ret;
-		}
+		reg_w_riv(gspca_dev, data->req, data->idx, data->val);
 		data++;
 	}
-	return 0;
 }
 
-static int spca50x_setup_qtable(struct gspca_dev *gspca_dev,
-				const u8 qtable[2][64])
+static void setup_qtable(struct gspca_dev *gspca_dev,
+			const u8 qtable[2][64])
 {
-	struct usb_device *dev = gspca_dev->dev;
-	int i, err;
+	int i;
 
 	/* loop over y components */
-	for (i = 0; i < 64; i++) {
-		err = reg_w_riv(dev, 0x00, 0x2800 + i, qtable[0][i]);
-		if (err < 0)
-			return err;
-	}
+	for (i = 0; i < 64; i++)
+		 reg_w_riv(gspca_dev, 0x00, 0x2800 + i, qtable[0][i]);
 
 	/* loop over c components */
-	for (i = 0; i < 64; i++) {
-		err = reg_w_riv(dev, 0x00, 0x2840 + i, qtable[1][i]);
-		if (err < 0)
-			return err;
-	}
-	return 0;
+	for (i = 0; i < 64; i++)
+		reg_w_riv(gspca_dev, 0x00, 0x2840 + i, qtable[1][i]);
 }
 
 static void spca504_acknowledged_command(struct gspca_dev *gspca_dev,
 			     u8 req, u16 idx, u16 val)
 {
-	struct usb_device *dev = gspca_dev->dev;
-	int notdone;
+	u16 notdone;
 
-	reg_w_riv(dev, req, idx, val);
+	reg_w_riv(gspca_dev, req, idx, val);
 	notdone = reg_r_12(gspca_dev, 0x01, 0x0001, 1);
-	reg_w_riv(dev, req, idx, val);
+	reg_w_riv(gspca_dev, req, idx, val);
 
 	PDEBUG(D_FRAM, "before wait 0x%04x", notdone);
 
@@ -616,23 +624,22 @@ static void spca504_acknowledged_command(struct gspca_dev *gspca_dev,
 
 static void spca504A_acknowledged_command(struct gspca_dev *gspca_dev,
 			u8 req,
-			u16 idx, u16 val, u8 stat, u8 count)
+			u16 idx, u16 val, u16 endcode, u8 count)
 {
-	struct usb_device *dev = gspca_dev->dev;
-	int status;
-	u8 endcode;
+	u16 status;
 
-	reg_w_riv(dev, req, idx, val);
+	reg_w_riv(gspca_dev, req, idx, val);
 	status = reg_r_12(gspca_dev, 0x01, 0x0001, 1);
-	endcode = stat;
-	PDEBUG(D_FRAM, "Status 0x%x Need 0x%04x", status, stat);
+	if (gspca_dev->usb_err < 0)
+		return;
+	PDEBUG(D_FRAM, "Status 0x%04x Need 0x%04x", status, endcode);
 	if (!count)
 		return;
 	count = 200;
 	while (--count > 0) {
 		msleep(10);
-		/* gsmart mini2 write a each wait setting 1 ms is enought */
-/*		reg_w_riv(dev, req, idx, val); */
+		/* gsmart mini2 write a each wait setting 1 ms is enough */
+/*		reg_w_riv(gspca_dev, req, idx, val); */
 		status = reg_r_12(gspca_dev, 0x01, 0x0001, 1);
 		if (status == endcode) {
 			PDEBUG(D_FRAM, "status 0x%04x after wait %d",
@@ -642,7 +649,7 @@ static void spca504A_acknowledged_command(struct gspca_dev *gspca_dev,
 	}
 }
 
-static int spca504B_PollingDataReady(struct gspca_dev *gspca_dev)
+static void spca504B_PollingDataReady(struct gspca_dev *gspca_dev)
 {
 	int count = 10;
 
@@ -652,7 +659,6 @@ static int spca504B_PollingDataReady(struct gspca_dev *gspca_dev)
 			break;
 		msleep(10);
 	}
-	return gspca_dev->usb_buf[0];
 }
 
 static void spca504B_WaitCmdStatus(struct gspca_dev *gspca_dev)
@@ -686,28 +692,26 @@ static void spca50x_GetFirmware(struct gspca_dev *gspca_dev)
 static void spca504B_SetSizeType(struct gspca_dev *gspca_dev)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
-	struct usb_device *dev = gspca_dev->dev;
 	u8 Size;
-	int rc;
 
 	Size = gspca_dev->cam.cam_mode[gspca_dev->curr_mode].priv;
 	switch (sd->bridge) {
 	case BRIDGE_SPCA533:
-		reg_w_riv(dev, 0x31, 0, 0);
+		reg_w_riv(gspca_dev, 0x31, 0, 0);
 		spca504B_WaitCmdStatus(gspca_dev);
-		rc = spca504B_PollingDataReady(gspca_dev);
+		spca504B_PollingDataReady(gspca_dev);
 		spca50x_GetFirmware(gspca_dev);
 		reg_w_1(gspca_dev, 0x24, 0, 8, 2);		/* type */
 		reg_r(gspca_dev, 0x24, 8, 1);
 
 		reg_w_1(gspca_dev, 0x25, 0, 4, Size);
 		reg_r(gspca_dev, 0x25, 4, 1);			/* size */
-		rc = spca504B_PollingDataReady(gspca_dev);
+		spca504B_PollingDataReady(gspca_dev);
 
 		/* Init the cam width height with some values get on init ? */
-		reg_w_riv(dev, 0x31, 0, 0x04);
+		reg_w_riv(gspca_dev, 0x31, 0x0004, 0x00);
 		spca504B_WaitCmdStatus(gspca_dev);
-		rc = spca504B_PollingDataReady(gspca_dev);
+		spca504B_PollingDataReady(gspca_dev);
 		break;
 	default:
 /* case BRIDGE_SPCA504B: */
@@ -716,7 +720,7 @@ static void spca504B_SetSizeType(struct gspca_dev *gspca_dev)
 		reg_r(gspca_dev, 0x25, 4, 1);			/* size */
 		reg_w_1(gspca_dev, 0x27, 0, 0, 6);
 		reg_r(gspca_dev, 0x27, 0, 1);			/* type */
-		rc = spca504B_PollingDataReady(gspca_dev);
+		spca504B_PollingDataReady(gspca_dev);
 		break;
 	case BRIDGE_SPCA504:
 		Size += 3;
@@ -733,8 +737,8 @@ static void spca504B_SetSizeType(struct gspca_dev *gspca_dev)
 		break;
 	case BRIDGE_SPCA504C:
 		/* capture mode */
-		reg_w_riv(dev, 0xa0, (0x0500 | (Size & 0x0f)), 0x00);
-		reg_w_riv(dev, 0x20, 0x01, 0x0500 | (Size & 0x0f));
+		reg_w_riv(gspca_dev, 0xa0, (0x0500 | (Size & 0x0f)), 0x00);
+		reg_w_riv(gspca_dev, 0x20, 0x01, 0x0500 | (Size & 0x0f));
 		break;
 	}
 }
@@ -762,37 +766,33 @@ static void spca504B_setQtable(struct gspca_dev *gspca_dev)
 static void setbrightness(struct gspca_dev *gspca_dev)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
-	struct usb_device *dev = gspca_dev->dev;
 	u16 reg;
 
 	reg = sd->bridge == BRIDGE_SPCA536 ? 0x20f0 : 0x21a7;
-	reg_w_riv(dev, 0x00, reg, sd->brightness);
+	reg_w_riv(gspca_dev, 0x00, reg, sd->brightness);
 }
 
 static void setcontrast(struct gspca_dev *gspca_dev)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
-	struct usb_device *dev = gspca_dev->dev;
 	u16 reg;
 
 	reg = sd->bridge == BRIDGE_SPCA536 ? 0x20f1 : 0x21a8;
-	reg_w_riv(dev, 0x00, reg, sd->contrast);
+	reg_w_riv(gspca_dev, 0x00, reg, sd->contrast);
 }
 
 static void setcolors(struct gspca_dev *gspca_dev)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
-	struct usb_device *dev = gspca_dev->dev;
 	u16 reg;
 
 	reg = sd->bridge == BRIDGE_SPCA536 ? 0x20f6 : 0x21ae;
-	reg_w_riv(dev, 0x00, reg, sd->colors);
+	reg_w_riv(gspca_dev, 0x00, reg, sd->colors);
 }
 
 static void init_ctl_reg(struct gspca_dev *gspca_dev)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
-	struct usb_device *dev = gspca_dev->dev;
 	int pollreg = 1;
 
 	setbrightness(gspca_dev);
@@ -807,14 +807,14 @@ static void init_ctl_reg(struct gspca_dev *gspca_dev)
 	default:
 /*	case BRIDGE_SPCA533: */
 /*	case BRIDGE_SPCA504B: */
-		reg_w_riv(dev, 0, 0x00, 0x21ad);	/* hue */
-		reg_w_riv(dev, 0, 0x01, 0x21ac);	/* sat/hue */
-		reg_w_riv(dev, 0, 0x00, 0x21a3);	/* gamma */
+		reg_w_riv(gspca_dev, 0, 0x21ad, 0x00);	/* hue */
+		reg_w_riv(gspca_dev, 0, 0x21ac, 0x01);	/* sat/hue */
+		reg_w_riv(gspca_dev, 0, 0x21a3, 0x00);	/* gamma */
 		break;
 	case BRIDGE_SPCA536:
-		reg_w_riv(dev, 0, 0x40, 0x20f5);
-		reg_w_riv(dev, 0, 0x01, 0x20f4);
-		reg_w_riv(dev, 0, 0x00, 0x2089);
+		reg_w_riv(gspca_dev, 0, 0x20f5, 0x40);
+		reg_w_riv(gspca_dev, 0, 0x20f4, 0x01);
+		reg_w_riv(gspca_dev, 0, 0x2089, 0x00);
 		break;
 	}
 	if (pollreg)
@@ -881,18 +881,17 @@ static int sd_config(struct gspca_dev *gspca_dev,
 static int sd_init(struct gspca_dev *gspca_dev)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
-	struct usb_device *dev = gspca_dev->dev;
-	int i, err_code;
+	int i;
 	u8 info[6];
 
 	switch (sd->bridge) {
 	case BRIDGE_SPCA504B:
-		reg_w_riv(dev, 0x1d, 0x00, 0);
-		reg_w_riv(dev, 0, 0x01, 0x2306);
-		reg_w_riv(dev, 0, 0x00, 0x0d04);
-		reg_w_riv(dev, 0, 0x00, 0x2000);
-		reg_w_riv(dev, 0, 0x13, 0x2301);
-		reg_w_riv(dev, 0, 0x00, 0x2306);
+		reg_w_riv(gspca_dev, 0x1d, 0x00, 0);
+		reg_w_riv(gspca_dev, 0x00, 0x2306, 0x01);
+		reg_w_riv(gspca_dev, 0x00, 0x0d04, 0x00);
+		reg_w_riv(gspca_dev, 0x00, 0x2000, 0x00);
+		reg_w_riv(gspca_dev, 0x00, 0x2301, 0x13);
+		reg_w_riv(gspca_dev, 0x00, 0x2306, 0x00);
 		/* fall thru */
 	case BRIDGE_SPCA533:
 		spca504B_PollingDataReady(gspca_dev);
@@ -904,13 +903,13 @@ static int sd_init(struct gspca_dev *gspca_dev)
 		reg_w_1(gspca_dev, 0x24, 0, 0, 0);
 		reg_r(gspca_dev, 0x24, 0, 1);
 		spca504B_PollingDataReady(gspca_dev);
-		reg_w_riv(dev, 0x34, 0, 0);
+		reg_w_riv(gspca_dev, 0x34, 0, 0);
 		spca504B_WaitCmdStatus(gspca_dev);
 		break;
 	case BRIDGE_SPCA504C:	/* pccam600 */
 		PDEBUG(D_STREAM, "Opening SPCA504 (PC-CAM 600)");
-		reg_w_riv(dev, 0xe0, 0x0000, 0x0000);
-		reg_w_riv(dev, 0xe0, 0x0000, 0x0001);	/* reset */
+		reg_w_riv(gspca_dev, 0xe0, 0x0000, 0x0000);
+		reg_w_riv(gspca_dev, 0xe0, 0x0000, 0x0001);	/* reset */
 		spca504_wait_status(gspca_dev);
 		if (sd->subtype == LogitechClickSmart420)
 			write_vector(gspca_dev,
@@ -919,12 +918,7 @@ static int sd_init(struct gspca_dev *gspca_dev)
 		else
 			write_vector(gspca_dev, spca504_pccam600_open_data,
 				ARRAY_SIZE(spca504_pccam600_open_data));
-		err_code = spca50x_setup_qtable(gspca_dev,
-						qtable_creative_pccam);
-		if (err_code < 0) {
-			PDEBUG(D_ERR|D_STREAM, "spca50x_setup_qtable failed");
-			return err_code;
-		}
+		setup_qtable(gspca_dev, qtable_creative_pccam);
 		break;
 	default:
 /*	case BRIDGE_SPCA504: */
@@ -958,29 +952,24 @@ static int sd_init(struct gspca_dev *gspca_dev)
 							6, 0, 0x86, 1); */
 /*			spca504A_acknowledged_command (gspca_dev, 0x24,
 							0, 0, 0x9D, 1); */
-			reg_w_riv(dev, 0x00, 0x270c, 0x05); /* L92 sno1t.txt */
-			reg_w_riv(dev, 0x00, 0x2310, 0x05);
+			reg_w_riv(gspca_dev, 0x00, 0x270c, 0x05);
+							/* L92 sno1t.txt */
+			reg_w_riv(gspca_dev, 0x00, 0x2310, 0x05);
 			spca504A_acknowledged_command(gspca_dev, 0x01,
 							0x0f, 0, 0xff, 0);
 		}
 		/* setup qtable */
-		reg_w_riv(dev, 0, 0x2000, 0);
-		reg_w_riv(dev, 0, 0x2883, 1);
-		err_code = spca50x_setup_qtable(gspca_dev,
-						qtable_spca504_default);
-		if (err_code < 0) {
-			PDEBUG(D_ERR, "spca50x_setup_qtable failed");
-			return err_code;
-		}
+		reg_w_riv(gspca_dev, 0, 0x2000, 0);
+		reg_w_riv(gspca_dev, 0, 0x2883, 1);
+		setup_qtable(gspca_dev, qtable_spca504_default);
 		break;
 	}
-	return 0;
+	return gspca_dev->usb_err;
 }
 
 static int sd_start(struct gspca_dev *gspca_dev)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
-	struct usb_device *dev = gspca_dev->dev;
 	int enable;
 	int i;
 	u8 info[6];
@@ -1005,13 +994,13 @@ static int sd_start(struct gspca_dev *gspca_dev)
 		case MegapixV4:
 		case LogitechClickSmart820:
 		case MegaImageVI:
-			reg_w_riv(dev, 0xf0, 0, 0);
+			reg_w_riv(gspca_dev, 0xf0, 0, 0);
 			spca504B_WaitCmdStatus(gspca_dev);
 			reg_r(gspca_dev, 0xf0, 4, 0);
 			spca504B_WaitCmdStatus(gspca_dev);
 			break;
 		default:
-			reg_w_riv(dev, 0x31, 0, 0x04);
+			reg_w_riv(gspca_dev, 0x31, 0x0004, 0x00);
 			spca504B_WaitCmdStatus(gspca_dev);
 			spca504B_PollingDataReady(gspca_dev);
 			break;
@@ -1048,8 +1037,9 @@ static int sd_start(struct gspca_dev *gspca_dev)
 			spca504_acknowledged_command(gspca_dev, 0x24, 0, 0);
 		}
 		spca504B_SetSizeType(gspca_dev);
-		reg_w_riv(dev, 0x00, 0x270c, 0x05);	/* L92 sno1t.txt */
-		reg_w_riv(dev, 0x00, 0x2310, 0x05);
+		reg_w_riv(gspca_dev, 0x00, 0x270c, 0x05);
+							/* L92 sno1t.txt */
+		reg_w_riv(gspca_dev, 0x00, 0x2310, 0x05);
 		break;
 	case BRIDGE_SPCA504C:
 		if (sd->subtype == LogitechClickSmart420) {
@@ -1061,36 +1051,37 @@ static int sd_start(struct gspca_dev *gspca_dev)
 				ARRAY_SIZE(spca504_pccam600_init_data));
 		}
 		enable = (sd->autogain ? 0x04 : 0x01);
-		reg_w_riv(dev, 0x0c, 0x0000, enable);	/* auto exposure */
-		reg_w_riv(dev, 0xb0, 0x0000, enable);	/* auto whiteness */
+		reg_w_riv(gspca_dev, 0x0c, 0x0000, enable);
+							/* auto exposure */
+		reg_w_riv(gspca_dev, 0xb0, 0x0000, enable);
+							/* auto whiteness */
 
 		/* set default exposure compensation and whiteness balance */
-		reg_w_riv(dev, 0x30, 0x0001, 800);	/* ~ 20 fps */
-		reg_w_riv(dev, 0x30, 0x0002, 1600);
+		reg_w_riv(gspca_dev, 0x30, 0x0001, 800);	/* ~ 20 fps */
+		reg_w_riv(gspca_dev, 0x30, 0x0002, 1600);
 		spca504B_SetSizeType(gspca_dev);
 		break;
 	}
 	init_ctl_reg(gspca_dev);
-	return 0;
+	return gspca_dev->usb_err;
 }
 
 static void sd_stopN(struct gspca_dev *gspca_dev)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
-	struct usb_device *dev = gspca_dev->dev;
 
 	switch (sd->bridge) {
 	default:
 /*	case BRIDGE_SPCA533: */
 /*	case BRIDGE_SPCA536: */
 /*	case BRIDGE_SPCA504B: */
-		reg_w_riv(dev, 0x31, 0, 0);
+		reg_w_riv(gspca_dev, 0x31, 0, 0);
 		spca504B_WaitCmdStatus(gspca_dev);
 		spca504B_PollingDataReady(gspca_dev);
 		break;
 	case BRIDGE_SPCA504:
 	case BRIDGE_SPCA504C:
-		reg_w_riv(dev, 0x00, 0x2000, 0x0000);
+		reg_w_riv(gspca_dev, 0x00, 0x2000, 0x0000);
 
 		if (sd->subtype == AiptekMiniPenCam13) {
 			/* spca504a aiptek */
@@ -1102,7 +1093,7 @@ static void sd_stopN(struct gspca_dev *gspca_dev)
 							0x0f, 0x00, 0xff, 1);
 		} else {
 			spca504_acknowledged_command(gspca_dev, 0x24, 0, 0);
-			reg_w_riv(dev, 0x01, 0x000f, 0x0000);
+			reg_w_riv(gspca_dev, 0x01, 0x000f, 0x0000);
 		}
 		break;
 	}
@@ -1116,7 +1107,6 @@ static void sd_stop0(struct gspca_dev *gspca_dev)
 }
 
 static void sd_pkt_scan(struct gspca_dev *gspca_dev,
-			struct gspca_frame *frame,	/* target */
 			u8 *data,			/* isoc packet */
 			int len)			/* iso packet length */
 {
@@ -1186,11 +1176,11 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
 		break;
 	}
 	if (sof) {		/* start of frame */
-		frame = gspca_frame_add(gspca_dev, LAST_PACKET, frame,
-					ffd9, 2);
+		gspca_frame_add(gspca_dev, LAST_PACKET,
+				ffd9, 2);
 
 		/* put the JPEG header in the new frame */
-		gspca_frame_add(gspca_dev, FIRST_PACKET, frame,
+		gspca_frame_add(gspca_dev, FIRST_PACKET,
 			sd->jpeg_hdr, JPEG_HDR_SZ);
 	}
 
@@ -1198,7 +1188,7 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
 	i = 0;
 	do {
 		if (data[i] == 0xff) {
-			gspca_frame_add(gspca_dev, INTER_PACKET, frame,
+			gspca_frame_add(gspca_dev, INTER_PACKET,
 					data, i + 1);
 			len -= i;
 			data += i;
@@ -1207,7 +1197,7 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
 		}
 		i++;
 	} while (i < len);
-	gspca_frame_add(gspca_dev, INTER_PACKET, frame, data, len);
+	gspca_frame_add(gspca_dev, INTER_PACKET, data, len);
 }
 
 static int sd_setbrightness(struct gspca_dev *gspca_dev, __s32 val)
@@ -1217,7 +1207,7 @@ static int sd_setbrightness(struct gspca_dev *gspca_dev, __s32 val)
 	sd->brightness = val;
 	if (gspca_dev->streaming)
 		setbrightness(gspca_dev);
-	return 0;
+	return gspca_dev->usb_err;
 }
 
 static int sd_getbrightness(struct gspca_dev *gspca_dev, __s32 *val)
@@ -1235,7 +1225,7 @@ static int sd_setcontrast(struct gspca_dev *gspca_dev, __s32 val)
 	sd->contrast = val;
 	if (gspca_dev->streaming)
 		setcontrast(gspca_dev);
-	return 0;
+	return gspca_dev->usb_err;
 }
 
 static int sd_getcontrast(struct gspca_dev *gspca_dev, __s32 *val)
@@ -1253,7 +1243,7 @@ static int sd_setcolors(struct gspca_dev *gspca_dev, __s32 val)
 	sd->colors = val;
 	if (gspca_dev->streaming)
 		setcolors(gspca_dev);
-	return 0;
+	return gspca_dev->usb_err;
 }
 
 static int sd_getcolors(struct gspca_dev *gspca_dev, __s32 *val)
@@ -1293,7 +1283,7 @@ static int sd_set_jcomp(struct gspca_dev *gspca_dev,
 		sd->quality = jcomp->quality;
 	if (gspca_dev->streaming)
 		jpeg_set_qual(sd->jpeg_hdr, sd->quality);
-	return 0;
+	return gspca_dev->usb_err;
 }
 
 static int sd_get_jcomp(struct gspca_dev *gspca_dev,
diff --git a/drivers/media/video/gspca/t613.c b/drivers/media/video/gspca/t613.c
index 1d321c30d22f..55ef6a744427 100644
--- a/drivers/media/video/gspca/t613.c
+++ b/drivers/media/video/gspca/t613.c
@@ -938,7 +938,6 @@ static void sd_stopN(struct gspca_dev *gspca_dev)
 }
 
 static void sd_pkt_scan(struct gspca_dev *gspca_dev,
-			struct gspca_frame *frame,	/* target */
 			u8 *data,			/* isoc packet */
 			int len)			/* iso packet length */
 {
@@ -956,9 +955,9 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
 		/* extra bytes....., could be processed too but would be
 		 * a waste of time, right now leave the application and
 		 * libjpeg do it for ourserlves.. */
-		frame = gspca_frame_add(gspca_dev, LAST_PACKET, frame,
+		gspca_frame_add(gspca_dev, LAST_PACKET,
 					ffd9, 2);
-		gspca_frame_add(gspca_dev, FIRST_PACKET, frame, data, len);
+		gspca_frame_add(gspca_dev, FIRST_PACKET, data, len);
 		return;
 	}
 
@@ -967,7 +966,7 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
 		 * other's do not include it... */
 		len -= 2;
 	}
-	gspca_frame_add(gspca_dev, INTER_PACKET, frame, data, len);
+	gspca_frame_add(gspca_dev, INTER_PACKET, data, len);
 }
 
 static int sd_setbrightness(struct gspca_dev *gspca_dev, __s32 val)
diff --git a/drivers/media/video/gspca/tv8532.c b/drivers/media/video/gspca/tv8532.c
index 4b44dde9f8b8..b74a3b6489c7 100644
--- a/drivers/media/video/gspca/tv8532.c
+++ b/drivers/media/video/gspca/tv8532.c
@@ -398,8 +398,7 @@ static void sd_stopN(struct gspca_dev *gspca_dev)
 }
 
 static void sd_pkt_scan(struct gspca_dev *gspca_dev,
-			struct gspca_frame *frame,	/* target */
-			__u8 *data,			/* isoc packet */
+			u8 *data,			/* isoc packet */
 			int len)			/* iso packet length */
 {
 	struct sd *sd = (struct sd *) gspca_dev;
@@ -424,9 +423,9 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
 	 * - 4 bytes
 	 */
 	gspca_frame_add(gspca_dev, packet_type0,
-			frame, data + 2, gspca_dev->width);
+			data + 2, gspca_dev->width);
 	gspca_frame_add(gspca_dev, packet_type1,
-			frame, data + gspca_dev->width + 5, gspca_dev->width);
+			data + gspca_dev->width + 5, gspca_dev->width);
 }
 
 static int sd_setbrightness(struct gspca_dev *gspca_dev, __s32 val)
diff --git a/drivers/media/video/gspca/vc032x.c b/drivers/media/video/gspca/vc032x.c
index 589042f6adbe..71921c878424 100644
--- a/drivers/media/video/gspca/vc032x.c
+++ b/drivers/media/video/gspca/vc032x.c
@@ -2987,7 +2987,6 @@ static void sd_stop0(struct gspca_dev *gspca_dev)
 }
 
 static void sd_pkt_scan(struct gspca_dev *gspca_dev,
-			struct gspca_frame *frame,	/* target */
 			u8 *data,			/* isoc packet */
 			int len)			/* iso pkt length */
 {
@@ -2996,21 +2995,29 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
 	if (data[0] == 0xff && data[1] == 0xd8) {
 		PDEBUG(D_PACK,
 			"vc032x header packet found len %d", len);
-		frame = gspca_frame_add(gspca_dev, LAST_PACKET, frame,
-						data, 0);
+		gspca_frame_add(gspca_dev, LAST_PACKET, NULL, 0);
 		data += sd->image_offset;
 		len -= sd->image_offset;
-		gspca_frame_add(gspca_dev, FIRST_PACKET, frame,
-				data, len);
+		gspca_frame_add(gspca_dev, FIRST_PACKET, data, len);
 		return;
 	}
 
 	/* The vc0321 sends some additional data after sending the complete
 	 * frame, we ignore this. */
-	if (sd->bridge == BRIDGE_VC0321
-	    && len > frame->v4l2_buf.length - (frame->data_end - frame->data))
-		len = frame->v4l2_buf.length - (frame->data_end - frame->data);
-	gspca_frame_add(gspca_dev, INTER_PACKET, frame, data, len);
+	if (sd->bridge == BRIDGE_VC0321) {
+		struct gspca_frame *frame;
+		int l;
+
+		frame = gspca_get_i_frame(gspca_dev);
+		if (frame == NULL) {
+			gspca_dev->last_packet_type = DISCARD_PACKET;
+			return;
+		}
+		l = frame->data_end - frame->data;
+		if (len > frame->v4l2_buf.length - l)
+			len = frame->v4l2_buf.length - l;
+	}
+	gspca_frame_add(gspca_dev, INTER_PACKET, data, len);
 }
 
 static int sd_sethflip(struct gspca_dev *gspca_dev, __s32 val)
@@ -3092,6 +3099,8 @@ static int sd_querymenu(struct gspca_dev *gspca_dev,
 
 	switch (menu->id) {
 	case V4L2_CID_POWER_LINE_FREQUENCY:
+		if (menu->index >= ARRAY_SIZE(freq_nm))
+			break;
 		strcpy((char *) menu->name, freq_nm[menu->index]);
 		return 0;
 	}
diff --git a/drivers/media/video/gspca/w996Xcf.c b/drivers/media/video/gspca/w996Xcf.c
new file mode 100644
index 000000000000..2fffe203bed8
--- /dev/null
+++ b/drivers/media/video/gspca/w996Xcf.c
@@ -0,0 +1,609 @@
+/**
+ *
+ * GSPCA sub driver for W996[78]CF JPEG USB Dual Mode Camera Chip.
+ *
+ * Copyright (C) 2009 Hans de Goede <hdegoede@redhat.com>
+ *
+ * This module is adapted from the in kernel v4l1 w9968cf driver:
+ *
+ * Copyright (C) 2002-2004 by Luca Risolia <luca.risolia@studio.unibo.it>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ *
+ */
+
+/* Note this is not a stand alone driver, it gets included in ov519.c, this
+   is a bit of a hack, but it needs the driver code for a lot of different
+   ov sensors which is already present in ov519.c (the old v4l1 driver used
+   the ovchipcam framework). When we have the time we really should move
+   the sensor drivers to v4l2 sub drivers, and properly split of this
+   driver from ov519.c */
+
+/* The CONEX_CAM define for jpeg.h needs renaming, now its used here too */
+#define CONEX_CAM
+#include "jpeg.h"
+
+#define W9968CF_I2C_BUS_DELAY    4 /* delay in us for I2C bit r/w operations */
+
+#define Y_QUANTABLE (sd->jpeg_hdr + JPEG_QT0_OFFSET)
+#define UV_QUANTABLE (sd->jpeg_hdr + JPEG_QT1_OFFSET)
+
+static const struct v4l2_pix_format w9968cf_vga_mode[] = {
+	{160, 120, V4L2_PIX_FMT_UYVY, V4L2_FIELD_NONE,
+		.bytesperline = 160 * 2,
+		.sizeimage = 160 * 120 * 2,
+		.colorspace = V4L2_COLORSPACE_JPEG},
+	{176, 144, V4L2_PIX_FMT_UYVY, V4L2_FIELD_NONE,
+		.bytesperline = 176 * 2,
+		.sizeimage = 176 * 144 * 2,
+		.colorspace = V4L2_COLORSPACE_JPEG},
+	{320, 240, V4L2_PIX_FMT_JPEG, V4L2_FIELD_NONE,
+		.bytesperline = 320 * 2,
+		.sizeimage = 320 * 240 * 2,
+		.colorspace = V4L2_COLORSPACE_JPEG},
+	{352, 288, V4L2_PIX_FMT_JPEG, V4L2_FIELD_NONE,
+		.bytesperline = 352 * 2,
+		.sizeimage = 352 * 288 * 2,
+		.colorspace = V4L2_COLORSPACE_JPEG},
+	{640, 480, V4L2_PIX_FMT_JPEG, V4L2_FIELD_NONE,
+		.bytesperline = 640 * 2,
+		.sizeimage = 640 * 480 * 2,
+		.colorspace = V4L2_COLORSPACE_JPEG},
+};
+
+static int reg_w(struct sd *sd, __u16 index, __u16 value);
+
+/*--------------------------------------------------------------------------
+  Write 64-bit data to the fast serial bus registers.
+  Return 0 on success, -1 otherwise.
+  --------------------------------------------------------------------------*/
+static int w9968cf_write_fsb(struct sd *sd, u16* data)
+{
+	struct usb_device* udev = sd->gspca_dev.dev;
+	u16 value;
+	int ret;
+
+	value = *data++;
+	memcpy(sd->gspca_dev.usb_buf, data, 6);
+
+	ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), 0,
+			      USB_TYPE_VENDOR | USB_DIR_OUT | USB_RECIP_DEVICE,
+			      value, 0x06, sd->gspca_dev.usb_buf, 6, 500);
+	if (ret < 0) {
+		PDEBUG(D_ERR, "Write FSB registers failed (%d)", ret);
+		return ret;
+	}
+
+	return 0;
+}
+
+/*--------------------------------------------------------------------------
+  Write data to the serial bus control register.
+  Return 0 on success, a negative number otherwise.
+  --------------------------------------------------------------------------*/
+static int w9968cf_write_sb(struct sd *sd, u16 value)
+{
+	int ret;
+
+	/* We don't use reg_w here, as that would cause all writes when
+	   bitbanging i2c to be logged, making the logs impossible to read */
+	ret = usb_control_msg(sd->gspca_dev.dev,
+		usb_sndctrlpipe(sd->gspca_dev.dev, 0),
+		0,
+		USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+		value, 0x01, NULL, 0, 500);
+
+	udelay(W9968CF_I2C_BUS_DELAY);
+
+	if (ret < 0) {
+		PDEBUG(D_ERR, "Write SB reg [01] %04x failed", value);
+		return ret;
+	}
+
+	return 0;
+}
+
+/*--------------------------------------------------------------------------
+  Read data from the serial bus control register.
+  Return 0 on success, a negative number otherwise.
+  --------------------------------------------------------------------------*/
+static int w9968cf_read_sb(struct sd *sd)
+{
+	int ret;
+
+	/* We don't use reg_r here, as the w9968cf is special and has 16
+	   bit registers instead of 8 bit */
+	ret = usb_control_msg(sd->gspca_dev.dev,
+			usb_rcvctrlpipe(sd->gspca_dev.dev, 0),
+			1,
+			USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+			0, 0x01, sd->gspca_dev.usb_buf, 2, 500);
+	if (ret >= 0)
+		ret = sd->gspca_dev.usb_buf[0] |
+		      (sd->gspca_dev.usb_buf[1] << 8);
+	else
+		PDEBUG(D_ERR, "Read SB reg [01] failed");
+
+	udelay(W9968CF_I2C_BUS_DELAY);
+
+	return ret;
+}
+
+/*--------------------------------------------------------------------------
+  Upload quantization tables for the JPEG compression.
+  This function is called by w9968cf_start_transfer().
+  Return 0 on success, a negative number otherwise.
+  --------------------------------------------------------------------------*/
+static int w9968cf_upload_quantizationtables(struct sd *sd)
+{
+	u16 a, b;
+	int ret = 0, i, j;
+
+	ret += reg_w(sd, 0x39, 0x0010); /* JPEG clock enable */
+
+	for (i = 0, j = 0; i < 32; i++, j += 2) {
+		a = Y_QUANTABLE[j] | ((unsigned)(Y_QUANTABLE[j+1]) << 8);
+		b = UV_QUANTABLE[j] | ((unsigned)(UV_QUANTABLE[j+1]) << 8);
+		ret += reg_w(sd, 0x40+i, a);
+		ret += reg_w(sd, 0x60+i, b);
+	}
+	ret += reg_w(sd, 0x39, 0x0012); /* JPEG encoder enable */
+
+	return ret;
+}
+
+/****************************************************************************
+ * Low-level I2C I/O functions.                                             *
+ * The adapter supports the following I2C transfer functions:               *
+ * i2c_adap_fastwrite_byte_data() (at 400 kHz bit frequency only)           *
+ * i2c_adap_read_byte_data()                                                *
+ * i2c_adap_read_byte()                                                     *
+ ****************************************************************************/
+
+static int w9968cf_smbus_start(struct sd *sd)
+{
+	int ret = 0;
+
+	ret += w9968cf_write_sb(sd, 0x0011); /* SDE=1, SDA=0, SCL=1 */
+	ret += w9968cf_write_sb(sd, 0x0010); /* SDE=1, SDA=0, SCL=0 */
+
+	return ret;
+}
+
+static int w9968cf_smbus_stop(struct sd *sd)
+{
+	int ret = 0;
+
+	ret += w9968cf_write_sb(sd, 0x0010); /* SDE=1, SDA=0, SCL=0 */
+	ret += w9968cf_write_sb(sd, 0x0011); /* SDE=1, SDA=0, SCL=1 */
+	ret += w9968cf_write_sb(sd, 0x0013); /* SDE=1, SDA=1, SCL=1 */
+
+	return ret;
+}
+
+static int w9968cf_smbus_write_byte(struct sd *sd, u8 v)
+{
+	u8 bit;
+	int ret = 0, sda;
+
+	for (bit = 0 ; bit < 8 ; bit++) {
+		sda = (v & 0x80) ? 2 : 0;
+		v <<= 1;
+		/* SDE=1, SDA=sda, SCL=0 */
+		ret += w9968cf_write_sb(sd, 0x10 | sda);
+		/* SDE=1, SDA=sda, SCL=1 */
+		ret += w9968cf_write_sb(sd, 0x11 | sda);
+		/* SDE=1, SDA=sda, SCL=0 */
+		ret += w9968cf_write_sb(sd, 0x10 | sda);
+	}
+
+	return ret;
+}
+
+static int w9968cf_smbus_read_byte(struct sd *sd, u8* v)
+{
+	u8 bit;
+	int ret = 0;
+
+	/* No need to ensure SDA is high as we are always called after
+	   read_ack which ends with SDA high */
+	*v = 0;
+	for (bit = 0 ; bit < 8 ; bit++) {
+		*v <<= 1;
+		/* SDE=1, SDA=1, SCL=1 */
+		ret += w9968cf_write_sb(sd, 0x0013);
+		*v |= (w9968cf_read_sb(sd) & 0x0008) ? 1 : 0;
+		/* SDE=1, SDA=1, SCL=0 */
+		ret += w9968cf_write_sb(sd, 0x0012);
+	}
+
+	return ret;
+}
+
+static int w9968cf_smbus_write_nack(struct sd *sd)
+{
+	int ret = 0;
+
+	/* No need to ensure SDA is high as we are always called after
+	   read_byte which ends with SDA high */
+	ret += w9968cf_write_sb(sd, 0x0013); /* SDE=1, SDA=1, SCL=1 */
+	ret += w9968cf_write_sb(sd, 0x0012); /* SDE=1, SDA=1, SCL=0 */
+
+	return ret;
+}
+
+static int w9968cf_smbus_read_ack(struct sd *sd)
+{
+	int ret = 0, sda;
+
+	/* Ensure SDA is high before raising clock to avoid a spurious stop */
+	ret += w9968cf_write_sb(sd, 0x0012); /* SDE=1, SDA=1, SCL=0 */
+	ret += w9968cf_write_sb(sd, 0x0013); /* SDE=1, SDA=1, SCL=1 */
+	sda = w9968cf_read_sb(sd);
+	ret += w9968cf_write_sb(sd, 0x0012); /* SDE=1, SDA=1, SCL=0 */
+	if (sda < 0)
+		ret += sda;
+	else if (sda & 0x08) {
+		PDEBUG(D_USBI, "Did not receive i2c ACK");
+		ret += -1;
+	}
+
+	return ret;
+}
+
+/* SMBus protocol: S Addr Wr [A] Subaddr [A] Value [A] P */
+static int w9968cf_i2c_w(struct sd *sd, u8 reg, u8 value)
+{
+	u16* data = (u16 *)sd->gspca_dev.usb_buf;
+	int ret = 0;
+
+	data[0] = 0x082f | ((sd->sensor_addr & 0x80) ? 0x1500 : 0x0);
+	data[0] |= (sd->sensor_addr & 0x40) ? 0x4000 : 0x0;
+	data[1] = 0x2082 | ((sd->sensor_addr & 0x40) ? 0x0005 : 0x0);
+	data[1] |= (sd->sensor_addr & 0x20) ? 0x0150 : 0x0;
+	data[1] |= (sd->sensor_addr & 0x10) ? 0x5400 : 0x0;
+	data[2] = 0x8208 | ((sd->sensor_addr & 0x08) ? 0x0015 : 0x0);
+	data[2] |= (sd->sensor_addr & 0x04) ? 0x0540 : 0x0;
+	data[2] |= (sd->sensor_addr & 0x02) ? 0x5000 : 0x0;
+	data[3] = 0x1d20 | ((sd->sensor_addr & 0x02) ? 0x0001 : 0x0);
+	data[3] |= (sd->sensor_addr & 0x01) ? 0x0054 : 0x0;
+
+	ret += w9968cf_write_fsb(sd, data);
+
+	data[0] = 0x8208 | ((reg & 0x80) ? 0x0015 : 0x0);
+	data[0] |= (reg & 0x40) ? 0x0540 : 0x0;
+	data[0] |= (reg & 0x20) ? 0x5000 : 0x0;
+	data[1] = 0x0820 | ((reg & 0x20) ? 0x0001 : 0x0);
+	data[1] |= (reg & 0x10) ? 0x0054 : 0x0;
+	data[1] |= (reg & 0x08) ? 0x1500 : 0x0;
+	data[1] |= (reg & 0x04) ? 0x4000 : 0x0;
+	data[2] = 0x2082 | ((reg & 0x04) ? 0x0005 : 0x0);
+	data[2] |= (reg & 0x02) ? 0x0150 : 0x0;
+	data[2] |= (reg & 0x01) ? 0x5400 : 0x0;
+	data[3] = 0x001d;
+
+	ret += w9968cf_write_fsb(sd, data);
+
+	data[0] = 0x8208 | ((value & 0x80) ? 0x0015 : 0x0);
+	data[0] |= (value & 0x40) ? 0x0540 : 0x0;
+	data[0] |= (value & 0x20) ? 0x5000 : 0x0;
+	data[1] = 0x0820 | ((value & 0x20) ? 0x0001 : 0x0);
+	data[1] |= (value & 0x10) ? 0x0054 : 0x0;
+	data[1] |= (value & 0x08) ? 0x1500 : 0x0;
+	data[1] |= (value & 0x04) ? 0x4000 : 0x0;
+	data[2] = 0x2082 | ((value & 0x04) ? 0x0005 : 0x0);
+	data[2] |= (value & 0x02) ? 0x0150 : 0x0;
+	data[2] |= (value & 0x01) ? 0x5400 : 0x0;
+	data[3] = 0xfe1d;
+
+	ret += w9968cf_write_fsb(sd, data);
+
+	if (!ret)
+		PDEBUG(D_USBO, "i2c 0x%02x -> [0x%02x]", value, reg);
+	else
+		PDEBUG(D_ERR, "i2c 0x%02x -> [0x%02x] failed", value, reg);
+
+	return ret;
+}
+
+/* SMBus protocol: S Addr Wr [A] Subaddr [A] P S Addr+1 Rd [A] [Value] NA P */
+static int w9968cf_i2c_r(struct sd *sd, u8 reg)
+{
+	int ret = 0;
+	u8 value;
+
+	/* Fast serial bus data control disable */
+	ret += w9968cf_write_sb(sd, 0x0013); /* don't change ! */
+
+	ret += w9968cf_smbus_start(sd);
+	ret += w9968cf_smbus_write_byte(sd, sd->sensor_addr);
+	ret += w9968cf_smbus_read_ack(sd);
+	ret += w9968cf_smbus_write_byte(sd, reg);
+	ret += w9968cf_smbus_read_ack(sd);
+	ret += w9968cf_smbus_stop(sd);
+	ret += w9968cf_smbus_start(sd);
+	ret += w9968cf_smbus_write_byte(sd, sd->sensor_addr + 1);
+	ret += w9968cf_smbus_read_ack(sd);
+	ret += w9968cf_smbus_read_byte(sd, &value);
+	/* signal we don't want to read anymore, the v4l1 driver used to
+	   send an ack here which is very wrong! (and then fixed
+	   the issues this gave by retrying reads) */
+	ret += w9968cf_smbus_write_nack(sd);
+	ret += w9968cf_smbus_stop(sd);
+
+	/* Fast serial bus data control re-enable */
+	ret += w9968cf_write_sb(sd, 0x0030);
+
+	if (!ret) {
+		ret = value;
+		PDEBUG(D_USBI, "i2c [0x%02X] -> 0x%02X", reg, value);
+	} else
+		PDEBUG(D_ERR, "i2c read [0x%02x] failed", reg);
+
+	return ret;
+}
+
+
+/*--------------------------------------------------------------------------
+  Turn on the LED on some webcams. A beep should be heard too.
+  Return 0 on success, a negative number otherwise.
+  --------------------------------------------------------------------------*/
+static int w9968cf_configure(struct sd *sd)
+{
+	int ret = 0;
+
+	ret += reg_w(sd, 0x00, 0xff00); /* power-down */
+	ret += reg_w(sd, 0x00, 0xbf17); /* reset everything */
+	ret += reg_w(sd, 0x00, 0xbf10); /* normal operation */
+	ret += reg_w(sd, 0x01, 0x0010); /* serial bus, SDS high */
+	ret += reg_w(sd, 0x01, 0x0000); /* serial bus, SDS low */
+	ret += reg_w(sd, 0x01, 0x0010); /* ..high 'beep-beep' */
+	ret += reg_w(sd, 0x01, 0x0030); /* Set sda scl to FSB mode */
+
+	if (ret)
+		PDEBUG(D_ERR, "Couldn't turn on the LED");
+
+	sd->stopped = 1;
+
+	return ret;
+}
+
+static int w9968cf_init(struct sd *sd)
+{
+	int ret = 0;
+	unsigned long hw_bufsize = sd->sif ? (352 * 288 * 2) : (640 * 480 * 2),
+		      y0 = 0x0000,
+		      u0 = y0 + hw_bufsize/2,
+		      v0 = u0 + hw_bufsize/4,
+		      y1 = v0 + hw_bufsize/4,
+		      u1 = y1 + hw_bufsize/2,
+		      v1 = u1 + hw_bufsize/4;
+
+	ret += reg_w(sd, 0x00, 0xff00); /* power off */
+	ret += reg_w(sd, 0x00, 0xbf10); /* power on */
+
+	ret += reg_w(sd, 0x03, 0x405d); /* DRAM timings */
+	ret += reg_w(sd, 0x04, 0x0030); /* SDRAM timings */
+
+	ret += reg_w(sd, 0x20, y0 & 0xffff); /* Y buf.0, low */
+	ret += reg_w(sd, 0x21, y0 >> 16);    /* Y buf.0, high */
+	ret += reg_w(sd, 0x24, u0 & 0xffff); /* U buf.0, low */
+	ret += reg_w(sd, 0x25, u0 >> 16);    /* U buf.0, high */
+	ret += reg_w(sd, 0x28, v0 & 0xffff); /* V buf.0, low */
+	ret += reg_w(sd, 0x29, v0 >> 16);    /* V buf.0, high */
+
+	ret += reg_w(sd, 0x22, y1 & 0xffff); /* Y buf.1, low */
+	ret += reg_w(sd, 0x23, y1 >> 16);    /* Y buf.1, high */
+	ret += reg_w(sd, 0x26, u1 & 0xffff); /* U buf.1, low */
+	ret += reg_w(sd, 0x27, u1 >> 16);    /* U buf.1, high */
+	ret += reg_w(sd, 0x2a, v1 & 0xffff); /* V buf.1, low */
+	ret += reg_w(sd, 0x2b, v1 >> 16);    /* V buf.1, high */
+
+	ret += reg_w(sd, 0x32, y1 & 0xffff); /* JPEG buf 0 low */
+	ret += reg_w(sd, 0x33, y1 >> 16);    /* JPEG buf 0 high */
+
+	ret += reg_w(sd, 0x34, y1 & 0xffff); /* JPEG buf 1 low */
+	ret += reg_w(sd, 0x35, y1 >> 16);    /* JPEG bug 1 high */
+
+	ret += reg_w(sd, 0x36, 0x0000);/* JPEG restart interval */
+	ret += reg_w(sd, 0x37, 0x0804);/*JPEG VLE FIFO threshold*/
+	ret += reg_w(sd, 0x38, 0x0000);/* disable hw up-scaling */
+	ret += reg_w(sd, 0x3f, 0x0000); /* JPEG/MCTL test data */
+
+	return ret;
+}
+
+static int w9968cf_set_crop_window(struct sd *sd)
+{
+	int ret = 0, start_cropx, start_cropy,  x, y, fw, fh, cw, ch,
+	    max_width, max_height;
+
+	if (sd->sif) {
+		max_width  = 352;
+		max_height = 288;
+	} else {
+		max_width  = 640;
+		max_height = 480;
+	}
+
+	if (sd->sensor == SEN_OV7620) {
+		/* Sigh, this is dependend on the clock / framerate changes
+		   made by the frequency control, sick. */
+		if (sd->freq == 1) {
+			start_cropx = 277;
+			start_cropy = 37;
+		} else {
+			start_cropx = 105;
+			start_cropy = 37;
+		}
+	} else {
+		start_cropx = 320;
+		start_cropy = 35;
+	}
+
+	/* Work around to avoid FP arithmetics */
+	#define SC(x) ((x) << 10)
+
+	/* Scaling factors */
+	fw = SC(sd->gspca_dev.width) / max_width;
+	fh = SC(sd->gspca_dev.height) / max_height;
+
+	cw = (fw >= fh) ? max_width : SC(sd->gspca_dev.width)/fh;
+	ch = (fw >= fh) ? SC(sd->gspca_dev.height)/fw : max_height;
+
+	sd->sensor_width = max_width;
+	sd->sensor_height = max_height;
+
+	x = (max_width - cw) / 2;
+	y = (max_height - ch) / 2;
+
+	ret += reg_w(sd, 0x10, start_cropx + x);
+	ret += reg_w(sd, 0x11, start_cropy + y);
+	ret += reg_w(sd, 0x12, start_cropx + x + cw);
+	ret += reg_w(sd, 0x13, start_cropy + y + ch);
+
+	return ret;
+}
+
+static int w9968cf_mode_init_regs(struct sd *sd)
+{
+	int ret = 0, val, vs_polarity, hs_polarity;
+
+	ret += w9968cf_set_crop_window(sd);
+
+	ret += reg_w(sd, 0x14, sd->gspca_dev.width);
+	ret += reg_w(sd, 0x15, sd->gspca_dev.height);
+
+	/* JPEG width & height */
+	ret += reg_w(sd, 0x30, sd->gspca_dev.width);
+	ret += reg_w(sd, 0x31, sd->gspca_dev.height);
+
+	/* Y & UV frame buffer strides (in WORD) */
+	if (w9968cf_vga_mode[sd->gspca_dev.curr_mode].pixelformat ==
+	    V4L2_PIX_FMT_JPEG) {
+		ret += reg_w(sd, 0x2c, sd->gspca_dev.width/2);
+		ret += reg_w(sd, 0x2d, sd->gspca_dev.width/4);
+	} else
+		ret += reg_w(sd, 0x2c, sd->gspca_dev.width);
+
+	ret += reg_w(sd, 0x00, 0xbf17); /* reset everything */
+	ret += reg_w(sd, 0x00, 0xbf10); /* normal operation */
+
+	/* Transfer size in WORDS (for UYVY format only) */
+	val = sd->gspca_dev.width * sd->gspca_dev.height;
+	ret += reg_w(sd, 0x3d, val & 0xffff); /* low bits */
+	ret += reg_w(sd, 0x3e, val >> 16);    /* high bits */
+
+	if (w9968cf_vga_mode[sd->gspca_dev.curr_mode].pixelformat ==
+	    V4L2_PIX_FMT_JPEG) {
+		/* We may get called multiple times (usb isoc bw negotiat.) */
+		if (!sd->jpeg_hdr)
+			sd->jpeg_hdr = kmalloc(JPEG_HDR_SZ, GFP_KERNEL);
+		if (!sd->jpeg_hdr)
+			return -ENOMEM;
+
+		jpeg_define(sd->jpeg_hdr, sd->gspca_dev.height,
+			    sd->gspca_dev.width, 0x22); /* JPEG 420 */
+		jpeg_set_qual(sd->jpeg_hdr, sd->quality);
+		ret += w9968cf_upload_quantizationtables(sd);
+	}
+
+	/* Video Capture Control Register */
+	if (sd->sensor == SEN_OV7620) {
+		/* Seems to work around a bug in the image sensor */
+		vs_polarity = 1;
+		hs_polarity = 1;
+	} else {
+		vs_polarity = 1;
+		hs_polarity = 0;
+	}
+
+	val = (vs_polarity << 12) | (hs_polarity << 11);
+
+	/* NOTE: We may not have enough memory to do double buffering while
+	   doing compression (amount of memory differs per model cam).
+	   So we use the second image buffer also as jpeg stream buffer
+	   (see w9968cf_init), and disable double buffering. */
+	if (w9968cf_vga_mode[sd->gspca_dev.curr_mode].pixelformat ==
+	    V4L2_PIX_FMT_JPEG) {
+		/* val |= 0x0002; YUV422P */
+		val |= 0x0003; /* YUV420P */
+	} else
+		val |= 0x0080; /* Enable HW double buffering */
+
+	/* val |= 0x0020; enable clamping */
+	/* val |= 0x0008; enable (1-2-1) filter */
+	/* val |= 0x000c; enable (2-3-6-3-2) filter */
+
+	val |= 0x8000; /* capt. enable */
+
+	ret += reg_w(sd, 0x16, val);
+
+	sd->gspca_dev.empty_packet = 0;
+
+	return ret;
+}
+
+static void w9968cf_stop0(struct sd *sd)
+{
+	if (sd->gspca_dev.present) {
+		reg_w(sd, 0x39, 0x0000); /* disable JPEG encoder */
+		reg_w(sd, 0x16, 0x0000); /* stop video capture */
+	}
+
+	kfree(sd->jpeg_hdr);
+	sd->jpeg_hdr = NULL;
+}
+
+/* The w9968cf docs say that a 0 sized packet means EOF (and also SOF
+   for the next frame). This seems to simply not be true when operating
+   in JPEG mode, in this case there may be empty packets within the
+   frame. So in JPEG mode use the JPEG SOI marker to detect SOF.
+
+   Note to make things even more interesting the w9968cf sends *PLANAR* jpeg,
+   to be precise it sends: SOI, SOF, DRI, SOS, Y-data, SOS, U-data, SOS,
+   V-data, EOI. */
+static void w9968cf_pkt_scan(struct gspca_dev *gspca_dev,
+			u8 *data,			/* isoc packet */
+			int len)			/* iso packet length */
+{
+	struct sd *sd = (struct sd *) gspca_dev;
+
+	if (w9968cf_vga_mode[gspca_dev->curr_mode].pixelformat ==
+	    V4L2_PIX_FMT_JPEG) {
+		if (len >= 2 &&
+		    data[0] == 0xff &&
+		    data[1] == 0xd8) {
+			gspca_frame_add(gspca_dev, LAST_PACKET,
+					NULL, 0);
+			gspca_frame_add(gspca_dev, FIRST_PACKET,
+					sd->jpeg_hdr, JPEG_HDR_SZ);
+			/* Strip the ff d8, our own header (which adds
+			   huffman and quantization tables) already has this */
+			len -= 2;
+			data += 2;
+		}
+	} else {
+		/* In UYVY mode an empty packet signals EOF */
+		if (gspca_dev->empty_packet) {
+			gspca_frame_add(gspca_dev, LAST_PACKET,
+						NULL, 0);
+			gspca_frame_add(gspca_dev, FIRST_PACKET,
+					NULL, 0);
+			gspca_dev->empty_packet = 0;
+		}
+	}
+	gspca_frame_add(gspca_dev, INTER_PACKET, data, len);
+}
diff --git a/drivers/media/video/gspca/zc3xx.c b/drivers/media/video/gspca/zc3xx.c
index cdf3357b4c9f..1a800fc1c00e 100644
--- a/drivers/media/video/gspca/zc3xx.c
+++ b/drivers/media/video/gspca/zc3xx.c
@@ -61,17 +61,18 @@ struct sd {
 #define SENSOR_HV7131C 6
 #define SENSOR_ICM105A 7
 #define SENSOR_MC501CB 8
-#define SENSOR_OV7620 9
-/*#define SENSOR_OV7648 9 - same values */
-#define SENSOR_OV7630C 10
-#define SENSOR_PAS106 11
-#define SENSOR_PAS202B 12
-#define SENSOR_PB0330 13
-#define SENSOR_PO2030 14
-#define SENSOR_TAS5130CK 15
-#define SENSOR_TAS5130CXX 16
-#define SENSOR_TAS5130C_VF0250 17
-#define SENSOR_MAX 18
+#define SENSOR_MI0360SOC 9
+#define SENSOR_OV7620 10
+/*#define SENSOR_OV7648 10 - same values */
+#define SENSOR_OV7630C 11
+#define SENSOR_PAS106 12
+#define SENSOR_PAS202B 13
+#define SENSOR_PB0330 14	/* (MI0360) */
+#define SENSOR_PO2030 15
+#define SENSOR_TAS5130CK 16
+#define SENSOR_TAS5130CXX 17
+#define SENSOR_TAS5130C_VF0250 18
+#define SENSOR_MAX 19
 	unsigned short chip_revision;
 
 	u8 *jpeg_hdr;
@@ -420,9 +421,7 @@ static const struct usb_action adcm2700_NoFliker[] = {
 	{0xaa, 0xfe, 0x0010},				/* 00,fe,10,aa */
 	{}
 };
-static const struct usb_action cs2102_Initial[] = {
-	{0xa1, 0x01, 0x0008},
-	{0xa1, 0x01, 0x0008},
+static const struct usb_action cs2102_Initial[] = {	/* 320x240 */
 	{0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL},
 	{0xa0, 0x10, ZC3XX_R002_CLOCKSELECT},
 	{0xa0, 0x00, ZC3XX_R010_CMOSSENSORSELECT},
@@ -471,88 +470,10 @@ static const struct usb_action cs2102_Initial[] = {
 	{0xa0, 0x08, ZC3XX_R301_EEPROMACCESS},
 	{0xa0, 0x68, ZC3XX_R18D_YTARGET},
 	{0xa0, 0x00, 0x01ad},
-	{0xa1, 0x01, 0x0002},
-	{0xa1, 0x01, 0x0008},
-	{0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},	/* 00 */
-	{0xa0, 0x08, ZC3XX_R1C6_SHARPNESS00},	/* sharpness+ */
-	{0xa1, 0x01, 0x01c8},
-	{0xa1, 0x01, 0x01c9},
-	{0xa1, 0x01, 0x01ca},
-	{0xa0, 0x0f, ZC3XX_R1CB_SHARPNESS05},	/* sharpness- */
-	{0xa0, 0x24, ZC3XX_R120_GAMMA00},	/* gamma 5 */
-	{0xa0, 0x44, ZC3XX_R121_GAMMA01},
-	{0xa0, 0x64, ZC3XX_R122_GAMMA02},
-	{0xa0, 0x84, ZC3XX_R123_GAMMA03},
-	{0xa0, 0x9d, ZC3XX_R124_GAMMA04},
-	{0xa0, 0xb2, ZC3XX_R125_GAMMA05},
-	{0xa0, 0xc4, ZC3XX_R126_GAMMA06},
-	{0xa0, 0xd3, ZC3XX_R127_GAMMA07},
-	{0xa0, 0xe0, ZC3XX_R128_GAMMA08},
-	{0xa0, 0xeb, ZC3XX_R129_GAMMA09},
-	{0xa0, 0xf4, ZC3XX_R12A_GAMMA0A},
-	{0xa0, 0xfb, ZC3XX_R12B_GAMMA0B},
-	{0xa0, 0xff, ZC3XX_R12C_GAMMA0C},
-	{0xa0, 0xff, ZC3XX_R12D_GAMMA0D},
-	{0xa0, 0xff, ZC3XX_R12E_GAMMA0E},
-	{0xa0, 0xff, ZC3XX_R12F_GAMMA0F},
-	{0xa0, 0x18, ZC3XX_R130_GAMMA10},
-	{0xa0, 0x20, ZC3XX_R131_GAMMA11},
-	{0xa0, 0x20, ZC3XX_R132_GAMMA12},
-	{0xa0, 0x1c, ZC3XX_R133_GAMMA13},
-	{0xa0, 0x16, ZC3XX_R134_GAMMA14},
-	{0xa0, 0x13, ZC3XX_R135_GAMMA15},
-	{0xa0, 0x10, ZC3XX_R136_GAMMA16},
-	{0xa0, 0x0e, ZC3XX_R137_GAMMA17},
-	{0xa0, 0x0b, ZC3XX_R138_GAMMA18},
-	{0xa0, 0x09, ZC3XX_R139_GAMMA19},
-	{0xa0, 0x07, ZC3XX_R13A_GAMMA1A},
-	{0xa0, 0x06, ZC3XX_R13B_GAMMA1B},
-	{0xa0, 0x00, ZC3XX_R13C_GAMMA1C},
-	{0xa0, 0x00, ZC3XX_R13D_GAMMA1D},
-	{0xa0, 0x00, ZC3XX_R13E_GAMMA1E},
-	{0xa0, 0x01, ZC3XX_R13F_GAMMA1F},
-	{0xa0, 0x58, ZC3XX_R10A_RGB00},	/* matrix */
-	{0xa0, 0xf4, ZC3XX_R10B_RGB01},
-	{0xa0, 0xf4, ZC3XX_R10C_RGB02},
-	{0xa0, 0xf4, ZC3XX_R10D_RGB10},
-	{0xa0, 0x58, ZC3XX_R10E_RGB11},
-	{0xa0, 0xf4, ZC3XX_R10F_RGB12},
-	{0xa0, 0xf4, ZC3XX_R110_RGB20},
-	{0xa0, 0xf4, ZC3XX_R111_RGB21},
-	{0xa0, 0x58, ZC3XX_R112_RGB22},
-	{0xa1, 0x01, 0x0180},
-	{0xa0, 0x00, ZC3XX_R180_AUTOCORRECTENABLE},
-	{0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
-	{0xaa, 0x23, 0x0001},
-	{0xaa, 0x24, 0x0055},
-	{0xaa, 0x25, 0x00cc},
-	{0xaa, 0x21, 0x003f},
-	{0xa0, 0x02, ZC3XX_R190_EXPOSURELIMITHIGH},
-	{0xa0, 0xab, ZC3XX_R191_EXPOSURELIMITMID},
-	{0xa0, 0x98, ZC3XX_R192_EXPOSURELIMITLOW},
-	{0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
-	{0xa0, 0x30, ZC3XX_R196_ANTIFLICKERMID},
-	{0xa0, 0xd4, ZC3XX_R197_ANTIFLICKERLOW},
-	{0xa0, 0x10, ZC3XX_R18C_AEFREEZE},
-	{0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE},
-	{0xa0, 0x10, ZC3XX_R1A9_DIGITALLIMITDIFF},
-	{0xa0, 0x24, ZC3XX_R1AA_DIGITALGAINSTEP},
-	{0xa0, 0x39, ZC3XX_R01D_HSYNC_0},
-	{0xa0, 0x70, ZC3XX_R01E_HSYNC_1},
-	{0xa0, 0xb0, ZC3XX_R01F_HSYNC_2},
-	{0xa0, 0xff, ZC3XX_R020_HSYNC_3},
-	{0xa0, 0x40, ZC3XX_R180_AUTOCORRECTENABLE},
-	{0xa1, 0x01, 0x0180},
-	{0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},
-	{0xa0, 0x40, ZC3XX_R116_RGAIN},
-	{0xa0, 0x40, ZC3XX_R117_GGAIN},
-	{0xa0, 0x40, ZC3XX_R118_BGAIN},
 	{}
 };
 
-static const struct usb_action cs2102_InitialScale[] = {
-	{0xa1, 0x01, 0x0008},
-	{0xa1, 0x01, 0x0008},
+static const struct usb_action cs2102_InitialScale[] = {	/* 640x480 */
 	{0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL},
 	{0xa0, 0x00, ZC3XX_R002_CLOCKSELECT},
 	{0xa0, 0x00, ZC3XX_R010_CMOSSENSORSELECT},
@@ -601,57 +522,75 @@ static const struct usb_action cs2102_InitialScale[] = {
 	{0xa0, 0x08, ZC3XX_R301_EEPROMACCESS},
 	{0xa0, 0x68, ZC3XX_R18D_YTARGET},
 	{0xa0, 0x00, 0x01ad},
-	{0xa1, 0x01, 0x0002},
-	{0xa1, 0x01, 0x0008},
-	{0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},	/* 00 */
-	{0xa0, 0x08, ZC3XX_R1C6_SHARPNESS00},	/* sharpness+ */
-	{0xa1, 0x01, 0x01c8},
-	{0xa1, 0x01, 0x01c9},
-	{0xa1, 0x01, 0x01ca},
-	{0xa0, 0x0f, ZC3XX_R1CB_SHARPNESS05},	/* sharpness- */
-	{0xa0, 0x24, ZC3XX_R120_GAMMA00},	/* gamma 5 */
-	{0xa0, 0x44, ZC3XX_R121_GAMMA01},
-	{0xa0, 0x64, ZC3XX_R122_GAMMA02},
-	{0xa0, 0x84, ZC3XX_R123_GAMMA03},
-	{0xa0, 0x9d, ZC3XX_R124_GAMMA04},
-	{0xa0, 0xb2, ZC3XX_R125_GAMMA05},
-	{0xa0, 0xc4, ZC3XX_R126_GAMMA06},
-	{0xa0, 0xd3, ZC3XX_R127_GAMMA07},
-	{0xa0, 0xe0, ZC3XX_R128_GAMMA08},
-	{0xa0, 0xeb, ZC3XX_R129_GAMMA09},
-	{0xa0, 0xf4, ZC3XX_R12A_GAMMA0A},
-	{0xa0, 0xfb, ZC3XX_R12B_GAMMA0B},
-	{0xa0, 0xff, ZC3XX_R12C_GAMMA0C},
-	{0xa0, 0xff, ZC3XX_R12D_GAMMA0D},
-	{0xa0, 0xff, ZC3XX_R12E_GAMMA0E},
-	{0xa0, 0xff, ZC3XX_R12F_GAMMA0F},
-	{0xa0, 0x18, ZC3XX_R130_GAMMA10},
-	{0xa0, 0x20, ZC3XX_R131_GAMMA11},
-	{0xa0, 0x20, ZC3XX_R132_GAMMA12},
-	{0xa0, 0x1c, ZC3XX_R133_GAMMA13},
-	{0xa0, 0x16, ZC3XX_R134_GAMMA14},
-	{0xa0, 0x13, ZC3XX_R135_GAMMA15},
-	{0xa0, 0x10, ZC3XX_R136_GAMMA16},
-	{0xa0, 0x0e, ZC3XX_R137_GAMMA17},
-	{0xa0, 0x0b, ZC3XX_R138_GAMMA18},
-	{0xa0, 0x09, ZC3XX_R139_GAMMA19},
-	{0xa0, 0x07, ZC3XX_R13A_GAMMA1A},
-	{0xa0, 0x06, ZC3XX_R13B_GAMMA1B},
-	{0xa0, 0x00, ZC3XX_R13C_GAMMA1C},
-	{0xa0, 0x00, ZC3XX_R13D_GAMMA1D},
-	{0xa0, 0x00, ZC3XX_R13E_GAMMA1E},
-	{0xa0, 0x01, ZC3XX_R13F_GAMMA1F},
-	{0xa0, 0x58, ZC3XX_R10A_RGB00},	/* matrix */
-	{0xa0, 0xf4, ZC3XX_R10B_RGB01},
-	{0xa0, 0xf4, ZC3XX_R10C_RGB02},
-	{0xa0, 0xf4, ZC3XX_R10D_RGB10},
-	{0xa0, 0x58, ZC3XX_R10E_RGB11},
-	{0xa0, 0xf4, ZC3XX_R10F_RGB12},
-	{0xa0, 0xf4, ZC3XX_R110_RGB20},
-	{0xa0, 0xf4, ZC3XX_R111_RGB21},
-	{0xa0, 0x58, ZC3XX_R112_RGB22},
-	{0xa1, 0x01, 0x0180},
-	{0xa0, 0x00, ZC3XX_R180_AUTOCORRECTENABLE},
+	{}
+};
+static const struct usb_action cs2102_50HZ[] = {
+	{0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
+	{0xaa, 0x23, 0x0001},
+	{0xaa, 0x24, 0x005f},
+	{0xaa, 0x25, 0x0090},
+	{0xaa, 0x21, 0x00dd},
+	{0xa0, 0x02, ZC3XX_R190_EXPOSURELIMITHIGH},
+	{0xa0, 0xbf, ZC3XX_R191_EXPOSURELIMITMID},
+	{0xa0, 0x20, ZC3XX_R192_EXPOSURELIMITLOW},
+	{0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
+	{0xa0, 0x3a, ZC3XX_R196_ANTIFLICKERMID},
+	{0xa0, 0x98, ZC3XX_R197_ANTIFLICKERLOW},
+	{0xa0, 0x10, ZC3XX_R18C_AEFREEZE},
+	{0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE},
+	{0xa0, 0x10, ZC3XX_R1A9_DIGITALLIMITDIFF},
+	{0xa0, 0x24, ZC3XX_R1AA_DIGITALGAINSTEP},
+	{0xa0, 0xdd, ZC3XX_R01D_HSYNC_0},
+	{0xa0, 0xe4, ZC3XX_R01E_HSYNC_1},
+	{0xa0, 0xf0, ZC3XX_R01F_HSYNC_2},
+	{0xa0, 0xff, ZC3XX_R020_HSYNC_3},
+	{}
+};
+static const struct usb_action cs2102_50HZScale[] = {
+	{0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
+	{0xaa, 0x23, 0x0000},
+	{0xaa, 0x24, 0x00af},
+	{0xaa, 0x25, 0x00c8},
+	{0xaa, 0x21, 0x0068},
+	{0xa0, 0x01, ZC3XX_R190_EXPOSURELIMITHIGH},
+	{0xa0, 0x5f, ZC3XX_R191_EXPOSURELIMITMID},
+	{0xa0, 0x90, ZC3XX_R192_EXPOSURELIMITLOW},
+	{0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
+	{0xa0, 0x1d, ZC3XX_R196_ANTIFLICKERMID},
+	{0xa0, 0x4c, ZC3XX_R197_ANTIFLICKERLOW},
+	{0xa0, 0x10, ZC3XX_R18C_AEFREEZE},
+	{0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE},
+	{0xa0, 0x10, ZC3XX_R1A9_DIGITALLIMITDIFF},
+	{0xa0, 0x24, ZC3XX_R1AA_DIGITALGAINSTEP},
+	{0xa0, 0x68, ZC3XX_R01D_HSYNC_0},
+	{0xa0, 0xe3, ZC3XX_R01E_HSYNC_1},
+	{0xa0, 0xf0, ZC3XX_R01F_HSYNC_2},
+	{0xa0, 0xff, ZC3XX_R020_HSYNC_3},
+	{}
+};
+static const struct usb_action cs2102_60HZ[] = {
+	{0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
+	{0xaa, 0x23, 0x0001},
+	{0xaa, 0x24, 0x0055},
+	{0xaa, 0x25, 0x00cc},
+	{0xaa, 0x21, 0x003f},
+	{0xa0, 0x02, ZC3XX_R190_EXPOSURELIMITHIGH},
+	{0xa0, 0xab, ZC3XX_R191_EXPOSURELIMITMID},
+	{0xa0, 0x98, ZC3XX_R192_EXPOSURELIMITLOW},
+	{0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
+	{0xa0, 0x30, ZC3XX_R196_ANTIFLICKERMID},
+	{0xa0, 0xd4, ZC3XX_R197_ANTIFLICKERLOW},
+	{0xa0, 0x10, ZC3XX_R18C_AEFREEZE},
+	{0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE},
+	{0xa0, 0x10, ZC3XX_R1A9_DIGITALLIMITDIFF},
+	{0xa0, 0x24, ZC3XX_R1AA_DIGITALGAINSTEP},
+	{0xa0, 0x39, ZC3XX_R01D_HSYNC_0},
+	{0xa0, 0x70, ZC3XX_R01E_HSYNC_1},
+	{0xa0, 0xb0, ZC3XX_R01F_HSYNC_2},
+	{0xa0, 0xff, ZC3XX_R020_HSYNC_3},
+	{}
+};
+static const struct usb_action cs2102_60HZScale[] = {
 	{0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
 	{0xaa, 0x23, 0x0000},
 	{0xaa, 0x24, 0x00aa},
@@ -671,162 +610,50 @@ static const struct usb_action cs2102_InitialScale[] = {
 	{0xa0, 0xa5, ZC3XX_R01E_HSYNC_1},
 	{0xa0, 0xf0, ZC3XX_R01F_HSYNC_2},
 	{0xa0, 0xff, ZC3XX_R020_HSYNC_3},
-	{0xa0, 0x40, ZC3XX_R180_AUTOCORRECTENABLE},
-	{0xa1, 0x01, 0x0180},
-	{0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},
-	{0xa0, 0x40, ZC3XX_R116_RGAIN},
-	{0xa0, 0x40, ZC3XX_R117_GGAIN},
-	{0xa0, 0x40, ZC3XX_R118_BGAIN},
-	{}
-};
-static const struct usb_action cs2102_50HZ[] = {
-	{0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS}, /* 00,19,00,cc */
-	{0xaa, 0x0f, 0x008c}, /* 00,0f,8c,aa */
-	{0xaa, 0x03, 0x0005}, /* 00,03,05,aa */
-	{0xaa, 0x04, 0x00ac}, /* 00,04,ac,aa */
-	{0xaa, 0x10, 0x0005}, /* 00,10,05,aa */
-	{0xaa, 0x11, 0x00ac}, /* 00,11,ac,aa */
-	{0xaa, 0x1b, 0x0000}, /* 00,1b,00,aa */
-	{0xaa, 0x1c, 0x0005}, /* 00,1c,05,aa */
-	{0xaa, 0x1d, 0x00ac}, /* 00,1d,ac,aa */
-	{0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH}, /* 01,90,00,cc */
-	{0xa0, 0x3f, ZC3XX_R191_EXPOSURELIMITMID}, /* 01,91,3f,cc */
-	{0xa0, 0xf0, ZC3XX_R192_EXPOSURELIMITLOW}, /* 01,92,f0,cc */
-	{0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH}, /* 01,95,00,cc */
-	{0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID}, /* 01,96,00,cc */
-	{0xa0, 0x42, ZC3XX_R197_ANTIFLICKERLOW}, /* 01,97,42,cc */
-	{0xa0, 0x10, ZC3XX_R18C_AEFREEZE}, /* 01,8c,10,cc */
-	{0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE}, /* 01,8f,20,cc */
-	{0xa0, 0x10, ZC3XX_R1A9_DIGITALLIMITDIFF}, /* 01,a9,10,cc */
-	{0xa0, 0x24, ZC3XX_R1AA_DIGITALGAINSTEP}, /* 01,aa,24,cc */
-	{0xa0, 0x8c, ZC3XX_R01D_HSYNC_0}, /* 00,1d,8c,cc */
-	{0xa0, 0xb0, ZC3XX_R01E_HSYNC_1}, /* 00,1e,b0,cc */
-	{0xa0, 0xd0, ZC3XX_R01F_HSYNC_2}, /* 00,1f,d0,cc */
-	{}
-};
-static const struct usb_action cs2102_50HZScale[] = {
-	{0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS}, /* 00,19,00,cc */
-	{0xaa, 0x0f, 0x0093}, /* 00,0f,93,aa */
-	{0xaa, 0x03, 0x0005}, /* 00,03,05,aa */
-	{0xaa, 0x04, 0x00a1}, /* 00,04,a1,aa */
-	{0xaa, 0x10, 0x0005}, /* 00,10,05,aa */
-	{0xaa, 0x11, 0x00a1}, /* 00,11,a1,aa */
-	{0xaa, 0x1b, 0x0000}, /* 00,1b,00,aa */
-	{0xaa, 0x1c, 0x0005}, /* 00,1c,05,aa */
-	{0xaa, 0x1d, 0x00a1}, /* 00,1d,a1,aa */
-	{0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH}, /* 01,90,00,cc */
-	{0xa0, 0x3f, ZC3XX_R191_EXPOSURELIMITMID}, /* 01,91,3f,cc */
-	{0xa0, 0xf7, ZC3XX_R192_EXPOSURELIMITLOW}, /* 01,92,f7,cc */
-	{0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH}, /* 01,95,00,cc */
-	{0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID}, /* 01,96,00,cc */
-	{0xa0, 0x83, ZC3XX_R197_ANTIFLICKERLOW}, /* 01,97,83,cc */
-	{0xa0, 0x10, ZC3XX_R18C_AEFREEZE}, /* 01,8c,10,cc */
-	{0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE}, /* 01,8f,20,cc */
-	{0xa0, 0x10, ZC3XX_R1A9_DIGITALLIMITDIFF}, /* 01,a9,10,cc */
-	{0xa0, 0x24, ZC3XX_R1AA_DIGITALGAINSTEP}, /* 01,aa,24,cc */
-	{0xa0, 0x93, ZC3XX_R01D_HSYNC_0}, /* 00,1d,93,cc */
-	{0xa0, 0xb0, ZC3XX_R01E_HSYNC_1}, /* 00,1e,b0,cc */
-	{0xa0, 0xd0, ZC3XX_R01F_HSYNC_2}, /* 00,1f,d0,cc */
-	{}
-};
-static const struct usb_action cs2102_60HZ[] = {
-	{0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS}, /* 00,19,00,cc */
-	{0xaa, 0x0f, 0x005d}, /* 00,0f,5d,aa */
-	{0xaa, 0x03, 0x0005}, /* 00,03,05,aa */
-	{0xaa, 0x04, 0x00aa}, /* 00,04,aa,aa */
-	{0xaa, 0x10, 0x0005}, /* 00,10,05,aa */
-	{0xaa, 0x11, 0x00aa}, /* 00,11,aa,aa */
-	{0xaa, 0x1b, 0x0000}, /* 00,1b,00,aa */
-	{0xaa, 0x1c, 0x0005}, /* 00,1c,05,aa */
-	{0xaa, 0x1d, 0x00aa}, /* 00,1d,aa,aa */
-	{0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH}, /* 01,90,00,cc */
-	{0xa0, 0x3f, ZC3XX_R191_EXPOSURELIMITMID}, /* 01,91,3f,cc */
-	{0xa0, 0xe4, ZC3XX_R192_EXPOSURELIMITLOW}, /* 01,92,e4,cc */
-	{0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH}, /* 01,95,00,cc */
-	{0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID}, /* 01,96,00,cc */
-	{0xa0, 0x3a, ZC3XX_R197_ANTIFLICKERLOW}, /* 01,97,3a,cc */
-	{0xa0, 0x10, ZC3XX_R18C_AEFREEZE}, /* 01,8c,10,cc */
-	{0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE}, /* 01,8f,20,cc */
-	{0xa0, 0x10, ZC3XX_R1A9_DIGITALLIMITDIFF}, /* 01,a9,10,cc */
-	{0xa0, 0x24, ZC3XX_R1AA_DIGITALGAINSTEP}, /* 01,aa,24,cc */
-	{0xa0, 0x5d, ZC3XX_R01D_HSYNC_0}, /* 00,1d,5d,cc */
-	{0xa0, 0x90, ZC3XX_R01E_HSYNC_1}, /* 00,1e,90,cc */
-	{0xa0, 0xd0, 0x00c8}, /* 00,c8,d0,cc */
-	{}
-};
-static const struct usb_action cs2102_60HZScale[] = {
-	{0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS}, /* 00,19,00,cc */
-	{0xaa, 0x0f, 0x00b7}, /* 00,0f,b7,aa */
-	{0xaa, 0x03, 0x0005}, /* 00,03,05,aa */
-	{0xaa, 0x04, 0x00be}, /* 00,04,be,aa */
-	{0xaa, 0x10, 0x0005}, /* 00,10,05,aa */
-	{0xaa, 0x11, 0x00be}, /* 00,11,be,aa */
-	{0xaa, 0x1b, 0x0000}, /* 00,1b,00,aa */
-	{0xaa, 0x1c, 0x0005}, /* 00,1c,05,aa */
-	{0xaa, 0x1d, 0x00be}, /* 00,1d,be,aa */
-	{0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH}, /* 01,90,00,cc */
-	{0xa0, 0x3f, ZC3XX_R191_EXPOSURELIMITMID}, /* 01,91,3f,cc */
-	{0xa0, 0xfc, ZC3XX_R192_EXPOSURELIMITLOW}, /* 01,92,fc,cc */
-	{0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH}, /* 01,95,00,cc */
-	{0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID}, /* 01,96,00,cc */
-	{0xa0, 0x69, ZC3XX_R197_ANTIFLICKERLOW}, /* 01,97,69,cc */
-	{0xa0, 0x10, ZC3XX_R18C_AEFREEZE}, /* 01,8c,10,cc */
-	{0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE}, /* 01,8f,20,cc */
-	{0xa0, 0x10, ZC3XX_R1A9_DIGITALLIMITDIFF}, /* 01,a9,10,cc */
-	{0xa0, 0x24, ZC3XX_R1AA_DIGITALGAINSTEP}, /* 01,aa,24,cc */
-	{0xa0, 0xb7, ZC3XX_R01D_HSYNC_0}, /* 00,1d,b7,cc */
-	{0xa0, 0xd0, ZC3XX_R01E_HSYNC_1}, /* 00,1e,d0,cc */
-	{0xa0, 0xe8, ZC3XX_R01F_HSYNC_2}, /* 00,1f,e8,cc */
 	{}
 };
 static const struct usb_action cs2102_NoFliker[] = {
-	{0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS}, /* 00,19,00,cc */
-	{0xaa, 0x0f, 0x0059}, /* 00,0f,59,aa */
-	{0xaa, 0x03, 0x0005}, /* 00,03,05,aa */
-	{0xaa, 0x04, 0x0080}, /* 00,04,80,aa */
-	{0xaa, 0x10, 0x0005}, /* 00,10,05,aa */
-	{0xaa, 0x11, 0x0080}, /* 00,11,80,aa */
-	{0xaa, 0x1b, 0x0000}, /* 00,1b,00,aa */
-	{0xaa, 0x1c, 0x0005}, /* 00,1c,05,aa */
-	{0xaa, 0x1d, 0x0080}, /* 00,1d,80,aa */
-	{0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH}, /* 01,90,00,cc */
-	{0xa0, 0x3f, ZC3XX_R191_EXPOSURELIMITMID}, /* 01,91,3f,cc */
-	{0xa0, 0xf0, ZC3XX_R192_EXPOSURELIMITLOW}, /* 01,92,f0,cc */
-	{0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH}, /* 01,95,00,cc */
-	{0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID}, /* 01,96,00,cc */
-	{0xa0, 0x10, ZC3XX_R197_ANTIFLICKERLOW}, /* 01,97,10,cc */
-	{0xa0, 0x10, ZC3XX_R18C_AEFREEZE}, /* 01,8c,10,cc */
-	{0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE}, /* 01,8f,20,cc */
-	{0xa0, 0x00, ZC3XX_R1A9_DIGITALLIMITDIFF}, /* 01,a9,00,cc */
-	{0xa0, 0x00, ZC3XX_R1AA_DIGITALGAINSTEP}, /* 01,aa,00,cc */
-	{0xa0, 0x59, ZC3XX_R01D_HSYNC_0}, /* 00,1d,59,cc */
-	{0xa0, 0x90, ZC3XX_R01E_HSYNC_1}, /* 00,1e,90,cc */
-	{0xa0, 0xc8, ZC3XX_R01F_HSYNC_2}, /* 00,1f,c8,cc */
+	{0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
+	{0xaa, 0x23, 0x0001},
+	{0xaa, 0x24, 0x005f},
+	{0xaa, 0x25, 0x0000},
+	{0xaa, 0x21, 0x0001},
+	{0xa0, 0x02, ZC3XX_R190_EXPOSURELIMITHIGH},
+	{0xa0, 0xbf, ZC3XX_R191_EXPOSURELIMITMID},
+	{0xa0, 0x00, ZC3XX_R192_EXPOSURELIMITLOW},
+	{0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
+	{0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
+	{0xa0, 0x80, ZC3XX_R197_ANTIFLICKERLOW},
+	{0xa0, 0x10, ZC3XX_R18C_AEFREEZE},
+	{0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE},
+	{0xa0, 0x00, ZC3XX_R1A9_DIGITALLIMITDIFF},
+	{0xa0, 0x00, ZC3XX_R1AA_DIGITALGAINSTEP},
+	{0xa0, 0x01, ZC3XX_R01D_HSYNC_0},
+	{0xa0, 0x40, ZC3XX_R01E_HSYNC_1},
+	{0xa0, 0xa0, ZC3XX_R01F_HSYNC_2},
+	{0xa0, 0xff, ZC3XX_R020_HSYNC_3},
 	{}
 };
 static const struct usb_action cs2102_NoFlikerScale[] = {
-	{0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS}, /* 00,19,00,cc */
-	{0xaa, 0x0f, 0x0059}, /* 00,0f,59,aa */
-	{0xaa, 0x03, 0x0005}, /* 00,03,05,aa */
-	{0xaa, 0x04, 0x0080}, /* 00,04,80,aa */
-	{0xaa, 0x10, 0x0005}, /* 00,10,05,aa */
-	{0xaa, 0x11, 0x0080}, /* 00,11,80,aa */
-	{0xaa, 0x1b, 0x0000}, /* 00,1b,00,aa */
-	{0xaa, 0x1c, 0x0005}, /* 00,1c,05,aa */
-	{0xaa, 0x1d, 0x0080}, /* 00,1d,80,aa */
-	{0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH}, /* 01,90,00,cc */
-	{0xa0, 0x3f, ZC3XX_R191_EXPOSURELIMITMID}, /* 01,91,3f,cc */
-	{0xa0, 0xf0, ZC3XX_R192_EXPOSURELIMITLOW}, /* 01,92,f0,cc */
-	{0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH}, /* 01,95,00,cc */
-	{0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID}, /* 01,96,00,cc */
-	{0xa0, 0x10, ZC3XX_R197_ANTIFLICKERLOW}, /* 01,97,10,cc */
-	{0xa0, 0x10, ZC3XX_R18C_AEFREEZE}, /* 01,8c,10,cc */
-	{0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE}, /* 01,8f,20,cc */
-	{0xa0, 0x00, ZC3XX_R1A9_DIGITALLIMITDIFF}, /* 01,a9,00,cc */
-	{0xa0, 0x00, ZC3XX_R1AA_DIGITALGAINSTEP}, /* 01,aa,00,cc */
-	{0xa0, 0x59, ZC3XX_R01D_HSYNC_0}, /* 00,1d,59,cc */
-	{0xa0, 0x90, ZC3XX_R01E_HSYNC_1}, /* 00,1e,90,cc */
-	{0xa0, 0xc8, ZC3XX_R01F_HSYNC_2}, /* 00,1f,c8,cc */
+	{0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
+	{0xaa, 0x23, 0x0000},
+	{0xaa, 0x24, 0x00af},
+	{0xaa, 0x25, 0x0080},
+	{0xaa, 0x21, 0x0001},
+	{0xa0, 0x01, ZC3XX_R190_EXPOSURELIMITHIGH},
+	{0xa0, 0x5f, ZC3XX_R191_EXPOSURELIMITMID},
+	{0xa0, 0x80, ZC3XX_R192_EXPOSURELIMITLOW},
+	{0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
+	{0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
+	{0xa0, 0x80, ZC3XX_R197_ANTIFLICKERLOW},
+	{0xa0, 0x10, ZC3XX_R18C_AEFREEZE},
+	{0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE},
+	{0xa0, 0x00, ZC3XX_R1A9_DIGITALLIMITDIFF},
+	{0xa0, 0x00, ZC3XX_R1AA_DIGITALGAINSTEP},
+	{0xa0, 0x01, ZC3XX_R01D_HSYNC_0},
+	{0xa0, 0x40, ZC3XX_R01E_HSYNC_1},
+	{0xa0, 0xa0, ZC3XX_R01F_HSYNC_2},
+	{0xa0, 0xff, ZC3XX_R020_HSYNC_3},
 	{}
 };
 
@@ -4409,170 +4236,80 @@ static const struct usb_action pas202b_NoFlikerScale[] = {
 	{}
 };
 
-static const struct usb_action pb03303x_Initial[] = {
+/* mi0360soc and pb0330 from vm30x.inf for 0ac8:301b and 0ac8:303b 07/02/13 */
+static const struct usb_action mi0360soc_Initial[] = {	/* 640x480 */
 	{0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL},
 	{0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},
 	{0xa0, 0x0a, ZC3XX_R010_CMOSSENSORSELECT},
-	{0xa0, 0x10, ZC3XX_R002_CLOCKSELECT},
+	{0xa0, 0x00, ZC3XX_R002_CLOCKSELECT},
 	{0xa0, 0x02, ZC3XX_R003_FRAMEWIDTHHIGH},
 	{0xa0, 0x80, ZC3XX_R004_FRAMEWIDTHLOW},
 	{0xa0, 0x01, ZC3XX_R005_FRAMEHEIGHTHIGH},
 	{0xa0, 0xe0, ZC3XX_R006_FRAMEHEIGHTLOW},
-	{0xa0, 0xdc, ZC3XX_R08B_I2CDEVICEADDR},	/* 8b -> dc */
+	{0xa0, 0xdc, ZC3XX_R08B_I2CDEVICEADDR},
 	{0xa0, 0x01, ZC3XX_R001_SYSTEMOPERATING},
-	{0xa0, 0x03, ZC3XX_R012_VIDEOCONTROLFUNC},
-	{0xa0, 0x01, ZC3XX_R012_VIDEOCONTROLFUNC},
+	{0xa0, 0x07, ZC3XX_R012_VIDEOCONTROLFUNC},	/*jfm: was 03*/
+/*	{0xa0, 0x01, ZC3XX_R012_VIDEOCONTROLFUNC}, */
 	{0xa0, 0x00, ZC3XX_R098_WINYSTARTLOW},
 	{0xa0, 0x00, ZC3XX_R09A_WINXSTARTLOW},
 	{0xa0, 0x00, ZC3XX_R11A_FIRSTYLOW},
 	{0xa0, 0x00, ZC3XX_R11C_FIRSTXLOW},
 	{0xa0, 0xdc, ZC3XX_R08B_I2CDEVICEADDR},
+	{0xdd, 0x00, 0x0200},
 	{0xaa, 0x01, 0x0001},
 	{0xaa, 0x06, 0x0000},
 	{0xaa, 0x08, 0x0483},
 	{0xaa, 0x01, 0x0004},
 	{0xaa, 0x08, 0x0006},
 	{0xaa, 0x02, 0x0011},
-	{0xaa, 0x03, 0x01e7},
-	{0xaa, 0x04, 0x0287},
+	{0xaa, 0x03, 0x01e5},			/*jfm: was 01e7*/
+	{0xaa, 0x04, 0x0285},			/*jfm: was 0287*/
 	{0xaa, 0x07, 0x3002},
-	{0xaa, 0x20, 0x1100},
-	{0xaa, 0x35, 0x0050},
+	{0xaa, 0x20, 0x5100},			/*jfm: was 1100*/
+	{0xaa, 0x35, 0x507f},			/*jfm: was 0050*/
 	{0xaa, 0x30, 0x0005},
 	{0xaa, 0x31, 0x0000},
 	{0xaa, 0x58, 0x0078},
 	{0xaa, 0x62, 0x0411},
 	{0xaa, 0x2b, 0x0028},
-	{0xaa, 0x2c, 0x0030},
-	{0xaa, 0x2d, 0x0030},
-	{0xaa, 0x2e, 0x0028},
+	{0xaa, 0x2c, 0x007f},			/*jfm: was 0030*/
+	{0xaa, 0x2d, 0x007f},			/*jfm: was 0030*/
+	{0xaa, 0x2e, 0x007f},			/*jfm: was 0030*/
 	{0xa0, 0x10, ZC3XX_R087_EXPTIMEMID},
-	{0xa0, 0x37, ZC3XX_R101_SENSORCORRECTION},
+	{0xa0, 0xb7, ZC3XX_R101_SENSORCORRECTION}, /*jfm: was 37*/
 	{0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC},
 	{0xa0, 0x0d, ZC3XX_R100_OPERATIONMODE},
 	{0xa0, 0x06, ZC3XX_R189_AWBSTATUS},
-	{0xa0, 0x00, 0x01ad},
+	{0xa0, 0x09, 0x01ad},			/*jfm: was 00*/
 	{0xa0, 0x03, ZC3XX_R1C5_SHARPNESSMODE},
 	{0xa0, 0x13, ZC3XX_R1CB_SHARPNESS05},
 	{0xa0, 0x08, ZC3XX_R250_DEADPIXELSMODE},
 	{0xa0, 0x08, ZC3XX_R301_EEPROMACCESS},
 	{0xa0, 0x60, ZC3XX_R1A8_DIGITALGAIN},
-	{0xa0, 0x78, ZC3XX_R18D_YTARGET},
+	{0xa0, 0x6c, ZC3XX_R18D_YTARGET},	/* jfm: was 78 */
 	{0xa0, 0x61, ZC3XX_R116_RGAIN},
 	{0xa0, 0x65, ZC3XX_R118_BGAIN},
-
-	{0xa1, 0x01, 0x0002},
-	{0xa0, 0x09, 0x01ad},
-	{0xa0, 0x15, 0x01ae},
-	{0xa0, 0x0d, 0x003a},
-	{0xa0, 0x02, 0x003b},
-	{0xa0, 0x00, 0x0038},
-	{0xa0, 0x50, ZC3XX_R10A_RGB00},	/* matrix */
-	{0xa0, 0xf8, ZC3XX_R10B_RGB01},
-	{0xa0, 0xf8, ZC3XX_R10C_RGB02},
-	{0xa0, 0xf8, ZC3XX_R10D_RGB10},
-	{0xa0, 0x50, ZC3XX_R10E_RGB11},
-	{0xa0, 0xf8, ZC3XX_R10F_RGB12},
-	{0xa0, 0xf8, ZC3XX_R110_RGB20},
-	{0xa0, 0xf8, ZC3XX_R111_RGB21},
-	{0xa0, 0x50, ZC3XX_R112_RGB22},
-
-	{0xa1, 0x01, 0x0008},
-	{0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},
-	{0xa0, 0x08, ZC3XX_R1C6_SHARPNESS00},
-	{0xa1, 0x01, 0x01c8},
-	{0xa1, 0x01, 0x01c9},
-	{0xa1, 0x01, 0x01ca},
-	{0xa0, 0x0f, ZC3XX_R1CB_SHARPNESS05},	/* sharpness- */
-	{0xa0, 0x13, ZC3XX_R120_GAMMA00},	/* gamma 4 */
-	{0xa0, 0x38, ZC3XX_R121_GAMMA01},
-	{0xa0, 0x59, ZC3XX_R122_GAMMA02},
-	{0xa0, 0x79, ZC3XX_R123_GAMMA03},
-	{0xa0, 0x92, ZC3XX_R124_GAMMA04},
-	{0xa0, 0xa7, ZC3XX_R125_GAMMA05},
-	{0xa0, 0xb9, ZC3XX_R126_GAMMA06},
-	{0xa0, 0xc8, ZC3XX_R127_GAMMA07},
-	{0xa0, 0xd4, ZC3XX_R128_GAMMA08},
-	{0xa0, 0xdf, ZC3XX_R129_GAMMA09},
-	{0xa0, 0xe7, ZC3XX_R12A_GAMMA0A},
-	{0xa0, 0xee, ZC3XX_R12B_GAMMA0B},
-	{0xa0, 0xf4, ZC3XX_R12C_GAMMA0C},
-	{0xa0, 0xf9, ZC3XX_R12D_GAMMA0D},
-	{0xa0, 0xfc, ZC3XX_R12E_GAMMA0E},
-	{0xa0, 0xff, ZC3XX_R12F_GAMMA0F},
-	{0xa0, 0x26, ZC3XX_R130_GAMMA10},
-	{0xa0, 0x22, ZC3XX_R131_GAMMA11},
-	{0xa0, 0x20, ZC3XX_R132_GAMMA12},
-	{0xa0, 0x1c, ZC3XX_R133_GAMMA13},
-	{0xa0, 0x16, ZC3XX_R134_GAMMA14},
-	{0xa0, 0x13, ZC3XX_R135_GAMMA15},
-	{0xa0, 0x10, ZC3XX_R136_GAMMA16},
-	{0xa0, 0x0d, ZC3XX_R137_GAMMA17},
-	{0xa0, 0x0b, ZC3XX_R138_GAMMA18},
-	{0xa0, 0x09, ZC3XX_R139_GAMMA19},
-	{0xa0, 0x07, ZC3XX_R13A_GAMMA1A},
-	{0xa0, 0x06, ZC3XX_R13B_GAMMA1B},
-	{0xa0, 0x05, ZC3XX_R13C_GAMMA1C},
-	{0xa0, 0x04, ZC3XX_R13D_GAMMA1D},
-	{0xa0, 0x03, ZC3XX_R13E_GAMMA1E},
-	{0xa0, 0x02, ZC3XX_R13F_GAMMA1F},
-	{0xa0, 0x50, ZC3XX_R10A_RGB00},	/* matrix */
-	{0xa0, 0xf8, ZC3XX_R10B_RGB01},
-	{0xa0, 0xf8, ZC3XX_R10C_RGB02},
-	{0xa0, 0xf8, ZC3XX_R10D_RGB10},
-	{0xa0, 0x50, ZC3XX_R10E_RGB11},
-	{0xa0, 0xf8, ZC3XX_R10F_RGB12},
-	{0xa0, 0xf8, ZC3XX_R110_RGB20},
-	{0xa0, 0xf8, ZC3XX_R111_RGB21},
-	{0xa0, 0x50, ZC3XX_R112_RGB22},
-
-	{0xa1, 0x01, 0x0180},
-	{0xa0, 0x00, ZC3XX_R180_AUTOCORRECTENABLE},
-	{0xa0, 0x00, ZC3XX_R180_AUTOCORRECTENABLE},
-	{0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
-	{0xaa, 0x05, 0x0009},
-	{0xaa, 0x09, 0x0134},
-	{0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},
-	{0xa0, 0x07, ZC3XX_R191_EXPOSURELIMITMID},
-	{0xa0, 0xec, ZC3XX_R192_EXPOSURELIMITLOW},
-	{0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
-	{0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
-	{0xa0, 0x9c, ZC3XX_R197_ANTIFLICKERLOW},
-	{0xa0, 0x0e, ZC3XX_R18C_AEFREEZE},
-	{0xa0, 0x1c, ZC3XX_R18F_AEUNFREEZE},
-	{0xa0, 0x14, ZC3XX_R1A9_DIGITALLIMITDIFF},
-	{0xa0, 0x24, ZC3XX_R1AA_DIGITALGAINSTEP},
-	{0xa0, 0xd7, ZC3XX_R01D_HSYNC_0},
-	{0xa0, 0xf4, ZC3XX_R01E_HSYNC_1},
-	{0xa0, 0xf9, ZC3XX_R01F_HSYNC_2},
-	{0xa0, 0xff, ZC3XX_R020_HSYNC_3},
-	{0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},
-	{0xa0, 0x09, 0x01ad},
-	{0xa0, 0x15, 0x01ae},
-	{0xa0, 0x40, ZC3XX_R180_AUTOCORRECTENABLE},
-	{0xa1, 0x01, 0x0180},
-	{0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},
 	{}
 };
-
-static const struct usb_action pb03303x_InitialScale[] = {
+static const struct usb_action mi0360soc_InitialScale[] = {	/* 320x240 */
 	{0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL},
 	{0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},
 	{0xa0, 0x0a, ZC3XX_R010_CMOSSENSORSELECT},
-	{0xa0, 0x00, ZC3XX_R002_CLOCKSELECT},
+	{0xa0, 0x10, ZC3XX_R002_CLOCKSELECT},
 	{0xa0, 0x02, ZC3XX_R003_FRAMEWIDTHHIGH},
 	{0xa0, 0x80, ZC3XX_R004_FRAMEWIDTHLOW},
 	{0xa0, 0x01, ZC3XX_R005_FRAMEHEIGHTHIGH},
 	{0xa0, 0xe0, ZC3XX_R006_FRAMEHEIGHTLOW},
-	{0xa0, 0xdc, ZC3XX_R08B_I2CDEVICEADDR},	/* 8b -> dc */
+	{0xa0, 0xdc, ZC3XX_R08B_I2CDEVICEADDR},
 	{0xa0, 0x01, ZC3XX_R001_SYSTEMOPERATING},
-	{0xa0, 0x03, ZC3XX_R012_VIDEOCONTROLFUNC},
-	{0xa0, 0x01, ZC3XX_R012_VIDEOCONTROLFUNC},
+	{0xa0, 0x07, ZC3XX_R012_VIDEOCONTROLFUNC},	/*jfm: was 03*/
+/*	{0xa0, 0x01, ZC3XX_R012_VIDEOCONTROLFUNC}, */
 	{0xa0, 0x00, ZC3XX_R098_WINYSTARTLOW},
 	{0xa0, 0x00, ZC3XX_R09A_WINXSTARTLOW},
 	{0xa0, 0x00, ZC3XX_R11A_FIRSTYLOW},
 	{0xa0, 0x00, ZC3XX_R11C_FIRSTXLOW},
 	{0xa0, 0xdc, ZC3XX_R08B_I2CDEVICEADDR},
+	{0xdd, 0x00, 0x0200},
 	{0xaa, 0x01, 0x0001},
 	{0xaa, 0x06, 0x0000},
 	{0xaa, 0x08, 0x0483},
@@ -4582,111 +4319,111 @@ static const struct usb_action pb03303x_InitialScale[] = {
 	{0xaa, 0x03, 0x01e7},
 	{0xaa, 0x04, 0x0287},
 	{0xaa, 0x07, 0x3002},
-	{0xaa, 0x20, 0x1100},
-	{0xaa, 0x35, 0x0050},
+	{0xaa, 0x20, 0x5100},			/*jfm: was 1100*/
+	{0xaa, 0x35, 0x007f},			/*jfm: was 0050*/
 	{0xaa, 0x30, 0x0005},
 	{0xaa, 0x31, 0x0000},
 	{0xaa, 0x58, 0x0078},
 	{0xaa, 0x62, 0x0411},
-	{0xaa, 0x2b, 0x0028},
-	{0xaa, 0x2c, 0x0030},
-	{0xaa, 0x2d, 0x0030},
-	{0xaa, 0x2e, 0x0028},
+	{0xaa, 0x2b, 0x007f},			/*jfm: was 28*/
+	{0xaa, 0x2c, 0x007f},			/*jfm: was 30*/
+	{0xaa, 0x2d, 0x007f},			/*jfm: was 30*/
+	{0xaa, 0x2e, 0x007f},			/*jfm: was 28*/
 	{0xa0, 0x10, ZC3XX_R087_EXPTIMEMID},
-	{0xa0, 0x37, ZC3XX_R101_SENSORCORRECTION},
+	{0xa0, 0xb7, ZC3XX_R101_SENSORCORRECTION},	/*jfm: was 37*/
 	{0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC},
 	{0xa0, 0x0d, ZC3XX_R100_OPERATIONMODE},
 	{0xa0, 0x06, ZC3XX_R189_AWBSTATUS},
-	{0xa0, 0x00, 0x01ad},
+	{0xa0, 0x09, 0x01ad},			/*jfm: was 00*/
 	{0xa0, 0x03, ZC3XX_R1C5_SHARPNESSMODE},
 	{0xa0, 0x13, ZC3XX_R1CB_SHARPNESS05},
 	{0xa0, 0x08, ZC3XX_R250_DEADPIXELSMODE},
 	{0xa0, 0x08, ZC3XX_R301_EEPROMACCESS},
 	{0xa0, 0x60, ZC3XX_R1A8_DIGITALGAIN},
-	{0xa0, 0x78, ZC3XX_R18D_YTARGET},
+	{0xa0, 0x6c, ZC3XX_R18D_YTARGET},	/*jfm: was 78*/
 	{0xa0, 0x61, ZC3XX_R116_RGAIN},
 	{0xa0, 0x65, ZC3XX_R118_BGAIN},
-
-	{0xa1, 0x01, 0x0002},
-
-	{0xa0, 0x09, 0x01ad},
-	{0xa0, 0x15, 0x01ae},
-
-	{0xa0, 0x0d, 0x003a},
-	{0xa0, 0x02, 0x003b},
-	{0xa0, 0x00, 0x0038},
-	{0xa0, 0x50, ZC3XX_R10A_RGB00},	/* matrix */
-	{0xa0, 0xf8, ZC3XX_R10B_RGB01},
-	{0xa0, 0xf8, ZC3XX_R10C_RGB02},
-	{0xa0, 0xf8, ZC3XX_R10D_RGB10},
-	{0xa0, 0x50, ZC3XX_R10E_RGB11},
-	{0xa0, 0xf8, ZC3XX_R10F_RGB12},
-	{0xa0, 0xf8, ZC3XX_R110_RGB20},
-	{0xa0, 0xf8, ZC3XX_R111_RGB21},
-	{0xa0, 0x50, ZC3XX_R112_RGB22},
-
-	{0xa1, 0x01, 0x0008},
-	{0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},	/* clock ? */
-	{0xa0, 0x08, ZC3XX_R1C6_SHARPNESS00},	/* sharpness+ */
-	{0xa1, 0x01, 0x01c8},
-	{0xa1, 0x01, 0x01c9},
-	{0xa1, 0x01, 0x01ca},
-	{0xa0, 0x0f, ZC3XX_R1CB_SHARPNESS05},	/* sharpness- */
-
-	{0xa0, 0x13, ZC3XX_R120_GAMMA00},	/* gamma 4 */
-	{0xa0, 0x38, ZC3XX_R121_GAMMA01},
-	{0xa0, 0x59, ZC3XX_R122_GAMMA02},
-	{0xa0, 0x79, ZC3XX_R123_GAMMA03},
-	{0xa0, 0x92, ZC3XX_R124_GAMMA04},
-	{0xa0, 0xa7, ZC3XX_R125_GAMMA05},
-	{0xa0, 0xb9, ZC3XX_R126_GAMMA06},
-	{0xa0, 0xc8, ZC3XX_R127_GAMMA07},
-	{0xa0, 0xd4, ZC3XX_R128_GAMMA08},
-	{0xa0, 0xdf, ZC3XX_R129_GAMMA09},
-	{0xa0, 0xe7, ZC3XX_R12A_GAMMA0A},
-	{0xa0, 0xee, ZC3XX_R12B_GAMMA0B},
-	{0xa0, 0xf4, ZC3XX_R12C_GAMMA0C},
-	{0xa0, 0xf9, ZC3XX_R12D_GAMMA0D},
-	{0xa0, 0xfc, ZC3XX_R12E_GAMMA0E},
-	{0xa0, 0xff, ZC3XX_R12F_GAMMA0F},
-	{0xa0, 0x26, ZC3XX_R130_GAMMA10},
-	{0xa0, 0x22, ZC3XX_R131_GAMMA11},
-	{0xa0, 0x20, ZC3XX_R132_GAMMA12},
-	{0xa0, 0x1c, ZC3XX_R133_GAMMA13},
-	{0xa0, 0x16, ZC3XX_R134_GAMMA14},
-	{0xa0, 0x13, ZC3XX_R135_GAMMA15},
-	{0xa0, 0x10, ZC3XX_R136_GAMMA16},
-	{0xa0, 0x0d, ZC3XX_R137_GAMMA17},
-	{0xa0, 0x0b, ZC3XX_R138_GAMMA18},
-	{0xa0, 0x09, ZC3XX_R139_GAMMA19},
-	{0xa0, 0x07, ZC3XX_R13A_GAMMA1A},
-	{0xa0, 0x06, ZC3XX_R13B_GAMMA1B},
-	{0xa0, 0x05, ZC3XX_R13C_GAMMA1C},
-	{0xa0, 0x04, ZC3XX_R13D_GAMMA1D},
-	{0xa0, 0x03, ZC3XX_R13E_GAMMA1E},
-	{0xa0, 0x02, ZC3XX_R13F_GAMMA1F},
-	{0xa0, 0x50, ZC3XX_R10A_RGB00},	/* matrix */
-	{0xa0, 0xf8, ZC3XX_R10B_RGB01},
-	{0xa0, 0xf8, ZC3XX_R10C_RGB02},
-	{0xa0, 0xf8, ZC3XX_R10D_RGB10},
-	{0xa0, 0x50, ZC3XX_R10E_RGB11},
-	{0xa0, 0xf8, ZC3XX_R10F_RGB12},
-	{0xa0, 0xf8, ZC3XX_R110_RGB20},
-	{0xa0, 0xf8, ZC3XX_R111_RGB21},
-	{0xa0, 0x50, ZC3XX_R112_RGB22},
-
-	{0xa1, 0x01, 0x0180},
+	{}
+};
+static const struct usb_action mi360soc_AE50HZ[] = {
+	{0xa0, 0x00, ZC3XX_R180_AUTOCORRECTENABLE},
+	{0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
+	{0xbb, 0x00, 0x0562},
+	{0xbb, 0x01, 0x09aa},
+	{0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},
+	{0xa0, 0x03, ZC3XX_R191_EXPOSURELIMITMID},
+	{0xa0, 0x9b, ZC3XX_R192_EXPOSURELIMITLOW},
+	{0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
+	{0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
+	{0xa0, 0x47, ZC3XX_R197_ANTIFLICKERLOW},
+	{0xa0, 0x0e, ZC3XX_R18C_AEFREEZE},
+	{0xa0, 0x1c, ZC3XX_R18F_AEUNFREEZE},
+	{0xa0, 0x14, ZC3XX_R1A9_DIGITALLIMITDIFF},
+	{0xa0, 0x66, ZC3XX_R1AA_DIGITALGAINSTEP},
+	{0xa0, 0x62, ZC3XX_R01D_HSYNC_0},
+	{0xa0, 0x90, ZC3XX_R01E_HSYNC_1},
+	{0xa0, 0xc8, ZC3XX_R01F_HSYNC_2},
+	{0xa0, 0xff, ZC3XX_R020_HSYNC_3},
+	{0xa0, 0x60, ZC3XX_R11D_GLOBALGAIN},
+	{0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},
+	{}
+};
+static const struct usb_action mi360soc_AE50HZScale[] = {
+	{0xa0, 0x00, ZC3XX_R180_AUTOCORRECTENABLE},
+	{0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
+	{0xbb, 0x00, 0x0509},
+	{0xbb, 0x01, 0x0934},
+	{0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},
+	{0xa0, 0x07, ZC3XX_R191_EXPOSURELIMITMID},
+	{0xa0, 0xd2, ZC3XX_R192_EXPOSURELIMITLOW},
+	{0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
+	{0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
+	{0xa0, 0x9a, ZC3XX_R197_ANTIFLICKERLOW},
+	{0xa0, 0x0e, ZC3XX_R18C_AEFREEZE},
+	{0xa0, 0x1c, ZC3XX_R18F_AEUNFREEZE},
+	{0xa0, 0x14, ZC3XX_R1A9_DIGITALLIMITDIFF},
+	{0xa0, 0x66, ZC3XX_R1AA_DIGITALGAINSTEP},
+	{0xa0, 0xd7, ZC3XX_R01D_HSYNC_0},
+	{0xa0, 0xf4, ZC3XX_R01E_HSYNC_1},
+	{0xa0, 0xf9, ZC3XX_R01F_HSYNC_2},
+	{0xa0, 0xff, ZC3XX_R020_HSYNC_3},
+	{0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},
+	{}
+};
+static const struct usb_action mi360soc_AE60HZ[] = {
 	{0xa0, 0x00, ZC3XX_R180_AUTOCORRECTENABLE},
+	{0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
+	{0xbb, 0x00, 0x053d},
+	{0xbb, 0x01, 0x096e},
+	{0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},
+	{0xa0, 0x07, ZC3XX_R191_EXPOSURELIMITMID},
+	{0xa0, 0xdd, ZC3XX_R192_EXPOSURELIMITLOW},
+	{0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
+	{0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
+	{0xa0, 0x3d, ZC3XX_R197_ANTIFLICKERLOW},
+	{0xa0, 0x0e, ZC3XX_R18C_AEFREEZE},
+	{0xa0, 0x1c, ZC3XX_R18F_AEUNFREEZE},
+	{0xa0, 0x14, ZC3XX_R1A9_DIGITALLIMITDIFF},
+	{0xa0, 0x24, ZC3XX_R1AA_DIGITALGAINSTEP},
+	{0xa0, 0x62, ZC3XX_R01D_HSYNC_0},
+	{0xa0, 0x90, ZC3XX_R01E_HSYNC_1},
+	{0xa0, 0xc8, ZC3XX_R01F_HSYNC_2},
+	{0xa0, 0xff, ZC3XX_R020_HSYNC_3},
+	{0xa0, 0x60, ZC3XX_R11D_GLOBALGAIN},
+	{0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},
+	{}
+};
+static const struct usb_action mi360soc_AE60HZScale[] = {
 	{0xa0, 0x00, ZC3XX_R180_AUTOCORRECTENABLE},
 	{0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
-	{0xaa, 0x05, 0x0009},
-	{0xaa, 0x09, 0x0134},
+	{0xbb, 0x00, 0x0509},
+	{0xbb, 0x01, 0x0983},
 	{0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},
 	{0xa0, 0x07, ZC3XX_R191_EXPOSURELIMITMID},
-	{0xa0, 0xec, ZC3XX_R192_EXPOSURELIMITLOW},
+	{0xa0, 0x8f, ZC3XX_R192_EXPOSURELIMITLOW},
 	{0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
 	{0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
-	{0xa0, 0x9c, ZC3XX_R197_ANTIFLICKERLOW},
+	{0xa0, 0x81, ZC3XX_R197_ANTIFLICKERLOW},
 	{0xa0, 0x0e, ZC3XX_R18C_AEFREEZE},
 	{0xa0, 0x1c, ZC3XX_R18F_AEUNFREEZE},
 	{0xa0, 0x14, ZC3XX_R1A9_DIGITALLIMITDIFF},
@@ -4696,20 +4433,60 @@ static const struct usb_action pb03303x_InitialScale[] = {
 	{0xa0, 0xf9, ZC3XX_R01F_HSYNC_2},
 	{0xa0, 0xff, ZC3XX_R020_HSYNC_3},
 	{0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},
-	{0xa0, 0x09, 0x01ad},
-	{0xa0, 0x15, 0x01ae},
-	{0xa0, 0x40, ZC3XX_R180_AUTOCORRECTENABLE},
-	{0xa1, 0x01, 0x0180},
+	{}
+};
+static const struct usb_action mi360soc_AENoFliker[] = {
+	{0xa0, 0x00, ZC3XX_R180_AUTOCORRECTENABLE},
+	{0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
+	{0xbb, 0x00, 0x0509},
+	{0xbb, 0x01, 0x0960},
+	{0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},
+	{0xa0, 0x07, ZC3XX_R191_EXPOSURELIMITMID},
+	{0xa0, 0xf0, ZC3XX_R192_EXPOSURELIMITLOW},
+	{0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
+	{0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
+	{0xa0, 0x04, ZC3XX_R197_ANTIFLICKERLOW},
+	{0xa0, 0x0e, ZC3XX_R18C_AEFREEZE},
+	{0xa0, 0x1c, ZC3XX_R18F_AEUNFREEZE},
+	{0xa0, 0x00, ZC3XX_R1A9_DIGITALLIMITDIFF},
+	{0xa0, 0x00, ZC3XX_R1AA_DIGITALGAINSTEP},
+	{0xa0, 0x09, ZC3XX_R01D_HSYNC_0},
+	{0xa0, 0x40, ZC3XX_R01E_HSYNC_1},
+	{0xa0, 0x90, ZC3XX_R01F_HSYNC_2},
+	{0xa0, 0xe0, ZC3XX_R020_HSYNC_3},
+	{0xa0, 0x60, ZC3XX_R11D_GLOBALGAIN},
 	{0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},
 	{}
 };
-static const struct usb_action pb0330xx_Initial[] = {
-	{0xa1, 0x01, 0x0008},
-	{0xa1, 0x01, 0x0008},
+static const struct usb_action mi360soc_AENoFlikerScale[] = {
+	{0xa0, 0x00, ZC3XX_R180_AUTOCORRECTENABLE},
+	{0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
+	{0xbb, 0x00, 0x0534},
+	{0xbb, 0x02, 0x0960},
+	{0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},
+	{0xa0, 0x07, ZC3XX_R191_EXPOSURELIMITMID},
+	{0xa0, 0xf0, ZC3XX_R192_EXPOSURELIMITLOW},
+	{0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
+	{0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
+	{0xa0, 0x04, ZC3XX_R197_ANTIFLICKERLOW},
+	{0xa0, 0x0e, ZC3XX_R18C_AEFREEZE},
+	{0xa0, 0x1c, ZC3XX_R18F_AEUNFREEZE},
+	{0xa0, 0x00, ZC3XX_R1A9_DIGITALLIMITDIFF},
+	{0xa0, 0x00, ZC3XX_R1AA_DIGITALGAINSTEP},
+	{0xa0, 0x34, ZC3XX_R01D_HSYNC_0},
+	{0xa0, 0x60, ZC3XX_R01E_HSYNC_1},
+	{0xa0, 0x90, ZC3XX_R01F_HSYNC_2},
+	{0xa0, 0xe0, ZC3XX_R020_HSYNC_3},
+	{0xa0, 0x60, ZC3XX_R11D_GLOBALGAIN},
+	{0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},
+	{}
+};
+
+static const struct usb_action pb0330_Initial[] = {	/* 640x480 */
 	{0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL},
 	{0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},	/* 00 */
 	{0xa0, 0x0a, ZC3XX_R010_CMOSSENSORSELECT},
-	{0xa0, 0x10, ZC3XX_R002_CLOCKSELECT},
+	{0xa0, 0x00, ZC3XX_R002_CLOCKSELECT},
 	{0xa0, 0x02, ZC3XX_R003_FRAMEWIDTHHIGH},
 	{0xa0, 0x80, ZC3XX_R004_FRAMEWIDTHLOW},
 	{0xa0, 0x01, ZC3XX_R005_FRAMEHEIGHTHIGH},
@@ -4721,11 +4498,12 @@ static const struct usb_action pb0330xx_Initial[] = {
 	{0xa0, 0x00, ZC3XX_R09A_WINXSTARTLOW},
 	{0xa0, 0x00, ZC3XX_R11A_FIRSTYLOW},
 	{0xa0, 0x00, ZC3XX_R11C_FIRSTXLOW},
+	{0xdd, 0x00, 0x0200},
 	{0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC},
 	{0xaa, 0x01, 0x0006},
 	{0xaa, 0x02, 0x0011},
-	{0xaa, 0x03, 0x01e7},
-	{0xaa, 0x04, 0x0287},
+	{0xaa, 0x03, 0x01e5},			/*jfm: was 1e7*/
+	{0xaa, 0x04, 0x0285},			/*jfm: was 0287*/
 	{0xaa, 0x06, 0x0003},
 	{0xaa, 0x07, 0x3002},
 	{0xaa, 0x20, 0x1100},
@@ -4743,88 +4521,21 @@ static const struct usb_action pb0330xx_Initial[] = {
 	{0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC},
 	{0xa0, 0x0d, ZC3XX_R100_OPERATIONMODE},
 	{0xa0, 0x06, ZC3XX_R189_AWBSTATUS},
-	{0xa0, 0x00, 0x01ad},
+	{0xa0, 0x09, 0x01ad},			/*jfm: was 00 */
+	{0xa0, 0x15, 0x01ae},
 	{0xa0, 0x03, ZC3XX_R1C5_SHARPNESSMODE},
 	{0xa0, 0x13, ZC3XX_R1CB_SHARPNESS05},
 	{0xa0, 0x08, ZC3XX_R250_DEADPIXELSMODE},
 	{0xa0, 0x08, ZC3XX_R301_EEPROMACCESS},
 	{0xa0, 0x60, ZC3XX_R1A8_DIGITALGAIN},
-	{0xa0, 0x6c, ZC3XX_R18D_YTARGET},
-	{0xa1, 0x01, 0x0002},
-	{0xa0, 0x09, 0x01ad},
-	{0xa0, 0x15, 0x01ae},
-	{0xa0, 0x00, ZC3XX_R092_I2CADDRESSSELECT},
-	{0xa0, 0x02, ZC3XX_R090_I2CCOMMAND},
-	{0xa1, 0x01, 0x0091},
-	{0xa1, 0x01, 0x0095},
-	{0xa1, 0x01, 0x0096},
-	{0xa0, 0x50, ZC3XX_R10A_RGB00},	/* matrix */
-	{0xa0, 0xf8, ZC3XX_R10B_RGB01},
-	{0xa0, 0xf8, ZC3XX_R10C_RGB02},
-	{0xa0, 0xf8, ZC3XX_R10D_RGB10},
-	{0xa0, 0x50, ZC3XX_R10E_RGB11},
-	{0xa0, 0xf8, ZC3XX_R10F_RGB12},
-	{0xa0, 0xf8, ZC3XX_R110_RGB20},
-	{0xa0, 0xf8, ZC3XX_R111_RGB21},
-	{0xa0, 0x50, ZC3XX_R112_RGB22},
-	{0xa1, 0x01, 0x0008},
-	{0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},	/* clock ? */
-	{0xa0, 0x08, ZC3XX_R1C6_SHARPNESS00},	/* sharpness+ */
-	{0xa1, 0x01, 0x01c8},
-	{0xa1, 0x01, 0x01c9},
-	{0xa1, 0x01, 0x01ca},
-	{0xa0, 0x0f, ZC3XX_R1CB_SHARPNESS05},	/* sharpness- */
-
-	{0xa0, 0x50, ZC3XX_R10A_RGB00},	/* matrix */
-	{0xa0, 0xf8, ZC3XX_R10B_RGB01},
-	{0xa0, 0xf8, ZC3XX_R10C_RGB02},
-	{0xa0, 0xf8, ZC3XX_R10D_RGB10},
-	{0xa0, 0x50, ZC3XX_R10E_RGB11},
-	{0xa0, 0xf8, ZC3XX_R10F_RGB12},
-	{0xa0, 0xf8, ZC3XX_R110_RGB20},
-	{0xa0, 0xf8, ZC3XX_R111_RGB21},
-	{0xa0, 0x50, ZC3XX_R112_RGB22},
-	{0xa1, 0x01, 0x0180},
-	{0xa0, 0x00, ZC3XX_R180_AUTOCORRECTENABLE},
-	{0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
-	{0xaa, 0x05, 0x0066},
-	{0xaa, 0x09, 0x02b2},
-	{0xaa, 0x10, 0x0002},
-
-	{0xa0, 0x60, ZC3XX_R11D_GLOBALGAIN},
-	{0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},
-	{0xa0, 0x07, ZC3XX_R191_EXPOSURELIMITMID},
-	{0xa0, 0x8c, ZC3XX_R192_EXPOSURELIMITLOW},
-	{0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
-	{0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
-	{0xa0, 0x8a, ZC3XX_R197_ANTIFLICKERLOW},
-	{0xa0, 0x10, ZC3XX_R18C_AEFREEZE},
-	{0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE},
-	{0xa0, 0x14, ZC3XX_R1A9_DIGITALLIMITDIFF},
-	{0xa0, 0x24, ZC3XX_R1AA_DIGITALGAINSTEP},
-	{0xa0, 0xd7, ZC3XX_R01D_HSYNC_0},
-	{0xa0, 0xf0, ZC3XX_R01E_HSYNC_1},
-	{0xa0, 0xf8, ZC3XX_R01F_HSYNC_2},
-	{0xa0, 0xff, ZC3XX_R020_HSYNC_3},
-	{0xa0, 0x09, 0x01ad},
-	{0xa0, 0x15, 0x01ae},
-	{0xa0, 0x40, ZC3XX_R180_AUTOCORRECTENABLE},
-	{0xa1, 0x01, 0x0180},
-	{0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},
-	{0xa1, 0x01, 0x0008},
-	{0xa1, 0x01, 0x0007},
-/*	{0xa0, 0x30, 0x0007}, */
-/*	{0xa0, 0x00, 0x0007}, */
+	{0xa0, 0x78, ZC3XX_R18D_YTARGET},	/*jfm: was 6c*/
 	{}
 };
-
-static const struct usb_action pb0330xx_InitialScale[] = {
-	{0xa1, 0x01, 0x0008},
-	{0xa1, 0x01, 0x0008},
+static const struct usb_action pb0330_InitialScale[] = {	/* 320x240 */
 	{0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL},
 	{0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},	/* 00 */
 	{0xa0, 0x0a, ZC3XX_R010_CMOSSENSORSELECT},
-	{0xa0, 0x00, ZC3XX_R002_CLOCKSELECT},	/* 10 */
+	{0xa0, 0x10, ZC3XX_R002_CLOCKSELECT},
 	{0xa0, 0x02, ZC3XX_R003_FRAMEWIDTHHIGH},
 	{0xa0, 0x80, ZC3XX_R004_FRAMEWIDTHLOW},
 	{0xa0, 0x01, ZC3XX_R005_FRAMEHEIGHTHIGH},
@@ -4836,6 +4547,7 @@ static const struct usb_action pb0330xx_InitialScale[] = {
 	{0xa0, 0x00, ZC3XX_R09A_WINXSTARTLOW},
 	{0xa0, 0x00, ZC3XX_R11A_FIRSTYLOW},
 	{0xa0, 0x00, ZC3XX_R11C_FIRSTXLOW},
+	{0xdd, 0x00, 0x0200},
 	{0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC},
 	{0xaa, 0x01, 0x0006},
 	{0xaa, 0x02, 0x0011},
@@ -4858,53 +4570,43 @@ static const struct usb_action pb0330xx_InitialScale[] = {
 	{0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC},
 	{0xa0, 0x0d, ZC3XX_R100_OPERATIONMODE},
 	{0xa0, 0x06, ZC3XX_R189_AWBSTATUS},
-	{0xa0, 0x00, 0x01ad},
+	{0xa0, 0x09, 0x01ad},
+	{0xa0, 0x15, 0x01ae},
 	{0xa0, 0x03, ZC3XX_R1C5_SHARPNESSMODE},
 	{0xa0, 0x13, ZC3XX_R1CB_SHARPNESS05},
 	{0xa0, 0x08, ZC3XX_R250_DEADPIXELSMODE},
 	{0xa0, 0x08, ZC3XX_R301_EEPROMACCESS},
 	{0xa0, 0x60, ZC3XX_R1A8_DIGITALGAIN},
-	{0xa0, 0x6c, ZC3XX_R18D_YTARGET},
-	{0xa1, 0x01, 0x0002},
-	{0xa0, 0x09, 0x01ad},
-	{0xa0, 0x15, 0x01ae},
-	{0xa0, 0x00, ZC3XX_R092_I2CADDRESSSELECT},
-	{0xa0, 0x02, ZC3XX_R090_I2CCOMMAND},
-	{0xa1, 0x01, 0x0091},
-	{0xa1, 0x01, 0x0095},
-	{0xa1, 0x01, 0x0096},
-	{0xa0, 0x50, ZC3XX_R10A_RGB00},	/* matrix */
-	{0xa0, 0xf8, ZC3XX_R10B_RGB01},
-	{0xa0, 0xf8, ZC3XX_R10C_RGB02},
-	{0xa0, 0xf8, ZC3XX_R10D_RGB10},
-	{0xa0, 0x50, ZC3XX_R10E_RGB11},
-	{0xa0, 0xf8, ZC3XX_R10F_RGB12},
-	{0xa0, 0xf8, ZC3XX_R110_RGB20},
-	{0xa0, 0xf8, ZC3XX_R111_RGB21},
-	{0xa0, 0x50, ZC3XX_R112_RGB22},
-	{0xa1, 0x01, 0x0008},
-	{0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},	/* clock ? */
-	{0xa0, 0x08, ZC3XX_R1C6_SHARPNESS00},	/* sharpness+ */
-	{0xa1, 0x01, 0x01c8},
-	{0xa1, 0x01, 0x01c9},
-	{0xa1, 0x01, 0x01ca},
-	{0xa0, 0x0f, ZC3XX_R1CB_SHARPNESS05},	/* sharpness- */
-
-	{0xa0, 0x50, ZC3XX_R10A_RGB00},	/* matrix */
-	{0xa0, 0xf8, ZC3XX_R10B_RGB01},
-	{0xa0, 0xf8, ZC3XX_R10C_RGB02},
-	{0xa0, 0xf8, ZC3XX_R10D_RGB10},
-	{0xa0, 0x50, ZC3XX_R10E_RGB11},
-	{0xa0, 0xf8, ZC3XX_R10F_RGB12},
-	{0xa0, 0xf8, ZC3XX_R110_RGB20},
-	{0xa0, 0xf8, ZC3XX_R111_RGB21},
-	{0xa0, 0x50, ZC3XX_R112_RGB22},
-	{0xa1, 0x01, 0x0180},
-	{0xa0, 0x00, ZC3XX_R180_AUTOCORRECTENABLE},
+	{0xa0, 0x78, ZC3XX_R18D_YTARGET},	/*jfm: was 6c*/
+	{}
+};
+static const struct usb_action pb0330_50HZ[] = {
+	{0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
+	{0xbb, 0x00, 0x055c},
+	{0xbb, 0x01, 0x09aa},
+	{0xbb, 0x00, 0x1001},
+	{0xa0, 0x60, ZC3XX_R11D_GLOBALGAIN},
+	{0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},
+	{0xa0, 0x07, ZC3XX_R191_EXPOSURELIMITMID},
+	{0xa0, 0xc4, ZC3XX_R192_EXPOSURELIMITLOW},
+	{0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
+	{0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
+	{0xa0, 0x47, ZC3XX_R197_ANTIFLICKERLOW},
+	{0xa0, 0x0e, ZC3XX_R18C_AEFREEZE},
+	{0xa0, 0x1a, ZC3XX_R18F_AEUNFREEZE},
+	{0xa0, 0x14, ZC3XX_R1A9_DIGITALLIMITDIFF},
+	{0xa0, 0x66, ZC3XX_R1AA_DIGITALGAINSTEP},
+	{0xa0, 0x5c, ZC3XX_R01D_HSYNC_0},
+	{0xa0, 0x90, ZC3XX_R01E_HSYNC_1},
+	{0xa0, 0xc8, ZC3XX_R01F_HSYNC_2},
+	{0xa0, 0xff, ZC3XX_R020_HSYNC_3},
+	{}
+};
+static const struct usb_action pb0330_50HZScale[] = {
 	{0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
-	{0xaa, 0x05, 0x0066},
-	{0xaa, 0x09, 0x02b2},
-	{0xaa, 0x10, 0x0002},
+	{0xbb, 0x00, 0x0566},
+	{0xbb, 0x02, 0x09b2},
+	{0xbb, 0x00, 0x1002},
 	{0xa0, 0x60, ZC3XX_R11D_GLOBALGAIN},
 	{0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},
 	{0xa0, 0x07, ZC3XX_R191_EXPOSURELIMITMID},
@@ -4912,124 +4614,102 @@ static const struct usb_action pb0330xx_InitialScale[] = {
 	{0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
 	{0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
 	{0xa0, 0x8a, ZC3XX_R197_ANTIFLICKERLOW},
-	{0xa0, 0x10, ZC3XX_R18C_AEFREEZE},
-	{0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE},
+	{0xa0, 0x0e, ZC3XX_R18C_AEFREEZE},
+	{0xa0, 0x1a, ZC3XX_R18F_AEUNFREEZE},
 	{0xa0, 0x14, ZC3XX_R1A9_DIGITALLIMITDIFF},
-	{0xa0, 0x24, ZC3XX_R1AA_DIGITALGAINSTEP},
+	{0xa0, 0x66, ZC3XX_R1AA_DIGITALGAINSTEP},
 	{0xa0, 0xd7, ZC3XX_R01D_HSYNC_0},
 	{0xa0, 0xf0, ZC3XX_R01E_HSYNC_1},
 	{0xa0, 0xf8, ZC3XX_R01F_HSYNC_2},
 	{0xa0, 0xff, ZC3XX_R020_HSYNC_3},
-	{0xa0, 0x09, 0x01ad},
-	{0xa0, 0x15, 0x01ae},
-	{0xa0, 0x40, ZC3XX_R180_AUTOCORRECTENABLE},
-	{0xa1, 0x01, 0x0180},
-	{0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},
-	{0xa1, 0x01, 0x0008},
-	{0xa1, 0x01, 0x0007},
-/*	{0xa0, 0x30, 0x0007}, */
-/*	{0xa0, 0x00, 0x0007}, */
-	{}
-};
-static const struct usb_action pb0330_50HZ[] = {
-	{0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH}, /* 01,90,00,cc */
-	{0xa0, 0x07, ZC3XX_R191_EXPOSURELIMITMID}, /* 01,91,07,cc */
-	{0xa0, 0xee, ZC3XX_R192_EXPOSURELIMITLOW}, /* 01,92,ee,cc */
-	{0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH}, /* 01,95,00,cc */
-	{0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID}, /* 01,96,00,cc */
-	{0xa0, 0x46, ZC3XX_R197_ANTIFLICKERLOW}, /* 01,97,46,cc */
-	{0xa0, 0x10, ZC3XX_R18C_AEFREEZE}, /* 01,8c,10,cc */
-	{0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE}, /* 01,8f,20,cc */
-	{0xa0, 0x0c, ZC3XX_R1A9_DIGITALLIMITDIFF}, /* 01,a9,0c,cc */
-	{0xa0, 0x26, ZC3XX_R1AA_DIGITALGAINSTEP}, /* 01,aa,26,cc */
-	{0xa0, 0x68, ZC3XX_R01D_HSYNC_0}, /* 00,1d,68,cc */
-	{0xa0, 0x90, ZC3XX_R01E_HSYNC_1}, /* 00,1e,90,cc */
-	{0xa0, 0xc8, ZC3XX_R01F_HSYNC_2}, /* 00,1f,c8,cc */
-	{}
-};
-static const struct usb_action pb0330_50HZScale[] = {
-	{0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS}, /* 00,19,00,cc */
-	{0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH}, /* 01,90,00,cc */
-	{0xa0, 0x07, ZC3XX_R191_EXPOSURELIMITMID}, /* 01,91,07,cc */
-	{0xa0, 0xa0, ZC3XX_R192_EXPOSURELIMITLOW}, /* 01,92,a0,cc */
-	{0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH}, /* 01,95,00,cc */
-	{0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID}, /* 01,96,00,cc */
-	{0xa0, 0x7a, ZC3XX_R197_ANTIFLICKERLOW}, /* 01,97,7a,cc */
-	{0xa0, 0x10, ZC3XX_R18C_AEFREEZE}, /* 01,8c,10,cc */
-	{0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE}, /* 01,8f,20,cc */
-	{0xa0, 0x0c, ZC3XX_R1A9_DIGITALLIMITDIFF}, /* 01,a9,0c,cc */
-	{0xa0, 0x26, ZC3XX_R1AA_DIGITALGAINSTEP}, /* 01,aa,26,cc */
-	{0xa0, 0xe5, ZC3XX_R01D_HSYNC_0}, /* 00,1d,e5,cc */
-	{0xa0, 0xf0, ZC3XX_R01E_HSYNC_1}, /* 00,1e,f0,cc */
-	{0xa0, 0xf8, ZC3XX_R01F_HSYNC_2}, /* 00,1f,f8,cc */
 	{}
 };
 static const struct usb_action pb0330_60HZ[] = {
-	{0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS}, /* 00,19,00,cc */
-	{0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH}, /* 01,90,00,cc */
-	{0xa0, 0x07, ZC3XX_R191_EXPOSURELIMITMID}, /* 01,91,07,cc */
-	{0xa0, 0xdd, ZC3XX_R192_EXPOSURELIMITLOW}, /* 01,92,dd,cc */
-	{0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH}, /* 01,95,00,cc */
-	{0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID}, /* 01,96,00,cc */
-	{0xa0, 0x3d, ZC3XX_R197_ANTIFLICKERLOW}, /* 01,97,3d,cc */
-	{0xa0, 0x10, ZC3XX_R18C_AEFREEZE}, /* 01,8c,10,cc */
-	{0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE}, /* 01,8f,20,cc */
-	{0xa0, 0x0c, ZC3XX_R1A9_DIGITALLIMITDIFF}, /* 01,a9,0c,cc */
-	{0xa0, 0x26, ZC3XX_R1AA_DIGITALGAINSTEP}, /* 01,aa,26,cc */
-	{0xa0, 0x43, ZC3XX_R01D_HSYNC_0}, /* 00,1d,43,cc */
-	{0xa0, 0x50, ZC3XX_R01E_HSYNC_1}, /* 00,1e,50,cc */
-	{0xa0, 0x90, ZC3XX_R01F_HSYNC_2}, /* 00,1f,90,cc */
+	{0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
+	{0xbb, 0x00, 0x0535},
+	{0xbb, 0x01, 0x0974},
+	{0xbb, 0x00, 0x1001},
+	{0xa0, 0x60, ZC3XX_R11D_GLOBALGAIN},
+	{0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},
+	{0xa0, 0x07, ZC3XX_R191_EXPOSURELIMITMID},
+	{0xa0, 0xfe, ZC3XX_R192_EXPOSURELIMITLOW},
+	{0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
+	{0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
+	{0xa0, 0x3e, ZC3XX_R197_ANTIFLICKERLOW},
+	{0xa0, 0x0e, ZC3XX_R18C_AEFREEZE},
+	{0xa0, 0x1a, ZC3XX_R18F_AEUNFREEZE},
+	{0xa0, 0x14, ZC3XX_R1A9_DIGITALLIMITDIFF},
+	{0xa0, 0x66, ZC3XX_R1AA_DIGITALGAINSTEP},
+	{0xa0, 0x35, ZC3XX_R01D_HSYNC_0},
+	{0xa0, 0x50, ZC3XX_R01E_HSYNC_1},
+	{0xa0, 0x90, ZC3XX_R01F_HSYNC_2},
+	{0xa0, 0xd0, ZC3XX_R020_HSYNC_3},
 	{}
 };
 static const struct usb_action pb0330_60HZScale[] = {
-	{0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS}, /* 00,19,00,cc */
-	{0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH}, /* 01,90,00,cc */
-	{0xa0, 0x07, ZC3XX_R191_EXPOSURELIMITMID}, /* 01,91,07,cc */
-	{0xa0, 0xa0, ZC3XX_R192_EXPOSURELIMITLOW}, /* 01,92,a0,cc */
-	{0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH}, /* 01,95,00,cc */
-	{0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID}, /* 01,96,00,cc */
-	{0xa0, 0x7a, ZC3XX_R197_ANTIFLICKERLOW}, /* 01,97,7a,cc */
-	{0xa0, 0x10, ZC3XX_R18C_AEFREEZE}, /* 01,8c,10,cc */
-	{0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE}, /* 01,8f,20,cc */
-	{0xa0, 0x0c, ZC3XX_R1A9_DIGITALLIMITDIFF}, /* 01,a9,0c,cc */
-	{0xa0, 0x26, ZC3XX_R1AA_DIGITALGAINSTEP}, /* 01,aa,26,cc */
-	{0xa0, 0x41, ZC3XX_R01D_HSYNC_0}, /* 00,1d,41,cc */
-	{0xa0, 0x50, ZC3XX_R01E_HSYNC_1}, /* 00,1e,50,cc */
-	{0xa0, 0x90, ZC3XX_R01F_HSYNC_2}, /* 00,1f,90,cc */
+	{0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
+	{0xbb, 0x00, 0x0535},
+	{0xbb, 0x02, 0x096c},
+	{0xbb, 0x00, 0x1002},
+	{0xa0, 0x60, ZC3XX_R11D_GLOBALGAIN},
+	{0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},
+	{0xa0, 0x07, ZC3XX_R191_EXPOSURELIMITMID},
+	{0xa0, 0xc0, ZC3XX_R192_EXPOSURELIMITLOW},
+	{0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
+	{0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
+	{0xa0, 0x7c, ZC3XX_R197_ANTIFLICKERLOW},
+	{0xa0, 0x0e, ZC3XX_R18C_AEFREEZE},
+	{0xa0, 0x1a, ZC3XX_R18F_AEUNFREEZE},
+	{0xa0, 0x14, ZC3XX_R1A9_DIGITALLIMITDIFF},
+	{0xa0, 0x66, ZC3XX_R1AA_DIGITALGAINSTEP},
+	{0xa0, 0x35, ZC3XX_R01D_HSYNC_0},
+	{0xa0, 0x50, ZC3XX_R01E_HSYNC_1},
+	{0xa0, 0x90, ZC3XX_R01F_HSYNC_2},
+	{0xa0, 0xd0, ZC3XX_R020_HSYNC_3},
 	{}
 };
 static const struct usb_action pb0330_NoFliker[] = {
-	{0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS}, /* 00,19,00,cc */
-	{0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH}, /* 01,90,00,cc */
-	{0xa0, 0x07, ZC3XX_R191_EXPOSURELIMITMID}, /* 01,91,07,cc */
-	{0xa0, 0xf0, ZC3XX_R192_EXPOSURELIMITLOW}, /* 01,92,f0,cc */
-	{0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH}, /* 01,95,00,cc */
-	{0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID}, /* 01,96,00,cc */
-	{0xa0, 0x10, ZC3XX_R197_ANTIFLICKERLOW}, /* 01,97,10,cc */
-	{0xa0, 0x10, ZC3XX_R18C_AEFREEZE}, /* 01,8c,10,cc */
-	{0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE}, /* 01,8f,20,cc */
-	{0xa0, 0x00, ZC3XX_R1A9_DIGITALLIMITDIFF}, /* 01,a9,00,cc */
-	{0xa0, 0x00, ZC3XX_R1AA_DIGITALGAINSTEP}, /* 01,aa,00,cc */
-	{0xa0, 0x09, ZC3XX_R01D_HSYNC_0}, /* 00,1d,09,cc */
-	{0xa0, 0x40, ZC3XX_R01E_HSYNC_1}, /* 00,1e,40,cc */
-	{0xa0, 0x90, ZC3XX_R01F_HSYNC_2}, /* 00,1f,90,cc */
+	{0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
+	{0xbb, 0x00, 0x0509},
+	{0xbb, 0x02, 0x0940},
+	{0xbb, 0x00, 0x1002},
+	{0xa0, 0x60, ZC3XX_R11D_GLOBALGAIN},
+	{0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},
+	{0xa0, 0x07, ZC3XX_R191_EXPOSURELIMITMID},
+	{0xa0, 0xf0, ZC3XX_R192_EXPOSURELIMITLOW},
+	{0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
+	{0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
+	{0xa0, 0x01, ZC3XX_R197_ANTIFLICKERLOW},
+	{0xa0, 0x10, ZC3XX_R18C_AEFREEZE},
+	{0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE},
+	{0xa0, 0x00, ZC3XX_R1A9_DIGITALLIMITDIFF},
+	{0xa0, 0x00, ZC3XX_R1AA_DIGITALGAINSTEP},
+	{0xa0, 0x09, ZC3XX_R01D_HSYNC_0},
+	{0xa0, 0x40, ZC3XX_R01E_HSYNC_1},
+	{0xa0, 0x90, ZC3XX_R01F_HSYNC_2},
+	{0xa0, 0xe0, ZC3XX_R020_HSYNC_3},
 	{}
 };
 static const struct usb_action pb0330_NoFlikerScale[] = {
-	{0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS}, /* 00,19,00,cc */
-	{0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH}, /* 01,90,00,cc */
-	{0xa0, 0x07, ZC3XX_R191_EXPOSURELIMITMID}, /* 01,91,07,cc */
-	{0xa0, 0xf0, ZC3XX_R192_EXPOSURELIMITLOW}, /* 01,92,f0,cc */
-	{0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH}, /* 01,95,00,cc */
-	{0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID}, /* 01,96,00,cc */
-	{0xa0, 0x10, ZC3XX_R197_ANTIFLICKERLOW}, /* 01,97,10,cc */
-	{0xa0, 0x10, ZC3XX_R18C_AEFREEZE},	/* 01,8c,10,cc */
-	{0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE},	/* 01,8f,20,cc */
-	{0xa0, 0x00, ZC3XX_R1A9_DIGITALLIMITDIFF}, /* 01,a9,00,cc */
-	{0xa0, 0x00, ZC3XX_R1AA_DIGITALGAINSTEP}, /* 01,aa,00,cc */
-	{0xa0, 0x09, ZC3XX_R01D_HSYNC_0},	/* 00,1d,09,cc */
-	{0xa0, 0x40, ZC3XX_R01E_HSYNC_1},	/* 00,1e,40,cc */
-	{0xa0, 0x90, ZC3XX_R01F_HSYNC_2},	/* 00,1f,90,cc */
+	{0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
+	{0xbb, 0x00, 0x0535},
+	{0xbb, 0x01, 0x0980},
+	{0xbb, 0x00, 0x1001},
+	{0xa0, 0x60, ZC3XX_R11D_GLOBALGAIN},
+	{0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},
+	{0xa0, 0x07, ZC3XX_R191_EXPOSURELIMITMID},
+	{0xa0, 0xf0, ZC3XX_R192_EXPOSURELIMITLOW},
+	{0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
+	{0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
+	{0xa0, 0x01, ZC3XX_R197_ANTIFLICKERLOW},
+	{0xa0, 0x10, ZC3XX_R18C_AEFREEZE},
+	{0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE},
+	{0xa0, 0x00, ZC3XX_R1A9_DIGITALLIMITDIFF},
+	{0xa0, 0x00, ZC3XX_R1AA_DIGITALGAINSTEP},
+	{0xa0, 0x35, ZC3XX_R01D_HSYNC_0},
+	{0xa0, 0x60, ZC3XX_R01E_HSYNC_1},
+	{0xa0, 0x90, ZC3XX_R01F_HSYNC_2},
+	{0xa0, 0xe0, ZC3XX_R020_HSYNC_3},
 	{}
 };
 
@@ -5655,7 +5335,7 @@ static const struct usb_action tas5130CK_InitialScale[] = {
 	{}
 };
 
-static const struct usb_action tas5130cxx_Initial[] = {
+static const struct usb_action tas5130cxx_InitialScale[] = {	/* 320x240 */
 	{0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL},
 	{0xa0, 0x50, ZC3XX_R002_CLOCKSELECT},
 	{0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},
@@ -5665,9 +5345,6 @@ static const struct usb_action tas5130cxx_Initial[] = {
 	{0xa0, 0x01, ZC3XX_R012_VIDEOCONTROLFUNC},
 	{0xa0, 0x01, ZC3XX_R001_SYSTEMOPERATING},
 	{0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC},
-	{0xa0, 0x07, ZC3XX_R0A5_EXPOSUREGAIN},
-	{0xa0, 0x02, ZC3XX_R0A6_EXPOSUREBLACKLVL},
-
 	{0xa0, 0x02, ZC3XX_R003_FRAMEWIDTHHIGH},
 	{0xa0, 0x80, ZC3XX_R004_FRAMEWIDTHLOW},
 	{0xa0, 0x01, ZC3XX_R005_FRAMEHEIGHTHIGH},
@@ -5684,82 +5361,27 @@ static const struct usb_action tas5130cxx_Initial[] = {
 	{0xa0, 0xf7, ZC3XX_R101_SENSORCORRECTION},
 	{0xa0, 0x0d, ZC3XX_R100_OPERATIONMODE},
 	{0xa0, 0x06, ZC3XX_R189_AWBSTATUS},
-	{0xa0, 0x68, ZC3XX_R18D_YTARGET},
-	{0xa0, 0x60, ZC3XX_R1A8_DIGITALGAIN},
+	{0xa0, 0x70, ZC3XX_R18D_YTARGET},
+	{0xa0, 0x50, ZC3XX_R1A8_DIGITALGAIN},
 	{0xa0, 0x00, 0x01ad},
 	{0xa0, 0x03, ZC3XX_R1C5_SHARPNESSMODE},
 	{0xa0, 0x13, ZC3XX_R1CB_SHARPNESS05},
 	{0xa0, 0x08, ZC3XX_R250_DEADPIXELSMODE},
 	{0xa0, 0x08, ZC3XX_R301_EEPROMACCESS},
-	{0xa1, 0x01, 0x0002},
-	{0xa1, 0x01, 0x0008},
-	{0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},	/* clock ? */
-	{0xa0, 0x08, ZC3XX_R1C6_SHARPNESS00},	/* sharpness+ */
-	{0xa1, 0x01, 0x01c8},
-	{0xa1, 0x01, 0x01c9},
-	{0xa1, 0x01, 0x01ca},
-	{0xa0, 0x0f, ZC3XX_R1CB_SHARPNESS05},	/* sharpness- */
-
-	{0xa0, 0x68, ZC3XX_R10A_RGB00},	/* matrix */
-	{0xa0, 0xec, ZC3XX_R10B_RGB01},
-	{0xa0, 0xec, ZC3XX_R10C_RGB02},
-	{0xa0, 0xec, ZC3XX_R10D_RGB10},
-	{0xa0, 0x68, ZC3XX_R10E_RGB11},
-	{0xa0, 0xec, ZC3XX_R10F_RGB12},
-	{0xa0, 0xec, ZC3XX_R110_RGB20},
-	{0xa0, 0xec, ZC3XX_R111_RGB21},
-	{0xa0, 0x68, ZC3XX_R112_RGB22},
-
-	{0xa1, 0x01, 0x018d},
-	{0xa0, 0x90, ZC3XX_R18D_YTARGET},	/* 90 */
-	{0xa1, 0x01, 0x0180},
-	{0xa0, 0x00, ZC3XX_R180_AUTOCORRECTENABLE},
-	{0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
-
-	{0xaa, 0xa3, 0x0001},
-	{0xaa, 0xa4, 0x0077},
-	{0xa0, 0x01, ZC3XX_R0A3_EXPOSURETIMEHIGH},
-	{0xa0, 0x77, ZC3XX_R0A4_EXPOSURETIMELOW},
-
-	{0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},	/* 00 */
-	{0xa0, 0x03, ZC3XX_R191_EXPOSURELIMITMID},	/* 03 */
-	{0xa0, 0xe8, ZC3XX_R192_EXPOSURELIMITLOW},	/* e8 */
-	{0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},	/* 0 */
-	{0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},	/* 0 */
-	{0xa0, 0x7d, ZC3XX_R197_ANTIFLICKERLOW},	/* 7d */
-
-	{0xa0, 0x0c, ZC3XX_R18C_AEFREEZE},
-	{0xa0, 0x18, ZC3XX_R18F_AEUNFREEZE},
-	{0xa0, 0x08, ZC3XX_R1A9_DIGITALLIMITDIFF},	/* 08 */
-	{0xa0, 0x24, ZC3XX_R1AA_DIGITALGAINSTEP},	/* 24 */
-	{0xa0, 0xf0, ZC3XX_R01D_HSYNC_0},
-	{0xa0, 0xf4, ZC3XX_R01E_HSYNC_1},
-	{0xa0, 0xf8, ZC3XX_R01F_HSYNC_2},
-	{0xa0, 0xff, ZC3XX_R020_HSYNC_3},
-	{0xa0, 0x03, ZC3XX_R09F_MAXXHIGH},
-	{0xa0, 0xc0, ZC3XX_R0A0_MAXXLOW},
-	{0xa0, 0x50, ZC3XX_R11D_GLOBALGAIN},	/* 50 */
-	{0xa0, 0x40, ZC3XX_R180_AUTOCORRECTENABLE},
-	{0xa1, 0x01, 0x0180},
-	{0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},
+	{0xa0, 0x07, ZC3XX_R0A5_EXPOSUREGAIN},
+	{0xa0, 0x02, ZC3XX_R0A6_EXPOSUREBLACKLVL},
 	{}
 };
-static const struct usb_action tas5130cxx_InitialScale[] = {
-/*??	{0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL}, */
+static const struct usb_action tas5130cxx_Initial[] = {	/* 640x480 */
 	{0xa0, 0x01, ZC3XX_R000_SYSTEMCONTROL},
 	{0xa0, 0x40, ZC3XX_R002_CLOCKSELECT},
-
-	{0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},
-	{0xa1, 0x01, 0x0008},
-
+	{0xa0, 0x00, ZC3XX_R008_CLOCKSETTING},
 	{0xa0, 0x02, ZC3XX_R010_CMOSSENSORSELECT},
 	{0xa0, 0x01, ZC3XX_R001_SYSTEMOPERATING},
 	{0xa0, 0x00, ZC3XX_R001_SYSTEMOPERATING},
 	{0xa0, 0x01, ZC3XX_R012_VIDEOCONTROLFUNC},
 	{0xa0, 0x01, ZC3XX_R001_SYSTEMOPERATING},
 	{0xa0, 0x05, ZC3XX_R012_VIDEOCONTROLFUNC},
-	{0xa0, 0x07, ZC3XX_R0A5_EXPOSUREGAIN},
-	{0xa0, 0x02, ZC3XX_R0A6_EXPOSUREBLACKLVL},
 	{0xa0, 0x02, ZC3XX_R003_FRAMEWIDTHHIGH},
 	{0xa0, 0x80, ZC3XX_R004_FRAMEWIDTHLOW},
 	{0xa0, 0x01, ZC3XX_R005_FRAMEHEIGHTHIGH},
@@ -5775,63 +5397,15 @@ static const struct usb_action tas5130cxx_InitialScale[] = {
 	{0xa0, 0x37, ZC3XX_R101_SENSORCORRECTION},
 	{0xa0, 0x0d, ZC3XX_R100_OPERATIONMODE},
 	{0xa0, 0x06, ZC3XX_R189_AWBSTATUS},
-	{0xa0, 0x68, ZC3XX_R18D_YTARGET},
-	{0xa0, 0x60, ZC3XX_R1A8_DIGITALGAIN},
+	{0xa0, 0x70, ZC3XX_R18D_YTARGET},
+	{0xa0, 0x50, ZC3XX_R1A8_DIGITALGAIN},
 	{0xa0, 0x00, 0x01ad},
 	{0xa0, 0x03, ZC3XX_R1C5_SHARPNESSMODE},
 	{0xa0, 0x13, ZC3XX_R1CB_SHARPNESS05},
 	{0xa0, 0x08, ZC3XX_R250_DEADPIXELSMODE},
 	{0xa0, 0x08, ZC3XX_R301_EEPROMACCESS},
-	{0xa1, 0x01, 0x0002},
-	{0xa1, 0x01, 0x0008},
-
-	{0xa0, 0x03, ZC3XX_R008_CLOCKSETTING},
-	{0xa1, 0x01, 0x0008},	/* clock ? */
-	{0xa0, 0x08, ZC3XX_R1C6_SHARPNESS00},	/* sharpness+ */
-	{0xa1, 0x01, 0x01c8},
-	{0xa1, 0x01, 0x01c9},
-	{0xa1, 0x01, 0x01ca},
-	{0xa0, 0x0f, ZC3XX_R1CB_SHARPNESS05},	/* sharpness- */
-
-	{0xa0, 0x68, ZC3XX_R10A_RGB00},	/* matrix */
-	{0xa0, 0xec, ZC3XX_R10B_RGB01},
-	{0xa0, 0xec, ZC3XX_R10C_RGB02},
-	{0xa0, 0xec, ZC3XX_R10D_RGB10},
-	{0xa0, 0x68, ZC3XX_R10E_RGB11},
-	{0xa0, 0xec, ZC3XX_R10F_RGB12},
-	{0xa0, 0xec, ZC3XX_R110_RGB20},
-	{0xa0, 0xec, ZC3XX_R111_RGB21},
-	{0xa0, 0x68, ZC3XX_R112_RGB22},
-
-	{0xa1, 0x01, 0x018d},
-	{0xa0, 0x90, ZC3XX_R18D_YTARGET},
-	{0xa1, 0x01, 0x0180},
-	{0xa0, 0x00, ZC3XX_R180_AUTOCORRECTENABLE},
-	{0xa0, 0x00, ZC3XX_R019_AUTOADJUSTFPS},
-	{0xaa, 0xa3, 0x0001},
-	{0xaa, 0xa4, 0x0063},
-	{0xa0, 0x01, ZC3XX_R0A3_EXPOSURETIMEHIGH},
-	{0xa0, 0x63, ZC3XX_R0A4_EXPOSURETIMELOW},
-	{0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH},
-	{0xa0, 0x02, ZC3XX_R191_EXPOSURELIMITMID},
-	{0xa0, 0x38, ZC3XX_R192_EXPOSURELIMITLOW},
-	{0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
-	{0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
-	{0xa0, 0x47, ZC3XX_R197_ANTIFLICKERLOW},
-	{0xa0, 0x0c, ZC3XX_R18C_AEFREEZE},
-	{0xa0, 0x18, ZC3XX_R18F_AEUNFREEZE},
-	{0xa0, 0x08, ZC3XX_R1A9_DIGITALLIMITDIFF},
-	{0xa0, 0x24, ZC3XX_R1AA_DIGITALGAINSTEP},
-	{0xa0, 0xd3, ZC3XX_R01D_HSYNC_0},
-	{0xa0, 0xda, ZC3XX_R01E_HSYNC_1},
-	{0xa0, 0xea, ZC3XX_R01F_HSYNC_2},
-	{0xa0, 0xff, ZC3XX_R020_HSYNC_3},
-	{0xa0, 0x03, ZC3XX_R09F_MAXXHIGH},
-	{0xa0, 0x4c, ZC3XX_R0A0_MAXXLOW},
-	{0xa0, 0x50, ZC3XX_R11D_GLOBALGAIN},
-	{0xa0, 0x40, ZC3XX_R180_AUTOCORRECTENABLE},
-	{0xa1, 0x01, 0x0180},
-	{0xa0, 0x42, ZC3XX_R180_AUTOCORRECTENABLE},
+	{0xa0, 0x07, ZC3XX_R0A5_EXPOSUREGAIN},
+	{0xa0, 0x02, ZC3XX_R0A6_EXPOSUREBLACKLVL},
 	{}
 };
 static const struct usb_action tas5130cxx_50HZ[] = {
@@ -5841,20 +5415,22 @@ static const struct usb_action tas5130cxx_50HZ[] = {
 	{0xa0, 0x01, ZC3XX_R0A3_EXPOSURETIMEHIGH}, /* 00,a3,01,cc */
 	{0xa0, 0x63, ZC3XX_R0A4_EXPOSURETIMELOW}, /* 00,a4,63,cc */
 	{0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH}, /* 01,90,00,cc */
-	{0xa0, 0x02, ZC3XX_R191_EXPOSURELIMITMID}, /* 01,91,02,cc */
-	{0xa0, 0x38, ZC3XX_R192_EXPOSURELIMITLOW}, /* 01,92,38,cc */
+	{0xa0, 0x04, ZC3XX_R191_EXPOSURELIMITMID},
+	{0xa0, 0xfe, ZC3XX_R192_EXPOSURELIMITLOW},
 	{0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH}, /* 01,95,00,cc */
 	{0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID}, /* 01,96,00,cc */
 	{0xa0, 0x47, ZC3XX_R197_ANTIFLICKERLOW}, /* 01,97,47,cc */
-	{0xa0, 0x10, ZC3XX_R18C_AEFREEZE}, /* 01,8c,10,cc */
-	{0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE}, /* 01,8f,20,cc */
-	{0xa0, 0x0c, ZC3XX_R1A9_DIGITALLIMITDIFF}, /* 01,a9,0c,cc */
-	{0xa0, 0x26, ZC3XX_R1AA_DIGITALGAINSTEP}, /* 01,aa,26,cc */
+	{0xa0, 0x0c, ZC3XX_R18C_AEFREEZE},
+	{0xa0, 0x18, ZC3XX_R18F_AEUNFREEZE},
+	{0xa0, 0x08, ZC3XX_R1A9_DIGITALLIMITDIFF},
+	{0xa0, 0x24, ZC3XX_R1AA_DIGITALGAINSTEP},
 	{0xa0, 0xd3, ZC3XX_R01D_HSYNC_0}, /* 00,1d,d3,cc */
 	{0xa0, 0xda, ZC3XX_R01E_HSYNC_1}, /* 00,1e,da,cc */
 	{0xa0, 0xea, ZC3XX_R01F_HSYNC_2}, /* 00,1f,ea,cc */
 	{0xa0, 0xff, ZC3XX_R020_HSYNC_3}, /* 00,20,ff,cc */
 	{0xa0, 0x03, ZC3XX_R09F_MAXXHIGH}, /* 00,9f,03,cc */
+	{0xa0, 0x4c, ZC3XX_R0A0_MAXXLOW},
+	{0xa0, 0x50, ZC3XX_R11D_GLOBALGAIN},
 	{}
 };
 static const struct usb_action tas5130cxx_50HZScale[] = {
@@ -5864,20 +5440,22 @@ static const struct usb_action tas5130cxx_50HZScale[] = {
 	{0xa0, 0x01, ZC3XX_R0A3_EXPOSURETIMEHIGH}, /* 00,a3,01,cc */
 	{0xa0, 0x77, ZC3XX_R0A4_EXPOSURETIMELOW}, /* 00,a4,77,cc */
 	{0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH}, /* 01,90,00,cc */
-	{0xa0, 0x03, ZC3XX_R191_EXPOSURELIMITMID}, /* 01,91,03,cc */
-	{0xa0, 0xe8, ZC3XX_R192_EXPOSURELIMITLOW}, /* 01,92,e8,cc */
+	{0xa0, 0x07, ZC3XX_R191_EXPOSURELIMITMID},
+	{0xa0, 0xd0, ZC3XX_R192_EXPOSURELIMITLOW},
 	{0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH}, /* 01,95,00,cc */
 	{0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID}, /* 01,96,00,cc */
 	{0xa0, 0x7d, ZC3XX_R197_ANTIFLICKERLOW}, /* 01,97,7d,cc */
-	{0xa0, 0x14, ZC3XX_R18C_AEFREEZE}, /* 01,8c,14,cc */
-	{0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE}, /* 01,8f,20,cc */
-	{0xa0, 0x0c, ZC3XX_R1A9_DIGITALLIMITDIFF}, /* 01,a9,0c,cc */
-	{0xa0, 0x26, ZC3XX_R1AA_DIGITALGAINSTEP}, /* 01,aa,26,cc */
+	{0xa0, 0x0c, ZC3XX_R18C_AEFREEZE},
+	{0xa0, 0x18, ZC3XX_R18F_AEUNFREEZE},
+	{0xa0, 0x08, ZC3XX_R1A9_DIGITALLIMITDIFF},
+	{0xa0, 0x24, ZC3XX_R1AA_DIGITALGAINSTEP},
 	{0xa0, 0xf0, ZC3XX_R01D_HSYNC_0}, /* 00,1d,f0,cc */
 	{0xa0, 0xf4, ZC3XX_R01E_HSYNC_1}, /* 00,1e,f4,cc */
 	{0xa0, 0xf8, ZC3XX_R01F_HSYNC_2}, /* 00,1f,f8,cc */
 	{0xa0, 0xff, ZC3XX_R020_HSYNC_3}, /* 00,20,ff,cc */
 	{0xa0, 0x03, ZC3XX_R09F_MAXXHIGH}, /* 00,9f,03,cc */
+	{0xa0, 0xc0, ZC3XX_R0A0_MAXXLOW},
+	{0xa0, 0x50, ZC3XX_R11D_GLOBALGAIN},
 	{}
 };
 static const struct usb_action tas5130cxx_60HZ[] = {
@@ -5887,20 +5465,22 @@ static const struct usb_action tas5130cxx_60HZ[] = {
 	{0xa0, 0x01, ZC3XX_R0A3_EXPOSURETIMEHIGH}, /* 00,a3,01,cc */
 	{0xa0, 0x36, ZC3XX_R0A4_EXPOSURETIMELOW}, /* 00,a4,36,cc */
 	{0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH}, /* 01,90,00,cc */
-	{0xa0, 0x01, ZC3XX_R191_EXPOSURELIMITMID}, /* 01,91,01,cc */
-	{0xa0, 0xf0, ZC3XX_R192_EXPOSURELIMITLOW}, /* 01,92,f0,cc */
+	{0xa0, 0x05, ZC3XX_R191_EXPOSURELIMITMID},
+	{0xa0, 0x54, ZC3XX_R192_EXPOSURELIMITLOW},
 	{0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH}, /* 01,95,00,cc */
 	{0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID}, /* 01,96,00,cc */
 	{0xa0, 0x3e, ZC3XX_R197_ANTIFLICKERLOW}, /* 01,97,3e,cc */
-	{0xa0, 0x10, ZC3XX_R18C_AEFREEZE}, /* 01,8c,10,cc */
-	{0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE}, /* 01,8f,20,cc */
-	{0xa0, 0x0c, ZC3XX_R1A9_DIGITALLIMITDIFF}, /* 01,a9,0c,cc */
-	{0xa0, 0x26, ZC3XX_R1AA_DIGITALGAINSTEP}, /* 01,aa,26,cc */
+	{0xa0, 0x0c, ZC3XX_R18C_AEFREEZE},
+	{0xa0, 0x18, ZC3XX_R18F_AEUNFREEZE},
+	{0xa0, 0x08, ZC3XX_R1A9_DIGITALLIMITDIFF},
+	{0xa0, 0x24, ZC3XX_R1AA_DIGITALGAINSTEP},
 	{0xa0, 0xca, ZC3XX_R01D_HSYNC_0}, /* 00,1d,ca,cc */
 	{0xa0, 0xd0, ZC3XX_R01E_HSYNC_1}, /* 00,1e,d0,cc */
 	{0xa0, 0xe0, ZC3XX_R01F_HSYNC_2}, /* 00,1f,e0,cc */
 	{0xa0, 0xff, ZC3XX_R020_HSYNC_3}, /* 00,20,ff,cc */
 	{0xa0, 0x03, ZC3XX_R09F_MAXXHIGH}, /* 00,9f,03,cc */
+	{0xa0, 0x28, ZC3XX_R0A0_MAXXLOW},
+	{0xa0, 0x50, ZC3XX_R11D_GLOBALGAIN},
 	{}
 };
 static const struct usb_action tas5130cxx_60HZScale[] = {
@@ -5910,20 +5490,22 @@ static const struct usb_action tas5130cxx_60HZScale[] = {
 	{0xa0, 0x01, ZC3XX_R0A3_EXPOSURETIMEHIGH}, /* 00,a3,01,cc */
 	{0xa0, 0x77, ZC3XX_R0A4_EXPOSURETIMELOW}, /* 00,a4,77,cc */
 	{0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH}, /* 01,90,00,cc */
-	{0xa0, 0x03, ZC3XX_R191_EXPOSURELIMITMID}, /* 01,91,03,cc */
-	{0xa0, 0xe8, ZC3XX_R192_EXPOSURELIMITLOW}, /* 01,92,e8,cc */
+	{0xa0, 0x09, ZC3XX_R191_EXPOSURELIMITMID},
+	{0xa0, 0x47, ZC3XX_R192_EXPOSURELIMITLOW},
 	{0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH}, /* 01,95,00,cc */
 	{0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID}, /* 01,96,00,cc */
 	{0xa0, 0x7d, ZC3XX_R197_ANTIFLICKERLOW}, /* 01,97,7d,cc */
-	{0xa0, 0x14, ZC3XX_R18C_AEFREEZE}, /* 01,8c,14,cc */
-	{0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE}, /* 01,8f,20,cc */
-	{0xa0, 0x0c, ZC3XX_R1A9_DIGITALLIMITDIFF}, /* 01,a9,0c,cc */
-	{0xa0, 0x26, ZC3XX_R1AA_DIGITALGAINSTEP}, /* 01,aa,26,cc */
+	{0xa0, 0x0c, ZC3XX_R18C_AEFREEZE},
+	{0xa0, 0x18, ZC3XX_R18F_AEUNFREEZE},
+	{0xa0, 0x08, ZC3XX_R1A9_DIGITALLIMITDIFF},
+	{0xa0, 0x24, ZC3XX_R1AA_DIGITALGAINSTEP},
 	{0xa0, 0xc8, ZC3XX_R01D_HSYNC_0}, /* 00,1d,c8,cc */
 	{0xa0, 0xd0, ZC3XX_R01E_HSYNC_1}, /* 00,1e,d0,cc */
 	{0xa0, 0xe0, ZC3XX_R01F_HSYNC_2}, /* 00,1f,e0,cc */
 	{0xa0, 0xff, ZC3XX_R020_HSYNC_3}, /* 00,20,ff,cc */
 	{0xa0, 0x03, ZC3XX_R09F_MAXXHIGH}, /* 00,9f,03,cc */
+	{0xa0, 0x20, ZC3XX_R0A0_MAXXLOW},
+	{0xa0, 0x50, ZC3XX_R11D_GLOBALGAIN},
 	{}
 };
 static const struct usb_action tas5130cxx_NoFliker[] = {
@@ -5933,13 +5515,13 @@ static const struct usb_action tas5130cxx_NoFliker[] = {
 	{0xa0, 0x01, ZC3XX_R0A3_EXPOSURETIMEHIGH}, /* 00,a3,01,cc */
 	{0xa0, 0x40, ZC3XX_R0A4_EXPOSURETIMELOW}, /* 00,a4,40,cc */
 	{0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH}, /* 01,90,00,cc */
-	{0xa0, 0x01, ZC3XX_R191_EXPOSURELIMITMID}, /* 01,91,01,cc */
-	{0xa0, 0xf0, ZC3XX_R192_EXPOSURELIMITLOW}, /* 01,92,f0,cc */
-	{0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH}, /* 01,95,00,cc */
-	{0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID}, /* 01,96,00,cc */
-	{0xa0, 0x10, ZC3XX_R197_ANTIFLICKERLOW}, /* 01,97,10,cc */
-	{0xa0, 0x10, ZC3XX_R18C_AEFREEZE}, /* 01,8c,10,cc */
-	{0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE}, /* 01,8f,20,cc */
+	{0xa0, 0x05, ZC3XX_R191_EXPOSURELIMITMID},
+	{0xa0, 0xa0, ZC3XX_R192_EXPOSURELIMITLOW},
+	{0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
+	{0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
+	{0xa0, 0x04, ZC3XX_R197_ANTIFLICKERLOW},
+	{0xa0, 0x0c, ZC3XX_R18C_AEFREEZE},
+	{0xa0, 0x18, ZC3XX_R18F_AEUNFREEZE},
 	{0xa0, 0x00, ZC3XX_R1A9_DIGITALLIMITDIFF}, /* 01,a9,00,cc */
 	{0xa0, 0x00, ZC3XX_R1AA_DIGITALGAINSTEP}, /* 01,aa,00,cc */
 	{0xa0, 0xbc, ZC3XX_R01D_HSYNC_0}, /* 00,1d,bc,cc */
@@ -5947,6 +5529,8 @@ static const struct usb_action tas5130cxx_NoFliker[] = {
 	{0xa0, 0xe0, ZC3XX_R01F_HSYNC_2}, /* 00,1f,e0,cc */
 	{0xa0, 0xff, ZC3XX_R020_HSYNC_3}, /* 00,20,ff,cc */
 	{0xa0, 0x02, ZC3XX_R09F_MAXXHIGH}, /* 00,9f,02,cc */
+	{0xa0, 0xf0, ZC3XX_R0A0_MAXXLOW},
+	{0xa0, 0x50, ZC3XX_R11D_GLOBALGAIN},
 	{}
 };
 
@@ -5957,13 +5541,13 @@ static const struct usb_action tas5130cxx_NoFlikerScale[] = {
 	{0xa0, 0x01, ZC3XX_R0A3_EXPOSURETIMEHIGH}, /* 00,a3,01,cc */
 	{0xa0, 0x90, ZC3XX_R0A4_EXPOSURETIMELOW}, /* 00,a4,90,cc */
 	{0xa0, 0x00, ZC3XX_R190_EXPOSURELIMITHIGH}, /* 01,90,00,cc */
-	{0xa0, 0x03, ZC3XX_R191_EXPOSURELIMITMID}, /* 01,91,03,cc */
-	{0xa0, 0xf0, ZC3XX_R192_EXPOSURELIMITLOW}, /* 01,92,f0,cc */
-	{0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH}, /* 01,95,00,cc */
-	{0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID}, /* 01,96,00,cc */
-	{0xa0, 0x10, ZC3XX_R197_ANTIFLICKERLOW}, /* 01,97,10,cc */
-	{0xa0, 0x10, ZC3XX_R18C_AEFREEZE}, /* 01,8c,10,cc */
-	{0xa0, 0x20, ZC3XX_R18F_AEUNFREEZE}, /* 01,8f,20,cc */
+	{0xa0, 0x0a, ZC3XX_R191_EXPOSURELIMITMID},
+	{0xa0, 0x00, ZC3XX_R192_EXPOSURELIMITLOW},
+	{0xa0, 0x00, ZC3XX_R195_ANTIFLICKERHIGH},
+	{0xa0, 0x00, ZC3XX_R196_ANTIFLICKERMID},
+	{0xa0, 0x04, ZC3XX_R197_ANTIFLICKERLOW},
+	{0xa0, 0x0c, ZC3XX_R18C_AEFREEZE},
+	{0xa0, 0x18, ZC3XX_R18F_AEUNFREEZE},
 	{0xa0, 0x00, ZC3XX_R1A9_DIGITALLIMITDIFF}, /* 01,a9,00,cc */
 	{0xa0, 0x00, ZC3XX_R1AA_DIGITALGAINSTEP}, /* 01,aa,00,cc */
 	{0xa0, 0xbc, ZC3XX_R01D_HSYNC_0}, /* 00,1d,bc,cc */
@@ -5971,6 +5555,8 @@ static const struct usb_action tas5130cxx_NoFlikerScale[] = {
 	{0xa0, 0xe0, ZC3XX_R01F_HSYNC_2}, /* 00,1f,e0,cc */
 	{0xa0, 0xff, ZC3XX_R020_HSYNC_3}, /* 00,20,ff,cc */
 	{0xa0, 0x02, ZC3XX_R09F_MAXXHIGH}, /* 00,9f,02,cc */
+	{0xa0, 0xf0, ZC3XX_R0A0_MAXXLOW},
+	{0xa0, 0x50, ZC3XX_R11D_GLOBALGAIN},
 	{}
 };
 
@@ -6303,8 +5889,10 @@ static __u16 i2c_read(struct gspca_dev *gspca_dev,
 
 	reg_w_i(gspca_dev->dev, reg, 0x0092);
 	reg_w_i(gspca_dev->dev, 0x02, 0x0090);		/* <- read command */
-	msleep(25);
+	msleep(20);
 	retbyte = reg_r_i(gspca_dev, 0x0091);		/* read status */
+	if (retbyte != 0x00)
+		err("i2c_r status error %02x", retbyte);
 	retval = reg_r_i(gspca_dev, 0x0095);		/* read Lowbyte */
 	retval |= reg_r_i(gspca_dev, 0x0096) << 8;	/* read Hightbyte */
 	PDEBUG(D_USBI, "i2c r [%02x] -> %04x (%02x)",
@@ -6323,8 +5911,10 @@ static __u8 i2c_write(struct gspca_dev *gspca_dev,
 	reg_w_i(gspca_dev->dev, valL, 0x93);
 	reg_w_i(gspca_dev->dev, valH, 0x94);
 	reg_w_i(gspca_dev->dev, 0x01, 0x90);		/* <- write command */
-	msleep(15);
+	msleep(1);
 	retbyte = reg_r_i(gspca_dev, 0x0091);		/* read status */
+	if (retbyte != 0x00)
+		err("i2c_w status error %02x", retbyte);
 	PDEBUG(D_USBO, "i2c w [%02x] = %02x%02x (%02x)",
 			reg, valH, valL, retbyte);
 	return retbyte;
@@ -6359,7 +5949,7 @@ static void usb_exchange(struct gspca_dev *gspca_dev,
 			break;
 		}
 		action++;
-/*		msleep(1); */
+		msleep(1);
 	}
 }
 
@@ -6380,11 +5970,13 @@ static void setmatrix(struct gspca_dev *gspca_dev)
 		{0x4c, 0xf5, 0xff, 0xf9, 0x51, 0xf5, 0xfb, 0xed, 0x5f};
 	static const __u8 po2030_matrix[9] =
 		{0x60, 0xf0, 0xf0, 0xf0, 0x60, 0xf0, 0xf0, 0xf0, 0x60};
+	static const u8 tas5130c_matrix[9] =
+		{0x68, 0xec, 0xec, 0xec, 0x68, 0xec, 0xec, 0xec, 0x68};
 	static const __u8 vf0250_matrix[9] =
 		{0x7b, 0xea, 0xea, 0xea, 0x7b, 0xea, 0xea, 0xea, 0x7b};
 	static const __u8 *matrix_tb[SENSOR_MAX] = {
 		adcm2700_matrix, /* SENSOR_ADCM2700 0 */
-		NULL,		/* SENSOR_CS2102 1 */
+		ov7620_matrix,	/* SENSOR_CS2102 1 */
 		NULL,		/* SENSOR_CS2102K 2 */
 		gc0305_matrix,	/* SENSOR_GC0305 3 */
 		NULL,		/* SENSOR_HDCS2020b 4 */
@@ -6392,15 +5984,16 @@ static void setmatrix(struct gspca_dev *gspca_dev)
 		NULL,		/* SENSOR_HV7131C 6 */
 		NULL,		/* SENSOR_ICM105A 7 */
 		NULL,		/* SENSOR_MC501CB 8 */
-		ov7620_matrix,	/* SENSOR_OV7620 9 */
-		NULL,		/* SENSOR_OV7630C 10 */
-		NULL,		/* SENSOR_PAS106 11 */
-		pas202b_matrix,	/* SENSOR_PAS202B 12 */
-		NULL,		/* SENSOR_PB0330 13 */
-		po2030_matrix,	/* SENSOR_PO2030 14 */
-		NULL,		/* SENSOR_TAS5130CK 15 */
-		NULL,		/* SENSOR_TAS5130CXX 16 */
-		vf0250_matrix,	/* SENSOR_TAS5130C_VF0250 17 */
+		gc0305_matrix,	/* SENSOR_MI0360SOC 9 */
+		ov7620_matrix,	/* SENSOR_OV7620 10 */
+		NULL,		/* SENSOR_OV7630C 11 */
+		NULL,		/* SENSOR_PAS106 12 */
+		pas202b_matrix,	/* SENSOR_PAS202B 13 */
+		gc0305_matrix,	/* SENSOR_PB0330 14 */
+		po2030_matrix,	/* SENSOR_PO2030 15 */
+		NULL,		/* SENSOR_TAS5130CK 16 */
+		tas5130c_matrix, /* SENSOR_TAS5130CXX 17 */
+		vf0250_matrix,	/* SENSOR_TAS5130C_VF0250 18 */
 	};
 
 	matrix = matrix_tb[sd->sensor];
@@ -6640,39 +6233,43 @@ static int setlightfreq(struct gspca_dev *gspca_dev)
 		{MC501CB_NoFliker, MC501CB_NoFlikerScale,
 		 MC501CB_50HZ, MC501CB_50HZScale,
 		 MC501CB_60HZ, MC501CB_60HZScale},
-/* SENSOR_OV7620 9 */
+/* SENSOR_MI0360SOC 9 */
+		{mi360soc_AENoFlikerScale, mi360soc_AENoFliker,
+		 mi360soc_AE50HZScale, mi360soc_AE50HZ,
+		 mi360soc_AE60HZScale, mi360soc_AE60HZ},
+/* SENSOR_OV7620 10 */
 		{OV7620_NoFliker, OV7620_NoFliker,
 		 OV7620_50HZ, OV7620_50HZ,
 		 OV7620_60HZ, OV7620_60HZ},
-/* SENSOR_OV7630C 10 */
+/* SENSOR_OV7630C 11 */
 		{NULL, NULL,
 		 NULL, NULL,
 		 NULL, NULL},
-/* SENSOR_PAS106 11 */
+/* SENSOR_PAS106 12 */
 		{pas106b_NoFliker, pas106b_NoFliker,
 		 pas106b_50HZ, pas106b_50HZ,
 		 pas106b_60HZ, pas106b_60HZ},
-/* SENSOR_PAS202B 12 */
+/* SENSOR_PAS202B 13 */
 		{pas202b_NoFlikerScale, pas202b_NoFliker,
 		 pas202b_50HZScale, pas202b_50HZ,
 		 pas202b_60HZScale, pas202b_60HZ},
-/* SENSOR_PB0330 13 */
-		{pb0330_NoFliker, pb0330_NoFlikerScale,
-		 pb0330_50HZ, pb0330_50HZScale,
-		 pb0330_60HZ, pb0330_60HZScale},
-/* SENSOR_PO2030 14 */
+/* SENSOR_PB0330 14 */
+		{pb0330_NoFlikerScale, pb0330_NoFliker,
+		 pb0330_50HZScale, pb0330_50HZ,
+		 pb0330_60HZScale, pb0330_60HZ},
+/* SENSOR_PO2030 15 */
 		{PO2030_NoFliker, PO2030_NoFliker,
 		 PO2030_50HZ, PO2030_50HZ,
 		 PO2030_60HZ, PO2030_60HZ},
-/* SENSOR_TAS5130CK 15 */
-		{tas5130cxx_NoFliker, tas5130cxx_NoFlikerScale,
-		 tas5130cxx_50HZ, tas5130cxx_50HZScale,
-		 tas5130cxx_60HZ, tas5130cxx_60HZScale},
-/* SENSOR_TAS5130CXX 16 */
-		{tas5130cxx_NoFliker, tas5130cxx_NoFlikerScale,
-		 tas5130cxx_50HZ, tas5130cxx_50HZScale,
-		 tas5130cxx_60HZ, tas5130cxx_60HZScale},
-/* SENSOR_TAS5130C_VF0250 17 */
+/* SENSOR_TAS5130CK 16 */
+		{tas5130cxx_NoFlikerScale, tas5130cxx_NoFliker,
+		 tas5130cxx_50HZScale, tas5130cxx_50HZ,
+		 tas5130cxx_60HZScale, tas5130cxx_60HZ},
+/* SENSOR_TAS5130CXX 17 */
+		{tas5130cxx_NoFlikerScale, tas5130cxx_NoFliker,
+		 tas5130cxx_50HZScale, tas5130cxx_50HZ,
+		 tas5130cxx_60HZScale, tas5130cxx_60HZ},
+/* SENSOR_TAS5130C_VF0250 18 */
 		{tas5130c_vf0250_NoFliker, tas5130c_vf0250_NoFlikerScale,
 		 tas5130c_vf0250_50HZ, tas5130c_vf0250_50HZScale,
 		 tas5130c_vf0250_60HZ, tas5130c_vf0250_60HZScale},
@@ -6729,6 +6326,7 @@ static void send_unknown(struct usb_device *dev, int sensor)
 	case SENSOR_ADCM2700:
 	case SENSOR_GC0305:
 	case SENSOR_OV7620:
+	case SENSOR_MI0360SOC:
 	case SENSOR_PB0330:
 	case SENSOR_PO2030:
 		reg_w(dev, 0x0d, 0x003a);
@@ -6820,16 +6418,16 @@ static int vga_2wr_probe(struct gspca_dev *gspca_dev)
 	start_2wr_probe(dev, 0x0e);		/* PAS202BCB */
 	reg_w(dev, 0x08, 0x008d);
 	i2c_write(gspca_dev, 0x03, 0xaa, 0x00);
-	msleep(500);
+	msleep(50);
 	retword = i2c_read(gspca_dev, 0x03);
 	if (retword != 0)
 		return 0x0e;			/* PAS202BCB */
 
-	start_2wr_probe(dev, 0x02);		/* ?? */
+	start_2wr_probe(dev, 0x02);		/* TAS5130C */
 	i2c_write(gspca_dev, 0x01, 0xaa, 0x00);
 	retword = i2c_read(gspca_dev, 0x01);
 	if (retword != 0)
-		return 0x02;			/* ?? */
+		return 0x02;			/* TAS5130C */
 ov_check:
 	reg_r(gspca_dev, 0x0010);		/* ?? */
 	reg_r(gspca_dev, 0x0010);
@@ -6863,7 +6461,8 @@ struct sensor_by_chipset_revision {
 	__u8 internal_sensor_id;
 };
 static const struct sensor_by_chipset_revision chipset_revision_sensor[] = {
-	{0xc001, 0x13},		/* MI0360 */
+	{0xc000, 0x12},		/* TAS5130C */
+	{0xc001, 0x13},		/* MI0360SOC */
 	{0xe001, 0x13},
 	{0x8001, 0x13},
 	{0x8000, 0x14},		/* CS2102K */
@@ -6905,6 +6504,8 @@ static int vga_3wr_probe(struct gspca_dev *gspca_dev)
 	reg_r(gspca_dev, 0x0010);
 	/* value 0x4001 is meaningless */
 	if (retword != 0x4001) {
+		if ((retword & 0xff00) == 0x6400)
+			return 0x02;		/* TAS5130C */
 		for (i = 0; i < ARRAY_SIZE(chipset_revision_sensor); i++) {
 			if (chipset_revision_sensor[i].revision == retword) {
 				sd->chip_revision = retword;
@@ -6915,7 +6516,7 @@ static int vga_3wr_probe(struct gspca_dev *gspca_dev)
 		}
 	}
 
-	reg_w(dev, 0x01, 0x0000);	/* check ?? */
+	reg_w(dev, 0x01, 0x0000);	/* check PB0330 */
 	reg_w(dev, 0x01, 0x0001);
 	reg_w(dev, 0xdd, 0x008b);
 	reg_w(dev, 0x0a, 0x0010);
@@ -6924,7 +6525,7 @@ static int vga_3wr_probe(struct gspca_dev *gspca_dev)
 	retword = i2c_read(gspca_dev, 0x00);
 	if (retword != 0) {
 		PDEBUG(D_PROBE, "probe 3wr vga type 0a ?");
-		return 0x0a;			/* ?? */
+		return 0x0a;			/* PB0330 */
 	}
 
 	reg_w(dev, 0x01, 0x0000);
@@ -6963,7 +6564,6 @@ static int vga_3wr_probe(struct gspca_dev *gspca_dev)
 	reg_w(dev, 0x01, 0x0001);
 	reg_w(dev, 0xee, 0x008b);
 	reg_w(dev, 0x03, 0x0012);
-/*	msleep(150); */
 	reg_w(dev, 0x01, 0x0012);
 	reg_w(dev, 0x05, 0x0012);
 	retword = i2c_read(gspca_dev, 0x00) << 8;	/* ID 0 */
@@ -7025,7 +6625,7 @@ static int sd_config(struct gspca_dev *gspca_dev,
 	int vga = 1;		/* 1: vga, 0: sif */
 	static const __u8 gamma[SENSOR_MAX] = {
 		4,	/* SENSOR_ADCM2700 0 */
-		5,	/* SENSOR_CS2102 1 */
+		4,	/* SENSOR_CS2102 1 */
 		5,	/* SENSOR_CS2102K 2 */
 		4,	/* SENSOR_GC0305 3 */
 		4,	/* SENSOR_HDCS2020b 4 */
@@ -7033,15 +6633,16 @@ static int sd_config(struct gspca_dev *gspca_dev,
 		4,	/* SENSOR_HV7131C 6 */
 		4,	/* SENSOR_ICM105A 7 */
 		4,	/* SENSOR_MC501CB 8 */
-		3,	/* SENSOR_OV7620 9 */
-		4,	/* SENSOR_OV7630C 10 */
-		4,	/* SENSOR_PAS106 11 */
-		4,	/* SENSOR_PAS202B 12 */
-		4,	/* SENSOR_PB0330 13 */
-		4,	/* SENSOR_PO2030 14 */
-		4,	/* SENSOR_TAS5130CK 15 */
-		4,	/* SENSOR_TAS5130CXX 16 */
-		3,	/* SENSOR_TAS5130C_VF0250 17 */
+		4,	/* SENSOR_MI0360SOC 9 */
+		3,	/* SENSOR_OV7620 10 */
+		4,	/* SENSOR_OV7630C 11 */
+		4,	/* SENSOR_PAS106 12 */
+		4,	/* SENSOR_PAS202B 13 */
+		4,	/* SENSOR_PB0330 14 */
+		4,	/* SENSOR_PO2030 15 */
+		4,	/* SENSOR_TAS5130CK 16 */
+		3,	/* SENSOR_TAS5130CXX 17 */
+		3,	/* SENSOR_TAS5130C_VF0250 18 */
 	};
 
 	/* define some sensors from the vendor/product */
@@ -7065,7 +6666,7 @@ static int sd_config(struct gspca_dev *gspca_dev,
 				break;
 			default:
 				PDEBUG(D_PROBE,
-					"Sensor UNKNOW_0 force Tas5130");
+					"Sensor UNKNOWN_0 force Tas5130");
 				sd->sensor = SENSOR_TAS5130CXX;
 			}
 			break;
@@ -7073,6 +6674,10 @@ static int sd_config(struct gspca_dev *gspca_dev,
 			PDEBUG(D_PROBE, "Find Sensor HV7131B");
 			sd->sensor = SENSOR_HV7131B;
 			break;
+		case 0x02:
+			PDEBUG(D_PROBE, "Sensor TAS5130C");
+			sd->sensor = SENSOR_TAS5130CXX;
+			break;
 		case 0x04:
 			PDEBUG(D_PROBE, "Find Sensor CS2102");
 			sd->sensor = SENSOR_CS2102;
@@ -7103,7 +6708,7 @@ static int sd_config(struct gspca_dev *gspca_dev,
 			break;
 		case 0x10:
 		case 0x12:
-			PDEBUG(D_PROBE, "Find Sensor TAS5130");
+			PDEBUG(D_PROBE, "Find Sensor TAS5130C");
 			sd->sensor = SENSOR_TAS5130CXX;
 			break;
 		case 0x11:
@@ -7112,9 +6717,9 @@ static int sd_config(struct gspca_dev *gspca_dev,
 			break;
 		case 0x13:
 			PDEBUG(D_PROBE,
-				"Find Sensor MI0360. Chip revision %x",
+				"Find Sensor MI0360SOC. Chip revision %x",
 				sd->chip_revision);
-			sd->sensor = SENSOR_PB0330;
+			sd->sensor = SENSOR_MI0360SOC;
 			break;
 		case 0x14:
 			PDEBUG(D_PROBE,
@@ -7228,17 +6833,17 @@ static int sd_start(struct gspca_dev *gspca_dev)
 		{hv7131cxx_InitialScale, hv7131cxx_Initial},	/* 6 */
 		{icm105axx_InitialScale, icm105axx_Initial},	/* 7 */
 		{MC501CB_InitialScale, MC501CB_Initial},	/* 8 */
-		{OV7620_mode0, OV7620_mode1},			/* 9 */
-		{ov7630c_InitialScale, ov7630c_Initial},	/* 10 */
-		{pas106b_InitialScale, pas106b_Initial},	/* 11 */
-		{pas202b_Initial, pas202b_InitialScale},	/* 12 */
-		{pb0330xx_InitialScale, pb0330xx_Initial},	/* 13 */
-/* or		{pb03303x_InitialScale, pb03303x_Initial}, */
-		{PO2030_mode0, PO2030_mode1},			/* 14 */
-		{tas5130CK_InitialScale, tas5130CK_Initial},	/* 15 */
-		{tas5130cxx_InitialScale, tas5130cxx_Initial},	/* 16 */
+		{mi0360soc_Initial, mi0360soc_InitialScale},	/* 9 */
+		{OV7620_mode0, OV7620_mode1},			/* 10 */
+		{ov7630c_InitialScale, ov7630c_Initial},	/* 11 */
+		{pas106b_InitialScale, pas106b_Initial},	/* 12 */
+		{pas202b_Initial, pas202b_InitialScale},	/* 13 */
+		{pb0330_Initial, pb0330_InitialScale},		/* 14 */
+		{PO2030_mode0, PO2030_mode1},			/* 15 */
+		{tas5130CK_InitialScale, tas5130CK_Initial},	/* 16 */
+		{tas5130cxx_Initial, tas5130cxx_InitialScale},	/* 17 */
 		{tas5130c_vf0250_InitialScale, tas5130c_vf0250_Initial},
-								/* 17 */
+								/* 18 */
 	};
 
 	/* create the JPEG header */
@@ -7258,19 +6863,6 @@ static int sd_start(struct gspca_dev *gspca_dev)
 	case SENSOR_PAS106:
 		usb_exchange(gspca_dev, pas106b_Initial_com);
 		break;
-	case SENSOR_PB0330:
-		if (mode) {
-			if (sd->chip_revision == 0xc001
-			    || sd->chip_revision == 0xe001
-			    || sd->chip_revision == 0x8001)
-				zc3_init = pb03303x_Initial;
-		} else {
-			if (sd->chip_revision == 0xc001
-			    || sd->chip_revision == 0xe001
-			    || sd->chip_revision == 0x8001)
-				zc3_init = pb03303x_InitialScale;
-		}
-		break;
 	}
 	usb_exchange(gspca_dev, zc3_init);
 
@@ -7279,11 +6871,14 @@ static int sd_start(struct gspca_dev *gspca_dev)
 	case SENSOR_GC0305:
 	case SENSOR_OV7620:
 	case SENSOR_PO2030:
+	case SENSOR_TAS5130CXX:
 	case SENSOR_TAS5130C_VF0250:
 /*		msleep(100);			 * ?? */
 		reg_r(gspca_dev, 0x0002);	/* --> 0x40 */
 		reg_w(dev, 0x09, 0x01ad);	/* (from win traces) */
 		reg_w(dev, 0x15, 0x01ae);
+		if (sd->sensor == SENSOR_TAS5130CXX)
+			break;
 		reg_w(dev, 0x0d, 0x003a);
 		reg_w(dev, 0x02, 0x003b);
 		reg_w(dev, 0x00, 0x0038);
@@ -7300,6 +6895,7 @@ static int sd_start(struct gspca_dev *gspca_dev)
 		break;
 	case SENSOR_PAS202B:
 	case SENSOR_GC0305:
+	case SENSOR_TAS5130CXX:
 		reg_r(gspca_dev, 0x0008);
 		/* fall thru */
 	case SENSOR_PO2030:
@@ -7310,10 +6906,8 @@ static int sd_start(struct gspca_dev *gspca_dev)
 
 	/* set the gamma tables when not set */
 	switch (sd->sensor) {
-	case SENSOR_CS2102:		/* gamma set in xxx_Initial */
-	case SENSOR_CS2102K:
+	case SENSOR_CS2102K:		/* gamma set in xxx_Initial */
 	case SENSOR_HDCS2020b:
-	case SENSOR_PB0330:		/* pb with chip_revision - see above */
 	case SENSOR_OV7630C:
 	case SENSOR_TAS5130CK:
 		break;
@@ -7343,6 +6937,7 @@ static int sd_start(struct gspca_dev *gspca_dev)
 		reg_w(dev, 0x40, 0x0117);
 		break;
 	case SENSOR_GC0305:
+	case SENSOR_TAS5130CXX:
 		reg_w(dev, 0x09, 0x01ad);	/* (from win traces) */
 		reg_w(dev, 0x15, 0x01ae);
 		/* fall thru */
@@ -7365,7 +6960,7 @@ static int sd_start(struct gspca_dev *gspca_dev)
 	setautogain(gspca_dev);
 	switch (sd->sensor) {
 	case SENSOR_PO2030:
-		msleep(500);
+		msleep(50);
 		reg_r(gspca_dev, 0x0008);
 		reg_r(gspca_dev, 0x0007);
 		/*fall thru*/
@@ -7389,17 +6984,16 @@ static void sd_stop0(struct gspca_dev *gspca_dev)
 }
 
 static void sd_pkt_scan(struct gspca_dev *gspca_dev,
-			struct gspca_frame *frame,
-			__u8 *data,
+			u8 *data,
 			int len)
 {
 	struct sd *sd = (struct sd *) gspca_dev;
 
 	if (data[0] == 0xff && data[1] == 0xd8) {	/* start of frame */
-		frame = gspca_frame_add(gspca_dev, LAST_PACKET, frame,
-					data, 0);
+		gspca_frame_add(gspca_dev, LAST_PACKET,
+					NULL, 0);
 		/* put the JPEG header in the new frame */
-		gspca_frame_add(gspca_dev, FIRST_PACKET, frame,
+		gspca_frame_add(gspca_dev, FIRST_PACKET,
 			sd->jpeg_hdr, JPEG_HDR_SZ);
 
 		/* remove the webcam's header:
@@ -7411,7 +7005,7 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
 		data += 18;
 		len -= 18;
 	}
-	gspca_frame_add(gspca_dev, INTER_PACKET, frame, data, len);
+	gspca_frame_add(gspca_dev, INTER_PACKET, data, len);
 }
 
 static int sd_setbrightness(struct gspca_dev *gspca_dev, __s32 val)
@@ -7636,7 +7230,7 @@ static const __devinitdata struct usb_device_id device_table[] = {
 	{USB_DEVICE(0x0ac8, 0x0302), .driver_info = SENSOR_PAS106},
 	{USB_DEVICE(0x0ac8, 0x301b)},
 	{USB_DEVICE(0x0ac8, 0x303b)},
-	{USB_DEVICE(0x0ac8, 0x305b), .driver_info = SENSOR_TAS5130C_VF0250},
+	{USB_DEVICE(0x0ac8, 0x305b)},
 	{USB_DEVICE(0x0ac8, 0x307b)},
 	{USB_DEVICE(0x10fd, 0x0128)},
 	{USB_DEVICE(0x10fd, 0x804d)},
diff --git a/drivers/media/video/hdpvr/hdpvr-core.c b/drivers/media/video/hdpvr/hdpvr-core.c
index 1c9bc94c905c..51f393d03a46 100644
--- a/drivers/media/video/hdpvr/hdpvr-core.c
+++ b/drivers/media/video/hdpvr/hdpvr-core.c
@@ -145,7 +145,7 @@ static int device_authorization(struct hdpvr_device *dev)
 #ifdef HDPVR_DEBUG
 	else {
 		hex_dump_to_buffer(dev->usbc_buf, 46, 16, 1, print_buf,
-				   sizeof(print_buf), 0);
+				   5*buf_size+1, 0);
 		v4l2_dbg(MSG_INFO, hdpvr_debug, &dev->v4l2_dev,
 			 "Status request returned, len %d: %s\n",
 			 ret, print_buf);
@@ -168,13 +168,13 @@ static int device_authorization(struct hdpvr_device *dev)
 
 	response = dev->usbc_buf+38;
 #ifdef HDPVR_DEBUG
-	hex_dump_to_buffer(response, 8, 16, 1, print_buf, sizeof(print_buf), 0);
+	hex_dump_to_buffer(response, 8, 16, 1, print_buf, 5*buf_size+1, 0);
 	v4l2_dbg(MSG_INFO, hdpvr_debug, &dev->v4l2_dev, "challenge: %s\n",
 		 print_buf);
 #endif
 	challenge(response);
 #ifdef HDPVR_DEBUG
-	hex_dump_to_buffer(response, 8, 16, 1, print_buf, sizeof(print_buf), 0);
+	hex_dump_to_buffer(response, 8, 16, 1, print_buf, 5*buf_size+1, 0);
 	v4l2_dbg(MSG_INFO, hdpvr_debug, &dev->v4l2_dev, " response: %s\n",
 		 print_buf);
 #endif
@@ -376,8 +376,8 @@ static int hdpvr_probe(struct usb_interface *interface,
 	usb_set_intfdata(interface, dev);
 
 	/* let the user know what node this device is now attached to */
-	v4l2_info(&dev->v4l2_dev, "device now attached to /dev/video%d\n",
-		  dev->video_dev->minor);
+	v4l2_info(&dev->v4l2_dev, "device now attached to %s\n",
+		  video_device_node_name(dev->video_dev));
 	return 0;
 
 error:
@@ -391,13 +391,10 @@ error:
 static void hdpvr_disconnect(struct usb_interface *interface)
 {
 	struct hdpvr_device *dev;
-	int minor;
 
 	dev = usb_get_intfdata(interface);
 	usb_set_intfdata(interface, NULL);
 
-	minor = dev->video_dev->minor;
-
 	/* prevent more I/O from starting and stop any ongoing */
 	mutex_lock(&dev->io_mutex);
 	dev->status = STATUS_DISCONNECTED;
@@ -425,7 +422,8 @@ static void hdpvr_disconnect(struct usb_interface *interface)
 
 	atomic_dec(&dev_nr);
 
-	v4l2_info(&dev->v4l2_dev, "device /dev/video%d disconnected\n", minor);
+	v4l2_info(&dev->v4l2_dev, "device %s disconnected\n",
+		  video_device_node_name(dev->video_dev));
 
 	v4l2_device_unregister(&dev->v4l2_dev);
 	kfree(dev->usbc_buf);
diff --git a/drivers/media/video/hdpvr/hdpvr-video.c b/drivers/media/video/hdpvr/hdpvr-video.c
index 2eb9dc2ebe59..fdd782039e9d 100644
--- a/drivers/media/video/hdpvr/hdpvr-video.c
+++ b/drivers/media/video/hdpvr/hdpvr-video.c
@@ -139,7 +139,7 @@ int hdpvr_alloc_buffers(struct hdpvr_device *dev, uint count)
 		urb = usb_alloc_urb(0, GFP_KERNEL);
 		if (!urb) {
 			v4l2_err(&dev->v4l2_dev, "cannot allocate urb\n");
-			goto exit;
+			goto exit_urb;
 		}
 		buf->urb = urb;
 
@@ -148,7 +148,7 @@ int hdpvr_alloc_buffers(struct hdpvr_device *dev, uint count)
 		if (!mem) {
 			v4l2_err(&dev->v4l2_dev,
 				 "cannot allocate usb transfer buffer\n");
-			goto exit;
+			goto exit_urb_buffer;
 		}
 
 		usb_fill_bulk_urb(buf->urb, dev->udev,
@@ -161,6 +161,10 @@ int hdpvr_alloc_buffers(struct hdpvr_device *dev, uint count)
 		list_add_tail(&buf->buff_list, &dev->free_buff_list);
 	}
 	return 0;
+exit_urb_buffer:
+	usb_free_urb(urb);
+exit_urb:
+	kfree(buf);
 exit:
 	hdpvr_free_buffers(dev);
 	return retval;
@@ -519,7 +523,7 @@ static unsigned int hdpvr_poll(struct file *filp, poll_table *wait)
 
 	mutex_lock(&dev->io_mutex);
 
-	if (video_is_unregistered(dev->video_dev)) {
+	if (!video_is_registered(dev->video_dev)) {
 		mutex_unlock(&dev->io_mutex);
 		return -EIO;
 	}
diff --git a/drivers/media/video/hexium_gemini.c b/drivers/media/video/hexium_gemini.c
index 71c211402eb5..60d992ee2589 100644
--- a/drivers/media/video/hexium_gemini.c
+++ b/drivers/media/video/hexium_gemini.c
@@ -251,7 +251,7 @@ static int vidioc_s_input(struct file *file, void *fh, unsigned int input)
 
 	DEB_EE(("VIDIOC_S_INPUT %d.\n", input));
 
-	if (input < 0 || input >= HEXIUM_INPUTS)
+	if (input >= HEXIUM_INPUTS)
 		return -EINVAL;
 
 	hexium->cur_input = input;
diff --git a/drivers/media/video/hexium_orion.c b/drivers/media/video/hexium_orion.c
index 39d65ca41c62..938a1f8f880a 100644
--- a/drivers/media/video/hexium_orion.c
+++ b/drivers/media/video/hexium_orion.c
@@ -350,7 +350,7 @@ static int vidioc_s_input(struct file *file, void *fh, unsigned int input)
 	struct saa7146_dev *dev = ((struct saa7146_fh *)fh)->dev;
 	struct hexium *hexium = (struct hexium *) dev->ext_priv;
 
-	if (input < 0 || input >= HEXIUM_INPUTS)
+	if (input >= HEXIUM_INPUTS)
 		return -EINVAL;
 
 	hexium->cur_input = input;
diff --git a/drivers/media/video/ir-kbd-i2c.c b/drivers/media/video/ir-kbd-i2c.c
index 247d3115a9b7..b86e35386cee 100644
--- a/drivers/media/video/ir-kbd-i2c.c
+++ b/drivers/media/video/ir-kbd-i2c.c
@@ -275,7 +275,7 @@ static void ir_key_poll(struct IR_i2c *ir)
 	if (0 == rc) {
 		ir_input_nokey(ir->input, &ir->ir);
 	} else {
-		ir_input_keydown(ir->input, &ir->ir, ir_key, ir_raw);
+		ir_input_keydown(ir->input, &ir->ir, ir_key);
 	}
 }
 
@@ -299,7 +299,7 @@ static int ir_probe(struct i2c_client *client, const struct i2c_device_id *id)
 {
 	struct ir_scancode_table *ir_codes = NULL;
 	const char *name = NULL;
-	int ir_type;
+	int ir_type = 0;
 	struct IR_i2c *ir;
 	struct input_dev *input_dev;
 	struct i2c_adapter *adap = client->adapter;
@@ -353,10 +353,9 @@ static int ir_probe(struct i2c_client *client, const struct i2c_device_id *id)
 		ir_type     = IR_TYPE_RC5;
 		ir_codes    = &ir_codes_fusionhdtv_mce_table;
 		break;
-	case 0x7a:
+	case 0x0b:
 	case 0x47:
 	case 0x71:
-	case 0x2d:
 		if (adap->id == I2C_HW_B_CX2388x ||
 		    adap->id == I2C_HW_B_CX2341X) {
 			/* Handled by cx88-input */
@@ -381,10 +380,6 @@ static int ir_probe(struct i2c_client *client, const struct i2c_device_id *id)
 		ir_type     = IR_TYPE_OTHER;
 		ir_codes    = &ir_codes_avermedia_cardbus_table;
 		break;
-	default:
-		dprintk(1, DEVNAME ": Unsupported i2c address 0x%02x\n", addr);
-		err = -ENODEV;
-		goto err_out_free;
 	}
 
 	/* Let the caller override settings */
@@ -427,8 +422,8 @@ static int ir_probe(struct i2c_client *client, const struct i2c_device_id *id)
 	}
 
 	/* Make sure we are all setup before going on */
-	if (!name || !ir->get_key || !ir_codes) {
-		dprintk(1, DEVNAME ": Unsupported device at address 0x%02x\n",
+	if (!name || !ir->get_key || !ir_type || !ir_codes) {
+		dprintk(1, ": Unsupported device at address 0x%02x\n",
 			addr);
 		err = -ENODEV;
 		goto err_out_free;
@@ -443,12 +438,15 @@ static int ir_probe(struct i2c_client *client, const struct i2c_device_id *id)
 		 dev_name(&client->dev));
 
 	/* init + register input device */
-	ir_input_init(input_dev, &ir->ir, ir_type, ir->ir_codes);
+	err = ir_input_init(input_dev, &ir->ir, ir_type);
+	if (err < 0)
+		goto err_out_free;
+
 	input_dev->id.bustype = BUS_I2C;
 	input_dev->name       = ir->name;
 	input_dev->phys       = ir->phys;
 
-	err = input_register_device(ir->input);
+	err = ir_input_register(ir->input, ir->ir_codes);
 	if (err)
 		goto err_out_free;
 
@@ -462,7 +460,6 @@ static int ir_probe(struct i2c_client *client, const struct i2c_device_id *id)
 	return 0;
 
  err_out_free:
-	input_free_device(input_dev);
 	kfree(ir);
 	return err;
 }
@@ -475,7 +472,7 @@ static int ir_remove(struct i2c_client *client)
 	cancel_delayed_work_sync(&ir->work);
 
 	/* unregister device */
-	input_unregister_device(ir->input);
+	ir_input_unregister(ir->input);
 
 	/* free memory */
 	kfree(ir);
diff --git a/drivers/media/video/ivtv/ivtv-cards.c b/drivers/media/video/ivtv/ivtv-cards.c
index 4873b6ca5801..79d0fe4990d6 100644
--- a/drivers/media/video/ivtv/ivtv-cards.c
+++ b/drivers/media/video/ivtv/ivtv-cards.c
@@ -136,7 +136,8 @@ static const struct ivtv_card ivtv_card_pvr350 = {
 	.hw_audio = IVTV_HW_MSP34XX,
 	.hw_audio_ctrl = IVTV_HW_MSP34XX,
 	.hw_all = IVTV_HW_MSP34XX | IVTV_HW_SAA7115 |
-		  IVTV_HW_SAA7127 | IVTV_HW_TVEEPROM | IVTV_HW_TUNER,
+		  IVTV_HW_SAA7127 | IVTV_HW_TVEEPROM | IVTV_HW_TUNER |
+		  IVTV_HW_I2C_IR_RX_HAUP_EXT | IVTV_HW_I2C_IR_RX_HAUP_INT,
 	.video_inputs = {
 		{ IVTV_CARD_INPUT_VID_TUNER,  0, IVTV_SAA71XX_COMPOSITE4 },
 		{ IVTV_CARD_INPUT_SVIDEO1,    1, IVTV_SAA71XX_SVIDEO0    },
@@ -199,7 +200,9 @@ static const struct ivtv_card ivtv_card_pvr150 = {
 	.hw_audio_ctrl = IVTV_HW_CX25840,
 	.hw_muxer = IVTV_HW_WM8775,
 	.hw_all = IVTV_HW_WM8775 | IVTV_HW_CX25840 |
-		  IVTV_HW_TVEEPROM | IVTV_HW_TUNER,
+		  IVTV_HW_TVEEPROM | IVTV_HW_TUNER |
+		  IVTV_HW_I2C_IR_RX_HAUP_EXT | IVTV_HW_I2C_IR_RX_HAUP_INT |
+		  IVTV_HW_Z8F0811_IR_HAUP,
 	.video_inputs = {
 		{ IVTV_CARD_INPUT_VID_TUNER,  0, CX25840_COMPOSITE7 },
 		{ IVTV_CARD_INPUT_SVIDEO1,    1, CX25840_SVIDEO1    },
@@ -955,7 +958,8 @@ static const struct ivtv_card ivtv_card_avertv_mce116 = {
 	.hw_video = IVTV_HW_CX25840,
 	.hw_audio = IVTV_HW_CX25840,
 	.hw_audio_ctrl = IVTV_HW_CX25840,
-	.hw_all = IVTV_HW_CX25840 | IVTV_HW_TUNER | IVTV_HW_WM8739,
+	.hw_all = IVTV_HW_CX25840 | IVTV_HW_TUNER | IVTV_HW_WM8739 |
+		  IVTV_HW_I2C_IR_RX_AVER,
 	.video_inputs = {
 		{ IVTV_CARD_INPUT_VID_TUNER,  0, CX25840_COMPOSITE2 },
 		{ IVTV_CARD_INPUT_SVIDEO1,    1, CX25840_SVIDEO3    },
@@ -965,6 +969,7 @@ static const struct ivtv_card ivtv_card_avertv_mce116 = {
 		{ IVTV_CARD_INPUT_AUD_TUNER,  CX25840_AUDIO5       },
 		{ IVTV_CARD_INPUT_LINE_IN1,   CX25840_AUDIO_SERIAL, 1 },
 	},
+	.radio_input = { IVTV_CARD_INPUT_AUD_TUNER,  CX25840_AUDIO5 },
 	/* enable line-in */
 	.gpio_init = { .direction = 0xe000, .initial_value = 0x4000 },
 	.xceive_pin = 10,
@@ -1025,13 +1030,15 @@ static const struct ivtv_card ivtv_card_aver_pvr150 = {
 /* AVerMedia UltraTV 1500 MCE (newer non-cx88 version, M113 variant) card */
 
 static const struct ivtv_card_pci_info ivtv_pci_aver_ultra1500mce[] = {
-	{ PCI_DEVICE_ID_IVTV16, IVTV_PCI_ID_AVERMEDIA, 0xc019 },
+	{ PCI_DEVICE_ID_IVTV16, IVTV_PCI_ID_AVERMEDIA, 0xc019 }, /* NTSC */
+	{ PCI_DEVICE_ID_IVTV16, IVTV_PCI_ID_AVERMEDIA, 0xc01b }, /* PAL/SECAM */
 	{ 0, 0, 0 }
 };
 
 static const struct ivtv_card ivtv_card_aver_ultra1500mce = {
 	.type = IVTV_CARD_AVER_ULTRA1500MCE,
 	.name = "AVerMedia UltraTV 1500 MCE / AVerTV M113 Philips Tuner",
+	.comment = "For non-NTSC tuners, use the pal= or secam= module options",
 	.v4l2_capabilities = IVTV_CAP_ENCODER,
 	.hw_video = IVTV_HW_CX25840,
 	.hw_audio = IVTV_HW_CX25840,
@@ -1058,6 +1065,7 @@ static const struct ivtv_card ivtv_card_aver_ultra1500mce = {
 	.tuners = {
 		/* The UltraTV 1500 MCE has a Philips FM1236 MK5 TV/FM tuner */
 		{ .std = V4L2_STD_MN, .tuner = TUNER_PHILIPS_FM1236_MK3 },
+		{ .std = V4L2_STD_PAL_SECAM, .tuner = TUNER_PHILIPS_FM1216MK5 },
 	},
 	.pci_list = ivtv_pci_aver_ultra1500mce,
 	.i2c = &ivtv_i2c_std,
diff --git a/drivers/media/video/ivtv/ivtv-cards.h b/drivers/media/video/ivtv/ivtv-cards.h
index e99a0a255578..6148827ec885 100644
--- a/drivers/media/video/ivtv/ivtv-cards.h
+++ b/drivers/media/video/ivtv/ivtv-cards.h
@@ -87,26 +87,43 @@
 #define IVTV_PCI_ID_GOTVIEW1		0xffac
 #define IVTV_PCI_ID_GOTVIEW2 		0xffad
 
-/* hardware flags, no gaps allowed, IVTV_HW_GPIO must always be last */
-#define IVTV_HW_CX25840   (1 << 0)
-#define IVTV_HW_SAA7115   (1 << 1)
-#define IVTV_HW_SAA7127   (1 << 2)
-#define IVTV_HW_MSP34XX   (1 << 3)
-#define IVTV_HW_TUNER     (1 << 4)
-#define IVTV_HW_WM8775    (1 << 5)
-#define IVTV_HW_CS53L32A  (1 << 6)
-#define IVTV_HW_TVEEPROM  (1 << 7)
-#define IVTV_HW_SAA7114   (1 << 8)
-#define IVTV_HW_UPD64031A (1 << 9)
-#define IVTV_HW_UPD6408X  (1 << 10)
-#define IVTV_HW_SAA717X   (1 << 11)
-#define IVTV_HW_WM8739    (1 << 12)
-#define IVTV_HW_VP27SMPX  (1 << 13)
-#define IVTV_HW_M52790    (1 << 14)
-#define IVTV_HW_GPIO      (1 << 15)
+/* hardware flags, no gaps allowed */
+#define IVTV_HW_CX25840			(1 << 0)
+#define IVTV_HW_SAA7115			(1 << 1)
+#define IVTV_HW_SAA7127			(1 << 2)
+#define IVTV_HW_MSP34XX			(1 << 3)
+#define IVTV_HW_TUNER			(1 << 4)
+#define IVTV_HW_WM8775			(1 << 5)
+#define IVTV_HW_CS53L32A		(1 << 6)
+#define IVTV_HW_TVEEPROM		(1 << 7)
+#define IVTV_HW_SAA7114			(1 << 8)
+#define IVTV_HW_UPD64031A		(1 << 9)
+#define IVTV_HW_UPD6408X		(1 << 10)
+#define IVTV_HW_SAA717X			(1 << 11)
+#define IVTV_HW_WM8739			(1 << 12)
+#define IVTV_HW_VP27SMPX		(1 << 13)
+#define IVTV_HW_M52790			(1 << 14)
+#define IVTV_HW_GPIO			(1 << 15)
+#define IVTV_HW_I2C_IR_RX_AVER		(1 << 16)
+#define IVTV_HW_I2C_IR_RX_HAUP_EXT	(1 << 17) /* External before internal */
+#define IVTV_HW_I2C_IR_RX_HAUP_INT	(1 << 18)
+#define IVTV_HW_Z8F0811_IR_TX_HAUP	(1 << 19)
+#define IVTV_HW_Z8F0811_IR_RX_HAUP	(1 << 20)
+
+#define IVTV_HW_Z8F0811_IR_HAUP	(IVTV_HW_Z8F0811_IR_RX_HAUP | \
+				 IVTV_HW_Z8F0811_IR_TX_HAUP)
 
 #define IVTV_HW_SAA711X   (IVTV_HW_SAA7115 | IVTV_HW_SAA7114)
 
+#define IVTV_HW_IR_RX_ANY (IVTV_HW_I2C_IR_RX_AVER | \
+			   IVTV_HW_I2C_IR_RX_HAUP_EXT | \
+			   IVTV_HW_I2C_IR_RX_HAUP_INT | \
+			   IVTV_HW_Z8F0811_IR_RX_HAUP)
+
+#define IVTV_HW_IR_TX_ANY (IVTV_HW_Z8F0811_IR_TX_HAUP)
+
+#define IVTV_HW_IR_ANY	  (IVTV_HW_IR_RX_ANY | IVTV_HW_IR_TX_ANY)
+
 /* video inputs */
 #define	IVTV_CARD_INPUT_VID_TUNER	1
 #define	IVTV_CARD_INPUT_SVIDEO1 	2
diff --git a/drivers/media/video/ivtv/ivtv-driver.c b/drivers/media/video/ivtv/ivtv-driver.c
index 463ec3457d7b..347c3344f56d 100644
--- a/drivers/media/video/ivtv/ivtv-driver.c
+++ b/drivers/media/video/ivtv/ivtv-driver.c
@@ -91,10 +91,15 @@ static int radio[IVTV_MAX_CARDS] = { -1, -1, -1, -1, -1, -1, -1, -1,
 				     -1, -1, -1, -1, -1, -1, -1, -1,
 				     -1, -1, -1, -1, -1, -1, -1, -1,
 				     -1, -1, -1, -1, -1, -1, -1, -1 };
+static int i2c_clock_period[IVTV_MAX_CARDS] = { -1, -1, -1, -1, -1, -1, -1, -1,
+					       -1, -1, -1, -1, -1, -1, -1, -1,
+					       -1, -1, -1, -1, -1, -1, -1, -1,
+					       -1, -1, -1, -1, -1, -1, -1, -1 };
 
 static unsigned int cardtype_c = 1;
 static unsigned int tuner_c = 1;
 static unsigned int radio_c = 1;
+static unsigned int i2c_clock_period_c = 1;
 static char pal[] = "---";
 static char secam[] = "--";
 static char ntsc[] = "-";
@@ -151,6 +156,7 @@ module_param(dec_vbi_buffers, int, 0644);
 
 module_param(tunertype, int, 0644);
 module_param(newi2c, int, 0644);
+module_param_array(i2c_clock_period, int, &i2c_clock_period_c, 0644);
 
 MODULE_PARM_DESC(tuner, "Tuner type selection,\n"
 			"\t\t\tsee tuner.h for values");
@@ -245,6 +251,10 @@ MODULE_PARM_DESC(newi2c,
 		 "Use new I2C implementation\n"
 		 "\t\t\t-1 is autodetect, 0 is off, 1 is on\n"
 		 "\t\t\tDefault is autodetect");
+MODULE_PARM_DESC(i2c_clock_period,
+		 "Period of SCL for the I2C bus controlled by the CX23415/6\n"
+		 "\t\t\tMin: 10 usec (100 kHz), Max: 4500 usec (222 Hz)\n"
+		 "\t\t\tDefault: " __stringify(IVTV_DEFAULT_I2C_CLOCK_PERIOD));
 
 MODULE_PARM_DESC(ivtv_first_minor, "Set device node number assigned to first card");
 
@@ -600,6 +610,15 @@ static void ivtv_process_options(struct ivtv *itv)
 	itv->options.cardtype = cardtype[itv->instance];
 	itv->options.tuner = tuner[itv->instance];
 	itv->options.radio = radio[itv->instance];
+
+	itv->options.i2c_clock_period = i2c_clock_period[itv->instance];
+	if (itv->options.i2c_clock_period == -1)
+		itv->options.i2c_clock_period = IVTV_DEFAULT_I2C_CLOCK_PERIOD;
+	else if (itv->options.i2c_clock_period < 10)
+		itv->options.i2c_clock_period = 10;
+	else if (itv->options.i2c_clock_period > 4500)
+		itv->options.i2c_clock_period = 4500;
+
 	itv->options.newi2c = newi2c;
 	if (tunertype < -1 || tunertype > 1) {
 		IVTV_WARN("Invalid tunertype argument, will autodetect instead\n");
@@ -865,6 +884,10 @@ static void ivtv_load_and_init_modules(struct ivtv *itv)
 			itv->hw_flags |= device;
 	}
 
+	/* probe for legacy IR controllers that aren't in card definitions */
+	if ((itv->hw_flags & IVTV_HW_IR_ANY) == 0)
+		ivtv_i2c_new_ir_legacy(itv);
+
 	if (itv->card->hw_all & IVTV_HW_CX25840)
 		itv->sd_video = ivtv_find_hw(itv, IVTV_HW_CX25840);
 	else if (itv->card->hw_all & IVTV_HW_SAA717X)
@@ -1361,7 +1384,7 @@ static struct pci_driver ivtv_pci_driver = {
       .remove =   ivtv_remove,
 };
 
-static int module_start(void)
+static int __init module_start(void)
 {
 	printk(KERN_INFO "ivtv: Start initialization, version %s\n", IVTV_VERSION);
 
@@ -1385,7 +1408,7 @@ static int module_start(void)
 	return 0;
 }
 
-static void module_cleanup(void)
+static void __exit module_cleanup(void)
 {
 	pci_unregister_driver(&ivtv_pci_driver);
 }
diff --git a/drivers/media/video/ivtv/ivtv-driver.h b/drivers/media/video/ivtv/ivtv-driver.h
index 440f7328a7ed..e4816da6482b 100644
--- a/drivers/media/video/ivtv/ivtv-driver.h
+++ b/drivers/media/video/ivtv/ivtv-driver.h
@@ -64,6 +64,7 @@
 #include <media/v4l2-device.h>
 #include <media/tuner.h>
 #include <media/cx2341x.h>
+#include <media/ir-kbd-i2c.h>
 
 #include <linux/ivtv.h>
 
@@ -176,12 +177,16 @@ extern int ivtv_debug;
 
 #define IVTV_MAX_PGM_INDEX (400)
 
+/* Default I2C SCL period in microseconds */
+#define IVTV_DEFAULT_I2C_CLOCK_PERIOD	20
+
 struct ivtv_options {
 	int kilobytes[IVTV_MAX_STREAMS];        /* size in kilobytes of each stream */
 	int cardtype;				/* force card type on load */
 	int tuner;				/* set tuner on load */
 	int radio;				/* enable/disable radio */
 	int newi2c;				/* new I2C algorithm */
+	int i2c_clock_period;			/* period of SCL for I2C bus */
 };
 
 /* ivtv-specific mailbox template */
@@ -677,6 +682,7 @@ struct ivtv {
 	int i2c_state;                  /* i2c bit state */
 	struct mutex i2c_bus_lock;      /* lock i2c bus */
 
+	struct IR_i2c_init_data ir_i2c_init_data;
 
 	/* Program Index information */
 	u32 pgm_info_offset;            /* start of pgm info in encoder memory */
diff --git a/drivers/media/video/ivtv/ivtv-fileops.c b/drivers/media/video/ivtv/ivtv-fileops.c
index e707ef3086b2..babcabd73c08 100644
--- a/drivers/media/video/ivtv/ivtv-fileops.c
+++ b/drivers/media/video/ivtv/ivtv-fileops.c
@@ -985,8 +985,8 @@ int ivtv_v4l2_open(struct file *filp)
 
 	mutex_lock(&itv->serialize_lock);
 	if (ivtv_init_on_first_open(itv)) {
-		IVTV_ERR("Failed to initialize on minor %d\n",
-				vdev->minor);
+		IVTV_ERR("Failed to initialize on device %s\n",
+			 video_device_node_name(vdev));
 		mutex_unlock(&itv->serialize_lock);
 		return -ENXIO;
 	}
diff --git a/drivers/media/video/ivtv/ivtv-i2c.c b/drivers/media/video/ivtv/ivtv-i2c.c
index b9c71e61f7d6..2ee03c2a1b58 100644
--- a/drivers/media/video/ivtv/ivtv-i2c.c
+++ b/drivers/media/video/ivtv/ivtv-i2c.c
@@ -88,6 +88,11 @@
 #define IVTV_UPD64083_I2C_ADDR 		0x5c
 #define IVTV_VP27SMPX_I2C_ADDR      	0x5b
 #define IVTV_M52790_I2C_ADDR      	0x48
+#define IVTV_AVERMEDIA_IR_RX_I2C_ADDR	0x40
+#define IVTV_HAUP_EXT_IR_RX_I2C_ADDR 	0x1a
+#define IVTV_HAUP_INT_IR_RX_I2C_ADDR 	0x18
+#define IVTV_Z8F0811_IR_TX_I2C_ADDR	0x70
+#define IVTV_Z8F0811_IR_RX_I2C_ADDR	0x71
 
 /* This array should match the IVTV_HW_ defines */
 static const u8 hw_addrs[] = {
@@ -106,7 +111,12 @@ static const u8 hw_addrs[] = {
 	IVTV_WM8739_I2C_ADDR,
 	IVTV_VP27SMPX_I2C_ADDR,
 	IVTV_M52790_I2C_ADDR,
-	0 		/* IVTV_HW_GPIO dummy driver ID */
+	0,				/* IVTV_HW_GPIO dummy driver ID */
+	IVTV_AVERMEDIA_IR_RX_I2C_ADDR,	/* IVTV_HW_I2C_IR_RX_AVER */
+	IVTV_HAUP_EXT_IR_RX_I2C_ADDR,	/* IVTV_HW_I2C_IR_RX_HAUP_EXT */
+	IVTV_HAUP_INT_IR_RX_I2C_ADDR,	/* IVTV_HW_I2C_IR_RX_HAUP_INT */
+	IVTV_Z8F0811_IR_TX_I2C_ADDR,	/* IVTV_HW_Z8F0811_IR_TX_HAUP */
+	IVTV_Z8F0811_IR_RX_I2C_ADDR,	/* IVTV_HW_Z8F0811_IR_RX_HAUP */
 };
 
 /* This array should match the IVTV_HW_ defines */
@@ -126,7 +136,12 @@ static const char *hw_modules[] = {
 	"wm8739",
 	"vp27smpx",
 	"m52790",
-	NULL
+	NULL,
+	NULL,		/* IVTV_HW_I2C_IR_RX_AVER */
+	NULL,		/* IVTV_HW_I2C_IR_RX_HAUP_EXT */
+	NULL,		/* IVTV_HW_I2C_IR_RX_HAUP_INT */
+	NULL,		/* IVTV_HW_Z8F0811_IR_TX_HAUP */
+	NULL,		/* IVTV_HW_Z8F0811_IR_RX_HAUP */
 };
 
 /* This array should match the IVTV_HW_ defines */
@@ -147,8 +162,95 @@ static const char * const hw_devicenames[] = {
 	"vp27smpx",
 	"m52790",
 	"gpio",
+	"ir_video",		/* IVTV_HW_I2C_IR_RX_AVER */
+	"ir_video",		/* IVTV_HW_I2C_IR_RX_HAUP_EXT */
+	"ir_video",		/* IVTV_HW_I2C_IR_RX_HAUP_INT */
+	"ir_tx_z8f0811_haup",	/* IVTV_HW_Z8F0811_IR_TX_HAUP */
+	"ir_rx_z8f0811_haup",	/* IVTV_HW_Z8F0811_IR_RX_HAUP */
 };
 
+static int ivtv_i2c_new_ir(struct ivtv *itv, u32 hw, const char *type, u8 addr)
+{
+	struct i2c_board_info info;
+	struct i2c_adapter *adap = &itv->i2c_adap;
+	struct IR_i2c_init_data *init_data = &itv->ir_i2c_init_data;
+	unsigned short addr_list[2] = { addr, I2C_CLIENT_END };
+
+	/* Only allow one IR transmitter to be registered per board */
+	if (hw & IVTV_HW_IR_TX_ANY) {
+		if (itv->hw_flags & IVTV_HW_IR_TX_ANY)
+			return -1;
+		memset(&info, 0, sizeof(struct i2c_board_info));
+		strlcpy(info.type, type, I2C_NAME_SIZE);
+		return i2c_new_probed_device(adap, &info, addr_list) == NULL
+								     ? -1 : 0;
+	}
+
+	/* Only allow one IR receiver to be registered per board */
+	if (itv->hw_flags & IVTV_HW_IR_RX_ANY)
+		return -1;
+
+	/* Our default information for ir-kbd-i2c.c to use */
+	switch (hw) {
+	case IVTV_HW_I2C_IR_RX_AVER:
+		init_data->ir_codes = &ir_codes_avermedia_cardbus_table;
+		init_data->internal_get_key_func =
+					IR_KBD_GET_KEY_AVERMEDIA_CARDBUS;
+		init_data->type = IR_TYPE_OTHER;
+		init_data->name = "AVerMedia AVerTV card";
+		break;
+	case IVTV_HW_I2C_IR_RX_HAUP_EXT:
+	case IVTV_HW_I2C_IR_RX_HAUP_INT:
+		/* Default to old black remote */
+		init_data->ir_codes = &ir_codes_rc5_tv_table;
+		init_data->internal_get_key_func = IR_KBD_GET_KEY_HAUP;
+		init_data->type = IR_TYPE_RC5;
+		init_data->name = itv->card_name;
+		break;
+	case IVTV_HW_Z8F0811_IR_RX_HAUP:
+		/* Default to grey remote */
+		init_data->ir_codes = &ir_codes_hauppauge_new_table;
+		init_data->internal_get_key_func = IR_KBD_GET_KEY_HAUP_XVR;
+		init_data->type = IR_TYPE_RC5;
+		init_data->name = itv->card_name;
+		break;
+	}
+
+	memset(&info, 0, sizeof(struct i2c_board_info));
+	info.platform_data = init_data;
+	strlcpy(info.type, type, I2C_NAME_SIZE);
+
+	return i2c_new_probed_device(adap, &info, addr_list) == NULL ? -1 : 0;
+}
+
+/* Instantiate the IR receiver device using probing -- undesirable */
+struct i2c_client *ivtv_i2c_new_ir_legacy(struct ivtv *itv)
+{
+	struct i2c_board_info info;
+	/*
+	 * The external IR receiver is at i2c address 0x34.
+	 * The internal IR receiver is at i2c address 0x30.
+	 *
+	 * In theory, both can be fitted, and Hauppauge suggests an external
+	 * overrides an internal.  That's why we probe 0x1a (~0x34) first. CB
+	 *
+	 * Some of these addresses we probe may collide with other i2c address
+	 * allocations, so this function must be called after all other i2c
+	 * devices we care about are registered.
+	 */
+	const unsigned short addr_list[] = {
+		0x1a,	/* Hauppauge IR external - collides with WM8739 */
+		0x18,	/* Hauppauge IR internal */
+		0x71,	/* Hauppauge IR (PVR150) */
+		0x6b,	/* Adaptec IR */
+		I2C_CLIENT_END
+	};
+
+	memset(&info, 0, sizeof(struct i2c_board_info));
+	strlcpy(info.type, "ir_video", I2C_NAME_SIZE);
+	return i2c_new_probed_device(&itv->i2c_adap, &info, addr_list);
+}
+
 int ivtv_i2c_register(struct ivtv *itv, unsigned idx)
 {
 	struct v4l2_subdev *sd;
@@ -178,8 +280,15 @@ int ivtv_i2c_register(struct ivtv *itv, unsigned idx)
 			sd->grp_id = 1 << idx;
 		return sd ? 0 : -1;
 	}
+
+	if (hw & IVTV_HW_IR_ANY)
+		return ivtv_i2c_new_ir(itv, hw, type, hw_addrs[idx]);
+
+	/* Is it not an I2C device or one we do not wish to register? */
 	if (!hw_addrs[idx])
 		return -1;
+
+	/* It's an I2C device other than an analog tuner or IR chip */
 	if (hw == IVTV_HW_UPD64031A || hw == IVTV_HW_UPD6408X) {
 		sd = v4l2_i2c_new_subdev(&itv->v4l2_dev,
 				adap, mod, type, 0, I2C_ADDRS(hw_addrs[idx]));
@@ -564,20 +673,22 @@ static struct i2c_adapter ivtv_i2c_adap_template = {
 	.owner = THIS_MODULE,
 };
 
+#define IVTV_ALGO_BIT_TIMEOUT	(2)	/* seconds */
+
 static const struct i2c_algo_bit_data ivtv_i2c_algo_template = {
 	.setsda		= ivtv_setsda_old,
 	.setscl		= ivtv_setscl_old,
 	.getsda		= ivtv_getsda_old,
 	.getscl		= ivtv_getscl_old,
-	.udelay		= 10,
-	.timeout	= 200,
+	.udelay		= IVTV_DEFAULT_I2C_CLOCK_PERIOD / 2,  /* microseconds */
+	.timeout	= IVTV_ALGO_BIT_TIMEOUT * HZ,         /* jiffies */
 };
 
 static struct i2c_client ivtv_i2c_client_template = {
 	.name = "ivtv internal",
 };
 
-/* init + register i2c adapter + instantiate IR receiver */
+/* init + register i2c adapter */
 int init_ivtv_i2c(struct ivtv *itv)
 {
 	int retval;
@@ -585,11 +696,10 @@ int init_ivtv_i2c(struct ivtv *itv)
 	IVTV_DEBUG_I2C("i2c init\n");
 
 	/* Sanity checks for the I2C hardware arrays. They must be the
-	 * same size and GPIO must be the last entry.
+	 * same size.
 	 */
 	if (ARRAY_SIZE(hw_devicenames) != ARRAY_SIZE(hw_addrs) ||
-	    ARRAY_SIZE(hw_devicenames) != ARRAY_SIZE(hw_modules) ||
-	    IVTV_HW_GPIO != (1 << (ARRAY_SIZE(hw_addrs) - 1))) {
+	    ARRAY_SIZE(hw_devicenames) != ARRAY_SIZE(hw_modules)) {
 		IVTV_ERR("Mismatched I2C hardware arrays\n");
 		return -ENODEV;
 	}
@@ -602,6 +712,7 @@ int init_ivtv_i2c(struct ivtv *itv)
 		memcpy(&itv->i2c_algo, &ivtv_i2c_algo_template,
 		       sizeof(struct i2c_algo_bit_data));
 	}
+	itv->i2c_algo.udelay = itv->options.i2c_clock_period / 2;
 	itv->i2c_algo.data = itv;
 	itv->i2c_adap.algo_data = &itv->i2c_algo;
 
@@ -623,32 +734,6 @@ int init_ivtv_i2c(struct ivtv *itv)
 	else
 		retval = i2c_bit_add_bus(&itv->i2c_adap);
 
-	/* Instantiate the IR receiver device, if present */
-	if (retval == 0) {
-		struct i2c_board_info info;
-		/* The external IR receiver is at i2c address 0x34 (0x35 for
-		   reads).  Future Hauppauge cards will have an internal
-		   receiver at 0x30 (0x31 for reads).  In theory, both can be
-		   fitted, and Hauppauge suggest an external overrides an
-		   internal.
-
-		   That's why we probe 0x1a (~0x34) first. CB
-		*/
-		const unsigned short addr_list[] = {
-			0x1a,	/* Hauppauge IR external */
-			0x18,	/* Hauppauge IR internal */
-			0x71,	/* Hauppauge IR (PVR150) */
-			0x64,	/* Pixelview IR */
-			0x30,	/* KNC ONE IR */
-			0x6b,	/* Adaptec IR */
-			I2C_CLIENT_END
-		};
-
-		memset(&info, 0, sizeof(struct i2c_board_info));
-		strlcpy(info.type, "ir_video", I2C_NAME_SIZE);
-		i2c_new_probed_device(&itv->i2c_adap, &info, addr_list);
-	}
-
 	return retval;
 }
 
diff --git a/drivers/media/video/ivtv/ivtv-i2c.h b/drivers/media/video/ivtv/ivtv-i2c.h
index 396928a06a54..9332920ca4ff 100644
--- a/drivers/media/video/ivtv/ivtv-i2c.h
+++ b/drivers/media/video/ivtv/ivtv-i2c.h
@@ -21,6 +21,7 @@
 #ifndef IVTV_I2C_H
 #define IVTV_I2C_H
 
+struct i2c_client *ivtv_i2c_new_ir_legacy(struct ivtv *itv);
 int ivtv_i2c_register(struct ivtv *itv, unsigned idx);
 struct v4l2_subdev *ivtv_find_hw(struct ivtv *itv, u32 hw);
 
diff --git a/drivers/media/video/ivtv/ivtv-streams.c b/drivers/media/video/ivtv/ivtv-streams.c
index 67699e3f2aaa..e12c6022373e 100644
--- a/drivers/media/video/ivtv/ivtv-streams.c
+++ b/drivers/media/video/ivtv/ivtv-streams.c
@@ -245,6 +245,7 @@ static int ivtv_reg_dev(struct ivtv *itv, int type)
 {
 	struct ivtv_stream *s = &itv->streams[type];
 	int vfl_type = ivtv_stream_info[type].vfl_type;
+	const char *name;
 	int num;
 
 	if (s->vdev == NULL)
@@ -268,24 +269,24 @@ static int ivtv_reg_dev(struct ivtv *itv, int type)
 		s->vdev = NULL;
 		return -ENOMEM;
 	}
-	num = s->vdev->num;
+	name = video_device_node_name(s->vdev);
 
 	switch (vfl_type) {
 	case VFL_TYPE_GRABBER:
-		IVTV_INFO("Registered device video%d for %s (%d kB)\n",
-			num, s->name, itv->options.kilobytes[type]);
+		IVTV_INFO("Registered device %s for %s (%d kB)\n",
+			name, s->name, itv->options.kilobytes[type]);
 		break;
 	case VFL_TYPE_RADIO:
-		IVTV_INFO("Registered device radio%d for %s\n",
-			num, s->name);
+		IVTV_INFO("Registered device %s for %s\n",
+			name, s->name);
 		break;
 	case VFL_TYPE_VBI:
 		if (itv->options.kilobytes[type])
-			IVTV_INFO("Registered device vbi%d for %s (%d kB)\n",
-				num, s->name, itv->options.kilobytes[type]);
+			IVTV_INFO("Registered device %s for %s (%d kB)\n",
+				name, s->name, itv->options.kilobytes[type]);
 		else
-			IVTV_INFO("Registered device vbi%d for %s\n",
-				num, s->name);
+			IVTV_INFO("Registered device %s for %s\n",
+				name, s->name);
 		break;
 	}
 	return 0;
diff --git a/drivers/media/video/meye.c b/drivers/media/video/meye.c
index 01e1eefcf1eb..b421858ccf90 100644
--- a/drivers/media/video/meye.c
+++ b/drivers/media/video/meye.c
@@ -800,8 +800,8 @@ again:
 		return IRQ_HANDLED;
 
 	if (meye.mchip_mode == MCHIP_HIC_MODE_CONT_OUT) {
-		if (kfifo_get(meye.grabq, (unsigned char *)&reqnr,
-			      sizeof(int)) != sizeof(int)) {
+		if (kfifo_out_locked(&meye.grabq, (unsigned char *)&reqnr,
+			      sizeof(int), &meye.grabq_lock) != sizeof(int)) {
 			mchip_free_frame();
 			return IRQ_HANDLED;
 		}
@@ -811,7 +811,8 @@ again:
 		meye.grab_buffer[reqnr].state = MEYE_BUF_DONE;
 		do_gettimeofday(&meye.grab_buffer[reqnr].timestamp);
 		meye.grab_buffer[reqnr].sequence = sequence++;
-		kfifo_put(meye.doneq, (unsigned char *)&reqnr, sizeof(int));
+		kfifo_in_locked(&meye.doneq, (unsigned char *)&reqnr,
+				sizeof(int), &meye.doneq_lock);
 		wake_up_interruptible(&meye.proc_list);
 	} else {
 		int size;
@@ -820,8 +821,8 @@ again:
 			mchip_free_frame();
 			goto again;
 		}
-		if (kfifo_get(meye.grabq, (unsigned char *)&reqnr,
-			      sizeof(int)) != sizeof(int)) {
+		if (kfifo_out_locked(&meye.grabq, (unsigned char *)&reqnr,
+			      sizeof(int), &meye.grabq_lock) != sizeof(int)) {
 			mchip_free_frame();
 			goto again;
 		}
@@ -831,7 +832,8 @@ again:
 		meye.grab_buffer[reqnr].state = MEYE_BUF_DONE;
 		do_gettimeofday(&meye.grab_buffer[reqnr].timestamp);
 		meye.grab_buffer[reqnr].sequence = sequence++;
-		kfifo_put(meye.doneq, (unsigned char *)&reqnr, sizeof(int));
+		kfifo_in_locked(&meye.doneq, (unsigned char *)&reqnr,
+				sizeof(int), &meye.doneq_lock);
 		wake_up_interruptible(&meye.proc_list);
 	}
 	mchip_free_frame();
@@ -859,8 +861,8 @@ static int meye_open(struct file *file)
 
 	for (i = 0; i < MEYE_MAX_BUFNBRS; i++)
 		meye.grab_buffer[i].state = MEYE_BUF_UNUSED;
-	kfifo_reset(meye.grabq);
-	kfifo_reset(meye.doneq);
+	kfifo_reset(&meye.grabq);
+	kfifo_reset(&meye.doneq);
 	return 0;
 }
 
@@ -933,7 +935,8 @@ static int meyeioc_qbuf_capt(int *nb)
 		mchip_cont_compression_start();
 
 	meye.grab_buffer[*nb].state = MEYE_BUF_USING;
-	kfifo_put(meye.grabq, (unsigned char *)nb, sizeof(int));
+	kfifo_in_locked(&meye.grabq, (unsigned char *)nb, sizeof(int),
+			 &meye.grabq_lock);
 	mutex_unlock(&meye.lock);
 
 	return 0;
@@ -965,7 +968,9 @@ static int meyeioc_sync(struct file *file, void *fh, int *i)
 		/* fall through */
 	case MEYE_BUF_DONE:
 		meye.grab_buffer[*i].state = MEYE_BUF_UNUSED;
-		kfifo_get(meye.doneq, (unsigned char *)&unused, sizeof(int));
+		if (kfifo_out_locked(&meye.doneq, (unsigned char *)&unused,
+				sizeof(int), &meye.doneq_lock) != sizeof(int))
+					break;
 	}
 	*i = meye.grab_buffer[*i].size;
 	mutex_unlock(&meye.lock);
@@ -1452,7 +1457,8 @@ static int vidioc_qbuf(struct file *file, void *fh, struct v4l2_buffer *buf)
 	buf->flags |= V4L2_BUF_FLAG_QUEUED;
 	buf->flags &= ~V4L2_BUF_FLAG_DONE;
 	meye.grab_buffer[buf->index].state = MEYE_BUF_USING;
-	kfifo_put(meye.grabq, (unsigned char *)&buf->index, sizeof(int));
+	kfifo_in_locked(&meye.grabq, (unsigned char *)&buf->index,
+			sizeof(int), &meye.grabq_lock);
 	mutex_unlock(&meye.lock);
 
 	return 0;
@@ -1467,19 +1473,19 @@ static int vidioc_dqbuf(struct file *file, void *fh, struct v4l2_buffer *buf)
 
 	mutex_lock(&meye.lock);
 
-	if (kfifo_len(meye.doneq) == 0 && file->f_flags & O_NONBLOCK) {
+	if (kfifo_len(&meye.doneq) == 0 && file->f_flags & O_NONBLOCK) {
 		mutex_unlock(&meye.lock);
 		return -EAGAIN;
 	}
 
 	if (wait_event_interruptible(meye.proc_list,
-				     kfifo_len(meye.doneq) != 0) < 0) {
+				     kfifo_len(&meye.doneq) != 0) < 0) {
 		mutex_unlock(&meye.lock);
 		return -EINTR;
 	}
 
-	if (!kfifo_get(meye.doneq, (unsigned char *)&reqnr,
-		       sizeof(int))) {
+	if (!kfifo_out_locked(&meye.doneq, (unsigned char *)&reqnr,
+		       sizeof(int), &meye.doneq_lock)) {
 		mutex_unlock(&meye.lock);
 		return -EBUSY;
 	}
@@ -1529,8 +1535,8 @@ static int vidioc_streamoff(struct file *file, void *fh, enum v4l2_buf_type i)
 {
 	mutex_lock(&meye.lock);
 	mchip_hic_stop();
-	kfifo_reset(meye.grabq);
-	kfifo_reset(meye.doneq);
+	kfifo_reset(&meye.grabq);
+	kfifo_reset(&meye.doneq);
 
 	for (i = 0; i < MEYE_MAX_BUFNBRS; i++)
 		meye.grab_buffer[i].state = MEYE_BUF_UNUSED;
@@ -1572,7 +1578,7 @@ static unsigned int meye_poll(struct file *file, poll_table *wait)
 
 	mutex_lock(&meye.lock);
 	poll_wait(file, &meye.proc_list, wait);
-	if (kfifo_len(meye.doneq))
+	if (kfifo_len(&meye.doneq))
 		res = POLLIN | POLLRDNORM;
 	mutex_unlock(&meye.lock);
 	return res;
@@ -1681,7 +1687,6 @@ static struct video_device meye_template = {
 	.fops		= &meye_fops,
 	.ioctl_ops 	= &meye_ioctl_ops,
 	.release	= video_device_release,
-	.minor		= -1,
 };
 
 #ifdef CONFIG_PM
@@ -1746,16 +1751,14 @@ static int __devinit meye_probe(struct pci_dev *pcidev,
 	}
 
 	spin_lock_init(&meye.grabq_lock);
-	meye.grabq = kfifo_alloc(sizeof(int) * MEYE_MAX_BUFNBRS, GFP_KERNEL,
-				 &meye.grabq_lock);
-	if (IS_ERR(meye.grabq)) {
+	if (kfifo_alloc(&meye.grabq, sizeof(int) * MEYE_MAX_BUFNBRS,
+				GFP_KERNEL)) {
 		printk(KERN_ERR "meye: fifo allocation failed\n");
 		goto outkfifoalloc1;
 	}
 	spin_lock_init(&meye.doneq_lock);
-	meye.doneq = kfifo_alloc(sizeof(int) * MEYE_MAX_BUFNBRS, GFP_KERNEL,
-				 &meye.doneq_lock);
-	if (IS_ERR(meye.doneq)) {
+	if (kfifo_alloc(&meye.doneq, sizeof(int) * MEYE_MAX_BUFNBRS,
+				GFP_KERNEL)) {
 		printk(KERN_ERR "meye: fifo allocation failed\n");
 		goto outkfifoalloc2;
 	}
@@ -1869,9 +1872,9 @@ outregions:
 outenabledev:
 	sony_pic_camera_command(SONY_PIC_COMMAND_SETCAMERA, 0);
 outsonypienable:
-	kfifo_free(meye.doneq);
+	kfifo_free(&meye.doneq);
 outkfifoalloc2:
-	kfifo_free(meye.grabq);
+	kfifo_free(&meye.grabq);
 outkfifoalloc1:
 	vfree(meye.grab_temp);
 outvmalloc:
@@ -1902,8 +1905,8 @@ static void __devexit meye_remove(struct pci_dev *pcidev)
 
 	sony_pic_camera_command(SONY_PIC_COMMAND_SETCAMERA, 0);
 
-	kfifo_free(meye.doneq);
-	kfifo_free(meye.grabq);
+	kfifo_free(&meye.doneq);
+	kfifo_free(&meye.grabq);
 
 	vfree(meye.grab_temp);
 
diff --git a/drivers/media/video/meye.h b/drivers/media/video/meye.h
index 5f70a106ba2b..1321ad5d6597 100644
--- a/drivers/media/video/meye.h
+++ b/drivers/media/video/meye.h
@@ -303,9 +303,9 @@ struct meye {
 	struct meye_grab_buffer grab_buffer[MEYE_MAX_BUFNBRS];
 	int vma_use_count[MEYE_MAX_BUFNBRS]; /* mmap count */
 	struct mutex lock;		/* mutex for open/mmap... */
-	struct kfifo *grabq;		/* queue for buffers to be grabbed */
+	struct kfifo grabq;		/* queue for buffers to be grabbed */
 	spinlock_t grabq_lock;		/* lock protecting the queue */
-	struct kfifo *doneq;		/* queue for grabbed buffers */
+	struct kfifo doneq;		/* queue for grabbed buffers */
 	spinlock_t doneq_lock;		/* lock protecting the queue */
 	wait_queue_head_t proc_list;	/* wait queue */
 	struct video_device *video_dev;	/* video device parameters */
diff --git a/drivers/media/video/mt9m001.c b/drivers/media/video/mt9m001.c
index 45388d2ce2fd..b62c0bd3f8ea 100644
--- a/drivers/media/video/mt9m001.c
+++ b/drivers/media/video/mt9m001.c
@@ -17,9 +17,11 @@
 #include <media/v4l2-chip-ident.h>
 #include <media/soc_camera.h>
 
-/* mt9m001 i2c address 0x5d
+/*
+ * mt9m001 i2c address 0x5d
  * The platform has to define ctruct i2c_board_info objects and link to them
- * from struct soc_camera_link */
+ * from struct soc_camera_link
+ */
 
 /* mt9m001 selected register addresses */
 #define MT9M001_CHIP_VERSION		0x00
@@ -46,42 +48,50 @@
 #define MT9M001_COLUMN_SKIP		20
 #define MT9M001_ROW_SKIP		12
 
-static const struct soc_camera_data_format mt9m001_colour_formats[] = {
-	/* Order important: first natively supported,
-	 * second supported with a GPIO extender */
-	{
-		.name		= "Bayer (sRGB) 10 bit",
-		.depth		= 10,
-		.fourcc		= V4L2_PIX_FMT_SBGGR16,
-		.colorspace	= V4L2_COLORSPACE_SRGB,
-	}, {
-		.name		= "Bayer (sRGB) 8 bit",
-		.depth		= 8,
-		.fourcc		= V4L2_PIX_FMT_SBGGR8,
-		.colorspace	= V4L2_COLORSPACE_SRGB,
-	}
+/* MT9M001 has only one fixed colorspace per pixelcode */
+struct mt9m001_datafmt {
+	enum v4l2_mbus_pixelcode	code;
+	enum v4l2_colorspace		colorspace;
+};
+
+/* Find a data format by a pixel code in an array */
+static const struct mt9m001_datafmt *mt9m001_find_datafmt(
+	enum v4l2_mbus_pixelcode code, const struct mt9m001_datafmt *fmt,
+	int n)
+{
+	int i;
+	for (i = 0; i < n; i++)
+		if (fmt[i].code == code)
+			return fmt + i;
+
+	return NULL;
+}
+
+static const struct mt9m001_datafmt mt9m001_colour_fmts[] = {
+	/*
+	 * Order important: first natively supported,
+	 * second supported with a GPIO extender
+	 */
+	{V4L2_MBUS_FMT_SBGGR10_1X10, V4L2_COLORSPACE_SRGB},
+	{V4L2_MBUS_FMT_SBGGR8_1X8, V4L2_COLORSPACE_SRGB},
 };
 
-static const struct soc_camera_data_format mt9m001_monochrome_formats[] = {
+static const struct mt9m001_datafmt mt9m001_monochrome_fmts[] = {
 	/* Order important - see above */
-	{
-		.name		= "Monochrome 10 bit",
-		.depth		= 10,
-		.fourcc		= V4L2_PIX_FMT_Y16,
-	}, {
-		.name		= "Monochrome 8 bit",
-		.depth		= 8,
-		.fourcc		= V4L2_PIX_FMT_GREY,
-	},
+	{V4L2_MBUS_FMT_Y10_1X10, V4L2_COLORSPACE_JPEG},
+	{V4L2_MBUS_FMT_GREY8_1X8, V4L2_COLORSPACE_JPEG},
 };
 
 struct mt9m001 {
 	struct v4l2_subdev subdev;
 	struct v4l2_rect rect;	/* Sensor window */
-	__u32 fourcc;
+	const struct mt9m001_datafmt *fmt;
+	const struct mt9m001_datafmt *fmts;
+	int num_fmts;
 	int model;	/* V4L2_IDENT_MT9M001* codes from v4l2-chip-ident.h */
 	unsigned int gain;
 	unsigned int exposure;
+	unsigned short y_skip_top;	/* Lines to skip at the top */
 	unsigned char autoexposure;
 };
 
@@ -204,8 +214,7 @@ static int mt9m001_s_crop(struct v4l2_subdev *sd, struct v4l2_crop *a)
 	const u16 hblank = 9, vblank = 25;
 	unsigned int total_h;
 
-	if (mt9m001->fourcc == V4L2_PIX_FMT_SBGGR8 ||
-	    mt9m001->fourcc == V4L2_PIX_FMT_SBGGR16)
+	if (mt9m001->fmts == mt9m001_colour_fmts)
 		/*
 		 * Bayer format - even number of rows for simplicity,
 		 * but let the user play with the top row.
@@ -222,15 +231,17 @@ static int mt9m001_s_crop(struct v4l2_subdev *sd, struct v4l2_crop *a)
 	soc_camera_limit_side(&rect.top, &rect.height,
 		     MT9M001_ROW_SKIP, MT9M001_MIN_HEIGHT, MT9M001_MAX_HEIGHT);
 
-	total_h = rect.height + icd->y_skip_top + vblank;
+	total_h = rect.height + mt9m001->y_skip_top + vblank;
 
 	/* Blanking and start values - default... */
 	ret = reg_write(client, MT9M001_HORIZONTAL_BLANKING, hblank);
 	if (!ret)
 		ret = reg_write(client, MT9M001_VERTICAL_BLANKING, vblank);
 
-	/* The caller provides a supported format, as verified per
-	 * call to icd->try_fmt() */
+	/*
+	 * The caller provides a supported format, as verified per
+	 * call to icd->try_fmt()
+	 */
 	if (!ret)
 		ret = reg_write(client, MT9M001_COLUMN_START, rect.left);
 	if (!ret)
@@ -239,7 +250,7 @@ static int mt9m001_s_crop(struct v4l2_subdev *sd, struct v4l2_crop *a)
 		ret = reg_write(client, MT9M001_WINDOW_WIDTH, rect.width - 1);
 	if (!ret)
 		ret = reg_write(client, MT9M001_WINDOW_HEIGHT,
-				rect.height + icd->y_skip_top - 1);
+				rect.height + mt9m001->y_skip_top - 1);
 	if (!ret && mt9m001->autoexposure) {
 		ret = reg_write(client, MT9M001_SHUTTER_WIDTH, total_h);
 		if (!ret) {
@@ -283,32 +294,32 @@ static int mt9m001_cropcap(struct v4l2_subdev *sd, struct v4l2_cropcap *a)
 	return 0;
 }
 
-static int mt9m001_g_fmt(struct v4l2_subdev *sd, struct v4l2_format *f)
+static int mt9m001_g_fmt(struct v4l2_subdev *sd,
+			 struct v4l2_mbus_framefmt *mf)
 {
 	struct i2c_client *client = sd->priv;
 	struct mt9m001 *mt9m001 = to_mt9m001(client);
-	struct v4l2_pix_format *pix = &f->fmt.pix;
 
-	pix->width		= mt9m001->rect.width;
-	pix->height		= mt9m001->rect.height;
-	pix->pixelformat	= mt9m001->fourcc;
-	pix->field		= V4L2_FIELD_NONE;
-	pix->colorspace		= V4L2_COLORSPACE_SRGB;
+	mf->width	= mt9m001->rect.width;
+	mf->height	= mt9m001->rect.height;
+	mf->code	= mt9m001->fmt->code;
+	mf->colorspace	= mt9m001->fmt->colorspace;
+	mf->field	= V4L2_FIELD_NONE;
 
 	return 0;
 }
 
-static int mt9m001_s_fmt(struct v4l2_subdev *sd, struct v4l2_format *f)
+static int mt9m001_s_fmt(struct v4l2_subdev *sd,
+			 struct v4l2_mbus_framefmt *mf)
 {
 	struct i2c_client *client = sd->priv;
 	struct mt9m001 *mt9m001 = to_mt9m001(client);
-	struct v4l2_pix_format *pix = &f->fmt.pix;
 	struct v4l2_crop a = {
 		.c = {
 			.left	= mt9m001->rect.left,
 			.top	= mt9m001->rect.top,
-			.width	= pix->width,
-			.height	= pix->height,
+			.width	= mf->width,
+			.height	= mf->height,
 		},
 	};
 	int ret;
@@ -316,28 +327,39 @@ static int mt9m001_s_fmt(struct v4l2_subdev *sd, struct v4l2_format *f)
 	/* No support for scaling so far, just crop. TODO: use skipping */
 	ret = mt9m001_s_crop(sd, &a);
 	if (!ret) {
-		pix->width = mt9m001->rect.width;
-		pix->height = mt9m001->rect.height;
-		mt9m001->fourcc = pix->pixelformat;
+		mf->width	= mt9m001->rect.width;
+		mf->height	= mt9m001->rect.height;
+		mt9m001->fmt	= mt9m001_find_datafmt(mf->code,
+					mt9m001->fmts, mt9m001->num_fmts);
+		mf->colorspace	= mt9m001->fmt->colorspace;
 	}
 
 	return ret;
 }
 
-static int mt9m001_try_fmt(struct v4l2_subdev *sd, struct v4l2_format *f)
+static int mt9m001_try_fmt(struct v4l2_subdev *sd,
+			   struct v4l2_mbus_framefmt *mf)
 {
 	struct i2c_client *client = sd->priv;
-	struct soc_camera_device *icd = client->dev.platform_data;
-	struct v4l2_pix_format *pix = &f->fmt.pix;
+	struct mt9m001 *mt9m001 = to_mt9m001(client);
+	const struct mt9m001_datafmt *fmt;
 
-	v4l_bound_align_image(&pix->width, MT9M001_MIN_WIDTH,
+	v4l_bound_align_image(&mf->width, MT9M001_MIN_WIDTH,
 		MT9M001_MAX_WIDTH, 1,
-		&pix->height, MT9M001_MIN_HEIGHT + icd->y_skip_top,
-		MT9M001_MAX_HEIGHT + icd->y_skip_top, 0, 0);
+		&mf->height, MT9M001_MIN_HEIGHT + mt9m001->y_skip_top,
+		MT9M001_MAX_HEIGHT + mt9m001->y_skip_top, 0, 0);
+
+	if (mt9m001->fmts == mt9m001_colour_fmts)
+		mf->height = ALIGN(mf->height - 1, 2);
 
-	if (pix->pixelformat == V4L2_PIX_FMT_SBGGR8 ||
-	    pix->pixelformat == V4L2_PIX_FMT_SBGGR16)
-		pix->height = ALIGN(pix->height - 1, 2);
+	fmt = mt9m001_find_datafmt(mf->code, mt9m001->fmts,
+				   mt9m001->num_fmts);
+	if (!fmt) {
+		fmt = mt9m001->fmt;
+		mf->code = fmt->code;
+	}
+
+	mf->colorspace	= fmt->colorspace;
 
 	return 0;
 }
@@ -552,7 +574,7 @@ static int mt9m001_s_ctrl(struct v4l2_subdev *sd, struct v4l2_control *ctrl)
 		if (ctrl->value) {
 			const u16 vblank = 25;
 			unsigned int total_h = mt9m001->rect.height +
-				icd->y_skip_top + vblank;
+				mt9m001->y_skip_top + vblank;
 			if (reg_write(client, MT9M001_SHUTTER_WIDTH,
 				      total_h) < 0)
 				return -EIO;
@@ -568,8 +590,10 @@ static int mt9m001_s_ctrl(struct v4l2_subdev *sd, struct v4l2_control *ctrl)
 	return 0;
 }
 
-/* Interface active, can use i2c. If it fails, it can indeed mean, that
- * this wasn't our capture interface, so, we wait for the right one */
+/*
+ * Interface active, can use i2c. If it fails, it can indeed mean, that
+ * this wasn't our capture interface, so, we wait for the right one
+ */
 static int mt9m001_video_probe(struct soc_camera_device *icd,
 			       struct i2c_client *client)
 {
@@ -579,8 +603,10 @@ static int mt9m001_video_probe(struct soc_camera_device *icd,
 	unsigned long flags;
 	int ret;
 
-	/* We must have a parent by now. And it cannot be a wrong one.
-	 * So this entire test is completely redundant. */
+	/*
+	 * We must have a parent by now. And it cannot be a wrong one.
+	 * So this entire test is completely redundant.
+	 */
 	if (!icd->dev.parent ||
 	    to_soc_camera_host(icd->dev.parent)->nr != icd->iface)
 		return -ENODEV;
@@ -597,11 +623,11 @@ static int mt9m001_video_probe(struct soc_camera_device *icd,
 	case 0x8411:
 	case 0x8421:
 		mt9m001->model = V4L2_IDENT_MT9M001C12ST;
-		icd->formats = mt9m001_colour_formats;
+		mt9m001->fmts = mt9m001_colour_fmts;
 		break;
 	case 0x8431:
 		mt9m001->model = V4L2_IDENT_MT9M001C12STM;
-		icd->formats = mt9m001_monochrome_formats;
+		mt9m001->fmts = mt9m001_monochrome_fmts;
 		break;
 	default:
 		dev_err(&client->dev,
@@ -609,7 +635,7 @@ static int mt9m001_video_probe(struct soc_camera_device *icd,
 		return -ENODEV;
 	}
 
-	icd->num_formats = 0;
+	mt9m001->num_fmts = 0;
 
 	/*
 	 * This is a 10bit sensor, so by default we only allow 10bit.
@@ -622,14 +648,14 @@ static int mt9m001_video_probe(struct soc_camera_device *icd,
 		flags = SOCAM_DATAWIDTH_10;
 
 	if (flags & SOCAM_DATAWIDTH_10)
-		icd->num_formats++;
+		mt9m001->num_fmts++;
 	else
-		icd->formats++;
+		mt9m001->fmts++;
 
 	if (flags & SOCAM_DATAWIDTH_8)
-		icd->num_formats++;
+		mt9m001->num_fmts++;
 
-	mt9m001->fourcc = icd->formats->fourcc;
+	mt9m001->fmt = &mt9m001->fmts[0];
 
 	dev_info(&client->dev, "Detected a MT9M001 chip ID %x (%s)\n", data,
 		 data == 0x8431 ? "C12STM" : "C12ST");
@@ -655,6 +681,16 @@ static void mt9m001_video_remove(struct soc_camera_device *icd)
 		icl->free_bus(icl);
 }
 
+static int mt9m001_g_skip_top_lines(struct v4l2_subdev *sd, u32 *lines)
+{
+	struct i2c_client *client = sd->priv;
+	struct mt9m001 *mt9m001 = to_mt9m001(client);
+
+	*lines = mt9m001->y_skip_top;
+
+	return 0;
+}
+
 static struct v4l2_subdev_core_ops mt9m001_subdev_core_ops = {
 	.g_ctrl		= mt9m001_g_ctrl,
 	.s_ctrl		= mt9m001_s_ctrl,
@@ -665,19 +701,38 @@ static struct v4l2_subdev_core_ops mt9m001_subdev_core_ops = {
 #endif
 };
 
+static int mt9m001_enum_fmt(struct v4l2_subdev *sd, int index,
+			    enum v4l2_mbus_pixelcode *code)
+{
+	struct i2c_client *client = sd->priv;
+	struct mt9m001 *mt9m001 = to_mt9m001(client);
+
+	if ((unsigned int)index >= mt9m001->num_fmts)
+		return -EINVAL;
+
+	*code = mt9m001->fmts[index].code;
+	return 0;
+}
+
 static struct v4l2_subdev_video_ops mt9m001_subdev_video_ops = {
 	.s_stream	= mt9m001_s_stream,
-	.s_fmt		= mt9m001_s_fmt,
-	.g_fmt		= mt9m001_g_fmt,
-	.try_fmt	= mt9m001_try_fmt,
+	.s_mbus_fmt	= mt9m001_s_fmt,
+	.g_mbus_fmt	= mt9m001_g_fmt,
+	.try_mbus_fmt	= mt9m001_try_fmt,
 	.s_crop		= mt9m001_s_crop,
 	.g_crop		= mt9m001_g_crop,
 	.cropcap	= mt9m001_cropcap,
+	.enum_mbus_fmt	= mt9m001_enum_fmt,
+};
+
+static struct v4l2_subdev_sensor_ops mt9m001_subdev_sensor_ops = {
+	.g_skip_top_lines	= mt9m001_g_skip_top_lines,
 };
 
 static struct v4l2_subdev_ops mt9m001_subdev_ops = {
 	.core	= &mt9m001_subdev_core_ops,
 	.video	= &mt9m001_subdev_video_ops,
+	.sensor	= &mt9m001_subdev_sensor_ops,
 };
 
 static int mt9m001_probe(struct i2c_client *client,
@@ -714,15 +769,17 @@ static int mt9m001_probe(struct i2c_client *client,
 
 	/* Second stage probe - when a capture adapter is there */
 	icd->ops		= &mt9m001_ops;
-	icd->y_skip_top		= 0;
 
+	mt9m001->y_skip_top	= 0;
 	mt9m001->rect.left	= MT9M001_COLUMN_SKIP;
 	mt9m001->rect.top	= MT9M001_ROW_SKIP;
 	mt9m001->rect.width	= MT9M001_MAX_WIDTH;
 	mt9m001->rect.height	= MT9M001_MAX_HEIGHT;
 
-	/* Simulated autoexposure. If enabled, we calculate shutter width
-	 * ourselves in the driver based on vertical blanking and frame width */
+	/*
+	 * Simulated autoexposure. If enabled, we calculate shutter width
+	 * ourselves in the driver based on vertical blanking and frame width
+	 */
 	mt9m001->autoexposure = 1;
 
 	ret = mt9m001_video_probe(icd, client);
diff --git a/drivers/media/video/mt9m111.c b/drivers/media/video/mt9m111.c
index 90da699601ea..d35f536f9fc3 100644
--- a/drivers/media/video/mt9m111.c
+++ b/drivers/media/video/mt9m111.c
@@ -123,23 +123,34 @@
 #define MT9M111_MAX_HEIGHT	1024
 #define MT9M111_MAX_WIDTH	1280
 
-#define COL_FMT(_name, _depth, _fourcc, _colorspace) \
-	{ .name = _name, .depth = _depth, .fourcc = _fourcc, \
-	.colorspace = _colorspace }
-#define RGB_FMT(_name, _depth, _fourcc) \
-	COL_FMT(_name, _depth, _fourcc, V4L2_COLORSPACE_SRGB)
-#define JPG_FMT(_name, _depth, _fourcc) \
-	COL_FMT(_name, _depth, _fourcc, V4L2_COLORSPACE_JPEG)
-
-static const struct soc_camera_data_format mt9m111_colour_formats[] = {
-	JPG_FMT("CbYCrY 16 bit", 16, V4L2_PIX_FMT_UYVY),
-	JPG_FMT("CrYCbY 16 bit", 16, V4L2_PIX_FMT_VYUY),
-	JPG_FMT("YCbYCr 16 bit", 16, V4L2_PIX_FMT_YUYV),
-	JPG_FMT("YCrYCb 16 bit", 16, V4L2_PIX_FMT_YVYU),
-	RGB_FMT("RGB 565", 16, V4L2_PIX_FMT_RGB565),
-	RGB_FMT("RGB 555", 16, V4L2_PIX_FMT_RGB555),
-	RGB_FMT("Bayer (sRGB) 10 bit", 10, V4L2_PIX_FMT_SBGGR16),
-	RGB_FMT("Bayer (sRGB) 8 bit", 8, V4L2_PIX_FMT_SBGGR8),
+/* MT9M111 has only one fixed colorspace per pixelcode */
+struct mt9m111_datafmt {
+	enum v4l2_mbus_pixelcode	code;
+	enum v4l2_colorspace		colorspace;
+};
+
+/* Find a data format by a pixel code in an array */
+static const struct mt9m111_datafmt *mt9m111_find_datafmt(
+	enum v4l2_mbus_pixelcode code, const struct mt9m111_datafmt *fmt,
+	int n)
+{
+	int i;
+	for (i = 0; i < n; i++)
+		if (fmt[i].code == code)
+			return fmt + i;
+
+	return NULL;
+}
+
+static const struct mt9m111_datafmt mt9m111_colour_fmts[] = {
+	{V4L2_MBUS_FMT_YUYV8_2X8_LE, V4L2_COLORSPACE_JPEG},
+	{V4L2_MBUS_FMT_YVYU8_2X8_LE, V4L2_COLORSPACE_JPEG},
+	{V4L2_MBUS_FMT_YUYV8_2X8_BE, V4L2_COLORSPACE_JPEG},
+	{V4L2_MBUS_FMT_YVYU8_2X8_BE, V4L2_COLORSPACE_JPEG},
+	{V4L2_MBUS_FMT_RGB555_2X8_PADHI_LE, V4L2_COLORSPACE_SRGB},
+	{V4L2_MBUS_FMT_RGB565_2X8_LE, V4L2_COLORSPACE_SRGB},
+	{V4L2_MBUS_FMT_SBGGR8_1X8, V4L2_COLORSPACE_SRGB},
+	{V4L2_MBUS_FMT_SBGGR10_2X8_PADHI_LE, V4L2_COLORSPACE_SRGB},
 };
 
 enum mt9m111_context {
@@ -152,7 +163,7 @@ struct mt9m111 {
 	int model;	/* V4L2_IDENT_MT9M11x* codes from v4l2-chip-ident.h */
 	enum mt9m111_context context;
 	struct v4l2_rect rect;
-	u32 pixfmt;
+	const struct mt9m111_datafmt *fmt;
 	unsigned int gain;
 	unsigned char autoexposure;
 	unsigned char datawidth;
@@ -258,8 +269,8 @@ static int mt9m111_setup_rect(struct i2c_client *client,
 	int width = rect->width;
 	int height = rect->height;
 
-	if (mt9m111->pixfmt == V4L2_PIX_FMT_SBGGR8 ||
-	    mt9m111->pixfmt == V4L2_PIX_FMT_SBGGR16)
+	if (mt9m111->fmt->code == V4L2_MBUS_FMT_SBGGR8_1X8 ||
+	    mt9m111->fmt->code == V4L2_MBUS_FMT_SBGGR10_2X8_PADHI_LE)
 		is_raw_format = 1;
 	else
 		is_raw_format = 0;
@@ -307,7 +318,8 @@ static int mt9m111_setup_pixfmt(struct i2c_client *client, u16 outfmt)
 
 static int mt9m111_setfmt_bayer8(struct i2c_client *client)
 {
-	return mt9m111_setup_pixfmt(client, MT9M111_OUTFMT_PROCESSED_BAYER);
+	return mt9m111_setup_pixfmt(client, MT9M111_OUTFMT_PROCESSED_BAYER |
+				    MT9M111_OUTFMT_RGB);
 }
 
 static int mt9m111_setfmt_bayer10(struct i2c_client *client)
@@ -401,8 +413,8 @@ static int mt9m111_make_rect(struct i2c_client *client,
 {
 	struct mt9m111 *mt9m111 = to_mt9m111(client);
 
-	if (mt9m111->pixfmt == V4L2_PIX_FMT_SBGGR8 ||
-	    mt9m111->pixfmt == V4L2_PIX_FMT_SBGGR16) {
+	if (mt9m111->fmt->code == V4L2_MBUS_FMT_SBGGR8_1X8 ||
+	    mt9m111->fmt->code == V4L2_MBUS_FMT_SBGGR10_2X8_PADHI_LE) {
 		/* Bayer format - even size lengths */
 		rect->width	= ALIGN(rect->width, 2);
 		rect->height	= ALIGN(rect->height, 2);
@@ -460,120 +472,139 @@ static int mt9m111_cropcap(struct v4l2_subdev *sd, struct v4l2_cropcap *a)
 	return 0;
 }
 
-static int mt9m111_g_fmt(struct v4l2_subdev *sd, struct v4l2_format *f)
+static int mt9m111_g_fmt(struct v4l2_subdev *sd,
+			 struct v4l2_mbus_framefmt *mf)
 {
 	struct i2c_client *client = sd->priv;
 	struct mt9m111 *mt9m111 = to_mt9m111(client);
-	struct v4l2_pix_format *pix = &f->fmt.pix;
 
-	pix->width		= mt9m111->rect.width;
-	pix->height		= mt9m111->rect.height;
-	pix->pixelformat	= mt9m111->pixfmt;
-	pix->field		= V4L2_FIELD_NONE;
-	pix->colorspace		= V4L2_COLORSPACE_SRGB;
+	mf->width	= mt9m111->rect.width;
+	mf->height	= mt9m111->rect.height;
+	mf->code	= mt9m111->fmt->code;
+	mf->field	= V4L2_FIELD_NONE;
 
 	return 0;
 }
 
-static int mt9m111_set_pixfmt(struct i2c_client *client, u32 pixfmt)
+static int mt9m111_set_pixfmt(struct i2c_client *client,
+			      enum v4l2_mbus_pixelcode code)
 {
 	struct mt9m111 *mt9m111 = to_mt9m111(client);
 	int ret;
 
-	switch (pixfmt) {
-	case V4L2_PIX_FMT_SBGGR8:
+	switch (code) {
+	case V4L2_MBUS_FMT_SBGGR8_1X8:
 		ret = mt9m111_setfmt_bayer8(client);
 		break;
-	case V4L2_PIX_FMT_SBGGR16:
+	case V4L2_MBUS_FMT_SBGGR10_2X8_PADHI_LE:
 		ret = mt9m111_setfmt_bayer10(client);
 		break;
-	case V4L2_PIX_FMT_RGB555:
+	case V4L2_MBUS_FMT_RGB555_2X8_PADHI_LE:
 		ret = mt9m111_setfmt_rgb555(client);
 		break;
-	case V4L2_PIX_FMT_RGB565:
+	case V4L2_MBUS_FMT_RGB565_2X8_LE:
 		ret = mt9m111_setfmt_rgb565(client);
 		break;
-	case V4L2_PIX_FMT_UYVY:
+	case V4L2_MBUS_FMT_YUYV8_2X8_BE:
 		mt9m111->swap_yuv_y_chromas = 0;
 		mt9m111->swap_yuv_cb_cr = 0;
 		ret = mt9m111_setfmt_yuv(client);
 		break;
-	case V4L2_PIX_FMT_VYUY:
+	case V4L2_MBUS_FMT_YVYU8_2X8_BE:
 		mt9m111->swap_yuv_y_chromas = 0;
 		mt9m111->swap_yuv_cb_cr = 1;
 		ret = mt9m111_setfmt_yuv(client);
 		break;
-	case V4L2_PIX_FMT_YUYV:
+	case V4L2_MBUS_FMT_YUYV8_2X8_LE:
 		mt9m111->swap_yuv_y_chromas = 1;
 		mt9m111->swap_yuv_cb_cr = 0;
 		ret = mt9m111_setfmt_yuv(client);
 		break;
-	case V4L2_PIX_FMT_YVYU:
+	case V4L2_MBUS_FMT_YVYU8_2X8_LE:
 		mt9m111->swap_yuv_y_chromas = 1;
 		mt9m111->swap_yuv_cb_cr = 1;
 		ret = mt9m111_setfmt_yuv(client);
 		break;
 	default:
 		dev_err(&client->dev, "Pixel format not handled : %x\n",
-			pixfmt);
+			code);
 		ret = -EINVAL;
 	}
 
-	if (!ret)
-		mt9m111->pixfmt = pixfmt;
-
 	return ret;
 }
 
-static int mt9m111_s_fmt(struct v4l2_subdev *sd, struct v4l2_format *f)
+static int mt9m111_s_fmt(struct v4l2_subdev *sd,
+			 struct v4l2_mbus_framefmt *mf)
 {
 	struct i2c_client *client = sd->priv;
+	const struct mt9m111_datafmt *fmt;
 	struct mt9m111 *mt9m111 = to_mt9m111(client);
-	struct v4l2_pix_format *pix = &f->fmt.pix;
 	struct v4l2_rect rect = {
 		.left	= mt9m111->rect.left,
 		.top	= mt9m111->rect.top,
-		.width	= pix->width,
-		.height	= pix->height,
+		.width	= mf->width,
+		.height	= mf->height,
 	};
 	int ret;
 
+	fmt = mt9m111_find_datafmt(mf->code, mt9m111_colour_fmts,
+				   ARRAY_SIZE(mt9m111_colour_fmts));
+	if (!fmt)
+		return -EINVAL;
+
 	dev_dbg(&client->dev,
-		"%s fmt=%x left=%d, top=%d, width=%d, height=%d\n", __func__,
-		pix->pixelformat, rect.left, rect.top, rect.width, rect.height);
+		"%s code=%x left=%d, top=%d, width=%d, height=%d\n", __func__,
+		mf->code, rect.left, rect.top, rect.width, rect.height);
 
 	ret = mt9m111_make_rect(client, &rect);
 	if (!ret)
-		ret = mt9m111_set_pixfmt(client, pix->pixelformat);
-	if (!ret)
-		mt9m111->rect = rect;
+		ret = mt9m111_set_pixfmt(client, mf->code);
+	if (!ret) {
+		mt9m111->rect	= rect;
+		mt9m111->fmt	= fmt;
+		mf->colorspace	= fmt->colorspace;
+	}
+
 	return ret;
 }
 
-static int mt9m111_try_fmt(struct v4l2_subdev *sd, struct v4l2_format *f)
+static int mt9m111_try_fmt(struct v4l2_subdev *sd,
+			   struct v4l2_mbus_framefmt *mf)
 {
-	struct v4l2_pix_format *pix = &f->fmt.pix;
-	bool bayer = pix->pixelformat == V4L2_PIX_FMT_SBGGR8 ||
-		pix->pixelformat == V4L2_PIX_FMT_SBGGR16;
+	struct i2c_client *client = sd->priv;
+	struct mt9m111 *mt9m111 = to_mt9m111(client);
+	const struct mt9m111_datafmt *fmt;
+	bool bayer = mf->code == V4L2_MBUS_FMT_SBGGR8_1X8 ||
+		mf->code == V4L2_MBUS_FMT_SBGGR10_2X8_PADHI_LE;
+
+	fmt = mt9m111_find_datafmt(mf->code, mt9m111_colour_fmts,
+				   ARRAY_SIZE(mt9m111_colour_fmts));
+	if (!fmt) {
+		fmt = mt9m111->fmt;
+		mf->code = fmt->code;
+	}
 
 	/*
 	 * With Bayer format enforce even side lengths, but let the user play
 	 * with the starting pixel
 	 */
 
-	if (pix->height > MT9M111_MAX_HEIGHT)
-		pix->height = MT9M111_MAX_HEIGHT;
-	else if (pix->height < 2)
-		pix->height = 2;
+	if (mf->height > MT9M111_MAX_HEIGHT)
+		mf->height = MT9M111_MAX_HEIGHT;
+	else if (mf->height < 2)
+		mf->height = 2;
 	else if (bayer)
-		pix->height = ALIGN(pix->height, 2);
+		mf->height = ALIGN(mf->height, 2);
 
-	if (pix->width > MT9M111_MAX_WIDTH)
-		pix->width = MT9M111_MAX_WIDTH;
-	else if (pix->width < 2)
-		pix->width = 2;
+	if (mf->width > MT9M111_MAX_WIDTH)
+		mf->width = MT9M111_MAX_WIDTH;
+	else if (mf->width < 2)
+		mf->width = 2;
 	else if (bayer)
-		pix->width = ALIGN(pix->width, 2);
+		mf->width = ALIGN(mf->width, 2);
+
+	mf->colorspace = fmt->colorspace;
 
 	return 0;
 }
@@ -863,7 +894,7 @@ static int mt9m111_restore_state(struct i2c_client *client)
 	struct mt9m111 *mt9m111 = to_mt9m111(client);
 
 	mt9m111_set_context(client, mt9m111->context);
-	mt9m111_set_pixfmt(client, mt9m111->pixfmt);
+	mt9m111_set_pixfmt(client, mt9m111->fmt->code);
 	mt9m111_setup_rect(client, &mt9m111->rect);
 	mt9m111_set_flip(client, mt9m111->hflip, MT9M111_RMB_MIRROR_COLS);
 	mt9m111_set_flip(client, mt9m111->vflip, MT9M111_RMB_MIRROR_ROWS);
@@ -952,9 +983,6 @@ static int mt9m111_video_probe(struct soc_camera_device *icd,
 		goto ei2c;
 	}
 
-	icd->formats = mt9m111_colour_formats;
-	icd->num_formats = ARRAY_SIZE(mt9m111_colour_formats);
-
 	dev_info(&client->dev, "Detected a MT9M11x chip ID %x\n", data);
 
 ei2c:
@@ -971,13 +999,24 @@ static struct v4l2_subdev_core_ops mt9m111_subdev_core_ops = {
 #endif
 };
 
+static int mt9m111_enum_fmt(struct v4l2_subdev *sd, int index,
+			    enum v4l2_mbus_pixelcode *code)
+{
+	if ((unsigned int)index >= ARRAY_SIZE(mt9m111_colour_fmts))
+		return -EINVAL;
+
+	*code = mt9m111_colour_fmts[index].code;
+	return 0;
+}
+
 static struct v4l2_subdev_video_ops mt9m111_subdev_video_ops = {
-	.s_fmt		= mt9m111_s_fmt,
-	.g_fmt		= mt9m111_g_fmt,
-	.try_fmt	= mt9m111_try_fmt,
+	.s_mbus_fmt	= mt9m111_s_fmt,
+	.g_mbus_fmt	= mt9m111_g_fmt,
+	.try_mbus_fmt	= mt9m111_try_fmt,
 	.s_crop		= mt9m111_s_crop,
 	.g_crop		= mt9m111_g_crop,
 	.cropcap	= mt9m111_cropcap,
+	.enum_mbus_fmt	= mt9m111_enum_fmt,
 };
 
 static struct v4l2_subdev_ops mt9m111_subdev_ops = {
@@ -1019,12 +1058,12 @@ static int mt9m111_probe(struct i2c_client *client,
 
 	/* Second stage probe - when a capture adapter is there */
 	icd->ops		= &mt9m111_ops;
-	icd->y_skip_top		= 0;
 
 	mt9m111->rect.left	= MT9M111_MIN_DARK_COLS;
 	mt9m111->rect.top	= MT9M111_MIN_DARK_ROWS;
 	mt9m111->rect.width	= MT9M111_MAX_WIDTH;
 	mt9m111->rect.height	= MT9M111_MAX_HEIGHT;
+	mt9m111->fmt		= &mt9m111_colour_fmts[0];
 
 	ret = mt9m111_video_probe(icd, client);
 	if (ret) {
diff --git a/drivers/media/video/mt9t031.c b/drivers/media/video/mt9t031.c
index 6966f644977e..a9061bff79b2 100644
--- a/drivers/media/video/mt9t031.c
+++ b/drivers/media/video/mt9t031.c
@@ -17,9 +17,11 @@
 #include <media/v4l2-chip-ident.h>
 #include <media/soc_camera.h>
 
-/* mt9t031 i2c address 0x5d
+/*
+ * mt9t031 i2c address 0x5d
  * The platform has to define i2c_board_info and link to it from
- * struct soc_camera_link */
+ * struct soc_camera_link
+ */
 
 /* mt9t031 selected register addresses */
 #define MT9T031_CHIP_VERSION		0x00
@@ -58,15 +60,6 @@
 	SOCAM_VSYNC_ACTIVE_HIGH | SOCAM_DATA_ACTIVE_HIGH |	\
 	SOCAM_MASTER | SOCAM_DATAWIDTH_10)
 
-static const struct soc_camera_data_format mt9t031_colour_formats[] = {
-	{
-		.name		= "Bayer (sRGB) 10 bit",
-		.depth		= 10,
-		.fourcc		= V4L2_PIX_FMT_SGRBG10,
-		.colorspace	= V4L2_COLORSPACE_SRGB,
-	}
-};
-
 struct mt9t031 {
 	struct v4l2_subdev subdev;
 	struct v4l2_rect rect;	/* Sensor window */
@@ -74,6 +67,7 @@ struct mt9t031 {
 	u16 xskip;
 	u16 yskip;
 	unsigned int gain;
+	unsigned short y_skip_top;	/* Lines to skip at the top */
 	unsigned int exposure;
 	unsigned char autoexposure;
 };
@@ -207,6 +201,71 @@ static unsigned long mt9t031_query_bus_param(struct soc_camera_device *icd)
 	return soc_camera_apply_sensor_flags(icl, MT9T031_BUS_PARAM);
 }
 
+enum {
+	MT9T031_CTRL_VFLIP,
+	MT9T031_CTRL_HFLIP,
+	MT9T031_CTRL_GAIN,
+	MT9T031_CTRL_EXPOSURE,
+	MT9T031_CTRL_EXPOSURE_AUTO,
+};
+
+static const struct v4l2_queryctrl mt9t031_controls[] = {
+	[MT9T031_CTRL_VFLIP] = {
+		.id		= V4L2_CID_VFLIP,
+		.type		= V4L2_CTRL_TYPE_BOOLEAN,
+		.name		= "Flip Vertically",
+		.minimum	= 0,
+		.maximum	= 1,
+		.step		= 1,
+		.default_value	= 0,
+	},
+	[MT9T031_CTRL_HFLIP] = {
+		.id		= V4L2_CID_HFLIP,
+		.type		= V4L2_CTRL_TYPE_BOOLEAN,
+		.name		= "Flip Horizontally",
+		.minimum	= 0,
+		.maximum	= 1,
+		.step		= 1,
+		.default_value	= 0,
+	},
+	[MT9T031_CTRL_GAIN] = {
+		.id		= V4L2_CID_GAIN,
+		.type		= V4L2_CTRL_TYPE_INTEGER,
+		.name		= "Gain",
+		.minimum	= 0,
+		.maximum	= 127,
+		.step		= 1,
+		.default_value	= 64,
+		.flags		= V4L2_CTRL_FLAG_SLIDER,
+	},
+	[MT9T031_CTRL_EXPOSURE] = {
+		.id		= V4L2_CID_EXPOSURE,
+		.type		= V4L2_CTRL_TYPE_INTEGER,
+		.name		= "Exposure",
+		.minimum	= 1,
+		.maximum	= 255,
+		.step		= 1,
+		.default_value	= 255,
+		.flags		= V4L2_CTRL_FLAG_SLIDER,
+	},
+	[MT9T031_CTRL_EXPOSURE_AUTO] = {
+		.id		= V4L2_CID_EXPOSURE_AUTO,
+		.type		= V4L2_CTRL_TYPE_BOOLEAN,
+		.name		= "Automatic Exposure",
+		.minimum	= 0,
+		.maximum	= 1,
+		.step		= 1,
+		.default_value	= 1,
+	}
+};
+
+static struct soc_camera_ops mt9t031_ops = {
+	.set_bus_param		= mt9t031_set_bus_param,
+	.query_bus_param	= mt9t031_query_bus_param,
+	.controls		= mt9t031_controls,
+	.num_controls		= ARRAY_SIZE(mt9t031_controls),
+};
+
 /* target must be _even_ */
 static u16 mt9t031_skip(s32 *source, s32 target, s32 max)
 {
@@ -226,10 +285,9 @@ static u16 mt9t031_skip(s32 *source, s32 target, s32 max)
 }
 
 /* rect is the sensor rectangle, the caller guarantees parameter validity */
-static int mt9t031_set_params(struct soc_camera_device *icd,
+static int mt9t031_set_params(struct i2c_client *client,
 			      struct v4l2_rect *rect, u16 xskip, u16 yskip)
 {
-	struct i2c_client *client = to_i2c_client(to_soc_camera_control(icd));
 	struct mt9t031 *mt9t031 = to_mt9t031(client);
 	int ret;
 	u16 xbin, ybin;
@@ -291,8 +349,10 @@ static int mt9t031_set_params(struct soc_camera_device *icd,
 	dev_dbg(&client->dev, "new physical left %u, top %u\n",
 		rect->left, rect->top);
 
-	/* The caller provides a supported format, as guaranteed by
-	 * icd->try_fmt_cap(), soc_camera_s_crop() and soc_camera_cropcap() */
+	/*
+	 * The caller provides a supported format, as guaranteed by
+	 * icd->try_fmt_cap(), soc_camera_s_crop() and soc_camera_cropcap()
+	 */
 	if (ret >= 0)
 		ret = reg_write(client, MT9T031_COLUMN_START, rect->left);
 	if (ret >= 0)
@@ -301,15 +361,14 @@ static int mt9t031_set_params(struct soc_camera_device *icd,
 		ret = reg_write(client, MT9T031_WINDOW_WIDTH, rect->width - 1);
 	if (ret >= 0)
 		ret = reg_write(client, MT9T031_WINDOW_HEIGHT,
-				rect->height + icd->y_skip_top - 1);
+				rect->height + mt9t031->y_skip_top - 1);
 	if (ret >= 0 && mt9t031->autoexposure) {
-		unsigned int total_h = rect->height + icd->y_skip_top + vblank;
+		unsigned int total_h = rect->height + mt9t031->y_skip_top + vblank;
 		ret = set_shutter(client, total_h);
 		if (ret >= 0) {
 			const u32 shutter_max = MT9T031_MAX_HEIGHT + vblank;
 			const struct v4l2_queryctrl *qctrl =
-				soc_camera_find_qctrl(icd->ops,
-						      V4L2_CID_EXPOSURE);
+				&mt9t031_controls[MT9T031_CTRL_EXPOSURE];
 			mt9t031->exposure = (shutter_max / 2 + (total_h - 1) *
 				 (qctrl->maximum - qctrl->minimum)) /
 				shutter_max + qctrl->minimum;
@@ -334,7 +393,6 @@ static int mt9t031_s_crop(struct v4l2_subdev *sd, struct v4l2_crop *a)
 	struct v4l2_rect rect = a->c;
 	struct i2c_client *client = sd->priv;
 	struct mt9t031 *mt9t031 = to_mt9t031(client);
-	struct soc_camera_device *icd = client->dev.platform_data;
 
 	rect.width = ALIGN(rect.width, 2);
 	rect.height = ALIGN(rect.height, 2);
@@ -345,7 +403,7 @@ static int mt9t031_s_crop(struct v4l2_subdev *sd, struct v4l2_crop *a)
 	soc_camera_limit_side(&rect.top, &rect.height,
 		     MT9T031_ROW_SKIP, MT9T031_MIN_HEIGHT, MT9T031_MAX_HEIGHT);
 
-	return mt9t031_set_params(icd, &rect, mt9t031->xskip, mt9t031->yskip);
+	return mt9t031_set_params(client, &rect, mt9t031->xskip, mt9t031->yskip);
 }
 
 static int mt9t031_g_crop(struct v4l2_subdev *sd, struct v4l2_crop *a)
@@ -373,27 +431,26 @@ static int mt9t031_cropcap(struct v4l2_subdev *sd, struct v4l2_cropcap *a)
 	return 0;
 }
 
-static int mt9t031_g_fmt(struct v4l2_subdev *sd, struct v4l2_format *f)
+static int mt9t031_g_fmt(struct v4l2_subdev *sd,
+			 struct v4l2_mbus_framefmt *mf)
 {
 	struct i2c_client *client = sd->priv;
 	struct mt9t031 *mt9t031 = to_mt9t031(client);
-	struct v4l2_pix_format *pix = &f->fmt.pix;
 
-	pix->width		= mt9t031->rect.width / mt9t031->xskip;
-	pix->height		= mt9t031->rect.height / mt9t031->yskip;
-	pix->pixelformat	= V4L2_PIX_FMT_SGRBG10;
-	pix->field		= V4L2_FIELD_NONE;
-	pix->colorspace		= V4L2_COLORSPACE_SRGB;
+	mf->width	= mt9t031->rect.width / mt9t031->xskip;
+	mf->height	= mt9t031->rect.height / mt9t031->yskip;
+	mf->code	= V4L2_MBUS_FMT_SBGGR10_1X10;
+	mf->colorspace	= V4L2_COLORSPACE_SRGB;
+	mf->field	= V4L2_FIELD_NONE;
 
 	return 0;
 }
 
-static int mt9t031_s_fmt(struct v4l2_subdev *sd, struct v4l2_format *f)
+static int mt9t031_s_fmt(struct v4l2_subdev *sd,
+			 struct v4l2_mbus_framefmt *mf)
 {
 	struct i2c_client *client = sd->priv;
 	struct mt9t031 *mt9t031 = to_mt9t031(client);
-	struct soc_camera_device *icd = client->dev.platform_data;
-	struct v4l2_pix_format *pix = &f->fmt.pix;
 	u16 xskip, yskip;
 	struct v4l2_rect rect = mt9t031->rect;
 
@@ -401,24 +458,29 @@ static int mt9t031_s_fmt(struct v4l2_subdev *sd, struct v4l2_format *f)
 	 * try_fmt has put width and height within limits.
 	 * S_FMT: use binning and skipping for scaling
 	 */
-	xskip = mt9t031_skip(&rect.width, pix->width, MT9T031_MAX_WIDTH);
-	yskip = mt9t031_skip(&rect.height, pix->height, MT9T031_MAX_HEIGHT);
+	xskip = mt9t031_skip(&rect.width, mf->width, MT9T031_MAX_WIDTH);
+	yskip = mt9t031_skip(&rect.height, mf->height, MT9T031_MAX_HEIGHT);
+
+	mf->code	= V4L2_MBUS_FMT_SBGGR10_1X10;
+	mf->colorspace	= V4L2_COLORSPACE_SRGB;
 
 	/* mt9t031_set_params() doesn't change width and height */
-	return mt9t031_set_params(icd, &rect, xskip, yskip);
+	return mt9t031_set_params(client, &rect, xskip, yskip);
 }
 
 /*
  * If a user window larger than sensor window is requested, we'll increase the
  * sensor window.
  */
-static int mt9t031_try_fmt(struct v4l2_subdev *sd, struct v4l2_format *f)
+static int mt9t031_try_fmt(struct v4l2_subdev *sd,
+			   struct v4l2_mbus_framefmt *mf)
 {
-	struct v4l2_pix_format *pix = &f->fmt.pix;
-
 	v4l_bound_align_image(
-		&pix->width, MT9T031_MIN_WIDTH, MT9T031_MAX_WIDTH, 1,
-		&pix->height, MT9T031_MIN_HEIGHT, MT9T031_MAX_HEIGHT, 1, 0);
+		&mf->width, MT9T031_MIN_WIDTH, MT9T031_MAX_WIDTH, 1,
+		&mf->height, MT9T031_MIN_HEIGHT, MT9T031_MAX_HEIGHT, 1, 0);
+
+	mf->code	= V4L2_MBUS_FMT_SBGGR10_1X10;
+	mf->colorspace	= V4L2_COLORSPACE_SRGB;
 
 	return 0;
 }
@@ -479,59 +541,6 @@ static int mt9t031_s_register(struct v4l2_subdev *sd,
 }
 #endif
 
-static const struct v4l2_queryctrl mt9t031_controls[] = {
-	{
-		.id		= V4L2_CID_VFLIP,
-		.type		= V4L2_CTRL_TYPE_BOOLEAN,
-		.name		= "Flip Vertically",
-		.minimum	= 0,
-		.maximum	= 1,
-		.step		= 1,
-		.default_value	= 0,
-	}, {
-		.id		= V4L2_CID_HFLIP,
-		.type		= V4L2_CTRL_TYPE_BOOLEAN,
-		.name		= "Flip Horizontally",
-		.minimum	= 0,
-		.maximum	= 1,
-		.step		= 1,
-		.default_value	= 0,
-	}, {
-		.id		= V4L2_CID_GAIN,
-		.type		= V4L2_CTRL_TYPE_INTEGER,
-		.name		= "Gain",
-		.minimum	= 0,
-		.maximum	= 127,
-		.step		= 1,
-		.default_value	= 64,
-		.flags		= V4L2_CTRL_FLAG_SLIDER,
-	}, {
-		.id		= V4L2_CID_EXPOSURE,
-		.type		= V4L2_CTRL_TYPE_INTEGER,
-		.name		= "Exposure",
-		.minimum	= 1,
-		.maximum	= 255,
-		.step		= 1,
-		.default_value	= 255,
-		.flags		= V4L2_CTRL_FLAG_SLIDER,
-	}, {
-		.id		= V4L2_CID_EXPOSURE_AUTO,
-		.type		= V4L2_CTRL_TYPE_BOOLEAN,
-		.name		= "Automatic Exposure",
-		.minimum	= 0,
-		.maximum	= 1,
-		.step		= 1,
-		.default_value	= 1,
-	}
-};
-
-static struct soc_camera_ops mt9t031_ops = {
-	.set_bus_param		= mt9t031_set_bus_param,
-	.query_bus_param	= mt9t031_query_bus_param,
-	.controls		= mt9t031_controls,
-	.num_controls		= ARRAY_SIZE(mt9t031_controls),
-};
-
 static int mt9t031_g_ctrl(struct v4l2_subdev *sd, struct v4l2_control *ctrl)
 {
 	struct i2c_client *client = sd->priv;
@@ -568,15 +577,9 @@ static int mt9t031_s_ctrl(struct v4l2_subdev *sd, struct v4l2_control *ctrl)
 {
 	struct i2c_client *client = sd->priv;
 	struct mt9t031 *mt9t031 = to_mt9t031(client);
-	struct soc_camera_device *icd = client->dev.platform_data;
 	const struct v4l2_queryctrl *qctrl;
 	int data;
 
-	qctrl = soc_camera_find_qctrl(&mt9t031_ops, ctrl->id);
-
-	if (!qctrl)
-		return -EINVAL;
-
 	switch (ctrl->id) {
 	case V4L2_CID_VFLIP:
 		if (ctrl->value)
@@ -595,6 +598,7 @@ static int mt9t031_s_ctrl(struct v4l2_subdev *sd, struct v4l2_control *ctrl)
 			return -EIO;
 		break;
 	case V4L2_CID_GAIN:
+		qctrl = &mt9t031_controls[MT9T031_CTRL_GAIN];
 		if (ctrl->value > qctrl->maximum || ctrl->value < qctrl->minimum)
 			return -EINVAL;
 		/* See Datasheet Table 7, Gain settings. */
@@ -634,6 +638,7 @@ static int mt9t031_s_ctrl(struct v4l2_subdev *sd, struct v4l2_control *ctrl)
 		mt9t031->gain = ctrl->value;
 		break;
 	case V4L2_CID_EXPOSURE:
+		qctrl = &mt9t031_controls[MT9T031_CTRL_EXPOSURE];
 		/* mt9t031 has maximum == default */
 		if (ctrl->value > qctrl->maximum || ctrl->value < qctrl->minimum)
 			return -EINVAL;
@@ -657,11 +662,11 @@ static int mt9t031_s_ctrl(struct v4l2_subdev *sd, struct v4l2_control *ctrl)
 			const u16 vblank = MT9T031_VERTICAL_BLANK;
 			const u32 shutter_max = MT9T031_MAX_HEIGHT + vblank;
 			unsigned int total_h = mt9t031->rect.height +
-				icd->y_skip_top + vblank;
+				mt9t031->y_skip_top + vblank;
 
 			if (set_shutter(client, total_h) < 0)
 				return -EIO;
-			qctrl = soc_camera_find_qctrl(icd->ops, V4L2_CID_EXPOSURE);
+			qctrl = &mt9t031_controls[MT9T031_CTRL_EXPOSURE];
 			mt9t031->exposure = (shutter_max / 2 + (total_h - 1) *
 				 (qctrl->maximum - qctrl->minimum)) /
 				shutter_max + qctrl->minimum;
@@ -669,15 +674,18 @@ static int mt9t031_s_ctrl(struct v4l2_subdev *sd, struct v4l2_control *ctrl)
 		} else
 			mt9t031->autoexposure = 0;
 		break;
+	default:
+		return -EINVAL;
 	}
 	return 0;
 }
 
-/* Interface active, can use i2c. If it fails, it can indeed mean, that
- * this wasn't our capture interface, so, we wait for the right one */
+/*
+ * Interface active, can use i2c. If it fails, it can indeed mean, that
+ * this wasn't our capture interface, so, we wait for the right one
+ */
 static int mt9t031_video_probe(struct i2c_client *client)
 {
-	struct soc_camera_device *icd = client->dev.platform_data;
 	struct mt9t031 *mt9t031 = to_mt9t031(client);
 	s32 data;
 	int ret;
@@ -692,8 +700,6 @@ static int mt9t031_video_probe(struct i2c_client *client)
 	switch (data) {
 	case 0x1621:
 		mt9t031->model = V4L2_IDENT_MT9T031;
-		icd->formats = mt9t031_colour_formats;
-		icd->num_formats = ARRAY_SIZE(mt9t031_colour_formats);
 		break;
 	default:
 		dev_err(&client->dev,
@@ -714,6 +720,16 @@ static int mt9t031_video_probe(struct i2c_client *client)
 	return ret;
 }
 
+static int mt9t031_g_skip_top_lines(struct v4l2_subdev *sd, u32 *lines)
+{
+	struct i2c_client *client = sd->priv;
+	struct mt9t031 *mt9t031 = to_mt9t031(client);
+
+	*lines = mt9t031->y_skip_top;
+
+	return 0;
+}
+
 static struct v4l2_subdev_core_ops mt9t031_subdev_core_ops = {
 	.g_ctrl		= mt9t031_g_ctrl,
 	.s_ctrl		= mt9t031_s_ctrl,
@@ -724,19 +740,35 @@ static struct v4l2_subdev_core_ops mt9t031_subdev_core_ops = {
 #endif
 };
 
+static int mt9t031_enum_fmt(struct v4l2_subdev *sd, int index,
+			    enum v4l2_mbus_pixelcode *code)
+{
+	if (index)
+		return -EINVAL;
+
+	*code = V4L2_MBUS_FMT_SBGGR10_1X10;
+	return 0;
+}
+
 static struct v4l2_subdev_video_ops mt9t031_subdev_video_ops = {
 	.s_stream	= mt9t031_s_stream,
-	.s_fmt		= mt9t031_s_fmt,
-	.g_fmt		= mt9t031_g_fmt,
-	.try_fmt	= mt9t031_try_fmt,
+	.s_mbus_fmt	= mt9t031_s_fmt,
+	.g_mbus_fmt	= mt9t031_g_fmt,
+	.try_mbus_fmt	= mt9t031_try_fmt,
 	.s_crop		= mt9t031_s_crop,
 	.g_crop		= mt9t031_g_crop,
 	.cropcap	= mt9t031_cropcap,
+	.enum_mbus_fmt	= mt9t031_enum_fmt,
+};
+
+static struct v4l2_subdev_sensor_ops mt9t031_subdev_sensor_ops = {
+	.g_skip_top_lines	= mt9t031_g_skip_top_lines,
 };
 
 static struct v4l2_subdev_ops mt9t031_subdev_ops = {
 	.core	= &mt9t031_subdev_core_ops,
 	.video	= &mt9t031_subdev_video_ops,
+	.sensor	= &mt9t031_subdev_sensor_ops,
 };
 
 static int mt9t031_probe(struct i2c_client *client,
@@ -745,18 +777,16 @@ static int mt9t031_probe(struct i2c_client *client,
 	struct mt9t031 *mt9t031;
 	struct soc_camera_device *icd = client->dev.platform_data;
 	struct i2c_adapter *adapter = to_i2c_adapter(client->dev.parent);
-	struct soc_camera_link *icl;
 	int ret;
 
-	if (!icd) {
-		dev_err(&client->dev, "MT9T031: missing soc-camera data!\n");
-		return -EINVAL;
-	}
+	if (icd) {
+		struct soc_camera_link *icl = to_soc_camera_link(icd);
+		if (!icl) {
+			dev_err(&client->dev, "MT9T031 driver needs platform data\n");
+			return -EINVAL;
+		}
 
-	icl = to_soc_camera_link(icd);
-	if (!icl) {
-		dev_err(&client->dev, "MT9T031 driver needs platform data\n");
-		return -EINVAL;
+		icd->ops = &mt9t031_ops;
 	}
 
 	if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_WORD_DATA)) {
@@ -771,17 +801,16 @@ static int mt9t031_probe(struct i2c_client *client,
 
 	v4l2_i2c_subdev_init(&mt9t031->subdev, client, &mt9t031_subdev_ops);
 
-	/* Second stage probe - when a capture adapter is there */
-	icd->ops		= &mt9t031_ops;
-	icd->y_skip_top		= 0;
-
+	mt9t031->y_skip_top	= 0;
 	mt9t031->rect.left	= MT9T031_COLUMN_SKIP;
 	mt9t031->rect.top	= MT9T031_ROW_SKIP;
 	mt9t031->rect.width	= MT9T031_MAX_WIDTH;
 	mt9t031->rect.height	= MT9T031_MAX_HEIGHT;
 
-	/* Simulated autoexposure. If enabled, we calculate shutter width
-	 * ourselves in the driver based on vertical blanking and frame width */
+	/*
+	 * Simulated autoexposure. If enabled, we calculate shutter width
+	 * ourselves in the driver based on vertical blanking and frame width
+	 */
 	mt9t031->autoexposure = 1;
 
 	mt9t031->xskip = 1;
@@ -794,7 +823,8 @@ static int mt9t031_probe(struct i2c_client *client,
 	mt9t031_disable(client);
 
 	if (ret) {
-		icd->ops = NULL;
+		if (icd)
+			icd->ops = NULL;
 		i2c_set_clientdata(client, NULL);
 		kfree(mt9t031);
 	}
@@ -807,7 +837,8 @@ static int mt9t031_remove(struct i2c_client *client)
 	struct mt9t031 *mt9t031 = to_mt9t031(client);
 	struct soc_camera_device *icd = client->dev.platform_data;
 
-	icd->ops = NULL;
+	if (icd)
+		icd->ops = NULL;
 	i2c_set_clientdata(client, NULL);
 	client->driver = NULL;
 	kfree(mt9t031);
diff --git a/drivers/media/video/mt9t112.c b/drivers/media/video/mt9t112.c
new file mode 100644
index 000000000000..fc4dd6045720
--- /dev/null
+++ b/drivers/media/video/mt9t112.c
@@ -0,0 +1,1177 @@
+/*
+ * mt9t112 Camera Driver
+ *
+ * Copyright (C) 2009 Renesas Solutions Corp.
+ * Kuninori Morimoto <morimoto.kuninori@renesas.com>
+ *
+ * Based on ov772x driver, mt9m111 driver,
+ *
+ * Copyright (C) 2008 Kuninori Morimoto <morimoto.kuninori@renesas.com>
+ * Copyright (C) 2008, Robert Jarzmik <robert.jarzmik@free.fr>
+ * Copyright 2006-7 Jonathan Corbet <corbet@lwn.net>
+ * Copyright (C) 2008 Magnus Damm
+ * Copyright (C) 2008, Guennadi Liakhovetski <kernel@pengutronix.de>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/delay.h>
+#include <linux/i2c.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/videodev2.h>
+
+#include <media/mt9t112.h>
+#include <media/soc_camera.h>
+#include <media/soc_mediabus.h>
+#include <media/v4l2-chip-ident.h>
+#include <media/v4l2-common.h>
+
+/* you can check PLL/clock info */
+/* #define EXT_CLOCK 24000000 */
+
+/************************************************************************
+
+
+			macro
+
+
+************************************************************************/
+/*
+ * frame size
+ */
+#define MAX_WIDTH   2048
+#define MAX_HEIGHT  1536
+
+#define VGA_WIDTH   640
+#define VGA_HEIGHT  480
+
+/*
+ * macro of read/write
+ */
+#define ECHECKER(ret, x)		\
+	do {				\
+		(ret) = (x);		\
+		if ((ret) < 0)		\
+			return (ret);	\
+	} while (0)
+
+#define mt9t112_reg_write(ret, client, a, b) \
+	ECHECKER(ret, __mt9t112_reg_write(client, a, b))
+#define mt9t112_mcu_write(ret, client, a, b) \
+	ECHECKER(ret, __mt9t112_mcu_write(client, a, b))
+
+#define mt9t112_reg_mask_set(ret, client, a, b, c) \
+	ECHECKER(ret, __mt9t112_reg_mask_set(client, a, b, c))
+#define mt9t112_mcu_mask_set(ret, client, a, b, c) \
+	ECHECKER(ret, __mt9t112_mcu_mask_set(client, a, b, c))
+
+#define mt9t112_reg_read(ret, client, a) \
+	ECHECKER(ret, __mt9t112_reg_read(client, a))
+
+/*
+ * Logical address
+ */
+#define _VAR(id, offset, base)	(base | (id & 0x1f) << 10 | (offset & 0x3ff))
+#define VAR(id, offset)  _VAR(id, offset, 0x0000)
+#define VAR8(id, offset) _VAR(id, offset, 0x8000)
+
+/************************************************************************
+
+
+			struct
+
+
+************************************************************************/
+struct mt9t112_frame_size {
+	u16 width;
+	u16 height;
+};
+
+struct mt9t112_format {
+	enum v4l2_mbus_pixelcode code;
+	enum v4l2_colorspace colorspace;
+	u16 fmt;
+	u16 order;
+};
+
+struct mt9t112_priv {
+	struct v4l2_subdev		 subdev;
+	struct mt9t112_camera_info	*info;
+	struct i2c_client		*client;
+	struct soc_camera_device	 icd;
+	struct mt9t112_frame_size	 frame;
+	const struct mt9t112_format	*format;
+	int				 model;
+	u32				 flags;
+/* for flags */
+#define INIT_DONE  (1<<0)
+};
+
+/************************************************************************
+
+
+			supported format
+
+
+************************************************************************/
+
+static const struct mt9t112_format mt9t112_cfmts[] = {
+	{
+		.code		= V4L2_MBUS_FMT_YUYV8_2X8_BE,
+		.colorspace	= V4L2_COLORSPACE_JPEG,
+		.fmt		= 1,
+		.order		= 0,
+	}, {
+		.code		= V4L2_MBUS_FMT_YVYU8_2X8_BE,
+		.colorspace	= V4L2_COLORSPACE_JPEG,
+		.fmt		= 1,
+		.order		= 1,
+	}, {
+		.code		= V4L2_MBUS_FMT_YUYV8_2X8_LE,
+		.colorspace	= V4L2_COLORSPACE_JPEG,
+		.fmt		= 1,
+		.order		= 2,
+	}, {
+		.code		= V4L2_MBUS_FMT_YVYU8_2X8_LE,
+		.colorspace	= V4L2_COLORSPACE_JPEG,
+		.fmt		= 1,
+		.order		= 3,
+	}, {
+		.code		= V4L2_MBUS_FMT_RGB555_2X8_PADHI_LE,
+		.colorspace	= V4L2_COLORSPACE_SRGB,
+		.fmt		= 8,
+		.order		= 2,
+	}, {
+		.code		= V4L2_MBUS_FMT_RGB565_2X8_LE,
+		.colorspace	= V4L2_COLORSPACE_SRGB,
+		.fmt		= 4,
+		.order		= 2,
+	},
+};
+
+/************************************************************************
+
+
+			general function
+
+
+************************************************************************/
+static struct mt9t112_priv *to_mt9t112(const struct i2c_client *client)
+{
+	return container_of(i2c_get_clientdata(client),
+			    struct mt9t112_priv,
+			    subdev);
+}
+
+static int __mt9t112_reg_read(const struct i2c_client *client, u16 command)
+{
+	struct i2c_msg msg[2];
+	u8 buf[2];
+	int ret;
+
+	command = swab16(command);
+
+	msg[0].addr  = client->addr;
+	msg[0].flags = 0;
+	msg[0].len   = 2;
+	msg[0].buf   = (u8 *)&command;
+
+	msg[1].addr  = client->addr;
+	msg[1].flags = I2C_M_RD;
+	msg[1].len   = 2;
+	msg[1].buf   = buf;
+
+	/*
+	 * if return value of this function is < 0,
+	 * it mean error.
+	 * else, under 16bit is valid data.
+	 */
+	ret = i2c_transfer(client->adapter, msg, 2);
+	if (ret < 0)
+		return ret;
+
+	memcpy(&ret, buf, 2);
+	return swab16(ret);
+}
+
+static int __mt9t112_reg_write(const struct i2c_client *client,
+			       u16 command, u16 data)
+{
+	struct i2c_msg msg;
+	u8 buf[4];
+	int ret;
+
+	command = swab16(command);
+	data = swab16(data);
+
+	memcpy(buf + 0, &command, 2);
+	memcpy(buf + 2, &data,    2);
+
+	msg.addr  = client->addr;
+	msg.flags = 0;
+	msg.len   = 4;
+	msg.buf   = buf;
+
+	/*
+	 * i2c_transfer return message length,
+	 * but this function should return 0 if correct case
+	 */
+	ret = i2c_transfer(client->adapter, &msg, 1);
+	if (ret >= 0)
+		ret = 0;
+
+	return ret;
+}
+
+static int __mt9t112_reg_mask_set(const struct i2c_client *client,
+				  u16  command,
+				  u16  mask,
+				  u16  set)
+{
+	int val = __mt9t112_reg_read(client, command);
+	if (val < 0)
+		return val;
+
+	val &= ~mask;
+	val |= set & mask;
+
+	return __mt9t112_reg_write(client, command, val);
+}
+
+/* mcu access */
+static int __mt9t112_mcu_read(const struct i2c_client *client, u16 command)
+{
+	int ret;
+
+	ret = __mt9t112_reg_write(client, 0x098E, command);
+	if (ret < 0)
+		return ret;
+
+	return __mt9t112_reg_read(client, 0x0990);
+}
+
+static int __mt9t112_mcu_write(const struct i2c_client *client,
+			       u16 command, u16 data)
+{
+	int ret;
+
+	ret = __mt9t112_reg_write(client, 0x098E, command);
+	if (ret < 0)
+		return ret;
+
+	return __mt9t112_reg_write(client, 0x0990, data);
+}
+
+static int __mt9t112_mcu_mask_set(const struct i2c_client *client,
+				  u16  command,
+				  u16  mask,
+				  u16  set)
+{
+	int val = __mt9t112_mcu_read(client, command);
+	if (val < 0)
+		return val;
+
+	val &= ~mask;
+	val |= set & mask;
+
+	return __mt9t112_mcu_write(client, command, val);
+}
+
+static int mt9t112_reset(const struct i2c_client *client)
+{
+	int ret;
+
+	mt9t112_reg_mask_set(ret, client, 0x001a, 0x0001, 0x0001);
+	msleep(1);
+	mt9t112_reg_mask_set(ret, client, 0x001a, 0x0001, 0x0000);
+
+	return ret;
+}
+
+#ifndef EXT_CLOCK
+#define CLOCK_INFO(a, b)
+#else
+#define CLOCK_INFO(a, b) mt9t112_clock_info(a, b)
+static int mt9t112_clock_info(const struct i2c_client *client, u32 ext)
+{
+	int m, n, p1, p2, p3, p4, p5, p6, p7;
+	u32 vco, clk;
+	char *enable;
+
+	ext /= 1000; /* kbyte order */
+
+	mt9t112_reg_read(n, client, 0x0012);
+	p1 = n & 0x000f;
+	n = n >> 4;
+	p2 = n & 0x000f;
+	n = n >> 4;
+	p3 = n & 0x000f;
+
+	mt9t112_reg_read(n, client, 0x002a);
+	p4 = n & 0x000f;
+	n = n >> 4;
+	p5 = n & 0x000f;
+	n = n >> 4;
+	p6 = n & 0x000f;
+
+	mt9t112_reg_read(n, client, 0x002c);
+	p7 = n & 0x000f;
+
+	mt9t112_reg_read(n, client, 0x0010);
+	m = n & 0x00ff;
+	n = (n >> 8) & 0x003f;
+
+	enable = ((6000 > ext) || (54000 < ext)) ? "X" : "";
+	dev_info(&client->dev, "EXTCLK          : %10u K %s\n", ext, enable);
+
+	vco = 2 * m * ext / (n+1);
+	enable = ((384000 > vco) || (768000 < vco)) ? "X" : "";
+	dev_info(&client->dev, "VCO             : %10u K %s\n", vco, enable);
+
+	clk = vco / (p1+1) / (p2+1);
+	enable = (96000 < clk) ? "X" : "";
+	dev_info(&client->dev, "PIXCLK          : %10u K %s\n", clk, enable);
+
+	clk = vco / (p3+1);
+	enable = (768000 < clk) ? "X" : "";
+	dev_info(&client->dev, "MIPICLK         : %10u K %s\n", clk, enable);
+
+	clk = vco / (p6+1);
+	enable = (96000 < clk) ? "X" : "";
+	dev_info(&client->dev, "MCU CLK         : %10u K %s\n", clk, enable);
+
+	clk = vco / (p5+1);
+	enable = (54000 < clk) ? "X" : "";
+	dev_info(&client->dev, "SOC CLK         : %10u K %s\n", clk, enable);
+
+	clk = vco / (p4+1);
+	enable = (70000 < clk) ? "X" : "";
+	dev_info(&client->dev, "Sensor CLK      : %10u K %s\n", clk, enable);
+
+	clk = vco / (p7+1);
+	dev_info(&client->dev, "External sensor : %10u K\n", clk);
+
+	clk = ext / (n+1);
+	enable = ((2000 > clk) || (24000 < clk)) ? "X" : "";
+	dev_info(&client->dev, "PFD             : %10u K %s\n", clk, enable);
+
+	return 0;
+}
+#endif
+
+static void mt9t112_frame_check(u32 *width, u32 *height)
+{
+	if (*width > MAX_WIDTH)
+		*width = MAX_WIDTH;
+
+	if (*height > MAX_HEIGHT)
+		*height = MAX_HEIGHT;
+}
+
+static int mt9t112_set_a_frame_size(const struct i2c_client *client,
+				   u16 width,
+				   u16 height)
+{
+	int ret;
+	u16 wstart = (MAX_WIDTH - width) / 2;
+	u16 hstart = (MAX_HEIGHT - height) / 2;
+
+	/* (Context A) Image Width/Height */
+	mt9t112_mcu_write(ret, client, VAR(26, 0), width);
+	mt9t112_mcu_write(ret, client, VAR(26, 2), height);
+
+	/* (Context A) Output Width/Height */
+	mt9t112_mcu_write(ret, client, VAR(18, 43), 8 + width);
+	mt9t112_mcu_write(ret, client, VAR(18, 45), 8 + height);
+
+	/* (Context A) Start Row/Column */
+	mt9t112_mcu_write(ret, client, VAR(18, 2), 4 + hstart);
+	mt9t112_mcu_write(ret, client, VAR(18, 4), 4 + wstart);
+
+	/* (Context A) End Row/Column */
+	mt9t112_mcu_write(ret, client, VAR(18, 6), 11 + height + hstart);
+	mt9t112_mcu_write(ret, client, VAR(18, 8), 11 + width  + wstart);
+
+	mt9t112_mcu_write(ret, client, VAR8(1, 0), 0x06);
+
+	return ret;
+}
+
+static int mt9t112_set_pll_dividers(const struct i2c_client *client,
+				    u8 m, u8 n,
+				    u8 p1, u8 p2, u8 p3,
+				    u8 p4, u8 p5, u8 p6,
+				    u8 p7)
+{
+	int ret;
+	u16 val;
+
+	/* N/M */
+	val = (n << 8) |
+	      (m << 0);
+	mt9t112_reg_mask_set(ret, client, 0x0010, 0x3fff, val);
+
+	/* P1/P2/P3 */
+	val = ((p3 & 0x0F) << 8) |
+	      ((p2 & 0x0F) << 4) |
+	      ((p1 & 0x0F) << 0);
+	mt9t112_reg_mask_set(ret, client, 0x0012, 0x0fff, val);
+
+	/* P4/P5/P6 */
+	val = (0x7         << 12) |
+	      ((p6 & 0x0F) <<  8) |
+	      ((p5 & 0x0F) <<  4) |
+	      ((p4 & 0x0F) <<  0);
+	mt9t112_reg_mask_set(ret, client, 0x002A, 0x7fff, val);
+
+	/* P7 */
+	val = (0x1         << 12) |
+	      ((p7 & 0x0F) <<  0);
+	mt9t112_reg_mask_set(ret, client, 0x002C, 0x100f, val);
+
+	return ret;
+}
+
+static int mt9t112_init_pll(const struct i2c_client *client)
+{
+	struct mt9t112_priv *priv = to_mt9t112(client);
+	int data, i, ret;
+
+	mt9t112_reg_mask_set(ret, client, 0x0014, 0x003, 0x0001);
+
+	/* PLL control: BYPASS PLL = 8517 */
+	mt9t112_reg_write(ret, client, 0x0014, 0x2145);
+
+	/* Replace these registers when new timing parameters are generated */
+	mt9t112_set_pll_dividers(client,
+				 priv->info->divider.m,
+				 priv->info->divider.n,
+				 priv->info->divider.p1,
+				 priv->info->divider.p2,
+				 priv->info->divider.p3,
+				 priv->info->divider.p4,
+				 priv->info->divider.p5,
+				 priv->info->divider.p6,
+				 priv->info->divider.p7);
+
+	/*
+	 * TEST_BYPASS  on
+	 * PLL_ENABLE   on
+	 * SEL_LOCK_DET on
+	 * TEST_BYPASS  off
+	 */
+	mt9t112_reg_write(ret, client, 0x0014, 0x2525);
+	mt9t112_reg_write(ret, client, 0x0014, 0x2527);
+	mt9t112_reg_write(ret, client, 0x0014, 0x3427);
+	mt9t112_reg_write(ret, client, 0x0014, 0x3027);
+
+	mdelay(10);
+
+	/*
+	 * PLL_BYPASS off
+	 * Reference clock count
+	 * I2C Master Clock Divider
+	 */
+	mt9t112_reg_write(ret, client, 0x0014, 0x3046);
+	mt9t112_reg_write(ret, client, 0x0022, 0x0190);
+	mt9t112_reg_write(ret, client, 0x3B84, 0x0212);
+
+	/* External sensor clock is PLL bypass */
+	mt9t112_reg_write(ret, client, 0x002E, 0x0500);
+
+	mt9t112_reg_mask_set(ret, client, 0x0018, 0x0002, 0x0002);
+	mt9t112_reg_mask_set(ret, client, 0x3B82, 0x0004, 0x0004);
+
+	/* MCU disabled */
+	mt9t112_reg_mask_set(ret, client, 0x0018, 0x0004, 0x0004);
+
+	/* out of standby */
+	mt9t112_reg_mask_set(ret, client, 0x0018, 0x0001, 0);
+
+	mdelay(50);
+
+	/*
+	 * Standby Workaround
+	 * Disable Secondary I2C Pads
+	 */
+	mt9t112_reg_write(ret, client, 0x0614, 0x0001);
+	mdelay(1);
+	mt9t112_reg_write(ret, client, 0x0614, 0x0001);
+	mdelay(1);
+	mt9t112_reg_write(ret, client, 0x0614, 0x0001);
+	mdelay(1);
+	mt9t112_reg_write(ret, client, 0x0614, 0x0001);
+	mdelay(1);
+	mt9t112_reg_write(ret, client, 0x0614, 0x0001);
+	mdelay(1);
+	mt9t112_reg_write(ret, client, 0x0614, 0x0001);
+	mdelay(1);
+
+	/* poll to verify out of standby. Must Poll this bit */
+	for (i = 0; i < 100; i++) {
+		mt9t112_reg_read(data, client, 0x0018);
+		if (0x4000 & data)
+			break;
+
+		mdelay(10);
+	}
+
+	return ret;
+}
+
+static int mt9t112_init_setting(const struct i2c_client *client)
+{
+
+	int ret;
+
+	/* Adaptive Output Clock (A) */
+	mt9t112_mcu_mask_set(ret, client, VAR(26, 160), 0x0040, 0x0000);
+
+	/* Read Mode (A) */
+	mt9t112_mcu_write(ret, client, VAR(18, 12), 0x0024);
+
+	/* Fine Correction (A) */
+	mt9t112_mcu_write(ret, client, VAR(18, 15), 0x00CC);
+
+	/* Fine IT Min (A) */
+	mt9t112_mcu_write(ret, client, VAR(18, 17), 0x01f1);
+
+	/* Fine IT Max Margin (A) */
+	mt9t112_mcu_write(ret, client, VAR(18, 19), 0x00fF);
+
+	/* Base Frame Lines (A) */
+	mt9t112_mcu_write(ret, client, VAR(18, 29), 0x032D);
+
+	/* Min Line Length (A) */
+	mt9t112_mcu_write(ret, client, VAR(18, 31), 0x073a);
+
+	/* Line Length (A) */
+	mt9t112_mcu_write(ret, client, VAR(18, 37), 0x07d0);
+
+	/* Adaptive Output Clock (B) */
+	mt9t112_mcu_mask_set(ret, client, VAR(27, 160), 0x0040, 0x0000);
+
+	/* Row Start (B) */
+	mt9t112_mcu_write(ret, client, VAR(18, 74), 0x004);
+
+	/* Column Start (B) */
+	mt9t112_mcu_write(ret, client, VAR(18, 76), 0x004);
+
+	/* Row End (B) */
+	mt9t112_mcu_write(ret, client, VAR(18, 78), 0x60B);
+
+	/* Column End (B) */
+	mt9t112_mcu_write(ret, client, VAR(18, 80), 0x80B);
+
+	/* Fine Correction (B) */
+	mt9t112_mcu_write(ret, client, VAR(18, 87), 0x008C);
+
+	/* Fine IT Min (B) */
+	mt9t112_mcu_write(ret, client, VAR(18, 89), 0x01F1);
+
+	/* Fine IT Max Margin (B) */
+	mt9t112_mcu_write(ret, client, VAR(18, 91), 0x00FF);
+
+	/* Base Frame Lines (B) */
+	mt9t112_mcu_write(ret, client, VAR(18, 101), 0x0668);
+
+	/* Min Line Length (B) */
+	mt9t112_mcu_write(ret, client, VAR(18, 103), 0x0AF0);
+
+	/* Line Length (B) */
+	mt9t112_mcu_write(ret, client, VAR(18, 109), 0x0AF0);
+
+	/*
+	 * Flicker Dectection registers
+	 * This section should be replaced whenever new Timing file is generated
+	 * All the following registers need to be replaced
+	 * Following registers are generated from Register Wizard but user can
+	 * modify them. For detail see auto flicker detection tuning
+	 */
+
+	/* FD_FDPERIOD_SELECT */
+	mt9t112_mcu_write(ret, client, VAR8(8, 5), 0x01);
+
+	/* PRI_B_CONFIG_FD_ALGO_RUN */
+	mt9t112_mcu_write(ret, client, VAR(27, 17), 0x0003);
+
+	/* PRI_A_CONFIG_FD_ALGO_RUN */
+	mt9t112_mcu_write(ret, client, VAR(26, 17), 0x0003);
+
+	/*
+	 * AFD range detection tuning registers
+	 */
+
+	/* search_f1_50 */
+	mt9t112_mcu_write(ret, client, VAR8(18, 165), 0x25);
+
+	/* search_f2_50 */
+	mt9t112_mcu_write(ret, client, VAR8(18, 166), 0x28);
+
+	/* search_f1_60 */
+	mt9t112_mcu_write(ret, client, VAR8(18, 167), 0x2C);
+
+	/* search_f2_60 */
+	mt9t112_mcu_write(ret, client, VAR8(18, 168), 0x2F);
+
+	/* period_50Hz (A) */
+	mt9t112_mcu_write(ret, client, VAR8(18, 68), 0xBA);
+
+	/* secret register by aptina */
+	/* period_50Hz (A MSB) */
+	mt9t112_mcu_write(ret, client, VAR8(18, 303), 0x00);
+
+	/* period_60Hz (A) */
+	mt9t112_mcu_write(ret, client, VAR8(18, 69), 0x9B);
+
+	/* secret register by aptina */
+	/* period_60Hz (A MSB) */
+	mt9t112_mcu_write(ret, client, VAR8(18, 301), 0x00);
+
+	/* period_50Hz (B) */
+	mt9t112_mcu_write(ret, client, VAR8(18, 140), 0x82);
+
+	/* secret register by aptina */
+	/* period_50Hz (B) MSB */
+	mt9t112_mcu_write(ret, client, VAR8(18, 304), 0x00);
+
+	/* period_60Hz (B) */
+	mt9t112_mcu_write(ret, client, VAR8(18, 141), 0x6D);
+
+	/* secret register by aptina */
+	/* period_60Hz (B) MSB */
+	mt9t112_mcu_write(ret, client, VAR8(18, 302), 0x00);
+
+	/* FD Mode */
+	mt9t112_mcu_write(ret, client, VAR8(8, 2), 0x10);
+
+	/* Stat_min */
+	mt9t112_mcu_write(ret, client, VAR8(8, 9), 0x02);
+
+	/* Stat_max */
+	mt9t112_mcu_write(ret, client, VAR8(8, 10), 0x03);
+
+	/* Min_amplitude */
+	mt9t112_mcu_write(ret, client, VAR8(8, 12), 0x0A);
+
+	/* RX FIFO Watermark (A) */
+	mt9t112_mcu_write(ret, client, VAR(18, 70), 0x0014);
+
+	/* RX FIFO Watermark (B) */
+	mt9t112_mcu_write(ret, client, VAR(18, 142), 0x0014);
+
+	/* MCLK: 16MHz
+	 * PCLK: 73MHz
+	 * CorePixCLK: 36.5 MHz
+	 */
+	mt9t112_mcu_write(ret, client, VAR8(18, 0x0044), 133);
+	mt9t112_mcu_write(ret, client, VAR8(18, 0x0045), 110);
+	mt9t112_mcu_write(ret, client, VAR8(18, 0x008c), 130);
+	mt9t112_mcu_write(ret, client, VAR8(18, 0x008d), 108);
+
+	mt9t112_mcu_write(ret, client, VAR8(18, 0x00A5), 27);
+	mt9t112_mcu_write(ret, client, VAR8(18, 0x00a6), 30);
+	mt9t112_mcu_write(ret, client, VAR8(18, 0x00a7), 32);
+	mt9t112_mcu_write(ret, client, VAR8(18, 0x00a8), 35);
+
+	return ret;
+}
+
+static int mt9t112_auto_focus_setting(const struct i2c_client *client)
+{
+	int ret;
+
+	mt9t112_mcu_write(ret, client, VAR(12, 13),	0x000F);
+	mt9t112_mcu_write(ret, client, VAR(12, 23),	0x0F0F);
+	mt9t112_mcu_write(ret, client, VAR8(1, 0),	0x06);
+
+	mt9t112_reg_write(ret, client, 0x0614, 0x0000);
+
+	mt9t112_mcu_write(ret, client, VAR8(1, 0),	0x05);
+	mt9t112_mcu_write(ret, client, VAR8(12, 2),	0x02);
+	mt9t112_mcu_write(ret, client, VAR(12, 3),	0x0002);
+	mt9t112_mcu_write(ret, client, VAR(17, 3),	0x8001);
+	mt9t112_mcu_write(ret, client, VAR(17, 11),	0x0025);
+	mt9t112_mcu_write(ret, client, VAR(17, 13),	0x0193);
+	mt9t112_mcu_write(ret, client, VAR8(17, 33),	0x18);
+	mt9t112_mcu_write(ret, client, VAR8(1, 0),	0x05);
+
+	return ret;
+}
+
+static int mt9t112_auto_focus_trigger(const struct i2c_client *client)
+{
+	int ret;
+
+	mt9t112_mcu_write(ret, client, VAR8(12, 25), 0x01);
+
+	return ret;
+}
+
+static int mt9t112_init_camera(const struct i2c_client *client)
+{
+	int ret;
+
+	ECHECKER(ret, mt9t112_reset(client));
+
+	ECHECKER(ret, mt9t112_init_pll(client));
+
+	ECHECKER(ret, mt9t112_init_setting(client));
+
+	ECHECKER(ret, mt9t112_auto_focus_setting(client));
+
+	mt9t112_reg_mask_set(ret, client, 0x0018, 0x0004, 0);
+
+	/* Analog setting B */
+	mt9t112_reg_write(ret, client, 0x3084, 0x2409);
+	mt9t112_reg_write(ret, client, 0x3092, 0x0A49);
+	mt9t112_reg_write(ret, client, 0x3094, 0x4949);
+	mt9t112_reg_write(ret, client, 0x3096, 0x4950);
+
+	/*
+	 * Disable adaptive clock
+	 * PRI_A_CONFIG_JPEG_OB_TX_CONTROL_VAR
+	 * PRI_B_CONFIG_JPEG_OB_TX_CONTROL_VAR
+	 */
+	mt9t112_mcu_write(ret, client, VAR(26, 160), 0x0A2E);
+	mt9t112_mcu_write(ret, client, VAR(27, 160), 0x0A2E);
+
+	/* Configure STatus in Status_before_length Format and enable header */
+	/* PRI_B_CONFIG_JPEG_OB_TX_CONTROL_VAR */
+	mt9t112_mcu_write(ret, client, VAR(27, 144), 0x0CB4);
+
+	/* Enable JPEG in context B */
+	/* PRI_B_CONFIG_JPEG_OB_TX_CONTROL_VAR */
+	mt9t112_mcu_write(ret, client, VAR8(27, 142), 0x01);
+
+	/* Disable Dac_TXLO */
+	mt9t112_reg_write(ret, client, 0x316C, 0x350F);
+
+	/* Set max slew rates */
+	mt9t112_reg_write(ret, client, 0x1E, 0x777);
+
+	return ret;
+}
+
+/************************************************************************
+
+
+			soc_camera_ops
+
+
+************************************************************************/
+static int mt9t112_set_bus_param(struct soc_camera_device *icd,
+				 unsigned long	flags)
+{
+	return 0;
+}
+
+static unsigned long mt9t112_query_bus_param(struct soc_camera_device *icd)
+{
+	struct i2c_client *client = to_i2c_client(to_soc_camera_control(icd));
+	struct mt9t112_priv *priv = to_mt9t112(client);
+	struct soc_camera_link *icl = to_soc_camera_link(icd);
+	unsigned long flags = SOCAM_MASTER | SOCAM_VSYNC_ACTIVE_HIGH |
+		SOCAM_HSYNC_ACTIVE_HIGH | SOCAM_DATA_ACTIVE_HIGH;
+
+	flags |= (priv->info->flags & MT9T112_FLAG_PCLK_RISING_EDGE) ?
+		SOCAM_PCLK_SAMPLE_RISING : SOCAM_PCLK_SAMPLE_FALLING;
+
+	if (priv->info->flags & MT9T112_FLAG_DATAWIDTH_8)
+		flags |= SOCAM_DATAWIDTH_8;
+	else
+		flags |= SOCAM_DATAWIDTH_10;
+
+	return soc_camera_apply_sensor_flags(icl, flags);
+}
+
+static struct soc_camera_ops mt9t112_ops = {
+	.set_bus_param		= mt9t112_set_bus_param,
+	.query_bus_param	= mt9t112_query_bus_param,
+};
+
+/************************************************************************
+
+
+			v4l2_subdev_core_ops
+
+
+************************************************************************/
+static int mt9t112_g_chip_ident(struct v4l2_subdev *sd,
+				struct v4l2_dbg_chip_ident *id)
+{
+	struct i2c_client *client = sd->priv;
+	struct mt9t112_priv *priv = to_mt9t112(client);
+
+	id->ident    = priv->model;
+	id->revision = 0;
+
+	return 0;
+}
+
+#ifdef CONFIG_VIDEO_ADV_DEBUG
+static int mt9t112_g_register(struct v4l2_subdev *sd,
+			      struct v4l2_dbg_register *reg)
+{
+	struct i2c_client *client = sd->priv;
+	int                ret;
+
+	reg->size = 2;
+	mt9t112_reg_read(ret, client, reg->reg);
+
+	reg->val = (__u64)ret;
+
+	return 0;
+}
+
+static int mt9t112_s_register(struct v4l2_subdev *sd,
+			      struct v4l2_dbg_register *reg)
+{
+	struct i2c_client *client = sd->priv;
+	int ret;
+
+	mt9t112_reg_write(ret, client, reg->reg, reg->val);
+
+	return ret;
+}
+#endif
+
+static struct v4l2_subdev_core_ops mt9t112_subdev_core_ops = {
+	.g_chip_ident	= mt9t112_g_chip_ident,
+#ifdef CONFIG_VIDEO_ADV_DEBUG
+	.g_register	= mt9t112_g_register,
+	.s_register	= mt9t112_s_register,
+#endif
+};
+
+
+/************************************************************************
+
+
+			v4l2_subdev_video_ops
+
+
+************************************************************************/
+static int mt9t112_s_stream(struct v4l2_subdev *sd, int enable)
+{
+	struct i2c_client *client = sd->priv;
+	struct mt9t112_priv *priv = to_mt9t112(client);
+	int ret = 0;
+
+	if (!enable) {
+		/* FIXME
+		 *
+		 * If user selected large output size,
+		 * and used it long time,
+		 * mt9t112 camera will be very warm.
+		 *
+		 * But current driver can not stop mt9t112 camera.
+		 * So, set small size here to solve this problem.
+		 */
+		mt9t112_set_a_frame_size(client, VGA_WIDTH, VGA_HEIGHT);
+		return ret;
+	}
+
+	if (!(priv->flags & INIT_DONE)) {
+		u16 param = (MT9T112_FLAG_PCLK_RISING_EDGE &
+			     priv->info->flags) ? 0x0001 : 0x0000;
+
+		ECHECKER(ret, mt9t112_init_camera(client));
+
+		/* Invert PCLK (Data sampled on falling edge of pixclk) */
+		mt9t112_reg_write(ret, client, 0x3C20, param);
+
+		mdelay(5);
+
+		priv->flags |= INIT_DONE;
+	}
+
+	mt9t112_mcu_write(ret, client, VAR(26, 7), priv->format->fmt);
+	mt9t112_mcu_write(ret, client, VAR(26, 9), priv->format->order);
+	mt9t112_mcu_write(ret, client, VAR8(1, 0), 0x06);
+
+	mt9t112_set_a_frame_size(client,
+				 priv->frame.width,
+				 priv->frame.height);
+
+	ECHECKER(ret, mt9t112_auto_focus_trigger(client));
+
+	dev_dbg(&client->dev, "format : %d\n", priv->format->code);
+	dev_dbg(&client->dev, "size   : %d x %d\n",
+		priv->frame.width,
+		priv->frame.height);
+
+	CLOCK_INFO(client, EXT_CLOCK);
+
+	return ret;
+}
+
+static int mt9t112_set_params(struct i2c_client *client, u32 width, u32 height,
+			      enum v4l2_mbus_pixelcode code)
+{
+	struct mt9t112_priv *priv = to_mt9t112(client);
+	int i;
+
+	priv->format = NULL;
+
+	/*
+	 * frame size check
+	 */
+	mt9t112_frame_check(&width, &height);
+
+	/*
+	 * get color format
+	 */
+	for (i = 0; i < ARRAY_SIZE(mt9t112_cfmts); i++)
+		if (mt9t112_cfmts[i].code == code)
+			break;
+
+	if (i == ARRAY_SIZE(mt9t112_cfmts))
+		return -EINVAL;
+
+	priv->frame.width  = (u16)width;
+	priv->frame.height = (u16)height;
+
+	priv->format = mt9t112_cfmts + i;
+
+	return 0;
+}
+
+static int mt9t112_cropcap(struct v4l2_subdev *sd, struct v4l2_cropcap *a)
+{
+	a->bounds.left			= 0;
+	a->bounds.top			= 0;
+	a->bounds.width			= VGA_WIDTH;
+	a->bounds.height		= VGA_HEIGHT;
+	a->defrect			= a->bounds;
+	a->type				= V4L2_BUF_TYPE_VIDEO_CAPTURE;
+	a->pixelaspect.numerator	= 1;
+	a->pixelaspect.denominator	= 1;
+
+	return 0;
+}
+
+static int mt9t112_g_crop(struct v4l2_subdev *sd, struct v4l2_crop *a)
+{
+	a->c.left	= 0;
+	a->c.top	= 0;
+	a->c.width	= VGA_WIDTH;
+	a->c.height	= VGA_HEIGHT;
+	a->type		= V4L2_BUF_TYPE_VIDEO_CAPTURE;
+
+	return 0;
+}
+
+static int mt9t112_s_crop(struct v4l2_subdev *sd, struct v4l2_crop *a)
+{
+	struct i2c_client *client = sd->priv;
+	struct v4l2_rect *rect = &a->c;
+
+	return mt9t112_set_params(client, rect->width, rect->height,
+				 V4L2_MBUS_FMT_YUYV8_2X8_BE);
+}
+
+static int mt9t112_g_fmt(struct v4l2_subdev *sd,
+			 struct v4l2_mbus_framefmt *mf)
+{
+	struct i2c_client *client = sd->priv;
+	struct mt9t112_priv *priv = to_mt9t112(client);
+
+	if (!priv->format) {
+		int ret = mt9t112_set_params(client, VGA_WIDTH, VGA_HEIGHT,
+					     V4L2_MBUS_FMT_YUYV8_2X8_BE);
+		if (ret < 0)
+			return ret;
+	}
+
+	mf->width	= priv->frame.width;
+	mf->height	= priv->frame.height;
+	/* TODO: set colorspace */
+	mf->code	= priv->format->code;
+	mf->field	= V4L2_FIELD_NONE;
+
+	return 0;
+}
+
+static int mt9t112_s_fmt(struct v4l2_subdev *sd,
+			 struct v4l2_mbus_framefmt *mf)
+{
+	struct i2c_client *client = sd->priv;
+
+	/* TODO: set colorspace */
+	return mt9t112_set_params(client, mf->width, mf->height, mf->code);
+}
+
+static int mt9t112_try_fmt(struct v4l2_subdev *sd,
+			   struct v4l2_mbus_framefmt *mf)
+{
+	mt9t112_frame_check(&mf->width, &mf->height);
+
+	/* TODO: set colorspace */
+	mf->field = V4L2_FIELD_NONE;
+
+	return 0;
+}
+
+static int mt9t112_enum_fmt(struct v4l2_subdev *sd, int index,
+			   enum v4l2_mbus_pixelcode *code)
+{
+	if ((unsigned int)index >= ARRAY_SIZE(mt9t112_cfmts))
+		return -EINVAL;
+
+	*code = mt9t112_cfmts[index].code;
+	return 0;
+}
+
+static struct v4l2_subdev_video_ops mt9t112_subdev_video_ops = {
+	.s_stream	= mt9t112_s_stream,
+	.g_mbus_fmt	= mt9t112_g_fmt,
+	.s_mbus_fmt	= mt9t112_s_fmt,
+	.try_mbus_fmt	= mt9t112_try_fmt,
+	.cropcap	= mt9t112_cropcap,
+	.g_crop		= mt9t112_g_crop,
+	.s_crop		= mt9t112_s_crop,
+	.enum_mbus_fmt	= mt9t112_enum_fmt,
+};
+
+/************************************************************************
+
+
+			i2c driver
+
+
+************************************************************************/
+static struct v4l2_subdev_ops mt9t112_subdev_ops = {
+	.core	= &mt9t112_subdev_core_ops,
+	.video	= &mt9t112_subdev_video_ops,
+};
+
+static int mt9t112_camera_probe(struct soc_camera_device *icd,
+				struct i2c_client *client)
+{
+	struct mt9t112_priv *priv = to_mt9t112(client);
+	const char          *devname;
+	int                  chipid;
+
+	/*
+	 * We must have a parent by now. And it cannot be a wrong one.
+	 * So this entire test is completely redundant.
+	 */
+	if (!icd->dev.parent ||
+	    to_soc_camera_host(icd->dev.parent)->nr != icd->iface)
+		return -ENODEV;
+
+	/*
+	 * check and show chip ID
+	 */
+	mt9t112_reg_read(chipid, client, 0x0000);
+
+	switch (chipid) {
+	case 0x2680:
+		devname = "mt9t111";
+		priv->model = V4L2_IDENT_MT9T111;
+		break;
+	case 0x2682:
+		devname = "mt9t112";
+		priv->model = V4L2_IDENT_MT9T112;
+		break;
+	default:
+		dev_err(&client->dev, "Product ID error %04x\n", chipid);
+		return -ENODEV;
+	}
+
+	dev_info(&client->dev, "%s chip ID %04x\n", devname, chipid);
+
+	return 0;
+}
+
+static int mt9t112_probe(struct i2c_client *client,
+			 const struct i2c_device_id *did)
+{
+	struct mt9t112_priv        *priv;
+	struct soc_camera_device   *icd = client->dev.platform_data;
+	struct soc_camera_link     *icl;
+	int                         ret;
+
+	if (!icd) {
+		dev_err(&client->dev, "mt9t112: missing soc-camera data!\n");
+		return -EINVAL;
+	}
+
+	icl = to_soc_camera_link(icd);
+	if (!icl || !icl->priv)
+		return -EINVAL;
+
+	priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+	if (!priv)
+		return -ENOMEM;
+
+	priv->info = icl->priv;
+
+	v4l2_i2c_subdev_init(&priv->subdev, client, &mt9t112_subdev_ops);
+
+	icd->ops = &mt9t112_ops;
+
+	ret = mt9t112_camera_probe(icd, client);
+	if (ret) {
+		icd->ops = NULL;
+		i2c_set_clientdata(client, NULL);
+		kfree(priv);
+	}
+
+	return ret;
+}
+
+static int mt9t112_remove(struct i2c_client *client)
+{
+	struct mt9t112_priv *priv = to_mt9t112(client);
+	struct soc_camera_device *icd = client->dev.platform_data;
+
+	icd->ops = NULL;
+	i2c_set_clientdata(client, NULL);
+	kfree(priv);
+	return 0;
+}
+
+static const struct i2c_device_id mt9t112_id[] = {
+	{ "mt9t112", 0 },
+	{ }
+};
+MODULE_DEVICE_TABLE(i2c, mt9t112_id);
+
+static struct i2c_driver mt9t112_i2c_driver = {
+	.driver = {
+		.name = "mt9t112",
+	},
+	.probe    = mt9t112_probe,
+	.remove   = mt9t112_remove,
+	.id_table = mt9t112_id,
+};
+
+/************************************************************************
+
+
+			module function
+
+
+************************************************************************/
+static int __init mt9t112_module_init(void)
+{
+	return i2c_add_driver(&mt9t112_i2c_driver);
+}
+
+static void __exit mt9t112_module_exit(void)
+{
+	i2c_del_driver(&mt9t112_i2c_driver);
+}
+
+module_init(mt9t112_module_init);
+module_exit(mt9t112_module_exit);
+
+MODULE_DESCRIPTION("SoC Camera driver for mt9t112");
+MODULE_AUTHOR("Kuninori Morimoto");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/media/video/mt9v022.c b/drivers/media/video/mt9v022.c
index 995607f9d3ba..91df7ec91fb6 100644
--- a/drivers/media/video/mt9v022.c
+++ b/drivers/media/video/mt9v022.c
@@ -18,9 +18,11 @@
 #include <media/v4l2-chip-ident.h>
 #include <media/soc_camera.h>
 
-/* mt9v022 i2c address 0x48, 0x4c, 0x58, 0x5c
+/*
+ * mt9v022 i2c address 0x48, 0x4c, 0x58, 0x5c
  * The platform has to define ctruct i2c_board_info objects and link to them
- * from struct soc_camera_link */
+ * from struct soc_camera_link
+ */
 
 static char *sensor_type;
 module_param(sensor_type, charp, S_IRUGO);
@@ -62,41 +64,49 @@ MODULE_PARM_DESC(sensor_type, "Sensor type: \"colour\" or \"monochrome\"");
 #define MT9V022_COLUMN_SKIP		1
 #define MT9V022_ROW_SKIP		4
 
-static const struct soc_camera_data_format mt9v022_colour_formats[] = {
-	/* Order important: first natively supported,
-	 * second supported with a GPIO extender */
-	{
-		.name		= "Bayer (sRGB) 10 bit",
-		.depth		= 10,
-		.fourcc		= V4L2_PIX_FMT_SBGGR16,
-		.colorspace	= V4L2_COLORSPACE_SRGB,
-	}, {
-		.name		= "Bayer (sRGB) 8 bit",
-		.depth		= 8,
-		.fourcc		= V4L2_PIX_FMT_SBGGR8,
-		.colorspace	= V4L2_COLORSPACE_SRGB,
-	}
+/* MT9V022 has only one fixed colorspace per pixelcode */
+struct mt9v022_datafmt {
+	enum v4l2_mbus_pixelcode	code;
+	enum v4l2_colorspace		colorspace;
+};
+
+/* Find a data format by a pixel code in an array */
+static const struct mt9v022_datafmt *mt9v022_find_datafmt(
+	enum v4l2_mbus_pixelcode code, const struct mt9v022_datafmt *fmt,
+	int n)
+{
+	int i;
+	for (i = 0; i < n; i++)
+		if (fmt[i].code == code)
+			return fmt + i;
+
+	return NULL;
+}
+
+static const struct mt9v022_datafmt mt9v022_colour_fmts[] = {
+	/*
+	 * Order important: first natively supported,
+	 * second supported with a GPIO extender
+	 */
+	{V4L2_MBUS_FMT_SBGGR10_1X10, V4L2_COLORSPACE_SRGB},
+	{V4L2_MBUS_FMT_SBGGR8_1X8, V4L2_COLORSPACE_SRGB},
 };
 
-static const struct soc_camera_data_format mt9v022_monochrome_formats[] = {
+static const struct mt9v022_datafmt mt9v022_monochrome_fmts[] = {
 	/* Order important - see above */
-	{
-		.name		= "Monochrome 10 bit",
-		.depth		= 10,
-		.fourcc		= V4L2_PIX_FMT_Y16,
-	}, {
-		.name		= "Monochrome 8 bit",
-		.depth		= 8,
-		.fourcc		= V4L2_PIX_FMT_GREY,
-	},
+	{V4L2_MBUS_FMT_Y10_1X10, V4L2_COLORSPACE_JPEG},
+	{V4L2_MBUS_FMT_GREY8_1X8, V4L2_COLORSPACE_JPEG},
 };
 
 struct mt9v022 {
 	struct v4l2_subdev subdev;
 	struct v4l2_rect rect;	/* Sensor window */
-	__u32 fourcc;
+	const struct mt9v022_datafmt *fmt;
+	const struct mt9v022_datafmt *fmts;
+	int num_fmts;
 	int model;	/* V4L2_IDENT_MT9V022* codes from v4l2-chip-ident.h */
 	u16 chip_control;
+	unsigned short y_skip_top;	/* Lines to skip at the top */
 };
 
 static struct mt9v022 *to_mt9v022(const struct i2c_client *client)
@@ -143,9 +153,11 @@ static int mt9v022_init(struct i2c_client *client)
 	struct mt9v022 *mt9v022 = to_mt9v022(client);
 	int ret;
 
-	/* Almost the default mode: master, parallel, simultaneous, and an
+	/*
+	 * Almost the default mode: master, parallel, simultaneous, and an
 	 * undocumented bit 0x200, which is present in table 7, but not in 8,
-	 * plus snapshot mode to disable scan for now */
+	 * plus snapshot mode to disable scan for now
+	 */
 	mt9v022->chip_control |= 0x10;
 	ret = reg_write(client, MT9V022_CHIP_CONTROL, mt9v022->chip_control);
 	if (!ret)
@@ -265,12 +277,10 @@ static int mt9v022_s_crop(struct v4l2_subdev *sd, struct v4l2_crop *a)
 	struct i2c_client *client = sd->priv;
 	struct mt9v022 *mt9v022 = to_mt9v022(client);
 	struct v4l2_rect rect = a->c;
-	struct soc_camera_device *icd = client->dev.platform_data;
 	int ret;
 
 	/* Bayer format - even size lengths */
-	if (mt9v022->fourcc == V4L2_PIX_FMT_SBGGR8 ||
-	    mt9v022->fourcc == V4L2_PIX_FMT_SBGGR16) {
+	if (mt9v022->fmts == mt9v022_colour_fmts) {
 		rect.width	= ALIGN(rect.width, 2);
 		rect.height	= ALIGN(rect.height, 2);
 		/* Let the user play with the starting pixel */
@@ -287,10 +297,10 @@ static int mt9v022_s_crop(struct v4l2_subdev *sd, struct v4l2_crop *a)
 	if (ret >= 0) {
 		if (ret & 1) /* Autoexposure */
 			ret = reg_write(client, MT9V022_MAX_TOTAL_SHUTTER_WIDTH,
-					rect.height + icd->y_skip_top + 43);
+					rect.height + mt9v022->y_skip_top + 43);
 		else
 			ret = reg_write(client, MT9V022_TOTAL_SHUTTER_WIDTH,
-					rect.height + icd->y_skip_top + 43);
+					rect.height + mt9v022->y_skip_top + 43);
 	}
 	/* Setup frame format: defaults apart from width and height */
 	if (!ret)
@@ -298,8 +308,10 @@ static int mt9v022_s_crop(struct v4l2_subdev *sd, struct v4l2_crop *a)
 	if (!ret)
 		ret = reg_write(client, MT9V022_ROW_START, rect.top);
 	if (!ret)
-		/* Default 94, Phytec driver says:
-		 * "width + horizontal blank >= 660" */
+		/*
+		 * Default 94, Phytec driver says:
+		 * "width + horizontal blank >= 660"
+		 */
 		ret = reg_write(client, MT9V022_HORIZONTAL_BLANKING,
 				rect.width > 660 - 43 ? 43 :
 				660 - rect.width);
@@ -309,7 +321,7 @@ static int mt9v022_s_crop(struct v4l2_subdev *sd, struct v4l2_crop *a)
 		ret = reg_write(client, MT9V022_WINDOW_WIDTH, rect.width);
 	if (!ret)
 		ret = reg_write(client, MT9V022_WINDOW_HEIGHT,
-				rect.height + icd->y_skip_top);
+				rect.height + mt9v022->y_skip_top);
 
 	if (ret < 0)
 		return ret;
@@ -346,46 +358,48 @@ static int mt9v022_cropcap(struct v4l2_subdev *sd, struct v4l2_cropcap *a)
 	return 0;
 }
 
-static int mt9v022_g_fmt(struct v4l2_subdev *sd, struct v4l2_format *f)
+static int mt9v022_g_fmt(struct v4l2_subdev *sd,
+			 struct v4l2_mbus_framefmt *mf)
 {
 	struct i2c_client *client = sd->priv;
 	struct mt9v022 *mt9v022 = to_mt9v022(client);
-	struct v4l2_pix_format *pix = &f->fmt.pix;
 
-	pix->width		= mt9v022->rect.width;
-	pix->height		= mt9v022->rect.height;
-	pix->pixelformat	= mt9v022->fourcc;
-	pix->field		= V4L2_FIELD_NONE;
-	pix->colorspace		= V4L2_COLORSPACE_SRGB;
+	mf->width	= mt9v022->rect.width;
+	mf->height	= mt9v022->rect.height;
+	mf->code	= mt9v022->fmt->code;
+	mf->colorspace	= mt9v022->fmt->colorspace;
+	mf->field	= V4L2_FIELD_NONE;
 
 	return 0;
 }
 
-static int mt9v022_s_fmt(struct v4l2_subdev *sd, struct v4l2_format *f)
+static int mt9v022_s_fmt(struct v4l2_subdev *sd,
+			 struct v4l2_mbus_framefmt *mf)
 {
 	struct i2c_client *client = sd->priv;
 	struct mt9v022 *mt9v022 = to_mt9v022(client);
-	struct v4l2_pix_format *pix = &f->fmt.pix;
 	struct v4l2_crop a = {
 		.c = {
 			.left	= mt9v022->rect.left,
 			.top	= mt9v022->rect.top,
-			.width	= pix->width,
-			.height	= pix->height,
+			.width	= mf->width,
+			.height	= mf->height,
 		},
 	};
 	int ret;
 
-	/* The caller provides a supported format, as verified per call to
-	 * icd->try_fmt(), datawidth is from our supported format list */
-	switch (pix->pixelformat) {
-	case V4L2_PIX_FMT_GREY:
-	case V4L2_PIX_FMT_Y16:
+	/*
+	 * The caller provides a supported format, as verified per call to
+	 * icd->try_fmt(), datawidth is from our supported format list
+	 */
+	switch (mf->code) {
+	case V4L2_MBUS_FMT_GREY8_1X8:
+	case V4L2_MBUS_FMT_Y10_1X10:
 		if (mt9v022->model != V4L2_IDENT_MT9V022IX7ATM)
 			return -EINVAL;
 		break;
-	case V4L2_PIX_FMT_SBGGR8:
-	case V4L2_PIX_FMT_SBGGR16:
+	case V4L2_MBUS_FMT_SBGGR8_1X8:
+	case V4L2_MBUS_FMT_SBGGR10_1X10:
 		if (mt9v022->model != V4L2_IDENT_MT9V022IX7ATC)
 			return -EINVAL;
 		break;
@@ -399,26 +413,38 @@ static int mt9v022_s_fmt(struct v4l2_subdev *sd, struct v4l2_format *f)
 	/* No support for scaling on this camera, just crop. */
 	ret = mt9v022_s_crop(sd, &a);
 	if (!ret) {
-		pix->width = mt9v022->rect.width;
-		pix->height = mt9v022->rect.height;
-		mt9v022->fourcc = pix->pixelformat;
+		mf->width	= mt9v022->rect.width;
+		mf->height	= mt9v022->rect.height;
+		mt9v022->fmt	= mt9v022_find_datafmt(mf->code,
+					mt9v022->fmts, mt9v022->num_fmts);
+		mf->colorspace	= mt9v022->fmt->colorspace;
 	}
 
 	return ret;
 }
 
-static int mt9v022_try_fmt(struct v4l2_subdev *sd, struct v4l2_format *f)
+static int mt9v022_try_fmt(struct v4l2_subdev *sd,
+			   struct v4l2_mbus_framefmt *mf)
 {
 	struct i2c_client *client = sd->priv;
-	struct soc_camera_device *icd = client->dev.platform_data;
-	struct v4l2_pix_format *pix = &f->fmt.pix;
-	int align = pix->pixelformat == V4L2_PIX_FMT_SBGGR8 ||
-		pix->pixelformat == V4L2_PIX_FMT_SBGGR16;
+	struct mt9v022 *mt9v022 = to_mt9v022(client);
+	const struct mt9v022_datafmt *fmt;
+	int align = mf->code == V4L2_MBUS_FMT_SBGGR8_1X8 ||
+		mf->code == V4L2_MBUS_FMT_SBGGR10_1X10;
 
-	v4l_bound_align_image(&pix->width, MT9V022_MIN_WIDTH,
+	v4l_bound_align_image(&mf->width, MT9V022_MIN_WIDTH,
 		MT9V022_MAX_WIDTH, align,
-		&pix->height, MT9V022_MIN_HEIGHT + icd->y_skip_top,
-		MT9V022_MAX_HEIGHT + icd->y_skip_top, align, 0);
+		&mf->height, MT9V022_MIN_HEIGHT + mt9v022->y_skip_top,
+		MT9V022_MAX_HEIGHT + mt9v022->y_skip_top, align, 0);
+
+	fmt = mt9v022_find_datafmt(mf->code, mt9v022->fmts,
+				   mt9v022->num_fmts);
+	if (!fmt) {
+		fmt = mt9v022->fmt;
+		mf->code = fmt->code;
+	}
+
+	mf->colorspace	= fmt->colorspace;
 
 	return 0;
 }
@@ -635,8 +661,10 @@ static int mt9v022_s_ctrl(struct v4l2_subdev *sd, struct v4l2_control *ctrl)
 					      48 + range / 2) / range + 16;
 			if (gain >= 32)
 				gain &= ~1;
-			/* The user wants to set gain manually, hope, she
-			 * knows, what she's doing... Switch AGC off. */
+			/*
+			 * The user wants to set gain manually, hope, she
+			 * knows, what she's doing... Switch AGC off.
+			 */
 
 			if (reg_clear(client, MT9V022_AEC_AGC_ENABLE, 0x2) < 0)
 				return -EIO;
@@ -655,8 +683,10 @@ static int mt9v022_s_ctrl(struct v4l2_subdev *sd, struct v4l2_control *ctrl)
 			unsigned long range = qctrl->maximum - qctrl->minimum;
 			unsigned long shutter = ((ctrl->value - qctrl->minimum) *
 						 479 + range / 2) / range + 1;
-			/* The user wants to set shutter width manually, hope,
-			 * she knows, what she's doing... Switch AEC off. */
+			/*
+			 * The user wants to set shutter width manually, hope,
+			 * she knows, what she's doing... Switch AEC off.
+			 */
 
 			if (reg_clear(client, MT9V022_AEC_AGC_ENABLE, 0x1) < 0)
 				return -EIO;
@@ -689,8 +719,10 @@ static int mt9v022_s_ctrl(struct v4l2_subdev *sd, struct v4l2_control *ctrl)
 	return 0;
 }
 
-/* Interface active, can use i2c. If it fails, it can indeed mean, that
- * this wasn't our capture interface, so, we wait for the right one */
+/*
+ * Interface active, can use i2c. If it fails, it can indeed mean, that
+ * this wasn't our capture interface, so, we wait for the right one
+ */
 static int mt9v022_video_probe(struct soc_camera_device *icd,
 			       struct i2c_client *client)
 {
@@ -733,17 +765,17 @@ static int mt9v022_video_probe(struct soc_camera_device *icd,
 			    !strcmp("color", sensor_type))) {
 		ret = reg_write(client, MT9V022_PIXEL_OPERATION_MODE, 4 | 0x11);
 		mt9v022->model = V4L2_IDENT_MT9V022IX7ATC;
-		icd->formats = mt9v022_colour_formats;
+		mt9v022->fmts = mt9v022_colour_fmts;
 	} else {
 		ret = reg_write(client, MT9V022_PIXEL_OPERATION_MODE, 0x11);
 		mt9v022->model = V4L2_IDENT_MT9V022IX7ATM;
-		icd->formats = mt9v022_monochrome_formats;
+		mt9v022->fmts = mt9v022_monochrome_fmts;
 	}
 
 	if (ret < 0)
 		goto ei2c;
 
-	icd->num_formats = 0;
+	mt9v022->num_fmts = 0;
 
 	/*
 	 * This is a 10bit sensor, so by default we only allow 10bit.
@@ -756,14 +788,14 @@ static int mt9v022_video_probe(struct soc_camera_device *icd,
 		flags = SOCAM_DATAWIDTH_10;
 
 	if (flags & SOCAM_DATAWIDTH_10)
-		icd->num_formats++;
+		mt9v022->num_fmts++;
 	else
-		icd->formats++;
+		mt9v022->fmts++;
 
 	if (flags & SOCAM_DATAWIDTH_8)
-		icd->num_formats++;
+		mt9v022->num_fmts++;
 
-	mt9v022->fourcc = icd->formats->fourcc;
+	mt9v022->fmt = &mt9v022->fmts[0];
 
 	dev_info(&client->dev, "Detected a MT9V022 chip ID %x, %s sensor\n",
 		 data, mt9v022->model == V4L2_IDENT_MT9V022IX7ATM ?
@@ -787,6 +819,16 @@ static void mt9v022_video_remove(struct soc_camera_device *icd)
 		icl->free_bus(icl);
 }
 
+static int mt9v022_g_skip_top_lines(struct v4l2_subdev *sd, u32 *lines)
+{
+	struct i2c_client *client = sd->priv;
+	struct mt9v022 *mt9v022 = to_mt9v022(client);
+
+	*lines = mt9v022->y_skip_top;
+
+	return 0;
+}
+
 static struct v4l2_subdev_core_ops mt9v022_subdev_core_ops = {
 	.g_ctrl		= mt9v022_g_ctrl,
 	.s_ctrl		= mt9v022_s_ctrl,
@@ -797,19 +839,38 @@ static struct v4l2_subdev_core_ops mt9v022_subdev_core_ops = {
 #endif
 };
 
+static int mt9v022_enum_fmt(struct v4l2_subdev *sd, int index,
+			    enum v4l2_mbus_pixelcode *code)
+{
+	struct i2c_client *client = sd->priv;
+	struct mt9v022 *mt9v022 = to_mt9v022(client);
+
+	if ((unsigned int)index >= mt9v022->num_fmts)
+		return -EINVAL;
+
+	*code = mt9v022->fmts[index].code;
+	return 0;
+}
+
 static struct v4l2_subdev_video_ops mt9v022_subdev_video_ops = {
 	.s_stream	= mt9v022_s_stream,
-	.s_fmt		= mt9v022_s_fmt,
-	.g_fmt		= mt9v022_g_fmt,
-	.try_fmt	= mt9v022_try_fmt,
+	.s_mbus_fmt	= mt9v022_s_fmt,
+	.g_mbus_fmt	= mt9v022_g_fmt,
+	.try_mbus_fmt	= mt9v022_try_fmt,
 	.s_crop		= mt9v022_s_crop,
 	.g_crop		= mt9v022_g_crop,
 	.cropcap	= mt9v022_cropcap,
+	.enum_mbus_fmt	= mt9v022_enum_fmt,
+};
+
+static struct v4l2_subdev_sensor_ops mt9v022_subdev_sensor_ops = {
+	.g_skip_top_lines	= mt9v022_g_skip_top_lines,
 };
 
 static struct v4l2_subdev_ops mt9v022_subdev_ops = {
 	.core	= &mt9v022_subdev_core_ops,
 	.video	= &mt9v022_subdev_video_ops,
+	.sensor	= &mt9v022_subdev_sensor_ops,
 };
 
 static int mt9v022_probe(struct i2c_client *client,
@@ -851,8 +912,7 @@ static int mt9v022_probe(struct i2c_client *client,
 	 * MT9V022 _really_ corrupts the first read out line.
 	 * TODO: verify on i.MX31
 	 */
-	icd->y_skip_top		= 1;
-
+	mt9v022->y_skip_top	= 1;
 	mt9v022->rect.left	= MT9V022_COLUMN_SKIP;
 	mt9v022->rect.top	= MT9V022_ROW_SKIP;
 	mt9v022->rect.width	= MT9V022_MAX_WIDTH;
diff --git a/drivers/media/video/mx1_camera.c b/drivers/media/video/mx1_camera.c
index 72802291e812..c167cc3de492 100644
--- a/drivers/media/video/mx1_camera.c
+++ b/drivers/media/video/mx1_camera.c
@@ -37,6 +37,7 @@
 #include <media/v4l2-common.h>
 #include <media/v4l2-dev.h>
 #include <media/videobuf-dma-contig.h>
+#include <media/soc_mediabus.h>
 
 #include <asm/dma.h>
 #include <asm/fiq.h>
@@ -94,14 +95,16 @@
 /* buffer for one video frame */
 struct mx1_buffer {
 	/* common v4l buffer stuff -- must be first */
-	struct videobuf_buffer vb;
-	const struct soc_camera_data_format *fmt;
-	int inwork;
+	struct videobuf_buffer		vb;
+	enum v4l2_mbus_pixelcode	code;
+	int				inwork;
 };
 
-/* i.MX1/i.MXL is only supposed to handle one camera on its Camera Sensor
+/*
+ * i.MX1/i.MXL is only supposed to handle one camera on its Camera Sensor
  * Interface. If anyone ever builds hardware to enable more than
- * one camera, they will have to modify this driver too */
+ * one camera, they will have to modify this driver too
+ */
 struct mx1_camera_dev {
 	struct soc_camera_host		soc_host;
 	struct soc_camera_device	*icd;
@@ -126,9 +129,13 @@ static int mx1_videobuf_setup(struct videobuf_queue *vq, unsigned int *count,
 			      unsigned int *size)
 {
 	struct soc_camera_device *icd = vq->priv_data;
+	int bytes_per_line = soc_mbus_bytes_per_line(icd->user_width,
+						icd->current_fmt->host_fmt);
+
+	if (bytes_per_line < 0)
+		return bytes_per_line;
 
-	*size = icd->user_width * icd->user_height *
-		((icd->current_fmt->depth + 7) >> 3);
+	*size = bytes_per_line * icd->user_height;
 
 	if (!*count)
 		*count = 32;
@@ -151,8 +158,10 @@ static void free_buffer(struct videobuf_queue *vq, struct mx1_buffer *buf)
 	dev_dbg(icd->dev.parent, "%s (vb=0x%p) 0x%08lx %d\n", __func__,
 		vb, vb->baddr, vb->bsize);
 
-	/* This waits until this buffer is out of danger, i.e., until it is no
-	 * longer in STATE_QUEUED or STATE_ACTIVE */
+	/*
+	 * This waits until this buffer is out of danger, i.e., until it is no
+	 * longer in STATE_QUEUED or STATE_ACTIVE
+	 */
 	videobuf_waiton(vb, 0, 0);
 	videobuf_dma_contig_free(vq, vb);
 
@@ -165,6 +174,11 @@ static int mx1_videobuf_prepare(struct videobuf_queue *vq,
 	struct soc_camera_device *icd = vq->priv_data;
 	struct mx1_buffer *buf = container_of(vb, struct mx1_buffer, vb);
 	int ret;
+	int bytes_per_line = soc_mbus_bytes_per_line(icd->user_width,
+						icd->current_fmt->host_fmt);
+
+	if (bytes_per_line < 0)
+		return bytes_per_line;
 
 	dev_dbg(icd->dev.parent, "%s (vb=0x%p) 0x%08lx %d\n", __func__,
 		vb, vb->baddr, vb->bsize);
@@ -174,22 +188,24 @@ static int mx1_videobuf_prepare(struct videobuf_queue *vq,
 
 	BUG_ON(NULL == icd->current_fmt);
 
-	/* I think, in buf_prepare you only have to protect global data,
-	 * the actual buffer is yours */
+	/*
+	 * I think, in buf_prepare you only have to protect global data,
+	 * the actual buffer is yours
+	 */
 	buf->inwork = 1;
 
-	if (buf->fmt	!= icd->current_fmt ||
+	if (buf->code	!= icd->current_fmt->code ||
 	    vb->width	!= icd->user_width ||
 	    vb->height	!= icd->user_height ||
 	    vb->field	!= field) {
-		buf->fmt	= icd->current_fmt;
+		buf->code	= icd->current_fmt->code;
 		vb->width	= icd->user_width;
 		vb->height	= icd->user_height;
 		vb->field	= field;
 		vb->state	= VIDEOBUF_NEEDS_INIT;
 	}
 
-	vb->size = vb->width * vb->height * ((buf->fmt->depth + 7) >> 3);
+	vb->size = bytes_per_line * vb->height;
 	if (0 != vb->baddr && vb->bsize < vb->size) {
 		ret = -EINVAL;
 		goto out;
@@ -381,8 +397,10 @@ static int mclk_get_divisor(struct mx1_camera_dev *pcdev)
 
 	lcdclk = clk_get_rate(pcdev->clk);
 
-	/* We verify platform_mclk_10khz != 0, so if anyone breaks it, here
-	 * they get a nice Oops */
+	/*
+	 * We verify platform_mclk_10khz != 0, so if anyone breaks it, here
+	 * they get a nice Oops
+	 */
 	div = (lcdclk + 2 * mclk - 1) / (2 * mclk) - 1;
 
 	dev_dbg(pcdev->icd->dev.parent,
@@ -420,8 +438,10 @@ static void mx1_camera_deactivate(struct mx1_camera_dev *pcdev)
 	clk_disable(pcdev->clk);
 }
 
-/* The following two functions absolutely depend on the fact, that
- * there can be only one camera on i.MX1/i.MXL camera sensor interface */
+/*
+ * The following two functions absolutely depend on the fact, that
+ * there can be only one camera on i.MX1/i.MXL camera sensor interface
+ */
 static int mx1_camera_add_device(struct soc_camera_device *icd)
 {
 	struct soc_camera_host *ici = to_soc_camera_host(icd->dev.parent);
@@ -487,12 +507,10 @@ static int mx1_camera_set_bus_param(struct soc_camera_device *icd, __u32 pixfmt)
 
 	/* MX1 supports only 8bit buswidth */
 	common_flags = soc_camera_bus_param_compatible(camera_flags,
-							       CSI_BUS_FLAGS);
+						       CSI_BUS_FLAGS);
 	if (!common_flags)
 		return -EINVAL;
 
-	icd->buswidth = 8;
-
 	/* Make choises, based on platform choice */
 	if ((common_flags & SOCAM_VSYNC_ACTIVE_HIGH) &&
 		(common_flags & SOCAM_VSYNC_ACTIVE_LOW)) {
@@ -545,7 +563,8 @@ static int mx1_camera_set_fmt(struct soc_camera_device *icd,
 	struct v4l2_subdev *sd = soc_camera_to_subdev(icd);
 	const struct soc_camera_format_xlate *xlate;
 	struct v4l2_pix_format *pix = &f->fmt.pix;
-	int ret;
+	struct v4l2_mbus_framefmt mf;
+	int ret, buswidth;
 
 	xlate = soc_camera_xlate_by_fourcc(icd, pix->pixelformat);
 	if (!xlate) {
@@ -554,12 +573,33 @@ static int mx1_camera_set_fmt(struct soc_camera_device *icd,
 		return -EINVAL;
 	}
 
-	ret = v4l2_subdev_call(sd, video, s_fmt, f);
-	if (!ret) {
-		icd->buswidth = xlate->buswidth;
-		icd->current_fmt = xlate->host_fmt;
+	buswidth = xlate->host_fmt->bits_per_sample;
+	if (buswidth > 8) {
+		dev_warn(icd->dev.parent,
+			 "bits-per-sample %d for format %x unsupported\n",
+			 buswidth, pix->pixelformat);
+		return -EINVAL;
 	}
 
+	mf.width	= pix->width;
+	mf.height	= pix->height;
+	mf.field	= pix->field;
+	mf.colorspace	= pix->colorspace;
+	mf.code		= xlate->code;
+
+	ret = v4l2_subdev_call(sd, video, s_mbus_fmt, &mf);
+	if (ret < 0)
+		return ret;
+
+	if (mf.code != xlate->code)
+		return -EINVAL;
+
+	pix->width		= mf.width;
+	pix->height		= mf.height;
+	pix->field		= mf.field;
+	pix->colorspace		= mf.colorspace;
+	icd->current_fmt	= xlate;
+
 	return ret;
 }
 
@@ -567,10 +607,36 @@ static int mx1_camera_try_fmt(struct soc_camera_device *icd,
 			      struct v4l2_format *f)
 {
 	struct v4l2_subdev *sd = soc_camera_to_subdev(icd);
+	const struct soc_camera_format_xlate *xlate;
+	struct v4l2_pix_format *pix = &f->fmt.pix;
+	struct v4l2_mbus_framefmt mf;
+	int ret;
 	/* TODO: limit to mx1 hardware capabilities */
 
+	xlate = soc_camera_xlate_by_fourcc(icd, pix->pixelformat);
+	if (!xlate) {
+		dev_warn(icd->dev.parent, "Format %x not found\n",
+			 pix->pixelformat);
+		return -EINVAL;
+	}
+
+	mf.width	= pix->width;
+	mf.height	= pix->height;
+	mf.field	= pix->field;
+	mf.colorspace	= pix->colorspace;
+	mf.code		= xlate->code;
+
 	/* limit to sensor capabilities */
-	return v4l2_subdev_call(sd, video, try_fmt, f);
+	ret = v4l2_subdev_call(sd, video, try_mbus_fmt, &mf);
+	if (ret < 0)
+		return ret;
+
+	pix->width	= mf.width;
+	pix->height	= mf.height;
+	pix->field	= mf.field;
+	pix->colorspace	= mf.colorspace;
+
+	return 0;
 }
 
 static int mx1_camera_reqbufs(struct soc_camera_file *icf,
@@ -578,10 +644,12 @@ static int mx1_camera_reqbufs(struct soc_camera_file *icf,
 {
 	int i;
 
-	/* This is for locking debugging only. I removed spinlocks and now I
+	/*
+	 * This is for locking debugging only. I removed spinlocks and now I
 	 * check whether .prepare is ever called on a linked buffer, or whether
 	 * a dma IRQ can occur for an in-work or unlinked buffer. Until now
-	 * it hadn't triggered */
+	 * it hadn't triggered
+	 */
 	for (i = 0; i < p->count; i++) {
 		struct mx1_buffer *buf = container_of(icf->vb_vidq.bufs[i],
 						      struct mx1_buffer, vb);
@@ -650,7 +718,7 @@ static int __init mx1_camera_probe(struct platform_device *pdev)
 
 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 	irq = platform_get_irq(pdev, 0);
-	if (!res || !irq) {
+	if (!res || (int)irq <= 0) {
 		err = -ENODEV;
 		goto exit;
 	}
diff --git a/drivers/media/video/mx3_camera.c b/drivers/media/video/mx3_camera.c
index 7db82bdf6f31..bd297f567dc7 100644
--- a/drivers/media/video/mx3_camera.c
+++ b/drivers/media/video/mx3_camera.c
@@ -23,6 +23,7 @@
 #include <media/v4l2-dev.h>
 #include <media/videobuf-dma-contig.h>
 #include <media/soc_camera.h>
+#include <media/soc_mediabus.h>
 
 #include <mach/ipu.h>
 #include <mach/mx3_camera.h>
@@ -63,7 +64,7 @@
 struct mx3_camera_buffer {
 	/* common v4l buffer stuff -- must be first */
 	struct videobuf_buffer			vb;
-	const struct soc_camera_data_format	*fmt;
+	enum v4l2_mbus_pixelcode		code;
 
 	/* One descriptot per scatterlist (per frame) */
 	struct dma_async_tx_descriptor		*txd;
@@ -118,8 +119,6 @@ struct dma_chan_request {
 	enum ipu_channel	id;
 };
 
-static int mx3_camera_set_bus_param(struct soc_camera_device *icd, __u32 pixfmt);
-
 static u32 csi_reg_read(struct mx3_camera_dev *mx3, off_t reg)
 {
 	return __raw_readl(mx3->base + reg);
@@ -211,17 +210,16 @@ static int mx3_videobuf_setup(struct videobuf_queue *vq, unsigned int *count,
 	struct soc_camera_device *icd = vq->priv_data;
 	struct soc_camera_host *ici = to_soc_camera_host(icd->dev.parent);
 	struct mx3_camera_dev *mx3_cam = ici->priv;
-	/*
-	 * bits-per-pixel (depth) as specified in camera's pixel format does
-	 * not necessarily match what the camera interface writes to RAM, but
-	 * it should be good enough for now.
-	 */
-	unsigned int bpp = DIV_ROUND_UP(icd->current_fmt->depth, 8);
+	int bytes_per_line = soc_mbus_bytes_per_line(icd->user_width,
+						icd->current_fmt->host_fmt);
+
+	if (bytes_per_line < 0)
+		return bytes_per_line;
 
 	if (!mx3_cam->idmac_channel[0])
 		return -EINVAL;
 
-	*size = icd->user_width * icd->user_height * bpp;
+	*size = bytes_per_line * icd->user_height;
 
 	if (!*count)
 		*count = 32;
@@ -241,21 +239,26 @@ static int mx3_videobuf_prepare(struct videobuf_queue *vq,
 	struct mx3_camera_dev *mx3_cam = ici->priv;
 	struct mx3_camera_buffer *buf =
 		container_of(vb, struct mx3_camera_buffer, vb);
-	/* current_fmt _must_ always be set */
-	size_t new_size = icd->user_width * icd->user_height *
-		((icd->current_fmt->depth + 7) >> 3);
+	size_t new_size;
 	int ret;
+	int bytes_per_line = soc_mbus_bytes_per_line(icd->user_width,
+						icd->current_fmt->host_fmt);
+
+	if (bytes_per_line < 0)
+		return bytes_per_line;
+
+	new_size = bytes_per_line * icd->user_height;
 
 	/*
 	 * I think, in buf_prepare you only have to protect global data,
 	 * the actual buffer is yours
 	 */
 
-	if (buf->fmt	!= icd->current_fmt ||
+	if (buf->code	!= icd->current_fmt->code ||
 	    vb->width	!= icd->user_width ||
 	    vb->height	!= icd->user_height ||
 	    vb->field	!= field) {
-		buf->fmt	= icd->current_fmt;
+		buf->code	= icd->current_fmt->code;
 		vb->width	= icd->user_width;
 		vb->height	= icd->user_height;
 		vb->field	= field;
@@ -348,13 +351,13 @@ static void mx3_videobuf_queue(struct videobuf_queue *vq,
 	struct dma_async_tx_descriptor *txd = buf->txd;
 	struct idmac_channel *ichan = to_idmac_chan(txd->chan);
 	struct idmac_video_param *video = &ichan->params.video;
-	const struct soc_camera_data_format *data_fmt = icd->current_fmt;
 	dma_cookie_t cookie;
+	u32 fourcc = icd->current_fmt->host_fmt->fourcc;
 
 	BUG_ON(!irqs_disabled());
 
 	/* This is the configuration of one sg-element */
-	video->out_pixel_fmt	= fourcc_to_ipu_pix(data_fmt->fourcc);
+	video->out_pixel_fmt	= fourcc_to_ipu_pix(fourcc);
 	video->out_width	= icd->user_width;
 	video->out_height	= icd->user_height;
 	video->out_stride	= icd->user_width;
@@ -564,30 +567,37 @@ static int test_platform_param(struct mx3_camera_dev *mx3_cam,
 		SOCAM_DATA_ACTIVE_HIGH |
 		SOCAM_DATA_ACTIVE_LOW;
 
-	/* If requested data width is supported by the platform, use it or any
-	 * possible lower value - i.MX31 is smart enough to schift bits */
+	/*
+	 * If requested data width is supported by the platform, use it or any
+	 * possible lower value - i.MX31 is smart enough to schift bits
+	 */
+	if (mx3_cam->platform_flags & MX3_CAMERA_DATAWIDTH_15)
+		*flags |= SOCAM_DATAWIDTH_15 | SOCAM_DATAWIDTH_10 |
+			SOCAM_DATAWIDTH_8 | SOCAM_DATAWIDTH_4;
+	else if (mx3_cam->platform_flags & MX3_CAMERA_DATAWIDTH_10)
+		*flags |= SOCAM_DATAWIDTH_10 | SOCAM_DATAWIDTH_8 |
+			SOCAM_DATAWIDTH_4;
+	else if (mx3_cam->platform_flags & MX3_CAMERA_DATAWIDTH_8)
+		*flags |= SOCAM_DATAWIDTH_8 | SOCAM_DATAWIDTH_4;
+	else if (mx3_cam->platform_flags & MX3_CAMERA_DATAWIDTH_4)
+		*flags |= SOCAM_DATAWIDTH_4;
+
 	switch (buswidth) {
 	case 15:
-		if (!(mx3_cam->platform_flags & MX3_CAMERA_DATAWIDTH_15))
+		if (!(*flags & SOCAM_DATAWIDTH_15))
 			return -EINVAL;
-		*flags |= SOCAM_DATAWIDTH_15 | SOCAM_DATAWIDTH_10 |
-			SOCAM_DATAWIDTH_8 | SOCAM_DATAWIDTH_4;
 		break;
 	case 10:
-		if (!(mx3_cam->platform_flags & MX3_CAMERA_DATAWIDTH_10))
+		if (!(*flags & SOCAM_DATAWIDTH_10))
 			return -EINVAL;
-		*flags |= SOCAM_DATAWIDTH_10 | SOCAM_DATAWIDTH_8 |
-			SOCAM_DATAWIDTH_4;
 		break;
 	case 8:
-		if (!(mx3_cam->platform_flags & MX3_CAMERA_DATAWIDTH_8))
+		if (!(*flags & SOCAM_DATAWIDTH_8))
 			return -EINVAL;
-		*flags |= SOCAM_DATAWIDTH_8 | SOCAM_DATAWIDTH_4;
 		break;
 	case 4:
-		if (!(mx3_cam->platform_flags & MX3_CAMERA_DATAWIDTH_4))
+		if (!(*flags & SOCAM_DATAWIDTH_4))
 			return -EINVAL;
-		*flags |= SOCAM_DATAWIDTH_4;
 		break;
 	default:
 		dev_warn(mx3_cam->soc_host.v4l2_dev.dev,
@@ -636,91 +646,92 @@ static bool chan_filter(struct dma_chan *chan, void *arg)
 		pdata->dma_dev == chan->device->dev;
 }
 
-static const struct soc_camera_data_format mx3_camera_formats[] = {
+static const struct soc_mbus_pixelfmt mx3_camera_formats[] = {
 	{
-		.name		= "Bayer (sRGB) 8 bit",
-		.depth		= 8,
-		.fourcc		= V4L2_PIX_FMT_SBGGR8,
-		.colorspace	= V4L2_COLORSPACE_SRGB,
+		.fourcc			= V4L2_PIX_FMT_SBGGR8,
+		.name			= "Bayer BGGR (sRGB) 8 bit",
+		.bits_per_sample	= 8,
+		.packing		= SOC_MBUS_PACKING_NONE,
+		.order			= SOC_MBUS_ORDER_LE,
 	}, {
-		.name		= "Monochrome 8 bit",
-		.depth		= 8,
-		.fourcc		= V4L2_PIX_FMT_GREY,
-		.colorspace	= V4L2_COLORSPACE_JPEG,
+		.fourcc			= V4L2_PIX_FMT_GREY,
+		.name			= "Monochrome 8 bit",
+		.bits_per_sample	= 8,
+		.packing		= SOC_MBUS_PACKING_NONE,
+		.order			= SOC_MBUS_ORDER_LE,
 	},
 };
 
-static bool buswidth_supported(struct soc_camera_host *ici, int depth)
+/* This will be corrected as we get more formats */
+static bool mx3_camera_packing_supported(const struct soc_mbus_pixelfmt *fmt)
 {
-	struct mx3_camera_dev *mx3_cam = ici->priv;
-
-	switch (depth) {
-	case 4:
-		return !!(mx3_cam->platform_flags & MX3_CAMERA_DATAWIDTH_4);
-	case 8:
-		return !!(mx3_cam->platform_flags & MX3_CAMERA_DATAWIDTH_8);
-	case 10:
-		return !!(mx3_cam->platform_flags & MX3_CAMERA_DATAWIDTH_10);
-	case 15:
-		return !!(mx3_cam->platform_flags & MX3_CAMERA_DATAWIDTH_15);
-	}
-	return false;
+	return	fmt->packing == SOC_MBUS_PACKING_NONE ||
+		(fmt->bits_per_sample == 8 &&
+		 fmt->packing == SOC_MBUS_PACKING_2X8_PADHI) ||
+		(fmt->bits_per_sample > 8 &&
+		 fmt->packing == SOC_MBUS_PACKING_EXTEND16);
 }
 
 static int mx3_camera_get_formats(struct soc_camera_device *icd, int idx,
 				  struct soc_camera_format_xlate *xlate)
 {
-	struct soc_camera_host *ici = to_soc_camera_host(icd->dev.parent);
-	int formats = 0, buswidth, ret;
+	struct v4l2_subdev *sd = soc_camera_to_subdev(icd);
+	struct device *dev = icd->dev.parent;
+	int formats = 0, ret;
+	enum v4l2_mbus_pixelcode code;
+	const struct soc_mbus_pixelfmt *fmt;
 
-	buswidth = icd->formats[idx].depth;
+	ret = v4l2_subdev_call(sd, video, enum_mbus_fmt, idx, &code);
+	if (ret < 0)
+		/* No more formats */
+		return 0;
 
-	if (!buswidth_supported(ici, buswidth))
+	fmt = soc_mbus_get_fmtdesc(code);
+	if (!fmt) {
+		dev_err(icd->dev.parent,
+			"Invalid format code #%d: %d\n", idx, code);
 		return 0;
+	}
 
-	ret = mx3_camera_try_bus_param(icd, buswidth);
+	/* This also checks support for the requested bits-per-sample */
+	ret = mx3_camera_try_bus_param(icd, fmt->bits_per_sample);
 	if (ret < 0)
 		return 0;
 
-	switch (icd->formats[idx].fourcc) {
-	case V4L2_PIX_FMT_SGRBG10:
+	switch (code) {
+	case V4L2_MBUS_FMT_SBGGR10_1X10:
 		formats++;
 		if (xlate) {
-			xlate->host_fmt = &mx3_camera_formats[0];
-			xlate->cam_fmt = icd->formats + idx;
-			xlate->buswidth = buswidth;
+			xlate->host_fmt	= &mx3_camera_formats[0];
+			xlate->code	= code;
 			xlate++;
-			dev_dbg(icd->dev.parent,
-				"Providing format %s using %s\n",
-				mx3_camera_formats[0].name,
-				icd->formats[idx].name);
+			dev_dbg(dev, "Providing format %s using code %d\n",
+				mx3_camera_formats[0].name, code);
 		}
-		goto passthrough;
-	case V4L2_PIX_FMT_Y16:
+		break;
+	case V4L2_MBUS_FMT_Y10_1X10:
 		formats++;
 		if (xlate) {
-			xlate->host_fmt = &mx3_camera_formats[1];
-			xlate->cam_fmt = icd->formats + idx;
-			xlate->buswidth = buswidth;
+			xlate->host_fmt	= &mx3_camera_formats[1];
+			xlate->code	= code;
 			xlate++;
-			dev_dbg(icd->dev.parent,
-				"Providing format %s using %s\n",
-				mx3_camera_formats[0].name,
-				icd->formats[idx].name);
+			dev_dbg(dev, "Providing format %s using code %d\n",
+				mx3_camera_formats[1].name, code);
 		}
+		break;
 	default:
-passthrough:
-		/* Generic pass-through */
-		formats++;
-		if (xlate) {
-			xlate->host_fmt = icd->formats + idx;
-			xlate->cam_fmt = icd->formats + idx;
-			xlate->buswidth = buswidth;
-			xlate++;
-			dev_dbg(icd->dev.parent,
-				"Providing format %s in pass-through mode\n",
-				icd->formats[idx].name);
-		}
+		if (!mx3_camera_packing_supported(fmt))
+			return 0;
+	}
+
+	/* Generic pass-through */
+	formats++;
+	if (xlate) {
+		xlate->host_fmt	= fmt;
+		xlate->code	= code;
+		xlate++;
+		dev_dbg(dev, "Providing format %x in pass-through mode\n",
+			xlate->host_fmt->fourcc);
 	}
 
 	return formats;
@@ -804,8 +815,7 @@ static int mx3_camera_set_crop(struct soc_camera_device *icd,
 	struct soc_camera_host *ici = to_soc_camera_host(icd->dev.parent);
 	struct mx3_camera_dev *mx3_cam = ici->priv;
 	struct v4l2_subdev *sd = soc_camera_to_subdev(icd);
-	struct v4l2_format f = {.type = V4L2_BUF_TYPE_VIDEO_CAPTURE};
-	struct v4l2_pix_format *pix = &f.fmt.pix;
+	struct v4l2_mbus_framefmt mf;
 	int ret;
 
 	soc_camera_limit_side(&rect->left, &rect->width, 0, 2, 4096);
@@ -816,19 +826,19 @@ static int mx3_camera_set_crop(struct soc_camera_device *icd,
 		return ret;
 
 	/* The capture device might have changed its output  */
-	ret = v4l2_subdev_call(sd, video, g_fmt, &f);
+	ret = v4l2_subdev_call(sd, video, g_mbus_fmt, &mf);
 	if (ret < 0)
 		return ret;
 
-	if (pix->width & 7) {
+	if (mf.width & 7) {
 		/* Ouch! We can only handle 8-byte aligned width... */
-		stride_align(&pix->width);
-		ret = v4l2_subdev_call(sd, video, s_fmt, &f);
+		stride_align(&mf.width);
+		ret = v4l2_subdev_call(sd, video, s_mbus_fmt, &mf);
 		if (ret < 0)
 			return ret;
 	}
 
-	if (pix->width != icd->user_width || pix->height != icd->user_height) {
+	if (mf.width != icd->user_width || mf.height != icd->user_height) {
 		/*
 		 * We now know pixel formats and can decide upon DMA-channel(s)
 		 * So far only direct camera-to-memory is supported
@@ -839,14 +849,14 @@ static int mx3_camera_set_crop(struct soc_camera_device *icd,
 				return ret;
 		}
 
-		configure_geometry(mx3_cam, pix->width, pix->height);
+		configure_geometry(mx3_cam, mf.width, mf.height);
 	}
 
 	dev_dbg(icd->dev.parent, "Sensor cropped %dx%d\n",
-		pix->width, pix->height);
+		mf.width, mf.height);
 
-	icd->user_width = pix->width;
-	icd->user_height = pix->height;
+	icd->user_width		= mf.width;
+	icd->user_height	= mf.height;
 
 	return ret;
 }
@@ -859,6 +869,7 @@ static int mx3_camera_set_fmt(struct soc_camera_device *icd,
 	struct v4l2_subdev *sd = soc_camera_to_subdev(icd);
 	const struct soc_camera_format_xlate *xlate;
 	struct v4l2_pix_format *pix = &f->fmt.pix;
+	struct v4l2_mbus_framefmt mf;
 	int ret;
 
 	xlate = soc_camera_xlate_by_fourcc(icd, pix->pixelformat);
@@ -883,11 +894,24 @@ static int mx3_camera_set_fmt(struct soc_camera_device *icd,
 
 	configure_geometry(mx3_cam, pix->width, pix->height);
 
-	ret = v4l2_subdev_call(sd, video, s_fmt, f);
-	if (!ret) {
-		icd->buswidth = xlate->buswidth;
-		icd->current_fmt = xlate->host_fmt;
-	}
+	mf.width	= pix->width;
+	mf.height	= pix->height;
+	mf.field	= pix->field;
+	mf.colorspace	= pix->colorspace;
+	mf.code		= xlate->code;
+
+	ret = v4l2_subdev_call(sd, video, s_mbus_fmt, &mf);
+	if (ret < 0)
+		return ret;
+
+	if (mf.code != xlate->code)
+		return -EINVAL;
+
+	pix->width		= mf.width;
+	pix->height		= mf.height;
+	pix->field		= mf.field;
+	pix->colorspace		= mf.colorspace;
+	icd->current_fmt	= xlate;
 
 	dev_dbg(icd->dev.parent, "Sensor set %dx%d\n", pix->width, pix->height);
 
@@ -900,8 +924,8 @@ static int mx3_camera_try_fmt(struct soc_camera_device *icd,
 	struct v4l2_subdev *sd = soc_camera_to_subdev(icd);
 	const struct soc_camera_format_xlate *xlate;
 	struct v4l2_pix_format *pix = &f->fmt.pix;
+	struct v4l2_mbus_framefmt mf;
 	__u32 pixfmt = pix->pixelformat;
-	enum v4l2_field field;
 	int ret;
 
 	xlate = soc_camera_xlate_by_fourcc(icd, pixfmt);
@@ -916,23 +940,37 @@ static int mx3_camera_try_fmt(struct soc_camera_device *icd,
 	if (pix->width > 4096)
 		pix->width = 4096;
 
-	pix->bytesperline = pix->width *
-		DIV_ROUND_UP(xlate->host_fmt->depth, 8);
+	pix->bytesperline = soc_mbus_bytes_per_line(pix->width,
+						    xlate->host_fmt);
+	if (pix->bytesperline < 0)
+		return pix->bytesperline;
 	pix->sizeimage = pix->height * pix->bytesperline;
 
-	/* camera has to see its format, but the user the original one */
-	pix->pixelformat = xlate->cam_fmt->fourcc;
 	/* limit to sensor capabilities */
-	ret = v4l2_subdev_call(sd, video, try_fmt, f);
-	pix->pixelformat = xlate->host_fmt->fourcc;
+	mf.width	= pix->width;
+	mf.height	= pix->height;
+	mf.field	= pix->field;
+	mf.colorspace	= pix->colorspace;
+	mf.code		= xlate->code;
+
+	ret = v4l2_subdev_call(sd, video, try_mbus_fmt, &mf);
+	if (ret < 0)
+		return ret;
 
-	field = pix->field;
+	pix->width	= mf.width;
+	pix->height	= mf.height;
+	pix->colorspace	= mf.colorspace;
 
-	if (field == V4L2_FIELD_ANY) {
+	switch (mf.field) {
+	case V4L2_FIELD_ANY:
 		pix->field = V4L2_FIELD_NONE;
-	} else if (field != V4L2_FIELD_NONE) {
-		dev_err(icd->dev.parent, "Field type %d unsupported.\n", field);
-		return -EINVAL;
+		break;
+	case V4L2_FIELD_NONE:
+		break;
+	default:
+		dev_err(icd->dev.parent, "Field type %d unsupported.\n",
+			mf.field);
+		ret = -EINVAL;
 	}
 
 	return ret;
@@ -968,18 +1006,26 @@ static int mx3_camera_set_bus_param(struct soc_camera_device *icd, __u32 pixfmt)
 	struct mx3_camera_dev *mx3_cam = ici->priv;
 	unsigned long bus_flags, camera_flags, common_flags;
 	u32 dw, sens_conf;
-	int ret = test_platform_param(mx3_cam, icd->buswidth, &bus_flags);
+	const struct soc_mbus_pixelfmt *fmt;
+	int buswidth;
+	int ret;
 	const struct soc_camera_format_xlate *xlate;
 	struct device *dev = icd->dev.parent;
 
+	fmt = soc_mbus_get_fmtdesc(icd->current_fmt->code);
+	if (!fmt)
+		return -EINVAL;
+
+	buswidth = fmt->bits_per_sample;
+	ret = test_platform_param(mx3_cam, buswidth, &bus_flags);
+
 	xlate = soc_camera_xlate_by_fourcc(icd, pixfmt);
 	if (!xlate) {
 		dev_warn(dev, "Format %x not found\n", pixfmt);
 		return -EINVAL;
 	}
 
-	dev_dbg(dev, "requested bus width %d bit: %d\n",
-		icd->buswidth, ret);
+	dev_dbg(dev, "requested bus width %d bit: %d\n", buswidth, ret);
 
 	if (ret < 0)
 		return ret;
@@ -1027,8 +1073,10 @@ static int mx3_camera_set_bus_param(struct soc_camera_device *icd, __u32 pixfmt)
 			common_flags &= ~SOCAM_PCLK_SAMPLE_FALLING;
 	}
 
-	/* Make the camera work in widest common mode, we'll take care of
-	 * the rest */
+	/*
+	 * Make the camera work in widest common mode, we'll take care of
+	 * the rest
+	 */
 	if (common_flags & SOCAM_DATAWIDTH_15)
 		common_flags = (common_flags & ~SOCAM_DATAWIDTH_MASK) |
 			SOCAM_DATAWIDTH_15;
@@ -1078,7 +1126,7 @@ static int mx3_camera_set_bus_param(struct soc_camera_device *icd, __u32 pixfmt)
 		sens_conf |= 1 << CSI_SENS_CONF_DATA_POL_SHIFT;
 
 	/* Just do what we're asked to do */
-	switch (xlate->host_fmt->depth) {
+	switch (xlate->host_fmt->bits_per_sample) {
 	case 4:
 		dw = 0 << CSI_SENS_CONF_DATA_WIDTH_SHIFT;
 		break;
@@ -1152,8 +1200,10 @@ static int __devinit mx3_camera_probe(struct platform_device *pdev)
 	if (!(mx3_cam->platform_flags & (MX3_CAMERA_DATAWIDTH_4 |
 			MX3_CAMERA_DATAWIDTH_8 | MX3_CAMERA_DATAWIDTH_10 |
 			MX3_CAMERA_DATAWIDTH_15))) {
-		/* Platform hasn't set available data widths. This is bad.
-		 * Warn and use a default. */
+		/*
+		 * Platform hasn't set available data widths. This is bad.
+		 * Warn and use a default.
+		 */
 		dev_warn(&pdev->dev, "WARNING! Platform hasn't set available "
 			 "data widths, using default 8 bit\n");
 		mx3_cam->platform_flags |= MX3_CAMERA_DATAWIDTH_8;
diff --git a/drivers/media/video/mxb.c b/drivers/media/video/mxb.c
index 3454070e63f0..c1fc6dc776f5 100644
--- a/drivers/media/video/mxb.c
+++ b/drivers/media/video/mxb.c
@@ -478,7 +478,7 @@ static int vidioc_s_input(struct file *file, void *fh, unsigned int input)
 
 	DEB_EE(("VIDIOC_S_INPUT %d.\n", input));
 
-	if (input < 0 || input >= MXB_INPUTS)
+	if (input >= MXB_INPUTS)
 		return -EINVAL;
 
 	mxb->cur_input = input;
diff --git a/drivers/media/video/omap24xxcam.c b/drivers/media/video/omap24xxcam.c
index 5fc4ac0d88f0..7400eacb4d64 100644
--- a/drivers/media/video/omap24xxcam.c
+++ b/drivers/media/video/omap24xxcam.c
@@ -1450,12 +1450,11 @@ static int omap24xxcam_mmap(struct file *file, struct vm_area_struct *vma)
 
 static int omap24xxcam_open(struct file *file)
 {
-	int minor = video_devdata(file)->minor;
 	struct omap24xxcam_device *cam = omap24xxcam.priv;
 	struct omap24xxcam_fh *fh;
 	struct v4l2_format format;
 
-	if (!cam || !cam->vfd || (cam->vfd->minor != minor))
+	if (!cam || !cam->vfd)
 		return -ENODEV;
 
 	fh = kzalloc(sizeof(*fh), GFP_KERNEL);
@@ -1660,7 +1659,6 @@ static int omap24xxcam_device_register(struct v4l2_int_device *s)
 
 	strlcpy(vfd->name, CAM_NAME, sizeof(vfd->name));
 	vfd->fops		 = &omap24xxcam_fops;
-	vfd->minor		 = -1;
 	vfd->ioctl_ops		 = &omap24xxcam_ioctl_fops;
 
 	omap24xxcam_hwinit(cam);
@@ -1671,14 +1669,14 @@ static int omap24xxcam_device_register(struct v4l2_int_device *s)
 
 	if (video_register_device(vfd, VFL_TYPE_GRABBER, video_nr) < 0) {
 		dev_err(cam->dev, "could not register V4L device\n");
-		vfd->minor = -1;
 		rval = -EBUSY;
 		goto err;
 	}
 
 	omap24xxcam_poweron_reset(cam);
 
-	dev_info(cam->dev, "registered device video%d\n", vfd->minor);
+	dev_info(cam->dev, "registered device %s\n",
+		 video_device_node_name(vfd));
 
 	return 0;
 
@@ -1695,7 +1693,7 @@ static void omap24xxcam_device_unregister(struct v4l2_int_device *s)
 	omap24xxcam_sensor_exit(cam);
 
 	if (cam->vfd) {
-		if (cam->vfd->minor == -1) {
+		if (!video_is_registered(cam->vfd)) {
 			/*
 			 * The device was never registered, so release the
 			 * video_device struct directly.
diff --git a/drivers/media/video/ov511.c b/drivers/media/video/ov511.c
index 0bc2cf573c76..e0bce8dc74bf 100644
--- a/drivers/media/video/ov511.c
+++ b/drivers/media/video/ov511.c
@@ -4674,7 +4674,6 @@ static struct video_device vdev_template = {
 	.name =		"OV511 USB Camera",
 	.fops =		&ov511_fops,
 	.release =	video_device_release,
-	.minor =	-1,
 };
 
 /****************************************************************************
@@ -5867,8 +5866,8 @@ ov51x_probe(struct usb_interface *intf, const struct usb_device_id *id)
 	ov511_devused |= 1 << nr;
 	ov->nr = nr;
 
-	dev_info(&intf->dev, "Device at %s registered to minor %d\n",
-		 ov->usb_path, ov->vdev->minor);
+	dev_info(&intf->dev, "Device at %s registered to %s\n",
+		 ov->usb_path, video_device_node_name(ov->vdev));
 
 	usb_set_intfdata(intf, ov);
 	if (ov_create_sysfs(ov->vdev)) {
@@ -5878,13 +5877,13 @@ ov51x_probe(struct usb_interface *intf, const struct usb_device_id *id)
 		goto error;
 	}
 
-	mutex_lock(&ov->lock);
+	mutex_unlock(&ov->lock);
 
 	return 0;
 
 error:
 	if (ov->vdev) {
-		if (-1 == ov->vdev->minor)
+		if (!video_is_registered(ov->vdev))
 			video_device_release(ov->vdev);
 		else
 			video_unregister_device(ov->vdev);
diff --git a/drivers/media/video/ov772x.c b/drivers/media/video/ov772x.c
index eccb40ab7fec..3a45e945a528 100644
--- a/drivers/media/video/ov772x.c
+++ b/drivers/media/video/ov772x.c
@@ -24,6 +24,7 @@
 #include <media/v4l2-chip-ident.h>
 #include <media/v4l2-subdev.h>
 #include <media/soc_camera.h>
+#include <media/soc_mediabus.h>
 #include <media/ov772x.h>
 
 /*
@@ -247,7 +248,7 @@
 
 /* COM5 */
 #define AFR_ON_OFF      0x80	/* Auto frame rate control ON/OFF selection */
-#define AFR_SPPED       0x40	/* Auto frame rate control speed slection */
+#define AFR_SPPED       0x40	/* Auto frame rate control speed selection */
 				/* Auto frame rate max rate control */
 #define AFR_NO_RATE     0x00	/*     No  reduction of frame rate */
 #define AFR_1p2         0x10	/*     Max reduction to 1/2 frame rate */
@@ -382,7 +383,8 @@ struct regval_list {
 };
 
 struct ov772x_color_format {
-	const struct soc_camera_data_format *format;
+	enum v4l2_mbus_pixelcode code;
+	enum v4l2_colorspace colorspace;
 	u8 dsp3;
 	u8 com3;
 	u8 com7;
@@ -399,7 +401,7 @@ struct ov772x_win_size {
 struct ov772x_priv {
 	struct v4l2_subdev                subdev;
 	struct ov772x_camera_info        *info;
-	const struct ov772x_color_format *fmt;
+	const struct ov772x_color_format *cfmt;
 	const struct ov772x_win_size     *win;
 	int                               model;
 	unsigned short                    flag_vflip:1;
@@ -434,93 +436,57 @@ static const struct regval_list ov772x_vga_regs[] = {
 };
 
 /*
- * supported format list
- */
-
-#define SETFOURCC(type) .name = (#type), .fourcc = (V4L2_PIX_FMT_ ## type)
-static const struct soc_camera_data_format ov772x_fmt_lists[] = {
-	{
-		SETFOURCC(YUYV),
-		.depth      = 16,
-		.colorspace = V4L2_COLORSPACE_JPEG,
-	},
-	{
-		SETFOURCC(YVYU),
-		.depth      = 16,
-		.colorspace = V4L2_COLORSPACE_JPEG,
-	},
-	{
-		SETFOURCC(UYVY),
-		.depth      = 16,
-		.colorspace = V4L2_COLORSPACE_JPEG,
-	},
-	{
-		SETFOURCC(RGB555),
-		.depth      = 16,
-		.colorspace = V4L2_COLORSPACE_SRGB,
-	},
-	{
-		SETFOURCC(RGB555X),
-		.depth      = 16,
-		.colorspace = V4L2_COLORSPACE_SRGB,
-	},
-	{
-		SETFOURCC(RGB565),
-		.depth      = 16,
-		.colorspace = V4L2_COLORSPACE_SRGB,
-	},
-	{
-		SETFOURCC(RGB565X),
-		.depth      = 16,
-		.colorspace = V4L2_COLORSPACE_SRGB,
-	},
-};
-
-/*
- * color format list
+ * supported color format list
  */
 static const struct ov772x_color_format ov772x_cfmts[] = {
 	{
-		.format = &ov772x_fmt_lists[0],
-		.dsp3   = 0x0,
-		.com3   = SWAP_YUV,
-		.com7   = OFMT_YUV,
+		.code		= V4L2_MBUS_FMT_YUYV8_2X8_LE,
+		.colorspace	= V4L2_COLORSPACE_JPEG,
+		.dsp3		= 0x0,
+		.com3		= SWAP_YUV,
+		.com7		= OFMT_YUV,
 	},
 	{
-		.format = &ov772x_fmt_lists[1],
-		.dsp3   = UV_ON,
-		.com3   = SWAP_YUV,
-		.com7   = OFMT_YUV,
+		.code		= V4L2_MBUS_FMT_YVYU8_2X8_LE,
+		.colorspace	= V4L2_COLORSPACE_JPEG,
+		.dsp3		= UV_ON,
+		.com3		= SWAP_YUV,
+		.com7		= OFMT_YUV,
 	},
 	{
-		.format = &ov772x_fmt_lists[2],
-		.dsp3   = 0x0,
-		.com3   = 0x0,
-		.com7   = OFMT_YUV,
+		.code		= V4L2_MBUS_FMT_YUYV8_2X8_BE,
+		.colorspace	= V4L2_COLORSPACE_JPEG,
+		.dsp3		= 0x0,
+		.com3		= 0x0,
+		.com7		= OFMT_YUV,
 	},
 	{
-		.format = &ov772x_fmt_lists[3],
-		.dsp3   = 0x0,
-		.com3   = SWAP_RGB,
-		.com7   = FMT_RGB555 | OFMT_RGB,
+		.code		= V4L2_MBUS_FMT_RGB555_2X8_PADHI_LE,
+		.colorspace	= V4L2_COLORSPACE_SRGB,
+		.dsp3		= 0x0,
+		.com3		= SWAP_RGB,
+		.com7		= FMT_RGB555 | OFMT_RGB,
 	},
 	{
-		.format = &ov772x_fmt_lists[4],
-		.dsp3   = 0x0,
-		.com3   = 0x0,
-		.com7   = FMT_RGB555 | OFMT_RGB,
+		.code		= V4L2_MBUS_FMT_RGB555_2X8_PADHI_BE,
+		.colorspace	= V4L2_COLORSPACE_SRGB,
+		.dsp3		= 0x0,
+		.com3		= 0x0,
+		.com7		= FMT_RGB555 | OFMT_RGB,
 	},
 	{
-		.format = &ov772x_fmt_lists[5],
-		.dsp3   = 0x0,
-		.com3   = SWAP_RGB,
-		.com7   = FMT_RGB565 | OFMT_RGB,
+		.code		= V4L2_MBUS_FMT_RGB565_2X8_LE,
+		.colorspace	= V4L2_COLORSPACE_SRGB,
+		.dsp3		= 0x0,
+		.com3		= SWAP_RGB,
+		.com7		= FMT_RGB565 | OFMT_RGB,
 	},
 	{
-		.format = &ov772x_fmt_lists[6],
-		.dsp3   = 0x0,
-		.com3   = 0x0,
-		.com7   = FMT_RGB565 | OFMT_RGB,
+		.code		= V4L2_MBUS_FMT_RGB565_2X8_BE,
+		.colorspace	= V4L2_COLORSPACE_SRGB,
+		.dsp3		= 0x0,
+		.com3		= 0x0,
+		.com7		= FMT_RGB565 | OFMT_RGB,
 	},
 };
 
@@ -642,15 +608,15 @@ static int ov772x_s_stream(struct v4l2_subdev *sd, int enable)
 		return 0;
 	}
 
-	if (!priv->win || !priv->fmt) {
+	if (!priv->win || !priv->cfmt) {
 		dev_err(&client->dev, "norm or win select error\n");
 		return -EPERM;
 	}
 
 	ov772x_mask_set(client, COM2, SOFT_SLEEP_MODE, 0);
 
-	dev_dbg(&client->dev, "format %s, win %s\n",
-		priv->fmt->format->name, priv->win->name);
+	dev_dbg(&client->dev, "format %d, win %s\n",
+		priv->cfmt->code, priv->win->name);
 
 	return 0;
 }
@@ -806,8 +772,8 @@ static const struct ov772x_win_size *ov772x_select_win(u32 width, u32 height)
 	return win;
 }
 
-static int ov772x_set_params(struct i2c_client *client,
-			     u32 *width, u32 *height, u32 pixfmt)
+static int ov772x_set_params(struct i2c_client *client, u32 *width, u32 *height,
+			     enum v4l2_mbus_pixelcode code)
 {
 	struct ov772x_priv *priv = to_ov772x(client);
 	int ret = -EINVAL;
@@ -817,14 +783,14 @@ static int ov772x_set_params(struct i2c_client *client,
 	/*
 	 * select format
 	 */
-	priv->fmt = NULL;
+	priv->cfmt = NULL;
 	for (i = 0; i < ARRAY_SIZE(ov772x_cfmts); i++) {
-		if (pixfmt == ov772x_cfmts[i].format->fourcc) {
-			priv->fmt = ov772x_cfmts + i;
+		if (code == ov772x_cfmts[i].code) {
+			priv->cfmt = ov772x_cfmts + i;
 			break;
 		}
 	}
-	if (!priv->fmt)
+	if (!priv->cfmt)
 		goto ov772x_set_fmt_error;
 
 	/*
@@ -894,7 +860,7 @@ static int ov772x_set_params(struct i2c_client *client,
 	/*
 	 * set DSP_CTRL3
 	 */
-	val = priv->fmt->dsp3;
+	val = priv->cfmt->dsp3;
 	if (val) {
 		ret = ov772x_mask_set(client,
 				      DSP_CTRL3, UV_MASK, val);
@@ -905,7 +871,7 @@ static int ov772x_set_params(struct i2c_client *client,
 	/*
 	 * set COM3
 	 */
-	val = priv->fmt->com3;
+	val = priv->cfmt->com3;
 	if (priv->info->flags & OV772X_FLAG_VFLIP)
 		val |= VFLIP_IMG;
 	if (priv->info->flags & OV772X_FLAG_HFLIP)
@@ -923,9 +889,9 @@ static int ov772x_set_params(struct i2c_client *client,
 	/*
 	 * set COM7
 	 */
-	val = priv->win->com7_bit | priv->fmt->com7;
+	val = priv->win->com7_bit | priv->cfmt->com7;
 	ret = ov772x_mask_set(client,
-			      COM7, (SLCT_MASK | FMT_MASK | OFMT_MASK),
+			      COM7, SLCT_MASK | FMT_MASK | OFMT_MASK,
 			      val);
 	if (ret < 0)
 		goto ov772x_set_fmt_error;
@@ -951,7 +917,7 @@ ov772x_set_fmt_error:
 
 	ov772x_reset(client);
 	priv->win = NULL;
-	priv->fmt = NULL;
+	priv->cfmt = NULL;
 
 	return ret;
 }
@@ -981,54 +947,79 @@ static int ov772x_cropcap(struct v4l2_subdev *sd, struct v4l2_cropcap *a)
 	return 0;
 }
 
-static int ov772x_g_fmt(struct v4l2_subdev *sd, struct v4l2_format *f)
+static int ov772x_g_fmt(struct v4l2_subdev *sd,
+			struct v4l2_mbus_framefmt *mf)
 {
 	struct i2c_client *client = sd->priv;
 	struct ov772x_priv *priv = to_ov772x(client);
-	struct v4l2_pix_format *pix = &f->fmt.pix;
 
-	if (!priv->win || !priv->fmt) {
+	if (!priv->win || !priv->cfmt) {
 		u32 width = VGA_WIDTH, height = VGA_HEIGHT;
 		int ret = ov772x_set_params(client, &width, &height,
-					    V4L2_PIX_FMT_YUYV);
+					    V4L2_MBUS_FMT_YUYV8_2X8_LE);
 		if (ret < 0)
 			return ret;
 	}
 
-	f->type			= V4L2_BUF_TYPE_VIDEO_CAPTURE;
-
-	pix->width		= priv->win->width;
-	pix->height		= priv->win->height;
-	pix->pixelformat	= priv->fmt->format->fourcc;
-	pix->colorspace		= priv->fmt->format->colorspace;
-	pix->field		= V4L2_FIELD_NONE;
+	mf->width	= priv->win->width;
+	mf->height	= priv->win->height;
+	mf->code	= priv->cfmt->code;
+	mf->colorspace	= priv->cfmt->colorspace;
+	mf->field	= V4L2_FIELD_NONE;
 
 	return 0;
 }
 
-static int ov772x_s_fmt(struct v4l2_subdev *sd, struct v4l2_format *f)
+static int ov772x_s_fmt(struct v4l2_subdev *sd,
+			struct v4l2_mbus_framefmt *mf)
 {
 	struct i2c_client *client = sd->priv;
-	struct v4l2_pix_format *pix = &f->fmt.pix;
+	struct ov772x_priv *priv = to_ov772x(client);
+	int ret = ov772x_set_params(client, &mf->width, &mf->height,
+				    mf->code);
+
+	if (!ret)
+		mf->colorspace = priv->cfmt->colorspace;
 
-	return ov772x_set_params(client, &pix->width, &pix->height,
-				 pix->pixelformat);
+	return ret;
 }
 
 static int ov772x_try_fmt(struct v4l2_subdev *sd,
-			  struct v4l2_format *f)
+			  struct v4l2_mbus_framefmt *mf)
 {
-	struct v4l2_pix_format *pix = &f->fmt.pix;
+	struct i2c_client *client = sd->priv;
+	struct ov772x_priv *priv = to_ov772x(client);
 	const struct ov772x_win_size *win;
+	int i;
 
 	/*
 	 * select suitable win
 	 */
-	win = ov772x_select_win(pix->width, pix->height);
+	win = ov772x_select_win(mf->width, mf->height);
+
+	mf->width	= win->width;
+	mf->height	= win->height;
+	mf->field	= V4L2_FIELD_NONE;
 
-	pix->width  = win->width;
-	pix->height = win->height;
-	pix->field  = V4L2_FIELD_NONE;
+	for (i = 0; i < ARRAY_SIZE(ov772x_cfmts); i++)
+		if (mf->code == ov772x_cfmts[i].code)
+			break;
+
+	if (i == ARRAY_SIZE(ov772x_cfmts)) {
+		/* Unsupported format requested. Propose either */
+		if (priv->cfmt) {
+			/* the current one or */
+			mf->colorspace = priv->cfmt->colorspace;
+			mf->code = priv->cfmt->code;
+		} else {
+			/* the default one */
+			mf->colorspace = ov772x_cfmts[0].colorspace;
+			mf->code = ov772x_cfmts[0].code;
+		}
+	} else {
+		/* Also return the colorspace */
+		mf->colorspace	= ov772x_cfmts[i].colorspace;
+	}
 
 	return 0;
 }
@@ -1057,9 +1048,6 @@ static int ov772x_video_probe(struct soc_camera_device *icd,
 		return -ENODEV;
 	}
 
-	icd->formats     = ov772x_fmt_lists;
-	icd->num_formats = ARRAY_SIZE(ov772x_fmt_lists);
-
 	/*
 	 * check and show product ID and manufacturer ID
 	 */
@@ -1109,13 +1097,24 @@ static struct v4l2_subdev_core_ops ov772x_subdev_core_ops = {
 #endif
 };
 
+static int ov772x_enum_fmt(struct v4l2_subdev *sd, int index,
+			   enum v4l2_mbus_pixelcode *code)
+{
+	if ((unsigned int)index >= ARRAY_SIZE(ov772x_cfmts))
+		return -EINVAL;
+
+	*code = ov772x_cfmts[index].code;
+	return 0;
+}
+
 static struct v4l2_subdev_video_ops ov772x_subdev_video_ops = {
 	.s_stream	= ov772x_s_stream,
-	.g_fmt		= ov772x_g_fmt,
-	.s_fmt		= ov772x_s_fmt,
-	.try_fmt	= ov772x_try_fmt,
+	.g_mbus_fmt	= ov772x_g_fmt,
+	.s_mbus_fmt	= ov772x_s_fmt,
+	.try_mbus_fmt	= ov772x_try_fmt,
 	.cropcap	= ov772x_cropcap,
 	.g_crop		= ov772x_g_crop,
+	.enum_mbus_fmt	= ov772x_enum_fmt,
 };
 
 static struct v4l2_subdev_ops ov772x_subdev_ops = {
@@ -1143,10 +1142,10 @@ static int ov772x_probe(struct i2c_client *client,
 	}
 
 	icl = to_soc_camera_link(icd);
-	if (!icl)
+	if (!icl || !icl->priv)
 		return -EINVAL;
 
-	info = container_of(icl, struct ov772x_camera_info, link);
+	info = icl->priv;
 
 	if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA)) {
 		dev_err(&adapter->dev,
diff --git a/drivers/media/video/ov9640.c b/drivers/media/video/ov9640.c
new file mode 100644
index 000000000000..47bf60ceb7a2
--- /dev/null
+++ b/drivers/media/video/ov9640.c
@@ -0,0 +1,832 @@
+/*
+ * OmniVision OV96xx Camera Driver
+ *
+ * Copyright (C) 2009 Marek Vasut <marek.vasut@gmail.com>
+ *
+ * Based on ov772x camera driver:
+ *
+ * Copyright (C) 2008 Renesas Solutions Corp.
+ * Kuninori Morimoto <morimoto.kuninori@renesas.com>
+ *
+ * Based on ov7670 and soc_camera_platform driver,
+ *
+ * Copyright 2006-7 Jonathan Corbet <corbet@lwn.net>
+ * Copyright (C) 2008 Magnus Damm
+ * Copyright (C) 2008, Guennadi Liakhovetski <kernel@pengutronix.de>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/i2c.h>
+#include <linux/slab.h>
+#include <linux/delay.h>
+#include <linux/videodev2.h>
+#include <media/v4l2-chip-ident.h>
+#include <media/v4l2-common.h>
+#include <media/soc_camera.h>
+
+#include "ov9640.h"
+
+/* default register setup */
+static const struct ov9640_reg ov9640_regs_dflt[] = {
+	{ OV9640_COM5,	OV9640_COM5_SYSCLK | OV9640_COM5_LONGEXP },
+	{ OV9640_COM6,	OV9640_COM6_OPT_BLC | OV9640_COM6_ADBLC_BIAS |
+			OV9640_COM6_FMT_RST | OV9640_COM6_ADBLC_OPTEN },
+	{ OV9640_PSHFT,	OV9640_PSHFT_VAL(0x01) },
+	{ OV9640_ACOM,	OV9640_ACOM_2X_ANALOG | OV9640_ACOM_RSVD },
+	{ OV9640_TSLB,	OV9640_TSLB_YUYV_UYVY },
+	{ OV9640_COM16,	OV9640_COM16_RB_AVG },
+
+	/* Gamma curve P */
+	{ 0x6c, 0x40 },	{ 0x6d, 0x30 },	{ 0x6e, 0x4b },	{ 0x6f, 0x60 },
+	{ 0x70, 0x70 },	{ 0x71, 0x70 },	{ 0x72, 0x70 },	{ 0x73, 0x70 },
+	{ 0x74, 0x60 },	{ 0x75, 0x60 },	{ 0x76, 0x50 },	{ 0x77, 0x48 },
+	{ 0x78, 0x3a },	{ 0x79, 0x2e },	{ 0x7a, 0x28 },	{ 0x7b, 0x22 },
+
+	/* Gamma curve T */
+	{ 0x7c, 0x04 },	{ 0x7d, 0x07 },	{ 0x7e, 0x10 },	{ 0x7f, 0x28 },
+	{ 0x80, 0x36 },	{ 0x81, 0x44 },	{ 0x82, 0x52 },	{ 0x83, 0x60 },
+	{ 0x84, 0x6c },	{ 0x85, 0x78 },	{ 0x86, 0x8c },	{ 0x87, 0x9e },
+	{ 0x88, 0xbb },	{ 0x89, 0xd2 },	{ 0x8a, 0xe6 },
+};
+
+/* Configurations
+ * NOTE: for YUV, alter the following registers:
+ * 		COM12 |= OV9640_COM12_YUV_AVG
+ *
+ *	 for RGB, alter the following registers:
+ *	 	COM7  |= OV9640_COM7_RGB
+ *	 	COM13 |= OV9640_COM13_RGB_AVG
+ *	 	COM15 |= proper RGB color encoding mode
+ */
+static const struct ov9640_reg ov9640_regs_qqcif[] = {
+	{ OV9640_CLKRC,	OV9640_CLKRC_DPLL_EN | OV9640_CLKRC_DIV(0x0f) },
+	{ OV9640_COM1,	OV9640_COM1_QQFMT | OV9640_COM1_HREF_2SKIP },
+	{ OV9640_COM4,	OV9640_COM4_QQ_VP | OV9640_COM4_RSVD },
+	{ OV9640_COM7,	OV9640_COM7_QCIF },
+	{ OV9640_COM12,	OV9640_COM12_RSVD },
+	{ OV9640_COM13,	OV9640_COM13_GAMMA_RAW | OV9640_COM13_MATRIX_EN },
+	{ OV9640_COM15,	OV9640_COM15_OR_10F0 },
+};
+
+static const struct ov9640_reg ov9640_regs_qqvga[] = {
+	{ OV9640_CLKRC,	OV9640_CLKRC_DPLL_EN | OV9640_CLKRC_DIV(0x07) },
+	{ OV9640_COM1,	OV9640_COM1_QQFMT | OV9640_COM1_HREF_2SKIP },
+	{ OV9640_COM4,	OV9640_COM4_QQ_VP | OV9640_COM4_RSVD },
+	{ OV9640_COM7,	OV9640_COM7_QVGA },
+	{ OV9640_COM12,	OV9640_COM12_RSVD },
+	{ OV9640_COM13,	OV9640_COM13_GAMMA_RAW | OV9640_COM13_MATRIX_EN },
+	{ OV9640_COM15,	OV9640_COM15_OR_10F0 },
+};
+
+static const struct ov9640_reg ov9640_regs_qcif[] = {
+	{ OV9640_CLKRC,	OV9640_CLKRC_DPLL_EN | OV9640_CLKRC_DIV(0x07) },
+	{ OV9640_COM4,	OV9640_COM4_QQ_VP | OV9640_COM4_RSVD },
+	{ OV9640_COM7,	OV9640_COM7_QCIF },
+	{ OV9640_COM12,	OV9640_COM12_RSVD },
+	{ OV9640_COM13,	OV9640_COM13_GAMMA_RAW | OV9640_COM13_MATRIX_EN },
+	{ OV9640_COM15,	OV9640_COM15_OR_10F0 },
+};
+
+static const struct ov9640_reg ov9640_regs_qvga[] = {
+	{ OV9640_CLKRC,	OV9640_CLKRC_DPLL_EN | OV9640_CLKRC_DIV(0x03) },
+	{ OV9640_COM4,	OV9640_COM4_QQ_VP | OV9640_COM4_RSVD },
+	{ OV9640_COM7,	OV9640_COM7_QVGA },
+	{ OV9640_COM12,	OV9640_COM12_RSVD },
+	{ OV9640_COM13,	OV9640_COM13_GAMMA_RAW | OV9640_COM13_MATRIX_EN },
+	{ OV9640_COM15,	OV9640_COM15_OR_10F0 },
+};
+
+static const struct ov9640_reg ov9640_regs_cif[] = {
+	{ OV9640_CLKRC,	OV9640_CLKRC_DPLL_EN | OV9640_CLKRC_DIV(0x03) },
+	{ OV9640_COM3,	OV9640_COM3_VP },
+	{ OV9640_COM7,	OV9640_COM7_CIF },
+	{ OV9640_COM12,	OV9640_COM12_RSVD },
+	{ OV9640_COM13,	OV9640_COM13_GAMMA_RAW | OV9640_COM13_MATRIX_EN },
+	{ OV9640_COM15,	OV9640_COM15_OR_10F0 },
+};
+
+static const struct ov9640_reg ov9640_regs_vga[] = {
+	{ OV9640_CLKRC,	OV9640_CLKRC_DPLL_EN | OV9640_CLKRC_DIV(0x01) },
+	{ OV9640_COM3,	OV9640_COM3_VP },
+	{ OV9640_COM7,	OV9640_COM7_VGA },
+	{ OV9640_COM12,	OV9640_COM12_RSVD },
+	{ OV9640_COM13,	OV9640_COM13_GAMMA_RAW | OV9640_COM13_MATRIX_EN },
+	{ OV9640_COM15,	OV9640_COM15_OR_10F0 },
+};
+
+static const struct ov9640_reg ov9640_regs_sxga[] = {
+	{ OV9640_CLKRC,	OV9640_CLKRC_DPLL_EN | OV9640_CLKRC_DIV(0x01) },
+	{ OV9640_COM3,	OV9640_COM3_VP },
+	{ OV9640_COM7,	0 },
+	{ OV9640_COM12,	OV9640_COM12_RSVD },
+	{ OV9640_COM13,	OV9640_COM13_GAMMA_RAW | OV9640_COM13_MATRIX_EN },
+	{ OV9640_COM15,	OV9640_COM15_OR_10F0 },
+};
+
+static const struct ov9640_reg ov9640_regs_yuv[] = {
+	{ OV9640_MTX1,	0x58 },
+	{ OV9640_MTX2,	0x48 },
+	{ OV9640_MTX3,	0x10 },
+	{ OV9640_MTX4,	0x28 },
+	{ OV9640_MTX5,	0x48 },
+	{ OV9640_MTX6,	0x70 },
+	{ OV9640_MTX7,	0x40 },
+	{ OV9640_MTX8,	0x40 },
+	{ OV9640_MTX9,	0x40 },
+	{ OV9640_MTXS,	0x0f },
+};
+
+static const struct ov9640_reg ov9640_regs_rgb[] = {
+	{ OV9640_MTX1,	0x71 },
+	{ OV9640_MTX2,	0x3e },
+	{ OV9640_MTX3,	0x0c },
+	{ OV9640_MTX4,	0x33 },
+	{ OV9640_MTX5,	0x72 },
+	{ OV9640_MTX6,	0x00 },
+	{ OV9640_MTX7,	0x2b },
+	{ OV9640_MTX8,	0x66 },
+	{ OV9640_MTX9,	0xd2 },
+	{ OV9640_MTXS,	0x65 },
+};
+
+static enum v4l2_mbus_pixelcode ov9640_codes[] = {
+	V4L2_MBUS_FMT_YUYV8_2X8_BE,
+	V4L2_MBUS_FMT_RGB555_2X8_PADHI_LE,
+	V4L2_MBUS_FMT_RGB565_2X8_LE,
+};
+
+static const struct v4l2_queryctrl ov9640_controls[] = {
+	{
+		.id		= V4L2_CID_VFLIP,
+		.type		= V4L2_CTRL_TYPE_BOOLEAN,
+		.name		= "Flip Vertically",
+		.minimum	= 0,
+		.maximum	= 1,
+		.step		= 1,
+		.default_value	= 0,
+	},
+	{
+		.id		= V4L2_CID_HFLIP,
+		.type		= V4L2_CTRL_TYPE_BOOLEAN,
+		.name		= "Flip Horizontally",
+		.minimum	= 0,
+		.maximum	= 1,
+		.step		= 1,
+		.default_value	= 0,
+	},
+};
+
+/* read a register */
+static int ov9640_reg_read(struct i2c_client *client, u8 reg, u8 *val)
+{
+	int ret;
+	u8 data = reg;
+	struct i2c_msg msg = {
+		.addr	= client->addr,
+		.flags	= 0,
+		.len	= 1,
+		.buf	= &data,
+	};
+
+	ret = i2c_transfer(client->adapter, &msg, 1);
+	if (ret < 0)
+		goto err;
+
+	msg.flags = I2C_M_RD;
+	ret = i2c_transfer(client->adapter, &msg, 1);
+	if (ret < 0)
+		goto err;
+
+	*val = data;
+	return 0;
+
+err:
+	dev_err(&client->dev, "Failed reading register 0x%02x!\n", reg);
+	return ret;
+}
+
+/* write a register */
+static int ov9640_reg_write(struct i2c_client *client, u8 reg, u8 val)
+{
+	int ret;
+	u8 _val;
+	unsigned char data[2] = { reg, val };
+	struct i2c_msg msg = {
+		.addr	= client->addr,
+		.flags	= 0,
+		.len	= 2,
+		.buf	= data,
+	};
+
+	ret = i2c_transfer(client->adapter, &msg, 1);
+	if (ret < 0) {
+		dev_err(&client->dev, "Failed writing register 0x%02x!\n", reg);
+		return ret;
+	}
+
+	/* we have to read the register back ... no idea why, maybe HW bug */
+	ret = ov9640_reg_read(client, reg, &_val);
+	if (ret)
+		dev_err(&client->dev,
+			"Failed reading back register 0x%02x!\n", reg);
+
+	return 0;
+}
+
+
+/* Read a register, alter its bits, write it back */
+static int ov9640_reg_rmw(struct i2c_client *client, u8 reg, u8 set, u8 unset)
+{
+	u8 val;
+	int ret;
+
+	ret = ov9640_reg_read(client, reg, &val);
+	if (ret) {
+		dev_err(&client->dev,
+			"[Read]-Modify-Write of register %02x failed!\n", reg);
+		return val;
+	}
+
+	val |= set;
+	val &= ~unset;
+
+	ret = ov9640_reg_write(client, reg, val);
+	if (ret)
+		dev_err(&client->dev,
+			"Read-Modify-[Write] of register %02x failed!\n", reg);
+
+	return ret;
+}
+
+/* Soft reset the camera. This has nothing to do with the RESET pin! */
+static int ov9640_reset(struct i2c_client *client)
+{
+	int ret;
+
+	ret = ov9640_reg_write(client, OV9640_COM7, OV9640_COM7_SCCB_RESET);
+	if (ret)
+		dev_err(&client->dev,
+			"An error occured while entering soft reset!\n");
+
+	return ret;
+}
+
+/* Start/Stop streaming from the device */
+static int ov9640_s_stream(struct v4l2_subdev *sd, int enable)
+{
+	return 0;
+}
+
+/* Alter bus settings on camera side */
+static int ov9640_set_bus_param(struct soc_camera_device *icd,
+				unsigned long flags)
+{
+	return 0;
+}
+
+/* Request bus settings on camera side */
+static unsigned long ov9640_query_bus_param(struct soc_camera_device *icd)
+{
+	struct soc_camera_link *icl = to_soc_camera_link(icd);
+
+	/*
+	 * REVISIT: the camera probably can do 10 bit transfers, but I don't
+	 *          have those pins connected on my hardware.
+	 */
+	unsigned long flags = SOCAM_PCLK_SAMPLE_RISING | SOCAM_MASTER |
+		SOCAM_VSYNC_ACTIVE_HIGH | SOCAM_HSYNC_ACTIVE_HIGH |
+		SOCAM_DATA_ACTIVE_HIGH | SOCAM_DATAWIDTH_8;
+
+	return soc_camera_apply_sensor_flags(icl, flags);
+}
+
+/* Get status of additional camera capabilities */
+static int ov9640_g_ctrl(struct v4l2_subdev *sd, struct v4l2_control *ctrl)
+{
+	struct i2c_client *client = sd->priv;
+	struct ov9640_priv *priv = container_of(i2c_get_clientdata(client),
+					struct ov9640_priv, subdev);
+
+	switch (ctrl->id) {
+	case V4L2_CID_VFLIP:
+		ctrl->value = priv->flag_vflip;
+		break;
+	case V4L2_CID_HFLIP:
+		ctrl->value = priv->flag_hflip;
+		break;
+	}
+	return 0;
+}
+
+/* Set status of additional camera capabilities */
+static int ov9640_s_ctrl(struct v4l2_subdev *sd, struct v4l2_control *ctrl)
+{
+	struct i2c_client *client = sd->priv;
+	struct ov9640_priv *priv = container_of(i2c_get_clientdata(client),
+					struct ov9640_priv, subdev);
+
+	int ret = 0;
+
+	switch (ctrl->id) {
+	case V4L2_CID_VFLIP:
+		priv->flag_vflip = ctrl->value;
+		if (ctrl->value)
+			ret = ov9640_reg_rmw(client, OV9640_MVFP,
+							OV9640_MVFP_V, 0);
+		else
+			ret = ov9640_reg_rmw(client, OV9640_MVFP,
+							0, OV9640_MVFP_V);
+		break;
+	case V4L2_CID_HFLIP:
+		priv->flag_hflip = ctrl->value;
+		if (ctrl->value)
+			ret = ov9640_reg_rmw(client, OV9640_MVFP,
+							OV9640_MVFP_H, 0);
+		else
+			ret = ov9640_reg_rmw(client, OV9640_MVFP,
+							0, OV9640_MVFP_H);
+		break;
+	}
+
+	return ret;
+}
+
+/* Get chip identification */
+static int ov9640_g_chip_ident(struct v4l2_subdev *sd,
+				struct v4l2_dbg_chip_ident *id)
+{
+	struct i2c_client *client = sd->priv;
+	struct ov9640_priv *priv = container_of(i2c_get_clientdata(client),
+					struct ov9640_priv, subdev);
+
+	id->ident	= priv->model;
+	id->revision	= priv->revision;
+
+	return 0;
+}
+
+#ifdef CONFIG_VIDEO_ADV_DEBUG
+static int ov9640_get_register(struct v4l2_subdev *sd,
+				struct v4l2_dbg_register *reg)
+{
+	struct i2c_client *client = sd->priv;
+	int ret;
+	u8 val;
+
+	if (reg->reg & ~0xff)
+		return -EINVAL;
+
+	reg->size = 1;
+
+	ret = ov9640_reg_read(client, reg->reg, &val);
+	if (ret)
+		return ret;
+
+	reg->val = (__u64)val;
+
+	return 0;
+}
+
+static int ov9640_set_register(struct v4l2_subdev *sd,
+				struct v4l2_dbg_register *reg)
+{
+	struct i2c_client *client = sd->priv;
+
+	if (reg->reg & ~0xff || reg->val & ~0xff)
+		return -EINVAL;
+
+	return ov9640_reg_write(client, reg->reg, reg->val);
+}
+#endif
+
+/* select nearest higher resolution for capture */
+static void ov9640_res_roundup(u32 *width, u32 *height)
+{
+	int i;
+	enum { QQCIF, QQVGA, QCIF, QVGA, CIF, VGA, SXGA };
+	int res_x[] = { 88, 160, 176, 320, 352, 640, 1280 };
+	int res_y[] = { 72, 120, 144, 240, 288, 480, 960 };
+
+	for (i = 0; i < ARRAY_SIZE(res_x); i++) {
+		if (res_x[i] >= *width && res_y[i] >= *height) {
+			*width = res_x[i];
+			*height = res_y[i];
+			return;
+		}
+	}
+
+	*width = res_x[SXGA];
+	*height = res_y[SXGA];
+}
+
+/* Prepare necessary register changes depending on color encoding */
+static void ov9640_alter_regs(enum v4l2_mbus_pixelcode code,
+			      struct ov9640_reg_alt *alt)
+{
+	switch (code) {
+	default:
+	case V4L2_MBUS_FMT_YUYV8_2X8_BE:
+		alt->com12	= OV9640_COM12_YUV_AVG;
+		alt->com13	= OV9640_COM13_Y_DELAY_EN |
+					OV9640_COM13_YUV_DLY(0x01);
+		break;
+	case V4L2_MBUS_FMT_RGB555_2X8_PADHI_LE:
+		alt->com7	= OV9640_COM7_RGB;
+		alt->com13	= OV9640_COM13_RGB_AVG;
+		alt->com15	= OV9640_COM15_RGB_555;
+		break;
+	case V4L2_MBUS_FMT_RGB565_2X8_LE:
+		alt->com7	= OV9640_COM7_RGB;
+		alt->com13	= OV9640_COM13_RGB_AVG;
+		alt->com15	= OV9640_COM15_RGB_565;
+		break;
+	};
+}
+
+/* Setup registers according to resolution and color encoding */
+static int ov9640_write_regs(struct i2c_client *client, u32 width,
+		enum v4l2_mbus_pixelcode code, struct ov9640_reg_alt *alts)
+{
+	const struct ov9640_reg	*ov9640_regs, *matrix_regs;
+	int			ov9640_regs_len, matrix_regs_len;
+	int			i, ret;
+	u8			val;
+
+	/* select register configuration for given resolution */
+	switch (width) {
+	case W_QQCIF:
+		ov9640_regs	= ov9640_regs_qqcif;
+		ov9640_regs_len	= ARRAY_SIZE(ov9640_regs_qqcif);
+		break;
+	case W_QQVGA:
+		ov9640_regs	= ov9640_regs_qqvga;
+		ov9640_regs_len	= ARRAY_SIZE(ov9640_regs_qqvga);
+		break;
+	case W_QCIF:
+		ov9640_regs	= ov9640_regs_qcif;
+		ov9640_regs_len	= ARRAY_SIZE(ov9640_regs_qcif);
+		break;
+	case W_QVGA:
+		ov9640_regs	= ov9640_regs_qvga;
+		ov9640_regs_len	= ARRAY_SIZE(ov9640_regs_qvga);
+		break;
+	case W_CIF:
+		ov9640_regs	= ov9640_regs_cif;
+		ov9640_regs_len	= ARRAY_SIZE(ov9640_regs_cif);
+		break;
+	case W_VGA:
+		ov9640_regs	= ov9640_regs_vga;
+		ov9640_regs_len	= ARRAY_SIZE(ov9640_regs_vga);
+		break;
+	case W_SXGA:
+		ov9640_regs	= ov9640_regs_sxga;
+		ov9640_regs_len	= ARRAY_SIZE(ov9640_regs_sxga);
+		break;
+	default:
+		dev_err(&client->dev, "Failed to select resolution!\n");
+		return -EINVAL;
+	}
+
+	/* select color matrix configuration for given color encoding */
+	if (code == V4L2_MBUS_FMT_YUYV8_2X8_BE) {
+		matrix_regs	= ov9640_regs_yuv;
+		matrix_regs_len	= ARRAY_SIZE(ov9640_regs_yuv);
+	} else {
+		matrix_regs	= ov9640_regs_rgb;
+		matrix_regs_len	= ARRAY_SIZE(ov9640_regs_rgb);
+	}
+
+	/* write register settings into the module */
+	for (i = 0; i < ov9640_regs_len; i++) {
+		val = ov9640_regs[i].val;
+
+		switch (ov9640_regs[i].reg) {
+		case OV9640_COM7:
+			val |= alts->com7;
+			break;
+		case OV9640_COM12:
+			val |= alts->com12;
+			break;
+		case OV9640_COM13:
+			val |= alts->com13;
+			break;
+		case OV9640_COM15:
+			val |= alts->com15;
+			break;
+		}
+
+		ret = ov9640_reg_write(client, ov9640_regs[i].reg, val);
+		if (ret)
+			return ret;
+	}
+
+	/* write color matrix configuration into the module */
+	for (i = 0; i < matrix_regs_len; i++) {
+		ret = ov9640_reg_write(client, matrix_regs[i].reg,
+						matrix_regs[i].val);
+		if (ret)
+			return ret;
+	}
+
+	return 0;
+}
+
+/* program default register values */
+static int ov9640_prog_dflt(struct i2c_client *client)
+{
+	int i, ret;
+
+	for (i = 0; i < ARRAY_SIZE(ov9640_regs_dflt); i++) {
+		ret = ov9640_reg_write(client, ov9640_regs_dflt[i].reg,
+						ov9640_regs_dflt[i].val);
+		if (ret)
+			return ret;
+	}
+
+	/* wait for the changes to actually happen, 140ms are not enough yet */
+	mdelay(150);
+
+	return 0;
+}
+
+/* set the format we will capture in */
+static int ov9640_s_fmt(struct v4l2_subdev *sd,
+			struct v4l2_mbus_framefmt *mf)
+{
+	struct i2c_client *client = sd->priv;
+	struct ov9640_reg_alt alts = {0};
+	enum v4l2_colorspace cspace;
+	enum v4l2_mbus_pixelcode code = mf->code;
+	int ret;
+
+	ov9640_res_roundup(&mf->width, &mf->height);
+	ov9640_alter_regs(mf->code, &alts);
+
+	ov9640_reset(client);
+
+	ret = ov9640_prog_dflt(client);
+	if (ret)
+		return ret;
+
+	switch (code) {
+	case V4L2_MBUS_FMT_RGB555_2X8_PADHI_LE:
+	case V4L2_MBUS_FMT_RGB565_2X8_LE:
+		cspace = V4L2_COLORSPACE_SRGB;
+		break;
+	default:
+		code = V4L2_MBUS_FMT_YUYV8_2X8_BE;
+	case V4L2_MBUS_FMT_YUYV8_2X8_BE:
+		cspace = V4L2_COLORSPACE_JPEG;
+	}
+
+	ret = ov9640_write_regs(client, mf->width, code, &alts);
+	if (!ret) {
+		mf->code	= code;
+		mf->colorspace	= cspace;
+	}
+
+	return ret;
+}
+
+static int ov9640_try_fmt(struct v4l2_subdev *sd,
+			  struct v4l2_mbus_framefmt *mf)
+{
+	ov9640_res_roundup(&mf->width, &mf->height);
+
+	mf->field = V4L2_FIELD_NONE;
+
+	switch (mf->code) {
+	case V4L2_MBUS_FMT_RGB555_2X8_PADHI_LE:
+	case V4L2_MBUS_FMT_RGB565_2X8_LE:
+		mf->colorspace = V4L2_COLORSPACE_SRGB;
+		break;
+	default:
+		mf->code = V4L2_MBUS_FMT_YUYV8_2X8_BE;
+	case V4L2_MBUS_FMT_YUYV8_2X8_BE:
+		mf->colorspace = V4L2_COLORSPACE_JPEG;
+	}
+
+	return 0;
+}
+
+static int ov9640_enum_fmt(struct v4l2_subdev *sd, int index,
+			   enum v4l2_mbus_pixelcode *code)
+{
+	if ((unsigned int)index >= ARRAY_SIZE(ov9640_codes))
+		return -EINVAL;
+
+	*code = ov9640_codes[index];
+	return 0;
+}
+
+static int ov9640_g_crop(struct v4l2_subdev *sd, struct v4l2_crop *a)
+{
+	a->c.left	= 0;
+	a->c.top	= 0;
+	a->c.width	= W_SXGA;
+	a->c.height	= H_SXGA;
+	a->type		= V4L2_BUF_TYPE_VIDEO_CAPTURE;
+
+	return 0;
+}
+
+static int ov9640_cropcap(struct v4l2_subdev *sd, struct v4l2_cropcap *a)
+{
+	a->bounds.left			= 0;
+	a->bounds.top			= 0;
+	a->bounds.width			= W_SXGA;
+	a->bounds.height		= H_SXGA;
+	a->defrect			= a->bounds;
+	a->type				= V4L2_BUF_TYPE_VIDEO_CAPTURE;
+	a->pixelaspect.numerator	= 1;
+	a->pixelaspect.denominator	= 1;
+
+	return 0;
+}
+
+
+
+static int ov9640_video_probe(struct soc_camera_device *icd,
+				struct i2c_client *client)
+{
+	struct ov9640_priv *priv = i2c_get_clientdata(client);
+	u8		pid, ver, midh, midl;
+	const char	*devname;
+	int		ret = 0;
+
+	/*
+	 * We must have a parent by now. And it cannot be a wrong one.
+	 * So this entire test is completely redundant.
+	 */
+	if (!icd->dev.parent ||
+	    to_soc_camera_host(icd->dev.parent)->nr != icd->iface) {
+		dev_err(&client->dev, "Parent missing or invalid!\n");
+		ret = -ENODEV;
+		goto err;
+	}
+
+	/*
+	 * check and show product ID and manufacturer ID
+	 */
+
+	ret = ov9640_reg_read(client, OV9640_PID, &pid);
+	if (ret)
+		goto err;
+
+	ret = ov9640_reg_read(client, OV9640_VER, &ver);
+	if (ret)
+		goto err;
+
+	ret = ov9640_reg_read(client, OV9640_MIDH, &midh);
+	if (ret)
+		goto err;
+
+	ret = ov9640_reg_read(client, OV9640_MIDL, &midl);
+	if (ret)
+		goto err;
+
+	switch (VERSION(pid, ver)) {
+	case OV9640_V2:
+		devname		= "ov9640";
+		priv->model	= V4L2_IDENT_OV9640;
+		priv->revision	= 2;
+	case OV9640_V3:
+		devname		= "ov9640";
+		priv->model	= V4L2_IDENT_OV9640;
+		priv->revision	= 3;
+		break;
+	default:
+		dev_err(&client->dev, "Product ID error %x:%x\n", pid, ver);
+		ret = -ENODEV;
+		goto err;
+	}
+
+	dev_info(&client->dev, "%s Product ID %0x:%0x Manufacturer ID %x:%x\n",
+		 devname, pid, ver, midh, midl);
+
+err:
+	return ret;
+}
+
+static struct soc_camera_ops ov9640_ops = {
+	.set_bus_param		= ov9640_set_bus_param,
+	.query_bus_param	= ov9640_query_bus_param,
+	.controls		= ov9640_controls,
+	.num_controls		= ARRAY_SIZE(ov9640_controls),
+};
+
+static struct v4l2_subdev_core_ops ov9640_core_ops = {
+	.g_ctrl			= ov9640_g_ctrl,
+	.s_ctrl			= ov9640_s_ctrl,
+	.g_chip_ident		= ov9640_g_chip_ident,
+#ifdef CONFIG_VIDEO_ADV_DEBUG
+	.g_register		= ov9640_get_register,
+	.s_register		= ov9640_set_register,
+#endif
+
+};
+
+static struct v4l2_subdev_video_ops ov9640_video_ops = {
+	.s_stream	= ov9640_s_stream,
+	.s_mbus_fmt	= ov9640_s_fmt,
+	.try_mbus_fmt	= ov9640_try_fmt,
+	.enum_mbus_fmt	= ov9640_enum_fmt,
+	.cropcap	= ov9640_cropcap,
+	.g_crop		= ov9640_g_crop,
+
+};
+
+static struct v4l2_subdev_ops ov9640_subdev_ops = {
+	.core	= &ov9640_core_ops,
+	.video	= &ov9640_video_ops,
+};
+
+/*
+ * i2c_driver function
+ */
+static int ov9640_probe(struct i2c_client *client,
+			const struct i2c_device_id *did)
+{
+	struct ov9640_priv *priv;
+	struct soc_camera_device *icd	= client->dev.platform_data;
+	struct soc_camera_link *icl;
+	int ret;
+
+	if (!icd) {
+		dev_err(&client->dev, "Missing soc-camera data!\n");
+		return -EINVAL;
+	}
+
+	icl = to_soc_camera_link(icd);
+	if (!icl) {
+		dev_err(&client->dev, "Missing platform_data for driver\n");
+		return -EINVAL;
+	}
+
+	priv = kzalloc(sizeof(struct ov9640_priv), GFP_KERNEL);
+	if (!priv) {
+		dev_err(&client->dev,
+			"Failed to allocate memory for private data!\n");
+		return -ENOMEM;
+	}
+
+	v4l2_i2c_subdev_init(&priv->subdev, client, &ov9640_subdev_ops);
+
+	icd->ops	= &ov9640_ops;
+
+	ret = ov9640_video_probe(icd, client);
+
+	if (ret) {
+		icd->ops = NULL;
+		i2c_set_clientdata(client, NULL);
+		kfree(priv);
+	}
+
+	return ret;
+}
+
+static int ov9640_remove(struct i2c_client *client)
+{
+	struct ov9640_priv *priv = i2c_get_clientdata(client);
+
+	i2c_set_clientdata(client, NULL);
+	kfree(priv);
+	return 0;
+}
+
+static const struct i2c_device_id ov9640_id[] = {
+	{ "ov9640", 0 },
+	{ }
+};
+MODULE_DEVICE_TABLE(i2c, ov9640_id);
+
+static struct i2c_driver ov9640_i2c_driver = {
+	.driver = {
+		.name = "ov9640",
+	},
+	.probe    = ov9640_probe,
+	.remove   = ov9640_remove,
+	.id_table = ov9640_id,
+};
+
+static int __init ov9640_module_init(void)
+{
+	return i2c_add_driver(&ov9640_i2c_driver);
+}
+
+static void __exit ov9640_module_exit(void)
+{
+	i2c_del_driver(&ov9640_i2c_driver);
+}
+
+module_init(ov9640_module_init);
+module_exit(ov9640_module_exit);
+
+MODULE_DESCRIPTION("SoC Camera driver for OmniVision OV96xx");
+MODULE_AUTHOR("Marek Vasut <marek.vasut@gmail.com>");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/media/video/ov9640.h b/drivers/media/video/ov9640.h
new file mode 100644
index 000000000000..f8a51b70792e
--- /dev/null
+++ b/drivers/media/video/ov9640.h
@@ -0,0 +1,209 @@
+/*
+ * OmniVision OV96xx Camera Header File
+ *
+ * Copyright (C) 2009 Marek Vasut <marek.vasut@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef	__DRIVERS_MEDIA_VIDEO_OV9640_H__
+#define	__DRIVERS_MEDIA_VIDEO_OV9640_H__
+
+/* Register definitions */
+#define	OV9640_GAIN	0x00
+#define	OV9640_BLUE	0x01
+#define	OV9640_RED	0x02
+#define	OV9640_VFER	0x03
+#define	OV9640_COM1	0x04
+#define	OV9640_BAVE	0x05
+#define	OV9640_GEAVE	0x06
+#define	OV9640_RSID	0x07
+#define	OV9640_RAVE	0x08
+#define	OV9640_COM2	0x09
+#define	OV9640_PID	0x0a
+#define	OV9640_VER	0x0b
+#define	OV9640_COM3	0x0c
+#define	OV9640_COM4	0x0d
+#define	OV9640_COM5	0x0e
+#define	OV9640_COM6	0x0f
+#define	OV9640_AECH	0x10
+#define	OV9640_CLKRC	0x11
+#define	OV9640_COM7	0x12
+#define	OV9640_COM8	0x13
+#define	OV9640_COM9	0x14
+#define	OV9640_COM10	0x15
+/* 0x16 - RESERVED */
+#define	OV9640_HSTART	0x17
+#define	OV9640_HSTOP	0x18
+#define	OV9640_VSTART	0x19
+#define	OV9640_VSTOP	0x1a
+#define	OV9640_PSHFT	0x1b
+#define	OV9640_MIDH	0x1c
+#define	OV9640_MIDL	0x1d
+#define	OV9640_MVFP	0x1e
+#define	OV9640_LAEC	0x1f
+#define	OV9640_BOS	0x20
+#define	OV9640_GBOS	0x21
+#define	OV9640_GROS	0x22
+#define	OV9640_ROS	0x23
+#define	OV9640_AEW	0x24
+#define	OV9640_AEB	0x25
+#define	OV9640_VPT	0x26
+#define	OV9640_BBIAS	0x27
+#define	OV9640_GBBIAS	0x28
+/* 0x29 - RESERVED */
+#define	OV9640_EXHCH	0x2a
+#define	OV9640_EXHCL	0x2b
+#define	OV9640_RBIAS	0x2c
+#define	OV9640_ADVFL	0x2d
+#define	OV9640_ADVFH	0x2e
+#define	OV9640_YAVE	0x2f
+#define	OV9640_HSYST	0x30
+#define	OV9640_HSYEN	0x31
+#define	OV9640_HREF	0x32
+#define	OV9640_CHLF	0x33
+#define	OV9640_ARBLM	0x34
+/* 0x35..0x36 - RESERVED */
+#define	OV9640_ADC	0x37
+#define	OV9640_ACOM	0x38
+#define	OV9640_OFON	0x39
+#define	OV9640_TSLB	0x3a
+#define	OV9640_COM11	0x3b
+#define	OV9640_COM12	0x3c
+#define	OV9640_COM13	0x3d
+#define	OV9640_COM14	0x3e
+#define	OV9640_EDGE	0x3f
+#define	OV9640_COM15	0x40
+#define	OV9640_COM16	0x41
+#define	OV9640_COM17	0x42
+/* 0x43..0x4e - RESERVED */
+#define	OV9640_MTX1	0x4f
+#define	OV9640_MTX2	0x50
+#define	OV9640_MTX3	0x51
+#define	OV9640_MTX4	0x52
+#define	OV9640_MTX5	0x53
+#define	OV9640_MTX6	0x54
+#define	OV9640_MTX7	0x55
+#define	OV9640_MTX8	0x56
+#define	OV9640_MTX9	0x57
+#define	OV9640_MTXS	0x58
+/* 0x59..0x61 - RESERVED */
+#define	OV9640_LCC1	0x62
+#define	OV9640_LCC2	0x63
+#define	OV9640_LCC3	0x64
+#define	OV9640_LCC4	0x65
+#define	OV9640_LCC5	0x66
+#define	OV9640_MANU	0x67
+#define	OV9640_MANV	0x68
+#define	OV9640_HV	0x69
+#define	OV9640_MBD	0x6a
+#define	OV9640_DBLV	0x6b
+#define	OV9640_GSP	0x6c	/* ... till 0x7b */
+#define	OV9640_GST	0x7c	/* ... till 0x8a */
+
+#define	OV9640_CLKRC_DPLL_EN	0x80
+#define	OV9640_CLKRC_DIRECT	0x40
+#define	OV9640_CLKRC_DIV(x)	((x) & 0x3f)
+
+#define	OV9640_PSHFT_VAL(x)	((x) & 0xff)
+
+#define	OV9640_ACOM_2X_ANALOG	0x80
+#define	OV9640_ACOM_RSVD	0x12
+
+#define	OV9640_MVFP_V		0x10
+#define	OV9640_MVFP_H		0x20
+
+#define	OV9640_COM1_HREF_NOSKIP	0x00
+#define	OV9640_COM1_HREF_2SKIP	0x04
+#define	OV9640_COM1_HREF_3SKIP	0x08
+#define	OV9640_COM1_QQFMT	0x20
+
+#define	OV9640_COM2_SSM		0x10
+
+#define	OV9640_COM3_VP		0x04
+
+#define	OV9640_COM4_QQ_VP	0x80
+#define	OV9640_COM4_RSVD	0x40
+
+#define	OV9640_COM5_SYSCLK	0x80
+#define	OV9640_COM5_LONGEXP	0x01
+
+#define	OV9640_COM6_OPT_BLC	0x40
+#define	OV9640_COM6_ADBLC_BIAS	0x08
+#define	OV9640_COM6_FMT_RST	0x82
+#define	OV9640_COM6_ADBLC_OPTEN	0x01
+
+#define	OV9640_COM7_RAW_RGB	0x01
+#define	OV9640_COM7_RGB		0x04
+#define	OV9640_COM7_QCIF	0x08
+#define	OV9640_COM7_QVGA	0x10
+#define	OV9640_COM7_CIF		0x20
+#define	OV9640_COM7_VGA		0x40
+#define	OV9640_COM7_SCCB_RESET	0x80
+
+#define	OV9640_TSLB_YVYU_YUYV	0x04
+#define	OV9640_TSLB_YUYV_UYVY	0x08
+
+#define	OV9640_COM12_YUV_AVG	0x04
+#define	OV9640_COM12_RSVD	0x40
+
+#define	OV9640_COM13_GAMMA_NONE	0x00
+#define	OV9640_COM13_GAMMA_Y	0x40
+#define	OV9640_COM13_GAMMA_RAW	0x80
+#define	OV9640_COM13_RGB_AVG	0x20
+#define	OV9640_COM13_MATRIX_EN	0x10
+#define	OV9640_COM13_Y_DELAY_EN	0x08
+#define	OV9640_COM13_YUV_DLY(x)	((x) & 0x07)
+
+#define	OV9640_COM15_OR_00FF	0x00
+#define	OV9640_COM15_OR_01FE	0x40
+#define	OV9640_COM15_OR_10F0	0xc0
+#define	OV9640_COM15_RGB_NORM	0x00
+#define	OV9640_COM15_RGB_565	0x10
+#define	OV9640_COM15_RGB_555	0x30
+
+#define	OV9640_COM16_RB_AVG	0x01
+
+/* IDs */
+#define	OV9640_V2		0x9648
+#define	OV9640_V3		0x9649
+#define	VERSION(pid, ver)	(((pid) << 8) | ((ver) & 0xFF))
+
+/* supported resolutions */
+enum {
+	W_QQCIF	= 88,
+	W_QQVGA	= 160,
+	W_QCIF	= 176,
+	W_QVGA	= 320,
+	W_CIF	= 352,
+	W_VGA	= 640,
+	W_SXGA	= 1280
+};
+#define	H_SXGA	960
+
+/* Misc. structures */
+struct ov9640_reg_alt {
+	u8	com7;
+	u8	com12;
+	u8	com13;
+	u8	com15;
+};
+
+struct ov9640_reg {
+	u8	reg;
+	u8	val;
+};
+
+struct ov9640_priv {
+	struct v4l2_subdev		subdev;
+
+	int				model;
+	int				revision;
+
+	bool				flag_vflip;
+	bool				flag_hflip;
+};
+
+#endif	/* __DRIVERS_MEDIA_VIDEO_OV9640_H__ */
diff --git a/drivers/media/video/pms.c b/drivers/media/video/pms.c
index a1ad38fc49c1..11a2c26399b5 100644
--- a/drivers/media/video/pms.c
+++ b/drivers/media/video/pms.c
@@ -14,8 +14,10 @@
  *	unless the userspace driver also doesn't work for you...
  *
  *      Changes:
- *      08/07/2003        Daniele Bellucci <bellucda@tiscali.it>
- *                        - pms_capture: report back -EFAULT
+ *	25-11-2009 	Hans Verkuil <hverkuil@xs4all.nl>
+ * 			- converted to version 2 of the V4L API.
+ *      08/07/2003      Daniele Bellucci <bellucda@tiscali.it>
+ *                      - pms_capture: report back -EFAULT
  */
 
 #include <linux/module.h>
@@ -27,175 +29,183 @@
 #include <linux/mm.h>
 #include <linux/ioport.h>
 #include <linux/init.h>
+#include <linux/version.h>
+#include <linux/mutex.h>
+#include <linux/uaccess.h>
 #include <asm/io.h>
-#include <linux/videodev.h>
+
+#include <linux/videodev2.h>
 #include <media/v4l2-common.h>
 #include <media/v4l2-ioctl.h>
-#include <linux/mutex.h>
+#include <media/v4l2-device.h>
 
-#include <asm/uaccess.h>
+MODULE_LICENSE("GPL");
 
 
 #define MOTOROLA	1
-#define PHILIPS2	2
+#define PHILIPS2	2               /* SAA7191 */
 #define PHILIPS1	3
 #define MVVMEMORYWIDTH	0x40		/* 512 bytes */
 
-struct pms_device
-{
-	struct video_device v;
-	struct video_picture picture;
-	int height;
-	int width;
-	unsigned long in_use;
-	struct mutex lock;
-};
-
-struct i2c_info
-{
+struct i2c_info {
 	u8 slave;
 	u8 sub;
 	u8 data;
 	u8 hits;
 };
 
-static int i2c_count;
-static struct i2c_info i2cinfo[64];
+struct pms {
+	struct v4l2_device v4l2_dev;
+	struct video_device vdev;
+	int height;
+	int width;
+	int depth;
+	int input;
+	s32 brightness, saturation, hue, contrast;
+	unsigned long in_use;
+	struct mutex lock;
+	int i2c_count;
+	struct i2c_info i2cinfo[64];
+
+	int decoder;
+	int standard;	/* 0 - auto 1 - ntsc 2 - pal 3 - secam */
+	v4l2_std_id std;
+	int io;
+	int data;
+	void __iomem *mem;
+};
 
-static int decoder 		= PHILIPS2;
-static int standard;	/* 0 - auto 1 - ntsc 2 - pal 3 - secam */
+static struct pms pms_card;
 
 /*
  *	I/O ports and Shared Memory
  */
 
-static int io_port		=	0x250;
-static int data_port		=	0x251;
-static int mem_base		=	0xC8000;
-static void __iomem *mem;
-static int video_nr             =       -1;
+static int io_port = 0x250;
+module_param(io_port, int, 0);
 
+static int mem_base = 0xc8000;
+module_param(mem_base, int, 0);
 
+static int video_nr = -1;
+module_param(video_nr, int, 0);
 
-static inline void mvv_write(u8 index, u8 value)
+
+static inline void mvv_write(struct pms *dev, u8 index, u8 value)
 {
-	outw(index|(value<<8), io_port);
+	outw(index | (value << 8), dev->io);
 }
 
-static inline u8 mvv_read(u8 index)
+static inline u8 mvv_read(struct pms *dev, u8 index)
 {
-	outb(index, io_port);
-	return inb(data_port);
+	outb(index, dev->io);
+	return inb(dev->data);
 }
 
-static int pms_i2c_stat(u8 slave)
+static int pms_i2c_stat(struct pms *dev, u8 slave)
 {
-	int counter;
+	int counter = 0;
 	int i;
 
-	outb(0x28, io_port);
+	outb(0x28, dev->io);
 
-	counter=0;
-	while((inb(data_port)&0x01)==0)
-		if(counter++==256)
+	while ((inb(dev->data) & 0x01) == 0)
+		if (counter++ == 256)
 			break;
 
-	while((inb(data_port)&0x01)!=0)
-		if(counter++==256)
+	while ((inb(dev->data) & 0x01) != 0)
+		if (counter++ == 256)
 			break;
 
-	outb(slave, io_port);
+	outb(slave, dev->io);
 
-	counter=0;
-	while((inb(data_port)&0x01)==0)
-		if(counter++==256)
+	counter = 0;
+	while ((inb(dev->data) & 0x01) == 0)
+		if (counter++ == 256)
 			break;
 
-	while((inb(data_port)&0x01)!=0)
-		if(counter++==256)
+	while ((inb(dev->data) & 0x01) != 0)
+		if (counter++ == 256)
 			break;
 
-	for(i=0;i<12;i++)
-	{
-		char st=inb(data_port);
-		if((st&2)!=0)
+	for (i = 0; i < 12; i++) {
+		char st = inb(dev->data);
+
+		if ((st & 2) != 0)
 			return -1;
-		if((st&1)==0)
+		if ((st & 1) == 0)
 			break;
 	}
-	outb(0x29, io_port);
-	return inb(data_port);
+	outb(0x29, dev->io);
+	return inb(dev->data);
 }
 
-static int pms_i2c_write(u16 slave, u16 sub, u16 data)
+static int pms_i2c_write(struct pms *dev, u16 slave, u16 sub, u16 data)
 {
-	int skip=0;
+	int skip = 0;
 	int count;
 	int i;
 
-	for(i=0;i<i2c_count;i++)
-	{
-		if((i2cinfo[i].slave==slave) &&
-		   (i2cinfo[i].sub == sub))
-		{
-			if(i2cinfo[i].data==data)
-				skip=1;
-			i2cinfo[i].data=data;
-			i=i2c_count+1;
+	for (i = 0; i < dev->i2c_count; i++) {
+		if ((dev->i2cinfo[i].slave == slave) &&
+		    (dev->i2cinfo[i].sub == sub)) {
+			if (dev->i2cinfo[i].data == data)
+				skip = 1;
+			dev->i2cinfo[i].data = data;
+			i = dev->i2c_count + 1;
 		}
 	}
 
-	if(i==i2c_count && i2c_count<64)
-	{
-		i2cinfo[i2c_count].slave=slave;
-		i2cinfo[i2c_count].sub=sub;
-		i2cinfo[i2c_count].data=data;
-		i2c_count++;
+	if (i == dev->i2c_count && dev->i2c_count < 64) {
+		dev->i2cinfo[dev->i2c_count].slave = slave;
+		dev->i2cinfo[dev->i2c_count].sub = sub;
+		dev->i2cinfo[dev->i2c_count].data = data;
+		dev->i2c_count++;
 	}
 
-	if(skip)
+	if (skip)
 		return 0;
 
-	mvv_write(0x29, sub);
-	mvv_write(0x2A, data);
-	mvv_write(0x28, slave);
+	mvv_write(dev, 0x29, sub);
+	mvv_write(dev, 0x2A, data);
+	mvv_write(dev, 0x28, slave);
 
-	outb(0x28, io_port);
+	outb(0x28, dev->io);
 
-	count=0;
-	while((inb(data_port)&1)==0)
-		if(count>255)
+	count = 0;
+	while ((inb(dev->data) & 1) == 0)
+		if (count > 255)
 			break;
-	while((inb(data_port)&1)!=0)
-		if(count>255)
+	while ((inb(dev->data) & 1) != 0)
+		if (count > 255)
 			break;
 
-	count=inb(data_port);
+	count = inb(dev->data);
 
-	if(count&2)
+	if (count & 2)
 		return -1;
 	return count;
 }
 
-static int pms_i2c_read(int slave, int sub)
+static int pms_i2c_read(struct pms *dev, int slave, int sub)
 {
-	int i=0;
-	for(i=0;i<i2c_count;i++)
-	{
-		if(i2cinfo[i].slave==slave && i2cinfo[i].sub==sub)
-			return i2cinfo[i].data;
+	int i;
+
+	for (i = 0; i < dev->i2c_count; i++) {
+		if (dev->i2cinfo[i].slave == slave && dev->i2cinfo[i].sub == sub)
+			return dev->i2cinfo[i].data;
 	}
 	return 0;
 }
 
 
-static void pms_i2c_andor(int slave, int sub, int and, int or)
+static void pms_i2c_andor(struct pms *dev, int slave, int sub, int and, int or)
 {
 	u8 tmp;
 
-	tmp=pms_i2c_read(slave, sub);
-	tmp = (tmp&and)|or;
-	pms_i2c_write(slave, sub, tmp);
+	tmp = pms_i2c_read(dev, slave, sub);
+	tmp = (tmp & and) | or;
+	pms_i2c_write(dev, slave, sub, tmp);
 }
 
 /*
@@ -203,100 +213,108 @@ static void pms_i2c_andor(int slave, int sub, int and, int or)
  */
 
 
-static void pms_videosource(short source)
+static void pms_videosource(struct pms *dev, short source)
 {
-	mvv_write(0x2E, source?0x31:0x30);
+	switch (dev->decoder) {
+	case MOTOROLA:
+		break;
+	case PHILIPS2:
+		pms_i2c_andor(dev, 0x8a, 0x06, 0x7f, source ? 0x80 : 0);
+		break;
+	case PHILIPS1:
+		break;
+	}
+	mvv_write(dev, 0x2E, 0x31);
+	/* Was: mvv_write(dev, 0x2E, source ? 0x31 : 0x30);
+	   But could not make this work correctly. Only Composite input
+	   worked for me. */
 }
 
-static void pms_hue(short hue)
+static void pms_hue(struct pms *dev, short hue)
 {
-	switch(decoder)
-	{
-		case MOTOROLA:
-			pms_i2c_write(0x8A, 0x00, hue);
-			break;
-		case PHILIPS2:
-			pms_i2c_write(0x8A, 0x07, hue);
-			break;
-		case PHILIPS1:
-			pms_i2c_write(0x42, 0x07, hue);
-			break;
+	switch (dev->decoder) {
+	case MOTOROLA:
+		pms_i2c_write(dev, 0x8a, 0x00, hue);
+		break;
+	case PHILIPS2:
+		pms_i2c_write(dev, 0x8a, 0x07, hue);
+		break;
+	case PHILIPS1:
+		pms_i2c_write(dev, 0x42, 0x07, hue);
+		break;
 	}
 }
 
-static void pms_colour(short colour)
+static void pms_saturation(struct pms *dev, short sat)
 {
-	switch(decoder)
-	{
-		case MOTOROLA:
-			pms_i2c_write(0x8A, 0x00, colour);
-			break;
-		case PHILIPS1:
-			pms_i2c_write(0x42, 0x12, colour);
-			break;
+	switch (dev->decoder) {
+	case MOTOROLA:
+		pms_i2c_write(dev, 0x8a, 0x00, sat);
+		break;
+	case PHILIPS1:
+		pms_i2c_write(dev, 0x42, 0x12, sat);
+		break;
 	}
 }
 
 
-static void pms_contrast(short contrast)
+static void pms_contrast(struct pms *dev, short contrast)
 {
-	switch(decoder)
-	{
-		case MOTOROLA:
-			pms_i2c_write(0x8A, 0x00, contrast);
-			break;
-		case PHILIPS1:
-			pms_i2c_write(0x42, 0x13, contrast);
-			break;
+	switch (dev->decoder) {
+	case MOTOROLA:
+		pms_i2c_write(dev, 0x8a, 0x00, contrast);
+		break;
+	case PHILIPS1:
+		pms_i2c_write(dev, 0x42, 0x13, contrast);
+		break;
 	}
 }
 
-static void pms_brightness(short brightness)
+static void pms_brightness(struct pms *dev, short brightness)
 {
-	switch(decoder)
-	{
-		case MOTOROLA:
-			pms_i2c_write(0x8A, 0x00, brightness);
-			pms_i2c_write(0x8A, 0x00, brightness);
-			pms_i2c_write(0x8A, 0x00, brightness);
-			break;
-		case PHILIPS1:
-			pms_i2c_write(0x42, 0x19, brightness);
-			break;
+	switch (dev->decoder) {
+	case MOTOROLA:
+		pms_i2c_write(dev, 0x8a, 0x00, brightness);
+		pms_i2c_write(dev, 0x8a, 0x00, brightness);
+		pms_i2c_write(dev, 0x8a, 0x00, brightness);
+		break;
+	case PHILIPS1:
+		pms_i2c_write(dev, 0x42, 0x19, brightness);
+		break;
 	}
 }
 
 
-static void pms_format(short format)
+static void pms_format(struct pms *dev, short format)
 {
 	int target;
-	standard = format;
 
-	if(decoder==PHILIPS1)
-		target=0x42;
-	else if(decoder==PHILIPS2)
-		target=0x8A;
+	dev->standard = format;
+
+	if (dev->decoder == PHILIPS1)
+		target = 0x42;
+	else if (dev->decoder == PHILIPS2)
+		target = 0x8a;
 	else
 		return;
 
-	switch(format)
-	{
-		case 0:	/* Auto */
-			pms_i2c_andor(target, 0x0D, 0xFE,0x00);
-			pms_i2c_andor(target, 0x0F, 0x3F,0x80);
-			break;
-		case 1: /* NTSC */
-			pms_i2c_andor(target, 0x0D, 0xFE, 0x00);
-			pms_i2c_andor(target, 0x0F, 0x3F, 0x40);
-			break;
-		case 2: /* PAL */
-			pms_i2c_andor(target, 0x0D, 0xFE, 0x00);
-			pms_i2c_andor(target, 0x0F, 0x3F, 0x00);
-			break;
-		case 3:	/* SECAM */
-			pms_i2c_andor(target, 0x0D, 0xFE, 0x01);
-			pms_i2c_andor(target, 0x0F, 0x3F, 0x00);
-			break;
+	switch (format) {
+	case 0:	/* Auto */
+		pms_i2c_andor(dev, target, 0x0d, 0xfe, 0x00);
+		pms_i2c_andor(dev, target, 0x0f, 0x3f, 0x80);
+		break;
+	case 1: /* NTSC */
+		pms_i2c_andor(dev, target, 0x0d, 0xfe, 0x00);
+		pms_i2c_andor(dev, target, 0x0f, 0x3f, 0x40);
+		break;
+	case 2: /* PAL */
+		pms_i2c_andor(dev, target, 0x0d, 0xfe, 0x00);
+		pms_i2c_andor(dev, target, 0x0f, 0x3f, 0x00);
+		break;
+	case 3:	/* SECAM */
+		pms_i2c_andor(dev, target, 0x0d, 0xfe, 0x01);
+		pms_i2c_andor(dev, target, 0x0f, 0x3f, 0x00);
+		break;
 	}
 }
 
@@ -308,18 +326,17 @@ static void pms_format(short format)
  *	people need it. We also don't yet use the PMS interrupt.
  */
 
-static void pms_hstart(short start)
+static void pms_hstart(struct pms *dev, short start)
 {
-	switch(decoder)
-	{
-		case PHILIPS1:
-			pms_i2c_write(0x8A, 0x05, start);
-			pms_i2c_write(0x8A, 0x18, start);
-			break;
-		case PHILIPS2:
-			pms_i2c_write(0x42, 0x05, start);
-			pms_i2c_write(0x42, 0x18, start);
-			break;
+	switch (dev->decoder) {
+	case PHILIPS1:
+		pms_i2c_write(dev, 0x8a, 0x05, start);
+		pms_i2c_write(dev, 0x8a, 0x18, start);
+		break;
+	case PHILIPS2:
+		pms_i2c_write(dev, 0x42, 0x05, start);
+		pms_i2c_write(dev, 0x42, 0x18, start);
+		break;
 	}
 }
 
@@ -327,293 +344,271 @@ static void pms_hstart(short start)
  *	Bandpass filters
  */
 
-static void pms_bandpass(short pass)
+static void pms_bandpass(struct pms *dev, short pass)
 {
-	if(decoder==PHILIPS2)
-		pms_i2c_andor(0x8A, 0x06, 0xCF, (pass&0x03)<<4);
-	else if(decoder==PHILIPS1)
-		pms_i2c_andor(0x42, 0x06, 0xCF, (pass&0x03)<<4);
+	if (dev->decoder == PHILIPS2)
+		pms_i2c_andor(dev, 0x8a, 0x06, 0xcf, (pass & 0x03) << 4);
+	else if (dev->decoder == PHILIPS1)
+		pms_i2c_andor(dev, 0x42, 0x06, 0xcf, (pass & 0x03) << 4);
 }
 
-static void pms_antisnow(short snow)
+static void pms_antisnow(struct pms *dev, short snow)
 {
-	if(decoder==PHILIPS2)
-		pms_i2c_andor(0x8A, 0x06, 0xF3, (snow&0x03)<<2);
-	else if(decoder==PHILIPS1)
-		pms_i2c_andor(0x42, 0x06, 0xF3, (snow&0x03)<<2);
+	if (dev->decoder == PHILIPS2)
+		pms_i2c_andor(dev, 0x8a, 0x06, 0xf3, (snow & 0x03) << 2);
+	else if (dev->decoder == PHILIPS1)
+		pms_i2c_andor(dev, 0x42, 0x06, 0xf3, (snow & 0x03) << 2);
 }
 
-static void pms_sharpness(short sharp)
+static void pms_sharpness(struct pms *dev, short sharp)
 {
-	if(decoder==PHILIPS2)
-		pms_i2c_andor(0x8A, 0x06, 0xFC, sharp&0x03);
-	else if(decoder==PHILIPS1)
-		pms_i2c_andor(0x42, 0x06, 0xFC, sharp&0x03);
+	if (dev->decoder == PHILIPS2)
+		pms_i2c_andor(dev, 0x8a, 0x06, 0xfc, sharp & 0x03);
+	else if (dev->decoder == PHILIPS1)
+		pms_i2c_andor(dev, 0x42, 0x06, 0xfc, sharp & 0x03);
 }
 
-static void pms_chromaagc(short agc)
+static void pms_chromaagc(struct pms *dev, short agc)
 {
-	if(decoder==PHILIPS2)
-		pms_i2c_andor(0x8A, 0x0C, 0x9F, (agc&0x03)<<5);
-	else if(decoder==PHILIPS1)
-		pms_i2c_andor(0x42, 0x0C, 0x9F, (agc&0x03)<<5);
+	if (dev->decoder == PHILIPS2)
+		pms_i2c_andor(dev, 0x8a, 0x0c, 0x9f, (agc & 0x03) << 5);
+	else if (dev->decoder == PHILIPS1)
+		pms_i2c_andor(dev, 0x42, 0x0c, 0x9f, (agc & 0x03) << 5);
 }
 
-static void pms_vertnoise(short noise)
+static void pms_vertnoise(struct pms *dev, short noise)
 {
-	if(decoder==PHILIPS2)
-		pms_i2c_andor(0x8A, 0x10, 0xFC, noise&3);
-	else if(decoder==PHILIPS1)
-		pms_i2c_andor(0x42, 0x10, 0xFC, noise&3);
+	if (dev->decoder == PHILIPS2)
+		pms_i2c_andor(dev, 0x8a, 0x10, 0xfc, noise & 3);
+	else if (dev->decoder == PHILIPS1)
+		pms_i2c_andor(dev, 0x42, 0x10, 0xfc, noise & 3);
 }
 
-static void pms_forcecolour(short colour)
+static void pms_forcecolour(struct pms *dev, short colour)
 {
-	if(decoder==PHILIPS2)
-		pms_i2c_andor(0x8A, 0x0C, 0x7F, (colour&1)<<7);
-	else if(decoder==PHILIPS1)
-		pms_i2c_andor(0x42, 0x0C, 0x7, (colour&1)<<7);
+	if (dev->decoder == PHILIPS2)
+		pms_i2c_andor(dev, 0x8a, 0x0c, 0x7f, (colour & 1) << 7);
+	else if (dev->decoder == PHILIPS1)
+		pms_i2c_andor(dev, 0x42, 0x0c, 0x7, (colour & 1) << 7);
 }
 
-static void pms_antigamma(short gamma)
+static void pms_antigamma(struct pms *dev, short gamma)
 {
-	if(decoder==PHILIPS2)
-		pms_i2c_andor(0xB8, 0x00, 0x7F, (gamma&1)<<7);
-	else if(decoder==PHILIPS1)
-		pms_i2c_andor(0x42, 0x20, 0x7, (gamma&1)<<7);
+	if (dev->decoder == PHILIPS2)
+		pms_i2c_andor(dev, 0xb8, 0x00, 0x7f, (gamma & 1) << 7);
+	else if (dev->decoder == PHILIPS1)
+		pms_i2c_andor(dev, 0x42, 0x20, 0x7, (gamma & 1) << 7);
 }
 
-static void pms_prefilter(short filter)
+static void pms_prefilter(struct pms *dev, short filter)
 {
-	if(decoder==PHILIPS2)
-		pms_i2c_andor(0x8A, 0x06, 0xBF, (filter&1)<<6);
-	else if(decoder==PHILIPS1)
-		pms_i2c_andor(0x42, 0x06, 0xBF, (filter&1)<<6);
+	if (dev->decoder == PHILIPS2)
+		pms_i2c_andor(dev, 0x8a, 0x06, 0xbf, (filter & 1) << 6);
+	else if (dev->decoder == PHILIPS1)
+		pms_i2c_andor(dev, 0x42, 0x06, 0xbf, (filter & 1) << 6);
 }
 
-static void pms_hfilter(short filter)
+static void pms_hfilter(struct pms *dev, short filter)
 {
-	if(decoder==PHILIPS2)
-		pms_i2c_andor(0xB8, 0x04, 0x1F, (filter&7)<<5);
-	else if(decoder==PHILIPS1)
-		pms_i2c_andor(0x42, 0x24, 0x1F, (filter&7)<<5);
+	if (dev->decoder == PHILIPS2)
+		pms_i2c_andor(dev, 0xb8, 0x04, 0x1f, (filter & 7) << 5);
+	else if (dev->decoder == PHILIPS1)
+		pms_i2c_andor(dev, 0x42, 0x24, 0x1f, (filter & 7) << 5);
 }
 
-static void pms_vfilter(short filter)
+static void pms_vfilter(struct pms *dev, short filter)
 {
-	if(decoder==PHILIPS2)
-		pms_i2c_andor(0xB8, 0x08, 0x9F, (filter&3)<<5);
-	else if(decoder==PHILIPS1)
-		pms_i2c_andor(0x42, 0x28, 0x9F, (filter&3)<<5);
+	if (dev->decoder == PHILIPS2)
+		pms_i2c_andor(dev, 0xb8, 0x08, 0x9f, (filter & 3) << 5);
+	else if (dev->decoder == PHILIPS1)
+		pms_i2c_andor(dev, 0x42, 0x28, 0x9f, (filter & 3) << 5);
 }
 
-static void pms_killcolour(short colour)
+static void pms_killcolour(struct pms *dev, short colour)
 {
-	if(decoder==PHILIPS2)
-	{
-		pms_i2c_andor(0x8A, 0x08, 0x07, (colour&0x1F)<<3);
-		pms_i2c_andor(0x8A, 0x09, 0x07, (colour&0x1F)<<3);
-	}
-	else if(decoder==PHILIPS1)
-	{
-		pms_i2c_andor(0x42, 0x08, 0x07, (colour&0x1F)<<3);
-		pms_i2c_andor(0x42, 0x09, 0x07, (colour&0x1F)<<3);
+	if (dev->decoder == PHILIPS2) {
+		pms_i2c_andor(dev, 0x8a, 0x08, 0x07, (colour & 0x1f) << 3);
+		pms_i2c_andor(dev, 0x8a, 0x09, 0x07, (colour & 0x1f) << 3);
+	} else if (dev->decoder == PHILIPS1) {
+		pms_i2c_andor(dev, 0x42, 0x08, 0x07, (colour & 0x1f) << 3);
+		pms_i2c_andor(dev, 0x42, 0x09, 0x07, (colour & 0x1f) << 3);
 	}
 }
 
-static void pms_chromagain(short chroma)
+static void pms_chromagain(struct pms *dev, short chroma)
 {
-	if(decoder==PHILIPS2)
-	{
-		pms_i2c_write(0x8A, 0x11, chroma);
-	}
-	else if(decoder==PHILIPS1)
-	{
-		pms_i2c_write(0x42, 0x11, chroma);
-	}
+	if (dev->decoder == PHILIPS2)
+		pms_i2c_write(dev, 0x8a, 0x11, chroma);
+	else if (dev->decoder == PHILIPS1)
+		pms_i2c_write(dev, 0x42, 0x11, chroma);
 }
 
 
-static void pms_spacialcompl(short data)
+static void pms_spacialcompl(struct pms *dev, short data)
 {
-	mvv_write(0x3B, data);
+	mvv_write(dev, 0x3b, data);
 }
 
-static void pms_spacialcomph(short data)
+static void pms_spacialcomph(struct pms *dev, short data)
 {
-	mvv_write(0x3A, data);
+	mvv_write(dev, 0x3a, data);
 }
 
-static void pms_vstart(short start)
+static void pms_vstart(struct pms *dev, short start)
 {
-	mvv_write(0x16, start);
-	mvv_write(0x17, (start>>8)&0x01);
+	mvv_write(dev, 0x16, start);
+	mvv_write(dev, 0x17, (start >> 8) & 0x01);
 }
 
 #endif
 
-static void pms_secamcross(short cross)
+static void pms_secamcross(struct pms *dev, short cross)
 {
-	if(decoder==PHILIPS2)
-		pms_i2c_andor(0x8A, 0x0F, 0xDF, (cross&1)<<5);
-	else if(decoder==PHILIPS1)
-		pms_i2c_andor(0x42, 0x0F, 0xDF, (cross&1)<<5);
+	if (dev->decoder == PHILIPS2)
+		pms_i2c_andor(dev, 0x8a, 0x0f, 0xdf, (cross & 1) << 5);
+	else if (dev->decoder == PHILIPS1)
+		pms_i2c_andor(dev, 0x42, 0x0f, 0xdf, (cross & 1) << 5);
 }
 
 
-static void pms_swsense(short sense)
+static void pms_swsense(struct pms *dev, short sense)
 {
-	if(decoder==PHILIPS2)
-	{
-		pms_i2c_write(0x8A, 0x0A, sense);
-		pms_i2c_write(0x8A, 0x0B, sense);
-	}
-	else if(decoder==PHILIPS1)
-	{
-		pms_i2c_write(0x42, 0x0A, sense);
-		pms_i2c_write(0x42, 0x0B, sense);
+	if (dev->decoder == PHILIPS2) {
+		pms_i2c_write(dev, 0x8a, 0x0a, sense);
+		pms_i2c_write(dev, 0x8a, 0x0b, sense);
+	} else if (dev->decoder == PHILIPS1) {
+		pms_i2c_write(dev, 0x42, 0x0a, sense);
+		pms_i2c_write(dev, 0x42, 0x0b, sense);
 	}
 }
 
 
-static void pms_framerate(short frr)
+static void pms_framerate(struct pms *dev, short frr)
 {
-	int fps=(standard==1)?30:25;
-	if(frr==0)
+	int fps = (dev->std & V4L2_STD_525_60) ? 30 : 25;
+
+	if (frr == 0)
 		return;
-	fps=fps/frr;
-	mvv_write(0x14,0x80|fps);
-	mvv_write(0x15,1);
+	fps = fps/frr;
+	mvv_write(dev, 0x14, 0x80 | fps);
+	mvv_write(dev, 0x15, 1);
 }
 
-static void pms_vert(u8 deciden, u8 decinum)
+static void pms_vert(struct pms *dev, u8 deciden, u8 decinum)
 {
-	mvv_write(0x1C, deciden);	/* Denominator */
-	mvv_write(0x1D, decinum);	/* Numerator */
+	mvv_write(dev, 0x1c, deciden);	/* Denominator */
+	mvv_write(dev, 0x1d, decinum);	/* Numerator */
 }
 
 /*
  *	Turn 16bit ratios into best small ratio the chipset can grok
  */
 
-static void pms_vertdeci(unsigned short decinum, unsigned short deciden)
+static void pms_vertdeci(struct pms *dev, unsigned short decinum, unsigned short deciden)
 {
-	/* Knock it down by /5 once */
-	if(decinum%5==0)
-	{
-		deciden/=5;
-		decinum/=5;
+	/* Knock it down by / 5 once */
+	if (decinum % 5 == 0) {
+		deciden /= 5;
+		decinum /= 5;
 	}
 	/*
 	 *	3's
 	 */
-	while(decinum%3==0 && deciden%3==0)
-	{
-		deciden/=3;
-		decinum/=3;
+	while (decinum % 3 == 0 && deciden % 3 == 0) {
+		deciden /= 3;
+		decinum /= 3;
 	}
 	/*
 	 *	2's
 	 */
-	while(decinum%2==0 && deciden%2==0)
-	{
-		decinum/=2;
-		deciden/=2;
+	while (decinum % 2 == 0 && deciden % 2 == 0) {
+		decinum /= 2;
+		deciden /= 2;
 	}
 	/*
 	 *	Fudgyify
 	 */
-	while(deciden>32)
-	{
-		deciden/=2;
-		decinum=(decinum+1)/2;
+	while (deciden > 32) {
+		deciden /= 2;
+		decinum = (decinum + 1) / 2;
 	}
-	if(deciden==32)
+	if (deciden == 32)
 		deciden--;
-	pms_vert(deciden,decinum);
+	pms_vert(dev, deciden, decinum);
 }
 
-static void pms_horzdeci(short decinum, short deciden)
+static void pms_horzdeci(struct pms *dev, short decinum, short deciden)
 {
-	if(decinum<=512)
-	{
-		if(decinum%5==0)
-		{
-			decinum/=5;
-			deciden/=5;
+	if (decinum <= 512) {
+		if (decinum % 5 == 0) {
+			decinum /= 5;
+			deciden /= 5;
 		}
-	}
-	else
-	{
-		decinum=512;
-		deciden=640;	/* 768 would be ideal */
+	} else {
+		decinum = 512;
+		deciden = 640;	/* 768 would be ideal */
 	}
 
-	while(((decinum|deciden)&1)==0)
-	{
-		decinum>>=1;
-		deciden>>=1;
+	while (((decinum | deciden) & 1) == 0) {
+		decinum >>= 1;
+		deciden >>= 1;
 	}
-	while(deciden>32)
-	{
-		deciden>>=1;
-		decinum=(decinum+1)>>1;
+	while (deciden > 32) {
+		deciden >>= 1;
+		decinum = (decinum + 1) >> 1;
 	}
-	if(deciden==32)
+	if (deciden == 32)
 		deciden--;
 
-	mvv_write(0x24, 0x80|deciden);
-	mvv_write(0x25, decinum);
+	mvv_write(dev, 0x24, 0x80 | deciden);
+	mvv_write(dev, 0x25, decinum);
 }
 
-static void pms_resolution(short width, short height)
+static void pms_resolution(struct pms *dev, short width, short height)
 {
 	int fg_height;
 
-	fg_height=height;
-	if(fg_height>280)
-		fg_height=280;
+	fg_height = height;
+	if (fg_height > 280)
+		fg_height = 280;
 
-	mvv_write(0x18, fg_height);
-	mvv_write(0x19, fg_height>>8);
+	mvv_write(dev, 0x18, fg_height);
+	mvv_write(dev, 0x19, fg_height >> 8);
 
-	if(standard==1)
-	{
-		mvv_write(0x1A, 0xFC);
-		mvv_write(0x1B, 0x00);
-		if(height>fg_height)
-			pms_vertdeci(240,240);
+	if (dev->std & V4L2_STD_525_60) {
+		mvv_write(dev, 0x1a, 0xfc);
+		mvv_write(dev, 0x1b, 0x00);
+		if (height > fg_height)
+			pms_vertdeci(dev, 240, 240);
 		else
-			pms_vertdeci(fg_height,240);
-	}
-	else
-	{
-		mvv_write(0x1A, 0x1A);
-		mvv_write(0x1B, 0x01);
-		if(fg_height>256)
-			pms_vertdeci(270,270);
+			pms_vertdeci(dev, fg_height, 240);
+	} else {
+		mvv_write(dev, 0x1a, 0x1a);
+		mvv_write(dev, 0x1b, 0x01);
+		if (fg_height > 256)
+			pms_vertdeci(dev, 270, 270);
 		else
-			pms_vertdeci(fg_height, 270);
+			pms_vertdeci(dev, fg_height, 270);
 	}
-	mvv_write(0x12,0);
-	mvv_write(0x13, MVVMEMORYWIDTH);
-	mvv_write(0x42, 0x00);
-	mvv_write(0x43, 0x00);
-	mvv_write(0x44, MVVMEMORYWIDTH);
+	mvv_write(dev, 0x12, 0);
+	mvv_write(dev, 0x13, MVVMEMORYWIDTH);
+	mvv_write(dev, 0x42, 0x00);
+	mvv_write(dev, 0x43, 0x00);
+	mvv_write(dev, 0x44, MVVMEMORYWIDTH);
 
-	mvv_write(0x22, width+8);
-	mvv_write(0x23, (width+8)>> 8);
+	mvv_write(dev, 0x22, width + 8);
+	mvv_write(dev, 0x23, (width + 8) >> 8);
 
-	if(standard==1)
-		pms_horzdeci(width,640);
+	if (dev->std & V4L2_STD_525_60)
+		pms_horzdeci(dev, width, 640);
 	else
-		pms_horzdeci(width+8, 768);
+		pms_horzdeci(dev, width + 8, 768);
 
-	mvv_write(0x30, mvv_read(0x30)&0xFE);
-	mvv_write(0x08, mvv_read(0x08)|0x01);
-	mvv_write(0x01, mvv_read(0x01)&0xFD);
-	mvv_write(0x32, 0x00);
-	mvv_write(0x33, MVVMEMORYWIDTH);
+	mvv_write(dev, 0x30, mvv_read(dev, 0x30) & 0xfe);
+	mvv_write(dev, 0x08, mvv_read(dev, 0x08) | 0x01);
+	mvv_write(dev, 0x01, mvv_read(dev, 0x01) & 0xfd);
+	mvv_write(dev, 0x32, 0x00);
+	mvv_write(dev, 0x33, MVVMEMORYWIDTH);
 }
 
 
@@ -621,52 +616,49 @@ static void pms_resolution(short width, short height)
  *	Set Input
  */
 
-static void pms_vcrinput(short input)
+static void pms_vcrinput(struct pms *dev, short input)
 {
-	if(decoder==PHILIPS2)
-		pms_i2c_andor(0x8A,0x0D,0x7F,(input&1)<<7);
-	else if(decoder==PHILIPS1)
-		pms_i2c_andor(0x42,0x0D,0x7F,(input&1)<<7);
+	if (dev->decoder == PHILIPS2)
+		pms_i2c_andor(dev, 0x8a, 0x0d, 0x7f, (input & 1) << 7);
+	else if (dev->decoder == PHILIPS1)
+		pms_i2c_andor(dev, 0x42, 0x0d, 0x7f, (input & 1) << 7);
 }
 
 
-static int pms_capture(struct pms_device *dev, char __user *buf, int rgb555, int count)
+static int pms_capture(struct pms *dev, char __user *buf, int rgb555, int count)
 {
 	int y;
-	int dw = 2*dev->width;
-
-	char tmp[dw+32]; /* using a temp buffer is faster than direct  */
+	int dw = 2 * dev->width;
+	char tmp[dw + 32]; /* using a temp buffer is faster than direct  */
 	int cnt = 0;
-	int len=0;
+	int len = 0;
 	unsigned char r8 = 0x5;  /* value for reg8  */
 
 	if (rgb555)
 		r8 |= 0x20; /* else use untranslated rgb = 565 */
-	mvv_write(0x08,r8); /* capture rgb555/565, init DRAM, PC enable */
+	mvv_write(dev, 0x08, r8); /* capture rgb555/565, init DRAM, PC enable */
 
 /*	printf("%d %d %d %d %d %x %x\n",width,height,voff,nom,den,mvv_buf); */
 
-	for (y = 0; y < dev->height; y++ )
-	{
-		writeb(0, mem);  /* synchronisiert neue Zeile */
+	for (y = 0; y < dev->height; y++) {
+		writeb(0, dev->mem);  /* synchronisiert neue Zeile */
 
 		/*
 		 *	This is in truth a fifo, be very careful as if you
 		 *	forgot this odd things will occur 8)
 		 */
 
-		memcpy_fromio(tmp, mem, dw+32); /* discard 16 word   */
+		memcpy_fromio(tmp, dev->mem, dw + 32); /* discard 16 word   */
 		cnt -= dev->height;
-		while (cnt <= 0)
-		{
+		while (cnt <= 0) {
 			/*
 			 *	Don't copy too far
 			 */
-			int dt=dw;
-			if(dt+len>count)
-				dt=count-len;
+			int dt = dw;
+			if (dt + len > count)
+				dt = count - len;
 			cnt += dev->height;
-			if (copy_to_user(buf, tmp+32, dt))
+			if (copy_to_user(buf, tmp + 32, dt))
 				return len ? len : -EFAULT;
 			buf += dt;
 			len += dt;
@@ -680,221 +672,278 @@ static int pms_capture(struct pms_device *dev, char __user *buf, int rgb555, int
  *	Video4linux interfacing
  */
 
-static long pms_do_ioctl(struct file *file, unsigned int cmd, void *arg)
+static int pms_querycap(struct file *file, void  *priv,
+					struct v4l2_capability *vcap)
 {
-	struct video_device *dev = video_devdata(file);
-	struct pms_device *pd=(struct pms_device *)dev;
-
-	switch(cmd)
-	{
-		case VIDIOCGCAP:
-		{
-			struct video_capability *b = arg;
-			strcpy(b->name, "Mediavision PMS");
-			b->type = VID_TYPE_CAPTURE|VID_TYPE_SCALES;
-			b->channels = 4;
-			b->audios = 0;
-			b->maxwidth = 640;
-			b->maxheight = 480;
-			b->minwidth = 16;
-			b->minheight = 16;
-			return 0;
-		}
-		case VIDIOCGCHAN:
-		{
-			struct video_channel *v = arg;
-			if(v->channel<0 || v->channel>3)
-				return -EINVAL;
-			v->flags=0;
-			v->tuners=1;
-			/* Good question.. its composite or SVHS so.. */
-			v->type = VIDEO_TYPE_CAMERA;
-			switch(v->channel)
-			{
-				case 0:
-					strcpy(v->name, "Composite");break;
-				case 1:
-					strcpy(v->name, "SVideo");break;
-				case 2:
-					strcpy(v->name, "Composite(VCR)");break;
-				case 3:
-					strcpy(v->name, "SVideo(VCR)");break;
-			}
-			return 0;
-		}
-		case VIDIOCSCHAN:
-		{
-			struct video_channel *v = arg;
-			if(v->channel<0 || v->channel>3)
-				return -EINVAL;
-			mutex_lock(&pd->lock);
-			pms_videosource(v->channel&1);
-			pms_vcrinput(v->channel>>1);
-			mutex_unlock(&pd->lock);
-			return 0;
-		}
-		case VIDIOCGTUNER:
-		{
-			struct video_tuner *v = arg;
-			if(v->tuner)
-				return -EINVAL;
-			strcpy(v->name, "Format");
-			v->rangelow=0;
-			v->rangehigh=0;
-			v->flags= VIDEO_TUNER_PAL|VIDEO_TUNER_NTSC|VIDEO_TUNER_SECAM;
-			switch(standard)
-			{
-				case 0:
-					v->mode = VIDEO_MODE_AUTO;
-					break;
-				case 1:
-					v->mode = VIDEO_MODE_NTSC;
-					break;
-				case 2:
-					v->mode = VIDEO_MODE_PAL;
-					break;
-				case 3:
-					v->mode = VIDEO_MODE_SECAM;
-					break;
-			}
-			return 0;
-		}
-		case VIDIOCSTUNER:
-		{
-			struct video_tuner *v = arg;
-			if(v->tuner)
-				return -EINVAL;
-			mutex_lock(&pd->lock);
-			switch(v->mode)
-			{
-				case VIDEO_MODE_AUTO:
-					pms_framerate(25);
-					pms_secamcross(0);
-					pms_format(0);
-					break;
-				case VIDEO_MODE_NTSC:
-					pms_framerate(30);
-					pms_secamcross(0);
-					pms_format(1);
-					break;
-				case VIDEO_MODE_PAL:
-					pms_framerate(25);
-					pms_secamcross(0);
-					pms_format(2);
-					break;
-				case VIDEO_MODE_SECAM:
-					pms_framerate(25);
-					pms_secamcross(1);
-					pms_format(2);
-					break;
-				default:
-					mutex_unlock(&pd->lock);
-					return -EINVAL;
-			}
-			mutex_unlock(&pd->lock);
-			return 0;
-		}
-		case VIDIOCGPICT:
-		{
-			struct video_picture *p = arg;
-			*p = pd->picture;
-			return 0;
-		}
-		case VIDIOCSPICT:
-		{
-			struct video_picture *p = arg;
-			if(!((p->palette==VIDEO_PALETTE_RGB565 && p->depth==16)
-			    ||(p->palette==VIDEO_PALETTE_RGB555 && p->depth==15)))
-				return -EINVAL;
-			pd->picture= *p;
+	struct pms *dev = video_drvdata(file);
 
-			/*
-			 *	Now load the card.
-			 */
+	strlcpy(vcap->driver, dev->v4l2_dev.name, sizeof(vcap->driver));
+	strlcpy(vcap->card, "Mediavision PMS", sizeof(vcap->card));
+	strlcpy(vcap->bus_info, "ISA", sizeof(vcap->bus_info));
+	vcap->version = KERNEL_VERSION(0, 0, 3);
+	vcap->capabilities = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_READWRITE;
+	return 0;
+}
 
-			mutex_lock(&pd->lock);
-			pms_brightness(p->brightness>>8);
-			pms_hue(p->hue>>8);
-			pms_colour(p->colour>>8);
-			pms_contrast(p->contrast>>8);
-			mutex_unlock(&pd->lock);
-			return 0;
-		}
-		case VIDIOCSWIN:
-		{
-			struct video_window *vw = arg;
-			if(vw->flags)
-				return -EINVAL;
-			if(vw->clipcount)
-				return -EINVAL;
-			if(vw->height<16||vw->height>480)
-				return -EINVAL;
-			if(vw->width<16||vw->width>640)
-				return -EINVAL;
-			pd->width=vw->width;
-			pd->height=vw->height;
-			mutex_lock(&pd->lock);
-			pms_resolution(pd->width, pd->height);
-			mutex_unlock(&pd->lock);			/* Ok we figured out what to use from our wide choice */
-			return 0;
-		}
-		case VIDIOCGWIN:
-		{
-			struct video_window *vw = arg;
-			memset(vw,0,sizeof(*vw));
-			vw->width=pd->width;
-			vw->height=pd->height;
-			return 0;
-		}
-		case VIDIOCKEY:
-			return 0;
-		case VIDIOCCAPTURE:
-		case VIDIOCGFBUF:
-		case VIDIOCSFBUF:
-		case VIDIOCGFREQ:
-		case VIDIOCSFREQ:
-		case VIDIOCGAUDIO:
-		case VIDIOCSAUDIO:
-			return -EINVAL;
-		default:
-			return -ENOIOCTLCMD;
+static int pms_enum_input(struct file *file, void *fh, struct v4l2_input *vin)
+{
+	static const char *inputs[4] = {
+		"Composite",
+		"S-Video",
+		"Composite (VCR)",
+		"S-Video (VCR)"
+	};
+
+	if (vin->index > 3)
+		return -EINVAL;
+	strlcpy(vin->name, inputs[vin->index], sizeof(vin->name));
+	vin->type = V4L2_INPUT_TYPE_CAMERA;
+	vin->audioset = 0;
+	vin->tuner = 0;
+	vin->std = V4L2_STD_ALL;
+	vin->status = 0;
+	return 0;
+}
+
+static int pms_g_input(struct file *file, void *fh, unsigned int *inp)
+{
+	struct pms *dev = video_drvdata(file);
+
+	*inp = dev->input;
+	return 0;
+}
+
+static int pms_s_input(struct file *file, void *fh, unsigned int inp)
+{
+	struct pms *dev = video_drvdata(file);
+
+	if (inp > 3)
+		return -EINVAL;
+
+	mutex_lock(&dev->lock);
+	dev->input = inp;
+	pms_videosource(dev, inp & 1);
+	pms_vcrinput(dev, inp >> 1);
+	mutex_unlock(&dev->lock);
+	return 0;
+}
+
+static int pms_g_std(struct file *file, void *fh, v4l2_std_id *std)
+{
+	struct pms *dev = video_drvdata(file);
+
+	*std = dev->std;
+	return 0;
+}
+
+static int pms_s_std(struct file *file, void *fh, v4l2_std_id *std)
+{
+	struct pms *dev = video_drvdata(file);
+	int ret = 0;
+
+	dev->std = *std;
+	mutex_lock(&dev->lock);
+	if (dev->std & V4L2_STD_NTSC) {
+		pms_framerate(dev, 30);
+		pms_secamcross(dev, 0);
+		pms_format(dev, 1);
+	} else if (dev->std & V4L2_STD_PAL) {
+		pms_framerate(dev, 25);
+		pms_secamcross(dev, 0);
+		pms_format(dev, 2);
+	} else if (dev->std & V4L2_STD_SECAM) {
+		pms_framerate(dev, 25);
+		pms_secamcross(dev, 1);
+		pms_format(dev, 2);
+	} else {
+		ret = -EINVAL;
 	}
+	/*
+	switch (v->mode) {
+	case VIDEO_MODE_AUTO:
+		pms_framerate(dev, 25);
+		pms_secamcross(dev, 0);
+		pms_format(dev, 0);
+		break;
+	}*/
+	mutex_unlock(&dev->lock);
 	return 0;
 }
 
-static long pms_ioctl(struct file *file,
-		     unsigned int cmd, unsigned long arg)
+static int pms_queryctrl(struct file *file, void *priv,
+					struct v4l2_queryctrl *qc)
 {
-	return video_usercopy(file, cmd, arg, pms_do_ioctl);
+	switch (qc->id) {
+	case V4L2_CID_BRIGHTNESS:
+		return v4l2_ctrl_query_fill(qc, 0, 255, 1, 139);
+	case V4L2_CID_CONTRAST:
+		return v4l2_ctrl_query_fill(qc, 0, 255, 1, 70);
+	case V4L2_CID_SATURATION:
+		return v4l2_ctrl_query_fill(qc, 0, 255, 1, 64);
+	case V4L2_CID_HUE:
+		return v4l2_ctrl_query_fill(qc, 0, 255, 1, 0);
+	}
+	return -EINVAL;
+}
+
+static int pms_g_ctrl(struct file *file, void *priv,
+					struct v4l2_control *ctrl)
+{
+	struct pms *dev = video_drvdata(file);
+	int ret = 0;
+
+	switch (ctrl->id) {
+	case V4L2_CID_BRIGHTNESS:
+		ctrl->value = dev->brightness;
+		break;
+	case V4L2_CID_CONTRAST:
+		ctrl->value = dev->contrast;
+		break;
+	case V4L2_CID_SATURATION:
+		ctrl->value = dev->saturation;
+		break;
+	case V4L2_CID_HUE:
+		ctrl->value = dev->hue;
+		break;
+	default:
+		ret = -EINVAL;
+		break;
+	}
+	return ret;
+}
+
+static int pms_s_ctrl(struct file *file, void *priv,
+					struct v4l2_control *ctrl)
+{
+	struct pms *dev = video_drvdata(file);
+	int ret = 0;
+
+	mutex_lock(&dev->lock);
+	switch (ctrl->id) {
+	case V4L2_CID_BRIGHTNESS:
+		dev->brightness = ctrl->value;
+		pms_brightness(dev, dev->brightness);
+		break;
+	case V4L2_CID_CONTRAST:
+		dev->contrast = ctrl->value;
+		pms_contrast(dev, dev->contrast);
+		break;
+	case V4L2_CID_SATURATION:
+		dev->saturation = ctrl->value;
+		pms_saturation(dev, dev->saturation);
+		break;
+	case V4L2_CID_HUE:
+		dev->hue = ctrl->value;
+		pms_hue(dev, dev->hue);
+		break;
+	default:
+		ret = -EINVAL;
+		break;
+	}
+	mutex_unlock(&dev->lock);
+	return ret;
+}
+
+static int pms_g_fmt_vid_cap(struct file *file, void *fh, struct v4l2_format *fmt)
+{
+	struct pms *dev = video_drvdata(file);
+	struct v4l2_pix_format *pix = &fmt->fmt.pix;
+
+	pix->width = dev->width;
+	pix->height = dev->height;
+	pix->pixelformat = dev->width == 15 ?
+			    V4L2_PIX_FMT_RGB555 : V4L2_PIX_FMT_RGB565;
+	pix->field = V4L2_FIELD_NONE;
+	pix->bytesperline = 2 * dev->width;
+	pix->sizeimage = 2 * dev->width * dev->height;
+	/* Just a guess */
+	pix->colorspace = V4L2_COLORSPACE_SRGB;
+	return 0;
+}
+
+static int pms_try_fmt_vid_cap(struct file *file, void *fh, struct v4l2_format *fmt)
+{
+	struct v4l2_pix_format *pix = &fmt->fmt.pix;
+
+	if (pix->height < 16 || pix->height > 480)
+		return -EINVAL;
+	if (pix->width < 16 || pix->width > 640)
+		return -EINVAL;
+	if (pix->pixelformat != V4L2_PIX_FMT_RGB555 &&
+	    pix->pixelformat != V4L2_PIX_FMT_RGB565)
+		return -EINVAL;
+	pix->field = V4L2_FIELD_NONE;
+	pix->bytesperline = 2 * pix->width;
+	pix->sizeimage = 2 * pix->width * pix->height;
+	/* Just a guess */
+	pix->colorspace = V4L2_COLORSPACE_SRGB;
+	return 0;
+}
+
+static int pms_s_fmt_vid_cap(struct file *file, void *fh, struct v4l2_format *fmt)
+{
+	struct pms *dev = video_drvdata(file);
+	struct v4l2_pix_format *pix = &fmt->fmt.pix;
+	int ret = pms_try_fmt_vid_cap(file, fh, fmt);
+
+	if (ret)
+		return ret;
+	mutex_lock(&dev->lock);
+	dev->width = pix->width;
+	dev->height = pix->height;
+	dev->depth = (pix->pixelformat == V4L2_PIX_FMT_RGB555) ? 15 : 16;
+	pms_resolution(dev, dev->width, dev->height);
+	/* Ok we figured out what to use from our wide choice */
+	mutex_unlock(&dev->lock);
+	return 0;
+}
+
+static int pms_enum_fmt_vid_cap(struct file *file, void *fh, struct v4l2_fmtdesc *fmt)
+{
+	static struct v4l2_fmtdesc formats[] = {
+		{ 0, 0, 0,
+		  "RGB 5:5:5", V4L2_PIX_FMT_RGB555,
+		  { 0, 0, 0, 0 }
+		},
+		{ 0, 0, 0,
+		  "RGB 5:6:5", V4L2_PIX_FMT_RGB565,
+		  { 0, 0, 0, 0 }
+		},
+	};
+	enum v4l2_buf_type type = fmt->type;
+
+	if (fmt->index > 1)
+		return -EINVAL;
+
+	*fmt = formats[fmt->index];
+	fmt->type = type;
+	return 0;
 }
 
 static ssize_t pms_read(struct file *file, char __user *buf,
 		    size_t count, loff_t *ppos)
 {
-	struct video_device *v = video_devdata(file);
-	struct pms_device *pd=(struct pms_device *)v;
+	struct pms *dev = video_drvdata(file);
 	int len;
 
-	mutex_lock(&pd->lock);
-	len=pms_capture(pd, buf, (pd->picture.depth==16)?0:1,count);
-	mutex_unlock(&pd->lock);
+	mutex_lock(&dev->lock);
+	len = pms_capture(dev, buf, (dev->depth == 15), count);
+	mutex_unlock(&dev->lock);
 	return len;
 }
 
 static int pms_exclusive_open(struct file *file)
 {
-	struct video_device *v = video_devdata(file);
-	struct pms_device *pd = (struct pms_device *)v;
+	struct pms *dev = video_drvdata(file);
 
-	return test_and_set_bit(0, &pd->in_use) ? -EBUSY : 0;
+	return test_and_set_bit(0, &dev->in_use) ? -EBUSY : 0;
 }
 
 static int pms_exclusive_release(struct file *file)
 {
-	struct video_device *v = video_devdata(file);
-	struct pms_device *pd = (struct pms_device *)v;
+	struct pms *dev = video_drvdata(file);
 
-	clear_bit(0, &pd->in_use);
+	clear_bit(0, &dev->in_use);
 	return 0;
 }
 
@@ -902,78 +951,81 @@ static const struct v4l2_file_operations pms_fops = {
 	.owner		= THIS_MODULE,
 	.open           = pms_exclusive_open,
 	.release        = pms_exclusive_release,
-	.ioctl          = pms_ioctl,
+	.ioctl		= video_ioctl2,
 	.read           = pms_read,
 };
 
-static struct video_device pms_template=
-{
-	.name		= "Mediavision PMS",
-	.fops           = &pms_fops,
-	.release 	= video_device_release_empty,
+static const struct v4l2_ioctl_ops pms_ioctl_ops = {
+	.vidioc_querycap    		    = pms_querycap,
+	.vidioc_g_input      		    = pms_g_input,
+	.vidioc_s_input      		    = pms_s_input,
+	.vidioc_enum_input   		    = pms_enum_input,
+	.vidioc_g_std 			    = pms_g_std,
+	.vidioc_s_std 			    = pms_s_std,
+	.vidioc_queryctrl 		    = pms_queryctrl,
+	.vidioc_g_ctrl  		    = pms_g_ctrl,
+	.vidioc_s_ctrl 			    = pms_s_ctrl,
+	.vidioc_enum_fmt_vid_cap 	    = pms_enum_fmt_vid_cap,
+	.vidioc_g_fmt_vid_cap 		    = pms_g_fmt_vid_cap,
+	.vidioc_s_fmt_vid_cap  		    = pms_s_fmt_vid_cap,
+	.vidioc_try_fmt_vid_cap  	    = pms_try_fmt_vid_cap,
 };
 
-static struct pms_device pms_device;
-
-
 /*
  *	Probe for and initialise the Mediavision PMS
  */
 
-static int init_mediavision(void)
+static int init_mediavision(struct pms *dev)
 {
 	int id;
 	int idec, decst;
 	int i;
-
-	unsigned char i2c_defs[]={
-		0x4C,0x30,0x00,0xE8,
-		0xB6,0xE2,0x00,0x00,
-		0xFF,0xFF,0x00,0x00,
-		0x00,0x00,0x78,0x98,
-		0x00,0x00,0x00,0x00,
-		0x34,0x0A,0xF4,0xCE,
-		0xE4
+	static const unsigned char i2c_defs[] = {
+		0x4c, 0x30, 0x00, 0xe8,
+		0xb6, 0xe2, 0x00, 0x00,
+		0xff, 0xff, 0x00, 0x00,
+		0x00, 0x00, 0x78, 0x98,
+		0x00, 0x00, 0x00, 0x00,
+		0x34, 0x0a, 0xf4, 0xce,
+		0xe4
 	};
 
-	mem = ioremap(mem_base, 0x800);
-	if (!mem)
+	dev->mem = ioremap(mem_base, 0x800);
+	if (!dev->mem)
 		return -ENOMEM;
 
-	if (!request_region(0x9A01, 1, "Mediavision PMS config"))
-	{
-		printk(KERN_WARNING "mediavision: unable to detect: 0x9A01 in use.\n");
-		iounmap(mem);
+	if (!request_region(0x9a01, 1, "Mediavision PMS config")) {
+		printk(KERN_WARNING "mediavision: unable to detect: 0x9a01 in use.\n");
+		iounmap(dev->mem);
 		return -EBUSY;
 	}
-	if (!request_region(io_port, 3, "Mediavision PMS"))
-	{
-		printk(KERN_WARNING "mediavision: I/O port %d in use.\n", io_port);
-		release_region(0x9A01, 1);
-		iounmap(mem);
+	if (!request_region(dev->io, 3, "Mediavision PMS")) {
+		printk(KERN_WARNING "mediavision: I/O port %d in use.\n", dev->io);
+		release_region(0x9a01, 1);
+		iounmap(dev->mem);
 		return -EBUSY;
 	}
-	outb(0xB8, 0x9A01);		/* Unlock */
-	outb(io_port>>4, 0x9A01);	/* Set IO port */
+	outb(0xb8, 0x9a01);		/* Unlock */
+	outb(dev->io >> 4, 0x9a01);	/* Set IO port */
 
 
-	id=mvv_read(3);
-	decst=pms_i2c_stat(0x43);
+	id = mvv_read(dev, 3);
+	decst = pms_i2c_stat(dev, 0x43);
 
-	if(decst!=-1)
-		idec=2;
-	else if(pms_i2c_stat(0xb9)!=-1)
-		idec=3;
-	else if(pms_i2c_stat(0x8b)!=-1)
-		idec=1;
+	if (decst != -1)
+		idec = 2;
+	else if (pms_i2c_stat(dev, 0xb9) != -1)
+		idec = 3;
+	else if (pms_i2c_stat(dev, 0x8b) != -1)
+		idec = 1;
 	else
-		idec=0;
+		idec = 0;
 
 	printk(KERN_INFO "PMS type is %d\n", idec);
-	if(idec == 0) {
-		release_region(io_port, 3);
-		release_region(0x9A01, 1);
-		iounmap(mem);
+	if (idec == 0) {
+		release_region(dev->io, 3);
+		release_region(0x9a01, 1);
+		iounmap(dev->mem);
 		return -ENODEV;
 	}
 
@@ -981,51 +1033,50 @@ static int init_mediavision(void)
 	 *	Ok we have a PMS of some sort
 	 */
 
-	mvv_write(0x04, mem_base>>12);	/* Set the memory area */
+	mvv_write(dev, 0x04, mem_base >> 12);	/* Set the memory area */
 
 	/* Ok now load the defaults */
 
-	for(i=0;i<0x19;i++)
-	{
-		if(i2c_defs[i]==0xFF)
-			pms_i2c_andor(0x8A, i, 0x07,0x00);
+	for (i = 0; i < 0x19; i++) {
+		if (i2c_defs[i] == 0xff)
+			pms_i2c_andor(dev, 0x8a, i, 0x07, 0x00);
 		else
-			pms_i2c_write(0x8A, i, i2c_defs[i]);
+			pms_i2c_write(dev, 0x8a, i, i2c_defs[i]);
 	}
 
-	pms_i2c_write(0xB8,0x00,0x12);
-	pms_i2c_write(0xB8,0x04,0x00);
-	pms_i2c_write(0xB8,0x07,0x00);
-	pms_i2c_write(0xB8,0x08,0x00);
-	pms_i2c_write(0xB8,0x09,0xFF);
-	pms_i2c_write(0xB8,0x0A,0x00);
-	pms_i2c_write(0xB8,0x0B,0x10);
-	pms_i2c_write(0xB8,0x10,0x03);
-
-	mvv_write(0x01, 0x00);
-	mvv_write(0x05, 0xA0);
-	mvv_write(0x08, 0x25);
-	mvv_write(0x09, 0x00);
-	mvv_write(0x0A, 0x20|MVVMEMORYWIDTH);
-
-	mvv_write(0x10, 0x02);
-	mvv_write(0x1E, 0x0C);
-	mvv_write(0x1F, 0x03);
-	mvv_write(0x26, 0x06);
-
-	mvv_write(0x2B, 0x00);
-	mvv_write(0x2C, 0x20);
-	mvv_write(0x2D, 0x00);
-	mvv_write(0x2F, 0x70);
-	mvv_write(0x32, 0x00);
-	mvv_write(0x33, MVVMEMORYWIDTH);
-	mvv_write(0x34, 0x00);
-	mvv_write(0x35, 0x00);
-	mvv_write(0x3A, 0x80);
-	mvv_write(0x3B, 0x10);
-	mvv_write(0x20, 0x00);
-	mvv_write(0x21, 0x00);
-	mvv_write(0x30, 0x22);
+	pms_i2c_write(dev, 0xb8, 0x00, 0x12);
+	pms_i2c_write(dev, 0xb8, 0x04, 0x00);
+	pms_i2c_write(dev, 0xb8, 0x07, 0x00);
+	pms_i2c_write(dev, 0xb8, 0x08, 0x00);
+	pms_i2c_write(dev, 0xb8, 0x09, 0xff);
+	pms_i2c_write(dev, 0xb8, 0x0a, 0x00);
+	pms_i2c_write(dev, 0xb8, 0x0b, 0x10);
+	pms_i2c_write(dev, 0xb8, 0x10, 0x03);
+
+	mvv_write(dev, 0x01, 0x00);
+	mvv_write(dev, 0x05, 0xa0);
+	mvv_write(dev, 0x08, 0x25);
+	mvv_write(dev, 0x09, 0x00);
+	mvv_write(dev, 0x0a, 0x20 | MVVMEMORYWIDTH);
+
+	mvv_write(dev, 0x10, 0x02);
+	mvv_write(dev, 0x1e, 0x0c);
+	mvv_write(dev, 0x1f, 0x03);
+	mvv_write(dev, 0x26, 0x06);
+
+	mvv_write(dev, 0x2b, 0x00);
+	mvv_write(dev, 0x2c, 0x20);
+	mvv_write(dev, 0x2d, 0x00);
+	mvv_write(dev, 0x2f, 0x70);
+	mvv_write(dev, 0x32, 0x00);
+	mvv_write(dev, 0x33, MVVMEMORYWIDTH);
+	mvv_write(dev, 0x34, 0x00);
+	mvv_write(dev, 0x35, 0x00);
+	mvv_write(dev, 0x3a, 0x80);
+	mvv_write(dev, 0x3b, 0x10);
+	mvv_write(dev, 0x20, 0x00);
+	mvv_write(dev, 0x21, 0x00);
+	mvv_write(dev, 0x30, 0x22);
 	return 0;
 }
 
@@ -1038,53 +1089,77 @@ static int enable;
 module_param(enable, int, 0);
 #endif
 
-static int __init init_pms_cards(void)
+static int __init pms_init(void)
 {
-	printk(KERN_INFO "Mediavision Pro Movie Studio driver 0.02\n");
+	struct pms *dev = &pms_card;
+	struct v4l2_device *v4l2_dev = &dev->v4l2_dev;
+	int res;
+
+	strlcpy(v4l2_dev->name, "pms", sizeof(v4l2_dev->name));
+
+	v4l2_info(v4l2_dev, "Mediavision Pro Movie Studio driver 0.03\n");
 
 #ifndef MODULE
 	if (!enable) {
-		printk(KERN_INFO "PMS: not enabled, use pms.enable=1 to "
-				 "probe\n");
+		v4l2_err(v4l2_dev,
+			"PMS: not enabled, use pms.enable=1 to probe\n");
 		return -ENODEV;
 	}
 #endif
 
-	data_port = io_port +1;
+	dev->decoder = PHILIPS2;
+	dev->io = io_port;
+	dev->data = io_port + 1;
 
-	if(init_mediavision())
-	{
-		printk(KERN_INFO "Board not found.\n");
+	if (init_mediavision(dev)) {
+		v4l2_err(v4l2_dev, "Board not found.\n");
 		return -ENODEV;
 	}
-	memcpy(&pms_device, &pms_template, sizeof(pms_template));
-	mutex_init(&pms_device.lock);
-	pms_device.height=240;
-	pms_device.width=320;
-	pms_swsense(75);
-	pms_resolution(320,240);
-	return video_register_device((struct video_device *)&pms_device, VFL_TYPE_GRABBER, video_nr);
-}
-
-module_param(io_port, int, 0);
-module_param(mem_base, int, 0);
-module_param(video_nr, int, 0);
-MODULE_LICENSE("GPL");
 
+	res = v4l2_device_register(NULL, v4l2_dev);
+	if (res < 0) {
+		v4l2_err(v4l2_dev, "Could not register v4l2_device\n");
+		return res;
+	}
 
-static void __exit shutdown_mediavision(void)
-{
-	release_region(io_port,3);
-	release_region(0x9A01, 1);
+	strlcpy(dev->vdev.name, v4l2_dev->name, sizeof(dev->vdev.name));
+	dev->vdev.v4l2_dev = v4l2_dev;
+	dev->vdev.fops = &pms_fops;
+	dev->vdev.ioctl_ops = &pms_ioctl_ops;
+	dev->vdev.release = video_device_release_empty;
+	video_set_drvdata(&dev->vdev, dev);
+	mutex_init(&dev->lock);
+	dev->std = V4L2_STD_NTSC_M;
+	dev->height = 240;
+	dev->width = 320;
+	dev->depth = 15;
+	dev->brightness = 139;
+	dev->contrast = 70;
+	dev->hue = 0;
+	dev->saturation = 64;
+	pms_swsense(dev, 75);
+	pms_resolution(dev, 320, 240);
+	pms_videosource(dev, 0);
+	pms_vcrinput(dev, 0);
+	if (video_register_device(&dev->vdev, VFL_TYPE_GRABBER, video_nr) < 0) {
+		v4l2_device_unregister(&dev->v4l2_dev);
+		release_region(dev->io, 3);
+		release_region(0x9a01, 1);
+		iounmap(dev->mem);
+		return -EINVAL;
+	}
+	return 0;
 }
 
-static void __exit cleanup_pms_module(void)
+static void __exit pms_exit(void)
 {
-	shutdown_mediavision();
-	video_unregister_device((struct video_device *)&pms_device);
-	iounmap(mem);
-}
+	struct pms *dev = &pms_card;
 
-module_init(init_pms_cards);
-module_exit(cleanup_pms_module);
+	video_unregister_device(&dev->vdev);
+	release_region(dev->io, 3);
+	release_region(0x9a01, 1);
+	iounmap(dev->mem);
+}
 
+module_init(pms_init);
+module_exit(pms_exit);
diff --git a/drivers/media/video/pvrusb2/pvrusb2-debugifc.c b/drivers/media/video/pvrusb2/pvrusb2-debugifc.c
index fbe3856bdca6..ae977668c496 100644
--- a/drivers/media/video/pvrusb2/pvrusb2-debugifc.c
+++ b/drivers/media/video/pvrusb2/pvrusb2-debugifc.c
@@ -142,6 +142,9 @@ int pvr2_debugifc_print_info(struct pvr2_hdw *hdw,char *buf,unsigned int acnt)
 {
 	int bcnt = 0;
 	int ccnt;
+	ccnt = scnprintf(buf, acnt, "Driver hardware description: %s\n",
+			 pvr2_hdw_get_desc(hdw));
+	bcnt += ccnt; acnt -= ccnt; buf += ccnt;
 	ccnt = scnprintf(buf,acnt,"Driver state info:\n");
 	bcnt += ccnt; acnt -= ccnt; buf += ccnt;
 	ccnt = pvr2_hdw_state_report(hdw,buf,acnt);
@@ -249,11 +252,15 @@ static int pvr2_debugifc_do1cmd(struct pvr2_hdw *hdw,const char *buf,
 			scnt = debugifc_isolate_word(buf,count,&wptr,&wlen);
 			if (scnt && wptr) {
 				count -= scnt; buf += scnt;
-				if (debugifc_match_keyword(wptr,wlen,"prom")) {
-					pvr2_hdw_cpufw_set_enabled(hdw,!0,!0);
-				} else if (debugifc_match_keyword(wptr,wlen,
-								  "ram")) {
-					pvr2_hdw_cpufw_set_enabled(hdw,0,!0);
+				if (debugifc_match_keyword(wptr, wlen,
+							   "prom")) {
+					pvr2_hdw_cpufw_set_enabled(hdw, 2, !0);
+				} else if (debugifc_match_keyword(wptr, wlen,
+								  "ram8k")) {
+					pvr2_hdw_cpufw_set_enabled(hdw, 0, !0);
+				} else if (debugifc_match_keyword(wptr, wlen,
+								  "ram16k")) {
+					pvr2_hdw_cpufw_set_enabled(hdw, 1, !0);
 				} else {
 					return -EINVAL;
 				}
diff --git a/drivers/media/video/pvrusb2/pvrusb2-devattr.c b/drivers/media/video/pvrusb2/pvrusb2-devattr.c
index e4d7c13cab87..6bc16c13ccef 100644
--- a/drivers/media/video/pvrusb2/pvrusb2-devattr.c
+++ b/drivers/media/video/pvrusb2/pvrusb2-devattr.c
@@ -58,7 +58,7 @@ static const char *pvr2_fw1_names_29xxx[] = {
 };
 
 static const struct pvr2_device_desc pvr2_device_29xxx = {
-		.description = "WinTV PVR USB2 Model Category 29xxx",
+		.description = "WinTV PVR USB2 Model 29xxx",
 		.shortname = "29xxx",
 		.client_table.lst = pvr2_cli_29xxx,
 		.client_table.cnt = ARRAY_SIZE(pvr2_cli_29xxx),
@@ -91,7 +91,7 @@ static const char *pvr2_fw1_names_24xxx[] = {
 };
 
 static const struct pvr2_device_desc pvr2_device_24xxx = {
-		.description = "WinTV PVR USB2 Model Category 24xxx",
+		.description = "WinTV PVR USB2 Model 24xxx",
 		.shortname = "24xxx",
 		.client_table.lst = pvr2_cli_24xxx,
 		.client_table.cnt = ARRAY_SIZE(pvr2_cli_24xxx),
@@ -340,7 +340,7 @@ static const char *pvr2_fw1_names_73xxx[] = {
 };
 
 static const struct pvr2_device_desc pvr2_device_73xxx = {
-		.description = "WinTV HVR-1900 Model Category 73xxx",
+		.description = "WinTV HVR-1900 Model 73xxx",
 		.shortname = "73xxx",
 		.client_table.lst = pvr2_cli_73xxx,
 		.client_table.cnt = ARRAY_SIZE(pvr2_cli_73xxx),
@@ -351,6 +351,7 @@ static const struct pvr2_device_desc pvr2_device_73xxx = {
 		.flag_has_analogtuner = !0,
 		.flag_has_composite = !0,
 		.flag_has_svideo = !0,
+		.flag_fx2_16kb = !0,
 		.signal_routing_scheme = PVR2_ROUTING_SCHEME_HAUPPAUGE,
 		.digital_control_scheme = PVR2_DIGITAL_SCHEME_HAUPPAUGE,
 		.led_scheme = PVR2_LED_SCHEME_HAUPPAUGE,
@@ -445,7 +446,7 @@ static const char *pvr2_fw1_names_75xxx[] = {
 };
 
 static const struct pvr2_device_desc pvr2_device_750xx = {
-		.description = "WinTV HVR-1950 Model Category 750xx",
+		.description = "WinTV HVR-1950 Model 750xx",
 		.shortname = "750xx",
 		.client_table.lst = pvr2_cli_73xxx,
 		.client_table.cnt = ARRAY_SIZE(pvr2_cli_73xxx),
@@ -456,6 +457,7 @@ static const struct pvr2_device_desc pvr2_device_750xx = {
 		.flag_has_analogtuner = !0,
 		.flag_has_composite = !0,
 		.flag_has_svideo = !0,
+		.flag_fx2_16kb = !0,
 		.signal_routing_scheme = PVR2_ROUTING_SCHEME_HAUPPAUGE,
 		.digital_control_scheme = PVR2_DIGITAL_SCHEME_HAUPPAUGE,
 		.default_std_mask = V4L2_STD_NTSC_M,
@@ -467,7 +469,7 @@ static const struct pvr2_device_desc pvr2_device_750xx = {
 };
 
 static const struct pvr2_device_desc pvr2_device_751xx = {
-		.description = "WinTV HVR-1950 Model Category 751xx",
+		.description = "WinTV HVR-1950 Model 751xx",
 		.shortname = "751xx",
 		.client_table.lst = pvr2_cli_73xxx,
 		.client_table.cnt = ARRAY_SIZE(pvr2_cli_73xxx),
@@ -478,6 +480,7 @@ static const struct pvr2_device_desc pvr2_device_751xx = {
 		.flag_has_analogtuner = !0,
 		.flag_has_composite = !0,
 		.flag_has_svideo = !0,
+		.flag_fx2_16kb = !0,
 		.signal_routing_scheme = PVR2_ROUTING_SCHEME_HAUPPAUGE,
 		.digital_control_scheme = PVR2_DIGITAL_SCHEME_HAUPPAUGE,
 		.default_std_mask = V4L2_STD_NTSC_M,
diff --git a/drivers/media/video/pvrusb2/pvrusb2-devattr.h b/drivers/media/video/pvrusb2/pvrusb2-devattr.h
index ea04ecf8aa39..e5b9594eb5f6 100644
--- a/drivers/media/video/pvrusb2/pvrusb2-devattr.h
+++ b/drivers/media/video/pvrusb2/pvrusb2-devattr.h
@@ -176,6 +176,7 @@ struct pvr2_device_desc {
 	unsigned int flag_has_analogtuner:1;   /* Has analog tuner */
 	unsigned int flag_has_composite:1;     /* Has composite input */
 	unsigned int flag_has_svideo:1;        /* Has s-video input */
+	unsigned int flag_fx2_16kb:1;          /* 16KB FX2 firmware OK here */
 };
 
 extern struct usb_device_id pvr2_device_table[];
diff --git a/drivers/media/video/pvrusb2/pvrusb2-encoder.c b/drivers/media/video/pvrusb2/pvrusb2-encoder.c
index 54ac5349dee2..e046fdaec5ae 100644
--- a/drivers/media/video/pvrusb2/pvrusb2-encoder.c
+++ b/drivers/media/video/pvrusb2/pvrusb2-encoder.c
@@ -294,7 +294,10 @@ static int pvr2_encoder_cmd(void *ctxt,
 			pvr2_trace(
 				PVR2_TRACE_ERROR_LEGS,
 				"Giving up on command."
-				"  This is normally recovered by the driver.");
+				"  This is normally recovered via a firmware"
+				" reload and re-initialization; concern"
+				" is only warranted if this happens repeatedly"
+				" and rapidly.");
 			break;
 		}
 		wrData[0] = 0x7;
diff --git a/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h b/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h
index 5b152ff20bd0..de5485f506b1 100644
--- a/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h
+++ b/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h
@@ -270,6 +270,7 @@ struct pvr2_hdw {
 
 	int force_dirty;        /* consider all controls dirty if true */
 	int flag_ok;            /* device in known good state */
+	int flag_modulefail;    /* true if at least one module failed to load */
 	int flag_disconnected;  /* flag_ok == 0 due to disconnect */
 	int flag_init_ok;       /* true if structure is fully initialized */
 	int fw1_state;          /* current situation with fw1 */
@@ -332,7 +333,7 @@ struct pvr2_hdw {
 
 	/* Bit mask of PVR2_CVAL_INPUT choices which are valid for the hardware */
 	unsigned int input_avail_mask;
-	/* Bit mask of PVR2_CVAL_INPUT choices which are currenly allowed */
+	/* Bit mask of PVR2_CVAL_INPUT choices which are currently allowed */
 	unsigned int input_allowed_mask;
 
 	/* Location of eeprom or a negative number if none */
diff --git a/drivers/media/video/pvrusb2/pvrusb2-hdw.c b/drivers/media/video/pvrusb2/pvrusb2-hdw.c
index 13639b302700..1bbdab08fe0e 100644
--- a/drivers/media/video/pvrusb2/pvrusb2-hdw.c
+++ b/drivers/media/video/pvrusb2/pvrusb2-hdw.c
@@ -1447,6 +1447,7 @@ static int pvr2_upload_firmware1(struct pvr2_hdw *hdw)
 	const struct firmware *fw_entry = NULL;
 	void  *fw_ptr;
 	unsigned int pipe;
+	unsigned int fwsize;
 	int ret;
 	u16 address;
 
@@ -1473,9 +1474,21 @@ static int pvr2_upload_firmware1(struct pvr2_hdw *hdw)
 	usb_clear_halt(hdw->usb_dev, usb_sndbulkpipe(hdw->usb_dev, 0 & 0x7f));
 
 	pipe = usb_sndctrlpipe(hdw->usb_dev, 0);
+	fwsize = fw_entry->size;
 
-	if (fw_entry->size != 0x2000){
-		pvr2_trace(PVR2_TRACE_ERROR_LEGS,"wrong fx2 firmware size");
+	if ((fwsize != 0x2000) &&
+	    (!(hdw->hdw_desc->flag_fx2_16kb && (fwsize == 0x4000)))) {
+		if (hdw->hdw_desc->flag_fx2_16kb) {
+			pvr2_trace(PVR2_TRACE_ERROR_LEGS,
+				   "Wrong fx2 firmware size"
+				   " (expected 8192 or 16384, got %u)",
+				   fwsize);
+		} else {
+			pvr2_trace(PVR2_TRACE_ERROR_LEGS,
+				   "Wrong fx2 firmware size"
+				   " (expected 8192, got %u)",
+				   fwsize);
+		}
 		release_firmware(fw_entry);
 		return -ENOMEM;
 	}
@@ -1493,7 +1506,7 @@ static int pvr2_upload_firmware1(struct pvr2_hdw *hdw)
 	   chunk. */
 
 	ret = 0;
-	for(address = 0; address < fw_entry->size; address += 0x800) {
+	for (address = 0; address < fwsize; address += 0x800) {
 		memcpy(fw_ptr, fw_entry->data + address, 0x800);
 		ret += usb_control_msg(hdw->usb_dev, pipe, 0xa0, 0x40, address,
 				       0, fw_ptr, 0x800, HZ);
@@ -1509,8 +1522,8 @@ static int pvr2_upload_firmware1(struct pvr2_hdw *hdw)
 
 	trace_firmware("Upload done (%d bytes sent)",ret);
 
-	/* We should have written 8192 bytes */
-	if (ret == 8192) {
+	/* We should have written fwsize bytes */
+	if (ret == fwsize) {
 		hdw->fw1_state = FW1_STATE_RELOAD;
 		return 0;
 	}
@@ -2030,7 +2043,8 @@ static int pvr2_hdw_load_subdev(struct pvr2_hdw *hdw,
 	fname = (mid < ARRAY_SIZE(module_names)) ? module_names[mid] : NULL;
 	if (!fname) {
 		pvr2_trace(PVR2_TRACE_ERROR_LEGS,
-			   "Module ID %u for device %s has no name",
+			   "Module ID %u for device %s has no name?"
+			   "  The driver might have a configuration problem.",
 			   mid,
 			   hdw->hdw_desc->description);
 		return -EINVAL;
@@ -2058,7 +2072,8 @@ static int pvr2_hdw_load_subdev(struct pvr2_hdw *hdw,
 	if (!i2ccnt) {
 		pvr2_trace(PVR2_TRACE_ERROR_LEGS,
 			   "Module ID %u (%s) for device %s:"
-			   " No i2c addresses",
+			   " No i2c addresses."
+			   "  The driver might have a configuration problem.",
 			   mid, fname, hdw->hdw_desc->description);
 		return -EINVAL;
 	}
@@ -2090,7 +2105,9 @@ static int pvr2_hdw_load_subdev(struct pvr2_hdw *hdw,
 
 	if (!sd) {
 		pvr2_trace(PVR2_TRACE_ERROR_LEGS,
-			   "Module ID %u (%s) for device %s failed to load",
+			   "Module ID %u (%s) for device %s failed to load."
+			   "  Possible missing sub-device kernel module or"
+			   " initialization failure within module.",
 			   mid, fname, hdw->hdw_desc->description);
 		return -EIO;
 	}
@@ -2132,7 +2149,10 @@ static void pvr2_hdw_load_modules(struct pvr2_hdw *hdw)
 	for (idx = 0; idx < ct->cnt; idx++) {
 		if (pvr2_hdw_load_subdev(hdw, &ct->lst[idx]) < 0) okFl = 0;
 	}
-	if (!okFl) pvr2_hdw_render_useless(hdw);
+	if (!okFl) {
+		hdw->flag_modulefail = !0;
+		pvr2_hdw_render_useless(hdw);
+	}
 }
 
 
@@ -2334,6 +2354,20 @@ static void pvr2_hdw_setup(struct pvr2_hdw *hdw)
 				break;
 			}
 		}
+		if (hdw->flag_modulefail) {
+			pvr2_trace(
+				PVR2_TRACE_ERROR_LEGS,
+				"***WARNING*** pvrusb2 driver initialization"
+				" failed due to the failure of one or more"
+				" sub-device kernel modules.");
+			pvr2_trace(
+				PVR2_TRACE_ERROR_LEGS,
+				"You need to resolve the failing condition"
+				" before this driver can function.  There"
+				" should be some earlier messages giving more"
+				" information about the problem.");
+			break;
+		}
 		if (procreload) {
 			pvr2_trace(
 				PVR2_TRACE_ERROR_LEGS,
@@ -2419,6 +2453,8 @@ struct pvr2_hdw *pvr2_hdw_create(struct usb_interface *intf,
 	hdw = kzalloc(sizeof(*hdw),GFP_KERNEL);
 	pvr2_trace(PVR2_TRACE_INIT,"pvr2_hdw_create: hdw=%p, type \"%s\"",
 		   hdw,hdw_desc->description);
+	pvr2_trace(PVR2_TRACE_INFO, "Hardware description: %s",
+		hdw_desc->description);
 	if (!hdw) goto fail;
 
 	init_timer(&hdw->quiescent_timer);
@@ -3480,7 +3516,7 @@ static u8 *pvr2_full_eeprom_fetch(struct pvr2_hdw *hdw)
 
 
 void pvr2_hdw_cpufw_set_enabled(struct pvr2_hdw *hdw,
-				int prom_flag,
+				int mode,
 				int enable_flag)
 {
 	int ret;
@@ -3503,11 +3539,12 @@ void pvr2_hdw_cpufw_set_enabled(struct pvr2_hdw *hdw,
 			break;
 		}
 
-		hdw->fw_cpu_flag = (prom_flag == 0);
+		hdw->fw_cpu_flag = (mode != 2);
 		if (hdw->fw_cpu_flag) {
+			hdw->fw_size = (mode == 1) ? 0x4000 : 0x2000;
 			pvr2_trace(PVR2_TRACE_FIRMWARE,
-				   "Preparing to suck out CPU firmware");
-			hdw->fw_size = 0x2000;
+				   "Preparing to suck out CPU firmware"
+				   " (size=%u)", hdw->fw_size);
 			hdw->fw_buffer = kzalloc(hdw->fw_size,GFP_KERNEL);
 			if (!hdw->fw_buffer) {
 				hdw->fw_size = 0;
diff --git a/drivers/media/video/pvrusb2/pvrusb2-hdw.h b/drivers/media/video/pvrusb2/pvrusb2-hdw.h
index 7b6940554e9a..56e70eae20c1 100644
--- a/drivers/media/video/pvrusb2/pvrusb2-hdw.h
+++ b/drivers/media/video/pvrusb2/pvrusb2-hdw.h
@@ -219,7 +219,7 @@ int pvr2_hdw_get_stdenum_value(struct pvr2_hdw *hdw,struct v4l2_standard *std,
    this may prevent the device from running (and leaving this mode may
    imply a device reset). */
 void pvr2_hdw_cpufw_set_enabled(struct pvr2_hdw *,
-				int prom_flag,
+				int mode, /* 0=8KB FX2, 1=16KB FX2, 2=PROM */
 				int enable_flag);
 
 /* Return true if we're in a mode for retrieval CPU firmware */
diff --git a/drivers/media/video/pvrusb2/pvrusb2-i2c-core.c b/drivers/media/video/pvrusb2/pvrusb2-i2c-core.c
index a334b1a966a2..7cbe18c4ca95 100644
--- a/drivers/media/video/pvrusb2/pvrusb2-i2c-core.c
+++ b/drivers/media/video/pvrusb2/pvrusb2-i2c-core.c
@@ -50,6 +50,7 @@ MODULE_PARM_DESC(disable_autoload_ir_video,
 
 /* Mapping of IR schemes to known I2C addresses - if any */
 static const unsigned char ir_video_addresses[] = {
+	[PVR2_IR_SCHEME_ZILOG] = 0x71,
 	[PVR2_IR_SCHEME_29XXX] = 0x18,
 	[PVR2_IR_SCHEME_24XXX] = 0x18,
 };
diff --git a/drivers/media/video/pvrusb2/pvrusb2-v4l2.c b/drivers/media/video/pvrusb2/pvrusb2-v4l2.c
index 2d8825e5b1be..cc8ddb2d2382 100644
--- a/drivers/media/video/pvrusb2/pvrusb2-v4l2.c
+++ b/drivers/media/video/pvrusb2/pvrusb2-v4l2.c
@@ -151,17 +151,6 @@ static struct v4l2_format pvr_format [] = {
 };
 
 
-static const char *get_v4l_name(int v4l_type)
-{
-	switch (v4l_type) {
-	case VFL_TYPE_GRABBER: return "video";
-	case VFL_TYPE_RADIO: return "radio";
-	case VFL_TYPE_VBI: return "vbi";
-	default: return "?";
-	}
-}
-
-
 /*
  * pvr_ioctl()
  *
@@ -891,10 +880,8 @@ static long pvr2_v4l2_do_ioctl(struct file *file, unsigned int cmd, void *arg)
 
 static void pvr2_v4l2_dev_destroy(struct pvr2_v4l2_dev *dip)
 {
-	int num = dip->devbase.num;
 	struct pvr2_hdw *hdw = dip->v4lp->channel.mc_head->hdw;
 	enum pvr2_config cfg = dip->config;
-	int v4l_type = dip->v4l_type;
 
 	pvr2_hdw_v4l_store_minor_number(hdw,dip->minor_type,-1);
 
@@ -906,13 +893,22 @@ static void pvr2_v4l2_dev_destroy(struct pvr2_v4l2_dev *dip)
 	   are gone. */
 	video_unregister_device(&dip->devbase);
 
-	printk(KERN_INFO "pvrusb2: unregistered device %s%u [%s]\n",
-	       get_v4l_name(v4l_type), num,
+	printk(KERN_INFO "pvrusb2: unregistered device %s [%s]\n",
+	       video_device_node_name(&dip->devbase),
 	       pvr2_config_get_name(cfg));
 
 }
 
 
+static void pvr2_v4l2_dev_disassociate_parent(struct pvr2_v4l2_dev *dip)
+{
+	if (!dip) return;
+	if (!dip->devbase.parent) return;
+	dip->devbase.parent = NULL;
+	device_move(&dip->devbase.dev, NULL, DPM_ORDER_NONE);
+}
+
+
 static void pvr2_v4l2_destroy_no_lock(struct pvr2_v4l2 *vp)
 {
 	if (vp->dev_video) {
@@ -943,6 +939,8 @@ static void pvr2_v4l2_internal_check(struct pvr2_channel *chp)
 	struct pvr2_v4l2 *vp;
 	vp = container_of(chp,struct pvr2_v4l2,channel);
 	if (!vp->channel.mc_head->disconnect_flag) return;
+	pvr2_v4l2_dev_disassociate_parent(vp->dev_video);
+	pvr2_v4l2_dev_disassociate_parent(vp->dev_radio);
 	if (vp->vfirst) return;
 	pvr2_v4l2_destroy_no_lock(vp);
 }
@@ -1250,12 +1248,13 @@ static void pvr2_v4l2_dev_init(struct pvr2_v4l2_dev *dip,
 			       struct pvr2_v4l2 *vp,
 			       int v4l_type)
 {
+	struct usb_device *usbdev;
 	int mindevnum;
 	int unit_number;
 	int *nr_ptr = NULL;
 	dip->v4lp = vp;
 
-
+	usbdev = pvr2_hdw_get_dev(vp->channel.mc_head->hdw);
 	dip->v4l_type = v4l_type;
 	switch (v4l_type) {
 	case VFL_TYPE_GRABBER:
@@ -1296,6 +1295,7 @@ static void pvr2_v4l2_dev_init(struct pvr2_v4l2_dev *dip,
 	if (nr_ptr && (unit_number >= 0) && (unit_number < PVR_NUM)) {
 		mindevnum = nr_ptr[unit_number];
 	}
+	dip->devbase.parent = &usbdev->dev;
 	if ((video_register_device(&dip->devbase,
 				   dip->v4l_type, mindevnum) < 0) &&
 	    (video_register_device(&dip->devbase,
@@ -1304,8 +1304,8 @@ static void pvr2_v4l2_dev_init(struct pvr2_v4l2_dev *dip,
 			": Failed to register pvrusb2 v4l device\n");
 	}
 
-	printk(KERN_INFO "pvrusb2: registered device %s%u [%s]\n",
-	       get_v4l_name(dip->v4l_type), dip->devbase.num,
+	printk(KERN_INFO "pvrusb2: registered device %s [%s]\n",
+	       video_device_node_name(&dip->devbase),
 	       pvr2_config_get_name(dip->config));
 
 	pvr2_hdw_v4l_store_minor_number(vp->channel.mc_head->hdw,
diff --git a/drivers/media/video/pwc/pwc-if.c b/drivers/media/video/pwc/pwc-if.c
index f976df452a34..aea7e224cef6 100644
--- a/drivers/media/video/pwc/pwc-if.c
+++ b/drivers/media/video/pwc/pwc-if.c
@@ -68,6 +68,7 @@
 #endif
 #include <linux/vmalloc.h>
 #include <asm/io.h>
+#include <linux/kernel.h>		/* simple_strtol() */
 
 #include "pwc.h"
 #include "pwc-kiara.h"
@@ -168,7 +169,6 @@ static struct video_device pwc_template = {
 	.name =		"Philips Webcam",	/* Filled in later */
 	.release =	video_device_release,
 	.fops =         &pwc_fops,
-	.minor =        -1,
 };
 
 /***************************************************************************/
@@ -1806,7 +1806,7 @@ static int usb_pwc_probe(struct usb_interface *intf, const struct usb_device_id
 		goto err_video_release;
 	}
 
-	PWC_INFO("Registered as /dev/video%d.\n", pdev->vdev->num);
+	PWC_INFO("Registered as %s.\n", video_device_node_name(pdev->vdev));
 
 	/* occupy slot */
 	if (hint < MAX_DEV_HINTS)
@@ -1916,19 +1916,6 @@ disconnect_out:
 	unlock_kernel();
 }
 
-/* *grunt* We have to do atoi ourselves :-( */
-static int pwc_atoi(const char *s)
-{
-	int k = 0;
-
-	k = 0;
-	while (*s != '\0' && *s >= '0' && *s <= '9') {
-		k = 10 * k + (*s - '0');
-		s++;
-	}
-	return k;
-}
-
 
 /*
  * Initialization code & module stuff
@@ -1960,7 +1947,9 @@ MODULE_PARM_DESC(size, "Initial image size. One of sqcif, qsif, qcif, sif, cif,
 MODULE_PARM_DESC(fps, "Initial frames per second. Varies with model, useful range 5-30");
 MODULE_PARM_DESC(fbufs, "Number of internal frame buffers to reserve");
 MODULE_PARM_DESC(mbufs, "Number of external (mmap()ed) image buffers");
+#ifdef CONFIG_USB_PWC_DEBUG
 MODULE_PARM_DESC(trace, "For debugging purposes");
+#endif
 MODULE_PARM_DESC(power_save, "Turn power save feature in camera on or off");
 MODULE_PARM_DESC(compression, "Preferred compression quality. Range 0 (uncompressed) to 3 (high compression)");
 MODULE_PARM_DESC(leds, "LED on,off time in milliseconds");
@@ -2078,13 +2067,16 @@ static int __init usb_pwc_init(void)
 				}
 				else {
 					/* No type or serial number specified, just a number. */
-					device_hint[i].device_node = pwc_atoi(s);
+					device_hint[i].device_node =
+						simple_strtol(s, NULL, 10);
 				}
 			}
 			else {
 				/* There's a colon, so we have at least a type and a device node */
-				device_hint[i].type = pwc_atoi(s);
-				device_hint[i].device_node = pwc_atoi(colon + 1);
+				device_hint[i].type =
+					simple_strtol(s, NULL, 10);
+				device_hint[i].device_node =
+					simple_strtol(colon + 1, NULL, 10);
 				if (*dot != '\0') {
 					/* There's a serial number as well */
 					int k;
diff --git a/drivers/media/video/pxa_camera.c b/drivers/media/video/pxa_camera.c
index 51b683c63b70..294f860ce2b0 100644
--- a/drivers/media/video/pxa_camera.c
+++ b/drivers/media/video/pxa_camera.c
@@ -32,6 +32,7 @@
 #include <media/v4l2-dev.h>
 #include <media/videobuf-dma-sg.h>
 #include <media/soc_camera.h>
+#include <media/soc_mediabus.h>
 
 #include <linux/videodev2.h>
 
@@ -183,23 +184,21 @@ struct pxa_cam_dma {
 /* buffer for one video frame */
 struct pxa_buffer {
 	/* common v4l buffer stuff -- must be first */
-	struct videobuf_buffer vb;
-
-	const struct soc_camera_data_format        *fmt;
-
+	struct videobuf_buffer		vb;
+	enum v4l2_mbus_pixelcode	code;
 	/* our descriptor lists for Y, U and V channels */
-	struct pxa_cam_dma dmas[3];
-
-	int			inwork;
-
-	enum pxa_camera_active_dma active_dma;
+	struct pxa_cam_dma		dmas[3];
+	int				inwork;
+	enum pxa_camera_active_dma	active_dma;
 };
 
 struct pxa_camera_dev {
 	struct soc_camera_host	soc_host;
-	/* PXA27x is only supposed to handle one camera on its Quick Capture
+	/*
+	 * PXA27x is only supposed to handle one camera on its Quick Capture
 	 * interface. If anyone ever builds hardware to enable more than
-	 * one camera, they will have to modify this driver too */
+	 * one camera, they will have to modify this driver too
+	 */
 	struct soc_camera_device *icd;
 	struct clk		*clk;
 
@@ -241,11 +240,15 @@ static int pxa_videobuf_setup(struct videobuf_queue *vq, unsigned int *count,
 			      unsigned int *size)
 {
 	struct soc_camera_device *icd = vq->priv_data;
+	int bytes_per_line = soc_mbus_bytes_per_line(icd->user_width,
+						icd->current_fmt->host_fmt);
+
+	if (bytes_per_line < 0)
+		return bytes_per_line;
 
 	dev_dbg(icd->dev.parent, "count=%d, size=%d\n", *count, *size);
 
-	*size = roundup(icd->user_width * icd->user_height *
-			((icd->current_fmt->depth + 7) >> 3), 8);
+	*size = bytes_per_line * icd->user_height;
 
 	if (0 == *count)
 		*count = 32;
@@ -267,8 +270,10 @@ static void free_buffer(struct videobuf_queue *vq, struct pxa_buffer *buf)
 	dev_dbg(icd->dev.parent, "%s (vb=0x%p) 0x%08lx %d\n", __func__,
 		&buf->vb, buf->vb.baddr, buf->vb.bsize);
 
-	/* This waits until this buffer is out of danger, i.e., until it is no
-	 * longer in STATE_QUEUED or STATE_ACTIVE */
+	/*
+	 * This waits until this buffer is out of danger, i.e., until it is no
+	 * longer in STATE_QUEUED or STATE_ACTIVE
+	 */
 	videobuf_waiton(&buf->vb, 0, 0);
 	videobuf_dma_unmap(vq, dma);
 	videobuf_dma_free(dma);
@@ -429,6 +434,11 @@ static int pxa_videobuf_prepare(struct videobuf_queue *vq,
 	struct pxa_buffer *buf = container_of(vb, struct pxa_buffer, vb);
 	int ret;
 	int size_y, size_u = 0, size_v = 0;
+	int bytes_per_line = soc_mbus_bytes_per_line(icd->user_width,
+						icd->current_fmt->host_fmt);
+
+	if (bytes_per_line < 0)
+		return bytes_per_line;
 
 	dev_dbg(dev, "%s (vb=0x%p) 0x%08lx %d\n", __func__,
 		vb, vb->baddr, vb->bsize);
@@ -437,29 +447,33 @@ static int pxa_videobuf_prepare(struct videobuf_queue *vq,
 	WARN_ON(!list_empty(&vb->queue));
 
 #ifdef DEBUG
-	/* This can be useful if you want to see if we actually fill
-	 * the buffer with something */
+	/*
+	 * This can be useful if you want to see if we actually fill
+	 * the buffer with something
+	 */
 	memset((void *)vb->baddr, 0xaa, vb->bsize);
 #endif
 
 	BUG_ON(NULL == icd->current_fmt);
 
-	/* I think, in buf_prepare you only have to protect global data,
-	 * the actual buffer is yours */
+	/*
+	 * I think, in buf_prepare you only have to protect global data,
+	 * the actual buffer is yours
+	 */
 	buf->inwork = 1;
 
-	if (buf->fmt	!= icd->current_fmt ||
+	if (buf->code	!= icd->current_fmt->code ||
 	    vb->width	!= icd->user_width ||
 	    vb->height	!= icd->user_height ||
 	    vb->field	!= field) {
-		buf->fmt	= icd->current_fmt;
+		buf->code	= icd->current_fmt->code;
 		vb->width	= icd->user_width;
 		vb->height	= icd->user_height;
 		vb->field	= field;
 		vb->state	= VIDEOBUF_NEEDS_INIT;
 	}
 
-	vb->size = vb->width * vb->height * ((buf->fmt->depth + 7) >> 3);
+	vb->size = bytes_per_line * vb->height;
 	if (0 != vb->baddr && vb->bsize < vb->size) {
 		ret = -EINVAL;
 		goto out;
@@ -834,8 +848,10 @@ static void pxa_camera_init_videobuf(struct videobuf_queue *q,
 	struct soc_camera_host *ici = to_soc_camera_host(icd->dev.parent);
 	struct pxa_camera_dev *pcdev = ici->priv;
 
-	/* We must pass NULL as dev pointer, then all pci_* dma operations
-	 * transform to normal dma_* ones. */
+	/*
+	 * We must pass NULL as dev pointer, then all pci_* dma operations
+	 * transform to normal dma_* ones.
+	 */
 	videobuf_queue_sg_init(q, &pxa_videobuf_ops, NULL, &pcdev->lock,
 				V4L2_BUF_TYPE_VIDEO_CAPTURE, V4L2_FIELD_NONE,
 				sizeof(struct pxa_buffer), icd);
@@ -1051,11 +1067,18 @@ static void pxa_camera_setup_cicr(struct soc_camera_device *icd,
 {
 	struct soc_camera_host *ici = to_soc_camera_host(icd->dev.parent);
 	struct pxa_camera_dev *pcdev = ici->priv;
+	struct v4l2_subdev *sd = soc_camera_to_subdev(icd);
 	unsigned long dw, bpp;
-	u32 cicr0, cicr1, cicr2, cicr3, cicr4 = 0;
+	u32 cicr0, cicr1, cicr2, cicr3, cicr4 = 0, y_skip_top;
+	int ret = v4l2_subdev_call(sd, sensor, g_skip_top_lines, &y_skip_top);
+
+	if (ret < 0)
+		y_skip_top = 0;
 
-	/* Datawidth is now guaranteed to be equal to one of the three values.
-	 * We fix bit-per-pixel equal to data-width... */
+	/*
+	 * Datawidth is now guaranteed to be equal to one of the three values.
+	 * We fix bit-per-pixel equal to data-width...
+	 */
 	switch (flags & SOCAM_DATAWIDTH_MASK) {
 	case SOCAM_DATAWIDTH_10:
 		dw = 4;
@@ -1066,8 +1089,10 @@ static void pxa_camera_setup_cicr(struct soc_camera_device *icd,
 		bpp = 0x20;
 		break;
 	default:
-		/* Actually it can only be 8 now,
-		 * default is just to silence compiler warnings */
+		/*
+		 * Actually it can only be 8 now,
+		 * default is just to silence compiler warnings
+		 */
 	case SOCAM_DATAWIDTH_8:
 		dw = 2;
 		bpp = 0;
@@ -1118,7 +1143,7 @@ static void pxa_camera_setup_cicr(struct soc_camera_device *icd,
 
 	cicr2 = 0;
 	cicr3 = CICR3_LPF_VAL(icd->user_height - 1) |
-		CICR3_BFW_VAL(min((unsigned short)255, icd->y_skip_top));
+		CICR3_BFW_VAL(min((u32)255, y_skip_top));
 	cicr4 |= pcdev->mclk_divisor;
 
 	__raw_writel(cicr1, pcdev->base + CICR1);
@@ -1138,9 +1163,15 @@ static int pxa_camera_set_bus_param(struct soc_camera_device *icd, __u32 pixfmt)
 	struct soc_camera_host *ici = to_soc_camera_host(icd->dev.parent);
 	struct pxa_camera_dev *pcdev = ici->priv;
 	unsigned long bus_flags, camera_flags, common_flags;
-	int ret = test_platform_param(pcdev, icd->buswidth, &bus_flags);
+	const struct soc_mbus_pixelfmt *fmt;
+	int ret;
 	struct pxa_cam *cam = icd->host_priv;
 
+	fmt = soc_mbus_get_fmtdesc(icd->current_fmt->code);
+	if (!fmt)
+		return -EINVAL;
+
+	ret = test_platform_param(pcdev, fmt->bits_per_sample, &bus_flags);
 	if (ret < 0)
 		return ret;
 
@@ -1204,59 +1235,49 @@ static int pxa_camera_try_bus_param(struct soc_camera_device *icd,
 	return soc_camera_bus_param_compatible(camera_flags, bus_flags) ? 0 : -EINVAL;
 }
 
-static const struct soc_camera_data_format pxa_camera_formats[] = {
+static const struct soc_mbus_pixelfmt pxa_camera_formats[] = {
 	{
-		.name		= "Planar YUV422 16 bit",
-		.depth		= 16,
-		.fourcc		= V4L2_PIX_FMT_YUV422P,
-		.colorspace	= V4L2_COLORSPACE_JPEG,
+		.fourcc			= V4L2_PIX_FMT_YUV422P,
+		.name			= "Planar YUV422 16 bit",
+		.bits_per_sample	= 8,
+		.packing		= SOC_MBUS_PACKING_2X8_PADHI,
+		.order			= SOC_MBUS_ORDER_LE,
 	},
 };
 
-static bool buswidth_supported(struct soc_camera_device *icd, int depth)
+/* This will be corrected as we get more formats */
+static bool pxa_camera_packing_supported(const struct soc_mbus_pixelfmt *fmt)
 {
-	struct soc_camera_host *ici = to_soc_camera_host(icd->dev.parent);
-	struct pxa_camera_dev *pcdev = ici->priv;
-
-	switch (depth) {
-	case 8:
-		return !!(pcdev->platform_flags & PXA_CAMERA_DATAWIDTH_8);
-	case 9:
-		return !!(pcdev->platform_flags & PXA_CAMERA_DATAWIDTH_9);
-	case 10:
-		return !!(pcdev->platform_flags & PXA_CAMERA_DATAWIDTH_10);
-	}
-	return false;
-}
-
-static int required_buswidth(const struct soc_camera_data_format *fmt)
-{
-	switch (fmt->fourcc) {
-	case V4L2_PIX_FMT_UYVY:
-	case V4L2_PIX_FMT_VYUY:
-	case V4L2_PIX_FMT_YUYV:
-	case V4L2_PIX_FMT_YVYU:
-	case V4L2_PIX_FMT_RGB565:
-	case V4L2_PIX_FMT_RGB555:
-		return 8;
-	default:
-		return fmt->depth;
-	}
+	return	fmt->packing == SOC_MBUS_PACKING_NONE ||
+		(fmt->bits_per_sample == 8 &&
+		 fmt->packing == SOC_MBUS_PACKING_2X8_PADHI) ||
+		(fmt->bits_per_sample > 8 &&
+		 fmt->packing == SOC_MBUS_PACKING_EXTEND16);
 }
 
 static int pxa_camera_get_formats(struct soc_camera_device *icd, int idx,
 				  struct soc_camera_format_xlate *xlate)
 {
+	struct v4l2_subdev *sd = soc_camera_to_subdev(icd);
 	struct device *dev = icd->dev.parent;
-	int formats = 0, buswidth, ret;
+	int formats = 0, ret;
 	struct pxa_cam *cam;
+	enum v4l2_mbus_pixelcode code;
+	const struct soc_mbus_pixelfmt *fmt;
 
-	buswidth = required_buswidth(icd->formats + idx);
+	ret = v4l2_subdev_call(sd, video, enum_mbus_fmt, idx, &code);
+	if (ret < 0)
+		/* No more formats */
+		return 0;
 
-	if (!buswidth_supported(icd, buswidth))
+	fmt = soc_mbus_get_fmtdesc(code);
+	if (!fmt) {
+		dev_err(dev, "Invalid format code #%d: %d\n", idx, code);
 		return 0;
+	}
 
-	ret = pxa_camera_try_bus_param(icd, buswidth);
+	/* This also checks support for the requested bits-per-sample */
+	ret = pxa_camera_try_bus_param(icd, fmt->bits_per_sample);
 	if (ret < 0)
 		return 0;
 
@@ -1270,45 +1291,40 @@ static int pxa_camera_get_formats(struct soc_camera_device *icd, int idx,
 		cam = icd->host_priv;
 	}
 
-	switch (icd->formats[idx].fourcc) {
-	case V4L2_PIX_FMT_UYVY:
+	switch (code) {
+	case V4L2_MBUS_FMT_YUYV8_2X8_BE:
 		formats++;
 		if (xlate) {
-			xlate->host_fmt = &pxa_camera_formats[0];
-			xlate->cam_fmt = icd->formats + idx;
-			xlate->buswidth = buswidth;
+			xlate->host_fmt	= &pxa_camera_formats[0];
+			xlate->code	= code;
 			xlate++;
-			dev_dbg(dev, "Providing format %s using %s\n",
-				pxa_camera_formats[0].name,
-				icd->formats[idx].name);
+			dev_dbg(dev, "Providing format %s using code %d\n",
+				pxa_camera_formats[0].name, code);
 		}
-	case V4L2_PIX_FMT_VYUY:
-	case V4L2_PIX_FMT_YUYV:
-	case V4L2_PIX_FMT_YVYU:
-	case V4L2_PIX_FMT_RGB565:
-	case V4L2_PIX_FMT_RGB555:
-		formats++;
-		if (xlate) {
-			xlate->host_fmt = icd->formats + idx;
-			xlate->cam_fmt = icd->formats + idx;
-			xlate->buswidth = buswidth;
-			xlate++;
+	case V4L2_MBUS_FMT_YVYU8_2X8_BE:
+	case V4L2_MBUS_FMT_YUYV8_2X8_LE:
+	case V4L2_MBUS_FMT_YVYU8_2X8_LE:
+	case V4L2_MBUS_FMT_RGB565_2X8_LE:
+	case V4L2_MBUS_FMT_RGB555_2X8_PADHI_LE:
+		if (xlate)
 			dev_dbg(dev, "Providing format %s packed\n",
-				icd->formats[idx].name);
-		}
+				fmt->name);
 		break;
 	default:
-		/* Generic pass-through */
-		formats++;
-		if (xlate) {
-			xlate->host_fmt = icd->formats + idx;
-			xlate->cam_fmt = icd->formats + idx;
-			xlate->buswidth = icd->formats[idx].depth;
-			xlate++;
+		if (!pxa_camera_packing_supported(fmt))
+			return 0;
+		if (xlate)
 			dev_dbg(dev,
 				"Providing format %s in pass-through mode\n",
-				icd->formats[idx].name);
-		}
+				fmt->name);
+	}
+
+	/* Generic pass-through */
+	formats++;
+	if (xlate) {
+		xlate->host_fmt	= fmt;
+		xlate->code	= code;
+		xlate++;
 	}
 
 	return formats;
@@ -1320,11 +1336,11 @@ static void pxa_camera_put_formats(struct soc_camera_device *icd)
 	icd->host_priv = NULL;
 }
 
-static int pxa_camera_check_frame(struct v4l2_pix_format *pix)
+static int pxa_camera_check_frame(u32 width, u32 height)
 {
 	/* limit to pxa hardware capabilities */
-	return pix->height < 32 || pix->height > 2048 || pix->width < 48 ||
-		pix->width > 2048 || (pix->width & 0x01);
+	return height < 32 || height > 2048 || width < 48 || width > 2048 ||
+		(width & 0x01);
 }
 
 static int pxa_camera_set_crop(struct soc_camera_device *icd,
@@ -1339,9 +1355,9 @@ static int pxa_camera_set_crop(struct soc_camera_device *icd,
 		.master_clock = pcdev->mclk,
 		.pixel_clock_max = pcdev->ciclk / 4,
 	};
-	struct v4l2_format f;
-	struct v4l2_pix_format *pix = &f.fmt.pix, pix_tmp;
+	struct v4l2_mbus_framefmt mf;
 	struct pxa_cam *cam = icd->host_priv;
+	u32 fourcc = icd->current_fmt->host_fmt->fourcc;
 	int ret;
 
 	/* If PCLK is used to latch data from the sensor, check sense */
@@ -1358,27 +1374,23 @@ static int pxa_camera_set_crop(struct soc_camera_device *icd,
 		return ret;
 	}
 
-	f.type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
-
-	ret = v4l2_subdev_call(sd, video, g_fmt, &f);
+	ret = v4l2_subdev_call(sd, video, g_mbus_fmt, &mf);
 	if (ret < 0)
 		return ret;
 
-	pix_tmp = *pix;
-	if (pxa_camera_check_frame(pix)) {
+	if (pxa_camera_check_frame(mf.width, mf.height)) {
 		/*
 		 * Camera cropping produced a frame beyond our capabilities.
 		 * FIXME: just extract a subframe, that we can process.
 		 */
-		v4l_bound_align_image(&pix->width, 48, 2048, 1,
-			&pix->height, 32, 2048, 0,
-			icd->current_fmt->fourcc == V4L2_PIX_FMT_YUV422P ?
-				4 : 0);
-		ret = v4l2_subdev_call(sd, video, s_fmt, &f);
+		v4l_bound_align_image(&mf.width, 48, 2048, 1,
+			&mf.height, 32, 2048, 0,
+			fourcc == V4L2_PIX_FMT_YUV422P ? 4 : 0);
+		ret = v4l2_subdev_call(sd, video, s_mbus_fmt, &mf);
 		if (ret < 0)
 			return ret;
 
-		if (pxa_camera_check_frame(pix)) {
+		if (pxa_camera_check_frame(mf.width, mf.height)) {
 			dev_warn(icd->dev.parent,
 				 "Inconsistent state. Use S_FMT to repair\n");
 			return -EINVAL;
@@ -1395,10 +1407,10 @@ static int pxa_camera_set_crop(struct soc_camera_device *icd,
 		recalculate_fifo_timeout(pcdev, sense.pixel_clock);
 	}
 
-	icd->user_width = pix->width;
-	icd->user_height = pix->height;
+	icd->user_width		= mf.width;
+	icd->user_height	= mf.height;
 
-	pxa_camera_setup_cicr(icd, cam->flags, icd->current_fmt->fourcc);
+	pxa_camera_setup_cicr(icd, cam->flags, fourcc);
 
 	return ret;
 }
@@ -1410,14 +1422,13 @@ static int pxa_camera_set_fmt(struct soc_camera_device *icd,
 	struct pxa_camera_dev *pcdev = ici->priv;
 	struct device *dev = icd->dev.parent;
 	struct v4l2_subdev *sd = soc_camera_to_subdev(icd);
-	const struct soc_camera_data_format *cam_fmt = NULL;
 	const struct soc_camera_format_xlate *xlate = NULL;
 	struct soc_camera_sense sense = {
 		.master_clock = pcdev->mclk,
 		.pixel_clock_max = pcdev->ciclk / 4,
 	};
 	struct v4l2_pix_format *pix = &f->fmt.pix;
-	struct v4l2_format cam_f = *f;
+	struct v4l2_mbus_framefmt mf;
 	int ret;
 
 	xlate = soc_camera_xlate_by_fourcc(icd, pix->pixelformat);
@@ -1426,26 +1437,31 @@ static int pxa_camera_set_fmt(struct soc_camera_device *icd,
 		return -EINVAL;
 	}
 
-	cam_fmt = xlate->cam_fmt;
-
 	/* If PCLK is used to latch data from the sensor, check sense */
 	if (pcdev->platform_flags & PXA_CAMERA_PCLK_EN)
+		/* The caller holds a mutex. */
 		icd->sense = &sense;
 
-	cam_f.fmt.pix.pixelformat = cam_fmt->fourcc;
-	ret = v4l2_subdev_call(sd, video, s_fmt, &cam_f);
-	cam_f.fmt.pix.pixelformat = pix->pixelformat;
-	*pix = cam_f.fmt.pix;
+	mf.width	= pix->width;
+	mf.height	= pix->height;
+	mf.field	= pix->field;
+	mf.colorspace	= pix->colorspace;
+	mf.code		= xlate->code;
+
+	ret = v4l2_subdev_call(sd, video, s_mbus_fmt, &mf);
+
+	if (mf.code != xlate->code)
+		return -EINVAL;
 
 	icd->sense = NULL;
 
 	if (ret < 0) {
 		dev_warn(dev, "Failed to configure for format %x\n",
 			 pix->pixelformat);
-	} else if (pxa_camera_check_frame(pix)) {
+	} else if (pxa_camera_check_frame(mf.width, mf.height)) {
 		dev_warn(dev,
 			 "Camera driver produced an unsupported frame %dx%d\n",
-			 pix->width, pix->height);
+			 mf.width, mf.height);
 		ret = -EINVAL;
 	} else if (sense.flags & SOCAM_SENSE_PCLK_CHANGED) {
 		if (sense.pixel_clock > sense.pixel_clock_max) {
@@ -1457,10 +1473,14 @@ static int pxa_camera_set_fmt(struct soc_camera_device *icd,
 		recalculate_fifo_timeout(pcdev, sense.pixel_clock);
 	}
 
-	if (!ret) {
-		icd->buswidth = xlate->buswidth;
-		icd->current_fmt = xlate->host_fmt;
-	}
+	if (ret < 0)
+		return ret;
+
+	pix->width		= mf.width;
+	pix->height		= mf.height;
+	pix->field		= mf.field;
+	pix->colorspace		= mf.colorspace;
+	icd->current_fmt	= xlate;
 
 	return ret;
 }
@@ -1468,17 +1488,16 @@ static int pxa_camera_set_fmt(struct soc_camera_device *icd,
 static int pxa_camera_try_fmt(struct soc_camera_device *icd,
 			      struct v4l2_format *f)
 {
-	struct soc_camera_host *ici = to_soc_camera_host(icd->dev.parent);
 	struct v4l2_subdev *sd = soc_camera_to_subdev(icd);
 	const struct soc_camera_format_xlate *xlate;
 	struct v4l2_pix_format *pix = &f->fmt.pix;
+	struct v4l2_mbus_framefmt mf;
 	__u32 pixfmt = pix->pixelformat;
-	enum v4l2_field field;
 	int ret;
 
 	xlate = soc_camera_xlate_by_fourcc(icd, pixfmt);
 	if (!xlate) {
-		dev_warn(ici->v4l2_dev.dev, "Format %x not found\n", pixfmt);
+		dev_warn(icd->dev.parent, "Format %x not found\n", pixfmt);
 		return -EINVAL;
 	}
 
@@ -1492,22 +1511,36 @@ static int pxa_camera_try_fmt(struct soc_camera_device *icd,
 			      &pix->height, 32, 2048, 0,
 			      pixfmt == V4L2_PIX_FMT_YUV422P ? 4 : 0);
 
-	pix->bytesperline = pix->width *
-		DIV_ROUND_UP(xlate->host_fmt->depth, 8);
+	pix->bytesperline = soc_mbus_bytes_per_line(pix->width,
+						    xlate->host_fmt);
+	if (pix->bytesperline < 0)
+		return pix->bytesperline;
 	pix->sizeimage = pix->height * pix->bytesperline;
 
-	/* camera has to see its format, but the user the original one */
-	pix->pixelformat = xlate->cam_fmt->fourcc;
 	/* limit to sensor capabilities */
-	ret = v4l2_subdev_call(sd, video, try_fmt, f);
-	pix->pixelformat = pixfmt;
+	mf.width	= pix->width;
+	mf.height	= pix->height;
+	mf.field	= pix->field;
+	mf.colorspace	= pix->colorspace;
+	mf.code		= xlate->code;
 
-	field = pix->field;
+	ret = v4l2_subdev_call(sd, video, try_mbus_fmt, &mf);
+	if (ret < 0)
+		return ret;
 
-	if (field == V4L2_FIELD_ANY) {
-		pix->field = V4L2_FIELD_NONE;
-	} else if (field != V4L2_FIELD_NONE) {
-		dev_err(icd->dev.parent, "Field type %d unsupported.\n", field);
+	pix->width	= mf.width;
+	pix->height	= mf.height;
+	pix->colorspace	= mf.colorspace;
+
+	switch (mf.field) {
+	case V4L2_FIELD_ANY:
+	case V4L2_FIELD_NONE:
+		pix->field	= V4L2_FIELD_NONE;
+		break;
+	default:
+		/* TODO: support interlaced at least in pass-through mode */
+		dev_err(icd->dev.parent, "Field type %d unsupported.\n",
+			mf.field);
 		return -EINVAL;
 	}
 
@@ -1519,10 +1552,12 @@ static int pxa_camera_reqbufs(struct soc_camera_file *icf,
 {
 	int i;
 
-	/* This is for locking debugging only. I removed spinlocks and now I
+	/*
+	 * This is for locking debugging only. I removed spinlocks and now I
 	 * check whether .prepare is ever called on a linked buffer, or whether
 	 * a dma IRQ can occur for an in-work or unlinked buffer. Until now
-	 * it hadn't triggered */
+	 * it hadn't triggered
+	 */
 	for (i = 0; i < p->count; i++) {
 		struct pxa_buffer *buf = container_of(icf->vb_vidq.bufs[i],
 						      struct pxa_buffer, vb);
@@ -1657,8 +1692,10 @@ static int __devinit pxa_camera_probe(struct platform_device *pdev)
 	pcdev->platform_flags = pcdev->pdata->flags;
 	if (!(pcdev->platform_flags & (PXA_CAMERA_DATAWIDTH_8 |
 			PXA_CAMERA_DATAWIDTH_9 | PXA_CAMERA_DATAWIDTH_10))) {
-		/* Platform hasn't set available data widths. This is bad.
-		 * Warn and use a default. */
+		/*
+		 * Platform hasn't set available data widths. This is bad.
+		 * Warn and use a default.
+		 */
 		dev_warn(&pdev->dev, "WARNING! Platform hasn't set available "
 			 "data widths, using default 10 bit\n");
 		pcdev->platform_flags |= PXA_CAMERA_DATAWIDTH_10;
diff --git a/drivers/media/video/rj54n1cb0c.c b/drivers/media/video/rj54n1cb0c.c
new file mode 100644
index 000000000000..805226e0d9c1
--- /dev/null
+++ b/drivers/media/video/rj54n1cb0c.c
@@ -0,0 +1,1501 @@
+/*
+ * Driver for RJ54N1CB0C CMOS Image Sensor from Micron
+ *
+ * Copyright (C) 2009, Guennadi Liakhovetski <g.liakhovetski@gmx.de>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/delay.h>
+#include <linux/i2c.h>
+#include <linux/slab.h>
+#include <linux/videodev2.h>
+
+#include <media/rj54n1cb0c.h>
+#include <media/soc_camera.h>
+#include <media/soc_mediabus.h>
+#include <media/v4l2-subdev.h>
+#include <media/v4l2-chip-ident.h>
+
+#define RJ54N1_DEV_CODE			0x0400
+#define RJ54N1_DEV_CODE2		0x0401
+#define RJ54N1_OUT_SEL			0x0403
+#define RJ54N1_XY_OUTPUT_SIZE_S_H	0x0404
+#define RJ54N1_X_OUTPUT_SIZE_S_L	0x0405
+#define RJ54N1_Y_OUTPUT_SIZE_S_L	0x0406
+#define RJ54N1_XY_OUTPUT_SIZE_P_H	0x0407
+#define RJ54N1_X_OUTPUT_SIZE_P_L	0x0408
+#define RJ54N1_Y_OUTPUT_SIZE_P_L	0x0409
+#define RJ54N1_LINE_LENGTH_PCK_S_H	0x040a
+#define RJ54N1_LINE_LENGTH_PCK_S_L	0x040b
+#define RJ54N1_LINE_LENGTH_PCK_P_H	0x040c
+#define RJ54N1_LINE_LENGTH_PCK_P_L	0x040d
+#define RJ54N1_RESIZE_N			0x040e
+#define RJ54N1_RESIZE_N_STEP		0x040f
+#define RJ54N1_RESIZE_STEP		0x0410
+#define RJ54N1_RESIZE_HOLD_H		0x0411
+#define RJ54N1_RESIZE_HOLD_L		0x0412
+#define RJ54N1_H_OBEN_OFS		0x0413
+#define RJ54N1_V_OBEN_OFS		0x0414
+#define RJ54N1_RESIZE_CONTROL		0x0415
+#define RJ54N1_STILL_CONTROL		0x0417
+#define RJ54N1_INC_USE_SEL_H		0x0425
+#define RJ54N1_INC_USE_SEL_L		0x0426
+#define RJ54N1_MIRROR_STILL_MODE	0x0427
+#define RJ54N1_INIT_START		0x0428
+#define RJ54N1_SCALE_1_2_LEV		0x0429
+#define RJ54N1_SCALE_4_LEV		0x042a
+#define RJ54N1_Y_GAIN			0x04d8
+#define RJ54N1_APT_GAIN_UP		0x04fa
+#define RJ54N1_RA_SEL_UL		0x0530
+#define RJ54N1_BYTE_SWAP		0x0531
+#define RJ54N1_OUT_SIGPO		0x053b
+#define RJ54N1_WB_SEL_WEIGHT_I		0x054e
+#define RJ54N1_BIT8_WB			0x0569
+#define RJ54N1_HCAPS_WB			0x056a
+#define RJ54N1_VCAPS_WB			0x056b
+#define RJ54N1_HCAPE_WB			0x056c
+#define RJ54N1_VCAPE_WB			0x056d
+#define RJ54N1_EXPOSURE_CONTROL		0x058c
+#define RJ54N1_FRAME_LENGTH_S_H		0x0595
+#define RJ54N1_FRAME_LENGTH_S_L		0x0596
+#define RJ54N1_FRAME_LENGTH_P_H		0x0597
+#define RJ54N1_FRAME_LENGTH_P_L		0x0598
+#define RJ54N1_PEAK_H			0x05b7
+#define RJ54N1_PEAK_50			0x05b8
+#define RJ54N1_PEAK_60			0x05b9
+#define RJ54N1_PEAK_DIFF		0x05ba
+#define RJ54N1_IOC			0x05ef
+#define RJ54N1_TG_BYPASS		0x0700
+#define RJ54N1_PLL_L			0x0701
+#define RJ54N1_PLL_N			0x0702
+#define RJ54N1_PLL_EN			0x0704
+#define RJ54N1_RATIO_TG			0x0706
+#define RJ54N1_RATIO_T			0x0707
+#define RJ54N1_RATIO_R			0x0708
+#define RJ54N1_RAMP_TGCLK_EN		0x0709
+#define RJ54N1_OCLK_DSP			0x0710
+#define RJ54N1_RATIO_OP			0x0711
+#define RJ54N1_RATIO_O			0x0712
+#define RJ54N1_OCLK_SEL_EN		0x0713
+#define RJ54N1_CLK_RST			0x0717
+#define RJ54N1_RESET_STANDBY		0x0718
+#define RJ54N1_FWFLG			0x07fe
+
+#define E_EXCLK				(1 << 7)
+#define SOFT_STDBY			(1 << 4)
+#define SEN_RSTX			(1 << 2)
+#define TG_RSTX				(1 << 1)
+#define DSP_RSTX			(1 << 0)
+
+#define RESIZE_HOLD_SEL			(1 << 2)
+#define RESIZE_GO			(1 << 1)
+
+/*
+ * When cropping, the camera automatically centers the cropped region, there
+ * doesn't seem to be a way to specify an explicit location of the rectangle.
+ */
+#define RJ54N1_COLUMN_SKIP		0
+#define RJ54N1_ROW_SKIP			0
+#define RJ54N1_MAX_WIDTH		1600
+#define RJ54N1_MAX_HEIGHT		1200
+
+#define PLL_L				2
+#define PLL_N				0x31
+
+/* I2C addresses: 0x50, 0x51, 0x60, 0x61 */
+
+/* RJ54N1CB0C has only one fixed colorspace per pixelcode */
+struct rj54n1_datafmt {
+	enum v4l2_mbus_pixelcode	code;
+	enum v4l2_colorspace		colorspace;
+};
+
+/* Find a data format by a pixel code in an array */
+static const struct rj54n1_datafmt *rj54n1_find_datafmt(
+	enum v4l2_mbus_pixelcode code, const struct rj54n1_datafmt *fmt,
+	int n)
+{
+	int i;
+	for (i = 0; i < n; i++)
+		if (fmt[i].code == code)
+			return fmt + i;
+
+	return NULL;
+}
+
+static const struct rj54n1_datafmt rj54n1_colour_fmts[] = {
+	{V4L2_MBUS_FMT_YUYV8_2X8_LE, V4L2_COLORSPACE_JPEG},
+	{V4L2_MBUS_FMT_YVYU8_2X8_LE, V4L2_COLORSPACE_JPEG},
+	{V4L2_MBUS_FMT_RGB565_2X8_LE, V4L2_COLORSPACE_SRGB},
+	{V4L2_MBUS_FMT_RGB565_2X8_BE, V4L2_COLORSPACE_SRGB},
+	{V4L2_MBUS_FMT_SBGGR10_2X8_PADHI_LE, V4L2_COLORSPACE_SRGB},
+	{V4L2_MBUS_FMT_SBGGR10_2X8_PADLO_LE, V4L2_COLORSPACE_SRGB},
+	{V4L2_MBUS_FMT_SBGGR10_2X8_PADHI_BE, V4L2_COLORSPACE_SRGB},
+	{V4L2_MBUS_FMT_SBGGR10_2X8_PADLO_BE, V4L2_COLORSPACE_SRGB},
+	{V4L2_MBUS_FMT_SBGGR10_1X10, V4L2_COLORSPACE_SRGB},
+};
+
+struct rj54n1_clock_div {
+	u8 ratio_tg;	/* can be 0 or an odd number */
+	u8 ratio_t;
+	u8 ratio_r;
+	u8 ratio_op;
+	u8 ratio_o;
+};
+
+struct rj54n1 {
+	struct v4l2_subdev subdev;
+	struct rj54n1_clock_div clk_div;
+	const struct rj54n1_datafmt *fmt;
+	struct v4l2_rect rect;	/* Sensor window */
+	unsigned int tgclk_mhz;
+	bool auto_wb;
+	unsigned short width;	/* Output window */
+	unsigned short height;
+	unsigned short resize;	/* Sensor * 1024 / resize = Output */
+	unsigned short scale;
+	u8 bank;
+};
+
+struct rj54n1_reg_val {
+	u16 reg;
+	u8 val;
+};
+
+const static struct rj54n1_reg_val bank_4[] = {
+	{0x417, 0},
+	{0x42c, 0},
+	{0x42d, 0xf0},
+	{0x42e, 0},
+	{0x42f, 0x50},
+	{0x430, 0xf5},
+	{0x431, 0x16},
+	{0x432, 0x20},
+	{0x433, 0},
+	{0x434, 0xc8},
+	{0x43c, 8},
+	{0x43e, 0x90},
+	{0x445, 0x83},
+	{0x4ba, 0x58},
+	{0x4bb, 4},
+	{0x4bc, 0x20},
+	{0x4db, 4},
+	{0x4fe, 2},
+};
+
+const static struct rj54n1_reg_val bank_5[] = {
+	{0x514, 0},
+	{0x516, 0},
+	{0x518, 0},
+	{0x51a, 0},
+	{0x51d, 0xff},
+	{0x56f, 0x28},
+	{0x575, 0x40},
+	{0x5bc, 0x48},
+	{0x5c1, 6},
+	{0x5e5, 0x11},
+	{0x5e6, 0x43},
+	{0x5e7, 0x33},
+	{0x5e8, 0x21},
+	{0x5e9, 0x30},
+	{0x5ea, 0x0},
+	{0x5eb, 0xa5},
+	{0x5ec, 0xff},
+	{0x5fe, 2},
+};
+
+const static struct rj54n1_reg_val bank_7[] = {
+	{0x70a, 0},
+	{0x714, 0xff},
+	{0x715, 0xff},
+	{0x716, 0x1f},
+	{0x7FE, 2},
+};
+
+const static struct rj54n1_reg_val bank_8[] = {
+	{0x800, 0x00},
+	{0x801, 0x01},
+	{0x802, 0x61},
+	{0x805, 0x00},
+	{0x806, 0x00},
+	{0x807, 0x00},
+	{0x808, 0x00},
+	{0x809, 0x01},
+	{0x80A, 0x61},
+	{0x80B, 0x00},
+	{0x80C, 0x01},
+	{0x80D, 0x00},
+	{0x80E, 0x00},
+	{0x80F, 0x00},
+	{0x810, 0x00},
+	{0x811, 0x01},
+	{0x812, 0x61},
+	{0x813, 0x00},
+	{0x814, 0x11},
+	{0x815, 0x00},
+	{0x816, 0x41},
+	{0x817, 0x00},
+	{0x818, 0x51},
+	{0x819, 0x01},
+	{0x81A, 0x1F},
+	{0x81B, 0x00},
+	{0x81C, 0x01},
+	{0x81D, 0x00},
+	{0x81E, 0x11},
+	{0x81F, 0x00},
+	{0x820, 0x41},
+	{0x821, 0x00},
+	{0x822, 0x51},
+	{0x823, 0x00},
+	{0x824, 0x00},
+	{0x825, 0x00},
+	{0x826, 0x47},
+	{0x827, 0x01},
+	{0x828, 0x4F},
+	{0x829, 0x00},
+	{0x82A, 0x00},
+	{0x82B, 0x00},
+	{0x82C, 0x30},
+	{0x82D, 0x00},
+	{0x82E, 0x40},
+	{0x82F, 0x00},
+	{0x830, 0xB3},
+	{0x831, 0x00},
+	{0x832, 0xE3},
+	{0x833, 0x00},
+	{0x834, 0x00},
+	{0x835, 0x00},
+	{0x836, 0x00},
+	{0x837, 0x00},
+	{0x838, 0x00},
+	{0x839, 0x01},
+	{0x83A, 0x61},
+	{0x83B, 0x00},
+	{0x83C, 0x01},
+	{0x83D, 0x00},
+	{0x83E, 0x00},
+	{0x83F, 0x00},
+	{0x840, 0x00},
+	{0x841, 0x01},
+	{0x842, 0x61},
+	{0x843, 0x00},
+	{0x844, 0x1D},
+	{0x845, 0x00},
+	{0x846, 0x00},
+	{0x847, 0x00},
+	{0x848, 0x00},
+	{0x849, 0x01},
+	{0x84A, 0x1F},
+	{0x84B, 0x00},
+	{0x84C, 0x05},
+	{0x84D, 0x00},
+	{0x84E, 0x19},
+	{0x84F, 0x01},
+	{0x850, 0x21},
+	{0x851, 0x01},
+	{0x852, 0x5D},
+	{0x853, 0x00},
+	{0x854, 0x00},
+	{0x855, 0x00},
+	{0x856, 0x19},
+	{0x857, 0x01},
+	{0x858, 0x21},
+	{0x859, 0x00},
+	{0x85A, 0x00},
+	{0x85B, 0x00},
+	{0x85C, 0x00},
+	{0x85D, 0x00},
+	{0x85E, 0x00},
+	{0x85F, 0x00},
+	{0x860, 0xB3},
+	{0x861, 0x00},
+	{0x862, 0xE3},
+	{0x863, 0x00},
+	{0x864, 0x00},
+	{0x865, 0x00},
+	{0x866, 0x00},
+	{0x867, 0x00},
+	{0x868, 0x00},
+	{0x869, 0xE2},
+	{0x86A, 0x00},
+	{0x86B, 0x01},
+	{0x86C, 0x06},
+	{0x86D, 0x00},
+	{0x86E, 0x00},
+	{0x86F, 0x00},
+	{0x870, 0x60},
+	{0x871, 0x8C},
+	{0x872, 0x10},
+	{0x873, 0x00},
+	{0x874, 0xE0},
+	{0x875, 0x00},
+	{0x876, 0x27},
+	{0x877, 0x01},
+	{0x878, 0x00},
+	{0x879, 0x00},
+	{0x87A, 0x00},
+	{0x87B, 0x03},
+	{0x87C, 0x00},
+	{0x87D, 0x00},
+	{0x87E, 0x00},
+	{0x87F, 0x00},
+	{0x880, 0x00},
+	{0x881, 0x00},
+	{0x882, 0x00},
+	{0x883, 0x00},
+	{0x884, 0x00},
+	{0x885, 0x00},
+	{0x886, 0xF8},
+	{0x887, 0x00},
+	{0x888, 0x03},
+	{0x889, 0x00},
+	{0x88A, 0x64},
+	{0x88B, 0x00},
+	{0x88C, 0x03},
+	{0x88D, 0x00},
+	{0x88E, 0xB1},
+	{0x88F, 0x00},
+	{0x890, 0x03},
+	{0x891, 0x01},
+	{0x892, 0x1D},
+	{0x893, 0x00},
+	{0x894, 0x03},
+	{0x895, 0x01},
+	{0x896, 0x4B},
+	{0x897, 0x00},
+	{0x898, 0xE5},
+	{0x899, 0x00},
+	{0x89A, 0x01},
+	{0x89B, 0x00},
+	{0x89C, 0x01},
+	{0x89D, 0x04},
+	{0x89E, 0xC8},
+	{0x89F, 0x00},
+	{0x8A0, 0x01},
+	{0x8A1, 0x01},
+	{0x8A2, 0x61},
+	{0x8A3, 0x00},
+	{0x8A4, 0x01},
+	{0x8A5, 0x00},
+	{0x8A6, 0x00},
+	{0x8A7, 0x00},
+	{0x8A8, 0x00},
+	{0x8A9, 0x00},
+	{0x8AA, 0x7F},
+	{0x8AB, 0x03},
+	{0x8AC, 0x00},
+	{0x8AD, 0x00},
+	{0x8AE, 0x00},
+	{0x8AF, 0x00},
+	{0x8B0, 0x00},
+	{0x8B1, 0x00},
+	{0x8B6, 0x00},
+	{0x8B7, 0x01},
+	{0x8B8, 0x00},
+	{0x8B9, 0x00},
+	{0x8BA, 0x02},
+	{0x8BB, 0x00},
+	{0x8BC, 0xFF},
+	{0x8BD, 0x00},
+	{0x8FE, 2},
+};
+
+const static struct rj54n1_reg_val bank_10[] = {
+	{0x10bf, 0x69}
+};
+
+/* Clock dividers - these are default register values, divider = register + 1 */
+const static struct rj54n1_clock_div clk_div = {
+	.ratio_tg	= 3 /* default: 5 */,
+	.ratio_t	= 4 /* default: 1 */,
+	.ratio_r	= 4 /* default: 0 */,
+	.ratio_op	= 1 /* default: 5 */,
+	.ratio_o	= 9 /* default: 0 */,
+};
+
+static struct rj54n1 *to_rj54n1(const struct i2c_client *client)
+{
+	return container_of(i2c_get_clientdata(client), struct rj54n1, subdev);
+}
+
+static int reg_read(struct i2c_client *client, const u16 reg)
+{
+	struct rj54n1 *rj54n1 = to_rj54n1(client);
+	int ret;
+
+	/* set bank */
+	if (rj54n1->bank != reg >> 8) {
+		dev_dbg(&client->dev, "[0x%x] = 0x%x\n", 0xff, reg >> 8);
+		ret = i2c_smbus_write_byte_data(client, 0xff, reg >> 8);
+		if (ret < 0)
+			return ret;
+		rj54n1->bank = reg >> 8;
+	}
+	return i2c_smbus_read_byte_data(client, reg & 0xff);
+}
+
+static int reg_write(struct i2c_client *client, const u16 reg,
+		     const u8 data)
+{
+	struct rj54n1 *rj54n1 = to_rj54n1(client);
+	int ret;
+
+	/* set bank */
+	if (rj54n1->bank != reg >> 8) {
+		dev_dbg(&client->dev, "[0x%x] = 0x%x\n", 0xff, reg >> 8);
+		ret = i2c_smbus_write_byte_data(client, 0xff, reg >> 8);
+		if (ret < 0)
+			return ret;
+		rj54n1->bank = reg >> 8;
+	}
+	dev_dbg(&client->dev, "[0x%x] = 0x%x\n", reg & 0xff, data);
+	return i2c_smbus_write_byte_data(client, reg & 0xff, data);
+}
+
+static int reg_set(struct i2c_client *client, const u16 reg,
+		   const u8 data, const u8 mask)
+{
+	int ret;
+
+	ret = reg_read(client, reg);
+	if (ret < 0)
+		return ret;
+	return reg_write(client, reg, (ret & ~mask) | (data & mask));
+}
+
+static int reg_write_multiple(struct i2c_client *client,
+			      const struct rj54n1_reg_val *rv, const int n)
+{
+	int i, ret;
+
+	for (i = 0; i < n; i++) {
+		ret = reg_write(client, rv->reg, rv->val);
+		if (ret < 0)
+			return ret;
+		rv++;
+	}
+
+	return 0;
+}
+
+static int rj54n1_enum_fmt(struct v4l2_subdev *sd, int index,
+			   enum v4l2_mbus_pixelcode *code)
+{
+	if ((unsigned int)index >= ARRAY_SIZE(rj54n1_colour_fmts))
+		return -EINVAL;
+
+	*code = rj54n1_colour_fmts[index].code;
+	return 0;
+}
+
+static int rj54n1_s_stream(struct v4l2_subdev *sd, int enable)
+{
+	struct i2c_client *client = sd->priv;
+
+	/* Switch between preview and still shot modes */
+	return reg_set(client, RJ54N1_STILL_CONTROL, (!enable) << 7, 0x80);
+}
+
+static int rj54n1_set_bus_param(struct soc_camera_device *icd,
+				unsigned long flags)
+{
+	struct v4l2_subdev *sd = soc_camera_to_subdev(icd);
+	struct i2c_client *client = sd->priv;
+	/* Figures 2.5-1 to 2.5-3 - default falling pixclk edge */
+
+	if (flags & SOCAM_PCLK_SAMPLE_RISING)
+		return reg_write(client, RJ54N1_OUT_SIGPO, 1 << 4);
+	else
+		return reg_write(client, RJ54N1_OUT_SIGPO, 0);
+}
+
+static unsigned long rj54n1_query_bus_param(struct soc_camera_device *icd)
+{
+	struct soc_camera_link *icl = to_soc_camera_link(icd);
+	const unsigned long flags =
+		SOCAM_PCLK_SAMPLE_RISING | SOCAM_PCLK_SAMPLE_FALLING |
+		SOCAM_MASTER | SOCAM_DATAWIDTH_8 |
+		SOCAM_HSYNC_ACTIVE_HIGH | SOCAM_VSYNC_ACTIVE_HIGH |
+		SOCAM_DATA_ACTIVE_HIGH;
+
+	return soc_camera_apply_sensor_flags(icl, flags);
+}
+
+static int rj54n1_set_rect(struct i2c_client *client,
+			   u16 reg_x, u16 reg_y, u16 reg_xy,
+			   u32 width, u32 height)
+{
+	int ret;
+
+	ret = reg_write(client, reg_xy,
+			((width >> 4) & 0x70) |
+			((height >> 8) & 7));
+
+	if (!ret)
+		ret = reg_write(client, reg_x, width & 0xff);
+	if (!ret)
+		ret = reg_write(client, reg_y, height & 0xff);
+
+	return ret;
+}
+
+/*
+ * Some commands, specifically certain initialisation sequences, require
+ * a commit operation.
+ */
+static int rj54n1_commit(struct i2c_client *client)
+{
+	int ret = reg_write(client, RJ54N1_INIT_START, 1);
+	msleep(10);
+	if (!ret)
+		ret = reg_write(client, RJ54N1_INIT_START, 0);
+	return ret;
+}
+
+static int rj54n1_sensor_scale(struct v4l2_subdev *sd, u32 *in_w, u32 *in_h,
+			       u32 *out_w, u32 *out_h);
+
+static int rj54n1_s_crop(struct v4l2_subdev *sd, struct v4l2_crop *a)
+{
+	struct i2c_client *client = sd->priv;
+	struct rj54n1 *rj54n1 = to_rj54n1(client);
+	struct v4l2_rect *rect = &a->c;
+	unsigned int dummy = 0, output_w, output_h,
+		input_w = rect->width, input_h = rect->height;
+	int ret;
+
+	/* arbitrary minimum width and height, edges unimportant */
+	soc_camera_limit_side(&dummy, &input_w,
+		     RJ54N1_COLUMN_SKIP, 8, RJ54N1_MAX_WIDTH);
+
+	soc_camera_limit_side(&dummy, &input_h,
+		     RJ54N1_ROW_SKIP, 8, RJ54N1_MAX_HEIGHT);
+
+	output_w = (input_w * 1024 + rj54n1->resize / 2) / rj54n1->resize;
+	output_h = (input_h * 1024 + rj54n1->resize / 2) / rj54n1->resize;
+
+	dev_dbg(&client->dev, "Scaling for %ux%u : %u = %ux%u\n",
+		input_w, input_h, rj54n1->resize, output_w, output_h);
+
+	ret = rj54n1_sensor_scale(sd, &input_w, &input_h, &output_w, &output_h);
+	if (ret < 0)
+		return ret;
+
+	rj54n1->width		= output_w;
+	rj54n1->height		= output_h;
+	rj54n1->resize		= ret;
+	rj54n1->rect.width	= input_w;
+	rj54n1->rect.height	= input_h;
+
+	return 0;
+}
+
+static int rj54n1_g_crop(struct v4l2_subdev *sd, struct v4l2_crop *a)
+{
+	struct i2c_client *client = sd->priv;
+	struct rj54n1 *rj54n1 = to_rj54n1(client);
+
+	a->c	= rj54n1->rect;
+	a->type	= V4L2_BUF_TYPE_VIDEO_CAPTURE;
+
+	return 0;
+}
+
+static int rj54n1_cropcap(struct v4l2_subdev *sd, struct v4l2_cropcap *a)
+{
+	a->bounds.left			= RJ54N1_COLUMN_SKIP;
+	a->bounds.top			= RJ54N1_ROW_SKIP;
+	a->bounds.width			= RJ54N1_MAX_WIDTH;
+	a->bounds.height		= RJ54N1_MAX_HEIGHT;
+	a->defrect			= a->bounds;
+	a->type				= V4L2_BUF_TYPE_VIDEO_CAPTURE;
+	a->pixelaspect.numerator	= 1;
+	a->pixelaspect.denominator	= 1;
+
+	return 0;
+}
+
+static int rj54n1_g_fmt(struct v4l2_subdev *sd,
+			struct v4l2_mbus_framefmt *mf)
+{
+	struct i2c_client *client = sd->priv;
+	struct rj54n1 *rj54n1 = to_rj54n1(client);
+
+	mf->code	= rj54n1->fmt->code;
+	mf->colorspace	= rj54n1->fmt->colorspace;
+	mf->field	= V4L2_FIELD_NONE;
+	mf->width	= rj54n1->width;
+	mf->height	= rj54n1->height;
+
+	return 0;
+}
+
+/*
+ * The actual geometry configuration routine. It scales the input window into
+ * the output one, updates the window sizes and returns an error or the resize
+ * coefficient on success. Note: we only use the "Fixed Scaling" on this camera.
+ */
+static int rj54n1_sensor_scale(struct v4l2_subdev *sd, u32 *in_w, u32 *in_h,
+			       u32 *out_w, u32 *out_h)
+{
+	struct i2c_client *client = sd->priv;
+	struct rj54n1 *rj54n1 = to_rj54n1(client);
+	unsigned int skip, resize, input_w = *in_w, input_h = *in_h,
+		output_w = *out_w, output_h = *out_h;
+	u16 inc_sel, wb_bit8, wb_left, wb_right, wb_top, wb_bottom;
+	unsigned int peak, peak_50, peak_60;
+	int ret;
+
+	/*
+	 * We have a problem with crops, where the window is larger than 512x384
+	 * and output window is larger than a half of the input one. In this
+	 * case we have to either reduce the input window to equal or below
+	 * 512x384 or the output window to equal or below 1/2 of the input.
+	 */
+	if (output_w > max(512U, input_w / 2)) {
+		if (2 * output_w > RJ54N1_MAX_WIDTH) {
+			input_w = RJ54N1_MAX_WIDTH;
+			output_w = RJ54N1_MAX_WIDTH / 2;
+		} else {
+			input_w = output_w * 2;
+		}
+
+		dev_dbg(&client->dev, "Adjusted output width: in %u, out %u\n",
+			input_w, output_w);
+	}
+
+	if (output_h > max(384U, input_h / 2)) {
+		if (2 * output_h > RJ54N1_MAX_HEIGHT) {
+			input_h = RJ54N1_MAX_HEIGHT;
+			output_h = RJ54N1_MAX_HEIGHT / 2;
+		} else {
+			input_h = output_h * 2;
+		}
+
+		dev_dbg(&client->dev, "Adjusted output height: in %u, out %u\n",
+			input_h, output_h);
+	}
+
+	/* Idea: use the read mode for snapshots, handle separate geometries */
+	ret = rj54n1_set_rect(client, RJ54N1_X_OUTPUT_SIZE_S_L,
+			      RJ54N1_Y_OUTPUT_SIZE_S_L,
+			      RJ54N1_XY_OUTPUT_SIZE_S_H, output_w, output_h);
+	if (!ret)
+		ret = rj54n1_set_rect(client, RJ54N1_X_OUTPUT_SIZE_P_L,
+			      RJ54N1_Y_OUTPUT_SIZE_P_L,
+			      RJ54N1_XY_OUTPUT_SIZE_P_H, output_w, output_h);
+
+	if (ret < 0)
+		return ret;
+
+	if (output_w > input_w && output_h > input_h) {
+		input_w = output_w;
+		input_h = output_h;
+
+		resize = 1024;
+	} else {
+		unsigned int resize_x, resize_y;
+		resize_x = (input_w * 1024 + output_w / 2) / output_w;
+		resize_y = (input_h * 1024 + output_h / 2) / output_h;
+
+		/* We want max(resize_x, resize_y), check if it still fits */
+		if (resize_x > resize_y &&
+		    (output_h * resize_x + 512) / 1024 > RJ54N1_MAX_HEIGHT)
+			resize = (RJ54N1_MAX_HEIGHT * 1024 + output_h / 2) /
+				output_h;
+		else if (resize_y > resize_x &&
+			 (output_w * resize_y + 512) / 1024 > RJ54N1_MAX_WIDTH)
+			resize = (RJ54N1_MAX_WIDTH * 1024 + output_w / 2) /
+				output_w;
+		else
+			resize = max(resize_x, resize_y);
+
+		/* Prohibited value ranges */
+		switch (resize) {
+		case 2040 ... 2047:
+			resize = 2039;
+			break;
+		case 4080 ... 4095:
+			resize = 4079;
+			break;
+		case 8160 ... 8191:
+			resize = 8159;
+			break;
+		case 16320 ... 16384:
+			resize = 16319;
+		}
+	}
+
+	/* Set scaling */
+	ret = reg_write(client, RJ54N1_RESIZE_HOLD_L, resize & 0xff);
+	if (!ret)
+		ret = reg_write(client, RJ54N1_RESIZE_HOLD_H, resize >> 8);
+
+	if (ret < 0)
+		return ret;
+
+	/*
+	 * Configure a skipping bitmask. The sensor will select a skipping value
+	 * among set bits automatically. This is very unclear in the datasheet
+	 * too. I was told, in this register one enables all skipping values,
+	 * that are required for a specific resize, and the camera selects
+	 * automatically, which ones to use. But it is unclear how to identify,
+	 * which cropping values are needed. Secondly, why don't we just set all
+	 * bits and let the camera choose? Would it increase processing time and
+	 * reduce the framerate? Using 0xfffc for INC_USE_SEL doesn't seem to
+	 * improve the image quality or stability for larger frames (see comment
+	 * above), but I didn't check the framerate.
+	 */
+	skip = min(resize / 1024, (unsigned)15);
+
+	inc_sel = 1 << skip;
+
+	if (inc_sel <= 2)
+		inc_sel = 0xc;
+	else if (resize & 1023 && skip < 15)
+		inc_sel |= 1 << (skip + 1);
+
+	ret = reg_write(client, RJ54N1_INC_USE_SEL_L, inc_sel & 0xfc);
+	if (!ret)
+		ret = reg_write(client, RJ54N1_INC_USE_SEL_H, inc_sel >> 8);
+
+	if (!rj54n1->auto_wb) {
+		/* Auto white balance window */
+		wb_left	  = output_w / 16;
+		wb_right  = (3 * output_w / 4 - 3) / 4;
+		wb_top	  = output_h / 16;
+		wb_bottom = (3 * output_h / 4 - 3) / 4;
+		wb_bit8	  = ((wb_left >> 2) & 0x40) | ((wb_top >> 4) & 0x10) |
+			((wb_right >> 6) & 4) | ((wb_bottom >> 8) & 1);
+
+		if (!ret)
+			ret = reg_write(client, RJ54N1_BIT8_WB, wb_bit8);
+		if (!ret)
+			ret = reg_write(client, RJ54N1_HCAPS_WB, wb_left);
+		if (!ret)
+			ret = reg_write(client, RJ54N1_VCAPS_WB, wb_top);
+		if (!ret)
+			ret = reg_write(client, RJ54N1_HCAPE_WB, wb_right);
+		if (!ret)
+			ret = reg_write(client, RJ54N1_VCAPE_WB, wb_bottom);
+	}
+
+	/* Antiflicker */
+	peak = 12 * RJ54N1_MAX_WIDTH * (1 << 14) * resize / rj54n1->tgclk_mhz /
+		10000;
+	peak_50 = peak / 6;
+	peak_60 = peak / 5;
+
+	if (!ret)
+		ret = reg_write(client, RJ54N1_PEAK_H,
+				((peak_50 >> 4) & 0xf0) | (peak_60 >> 8));
+	if (!ret)
+		ret = reg_write(client, RJ54N1_PEAK_50, peak_50);
+	if (!ret)
+		ret = reg_write(client, RJ54N1_PEAK_60, peak_60);
+	if (!ret)
+		ret = reg_write(client, RJ54N1_PEAK_DIFF, peak / 150);
+
+	/* Start resizing */
+	if (!ret)
+		ret = reg_write(client, RJ54N1_RESIZE_CONTROL,
+				RESIZE_HOLD_SEL | RESIZE_GO | 1);
+
+	if (ret < 0)
+		return ret;
+
+	/* Constant taken from manufacturer's example */
+	msleep(230);
+
+	ret = reg_write(client, RJ54N1_RESIZE_CONTROL, RESIZE_HOLD_SEL | 1);
+	if (ret < 0)
+		return ret;
+
+	*in_w = (output_w * resize + 512) / 1024;
+	*in_h = (output_h * resize + 512) / 1024;
+	*out_w = output_w;
+	*out_h = output_h;
+
+	dev_dbg(&client->dev, "Scaled for %ux%u : %u = %ux%u, skip %u\n",
+		*in_w, *in_h, resize, output_w, output_h, skip);
+
+	return resize;
+}
+
+static int rj54n1_set_clock(struct i2c_client *client)
+{
+	struct rj54n1 *rj54n1 = to_rj54n1(client);
+	int ret;
+
+	/* Enable external clock */
+	ret = reg_write(client, RJ54N1_RESET_STANDBY, E_EXCLK | SOFT_STDBY);
+	/* Leave stand-by. Note: use this when implementing suspend / resume */
+	if (!ret)
+		ret = reg_write(client, RJ54N1_RESET_STANDBY, E_EXCLK);
+
+	if (!ret)
+		ret = reg_write(client, RJ54N1_PLL_L, PLL_L);
+	if (!ret)
+		ret = reg_write(client, RJ54N1_PLL_N, PLL_N);
+
+	/* TGCLK dividers */
+	if (!ret)
+		ret = reg_write(client, RJ54N1_RATIO_TG,
+				rj54n1->clk_div.ratio_tg);
+	if (!ret)
+		ret = reg_write(client, RJ54N1_RATIO_T,
+				rj54n1->clk_div.ratio_t);
+	if (!ret)
+		ret = reg_write(client, RJ54N1_RATIO_R,
+				rj54n1->clk_div.ratio_r);
+
+	/* Enable TGCLK & RAMP */
+	if (!ret)
+		ret = reg_write(client, RJ54N1_RAMP_TGCLK_EN, 3);
+
+	/* Disable clock output */
+	if (!ret)
+		ret = reg_write(client, RJ54N1_OCLK_DSP, 0);
+
+	/* Set divisors */
+	if (!ret)
+		ret = reg_write(client, RJ54N1_RATIO_OP,
+				rj54n1->clk_div.ratio_op);
+	if (!ret)
+		ret = reg_write(client, RJ54N1_RATIO_O,
+				rj54n1->clk_div.ratio_o);
+
+	/* Enable OCLK */
+	if (!ret)
+		ret = reg_write(client, RJ54N1_OCLK_SEL_EN, 1);
+
+	/* Use PLL for Timing Generator, write 2 to reserved bits */
+	if (!ret)
+		ret = reg_write(client, RJ54N1_TG_BYPASS, 2);
+
+	/* Take sensor out of reset */
+	if (!ret)
+		ret = reg_write(client, RJ54N1_RESET_STANDBY,
+				E_EXCLK | SEN_RSTX);
+	/* Enable PLL */
+	if (!ret)
+		ret = reg_write(client, RJ54N1_PLL_EN, 1);
+
+	/* Wait for PLL to stabilise */
+	msleep(10);
+
+	/* Enable clock to frequency divider */
+	if (!ret)
+		ret = reg_write(client, RJ54N1_CLK_RST, 1);
+
+	if (!ret)
+		ret = reg_read(client, RJ54N1_CLK_RST);
+	if (ret != 1) {
+		dev_err(&client->dev,
+			"Resetting RJ54N1CB0C clock failed: %d!\n", ret);
+		return -EIO;
+	}
+
+	/* Start the PLL */
+	ret = reg_set(client, RJ54N1_OCLK_DSP, 1, 1);
+
+	/* Enable OCLK */
+	if (!ret)
+		ret = reg_write(client, RJ54N1_OCLK_SEL_EN, 1);
+
+	return ret;
+}
+
+static int rj54n1_reg_init(struct i2c_client *client)
+{
+	struct rj54n1 *rj54n1 = to_rj54n1(client);
+	int ret = rj54n1_set_clock(client);
+
+	if (!ret)
+		ret = reg_write_multiple(client, bank_7, ARRAY_SIZE(bank_7));
+	if (!ret)
+		ret = reg_write_multiple(client, bank_10, ARRAY_SIZE(bank_10));
+
+	/* Set binning divisors */
+	if (!ret)
+		ret = reg_write(client, RJ54N1_SCALE_1_2_LEV, 3 | (7 << 4));
+	if (!ret)
+		ret = reg_write(client, RJ54N1_SCALE_4_LEV, 0xf);
+
+	/* Switch to fixed resize mode */
+	if (!ret)
+		ret = reg_write(client, RJ54N1_RESIZE_CONTROL,
+				RESIZE_HOLD_SEL | 1);
+
+	/* Set gain */
+	if (!ret)
+		ret = reg_write(client, RJ54N1_Y_GAIN, 0x84);
+
+	/*
+	 * Mirror the image back: default is upside down and left-to-right...
+	 * Set manual preview / still shot switching
+	 */
+	if (!ret)
+		ret = reg_write(client, RJ54N1_MIRROR_STILL_MODE, 0x27);
+
+	if (!ret)
+		ret = reg_write_multiple(client, bank_4, ARRAY_SIZE(bank_4));
+
+	/* Auto exposure area */
+	if (!ret)
+		ret = reg_write(client, RJ54N1_EXPOSURE_CONTROL, 0x80);
+	/* Check current auto WB config */
+	if (!ret)
+		ret = reg_read(client, RJ54N1_WB_SEL_WEIGHT_I);
+	if (ret >= 0) {
+		rj54n1->auto_wb = ret & 0x80;
+		ret = reg_write_multiple(client, bank_5, ARRAY_SIZE(bank_5));
+	}
+	if (!ret)
+		ret = reg_write_multiple(client, bank_8, ARRAY_SIZE(bank_8));
+
+	if (!ret)
+		ret = reg_write(client, RJ54N1_RESET_STANDBY,
+				E_EXCLK | DSP_RSTX | SEN_RSTX);
+
+	/* Commit init */
+	if (!ret)
+		ret = rj54n1_commit(client);
+
+	/* Take DSP, TG, sensor out of reset */
+	if (!ret)
+		ret = reg_write(client, RJ54N1_RESET_STANDBY,
+				E_EXCLK | DSP_RSTX | TG_RSTX | SEN_RSTX);
+
+	/* Start register update? Same register as 0x?FE in many bank_* sets */
+	if (!ret)
+		ret = reg_write(client, RJ54N1_FWFLG, 2);
+
+	/* Constant taken from manufacturer's example */
+	msleep(700);
+
+	return ret;
+}
+
+static int rj54n1_try_fmt(struct v4l2_subdev *sd,
+			  struct v4l2_mbus_framefmt *mf)
+{
+	struct i2c_client *client = sd->priv;
+	struct rj54n1 *rj54n1 = to_rj54n1(client);
+	const struct rj54n1_datafmt *fmt;
+	int align = mf->code == V4L2_MBUS_FMT_SBGGR10_1X10 ||
+		mf->code == V4L2_MBUS_FMT_SBGGR10_2X8_PADHI_BE ||
+		mf->code == V4L2_MBUS_FMT_SBGGR10_2X8_PADLO_BE ||
+		mf->code == V4L2_MBUS_FMT_SBGGR10_2X8_PADHI_LE ||
+		mf->code == V4L2_MBUS_FMT_SBGGR10_2X8_PADLO_LE;
+
+	dev_dbg(&client->dev, "%s: code = %d, width = %u, height = %u\n",
+		__func__, mf->code, mf->width, mf->height);
+
+	fmt = rj54n1_find_datafmt(mf->code, rj54n1_colour_fmts,
+				  ARRAY_SIZE(rj54n1_colour_fmts));
+	if (!fmt) {
+		fmt = rj54n1->fmt;
+		mf->code = fmt->code;
+	}
+
+	mf->field	= V4L2_FIELD_NONE;
+	mf->colorspace	= fmt->colorspace;
+
+	v4l_bound_align_image(&mf->width, 112, RJ54N1_MAX_WIDTH, align,
+			      &mf->height, 84, RJ54N1_MAX_HEIGHT, align, 0);
+
+	return 0;
+}
+
+static int rj54n1_s_fmt(struct v4l2_subdev *sd,
+			struct v4l2_mbus_framefmt *mf)
+{
+	struct i2c_client *client = sd->priv;
+	struct rj54n1 *rj54n1 = to_rj54n1(client);
+	const struct rj54n1_datafmt *fmt;
+	unsigned int output_w, output_h, max_w, max_h,
+		input_w = rj54n1->rect.width, input_h = rj54n1->rect.height;
+	int ret;
+
+	/*
+	 * The host driver can call us without .try_fmt(), so, we have to take
+	 * care ourseleves
+	 */
+	rj54n1_try_fmt(sd, mf);
+
+	/*
+	 * Verify if the sensor has just been powered on. TODO: replace this
+	 * with proper PM, when a suitable API is available.
+	 */
+	ret = reg_read(client, RJ54N1_RESET_STANDBY);
+	if (ret < 0)
+		return ret;
+
+	if (!(ret & E_EXCLK)) {
+		ret = rj54n1_reg_init(client);
+		if (ret < 0)
+			return ret;
+	}
+
+	dev_dbg(&client->dev, "%s: code = %d, width = %u, height = %u\n",
+		__func__, mf->code, mf->width, mf->height);
+
+	/* RA_SEL_UL is only relevant for raw modes, ignored otherwise. */
+	switch (mf->code) {
+	case V4L2_MBUS_FMT_YUYV8_2X8_LE:
+		ret = reg_write(client, RJ54N1_OUT_SEL, 0);
+		if (!ret)
+			ret = reg_set(client, RJ54N1_BYTE_SWAP, 8, 8);
+		break;
+	case V4L2_MBUS_FMT_YVYU8_2X8_LE:
+		ret = reg_write(client, RJ54N1_OUT_SEL, 0);
+		if (!ret)
+			ret = reg_set(client, RJ54N1_BYTE_SWAP, 0, 8);
+		break;
+	case V4L2_MBUS_FMT_RGB565_2X8_LE:
+		ret = reg_write(client, RJ54N1_OUT_SEL, 0x11);
+		if (!ret)
+			ret = reg_set(client, RJ54N1_BYTE_SWAP, 8, 8);
+		break;
+	case V4L2_MBUS_FMT_RGB565_2X8_BE:
+		ret = reg_write(client, RJ54N1_OUT_SEL, 0x11);
+		if (!ret)
+			ret = reg_set(client, RJ54N1_BYTE_SWAP, 0, 8);
+		break;
+	case V4L2_MBUS_FMT_SBGGR10_2X8_PADLO_LE:
+		ret = reg_write(client, RJ54N1_OUT_SEL, 4);
+		if (!ret)
+			ret = reg_set(client, RJ54N1_BYTE_SWAP, 8, 8);
+		if (!ret)
+			ret = reg_write(client, RJ54N1_RA_SEL_UL, 0);
+		break;
+	case V4L2_MBUS_FMT_SBGGR10_2X8_PADHI_LE:
+		ret = reg_write(client, RJ54N1_OUT_SEL, 4);
+		if (!ret)
+			ret = reg_set(client, RJ54N1_BYTE_SWAP, 8, 8);
+		if (!ret)
+			ret = reg_write(client, RJ54N1_RA_SEL_UL, 8);
+		break;
+	case V4L2_MBUS_FMT_SBGGR10_2X8_PADLO_BE:
+		ret = reg_write(client, RJ54N1_OUT_SEL, 4);
+		if (!ret)
+			ret = reg_set(client, RJ54N1_BYTE_SWAP, 0, 8);
+		if (!ret)
+			ret = reg_write(client, RJ54N1_RA_SEL_UL, 0);
+		break;
+	case V4L2_MBUS_FMT_SBGGR10_2X8_PADHI_BE:
+		ret = reg_write(client, RJ54N1_OUT_SEL, 4);
+		if (!ret)
+			ret = reg_set(client, RJ54N1_BYTE_SWAP, 0, 8);
+		if (!ret)
+			ret = reg_write(client, RJ54N1_RA_SEL_UL, 8);
+		break;
+	case V4L2_MBUS_FMT_SBGGR10_1X10:
+		ret = reg_write(client, RJ54N1_OUT_SEL, 5);
+		break;
+	default:
+		ret = -EINVAL;
+	}
+
+	/* Special case: a raw mode with 10 bits of data per clock tick */
+	if (!ret)
+		ret = reg_set(client, RJ54N1_OCLK_SEL_EN,
+			      (mf->code == V4L2_MBUS_FMT_SBGGR10_1X10) << 1, 2);
+
+	if (ret < 0)
+		return ret;
+
+	/* Supported scales 1:1 >= scale > 1:16 */
+	max_w = mf->width * (16 * 1024 - 1) / 1024;
+	if (input_w > max_w)
+		input_w = max_w;
+	max_h = mf->height * (16 * 1024 - 1) / 1024;
+	if (input_h > max_h)
+		input_h = max_h;
+
+	output_w = mf->width;
+	output_h = mf->height;
+
+	ret = rj54n1_sensor_scale(sd, &input_w, &input_h, &output_w, &output_h);
+	if (ret < 0)
+		return ret;
+
+	fmt = rj54n1_find_datafmt(mf->code, rj54n1_colour_fmts,
+				  ARRAY_SIZE(rj54n1_colour_fmts));
+
+	rj54n1->fmt		= fmt;
+	rj54n1->resize		= ret;
+	rj54n1->rect.width	= input_w;
+	rj54n1->rect.height	= input_h;
+	rj54n1->width		= output_w;
+	rj54n1->height		= output_h;
+
+	mf->width		= output_w;
+	mf->height		= output_h;
+	mf->field		= V4L2_FIELD_NONE;
+	mf->colorspace		= fmt->colorspace;
+
+	return 0;
+}
+
+static int rj54n1_g_chip_ident(struct v4l2_subdev *sd,
+			       struct v4l2_dbg_chip_ident *id)
+{
+	struct i2c_client *client = sd->priv;
+
+	if (id->match.type != V4L2_CHIP_MATCH_I2C_ADDR)
+		return -EINVAL;
+
+	if (id->match.addr != client->addr)
+		return -ENODEV;
+
+	id->ident	= V4L2_IDENT_RJ54N1CB0C;
+	id->revision	= 0;
+
+	return 0;
+}
+
+#ifdef CONFIG_VIDEO_ADV_DEBUG
+static int rj54n1_g_register(struct v4l2_subdev *sd,
+			     struct v4l2_dbg_register *reg)
+{
+	struct i2c_client *client = sd->priv;
+
+	if (reg->match.type != V4L2_CHIP_MATCH_I2C_ADDR ||
+	    reg->reg < 0x400 || reg->reg > 0x1fff)
+		/* Registers > 0x0800 are only available from Sharp support */
+		return -EINVAL;
+
+	if (reg->match.addr != client->addr)
+		return -ENODEV;
+
+	reg->size = 1;
+	reg->val = reg_read(client, reg->reg);
+
+	if (reg->val > 0xff)
+		return -EIO;
+
+	return 0;
+}
+
+static int rj54n1_s_register(struct v4l2_subdev *sd,
+			     struct v4l2_dbg_register *reg)
+{
+	struct i2c_client *client = sd->priv;
+
+	if (reg->match.type != V4L2_CHIP_MATCH_I2C_ADDR ||
+	    reg->reg < 0x400 || reg->reg > 0x1fff)
+		/* Registers >= 0x0800 are only available from Sharp support */
+		return -EINVAL;
+
+	if (reg->match.addr != client->addr)
+		return -ENODEV;
+
+	if (reg_write(client, reg->reg, reg->val) < 0)
+		return -EIO;
+
+	return 0;
+}
+#endif
+
+static const struct v4l2_queryctrl rj54n1_controls[] = {
+	{
+		.id		= V4L2_CID_VFLIP,
+		.type		= V4L2_CTRL_TYPE_BOOLEAN,
+		.name		= "Flip Vertically",
+		.minimum	= 0,
+		.maximum	= 1,
+		.step		= 1,
+		.default_value	= 0,
+	}, {
+		.id		= V4L2_CID_HFLIP,
+		.type		= V4L2_CTRL_TYPE_BOOLEAN,
+		.name		= "Flip Horizontally",
+		.minimum	= 0,
+		.maximum	= 1,
+		.step		= 1,
+		.default_value	= 0,
+	}, {
+		.id		= V4L2_CID_GAIN,
+		.type		= V4L2_CTRL_TYPE_INTEGER,
+		.name		= "Gain",
+		.minimum	= 0,
+		.maximum	= 127,
+		.step		= 1,
+		.default_value	= 66,
+		.flags		= V4L2_CTRL_FLAG_SLIDER,
+	}, {
+		.id		= V4L2_CID_AUTO_WHITE_BALANCE,
+		.type		= V4L2_CTRL_TYPE_BOOLEAN,
+		.name		= "Auto white balance",
+		.minimum	= 0,
+		.maximum	= 1,
+		.step		= 1,
+		.default_value	= 1,
+	},
+};
+
+static struct soc_camera_ops rj54n1_ops = {
+	.set_bus_param		= rj54n1_set_bus_param,
+	.query_bus_param	= rj54n1_query_bus_param,
+	.controls		= rj54n1_controls,
+	.num_controls		= ARRAY_SIZE(rj54n1_controls),
+};
+
+static int rj54n1_g_ctrl(struct v4l2_subdev *sd, struct v4l2_control *ctrl)
+{
+	struct i2c_client *client = sd->priv;
+	struct rj54n1 *rj54n1 = to_rj54n1(client);
+	int data;
+
+	switch (ctrl->id) {
+	case V4L2_CID_VFLIP:
+		data = reg_read(client, RJ54N1_MIRROR_STILL_MODE);
+		if (data < 0)
+			return -EIO;
+		ctrl->value = !(data & 1);
+		break;
+	case V4L2_CID_HFLIP:
+		data = reg_read(client, RJ54N1_MIRROR_STILL_MODE);
+		if (data < 0)
+			return -EIO;
+		ctrl->value = !(data & 2);
+		break;
+	case V4L2_CID_GAIN:
+		data = reg_read(client, RJ54N1_Y_GAIN);
+		if (data < 0)
+			return -EIO;
+
+		ctrl->value = data / 2;
+		break;
+	case V4L2_CID_AUTO_WHITE_BALANCE:
+		ctrl->value = rj54n1->auto_wb;
+		break;
+	}
+
+	return 0;
+}
+
+static int rj54n1_s_ctrl(struct v4l2_subdev *sd, struct v4l2_control *ctrl)
+{
+	int data;
+	struct i2c_client *client = sd->priv;
+	struct rj54n1 *rj54n1 = to_rj54n1(client);
+	const struct v4l2_queryctrl *qctrl;
+
+	qctrl = soc_camera_find_qctrl(&rj54n1_ops, ctrl->id);
+	if (!qctrl)
+		return -EINVAL;
+
+	switch (ctrl->id) {
+	case V4L2_CID_VFLIP:
+		if (ctrl->value)
+			data = reg_set(client, RJ54N1_MIRROR_STILL_MODE, 0, 1);
+		else
+			data = reg_set(client, RJ54N1_MIRROR_STILL_MODE, 1, 1);
+		if (data < 0)
+			return -EIO;
+		break;
+	case V4L2_CID_HFLIP:
+		if (ctrl->value)
+			data = reg_set(client, RJ54N1_MIRROR_STILL_MODE, 0, 2);
+		else
+			data = reg_set(client, RJ54N1_MIRROR_STILL_MODE, 2, 2);
+		if (data < 0)
+			return -EIO;
+		break;
+	case V4L2_CID_GAIN:
+		if (ctrl->value > qctrl->maximum ||
+		    ctrl->value < qctrl->minimum)
+			return -EINVAL;
+		else if (reg_write(client, RJ54N1_Y_GAIN, ctrl->value * 2) < 0)
+			return -EIO;
+		break;
+	case V4L2_CID_AUTO_WHITE_BALANCE:
+		/* Auto WB area - whole image */
+		if (reg_set(client, RJ54N1_WB_SEL_WEIGHT_I, ctrl->value << 7,
+			    0x80) < 0)
+			return -EIO;
+		rj54n1->auto_wb = ctrl->value;
+		break;
+	}
+
+	return 0;
+}
+
+static struct v4l2_subdev_core_ops rj54n1_subdev_core_ops = {
+	.g_ctrl		= rj54n1_g_ctrl,
+	.s_ctrl		= rj54n1_s_ctrl,
+	.g_chip_ident	= rj54n1_g_chip_ident,
+#ifdef CONFIG_VIDEO_ADV_DEBUG
+	.g_register	= rj54n1_g_register,
+	.s_register	= rj54n1_s_register,
+#endif
+};
+
+static struct v4l2_subdev_video_ops rj54n1_subdev_video_ops = {
+	.s_stream	= rj54n1_s_stream,
+	.s_mbus_fmt	= rj54n1_s_fmt,
+	.g_mbus_fmt	= rj54n1_g_fmt,
+	.try_mbus_fmt	= rj54n1_try_fmt,
+	.enum_mbus_fmt	= rj54n1_enum_fmt,
+	.g_crop		= rj54n1_g_crop,
+	.s_crop		= rj54n1_s_crop,
+	.cropcap	= rj54n1_cropcap,
+};
+
+static struct v4l2_subdev_ops rj54n1_subdev_ops = {
+	.core	= &rj54n1_subdev_core_ops,
+	.video	= &rj54n1_subdev_video_ops,
+};
+
+/*
+ * Interface active, can use i2c. If it fails, it can indeed mean, that
+ * this wasn't our capture interface, so, we wait for the right one
+ */
+static int rj54n1_video_probe(struct soc_camera_device *icd,
+			      struct i2c_client *client,
+			      struct rj54n1_pdata *priv)
+{
+	int data1, data2;
+	int ret;
+
+	/* This could be a BUG_ON() or a WARN_ON(), or remove it completely */
+	if (!icd->dev.parent ||
+	    to_soc_camera_host(icd->dev.parent)->nr != icd->iface)
+		return -ENODEV;
+
+	/* Read out the chip version register */
+	data1 = reg_read(client, RJ54N1_DEV_CODE);
+	data2 = reg_read(client, RJ54N1_DEV_CODE2);
+
+	if (data1 != 0x51 || data2 != 0x10) {
+		ret = -ENODEV;
+		dev_info(&client->dev, "No RJ54N1CB0C found, read 0x%x:0x%x\n",
+			 data1, data2);
+		goto ei2c;
+	}
+
+	/* Configure IOCTL polarity from the platform data: 0 or 1 << 7. */
+	ret = reg_write(client, RJ54N1_IOC, priv->ioctl_high << 7);
+	if (ret < 0)
+		goto ei2c;
+
+	dev_info(&client->dev, "Detected a RJ54N1CB0C chip ID 0x%x:0x%x\n",
+		 data1, data2);
+
+ei2c:
+	return ret;
+}
+
+static int rj54n1_probe(struct i2c_client *client,
+			const struct i2c_device_id *did)
+{
+	struct rj54n1 *rj54n1;
+	struct soc_camera_device *icd = client->dev.platform_data;
+	struct i2c_adapter *adapter = to_i2c_adapter(client->dev.parent);
+	struct soc_camera_link *icl;
+	struct rj54n1_pdata *rj54n1_priv;
+	int ret;
+
+	if (!icd) {
+		dev_err(&client->dev, "RJ54N1CB0C: missing soc-camera data!\n");
+		return -EINVAL;
+	}
+
+	icl = to_soc_camera_link(icd);
+	if (!icl || !icl->priv) {
+		dev_err(&client->dev, "RJ54N1CB0C: missing platform data!\n");
+		return -EINVAL;
+	}
+
+	rj54n1_priv = icl->priv;
+
+	if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA)) {
+		dev_warn(&adapter->dev,
+			 "I2C-Adapter doesn't support I2C_FUNC_SMBUS_BYTE\n");
+		return -EIO;
+	}
+
+	rj54n1 = kzalloc(sizeof(struct rj54n1), GFP_KERNEL);
+	if (!rj54n1)
+		return -ENOMEM;
+
+	v4l2_i2c_subdev_init(&rj54n1->subdev, client, &rj54n1_subdev_ops);
+
+	icd->ops		= &rj54n1_ops;
+
+	rj54n1->clk_div		= clk_div;
+	rj54n1->rect.left	= RJ54N1_COLUMN_SKIP;
+	rj54n1->rect.top	= RJ54N1_ROW_SKIP;
+	rj54n1->rect.width	= RJ54N1_MAX_WIDTH;
+	rj54n1->rect.height	= RJ54N1_MAX_HEIGHT;
+	rj54n1->width		= RJ54N1_MAX_WIDTH;
+	rj54n1->height		= RJ54N1_MAX_HEIGHT;
+	rj54n1->fmt		= &rj54n1_colour_fmts[0];
+	rj54n1->resize		= 1024;
+	rj54n1->tgclk_mhz	= (rj54n1_priv->mclk_freq / PLL_L * PLL_N) /
+		(clk_div.ratio_tg + 1) / (clk_div.ratio_t + 1);
+
+	ret = rj54n1_video_probe(icd, client, rj54n1_priv);
+	if (ret < 0) {
+		icd->ops = NULL;
+		i2c_set_clientdata(client, NULL);
+		kfree(rj54n1);
+		return ret;
+	}
+
+	return ret;
+}
+
+static int rj54n1_remove(struct i2c_client *client)
+{
+	struct rj54n1 *rj54n1 = to_rj54n1(client);
+	struct soc_camera_device *icd = client->dev.platform_data;
+	struct soc_camera_link *icl = to_soc_camera_link(icd);
+
+	icd->ops = NULL;
+	if (icl->free_bus)
+		icl->free_bus(icl);
+	i2c_set_clientdata(client, NULL);
+	client->driver = NULL;
+	kfree(rj54n1);
+
+	return 0;
+}
+
+static const struct i2c_device_id rj54n1_id[] = {
+	{ "rj54n1cb0c", 0 },
+	{ }
+};
+MODULE_DEVICE_TABLE(i2c, rj54n1_id);
+
+static struct i2c_driver rj54n1_i2c_driver = {
+	.driver = {
+		.name = "rj54n1cb0c",
+	},
+	.probe		= rj54n1_probe,
+	.remove		= rj54n1_remove,
+	.id_table	= rj54n1_id,
+};
+
+static int __init rj54n1_mod_init(void)
+{
+	return i2c_add_driver(&rj54n1_i2c_driver);
+}
+
+static void __exit rj54n1_mod_exit(void)
+{
+	i2c_del_driver(&rj54n1_i2c_driver);
+}
+
+module_init(rj54n1_mod_init);
+module_exit(rj54n1_mod_exit);
+
+MODULE_DESCRIPTION("Sharp RJ54N1CB0C Camera driver");
+MODULE_AUTHOR("Guennadi Liakhovetski <g.liakhovetski@gmx.de>");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/media/video/s2255drv.c b/drivers/media/video/s2255drv.c
index 2c0bb06cab3b..fb742f1ae711 100644
--- a/drivers/media/video/s2255drv.c
+++ b/drivers/media/video/s2255drv.c
@@ -233,7 +233,6 @@ struct s2255_dev {
 
 	struct s2255_dmaqueue	vidq[MAX_CHANNELS];
 	struct video_device	*vdev[MAX_CHANNELS];
-	struct list_head	s2255_devlist;
 	struct timer_list	timer;
 	struct s2255_fw	*fw_data;
 	struct s2255_pipeinfo	pipes[MAX_PIPE_BUFFERS];
@@ -313,8 +312,6 @@ struct s2255_fh {
 /* Channels on box are in reverse order */
 static unsigned long G_chnmap[MAX_CHANNELS] = {3, 2, 1, 0};
 
-static LIST_HEAD(s2255_devlist);
-
 static int debug;
 static int *s2255_debug = &debug;
 
@@ -1533,32 +1530,24 @@ static int vidioc_s_parm(struct file *file, void *priv,
 }
 static int s2255_open(struct file *file)
 {
-	int minor = video_devdata(file)->minor;
-	struct s2255_dev *h, *dev = NULL;
+	struct video_device *vdev = video_devdata(file);
+	struct s2255_dev *dev = video_drvdata(file);
 	struct s2255_fh *fh;
-	struct list_head *list;
-	enum v4l2_buf_type type = 0;
+	enum v4l2_buf_type type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
 	int i = 0;
 	int cur_channel = -1;
 	int state;
-	dprintk(1, "s2255: open called (minor=%d)\n", minor);
+
+	dprintk(1, "s2255: open called (dev=%s)\n",
+		video_device_node_name(vdev));
 
 	lock_kernel();
-	list_for_each(list, &s2255_devlist) {
-		h = list_entry(list, struct s2255_dev, s2255_devlist);
-		for (i = 0; i < MAX_CHANNELS; i++) {
-			if (h->vdev[i]->minor == minor) {
-				cur_channel = i;
-				dev = h;
-				type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
-			}
-		}
-	}
 
-	if ((NULL == dev) || (cur_channel == -1)) {
-		unlock_kernel();
-		printk(KERN_INFO "s2255: openv4l no dev\n");
-		return -ENODEV;
+	for (i = 0; i < MAX_CHANNELS; i++) {
+		if (dev->vdev[i] == vdev) {
+			cur_channel = i;
+			break;
+		}
 	}
 
 	if (atomic_read(&dev->fw_data->fw_state) == S2255_FW_DISCONNECTING) {
@@ -1662,8 +1651,9 @@ static int s2255_open(struct file *file)
 	for (i = 0; i < ARRAY_SIZE(s2255_qctrl); i++)
 		qctl_regs[i] = s2255_qctrl[i].default_value;
 
-	dprintk(1, "s2255drv: open minor=%d type=%s users=%d\n",
-		minor, v4l2_type_names[type], dev->users[cur_channel]);
+	dprintk(1, "s2255drv: open dev=%s type=%s users=%d\n",
+		video_device_node_name(vdev), v4l2_type_names[type],
+		dev->users[cur_channel]);
 	dprintk(2, "s2255drv: open: fh=0x%08lx, dev=0x%08lx, vidq=0x%08lx\n",
 		(unsigned long)fh, (unsigned long)dev,
 		(unsigned long)&dev->vidq[cur_channel]);
@@ -1699,7 +1689,6 @@ static unsigned int s2255_poll(struct file *file,
 static void s2255_destroy(struct kref *kref)
 {
 	struct s2255_dev *dev = to_s2255_dev(kref);
-	struct list_head *list;
 	int i;
 	if (!dev) {
 		printk(KERN_ERR "s2255drv: kref problem\n");
@@ -1733,10 +1722,6 @@ static void s2255_destroy(struct kref *kref)
 	usb_put_dev(dev->udev);
 	dprintk(1, "%s", __func__);
 
-	while (!list_empty(&s2255_devlist)) {
-		list = s2255_devlist.next;
-		list_del(list);
-	}
 	mutex_unlock(&dev->open_lock);
 	kfree(dev);
 }
@@ -1745,7 +1730,8 @@ static int s2255_close(struct file *file)
 {
 	struct s2255_fh *fh = file->private_data;
 	struct s2255_dev *dev = fh->dev;
-	int minor = video_devdata(file)->minor;
+	struct video_device *vdev = video_devdata(file);
+
 	if (!dev)
 		return -ENODEV;
 
@@ -1765,8 +1751,8 @@ static int s2255_close(struct file *file)
 	mutex_unlock(&dev->open_lock);
 
 	kref_put(&dev->kref, s2255_destroy);
-	dprintk(1, "s2255: close called (minor=%d, users=%d)\n",
-		minor, dev->users[fh->channel]);
+	dprintk(1, "s2255: close called (dev=%s, users=%d)\n",
+		video_device_node_name(vdev), dev->users[fh->channel]);
 	kfree(fh);
 	return 0;
 }
@@ -1830,7 +1816,6 @@ static struct video_device template = {
 	.name = "s2255v",
 	.fops = &s2255_fops_v4l,
 	.ioctl_ops = &s2255_ioctl_ops,
-	.minor = -1,
 	.release = video_device_release,
 	.tvnorms = S2255_NORMS,
 	.current_norm = V4L2_STD_NTSC_M,
@@ -1843,7 +1828,6 @@ static int s2255_probe_v4l(struct s2255_dev *dev)
 	int cur_nr = video_nr;
 
 	/* initialize all video 4 linux */
-	list_add_tail(&dev->s2255_devlist, &s2255_devlist);
 	/* register 4 video devices */
 	for (i = 0; i < MAX_CHANNELS; i++) {
 		INIT_LIST_HEAD(&dev->vidq[i].active);
@@ -1853,6 +1837,7 @@ static int s2255_probe_v4l(struct s2255_dev *dev)
 		dev->vdev[i] = video_device_alloc();
 		memcpy(dev->vdev[i], &template, sizeof(struct video_device));
 		dev->vdev[i]->parent = &dev->interface->dev;
+		video_set_drvdata(dev->vdev[i], dev);
 		if (video_nr == -1)
 			ret = video_register_device(dev->vdev[i],
 						    VFL_TYPE_GRABBER,
@@ -1880,7 +1865,7 @@ static void s2255_exit_v4l(struct s2255_dev *dev)
 
 	int i;
 	for (i = 0; i < MAX_CHANNELS; i++) {
-		if (-1 != dev->vdev[i]->minor) {
+		if (video_is_registered(dev->vdev[i])) {
 			video_unregister_device(dev->vdev[i]);
 			printk(KERN_INFO "s2255 unregistered\n");
 		} else {
@@ -1958,7 +1943,7 @@ static int save_frame(struct s2255_dev *dev, struct s2255_pipeinfo *pipe_info)
 				if (pdword[1] >= MAX_CHANNELS)
 					break;
 				cc = G_chnmap[pdword[1]];
-				if (!(cc >= 0 && cc < MAX_CHANNELS))
+				if (cc >= MAX_CHANNELS)
 					break;
 				switch (pdword[2]) {
 				case S2255_RESPONSE_SETMODE:
@@ -1980,7 +1965,7 @@ static int save_frame(struct s2255_dev *dev, struct s2255_pipeinfo *pipe_info)
 					wake_up(&dev->fw_data->wait_fw);
 					break;
 				default:
-					printk(KERN_INFO "s2255 unknwn resp\n");
+					printk(KERN_INFO "s2255 unknown resp\n");
 				}
 			default:
 				pdata++;
diff --git a/drivers/media/video/saa5246a.c b/drivers/media/video/saa5246a.c
index b624a4c01fdc..5ab6a0f901c0 100644
--- a/drivers/media/video/saa5246a.c
+++ b/drivers/media/video/saa5246a.c
@@ -1036,7 +1036,6 @@ static struct video_device saa_template =
 	.name	  = "saa5246a",
 	.fops	  = &saa_fops,
 	.release  = video_device_release,
-	.minor    = -1,
 };
 
 static int saa5246a_g_chip_ident(struct v4l2_subdev *sd, struct v4l2_dbg_chip_ident *chip)
diff --git a/drivers/media/video/saa7110.c b/drivers/media/video/saa7110.c
index 5c24c993ac16..3bca744e43af 100644
--- a/drivers/media/video/saa7110.c
+++ b/drivers/media/video/saa7110.c
@@ -304,7 +304,7 @@ static int saa7110_s_routing(struct v4l2_subdev *sd,
 {
 	struct saa7110 *decoder = to_saa7110(sd);
 
-	if (input < 0 || input >= SAA7110_MAX_INPUT) {
+	if (input >= SAA7110_MAX_INPUT) {
 		v4l2_dbg(1, debug, sd, "input=%d not available\n", input);
 		return -EINVAL;
 	}
diff --git a/drivers/media/video/saa7134/saa7134-cards.c b/drivers/media/video/saa7134/saa7134-cards.c
index 09013229d4aa..03f572708b85 100644
--- a/drivers/media/video/saa7134/saa7134-cards.c
+++ b/drivers/media/video/saa7134/saa7134-cards.c
@@ -5239,6 +5239,7 @@ struct saa7134_board saa7134_boards[] = {
 		.radio_type     = UNSET,
 		.tuner_addr     = ADDR_UNSET,
 		.radio_addr     = ADDR_UNSET,
+		.mpeg           = SAA7134_MPEG_DVB,
 		.inputs         = { {
 			.name = name_tv,
 			.vmux = 2,
@@ -5279,6 +5280,46 @@ struct saa7134_board saa7134_boards[] = {
 			.amux = TV,
 		},
 	},
+	[SAA7134_BOARD_ASUS_EUROPA_HYBRID] = {
+		.name           = "Asus Europa Hybrid OEM",
+		.audio_clock    = 0x00187de7,
+		.tuner_type     = TUNER_PHILIPS_TD1316,
+		.radio_type     = UNSET,
+		.tuner_addr	= 0x61,
+		.radio_addr	= ADDR_UNSET,
+		.tda9887_conf   = TDA9887_PRESENT | TDA9887_PORT1_ACTIVE,
+		.mpeg           = SAA7134_MPEG_DVB,
+		.inputs = { {
+			.name   = name_tv,
+			.vmux   = 3,
+			.amux   = TV,
+			.tv     = 1,
+		}, {
+			.name   = name_comp1,
+			.vmux   = 4,
+			.amux   = LINE2,
+		}, {
+			.name   = name_svideo,
+			.vmux   = 8,
+			.amux   = LINE2,
+		} },
+	},
+	[SAA7134_BOARD_LEADTEK_WINFAST_DTV1000S] = {
+		.name           = "Leadtek Winfast DTV1000S",
+		.audio_clock    = 0x00187de7,
+		.tuner_type     = TUNER_PHILIPS_TDA8290,
+		.radio_type     = UNSET,
+		.tuner_addr     = ADDR_UNSET,
+		.radio_addr     = ADDR_UNSET,
+		.mpeg           = SAA7134_MPEG_DVB,
+		.inputs         = { {
+			.name = name_comp1,
+			.vmux = 3,
+		}, {
+			.name = name_svideo,
+			.vmux = 8,
+		} },
+	},
 
 };
 
@@ -6418,6 +6459,18 @@ struct pci_device_id saa7134_pci_tbl[] = {
 		.subdevice    = 0x2004,
 		.driver_data  = SAA7134_BOARD_ZOLID_HYBRID_PCI,
 	}, {
+		.vendor       = PCI_VENDOR_ID_PHILIPS,
+		.device       = PCI_DEVICE_ID_PHILIPS_SAA7134,
+		.subvendor    = 0x1043,
+		.subdevice    = 0x4847,
+		.driver_data  = SAA7134_BOARD_ASUS_EUROPA_HYBRID,
+	}, {
+		.vendor       = PCI_VENDOR_ID_PHILIPS,
+		.device       = PCI_DEVICE_ID_PHILIPS_SAA7130,
+		.subvendor    = 0x107d,
+		.subdevice    = 0x6655,
+		.driver_data  = SAA7134_BOARD_LEADTEK_WINFAST_DTV1000S,
+	}, {
 		/* --- boards without eeprom + subsystem ID --- */
 		.vendor       = PCI_VENDOR_ID_PHILIPS,
 		.device       = PCI_DEVICE_ID_PHILIPS_SAA7134,
@@ -6748,6 +6801,7 @@ int saa7134_board_init1(struct saa7134_dev *dev)
 	case SAA7134_BOARD_KWORLD_PLUS_TV_ANALOG:
 	case SAA7134_BOARD_AVERMEDIA_GO_007_FM_PLUS:
 	case SAA7134_BOARD_ROVERMEDIA_LINK_PRO_FM:
+	case SAA7134_BOARD_LEADTEK_WINFAST_DTV1000S:
 		dev->has_remote = SAA7134_REMOTE_GPIO;
 		break;
 	case SAA7134_BOARD_FLYDVBS_LR300:
@@ -7079,6 +7133,7 @@ int saa7134_board_init2(struct saa7134_dev *dev)
 		/* break intentionally omitted */
 	case SAA7134_BOARD_VIDEOMATE_DVBT_300:
 	case SAA7134_BOARD_ASUS_EUROPA2_HYBRID:
+	case SAA7134_BOARD_ASUS_EUROPA_HYBRID:
 	{
 
 		/* The Philips EUROPA based hybrid boards have the tuner
@@ -7156,9 +7211,31 @@ int saa7134_board_init2(struct saa7134_dev *dev)
 	}
 	case SAA7134_BOARD_FLYDVB_TRIO:
 	{
+		u8 temp = 0;
+		int rc;
 		u8 data[] = { 0x3c, 0x33, 0x62};
 		struct i2c_msg msg = {.addr=0x09, .flags=0, .buf=data, .len = sizeof(data)};
 		i2c_transfer(&dev->i2c_adap, &msg, 1);
+
+		/*
+		 * send weak up message to pic16C505 chip
+		 * @ LifeView FlyDVB Trio
+		 */
+		msg.buf = &temp;
+		msg.addr = 0x0b;
+		msg.len = 1;
+		if (1 != i2c_transfer(&dev->i2c_adap, &msg, 1)) {
+			printk(KERN_WARNING "%s: send wake up byte to pic16C505"
+					"(IR chip) failed\n", dev->name);
+		} else {
+			msg.flags = I2C_M_RD;
+			rc = i2c_transfer(&dev->i2c_adap, &msg, 1);
+			printk(KERN_INFO "%s: probe IR chip @ i2c 0x%02x: %s\n",
+				   dev->name, msg.addr,
+				   (1 == rc) ? "yes" : "no");
+			if (rc == 1)
+				dev->has_remote = SAA7134_REMOTE_I2C;
+		}
 		break;
 	}
 	case SAA7134_BOARD_ADS_DUO_CARDBUS_PTV331:
diff --git a/drivers/media/video/saa7134/saa7134-core.c b/drivers/media/video/saa7134/saa7134-core.c
index f87757fccc72..a7ad7810fddc 100644
--- a/drivers/media/video/saa7134/saa7134-core.c
+++ b/drivers/media/video/saa7134/saa7134-core.c
@@ -420,19 +420,6 @@ int saa7134_set_dmabits(struct saa7134_dev *dev)
 		ctrl |= SAA7134_MAIN_CTRL_TE5;
 		irq  |= SAA7134_IRQ1_INTE_RA2_1 |
 			SAA7134_IRQ1_INTE_RA2_0;
-
-		/* dma: setup channel 5 (= TS) */
-
-		saa_writeb(SAA7134_TS_DMA0, (dev->ts.nr_packets - 1) & 0xff);
-		saa_writeb(SAA7134_TS_DMA1,
-			((dev->ts.nr_packets - 1) >> 8) & 0xff);
-		/* TSNOPIT=0, TSCOLAP=0 */
-		saa_writeb(SAA7134_TS_DMA2,
-			(((dev->ts.nr_packets - 1) >> 16) & 0x3f) | 0x00);
-		saa_writel(SAA7134_RS_PITCH(5), TS_PACKET_SIZE);
-		saa_writel(SAA7134_RS_CONTROL(5), SAA7134_RS_CONTROL_BURST_16 |
-						  SAA7134_RS_CONTROL_ME |
-						  (dev->ts.pt_ts.dma >> 12));
 	}
 
 	/* set task conditions + field handling */
@@ -797,27 +784,28 @@ static struct video_device *vdev_init(struct saa7134_dev *dev,
 	vfd->debug   = video_debug;
 	snprintf(vfd->name, sizeof(vfd->name), "%s %s (%s)",
 		 dev->name, type, saa7134_boards[dev->board].name);
+	video_set_drvdata(vfd, dev);
 	return vfd;
 }
 
 static void saa7134_unregister_video(struct saa7134_dev *dev)
 {
 	if (dev->video_dev) {
-		if (-1 != dev->video_dev->minor)
+		if (video_is_registered(dev->video_dev))
 			video_unregister_device(dev->video_dev);
 		else
 			video_device_release(dev->video_dev);
 		dev->video_dev = NULL;
 	}
 	if (dev->vbi_dev) {
-		if (-1 != dev->vbi_dev->minor)
+		if (video_is_registered(dev->vbi_dev))
 			video_unregister_device(dev->vbi_dev);
 		else
 			video_device_release(dev->vbi_dev);
 		dev->vbi_dev = NULL;
 	}
 	if (dev->radio_dev) {
-		if (-1 != dev->radio_dev->minor)
+		if (video_is_registered(dev->radio_dev))
 			video_unregister_device(dev->radio_dev);
 		else
 			video_device_release(dev->radio_dev);
@@ -1032,7 +1020,7 @@ static int __devinit saa7134_initdev(struct pci_dev *pci_dev,
 	saa7134_irq_video_signalchange(dev);
 
 	if (TUNER_ABSENT != dev->tuner_type)
-		saa_call_all(dev, tuner, s_standby);
+		saa_call_all(dev, core, s_power, 0);
 
 	/* register v4l devices */
 	if (saa7134_no_overlay > 0)
@@ -1046,8 +1034,8 @@ static int __devinit saa7134_initdev(struct pci_dev *pci_dev,
 		       dev->name);
 		goto fail4;
 	}
-	printk(KERN_INFO "%s: registered device video%d [v4l2]\n",
-	       dev->name, dev->video_dev->num);
+	printk(KERN_INFO "%s: registered device %s [v4l2]\n",
+	       dev->name, video_device_node_name(dev->video_dev));
 
 	dev->vbi_dev = vdev_init(dev, &saa7134_video_template, "vbi");
 
@@ -1055,8 +1043,8 @@ static int __devinit saa7134_initdev(struct pci_dev *pci_dev,
 				    vbi_nr[dev->nr]);
 	if (err < 0)
 		goto fail4;
-	printk(KERN_INFO "%s: registered device vbi%d\n",
-	       dev->name, dev->vbi_dev->num);
+	printk(KERN_INFO "%s: registered device %s\n",
+	       dev->name, video_device_node_name(dev->vbi_dev));
 
 	if (card_has_radio(dev)) {
 		dev->radio_dev = vdev_init(dev,&saa7134_radio_template,"radio");
@@ -1064,8 +1052,8 @@ static int __devinit saa7134_initdev(struct pci_dev *pci_dev,
 					    radio_nr[dev->nr]);
 		if (err < 0)
 			goto fail4;
-		printk(KERN_INFO "%s: registered device radio%d\n",
-		       dev->name, dev->radio_dev->num);
+		printk(KERN_INFO "%s: registered device %s\n",
+		       dev->name, video_device_node_name(dev->radio_dev));
 	}
 
 	/* everything worked */
@@ -1319,7 +1307,7 @@ static struct pci_driver saa7134_pci_driver = {
 #endif
 };
 
-static int saa7134_init(void)
+static int __init saa7134_init(void)
 {
 	INIT_LIST_HEAD(&saa7134_devlist);
 	printk(KERN_INFO "saa7130/34: v4l2 driver version %d.%d.%d loaded\n",
@@ -1333,7 +1321,7 @@ static int saa7134_init(void)
 	return pci_register_driver(&saa7134_pci_driver);
 }
 
-static void saa7134_fini(void)
+static void __exit saa7134_fini(void)
 {
 	pci_unregister_driver(&saa7134_pci_driver);
 }
diff --git a/drivers/media/video/saa7134/saa7134-dvb.c b/drivers/media/video/saa7134/saa7134-dvb.c
index a26e997a9ce6..73739d2a63dd 100644
--- a/drivers/media/video/saa7134/saa7134-dvb.c
+++ b/drivers/media/video/saa7134/saa7134-dvb.c
@@ -40,6 +40,7 @@
 #include "tda1004x.h"
 #include "nxt200x.h"
 #include "tuner-xc2028.h"
+#include "xc5000.h"
 
 #include "tda10086.h"
 #include "tda826x.h"
@@ -871,6 +872,20 @@ static struct zl10353_config behold_h6_config = {
 	.disable_i2c_gate_ctrl = 1,
 };
 
+static struct xc5000_config behold_x7_tunerconfig = {
+	.i2c_address      = 0xc2>>1,
+	.if_khz           = 4560,
+	.radio_input      = XC5000_RADIO_FM1,
+};
+
+static struct zl10353_config behold_x7_config = {
+	.demod_address = 0x1e>>1,
+	.if2           = 45600,
+	.no_tuner      = 1,
+	.parallel_ts   = 1,
+	.disable_i2c_gate_ctrl = 1,
+};
+
 /* ==================================================================
  * tda10086 based DVB-S cards, helper functions
  */
@@ -1030,6 +1045,32 @@ static struct tda18271_config zolid_tda18271_config = {
 	.gate    = TDA18271_GATE_ANALOG,
 };
 
+static struct tda10048_config dtv1000s_tda10048_config = {
+	.demod_address    = 0x10 >> 1,
+	.output_mode      = TDA10048_PARALLEL_OUTPUT,
+	.fwbulkwritelen   = TDA10048_BULKWRITE_200,
+	.inversion        = TDA10048_INVERSION_ON,
+	.dtv6_if_freq_khz = TDA10048_IF_3300,
+	.dtv7_if_freq_khz = TDA10048_IF_3800,
+	.dtv8_if_freq_khz = TDA10048_IF_4300,
+	.clk_freq_khz     = TDA10048_CLK_16000,
+	.disable_gate_access = 1,
+};
+
+static struct tda18271_std_map dtv1000s_tda18271_std_map = {
+	.dvbt_6   = { .if_freq = 3300, .agc_mode = 3, .std = 4,
+		      .if_lvl = 1, .rfagc_top = 0x37, },
+	.dvbt_7   = { .if_freq = 3800, .agc_mode = 3, .std = 5,
+		      .if_lvl = 1, .rfagc_top = 0x37, },
+	.dvbt_8   = { .if_freq = 4300, .agc_mode = 3, .std = 6,
+		      .if_lvl = 1, .rfagc_top = 0x37, },
+};
+
+static struct tda18271_config dtv1000s_tda18271_config = {
+	.std_map = &dtv1000s_tda18271_std_map,
+	.gate    = TDA18271_GATE_ANALOG,
+};
+
 /* ==================================================================
  * Core code
  */
@@ -1116,6 +1157,7 @@ static int dvb_init(struct saa7134_dev *dev)
 		break;
 	case SAA7134_BOARD_PHILIPS_EUROPA:
 	case SAA7134_BOARD_VIDEOMATE_DVBT_300:
+	case SAA7134_BOARD_ASUS_EUROPA_HYBRID:
 		fe0->dvb.frontend = dvb_attach(tda10046_attach,
 					       &philips_europa_config,
 					       &dev->i2c_adap);
@@ -1482,6 +1524,15 @@ static int dvb_init(struct saa7134_dev *dev)
 				   TUNER_PHILIPS_FMD1216MEX_MK3);
 		}
 		break;
+	case SAA7134_BOARD_BEHOLD_X7:
+		fe0->dvb.frontend = dvb_attach(zl10353_attach,
+						&behold_x7_config,
+						&dev->i2c_adap);
+		if (fe0->dvb.frontend) {
+			dvb_attach(xc5000_attach, fe0->dvb.frontend,
+				   &dev->i2c_adap, &behold_x7_tunerconfig);
+		}
+		break;
 	case SAA7134_BOARD_AVERMEDIA_A700_PRO:
 	case SAA7134_BOARD_AVERMEDIA_A700_HYBRID:
 		/* Zarlink ZL10313 */
@@ -1518,6 +1569,19 @@ static int dvb_init(struct saa7134_dev *dev)
 				   &zolid_tda18271_config);
 		}
 		break;
+	case SAA7134_BOARD_LEADTEK_WINFAST_DTV1000S:
+		fe0->dvb.frontend = dvb_attach(tda10048_attach,
+					       &dtv1000s_tda10048_config,
+					       &dev->i2c_adap);
+		if (fe0->dvb.frontend != NULL) {
+			dvb_attach(tda829x_attach, fe0->dvb.frontend,
+				   &dev->i2c_adap, 0x4b,
+				   &tda829x_no_probe);
+			dvb_attach(tda18271_attach, fe0->dvb.frontend,
+				   0x60, &dev->i2c_adap,
+				   &dtv1000s_tda18271_config);
+		}
+		break;
 	default:
 		wprintk("Huh? unknown DVB card?\n");
 		break;
@@ -1550,7 +1614,7 @@ static int dvb_init(struct saa7134_dev *dev)
 
 	/* register everything else */
 	ret = videobuf_dvb_register_bus(&dev->frontends, THIS_MODULE, dev,
-		&dev->pci->dev, adapter_nr, 0);
+					&dev->pci->dev, adapter_nr, 0, NULL);
 
 	/* this sequence is necessary to make the tda1004x load its firmware
 	 * and to enter analog mode of hybrid boards
diff --git a/drivers/media/video/saa7134/saa7134-empress.c b/drivers/media/video/saa7134/saa7134-empress.c
index 296788c3bf0e..7dfecfc6017c 100644
--- a/drivers/media/video/saa7134/saa7134-empress.c
+++ b/drivers/media/video/saa7134/saa7134-empress.c
@@ -86,19 +86,11 @@ static int ts_init_encoder(struct saa7134_dev* dev)
 
 static int ts_open(struct file *file)
 {
-	int minor = video_devdata(file)->minor;
-	struct saa7134_dev *dev;
+	struct video_device *vdev = video_devdata(file);
+	struct saa7134_dev *dev = video_drvdata(file);
 	int err;
 
-	lock_kernel();
-	list_for_each_entry(dev, &saa7134_devlist, devlist)
-		if (dev->empress_dev && dev->empress_dev->minor == minor)
-			goto found;
-	unlock_kernel();
-	return -ENODEV;
- found:
-
-	dprintk("open minor=%d\n",minor);
+	dprintk("open dev=%s\n", video_device_node_name(vdev));
 	err = -EBUSY;
 	if (!mutex_trylock(&dev->empress_tsq.vb_lock))
 		goto done;
@@ -489,7 +481,6 @@ static const struct v4l2_ioctl_ops ts_ioctl_ops = {
 static struct video_device saa7134_empress_template = {
 	.name          = "saa7134-empress",
 	.fops          = &ts_fops,
-	.minor	       = -1,
 	.ioctl_ops     = &ts_ioctl_ops,
 
 	.tvnorms			= SAA7134_NORMS,
@@ -531,6 +522,7 @@ static int empress_init(struct saa7134_dev *dev)
 
 	INIT_WORK(&dev->empress_workqueue, empress_signal_update);
 
+	video_set_drvdata(dev->empress_dev, dev);
 	err = video_register_device(dev->empress_dev,VFL_TYPE_GRABBER,
 				    empress_nr[dev->nr]);
 	if (err < 0) {
@@ -540,8 +532,8 @@ static int empress_init(struct saa7134_dev *dev)
 		dev->empress_dev = NULL;
 		return err;
 	}
-	printk(KERN_INFO "%s: registered device video%d [mpeg]\n",
-	       dev->name, dev->empress_dev->num);
+	printk(KERN_INFO "%s: registered device %s [mpeg]\n",
+	       dev->name, video_device_node_name(dev->empress_dev));
 
 	videobuf_queue_sg_init(&dev->empress_tsq, &saa7134_ts_qops,
 			    &dev->pci->dev, &dev->slock,
diff --git a/drivers/media/video/saa7134/saa7134-input.c b/drivers/media/video/saa7134/saa7134-input.c
index a0e8c62e6ae1..f8e985989ca0 100644
--- a/drivers/media/video/saa7134/saa7134-input.c
+++ b/drivers/media/video/saa7134/saa7134-input.c
@@ -102,14 +102,14 @@ static int build_key(struct saa7134_dev *dev)
 		if (data == ir->mask_keycode)
 			ir_input_nokey(ir->dev, &ir->ir);
 		else
-			ir_input_keydown(ir->dev, &ir->ir, data, data);
+			ir_input_keydown(ir->dev, &ir->ir, data);
 		return 0;
 	}
 
 	if (ir->polling) {
 		if ((ir->mask_keydown  &&  (0 != (gpio & ir->mask_keydown))) ||
 		    (ir->mask_keyup    &&  (0 == (gpio & ir->mask_keyup)))) {
-			ir_input_keydown(ir->dev, &ir->ir, data, data);
+			ir_input_keydown(ir->dev, &ir->ir, data);
 		} else {
 			ir_input_nokey(ir->dev, &ir->ir);
 		}
@@ -117,7 +117,7 @@ static int build_key(struct saa7134_dev *dev)
 	else {	/* IRQ driven mode - handle key press and release in one go */
 		if ((ir->mask_keydown  &&  (0 != (gpio & ir->mask_keydown))) ||
 		    (ir->mask_keyup    &&  (0 == (gpio & ir->mask_keyup)))) {
-			ir_input_keydown(ir->dev, &ir->ir, data, data);
+			ir_input_keydown(ir->dev, &ir->ir, data);
 			ir_input_nokey(ir->dev, &ir->ir);
 		}
 	}
@@ -127,6 +127,61 @@ static int build_key(struct saa7134_dev *dev)
 
 /* --------------------- Chip specific I2C key builders ----------------- */
 
+static int get_key_flydvb_trio(struct IR_i2c *ir, u32 *ir_key, u32 *ir_raw)
+{
+	int gpio;
+	int attempt = 0;
+	unsigned char b;
+
+	/* We need this to access GPI Used by the saa_readl macro. */
+	struct saa7134_dev *dev = ir->c->adapter->algo_data;
+
+	if (dev == NULL) {
+		dprintk("get_key_flydvb_trio: "
+			 "gir->c->adapter->algo_data is NULL!\n");
+		return -EIO;
+	}
+
+	/* rising SAA7134_GPIGPRESCAN reads the status */
+	saa_clearb(SAA7134_GPIO_GPMODE3, SAA7134_GPIO_GPRESCAN);
+	saa_setb(SAA7134_GPIO_GPMODE3, SAA7134_GPIO_GPRESCAN);
+
+	gpio = saa_readl(SAA7134_GPIO_GPSTATUS0 >> 2);
+
+	if (0x40000 & ~gpio)
+		return 0; /* No button press */
+
+	/* No button press - only before first key pressed */
+	if (b == 0xFF)
+		return 0;
+
+	/* poll IR chip */
+	/* weak up the IR chip */
+	b = 0;
+
+	while (1 != i2c_master_send(ir->c, &b, 1)) {
+		if ((attempt++) < 10) {
+			/*
+			 * wait a bit for next attempt -
+			 * I don't know how make it better
+			 */
+			msleep(10);
+			continue;
+		}
+		i2cdprintk("send wake up byte to pic16C505 (IR chip)"
+			   "failed %dx\n", attempt);
+		return -EIO;
+	}
+	if (1 != i2c_master_recv(ir->c, &b, 1)) {
+		i2cdprintk("read error\n");
+		return -EIO;
+	}
+
+	*ir_key = b;
+	*ir_raw = b;
+	return 1;
+}
+
 static int get_key_msi_tvanywhere_plus(struct IR_i2c *ir, u32 *ir_key,
 				       u32 *ir_raw)
 {
@@ -616,6 +671,13 @@ int saa7134_input_init1(struct saa7134_dev *dev)
 		mask_keycode = 0x003f00;
 		mask_keydown = 0x040000;
 		break;
+	case SAA7134_BOARD_LEADTEK_WINFAST_DTV1000S:
+		ir_codes     = &ir_codes_winfast_table;
+		mask_keycode = 0x5f00;
+		mask_keyup   = 0x020000;
+		polling      = 50; /* ms */
+		break;
+	break;
 	}
 	if (NULL == ir_codes) {
 		printk("%s: Oops: IR config error [card=%d]\n",
@@ -646,7 +708,10 @@ int saa7134_input_init1(struct saa7134_dev *dev)
 	snprintf(ir->phys, sizeof(ir->phys), "pci-%s/ir0",
 		 pci_name(dev->pci));
 
-	ir_input_init(input_dev, &ir->ir, ir_type, ir_codes);
+	err = ir_input_init(input_dev, &ir->ir, ir_type);
+	if (err < 0)
+		goto err_out_free;
+
 	input_dev->name = ir->name;
 	input_dev->phys = ir->phys;
 	input_dev->id.bustype = BUS_PCI;
@@ -663,7 +728,7 @@ int saa7134_input_init1(struct saa7134_dev *dev)
 	dev->remote = ir;
 	saa7134_ir_start(dev, ir);
 
-	err = input_register_device(ir->dev);
+	err = ir_input_register(ir->dev, ir_codes);
 	if (err)
 		goto err_out_stop;
 
@@ -677,7 +742,6 @@ int saa7134_input_init1(struct saa7134_dev *dev)
 	saa7134_ir_stop(dev);
 	dev->remote = NULL;
  err_out_free:
-	input_free_device(input_dev);
 	kfree(ir);
 	return err;
 }
@@ -688,17 +752,14 @@ void saa7134_input_fini(struct saa7134_dev *dev)
 		return;
 
 	saa7134_ir_stop(dev);
-	input_unregister_device(dev->remote->dev);
+	ir_input_unregister(dev->remote->dev);
 	kfree(dev->remote);
 	dev->remote = NULL;
 }
 
 void saa7134_probe_i2c_ir(struct saa7134_dev *dev)
 {
-	const unsigned short addr_list[] = {
-		0x7a, 0x47, 0x71, 0x2d,
-		I2C_CLIENT_END
-	};
+	struct i2c_board_info info;
 
 	struct i2c_msg msg_msi = {
 		.addr = 0x50,
@@ -714,9 +775,9 @@ void saa7134_probe_i2c_ir(struct saa7134_dev *dev)
 		return;
 	}
 
-	memset(&dev->info, 0, sizeof(dev->info));
+	memset(&info, 0, sizeof(struct i2c_board_info));
 	memset(&dev->init_data, 0, sizeof(dev->init_data));
-	strlcpy(dev->info.type, "ir_video", I2C_NAME_SIZE);
+	strlcpy(info.type, "ir_video", I2C_NAME_SIZE);
 
 	switch (dev->board) {
 	case SAA7134_BOARD_PINNACLE_PCTV_110i:
@@ -725,23 +786,24 @@ void saa7134_probe_i2c_ir(struct saa7134_dev *dev)
 		if (pinnacle_remote == 0) {
 			dev->init_data.get_key = get_key_pinnacle_color;
 			dev->init_data.ir_codes = &ir_codes_pinnacle_color_table;
-			dev->info.addr = 0x47;
+			info.addr = 0x47;
 		} else {
 			dev->init_data.get_key = get_key_pinnacle_grey;
 			dev->init_data.ir_codes = &ir_codes_pinnacle_grey_table;
-			dev->info.addr = 0x47;
+			info.addr = 0x47;
 		}
 		break;
 	case SAA7134_BOARD_UPMOST_PURPLE_TV:
 		dev->init_data.name = "Purple TV";
 		dev->init_data.get_key = get_key_purpletv;
 		dev->init_data.ir_codes = &ir_codes_purpletv_table;
+		info.addr = 0x7a;
 		break;
 	case SAA7134_BOARD_MSI_TVATANYWHERE_PLUS:
 		dev->init_data.name = "MSI TV@nywhere Plus";
 		dev->init_data.get_key = get_key_msi_tvanywhere_plus;
 		dev->init_data.ir_codes = &ir_codes_msi_tvanywhere_plus_table;
-		dev->info.addr = 0x30;
+		info.addr = 0x30;
 		/* MSI TV@nywhere Plus controller doesn't seem to
 		   respond to probes unless we read something from
 		   an existing device. Weird...
@@ -755,6 +817,7 @@ void saa7134_probe_i2c_ir(struct saa7134_dev *dev)
 		dev->init_data.name = "HVR 1110";
 		dev->init_data.get_key = get_key_hvr1110;
 		dev->init_data.ir_codes = &ir_codes_hauppauge_new_table;
+		info.addr = 0x71;
 		break;
 	case SAA7134_BOARD_BEHOLD_607FM_MK3:
 	case SAA7134_BOARD_BEHOLD_607FM_MK5:
@@ -772,23 +835,26 @@ void saa7134_probe_i2c_ir(struct saa7134_dev *dev)
 		dev->init_data.name = "BeholdTV";
 		dev->init_data.get_key = get_key_beholdm6xx;
 		dev->init_data.ir_codes = &ir_codes_behold_table;
+		info.addr = 0x2d;
 		break;
 	case SAA7134_BOARD_AVERMEDIA_CARDBUS_501:
 	case SAA7134_BOARD_AVERMEDIA_CARDBUS_506:
-		dev->info.addr = 0x40;
+		info.addr = 0x40;
 		break;
-	}
-
-	if (dev->init_data.name)
-		dev->info.platform_data = &dev->init_data;
-	/* No need to probe if address is known */
-	if (dev->info.addr) {
-		i2c_new_device(&dev->i2c_adap, &dev->info);
+	case SAA7134_BOARD_FLYDVB_TRIO:
+		dev->init_data.name = "FlyDVB Trio";
+		dev->init_data.get_key = get_key_flydvb_trio;
+		dev->init_data.ir_codes = &ir_codes_flydvb_table;
+		info.addr = 0x0b;
+		break;
+	default:
+		dprintk("No I2C IR support for board %x\n", dev->board);
 		return;
 	}
 
-	/* Address not known, fallback to probing */
-	i2c_new_probed_device(&dev->i2c_adap, &dev->info, addr_list);
+	if (dev->init_data.name)
+		info.platform_data = &dev->init_data;
+	i2c_new_device(&dev->i2c_adap, &info);
 }
 
 static int saa7134_rc5_irq(struct saa7134_dev *dev)
@@ -936,7 +1002,7 @@ static void nec_task(unsigned long data)
 		dprintk("scancode = 0x%02x (code = 0x%02x, notcode= 0x%02x)\n",
 			 ir->code, ircode, not_code);
 
-		ir_input_keydown(ir->dev, &ir->ir, ir->code, ir->code);
+		ir_input_keydown(ir->dev, &ir->ir, ir->code);
 	} else
 		dprintk("Repeat last key\n");
 
diff --git a/drivers/media/video/saa7134/saa7134-ts.c b/drivers/media/video/saa7134/saa7134-ts.c
index 03488ba4c99c..b9817d74943f 100644
--- a/drivers/media/video/saa7134/saa7134-ts.c
+++ b/drivers/media/video/saa7134/saa7134-ts.c
@@ -250,6 +250,19 @@ int saa7134_ts_start(struct saa7134_dev *dev)
 
 	BUG_ON(dev->ts_started);
 
+	/* dma: setup channel 5 (= TS) */
+	saa_writeb(SAA7134_TS_DMA0, (dev->ts.nr_packets - 1) & 0xff);
+	saa_writeb(SAA7134_TS_DMA1,
+		((dev->ts.nr_packets - 1) >> 8) & 0xff);
+	/* TSNOPIT=0, TSCOLAP=0 */
+	saa_writeb(SAA7134_TS_DMA2,
+		(((dev->ts.nr_packets - 1) >> 16) & 0x3f) | 0x00);
+	saa_writel(SAA7134_RS_PITCH(5), TS_PACKET_SIZE);
+	saa_writel(SAA7134_RS_CONTROL(5), SAA7134_RS_CONTROL_BURST_16 |
+					  SAA7134_RS_CONTROL_ME |
+					  (dev->ts.pt_ts.dma >> 12));
+
+	/* reset hardware TS buffers */
 	saa_writeb(SAA7134_TS_SERIAL1, 0x00);
 	saa_writeb(SAA7134_TS_SERIAL1, 0x03);
 	saa_writeb(SAA7134_TS_SERIAL1, 0x00);
diff --git a/drivers/media/video/saa7134/saa7134-video.c b/drivers/media/video/saa7134/saa7134-video.c
index da26f476a302..cb732640ac4a 100644
--- a/drivers/media/video/saa7134/saa7134-video.c
+++ b/drivers/media/video/saa7134/saa7134-video.c
@@ -1326,33 +1326,26 @@ static int saa7134_resource(struct saa7134_fh *fh)
 
 static int video_open(struct file *file)
 {
-	int minor = video_devdata(file)->minor;
-	struct saa7134_dev *dev;
+	struct video_device *vdev = video_devdata(file);
+	struct saa7134_dev *dev = video_drvdata(file);
 	struct saa7134_fh *fh;
-	enum v4l2_buf_type type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
+	enum v4l2_buf_type type = 0;
 	int radio = 0;
 
-	mutex_lock(&saa7134_devlist_lock);
-	list_for_each_entry(dev, &saa7134_devlist, devlist) {
-		if (dev->video_dev && (dev->video_dev->minor == minor))
-			goto found;
-		if (dev->radio_dev && (dev->radio_dev->minor == minor)) {
-			radio = 1;
-			goto found;
-		}
-		if (dev->vbi_dev && (dev->vbi_dev->minor == minor)) {
-			type = V4L2_BUF_TYPE_VBI_CAPTURE;
-			goto found;
-		}
+	switch (vdev->vfl_type) {
+	case VFL_TYPE_GRABBER:
+		type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
+		break;
+	case VFL_TYPE_VBI:
+		type = V4L2_BUF_TYPE_VBI_CAPTURE;
+		break;
+	case VFL_TYPE_RADIO:
+		radio = 1;
+		break;
 	}
-	mutex_unlock(&saa7134_devlist_lock);
-	return -ENODEV;
-
-found:
-	mutex_unlock(&saa7134_devlist_lock);
 
-	dprintk("open minor=%d radio=%d type=%s\n",minor,radio,
-		v4l2_type_names[type]);
+	dprintk("open dev=%s radio=%d type=%s\n", video_device_node_name(vdev),
+		radio, v4l2_type_names[type]);
 
 	/* allocate + initialize per filehandle data */
 	fh = kzalloc(sizeof(*fh),GFP_KERNEL);
@@ -1499,7 +1492,7 @@ static int video_release(struct file *file)
 	saa_andorb(SAA7134_OFMT_DATA_A, 0x1f, 0);
 	saa_andorb(SAA7134_OFMT_DATA_B, 0x1f, 0);
 
-	saa_call_all(dev, tuner, s_standby);
+	saa_call_all(dev, core, s_power, 0);
 	if (fh->radio)
 		saa_call_all(dev, core, ioctl, RDS_CMD_CLOSE, &cmd);
 
@@ -2502,7 +2495,6 @@ struct video_device saa7134_video_template = {
 	.name				= "saa7134-video",
 	.fops				= &video_fops,
 	.ioctl_ops 			= &video_ioctl_ops,
-	.minor				= -1,
 	.tvnorms			= SAA7134_NORMS,
 	.current_norm			= V4L2_STD_PAL,
 };
@@ -2511,7 +2503,6 @@ struct video_device saa7134_radio_template = {
 	.name			= "saa7134-radio",
 	.fops			= &radio_fops,
 	.ioctl_ops 		= &radio_ioctl_ops,
-	.minor			= -1,
 };
 
 int saa7134_video_init1(struct saa7134_dev *dev)
diff --git a/drivers/media/video/saa7134/saa7134.h b/drivers/media/video/saa7134/saa7134.h
index f8697d46ff5f..53b7e0b8a2fb 100644
--- a/drivers/media/video/saa7134/saa7134.h
+++ b/drivers/media/video/saa7134/saa7134.h
@@ -297,6 +297,8 @@ struct saa7134_format {
 #define SAA7134_BOARD_BEHOLD_X7             171
 #define SAA7134_BOARD_ROVERMEDIA_LINK_PRO_FM 172
 #define SAA7134_BOARD_ZOLID_HYBRID_PCI		173
+#define SAA7134_BOARD_ASUS_EUROPA_HYBRID	174
+#define SAA7134_BOARD_LEADTEK_WINFAST_DTV1000S 175
 
 #define SAA7134_MAXBOARDS 32
 #define SAA7134_INPUT_MAX 8
@@ -592,7 +594,6 @@ struct saa7134_dev {
 	unsigned int               insuspend;
 
 	/* I2C keyboard data */
-	struct i2c_board_info      info;
 	struct IR_i2c_init_data    init_data;
 
 	/* SAA7134_MPEG_* */
diff --git a/drivers/media/video/saa7164/saa7164-core.c b/drivers/media/video/saa7164/saa7164-core.c
index 709affc31042..e6aa0fbd1e91 100644
--- a/drivers/media/video/saa7164/saa7164-core.c
+++ b/drivers/media/video/saa7164/saa7164-core.c
@@ -724,13 +724,13 @@ static struct pci_driver saa7164_pci_driver = {
 	.resume   = NULL,
 };
 
-static int saa7164_init(void)
+static int __init saa7164_init(void)
 {
 	printk(KERN_INFO "saa7164 driver loaded\n");
 	return pci_register_driver(&saa7164_pci_driver);
 }
 
-static void saa7164_fini(void)
+static void __exit saa7164_fini(void)
 {
 	pci_unregister_driver(&saa7164_pci_driver);
 }
diff --git a/drivers/media/video/saa7164/saa7164-dvb.c b/drivers/media/video/saa7164/saa7164-dvb.c
index 6a2d847d6a88..cf099c59b38e 100644
--- a/drivers/media/video/saa7164/saa7164-dvb.c
+++ b/drivers/media/video/saa7164/saa7164-dvb.c
@@ -68,6 +68,7 @@ static struct tda18271_config hauppauge_hvr22x0s_tuner_config = {
 	.std_map	= &hauppauge_tda18271_std_map,
 	.gate		= TDA18271_GATE_ANALOG,
 	.role		= TDA18271_SLAVE,
+	.output_opt     = TDA18271_OUTPUT_LT_OFF,
 	.rf_cal_on_startup = 1
 };
 
diff --git a/drivers/media/video/saa717x.c b/drivers/media/video/saa717x.c
index b15c40908e84..6818df571168 100644
--- a/drivers/media/video/saa717x.c
+++ b/drivers/media/video/saa717x.c
@@ -1115,7 +1115,7 @@ static int saa717x_s_video_routing(struct v4l2_subdev *sd,
 	v4l2_dbg(1, debug, sd, "decoder set input (%d)\n", input);
 	/* inputs from 0-9 are available*/
 	/* saa717x have mode0-mode9 but mode5 is reserved. */
-	if (input < 0 || input > 9 || input == 5)
+	if (input > 9 || input == 5)
 		return -EINVAL;
 
 	if (decoder->input != input) {
@@ -1312,7 +1312,7 @@ static int saa717x_s_tuner(struct v4l2_subdev *sd, struct v4l2_tuner *vt)
 		"MONO", "STEREO", "LANG1", "LANG2/SAP"
 	};
 
-	audio_mode = V4L2_TUNER_MODE_STEREO;
+	audio_mode = TUNER_AUDIO_STEREO;
 
 	switch (vt->audmode) {
 		case V4L2_TUNER_MODE_MONO:
diff --git a/drivers/media/video/se401.c b/drivers/media/video/se401.c
index 85ffc2cba039..41d0166c0f95 100644
--- a/drivers/media/video/se401.c
+++ b/drivers/media/video/se401.c
@@ -1428,8 +1428,8 @@ static int se401_probe(struct usb_interface *intf,
 		err("video_register_device failed");
 		return -EIO;
 	}
-	dev_info(&intf->dev, "registered new video device: video%d\n",
-		 se401->vdev.num);
+	dev_info(&intf->dev, "registered new video device: %s\n",
+		 video_device_node_name(&se401->vdev));
 
 	usb_set_intfdata(intf, se401);
 	return 0;
diff --git a/drivers/media/video/sh_mobile_ceu_camera.c b/drivers/media/video/sh_mobile_ceu_camera.c
index 9c8b7c7b89ee..f09c7140d6b2 100644
--- a/drivers/media/video/sh_mobile_ceu_camera.c
+++ b/drivers/media/video/sh_mobile_ceu_camera.c
@@ -38,6 +38,8 @@
 #include <media/soc_camera.h>
 #include <media/sh_mobile_ceu.h>
 #include <media/videobuf-dma-contig.h>
+#include <media/v4l2-mediabus.h>
+#include <media/soc_mediabus.h>
 
 /* register offsets for sh7722 / sh7723 */
 
@@ -85,7 +87,7 @@
 /* per video frame buffer */
 struct sh_mobile_ceu_buffer {
 	struct videobuf_buffer vb; /* v4l buffer must be first */
-	const struct soc_camera_data_format *fmt;
+	enum v4l2_mbus_pixelcode code;
 };
 
 struct sh_mobile_ceu_dev {
@@ -105,7 +107,8 @@ struct sh_mobile_ceu_dev {
 
 	u32 cflcr;
 
-	unsigned int is_interlaced:1;
+	enum v4l2_field field;
+
 	unsigned int image_mode:1;
 	unsigned int is_16bit:1;
 };
@@ -114,8 +117,8 @@ struct sh_mobile_ceu_cam {
 	struct v4l2_rect ceu_rect;
 	unsigned int cam_width;
 	unsigned int cam_height;
-	const struct soc_camera_data_format *extra_fmt;
-	const struct soc_camera_data_format *camera_fmt;
+	const struct soc_mbus_pixelfmt *extra_fmt;
+	enum v4l2_mbus_pixelcode code;
 };
 
 static unsigned long make_bus_param(struct sh_mobile_ceu_dev *pcdev)
@@ -153,6 +156,40 @@ static u32 ceu_read(struct sh_mobile_ceu_dev *priv, unsigned long reg_offs)
 	return ioread32(priv->base + reg_offs);
 }
 
+static int sh_mobile_ceu_soft_reset(struct sh_mobile_ceu_dev *pcdev)
+{
+	int i, success = 0;
+	struct soc_camera_device *icd = pcdev->icd;
+
+	ceu_write(pcdev, CAPSR, 1 << 16); /* reset */
+
+	/* wait CSTSR.CPTON bit */
+	for (i = 0; i < 1000; i++) {
+		if (!(ceu_read(pcdev, CSTSR) & 1)) {
+			success++;
+			break;
+		}
+		udelay(1);
+	}
+
+	/* wait CAPSR.CPKIL bit */
+	for (i = 0; i < 1000; i++) {
+		if (!(ceu_read(pcdev, CAPSR) & (1 << 16))) {
+			success++;
+			break;
+		}
+		udelay(1);
+	}
+
+
+	if (2 != success) {
+		dev_warn(&icd->dev, "soft reset time out\n");
+		return -EIO;
+	}
+
+	return 0;
+}
+
 /*
  *  Videobuf operations
  */
@@ -163,16 +200,19 @@ static int sh_mobile_ceu_videobuf_setup(struct videobuf_queue *vq,
 	struct soc_camera_device *icd = vq->priv_data;
 	struct soc_camera_host *ici = to_soc_camera_host(icd->dev.parent);
 	struct sh_mobile_ceu_dev *pcdev = ici->priv;
-	int bytes_per_pixel = (icd->current_fmt->depth + 7) >> 3;
+	int bytes_per_line = soc_mbus_bytes_per_line(icd->user_width,
+						icd->current_fmt->host_fmt);
+
+	if (bytes_per_line < 0)
+		return bytes_per_line;
 
-	*size = PAGE_ALIGN(icd->user_width * icd->user_height *
-			   bytes_per_pixel);
+	*size = bytes_per_line * icd->user_height;
 
 	if (0 == *count)
 		*count = 2;
 
 	if (pcdev->video_limit) {
-		while (*size * *count > pcdev->video_limit)
+		while (PAGE_ALIGN(*size) * *count > pcdev->video_limit)
 			(*count)--;
 	}
 
@@ -202,51 +242,86 @@ static void free_buffer(struct videobuf_queue *vq,
 #define CEU_CETCR_MAGIC 0x0317f313 /* acknowledge magical interrupt sources */
 #define CEU_CETCR_IGRW (1 << 4) /* prohibited register access interrupt bit */
 #define CEU_CEIER_CPEIE (1 << 0) /* one-frame capture end interrupt */
+#define CEU_CEIER_VBP   (1 << 20) /* vbp error */
 #define CEU_CAPCR_CTNCP (1 << 16) /* continuous capture mode (if set) */
+#define CEU_CEIER_MASK (CEU_CEIER_CPEIE | CEU_CEIER_VBP)
 
 
-static void sh_mobile_ceu_capture(struct sh_mobile_ceu_dev *pcdev)
+/*
+ * return value doesn't reflex the success/failure to queue the new buffer,
+ * but rather the status of the previous buffer.
+ */
+static int sh_mobile_ceu_capture(struct sh_mobile_ceu_dev *pcdev)
 {
 	struct soc_camera_device *icd = pcdev->icd;
 	dma_addr_t phys_addr_top, phys_addr_bottom;
+	unsigned long top1, top2;
+	unsigned long bottom1, bottom2;
+	u32 status;
+	int ret = 0;
 
-	/* The hardware is _very_ picky about this sequence. Especially
+	/*
+	 * The hardware is _very_ picky about this sequence. Especially
 	 * the CEU_CETCR_MAGIC value. It seems like we need to acknowledge
 	 * several not-so-well documented interrupt sources in CETCR.
 	 */
-	ceu_write(pcdev, CEIER, ceu_read(pcdev, CEIER) & ~CEU_CEIER_CPEIE);
-	ceu_write(pcdev, CETCR, ~ceu_read(pcdev, CETCR) & CEU_CETCR_MAGIC);
-	ceu_write(pcdev, CEIER, ceu_read(pcdev, CEIER) | CEU_CEIER_CPEIE);
+	ceu_write(pcdev, CEIER, ceu_read(pcdev, CEIER) & ~CEU_CEIER_MASK);
+	status = ceu_read(pcdev, CETCR);
+	ceu_write(pcdev, CETCR, ~status & CEU_CETCR_MAGIC);
+	ceu_write(pcdev, CEIER, ceu_read(pcdev, CEIER) | CEU_CEIER_MASK);
 	ceu_write(pcdev, CAPCR, ceu_read(pcdev, CAPCR) & ~CEU_CAPCR_CTNCP);
 	ceu_write(pcdev, CETCR, CEU_CETCR_MAGIC ^ CEU_CETCR_IGRW);
 
+	/*
+	 * When a VBP interrupt occurs, a capture end interrupt does not occur
+	 * and the image of that frame is not captured correctly. So, soft reset
+	 * is needed here.
+	 */
+	if (status & CEU_CEIER_VBP) {
+		sh_mobile_ceu_soft_reset(pcdev);
+		ret = -EIO;
+	}
+
 	if (!pcdev->active)
-		return;
+		return ret;
+
+	if (V4L2_FIELD_INTERLACED_BT == pcdev->field) {
+		top1	= CDBYR;
+		top2	= CDBCR;
+		bottom1	= CDAYR;
+		bottom2	= CDACR;
+	} else {
+		top1	= CDAYR;
+		top2	= CDACR;
+		bottom1	= CDBYR;
+		bottom2	= CDBCR;
+	}
 
 	phys_addr_top = videobuf_to_dma_contig(pcdev->active);
-	ceu_write(pcdev, CDAYR, phys_addr_top);
-	if (pcdev->is_interlaced) {
+	ceu_write(pcdev, top1, phys_addr_top);
+	if (V4L2_FIELD_NONE != pcdev->field) {
 		phys_addr_bottom = phys_addr_top + icd->user_width;
-		ceu_write(pcdev, CDBYR, phys_addr_bottom);
+		ceu_write(pcdev, bottom1, phys_addr_bottom);
 	}
 
-	switch (icd->current_fmt->fourcc) {
+	switch (icd->current_fmt->host_fmt->fourcc) {
 	case V4L2_PIX_FMT_NV12:
 	case V4L2_PIX_FMT_NV21:
 	case V4L2_PIX_FMT_NV16:
 	case V4L2_PIX_FMT_NV61:
 		phys_addr_top += icd->user_width *
 			icd->user_height;
-		ceu_write(pcdev, CDACR, phys_addr_top);
-		if (pcdev->is_interlaced) {
-			phys_addr_bottom = phys_addr_top +
-				icd->user_width;
-			ceu_write(pcdev, CDBCR, phys_addr_bottom);
+		ceu_write(pcdev, top2, phys_addr_top);
+		if (V4L2_FIELD_NONE != pcdev->field) {
+			phys_addr_bottom = phys_addr_top + icd->user_width;
+			ceu_write(pcdev, bottom2, phys_addr_bottom);
 		}
 	}
 
 	pcdev->active->state = VIDEOBUF_ACTIVE;
 	ceu_write(pcdev, CAPSR, 0x1); /* start capture */
+
+	return ret;
 }
 
 static int sh_mobile_ceu_videobuf_prepare(struct videobuf_queue *vq,
@@ -255,8 +330,13 @@ static int sh_mobile_ceu_videobuf_prepare(struct videobuf_queue *vq,
 {
 	struct soc_camera_device *icd = vq->priv_data;
 	struct sh_mobile_ceu_buffer *buf;
+	int bytes_per_line = soc_mbus_bytes_per_line(icd->user_width,
+						icd->current_fmt->host_fmt);
 	int ret;
 
+	if (bytes_per_line < 0)
+		return bytes_per_line;
+
 	buf = container_of(vb, struct sh_mobile_ceu_buffer, vb);
 
 	dev_dbg(icd->dev.parent, "%s (vb=0x%p) 0x%08lx %zd\n", __func__,
@@ -266,25 +346,27 @@ static int sh_mobile_ceu_videobuf_prepare(struct videobuf_queue *vq,
 	WARN_ON(!list_empty(&vb->queue));
 
 #ifdef DEBUG
-	/* This can be useful if you want to see if we actually fill
-	 * the buffer with something */
+	/*
+	 * This can be useful if you want to see if we actually fill
+	 * the buffer with something
+	 */
 	memset((void *)vb->baddr, 0xaa, vb->bsize);
 #endif
 
 	BUG_ON(NULL == icd->current_fmt);
 
-	if (buf->fmt	!= icd->current_fmt ||
+	if (buf->code	!= icd->current_fmt->code ||
 	    vb->width	!= icd->user_width ||
 	    vb->height	!= icd->user_height ||
 	    vb->field	!= field) {
-		buf->fmt	= icd->current_fmt;
+		buf->code	= icd->current_fmt->code;
 		vb->width	= icd->user_width;
 		vb->height	= icd->user_height;
 		vb->field	= field;
 		vb->state	= VIDEOBUF_NEEDS_INIT;
 	}
 
-	vb->size = vb->width * vb->height * ((buf->fmt->depth + 7) >> 3);
+	vb->size = vb->height * bytes_per_line;
 	if (0 != vb->baddr && vb->bsize < vb->size) {
 		ret = -EINVAL;
 		goto out;
@@ -319,6 +401,11 @@ static void sh_mobile_ceu_videobuf_queue(struct videobuf_queue *vq,
 	list_add_tail(&vb->queue, &pcdev->capture);
 
 	if (!pcdev->active) {
+		/*
+		 * Because there were no active buffer at this moment,
+		 * we are not interested in the return value of
+		 * sh_mobile_ceu_capture here.
+		 */
 		pcdev->active = vb;
 		sh_mobile_ceu_capture(pcdev);
 	}
@@ -379,9 +466,8 @@ static irqreturn_t sh_mobile_ceu_irq(int irq, void *data)
 	else
 		pcdev->active = NULL;
 
-	sh_mobile_ceu_capture(pcdev);
-
-	vb->state = VIDEOBUF_DONE;
+	vb->state = (sh_mobile_ceu_capture(pcdev) < 0) ?
+		VIDEOBUF_ERROR : VIDEOBUF_DONE;
 	do_gettimeofday(&vb->ts);
 	vb->field_count++;
 	wake_up(&vb->done);
@@ -397,6 +483,7 @@ static int sh_mobile_ceu_add_device(struct soc_camera_device *icd)
 {
 	struct soc_camera_host *ici = to_soc_camera_host(icd->dev.parent);
 	struct sh_mobile_ceu_dev *pcdev = ici->priv;
+	int ret;
 
 	if (pcdev->icd)
 		return -EBUSY;
@@ -407,13 +494,11 @@ static int sh_mobile_ceu_add_device(struct soc_camera_device *icd)
 
 	pm_runtime_get_sync(ici->v4l2_dev.dev);
 
-	ceu_write(pcdev, CAPSR, 1 << 16); /* reset */
-	while (ceu_read(pcdev, CSTSR) & 1)
-		msleep(1);
-
-	pcdev->icd = icd;
+	ret = sh_mobile_ceu_soft_reset(pcdev);
+	if (!ret)
+		pcdev->icd = icd;
 
-	return 0;
+	return ret;
 }
 
 /* Called with .video_lock held */
@@ -427,7 +512,7 @@ static void sh_mobile_ceu_remove_device(struct soc_camera_device *icd)
 
 	/* disable capture, disable interrupts */
 	ceu_write(pcdev, CEIER, 0);
-	ceu_write(pcdev, CAPSR, 1 << 16); /* reset */
+	sh_mobile_ceu_soft_reset(pcdev);
 
 	/* make sure active buffer is canceled */
 	spin_lock_irqsave(&pcdev->lock, flags);
@@ -503,24 +588,35 @@ static void sh_mobile_ceu_set_rect(struct soc_camera_device *icd,
 			in_width *= 2;
 			left_offset *= 2;
 		}
-		width = cdwdr_width = out_width;
+		width = out_width;
+		cdwdr_width = out_width;
 	} else {
-		unsigned int w_factor = (icd->current_fmt->depth + 7) >> 3;
+		int bytes_per_line = soc_mbus_bytes_per_line(out_width,
+						icd->current_fmt->host_fmt);
+		unsigned int w_factor;
 
-		width = out_width * w_factor / 2;
+		width = out_width;
 
-		if (!pcdev->is_16bit)
-			w_factor *= 2;
+		switch (icd->current_fmt->host_fmt->packing) {
+		case SOC_MBUS_PACKING_2X8_PADHI:
+			w_factor = 2;
+			break;
+		default:
+			w_factor = 1;
+		}
 
-		in_width = rect->width * w_factor / 2;
-		left_offset = left_offset * w_factor / 2;
+		in_width = rect->width * w_factor;
+		left_offset = left_offset * w_factor;
 
-		cdwdr_width = width * 2;
+		if (bytes_per_line < 0)
+			cdwdr_width = out_width;
+		else
+			cdwdr_width = bytes_per_line;
 	}
 
 	height = out_height;
 	in_height = rect->height;
-	if (pcdev->is_interlaced) {
+	if (V4L2_FIELD_NONE != pcdev->field) {
 		height /= 2;
 		in_height /= 2;
 		top_offset /= 2;
@@ -591,6 +687,23 @@ static int sh_mobile_ceu_set_bus_param(struct soc_camera_device *icd,
 	if (!common_flags)
 		return -EINVAL;
 
+	/* Make choises, based on platform preferences */
+	if ((common_flags & SOCAM_HSYNC_ACTIVE_HIGH) &&
+	    (common_flags & SOCAM_HSYNC_ACTIVE_LOW)) {
+		if (pcdev->pdata->flags & SH_CEU_FLAG_HSYNC_LOW)
+			common_flags &= ~SOCAM_HSYNC_ACTIVE_HIGH;
+		else
+			common_flags &= ~SOCAM_HSYNC_ACTIVE_LOW;
+	}
+
+	if ((common_flags & SOCAM_VSYNC_ACTIVE_HIGH) &&
+	    (common_flags & SOCAM_VSYNC_ACTIVE_LOW)) {
+		if (pcdev->pdata->flags & SH_CEU_FLAG_VSYNC_LOW)
+			common_flags &= ~SOCAM_VSYNC_ACTIVE_HIGH;
+		else
+			common_flags &= ~SOCAM_VSYNC_ACTIVE_LOW;
+	}
+
 	ret = icd->ops->set_bus_param(icd, common_flags);
 	if (ret < 0)
 		return ret;
@@ -612,24 +725,24 @@ static int sh_mobile_ceu_set_bus_param(struct soc_camera_device *icd,
 	value = 0x00000010; /* data fetch by default */
 	yuv_lineskip = 0;
 
-	switch (icd->current_fmt->fourcc) {
+	switch (icd->current_fmt->host_fmt->fourcc) {
 	case V4L2_PIX_FMT_NV12:
 	case V4L2_PIX_FMT_NV21:
 		yuv_lineskip = 1; /* skip for NV12/21, no skip for NV16/61 */
 		/* fall-through */
 	case V4L2_PIX_FMT_NV16:
 	case V4L2_PIX_FMT_NV61:
-		switch (cam->camera_fmt->fourcc) {
-		case V4L2_PIX_FMT_UYVY:
+		switch (cam->code) {
+		case V4L2_MBUS_FMT_YUYV8_2X8_BE:
 			value = 0x00000000; /* Cb0, Y0, Cr0, Y1 */
 			break;
-		case V4L2_PIX_FMT_VYUY:
+		case V4L2_MBUS_FMT_YVYU8_2X8_BE:
 			value = 0x00000100; /* Cr0, Y0, Cb0, Y1 */
 			break;
-		case V4L2_PIX_FMT_YUYV:
+		case V4L2_MBUS_FMT_YUYV8_2X8_LE:
 			value = 0x00000200; /* Y0, Cb0, Y1, Cr0 */
 			break;
-		case V4L2_PIX_FMT_YVYU:
+		case V4L2_MBUS_FMT_YVYU8_2X8_LE:
 			value = 0x00000300; /* Y0, Cr0, Y1, Cb0 */
 			break;
 		default:
@@ -637,8 +750,8 @@ static int sh_mobile_ceu_set_bus_param(struct soc_camera_device *icd,
 		}
 	}
 
-	if (icd->current_fmt->fourcc == V4L2_PIX_FMT_NV21 ||
-	    icd->current_fmt->fourcc == V4L2_PIX_FMT_NV61)
+	if (icd->current_fmt->host_fmt->fourcc == V4L2_PIX_FMT_NV21 ||
+	    icd->current_fmt->host_fmt->fourcc == V4L2_PIX_FMT_NV61)
 		value ^= 0x00000100; /* swap U, V to change from NV1x->NVx1 */
 
 	value |= common_flags & SOCAM_VSYNC_ACTIVE_LOW ? 1 << 1 : 0;
@@ -647,14 +760,27 @@ static int sh_mobile_ceu_set_bus_param(struct soc_camera_device *icd,
 	ceu_write(pcdev, CAMCR, value);
 
 	ceu_write(pcdev, CAPCR, 0x00300000);
-	ceu_write(pcdev, CAIFR, pcdev->is_interlaced ? 0x101 : 0);
+
+	switch (pcdev->field) {
+	case V4L2_FIELD_INTERLACED_TB:
+		value = 0x101;
+		break;
+	case V4L2_FIELD_INTERLACED_BT:
+		value = 0x102;
+		break;
+	default:
+		value = 0;
+		break;
+	}
+	ceu_write(pcdev, CAIFR, value);
 
 	sh_mobile_ceu_set_rect(icd, icd->user_width, icd->user_height);
 	mdelay(1);
 
 	ceu_write(pcdev, CFLCR, pcdev->cflcr);
 
-	/* A few words about byte order (observed in Big Endian mode)
+	/*
+	 * A few words about byte order (observed in Big Endian mode)
 	 *
 	 * In data fetch mode bytes are received in chunks of 8 bytes.
 	 * D0, D1, D2, D3, D4, D5, D6, D7 (D0 received first)
@@ -684,7 +810,8 @@ static int sh_mobile_ceu_set_bus_param(struct soc_camera_device *icd,
 	return 0;
 }
 
-static int sh_mobile_ceu_try_bus_param(struct soc_camera_device *icd)
+static int sh_mobile_ceu_try_bus_param(struct soc_camera_device *icd,
+				       unsigned char buswidth)
 {
 	struct soc_camera_host *ici = to_soc_camera_host(icd->dev.parent);
 	struct sh_mobile_ceu_dev *pcdev = ici->priv;
@@ -693,48 +820,75 @@ static int sh_mobile_ceu_try_bus_param(struct soc_camera_device *icd)
 	camera_flags = icd->ops->query_bus_param(icd);
 	common_flags = soc_camera_bus_param_compatible(camera_flags,
 						       make_bus_param(pcdev));
-	if (!common_flags)
+	if (!common_flags || buswidth > 16 ||
+	    (buswidth > 8 && !(common_flags & SOCAM_DATAWIDTH_16)))
 		return -EINVAL;
 
 	return 0;
 }
 
-static const struct soc_camera_data_format sh_mobile_ceu_formats[] = {
-	{
-		.name		= "NV12",
-		.depth		= 12,
-		.fourcc		= V4L2_PIX_FMT_NV12,
-		.colorspace	= V4L2_COLORSPACE_JPEG,
-	},
+static const struct soc_mbus_pixelfmt sh_mobile_ceu_formats[] = {
 	{
-		.name		= "NV21",
-		.depth		= 12,
-		.fourcc		= V4L2_PIX_FMT_NV21,
-		.colorspace	= V4L2_COLORSPACE_JPEG,
-	},
-	{
-		.name		= "NV16",
-		.depth		= 16,
-		.fourcc		= V4L2_PIX_FMT_NV16,
-		.colorspace	= V4L2_COLORSPACE_JPEG,
-	},
-	{
-		.name		= "NV61",
-		.depth		= 16,
-		.fourcc		= V4L2_PIX_FMT_NV61,
-		.colorspace	= V4L2_COLORSPACE_JPEG,
+		.fourcc			= V4L2_PIX_FMT_NV12,
+		.name			= "NV12",
+		.bits_per_sample	= 12,
+		.packing		= SOC_MBUS_PACKING_NONE,
+		.order			= SOC_MBUS_ORDER_LE,
+	}, {
+		.fourcc			= V4L2_PIX_FMT_NV21,
+		.name			= "NV21",
+		.bits_per_sample	= 12,
+		.packing		= SOC_MBUS_PACKING_NONE,
+		.order			= SOC_MBUS_ORDER_LE,
+	}, {
+		.fourcc			= V4L2_PIX_FMT_NV16,
+		.name			= "NV16",
+		.bits_per_sample	= 16,
+		.packing		= SOC_MBUS_PACKING_NONE,
+		.order			= SOC_MBUS_ORDER_LE,
+	}, {
+		.fourcc			= V4L2_PIX_FMT_NV61,
+		.name			= "NV61",
+		.bits_per_sample	= 16,
+		.packing		= SOC_MBUS_PACKING_NONE,
+		.order			= SOC_MBUS_ORDER_LE,
 	},
 };
 
+/* This will be corrected as we get more formats */
+static bool sh_mobile_ceu_packing_supported(const struct soc_mbus_pixelfmt *fmt)
+{
+	return	fmt->packing == SOC_MBUS_PACKING_NONE ||
+		(fmt->bits_per_sample == 8 &&
+		 fmt->packing == SOC_MBUS_PACKING_2X8_PADHI) ||
+		(fmt->bits_per_sample > 8 &&
+		 fmt->packing == SOC_MBUS_PACKING_EXTEND16);
+}
+
 static int sh_mobile_ceu_get_formats(struct soc_camera_device *icd, int idx,
 				     struct soc_camera_format_xlate *xlate)
 {
+	struct v4l2_subdev *sd = soc_camera_to_subdev(icd);
 	struct device *dev = icd->dev.parent;
 	int ret, k, n;
 	int formats = 0;
 	struct sh_mobile_ceu_cam *cam;
+	enum v4l2_mbus_pixelcode code;
+	const struct soc_mbus_pixelfmt *fmt;
 
-	ret = sh_mobile_ceu_try_bus_param(icd);
+	ret = v4l2_subdev_call(sd, video, enum_mbus_fmt, idx, &code);
+	if (ret < 0)
+		/* No more formats */
+		return 0;
+
+	fmt = soc_mbus_get_fmtdesc(code);
+	if (!fmt) {
+		dev_err(icd->dev.parent,
+			"Invalid format code #%d: %d\n", idx, code);
+		return -EINVAL;
+	}
+
+	ret = sh_mobile_ceu_try_bus_param(icd, fmt->bits_per_sample);
 	if (ret < 0)
 		return 0;
 
@@ -752,13 +906,13 @@ static int sh_mobile_ceu_get_formats(struct soc_camera_device *icd, int idx,
 	if (!idx)
 		cam->extra_fmt = NULL;
 
-	switch (icd->formats[idx].fourcc) {
-	case V4L2_PIX_FMT_UYVY:
-	case V4L2_PIX_FMT_VYUY:
-	case V4L2_PIX_FMT_YUYV:
-	case V4L2_PIX_FMT_YVYU:
+	switch (code) {
+	case V4L2_MBUS_FMT_YUYV8_2X8_BE:
+	case V4L2_MBUS_FMT_YVYU8_2X8_BE:
+	case V4L2_MBUS_FMT_YUYV8_2X8_LE:
+	case V4L2_MBUS_FMT_YVYU8_2X8_LE:
 		if (cam->extra_fmt)
-			goto add_single_format;
+			break;
 
 		/*
 		 * Our case is simple so far: for any of the above four camera
@@ -769,32 +923,31 @@ static int sh_mobile_ceu_get_formats(struct soc_camera_device *icd, int idx,
 		 * the host_priv pointer and check whether the format you're
 		 * going to add now is already there.
 		 */
-		cam->extra_fmt = (void *)sh_mobile_ceu_formats;
+		cam->extra_fmt = sh_mobile_ceu_formats;
 
 		n = ARRAY_SIZE(sh_mobile_ceu_formats);
 		formats += n;
 		for (k = 0; xlate && k < n; k++) {
-			xlate->host_fmt = &sh_mobile_ceu_formats[k];
-			xlate->cam_fmt = icd->formats + idx;
-			xlate->buswidth = icd->formats[idx].depth;
+			xlate->host_fmt	= &sh_mobile_ceu_formats[k];
+			xlate->code	= code;
 			xlate++;
-			dev_dbg(dev, "Providing format %s using %s\n",
-				sh_mobile_ceu_formats[k].name,
-				icd->formats[idx].name);
+			dev_dbg(dev, "Providing format %s using code %d\n",
+				sh_mobile_ceu_formats[k].name, code);
 		}
+		break;
 	default:
-add_single_format:
-		/* Generic pass-through */
-		formats++;
-		if (xlate) {
-			xlate->host_fmt = icd->formats + idx;
-			xlate->cam_fmt = icd->formats + idx;
-			xlate->buswidth = icd->formats[idx].depth;
-			xlate++;
-			dev_dbg(dev,
-				"Providing format %s in pass-through mode\n",
-				icd->formats[idx].name);
-		}
+		if (!sh_mobile_ceu_packing_supported(fmt))
+			return 0;
+	}
+
+	/* Generic pass-through */
+	formats++;
+	if (xlate) {
+		xlate->host_fmt	= fmt;
+		xlate->code	= code;
+		xlate++;
+		dev_dbg(dev, "Providing format %s in pass-through mode\n",
+			xlate->host_fmt->name);
 	}
 
 	return formats;
@@ -974,17 +1127,15 @@ static int client_s_crop(struct v4l2_subdev *sd, struct v4l2_crop *crop,
 static int get_camera_scales(struct v4l2_subdev *sd, struct v4l2_rect *rect,
 			     unsigned int *scale_h, unsigned int *scale_v)
 {
-	struct v4l2_format f;
+	struct v4l2_mbus_framefmt mf;
 	int ret;
 
-	f.type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
-
-	ret = v4l2_subdev_call(sd, video, g_fmt, &f);
+	ret = v4l2_subdev_call(sd, video, g_mbus_fmt, &mf);
 	if (ret < 0)
 		return ret;
 
-	*scale_h = calc_generic_scale(rect->width, f.fmt.pix.width);
-	*scale_v = calc_generic_scale(rect->height, f.fmt.pix.height);
+	*scale_h = calc_generic_scale(rect->width, mf.width);
+	*scale_v = calc_generic_scale(rect->height, mf.height);
 
 	return 0;
 }
@@ -999,32 +1150,29 @@ static int get_camera_subwin(struct soc_camera_device *icd,
 	if (!ceu_rect->width) {
 		struct v4l2_subdev *sd = soc_camera_to_subdev(icd);
 		struct device *dev = icd->dev.parent;
-		struct v4l2_format f;
-		struct v4l2_pix_format *pix = &f.fmt.pix;
+		struct v4l2_mbus_framefmt mf;
 		int ret;
 		/* First time */
 
-		f.type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
-
-		ret = v4l2_subdev_call(sd, video, g_fmt, &f);
+		ret = v4l2_subdev_call(sd, video, g_mbus_fmt, &mf);
 		if (ret < 0)
 			return ret;
 
-		dev_geo(dev, "camera fmt %ux%u\n", pix->width, pix->height);
+		dev_geo(dev, "camera fmt %ux%u\n", mf.width, mf.height);
 
-		if (pix->width > 2560) {
+		if (mf.width > 2560) {
 			ceu_rect->width	 = 2560;
-			ceu_rect->left	 = (pix->width - 2560) / 2;
+			ceu_rect->left	 = (mf.width - 2560) / 2;
 		} else {
-			ceu_rect->width	 = pix->width;
+			ceu_rect->width	 = mf.width;
 			ceu_rect->left	 = 0;
 		}
 
-		if (pix->height > 1920) {
+		if (mf.height > 1920) {
 			ceu_rect->height = 1920;
-			ceu_rect->top	 = (pix->height - 1920) / 2;
+			ceu_rect->top	 = (mf.height - 1920) / 2;
 		} else {
-			ceu_rect->height = pix->height;
+			ceu_rect->height = mf.height;
 			ceu_rect->top	 = 0;
 		}
 
@@ -1041,13 +1189,12 @@ static int get_camera_subwin(struct soc_camera_device *icd,
 	return 0;
 }
 
-static int client_s_fmt(struct soc_camera_device *icd, struct v4l2_format *f,
-			bool ceu_can_scale)
+static int client_s_fmt(struct soc_camera_device *icd,
+			struct v4l2_mbus_framefmt *mf, bool ceu_can_scale)
 {
 	struct v4l2_subdev *sd = soc_camera_to_subdev(icd);
 	struct device *dev = icd->dev.parent;
-	struct v4l2_pix_format *pix = &f->fmt.pix;
-	unsigned int width = pix->width, height = pix->height, tmp_w, tmp_h;
+	unsigned int width = mf->width, height = mf->height, tmp_w, tmp_h;
 	unsigned int max_width, max_height;
 	struct v4l2_cropcap cap;
 	int ret;
@@ -1061,29 +1208,29 @@ static int client_s_fmt(struct soc_camera_device *icd, struct v4l2_format *f,
 	max_width = min(cap.bounds.width, 2560);
 	max_height = min(cap.bounds.height, 1920);
 
-	ret = v4l2_subdev_call(sd, video, s_fmt, f);
+	ret = v4l2_subdev_call(sd, video, s_mbus_fmt, mf);
 	if (ret < 0)
 		return ret;
 
-	dev_geo(dev, "camera scaled to %ux%u\n", pix->width, pix->height);
+	dev_geo(dev, "camera scaled to %ux%u\n", mf->width, mf->height);
 
-	if ((width == pix->width && height == pix->height) || !ceu_can_scale)
+	if ((width == mf->width && height == mf->height) || !ceu_can_scale)
 		return 0;
 
 	/* Camera set a format, but geometry is not precise, try to improve */
-	tmp_w = pix->width;
-	tmp_h = pix->height;
+	tmp_w = mf->width;
+	tmp_h = mf->height;
 
 	/* width <= max_width && height <= max_height - guaranteed by try_fmt */
 	while ((width > tmp_w || height > tmp_h) &&
 	       tmp_w < max_width && tmp_h < max_height) {
 		tmp_w = min(2 * tmp_w, max_width);
 		tmp_h = min(2 * tmp_h, max_height);
-		pix->width = tmp_w;
-		pix->height = tmp_h;
-		ret = v4l2_subdev_call(sd, video, s_fmt, f);
+		mf->width = tmp_w;
+		mf->height = tmp_h;
+		ret = v4l2_subdev_call(sd, video, s_mbus_fmt, mf);
 		dev_geo(dev, "Camera scaled to %ux%u\n",
-			pix->width, pix->height);
+			mf->width, mf->height);
 		if (ret < 0) {
 			/* This shouldn't happen */
 			dev_err(dev, "Client failed to set format: %d\n", ret);
@@ -1101,27 +1248,26 @@ static int client_s_fmt(struct soc_camera_device *icd, struct v4l2_format *f,
  */
 static int client_scale(struct soc_camera_device *icd, struct v4l2_rect *rect,
 			struct v4l2_rect *sub_rect, struct v4l2_rect *ceu_rect,
-			struct v4l2_format *f, bool ceu_can_scale)
+			struct v4l2_mbus_framefmt *mf, bool ceu_can_scale)
 {
 	struct v4l2_subdev *sd = soc_camera_to_subdev(icd);
 	struct sh_mobile_ceu_cam *cam = icd->host_priv;
 	struct device *dev = icd->dev.parent;
-	struct v4l2_format f_tmp = *f;
-	struct v4l2_pix_format *pix_tmp = &f_tmp.fmt.pix;
+	struct v4l2_mbus_framefmt mf_tmp = *mf;
 	unsigned int scale_h, scale_v;
 	int ret;
 
 	/* 5. Apply iterative camera S_FMT for camera user window. */
-	ret = client_s_fmt(icd, &f_tmp, ceu_can_scale);
+	ret = client_s_fmt(icd, &mf_tmp, ceu_can_scale);
 	if (ret < 0)
 		return ret;
 
 	dev_geo(dev, "5: camera scaled to %ux%u\n",
-		pix_tmp->width, pix_tmp->height);
+		mf_tmp.width, mf_tmp.height);
 
 	/* 6. Retrieve camera output window (g_fmt) */
 
-	/* unneeded - it is already in "f_tmp" */
+	/* unneeded - it is already in "mf_tmp" */
 
 	/* 7. Calculate new camera scales. */
 	ret = get_camera_scales(sd, rect, &scale_h, &scale_v);
@@ -1130,10 +1276,11 @@ static int client_scale(struct soc_camera_device *icd, struct v4l2_rect *rect,
 
 	dev_geo(dev, "7: camera scales %u:%u\n", scale_h, scale_v);
 
-	cam->cam_width		= pix_tmp->width;
-	cam->cam_height		= pix_tmp->height;
-	f->fmt.pix.width	= pix_tmp->width;
-	f->fmt.pix.height	= pix_tmp->height;
+	cam->cam_width	= mf_tmp.width;
+	cam->cam_height	= mf_tmp.height;
+	mf->width	= mf_tmp.width;
+	mf->height	= mf_tmp.height;
+	mf->colorspace	= mf_tmp.colorspace;
 
 	/*
 	 * 8. Calculate new CEU crop - apply camera scales to previously
@@ -1197,8 +1344,7 @@ static int sh_mobile_ceu_set_crop(struct soc_camera_device *icd,
 	struct v4l2_rect *cam_rect = &cam_crop.c, *ceu_rect = &cam->ceu_rect;
 	struct v4l2_subdev *sd = soc_camera_to_subdev(icd);
 	struct device *dev = icd->dev.parent;
-	struct v4l2_format f;
-	struct v4l2_pix_format *pix = &f.fmt.pix;
+	struct v4l2_mbus_framefmt mf;
 	unsigned int scale_comb_h, scale_comb_v, scale_ceu_h, scale_ceu_v,
 		out_width, out_height;
 	u32 capsr, cflcr;
@@ -1247,26 +1393,25 @@ static int sh_mobile_ceu_set_crop(struct soc_camera_device *icd,
 	 * 5. Using actual input window and calculated combined scales calculate
 	 *    camera target output window.
 	 */
-	pix->width		= scale_down(cam_rect->width, scale_comb_h);
-	pix->height		= scale_down(cam_rect->height, scale_comb_v);
+	mf.width	= scale_down(cam_rect->width, scale_comb_h);
+	mf.height	= scale_down(cam_rect->height, scale_comb_v);
 
-	dev_geo(dev, "5: camera target %ux%u\n", pix->width, pix->height);
+	dev_geo(dev, "5: camera target %ux%u\n", mf.width, mf.height);
 
 	/* 6. - 9. */
-	pix->pixelformat	= cam->camera_fmt->fourcc;
-	pix->colorspace		= cam->camera_fmt->colorspace;
+	mf.code		= cam->code;
+	mf.field	= pcdev->field;
 
 	capsr = capture_save_reset(pcdev);
 	dev_dbg(dev, "CAPSR 0x%x, CFLCR 0x%x\n", capsr, pcdev->cflcr);
 
 	/* Make relative to camera rectangle */
-	rect->left		-= cam_rect->left;
-	rect->top		-= cam_rect->top;
-
-	f.type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
+	rect->left	-= cam_rect->left;
+	rect->top	-= cam_rect->top;
 
-	ret = client_scale(icd, cam_rect, rect, ceu_rect, &f,
-			   pcdev->image_mode && !pcdev->is_interlaced);
+	ret = client_scale(icd, cam_rect, rect, ceu_rect, &mf,
+			   pcdev->image_mode &&
+			   V4L2_FIELD_NONE == pcdev->field);
 
 	dev_geo(dev, "6-9: %d\n", ret);
 
@@ -1313,8 +1458,7 @@ static int sh_mobile_ceu_set_fmt(struct soc_camera_device *icd,
 	struct sh_mobile_ceu_dev *pcdev = ici->priv;
 	struct sh_mobile_ceu_cam *cam = icd->host_priv;
 	struct v4l2_pix_format *pix = &f->fmt.pix;
-	struct v4l2_format cam_f = *f;
-	struct v4l2_pix_format *cam_pix = &cam_f.fmt.pix;
+	struct v4l2_mbus_framefmt mf;
 	struct v4l2_subdev *sd = soc_camera_to_subdev(icd);
 	struct device *dev = icd->dev.parent;
 	__u32 pixfmt = pix->pixelformat;
@@ -1324,18 +1468,20 @@ static int sh_mobile_ceu_set_fmt(struct soc_camera_device *icd,
 	unsigned int scale_cam_h, scale_cam_v;
 	u16 scale_v, scale_h;
 	int ret;
-	bool is_interlaced, image_mode;
+	bool image_mode;
+	enum v4l2_field field;
 
 	switch (pix->field) {
-	case V4L2_FIELD_INTERLACED:
-		is_interlaced = true;
-		break;
-	case V4L2_FIELD_ANY:
 	default:
 		pix->field = V4L2_FIELD_NONE;
 		/* fall-through */
+	case V4L2_FIELD_INTERLACED_TB:
+	case V4L2_FIELD_INTERLACED_BT:
 	case V4L2_FIELD_NONE:
-		is_interlaced = false;
+		field = pix->field;
+		break;
+	case V4L2_FIELD_INTERLACED:
+		field = V4L2_FIELD_INTERLACED_TB;
 		break;
 	}
 
@@ -1383,9 +1529,11 @@ static int sh_mobile_ceu_set_fmt(struct soc_camera_device *icd,
 	 * 4. Calculate camera output window by applying combined scales to real
 	 *    input window.
 	 */
-	cam_pix->width = scale_down(cam_rect->width, scale_h);
-	cam_pix->height = scale_down(cam_rect->height, scale_v);
-	cam_pix->pixelformat = xlate->cam_fmt->fourcc;
+	mf.width	= scale_down(cam_rect->width, scale_h);
+	mf.height	= scale_down(cam_rect->height, scale_v);
+	mf.field	= pix->field;
+	mf.colorspace	= pix->colorspace;
+	mf.code		= xlate->code;
 
 	switch (pixfmt) {
 	case V4L2_PIX_FMT_NV12:
@@ -1398,51 +1546,61 @@ static int sh_mobile_ceu_set_fmt(struct soc_camera_device *icd,
 		image_mode = false;
 	}
 
-	dev_geo(dev, "4: camera output %ux%u\n",
-		cam_pix->width, cam_pix->height);
+	dev_geo(dev, "4: camera output %ux%u\n", mf.width, mf.height);
 
 	/* 5. - 9. */
-	ret = client_scale(icd, cam_rect, &cam_subrect, &ceu_rect, &cam_f,
-			   image_mode && !is_interlaced);
+	ret = client_scale(icd, cam_rect, &cam_subrect, &ceu_rect, &mf,
+			   image_mode && V4L2_FIELD_NONE == field);
 
 	dev_geo(dev, "5-9: client scale %d\n", ret);
 
 	/* Done with the camera. Now see if we can improve the result */
 
 	dev_dbg(dev, "Camera %d fmt %ux%u, requested %ux%u\n",
-		ret, cam_pix->width, cam_pix->height, pix->width, pix->height);
+		ret, mf.width, mf.height, pix->width, pix->height);
 	if (ret < 0)
 		return ret;
 
+	if (mf.code != xlate->code)
+		return -EINVAL;
+
 	/* 10. Use CEU scaling to scale to the requested user window. */
 
 	/* We cannot scale up */
-	if (pix->width > cam_pix->width)
-		pix->width = cam_pix->width;
+	if (pix->width > mf.width)
+		pix->width = mf.width;
 	if (pix->width > ceu_rect.width)
 		pix->width = ceu_rect.width;
 
-	if (pix->height > cam_pix->height)
-		pix->height = cam_pix->height;
+	if (pix->height > mf.height)
+		pix->height = mf.height;
 	if (pix->height > ceu_rect.height)
 		pix->height = ceu_rect.height;
 
-	/* Let's rock: scale pix->{width x height} down to width x height */
-	scale_h = calc_scale(ceu_rect.width, &pix->width);
-	scale_v = calc_scale(ceu_rect.height, &pix->height);
+	pix->colorspace = mf.colorspace;
+
+	if (image_mode) {
+		/* Scale pix->{width x height} down to width x height */
+		scale_h = calc_scale(ceu_rect.width, &pix->width);
+		scale_v = calc_scale(ceu_rect.height, &pix->height);
+
+		pcdev->cflcr = scale_h | (scale_v << 16);
+	} else {
+		pix->width = ceu_rect.width;
+		pix->height = ceu_rect.height;
+		scale_h = scale_v = 0;
+		pcdev->cflcr = 0;
+	}
 
 	dev_geo(dev, "10: W: %u : 0x%x = %u, H: %u : 0x%x = %u\n",
 		ceu_rect.width, scale_h, pix->width,
 		ceu_rect.height, scale_v, pix->height);
 
-	pcdev->cflcr = scale_h | (scale_v << 16);
+	cam->code		= xlate->code;
+	cam->ceu_rect		= ceu_rect;
+	icd->current_fmt	= xlate;
 
-	icd->buswidth = xlate->buswidth;
-	icd->current_fmt = xlate->host_fmt;
-	cam->camera_fmt = xlate->cam_fmt;
-	cam->ceu_rect = ceu_rect;
-
-	pcdev->is_interlaced = is_interlaced;
+	pcdev->field = field;
 	pcdev->image_mode = image_mode;
 
 	return 0;
@@ -1454,6 +1612,7 @@ static int sh_mobile_ceu_try_fmt(struct soc_camera_device *icd,
 	const struct soc_camera_format_xlate *xlate;
 	struct v4l2_pix_format *pix = &f->fmt.pix;
 	struct v4l2_subdev *sd = soc_camera_to_subdev(icd);
+	struct v4l2_mbus_framefmt mf;
 	__u32 pixfmt = pix->pixelformat;
 	int width, height;
 	int ret;
@@ -1472,18 +1631,27 @@ static int sh_mobile_ceu_try_fmt(struct soc_camera_device *icd,
 	width = pix->width;
 	height = pix->height;
 
-	pix->bytesperline = pix->width *
-		DIV_ROUND_UP(xlate->host_fmt->depth, 8);
-	pix->sizeimage = pix->height * pix->bytesperline;
-
-	pix->pixelformat = xlate->cam_fmt->fourcc;
+	pix->bytesperline = soc_mbus_bytes_per_line(width, xlate->host_fmt);
+	if (pix->bytesperline < 0)
+		return pix->bytesperline;
+	pix->sizeimage = height * pix->bytesperline;
 
 	/* limit to sensor capabilities */
-	ret = v4l2_subdev_call(sd, video, try_fmt, f);
-	pix->pixelformat = pixfmt;
+	mf.width	= pix->width;
+	mf.height	= pix->height;
+	mf.field	= pix->field;
+	mf.code		= xlate->code;
+	mf.colorspace	= pix->colorspace;
+
+	ret = v4l2_subdev_call(sd, video, try_mbus_fmt, &mf);
 	if (ret < 0)
 		return ret;
 
+	pix->width	= mf.width;
+	pix->height	= mf.height;
+	pix->field	= mf.field;
+	pix->colorspace	= mf.colorspace;
+
 	switch (pixfmt) {
 	case V4L2_PIX_FMT_NV12:
 	case V4L2_PIX_FMT_NV21:
@@ -1492,21 +1660,25 @@ static int sh_mobile_ceu_try_fmt(struct soc_camera_device *icd,
 		/* FIXME: check against rect_max after converting soc-camera */
 		/* We can scale precisely, need a bigger image from camera */
 		if (pix->width < width || pix->height < height) {
-			int tmp_w = pix->width, tmp_h = pix->height;
-			pix->width = 2560;
-			pix->height = 1920;
-			ret = v4l2_subdev_call(sd, video, try_fmt, f);
+			/*
+			 * We presume, the sensor behaves sanely, i.e., if
+			 * requested a bigger rectangle, it will not return a
+			 * smaller one.
+			 */
+			mf.width = 2560;
+			mf.height = 1920;
+			ret = v4l2_subdev_call(sd, video, try_mbus_fmt, &mf);
 			if (ret < 0) {
 				/* Shouldn't actually happen... */
 				dev_err(icd->dev.parent,
-					"FIXME: try_fmt() returned %d\n", ret);
-				pix->width = tmp_w;
-				pix->height = tmp_h;
+					"FIXME: client try_fmt() = %d\n", ret);
+				return ret;
 			}
 		}
-		if (pix->width > width)
+		/* We will scale exactly */
+		if (mf.width > width)
 			pix->width = width;
-		if (pix->height > height)
+		if (mf.height > height)
 			pix->height = height;
 	}
 
@@ -1518,10 +1690,12 @@ static int sh_mobile_ceu_reqbufs(struct soc_camera_file *icf,
 {
 	int i;
 
-	/* This is for locking debugging only. I removed spinlocks and now I
+	/*
+	 * This is for locking debugging only. I removed spinlocks and now I
 	 * check whether .prepare is ever called on a linked buffer, or whether
 	 * a dma IRQ can occur for an in-work or unlinked buffer. Until now
-	 * it hadn't triggered */
+	 * it hadn't triggered
+	 */
 	for (i = 0; i < p->count; i++) {
 		struct sh_mobile_ceu_buffer *buf;
 
@@ -1569,8 +1743,7 @@ static void sh_mobile_ceu_init_videobuf(struct videobuf_queue *q,
 				       &sh_mobile_ceu_videobuf_ops,
 				       icd->dev.parent, &pcdev->lock,
 				       V4L2_BUF_TYPE_VIDEO_CAPTURE,
-				       pcdev->is_interlaced ?
-				       V4L2_FIELD_INTERLACED : V4L2_FIELD_NONE,
+				       pcdev->field,
 				       sizeof(struct sh_mobile_ceu_buffer),
 				       icd);
 }
@@ -1599,7 +1772,7 @@ static int sh_mobile_ceu_set_ctrl(struct soc_camera_device *icd,
 
 	switch (ctrl->id) {
 	case V4L2_CID_SHARPNESS:
-		switch (icd->current_fmt->fourcc) {
+		switch (icd->current_fmt->host_fmt->fourcc) {
 		case V4L2_PIX_FMT_NV12:
 		case V4L2_PIX_FMT_NV21:
 		case V4L2_PIX_FMT_NV16:
@@ -1654,7 +1827,7 @@ static int __devinit sh_mobile_ceu_probe(struct platform_device *pdev)
 
 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 	irq = platform_get_irq(pdev, 0);
-	if (!res || !irq) {
+	if (!res || (int)irq <= 0) {
 		dev_err(&pdev->dev, "Not enough CEU platform resources.\n");
 		err = -ENODEV;
 		goto exit;
@@ -1770,7 +1943,7 @@ static int sh_mobile_ceu_runtime_nop(struct device *dev)
 	return 0;
 }
 
-static struct dev_pm_ops sh_mobile_ceu_dev_pm_ops = {
+static const struct dev_pm_ops sh_mobile_ceu_dev_pm_ops = {
 	.runtime_suspend = sh_mobile_ceu_runtime_nop,
 	.runtime_resume = sh_mobile_ceu_runtime_nop,
 };
@@ -1781,7 +1954,7 @@ static struct platform_driver sh_mobile_ceu_driver = {
 		.pm	= &sh_mobile_ceu_dev_pm_ops,
 	},
 	.probe		= sh_mobile_ceu_probe,
-	.remove		= __exit_p(sh_mobile_ceu_remove),
+	.remove		= __devexit_p(sh_mobile_ceu_remove),
 };
 
 static int __init sh_mobile_ceu_init(void)
diff --git a/drivers/media/video/sn9c102/sn9c102_core.c b/drivers/media/video/sn9c102/sn9c102_core.c
index 4a7711c3e745..cbf8087b286f 100644
--- a/drivers/media/video/sn9c102/sn9c102_core.c
+++ b/drivers/media/video/sn9c102/sn9c102_core.c
@@ -1007,8 +1007,8 @@ static int sn9c102_stream_interrupt(struct sn9c102_device* cam)
 	else if (cam->stream != STREAM_OFF) {
 		cam->state |= DEV_MISCONFIGURED;
 		DBG(1, "URB timeout reached. The camera is misconfigured. "
-		       "To use it, close and open /dev/video%d again.",
-		    cam->v4ldev->num);
+		       "To use it, close and open %s again.",
+		    video_device_node_name(cam->v4ldev));
 		return -EIO;
 	}
 
@@ -1734,7 +1734,8 @@ static void sn9c102_release_resources(struct kref *kref)
 
 	cam = container_of(kref, struct sn9c102_device, kref);
 
-	DBG(2, "V4L2 device /dev/video%d deregistered", cam->v4ldev->num);
+	DBG(2, "V4L2 device %s deregistered",
+	    video_device_node_name(cam->v4ldev));
 	video_set_drvdata(cam->v4ldev, NULL);
 	video_unregister_device(cam->v4ldev);
 	usb_put_dev(cam->usbdev);
@@ -1791,8 +1792,8 @@ static int sn9c102_open(struct file *filp)
 	}
 
 	if (cam->users) {
-		DBG(2, "Device /dev/video%d is already in use",
-		       cam->v4ldev->num);
+		DBG(2, "Device %s is already in use",
+		    video_device_node_name(cam->v4ldev));
 		DBG(3, "Simultaneous opens are not supported");
 		/*
 		   open() must follow the open flags and should block
@@ -1845,7 +1846,7 @@ static int sn9c102_open(struct file *filp)
 	cam->frame_count = 0;
 	sn9c102_empty_framequeues(cam);
 
-	DBG(3, "Video device /dev/video%d is open", cam->v4ldev->num);
+	DBG(3, "Video device %s is open", video_device_node_name(cam->v4ldev));
 
 out:
 	mutex_unlock(&cam->open_mutex);
@@ -1870,7 +1871,7 @@ static int sn9c102_release(struct file *filp)
 	cam->users--;
 	wake_up_interruptible_nr(&cam->wait_open, 1);
 
-	DBG(3, "Video device /dev/video%d closed", cam->v4ldev->num);
+	DBG(3, "Video device %s closed", video_device_node_name(cam->v4ldev));
 
 	kref_put(&cam->kref, sn9c102_release_resources);
 
@@ -2433,8 +2434,8 @@ sn9c102_vidioc_s_crop(struct sn9c102_device* cam, void __user * arg)
 	if (err) { /* atomic, no rollback in ioctl() */
 		cam->state |= DEV_MISCONFIGURED;
 		DBG(1, "VIDIOC_S_CROP failed because of hardware problems. To "
-		       "use the camera, close and open /dev/video%d again.",
-		    cam->v4ldev->num);
+		       "use the camera, close and open %s again.",
+		    video_device_node_name(cam->v4ldev));
 		return -EIO;
 	}
 
@@ -2446,8 +2447,8 @@ sn9c102_vidioc_s_crop(struct sn9c102_device* cam, void __user * arg)
 	    nbuffers != sn9c102_request_buffers(cam, nbuffers, cam->io)) {
 		cam->state |= DEV_MISCONFIGURED;
 		DBG(1, "VIDIOC_S_CROP failed because of not enough memory. To "
-		       "use the camera, close and open /dev/video%d again.",
-		    cam->v4ldev->num);
+		       "use the camera, close and open %s again.",
+		    video_device_node_name(cam->v4ldev));
 		return -ENOMEM;
 	}
 
@@ -2690,8 +2691,8 @@ sn9c102_vidioc_try_s_fmt(struct sn9c102_device* cam, unsigned int cmd,
 	if (err) { /* atomic, no rollback in ioctl() */
 		cam->state |= DEV_MISCONFIGURED;
 		DBG(1, "VIDIOC_S_FMT failed because of hardware problems. To "
-		       "use the camera, close and open /dev/video%d again.",
-		    cam->v4ldev->num);
+		       "use the camera, close and open %s again.",
+		    video_device_node_name(cam->v4ldev));
 		return -EIO;
 	}
 
@@ -2702,8 +2703,8 @@ sn9c102_vidioc_try_s_fmt(struct sn9c102_device* cam, unsigned int cmd,
 	    nbuffers != sn9c102_request_buffers(cam, nbuffers, cam->io)) {
 		cam->state |= DEV_MISCONFIGURED;
 		DBG(1, "VIDIOC_S_FMT failed because of not enough memory. To "
-		       "use the camera, close and open /dev/video%d again.",
-		    cam->v4ldev->num);
+		       "use the camera, close and open %s again.",
+		    video_device_node_name(cam->v4ldev));
 		return -ENOMEM;
 	}
 
@@ -2748,9 +2749,9 @@ sn9c102_vidioc_s_jpegcomp(struct sn9c102_device* cam, void __user * arg)
 	err += sn9c102_set_compression(cam, &jc);
 	if (err) { /* atomic, no rollback in ioctl() */
 		cam->state |= DEV_MISCONFIGURED;
-		DBG(1, "VIDIOC_S_JPEGCOMP failed because of hardware "
-		       "problems. To use the camera, close and open "
-		       "/dev/video%d again.", cam->v4ldev->num);
+		DBG(1, "VIDIOC_S_JPEGCOMP failed because of hardware problems. "
+		       "To use the camera, close and open %s again.",
+		    video_device_node_name(cam->v4ldev));
 		return -EIO;
 	}
 
@@ -3328,7 +3329,6 @@ sn9c102_usb_probe(struct usb_interface* intf, const struct usb_device_id* id)
 
 	strcpy(cam->v4ldev->name, "SN9C1xx PC Camera");
 	cam->v4ldev->fops = &sn9c102_fops;
-	cam->v4ldev->minor = video_nr[dev_nr];
 	cam->v4ldev->release = video_device_release;
 	cam->v4ldev->parent = &udev->dev;
 
@@ -3346,7 +3346,8 @@ sn9c102_usb_probe(struct usb_interface* intf, const struct usb_device_id* id)
 		goto fail;
 	}
 
-	DBG(2, "V4L2 device registered as /dev/video%d", cam->v4ldev->num);
+	DBG(2, "V4L2 device registered as %s",
+	    video_device_node_name(cam->v4ldev));
 
 	video_set_drvdata(cam->v4ldev, cam);
 	cam->module_param.force_munmap = force_munmap[dev_nr];
@@ -3398,9 +3399,9 @@ static void sn9c102_usb_disconnect(struct usb_interface* intf)
 	DBG(2, "Disconnecting %s...", cam->v4ldev->name);
 
 	if (cam->users) {
-		DBG(2, "Device /dev/video%d is open! Deregistration and "
-		       "memory deallocation are deferred.",
-		    cam->v4ldev->num);
+		DBG(2, "Device %s is open! Deregistration and memory "
+		       "deallocation are deferred.",
+		    video_device_node_name(cam->v4ldev));
 		cam->state |= DEV_MISCONFIGURED;
 		sn9c102_stop_transfer(cam);
 		cam->state |= DEV_DISCONNECTED;
diff --git a/drivers/media/video/soc_camera.c b/drivers/media/video/soc_camera.c
index 95fdeb23c2c1..6b3fbcca7747 100644
--- a/drivers/media/video/soc_camera.c
+++ b/drivers/media/video/soc_camera.c
@@ -31,6 +31,7 @@
 #include <media/v4l2-ioctl.h>
 #include <media/v4l2-dev.h>
 #include <media/videobuf-core.h>
+#include <media/soc_mediabus.h>
 
 /* Default to VGA resolution */
 #define DEFAULT_WIDTH	640
@@ -40,18 +41,6 @@ static LIST_HEAD(hosts);
 static LIST_HEAD(devices);
 static DEFINE_MUTEX(list_lock);		/* Protects the list of hosts */
 
-const struct soc_camera_data_format *soc_camera_format_by_fourcc(
-	struct soc_camera_device *icd, unsigned int fourcc)
-{
-	unsigned int i;
-
-	for (i = 0; i < icd->num_formats; i++)
-		if (icd->formats[i].fourcc == fourcc)
-			return icd->formats + i;
-	return NULL;
-}
-EXPORT_SYMBOL(soc_camera_format_by_fourcc);
-
 const struct soc_camera_format_xlate *soc_camera_xlate_by_fourcc(
 	struct soc_camera_device *icd, unsigned int fourcc)
 {
@@ -207,21 +196,26 @@ static int soc_camera_dqbuf(struct file *file, void *priv,
 /* Always entered with .video_lock held */
 static int soc_camera_init_user_formats(struct soc_camera_device *icd)
 {
+	struct v4l2_subdev *sd = soc_camera_to_subdev(icd);
 	struct soc_camera_host *ici = to_soc_camera_host(icd->dev.parent);
-	int i, fmts = 0, ret;
+	int i, fmts = 0, raw_fmts = 0, ret;
+	enum v4l2_mbus_pixelcode code;
+
+	while (!v4l2_subdev_call(sd, video, enum_mbus_fmt, raw_fmts, &code))
+		raw_fmts++;
 
 	if (!ici->ops->get_formats)
 		/*
 		 * Fallback mode - the host will have to serve all
 		 * sensor-provided formats one-to-one to the user
 		 */
-		fmts = icd->num_formats;
+		fmts = raw_fmts;
 	else
 		/*
 		 * First pass - only count formats this host-sensor
 		 * configuration can provide
 		 */
-		for (i = 0; i < icd->num_formats; i++) {
+		for (i = 0; i < raw_fmts; i++) {
 			ret = ici->ops->get_formats(icd, i, NULL);
 			if (ret < 0)
 				return ret;
@@ -242,11 +236,12 @@ static int soc_camera_init_user_formats(struct soc_camera_device *icd)
 
 	/* Second pass - actually fill data formats */
 	fmts = 0;
-	for (i = 0; i < icd->num_formats; i++)
+	for (i = 0; i < raw_fmts; i++)
 		if (!ici->ops->get_formats) {
-			icd->user_formats[i].host_fmt = icd->formats + i;
-			icd->user_formats[i].cam_fmt = icd->formats + i;
-			icd->user_formats[i].buswidth = icd->formats[i].depth;
+			v4l2_subdev_call(sd, video, enum_mbus_fmt, i, &code);
+			icd->user_formats[i].host_fmt =
+				soc_mbus_get_fmtdesc(code);
+			icd->user_formats[i].code = code;
 		} else {
 			ret = ici->ops->get_formats(icd, i,
 						    &icd->user_formats[fmts]);
@@ -255,7 +250,7 @@ static int soc_camera_init_user_formats(struct soc_camera_device *icd)
 			fmts += ret;
 		}
 
-	icd->current_fmt = icd->user_formats[0].host_fmt;
+	icd->current_fmt = &icd->user_formats[0];
 
 	return 0;
 
@@ -281,7 +276,7 @@ static void soc_camera_free_user_formats(struct soc_camera_device *icd)
 #define pixfmtstr(x) (x) & 0xff, ((x) >> 8) & 0xff, ((x) >> 16) & 0xff, \
 	((x) >> 24) & 0xff
 
-/* Called with .vb_lock held */
+/* Called with .vb_lock held, or from the first open(2), see comment there */
 static int soc_camera_set_fmt(struct soc_camera_file *icf,
 			      struct v4l2_format *f)
 {
@@ -302,7 +297,7 @@ static int soc_camera_set_fmt(struct soc_camera_file *icf,
 	if (ret < 0) {
 		return ret;
 	} else if (!icd->current_fmt ||
-		   icd->current_fmt->fourcc != pix->pixelformat) {
+		   icd->current_fmt->host_fmt->fourcc != pix->pixelformat) {
 		dev_err(&icd->dev,
 			"Host driver hasn't set up current format correctly!\n");
 		return -EINVAL;
@@ -310,6 +305,7 @@ static int soc_camera_set_fmt(struct soc_camera_file *icf,
 
 	icd->user_width		= pix->width;
 	icd->user_height	= pix->height;
+	icd->colorspace		= pix->colorspace;
 	icf->vb_vidq.field	=
 		icd->field	= pix->field;
 
@@ -369,8 +365,9 @@ static int soc_camera_open(struct file *file)
 				.width		= icd->user_width,
 				.height		= icd->user_height,
 				.field		= icd->field,
-				.pixelformat	= icd->current_fmt->fourcc,
-				.colorspace	= icd->current_fmt->colorspace,
+				.colorspace	= icd->colorspace,
+				.pixelformat	=
+					icd->current_fmt->host_fmt->fourcc,
 			},
 		};
 
@@ -390,7 +387,12 @@ static int soc_camera_open(struct file *file)
 			goto eiciadd;
 		}
 
-		/* Try to configure with default parameters */
+		/*
+		 * Try to configure with default parameters. Notice: this is the
+		 * very first open, so, we cannot race against other calls,
+		 * apart from someone else calling open() simultaneously, but
+		 * .video_lock is protecting us against it.
+		 */
 		ret = soc_camera_set_fmt(icf, &f);
 		if (ret < 0)
 			goto esfmt;
@@ -534,7 +536,7 @@ static int soc_camera_enum_fmt_vid_cap(struct file *file, void  *priv,
 {
 	struct soc_camera_file *icf = file->private_data;
 	struct soc_camera_device *icd = icf->icd;
-	const struct soc_camera_data_format *format;
+	const struct soc_mbus_pixelfmt *format;
 
 	WARN_ON(priv != file->private_data);
 
@@ -543,7 +545,8 @@ static int soc_camera_enum_fmt_vid_cap(struct file *file, void  *priv,
 
 	format = icd->user_formats[f->index].host_fmt;
 
-	strlcpy(f->description, format->name, sizeof(f->description));
+	if (format->name)
+		strlcpy(f->description, format->name, sizeof(f->description));
 	f->pixelformat = format->fourcc;
 	return 0;
 }
@@ -560,12 +563,15 @@ static int soc_camera_g_fmt_vid_cap(struct file *file, void *priv,
 	pix->width		= icd->user_width;
 	pix->height		= icd->user_height;
 	pix->field		= icf->vb_vidq.field;
-	pix->pixelformat	= icd->current_fmt->fourcc;
-	pix->bytesperline	= pix->width *
-		DIV_ROUND_UP(icd->current_fmt->depth, 8);
+	pix->pixelformat	= icd->current_fmt->host_fmt->fourcc;
+	pix->bytesperline	= soc_mbus_bytes_per_line(pix->width,
+						icd->current_fmt->host_fmt);
+	pix->colorspace		= icd->colorspace;
+	if (pix->bytesperline < 0)
+		return pix->bytesperline;
 	pix->sizeimage		= pix->height * pix->bytesperline;
 	dev_dbg(&icd->dev, "current_fmt->fourcc: 0x%08x\n",
-		icd->current_fmt->fourcc);
+		icd->current_fmt->host_fmt->fourcc);
 	return 0;
 }
 
@@ -621,8 +627,10 @@ static int soc_camera_streamoff(struct file *file, void *priv,
 
 	mutex_lock(&icd->video_lock);
 
-	/* This calls buf_release from host driver's videobuf_queue_ops for all
-	 * remaining buffers. When the last buffer is freed, stop capture */
+	/*
+	 * This calls buf_release from host driver's videobuf_queue_ops for all
+	 * remaining buffers. When the last buffer is freed, stop capture
+	 */
 	videobuf_streamoff(&icf->vb_vidq);
 
 	v4l2_subdev_call(sd, video, s_stream, 0);
@@ -892,7 +900,7 @@ static int soc_camera_probe(struct device *dev)
 	struct soc_camera_link *icl = to_soc_camera_link(icd);
 	struct device *control = NULL;
 	struct v4l2_subdev *sd;
-	struct v4l2_format f = {.type = V4L2_BUF_TYPE_VIDEO_CAPTURE};
+	struct v4l2_mbus_framefmt mf;
 	int ret;
 
 	dev_info(dev, "Probing %s\n", dev_name(dev));
@@ -963,9 +971,11 @@ static int soc_camera_probe(struct device *dev)
 
 	/* Try to improve our guess of a reasonable window format */
 	sd = soc_camera_to_subdev(icd);
-	if (!v4l2_subdev_call(sd, video, g_fmt, &f)) {
-		icd->user_width		= f.fmt.pix.width;
-		icd->user_height	= f.fmt.pix.height;
+	if (!v4l2_subdev_call(sd, video, g_mbus_fmt, &mf)) {
+		icd->user_width		= mf.width;
+		icd->user_height	= mf.height;
+		icd->colorspace		= mf.colorspace;
+		icd->field		= mf.field;
 	}
 
 	/* Do we have to sysfs_remove_link() before device_unregister()? */
@@ -1004,8 +1014,10 @@ epower:
 	return ret;
 }
 
-/* This is called on device_unregister, which only means we have to disconnect
- * from the host, but not remove ourselves from the device list */
+/*
+ * This is called on device_unregister, which only means we have to disconnect
+ * from the host, but not remove ourselves from the device list
+ */
 static int soc_camera_remove(struct device *dev)
 {
 	struct soc_camera_device *icd = to_soc_camera_dev(dev);
@@ -1205,8 +1217,10 @@ static int soc_camera_device_register(struct soc_camera_device *icd)
 	}
 
 	if (num < 0)
-		/* ok, we have 256 cameras on this host...
-		 * man, stay reasonable... */
+		/*
+		 * ok, we have 256 cameras on this host...
+		 * man, stay reasonable...
+		 */
 		return -ENOMEM;
 
 	icd->devnum		= num;
@@ -1268,7 +1282,6 @@ static int video_dev_create(struct soc_camera_device *icd)
 	vdev->fops		= &soc_camera_fops;
 	vdev->ioctl_ops		= &soc_camera_ioctl_ops;
 	vdev->release		= video_device_release;
-	vdev->minor		= -1;
 	vdev->tvnorms		= V4L2_STD_UNKNOWN;
 
 	icd->vdev = vdev;
@@ -1291,8 +1304,7 @@ static int soc_camera_video_start(struct soc_camera_device *icd)
 	    !icd->ops->set_bus_param)
 		return -EINVAL;
 
-	ret = video_register_device(icd->vdev, VFL_TYPE_GRABBER,
-				    icd->vdev->minor);
+	ret = video_register_device(icd->vdev, VFL_TYPE_GRABBER, -1);
 	if (ret < 0) {
 		dev_err(&icd->dev, "video_register_device failed: %d\n", ret);
 		return ret;
@@ -1335,9 +1347,11 @@ escdevreg:
 	return ret;
 }
 
-/* Only called on rmmod for each platform device, since they are not
+/*
+ * Only called on rmmod for each platform device, since they are not
  * hot-pluggable. Now we know, that all our users - hosts and devices have
- * been unloaded already */
+ * been unloaded already
+ */
 static int __devexit soc_camera_pdrv_remove(struct platform_device *pdev)
 {
 	struct soc_camera_device *icd = platform_get_drvdata(pdev);
diff --git a/drivers/media/video/soc_camera_platform.c b/drivers/media/video/soc_camera_platform.c
index b6a575ce5da2..10b003a8be83 100644
--- a/drivers/media/video/soc_camera_platform.c
+++ b/drivers/media/video/soc_camera_platform.c
@@ -22,7 +22,6 @@
 
 struct soc_camera_platform_priv {
 	struct v4l2_subdev subdev;
-	struct soc_camera_data_format format;
 };
 
 static struct soc_camera_platform_priv *get_priv(struct platform_device *pdev)
@@ -58,36 +57,36 @@ soc_camera_platform_query_bus_param(struct soc_camera_device *icd)
 }
 
 static int soc_camera_platform_try_fmt(struct v4l2_subdev *sd,
-				       struct v4l2_format *f)
+				       struct v4l2_mbus_framefmt *mf)
 {
 	struct soc_camera_platform_info *p = v4l2_get_subdevdata(sd);
-	struct v4l2_pix_format *pix = &f->fmt.pix;
 
-	pix->width = p->format.width;
-	pix->height = p->format.height;
+	mf->width	= p->format.width;
+	mf->height	= p->format.height;
+	mf->code	= p->format.code;
+	mf->colorspace	= p->format.colorspace;
+
 	return 0;
 }
 
-static void soc_camera_platform_video_probe(struct soc_camera_device *icd,
-					    struct platform_device *pdev)
+static struct v4l2_subdev_core_ops platform_subdev_core_ops;
+
+static int soc_camera_platform_enum_fmt(struct v4l2_subdev *sd, int index,
+					enum v4l2_mbus_pixelcode *code)
 {
-	struct soc_camera_platform_priv *priv = get_priv(pdev);
-	struct soc_camera_platform_info *p = pdev->dev.platform_data;
+	struct soc_camera_platform_info *p = v4l2_get_subdevdata(sd);
 
-	priv->format.name = p->format_name;
-	priv->format.depth = p->format_depth;
-	priv->format.fourcc = p->format.pixelformat;
-	priv->format.colorspace = p->format.colorspace;
+	if (index)
+		return -EINVAL;
 
-	icd->formats = &priv->format;
-	icd->num_formats = 1;
+	*code = p->format.code;
+	return 0;
 }
 
-static struct v4l2_subdev_core_ops platform_subdev_core_ops;
-
 static struct v4l2_subdev_video_ops platform_subdev_video_ops = {
 	.s_stream	= soc_camera_platform_s_stream,
-	.try_fmt	= soc_camera_platform_try_fmt,
+	.try_mbus_fmt	= soc_camera_platform_try_fmt,
+	.enum_mbus_fmt	= soc_camera_platform_enum_fmt,
 };
 
 static struct v4l2_subdev_ops platform_subdev_ops = {
@@ -128,13 +127,10 @@ static int soc_camera_platform_probe(struct platform_device *pdev)
 	/* Set the control device reference */
 	dev_set_drvdata(&icd->dev, &pdev->dev);
 
-	icd->y_skip_top		= 0;
-	icd->ops		= &soc_camera_platform_ops;
+	icd->ops = &soc_camera_platform_ops;
 
 	ici = to_soc_camera_host(icd->dev.parent);
 
-	soc_camera_platform_video_probe(icd, pdev);
-
 	v4l2_subdev_init(&priv->subdev, &platform_subdev_ops);
 	v4l2_set_subdevdata(&priv->subdev, p);
 	strncpy(priv->subdev.name, dev_name(&pdev->dev), V4L2_SUBDEV_NAME_SIZE);
diff --git a/drivers/media/video/soc_mediabus.c b/drivers/media/video/soc_mediabus.c
new file mode 100644
index 000000000000..f8d5c87dc2aa
--- /dev/null
+++ b/drivers/media/video/soc_mediabus.c
@@ -0,0 +1,157 @@
+/*
+ * soc-camera media bus helper routines
+ *
+ * Copyright (C) 2009, Guennadi Liakhovetski <g.liakhovetski@gmx.de>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+
+#include <media/v4l2-device.h>
+#include <media/v4l2-mediabus.h>
+#include <media/soc_mediabus.h>
+
+#define MBUS_IDX(f) (V4L2_MBUS_FMT_ ## f - V4L2_MBUS_FMT_FIXED - 1)
+
+static const struct soc_mbus_pixelfmt mbus_fmt[] = {
+	[MBUS_IDX(YUYV8_2X8_LE)] = {
+		.fourcc			= V4L2_PIX_FMT_YUYV,
+		.name			= "YUYV",
+		.bits_per_sample	= 8,
+		.packing		= SOC_MBUS_PACKING_2X8_PADHI,
+		.order			= SOC_MBUS_ORDER_LE,
+	}, [MBUS_IDX(YVYU8_2X8_LE)] = {
+		.fourcc			= V4L2_PIX_FMT_YVYU,
+		.name			= "YVYU",
+		.bits_per_sample	= 8,
+		.packing		= SOC_MBUS_PACKING_2X8_PADHI,
+		.order			= SOC_MBUS_ORDER_LE,
+	}, [MBUS_IDX(YUYV8_2X8_BE)] = {
+		.fourcc			= V4L2_PIX_FMT_UYVY,
+		.name			= "UYVY",
+		.bits_per_sample	= 8,
+		.packing		= SOC_MBUS_PACKING_2X8_PADHI,
+		.order			= SOC_MBUS_ORDER_LE,
+	}, [MBUS_IDX(YVYU8_2X8_BE)] = {
+		.fourcc			= V4L2_PIX_FMT_VYUY,
+		.name			= "VYUY",
+		.bits_per_sample	= 8,
+		.packing		= SOC_MBUS_PACKING_2X8_PADHI,
+		.order			= SOC_MBUS_ORDER_LE,
+	}, [MBUS_IDX(RGB555_2X8_PADHI_LE)] = {
+		.fourcc			= V4L2_PIX_FMT_RGB555,
+		.name			= "RGB555",
+		.bits_per_sample	= 8,
+		.packing		= SOC_MBUS_PACKING_2X8_PADHI,
+		.order			= SOC_MBUS_ORDER_LE,
+	}, [MBUS_IDX(RGB555_2X8_PADHI_BE)] = {
+		.fourcc			= V4L2_PIX_FMT_RGB555X,
+		.name			= "RGB555X",
+		.bits_per_sample	= 8,
+		.packing		= SOC_MBUS_PACKING_2X8_PADHI,
+		.order			= SOC_MBUS_ORDER_LE,
+	}, [MBUS_IDX(RGB565_2X8_LE)] = {
+		.fourcc			= V4L2_PIX_FMT_RGB565,
+		.name			= "RGB565",
+		.bits_per_sample	= 8,
+		.packing		= SOC_MBUS_PACKING_2X8_PADHI,
+		.order			= SOC_MBUS_ORDER_LE,
+	}, [MBUS_IDX(RGB565_2X8_BE)] = {
+		.fourcc			= V4L2_PIX_FMT_RGB565X,
+		.name			= "RGB565X",
+		.bits_per_sample	= 8,
+		.packing		= SOC_MBUS_PACKING_2X8_PADHI,
+		.order			= SOC_MBUS_ORDER_LE,
+	}, [MBUS_IDX(SBGGR8_1X8)] = {
+		.fourcc			= V4L2_PIX_FMT_SBGGR8,
+		.name			= "Bayer 8 BGGR",
+		.bits_per_sample	= 8,
+		.packing		= SOC_MBUS_PACKING_NONE,
+		.order			= SOC_MBUS_ORDER_LE,
+	}, [MBUS_IDX(SBGGR10_1X10)] = {
+		.fourcc			= V4L2_PIX_FMT_SBGGR10,
+		.name			= "Bayer 10 BGGR",
+		.bits_per_sample	= 10,
+		.packing		= SOC_MBUS_PACKING_EXTEND16,
+		.order			= SOC_MBUS_ORDER_LE,
+	}, [MBUS_IDX(GREY8_1X8)] = {
+		.fourcc			= V4L2_PIX_FMT_GREY,
+		.name			= "Grey",
+		.bits_per_sample	= 8,
+		.packing		= SOC_MBUS_PACKING_NONE,
+		.order			= SOC_MBUS_ORDER_LE,
+	}, [MBUS_IDX(Y10_1X10)] = {
+		.fourcc			= V4L2_PIX_FMT_Y10,
+		.name			= "Grey 10bit",
+		.bits_per_sample	= 10,
+		.packing		= SOC_MBUS_PACKING_EXTEND16,
+		.order			= SOC_MBUS_ORDER_LE,
+	}, [MBUS_IDX(SBGGR10_2X8_PADHI_LE)] = {
+		.fourcc			= V4L2_PIX_FMT_SBGGR10,
+		.name			= "Bayer 10 BGGR",
+		.bits_per_sample	= 8,
+		.packing		= SOC_MBUS_PACKING_2X8_PADHI,
+		.order			= SOC_MBUS_ORDER_LE,
+	}, [MBUS_IDX(SBGGR10_2X8_PADLO_LE)] = {
+		.fourcc			= V4L2_PIX_FMT_SBGGR10,
+		.name			= "Bayer 10 BGGR",
+		.bits_per_sample	= 8,
+		.packing		= SOC_MBUS_PACKING_2X8_PADLO,
+		.order			= SOC_MBUS_ORDER_LE,
+	}, [MBUS_IDX(SBGGR10_2X8_PADHI_BE)] = {
+		.fourcc			= V4L2_PIX_FMT_SBGGR10,
+		.name			= "Bayer 10 BGGR",
+		.bits_per_sample	= 8,
+		.packing		= SOC_MBUS_PACKING_2X8_PADHI,
+		.order			= SOC_MBUS_ORDER_BE,
+	}, [MBUS_IDX(SBGGR10_2X8_PADLO_BE)] = {
+		.fourcc			= V4L2_PIX_FMT_SBGGR10,
+		.name			= "Bayer 10 BGGR",
+		.bits_per_sample	= 8,
+		.packing		= SOC_MBUS_PACKING_2X8_PADLO,
+		.order			= SOC_MBUS_ORDER_BE,
+	},
+};
+
+s32 soc_mbus_bytes_per_line(u32 width, const struct soc_mbus_pixelfmt *mf)
+{
+	switch (mf->packing) {
+	case SOC_MBUS_PACKING_NONE:
+		return width * mf->bits_per_sample / 8;
+	case SOC_MBUS_PACKING_2X8_PADHI:
+	case SOC_MBUS_PACKING_2X8_PADLO:
+	case SOC_MBUS_PACKING_EXTEND16:
+		return width * 2;
+	}
+	return -EINVAL;
+}
+EXPORT_SYMBOL(soc_mbus_bytes_per_line);
+
+const struct soc_mbus_pixelfmt *soc_mbus_get_fmtdesc(
+	enum v4l2_mbus_pixelcode code)
+{
+	if ((unsigned int)(code - V4L2_MBUS_FMT_FIXED) > ARRAY_SIZE(mbus_fmt))
+		return NULL;
+	return mbus_fmt + code - V4L2_MBUS_FMT_FIXED - 1;
+}
+EXPORT_SYMBOL(soc_mbus_get_fmtdesc);
+
+static int __init soc_mbus_init(void)
+{
+	return 0;
+}
+
+static void __exit soc_mbus_exit(void)
+{
+}
+
+module_init(soc_mbus_init);
+module_exit(soc_mbus_exit);
+
+MODULE_DESCRIPTION("soc-camera media bus interface");
+MODULE_AUTHOR("Guennadi Liakhovetski <g.liakhovetski@gmx.de>");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/media/video/stk-webcam.c b/drivers/media/video/stk-webcam.c
index 6b41865f42bd..f07a0f6b71c4 100644
--- a/drivers/media/video/stk-webcam.c
+++ b/drivers/media/video/stk-webcam.c
@@ -1307,7 +1307,6 @@ static void stk_v4l_dev_release(struct video_device *vd)
 
 static struct video_device stk_v4l_data = {
 	.name = "stkwebcam",
-	.minor = -1,
 	.tvnorms = V4L2_STD_UNKNOWN,
 	.current_norm = V4L2_STD_UNKNOWN,
 	.fops = &v4l_stk_fops,
@@ -1327,8 +1326,8 @@ static int stk_register_video_device(struct stk_camera *dev)
 	if (err)
 		STK_ERROR("v4l registration failed\n");
 	else
-		STK_INFO("Syntek USB2.0 Camera is now controlling video device"
-			" /dev/video%d\n", dev->vdev.num);
+		STK_INFO("Syntek USB2.0 Camera is now controlling device %s\n",
+			 video_device_node_name(&dev->vdev));
 	return err;
 }
 
@@ -1418,8 +1417,8 @@ static void stk_camera_disconnect(struct usb_interface *interface)
 	wake_up_interruptible(&dev->wait_frame);
 	stk_remove_sysfs_files(&dev->vdev);
 
-	STK_INFO("Syntek USB2.0 Camera release resources "
-		"video device /dev/video%d\n", dev->vdev.num);
+	STK_INFO("Syntek USB2.0 Camera release resources device %s\n",
+		 video_device_node_name(&dev->vdev));
 
 	video_unregister_device(&dev->vdev);
 }
diff --git a/drivers/media/video/stradis.c b/drivers/media/video/stradis.c
index eaada39c76fd..a057824e7ebc 100644
--- a/drivers/media/video/stradis.c
+++ b/drivers/media/video/stradis.c
@@ -1921,7 +1921,6 @@ static const struct v4l2_file_operations saa_fops = {
 static struct video_device saa_template = {
 	.name = "SAA7146A",
 	.fops = &saa_fops,
-	.minor = -1,
 	.release = video_device_release_empty,
 };
 
@@ -1972,7 +1971,6 @@ static int __devinit configure_saa7146(struct pci_dev *pdev, int num)
 
 	saa->id = pdev->device;
 	saa->irq = pdev->irq;
-	saa->video_dev.minor = -1;
 	saa->saa7146_adr = pci_resource_start(pdev, 0);
 	pci_read_config_byte(pdev, PCI_CLASS_REVISION, &saa->revision);
 
@@ -2134,7 +2132,7 @@ static void stradis_release_saa(struct pci_dev *pdev)
 	free_irq(saa->irq, saa);
 	if (saa->saa7146_mem)
 		iounmap(saa->saa7146_mem);
-	if (saa->video_dev.minor != -1)
+	if (video_is_registered(&saa->video_dev))
 		video_unregister_device(&saa->video_dev);
 }
 
diff --git a/drivers/media/video/stv680.c b/drivers/media/video/stv680.c
index 6a91714125d2..5938ad8702ef 100644
--- a/drivers/media/video/stv680.c
+++ b/drivers/media/video/stv680.c
@@ -1405,7 +1405,6 @@ static struct video_device stv680_template = {
 	.name =		"STV0680 USB camera",
 	.fops =         &stv680_fops,
 	.release =	video_device_release,
-	.minor = 	-1,
 };
 
 static int stv680_probe (struct usb_interface *intf, const struct usb_device_id *id)
@@ -1467,8 +1466,8 @@ static int stv680_probe (struct usb_interface *intf, const struct usb_device_id
 		retval = -EIO;
 		goto error_vdev;
 	}
-	PDEBUG(0, "STV(i): registered new video device: video%d",
-		stv680->vdev->num);
+	PDEBUG(0, "STV(i): registered new video device: %s",
+		video_device_node_name(stv680->vdev));
 
 	usb_set_intfdata (intf, stv680);
 	retval = stv680_create_sysfs_files(stv680->vdev);
diff --git a/drivers/media/video/tuner-core.c b/drivers/media/video/tuner-core.c
index aba92e2313d8..5b3eaa16afd2 100644
--- a/drivers/media/video/tuner-core.c
+++ b/drivers/media/video/tuner-core.c
@@ -320,6 +320,7 @@ static void set_type(struct i2c_client *c, unsigned int type,
 	struct dvb_tuner_ops *fe_tuner_ops = &t->fe.ops.tuner_ops;
 	struct analog_demod_ops *analog_ops = &t->fe.ops.analog_ops;
 	unsigned char buffer[4];
+	int tune_now = 1;
 
 	if (type == UNSET || type == TUNER_ABSENT) {
 		tuner_dbg ("tuner 0x%02x: Tuner type absent\n",c->addr);
@@ -328,7 +329,7 @@ static void set_type(struct i2c_client *c, unsigned int type,
 
 	t->type = type;
 	/* prevent invalid config values */
-	t->config = ((new_config >= 0) && (new_config < 256)) ? new_config : 0;
+	t->config = new_config < 256 ? new_config : 0;
 	if (tuner_callback != NULL) {
 		tuner_dbg("defining GPIO callback\n");
 		t->fe.callback = tuner_callback;
@@ -404,6 +405,7 @@ static void set_type(struct i2c_client *c, unsigned int type,
 		};
 		if (!dvb_attach(xc2028_attach, &t->fe, &cfg))
 			goto attach_failed;
+		tune_now = 0;
 		break;
 	}
 	case TUNER_TDA9887:
@@ -419,6 +421,7 @@ static void set_type(struct i2c_client *c, unsigned int type,
 		if (!dvb_attach(xc5000_attach,
 				&t->fe, t->i2c->adapter, &xc5000_cfg))
 			goto attach_failed;
+		tune_now = 0;
 		break;
 	}
 	case TUNER_NXP_TDA18271:
@@ -430,6 +433,7 @@ static void set_type(struct i2c_client *c, unsigned int type,
 		if (!dvb_attach(tda18271_attach, &t->fe, t->i2c->addr,
 				t->i2c->adapter, &cfg))
 			goto attach_failed;
+		tune_now = 0;
 		break;
 	}
 	default:
@@ -458,12 +462,13 @@ static void set_type(struct i2c_client *c, unsigned int type,
 	if (t->mode_mask == T_UNINITIALIZED)
 		t->mode_mask = new_mode_mask;
 
-	/* xc2028/3028 and xc5000 requires a firmware to be set-up later
+	/* Some tuners require more initialization setup before use,
+	   such as firmware download or device calibration.
 	   trying to set a frequency here will just fail
 	   FIXME: better to move set_freq to the tuner code. This is needed
 	   on analog tuners for PLL to properly work
 	 */
-	if (t->type != TUNER_XC2028 && t->type != TUNER_XC5000)
+	if (tune_now)
 		set_freq(c, (V4L2_TUNER_RADIO == t->mode) ?
 			    t->radio_freq : t->tv_freq);
 
@@ -752,14 +757,17 @@ static int tuner_s_radio(struct v4l2_subdev *sd)
 	return 0;
 }
 
-static int tuner_s_standby(struct v4l2_subdev *sd)
+static int tuner_s_power(struct v4l2_subdev *sd, int on)
 {
 	struct tuner *t = to_tuner(sd);
 	struct analog_demod_ops *analog_ops = &t->fe.ops.analog_ops;
 
+	if (on)
+		return 0;
+
 	tuner_dbg("Putting tuner to sleep\n");
 
-	if (check_mode(t, "s_standby") == -EINVAL)
+	if (check_mode(t, "s_power") == -EINVAL)
 		return 0;
 	t->mode = T_STANDBY;
 	if (analog_ops->standby)
@@ -961,6 +969,7 @@ static int tuner_command(struct i2c_client *client, unsigned cmd, void *arg)
 static const struct v4l2_subdev_core_ops tuner_core_ops = {
 	.log_status = tuner_log_status,
 	.s_std = tuner_s_std,
+	.s_power = tuner_s_power,
 };
 
 static const struct v4l2_subdev_tuner_ops tuner_tuner_ops = {
@@ -971,7 +980,6 @@ static const struct v4l2_subdev_tuner_ops tuner_tuner_ops = {
 	.g_frequency = tuner_g_frequency,
 	.s_type_addr = tuner_s_type_addr,
 	.s_config = tuner_s_config,
-	.s_standby = tuner_s_standby,
 };
 
 static const struct v4l2_subdev_ops tuner_ops = {
diff --git a/drivers/media/video/tvaudio.c b/drivers/media/video/tvaudio.c
index 0869bafc2b56..800fc1b111ef 100644
--- a/drivers/media/video/tvaudio.c
+++ b/drivers/media/video/tvaudio.c
@@ -1919,7 +1919,7 @@ static const struct v4l2_subdev_tuner_ops tvaudio_tuner_ops = {
 	.s_radio = tvaudio_s_radio,
 	.s_frequency = tvaudio_s_frequency,
 	.s_tuner = tvaudio_s_tuner,
-	.s_tuner = tvaudio_g_tuner,
+	.g_tuner = tvaudio_g_tuner,
 };
 
 static const struct v4l2_subdev_audio_ops tvaudio_audio_ops = {
diff --git a/drivers/media/video/tvp514x.c b/drivers/media/video/tvp514x.c
index 244372627df2..26b4e718cd6d 100644
--- a/drivers/media/video/tvp514x.c
+++ b/drivers/media/video/tvp514x.c
@@ -272,7 +272,7 @@ static int tvp514x_read_reg(struct v4l2_subdev *sd, u8 reg)
 read_again:
 
 	err = i2c_smbus_read_byte_data(client, reg);
-	if (err == -1) {
+	if (err < 0) {
 		if (retry <= I2C_RETRY_COUNT) {
 			v4l2_warn(sd, "Read: retry ... %d\n", retry);
 			retry++;
diff --git a/drivers/media/video/tw9910.c b/drivers/media/video/tw9910.c
index 269ab044072a..5b801a6e1eea 100644
--- a/drivers/media/video/tw9910.c
+++ b/drivers/media/video/tw9910.c
@@ -29,7 +29,7 @@
 #include <media/tw9910.h>
 
 #define GET_ID(val)  ((val & 0xF8) >> 3)
-#define GET_ReV(val) (val & 0x07)
+#define GET_REV(val) (val & 0x07)
 
 /*
  * register offset
@@ -117,7 +117,7 @@
 #define LCTL24		0x68
 #define LCTL25		0x69
 #define LCTL26		0x6A
-#define HSGEGIN		0x6B
+#define HSBEGIN		0x6B
 #define HSEND		0x6C
 #define OVSDLY		0x6D
 #define OVSEND		0x6E
@@ -152,7 +152,10 @@
 			 /* 1 : non-auto */
 #define VSCTL       0x08 /* 1 : Vertical out ctrl by DVALID */
 			 /* 0 : Vertical out ctrl by HACTIVE and DVALID */
-#define OEN         0x04 /* Output Enable together with TRI_SEL. */
+#define OEN_TRI_SEL_MASK	0x07
+#define OEN_TRI_SEL_ALL_ON	0x00 /* Enable output for Rev0/Rev1 */
+#define OEN_TRI_SEL_ALL_OFF_r0	0x06 /* All tri-stated for Rev0 */
+#define OEN_TRI_SEL_ALL_OFF_r1	0x07 /* All tri-stated for Rev1 */
 
 /* OUTCTR1 */
 #define VSP_LO      0x00 /* 0 : VS pin output polarity is active low */
@@ -178,11 +181,18 @@
 			  * but all register content remain unchanged.
 			  * This bit is self-resetting.
 			  */
+#define ACNTL1_PDN_MASK	0x0e
+#define CLK_PDN		0x08 /* system clock power down */
+#define Y_PDN		0x04 /* Luma ADC power down */
+#define C_PDN		0x02 /* Chroma ADC power down */
+
+/* ACNTL2 */
+#define ACNTL2_PDN_MASK	0x40
+#define PLL_PDN		0x40 /* PLL power down */
 
 /* VBICNTL */
-/* RTSEL : control the real time signal
-*          output from the MPOUT pin
-*/
+
+/* RTSEL : control the real time signal output from the MPOUT pin */
 #define RTSEL_MASK  0x07
 #define RTSEL_VLOSS 0x00 /* 0000 = Video loss */
 #define RTSEL_HLOCK 0x01 /* 0001 = H-lock */
@@ -226,28 +236,7 @@ struct tw9910_priv {
 	struct v4l2_subdev                subdev;
 	struct tw9910_video_info       *info;
 	const struct tw9910_scale_ctrl *scale;
-};
-
-/*
- * register settings
- */
-
-#define ENDMARKER { 0xff, 0xff }
-
-static const struct regval_list tw9910_default_regs[] =
-{
-	{ OPFORM,  0x00 },
-	{ OUTCTR1, VSP_LO | VSSL_VVALID | HSP_HI | HSSL_HSYNC },
-	ENDMARKER,
-};
-
-static const struct soc_camera_data_format tw9910_color_fmt[] = {
-	{
-		.name       = "VYUY",
-		.fourcc     = V4L2_PIX_FMT_VYUY,
-		.depth      = 16,
-		.colorspace = V4L2_COLORSPACE_SMPTE170M,
-	}
+	u32                             revision;
 };
 
 static const struct tw9910_scale_ctrl tw9910_ntsc_scales[] = {
@@ -340,13 +329,6 @@ static const struct tw9910_scale_ctrl tw9910_pal_scales[] = {
 	},
 };
 
-static const struct tw9910_cropping_ctrl tw9910_cropping_ctrl = {
-	.vdelay  = 0x0012,
-	.vactive = 0x00F0,
-	.hdelay  = 0x0010,
-	.hactive = 0x02D0,
-};
-
 static const struct tw9910_hsync_ctrl tw9910_hsync_ctrl = {
 	.start = 0x0260,
 	.end   = 0x0300,
@@ -361,6 +343,19 @@ static struct tw9910_priv *to_tw9910(const struct i2c_client *client)
 			    subdev);
 }
 
+static int tw9910_mask_set(struct i2c_client *client, u8 command,
+			   u8 mask, u8 set)
+{
+	s32 val = i2c_smbus_read_byte_data(client, command);
+	if (val < 0)
+		return val;
+
+	val &= ~mask;
+	val |= set & mask;
+
+	return i2c_smbus_write_byte_data(client, command, val);
+}
+
 static int tw9910_set_scale(struct i2c_client *client,
 			    const struct tw9910_scale_ctrl *scale)
 {
@@ -383,47 +378,14 @@ static int tw9910_set_scale(struct i2c_client *client,
 	return ret;
 }
 
-static int tw9910_set_cropping(struct i2c_client *client,
-			       const struct tw9910_cropping_ctrl *cropping)
-{
-	int ret;
-
-	ret = i2c_smbus_write_byte_data(client, CROP_HI,
-					(cropping->vdelay  & 0x0300) >> 2 |
-					(cropping->vactive & 0x0300) >> 4 |
-					(cropping->hdelay  & 0x0300) >> 6 |
-					(cropping->hactive & 0x0300) >> 8);
-	if (ret < 0)
-		return ret;
-
-	ret = i2c_smbus_write_byte_data(client, VDELAY_LO,
-					cropping->vdelay & 0x00FF);
-	if (ret < 0)
-		return ret;
-
-	ret = i2c_smbus_write_byte_data(client, VACTIVE_LO,
-					cropping->vactive & 0x00FF);
-	if (ret < 0)
-		return ret;
-
-	ret = i2c_smbus_write_byte_data(client, HDELAY_LO,
-					cropping->hdelay & 0x00FF);
-	if (ret < 0)
-		return ret;
-
-	ret = i2c_smbus_write_byte_data(client, HACTIVE_LO,
-					cropping->hactive & 0x00FF);
-
-	return ret;
-}
-
 static int tw9910_set_hsync(struct i2c_client *client,
 			    const struct tw9910_hsync_ctrl *hsync)
 {
+	struct tw9910_priv *priv = to_tw9910(client);
 	int ret;
 
 	/* bit 10 - 3 */
-	ret = i2c_smbus_write_byte_data(client, HSGEGIN,
+	ret = i2c_smbus_write_byte_data(client, HSBEGIN,
 					(hsync->start & 0x07F8) >> 3);
 	if (ret < 0)
 		return ret;
@@ -434,50 +396,41 @@ static int tw9910_set_hsync(struct i2c_client *client,
 	if (ret < 0)
 		return ret;
 
+	/* So far only revisions 0 and 1 have been seen */
 	/* bit 2 - 0 */
-	ret = i2c_smbus_read_byte_data(client, HSLOWCTL);
-	if (ret < 0)
-		return ret;
-
-	ret = i2c_smbus_write_byte_data(client, HSLOWCTL,
-					(ret & 0x88)                 |
-					(hsync->start & 0x0007) << 4 |
-					(hsync->end   & 0x0007));
+	if (1 == priv->revision)
+		ret = tw9910_mask_set(client, HSLOWCTL, 0x77,
+				      (hsync->start & 0x0007) << 4 |
+				      (hsync->end   & 0x0007));
 
 	return ret;
 }
 
-static int tw9910_write_array(struct i2c_client *client,
-			      const struct regval_list *vals)
+static void tw9910_reset(struct i2c_client *client)
 {
-	while (vals->reg_num != 0xff) {
-		int ret = i2c_smbus_write_byte_data(client,
-						    vals->reg_num,
-						    vals->value);
-		if (ret < 0)
-			return ret;
-		vals++;
-	}
-	return 0;
+	tw9910_mask_set(client, ACNTL1, SRESET, SRESET);
+	msleep(1);
 }
 
-static int tw9910_mask_set(struct i2c_client *client, u8 command,
-			   u8 mask, u8 set)
+static int tw9910_power(struct i2c_client *client, int enable)
 {
-	s32 val = i2c_smbus_read_byte_data(client, command);
-	if (val < 0)
-		return val;
+	int ret;
+	u8 acntl1;
+	u8 acntl2;
 
-	val &= ~mask;
-	val |= set & mask;
+	if (enable) {
+		acntl1 = 0;
+		acntl2 = 0;
+	} else {
+		acntl1 = CLK_PDN | Y_PDN | C_PDN;
+		acntl2 = PLL_PDN;
+	}
 
-	return i2c_smbus_write_byte_data(client, command, val);
-}
+	ret = tw9910_mask_set(client, ACNTL1, ACNTL1_PDN_MASK, acntl1);
+	if (ret < 0)
+		return ret;
 
-static void tw9910_reset(struct i2c_client *client)
-{
-	i2c_smbus_write_byte_data(client, ACNTL1, SRESET);
-	msleep(1);
+	return tw9910_mask_set(client, ACNTL2, ACNTL2_PDN_MASK, acntl2);
 }
 
 static const struct tw9910_scale_ctrl*
@@ -518,27 +471,62 @@ static int tw9910_s_stream(struct v4l2_subdev *sd, int enable)
 {
 	struct i2c_client *client = sd->priv;
 	struct tw9910_priv *priv = to_tw9910(client);
+	u8 val;
+	int ret;
 
-	if (!enable)
-		return 0;
+	if (!enable) {
+		switch (priv->revision) {
+		case 0:
+			val = OEN_TRI_SEL_ALL_OFF_r0;
+			break;
+		case 1:
+			val = OEN_TRI_SEL_ALL_OFF_r1;
+			break;
+		default:
+			dev_err(&client->dev, "un-supported revision\n");
+			return -EINVAL;
+		}
+	} else {
+		val = OEN_TRI_SEL_ALL_ON;
 
-	if (!priv->scale) {
-		dev_err(&client->dev, "norm select error\n");
-		return -EPERM;
+		if (!priv->scale) {
+			dev_err(&client->dev, "norm select error\n");
+			return -EPERM;
+		}
+
+		dev_dbg(&client->dev, "%s %dx%d\n",
+			priv->scale->name,
+			priv->scale->width,
+			priv->scale->height);
 	}
 
-	dev_dbg(&client->dev, "%s %dx%d\n",
-		 priv->scale->name,
-		 priv->scale->width,
-		 priv->scale->height);
+	ret = tw9910_mask_set(client, OPFORM, OEN_TRI_SEL_MASK, val);
+	if (ret < 0)
+		return ret;
 
-	return 0;
+	return tw9910_power(client, enable);
 }
 
 static int tw9910_set_bus_param(struct soc_camera_device *icd,
 				unsigned long flags)
 {
-	return 0;
+	struct v4l2_subdev *sd = soc_camera_to_subdev(icd);
+	struct i2c_client *client = sd->priv;
+	u8 val = VSSL_VVALID | HSSL_DVALID;
+
+	/*
+	 * set OUTCTR1
+	 *
+	 * We use VVALID and DVALID signals to control VSYNC and HSYNC
+	 * outputs, in this mode their polarity is inverted.
+	 */
+	if (flags & SOCAM_HSYNC_ACTIVE_LOW)
+		val |= HSP_HI;
+
+	if (flags & SOCAM_VSYNC_ACTIVE_LOW)
+		val |= VSP_HI;
+
+	return i2c_smbus_write_byte_data(client, OUTCTR1, val);
 }
 
 static unsigned long tw9910_query_bus_param(struct soc_camera_device *icd)
@@ -548,6 +536,7 @@ static unsigned long tw9910_query_bus_param(struct soc_camera_device *icd)
 	struct soc_camera_link *icl = to_soc_camera_link(icd);
 	unsigned long flags = SOCAM_PCLK_SAMPLE_RISING | SOCAM_MASTER |
 		SOCAM_VSYNC_ACTIVE_HIGH | SOCAM_HSYNC_ACTIVE_HIGH |
+		SOCAM_VSYNC_ACTIVE_LOW  | SOCAM_HSYNC_ACTIVE_LOW  |
 		SOCAM_DATA_ACTIVE_HIGH | priv->info->buswidth;
 
 	return soc_camera_apply_sensor_flags(icl, flags);
@@ -576,8 +565,11 @@ static int tw9910_enum_input(struct soc_camera_device *icd,
 static int tw9910_g_chip_ident(struct v4l2_subdev *sd,
 			       struct v4l2_dbg_chip_ident *id)
 {
+	struct i2c_client *client = sd->priv;
+	struct tw9910_priv *priv = to_tw9910(client);
+
 	id->ident = V4L2_IDENT_TW9910;
-	id->revision = 0;
+	id->revision = priv->revision;
 
 	return 0;
 }
@@ -596,7 +588,8 @@ static int tw9910_g_register(struct v4l2_subdev *sd,
 	if (ret < 0)
 		return ret;
 
-	/* ret      = int
+	/*
+	 * ret      = int
 	 * reg->val = __u64
 	 */
 	reg->val = (__u64)ret;
@@ -637,9 +630,6 @@ static int tw9910_s_crop(struct v4l2_subdev *sd, struct v4l2_crop *a)
 	 * reset hardware
 	 */
 	tw9910_reset(client);
-	ret = tw9910_write_array(client, tw9910_default_regs);
-	if (ret < 0)
-		goto tw9910_set_fmt_error;
 
 	/*
 	 * set bus width
@@ -688,13 +678,6 @@ static int tw9910_s_crop(struct v4l2_subdev *sd, struct v4l2_crop *a)
 		goto tw9910_set_fmt_error;
 
 	/*
-	 * set cropping
-	 */
-	ret = tw9910_set_cropping(client, &tw9910_cropping_ctrl);
-	if (ret < 0)
-		goto tw9910_set_fmt_error;
-
-	/*
 	 * set hsync
 	 */
 	ret = tw9910_set_hsync(client, &tw9910_hsync_ctrl);
@@ -762,11 +745,11 @@ static int tw9910_cropcap(struct v4l2_subdev *sd, struct v4l2_cropcap *a)
 	return 0;
 }
 
-static int tw9910_g_fmt(struct v4l2_subdev *sd, struct v4l2_format *f)
+static int tw9910_g_fmt(struct v4l2_subdev *sd,
+			struct v4l2_mbus_framefmt *mf)
 {
 	struct i2c_client *client = sd->priv;
 	struct tw9910_priv *priv = to_tw9910(client);
-	struct v4l2_pix_format *pix = &f->fmt.pix;
 
 	if (!priv->scale) {
 		int ret;
@@ -783,74 +766,76 @@ static int tw9910_g_fmt(struct v4l2_subdev *sd, struct v4l2_format *f)
 			return ret;
 	}
 
-	f->type			= V4L2_BUF_TYPE_VIDEO_CAPTURE;
-
-	pix->width		= priv->scale->width;
-	pix->height		= priv->scale->height;
-	pix->pixelformat	= V4L2_PIX_FMT_VYUY;
-	pix->colorspace		= V4L2_COLORSPACE_SMPTE170M;
-	pix->field		= V4L2_FIELD_INTERLACED;
+	mf->width	= priv->scale->width;
+	mf->height	= priv->scale->height;
+	mf->code	= V4L2_MBUS_FMT_YUYV8_2X8_BE;
+	mf->colorspace	= V4L2_COLORSPACE_JPEG;
+	mf->field	= V4L2_FIELD_INTERLACED_BT;
 
 	return 0;
 }
 
-static int tw9910_s_fmt(struct v4l2_subdev *sd, struct v4l2_format *f)
+static int tw9910_s_fmt(struct v4l2_subdev *sd,
+			struct v4l2_mbus_framefmt *mf)
 {
 	struct i2c_client *client = sd->priv;
 	struct tw9910_priv *priv = to_tw9910(client);
-	struct v4l2_pix_format *pix = &f->fmt.pix;
 	/* See tw9910_s_crop() - no proper cropping support */
 	struct v4l2_crop a = {
 		.c = {
 			.left	= 0,
 			.top	= 0,
-			.width	= pix->width,
-			.height	= pix->height,
+			.width	= mf->width,
+			.height	= mf->height,
 		},
 	};
-	int i, ret;
+	int ret;
+
+	WARN_ON(mf->field != V4L2_FIELD_ANY &&
+		mf->field != V4L2_FIELD_INTERLACED_BT);
 
 	/*
 	 * check color format
 	 */
-	for (i = 0; i < ARRAY_SIZE(tw9910_color_fmt); i++)
-		if (pix->pixelformat == tw9910_color_fmt[i].fourcc)
-			break;
-
-	if (i == ARRAY_SIZE(tw9910_color_fmt))
+	if (mf->code != V4L2_MBUS_FMT_YUYV8_2X8_BE)
 		return -EINVAL;
 
+	mf->colorspace = V4L2_COLORSPACE_JPEG;
+
 	ret = tw9910_s_crop(sd, &a);
 	if (!ret) {
-		pix->width = priv->scale->width;
-		pix->height = priv->scale->height;
+		mf->width	= priv->scale->width;
+		mf->height	= priv->scale->height;
 	}
 	return ret;
 }
 
-static int tw9910_try_fmt(struct v4l2_subdev *sd, struct v4l2_format *f)
+static int tw9910_try_fmt(struct v4l2_subdev *sd,
+			  struct v4l2_mbus_framefmt *mf)
 {
 	struct i2c_client *client = sd->priv;
 	struct soc_camera_device *icd = client->dev.platform_data;
-	struct v4l2_pix_format *pix = &f->fmt.pix;
 	const struct tw9910_scale_ctrl *scale;
 
-	if (V4L2_FIELD_ANY == pix->field) {
-		pix->field = V4L2_FIELD_INTERLACED;
-	} else if (V4L2_FIELD_INTERLACED != pix->field) {
-		dev_err(&client->dev, "Field type invalid.\n");
+	if (V4L2_FIELD_ANY == mf->field) {
+		mf->field = V4L2_FIELD_INTERLACED_BT;
+	} else if (V4L2_FIELD_INTERLACED_BT != mf->field) {
+		dev_err(&client->dev, "Field type %d invalid.\n", mf->field);
 		return -EINVAL;
 	}
 
+	mf->code = V4L2_MBUS_FMT_YUYV8_2X8_BE;
+	mf->colorspace = V4L2_COLORSPACE_JPEG;
+
 	/*
 	 * select suitable norm
 	 */
-	scale = tw9910_select_norm(icd, pix->width, pix->height);
+	scale = tw9910_select_norm(icd, mf->width, mf->height);
 	if (!scale)
 		return -EINVAL;
 
-	pix->width  = scale->width;
-	pix->height = scale->height;
+	mf->width	= scale->width;
+	mf->height	= scale->height;
 
 	return 0;
 }
@@ -859,7 +844,7 @@ static int tw9910_video_probe(struct soc_camera_device *icd,
 			      struct i2c_client *client)
 {
 	struct tw9910_priv *priv = to_tw9910(client);
-	s32 val;
+	s32 id;
 
 	/*
 	 * We must have a parent by now. And it cannot be a wrong one.
@@ -878,23 +863,24 @@ static int tw9910_video_probe(struct soc_camera_device *icd,
 		return -ENODEV;
 	}
 
-	icd->formats     = tw9910_color_fmt;
-	icd->num_formats = ARRAY_SIZE(tw9910_color_fmt);
-
 	/*
 	 * check and show Product ID
+	 * So far only revisions 0 and 1 have been seen
 	 */
-	val = i2c_smbus_read_byte_data(client, ID);
+	id = i2c_smbus_read_byte_data(client, ID);
+	priv->revision = GET_REV(id);
+	id = GET_ID(id);
 
-	if (0x0B != GET_ID(val) ||
-	    0x00 != GET_ReV(val)) {
+	if (0x0B != id ||
+	    0x01 < priv->revision) {
 		dev_err(&client->dev,
-			"Product ID error %x:%x\n", GET_ID(val), GET_ReV(val));
+			"Product ID error %x:%x\n",
+			id, priv->revision);
 		return -ENODEV;
 	}
 
 	dev_info(&client->dev,
-		 "tw9910 Product ID %0x:%0x\n", GET_ID(val), GET_ReV(val));
+		 "tw9910 Product ID %0x:%0x\n", id, priv->revision);
 
 	icd->vdev->tvnorms      = V4L2_STD_NTSC | V4L2_STD_PAL;
 	icd->vdev->current_norm = V4L2_STD_NTSC;
@@ -917,14 +903,25 @@ static struct v4l2_subdev_core_ops tw9910_subdev_core_ops = {
 #endif
 };
 
+static int tw9910_enum_fmt(struct v4l2_subdev *sd, int index,
+			   enum v4l2_mbus_pixelcode *code)
+{
+	if (index)
+		return -EINVAL;
+
+	*code = V4L2_MBUS_FMT_YUYV8_2X8_BE;
+	return 0;
+}
+
 static struct v4l2_subdev_video_ops tw9910_subdev_video_ops = {
 	.s_stream	= tw9910_s_stream,
-	.g_fmt		= tw9910_g_fmt,
-	.s_fmt		= tw9910_s_fmt,
-	.try_fmt	= tw9910_try_fmt,
+	.g_mbus_fmt	= tw9910_g_fmt,
+	.s_mbus_fmt	= tw9910_s_fmt,
+	.try_mbus_fmt	= tw9910_try_fmt,
 	.cropcap	= tw9910_cropcap,
 	.g_crop		= tw9910_g_crop,
 	.s_crop		= tw9910_s_crop,
+	.enum_mbus_fmt	= tw9910_enum_fmt,
 };
 
 static struct v4l2_subdev_ops tw9910_subdev_ops = {
@@ -954,10 +951,10 @@ static int tw9910_probe(struct i2c_client *client,
 	}
 
 	icl = to_soc_camera_link(icd);
-	if (!icl)
+	if (!icl || !icl->priv)
 		return -EINVAL;
 
-	info = container_of(icl, struct tw9910_video_info, link);
+	info = icl->priv;
 
 	if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA)) {
 		dev_err(&client->dev,
@@ -975,7 +972,7 @@ static int tw9910_probe(struct i2c_client *client,
 	v4l2_i2c_subdev_init(&priv->subdev, client, &tw9910_subdev_ops);
 
 	icd->ops     = &tw9910_ops;
-	icd->iface   = info->link.bus_id;
+	icd->iface   = icl->bus_id;
 
 	ret = tw9910_video_probe(icd, client);
 	if (ret) {
diff --git a/drivers/media/video/usbvideo/konicawc.c b/drivers/media/video/usbvideo/konicawc.c
index 31d57f2d09e1..a0addcb04295 100644
--- a/drivers/media/video/usbvideo/konicawc.c
+++ b/drivers/media/video/usbvideo/konicawc.c
@@ -225,7 +225,7 @@ static void konicawc_register_input(struct konicawc *cam, struct usb_device *dev
 	int error;
 
 	usb_make_path(dev, cam->input_physname, sizeof(cam->input_physname));
-	strncat(cam->input_physname, "/input0", sizeof(cam->input_physname));
+	strlcat(cam->input_physname, "/input0", sizeof(cam->input_physname));
 
 	cam->input = input_dev = input_allocate_device();
 	if (!input_dev) {
diff --git a/drivers/media/video/usbvideo/quickcam_messenger.c b/drivers/media/video/usbvideo/quickcam_messenger.c
index 803d3e4e29a2..c4d1b96b5cee 100644
--- a/drivers/media/video/usbvideo/quickcam_messenger.c
+++ b/drivers/media/video/usbvideo/quickcam_messenger.c
@@ -89,7 +89,7 @@ static void qcm_register_input(struct qcm *cam, struct usb_device *dev)
 	int error;
 
 	usb_make_path(dev, cam->input_physname, sizeof(cam->input_physname));
-	strncat(cam->input_physname, "/input0", sizeof(cam->input_physname));
+	strlcat(cam->input_physname, "/input0", sizeof(cam->input_physname));
 
 	cam->input = input_dev = input_allocate_device();
 	if (!input_dev) {
diff --git a/drivers/media/video/usbvideo/usbvideo.c b/drivers/media/video/usbvideo/usbvideo.c
index dea8b321fb4a..5ac37c6c4313 100644
--- a/drivers/media/video/usbvideo/usbvideo.c
+++ b/drivers/media/video/usbvideo/usbvideo.c
@@ -1053,9 +1053,9 @@ int usbvideo_RegisterVideoDevice(struct uvd *uvd)
 			 "%s: video_register_device() successful\n", __func__);
 	}
 
-	dev_info(&uvd->dev->dev, "%s on /dev/video%d: canvas=%s videosize=%s\n",
+	dev_info(&uvd->dev->dev, "%s on %s: canvas=%s videosize=%s\n",
 		 (uvd->handle != NULL) ? uvd->handle->drvName : "???",
-		 uvd->vdev.num, tmp2, tmp1);
+		 video_device_node_name(&uvd->vdev), tmp2, tmp1);
 
 	usb_get_dev(uvd->dev);
 	return 0;
diff --git a/drivers/media/video/usbvideo/vicam.c b/drivers/media/video/usbvideo/vicam.c
index 45fce39ec9ad..6030410c6677 100644
--- a/drivers/media/video/usbvideo/vicam.c
+++ b/drivers/media/video/usbvideo/vicam.c
@@ -796,7 +796,6 @@ static const struct v4l2_file_operations vicam_fops = {
 static struct video_device vicam_template = {
 	.name 		= "ViCam-based USB Camera",
 	.fops 		= &vicam_fops,
-	.minor 		= -1,
 	.release 	= video_device_release_empty,
 };
 
@@ -873,8 +872,8 @@ vicam_probe( struct usb_interface *intf, const struct usb_device_id *id)
 		return -EIO;
 	}
 
-	printk(KERN_INFO "ViCam webcam driver now controlling video device %d\n",
-			cam->vdev.num);
+	printk(KERN_INFO "ViCam webcam driver now controlling device %s\n",
+		video_device_node_name(&cam->vdev));
 
 	usb_set_intfdata (intf, cam);
 
diff --git a/drivers/media/video/usbvision/usbvision-i2c.c b/drivers/media/video/usbvision/usbvision-i2c.c
index c19f51dba2ee..0613922997e0 100644
--- a/drivers/media/video/usbvision/usbvision-i2c.c
+++ b/drivers/media/video/usbvision/usbvision-i2c.c
@@ -215,8 +215,8 @@ int usbvision_i2c_register(struct usb_usbvision *usbvision)
 	memcpy(&usbvision->i2c_adap, &i2c_adap_template,
 	       sizeof(struct i2c_adapter));
 
-	sprintf(usbvision->i2c_adap.name + strlen(usbvision->i2c_adap.name),
-		" #%d", usbvision->vdev->num);
+	sprintf(usbvision->i2c_adap.name, "%s-%d-%s", i2c_adap_template.name,
+		usbvision->dev->bus->busnum, usbvision->dev->devpath);
 	PDEBUG(DBG_I2C,"Adaptername: %s", usbvision->i2c_adap.name);
 	usbvision->i2c_adap.dev.parent = &usbvision->dev->dev;
 
diff --git a/drivers/media/video/usbvision/usbvision-video.c b/drivers/media/video/usbvision/usbvision-video.c
index a2a50d608a3f..1054546db908 100644
--- a/drivers/media/video/usbvision/usbvision-video.c
+++ b/drivers/media/video/usbvision/usbvision-video.c
@@ -601,7 +601,7 @@ static int vidioc_s_input (struct file *file, void *priv, unsigned int input)
 {
 	struct usb_usbvision *usbvision = video_drvdata(file);
 
-	if ((input >= usbvision->video_inputs) || (input < 0) )
+	if (input >= usbvision->video_inputs)
 		return -EINVAL;
 
 	mutex_lock(&usbvision->lock);
@@ -1328,7 +1328,6 @@ static struct video_device usbvision_video_template = {
 	.ioctl_ops 	= &usbvision_ioctl_ops,
 	.name           = "usbvision-video",
 	.release	= video_device_release,
-	.minor		= -1,
 	.tvnorms              = USBVISION_NORMS,
 	.current_norm         = V4L2_STD_PAL
 };
@@ -1362,7 +1361,6 @@ static struct video_device usbvision_radio_template = {
 	.fops		= &usbvision_radio_fops,
 	.name           = "usbvision-radio",
 	.release	= video_device_release,
-	.minor		= -1,
 	.ioctl_ops 	= &usbvision_radio_ioctl_ops,
 
 	.tvnorms              = USBVISION_NORMS,
@@ -1382,7 +1380,6 @@ static struct video_device usbvision_vbi_template=
 	.fops		= &usbvision_vbi_fops,
 	.release	= video_device_release,
 	.name           = "usbvision-vbi",
-	.minor		= -1,
 };
 
 
@@ -1404,7 +1401,6 @@ static struct video_device *usbvision_vdev_init(struct usb_usbvision *usbvision,
 		return NULL;
 	}
 	*vdev = *vdev_template;
-//	vdev->minor   = -1;
 	vdev->v4l2_dev = &usbvision->v4l2_dev;
 	snprintf(vdev->name, sizeof(vdev->name), "%s", name);
 	video_set_drvdata(vdev, usbvision);
@@ -1416,9 +1412,9 @@ static void usbvision_unregister_video(struct usb_usbvision *usbvision)
 {
 	// vbi Device:
 	if (usbvision->vbi) {
-		PDEBUG(DBG_PROBE, "unregister /dev/vbi%d [v4l2]",
-		       usbvision->vbi->num);
-		if (usbvision->vbi->minor != -1) {
+		PDEBUG(DBG_PROBE, "unregister %s [v4l2]",
+		       video_device_node_name(usbvision->vbi));
+		if (video_is_registered(usbvision->vbi)) {
 			video_unregister_device(usbvision->vbi);
 		} else {
 			video_device_release(usbvision->vbi);
@@ -1428,9 +1424,9 @@ static void usbvision_unregister_video(struct usb_usbvision *usbvision)
 
 	// Radio Device:
 	if (usbvision->rdev) {
-		PDEBUG(DBG_PROBE, "unregister /dev/radio%d [v4l2]",
-		       usbvision->rdev->num);
-		if (usbvision->rdev->minor != -1) {
+		PDEBUG(DBG_PROBE, "unregister %s [v4l2]",
+		       video_device_node_name(usbvision->rdev));
+		if (video_is_registered(usbvision->rdev)) {
 			video_unregister_device(usbvision->rdev);
 		} else {
 			video_device_release(usbvision->rdev);
@@ -1440,9 +1436,9 @@ static void usbvision_unregister_video(struct usb_usbvision *usbvision)
 
 	// Video Device:
 	if (usbvision->vdev) {
-		PDEBUG(DBG_PROBE, "unregister /dev/video%d [v4l2]",
-		       usbvision->vdev->num);
-		if (usbvision->vdev->minor != -1) {
+		PDEBUG(DBG_PROBE, "unregister %s [v4l2]",
+		       video_device_node_name(usbvision->vdev));
+		if (video_is_registered(usbvision->vdev)) {
 			video_unregister_device(usbvision->vdev);
 		} else {
 			video_device_release(usbvision->vdev);
@@ -1466,8 +1462,8 @@ static int __devinit usbvision_register_video(struct usb_usbvision *usbvision)
 				  video_nr)<0) {
 		goto err_exit;
 	}
-	printk(KERN_INFO "USBVision[%d]: registered USBVision Video device /dev/video%d [v4l2]\n",
-	       usbvision->nr, usbvision->vdev->num);
+	printk(KERN_INFO "USBVision[%d]: registered USBVision Video device %s [v4l2]\n",
+	       usbvision->nr, video_device_node_name(usbvision->vdev));
 
 	// Radio Device:
 	if (usbvision_device_data[usbvision->DevModel].Radio) {
@@ -1483,8 +1479,8 @@ static int __devinit usbvision_register_video(struct usb_usbvision *usbvision)
 					  radio_nr)<0) {
 			goto err_exit;
 		}
-		printk(KERN_INFO "USBVision[%d]: registered USBVision Radio device /dev/radio%d [v4l2]\n",
-		       usbvision->nr, usbvision->rdev->num);
+		printk(KERN_INFO "USBVision[%d]: registered USBVision Radio device %s [v4l2]\n",
+		       usbvision->nr, video_device_node_name(usbvision->rdev));
 	}
 	// vbi Device:
 	if (usbvision_device_data[usbvision->DevModel].vbi) {
@@ -1499,8 +1495,8 @@ static int __devinit usbvision_register_video(struct usb_usbvision *usbvision)
 					  vbi_nr)<0) {
 			goto err_exit;
 		}
-		printk(KERN_INFO "USBVision[%d]: registered USBVision VBI device /dev/vbi%d [v4l2] (Not Working Yet!)\n",
-		       usbvision->nr, usbvision->vbi->num);
+		printk(KERN_INFO "USBVision[%d]: registered USBVision VBI device %s [v4l2] (Not Working Yet!)\n",
+		       usbvision->nr, video_device_node_name(usbvision->vbi));
 	}
 	// all done
 	return 0;
diff --git a/drivers/media/video/uvc/uvc_ctrl.c b/drivers/media/video/uvc/uvc_ctrl.c
index 1b89735e62fd..ec8ef8c5560a 100644
--- a/drivers/media/video/uvc/uvc_ctrl.c
+++ b/drivers/media/video/uvc/uvc_ctrl.c
@@ -742,17 +742,7 @@ struct uvc_control *uvc_find_control(struct uvc_video_chain *chain,
 	v4l2_id &= V4L2_CTRL_ID_MASK;
 
 	/* Find the control. */
-	__uvc_find_control(chain->processing, v4l2_id, mapping, &ctrl, next);
-	if (ctrl && !next)
-		return ctrl;
-
-	list_for_each_entry(entity, &chain->iterms, chain) {
-		__uvc_find_control(entity, v4l2_id, mapping, &ctrl, next);
-		if (ctrl && !next)
-			return ctrl;
-	}
-
-	list_for_each_entry(entity, &chain->extensions, chain) {
+	list_for_each_entry(entity, &chain->entities, chain) {
 		__uvc_find_control(entity, v4l2_id, mapping, &ctrl, next);
 		if (ctrl && !next)
 			return ctrl;
@@ -826,6 +816,13 @@ int uvc_query_v4l2_ctrl(struct uvc_video_chain *chain,
 		ret = 0;
 		goto out;
 
+	case V4L2_CTRL_TYPE_BUTTON:
+		v4l2_ctrl->minimum = 0;
+		v4l2_ctrl->maximum = 0;
+		v4l2_ctrl->step = 0;
+		ret = 0;
+		goto out;
+
 	default:
 		break;
 	}
@@ -944,17 +941,7 @@ int __uvc_ctrl_commit(struct uvc_video_chain *chain, int rollback)
 	int ret = 0;
 
 	/* Find the control. */
-	ret = uvc_ctrl_commit_entity(chain->dev, chain->processing, rollback);
-	if (ret < 0)
-		goto done;
-
-	list_for_each_entry(entity, &chain->iterms, chain) {
-		ret = uvc_ctrl_commit_entity(chain->dev, entity, rollback);
-		if (ret < 0)
-			goto done;
-	}
-
-	list_for_each_entry(entity, &chain->extensions, chain) {
+	list_for_each_entry(entity, &chain->entities, chain) {
 		ret = uvc_ctrl_commit_entity(chain->dev, entity, rollback);
 		if (ret < 0)
 			goto done;
@@ -1068,8 +1055,9 @@ int uvc_xu_ctrl_query(struct uvc_video_chain *chain,
 	int ret;
 
 	/* Find the extension unit. */
-	list_for_each_entry(entity, &chain->extensions, chain) {
-		if (entity->id == xctrl->unit)
+	list_for_each_entry(entity, &chain->entities, chain) {
+		if (UVC_ENTITY_TYPE(entity) == UVC_VC_EXTENSION_UNIT &&
+		    entity->id == xctrl->unit)
 			break;
 	}
 
@@ -1405,7 +1393,7 @@ uvc_ctrl_prune_entity(struct uvc_device *dev, struct uvc_entity *entity)
 	size = entity->processing.bControlSize;
 
 	for (i = 0; i < ARRAY_SIZE(blacklist); ++i) {
-		if (!usb_match_id(dev->intf, &blacklist[i].id))
+		if (!usb_match_one_id(dev->intf, &blacklist[i].id))
 			continue;
 
 		if (blacklist[i].index >= 8 * size ||
diff --git a/drivers/media/video/uvc/uvc_driver.c b/drivers/media/video/uvc/uvc_driver.c
index 8756be569154..391cccca7ffc 100644
--- a/drivers/media/video/uvc/uvc_driver.c
+++ b/drivers/media/video/uvc/uvc_driver.c
@@ -46,6 +46,7 @@
 unsigned int uvc_no_drop_param;
 static unsigned int uvc_quirks_param;
 unsigned int uvc_trace_param;
+unsigned int uvc_timeout_param = UVC_CTRL_STREAMING_TIMEOUT;
 
 /* ------------------------------------------------------------------------
  * Video formats
@@ -248,29 +249,9 @@ static struct uvc_entity *uvc_entity_by_reference(struct uvc_device *dev,
 		entity = list_entry(&dev->entities, struct uvc_entity, list);
 
 	list_for_each_entry_continue(entity, &dev->entities, list) {
-		switch (UVC_ENTITY_TYPE(entity)) {
-		case UVC_TT_STREAMING:
-			if (entity->output.bSourceID == id)
-				return entity;
-			break;
-
-		case UVC_VC_PROCESSING_UNIT:
-			if (entity->processing.bSourceID == id)
+		for (i = 0; i < entity->bNrInPins; ++i)
+			if (entity->baSourceID[i] == id)
 				return entity;
-			break;
-
-		case UVC_VC_SELECTOR_UNIT:
-			for (i = 0; i < entity->selector.bNrInPins; ++i)
-				if (entity->selector.baSourceID[i] == id)
-					return entity;
-			break;
-
-		case UVC_VC_EXTENSION_UNIT:
-			for (i = 0; i < entity->extension.bNrInPins; ++i)
-				if (entity->extension.baSourceID[i] == id)
-					return entity;
-			break;
-		}
 	}
 
 	return NULL;
@@ -426,7 +407,8 @@ static int uvc_parse_format(struct uvc_device *dev,
 	/* Parse the frame descriptors. Only uncompressed, MJPEG and frame
 	 * based formats have frame descriptors.
 	 */
-	while (buflen > 2 && buffer[2] == ftype) {
+	while (buflen > 2 && buffer[1] == USB_DT_CS_INTERFACE &&
+	       buffer[2] == ftype) {
 		frame = &format->frame[format->nframes];
 		if (ftype != UVC_VS_FRAME_FRAME_BASED)
 			n = buflen > 25 ? buffer[25] : 0;
@@ -503,12 +485,14 @@ static int uvc_parse_format(struct uvc_device *dev,
 		buffer += buffer[0];
 	}
 
-	if (buflen > 2 && buffer[2] == UVC_VS_STILL_IMAGE_FRAME) {
+	if (buflen > 2 && buffer[1] == USB_DT_CS_INTERFACE &&
+	    buffer[2] == UVC_VS_STILL_IMAGE_FRAME) {
 		buflen -= buffer[0];
 		buffer += buffer[0];
 	}
 
-	if (buflen > 2 && buffer[2] == UVC_VS_COLORFORMAT) {
+	if (buflen > 2 && buffer[1] == USB_DT_CS_INTERFACE &&
+	    buffer[2] == UVC_VS_COLORFORMAT) {
 		if (buflen < 6) {
 			uvc_trace(UVC_TRACE_DESCR, "device %d videostreaming "
 			       "interface %d COLORFORMAT error\n",
@@ -749,6 +733,11 @@ static int uvc_parse_streaming(struct uvc_device *dev,
 		buffer += buffer[0];
 	}
 
+	if (buflen)
+		uvc_trace(UVC_TRACE_DESCR, "device %d videostreaming interface "
+			"%d has %u bytes of trailing descriptor garbage.\n",
+			dev->udev->devnum, alts->desc.bInterfaceNumber, buflen);
+
 	/* Parse the alternate settings to find the maximum bandwidth. */
 	for (i = 0; i < intf->num_altsetting; ++i) {
 		struct usb_host_endpoint *ep;
@@ -776,6 +765,28 @@ error:
 	return ret;
 }
 
+static struct uvc_entity *uvc_alloc_entity(u16 type, u8 id,
+		unsigned int num_pads, unsigned int extra_size)
+{
+	struct uvc_entity *entity;
+	unsigned int num_inputs;
+	unsigned int size;
+
+	num_inputs = (type & UVC_TERM_OUTPUT) ? num_pads : num_pads - 1;
+	size = sizeof(*entity) + extra_size + num_inputs;
+	entity = kzalloc(size, GFP_KERNEL);
+	if (entity == NULL)
+		return NULL;
+
+	entity->id = id;
+	entity->type = type;
+
+	entity->bNrInPins = num_inputs;
+	entity->baSourceID = ((__u8 *)entity) + sizeof(*entity) + extra_size;
+
+	return entity;
+}
+
 /* Parse vendor-specific extensions. */
 static int uvc_parse_vendor_control(struct uvc_device *dev,
 	const unsigned char *buffer, int buflen)
@@ -827,21 +838,18 @@ static int uvc_parse_vendor_control(struct uvc_device *dev,
 			break;
 		}
 
-		unit = kzalloc(sizeof *unit + p + 2*n, GFP_KERNEL);
+		unit = uvc_alloc_entity(UVC_VC_EXTENSION_UNIT, buffer[3],
+					p + 1, 2*n);
 		if (unit == NULL)
 			return -ENOMEM;
 
-		unit->id = buffer[3];
-		unit->type = UVC_VC_EXTENSION_UNIT;
 		memcpy(unit->extension.guidExtensionCode, &buffer[4], 16);
 		unit->extension.bNumControls = buffer[20];
-		unit->extension.bNrInPins = get_unaligned_le16(&buffer[21]);
-		unit->extension.baSourceID = (__u8 *)unit + sizeof *unit;
-		memcpy(unit->extension.baSourceID, &buffer[22], p);
+		memcpy(unit->baSourceID, &buffer[22], p);
 		unit->extension.bControlSize = buffer[22+p];
-		unit->extension.bmControls = (__u8 *)unit + sizeof *unit + p;
-		unit->extension.bmControlsType = (__u8 *)unit + sizeof *unit
-					       + p + n;
+		unit->extension.bmControls = (__u8 *)unit + sizeof(*unit);
+		unit->extension.bmControlsType = (__u8 *)unit + sizeof(*unit)
+					       + n;
 		memcpy(unit->extension.bmControls, &buffer[23+p], 2*n);
 
 		if (buffer[24+p+2*n] != 0)
@@ -938,13 +946,11 @@ static int uvc_parse_standard_control(struct uvc_device *dev,
 			return -EINVAL;
 		}
 
-		term = kzalloc(sizeof *term + n + p, GFP_KERNEL);
+		term = uvc_alloc_entity(type | UVC_TERM_INPUT, buffer[3],
+					1, n + p);
 		if (term == NULL)
 			return -ENOMEM;
 
-		term->id = buffer[3];
-		term->type = type | UVC_TERM_INPUT;
-
 		if (UVC_ENTITY_TYPE(term) == UVC_ITT_CAMERA) {
 			term->camera.bControlSize = n;
 			term->camera.bmControls = (__u8 *)term + sizeof *term;
@@ -999,13 +1005,12 @@ static int uvc_parse_standard_control(struct uvc_device *dev,
 			return 0;
 		}
 
-		term = kzalloc(sizeof *term, GFP_KERNEL);
+		term = uvc_alloc_entity(type | UVC_TERM_OUTPUT, buffer[3],
+					1, 0);
 		if (term == NULL)
 			return -ENOMEM;
 
-		term->id = buffer[3];
-		term->type = type | UVC_TERM_OUTPUT;
-		term->output.bSourceID = buffer[7];
+		memcpy(term->baSourceID, &buffer[7], 1);
 
 		if (buffer[8] != 0)
 			usb_string(udev, buffer[8], term->name,
@@ -1026,15 +1031,11 @@ static int uvc_parse_standard_control(struct uvc_device *dev,
 			return -EINVAL;
 		}
 
-		unit = kzalloc(sizeof *unit + p, GFP_KERNEL);
+		unit = uvc_alloc_entity(buffer[2], buffer[3], p + 1, 0);
 		if (unit == NULL)
 			return -ENOMEM;
 
-		unit->id = buffer[3];
-		unit->type = buffer[2];
-		unit->selector.bNrInPins = buffer[4];
-		unit->selector.baSourceID = (__u8 *)unit + sizeof *unit;
-		memcpy(unit->selector.baSourceID, &buffer[5], p);
+		memcpy(unit->baSourceID, &buffer[5], p);
 
 		if (buffer[5+p] != 0)
 			usb_string(udev, buffer[5+p], unit->name,
@@ -1056,13 +1057,11 @@ static int uvc_parse_standard_control(struct uvc_device *dev,
 			return -EINVAL;
 		}
 
-		unit = kzalloc(sizeof *unit + n, GFP_KERNEL);
+		unit = uvc_alloc_entity(buffer[2], buffer[3], 2, n);
 		if (unit == NULL)
 			return -ENOMEM;
 
-		unit->id = buffer[3];
-		unit->type = buffer[2];
-		unit->processing.bSourceID = buffer[4];
+		memcpy(unit->baSourceID, &buffer[4], 1);
 		unit->processing.wMaxMultiplier =
 			get_unaligned_le16(&buffer[5]);
 		unit->processing.bControlSize = buffer[7];
@@ -1091,19 +1090,15 @@ static int uvc_parse_standard_control(struct uvc_device *dev,
 			return -EINVAL;
 		}
 
-		unit = kzalloc(sizeof *unit + p + n, GFP_KERNEL);
+		unit = uvc_alloc_entity(buffer[2], buffer[3], p + 1, n);
 		if (unit == NULL)
 			return -ENOMEM;
 
-		unit->id = buffer[3];
-		unit->type = buffer[2];
 		memcpy(unit->extension.guidExtensionCode, &buffer[4], 16);
 		unit->extension.bNumControls = buffer[20];
-		unit->extension.bNrInPins = get_unaligned_le16(&buffer[21]);
-		unit->extension.baSourceID = (__u8 *)unit + sizeof *unit;
-		memcpy(unit->extension.baSourceID, &buffer[22], p);
+		memcpy(unit->baSourceID, &buffer[22], p);
 		unit->extension.bControlSize = buffer[22+p];
-		unit->extension.bmControls = (__u8 *)unit + sizeof *unit + p;
+		unit->extension.bmControls = (__u8 *)unit + sizeof *unit;
 		memcpy(unit->extension.bmControls, &buffer[23+p], n);
 
 		if (buffer[23+p+n] != 0)
@@ -1209,13 +1204,12 @@ static int uvc_scan_chain_entity(struct uvc_video_chain *chain,
 		if (uvc_trace_param & UVC_TRACE_PROBE)
 			printk(" <- XU %d", entity->id);
 
-		if (entity->extension.bNrInPins != 1) {
+		if (entity->bNrInPins != 1) {
 			uvc_trace(UVC_TRACE_DESCR, "Extension unit %d has more "
 				"than 1 input pin.\n", entity->id);
 			return -1;
 		}
 
-		list_add_tail(&entity->chain, &chain->extensions);
 		break;
 
 	case UVC_VC_PROCESSING_UNIT:
@@ -1236,7 +1230,7 @@ static int uvc_scan_chain_entity(struct uvc_video_chain *chain,
 			printk(" <- SU %d", entity->id);
 
 		/* Single-input selector units are ignored. */
-		if (entity->selector.bNrInPins == 1)
+		if (entity->bNrInPins == 1)
 			break;
 
 		if (chain->selector != NULL) {
@@ -1254,20 +1248,17 @@ static int uvc_scan_chain_entity(struct uvc_video_chain *chain,
 		if (uvc_trace_param & UVC_TRACE_PROBE)
 			printk(" <- IT %d\n", entity->id);
 
-		list_add_tail(&entity->chain, &chain->iterms);
 		break;
 
 	case UVC_TT_STREAMING:
-		if (uvc_trace_param & UVC_TRACE_PROBE)
-			printk(" <- IT %d\n", entity->id);
-
-		if (!UVC_ENTITY_IS_ITERM(entity)) {
-			uvc_trace(UVC_TRACE_DESCR, "Unsupported input "
-				"terminal %u.\n", entity->id);
-			return -1;
+		if (UVC_ENTITY_IS_ITERM(entity)) {
+			if (uvc_trace_param & UVC_TRACE_PROBE)
+				printk(" <- IT %d\n", entity->id);
+		} else {
+			if (uvc_trace_param & UVC_TRACE_PROBE)
+				printk(" OT %d", entity->id);
 		}
 
-		list_add_tail(&entity->chain, &chain->iterms);
 		break;
 
 	default:
@@ -1276,6 +1267,7 @@ static int uvc_scan_chain_entity(struct uvc_video_chain *chain,
 		return -1;
 	}
 
+	list_add_tail(&entity->chain, &chain->entities);
 	return 0;
 }
 
@@ -1299,14 +1291,14 @@ static int uvc_scan_chain_forward(struct uvc_video_chain *chain,
 
 		switch (UVC_ENTITY_TYPE(forward)) {
 		case UVC_VC_EXTENSION_UNIT:
-			if (forward->extension.bNrInPins != 1) {
+			if (forward->bNrInPins != 1) {
 				uvc_trace(UVC_TRACE_DESCR, "Extension unit %d "
 					  "has more than 1 input pin.\n",
 					  entity->id);
 				return -EINVAL;
 			}
 
-			list_add_tail(&forward->chain, &chain->extensions);
+			list_add_tail(&forward->chain, &chain->entities);
 			if (uvc_trace_param & UVC_TRACE_PROBE) {
 				if (!found)
 					printk(" (->");
@@ -1326,7 +1318,7 @@ static int uvc_scan_chain_forward(struct uvc_video_chain *chain,
 				return -EINVAL;
 			}
 
-			list_add_tail(&forward->chain, &chain->oterms);
+			list_add_tail(&forward->chain, &chain->entities);
 			if (uvc_trace_param & UVC_TRACE_PROBE) {
 				if (!found)
 					printk(" (->");
@@ -1344,24 +1336,22 @@ static int uvc_scan_chain_forward(struct uvc_video_chain *chain,
 }
 
 static int uvc_scan_chain_backward(struct uvc_video_chain *chain,
-	struct uvc_entity *entity)
+	struct uvc_entity **_entity)
 {
+	struct uvc_entity *entity = *_entity;
 	struct uvc_entity *term;
-	int id = -1, i;
+	int id = -EINVAL, i;
 
 	switch (UVC_ENTITY_TYPE(entity)) {
 	case UVC_VC_EXTENSION_UNIT:
-		id = entity->extension.baSourceID[0];
-		break;
-
 	case UVC_VC_PROCESSING_UNIT:
-		id = entity->processing.bSourceID;
+		id = entity->baSourceID[0];
 		break;
 
 	case UVC_VC_SELECTOR_UNIT:
 		/* Single-input selector units are ignored. */
-		if (entity->selector.bNrInPins == 1) {
-			id = entity->selector.baSourceID[0];
+		if (entity->bNrInPins == 1) {
+			id = entity->baSourceID[0];
 			break;
 		}
 
@@ -1369,8 +1359,8 @@ static int uvc_scan_chain_backward(struct uvc_video_chain *chain,
 			printk(" <- IT");
 
 		chain->selector = entity;
-		for (i = 0; i < entity->selector.bNrInPins; ++i) {
-			id = entity->selector.baSourceID[i];
+		for (i = 0; i < entity->bNrInPins; ++i) {
+			id = entity->baSourceID[i];
 			term = uvc_entity_by_id(chain->dev, id);
 			if (term == NULL || !UVC_ENTITY_IS_ITERM(term)) {
 				uvc_trace(UVC_TRACE_DESCR, "Selector unit %d "
@@ -1382,7 +1372,7 @@ static int uvc_scan_chain_backward(struct uvc_video_chain *chain,
 			if (uvc_trace_param & UVC_TRACE_PROBE)
 				printk(" %d", term->id);
 
-			list_add_tail(&term->chain, &chain->iterms);
+			list_add_tail(&term->chain, &chain->entities);
 			uvc_scan_chain_forward(chain, term, entity);
 		}
 
@@ -1391,34 +1381,49 @@ static int uvc_scan_chain_backward(struct uvc_video_chain *chain,
 
 		id = 0;
 		break;
+
+	case UVC_ITT_VENDOR_SPECIFIC:
+	case UVC_ITT_CAMERA:
+	case UVC_ITT_MEDIA_TRANSPORT_INPUT:
+	case UVC_OTT_VENDOR_SPECIFIC:
+	case UVC_OTT_DISPLAY:
+	case UVC_OTT_MEDIA_TRANSPORT_OUTPUT:
+	case UVC_TT_STREAMING:
+		id = UVC_ENTITY_IS_OTERM(entity) ? entity->baSourceID[0] : 0;
+		break;
+	}
+
+	if (id <= 0) {
+		*_entity = NULL;
+		return id;
 	}
 
-	return id;
+	entity = uvc_entity_by_id(chain->dev, id);
+	if (entity == NULL) {
+		uvc_trace(UVC_TRACE_DESCR, "Found reference to "
+			"unknown entity %d.\n", id);
+		return -EINVAL;
+	}
+
+	*_entity = entity;
+	return 0;
 }
 
 static int uvc_scan_chain(struct uvc_video_chain *chain,
-			  struct uvc_entity *oterm)
+			  struct uvc_entity *term)
 {
 	struct uvc_entity *entity, *prev;
-	int id;
 
-	entity = oterm;
-	list_add_tail(&entity->chain, &chain->oterms);
-	uvc_trace(UVC_TRACE_PROBE, "Scanning UVC chain: OT %d", entity->id);
+	uvc_trace(UVC_TRACE_PROBE, "Scanning UVC chain:");
 
-	id = entity->output.bSourceID;
-	while (id != 0) {
-		prev = entity;
-		entity = uvc_entity_by_id(chain->dev, id);
-		if (entity == NULL) {
-			uvc_trace(UVC_TRACE_DESCR, "Found reference to "
-				"unknown entity %d.\n", id);
-			return -EINVAL;
-		}
+	entity = term;
+	prev = NULL;
 
+	while (entity != NULL) {
+		/* Entity must not be part of an existing chain */
 		if (entity->chain.next || entity->chain.prev) {
 			uvc_trace(UVC_TRACE_DESCR, "Found reference to "
-				"entity %d already in chain.\n", id);
+				"entity %d already in chain.\n", entity->id);
 			return -EINVAL;
 		}
 
@@ -1430,34 +1435,34 @@ static int uvc_scan_chain(struct uvc_video_chain *chain,
 		if (uvc_scan_chain_forward(chain, entity, prev) < 0)
 			return -EINVAL;
 
-		/* Stop when a terminal is found. */
-		if (UVC_ENTITY_IS_TERM(entity))
-			break;
-
 		/* Backward scan */
-		id = uvc_scan_chain_backward(chain, entity);
-		if (id < 0)
-			return id;
+		prev = entity;
+		if (uvc_scan_chain_backward(chain, &entity) < 0)
+			return -EINVAL;
 	}
 
 	return 0;
 }
 
-static unsigned int uvc_print_terms(struct list_head *terms, char *buffer)
+static unsigned int uvc_print_terms(struct list_head *terms, u16 dir,
+		char *buffer)
 {
 	struct uvc_entity *term;
 	unsigned int nterms = 0;
 	char *p = buffer;
 
 	list_for_each_entry(term, terms, chain) {
-		p += sprintf(p, "%u", term->id);
-		if (term->chain.next != terms) {
+		if (!UVC_ENTITY_IS_TERM(term) ||
+		    UVC_TERM_DIRECTION(term) != dir)
+			continue;
+
+		if (nterms)
 			p += sprintf(p, ",");
-			if (++nterms >= 4) {
-				p += sprintf(p, "...");
-				break;
-			}
+		if (++nterms >= 4) {
+			p += sprintf(p, "...");
+			break;
 		}
+		p += sprintf(p, "%u", term->id);
 	}
 
 	return p - buffer;
@@ -1468,9 +1473,9 @@ static const char *uvc_print_chain(struct uvc_video_chain *chain)
 	static char buffer[43];
 	char *p = buffer;
 
-	p += uvc_print_terms(&chain->iterms, p);
+	p += uvc_print_terms(&chain->entities, UVC_TERM_INPUT, p);
 	p += sprintf(p, " -> ");
-	uvc_print_terms(&chain->oterms, p);
+	uvc_print_terms(&chain->entities, UVC_TERM_OUTPUT, p);
 
 	return buffer;
 }
@@ -1501,9 +1506,7 @@ static int uvc_scan_device(struct uvc_device *dev)
 		if (chain == NULL)
 			return -ENOMEM;
 
-		INIT_LIST_HEAD(&chain->iterms);
-		INIT_LIST_HEAD(&chain->oterms);
-		INIT_LIST_HEAD(&chain->extensions);
+		INIT_LIST_HEAD(&chain->entities);
 		mutex_init(&chain->ctrl_mutex);
 		chain->dev = dev;
 
@@ -1531,22 +1534,92 @@ static int uvc_scan_device(struct uvc_device *dev)
  */
 
 /*
+ * Delete the UVC device.
+ *
+ * Called by the kernel when the last reference to the uvc_device structure
+ * is released.
+ *
+ * As this function is called after or during disconnect(), all URBs have
+ * already been canceled by the USB core. There is no need to kill the
+ * interrupt URB manually.
+ */
+static void uvc_delete(struct uvc_device *dev)
+{
+	struct list_head *p, *n;
+
+	usb_put_intf(dev->intf);
+	usb_put_dev(dev->udev);
+
+	uvc_status_cleanup(dev);
+	uvc_ctrl_cleanup_device(dev);
+
+	list_for_each_safe(p, n, &dev->chains) {
+		struct uvc_video_chain *chain;
+		chain = list_entry(p, struct uvc_video_chain, list);
+		kfree(chain);
+	}
+
+	list_for_each_safe(p, n, &dev->entities) {
+		struct uvc_entity *entity;
+		entity = list_entry(p, struct uvc_entity, list);
+		kfree(entity);
+	}
+
+	list_for_each_safe(p, n, &dev->streams) {
+		struct uvc_streaming *streaming;
+		streaming = list_entry(p, struct uvc_streaming, list);
+		usb_driver_release_interface(&uvc_driver.driver,
+			streaming->intf);
+		usb_put_intf(streaming->intf);
+		kfree(streaming->format);
+		kfree(streaming->header.bmaControls);
+		kfree(streaming);
+	}
+
+	kfree(dev);
+}
+
+static void uvc_release(struct video_device *vdev)
+{
+	struct uvc_streaming *stream = video_get_drvdata(vdev);
+	struct uvc_device *dev = stream->dev;
+
+	video_device_release(vdev);
+
+	/* Decrement the registered streams count and delete the device when it
+	 * reaches zero.
+	 */
+	if (atomic_dec_and_test(&dev->nstreams))
+		uvc_delete(dev);
+}
+
+/*
  * Unregister the video devices.
  */
 static void uvc_unregister_video(struct uvc_device *dev)
 {
 	struct uvc_streaming *stream;
 
+	/* Unregistering all video devices might result in uvc_delete() being
+	 * called from inside the loop if there's no open file handle. To avoid
+	 * that, increment the stream count before iterating over the streams
+	 * and decrement it when done.
+	 */
+	atomic_inc(&dev->nstreams);
+
 	list_for_each_entry(stream, &dev->streams, list) {
 		if (stream->vdev == NULL)
 			continue;
 
-		if (stream->vdev->minor == -1)
-			video_device_release(stream->vdev);
-		else
-			video_unregister_device(stream->vdev);
+		video_unregister_device(stream->vdev);
 		stream->vdev = NULL;
 	}
+
+	/* Decrement the stream count and call uvc_delete explicitly if there
+	 * are no stream left.
+	 */
+	if (atomic_dec_and_test(&dev->nstreams))
+		uvc_delete(dev);
 }
 
 static int uvc_register_video(struct uvc_device *dev,
@@ -1578,9 +1651,8 @@ static int uvc_register_video(struct uvc_device *dev,
 	 * get another one.
 	 */
 	vdev->parent = &dev->intf->dev;
-	vdev->minor = -1;
 	vdev->fops = &uvc_fops;
-	vdev->release = video_device_release;
+	vdev->release = uvc_release;
 	strlcpy(vdev->name, dev->name, sizeof vdev->name);
 
 	/* Set the driver data before calling video_register_device, otherwise
@@ -1598,6 +1670,7 @@ static int uvc_register_video(struct uvc_device *dev,
 		return ret;
 	}
 
+	atomic_inc(&dev->nstreams);
 	return 0;
 }
 
@@ -1605,13 +1678,13 @@ static int uvc_register_video(struct uvc_device *dev,
  * Register all video devices in all chains.
  */
 static int uvc_register_terms(struct uvc_device *dev,
-	struct uvc_video_chain *chain, struct list_head *terms)
+	struct uvc_video_chain *chain)
 {
 	struct uvc_streaming *stream;
 	struct uvc_entity *term;
 	int ret;
 
-	list_for_each_entry(term, terms, chain) {
+	list_for_each_entry(term, &chain->entities, chain) {
 		if (UVC_ENTITY_TYPE(term) != UVC_TT_STREAMING)
 			continue;
 
@@ -1637,11 +1710,7 @@ static int uvc_register_chains(struct uvc_device *dev)
 	int ret;
 
 	list_for_each_entry(chain, &dev->chains, list) {
-		ret = uvc_register_terms(dev, chain, &chain->iterms);
-		if (ret < 0)
-			return ret;
-
-		ret = uvc_register_terms(dev, chain, &chain->oterms);
+		ret = uvc_register_terms(dev, chain);
 		if (ret < 0)
 			return ret;
 	}
@@ -1653,61 +1722,6 @@ static int uvc_register_chains(struct uvc_device *dev)
  * USB probe, disconnect, suspend and resume
  */
 
-/*
- * Delete the UVC device.
- *
- * Called by the kernel when the last reference to the uvc_device structure
- * is released.
- *
- * Unregistering the video devices is done here because every opened instance
- * must be closed before the device can be unregistered. An alternative would
- * have been to use another reference count for uvc_v4l2_open/uvc_release, and
- * unregister the video devices on disconnect when that reference count drops
- * to zero.
- *
- * As this function is called after or during disconnect(), all URBs have
- * already been canceled by the USB core. There is no need to kill the
- * interrupt URB manually.
- */
-void uvc_delete(struct kref *kref)
-{
-	struct uvc_device *dev = container_of(kref, struct uvc_device, kref);
-	struct list_head *p, *n;
-
-	/* Unregister the video devices. */
-	uvc_unregister_video(dev);
-	usb_put_intf(dev->intf);
-	usb_put_dev(dev->udev);
-
-	uvc_status_cleanup(dev);
-	uvc_ctrl_cleanup_device(dev);
-
-	list_for_each_safe(p, n, &dev->chains) {
-		struct uvc_video_chain *chain;
-		chain = list_entry(p, struct uvc_video_chain, list);
-		kfree(chain);
-	}
-
-	list_for_each_safe(p, n, &dev->entities) {
-		struct uvc_entity *entity;
-		entity = list_entry(p, struct uvc_entity, list);
-		kfree(entity);
-	}
-
-	list_for_each_safe(p, n, &dev->streams) {
-		struct uvc_streaming *streaming;
-		streaming = list_entry(p, struct uvc_streaming, list);
-		usb_driver_release_interface(&uvc_driver.driver,
-			streaming->intf);
-		usb_put_intf(streaming->intf);
-		kfree(streaming->format);
-		kfree(streaming->header.bmaControls);
-		kfree(streaming);
-	}
-
-	kfree(dev);
-}
-
 static int uvc_probe(struct usb_interface *intf,
 		     const struct usb_device_id *id)
 {
@@ -1730,7 +1744,7 @@ static int uvc_probe(struct usb_interface *intf,
 	INIT_LIST_HEAD(&dev->entities);
 	INIT_LIST_HEAD(&dev->chains);
 	INIT_LIST_HEAD(&dev->streams);
-	kref_init(&dev->kref);
+	atomic_set(&dev->nstreams, 0);
 	atomic_set(&dev->users, 0);
 
 	dev->udev = usb_get_dev(udev);
@@ -1792,7 +1806,7 @@ static int uvc_probe(struct usb_interface *intf,
 	return 0;
 
 error:
-	kref_put(&dev->kref, uvc_delete);
+	uvc_unregister_video(dev);
 	return -ENODEV;
 }
 
@@ -1809,21 +1823,9 @@ static void uvc_disconnect(struct usb_interface *intf)
 	    UVC_SC_VIDEOSTREAMING)
 		return;
 
-	/* uvc_v4l2_open() might race uvc_disconnect(). A static driver-wide
-	 * lock is needed to prevent uvc_disconnect from releasing its
-	 * reference to the uvc_device instance after uvc_v4l2_open() received
-	 * the pointer to the device (video_devdata) but before it got the
-	 * chance to increase the reference count (kref_get).
-	 *
-	 * Note that the reference can't be released with the lock held,
-	 * otherwise a AB-BA deadlock can occur with videodev_lock that
-	 * videodev acquires in videodev_open() and video_unregister_device().
-	 */
-	mutex_lock(&uvc_driver.open_mutex);
 	dev->state |= UVC_DEV_DISCONNECTED;
-	mutex_unlock(&uvc_driver.open_mutex);
 
-	kref_put(&dev->kref, uvc_delete);
+	uvc_unregister_video(dev);
 }
 
 static int uvc_suspend(struct usb_interface *intf, pm_message_t message)
@@ -1899,6 +1901,15 @@ static int uvc_reset_resume(struct usb_interface *intf)
  * though they are compliant.
  */
 static struct usb_device_id uvc_ids[] = {
+	/* Genius eFace 2025 */
+	{ .match_flags		= USB_DEVICE_ID_MATCH_DEVICE
+				| USB_DEVICE_ID_MATCH_INT_INFO,
+	  .idVendor		= 0x0458,
+	  .idProduct		= 0x706e,
+	  .bInterfaceClass	= USB_CLASS_VIDEO,
+	  .bInterfaceSubClass	= 1,
+	  .bInterfaceProtocol	= 0,
+	  .driver_info		= UVC_QUIRK_PROBE_MINMAX },
 	/* Microsoft Lifecam NX-6000 */
 	{ .match_flags		= USB_DEVICE_ID_MATCH_DEVICE
 				| USB_DEVICE_ID_MATCH_INT_INFO,
@@ -2123,6 +2134,15 @@ static struct usb_device_id uvc_ids[] = {
 	  .bInterfaceSubClass	= 1,
 	  .bInterfaceProtocol	= 0,
 	  .driver_info		= UVC_QUIRK_STATUS_INTERVAL },
+	/* MSI StarCam 370i */
+	{ .match_flags		= USB_DEVICE_ID_MATCH_DEVICE
+				| USB_DEVICE_ID_MATCH_INT_INFO,
+	  .idVendor		= 0x1b3b,
+	  .idProduct		= 0x2951,
+	  .bInterfaceClass	= USB_CLASS_VIDEO,
+	  .bInterfaceSubClass	= 1,
+	  .bInterfaceProtocol	= 0,
+	  .driver_info		= UVC_QUIRK_PROBE_MINMAX },
 	/* SiGma Micro USB Web Camera */
 	{ .match_flags		= USB_DEVICE_ID_MATCH_DEVICE
 				| USB_DEVICE_ID_MATCH_INT_INFO,
@@ -2159,7 +2179,6 @@ static int __init uvc_init(void)
 
 	INIT_LIST_HEAD(&uvc_driver.devices);
 	INIT_LIST_HEAD(&uvc_driver.controls);
-	mutex_init(&uvc_driver.open_mutex);
 	mutex_init(&uvc_driver.ctrl_mutex);
 
 	uvc_ctrl_init();
@@ -2184,6 +2203,8 @@ module_param_named(quirks, uvc_quirks_param, uint, S_IRUGO|S_IWUSR);
 MODULE_PARM_DESC(quirks, "Forced device quirks");
 module_param_named(trace, uvc_trace_param, uint, S_IRUGO|S_IWUSR);
 MODULE_PARM_DESC(trace, "Trace level bitmask");
+module_param_named(timeout, uvc_timeout_param, uint, S_IRUGO|S_IWUSR);
+MODULE_PARM_DESC(timeout, "Streaming control requests timeout");
 
 MODULE_AUTHOR(DRIVER_AUTHOR);
 MODULE_DESCRIPTION(DRIVER_DESC);
diff --git a/drivers/media/video/uvc/uvc_queue.c b/drivers/media/video/uvc/uvc_queue.c
index f854698c4061..ea11839cba4a 100644
--- a/drivers/media/video/uvc/uvc_queue.c
+++ b/drivers/media/video/uvc/uvc_queue.c
@@ -59,9 +59,9 @@
  *    returns immediately.
  *
  *    When the buffer is full, the completion handler removes it from the irq
- *    queue, marks it as ready (UVC_BUF_STATE_DONE) and wakes its wait queue.
+ *    queue, marks it as done (UVC_BUF_STATE_DONE) and wakes its wait queue.
  *    At that point, any process waiting on the buffer will be woken up. If a
- *    process tries to dequeue a buffer after it has been marked ready, the
+ *    process tries to dequeue a buffer after it has been marked done, the
  *    dequeing will succeed immediately.
  *
  * 2. Buffers are queued, user is waiting on a buffer and the device gets
@@ -201,6 +201,7 @@ static void __uvc_query_buffer(struct uvc_buffer *buf,
 		break;
 	case UVC_BUF_STATE_QUEUED:
 	case UVC_BUF_STATE_ACTIVE:
+	case UVC_BUF_STATE_READY:
 		v4l2_buf->flags |= V4L2_BUF_FLAG_QUEUED;
 		break;
 	case UVC_BUF_STATE_IDLE:
@@ -295,13 +296,15 @@ static int uvc_queue_waiton(struct uvc_buffer *buf, int nonblocking)
 {
 	if (nonblocking) {
 		return (buf->state != UVC_BUF_STATE_QUEUED &&
-			buf->state != UVC_BUF_STATE_ACTIVE)
+			buf->state != UVC_BUF_STATE_ACTIVE &&
+			buf->state != UVC_BUF_STATE_READY)
 			? 0 : -EAGAIN;
 	}
 
 	return wait_event_interruptible(buf->wait,
 		buf->state != UVC_BUF_STATE_QUEUED &&
-		buf->state != UVC_BUF_STATE_ACTIVE);
+		buf->state != UVC_BUF_STATE_ACTIVE &&
+		buf->state != UVC_BUF_STATE_READY);
 }
 
 /*
@@ -348,6 +351,7 @@ int uvc_dequeue_buffer(struct uvc_video_queue *queue,
 	case UVC_BUF_STATE_IDLE:
 	case UVC_BUF_STATE_QUEUED:
 	case UVC_BUF_STATE_ACTIVE:
+	case UVC_BUF_STATE_READY:
 	default:
 		uvc_trace(UVC_TRACE_CAPTURE, "[E] Invalid buffer state %u "
 			"(driver bug?).\n", buf->state);
@@ -489,6 +493,7 @@ struct uvc_buffer *uvc_queue_next_buffer(struct uvc_video_queue *queue,
 
 	spin_lock_irqsave(&queue->irqlock, flags);
 	list_del(&buf->queue);
+	buf->state = UVC_BUF_STATE_DONE;
 	if (!list_empty(&queue->irqqueue))
 		nextbuf = list_first_entry(&queue->irqqueue, struct uvc_buffer,
 					   queue);
diff --git a/drivers/media/video/uvc/uvc_v4l2.c b/drivers/media/video/uvc/uvc_v4l2.c
index a2bdd806efab..23239a4adefe 100644
--- a/drivers/media/video/uvc/uvc_v4l2.c
+++ b/drivers/media/video/uvc/uvc_v4l2.c
@@ -364,37 +364,30 @@ static int uvc_v4l2_set_streamparm(struct uvc_streaming *stream,
  * unprivileged state. Only a single instance can be in a privileged state at
  * a given time. Trying to perform an operation that requires privileges will
  * automatically acquire the required privileges if possible, or return -EBUSY
- * otherwise. Privileges are dismissed when closing the instance.
+ * otherwise. Privileges are dismissed when closing the instance or when
+ * freeing the video buffers using VIDIOC_REQBUFS.
  *
  * Operations that require privileges are:
  *
  * - VIDIOC_S_INPUT
  * - VIDIOC_S_PARM
  * - VIDIOC_S_FMT
- * - VIDIOC_TRY_FMT
  * - VIDIOC_REQBUFS
  */
 static int uvc_acquire_privileges(struct uvc_fh *handle)
 {
-	int ret = 0;
-
 	/* Always succeed if the handle is already privileged. */
 	if (handle->state == UVC_HANDLE_ACTIVE)
 		return 0;
 
 	/* Check if the device already has a privileged handle. */
-	mutex_lock(&uvc_driver.open_mutex);
 	if (atomic_inc_return(&handle->stream->active) != 1) {
 		atomic_dec(&handle->stream->active);
-		ret = -EBUSY;
-		goto done;
+		return -EBUSY;
 	}
 
 	handle->state = UVC_HANDLE_ACTIVE;
-
-done:
-	mutex_unlock(&uvc_driver.open_mutex);
-	return ret;
+	return 0;
 }
 
 static void uvc_dismiss_privileges(struct uvc_fh *handle)
@@ -421,24 +414,20 @@ static int uvc_v4l2_open(struct file *file)
 	int ret = 0;
 
 	uvc_trace(UVC_TRACE_CALLS, "uvc_v4l2_open\n");
-	mutex_lock(&uvc_driver.open_mutex);
 	stream = video_drvdata(file);
 
-	if (stream->dev->state & UVC_DEV_DISCONNECTED) {
-		ret = -ENODEV;
-		goto done;
-	}
+	if (stream->dev->state & UVC_DEV_DISCONNECTED)
+		return -ENODEV;
 
 	ret = usb_autopm_get_interface(stream->dev->intf);
 	if (ret < 0)
-		goto done;
+		return ret;
 
 	/* Create the device handle. */
 	handle = kzalloc(sizeof *handle, GFP_KERNEL);
 	if (handle == NULL) {
 		usb_autopm_put_interface(stream->dev->intf);
-		ret = -ENOMEM;
-		goto done;
+		return -ENOMEM;
 	}
 
 	if (atomic_inc_return(&stream->dev->users) == 1) {
@@ -447,7 +436,7 @@ static int uvc_v4l2_open(struct file *file)
 			usb_autopm_put_interface(stream->dev->intf);
 			atomic_dec(&stream->dev->users);
 			kfree(handle);
-			goto done;
+			return ret;
 		}
 	}
 
@@ -456,11 +445,7 @@ static int uvc_v4l2_open(struct file *file)
 	handle->state = UVC_HANDLE_PASSIVE;
 	file->private_data = handle;
 
-	kref_get(&stream->dev->kref);
-
-done:
-	mutex_unlock(&uvc_driver.open_mutex);
-	return ret;
+	return 0;
 }
 
 static int uvc_v4l2_release(struct file *file)
@@ -490,7 +475,6 @@ static int uvc_v4l2_release(struct file *file)
 		uvc_status_stop(stream->dev);
 
 	usb_autopm_put_interface(stream->dev->intf);
-	kref_put(&stream->dev->kref, uvc_delete);
 	return 0;
 }
 
@@ -636,12 +620,16 @@ static long uvc_v4l2_do_ioctl(struct file *file, unsigned int cmd, void *arg)
 		    (chain->dev->quirks & UVC_QUIRK_IGNORE_SELECTOR_UNIT)) {
 			if (index != 0)
 				return -EINVAL;
-			iterm = list_first_entry(&chain->iterms,
-					struct uvc_entity, chain);
+			list_for_each_entry(iterm, &chain->entities, chain) {
+				if (UVC_ENTITY_IS_ITERM(iterm))
+					break;
+			}
 			pin = iterm->id;
-		} else if (pin < selector->selector.bNrInPins) {
-			pin = selector->selector.baSourceID[index];
-			list_for_each_entry(iterm, chain->iterms.next, chain) {
+		} else if (pin < selector->bNrInPins) {
+			pin = selector->baSourceID[index];
+			list_for_each_entry(iterm, &chain->entities, chain) {
+				if (!UVC_ENTITY_IS_ITERM(iterm))
+					continue;
 				if (iterm->id == pin)
 					break;
 			}
@@ -692,7 +680,7 @@ static long uvc_v4l2_do_ioctl(struct file *file, unsigned int cmd, void *arg)
 			break;
 		}
 
-		if (input == 0 || input > chain->selector->selector.bNrInPins)
+		if (input == 0 || input > chain->selector->bNrInPins)
 			return -EINVAL;
 
 		return uvc_query_ctrl(chain->dev, UVC_SET_CUR,
@@ -731,9 +719,6 @@ static long uvc_v4l2_do_ioctl(struct file *file, unsigned int cmd, void *arg)
 	{
 		struct uvc_streaming_control probe;
 
-		if ((ret = uvc_acquire_privileges(handle)) < 0)
-			return ret;
-
 		return uvc_v4l2_try_format(stream, arg, &probe, NULL, NULL);
 	}
 
@@ -888,6 +873,9 @@ static long uvc_v4l2_do_ioctl(struct file *file, unsigned int cmd, void *arg)
 		if (ret < 0)
 			return ret;
 
+		if (ret == 0)
+			uvc_dismiss_privileges(handle);
+
 		rb->count = ret;
 		ret = 0;
 		break;
@@ -1051,7 +1039,7 @@ static ssize_t uvc_v4l2_read(struct file *file, char __user *data,
 		    size_t count, loff_t *ppos)
 {
 	uvc_trace(UVC_TRACE_CALLS, "uvc_v4l2_read: not implemented.\n");
-	return -ENODEV;
+	return -EINVAL;
 }
 
 /*
diff --git a/drivers/media/video/uvc/uvc_video.c b/drivers/media/video/uvc/uvc_video.c
index a6e41d12b221..7dcf534a0cf3 100644
--- a/drivers/media/video/uvc/uvc_video.c
+++ b/drivers/media/video/uvc/uvc_video.c
@@ -135,7 +135,7 @@ static int uvc_get_video_ctrl(struct uvc_streaming *stream,
 
 	ret = __uvc_query_ctrl(stream->dev, query, 0, stream->intfnum,
 		probe ? UVC_VS_PROBE_CONTROL : UVC_VS_COMMIT_CONTROL, data,
-		size, UVC_CTRL_STREAMING_TIMEOUT);
+		size, uvc_timeout_param);
 
 	if ((query == UVC_GET_MIN || query == UVC_GET_MAX) && ret == 2) {
 		/* Some cameras, mostly based on Bison Electronics chipsets,
@@ -145,7 +145,7 @@ static int uvc_get_video_ctrl(struct uvc_streaming *stream,
 		uvc_warn_once(stream->dev, UVC_WARN_MINMAX, "UVC non "
 			"compliance - GET_MIN/MAX(PROBE) incorrectly "
 			"supported. Enabling workaround.\n");
-		memset(ctrl, 0, sizeof ctrl);
+		memset(ctrl, 0, sizeof *ctrl);
 		ctrl->wCompQuality = le16_to_cpup((__le16 *)data);
 		ret = 0;
 		goto out;
@@ -239,7 +239,7 @@ static int uvc_set_video_ctrl(struct uvc_streaming *stream,
 
 	ret = __uvc_query_ctrl(stream->dev, UVC_SET_CUR, 0, stream->intfnum,
 		probe ? UVC_VS_PROBE_CONTROL : UVC_VS_COMMIT_CONTROL, data,
-		size, UVC_CTRL_STREAMING_TIMEOUT);
+		size, uvc_timeout_param);
 	if (ret != size) {
 		uvc_printk(KERN_ERR, "Failed to set UVC %s control : "
 			"%d (exp. %u).\n", probe ? "probe" : "commit",
@@ -441,7 +441,7 @@ static int uvc_video_decode_start(struct uvc_streaming *stream,
 	if (fid != stream->last_fid && buf->buf.bytesused != 0) {
 		uvc_trace(UVC_TRACE_FRAME, "Frame complete (FID bit "
 				"toggled).\n");
-		buf->state = UVC_BUF_STATE_DONE;
+		buf->state = UVC_BUF_STATE_READY;
 		return -EAGAIN;
 	}
 
@@ -470,7 +470,7 @@ static void uvc_video_decode_data(struct uvc_streaming *stream,
 	/* Complete the current frame if the buffer size was exceeded. */
 	if (len > maxlen) {
 		uvc_trace(UVC_TRACE_FRAME, "Frame complete (overflow).\n");
-		buf->state = UVC_BUF_STATE_DONE;
+		buf->state = UVC_BUF_STATE_READY;
 	}
 }
 
@@ -482,7 +482,7 @@ static void uvc_video_decode_end(struct uvc_streaming *stream,
 		uvc_trace(UVC_TRACE_FRAME, "Frame complete (EOF found).\n");
 		if (data[0] == len)
 			uvc_trace(UVC_TRACE_FRAME, "EOF in empty payload.\n");
-		buf->state = UVC_BUF_STATE_DONE;
+		buf->state = UVC_BUF_STATE_READY;
 		if (stream->dev->quirks & UVC_QUIRK_STREAM_NO_FID)
 			stream->last_fid ^= UVC_STREAM_FID;
 	}
@@ -568,8 +568,7 @@ static void uvc_video_decode_isoc(struct urb *urb, struct uvc_streaming *stream,
 		uvc_video_decode_end(stream, buf, mem,
 			urb->iso_frame_desc[i].actual_length);
 
-		if (buf->state == UVC_BUF_STATE_DONE ||
-		    buf->state == UVC_BUF_STATE_ERROR)
+		if (buf->state == UVC_BUF_STATE_READY)
 			buf = uvc_queue_next_buffer(&stream->queue, buf);
 	}
 }
@@ -627,8 +626,7 @@ static void uvc_video_decode_bulk(struct urb *urb, struct uvc_streaming *stream,
 		if (!stream->bulk.skip_payload && buf != NULL) {
 			uvc_video_decode_end(stream, buf, stream->bulk.header,
 				stream->bulk.payload_size);
-			if (buf->state == UVC_BUF_STATE_DONE ||
-			    buf->state == UVC_BUF_STATE_ERROR)
+			if (buf->state == UVC_BUF_STATE_READY)
 				buf = uvc_queue_next_buffer(&stream->queue,
 							    buf);
 		}
@@ -669,7 +667,7 @@ static void uvc_video_encode_bulk(struct urb *urb, struct uvc_streaming *stream,
 	    stream->bulk.payload_size == stream->bulk.max_payload_size) {
 		if (buf->buf.bytesused == stream->queue.buf_used) {
 			stream->queue.buf_used = 0;
-			buf->state = UVC_BUF_STATE_DONE;
+			buf->state = UVC_BUF_STATE_READY;
 			uvc_queue_next_buffer(&stream->queue, buf);
 			stream->last_fid ^= UVC_STREAM_FID;
 		}
@@ -770,8 +768,9 @@ static int uvc_alloc_urb_buffers(struct uvc_streaming *stream,
 	/* Retry allocations until one succeed. */
 	for (; npackets > 1; npackets /= 2) {
 		for (i = 0; i < UVC_URBS; ++i) {
+			stream->urb_size = psize * npackets;
 			stream->urb_buffer[i] = usb_buffer_alloc(
-				stream->dev->udev, psize * npackets,
+				stream->dev->udev, stream->urb_size,
 				gfp_flags | __GFP_NOWARN, &stream->urb_dma[i]);
 			if (!stream->urb_buffer[i]) {
 				uvc_free_urb_buffers(stream);
@@ -780,11 +779,15 @@ static int uvc_alloc_urb_buffers(struct uvc_streaming *stream,
 		}
 
 		if (i == UVC_URBS) {
-			stream->urb_size = psize * npackets;
+			uvc_trace(UVC_TRACE_VIDEO, "Allocated %u URB buffers "
+				"of %ux%u bytes each.\n", UVC_URBS, npackets,
+				psize);
 			return npackets;
 		}
 	}
 
+	uvc_trace(UVC_TRACE_VIDEO, "Failed to allocate URB buffers (%u bytes "
+		"per packet).\n", psize);
 	return 0;
 }
 
@@ -919,10 +922,8 @@ static int uvc_init_video_bulk(struct uvc_streaming *stream,
 static int uvc_init_video(struct uvc_streaming *stream, gfp_t gfp_flags)
 {
 	struct usb_interface *intf = stream->intf;
-	struct usb_host_interface *alts;
-	struct usb_host_endpoint *ep = NULL;
-	int intfnum = stream->intfnum;
-	unsigned int bandwidth, psize, i;
+	struct usb_host_endpoint *ep;
+	unsigned int i;
 	int ret;
 
 	stream->last_fid = -1;
@@ -931,17 +932,28 @@ static int uvc_init_video(struct uvc_streaming *stream, gfp_t gfp_flags)
 	stream->bulk.payload_size = 0;
 
 	if (intf->num_altsetting > 1) {
+		struct usb_host_endpoint *best_ep = NULL;
+		unsigned int best_psize = 3 * 1024;
+		unsigned int bandwidth;
+		unsigned int uninitialized_var(altsetting);
+		int intfnum = stream->intfnum;
+
 		/* Isochronous endpoint, select the alternate setting. */
 		bandwidth = stream->ctrl.dwMaxPayloadTransferSize;
 
 		if (bandwidth == 0) {
-			uvc_printk(KERN_WARNING, "device %s requested null "
-				"bandwidth, defaulting to lowest.\n",
-				stream->dev->name);
+			uvc_trace(UVC_TRACE_VIDEO, "Device requested null "
+				"bandwidth, defaulting to lowest.\n");
 			bandwidth = 1;
+		} else {
+			uvc_trace(UVC_TRACE_VIDEO, "Device requested %u "
+				"B/frame bandwidth.\n", bandwidth);
 		}
 
 		for (i = 0; i < intf->num_altsetting; ++i) {
+			struct usb_host_interface *alts;
+			unsigned int psize;
+
 			alts = &intf->altsetting[i];
 			ep = uvc_find_endpoint(alts,
 				stream->header.bEndpointAddress);
@@ -951,18 +963,27 @@ static int uvc_init_video(struct uvc_streaming *stream, gfp_t gfp_flags)
 			/* Check if the bandwidth is high enough. */
 			psize = le16_to_cpu(ep->desc.wMaxPacketSize);
 			psize = (psize & 0x07ff) * (1 + ((psize >> 11) & 3));
-			if (psize >= bandwidth)
-				break;
+			if (psize >= bandwidth && psize <= best_psize) {
+				altsetting = i;
+				best_psize = psize;
+				best_ep = ep;
+			}
 		}
 
-		if (i >= intf->num_altsetting)
+		if (best_ep == NULL) {
+			uvc_trace(UVC_TRACE_VIDEO, "No fast enough alt setting "
+				"for requested bandwidth.\n");
 			return -EIO;
+		}
+
+		uvc_trace(UVC_TRACE_VIDEO, "Selecting alternate setting %u "
+			"(%u B/frame bandwidth).\n", altsetting, best_psize);
 
-		ret = usb_set_interface(stream->dev->udev, intfnum, i);
+		ret = usb_set_interface(stream->dev->udev, intfnum, altsetting);
 		if (ret < 0)
 			return ret;
 
-		ret = uvc_init_video_isoc(stream, ep, gfp_flags);
+		ret = uvc_init_video_isoc(stream, best_ep, gfp_flags);
 	} else {
 		/* Bulk endpoint, proceed to URB initialization. */
 		ep = uvc_find_endpoint(&intf->altsetting[0],
diff --git a/drivers/media/video/uvc/uvcvideo.h b/drivers/media/video/uvc/uvcvideo.h
index e7958aa454ce..2337585001ea 100644
--- a/drivers/media/video/uvc/uvcvideo.h
+++ b/drivers/media/video/uvc/uvcvideo.h
@@ -75,6 +75,7 @@ struct uvc_xu_control {
 
 #define UVC_TERM_INPUT			0x0000
 #define UVC_TERM_OUTPUT			0x8000
+#define UVC_TERM_DIRECTION(term)	((term)->type & 0x8000)
 
 #define UVC_ENTITY_TYPE(entity)		((entity)->type & 0x7fff)
 #define UVC_ENTITY_IS_UNIT(entity)	(((entity)->type & 0xff00) == 0)
@@ -148,7 +149,7 @@ struct uvc_xu_control {
 #define UVC_MAX_STATUS_SIZE	16
 
 #define UVC_CTRL_CONTROL_TIMEOUT	300
-#define UVC_CTRL_STREAMING_TIMEOUT	1000
+#define UVC_CTRL_STREAMING_TIMEOUT	3000
 
 /* Devices quirks */
 #define UVC_QUIRK_STATUS_INTERVAL	0x00000001
@@ -292,11 +293,9 @@ struct uvc_entity {
 		} media;
 
 		struct {
-			__u8  bSourceID;
 		} output;
 
 		struct {
-			__u8  bSourceID;
 			__u16 wMaxMultiplier;
 			__u8  bControlSize;
 			__u8  *bmControls;
@@ -304,21 +303,20 @@ struct uvc_entity {
 		} processing;
 
 		struct {
-			__u8  bNrInPins;
-			__u8  *baSourceID;
 		} selector;
 
 		struct {
 			__u8  guidExtensionCode[16];
 			__u8  bNumControls;
-			__u8  bNrInPins;
-			__u8  *baSourceID;
 			__u8  bControlSize;
 			__u8  *bmControls;
 			__u8  *bmControlsType;
 		} extension;
 	};
 
+	__u8 bNrInPins;
+	__u8 *baSourceID;
+
 	unsigned int ncontrols;
 	struct uvc_control *controls;
 };
@@ -367,8 +365,9 @@ enum uvc_buffer_state {
 	UVC_BUF_STATE_IDLE	= 0,
 	UVC_BUF_STATE_QUEUED	= 1,
 	UVC_BUF_STATE_ACTIVE	= 2,
-	UVC_BUF_STATE_DONE	= 3,
-	UVC_BUF_STATE_ERROR	= 4,
+	UVC_BUF_STATE_READY	= 3,
+	UVC_BUF_STATE_DONE	= 4,
+	UVC_BUF_STATE_ERROR	= 5,
 };
 
 struct uvc_buffer {
@@ -408,11 +407,9 @@ struct uvc_video_chain {
 	struct uvc_device *dev;
 	struct list_head list;
 
-	struct list_head iterms;		/* Input terminals */
-	struct list_head oterms;		/* Output terminals */
+	struct list_head entities;		/* All entities */
 	struct uvc_entity *processing;		/* Processing unit */
 	struct uvc_entity *selector;		/* Selector unit */
-	struct list_head extensions;		/* Extension units */
 
 	struct mutex ctrl_mutex;
 };
@@ -475,7 +472,6 @@ struct uvc_device {
 	char name[32];
 
 	enum uvc_device_state state;
-	struct kref kref;
 	struct list_head list;
 	atomic_t users;
 
@@ -488,6 +484,7 @@ struct uvc_device {
 
 	/* Video Streaming interfaces */
 	struct list_head streams;
+	atomic_t nstreams;
 
 	/* Status Interrupt Endpoint */
 	struct usb_host_endpoint *int_ep;
@@ -511,8 +508,6 @@ struct uvc_fh {
 struct uvc_driver {
 	struct usb_driver driver;
 
-	struct mutex open_mutex;	/* protects from open/disconnect race */
-
 	struct list_head devices;	/* struct uvc_device list */
 	struct list_head controls;	/* struct uvc_control_info list */
 	struct mutex ctrl_mutex;	/* protects controls and devices
@@ -533,12 +528,14 @@ struct uvc_driver {
 #define UVC_TRACE_FRAME		(1 << 7)
 #define UVC_TRACE_SUSPEND	(1 << 8)
 #define UVC_TRACE_STATUS	(1 << 9)
+#define UVC_TRACE_VIDEO		(1 << 10)
 
 #define UVC_WARN_MINMAX		0
 #define UVC_WARN_PROBE_DEF	1
 
 extern unsigned int uvc_no_drop_param;
 extern unsigned int uvc_trace_param;
+extern unsigned int uvc_timeout_param;
 
 #define uvc_trace(flag, msg...) \
 	do { \
@@ -571,7 +568,6 @@ extern unsigned int uvc_trace_param;
 
 /* Core driver */
 extern struct uvc_driver uvc_driver;
-extern void uvc_delete(struct kref *kref);
 
 /* Video buffers queue management. */
 extern void uvc_queue_init(struct uvc_video_queue *queue,
diff --git a/drivers/media/video/v4l2-common.c b/drivers/media/video/v4l2-common.c
index f5a93ae3cdf9..36b5cb86fb57 100644
--- a/drivers/media/video/v4l2-common.c
+++ b/drivers/media/video/v4l2-common.c
@@ -431,6 +431,8 @@ const char *v4l2_ctrl_get_name(u32 id)
 	case V4L2_CID_CHROMA_AGC:		return "Chroma AGC";
 	case V4L2_CID_COLOR_KILLER:		return "Color Killer";
 	case V4L2_CID_COLORFX:			return "Color Effects";
+	case V4L2_CID_ROTATE:			return "Rotate";
+	case V4L2_CID_BG_COLOR:			return "Background color";
 
 	/* MPEG controls */
 	case V4L2_CID_MPEG_CLASS: 		return "MPEG Encoder Controls";
@@ -587,6 +589,13 @@ int v4l2_ctrl_query_fill(struct v4l2_queryctrl *qctrl, s32 min, s32 max, s32 ste
 		qctrl->flags |= V4L2_CTRL_FLAG_READ_ONLY;
 		min = max = step = def = 0;
 		break;
+	case V4L2_CID_BG_COLOR:
+		qctrl->type = V4L2_CTRL_TYPE_INTEGER;
+		step = 1;
+		min = 0;
+		/* Max is calculated as RGB888 that is 2^24 */
+		max = 0xFFFFFF;
+		break;
 	default:
 		qctrl->type = V4L2_CTRL_TYPE_INTEGER;
 		break;
@@ -1015,3 +1024,50 @@ void v4l_bound_align_image(u32 *w, unsigned int wmin, unsigned int wmax,
 	}
 }
 EXPORT_SYMBOL_GPL(v4l_bound_align_image);
+
+/**
+ * v4l_fill_dv_preset_info - fill description of a digital video preset
+ * @preset - preset value
+ * @info - pointer to struct v4l2_dv_enum_preset
+ *
+ * drivers can use this helper function to fill description of dv preset
+ * in info.
+ */
+int v4l_fill_dv_preset_info(u32 preset, struct v4l2_dv_enum_preset *info)
+{
+	static const struct v4l2_dv_preset_info {
+		u16 width;
+		u16 height;
+		const char *name;
+	} dv_presets[] = {
+		{ 0, 0, "Invalid" },		/* V4L2_DV_INVALID */
+		{ 720,  480, "480p@59.94" },	/* V4L2_DV_480P59_94 */
+		{ 720,  576, "576p@50" },	/* V4L2_DV_576P50 */
+		{ 1280, 720, "720p@24" },	/* V4L2_DV_720P24 */
+		{ 1280, 720, "720p@25" },	/* V4L2_DV_720P25 */
+		{ 1280, 720, "720p@30" },	/* V4L2_DV_720P30 */
+		{ 1280, 720, "720p@50" },	/* V4L2_DV_720P50 */
+		{ 1280, 720, "720p@59.94" },	/* V4L2_DV_720P59_94 */
+		{ 1280, 720, "720p@60" },	/* V4L2_DV_720P60 */
+		{ 1920, 1080, "1080i@29.97" },	/* V4L2_DV_1080I29_97 */
+		{ 1920, 1080, "1080i@30" },	/* V4L2_DV_1080I30 */
+		{ 1920, 1080, "1080i@25" },	/* V4L2_DV_1080I25 */
+		{ 1920, 1080, "1080i@50" },	/* V4L2_DV_1080I50 */
+		{ 1920, 1080, "1080i@60" },	/* V4L2_DV_1080I60 */
+		{ 1920, 1080, "1080p@24" },	/* V4L2_DV_1080P24 */
+		{ 1920, 1080, "1080p@25" },	/* V4L2_DV_1080P25 */
+		{ 1920, 1080, "1080p@30" },	/* V4L2_DV_1080P30 */
+		{ 1920, 1080, "1080p@50" },	/* V4L2_DV_1080P50 */
+		{ 1920, 1080, "1080p@60" },	/* V4L2_DV_1080P60 */
+	};
+
+	if (info == NULL || preset >= ARRAY_SIZE(dv_presets))
+		return -EINVAL;
+
+	info->preset = preset;
+	info->width = dv_presets[preset].width;
+	info->height = dv_presets[preset].height;
+	strlcpy(info->name, dv_presets[preset].name, sizeof(info->name));
+	return 0;
+}
+EXPORT_SYMBOL_GPL(v4l_fill_dv_preset_info);
diff --git a/drivers/media/video/v4l2-compat-ioctl32.c b/drivers/media/video/v4l2-compat-ioctl32.c
index 997975d5e024..c4150bd26337 100644
--- a/drivers/media/video/v4l2-compat-ioctl32.c
+++ b/drivers/media/video/v4l2-compat-ioctl32.c
@@ -1077,6 +1077,12 @@ long v4l2_compat_ioctl32(struct file *file, unsigned int cmd, unsigned long arg)
 	case VIDIOC_DBG_G_REGISTER:
 	case VIDIOC_DBG_G_CHIP_IDENT:
 	case VIDIOC_S_HW_FREQ_SEEK:
+	case VIDIOC_ENUM_DV_PRESETS:
+	case VIDIOC_S_DV_PRESET:
+	case VIDIOC_G_DV_PRESET:
+	case VIDIOC_QUERY_DV_PRESET:
+	case VIDIOC_S_DV_TIMINGS:
+	case VIDIOC_G_DV_TIMINGS:
 		ret = do_video_ioctl(file, cmd, arg);
 		break;
 
diff --git a/drivers/media/video/v4l2-dev.c b/drivers/media/video/v4l2-dev.c
index 500cbe9891ac..709069916068 100644
--- a/drivers/media/video/v4l2-dev.c
+++ b/drivers/media/video/v4l2-dev.c
@@ -189,7 +189,7 @@ static ssize_t v4l2_read(struct file *filp, char __user *buf,
 
 	if (!vdev->fops->read)
 		return -EINVAL;
-	if (video_is_unregistered(vdev))
+	if (!video_is_registered(vdev))
 		return -EIO;
 	return vdev->fops->read(filp, buf, sz, off);
 }
@@ -201,7 +201,7 @@ static ssize_t v4l2_write(struct file *filp, const char __user *buf,
 
 	if (!vdev->fops->write)
 		return -EINVAL;
-	if (video_is_unregistered(vdev))
+	if (!video_is_registered(vdev))
 		return -EIO;
 	return vdev->fops->write(filp, buf, sz, off);
 }
@@ -210,7 +210,7 @@ static unsigned int v4l2_poll(struct file *filp, struct poll_table_struct *poll)
 {
 	struct video_device *vdev = video_devdata(filp);
 
-	if (!vdev->fops->poll || video_is_unregistered(vdev))
+	if (!vdev->fops->poll || !video_is_registered(vdev))
 		return DEFAULT_POLLMASK;
 	return vdev->fops->poll(filp, poll);
 }
@@ -250,7 +250,7 @@ static unsigned long v4l2_get_unmapped_area(struct file *filp,
 
 	if (!vdev->fops->get_unmapped_area)
 		return -ENOSYS;
-	if (video_is_unregistered(vdev))
+	if (!video_is_registered(vdev))
 		return -ENODEV;
 	return vdev->fops->get_unmapped_area(filp, addr, len, pgoff, flags);
 }
@@ -260,8 +260,7 @@ static int v4l2_mmap(struct file *filp, struct vm_area_struct *vm)
 {
 	struct video_device *vdev = video_devdata(filp);
 
-	if (!vdev->fops->mmap ||
-	    video_is_unregistered(vdev))
+	if (!vdev->fops->mmap || !video_is_registered(vdev))
 		return -ENODEV;
 	return vdev->fops->mmap(filp, vm);
 }
@@ -277,7 +276,7 @@ static int v4l2_open(struct inode *inode, struct file *filp)
 	vdev = video_devdata(filp);
 	/* return ENODEV if the video device has been removed
 	   already or if it is not registered anymore. */
-	if (vdev == NULL || video_is_unregistered(vdev)) {
+	if (vdev == NULL || !video_is_registered(vdev)) {
 		mutex_unlock(&videodev_lock);
 		return -ENODEV;
 	}
@@ -551,10 +550,11 @@ static int __video_register_device(struct video_device *vdev, int type, int nr,
 	vdev->dev.release = v4l2_device_release;
 
 	if (nr != -1 && nr != vdev->num && warn_if_nr_in_use)
-		printk(KERN_WARNING "%s: requested %s%d, got %s%d\n",
-				__func__, name_base, nr, name_base, vdev->num);
+		printk(KERN_WARNING "%s: requested %s%d, got %s\n", __func__,
+			name_base, nr, video_device_node_name(vdev));
 
 	/* Part 5: Activate this minor. The char device can now be used. */
+	set_bit(V4L2_FL_REGISTERED, &vdev->flags);
 	mutex_lock(&videodev_lock);
 	video_device[vdev->minor] = vdev;
 	mutex_unlock(&videodev_lock);
@@ -593,11 +593,11 @@ EXPORT_SYMBOL(video_register_device_no_warn);
 void video_unregister_device(struct video_device *vdev)
 {
 	/* Check if vdev was ever registered at all */
-	if (!vdev || vdev->minor < 0)
+	if (!vdev || !video_is_registered(vdev))
 		return;
 
 	mutex_lock(&videodev_lock);
-	set_bit(V4L2_FL_UNREGISTERED, &vdev->flags);
+	clear_bit(V4L2_FL_REGISTERED, &vdev->flags);
 	mutex_unlock(&videodev_lock);
 	device_unregister(&vdev->dev);
 }
diff --git a/drivers/media/video/v4l2-ioctl.c b/drivers/media/video/v4l2-ioctl.c
index 30cc3347ae52..4b11257c3184 100644
--- a/drivers/media/video/v4l2-ioctl.c
+++ b/drivers/media/video/v4l2-ioctl.c
@@ -284,6 +284,12 @@ static const char *v4l2_ioctls[] = {
 	[_IOC_NR(VIDIOC_DBG_G_CHIP_IDENT)] = "VIDIOC_DBG_G_CHIP_IDENT",
 	[_IOC_NR(VIDIOC_S_HW_FREQ_SEEK)]   = "VIDIOC_S_HW_FREQ_SEEK",
 #endif
+	[_IOC_NR(VIDIOC_ENUM_DV_PRESETS)]  = "VIDIOC_ENUM_DV_PRESETS",
+	[_IOC_NR(VIDIOC_S_DV_PRESET)]	   = "VIDIOC_S_DV_PRESET",
+	[_IOC_NR(VIDIOC_G_DV_PRESET)]	   = "VIDIOC_G_DV_PRESET",
+	[_IOC_NR(VIDIOC_QUERY_DV_PRESET)]  = "VIDIOC_QUERY_DV_PRESET",
+	[_IOC_NR(VIDIOC_S_DV_TIMINGS)]     = "VIDIOC_S_DV_TIMINGS",
+	[_IOC_NR(VIDIOC_G_DV_TIMINGS)]     = "VIDIOC_G_DV_TIMINGS",
 };
 #define V4L2_IOCTLS ARRAY_SIZE(v4l2_ioctls)
 
@@ -1135,6 +1141,19 @@ static long __video_do_ioctl(struct file *file,
 	{
 		struct v4l2_input *p = arg;
 
+		/*
+		 * We set the flags for CAP_PRESETS, CAP_CUSTOM_TIMINGS &
+		 * CAP_STD here based on ioctl handler provided by the
+		 * driver. If the driver doesn't support these
+		 * for a specific input, it must override these flags.
+		 */
+		if (ops->vidioc_s_std)
+			p->capabilities |= V4L2_IN_CAP_STD;
+		if (ops->vidioc_s_dv_preset)
+			p->capabilities |= V4L2_IN_CAP_PRESETS;
+		if (ops->vidioc_s_dv_timings)
+			p->capabilities |= V4L2_IN_CAP_CUSTOM_TIMINGS;
+
 		if (!ops->vidioc_enum_input)
 			break;
 
@@ -1179,6 +1198,19 @@ static long __video_do_ioctl(struct file *file,
 		if (!ops->vidioc_enum_output)
 			break;
 
+		/*
+		 * We set the flags for CAP_PRESETS, CAP_CUSTOM_TIMINGS &
+		 * CAP_STD here based on ioctl handler provided by the
+		 * driver. If the driver doesn't support these
+		 * for a specific output, it must override these flags.
+		 */
+		if (ops->vidioc_s_std)
+			p->capabilities |= V4L2_OUT_CAP_STD;
+		if (ops->vidioc_s_dv_preset)
+			p->capabilities |= V4L2_OUT_CAP_PRESETS;
+		if (ops->vidioc_s_dv_timings)
+			p->capabilities |= V4L2_OUT_CAP_CUSTOM_TIMINGS;
+
 		ret = ops->vidioc_enum_output(file, fh, p);
 		if (!ret)
 			dbgarg(cmd, "index=%d, name=%s, type=%d, "
@@ -1794,6 +1826,121 @@ static long __video_do_ioctl(struct file *file,
 		}
 		break;
 	}
+	case VIDIOC_ENUM_DV_PRESETS:
+	{
+		struct v4l2_dv_enum_preset *p = arg;
+
+		if (!ops->vidioc_enum_dv_presets)
+			break;
+
+		ret = ops->vidioc_enum_dv_presets(file, fh, p);
+		if (!ret)
+			dbgarg(cmd,
+				"index=%d, preset=%d, name=%s, width=%d,"
+				" height=%d ",
+				p->index, p->preset, p->name, p->width,
+				p->height);
+		break;
+	}
+	case VIDIOC_S_DV_PRESET:
+	{
+		struct v4l2_dv_preset *p = arg;
+
+		if (!ops->vidioc_s_dv_preset)
+			break;
+
+		dbgarg(cmd, "preset=%d\n", p->preset);
+		ret = ops->vidioc_s_dv_preset(file, fh, p);
+		break;
+	}
+	case VIDIOC_G_DV_PRESET:
+	{
+		struct v4l2_dv_preset *p = arg;
+
+		if (!ops->vidioc_g_dv_preset)
+			break;
+
+		ret = ops->vidioc_g_dv_preset(file, fh, p);
+		if (!ret)
+			dbgarg(cmd, "preset=%d\n", p->preset);
+		break;
+	}
+	case VIDIOC_QUERY_DV_PRESET:
+	{
+		struct v4l2_dv_preset *p = arg;
+
+		if (!ops->vidioc_query_dv_preset)
+			break;
+
+		ret = ops->vidioc_query_dv_preset(file, fh, p);
+		if (!ret)
+			dbgarg(cmd, "preset=%d\n", p->preset);
+		break;
+	}
+	case VIDIOC_S_DV_TIMINGS:
+	{
+		struct v4l2_dv_timings *p = arg;
+
+		if (!ops->vidioc_s_dv_timings)
+			break;
+
+		switch (p->type) {
+		case V4L2_DV_BT_656_1120:
+			dbgarg2("bt-656/1120:interlaced=%d, pixelclock=%lld,"
+				" width=%d, height=%d, polarities=%x,"
+				" hfrontporch=%d, hsync=%d, hbackporch=%d,"
+				" vfrontporch=%d, vsync=%d, vbackporch=%d,"
+				" il_vfrontporch=%d, il_vsync=%d,"
+				" il_vbackporch=%d\n",
+				p->bt.interlaced, p->bt.pixelclock,
+				p->bt.width, p->bt.height, p->bt.polarities,
+				p->bt.hfrontporch, p->bt.hsync,
+				p->bt.hbackporch, p->bt.vfrontporch,
+				p->bt.vsync, p->bt.vbackporch,
+				p->bt.il_vfrontporch, p->bt.il_vsync,
+				p->bt.il_vbackporch);
+			ret = ops->vidioc_s_dv_timings(file, fh, p);
+			break;
+		default:
+			dbgarg2("Unknown type %d!\n", p->type);
+			break;
+		}
+		break;
+	}
+	case VIDIOC_G_DV_TIMINGS:
+	{
+		struct v4l2_dv_timings *p = arg;
+
+		if (!ops->vidioc_g_dv_timings)
+			break;
+
+		ret = ops->vidioc_g_dv_timings(file, fh, p);
+		if (!ret) {
+			switch (p->type) {
+			case V4L2_DV_BT_656_1120:
+				dbgarg2("bt-656/1120:interlaced=%d,"
+					" pixelclock=%lld,"
+					" width=%d, height=%d, polarities=%x,"
+					" hfrontporch=%d, hsync=%d,"
+					" hbackporch=%d, vfrontporch=%d,"
+					" vsync=%d, vbackporch=%d,"
+					" il_vfrontporch=%d, il_vsync=%d,"
+					" il_vbackporch=%d\n",
+					p->bt.interlaced, p->bt.pixelclock,
+					p->bt.width, p->bt.height,
+					p->bt.polarities, p->bt.hfrontporch,
+					p->bt.hsync, p->bt.hbackporch,
+					p->bt.vfrontporch, p->bt.vsync,
+					p->bt.vbackporch, p->bt.il_vfrontporch,
+					p->bt.il_vsync, p->bt.il_vbackporch);
+				break;
+			default:
+				dbgarg2("Unknown type %d!\n", p->type);
+				break;
+			}
+		}
+		break;
+	}
 
 	default:
 	{
diff --git a/drivers/media/video/videobuf-core.c b/drivers/media/video/videobuf-core.c
index 8e93c6f25c83..bb0a1c8de414 100644
--- a/drivers/media/video/videobuf-core.c
+++ b/drivers/media/video/videobuf-core.c
@@ -110,7 +110,7 @@ EXPORT_SYMBOL_GPL(videobuf_queue_to_vmalloc);
 
 
 void videobuf_queue_core_init(struct videobuf_queue *q,
-			 struct videobuf_queue_ops *ops,
+			 const struct videobuf_queue_ops *ops,
 			 struct device *dev,
 			 spinlock_t *irqlock,
 			 enum v4l2_buf_type type,
@@ -360,7 +360,7 @@ int __videobuf_mmap_setup(struct videobuf_queue *q,
 		q->bufs[i]->bsize  = bsize;
 		switch (memory) {
 		case V4L2_MEMORY_MMAP:
-			q->bufs[i]->boff  = bsize * i;
+			q->bufs[i]->boff = PAGE_ALIGN(bsize) * i;
 			break;
 		case V4L2_MEMORY_USERPTR:
 		case V4L2_MEMORY_OVERLAY:
@@ -430,9 +430,9 @@ int videobuf_reqbufs(struct videobuf_queue *q,
 		count = VIDEO_MAX_FRAME;
 	size = 0;
 	q->ops->buf_setup(q, &count, &size);
-	size = PAGE_ALIGN(size);
-	dprintk(1, "reqbufs: bufs=%d, size=0x%x [%d pages total]\n",
-		count, size, (count*size)>>PAGE_SHIFT);
+	dprintk(1, "reqbufs: bufs=%d, size=0x%x [%u pages total]\n",
+		count, size,
+		(unsigned int)((count*PAGE_ALIGN(size))>>PAGE_SHIFT) );
 
 	retval = __videobuf_mmap_setup(q, count, size, req->memory);
 	if (retval < 0) {
@@ -1099,7 +1099,7 @@ int videobuf_cgmbuf(struct videobuf_queue *q,
 	mbuf->size   = 0;
 	for (i = 0; i < mbuf->frames; i++) {
 		mbuf->offsets[i]  = q->bufs[i]->boff;
-		mbuf->size       += q->bufs[i]->bsize;
+		mbuf->size       += PAGE_ALIGN(q->bufs[i]->bsize);
 	}
 
 	return 0;
diff --git a/drivers/media/video/videobuf-dma-contig.c b/drivers/media/video/videobuf-dma-contig.c
index c3065c4bcba9..22c01097e8a8 100644
--- a/drivers/media/video/videobuf-dma-contig.c
+++ b/drivers/media/video/videobuf-dma-contig.c
@@ -141,9 +141,11 @@ static int videobuf_dma_contig_user_get(struct videobuf_dma_contig_memory *mem,
 	struct vm_area_struct *vma;
 	unsigned long prev_pfn, this_pfn;
 	unsigned long pages_done, user_address;
+	unsigned int offset;
 	int ret;
 
-	mem->size = PAGE_ALIGN(vb->size);
+	offset = vb->baddr & ~PAGE_MASK;
+	mem->size = PAGE_ALIGN(vb->size + offset);
 	mem->is_userptr = 0;
 	ret = -EINVAL;
 
@@ -166,7 +168,7 @@ static int videobuf_dma_contig_user_get(struct videobuf_dma_contig_memory *mem,
 			break;
 
 		if (pages_done == 0)
-			mem->dma_handle = this_pfn << PAGE_SHIFT;
+			mem->dma_handle = (this_pfn << PAGE_SHIFT) + offset;
 		else if (this_pfn != (prev_pfn + 1))
 			ret = -EFAULT;
 
@@ -429,7 +431,7 @@ static struct videobuf_qtype_ops qops = {
 };
 
 void videobuf_queue_dma_contig_init(struct videobuf_queue *q,
-				    struct videobuf_queue_ops *ops,
+				    const struct videobuf_queue_ops *ops,
 				    struct device *dev,
 				    spinlock_t *irqlock,
 				    enum v4l2_buf_type type,
diff --git a/drivers/media/video/videobuf-dma-sg.c b/drivers/media/video/videobuf-dma-sg.c
index 032ebae0134a..fa78555b118b 100644
--- a/drivers/media/video/videobuf-dma-sg.c
+++ b/drivers/media/video/videobuf-dma-sg.c
@@ -588,7 +588,7 @@ static int __videobuf_mmap_mapper(struct videobuf_queue *q,
 			retval = -EBUSY;
 			goto done;
 		}
-		size += q->bufs[last]->bsize;
+		size += PAGE_ALIGN(q->bufs[last]->bsize);
 		if (size == (vma->vm_end - vma->vm_start))
 			break;
 	}
@@ -610,7 +610,7 @@ static int __videobuf_mmap_mapper(struct videobuf_queue *q,
 			continue;
 		q->bufs[i]->map   = map;
 		q->bufs[i]->baddr = vma->vm_start + size;
-		size += q->bufs[i]->bsize;
+		size += PAGE_ALIGN(q->bufs[i]->bsize);
 	}
 
 	map->count    = 1;
@@ -702,7 +702,7 @@ void *videobuf_sg_alloc(size_t size)
 }
 
 void videobuf_queue_sg_init(struct videobuf_queue* q,
-			 struct videobuf_queue_ops *ops,
+			 const struct videobuf_queue_ops *ops,
 			 struct device *dev,
 			 spinlock_t *irqlock,
 			 enum v4l2_buf_type type,
diff --git a/drivers/media/video/videobuf-dvb.c b/drivers/media/video/videobuf-dvb.c
index 0e7dcba8e4ae..a56cf0d3a6d6 100644
--- a/drivers/media/video/videobuf-dvb.c
+++ b/drivers/media/video/videobuf-dvb.c
@@ -139,7 +139,9 @@ static int videobuf_dvb_register_adapter(struct videobuf_dvb_frontends *fe,
 			  struct device *device,
 			  char *adapter_name,
 			  short *adapter_nr,
-			  int mfe_shared)
+			  int mfe_shared,
+			  int (*fe_ioctl_override)(struct dvb_frontend *,
+					unsigned int, void *, unsigned int))
 {
 	int result;
 
@@ -154,6 +156,7 @@ static int videobuf_dvb_register_adapter(struct videobuf_dvb_frontends *fe,
 	}
 	fe->adapter.priv = adapter_priv;
 	fe->adapter.mfe_shared = mfe_shared;
+	fe->adapter.fe_ioctl_override = fe_ioctl_override;
 
 	return result;
 }
@@ -253,7 +256,9 @@ int videobuf_dvb_register_bus(struct videobuf_dvb_frontends *f,
 			  void *adapter_priv,
 			  struct device *device,
 			  short *adapter_nr,
-			  int mfe_shared)
+			  int mfe_shared,
+			  int (*fe_ioctl_override)(struct dvb_frontend *,
+					unsigned int, void *, unsigned int))
 {
 	struct list_head *list, *q;
 	struct videobuf_dvb_frontend *fe;
@@ -267,7 +272,7 @@ int videobuf_dvb_register_bus(struct videobuf_dvb_frontends *f,
 
 	/* Bring up the adapter */
 	res = videobuf_dvb_register_adapter(f, module, adapter_priv, device,
-		fe->dvb.name, adapter_nr, mfe_shared);
+		fe->dvb.name, adapter_nr, mfe_shared, fe_ioctl_override);
 	if (res < 0) {
 		printk(KERN_WARNING "videobuf_dvb_register_adapter failed (errno = %d)\n", res);
 		return res;
diff --git a/drivers/media/video/videobuf-vmalloc.c b/drivers/media/video/videobuf-vmalloc.c
index 35f3900c5633..d6e6a28fb6b8 100644
--- a/drivers/media/video/videobuf-vmalloc.c
+++ b/drivers/media/video/videobuf-vmalloc.c
@@ -391,8 +391,8 @@ static struct videobuf_qtype_ops qops = {
 };
 
 void videobuf_queue_vmalloc_init(struct videobuf_queue* q,
-			 struct videobuf_queue_ops *ops,
-			 void *dev,
+			 const struct videobuf_queue_ops *ops,
+			 struct device *dev,
 			 spinlock_t *irqlock,
 			 enum v4l2_buf_type type,
 			 enum v4l2_field field,
diff --git a/drivers/media/video/vino.c b/drivers/media/video/vino.c
index b034a81d2b1c..a15d1e7cbed8 100644
--- a/drivers/media/video/vino.c
+++ b/drivers/media/video/vino.c
@@ -4068,7 +4068,6 @@ static struct video_device vdev_template = {
 	.fops		= &vino_fops,
 	.ioctl_ops 	= &vino_ioctl_ops,
 	.tvnorms 	= V4L2_STD_NTSC | V4L2_STD_PAL | V4L2_STD_SECAM,
-	.minor		= -1,
 };
 
 static void vino_module_cleanup(int stage)
diff --git a/drivers/media/video/vivi.c b/drivers/media/video/vivi.c
index 7705fc6baf00..37632a064966 100644
--- a/drivers/media/video/vivi.c
+++ b/drivers/media/video/vivi.c
@@ -1148,7 +1148,8 @@ static int vivi_open(struct file *file)
 		return -EBUSY;
 	}
 
-	dprintk(dev, 1, "open /dev/video%d type=%s users=%d\n", dev->vfd->num,
+	dprintk(dev, 1, "open %s type=%s users=%d\n",
+		video_device_node_name(dev->vfd),
 		v4l2_type_names[V4L2_BUF_TYPE_VIDEO_CAPTURE], dev->users);
 
 	/* allocate + initialize per filehandle data */
@@ -1221,8 +1222,7 @@ static int vivi_close(struct file *file)
 	struct vivi_fh         *fh = file->private_data;
 	struct vivi_dev *dev       = fh->dev;
 	struct vivi_dmaqueue *vidq = &dev->vidq;
-
-	int minor = video_devdata(file)->minor;
+	struct video_device  *vdev = video_devdata(file);
 
 	vivi_stop_thread(vidq);
 	videobuf_stop(&fh->vb_vidq);
@@ -1234,8 +1234,8 @@ static int vivi_close(struct file *file)
 	dev->users--;
 	mutex_unlock(&dev->mutex);
 
-	dprintk(dev, 1, "close called (minor=%d, users=%d)\n",
-		minor, dev->users);
+	dprintk(dev, 1, "close called (dev=%s, users=%d)\n",
+		video_device_node_name(vdev), dev->users);
 
 	return 0;
 }
@@ -1296,7 +1296,6 @@ static struct video_device vivi_template = {
 	.name		= "vivi",
 	.fops           = &vivi_fops,
 	.ioctl_ops 	= &vivi_ioctl_ops,
-	.minor		= -1,
 	.release	= video_device_release,
 
 	.tvnorms              = V4L2_STD_525_60,
@@ -1317,8 +1316,8 @@ static int vivi_release(void)
 		list_del(list);
 		dev = list_entry(list, struct vivi_dev, vivi_devlist);
 
-		v4l2_info(&dev->v4l2_dev, "unregistering /dev/video%d\n",
-			dev->vfd->num);
+		v4l2_info(&dev->v4l2_dev, "unregistering %s\n",
+			video_device_node_name(dev->vfd));
 		video_unregister_device(dev->vfd);
 		v4l2_device_unregister(&dev->v4l2_dev);
 		kfree(dev);
@@ -1372,15 +1371,12 @@ static int __init vivi_create_instance(int inst)
 	/* Now that everything is fine, let's add it to device list */
 	list_add_tail(&dev->vivi_devlist, &vivi_devlist);
 
-	snprintf(vfd->name, sizeof(vfd->name), "%s (%i)",
-			vivi_template.name, vfd->num);
-
 	if (video_nr >= 0)
 		video_nr++;
 
 	dev->vfd = vfd;
-	v4l2_info(&dev->v4l2_dev, "V4L2 device registered as /dev/video%d\n",
-			vfd->num);
+	v4l2_info(&dev->v4l2_dev, "V4L2 device registered as %s\n",
+		  video_device_node_name(vfd));
 	return 0;
 
 rel_vdev:
diff --git a/drivers/media/video/vpx3220.c b/drivers/media/video/vpx3220.c
index 97e0ce28ff18..33205d7537d8 100644
--- a/drivers/media/video/vpx3220.c
+++ b/drivers/media/video/vpx3220.c
@@ -391,7 +391,7 @@ static int vpx3220_s_routing(struct v4l2_subdev *sd,
 		{0x0e, 1}
 	};
 
-	if (input < 0 || input > 2)
+	if (input > 2)
 		return -EINVAL;
 
 	v4l2_dbg(1, debug, sd, "input switched to %s\n", inputs[input]);
diff --git a/drivers/media/video/w9968cf.c b/drivers/media/video/w9968cf.c
index 37fcdc447db5..d807eea91757 100644
--- a/drivers/media/video/w9968cf.c
+++ b/drivers/media/video/w9968cf.c
@@ -2323,9 +2323,9 @@ static int w9968cf_sensor_init(struct w9968cf_device* cam)
 error:
 	cam->sensor_initialized = 0;
 	cam->sensor = CC_UNKNOWN;
-	DBG(1, "Image sensor initialization failed for %s (/dev/video%d). "
+	DBG(1, "Image sensor initialization failed for %s (%s). "
 	       "Try to detach and attach this device again",
-	    symbolic(camlist, cam->id), cam->v4ldev->num)
+	    symbolic(camlist, cam->id), video_device_node_name(cam->v4ldev))
 	return err;
 }
 
@@ -2571,7 +2571,8 @@ static void w9968cf_release_resources(struct w9968cf_device* cam)
 {
 	mutex_lock(&w9968cf_devlist_mutex);
 
-	DBG(2, "V4L device deregistered: /dev/video%d", cam->v4ldev->num)
+	DBG(2, "V4L device deregistered: %s",
+	    video_device_node_name(cam->v4ldev))
 
 	video_unregister_device(cam->v4ldev);
 	list_del(&cam->v4llist);
@@ -2605,17 +2606,19 @@ static int w9968cf_open(struct file *filp)
 
 	if (cam->sensor == CC_UNKNOWN) {
 		DBG(2, "No supported image sensor has been detected by the "
-		       "'ovcamchip' module for the %s (/dev/video%d). Make "
-		       "sure it is loaded *before* (re)connecting the camera.",
-		    symbolic(camlist, cam->id), cam->v4ldev->num)
+		       "'ovcamchip' module for the %s (%s). Make sure "
+		       "it is loaded *before* (re)connecting the camera.",
+		    symbolic(camlist, cam->id),
+		    video_device_node_name(cam->v4ldev))
 		mutex_unlock(&cam->dev_mutex);
 		up_read(&w9968cf_disconnect);
 		return -ENODEV;
 	}
 
 	if (cam->users) {
-		DBG(2, "%s (/dev/video%d) has been already occupied by '%s'",
-		    symbolic(camlist, cam->id), cam->v4ldev->num, cam->command)
+		DBG(2, "%s (%s) has been already occupied by '%s'",
+		    symbolic(camlist, cam->id),
+		    video_device_node_name(cam->v4ldev), cam->command)
 		if ((filp->f_flags & O_NONBLOCK)||(filp->f_flags & O_NDELAY)) {
 			mutex_unlock(&cam->dev_mutex);
 			up_read(&w9968cf_disconnect);
@@ -2636,8 +2639,8 @@ static int w9968cf_open(struct file *filp)
 		mutex_lock(&cam->dev_mutex);
 	}
 
-	DBG(5, "Opening '%s', /dev/video%d ...",
-	    symbolic(camlist, cam->id), cam->v4ldev->num)
+	DBG(5, "Opening '%s', %s ...",
+	    symbolic(camlist, cam->id), video_device_node_name(cam->v4ldev))
 
 	cam->streaming = 0;
 	cam->misconfigured = 0;
@@ -2874,8 +2877,7 @@ static long w9968cf_v4l_ioctl(struct file *filp,
 			.minwidth = cam->minwidth,
 			.minheight = cam->minheight,
 		};
-		sprintf(cap.name, "W996[87]CF USB Camera #%d",
-			cam->v4ldev->num);
+		sprintf(cap.name, "W996[87]CF USB Camera");
 		cap.maxwidth = (cam->upscaling && w9968cf_vpp)
 			       ? max((u16)W9968CF_MAX_WIDTH, cam->maxwidth)
 				 : cam->maxwidth;
@@ -3485,7 +3487,6 @@ w9968cf_usb_probe(struct usb_interface* intf, const struct usb_device_id* id)
 
 	strcpy(cam->v4ldev->name, symbolic(camlist, mod_id));
 	cam->v4ldev->fops = &w9968cf_fops;
-	cam->v4ldev->minor = video_nr[dev_nr];
 	cam->v4ldev->release = video_device_release;
 	video_set_drvdata(cam->v4ldev, cam);
 	cam->v4ldev->v4l2_dev = &cam->v4l2_dev;
@@ -3501,7 +3502,8 @@ w9968cf_usb_probe(struct usb_interface* intf, const struct usb_device_id* id)
 		goto fail;
 	}
 
-	DBG(2, "V4L device registered as /dev/video%d", cam->v4ldev->num)
+	DBG(2, "V4L device registered as %s",
+	    video_device_node_name(cam->v4ldev))
 
 	/* Set some basic constants */
 	w9968cf_configure_camera(cam, udev, mod_id, dev_nr);
@@ -3557,10 +3559,10 @@ static void w9968cf_usb_disconnect(struct usb_interface* intf)
 		wake_up_interruptible_all(&cam->open);
 
 		if (cam->users) {
-			DBG(2, "The device is open (/dev/video%d)! "
+			DBG(2, "The device is open (%s)! "
 			       "Process name: %s. Deregistration and memory "
 			       "deallocation are deferred on close.",
-			    cam->v4ldev->num, cam->command)
+			    video_device_node_name(cam->v4ldev), cam->command)
 			cam->misconfigured = 1;
 			w9968cf_stop_transfer(cam);
 			wake_up_interruptible(&cam->wait_queue);
diff --git a/drivers/media/video/zc0301/zc0301_core.c b/drivers/media/video/zc0301/zc0301_core.c
index 312a71336fd0..e44e4b5f3e50 100644
--- a/drivers/media/video/zc0301/zc0301_core.c
+++ b/drivers/media/video/zc0301/zc0301_core.c
@@ -538,8 +538,8 @@ static int zc0301_stream_interrupt(struct zc0301_device* cam)
 	else if (cam->stream != STREAM_OFF) {
 		cam->state |= DEV_MISCONFIGURED;
 		DBG(1, "URB timeout reached. The camera is misconfigured. To "
-		       "use it, close and open /dev/video%d again.",
-		    cam->v4ldev->num);
+		       "use it, close and open %s again.",
+		    video_device_node_name(cam->v4ldev));
 		return -EIO;
 	}
 
@@ -640,7 +640,8 @@ static void zc0301_release_resources(struct kref *kref)
 {
 	struct zc0301_device *cam = container_of(kref, struct zc0301_device,
 						 kref);
-	DBG(2, "V4L2 device /dev/video%d deregistered", cam->v4ldev->num);
+	DBG(2, "V4L2 device %s deregistered",
+	    video_device_node_name(cam->v4ldev));
 	video_set_drvdata(cam->v4ldev, NULL);
 	video_unregister_device(cam->v4ldev);
 	usb_put_dev(cam->usbdev);
@@ -679,7 +680,8 @@ static int zc0301_open(struct file *filp)
 	}
 
 	if (cam->users) {
-		DBG(2, "Device /dev/video%d is busy...", cam->v4ldev->num);
+		DBG(2, "Device %s is busy...",
+		    video_device_node_name(cam->v4ldev));
 		DBG(3, "Simultaneous opens are not supported");
 		if ((filp->f_flags & O_NONBLOCK) ||
 		    (filp->f_flags & O_NDELAY)) {
@@ -722,7 +724,8 @@ static int zc0301_open(struct file *filp)
 	cam->frame_count = 0;
 	zc0301_empty_framequeues(cam);
 
-	DBG(3, "Video device /dev/video%d is open", cam->v4ldev->num);
+	DBG(3, "Video device %s is open",
+	    video_device_node_name(cam->v4ldev));
 
 out:
 	mutex_unlock(&cam->open_mutex);
@@ -746,7 +749,8 @@ static int zc0301_release(struct file *filp)
 	cam->users--;
 	wake_up_interruptible_nr(&cam->wait_open, 1);
 
-	DBG(3, "Video device /dev/video%d closed", cam->v4ldev->num);
+	DBG(3, "Video device %s closed",
+	    video_device_node_name(cam->v4ldev));
 
 	kref_put(&cam->kref, zc0301_release_resources);
 
@@ -1276,8 +1280,8 @@ zc0301_vidioc_s_crop(struct zc0301_device* cam, void __user * arg)
 	if (err) { /* atomic, no rollback in ioctl() */
 		cam->state |= DEV_MISCONFIGURED;
 		DBG(1, "VIDIOC_S_CROP failed because of hardware problems. To "
-		       "use the camera, close and open /dev/video%d again.",
-		    cam->v4ldev->num);
+		       "use the camera, close and open %s again.",
+		    video_device_node_name(cam->v4ldev));
 		return -EIO;
 	}
 
@@ -1289,8 +1293,8 @@ zc0301_vidioc_s_crop(struct zc0301_device* cam, void __user * arg)
 	    nbuffers != zc0301_request_buffers(cam, nbuffers, cam->io)) {
 		cam->state |= DEV_MISCONFIGURED;
 		DBG(1, "VIDIOC_S_CROP failed because of not enough memory. To "
-		       "use the camera, close and open /dev/video%d again.",
-		    cam->v4ldev->num);
+		       "use the camera, close and open %s again.",
+		    video_device_node_name(cam->v4ldev));
 		return -ENOMEM;
 	}
 
@@ -1471,8 +1475,8 @@ zc0301_vidioc_try_s_fmt(struct zc0301_device* cam, unsigned int cmd,
 	if (err) { /* atomic, no rollback in ioctl() */
 		cam->state |= DEV_MISCONFIGURED;
 		DBG(1, "VIDIOC_S_FMT failed because of hardware problems. To "
-		       "use the camera, close and open /dev/video%d again.",
-		    cam->v4ldev->num);
+		       "use the camera, close and open %s again.",
+		    video_device_node_name(cam->v4ldev));
 		return -EIO;
 	}
 
@@ -1483,8 +1487,8 @@ zc0301_vidioc_try_s_fmt(struct zc0301_device* cam, unsigned int cmd,
 	    nbuffers != zc0301_request_buffers(cam, nbuffers, cam->io)) {
 		cam->state |= DEV_MISCONFIGURED;
 		DBG(1, "VIDIOC_S_FMT failed because of not enough memory. To "
-		       "use the camera, close and open /dev/video%d again.",
-		    cam->v4ldev->num);
+		       "use the camera, close and open %s again.",
+		    video_device_node_name(cam->v4ldev));
 		return -ENOMEM;
 	}
 
@@ -1530,8 +1534,8 @@ zc0301_vidioc_s_jpegcomp(struct zc0301_device* cam, void __user * arg)
 	if (err) { /* atomic, no rollback in ioctl() */
 		cam->state |= DEV_MISCONFIGURED;
 		DBG(1, "VIDIOC_S_JPEGCOMP failed because of hardware "
-		       "problems. To use the camera, close and open "
-		       "/dev/video%d again.", cam->v4ldev->num);
+		       "problems. To use the camera, close and open %s again.",
+		       video_device_node_name(cam->v4ldev));
 		return -EIO;
 	}
 
@@ -1984,7 +1988,6 @@ zc0301_usb_probe(struct usb_interface* intf, const struct usb_device_id* id)
 
 	strcpy(cam->v4ldev->name, "ZC0301[P] PC Camera");
 	cam->v4ldev->fops = &zc0301_fops;
-	cam->v4ldev->minor = video_nr[dev_nr];
 	cam->v4ldev->release = video_device_release;
 	cam->v4ldev->parent = &udev->dev;
 	video_set_drvdata(cam->v4ldev, cam);
@@ -2003,7 +2006,8 @@ zc0301_usb_probe(struct usb_interface* intf, const struct usb_device_id* id)
 		goto fail;
 	}
 
-	DBG(2, "V4L2 device registered as /dev/video%d", cam->v4ldev->num);
+	DBG(2, "V4L2 device registered as %s",
+	    video_device_node_name(cam->v4ldev));
 
 	cam->module_param.force_munmap = force_munmap[dev_nr];
 	cam->module_param.frame_timeout = frame_timeout[dev_nr];
@@ -2040,9 +2044,9 @@ static void zc0301_usb_disconnect(struct usb_interface* intf)
 	DBG(2, "Disconnecting %s...", cam->v4ldev->name);
 
 	if (cam->users) {
-		DBG(2, "Device /dev/video%d is open! Deregistration and "
+		DBG(2, "Device %s is open! Deregistration and "
 		       "memory deallocation are deferred.",
-		    cam->v4ldev->num);
+		    video_device_node_name(cam->v4ldev));
 		cam->state |= DEV_MISCONFIGURED;
 		zc0301_stop_transfer(cam);
 		cam->state |= DEV_DISCONNECTED;
diff --git a/drivers/media/video/zoran/zoran.h b/drivers/media/video/zoran/zoran.h
index d439c76b27e1..cb1de7ea197a 100644
--- a/drivers/media/video/zoran/zoran.h
+++ b/drivers/media/video/zoran/zoran.h
@@ -106,7 +106,7 @@ struct zoran_params {
 	unsigned long jpeg_markers;	/* Which markers should go into the JPEG output.
 					 * Unless you exactly know what you do, leave them untouched.
 					 * Inluding less markers will make the resulting code
-					 * smaller, but there will be fewer aplications
+					 * smaller, but there will be fewer applications
 					 * which can read it.
 					 * The presence of the APP and COM marker is
 					 * influenced by APP0_len and COM_len ONLY! */
diff --git a/drivers/media/video/zoran/zoran_driver.c b/drivers/media/video/zoran/zoran_driver.c
index 47137deafcfd..2ddffed019ee 100644
--- a/drivers/media/video/zoran/zoran_driver.c
+++ b/drivers/media/video/zoran/zoran_driver.c
@@ -2764,7 +2764,7 @@ static int zoran_enum_input(struct file *file, void *__fh,
 	struct zoran_fh *fh = __fh;
 	struct zoran *zr = fh->zr;
 
-	if (inp->index < 0 || inp->index >= zr->card.inputs)
+	if (inp->index >= zr->card.inputs)
 		return -EINVAL;
 	else {
 		int id = inp->index;
@@ -3387,6 +3387,5 @@ struct video_device zoran_template __devinitdata = {
 	.ioctl_ops = &zoran_ioctl_ops,
 	.release = &zoran_vdev_release,
 	.tvnorms = V4L2_STD_NTSC | V4L2_STD_PAL | V4L2_STD_SECAM,
-	.minor = -1
 };
 
diff --git a/drivers/media/video/zr364xx.c b/drivers/media/video/zr364xx.c
index 9aae011d92ab..f0eae83e3d89 100644
--- a/drivers/media/video/zr364xx.c
+++ b/drivers/media/video/zr364xx.c
@@ -115,6 +115,7 @@ static struct usb_device_id device_table[] = {
 	{USB_DEVICE(0x0a17, 0x004e), .driver_info = METHOD2 },
 	{USB_DEVICE(0x041e, 0x405d), .driver_info = METHOD2 },
 	{USB_DEVICE(0x08ca, 0x2102), .driver_info = METHOD2 },
+	{USB_DEVICE(0x06d6, 0x003d), .driver_info = METHOD0 },
 	{}			/* Terminating entry */
 };
 
@@ -1454,7 +1455,6 @@ static struct video_device zr364xx_template = {
 	.fops = &zr364xx_fops,
 	.ioctl_ops = &zr364xx_ioctl_ops,
 	.release = video_device_release,
-	.minor = -1,
 };
 
 
@@ -1634,8 +1634,8 @@ static int zr364xx_probe(struct usb_interface *intf,
 
 	spin_lock_init(&cam->slock);
 
-	dev_info(&udev->dev, DRIVER_DESC " controlling video device %d\n",
-		 cam->vdev->num);
+	dev_info(&udev->dev, DRIVER_DESC " controlling device %s\n",
+		 video_device_node_name(cam->vdev));
 	return 0;
 }
 
diff --git a/drivers/message/fusion/mptbase.c b/drivers/message/fusion/mptbase.c
index 610e914abe6c..85bc6a685e36 100644
--- a/drivers/message/fusion/mptbase.c
+++ b/drivers/message/fusion/mptbase.c
@@ -1587,7 +1587,7 @@ mpt_mapresources(MPT_ADAPTER *ioc)
 {
 	u8		__iomem *mem;
 	int		 ii;
-	unsigned long	 mem_phys;
+	resource_size_t	 mem_phys;
 	unsigned long	 port;
 	u32		 msize;
 	u32		 psize;
@@ -1677,8 +1677,8 @@ mpt_mapresources(MPT_ADAPTER *ioc)
 		return -EINVAL;
 	}
 	ioc->memmap = mem;
-	dinitprintk(ioc, printk(MYIOC_s_INFO_FMT "mem = %p, mem_phys = %lx\n",
-	    ioc->name, mem, mem_phys));
+	dinitprintk(ioc, printk(MYIOC_s_INFO_FMT "mem = %p, mem_phys = %llx\n",
+	    ioc->name, mem, (unsigned long long)mem_phys));
 
 	ioc->mem_phys = mem_phys;
 	ioc->chip = (SYSIF_REGS __iomem *)mem;
diff --git a/drivers/message/fusion/mptbase.h b/drivers/message/fusion/mptbase.h
index 8dd4d219e433..b4948671eb92 100644
--- a/drivers/message/fusion/mptbase.h
+++ b/drivers/message/fusion/mptbase.h
@@ -76,8 +76,8 @@
 #define COPYRIGHT	"Copyright (c) 1999-2008 " MODULEAUTHOR
 #endif
 
-#define MPT_LINUX_VERSION_COMMON	"3.04.12"
-#define MPT_LINUX_PACKAGE_NAME		"@(#)mptlinux-3.04.12"
+#define MPT_LINUX_VERSION_COMMON	"3.04.13"
+#define MPT_LINUX_PACKAGE_NAME		"@(#)mptlinux-3.04.13"
 #define WHAT_MAGIC_STRING		"@" "(" "#" ")"
 
 #define show_mptmod_ver(s,ver)  \
diff --git a/drivers/message/fusion/mptctl.c b/drivers/message/fusion/mptctl.c
index 9b2e2198aee9..352acd05c46b 100644
--- a/drivers/message/fusion/mptctl.c
+++ b/drivers/message/fusion/mptctl.c
@@ -621,11 +621,8 @@ __mptctl_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 	 */
 	iocnumX = khdr.iocnum & 0xFF;
 	if (((iocnum = mpt_verify_adapter(iocnumX, &iocp)) < 0) ||
-	    (iocp == NULL)) {
-		printk(KERN_DEBUG MYNAM "%s::mptctl_ioctl() @%d - ioc%d not found!\n",
-				__FILE__, __LINE__, iocnumX);
+	    (iocp == NULL))
 		return -ENODEV;
-	}
 
 	if (!iocp->active) {
 		printk(KERN_DEBUG MYNAM "%s::mptctl_ioctl() @%d - Controller disabled.\n",
diff --git a/drivers/message/fusion/mptscsih.c b/drivers/message/fusion/mptscsih.c
index c29578614504..57752751712b 100644
--- a/drivers/message/fusion/mptscsih.c
+++ b/drivers/message/fusion/mptscsih.c
@@ -792,11 +792,36 @@ mptscsih_io_done(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf, MPT_FRAME_HDR *mr)
 			 *  precedence!
 			 */
 			sc->result = (DID_OK << 16) | scsi_status;
-			if (scsi_state & MPI_SCSI_STATE_AUTOSENSE_VALID) {
-				/* Have already saved the status and sense data
+			if (!(scsi_state & MPI_SCSI_STATE_AUTOSENSE_VALID)) {
+
+				/*
+				 * For an Errata on LSI53C1030
+				 * When the length of request data
+				 * and transfer data are different
+				 * with result of command (READ or VERIFY),
+				 * DID_SOFT_ERROR is set.
 				 */
-				;
-			} else {
+				if (ioc->bus_type == SPI) {
+					if (pScsiReq->CDB[0] == READ_6  ||
+					    pScsiReq->CDB[0] == READ_10 ||
+					    pScsiReq->CDB[0] == READ_12 ||
+					    pScsiReq->CDB[0] == READ_16 ||
+					    pScsiReq->CDB[0] == VERIFY  ||
+					    pScsiReq->CDB[0] == VERIFY_16) {
+						if (scsi_bufflen(sc) !=
+							xfer_cnt) {
+							sc->result =
+							DID_SOFT_ERROR << 16;
+						    printk(KERN_WARNING "Errata"
+						    "on LSI53C1030 occurred."
+						    "sc->req_bufflen=0x%02x,"
+						    "xfer_cnt=0x%02x\n",
+						    scsi_bufflen(sc),
+						    xfer_cnt);
+						}
+					}
+				}
+
 				if (xfer_cnt < sc->underflow) {
 					if (scsi_status == SAM_STAT_BUSY)
 						sc->result = SAM_STAT_BUSY;
@@ -835,7 +860,58 @@ mptscsih_io_done(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf, MPT_FRAME_HDR *mr)
 			sc->result = (DID_OK << 16) | scsi_status;
 			if (scsi_state == 0) {
 				;
-			} else if (scsi_state & MPI_SCSI_STATE_AUTOSENSE_VALID) {
+			} else if (scsi_state &
+			    MPI_SCSI_STATE_AUTOSENSE_VALID) {
+
+				/*
+				 * For potential trouble on LSI53C1030.
+				 * (date:2007.xx.)
+				 * It is checked whether the length of
+				 * request data is equal to
+				 * the length of transfer and residual.
+				 * MEDIUM_ERROR is set by incorrect data.
+				 */
+				if ((ioc->bus_type == SPI) &&
+					(sc->sense_buffer[2] & 0x20)) {
+					u32	 difftransfer;
+					difftransfer =
+					sc->sense_buffer[3] << 24 |
+					sc->sense_buffer[4] << 16 |
+					sc->sense_buffer[5] << 8 |
+					sc->sense_buffer[6];
+					if (((sc->sense_buffer[3] & 0x80) ==
+						0x80) && (scsi_bufflen(sc)
+						!= xfer_cnt)) {
+						sc->sense_buffer[2] =
+						    MEDIUM_ERROR;
+						sc->sense_buffer[12] = 0xff;
+						sc->sense_buffer[13] = 0xff;
+						printk(KERN_WARNING"Errata"
+						"on LSI53C1030 occurred."
+						"sc->req_bufflen=0x%02x,"
+						"xfer_cnt=0x%02x\n" ,
+						scsi_bufflen(sc),
+						xfer_cnt);
+					}
+					if (((sc->sense_buffer[3] & 0x80)
+						!= 0x80) &&
+						(scsi_bufflen(sc) !=
+						xfer_cnt + difftransfer)) {
+						sc->sense_buffer[2] =
+							MEDIUM_ERROR;
+						sc->sense_buffer[12] = 0xff;
+						sc->sense_buffer[13] = 0xff;
+						printk(KERN_WARNING
+						"Errata on LSI53C1030 occurred"
+						"sc->req_bufflen=0x%02x,"
+						" xfer_cnt=0x%02x,"
+						"difftransfer=0x%02x\n",
+						scsi_bufflen(sc),
+						xfer_cnt,
+						difftransfer);
+					}
+				}
+
 				/*
 				 * If running against circa 200003dd 909 MPT f/w,
 				 * may get this (AUTOSENSE_VALID) for actual TASK_SET_FULL
@@ -2275,11 +2351,12 @@ mptscsih_slave_destroy(struct scsi_device *sdev)
  *	mptscsih_change_queue_depth - This function will set a devices queue depth
  *	@sdev: per scsi_device pointer
  *	@qdepth: requested queue depth
+ *	@reason: calling context
  *
  *	Adding support for new 'change_queue_depth' api.
 */
 int
-mptscsih_change_queue_depth(struct scsi_device *sdev, int qdepth)
+mptscsih_change_queue_depth(struct scsi_device *sdev, int qdepth, int reason)
 {
 	MPT_SCSI_HOST		*hd = shost_priv(sdev->host);
 	VirtTarget 		*vtarget;
@@ -2291,6 +2368,9 @@ mptscsih_change_queue_depth(struct scsi_device *sdev, int qdepth)
 	starget = scsi_target(sdev);
 	vtarget = starget->hostdata;
 
+	if (reason != SCSI_QDEPTH_DEFAULT)
+		return -EOPNOTSUPP;
+
 	if (ioc->bus_type == SPI) {
 		if (!(vtarget->tflags & MPT_TARGET_FLAGS_Q_YES))
 			max_depth = 1;
@@ -2357,7 +2437,8 @@ mptscsih_slave_configure(struct scsi_device *sdev)
 		    ioc->name, vtarget->negoFlags, vtarget->maxOffset,
 		    vtarget->minSyncFactor));
 
-	mptscsih_change_queue_depth(sdev, MPT_SCSI_CMD_PER_DEV_HIGH);
+	mptscsih_change_queue_depth(sdev, MPT_SCSI_CMD_PER_DEV_HIGH,
+				    SCSI_QDEPTH_DEFAULT);
 	dsprintk(ioc, printk(MYIOC_s_DEBUG_FMT
 		"tagged %d, simple %d, ordered %d\n",
 		ioc->name,sdev->tagged_supported, sdev->simple_tags,
diff --git a/drivers/message/fusion/mptscsih.h b/drivers/message/fusion/mptscsih.h
index e0b33e04a33b..45a5ff3eff61 100644
--- a/drivers/message/fusion/mptscsih.h
+++ b/drivers/message/fusion/mptscsih.h
@@ -128,7 +128,8 @@ extern int mptscsih_taskmgmt_complete(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf, MPT_F
 extern int mptscsih_scandv_complete(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf, MPT_FRAME_HDR *r);
 extern int mptscsih_event_process(MPT_ADAPTER *ioc, EventNotificationReply_t *pEvReply);
 extern int mptscsih_ioc_reset(MPT_ADAPTER *ioc, int post_reset);
-extern int mptscsih_change_queue_depth(struct scsi_device *sdev, int qdepth);
+extern int mptscsih_change_queue_depth(struct scsi_device *sdev, int qdepth,
+				       int reason);
 extern u8 mptscsih_raid_id_to_num(MPT_ADAPTER *ioc, u8 channel, u8 id);
 extern int mptscsih_is_phys_disk(MPT_ADAPTER *ioc, u8 channel, u8 id);
 extern struct device_attribute *mptscsih_host_attrs[];
diff --git a/drivers/message/i2o/i2o_block.c b/drivers/message/i2o/i2o_block.c
index d505b68cd372..e39986a78273 100644
--- a/drivers/message/i2o/i2o_block.c
+++ b/drivers/message/i2o/i2o_block.c
@@ -940,7 +940,7 @@ static const struct block_device_operations i2o_block_fops = {
  *	Allocate memory for the i2o_block_device struct, gendisk and request
  *	queue and initialize them as far as no additional information is needed.
  *
- *	Returns a pointer to the allocated I2O Block device on succes or a
+ *	Returns a pointer to the allocated I2O Block device on success or a
  *	negative error code on failure.
  */
 static struct i2o_block_device *i2o_block_device_alloc(void)
diff --git a/drivers/message/i2o/i2o_config.c b/drivers/message/i2o/i2o_config.c
index efba7021948a..3d5f40cd69df 100644
--- a/drivers/message/i2o/i2o_config.c
+++ b/drivers/message/i2o/i2o_config.c
@@ -40,8 +40,7 @@
 
 #define SG_TABLESIZE		30
 
-static int i2o_cfg_ioctl(struct inode *, struct file *, unsigned int,
-			 unsigned long);
+static long i2o_cfg_ioctl(struct file *, unsigned int, unsigned long);
 
 static spinlock_t i2o_config_lock;
 
@@ -751,7 +750,7 @@ static long i2o_cfg_compat_ioctl(struct file *file, unsigned cmd,
 	lock_kernel();
 	switch (cmd) {
 	case I2OGETIOPS:
-		ret = i2o_cfg_ioctl(NULL, file, cmd, arg);
+		ret = i2o_cfg_ioctl(file, cmd, arg);
 		break;
 	case I2OPASSTHRU32:
 		ret = i2o_cfg_passthru32(file, cmd, arg);
@@ -984,11 +983,11 @@ out:
 /*
  * IOCTL Handler
  */
-static int i2o_cfg_ioctl(struct inode *inode, struct file *fp, unsigned int cmd,
-			 unsigned long arg)
+static long i2o_cfg_ioctl(struct file *fp, unsigned int cmd, unsigned long arg)
 {
 	int ret;
 
+	lock_kernel();
 	switch (cmd) {
 	case I2OGETIOPS:
 		ret = i2o_cfg_getiops(arg);
@@ -1044,7 +1043,7 @@ static int i2o_cfg_ioctl(struct inode *inode, struct file *fp, unsigned int cmd,
 		osm_debug("unknown ioctl called!\n");
 		ret = -EINVAL;
 	}
-
+	unlock_kernel();
 	return ret;
 }
 
@@ -1118,7 +1117,7 @@ static int cfg_release(struct inode *inode, struct file *file)
 static const struct file_operations config_fops = {
 	.owner = THIS_MODULE,
 	.llseek = no_llseek,
-	.ioctl = i2o_cfg_ioctl,
+	.unlocked_ioctl = i2o_cfg_ioctl,
 #ifdef CONFIG_COMPAT
 	.compat_ioctl = i2o_cfg_compat_ioctl,
 #endif
diff --git a/drivers/message/i2o/iop.c b/drivers/message/i2o/iop.c
index 27cf4af0e13d..e5ab62141503 100644
--- a/drivers/message/i2o/iop.c
+++ b/drivers/message/i2o/iop.c
@@ -132,7 +132,7 @@ u32 i2o_cntxt_list_add(struct i2o_controller * c, void *ptr)
  *	Removes a previously added pointer from the context list and returns
  *	the matching context id.
  *
- *	Returns context id on succes or 0 on failure.
+ *	Returns context id on success or 0 on failure.
  */
 u32 i2o_cntxt_list_remove(struct i2o_controller * c, void *ptr)
 {
@@ -198,7 +198,7 @@ void *i2o_cntxt_list_get(struct i2o_controller *c, u32 context)
  *	@c: controller to which the context list belong
  *	@ptr: pointer to which the context id should be fetched
  *
- *	Returns context id which matches to the pointer on succes or 0 on
+ *	Returns context id which matches to the pointer on success or 0 on
  *	failure.
  */
 u32 i2o_cntxt_list_get_ptr(struct i2o_controller * c, void *ptr)
diff --git a/drivers/mfd/88pm8607.c b/drivers/mfd/88pm8607.c
new file mode 100644
index 000000000000..7e3f65907993
--- /dev/null
+++ b/drivers/mfd/88pm8607.c
@@ -0,0 +1,302 @@
+/*
+ * Base driver for Marvell 88PM8607
+ *
+ * Copyright (C) 2009 Marvell International Ltd.
+ * 	Haojian Zhuang <haojian.zhuang@marvell.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/interrupt.h>
+#include <linux/platform_device.h>
+#include <linux/i2c.h>
+#include <linux/mfd/core.h>
+#include <linux/mfd/88pm8607.h>
+
+
+#define PM8607_REG_RESOURCE(_start, _end)		\
+{							\
+	.start	= PM8607_##_start,			\
+	.end	= PM8607_##_end,			\
+	.flags	= IORESOURCE_IO,			\
+}
+
+static struct resource pm8607_regulator_resources[] = {
+	PM8607_REG_RESOURCE(BUCK1, BUCK1),
+	PM8607_REG_RESOURCE(BUCK2, BUCK2),
+	PM8607_REG_RESOURCE(BUCK3, BUCK3),
+	PM8607_REG_RESOURCE(LDO1,  LDO1),
+	PM8607_REG_RESOURCE(LDO2,  LDO2),
+	PM8607_REG_RESOURCE(LDO3,  LDO3),
+	PM8607_REG_RESOURCE(LDO4,  LDO4),
+	PM8607_REG_RESOURCE(LDO5,  LDO5),
+	PM8607_REG_RESOURCE(LDO6,  LDO6),
+	PM8607_REG_RESOURCE(LDO7,  LDO7),
+	PM8607_REG_RESOURCE(LDO8,  LDO8),
+	PM8607_REG_RESOURCE(LDO9,  LDO9),
+	PM8607_REG_RESOURCE(LDO10, LDO10),
+	PM8607_REG_RESOURCE(LDO12, LDO12),
+	PM8607_REG_RESOURCE(LDO14, LDO14),
+};
+
+#define PM8607_REG_DEVS(_name, _id)					\
+{									\
+	.name		= "88pm8607-" #_name,				\
+	.num_resources	= 1,						\
+	.resources	= &pm8607_regulator_resources[PM8607_ID_##_id],	\
+}
+
+static struct mfd_cell pm8607_devs[] = {
+	PM8607_REG_DEVS(buck1, BUCK1),
+	PM8607_REG_DEVS(buck2, BUCK2),
+	PM8607_REG_DEVS(buck3, BUCK3),
+	PM8607_REG_DEVS(ldo1,  LDO1),
+	PM8607_REG_DEVS(ldo2,  LDO2),
+	PM8607_REG_DEVS(ldo3,  LDO3),
+	PM8607_REG_DEVS(ldo4,  LDO4),
+	PM8607_REG_DEVS(ldo5,  LDO5),
+	PM8607_REG_DEVS(ldo6,  LDO6),
+	PM8607_REG_DEVS(ldo7,  LDO7),
+	PM8607_REG_DEVS(ldo8,  LDO8),
+	PM8607_REG_DEVS(ldo9,  LDO9),
+	PM8607_REG_DEVS(ldo10, LDO10),
+	PM8607_REG_DEVS(ldo12, LDO12),
+	PM8607_REG_DEVS(ldo14, LDO14),
+};
+
+static inline int pm8607_read_device(struct pm8607_chip *chip,
+				     int reg, int bytes, void *dest)
+{
+	struct i2c_client *i2c = chip->client;
+	unsigned char data;
+	int ret;
+
+	data = (unsigned char)reg;
+	ret = i2c_master_send(i2c, &data, 1);
+	if (ret < 0)
+		return ret;
+
+	ret = i2c_master_recv(i2c, dest, bytes);
+	if (ret < 0)
+		return ret;
+	return 0;
+}
+
+static inline int pm8607_write_device(struct pm8607_chip *chip,
+				      int reg, int bytes, void *src)
+{
+	struct i2c_client *i2c = chip->client;
+	unsigned char buf[bytes + 1];
+	int ret;
+
+	buf[0] = (unsigned char)reg;
+	memcpy(&buf[1], src, bytes);
+
+	ret = i2c_master_send(i2c, buf, bytes + 1);
+	if (ret < 0)
+		return ret;
+	return 0;
+}
+
+int pm8607_reg_read(struct pm8607_chip *chip, int reg)
+{
+	unsigned char data;
+	int ret;
+
+	mutex_lock(&chip->io_lock);
+	ret = chip->read(chip, reg, 1, &data);
+	mutex_unlock(&chip->io_lock);
+
+	if (ret < 0)
+		return ret;
+	else
+		return (int)data;
+}
+EXPORT_SYMBOL(pm8607_reg_read);
+
+int pm8607_reg_write(struct pm8607_chip *chip, int reg,
+		     unsigned char data)
+{
+	int ret;
+
+	mutex_lock(&chip->io_lock);
+	ret = chip->write(chip, reg, 1, &data);
+	mutex_unlock(&chip->io_lock);
+
+	return ret;
+}
+EXPORT_SYMBOL(pm8607_reg_write);
+
+int pm8607_bulk_read(struct pm8607_chip *chip, int reg,
+		     int count, unsigned char *buf)
+{
+	int ret;
+
+	mutex_lock(&chip->io_lock);
+	ret = chip->read(chip, reg, count, buf);
+	mutex_unlock(&chip->io_lock);
+
+	return ret;
+}
+EXPORT_SYMBOL(pm8607_bulk_read);
+
+int pm8607_bulk_write(struct pm8607_chip *chip, int reg,
+		      int count, unsigned char *buf)
+{
+	int ret;
+
+	mutex_lock(&chip->io_lock);
+	ret = chip->write(chip, reg, count, buf);
+	mutex_unlock(&chip->io_lock);
+
+	return ret;
+}
+EXPORT_SYMBOL(pm8607_bulk_write);
+
+int pm8607_set_bits(struct pm8607_chip *chip, int reg,
+		    unsigned char mask, unsigned char data)
+{
+	unsigned char value;
+	int ret;
+
+	mutex_lock(&chip->io_lock);
+	ret = chip->read(chip, reg, 1, &value);
+	if (ret < 0)
+		goto out;
+	value &= ~mask;
+	value |= data;
+	ret = chip->write(chip, reg, 1, &value);
+out:
+	mutex_unlock(&chip->io_lock);
+	return ret;
+}
+EXPORT_SYMBOL(pm8607_set_bits);
+
+
+static const struct i2c_device_id pm8607_id_table[] = {
+	{ "88PM8607", 0 },
+	{}
+};
+MODULE_DEVICE_TABLE(i2c, pm8607_id_table);
+
+
+static int __devinit pm8607_probe(struct i2c_client *client,
+				  const struct i2c_device_id *id)
+{
+	struct pm8607_platform_data *pdata = client->dev.platform_data;
+	struct pm8607_chip *chip;
+	int i, count;
+	int ret;
+
+	chip = kzalloc(sizeof(struct pm8607_chip), GFP_KERNEL);
+	if (chip == NULL)
+		return -ENOMEM;
+
+	chip->client = client;
+	chip->dev = &client->dev;
+	chip->read = pm8607_read_device;
+	chip->write = pm8607_write_device;
+	i2c_set_clientdata(client, chip);
+
+	mutex_init(&chip->io_lock);
+	dev_set_drvdata(chip->dev, chip);
+
+	ret = pm8607_reg_read(chip, PM8607_CHIP_ID);
+	if (ret < 0) {
+		dev_err(chip->dev, "Failed to read CHIP ID: %d\n", ret);
+		goto out;
+	}
+	if ((ret & CHIP_ID_MASK) == CHIP_ID)
+		dev_info(chip->dev, "Marvell 88PM8607 (ID: %02x) detected\n",
+			 ret);
+	else {
+		dev_err(chip->dev, "Failed to detect Marvell 88PM8607. "
+			"Chip ID: %02x\n", ret);
+		goto out;
+	}
+	chip->chip_id = ret;
+
+	ret = pm8607_reg_read(chip, PM8607_BUCK3);
+	if (ret < 0) {
+		dev_err(chip->dev, "Failed to read BUCK3 register: %d\n", ret);
+		goto out;
+	}
+	if (ret & PM8607_BUCK3_DOUBLE)
+		chip->buck3_double = 1;
+
+	ret = pm8607_reg_read(chip, PM8607_MISC1);
+	if (ret < 0) {
+		dev_err(chip->dev, "Failed to read MISC1 register: %d\n", ret);
+		goto out;
+	}
+	if (pdata->i2c_port == PI2C_PORT)
+		ret |= PM8607_MISC1_PI2C;
+	else
+		ret &= ~PM8607_MISC1_PI2C;
+	ret = pm8607_reg_write(chip, PM8607_MISC1, ret);
+	if (ret < 0) {
+		dev_err(chip->dev, "Failed to write MISC1 register: %d\n", ret);
+		goto out;
+	}
+
+
+	count = ARRAY_SIZE(pm8607_devs);
+	for (i = 0; i < count; i++) {
+		ret = mfd_add_devices(chip->dev, i, &pm8607_devs[i],
+				      1, NULL, 0);
+		if (ret != 0) {
+			dev_err(chip->dev, "Failed to add subdevs\n");
+			goto out;
+		}
+	}
+
+	return 0;
+
+out:
+	i2c_set_clientdata(client, NULL);
+	kfree(chip);
+	return ret;
+}
+
+static int __devexit pm8607_remove(struct i2c_client *client)
+{
+	struct pm8607_chip *chip = i2c_get_clientdata(client);
+
+	mfd_remove_devices(chip->dev);
+	kfree(chip);
+	return 0;
+}
+
+static struct i2c_driver pm8607_driver = {
+	.driver	= {
+		.name	= "88PM8607",
+		.owner	= THIS_MODULE,
+	},
+	.probe		= pm8607_probe,
+	.remove		= __devexit_p(pm8607_remove),
+	.id_table	= pm8607_id_table,
+};
+
+static int __init pm8607_init(void)
+{
+	int ret;
+	ret = i2c_add_driver(&pm8607_driver);
+	if (ret != 0)
+		pr_err("Failed to register 88PM8607 I2C driver: %d\n", ret);
+	return ret;
+}
+subsys_initcall(pm8607_init);
+
+static void __exit pm8607_exit(void)
+{
+	i2c_del_driver(&pm8607_driver);
+}
+module_exit(pm8607_exit);
+
+MODULE_DESCRIPTION("PMIC Driver for Marvell 88PM8607");
+MODULE_AUTHOR("Haojian Zhuang <haojian.zhuang@marvell.com>");
+MODULE_LICENSE("GPL");
diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
index 08f2d07bf56a..87829789243e 100644
--- a/drivers/mfd/Kconfig
+++ b/drivers/mfd/Kconfig
@@ -35,6 +35,14 @@ config MFD_ASIC3
 	  This driver supports the ASIC3 multifunction chip found on many
 	  PDAs (mainly iPAQ and HTC based ones)
 
+config MFD_SH_MOBILE_SDHI
+	bool "Support for SuperH Mobile SDHI"
+	depends on SUPERH
+	select MFD_CORE
+	 ---help---
+	  This driver supports the SDHI hardware block found in many
+	  SuperH Mobile SoCs.
+
 config MFD_DM355EVM_MSP
 	bool "DaVinci DM355 EVM microcontroller"
 	depends on I2C && MACH_DAVINCI_DM355_EVM
@@ -95,10 +103,10 @@ config MENELAUS
 	  cell phones and PDAs.
 
 config TWL4030_CORE
-	bool "Texas Instruments TWL4030/TPS659x0 Support"
+	bool "Texas Instruments TWL4030/TWL5030/TWL6030/TPS659x0 Support"
 	depends on I2C=y && GENERIC_HARDIRQS
 	help
-	  Say yes here if you have TWL4030 family chip on your board.
+	  Say yes here if you have TWL4030 / TWL6030 family chip on your board.
 	  This core driver provides register access and IRQ handling
 	  facilities, and registers devices for the various functions
 	  so that function-specific drivers can bind to them.
@@ -166,6 +174,16 @@ config PMIC_DA903X
 	  individual components like LCD backlight, voltage regulators,
 	  LEDs and battery-charger under the corresponding menus.
 
+config PMIC_ADP5520
+	bool "Analog Devices ADP5520/01 MFD PMIC Core Support"
+	depends on I2C=y
+	help
+	  Say yes here to add support for Analog Devices AD5520 and ADP5501,
+	  Multifunction Power Management IC. This includes
+	  the I2C driver and the core APIs _only_, you have to select
+	  individual components like LCD backlight, LEDs, GPIOs and Kepad
+	  under the corresponding menus.
+
 config MFD_WM8400
 	tristate "Support Wolfson Microelectronics WM8400"
 	select MFD_CORE
@@ -177,12 +195,12 @@ config MFD_WM8400
 	  the functionality of the device.
 
 config MFD_WM831X
-	tristate "Support Wolfson Microelectronics WM831x PMICs"
+	bool "Support Wolfson Microelectronics WM831x/2x PMICs"
 	select MFD_CORE
-	depends on I2C
+	depends on I2C=y
 	help
-	  Support for the Wolfson Microelecronics WM831x PMICs.  This
-	  driver provides common support for accessing the device,
+	  Support for the Wolfson Microelecronics WM831x and WM832x PMICs.
+	  This driver provides common support for accessing the device,
 	  additional drivers must be enabled in order to use the
 	  functionality of the device.
 
@@ -311,6 +329,25 @@ config EZX_PCAP
 	  This enables the PCAP ASIC present on EZX Phones. This is
 	  needed for MMC, TouchScreen, Sound, USB, etc..
 
+config MFD_88PM8607
+	bool "Support Marvell 88PM8607"
+	depends on I2C=y
+	select MFD_CORE
+	help
+	  This supports for Marvell 88PM8607 Power Management IC. This includes
+	  the I2C driver and the core APIs _only_, you have to select
+	  individual components like voltage regulators, RTC and
+	  battery-charger under the corresponding menus.
+
+config AB4500_CORE
+	tristate "ST-Ericsson's AB4500 Mixed Signal Power management chip"
+	depends on SPI
+	help
+	  Select this option to enable access to AB4500 power management
+	  chip. This connects to U8500 on the SSP/SPI bus and exports
+	  read/write functions for the devices to get access to this chip.
+	  This chip embeds various other multimedia funtionalities as well.
+
 endmenu
 
 menu "Multimedia Capabilities Port drivers"
diff --git a/drivers/mfd/Makefile b/drivers/mfd/Makefile
index af0fc903cec8..8f0d18409ede 100644
--- a/drivers/mfd/Makefile
+++ b/drivers/mfd/Makefile
@@ -4,27 +4,29 @@
 
 obj-$(CONFIG_MFD_SM501)		+= sm501.o
 obj-$(CONFIG_MFD_ASIC3)		+= asic3.o
+obj-$(CONFIG_MFD_SH_MOBILE_SDHI)		+= sh_mobile_sdhi.o
 
 obj-$(CONFIG_HTC_EGPIO)		+= htc-egpio.o
 obj-$(CONFIG_HTC_PASIC3)	+= htc-pasic3.o
 
 obj-$(CONFIG_MFD_DM355EVM_MSP)	+= dm355evm_msp.o
 
-obj-$(CONFIG_MFD_T7L66XB)	+= t7l66xb.o
-obj-$(CONFIG_MFD_TC6387XB)	+= tc6387xb.o
-obj-$(CONFIG_MFD_TC6393XB)	+= tc6393xb.o
+obj-$(CONFIG_MFD_T7L66XB)	+= t7l66xb.o tmio_core.o
+obj-$(CONFIG_MFD_TC6387XB)	+= tc6387xb.o tmio_core.o
+obj-$(CONFIG_MFD_TC6393XB)	+= tc6393xb.o tmio_core.o
 
 obj-$(CONFIG_MFD_WM8400)	+= wm8400-core.o
 wm831x-objs			:= wm831x-core.o wm831x-irq.o wm831x-otp.o
 obj-$(CONFIG_MFD_WM831X)	+= wm831x.o
 wm8350-objs			:= wm8350-core.o wm8350-regmap.o wm8350-gpio.o
+wm8350-objs			+= wm8350-irq.o
 obj-$(CONFIG_MFD_WM8350)	+= wm8350.o
 obj-$(CONFIG_MFD_WM8350_I2C)	+= wm8350-i2c.o
 
 obj-$(CONFIG_TPS65010)		+= tps65010.o
 obj-$(CONFIG_MENELAUS)		+= menelaus.o
 
-obj-$(CONFIG_TWL4030_CORE)	+= twl4030-core.o twl4030-irq.o
+obj-$(CONFIG_TWL4030_CORE)	+= twl-core.o twl4030-irq.o twl6030-irq.o
 obj-$(CONFIG_TWL4030_POWER)    += twl4030-power.o
 obj-$(CONFIG_TWL4030_CODEC)	+= twl4030-codec.o
 
@@ -51,3 +53,6 @@ obj-$(CONFIG_PCF50633_ADC)	+= pcf50633-adc.o
 obj-$(CONFIG_PCF50633_GPIO)	+= pcf50633-gpio.o
 obj-$(CONFIG_AB3100_CORE)	+= ab3100-core.o
 obj-$(CONFIG_AB3100_OTP)	+= ab3100-otp.o
+obj-$(CONFIG_AB4500_CORE)	+= ab4500-core.o
+obj-$(CONFIG_MFD_88PM8607)	+= 88pm8607.o
+obj-$(CONFIG_PMIC_ADP5520)	+= adp5520.o
\ No newline at end of file
diff --git a/drivers/mfd/ab3100-core.c b/drivers/mfd/ab3100-core.c
index 613481028272..fd42a80e7bf9 100644
--- a/drivers/mfd/ab3100-core.c
+++ b/drivers/mfd/ab3100-core.c
@@ -900,9 +900,6 @@ static int __init ab3100_probe(struct i2c_client *client,
 		goto exit_no_testreg_client;
 	}
 
-	strlcpy(ab3100->testreg_client->name, id->name,
-		sizeof(ab3100->testreg_client->name));
-
 	err = ab3100_setup(ab3100);
 	if (err)
 		goto exit_no_setup;
diff --git a/drivers/mfd/ab4500-core.c b/drivers/mfd/ab4500-core.c
new file mode 100644
index 000000000000..1c44c19e073a
--- /dev/null
+++ b/drivers/mfd/ab4500-core.c
@@ -0,0 +1,208 @@
+/*
+ * Copyright (C) 2009 ST-Ericsson
+ *
+ * Author: Srinidhi KASAGAR <srinidhi.kasagar@stericsson.com>
+ *
+ * This program is free software; you can redistribute it
+ * and/or modify it under the terms of the GNU General Public
+ * License version 2, as published by the Free Software Foundation.
+ *
+ * AB4500 is a companion power management chip used with U8500.
+ * On this platform, this is interfaced with SSP0 controller
+ * which is a ARM primecell pl022.
+ *
+ * At the moment the module just exports read/write features.
+ * Interrupt management to be added - TODO.
+ */
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/spi/spi.h>
+#include <linux/mfd/ab4500.h>
+
+/* just required if probe fails, we need to
+ * unregister the device
+ */
+static struct spi_driver ab4500_driver;
+
+/*
+ * This funtion writes to any AB4500 registers using
+ * SPI protocol &  before it writes it packs the data
+ * in the below 24 bit frame format
+ *
+ *	 *|------------------------------------|
+ *	 *| 23|22...18|17.......10|9|8|7......0|
+ *	 *| r/w  bank       adr          data  |
+ *	 * ------------------------------------
+ *
+ * This function shouldn't be called from interrupt
+ * context
+ */
+int ab4500_write(struct ab4500 *ab4500, unsigned char block,
+		unsigned long addr, unsigned char data)
+{
+	struct spi_transfer xfer;
+	struct spi_message	msg;
+	int err;
+	unsigned long spi_data =
+		block << 18 | addr << 10 | data;
+
+	mutex_lock(&ab4500->lock);
+	ab4500->tx_buf[0] = spi_data;
+	ab4500->rx_buf[0] = 0;
+
+	xfer.tx_buf	= ab4500->tx_buf;
+	xfer.rx_buf 	= NULL;
+	xfer.len	= sizeof(unsigned long);
+
+	spi_message_init(&msg);
+	spi_message_add_tail(&xfer, &msg);
+
+	err = spi_sync(ab4500->spi, &msg);
+	mutex_unlock(&ab4500->lock);
+
+	return err;
+}
+EXPORT_SYMBOL(ab4500_write);
+
+int ab4500_read(struct ab4500 *ab4500, unsigned char block,
+		unsigned long addr)
+{
+	struct spi_transfer xfer;
+	struct spi_message	msg;
+	unsigned long spi_data =
+		1 << 23 | block << 18 | addr << 10;
+
+	mutex_lock(&ab4500->lock);
+	ab4500->tx_buf[0] = spi_data;
+	ab4500->rx_buf[0] = 0;
+
+	xfer.tx_buf	= ab4500->tx_buf;
+	xfer.rx_buf 	= ab4500->rx_buf;
+	xfer.len	= sizeof(unsigned long);
+
+	spi_message_init(&msg);
+	spi_message_add_tail(&xfer, &msg);
+
+	spi_sync(ab4500->spi, &msg);
+	mutex_unlock(&ab4500->lock);
+
+	return  ab4500->rx_buf[0];
+}
+EXPORT_SYMBOL(ab4500_read);
+
+/* ref: ab3100 core */
+#define AB4500_DEVICE(devname, devid)				\
+static struct platform_device ab4500_##devname##_device = {	\
+	.name	= devid,					\
+	.id	= -1,						\
+}
+
+/* list of childern devices of ab4500 - all are
+ * not populated here - TODO
+ */
+AB4500_DEVICE(charger, "ab4500-charger");
+AB4500_DEVICE(audio, "ab4500-audio");
+AB4500_DEVICE(usb, "ab4500-usb");
+AB4500_DEVICE(tvout, "ab4500-tvout");
+AB4500_DEVICE(sim, "ab4500-sim");
+AB4500_DEVICE(gpadc, "ab4500-gpadc");
+AB4500_DEVICE(clkmgt, "ab4500-clkmgt");
+AB4500_DEVICE(misc, "ab4500-misc");
+
+static struct platform_device *ab4500_platform_devs[] = {
+	&ab4500_charger_device,
+	&ab4500_audio_device,
+	&ab4500_usb_device,
+	&ab4500_tvout_device,
+	&ab4500_sim_device,
+	&ab4500_gpadc_device,
+	&ab4500_clkmgt_device,
+	&ab4500_misc_device,
+};
+
+static int __init ab4500_probe(struct spi_device *spi)
+{
+	struct ab4500	*ab4500;
+	unsigned char revision;
+	int err = 0;
+	int i;
+
+	ab4500 = kzalloc(sizeof *ab4500, GFP_KERNEL);
+	if (!ab4500) {
+		dev_err(&spi->dev, "could not allocate AB4500\n");
+		err = -ENOMEM;
+		goto not_detect;
+	}
+
+	ab4500->spi = spi;
+	spi_set_drvdata(spi, ab4500);
+
+	mutex_init(&ab4500->lock);
+
+	/* read the revision register */
+	revision = ab4500_read(ab4500, AB4500_MISC, AB4500_REV_REG);
+
+	/* revision id 0x0 is for early drop, 0x10 is for cut1.0 */
+	if (revision == 0x0 || revision == 0x10)
+		dev_info(&spi->dev, "Detected chip: %s, revision = %x\n",
+			ab4500_driver.driver.name, revision);
+	else	{
+		dev_err(&spi->dev, "unknown chip: 0x%x\n", revision);
+		goto not_detect;
+	}
+
+	for (i = 0; i < ARRAY_SIZE(ab4500_platform_devs); i++)	{
+		ab4500_platform_devs[i]->dev.parent =
+			&spi->dev;
+		platform_set_drvdata(ab4500_platform_devs[i], ab4500);
+	}
+
+	/* register the ab4500 platform devices */
+	platform_add_devices(ab4500_platform_devs,
+			ARRAY_SIZE(ab4500_platform_devs));
+
+	return err;
+
+ not_detect:
+	spi_unregister_driver(&ab4500_driver);
+	kfree(ab4500);
+	return err;
+}
+
+static int __devexit ab4500_remove(struct spi_device *spi)
+{
+	struct ab4500 *ab4500 =
+		spi_get_drvdata(spi);
+
+	kfree(ab4500);
+
+	return 0;
+}
+
+static struct spi_driver ab4500_driver = {
+	.driver = {
+		.name = "ab4500",
+		.owner = THIS_MODULE,
+	},
+	.probe = ab4500_probe,
+	.remove = __devexit_p(ab4500_remove)
+};
+
+static int __devinit ab4500_init(void)
+{
+	return spi_register_driver(&ab4500_driver);
+}
+
+static void __exit ab4500_exit(void)
+{
+	spi_unregister_driver(&ab4500_driver);
+}
+
+subsys_initcall(ab4500_init);
+module_exit(ab4500_exit);
+
+MODULE_AUTHOR("Srinidhi KASAGAR <srinidhi.kasagar@stericsson.com");
+MODULE_DESCRIPTION("AB4500 core driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/mfd/adp5520.c b/drivers/mfd/adp5520.c
new file mode 100644
index 000000000000..b26644772d02
--- /dev/null
+++ b/drivers/mfd/adp5520.c
@@ -0,0 +1,379 @@
+/*
+ * Base driver for Analog Devices ADP5520/ADP5501 MFD PMICs
+ * LCD Backlight: drivers/video/backlight/adp5520_bl
+ * LEDs		: drivers/led/leds-adp5520
+ * GPIO		: drivers/gpio/adp5520-gpio (ADP5520 only)
+ * Keys		: drivers/input/keyboard/adp5520-keys (ADP5520 only)
+ *
+ * Copyright 2009 Analog Devices Inc.
+ *
+ * Derived from da903x:
+ * Copyright (C) 2008 Compulab, Ltd.
+ * 	Mike Rapoport <mike@compulab.co.il>
+ *
+ * Copyright (C) 2006-2008 Marvell International Ltd.
+ * 	Eric Miao <eric.miao@marvell.com>
+ *
+ * Licensed under the GPL-2 or later.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/init.h>
+#include <linux/interrupt.h>
+#include <linux/irq.h>
+#include <linux/err.h>
+#include <linux/i2c.h>
+
+#include <linux/mfd/adp5520.h>
+
+struct adp5520_chip {
+	struct i2c_client *client;
+	struct device *dev;
+	struct mutex lock;
+	struct blocking_notifier_head notifier_list;
+	int irq;
+	unsigned long id;
+};
+
+static int __adp5520_read(struct i2c_client *client,
+				int reg, uint8_t *val)
+{
+	int ret;
+
+	ret = i2c_smbus_read_byte_data(client, reg);
+	if (ret < 0) {
+		dev_err(&client->dev, "failed reading at 0x%02x\n", reg);
+		return ret;
+	}
+
+	*val = (uint8_t)ret;
+	return 0;
+}
+
+static int __adp5520_write(struct i2c_client *client,
+				 int reg, uint8_t val)
+{
+	int ret;
+
+	ret = i2c_smbus_write_byte_data(client, reg, val);
+	if (ret < 0) {
+		dev_err(&client->dev, "failed writing 0x%02x to 0x%02x\n",
+				val, reg);
+		return ret;
+	}
+	return 0;
+}
+
+static int __adp5520_ack_bits(struct i2c_client *client, int reg,
+			      uint8_t bit_mask)
+{
+	struct adp5520_chip *chip = i2c_get_clientdata(client);
+	uint8_t reg_val;
+	int ret;
+
+	mutex_lock(&chip->lock);
+
+	ret = __adp5520_read(client, reg, &reg_val);
+
+	if (!ret) {
+		reg_val |= bit_mask;
+		ret = __adp5520_write(client, reg, reg_val);
+	}
+
+	mutex_unlock(&chip->lock);
+	return ret;
+}
+
+int adp5520_write(struct device *dev, int reg, uint8_t val)
+{
+	return __adp5520_write(to_i2c_client(dev), reg, val);
+}
+EXPORT_SYMBOL_GPL(adp5520_write);
+
+int adp5520_read(struct device *dev, int reg, uint8_t *val)
+{
+	return __adp5520_read(to_i2c_client(dev), reg, val);
+}
+EXPORT_SYMBOL_GPL(adp5520_read);
+
+int adp5520_set_bits(struct device *dev, int reg, uint8_t bit_mask)
+{
+	struct adp5520_chip *chip = dev_get_drvdata(dev);
+	uint8_t reg_val;
+	int ret;
+
+	mutex_lock(&chip->lock);
+
+	ret = __adp5520_read(chip->client, reg, &reg_val);
+
+	if (!ret && ((reg_val & bit_mask) == 0)) {
+		reg_val |= bit_mask;
+		ret = __adp5520_write(chip->client, reg, reg_val);
+	}
+
+	mutex_unlock(&chip->lock);
+	return ret;
+}
+EXPORT_SYMBOL_GPL(adp5520_set_bits);
+
+int adp5520_clr_bits(struct device *dev, int reg, uint8_t bit_mask)
+{
+	struct adp5520_chip *chip = dev_get_drvdata(dev);
+	uint8_t reg_val;
+	int ret;
+
+	mutex_lock(&chip->lock);
+
+	ret = __adp5520_read(chip->client, reg, &reg_val);
+
+	if (!ret && (reg_val & bit_mask)) {
+		reg_val &= ~bit_mask;
+		ret = __adp5520_write(chip->client, reg, reg_val);
+	}
+
+	mutex_unlock(&chip->lock);
+	return ret;
+}
+EXPORT_SYMBOL_GPL(adp5520_clr_bits);
+
+int adp5520_register_notifier(struct device *dev, struct notifier_block *nb,
+				unsigned int events)
+{
+	struct adp5520_chip *chip = dev_get_drvdata(dev);
+
+	if (chip->irq) {
+		adp5520_set_bits(chip->dev, ADP5520_INTERRUPT_ENABLE,
+			events & (ADP5520_KP_IEN | ADP5520_KR_IEN |
+			ADP5520_OVP_IEN | ADP5520_CMPR_IEN));
+
+		return blocking_notifier_chain_register(&chip->notifier_list,
+			 nb);
+	}
+
+	return -ENODEV;
+}
+EXPORT_SYMBOL_GPL(adp5520_register_notifier);
+
+int adp5520_unregister_notifier(struct device *dev, struct notifier_block *nb,
+				unsigned int events)
+{
+	struct adp5520_chip *chip = dev_get_drvdata(dev);
+
+	adp5520_clr_bits(chip->dev, ADP5520_INTERRUPT_ENABLE,
+		events & (ADP5520_KP_IEN | ADP5520_KR_IEN |
+		ADP5520_OVP_IEN | ADP5520_CMPR_IEN));
+
+	return blocking_notifier_chain_unregister(&chip->notifier_list, nb);
+}
+EXPORT_SYMBOL_GPL(adp5520_unregister_notifier);
+
+static irqreturn_t adp5520_irq_thread(int irq, void *data)
+{
+	struct adp5520_chip *chip = data;
+	unsigned int events;
+	uint8_t reg_val;
+	int ret;
+
+	ret = __adp5520_read(chip->client, ADP5520_MODE_STATUS, &reg_val);
+	if (ret)
+		goto out;
+
+	events =  reg_val & (ADP5520_OVP_INT | ADP5520_CMPR_INT |
+		ADP5520_GPI_INT | ADP5520_KR_INT | ADP5520_KP_INT);
+
+	blocking_notifier_call_chain(&chip->notifier_list, events, NULL);
+	/* ACK, Sticky bits are W1C */
+	__adp5520_ack_bits(chip->client, ADP5520_MODE_STATUS, events);
+
+out:
+	return IRQ_HANDLED;
+}
+
+static int __remove_subdev(struct device *dev, void *unused)
+{
+	platform_device_unregister(to_platform_device(dev));
+	return 0;
+}
+
+static int adp5520_remove_subdevs(struct adp5520_chip *chip)
+{
+	return device_for_each_child(chip->dev, NULL, __remove_subdev);
+}
+
+static int __devinit adp5520_probe(struct i2c_client *client,
+					const struct i2c_device_id *id)
+{
+	struct adp5520_platform_data *pdata = client->dev.platform_data;
+	struct platform_device *pdev;
+	struct adp5520_chip *chip;
+	int ret;
+
+	if (!i2c_check_functionality(client->adapter,
+					I2C_FUNC_SMBUS_BYTE_DATA)) {
+		dev_err(&client->dev, "SMBUS Word Data not Supported\n");
+		return -EIO;
+	}
+
+	if (pdata == NULL) {
+		dev_err(&client->dev, "missing platform data\n");
+		return -ENODEV;
+	}
+
+	chip = kzalloc(sizeof(*chip), GFP_KERNEL);
+	if (!chip)
+		return -ENOMEM;
+
+	i2c_set_clientdata(client, chip);
+	chip->client = client;
+
+	chip->dev = &client->dev;
+	chip->irq = client->irq;
+	chip->id = id->driver_data;
+	mutex_init(&chip->lock);
+
+	if (chip->irq) {
+		BLOCKING_INIT_NOTIFIER_HEAD(&chip->notifier_list);
+
+		ret = request_threaded_irq(chip->irq, NULL, adp5520_irq_thread,
+				IRQF_TRIGGER_LOW | IRQF_ONESHOT,
+				"adp5520", chip);
+		if (ret) {
+			dev_err(&client->dev, "failed to request irq %d\n",
+					chip->irq);
+			goto out_free_chip;
+		}
+	}
+
+	ret = adp5520_write(chip->dev, ADP5520_MODE_STATUS, ADP5520_nSTNBY);
+	if (ret) {
+		dev_err(&client->dev, "failed to write\n");
+		goto out_free_irq;
+	}
+
+	if (pdata->keys) {
+		pdev = platform_device_register_data(chip->dev, "adp5520-keys",
+				chip->id, pdata->keys, sizeof(*pdata->keys));
+		if (IS_ERR(pdev)) {
+			ret = PTR_ERR(pdev);
+			goto out_remove_subdevs;
+		}
+	}
+
+	if (pdata->gpio) {
+		pdev = platform_device_register_data(chip->dev, "adp5520-gpio",
+				chip->id, pdata->gpio, sizeof(*pdata->gpio));
+		if (IS_ERR(pdev)) {
+			ret = PTR_ERR(pdev);
+			goto out_remove_subdevs;
+		}
+	}
+
+	if (pdata->leds) {
+		pdev = platform_device_register_data(chip->dev, "adp5520-led",
+				chip->id, pdata->leds, sizeof(*pdata->leds));
+		if (IS_ERR(pdev)) {
+			ret = PTR_ERR(pdev);
+			goto out_remove_subdevs;
+		}
+	}
+
+	if (pdata->backlight) {
+		pdev = platform_device_register_data(chip->dev,
+						"adp5520-backlight",
+						chip->id,
+						pdata->backlight,
+						sizeof(*pdata->backlight));
+		if (IS_ERR(pdev)) {
+			ret = PTR_ERR(pdev);
+			goto out_remove_subdevs;
+		}
+	}
+
+	return 0;
+
+out_remove_subdevs:
+	adp5520_remove_subdevs(chip);
+
+out_free_irq:
+	if (chip->irq)
+		free_irq(chip->irq, chip);
+
+out_free_chip:
+	i2c_set_clientdata(client, NULL);
+	kfree(chip);
+
+	return ret;
+}
+
+static int __devexit adp5520_remove(struct i2c_client *client)
+{
+	struct adp5520_chip *chip = dev_get_drvdata(&client->dev);
+
+	if (chip->irq)
+		free_irq(chip->irq, chip);
+
+	adp5520_remove_subdevs(chip);
+	adp5520_write(chip->dev, ADP5520_MODE_STATUS, 0);
+	i2c_set_clientdata(client, NULL);
+	kfree(chip);
+	return 0;
+}
+
+#ifdef CONFIG_PM
+static int adp5520_suspend(struct i2c_client *client,
+				 pm_message_t state)
+{
+	struct adp5520_chip *chip = dev_get_drvdata(&client->dev);
+
+	adp5520_clr_bits(chip->dev, ADP5520_MODE_STATUS, ADP5520_nSTNBY);
+	return 0;
+}
+
+static int adp5520_resume(struct i2c_client *client)
+{
+	struct adp5520_chip *chip = dev_get_drvdata(&client->dev);
+
+	adp5520_set_bits(chip->dev, ADP5520_MODE_STATUS, ADP5520_nSTNBY);
+	return 0;
+}
+#else
+#define adp5520_suspend	NULL
+#define adp5520_resume	NULL
+#endif
+
+static const struct i2c_device_id adp5520_id[] = {
+	{ "pmic-adp5520", ID_ADP5520 },
+	{ "pmic-adp5501", ID_ADP5501 },
+	{ }
+};
+MODULE_DEVICE_TABLE(i2c, adp5520_id);
+
+static struct i2c_driver adp5520_driver = {
+	.driver = {
+		.name	= "adp5520",
+		.owner	= THIS_MODULE,
+	},
+	.probe		= adp5520_probe,
+	.remove		= __devexit_p(adp5520_remove),
+	.suspend	= adp5520_suspend,
+	.resume		= adp5520_resume,
+	.id_table 	= adp5520_id,
+};
+
+static int __init adp5520_init(void)
+{
+	return i2c_add_driver(&adp5520_driver);
+}
+module_init(adp5520_init);
+
+static void __exit adp5520_exit(void)
+{
+	i2c_del_driver(&adp5520_driver);
+}
+module_exit(adp5520_exit);
+
+MODULE_AUTHOR("Michael Hennerich <hennerich@blackfin.uclinux.org>");
+MODULE_DESCRIPTION("ADP5520(01) PMIC-MFD Driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/mfd/asic3.c b/drivers/mfd/asic3.c
index 63a2a6632106..95c1e6bd1729 100644
--- a/drivers/mfd/asic3.c
+++ b/drivers/mfd/asic3.c
@@ -80,6 +80,7 @@ struct asic3 {
 	u16 irq_bothedge[4];
 	struct gpio_chip gpio;
 	struct device *dev;
+	void __iomem *tmio_cnf;
 
 	struct asic3_clk clocks[ARRAY_SIZE(asic3_clk_init)];
 };
@@ -685,8 +686,24 @@ static struct mfd_cell asic3_cell_ds1wm = {
 	.resources     = ds1wm_resources,
 };
 
+static void asic3_mmc_pwr(struct platform_device *pdev, int state)
+{
+	struct asic3 *asic = dev_get_drvdata(pdev->dev.parent);
+
+	tmio_core_mmc_pwr(asic->tmio_cnf, 1 - asic->bus_shift, state);
+}
+
+static void asic3_mmc_clk_div(struct platform_device *pdev, int state)
+{
+	struct asic3 *asic = dev_get_drvdata(pdev->dev.parent);
+
+	tmio_core_mmc_clk_div(asic->tmio_cnf, 1 - asic->bus_shift, state);
+}
+
 static struct tmio_mmc_data asic3_mmc_data = {
-	.hclk = 24576000,
+	.hclk           = 24576000,
+	.set_pwr        = asic3_mmc_pwr,
+	.set_clk_div    = asic3_mmc_clk_div,
 };
 
 static struct resource asic3_mmc_resources[] = {
@@ -696,11 +713,6 @@ static struct resource asic3_mmc_resources[] = {
 		.flags = IORESOURCE_MEM,
 	},
 	{
-		.start = ASIC3_SD_CONFIG_BASE,
-		.end   = ASIC3_SD_CONFIG_BASE + 0x1ff,
-		.flags = IORESOURCE_MEM,
-	},
-	{
 		.start = 0,
 		.end   = 0,
 		.flags = IORESOURCE_IRQ,
@@ -743,6 +755,10 @@ static int asic3_mmc_enable(struct platform_device *pdev)
 	asic3_set_register(asic, ASIC3_OFFSET(SDHWCTRL, SDCONF),
 			   ASIC3_SDHWCTRL_SDPWR, 1);
 
+	/* ASIC3_SD_CTRL_BASE assumes 32-bit addressing, TMIO is 16-bit */
+	tmio_core_mmc_enable(asic->tmio_cnf, 1 - asic->bus_shift,
+			     ASIC3_SD_CTRL_BASE >> 1);
+
 	return 0;
 }
 
@@ -797,10 +813,15 @@ static int __init asic3_mfd_probe(struct platform_device *pdev,
 	asic3_cell_ds1wm.data_size = sizeof(asic3_cell_ds1wm);
 
 	/* MMC */
+	asic->tmio_cnf = ioremap((ASIC3_SD_CONFIG_BASE >> asic->bus_shift) +
+				 mem_sdio->start, 0x400 >> asic->bus_shift);
+	if (!asic->tmio_cnf) {
+		ret = -ENOMEM;
+		dev_dbg(asic->dev, "Couldn't ioremap SD_CONFIG\n");
+		goto out;
+	}
 	asic3_mmc_resources[0].start >>= asic->bus_shift;
 	asic3_mmc_resources[0].end   >>= asic->bus_shift;
-	asic3_mmc_resources[1].start >>= asic->bus_shift;
-	asic3_mmc_resources[1].end   >>= asic->bus_shift;
 
 	asic3_cell_mmc.platform_data = &asic3_cell_mmc;
 	asic3_cell_mmc.data_size = sizeof(asic3_cell_mmc);
@@ -820,7 +841,10 @@ static int __init asic3_mfd_probe(struct platform_device *pdev,
 
 static void asic3_mfd_remove(struct platform_device *pdev)
 {
+	struct asic3 *asic = platform_get_drvdata(pdev);
+
 	mfd_remove_devices(&pdev->dev);
+	iounmap(asic->tmio_cnf);
 }
 
 /* Core */
@@ -908,7 +932,7 @@ static int __init asic3_probe(struct platform_device *pdev)
 	return ret;
 }
 
-static int asic3_remove(struct platform_device *pdev)
+static int __devexit asic3_remove(struct platform_device *pdev)
 {
 	int ret;
 	struct asic3 *asic = platform_get_drvdata(pdev);
diff --git a/drivers/mfd/ezx-pcap.c b/drivers/mfd/ezx-pcap.c
index 876288917976..df405af968fa 100644
--- a/drivers/mfd/ezx-pcap.c
+++ b/drivers/mfd/ezx-pcap.c
@@ -387,7 +387,6 @@ static int __devinit pcap_add_subdev(struct pcap_chip *pcap,
 	pdev = platform_device_alloc(subdev->name, subdev->id);
 	pdev->dev.parent = &pcap->spi->dev;
 	pdev->dev.platform_data = subdev->platform_data;
-	platform_set_drvdata(pdev, pcap);
 
 	return platform_device_add(pdev);
 }
diff --git a/drivers/mfd/mc13783-core.c b/drivers/mfd/mc13783-core.c
index e354d2912ef1..735c8a4d164f 100644
--- a/drivers/mfd/mc13783-core.c
+++ b/drivers/mfd/mc13783-core.c
@@ -1,286 +1,549 @@
 /*
- * Copyright 2009 Pengutronix, Sascha Hauer <s.hauer@pengutronix.de>
- *
- * This code is in parts based on wm8350-core.c and pcf50633-core.c
- *
- * Initial development of this code was funded by
- * Phytec Messtechnik GmbH, http://www.phytec.de
+ * Copyright 2009 Pengutronix
+ * Uwe Kleine-Koenig <u.kleine-koenig@pengutronix.de>
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
+ * loosely based on an earlier driver that has
+ * Copyright 2009 Pengutronix, Sascha Hauer <s.hauer@pengutronix.de>
  *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ * This program is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License version 2 as published by the
+ * Free Software Foundation.
  */
-
-#include <linux/mfd/mc13783-private.h>
-#include <linux/platform_device.h>
-#include <linux/mfd/mc13783.h>
-#include <linux/completion.h>
-#include <linux/interrupt.h>
-#include <linux/mfd/core.h>
-#include <linux/spi/spi.h>
-#include <linux/uaccess.h>
-#include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/init.h>
-#include <linux/slab.h>
-#include <linux/irq.h>
+#include <linux/spi/spi.h>
+#include <linux/mfd/core.h>
+#include <linux/mfd/mc13783-private.h>
+
+#define MC13783_IRQSTAT0	0
+#define MC13783_IRQSTAT0_ADCDONEI	(1 << 0)
+#define MC13783_IRQSTAT0_ADCBISDONEI	(1 << 1)
+#define MC13783_IRQSTAT0_TSI		(1 << 2)
+#define MC13783_IRQSTAT0_WHIGHI		(1 << 3)
+#define MC13783_IRQSTAT0_WLOWI		(1 << 4)
+#define MC13783_IRQSTAT0_CHGDETI	(1 << 6)
+#define MC13783_IRQSTAT0_CHGOVI		(1 << 7)
+#define MC13783_IRQSTAT0_CHGREVI	(1 << 8)
+#define MC13783_IRQSTAT0_CHGSHORTI	(1 << 9)
+#define MC13783_IRQSTAT0_CCCVI		(1 << 10)
+#define MC13783_IRQSTAT0_CHGCURRI	(1 << 11)
+#define MC13783_IRQSTAT0_BPONI		(1 << 12)
+#define MC13783_IRQSTAT0_LOBATLI	(1 << 13)
+#define MC13783_IRQSTAT0_LOBATHI	(1 << 14)
+#define MC13783_IRQSTAT0_UDPI		(1 << 15)
+#define MC13783_IRQSTAT0_USBI		(1 << 16)
+#define MC13783_IRQSTAT0_IDI		(1 << 19)
+#define MC13783_IRQSTAT0_SE1I		(1 << 21)
+#define MC13783_IRQSTAT0_CKDETI		(1 << 22)
+#define MC13783_IRQSTAT0_UDMI		(1 << 23)
+
+#define MC13783_IRQMASK0	1
+#define MC13783_IRQMASK0_ADCDONEM	MC13783_IRQSTAT0_ADCDONEI
+#define MC13783_IRQMASK0_ADCBISDONEM	MC13783_IRQSTAT0_ADCBISDONEI
+#define MC13783_IRQMASK0_TSM		MC13783_IRQSTAT0_TSI
+#define MC13783_IRQMASK0_WHIGHM		MC13783_IRQSTAT0_WHIGHI
+#define MC13783_IRQMASK0_WLOWM		MC13783_IRQSTAT0_WLOWI
+#define MC13783_IRQMASK0_CHGDETM	MC13783_IRQSTAT0_CHGDETI
+#define MC13783_IRQMASK0_CHGOVM		MC13783_IRQSTAT0_CHGOVI
+#define MC13783_IRQMASK0_CHGREVM	MC13783_IRQSTAT0_CHGREVI
+#define MC13783_IRQMASK0_CHGSHORTM	MC13783_IRQSTAT0_CHGSHORTI
+#define MC13783_IRQMASK0_CCCVM		MC13783_IRQSTAT0_CCCVI
+#define MC13783_IRQMASK0_CHGCURRM	MC13783_IRQSTAT0_CHGCURRI
+#define MC13783_IRQMASK0_BPONM		MC13783_IRQSTAT0_BPONI
+#define MC13783_IRQMASK0_LOBATLM	MC13783_IRQSTAT0_LOBATLI
+#define MC13783_IRQMASK0_LOBATHM	MC13783_IRQSTAT0_LOBATHI
+#define MC13783_IRQMASK0_UDPM		MC13783_IRQSTAT0_UDPI
+#define MC13783_IRQMASK0_USBM		MC13783_IRQSTAT0_USBI
+#define MC13783_IRQMASK0_IDM		MC13783_IRQSTAT0_IDI
+#define MC13783_IRQMASK0_SE1M		MC13783_IRQSTAT0_SE1I
+#define MC13783_IRQMASK0_CKDETM		MC13783_IRQSTAT0_CKDETI
+#define MC13783_IRQMASK0_UDMM		MC13783_IRQSTAT0_UDMI
+
+#define MC13783_IRQSTAT1	3
+#define MC13783_IRQSTAT1_1HZI		(1 << 0)
+#define MC13783_IRQSTAT1_TODAI		(1 << 1)
+#define MC13783_IRQSTAT1_ONOFD1I	(1 << 3)
+#define MC13783_IRQSTAT1_ONOFD2I	(1 << 4)
+#define MC13783_IRQSTAT1_ONOFD3I	(1 << 5)
+#define MC13783_IRQSTAT1_SYSRSTI	(1 << 6)
+#define MC13783_IRQSTAT1_RTCRSTI	(1 << 7)
+#define MC13783_IRQSTAT1_PCI		(1 << 8)
+#define MC13783_IRQSTAT1_WARMI		(1 << 9)
+#define MC13783_IRQSTAT1_MEMHLDI	(1 << 10)
+#define MC13783_IRQSTAT1_PWRRDYI	(1 << 11)
+#define MC13783_IRQSTAT1_THWARNLI	(1 << 12)
+#define MC13783_IRQSTAT1_THWARNHI	(1 << 13)
+#define MC13783_IRQSTAT1_CLKI		(1 << 14)
+#define MC13783_IRQSTAT1_SEMAFI		(1 << 15)
+#define MC13783_IRQSTAT1_MC2BI		(1 << 17)
+#define MC13783_IRQSTAT1_HSDETI		(1 << 18)
+#define MC13783_IRQSTAT1_HSLI		(1 << 19)
+#define MC13783_IRQSTAT1_ALSPTHI	(1 << 20)
+#define MC13783_IRQSTAT1_AHSSHORTI	(1 << 21)
+
+#define MC13783_IRQMASK1	4
+#define MC13783_IRQMASK1_1HZM		MC13783_IRQSTAT1_1HZI
+#define MC13783_IRQMASK1_TODAM		MC13783_IRQSTAT1_TODAI
+#define MC13783_IRQMASK1_ONOFD1M	MC13783_IRQSTAT1_ONOFD1I
+#define MC13783_IRQMASK1_ONOFD2M	MC13783_IRQSTAT1_ONOFD2I
+#define MC13783_IRQMASK1_ONOFD3M	MC13783_IRQSTAT1_ONOFD3I
+#define MC13783_IRQMASK1_SYSRSTM	MC13783_IRQSTAT1_SYSRSTI
+#define MC13783_IRQMASK1_RTCRSTM	MC13783_IRQSTAT1_RTCRSTI
+#define MC13783_IRQMASK1_PCM		MC13783_IRQSTAT1_PCI
+#define MC13783_IRQMASK1_WARMM		MC13783_IRQSTAT1_WARMI
+#define MC13783_IRQMASK1_MEMHLDM	MC13783_IRQSTAT1_MEMHLDI
+#define MC13783_IRQMASK1_PWRRDYM	MC13783_IRQSTAT1_PWRRDYI
+#define MC13783_IRQMASK1_THWARNLM	MC13783_IRQSTAT1_THWARNLI
+#define MC13783_IRQMASK1_THWARNHM	MC13783_IRQSTAT1_THWARNHI
+#define MC13783_IRQMASK1_CLKM		MC13783_IRQSTAT1_CLKI
+#define MC13783_IRQMASK1_SEMAFM		MC13783_IRQSTAT1_SEMAFI
+#define MC13783_IRQMASK1_MC2BM		MC13783_IRQSTAT1_MC2BI
+#define MC13783_IRQMASK1_HSDETM		MC13783_IRQSTAT1_HSDETI
+#define MC13783_IRQMASK1_HSLM		MC13783_IRQSTAT1_HSLI
+#define MC13783_IRQMASK1_ALSPTHM	MC13783_IRQSTAT1_ALSPTHI
+#define MC13783_IRQMASK1_AHSSHORTM	MC13783_IRQSTAT1_AHSSHORTI
+
+#define MC13783_ADC1		44
+#define MC13783_ADC1_ADEN		(1 << 0)
+#define MC13783_ADC1_RAND		(1 << 1)
+#define MC13783_ADC1_ADSEL		(1 << 3)
+#define MC13783_ADC1_ASC		(1 << 20)
+#define MC13783_ADC1_ADTRIGIGN		(1 << 21)
+
+#define MC13783_NUMREGS 0x3f
+
+void mc13783_lock(struct mc13783 *mc13783)
+{
+	if (!mutex_trylock(&mc13783->lock)) {
+		dev_dbg(&mc13783->spidev->dev, "wait for %s from %pf\n",
+				__func__, __builtin_return_address(0));
+
+		mutex_lock(&mc13783->lock);
+	}
+	dev_dbg(&mc13783->spidev->dev, "%s from %pf\n",
+			__func__, __builtin_return_address(0));
+}
+EXPORT_SYMBOL(mc13783_lock);
 
-#define MC13783_MAX_REG_NUM	0x3f
-#define MC13783_FRAME_MASK	0x00ffffff
-#define MC13783_MAX_REG_NUM	0x3f
-#define MC13783_REG_NUM_SHIFT	0x19
-#define MC13783_WRITE_BIT_SHIFT	31
+void mc13783_unlock(struct mc13783 *mc13783)
+{
+	dev_dbg(&mc13783->spidev->dev, "%s from %pf\n",
+			__func__, __builtin_return_address(0));
+	mutex_unlock(&mc13783->lock);
+}
+EXPORT_SYMBOL(mc13783_unlock);
 
-static inline int spi_rw(struct spi_device *spi, u8 * buf, size_t len)
+#define MC13783_REGOFFSET_SHIFT 25
+int mc13783_reg_read(struct mc13783 *mc13783, unsigned int offset, u32 *val)
 {
-	struct spi_transfer t = {
-		.tx_buf = (const void *)buf,
-		.rx_buf = buf,
-		.len = len,
-		.cs_change = 0,
-		.delay_usecs = 0,
-	};
+	struct spi_transfer t;
 	struct spi_message m;
+	int ret;
+
+	BUG_ON(!mutex_is_locked(&mc13783->lock));
+
+	if (offset > MC13783_NUMREGS)
+		return -EINVAL;
+
+	*val = offset << MC13783_REGOFFSET_SHIFT;
+
+	memset(&t, 0, sizeof(t));
+
+	t.tx_buf = val;
+	t.rx_buf = val;
+	t.len = sizeof(u32);
 
 	spi_message_init(&m);
 	spi_message_add_tail(&t, &m);
-	if (spi_sync(spi, &m) != 0 || m.status != 0)
-		return -EINVAL;
-	return len - m.actual_length;
-}
 
-static int mc13783_read(struct mc13783 *mc13783, int reg_num, u32 *reg_val)
-{
-	unsigned int frame = 0;
-	int ret = 0;
+	ret = spi_sync(mc13783->spidev, &m);
 
-	if (reg_num > MC13783_MAX_REG_NUM)
-		return -EINVAL;
+	/* error in message.status implies error return from spi_sync */
+	BUG_ON(!ret && m.status);
 
-	frame |= reg_num << MC13783_REG_NUM_SHIFT;
+	if (ret)
+		return ret;
 
-	ret = spi_rw(mc13783->spi_device, (u8 *)&frame, 4);
+	*val &= 0xffffff;
 
-	*reg_val = frame & MC13783_FRAME_MASK;
+	dev_vdbg(&mc13783->spidev->dev, "[0x%02x] -> 0x%06x\n", offset, *val);
 
-	return ret;
+	return 0;
 }
+EXPORT_SYMBOL(mc13783_reg_read);
 
-static int mc13783_write(struct mc13783 *mc13783, int reg_num, u32 reg_val)
+int mc13783_reg_write(struct mc13783 *mc13783, unsigned int offset, u32 val)
 {
-	unsigned int frame = 0;
+	u32 buf;
+	struct spi_transfer t;
+	struct spi_message m;
+	int ret;
+
+	BUG_ON(!mutex_is_locked(&mc13783->lock));
 
-	if (reg_num > MC13783_MAX_REG_NUM)
+	dev_vdbg(&mc13783->spidev->dev, "[0x%02x] <- 0x%06x\n", offset, val);
+
+	if (offset > MC13783_NUMREGS || val > 0xffffff)
 		return -EINVAL;
 
-	frame |= (1 << MC13783_WRITE_BIT_SHIFT);
-	frame |= reg_num << MC13783_REG_NUM_SHIFT;
-	frame |= reg_val & MC13783_FRAME_MASK;
+	buf = 1 << 31 | offset << MC13783_REGOFFSET_SHIFT | val;
+
+	memset(&t, 0, sizeof(t));
 
-	return spi_rw(mc13783->spi_device, (u8 *)&frame, 4);
+	t.tx_buf = &buf;
+	t.rx_buf = &buf;
+	t.len = sizeof(u32);
+
+	spi_message_init(&m);
+	spi_message_add_tail(&t, &m);
+
+	ret = spi_sync(mc13783->spidev, &m);
+
+	BUG_ON(!ret && m.status);
+
+	if (ret)
+		return ret;
+
+	return 0;
 }
+EXPORT_SYMBOL(mc13783_reg_write);
 
-int mc13783_reg_read(struct mc13783 *mc13783, int reg_num, u32 *reg_val)
+int mc13783_reg_rmw(struct mc13783 *mc13783, unsigned int offset,
+		u32 mask, u32 val)
 {
 	int ret;
+	u32 valread;
 
-	mutex_lock(&mc13783->io_lock);
-	ret = mc13783_read(mc13783, reg_num, reg_val);
-	mutex_unlock(&mc13783->io_lock);
+	BUG_ON(val & ~mask);
 
-	return ret;
+	ret = mc13783_reg_read(mc13783, offset, &valread);
+	if (ret)
+		return ret;
+
+	valread = (valread & ~mask) | val;
+
+	return mc13783_reg_write(mc13783, offset, valread);
 }
-EXPORT_SYMBOL_GPL(mc13783_reg_read);
+EXPORT_SYMBOL(mc13783_reg_rmw);
 
-int mc13783_reg_write(struct mc13783 *mc13783, int reg_num, u32 reg_val)
+int mc13783_mask(struct mc13783 *mc13783, int irq)
 {
 	int ret;
+	unsigned int offmask = irq < 24 ? MC13783_IRQMASK0 : MC13783_IRQMASK1;
+	u32 irqbit = 1 << (irq < 24 ? irq : irq - 24);
+	u32 mask;
 
-	mutex_lock(&mc13783->io_lock);
-	ret = mc13783_write(mc13783, reg_num, reg_val);
-	mutex_unlock(&mc13783->io_lock);
+	if (irq < 0 || irq >= MC13783_NUM_IRQ)
+		return -EINVAL;
 
-	return ret;
+	ret = mc13783_reg_read(mc13783, offmask, &mask);
+	if (ret)
+		return ret;
+
+	if (mask & irqbit)
+		/* already masked */
+		return 0;
+
+	return mc13783_reg_write(mc13783, offmask, mask | irqbit);
 }
-EXPORT_SYMBOL_GPL(mc13783_reg_write);
+EXPORT_SYMBOL(mc13783_mask);
 
-/**
- * mc13783_set_bits - Bitmask write
- *
- * @mc13783: Pointer to mc13783 control structure
- * @reg:    Register to access
- * @mask:   Mask of bits to change
- * @val:    Value to set for masked bits
- */
-int mc13783_set_bits(struct mc13783 *mc13783, int reg, u32 mask, u32 val)
+int mc13783_unmask(struct mc13783 *mc13783, int irq)
 {
-	u32 tmp;
 	int ret;
+	unsigned int offmask = irq < 24 ? MC13783_IRQMASK0 : MC13783_IRQMASK1;
+	u32 irqbit = 1 << (irq < 24 ? irq : irq - 24);
+	u32 mask;
 
-	mutex_lock(&mc13783->io_lock);
+	if (irq < 0 || irq >= MC13783_NUM_IRQ)
+		return -EINVAL;
 
-	ret = mc13783_read(mc13783, reg, &tmp);
-	tmp = (tmp & ~mask) | val;
-	if (ret == 0)
-		ret = mc13783_write(mc13783, reg, tmp);
+	ret = mc13783_reg_read(mc13783, offmask, &mask);
+	if (ret)
+		return ret;
 
-	mutex_unlock(&mc13783->io_lock);
+	if (!(mask & irqbit))
+		/* already unmasked */
+		return 0;
 
-	return ret;
+	return mc13783_reg_write(mc13783, offmask, mask & ~irqbit);
 }
-EXPORT_SYMBOL_GPL(mc13783_set_bits);
+EXPORT_SYMBOL(mc13783_unmask);
 
-int mc13783_register_irq(struct mc13783 *mc13783, int irq,
-		void (*handler) (int, void *), void *data)
+int mc13783_irq_request_nounmask(struct mc13783 *mc13783, int irq,
+		irq_handler_t handler, const char *name, void *dev)
 {
-	if (irq < 0 || irq > MC13783_NUM_IRQ || !handler)
+	BUG_ON(!mutex_is_locked(&mc13783->lock));
+	BUG_ON(!handler);
+
+	if (irq < 0 || irq >= MC13783_NUM_IRQ)
 		return -EINVAL;
 
-	if (WARN_ON(mc13783->irq_handler[irq].handler))
+	if (mc13783->irqhandler[irq])
 		return -EBUSY;
 
-	mutex_lock(&mc13783->io_lock);
-	mc13783->irq_handler[irq].handler = handler;
-	mc13783->irq_handler[irq].data = data;
-	mutex_unlock(&mc13783->io_lock);
+	mc13783->irqhandler[irq] = handler;
+	mc13783->irqdata[irq] = dev;
 
 	return 0;
 }
-EXPORT_SYMBOL_GPL(mc13783_register_irq);
+EXPORT_SYMBOL(mc13783_irq_request_nounmask);
 
-int mc13783_free_irq(struct mc13783 *mc13783, int irq)
+int mc13783_irq_request(struct mc13783 *mc13783, int irq,
+		irq_handler_t handler, const char *name, void *dev)
 {
-	if (irq < 0 || irq > MC13783_NUM_IRQ)
+	int ret;
+
+	ret = mc13783_irq_request_nounmask(mc13783, irq, handler, name, dev);
+	if (ret)
+		return ret;
+
+	ret = mc13783_unmask(mc13783, irq);
+	if (ret) {
+		mc13783->irqhandler[irq] = NULL;
+		mc13783->irqdata[irq] = NULL;
+		return ret;
+	}
+
+	return 0;
+}
+EXPORT_SYMBOL(mc13783_irq_request);
+
+int mc13783_irq_free(struct mc13783 *mc13783, int irq, void *dev)
+{
+	int ret;
+	BUG_ON(!mutex_is_locked(&mc13783->lock));
+
+	if (irq < 0 || irq >= MC13783_NUM_IRQ || !mc13783->irqhandler[irq] ||
+			mc13783->irqdata[irq] != dev)
 		return -EINVAL;
 
-	mutex_lock(&mc13783->io_lock);
-	mc13783->irq_handler[irq].handler = NULL;
-	mutex_unlock(&mc13783->io_lock);
+	ret = mc13783_mask(mc13783, irq);
+	if (ret)
+		return ret;
+
+	mc13783->irqhandler[irq] = NULL;
+	mc13783->irqdata[irq] = NULL;
 
 	return 0;
 }
-EXPORT_SYMBOL_GPL(mc13783_free_irq);
+EXPORT_SYMBOL(mc13783_irq_free);
 
-static void mc13783_irq_work(struct work_struct *work)
+static inline irqreturn_t mc13783_irqhandler(struct mc13783 *mc13783, int irq)
 {
-	struct mc13783 *mc13783 = container_of(work, struct mc13783, work);
-	int i;
-	unsigned int adc_sts;
-
-	/* check if the adc has finished any completion */
-	mc13783_reg_read(mc13783, MC13783_REG_INTERRUPT_STATUS_0, &adc_sts);
-	mc13783_reg_write(mc13783, MC13783_REG_INTERRUPT_STATUS_0,
-			adc_sts & MC13783_INT_STAT_ADCDONEI);
-
-	if (adc_sts & MC13783_INT_STAT_ADCDONEI)
-		complete_all(&mc13783->adc_done);
-
-	for (i = 0; i < MC13783_NUM_IRQ; i++)
-		if (mc13783->irq_handler[i].handler)
-			mc13783->irq_handler[i].handler(i,
-					mc13783->irq_handler[i].data);
-	enable_irq(mc13783->irq);
+	return mc13783->irqhandler[irq](irq, mc13783->irqdata[irq]);
 }
 
-static irqreturn_t mc13783_interrupt(int irq, void *dev_id)
+int mc13783_ackirq(struct mc13783 *mc13783, int irq)
 {
-	struct mc13783 *mc13783 = dev_id;
+	unsigned int offstat = irq < 24 ? MC13783_IRQSTAT0 : MC13783_IRQSTAT1;
+	unsigned int val = 1 << (irq < 24 ? irq : irq - 24);
 
-	disable_irq_nosync(irq);
+	BUG_ON(irq < 0 || irq >= MC13783_NUM_IRQ);
 
-	schedule_work(&mc13783->work);
-	return IRQ_HANDLED;
+	return mc13783_reg_write(mc13783, offstat, val);
 }
+EXPORT_SYMBOL(mc13783_ackirq);
 
-/* set adc to ts interrupt mode, which generates touchscreen wakeup interrupt */
-static inline void mc13783_adc_set_ts_irq_mode(struct mc13783 *mc13783)
+/*
+ * returns: number of handled irqs or negative error
+ * locking: holds mc13783->lock
+ */
+static int mc13783_irq_handle(struct mc13783 *mc13783,
+		unsigned int offstat, unsigned int offmask, int baseirq)
+{
+	u32 stat, mask;
+	int ret = mc13783_reg_read(mc13783, offstat, &stat);
+	int num_handled = 0;
+
+	if (ret)
+		return ret;
+
+	ret = mc13783_reg_read(mc13783, offmask, &mask);
+	if (ret)
+		return ret;
+
+	while (stat & ~mask) {
+		int irq = __ffs(stat & ~mask);
+
+		stat &= ~(1 << irq);
+
+		if (likely(mc13783->irqhandler[baseirq + irq])) {
+			irqreturn_t handled;
+
+			handled = mc13783_irqhandler(mc13783, baseirq + irq);
+			if (handled == IRQ_HANDLED)
+				num_handled++;
+		} else {
+			dev_err(&mc13783->spidev->dev,
+					"BUG: irq %u but no handler\n",
+					baseirq + irq);
+
+			mask |= 1 << irq;
+
+			ret = mc13783_reg_write(mc13783, offmask, mask);
+		}
+	}
+
+	return num_handled;
+}
+
+static irqreturn_t mc13783_irq_thread(int irq, void *data)
 {
-	unsigned int reg_adc0, reg_adc1;
+	struct mc13783 *mc13783 = data;
+	irqreturn_t ret;
+	int handled = 0;
+
+	mc13783_lock(mc13783);
+
+	ret = mc13783_irq_handle(mc13783, MC13783_IRQSTAT0,
+			MC13783_IRQMASK0, MC13783_IRQ_ADCDONE);
+	if (ret > 0)
+		handled = 1;
+
+	ret = mc13783_irq_handle(mc13783, MC13783_IRQSTAT1,
+			MC13783_IRQMASK1, MC13783_IRQ_1HZ);
+	if (ret > 0)
+		handled = 1;
 
-	reg_adc0 = MC13783_ADC0_ADREFEN | MC13783_ADC0_ADREFMODE
-			| MC13783_ADC0_TSMOD0;
-	reg_adc1 = MC13783_ADC1_ADEN | MC13783_ADC1_ADTRIGIGN;
+	mc13783_unlock(mc13783);
 
-	mc13783_reg_write(mc13783, MC13783_REG_ADC_0, reg_adc0);
-	mc13783_reg_write(mc13783, MC13783_REG_ADC_1, reg_adc1);
+	return IRQ_RETVAL(handled);
 }
 
+#define MC13783_ADC1_CHAN0_SHIFT	5
+#define MC13783_ADC1_CHAN1_SHIFT	8
+
+struct mc13783_adcdone_data {
+	struct mc13783 *mc13783;
+	struct completion done;
+};
+
+static irqreturn_t mc13783_handler_adcdone(int irq, void *data)
+{
+	struct mc13783_adcdone_data *adcdone_data = data;
+
+	mc13783_ackirq(adcdone_data->mc13783, irq);
+
+	complete_all(&adcdone_data->done);
+
+	return IRQ_HANDLED;
+}
+
+#define MC13783_ADC_WORKING (1 << 16)
+
 int mc13783_adc_do_conversion(struct mc13783 *mc13783, unsigned int mode,
 		unsigned int channel, unsigned int *sample)
 {
-	unsigned int reg_adc0, reg_adc1;
-	int i;
+	u32 adc0, adc1, old_adc0;
+	int i, ret;
+	struct mc13783_adcdone_data adcdone_data = {
+		.mc13783 = mc13783,
+	};
+	init_completion(&adcdone_data.done);
 
-	mutex_lock(&mc13783->adc_conv_lock);
+	dev_dbg(&mc13783->spidev->dev, "%s\n", __func__);
 
-	/* set up auto incrementing anyway to make quick read */
-	reg_adc0 =  MC13783_ADC0_ADINC1 | MC13783_ADC0_ADINC2;
-	/* enable the adc, ignore external triggering and set ASC to trigger
-	 * conversion */
-	reg_adc1 =  MC13783_ADC1_ADEN | MC13783_ADC1_ADTRIGIGN
-		| MC13783_ADC1_ASC;
+	mc13783_lock(mc13783);
+
+	if (mc13783->flags & MC13783_ADC_WORKING) {
+		ret = -EBUSY;
+		goto out;
+	}
+
+	mc13783->flags |= MC13783_ADC_WORKING;
+
+	mc13783_reg_read(mc13783, MC13783_ADC0, &old_adc0);
+
+	adc0 = MC13783_ADC0_ADINC1 | MC13783_ADC0_ADINC2;
+	adc1 = MC13783_ADC1_ADEN | MC13783_ADC1_ADTRIGIGN | MC13783_ADC1_ASC;
 
-	/* setup channel number */
 	if (channel > 7)
-		reg_adc1 |= MC13783_ADC1_ADSEL;
+		adc1 |= MC13783_ADC1_ADSEL;
 
 	switch (mode) {
 	case MC13783_ADC_MODE_TS:
-		/* enables touch screen reference mode and set touchscreen mode
-		 * to position mode */
-		reg_adc0 |= MC13783_ADC0_ADREFEN | MC13783_ADC0_ADREFMODE
-			| MC13783_ADC0_TSMOD0 | MC13783_ADC0_TSMOD1;
-		reg_adc1 |= 4 << MC13783_ADC1_CHAN1_SHIFT;
+		adc0 |= MC13783_ADC0_ADREFEN | MC13783_ADC0_TSMOD0 |
+			MC13783_ADC0_TSMOD1;
+		adc1 |= 4 << MC13783_ADC1_CHAN1_SHIFT;
 		break;
+
 	case MC13783_ADC_MODE_SINGLE_CHAN:
-		reg_adc1 |= (channel & 0x7) << MC13783_ADC1_CHAN0_SHIFT;
-		reg_adc1 |= MC13783_ADC1_RAND;
+		adc0 |= old_adc0 & MC13783_ADC0_TSMOD_MASK;
+		adc1 |= (channel & 0x7) << MC13783_ADC1_CHAN0_SHIFT;
+		adc1 |= MC13783_ADC1_RAND;
 		break;
+
 	case MC13783_ADC_MODE_MULT_CHAN:
-		reg_adc1 |= 4 << MC13783_ADC1_CHAN1_SHIFT;
+		adc0 |= old_adc0 & MC13783_ADC0_TSMOD_MASK;
+		adc1 |= 4 << MC13783_ADC1_CHAN1_SHIFT;
 		break;
+
 	default:
+		mc13783_unlock(mc13783);
 		return -EINVAL;
 	}
 
-	mc13783_reg_write(mc13783, MC13783_REG_ADC_0, reg_adc0);
-	mc13783_reg_write(mc13783, MC13783_REG_ADC_1, reg_adc1);
+	dev_dbg(&mc13783->spidev->dev, "%s: request irq\n", __func__);
+	mc13783_irq_request(mc13783, MC13783_IRQ_ADCDONE,
+			mc13783_handler_adcdone, __func__, &adcdone_data);
+	mc13783_ackirq(mc13783, MC13783_IRQ_ADCDONE);
 
-	wait_for_completion_interruptible(&mc13783->adc_done);
+	mc13783_reg_write(mc13783, MC13783_REG_ADC_0, adc0);
+	mc13783_reg_write(mc13783, MC13783_REG_ADC_1, adc1);
 
-	for (i = 0; i < 4; i++)
-		mc13783_reg_read(mc13783, MC13783_REG_ADC_2, &sample[i]);
+	mc13783_unlock(mc13783);
 
-	if (mc13783->ts_active)
-		mc13783_adc_set_ts_irq_mode(mc13783);
+	ret = wait_for_completion_interruptible_timeout(&adcdone_data.done, HZ);
 
-	mutex_unlock(&mc13783->adc_conv_lock);
+	if (!ret)
+		ret = -ETIMEDOUT;
 
-	return 0;
+	mc13783_lock(mc13783);
+
+	mc13783_irq_free(mc13783, MC13783_IRQ_ADCDONE, &adcdone_data);
+
+	if (ret > 0)
+		for (i = 0; i < 4; ++i) {
+			ret = mc13783_reg_read(mc13783,
+					MC13783_REG_ADC_2, &sample[i]);
+			if (ret)
+				break;
+		}
+
+	if (mode == MC13783_ADC_MODE_TS)
+		/* restore TSMOD */
+		mc13783_reg_write(mc13783, MC13783_REG_ADC_0, old_adc0);
+
+	mc13783->flags &= ~MC13783_ADC_WORKING;
+out:
+	mc13783_unlock(mc13783);
+
+	return ret;
 }
 EXPORT_SYMBOL_GPL(mc13783_adc_do_conversion);
 
-void mc13783_adc_set_ts_status(struct mc13783 *mc13783, unsigned int status)
+static int mc13783_add_subdevice_pdata(struct mc13783 *mc13783,
+		const char *name, void *pdata, size_t pdata_size)
+{
+	struct mfd_cell cell = {
+		.name = name,
+		.platform_data = pdata,
+		.data_size = pdata_size,
+	};
+
+	return mfd_add_devices(&mc13783->spidev->dev, -1, &cell, 1, NULL, 0);
+}
+
+static int mc13783_add_subdevice(struct mc13783 *mc13783, const char *name)
 {
-	mc13783->ts_active = status;
+	return mc13783_add_subdevice_pdata(mc13783, name, NULL, 0);
 }
-EXPORT_SYMBOL_GPL(mc13783_adc_set_ts_status);
 
 static int mc13783_check_revision(struct mc13783 *mc13783)
 {
 	u32 rev_id, rev1, rev2, finid, icid;
 
-	mc13783_read(mc13783, MC13783_REG_REVISION, &rev_id);
+	mc13783_reg_read(mc13783, MC13783_REG_REVISION, &rev_id);
 
 	rev1 = (rev_id & 0x018) >> 3;
 	rev2 = (rev_id & 0x007);
@@ -292,38 +555,24 @@ static int mc13783_check_revision(struct mc13783 *mc13783)
 		rev1 = 3;
 
 	if (rev1 == 0 || icid != 2) {
-		dev_err(mc13783->dev, "No MC13783 detected.\n");
+		dev_err(&mc13783->spidev->dev, "No MC13783 detected.\n");
 		return -ENODEV;
 	}
 
-	mc13783->revision = ((rev1 * 10) + rev2);
-	dev_info(mc13783->dev, "MC13783 Rev %d.%d FinVer %x detected\n", rev1,
-	       rev2, finid);
+	dev_info(&mc13783->spidev->dev,
+			"MC13783 Rev %d.%d FinVer %x detected\n",
+			rev1, rev2, finid);
 
 	return 0;
 }
 
-/*
- * Register a client device.  This is non-fatal since there is no need to
- * fail the entire device init due to a single platform device failing.
- */
-static void mc13783_client_dev_register(struct mc13783 *mc13783,
-				       const char *name)
-{
-	struct mfd_cell cell = {};
-
-	cell.name = name;
-
-	mfd_add_devices(mc13783->dev, -1, &cell, 1, NULL, 0);
-}
-
-static int __devinit mc13783_probe(struct spi_device *spi)
+static int mc13783_probe(struct spi_device *spi)
 {
 	struct mc13783 *mc13783;
-	struct mc13783_platform_data *pdata = spi->dev.platform_data;
+	struct mc13783_platform_data *pdata = dev_get_platdata(&spi->dev);
 	int ret;
 
-	mc13783 = kzalloc(sizeof(struct mc13783), GFP_KERNEL);
+	mc13783 = kzalloc(sizeof(*mc13783), GFP_KERNEL);
 	if (!mc13783)
 		return -ENOMEM;
 
@@ -332,96 +581,104 @@ static int __devinit mc13783_probe(struct spi_device *spi)
 	spi->bits_per_word = 32;
 	spi_setup(spi);
 
-	mc13783->spi_device = spi;
-	mc13783->dev = &spi->dev;
-	mc13783->irq = spi->irq;
+	mc13783->spidev = spi;
+
+	mutex_init(&mc13783->lock);
+	mc13783_lock(mc13783);
+
+	ret = mc13783_check_revision(mc13783);
+	if (ret)
+		goto err_revision;
+
+	/* mask all irqs */
+	ret = mc13783_reg_write(mc13783, MC13783_IRQMASK0, 0x00ffffff);
+	if (ret)
+		goto err_mask;
 
-	INIT_WORK(&mc13783->work, mc13783_irq_work);
-	mutex_init(&mc13783->io_lock);
-	mutex_init(&mc13783->adc_conv_lock);
-	init_completion(&mc13783->adc_done);
+	ret = mc13783_reg_write(mc13783, MC13783_IRQMASK1, 0x00ffffff);
+	if (ret)
+		goto err_mask;
+
+	ret = request_threaded_irq(spi->irq, NULL, mc13783_irq_thread,
+			IRQF_ONESHOT | IRQF_TRIGGER_HIGH, "mc13783", mc13783);
+
+	if (ret) {
+err_mask:
+err_revision:
+		mutex_unlock(&mc13783->lock);
+		dev_set_drvdata(&spi->dev, NULL);
+		kfree(mc13783);
+		return ret;
+	}
 
+	/* This should go away (BEGIN) */
 	if (pdata) {
 		mc13783->flags = pdata->flags;
 		mc13783->regulators = pdata->regulators;
 		mc13783->num_regulators = pdata->num_regulators;
 	}
+	/* This should go away (END) */
 
-	if (mc13783_check_revision(mc13783)) {
-		ret = -ENODEV;
-		goto err_out;
-	}
+	mc13783_unlock(mc13783);
 
-	/* clear and mask all interrupts */
-	mc13783_reg_write(mc13783, MC13783_REG_INTERRUPT_STATUS_0, 0x00ffffff);
-	mc13783_reg_write(mc13783, MC13783_REG_INTERRUPT_MASK_0, 0x00ffffff);
-	mc13783_reg_write(mc13783, MC13783_REG_INTERRUPT_STATUS_1, 0x00ffffff);
-	mc13783_reg_write(mc13783, MC13783_REG_INTERRUPT_MASK_1, 0x00ffffff);
+	if (pdata->flags & MC13783_USE_ADC)
+		mc13783_add_subdevice(mc13783, "mc13783-adc");
 
-	/* unmask adcdone interrupts */
-	mc13783_set_bits(mc13783, MC13783_REG_INTERRUPT_MASK_0,
-			MC13783_INT_MASK_ADCDONEM, 0);
+	if (pdata->flags & MC13783_USE_CODEC)
+		mc13783_add_subdevice(mc13783, "mc13783-codec");
 
-	ret = request_irq(mc13783->irq, mc13783_interrupt,
-			IRQF_DISABLED | IRQF_TRIGGER_HIGH, "mc13783",
-			mc13783);
-	if (ret)
-		goto err_out;
-
-	if (mc13783->flags & MC13783_USE_CODEC)
-		mc13783_client_dev_register(mc13783, "mc13783-codec");
-	if (mc13783->flags & MC13783_USE_ADC)
-		mc13783_client_dev_register(mc13783, "mc13783-adc");
-	if (mc13783->flags & MC13783_USE_RTC)
-		mc13783_client_dev_register(mc13783, "mc13783-rtc");
-	if (mc13783->flags & MC13783_USE_REGULATOR)
-		mc13783_client_dev_register(mc13783, "mc13783-regulator");
-	if (mc13783->flags & MC13783_USE_TOUCHSCREEN)
-		mc13783_client_dev_register(mc13783, "mc13783-ts");
+	if (pdata->flags & MC13783_USE_REGULATOR) {
+		struct mc13783_regulator_platform_data regulator_pdata = {
+			.num_regulators = pdata->num_regulators,
+			.regulators = pdata->regulators,
+		};
 
-	return 0;
+		mc13783_add_subdevice_pdata(mc13783, "mc13783-regulator",
+				&regulator_pdata, sizeof(regulator_pdata));
+	}
 
-err_out:
-	kfree(mc13783);
-	return ret;
+	if (pdata->flags & MC13783_USE_RTC)
+		mc13783_add_subdevice(mc13783, "mc13783-rtc");
+
+	if (pdata->flags & MC13783_USE_TOUCHSCREEN)
+		mc13783_add_subdevice(mc13783, "mc13783-ts");
+
+	return 0;
 }
 
 static int __devexit mc13783_remove(struct spi_device *spi)
 {
-	struct mc13783 *mc13783;
+	struct mc13783 *mc13783 = dev_get_drvdata(&spi->dev);
 
-	mc13783 = dev_get_drvdata(&spi->dev);
-
-	free_irq(mc13783->irq, mc13783);
+	free_irq(mc13783->spidev->irq, mc13783);
 
 	mfd_remove_devices(&spi->dev);
 
 	return 0;
 }
 
-static struct spi_driver pmic_driver = {
+static struct spi_driver mc13783_driver = {
 	.driver = {
-		   .name = "mc13783",
-		   .bus = &spi_bus_type,
-		   .owner = THIS_MODULE,
+		.name = "mc13783",
+		.bus = &spi_bus_type,
+		.owner = THIS_MODULE,
 	},
 	.probe = mc13783_probe,
 	.remove = __devexit_p(mc13783_remove),
 };
 
-static int __init pmic_init(void)
+static int __init mc13783_init(void)
 {
-	return spi_register_driver(&pmic_driver);
+	return spi_register_driver(&mc13783_driver);
 }
-subsys_initcall(pmic_init);
+subsys_initcall(mc13783_init);
 
-static void __exit pmic_exit(void)
+static void __exit mc13783_exit(void)
 {
-	spi_unregister_driver(&pmic_driver);
+	spi_unregister_driver(&mc13783_driver);
 }
-module_exit(pmic_exit);
-
-MODULE_DESCRIPTION("Core/Protocol driver for Freescale MC13783 PMIC");
-MODULE_AUTHOR("Sascha Hauer <s.hauer@pengutronix.de>");
-MODULE_LICENSE("GPL");
+module_exit(mc13783_exit);
 
+MODULE_DESCRIPTION("Core driver for Freescale MC13783 PMIC");
+MODULE_AUTHOR("Uwe Kleine-Koenig <u.kleine-koenig@pengutronix.de>");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/mfd/pcf50633-adc.c b/drivers/mfd/pcf50633-adc.c
index 3d31e97d6a45..6d2e8466df1d 100644
--- a/drivers/mfd/pcf50633-adc.c
+++ b/drivers/mfd/pcf50633-adc.c
@@ -209,17 +209,16 @@ static void pcf50633_adc_irq(int irq, void *data)
 
 static int __devinit pcf50633_adc_probe(struct platform_device *pdev)
 {
-	struct pcf50633_subdev_pdata *pdata = pdev->dev.platform_data;
 	struct pcf50633_adc *adc;
 
 	adc = kzalloc(sizeof(*adc), GFP_KERNEL);
 	if (!adc)
 		return -ENOMEM;
 
-	adc->pcf = pdata->pcf;
+	adc->pcf = dev_to_pcf50633(pdev->dev.parent);
 	platform_set_drvdata(pdev, adc);
 
-	pcf50633_register_irq(pdata->pcf, PCF50633_IRQ_ADCRDY,
+	pcf50633_register_irq(adc->pcf, PCF50633_IRQ_ADCRDY,
 					pcf50633_adc_irq, adc);
 
 	mutex_init(&adc->queue_mutex);
diff --git a/drivers/mfd/pcf50633-core.c b/drivers/mfd/pcf50633-core.c
index d26d7747175e..03dcc9200707 100644
--- a/drivers/mfd/pcf50633-core.c
+++ b/drivers/mfd/pcf50633-core.c
@@ -290,7 +290,7 @@ out:
 
 int pcf50633_irq_mask(struct pcf50633 *pcf, int irq)
 {
-	dev_info(pcf->dev, "Masking IRQ %d\n", irq);
+	dev_dbg(pcf->dev, "Masking IRQ %d\n", irq);
 
 	return __pcf50633_irq_mask_set(pcf, irq, 1);
 }
@@ -298,7 +298,7 @@ EXPORT_SYMBOL_GPL(pcf50633_irq_mask);
 
 int pcf50633_irq_unmask(struct pcf50633 *pcf, int irq)
 {
-	dev_info(pcf->dev, "Unmasking IRQ %d\n", irq);
+	dev_dbg(pcf->dev, "Unmasking IRQ %d\n", irq);
 
 	return __pcf50633_irq_mask_set(pcf, irq, 0);
 }
@@ -345,6 +345,9 @@ static void pcf50633_irq_worker(struct work_struct *work)
 		goto out;
 	}
 
+	/* defeat 8s death from lowsys on A5 */
+	pcf50633_reg_write(pcf, PCF50633_REG_OOCSHDWN,  0x04);
+
 	/* We immediately read the usb and adapter status. We thus make sure
 	 * only of USBINS/USBREM IRQ handlers are called */
 	if (pcf_int[0] & (PCF50633_INT1_USBINS | PCF50633_INT1_USBREM)) {
@@ -453,7 +456,6 @@ static void
 pcf50633_client_dev_register(struct pcf50633 *pcf, const char *name,
 						struct platform_device **pdev)
 {
-	struct pcf50633_subdev_pdata *subdev_pdata;
 	int ret;
 
 	*pdev = platform_device_alloc(name, -1);
@@ -462,15 +464,6 @@ pcf50633_client_dev_register(struct pcf50633 *pcf, const char *name,
 		return;
 	}
 
-	subdev_pdata = kmalloc(sizeof(*subdev_pdata), GFP_KERNEL);
-	if (!subdev_pdata) {
-		dev_err(pcf->dev, "Error allocating subdev pdata\n");
-		platform_device_put(*pdev);
-	}
-
-	subdev_pdata->pcf = pcf;
-	platform_device_add_data(*pdev, subdev_pdata, sizeof(*subdev_pdata));
-
 	(*pdev)->dev.parent = pcf->dev;
 
 	ret = platform_device_add(*pdev);
@@ -482,13 +475,13 @@ pcf50633_client_dev_register(struct pcf50633 *pcf, const char *name,
 }
 
 #ifdef CONFIG_PM
-static int pcf50633_suspend(struct device *dev, pm_message_t state)
+static int pcf50633_suspend(struct i2c_client *client, pm_message_t state)
 {
 	struct pcf50633 *pcf;
 	int ret = 0, i;
 	u8 res[5];
 
-	pcf = dev_get_drvdata(dev);
+	pcf = i2c_get_clientdata(client);
 
 	/* Make sure our interrupt handlers are not called
 	 * henceforth */
@@ -523,12 +516,12 @@ out:
 	return ret;
 }
 
-static int pcf50633_resume(struct device *dev)
+static int pcf50633_resume(struct i2c_client *client)
 {
 	struct pcf50633 *pcf;
 	int ret;
 
-	pcf = dev_get_drvdata(dev);
+	pcf = i2c_get_clientdata(client);
 
 	/* Write the saved mask registers */
 	ret = pcf50633_write_block(pcf, PCF50633_REG_INT1M,
@@ -560,9 +553,14 @@ static int __devinit pcf50633_probe(struct i2c_client *client,
 {
 	struct pcf50633 *pcf;
 	struct pcf50633_platform_data *pdata = client->dev.platform_data;
-	int i, ret = 0;
+	int i, ret;
 	int version, variant;
 
+	if (!client->irq) {
+		dev_err(&client->dev, "Missing IRQ\n");
+		return -ENOENT;
+	}
+
 	pcf = kzalloc(sizeof(*pcf), GFP_KERNEL);
 	if (!pcf)
 		return -ENOMEM;
@@ -577,6 +575,12 @@ static int __devinit pcf50633_probe(struct i2c_client *client,
 	pcf->irq = client->irq;
 	pcf->work_queue = create_singlethread_workqueue("pcf50633");
 
+	if (!pcf->work_queue) {
+		dev_err(&client->dev, "Failed to alloc workqueue\n");
+		ret = -ENOMEM;
+		goto err_free;
+	}
+
 	INIT_WORK(&pcf->irq_work, pcf50633_irq_worker);
 
 	version = pcf50633_reg_read(pcf, 0);
@@ -584,7 +588,7 @@ static int __devinit pcf50633_probe(struct i2c_client *client,
 	if (version < 0 || variant < 0) {
 		dev_err(pcf->dev, "Unable to probe pcf50633\n");
 		ret = -ENODEV;
-		goto err;
+		goto err_destroy_workqueue;
 	}
 
 	dev_info(pcf->dev, "Probed device version %d variant %d\n",
@@ -598,6 +602,14 @@ static int __devinit pcf50633_probe(struct i2c_client *client,
 	pcf50633_reg_write(pcf, PCF50633_REG_INT4M, 0x00);
 	pcf50633_reg_write(pcf, PCF50633_REG_INT5M, 0x00);
 
+	ret = request_irq(client->irq, pcf50633_irq,
+					IRQF_TRIGGER_LOW, "pcf50633", pcf);
+
+	if (ret) {
+		dev_err(pcf->dev, "Failed to request IRQ %d\n", ret);
+		goto err_destroy_workqueue;
+	}
+
 	/* Create sub devices */
 	pcf50633_client_dev_register(pcf, "pcf50633-input",
 						&pcf->input_pdev);
@@ -613,31 +625,18 @@ static int __devinit pcf50633_probe(struct i2c_client *client,
 
 		pdev = platform_device_alloc("pcf50633-regltr", i);
 		if (!pdev) {
-			dev_err(pcf->dev, "Cannot create regulator\n");
+			dev_err(pcf->dev, "Cannot create regulator %d\n", i);
 			continue;
 		}
 
 		pdev->dev.parent = pcf->dev;
-		pdev->dev.platform_data = &pdata->reg_init_data[i];
-		dev_set_drvdata(&pdev->dev, pcf);
+		platform_device_add_data(pdev, &pdata->reg_init_data[i],
+					sizeof(pdata->reg_init_data[i]));
 		pcf->regulator_pdev[i] = pdev;
 
 		platform_device_add(pdev);
 	}
 
-	if (client->irq) {
-		ret = request_irq(client->irq, pcf50633_irq,
-				IRQF_TRIGGER_LOW, "pcf50633", pcf);
-
-		if (ret) {
-			dev_err(pcf->dev, "Failed to request IRQ %d\n", ret);
-			goto err;
-		}
-	} else {
-		dev_err(pcf->dev, "No IRQ configured\n");
-		goto err;
-	}
-
 	if (enable_irq_wake(client->irq) < 0)
 		dev_err(pcf->dev, "IRQ %u cannot be enabled as wake-up source"
 			"in this hardware revision", client->irq);
@@ -651,9 +650,12 @@ static int __devinit pcf50633_probe(struct i2c_client *client,
 
 	return 0;
 
-err:
+err_destroy_workqueue:
 	destroy_workqueue(pcf->work_queue);
+err_free:
+	i2c_set_clientdata(client, NULL);
 	kfree(pcf);
+
 	return ret;
 }
 
@@ -686,12 +688,12 @@ static struct i2c_device_id pcf50633_id_table[] = {
 static struct i2c_driver pcf50633_driver = {
 	.driver = {
 		.name	= "pcf50633",
-		.suspend = pcf50633_suspend,
-		.resume	= pcf50633_resume,
 	},
 	.id_table = pcf50633_id_table,
 	.probe = pcf50633_probe,
 	.remove = __devexit_p(pcf50633_remove),
+	.suspend = pcf50633_suspend,
+	.resume	= pcf50633_resume,
 };
 
 static int __init pcf50633_init(void)
diff --git a/drivers/mfd/sh_mobile_sdhi.c b/drivers/mfd/sh_mobile_sdhi.c
new file mode 100644
index 000000000000..03efae8041ab
--- /dev/null
+++ b/drivers/mfd/sh_mobile_sdhi.c
@@ -0,0 +1,156 @@
+/*
+ * SuperH Mobile SDHI
+ *
+ * Copyright (C) 2009 Magnus Damm
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * Based on "Compaq ASIC3 support":
+ *
+ * Copyright 2001 Compaq Computer Corporation.
+ * Copyright 2004-2005 Phil Blundell
+ * Copyright 2007-2008 OpenedHand Ltd.
+ *
+ * Authors: Phil Blundell <pb@handhelds.org>,
+ *	    Samuel Ortiz <sameo@openedhand.com>
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/clk.h>
+#include <linux/platform_device.h>
+
+#include <linux/mfd/core.h>
+#include <linux/mfd/tmio.h>
+#include <linux/mfd/sh_mobile_sdhi.h>
+
+struct sh_mobile_sdhi {
+	struct clk *clk;
+	struct tmio_mmc_data mmc_data;
+	struct mfd_cell cell_mmc;
+};
+
+static struct resource sh_mobile_sdhi_resources[] = {
+	{
+		.start = 0x000,
+		.end   = 0x1ff,
+		.flags = IORESOURCE_MEM,
+	},
+	{
+		.start = 0,
+		.end   = 0,
+		.flags = IORESOURCE_IRQ,
+	},
+};
+
+static struct mfd_cell sh_mobile_sdhi_cell = {
+	.name          = "tmio-mmc",
+	.num_resources = ARRAY_SIZE(sh_mobile_sdhi_resources),
+	.resources     = sh_mobile_sdhi_resources,
+};
+
+static void sh_mobile_sdhi_set_pwr(struct platform_device *tmio, int state)
+{
+	struct platform_device *pdev = to_platform_device(tmio->dev.parent);
+	struct sh_mobile_sdhi_info *p = pdev->dev.platform_data;
+
+	if (p && p->set_pwr)
+		p->set_pwr(pdev, state);
+}
+
+static int __init sh_mobile_sdhi_probe(struct platform_device *pdev)
+{
+	struct sh_mobile_sdhi *priv;
+	struct resource *mem;
+	char clk_name[8];
+	int ret, irq;
+
+	mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	if (!mem)
+		dev_err(&pdev->dev, "missing MEM resource\n");
+
+	irq = platform_get_irq(pdev, 0);
+	if (irq < 0)
+		dev_err(&pdev->dev, "missing IRQ resource\n");
+
+	if (!mem || (irq < 0))
+		return -EINVAL;
+
+	priv = kzalloc(sizeof(struct sh_mobile_sdhi), GFP_KERNEL);
+	if (priv == NULL) {
+		dev_err(&pdev->dev, "kzalloc failed\n");
+		return -ENOMEM;
+	}
+
+	snprintf(clk_name, sizeof(clk_name), "sdhi%d", pdev->id);
+	priv->clk = clk_get(&pdev->dev, clk_name);
+	if (IS_ERR(priv->clk)) {
+		dev_err(&pdev->dev, "cannot get clock \"%s\"\n", clk_name);
+		ret = PTR_ERR(priv->clk);
+		kfree(priv);
+		return ret;
+	}
+
+	clk_enable(priv->clk);
+
+	/* FIXME: silly const unsigned int hclk */
+	*(unsigned int *)&priv->mmc_data.hclk = clk_get_rate(priv->clk);
+	priv->mmc_data.set_pwr = sh_mobile_sdhi_set_pwr;
+
+	memcpy(&priv->cell_mmc, &sh_mobile_sdhi_cell, sizeof(priv->cell_mmc));
+	priv->cell_mmc.driver_data = &priv->mmc_data;
+	priv->cell_mmc.platform_data = &priv->cell_mmc;
+	priv->cell_mmc.data_size = sizeof(priv->cell_mmc);
+
+	platform_set_drvdata(pdev, priv);
+
+	ret = mfd_add_devices(&pdev->dev, pdev->id,
+			      &priv->cell_mmc, 1, mem, irq);
+	if (ret) {
+		clk_disable(priv->clk);
+		clk_put(priv->clk);
+		kfree(priv);
+	}
+
+	return ret;
+}
+
+static int sh_mobile_sdhi_remove(struct platform_device *pdev)
+{
+	struct sh_mobile_sdhi *priv = platform_get_drvdata(pdev);
+
+	mfd_remove_devices(&pdev->dev);
+	clk_disable(priv->clk);
+	clk_put(priv->clk);
+	kfree(priv);
+
+	return 0;
+}
+
+static struct platform_driver sh_mobile_sdhi_driver = {
+	.driver		= {
+		.name	= "sh_mobile_sdhi",
+		.owner	= THIS_MODULE,
+	},
+	.probe		= sh_mobile_sdhi_probe,
+	.remove		= __devexit_p(sh_mobile_sdhi_remove),
+};
+
+static int __init sh_mobile_sdhi_init(void)
+{
+	return platform_driver_register(&sh_mobile_sdhi_driver);
+}
+
+static void __exit sh_mobile_sdhi_exit(void)
+{
+	platform_driver_unregister(&sh_mobile_sdhi_driver);
+}
+
+module_init(sh_mobile_sdhi_init);
+module_exit(sh_mobile_sdhi_exit);
+
+MODULE_DESCRIPTION("SuperH Mobile SDHI driver");
+MODULE_AUTHOR("Magnus Damm");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/mfd/t7l66xb.c b/drivers/mfd/t7l66xb.c
index 0a255c1f1ce7..bcf4687d4af5 100644
--- a/drivers/mfd/t7l66xb.c
+++ b/drivers/mfd/t7l66xb.c
@@ -38,6 +38,19 @@ enum {
 	T7L66XB_CELL_MMC,
 };
 
+static const struct resource t7l66xb_mmc_resources[] = {
+	{
+		.start = 0x800,
+		.end	= 0x9ff,
+		.flags = IORESOURCE_MEM,
+	},
+	{
+		.start = IRQ_T7L66XB_MMC,
+		.end	= IRQ_T7L66XB_MMC,
+		.flags = IORESOURCE_IRQ,
+	},
+};
+
 #define SCR_REVID	0x08		/* b Revision ID	*/
 #define SCR_IMR		0x42		/* b Interrupt Mask	*/
 #define SCR_DEV_CTL	0xe0		/* b Device control	*/
@@ -83,6 +96,9 @@ static int t7l66xb_mmc_enable(struct platform_device *mmc)
 
 	spin_unlock_irqrestore(&t7l66xb->lock, flags);
 
+	tmio_core_mmc_enable(t7l66xb->scr + 0x200, 0,
+		t7l66xb_mmc_resources[0].start & 0xfffe);
+
 	return 0;
 }
 
@@ -106,28 +122,28 @@ static int t7l66xb_mmc_disable(struct platform_device *mmc)
 	return 0;
 }
 
+static void t7l66xb_mmc_pwr(struct platform_device *mmc, int state)
+{
+	struct platform_device *dev = to_platform_device(mmc->dev.parent);
+	struct t7l66xb *t7l66xb = platform_get_drvdata(dev);
+
+	tmio_core_mmc_pwr(t7l66xb->scr + 0x200, 0, state);
+}
+
+static void t7l66xb_mmc_clk_div(struct platform_device *mmc, int state)
+{
+	struct platform_device *dev = to_platform_device(mmc->dev.parent);
+	struct t7l66xb *t7l66xb = platform_get_drvdata(dev);
+
+	tmio_core_mmc_clk_div(t7l66xb->scr + 0x200, 0, state);
+}
+
 /*--------------------------------------------------------------------------*/
 
 static struct tmio_mmc_data t7166xb_mmc_data = {
 	.hclk = 24000000,
-};
-
-static const struct resource t7l66xb_mmc_resources[] = {
-	{
-		.start = 0x800,
-		.end	= 0x9ff,
-		.flags = IORESOURCE_MEM,
-	},
-	{
-		.start = 0x200,
-		.end	= 0x2ff,
-		.flags = IORESOURCE_MEM,
-	},
-	{
-		.start = IRQ_T7L66XB_MMC,
-		.end	= IRQ_T7L66XB_MMC,
-		.flags = IORESOURCE_IRQ,
-	},
+	.set_pwr = t7l66xb_mmc_pwr,
+	.set_clk_div = t7l66xb_mmc_clk_div,
 };
 
 static const struct resource t7l66xb_nand_resources[] = {
@@ -282,6 +298,9 @@ static int t7l66xb_resume(struct platform_device *dev)
 	if (pdata && pdata->resume)
 		pdata->resume(dev);
 
+	tmio_core_mmc_enable(t7l66xb->scr + 0x200, 0,
+		t7l66xb_mmc_resources[0].start & 0xfffe);
+
 	return 0;
 }
 #else
diff --git a/drivers/mfd/tc6387xb.c b/drivers/mfd/tc6387xb.c
index 3280ab33f88a..5c7f04343d5c 100644
--- a/drivers/mfd/tc6387xb.c
+++ b/drivers/mfd/tc6387xb.c
@@ -22,28 +22,52 @@ enum {
 	TC6387XB_CELL_MMC,
 };
 
+struct tc6387xb {
+	void __iomem *scr;
+	struct clk *clk32k;
+	struct resource rscr;
+};
+
+static struct resource tc6387xb_mmc_resources[] = {
+	{
+		.start = 0x800,
+		.end   = 0x9ff,
+		.flags = IORESOURCE_MEM,
+	},
+	{
+		.start = 0,
+		.end   = 0,
+		.flags = IORESOURCE_IRQ,
+	},
+};
+
+/*--------------------------------------------------------------------------*/
+
 #ifdef CONFIG_PM
 static int tc6387xb_suspend(struct platform_device *dev, pm_message_t state)
 {
-	struct clk *clk32k = platform_get_drvdata(dev);
+	struct tc6387xb *tc6387xb = platform_get_drvdata(dev);
 	struct tc6387xb_platform_data *pdata = dev->dev.platform_data;
 
 	if (pdata && pdata->suspend)
 		pdata->suspend(dev);
-	clk_disable(clk32k);
+	clk_disable(tc6387xb->clk32k);
 
 	return 0;
 }
 
 static int tc6387xb_resume(struct platform_device *dev)
 {
-	struct clk *clk32k = platform_get_drvdata(dev);
+	struct tc6387xb *tc6387xb = platform_get_drvdata(dev);
 	struct tc6387xb_platform_data *pdata = dev->dev.platform_data;
 
-	clk_enable(clk32k);
+	clk_enable(tc6387xb->clk32k);
 	if (pdata && pdata->resume)
 		pdata->resume(dev);
 
+	tmio_core_mmc_resume(tc6387xb->scr + 0x200, 0,
+		tc6387xb_mmc_resources[0].start & 0xfffe);
+
 	return 0;
 }
 #else
@@ -53,12 +77,32 @@ static int tc6387xb_resume(struct platform_device *dev)
 
 /*--------------------------------------------------------------------------*/
 
+static void tc6387xb_mmc_pwr(struct platform_device *mmc, int state)
+{
+	struct platform_device *dev = to_platform_device(mmc->dev.parent);
+	struct tc6387xb *tc6387xb = platform_get_drvdata(dev);
+
+	tmio_core_mmc_pwr(tc6387xb->scr + 0x200, 0, state);
+}
+
+static void tc6387xb_mmc_clk_div(struct platform_device *mmc, int state)
+{
+	struct platform_device *dev = to_platform_device(mmc->dev.parent);
+	struct tc6387xb *tc6387xb = platform_get_drvdata(dev);
+
+	tmio_core_mmc_clk_div(tc6387xb->scr + 0x200, 0, state);
+}
+
+
 static int tc6387xb_mmc_enable(struct platform_device *mmc)
 {
 	struct platform_device *dev      = to_platform_device(mmc->dev.parent);
-	struct clk *clk32k = platform_get_drvdata(dev);
+	struct tc6387xb *tc6387xb = platform_get_drvdata(dev);
 
-	clk_enable(clk32k);
+	clk_enable(tc6387xb->clk32k);
+
+	tmio_core_mmc_enable(tc6387xb->scr + 0x200, 0,
+		tc6387xb_mmc_resources[0].start & 0xfffe);
 
 	return 0;
 }
@@ -66,36 +110,20 @@ static int tc6387xb_mmc_enable(struct platform_device *mmc)
 static int tc6387xb_mmc_disable(struct platform_device *mmc)
 {
 	struct platform_device *dev      = to_platform_device(mmc->dev.parent);
-	struct clk *clk32k = platform_get_drvdata(dev);
+	struct tc6387xb *tc6387xb = platform_get_drvdata(dev);
 
-	clk_disable(clk32k);
+	clk_disable(tc6387xb->clk32k);
 
 	return 0;
 }
 
-/*--------------------------------------------------------------------------*/
-
 static struct tmio_mmc_data tc6387xb_mmc_data = {
 	.hclk = 24000000,
+	.set_pwr = tc6387xb_mmc_pwr,
+	.set_clk_div = tc6387xb_mmc_clk_div,
 };
 
-static struct resource tc6387xb_mmc_resources[] = {
-	{
-		.start = 0x800,
-		.end   = 0x9ff,
-		.flags = IORESOURCE_MEM,
-	},
-	{
-		.start = 0x200,
-		.end   = 0x2ff,
-		.flags = IORESOURCE_MEM,
-	},
-	{
-		.start = 0,
-		.end   = 0,
-		.flags = IORESOURCE_IRQ,
-	},
-};
+/*--------------------------------------------------------------------------*/
 
 static struct mfd_cell tc6387xb_cells[] = {
 	[TC6387XB_CELL_MMC] = {
@@ -111,8 +139,9 @@ static struct mfd_cell tc6387xb_cells[] = {
 static int tc6387xb_probe(struct platform_device *dev)
 {
 	struct tc6387xb_platform_data *pdata = dev->dev.platform_data;
-	struct resource *iomem;
+	struct resource *iomem, *rscr;
 	struct clk *clk32k;
+	struct tc6387xb *tc6387xb;
 	int irq, ret;
 
 	iomem = platform_get_resource(dev, IORESOURCE_MEM, 0);
@@ -120,18 +149,40 @@ static int tc6387xb_probe(struct platform_device *dev)
 		return -EINVAL;
 	}
 
+	tc6387xb = kzalloc(sizeof *tc6387xb, GFP_KERNEL);
+	if (!tc6387xb)
+		return -ENOMEM;
+
 	ret  = platform_get_irq(dev, 0);
 	if (ret >= 0)
 		irq = ret;
 	else
-		goto err_resource;
+		goto err_no_irq;
 
 	clk32k = clk_get(&dev->dev, "CLK_CK32K");
 	if (IS_ERR(clk32k)) {
 		ret = PTR_ERR(clk32k);
+		goto err_no_clk;
+	}
+
+	rscr = &tc6387xb->rscr;
+	rscr->name = "tc6387xb-core";
+	rscr->start = iomem->start;
+	rscr->end = iomem->start + 0xff;
+	rscr->flags = IORESOURCE_MEM;
+
+	ret = request_resource(iomem, rscr);
+	if (ret)
 		goto err_resource;
+
+	tc6387xb->scr = ioremap(rscr->start, rscr->end - rscr->start + 1);
+	if (!tc6387xb->scr) {
+		ret = -ENOMEM;
+		goto err_ioremap;
 	}
-	platform_set_drvdata(dev, clk32k);
+
+	tc6387xb->clk32k = clk32k;
+	platform_set_drvdata(dev, tc6387xb);
 
 	if (pdata && pdata->enable)
 		pdata->enable(dev);
@@ -149,8 +200,13 @@ static int tc6387xb_probe(struct platform_device *dev)
 	if (!ret)
 		return 0;
 
-	clk_put(clk32k);
+err_ioremap:
+	release_resource(&tc6387xb->rscr);
 err_resource:
+	clk_put(clk32k);
+err_no_clk:
+err_no_irq:
+	kfree(tc6387xb);
 	return ret;
 }
 
@@ -195,3 +251,4 @@ MODULE_DESCRIPTION("Toshiba TC6387XB core driver");
 MODULE_LICENSE("GPL v2");
 MODULE_AUTHOR("Ian Molton");
 MODULE_ALIAS("platform:tc6387xb");
+
diff --git a/drivers/mfd/tc6393xb.c b/drivers/mfd/tc6393xb.c
index 1429a7341a9a..4bc5a08a2b09 100644
--- a/drivers/mfd/tc6393xb.c
+++ b/drivers/mfd/tc6393xb.c
@@ -136,10 +136,6 @@ static int tc6393xb_nand_enable(struct platform_device *nand)
 	return 0;
 }
 
-static struct tmio_mmc_data tc6393xb_mmc_data = {
-	.hclk = 24000000,
-};
-
 static struct resource __devinitdata tc6393xb_nand_resources[] = {
 	{
 		.start	= 0x1000,
@@ -165,11 +161,6 @@ static struct resource __devinitdata tc6393xb_mmc_resources[] = {
 		.flags	= IORESOURCE_MEM,
 	},
 	{
-		.start	= 0x200,
-		.end	= 0x2ff,
-		.flags	= IORESOURCE_MEM,
-	},
-	{
 		.start	= IRQ_TC6393_MMC,
 		.end	= IRQ_TC6393_MMC,
 		.flags	= IORESOURCE_IRQ,
@@ -346,6 +337,50 @@ int tc6393xb_lcd_mode(struct platform_device *fb,
 }
 EXPORT_SYMBOL(tc6393xb_lcd_mode);
 
+static int tc6393xb_mmc_enable(struct platform_device *mmc)
+{
+	struct platform_device *dev = to_platform_device(mmc->dev.parent);
+	struct tc6393xb *tc6393xb = platform_get_drvdata(dev);
+
+	tmio_core_mmc_enable(tc6393xb->scr + 0x200, 0,
+		tc6393xb_mmc_resources[0].start & 0xfffe);
+
+	return 0;
+}
+
+static int tc6393xb_mmc_resume(struct platform_device *mmc)
+{
+	struct platform_device *dev = to_platform_device(mmc->dev.parent);
+	struct tc6393xb *tc6393xb = platform_get_drvdata(dev);
+
+	tmio_core_mmc_resume(tc6393xb->scr + 0x200, 0,
+		tc6393xb_mmc_resources[0].start & 0xfffe);
+
+	return 0;
+}
+
+static void tc6393xb_mmc_pwr(struct platform_device *mmc, int state)
+{
+	struct platform_device *dev = to_platform_device(mmc->dev.parent);
+	struct tc6393xb *tc6393xb = platform_get_drvdata(dev);
+
+	tmio_core_mmc_pwr(tc6393xb->scr + 0x200, 0, state);
+}
+
+static void tc6393xb_mmc_clk_div(struct platform_device *mmc, int state)
+{
+	struct platform_device *dev = to_platform_device(mmc->dev.parent);
+	struct tc6393xb *tc6393xb = platform_get_drvdata(dev);
+
+	tmio_core_mmc_clk_div(tc6393xb->scr + 0x200, 0, state);
+}
+
+static struct tmio_mmc_data tc6393xb_mmc_data = {
+	.hclk = 24000000,
+	.set_pwr = tc6393xb_mmc_pwr,
+	.set_clk_div = tc6393xb_mmc_clk_div,
+};
+
 static struct mfd_cell __devinitdata tc6393xb_cells[] = {
 	[TC6393XB_CELL_NAND] = {
 		.name = "tmio-nand",
@@ -355,6 +390,8 @@ static struct mfd_cell __devinitdata tc6393xb_cells[] = {
 	},
 	[TC6393XB_CELL_MMC] = {
 		.name = "tmio-mmc",
+		.enable = tc6393xb_mmc_enable,
+		.resume = tc6393xb_mmc_resume,
 		.driver_data = &tc6393xb_mmc_data,
 		.num_resources = ARRAY_SIZE(tc6393xb_mmc_resources),
 		.resources = tc6393xb_mmc_resources,
@@ -836,3 +873,4 @@ MODULE_LICENSE("GPL v2");
 MODULE_AUTHOR("Ian Molton, Dmitry Baryshkov and Dirk Opfer");
 MODULE_DESCRIPTION("tc6393xb Toshiba Mobile IO Controller");
 MODULE_ALIAS("platform:tc6393xb");
+
diff --git a/drivers/mfd/tmio_core.c b/drivers/mfd/tmio_core.c
new file mode 100644
index 000000000000..eddc19ae464b
--- /dev/null
+++ b/drivers/mfd/tmio_core.c
@@ -0,0 +1,52 @@
+/*
+ * Copyright(c) 2009 Ian Molton <spyro@f2s.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/mfd/tmio.h>
+
+int tmio_core_mmc_enable(void __iomem *cnf, int shift, unsigned long base)
+{
+	/* Enable the MMC/SD Control registers */
+	sd_config_write16(cnf, shift, CNF_CMD, SDCREN);
+	sd_config_write32(cnf, shift, CNF_CTL_BASE, base & 0xfffe);
+
+	/* Disable SD power during suspend */
+	sd_config_write8(cnf, shift, CNF_PWR_CTL_3, 0x01);
+
+	/* The below is required but why? FIXME */
+	sd_config_write8(cnf, shift, CNF_STOP_CLK_CTL, 0x1f);
+
+	/* Power down SD bus */
+	sd_config_write8(cnf, shift, CNF_PWR_CTL_2, 0x00);
+
+	return 0;
+}
+EXPORT_SYMBOL(tmio_core_mmc_enable);
+
+int tmio_core_mmc_resume(void __iomem *cnf, int shift, unsigned long base)
+{
+
+	/* Enable the MMC/SD Control registers */
+	sd_config_write16(cnf, shift, CNF_CMD, SDCREN);
+	sd_config_write32(cnf, shift, CNF_CTL_BASE, base & 0xfffe);
+
+	return 0;
+}
+EXPORT_SYMBOL(tmio_core_mmc_resume);
+
+void tmio_core_mmc_pwr(void __iomem *cnf, int shift, int state)
+{
+	sd_config_write8(cnf, shift, CNF_PWR_CTL_2, state ? 0x02 : 0x00);
+}
+EXPORT_SYMBOL(tmio_core_mmc_pwr);
+
+void tmio_core_mmc_clk_div(void __iomem *cnf, int shift, int state)
+{
+	sd_config_write8(cnf, shift, CNF_SD_CLK_MODE, state ? 1 : 0);
+}
+EXPORT_SYMBOL(tmio_core_mmc_clk_div);
+
diff --git a/drivers/mfd/tps65010.c b/drivers/mfd/tps65010.c
index acf8b9d5f575..e5955306c2fa 100644
--- a/drivers/mfd/tps65010.c
+++ b/drivers/mfd/tps65010.c
@@ -637,7 +637,7 @@ static int tps65010_probe(struct i2c_client *client,
 				tps, DEBUG_FOPS);
 
 	/* optionally register GPIOs */
-	if (board && board->base > 0) {
+	if (board && board->base != 0) {
 		tps->outmask = board->outmask;
 
 		tps->chip.label = client->name;
@@ -964,6 +964,34 @@ int tps65010_config_vregs1(unsigned value)
 }
 EXPORT_SYMBOL(tps65010_config_vregs1);
 
+int tps65010_config_vdcdc2(unsigned value)
+{
+	struct i2c_client *c;
+	int	 status;
+
+	if (!the_tps)
+		return -ENODEV;
+
+	c = the_tps->client;
+	mutex_lock(&the_tps->lock);
+
+	pr_debug("%s: vdcdc2 0x%02x\n", DRIVER_NAME,
+		 i2c_smbus_read_byte_data(c, TPS_VDCDC2));
+
+	status = i2c_smbus_write_byte_data(c, TPS_VDCDC2, value);
+
+	if (status != 0)
+		printk(KERN_ERR "%s: Failed to write vdcdc2 register\n",
+			DRIVER_NAME);
+	else
+		pr_debug("%s: vregs1 0x%02x\n", DRIVER_NAME,
+			 i2c_smbus_read_byte_data(c, TPS_VDCDC2));
+
+	mutex_unlock(&the_tps->lock);
+	return status;
+}
+EXPORT_SYMBOL(tps65010_config_vdcdc2);
+
 /*-------------------------------------------------------------------------*/
 /* tps65013_set_low_pwr parameter:
  * mode: ON or OFF
diff --git a/drivers/mfd/twl4030-core.c b/drivers/mfd/twl-core.c
index 40449cdf09db..2a7606534196 100644
--- a/drivers/mfd/twl4030-core.c
+++ b/drivers/mfd/twl-core.c
@@ -1,5 +1,6 @@
 /*
- * twl4030_core.c - driver for TWL4030/TPS659x0 PM and audio CODEC devices
+ * twl_core.c - driver for TWL4030/TWL5030/TWL60X0/TPS659x0 PM
+ * and audio CODEC devices
  *
  * Copyright (C) 2005-2006 Texas Instruments, Inc.
  *
@@ -36,7 +37,7 @@
 #include <linux/regulator/machine.h>
 
 #include <linux/i2c.h>
-#include <linux/i2c/twl4030.h>
+#include <linux/i2c/twl.h>
 
 #if defined(CONFIG_ARCH_OMAP2) || defined(CONFIG_ARCH_OMAP3)
 #include <plat/cpu.h>
@@ -55,7 +56,7 @@
  * (and associated registers).
  */
 
-#define DRIVER_NAME			"twl4030"
+#define DRIVER_NAME			"twl"
 
 #if defined(CONFIG_TWL4030_BCI_BATTERY) || \
 	defined(CONFIG_TWL4030_BCI_BATTERY_MODULE)
@@ -125,7 +126,7 @@
 /* Last - for index max*/
 #define TWL4030_MODULE_LAST		TWL4030_MODULE_SECURED_REG
 
-#define TWL4030_NUM_SLAVES		4
+#define TWL_NUM_SLAVES		4
 
 #if defined(CONFIG_INPUT_TWL4030_PWRBUTTON) \
 	|| defined(CONFIG_INPUT_TWL4030_PWBUTTON_MODULE)
@@ -134,6 +135,13 @@
 #define twl_has_pwrbutton()	false
 #endif
 
+#define SUB_CHIP_ID0 0
+#define SUB_CHIP_ID1 1
+#define SUB_CHIP_ID2 2
+#define SUB_CHIP_ID3 3
+
+#define TWL_MODULE_LAST TWL4030_MODULE_LAST
+
 /* Base Address defns for twl4030_map[] */
 
 /* subchip/slave 0 - USB ID */
@@ -158,6 +166,10 @@
 #define TWL4030_BASEADD_PWMB		0x00F1
 #define TWL4030_BASEADD_KEYPAD		0x00D2
 
+#define TWL5031_BASEADD_ACCESSORY	0x0074 /* Replaces Main Charge */
+#define TWL5031_BASEADD_INTERRUPTS	0x00B9 /* Different than TWL4030's
+						  one */
+
 /* subchip/slave 3 - POWER ID */
 #define TWL4030_BASEADD_BACKUP		0x0014
 #define TWL4030_BASEADD_INT		0x002E
@@ -169,6 +181,30 @@
 /* Triton Core internal information (END) */
 
 
+/* subchip/slave 0 0x48 - POWER */
+#define TWL6030_BASEADD_RTC		0x0000
+#define TWL6030_BASEADD_MEM		0x0017
+#define TWL6030_BASEADD_PM_MASTER	0x001F
+#define TWL6030_BASEADD_PM_SLAVE_MISC	0x0030 /* PM_RECEIVER */
+#define TWL6030_BASEADD_PM_MISC		0x00E2
+#define TWL6030_BASEADD_PM_PUPD		0x00F0
+
+/* subchip/slave 1 0x49 - FEATURE */
+#define TWL6030_BASEADD_USB		0x0000
+#define TWL6030_BASEADD_GPADC_CTRL	0x002E
+#define TWL6030_BASEADD_AUX		0x0090
+#define TWL6030_BASEADD_PWM		0x00BA
+#define TWL6030_BASEADD_GASGAUGE	0x00C0
+#define TWL6030_BASEADD_PIH		0x00D0
+#define TWL6030_BASEADD_CHARGER		0x00E0
+
+/* subchip/slave 2 0x4A - DFT */
+#define TWL6030_BASEADD_DIEID		0x00C0
+
+/* subchip/slave 3 0x4B - AUDIO */
+#define TWL6030_BASEADD_AUDIO		0x0000
+#define TWL6030_BASEADD_RSV		0x0000
+
 /* Few power values */
 #define R_CFG_BOOT			0x05
 #define R_PROTECT_KEY			0x0E
@@ -183,19 +219,29 @@
 #define HFCLK_FREQ_26_MHZ		(2 << 0)
 #define HFCLK_FREQ_38p4_MHZ		(3 << 0)
 #define HIGH_PERF_SQ			(1 << 3)
+#define CK32K_LOWPWR_EN			(1 << 7)
 
 
 /* chip-specific feature flags, for i2c_device_id.driver_data */
 #define TWL4030_VAUX2		BIT(0)	/* pre-5030 voltage ranges */
 #define TPS_SUBSET		BIT(1)	/* tps659[23]0 have fewer LDOs */
+#define TWL5031			BIT(2)  /* twl5031 has different registers */
+#define TWL6030_CLASS		BIT(3)	/* TWL6030 class */
 
 /*----------------------------------------------------------------------*/
 
 /* is driver active, bound to a chip? */
 static bool inuse;
 
-/* Structure for each TWL4030 Slave */
-struct twl4030_client {
+static unsigned int twl_id;
+unsigned int twl_rev(void)
+{
+	return twl_id;
+}
+EXPORT_SYMBOL(twl_rev);
+
+/* Structure for each TWL4030/TWL6030 Slave */
+struct twl_client {
 	struct i2c_client *client;
 	u8 address;
 
@@ -206,19 +252,20 @@ struct twl4030_client {
 	struct mutex xfer_lock;
 };
 
-static struct twl4030_client twl4030_modules[TWL4030_NUM_SLAVES];
+static struct twl_client twl_modules[TWL_NUM_SLAVES];
 
 
 /* mapping the module id to slave id and base address */
-struct twl4030mapping {
+struct twl_mapping {
 	unsigned char sid;	/* Slave ID */
 	unsigned char base;	/* base address */
 };
+struct twl_mapping *twl_map;
 
-static struct twl4030mapping twl4030_map[TWL4030_MODULE_LAST + 1] = {
+static struct twl_mapping twl4030_map[TWL4030_MODULE_LAST + 1] = {
 	/*
 	 * NOTE:  don't change this table without updating the
-	 * <linux/i2c/twl4030.h> defines for TWL4030_MODULE_*
+	 * <linux/i2c/twl.h> defines for TWL4030_MODULE_*
 	 * so they continue to match the order in this table.
 	 */
 
@@ -240,6 +287,8 @@ static struct twl4030mapping twl4030_map[TWL4030_MODULE_LAST + 1] = {
 	{ 2, TWL4030_BASEADD_PWM1 },
 	{ 2, TWL4030_BASEADD_PWMA },
 	{ 2, TWL4030_BASEADD_PWMB },
+	{ 2, TWL5031_BASEADD_ACCESSORY },
+	{ 2, TWL5031_BASEADD_INTERRUPTS },
 
 	{ 3, TWL4030_BASEADD_BACKUP },
 	{ 3, TWL4030_BASEADD_INT },
@@ -249,12 +298,46 @@ static struct twl4030mapping twl4030_map[TWL4030_MODULE_LAST + 1] = {
 	{ 3, TWL4030_BASEADD_SECURED_REG },
 };
 
+static struct twl_mapping twl6030_map[] = {
+	/*
+	 * NOTE:  don't change this table without updating the
+	 * <linux/i2c/twl.h> defines for TWL4030_MODULE_*
+	 * so they continue to match the order in this table.
+	 */
+	{ SUB_CHIP_ID1, TWL6030_BASEADD_USB },
+	{ SUB_CHIP_ID3, TWL6030_BASEADD_AUDIO },
+	{ SUB_CHIP_ID2, TWL6030_BASEADD_DIEID },
+	{ SUB_CHIP_ID2, TWL6030_BASEADD_RSV },
+	{ SUB_CHIP_ID1, TWL6030_BASEADD_PIH },
+
+	{ SUB_CHIP_ID2, TWL6030_BASEADD_RSV },
+	{ SUB_CHIP_ID2, TWL6030_BASEADD_RSV },
+	{ SUB_CHIP_ID1, TWL6030_BASEADD_GPADC_CTRL },
+	{ SUB_CHIP_ID2, TWL6030_BASEADD_RSV },
+	{ SUB_CHIP_ID2, TWL6030_BASEADD_RSV },
+
+	{ SUB_CHIP_ID1, TWL6030_BASEADD_CHARGER },
+	{ SUB_CHIP_ID1, TWL6030_BASEADD_GASGAUGE },
+	{ SUB_CHIP_ID1, TWL6030_BASEADD_PWM },
+	{ SUB_CHIP_ID2, TWL6030_BASEADD_RSV },
+	{ SUB_CHIP_ID2, TWL6030_BASEADD_RSV },
+
+	{ SUB_CHIP_ID2, TWL6030_BASEADD_RSV },
+	{ SUB_CHIP_ID2, TWL6030_BASEADD_RSV },
+	{ SUB_CHIP_ID2, TWL6030_BASEADD_RSV },
+	{ SUB_CHIP_ID0, TWL6030_BASEADD_PM_MASTER },
+	{ SUB_CHIP_ID0, TWL6030_BASEADD_PM_SLAVE_MISC },
+
+	{ SUB_CHIP_ID0, TWL6030_BASEADD_RTC },
+	{ SUB_CHIP_ID0, TWL6030_BASEADD_MEM },
+};
+
 /*----------------------------------------------------------------------*/
 
 /* Exported Functions */
 
 /**
- * twl4030_i2c_write - Writes a n bit register in TWL4030
+ * twl_i2c_write - Writes a n bit register in TWL4030/TWL5030/TWL60X0
  * @mod_no: module number
  * @value: an array of num_bytes+1 containing data to write
  * @reg: register address (just offset will do)
@@ -265,19 +348,19 @@ static struct twl4030mapping twl4030_map[TWL4030_MODULE_LAST + 1] = {
  *
  * Returns the result of operation - 0 is success
  */
-int twl4030_i2c_write(u8 mod_no, u8 *value, u8 reg, unsigned num_bytes)
+int twl_i2c_write(u8 mod_no, u8 *value, u8 reg, unsigned num_bytes)
 {
 	int ret;
 	int sid;
-	struct twl4030_client *twl;
+	struct twl_client *twl;
 	struct i2c_msg *msg;
 
-	if (unlikely(mod_no > TWL4030_MODULE_LAST)) {
+	if (unlikely(mod_no > TWL_MODULE_LAST)) {
 		pr_err("%s: invalid module number %d\n", DRIVER_NAME, mod_no);
 		return -EPERM;
 	}
-	sid = twl4030_map[mod_no].sid;
-	twl = &twl4030_modules[sid];
+	sid = twl_map[mod_no].sid;
+	twl = &twl_modules[sid];
 
 	if (unlikely(!inuse)) {
 		pr_err("%s: client %d is not initialized\n", DRIVER_NAME, sid);
@@ -294,19 +377,26 @@ int twl4030_i2c_write(u8 mod_no, u8 *value, u8 reg, unsigned num_bytes)
 	msg->flags = 0;
 	msg->buf = value;
 	/* over write the first byte of buffer with the register address */
-	*value = twl4030_map[mod_no].base + reg;
+	*value = twl_map[mod_no].base + reg;
 	ret = i2c_transfer(twl->client->adapter, twl->xfer_msg, 1);
 	mutex_unlock(&twl->xfer_lock);
 
-	/* i2cTransfer returns num messages.translate it pls.. */
-	if (ret >= 0)
-		ret = 0;
-	return ret;
+	/* i2c_transfer returns number of messages transferred */
+	if (ret != 1) {
+		pr_err("%s: i2c_write failed to transfer all messages\n",
+			DRIVER_NAME);
+		if (ret < 0)
+			return ret;
+		else
+			return -EIO;
+	} else {
+		return 0;
+	}
 }
-EXPORT_SYMBOL(twl4030_i2c_write);
+EXPORT_SYMBOL(twl_i2c_write);
 
 /**
- * twl4030_i2c_read - Reads a n bit register in TWL4030
+ * twl_i2c_read - Reads a n bit register in TWL4030/TWL5030/TWL60X0
  * @mod_no: module number
  * @value: an array of num_bytes containing data to be read
  * @reg: register address (just offset will do)
@@ -314,20 +404,20 @@ EXPORT_SYMBOL(twl4030_i2c_write);
  *
  * Returns result of operation - num_bytes is success else failure.
  */
-int twl4030_i2c_read(u8 mod_no, u8 *value, u8 reg, unsigned num_bytes)
+int twl_i2c_read(u8 mod_no, u8 *value, u8 reg, unsigned num_bytes)
 {
 	int ret;
 	u8 val;
 	int sid;
-	struct twl4030_client *twl;
+	struct twl_client *twl;
 	struct i2c_msg *msg;
 
-	if (unlikely(mod_no > TWL4030_MODULE_LAST)) {
+	if (unlikely(mod_no > TWL_MODULE_LAST)) {
 		pr_err("%s: invalid module number %d\n", DRIVER_NAME, mod_no);
 		return -EPERM;
 	}
-	sid = twl4030_map[mod_no].sid;
-	twl = &twl4030_modules[sid];
+	sid = twl_map[mod_no].sid;
+	twl = &twl_modules[sid];
 
 	if (unlikely(!inuse)) {
 		pr_err("%s: client %d is not initialized\n", DRIVER_NAME, sid);
@@ -339,7 +429,7 @@ int twl4030_i2c_read(u8 mod_no, u8 *value, u8 reg, unsigned num_bytes)
 	msg->addr = twl->address;
 	msg->len = 1;
 	msg->flags = 0;	/* Read the register value */
-	val = twl4030_map[mod_no].base + reg;
+	val = twl_map[mod_no].base + reg;
 	msg->buf = &val;
 	/* [MSG2] fill the data rx buffer */
 	msg = &twl->xfer_msg[1];
@@ -350,45 +440,52 @@ int twl4030_i2c_read(u8 mod_no, u8 *value, u8 reg, unsigned num_bytes)
 	ret = i2c_transfer(twl->client->adapter, twl->xfer_msg, 2);
 	mutex_unlock(&twl->xfer_lock);
 
-	/* i2cTransfer returns num messages.translate it pls.. */
-	if (ret >= 0)
-		ret = 0;
-	return ret;
+	/* i2c_transfer returns number of messages transferred */
+	if (ret != 2) {
+		pr_err("%s: i2c_read failed to transfer all messages\n",
+			DRIVER_NAME);
+		if (ret < 0)
+			return ret;
+		else
+			return -EIO;
+	} else {
+		return 0;
+	}
 }
-EXPORT_SYMBOL(twl4030_i2c_read);
+EXPORT_SYMBOL(twl_i2c_read);
 
 /**
- * twl4030_i2c_write_u8 - Writes a 8 bit register in TWL4030
+ * twl_i2c_write_u8 - Writes a 8 bit register in TWL4030/TWL5030/TWL60X0
  * @mod_no: module number
  * @value: the value to be written 8 bit
  * @reg: register address (just offset will do)
  *
  * Returns result of operation - 0 is success
  */
-int twl4030_i2c_write_u8(u8 mod_no, u8 value, u8 reg)
+int twl_i2c_write_u8(u8 mod_no, u8 value, u8 reg)
 {
 
 	/* 2 bytes offset 1 contains the data offset 0 is used by i2c_write */
 	u8 temp_buffer[2] = { 0 };
 	/* offset 1 contains the data */
 	temp_buffer[1] = value;
-	return twl4030_i2c_write(mod_no, temp_buffer, reg, 1);
+	return twl_i2c_write(mod_no, temp_buffer, reg, 1);
 }
-EXPORT_SYMBOL(twl4030_i2c_write_u8);
+EXPORT_SYMBOL(twl_i2c_write_u8);
 
 /**
- * twl4030_i2c_read_u8 - Reads a 8 bit register from TWL4030
+ * twl_i2c_read_u8 - Reads a 8 bit register from TWL4030/TWL5030/TWL60X0
  * @mod_no: module number
  * @value: the value read 8 bit
  * @reg: register address (just offset will do)
  *
  * Returns result of operation - 0 is success
  */
-int twl4030_i2c_read_u8(u8 mod_no, u8 *value, u8 reg)
+int twl_i2c_read_u8(u8 mod_no, u8 *value, u8 reg)
 {
-	return twl4030_i2c_read(mod_no, value, reg, 1);
+	return twl_i2c_read(mod_no, value, reg, 1);
 }
-EXPORT_SYMBOL(twl4030_i2c_read_u8);
+EXPORT_SYMBOL(twl_i2c_read_u8);
 
 /*----------------------------------------------------------------------*/
 
@@ -398,7 +495,7 @@ add_numbered_child(unsigned chip, const char *name, int num,
 		bool can_wakeup, int irq0, int irq1)
 {
 	struct platform_device	*pdev;
-	struct twl4030_client	*twl = &twl4030_modules[chip];
+	struct twl_client	*twl = &twl_modules[chip];
 	int			status;
 
 	pdev = platform_device_alloc(name, num);
@@ -456,6 +553,7 @@ add_regulator_linked(int num, struct regulator_init_data *pdata,
 		struct regulator_consumer_supply *consumers,
 		unsigned num_consumers)
 {
+	unsigned sub_chip_id;
 	/* regulator framework demands init_data ... */
 	if (!pdata)
 		return NULL;
@@ -466,7 +564,8 @@ add_regulator_linked(int num, struct regulator_init_data *pdata,
 	}
 
 	/* NOTE:  we currently ignore regulator IRQs, e.g. for short circuits */
-	return add_numbered_child(3, "twl4030_reg", num,
+	sub_chip_id = twl_map[TWL_MODULE_PM_MASTER].sid;
+	return add_numbered_child(sub_chip_id, "twl_reg", num,
 		pdata, sizeof(*pdata), false, 0, 0);
 }
 
@@ -486,29 +585,32 @@ static int
 add_children(struct twl4030_platform_data *pdata, unsigned long features)
 {
 	struct device	*child;
+	unsigned sub_chip_id;
 
-	if (twl_has_bci() && pdata->bci && !(features & TPS_SUBSET)) {
+	if (twl_has_bci() && pdata->bci &&
+	    !(features & (TPS_SUBSET | TWL5031))) {
 		child = add_child(3, "twl4030_bci",
 				pdata->bci, sizeof(*pdata->bci),
 				false,
 				/* irq0 = CHG_PRES, irq1 = BCI */
-				pdata->irq_base + 8 + 1, pdata->irq_base + 2);
+				pdata->irq_base + BCI_PRES_INTR_OFFSET,
+				pdata->irq_base + BCI_INTR_OFFSET);
 		if (IS_ERR(child))
 			return PTR_ERR(child);
 	}
 
 	if (twl_has_gpio() && pdata->gpio) {
-		child = add_child(1, "twl4030_gpio",
+		child = add_child(SUB_CHIP_ID1, "twl4030_gpio",
 				pdata->gpio, sizeof(*pdata->gpio),
-				false, pdata->irq_base + 0, 0);
+				false, pdata->irq_base + GPIO_INTR_OFFSET, 0);
 		if (IS_ERR(child))
 			return PTR_ERR(child);
 	}
 
 	if (twl_has_keypad() && pdata->keypad) {
-		child = add_child(2, "twl4030_keypad",
+		child = add_child(SUB_CHIP_ID2, "twl4030_keypad",
 				pdata->keypad, sizeof(*pdata->keypad),
-				true, pdata->irq_base + 1, 0);
+				true, pdata->irq_base + KEYPAD_INTR_OFFSET, 0);
 		if (IS_ERR(child))
 			return PTR_ERR(child);
 	}
@@ -516,7 +618,7 @@ add_children(struct twl4030_platform_data *pdata, unsigned long features)
 	if (twl_has_madc() && pdata->madc) {
 		child = add_child(2, "twl4030_madc",
 				pdata->madc, sizeof(*pdata->madc),
-				true, pdata->irq_base + 3, 0);
+				true, pdata->irq_base + MADC_INTR_OFFSET, 0);
 		if (IS_ERR(child))
 			return PTR_ERR(child);
 	}
@@ -529,14 +631,15 @@ add_children(struct twl4030_platform_data *pdata, unsigned long features)
 		 * Eventually, Linux might become more aware of such
 		 * HW security concerns, and "least privilege".
 		 */
-		child = add_child(3, "twl4030_rtc",
+		sub_chip_id = twl_map[TWL_MODULE_RTC].sid;
+		child = add_child(sub_chip_id, "twl_rtc",
 				NULL, 0,
-				true, pdata->irq_base + 8 + 3, 0);
+				true, pdata->irq_base + RTC_INTR_OFFSET, 0);
 		if (IS_ERR(child))
 			return PTR_ERR(child);
 	}
 
-	if (twl_has_usb() && pdata->usb) {
+	if (twl_has_usb() && pdata->usb && twl_class_is_4030()) {
 
 		static struct regulator_consumer_supply usb1v5 = {
 			.supply =	"usb1v5",
@@ -581,7 +684,8 @@ add_children(struct twl4030_platform_data *pdata, unsigned long features)
 				pdata->usb, sizeof(*pdata->usb),
 				true,
 				/* irq0 = USB_PRES, irq1 = USB */
-				pdata->irq_base + 8 + 2, pdata->irq_base + 4);
+				pdata->irq_base + USB_PRES_INTR_OFFSET,
+				pdata->irq_base + USB_INTR_OFFSET);
 
 		if (IS_ERR(child))
 			return PTR_ERR(child);
@@ -615,12 +719,23 @@ add_children(struct twl4030_platform_data *pdata, unsigned long features)
 			return PTR_ERR(child);
 	}
 
-	if (twl_has_regulator()) {
-		/*
+	/* twl4030 regulators */
+	if (twl_has_regulator() && twl_class_is_4030()) {
 		child = add_regulator(TWL4030_REG_VPLL1, pdata->vpll1);
 		if (IS_ERR(child))
 			return PTR_ERR(child);
-		*/
+
+		child = add_regulator(TWL4030_REG_VIO, pdata->vio);
+		if (IS_ERR(child))
+			return PTR_ERR(child);
+
+		child = add_regulator(TWL4030_REG_VDD1, pdata->vdd1);
+		if (IS_ERR(child))
+			return PTR_ERR(child);
+
+		child = add_regulator(TWL4030_REG_VDD2, pdata->vdd2);
+		if (IS_ERR(child))
+			return PTR_ERR(child);
 
 		child = add_regulator(TWL4030_REG_VMMC1, pdata->vmmc1);
 		if (IS_ERR(child))
@@ -636,10 +751,23 @@ add_children(struct twl4030_platform_data *pdata, unsigned long features)
 				pdata->vaux2);
 		if (IS_ERR(child))
 			return PTR_ERR(child);
+
+		child = add_regulator(TWL4030_REG_VINTANA1, pdata->vintana1);
+		if (IS_ERR(child))
+			return PTR_ERR(child);
+
+		child = add_regulator(TWL4030_REG_VINTANA2, pdata->vintana2);
+		if (IS_ERR(child))
+			return PTR_ERR(child);
+
+		child = add_regulator(TWL4030_REG_VINTDIG, pdata->vintdig);
+		if (IS_ERR(child))
+			return PTR_ERR(child);
 	}
 
 	/* maybe add LDOs that are omitted on cost-reduced parts */
-	if (twl_has_regulator() && !(features & TPS_SUBSET)) {
+	if (twl_has_regulator() && !(features & TPS_SUBSET)
+	  && twl_class_is_4030()) {
 		child = add_regulator(TWL4030_REG_VPLL2, pdata->vpll2);
 		if (IS_ERR(child))
 			return PTR_ERR(child);
@@ -665,6 +793,49 @@ add_children(struct twl4030_platform_data *pdata, unsigned long features)
 			return PTR_ERR(child);
 	}
 
+	/* twl6030 regulators */
+	if (twl_has_regulator() && twl_class_is_6030()) {
+		child = add_regulator(TWL6030_REG_VMMC, pdata->vmmc);
+		if (IS_ERR(child))
+			return PTR_ERR(child);
+
+		child = add_regulator(TWL6030_REG_VPP, pdata->vpp);
+		if (IS_ERR(child))
+			return PTR_ERR(child);
+
+		child = add_regulator(TWL6030_REG_VUSIM, pdata->vusim);
+		if (IS_ERR(child))
+			return PTR_ERR(child);
+
+		child = add_regulator(TWL6030_REG_VANA, pdata->vana);
+		if (IS_ERR(child))
+			return PTR_ERR(child);
+
+		child = add_regulator(TWL6030_REG_VCXIO, pdata->vcxio);
+		if (IS_ERR(child))
+			return PTR_ERR(child);
+
+		child = add_regulator(TWL6030_REG_VDAC, pdata->vdac);
+		if (IS_ERR(child))
+			return PTR_ERR(child);
+
+		child = add_regulator(TWL6030_REG_VUSB, pdata->vusb);
+		if (IS_ERR(child))
+			return PTR_ERR(child);
+
+		child = add_regulator(TWL6030_REG_VAUX1_6030, pdata->vaux1);
+		if (IS_ERR(child))
+			return PTR_ERR(child);
+
+		child = add_regulator(TWL6030_REG_VAUX2_6030, pdata->vaux2);
+		if (IS_ERR(child))
+			return PTR_ERR(child);
+
+		child = add_regulator(TWL6030_REG_VAUX3_6030, pdata->vaux3);
+		if (IS_ERR(child))
+			return PTR_ERR(child);
+	}
+
 	return 0;
 }
 
@@ -679,7 +850,7 @@ static inline int __init protect_pm_master(void)
 {
 	int e = 0;
 
-	e = twl4030_i2c_write_u8(TWL4030_MODULE_PM_MASTER, KEY_LOCK,
+	e = twl_i2c_write_u8(TWL_MODULE_PM_MASTER, KEY_LOCK,
 			R_PROTECT_KEY);
 	return e;
 }
@@ -688,14 +859,15 @@ static inline int __init unprotect_pm_master(void)
 {
 	int e = 0;
 
-	e |= twl4030_i2c_write_u8(TWL4030_MODULE_PM_MASTER, KEY_UNLOCK1,
+	e |= twl_i2c_write_u8(TWL_MODULE_PM_MASTER, KEY_UNLOCK1,
 			R_PROTECT_KEY);
-	e |= twl4030_i2c_write_u8(TWL4030_MODULE_PM_MASTER, KEY_UNLOCK2,
+	e |= twl_i2c_write_u8(TWL_MODULE_PM_MASTER, KEY_UNLOCK2,
 			R_PROTECT_KEY);
 	return e;
 }
 
-static void clocks_init(struct device *dev)
+static void clocks_init(struct device *dev,
+			struct twl4030_clock_init_data *clock)
 {
 	int e = 0;
 	struct clk *osc;
@@ -709,7 +881,7 @@ static void clocks_init(struct device *dev)
 		osc = clk_get(dev, "osc_sys_ck");
 
 	if (IS_ERR(osc)) {
-		printk(KERN_WARNING "Skipping twl4030 internal clock init and "
+		printk(KERN_WARNING "Skipping twl internal clock init and "
 				"using bootloader value (unknown osc rate)\n");
 		return;
 	}
@@ -723,7 +895,7 @@ static void clocks_init(struct device *dev)
 	 */
 	osc = ERR_PTR(-EIO);
 
-	printk(KERN_WARNING "Skipping twl4030 internal clock init and "
+	printk(KERN_WARNING "Skipping twl internal clock init and "
 	       "using bootloader value (unknown osc rate)\n");
 
 	return;
@@ -742,9 +914,12 @@ static void clocks_init(struct device *dev)
 	}
 
 	ctrl |= HIGH_PERF_SQ;
+	if (clock && clock->ck32k_lowpwr_enable)
+		ctrl |= CK32K_LOWPWR_EN;
+
 	e |= unprotect_pm_master();
 	/* effect->MADC+USB ck en */
-	e |= twl4030_i2c_write_u8(TWL4030_MODULE_PM_MASTER, ctrl, R_CFG_BOOT);
+	e |= twl_i2c_write_u8(TWL_MODULE_PM_MASTER, ctrl, R_CFG_BOOT);
 	e |= protect_pm_master();
 
 	if (e < 0)
@@ -753,24 +928,31 @@ static void clocks_init(struct device *dev)
 
 /*----------------------------------------------------------------------*/
 
-int twl_init_irq(int irq_num, unsigned irq_base, unsigned irq_end);
-int twl_exit_irq(void);
+int twl4030_init_irq(int irq_num, unsigned irq_base, unsigned irq_end);
+int twl4030_exit_irq(void);
+int twl4030_init_chip_irq(const char *chip);
+int twl6030_init_irq(int irq_num, unsigned irq_base, unsigned irq_end);
+int twl6030_exit_irq(void);
 
-static int twl4030_remove(struct i2c_client *client)
+static int twl_remove(struct i2c_client *client)
 {
 	unsigned i;
 	int status;
 
-	status = twl_exit_irq();
+	if (twl_class_is_4030())
+		status = twl4030_exit_irq();
+	else
+		status = twl6030_exit_irq();
+
 	if (status < 0)
 		return status;
 
-	for (i = 0; i < TWL4030_NUM_SLAVES; i++) {
-		struct twl4030_client	*twl = &twl4030_modules[i];
+	for (i = 0; i < TWL_NUM_SLAVES; i++) {
+		struct twl_client	*twl = &twl_modules[i];
 
 		if (twl->client && twl->client != client)
 			i2c_unregister_device(twl->client);
-		twl4030_modules[i].client = NULL;
+		twl_modules[i].client = NULL;
 	}
 	inuse = false;
 	return 0;
@@ -778,7 +960,7 @@ static int twl4030_remove(struct i2c_client *client)
 
 /* NOTE:  this driver only handles a single twl4030/tps659x0 chip */
 static int __init
-twl4030_probe(struct i2c_client *client, const struct i2c_device_id *id)
+twl_probe(struct i2c_client *client, const struct i2c_device_id *id)
 {
 	int				status;
 	unsigned			i;
@@ -799,8 +981,8 @@ twl4030_probe(struct i2c_client *client, const struct i2c_device_id *id)
 		return -EBUSY;
 	}
 
-	for (i = 0; i < TWL4030_NUM_SLAVES; i++) {
-		struct twl4030_client	*twl = &twl4030_modules[i];
+	for (i = 0; i < TWL_NUM_SLAVES; i++) {
+		struct twl_client	*twl = &twl_modules[i];
 
 		twl->address = client->addr + i;
 		if (i == 0)
@@ -814,15 +996,20 @@ twl4030_probe(struct i2c_client *client, const struct i2c_device_id *id)
 				status = -ENOMEM;
 				goto fail;
 			}
-			strlcpy(twl->client->name, id->name,
-					sizeof(twl->client->name));
 		}
 		mutex_init(&twl->xfer_lock);
 	}
 	inuse = true;
+	if ((id->driver_data) & TWL6030_CLASS) {
+		twl_id = TWL6030_CLASS_ID;
+		twl_map = &twl6030_map[0];
+	} else {
+		twl_id = TWL4030_CLASS_ID;
+		twl_map = &twl4030_map[0];
+	}
 
 	/* setup clock framework */
-	clocks_init(&client->dev);
+	clocks_init(&client->dev, pdata->clock);
 
 	/* load power event scripts */
 	if (twl_has_power() && pdata->power)
@@ -832,7 +1019,15 @@ twl4030_probe(struct i2c_client *client, const struct i2c_device_id *id)
 	if (client->irq
 			&& pdata->irq_base
 			&& pdata->irq_end > pdata->irq_base) {
-		status = twl_init_irq(client->irq, pdata->irq_base, pdata->irq_end);
+		if (twl_class_is_4030()) {
+			twl4030_init_chip_irq(id->name);
+			status = twl4030_init_irq(client->irq, pdata->irq_base,
+			pdata->irq_end);
+		} else {
+			status = twl6030_init_irq(client->irq, pdata->irq_base,
+			pdata->irq_end);
+		}
+
 		if (status < 0)
 			goto fail;
 	}
@@ -840,40 +1035,42 @@ twl4030_probe(struct i2c_client *client, const struct i2c_device_id *id)
 	status = add_children(pdata, id->driver_data);
 fail:
 	if (status < 0)
-		twl4030_remove(client);
+		twl_remove(client);
 	return status;
 }
 
-static const struct i2c_device_id twl4030_ids[] = {
+static const struct i2c_device_id twl_ids[] = {
 	{ "twl4030", TWL4030_VAUX2 },	/* "Triton 2" */
 	{ "twl5030", 0 },		/* T2 updated */
+	{ "twl5031", TWL5031 },		/* TWL5030 updated */
 	{ "tps65950", 0 },		/* catalog version of twl5030 */
 	{ "tps65930", TPS_SUBSET },	/* fewer LDOs and DACs; no charger */
 	{ "tps65920", TPS_SUBSET },	/* fewer LDOs; no codec or charger */
+	{ "twl6030", TWL6030_CLASS },	/* "Phoenix power chip" */
 	{ /* end of list */ },
 };
-MODULE_DEVICE_TABLE(i2c, twl4030_ids);
+MODULE_DEVICE_TABLE(i2c, twl_ids);
 
 /* One Client Driver , 4 Clients */
-static struct i2c_driver twl4030_driver = {
+static struct i2c_driver twl_driver = {
 	.driver.name	= DRIVER_NAME,
-	.id_table	= twl4030_ids,
-	.probe		= twl4030_probe,
-	.remove		= twl4030_remove,
+	.id_table	= twl_ids,
+	.probe		= twl_probe,
+	.remove		= twl_remove,
 };
 
-static int __init twl4030_init(void)
+static int __init twl_init(void)
 {
-	return i2c_add_driver(&twl4030_driver);
+	return i2c_add_driver(&twl_driver);
 }
-subsys_initcall(twl4030_init);
+subsys_initcall(twl_init);
 
-static void __exit twl4030_exit(void)
+static void __exit twl_exit(void)
 {
-	i2c_del_driver(&twl4030_driver);
+	i2c_del_driver(&twl_driver);
 }
-module_exit(twl4030_exit);
+module_exit(twl_exit);
 
 MODULE_AUTHOR("Texas Instruments, Inc.");
-MODULE_DESCRIPTION("I2C Core interface for TWL4030");
+MODULE_DESCRIPTION("I2C Core interface for TWL");
 MODULE_LICENSE("GPL");
diff --git a/drivers/mfd/twl4030-codec.c b/drivers/mfd/twl4030-codec.c
index 77b914907d7c..700b149c1b91 100644
--- a/drivers/mfd/twl4030-codec.c
+++ b/drivers/mfd/twl4030-codec.c
@@ -26,7 +26,7 @@
 #include <linux/kernel.h>
 #include <linux/fs.h>
 #include <linux/platform_device.h>
-#include <linux/i2c/twl4030.h>
+#include <linux/i2c/twl.h>
 #include <linux/mfd/core.h>
 #include <linux/mfd/twl4030-codec.h>
 
@@ -56,7 +56,7 @@ static int twl4030_codec_set_resource(enum twl4030_codec_res id, int enable)
 	struct twl4030_codec *codec = platform_get_drvdata(twl4030_codec_dev);
 	u8 val;
 
-	twl4030_i2c_read_u8(TWL4030_MODULE_AUDIO_VOICE, &val,
+	twl_i2c_read_u8(TWL4030_MODULE_AUDIO_VOICE, &val,
 			codec->resource[id].reg);
 
 	if (enable)
@@ -64,7 +64,7 @@ static int twl4030_codec_set_resource(enum twl4030_codec_res id, int enable)
 	else
 		val &= ~codec->resource[id].mask;
 
-	twl4030_i2c_write_u8(TWL4030_MODULE_AUDIO_VOICE,
+	twl_i2c_write_u8(TWL4030_MODULE_AUDIO_VOICE,
 					val, codec->resource[id].reg);
 
 	return val;
@@ -75,7 +75,7 @@ static inline int twl4030_codec_get_resource(enum twl4030_codec_res id)
 	struct twl4030_codec *codec = platform_get_drvdata(twl4030_codec_dev);
 	u8 val;
 
-	twl4030_i2c_read_u8(TWL4030_MODULE_AUDIO_VOICE, &val,
+	twl_i2c_read_u8(TWL4030_MODULE_AUDIO_VOICE, &val,
 			codec->resource[id].reg);
 
 	return val;
@@ -183,7 +183,7 @@ static int __devinit twl4030_codec_probe(struct platform_device *pdev)
 		dev_err(&pdev->dev, "Invalid audio_mclk\n");
 		return -EINVAL;
 	}
-	twl4030_i2c_write_u8(TWL4030_MODULE_AUDIO_VOICE,
+	twl_i2c_write_u8(TWL4030_MODULE_AUDIO_VOICE,
 					val, TWL4030_REG_APLL_CTL);
 
 	codec = kzalloc(sizeof(struct twl4030_codec), GFP_KERNEL);
diff --git a/drivers/mfd/twl4030-irq.c b/drivers/mfd/twl4030-irq.c
index fb194fe244c1..9df9a5ad38f9 100644
--- a/drivers/mfd/twl4030-irq.c
+++ b/drivers/mfd/twl4030-irq.c
@@ -32,7 +32,7 @@
 #include <linux/irq.h>
 #include <linux/kthread.h>
 
-#include <linux/i2c/twl4030.h>
+#include <linux/i2c/twl.h>
 
 
 /*
@@ -74,6 +74,8 @@ struct sih {
 	u8	edr_offset;
 	u8	bytes_edr;		/* bytelen of EDR */
 
+	u8	irq_lines;		/* number of supported irq lines */
+
 	/* SIR ignored -- set interrupt, for testing only */
 	struct irq_data {
 		u8	isr_offset;
@@ -82,6 +84,9 @@ struct sih {
 	/* + 2 bytes padding */
 };
 
+static const struct sih *sih_modules;
+static int nr_sih_modules;
+
 #define SIH_INITIALIZER(modname, nbits) \
 	.module		= TWL4030_MODULE_ ## modname, \
 	.control_offset = TWL4030_ ## modname ## _SIH_CTRL, \
@@ -89,6 +94,7 @@ struct sih {
 	.bytes_ixr	= DIV_ROUND_UP(nbits, 8), \
 	.edr_offset	= TWL4030_ ## modname ## _EDR, \
 	.bytes_edr	= DIV_ROUND_UP((2*(nbits)), 8), \
+	.irq_lines	= 2, \
 	.mask = { { \
 		.isr_offset	= TWL4030_ ## modname ## _ISR1, \
 		.imr_offset	= TWL4030_ ## modname ## _IMR1, \
@@ -107,7 +113,8 @@ struct sih {
 /* Order in this table matches order in PIH_ISR.  That is,
  * BIT(n) in PIH_ISR is sih_modules[n].
  */
-static const struct sih sih_modules[6] = {
+/* sih_modules_twl4030 is used both in twl4030 and twl5030 */
+static const struct sih sih_modules_twl4030[6] = {
 	[0] = {
 		.name		= "gpio",
 		.module		= TWL4030_MODULE_GPIO,
@@ -118,6 +125,7 @@ static const struct sih sih_modules[6] = {
 		/* Note: *all* of these IRQs default to no-trigger */
 		.edr_offset	= REG_GPIO_EDR1,
 		.bytes_edr	= 5,
+		.irq_lines	= 2,
 		.mask = { {
 			.isr_offset	= REG_GPIO_ISR1A,
 			.imr_offset	= REG_GPIO_IMR1A,
@@ -140,6 +148,7 @@ static const struct sih sih_modules[6] = {
 		.edr_offset	= TWL4030_INTERRUPTS_BCIEDR1,
 		/* Note: most of these IRQs default to no-trigger */
 		.bytes_edr	= 3,
+		.irq_lines	= 2,
 		.mask = { {
 			.isr_offset	= TWL4030_INTERRUPTS_BCIISR1A,
 			.imr_offset	= TWL4030_INTERRUPTS_BCIIMR1A,
@@ -164,6 +173,99 @@ static const struct sih sih_modules[6] = {
 		/* there are no SIH modules #6 or #7 ... */
 };
 
+static const struct sih sih_modules_twl5031[8] = {
+	[0] = {
+		.name		= "gpio",
+		.module		= TWL4030_MODULE_GPIO,
+		.control_offset	= REG_GPIO_SIH_CTRL,
+		.set_cor	= true,
+		.bits		= TWL4030_GPIO_MAX,
+		.bytes_ixr	= 3,
+		/* Note: *all* of these IRQs default to no-trigger */
+		.edr_offset	= REG_GPIO_EDR1,
+		.bytes_edr	= 5,
+		.irq_lines	= 2,
+		.mask = { {
+			.isr_offset	= REG_GPIO_ISR1A,
+			.imr_offset	= REG_GPIO_IMR1A,
+		}, {
+			.isr_offset	= REG_GPIO_ISR1B,
+			.imr_offset	= REG_GPIO_IMR1B,
+		}, },
+	},
+	[1] = {
+		.name		= "keypad",
+		.set_cor	= true,
+		SIH_INITIALIZER(KEYPAD_KEYP, 4)
+	},
+	[2] = {
+		.name		= "bci",
+		.module		= TWL5031_MODULE_INTERRUPTS,
+		.control_offset	= TWL5031_INTERRUPTS_BCISIHCTRL,
+		.bits		= 7,
+		.bytes_ixr	= 1,
+		.edr_offset	= TWL5031_INTERRUPTS_BCIEDR1,
+		/* Note: most of these IRQs default to no-trigger */
+		.bytes_edr	= 2,
+		.irq_lines	= 2,
+		.mask = { {
+			.isr_offset	= TWL5031_INTERRUPTS_BCIISR1,
+			.imr_offset	= TWL5031_INTERRUPTS_BCIIMR1,
+		}, {
+			.isr_offset	= TWL5031_INTERRUPTS_BCIISR2,
+			.imr_offset	= TWL5031_INTERRUPTS_BCIIMR2,
+		}, },
+	},
+	[3] = {
+		.name		= "madc",
+		SIH_INITIALIZER(MADC, 4)
+	},
+	[4] = {
+		/* USB doesn't use the same SIH organization */
+		.name		= "usb",
+	},
+	[5] = {
+		.name		= "power",
+		.set_cor	= true,
+		SIH_INITIALIZER(INT_PWR, 8)
+	},
+	[6] = {
+		/*
+		 * ACI doesn't use the same SIH organization.
+		 * For example, it supports only one interrupt line
+		 */
+		.name		= "aci",
+		.module		= TWL5031_MODULE_ACCESSORY,
+		.bits		= 9,
+		.bytes_ixr	= 2,
+		.irq_lines	= 1,
+		.mask = { {
+			.isr_offset	= TWL5031_ACIIDR_LSB,
+			.imr_offset	= TWL5031_ACIIMR_LSB,
+		}, },
+
+	},
+	[7] = {
+		/* Accessory */
+		.name		= "acc",
+		.module		= TWL5031_MODULE_ACCESSORY,
+		.control_offset	= TWL5031_ACCSIHCTRL,
+		.bits		= 2,
+		.bytes_ixr	= 1,
+		.edr_offset	= TWL5031_ACCEDR1,
+		/* Note: most of these IRQs default to no-trigger */
+		.bytes_edr	= 1,
+		.irq_lines	= 2,
+		.mask = { {
+			.isr_offset	= TWL5031_ACCISR1,
+			.imr_offset	= TWL5031_ACCIMR1,
+		}, {
+			.isr_offset	= TWL5031_ACCISR2,
+			.imr_offset	= TWL5031_ACCIMR2,
+		}, },
+	},
+};
+
 #undef TWL4030_MODULE_KEYPAD_KEYP
 #undef TWL4030_MODULE_INT_PWR
 #undef TWL4030_INT_PWR_EDR
@@ -194,7 +296,7 @@ static int twl4030_irq_thread(void *data)
 		/* Wait for IRQ, then read PIH irq status (also blocking) */
 		wait_for_completion_interruptible(&irq_event);
 
-		ret = twl4030_i2c_read_u8(TWL4030_MODULE_PIH, &pih_isr,
+		ret = twl_i2c_read_u8(TWL4030_MODULE_PIH, &pih_isr,
 					  REG_PIH_ISR_P1);
 		if (ret) {
 			pr_warning("twl4030: I2C error %d reading PIH ISR\n",
@@ -284,13 +386,17 @@ static int twl4030_init_sih_modules(unsigned line)
 	/* disable all interrupts on our line */
 	memset(buf, 0xff, sizeof buf);
 	sih = sih_modules;
-	for (i = 0; i < ARRAY_SIZE(sih_modules); i++, sih++) {
+	for (i = 0; i < nr_sih_modules; i++, sih++) {
 
 		/* skip USB -- it's funky */
 		if (!sih->bytes_ixr)
 			continue;
 
-		status = twl4030_i2c_write(sih->module, buf,
+		/* Not all the SIH modules support multiple interrupt lines */
+		if (sih->irq_lines <= line)
+			continue;
+
+		status = twl_i2c_write(sih->module, buf,
 				sih->mask[line].imr_offset, sih->bytes_ixr);
 		if (status < 0)
 			pr_err("twl4030: err %d initializing %s %s\n",
@@ -304,7 +410,7 @@ static int twl4030_init_sih_modules(unsigned line)
 		 * And for PWR_INT it's not documented...
 		 */
 		if (sih->set_cor) {
-			status = twl4030_i2c_write_u8(sih->module,
+			status = twl_i2c_write_u8(sih->module,
 					TWL4030_SIH_CTRL_COR_MASK,
 					sih->control_offset);
 			if (status < 0)
@@ -314,7 +420,7 @@ static int twl4030_init_sih_modules(unsigned line)
 	}
 
 	sih = sih_modules;
-	for (i = 0; i < ARRAY_SIZE(sih_modules); i++, sih++) {
+	for (i = 0; i < nr_sih_modules; i++, sih++) {
 		u8 rxbuf[4];
 		int j;
 
@@ -322,20 +428,24 @@ static int twl4030_init_sih_modules(unsigned line)
 		if (!sih->bytes_ixr)
 			continue;
 
+		/* Not all the SIH modules support multiple interrupt lines */
+		if (sih->irq_lines <= line)
+			continue;
+
 		/* Clear pending interrupt status.  Either the read was
 		 * enough, or we need to write those bits.  Repeat, in
 		 * case an IRQ is pending (PENDDIS=0) ... that's not
 		 * uncommon with PWR_INT.PWRON.
 		 */
 		for (j = 0; j < 2; j++) {
-			status = twl4030_i2c_read(sih->module, rxbuf,
+			status = twl_i2c_read(sih->module, rxbuf,
 				sih->mask[line].isr_offset, sih->bytes_ixr);
 			if (status < 0)
 				pr_err("twl4030: err %d initializing %s %s\n",
 					status, sih->name, "ISR");
 
 			if (!sih->set_cor)
-				status = twl4030_i2c_write(sih->module, buf,
+				status = twl_i2c_write(sih->module, buf,
 					sih->mask[line].isr_offset,
 					sih->bytes_ixr);
 			/* else COR=1 means read sufficed.
@@ -404,7 +514,7 @@ static void twl4030_sih_do_mask(struct work_struct *work)
 		return;
 
 	/* write the whole mask ... simpler than subsetting it */
-	status = twl4030_i2c_write(sih->module, imr.bytes,
+	status = twl_i2c_write(sih->module, imr.bytes,
 			sih->mask[irq_line].imr_offset, sih->bytes_ixr);
 	if (status)
 		pr_err("twl4030: %s, %s --> %d\n", __func__,
@@ -435,7 +545,7 @@ static void twl4030_sih_do_edge(struct work_struct *work)
 	 * any processor on the other IRQ line, EDR registers are
 	 * shared.
 	 */
-	status = twl4030_i2c_read(sih->module, bytes + 1,
+	status = twl_i2c_read(sih->module, bytes + 1,
 			sih->edr_offset, sih->bytes_edr);
 	if (status) {
 		pr_err("twl4030: %s, %s --> %d\n", __func__,
@@ -458,18 +568,18 @@ static void twl4030_sih_do_edge(struct work_struct *work)
 
 		bytes[byte] &= ~(0x03 << off);
 
-		spin_lock_irq(&d->lock);
+		raw_spin_lock_irq(&d->lock);
 		if (d->status & IRQ_TYPE_EDGE_RISING)
 			bytes[byte] |= BIT(off + 1);
 		if (d->status & IRQ_TYPE_EDGE_FALLING)
 			bytes[byte] |= BIT(off + 0);
-		spin_unlock_irq(&d->lock);
+		raw_spin_unlock_irq(&d->lock);
 
 		edge_change &= ~BIT(i);
 	}
 
 	/* Write */
-	status = twl4030_i2c_write(sih->module, bytes,
+	status = twl_i2c_write(sih->module, bytes,
 			sih->edr_offset, sih->bytes_edr);
 	if (status)
 		pr_err("twl4030: %s, %s --> %d\n", __func__,
@@ -554,7 +664,7 @@ static inline int sih_read_isr(const struct sih *sih)
 	/* FIXME need retry-on-error ... */
 
 	isr.word = 0;
-	status = twl4030_i2c_read(sih->module, isr.bytes,
+	status = twl_i2c_read(sih->module, isr.bytes,
 			sih->mask[irq_line].isr_offset, sih->bytes_ixr);
 
 	return (status < 0) ? status : le32_to_cpu(isr.word);
@@ -611,7 +721,7 @@ int twl4030_sih_setup(int module)
 
 	/* only support modules with standard clear-on-read for now */
 	for (sih_mod = 0, sih = sih_modules;
-			sih_mod < ARRAY_SIZE(sih_modules);
+			sih_mod < nr_sih_modules;
 			sih_mod++, sih++) {
 		if (sih->module == module && sih->set_cor) {
 			if (!WARN((irq_base + sih->bits) > NR_IRQS,
@@ -668,7 +778,7 @@ int twl4030_sih_setup(int module)
 /* FIXME pass in which interrupt line we'll use ... */
 #define twl_irq_line	0
 
-int twl_init_irq(int irq_num, unsigned irq_base, unsigned irq_end)
+int twl4030_init_irq(int irq_num, unsigned irq_base, unsigned irq_end)
 {
 	static struct irq_chip	twl4030_irq_chip;
 
@@ -728,7 +838,8 @@ int twl_init_irq(int irq_num, unsigned irq_base, unsigned irq_end)
 		goto fail_rqirq;
 	}
 
-	task = kthread_run(twl4030_irq_thread, (void *)irq_num, "twl4030-irq");
+	task = kthread_run(twl4030_irq_thread, (void *)(long)irq_num,
+								"twl4030-irq");
 	if (IS_ERR(task)) {
 		pr_err("twl4030: could not create irq %d thread!\n", irq_num);
 		status = PTR_ERR(task);
@@ -747,7 +858,7 @@ fail:
 	return status;
 }
 
-int twl_exit_irq(void)
+int twl4030_exit_irq(void)
 {
 	/* FIXME undo twl_init_irq() */
 	if (twl4030_irq_base) {
@@ -756,3 +867,16 @@ int twl_exit_irq(void)
 	}
 	return 0;
 }
+
+int twl4030_init_chip_irq(const char *chip)
+{
+	if (!strcmp(chip, "twl5031")) {
+		sih_modules = sih_modules_twl5031;
+		nr_sih_modules = ARRAY_SIZE(sih_modules_twl5031);
+	} else {
+		sih_modules = sih_modules_twl4030;
+		nr_sih_modules = ARRAY_SIZE(sih_modules_twl4030);
+	}
+
+	return 0;
+}
diff --git a/drivers/mfd/twl4030-power.c b/drivers/mfd/twl4030-power.c
index d423e0c4176b..0815292fdafc 100644
--- a/drivers/mfd/twl4030-power.c
+++ b/drivers/mfd/twl4030-power.c
@@ -26,7 +26,7 @@
 
 #include <linux/module.h>
 #include <linux/pm.h>
-#include <linux/i2c/twl4030.h>
+#include <linux/i2c/twl.h>
 #include <linux/platform_device.h>
 
 #include <asm/mach-types.h>
@@ -67,19 +67,35 @@ static u8 twl4030_start_script_address = 0x2b;
 #define R_KEY_1			0xC0
 #define R_KEY_2			0x0C
 
-/* resource configuration registers */
-
-#define DEVGROUP_OFFSET		0
+/* resource configuration registers
+   <RESOURCE>_DEV_GRP   at address 'n+0'
+   <RESOURCE>_TYPE      at address 'n+1'
+   <RESOURCE>_REMAP     at address 'n+2'
+   <RESOURCE>_DEDICATED at address 'n+3'
+*/
+#define DEV_GRP_OFFSET		0
 #define TYPE_OFFSET		1
+#define REMAP_OFFSET		2
+#define DEDICATED_OFFSET	3
+
+/* Bit positions in the registers */
+
+/* <RESOURCE>_DEV_GRP */
+#define DEV_GRP_SHIFT		5
+#define DEV_GRP_MASK		(7 << DEV_GRP_SHIFT)
 
-/* Bit positions */
-#define DEVGROUP_SHIFT		5
-#define DEVGROUP_MASK		(7 << DEVGROUP_SHIFT)
+/* <RESOURCE>_TYPE */
 #define TYPE_SHIFT		0
 #define TYPE_MASK		(7 << TYPE_SHIFT)
 #define TYPE2_SHIFT		3
 #define TYPE2_MASK		(3 << TYPE2_SHIFT)
 
+/* <RESOURCE>_REMAP */
+#define SLEEP_STATE_SHIFT	0
+#define SLEEP_STATE_MASK	(0xf << SLEEP_STATE_SHIFT)
+#define OFF_STATE_SHIFT		4
+#define OFF_STATE_MASK		(0xf << OFF_STATE_SHIFT)
+
 static u8 res_config_addrs[] = {
 	[RES_VAUX1]	= 0x17,
 	[RES_VAUX2]	= 0x1b,
@@ -115,11 +131,11 @@ static int __init twl4030_write_script_byte(u8 address, u8 byte)
 {
 	int err;
 
-	err = twl4030_i2c_write_u8(TWL4030_MODULE_PM_MASTER, address,
+	err = twl_i2c_write_u8(TWL4030_MODULE_PM_MASTER, address,
 				R_MEMORY_ADDRESS);
 	if (err)
 		goto out;
-	err = twl4030_i2c_write_u8(TWL4030_MODULE_PM_MASTER, byte,
+	err = twl_i2c_write_u8(TWL4030_MODULE_PM_MASTER, byte,
 				R_MEMORY_DATA);
 out:
 	return err;
@@ -176,18 +192,18 @@ static int __init twl4030_config_wakeup3_sequence(u8 address)
 	u8 data;
 
 	/* Set SLEEP to ACTIVE SEQ address for P3 */
-	err = twl4030_i2c_write_u8(TWL4030_MODULE_PM_MASTER, address,
+	err = twl_i2c_write_u8(TWL4030_MODULE_PM_MASTER, address,
 				R_SEQ_ADD_S2A3);
 	if (err)
 		goto out;
 
 	/* P3 LVL_WAKEUP should be on LEVEL */
-	err = twl4030_i2c_read_u8(TWL4030_MODULE_PM_MASTER, &data,
+	err = twl_i2c_read_u8(TWL4030_MODULE_PM_MASTER, &data,
 				R_P3_SW_EVENTS);
 	if (err)
 		goto out;
 	data |= LVL_WAKEUP;
-	err = twl4030_i2c_write_u8(TWL4030_MODULE_PM_MASTER, data,
+	err = twl_i2c_write_u8(TWL4030_MODULE_PM_MASTER, data,
 				R_P3_SW_EVENTS);
 out:
 	if (err)
@@ -201,42 +217,42 @@ static int __init twl4030_config_wakeup12_sequence(u8 address)
 	u8 data;
 
 	/* Set SLEEP to ACTIVE SEQ address for P1 and P2 */
-	err = twl4030_i2c_write_u8(TWL4030_MODULE_PM_MASTER, address,
+	err = twl_i2c_write_u8(TWL4030_MODULE_PM_MASTER, address,
 				R_SEQ_ADD_S2A12);
 	if (err)
 		goto out;
 
 	/* P1/P2 LVL_WAKEUP should be on LEVEL */
-	err = twl4030_i2c_read_u8(TWL4030_MODULE_PM_MASTER, &data,
+	err = twl_i2c_read_u8(TWL4030_MODULE_PM_MASTER, &data,
 				R_P1_SW_EVENTS);
 	if (err)
 		goto out;
 
 	data |= LVL_WAKEUP;
-	err = twl4030_i2c_write_u8(TWL4030_MODULE_PM_MASTER, data,
+	err = twl_i2c_write_u8(TWL4030_MODULE_PM_MASTER, data,
 				R_P1_SW_EVENTS);
 	if (err)
 		goto out;
 
-	err = twl4030_i2c_read_u8(TWL4030_MODULE_PM_MASTER, &data,
+	err = twl_i2c_read_u8(TWL4030_MODULE_PM_MASTER, &data,
 				R_P2_SW_EVENTS);
 	if (err)
 		goto out;
 
 	data |= LVL_WAKEUP;
-	err = twl4030_i2c_write_u8(TWL4030_MODULE_PM_MASTER, data,
+	err = twl_i2c_write_u8(TWL4030_MODULE_PM_MASTER, data,
 				R_P2_SW_EVENTS);
 	if (err)
 		goto out;
 
 	if (machine_is_omap_3430sdp() || machine_is_omap_ldp()) {
 		/* Disabling AC charger effect on sleep-active transitions */
-		err = twl4030_i2c_read_u8(TWL4030_MODULE_PM_MASTER, &data,
+		err = twl_i2c_read_u8(TWL4030_MODULE_PM_MASTER, &data,
 					R_CFG_P1_TRANSITION);
 		if (err)
 			goto out;
 		data &= ~(1<<1);
-		err = twl4030_i2c_write_u8(TWL4030_MODULE_PM_MASTER, data ,
+		err = twl_i2c_write_u8(TWL4030_MODULE_PM_MASTER, data ,
 					R_CFG_P1_TRANSITION);
 		if (err)
 			goto out;
@@ -254,7 +270,7 @@ static int __init twl4030_config_sleep_sequence(u8 address)
 	int err;
 
 	/* Set ACTIVE to SLEEP SEQ address in T2 memory*/
-	err = twl4030_i2c_write_u8(TWL4030_MODULE_PM_MASTER, address,
+	err = twl_i2c_write_u8(TWL4030_MODULE_PM_MASTER, address,
 				R_SEQ_ADD_A2S);
 
 	if (err)
@@ -269,41 +285,41 @@ static int __init twl4030_config_warmreset_sequence(u8 address)
 	u8 rd_data;
 
 	/* Set WARM RESET SEQ address for P1 */
-	err = twl4030_i2c_write_u8(TWL4030_MODULE_PM_MASTER, address,
+	err = twl_i2c_write_u8(TWL4030_MODULE_PM_MASTER, address,
 				R_SEQ_ADD_WARM);
 	if (err)
 		goto out;
 
 	/* P1/P2/P3 enable WARMRESET */
-	err = twl4030_i2c_read_u8(TWL4030_MODULE_PM_MASTER, &rd_data,
+	err = twl_i2c_read_u8(TWL4030_MODULE_PM_MASTER, &rd_data,
 				R_P1_SW_EVENTS);
 	if (err)
 		goto out;
 
 	rd_data |= ENABLE_WARMRESET;
-	err = twl4030_i2c_write_u8(TWL4030_MODULE_PM_MASTER, rd_data,
+	err = twl_i2c_write_u8(TWL4030_MODULE_PM_MASTER, rd_data,
 				R_P1_SW_EVENTS);
 	if (err)
 		goto out;
 
-	err = twl4030_i2c_read_u8(TWL4030_MODULE_PM_MASTER, &rd_data,
+	err = twl_i2c_read_u8(TWL4030_MODULE_PM_MASTER, &rd_data,
 				R_P2_SW_EVENTS);
 	if (err)
 		goto out;
 
 	rd_data |= ENABLE_WARMRESET;
-	err = twl4030_i2c_write_u8(TWL4030_MODULE_PM_MASTER, rd_data,
+	err = twl_i2c_write_u8(TWL4030_MODULE_PM_MASTER, rd_data,
 				R_P2_SW_EVENTS);
 	if (err)
 		goto out;
 
-	err = twl4030_i2c_read_u8(TWL4030_MODULE_PM_MASTER, &rd_data,
+	err = twl_i2c_read_u8(TWL4030_MODULE_PM_MASTER, &rd_data,
 				R_P3_SW_EVENTS);
 	if (err)
 		goto out;
 
 	rd_data |= ENABLE_WARMRESET;
-	err = twl4030_i2c_write_u8(TWL4030_MODULE_PM_MASTER, rd_data,
+	err = twl_i2c_write_u8(TWL4030_MODULE_PM_MASTER, rd_data,
 				R_P3_SW_EVENTS);
 out:
 	if (err)
@@ -317,6 +333,7 @@ static int __init twl4030_configure_resource(struct twl4030_resconfig *rconfig)
 	int err;
 	u8 type;
 	u8 grp;
+	u8 remap;
 
 	if (rconfig->resource > TOTAL_RESOURCES) {
 		pr_err("TWL4030 Resource %d does not exist\n",
@@ -327,19 +344,19 @@ static int __init twl4030_configure_resource(struct twl4030_resconfig *rconfig)
 	rconfig_addr = res_config_addrs[rconfig->resource];
 
 	/* Set resource group */
-	err = twl4030_i2c_read_u8(TWL4030_MODULE_PM_RECEIVER, &grp,
-				rconfig_addr + DEVGROUP_OFFSET);
+	err = twl_i2c_read_u8(TWL4030_MODULE_PM_RECEIVER, &grp,
+			      rconfig_addr + DEV_GRP_OFFSET);
 	if (err) {
 		pr_err("TWL4030 Resource %d group could not be read\n",
 			rconfig->resource);
 		return err;
 	}
 
-	if (rconfig->devgroup >= 0) {
-		grp &= ~DEVGROUP_MASK;
-		grp |= rconfig->devgroup << DEVGROUP_SHIFT;
-		err = twl4030_i2c_write_u8(TWL4030_MODULE_PM_RECEIVER,
-					grp, rconfig_addr + DEVGROUP_OFFSET);
+	if (rconfig->devgroup != TWL4030_RESCONFIG_UNDEF) {
+		grp &= ~DEV_GRP_MASK;
+		grp |= rconfig->devgroup << DEV_GRP_SHIFT;
+		err = twl_i2c_write_u8(TWL4030_MODULE_PM_RECEIVER,
+				       grp, rconfig_addr + DEV_GRP_OFFSET);
 		if (err < 0) {
 			pr_err("TWL4030 failed to program devgroup\n");
 			return err;
@@ -347,7 +364,7 @@ static int __init twl4030_configure_resource(struct twl4030_resconfig *rconfig)
 	}
 
 	/* Set resource types */
-	err = twl4030_i2c_read_u8(TWL4030_MODULE_PM_RECEIVER, &type,
+	err = twl_i2c_read_u8(TWL4030_MODULE_PM_RECEIVER, &type,
 				rconfig_addr + TYPE_OFFSET);
 	if (err < 0) {
 		pr_err("TWL4030 Resource %d type could not be read\n",
@@ -355,23 +372,50 @@ static int __init twl4030_configure_resource(struct twl4030_resconfig *rconfig)
 		return err;
 	}
 
-	if (rconfig->type >= 0) {
+	if (rconfig->type != TWL4030_RESCONFIG_UNDEF) {
 		type &= ~TYPE_MASK;
 		type |= rconfig->type << TYPE_SHIFT;
 	}
 
-	if (rconfig->type2 >= 0) {
+	if (rconfig->type2 != TWL4030_RESCONFIG_UNDEF) {
 		type &= ~TYPE2_MASK;
 		type |= rconfig->type2 << TYPE2_SHIFT;
 	}
 
-	err = twl4030_i2c_write_u8(TWL4030_MODULE_PM_RECEIVER,
+	err = twl_i2c_write_u8(TWL4030_MODULE_PM_RECEIVER,
 				type, rconfig_addr + TYPE_OFFSET);
 	if (err < 0) {
 		pr_err("TWL4030 failed to program resource type\n");
 		return err;
 	}
 
+	/* Set remap states */
+	err = twl_i2c_read_u8(TWL4030_MODULE_PM_RECEIVER, &remap,
+			      rconfig_addr + REMAP_OFFSET);
+	if (err < 0) {
+		pr_err("TWL4030 Resource %d remap could not be read\n",
+			rconfig->resource);
+		return err;
+	}
+
+	if (rconfig->remap_off != TWL4030_RESCONFIG_UNDEF) {
+		remap &= ~OFF_STATE_MASK;
+		remap |= rconfig->remap_off << OFF_STATE_SHIFT;
+	}
+
+	if (rconfig->remap_sleep != TWL4030_RESCONFIG_UNDEF) {
+		remap &= ~SLEEP_STATE_MASK;
+		remap |= rconfig->remap_off << SLEEP_STATE_SHIFT;
+	}
+
+	err = twl_i2c_write_u8(TWL4030_MODULE_PM_RECEIVER,
+			       remap,
+			       rconfig_addr + REMAP_OFFSET);
+	if (err < 0) {
+		pr_err("TWL4030 failed to program remap\n");
+		return err;
+	}
+
 	return 0;
 }
 
@@ -424,12 +468,12 @@ void __init twl4030_power_init(struct twl4030_power_data *twl4030_scripts)
 	struct twl4030_resconfig *resconfig;
 	u8 address = twl4030_start_script_address;
 
-	err = twl4030_i2c_write_u8(TWL4030_MODULE_PM_MASTER, R_KEY_1,
+	err = twl_i2c_write_u8(TWL4030_MODULE_PM_MASTER, R_KEY_1,
 				R_PROTECT_KEY);
 	if (err)
 		goto unlock;
 
-	err = twl4030_i2c_write_u8(TWL4030_MODULE_PM_MASTER, R_KEY_2,
+	err = twl_i2c_write_u8(TWL4030_MODULE_PM_MASTER, R_KEY_2,
 				R_PROTECT_KEY);
 	if (err)
 		goto unlock;
@@ -452,7 +496,7 @@ void __init twl4030_power_init(struct twl4030_power_data *twl4030_scripts)
 		}
 	}
 
-	err = twl4030_i2c_write_u8(TWL4030_MODULE_PM_MASTER, 0, R_PROTECT_KEY);
+	err = twl_i2c_write_u8(TWL4030_MODULE_PM_MASTER, 0, R_PROTECT_KEY);
 	if (err)
 		pr_err("TWL4030 Unable to relock registers\n");
 	return;
diff --git a/drivers/mfd/twl6030-irq.c b/drivers/mfd/twl6030-irq.c
new file mode 100644
index 000000000000..10bf228ad626
--- /dev/null
+++ b/drivers/mfd/twl6030-irq.c
@@ -0,0 +1,299 @@
+/*
+ * twl6030-irq.c - TWL6030 irq support
+ *
+ * Copyright (C) 2005-2009 Texas Instruments, Inc.
+ *
+ * Modifications to defer interrupt handling to a kernel thread:
+ * Copyright (C) 2006 MontaVista Software, Inc.
+ *
+ * Based on tlv320aic23.c:
+ * Copyright (c) by Kai Svahn <kai.svahn@nokia.com>
+ *
+ * Code cleanup and modifications to IRQ handler.
+ * by syed khasim <x0khasim@ti.com>
+ *
+ * TWL6030 specific code and IRQ handling changes by
+ * Jagadeesh Bhaskar Pakaravoor <j-pakaravoor@ti.com>
+ * Balaji T K <balajitk@ti.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
+ */
+
+#include <linux/init.h>
+#include <linux/interrupt.h>
+#include <linux/irq.h>
+#include <linux/kthread.h>
+#include <linux/i2c/twl.h>
+
+/*
+ * TWL6030 (unlike its predecessors, which had two level interrupt handling)
+ * three interrupt registers INT_STS_A, INT_STS_B and INT_STS_C.
+ * It exposes status bits saying who has raised an interrupt. There are
+ * three mask registers that corresponds to these status registers, that
+ * enables/disables these interrupts.
+ *
+ * We set up IRQs starting at a platform-specified base. An interrupt map table,
+ * specifies mapping between interrupt number and the associated module.
+ *
+ */
+
+static int twl6030_interrupt_mapping[24] = {
+	PWR_INTR_OFFSET,	/* Bit 0	PWRON			*/
+	PWR_INTR_OFFSET,	/* Bit 1	RPWRON			*/
+	PWR_INTR_OFFSET,	/* Bit 2	BAT_VLOW		*/
+	RTC_INTR_OFFSET,	/* Bit 3	RTC_ALARM		*/
+	RTC_INTR_OFFSET,	/* Bit 4	RTC_PERIOD		*/
+	HOTDIE_INTR_OFFSET,	/* Bit 5	HOT_DIE			*/
+	SMPSLDO_INTR_OFFSET,	/* Bit 6	VXXX_SHORT		*/
+	SMPSLDO_INTR_OFFSET,	/* Bit 7	VMMC_SHORT		*/
+
+	SMPSLDO_INTR_OFFSET,	/* Bit 8	VUSIM_SHORT		*/
+	BATDETECT_INTR_OFFSET,	/* Bit 9	BAT			*/
+	SIMDETECT_INTR_OFFSET,	/* Bit 10	SIM			*/
+	MMCDETECT_INTR_OFFSET,	/* Bit 11	MMC			*/
+	RSV_INTR_OFFSET,  	/* Bit 12	Reserved		*/
+	MADC_INTR_OFFSET,	/* Bit 13	GPADC_RT_EOC		*/
+	MADC_INTR_OFFSET,	/* Bit 14	GPADC_SW_EOC		*/
+	GASGAUGE_INTR_OFFSET,	/* Bit 15	CC_AUTOCAL		*/
+
+	USBOTG_INTR_OFFSET,	/* Bit 16	ID_WKUP			*/
+	USBOTG_INTR_OFFSET,	/* Bit 17	VBUS_WKUP		*/
+	USBOTG_INTR_OFFSET,	/* Bit 18	ID			*/
+	USBOTG_INTR_OFFSET,	/* Bit 19	VBUS			*/
+	CHARGER_INTR_OFFSET,	/* Bit 20	CHRG_CTRL		*/
+	CHARGER_INTR_OFFSET,	/* Bit 21	EXT_CHRG		*/
+	CHARGER_INTR_OFFSET,	/* Bit 22	INT_CHRG		*/
+	RSV_INTR_OFFSET,	/* Bit 23	Reserved		*/
+};
+/*----------------------------------------------------------------------*/
+
+static unsigned twl6030_irq_base;
+
+static struct completion irq_event;
+
+/*
+ * This thread processes interrupts reported by the Primary Interrupt Handler.
+ */
+static int twl6030_irq_thread(void *data)
+{
+	long irq = (long)data;
+	static unsigned i2c_errors;
+	static const unsigned max_i2c_errors = 100;
+	int ret;
+
+	current->flags |= PF_NOFREEZE;
+
+	while (!kthread_should_stop()) {
+		int i;
+		union {
+		u8 bytes[4];
+		u32 int_sts;
+		} sts;
+
+		/* Wait for IRQ, then read PIH irq status (also blocking) */
+		wait_for_completion_interruptible(&irq_event);
+
+		/* read INT_STS_A, B and C in one shot using a burst read */
+		ret = twl_i2c_read(TWL_MODULE_PIH, sts.bytes,
+				REG_INT_STS_A, 3);
+		if (ret) {
+			pr_warning("twl6030: I2C error %d reading PIH ISR\n",
+					ret);
+			if (++i2c_errors >= max_i2c_errors) {
+				printk(KERN_ERR "Maximum I2C error count"
+						" exceeded.  Terminating %s.\n",
+						__func__);
+				break;
+			}
+			complete(&irq_event);
+			continue;
+		}
+
+
+
+		sts.bytes[3] = 0; /* Only 24 bits are valid*/
+
+		for (i = 0; sts.int_sts; sts.int_sts >>= 1, i++) {
+			local_irq_disable();
+			if (sts.int_sts & 0x1) {
+				int module_irq = twl6030_irq_base +
+					twl6030_interrupt_mapping[i];
+				struct irq_desc *d = irq_to_desc(module_irq);
+
+				if (!d) {
+					pr_err("twl6030: Invalid SIH IRQ: %d\n",
+					       module_irq);
+					return -EINVAL;
+				}
+
+				/* These can't be masked ... always warn
+				 * if we get any surprises.
+				 */
+				if (d->status & IRQ_DISABLED)
+					note_interrupt(module_irq, d,
+							IRQ_NONE);
+				else
+					d->handle_irq(module_irq, d);
+
+			}
+		local_irq_enable();
+		}
+		ret = twl_i2c_write(TWL_MODULE_PIH, sts.bytes,
+				REG_INT_STS_A, 3); /* clear INT_STS_A */
+		if (ret)
+			pr_warning("twl6030: I2C error in clearing PIH ISR\n");
+
+		enable_irq(irq);
+	}
+
+	return 0;
+}
+
+/*
+ * handle_twl6030_int() is the desc->handle method for the twl6030 interrupt.
+ * This is a chained interrupt, so there is no desc->action method for it.
+ * Now we need to query the interrupt controller in the twl6030 to determine
+ * which module is generating the interrupt request.  However, we can't do i2c
+ * transactions in interrupt context, so we must defer that work to a kernel
+ * thread.  All we do here is acknowledge and mask the interrupt and wakeup
+ * the kernel thread.
+ */
+static irqreturn_t handle_twl6030_pih(int irq, void *devid)
+{
+	disable_irq_nosync(irq);
+	complete(devid);
+	return IRQ_HANDLED;
+}
+
+/*----------------------------------------------------------------------*/
+
+static inline void activate_irq(int irq)
+{
+#ifdef CONFIG_ARM
+	/* ARM requires an extra step to clear IRQ_NOREQUEST, which it
+	 * sets on behalf of every irq_chip.  Also sets IRQ_NOPROBE.
+	 */
+	set_irq_flags(irq, IRQF_VALID);
+#else
+	/* same effect on other architectures */
+	set_irq_noprobe(irq);
+#endif
+}
+
+/*----------------------------------------------------------------------*/
+
+static unsigned twl6030_irq_next;
+
+/*----------------------------------------------------------------------*/
+int twl6030_interrupt_unmask(u8 bit_mask, u8 offset)
+{
+	int ret;
+	u8 unmask_value;
+	ret = twl_i2c_read_u8(TWL_MODULE_PIH, &unmask_value,
+			REG_INT_STS_A + offset);
+	unmask_value &= (~(bit_mask));
+	ret |= twl_i2c_write_u8(TWL_MODULE_PIH, unmask_value,
+			REG_INT_STS_A + offset); /* unmask INT_MSK_A/B/C */
+	return ret;
+}
+EXPORT_SYMBOL(twl6030_interrupt_unmask);
+
+int twl6030_interrupt_mask(u8 bit_mask, u8 offset)
+{
+	int ret;
+	u8 mask_value;
+	ret = twl_i2c_read_u8(TWL_MODULE_PIH, &mask_value,
+			REG_INT_STS_A + offset);
+	mask_value |= (bit_mask);
+	ret |= twl_i2c_write_u8(TWL_MODULE_PIH, mask_value,
+			REG_INT_STS_A + offset); /* mask INT_MSK_A/B/C */
+	return ret;
+}
+EXPORT_SYMBOL(twl6030_interrupt_mask);
+
+int twl6030_init_irq(int irq_num, unsigned irq_base, unsigned irq_end)
+{
+
+	int	status = 0;
+	int	i;
+	struct task_struct	*task;
+	int ret;
+	u8 mask[4];
+
+	static struct irq_chip	twl6030_irq_chip;
+	mask[1] = 0xFF;
+	mask[2] = 0xFF;
+	mask[3] = 0xFF;
+	ret = twl_i2c_write(TWL_MODULE_PIH, &mask[0],
+			REG_INT_MSK_LINE_A, 3); /* MASK ALL INT LINES */
+	ret = twl_i2c_write(TWL_MODULE_PIH, &mask[0],
+			REG_INT_MSK_STS_A, 3); /* MASK ALL INT STS */
+	ret = twl_i2c_write(TWL_MODULE_PIH, &mask[0],
+			REG_INT_STS_A, 3); /* clear INT_STS_A,B,C */
+
+	twl6030_irq_base = irq_base;
+
+	/* install an irq handler for each of the modules;
+	 * clone dummy irq_chip since PIH can't *do* anything
+	 */
+	twl6030_irq_chip = dummy_irq_chip;
+	twl6030_irq_chip.name = "twl6030";
+	twl6030_irq_chip.set_type = NULL;
+
+	for (i = irq_base; i < irq_end; i++) {
+		set_irq_chip_and_handler(i, &twl6030_irq_chip,
+				handle_simple_irq);
+		activate_irq(i);
+	}
+
+	twl6030_irq_next = i;
+	pr_info("twl6030: %s (irq %d) chaining IRQs %d..%d\n", "PIH",
+			irq_num, irq_base, twl6030_irq_next - 1);
+
+	/* install an irq handler to demultiplex the TWL6030 interrupt */
+	init_completion(&irq_event);
+	task = kthread_run(twl6030_irq_thread, (void *)irq_num, "twl6030-irq");
+	if (IS_ERR(task)) {
+		pr_err("twl6030: could not create irq %d thread!\n", irq_num);
+		status = PTR_ERR(task);
+		goto fail_kthread;
+	}
+
+	status = request_irq(irq_num, handle_twl6030_pih, IRQF_DISABLED,
+				"TWL6030-PIH", &irq_event);
+	if (status < 0) {
+		pr_err("twl6030: could not claim irq%d: %d\n", irq_num, status);
+		goto fail_irq;
+	}
+	return status;
+fail_irq:
+	free_irq(irq_num, &irq_event);
+
+fail_kthread:
+	for (i = irq_base; i < irq_end; i++)
+		set_irq_chip_and_handler(i, NULL, NULL);
+	return status;
+}
+
+int twl6030_exit_irq(void)
+{
+
+	if (twl6030_irq_base) {
+		pr_err("twl6030: can't yet clean up IRQs?\n");
+		return -ENOSYS;
+	}
+	return 0;
+}
+
diff --git a/drivers/mfd/ucb1400_core.c b/drivers/mfd/ucb1400_core.c
index fa294b6d600a..85fd9421be94 100644
--- a/drivers/mfd/ucb1400_core.c
+++ b/drivers/mfd/ucb1400_core.c
@@ -51,6 +51,7 @@ static int ucb1400_core_probe(struct device *dev)
 	struct ucb1400_ts ucb_ts;
 	struct ucb1400_gpio ucb_gpio;
 	struct snd_ac97 *ac97;
+	struct ucb1400_pdata *pdata = dev->platform_data;
 
 	memset(&ucb_ts, 0, sizeof(ucb_ts));
 	memset(&ucb_gpio, 0, sizeof(ucb_gpio));
@@ -88,6 +89,12 @@ static int ucb1400_core_probe(struct device *dev)
 
 	/* TOUCHSCREEN */
 	ucb_ts.ac97 = ac97;
+
+	if (pdata != NULL && pdata->irq >= 0)
+		ucb_ts.irq = pdata->irq;
+	else
+		ucb_ts.irq = -1;
+
 	ucb->ucb1400_ts = platform_device_alloc("ucb1400_ts", -1);
 	if (!ucb->ucb1400_ts) {
 		err = -ENOMEM;
diff --git a/drivers/mfd/wm831x-core.c b/drivers/mfd/wm831x-core.c
index 7f27576ca046..4b2021af1d96 100644
--- a/drivers/mfd/wm831x-core.c
+++ b/drivers/mfd/wm831x-core.c
@@ -90,9 +90,10 @@ int wm831x_isinkv_values[WM831X_ISINK_MAX_ISEL + 1] = {
 EXPORT_SYMBOL_GPL(wm831x_isinkv_values);
 
 enum wm831x_parent {
-	WM8310 = 0,
-	WM8311 = 1,
-	WM8312 = 2,
+	WM8310 = 0x8310,
+	WM8311 = 0x8311,
+	WM8312 = 0x8312,
+	WM8320 = 0x8320,
 };
 
 static int wm831x_reg_locked(struct wm831x *wm831x, unsigned short reg)
@@ -478,6 +479,20 @@ static struct resource wm831x_dcdc4_resources[] = {
 	},
 };
 
+static struct resource wm8320_dcdc4_buck_resources[] = {
+	{
+		.start = WM831X_DC4_CONTROL,
+		.end   = WM832X_DC4_SLEEP_CONTROL,
+		.flags = IORESOURCE_IO,
+	},
+	{
+		.name  = "UV",
+		.start = WM831X_IRQ_UV_DC4,
+		.end   = WM831X_IRQ_UV_DC4,
+		.flags = IORESOURCE_IRQ,
+	},
+};
+
 static struct resource wm831x_gpio_resources[] = {
 	{
 		.start = WM831X_IRQ_GPIO_1,
@@ -794,6 +809,9 @@ static struct resource wm831x_wdt_resources[] = {
 
 static struct mfd_cell wm8310_devs[] = {
 	{
+		.name = "wm831x-backup",
+	},
+	{
 		.name = "wm831x-buckv",
 		.id = 1,
 		.num_resources = ARRAY_SIZE(wm831x_dcdc1_resources),
@@ -947,6 +965,9 @@ static struct mfd_cell wm8310_devs[] = {
 
 static struct mfd_cell wm8311_devs[] = {
 	{
+		.name = "wm831x-backup",
+	},
+	{
 		.name = "wm831x-buckv",
 		.id = 1,
 		.num_resources = ARRAY_SIZE(wm831x_dcdc1_resources),
@@ -1081,6 +1102,9 @@ static struct mfd_cell wm8311_devs[] = {
 
 static struct mfd_cell wm8312_devs[] = {
 	{
+		.name = "wm831x-backup",
+	},
+	{
 		.name = "wm831x-buckv",
 		.id = 1,
 		.num_resources = ARRAY_SIZE(wm831x_dcdc1_resources),
@@ -1237,6 +1261,137 @@ static struct mfd_cell wm8312_devs[] = {
 	},
 };
 
+static struct mfd_cell wm8320_devs[] = {
+	{
+		.name = "wm831x-backup",
+	},
+	{
+		.name = "wm831x-buckv",
+		.id = 1,
+		.num_resources = ARRAY_SIZE(wm831x_dcdc1_resources),
+		.resources = wm831x_dcdc1_resources,
+	},
+	{
+		.name = "wm831x-buckv",
+		.id = 2,
+		.num_resources = ARRAY_SIZE(wm831x_dcdc2_resources),
+		.resources = wm831x_dcdc2_resources,
+	},
+	{
+		.name = "wm831x-buckp",
+		.id = 3,
+		.num_resources = ARRAY_SIZE(wm831x_dcdc3_resources),
+		.resources = wm831x_dcdc3_resources,
+	},
+	{
+		.name = "wm831x-buckp",
+		.id = 4,
+		.num_resources = ARRAY_SIZE(wm8320_dcdc4_buck_resources),
+		.resources = wm8320_dcdc4_buck_resources,
+	},
+	{
+		.name = "wm831x-gpio",
+		.num_resources = ARRAY_SIZE(wm831x_gpio_resources),
+		.resources = wm831x_gpio_resources,
+	},
+	{
+		.name = "wm831x-hwmon",
+	},
+	{
+		.name = "wm831x-ldo",
+		.id = 1,
+		.num_resources = ARRAY_SIZE(wm831x_ldo1_resources),
+		.resources = wm831x_ldo1_resources,
+	},
+	{
+		.name = "wm831x-ldo",
+		.id = 2,
+		.num_resources = ARRAY_SIZE(wm831x_ldo2_resources),
+		.resources = wm831x_ldo2_resources,
+	},
+	{
+		.name = "wm831x-ldo",
+		.id = 3,
+		.num_resources = ARRAY_SIZE(wm831x_ldo3_resources),
+		.resources = wm831x_ldo3_resources,
+	},
+	{
+		.name = "wm831x-ldo",
+		.id = 4,
+		.num_resources = ARRAY_SIZE(wm831x_ldo4_resources),
+		.resources = wm831x_ldo4_resources,
+	},
+	{
+		.name = "wm831x-ldo",
+		.id = 5,
+		.num_resources = ARRAY_SIZE(wm831x_ldo5_resources),
+		.resources = wm831x_ldo5_resources,
+	},
+	{
+		.name = "wm831x-ldo",
+		.id = 6,
+		.num_resources = ARRAY_SIZE(wm831x_ldo6_resources),
+		.resources = wm831x_ldo6_resources,
+	},
+	{
+		.name = "wm831x-aldo",
+		.id = 7,
+		.num_resources = ARRAY_SIZE(wm831x_ldo7_resources),
+		.resources = wm831x_ldo7_resources,
+	},
+	{
+		.name = "wm831x-aldo",
+		.id = 8,
+		.num_resources = ARRAY_SIZE(wm831x_ldo8_resources),
+		.resources = wm831x_ldo8_resources,
+	},
+	{
+		.name = "wm831x-aldo",
+		.id = 9,
+		.num_resources = ARRAY_SIZE(wm831x_ldo9_resources),
+		.resources = wm831x_ldo9_resources,
+	},
+	{
+		.name = "wm831x-aldo",
+		.id = 10,
+		.num_resources = ARRAY_SIZE(wm831x_ldo10_resources),
+		.resources = wm831x_ldo10_resources,
+	},
+	{
+		.name = "wm831x-alive-ldo",
+		.id = 11,
+		.num_resources = ARRAY_SIZE(wm831x_ldo11_resources),
+		.resources = wm831x_ldo11_resources,
+	},
+	{
+		.name = "wm831x-on",
+		.num_resources = ARRAY_SIZE(wm831x_on_resources),
+		.resources = wm831x_on_resources,
+	},
+	{
+		.name = "wm831x-rtc",
+		.num_resources = ARRAY_SIZE(wm831x_rtc_resources),
+		.resources = wm831x_rtc_resources,
+	},
+	{
+		.name = "wm831x-status",
+		.id = 1,
+		.num_resources = ARRAY_SIZE(wm831x_status1_resources),
+		.resources = wm831x_status1_resources,
+	},
+	{
+		.name = "wm831x-status",
+		.id = 2,
+		.num_resources = ARRAY_SIZE(wm831x_status2_resources),
+		.resources = wm831x_status2_resources,
+	},
+	{
+		.name = "wm831x-watchdog",
+		.num_resources = ARRAY_SIZE(wm831x_wdt_resources),
+		.resources = wm831x_wdt_resources,
+	},
+};
+
 static struct mfd_cell backlight_devs[] = {
 	{
 		.name = "wm831x-backlight",
@@ -1282,50 +1437,37 @@ static int wm831x_device_init(struct wm831x *wm831x, unsigned long id, int irq)
 		goto err;
 	}
 
+	/* Some engineering samples do not have the ID set, rely on
+	 * the device being registered correctly.
+	 */
+	if (ret == 0) {
+		dev_info(wm831x->dev, "Device is an engineering sample\n");
+		ret = id;
+	}
+
 	switch (ret) {
-	case 0x8310:
+	case WM8310:
 		parent = WM8310;
-		switch (rev) {
-		case 0:
-			dev_info(wm831x->dev, "WM8310 revision %c\n",
-				 'A' + rev);
-			break;
-		}
+		wm831x->num_gpio = 16;
+		dev_info(wm831x->dev, "WM8310 revision %c\n", 'A' + rev);
 		break;
 
-	case 0x8311:
+	case WM8311:
 		parent = WM8311;
-		switch (rev) {
-		case 0:
-			dev_info(wm831x->dev, "WM8311 revision %c\n",
-				 'A' + rev);
-			break;
-		}
+		wm831x->num_gpio = 16;
+		dev_info(wm831x->dev, "WM8311 revision %c\n", 'A' + rev);
 		break;
 
-	case 0x8312:
+	case WM8312:
 		parent = WM8312;
-		switch (rev) {
-		case 0:
-			dev_info(wm831x->dev, "WM8312 revision %c\n",
-				 'A' + rev);
-			break;
-		}
+		wm831x->num_gpio = 16;
+		dev_info(wm831x->dev, "WM8312 revision %c\n", 'A' + rev);
 		break;
 
-	case 0:
-		/* Some engineering samples do not have the ID set,
-		 * rely on the device being registered correctly.
-		 * This will need revisiting for future devices with
-		 * multiple dies.
-		 */
-		parent = id;
-		switch (rev) {
-		case 0:
-			dev_info(wm831x->dev, "WM831%d ES revision %c\n",
-				 parent, 'A' + rev);
-			break;
-		}
+	case WM8320:
+		parent = WM8320;
+		wm831x->num_gpio = 12;
+		dev_info(wm831x->dev, "WM8320 revision %c\n", 'A' + rev);
 		break;
 
 	default:
@@ -1338,7 +1480,7 @@ static int wm831x_device_init(struct wm831x *wm831x, unsigned long id, int irq)
 	 * current parts.
 	 */
 	if (parent != id)
-		dev_warn(wm831x->dev, "Device was registered as a WM831%lu\n",
+		dev_warn(wm831x->dev, "Device was registered as a WM%lx\n",
 			 id);
 
 	/* Bootstrap the user key */
@@ -1371,18 +1513,24 @@ static int wm831x_device_init(struct wm831x *wm831x, unsigned long id, int irq)
 	case WM8310:
 		ret = mfd_add_devices(wm831x->dev, -1,
 				      wm8310_devs, ARRAY_SIZE(wm8310_devs),
-				      NULL, 0);
+				      NULL, wm831x->irq_base);
 		break;
 
 	case WM8311:
 		ret = mfd_add_devices(wm831x->dev, -1,
 				      wm8311_devs, ARRAY_SIZE(wm8311_devs),
-				      NULL, 0);
+				      NULL, wm831x->irq_base);
 		break;
 
 	case WM8312:
 		ret = mfd_add_devices(wm831x->dev, -1,
 				      wm8312_devs, ARRAY_SIZE(wm8312_devs),
+				      NULL, wm831x->irq_base);
+		break;
+
+	case WM8320:
+		ret = mfd_add_devices(wm831x->dev, -1,
+				      wm8320_devs, ARRAY_SIZE(wm8320_devs),
 				      NULL, 0);
 		break;
 
@@ -1399,7 +1547,8 @@ static int wm831x_device_init(struct wm831x *wm831x, unsigned long id, int irq)
 	if (pdata && pdata->backlight) {
 		/* Treat errors as non-critical */
 		ret = mfd_add_devices(wm831x->dev, -1, backlight_devs,
-				      ARRAY_SIZE(backlight_devs), NULL, 0);
+				      ARRAY_SIZE(backlight_devs), NULL,
+				      wm831x->irq_base);
 		if (ret < 0)
 			dev_err(wm831x->dev, "Failed to add backlight: %d\n",
 				ret);
@@ -1511,6 +1660,7 @@ static const struct i2c_device_id wm831x_i2c_id[] = {
 	{ "wm8310", WM8310 },
 	{ "wm8311", WM8311 },
 	{ "wm8312", WM8312 },
+	{ "wm8320", WM8320 },
 	{ }
 };
 MODULE_DEVICE_TABLE(i2c, wm831x_i2c_id);
diff --git a/drivers/mfd/wm831x-irq.c b/drivers/mfd/wm831x-irq.c
index ac056ea6b66e..301327697117 100644
--- a/drivers/mfd/wm831x-irq.c
+++ b/drivers/mfd/wm831x-irq.c
@@ -15,6 +15,7 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/i2c.h>
+#include <linux/irq.h>
 #include <linux/mfd/core.h>
 #include <linux/interrupt.h>
 
@@ -339,110 +340,71 @@ static inline int irq_data_to_mask_reg(struct wm831x_irq_data *irq_data)
 	return WM831X_INTERRUPT_STATUS_1_MASK - 1 + irq_data->reg;
 }
 
-static void __wm831x_enable_irq(struct wm831x *wm831x, int irq)
+static inline struct wm831x_irq_data *irq_to_wm831x_irq(struct wm831x *wm831x,
+							int irq)
 {
-	struct wm831x_irq_data *irq_data = &wm831x_irqs[irq];
-
-	wm831x->irq_masks[irq_data->reg - 1] &= ~irq_data->mask;
-	wm831x_reg_write(wm831x, irq_data_to_mask_reg(irq_data),
-			 wm831x->irq_masks[irq_data->reg - 1]);
+	return &wm831x_irqs[irq - wm831x->irq_base];
 }
 
-void wm831x_enable_irq(struct wm831x *wm831x, int irq)
+static void wm831x_irq_lock(unsigned int irq)
 {
-	mutex_lock(&wm831x->irq_lock);
-	__wm831x_enable_irq(wm831x, irq);
-	mutex_unlock(&wm831x->irq_lock);
-}
-EXPORT_SYMBOL_GPL(wm831x_enable_irq);
+	struct wm831x *wm831x = get_irq_chip_data(irq);
 
-static void __wm831x_disable_irq(struct wm831x *wm831x, int irq)
-{
-	struct wm831x_irq_data *irq_data = &wm831x_irqs[irq];
-
-	wm831x->irq_masks[irq_data->reg - 1] |= irq_data->mask;
-	wm831x_reg_write(wm831x, irq_data_to_mask_reg(irq_data),
-			 wm831x->irq_masks[irq_data->reg - 1]);
-}
-
-void wm831x_disable_irq(struct wm831x *wm831x, int irq)
-{
 	mutex_lock(&wm831x->irq_lock);
-	__wm831x_disable_irq(wm831x, irq);
-	mutex_unlock(&wm831x->irq_lock);
 }
-EXPORT_SYMBOL_GPL(wm831x_disable_irq);
 
-int wm831x_request_irq(struct wm831x *wm831x,
-		       unsigned int irq, irq_handler_t handler,
-		       unsigned long flags, const char *name,
-		       void *dev)
+static void wm831x_irq_sync_unlock(unsigned int irq)
 {
-	int ret = 0;
-
-	if (irq < 0 || irq >= WM831X_NUM_IRQS)
-		return -EINVAL;
-
-	mutex_lock(&wm831x->irq_lock);
-
-	if (wm831x_irqs[irq].handler) {
-		dev_err(wm831x->dev, "Already have handler for IRQ %d\n", irq);
-		ret = -EINVAL;
-		goto out;
+	struct wm831x *wm831x = get_irq_chip_data(irq);
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(wm831x->irq_masks_cur); i++) {
+		/* If there's been a change in the mask write it back
+		 * to the hardware. */
+		if (wm831x->irq_masks_cur[i] != wm831x->irq_masks_cache[i]) {
+			wm831x->irq_masks_cache[i] = wm831x->irq_masks_cur[i];
+			wm831x_reg_write(wm831x,
+					 WM831X_INTERRUPT_STATUS_1_MASK + i,
+					 wm831x->irq_masks_cur[i]);
+		}
 	}
 
-	wm831x_irqs[irq].handler = handler;
-	wm831x_irqs[irq].handler_data = dev;
-
-	__wm831x_enable_irq(wm831x, irq);
-
-out:
 	mutex_unlock(&wm831x->irq_lock);
-
-	return ret;
 }
-EXPORT_SYMBOL_GPL(wm831x_request_irq);
 
-void wm831x_free_irq(struct wm831x *wm831x, unsigned int irq, void *data)
+static void wm831x_irq_unmask(unsigned int irq)
 {
-	if (irq < 0 || irq >= WM831X_NUM_IRQS)
-		return;
-
-	mutex_lock(&wm831x->irq_lock);
+	struct wm831x *wm831x = get_irq_chip_data(irq);
+	struct wm831x_irq_data *irq_data = irq_to_wm831x_irq(wm831x, irq);
 
-	wm831x_irqs[irq].handler = NULL;
-	wm831x_irqs[irq].handler_data = NULL;
-
-	__wm831x_disable_irq(wm831x, irq);
-
-	mutex_unlock(&wm831x->irq_lock);
+	wm831x->irq_masks_cur[irq_data->reg - 1] &= ~irq_data->mask;
 }
-EXPORT_SYMBOL_GPL(wm831x_free_irq);
 
-
-static void wm831x_handle_irq(struct wm831x *wm831x, int irq, int status)
+static void wm831x_irq_mask(unsigned int irq)
 {
-	struct wm831x_irq_data *irq_data = &wm831x_irqs[irq];
-
-	if (irq_data->handler) {
-		irq_data->handler(irq, irq_data->handler_data);
-		wm831x_reg_write(wm831x, irq_data_to_status_reg(irq_data),
-				 irq_data->mask);
-	} else {
-		dev_err(wm831x->dev, "Unhandled IRQ %d, masking\n", irq);
-		__wm831x_disable_irq(wm831x, irq);
-	}
+	struct wm831x *wm831x = get_irq_chip_data(irq);
+	struct wm831x_irq_data *irq_data = irq_to_wm831x_irq(wm831x, irq);
+
+	wm831x->irq_masks_cur[irq_data->reg - 1] |= irq_data->mask;
 }
 
-/* Main interrupt handling occurs in a workqueue since we need
- * interrupts enabled to interact with the chip. */
-static void wm831x_irq_worker(struct work_struct *work)
+static struct irq_chip wm831x_irq_chip = {
+	.name = "wm831x",
+	.bus_lock = wm831x_irq_lock,
+	.bus_sync_unlock = wm831x_irq_sync_unlock,
+	.mask = wm831x_irq_mask,
+	.unmask = wm831x_irq_unmask,
+};
+
+/* The processing of the primary interrupt occurs in a thread so that
+ * we can interact with the device over I2C or SPI. */
+static irqreturn_t wm831x_irq_thread(int irq, void *data)
 {
-	struct wm831x *wm831x = container_of(work, struct wm831x, irq_work);
+	struct wm831x *wm831x = data;
 	unsigned int i;
 	int primary;
-	int status_regs[5];
-	int read[5] = { 0 };
+	int status_regs[WM831X_NUM_IRQ_REGS] = { 0 };
+	int read[WM831X_NUM_IRQ_REGS] = { 0 };
 	int *status;
 
 	primary = wm831x_reg_read(wm831x, WM831X_SYSTEM_INTERRUPTS);
@@ -452,8 +414,6 @@ static void wm831x_irq_worker(struct work_struct *work)
 		goto out;
 	}
 
-	mutex_lock(&wm831x->irq_lock);
-
 	for (i = 0; i < ARRAY_SIZE(wm831x_irqs); i++) {
 		int offset = wm831x_irqs[i].reg - 1;
 
@@ -471,41 +431,34 @@ static void wm831x_irq_worker(struct work_struct *work)
 				dev_err(wm831x->dev,
 					"Failed to read IRQ status: %d\n",
 					*status);
-				goto out_lock;
+				goto out;
 			}
 
-			/* Mask out the disabled IRQs */
-			*status &= ~wm831x->irq_masks[offset];
 			read[offset] = 1;
 		}
 
-		if (*status & wm831x_irqs[i].mask)
-			wm831x_handle_irq(wm831x, i, *status);
+		/* Report it if it isn't masked, or forget the status. */
+		if ((*status & ~wm831x->irq_masks_cur[offset])
+		    & wm831x_irqs[i].mask)
+			handle_nested_irq(wm831x->irq_base + i);
+		else
+			*status &= ~wm831x_irqs[i].mask;
 	}
 
-out_lock:
-	mutex_unlock(&wm831x->irq_lock);
 out:
-	enable_irq(wm831x->irq);
-}
-
-
-static irqreturn_t wm831x_cpu_irq(int irq, void *data)
-{
-	struct wm831x *wm831x = data;
-
-	/* Shut the interrupt to the CPU up and schedule the actual
-	 * handler; we can't check that the IRQ is asserted. */
-	disable_irq_nosync(irq);
-
-	queue_work(wm831x->irq_wq, &wm831x->irq_work);
+	for (i = 0; i < ARRAY_SIZE(status_regs); i++) {
+		if (status_regs[i])
+			wm831x_reg_write(wm831x, WM831X_INTERRUPT_STATUS_1 + i,
+					 status_regs[i]);
+	}
 
 	return IRQ_HANDLED;
 }
 
 int wm831x_irq_init(struct wm831x *wm831x, int irq)
 {
-	int i, ret;
+	struct wm831x_pdata *pdata = wm831x->dev->platform_data;
+	int i, cur_irq, ret;
 
 	mutex_init(&wm831x->irq_lock);
 
@@ -515,41 +468,53 @@ int wm831x_irq_init(struct wm831x *wm831x, int irq)
 		return 0;
 	}
 
-
-	wm831x->irq_wq = create_singlethread_workqueue("wm831x-irq");
-	if (!wm831x->irq_wq) {
-		dev_err(wm831x->dev, "Failed to allocate IRQ worker\n");
-		return -ESRCH;
+	if (!pdata || !pdata->irq_base) {
+		dev_err(wm831x->dev,
+			"No interrupt base specified, no interrupts\n");
+		return 0;
 	}
 
 	wm831x->irq = irq;
-	INIT_WORK(&wm831x->irq_work, wm831x_irq_worker);
+	wm831x->irq_base = pdata->irq_base;
 
 	/* Mask the individual interrupt sources */
-	for (i = 0; i < ARRAY_SIZE(wm831x->irq_masks); i++) {
-		wm831x->irq_masks[i] = 0xffff;
+	for (i = 0; i < ARRAY_SIZE(wm831x->irq_masks_cur); i++) {
+		wm831x->irq_masks_cur[i] = 0xffff;
+		wm831x->irq_masks_cache[i] = 0xffff;
 		wm831x_reg_write(wm831x, WM831X_INTERRUPT_STATUS_1_MASK + i,
 				 0xffff);
 	}
 
-	/* Enable top level interrupts, we mask at secondary level */
-	wm831x_reg_write(wm831x, WM831X_SYSTEM_INTERRUPTS_MASK, 0);
+	/* Register them with genirq */
+	for (cur_irq = wm831x->irq_base;
+	     cur_irq < ARRAY_SIZE(wm831x_irqs) + wm831x->irq_base;
+	     cur_irq++) {
+		set_irq_chip_data(cur_irq, wm831x);
+		set_irq_chip_and_handler(cur_irq, &wm831x_irq_chip,
+					 handle_edge_irq);
+		set_irq_nested_thread(cur_irq, 1);
+
+		/* ARM needs us to explicitly flag the IRQ as valid
+		 * and will set them noprobe when we do so. */
+#ifdef CONFIG_ARM
+		set_irq_flags(cur_irq, IRQF_VALID);
+#else
+		set_irq_noprobe(cur_irq);
+#endif
+	}
 
-	/* We're good to go.  We set IRQF_SHARED since there's a
-	 * chance the driver will interoperate with another driver but
-	 * the need to disable the IRQ while handing via I2C/SPI means
-	 * that this may break and performance will be impacted.  If
-	 * this does happen it's a hardware design issue and the only
-	 * other alternative would be polling.
-	 */
-	ret = request_irq(irq, wm831x_cpu_irq, IRQF_TRIGGER_LOW | IRQF_SHARED,
-			  "wm831x", wm831x);
+	ret = request_threaded_irq(irq, NULL, wm831x_irq_thread,
+				   IRQF_TRIGGER_LOW | IRQF_ONESHOT,
+				   "wm831x", wm831x);
 	if (ret != 0) {
 		dev_err(wm831x->dev, "Failed to request IRQ %d: %d\n",
 			irq, ret);
 		return ret;
 	}
 
+	/* Enable top level interrupts, we mask at secondary level */
+	wm831x_reg_write(wm831x, WM831X_SYSTEM_INTERRUPTS_MASK, 0);
+
 	return 0;
 }
 
diff --git a/drivers/mfd/wm8350-core.c b/drivers/mfd/wm8350-core.c
index ba27c9dc1ad3..9a970bd68775 100644
--- a/drivers/mfd/wm8350-core.c
+++ b/drivers/mfd/wm8350-core.c
@@ -134,8 +134,7 @@ static inline int is_reg_locked(struct wm8350 *wm8350, u8 reg)
 	    wm8350->reg_cache[WM8350_SECURITY] == WM8350_UNLOCK_KEY)
 		return 0;
 
-	if ((reg == WM8350_GPIO_CONFIGURATION_I_O) ||
-	    (reg >= WM8350_GPIO_FUNCTION_SELECT_1 &&
+	if ((reg >= WM8350_GPIO_FUNCTION_SELECT_1 &&
 	     reg <= WM8350_GPIO_FUNCTION_SELECT_4) ||
 	    (reg >= WM8350_BATTERY_CHARGER_CONTROL_1 &&
 	     reg <= WM8350_BATTERY_CHARGER_CONTROL_3))
@@ -337,733 +336,6 @@ int wm8350_reg_unlock(struct wm8350 *wm8350)
 }
 EXPORT_SYMBOL_GPL(wm8350_reg_unlock);
 
-static void wm8350_irq_call_handler(struct wm8350 *wm8350, int irq)
-{
-	mutex_lock(&wm8350->irq_mutex);
-
-	if (wm8350->irq[irq].handler)
-		wm8350->irq[irq].handler(wm8350, irq, wm8350->irq[irq].data);
-	else {
-		dev_err(wm8350->dev, "irq %d nobody cared. now masked.\n",
-			irq);
-		wm8350_mask_irq(wm8350, irq);
-	}
-
-	mutex_unlock(&wm8350->irq_mutex);
-}
-
-/*
- * This is a threaded IRQ handler so can access I2C/SPI.  Since all
- * interrupts are clear on read the IRQ line will be reasserted and
- * the physical IRQ will be handled again if another interrupt is
- * asserted while we run - in the normal course of events this is a
- * rare occurrence so we save I2C/SPI reads.
- */
-static irqreturn_t wm8350_irq(int irq, void *data)
-{
-	struct wm8350 *wm8350 = data;
-	u16 level_one, status1, status2, comp;
-
-	/* TODO: Use block reads to improve performance? */
-	level_one = wm8350_reg_read(wm8350, WM8350_SYSTEM_INTERRUPTS)
-		& ~wm8350_reg_read(wm8350, WM8350_SYSTEM_INTERRUPTS_MASK);
-	status1 = wm8350_reg_read(wm8350, WM8350_INT_STATUS_1)
-		& ~wm8350_reg_read(wm8350, WM8350_INT_STATUS_1_MASK);
-	status2 = wm8350_reg_read(wm8350, WM8350_INT_STATUS_2)
-		& ~wm8350_reg_read(wm8350, WM8350_INT_STATUS_2_MASK);
-	comp = wm8350_reg_read(wm8350, WM8350_COMPARATOR_INT_STATUS)
-		& ~wm8350_reg_read(wm8350, WM8350_COMPARATOR_INT_STATUS_MASK);
-
-	/* over current */
-	if (level_one & WM8350_OC_INT) {
-		u16 oc;
-
-		oc = wm8350_reg_read(wm8350, WM8350_OVER_CURRENT_INT_STATUS);
-		oc &= ~wm8350_reg_read(wm8350,
-				       WM8350_OVER_CURRENT_INT_STATUS_MASK);
-
-		if (oc & WM8350_OC_LS_EINT)	/* limit switch */
-			wm8350_irq_call_handler(wm8350, WM8350_IRQ_OC_LS);
-	}
-
-	/* under voltage */
-	if (level_one & WM8350_UV_INT) {
-		u16 uv;
-
-		uv = wm8350_reg_read(wm8350, WM8350_UNDER_VOLTAGE_INT_STATUS);
-		uv &= ~wm8350_reg_read(wm8350,
-				       WM8350_UNDER_VOLTAGE_INT_STATUS_MASK);
-
-		if (uv & WM8350_UV_DC1_EINT)
-			wm8350_irq_call_handler(wm8350, WM8350_IRQ_UV_DC1);
-		if (uv & WM8350_UV_DC2_EINT)
-			wm8350_irq_call_handler(wm8350, WM8350_IRQ_UV_DC2);
-		if (uv & WM8350_UV_DC3_EINT)
-			wm8350_irq_call_handler(wm8350, WM8350_IRQ_UV_DC3);
-		if (uv & WM8350_UV_DC4_EINT)
-			wm8350_irq_call_handler(wm8350, WM8350_IRQ_UV_DC4);
-		if (uv & WM8350_UV_DC5_EINT)
-			wm8350_irq_call_handler(wm8350, WM8350_IRQ_UV_DC5);
-		if (uv & WM8350_UV_DC6_EINT)
-			wm8350_irq_call_handler(wm8350, WM8350_IRQ_UV_DC6);
-		if (uv & WM8350_UV_LDO1_EINT)
-			wm8350_irq_call_handler(wm8350, WM8350_IRQ_UV_LDO1);
-		if (uv & WM8350_UV_LDO2_EINT)
-			wm8350_irq_call_handler(wm8350, WM8350_IRQ_UV_LDO2);
-		if (uv & WM8350_UV_LDO3_EINT)
-			wm8350_irq_call_handler(wm8350, WM8350_IRQ_UV_LDO3);
-		if (uv & WM8350_UV_LDO4_EINT)
-			wm8350_irq_call_handler(wm8350, WM8350_IRQ_UV_LDO4);
-	}
-
-	/* charger, RTC */
-	if (status1) {
-		if (status1 & WM8350_CHG_BAT_HOT_EINT)
-			wm8350_irq_call_handler(wm8350,
-						WM8350_IRQ_CHG_BAT_HOT);
-		if (status1 & WM8350_CHG_BAT_COLD_EINT)
-			wm8350_irq_call_handler(wm8350,
-						WM8350_IRQ_CHG_BAT_COLD);
-		if (status1 & WM8350_CHG_BAT_FAIL_EINT)
-			wm8350_irq_call_handler(wm8350,
-						WM8350_IRQ_CHG_BAT_FAIL);
-		if (status1 & WM8350_CHG_TO_EINT)
-			wm8350_irq_call_handler(wm8350, WM8350_IRQ_CHG_TO);
-		if (status1 & WM8350_CHG_END_EINT)
-			wm8350_irq_call_handler(wm8350, WM8350_IRQ_CHG_END);
-		if (status1 & WM8350_CHG_START_EINT)
-			wm8350_irq_call_handler(wm8350, WM8350_IRQ_CHG_START);
-		if (status1 & WM8350_CHG_FAST_RDY_EINT)
-			wm8350_irq_call_handler(wm8350,
-						WM8350_IRQ_CHG_FAST_RDY);
-		if (status1 & WM8350_CHG_VBATT_LT_3P9_EINT)
-			wm8350_irq_call_handler(wm8350,
-						WM8350_IRQ_CHG_VBATT_LT_3P9);
-		if (status1 & WM8350_CHG_VBATT_LT_3P1_EINT)
-			wm8350_irq_call_handler(wm8350,
-						WM8350_IRQ_CHG_VBATT_LT_3P1);
-		if (status1 & WM8350_CHG_VBATT_LT_2P85_EINT)
-			wm8350_irq_call_handler(wm8350,
-						WM8350_IRQ_CHG_VBATT_LT_2P85);
-		if (status1 & WM8350_RTC_ALM_EINT)
-			wm8350_irq_call_handler(wm8350, WM8350_IRQ_RTC_ALM);
-		if (status1 & WM8350_RTC_SEC_EINT)
-			wm8350_irq_call_handler(wm8350, WM8350_IRQ_RTC_SEC);
-		if (status1 & WM8350_RTC_PER_EINT)
-			wm8350_irq_call_handler(wm8350, WM8350_IRQ_RTC_PER);
-	}
-
-	/* current sink, system, aux adc */
-	if (status2) {
-		if (status2 & WM8350_CS1_EINT)
-			wm8350_irq_call_handler(wm8350, WM8350_IRQ_CS1);
-		if (status2 & WM8350_CS2_EINT)
-			wm8350_irq_call_handler(wm8350, WM8350_IRQ_CS2);
-
-		if (status2 & WM8350_SYS_HYST_COMP_FAIL_EINT)
-			wm8350_irq_call_handler(wm8350,
-						WM8350_IRQ_SYS_HYST_COMP_FAIL);
-		if (status2 & WM8350_SYS_CHIP_GT115_EINT)
-			wm8350_irq_call_handler(wm8350,
-						WM8350_IRQ_SYS_CHIP_GT115);
-		if (status2 & WM8350_SYS_CHIP_GT140_EINT)
-			wm8350_irq_call_handler(wm8350,
-						WM8350_IRQ_SYS_CHIP_GT140);
-		if (status2 & WM8350_SYS_WDOG_TO_EINT)
-			wm8350_irq_call_handler(wm8350,
-						WM8350_IRQ_SYS_WDOG_TO);
-
-		if (status2 & WM8350_AUXADC_DATARDY_EINT)
-			wm8350_irq_call_handler(wm8350,
-						WM8350_IRQ_AUXADC_DATARDY);
-		if (status2 & WM8350_AUXADC_DCOMP4_EINT)
-			wm8350_irq_call_handler(wm8350,
-						WM8350_IRQ_AUXADC_DCOMP4);
-		if (status2 & WM8350_AUXADC_DCOMP3_EINT)
-			wm8350_irq_call_handler(wm8350,
-						WM8350_IRQ_AUXADC_DCOMP3);
-		if (status2 & WM8350_AUXADC_DCOMP2_EINT)
-			wm8350_irq_call_handler(wm8350,
-						WM8350_IRQ_AUXADC_DCOMP2);
-		if (status2 & WM8350_AUXADC_DCOMP1_EINT)
-			wm8350_irq_call_handler(wm8350,
-						WM8350_IRQ_AUXADC_DCOMP1);
-
-		if (status2 & WM8350_USB_LIMIT_EINT)
-			wm8350_irq_call_handler(wm8350, WM8350_IRQ_USB_LIMIT);
-	}
-
-	/* wake, codec, ext */
-	if (comp) {
-		if (comp & WM8350_WKUP_OFF_STATE_EINT)
-			wm8350_irq_call_handler(wm8350,
-						WM8350_IRQ_WKUP_OFF_STATE);
-		if (comp & WM8350_WKUP_HIB_STATE_EINT)
-			wm8350_irq_call_handler(wm8350,
-						WM8350_IRQ_WKUP_HIB_STATE);
-		if (comp & WM8350_WKUP_CONV_FAULT_EINT)
-			wm8350_irq_call_handler(wm8350,
-						WM8350_IRQ_WKUP_CONV_FAULT);
-		if (comp & WM8350_WKUP_WDOG_RST_EINT)
-			wm8350_irq_call_handler(wm8350,
-						WM8350_IRQ_WKUP_WDOG_RST);
-		if (comp & WM8350_WKUP_GP_PWR_ON_EINT)
-			wm8350_irq_call_handler(wm8350,
-						WM8350_IRQ_WKUP_GP_PWR_ON);
-		if (comp & WM8350_WKUP_ONKEY_EINT)
-			wm8350_irq_call_handler(wm8350, WM8350_IRQ_WKUP_ONKEY);
-		if (comp & WM8350_WKUP_GP_WAKEUP_EINT)
-			wm8350_irq_call_handler(wm8350,
-						WM8350_IRQ_WKUP_GP_WAKEUP);
-
-		if (comp & WM8350_CODEC_JCK_DET_L_EINT)
-			wm8350_irq_call_handler(wm8350,
-						WM8350_IRQ_CODEC_JCK_DET_L);
-		if (comp & WM8350_CODEC_JCK_DET_R_EINT)
-			wm8350_irq_call_handler(wm8350,
-						WM8350_IRQ_CODEC_JCK_DET_R);
-		if (comp & WM8350_CODEC_MICSCD_EINT)
-			wm8350_irq_call_handler(wm8350,
-						WM8350_IRQ_CODEC_MICSCD);
-		if (comp & WM8350_CODEC_MICD_EINT)
-			wm8350_irq_call_handler(wm8350, WM8350_IRQ_CODEC_MICD);
-
-		if (comp & WM8350_EXT_USB_FB_EINT)
-			wm8350_irq_call_handler(wm8350, WM8350_IRQ_EXT_USB_FB);
-		if (comp & WM8350_EXT_WALL_FB_EINT)
-			wm8350_irq_call_handler(wm8350,
-						WM8350_IRQ_EXT_WALL_FB);
-		if (comp & WM8350_EXT_BAT_FB_EINT)
-			wm8350_irq_call_handler(wm8350, WM8350_IRQ_EXT_BAT_FB);
-	}
-
-	if (level_one & WM8350_GP_INT) {
-		int i;
-		u16 gpio;
-
-		gpio = wm8350_reg_read(wm8350, WM8350_GPIO_INT_STATUS);
-		gpio &= ~wm8350_reg_read(wm8350,
-					 WM8350_GPIO_INT_STATUS_MASK);
-
-		for (i = 0; i < 12; i++) {
-			if (gpio & (1 << i))
-				wm8350_irq_call_handler(wm8350,
-							WM8350_IRQ_GPIO(i));
-		}
-	}
-
-	return IRQ_HANDLED;
-}
-
-int wm8350_register_irq(struct wm8350 *wm8350, int irq,
-			void (*handler) (struct wm8350 *, int, void *),
-			void *data)
-{
-	if (irq < 0 || irq > WM8350_NUM_IRQ || !handler)
-		return -EINVAL;
-
-	if (wm8350->irq[irq].handler)
-		return -EBUSY;
-
-	mutex_lock(&wm8350->irq_mutex);
-	wm8350->irq[irq].handler = handler;
-	wm8350->irq[irq].data = data;
-	mutex_unlock(&wm8350->irq_mutex);
-
-	return 0;
-}
-EXPORT_SYMBOL_GPL(wm8350_register_irq);
-
-int wm8350_free_irq(struct wm8350 *wm8350, int irq)
-{
-	if (irq < 0 || irq > WM8350_NUM_IRQ)
-		return -EINVAL;
-
-	mutex_lock(&wm8350->irq_mutex);
-	wm8350->irq[irq].handler = NULL;
-	mutex_unlock(&wm8350->irq_mutex);
-	return 0;
-}
-EXPORT_SYMBOL_GPL(wm8350_free_irq);
-
-int wm8350_mask_irq(struct wm8350 *wm8350, int irq)
-{
-	switch (irq) {
-	case WM8350_IRQ_CHG_BAT_HOT:
-		return wm8350_set_bits(wm8350, WM8350_INT_STATUS_1_MASK,
-				       WM8350_IM_CHG_BAT_HOT_EINT);
-	case WM8350_IRQ_CHG_BAT_COLD:
-		return wm8350_set_bits(wm8350, WM8350_INT_STATUS_1_MASK,
-				       WM8350_IM_CHG_BAT_COLD_EINT);
-	case WM8350_IRQ_CHG_BAT_FAIL:
-		return wm8350_set_bits(wm8350, WM8350_INT_STATUS_1_MASK,
-				       WM8350_IM_CHG_BAT_FAIL_EINT);
-	case WM8350_IRQ_CHG_TO:
-		return wm8350_set_bits(wm8350, WM8350_INT_STATUS_1_MASK,
-				       WM8350_IM_CHG_TO_EINT);
-	case WM8350_IRQ_CHG_END:
-		return wm8350_set_bits(wm8350, WM8350_INT_STATUS_1_MASK,
-				       WM8350_IM_CHG_END_EINT);
-	case WM8350_IRQ_CHG_START:
-		return wm8350_set_bits(wm8350, WM8350_INT_STATUS_1_MASK,
-				       WM8350_IM_CHG_START_EINT);
-	case WM8350_IRQ_CHG_FAST_RDY:
-		return wm8350_set_bits(wm8350, WM8350_INT_STATUS_1_MASK,
-				       WM8350_IM_CHG_FAST_RDY_EINT);
-	case WM8350_IRQ_RTC_PER:
-		return wm8350_set_bits(wm8350, WM8350_INT_STATUS_1_MASK,
-				       WM8350_IM_RTC_PER_EINT);
-	case WM8350_IRQ_RTC_SEC:
-		return wm8350_set_bits(wm8350, WM8350_INT_STATUS_1_MASK,
-				       WM8350_IM_RTC_SEC_EINT);
-	case WM8350_IRQ_RTC_ALM:
-		return wm8350_set_bits(wm8350, WM8350_INT_STATUS_1_MASK,
-				       WM8350_IM_RTC_ALM_EINT);
-	case WM8350_IRQ_CHG_VBATT_LT_3P9:
-		return wm8350_set_bits(wm8350, WM8350_INT_STATUS_1_MASK,
-				       WM8350_IM_CHG_VBATT_LT_3P9_EINT);
-	case WM8350_IRQ_CHG_VBATT_LT_3P1:
-		return wm8350_set_bits(wm8350, WM8350_INT_STATUS_1_MASK,
-				       WM8350_IM_CHG_VBATT_LT_3P1_EINT);
-	case WM8350_IRQ_CHG_VBATT_LT_2P85:
-		return wm8350_set_bits(wm8350, WM8350_INT_STATUS_1_MASK,
-				       WM8350_IM_CHG_VBATT_LT_2P85_EINT);
-	case WM8350_IRQ_CS1:
-		return wm8350_set_bits(wm8350, WM8350_INT_STATUS_2_MASK,
-				       WM8350_IM_CS1_EINT);
-	case WM8350_IRQ_CS2:
-		return wm8350_set_bits(wm8350, WM8350_INT_STATUS_2_MASK,
-				       WM8350_IM_CS2_EINT);
-	case WM8350_IRQ_USB_LIMIT:
-		return wm8350_set_bits(wm8350, WM8350_INT_STATUS_2_MASK,
-				       WM8350_IM_USB_LIMIT_EINT);
-	case WM8350_IRQ_AUXADC_DATARDY:
-		return wm8350_set_bits(wm8350, WM8350_INT_STATUS_2_MASK,
-				       WM8350_IM_AUXADC_DATARDY_EINT);
-	case WM8350_IRQ_AUXADC_DCOMP4:
-		return wm8350_set_bits(wm8350, WM8350_INT_STATUS_2_MASK,
-				       WM8350_IM_AUXADC_DCOMP4_EINT);
-	case WM8350_IRQ_AUXADC_DCOMP3:
-		return wm8350_set_bits(wm8350, WM8350_INT_STATUS_2_MASK,
-				       WM8350_IM_AUXADC_DCOMP3_EINT);
-	case WM8350_IRQ_AUXADC_DCOMP2:
-		return wm8350_set_bits(wm8350, WM8350_INT_STATUS_2_MASK,
-				       WM8350_IM_AUXADC_DCOMP2_EINT);
-	case WM8350_IRQ_AUXADC_DCOMP1:
-		return wm8350_set_bits(wm8350, WM8350_INT_STATUS_2_MASK,
-				       WM8350_IM_AUXADC_DCOMP1_EINT);
-	case WM8350_IRQ_SYS_HYST_COMP_FAIL:
-		return wm8350_set_bits(wm8350, WM8350_INT_STATUS_2_MASK,
-				       WM8350_IM_SYS_HYST_COMP_FAIL_EINT);
-	case WM8350_IRQ_SYS_CHIP_GT115:
-		return wm8350_set_bits(wm8350, WM8350_INT_STATUS_2_MASK,
-				       WM8350_IM_SYS_CHIP_GT115_EINT);
-	case WM8350_IRQ_SYS_CHIP_GT140:
-		return wm8350_set_bits(wm8350, WM8350_INT_STATUS_2_MASK,
-				       WM8350_IM_SYS_CHIP_GT140_EINT);
-	case WM8350_IRQ_SYS_WDOG_TO:
-		return wm8350_set_bits(wm8350, WM8350_INT_STATUS_2_MASK,
-				       WM8350_IM_SYS_WDOG_TO_EINT);
-	case WM8350_IRQ_UV_LDO4:
-		return wm8350_set_bits(wm8350,
-				       WM8350_UNDER_VOLTAGE_INT_STATUS_MASK,
-				       WM8350_IM_UV_LDO4_EINT);
-	case WM8350_IRQ_UV_LDO3:
-		return wm8350_set_bits(wm8350,
-				       WM8350_UNDER_VOLTAGE_INT_STATUS_MASK,
-				       WM8350_IM_UV_LDO3_EINT);
-	case WM8350_IRQ_UV_LDO2:
-		return wm8350_set_bits(wm8350,
-				       WM8350_UNDER_VOLTAGE_INT_STATUS_MASK,
-				       WM8350_IM_UV_LDO2_EINT);
-	case WM8350_IRQ_UV_LDO1:
-		return wm8350_set_bits(wm8350,
-				       WM8350_UNDER_VOLTAGE_INT_STATUS_MASK,
-				       WM8350_IM_UV_LDO1_EINT);
-	case WM8350_IRQ_UV_DC6:
-		return wm8350_set_bits(wm8350,
-				       WM8350_UNDER_VOLTAGE_INT_STATUS_MASK,
-				       WM8350_IM_UV_DC6_EINT);
-	case WM8350_IRQ_UV_DC5:
-		return wm8350_set_bits(wm8350,
-				       WM8350_UNDER_VOLTAGE_INT_STATUS_MASK,
-				       WM8350_IM_UV_DC5_EINT);
-	case WM8350_IRQ_UV_DC4:
-		return wm8350_set_bits(wm8350,
-				       WM8350_UNDER_VOLTAGE_INT_STATUS_MASK,
-				       WM8350_IM_UV_DC4_EINT);
-	case WM8350_IRQ_UV_DC3:
-		return wm8350_set_bits(wm8350,
-				       WM8350_UNDER_VOLTAGE_INT_STATUS_MASK,
-				       WM8350_IM_UV_DC3_EINT);
-	case WM8350_IRQ_UV_DC2:
-		return wm8350_set_bits(wm8350,
-				       WM8350_UNDER_VOLTAGE_INT_STATUS_MASK,
-				       WM8350_IM_UV_DC2_EINT);
-	case WM8350_IRQ_UV_DC1:
-		return wm8350_set_bits(wm8350,
-				       WM8350_UNDER_VOLTAGE_INT_STATUS_MASK,
-				       WM8350_IM_UV_DC1_EINT);
-	case WM8350_IRQ_OC_LS:
-		return wm8350_set_bits(wm8350,
-				       WM8350_OVER_CURRENT_INT_STATUS_MASK,
-				       WM8350_IM_OC_LS_EINT);
-	case WM8350_IRQ_EXT_USB_FB:
-		return wm8350_set_bits(wm8350,
-				       WM8350_COMPARATOR_INT_STATUS_MASK,
-				       WM8350_IM_EXT_USB_FB_EINT);
-	case WM8350_IRQ_EXT_WALL_FB:
-		return wm8350_set_bits(wm8350,
-				       WM8350_COMPARATOR_INT_STATUS_MASK,
-				       WM8350_IM_EXT_WALL_FB_EINT);
-	case WM8350_IRQ_EXT_BAT_FB:
-		return wm8350_set_bits(wm8350,
-				       WM8350_COMPARATOR_INT_STATUS_MASK,
-				       WM8350_IM_EXT_BAT_FB_EINT);
-	case WM8350_IRQ_CODEC_JCK_DET_L:
-		return wm8350_set_bits(wm8350,
-				       WM8350_COMPARATOR_INT_STATUS_MASK,
-				       WM8350_IM_CODEC_JCK_DET_L_EINT);
-	case WM8350_IRQ_CODEC_JCK_DET_R:
-		return wm8350_set_bits(wm8350,
-				       WM8350_COMPARATOR_INT_STATUS_MASK,
-				       WM8350_IM_CODEC_JCK_DET_R_EINT);
-	case WM8350_IRQ_CODEC_MICSCD:
-		return wm8350_set_bits(wm8350,
-				       WM8350_COMPARATOR_INT_STATUS_MASK,
-				       WM8350_IM_CODEC_MICSCD_EINT);
-	case WM8350_IRQ_CODEC_MICD:
-		return wm8350_set_bits(wm8350,
-				       WM8350_COMPARATOR_INT_STATUS_MASK,
-				       WM8350_IM_CODEC_MICD_EINT);
-	case WM8350_IRQ_WKUP_OFF_STATE:
-		return wm8350_set_bits(wm8350,
-				       WM8350_COMPARATOR_INT_STATUS_MASK,
-				       WM8350_IM_WKUP_OFF_STATE_EINT);
-	case WM8350_IRQ_WKUP_HIB_STATE:
-		return wm8350_set_bits(wm8350,
-				       WM8350_COMPARATOR_INT_STATUS_MASK,
-				       WM8350_IM_WKUP_HIB_STATE_EINT);
-	case WM8350_IRQ_WKUP_CONV_FAULT:
-		return wm8350_set_bits(wm8350,
-				       WM8350_COMPARATOR_INT_STATUS_MASK,
-				       WM8350_IM_WKUP_CONV_FAULT_EINT);
-	case WM8350_IRQ_WKUP_WDOG_RST:
-		return wm8350_set_bits(wm8350,
-				       WM8350_COMPARATOR_INT_STATUS_MASK,
-				       WM8350_IM_WKUP_OFF_STATE_EINT);
-	case WM8350_IRQ_WKUP_GP_PWR_ON:
-		return wm8350_set_bits(wm8350,
-				       WM8350_COMPARATOR_INT_STATUS_MASK,
-				       WM8350_IM_WKUP_GP_PWR_ON_EINT);
-	case WM8350_IRQ_WKUP_ONKEY:
-		return wm8350_set_bits(wm8350,
-				       WM8350_COMPARATOR_INT_STATUS_MASK,
-				       WM8350_IM_WKUP_ONKEY_EINT);
-	case WM8350_IRQ_WKUP_GP_WAKEUP:
-		return wm8350_set_bits(wm8350,
-				       WM8350_COMPARATOR_INT_STATUS_MASK,
-				       WM8350_IM_WKUP_GP_WAKEUP_EINT);
-	case WM8350_IRQ_GPIO(0):
-		return wm8350_set_bits(wm8350,
-				       WM8350_GPIO_INT_STATUS_MASK,
-				       WM8350_IM_GP0_EINT);
-	case WM8350_IRQ_GPIO(1):
-		return wm8350_set_bits(wm8350,
-				       WM8350_GPIO_INT_STATUS_MASK,
-				       WM8350_IM_GP1_EINT);
-	case WM8350_IRQ_GPIO(2):
-		return wm8350_set_bits(wm8350,
-				       WM8350_GPIO_INT_STATUS_MASK,
-				       WM8350_IM_GP2_EINT);
-	case WM8350_IRQ_GPIO(3):
-		return wm8350_set_bits(wm8350,
-				       WM8350_GPIO_INT_STATUS_MASK,
-				       WM8350_IM_GP3_EINT);
-	case WM8350_IRQ_GPIO(4):
-		return wm8350_set_bits(wm8350,
-				       WM8350_GPIO_INT_STATUS_MASK,
-				       WM8350_IM_GP4_EINT);
-	case WM8350_IRQ_GPIO(5):
-		return wm8350_set_bits(wm8350,
-				       WM8350_GPIO_INT_STATUS_MASK,
-				       WM8350_IM_GP5_EINT);
-	case WM8350_IRQ_GPIO(6):
-		return wm8350_set_bits(wm8350,
-				       WM8350_GPIO_INT_STATUS_MASK,
-				       WM8350_IM_GP6_EINT);
-	case WM8350_IRQ_GPIO(7):
-		return wm8350_set_bits(wm8350,
-				       WM8350_GPIO_INT_STATUS_MASK,
-				       WM8350_IM_GP7_EINT);
-	case WM8350_IRQ_GPIO(8):
-		return wm8350_set_bits(wm8350,
-				       WM8350_GPIO_INT_STATUS_MASK,
-				       WM8350_IM_GP8_EINT);
-	case WM8350_IRQ_GPIO(9):
-		return wm8350_set_bits(wm8350,
-				       WM8350_GPIO_INT_STATUS_MASK,
-				       WM8350_IM_GP9_EINT);
-	case WM8350_IRQ_GPIO(10):
-		return wm8350_set_bits(wm8350,
-				       WM8350_GPIO_INT_STATUS_MASK,
-				       WM8350_IM_GP10_EINT);
-	case WM8350_IRQ_GPIO(11):
-		return wm8350_set_bits(wm8350,
-				       WM8350_GPIO_INT_STATUS_MASK,
-				       WM8350_IM_GP11_EINT);
-	case WM8350_IRQ_GPIO(12):
-		return wm8350_set_bits(wm8350,
-				       WM8350_GPIO_INT_STATUS_MASK,
-				       WM8350_IM_GP12_EINT);
-	default:
-		dev_warn(wm8350->dev, "Attempting to mask unknown IRQ %d\n",
-			 irq);
-		return -EINVAL;
-	}
-	return 0;
-}
-EXPORT_SYMBOL_GPL(wm8350_mask_irq);
-
-int wm8350_unmask_irq(struct wm8350 *wm8350, int irq)
-{
-	switch (irq) {
-	case WM8350_IRQ_CHG_BAT_HOT:
-		return wm8350_clear_bits(wm8350, WM8350_INT_STATUS_1_MASK,
-					 WM8350_IM_CHG_BAT_HOT_EINT);
-	case WM8350_IRQ_CHG_BAT_COLD:
-		return wm8350_clear_bits(wm8350, WM8350_INT_STATUS_1_MASK,
-					 WM8350_IM_CHG_BAT_COLD_EINT);
-	case WM8350_IRQ_CHG_BAT_FAIL:
-		return wm8350_clear_bits(wm8350, WM8350_INT_STATUS_1_MASK,
-					 WM8350_IM_CHG_BAT_FAIL_EINT);
-	case WM8350_IRQ_CHG_TO:
-		return wm8350_clear_bits(wm8350, WM8350_INT_STATUS_1_MASK,
-					 WM8350_IM_CHG_TO_EINT);
-	case WM8350_IRQ_CHG_END:
-		return wm8350_clear_bits(wm8350, WM8350_INT_STATUS_1_MASK,
-					 WM8350_IM_CHG_END_EINT);
-	case WM8350_IRQ_CHG_START:
-		return wm8350_clear_bits(wm8350, WM8350_INT_STATUS_1_MASK,
-					 WM8350_IM_CHG_START_EINT);
-	case WM8350_IRQ_CHG_FAST_RDY:
-		return wm8350_clear_bits(wm8350, WM8350_INT_STATUS_1_MASK,
-					 WM8350_IM_CHG_FAST_RDY_EINT);
-	case WM8350_IRQ_RTC_PER:
-		return wm8350_clear_bits(wm8350, WM8350_INT_STATUS_1_MASK,
-					 WM8350_IM_RTC_PER_EINT);
-	case WM8350_IRQ_RTC_SEC:
-		return wm8350_clear_bits(wm8350, WM8350_INT_STATUS_1_MASK,
-					 WM8350_IM_RTC_SEC_EINT);
-	case WM8350_IRQ_RTC_ALM:
-		return wm8350_clear_bits(wm8350, WM8350_INT_STATUS_1_MASK,
-					 WM8350_IM_RTC_ALM_EINT);
-	case WM8350_IRQ_CHG_VBATT_LT_3P9:
-		return wm8350_clear_bits(wm8350, WM8350_INT_STATUS_1_MASK,
-					 WM8350_IM_CHG_VBATT_LT_3P9_EINT);
-	case WM8350_IRQ_CHG_VBATT_LT_3P1:
-		return wm8350_clear_bits(wm8350, WM8350_INT_STATUS_1_MASK,
-					 WM8350_IM_CHG_VBATT_LT_3P1_EINT);
-	case WM8350_IRQ_CHG_VBATT_LT_2P85:
-		return wm8350_clear_bits(wm8350, WM8350_INT_STATUS_1_MASK,
-					 WM8350_IM_CHG_VBATT_LT_2P85_EINT);
-	case WM8350_IRQ_CS1:
-		return wm8350_clear_bits(wm8350, WM8350_INT_STATUS_2_MASK,
-					 WM8350_IM_CS1_EINT);
-	case WM8350_IRQ_CS2:
-		return wm8350_clear_bits(wm8350, WM8350_INT_STATUS_2_MASK,
-					 WM8350_IM_CS2_EINT);
-	case WM8350_IRQ_USB_LIMIT:
-		return wm8350_clear_bits(wm8350, WM8350_INT_STATUS_2_MASK,
-					 WM8350_IM_USB_LIMIT_EINT);
-	case WM8350_IRQ_AUXADC_DATARDY:
-		return wm8350_clear_bits(wm8350, WM8350_INT_STATUS_2_MASK,
-					 WM8350_IM_AUXADC_DATARDY_EINT);
-	case WM8350_IRQ_AUXADC_DCOMP4:
-		return wm8350_clear_bits(wm8350, WM8350_INT_STATUS_2_MASK,
-					 WM8350_IM_AUXADC_DCOMP4_EINT);
-	case WM8350_IRQ_AUXADC_DCOMP3:
-		return wm8350_clear_bits(wm8350, WM8350_INT_STATUS_2_MASK,
-					 WM8350_IM_AUXADC_DCOMP3_EINT);
-	case WM8350_IRQ_AUXADC_DCOMP2:
-		return wm8350_clear_bits(wm8350, WM8350_INT_STATUS_2_MASK,
-					 WM8350_IM_AUXADC_DCOMP2_EINT);
-	case WM8350_IRQ_AUXADC_DCOMP1:
-		return wm8350_clear_bits(wm8350, WM8350_INT_STATUS_2_MASK,
-					 WM8350_IM_AUXADC_DCOMP1_EINT);
-	case WM8350_IRQ_SYS_HYST_COMP_FAIL:
-		return wm8350_clear_bits(wm8350, WM8350_INT_STATUS_2_MASK,
-					 WM8350_IM_SYS_HYST_COMP_FAIL_EINT);
-	case WM8350_IRQ_SYS_CHIP_GT115:
-		return wm8350_clear_bits(wm8350, WM8350_INT_STATUS_2_MASK,
-					 WM8350_IM_SYS_CHIP_GT115_EINT);
-	case WM8350_IRQ_SYS_CHIP_GT140:
-		return wm8350_clear_bits(wm8350, WM8350_INT_STATUS_2_MASK,
-					 WM8350_IM_SYS_CHIP_GT140_EINT);
-	case WM8350_IRQ_SYS_WDOG_TO:
-		return wm8350_clear_bits(wm8350, WM8350_INT_STATUS_2_MASK,
-					 WM8350_IM_SYS_WDOG_TO_EINT);
-	case WM8350_IRQ_UV_LDO4:
-		return wm8350_clear_bits(wm8350,
-					 WM8350_UNDER_VOLTAGE_INT_STATUS_MASK,
-					 WM8350_IM_UV_LDO4_EINT);
-	case WM8350_IRQ_UV_LDO3:
-		return wm8350_clear_bits(wm8350,
-					 WM8350_UNDER_VOLTAGE_INT_STATUS_MASK,
-					 WM8350_IM_UV_LDO3_EINT);
-	case WM8350_IRQ_UV_LDO2:
-		return wm8350_clear_bits(wm8350,
-					 WM8350_UNDER_VOLTAGE_INT_STATUS_MASK,
-					 WM8350_IM_UV_LDO2_EINT);
-	case WM8350_IRQ_UV_LDO1:
-		return wm8350_clear_bits(wm8350,
-					 WM8350_UNDER_VOLTAGE_INT_STATUS_MASK,
-					 WM8350_IM_UV_LDO1_EINT);
-	case WM8350_IRQ_UV_DC6:
-		return wm8350_clear_bits(wm8350,
-					 WM8350_UNDER_VOLTAGE_INT_STATUS_MASK,
-					 WM8350_IM_UV_DC6_EINT);
-	case WM8350_IRQ_UV_DC5:
-		return wm8350_clear_bits(wm8350,
-					 WM8350_UNDER_VOLTAGE_INT_STATUS_MASK,
-					 WM8350_IM_UV_DC5_EINT);
-	case WM8350_IRQ_UV_DC4:
-		return wm8350_clear_bits(wm8350,
-					 WM8350_UNDER_VOLTAGE_INT_STATUS_MASK,
-					 WM8350_IM_UV_DC4_EINT);
-	case WM8350_IRQ_UV_DC3:
-		return wm8350_clear_bits(wm8350,
-					 WM8350_UNDER_VOLTAGE_INT_STATUS_MASK,
-					 WM8350_IM_UV_DC3_EINT);
-	case WM8350_IRQ_UV_DC2:
-		return wm8350_clear_bits(wm8350,
-					 WM8350_UNDER_VOLTAGE_INT_STATUS_MASK,
-					 WM8350_IM_UV_DC2_EINT);
-	case WM8350_IRQ_UV_DC1:
-		return wm8350_clear_bits(wm8350,
-					 WM8350_UNDER_VOLTAGE_INT_STATUS_MASK,
-					 WM8350_IM_UV_DC1_EINT);
-	case WM8350_IRQ_OC_LS:
-		return wm8350_clear_bits(wm8350,
-					 WM8350_OVER_CURRENT_INT_STATUS_MASK,
-					 WM8350_IM_OC_LS_EINT);
-	case WM8350_IRQ_EXT_USB_FB:
-		return wm8350_clear_bits(wm8350,
-					 WM8350_COMPARATOR_INT_STATUS_MASK,
-					 WM8350_IM_EXT_USB_FB_EINT);
-	case WM8350_IRQ_EXT_WALL_FB:
-		return wm8350_clear_bits(wm8350,
-					 WM8350_COMPARATOR_INT_STATUS_MASK,
-					 WM8350_IM_EXT_WALL_FB_EINT);
-	case WM8350_IRQ_EXT_BAT_FB:
-		return wm8350_clear_bits(wm8350,
-					 WM8350_COMPARATOR_INT_STATUS_MASK,
-					 WM8350_IM_EXT_BAT_FB_EINT);
-	case WM8350_IRQ_CODEC_JCK_DET_L:
-		return wm8350_clear_bits(wm8350,
-					 WM8350_COMPARATOR_INT_STATUS_MASK,
-					 WM8350_IM_CODEC_JCK_DET_L_EINT);
-	case WM8350_IRQ_CODEC_JCK_DET_R:
-		return wm8350_clear_bits(wm8350,
-					 WM8350_COMPARATOR_INT_STATUS_MASK,
-					 WM8350_IM_CODEC_JCK_DET_R_EINT);
-	case WM8350_IRQ_CODEC_MICSCD:
-		return wm8350_clear_bits(wm8350,
-					 WM8350_COMPARATOR_INT_STATUS_MASK,
-					 WM8350_IM_CODEC_MICSCD_EINT);
-	case WM8350_IRQ_CODEC_MICD:
-		return wm8350_clear_bits(wm8350,
-					 WM8350_COMPARATOR_INT_STATUS_MASK,
-					 WM8350_IM_CODEC_MICD_EINT);
-	case WM8350_IRQ_WKUP_OFF_STATE:
-		return wm8350_clear_bits(wm8350,
-					 WM8350_COMPARATOR_INT_STATUS_MASK,
-					 WM8350_IM_WKUP_OFF_STATE_EINT);
-	case WM8350_IRQ_WKUP_HIB_STATE:
-		return wm8350_clear_bits(wm8350,
-					 WM8350_COMPARATOR_INT_STATUS_MASK,
-					 WM8350_IM_WKUP_HIB_STATE_EINT);
-	case WM8350_IRQ_WKUP_CONV_FAULT:
-		return wm8350_clear_bits(wm8350,
-					 WM8350_COMPARATOR_INT_STATUS_MASK,
-					 WM8350_IM_WKUP_CONV_FAULT_EINT);
-	case WM8350_IRQ_WKUP_WDOG_RST:
-		return wm8350_clear_bits(wm8350,
-					 WM8350_COMPARATOR_INT_STATUS_MASK,
-					 WM8350_IM_WKUP_OFF_STATE_EINT);
-	case WM8350_IRQ_WKUP_GP_PWR_ON:
-		return wm8350_clear_bits(wm8350,
-					 WM8350_COMPARATOR_INT_STATUS_MASK,
-					 WM8350_IM_WKUP_GP_PWR_ON_EINT);
-	case WM8350_IRQ_WKUP_ONKEY:
-		return wm8350_clear_bits(wm8350,
-					 WM8350_COMPARATOR_INT_STATUS_MASK,
-					 WM8350_IM_WKUP_ONKEY_EINT);
-	case WM8350_IRQ_WKUP_GP_WAKEUP:
-		return wm8350_clear_bits(wm8350,
-					 WM8350_COMPARATOR_INT_STATUS_MASK,
-					 WM8350_IM_WKUP_GP_WAKEUP_EINT);
-	case WM8350_IRQ_GPIO(0):
-		return wm8350_clear_bits(wm8350,
-					 WM8350_GPIO_INT_STATUS_MASK,
-					 WM8350_IM_GP0_EINT);
-	case WM8350_IRQ_GPIO(1):
-		return wm8350_clear_bits(wm8350,
-					 WM8350_GPIO_INT_STATUS_MASK,
-					 WM8350_IM_GP1_EINT);
-	case WM8350_IRQ_GPIO(2):
-		return wm8350_clear_bits(wm8350,
-					 WM8350_GPIO_INT_STATUS_MASK,
-					 WM8350_IM_GP2_EINT);
-	case WM8350_IRQ_GPIO(3):
-		return wm8350_clear_bits(wm8350,
-					 WM8350_GPIO_INT_STATUS_MASK,
-					 WM8350_IM_GP3_EINT);
-	case WM8350_IRQ_GPIO(4):
-		return wm8350_clear_bits(wm8350,
-					 WM8350_GPIO_INT_STATUS_MASK,
-					 WM8350_IM_GP4_EINT);
-	case WM8350_IRQ_GPIO(5):
-		return wm8350_clear_bits(wm8350,
-					 WM8350_GPIO_INT_STATUS_MASK,
-					 WM8350_IM_GP5_EINT);
-	case WM8350_IRQ_GPIO(6):
-		return wm8350_clear_bits(wm8350,
-					 WM8350_GPIO_INT_STATUS_MASK,
-					 WM8350_IM_GP6_EINT);
-	case WM8350_IRQ_GPIO(7):
-		return wm8350_clear_bits(wm8350,
-					 WM8350_GPIO_INT_STATUS_MASK,
-					 WM8350_IM_GP7_EINT);
-	case WM8350_IRQ_GPIO(8):
-		return wm8350_clear_bits(wm8350,
-					 WM8350_GPIO_INT_STATUS_MASK,
-					 WM8350_IM_GP8_EINT);
-	case WM8350_IRQ_GPIO(9):
-		return wm8350_clear_bits(wm8350,
-					 WM8350_GPIO_INT_STATUS_MASK,
-					 WM8350_IM_GP9_EINT);
-	case WM8350_IRQ_GPIO(10):
-		return wm8350_clear_bits(wm8350,
-					 WM8350_GPIO_INT_STATUS_MASK,
-					 WM8350_IM_GP10_EINT);
-	case WM8350_IRQ_GPIO(11):
-		return wm8350_clear_bits(wm8350,
-					 WM8350_GPIO_INT_STATUS_MASK,
-					 WM8350_IM_GP11_EINT);
-	case WM8350_IRQ_GPIO(12):
-		return wm8350_clear_bits(wm8350,
-					 WM8350_GPIO_INT_STATUS_MASK,
-					 WM8350_IM_GP12_EINT);
-	default:
-		dev_warn(wm8350->dev, "Attempting to unmask unknown IRQ %d\n",
-			 irq);
-		return -EINVAL;
-	}
-	return 0;
-}
-EXPORT_SYMBOL_GPL(wm8350_unmask_irq);
-
 int wm8350_read_auxadc(struct wm8350 *wm8350, int channel, int scale, int vref)
 {
 	u16 reg, result = 0;
@@ -1264,7 +536,7 @@ static void wm8350_client_dev_register(struct wm8350 *wm8350,
 	int ret;
 
 	*pdev = platform_device_alloc(name, -1);
-	if (pdev == NULL) {
+	if (*pdev == NULL) {
 		dev_err(wm8350->dev, "Failed to allocate %s\n", name);
 		return;
 	}
@@ -1409,49 +681,18 @@ int wm8350_device_init(struct wm8350 *wm8350, int irq,
 		return ret;
 	}
 
-	wm8350_reg_write(wm8350, WM8350_SYSTEM_INTERRUPTS_MASK, 0xFFFF);
-	wm8350_reg_write(wm8350, WM8350_INT_STATUS_1_MASK, 0xFFFF);
-	wm8350_reg_write(wm8350, WM8350_INT_STATUS_2_MASK, 0xFFFF);
-	wm8350_reg_write(wm8350, WM8350_UNDER_VOLTAGE_INT_STATUS_MASK, 0xFFFF);
-	wm8350_reg_write(wm8350, WM8350_GPIO_INT_STATUS_MASK, 0xFFFF);
-	wm8350_reg_write(wm8350, WM8350_COMPARATOR_INT_STATUS_MASK, 0xFFFF);
-
 	mutex_init(&wm8350->auxadc_mutex);
-	mutex_init(&wm8350->irq_mutex);
-	if (irq) {
-		int flags = IRQF_ONESHOT;
-
-		if (pdata && pdata->irq_high) {
-			flags |= IRQF_TRIGGER_HIGH;
-
-			wm8350_set_bits(wm8350, WM8350_SYSTEM_CONTROL_1,
-					WM8350_IRQ_POL);
-		} else {
-			flags |= IRQF_TRIGGER_LOW;
-
-			wm8350_clear_bits(wm8350, WM8350_SYSTEM_CONTROL_1,
-					  WM8350_IRQ_POL);
-		}
 
-		ret = request_threaded_irq(irq, NULL, wm8350_irq, flags,
-					   "wm8350", wm8350);
-		if (ret != 0) {
-			dev_err(wm8350->dev, "Failed to request IRQ: %d\n",
-				ret);
-			goto err;
-		}
-	} else {
-		dev_err(wm8350->dev, "No IRQ configured\n");
+	ret = wm8350_irq_init(wm8350, irq, pdata);
+	if (ret < 0)
 		goto err;
-	}
-	wm8350->chip_irq = irq;
 
 	if (pdata && pdata->init) {
 		ret = pdata->init(wm8350);
 		if (ret != 0) {
 			dev_err(wm8350->dev, "Platform init() failed: %d\n",
 				ret);
-			goto err;
+			goto err_irq;
 		}
 	}
 
@@ -1470,6 +711,8 @@ int wm8350_device_init(struct wm8350 *wm8350, int irq,
 
 	return 0;
 
+err_irq:
+	wm8350_irq_exit(wm8350);
 err:
 	kfree(wm8350->reg_cache);
 	return ret;
@@ -1493,7 +736,8 @@ void wm8350_device_exit(struct wm8350 *wm8350)
 	platform_device_unregister(wm8350->gpio.pdev);
 	platform_device_unregister(wm8350->codec.pdev);
 
-	free_irq(wm8350->chip_irq, wm8350);
+	wm8350_irq_exit(wm8350);
+
 	kfree(wm8350->reg_cache);
 }
 EXPORT_SYMBOL_GPL(wm8350_device_exit);
diff --git a/drivers/mfd/wm8350-irq.c b/drivers/mfd/wm8350-irq.c
new file mode 100644
index 000000000000..9025f29e2707
--- /dev/null
+++ b/drivers/mfd/wm8350-irq.c
@@ -0,0 +1,529 @@
+/*
+ * wm8350-irq.c  --  IRQ support for Wolfson WM8350
+ *
+ * Copyright 2007, 2008, 2009 Wolfson Microelectronics PLC.
+ *
+ * Author: Liam Girdwood, Mark Brown
+ *
+ *  This program is free software; you can redistribute  it and/or modify it
+ *  under  the terms of  the GNU General  Public License as published by the
+ *  Free Software Foundation;  either version 2 of the  License, or (at your
+ *  option) any later version.
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/bug.h>
+#include <linux/device.h>
+#include <linux/interrupt.h>
+#include <linux/workqueue.h>
+
+#include <linux/mfd/wm8350/core.h>
+#include <linux/mfd/wm8350/audio.h>
+#include <linux/mfd/wm8350/comparator.h>
+#include <linux/mfd/wm8350/gpio.h>
+#include <linux/mfd/wm8350/pmic.h>
+#include <linux/mfd/wm8350/rtc.h>
+#include <linux/mfd/wm8350/supply.h>
+#include <linux/mfd/wm8350/wdt.h>
+
+#define WM8350_NUM_IRQ_REGS 7
+
+#define WM8350_INT_OFFSET_1                     0
+#define WM8350_INT_OFFSET_2                     1
+#define WM8350_POWER_UP_INT_OFFSET              2
+#define WM8350_UNDER_VOLTAGE_INT_OFFSET         3
+#define WM8350_OVER_CURRENT_INT_OFFSET          4
+#define WM8350_GPIO_INT_OFFSET                  5
+#define WM8350_COMPARATOR_INT_OFFSET            6
+
+struct wm8350_irq_data {
+	int primary;
+	int reg;
+	int mask;
+	int primary_only;
+};
+
+static struct wm8350_irq_data wm8350_irqs[] = {
+	[WM8350_IRQ_OC_LS] = {
+		.primary = WM8350_OC_INT,
+		.reg = WM8350_OVER_CURRENT_INT_OFFSET,
+		.mask = WM8350_OC_LS_EINT,
+		.primary_only = 1,
+	},
+	[WM8350_IRQ_UV_DC1] = {
+		.primary = WM8350_UV_INT,
+		.reg = WM8350_UNDER_VOLTAGE_INT_OFFSET,
+		.mask = WM8350_UV_DC1_EINT,
+	},
+	[WM8350_IRQ_UV_DC2] = {
+		.primary = WM8350_UV_INT,
+		.reg = WM8350_UNDER_VOLTAGE_INT_OFFSET,
+		.mask = WM8350_UV_DC2_EINT,
+	},
+	[WM8350_IRQ_UV_DC3] = {
+		.primary = WM8350_UV_INT,
+		.reg = WM8350_UNDER_VOLTAGE_INT_OFFSET,
+		.mask = WM8350_UV_DC3_EINT,
+	},
+	[WM8350_IRQ_UV_DC4] = {
+		.primary = WM8350_UV_INT,
+		.reg = WM8350_UNDER_VOLTAGE_INT_OFFSET,
+		.mask = WM8350_UV_DC4_EINT,
+	},
+	[WM8350_IRQ_UV_DC5] = {
+		.primary = WM8350_UV_INT,
+		.reg = WM8350_UNDER_VOLTAGE_INT_OFFSET,
+		.mask = WM8350_UV_DC5_EINT,
+	},
+	[WM8350_IRQ_UV_DC6] = {
+		.primary = WM8350_UV_INT,
+		.reg = WM8350_UNDER_VOLTAGE_INT_OFFSET,
+		.mask = WM8350_UV_DC6_EINT,
+	},
+	[WM8350_IRQ_UV_LDO1] = {
+		.primary = WM8350_UV_INT,
+		.reg = WM8350_UNDER_VOLTAGE_INT_OFFSET,
+		.mask = WM8350_UV_LDO1_EINT,
+	},
+	[WM8350_IRQ_UV_LDO2] = {
+		.primary = WM8350_UV_INT,
+		.reg = WM8350_UNDER_VOLTAGE_INT_OFFSET,
+		.mask = WM8350_UV_LDO2_EINT,
+	},
+	[WM8350_IRQ_UV_LDO3] = {
+		.primary = WM8350_UV_INT,
+		.reg = WM8350_UNDER_VOLTAGE_INT_OFFSET,
+		.mask = WM8350_UV_LDO3_EINT,
+	},
+	[WM8350_IRQ_UV_LDO4] = {
+		.primary = WM8350_UV_INT,
+		.reg = WM8350_UNDER_VOLTAGE_INT_OFFSET,
+		.mask = WM8350_UV_LDO4_EINT,
+	},
+	[WM8350_IRQ_CHG_BAT_HOT] = {
+		.primary = WM8350_CHG_INT,
+		.reg = WM8350_INT_OFFSET_1,
+		.mask = WM8350_CHG_BAT_HOT_EINT,
+	},
+	[WM8350_IRQ_CHG_BAT_COLD] = {
+		.primary = WM8350_CHG_INT,
+		.reg = WM8350_INT_OFFSET_1,
+		.mask = WM8350_CHG_BAT_COLD_EINT,
+	},
+	[WM8350_IRQ_CHG_BAT_FAIL] = {
+		.primary = WM8350_CHG_INT,
+		.reg = WM8350_INT_OFFSET_1,
+		.mask = WM8350_CHG_BAT_FAIL_EINT,
+	},
+	[WM8350_IRQ_CHG_TO] = {
+		.primary = WM8350_CHG_INT,
+		.reg = WM8350_INT_OFFSET_1,
+		.mask = WM8350_CHG_TO_EINT,
+	},
+	[WM8350_IRQ_CHG_END] = {
+		.primary = WM8350_CHG_INT,
+		.reg = WM8350_INT_OFFSET_1,
+		.mask = WM8350_CHG_END_EINT,
+	},
+	[WM8350_IRQ_CHG_START] = {
+		.primary = WM8350_CHG_INT,
+		.reg = WM8350_INT_OFFSET_1,
+		.mask = WM8350_CHG_START_EINT,
+	},
+	[WM8350_IRQ_CHG_FAST_RDY] = {
+		.primary = WM8350_CHG_INT,
+		.reg = WM8350_INT_OFFSET_1,
+		.mask = WM8350_CHG_FAST_RDY_EINT,
+	},
+	[WM8350_IRQ_CHG_VBATT_LT_3P9] = {
+		.primary = WM8350_CHG_INT,
+		.reg = WM8350_INT_OFFSET_1,
+		.mask = WM8350_CHG_VBATT_LT_3P9_EINT,
+	},
+	[WM8350_IRQ_CHG_VBATT_LT_3P1] = {
+		.primary = WM8350_CHG_INT,
+		.reg = WM8350_INT_OFFSET_1,
+		.mask = WM8350_CHG_VBATT_LT_3P1_EINT,
+	},
+	[WM8350_IRQ_CHG_VBATT_LT_2P85] = {
+		.primary = WM8350_CHG_INT,
+		.reg = WM8350_INT_OFFSET_1,
+		.mask = WM8350_CHG_VBATT_LT_2P85_EINT,
+	},
+	[WM8350_IRQ_RTC_ALM] = {
+		.primary = WM8350_RTC_INT,
+		.reg = WM8350_INT_OFFSET_1,
+		.mask = WM8350_RTC_ALM_EINT,
+	},
+	[WM8350_IRQ_RTC_SEC] = {
+		.primary = WM8350_RTC_INT,
+		.reg = WM8350_INT_OFFSET_1,
+		.mask = WM8350_RTC_SEC_EINT,
+	},
+	[WM8350_IRQ_RTC_PER] = {
+		.primary = WM8350_RTC_INT,
+		.reg = WM8350_INT_OFFSET_1,
+		.mask = WM8350_RTC_PER_EINT,
+	},
+	[WM8350_IRQ_CS1] = {
+		.primary = WM8350_CS_INT,
+		.reg = WM8350_INT_OFFSET_2,
+		.mask = WM8350_CS1_EINT,
+	},
+	[WM8350_IRQ_CS2] = {
+		.primary = WM8350_CS_INT,
+		.reg = WM8350_INT_OFFSET_2,
+		.mask = WM8350_CS2_EINT,
+	},
+	[WM8350_IRQ_SYS_HYST_COMP_FAIL] = {
+		.primary = WM8350_SYS_INT,
+		.reg = WM8350_INT_OFFSET_2,
+		.mask = WM8350_SYS_HYST_COMP_FAIL_EINT,
+	},
+	[WM8350_IRQ_SYS_CHIP_GT115] = {
+		.primary = WM8350_SYS_INT,
+		.reg = WM8350_INT_OFFSET_2,
+		.mask = WM8350_SYS_CHIP_GT115_EINT,
+	},
+	[WM8350_IRQ_SYS_CHIP_GT140] = {
+		.primary = WM8350_SYS_INT,
+		.reg = WM8350_INT_OFFSET_2,
+		.mask = WM8350_SYS_CHIP_GT140_EINT,
+	},
+	[WM8350_IRQ_SYS_WDOG_TO] = {
+		.primary = WM8350_SYS_INT,
+		.reg = WM8350_INT_OFFSET_2,
+		.mask = WM8350_SYS_WDOG_TO_EINT,
+	},
+	[WM8350_IRQ_AUXADC_DATARDY] = {
+		.primary = WM8350_AUXADC_INT,
+		.reg = WM8350_INT_OFFSET_2,
+		.mask = WM8350_AUXADC_DATARDY_EINT,
+	},
+	[WM8350_IRQ_AUXADC_DCOMP4] = {
+		.primary = WM8350_AUXADC_INT,
+		.reg = WM8350_INT_OFFSET_2,
+		.mask = WM8350_AUXADC_DCOMP4_EINT,
+	},
+	[WM8350_IRQ_AUXADC_DCOMP3] = {
+		.primary = WM8350_AUXADC_INT,
+		.reg = WM8350_INT_OFFSET_2,
+		.mask = WM8350_AUXADC_DCOMP3_EINT,
+	},
+	[WM8350_IRQ_AUXADC_DCOMP2] = {
+		.primary = WM8350_AUXADC_INT,
+		.reg = WM8350_INT_OFFSET_2,
+		.mask = WM8350_AUXADC_DCOMP2_EINT,
+	},
+	[WM8350_IRQ_AUXADC_DCOMP1] = {
+		.primary = WM8350_AUXADC_INT,
+		.reg = WM8350_INT_OFFSET_2,
+		.mask = WM8350_AUXADC_DCOMP1_EINT,
+	},
+	[WM8350_IRQ_USB_LIMIT] = {
+		.primary = WM8350_USB_INT,
+		.reg = WM8350_INT_OFFSET_2,
+		.mask = WM8350_USB_LIMIT_EINT,
+		.primary_only = 1,
+	},
+	[WM8350_IRQ_WKUP_OFF_STATE] = {
+		.primary = WM8350_WKUP_INT,
+		.reg = WM8350_COMPARATOR_INT_OFFSET,
+		.mask = WM8350_WKUP_OFF_STATE_EINT,
+	},
+	[WM8350_IRQ_WKUP_HIB_STATE] = {
+		.primary = WM8350_WKUP_INT,
+		.reg = WM8350_COMPARATOR_INT_OFFSET,
+		.mask = WM8350_WKUP_HIB_STATE_EINT,
+	},
+	[WM8350_IRQ_WKUP_CONV_FAULT] = {
+		.primary = WM8350_WKUP_INT,
+		.reg = WM8350_COMPARATOR_INT_OFFSET,
+		.mask = WM8350_WKUP_CONV_FAULT_EINT,
+	},
+	[WM8350_IRQ_WKUP_WDOG_RST] = {
+		.primary = WM8350_WKUP_INT,
+		.reg = WM8350_COMPARATOR_INT_OFFSET,
+		.mask = WM8350_WKUP_WDOG_RST_EINT,
+	},
+	[WM8350_IRQ_WKUP_GP_PWR_ON] = {
+		.primary = WM8350_WKUP_INT,
+		.reg = WM8350_COMPARATOR_INT_OFFSET,
+		.mask = WM8350_WKUP_GP_PWR_ON_EINT,
+	},
+	[WM8350_IRQ_WKUP_ONKEY] = {
+		.primary = WM8350_WKUP_INT,
+		.reg = WM8350_COMPARATOR_INT_OFFSET,
+		.mask = WM8350_WKUP_ONKEY_EINT,
+	},
+	[WM8350_IRQ_WKUP_GP_WAKEUP] = {
+		.primary = WM8350_WKUP_INT,
+		.reg = WM8350_COMPARATOR_INT_OFFSET,
+		.mask = WM8350_WKUP_GP_WAKEUP_EINT,
+	},
+	[WM8350_IRQ_CODEC_JCK_DET_L] = {
+		.primary = WM8350_CODEC_INT,
+		.reg = WM8350_COMPARATOR_INT_OFFSET,
+		.mask = WM8350_CODEC_JCK_DET_L_EINT,
+	},
+	[WM8350_IRQ_CODEC_JCK_DET_R] = {
+		.primary = WM8350_CODEC_INT,
+		.reg = WM8350_COMPARATOR_INT_OFFSET,
+		.mask = WM8350_CODEC_JCK_DET_R_EINT,
+	},
+	[WM8350_IRQ_CODEC_MICSCD] = {
+		.primary = WM8350_CODEC_INT,
+		.reg = WM8350_COMPARATOR_INT_OFFSET,
+		.mask = WM8350_CODEC_MICSCD_EINT,
+	},
+	[WM8350_IRQ_CODEC_MICD] = {
+		.primary = WM8350_CODEC_INT,
+		.reg = WM8350_COMPARATOR_INT_OFFSET,
+		.mask = WM8350_CODEC_MICD_EINT,
+	},
+	[WM8350_IRQ_EXT_USB_FB] = {
+		.primary = WM8350_EXT_INT,
+		.reg = WM8350_COMPARATOR_INT_OFFSET,
+		.mask = WM8350_EXT_USB_FB_EINT,
+	},
+	[WM8350_IRQ_EXT_WALL_FB] = {
+		.primary = WM8350_EXT_INT,
+		.reg = WM8350_COMPARATOR_INT_OFFSET,
+		.mask = WM8350_EXT_WALL_FB_EINT,
+	},
+	[WM8350_IRQ_EXT_BAT_FB] = {
+		.primary = WM8350_EXT_INT,
+		.reg = WM8350_COMPARATOR_INT_OFFSET,
+		.mask = WM8350_EXT_BAT_FB_EINT,
+	},
+	[WM8350_IRQ_GPIO(0)] = {
+		.primary = WM8350_GP_INT,
+		.reg = WM8350_GPIO_INT_OFFSET,
+		.mask = WM8350_GP0_EINT,
+	},
+	[WM8350_IRQ_GPIO(1)] = {
+		.primary = WM8350_GP_INT,
+		.reg = WM8350_GPIO_INT_OFFSET,
+		.mask = WM8350_GP1_EINT,
+	},
+	[WM8350_IRQ_GPIO(2)] = {
+		.primary = WM8350_GP_INT,
+		.reg = WM8350_GPIO_INT_OFFSET,
+		.mask = WM8350_GP2_EINT,
+	},
+	[WM8350_IRQ_GPIO(3)] = {
+		.primary = WM8350_GP_INT,
+		.reg = WM8350_GPIO_INT_OFFSET,
+		.mask = WM8350_GP3_EINT,
+	},
+	[WM8350_IRQ_GPIO(4)] = {
+		.primary = WM8350_GP_INT,
+		.reg = WM8350_GPIO_INT_OFFSET,
+		.mask = WM8350_GP4_EINT,
+	},
+	[WM8350_IRQ_GPIO(5)] = {
+		.primary = WM8350_GP_INT,
+		.reg = WM8350_GPIO_INT_OFFSET,
+		.mask = WM8350_GP5_EINT,
+	},
+	[WM8350_IRQ_GPIO(6)] = {
+		.primary = WM8350_GP_INT,
+		.reg = WM8350_GPIO_INT_OFFSET,
+		.mask = WM8350_GP6_EINT,
+	},
+	[WM8350_IRQ_GPIO(7)] = {
+		.primary = WM8350_GP_INT,
+		.reg = WM8350_GPIO_INT_OFFSET,
+		.mask = WM8350_GP7_EINT,
+	},
+	[WM8350_IRQ_GPIO(8)] = {
+		.primary = WM8350_GP_INT,
+		.reg = WM8350_GPIO_INT_OFFSET,
+		.mask = WM8350_GP8_EINT,
+	},
+	[WM8350_IRQ_GPIO(9)] = {
+		.primary = WM8350_GP_INT,
+		.reg = WM8350_GPIO_INT_OFFSET,
+		.mask = WM8350_GP9_EINT,
+	},
+	[WM8350_IRQ_GPIO(10)] = {
+		.primary = WM8350_GP_INT,
+		.reg = WM8350_GPIO_INT_OFFSET,
+		.mask = WM8350_GP10_EINT,
+	},
+	[WM8350_IRQ_GPIO(11)] = {
+		.primary = WM8350_GP_INT,
+		.reg = WM8350_GPIO_INT_OFFSET,
+		.mask = WM8350_GP11_EINT,
+	},
+	[WM8350_IRQ_GPIO(12)] = {
+		.primary = WM8350_GP_INT,
+		.reg = WM8350_GPIO_INT_OFFSET,
+		.mask = WM8350_GP12_EINT,
+	},
+};
+
+static void wm8350_irq_call_handler(struct wm8350 *wm8350, int irq)
+{
+	mutex_lock(&wm8350->irq_mutex);
+
+	if (wm8350->irq[irq].handler)
+		wm8350->irq[irq].handler(irq, wm8350->irq[irq].data);
+	else {
+		dev_err(wm8350->dev, "irq %d nobody cared. now masked.\n",
+			irq);
+		wm8350_mask_irq(wm8350, irq);
+	}
+
+	mutex_unlock(&wm8350->irq_mutex);
+}
+
+/*
+ * This is a threaded IRQ handler so can access I2C/SPI.  Since all
+ * interrupts are clear on read the IRQ line will be reasserted and
+ * the physical IRQ will be handled again if another interrupt is
+ * asserted while we run - in the normal course of events this is a
+ * rare occurrence so we save I2C/SPI reads.
+ */
+static irqreturn_t wm8350_irq(int irq, void *irq_data)
+{
+	struct wm8350 *wm8350 = irq_data;
+	u16 level_one;
+	u16 sub_reg[WM8350_NUM_IRQ_REGS];
+	int read_done[WM8350_NUM_IRQ_REGS];
+	struct wm8350_irq_data *data;
+	int i;
+
+	/* TODO: Use block reads to improve performance? */
+	level_one = wm8350_reg_read(wm8350, WM8350_SYSTEM_INTERRUPTS)
+		& ~wm8350_reg_read(wm8350, WM8350_SYSTEM_INTERRUPTS_MASK);
+
+	if (!level_one)
+		return IRQ_NONE;
+
+	memset(&read_done, 0, sizeof(read_done));
+
+	for (i = 0; i < ARRAY_SIZE(wm8350_irqs); i++) {
+		data = &wm8350_irqs[i];
+
+		if (!(level_one & data->primary))
+			continue;
+
+		if (!read_done[data->reg]) {
+			sub_reg[data->reg] =
+				wm8350_reg_read(wm8350, WM8350_INT_STATUS_1 +
+						data->reg);
+			sub_reg[data->reg] &=
+				~wm8350_reg_read(wm8350,
+						 WM8350_INT_STATUS_1_MASK +
+						 data->reg);
+			read_done[data->reg] = 1;
+		}
+
+		if (sub_reg[data->reg] & data->mask)
+			wm8350_irq_call_handler(wm8350, i);
+	}
+
+	return IRQ_HANDLED;
+}
+
+int wm8350_register_irq(struct wm8350 *wm8350, int irq,
+			irq_handler_t handler, unsigned long flags,
+			const char *name, void *data)
+{
+	if (irq < 0 || irq >= WM8350_NUM_IRQ || !handler)
+		return -EINVAL;
+
+	if (wm8350->irq[irq].handler)
+		return -EBUSY;
+
+	mutex_lock(&wm8350->irq_mutex);
+	wm8350->irq[irq].handler = handler;
+	wm8350->irq[irq].data = data;
+	mutex_unlock(&wm8350->irq_mutex);
+
+	wm8350_unmask_irq(wm8350, irq);
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(wm8350_register_irq);
+
+int wm8350_free_irq(struct wm8350 *wm8350, int irq)
+{
+	if (irq < 0 || irq >= WM8350_NUM_IRQ)
+		return -EINVAL;
+
+	wm8350_mask_irq(wm8350, irq);
+
+	mutex_lock(&wm8350->irq_mutex);
+	wm8350->irq[irq].handler = NULL;
+	mutex_unlock(&wm8350->irq_mutex);
+	return 0;
+}
+EXPORT_SYMBOL_GPL(wm8350_free_irq);
+
+int wm8350_mask_irq(struct wm8350 *wm8350, int irq)
+{
+	return wm8350_set_bits(wm8350, WM8350_INT_STATUS_1_MASK +
+			       wm8350_irqs[irq].reg,
+			       wm8350_irqs[irq].mask);
+}
+EXPORT_SYMBOL_GPL(wm8350_mask_irq);
+
+int wm8350_unmask_irq(struct wm8350 *wm8350, int irq)
+{
+	return wm8350_clear_bits(wm8350, WM8350_INT_STATUS_1_MASK +
+				 wm8350_irqs[irq].reg,
+				 wm8350_irqs[irq].mask);
+}
+EXPORT_SYMBOL_GPL(wm8350_unmask_irq);
+
+int wm8350_irq_init(struct wm8350 *wm8350, int irq,
+		    struct wm8350_platform_data *pdata)
+{
+	int ret;
+	int flags = IRQF_ONESHOT;
+
+	if (!irq) {
+		dev_err(wm8350->dev, "No IRQ configured\n");
+		return -EINVAL;
+	}
+
+	wm8350_reg_write(wm8350, WM8350_SYSTEM_INTERRUPTS_MASK, 0xFFFF);
+	wm8350_reg_write(wm8350, WM8350_INT_STATUS_1_MASK, 0xFFFF);
+	wm8350_reg_write(wm8350, WM8350_INT_STATUS_2_MASK, 0xFFFF);
+	wm8350_reg_write(wm8350, WM8350_UNDER_VOLTAGE_INT_STATUS_MASK, 0xFFFF);
+	wm8350_reg_write(wm8350, WM8350_GPIO_INT_STATUS_MASK, 0xFFFF);
+	wm8350_reg_write(wm8350, WM8350_COMPARATOR_INT_STATUS_MASK, 0xFFFF);
+
+	mutex_init(&wm8350->irq_mutex);
+	wm8350->chip_irq = irq;
+
+	if (pdata && pdata->irq_high) {
+		flags |= IRQF_TRIGGER_HIGH;
+
+		wm8350_set_bits(wm8350, WM8350_SYSTEM_CONTROL_1,
+				WM8350_IRQ_POL);
+	} else {
+		flags |= IRQF_TRIGGER_LOW;
+
+		wm8350_clear_bits(wm8350, WM8350_SYSTEM_CONTROL_1,
+				  WM8350_IRQ_POL);
+	}
+
+	ret = request_threaded_irq(irq, NULL, wm8350_irq, flags,
+				   "wm8350", wm8350);
+	if (ret != 0)
+		dev_err(wm8350->dev, "Failed to request IRQ: %d\n", ret);
+
+	return ret;
+}
+
+int wm8350_irq_exit(struct wm8350 *wm8350)
+{
+	free_irq(wm8350->chip_irq, wm8350);
+	return 0;
+}
diff --git a/drivers/mfd/wm8350-regmap.c b/drivers/mfd/wm8350-regmap.c
index 7ccc1eab98ab..e965139e5cd5 100644
--- a/drivers/mfd/wm8350-regmap.c
+++ b/drivers/mfd/wm8350-regmap.c
@@ -3170,14 +3170,6 @@ const u16 wm8352_mode3_defaults[] = {
 };
 #endif
 
-/* The register defaults for the config mode used must be compiled in but
- * due to the impact on kernel size it is possible to disable
- */
-#ifndef WM8350_HAVE_CONFIG_MODE
-#warning No WM8350 config modes supported - select at least one of the
-#warning MFD_WM8350_CONFIG_MODE_n options from the board driver.
-#endif
-
 /*
  * Access masks.
  */
diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index 2c16ca6501d5..e3551d20464f 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -13,6 +13,20 @@ menuconfig MISC_DEVICES
 
 if MISC_DEVICES
 
+config AD525X_DPOT
+	tristate "Analog Devices AD525x Digital Potentiometers"
+	depends on I2C && SYSFS
+	help
+	  If you say yes here, you get support for the Analog Devices
+	  AD5258, AD5259, AD5251, AD5252, AD5253, AD5254 and AD5255
+	  digital potentiometer chips.
+
+	  See Documentation/misc-devices/ad525x_dpot.txt for the
+	  userspace interface.
+
+	  This driver can also be built as a module.  If so, the module
+	  will be called ad525x_dpot.
+
 config ATMEL_PWM
 	tristate "Atmel AT32/AT91 PWM support"
 	depends on AVR32 || ARCH_AT91SAM9263 || ARCH_AT91SAM9RL || ARCH_AT91CAP9
@@ -173,6 +187,31 @@ config SGI_XP
 	  this feature will allow for direct communication between SSIs
 	  based on a network adapter and DMA messaging.
 
+config CS5535_MFGPT
+	tristate "CS5535/CS5536 Geode Multi-Function General Purpose Timer (MFGPT) support"
+	depends on PCI
+	depends on X86
+	default n
+	help
+	  This driver provides access to MFGPT functionality for other
+	  drivers that need timers.  MFGPTs are available in the CS5535 and
+	  CS5536 companion chips that are found in AMD Geode and several
+	  other platforms.  They have a better resolution and max interval
+	  than the generic PIT, and are suitable for use as high-res timers.
+	  You probably don't want to enable this manually; other drivers that
+	  make use of it should enable it.
+
+config CS5535_MFGPT_DEFAULT_IRQ
+	int
+	depends on CS5535_MFGPT
+	default 7
+	help
+	  MFGPTs on the CS5535 require an interrupt.  The selected IRQ
+	  can be overridden as a module option as well as by driver that
+	  use the cs5535_mfgpt_ API; however, different architectures might
+	  want to use a different IRQ by default.  This is here for
+	  architectures to set as necessary.
+
 config HP_ILO
 	tristate "Channel interface driver for HP iLO/iLO2 processor"
 	depends on PCI
@@ -210,19 +249,6 @@ config SGI_GRU_DEBUG
 	This option enables addition debugging code for the SGI GRU driver. If
 	you are unsure, say N.
 
-config DELL_LAPTOP
-	tristate "Dell Laptop Extras (EXPERIMENTAL)"
-	depends on X86
-	depends on DCDBAS
-	depends on EXPERIMENTAL
-	depends on BACKLIGHT_CLASS_DEVICE
-	depends on RFKILL
-	depends on POWER_SUPPLY
-	default n
-	---help---
-	This driver adds support for rfkill and backlight control to Dell
-	laptops.
-
 config ISL29003
 	tristate "Intersil ISL29003 ambient light sensor"
 	depends on I2C && SYSFS
@@ -256,6 +282,16 @@ config DS1682
 	  This driver can also be built as a module.  If so, the module
 	  will be called ds1682.
 
+config TI_DAC7512
+	tristate "Texas Instruments DAC7512"
+	depends on SPI && SYSFS
+	help
+	  If you say yes here you get support for the Texas Instruments
+	  DAC7512 16-bit digital-to-analog converter.
+
+	  This driver can also be built as a module. If so, the module
+	  will be calles ti_dac7512.
+
 source "drivers/misc/c2port/Kconfig"
 source "drivers/misc/eeprom/Kconfig"
 source "drivers/misc/cb710/Kconfig"
diff --git a/drivers/misc/Makefile b/drivers/misc/Makefile
index 906a0edcea40..049ff2482f30 100644
--- a/drivers/misc/Makefile
+++ b/drivers/misc/Makefile
@@ -4,6 +4,7 @@
 
 obj-$(CONFIG_IBM_ASM)		+= ibmasm/
 obj-$(CONFIG_HDPU_FEATURES)	+= hdpuftrs/
+obj-$(CONFIG_AD525X_DPOT)	+= ad525x_dpot.o
 obj-$(CONFIG_ATMEL_PWM)		+= atmel_pwm.o
 obj-$(CONFIG_ATMEL_SSC)		+= atmel-ssc.o
 obj-$(CONFIG_ATMEL_TCLIB)	+= atmel_tclib.o
@@ -17,10 +18,12 @@ obj-$(CONFIG_ENCLOSURE_SERVICES) += enclosure.o
 obj-$(CONFIG_KGDB_TESTS)	+= kgdbts.o
 obj-$(CONFIG_SGI_XP)		+= sgi-xp/
 obj-$(CONFIG_SGI_GRU)		+= sgi-gru/
+obj-$(CONFIG_CS5535_MFGPT)	+= cs5535-mfgpt.o
 obj-$(CONFIG_HP_ILO)		+= hpilo.o
 obj-$(CONFIG_ISL29003)		+= isl29003.o
 obj-$(CONFIG_EP93XX_PWM)	+= ep93xx_pwm.o
 obj-$(CONFIG_DS1682)		+= ds1682.o
+obj-$(CONFIG_TI_DAC7512)	+= ti_dac7512.o
 obj-$(CONFIG_C2PORT)		+= c2port/
 obj-$(CONFIG_IWMC3200TOP)      += iwmc3200top/
 obj-y				+= eeprom/
diff --git a/drivers/misc/ad525x_dpot.c b/drivers/misc/ad525x_dpot.c
new file mode 100644
index 000000000000..30a59f2bacd2
--- /dev/null
+++ b/drivers/misc/ad525x_dpot.c
@@ -0,0 +1,666 @@
+/*
+ * ad525x_dpot: Driver for the Analog Devices AD525x digital potentiometers
+ * Copyright (c) 2009 Analog Devices, Inc.
+ * Author: Michael Hennerich <hennerich@blackfin.uclinux.org>
+ *
+ * DEVID		#Wipers		#Positions 	Resistor Options (kOhm)
+ * AD5258		1		64		1, 10, 50, 100
+ * AD5259		1		256		5, 10, 50, 100
+ * AD5251		2		64		1, 10, 50, 100
+ * AD5252		2		256		1, 10, 50, 100
+ * AD5255		3		512		25, 250
+ * AD5253		4		64		1, 10, 50, 100
+ * AD5254		4		256		1, 10, 50, 100
+ *
+ * See Documentation/misc-devices/ad525x_dpot.txt for more info.
+ *
+ * derived from ad5258.c
+ * Copyright (c) 2009 Cyber Switching, Inc.
+ * Author: Chris Verges <chrisv@cyberswitching.com>
+ *
+ * derived from ad5252.c
+ * Copyright (c) 2006 Michael Hennerich <hennerich@blackfin.uclinux.org>
+ *
+ * Licensed under the GPL-2 or later.
+ */
+
+#include <linux/module.h>
+#include <linux/device.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/i2c.h>
+#include <linux/delay.h>
+
+#define DRIVER_NAME			"ad525x_dpot"
+#define DRIVER_VERSION			"0.1"
+
+enum dpot_devid {
+	AD5258_ID,
+	AD5259_ID,
+	AD5251_ID,
+	AD5252_ID,
+	AD5253_ID,
+	AD5254_ID,
+	AD5255_ID,
+};
+
+#define AD5258_MAX_POSITION		64
+#define AD5259_MAX_POSITION		256
+#define AD5251_MAX_POSITION		64
+#define AD5252_MAX_POSITION		256
+#define AD5253_MAX_POSITION		64
+#define AD5254_MAX_POSITION		256
+#define AD5255_MAX_POSITION		512
+
+#define AD525X_RDAC0		0
+#define AD525X_RDAC1		1
+#define AD525X_RDAC2		2
+#define AD525X_RDAC3		3
+
+#define AD525X_REG_TOL		0x18
+#define AD525X_TOL_RDAC0	(AD525X_REG_TOL | AD525X_RDAC0)
+#define AD525X_TOL_RDAC1	(AD525X_REG_TOL | AD525X_RDAC1)
+#define AD525X_TOL_RDAC2	(AD525X_REG_TOL | AD525X_RDAC2)
+#define AD525X_TOL_RDAC3	(AD525X_REG_TOL | AD525X_RDAC3)
+
+/* RDAC-to-EEPROM Interface Commands */
+#define AD525X_I2C_RDAC		(0x00 << 5)
+#define AD525X_I2C_EEPROM	(0x01 << 5)
+#define AD525X_I2C_CMD		(0x80)
+
+#define AD525X_DEC_ALL_6DB	(AD525X_I2C_CMD | (0x4 << 3))
+#define AD525X_INC_ALL_6DB	(AD525X_I2C_CMD | (0x9 << 3))
+#define AD525X_DEC_ALL		(AD525X_I2C_CMD | (0x6 << 3))
+#define AD525X_INC_ALL		(AD525X_I2C_CMD | (0xB << 3))
+
+static s32 ad525x_read(struct i2c_client *client, u8 reg);
+static s32 ad525x_write(struct i2c_client *client, u8 reg, u8 value);
+
+/*
+ * Client data (each client gets its own)
+ */
+
+struct dpot_data {
+	struct mutex update_lock;
+	unsigned rdac_mask;
+	unsigned max_pos;
+	unsigned devid;
+};
+
+/* sysfs functions */
+
+static ssize_t sysfs_show_reg(struct device *dev,
+			      struct device_attribute *attr, char *buf, u32 reg)
+{
+	struct i2c_client *client = to_i2c_client(dev);
+	struct dpot_data *data = i2c_get_clientdata(client);
+	s32 value;
+
+	mutex_lock(&data->update_lock);
+	value = ad525x_read(client, reg);
+	mutex_unlock(&data->update_lock);
+
+	if (value < 0)
+		return -EINVAL;
+	/*
+	 * Let someone else deal with converting this ...
+	 * the tolerance is a two-byte value where the MSB
+	 * is a sign + integer value, and the LSB is a
+	 * decimal value.  See page 18 of the AD5258
+	 * datasheet (Rev. A) for more details.
+	 */
+
+	if (reg & AD525X_REG_TOL)
+		return sprintf(buf, "0x%04x\n", value & 0xFFFF);
+	else
+		return sprintf(buf, "%u\n", value & data->rdac_mask);
+}
+
+static ssize_t sysfs_set_reg(struct device *dev,
+			     struct device_attribute *attr,
+			     const char *buf, size_t count, u32 reg)
+{
+	struct i2c_client *client = to_i2c_client(dev);
+	struct dpot_data *data = i2c_get_clientdata(client);
+	unsigned long value;
+	int err;
+
+	err = strict_strtoul(buf, 10, &value);
+	if (err)
+		return err;
+
+	if (value > data->rdac_mask)
+		value = data->rdac_mask;
+
+	mutex_lock(&data->update_lock);
+	ad525x_write(client, reg, value);
+	if (reg & AD525X_I2C_EEPROM)
+		msleep(26);	/* Sleep while the EEPROM updates */
+	mutex_unlock(&data->update_lock);
+
+	return count;
+}
+
+static ssize_t sysfs_do_cmd(struct device *dev,
+			    struct device_attribute *attr,
+			    const char *buf, size_t count, u32 reg)
+{
+	struct i2c_client *client = to_i2c_client(dev);
+	struct dpot_data *data = i2c_get_clientdata(client);
+
+	mutex_lock(&data->update_lock);
+	ad525x_write(client, reg, 0);
+	mutex_unlock(&data->update_lock);
+
+	return count;
+}
+
+/* ------------------------------------------------------------------------- */
+
+static ssize_t show_rdac0(struct device *dev,
+			  struct device_attribute *attr, char *buf)
+{
+	return sysfs_show_reg(dev, attr, buf, AD525X_I2C_RDAC | AD525X_RDAC0);
+}
+
+static ssize_t set_rdac0(struct device *dev,
+			 struct device_attribute *attr,
+			 const char *buf, size_t count)
+{
+	return sysfs_set_reg(dev, attr, buf, count,
+			     AD525X_I2C_RDAC | AD525X_RDAC0);
+}
+
+static DEVICE_ATTR(rdac0, S_IWUSR | S_IRUGO, show_rdac0, set_rdac0);
+
+static ssize_t show_eeprom0(struct device *dev,
+			    struct device_attribute *attr, char *buf)
+{
+	return sysfs_show_reg(dev, attr, buf, AD525X_I2C_EEPROM | AD525X_RDAC0);
+}
+
+static ssize_t set_eeprom0(struct device *dev,
+			   struct device_attribute *attr,
+			   const char *buf, size_t count)
+{
+	return sysfs_set_reg(dev, attr, buf, count,
+			     AD525X_I2C_EEPROM | AD525X_RDAC0);
+}
+
+static DEVICE_ATTR(eeprom0, S_IWUSR | S_IRUGO, show_eeprom0, set_eeprom0);
+
+static ssize_t show_tolerance0(struct device *dev,
+			       struct device_attribute *attr, char *buf)
+{
+	return sysfs_show_reg(dev, attr, buf,
+			      AD525X_I2C_EEPROM | AD525X_TOL_RDAC0);
+}
+
+static DEVICE_ATTR(tolerance0, S_IRUGO, show_tolerance0, NULL);
+
+/* ------------------------------------------------------------------------- */
+
+static ssize_t show_rdac1(struct device *dev,
+			  struct device_attribute *attr, char *buf)
+{
+	return sysfs_show_reg(dev, attr, buf, AD525X_I2C_RDAC | AD525X_RDAC1);
+}
+
+static ssize_t set_rdac1(struct device *dev,
+			 struct device_attribute *attr,
+			 const char *buf, size_t count)
+{
+	return sysfs_set_reg(dev, attr, buf, count,
+			     AD525X_I2C_RDAC | AD525X_RDAC1);
+}
+
+static DEVICE_ATTR(rdac1, S_IWUSR | S_IRUGO, show_rdac1, set_rdac1);
+
+static ssize_t show_eeprom1(struct device *dev,
+			    struct device_attribute *attr, char *buf)
+{
+	return sysfs_show_reg(dev, attr, buf, AD525X_I2C_EEPROM | AD525X_RDAC1);
+}
+
+static ssize_t set_eeprom1(struct device *dev,
+			   struct device_attribute *attr,
+			   const char *buf, size_t count)
+{
+	return sysfs_set_reg(dev, attr, buf, count,
+			     AD525X_I2C_EEPROM | AD525X_RDAC1);
+}
+
+static DEVICE_ATTR(eeprom1, S_IWUSR | S_IRUGO, show_eeprom1, set_eeprom1);
+
+static ssize_t show_tolerance1(struct device *dev,
+			       struct device_attribute *attr, char *buf)
+{
+	return sysfs_show_reg(dev, attr, buf,
+			      AD525X_I2C_EEPROM | AD525X_TOL_RDAC1);
+}
+
+static DEVICE_ATTR(tolerance1, S_IRUGO, show_tolerance1, NULL);
+
+/* ------------------------------------------------------------------------- */
+
+static ssize_t show_rdac2(struct device *dev,
+			  struct device_attribute *attr, char *buf)
+{
+	return sysfs_show_reg(dev, attr, buf, AD525X_I2C_RDAC | AD525X_RDAC2);
+}
+
+static ssize_t set_rdac2(struct device *dev,
+			 struct device_attribute *attr,
+			 const char *buf, size_t count)
+{
+	return sysfs_set_reg(dev, attr, buf, count,
+			     AD525X_I2C_RDAC | AD525X_RDAC2);
+}
+
+static DEVICE_ATTR(rdac2, S_IWUSR | S_IRUGO, show_rdac2, set_rdac2);
+
+static ssize_t show_eeprom2(struct device *dev,
+			    struct device_attribute *attr, char *buf)
+{
+	return sysfs_show_reg(dev, attr, buf, AD525X_I2C_EEPROM | AD525X_RDAC2);
+}
+
+static ssize_t set_eeprom2(struct device *dev,
+			   struct device_attribute *attr,
+			   const char *buf, size_t count)
+{
+	return sysfs_set_reg(dev, attr, buf, count,
+			     AD525X_I2C_EEPROM | AD525X_RDAC2);
+}
+
+static DEVICE_ATTR(eeprom2, S_IWUSR | S_IRUGO, show_eeprom2, set_eeprom2);
+
+static ssize_t show_tolerance2(struct device *dev,
+			       struct device_attribute *attr, char *buf)
+{
+	return sysfs_show_reg(dev, attr, buf,
+			      AD525X_I2C_EEPROM | AD525X_TOL_RDAC2);
+}
+
+static DEVICE_ATTR(tolerance2, S_IRUGO, show_tolerance2, NULL);
+
+/* ------------------------------------------------------------------------- */
+
+static ssize_t show_rdac3(struct device *dev,
+			  struct device_attribute *attr, char *buf)
+{
+	return sysfs_show_reg(dev, attr, buf, AD525X_I2C_RDAC | AD525X_RDAC3);
+}
+
+static ssize_t set_rdac3(struct device *dev,
+			 struct device_attribute *attr,
+			 const char *buf, size_t count)
+{
+	return sysfs_set_reg(dev, attr, buf, count,
+			     AD525X_I2C_RDAC | AD525X_RDAC3);
+}
+
+static DEVICE_ATTR(rdac3, S_IWUSR | S_IRUGO, show_rdac3, set_rdac3);
+
+static ssize_t show_eeprom3(struct device *dev,
+			    struct device_attribute *attr, char *buf)
+{
+	return sysfs_show_reg(dev, attr, buf, AD525X_I2C_EEPROM | AD525X_RDAC3);
+}
+
+static ssize_t set_eeprom3(struct device *dev,
+			   struct device_attribute *attr,
+			   const char *buf, size_t count)
+{
+	return sysfs_set_reg(dev, attr, buf, count,
+			     AD525X_I2C_EEPROM | AD525X_RDAC3);
+}
+
+static DEVICE_ATTR(eeprom3, S_IWUSR | S_IRUGO, show_eeprom3, set_eeprom3);
+
+static ssize_t show_tolerance3(struct device *dev,
+			       struct device_attribute *attr, char *buf)
+{
+	return sysfs_show_reg(dev, attr, buf,
+			      AD525X_I2C_EEPROM | AD525X_TOL_RDAC3);
+}
+
+static DEVICE_ATTR(tolerance3, S_IRUGO, show_tolerance3, NULL);
+
+static struct attribute *ad525x_attributes_wipers[4][4] = {
+	{
+		&dev_attr_rdac0.attr,
+		&dev_attr_eeprom0.attr,
+		&dev_attr_tolerance0.attr,
+		NULL
+	}, {
+		&dev_attr_rdac1.attr,
+		&dev_attr_eeprom1.attr,
+		&dev_attr_tolerance1.attr,
+		NULL
+	}, {
+		&dev_attr_rdac2.attr,
+		&dev_attr_eeprom2.attr,
+		&dev_attr_tolerance2.attr,
+		NULL
+	}, {
+		&dev_attr_rdac3.attr,
+		&dev_attr_eeprom3.attr,
+		&dev_attr_tolerance3.attr,
+		NULL
+	}
+};
+
+static const struct attribute_group ad525x_group_wipers[] = {
+	{.attrs = ad525x_attributes_wipers[AD525X_RDAC0]},
+	{.attrs = ad525x_attributes_wipers[AD525X_RDAC1]},
+	{.attrs = ad525x_attributes_wipers[AD525X_RDAC2]},
+	{.attrs = ad525x_attributes_wipers[AD525X_RDAC3]},
+};
+
+/* ------------------------------------------------------------------------- */
+
+static ssize_t set_inc_all(struct device *dev,
+			   struct device_attribute *attr,
+			   const char *buf, size_t count)
+{
+	return sysfs_do_cmd(dev, attr, buf, count, AD525X_INC_ALL);
+}
+
+static DEVICE_ATTR(inc_all, S_IWUSR, NULL, set_inc_all);
+
+static ssize_t set_dec_all(struct device *dev,
+			   struct device_attribute *attr,
+			   const char *buf, size_t count)
+{
+	return sysfs_do_cmd(dev, attr, buf, count, AD525X_DEC_ALL);
+}
+
+static DEVICE_ATTR(dec_all, S_IWUSR, NULL, set_dec_all);
+
+static ssize_t set_inc_all_6db(struct device *dev,
+			       struct device_attribute *attr,
+			       const char *buf, size_t count)
+{
+	return sysfs_do_cmd(dev, attr, buf, count, AD525X_INC_ALL_6DB);
+}
+
+static DEVICE_ATTR(inc_all_6db, S_IWUSR, NULL, set_inc_all_6db);
+
+static ssize_t set_dec_all_6db(struct device *dev,
+			       struct device_attribute *attr,
+			       const char *buf, size_t count)
+{
+	return sysfs_do_cmd(dev, attr, buf, count, AD525X_DEC_ALL_6DB);
+}
+
+static DEVICE_ATTR(dec_all_6db, S_IWUSR, NULL, set_dec_all_6db);
+
+static struct attribute *ad525x_attributes_commands[] = {
+	&dev_attr_inc_all.attr,
+	&dev_attr_dec_all.attr,
+	&dev_attr_inc_all_6db.attr,
+	&dev_attr_dec_all_6db.attr,
+	NULL
+};
+
+static const struct attribute_group ad525x_group_commands = {
+	.attrs = ad525x_attributes_commands,
+};
+
+/* ------------------------------------------------------------------------- */
+
+/* i2c device functions */
+
+/**
+ * ad525x_read - return the value contained in the specified register
+ * on the AD5258 device.
+ * @client: value returned from i2c_new_device()
+ * @reg: the register to read
+ *
+ * If the tolerance register is specified, 2 bytes are returned.
+ * Otherwise, 1 byte is returned.  A negative value indicates an error
+ * occurred while reading the register.
+ */
+static s32 ad525x_read(struct i2c_client *client, u8 reg)
+{
+	struct dpot_data *data = i2c_get_clientdata(client);
+
+	if ((reg & AD525X_REG_TOL) || (data->max_pos > 256))
+		return i2c_smbus_read_word_data(client, (reg & 0xF8) |
+						((reg & 0x7) << 1));
+	else
+		return i2c_smbus_read_byte_data(client, reg);
+}
+
+/**
+ * ad525x_write - store the given value in the specified register on
+ * the AD5258 device.
+ * @client: value returned from i2c_new_device()
+ * @reg: the register to write
+ * @value: the byte to store in the register
+ *
+ * For certain instructions that do not require a data byte, "NULL"
+ * should be specified for the "value" parameter.  These instructions
+ * include NOP, RESTORE_FROM_EEPROM, and STORE_TO_EEPROM.
+ *
+ * A negative return value indicates an error occurred while reading
+ * the register.
+ */
+static s32 ad525x_write(struct i2c_client *client, u8 reg, u8 value)
+{
+	struct dpot_data *data = i2c_get_clientdata(client);
+
+	/* Only write the instruction byte for certain commands */
+	if (reg & AD525X_I2C_CMD)
+		return i2c_smbus_write_byte(client, reg);
+
+	if (data->max_pos > 256)
+		return i2c_smbus_write_word_data(client, (reg & 0xF8) |
+						((reg & 0x7) << 1), value);
+	else
+		/* All other registers require instruction + data bytes */
+		return i2c_smbus_write_byte_data(client, reg, value);
+}
+
+static int ad525x_probe(struct i2c_client *client,
+			const struct i2c_device_id *id)
+{
+	struct device *dev = &client->dev;
+	struct dpot_data *data;
+	int err = 0;
+
+	dev_dbg(dev, "%s\n", __func__);
+
+	if (!i2c_check_functionality(client->adapter, I2C_FUNC_SMBUS_BYTE)) {
+		dev_err(dev, "missing I2C functionality for this driver\n");
+		goto exit;
+	}
+
+	data = kzalloc(sizeof(struct dpot_data), GFP_KERNEL);
+	if (!data) {
+		err = -ENOMEM;
+		goto exit;
+	}
+
+	i2c_set_clientdata(client, data);
+	mutex_init(&data->update_lock);
+
+	switch (id->driver_data) {
+	case AD5258_ID:
+		data->max_pos = AD5258_MAX_POSITION;
+		err = sysfs_create_group(&dev->kobj,
+				       &ad525x_group_wipers[AD525X_RDAC0]);
+		break;
+	case AD5259_ID:
+		data->max_pos = AD5259_MAX_POSITION;
+		err = sysfs_create_group(&dev->kobj,
+				       &ad525x_group_wipers[AD525X_RDAC0]);
+		break;
+	case AD5251_ID:
+		data->max_pos = AD5251_MAX_POSITION;
+		err = sysfs_create_group(&dev->kobj,
+				       &ad525x_group_wipers[AD525X_RDAC1]);
+		err |= sysfs_create_group(&dev->kobj,
+				       &ad525x_group_wipers[AD525X_RDAC3]);
+		err |= sysfs_create_group(&dev->kobj, &ad525x_group_commands);
+		break;
+	case AD5252_ID:
+		data->max_pos = AD5252_MAX_POSITION;
+		err = sysfs_create_group(&dev->kobj,
+				       &ad525x_group_wipers[AD525X_RDAC1]);
+		err |= sysfs_create_group(&dev->kobj,
+				       &ad525x_group_wipers[AD525X_RDAC3]);
+		err |= sysfs_create_group(&dev->kobj, &ad525x_group_commands);
+		break;
+	case AD5253_ID:
+		data->max_pos = AD5253_MAX_POSITION;
+		err = sysfs_create_group(&dev->kobj,
+				       &ad525x_group_wipers[AD525X_RDAC0]);
+		err |= sysfs_create_group(&dev->kobj,
+				       &ad525x_group_wipers[AD525X_RDAC1]);
+		err |= sysfs_create_group(&dev->kobj,
+				       &ad525x_group_wipers[AD525X_RDAC2]);
+		err |= sysfs_create_group(&dev->kobj,
+				       &ad525x_group_wipers[AD525X_RDAC3]);
+		err |= sysfs_create_group(&dev->kobj, &ad525x_group_commands);
+		break;
+	case AD5254_ID:
+		data->max_pos = AD5254_MAX_POSITION;
+		err = sysfs_create_group(&dev->kobj,
+				       &ad525x_group_wipers[AD525X_RDAC0]);
+		err |= sysfs_create_group(&dev->kobj,
+				       &ad525x_group_wipers[AD525X_RDAC1]);
+		err |= sysfs_create_group(&dev->kobj,
+				       &ad525x_group_wipers[AD525X_RDAC2]);
+		err |= sysfs_create_group(&dev->kobj,
+				       &ad525x_group_wipers[AD525X_RDAC3]);
+		err |= sysfs_create_group(&dev->kobj, &ad525x_group_commands);
+		break;
+	case AD5255_ID:
+		data->max_pos = AD5255_MAX_POSITION;
+		err = sysfs_create_group(&dev->kobj,
+				       &ad525x_group_wipers[AD525X_RDAC0]);
+		err |= sysfs_create_group(&dev->kobj,
+				       &ad525x_group_wipers[AD525X_RDAC1]);
+		err |= sysfs_create_group(&dev->kobj,
+				       &ad525x_group_wipers[AD525X_RDAC2]);
+		err |= sysfs_create_group(&dev->kobj, &ad525x_group_commands);
+		break;
+	default:
+		err = -ENODEV;
+		goto exit_free;
+	}
+
+	if (err) {
+		dev_err(dev, "failed to register sysfs hooks\n");
+		goto exit_free;
+	}
+
+	data->devid = id->driver_data;
+	data->rdac_mask = data->max_pos - 1;
+
+	dev_info(dev, "%s %d-Position Digital Potentiometer registered\n",
+		 id->name, data->max_pos);
+
+	return 0;
+
+exit_free:
+	kfree(data);
+	i2c_set_clientdata(client, NULL);
+exit:
+	dev_err(dev, "failed to create client\n");
+	return err;
+}
+
+static int __devexit ad525x_remove(struct i2c_client *client)
+{
+	struct dpot_data *data = i2c_get_clientdata(client);
+	struct device *dev = &client->dev;
+
+	switch (data->devid) {
+	case AD5258_ID:
+	case AD5259_ID:
+		sysfs_remove_group(&dev->kobj,
+				   &ad525x_group_wipers[AD525X_RDAC0]);
+		break;
+	case AD5251_ID:
+	case AD5252_ID:
+		sysfs_remove_group(&dev->kobj,
+				   &ad525x_group_wipers[AD525X_RDAC1]);
+		sysfs_remove_group(&dev->kobj,
+				   &ad525x_group_wipers[AD525X_RDAC3]);
+		sysfs_remove_group(&dev->kobj, &ad525x_group_commands);
+		break;
+	case AD5253_ID:
+	case AD5254_ID:
+		sysfs_remove_group(&dev->kobj,
+				   &ad525x_group_wipers[AD525X_RDAC0]);
+		sysfs_remove_group(&dev->kobj,
+				   &ad525x_group_wipers[AD525X_RDAC1]);
+		sysfs_remove_group(&dev->kobj,
+				   &ad525x_group_wipers[AD525X_RDAC2]);
+		sysfs_remove_group(&dev->kobj,
+				   &ad525x_group_wipers[AD525X_RDAC3]);
+		sysfs_remove_group(&dev->kobj, &ad525x_group_commands);
+		break;
+	case AD5255_ID:
+		sysfs_remove_group(&dev->kobj,
+				   &ad525x_group_wipers[AD525X_RDAC0]);
+		sysfs_remove_group(&dev->kobj,
+				   &ad525x_group_wipers[AD525X_RDAC1]);
+		sysfs_remove_group(&dev->kobj,
+				   &ad525x_group_wipers[AD525X_RDAC2]);
+		sysfs_remove_group(&dev->kobj, &ad525x_group_commands);
+		break;
+	}
+
+	i2c_set_clientdata(client, NULL);
+	kfree(data);
+
+	return 0;
+}
+
+static const struct i2c_device_id ad525x_idtable[] = {
+	{"ad5258", AD5258_ID},
+	{"ad5259", AD5259_ID},
+	{"ad5251", AD5251_ID},
+	{"ad5252", AD5252_ID},
+	{"ad5253", AD5253_ID},
+	{"ad5254", AD5254_ID},
+	{"ad5255", AD5255_ID},
+	{}
+};
+
+MODULE_DEVICE_TABLE(i2c, ad525x_idtable);
+
+static struct i2c_driver ad525x_driver = {
+	.driver = {
+		   .owner = THIS_MODULE,
+		   .name = DRIVER_NAME,
+		   },
+	.id_table = ad525x_idtable,
+	.probe = ad525x_probe,
+	.remove = __devexit_p(ad525x_remove),
+};
+
+static int __init ad525x_init(void)
+{
+	return i2c_add_driver(&ad525x_driver);
+}
+
+module_init(ad525x_init);
+
+static void __exit ad525x_exit(void)
+{
+	i2c_del_driver(&ad525x_driver);
+}
+
+module_exit(ad525x_exit);
+
+MODULE_AUTHOR("Chris Verges <chrisv@cyberswitching.com>, "
+	      "Michael Hennerich <hennerich@blackfin.uclinux.org>, ");
+MODULE_DESCRIPTION("AD5258/9 digital potentiometer driver");
+MODULE_LICENSE("GPL");
+MODULE_VERSION(DRIVER_VERSION);
diff --git a/drivers/misc/cs5535-mfgpt.c b/drivers/misc/cs5535-mfgpt.c
new file mode 100644
index 000000000000..8110460558ff
--- /dev/null
+++ b/drivers/misc/cs5535-mfgpt.c
@@ -0,0 +1,370 @@
+/*
+ * Driver for the CS5535/CS5536 Multi-Function General Purpose Timers (MFGPT)
+ *
+ * Copyright (C) 2006, Advanced Micro Devices, Inc.
+ * Copyright (C) 2007  Andres Salomon <dilinger@debian.org>
+ * Copyright (C) 2009  Andres Salomon <dilinger@collabora.co.uk>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public License
+ * as published by the Free Software Foundation.
+ *
+ * The MFGPTs are documented in AMD Geode CS5536 Companion Device Data Book.
+ */
+
+#include <linux/kernel.h>
+#include <linux/spinlock.h>
+#include <linux/interrupt.h>
+#include <linux/module.h>
+#include <linux/pci.h>
+#include <linux/cs5535.h>
+
+#define DRV_NAME "cs5535-mfgpt"
+#define MFGPT_BAR 2
+
+static int mfgpt_reset_timers;
+module_param_named(mfgptfix, mfgpt_reset_timers, int, 0644);
+MODULE_PARM_DESC(mfgptfix, "Reset the MFGPT timers during init; "
+		"required by some broken BIOSes (ie, TinyBIOS < 0.99).");
+
+struct cs5535_mfgpt_timer {
+	struct cs5535_mfgpt_chip *chip;
+	int nr;
+};
+
+static struct cs5535_mfgpt_chip {
+	DECLARE_BITMAP(avail, MFGPT_MAX_TIMERS);
+	resource_size_t base;
+
+	struct pci_dev *pdev;
+	spinlock_t lock;
+	int initialized;
+} cs5535_mfgpt_chip;
+
+int cs5535_mfgpt_toggle_event(struct cs5535_mfgpt_timer *timer, int cmp,
+		int event, int enable)
+{
+	uint32_t msr, mask, value, dummy;
+	int shift = (cmp == MFGPT_CMP1) ? 0 : 8;
+
+	if (!timer) {
+		WARN_ON(1);
+		return -EIO;
+	}
+
+	/*
+	 * The register maps for these are described in sections 6.17.1.x of
+	 * the AMD Geode CS5536 Companion Device Data Book.
+	 */
+	switch (event) {
+	case MFGPT_EVENT_RESET:
+		/*
+		 * XXX: According to the docs, we cannot reset timers above
+		 * 6; that is, resets for 7 and 8 will be ignored.  Is this
+		 * a problem?   -dilinger
+		 */
+		msr = MSR_MFGPT_NR;
+		mask = 1 << (timer->nr + 24);
+		break;
+
+	case MFGPT_EVENT_NMI:
+		msr = MSR_MFGPT_NR;
+		mask = 1 << (timer->nr + shift);
+		break;
+
+	case MFGPT_EVENT_IRQ:
+		msr = MSR_MFGPT_IRQ;
+		mask = 1 << (timer->nr + shift);
+		break;
+
+	default:
+		return -EIO;
+	}
+
+	rdmsr(msr, value, dummy);
+
+	if (enable)
+		value |= mask;
+	else
+		value &= ~mask;
+
+	wrmsr(msr, value, dummy);
+	return 0;
+}
+EXPORT_SYMBOL_GPL(cs5535_mfgpt_toggle_event);
+
+int cs5535_mfgpt_set_irq(struct cs5535_mfgpt_timer *timer, int cmp, int *irq,
+		int enable)
+{
+	uint32_t zsel, lpc, dummy;
+	int shift;
+
+	if (!timer) {
+		WARN_ON(1);
+		return -EIO;
+	}
+
+	/*
+	 * Unfortunately, MFGPTs come in pairs sharing their IRQ lines. If VSA
+	 * is using the same CMP of the timer's Siamese twin, the IRQ is set to
+	 * 2, and we mustn't use nor change it.
+	 * XXX: Likewise, 2 Linux drivers might clash if the 2nd overwrites the
+	 * IRQ of the 1st. This can only happen if forcing an IRQ, calling this
+	 * with *irq==0 is safe. Currently there _are_ no 2 drivers.
+	 */
+	rdmsr(MSR_PIC_ZSEL_LOW, zsel, dummy);
+	shift = ((cmp == MFGPT_CMP1 ? 0 : 4) + timer->nr % 4) * 4;
+	if (((zsel >> shift) & 0xF) == 2)
+		return -EIO;
+
+	/* Choose IRQ: if none supplied, keep IRQ already set or use default */
+	if (!*irq)
+		*irq = (zsel >> shift) & 0xF;
+	if (!*irq)
+		*irq = CONFIG_CS5535_MFGPT_DEFAULT_IRQ;
+
+	/* Can't use IRQ if it's 0 (=disabled), 2, or routed to LPC */
+	if (*irq < 1 || *irq == 2 || *irq > 15)
+		return -EIO;
+	rdmsr(MSR_PIC_IRQM_LPC, lpc, dummy);
+	if (lpc & (1 << *irq))
+		return -EIO;
+
+	/* All chosen and checked - go for it */
+	if (cs5535_mfgpt_toggle_event(timer, cmp, MFGPT_EVENT_IRQ, enable))
+		return -EIO;
+	if (enable) {
+		zsel = (zsel & ~(0xF << shift)) | (*irq << shift);
+		wrmsr(MSR_PIC_ZSEL_LOW, zsel, dummy);
+	}
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(cs5535_mfgpt_set_irq);
+
+struct cs5535_mfgpt_timer *cs5535_mfgpt_alloc_timer(int timer_nr, int domain)
+{
+	struct cs5535_mfgpt_chip *mfgpt = &cs5535_mfgpt_chip;
+	struct cs5535_mfgpt_timer *timer = NULL;
+	unsigned long flags;
+	int max;
+
+	if (!mfgpt->initialized)
+		goto done;
+
+	/* only allocate timers from the working domain if requested */
+	if (domain == MFGPT_DOMAIN_WORKING)
+		max = 6;
+	else
+		max = MFGPT_MAX_TIMERS;
+
+	if (timer_nr >= max) {
+		/* programmer error.  silly programmers! */
+		WARN_ON(1);
+		goto done;
+	}
+
+	spin_lock_irqsave(&mfgpt->lock, flags);
+	if (timer_nr < 0) {
+		unsigned long t;
+
+		/* try to find any available timer */
+		t = find_first_bit(mfgpt->avail, max);
+		/* set timer_nr to -1 if no timers available */
+		timer_nr = t < max ? (int) t : -1;
+	} else {
+		/* check if the requested timer's available */
+		if (test_bit(timer_nr, mfgpt->avail))
+			timer_nr = -1;
+	}
+
+	if (timer_nr >= 0)
+		/* if timer_nr is not -1, it's an available timer */
+		__clear_bit(timer_nr, mfgpt->avail);
+	spin_unlock_irqrestore(&mfgpt->lock, flags);
+
+	if (timer_nr < 0)
+		goto done;
+
+	timer = kmalloc(sizeof(*timer), GFP_KERNEL);
+	if (!timer) {
+		/* aw hell */
+		spin_lock_irqsave(&mfgpt->lock, flags);
+		__set_bit(timer_nr, mfgpt->avail);
+		spin_unlock_irqrestore(&mfgpt->lock, flags);
+		goto done;
+	}
+	timer->chip = mfgpt;
+	timer->nr = timer_nr;
+	dev_info(&mfgpt->pdev->dev, "registered timer %d\n", timer_nr);
+
+done:
+	return timer;
+}
+EXPORT_SYMBOL_GPL(cs5535_mfgpt_alloc_timer);
+
+/*
+ * XXX: This frees the timer memory, but never resets the actual hardware
+ * timer.  The old geode_mfgpt code did this; it would be good to figure
+ * out a way to actually release the hardware timer.  See comments below.
+ */
+void cs5535_mfgpt_free_timer(struct cs5535_mfgpt_timer *timer)
+{
+	kfree(timer);
+}
+EXPORT_SYMBOL_GPL(cs5535_mfgpt_free_timer);
+
+uint16_t cs5535_mfgpt_read(struct cs5535_mfgpt_timer *timer, uint16_t reg)
+{
+	return inw(timer->chip->base + reg + (timer->nr * 8));
+}
+EXPORT_SYMBOL_GPL(cs5535_mfgpt_read);
+
+void cs5535_mfgpt_write(struct cs5535_mfgpt_timer *timer, uint16_t reg,
+		uint16_t value)
+{
+	outw(value, timer->chip->base + reg + (timer->nr * 8));
+}
+EXPORT_SYMBOL_GPL(cs5535_mfgpt_write);
+
+/*
+ * This is a sledgehammer that resets all MFGPT timers. This is required by
+ * some broken BIOSes which leave the system in an unstable state
+ * (TinyBIOS 0.98, for example; fixed in 0.99).  It's uncertain as to
+ * whether or not this secret MSR can be used to release individual timers.
+ * Jordan tells me that he and Mitch once played w/ it, but it's unclear
+ * what the results of that were (and they experienced some instability).
+ */
+static void __init reset_all_timers(void)
+{
+	uint32_t val, dummy;
+
+	/* The following undocumented bit resets the MFGPT timers */
+	val = 0xFF; dummy = 0;
+	wrmsr(MSR_MFGPT_SETUP, val, dummy);
+}
+
+/*
+ * Check whether any MFGPTs are available for the kernel to use.  In most
+ * cases, firmware that uses AMD's VSA code will claim all timers during
+ * bootup; we certainly don't want to take them if they're already in use.
+ * In other cases (such as with VSAless OpenFirmware), the system firmware
+ * leaves timers available for us to use.
+ */
+static int __init scan_timers(struct cs5535_mfgpt_chip *mfgpt)
+{
+	struct cs5535_mfgpt_timer timer = { .chip = mfgpt };
+	unsigned long flags;
+	int timers = 0;
+	uint16_t val;
+	int i;
+
+	/* bios workaround */
+	if (mfgpt_reset_timers)
+		reset_all_timers();
+
+	/* just to be safe, protect this section w/ lock */
+	spin_lock_irqsave(&mfgpt->lock, flags);
+	for (i = 0; i < MFGPT_MAX_TIMERS; i++) {
+		timer.nr = i;
+		val = cs5535_mfgpt_read(&timer, MFGPT_REG_SETUP);
+		if (!(val & MFGPT_SETUP_SETUP)) {
+			__set_bit(i, mfgpt->avail);
+			timers++;
+		}
+	}
+	spin_unlock_irqrestore(&mfgpt->lock, flags);
+
+	return timers;
+}
+
+static int __init cs5535_mfgpt_probe(struct pci_dev *pdev,
+		const struct pci_device_id *pci_id)
+{
+	int err, t;
+
+	/* There are two ways to get the MFGPT base address; one is by
+	 * fetching it from MSR_LBAR_MFGPT, the other is by reading the
+	 * PCI BAR info.  The latter method is easier (especially across
+	 * different architectures), so we'll stick with that for now.  If
+	 * it turns out to be unreliable in the face of crappy BIOSes, we
+	 * can always go back to using MSRs.. */
+
+	err = pci_enable_device_io(pdev);
+	if (err) {
+		dev_err(&pdev->dev, "can't enable device IO\n");
+		goto done;
+	}
+
+	err = pci_request_region(pdev, MFGPT_BAR, DRV_NAME);
+	if (err) {
+		dev_err(&pdev->dev, "can't alloc PCI BAR #%d\n", MFGPT_BAR);
+		goto done;
+	}
+
+	/* set up the driver-specific struct */
+	cs5535_mfgpt_chip.base = pci_resource_start(pdev, MFGPT_BAR);
+	cs5535_mfgpt_chip.pdev = pdev;
+	spin_lock_init(&cs5535_mfgpt_chip.lock);
+
+	dev_info(&pdev->dev, "allocated PCI BAR #%d: base 0x%llx\n", MFGPT_BAR,
+			(unsigned long long) cs5535_mfgpt_chip.base);
+
+	/* detect the available timers */
+	t = scan_timers(&cs5535_mfgpt_chip);
+	dev_info(&pdev->dev, DRV_NAME ": %d MFGPT timers available\n", t);
+	cs5535_mfgpt_chip.initialized = 1;
+	return 0;
+
+done:
+	return err;
+}
+
+static struct pci_device_id cs5535_mfgpt_pci_tbl[] = {
+	{ PCI_DEVICE(PCI_VENDOR_ID_NS, PCI_DEVICE_ID_NS_CS5535_ISA) },
+	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_CS5536_ISA) },
+	{ 0, },
+};
+MODULE_DEVICE_TABLE(pci, cs5535_mfgpt_pci_tbl);
+
+/*
+ * Just like with the cs5535-gpio driver, we can't use the standard PCI driver
+ * registration stuff.  It only allows only one driver to bind to each PCI
+ * device, and we want the GPIO and MFGPT drivers to be able to share a PCI
+ * device.  Instead, we manually scan for the PCI device, request a single
+ * region, and keep track of the devices that we're using.
+ */
+
+static int __init cs5535_mfgpt_scan_pci(void)
+{
+	struct pci_dev *pdev;
+	int err = -ENODEV;
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(cs5535_mfgpt_pci_tbl); i++) {
+		pdev = pci_get_device(cs5535_mfgpt_pci_tbl[i].vendor,
+				cs5535_mfgpt_pci_tbl[i].device, NULL);
+		if (pdev) {
+			err = cs5535_mfgpt_probe(pdev,
+					&cs5535_mfgpt_pci_tbl[i]);
+			if (err)
+				pci_dev_put(pdev);
+
+			/* we only support a single CS5535/6 southbridge */
+			break;
+		}
+	}
+
+	return err;
+}
+
+static int __init cs5535_mfgpt_init(void)
+{
+	return cs5535_mfgpt_scan_pci();
+}
+
+module_init(cs5535_mfgpt_init);
+
+MODULE_AUTHOR("Andres Salomon <dilinger@collabora.co.uk>");
+MODULE_DESCRIPTION("CS5535/CS5536 MFGPT timer driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/misc/eeprom/eeprom.c b/drivers/misc/eeprom/eeprom.c
index 2c27193aeaa0..f939ebc2507c 100644
--- a/drivers/misc/eeprom/eeprom.c
+++ b/drivers/misc/eeprom/eeprom.c
@@ -32,9 +32,6 @@
 static const unsigned short normal_i2c[] = { 0x50, 0x51, 0x52, 0x53, 0x54,
 					0x55, 0x56, 0x57, I2C_CLIENT_END };
 
-/* Insmod parameters */
-I2C_CLIENT_INSMOD_1(eeprom);
-
 
 /* Size of EEPROM in bytes */
 #define EEPROM_SIZE		256
@@ -135,8 +132,7 @@ static struct bin_attribute eeprom_attr = {
 };
 
 /* Return 0 if detection is successful, -ENODEV otherwise */
-static int eeprom_detect(struct i2c_client *client, int kind,
-			 struct i2c_board_info *info)
+static int eeprom_detect(struct i2c_client *client, struct i2c_board_info *info)
 {
 	struct i2c_adapter *adapter = client->adapter;
 
@@ -233,7 +229,7 @@ static struct i2c_driver eeprom_driver = {
 
 	.class		= I2C_CLASS_DDC | I2C_CLASS_SPD,
 	.detect		= eeprom_detect,
-	.address_data	= &addr_data,
+	.address_list	= normal_i2c,
 };
 
 static int __init eeprom_init(void)
diff --git a/drivers/misc/enclosure.c b/drivers/misc/enclosure.c
index e9eae4a78402..1eac626e710a 100644
--- a/drivers/misc/enclosure.c
+++ b/drivers/misc/enclosure.c
@@ -391,6 +391,7 @@ static const char *const enclosure_status [] = {
 	[ENCLOSURE_STATUS_NOT_INSTALLED] = "not installed",
 	[ENCLOSURE_STATUS_UNKNOWN] = "unknown",
 	[ENCLOSURE_STATUS_UNAVAILABLE] = "unavailable",
+	[ENCLOSURE_STATUS_MAX] = NULL,
 };
 
 static const char *const enclosure_type [] = {
diff --git a/drivers/misc/hpilo.h b/drivers/misc/hpilo.h
index 38576050776a..247eb386a973 100644
--- a/drivers/misc/hpilo.h
+++ b/drivers/misc/hpilo.h
@@ -44,9 +44,20 @@ struct ilo_hwinfo {
 
 	struct pci_dev *ilo_dev;
 
+	/*
+	 * open_lock      serializes ccb_cnt during open and close
+	 * [ irq disabled ]
+	 * -> alloc_lock  used when adding/removing/searching ccb_alloc,
+	 *                which represents all ccbs open on the device
+	 * --> fifo_lock  controls access to fifo queues shared with hw
+	 *
+	 * Locks must be taken in this order, but open_lock and alloc_lock
+	 * are optional, they do not need to be held in order to take a
+	 * lower level lock.
+	 */
+	spinlock_t open_lock;
 	spinlock_t alloc_lock;
 	spinlock_t fifo_lock;
-	spinlock_t open_lock;
 
 	struct cdev cdev;
 };
diff --git a/drivers/misc/ics932s401.c b/drivers/misc/ics932s401.c
index 4bb7a3af9ad9..395a4ea64e9c 100644
--- a/drivers/misc/ics932s401.c
+++ b/drivers/misc/ics932s401.c
@@ -30,9 +30,6 @@
 /* Addresses to scan */
 static const unsigned short normal_i2c[] = { 0x69, I2C_CLIENT_END };
 
-/* Insmod parameters */
-I2C_CLIENT_INSMOD_1(ics932s401);
-
 /* ICS932S401 registers */
 #define ICS932S401_REG_CFG2			0x01
 #define 	ICS932S401_CFG1_SPREAD		0x01
@@ -106,12 +103,12 @@ struct ics932s401_data {
 
 static int ics932s401_probe(struct i2c_client *client,
 			 const struct i2c_device_id *id);
-static int ics932s401_detect(struct i2c_client *client, int kind,
+static int ics932s401_detect(struct i2c_client *client,
 			  struct i2c_board_info *info);
 static int ics932s401_remove(struct i2c_client *client);
 
 static const struct i2c_device_id ics932s401_id[] = {
-	{ "ics932s401", ics932s401 },
+	{ "ics932s401", 0 },
 	{ }
 };
 MODULE_DEVICE_TABLE(i2c, ics932s401_id);
@@ -125,7 +122,7 @@ static struct i2c_driver ics932s401_driver = {
 	.remove		= ics932s401_remove,
 	.id_table	= ics932s401_id,
 	.detect		= ics932s401_detect,
-	.address_data	= &addr_data,
+	.address_list	= normal_i2c,
 };
 
 static struct ics932s401_data *ics932s401_update_device(struct device *dev)
@@ -413,7 +410,7 @@ static ssize_t show_spread(struct device *dev,
 }
 
 /* Return 0 if detection is successful, -ENODEV otherwise */
-static int ics932s401_detect(struct i2c_client *client, int kind,
+static int ics932s401_detect(struct i2c_client *client,
 			  struct i2c_board_info *info)
 {
 	struct i2c_adapter *adapter = client->adapter;
diff --git a/drivers/misc/ioc4.c b/drivers/misc/ioc4.c
index 60b0b1a4fb3a..09dcb699e667 100644
--- a/drivers/misc/ioc4.c
+++ b/drivers/misc/ioc4.c
@@ -138,7 +138,7 @@ ioc4_unregister_submodule(struct ioc4_submodule *is)
  * even though the following code utilizes external interrupt registers
  * to perform the speed calculation.
  */
-static void
+static void __devinit
 ioc4_clock_calibrate(struct ioc4_driver_data *idd)
 {
 	union ioc4_int_out int_out;
@@ -230,7 +230,7 @@ ioc4_clock_calibrate(struct ioc4_driver_data *idd)
  * on the same PCI bus at slot number 3 to differentiate IO9 from IO10.
  * If neither is present, it's a PCI-RT.
  */
-static unsigned int
+static unsigned int __devinit
 ioc4_variant(struct ioc4_driver_data *idd)
 {
 	struct pci_dev *pdev = NULL;
@@ -269,7 +269,7 @@ ioc4_variant(struct ioc4_driver_data *idd)
 	return IOC4_VARIANT_PCI_RT;
 }
 
-static void
+static void __devinit
 ioc4_load_modules(struct work_struct *work)
 {
 	/* arg just has to be freed */
@@ -280,7 +280,7 @@ ioc4_load_modules(struct work_struct *work)
 }
 
 /* Adds a new instance of an IOC4 card */
-static int
+static int __devinit
 ioc4_probe(struct pci_dev *pdev, const struct pci_device_id *pci_id)
 {
 	struct ioc4_driver_data *idd;
@@ -425,7 +425,7 @@ out:
 }
 
 /* Removes a particular instance of an IOC4 card. */
-static void
+static void __devexit
 ioc4_remove(struct pci_dev *pdev)
 {
 	struct ioc4_submodule *is;
@@ -476,7 +476,7 @@ static struct pci_driver ioc4_driver = {
 	.name = "IOC4",
 	.id_table = ioc4_id_table,
 	.probe = ioc4_probe,
-	.remove = ioc4_remove,
+	.remove = __devexit_p(ioc4_remove),
 };
 
 MODULE_DEVICE_TABLE(pci, ioc4_id_table);
@@ -486,14 +486,14 @@ MODULE_DEVICE_TABLE(pci, ioc4_id_table);
  *********************/
 
 /* Module load */
-static int __devinit
+static int __init
 ioc4_init(void)
 {
 	return pci_register_driver(&ioc4_driver);
 }
 
 /* Module unload */
-static void __devexit
+static void __exit
 ioc4_exit(void)
 {
 	/* Ensure ioc4_load_modules() has completed before exiting */
diff --git a/drivers/misc/kgdbts.c b/drivers/misc/kgdbts.c
index e4ff50b95a5e..fcb6ec1af173 100644
--- a/drivers/misc/kgdbts.c
+++ b/drivers/misc/kgdbts.c
@@ -712,6 +712,12 @@ static int run_simple_test(int is_get_char, int chr)
 
 	/* End of packet == #XX so look for the '#' */
 	if (put_buf_cnt > 3 && put_buf[put_buf_cnt - 3] == '#') {
+		if (put_buf_cnt >= BUFMAX) {
+			eprintk("kgdbts: ERROR: put buffer overflow on"
+				" '%s' line %i\n", ts.name, ts.idx);
+			put_buf_cnt = 0;
+			return 0;
+		}
 		put_buf[put_buf_cnt] = '\0';
 		v2printk("put%i: %s\n", ts.idx, put_buf);
 		/* Trigger check here */
@@ -885,16 +891,16 @@ static void kgdbts_run_tests(void)
 	int nmi_sleep = 0;
 	int i;
 
-	ptr = strstr(config, "F");
+	ptr = strchr(config, 'F');
 	if (ptr)
 		fork_test = simple_strtol(ptr + 1, NULL, 10);
-	ptr = strstr(config, "S");
+	ptr = strchr(config, 'S');
 	if (ptr)
 		do_sys_open_test = simple_strtol(ptr + 1, NULL, 10);
-	ptr = strstr(config, "N");
+	ptr = strchr(config, 'N');
 	if (ptr)
 		nmi_sleep = simple_strtol(ptr+1, NULL, 10);
-	ptr = strstr(config, "I");
+	ptr = strchr(config, 'I');
 	if (ptr)
 		sstep_test = simple_strtol(ptr+1, NULL, 10);
 
diff --git a/drivers/misc/sgi-gru/gru.h b/drivers/misc/sgi-gru/gru.h
index f93f03a9e6e9..3ad76cd18b4b 100644
--- a/drivers/misc/sgi-gru/gru.h
+++ b/drivers/misc/sgi-gru/gru.h
@@ -53,6 +53,17 @@ struct gru_chiplet_info {
 	int	free_user_cbr;
 };
 
+/*
+ * Statictics kept for each context.
+ */
+struct gru_gseg_statistics {
+	unsigned long	fmm_tlbmiss;
+	unsigned long	upm_tlbmiss;
+	unsigned long	tlbdropin;
+	unsigned long	context_stolen;
+	unsigned long	reserved[10];
+};
+
 /* Flags for GRU options on the gru_create_context() call */
 /* Select one of the follow 4 options to specify how TLB misses are handled */
 #define GRU_OPT_MISS_DEFAULT	0x0000	/* Use default mode */
diff --git a/drivers/misc/sgi-gru/gru_instructions.h b/drivers/misc/sgi-gru/gru_instructions.h
index 3c9c06618e6a..d95587cc794c 100644
--- a/drivers/misc/sgi-gru/gru_instructions.h
+++ b/drivers/misc/sgi-gru/gru_instructions.h
@@ -34,17 +34,17 @@ extern void gru_wait_abort_proc(void *cb);
 #include <asm/intrinsics.h>
 #define __flush_cache(p)		ia64_fc((unsigned long)p)
 /* Use volatile on IA64 to ensure ordering via st4.rel */
-#define gru_ordered_store_int(p, v)					\
+#define gru_ordered_store_ulong(p, v)					\
 		do {							\
 			barrier();					\
-			*((volatile int *)(p)) = v; /* force st.rel */	\
+			*((volatile unsigned long *)(p)) = v; /* force st.rel */	\
 		} while (0)
 #elif defined(CONFIG_X86_64)
 #define __flush_cache(p)		clflush(p)
-#define gru_ordered_store_int(p, v)					\
+#define gru_ordered_store_ulong(p, v)					\
 		do {							\
 			barrier();					\
-			*(int *)p = v;					\
+			*(unsigned long *)p = v;			\
 		} while (0)
 #else
 #error "Unsupported architecture"
@@ -129,8 +129,13 @@ struct gru_instruction_bits {
  */
 struct gru_instruction {
     /* DW 0 */
-    unsigned int		op32;    /* icmd,xtype,iaa0,ima,opc */
-    unsigned int		tri0;
+    union {
+    	unsigned long		op64;    /* icmd,xtype,iaa0,ima,opc,tri0 */
+	struct {
+		unsigned int	op32;
+		unsigned int	tri0;
+	};
+    };
     unsigned long		tri1_bufsize;		/* DW 1 */
     unsigned long		baddr0;			/* DW 2 */
     unsigned long		nelem;			/* DW 3 */
@@ -140,7 +145,7 @@ struct gru_instruction {
     unsigned long		avalue;			/* DW 7 */
 };
 
-/* Some shifts and masks for the low 32 bits of a GRU command */
+/* Some shifts and masks for the low 64 bits of a GRU command */
 #define GRU_CB_ICMD_SHFT	0
 #define GRU_CB_ICMD_MASK	0x1
 #define GRU_CB_XTYPE_SHFT	8
@@ -155,6 +160,10 @@ struct gru_instruction {
 #define GRU_CB_OPC_MASK		0xff
 #define GRU_CB_EXOPC_SHFT	24
 #define GRU_CB_EXOPC_MASK	0xff
+#define GRU_IDEF2_SHFT		32
+#define GRU_IDEF2_MASK		0x3ffff
+#define GRU_ISTATUS_SHFT	56
+#define GRU_ISTATUS_MASK	0x3
 
 /* GRU instruction opcodes (opc field) */
 #define OP_NOP		0x00
@@ -256,6 +265,7 @@ struct gru_instruction {
 #define CBE_CAUSE_PROTOCOL_STATE_DATA_ERROR	(1 << 16)
 #define CBE_CAUSE_RA_RESPONSE_DATA_ERROR	(1 << 17)
 #define CBE_CAUSE_HA_RESPONSE_DATA_ERROR	(1 << 18)
+#define CBE_CAUSE_FORCED_ERROR			(1 << 19)
 
 /* CBE cbrexecstatus bits */
 #define CBR_EXS_ABORT_OCC_BIT			0
@@ -264,13 +274,15 @@ struct gru_instruction {
 #define CBR_EXS_QUEUED_BIT			3
 #define CBR_EXS_TLB_INVAL_BIT			4
 #define CBR_EXS_EXCEPTION_BIT			5
+#define CBR_EXS_CB_INT_PENDING_BIT		6
 
 #define CBR_EXS_ABORT_OCC			(1 << CBR_EXS_ABORT_OCC_BIT)
 #define CBR_EXS_INT_OCC				(1 << CBR_EXS_INT_OCC_BIT)
 #define CBR_EXS_PENDING				(1 << CBR_EXS_PENDING_BIT)
 #define CBR_EXS_QUEUED				(1 << CBR_EXS_QUEUED_BIT)
-#define CBR_TLB_INVAL				(1 << CBR_EXS_TLB_INVAL_BIT)
+#define CBR_EXS_TLB_INVAL			(1 << CBR_EXS_TLB_INVAL_BIT)
 #define CBR_EXS_EXCEPTION			(1 << CBR_EXS_EXCEPTION_BIT)
+#define CBR_EXS_CB_INT_PENDING			(1 << CBR_EXS_CB_INT_PENDING_BIT)
 
 /*
  * Exceptions are retried for the following cases. If any OTHER bits are set
@@ -296,12 +308,14 @@ union gru_mesqhead {
 
 
 /* Generate the low word of a GRU instruction */
-static inline unsigned int
-__opword(unsigned char opcode, unsigned char exopc, unsigned char xtype,
+static inline unsigned long
+__opdword(unsigned char opcode, unsigned char exopc, unsigned char xtype,
        unsigned char iaa0, unsigned char iaa1,
-       unsigned char ima)
+       unsigned long idef2, unsigned char ima)
 {
     return (1 << GRU_CB_ICMD_SHFT) |
+	   ((unsigned long)CBS_ACTIVE << GRU_ISTATUS_SHFT) |
+	   (idef2<< GRU_IDEF2_SHFT) |
 	   (iaa0 << GRU_CB_IAA0_SHFT) |
 	   (iaa1 << GRU_CB_IAA1_SHFT) |
 	   (ima << GRU_CB_IMA_SHFT) |
@@ -319,12 +333,13 @@ static inline void gru_flush_cache(void *p)
 }
 
 /*
- * Store the lower 32 bits of the command including the "start" bit. Then
+ * Store the lower 64 bits of the command including the "start" bit. Then
  * start the instruction executing.
  */
-static inline void gru_start_instruction(struct gru_instruction *ins, int op32)
+static inline void gru_start_instruction(struct gru_instruction *ins, unsigned long op64)
 {
-	gru_ordered_store_int(ins, op32);
+	gru_ordered_store_ulong(ins, op64);
+	mb();
 	gru_flush_cache(ins);
 }
 
@@ -340,6 +355,30 @@ static inline void gru_start_instruction(struct gru_instruction *ins, int op32)
  *     	- nelem and stride are in elements
  *     	- tri0/tri1 is in bytes for the beginning of the data segment.
  */
+static inline void gru_vload_phys(void *cb, unsigned long gpa,
+		unsigned int tri0, int iaa, unsigned long hints)
+{
+	struct gru_instruction *ins = (struct gru_instruction *)cb;
+
+	ins->baddr0 = (long)gpa | ((unsigned long)iaa << 62);
+	ins->nelem = 1;
+	ins->op1_stride = 1;
+	gru_start_instruction(ins, __opdword(OP_VLOAD, 0, XTYPE_DW, iaa, 0,
+					(unsigned long)tri0, CB_IMA(hints)));
+}
+
+static inline void gru_vstore_phys(void *cb, unsigned long gpa,
+		unsigned int tri0, int iaa, unsigned long hints)
+{
+	struct gru_instruction *ins = (struct gru_instruction *)cb;
+
+	ins->baddr0 = (long)gpa | ((unsigned long)iaa << 62);
+	ins->nelem = 1;
+	ins->op1_stride = 1;
+	gru_start_instruction(ins, __opdword(OP_VSTORE, 0, XTYPE_DW, iaa, 0,
+					(unsigned long)tri0, CB_IMA(hints)));
+}
+
 static inline void gru_vload(void *cb, unsigned long mem_addr,
 		unsigned int tri0, unsigned char xtype, unsigned long nelem,
 		unsigned long stride, unsigned long hints)
@@ -348,10 +387,9 @@ static inline void gru_vload(void *cb, unsigned long mem_addr,
 
 	ins->baddr0 = (long)mem_addr;
 	ins->nelem = nelem;
-	ins->tri0 = tri0;
 	ins->op1_stride = stride;
-	gru_start_instruction(ins, __opword(OP_VLOAD, 0, xtype, IAA_RAM, 0,
-					CB_IMA(hints)));
+	gru_start_instruction(ins, __opdword(OP_VLOAD, 0, xtype, IAA_RAM, 0,
+					(unsigned long)tri0, CB_IMA(hints)));
 }
 
 static inline void gru_vstore(void *cb, unsigned long mem_addr,
@@ -362,10 +400,9 @@ static inline void gru_vstore(void *cb, unsigned long mem_addr,
 
 	ins->baddr0 = (long)mem_addr;
 	ins->nelem = nelem;
-	ins->tri0 = tri0;
 	ins->op1_stride = stride;
-	gru_start_instruction(ins, __opword(OP_VSTORE, 0, xtype, IAA_RAM, 0,
-					CB_IMA(hints)));
+	gru_start_instruction(ins, __opdword(OP_VSTORE, 0, xtype, IAA_RAM, 0,
+					tri0, CB_IMA(hints)));
 }
 
 static inline void gru_ivload(void *cb, unsigned long mem_addr,
@@ -376,10 +413,9 @@ static inline void gru_ivload(void *cb, unsigned long mem_addr,
 
 	ins->baddr0 = (long)mem_addr;
 	ins->nelem = nelem;
-	ins->tri0 = tri0;
 	ins->tri1_bufsize = tri1;
-	gru_start_instruction(ins, __opword(OP_IVLOAD, 0, xtype, IAA_RAM, 0,
-					CB_IMA(hints)));
+	gru_start_instruction(ins, __opdword(OP_IVLOAD, 0, xtype, IAA_RAM, 0,
+					tri0, CB_IMA(hints)));
 }
 
 static inline void gru_ivstore(void *cb, unsigned long mem_addr,
@@ -390,10 +426,9 @@ static inline void gru_ivstore(void *cb, unsigned long mem_addr,
 
 	ins->baddr0 = (long)mem_addr;
 	ins->nelem = nelem;
-	ins->tri0 = tri0;
 	ins->tri1_bufsize = tri1;
-	gru_start_instruction(ins, __opword(OP_IVSTORE, 0, xtype, IAA_RAM, 0,
-					CB_IMA(hints)));
+	gru_start_instruction(ins, __opdword(OP_IVSTORE, 0, xtype, IAA_RAM, 0,
+					tri0, CB_IMA(hints)));
 }
 
 static inline void gru_vset(void *cb, unsigned long mem_addr,
@@ -406,8 +441,8 @@ static inline void gru_vset(void *cb, unsigned long mem_addr,
 	ins->op2_value_baddr1 = value;
 	ins->nelem = nelem;
 	ins->op1_stride = stride;
-	gru_start_instruction(ins, __opword(OP_VSET, 0, xtype, IAA_RAM, 0,
-					 CB_IMA(hints)));
+	gru_start_instruction(ins, __opdword(OP_VSET, 0, xtype, IAA_RAM, 0,
+					 0, CB_IMA(hints)));
 }
 
 static inline void gru_ivset(void *cb, unsigned long mem_addr,
@@ -420,8 +455,8 @@ static inline void gru_ivset(void *cb, unsigned long mem_addr,
 	ins->op2_value_baddr1 = value;
 	ins->nelem = nelem;
 	ins->tri1_bufsize = tri1;
-	gru_start_instruction(ins, __opword(OP_IVSET, 0, xtype, IAA_RAM, 0,
-					CB_IMA(hints)));
+	gru_start_instruction(ins, __opdword(OP_IVSET, 0, xtype, IAA_RAM, 0,
+					0, CB_IMA(hints)));
 }
 
 static inline void gru_vflush(void *cb, unsigned long mem_addr,
@@ -433,15 +468,15 @@ static inline void gru_vflush(void *cb, unsigned long mem_addr,
 	ins->baddr0 = (long)mem_addr;
 	ins->op1_stride = stride;
 	ins->nelem = nelem;
-	gru_start_instruction(ins, __opword(OP_VFLUSH, 0, xtype, IAA_RAM, 0,
-					CB_IMA(hints)));
+	gru_start_instruction(ins, __opdword(OP_VFLUSH, 0, xtype, IAA_RAM, 0,
+					0, CB_IMA(hints)));
 }
 
 static inline void gru_nop(void *cb, int hints)
 {
 	struct gru_instruction *ins = (void *)cb;
 
-	gru_start_instruction(ins, __opword(OP_NOP, 0, 0, 0, 0, CB_IMA(hints)));
+	gru_start_instruction(ins, __opdword(OP_NOP, 0, 0, 0, 0, 0, CB_IMA(hints)));
 }
 
 
@@ -455,10 +490,9 @@ static inline void gru_bcopy(void *cb, const unsigned long src,
 	ins->baddr0 = (long)src;
 	ins->op2_value_baddr1 = (long)dest;
 	ins->nelem = nelem;
-	ins->tri0 = tri0;
 	ins->tri1_bufsize = bufsize;
-	gru_start_instruction(ins, __opword(OP_BCOPY, 0, xtype, IAA_RAM,
-					IAA_RAM, CB_IMA(hints)));
+	gru_start_instruction(ins, __opdword(OP_BCOPY, 0, xtype, IAA_RAM,
+					IAA_RAM, tri0, CB_IMA(hints)));
 }
 
 static inline void gru_bstore(void *cb, const unsigned long src,
@@ -470,9 +504,8 @@ static inline void gru_bstore(void *cb, const unsigned long src,
 	ins->baddr0 = (long)src;
 	ins->op2_value_baddr1 = (long)dest;
 	ins->nelem = nelem;
-	ins->tri0 = tri0;
-	gru_start_instruction(ins, __opword(OP_BSTORE, 0, xtype, 0, IAA_RAM,
-					CB_IMA(hints)));
+	gru_start_instruction(ins, __opdword(OP_BSTORE, 0, xtype, 0, IAA_RAM,
+					tri0, CB_IMA(hints)));
 }
 
 static inline void gru_gamir(void *cb, int exopc, unsigned long src,
@@ -481,8 +514,8 @@ static inline void gru_gamir(void *cb, int exopc, unsigned long src,
 	struct gru_instruction *ins = (void *)cb;
 
 	ins->baddr0 = (long)src;
-	gru_start_instruction(ins, __opword(OP_GAMIR, exopc, xtype, IAA_RAM, 0,
-					CB_IMA(hints)));
+	gru_start_instruction(ins, __opdword(OP_GAMIR, exopc, xtype, IAA_RAM, 0,
+					0, CB_IMA(hints)));
 }
 
 static inline void gru_gamirr(void *cb, int exopc, unsigned long src,
@@ -491,8 +524,8 @@ static inline void gru_gamirr(void *cb, int exopc, unsigned long src,
 	struct gru_instruction *ins = (void *)cb;
 
 	ins->baddr0 = (long)src;
-	gru_start_instruction(ins, __opword(OP_GAMIRR, exopc, xtype, IAA_RAM, 0,
-					CB_IMA(hints)));
+	gru_start_instruction(ins, __opdword(OP_GAMIRR, exopc, xtype, IAA_RAM, 0,
+					0, CB_IMA(hints)));
 }
 
 static inline void gru_gamer(void *cb, int exopc, unsigned long src,
@@ -505,8 +538,8 @@ static inline void gru_gamer(void *cb, int exopc, unsigned long src,
 	ins->baddr0 = (long)src;
 	ins->op1_stride = operand1;
 	ins->op2_value_baddr1 = operand2;
-	gru_start_instruction(ins, __opword(OP_GAMER, exopc, xtype, IAA_RAM, 0,
-					CB_IMA(hints)));
+	gru_start_instruction(ins, __opdword(OP_GAMER, exopc, xtype, IAA_RAM, 0,
+					0, CB_IMA(hints)));
 }
 
 static inline void gru_gamerr(void *cb, int exopc, unsigned long src,
@@ -518,8 +551,8 @@ static inline void gru_gamerr(void *cb, int exopc, unsigned long src,
 	ins->baddr0 = (long)src;
 	ins->op1_stride = operand1;
 	ins->op2_value_baddr1 = operand2;
-	gru_start_instruction(ins, __opword(OP_GAMERR, exopc, xtype, IAA_RAM, 0,
-					CB_IMA(hints)));
+	gru_start_instruction(ins, __opdword(OP_GAMERR, exopc, xtype, IAA_RAM, 0,
+					0, CB_IMA(hints)));
 }
 
 static inline void gru_gamxr(void *cb, unsigned long src,
@@ -529,8 +562,8 @@ static inline void gru_gamxr(void *cb, unsigned long src,
 
 	ins->baddr0 = (long)src;
 	ins->nelem = 4;
-	gru_start_instruction(ins, __opword(OP_GAMXR, EOP_XR_CSWAP, XTYPE_DW,
-				 IAA_RAM, 0, CB_IMA(hints)));
+	gru_start_instruction(ins, __opdword(OP_GAMXR, EOP_XR_CSWAP, XTYPE_DW,
+				 IAA_RAM, 0, 0, CB_IMA(hints)));
 }
 
 static inline void gru_mesq(void *cb, unsigned long queue,
@@ -541,9 +574,8 @@ static inline void gru_mesq(void *cb, unsigned long queue,
 
 	ins->baddr0 = (long)queue;
 	ins->nelem = nelem;
-	ins->tri0 = tri0;
-	gru_start_instruction(ins, __opword(OP_MESQ, 0, XTYPE_CL, IAA_RAM, 0,
-					CB_IMA(hints)));
+	gru_start_instruction(ins, __opdword(OP_MESQ, 0, XTYPE_CL, IAA_RAM, 0,
+					tri0, CB_IMA(hints)));
 }
 
 static inline unsigned long gru_get_amo_value(void *cb)
@@ -662,6 +694,14 @@ static inline void gru_wait_abort(void *cb)
 	gru_wait_abort_proc(cb);
 }
 
+/*
+ * Get a pointer to the start of a gseg
+ * 	p	- Any valid pointer within the gseg
+ */
+static inline void *gru_get_gseg_pointer (void *p)
+{
+	return (void *)((unsigned long)p & ~(GRU_GSEG_PAGESIZE - 1));
+}
 
 /*
  * Get a pointer to a control block
diff --git a/drivers/misc/sgi-gru/grufault.c b/drivers/misc/sgi-gru/grufault.c
index 679e01778286..38657cdaf54d 100644
--- a/drivers/misc/sgi-gru/grufault.c
+++ b/drivers/misc/sgi-gru/grufault.c
@@ -40,6 +40,12 @@
 #include "gru_instructions.h"
 #include <asm/uv/uv_hub.h>
 
+/* Return codes for vtop functions */
+#define VTOP_SUCCESS               0
+#define VTOP_INVALID               -1
+#define VTOP_RETRY                 -2
+
+
 /*
  * Test if a physical address is a valid GRU GSEG address
  */
@@ -90,19 +96,22 @@ static struct gru_thread_state *gru_alloc_locked_gts(unsigned long vaddr)
 {
 	struct mm_struct *mm = current->mm;
 	struct vm_area_struct *vma;
-	struct gru_thread_state *gts = NULL;
+	struct gru_thread_state *gts = ERR_PTR(-EINVAL);
 
 	down_write(&mm->mmap_sem);
 	vma = gru_find_vma(vaddr);
-	if (vma)
-		gts = gru_alloc_thread_state(vma, TSID(vaddr, vma));
-	if (gts) {
-		mutex_lock(&gts->ts_ctxlock);
-		downgrade_write(&mm->mmap_sem);
-	} else {
-		up_write(&mm->mmap_sem);
-	}
+	if (!vma)
+		goto err;
 
+	gts = gru_alloc_thread_state(vma, TSID(vaddr, vma));
+	if (IS_ERR(gts))
+		goto err;
+	mutex_lock(&gts->ts_ctxlock);
+	downgrade_write(&mm->mmap_sem);
+	return gts;
+
+err:
+	up_write(&mm->mmap_sem);
 	return gts;
 }
 
@@ -122,39 +131,15 @@ static void gru_unlock_gts(struct gru_thread_state *gts)
  * is necessary to prevent the user from seeing a stale cb.istatus that will
  * change as soon as the TFH restart is complete. Races may cause an
  * occasional failure to clear the cb.istatus, but that is ok.
- *
- * If the cb address is not valid (should not happen, but...), nothing
- * bad will happen.. The get_user()/put_user() will fail but there
- * are no bad side-effects.
  */
-static void gru_cb_set_istatus_active(unsigned long __user *cb)
+static void gru_cb_set_istatus_active(struct gru_instruction_bits *cbk)
 {
-	union {
-		struct gru_instruction_bits bits;
-		unsigned long dw;
-	} u;
-
-	if (cb) {
-		get_user(u.dw, cb);
-		u.bits.istatus = CBS_ACTIVE;
-		put_user(u.dw, cb);
+	if (cbk) {
+		cbk->istatus = CBS_ACTIVE;
 	}
 }
 
 /*
- * Convert a interrupt IRQ to a pointer to the GRU GTS that caused the
- * interrupt. Interrupts are always sent to a cpu on the blade that contains the
- * GRU (except for headless blades which are not currently supported). A blade
- * has N grus; a block of N consecutive IRQs is assigned to the GRUs. The IRQ
- * number uniquely identifies the GRU chiplet on the local blade that caused the
- * interrupt. Always called in interrupt context.
- */
-static inline struct gru_state *irq_to_gru(int irq)
-{
-	return &gru_base[uv_numa_blade_id()]->bs_grus[irq - IRQ_GRU];
-}
-
-/*
  * Read & clear a TFM
  *
  * The GRU has an array of fault maps. A map is private to a cpu
@@ -207,10 +192,11 @@ static int non_atomic_pte_lookup(struct vm_area_struct *vma,
 {
 	struct page *page;
 
-	/* ZZZ Need to handle HUGE pages */
-	if (is_vm_hugetlb_page(vma))
-		return -EFAULT;
+#ifdef CONFIG_HUGETLB_PAGE
+	*pageshift = is_vm_hugetlb_page(vma) ? HPAGE_SHIFT : PAGE_SHIFT;
+#else
 	*pageshift = PAGE_SHIFT;
+#endif
 	if (get_user_pages
 	    (current, current->mm, vaddr, 1, write, 0, &page, NULL) <= 0)
 		return -EFAULT;
@@ -268,7 +254,6 @@ static int atomic_pte_lookup(struct vm_area_struct *vma, unsigned long vaddr,
 	return 0;
 
 err:
-	local_irq_enable();
 	return 1;
 }
 
@@ -301,14 +286,69 @@ static int gru_vtop(struct gru_thread_state *gts, unsigned long vaddr,
 	paddr = paddr & ~((1UL << ps) - 1);
 	*gpa = uv_soc_phys_ram_to_gpa(paddr);
 	*pageshift = ps;
-	return 0;
+	return VTOP_SUCCESS;
 
 inval:
-	return -1;
+	return VTOP_INVALID;
 upm:
-	return -2;
+	return VTOP_RETRY;
+}
+
+
+/*
+ * Flush a CBE from cache. The CBE is clean in the cache. Dirty the
+ * CBE cacheline so that the line will be written back to home agent.
+ * Otherwise the line may be silently dropped. This has no impact
+ * except on performance.
+ */
+static void gru_flush_cache_cbe(struct gru_control_block_extended *cbe)
+{
+	if (unlikely(cbe)) {
+		cbe->cbrexecstatus = 0;         /* make CL dirty */
+		gru_flush_cache(cbe);
+	}
 }
 
+/*
+ * Preload the TLB with entries that may be required. Currently, preloading
+ * is implemented only for BCOPY. Preload  <tlb_preload_count> pages OR to
+ * the end of the bcopy tranfer, whichever is smaller.
+ */
+static void gru_preload_tlb(struct gru_state *gru,
+			struct gru_thread_state *gts, int atomic,
+			unsigned long fault_vaddr, int asid, int write,
+			unsigned char tlb_preload_count,
+			struct gru_tlb_fault_handle *tfh,
+			struct gru_control_block_extended *cbe)
+{
+	unsigned long vaddr = 0, gpa;
+	int ret, pageshift;
+
+	if (cbe->opccpy != OP_BCOPY)
+		return;
+
+	if (fault_vaddr == cbe->cbe_baddr0)
+		vaddr = fault_vaddr + GRU_CACHE_LINE_BYTES * cbe->cbe_src_cl - 1;
+	else if (fault_vaddr == cbe->cbe_baddr1)
+		vaddr = fault_vaddr + (1 << cbe->xtypecpy) * cbe->cbe_nelemcur - 1;
+
+	fault_vaddr &= PAGE_MASK;
+	vaddr &= PAGE_MASK;
+	vaddr = min(vaddr, fault_vaddr + tlb_preload_count * PAGE_SIZE);
+
+	while (vaddr > fault_vaddr) {
+		ret = gru_vtop(gts, vaddr, write, atomic, &gpa, &pageshift);
+		if (ret || tfh_write_only(tfh, gpa, GAA_RAM, vaddr, asid, write,
+					  GRU_PAGESIZE(pageshift)))
+			return;
+		gru_dbg(grudev,
+			"%s: gid %d, gts 0x%p, tfh 0x%p, vaddr 0x%lx, asid 0x%x, rw %d, ps %d, gpa 0x%lx\n",
+			atomic ? "atomic" : "non-atomic", gru->gs_gid, gts, tfh,
+			vaddr, asid, write, pageshift, gpa);
+		vaddr -= PAGE_SIZE;
+		STAT(tlb_preload_page);
+	}
+}
 
 /*
  * Drop a TLB entry into the GRU. The fault is described by info in an TFH.
@@ -320,11 +360,14 @@ upm:
  * 		< 0 = error code
  *
  */
-static int gru_try_dropin(struct gru_thread_state *gts,
+static int gru_try_dropin(struct gru_state *gru,
+			  struct gru_thread_state *gts,
 			  struct gru_tlb_fault_handle *tfh,
-			  unsigned long __user *cb)
+			  struct gru_instruction_bits *cbk)
 {
-	int pageshift = 0, asid, write, ret, atomic = !cb;
+	struct gru_control_block_extended *cbe = NULL;
+	unsigned char tlb_preload_count = gts->ts_tlb_preload_count;
+	int pageshift = 0, asid, write, ret, atomic = !cbk, indexway;
 	unsigned long gpa = 0, vaddr = 0;
 
 	/*
@@ -335,24 +378,34 @@ static int gru_try_dropin(struct gru_thread_state *gts,
 	 */
 
 	/*
+	 * Prefetch the CBE if doing TLB preloading
+	 */
+	if (unlikely(tlb_preload_count)) {
+		cbe = gru_tfh_to_cbe(tfh);
+		prefetchw(cbe);
+	}
+
+	/*
 	 * Error if TFH state is IDLE or FMM mode & the user issuing a UPM call.
 	 * Might be a hardware race OR a stupid user. Ignore FMM because FMM
 	 * is a transient state.
 	 */
 	if (tfh->status != TFHSTATUS_EXCEPTION) {
 		gru_flush_cache(tfh);
+		sync_core();
 		if (tfh->status != TFHSTATUS_EXCEPTION)
 			goto failnoexception;
 		STAT(tfh_stale_on_fault);
 	}
 	if (tfh->state == TFHSTATE_IDLE)
 		goto failidle;
-	if (tfh->state == TFHSTATE_MISS_FMM && cb)
+	if (tfh->state == TFHSTATE_MISS_FMM && cbk)
 		goto failfmm;
 
 	write = (tfh->cause & TFHCAUSE_TLB_MOD) != 0;
 	vaddr = tfh->missvaddr;
 	asid = tfh->missasid;
+	indexway = tfh->indexway;
 	if (asid == 0)
 		goto failnoasid;
 
@@ -366,41 +419,51 @@ static int gru_try_dropin(struct gru_thread_state *gts,
 		goto failactive;
 
 	ret = gru_vtop(gts, vaddr, write, atomic, &gpa, &pageshift);
-	if (ret == -1)
+	if (ret == VTOP_INVALID)
 		goto failinval;
-	if (ret == -2)
+	if (ret == VTOP_RETRY)
 		goto failupm;
 
 	if (!(gts->ts_sizeavail & GRU_SIZEAVAIL(pageshift))) {
 		gts->ts_sizeavail |= GRU_SIZEAVAIL(pageshift);
-		if (atomic || !gru_update_cch(gts, 0)) {
+		if (atomic || !gru_update_cch(gts)) {
 			gts->ts_force_cch_reload = 1;
 			goto failupm;
 		}
 	}
-	gru_cb_set_istatus_active(cb);
+
+	if (unlikely(cbe) && pageshift == PAGE_SHIFT) {
+		gru_preload_tlb(gru, gts, atomic, vaddr, asid, write, tlb_preload_count, tfh, cbe);
+		gru_flush_cache_cbe(cbe);
+	}
+
+	gru_cb_set_istatus_active(cbk);
+	gts->ustats.tlbdropin++;
 	tfh_write_restart(tfh, gpa, GAA_RAM, vaddr, asid, write,
 			  GRU_PAGESIZE(pageshift));
-	STAT(tlb_dropin);
 	gru_dbg(grudev,
-		"%s: tfh 0x%p, vaddr 0x%lx, asid 0x%x, ps %d, gpa 0x%lx\n",
-		ret ? "non-atomic" : "atomic", tfh, vaddr, asid,
-		pageshift, gpa);
+		"%s: gid %d, gts 0x%p, tfh 0x%p, vaddr 0x%lx, asid 0x%x, indexway 0x%x,"
+		" rw %d, ps %d, gpa 0x%lx\n",
+		atomic ? "atomic" : "non-atomic", gru->gs_gid, gts, tfh, vaddr, asid,
+		indexway, write, pageshift, gpa);
+	STAT(tlb_dropin);
 	return 0;
 
 failnoasid:
 	/* No asid (delayed unload). */
 	STAT(tlb_dropin_fail_no_asid);
 	gru_dbg(grudev, "FAILED no_asid tfh: 0x%p, vaddr 0x%lx\n", tfh, vaddr);
-	if (!cb)
+	if (!cbk)
 		tfh_user_polling_mode(tfh);
 	else
 		gru_flush_cache(tfh);
+	gru_flush_cache_cbe(cbe);
 	return -EAGAIN;
 
 failupm:
 	/* Atomic failure switch CBR to UPM */
 	tfh_user_polling_mode(tfh);
+	gru_flush_cache_cbe(cbe);
 	STAT(tlb_dropin_fail_upm);
 	gru_dbg(grudev, "FAILED upm tfh: 0x%p, vaddr 0x%lx\n", tfh, vaddr);
 	return 1;
@@ -408,6 +471,7 @@ failupm:
 failfmm:
 	/* FMM state on UPM call */
 	gru_flush_cache(tfh);
+	gru_flush_cache_cbe(cbe);
 	STAT(tlb_dropin_fail_fmm);
 	gru_dbg(grudev, "FAILED fmm tfh: 0x%p, state %d\n", tfh, tfh->state);
 	return 0;
@@ -415,17 +479,20 @@ failfmm:
 failnoexception:
 	/* TFH status did not show exception pending */
 	gru_flush_cache(tfh);
-	if (cb)
-		gru_flush_cache(cb);
+	gru_flush_cache_cbe(cbe);
+	if (cbk)
+		gru_flush_cache(cbk);
 	STAT(tlb_dropin_fail_no_exception);
-	gru_dbg(grudev, "FAILED non-exception tfh: 0x%p, status %d, state %d\n", tfh, tfh->status, tfh->state);
+	gru_dbg(grudev, "FAILED non-exception tfh: 0x%p, status %d, state %d\n",
+		tfh, tfh->status, tfh->state);
 	return 0;
 
 failidle:
 	/* TFH state was idle  - no miss pending */
 	gru_flush_cache(tfh);
-	if (cb)
-		gru_flush_cache(cb);
+	gru_flush_cache_cbe(cbe);
+	if (cbk)
+		gru_flush_cache(cbk);
 	STAT(tlb_dropin_fail_idle);
 	gru_dbg(grudev, "FAILED idle tfh: 0x%p, state %d\n", tfh, tfh->state);
 	return 0;
@@ -433,16 +500,18 @@ failidle:
 failinval:
 	/* All errors (atomic & non-atomic) switch CBR to EXCEPTION state */
 	tfh_exception(tfh);
+	gru_flush_cache_cbe(cbe);
 	STAT(tlb_dropin_fail_invalid);
 	gru_dbg(grudev, "FAILED inval tfh: 0x%p, vaddr 0x%lx\n", tfh, vaddr);
 	return -EFAULT;
 
 failactive:
 	/* Range invalidate active. Switch to UPM iff atomic */
-	if (!cb)
+	if (!cbk)
 		tfh_user_polling_mode(tfh);
 	else
 		gru_flush_cache(tfh);
+	gru_flush_cache_cbe(cbe);
 	STAT(tlb_dropin_fail_range_active);
 	gru_dbg(grudev, "FAILED range active: tfh 0x%p, vaddr 0x%lx\n",
 		tfh, vaddr);
@@ -455,31 +524,41 @@ failactive:
  * Note that this is the interrupt handler that is registered with linux
  * interrupt handlers.
  */
-irqreturn_t gru_intr(int irq, void *dev_id)
+static irqreturn_t gru_intr(int chiplet, int blade)
 {
 	struct gru_state *gru;
 	struct gru_tlb_fault_map imap, dmap;
 	struct gru_thread_state *gts;
 	struct gru_tlb_fault_handle *tfh = NULL;
+	struct completion *cmp;
 	int cbrnum, ctxnum;
 
 	STAT(intr);
 
-	gru = irq_to_gru(irq);
+	gru = &gru_base[blade]->bs_grus[chiplet];
 	if (!gru) {
-		dev_err(grudev, "GRU: invalid interrupt: cpu %d, irq %d\n",
-			raw_smp_processor_id(), irq);
+		dev_err(grudev, "GRU: invalid interrupt: cpu %d, chiplet %d\n",
+			raw_smp_processor_id(), chiplet);
 		return IRQ_NONE;
 	}
 	get_clear_fault_map(gru, &imap, &dmap);
+	gru_dbg(grudev,
+		"cpu %d, chiplet %d, gid %d, imap %016lx %016lx, dmap %016lx %016lx\n",
+		smp_processor_id(), chiplet, gru->gs_gid,
+		imap.fault_bits[0], imap.fault_bits[1],
+		dmap.fault_bits[0], dmap.fault_bits[1]);
 
 	for_each_cbr_in_tfm(cbrnum, dmap.fault_bits) {
-		complete(gru->gs_blade->bs_async_wq);
+		STAT(intr_cbr);
+		cmp = gru->gs_blade->bs_async_wq;
+		if (cmp)
+			complete(cmp);
 		gru_dbg(grudev, "gid %d, cbr_done %d, done %d\n",
-			gru->gs_gid, cbrnum, gru->gs_blade->bs_async_wq->done);
+			gru->gs_gid, cbrnum, cmp ? cmp->done : -1);
 	}
 
 	for_each_cbr_in_tfm(cbrnum, imap.fault_bits) {
+		STAT(intr_tfh);
 		tfh = get_tfh_by_index(gru, cbrnum);
 		prefetchw(tfh);	/* Helps on hdw, required for emulator */
 
@@ -492,14 +571,20 @@ irqreturn_t gru_intr(int irq, void *dev_id)
 		ctxnum = tfh->ctxnum;
 		gts = gru->gs_gts[ctxnum];
 
+		/* Spurious interrupts can cause this. Ignore. */
+		if (!gts) {
+			STAT(intr_spurious);
+			continue;
+		}
+
 		/*
 		 * This is running in interrupt context. Trylock the mmap_sem.
 		 * If it fails, retry the fault in user context.
 		 */
+		gts->ustats.fmm_tlbmiss++;
 		if (!gts->ts_force_cch_reload &&
 					down_read_trylock(&gts->ts_mm->mmap_sem)) {
-			gts->ustats.fmm_tlbdropin++;
-			gru_try_dropin(gts, tfh, NULL);
+			gru_try_dropin(gru, gts, tfh, NULL);
 			up_read(&gts->ts_mm->mmap_sem);
 		} else {
 			tfh_user_polling_mode(tfh);
@@ -509,20 +594,43 @@ irqreturn_t gru_intr(int irq, void *dev_id)
 	return IRQ_HANDLED;
 }
 
+irqreturn_t gru0_intr(int irq, void *dev_id)
+{
+	return gru_intr(0, uv_numa_blade_id());
+}
+
+irqreturn_t gru1_intr(int irq, void *dev_id)
+{
+	return gru_intr(1, uv_numa_blade_id());
+}
+
+irqreturn_t gru_intr_mblade(int irq, void *dev_id)
+{
+	int blade;
+
+	for_each_possible_blade(blade) {
+		if (uv_blade_nr_possible_cpus(blade))
+			continue;
+		 gru_intr(0, blade);
+		 gru_intr(1, blade);
+	}
+	return IRQ_HANDLED;
+}
+
 
 static int gru_user_dropin(struct gru_thread_state *gts,
 			   struct gru_tlb_fault_handle *tfh,
-			   unsigned long __user *cb)
+			   void *cb)
 {
 	struct gru_mm_struct *gms = gts->ts_gms;
 	int ret;
 
-	gts->ustats.upm_tlbdropin++;
+	gts->ustats.upm_tlbmiss++;
 	while (1) {
 		wait_event(gms->ms_wait_queue,
 			   atomic_read(&gms->ms_range_active) == 0);
 		prefetchw(tfh);	/* Helps on hdw, required for emulator */
-		ret = gru_try_dropin(gts, tfh, cb);
+		ret = gru_try_dropin(gts->ts_gru, gts, tfh, cb);
 		if (ret <= 0)
 			return ret;
 		STAT(call_os_wait_queue);
@@ -538,52 +646,41 @@ int gru_handle_user_call_os(unsigned long cb)
 {
 	struct gru_tlb_fault_handle *tfh;
 	struct gru_thread_state *gts;
-	unsigned long __user *cbp;
+	void *cbk;
 	int ucbnum, cbrnum, ret = -EINVAL;
 
 	STAT(call_os);
-	gru_dbg(grudev, "address 0x%lx\n", cb);
 
 	/* sanity check the cb pointer */
 	ucbnum = get_cb_number((void *)cb);
 	if ((cb & (GRU_HANDLE_STRIDE - 1)) || ucbnum >= GRU_NUM_CB)
 		return -EINVAL;
-	cbp = (unsigned long *)cb;
 
 	gts = gru_find_lock_gts(cb);
 	if (!gts)
 		return -EINVAL;
+	gru_dbg(grudev, "address 0x%lx, gid %d, gts 0x%p\n", cb, gts->ts_gru ? gts->ts_gru->gs_gid : -1, gts);
 
 	if (ucbnum >= gts->ts_cbr_au_count * GRU_CBR_AU_SIZE)
 		goto exit;
 
-	/*
-	 * If force_unload is set, the UPM TLB fault is phony. The task
-	 * has migrated to another node and the GSEG must be moved. Just
-	 * unload the context. The task will page fault and assign a new
-	 * context.
-	 */
-	if (gts->ts_tgid_owner == current->tgid && gts->ts_blade >= 0 &&
-				gts->ts_blade != uv_numa_blade_id()) {
-		STAT(call_os_offnode_reference);
-		gts->ts_force_unload = 1;
-	}
+	gru_check_context_placement(gts);
 
 	/*
 	 * CCH may contain stale data if ts_force_cch_reload is set.
 	 */
 	if (gts->ts_gru && gts->ts_force_cch_reload) {
 		gts->ts_force_cch_reload = 0;
-		gru_update_cch(gts, 0);
+		gru_update_cch(gts);
 	}
 
 	ret = -EAGAIN;
 	cbrnum = thread_cbr_number(gts, ucbnum);
-	if (gts->ts_force_unload) {
-		gru_unload_context(gts, 1);
-	} else if (gts->ts_gru) {
+	if (gts->ts_gru) {
 		tfh = get_tfh_by_index(gts->ts_gru, cbrnum);
-		ret = gru_user_dropin(gts, tfh, cbp);
+		cbk = get_gseg_base_address_cb(gts->ts_gru->gs_gru_base_vaddr,
+				gts->ts_ctxnum, ucbnum);
+		ret = gru_user_dropin(gts, tfh, cbk);
 	}
 exit:
 	gru_unlock_gts(gts);
@@ -605,11 +702,11 @@ int gru_get_exception_detail(unsigned long arg)
 	if (copy_from_user(&excdet, (void __user *)arg, sizeof(excdet)))
 		return -EFAULT;
 
-	gru_dbg(grudev, "address 0x%lx\n", excdet.cb);
 	gts = gru_find_lock_gts(excdet.cb);
 	if (!gts)
 		return -EINVAL;
 
+	gru_dbg(grudev, "address 0x%lx, gid %d, gts 0x%p\n", excdet.cb, gts->ts_gru ? gts->ts_gru->gs_gid : -1, gts);
 	ucbnum = get_cb_number((void *)excdet.cb);
 	if (ucbnum >= gts->ts_cbr_au_count * GRU_CBR_AU_SIZE) {
 		ret = -EINVAL;
@@ -617,6 +714,7 @@ int gru_get_exception_detail(unsigned long arg)
 		cbrnum = thread_cbr_number(gts, ucbnum);
 		cbe = get_cbe_by_index(gts->ts_gru, cbrnum);
 		gru_flush_cache(cbe);	/* CBE not coherent */
+		sync_core();		/* make sure we are have current data */
 		excdet.opc = cbe->opccpy;
 		excdet.exopc = cbe->exopccpy;
 		excdet.ecause = cbe->ecause;
@@ -624,7 +722,7 @@ int gru_get_exception_detail(unsigned long arg)
 		excdet.exceptdet1 = cbe->idef3upd;
 		excdet.cbrstate = cbe->cbrstate;
 		excdet.cbrexecstatus = cbe->cbrexecstatus;
-		gru_flush_cache(cbe);
+		gru_flush_cache_cbe(cbe);
 		ret = 0;
 	} else {
 		ret = -EAGAIN;
@@ -733,6 +831,11 @@ long gru_get_gseg_statistics(unsigned long arg)
 	if (copy_from_user(&req, (void __user *)arg, sizeof(req)))
 		return -EFAULT;
 
+	/*
+	 * The library creates arrays of contexts for threaded programs.
+	 * If no gts exists in the array, the context has never been used & all
+	 * statistics are implicitly 0.
+	 */
 	gts = gru_find_lock_gts(req.gseg);
 	if (gts) {
 		memcpy(&req.stats, &gts->ustats, sizeof(gts->ustats));
@@ -762,11 +865,25 @@ int gru_set_context_option(unsigned long arg)
 		return -EFAULT;
 	gru_dbg(grudev, "op %d, gseg 0x%lx, value1 0x%lx\n", req.op, req.gseg, req.val1);
 
-	gts = gru_alloc_locked_gts(req.gseg);
-	if (!gts)
-		return -EINVAL;
+	gts = gru_find_lock_gts(req.gseg);
+	if (!gts) {
+		gts = gru_alloc_locked_gts(req.gseg);
+		if (IS_ERR(gts))
+			return PTR_ERR(gts);
+	}
 
 	switch (req.op) {
+	case sco_blade_chiplet:
+		/* Select blade/chiplet for GRU context */
+		if (req.val1 < -1 || req.val1 >= GRU_MAX_BLADES || !gru_base[req.val1] ||
+		    req.val0 < -1 || req.val0 >= GRU_CHIPLETS_PER_HUB) {
+			ret = -EINVAL;
+		} else {
+			gts->ts_user_blade_id = req.val1;
+			gts->ts_user_chiplet_id = req.val0;
+			gru_check_context_placement(gts);
+		}
+		break;
 	case sco_gseg_owner:
  		/* Register the current task as the GSEG owner */
 		gts->ts_tgid_owner = current->tgid;
diff --git a/drivers/misc/sgi-gru/grufile.c b/drivers/misc/sgi-gru/grufile.c
index 41c8fe2a928c..cb3b4d228475 100644
--- a/drivers/misc/sgi-gru/grufile.c
+++ b/drivers/misc/sgi-gru/grufile.c
@@ -35,6 +35,9 @@
 #include <linux/interrupt.h>
 #include <linux/proc_fs.h>
 #include <linux/uaccess.h>
+#ifdef CONFIG_X86_64
+#include <asm/uv/uv_irq.h>
+#endif
 #include <asm/uv/uv.h>
 #include "gru.h"
 #include "grulib.h"
@@ -92,7 +95,7 @@ static void gru_vma_close(struct vm_area_struct *vma)
 /*
  * gru_file_mmap
  *
- * Called when mmaping the device.  Initializes the vma with a fault handler
+ * Called when mmapping the device.  Initializes the vma with a fault handler
  * and private data structure necessary to allocate, track, and free the
  * underlying pages.
  */
@@ -130,7 +133,6 @@ static int gru_create_new_context(unsigned long arg)
 	struct gru_vma_data *vdata;
 	int ret = -EINVAL;
 
-
 	if (copy_from_user(&req, (void __user *)arg, sizeof(req)))
 		return -EFAULT;
 
@@ -150,6 +152,7 @@ static int gru_create_new_context(unsigned long arg)
 		vdata->vd_dsr_au_count =
 		    GRU_DS_BYTES_TO_AU(req.data_segment_bytes);
 		vdata->vd_cbr_au_count = GRU_CB_COUNT_TO_AU(req.control_blocks);
+		vdata->vd_tlb_preload_count = req.tlb_preload_count;
 		ret = 0;
 	}
 	up_write(&current->mm->mmap_sem);
@@ -190,7 +193,7 @@ static long gru_file_unlocked_ioctl(struct file *file, unsigned int req,
 {
 	int err = -EBADRQC;
 
-	gru_dbg(grudev, "file %p\n", file);
+	gru_dbg(grudev, "file %p, req 0x%x, 0x%lx\n", file, req, arg);
 
 	switch (req) {
 	case GRU_CREATE_CONTEXT:
@@ -232,23 +235,24 @@ static long gru_file_unlocked_ioctl(struct file *file, unsigned int req,
  * system.
  */
 static void gru_init_chiplet(struct gru_state *gru, unsigned long paddr,
-			     void *vaddr, int nid, int bid, int grunum)
+			     void *vaddr, int blade_id, int chiplet_id)
 {
 	spin_lock_init(&gru->gs_lock);
 	spin_lock_init(&gru->gs_asid_lock);
 	gru->gs_gru_base_paddr = paddr;
 	gru->gs_gru_base_vaddr = vaddr;
-	gru->gs_gid = bid * GRU_CHIPLETS_PER_BLADE + grunum;
-	gru->gs_blade = gru_base[bid];
-	gru->gs_blade_id = bid;
+	gru->gs_gid = blade_id * GRU_CHIPLETS_PER_BLADE + chiplet_id;
+	gru->gs_blade = gru_base[blade_id];
+	gru->gs_blade_id = blade_id;
+	gru->gs_chiplet_id = chiplet_id;
 	gru->gs_cbr_map = (GRU_CBR_AU == 64) ? ~0 : (1UL << GRU_CBR_AU) - 1;
 	gru->gs_dsr_map = (1UL << GRU_DSR_AU) - 1;
 	gru->gs_asid_limit = MAX_ASID;
 	gru_tgh_flush_init(gru);
 	if (gru->gs_gid >= gru_max_gids)
 		gru_max_gids = gru->gs_gid + 1;
-	gru_dbg(grudev, "bid %d, nid %d, gid %d, vaddr %p (0x%lx)\n",
-		bid, nid, gru->gs_gid, gru->gs_gru_base_vaddr,
+	gru_dbg(grudev, "bid %d, gid %d, vaddr %p (0x%lx)\n",
+		blade_id, gru->gs_gid, gru->gs_gru_base_vaddr,
 		gru->gs_gru_base_paddr);
 }
 
@@ -264,12 +268,10 @@ static int gru_init_tables(unsigned long gru_base_paddr, void *gru_base_vaddr)
 
 	max_user_cbrs = GRU_NUM_CB;
 	max_user_dsr_bytes = GRU_NUM_DSR_BYTES;
-	for_each_online_node(nid) {
-		bid = uv_node_to_blade_id(nid);
-		pnode = uv_node_to_pnode(nid);
-		if (bid < 0 || gru_base[bid])
-			continue;
-		page = alloc_pages_exact_node(nid, GFP_KERNEL, order);
+	for_each_possible_blade(bid) {
+		pnode = uv_blade_to_pnode(bid);
+		nid = uv_blade_to_memory_nid(bid);/* -1 if no memory on blade */
+		page = alloc_pages_node(nid, GFP_KERNEL, order);
 		if (!page)
 			goto fail;
 		gru_base[bid] = page_address(page);
@@ -285,7 +287,7 @@ static int gru_init_tables(unsigned long gru_base_paddr, void *gru_base_vaddr)
 				chip++, gru++) {
 			paddr = gru_chiplet_paddr(gru_base_paddr, pnode, chip);
 			vaddr = gru_chiplet_vaddr(gru_base_vaddr, pnode, chip);
-			gru_init_chiplet(gru, paddr, vaddr, nid, bid, chip);
+			gru_init_chiplet(gru, paddr, vaddr, bid, chip);
 			n = hweight64(gru->gs_cbr_map) * GRU_CBR_AU_SIZE;
 			cbrs = max(cbrs, n);
 			n = hweight64(gru->gs_dsr_map) * GRU_DSR_AU_BYTES;
@@ -298,39 +300,215 @@ static int gru_init_tables(unsigned long gru_base_paddr, void *gru_base_vaddr)
 	return 0;
 
 fail:
-	for (nid--; nid >= 0; nid--)
-		free_pages((unsigned long)gru_base[nid], order);
+	for (bid--; bid >= 0; bid--)
+		free_pages((unsigned long)gru_base[bid], order);
 	return -ENOMEM;
 }
 
-#ifdef CONFIG_IA64
+static void gru_free_tables(void)
+{
+	int bid;
+	int order = get_order(sizeof(struct gru_state) *
+			      GRU_CHIPLETS_PER_BLADE);
 
-static int get_base_irq(void)
+	for (bid = 0; bid < GRU_MAX_BLADES; bid++)
+		free_pages((unsigned long)gru_base[bid], order);
+}
+
+static unsigned long gru_chiplet_cpu_to_mmr(int chiplet, int cpu, int *corep)
 {
-	return IRQ_GRU;
+	unsigned long mmr = 0;
+	int core;
+
+	/*
+	 * We target the cores of a blade and not the hyperthreads themselves.
+	 * There is a max of 8 cores per socket and 2 sockets per blade,
+	 * making for a max total of 16 cores (i.e., 16 CPUs without
+	 * hyperthreading and 32 CPUs with hyperthreading).
+	 */
+	core = uv_cpu_core_number(cpu) + UV_MAX_INT_CORES * uv_cpu_socket_number(cpu);
+	if (core >= GRU_NUM_TFM || uv_cpu_ht_number(cpu))
+		return 0;
+
+	if (chiplet == 0) {
+		mmr = UVH_GR0_TLB_INT0_CONFIG +
+		    core * (UVH_GR0_TLB_INT1_CONFIG - UVH_GR0_TLB_INT0_CONFIG);
+	} else if (chiplet == 1) {
+		mmr = UVH_GR1_TLB_INT0_CONFIG +
+		    core * (UVH_GR1_TLB_INT1_CONFIG - UVH_GR1_TLB_INT0_CONFIG);
+	} else {
+		BUG();
+	}
+
+	*corep = core;
+	return mmr;
 }
 
-#elif defined CONFIG_X86_64
+#ifdef CONFIG_IA64
 
-static void noop(unsigned int irq)
+static int gru_irq_count[GRU_CHIPLETS_PER_BLADE];
+
+static void gru_noop(unsigned int irq)
 {
 }
 
-static struct irq_chip gru_chip = {
-	.name		= "gru",
-	.mask		= noop,
-	.unmask		= noop,
-	.ack		= noop,
+static struct irq_chip gru_chip[GRU_CHIPLETS_PER_BLADE] = {
+	[0 ... GRU_CHIPLETS_PER_BLADE - 1] {
+		.mask		= gru_noop,
+		.unmask		= gru_noop,
+		.ack		= gru_noop
+	}
 };
 
-static int get_base_irq(void)
+static int gru_chiplet_setup_tlb_irq(int chiplet, char *irq_name,
+			irq_handler_t irq_handler, int cpu, int blade)
+{
+	unsigned long mmr;
+	int irq = IRQ_GRU + chiplet;
+	int ret, core;
+
+	mmr = gru_chiplet_cpu_to_mmr(chiplet, cpu, &core);
+	if (mmr == 0)
+		return 0;
+
+	if (gru_irq_count[chiplet] == 0) {
+		gru_chip[chiplet].name = irq_name;
+		ret = set_irq_chip(irq, &gru_chip[chiplet]);
+		if (ret) {
+			printk(KERN_ERR "%s: set_irq_chip failed, errno=%d\n",
+			       GRU_DRIVER_ID_STR, -ret);
+			return ret;
+		}
+
+		ret = request_irq(irq, irq_handler, 0, irq_name, NULL);
+		if (ret) {
+			printk(KERN_ERR "%s: request_irq failed, errno=%d\n",
+			       GRU_DRIVER_ID_STR, -ret);
+			return ret;
+		}
+	}
+	gru_irq_count[chiplet]++;
+
+	return 0;
+}
+
+static void gru_chiplet_teardown_tlb_irq(int chiplet, int cpu, int blade)
+{
+	unsigned long mmr;
+	int core, irq = IRQ_GRU + chiplet;
+
+	if (gru_irq_count[chiplet] == 0)
+		return;
+
+	mmr = gru_chiplet_cpu_to_mmr(chiplet, cpu, &core);
+	if (mmr == 0)
+		return;
+
+	if (--gru_irq_count[chiplet] == 0)
+		free_irq(irq, NULL);
+}
+
+#elif defined CONFIG_X86_64
+
+static int gru_chiplet_setup_tlb_irq(int chiplet, char *irq_name,
+			irq_handler_t irq_handler, int cpu, int blade)
+{
+	unsigned long mmr;
+	int irq, core;
+	int ret;
+
+	mmr = gru_chiplet_cpu_to_mmr(chiplet, cpu, &core);
+	if (mmr == 0)
+		return 0;
+
+	irq = uv_setup_irq(irq_name, cpu, blade, mmr, UV_AFFINITY_CPU);
+	if (irq < 0) {
+		printk(KERN_ERR "%s: uv_setup_irq failed, errno=%d\n",
+		       GRU_DRIVER_ID_STR, -irq);
+		return irq;
+	}
+
+	ret = request_irq(irq, irq_handler, 0, irq_name, NULL);
+	if (ret) {
+		uv_teardown_irq(irq);
+		printk(KERN_ERR "%s: request_irq failed, errno=%d\n",
+		       GRU_DRIVER_ID_STR, -ret);
+		return ret;
+	}
+	gru_base[blade]->bs_grus[chiplet].gs_irq[core] = irq;
+	return 0;
+}
+
+static void gru_chiplet_teardown_tlb_irq(int chiplet, int cpu, int blade)
 {
-	set_irq_chip(IRQ_GRU, &gru_chip);
-	set_irq_chip(IRQ_GRU + 1, &gru_chip);
-	return IRQ_GRU;
+	int irq, core;
+	unsigned long mmr;
+
+	mmr = gru_chiplet_cpu_to_mmr(chiplet, cpu, &core);
+	if (mmr) {
+		irq = gru_base[blade]->bs_grus[chiplet].gs_irq[core];
+		if (irq) {
+			free_irq(irq, NULL);
+			uv_teardown_irq(irq);
+		}
+	}
 }
+
 #endif
 
+static void gru_teardown_tlb_irqs(void)
+{
+	int blade;
+	int cpu;
+
+	for_each_online_cpu(cpu) {
+		blade = uv_cpu_to_blade_id(cpu);
+		gru_chiplet_teardown_tlb_irq(0, cpu, blade);
+		gru_chiplet_teardown_tlb_irq(1, cpu, blade);
+	}
+	for_each_possible_blade(blade) {
+		if (uv_blade_nr_possible_cpus(blade))
+			continue;
+		gru_chiplet_teardown_tlb_irq(0, 0, blade);
+		gru_chiplet_teardown_tlb_irq(1, 0, blade);
+	}
+}
+
+static int gru_setup_tlb_irqs(void)
+{
+	int blade;
+	int cpu;
+	int ret;
+
+	for_each_online_cpu(cpu) {
+		blade = uv_cpu_to_blade_id(cpu);
+		ret = gru_chiplet_setup_tlb_irq(0, "GRU0_TLB", gru0_intr, cpu, blade);
+		if (ret != 0)
+			goto exit1;
+
+		ret = gru_chiplet_setup_tlb_irq(1, "GRU1_TLB", gru1_intr, cpu, blade);
+		if (ret != 0)
+			goto exit1;
+	}
+	for_each_possible_blade(blade) {
+		if (uv_blade_nr_possible_cpus(blade))
+			continue;
+		ret = gru_chiplet_setup_tlb_irq(0, "GRU0_TLB", gru_intr_mblade, 0, blade);
+		if (ret != 0)
+			goto exit1;
+
+		ret = gru_chiplet_setup_tlb_irq(1, "GRU1_TLB", gru_intr_mblade, 0, blade);
+		if (ret != 0)
+			goto exit1;
+	}
+
+	return 0;
+
+exit1:
+	gru_teardown_tlb_irqs();
+	return ret;
+}
+
 /*
  * gru_init
  *
@@ -338,8 +516,7 @@ static int get_base_irq(void)
  */
 static int __init gru_init(void)
 {
-	int ret, irq, chip;
-	char id[10];
+	int ret;
 
 	if (!is_uv_system())
 		return 0;
@@ -354,41 +531,29 @@ static int __init gru_init(void)
 	gru_end_paddr = gru_start_paddr + GRU_MAX_BLADES * GRU_SIZE;
 	printk(KERN_INFO "GRU space: 0x%lx - 0x%lx\n",
 	       gru_start_paddr, gru_end_paddr);
-	irq = get_base_irq();
-	for (chip = 0; chip < GRU_CHIPLETS_PER_BLADE; chip++) {
-		ret = request_irq(irq + chip, gru_intr, 0, id, NULL);
-		/* TODO: fix irq handling on x86. For now ignore failure because
-		 * interrupts are not required & not yet fully supported */
-		if (ret) {
-			printk(KERN_WARNING
-			       "!!!WARNING: GRU ignoring request failure!!!\n");
-			ret = 0;
-		}
-		if (ret) {
-			printk(KERN_ERR "%s: request_irq failed\n",
-			       GRU_DRIVER_ID_STR);
-			goto exit1;
-		}
-	}
-
 	ret = misc_register(&gru_miscdev);
 	if (ret) {
 		printk(KERN_ERR "%s: misc_register failed\n",
 		       GRU_DRIVER_ID_STR);
-		goto exit1;
+		goto exit0;
 	}
 
 	ret = gru_proc_init();
 	if (ret) {
 		printk(KERN_ERR "%s: proc init failed\n", GRU_DRIVER_ID_STR);
-		goto exit2;
+		goto exit1;
 	}
 
 	ret = gru_init_tables(gru_start_paddr, gru_start_vaddr);
 	if (ret) {
 		printk(KERN_ERR "%s: init tables failed\n", GRU_DRIVER_ID_STR);
-		goto exit3;
+		goto exit2;
 	}
+
+	ret = gru_setup_tlb_irqs();
+	if (ret != 0)
+		goto exit3;
+
 	gru_kservices_init();
 
 	printk(KERN_INFO "%s: v%s\n", GRU_DRIVER_ID_STR,
@@ -396,31 +561,24 @@ static int __init gru_init(void)
 	return 0;
 
 exit3:
-	gru_proc_exit();
+	gru_free_tables();
 exit2:
-	misc_deregister(&gru_miscdev);
+	gru_proc_exit();
 exit1:
-	for (--chip; chip >= 0; chip--)
-		free_irq(irq + chip, NULL);
+	misc_deregister(&gru_miscdev);
+exit0:
 	return ret;
 
 }
 
 static void __exit gru_exit(void)
 {
-	int i, bid;
-	int order = get_order(sizeof(struct gru_state) *
-			      GRU_CHIPLETS_PER_BLADE);
-
 	if (!is_uv_system())
 		return;
 
-	for (i = 0; i < GRU_CHIPLETS_PER_BLADE; i++)
-		free_irq(IRQ_GRU + i, NULL);
+	gru_teardown_tlb_irqs();
 	gru_kservices_exit();
-	for (bid = 0; bid < GRU_MAX_BLADES; bid++)
-		free_pages((unsigned long)gru_base[bid], order);
-
+	gru_free_tables();
 	misc_deregister(&gru_miscdev);
 	gru_proc_exit();
 }
diff --git a/drivers/misc/sgi-gru/gruhandles.c b/drivers/misc/sgi-gru/gruhandles.c
index 37e7cfc53b9c..2f30badc6ffd 100644
--- a/drivers/misc/sgi-gru/gruhandles.c
+++ b/drivers/misc/sgi-gru/gruhandles.c
@@ -27,9 +27,11 @@
 #ifdef CONFIG_IA64
 #include <asm/processor.h>
 #define GRU_OPERATION_TIMEOUT	(((cycles_t) local_cpu_data->itc_freq)*10)
+#define CLKS2NSEC(c)		((c) *1000000000 / local_cpu_data->itc_freq)
 #else
 #include <asm/tsc.h>
 #define GRU_OPERATION_TIMEOUT	((cycles_t) tsc_khz*10*1000)
+#define CLKS2NSEC(c)		((c) * 1000000 / tsc_khz)
 #endif
 
 /* Extract the status field from a kernel handle */
@@ -39,21 +41,39 @@ struct mcs_op_statistic mcs_op_statistics[mcsop_last];
 
 static void update_mcs_stats(enum mcs_op op, unsigned long clks)
 {
+	unsigned long nsec;
+
+	nsec = CLKS2NSEC(clks);
 	atomic_long_inc(&mcs_op_statistics[op].count);
-	atomic_long_add(clks, &mcs_op_statistics[op].total);
-	if (mcs_op_statistics[op].max < clks)
-		mcs_op_statistics[op].max = clks;
+	atomic_long_add(nsec, &mcs_op_statistics[op].total);
+	if (mcs_op_statistics[op].max < nsec)
+		mcs_op_statistics[op].max = nsec;
 }
 
 static void start_instruction(void *h)
 {
 	unsigned long *w0 = h;
 
-	wmb();		/* setting CMD bit must be last */
-	*w0 = *w0 | 1;
+	wmb();		/* setting CMD/STATUS bits must be last */
+	*w0 = *w0 | 0x20001;
 	gru_flush_cache(h);
 }
 
+static void report_instruction_timeout(void *h)
+{
+	unsigned long goff = GSEGPOFF((unsigned long)h);
+	char *id = "???";
+
+	if (TYPE_IS(CCH, goff))
+		id = "CCH";
+	else if (TYPE_IS(TGH, goff))
+		id = "TGH";
+	else if (TYPE_IS(TFH, goff))
+		id = "TFH";
+
+	panic(KERN_ALERT "GRU %p (%s) is malfunctioning\n", h, id);
+}
+
 static int wait_instruction_complete(void *h, enum mcs_op opc)
 {
 	int status;
@@ -64,9 +84,10 @@ static int wait_instruction_complete(void *h, enum mcs_op opc)
 		status = GET_MSEG_HANDLE_STATUS(h);
 		if (status != CCHSTATUS_ACTIVE)
 			break;
-		if (GRU_OPERATION_TIMEOUT < (get_cycles() - start_time))
-			panic("GRU %p is malfunctioning: start %ld, end %ld\n",
-			      h, start_time, (unsigned long)get_cycles());
+		if (GRU_OPERATION_TIMEOUT < (get_cycles() - start_time)) {
+			report_instruction_timeout(h);
+			start_time = get_cycles();
+		}
 	}
 	if (gru_options & OPT_STATS)
 		update_mcs_stats(opc, get_cycles() - start_time);
@@ -75,9 +96,18 @@ static int wait_instruction_complete(void *h, enum mcs_op opc)
 
 int cch_allocate(struct gru_context_configuration_handle *cch)
 {
+	int ret;
+
 	cch->opc = CCHOP_ALLOCATE;
 	start_instruction(cch);
-	return wait_instruction_complete(cch, cchop_allocate);
+	ret = wait_instruction_complete(cch, cchop_allocate);
+
+	/*
+	 * Stop speculation into the GSEG being mapped by the previous ALLOCATE.
+	 * The GSEG memory does not exist until the ALLOCATE completes.
+	 */
+	sync_core();
+	return ret;
 }
 
 int cch_start(struct gru_context_configuration_handle *cch)
@@ -96,9 +126,18 @@ int cch_interrupt(struct gru_context_configuration_handle *cch)
 
 int cch_deallocate(struct gru_context_configuration_handle *cch)
 {
+	int ret;
+
 	cch->opc = CCHOP_DEALLOCATE;
 	start_instruction(cch);
-	return wait_instruction_complete(cch, cchop_deallocate);
+	ret = wait_instruction_complete(cch, cchop_deallocate);
+
+	/*
+	 * Stop speculation into the GSEG being unmapped by the previous
+	 * DEALLOCATE.
+	 */
+	sync_core();
+	return ret;
 }
 
 int cch_interrupt_sync(struct gru_context_configuration_handle
@@ -126,17 +165,20 @@ int tgh_invalidate(struct gru_tlb_global_handle *tgh,
 	return wait_instruction_complete(tgh, tghop_invalidate);
 }
 
-void tfh_write_only(struct gru_tlb_fault_handle *tfh,
-				  unsigned long pfn, unsigned long vaddr,
-				  int asid, int dirty, int pagesize)
+int tfh_write_only(struct gru_tlb_fault_handle *tfh,
+				  unsigned long paddr, int gaa,
+				  unsigned long vaddr, int asid, int dirty,
+				  int pagesize)
 {
 	tfh->fillasid = asid;
 	tfh->fillvaddr = vaddr;
-	tfh->pfn = pfn;
+	tfh->pfn = paddr >> GRU_PADDR_SHIFT;
+	tfh->gaa = gaa;
 	tfh->dirty = dirty;
 	tfh->pagesize = pagesize;
 	tfh->opc = TFHOP_WRITE_ONLY;
 	start_instruction(tfh);
+	return wait_instruction_complete(tfh, tfhop_write_only);
 }
 
 void tfh_write_restart(struct gru_tlb_fault_handle *tfh,
diff --git a/drivers/misc/sgi-gru/gruhandles.h b/drivers/misc/sgi-gru/gruhandles.h
index f44112242d00..3f998b924d8f 100644
--- a/drivers/misc/sgi-gru/gruhandles.h
+++ b/drivers/misc/sgi-gru/gruhandles.h
@@ -91,6 +91,12 @@
 /* Convert an arbitrary handle address to the beginning of the GRU segment */
 #define GRUBASE(h)		((void *)((unsigned long)(h) & ~(GRU_SIZE - 1)))
 
+/* Test a valid handle address to determine the type */
+#define TYPE_IS(hn, h)		((h) >= GRU_##hn##_BASE && (h) <	\
+		GRU_##hn##_BASE + GRU_NUM_##hn * GRU_HANDLE_STRIDE &&   \
+		(((h) & (GRU_HANDLE_STRIDE - 1)) == 0))
+
+
 /* General addressing macros. */
 static inline void *get_gseg_base_address(void *base, int ctxnum)
 {
@@ -158,6 +164,16 @@ static inline void *gru_chiplet_vaddr(void *vaddr, int pnode, int chiplet)
 	return vaddr + GRU_SIZE * (2 * pnode  + chiplet);
 }
 
+static inline struct gru_control_block_extended *gru_tfh_to_cbe(
+					struct gru_tlb_fault_handle *tfh)
+{
+	unsigned long cbe;
+
+	cbe = (unsigned long)tfh - GRU_TFH_BASE + GRU_CBE_BASE;
+	return (struct gru_control_block_extended*)cbe;
+}
+
+
 
 
 /*
@@ -236,6 +252,17 @@ enum gru_tgh_state {
 	TGHSTATE_RESTART_CTX,
 };
 
+enum gru_tgh_cause {
+	TGHCAUSE_RR_ECC,
+	TGHCAUSE_TLB_ECC,
+	TGHCAUSE_LRU_ECC,
+	TGHCAUSE_PS_ECC,
+	TGHCAUSE_MUL_ERR,
+	TGHCAUSE_DATA_ERR,
+	TGHCAUSE_SW_FORCE
+};
+
+
 /*
  * TFH - TLB Global Handle
  * 	Used for TLB dropins into the GRU TLB.
@@ -440,6 +467,12 @@ struct gru_control_block_extended {
 	unsigned int cbrexecstatus:8;
 };
 
+/* CBE fields for active BCOPY instructions */
+#define cbe_baddr0	idef1upd
+#define cbe_baddr1	idef3upd
+#define cbe_src_cl	idef6cpy
+#define cbe_nelemcur	idef5upd
+
 enum gru_cbr_state {
 	CBRSTATE_INACTIVE,
 	CBRSTATE_IDLE,
@@ -487,8 +520,8 @@ int cch_interrupt_sync(struct gru_context_configuration_handle *cch);
 int tgh_invalidate(struct gru_tlb_global_handle *tgh, unsigned long vaddr,
 	unsigned long vaddrmask, int asid, int pagesize, int global, int n,
 	unsigned short ctxbitmap);
-void tfh_write_only(struct gru_tlb_fault_handle *tfh, unsigned long pfn,
-	unsigned long vaddr, int asid, int dirty, int pagesize);
+int tfh_write_only(struct gru_tlb_fault_handle *tfh, unsigned long paddr,
+	int gaa, unsigned long vaddr, int asid, int dirty, int pagesize);
 void tfh_write_restart(struct gru_tlb_fault_handle *tfh, unsigned long paddr,
 	int gaa, unsigned long vaddr, int asid, int dirty, int pagesize);
 void tfh_restart(struct gru_tlb_fault_handle *tfh);
diff --git a/drivers/misc/sgi-gru/grukdump.c b/drivers/misc/sgi-gru/grukdump.c
index 55eabfa85585..9b2062d17327 100644
--- a/drivers/misc/sgi-gru/grukdump.c
+++ b/drivers/misc/sgi-gru/grukdump.c
@@ -44,7 +44,8 @@ static int gru_user_copy_handle(void __user **dp, void *s)
 
 static int gru_dump_context_data(void *grubase,
 			struct gru_context_configuration_handle *cch,
-			void __user *ubuf, int ctxnum, int dsrcnt)
+			void __user *ubuf, int ctxnum, int dsrcnt,
+			int flush_cbrs)
 {
 	void *cb, *cbe, *tfh, *gseg;
 	int i, scr;
@@ -55,6 +56,8 @@ static int gru_dump_context_data(void *grubase,
 	tfh = grubase + GRU_TFH_BASE;
 
 	for_each_cbr_in_allocation_map(i, &cch->cbr_allocation_map, scr) {
+		if (flush_cbrs)
+			gru_flush_cache(cb);
 		if (gru_user_copy_handle(&ubuf, cb))
 			goto fail;
 		if (gru_user_copy_handle(&ubuf, tfh + i * GRU_HANDLE_STRIDE))
@@ -115,7 +118,7 @@ fail:
 
 static int gru_dump_context(struct gru_state *gru, int ctxnum,
 		void __user *ubuf, void __user *ubufend, char data_opt,
-		char lock_cch)
+		char lock_cch, char flush_cbrs)
 {
 	struct gru_dump_context_header hdr;
 	struct gru_dump_context_header __user *uhdr = ubuf;
@@ -159,8 +162,7 @@ static int gru_dump_context(struct gru_state *gru, int ctxnum,
 			ret = -EFBIG;
 		else
 			ret = gru_dump_context_data(grubase, cch, ubuf, ctxnum,
-							dsrcnt);
-
+							dsrcnt, flush_cbrs);
 	}
 	if (cch_locked)
 		unlock_cch_handle(cch);
@@ -215,7 +217,8 @@ int gru_dump_chiplet_request(unsigned long arg)
 	for (ctxnum = 0; ctxnum < GRU_NUM_CCH; ctxnum++) {
 		if (req.ctxnum == ctxnum || req.ctxnum < 0) {
 			ret = gru_dump_context(gru, ctxnum, ubuf, ubufend,
-						req.data_opt, req.lock_cch);
+						req.data_opt, req.lock_cch,
+						req.flush_cbrs);
 			if (ret < 0)
 				goto fail;
 			ubuf += ret;
diff --git a/drivers/misc/sgi-gru/grukservices.c b/drivers/misc/sgi-gru/grukservices.c
index 766e21e15574..34749ee88dfa 100644
--- a/drivers/misc/sgi-gru/grukservices.c
+++ b/drivers/misc/sgi-gru/grukservices.c
@@ -31,6 +31,7 @@
 #include <linux/interrupt.h>
 #include <linux/uaccess.h>
 #include <linux/delay.h>
+#include <asm/io_apic.h>
 #include "gru.h"
 #include "grulib.h"
 #include "grutables.h"
@@ -97,9 +98,6 @@
 #define ASYNC_HAN_TO_BID(h)	((h) - 1)
 #define ASYNC_BID_TO_HAN(b)	((b) + 1)
 #define ASYNC_HAN_TO_BS(h)	gru_base[ASYNC_HAN_TO_BID(h)]
-#define KCB_TO_GID(cb)		((cb - gru_start_vaddr) /		\
-					(GRU_SIZE * GRU_CHIPLETS_PER_BLADE))
-#define KCB_TO_BS(cb)		gru_base[KCB_TO_GID(cb)]
 
 #define GRU_NUM_KERNEL_CBR	1
 #define GRU_NUM_KERNEL_DSR_BYTES 256
@@ -160,8 +158,10 @@ static void gru_load_kernel_context(struct gru_blade_state *bs, int blade_id)
 	up_read(&bs->bs_kgts_sema);
 	down_write(&bs->bs_kgts_sema);
 
-	if (!bs->bs_kgts)
-		bs->bs_kgts = gru_alloc_gts(NULL, 0, 0, 0, 0);
+	if (!bs->bs_kgts) {
+		bs->bs_kgts = gru_alloc_gts(NULL, 0, 0, 0, 0, 0);
+		bs->bs_kgts->ts_user_blade_id = blade_id;
+	}
 	kgts = bs->bs_kgts;
 
 	if (!kgts->ts_gru) {
@@ -172,9 +172,9 @@ static void gru_load_kernel_context(struct gru_blade_state *bs, int blade_id)
 		kgts->ts_dsr_au_count = GRU_DS_BYTES_TO_AU(
 			GRU_NUM_KERNEL_DSR_BYTES * ncpus +
 				bs->bs_async_dsr_bytes);
-		while (!gru_assign_gru_context(kgts, blade_id)) {
+		while (!gru_assign_gru_context(kgts)) {
 			msleep(1);
-			gru_steal_context(kgts, blade_id);
+			gru_steal_context(kgts);
 		}
 		gru_load_context(kgts);
 		gru = bs->bs_kgts->ts_gru;
@@ -200,13 +200,15 @@ static int gru_free_kernel_contexts(void)
 		bs = gru_base[bid];
 		if (!bs)
 			continue;
+
+		/* Ignore busy contexts. Don't want to block here.  */
 		if (down_write_trylock(&bs->bs_kgts_sema)) {
 			kgts = bs->bs_kgts;
 			if (kgts && kgts->ts_gru)
 				gru_unload_context(kgts, 0);
-			kfree(kgts);
 			bs->bs_kgts = NULL;
 			up_write(&bs->bs_kgts_sema);
+			kfree(kgts);
 		} else {
 			ret++;
 		}
@@ -220,13 +222,21 @@ static int gru_free_kernel_contexts(void)
 static struct gru_blade_state *gru_lock_kernel_context(int blade_id)
 {
 	struct gru_blade_state *bs;
+	int bid;
 
 	STAT(lock_kernel_context);
-	bs = gru_base[blade_id];
+again:
+	bid = blade_id < 0 ? uv_numa_blade_id() : blade_id;
+	bs = gru_base[bid];
 
+	/* Handle the case where migration occured while waiting for the sema */
 	down_read(&bs->bs_kgts_sema);
+	if (blade_id < 0 && bid != uv_numa_blade_id()) {
+		up_read(&bs->bs_kgts_sema);
+		goto again;
+	}
 	if (!bs->bs_kgts || !bs->bs_kgts->ts_gru)
-		gru_load_kernel_context(bs, blade_id);
+		gru_load_kernel_context(bs, bid);
 	return bs;
 
 }
@@ -255,7 +265,7 @@ static int gru_get_cpu_resources(int dsr_bytes, void **cb, void **dsr)
 
 	BUG_ON(dsr_bytes > GRU_NUM_KERNEL_DSR_BYTES);
 	preempt_disable();
-	bs = gru_lock_kernel_context(uv_numa_blade_id());
+	bs = gru_lock_kernel_context(-1);
 	lcpu = uv_blade_processor_id();
 	*cb = bs->kernel_cb + lcpu * GRU_HANDLE_STRIDE;
 	*dsr = bs->kernel_dsr + lcpu * GRU_NUM_KERNEL_DSR_BYTES;
@@ -384,13 +394,31 @@ int gru_get_cb_exception_detail(void *cb,
 		struct control_block_extended_exc_detail *excdet)
 {
 	struct gru_control_block_extended *cbe;
-	struct gru_blade_state *bs;
-	int cbrnum;
-
-	bs = KCB_TO_BS(cb);
-	cbrnum = thread_cbr_number(bs->bs_kgts, get_cb_number(cb));
+	struct gru_thread_state *kgts = NULL;
+	unsigned long off;
+	int cbrnum, bid;
+
+	/*
+	 * Locate kgts for cb. This algorithm is SLOW but
+	 * this function is rarely called (ie., almost never).
+	 * Performance does not matter.
+	 */
+	for_each_possible_blade(bid) {
+		if (!gru_base[bid])
+			break;
+		kgts = gru_base[bid]->bs_kgts;
+		if (!kgts || !kgts->ts_gru)
+			continue;
+		off = cb - kgts->ts_gru->gs_gru_base_vaddr;
+		if (off < GRU_SIZE)
+			break;
+		kgts = NULL;
+	}
+	BUG_ON(!kgts);
+	cbrnum = thread_cbr_number(kgts, get_cb_number(cb));
 	cbe = get_cbe(GRUBASE(cb), cbrnum);
 	gru_flush_cache(cbe);	/* CBE not coherent */
+	sync_core();
 	excdet->opc = cbe->opccpy;
 	excdet->exopc = cbe->exopccpy;
 	excdet->ecause = cbe->ecause;
@@ -409,8 +437,8 @@ char *gru_get_cb_exception_detail_str(int ret, void *cb,
 	if (ret > 0 && gen->istatus == CBS_EXCEPTION) {
 		gru_get_cb_exception_detail(cb, &excdet);
 		snprintf(buf, size,
-			"GRU exception: cb %p, opc %d, exopc %d, ecause 0x%x,"
-			"excdet0 0x%lx, excdet1 0x%x",
+			"GRU:%d exception: cb %p, opc %d, exopc %d, ecause 0x%x,"
+			"excdet0 0x%lx, excdet1 0x%x", smp_processor_id(),
 			gen, excdet.opc, excdet.exopc, excdet.ecause,
 			excdet.exceptdet0, excdet.exceptdet1);
 	} else {
@@ -457,9 +485,10 @@ int gru_check_status_proc(void *cb)
 	int ret;
 
 	ret = gen->istatus;
-	if (ret != CBS_EXCEPTION)
-		return ret;
-	return gru_retry_exception(cb);
+	if (ret == CBS_EXCEPTION)
+		ret = gru_retry_exception(cb);
+	rmb();
+	return ret;
 
 }
 
@@ -471,7 +500,7 @@ int gru_wait_proc(void *cb)
 	ret = gru_wait_idle_or_exception(gen);
 	if (ret == CBS_EXCEPTION)
 		ret = gru_retry_exception(cb);
-
+	rmb();
 	return ret;
 }
 
@@ -538,7 +567,7 @@ int gru_create_message_queue(struct gru_message_queue_desc *mqd,
 	mqd->mq = mq;
 	mqd->mq_gpa = uv_gpa(mq);
 	mqd->qlines = qlines;
-	mqd->interrupt_pnode = UV_NASID_TO_PNODE(nasid);
+	mqd->interrupt_pnode = nasid >> 1;
 	mqd->interrupt_vector = vector;
 	mqd->interrupt_apicid = apicid;
 	return 0;
@@ -598,6 +627,8 @@ static int send_noop_message(void *cb, struct gru_message_queue_desc *mqd,
 				ret = MQE_UNEXPECTED_CB_ERR;
 			break;
 		case CBSS_PAGE_OVERFLOW:
+			STAT(mesq_noop_page_overflow);
+			/* fallthru */
 		default:
 			BUG();
 		}
@@ -673,18 +704,6 @@ cberr:
 }
 
 /*
- * Send a cross-partition interrupt to the SSI that contains the target
- * message queue. Normally, the interrupt is automatically delivered by hardware
- * but some error conditions require explicit delivery.
- */
-static void send_message_queue_interrupt(struct gru_message_queue_desc *mqd)
-{
-	if (mqd->interrupt_vector)
-		uv_hub_send_ipi(mqd->interrupt_pnode, mqd->interrupt_apicid,
-				mqd->interrupt_vector);
-}
-
-/*
  * Handle a PUT failure. Note: if message was a 2-line message, one of the
  * lines might have successfully have been written. Before sending the
  * message, "present" must be cleared in BOTH lines to prevent the receiver
@@ -693,7 +712,8 @@ static void send_message_queue_interrupt(struct gru_message_queue_desc *mqd)
 static int send_message_put_nacked(void *cb, struct gru_message_queue_desc *mqd,
 			void *mesg, int lines)
 {
-	unsigned long m;
+	unsigned long m, *val = mesg, gpa, save;
+	int ret;
 
 	m = mqd->mq_gpa + (gru_get_amo_value_head(cb) << 6);
 	if (lines == 2) {
@@ -704,7 +724,26 @@ static int send_message_put_nacked(void *cb, struct gru_message_queue_desc *mqd,
 	gru_vstore(cb, m, gru_get_tri(mesg), XTYPE_CL, lines, 1, IMA);
 	if (gru_wait(cb) != CBS_IDLE)
 		return MQE_UNEXPECTED_CB_ERR;
-	send_message_queue_interrupt(mqd);
+
+	if (!mqd->interrupt_vector)
+		return MQE_OK;
+
+	/*
+	 * Send a cross-partition interrupt to the SSI that contains the target
+	 * message queue. Normally, the interrupt is automatically delivered by
+	 * hardware but some error conditions require explicit delivery.
+	 * Use the GRU to deliver the interrupt. Otherwise partition failures
+	 * could cause unrecovered errors.
+	 */
+	gpa = uv_global_gru_mmr_address(mqd->interrupt_pnode, UVH_IPI_INT);
+	save = *val;
+	*val = uv_hub_ipi_value(mqd->interrupt_apicid, mqd->interrupt_vector,
+				dest_Fixed);
+	gru_vstore_phys(cb, gpa, gru_get_tri(mesg), IAA_REGISTER, IMA);
+	ret = gru_wait(cb);
+	*val = save;
+	if (ret != CBS_IDLE)
+		return MQE_UNEXPECTED_CB_ERR;
 	return MQE_OK;
 }
 
@@ -739,6 +778,9 @@ static int send_message_failure(void *cb, struct gru_message_queue_desc *mqd,
 		STAT(mesq_send_put_nacked);
 		ret = send_message_put_nacked(cb, mqd, mesg, lines);
 		break;
+	case CBSS_PAGE_OVERFLOW:
+		STAT(mesq_page_overflow);
+		/* fallthru */
 	default:
 		BUG();
 	}
@@ -831,7 +873,6 @@ void *gru_get_next_message(struct gru_message_queue_desc *mqd)
 	int present = mhdr->present;
 
 	/* skip NOOP messages */
-	STAT(mesq_receive);
 	while (present == MQS_NOOP) {
 		gru_free_message(mqd, mhdr);
 		mhdr = mq->next;
@@ -851,6 +892,7 @@ void *gru_get_next_message(struct gru_message_queue_desc *mqd)
 	if (mhdr->lines == 2)
 		restore_present2(mhdr, mhdr->present2);
 
+	STAT(mesq_receive);
 	return mhdr;
 }
 EXPORT_SYMBOL_GPL(gru_get_next_message);
@@ -858,6 +900,29 @@ EXPORT_SYMBOL_GPL(gru_get_next_message);
 /* ---------------------- GRU DATA COPY FUNCTIONS ---------------------------*/
 
 /*
+ * Load a DW from a global GPA. The GPA can be a memory or MMR address.
+ */
+int gru_read_gpa(unsigned long *value, unsigned long gpa)
+{
+	void *cb;
+	void *dsr;
+	int ret, iaa;
+
+	STAT(read_gpa);
+	if (gru_get_cpu_resources(GRU_NUM_KERNEL_DSR_BYTES, &cb, &dsr))
+		return MQE_BUG_NO_RESOURCES;
+	iaa = gpa >> 62;
+	gru_vload_phys(cb, gpa, gru_get_tri(dsr), iaa, IMA);
+	ret = gru_wait(cb);
+	if (ret == CBS_IDLE)
+		*value = *(unsigned long *)dsr;
+	gru_free_cpu_resources(cb, dsr);
+	return ret;
+}
+EXPORT_SYMBOL_GPL(gru_read_gpa);
+
+
+/*
  * Copy a block of data using the GRU resources
  */
 int gru_copy_gpa(unsigned long dest_gpa, unsigned long src_gpa,
@@ -898,24 +963,24 @@ static int quicktest0(unsigned long arg)
 
 	gru_vload(cb, uv_gpa(&word0), gru_get_tri(dsr), XTYPE_DW, 1, 1, IMA);
 	if (gru_wait(cb) != CBS_IDLE) {
-		printk(KERN_DEBUG "GRU quicktest0: CBR failure 1\n");
+		printk(KERN_DEBUG "GRU:%d quicktest0: CBR failure 1\n", smp_processor_id());
 		goto done;
 	}
 
 	if (*p != MAGIC) {
-		printk(KERN_DEBUG "GRU: quicktest0 bad magic 0x%lx\n", *p);
+		printk(KERN_DEBUG "GRU:%d quicktest0 bad magic 0x%lx\n", smp_processor_id(), *p);
 		goto done;
 	}
 	gru_vstore(cb, uv_gpa(&word1), gru_get_tri(dsr), XTYPE_DW, 1, 1, IMA);
 	if (gru_wait(cb) != CBS_IDLE) {
-		printk(KERN_DEBUG "GRU quicktest0: CBR failure 2\n");
+		printk(KERN_DEBUG "GRU:%d quicktest0: CBR failure 2\n", smp_processor_id());
 		goto done;
 	}
 
 	if (word0 != word1 || word1 != MAGIC) {
 		printk(KERN_DEBUG
-		       "GRU quicktest0 err: found 0x%lx, expected 0x%lx\n",
-		     word1, MAGIC);
+		       "GRU:%d quicktest0 err: found 0x%lx, expected 0x%lx\n",
+		     smp_processor_id(), word1, MAGIC);
 		goto done;
 	}
 	ret = 0;
@@ -952,8 +1017,11 @@ static int quicktest1(unsigned long arg)
 		if (ret)
 			break;
 	}
-	if (ret != MQE_QUEUE_FULL || i != 4)
+	if (ret != MQE_QUEUE_FULL || i != 4) {
+		printk(KERN_DEBUG "GRU:%d quicktest1: unexpect status %d, i %d\n",
+		       smp_processor_id(), ret, i);
 		goto done;
+	}
 
 	for (i = 0; i < 6; i++) {
 		m = gru_get_next_message(&mqd);
@@ -961,7 +1029,12 @@ static int quicktest1(unsigned long arg)
 			break;
 		gru_free_message(&mqd, m);
 	}
-	ret = (i == 4) ? 0 : -EIO;
+	if (i != 4) {
+		printk(KERN_DEBUG "GRU:%d quicktest2: bad message, i %d, m %p, m8 %d\n",
+			smp_processor_id(), i, m, m ? m[8] : -1);
+		goto done;
+	}
+	ret = 0;
 
 done:
 	kfree(p);
@@ -977,6 +1050,7 @@ static int quicktest2(unsigned long arg)
 	int ret = 0;
 	unsigned long *buf;
 	void *cb0, *cb;
+	struct gru_control_block_status *gen;
 	int i, k, istatus, bytes;
 
 	bytes = numcb * 4 * 8;
@@ -996,20 +1070,30 @@ static int quicktest2(unsigned long arg)
 				XTYPE_DW, 4, 1, IMA_INTERRUPT);
 
 	ret = 0;
-	for (k = 0; k < numcb; k++) {
+	k = numcb;
+	do {
 		gru_wait_async_cbr(han);
 		for (i = 0; i < numcb; i++) {
 			cb = cb0 + i * GRU_HANDLE_STRIDE;
 			istatus = gru_check_status(cb);
-			if (istatus == CBS_ACTIVE)
-				continue;
-			if (istatus == CBS_EXCEPTION)
-				ret = -EFAULT;
-			else if (buf[i] || buf[i + 1] || buf[i + 2] ||
-					buf[i + 3])
-				ret = -EIO;
+			if (istatus != CBS_ACTIVE && istatus != CBS_CALL_OS)
+				break;
 		}
-	}
+		if (i == numcb)
+			continue;
+		if (istatus != CBS_IDLE) {
+			printk(KERN_DEBUG "GRU:%d quicktest2: cb %d, exception\n", smp_processor_id(), i);
+			ret = -EFAULT;
+		} else if (buf[4 * i] || buf[4 * i + 1] || buf[4 * i + 2] ||
+				buf[4 * i + 3]) {
+			printk(KERN_DEBUG "GRU:%d quicktest2:cb %d,  buf 0x%lx, 0x%lx, 0x%lx, 0x%lx\n",
+			       smp_processor_id(), i, buf[4 * i], buf[4 * i + 1], buf[4 * i + 2], buf[4 * i + 3]);
+			ret = -EIO;
+		}
+		k--;
+		gen = cb;
+		gen->istatus = CBS_CALL_OS; /* don't handle this CBR again */
+	} while (k);
 	BUG_ON(cmp.done);
 
 	gru_unlock_async_resource(han);
@@ -1019,6 +1103,22 @@ done:
 	return ret;
 }
 
+#define BUFSIZE 200
+static int quicktest3(unsigned long arg)
+{
+	char buf1[BUFSIZE], buf2[BUFSIZE];
+	int ret = 0;
+
+	memset(buf2, 0, sizeof(buf2));
+	memset(buf1, get_cycles() & 255, sizeof(buf1));
+	gru_copy_gpa(uv_gpa(buf2), uv_gpa(buf1), BUFSIZE);
+	if (memcmp(buf1, buf2, BUFSIZE)) {
+		printk(KERN_DEBUG "GRU:%d quicktest3 error\n", smp_processor_id());
+		ret = -EIO;
+	}
+	return ret;
+}
+
 /*
  * Debugging only. User hook for various kernel tests
  * of driver & gru.
@@ -1037,6 +1137,9 @@ int gru_ktest(unsigned long arg)
 	case 2:
 		ret = quicktest2(arg);
 		break;
+	case 3:
+		ret = quicktest3(arg);
+		break;
 	case 99:
 		ret = gru_free_kernel_contexts();
 		break;
diff --git a/drivers/misc/sgi-gru/grukservices.h b/drivers/misc/sgi-gru/grukservices.h
index d60d34bca44d..02aa94d8484a 100644
--- a/drivers/misc/sgi-gru/grukservices.h
+++ b/drivers/misc/sgi-gru/grukservices.h
@@ -131,6 +131,20 @@ extern void *gru_get_next_message(struct gru_message_queue_desc *mqd);
 
 
 /*
+ * Read a GRU global GPA. Source can be located in a remote partition.
+ *
+ *    Input:
+ *    	value		memory address where MMR value is returned
+ *    	gpa		source numalink physical address of GPA
+ *
+ *    Output:
+ *	0		OK
+ *	>0		error
+ */
+int gru_read_gpa(unsigned long *value, unsigned long gpa);
+
+
+/*
  * Copy data using the GRU. Source or destination can be located in a remote
  * partition.
  *
diff --git a/drivers/misc/sgi-gru/grulib.h b/drivers/misc/sgi-gru/grulib.h
index 889bc442a3e8..e77d1b1f9d05 100644
--- a/drivers/misc/sgi-gru/grulib.h
+++ b/drivers/misc/sgi-gru/grulib.h
@@ -63,18 +63,9 @@
 #define THREAD_POINTER(p, th)		(p + GRU_GSEG_PAGESIZE * (th))
 #define GSEG_START(cb)			((void *)((unsigned long)(cb) & ~(GRU_GSEG_PAGESIZE - 1)))
 
-/*
- * Statictics kept on a per-GTS basis.
- */
-struct gts_statistics {
-	unsigned long	fmm_tlbdropin;
-	unsigned long	upm_tlbdropin;
-	unsigned long	context_stolen;
-};
-
 struct gru_get_gseg_statistics_req {
-	unsigned long		gseg;
-	struct gts_statistics	stats;
+	unsigned long			gseg;
+	struct gru_gseg_statistics	stats;
 };
 
 /*
@@ -86,6 +77,7 @@ struct gru_create_context_req {
 	unsigned int		control_blocks;
 	unsigned int		maximum_thread_count;
 	unsigned int		options;
+	unsigned char		tlb_preload_count;
 };
 
 /*
@@ -98,11 +90,12 @@ struct gru_unload_context_req {
 /*
  * Structure used to set context options
  */
-enum {sco_gseg_owner, sco_cch_req_slice};
+enum {sco_gseg_owner, sco_cch_req_slice, sco_blade_chiplet};
 struct gru_set_context_option_req {
 	unsigned long	gseg;
 	int		op;
-	unsigned long	val1;
+	int		val0;
+	long		val1;
 };
 
 /*
@@ -124,6 +117,8 @@ struct gru_dump_chiplet_state_req {
 	int		ctxnum;
 	char		data_opt;
 	char		lock_cch;
+	char		flush_cbrs;
+	char		fill[10];
 	pid_t		pid;
 	void		*buf;
 	size_t		buflen;
diff --git a/drivers/misc/sgi-gru/grumain.c b/drivers/misc/sgi-gru/grumain.c
index 3bc643dad606..f8538bbd0bfa 100644
--- a/drivers/misc/sgi-gru/grumain.c
+++ b/drivers/misc/sgi-gru/grumain.c
@@ -27,6 +27,7 @@
 #include <linux/sched.h>
 #include <linux/device.h>
 #include <linux/list.h>
+#include <linux/err.h>
 #include <asm/uv/uv_hub.h>
 #include "gru.h"
 #include "grutables.h"
@@ -48,12 +49,20 @@ struct device *grudev = &gru_device;
 /*
  * Select a gru fault map to be used by the current cpu. Note that
  * multiple cpus may be using the same map.
- *	ZZZ should "shift" be used?? Depends on HT cpu numbering
  *	ZZZ should be inline but did not work on emulator
  */
 int gru_cpu_fault_map_id(void)
 {
+#ifdef CONFIG_IA64
 	return uv_blade_processor_id() % GRU_NUM_TFM;
+#else
+	int cpu = smp_processor_id();
+	int id, core;
+
+	core = uv_cpu_core_number(cpu);
+	id = core + UV_MAX_INT_CORES * uv_cpu_socket_number(cpu);
+	return id;
+#endif
 }
 
 /*--------- ASID Management -------------------------------------------
@@ -286,7 +295,8 @@ static void gru_unload_mm_tracker(struct gru_state *gru,
 void gts_drop(struct gru_thread_state *gts)
 {
 	if (gts && atomic_dec_return(&gts->ts_refcnt) == 0) {
-		gru_drop_mmu_notifier(gts->ts_gms);
+		if (gts->ts_gms)
+			gru_drop_mmu_notifier(gts->ts_gms);
 		kfree(gts);
 		STAT(gts_free);
 	}
@@ -310,16 +320,18 @@ static struct gru_thread_state *gru_find_current_gts_nolock(struct gru_vma_data
  * Allocate a thread state structure.
  */
 struct gru_thread_state *gru_alloc_gts(struct vm_area_struct *vma,
-		int cbr_au_count, int dsr_au_count, int options, int tsid)
+		int cbr_au_count, int dsr_au_count,
+		unsigned char tlb_preload_count, int options, int tsid)
 {
 	struct gru_thread_state *gts;
+	struct gru_mm_struct *gms;
 	int bytes;
 
 	bytes = DSR_BYTES(dsr_au_count) + CBR_BYTES(cbr_au_count);
 	bytes += sizeof(struct gru_thread_state);
 	gts = kmalloc(bytes, GFP_KERNEL);
 	if (!gts)
-		return NULL;
+		return ERR_PTR(-ENOMEM);
 
 	STAT(gts_alloc);
 	memset(gts, 0, sizeof(struct gru_thread_state)); /* zero out header */
@@ -327,7 +339,10 @@ struct gru_thread_state *gru_alloc_gts(struct vm_area_struct *vma,
 	mutex_init(&gts->ts_ctxlock);
 	gts->ts_cbr_au_count = cbr_au_count;
 	gts->ts_dsr_au_count = dsr_au_count;
+	gts->ts_tlb_preload_count = tlb_preload_count;
 	gts->ts_user_options = options;
+	gts->ts_user_blade_id = -1;
+	gts->ts_user_chiplet_id = -1;
 	gts->ts_tsid = tsid;
 	gts->ts_ctxnum = NULLCTX;
 	gts->ts_tlb_int_select = -1;
@@ -336,9 +351,10 @@ struct gru_thread_state *gru_alloc_gts(struct vm_area_struct *vma,
 	if (vma) {
 		gts->ts_mm = current->mm;
 		gts->ts_vma = vma;
-		gts->ts_gms = gru_register_mmu_notifier();
-		if (!gts->ts_gms)
+		gms = gru_register_mmu_notifier();
+		if (IS_ERR(gms))
 			goto err;
+		gts->ts_gms = gms;
 	}
 
 	gru_dbg(grudev, "alloc gts %p\n", gts);
@@ -346,7 +362,7 @@ struct gru_thread_state *gru_alloc_gts(struct vm_area_struct *vma,
 
 err:
 	gts_drop(gts);
-	return NULL;
+	return ERR_CAST(gms);
 }
 
 /*
@@ -360,6 +376,7 @@ struct gru_vma_data *gru_alloc_vma_data(struct vm_area_struct *vma, int tsid)
 	if (!vdata)
 		return NULL;
 
+	STAT(vdata_alloc);
 	INIT_LIST_HEAD(&vdata->vd_head);
 	spin_lock_init(&vdata->vd_lock);
 	gru_dbg(grudev, "alloc vdata %p\n", vdata);
@@ -392,10 +409,12 @@ struct gru_thread_state *gru_alloc_thread_state(struct vm_area_struct *vma,
 	struct gru_vma_data *vdata = vma->vm_private_data;
 	struct gru_thread_state *gts, *ngts;
 
-	gts = gru_alloc_gts(vma, vdata->vd_cbr_au_count, vdata->vd_dsr_au_count,
+	gts = gru_alloc_gts(vma, vdata->vd_cbr_au_count,
+			    vdata->vd_dsr_au_count,
+			    vdata->vd_tlb_preload_count,
 			    vdata->vd_user_options, tsid);
-	if (!gts)
-		return NULL;
+	if (IS_ERR(gts))
+		return gts;
 
 	spin_lock(&vdata->vd_lock);
 	ngts = gru_find_current_gts_nolock(vdata, tsid);
@@ -493,6 +512,9 @@ static void gru_load_context_data(void *save, void *grubase, int ctxnum,
 			memset(cbe + i * GRU_HANDLE_STRIDE, 0,
 						GRU_CACHE_LINE_BYTES);
 		}
+		/* Flush CBE to hide race in context restart */
+		mb();
+		gru_flush_cache(cbe + i * GRU_HANDLE_STRIDE);
 		cb += GRU_HANDLE_STRIDE;
 	}
 
@@ -513,6 +535,12 @@ static void gru_unload_context_data(void *save, void *grubase, int ctxnum,
 	cb = gseg + GRU_CB_BASE;
 	cbe = grubase + GRU_CBE_BASE;
 	length = hweight64(dsrmap) * GRU_DSR_AU_BYTES;
+
+	/* CBEs may not be coherent. Flush them from cache */
+	for_each_cbr_in_allocation_map(i, &cbrmap, scr)
+		gru_flush_cache(cbe + i * GRU_HANDLE_STRIDE);
+	mb();		/* Let the CL flush complete */
+
 	gru_prefetch_context(gseg, cb, cbe, cbrmap, length);
 
 	for_each_cbr_in_allocation_map(i, &cbrmap, scr) {
@@ -533,7 +561,8 @@ void gru_unload_context(struct gru_thread_state *gts, int savestate)
 		zap_vma_ptes(gts->ts_vma, UGRUADDR(gts), GRU_GSEG_PAGESIZE);
 	cch = get_cch(gru->gs_gru_base_vaddr, ctxnum);
 
-	gru_dbg(grudev, "gts %p\n", gts);
+	gru_dbg(grudev, "gts %p, cbrmap 0x%lx, dsrmap 0x%lx\n",
+		gts, gts->ts_cbr_map, gts->ts_dsr_map);
 	lock_cch_handle(cch);
 	if (cch_interrupt_sync(cch))
 		BUG();
@@ -549,7 +578,6 @@ void gru_unload_context(struct gru_thread_state *gts, int savestate)
 
 	if (cch_deallocate(cch))
 		BUG();
-	gts->ts_force_unload = 0;	/* ts_force_unload locked by CCH lock */
 	unlock_cch_handle(cch);
 
 	gru_free_gru_context(gts);
@@ -565,9 +593,7 @@ void gru_load_context(struct gru_thread_state *gts)
 	struct gru_context_configuration_handle *cch;
 	int i, err, asid, ctxnum = gts->ts_ctxnum;
 
-	gru_dbg(grudev, "gts %p\n", gts);
 	cch = get_cch(gru->gs_gru_base_vaddr, ctxnum);
-
 	lock_cch_handle(cch);
 	cch->tfm_fault_bit_enable =
 	    (gts->ts_user_options == GRU_OPT_MISS_FMM_POLL
@@ -591,6 +617,7 @@ void gru_load_context(struct gru_thread_state *gts)
 		cch->unmap_enable = 1;
 		cch->tfm_done_bit_enable = 1;
 		cch->cb_int_enable = 1;
+		cch->tlb_int_select = 0;	/* For now, ints go to cpu 0 */
 	} else {
 		cch->unmap_enable = 0;
 		cch->tfm_done_bit_enable = 0;
@@ -616,17 +643,18 @@ void gru_load_context(struct gru_thread_state *gts)
 	if (cch_start(cch))
 		BUG();
 	unlock_cch_handle(cch);
+
+	gru_dbg(grudev, "gid %d, gts %p, cbrmap 0x%lx, dsrmap 0x%lx, tie %d, tis %d\n",
+		gts->ts_gru->gs_gid, gts, gts->ts_cbr_map, gts->ts_dsr_map,
+		(gts->ts_user_options == GRU_OPT_MISS_FMM_INTR), gts->ts_tlb_int_select);
 }
 
 /*
  * Update fields in an active CCH:
  * 	- retarget interrupts on local blade
  * 	- update sizeavail mask
- * 	- force a delayed context unload by clearing the CCH asids. This
- * 	  forces TLB misses for new GRU instructions. The context is unloaded
- * 	  when the next TLB miss occurs.
  */
-int gru_update_cch(struct gru_thread_state *gts, int force_unload)
+int gru_update_cch(struct gru_thread_state *gts)
 {
 	struct gru_context_configuration_handle *cch;
 	struct gru_state *gru = gts->ts_gru;
@@ -640,21 +668,13 @@ int gru_update_cch(struct gru_thread_state *gts, int force_unload)
 			goto exit;
 		if (cch_interrupt(cch))
 			BUG();
-		if (!force_unload) {
-			for (i = 0; i < 8; i++)
-				cch->sizeavail[i] = gts->ts_sizeavail;
-			gts->ts_tlb_int_select = gru_cpu_fault_map_id();
-			cch->tlb_int_select = gru_cpu_fault_map_id();
-			cch->tfm_fault_bit_enable =
-			  (gts->ts_user_options == GRU_OPT_MISS_FMM_POLL
-			    || gts->ts_user_options == GRU_OPT_MISS_FMM_INTR);
-		} else {
-			for (i = 0; i < 8; i++)
-				cch->asid[i] = 0;
-			cch->tfm_fault_bit_enable = 0;
-			cch->tlb_int_enable = 0;
-			gts->ts_force_unload = 1;
-		}
+		for (i = 0; i < 8; i++)
+			cch->sizeavail[i] = gts->ts_sizeavail;
+		gts->ts_tlb_int_select = gru_cpu_fault_map_id();
+		cch->tlb_int_select = gru_cpu_fault_map_id();
+		cch->tfm_fault_bit_enable =
+		  (gts->ts_user_options == GRU_OPT_MISS_FMM_POLL
+		    || gts->ts_user_options == GRU_OPT_MISS_FMM_INTR);
 		if (cch_start(cch))
 			BUG();
 		ret = 1;
@@ -679,7 +699,54 @@ static int gru_retarget_intr(struct gru_thread_state *gts)
 
 	gru_dbg(grudev, "retarget from %d to %d\n", gts->ts_tlb_int_select,
 		gru_cpu_fault_map_id());
-	return gru_update_cch(gts, 0);
+	return gru_update_cch(gts);
+}
+
+/*
+ * Check if a GRU context is allowed to use a specific chiplet. By default
+ * a context is assigned to any blade-local chiplet. However, users can
+ * override this.
+ * 	Returns 1 if assignment allowed, 0 otherwise
+ */
+static int gru_check_chiplet_assignment(struct gru_state *gru,
+					struct gru_thread_state *gts)
+{
+	int blade_id;
+	int chiplet_id;
+
+	blade_id = gts->ts_user_blade_id;
+	if (blade_id < 0)
+		blade_id = uv_numa_blade_id();
+
+	chiplet_id = gts->ts_user_chiplet_id;
+	return gru->gs_blade_id == blade_id &&
+		(chiplet_id < 0 || chiplet_id == gru->gs_chiplet_id);
+}
+
+/*
+ * Unload the gru context if it is not assigned to the correct blade or
+ * chiplet. Misassignment can occur if the process migrates to a different
+ * blade or if the user changes the selected blade/chiplet.
+ */
+void gru_check_context_placement(struct gru_thread_state *gts)
+{
+	struct gru_state *gru;
+
+	/*
+	 * If the current task is the context owner, verify that the
+	 * context is correctly placed. This test is skipped for non-owner
+	 * references. Pthread apps use non-owner references to the CBRs.
+	 */
+	gru = gts->ts_gru;
+	if (!gru || gts->ts_tgid_owner != current->tgid)
+		return;
+
+	if (!gru_check_chiplet_assignment(gru, gts)) {
+		STAT(check_context_unload);
+		gru_unload_context(gts, 1);
+	} else if (gru_retarget_intr(gts)) {
+		STAT(check_context_retarget_intr);
+	}
 }
 
 
@@ -712,13 +779,17 @@ static void gts_stolen(struct gru_thread_state *gts,
 	}
 }
 
-void gru_steal_context(struct gru_thread_state *gts, int blade_id)
+void gru_steal_context(struct gru_thread_state *gts)
 {
 	struct gru_blade_state *blade;
 	struct gru_state *gru, *gru0;
 	struct gru_thread_state *ngts = NULL;
 	int ctxnum, ctxnum0, flag = 0, cbr, dsr;
+	int blade_id;
 
+	blade_id = gts->ts_user_blade_id;
+	if (blade_id < 0)
+		blade_id = uv_numa_blade_id();
 	cbr = gts->ts_cbr_au_count;
 	dsr = gts->ts_dsr_au_count;
 
@@ -729,35 +800,39 @@ void gru_steal_context(struct gru_thread_state *gts, int blade_id)
 	gru = blade->bs_lru_gru;
 	if (ctxnum == 0)
 		gru = next_gru(blade, gru);
+	blade->bs_lru_gru = gru;
+	blade->bs_lru_ctxnum = ctxnum;
 	ctxnum0 = ctxnum;
 	gru0 = gru;
 	while (1) {
-		if (check_gru_resources(gru, cbr, dsr, GRU_NUM_CCH))
-			break;
-		spin_lock(&gru->gs_lock);
-		for (; ctxnum < GRU_NUM_CCH; ctxnum++) {
-			if (flag && gru == gru0 && ctxnum == ctxnum0)
+		if (gru_check_chiplet_assignment(gru, gts)) {
+			if (check_gru_resources(gru, cbr, dsr, GRU_NUM_CCH))
 				break;
-			ngts = gru->gs_gts[ctxnum];
-			/*
-			 * We are grabbing locks out of order, so trylock is
-			 * needed. GTSs are usually not locked, so the odds of
-			 * success are high. If trylock fails, try to steal a
-			 * different GSEG.
-			 */
-			if (ngts && is_gts_stealable(ngts, blade))
+			spin_lock(&gru->gs_lock);
+			for (; ctxnum < GRU_NUM_CCH; ctxnum++) {
+				if (flag && gru == gru0 && ctxnum == ctxnum0)
+					break;
+				ngts = gru->gs_gts[ctxnum];
+				/*
+			 	* We are grabbing locks out of order, so trylock is
+			 	* needed. GTSs are usually not locked, so the odds of
+			 	* success are high. If trylock fails, try to steal a
+			 	* different GSEG.
+			 	*/
+				if (ngts && is_gts_stealable(ngts, blade))
+					break;
+				ngts = NULL;
+			}
+			spin_unlock(&gru->gs_lock);
+			if (ngts || (flag && gru == gru0 && ctxnum == ctxnum0))
 				break;
-			ngts = NULL;
-			flag = 1;
 		}
-		spin_unlock(&gru->gs_lock);
-		if (ngts || (flag && gru == gru0 && ctxnum == ctxnum0))
+		if (flag && gru == gru0)
 			break;
+		flag = 1;
 		ctxnum = 0;
 		gru = next_gru(blade, gru);
 	}
-	blade->bs_lru_gru = gru;
-	blade->bs_lru_ctxnum = ctxnum;
 	spin_unlock(&blade->bs_lock);
 
 	if (ngts) {
@@ -776,19 +851,34 @@ void gru_steal_context(struct gru_thread_state *gts, int blade_id)
 }
 
 /*
+ * Assign a gru context.
+ */
+static int gru_assign_context_number(struct gru_state *gru)
+{
+	int ctxnum;
+
+	ctxnum = find_first_zero_bit(&gru->gs_context_map, GRU_NUM_CCH);
+	__set_bit(ctxnum, &gru->gs_context_map);
+	return ctxnum;
+}
+
+/*
  * Scan the GRUs on the local blade & assign a GRU context.
  */
-struct gru_state *gru_assign_gru_context(struct gru_thread_state *gts,
-						int blade)
+struct gru_state *gru_assign_gru_context(struct gru_thread_state *gts)
 {
 	struct gru_state *gru, *grux;
 	int i, max_active_contexts;
+	int blade_id = gts->ts_user_blade_id;
 
-
+	if (blade_id < 0)
+		blade_id = uv_numa_blade_id();
 again:
 	gru = NULL;
 	max_active_contexts = GRU_NUM_CCH;
-	for_each_gru_on_blade(grux, blade, i) {
+	for_each_gru_on_blade(grux, blade_id, i) {
+		if (!gru_check_chiplet_assignment(grux, gts))
+			continue;
 		if (check_gru_resources(grux, gts->ts_cbr_au_count,
 					gts->ts_dsr_au_count,
 					max_active_contexts)) {
@@ -809,12 +899,9 @@ again:
 		reserve_gru_resources(gru, gts);
 		gts->ts_gru = gru;
 		gts->ts_blade = gru->gs_blade_id;
-		gts->ts_ctxnum =
-		    find_first_zero_bit(&gru->gs_context_map, GRU_NUM_CCH);
-		BUG_ON(gts->ts_ctxnum == GRU_NUM_CCH);
+		gts->ts_ctxnum = gru_assign_context_number(gru);
 		atomic_inc(&gts->ts_refcnt);
 		gru->gs_gts[gts->ts_ctxnum] = gts;
-		__set_bit(gts->ts_ctxnum, &gru->gs_context_map);
 		spin_unlock(&gru->gs_lock);
 
 		STAT(assign_context);
@@ -842,7 +929,6 @@ int gru_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
 {
 	struct gru_thread_state *gts;
 	unsigned long paddr, vaddr;
-	int blade_id;
 
 	vaddr = (unsigned long)vmf->virtual_address;
 	gru_dbg(grudev, "vma %p, vaddr 0x%lx (0x%lx)\n",
@@ -857,28 +943,18 @@ int gru_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
 again:
 	mutex_lock(&gts->ts_ctxlock);
 	preempt_disable();
-	blade_id = uv_numa_blade_id();
 
-	if (gts->ts_gru) {
-		if (gts->ts_gru->gs_blade_id != blade_id) {
-			STAT(migrated_nopfn_unload);
-			gru_unload_context(gts, 1);
-		} else {
-			if (gru_retarget_intr(gts))
-				STAT(migrated_nopfn_retarget);
-		}
-	}
+	gru_check_context_placement(gts);
 
 	if (!gts->ts_gru) {
 		STAT(load_user_context);
-		if (!gru_assign_gru_context(gts, blade_id)) {
+		if (!gru_assign_gru_context(gts)) {
 			preempt_enable();
 			mutex_unlock(&gts->ts_ctxlock);
 			set_current_state(TASK_INTERRUPTIBLE);
 			schedule_timeout(GRU_ASSIGN_DELAY);  /* true hack ZZZ */
-			blade_id = uv_numa_blade_id();
 			if (gts->ts_steal_jiffies + GRU_STEAL_DELAY < jiffies)
-				gru_steal_context(gts, blade_id);
+				gru_steal_context(gts);
 			goto again;
 		}
 		gru_load_context(gts);
diff --git a/drivers/misc/sgi-gru/gruprocfs.c b/drivers/misc/sgi-gru/gruprocfs.c
index 3f2375c5ba5b..7768b87d995b 100644
--- a/drivers/misc/sgi-gru/gruprocfs.c
+++ b/drivers/misc/sgi-gru/gruprocfs.c
@@ -36,8 +36,7 @@ static void printstat_val(struct seq_file *s, atomic_long_t *v, char *id)
 {
 	unsigned long val = atomic_long_read(v);
 
-	if (val)
-		seq_printf(s, "%16lu %s\n", val, id);
+	seq_printf(s, "%16lu %s\n", val, id);
 }
 
 static int statistics_show(struct seq_file *s, void *p)
@@ -46,7 +45,8 @@ static int statistics_show(struct seq_file *s, void *p)
 	printstat(s, vdata_free);
 	printstat(s, gts_alloc);
 	printstat(s, gts_free);
-	printstat(s, vdata_double_alloc);
+	printstat(s, gms_alloc);
+	printstat(s, gms_free);
 	printstat(s, gts_double_allocate);
 	printstat(s, assign_context);
 	printstat(s, assign_context_failed);
@@ -59,28 +59,25 @@ static int statistics_show(struct seq_file *s, void *p)
 	printstat(s, steal_kernel_context);
 	printstat(s, steal_context_failed);
 	printstat(s, nopfn);
-	printstat(s, break_cow);
 	printstat(s, asid_new);
 	printstat(s, asid_next);
 	printstat(s, asid_wrap);
 	printstat(s, asid_reuse);
 	printstat(s, intr);
+	printstat(s, intr_cbr);
+	printstat(s, intr_tfh);
+	printstat(s, intr_spurious);
 	printstat(s, intr_mm_lock_failed);
 	printstat(s, call_os);
-	printstat(s, call_os_offnode_reference);
-	printstat(s, call_os_check_for_bug);
 	printstat(s, call_os_wait_queue);
 	printstat(s, user_flush_tlb);
 	printstat(s, user_unload_context);
 	printstat(s, user_exception);
 	printstat(s, set_context_option);
-	printstat(s, migrate_check);
-	printstat(s, migrated_retarget);
-	printstat(s, migrated_unload);
-	printstat(s, migrated_unload_delay);
-	printstat(s, migrated_nopfn_retarget);
-	printstat(s, migrated_nopfn_unload);
+	printstat(s, check_context_retarget_intr);
+	printstat(s, check_context_unload);
 	printstat(s, tlb_dropin);
+	printstat(s, tlb_preload_page);
 	printstat(s, tlb_dropin_fail_no_asid);
 	printstat(s, tlb_dropin_fail_upm);
 	printstat(s, tlb_dropin_fail_invalid);
@@ -88,16 +85,15 @@ static int statistics_show(struct seq_file *s, void *p)
 	printstat(s, tlb_dropin_fail_idle);
 	printstat(s, tlb_dropin_fail_fmm);
 	printstat(s, tlb_dropin_fail_no_exception);
-	printstat(s, tlb_dropin_fail_no_exception_war);
 	printstat(s, tfh_stale_on_fault);
 	printstat(s, mmu_invalidate_range);
 	printstat(s, mmu_invalidate_page);
-	printstat(s, mmu_clear_flush_young);
 	printstat(s, flush_tlb);
 	printstat(s, flush_tlb_gru);
 	printstat(s, flush_tlb_gru_tgh);
 	printstat(s, flush_tlb_gru_zero_asid);
 	printstat(s, copy_gpa);
+	printstat(s, read_gpa);
 	printstat(s, mesq_receive);
 	printstat(s, mesq_receive_none);
 	printstat(s, mesq_send);
@@ -108,7 +104,6 @@ static int statistics_show(struct seq_file *s, void *p)
 	printstat(s, mesq_send_qlimit_reached);
 	printstat(s, mesq_send_amo_nacked);
 	printstat(s, mesq_send_put_nacked);
-	printstat(s, mesq_qf_not_full);
 	printstat(s, mesq_qf_locked);
 	printstat(s, mesq_qf_noop_not_full);
 	printstat(s, mesq_qf_switch_head_failed);
@@ -118,6 +113,7 @@ static int statistics_show(struct seq_file *s, void *p)
 	printstat(s, mesq_noop_qlimit_reached);
 	printstat(s, mesq_noop_amo_nacked);
 	printstat(s, mesq_noop_put_nacked);
+	printstat(s, mesq_noop_page_overflow);
 	return 0;
 }
 
@@ -133,8 +129,10 @@ static int mcs_statistics_show(struct seq_file *s, void *p)
 	int op;
 	unsigned long total, count, max;
 	static char *id[] = {"cch_allocate", "cch_start", "cch_interrupt",
-		"cch_interrupt_sync", "cch_deallocate", "tgh_invalidate"};
+		"cch_interrupt_sync", "cch_deallocate", "tfh_write_only",
+		"tfh_write_restart", "tgh_invalidate"};
 
+	seq_printf(s, "%-20s%12s%12s%12s\n", "#id", "count", "aver-clks", "max-clks");
 	for (op = 0; op < mcsop_last; op++) {
 		count = atomic_long_read(&mcs_op_statistics[op].count);
 		total = atomic_long_read(&mcs_op_statistics[op].total);
@@ -154,6 +152,7 @@ static ssize_t mcs_statistics_write(struct file *file,
 
 static int options_show(struct seq_file *s, void *p)
 {
+	seq_printf(s, "#bitmask: 1=trace, 2=statistics\n");
 	seq_printf(s, "0x%lx\n", gru_options);
 	return 0;
 }
@@ -183,16 +182,17 @@ static int cch_seq_show(struct seq_file *file, void *data)
 	const char *mode[] = { "??", "UPM", "INTR", "OS_POLL" };
 
 	if (gid == 0)
-		seq_printf(file, "#%5s%5s%6s%9s%6s%8s%8s\n", "gid", "bid",
-			   "ctx#", "pid", "cbrs", "dsbytes", "mode");
+		seq_printf(file, "#%5s%5s%6s%7s%9s%6s%8s%8s\n", "gid", "bid",
+			   "ctx#", "asid", "pid", "cbrs", "dsbytes", "mode");
 	if (gru)
 		for (i = 0; i < GRU_NUM_CCH; i++) {
 			ts = gru->gs_gts[i];
 			if (!ts)
 				continue;
-			seq_printf(file, " %5d%5d%6d%9d%6d%8d%8s\n",
+			seq_printf(file, " %5d%5d%6d%7d%9d%6d%8d%8s\n",
 				   gru->gs_gid, gru->gs_blade_id, i,
-				   ts->ts_tgid_owner,
+				   is_kernel_context(ts) ? 0 : ts->ts_gms->ms_asids[gid].mt_asid,
+				   is_kernel_context(ts) ? 0 : ts->ts_tgid_owner,
 				   ts->ts_cbr_au_count * GRU_CBR_AU_SIZE,
 				   ts->ts_cbr_au_count * GRU_DSR_AU_BYTES,
 				   mode[ts->ts_user_options &
@@ -355,7 +355,7 @@ static void delete_proc_files(void)
 		for (p = proc_files; p->name; p++)
 			if (p->entry)
 				remove_proc_entry(p->name, proc_gru);
-		remove_proc_entry("gru", NULL);
+		remove_proc_entry("gru", proc_gru->parent);
 	}
 }
 
diff --git a/drivers/misc/sgi-gru/grutables.h b/drivers/misc/sgi-gru/grutables.h
index 46990bcfa536..02a77b8b8eef 100644
--- a/drivers/misc/sgi-gru/grutables.h
+++ b/drivers/misc/sgi-gru/grutables.h
@@ -161,7 +161,7 @@ extern unsigned int gru_max_gids;
 #define GRU_MAX_GRUS		(GRU_MAX_BLADES * GRU_CHIPLETS_PER_BLADE)
 
 #define GRU_DRIVER_ID_STR	"SGI GRU Device Driver"
-#define GRU_DRIVER_VERSION_STR	"0.80"
+#define GRU_DRIVER_VERSION_STR	"0.85"
 
 /*
  * GRU statistics.
@@ -171,7 +171,8 @@ struct gru_stats_s {
 	atomic_long_t vdata_free;
 	atomic_long_t gts_alloc;
 	atomic_long_t gts_free;
-	atomic_long_t vdata_double_alloc;
+	atomic_long_t gms_alloc;
+	atomic_long_t gms_free;
 	atomic_long_t gts_double_allocate;
 	atomic_long_t assign_context;
 	atomic_long_t assign_context_failed;
@@ -184,28 +185,25 @@ struct gru_stats_s {
 	atomic_long_t steal_kernel_context;
 	atomic_long_t steal_context_failed;
 	atomic_long_t nopfn;
-	atomic_long_t break_cow;
 	atomic_long_t asid_new;
 	atomic_long_t asid_next;
 	atomic_long_t asid_wrap;
 	atomic_long_t asid_reuse;
 	atomic_long_t intr;
+	atomic_long_t intr_cbr;
+	atomic_long_t intr_tfh;
+	atomic_long_t intr_spurious;
 	atomic_long_t intr_mm_lock_failed;
 	atomic_long_t call_os;
-	atomic_long_t call_os_offnode_reference;
-	atomic_long_t call_os_check_for_bug;
 	atomic_long_t call_os_wait_queue;
 	atomic_long_t user_flush_tlb;
 	atomic_long_t user_unload_context;
 	atomic_long_t user_exception;
 	atomic_long_t set_context_option;
-	atomic_long_t migrate_check;
-	atomic_long_t migrated_retarget;
-	atomic_long_t migrated_unload;
-	atomic_long_t migrated_unload_delay;
-	atomic_long_t migrated_nopfn_retarget;
-	atomic_long_t migrated_nopfn_unload;
+	atomic_long_t check_context_retarget_intr;
+	atomic_long_t check_context_unload;
 	atomic_long_t tlb_dropin;
+	atomic_long_t tlb_preload_page;
 	atomic_long_t tlb_dropin_fail_no_asid;
 	atomic_long_t tlb_dropin_fail_upm;
 	atomic_long_t tlb_dropin_fail_invalid;
@@ -213,17 +211,16 @@ struct gru_stats_s {
 	atomic_long_t tlb_dropin_fail_idle;
 	atomic_long_t tlb_dropin_fail_fmm;
 	atomic_long_t tlb_dropin_fail_no_exception;
-	atomic_long_t tlb_dropin_fail_no_exception_war;
 	atomic_long_t tfh_stale_on_fault;
 	atomic_long_t mmu_invalidate_range;
 	atomic_long_t mmu_invalidate_page;
-	atomic_long_t mmu_clear_flush_young;
 	atomic_long_t flush_tlb;
 	atomic_long_t flush_tlb_gru;
 	atomic_long_t flush_tlb_gru_tgh;
 	atomic_long_t flush_tlb_gru_zero_asid;
 
 	atomic_long_t copy_gpa;
+	atomic_long_t read_gpa;
 
 	atomic_long_t mesq_receive;
 	atomic_long_t mesq_receive_none;
@@ -235,7 +232,7 @@ struct gru_stats_s {
 	atomic_long_t mesq_send_qlimit_reached;
 	atomic_long_t mesq_send_amo_nacked;
 	atomic_long_t mesq_send_put_nacked;
-	atomic_long_t mesq_qf_not_full;
+	atomic_long_t mesq_page_overflow;
 	atomic_long_t mesq_qf_locked;
 	atomic_long_t mesq_qf_noop_not_full;
 	atomic_long_t mesq_qf_switch_head_failed;
@@ -245,11 +242,13 @@ struct gru_stats_s {
 	atomic_long_t mesq_noop_qlimit_reached;
 	atomic_long_t mesq_noop_amo_nacked;
 	atomic_long_t mesq_noop_put_nacked;
+	atomic_long_t mesq_noop_page_overflow;
 
 };
 
 enum mcs_op {cchop_allocate, cchop_start, cchop_interrupt, cchop_interrupt_sync,
-	cchop_deallocate, tghop_invalidate, mcsop_last};
+	cchop_deallocate, tfhop_write_only, tfhop_write_restart,
+	tghop_invalidate, mcsop_last};
 
 struct mcs_op_statistic {
 	atomic_long_t	count;
@@ -259,8 +258,8 @@ struct mcs_op_statistic {
 
 extern struct mcs_op_statistic mcs_op_statistics[mcsop_last];
 
-#define OPT_DPRINT	1
-#define OPT_STATS	2
+#define OPT_DPRINT		1
+#define OPT_STATS		2
 
 
 #define IRQ_GRU			110	/* Starting IRQ number for interrupts */
@@ -283,7 +282,7 @@ extern struct mcs_op_statistic mcs_op_statistics[mcsop_last];
 #define gru_dbg(dev, fmt, x...)						\
 	do {								\
 		if (gru_options & OPT_DPRINT)				\
-			dev_dbg(dev, "%s: " fmt, __func__, x);		\
+			printk(KERN_DEBUG "GRU:%d %s: " fmt, smp_processor_id(), __func__, x);\
 	} while (0)
 #else
 #define gru_dbg(x...)
@@ -297,13 +296,7 @@ extern struct mcs_op_statistic mcs_op_statistics[mcsop_last];
 #define ASID_INC	8	/* number of regions */
 
 /* Generate a GRU asid value from a GRU base asid & a virtual address. */
-#if defined CONFIG_IA64
 #define VADDR_HI_BIT		64
-#elif defined CONFIG_X86_64
-#define VADDR_HI_BIT		48
-#else
-#error "Unsupported architecture"
-#endif
 #define GRUREGION(addr)		((addr) >> (VADDR_HI_BIT - 3) & 3)
 #define GRUASID(asid, addr)	((asid) + GRUREGION(addr))
 
@@ -345,6 +338,7 @@ struct gru_vma_data {
 	long			vd_user_options;/* misc user option flags */
 	int			vd_cbr_au_count;
 	int			vd_dsr_au_count;
+	unsigned char		vd_tlb_preload_count;
 };
 
 /*
@@ -360,6 +354,7 @@ struct gru_thread_state {
 	struct gru_state	*ts_gru;	/* GRU where the context is
 						   loaded */
 	struct gru_mm_struct	*ts_gms;	/* asid & ioproc struct */
+	unsigned char		ts_tlb_preload_count; /* TLB preload pages */
 	unsigned long		ts_cbr_map;	/* map of allocated CBRs */
 	unsigned long		ts_dsr_map;	/* map of allocated DATA
 						   resources */
@@ -368,6 +363,8 @@ struct gru_thread_state {
 	long			ts_user_options;/* misc user option flags */
 	pid_t			ts_tgid_owner;	/* task that is using the
 						   context - for migration */
+	short			ts_user_blade_id;/* user selected blade */
+	char			ts_user_chiplet_id;/* user selected chiplet */
 	unsigned short		ts_sizeavail;	/* Pagesizes in use */
 	int			ts_tsid;	/* thread that owns the
 						   structure */
@@ -384,13 +381,11 @@ struct gru_thread_state {
 	char			ts_blade;	/* If >= 0, migrate context if
 						   ref from diferent blade */
 	char			ts_force_cch_reload;
-	char			ts_force_unload;/* force context to be unloaded
-						   after migration */
 	char			ts_cbr_idx[GRU_CBR_AU];/* CBR numbers of each
 							  allocated CB */
 	int			ts_data_valid;	/* Indicates if ts_gdata has
 						   valid data */
-	struct gts_statistics	ustats;		/* User statistics */
+	struct gru_gseg_statistics ustats;	/* User statistics */
 	unsigned long		ts_gdata[0];	/* save area for GRU data (CB,
 						   DS, CBE) */
 };
@@ -422,6 +417,7 @@ struct gru_state {
 							   gru segments (64) */
 	unsigned short		gs_gid;			/* unique GRU number */
 	unsigned short		gs_blade_id;		/* blade of GRU */
+	unsigned char		gs_chiplet_id;		/* blade chiplet of GRU */
 	unsigned char		gs_tgh_local_shift;	/* used to pick TGH for
 							   local flush */
 	unsigned char		gs_tgh_first_remote;	/* starting TGH# for
@@ -453,6 +449,7 @@ struct gru_state {
 							   in use */
 	struct gru_thread_state	*gs_gts[GRU_NUM_CCH];	/* GTS currently using
 							   the context */
+	int			gs_irq[GRU_NUM_TFM];	/* Interrupt irqs */
 };
 
 /*
@@ -619,6 +616,15 @@ static inline int is_kernel_context(struct gru_thread_state *gts)
 	return !gts->ts_mm;
 }
 
+/*
+ * The following are for Nehelem-EX. A more general scheme is needed for
+ * future processors.
+ */
+#define UV_MAX_INT_CORES		8
+#define uv_cpu_socket_number(p)		((cpu_physical_id(p) >> 5) & 1)
+#define uv_cpu_ht_number(p)		(cpu_physical_id(p) & 1)
+#define uv_cpu_core_number(p)		(((cpu_physical_id(p) >> 2) & 4) |	\
+					((cpu_physical_id(p) >> 1) & 3))
 /*-----------------------------------------------------------------------------
  * Function prototypes & externs
  */
@@ -633,24 +639,26 @@ extern struct gru_thread_state *gru_find_thread_state(struct vm_area_struct
 				*vma, int tsid);
 extern struct gru_thread_state *gru_alloc_thread_state(struct vm_area_struct
 				*vma, int tsid);
-extern struct gru_state *gru_assign_gru_context(struct gru_thread_state *gts,
-		int blade);
+extern struct gru_state *gru_assign_gru_context(struct gru_thread_state *gts);
 extern void gru_load_context(struct gru_thread_state *gts);
-extern void gru_steal_context(struct gru_thread_state *gts, int blade_id);
+extern void gru_steal_context(struct gru_thread_state *gts);
 extern void gru_unload_context(struct gru_thread_state *gts, int savestate);
-extern int gru_update_cch(struct gru_thread_state *gts, int force_unload);
+extern int gru_update_cch(struct gru_thread_state *gts);
 extern void gts_drop(struct gru_thread_state *gts);
 extern void gru_tgh_flush_init(struct gru_state *gru);
 extern int gru_kservices_init(void);
 extern void gru_kservices_exit(void);
+extern irqreturn_t gru0_intr(int irq, void *dev_id);
+extern irqreturn_t gru1_intr(int irq, void *dev_id);
+extern irqreturn_t gru_intr_mblade(int irq, void *dev_id);
 extern int gru_dump_chiplet_request(unsigned long arg);
 extern long gru_get_gseg_statistics(unsigned long arg);
-extern irqreturn_t gru_intr(int irq, void *dev_id);
 extern int gru_handle_user_call_os(unsigned long address);
 extern int gru_user_flush_tlb(unsigned long arg);
 extern int gru_user_unload_context(unsigned long arg);
 extern int gru_get_exception_detail(unsigned long arg);
 extern int gru_set_context_option(unsigned long address);
+extern void gru_check_context_placement(struct gru_thread_state *gts);
 extern int gru_cpu_fault_map_id(void);
 extern struct vm_area_struct *gru_find_vma(unsigned long vaddr);
 extern void gru_flush_all_tlb(struct gru_state *gru);
@@ -658,7 +666,8 @@ extern int gru_proc_init(void);
 extern void gru_proc_exit(void);
 
 extern struct gru_thread_state *gru_alloc_gts(struct vm_area_struct *vma,
-		int cbr_au_count, int dsr_au_count, int options, int tsid);
+		int cbr_au_count, int dsr_au_count,
+		unsigned char tlb_preload_count, int options, int tsid);
 extern unsigned long gru_reserve_cb_resources(struct gru_state *gru,
 		int cbr_au_count, char *cbmap);
 extern unsigned long gru_reserve_ds_resources(struct gru_state *gru,
diff --git a/drivers/misc/sgi-gru/grutlbpurge.c b/drivers/misc/sgi-gru/grutlbpurge.c
index 1d125091f5e7..240a6d361665 100644
--- a/drivers/misc/sgi-gru/grutlbpurge.c
+++ b/drivers/misc/sgi-gru/grutlbpurge.c
@@ -184,8 +184,8 @@ void gru_flush_tlb_range(struct gru_mm_struct *gms, unsigned long start,
 			STAT(flush_tlb_gru_tgh);
 			asid = GRUASID(asid, start);
 			gru_dbg(grudev,
-	"  FLUSH gruid %d, asid 0x%x, num %ld, cbmap 0x%x\n",
-				gid, asid, num, asids->mt_ctxbitmap);
+	"  FLUSH gruid %d, asid 0x%x, vaddr 0x%lx, vamask 0x%x, num %ld, cbmap 0x%x\n",
+			      gid, asid, start, grupagesize, num, asids->mt_ctxbitmap);
 			tgh = get_lock_tgh_handle(gru);
 			tgh_invalidate(tgh, start, ~0, asid, grupagesize, 0,
 				       num - 1, asids->mt_ctxbitmap);
@@ -299,6 +299,7 @@ struct gru_mm_struct *gru_register_mmu_notifier(void)
 {
 	struct gru_mm_struct *gms;
 	struct mmu_notifier *mn;
+	int err;
 
 	mn = mmu_find_ops(current->mm, &gru_mmuops);
 	if (mn) {
@@ -307,16 +308,22 @@ struct gru_mm_struct *gru_register_mmu_notifier(void)
 	} else {
 		gms = kzalloc(sizeof(*gms), GFP_KERNEL);
 		if (gms) {
+			STAT(gms_alloc);
 			spin_lock_init(&gms->ms_asid_lock);
 			gms->ms_notifier.ops = &gru_mmuops;
 			atomic_set(&gms->ms_refcnt, 1);
 			init_waitqueue_head(&gms->ms_wait_queue);
-			__mmu_notifier_register(&gms->ms_notifier, current->mm);
+			err = __mmu_notifier_register(&gms->ms_notifier, current->mm);
+			if (err)
+				goto error;
 		}
 	}
 	gru_dbg(grudev, "gms %p, refcnt %d\n", gms,
 		atomic_read(&gms->ms_refcnt));
 	return gms;
+error:
+	kfree(gms);
+	return ERR_PTR(err);
 }
 
 void gru_drop_mmu_notifier(struct gru_mm_struct *gms)
@@ -327,6 +334,7 @@ void gru_drop_mmu_notifier(struct gru_mm_struct *gms)
 		if (!gms->ms_released)
 			mmu_notifier_unregister(&gms->ms_notifier, current->mm);
 		kfree(gms);
+		STAT(gms_free);
 	}
 }
 
diff --git a/drivers/misc/sgi-xp/xp.h b/drivers/misc/sgi-xp/xp.h
index 2275126cb334..851b2f25ce0e 100644
--- a/drivers/misc/sgi-xp/xp.h
+++ b/drivers/misc/sgi-xp/xp.h
@@ -339,6 +339,7 @@ extern short xp_partition_id;
 extern u8 xp_region_size;
 
 extern unsigned long (*xp_pa) (void *);
+extern unsigned long (*xp_socket_pa) (unsigned long);
 extern enum xp_retval (*xp_remote_memcpy) (unsigned long, const unsigned long,
 		       size_t);
 extern int (*xp_cpu_to_nasid) (int);
diff --git a/drivers/misc/sgi-xp/xp_main.c b/drivers/misc/sgi-xp/xp_main.c
index 7896849b16dc..01be66d02ca8 100644
--- a/drivers/misc/sgi-xp/xp_main.c
+++ b/drivers/misc/sgi-xp/xp_main.c
@@ -44,6 +44,9 @@ EXPORT_SYMBOL_GPL(xp_region_size);
 unsigned long (*xp_pa) (void *addr);
 EXPORT_SYMBOL_GPL(xp_pa);
 
+unsigned long (*xp_socket_pa) (unsigned long gpa);
+EXPORT_SYMBOL_GPL(xp_socket_pa);
+
 enum xp_retval (*xp_remote_memcpy) (unsigned long dst_gpa,
 				    const unsigned long src_gpa, size_t len);
 EXPORT_SYMBOL_GPL(xp_remote_memcpy);
diff --git a/drivers/misc/sgi-xp/xp_sn2.c b/drivers/misc/sgi-xp/xp_sn2.c
index fb3ec9d735a9..d8e463f87241 100644
--- a/drivers/misc/sgi-xp/xp_sn2.c
+++ b/drivers/misc/sgi-xp/xp_sn2.c
@@ -84,6 +84,15 @@ xp_pa_sn2(void *addr)
 }
 
 /*
+ * Convert a global physical to a socket physical address.
+ */
+static unsigned long
+xp_socket_pa_sn2(unsigned long gpa)
+{
+	return gpa;
+}
+
+/*
  * Wrapper for bte_copy().
  *
  *	dst_pa - physical address of the destination of the transfer.
@@ -162,6 +171,7 @@ xp_init_sn2(void)
 	xp_region_size = sn_region_size;
 
 	xp_pa = xp_pa_sn2;
+	xp_socket_pa = xp_socket_pa_sn2;
 	xp_remote_memcpy = xp_remote_memcpy_sn2;
 	xp_cpu_to_nasid = xp_cpu_to_nasid_sn2;
 	xp_expand_memprotect = xp_expand_memprotect_sn2;
diff --git a/drivers/misc/sgi-xp/xp_uv.c b/drivers/misc/sgi-xp/xp_uv.c
index d238576b26fa..a0d093274dc0 100644
--- a/drivers/misc/sgi-xp/xp_uv.c
+++ b/drivers/misc/sgi-xp/xp_uv.c
@@ -32,12 +32,44 @@ xp_pa_uv(void *addr)
 	return uv_gpa(addr);
 }
 
+/*
+ * Convert a global physical to socket physical address.
+ */
+static unsigned long
+xp_socket_pa_uv(unsigned long gpa)
+{
+	return uv_gpa_to_soc_phys_ram(gpa);
+}
+
+static enum xp_retval
+xp_remote_mmr_read(unsigned long dst_gpa, const unsigned long src_gpa,
+		   size_t len)
+{
+	int ret;
+	unsigned long *dst_va = __va(uv_gpa_to_soc_phys_ram(dst_gpa));
+
+	BUG_ON(!uv_gpa_in_mmr_space(src_gpa));
+	BUG_ON(len != 8);
+
+	ret = gru_read_gpa(dst_va, src_gpa);
+	if (ret == 0)
+		return xpSuccess;
+
+	dev_err(xp, "gru_read_gpa() failed, dst_gpa=0x%016lx src_gpa=0x%016lx "
+		"len=%ld\n", dst_gpa, src_gpa, len);
+	return xpGruCopyError;
+}
+
+
 static enum xp_retval
 xp_remote_memcpy_uv(unsigned long dst_gpa, const unsigned long src_gpa,
 		    size_t len)
 {
 	int ret;
 
+	if (uv_gpa_in_mmr_space(src_gpa))
+		return xp_remote_mmr_read(dst_gpa, src_gpa, len);
+
 	ret = gru_copy_gpa(dst_gpa, src_gpa, len);
 	if (ret == 0)
 		return xpSuccess;
@@ -123,6 +155,7 @@ xp_init_uv(void)
 	xp_region_size = sn_region_size;
 
 	xp_pa = xp_pa_uv;
+	xp_socket_pa = xp_socket_pa_uv;
 	xp_remote_memcpy = xp_remote_memcpy_uv;
 	xp_cpu_to_nasid = xp_cpu_to_nasid_uv;
 	xp_expand_memprotect = xp_expand_memprotect_uv;
diff --git a/drivers/misc/sgi-xp/xpc_partition.c b/drivers/misc/sgi-xp/xpc_partition.c
index 65877bc5edaa..9a6268c89fdd 100644
--- a/drivers/misc/sgi-xp/xpc_partition.c
+++ b/drivers/misc/sgi-xp/xpc_partition.c
@@ -18,6 +18,7 @@
 #include <linux/device.h>
 #include <linux/hardirq.h>
 #include "xpc.h"
+#include <asm/uv/uv_hub.h>
 
 /* XPC is exiting flag */
 int xpc_exiting;
@@ -92,8 +93,12 @@ xpc_get_rsvd_page_pa(int nasid)
 			break;
 
 		/* !!! L1_CACHE_ALIGN() is only a sn2-bte_copy requirement */
-		if (L1_CACHE_ALIGN(len) > buf_len) {
-			kfree(buf_base);
+		if (is_shub())
+			len = L1_CACHE_ALIGN(len);
+
+		if (len > buf_len) {
+			if (buf_base != NULL)
+				kfree(buf_base);
 			buf_len = L1_CACHE_ALIGN(len);
 			buf = xpc_kmalloc_cacheline_aligned(buf_len, GFP_KERNEL,
 							    &buf_base);
@@ -105,7 +110,7 @@ xpc_get_rsvd_page_pa(int nasid)
 			}
 		}
 
-		ret = xp_remote_memcpy(xp_pa(buf), rp_pa, buf_len);
+		ret = xp_remote_memcpy(xp_pa(buf), rp_pa, len);
 		if (ret != xpSuccess) {
 			dev_dbg(xpc_part, "xp_remote_memcpy failed %d\n", ret);
 			break;
@@ -143,7 +148,7 @@ xpc_setup_rsvd_page(void)
 		dev_err(xpc_part, "SAL failed to locate the reserved page\n");
 		return -ESRCH;
 	}
-	rp = (struct xpc_rsvd_page *)__va(rp_pa);
+	rp = (struct xpc_rsvd_page *)__va(xp_socket_pa(rp_pa));
 
 	if (rp->SAL_version < 3) {
 		/* SAL_versions < 3 had a SAL_partid defined as a u8 */
diff --git a/drivers/misc/sgi-xp/xpc_uv.c b/drivers/misc/sgi-xp/xpc_uv.c
index b5bbe59f9c57..8725d5e8ab0c 100644
--- a/drivers/misc/sgi-xp/xpc_uv.c
+++ b/drivers/misc/sgi-xp/xpc_uv.c
@@ -157,22 +157,24 @@ xpc_gru_mq_watchlist_alloc_uv(struct xpc_gru_mq_uv *mq)
 {
 	int ret;
 
-#if defined CONFIG_X86_64
-	ret = uv_bios_mq_watchlist_alloc(mq->mmr_blade, uv_gpa(mq->address),
-					 mq->order, &mq->mmr_offset);
-	if (ret < 0) {
-		dev_err(xpc_part, "uv_bios_mq_watchlist_alloc() failed, "
-			"ret=%d\n", ret);
-		return ret;
-	}
-#elif defined CONFIG_IA64_GENERIC || defined CONFIG_IA64_SGI_UV
-	ret = sn_mq_watchlist_alloc(mq->mmr_blade, (void *)uv_gpa(mq->address),
+#if defined CONFIG_IA64_GENERIC || defined CONFIG_IA64_SGI_UV
+	int mmr_pnode = uv_blade_to_pnode(mq->mmr_blade);
+
+	ret = sn_mq_watchlist_alloc(mmr_pnode, (void *)uv_gpa(mq->address),
 				    mq->order, &mq->mmr_offset);
 	if (ret < 0) {
 		dev_err(xpc_part, "sn_mq_watchlist_alloc() failed, ret=%d\n",
 			ret);
 		return -EBUSY;
 	}
+#elif defined CONFIG_X86_64
+	ret = uv_bios_mq_watchlist_alloc(uv_gpa(mq->address),
+					 mq->order, &mq->mmr_offset);
+	if (ret < 0) {
+		dev_err(xpc_part, "uv_bios_mq_watchlist_alloc() failed, "
+			"ret=%d\n", ret);
+		return ret;
+	}
 #else
 	#error not a supported configuration
 #endif
@@ -185,12 +187,13 @@ static void
 xpc_gru_mq_watchlist_free_uv(struct xpc_gru_mq_uv *mq)
 {
 	int ret;
+	int mmr_pnode = uv_blade_to_pnode(mq->mmr_blade);
 
 #if defined CONFIG_X86_64
-	ret = uv_bios_mq_watchlist_free(mq->mmr_blade, mq->watchlist_num);
+	ret = uv_bios_mq_watchlist_free(mmr_pnode, mq->watchlist_num);
 	BUG_ON(ret != BIOS_STATUS_SUCCESS);
 #elif defined CONFIG_IA64_GENERIC || defined CONFIG_IA64_SGI_UV
-	ret = sn_mq_watchlist_free(mq->mmr_blade, mq->watchlist_num);
+	ret = sn_mq_watchlist_free(mmr_pnode, mq->watchlist_num);
 	BUG_ON(ret != SALRET_OK);
 #else
 	#error not a supported configuration
@@ -204,6 +207,7 @@ xpc_create_gru_mq_uv(unsigned int mq_size, int cpu, char *irq_name,
 	enum xp_retval xp_ret;
 	int ret;
 	int nid;
+	int nasid;
 	int pg_order;
 	struct page *page;
 	struct xpc_gru_mq_uv *mq;
@@ -259,9 +263,11 @@ xpc_create_gru_mq_uv(unsigned int mq_size, int cpu, char *irq_name,
 		goto out_5;
 	}
 
+	nasid = UV_PNODE_TO_NASID(uv_cpu_to_pnode(cpu));
+
 	mmr_value = (struct uv_IO_APIC_route_entry *)&mq->mmr_value;
 	ret = gru_create_message_queue(mq->gru_mq_desc, mq->address, mq_size,
-				       nid, mmr_value->vector, mmr_value->dest);
+				     nasid, mmr_value->vector, mmr_value->dest);
 	if (ret != 0) {
 		dev_err(xpc_part, "gru_create_message_queue() returned "
 			"error=%d\n", ret);
@@ -946,11 +952,13 @@ xpc_get_fifo_entry_uv(struct xpc_fifo_head_uv *head)
 		head->first = first->next;
 		if (head->first == NULL)
 			head->last = NULL;
+
+		head->n_entries--;
+		BUG_ON(head->n_entries < 0);
+
+		first->next = NULL;
 	}
-	head->n_entries--;
-	BUG_ON(head->n_entries < 0);
 	spin_unlock_irqrestore(&head->lock, irq_flags);
-	first->next = NULL;
 	return first;
 }
 
@@ -1019,7 +1027,8 @@ xpc_make_first_contact_uv(struct xpc_partition *part)
 	xpc_send_activate_IRQ_part_uv(part, &msg, sizeof(msg),
 				      XPC_ACTIVATE_MQ_MSG_SYNC_ACT_STATE_UV);
 
-	while (part->sn.uv.remote_act_state != XPC_P_AS_ACTIVATING) {
+	while (!((part->sn.uv.remote_act_state == XPC_P_AS_ACTIVATING) ||
+		 (part->sn.uv.remote_act_state == XPC_P_AS_ACTIVE))) {
 
 		dev_dbg(xpc_part, "waiting to make first contact with "
 			"partition %d\n", XPC_PARTID(part));
@@ -1422,7 +1431,6 @@ xpc_handle_notify_mq_msg_uv(struct xpc_partition *part,
 	msg_slot = ch_uv->recv_msg_slots +
 	    (msg->hdr.msg_slot_number % ch->remote_nentries) * ch->entry_size;
 
-	BUG_ON(msg->hdr.msg_slot_number != msg_slot->hdr.msg_slot_number);
 	BUG_ON(msg_slot->hdr.size != 0);
 
 	memcpy(msg_slot, msg, msg->hdr.size);
@@ -1646,8 +1654,6 @@ xpc_received_payload_uv(struct xpc_channel *ch, void *payload)
 			       sizeof(struct xpc_notify_mq_msghdr_uv));
 	if (ret != xpSuccess)
 		XPC_DEACTIVATE_PARTITION(&xpc_partitions[ch->partid], ret);
-
-	msg->hdr.msg_slot_number += ch->remote_nentries;
 }
 
 static struct xpc_arch_operations xpc_arch_ops_uv = {
diff --git a/drivers/misc/ti_dac7512.c b/drivers/misc/ti_dac7512.c
new file mode 100644
index 000000000000..d3f229a3a77e
--- /dev/null
+++ b/drivers/misc/ti_dac7512.c
@@ -0,0 +1,101 @@
+/*
+ *  dac7512.c - Linux kernel module for
+ * 	Texas Instruments DAC7512
+ *
+ *  Copyright (c) 2009 Daniel Mack <daniel@caiaq.de>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/spi/spi.h>
+
+#define DAC7512_DRV_NAME	"dac7512"
+#define DRIVER_VERSION		"1.0"
+
+static ssize_t dac7512_store_val(struct device *dev,
+				 struct device_attribute *attr,
+				 const char *buf, size_t count)
+{
+	struct spi_device *spi = to_spi_device(dev);
+	unsigned char tmp[2];
+	unsigned long val;
+
+	if (strict_strtoul(buf, 10, &val) < 0)
+		return -EINVAL;
+
+	tmp[0] = val >> 8;
+	tmp[1] = val & 0xff;
+	spi_write(spi, tmp, sizeof(tmp));
+	return count;
+}
+
+static DEVICE_ATTR(value, S_IWUSR, NULL, dac7512_store_val);
+
+static struct attribute *dac7512_attributes[] = {
+	&dev_attr_value.attr,
+	NULL
+};
+
+static const struct attribute_group dac7512_attr_group = {
+	.attrs = dac7512_attributes,
+};
+
+static int __devinit dac7512_probe(struct spi_device *spi)
+{
+	int ret;
+
+	spi->bits_per_word = 8;
+	spi->mode = SPI_MODE_0;
+	ret = spi_setup(spi);
+	if (ret < 0)
+		return ret;
+
+	return sysfs_create_group(&spi->dev.kobj, &dac7512_attr_group);
+}
+
+static int __devexit dac7512_remove(struct spi_device *spi)
+{
+	sysfs_remove_group(&spi->dev.kobj, &dac7512_attr_group);
+	return 0;
+}
+
+static struct spi_driver dac7512_driver = {
+	.driver = {
+		.name	= DAC7512_DRV_NAME,
+		.owner	= THIS_MODULE,
+	},
+	.probe	= dac7512_probe,
+	.remove	= __devexit_p(dac7512_remove),
+};
+
+static int __init dac7512_init(void)
+{
+	return spi_register_driver(&dac7512_driver);
+}
+
+static void __exit dac7512_exit(void)
+{
+	spi_unregister_driver(&dac7512_driver);
+}
+
+MODULE_AUTHOR("Daniel Mack <daniel@caiaq.de>");
+MODULE_DESCRIPTION("DAC7512 16-bit DAC");
+MODULE_LICENSE("GPL v2");
+MODULE_VERSION(DRIVER_VERSION);
+
+module_init(dac7512_init);
+module_exit(dac7512_exit);
diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
index 85f0e8cd875b..1f552c6e7579 100644
--- a/drivers/mmc/card/block.c
+++ b/drivers/mmc/card/block.c
@@ -85,7 +85,14 @@ static void mmc_blk_put(struct mmc_blk_data *md)
 	mutex_lock(&open_lock);
 	md->usage--;
 	if (md->usage == 0) {
+		int devmaj = MAJOR(disk_devt(md->disk));
 		int devidx = MINOR(disk_devt(md->disk)) >> MMC_SHIFT;
+
+		if (!devmaj)
+			devidx = md->disk->first_minor >> MMC_SHIFT;
+
+		blk_cleanup_queue(md->queue.queue);
+
 		__clear_bit(devidx, dev_use);
 
 		put_disk(md->disk);
@@ -613,6 +620,7 @@ static int mmc_blk_probe(struct mmc_card *card)
 	return 0;
 
  out:
+	mmc_cleanup_queue(&md->queue);
 	mmc_blk_put(md);
 
 	return err;
diff --git a/drivers/mmc/card/queue.c b/drivers/mmc/card/queue.c
index 49e582356c65..c5a7a855f4b1 100644
--- a/drivers/mmc/card/queue.c
+++ b/drivers/mmc/card/queue.c
@@ -90,9 +90,10 @@ static void mmc_request(struct request_queue *q)
 	struct request *req;
 
 	if (!mq) {
-		printk(KERN_ERR "MMC: killing requests for dead queue\n");
-		while ((req = blk_fetch_request(q)) != NULL)
+		while ((req = blk_fetch_request(q)) != NULL) {
+			req->cmd_flags |= REQ_QUIET;
 			__blk_end_request_all(req, -EIO);
+		}
 		return;
 	}
 
@@ -223,17 +224,18 @@ void mmc_cleanup_queue(struct mmc_queue *mq)
 	struct request_queue *q = mq->queue;
 	unsigned long flags;
 
-	/* Mark that we should start throwing out stragglers */
-	spin_lock_irqsave(q->queue_lock, flags);
-	q->queuedata = NULL;
-	spin_unlock_irqrestore(q->queue_lock, flags);
-
 	/* Make sure the queue isn't suspended, as that will deadlock */
 	mmc_queue_resume(mq);
 
 	/* Then terminate our worker thread */
 	kthread_stop(mq->thread);
 
+	/* Empty the queue */
+	spin_lock_irqsave(q->queue_lock, flags);
+	q->queuedata = NULL;
+	blk_start_queue(q);
+	spin_unlock_irqrestore(q->queue_lock, flags);
+
  	if (mq->bounce_sg)
  		kfree(mq->bounce_sg);
  	mq->bounce_sg = NULL;
@@ -245,8 +247,6 @@ void mmc_cleanup_queue(struct mmc_queue *mq)
 		kfree(mq->bounce_buf);
 	mq->bounce_buf = NULL;
 
-	blk_cleanup_queue(mq->queue);
-
 	mq->card = NULL;
 }
 EXPORT_SYMBOL(mmc_cleanup_queue);
diff --git a/drivers/mmc/card/sdio_uart.c b/drivers/mmc/card/sdio_uart.c
index 36a8d53ad2a2..f53755533e7e 100644
--- a/drivers/mmc/card/sdio_uart.c
+++ b/drivers/mmc/card/sdio_uart.c
@@ -29,6 +29,7 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
+#include <linux/sched.h>
 #include <linux/mutex.h>
 #include <linux/seq_file.h>
 #include <linux/serial_reg.h>
@@ -73,11 +74,10 @@ struct uart_icount {
 };
 
 struct sdio_uart_port {
+	struct tty_port		port;
 	struct kref		kref;
 	struct tty_struct	*tty;
 	unsigned int		index;
-	unsigned int		opened;
-	struct mutex		open_lock;
 	struct sdio_func	*func;
 	struct mutex		func_lock;
 	struct task_struct	*in_sdio_uart_irq;
@@ -87,6 +87,7 @@ struct sdio_uart_port {
 	struct uart_icount	icount;
 	unsigned int		uartclk;
 	unsigned int		mctrl;
+	unsigned int		rx_mctrl;
 	unsigned int		read_status_mask;
 	unsigned int		ignore_status_mask;
 	unsigned char		x_char;
@@ -102,7 +103,6 @@ static int sdio_uart_add_port(struct sdio_uart_port *port)
 	int index, ret = -EBUSY;
 
 	kref_init(&port->kref);
-	mutex_init(&port->open_lock);
 	mutex_init(&port->func_lock);
 	spin_lock_init(&port->write_lock);
 
@@ -151,6 +151,7 @@ static void sdio_uart_port_put(struct sdio_uart_port *port)
 static void sdio_uart_port_remove(struct sdio_uart_port *port)
 {
 	struct sdio_func *func;
+	struct tty_struct *tty;
 
 	BUG_ON(sdio_uart_table[port->index] != port);
 
@@ -165,15 +166,19 @@ static void sdio_uart_port_remove(struct sdio_uart_port *port)
 	 * give up on that port ASAP.
 	 * Beware: the lock ordering is critical.
 	 */
-	mutex_lock(&port->open_lock);
+	mutex_lock(&port->port.mutex);
 	mutex_lock(&port->func_lock);
 	func = port->func;
 	sdio_claim_host(func);
 	port->func = NULL;
 	mutex_unlock(&port->func_lock);
-	if (port->opened)
-		tty_hangup(port->tty);
-	mutex_unlock(&port->open_lock);
+	tty = tty_port_tty_get(&port->port);
+	/* tty_hangup is async so is this safe as is ?? */
+	if (tty) {
+		tty_hangup(tty);
+		tty_kref_put(tty);
+	}
+	mutex_unlock(&port->port.mutex);
 	sdio_release_irq(func);
 	sdio_disable_func(func);
 	sdio_release_host(func);
@@ -217,6 +222,8 @@ static unsigned int sdio_uart_get_mctrl(struct sdio_uart_port *port)
 	unsigned char status;
 	unsigned int ret;
 
+	/* FIXME: What stops this losing the delta bits and breaking
+	   sdio_uart_check_modem_status ? */
 	status = sdio_in(port, UART_MSR);
 
 	ret = 0;
@@ -231,7 +238,8 @@ static unsigned int sdio_uart_get_mctrl(struct sdio_uart_port *port)
 	return ret;
 }
 
-static void sdio_uart_write_mctrl(struct sdio_uart_port *port, unsigned int mctrl)
+static void sdio_uart_write_mctrl(struct sdio_uart_port *port,
+				  unsigned int mctrl)
 {
 	unsigned char mcr = 0;
 
@@ -387,9 +395,10 @@ static void sdio_uart_stop_rx(struct sdio_uart_port *port)
 	sdio_out(port, UART_IER, port->ier);
 }
 
-static void sdio_uart_receive_chars(struct sdio_uart_port *port, unsigned int *status)
+static void sdio_uart_receive_chars(struct sdio_uart_port *port,
+				    unsigned int *status)
 {
-	struct tty_struct *tty = port->tty;
+	struct tty_struct *tty = tty_port_tty_get(&port->port);
 	unsigned int ch, flag;
 	int max_count = 256;
 
@@ -399,7 +408,7 @@ static void sdio_uart_receive_chars(struct sdio_uart_port *port, unsigned int *s
 		port->icount.rx++;
 
 		if (unlikely(*status & (UART_LSR_BI | UART_LSR_PE |
-				        UART_LSR_FE | UART_LSR_OE))) {
+					UART_LSR_FE | UART_LSR_OE))) {
 			/*
 			 * For statistics only
 			 */
@@ -417,33 +426,39 @@ static void sdio_uart_receive_chars(struct sdio_uart_port *port, unsigned int *s
 			 * Mask off conditions which should be ignored.
 			 */
 			*status &= port->read_status_mask;
-			if (*status & UART_LSR_BI) {
+			if (*status & UART_LSR_BI)
 				flag = TTY_BREAK;
-			} else if (*status & UART_LSR_PE)
+			else if (*status & UART_LSR_PE)
 				flag = TTY_PARITY;
 			else if (*status & UART_LSR_FE)
 				flag = TTY_FRAME;
 		}
 
 		if ((*status & port->ignore_status_mask & ~UART_LSR_OE) == 0)
-			tty_insert_flip_char(tty, ch, flag);
+			if (tty)
+				tty_insert_flip_char(tty, ch, flag);
 
 		/*
 		 * Overrun is special.  Since it's reported immediately,
 		 * it doesn't affect the current character.
 		 */
 		if (*status & ~port->ignore_status_mask & UART_LSR_OE)
-			tty_insert_flip_char(tty, 0, TTY_OVERRUN);
+			if (tty)
+				tty_insert_flip_char(tty, 0, TTY_OVERRUN);
 
 		*status = sdio_in(port, UART_LSR);
 	} while ((*status & UART_LSR_DR) && (max_count-- > 0));
-	tty_flip_buffer_push(tty);
+	if (tty) {
+		tty_flip_buffer_push(tty);
+		tty_kref_put(tty);
+	}
 }
 
 static void sdio_uart_transmit_chars(struct sdio_uart_port *port)
 {
 	struct circ_buf *xmit = &port->xmit;
 	int count;
+	struct tty_struct *tty;
 
 	if (port->x_char) {
 		sdio_out(port, UART_TX, port->x_char);
@@ -451,8 +466,13 @@ static void sdio_uart_transmit_chars(struct sdio_uart_port *port)
 		port->x_char = 0;
 		return;
 	}
-	if (circ_empty(xmit) || port->tty->stopped || port->tty->hw_stopped) {
+
+	tty = tty_port_tty_get(&port->port);
+
+	if (tty == NULL || circ_empty(xmit) ||
+				tty->stopped || tty->hw_stopped) {
 		sdio_uart_stop_tx(port);
+		tty_kref_put(tty);
 		return;
 	}
 
@@ -466,15 +486,17 @@ static void sdio_uart_transmit_chars(struct sdio_uart_port *port)
 	} while (--count > 0);
 
 	if (circ_chars_pending(xmit) < WAKEUP_CHARS)
-		tty_wakeup(port->tty);
+		tty_wakeup(tty);
 
 	if (circ_empty(xmit))
 		sdio_uart_stop_tx(port);
+	tty_kref_put(tty);
 }
 
 static void sdio_uart_check_modem_status(struct sdio_uart_port *port)
 {
 	int status;
+	struct tty_struct *tty;
 
 	status = sdio_in(port, UART_MSR);
 
@@ -485,25 +507,39 @@ static void sdio_uart_check_modem_status(struct sdio_uart_port *port)
 		port->icount.rng++;
 	if (status & UART_MSR_DDSR)
 		port->icount.dsr++;
-	if (status & UART_MSR_DDCD)
+	if (status & UART_MSR_DDCD) {
 		port->icount.dcd++;
+		/* DCD raise - wake for open */
+		if (status & UART_MSR_DCD)
+			wake_up_interruptible(&port->port.open_wait);
+		else {
+			/* DCD drop - hang up if tty attached */
+			tty = tty_port_tty_get(&port->port);
+			if (tty) {
+				tty_hangup(tty);
+				tty_kref_put(tty);
+			}
+		}
+	}
 	if (status & UART_MSR_DCTS) {
 		port->icount.cts++;
-		if (port->tty->termios->c_cflag & CRTSCTS) {
+		tty = tty_port_tty_get(&port->port);
+		if (tty && (tty->termios->c_cflag & CRTSCTS)) {
 			int cts = (status & UART_MSR_CTS);
-			if (port->tty->hw_stopped) {
+			if (tty->hw_stopped) {
 				if (cts) {
-					port->tty->hw_stopped = 0;
+					tty->hw_stopped = 0;
 					sdio_uart_start_tx(port);
-					tty_wakeup(port->tty);
+					tty_wakeup(tty);
 				}
 			} else {
 				if (!cts) {
-					port->tty->hw_stopped = 1;
+					tty->hw_stopped = 1;
 					sdio_uart_stop_tx(port);
 				}
 			}
 		}
+		tty_kref_put(tty);
 	}
 }
 
@@ -540,8 +576,62 @@ static void sdio_uart_irq(struct sdio_func *func)
 	port->in_sdio_uart_irq = NULL;
 }
 
-static int sdio_uart_startup(struct sdio_uart_port *port)
+static int uart_carrier_raised(struct tty_port *tport)
+{
+	struct sdio_uart_port *port =
+			container_of(tport, struct sdio_uart_port, port);
+	unsigned int ret = sdio_uart_claim_func(port);
+	if (ret)	/* Missing hardware shoudn't block for carrier */
+		return 1;
+	ret = sdio_uart_get_mctrl(port);
+	sdio_uart_release_func(port);
+	if (ret & TIOCM_CAR)
+		return 1;
+	return 0;
+}
+
+/**
+ *	uart_dtr_rts		-	 port helper to set uart signals
+ *	@tport: tty port to be updated
+ *	@onoff: set to turn on DTR/RTS
+ *
+ *	Called by the tty port helpers when the modem signals need to be
+ *	adjusted during an open, close and hangup.
+ */
+
+static void uart_dtr_rts(struct tty_port *tport, int onoff)
 {
+	struct sdio_uart_port *port =
+			container_of(tport, struct sdio_uart_port, port);
+	int ret = sdio_uart_claim_func(port);
+	if (ret)
+		return;
+	if (onoff == 0)
+		sdio_uart_clear_mctrl(port, TIOCM_DTR | TIOCM_RTS);
+	else
+		sdio_uart_set_mctrl(port, TIOCM_DTR | TIOCM_RTS);
+	sdio_uart_release_func(port);
+}
+
+/**
+ *	sdio_uart_activate	-	start up hardware
+ *	@tport: tty port to activate
+ *	@tty: tty bound to this port
+ *
+ *	Activate a tty port. The port locking guarantees us this will be
+ *	run exactly once per set of opens, and if successful will see the
+ *	shutdown method run exactly once to match. Start up and shutdown are
+ *	protected from each other by the internal locking and will not run
+ *	at the same time even during a hangup event.
+ *
+ *	If we successfully start up the port we take an extra kref as we
+ *	will keep it around until shutdown when the kref is dropped.
+ */
+
+static int sdio_uart_activate(struct tty_port *tport, struct tty_struct *tty)
+{
+	struct sdio_uart_port *port =
+			container_of(tport, struct sdio_uart_port, port);
 	unsigned long page;
 	int ret;
 
@@ -549,7 +639,7 @@ static int sdio_uart_startup(struct sdio_uart_port *port)
 	 * Set the TTY IO error marker - we will only clear this
 	 * once we have successfully opened the port.
 	 */
-	set_bit(TTY_IO_ERROR, &port->tty->flags);
+	set_bit(TTY_IO_ERROR, &tty->flags);
 
 	/* Initialise and allocate the transmit buffer. */
 	page = __get_free_page(GFP_KERNEL);
@@ -574,7 +664,7 @@ static int sdio_uart_startup(struct sdio_uart_port *port)
 	 */
 	sdio_out(port, UART_FCR, UART_FCR_ENABLE_FIFO);
 	sdio_out(port, UART_FCR, UART_FCR_ENABLE_FIFO |
-			UART_FCR_CLEAR_RCVR | UART_FCR_CLEAR_XMIT);
+		       UART_FCR_CLEAR_RCVR | UART_FCR_CLEAR_XMIT);
 	sdio_out(port, UART_FCR, 0);
 
 	/*
@@ -590,19 +680,19 @@ static int sdio_uart_startup(struct sdio_uart_port *port)
 	 */
 	sdio_out(port, UART_LCR, UART_LCR_WLEN8);
 
-	port->ier = UART_IER_RLSI | UART_IER_RDI | UART_IER_RTOIE | UART_IER_UUE;
+	port->ier = UART_IER_RLSI|UART_IER_RDI|UART_IER_RTOIE|UART_IER_UUE;
 	port->mctrl = TIOCM_OUT2;
 
-	sdio_uart_change_speed(port, port->tty->termios, NULL);
+	sdio_uart_change_speed(port, tty->termios, NULL);
 
-	if (port->tty->termios->c_cflag & CBAUD)
+	if (tty->termios->c_cflag & CBAUD)
 		sdio_uart_set_mctrl(port, TIOCM_RTS | TIOCM_DTR);
 
-	if (port->tty->termios->c_cflag & CRTSCTS)
+	if (tty->termios->c_cflag & CRTSCTS)
 		if (!(sdio_uart_get_mctrl(port) & TIOCM_CTS))
-			port->tty->hw_stopped = 1;
+			tty->hw_stopped = 1;
 
-	clear_bit(TTY_IO_ERROR, &port->tty->flags);
+	clear_bit(TTY_IO_ERROR, &tty->flags);
 
 	/* Kick the IRQ handler once while we're still holding the host lock */
 	sdio_uart_irq(port->func);
@@ -619,8 +709,20 @@ err1:
 	return ret;
 }
 
-static void sdio_uart_shutdown(struct sdio_uart_port *port)
+/**
+ *	sdio_uart_shutdown	-	stop hardware
+ *	@tport: tty port to shut down
+ *
+ *	Deactivate a tty port. The port locking guarantees us this will be
+ *	run only if a successful matching activate already ran. The two are
+ *	protected from each other by the internal locking and will not run
+ *	at the same time even during a hangup event.
+ */
+
+static void sdio_uart_shutdown(struct tty_port *tport)
 {
+	struct sdio_uart_port *port =
+			container_of(tport, struct sdio_uart_port, port);
 	int ret;
 
 	ret = sdio_uart_claim_func(port);
@@ -629,13 +731,7 @@ static void sdio_uart_shutdown(struct sdio_uart_port *port)
 
 	sdio_uart_stop_rx(port);
 
-	/* TODO: wait here for TX FIFO to drain */
-
-	/* Turn off DTR and RTS early. */
-	if (port->tty->termios->c_cflag & HUPCL)
-		sdio_uart_clear_mctrl(port, TIOCM_DTR | TIOCM_RTS);
-
-	 /* Disable interrupts from this port */
+	/* Disable interrupts from this port */
 	sdio_release_irq(port->func);
 	port->ier = 0;
 	sdio_out(port, UART_IER, 0);
@@ -659,77 +755,70 @@ skip:
 	free_page((unsigned long)port->xmit.buf);
 }
 
-static int sdio_uart_open (struct tty_struct *tty, struct file * filp)
+/**
+ *	sdio_uart_install	-	install method
+ *	@driver: the driver in use (sdio_uart in our case)
+ *	@tty: the tty being bound
+ *
+ *	Look up and bind the tty and the driver together. Initialize
+ *	any needed private data (in our case the termios)
+ */
+
+static int sdio_uart_install(struct tty_driver *driver, struct tty_struct *tty)
 {
-	struct sdio_uart_port *port;
-	int ret;
+	int idx = tty->index;
+	struct sdio_uart_port *port = sdio_uart_port_get(idx);
+	int ret = tty_init_termios(tty);
+
+	if (ret == 0) {
+		tty_driver_kref_get(driver);
+		tty->count++;
+		/* This is the ref sdio_uart_port get provided */
+		tty->driver_data = port;
+		driver->ttys[idx] = tty;
+	} else
+		sdio_uart_port_put(port);
+	return ret;
+}
 
-	port = sdio_uart_port_get(tty->index);
-	if (!port)
-		return -ENODEV;
+/**
+ *	sdio_uart_cleanup	-	called on the last tty kref drop
+ *	@tty: the tty being destroyed
+ *
+ *	Called asynchronously when the last reference to the tty is dropped.
+ *	We cannot destroy the tty->driver_data port kref until this point
+ */
 
-	mutex_lock(&port->open_lock);
+static void sdio_uart_cleanup(struct tty_struct *tty)
+{
+	struct sdio_uart_port *port = tty->driver_data;
+	tty->driver_data = NULL;	/* Bug trap */
+	sdio_uart_port_put(port);
+}
 
-	/*
-	 * Make sure not to mess up with a dead port
-	 * which has not been closed yet.
-	 */
-	if (tty->driver_data && tty->driver_data != port) {
-		mutex_unlock(&port->open_lock);
-		sdio_uart_port_put(port);
-		return -EBUSY;
-	}
+/*
+ *	Open/close/hangup is now entirely boilerplate
+ */
 
-	if (!port->opened) {
-		tty->driver_data = port;
-		port->tty = tty;
-		ret = sdio_uart_startup(port);
-		if (ret) {
-			tty->driver_data = NULL;
-			port->tty = NULL;
-			mutex_unlock(&port->open_lock);
-			sdio_uart_port_put(port);
-			return ret;
-		}
-	}
-	port->opened++;
-	mutex_unlock(&port->open_lock);
-	return 0;
+static int sdio_uart_open(struct tty_struct *tty, struct file *filp)
+{
+	struct sdio_uart_port *port = tty->driver_data;
+	return tty_port_open(&port->port, tty, filp);
 }
 
 static void sdio_uart_close(struct tty_struct *tty, struct file * filp)
 {
 	struct sdio_uart_port *port = tty->driver_data;
+	tty_port_close(&port->port, tty, filp);
+}
 
-	if (!port)
-		return;
-
-	mutex_lock(&port->open_lock);
-	BUG_ON(!port->opened);
-
-	/*
-	 * This is messy.  The tty layer calls us even when open()
-	 * returned an error.  Ignore this close request if tty->count
-	 * is larger than port->count.
-	 */
-	if (tty->count > port->opened) {
-		mutex_unlock(&port->open_lock);
-		return;
-	}
-
-	if (--port->opened == 0) {
-		tty->closing = 1;
-		sdio_uart_shutdown(port);
-		tty_ldisc_flush(tty);
-		port->tty = NULL;
-		tty->driver_data = NULL;
-		tty->closing = 0;
-	}
-	mutex_unlock(&port->open_lock);
-	sdio_uart_port_put(port);
+static void sdio_uart_hangup(struct tty_struct *tty)
+{
+	struct sdio_uart_port *port = tty->driver_data;
+	tty_port_hangup(&port->port);
 }
 
-static int sdio_uart_write(struct tty_struct * tty, const unsigned char *buf,
+static int sdio_uart_write(struct tty_struct *tty, const unsigned char *buf,
 			   int count)
 {
 	struct sdio_uart_port *port = tty->driver_data;
@@ -754,7 +843,7 @@ static int sdio_uart_write(struct tty_struct * tty, const unsigned char *buf,
 	}
 	spin_unlock(&port->write_lock);
 
-	if ( !(port->ier & UART_IER_THRI)) {
+	if (!(port->ier & UART_IER_THRI)) {
 		int err = sdio_uart_claim_func(port);
 		if (!err) {
 			sdio_uart_start_tx(port);
@@ -841,17 +930,12 @@ static void sdio_uart_unthrottle(struct tty_struct *tty)
 	sdio_uart_release_func(port);
 }
 
-static void sdio_uart_set_termios(struct tty_struct *tty, struct ktermios *old_termios)
+static void sdio_uart_set_termios(struct tty_struct *tty,
+						struct ktermios *old_termios)
 {
 	struct sdio_uart_port *port = tty->driver_data;
 	unsigned int cflag = tty->termios->c_cflag;
 
-#define RELEVANT_IFLAG(iflag)   ((iflag) & (IGNBRK|BRKINT|IGNPAR|PARMRK|INPCK))
-
-	if ((cflag ^ old_termios->c_cflag) == 0 &&
-	    RELEVANT_IFLAG(tty->termios->c_iflag ^ old_termios->c_iflag) == 0)
-		return;
-
 	if (sdio_uart_claim_func(port) != 0)
 		return;
 
@@ -925,8 +1009,8 @@ static int sdio_uart_tiocmset(struct tty_struct *tty, struct file *file,
 	struct sdio_uart_port *port = tty->driver_data;
 	int result;
 
-	result =sdio_uart_claim_func(port);
-	if(!result) {
+	result = sdio_uart_claim_func(port);
+	if (!result) {
 		sdio_uart_update_mctrl(port, set, clear);
 		sdio_uart_release_func(port);
 	}
@@ -944,33 +1028,33 @@ static int sdio_uart_proc_show(struct seq_file *m, void *v)
 		struct sdio_uart_port *port = sdio_uart_port_get(i);
 		if (port) {
 			seq_printf(m, "%d: uart:SDIO", i);
-			if(capable(CAP_SYS_ADMIN)) {
+			if (capable(CAP_SYS_ADMIN)) {
 				seq_printf(m, " tx:%d rx:%d",
-					       port->icount.tx, port->icount.rx);
+					      port->icount.tx, port->icount.rx);
 				if (port->icount.frame)
 					seq_printf(m, " fe:%d",
-						       port->icount.frame);
+						      port->icount.frame);
 				if (port->icount.parity)
 					seq_printf(m, " pe:%d",
-						       port->icount.parity);
+						      port->icount.parity);
 				if (port->icount.brk)
 					seq_printf(m, " brk:%d",
-						       port->icount.brk);
+						      port->icount.brk);
 				if (port->icount.overrun)
 					seq_printf(m, " oe:%d",
-						       port->icount.overrun);
+						      port->icount.overrun);
 				if (port->icount.cts)
 					seq_printf(m, " cts:%d",
-						       port->icount.cts);
+						      port->icount.cts);
 				if (port->icount.dsr)
 					seq_printf(m, " dsr:%d",
-						       port->icount.dsr);
+						      port->icount.dsr);
 				if (port->icount.rng)
 					seq_printf(m, " rng:%d",
-						       port->icount.rng);
+						      port->icount.rng);
 				if (port->icount.dcd)
 					seq_printf(m, " dcd:%d",
-						       port->icount.dcd);
+						      port->icount.dcd);
 			}
 			sdio_uart_port_put(port);
 			seq_putc(m, '\n');
@@ -992,6 +1076,13 @@ static const struct file_operations sdio_uart_proc_fops = {
 	.release	= single_release,
 };
 
+static const struct tty_port_operations sdio_uart_port_ops = {
+	.dtr_rts = uart_dtr_rts,
+	.carrier_raised = uart_carrier_raised,
+	.shutdown = sdio_uart_shutdown,
+	.activate = sdio_uart_activate,
+};
+
 static const struct tty_operations sdio_uart_ops = {
 	.open			= sdio_uart_open,
 	.close			= sdio_uart_close,
@@ -1002,9 +1093,12 @@ static const struct tty_operations sdio_uart_ops = {
 	.throttle		= sdio_uart_throttle,
 	.unthrottle		= sdio_uart_unthrottle,
 	.set_termios		= sdio_uart_set_termios,
+	.hangup			= sdio_uart_hangup,
 	.break_ctl		= sdio_uart_break_ctl,
 	.tiocmget		= sdio_uart_tiocmget,
 	.tiocmset		= sdio_uart_tiocmset,
+	.install		= sdio_uart_install,
+	.cleanup		= sdio_uart_cleanup,
 	.proc_fops		= &sdio_uart_proc_fops,
 };
 
@@ -1041,7 +1135,7 @@ static int sdio_uart_probe(struct sdio_func *func,
 		}
 		if (!tpl) {
 			printk(KERN_WARNING
-			       "%s: can't find tuple 0x91 subtuple 0 (SUBTPL_SIOREG) for GPS class\n",
+       "%s: can't find tuple 0x91 subtuple 0 (SUBTPL_SIOREG) for GPS class\n",
 			       sdio_func_id(func));
 			kfree(port);
 			return -EINVAL;
@@ -1066,13 +1160,16 @@ static int sdio_uart_probe(struct sdio_func *func,
 
 	port->func = func;
 	sdio_set_drvdata(func, port);
+	tty_port_init(&port->port);
+	port->port.ops = &sdio_uart_port_ops;
 
 	ret = sdio_uart_add_port(port);
 	if (ret) {
 		kfree(port);
 	} else {
 		struct device *dev;
-		dev = tty_register_device(sdio_uart_tty_driver, port->index, &func->dev);
+		dev = tty_register_device(sdio_uart_tty_driver,
+						port->index, &func->dev);
 		if (IS_ERR(dev)) {
 			sdio_uart_port_remove(port);
 			ret = PTR_ERR(dev);
diff --git a/drivers/mmc/core/Kconfig b/drivers/mmc/core/Kconfig
index ab37a6d9d32a..bb22ffd76ef8 100644
--- a/drivers/mmc/core/Kconfig
+++ b/drivers/mmc/core/Kconfig
@@ -3,7 +3,7 @@
 #
 
 config MMC_UNSAFE_RESUME
-	bool "Allow unsafe resume (DANGEROUS)"
+	bool "Assume MMC/SD cards are non-removable (DANGEROUS)"
 	help
 	  If you say Y here, the MMC layer will assume that all cards
 	  stayed in their respective slots during the suspend. The
@@ -14,3 +14,5 @@ config MMC_UNSAFE_RESUME
 	  This option is usually just for embedded systems which use
 	  a MMC/SD card for rootfs. Most people should say N here.
 
+	  This option sets a default which can be overridden by the
+	  module parameter "removable=0" or "removable=1".
diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
index 7dab2e5f4bc9..30acd5265821 100644
--- a/drivers/mmc/core/core.c
+++ b/drivers/mmc/core/core.c
@@ -48,6 +48,22 @@ int use_spi_crc = 1;
 module_param(use_spi_crc, bool, 0);
 
 /*
+ * We normally treat cards as removed during suspend if they are not
+ * known to be on a non-removable bus, to avoid the risk of writing
+ * back data to a different card after resume.  Allow this to be
+ * overridden if necessary.
+ */
+#ifdef CONFIG_MMC_UNSAFE_RESUME
+int mmc_assume_removable;
+#else
+int mmc_assume_removable = 1;
+#endif
+module_param_named(removable, mmc_assume_removable, bool, 0644);
+MODULE_PARM_DESC(
+	removable,
+	"MMC/SD cards are removable and may be removed during suspend");
+
+/*
  * Internal function. Schedule delayed work in the MMC work queue.
  */
 static int mmc_schedule_delayed_work(struct delayed_work *work,
diff --git a/drivers/mmc/core/core.h b/drivers/mmc/core/core.h
index 67ae6abc4230..a811c52a1659 100644
--- a/drivers/mmc/core/core.h
+++ b/drivers/mmc/core/core.h
@@ -54,7 +54,9 @@ int mmc_attach_mmc(struct mmc_host *host, u32 ocr);
 int mmc_attach_sd(struct mmc_host *host, u32 ocr);
 int mmc_attach_sdio(struct mmc_host *host, u32 ocr);
 
+/* Module parameters */
 extern int use_spi_crc;
+extern int mmc_assume_removable;
 
 /* Debugfs information for hosts and cards */
 void mmc_add_host_debugfs(struct mmc_host *host);
diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
index bfefce365ae7..0eac6c814904 100644
--- a/drivers/mmc/core/mmc.c
+++ b/drivers/mmc/core/mmc.c
@@ -207,7 +207,7 @@ static int mmc_read_ext_csd(struct mmc_card *card)
 	}
 
 	card->ext_csd.rev = ext_csd[EXT_CSD_REV];
-	if (card->ext_csd.rev > 3) {
+	if (card->ext_csd.rev > 5) {
 		printk(KERN_ERR "%s: unrecognised EXT_CSD structure "
 			"version %d\n", mmc_hostname(card->host),
 			card->ext_csd.rev);
@@ -602,25 +602,6 @@ static int mmc_awake(struct mmc_host *host)
 	return err;
 }
 
-#ifdef CONFIG_MMC_UNSAFE_RESUME
-
-static const struct mmc_bus_ops mmc_ops = {
-	.awake = mmc_awake,
-	.sleep = mmc_sleep,
-	.remove = mmc_remove,
-	.detect = mmc_detect,
-	.suspend = mmc_suspend,
-	.resume = mmc_resume,
-	.power_restore = mmc_power_restore,
-};
-
-static void mmc_attach_bus_ops(struct mmc_host *host)
-{
-	mmc_attach_bus(host, &mmc_ops);
-}
-
-#else
-
 static const struct mmc_bus_ops mmc_ops = {
 	.awake = mmc_awake,
 	.sleep = mmc_sleep,
@@ -645,15 +626,13 @@ static void mmc_attach_bus_ops(struct mmc_host *host)
 {
 	const struct mmc_bus_ops *bus_ops;
 
-	if (host->caps & MMC_CAP_NONREMOVABLE)
+	if (host->caps & MMC_CAP_NONREMOVABLE || !mmc_assume_removable)
 		bus_ops = &mmc_ops_unsafe;
 	else
 		bus_ops = &mmc_ops;
 	mmc_attach_bus(host, bus_ops);
 }
 
-#endif
-
 /*
  * Starting point for MMC card init.
  */
diff --git a/drivers/mmc/core/sd.c b/drivers/mmc/core/sd.c
index 10b2a4d20f5a..fdd414eded09 100644
--- a/drivers/mmc/core/sd.c
+++ b/drivers/mmc/core/sd.c
@@ -606,23 +606,6 @@ static void mmc_sd_power_restore(struct mmc_host *host)
 	mmc_release_host(host);
 }
 
-#ifdef CONFIG_MMC_UNSAFE_RESUME
-
-static const struct mmc_bus_ops mmc_sd_ops = {
-	.remove = mmc_sd_remove,
-	.detect = mmc_sd_detect,
-	.suspend = mmc_sd_suspend,
-	.resume = mmc_sd_resume,
-	.power_restore = mmc_sd_power_restore,
-};
-
-static void mmc_sd_attach_bus_ops(struct mmc_host *host)
-{
-	mmc_attach_bus(host, &mmc_sd_ops);
-}
-
-#else
-
 static const struct mmc_bus_ops mmc_sd_ops = {
 	.remove = mmc_sd_remove,
 	.detect = mmc_sd_detect,
@@ -643,15 +626,13 @@ static void mmc_sd_attach_bus_ops(struct mmc_host *host)
 {
 	const struct mmc_bus_ops *bus_ops;
 
-	if (host->caps & MMC_CAP_NONREMOVABLE)
+	if (host->caps & MMC_CAP_NONREMOVABLE || !mmc_assume_removable)
 		bus_ops = &mmc_sd_ops_unsafe;
 	else
 		bus_ops = &mmc_sd_ops;
 	mmc_attach_bus(host, bus_ops);
 }
 
-#endif
-
 /*
  * Starting point for SD card init.
  */
diff --git a/drivers/mmc/core/sdio.c b/drivers/mmc/core/sdio.c
index cdb845b68ab5..06b64085a355 100644
--- a/drivers/mmc/core/sdio.c
+++ b/drivers/mmc/core/sdio.c
@@ -516,7 +516,8 @@ int mmc_attach_sdio(struct mmc_host *host, u32 ocr)
 	 * The number of functions on the card is encoded inside
 	 * the ocr.
 	 */
-	card->sdio_funcs = funcs = (ocr & 0x70000000) >> 28;
+	funcs = (ocr & 0x70000000) >> 28;
+	card->sdio_funcs = 0;
 
 	/*
 	 * If needed, disconnect card detection pull-up resistor.
@@ -528,7 +529,7 @@ int mmc_attach_sdio(struct mmc_host *host, u32 ocr)
 	/*
 	 * Initialize (but don't add) all present functions.
 	 */
-	for (i = 0;i < funcs;i++) {
+	for (i = 0; i < funcs; i++, card->sdio_funcs++) {
 		err = sdio_init_func(host->card, i + 1);
 		if (err)
 			goto remove;
diff --git a/drivers/mmc/core/sdio_bus.c b/drivers/mmc/core/sdio_bus.c
index d37464e296a5..9e060c87e64d 100644
--- a/drivers/mmc/core/sdio_bus.c
+++ b/drivers/mmc/core/sdio_bus.c
@@ -248,12 +248,15 @@ int sdio_add_func(struct sdio_func *func)
 /*
  * Unregister a SDIO function with the driver model, and
  * (eventually) free it.
+ * This function can be called through error paths where sdio_add_func() was
+ * never executed (because a failure occurred at an earlier point).
  */
 void sdio_remove_func(struct sdio_func *func)
 {
-	if (sdio_func_present(func))
-		device_del(&func->dev);
+	if (!sdio_func_present(func))
+		return;
 
+	device_del(&func->dev);
 	put_device(&func->dev);
 }
 
diff --git a/drivers/mmc/core/sdio_cis.c b/drivers/mmc/core/sdio_cis.c
index f85dcd536508..9538389783c1 100644
--- a/drivers/mmc/core/sdio_cis.c
+++ b/drivers/mmc/core/sdio_cis.c
@@ -97,26 +97,56 @@ static const unsigned char speed_val[16] =
 static const unsigned int speed_unit[8] =
 	{ 10000, 100000, 1000000, 10000000, 0, 0, 0, 0 };
 
-/* FUNCE tuples with these types get passed to SDIO drivers */
-static const unsigned char funce_type_whitelist[] = {
-	4 /* CISTPL_FUNCE_LAN_NODE_ID used in Broadcom cards */
+
+typedef int (tpl_parse_t)(struct mmc_card *, struct sdio_func *,
+			   const unsigned char *, unsigned);
+
+struct cis_tpl {
+	unsigned char code;
+	unsigned char min_size;
+	tpl_parse_t *parse;
 };
 
-static int cistpl_funce_whitelisted(unsigned char type)
+static int cis_tpl_parse(struct mmc_card *card, struct sdio_func *func,
+			 const char *tpl_descr,
+			 const struct cis_tpl *tpl, int tpl_count,
+			 unsigned char code,
+			 const unsigned char *buf, unsigned size)
 {
-	int i;
+	int i, ret;
 
-	for (i = 0; i < ARRAY_SIZE(funce_type_whitelist); i++) {
-		if (funce_type_whitelist[i] == type)
-			return 1;
+	/* look for a matching code in the table */
+	for (i = 0; i < tpl_count; i++, tpl++) {
+		if (tpl->code == code)
+			break;
 	}
-	return 0;
+	if (i < tpl_count) {
+		if (size >= tpl->min_size) {
+			if (tpl->parse)
+				ret = tpl->parse(card, func, buf, size);
+			else
+				ret = -EILSEQ;	/* known tuple, not parsed */
+		} else {
+			/* invalid tuple */
+			ret = -EINVAL;
+		}
+		if (ret && ret != -EILSEQ && ret != -ENOENT) {
+			printk(KERN_ERR "%s: bad %s tuple 0x%02x (%u bytes)\n",
+			       mmc_hostname(card->host), tpl_descr, code, size);
+		}
+	} else {
+		/* unknown tuple */
+		ret = -ENOENT;
+	}
+
+	return ret;
 }
 
-static int cistpl_funce_common(struct mmc_card *card,
+static int cistpl_funce_common(struct mmc_card *card, struct sdio_func *func,
 			       const unsigned char *buf, unsigned size)
 {
-	if (size < 0x04 || buf[0] != 0)
+	/* Only valid for the common CIS (function 0) */
+	if (func)
 		return -EINVAL;
 
 	/* TPLFE_FN0_BLK_SIZE */
@@ -129,20 +159,24 @@ static int cistpl_funce_common(struct mmc_card *card,
 	return 0;
 }
 
-static int cistpl_funce_func(struct sdio_func *func,
+static int cistpl_funce_func(struct mmc_card *card, struct sdio_func *func,
 			     const unsigned char *buf, unsigned size)
 {
 	unsigned vsn;
 	unsigned min_size;
 
-	/* let SDIO drivers take care of whitelisted FUNCE tuples */
-	if (cistpl_funce_whitelisted(buf[0]))
-		return -EILSEQ;
+	/* Only valid for the individual function's CIS (1-7) */
+	if (!func)
+		return -EINVAL;
 
+	/*
+	 * This tuple has a different length depending on the SDIO spec
+	 * version.
+	 */
 	vsn = func->card->cccr.sdio_vsn;
 	min_size = (vsn == SDIO_SDIO_REV_1_00) ? 28 : 42;
 
-	if (size < min_size || buf[0] != 1)
+	if (size < min_size)
 		return -EINVAL;
 
 	/* TPLFE_MAX_BLK_SIZE */
@@ -157,39 +191,32 @@ static int cistpl_funce_func(struct sdio_func *func,
 	return 0;
 }
 
+/*
+ * Known TPLFE_TYPEs table for CISTPL_FUNCE tuples.
+ *
+ * Note that, unlike PCMCIA, CISTPL_FUNCE tuples are not parsed depending
+ * on the TPLFID_FUNCTION value of the previous CISTPL_FUNCID as on SDIO
+ * TPLFID_FUNCTION is always hardcoded to 0x0C.
+ */
+static const struct cis_tpl cis_tpl_funce_list[] = {
+	{	0x00,	4,	cistpl_funce_common		},
+	{	0x01,	0,	cistpl_funce_func		},
+	{	0x04,	1+1+6,	/* CISTPL_FUNCE_LAN_NODE_ID */	},
+};
+
 static int cistpl_funce(struct mmc_card *card, struct sdio_func *func,
 			const unsigned char *buf, unsigned size)
 {
-	int ret;
-
-	/*
-	 * There should be two versions of the CISTPL_FUNCE tuple,
-	 * one for the common CIS (function 0) and a version used by
-	 * the individual function's CIS (1-7). Yet, the later has a
-	 * different length depending on the SDIO spec version.
-	 */
-	if (func)
-		ret = cistpl_funce_func(func, buf, size);
-	else
-		ret = cistpl_funce_common(card, buf, size);
-
-	if (ret && ret != -EILSEQ) {
-		printk(KERN_ERR "%s: bad CISTPL_FUNCE size %u "
-		       "type %u\n", mmc_hostname(card->host), size, buf[0]);
-	}
+	if (size < 1)
+		return -EINVAL;
 
-	return ret;
+	return cis_tpl_parse(card, func, "CISTPL_FUNCE",
+			     cis_tpl_funce_list,
+			     ARRAY_SIZE(cis_tpl_funce_list),
+			     buf[0], buf, size);
 }
 
-typedef int (tpl_parse_t)(struct mmc_card *, struct sdio_func *,
-			   const unsigned char *, unsigned);
-
-struct cis_tpl {
-	unsigned char code;
-	unsigned char min_size;
-	tpl_parse_t *parse;
-};
-
+/* Known TPL_CODEs table for CIS tuples */
 static const struct cis_tpl cis_tpl_list[] = {
 	{	0x15,	3,	cistpl_vers_1		},
 	{	0x20,	4,	cistpl_manfid		},
@@ -268,46 +295,38 @@ static int sdio_read_cis(struct mmc_card *card, struct sdio_func *func)
 			break;
 		}
 
-		for (i = 0; i < ARRAY_SIZE(cis_tpl_list); i++)
-			if (cis_tpl_list[i].code == tpl_code)
-				break;
-		if (i < ARRAY_SIZE(cis_tpl_list)) {
-			const struct cis_tpl *tpl = cis_tpl_list + i;
-			if (tpl_link < tpl->min_size) {
-				printk(KERN_ERR
-				       "%s: bad CIS tuple 0x%02x"
-				       " (length = %u, expected >= %u)\n",
-				       mmc_hostname(card->host),
-				       tpl_code, tpl_link, tpl->min_size);
-				ret = -EINVAL;
-			} else if (tpl->parse) {
-				ret = tpl->parse(card, func,
-						 this->data, tpl_link);
-			}
+		/* Try to parse the CIS tuple */
+		ret = cis_tpl_parse(card, func, "CIS",
+				    cis_tpl_list, ARRAY_SIZE(cis_tpl_list),
+				    tpl_code, this->data, tpl_link);
+		if (ret == -EILSEQ || ret == -ENOENT) {
 			/*
-			 * We don't need the tuple anymore if it was
-			 * successfully parsed by the SDIO core or if it is
-			 * not going to be parsed by SDIO drivers.
+			 * The tuple is unknown or known but not parsed.
+			 * Queue the tuple for the function driver.
 			 */
-			if (!ret || ret != -EILSEQ)
-				kfree(this);
-		} else {
-			/* unknown tuple */
-			ret = -EILSEQ;
-		}
-
-		if (ret == -EILSEQ) {
-			/* this tuple is unknown to the core or whitelisted */
 			this->next = NULL;
 			this->code = tpl_code;
 			this->size = tpl_link;
 			*prev = this;
 			prev = &this->next;
-			printk(KERN_DEBUG
-			       "%s: queuing CIS tuple 0x%02x length %u\n",
-			       mmc_hostname(card->host), tpl_code, tpl_link);
+
+			if (ret == -ENOENT) {
+				/* warn about unknown tuples */
+				printk(KERN_WARNING "%s: queuing unknown"
+				       " CIS tuple 0x%02x (%u bytes)\n",
+				       mmc_hostname(card->host),
+				       tpl_code, tpl_link);
+			}
+
 			/* keep on analyzing tuples */
 			ret = 0;
+		} else {
+			/*
+			 * We don't need the tuple anymore if it was
+			 * successfully parsed by the SDIO core or if it is
+			 * not going to be queued for a driver.
+			 */
+			kfree(this);
 		}
 
 		ptr += tpl_link;
diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig
index 432ae8358c86..ce1d28884e29 100644
--- a/drivers/mmc/host/Kconfig
+++ b/drivers/mmc/host/Kconfig
@@ -44,6 +44,19 @@ config MMC_SDHCI_IO_ACCESSORS
 	  This is silent Kconfig symbol that is selected by the drivers that
 	  need to overwrite SDHCI IO memory accessors.
 
+config MMC_SDHCI_BIG_ENDIAN_32BIT_BYTE_SWAPPER
+	bool
+	select MMC_SDHCI_IO_ACCESSORS
+	help
+	  This option is selected by drivers running on big endian hosts
+	  and performing I/O to a SDHCI controller through a bus that
+	  implements a hardware byte swapper using a 32-bit datum.
+	  This endian mapping mode is called "data invariance" and
+	  has the effect of scrambling the addresses and formats of data
+	  accessed in sizes other than the datum size.
+
+	  This is the case for the Freescale eSDHC and Nintendo Wii SDHCI.
+
 config MMC_SDHCI_PCI
 	tristate "SDHCI support on PCI bus"
 	depends on MMC_SDHCI && PCI
@@ -75,11 +88,29 @@ config MMC_RICOH_MMC
 config MMC_SDHCI_OF
 	tristate "SDHCI support on OpenFirmware platforms"
 	depends on MMC_SDHCI && PPC_OF
-	select MMC_SDHCI_IO_ACCESSORS
 	help
 	  This selects the OF support for Secure Digital Host Controller
-	  Interfaces. So far, only the Freescale eSDHC controller is known
-	  to exist on OF platforms.
+	  Interfaces.
+
+	  If unsure, say N.
+
+config MMC_SDHCI_OF_ESDHC
+	bool "SDHCI OF support for the Freescale eSDHC controller"
+	depends on MMC_SDHCI_OF
+	select MMC_SDHCI_BIG_ENDIAN_32BIT_BYTE_SWAPPER
+	help
+	  This selects the Freescale eSDHC controller support.
+
+	  If unsure, say N.
+
+config MMC_SDHCI_OF_HLWD
+	bool "SDHCI OF support for the Nintendo Wii SDHCI controllers"
+	depends on MMC_SDHCI_OF
+	select MMC_SDHCI_BIG_ENDIAN_32BIT_BYTE_SWAPPER
+	help
+	  This selects the Secure Digital Host Controller Interface (SDHCI)
+	  found in the "Hollywood" chipset of the Nintendo Wii video game
+	  console.
 
 	  If unsure, say N.
 
@@ -251,6 +282,14 @@ config MMC_MVSDIO
 	  To compile this driver as a module, choose M here: the
 	  module will be called mvsdio.
 
+config MMC_DAVINCI
+        tristate "TI DAVINCI Multimedia Card Interface support"
+        depends on ARCH_DAVINCI
+        help
+          This selects the TI DAVINCI Multimedia card Interface.
+          If you have an DAVINCI board with a Multimedia Card slot,
+          say Y or M here.  If unsure, say N.
+
 config MMC_SPI
 	tristate "MMC/SD/SDIO over SPI"
 	depends on SPI_MASTER && !HIGHMEM && HAS_DMA
@@ -329,7 +368,7 @@ config MMC_SDRICOH_CS
 
 config MMC_TMIO
 	tristate "Toshiba Mobile IO Controller (TMIO) MMC/SD function support"
-	depends on MFD_TMIO || MFD_ASIC3
+	depends on MFD_TMIO || MFD_ASIC3 || SUPERH
 	help
 	  This provides support for the SD/MMC cell found in TC6393XB,
 	  T7L66XB and also HTC ASIC3
@@ -357,3 +396,22 @@ config MMC_VIA_SDMMC
 	  If you have a controller with this interface, say Y or M here.
 
 	  If unsure, say N.
+
+config SDH_BFIN
+	tristate "Blackfin Secure Digital Host support"
+	depends on MMC && ((BF54x && !BF544) || (BF51x && !BF512))
+	help
+	  If you say yes here you will get support for the Blackfin on-chip
+	  Secure Digital Host interface.  This includes support for MMC and
+	  SD cards.
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called bfin_sdh.
+
+	  If unsure, say N.
+
+config SDH_BFIN_MISSING_CMD_PULLUP_WORKAROUND
+	bool "Blackfin EZkit Missing SDH_CMD Pull Up Resistor Workaround"
+	depends on SDH_BFIN
+	help
+	  If you say yes here SD-Cards may work on the EZkit.
diff --git a/drivers/mmc/host/Makefile b/drivers/mmc/host/Makefile
index abcb0400e06d..3d253dd4240f 100644
--- a/drivers/mmc/host/Makefile
+++ b/drivers/mmc/host/Makefile
@@ -13,7 +13,6 @@ obj-$(CONFIG_MMC_MXC)		+= mxcmmc.o
 obj-$(CONFIG_MMC_SDHCI)		+= sdhci.o
 obj-$(CONFIG_MMC_SDHCI_PCI)	+= sdhci-pci.o
 obj-$(CONFIG_MMC_RICOH_MMC)	+= ricoh_mmc.o
-obj-$(CONFIG_MMC_SDHCI_OF)	+= sdhci-of.o
 obj-$(CONFIG_MMC_SDHCI_PLTFM)	+= sdhci-pltfm.o
 obj-$(CONFIG_MMC_SDHCI_S3C)	+= sdhci-s3c.o
 obj-$(CONFIG_MMC_WBSD)		+= wbsd.o
@@ -25,6 +24,7 @@ obj-$(CONFIG_MMC_ATMELMCI)	+= atmel-mci.o
 obj-$(CONFIG_MMC_TIFM_SD)	+= tifm_sd.o
 obj-$(CONFIG_MMC_MSM7X00A)	+= msm_sdcc.o
 obj-$(CONFIG_MMC_MVSDIO)	+= mvsdio.o
+obj-$(CONFIG_MMC_DAVINCI)       += davinci_mmc.o
 obj-$(CONFIG_MMC_SPI)		+= mmc_spi.o
 ifeq ($(CONFIG_OF),y)
 obj-$(CONFIG_MMC_SPI)		+= of_mmc_spi.o
@@ -34,6 +34,12 @@ obj-$(CONFIG_MMC_SDRICOH_CS)	+= sdricoh_cs.o
 obj-$(CONFIG_MMC_TMIO)		+= tmio_mmc.o
 obj-$(CONFIG_MMC_CB710)	+= cb710-mmc.o
 obj-$(CONFIG_MMC_VIA_SDMMC)	+= via-sdmmc.o
+obj-$(CONFIG_SDH_BFIN)		+= bfin_sdh.o
+
+obj-$(CONFIG_MMC_SDHCI_OF)	+= sdhci-of.o
+sdhci-of-y				:= sdhci-of-core.o
+sdhci-of-$(CONFIG_MMC_SDHCI_OF_ESDHC)	+= sdhci-of-esdhc.o
+sdhci-of-$(CONFIG_MMC_SDHCI_OF_HLWD)	+= sdhci-of-hlwd.o
 
 ifeq ($(CONFIG_CB710_DEBUG),y)
 	CFLAGS-cb710-mmc	+= -DDEBUG
diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c
index fc25586b7ee1..8072128e933b 100644
--- a/drivers/mmc/host/atmel-mci.c
+++ b/drivers/mmc/host/atmel-mci.c
@@ -25,6 +25,8 @@
 #include <linux/stat.h>
 
 #include <linux/mmc/host.h>
+
+#include <mach/atmel-mci.h>
 #include <linux/atmel-mci.h>
 
 #include <asm/io.h>
@@ -92,6 +94,7 @@ struct atmel_mci_dma {
  * @need_clock_update: Update the clock rate before the next request.
  * @need_reset: Reset controller before next request.
  * @mode_reg: Value of the MR register.
+ * @cfg_reg: Value of the CFG register.
  * @bus_hz: The rate of @mck in Hz. This forms the basis for MMC bus
  *	rate and timeout calculations.
  * @mapbase: Physical address of the MMIO registers.
@@ -155,6 +158,7 @@ struct atmel_mci {
 	bool			need_clock_update;
 	bool			need_reset;
 	u32			mode_reg;
+	u32			cfg_reg;
 	unsigned long		bus_hz;
 	unsigned long		mapbase;
 	struct clk		*mck;
@@ -223,6 +227,19 @@ static bool mci_has_rwproof(void)
 }
 
 /*
+ * The new MCI2 module isn't 100% compatible with the old MCI module,
+ * and it has a few nice features which we want to use...
+ */
+static inline bool atmci_is_mci2(void)
+{
+	if (cpu_is_at91sam9g45())
+		return true;
+
+	return false;
+}
+
+
+/*
  * The debugfs stuff below is mostly optimized away when
  * CONFIG_DEBUG_FS is not set.
  */
@@ -357,12 +374,33 @@ static int atmci_regs_show(struct seq_file *s, void *v)
 			buf[MCI_BLKR / 4],
 			buf[MCI_BLKR / 4] & 0xffff,
 			(buf[MCI_BLKR / 4] >> 16) & 0xffff);
+	if (atmci_is_mci2())
+		seq_printf(s, "CSTOR:\t0x%08x\n", buf[MCI_CSTOR / 4]);
 
 	/* Don't read RSPR and RDR; it will consume the data there */
 
 	atmci_show_status_reg(s, "SR", buf[MCI_SR / 4]);
 	atmci_show_status_reg(s, "IMR", buf[MCI_IMR / 4]);
 
+	if (atmci_is_mci2()) {
+		u32 val;
+
+		val = buf[MCI_DMA / 4];
+		seq_printf(s, "DMA:\t0x%08x OFFSET=%u CHKSIZE=%u%s\n",
+				val, val & 3,
+				((val >> 4) & 3) ?
+					1 << (((val >> 4) & 3) + 1) : 1,
+				val & MCI_DMAEN ? " DMAEN" : "");
+
+		val = buf[MCI_CFG / 4];
+		seq_printf(s, "CFG:\t0x%08x%s%s%s%s\n",
+				val,
+				val & MCI_CFG_FIFOMODE_1DATA ? " FIFOMODE_ONE_DATA" : "",
+				val & MCI_CFG_FERRCTRL_COR ? " FERRCTRL_CLEAR_ON_READ" : "",
+				val & MCI_CFG_HSMODE ? " HSMODE" : "",
+				val & MCI_CFG_LSYNC ? " LSYNC" : "");
+	}
+
 	kfree(buf);
 
 	return 0;
@@ -557,6 +595,10 @@ static void atmci_dma_complete(void *arg)
 
 	dev_vdbg(&host->pdev->dev, "DMA complete\n");
 
+	if (atmci_is_mci2())
+		/* Disable DMA hardware handshaking on MCI */
+		mci_writel(host, DMA, mci_readl(host, DMA) & ~MCI_DMAEN);
+
 	atmci_dma_cleanup(host);
 
 	/*
@@ -592,7 +634,7 @@ static void atmci_dma_complete(void *arg)
 }
 
 static int
-atmci_submit_data_dma(struct atmel_mci *host, struct mmc_data *data)
+atmci_prepare_data_dma(struct atmel_mci *host, struct mmc_data *data)
 {
 	struct dma_chan			*chan;
 	struct dma_async_tx_descriptor	*desc;
@@ -624,6 +666,9 @@ atmci_submit_data_dma(struct atmel_mci *host, struct mmc_data *data)
 	if (!chan)
 		return -ENODEV;
 
+	if (atmci_is_mci2())
+		mci_writel(host, DMA, MCI_DMA_CHKSIZE(3) | MCI_DMAEN);
+
 	if (data->flags & MMC_DATA_READ)
 		direction = DMA_FROM_DEVICE;
 	else
@@ -641,10 +686,6 @@ atmci_submit_data_dma(struct atmel_mci *host, struct mmc_data *data)
 	host->dma.data_desc = desc;
 	desc->callback = atmci_dma_complete;
 	desc->callback_param = host;
-	desc->tx_submit(desc);
-
-	/* Go! */
-	chan->device->device_issue_pending(chan);
 
 	return 0;
 unmap_exit:
@@ -652,13 +693,26 @@ unmap_exit:
 	return -ENOMEM;
 }
 
+static void atmci_submit_data(struct atmel_mci *host)
+{
+	struct dma_chan			*chan = host->data_chan;
+	struct dma_async_tx_descriptor	*desc = host->dma.data_desc;
+
+	if (chan) {
+		desc->tx_submit(desc);
+		chan->device->device_issue_pending(chan);
+	}
+}
+
 #else /* CONFIG_MMC_ATMELMCI_DMA */
 
-static int atmci_submit_data_dma(struct atmel_mci *host, struct mmc_data *data)
+static int atmci_prepare_data_dma(struct atmel_mci *host, struct mmc_data *data)
 {
 	return -ENOSYS;
 }
 
+static void atmci_submit_data(struct atmel_mci *host) {}
+
 static void atmci_stop_dma(struct atmel_mci *host)
 {
 	/* Data transfer was stopped by the interrupt handler */
@@ -672,7 +726,7 @@ static void atmci_stop_dma(struct atmel_mci *host)
  * Returns a mask of interrupt flags to be enabled after the whole
  * request has been prepared.
  */
-static u32 atmci_submit_data(struct atmel_mci *host, struct mmc_data *data)
+static u32 atmci_prepare_data(struct atmel_mci *host, struct mmc_data *data)
 {
 	u32 iflags;
 
@@ -683,7 +737,7 @@ static u32 atmci_submit_data(struct atmel_mci *host, struct mmc_data *data)
 	host->data = data;
 
 	iflags = ATMCI_DATA_ERROR_FLAGS;
-	if (atmci_submit_data_dma(host, data)) {
+	if (atmci_prepare_data_dma(host, data)) {
 		host->data_chan = NULL;
 
 		/*
@@ -729,6 +783,8 @@ static void atmci_start_request(struct atmel_mci *host,
 		mci_writel(host, CR, MCI_CR_SWRST);
 		mci_writel(host, CR, MCI_CR_MCIEN);
 		mci_writel(host, MR, host->mode_reg);
+		if (atmci_is_mci2())
+			mci_writel(host, CFG, host->cfg_reg);
 		host->need_reset = false;
 	}
 	mci_writel(host, SDCR, slot->sdc_reg);
@@ -744,6 +800,7 @@ static void atmci_start_request(struct atmel_mci *host,
 		while (!(mci_readl(host, SR) & MCI_CMDRDY))
 			cpu_relax();
 	}
+	iflags = 0;
 	data = mrq->data;
 	if (data) {
 		atmci_set_timeout(host, slot, data);
@@ -753,15 +810,17 @@ static void atmci_start_request(struct atmel_mci *host,
 				| MCI_BLKLEN(data->blksz));
 		dev_vdbg(&slot->mmc->class_dev, "BLKR=0x%08x\n",
 			MCI_BCNT(data->blocks) | MCI_BLKLEN(data->blksz));
+
+		iflags |= atmci_prepare_data(host, data);
 	}
 
-	iflags = MCI_CMDRDY;
+	iflags |= MCI_CMDRDY;
 	cmd = mrq->cmd;
 	cmdflags = atmci_prepare_command(slot->mmc, cmd);
 	atmci_start_command(host, cmd, cmdflags);
 
 	if (data)
-		iflags |= atmci_submit_data(host, data);
+		atmci_submit_data(host);
 
 	if (mrq->stop) {
 		host->stop_cmdr = atmci_prepare_command(slot->mmc, mrq->stop);
@@ -857,6 +916,8 @@ static void atmci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
 			clk_enable(host->mck);
 			mci_writel(host, CR, MCI_CR_SWRST);
 			mci_writel(host, CR, MCI_CR_MCIEN);
+			if (atmci_is_mci2())
+				mci_writel(host, CFG, host->cfg_reg);
 		}
 
 		/*
@@ -1095,6 +1156,8 @@ static void atmci_detect_change(unsigned long data)
 				mci_writel(host, CR, MCI_CR_SWRST);
 				mci_writel(host, CR, MCI_CR_MCIEN);
 				mci_writel(host, MR, host->mode_reg);
+				if (atmci_is_mci2())
+					mci_writel(host, CFG, host->cfg_reg);
 
 				host->data = NULL;
 				host->cmd = NULL;
@@ -1584,14 +1647,47 @@ static void __exit atmci_cleanup_slot(struct atmel_mci_slot *slot,
 #ifdef CONFIG_MMC_ATMELMCI_DMA
 static bool filter(struct dma_chan *chan, void *slave)
 {
-	struct dw_dma_slave *dws = slave;
+	struct mci_dma_data	*sl = slave;
 
-	if (dws->dma_dev == chan->device->dev) {
-		chan->private = dws;
+	if (sl && find_slave_dev(sl) == chan->device->dev) {
+		chan->private = slave_data_ptr(sl);
 		return true;
-	} else
+	} else {
 		return false;
+	}
 }
+
+static void atmci_configure_dma(struct atmel_mci *host)
+{
+	struct mci_platform_data	*pdata;
+
+	if (host == NULL)
+		return;
+
+	pdata = host->pdev->dev.platform_data;
+
+	if (pdata && find_slave_dev(pdata->dma_slave)) {
+		dma_cap_mask_t mask;
+
+		setup_dma_addr(pdata->dma_slave,
+			       host->mapbase + MCI_TDR,
+			       host->mapbase + MCI_RDR);
+
+		/* Try to grab a DMA channel */
+		dma_cap_zero(mask);
+		dma_cap_set(DMA_SLAVE, mask);
+		host->dma.chan =
+			dma_request_channel(mask, filter, pdata->dma_slave);
+	}
+	if (!host->dma.chan)
+		dev_notice(&host->pdev->dev, "DMA not available, using PIO\n");
+	else
+		dev_info(&host->pdev->dev,
+					"Using %s for DMA transfers\n",
+					dma_chan_name(host->dma.chan));
+}
+#else
+static void atmci_configure_dma(struct atmel_mci *host) {}
 #endif
 
 static int __init atmci_probe(struct platform_device *pdev)
@@ -1645,22 +1741,7 @@ static int __init atmci_probe(struct platform_device *pdev)
 	if (ret)
 		goto err_request_irq;
 
-#ifdef CONFIG_MMC_ATMELMCI_DMA
-	if (pdata->dma_slave.dma_dev) {
-		struct dw_dma_slave *dws = &pdata->dma_slave;
-		dma_cap_mask_t mask;
-
-		dws->tx_reg = regs->start + MCI_TDR;
-		dws->rx_reg = regs->start + MCI_RDR;
-
-		/* Try to grab a DMA channel */
-		dma_cap_zero(mask);
-		dma_cap_set(DMA_SLAVE, mask);
-		host->dma.chan = dma_request_channel(mask, filter, dws);
-	}
-	if (!host->dma.chan)
-		dev_notice(&pdev->dev, "DMA not available, using PIO\n");
-#endif /* CONFIG_MMC_ATMELMCI_DMA */
+	atmci_configure_dma(host);
 
 	platform_set_drvdata(pdev, host);
 
diff --git a/drivers/mmc/host/bfin_sdh.c b/drivers/mmc/host/bfin_sdh.c
new file mode 100644
index 000000000000..3343a57355cc
--- /dev/null
+++ b/drivers/mmc/host/bfin_sdh.c
@@ -0,0 +1,639 @@
+/*
+ * bfin_sdh.c - Analog Devices Blackfin SDH Controller
+ *
+ * Copyright (C) 2007-2009 Analog Device Inc.
+ *
+ * Licensed under the GPL-2 or later.
+ */
+
+#define DRIVER_NAME	"bfin-sdh"
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/ioport.h>
+#include <linux/platform_device.h>
+#include <linux/delay.h>
+#include <linux/interrupt.h>
+#include <linux/dma-mapping.h>
+#include <linux/mmc/host.h>
+#include <linux/proc_fs.h>
+
+#include <asm/cacheflush.h>
+#include <asm/dma.h>
+#include <asm/portmux.h>
+#include <asm/bfin_sdh.h>
+
+#if defined(CONFIG_BF51x)
+#define bfin_read_SDH_PWR_CTL		bfin_read_RSI_PWR_CTL
+#define bfin_write_SDH_PWR_CTL		bfin_write_RSI_PWR_CTL
+#define bfin_read_SDH_CLK_CTL		bfin_read_RSI_CLK_CTL
+#define bfin_write_SDH_CLK_CTL		bfin_write_RSI_CLK_CTL
+#define bfin_write_SDH_ARGUMENT		bfin_write_RSI_ARGUMENT
+#define bfin_write_SDH_COMMAND		bfin_write_RSI_COMMAND
+#define bfin_write_SDH_DATA_TIMER	bfin_write_RSI_DATA_TIMER
+#define bfin_read_SDH_RESPONSE0		bfin_read_RSI_RESPONSE0
+#define bfin_read_SDH_RESPONSE1		bfin_read_RSI_RESPONSE1
+#define bfin_read_SDH_RESPONSE2		bfin_read_RSI_RESPONSE2
+#define bfin_read_SDH_RESPONSE3		bfin_read_RSI_RESPONSE3
+#define bfin_write_SDH_DATA_LGTH	bfin_write_RSI_DATA_LGTH
+#define bfin_read_SDH_DATA_CTL		bfin_read_RSI_DATA_CTL
+#define bfin_write_SDH_DATA_CTL		bfin_write_RSI_DATA_CTL
+#define bfin_read_SDH_DATA_CNT		bfin_read_RSI_DATA_CNT
+#define bfin_write_SDH_STATUS_CLR	bfin_write_RSI_STATUS_CLR
+#define bfin_read_SDH_E_STATUS		bfin_read_RSI_E_STATUS
+#define bfin_write_SDH_E_STATUS		bfin_write_RSI_E_STATUS
+#define bfin_read_SDH_STATUS		bfin_read_RSI_STATUS
+#define bfin_write_SDH_MASK0		bfin_write_RSI_MASK0
+#define bfin_read_SDH_CFG		bfin_read_RSI_CFG
+#define bfin_write_SDH_CFG		bfin_write_RSI_CFG
+#endif
+
+struct dma_desc_array {
+	unsigned long	start_addr;
+	unsigned short	cfg;
+	unsigned short	x_count;
+	short		x_modify;
+} __packed;
+
+struct sdh_host {
+	struct mmc_host		*mmc;
+	spinlock_t		lock;
+	struct resource		*res;
+	void __iomem		*base;
+	int			irq;
+	int			stat_irq;
+	int			dma_ch;
+	int			dma_dir;
+	struct dma_desc_array	*sg_cpu;
+	dma_addr_t		sg_dma;
+	int			dma_len;
+
+	unsigned int		imask;
+	unsigned int		power_mode;
+	unsigned int		clk_div;
+
+	struct mmc_request	*mrq;
+	struct mmc_command	*cmd;
+	struct mmc_data		*data;
+};
+
+static struct bfin_sd_host *get_sdh_data(struct platform_device *pdev)
+{
+	return pdev->dev.platform_data;
+}
+
+static void sdh_stop_clock(struct sdh_host *host)
+{
+	bfin_write_SDH_CLK_CTL(bfin_read_SDH_CLK_CTL() & ~CLK_E);
+	SSYNC();
+}
+
+static void sdh_enable_stat_irq(struct sdh_host *host, unsigned int mask)
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(&host->lock, flags);
+	host->imask |= mask;
+	bfin_write_SDH_MASK0(mask);
+	SSYNC();
+	spin_unlock_irqrestore(&host->lock, flags);
+}
+
+static void sdh_disable_stat_irq(struct sdh_host *host, unsigned int mask)
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(&host->lock, flags);
+	host->imask &= ~mask;
+	bfin_write_SDH_MASK0(host->imask);
+	SSYNC();
+	spin_unlock_irqrestore(&host->lock, flags);
+}
+
+static int sdh_setup_data(struct sdh_host *host, struct mmc_data *data)
+{
+	unsigned int length;
+	unsigned int data_ctl;
+	unsigned int dma_cfg;
+	struct scatterlist *sg;
+
+	dev_dbg(mmc_dev(host->mmc), "%s enter flags: 0x%x\n", __func__, data->flags);
+	host->data = data;
+	data_ctl = 0;
+	dma_cfg = 0;
+
+	length = data->blksz * data->blocks;
+	bfin_write_SDH_DATA_LGTH(length);
+
+	if (data->flags & MMC_DATA_STREAM)
+		data_ctl |= DTX_MODE;
+
+	if (data->flags & MMC_DATA_READ)
+		data_ctl |= DTX_DIR;
+	/* Only supports power-of-2 block size */
+	if (data->blksz & (data->blksz - 1))
+		return -EINVAL;
+	data_ctl |= ((ffs(data->blksz) - 1) << 4);
+
+	bfin_write_SDH_DATA_CTL(data_ctl);
+
+	bfin_write_SDH_DATA_TIMER(0xFFFF);
+	SSYNC();
+
+	if (data->flags & MMC_DATA_READ) {
+		host->dma_dir = DMA_FROM_DEVICE;
+		dma_cfg |= WNR;
+	} else
+		host->dma_dir = DMA_TO_DEVICE;
+
+	sdh_enable_stat_irq(host, (DAT_CRC_FAIL | DAT_TIME_OUT | DAT_END));
+	host->dma_len = dma_map_sg(mmc_dev(host->mmc), data->sg, data->sg_len, host->dma_dir);
+#if defined(CONFIG_BF54x)
+	dma_cfg |= DMAFLOW_ARRAY | NDSIZE_5 | RESTART | WDSIZE_32 | DMAEN;
+	{
+		int i;
+		for_each_sg(data->sg, sg, host->dma_len, i) {
+			host->sg_cpu[i].start_addr = sg_dma_address(sg);
+			host->sg_cpu[i].cfg = dma_cfg;
+			host->sg_cpu[i].x_count = sg_dma_len(sg) / 4;
+			host->sg_cpu[i].x_modify = 4;
+			dev_dbg(mmc_dev(host->mmc), "%d: start_addr:0x%lx, "
+				"cfg:0x%x, x_count:0x%x, x_modify:0x%x\n",
+				i, host->sg_cpu[i].start_addr,
+				host->sg_cpu[i].cfg, host->sg_cpu[i].x_count,
+				host->sg_cpu[i].x_modify);
+		}
+	}
+	flush_dcache_range((unsigned int)host->sg_cpu,
+		(unsigned int)host->sg_cpu +
+			host->dma_len * sizeof(struct dma_desc_array));
+	/* Set the last descriptor to stop mode */
+	host->sg_cpu[host->dma_len - 1].cfg &= ~(DMAFLOW | NDSIZE);
+	host->sg_cpu[host->dma_len - 1].cfg |= DI_EN;
+
+	set_dma_curr_desc_addr(host->dma_ch, (unsigned long *)host->sg_dma);
+	set_dma_x_count(host->dma_ch, 0);
+	set_dma_x_modify(host->dma_ch, 0);
+	set_dma_config(host->dma_ch, dma_cfg);
+#elif defined(CONFIG_BF51x)
+	/* RSI DMA doesn't work in array mode */
+	dma_cfg |= WDSIZE_32 | DMAEN;
+	set_dma_start_addr(host->dma_ch, sg_dma_address(&data->sg[0]));
+	set_dma_x_count(host->dma_ch, length / 4);
+	set_dma_x_modify(host->dma_ch, 4);
+	set_dma_config(host->dma_ch, dma_cfg);
+#endif
+	bfin_write_SDH_DATA_CTL(bfin_read_SDH_DATA_CTL() | DTX_DMA_E | DTX_E);
+
+	SSYNC();
+
+	dev_dbg(mmc_dev(host->mmc), "%s exit\n", __func__);
+	return 0;
+}
+
+static void sdh_start_cmd(struct sdh_host *host, struct mmc_command *cmd)
+{
+	unsigned int sdh_cmd;
+	unsigned int stat_mask;
+
+	dev_dbg(mmc_dev(host->mmc), "%s enter cmd: 0x%p\n", __func__, cmd);
+	WARN_ON(host->cmd != NULL);
+	host->cmd = cmd;
+
+	sdh_cmd = 0;
+	stat_mask = 0;
+
+	sdh_cmd |= cmd->opcode;
+
+	if (cmd->flags & MMC_RSP_PRESENT) {
+		sdh_cmd |= CMD_RSP;
+		stat_mask |= CMD_RESP_END;
+	} else {
+		stat_mask |= CMD_SENT;
+	}
+
+	if (cmd->flags & MMC_RSP_136)
+		sdh_cmd |= CMD_L_RSP;
+
+	stat_mask |= CMD_CRC_FAIL | CMD_TIME_OUT;
+
+	sdh_enable_stat_irq(host, stat_mask);
+
+	bfin_write_SDH_ARGUMENT(cmd->arg);
+	bfin_write_SDH_COMMAND(sdh_cmd | CMD_E);
+	bfin_write_SDH_CLK_CTL(bfin_read_SDH_CLK_CTL() | CLK_E);
+	SSYNC();
+}
+
+static void sdh_finish_request(struct sdh_host *host, struct mmc_request *mrq)
+{
+	dev_dbg(mmc_dev(host->mmc), "%s enter\n", __func__);
+	host->mrq = NULL;
+	host->cmd = NULL;
+	host->data = NULL;
+	mmc_request_done(host->mmc, mrq);
+}
+
+static int sdh_cmd_done(struct sdh_host *host, unsigned int stat)
+{
+	struct mmc_command *cmd = host->cmd;
+	int ret = 0;
+
+	dev_dbg(mmc_dev(host->mmc), "%s enter cmd: %p\n", __func__, cmd);
+	if (!cmd)
+		return 0;
+
+	host->cmd = NULL;
+
+	if (cmd->flags & MMC_RSP_PRESENT) {
+		cmd->resp[0] = bfin_read_SDH_RESPONSE0();
+		if (cmd->flags & MMC_RSP_136) {
+			cmd->resp[1] = bfin_read_SDH_RESPONSE1();
+			cmd->resp[2] = bfin_read_SDH_RESPONSE2();
+			cmd->resp[3] = bfin_read_SDH_RESPONSE3();
+		}
+	}
+	if (stat & CMD_TIME_OUT)
+		cmd->error = -ETIMEDOUT;
+	else if (stat & CMD_CRC_FAIL && cmd->flags & MMC_RSP_CRC)
+		cmd->error = -EILSEQ;
+
+	sdh_disable_stat_irq(host, (CMD_SENT | CMD_RESP_END | CMD_TIME_OUT | CMD_CRC_FAIL));
+
+	if (host->data && !cmd->error) {
+		if (host->data->flags & MMC_DATA_WRITE) {
+			ret = sdh_setup_data(host, host->data);
+			if (ret)
+				return 0;
+		}
+
+		sdh_enable_stat_irq(host, DAT_END | RX_OVERRUN | TX_UNDERRUN | DAT_TIME_OUT);
+	} else
+		sdh_finish_request(host, host->mrq);
+
+	return 1;
+}
+
+static int sdh_data_done(struct sdh_host *host, unsigned int stat)
+{
+	struct mmc_data *data = host->data;
+
+	dev_dbg(mmc_dev(host->mmc), "%s enter stat: 0x%x\n", __func__, stat);
+	if (!data)
+		return 0;
+
+	disable_dma(host->dma_ch);
+	dma_unmap_sg(mmc_dev(host->mmc), data->sg, data->sg_len,
+		     host->dma_dir);
+
+	if (stat & DAT_TIME_OUT)
+		data->error = -ETIMEDOUT;
+	else if (stat & DAT_CRC_FAIL)
+		data->error = -EILSEQ;
+	else if (stat & (RX_OVERRUN | TX_UNDERRUN))
+		data->error = -EIO;
+
+	if (!data->error)
+		data->bytes_xfered = data->blocks * data->blksz;
+	else
+		data->bytes_xfered = 0;
+
+	sdh_disable_stat_irq(host, DAT_END | DAT_TIME_OUT | DAT_CRC_FAIL | RX_OVERRUN | TX_UNDERRUN);
+	bfin_write_SDH_STATUS_CLR(DAT_END_STAT | DAT_TIMEOUT_STAT | \
+			DAT_CRC_FAIL_STAT | DAT_BLK_END_STAT | RX_OVERRUN | TX_UNDERRUN);
+	bfin_write_SDH_DATA_CTL(0);
+	SSYNC();
+
+	host->data = NULL;
+	if (host->mrq->stop) {
+		sdh_stop_clock(host);
+		sdh_start_cmd(host, host->mrq->stop);
+	} else {
+		sdh_finish_request(host, host->mrq);
+	}
+
+	return 1;
+}
+
+static void sdh_request(struct mmc_host *mmc, struct mmc_request *mrq)
+{
+	struct sdh_host *host = mmc_priv(mmc);
+	int ret = 0;
+
+	dev_dbg(mmc_dev(host->mmc), "%s enter, mrp:%p, cmd:%p\n", __func__, mrq, mrq->cmd);
+	WARN_ON(host->mrq != NULL);
+
+	host->mrq = mrq;
+	host->data = mrq->data;
+
+	if (mrq->data && mrq->data->flags & MMC_DATA_READ) {
+		ret = sdh_setup_data(host, mrq->data);
+		if (ret)
+			return;
+	}
+
+	sdh_start_cmd(host, mrq->cmd);
+}
+
+static void sdh_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
+{
+	struct sdh_host *host;
+	unsigned long flags;
+	u16 clk_ctl = 0;
+	u16 pwr_ctl = 0;
+	u16 cfg;
+	host = mmc_priv(mmc);
+
+	spin_lock_irqsave(&host->lock, flags);
+	if (ios->clock) {
+		unsigned long  sys_clk, ios_clk;
+		unsigned char clk_div;
+		ios_clk = 2 * ios->clock;
+		sys_clk = get_sclk();
+		clk_div = sys_clk / ios_clk;
+		if (sys_clk % ios_clk == 0)
+			clk_div -= 1;
+		clk_div = min_t(unsigned char, clk_div, 0xFF);
+		clk_ctl |= clk_div;
+		clk_ctl |= CLK_E;
+		host->clk_div = clk_div;
+	} else
+		sdh_stop_clock(host);
+
+	if (ios->bus_mode == MMC_BUSMODE_OPENDRAIN)
+#ifdef CONFIG_SDH_BFIN_MISSING_CMD_PULLUP_WORKAROUND
+		pwr_ctl |= ROD_CTL;
+#else
+		pwr_ctl |= SD_CMD_OD | ROD_CTL;
+#endif
+
+	if (ios->bus_width == MMC_BUS_WIDTH_4) {
+		cfg = bfin_read_SDH_CFG();
+		cfg &= ~PD_SDDAT3;
+		cfg |= PUP_SDDAT3;
+		/* Enable 4 bit SDIO */
+		cfg |= (SD4E | MWE);
+		bfin_write_SDH_CFG(cfg);
+		clk_ctl |= WIDE_BUS;
+	} else {
+		cfg = bfin_read_SDH_CFG();
+		cfg |= MWE;
+		bfin_write_SDH_CFG(cfg);
+	}
+
+	bfin_write_SDH_CLK_CTL(clk_ctl);
+
+	host->power_mode = ios->power_mode;
+	if (ios->power_mode == MMC_POWER_ON)
+		pwr_ctl |= PWR_ON;
+
+	bfin_write_SDH_PWR_CTL(pwr_ctl);
+	SSYNC();
+
+	spin_unlock_irqrestore(&host->lock, flags);
+
+	dev_dbg(mmc_dev(host->mmc), "SDH: clk_div = 0x%x actual clock:%ld expected clock:%d\n",
+		host->clk_div,
+		host->clk_div ? get_sclk() / (2 * (host->clk_div + 1)) : 0,
+		ios->clock);
+}
+
+static const struct mmc_host_ops sdh_ops = {
+	.request	= sdh_request,
+	.set_ios	= sdh_set_ios,
+};
+
+static irqreturn_t sdh_dma_irq(int irq, void *devid)
+{
+	struct sdh_host *host = devid;
+
+	dev_dbg(mmc_dev(host->mmc), "%s enter, irq_stat: 0x%04x\n", __func__,
+		get_dma_curr_irqstat(host->dma_ch));
+	clear_dma_irqstat(host->dma_ch);
+	SSYNC();
+
+	return IRQ_HANDLED;
+}
+
+static irqreturn_t sdh_stat_irq(int irq, void *devid)
+{
+	struct sdh_host *host = devid;
+	unsigned int status;
+	int handled = 0;
+
+	dev_dbg(mmc_dev(host->mmc), "%s enter\n", __func__);
+	status = bfin_read_SDH_E_STATUS();
+	if (status & SD_CARD_DET) {
+		mmc_detect_change(host->mmc, 0);
+		bfin_write_SDH_E_STATUS(SD_CARD_DET);
+	}
+	status = bfin_read_SDH_STATUS();
+	if (status & (CMD_SENT | CMD_RESP_END | CMD_TIME_OUT | CMD_CRC_FAIL)) {
+		handled |= sdh_cmd_done(host, status);
+		bfin_write_SDH_STATUS_CLR(CMD_SENT_STAT | CMD_RESP_END_STAT | \
+				CMD_TIMEOUT_STAT | CMD_CRC_FAIL_STAT);
+		SSYNC();
+	}
+
+	status = bfin_read_SDH_STATUS();
+	if (status & (DAT_END | DAT_TIME_OUT | DAT_CRC_FAIL | RX_OVERRUN | TX_UNDERRUN))
+		handled |= sdh_data_done(host, status);
+
+	dev_dbg(mmc_dev(host->mmc), "%s exit\n\n", __func__);
+
+	return IRQ_RETVAL(handled);
+}
+
+static int __devinit sdh_probe(struct platform_device *pdev)
+{
+	struct mmc_host *mmc;
+	struct sdh_host *host;
+	struct bfin_sd_host *drv_data = get_sdh_data(pdev);
+	int ret;
+
+	if (!drv_data) {
+		dev_err(&pdev->dev, "missing platform driver data\n");
+		ret = -EINVAL;
+		goto out;
+	}
+
+	mmc = mmc_alloc_host(sizeof(*mmc), &pdev->dev);
+	if (!mmc) {
+		ret = -ENOMEM;
+		goto out;
+	}
+
+	mmc->ops = &sdh_ops;
+	mmc->max_phys_segs = 32;
+	mmc->max_seg_size = 1 << 16;
+	mmc->max_blk_size = 1 << 11;
+	mmc->max_blk_count = 1 << 11;
+	mmc->max_req_size = PAGE_SIZE;
+	mmc->ocr_avail = MMC_VDD_32_33 | MMC_VDD_33_34;
+	mmc->f_max = get_sclk();
+	mmc->f_min = mmc->f_max >> 9;
+	mmc->caps = MMC_CAP_4_BIT_DATA | MMC_CAP_NEEDS_POLL;
+	host = mmc_priv(mmc);
+	host->mmc = mmc;
+
+	spin_lock_init(&host->lock);
+	host->irq = drv_data->irq_int0;
+	host->dma_ch = drv_data->dma_chan;
+
+	ret = request_dma(host->dma_ch, DRIVER_NAME "DMA");
+	if (ret) {
+		dev_err(&pdev->dev, "unable to request DMA channel\n");
+		goto out1;
+	}
+
+	ret = set_dma_callback(host->dma_ch, sdh_dma_irq, host);
+	if (ret) {
+		dev_err(&pdev->dev, "unable to request DMA irq\n");
+		goto out2;
+	}
+
+	host->sg_cpu = dma_alloc_coherent(&pdev->dev, PAGE_SIZE, &host->sg_dma, GFP_KERNEL);
+	if (host->sg_cpu == NULL) {
+		ret = -ENOMEM;
+		goto out2;
+	}
+
+	platform_set_drvdata(pdev, mmc);
+	mmc_add_host(mmc);
+
+	ret = request_irq(host->irq, sdh_stat_irq, 0, "SDH Status IRQ", host);
+	if (ret) {
+		dev_err(&pdev->dev, "unable to request status irq\n");
+		goto out3;
+	}
+
+	ret = peripheral_request_list(drv_data->pin_req, DRIVER_NAME);
+	if (ret) {
+		dev_err(&pdev->dev, "unable to request peripheral pins\n");
+		goto out4;
+	}
+#if defined(CONFIG_BF54x)
+	/* Secure Digital Host shares DMA with Nand controller */
+	bfin_write_DMAC1_PERIMUX(bfin_read_DMAC1_PERIMUX() | 0x1);
+#endif
+
+	bfin_write_SDH_CFG(bfin_read_SDH_CFG() | CLKS_EN);
+	SSYNC();
+
+	/* Disable card inserting detection pin. set MMC_CAP_NEES_POLL, and
+	 * mmc stack will do the detection.
+	 */
+	bfin_write_SDH_CFG((bfin_read_SDH_CFG() & 0x1F) | (PUP_SDDAT | PUP_SDDAT3));
+	SSYNC();
+
+	return 0;
+
+out4:
+	free_irq(host->irq, host);
+out3:
+	mmc_remove_host(mmc);
+	dma_free_coherent(&pdev->dev, PAGE_SIZE, host->sg_cpu, host->sg_dma);
+out2:
+	free_dma(host->dma_ch);
+out1:
+	mmc_free_host(mmc);
+ out:
+	return ret;
+}
+
+static int __devexit sdh_remove(struct platform_device *pdev)
+{
+	struct mmc_host *mmc = platform_get_drvdata(pdev);
+
+	platform_set_drvdata(pdev, NULL);
+
+	if (mmc) {
+		struct sdh_host *host = mmc_priv(mmc);
+
+		mmc_remove_host(mmc);
+
+		sdh_stop_clock(host);
+		free_irq(host->irq, host);
+		free_dma(host->dma_ch);
+		dma_free_coherent(&pdev->dev, PAGE_SIZE, host->sg_cpu, host->sg_dma);
+
+		mmc_free_host(mmc);
+	}
+
+	return 0;
+}
+
+#ifdef CONFIG_PM
+static int sdh_suspend(struct platform_device *dev, pm_message_t state)
+{
+	struct mmc_host *mmc = platform_get_drvdata(dev);
+	struct bfin_sd_host *drv_data = get_sdh_data(dev);
+	int ret = 0;
+
+	if (mmc)
+		ret = mmc_suspend_host(mmc, state);
+
+	bfin_write_SDH_PWR_CTL(bfin_read_SDH_PWR_CTL() & ~PWR_ON);
+	peripheral_free_list(drv_data->pin_req);
+
+	return ret;
+}
+
+static int sdh_resume(struct platform_device *dev)
+{
+	struct mmc_host *mmc = platform_get_drvdata(dev);
+	struct bfin_sd_host *drv_data = get_sdh_data(dev);
+	int ret = 0;
+
+	ret = peripheral_request_list(drv_data->pin_req, DRIVER_NAME);
+	if (ret) {
+		dev_err(&dev->dev, "unable to request peripheral pins\n");
+		return ret;
+	}
+
+	bfin_write_SDH_PWR_CTL(bfin_read_SDH_PWR_CTL() | PWR_ON);
+#if defined(CONFIG_BF54x)
+	/* Secure Digital Host shares DMA with Nand controller */
+	bfin_write_DMAC1_PERIMUX(bfin_read_DMAC1_PERIMUX() | 0x1);
+#endif
+	bfin_write_SDH_CFG(bfin_read_SDH_CFG() | CLKS_EN);
+	SSYNC();
+
+	bfin_write_SDH_CFG((bfin_read_SDH_CFG() & 0x1F) | (PUP_SDDAT | PUP_SDDAT3));
+	SSYNC();
+
+	if (mmc)
+		ret = mmc_resume_host(mmc);
+
+	return ret;
+}
+#else
+# define sdh_suspend NULL
+# define sdh_resume  NULL
+#endif
+
+static struct platform_driver sdh_driver = {
+	.probe   = sdh_probe,
+	.remove  = __devexit_p(sdh_remove),
+	.suspend = sdh_suspend,
+	.resume  = sdh_resume,
+	.driver  = {
+		.name = DRIVER_NAME,
+	},
+};
+
+static int __init sdh_init(void)
+{
+	return platform_driver_register(&sdh_driver);
+}
+module_init(sdh_init);
+
+static void __exit sdh_exit(void)
+{
+	platform_driver_unregister(&sdh_driver);
+}
+module_exit(sdh_exit);
+
+MODULE_DESCRIPTION("Blackfin Secure Digital Host Driver");
+MODULE_AUTHOR("Cliff Cai, Roy Huang");
+MODULE_LICENSE("GPL");
diff --git a/drivers/mmc/host/davinci_mmc.c b/drivers/mmc/host/davinci_mmc.c
new file mode 100644
index 000000000000..dd45e7c3517e
--- /dev/null
+++ b/drivers/mmc/host/davinci_mmc.c
@@ -0,0 +1,1349 @@
+/*
+ * davinci_mmc.c - TI DaVinci MMC/SD/SDIO driver
+ *
+ * Copyright (C) 2006 Texas Instruments.
+ *       Original author: Purushotam Kumar
+ * Copyright (C) 2009 David Brownell
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include <linux/module.h>
+#include <linux/ioport.h>
+#include <linux/platform_device.h>
+#include <linux/clk.h>
+#include <linux/err.h>
+#include <linux/cpufreq.h>
+#include <linux/mmc/host.h>
+#include <linux/io.h>
+#include <linux/irq.h>
+#include <linux/delay.h>
+#include <linux/dma-mapping.h>
+#include <linux/mmc/mmc.h>
+
+#include <mach/mmc.h>
+#include <mach/edma.h>
+
+/*
+ * Register Definitions
+ */
+#define DAVINCI_MMCCTL       0x00 /* Control Register                  */
+#define DAVINCI_MMCCLK       0x04 /* Memory Clock Control Register     */
+#define DAVINCI_MMCST0       0x08 /* Status Register 0                 */
+#define DAVINCI_MMCST1       0x0C /* Status Register 1                 */
+#define DAVINCI_MMCIM        0x10 /* Interrupt Mask Register           */
+#define DAVINCI_MMCTOR       0x14 /* Response Time-Out Register        */
+#define DAVINCI_MMCTOD       0x18 /* Data Read Time-Out Register       */
+#define DAVINCI_MMCBLEN      0x1C /* Block Length Register             */
+#define DAVINCI_MMCNBLK      0x20 /* Number of Blocks Register         */
+#define DAVINCI_MMCNBLC      0x24 /* Number of Blocks Counter Register */
+#define DAVINCI_MMCDRR       0x28 /* Data Receive Register             */
+#define DAVINCI_MMCDXR       0x2C /* Data Transmit Register            */
+#define DAVINCI_MMCCMD       0x30 /* Command Register                  */
+#define DAVINCI_MMCARGHL     0x34 /* Argument Register                 */
+#define DAVINCI_MMCRSP01     0x38 /* Response Register 0 and 1         */
+#define DAVINCI_MMCRSP23     0x3C /* Response Register 0 and 1         */
+#define DAVINCI_MMCRSP45     0x40 /* Response Register 0 and 1         */
+#define DAVINCI_MMCRSP67     0x44 /* Response Register 0 and 1         */
+#define DAVINCI_MMCDRSP      0x48 /* Data Response Register            */
+#define DAVINCI_MMCETOK      0x4C
+#define DAVINCI_MMCCIDX      0x50 /* Command Index Register            */
+#define DAVINCI_MMCCKC       0x54
+#define DAVINCI_MMCTORC      0x58
+#define DAVINCI_MMCTODC      0x5C
+#define DAVINCI_MMCBLNC      0x60
+#define DAVINCI_SDIOCTL      0x64
+#define DAVINCI_SDIOST0      0x68
+#define DAVINCI_SDIOEN       0x6C
+#define DAVINCI_SDIOST       0x70
+#define DAVINCI_MMCFIFOCTL   0x74 /* FIFO Control Register             */
+
+/* DAVINCI_MMCCTL definitions */
+#define MMCCTL_DATRST         (1 << 0)
+#define MMCCTL_CMDRST         (1 << 1)
+#define MMCCTL_WIDTH_4_BIT    (1 << 2)
+#define MMCCTL_DATEG_DISABLED (0 << 6)
+#define MMCCTL_DATEG_RISING   (1 << 6)
+#define MMCCTL_DATEG_FALLING  (2 << 6)
+#define MMCCTL_DATEG_BOTH     (3 << 6)
+#define MMCCTL_PERMDR_LE      (0 << 9)
+#define MMCCTL_PERMDR_BE      (1 << 9)
+#define MMCCTL_PERMDX_LE      (0 << 10)
+#define MMCCTL_PERMDX_BE      (1 << 10)
+
+/* DAVINCI_MMCCLK definitions */
+#define MMCCLK_CLKEN          (1 << 8)
+#define MMCCLK_CLKRT_MASK     (0xFF << 0)
+
+/* IRQ bit definitions, for DAVINCI_MMCST0 and DAVINCI_MMCIM */
+#define MMCST0_DATDNE         BIT(0)	/* data done */
+#define MMCST0_BSYDNE         BIT(1)	/* busy done */
+#define MMCST0_RSPDNE         BIT(2)	/* command done */
+#define MMCST0_TOUTRD         BIT(3)	/* data read timeout */
+#define MMCST0_TOUTRS         BIT(4)	/* command response timeout */
+#define MMCST0_CRCWR          BIT(5)	/* data write CRC error */
+#define MMCST0_CRCRD          BIT(6)	/* data read CRC error */
+#define MMCST0_CRCRS          BIT(7)	/* command response CRC error */
+#define MMCST0_DXRDY          BIT(9)	/* data transmit ready (fifo empty) */
+#define MMCST0_DRRDY          BIT(10)	/* data receive ready (data in fifo)*/
+#define MMCST0_DATED          BIT(11)	/* DAT3 edge detect */
+#define MMCST0_TRNDNE         BIT(12)	/* transfer done */
+
+/* DAVINCI_MMCST1 definitions */
+#define MMCST1_BUSY           (1 << 0)
+
+/* DAVINCI_MMCCMD definitions */
+#define MMCCMD_CMD_MASK       (0x3F << 0)
+#define MMCCMD_PPLEN          (1 << 7)
+#define MMCCMD_BSYEXP         (1 << 8)
+#define MMCCMD_RSPFMT_MASK    (3 << 9)
+#define MMCCMD_RSPFMT_NONE    (0 << 9)
+#define MMCCMD_RSPFMT_R1456   (1 << 9)
+#define MMCCMD_RSPFMT_R2      (2 << 9)
+#define MMCCMD_RSPFMT_R3      (3 << 9)
+#define MMCCMD_DTRW           (1 << 11)
+#define MMCCMD_STRMTP         (1 << 12)
+#define MMCCMD_WDATX          (1 << 13)
+#define MMCCMD_INITCK         (1 << 14)
+#define MMCCMD_DCLR           (1 << 15)
+#define MMCCMD_DMATRIG        (1 << 16)
+
+/* DAVINCI_MMCFIFOCTL definitions */
+#define MMCFIFOCTL_FIFORST    (1 << 0)
+#define MMCFIFOCTL_FIFODIR_WR (1 << 1)
+#define MMCFIFOCTL_FIFODIR_RD (0 << 1)
+#define MMCFIFOCTL_FIFOLEV    (1 << 2) /* 0 = 128 bits, 1 = 256 bits */
+#define MMCFIFOCTL_ACCWD_4    (0 << 3) /* access width of 4 bytes    */
+#define MMCFIFOCTL_ACCWD_3    (1 << 3) /* access width of 3 bytes    */
+#define MMCFIFOCTL_ACCWD_2    (2 << 3) /* access width of 2 bytes    */
+#define MMCFIFOCTL_ACCWD_1    (3 << 3) /* access width of 1 byte     */
+
+
+/* MMCSD Init clock in Hz in opendrain mode */
+#define MMCSD_INIT_CLOCK		200000
+
+/*
+ * One scatterlist dma "segment" is at most MAX_CCNT rw_threshold units,
+ * and we handle up to NR_SG segments.  MMC_BLOCK_BOUNCE kicks in only
+ * for drivers with max_hw_segs == 1, making the segments bigger (64KB)
+ * than the page or two that's otherwise typical.  NR_SG == 16 gives at
+ * least the same throughput boost, using EDMA transfer linkage instead
+ * of spending CPU time copying pages.
+ */
+#define MAX_CCNT	((1 << 16) - 1)
+
+#define NR_SG		16
+
+static unsigned rw_threshold = 32;
+module_param(rw_threshold, uint, S_IRUGO);
+MODULE_PARM_DESC(rw_threshold,
+		"Read/Write threshold. Default = 32");
+
+static unsigned __initdata use_dma = 1;
+module_param(use_dma, uint, 0);
+MODULE_PARM_DESC(use_dma, "Whether to use DMA or not. Default = 1");
+
+struct mmc_davinci_host {
+	struct mmc_command *cmd;
+	struct mmc_data *data;
+	struct mmc_host *mmc;
+	struct clk *clk;
+	unsigned int mmc_input_clk;
+	void __iomem *base;
+	struct resource *mem_res;
+	int irq;
+	unsigned char bus_mode;
+
+#define DAVINCI_MMC_DATADIR_NONE	0
+#define DAVINCI_MMC_DATADIR_READ	1
+#define DAVINCI_MMC_DATADIR_WRITE	2
+	unsigned char data_dir;
+
+	/* buffer is used during PIO of one scatterlist segment, and
+	 * is updated along with buffer_bytes_left.  bytes_left applies
+	 * to all N blocks of the PIO transfer.
+	 */
+	u8 *buffer;
+	u32 buffer_bytes_left;
+	u32 bytes_left;
+
+	u32 rxdma, txdma;
+	bool use_dma;
+	bool do_dma;
+
+	/* Scatterlist DMA uses one or more parameter RAM entries:
+	 * the main one (associated with rxdma or txdma) plus zero or
+	 * more links.  The entries for a given transfer differ only
+	 * by memory buffer (address, length) and link field.
+	 */
+	struct edmacc_param	tx_template;
+	struct edmacc_param	rx_template;
+	unsigned		n_link;
+	u32			links[NR_SG - 1];
+
+	/* For PIO we walk scatterlists one segment at a time. */
+	unsigned int		sg_len;
+	struct scatterlist *sg;
+
+	/* Version of the MMC/SD controller */
+	u8 version;
+	/* for ns in one cycle calculation */
+	unsigned ns_in_one_cycle;
+#ifdef CONFIG_CPU_FREQ
+	struct notifier_block	freq_transition;
+#endif
+};
+
+
+/* PIO only */
+static void mmc_davinci_sg_to_buf(struct mmc_davinci_host *host)
+{
+	host->buffer_bytes_left = sg_dma_len(host->sg);
+	host->buffer = sg_virt(host->sg);
+	if (host->buffer_bytes_left > host->bytes_left)
+		host->buffer_bytes_left = host->bytes_left;
+}
+
+static void davinci_fifo_data_trans(struct mmc_davinci_host *host,
+					unsigned int n)
+{
+	u8 *p;
+	unsigned int i;
+
+	if (host->buffer_bytes_left == 0) {
+		host->sg = sg_next(host->data->sg);
+		mmc_davinci_sg_to_buf(host);
+	}
+
+	p = host->buffer;
+	if (n > host->buffer_bytes_left)
+		n = host->buffer_bytes_left;
+	host->buffer_bytes_left -= n;
+	host->bytes_left -= n;
+
+	/* NOTE:  we never transfer more than rw_threshold bytes
+	 * to/from the fifo here; there's no I/O overlap.
+	 * This also assumes that access width( i.e. ACCWD) is 4 bytes
+	 */
+	if (host->data_dir == DAVINCI_MMC_DATADIR_WRITE) {
+		for (i = 0; i < (n >> 2); i++) {
+			writel(*((u32 *)p), host->base + DAVINCI_MMCDXR);
+			p = p + 4;
+		}
+		if (n & 3) {
+			iowrite8_rep(host->base + DAVINCI_MMCDXR, p, (n & 3));
+			p = p + (n & 3);
+		}
+	} else {
+		for (i = 0; i < (n >> 2); i++) {
+			*((u32 *)p) = readl(host->base + DAVINCI_MMCDRR);
+			p  = p + 4;
+		}
+		if (n & 3) {
+			ioread8_rep(host->base + DAVINCI_MMCDRR, p, (n & 3));
+			p = p + (n & 3);
+		}
+	}
+	host->buffer = p;
+}
+
+static void mmc_davinci_start_command(struct mmc_davinci_host *host,
+		struct mmc_command *cmd)
+{
+	u32 cmd_reg = 0;
+	u32 im_val;
+
+	dev_dbg(mmc_dev(host->mmc), "CMD%d, arg 0x%08x%s\n",
+		cmd->opcode, cmd->arg,
+		({ char *s;
+		switch (mmc_resp_type(cmd)) {
+		case MMC_RSP_R1:
+			s = ", R1/R5/R6/R7 response";
+			break;
+		case MMC_RSP_R1B:
+			s = ", R1b response";
+			break;
+		case MMC_RSP_R2:
+			s = ", R2 response";
+			break;
+		case MMC_RSP_R3:
+			s = ", R3/R4 response";
+			break;
+		default:
+			s = ", (R? response)";
+			break;
+		}; s; }));
+	host->cmd = cmd;
+
+	switch (mmc_resp_type(cmd)) {
+	case MMC_RSP_R1B:
+		/* There's some spec confusion about when R1B is
+		 * allowed, but if the card doesn't issue a BUSY
+		 * then it's harmless for us to allow it.
+		 */
+		cmd_reg |= MMCCMD_BSYEXP;
+		/* FALLTHROUGH */
+	case MMC_RSP_R1:		/* 48 bits, CRC */
+		cmd_reg |= MMCCMD_RSPFMT_R1456;
+		break;
+	case MMC_RSP_R2:		/* 136 bits, CRC */
+		cmd_reg |= MMCCMD_RSPFMT_R2;
+		break;
+	case MMC_RSP_R3:		/* 48 bits, no CRC */
+		cmd_reg |= MMCCMD_RSPFMT_R3;
+		break;
+	default:
+		cmd_reg |= MMCCMD_RSPFMT_NONE;
+		dev_dbg(mmc_dev(host->mmc), "unknown resp_type %04x\n",
+			mmc_resp_type(cmd));
+		break;
+	}
+
+	/* Set command index */
+	cmd_reg |= cmd->opcode;
+
+	/* Enable EDMA transfer triggers */
+	if (host->do_dma)
+		cmd_reg |= MMCCMD_DMATRIG;
+
+	if (host->version == MMC_CTLR_VERSION_2 && host->data != NULL &&
+			host->data_dir == DAVINCI_MMC_DATADIR_READ)
+		cmd_reg |= MMCCMD_DMATRIG;
+
+	/* Setting whether command involves data transfer or not */
+	if (cmd->data)
+		cmd_reg |= MMCCMD_WDATX;
+
+	/* Setting whether stream or block transfer */
+	if (cmd->flags & MMC_DATA_STREAM)
+		cmd_reg |= MMCCMD_STRMTP;
+
+	/* Setting whether data read or write */
+	if (host->data_dir == DAVINCI_MMC_DATADIR_WRITE)
+		cmd_reg |= MMCCMD_DTRW;
+
+	if (host->bus_mode == MMC_BUSMODE_PUSHPULL)
+		cmd_reg |= MMCCMD_PPLEN;
+
+	/* set Command timeout */
+	writel(0x1FFF, host->base + DAVINCI_MMCTOR);
+
+	/* Enable interrupt (calculate here, defer until FIFO is stuffed). */
+	im_val =  MMCST0_RSPDNE | MMCST0_CRCRS | MMCST0_TOUTRS;
+	if (host->data_dir == DAVINCI_MMC_DATADIR_WRITE) {
+		im_val |= MMCST0_DATDNE | MMCST0_CRCWR;
+
+		if (!host->do_dma)
+			im_val |= MMCST0_DXRDY;
+	} else if (host->data_dir == DAVINCI_MMC_DATADIR_READ) {
+		im_val |= MMCST0_DATDNE | MMCST0_CRCRD | MMCST0_TOUTRD;
+
+		if (!host->do_dma)
+			im_val |= MMCST0_DRRDY;
+	}
+
+	/*
+	 * Before non-DMA WRITE commands the controller needs priming:
+	 * FIFO should be populated with 32 bytes i.e. whatever is the FIFO size
+	 */
+	if (!host->do_dma && (host->data_dir == DAVINCI_MMC_DATADIR_WRITE))
+		davinci_fifo_data_trans(host, rw_threshold);
+
+	writel(cmd->arg, host->base + DAVINCI_MMCARGHL);
+	writel(cmd_reg,  host->base + DAVINCI_MMCCMD);
+	writel(im_val, host->base + DAVINCI_MMCIM);
+}
+
+/*----------------------------------------------------------------------*/
+
+/* DMA infrastructure */
+
+static void davinci_abort_dma(struct mmc_davinci_host *host)
+{
+	int sync_dev;
+
+	if (host->data_dir == DAVINCI_MMC_DATADIR_READ)
+		sync_dev = host->rxdma;
+	else
+		sync_dev = host->txdma;
+
+	edma_stop(sync_dev);
+	edma_clean_channel(sync_dev);
+}
+
+static void
+mmc_davinci_xfer_done(struct mmc_davinci_host *host, struct mmc_data *data);
+
+static void mmc_davinci_dma_cb(unsigned channel, u16 ch_status, void *data)
+{
+	if (DMA_COMPLETE != ch_status) {
+		struct mmc_davinci_host *host = data;
+
+		/* Currently means:  DMA Event Missed, or "null" transfer
+		 * request was seen.  In the future, TC errors (like bad
+		 * addresses) might be presented too.
+		 */
+		dev_warn(mmc_dev(host->mmc), "DMA %s error\n",
+			(host->data->flags & MMC_DATA_WRITE)
+				? "write" : "read");
+		host->data->error = -EIO;
+		mmc_davinci_xfer_done(host, host->data);
+	}
+}
+
+/* Set up tx or rx template, to be modified and updated later */
+static void __init mmc_davinci_dma_setup(struct mmc_davinci_host *host,
+		bool tx, struct edmacc_param *template)
+{
+	unsigned	sync_dev;
+	const u16	acnt = 4;
+	const u16	bcnt = rw_threshold >> 2;
+	const u16	ccnt = 0;
+	u32		src_port = 0;
+	u32		dst_port = 0;
+	s16		src_bidx, dst_bidx;
+	s16		src_cidx, dst_cidx;
+
+	/*
+	 * A-B Sync transfer:  each DMA request is for one "frame" of
+	 * rw_threshold bytes, broken into "acnt"-size chunks repeated
+	 * "bcnt" times.  Each segment needs "ccnt" such frames; since
+	 * we tell the block layer our mmc->max_seg_size limit, we can
+	 * trust (later) that it's within bounds.
+	 *
+	 * The FIFOs are read/written in 4-byte chunks (acnt == 4) and
+	 * EDMA will optimize memory operations to use larger bursts.
+	 */
+	if (tx) {
+		sync_dev = host->txdma;
+
+		/* src_prt, ccnt, and link to be set up later */
+		src_bidx = acnt;
+		src_cidx = acnt * bcnt;
+
+		dst_port = host->mem_res->start + DAVINCI_MMCDXR;
+		dst_bidx = 0;
+		dst_cidx = 0;
+	} else {
+		sync_dev = host->rxdma;
+
+		src_port = host->mem_res->start + DAVINCI_MMCDRR;
+		src_bidx = 0;
+		src_cidx = 0;
+
+		/* dst_prt, ccnt, and link to be set up later */
+		dst_bidx = acnt;
+		dst_cidx = acnt * bcnt;
+	}
+
+	/*
+	 * We can't use FIFO mode for the FIFOs because MMC FIFO addresses
+	 * are not 256-bit (32-byte) aligned.  So we use INCR, and the W8BIT
+	 * parameter is ignored.
+	 */
+	edma_set_src(sync_dev, src_port, INCR, W8BIT);
+	edma_set_dest(sync_dev, dst_port, INCR, W8BIT);
+
+	edma_set_src_index(sync_dev, src_bidx, src_cidx);
+	edma_set_dest_index(sync_dev, dst_bidx, dst_cidx);
+
+	edma_set_transfer_params(sync_dev, acnt, bcnt, ccnt, 8, ABSYNC);
+
+	edma_read_slot(sync_dev, template);
+
+	/* don't bother with irqs or chaining */
+	template->opt |= EDMA_CHAN_SLOT(sync_dev) << 12;
+}
+
+static void mmc_davinci_send_dma_request(struct mmc_davinci_host *host,
+		struct mmc_data *data)
+{
+	struct edmacc_param	*template;
+	int			channel, slot;
+	unsigned		link;
+	struct scatterlist	*sg;
+	unsigned		sg_len;
+	unsigned		bytes_left = host->bytes_left;
+	const unsigned		shift = ffs(rw_threshold) - 1;;
+
+	if (host->data_dir == DAVINCI_MMC_DATADIR_WRITE) {
+		template = &host->tx_template;
+		channel = host->txdma;
+	} else {
+		template = &host->rx_template;
+		channel = host->rxdma;
+	}
+
+	/* We know sg_len and ccnt will never be out of range because
+	 * we told the mmc layer which in turn tells the block layer
+	 * to ensure that it only hands us one scatterlist segment
+	 * per EDMA PARAM entry.  Update the PARAM
+	 * entries needed for each segment of this scatterlist.
+	 */
+	for (slot = channel, link = 0, sg = data->sg, sg_len = host->sg_len;
+			sg_len-- != 0 && bytes_left;
+			sg = sg_next(sg), slot = host->links[link++]) {
+		u32		buf = sg_dma_address(sg);
+		unsigned	count = sg_dma_len(sg);
+
+		template->link_bcntrld = sg_len
+				? (EDMA_CHAN_SLOT(host->links[link]) << 5)
+				: 0xffff;
+
+		if (count > bytes_left)
+			count = bytes_left;
+		bytes_left -= count;
+
+		if (host->data_dir == DAVINCI_MMC_DATADIR_WRITE)
+			template->src = buf;
+		else
+			template->dst = buf;
+		template->ccnt = count >> shift;
+
+		edma_write_slot(slot, template);
+	}
+
+	if (host->version == MMC_CTLR_VERSION_2)
+		edma_clear_event(channel);
+
+	edma_start(channel);
+}
+
+static int mmc_davinci_start_dma_transfer(struct mmc_davinci_host *host,
+		struct mmc_data *data)
+{
+	int i;
+	int mask = rw_threshold - 1;
+
+	host->sg_len = dma_map_sg(mmc_dev(host->mmc), data->sg, data->sg_len,
+				((data->flags & MMC_DATA_WRITE)
+				? DMA_TO_DEVICE
+				: DMA_FROM_DEVICE));
+
+	/* no individual DMA segment should need a partial FIFO */
+	for (i = 0; i < host->sg_len; i++) {
+		if (sg_dma_len(data->sg + i) & mask) {
+			dma_unmap_sg(mmc_dev(host->mmc),
+					data->sg, data->sg_len,
+					(data->flags & MMC_DATA_WRITE)
+					? DMA_TO_DEVICE
+					: DMA_FROM_DEVICE);
+			return -1;
+		}
+	}
+
+	host->do_dma = 1;
+	mmc_davinci_send_dma_request(host, data);
+
+	return 0;
+}
+
+static void __init_or_module
+davinci_release_dma_channels(struct mmc_davinci_host *host)
+{
+	unsigned	i;
+
+	if (!host->use_dma)
+		return;
+
+	for (i = 0; i < host->n_link; i++)
+		edma_free_slot(host->links[i]);
+
+	edma_free_channel(host->txdma);
+	edma_free_channel(host->rxdma);
+}
+
+static int __init davinci_acquire_dma_channels(struct mmc_davinci_host *host)
+{
+	int r, i;
+
+	/* Acquire master DMA write channel */
+	r = edma_alloc_channel(host->txdma, mmc_davinci_dma_cb, host,
+			EVENTQ_DEFAULT);
+	if (r < 0) {
+		dev_warn(mmc_dev(host->mmc), "alloc %s channel err %d\n",
+				"tx", r);
+		return r;
+	}
+	mmc_davinci_dma_setup(host, true, &host->tx_template);
+
+	/* Acquire master DMA read channel */
+	r = edma_alloc_channel(host->rxdma, mmc_davinci_dma_cb, host,
+			EVENTQ_DEFAULT);
+	if (r < 0) {
+		dev_warn(mmc_dev(host->mmc), "alloc %s channel err %d\n",
+				"rx", r);
+		goto free_master_write;
+	}
+	mmc_davinci_dma_setup(host, false, &host->rx_template);
+
+	/* Allocate parameter RAM slots, which will later be bound to a
+	 * channel as needed to handle a scatterlist.
+	 */
+	for (i = 0; i < ARRAY_SIZE(host->links); i++) {
+		r = edma_alloc_slot(EDMA_CTLR(host->txdma), EDMA_SLOT_ANY);
+		if (r < 0) {
+			dev_dbg(mmc_dev(host->mmc), "dma PaRAM alloc --> %d\n",
+				r);
+			break;
+		}
+		host->links[i] = r;
+	}
+	host->n_link = i;
+
+	return 0;
+
+free_master_write:
+	edma_free_channel(host->txdma);
+
+	return r;
+}
+
+/*----------------------------------------------------------------------*/
+
+static void
+mmc_davinci_prepare_data(struct mmc_davinci_host *host, struct mmc_request *req)
+{
+	int fifo_lev = (rw_threshold == 32) ? MMCFIFOCTL_FIFOLEV : 0;
+	int timeout;
+	struct mmc_data *data = req->data;
+
+	if (host->version == MMC_CTLR_VERSION_2)
+		fifo_lev = (rw_threshold == 64) ? MMCFIFOCTL_FIFOLEV : 0;
+
+	host->data = data;
+	if (data == NULL) {
+		host->data_dir = DAVINCI_MMC_DATADIR_NONE;
+		writel(0, host->base + DAVINCI_MMCBLEN);
+		writel(0, host->base + DAVINCI_MMCNBLK);
+		return;
+	}
+
+	dev_dbg(mmc_dev(host->mmc), "%s %s, %d blocks of %d bytes\n",
+		(data->flags & MMC_DATA_STREAM) ? "stream" : "block",
+		(data->flags & MMC_DATA_WRITE) ? "write" : "read",
+		data->blocks, data->blksz);
+	dev_dbg(mmc_dev(host->mmc), "  DTO %d cycles + %d ns\n",
+		data->timeout_clks, data->timeout_ns);
+	timeout = data->timeout_clks +
+		(data->timeout_ns / host->ns_in_one_cycle);
+	if (timeout > 0xffff)
+		timeout = 0xffff;
+
+	writel(timeout, host->base + DAVINCI_MMCTOD);
+	writel(data->blocks, host->base + DAVINCI_MMCNBLK);
+	writel(data->blksz, host->base + DAVINCI_MMCBLEN);
+
+	/* Configure the FIFO */
+	switch (data->flags & MMC_DATA_WRITE) {
+	case MMC_DATA_WRITE:
+		host->data_dir = DAVINCI_MMC_DATADIR_WRITE;
+		writel(fifo_lev | MMCFIFOCTL_FIFODIR_WR | MMCFIFOCTL_FIFORST,
+			host->base + DAVINCI_MMCFIFOCTL);
+		writel(fifo_lev | MMCFIFOCTL_FIFODIR_WR,
+			host->base + DAVINCI_MMCFIFOCTL);
+		break;
+
+	default:
+		host->data_dir = DAVINCI_MMC_DATADIR_READ;
+		writel(fifo_lev | MMCFIFOCTL_FIFODIR_RD | MMCFIFOCTL_FIFORST,
+			host->base + DAVINCI_MMCFIFOCTL);
+		writel(fifo_lev | MMCFIFOCTL_FIFODIR_RD,
+			host->base + DAVINCI_MMCFIFOCTL);
+		break;
+	}
+
+	host->buffer = NULL;
+	host->bytes_left = data->blocks * data->blksz;
+
+	/* For now we try to use DMA whenever we won't need partial FIFO
+	 * reads or writes, either for the whole transfer (as tested here)
+	 * or for any individual scatterlist segment (tested when we call
+	 * start_dma_transfer).
+	 *
+	 * While we *could* change that, unusual block sizes are rarely
+	 * used.  The occasional fallback to PIO should't hurt.
+	 */
+	if (host->use_dma && (host->bytes_left & (rw_threshold - 1)) == 0
+			&& mmc_davinci_start_dma_transfer(host, data) == 0) {
+		/* zero this to ensure we take no PIO paths */
+		host->bytes_left = 0;
+	} else {
+		/* Revert to CPU Copy */
+		host->sg_len = data->sg_len;
+		host->sg = host->data->sg;
+		mmc_davinci_sg_to_buf(host);
+	}
+}
+
+static void mmc_davinci_request(struct mmc_host *mmc, struct mmc_request *req)
+{
+	struct mmc_davinci_host *host = mmc_priv(mmc);
+	unsigned long timeout = jiffies + msecs_to_jiffies(900);
+	u32 mmcst1 = 0;
+
+	/* Card may still be sending BUSY after a previous operation,
+	 * typically some kind of write.  If so, we can't proceed yet.
+	 */
+	while (time_before(jiffies, timeout)) {
+		mmcst1  = readl(host->base + DAVINCI_MMCST1);
+		if (!(mmcst1 & MMCST1_BUSY))
+			break;
+		cpu_relax();
+	}
+	if (mmcst1 & MMCST1_BUSY) {
+		dev_err(mmc_dev(host->mmc), "still BUSY? bad ... \n");
+		req->cmd->error = -ETIMEDOUT;
+		mmc_request_done(mmc, req);
+		return;
+	}
+
+	host->do_dma = 0;
+	mmc_davinci_prepare_data(host, req);
+	mmc_davinci_start_command(host, req->cmd);
+}
+
+static unsigned int calculate_freq_for_card(struct mmc_davinci_host *host,
+	unsigned int mmc_req_freq)
+{
+	unsigned int mmc_freq = 0, mmc_pclk = 0, mmc_push_pull_divisor = 0;
+
+	mmc_pclk = host->mmc_input_clk;
+	if (mmc_req_freq && mmc_pclk > (2 * mmc_req_freq))
+		mmc_push_pull_divisor = ((unsigned int)mmc_pclk
+				/ (2 * mmc_req_freq)) - 1;
+	else
+		mmc_push_pull_divisor = 0;
+
+	mmc_freq = (unsigned int)mmc_pclk
+		/ (2 * (mmc_push_pull_divisor + 1));
+
+	if (mmc_freq > mmc_req_freq)
+		mmc_push_pull_divisor = mmc_push_pull_divisor + 1;
+	/* Convert ns to clock cycles */
+	if (mmc_req_freq <= 400000)
+		host->ns_in_one_cycle = (1000000) / (((mmc_pclk
+				/ (2 * (mmc_push_pull_divisor + 1)))/1000));
+	else
+		host->ns_in_one_cycle = (1000000) / (((mmc_pclk
+				/ (2 * (mmc_push_pull_divisor + 1)))/1000000));
+
+	return mmc_push_pull_divisor;
+}
+
+static void calculate_clk_divider(struct mmc_host *mmc, struct mmc_ios *ios)
+{
+	unsigned int open_drain_freq = 0, mmc_pclk = 0;
+	unsigned int mmc_push_pull_freq = 0;
+	struct mmc_davinci_host *host = mmc_priv(mmc);
+
+	if (ios->bus_mode == MMC_BUSMODE_OPENDRAIN) {
+		u32 temp;
+
+		/* Ignoring the init clock value passed for fixing the inter
+		 * operability with different cards.
+		 */
+		open_drain_freq = ((unsigned int)mmc_pclk
+				/ (2 * MMCSD_INIT_CLOCK)) - 1;
+
+		if (open_drain_freq > 0xFF)
+			open_drain_freq = 0xFF;
+
+		temp = readl(host->base + DAVINCI_MMCCLK) & ~MMCCLK_CLKRT_MASK;
+		temp |= open_drain_freq;
+		writel(temp, host->base + DAVINCI_MMCCLK);
+
+		/* Convert ns to clock cycles */
+		host->ns_in_one_cycle = (1000000) / (MMCSD_INIT_CLOCK/1000);
+	} else {
+		u32 temp;
+		mmc_push_pull_freq = calculate_freq_for_card(host, ios->clock);
+
+		if (mmc_push_pull_freq > 0xFF)
+			mmc_push_pull_freq = 0xFF;
+
+		temp = readl(host->base + DAVINCI_MMCCLK) & ~MMCCLK_CLKEN;
+		writel(temp, host->base + DAVINCI_MMCCLK);
+
+		udelay(10);
+
+		temp = readl(host->base + DAVINCI_MMCCLK) & ~MMCCLK_CLKRT_MASK;
+		temp |= mmc_push_pull_freq;
+		writel(temp, host->base + DAVINCI_MMCCLK);
+
+		writel(temp | MMCCLK_CLKEN, host->base + DAVINCI_MMCCLK);
+
+		udelay(10);
+	}
+}
+
+static void mmc_davinci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
+{
+	unsigned int mmc_pclk = 0;
+	struct mmc_davinci_host *host = mmc_priv(mmc);
+
+	mmc_pclk = host->mmc_input_clk;
+	dev_dbg(mmc_dev(host->mmc),
+		"clock %dHz busmode %d powermode %d Vdd %04x\n",
+		ios->clock, ios->bus_mode, ios->power_mode,
+		ios->vdd);
+	if (ios->bus_width == MMC_BUS_WIDTH_4) {
+		dev_dbg(mmc_dev(host->mmc), "Enabling 4 bit mode\n");
+		writel(readl(host->base + DAVINCI_MMCCTL) | MMCCTL_WIDTH_4_BIT,
+			host->base + DAVINCI_MMCCTL);
+	} else {
+		dev_dbg(mmc_dev(host->mmc), "Disabling 4 bit mode\n");
+		writel(readl(host->base + DAVINCI_MMCCTL) & ~MMCCTL_WIDTH_4_BIT,
+			host->base + DAVINCI_MMCCTL);
+	}
+
+	calculate_clk_divider(mmc, ios);
+
+	host->bus_mode = ios->bus_mode;
+	if (ios->power_mode == MMC_POWER_UP) {
+		unsigned long timeout = jiffies + msecs_to_jiffies(50);
+		bool lose = true;
+
+		/* Send clock cycles, poll completion */
+		writel(0, host->base + DAVINCI_MMCARGHL);
+		writel(MMCCMD_INITCK, host->base + DAVINCI_MMCCMD);
+		while (time_before(jiffies, timeout)) {
+			u32 tmp = readl(host->base + DAVINCI_MMCST0);
+
+			if (tmp & MMCST0_RSPDNE) {
+				lose = false;
+				break;
+			}
+			cpu_relax();
+		}
+		if (lose)
+			dev_warn(mmc_dev(host->mmc), "powerup timeout\n");
+	}
+
+	/* FIXME on power OFF, reset things ... */
+}
+
+static void
+mmc_davinci_xfer_done(struct mmc_davinci_host *host, struct mmc_data *data)
+{
+	host->data = NULL;
+
+	if (host->do_dma) {
+		davinci_abort_dma(host);
+
+		dma_unmap_sg(mmc_dev(host->mmc), data->sg, data->sg_len,
+			     (data->flags & MMC_DATA_WRITE)
+			     ? DMA_TO_DEVICE
+			     : DMA_FROM_DEVICE);
+		host->do_dma = false;
+	}
+	host->data_dir = DAVINCI_MMC_DATADIR_NONE;
+
+	if (!data->stop || (host->cmd && host->cmd->error)) {
+		mmc_request_done(host->mmc, data->mrq);
+		writel(0, host->base + DAVINCI_MMCIM);
+	} else
+		mmc_davinci_start_command(host, data->stop);
+}
+
+static void mmc_davinci_cmd_done(struct mmc_davinci_host *host,
+				 struct mmc_command *cmd)
+{
+	host->cmd = NULL;
+
+	if (cmd->flags & MMC_RSP_PRESENT) {
+		if (cmd->flags & MMC_RSP_136) {
+			/* response type 2 */
+			cmd->resp[3] = readl(host->base + DAVINCI_MMCRSP01);
+			cmd->resp[2] = readl(host->base + DAVINCI_MMCRSP23);
+			cmd->resp[1] = readl(host->base + DAVINCI_MMCRSP45);
+			cmd->resp[0] = readl(host->base + DAVINCI_MMCRSP67);
+		} else {
+			/* response types 1, 1b, 3, 4, 5, 6 */
+			cmd->resp[0] = readl(host->base + DAVINCI_MMCRSP67);
+		}
+	}
+
+	if (host->data == NULL || cmd->error) {
+		if (cmd->error == -ETIMEDOUT)
+			cmd->mrq->cmd->retries = 0;
+		mmc_request_done(host->mmc, cmd->mrq);
+		writel(0, host->base + DAVINCI_MMCIM);
+	}
+}
+
+static void
+davinci_abort_data(struct mmc_davinci_host *host, struct mmc_data *data)
+{
+	u32 temp;
+
+	/* reset command and data state machines */
+	temp = readl(host->base + DAVINCI_MMCCTL);
+	writel(temp | MMCCTL_CMDRST | MMCCTL_DATRST,
+		host->base + DAVINCI_MMCCTL);
+
+	temp &= ~(MMCCTL_CMDRST | MMCCTL_DATRST);
+	udelay(10);
+	writel(temp, host->base + DAVINCI_MMCCTL);
+}
+
+static irqreturn_t mmc_davinci_irq(int irq, void *dev_id)
+{
+	struct mmc_davinci_host *host = (struct mmc_davinci_host *)dev_id;
+	unsigned int status, qstatus;
+	int end_command = 0;
+	int end_transfer = 0;
+	struct mmc_data *data = host->data;
+
+	if (host->cmd == NULL && host->data == NULL) {
+		status = readl(host->base + DAVINCI_MMCST0);
+		dev_dbg(mmc_dev(host->mmc),
+			"Spurious interrupt 0x%04x\n", status);
+		/* Disable the interrupt from mmcsd */
+		writel(0, host->base + DAVINCI_MMCIM);
+		return IRQ_NONE;
+	}
+
+	status = readl(host->base + DAVINCI_MMCST0);
+	qstatus = status;
+
+	/* handle FIFO first when using PIO for data.
+	 * bytes_left will decrease to zero as I/O progress and status will
+	 * read zero over iteration because this controller status
+	 * register(MMCST0) reports any status only once and it is cleared
+	 * by read. So, it is not unbouned loop even in the case of
+	 * non-dma.
+	 */
+	while (host->bytes_left && (status & (MMCST0_DXRDY | MMCST0_DRRDY))) {
+		davinci_fifo_data_trans(host, rw_threshold);
+		status = readl(host->base + DAVINCI_MMCST0);
+		if (!status)
+			break;
+		qstatus |= status;
+	}
+
+	if (qstatus & MMCST0_DATDNE) {
+		/* All blocks sent/received, and CRC checks passed */
+		if (data != NULL) {
+			if ((host->do_dma == 0) && (host->bytes_left > 0)) {
+				/* if datasize < rw_threshold
+				 * no RX ints are generated
+				 */
+				davinci_fifo_data_trans(host, host->bytes_left);
+			}
+			end_transfer = 1;
+			data->bytes_xfered = data->blocks * data->blksz;
+		} else {
+			dev_err(mmc_dev(host->mmc),
+					"DATDNE with no host->data\n");
+		}
+	}
+
+	if (qstatus & MMCST0_TOUTRD) {
+		/* Read data timeout */
+		data->error = -ETIMEDOUT;
+		end_transfer = 1;
+
+		dev_dbg(mmc_dev(host->mmc),
+			"read data timeout, status %x\n",
+			qstatus);
+
+		davinci_abort_data(host, data);
+	}
+
+	if (qstatus & (MMCST0_CRCWR | MMCST0_CRCRD)) {
+		/* Data CRC error */
+		data->error = -EILSEQ;
+		end_transfer = 1;
+
+		/* NOTE:  this controller uses CRCWR to report both CRC
+		 * errors and timeouts (on writes).  MMCDRSP values are
+		 * only weakly documented, but 0x9f was clearly a timeout
+		 * case and the two three-bit patterns in various SD specs
+		 * (101, 010) aren't part of it ...
+		 */
+		if (qstatus & MMCST0_CRCWR) {
+			u32 temp = readb(host->base + DAVINCI_MMCDRSP);
+
+			if (temp == 0x9f)
+				data->error = -ETIMEDOUT;
+		}
+		dev_dbg(mmc_dev(host->mmc), "data %s %s error\n",
+			(qstatus & MMCST0_CRCWR) ? "write" : "read",
+			(data->error == -ETIMEDOUT) ? "timeout" : "CRC");
+
+		davinci_abort_data(host, data);
+	}
+
+	if (qstatus & MMCST0_TOUTRS) {
+		/* Command timeout */
+		if (host->cmd) {
+			dev_dbg(mmc_dev(host->mmc),
+				"CMD%d timeout, status %x\n",
+				host->cmd->opcode, qstatus);
+			host->cmd->error = -ETIMEDOUT;
+			if (data) {
+				end_transfer = 1;
+				davinci_abort_data(host, data);
+			} else
+				end_command = 1;
+		}
+	}
+
+	if (qstatus & MMCST0_CRCRS) {
+		/* Command CRC error */
+		dev_dbg(mmc_dev(host->mmc), "Command CRC error\n");
+		if (host->cmd) {
+			host->cmd->error = -EILSEQ;
+			end_command = 1;
+		}
+	}
+
+	if (qstatus & MMCST0_RSPDNE) {
+		/* End of command phase */
+		end_command = (int) host->cmd;
+	}
+
+	if (end_command)
+		mmc_davinci_cmd_done(host, host->cmd);
+	if (end_transfer)
+		mmc_davinci_xfer_done(host, data);
+	return IRQ_HANDLED;
+}
+
+static int mmc_davinci_get_cd(struct mmc_host *mmc)
+{
+	struct platform_device *pdev = to_platform_device(mmc->parent);
+	struct davinci_mmc_config *config = pdev->dev.platform_data;
+
+	if (!config || !config->get_cd)
+		return -ENOSYS;
+	return config->get_cd(pdev->id);
+}
+
+static int mmc_davinci_get_ro(struct mmc_host *mmc)
+{
+	struct platform_device *pdev = to_platform_device(mmc->parent);
+	struct davinci_mmc_config *config = pdev->dev.platform_data;
+
+	if (!config || !config->get_ro)
+		return -ENOSYS;
+	return config->get_ro(pdev->id);
+}
+
+static struct mmc_host_ops mmc_davinci_ops = {
+	.request	= mmc_davinci_request,
+	.set_ios	= mmc_davinci_set_ios,
+	.get_cd		= mmc_davinci_get_cd,
+	.get_ro		= mmc_davinci_get_ro,
+};
+
+/*----------------------------------------------------------------------*/
+
+#ifdef CONFIG_CPU_FREQ
+static int mmc_davinci_cpufreq_transition(struct notifier_block *nb,
+				     unsigned long val, void *data)
+{
+	struct mmc_davinci_host *host;
+	unsigned int mmc_pclk;
+	struct mmc_host *mmc;
+	unsigned long flags;
+
+	host = container_of(nb, struct mmc_davinci_host, freq_transition);
+	mmc = host->mmc;
+	mmc_pclk = clk_get_rate(host->clk);
+
+	if (val == CPUFREQ_POSTCHANGE) {
+		spin_lock_irqsave(&mmc->lock, flags);
+		host->mmc_input_clk = mmc_pclk;
+		calculate_clk_divider(mmc, &mmc->ios);
+		spin_unlock_irqrestore(&mmc->lock, flags);
+	}
+
+	return 0;
+}
+
+static inline int mmc_davinci_cpufreq_register(struct mmc_davinci_host *host)
+{
+	host->freq_transition.notifier_call = mmc_davinci_cpufreq_transition;
+
+	return cpufreq_register_notifier(&host->freq_transition,
+					 CPUFREQ_TRANSITION_NOTIFIER);
+}
+
+static inline void mmc_davinci_cpufreq_deregister(struct mmc_davinci_host *host)
+{
+	cpufreq_unregister_notifier(&host->freq_transition,
+				    CPUFREQ_TRANSITION_NOTIFIER);
+}
+#else
+static inline int mmc_davinci_cpufreq_register(struct mmc_davinci_host *host)
+{
+	return 0;
+}
+
+static inline void mmc_davinci_cpufreq_deregister(struct mmc_davinci_host *host)
+{
+}
+#endif
+static void __init init_mmcsd_host(struct mmc_davinci_host *host)
+{
+	/* DAT line portion is diabled and in reset state */
+	writel(readl(host->base + DAVINCI_MMCCTL) | MMCCTL_DATRST,
+		host->base + DAVINCI_MMCCTL);
+
+	/* CMD line portion is diabled and in reset state */
+	writel(readl(host->base + DAVINCI_MMCCTL) | MMCCTL_CMDRST,
+		host->base + DAVINCI_MMCCTL);
+
+	udelay(10);
+
+	writel(0, host->base + DAVINCI_MMCCLK);
+	writel(MMCCLK_CLKEN, host->base + DAVINCI_MMCCLK);
+
+	writel(0x1FFF, host->base + DAVINCI_MMCTOR);
+	writel(0xFFFF, host->base + DAVINCI_MMCTOD);
+
+	writel(readl(host->base + DAVINCI_MMCCTL) & ~MMCCTL_DATRST,
+		host->base + DAVINCI_MMCCTL);
+	writel(readl(host->base + DAVINCI_MMCCTL) & ~MMCCTL_CMDRST,
+		host->base + DAVINCI_MMCCTL);
+
+	udelay(10);
+}
+
+static int __init davinci_mmcsd_probe(struct platform_device *pdev)
+{
+	struct davinci_mmc_config *pdata = pdev->dev.platform_data;
+	struct mmc_davinci_host *host = NULL;
+	struct mmc_host *mmc = NULL;
+	struct resource *r, *mem = NULL;
+	int ret = 0, irq = 0;
+	size_t mem_size;
+
+	/* REVISIT:  when we're fully converted, fail if pdata is NULL */
+
+	ret = -ENODEV;
+	r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	irq = platform_get_irq(pdev, 0);
+	if (!r || irq == NO_IRQ)
+		goto out;
+
+	ret = -EBUSY;
+	mem_size = resource_size(r);
+	mem = request_mem_region(r->start, mem_size, pdev->name);
+	if (!mem)
+		goto out;
+
+	ret = -ENOMEM;
+	mmc = mmc_alloc_host(sizeof(struct mmc_davinci_host), &pdev->dev);
+	if (!mmc)
+		goto out;
+
+	host = mmc_priv(mmc);
+	host->mmc = mmc;	/* Important */
+
+	r = platform_get_resource(pdev, IORESOURCE_DMA, 0);
+	if (!r)
+		goto out;
+	host->rxdma = r->start;
+
+	r = platform_get_resource(pdev, IORESOURCE_DMA, 1);
+	if (!r)
+		goto out;
+	host->txdma = r->start;
+
+	host->mem_res = mem;
+	host->base = ioremap(mem->start, mem_size);
+	if (!host->base)
+		goto out;
+
+	ret = -ENXIO;
+	host->clk = clk_get(&pdev->dev, "MMCSDCLK");
+	if (IS_ERR(host->clk)) {
+		ret = PTR_ERR(host->clk);
+		goto out;
+	}
+	clk_enable(host->clk);
+	host->mmc_input_clk = clk_get_rate(host->clk);
+
+	init_mmcsd_host(host);
+
+	host->use_dma = use_dma;
+	host->irq = irq;
+
+	if (host->use_dma && davinci_acquire_dma_channels(host) != 0)
+		host->use_dma = 0;
+
+	/* REVISIT:  someday, support IRQ-driven card detection.  */
+	mmc->caps |= MMC_CAP_NEEDS_POLL;
+
+	if (!pdata || pdata->wires == 4 || pdata->wires == 0)
+		mmc->caps |= MMC_CAP_4_BIT_DATA;
+
+	host->version = pdata->version;
+
+	mmc->ops = &mmc_davinci_ops;
+	mmc->f_min = 312500;
+	mmc->f_max = 25000000;
+	if (pdata && pdata->max_freq)
+		mmc->f_max = pdata->max_freq;
+	if (pdata && pdata->caps)
+		mmc->caps |= pdata->caps;
+	mmc->ocr_avail = MMC_VDD_32_33 | MMC_VDD_33_34;
+
+	/* With no iommu coalescing pages, each phys_seg is a hw_seg.
+	 * Each hw_seg uses one EDMA parameter RAM slot, always one
+	 * channel and then usually some linked slots.
+	 */
+	mmc->max_hw_segs	= 1 + host->n_link;
+	mmc->max_phys_segs	= mmc->max_hw_segs;
+
+	/* EDMA limit per hw segment (one or two MBytes) */
+	mmc->max_seg_size	= MAX_CCNT * rw_threshold;
+
+	/* MMC/SD controller limits for multiblock requests */
+	mmc->max_blk_size	= 4095;  /* BLEN is 12 bits */
+	mmc->max_blk_count	= 65535; /* NBLK is 16 bits */
+	mmc->max_req_size	= mmc->max_blk_size * mmc->max_blk_count;
+
+	dev_dbg(mmc_dev(host->mmc), "max_phys_segs=%d\n", mmc->max_phys_segs);
+	dev_dbg(mmc_dev(host->mmc), "max_hw_segs=%d\n", mmc->max_hw_segs);
+	dev_dbg(mmc_dev(host->mmc), "max_blk_size=%d\n", mmc->max_blk_size);
+	dev_dbg(mmc_dev(host->mmc), "max_req_size=%d\n", mmc->max_req_size);
+	dev_dbg(mmc_dev(host->mmc), "max_seg_size=%d\n", mmc->max_seg_size);
+
+	platform_set_drvdata(pdev, host);
+
+	ret = mmc_davinci_cpufreq_register(host);
+	if (ret) {
+		dev_err(&pdev->dev, "failed to register cpufreq\n");
+		goto cpu_freq_fail;
+	}
+
+	ret = mmc_add_host(mmc);
+	if (ret < 0)
+		goto out;
+
+	ret = request_irq(irq, mmc_davinci_irq, 0, mmc_hostname(mmc), host);
+	if (ret)
+		goto out;
+
+	rename_region(mem, mmc_hostname(mmc));
+
+	dev_info(mmc_dev(host->mmc), "Using %s, %d-bit mode\n",
+		host->use_dma ? "DMA" : "PIO",
+		(mmc->caps & MMC_CAP_4_BIT_DATA) ? 4 : 1);
+
+	return 0;
+
+out:
+	mmc_davinci_cpufreq_deregister(host);
+cpu_freq_fail:
+	if (host) {
+		davinci_release_dma_channels(host);
+
+		if (host->clk) {
+			clk_disable(host->clk);
+			clk_put(host->clk);
+		}
+
+		if (host->base)
+			iounmap(host->base);
+	}
+
+	if (mmc)
+		mmc_free_host(mmc);
+
+	if (mem)
+		release_resource(mem);
+
+	dev_dbg(&pdev->dev, "probe err %d\n", ret);
+
+	return ret;
+}
+
+static int __exit davinci_mmcsd_remove(struct platform_device *pdev)
+{
+	struct mmc_davinci_host *host = platform_get_drvdata(pdev);
+
+	platform_set_drvdata(pdev, NULL);
+	if (host) {
+		mmc_davinci_cpufreq_deregister(host);
+
+		mmc_remove_host(host->mmc);
+		free_irq(host->irq, host);
+
+		davinci_release_dma_channels(host);
+
+		clk_disable(host->clk);
+		clk_put(host->clk);
+
+		iounmap(host->base);
+
+		release_resource(host->mem_res);
+
+		mmc_free_host(host->mmc);
+	}
+
+	return 0;
+}
+
+#ifdef CONFIG_PM
+static int davinci_mmcsd_suspend(struct platform_device *pdev, pm_message_t msg)
+{
+	struct mmc_davinci_host *host = platform_get_drvdata(pdev);
+
+	return mmc_suspend_host(host->mmc, msg);
+}
+
+static int davinci_mmcsd_resume(struct platform_device *pdev)
+{
+	struct mmc_davinci_host *host = platform_get_drvdata(pdev);
+
+	return mmc_resume_host(host->mmc);
+}
+#else
+#define davinci_mmcsd_suspend	NULL
+#define davinci_mmcsd_resume	NULL
+#endif
+
+static struct platform_driver davinci_mmcsd_driver = {
+	.driver		= {
+		.name	= "davinci_mmc",
+		.owner	= THIS_MODULE,
+	},
+	.remove		= __exit_p(davinci_mmcsd_remove),
+	.suspend	= davinci_mmcsd_suspend,
+	.resume		= davinci_mmcsd_resume,
+};
+
+static int __init davinci_mmcsd_init(void)
+{
+	return platform_driver_probe(&davinci_mmcsd_driver,
+				     davinci_mmcsd_probe);
+}
+module_init(davinci_mmcsd_init);
+
+static void __exit davinci_mmcsd_exit(void)
+{
+	platform_driver_unregister(&davinci_mmcsd_driver);
+}
+module_exit(davinci_mmcsd_exit);
+
+MODULE_AUTHOR("Texas Instruments India");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("MMC/SD driver for Davinci MMC controller");
+
diff --git a/drivers/mmc/host/msm_sdcc.c b/drivers/mmc/host/msm_sdcc.c
index dba4600bcdb4..b31946e0b4ca 100644
--- a/drivers/mmc/host/msm_sdcc.c
+++ b/drivers/mmc/host/msm_sdcc.c
@@ -38,10 +38,9 @@
 #include <asm/div64.h>
 #include <asm/sizes.h>
 
-#include <asm/mach/mmc.h>
+#include <mach/mmc.h>
 #include <mach/msm_iomap.h>
 #include <mach/dma.h>
-#include <mach/htc_pwrsink.h>
 
 #include "msm_sdcc.h"
 
@@ -775,13 +774,11 @@ msmsdcc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
 
 	switch (ios->power_mode) {
 	case MMC_POWER_OFF:
-		htc_pwrsink_set(PWRSINK_SDCARD, 0);
 		break;
 	case MMC_POWER_UP:
 		pwr |= MCI_PWR_UP;
 		break;
 	case MMC_POWER_ON:
-		htc_pwrsink_set(PWRSINK_SDCARD, 100);
 		pwr |= MCI_PWR_ON;
 		break;
 	}
diff --git a/drivers/mmc/host/mxcmmc.c b/drivers/mmc/host/mxcmmc.c
index 88671529c45d..60a2b69e54f5 100644
--- a/drivers/mmc/host/mxcmmc.c
+++ b/drivers/mmc/host/mxcmmc.c
@@ -679,17 +679,17 @@ static int mxcmci_probe(struct platform_device *pdev)
 {
 	struct mmc_host *mmc;
 	struct mxcmci_host *host = NULL;
-	struct resource *r;
+	struct resource *iores, *r;
 	int ret = 0, irq;
 
 	printk(KERN_INFO "i.MX SDHC driver\n");
 
-	r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	iores = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 	irq = platform_get_irq(pdev, 0);
-	if (!r || irq < 0)
+	if (!iores || irq < 0)
 		return -EINVAL;
 
-	r = request_mem_region(r->start, resource_size(r), pdev->name);
+	r = request_mem_region(iores->start, resource_size(iores), pdev->name);
 	if (!r)
 		return -EBUSY;
 
@@ -809,7 +809,7 @@ out_iounmap:
 out_free:
 	mmc_free_host(mmc);
 out_release_mem:
-	release_mem_region(host->res->start, resource_size(host->res));
+	release_mem_region(iores->start, resource_size(iores));
 	return ret;
 }
 
diff --git a/drivers/mmc/host/of_mmc_spi.c b/drivers/mmc/host/of_mmc_spi.c
index 0c44d560bf1a..0c7a63c1f12f 100644
--- a/drivers/mmc/host/of_mmc_spi.c
+++ b/drivers/mmc/host/of_mmc_spi.c
@@ -22,6 +22,8 @@
 #include <linux/mmc/core.h>
 #include <linux/mmc/host.h>
 
+MODULE_LICENSE("GPL");
+
 enum {
 	CD_GPIO = 0,
 	WP_GPIO,
diff --git a/drivers/mmc/host/omap.c b/drivers/mmc/host/omap.c
index 5f970e253e50..c6d7e8ecadbf 100644
--- a/drivers/mmc/host/omap.c
+++ b/drivers/mmc/host/omap.c
@@ -1459,8 +1459,10 @@ static int __init mmc_omap_probe(struct platform_device *pdev)
 		goto err_ioremap;
 
 	host->iclk = clk_get(&pdev->dev, "ick");
-	if (IS_ERR(host->iclk))
+	if (IS_ERR(host->iclk)) {
+		ret = PTR_ERR(host->iclk);
 		goto err_free_mmc_host;
+	}
 	clk_enable(host->iclk);
 
 	host->fclk = clk_get(&pdev->dev, "fck");
@@ -1500,10 +1502,8 @@ err_free_irq:
 err_free_fclk:
 	clk_put(host->fclk);
 err_free_iclk:
-	if (host->iclk != NULL) {
-		clk_disable(host->iclk);
-		clk_put(host->iclk);
-	}
+	clk_disable(host->iclk);
+	clk_put(host->iclk);
 err_free_mmc_host:
 	iounmap(host->virt_base);
 err_ioremap:
diff --git a/drivers/mmc/host/pxamci.c b/drivers/mmc/host/pxamci.c
index bb47ff465c04..0d783f3e79ed 100644
--- a/drivers/mmc/host/pxamci.c
+++ b/drivers/mmc/host/pxamci.c
@@ -828,7 +828,7 @@ static int pxamci_resume(struct device *dev)
 	return ret;
 }
 
-static struct dev_pm_ops pxamci_pm_ops = {
+static const struct dev_pm_ops pxamci_pm_ops = {
 	.suspend	= pxamci_suspend,
 	.resume		= pxamci_resume,
 };
diff --git a/drivers/mmc/host/s3cmci.c b/drivers/mmc/host/s3cmci.c
index 99b74a351020..d96e1abf2d64 100644
--- a/drivers/mmc/host/s3cmci.c
+++ b/drivers/mmc/host/s3cmci.c
@@ -820,7 +820,7 @@ fail_request:
 static void finalize_request(struct s3cmci_host *host)
 {
 	struct mmc_request *mrq = host->mrq;
-	struct mmc_command *cmd = host->cmd_is_stop ? mrq->stop : mrq->cmd;
+	struct mmc_command *cmd;
 	int debug_as_failure = 0;
 
 	if (host->complete_what != COMPLETION_FINALIZE)
@@ -828,6 +828,7 @@ static void finalize_request(struct s3cmci_host *host)
 
 	if (!mrq)
 		return;
+	cmd = host->cmd_is_stop ? mrq->stop : mrq->cmd;
 
 	if (cmd->data && (cmd->error == 0) &&
 	    (cmd->data->error == 0)) {
@@ -1302,10 +1303,8 @@ static int s3cmci_get_ro(struct mmc_host *mmc)
 	if (pdata->no_wprotect)
 		return 0;
 
-	ret = s3c2410_gpio_getpin(pdata->gpio_wprotect);
-
-	if (pdata->wprotect_invert)
-		ret = !ret;
+	ret = gpio_get_value(pdata->gpio_wprotect) ? 1 : 0;
+	ret ^= pdata->wprotect_invert;
 
 	return ret;
 }
@@ -1360,7 +1359,7 @@ static struct mmc_host_ops s3cmci_ops = {
 
 static struct s3c24xx_mci_pdata s3cmci_def_pdata = {
 	/* This is currently here to avoid a number of if (host->pdata)
-	 * checks. Any zero fields to ensure reaonable defaults are picked. */
+	 * checks. Any zero fields to ensure reasonable defaults are picked. */
 };
 
 #ifdef CONFIG_CPU_FREQ
@@ -1654,7 +1653,7 @@ static int __devinit s3cmci_probe(struct platform_device *pdev)
 			goto probe_free_irq;
 		}
 
-		host->irq_cd = s3c2410_gpio_getirq(host->pdata->gpio_detect);
+		host->irq_cd = gpio_to_irq(host->pdata->gpio_detect);
 
 		if (host->irq_cd >= 0) {
 			if (request_irq(host->irq_cd, s3cmci_irq_cd,
@@ -1892,7 +1891,7 @@ static int s3cmci_resume(struct device *dev)
 	return mmc_resume_host(mmc);
 }
 
-static struct dev_pm_ops s3cmci_pm = {
+static const struct dev_pm_ops s3cmci_pm = {
 	.suspend	= s3cmci_suspend,
 	.resume		= s3cmci_resume,
 };
diff --git a/drivers/mmc/host/sdhci-of.c b/drivers/mmc/host/sdhci-of-core.c
index 01ab916c2802..55e33135edb4 100644
--- a/drivers/mmc/host/sdhci-of.c
+++ b/drivers/mmc/host/sdhci-of-core.c
@@ -22,62 +22,37 @@
 #include <linux/of_platform.h>
 #include <linux/mmc/host.h>
 #include <asm/machdep.h>
+#include "sdhci-of.h"
 #include "sdhci.h"
 
-struct sdhci_of_data {
-	unsigned int quirks;
-	struct sdhci_ops ops;
-};
-
-struct sdhci_of_host {
-	unsigned int clock;
-	u16 xfer_mode_shadow;
-};
+#ifdef CONFIG_MMC_SDHCI_BIG_ENDIAN_32BIT_BYTE_SWAPPER
 
 /*
- * Ops and quirks for the Freescale eSDHC controller.
+ * These accessors are designed for big endian hosts doing I/O to
+ * little endian controllers incorporating a 32-bit hardware byte swapper.
  */
 
-#define ESDHC_DMA_SYSCTL	0x40c
-#define ESDHC_DMA_SNOOP		0x00000040
-
-#define ESDHC_SYSTEM_CONTROL	0x2c
-#define ESDHC_CLOCK_MASK	0x0000fff0
-#define ESDHC_PREDIV_SHIFT	8
-#define ESDHC_DIVIDER_SHIFT	4
-#define ESDHC_CLOCK_PEREN	0x00000004
-#define ESDHC_CLOCK_HCKEN	0x00000002
-#define ESDHC_CLOCK_IPGEN	0x00000001
-
-#define ESDHC_HOST_CONTROL_RES	0x05
-
-static u32 esdhc_readl(struct sdhci_host *host, int reg)
+u32 sdhci_be32bs_readl(struct sdhci_host *host, int reg)
 {
 	return in_be32(host->ioaddr + reg);
 }
 
-static u16 esdhc_readw(struct sdhci_host *host, int reg)
+u16 sdhci_be32bs_readw(struct sdhci_host *host, int reg)
 {
-	u16 ret;
-
-	if (unlikely(reg == SDHCI_HOST_VERSION))
-		ret = in_be16(host->ioaddr + reg);
-	else
-		ret = in_be16(host->ioaddr + (reg ^ 0x2));
-	return ret;
+	return in_be16(host->ioaddr + (reg ^ 0x2));
 }
 
-static u8 esdhc_readb(struct sdhci_host *host, int reg)
+u8 sdhci_be32bs_readb(struct sdhci_host *host, int reg)
 {
 	return in_8(host->ioaddr + (reg ^ 0x3));
 }
 
-static void esdhc_writel(struct sdhci_host *host, u32 val, int reg)
+void sdhci_be32bs_writel(struct sdhci_host *host, u32 val, int reg)
 {
 	out_be32(host->ioaddr + reg, val);
 }
 
-static void esdhc_writew(struct sdhci_host *host, u16 val, int reg)
+void sdhci_be32bs_writew(struct sdhci_host *host, u16 val, int reg)
 {
 	struct sdhci_of_host *of_host = sdhci_priv(host);
 	int base = reg & ~0x3;
@@ -92,106 +67,21 @@ static void esdhc_writew(struct sdhci_host *host, u16 val, int reg)
 		of_host->xfer_mode_shadow = val;
 		return;
 	case SDHCI_COMMAND:
-		esdhc_writel(host, val << 16 | of_host->xfer_mode_shadow,
-			     SDHCI_TRANSFER_MODE);
+		sdhci_be32bs_writel(host, val << 16 | of_host->xfer_mode_shadow,
+				    SDHCI_TRANSFER_MODE);
 		return;
-	case SDHCI_BLOCK_SIZE:
-		/*
-		 * Two last DMA bits are reserved, and first one is used for
-		 * non-standard blksz of 4096 bytes that we don't support
-		 * yet. So clear the DMA boundary bits.
-		 */
-		val &= ~SDHCI_MAKE_BLKSZ(0x7, 0);
-		/* fall through */
 	}
 	clrsetbits_be32(host->ioaddr + base, 0xffff << shift, val << shift);
 }
 
-static void esdhc_writeb(struct sdhci_host *host, u8 val, int reg)
+void sdhci_be32bs_writeb(struct sdhci_host *host, u8 val, int reg)
 {
 	int base = reg & ~0x3;
 	int shift = (reg & 0x3) * 8;
 
-	/* Prevent SDHCI core from writing reserved bits (e.g. HISPD). */
-	if (reg == SDHCI_HOST_CONTROL)
-		val &= ~ESDHC_HOST_CONTROL_RES;
-
 	clrsetbits_be32(host->ioaddr + base , 0xff << shift, val << shift);
 }
-
-static void esdhc_set_clock(struct sdhci_host *host, unsigned int clock)
-{
-	int pre_div = 2;
-	int div = 1;
-
-	clrbits32(host->ioaddr + ESDHC_SYSTEM_CONTROL, ESDHC_CLOCK_IPGEN |
-		  ESDHC_CLOCK_HCKEN | ESDHC_CLOCK_PEREN | ESDHC_CLOCK_MASK);
-
-	if (clock == 0)
-		goto out;
-
-	while (host->max_clk / pre_div / 16 > clock && pre_div < 256)
-		pre_div *= 2;
-
-	while (host->max_clk / pre_div / div > clock && div < 16)
-		div++;
-
-	dev_dbg(mmc_dev(host->mmc), "desired SD clock: %d, actual: %d\n",
-		clock, host->max_clk / pre_div / div);
-
-	pre_div >>= 1;
-	div--;
-
-	setbits32(host->ioaddr + ESDHC_SYSTEM_CONTROL, ESDHC_CLOCK_IPGEN |
-		  ESDHC_CLOCK_HCKEN | ESDHC_CLOCK_PEREN |
-		  div << ESDHC_DIVIDER_SHIFT | pre_div << ESDHC_PREDIV_SHIFT);
-	mdelay(100);
-out:
-	host->clock = clock;
-}
-
-static int esdhc_enable_dma(struct sdhci_host *host)
-{
-	setbits32(host->ioaddr + ESDHC_DMA_SYSCTL, ESDHC_DMA_SNOOP);
-	return 0;
-}
-
-static unsigned int esdhc_get_max_clock(struct sdhci_host *host)
-{
-	struct sdhci_of_host *of_host = sdhci_priv(host);
-
-	return of_host->clock;
-}
-
-static unsigned int esdhc_get_min_clock(struct sdhci_host *host)
-{
-	struct sdhci_of_host *of_host = sdhci_priv(host);
-
-	return of_host->clock / 256 / 16;
-}
-
-static struct sdhci_of_data sdhci_esdhc = {
-	.quirks = SDHCI_QUIRK_FORCE_BLK_SZ_2048 |
-		  SDHCI_QUIRK_BROKEN_CARD_DETECTION |
-		  SDHCI_QUIRK_NO_BUSY_IRQ |
-		  SDHCI_QUIRK_NONSTANDARD_CLOCK |
-		  SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK |
-		  SDHCI_QUIRK_PIO_NEEDS_DELAY |
-		  SDHCI_QUIRK_RESTORE_IRQS_AFTER_RESET |
-		  SDHCI_QUIRK_NO_CARD_NO_RESET,
-	.ops = {
-		.readl = esdhc_readl,
-		.readw = esdhc_readw,
-		.readb = esdhc_readb,
-		.writel = esdhc_writel,
-		.writew = esdhc_writew,
-		.writeb = esdhc_writeb,
-		.set_clock = esdhc_set_clock,
-		.enable_dma = esdhc_enable_dma,
-		.get_max_clock = esdhc_get_max_clock,
-		.get_min_clock = esdhc_get_min_clock,
-	},
-};
+#endif /* CONFIG_MMC_SDHCI_BIG_ENDIAN_32BIT_BYTE_SWAPPER */
 
 #ifdef CONFIG_PM
 
@@ -301,9 +191,14 @@ static int __devexit sdhci_of_remove(struct of_device *ofdev)
 }
 
 static const struct of_device_id sdhci_of_match[] = {
+#ifdef CONFIG_MMC_SDHCI_OF_ESDHC
 	{ .compatible = "fsl,mpc8379-esdhc", .data = &sdhci_esdhc, },
 	{ .compatible = "fsl,mpc8536-esdhc", .data = &sdhci_esdhc, },
 	{ .compatible = "fsl,esdhc", .data = &sdhci_esdhc, },
+#endif
+#ifdef CONFIG_MMC_SDHCI_OF_HLWD
+	{ .compatible = "nintendo,hollywood-sdhci", .data = &sdhci_hlwd, },
+#endif
 	{ .compatible = "generic-sdhci", },
 	{},
 };
diff --git a/drivers/mmc/host/sdhci-of-esdhc.c b/drivers/mmc/host/sdhci-of-esdhc.c
new file mode 100644
index 000000000000..d5b11a17e648
--- /dev/null
+++ b/drivers/mmc/host/sdhci-of-esdhc.c
@@ -0,0 +1,143 @@
+/*
+ * Freescale eSDHC controller driver.
+ *
+ * Copyright (c) 2007 Freescale Semiconductor, Inc.
+ * Copyright (c) 2009 MontaVista Software, Inc.
+ *
+ * Authors: Xiaobo Xie <X.Xie@freescale.com>
+ *	    Anton Vorontsov <avorontsov@ru.mvista.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or (at
+ * your option) any later version.
+ */
+
+#include <linux/io.h>
+#include <linux/delay.h>
+#include <linux/mmc/host.h>
+#include "sdhci-of.h"
+#include "sdhci.h"
+
+/*
+ * Ops and quirks for the Freescale eSDHC controller.
+ */
+
+#define ESDHC_DMA_SYSCTL	0x40c
+#define ESDHC_DMA_SNOOP		0x00000040
+
+#define ESDHC_SYSTEM_CONTROL	0x2c
+#define ESDHC_CLOCK_MASK	0x0000fff0
+#define ESDHC_PREDIV_SHIFT	8
+#define ESDHC_DIVIDER_SHIFT	4
+#define ESDHC_CLOCK_PEREN	0x00000004
+#define ESDHC_CLOCK_HCKEN	0x00000002
+#define ESDHC_CLOCK_IPGEN	0x00000001
+
+#define ESDHC_HOST_CONTROL_RES	0x05
+
+static u16 esdhc_readw(struct sdhci_host *host, int reg)
+{
+	u16 ret;
+
+	if (unlikely(reg == SDHCI_HOST_VERSION))
+		ret = in_be16(host->ioaddr + reg);
+	else
+		ret = sdhci_be32bs_readw(host, reg);
+	return ret;
+}
+
+static void esdhc_writew(struct sdhci_host *host, u16 val, int reg)
+{
+	if (reg == SDHCI_BLOCK_SIZE) {
+		/*
+		 * Two last DMA bits are reserved, and first one is used for
+		 * non-standard blksz of 4096 bytes that we don't support
+		 * yet. So clear the DMA boundary bits.
+		 */
+		val &= ~SDHCI_MAKE_BLKSZ(0x7, 0);
+	}
+	sdhci_be32bs_writew(host, val, reg);
+}
+
+static void esdhc_writeb(struct sdhci_host *host, u8 val, int reg)
+{
+	/* Prevent SDHCI core from writing reserved bits (e.g. HISPD). */
+	if (reg == SDHCI_HOST_CONTROL)
+		val &= ~ESDHC_HOST_CONTROL_RES;
+	sdhci_be32bs_writeb(host, val, reg);
+}
+
+static void esdhc_set_clock(struct sdhci_host *host, unsigned int clock)
+{
+	int pre_div = 2;
+	int div = 1;
+
+	clrbits32(host->ioaddr + ESDHC_SYSTEM_CONTROL, ESDHC_CLOCK_IPGEN |
+		  ESDHC_CLOCK_HCKEN | ESDHC_CLOCK_PEREN | ESDHC_CLOCK_MASK);
+
+	if (clock == 0)
+		goto out;
+
+	while (host->max_clk / pre_div / 16 > clock && pre_div < 256)
+		pre_div *= 2;
+
+	while (host->max_clk / pre_div / div > clock && div < 16)
+		div++;
+
+	dev_dbg(mmc_dev(host->mmc), "desired SD clock: %d, actual: %d\n",
+		clock, host->max_clk / pre_div / div);
+
+	pre_div >>= 1;
+	div--;
+
+	setbits32(host->ioaddr + ESDHC_SYSTEM_CONTROL, ESDHC_CLOCK_IPGEN |
+		  ESDHC_CLOCK_HCKEN | ESDHC_CLOCK_PEREN |
+		  div << ESDHC_DIVIDER_SHIFT | pre_div << ESDHC_PREDIV_SHIFT);
+	mdelay(100);
+out:
+	host->clock = clock;
+}
+
+static int esdhc_enable_dma(struct sdhci_host *host)
+{
+	setbits32(host->ioaddr + ESDHC_DMA_SYSCTL, ESDHC_DMA_SNOOP);
+	return 0;
+}
+
+static unsigned int esdhc_get_max_clock(struct sdhci_host *host)
+{
+	struct sdhci_of_host *of_host = sdhci_priv(host);
+
+	return of_host->clock;
+}
+
+static unsigned int esdhc_get_min_clock(struct sdhci_host *host)
+{
+	struct sdhci_of_host *of_host = sdhci_priv(host);
+
+	return of_host->clock / 256 / 16;
+}
+
+struct sdhci_of_data sdhci_esdhc = {
+	.quirks = SDHCI_QUIRK_FORCE_BLK_SZ_2048 |
+		  SDHCI_QUIRK_BROKEN_CARD_DETECTION |
+		  SDHCI_QUIRK_NO_BUSY_IRQ |
+		  SDHCI_QUIRK_NONSTANDARD_CLOCK |
+		  SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK |
+		  SDHCI_QUIRK_PIO_NEEDS_DELAY |
+		  SDHCI_QUIRK_RESTORE_IRQS_AFTER_RESET |
+		  SDHCI_QUIRK_NO_CARD_NO_RESET,
+	.ops = {
+		.readl = sdhci_be32bs_readl,
+		.readw = esdhc_readw,
+		.readb = sdhci_be32bs_readb,
+		.writel = sdhci_be32bs_writel,
+		.writew = esdhc_writew,
+		.writeb = esdhc_writeb,
+		.set_clock = esdhc_set_clock,
+		.enable_dma = esdhc_enable_dma,
+		.get_max_clock = esdhc_get_max_clock,
+		.get_min_clock = esdhc_get_min_clock,
+	},
+};
diff --git a/drivers/mmc/host/sdhci-of-hlwd.c b/drivers/mmc/host/sdhci-of-hlwd.c
new file mode 100644
index 000000000000..35117f3ed757
--- /dev/null
+++ b/drivers/mmc/host/sdhci-of-hlwd.c
@@ -0,0 +1,65 @@
+/*
+ * drivers/mmc/host/sdhci-of-hlwd.c
+ *
+ * Nintendo Wii Secure Digital Host Controller Interface.
+ * Copyright (C) 2009 The GameCube Linux Team
+ * Copyright (C) 2009 Albert Herranz
+ *
+ * Based on sdhci-of-esdhc.c
+ *
+ * Copyright (c) 2007 Freescale Semiconductor, Inc.
+ * Copyright (c) 2009 MontaVista Software, Inc.
+ *
+ * Authors: Xiaobo Xie <X.Xie@freescale.com>
+ *	    Anton Vorontsov <avorontsov@ru.mvista.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or (at
+ * your option) any later version.
+ */
+
+#include <linux/delay.h>
+#include <linux/mmc/host.h>
+#include "sdhci-of.h"
+#include "sdhci.h"
+
+/*
+ * Ops and quirks for the Nintendo Wii SDHCI controllers.
+ */
+
+/*
+ * We need a small delay after each write, or things go horribly wrong.
+ */
+#define SDHCI_HLWD_WRITE_DELAY	5 /* usecs */
+
+static void sdhci_hlwd_writel(struct sdhci_host *host, u32 val, int reg)
+{
+	sdhci_be32bs_writel(host, val, reg);
+	udelay(SDHCI_HLWD_WRITE_DELAY);
+}
+
+static void sdhci_hlwd_writew(struct sdhci_host *host, u16 val, int reg)
+{
+	sdhci_be32bs_writew(host, val, reg);
+	udelay(SDHCI_HLWD_WRITE_DELAY);
+}
+
+static void sdhci_hlwd_writeb(struct sdhci_host *host, u8 val, int reg)
+{
+	sdhci_be32bs_writeb(host, val, reg);
+	udelay(SDHCI_HLWD_WRITE_DELAY);
+}
+
+struct sdhci_of_data sdhci_hlwd = {
+	.quirks = SDHCI_QUIRK_32BIT_DMA_ADDR |
+		  SDHCI_QUIRK_32BIT_DMA_SIZE,
+	.ops = {
+		.readl = sdhci_be32bs_readl,
+		.readw = sdhci_be32bs_readw,
+		.readb = sdhci_be32bs_readb,
+		.writel = sdhci_hlwd_writel,
+		.writew = sdhci_hlwd_writew,
+		.writeb = sdhci_hlwd_writeb,
+	},
+};
diff --git a/drivers/mmc/host/sdhci-of.h b/drivers/mmc/host/sdhci-of.h
new file mode 100644
index 000000000000..ad09ad9915d8
--- /dev/null
+++ b/drivers/mmc/host/sdhci-of.h
@@ -0,0 +1,42 @@
+/*
+ * OpenFirmware bindings for Secure Digital Host Controller Interface.
+ *
+ * Copyright (c) 2007 Freescale Semiconductor, Inc.
+ * Copyright (c) 2009 MontaVista Software, Inc.
+ *
+ * Authors: Xiaobo Xie <X.Xie@freescale.com>
+ *	    Anton Vorontsov <avorontsov@ru.mvista.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or (at
+ * your option) any later version.
+ */
+
+#ifndef __SDHCI_OF_H
+#define __SDHCI_OF_H
+
+#include <linux/types.h>
+#include "sdhci.h"
+
+struct sdhci_of_data {
+	unsigned int quirks;
+	struct sdhci_ops ops;
+};
+
+struct sdhci_of_host {
+	unsigned int clock;
+	u16 xfer_mode_shadow;
+};
+
+extern u32 sdhci_be32bs_readl(struct sdhci_host *host, int reg);
+extern u16 sdhci_be32bs_readw(struct sdhci_host *host, int reg);
+extern u8 sdhci_be32bs_readb(struct sdhci_host *host, int reg);
+extern void sdhci_be32bs_writel(struct sdhci_host *host, u32 val, int reg);
+extern void sdhci_be32bs_writew(struct sdhci_host *host, u16 val, int reg);
+extern void sdhci_be32bs_writeb(struct sdhci_host *host, u8 val, int reg);
+
+extern struct sdhci_of_data sdhci_esdhc;
+extern struct sdhci_of_data sdhci_hlwd;
+
+#endif /* __SDHCI_OF_H */
diff --git a/drivers/mmc/host/sdhci-pci.c b/drivers/mmc/host/sdhci-pci.c
index e0356644d1aa..5c3a1767770a 100644
--- a/drivers/mmc/host/sdhci-pci.c
+++ b/drivers/mmc/host/sdhci-pci.c
@@ -285,6 +285,73 @@ static const struct sdhci_pci_fixes sdhci_jmicron = {
 	.resume		= jmicron_resume,
 };
 
+/* SysKonnect CardBus2SDIO extra registers */
+#define SYSKT_CTRL		0x200
+#define SYSKT_RDFIFO_STAT	0x204
+#define SYSKT_WRFIFO_STAT	0x208
+#define SYSKT_POWER_DATA	0x20c
+#define   SYSKT_POWER_330	0xef
+#define   SYSKT_POWER_300	0xf8
+#define   SYSKT_POWER_184	0xcc
+#define SYSKT_POWER_CMD		0x20d
+#define   SYSKT_POWER_START	(1 << 7)
+#define SYSKT_POWER_STATUS	0x20e
+#define   SYSKT_POWER_STATUS_OK	(1 << 0)
+#define SYSKT_BOARD_REV		0x210
+#define SYSKT_CHIP_REV		0x211
+#define SYSKT_CONF_DATA		0x212
+#define   SYSKT_CONF_DATA_1V8	(1 << 2)
+#define   SYSKT_CONF_DATA_2V5	(1 << 1)
+#define   SYSKT_CONF_DATA_3V3	(1 << 0)
+
+static int syskt_probe(struct sdhci_pci_chip *chip)
+{
+	if ((chip->pdev->class & 0x0000FF) == PCI_SDHCI_IFVENDOR) {
+		chip->pdev->class &= ~0x0000FF;
+		chip->pdev->class |= PCI_SDHCI_IFDMA;
+	}
+	return 0;
+}
+
+static int syskt_probe_slot(struct sdhci_pci_slot *slot)
+{
+	int tm, ps;
+
+	u8 board_rev = readb(slot->host->ioaddr + SYSKT_BOARD_REV);
+	u8  chip_rev = readb(slot->host->ioaddr + SYSKT_CHIP_REV);
+	dev_info(&slot->chip->pdev->dev, "SysKonnect CardBus2SDIO, "
+					 "board rev %d.%d, chip rev %d.%d\n",
+					 board_rev >> 4, board_rev & 0xf,
+					 chip_rev >> 4,  chip_rev & 0xf);
+	if (chip_rev >= 0x20)
+		slot->host->quirks |= SDHCI_QUIRK_FORCE_DMA;
+
+	writeb(SYSKT_POWER_330, slot->host->ioaddr + SYSKT_POWER_DATA);
+	writeb(SYSKT_POWER_START, slot->host->ioaddr + SYSKT_POWER_CMD);
+	udelay(50);
+	tm = 10;  /* Wait max 1 ms */
+	do {
+		ps = readw(slot->host->ioaddr + SYSKT_POWER_STATUS);
+		if (ps & SYSKT_POWER_STATUS_OK)
+			break;
+		udelay(100);
+	} while (--tm);
+	if (!tm) {
+		dev_err(&slot->chip->pdev->dev,
+			"power regulator never stabilized");
+		writeb(0, slot->host->ioaddr + SYSKT_POWER_CMD);
+		return -ENODEV;
+	}
+
+	return 0;
+}
+
+static const struct sdhci_pci_fixes sdhci_syskt = {
+	.quirks		= SDHCI_QUIRK_NO_SIMULT_VDD_AND_POWER,
+	.probe		= syskt_probe,
+	.probe_slot	= syskt_probe_slot,
+};
+
 static int via_probe(struct sdhci_pci_chip *chip)
 {
 	if (chip->pdev->revision == 0x10)
@@ -363,6 +430,14 @@ static const struct pci_device_id pci_ids[] __devinitdata = {
 	},
 
 	{
+		.vendor		= PCI_VENDOR_ID_SYSKONNECT,
+		.device		= 0x8000,
+		.subvendor	= PCI_ANY_ID,
+		.subdevice	= PCI_ANY_ID,
+		.driver_data	= (kernel_ulong_t)&sdhci_syskt,
+	},
+
+	{
 		.vendor		= PCI_VENDOR_ID_VIA,
 		.device		= 0x95d0,
 		.subvendor	= PCI_ANY_ID,
diff --git a/drivers/mmc/host/sdhci.h b/drivers/mmc/host/sdhci.h
index ce5f1d73dc04..842f46f94284 100644
--- a/drivers/mmc/host/sdhci.h
+++ b/drivers/mmc/host/sdhci.h
@@ -8,6 +8,8 @@
  * the Free Software Foundation; either version 2 of the License, or (at
  * your option) any later version.
  */
+#ifndef __SDHCI_H
+#define __SDHCI_H
 
 #include <linux/scatterlist.h>
 #include <linux/compiler.h>
@@ -408,3 +410,5 @@ extern void sdhci_remove_host(struct sdhci_host *host, int dead);
 extern int sdhci_suspend_host(struct sdhci_host *host, pm_message_t state);
 extern int sdhci_resume_host(struct sdhci_host *host);
 #endif
+
+#endif /* __SDHCI_H */
diff --git a/drivers/mmc/host/tmio_mmc.c b/drivers/mmc/host/tmio_mmc.c
index 91991b460c45..e22c3fa3516a 100644
--- a/drivers/mmc/host/tmio_mmc.c
+++ b/drivers/mmc/host/tmio_mmc.c
@@ -46,7 +46,9 @@ static void tmio_mmc_set_clock(struct tmio_mmc_host *host, int new_clock)
 		clk |= 0x100;
 	}
 
-	sd_config_write8(host, CNF_SD_CLK_MODE, clk >> 22);
+	if (host->set_clk_div)
+		host->set_clk_div(host->pdev, (clk>>22) & 1);
+
 	sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, clk & 0x1ff);
 }
 
@@ -427,12 +429,13 @@ static void tmio_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
 	/* Power sequence - OFF -> ON -> UP */
 	switch (ios->power_mode) {
 	case MMC_POWER_OFF: /* power down SD bus */
-		sd_config_write8(host, CNF_PWR_CTL_2, 0x00);
+		if (host->set_pwr)
+			host->set_pwr(host->pdev, 0);
 		tmio_mmc_clk_stop(host);
 		break;
 	case MMC_POWER_ON: /* power up SD bus */
-
-		sd_config_write8(host, CNF_PWR_CTL_2, 0x02);
+		if (host->set_pwr)
+			host->set_pwr(host->pdev, 1);
 		break;
 	case MMC_POWER_UP: /* start bus clock */
 		tmio_mmc_clk_start(host);
@@ -485,21 +488,15 @@ static int tmio_mmc_resume(struct platform_device *dev)
 {
 	struct mfd_cell	*cell = (struct mfd_cell *)dev->dev.platform_data;
 	struct mmc_host *mmc = platform_get_drvdata(dev);
-	struct tmio_mmc_host *host = mmc_priv(mmc);
 	int ret = 0;
 
 	/* Tell the MFD core we are ready to be enabled */
-	if (cell->enable) {
-		ret = cell->enable(dev);
+	if (cell->resume) {
+		ret = cell->resume(dev);
 		if (ret)
 			goto out;
 	}
 
-	/* Enable the MMC/SD Control registers */
-	sd_config_write16(host, CNF_CMD, SDCREN);
-	sd_config_write32(host, CNF_CTL_BASE,
-		(dev->resource[0].start >> host->bus_shift) & 0xfffe);
-
 	mmc_resume_host(mmc);
 
 out:
@@ -514,17 +511,16 @@ static int __devinit tmio_mmc_probe(struct platform_device *dev)
 {
 	struct mfd_cell	*cell = (struct mfd_cell *)dev->dev.platform_data;
 	struct tmio_mmc_data *pdata;
-	struct resource *res_ctl, *res_cnf;
+	struct resource *res_ctl;
 	struct tmio_mmc_host *host;
 	struct mmc_host *mmc;
 	int ret = -EINVAL;
 
-	if (dev->num_resources != 3)
+	if (dev->num_resources != 2)
 		goto out;
 
 	res_ctl = platform_get_resource(dev, IORESOURCE_MEM, 0);
-	res_cnf = platform_get_resource(dev, IORESOURCE_MEM, 1);
-	if (!res_ctl || !res_cnf)
+	if (!res_ctl)
 		goto out;
 
 	pdata = cell->driver_data;
@@ -539,8 +535,12 @@ static int __devinit tmio_mmc_probe(struct platform_device *dev)
 
 	host = mmc_priv(mmc);
 	host->mmc = mmc;
+	host->pdev = dev;
 	platform_set_drvdata(dev, mmc);
 
+	host->set_pwr = pdata->set_pwr;
+	host->set_clk_div = pdata->set_clk_div;
+
 	/* SD control register space size is 0x200, 0x400 for bus_shift=1 */
 	host->bus_shift = resource_size(res_ctl) >> 10;
 
@@ -548,10 +548,6 @@ static int __devinit tmio_mmc_probe(struct platform_device *dev)
 	if (!host->ctl)
 		goto host_free;
 
-	host->cnf = ioremap(res_cnf->start, resource_size(res_cnf));
-	if (!host->cnf)
-		goto unmap_ctl;
-
 	mmc->ops = &tmio_mmc_ops;
 	mmc->caps = MMC_CAP_4_BIT_DATA;
 	mmc->f_max = pdata->hclk;
@@ -562,23 +558,9 @@ static int __devinit tmio_mmc_probe(struct platform_device *dev)
 	if (cell->enable) {
 		ret = cell->enable(dev);
 		if (ret)
-			goto unmap_cnf;
+			goto unmap_ctl;
 	}
 
-	/* Enable the MMC/SD Control registers */
-	sd_config_write16(host, CNF_CMD, SDCREN);
-	sd_config_write32(host, CNF_CTL_BASE,
-		(dev->resource[0].start >> host->bus_shift) & 0xfffe);
-
-	/* Disable SD power during suspend */
-	sd_config_write8(host, CNF_PWR_CTL_3, 0x01);
-
-	/* The below is required but why? FIXME */
-	sd_config_write8(host, CNF_STOP_CLK_CTL, 0x1f);
-
-	/* Power down SD bus*/
-	sd_config_write8(host, CNF_PWR_CTL_2, 0x00);
-
 	tmio_mmc_clk_stop(host);
 	reset(host);
 
@@ -586,14 +568,14 @@ static int __devinit tmio_mmc_probe(struct platform_device *dev)
 	if (ret >= 0)
 		host->irq = ret;
 	else
-		goto unmap_cnf;
+		goto unmap_ctl;
 
 	disable_mmc_irqs(host, TMIO_MASK_ALL);
 
 	ret = request_irq(host->irq, tmio_mmc_irq, IRQF_DISABLED |
-		IRQF_TRIGGER_FALLING, "tmio-mmc", host);
+		IRQF_TRIGGER_FALLING, dev_name(&dev->dev), host);
 	if (ret)
-		goto unmap_cnf;
+		goto unmap_ctl;
 
 	mmc_add_host(mmc);
 
@@ -605,8 +587,6 @@ static int __devinit tmio_mmc_probe(struct platform_device *dev)
 
 	return 0;
 
-unmap_cnf:
-	iounmap(host->cnf);
 unmap_ctl:
 	iounmap(host->ctl);
 host_free:
@@ -626,7 +606,6 @@ static int __devexit tmio_mmc_remove(struct platform_device *dev)
 		mmc_remove_host(mmc);
 		free_irq(host->irq, host);
 		iounmap(host->ctl);
-		iounmap(host->cnf);
 		mmc_free_host(mmc);
 	}
 
diff --git a/drivers/mmc/host/tmio_mmc.h b/drivers/mmc/host/tmio_mmc.h
index 9fa998594974..692dc23363b9 100644
--- a/drivers/mmc/host/tmio_mmc.h
+++ b/drivers/mmc/host/tmio_mmc.h
@@ -11,26 +11,6 @@
 
 #include <linux/highmem.h>
 
-#define CNF_CMD     0x04
-#define CNF_CTL_BASE   0x10
-#define CNF_INT_PIN  0x3d
-#define CNF_STOP_CLK_CTL 0x40
-#define CNF_GCLK_CTL 0x41
-#define CNF_SD_CLK_MODE 0x42
-#define CNF_PIN_STATUS 0x44
-#define CNF_PWR_CTL_1 0x48
-#define CNF_PWR_CTL_2 0x49
-#define CNF_PWR_CTL_3 0x4a
-#define CNF_CARD_DETECT_MODE 0x4c
-#define CNF_SD_SLOT 0x50
-#define CNF_EXT_GCLK_CTL_1 0xf0
-#define CNF_EXT_GCLK_CTL_2 0xf1
-#define CNF_EXT_GCLK_CTL_3 0xf9
-#define CNF_SD_LED_EN_1 0xfa
-#define CNF_SD_LED_EN_2 0xfe
-
-#define   SDCREN 0x2   /* Enable access to MMC CTL regs. (flag in COMMAND_REG)*/
-
 #define CTL_SD_CMD 0x00
 #define CTL_ARG_REG 0x04
 #define CTL_STOP_INTERNAL_ACTION 0x08
@@ -110,7 +90,6 @@
 
 
 struct tmio_mmc_host {
-	void __iomem *cnf;
 	void __iomem *ctl;
 	unsigned long bus_shift;
 	struct mmc_command      *cmd;
@@ -119,10 +98,16 @@ struct tmio_mmc_host {
 	struct mmc_host         *mmc;
 	int                     irq;
 
+	/* Callbacks for clock / power control */
+	void (*set_pwr)(struct platform_device *host, int state);
+	void (*set_clk_div)(struct platform_device *host, int state);
+
 	/* pio related stuff */
 	struct scatterlist      *sg_ptr;
 	unsigned int            sg_len;
 	unsigned int            sg_off;
+
+	struct platform_device *pdev;
 };
 
 #include <linux/io.h>
@@ -163,25 +148,6 @@ static inline void sd_ctrl_write32(struct tmio_mmc_host *host, int addr,
 	writew(val >> 16, host->ctl + ((addr + 2) << host->bus_shift));
 }
 
-static inline void sd_config_write8(struct tmio_mmc_host *host, int addr,
-		u8 val)
-{
-	writeb(val, host->cnf + (addr << host->bus_shift));
-}
-
-static inline void sd_config_write16(struct tmio_mmc_host *host, int addr,
-		u16 val)
-{
-	writew(val, host->cnf + (addr << host->bus_shift));
-}
-
-static inline void sd_config_write32(struct tmio_mmc_host *host, int addr,
-		u32 val)
-{
-	writew(val, host->cnf + (addr << host->bus_shift));
-	writew(val >> 16, host->cnf + ((addr + 2) << host->bus_shift));
-}
-
 #include <linux/scatterlist.h>
 #include <linux/blkdev.h>
 
diff --git a/drivers/mtd/chips/Kconfig b/drivers/mtd/chips/Kconfig
index 9408099eec48..35c6a23b183b 100644
--- a/drivers/mtd/chips/Kconfig
+++ b/drivers/mtd/chips/Kconfig
@@ -1,5 +1,3 @@
-# drivers/mtd/chips/Kconfig
-
 menu "RAM/ROM/Flash chip drivers"
 	depends on MTD!=n
 
@@ -242,4 +240,3 @@ config MTD_XIP
 	  then say N.
 
 endmenu
-
diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c
index e7563a9872d0..5fbf29e1e64f 100644
--- a/drivers/mtd/chips/cfi_cmdset_0001.c
+++ b/drivers/mtd/chips/cfi_cmdset_0001.c
@@ -43,15 +43,17 @@
 // debugging, turns off buffer write mode if set to 1
 #define FORCE_WORD_WRITE 0
 
-#define MANUFACTURER_INTEL	0x0089
+/* Intel chips */
 #define I82802AB	0x00ad
 #define I82802AC	0x00ac
 #define PF38F4476	0x881c
-#define MANUFACTURER_ST         0x0020
+/* STMicroelectronics chips */
 #define M50LPW080       0x002F
 #define M50FLW080A	0x0080
 #define M50FLW080B	0x0081
+/* Atmel chips */
 #define AT49BV640D	0x02de
+#define AT49BV640DT	0x02db
 
 static int cfi_intelext_read (struct mtd_info *, loff_t, size_t, size_t *, u_char *);
 static int cfi_intelext_write_words(struct mtd_info *, loff_t, size_t, size_t *, const u_char *);
@@ -199,6 +201,16 @@ static void fixup_convert_atmel_pri(struct mtd_info *mtd, void *param)
 	cfi->cfiq->BufWriteTimeoutMax = 0;
 }
 
+static void fixup_at49bv640dx_lock(struct mtd_info *mtd, void *param)
+{
+	struct map_info *map = mtd->priv;
+	struct cfi_private *cfi = map->fldrv_priv;
+	struct cfi_pri_intelext *cfip = cfi->cmdset_priv;
+
+	cfip->FeatureSupport |= (1 << 5);
+	mtd->flags |= MTD_POWERUP_LOCK;
+}
+
 #ifdef CMDSET0001_DISABLE_ERASE_SUSPEND_ON_WRITE
 /* Some Intel Strata Flash prior to FPO revision C has bugs in this area */
 static void fixup_intel_strataflash(struct mtd_info *mtd, void* param)
@@ -283,6 +295,8 @@ static void fixup_unlock_powerup_lock(struct mtd_info *mtd, void *param)
 
 static struct cfi_fixup cfi_fixup_table[] = {
 	{ CFI_MFR_ATMEL, CFI_ID_ANY, fixup_convert_atmel_pri, NULL },
+	{ CFI_MFR_ATMEL, AT49BV640D, fixup_at49bv640dx_lock, NULL },
+	{ CFI_MFR_ATMEL, AT49BV640DT, fixup_at49bv640dx_lock, NULL },
 #ifdef CMDSET0001_DISABLE_ERASE_SUSPEND_ON_WRITE
 	{ CFI_MFR_ANY, CFI_ID_ANY, fixup_intel_strataflash, NULL },
 #endif
@@ -294,16 +308,16 @@ static struct cfi_fixup cfi_fixup_table[] = {
 #endif
 	{ CFI_MFR_ST, 0x00ba, /* M28W320CT */ fixup_st_m28w320ct, NULL },
 	{ CFI_MFR_ST, 0x00bb, /* M28W320CB */ fixup_st_m28w320cb, NULL },
-	{ MANUFACTURER_INTEL, CFI_ID_ANY, fixup_unlock_powerup_lock, NULL, },
+	{ CFI_MFR_INTEL, CFI_ID_ANY, fixup_unlock_powerup_lock, NULL, },
 	{ 0, 0, NULL, NULL }
 };
 
 static struct cfi_fixup jedec_fixup_table[] = {
-	{ MANUFACTURER_INTEL, I82802AB,   fixup_use_fwh_lock, NULL, },
-	{ MANUFACTURER_INTEL, I82802AC,   fixup_use_fwh_lock, NULL, },
-	{ MANUFACTURER_ST,    M50LPW080,  fixup_use_fwh_lock, NULL, },
-	{ MANUFACTURER_ST,    M50FLW080A, fixup_use_fwh_lock, NULL, },
-	{ MANUFACTURER_ST,    M50FLW080B, fixup_use_fwh_lock, NULL, },
+	{ CFI_MFR_INTEL, I82802AB,   fixup_use_fwh_lock, NULL, },
+	{ CFI_MFR_INTEL, I82802AC,   fixup_use_fwh_lock, NULL, },
+	{ CFI_MFR_ST,    M50LPW080,  fixup_use_fwh_lock, NULL, },
+	{ CFI_MFR_ST,    M50FLW080A, fixup_use_fwh_lock, NULL, },
+	{ CFI_MFR_ST,    M50FLW080B, fixup_use_fwh_lock, NULL, },
 	{ 0, 0, NULL, NULL }
 };
 static struct cfi_fixup fixup_table[] = {
@@ -319,7 +333,7 @@ static struct cfi_fixup fixup_table[] = {
 static void cfi_fixup_major_minor(struct cfi_private *cfi,
 						struct cfi_pri_intelext *extp)
 {
-	if (cfi->mfr == MANUFACTURER_INTEL &&
+	if (cfi->mfr == CFI_MFR_INTEL &&
 			cfi->id == PF38F4476 && extp->MinorVersion == '3')
 		extp->MinorVersion = '1';
 }
@@ -2235,7 +2249,7 @@ static int cfi_intelext_otp_walk(struct mtd_info *mtd, loff_t from, size_t len,
 
 	/* Some chips have OTP located in the _top_ partition only.
 	   For example: Intel 28F256L18T (T means top-parameter device) */
-	if (cfi->mfr == MANUFACTURER_INTEL) {
+	if (cfi->mfr == CFI_MFR_INTEL) {
 		switch (cfi->id) {
 		case 0x880b:
 		case 0x880c:
@@ -2564,6 +2578,7 @@ static int cfi_intelext_reset(struct mtd_info *mtd)
 		if (!ret) {
 			map_write(map, CMD(0xff), chip->start);
 			chip->state = FL_SHUTDOWN;
+			put_chip(map, chip, chip->start);
 		}
 		spin_unlock(chip->mutex);
 	}
diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c
index 94bb61e19047..f3600e8d5382 100644
--- a/drivers/mtd/chips/cfi_cmdset_0002.c
+++ b/drivers/mtd/chips/cfi_cmdset_0002.c
@@ -490,10 +490,6 @@ static struct mtd_info *cfi_amdstd_setup(struct mtd_info *mtd)
 	}
 #endif
 
-	/* FIXME: erase-suspend-program is broken.  See
-	   http://lists.infradead.org/pipermail/linux-mtd/2003-December/009001.html */
-	printk(KERN_NOTICE "cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.\n");
-
 	__module_get(THIS_MODULE);
 	return mtd;
 
@@ -573,7 +569,6 @@ static int get_chip(struct map_info *map, struct flchip *chip, unsigned long adr
 
 			if (time_after(jiffies, timeo)) {
 				printk(KERN_ERR "Waiting for chip to be ready timed out.\n");
-				spin_unlock(chip->mutex);
 				return -EIO;
 			}
 			spin_unlock(chip->mutex);
@@ -589,15 +584,9 @@ static int get_chip(struct map_info *map, struct flchip *chip, unsigned long adr
 		return 0;
 
 	case FL_ERASING:
-		if (mode == FL_WRITING) /* FIXME: Erase-suspend-program appears broken. */
-			goto sleep;
-
-		if (!(   mode == FL_READY
-		      || mode == FL_POINT
-		      || !cfip
-		      || (mode == FL_WRITING && (cfip->EraseSuspend & 0x2))
-		      || (mode == FL_WRITING && (cfip->EraseSuspend & 0x1)
-		    )))
+		if (!cfip || !(cfip->EraseSuspend & (0x1|0x2)) ||
+		    !(mode == FL_READY || mode == FL_POINT ||
+		    (mode == FL_WRITING && (cfip->EraseSuspend & 0x2))))
 			goto sleep;
 
 		/* We could check to see if we're trying to access the sector
diff --git a/drivers/mtd/chips/cfi_util.c b/drivers/mtd/chips/cfi_util.c
index c5a84fda5410..ca584d0380b4 100755
--- a/drivers/mtd/chips/cfi_util.c
+++ b/drivers/mtd/chips/cfi_util.c
@@ -71,6 +71,13 @@ int __xipram cfi_qry_mode_on(uint32_t base, struct map_info *map,
 	cfi_send_gen_cmd(0x98, 0x555, base, map, cfi, cfi->device_type, NULL);
 	if (cfi_qry_present(map, base, cfi))
 		return 1;
+	/* some old SST chips, e.g. 39VF160x/39VF320x */
+	cfi_send_gen_cmd(0xF0, 0, base, map, cfi, cfi->device_type, NULL);
+	cfi_send_gen_cmd(0xAA, 0x5555, base, map, cfi, cfi->device_type, NULL);
+	cfi_send_gen_cmd(0x55, 0x2AAA, base, map, cfi, cfi->device_type, NULL);
+	cfi_send_gen_cmd(0x98, 0x5555, base, map, cfi, cfi->device_type, NULL);
+	if (cfi_qry_present(map, base, cfi))
+		return 1;
 	/* QRY not found */
 	return 0;
 }
diff --git a/drivers/mtd/chips/jedec_probe.c b/drivers/mtd/chips/jedec_probe.c
index 736a3be265f2..1bec5e1ce6ac 100644
--- a/drivers/mtd/chips/jedec_probe.c
+++ b/drivers/mtd/chips/jedec_probe.c
@@ -142,8 +142,8 @@
 
 /* ST - www.st.com */
 #define M29F800AB	0x0058
-#define M29W800DT	0x00D7
-#define M29W800DB	0x005B
+#define M29W800DT	0x22D7
+#define M29W800DB	0x225B
 #define M29W400DT	0x00EE
 #define M29W400DB	0x00EF
 #define M29W160DT	0x22C4
@@ -1575,7 +1575,7 @@ static const struct amd_flash_info jedec_table[] = {
 		.dev_id		= M29W800DT,
 		.name		= "ST M29W800DT",
 		.devtypes	= CFI_DEVICETYPE_X16|CFI_DEVICETYPE_X8,
-		.uaddr		= MTD_UADDR_0x5555_0x2AAA,	/* ???? */
+		.uaddr		= MTD_UADDR_0x0AAA_0x0555,
 		.dev_size	= SIZE_1MiB,
 		.cmd_set	= P_ID_AMD_STD,
 		.nr_regions	= 4,
@@ -1590,7 +1590,7 @@ static const struct amd_flash_info jedec_table[] = {
 		.dev_id		= M29W800DB,
 		.name		= "ST M29W800DB",
 		.devtypes	= CFI_DEVICETYPE_X16|CFI_DEVICETYPE_X8,
-		.uaddr		= MTD_UADDR_0x5555_0x2AAA,	/* ???? */
+		.uaddr		= MTD_UADDR_0x0AAA_0x0555,
 		.dev_size	= SIZE_1MiB,
 		.cmd_set	= P_ID_AMD_STD,
 		.nr_regions	= 4,
diff --git a/drivers/mtd/devices/Kconfig b/drivers/mtd/devices/Kconfig
index c222514bb70d..35081ce77fbd 100644
--- a/drivers/mtd/devices/Kconfig
+++ b/drivers/mtd/devices/Kconfig
@@ -1,5 +1,3 @@
-# drivers/mtd/maps/Kconfig
-
 menu "Self-contained MTD device drivers"
 	depends on MTD!=n
 
@@ -308,4 +306,3 @@ config MTD_DOCPROBE_55AA
 	  you have managed to wipe the first block.
 
 endmenu
-
diff --git a/drivers/mtd/devices/m25p80.c b/drivers/mtd/devices/m25p80.c
index 4c19269de91a..f3f4768d6e18 100644
--- a/drivers/mtd/devices/m25p80.c
+++ b/drivers/mtd/devices/m25p80.c
@@ -22,6 +22,7 @@
 #include <linux/mutex.h>
 #include <linux/math64.h>
 #include <linux/sched.h>
+#include <linux/mod_devicetable.h>
 
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/partitions.h>
@@ -29,9 +30,6 @@
 #include <linux/spi/spi.h>
 #include <linux/spi/flash.h>
 
-
-#define FLASH_PAGESIZE		256
-
 /* Flash opcodes. */
 #define	OPCODE_WREN		0x06	/* Write enable */
 #define	OPCODE_RDSR		0x05	/* Read status register */
@@ -61,7 +59,7 @@
 
 /* Define max times to check status register before we give up. */
 #define	MAX_READY_WAIT_JIFFIES	(40 * HZ)	/* M25P16 specs 40s max chip erase */
-#define	CMD_SIZE		4
+#define	MAX_CMD_SIZE		4
 
 #ifdef CONFIG_M25PXX_USE_FAST_READ
 #define OPCODE_READ 	OPCODE_FAST_READ
@@ -78,8 +76,10 @@ struct m25p {
 	struct mutex		lock;
 	struct mtd_info		mtd;
 	unsigned		partitioned:1;
+	u16			page_size;
+	u16			addr_width;
 	u8			erase_opcode;
-	u8			command[CMD_SIZE + FAST_READ_DUMMY_BYTE];
+	u8			*command;
 };
 
 static inline struct m25p *mtd_to_m25p(struct mtd_info *mtd)
@@ -198,6 +198,19 @@ static int erase_chip(struct m25p *flash)
 	return 0;
 }
 
+static void m25p_addr2cmd(struct m25p *flash, unsigned int addr, u8 *cmd)
+{
+	/* opcode is in cmd[0] */
+	cmd[1] = addr >> (flash->addr_width * 8 -  8);
+	cmd[2] = addr >> (flash->addr_width * 8 - 16);
+	cmd[3] = addr >> (flash->addr_width * 8 - 24);
+}
+
+static int m25p_cmdsz(struct m25p *flash)
+{
+	return 1 + flash->addr_width;
+}
+
 /*
  * Erase one sector of flash memory at offset ``offset'' which is any
  * address within the sector which should be erased.
@@ -219,11 +232,9 @@ static int erase_sector(struct m25p *flash, u32 offset)
 
 	/* Set up command buffer. */
 	flash->command[0] = flash->erase_opcode;
-	flash->command[1] = offset >> 16;
-	flash->command[2] = offset >> 8;
-	flash->command[3] = offset;
+	m25p_addr2cmd(flash, offset, flash->command);
 
-	spi_write(flash->spi, flash->command, CMD_SIZE);
+	spi_write(flash->spi, flash->command, m25p_cmdsz(flash));
 
 	return 0;
 }
@@ -325,7 +336,7 @@ static int m25p80_read(struct mtd_info *mtd, loff_t from, size_t len,
 	 * Should add 1 byte DUMMY_BYTE.
 	 */
 	t[0].tx_buf = flash->command;
-	t[0].len = CMD_SIZE + FAST_READ_DUMMY_BYTE;
+	t[0].len = m25p_cmdsz(flash) + FAST_READ_DUMMY_BYTE;
 	spi_message_add_tail(&t[0], &m);
 
 	t[1].rx_buf = buf;
@@ -352,13 +363,11 @@ static int m25p80_read(struct mtd_info *mtd, loff_t from, size_t len,
 
 	/* Set up the write data buffer. */
 	flash->command[0] = OPCODE_READ;
-	flash->command[1] = from >> 16;
-	flash->command[2] = from >> 8;
-	flash->command[3] = from;
+	m25p_addr2cmd(flash, from, flash->command);
 
 	spi_sync(flash->spi, &m);
 
-	*retlen = m.actual_length - CMD_SIZE - FAST_READ_DUMMY_BYTE;
+	*retlen = m.actual_length - m25p_cmdsz(flash) - FAST_READ_DUMMY_BYTE;
 
 	mutex_unlock(&flash->lock);
 
@@ -396,7 +405,7 @@ static int m25p80_write(struct mtd_info *mtd, loff_t to, size_t len,
 	memset(t, 0, (sizeof t));
 
 	t[0].tx_buf = flash->command;
-	t[0].len = CMD_SIZE;
+	t[0].len = m25p_cmdsz(flash);
 	spi_message_add_tail(&t[0], &m);
 
 	t[1].tx_buf = buf;
@@ -414,41 +423,36 @@ static int m25p80_write(struct mtd_info *mtd, loff_t to, size_t len,
 
 	/* Set up the opcode in the write buffer. */
 	flash->command[0] = OPCODE_PP;
-	flash->command[1] = to >> 16;
-	flash->command[2] = to >> 8;
-	flash->command[3] = to;
+	m25p_addr2cmd(flash, to, flash->command);
 
-	/* what page do we start with? */
-	page_offset = to % FLASH_PAGESIZE;
+	page_offset = to & (flash->page_size - 1);
 
 	/* do all the bytes fit onto one page? */
-	if (page_offset + len <= FLASH_PAGESIZE) {
+	if (page_offset + len <= flash->page_size) {
 		t[1].len = len;
 
 		spi_sync(flash->spi, &m);
 
-		*retlen = m.actual_length - CMD_SIZE;
+		*retlen = m.actual_length - m25p_cmdsz(flash);
 	} else {
 		u32 i;
 
 		/* the size of data remaining on the first page */
-		page_size = FLASH_PAGESIZE - page_offset;
+		page_size = flash->page_size - page_offset;
 
 		t[1].len = page_size;
 		spi_sync(flash->spi, &m);
 
-		*retlen = m.actual_length - CMD_SIZE;
+		*retlen = m.actual_length - m25p_cmdsz(flash);
 
-		/* write everything in PAGESIZE chunks */
+		/* write everything in flash->page_size chunks */
 		for (i = page_size; i < len; i += page_size) {
 			page_size = len - i;
-			if (page_size > FLASH_PAGESIZE)
-				page_size = FLASH_PAGESIZE;
+			if (page_size > flash->page_size)
+				page_size = flash->page_size;
 
 			/* write the next page to flash */
-			flash->command[1] = (to + i) >> 16;
-			flash->command[2] = (to + i) >> 8;
-			flash->command[3] = (to + i);
+			m25p_addr2cmd(flash, to + i, flash->command);
 
 			t[1].tx_buf = buf + i;
 			t[1].len = page_size;
@@ -460,7 +464,7 @@ static int m25p80_write(struct mtd_info *mtd, loff_t to, size_t len,
 			spi_sync(flash->spi, &m);
 
 			if (retlen)
-				*retlen += m.actual_length - CMD_SIZE;
+				*retlen += m.actual_length - m25p_cmdsz(flash);
 		}
 	}
 
@@ -492,7 +496,7 @@ static int sst_write(struct mtd_info *mtd, loff_t to, size_t len,
 	memset(t, 0, (sizeof t));
 
 	t[0].tx_buf = flash->command;
-	t[0].len = CMD_SIZE;
+	t[0].len = m25p_cmdsz(flash);
 	spi_message_add_tail(&t[0], &m);
 
 	t[1].tx_buf = buf;
@@ -511,9 +515,7 @@ static int sst_write(struct mtd_info *mtd, loff_t to, size_t len,
 	/* Start write from odd address. */
 	if (actual) {
 		flash->command[0] = OPCODE_BP;
-		flash->command[1] = to >> 16;
-		flash->command[2] = to >> 8;
-		flash->command[3] = to;
+		m25p_addr2cmd(flash, to, flash->command);
 
 		/* write one byte. */
 		t[1].len = 1;
@@ -521,17 +523,15 @@ static int sst_write(struct mtd_info *mtd, loff_t to, size_t len,
 		ret = wait_till_ready(flash);
 		if (ret)
 			goto time_out;
-		*retlen += m.actual_length - CMD_SIZE;
+		*retlen += m.actual_length - m25p_cmdsz(flash);
 	}
 	to += actual;
 
 	flash->command[0] = OPCODE_AAI_WP;
-	flash->command[1] = to >> 16;
-	flash->command[2] = to >> 8;
-	flash->command[3] = to;
+	m25p_addr2cmd(flash, to, flash->command);
 
 	/* Write out most of the data here. */
-	cmd_sz = CMD_SIZE;
+	cmd_sz = m25p_cmdsz(flash);
 	for (; actual < len - 1; actual += 2) {
 		t[0].len = cmd_sz;
 		/* write two bytes. */
@@ -555,10 +555,8 @@ static int sst_write(struct mtd_info *mtd, loff_t to, size_t len,
 	if (actual != len) {
 		write_enable(flash);
 		flash->command[0] = OPCODE_BP;
-		flash->command[1] = to >> 16;
-		flash->command[2] = to >> 8;
-		flash->command[3] = to;
-		t[0].len = CMD_SIZE;
+		m25p_addr2cmd(flash, to, flash->command);
+		t[0].len = m25p_cmdsz(flash);
 		t[1].len = 1;
 		t[1].tx_buf = buf + actual;
 
@@ -566,7 +564,7 @@ static int sst_write(struct mtd_info *mtd, loff_t to, size_t len,
 		ret = wait_till_ready(flash);
 		if (ret)
 			goto time_out;
-		*retlen += m.actual_length - CMD_SIZE;
+		*retlen += m.actual_length - m25p_cmdsz(flash);
 		write_disable(flash);
 	}
 
@@ -582,8 +580,6 @@ time_out:
  */
 
 struct flash_info {
-	char		*name;
-
 	/* JEDEC id zero means "no ID" (most older chips); otherwise it has
 	 * a high byte of zero plus three data bytes: the manufacturer id,
 	 * then a two byte device id.
@@ -597,87 +593,119 @@ struct flash_info {
 	unsigned	sector_size;
 	u16		n_sectors;
 
+	u16		page_size;
+	u16		addr_width;
+
 	u16		flags;
 #define	SECT_4K		0x01		/* OPCODE_BE_4K works uniformly */
+#define	M25P_NO_ERASE	0x02		/* No erase command needed */
 };
 
+#define INFO(_jedec_id, _ext_id, _sector_size, _n_sectors, _flags)	\
+	((kernel_ulong_t)&(struct flash_info) {				\
+		.jedec_id = (_jedec_id),				\
+		.ext_id = (_ext_id),					\
+		.sector_size = (_sector_size),				\
+		.n_sectors = (_n_sectors),				\
+		.page_size = 256,					\
+		.addr_width = 3,					\
+		.flags = (_flags),					\
+	})
+
+#define CAT25_INFO(_sector_size, _n_sectors, _page_size, _addr_width)	\
+	((kernel_ulong_t)&(struct flash_info) {				\
+		.sector_size = (_sector_size),				\
+		.n_sectors = (_n_sectors),				\
+		.page_size = (_page_size),				\
+		.addr_width = (_addr_width),				\
+		.flags = M25P_NO_ERASE,					\
+	})
 
 /* NOTE: double check command sets and memory organization when you add
  * more flash chips.  This current list focusses on newer chips, which
  * have been converging on command sets which including JEDEC ID.
  */
-static struct flash_info __devinitdata m25p_data [] = {
-
+static const struct spi_device_id m25p_ids[] = {
 	/* Atmel -- some are (confusingly) marketed as "DataFlash" */
-	{ "at25fs010",  0x1f6601, 0, 32 * 1024, 4, SECT_4K, },
-	{ "at25fs040",  0x1f6604, 0, 64 * 1024, 8, SECT_4K, },
+	{ "at25fs010",  INFO(0x1f6601, 0, 32 * 1024,   4, SECT_4K) },
+	{ "at25fs040",  INFO(0x1f6604, 0, 64 * 1024,   8, SECT_4K) },
 
-	{ "at25df041a", 0x1f4401, 0, 64 * 1024, 8, SECT_4K, },
-	{ "at25df641",  0x1f4800, 0, 64 * 1024, 128, SECT_4K, },
+	{ "at25df041a", INFO(0x1f4401, 0, 64 * 1024,   8, SECT_4K) },
+	{ "at25df641",  INFO(0x1f4800, 0, 64 * 1024, 128, SECT_4K) },
 
-	{ "at26f004",   0x1f0400, 0, 64 * 1024, 8, SECT_4K, },
-	{ "at26df081a", 0x1f4501, 0, 64 * 1024, 16, SECT_4K, },
-	{ "at26df161a", 0x1f4601, 0, 64 * 1024, 32, SECT_4K, },
-	{ "at26df321",  0x1f4701, 0, 64 * 1024, 64, SECT_4K, },
+	{ "at26f004",   INFO(0x1f0400, 0, 64 * 1024,  8, SECT_4K) },
+	{ "at26df081a", INFO(0x1f4501, 0, 64 * 1024, 16, SECT_4K) },
+	{ "at26df161a", INFO(0x1f4601, 0, 64 * 1024, 32, SECT_4K) },
+	{ "at26df321",  INFO(0x1f4701, 0, 64 * 1024, 64, SECT_4K) },
 
 	/* Macronix */
-	{ "mx25l3205d", 0xc22016, 0, 64 * 1024, 64, },
-	{ "mx25l6405d", 0xc22017, 0, 64 * 1024, 128, },
-	{ "mx25l12805d", 0xc22018, 0, 64 * 1024, 256, },
-	{ "mx25l12855e", 0xc22618, 0, 64 * 1024, 256, },
+	{ "mx25l4005a",  INFO(0xc22013, 0, 64 * 1024,   8, SECT_4K) },
+	{ "mx25l3205d",  INFO(0xc22016, 0, 64 * 1024,  64, 0) },
+	{ "mx25l6405d",  INFO(0xc22017, 0, 64 * 1024, 128, 0) },
+	{ "mx25l12805d", INFO(0xc22018, 0, 64 * 1024, 256, 0) },
+	{ "mx25l12855e", INFO(0xc22618, 0, 64 * 1024, 256, 0) },
 
 	/* Spansion -- single (large) sector size only, at least
 	 * for the chips listed here (without boot sectors).
 	 */
-	{ "s25sl004a", 0x010212, 0, 64 * 1024, 8, },
-	{ "s25sl008a", 0x010213, 0, 64 * 1024, 16, },
-	{ "s25sl016a", 0x010214, 0, 64 * 1024, 32, },
-	{ "s25sl032a", 0x010215, 0, 64 * 1024, 64, },
-	{ "s25sl064a", 0x010216, 0, 64 * 1024, 128, },
-	{ "s25sl12800", 0x012018, 0x0300, 256 * 1024, 64, },
-	{ "s25sl12801", 0x012018, 0x0301, 64 * 1024, 256, },
-	{ "s25fl129p0", 0x012018, 0x4d00, 256 * 1024, 64, },
-	{ "s25fl129p1", 0x012018, 0x4d01, 64 * 1024, 256, },
+	{ "s25sl004a",  INFO(0x010212,      0,  64 * 1024,   8, 0) },
+	{ "s25sl008a",  INFO(0x010213,      0,  64 * 1024,  16, 0) },
+	{ "s25sl016a",  INFO(0x010214,      0,  64 * 1024,  32, 0) },
+	{ "s25sl032a",  INFO(0x010215,      0,  64 * 1024,  64, 0) },
+	{ "s25sl064a",  INFO(0x010216,      0,  64 * 1024, 128, 0) },
+	{ "s25sl12800", INFO(0x012018, 0x0300, 256 * 1024,  64, 0) },
+	{ "s25sl12801", INFO(0x012018, 0x0301,  64 * 1024, 256, 0) },
+	{ "s25fl129p0", INFO(0x012018, 0x4d00, 256 * 1024,  64, 0) },
+	{ "s25fl129p1", INFO(0x012018, 0x4d01,  64 * 1024, 256, 0) },
 
 	/* SST -- large erase sizes are "overlays", "sectors" are 4K */
-	{ "sst25vf040b", 0xbf258d, 0, 64 * 1024, 8, SECT_4K, },
-	{ "sst25vf080b", 0xbf258e, 0, 64 * 1024, 16, SECT_4K, },
-	{ "sst25vf016b", 0xbf2541, 0, 64 * 1024, 32, SECT_4K, },
-	{ "sst25vf032b", 0xbf254a, 0, 64 * 1024, 64, SECT_4K, },
-	{ "sst25wf512",  0xbf2501, 0, 64 * 1024, 1, SECT_4K, },
-	{ "sst25wf010",  0xbf2502, 0, 64 * 1024, 2, SECT_4K, },
-	{ "sst25wf020",  0xbf2503, 0, 64 * 1024, 4, SECT_4K, },
-	{ "sst25wf040",  0xbf2504, 0, 64 * 1024, 8, SECT_4K, },
+	{ "sst25vf040b", INFO(0xbf258d, 0, 64 * 1024,  8, SECT_4K) },
+	{ "sst25vf080b", INFO(0xbf258e, 0, 64 * 1024, 16, SECT_4K) },
+	{ "sst25vf016b", INFO(0xbf2541, 0, 64 * 1024, 32, SECT_4K) },
+	{ "sst25vf032b", INFO(0xbf254a, 0, 64 * 1024, 64, SECT_4K) },
+	{ "sst25wf512",  INFO(0xbf2501, 0, 64 * 1024,  1, SECT_4K) },
+	{ "sst25wf010",  INFO(0xbf2502, 0, 64 * 1024,  2, SECT_4K) },
+	{ "sst25wf020",  INFO(0xbf2503, 0, 64 * 1024,  4, SECT_4K) },
+	{ "sst25wf040",  INFO(0xbf2504, 0, 64 * 1024,  8, SECT_4K) },
 
 	/* ST Microelectronics -- newer production may have feature updates */
-	{ "m25p05",  0x202010,  0, 32 * 1024, 2, },
-	{ "m25p10",  0x202011,  0, 32 * 1024, 4, },
-	{ "m25p20",  0x202012,  0, 64 * 1024, 4, },
-	{ "m25p40",  0x202013,  0, 64 * 1024, 8, },
-	{ "m25p80",         0,  0, 64 * 1024, 16, },
-	{ "m25p16",  0x202015,  0, 64 * 1024, 32, },
-	{ "m25p32",  0x202016,  0, 64 * 1024, 64, },
-	{ "m25p64",  0x202017,  0, 64 * 1024, 128, },
-	{ "m25p128", 0x202018, 0, 256 * 1024, 64, },
-
-	{ "m45pe10", 0x204011,  0, 64 * 1024, 2, },
-	{ "m45pe80", 0x204014,  0, 64 * 1024, 16, },
-	{ "m45pe16", 0x204015,  0, 64 * 1024, 32, },
-
-	{ "m25pe80", 0x208014,  0, 64 * 1024, 16, },
-	{ "m25pe16", 0x208015,  0, 64 * 1024, 32, SECT_4K, },
+	{ "m25p05",  INFO(0x202010,  0,  32 * 1024,   2, 0) },
+	{ "m25p10",  INFO(0x202011,  0,  32 * 1024,   4, 0) },
+	{ "m25p20",  INFO(0x202012,  0,  64 * 1024,   4, 0) },
+	{ "m25p40",  INFO(0x202013,  0,  64 * 1024,   8, 0) },
+	{ "m25p80",  INFO(0x202014,  0,  64 * 1024,  16, 0) },
+	{ "m25p16",  INFO(0x202015,  0,  64 * 1024,  32, 0) },
+	{ "m25p32",  INFO(0x202016,  0,  64 * 1024,  64, 0) },
+	{ "m25p64",  INFO(0x202017,  0,  64 * 1024, 128, 0) },
+	{ "m25p128", INFO(0x202018,  0, 256 * 1024,  64, 0) },
+
+	{ "m45pe10", INFO(0x204011,  0, 64 * 1024,    2, 0) },
+	{ "m45pe80", INFO(0x204014,  0, 64 * 1024,   16, 0) },
+	{ "m45pe16", INFO(0x204015,  0, 64 * 1024,   32, 0) },
+
+	{ "m25pe80", INFO(0x208014,  0, 64 * 1024, 16,       0) },
+	{ "m25pe16", INFO(0x208015,  0, 64 * 1024, 32, SECT_4K) },
 
 	/* Winbond -- w25x "blocks" are 64K, "sectors" are 4KiB */
-	{ "w25x10", 0xef3011, 0, 64 * 1024, 2, SECT_4K, },
-	{ "w25x20", 0xef3012, 0, 64 * 1024, 4, SECT_4K, },
-	{ "w25x40", 0xef3013, 0, 64 * 1024, 8, SECT_4K, },
-	{ "w25x80", 0xef3014, 0, 64 * 1024, 16, SECT_4K, },
-	{ "w25x16", 0xef3015, 0, 64 * 1024, 32, SECT_4K, },
-	{ "w25x32", 0xef3016, 0, 64 * 1024, 64, SECT_4K, },
-	{ "w25x64", 0xef3017, 0, 64 * 1024, 128, SECT_4K, },
+	{ "w25x10", INFO(0xef3011, 0, 64 * 1024,  2,  SECT_4K) },
+	{ "w25x20", INFO(0xef3012, 0, 64 * 1024,  4,  SECT_4K) },
+	{ "w25x40", INFO(0xef3013, 0, 64 * 1024,  8,  SECT_4K) },
+	{ "w25x80", INFO(0xef3014, 0, 64 * 1024,  16, SECT_4K) },
+	{ "w25x16", INFO(0xef3015, 0, 64 * 1024,  32, SECT_4K) },
+	{ "w25x32", INFO(0xef3016, 0, 64 * 1024,  64, SECT_4K) },
+	{ "w25x64", INFO(0xef3017, 0, 64 * 1024, 128, SECT_4K) },
+
+	/* Catalyst / On Semiconductor -- non-JEDEC */
+	{ "cat25c11", CAT25_INFO(  16, 8, 16, 1) },
+	{ "cat25c03", CAT25_INFO(  32, 8, 16, 2) },
+	{ "cat25c09", CAT25_INFO( 128, 8, 32, 2) },
+	{ "cat25c17", CAT25_INFO( 256, 8, 32, 2) },
+	{ "cat25128", CAT25_INFO(2048, 8, 64, 2) },
+	{ },
 };
+MODULE_DEVICE_TABLE(spi, m25p_ids);
 
-static struct flash_info *__devinit jedec_probe(struct spi_device *spi)
+static const struct spi_device_id *__devinit jedec_probe(struct spi_device *spi)
 {
 	int			tmp;
 	u8			code = OPCODE_RDID;
@@ -702,18 +730,24 @@ static struct flash_info *__devinit jedec_probe(struct spi_device *spi)
 	jedec = jedec << 8;
 	jedec |= id[2];
 
+	/*
+	 * Some chips (like Numonyx M25P80) have JEDEC and non-JEDEC variants,
+	 * which depend on technology process. Officially RDID command doesn't
+	 * exist for non-JEDEC chips, but for compatibility they return ID 0.
+	 */
+	if (jedec == 0)
+		return NULL;
+
 	ext_jedec = id[3] << 8 | id[4];
 
-	for (tmp = 0, info = m25p_data;
-			tmp < ARRAY_SIZE(m25p_data);
-			tmp++, info++) {
+	for (tmp = 0; tmp < ARRAY_SIZE(m25p_ids) - 1; tmp++) {
+		info = (void *)m25p_ids[tmp].driver_data;
 		if (info->jedec_id == jedec) {
 			if (info->ext_id != 0 && info->ext_id != ext_jedec)
 				continue;
-			return info;
+			return &m25p_ids[tmp];
 		}
 	}
-	dev_err(&spi->dev, "unrecognized JEDEC id %06x\n", jedec);
 	return NULL;
 }
 
@@ -725,6 +759,7 @@ static struct flash_info *__devinit jedec_probe(struct spi_device *spi)
  */
 static int __devinit m25p_probe(struct spi_device *spi)
 {
+	const struct spi_device_id	*id = spi_get_device_id(spi);
 	struct flash_platform_data	*data;
 	struct m25p			*flash;
 	struct flash_info		*info;
@@ -737,50 +772,65 @@ static int __devinit m25p_probe(struct spi_device *spi)
 	 */
 	data = spi->dev.platform_data;
 	if (data && data->type) {
-		for (i = 0, info = m25p_data;
-				i < ARRAY_SIZE(m25p_data);
-				i++, info++) {
-			if (strcmp(data->type, info->name) == 0)
-				break;
-		}
+		const struct spi_device_id *plat_id;
 
-		/* unrecognized chip? */
-		if (i == ARRAY_SIZE(m25p_data)) {
-			DEBUG(MTD_DEBUG_LEVEL0, "%s: unrecognized id %s\n",
-					dev_name(&spi->dev), data->type);
-			info = NULL;
-
-		/* recognized; is that chip really what's there? */
-		} else if (info->jedec_id) {
-			struct flash_info	*chip = jedec_probe(spi);
-
-			if (!chip || chip != info) {
-				dev_warn(&spi->dev, "found %s, expected %s\n",
-						chip ? chip->name : "UNKNOWN",
-						info->name);
-				info = NULL;
-			}
+		for (i = 0; i < ARRAY_SIZE(m25p_ids) - 1; i++) {
+			plat_id = &m25p_ids[i];
+			if (strcmp(data->type, plat_id->name))
+				continue;
+			break;
 		}
-	} else
-		info = jedec_probe(spi);
 
-	if (!info)
-		return -ENODEV;
+		if (plat_id)
+			id = plat_id;
+		else
+			dev_warn(&spi->dev, "unrecognized id %s\n", data->type);
+	}
+
+	info = (void *)id->driver_data;
+
+	if (info->jedec_id) {
+		const struct spi_device_id *jid;
+
+		jid = jedec_probe(spi);
+		if (!jid) {
+			dev_info(&spi->dev, "non-JEDEC variant of %s\n",
+				 id->name);
+		} else if (jid != id) {
+			/*
+			 * JEDEC knows better, so overwrite platform ID. We
+			 * can't trust partitions any longer, but we'll let
+			 * mtd apply them anyway, since some partitions may be
+			 * marked read-only, and we don't want to lose that
+			 * information, even if it's not 100% accurate.
+			 */
+			dev_warn(&spi->dev, "found %s, expected %s\n",
+				 jid->name, id->name);
+			id = jid;
+			info = (void *)jid->driver_data;
+		}
+	}
 
 	flash = kzalloc(sizeof *flash, GFP_KERNEL);
 	if (!flash)
 		return -ENOMEM;
+	flash->command = kmalloc(MAX_CMD_SIZE + FAST_READ_DUMMY_BYTE, GFP_KERNEL);
+	if (!flash->command) {
+		kfree(flash);
+		return -ENOMEM;
+	}
 
 	flash->spi = spi;
 	mutex_init(&flash->lock);
 	dev_set_drvdata(&spi->dev, flash);
 
 	/*
-	 * Atmel serial flash tend to power up
-	 * with the software protection bits set
+	 * Atmel and SST serial flash tend to power
+	 * up with the software protection bits set
 	 */
 
-	if (info->jedec_id >> 16 == 0x1f) {
+	if (info->jedec_id >> 16 == 0x1f ||
+	    info->jedec_id >> 16 == 0xbf) {
 		write_enable(flash);
 		write_sr(flash, 0);
 	}
@@ -812,9 +862,14 @@ static int __devinit m25p_probe(struct spi_device *spi)
 		flash->mtd.erasesize = info->sector_size;
 	}
 
+	if (info->flags & M25P_NO_ERASE)
+		flash->mtd.flags |= MTD_NO_ERASE;
+
 	flash->mtd.dev.parent = &spi->dev;
+	flash->page_size = info->page_size;
+	flash->addr_width = info->addr_width;
 
-	dev_info(&spi->dev, "%s (%lld Kbytes)\n", info->name,
+	dev_info(&spi->dev, "%s (%lld Kbytes)\n", id->name,
 			(long long)flash->mtd.size >> 10);
 
 	DEBUG(MTD_DEBUG_LEVEL2,
@@ -888,8 +943,10 @@ static int __devexit m25p_remove(struct spi_device *spi)
 		status = del_mtd_partitions(&flash->mtd);
 	else
 		status = del_mtd_device(&flash->mtd);
-	if (status == 0)
+	if (status == 0) {
+		kfree(flash->command);
 		kfree(flash);
+	}
 	return 0;
 }
 
@@ -900,6 +957,7 @@ static struct spi_driver m25p80_driver = {
 		.bus	= &spi_bus_type,
 		.owner	= THIS_MODULE,
 	},
+	.id_table	= m25p_ids,
 	.probe	= m25p_probe,
 	.remove	= __devexit_p(m25p_remove),
 
diff --git a/drivers/mtd/devices/mtd_dataflash.c b/drivers/mtd/devices/mtd_dataflash.c
index 93e3627be74c..19817404ce7d 100644
--- a/drivers/mtd/devices/mtd_dataflash.c
+++ b/drivers/mtd/devices/mtd_dataflash.c
@@ -636,6 +636,7 @@ add_dataflash_otp(struct spi_device *spi, char *name,
 	struct mtd_info			*device;
 	struct flash_platform_data	*pdata = spi->dev.platform_data;
 	char				*otp_tag = "";
+	int				err = 0;
 
 	priv = kzalloc(sizeof *priv, GFP_KERNEL);
 	if (!priv)
@@ -693,13 +694,23 @@ add_dataflash_otp(struct spi_device *spi, char *name,
 
 		if (nr_parts > 0) {
 			priv->partitioned = 1;
-			return add_mtd_partitions(device, parts, nr_parts);
+			err = add_mtd_partitions(device, parts, nr_parts);
+			goto out;
 		}
 	} else if (pdata && pdata->nr_parts)
 		dev_warn(&spi->dev, "ignoring %d default partitions on %s\n",
 				pdata->nr_parts, device->name);
 
-	return add_mtd_device(device) == 1 ? -ENODEV : 0;
+	if (add_mtd_device(device) == 1)
+		err = -ENODEV;
+
+out:
+	if (!err)
+		return 0;
+
+	dev_set_drvdata(&spi->dev, NULL);
+	kfree(priv);
+	return err;
 }
 
 static inline int __devinit
@@ -932,8 +943,10 @@ static int __devexit dataflash_remove(struct spi_device *spi)
 		status = del_mtd_partitions(&flash->mtd);
 	else
 		status = del_mtd_device(&flash->mtd);
-	if (status == 0)
+	if (status == 0) {
+		dev_set_drvdata(&spi->dev, NULL);
 		kfree(flash);
+	}
 	return status;
 }
 
diff --git a/drivers/mtd/devices/slram.c b/drivers/mtd/devices/slram.c
index 3aa05cd18ea1..592016a0668f 100644
--- a/drivers/mtd/devices/slram.c
+++ b/drivers/mtd/devices/slram.c
@@ -18,7 +18,7 @@
                 to specify the offset instead of the absolute address
 
   NOTE:
-  With slram it's only possible to map a contigous memory region. Therfore
+  With slram it's only possible to map a contiguous memory region. Therefore
   if there's a device mapped somewhere in the region specified slram will
   fail to load (see kernel log if modprobe fails).
 
diff --git a/drivers/mtd/lpddr/Kconfig b/drivers/mtd/lpddr/Kconfig
index 5a401d8047ab..265f969817e3 100644
--- a/drivers/mtd/lpddr/Kconfig
+++ b/drivers/mtd/lpddr/Kconfig
@@ -1,5 +1,3 @@
-# drivers/mtd/chips/Kconfig
-
 menu "LPDDR flash memory drivers"
 	depends on MTD!=n
 
@@ -20,4 +18,3 @@ config MTD_QINFO_PROBE
 	    families of devices. This serves similar purpose of CFI on legacy
 	    Flash products
 endmenu
-
diff --git a/drivers/mtd/maps/Kconfig b/drivers/mtd/maps/Kconfig
index 14be0755d7cd..4c364d44ad59 100644
--- a/drivers/mtd/maps/Kconfig
+++ b/drivers/mtd/maps/Kconfig
@@ -1,5 +1,3 @@
-# drivers/mtd/maps/Kconfig
-
 menu "Mapping drivers for chip access"
 	depends on MTD!=n
 
@@ -361,12 +359,6 @@ config MTD_SA1100
 	  the SA1100 and SA1110, including the Assabet and the Compaq iPAQ.
 	  If you have such a board, say 'Y'.
 
-config MTD_IPAQ
-	tristate "CFI Flash device mapped on Compaq/HP iPAQ"
-	depends on IPAQ_HANDHELD && MTD_CFI
-	help
-	  This provides a driver for the on-board flash of the iPAQ.
-
 config MTD_DC21285
 	tristate "CFI Flash device mapped on DC21285 Footbridge"
 	depends on MTD_CFI && ARCH_FOOTBRIDGE && MTD_COMPLEX_MAPPINGS
@@ -389,9 +381,9 @@ config MTD_IXP2000
 	depends on MTD_CFI && MTD_COMPLEX_MAPPINGS && ARCH_IXP2000
 	help
 	  This enables MTD access to flash devices on platforms based
-	  on Intel's IXP2000 family of network processors such as the
-	  IXDP425 and Coyote. If you have an IXP2000 based board and
-	  would like to use the flash chips on it, say 'Y'.
+	  on Intel's IXP2000 family of network processors. If you have an
+	  IXP2000 based board and would like to use the flash chips on it,
+	  say 'Y'.
 
 config MTD_FORTUNET
 	tristate "CFI Flash device mapped on the FortuNet board"
diff --git a/drivers/mtd/maps/Makefile b/drivers/mtd/maps/Makefile
index ae2f6dbe43c3..ce315214ff2b 100644
--- a/drivers/mtd/maps/Makefile
+++ b/drivers/mtd/maps/Makefile
@@ -24,12 +24,12 @@ obj-$(CONFIG_MTD_CEIVA)		+= ceiva.o
 obj-$(CONFIG_MTD_OCTAGON)	+= octagon-5066.o
 obj-$(CONFIG_MTD_PHYSMAP)	+= physmap.o
 obj-$(CONFIG_MTD_PHYSMAP_OF)	+= physmap_of.o
+obj-$(CONFIG_MTD_PISMO)		+= pismo.o
 obj-$(CONFIG_MTD_PMC_MSP_EVM)   += pmcmsp-flash.o
 obj-$(CONFIG_MTD_PCMCIA)	+= pcmciamtd.o
 obj-$(CONFIG_MTD_RPXLITE)	+= rpxlite.o
 obj-$(CONFIG_MTD_TQM8XXL)	+= tqm8xxl.o
 obj-$(CONFIG_MTD_SA1100)	+= sa1100-flash.o
-obj-$(CONFIG_MTD_IPAQ)		+= ipaq-flash.o
 obj-$(CONFIG_MTD_SBC_GXX)	+= sbc_gxx.o
 obj-$(CONFIG_MTD_SC520CDP)	+= sc520cdp.o
 obj-$(CONFIG_MTD_NETSC520)	+= netsc520.o
diff --git a/drivers/mtd/maps/ipaq-flash.c b/drivers/mtd/maps/ipaq-flash.c
deleted file mode 100644
index 76708e796b70..000000000000
--- a/drivers/mtd/maps/ipaq-flash.c
+++ /dev/null
@@ -1,460 +0,0 @@
-/*
- * Flash memory access on iPAQ Handhelds (either SA1100 or PXA250 based)
- *
- * (C) 2000 Nicolas Pitre <nico@fluxnic.net>
- * (C) 2002 Hewlett-Packard Company <jamey.hicks@hp.com>
- * (C) 2003 Christian Pellegrin <chri@ascensit.com>, <chri@infis.univ.ts.it>: concatenation of multiple flashes
- */
-
-#include <linux/module.h>
-#include <linux/types.h>
-#include <linux/kernel.h>
-#include <linux/spinlock.h>
-#include <linux/init.h>
-#include <linux/slab.h>
-#include <asm/page.h>
-#include <asm/mach-types.h>
-#include <asm/system.h>
-#include <asm/errno.h>
-
-#include <linux/mtd/mtd.h>
-#include <linux/mtd/map.h>
-#include <linux/mtd/partitions.h>
-#ifdef CONFIG_MTD_CONCAT
-#include <linux/mtd/concat.h>
-#endif
-
-#include <mach/hardware.h>
-#include <mach/h3600.h>
-#include <asm/io.h>
-
-
-#ifndef CONFIG_IPAQ_HANDHELD
-#error This is for iPAQ Handhelds only
-#endif
-#ifdef CONFIG_SA1100_JORNADA56X
-
-static void jornada56x_set_vpp(struct map_info *map, int vpp)
-{
-	if (vpp)
-		GPSR = GPIO_GPIO26;
-	else
-		GPCR = GPIO_GPIO26;
-	GPDR |= GPIO_GPIO26;
-}
-
-#endif
-
-#ifdef CONFIG_SA1100_JORNADA720
-
-static void jornada720_set_vpp(struct map_info *map, int vpp)
-{
-	if (vpp)
-		PPSR |= 0x80;
-	else
-		PPSR &= ~0x80;
-	PPDR |= 0x80;
-}
-
-#endif
-
-#define MAX_IPAQ_CS 2		/* Number of CS we are going to test */
-
-#define IPAQ_MAP_INIT(X) \
-	{ \
-		name:		"IPAQ flash " X, \
-	}
-
-
-static struct map_info ipaq_map[MAX_IPAQ_CS] = {
-	IPAQ_MAP_INIT("bank 1"),
-	IPAQ_MAP_INIT("bank 2")
-};
-
-static struct mtd_info *my_sub_mtd[MAX_IPAQ_CS] = {
-	NULL,
-	NULL
-};
-
-/*
- * Here are partition information for all known IPAQ-based devices.
- * See include/linux/mtd/partitions.h for definition of the mtd_partition
- * structure.
- *
- * The *_max_flash_size is the maximum possible mapped flash size which
- * is not necessarily the actual flash size.  It must be no more than
- * the value specified in the "struct map_desc *_io_desc" mapping
- * definition for the corresponding machine.
- *
- * Please keep these in alphabetical order, and formatted as per existing
- * entries.  Thanks.
- */
-
-#ifdef CONFIG_IPAQ_HANDHELD
-static unsigned long h3xxx_max_flash_size = 0x04000000;
-static struct mtd_partition h3xxx_partitions[] = {
-	{
-		name:		"H3XXX boot firmware",
-#ifndef CONFIG_LAB
-		size:		0x00040000,
-#else
-		size:		0x00080000,
-#endif
-		offset:		0,
-#ifndef CONFIG_LAB
-		mask_flags:	MTD_WRITEABLE,  /* force read-only */
-#endif
-	},
-	{
-		name:		"H3XXX root jffs2",
-#ifndef CONFIG_LAB
-		size:		0x2000000 - 2*0x40000, /* Warning, this is fixed later */
-		offset:		0x00040000,
-#else
-		size:		0x2000000 - 0x40000 - 0x80000, /* Warning, this is fixed later */
-		offset:		0x00080000,
-#endif
-	},
-	{
-		name:		"asset",
-		size:		0x40000,
-		offset:		0x2000000 - 0x40000, /* Warning, this is fixed later */
-		mask_flags:	MTD_WRITEABLE,  /* force read-only */
-	}
-};
-
-#ifndef CONFIG_MTD_CONCAT
-static struct mtd_partition h3xxx_partitions_bank2[] = {
-	/* this is used only on 2 CS machines when concat is not present */
-	{
-		name:		"second H3XXX root jffs2",
-		size:		0x1000000 - 0x40000, /* Warning, this is fixed later */
-		offset:		0x00000000,
-	},
-	{
-		name:		"second asset",
-		size:		0x40000,
-		offset:		0x1000000 - 0x40000, /* Warning, this is fixed later */
-		mask_flags:	MTD_WRITEABLE,  /* force read-only */
-	}
-};
-#endif
-
-static DEFINE_SPINLOCK(ipaq_vpp_lock);
-
-static void h3xxx_set_vpp(struct map_info *map, int vpp)
-{
-	static int nest = 0;
-
-	spin_lock(&ipaq_vpp_lock);
-	if (vpp)
-		nest++;
-	else
-		nest--;
-	if (nest)
-		assign_h3600_egpio(IPAQ_EGPIO_VPP_ON, 1);
-	else
-		assign_h3600_egpio(IPAQ_EGPIO_VPP_ON, 0);
-	spin_unlock(&ipaq_vpp_lock);
-}
-
-#endif
-
-#if defined(CONFIG_SA1100_JORNADA56X) || defined(CONFIG_SA1100_JORNADA720)
-static unsigned long jornada_max_flash_size = 0x02000000;
-static struct mtd_partition jornada_partitions[] = {
-	{
-		name:		"Jornada boot firmware",
-		size:		0x00040000,
-		offset:		0,
-		mask_flags:	MTD_WRITEABLE,  /* force read-only */
-	}, {
-		name:		"Jornada root jffs2",
-		size:		MTDPART_SIZ_FULL,
-		offset:		0x00040000,
-	}
-};
-#endif
-
-
-static struct mtd_partition *parsed_parts;
-static struct mtd_info *mymtd;
-
-static unsigned long cs_phys[] = {
-#ifdef CONFIG_ARCH_SA1100
-	SA1100_CS0_PHYS,
-	SA1100_CS1_PHYS,
-	SA1100_CS2_PHYS,
-	SA1100_CS3_PHYS,
-	SA1100_CS4_PHYS,
-	SA1100_CS5_PHYS,
-#else
-	PXA_CS0_PHYS,
-	PXA_CS1_PHYS,
-	PXA_CS2_PHYS,
-	PXA_CS3_PHYS,
-	PXA_CS4_PHYS,
-	PXA_CS5_PHYS,
-#endif
-};
-
-static const char *part_probes[] = { "cmdlinepart", "RedBoot", NULL };
-
-static int __init h1900_special_case(void);
-
-static int __init ipaq_mtd_init(void)
-{
-	struct mtd_partition *parts = NULL;
-	int nb_parts = 0;
-	int parsed_nr_parts = 0;
-	const char *part_type;
-	int i; /* used when we have >1 flash chips */
-	unsigned long tot_flashsize = 0; /* used when we have >1 flash chips */
-
-	/* Default flash bankwidth */
-	// ipaq_map.bankwidth = (MSC0 & MSC_RBW) ? 2 : 4;
-
-	if (machine_is_h1900())
-	{
-		/* For our intents, the h1900 is not a real iPAQ, so we special-case it. */
-		return h1900_special_case();
-	}
-
-	if (machine_is_h3100() || machine_is_h1900())
-		for(i=0; i<MAX_IPAQ_CS; i++)
-			ipaq_map[i].bankwidth = 2;
-	else
-		for(i=0; i<MAX_IPAQ_CS; i++)
-			ipaq_map[i].bankwidth = 4;
-
-	/*
-	 * Static partition definition selection
-	 */
-	part_type = "static";
-
-	simple_map_init(&ipaq_map[0]);
-	simple_map_init(&ipaq_map[1]);
-
-#ifdef CONFIG_IPAQ_HANDHELD
-	if (machine_is_ipaq()) {
-		parts = h3xxx_partitions;
-		nb_parts = ARRAY_SIZE(h3xxx_partitions);
-		for(i=0; i<MAX_IPAQ_CS; i++) {
-			ipaq_map[i].size = h3xxx_max_flash_size;
-			ipaq_map[i].set_vpp = h3xxx_set_vpp;
-			ipaq_map[i].phys = cs_phys[i];
-			ipaq_map[i].virt = ioremap(cs_phys[i], 0x04000000);
-			if (machine_is_h3100 () || machine_is_h1900())
-				ipaq_map[i].bankwidth = 2;
-		}
-		if (machine_is_h3600()) {
-			/* No asset partition here */
-			h3xxx_partitions[1].size += 0x40000;
-			nb_parts--;
-		}
-	}
-#endif
-#ifdef CONFIG_ARCH_H5400
-	if (machine_is_h5400()) {
-		ipaq_map[0].size = 0x02000000;
-		ipaq_map[1].size = 0x02000000;
-		ipaq_map[1].phys = 0x02000000;
-		ipaq_map[1].virt = ipaq_map[0].virt + 0x02000000;
-	}
-#endif
-#ifdef CONFIG_ARCH_H1900
-	if (machine_is_h1900()) {
-		ipaq_map[0].size = 0x00400000;
-		ipaq_map[1].size = 0x02000000;
-		ipaq_map[1].phys = 0x00080000;
-		ipaq_map[1].virt = ipaq_map[0].virt + 0x00080000;
-	}
-#endif
-
-#ifdef CONFIG_SA1100_JORNADA56X
-	if (machine_is_jornada56x()) {
-		parts = jornada_partitions;
-		nb_parts = ARRAY_SIZE(jornada_partitions);
-		ipaq_map[0].size = jornada_max_flash_size;
-		ipaq_map[0].set_vpp = jornada56x_set_vpp;
-		ipaq_map[0].virt = (__u32)ioremap(0x0, 0x04000000);
-	}
-#endif
-#ifdef CONFIG_SA1100_JORNADA720
-	if (machine_is_jornada720()) {
-		parts = jornada_partitions;
-		nb_parts = ARRAY_SIZE(jornada_partitions);
-		ipaq_map[0].size = jornada_max_flash_size;
-		ipaq_map[0].set_vpp = jornada720_set_vpp;
-	}
-#endif
-
-
-	if (machine_is_ipaq()) { /* for iPAQs only */
-		for(i=0; i<MAX_IPAQ_CS; i++) {
-			printk(KERN_NOTICE "iPAQ flash: probing %d-bit flash bus, window=%lx with CFI.\n", ipaq_map[i].bankwidth*8, ipaq_map[i].virt);
-			my_sub_mtd[i] = do_map_probe("cfi_probe", &ipaq_map[i]);
-			if (!my_sub_mtd[i]) {
-				printk(KERN_NOTICE "iPAQ flash: probing %d-bit flash bus, window=%lx with JEDEC.\n", ipaq_map[i].bankwidth*8, ipaq_map[i].virt);
-				my_sub_mtd[i] = do_map_probe("jedec_probe", &ipaq_map[i]);
-			}
-			if (!my_sub_mtd[i]) {
-				printk(KERN_NOTICE "iPAQ flash: failed to find flash.\n");
-				if (i)
-					break;
-				else
-					return -ENXIO;
-			} else
-				printk(KERN_NOTICE "iPAQ flash: found %d bytes\n", my_sub_mtd[i]->size);
-
-			/* do we really need this debugging? --joshua 20030703 */
-			// printk("my_sub_mtd[%d]=%p\n", i, my_sub_mtd[i]);
-			my_sub_mtd[i]->owner = THIS_MODULE;
-			tot_flashsize += my_sub_mtd[i]->size;
-		}
-#ifdef CONFIG_MTD_CONCAT
-		/* fix the asset location */
-#	ifdef CONFIG_LAB
-		h3xxx_partitions[1].size = tot_flashsize - 0x40000 - 0x80000 /* extra big boot block */;
-#	else
-		h3xxx_partitions[1].size = tot_flashsize - 2 * 0x40000;
-#	endif
-		h3xxx_partitions[2].offset = tot_flashsize - 0x40000;
-		/* and concat the devices */
-		mymtd = mtd_concat_create(&my_sub_mtd[0], i,
-					  "ipaq");
-		if (!mymtd) {
-			printk("Cannot create iPAQ concat device\n");
-			return -ENXIO;
-		}
-#else
-		mymtd = my_sub_mtd[0];
-
-		/*
-		 *In the very near future, command line partition parsing
-		 * will use the device name as 'mtd-id' instead of a value
-		 * passed to the parse_cmdline_partitions() routine. Since
-		 * the bootldr says 'ipaq', make sure it continues to work.
-		 */
-		mymtd->name = "ipaq";
-
-		if ((machine_is_h3600())) {
-#	ifdef CONFIG_LAB
-			h3xxx_partitions[1].size = my_sub_mtd[0]->size - 0x80000;
-#	else
-			h3xxx_partitions[1].size = my_sub_mtd[0]->size - 0x40000;
-#	endif
-			nb_parts = 2;
-		} else {
-#	ifdef CONFIG_LAB
-			h3xxx_partitions[1].size = my_sub_mtd[0]->size - 0x40000 - 0x80000; /* extra big boot block */
-#	else
-			h3xxx_partitions[1].size = my_sub_mtd[0]->size - 2*0x40000;
-#	endif
-			h3xxx_partitions[2].offset = my_sub_mtd[0]->size - 0x40000;
-		}
-
-		if (my_sub_mtd[1]) {
-#	ifdef CONFIG_LAB
-			h3xxx_partitions_bank2[0].size = my_sub_mtd[1]->size - 0x80000;
-#	else
-			h3xxx_partitions_bank2[0].size = my_sub_mtd[1]->size - 0x40000;
-#	endif
-			h3xxx_partitions_bank2[1].offset = my_sub_mtd[1]->size - 0x40000;
-		}
-#endif
-	}
-	else {
-		/*
-		 * Now let's probe for the actual flash.  Do it here since
-		 * specific machine settings might have been set above.
-		 */
-		printk(KERN_NOTICE "IPAQ flash: probing %d-bit flash bus, window=%lx\n", ipaq_map[0].bankwidth*8, ipaq_map[0].virt);
-		mymtd = do_map_probe("cfi_probe", &ipaq_map[0]);
-		if (!mymtd)
-			return -ENXIO;
-		mymtd->owner = THIS_MODULE;
-	}
-
-
-	/*
-	 * Dynamic partition selection stuff (might override the static ones)
-	 */
-
-	 i = parse_mtd_partitions(mymtd, part_probes, &parsed_parts, 0);
-
-	 if (i > 0) {
-		 nb_parts = parsed_nr_parts = i;
-		 parts = parsed_parts;
-		 part_type = "dynamic";
-	 }
-
-	 if (!parts) {
-		 printk(KERN_NOTICE "IPAQ flash: no partition info available, registering whole flash at once\n");
-		 add_mtd_device(mymtd);
-#ifndef CONFIG_MTD_CONCAT
-		 if (my_sub_mtd[1])
-			 add_mtd_device(my_sub_mtd[1]);
-#endif
-	 } else {
-		 printk(KERN_NOTICE "Using %s partition definition\n", part_type);
-		 add_mtd_partitions(mymtd, parts, nb_parts);
-#ifndef CONFIG_MTD_CONCAT
-		 if (my_sub_mtd[1])
-			 add_mtd_partitions(my_sub_mtd[1], h3xxx_partitions_bank2, ARRAY_SIZE(h3xxx_partitions_bank2));
-#endif
-	 }
-
-	 return 0;
-}
-
-static void __exit ipaq_mtd_cleanup(void)
-{
-	int i;
-
-	if (mymtd) {
-		del_mtd_partitions(mymtd);
-#ifndef CONFIG_MTD_CONCAT
-		if (my_sub_mtd[1])
-			del_mtd_partitions(my_sub_mtd[1]);
-#endif
-		map_destroy(mymtd);
-#ifdef CONFIG_MTD_CONCAT
-		for(i=0; i<MAX_IPAQ_CS; i++)
-#else
-			for(i=1; i<MAX_IPAQ_CS; i++)
-#endif
-			{
-				if (my_sub_mtd[i])
-					map_destroy(my_sub_mtd[i]);
-			}
-		kfree(parsed_parts);
-	}
-}
-
-static int __init h1900_special_case(void)
-{
-	/* The iPAQ h1900 is a special case - it has weird ROM. */
-	simple_map_init(&ipaq_map[0]);
-	ipaq_map[0].size = 0x80000;
-	ipaq_map[0].set_vpp = h3xxx_set_vpp;
-	ipaq_map[0].phys = 0x0;
-	ipaq_map[0].virt = ioremap(0x0, 0x04000000);
-	ipaq_map[0].bankwidth = 2;
-
-	printk(KERN_NOTICE "iPAQ flash: probing %d-bit flash bus, window=%lx with JEDEC.\n", ipaq_map[0].bankwidth*8, ipaq_map[0].virt);
-	mymtd = do_map_probe("jedec_probe", &ipaq_map[0]);
-	if (!mymtd)
-		return -ENODEV;
-	add_mtd_device(mymtd);
-	printk(KERN_NOTICE "iPAQ flash: registered h1910 flash\n");
-
-	return 0;
-}
-
-module_init(ipaq_mtd_init);
-module_exit(ipaq_mtd_cleanup);
-
-MODULE_AUTHOR("Jamey Hicks");
-MODULE_DESCRIPTION("IPAQ CFI map driver");
-MODULE_LICENSE("MIT");
diff --git a/drivers/mtd/maps/ixp4xx.c b/drivers/mtd/maps/ixp4xx.c
index 7214b876feba..7b0515297411 100644
--- a/drivers/mtd/maps/ixp4xx.c
+++ b/drivers/mtd/maps/ixp4xx.c
@@ -210,7 +210,7 @@ static int ixp4xx_flash_probe(struct platform_device *dev)
 	 * not attempt to do a direct access on us.
 	 */
 	info->map.phys = NO_XIP;
-	info->map.size = dev->resource->end - dev->resource->start + 1;
+	info->map.size = resource_size(dev->resource);
 
 	/*
 	 * We only support 16-bit accesses for now. If and when
@@ -224,7 +224,7 @@ static int ixp4xx_flash_probe(struct platform_device *dev)
 	info->map.copy_from = ixp4xx_copy_from,
 
 	info->res = request_mem_region(dev->resource->start,
-			dev->resource->end - dev->resource->start + 1,
+			resource_size(dev->resource),
 			"IXP4XXFlash");
 	if (!info->res) {
 		printk(KERN_ERR "IXP4XXFlash: Could not reserve memory region\n");
@@ -233,7 +233,7 @@ static int ixp4xx_flash_probe(struct platform_device *dev)
 	}
 
 	info->map.virt = ioremap(dev->resource->start,
-				 dev->resource->end - dev->resource->start + 1);
+				 resource_size(dev->resource));
 	if (!info->map.virt) {
 		printk(KERN_ERR "IXP4XXFlash: Failed to ioremap region\n");
 		err = -EIO;
diff --git a/drivers/mtd/maps/physmap.c b/drivers/mtd/maps/physmap.c
index 380648e9051a..d9603f7f9652 100644
--- a/drivers/mtd/maps/physmap.c
+++ b/drivers/mtd/maps/physmap.c
@@ -48,23 +48,22 @@ static int physmap_flash_remove(struct platform_device *dev)
 
 	if (info->cmtd) {
 #ifdef CONFIG_MTD_PARTITIONS
-		if (info->nr_parts || physmap_data->nr_parts)
+		if (info->nr_parts || physmap_data->nr_parts) {
 			del_mtd_partitions(info->cmtd);
-		else
+
+			if (info->nr_parts)
+				kfree(info->parts);
+		} else {
 			del_mtd_device(info->cmtd);
+		}
 #else
 		del_mtd_device(info->cmtd);
 #endif
-	}
-#ifdef CONFIG_MTD_PARTITIONS
-	if (info->nr_parts)
-		kfree(info->parts);
-#endif
-
 #ifdef CONFIG_MTD_CONCAT
-	if (info->cmtd != info->mtd[0])
-		mtd_concat_destroy(info->cmtd);
+		if (info->cmtd != info->mtd[0])
+			mtd_concat_destroy(info->cmtd);
 #endif
+	}
 
 	for (i = 0; i < MAX_RESOURCES; i++) {
 		if (info->mtd[i] != NULL)
@@ -130,7 +129,7 @@ static int physmap_flash_probe(struct platform_device *dev)
 						 info->map[i].size);
 		if (info->map[i].virt == NULL) {
 			dev_err(&dev->dev, "Failed to ioremap flash region\n");
-			err = EIO;
+			err = -EIO;
 			goto err_out;
 		}
 
diff --git a/drivers/mtd/maps/pxa2xx-flash.c b/drivers/mtd/maps/pxa2xx-flash.c
index 74fa075c838a..b13f6417b5b2 100644
--- a/drivers/mtd/maps/pxa2xx-flash.c
+++ b/drivers/mtd/maps/pxa2xx-flash.c
@@ -20,14 +20,23 @@
 
 #include <asm/io.h>
 #include <mach/hardware.h>
-#include <asm/cacheflush.h>
 
 #include <asm/mach/flash.h>
 
+#define CACHELINESIZE	32
+
 static void pxa2xx_map_inval_cache(struct map_info *map, unsigned long from,
 				      ssize_t len)
 {
-	flush_ioremap_region(map->phys, map->cached, from, len);
+	unsigned long start = (unsigned long)map->cached + from;
+	unsigned long end = start + len;
+
+	start &= ~(CACHELINESIZE - 1);
+	while (start < end) {
+		/* invalidate D cache line */
+		asm volatile ("mcr p15, 0, %0, c7, c6, 1" : : "r" (start));
+		start += CACHELINESIZE;
+	}
 }
 
 struct pxa2xx_flash_info {
diff --git a/drivers/mtd/maps/sa1100-flash.c b/drivers/mtd/maps/sa1100-flash.c
index d7a47574d21e..f3af87e08ecd 100644
--- a/drivers/mtd/maps/sa1100-flash.c
+++ b/drivers/mtd/maps/sa1100-flash.c
@@ -248,7 +248,7 @@ static void sa1100_destroy(struct sa_info *info, struct flash_platform_data *pla
 		plat->exit();
 }
 
-static struct sa_info *__init
+static struct sa_info *__devinit
 sa1100_setup_mtd(struct platform_device *pdev, struct flash_platform_data *plat)
 {
 	struct sa_info *info;
diff --git a/drivers/mtd/maps/vmu-flash.c b/drivers/mtd/maps/vmu-flash.c
index 1f73297e7776..82afad0ddd72 100644
--- a/drivers/mtd/maps/vmu-flash.c
+++ b/drivers/mtd/maps/vmu-flash.c
@@ -612,16 +612,15 @@ static int __devinit vmu_connect(struct maple_device *mdev)
 
 	test_flash_data = be32_to_cpu(mdev->devinfo.function);
 	/* Need to count how many bits are set - to find out which
-	 * function_data element has details of the memory card:
-	 * using Brian Kernighan's/Peter Wegner's method */
-	for (c = 0; test_flash_data; c++)
-		test_flash_data &= test_flash_data - 1;
+	 * function_data element has details of the memory card
+	 */
+	c = hweight_long(test_flash_data);
 
 	basic_flash_data = be32_to_cpu(mdev->devinfo.function_data[c - 1]);
 
 	card = kmalloc(sizeof(struct memcard), GFP_KERNEL);
 	if (!card) {
-		error = ENOMEM;
+		error = -ENOMEM;
 		goto fail_nomem;
 	}
 
diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c
index 64e2b379a350..c82e09bbc5fd 100644
--- a/drivers/mtd/mtd_blkdevs.c
+++ b/drivers/mtd/mtd_blkdevs.c
@@ -84,9 +84,6 @@ static int mtd_blktrans_thread(void *arg)
 	struct request_queue *rq = tr->blkcore_priv->rq;
 	struct request *req = NULL;
 
-	/* we might get involved when memory gets low, so use PF_MEMALLOC */
-	current->flags |= PF_MEMALLOC;
-
 	spin_lock_irq(rq->queue_lock);
 
 	while (!kthread_should_stop()) {
@@ -381,7 +378,7 @@ int register_mtd_blktrans(struct mtd_blktrans_ops *tr)
 	tr->blkcore_priv->thread = kthread_run(mtd_blktrans_thread, tr,
 			"%sd", tr->name);
 	if (IS_ERR(tr->blkcore_priv->thread)) {
-		int ret = PTR_ERR(tr->blkcore_priv->thread);
+		ret = PTR_ERR(tr->blkcore_priv->thread);
 		blk_cleanup_queue(tr->blkcore_priv->rq);
 		unregister_blkdev(tr->major, tr->name);
 		kfree(tr->blkcore_priv);
diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c
index 467a4f177bfb..c356c0a30c3e 100644
--- a/drivers/mtd/mtdcore.c
+++ b/drivers/mtd/mtdcore.c
@@ -447,7 +447,7 @@ struct mtd_info *get_mtd_device(struct mtd_info *mtd, int num)
 		for (i=0; i< MAX_MTD_DEVICES; i++)
 			if (mtd_table[i] == mtd)
 				ret = mtd_table[i];
-	} else if (num < MAX_MTD_DEVICES) {
+	} else if (num >= 0 && num < MAX_MTD_DEVICES) {
 		ret = mtd_table[num];
 		if (mtd && mtd != ret)
 			ret = NULL;
diff --git a/drivers/mtd/mtdoops.c b/drivers/mtd/mtdoops.c
index 1060337c06df..a714ec482761 100644
--- a/drivers/mtd/mtdoops.c
+++ b/drivers/mtd/mtdoops.c
@@ -29,14 +29,34 @@
 #include <linux/sched.h>
 #include <linux/wait.h>
 #include <linux/delay.h>
-#include <linux/spinlock.h>
 #include <linux/interrupt.h>
 #include <linux/mtd/mtd.h>
+#include <linux/kmsg_dump.h>
+
+/* Maximum MTD partition size */
+#define MTDOOPS_MAX_MTD_SIZE (8 * 1024 * 1024)
 
 #define MTDOOPS_KERNMSG_MAGIC 0x5d005d00
-#define OOPS_PAGE_SIZE 4096
+#define MTDOOPS_HEADER_SIZE   8
+
+static unsigned long record_size = 4096;
+module_param(record_size, ulong, 0400);
+MODULE_PARM_DESC(record_size,
+		"record size for MTD OOPS pages in bytes (default 4096)");
+
+static char mtddev[80];
+module_param_string(mtddev, mtddev, 80, 0400);
+MODULE_PARM_DESC(mtddev,
+		"name or index number of the MTD device to use");
+
+static int dump_oops = 1;
+module_param(dump_oops, int, 0600);
+MODULE_PARM_DESC(dump_oops,
+		"set to 1 to dump oopses, 0 to only dump panics (default 1)");
 
 static struct mtdoops_context {
+	struct kmsg_dumper dump;
+
 	int mtd_index;
 	struct work_struct work_erase;
 	struct work_struct work_write;
@@ -44,28 +64,43 @@ static struct mtdoops_context {
 	int oops_pages;
 	int nextpage;
 	int nextcount;
-	char *name;
+	unsigned long *oops_page_used;
 
 	void *oops_buf;
-
-	/* writecount and disabling ready are spin lock protected */
-	spinlock_t writecount_lock;
-	int ready;
-	int writecount;
 } oops_cxt;
 
+static void mark_page_used(struct mtdoops_context *cxt, int page)
+{
+	set_bit(page, cxt->oops_page_used);
+}
+
+static void mark_page_unused(struct mtdoops_context *cxt, int page)
+{
+	clear_bit(page, cxt->oops_page_used);
+}
+
+static int page_is_used(struct mtdoops_context *cxt, int page)
+{
+	return test_bit(page, cxt->oops_page_used);
+}
+
 static void mtdoops_erase_callback(struct erase_info *done)
 {
 	wait_queue_head_t *wait_q = (wait_queue_head_t *)done->priv;
 	wake_up(wait_q);
 }
 
-static int mtdoops_erase_block(struct mtd_info *mtd, int offset)
+static int mtdoops_erase_block(struct mtdoops_context *cxt, int offset)
 {
+	struct mtd_info *mtd = cxt->mtd;
+	u32 start_page_offset = mtd_div_by_eb(offset, mtd) * mtd->erasesize;
+	u32 start_page = start_page_offset / record_size;
+	u32 erase_pages = mtd->erasesize / record_size;
 	struct erase_info erase;
 	DECLARE_WAITQUEUE(wait, current);
 	wait_queue_head_t wait_q;
 	int ret;
+	int page;
 
 	init_waitqueue_head(&wait_q);
 	erase.mtd = mtd;
@@ -81,25 +116,24 @@ static int mtdoops_erase_block(struct mtd_info *mtd, int offset)
 	if (ret) {
 		set_current_state(TASK_RUNNING);
 		remove_wait_queue(&wait_q, &wait);
-		printk (KERN_WARNING "mtdoops: erase of region [0x%llx, 0x%llx] "
-				     "on \"%s\" failed\n",
-			(unsigned long long)erase.addr, (unsigned long long)erase.len, mtd->name);
+		printk(KERN_WARNING "mtdoops: erase of region [0x%llx, 0x%llx] on \"%s\" failed\n",
+		       (unsigned long long)erase.addr,
+		       (unsigned long long)erase.len, mtddev);
 		return ret;
 	}
 
 	schedule();  /* Wait for erase to finish. */
 	remove_wait_queue(&wait_q, &wait);
 
+	/* Mark pages as unused */
+	for (page = start_page; page < start_page + erase_pages; page++)
+		mark_page_unused(cxt, page);
+
 	return 0;
 }
 
 static void mtdoops_inc_counter(struct mtdoops_context *cxt)
 {
-	struct mtd_info *mtd = cxt->mtd;
-	size_t retlen;
-	u32 count;
-	int ret;
-
 	cxt->nextpage++;
 	if (cxt->nextpage >= cxt->oops_pages)
 		cxt->nextpage = 0;
@@ -107,25 +141,13 @@ static void mtdoops_inc_counter(struct mtdoops_context *cxt)
 	if (cxt->nextcount == 0xffffffff)
 		cxt->nextcount = 0;
 
-	ret = mtd->read(mtd, cxt->nextpage * OOPS_PAGE_SIZE, 4,
-			&retlen, (u_char *) &count);
-	if ((retlen != 4) || ((ret < 0) && (ret != -EUCLEAN))) {
-		printk(KERN_ERR "mtdoops: Read failure at %d (%td of 4 read)"
-				", err %d.\n", cxt->nextpage * OOPS_PAGE_SIZE,
-				retlen, ret);
+	if (page_is_used(cxt, cxt->nextpage)) {
 		schedule_work(&cxt->work_erase);
 		return;
 	}
 
-	/* See if we need to erase the next block */
-	if (count != 0xffffffff) {
-		schedule_work(&cxt->work_erase);
-		return;
-	}
-
-	printk(KERN_DEBUG "mtdoops: Ready %d, %d (no erase)\n",
-			cxt->nextpage, cxt->nextcount);
-	cxt->ready = 1;
+	printk(KERN_DEBUG "mtdoops: ready %d, %d (no erase)\n",
+	       cxt->nextpage, cxt->nextcount);
 }
 
 /* Scheduled work - when we can't proceed without erasing a block */
@@ -140,47 +162,47 @@ static void mtdoops_workfunc_erase(struct work_struct *work)
 	if (!mtd)
 		return;
 
-	mod = (cxt->nextpage * OOPS_PAGE_SIZE) % mtd->erasesize;
+	mod = (cxt->nextpage * record_size) % mtd->erasesize;
 	if (mod != 0) {
-		cxt->nextpage = cxt->nextpage + ((mtd->erasesize - mod) / OOPS_PAGE_SIZE);
+		cxt->nextpage = cxt->nextpage + ((mtd->erasesize - mod) / record_size);
 		if (cxt->nextpage >= cxt->oops_pages)
 			cxt->nextpage = 0;
 	}
 
 	while (mtd->block_isbad) {
-		ret = mtd->block_isbad(mtd, cxt->nextpage * OOPS_PAGE_SIZE);
+		ret = mtd->block_isbad(mtd, cxt->nextpage * record_size);
 		if (!ret)
 			break;
 		if (ret < 0) {
-			printk(KERN_ERR "mtdoops: block_isbad failed, aborting.\n");
+			printk(KERN_ERR "mtdoops: block_isbad failed, aborting\n");
 			return;
 		}
 badblock:
-		printk(KERN_WARNING "mtdoops: Bad block at %08x\n",
-				cxt->nextpage * OOPS_PAGE_SIZE);
+		printk(KERN_WARNING "mtdoops: bad block at %08lx\n",
+		       cxt->nextpage * record_size);
 		i++;
-		cxt->nextpage = cxt->nextpage + (mtd->erasesize / OOPS_PAGE_SIZE);
+		cxt->nextpage = cxt->nextpage + (mtd->erasesize / record_size);
 		if (cxt->nextpage >= cxt->oops_pages)
 			cxt->nextpage = 0;
-		if (i == (cxt->oops_pages / (mtd->erasesize / OOPS_PAGE_SIZE))) {
-			printk(KERN_ERR "mtdoops: All blocks bad!\n");
+		if (i == cxt->oops_pages / (mtd->erasesize / record_size)) {
+			printk(KERN_ERR "mtdoops: all blocks bad!\n");
 			return;
 		}
 	}
 
 	for (j = 0, ret = -1; (j < 3) && (ret < 0); j++)
-		ret = mtdoops_erase_block(mtd, cxt->nextpage * OOPS_PAGE_SIZE);
+		ret = mtdoops_erase_block(cxt, cxt->nextpage * record_size);
 
 	if (ret >= 0) {
-		printk(KERN_DEBUG "mtdoops: Ready %d, %d \n", cxt->nextpage, cxt->nextcount);
-		cxt->ready = 1;
+		printk(KERN_DEBUG "mtdoops: ready %d, %d\n",
+		       cxt->nextpage, cxt->nextcount);
 		return;
 	}
 
-	if (mtd->block_markbad && (ret == -EIO)) {
-		ret = mtd->block_markbad(mtd, cxt->nextpage * OOPS_PAGE_SIZE);
+	if (mtd->block_markbad && ret == -EIO) {
+		ret = mtd->block_markbad(mtd, cxt->nextpage * record_size);
 		if (ret < 0) {
-			printk(KERN_ERR "mtdoops: block_markbad failed, aborting.\n");
+			printk(KERN_ERR "mtdoops: block_markbad failed, aborting\n");
 			return;
 		}
 	}
@@ -191,36 +213,37 @@ static void mtdoops_write(struct mtdoops_context *cxt, int panic)
 {
 	struct mtd_info *mtd = cxt->mtd;
 	size_t retlen;
+	u32 *hdr;
 	int ret;
 
-	if (cxt->writecount < OOPS_PAGE_SIZE)
-		memset(cxt->oops_buf + cxt->writecount, 0xff,
-					OOPS_PAGE_SIZE - cxt->writecount);
+	/* Add mtdoops header to the buffer */
+	hdr = cxt->oops_buf;
+	hdr[0] = cxt->nextcount;
+	hdr[1] = MTDOOPS_KERNMSG_MAGIC;
 
 	if (panic)
-		ret = mtd->panic_write(mtd, cxt->nextpage * OOPS_PAGE_SIZE,
-					OOPS_PAGE_SIZE, &retlen, cxt->oops_buf);
+		ret = mtd->panic_write(mtd, cxt->nextpage * record_size,
+					record_size, &retlen, cxt->oops_buf);
 	else
-		ret = mtd->write(mtd, cxt->nextpage * OOPS_PAGE_SIZE,
-					OOPS_PAGE_SIZE, &retlen, cxt->oops_buf);
-
-	cxt->writecount = 0;
+		ret = mtd->write(mtd, cxt->nextpage * record_size,
+					record_size, &retlen, cxt->oops_buf);
 
-	if ((retlen != OOPS_PAGE_SIZE) || (ret < 0))
-		printk(KERN_ERR "mtdoops: Write failure at %d (%td of %d written), err %d.\n",
-			cxt->nextpage * OOPS_PAGE_SIZE, retlen,	OOPS_PAGE_SIZE, ret);
+	if (retlen != record_size || ret < 0)
+		printk(KERN_ERR "mtdoops: write failure at %ld (%td of %ld written), error %d\n",
+		       cxt->nextpage * record_size, retlen, record_size, ret);
+	mark_page_used(cxt, cxt->nextpage);
+	memset(cxt->oops_buf, 0xff, record_size);
 
 	mtdoops_inc_counter(cxt);
 }
 
-
 static void mtdoops_workfunc_write(struct work_struct *work)
 {
 	struct mtdoops_context *cxt =
 			container_of(work, struct mtdoops_context, work_write);
 
 	mtdoops_write(cxt, 0);
-}					
+}
 
 static void find_next_position(struct mtdoops_context *cxt)
 {
@@ -230,28 +253,33 @@ static void find_next_position(struct mtdoops_context *cxt)
 	size_t retlen;
 
 	for (page = 0; page < cxt->oops_pages; page++) {
-		ret = mtd->read(mtd, page * OOPS_PAGE_SIZE, 8, &retlen, (u_char *) &count[0]);
-		if ((retlen != 8) || ((ret < 0) && (ret != -EUCLEAN))) {
-			printk(KERN_ERR "mtdoops: Read failure at %d (%td of 8 read)"
-				", err %d.\n", page * OOPS_PAGE_SIZE, retlen, ret);
+		/* Assume the page is used */
+		mark_page_used(cxt, page);
+		ret = mtd->read(mtd, page * record_size, MTDOOPS_HEADER_SIZE,
+				&retlen, (u_char *) &count[0]);
+		if (retlen != MTDOOPS_HEADER_SIZE ||
+				(ret < 0 && ret != -EUCLEAN)) {
+			printk(KERN_ERR "mtdoops: read failure at %ld (%td of %d read), err %d\n",
+			       page * record_size, retlen,
+			       MTDOOPS_HEADER_SIZE, ret);
 			continue;
 		}
 
-		if (count[1] != MTDOOPS_KERNMSG_MAGIC)
-			continue;
+		if (count[0] == 0xffffffff && count[1] == 0xffffffff)
+			mark_page_unused(cxt, page);
 		if (count[0] == 0xffffffff)
 			continue;
 		if (maxcount == 0xffffffff) {
 			maxcount = count[0];
 			maxpos = page;
-		} else if ((count[0] < 0x40000000) && (maxcount > 0xc0000000)) {
+		} else if (count[0] < 0x40000000 && maxcount > 0xc0000000) {
 			maxcount = count[0];
 			maxpos = page;
-		} else if ((count[0] > maxcount) && (count[0] < 0xc0000000)) {
+		} else if (count[0] > maxcount && count[0] < 0xc0000000) {
 			maxcount = count[0];
 			maxpos = page;
-		} else if ((count[0] > maxcount) && (count[0] > 0xc0000000)
-					&& (maxcount > 0x80000000)) {
+		} else if (count[0] > maxcount && count[0] > 0xc0000000
+					&& maxcount > 0x80000000) {
 			maxcount = count[0];
 			maxpos = page;
 		}
@@ -269,187 +297,170 @@ static void find_next_position(struct mtdoops_context *cxt)
 	mtdoops_inc_counter(cxt);
 }
 
-
-static void mtdoops_notify_add(struct mtd_info *mtd)
+static void mtdoops_do_dump(struct kmsg_dumper *dumper,
+		enum kmsg_dump_reason reason, const char *s1, unsigned long l1,
+		const char *s2, unsigned long l2)
 {
-	struct mtdoops_context *cxt = &oops_cxt;
+	struct mtdoops_context *cxt = container_of(dumper,
+			struct mtdoops_context, dump);
+	unsigned long s1_start, s2_start;
+	unsigned long l1_cpy, l2_cpy;
+	char *dst;
+
+	/* Only dump oopses if dump_oops is set */
+	if (reason == KMSG_DUMP_OOPS && !dump_oops)
+		return;
 
-	if (cxt->name && !strcmp(mtd->name, cxt->name))
-		cxt->mtd_index = mtd->index;
+	dst = cxt->oops_buf + MTDOOPS_HEADER_SIZE; /* Skip the header */
+	l2_cpy = min(l2, record_size - MTDOOPS_HEADER_SIZE);
+	l1_cpy = min(l1, record_size - MTDOOPS_HEADER_SIZE - l2_cpy);
 
-	if ((mtd->index != cxt->mtd_index) || cxt->mtd_index < 0)
-		return;
+	s2_start = l2 - l2_cpy;
+	s1_start = l1 - l1_cpy;
 
-	if (mtd->size < (mtd->erasesize * 2)) {
-		printk(KERN_ERR "MTD partition %d not big enough for mtdoops\n",
-				mtd->index);
-		return;
-	}
+	memcpy(dst, s1 + s1_start, l1_cpy);
+	memcpy(dst + l1_cpy, s2 + s2_start, l2_cpy);
 
-	if (mtd->erasesize < OOPS_PAGE_SIZE) {
-		printk(KERN_ERR "Eraseblock size of MTD partition %d too small\n",
-				mtd->index);
+	/* Panics must be written immediately */
+	if (reason == KMSG_DUMP_PANIC) {
+		if (!cxt->mtd->panic_write)
+			printk(KERN_ERR "mtdoops: Cannot write from panic without panic_write\n");
+		else
+			mtdoops_write(cxt, 1);
 		return;
 	}
 
-	cxt->mtd = mtd;
-	if (mtd->size > INT_MAX)
-		cxt->oops_pages = INT_MAX / OOPS_PAGE_SIZE;
-	else
-		cxt->oops_pages = (int)mtd->size / OOPS_PAGE_SIZE;
-
-	find_next_position(cxt);
-
-	printk(KERN_INFO "mtdoops: Attached to MTD device %d\n", mtd->index);
+	/* For other cases, schedule work to write it "nicely" */
+	schedule_work(&cxt->work_write);
 }
 
-static void mtdoops_notify_remove(struct mtd_info *mtd)
+static void mtdoops_notify_add(struct mtd_info *mtd)
 {
 	struct mtdoops_context *cxt = &oops_cxt;
+	u64 mtdoops_pages = div_u64(mtd->size, record_size);
+	int err;
 
-	if ((mtd->index != cxt->mtd_index) || cxt->mtd_index < 0)
-		return;
-
-	cxt->mtd = NULL;
-	flush_scheduled_work();
-}
-
-static void mtdoops_console_sync(void)
-{
-	struct mtdoops_context *cxt = &oops_cxt;
-	struct mtd_info *mtd = cxt->mtd;
-	unsigned long flags;
+	if (!strcmp(mtd->name, mtddev))
+		cxt->mtd_index = mtd->index;
 
-	if (!cxt->ready || !mtd || cxt->writecount == 0)
+	if (mtd->index != cxt->mtd_index || cxt->mtd_index < 0)
 		return;
 
-	/* 
-	 *  Once ready is 0 and we've held the lock no further writes to the 
-	 *  buffer will happen
-	 */
-	spin_lock_irqsave(&cxt->writecount_lock, flags);
-	if (!cxt->ready) {
-		spin_unlock_irqrestore(&cxt->writecount_lock, flags);
+	if (mtd->size < mtd->erasesize * 2) {
+		printk(KERN_ERR "mtdoops: MTD partition %d not big enough for mtdoops\n",
+		       mtd->index);
 		return;
 	}
-	cxt->ready = 0;
-	spin_unlock_irqrestore(&cxt->writecount_lock, flags);
-
-	if (mtd->panic_write && in_interrupt())
-		/* Interrupt context, we're going to panic so try and log */
-		mtdoops_write(cxt, 1);
-	else
-		schedule_work(&cxt->work_write);
-}
-
-static void
-mtdoops_console_write(struct console *co, const char *s, unsigned int count)
-{
-	struct mtdoops_context *cxt = co->data;
-	struct mtd_info *mtd = cxt->mtd;
-	unsigned long flags;
-
-	if (!oops_in_progress) {
-		mtdoops_console_sync();
+	if (mtd->erasesize < record_size) {
+		printk(KERN_ERR "mtdoops: eraseblock size of MTD partition %d too small\n",
+		       mtd->index);
 		return;
 	}
-
-	if (!cxt->ready || !mtd)
+	if (mtd->size > MTDOOPS_MAX_MTD_SIZE) {
+		printk(KERN_ERR "mtdoops: mtd%d is too large (limit is %d MiB)\n",
+		       mtd->index, MTDOOPS_MAX_MTD_SIZE / 1024 / 1024);
 		return;
+	}
 
-	/* Locking on writecount ensures sequential writes to the buffer */
-	spin_lock_irqsave(&cxt->writecount_lock, flags);
-
-	/* Check ready status didn't change whilst waiting for the lock */
-	if (!cxt->ready) {
-		spin_unlock_irqrestore(&cxt->writecount_lock, flags);
+	/* oops_page_used is a bit field */
+	cxt->oops_page_used = vmalloc(DIV_ROUND_UP(mtdoops_pages,
+			BITS_PER_LONG));
+	if (!cxt->oops_page_used) {
+		printk(KERN_ERR "mtdoops: could not allocate page array\n");
 		return;
 	}
 
-	if (cxt->writecount == 0) {
-		u32 *stamp = cxt->oops_buf;
-		*stamp++ = cxt->nextcount;
-		*stamp = MTDOOPS_KERNMSG_MAGIC;
-		cxt->writecount = 8;
+	cxt->dump.dump = mtdoops_do_dump;
+	err = kmsg_dump_register(&cxt->dump);
+	if (err) {
+		printk(KERN_ERR "mtdoops: registering kmsg dumper failed, error %d\n", err);
+		vfree(cxt->oops_page_used);
+		cxt->oops_page_used = NULL;
+		return;
 	}
 
-	if ((count + cxt->writecount) > OOPS_PAGE_SIZE)
-		count = OOPS_PAGE_SIZE - cxt->writecount;
-
-	memcpy(cxt->oops_buf + cxt->writecount, s, count);
-	cxt->writecount += count;
-
-	spin_unlock_irqrestore(&cxt->writecount_lock, flags);
-
-	if (cxt->writecount == OOPS_PAGE_SIZE)
-		mtdoops_console_sync();
+	cxt->mtd = mtd;
+	cxt->oops_pages = (int)mtd->size / record_size;
+	find_next_position(cxt);
+	printk(KERN_INFO "mtdoops: Attached to MTD device %d\n", mtd->index);
 }
 
-static int __init mtdoops_console_setup(struct console *co, char *options)
+static void mtdoops_notify_remove(struct mtd_info *mtd)
 {
-	struct mtdoops_context *cxt = co->data;
+	struct mtdoops_context *cxt = &oops_cxt;
 
-	if (cxt->mtd_index != -1 || cxt->name)
-		return -EBUSY;
-	if (options) {
-		cxt->name = kstrdup(options, GFP_KERNEL);
-		return 0;
-	}
-	if (co->index == -1)
-		return -EINVAL;
+	if (mtd->index != cxt->mtd_index || cxt->mtd_index < 0)
+		return;
 
-	cxt->mtd_index = co->index;
-	return 0;
+	if (kmsg_dump_unregister(&cxt->dump) < 0)
+		printk(KERN_WARNING "mtdoops: could not unregister kmsg_dumper\n");
+
+	cxt->mtd = NULL;
+	flush_scheduled_work();
 }
 
+
 static struct mtd_notifier mtdoops_notifier = {
 	.add	= mtdoops_notify_add,
 	.remove	= mtdoops_notify_remove,
 };
 
-static struct console mtdoops_console = {
-	.name		= "ttyMTD",
-	.write		= mtdoops_console_write,
-	.setup		= mtdoops_console_setup,
-	.unblank	= mtdoops_console_sync,
-	.index		= -1,
-	.data		= &oops_cxt,
-};
-
-static int __init mtdoops_console_init(void)
+static int __init mtdoops_init(void)
 {
 	struct mtdoops_context *cxt = &oops_cxt;
+	int mtd_index;
+	char *endp;
 
+	if (strlen(mtddev) == 0) {
+		printk(KERN_ERR "mtdoops: mtd device (mtddev=name/number) must be supplied\n");
+		return -EINVAL;
+	}
+	if ((record_size & 4095) != 0) {
+		printk(KERN_ERR "mtdoops: record_size must be a multiple of 4096\n");
+		return -EINVAL;
+	}
+	if (record_size < 4096) {
+		printk(KERN_ERR "mtdoops: record_size must be over 4096 bytes\n");
+		return -EINVAL;
+	}
+
+	/* Setup the MTD device to use */
 	cxt->mtd_index = -1;
-	cxt->oops_buf = vmalloc(OOPS_PAGE_SIZE);
-	spin_lock_init(&cxt->writecount_lock);
+	mtd_index = simple_strtoul(mtddev, &endp, 0);
+	if (*endp == '\0')
+		cxt->mtd_index = mtd_index;
+	if (cxt->mtd_index > MAX_MTD_DEVICES) {
+		printk(KERN_ERR "mtdoops: invalid mtd device number (%u) given\n",
+				mtd_index);
+		return -EINVAL;
+	}
 
+	cxt->oops_buf = vmalloc(record_size);
 	if (!cxt->oops_buf) {
-		printk(KERN_ERR "Failed to allocate mtdoops buffer workspace\n");
+		printk(KERN_ERR "mtdoops: failed to allocate buffer workspace\n");
 		return -ENOMEM;
 	}
+	memset(cxt->oops_buf, 0xff, record_size);
 
 	INIT_WORK(&cxt->work_erase, mtdoops_workfunc_erase);
 	INIT_WORK(&cxt->work_write, mtdoops_workfunc_write);
 
-	register_console(&mtdoops_console);
 	register_mtd_user(&mtdoops_notifier);
 	return 0;
 }
 
-static void __exit mtdoops_console_exit(void)
+static void __exit mtdoops_exit(void)
 {
 	struct mtdoops_context *cxt = &oops_cxt;
 
 	unregister_mtd_user(&mtdoops_notifier);
-	unregister_console(&mtdoops_console);
-	kfree(cxt->name);
 	vfree(cxt->oops_buf);
+	vfree(cxt->oops_page_used);
 }
 
 
-subsys_initcall(mtdoops_console_init);
-module_exit(mtdoops_console_exit);
+module_init(mtdoops_init);
+module_exit(mtdoops_exit);
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Richard Purdie <rpurdie@openedhand.com>");
diff --git a/drivers/mtd/nand/Kconfig b/drivers/mtd/nand/Kconfig
index 8f8e87b7ed64..677cd53f18c3 100644
--- a/drivers/mtd/nand/Kconfig
+++ b/drivers/mtd/nand/Kconfig
@@ -1,5 +1,3 @@
-# drivers/mtd/nand/Kconfig
-
 menuconfig MTD_NAND
 	tristate "NAND Device Support"
 	depends on MTD
@@ -203,6 +201,22 @@ config MTD_NAND_S3C2410_CLKSTOP
 	  when the is NAND chip selected or released, but will save
 	  approximately 5mA of power when there is nothing happening.
 
+config MTD_NAND_BCM_UMI
+	tristate "NAND Flash support for BCM Reference Boards"
+	depends on ARCH_BCMRING && MTD_NAND
+	help
+	  This enables the NAND flash controller on the BCM UMI block.
+
+	  No board specfic support is done by this driver, each board
+	  must advertise a platform_device for the driver to attach.
+
+config MTD_NAND_BCM_UMI_HWCS
+	bool "BCM UMI NAND Hardware CS"
+	depends on MTD_NAND_BCM_UMI
+	help
+	  Enable the use of the BCM UMI block's internal CS using NAND.
+	  This should only be used if you know the external NAND CS can toggle.
+
 config MTD_NAND_DISKONCHIP
 	tristate "DiskOnChip 2000, Millennium and Millennium Plus (NAND reimplementation) (EXPERIMENTAL)"
 	depends on EXPERIMENTAL
@@ -277,14 +291,6 @@ config MTD_NAND_SHARPSL
 	tristate "Support for NAND Flash on Sharp SL Series (C7xx + others)"
 	depends on ARCH_PXA
 
-config MTD_NAND_BASLER_EXCITE
-	tristate  "Support for NAND Flash on Basler eXcite"
-	depends on BASLER_EXCITE
-	help
-          This enables the driver for the NAND flash device found on the
-          Basler eXcite Smart Camera. If built as a module, the driver
-          will be named excite_nandflash.
-
 config MTD_NAND_CAFE
 	tristate "NAND support for OLPC CAFÉ chip"
 	depends on PCI
diff --git a/drivers/mtd/nand/Makefile b/drivers/mtd/nand/Makefile
index 6950d3dabf10..1407bd144015 100644
--- a/drivers/mtd/nand/Makefile
+++ b/drivers/mtd/nand/Makefile
@@ -27,7 +27,6 @@ obj-$(CONFIG_MTD_NAND_ATMEL)		+= atmel_nand.o
 obj-$(CONFIG_MTD_NAND_GPIO)		+= gpio.o
 obj-$(CONFIG_MTD_NAND_OMAP2) 		+= omap2.o
 obj-$(CONFIG_MTD_NAND_CM_X270)		+= cmx270_nand.o
-obj-$(CONFIG_MTD_NAND_BASLER_EXCITE)	+= excite_nandflash.o
 obj-$(CONFIG_MTD_NAND_PXA3xx)		+= pxa3xx_nand.o
 obj-$(CONFIG_MTD_NAND_TMIO)		+= tmio_nand.o
 obj-$(CONFIG_MTD_NAND_PLATFORM)		+= plat_nand.o
@@ -42,5 +41,6 @@ obj-$(CONFIG_MTD_NAND_SOCRATES)		+= socrates_nand.o
 obj-$(CONFIG_MTD_NAND_TXX9NDFMC)	+= txx9ndfmc.o
 obj-$(CONFIG_MTD_NAND_W90P910)		+= w90p910_nand.o
 obj-$(CONFIG_MTD_NAND_NOMADIK)		+= nomadik_nand.o
+obj-$(CONFIG_MTD_NAND_BCM_UMI)		+= bcm_umi_nand.o nand_bcm_umi.o
 
 nand-objs := nand_base.o nand_bbt.o
diff --git a/drivers/mtd/nand/alauda.c b/drivers/mtd/nand/alauda.c
index 6d9649159a18..2d6773281fd9 100644
--- a/drivers/mtd/nand/alauda.c
+++ b/drivers/mtd/nand/alauda.c
@@ -372,15 +372,6 @@ static int alauda_read_oob(struct mtd_info *mtd, loff_t from, void *oob)
 	return __alauda_read_page(mtd, from, ignore_buf, oob);
 }
 
-static int popcount8(u8 c)
-{
-	int ret = 0;
-
-	for ( ; c; c>>=1)
-		ret += c & 1;
-	return ret;
-}
-
 static int alauda_isbad(struct mtd_info *mtd, loff_t ofs)
 {
 	u8 oob[16];
@@ -391,7 +382,7 @@ static int alauda_isbad(struct mtd_info *mtd, loff_t ofs)
 		return err;
 
 	/* A block is marked bad if two or more bits are zero */
-	return popcount8(oob[5]) >= 7 ? 0 : 1;
+	return hweight8(oob[5]) >= 7 ? 0 : 1;
 }
 
 static int alauda_bounce_read(struct mtd_info *mtd, loff_t from, size_t len,
diff --git a/drivers/mtd/nand/atmel_nand.c b/drivers/mtd/nand/atmel_nand.c
index f8e9975c86e5..524e6c9e0672 100644
--- a/drivers/mtd/nand/atmel_nand.c
+++ b/drivers/mtd/nand/atmel_nand.c
@@ -192,7 +192,6 @@ static int atmel_nand_calculate(struct mtd_info *mtd,
 {
 	struct nand_chip *nand_chip = mtd->priv;
 	struct atmel_nand_host *host = nand_chip->priv;
-	uint32_t *eccpos = nand_chip->ecc.layout->eccpos;
 	unsigned int ecc_value;
 
 	/* get the first 2 ECC bytes */
@@ -464,7 +463,7 @@ static int __init atmel_nand_probe(struct platform_device *pdev)
 	if (host->board->det_pin) {
 		if (gpio_get_value(host->board->det_pin)) {
 			printk(KERN_INFO "No SmartMedia card inserted.\n");
-			res = ENXIO;
+			res = -ENXIO;
 			goto err_no_card;
 		}
 	}
@@ -535,7 +534,7 @@ static int __init atmel_nand_probe(struct platform_device *pdev)
 
 	if ((!partitions) || (num_partitions == 0)) {
 		printk(KERN_ERR "atmel_nand: No partitions defined, or unsupported device.\n");
-		res = ENXIO;
+		res = -ENXIO;
 		goto err_no_partitions;
 	}
 
diff --git a/drivers/mtd/nand/bcm_umi_bch.c b/drivers/mtd/nand/bcm_umi_bch.c
new file mode 100644
index 000000000000..a930666d0687
--- /dev/null
+++ b/drivers/mtd/nand/bcm_umi_bch.c
@@ -0,0 +1,213 @@
+/*****************************************************************************
+* Copyright 2004 - 2009 Broadcom Corporation.  All rights reserved.
+*
+* Unless you and Broadcom execute a separate written software license
+* agreement governing use of this software, this software is licensed to you
+* under the terms of the GNU General Public License version 2, available at
+* http://www.broadcom.com/licenses/GPLv2.php (the "GPL").
+*
+* Notwithstanding the above, under no circumstances may you combine this
+* software in any way with any other Broadcom software provided under a
+* license other than the GPL, without Broadcom's express prior written
+* consent.
+*****************************************************************************/
+
+/* ---- Include Files ---------------------------------------------------- */
+#include "nand_bcm_umi.h"
+
+/* ---- External Variable Declarations ----------------------------------- */
+/* ---- External Function Prototypes ------------------------------------- */
+/* ---- Public Variables ------------------------------------------------- */
+/* ---- Private Constants and Types -------------------------------------- */
+
+/* ---- Private Function Prototypes -------------------------------------- */
+static int bcm_umi_bch_read_page_hwecc(struct mtd_info *mtd,
+	struct nand_chip *chip, uint8_t *buf, int page);
+static void bcm_umi_bch_write_page_hwecc(struct mtd_info *mtd,
+	struct nand_chip *chip, const uint8_t *buf);
+
+/* ---- Private Variables ------------------------------------------------ */
+
+/*
+** nand_hw_eccoob
+** New oob placement block for use with hardware ecc generation.
+*/
+static struct nand_ecclayout nand_hw_eccoob_512 = {
+	/* Reserve 5 for BI indicator */
+	.oobfree = {
+#if (NAND_ECC_NUM_BYTES > 3)
+		    {.offset = 0, .length = 2}
+#else
+		    {.offset = 0, .length = 5},
+		    {.offset = 6, .length = 7}
+#endif
+		    }
+};
+
+/*
+** We treat the OOB for a 2K page as if it were 4 512 byte oobs,
+** except the BI is at byte 0.
+*/
+static struct nand_ecclayout nand_hw_eccoob_2048 = {
+	/* Reserve 0 as BI indicator */
+	.oobfree = {
+#if (NAND_ECC_NUM_BYTES > 10)
+		    {.offset = 1, .length = 2},
+#elif (NAND_ECC_NUM_BYTES > 7)
+		    {.offset = 1, .length = 5},
+		    {.offset = 16, .length = 6},
+		    {.offset = 32, .length = 6},
+		    {.offset = 48, .length = 6}
+#else
+		    {.offset = 1, .length = 8},
+		    {.offset = 16, .length = 9},
+		    {.offset = 32, .length = 9},
+		    {.offset = 48, .length = 9}
+#endif
+		    }
+};
+
+/* We treat the OOB for a 4K page as if it were 8 512 byte oobs,
+ * except the BI is at byte 0. */
+static struct nand_ecclayout nand_hw_eccoob_4096 = {
+	/* Reserve 0 as BI indicator */
+	.oobfree = {
+#if (NAND_ECC_NUM_BYTES > 10)
+		    {.offset = 1, .length = 2},
+		    {.offset = 16, .length = 3},
+		    {.offset = 32, .length = 3},
+		    {.offset = 48, .length = 3},
+		    {.offset = 64, .length = 3},
+		    {.offset = 80, .length = 3},
+		    {.offset = 96, .length = 3},
+		    {.offset = 112, .length = 3}
+#else
+		    {.offset = 1, .length = 5},
+		    {.offset = 16, .length = 6},
+		    {.offset = 32, .length = 6},
+		    {.offset = 48, .length = 6},
+		    {.offset = 64, .length = 6},
+		    {.offset = 80, .length = 6},
+		    {.offset = 96, .length = 6},
+		    {.offset = 112, .length = 6}
+#endif
+		    }
+};
+
+/* ---- Private Functions ------------------------------------------------ */
+/* ==== Public Functions ================================================= */
+
+/****************************************************************************
+*
+*  bcm_umi_bch_read_page_hwecc - hardware ecc based page read function
+*  @mtd:	mtd info structure
+*  @chip:	nand chip info structure
+*  @buf:	buffer to store read data
+*
+***************************************************************************/
+static int bcm_umi_bch_read_page_hwecc(struct mtd_info *mtd,
+				       struct nand_chip *chip, uint8_t * buf,
+						 int page)
+{
+	int sectorIdx = 0;
+	int eccsize = chip->ecc.size;
+	int eccsteps = chip->ecc.steps;
+	uint8_t *datap = buf;
+	uint8_t eccCalc[NAND_ECC_NUM_BYTES];
+	int sectorOobSize = mtd->oobsize / eccsteps;
+	int stat;
+
+	for (sectorIdx = 0; sectorIdx < eccsteps;
+			sectorIdx++, datap += eccsize) {
+		if (sectorIdx > 0) {
+			/* Seek to page location within sector */
+			chip->cmdfunc(mtd, NAND_CMD_RNDOUT, sectorIdx * eccsize,
+				      -1);
+		}
+
+		/* Enable hardware ECC before reading the buf */
+		nand_bcm_umi_bch_enable_read_hwecc();
+
+		/* Read in data */
+		bcm_umi_nand_read_buf(mtd, datap, eccsize);
+
+		/* Pause hardware ECC after reading the buf */
+		nand_bcm_umi_bch_pause_read_ecc_calc();
+
+		/* Read the OOB ECC */
+		chip->cmdfunc(mtd, NAND_CMD_RNDOUT,
+			      mtd->writesize + sectorIdx * sectorOobSize, -1);
+		nand_bcm_umi_bch_read_oobEcc(mtd->writesize, eccCalc,
+					     NAND_ECC_NUM_BYTES,
+					     chip->oob_poi +
+					     sectorIdx * sectorOobSize);
+
+		/* Correct any ECC detected errors */
+		stat =
+		    nand_bcm_umi_bch_correct_page(datap, eccCalc,
+						  NAND_ECC_NUM_BYTES);
+
+		/* Update Stats */
+		if (stat < 0) {
+#if defined(NAND_BCM_UMI_DEBUG)
+			printk(KERN_WARNING "%s uncorr_err sectorIdx=%d\n",
+			       __func__, sectorIdx);
+			printk(KERN_WARNING
+			       "%s data %02x %02x %02x %02x "
+					 "%02x %02x %02x %02x\n",
+			       __func__, datap[0], datap[1], datap[2], datap[3],
+			       datap[4], datap[5], datap[6], datap[7]);
+			printk(KERN_WARNING
+			       "%s ecc  %02x %02x %02x %02x "
+					 "%02x %02x %02x %02x %02x %02x "
+					 "%02x %02x %02x\n",
+			       __func__, eccCalc[0], eccCalc[1], eccCalc[2],
+			       eccCalc[3], eccCalc[4], eccCalc[5], eccCalc[6],
+			       eccCalc[7], eccCalc[8], eccCalc[9], eccCalc[10],
+			       eccCalc[11], eccCalc[12]);
+			BUG();
+#endif
+			mtd->ecc_stats.failed++;
+		} else {
+#if defined(NAND_BCM_UMI_DEBUG)
+			if (stat > 0) {
+				printk(KERN_INFO
+				       "%s %d correctable_errors detected\n",
+				       __func__, stat);
+			}
+#endif
+			mtd->ecc_stats.corrected += stat;
+		}
+	}
+	return 0;
+}
+
+/****************************************************************************
+*
+*  bcm_umi_bch_write_page_hwecc - hardware ecc based page write function
+*  @mtd:	mtd info structure
+*  @chip:	nand chip info structure
+*  @buf:	data buffer
+*
+***************************************************************************/
+static void bcm_umi_bch_write_page_hwecc(struct mtd_info *mtd,
+	struct nand_chip *chip, const uint8_t *buf)
+{
+	int sectorIdx = 0;
+	int eccsize = chip->ecc.size;
+	int eccsteps = chip->ecc.steps;
+	const uint8_t *datap = buf;
+	uint8_t *oobp = chip->oob_poi;
+	int sectorOobSize = mtd->oobsize / eccsteps;
+
+	for (sectorIdx = 0; sectorIdx < eccsteps;
+	     sectorIdx++, datap += eccsize, oobp += sectorOobSize) {
+		/* Enable hardware ECC before writing the buf */
+		nand_bcm_umi_bch_enable_write_hwecc();
+		bcm_umi_nand_write_buf(mtd, datap, eccsize);
+		nand_bcm_umi_bch_write_oobEcc(mtd->writesize, oobp,
+					      NAND_ECC_NUM_BYTES);
+	}
+
+	bcm_umi_nand_write_buf(mtd, chip->oob_poi, mtd->oobsize);
+}
diff --git a/drivers/mtd/nand/bcm_umi_nand.c b/drivers/mtd/nand/bcm_umi_nand.c
new file mode 100644
index 000000000000..087bcd745bb7
--- /dev/null
+++ b/drivers/mtd/nand/bcm_umi_nand.c
@@ -0,0 +1,581 @@
+/*****************************************************************************
+* Copyright 2004 - 2009 Broadcom Corporation.  All rights reserved.
+*
+* Unless you and Broadcom execute a separate written software license
+* agreement governing use of this software, this software is licensed to you
+* under the terms of the GNU General Public License version 2, available at
+* http://www.broadcom.com/licenses/GPLv2.php (the "GPL").
+*
+* Notwithstanding the above, under no circumstances may you combine this
+* software in any way with any other Broadcom software provided under a
+* license other than the GPL, without Broadcom's express prior written
+* consent.
+*****************************************************************************/
+
+/* ---- Include Files ---------------------------------------------------- */
+#include <linux/version.h>
+#include <linux/module.h>
+#include <linux/types.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/string.h>
+#include <linux/ioport.h>
+#include <linux/device.h>
+#include <linux/delay.h>
+#include <linux/err.h>
+#include <linux/io.h>
+#include <linux/platform_device.h>
+#include <linux/mtd/mtd.h>
+#include <linux/mtd/nand.h>
+#include <linux/mtd/nand_ecc.h>
+#include <linux/mtd/partitions.h>
+
+#include <asm/mach-types.h>
+#include <asm/system.h>
+
+#include <mach/reg_nand.h>
+#include <mach/reg_umi.h>
+
+#include "nand_bcm_umi.h"
+
+#include <mach/memory_settings.h>
+
+#define USE_DMA 1
+#include <mach/dma.h>
+#include <linux/dma-mapping.h>
+#include <linux/completion.h>
+
+/* ---- External Variable Declarations ----------------------------------- */
+/* ---- External Function Prototypes ------------------------------------- */
+/* ---- Public Variables ------------------------------------------------- */
+/* ---- Private Constants and Types -------------------------------------- */
+static const __devinitconst char gBanner[] = KERN_INFO \
+	"BCM UMI MTD NAND Driver: 1.00\n";
+
+#ifdef CONFIG_MTD_PARTITIONS
+const char *part_probes[] = { "cmdlinepart", NULL };
+#endif
+
+#if NAND_ECC_BCH
+static uint8_t scan_ff_pattern[] = { 0xff };
+
+static struct nand_bbt_descr largepage_bbt = {
+	.options = 0,
+	.offs = 0,
+	.len = 1,
+	.pattern = scan_ff_pattern
+};
+#endif
+
+/*
+** Preallocate a buffer to avoid having to do this every dma operation.
+** This is the size of the preallocated coherent DMA buffer.
+*/
+#if USE_DMA
+#define DMA_MIN_BUFLEN	512
+#define DMA_MAX_BUFLEN	PAGE_SIZE
+#define USE_DIRECT_IO(len)	(((len) < DMA_MIN_BUFLEN) || \
+	((len) > DMA_MAX_BUFLEN))
+
+/*
+ * The current NAND data space goes from 0x80001900 to 0x80001FFF,
+ * which is only 0x700 = 1792 bytes long. This is too small for 2K, 4K page
+ * size NAND flash. Need to break the DMA down to multiple 1Ks.
+ *
+ * Need to make sure REG_NAND_DATA_PADDR + DMA_MAX_LEN < 0x80002000
+ */
+#define DMA_MAX_LEN             1024
+
+#else /* !USE_DMA */
+#define DMA_MIN_BUFLEN          0
+#define DMA_MAX_BUFLEN          0
+#define USE_DIRECT_IO(len)      1
+#endif
+/* ---- Private Function Prototypes -------------------------------------- */
+static void bcm_umi_nand_read_buf(struct mtd_info *mtd, u_char * buf, int len);
+static void bcm_umi_nand_write_buf(struct mtd_info *mtd, const u_char * buf,
+				   int len);
+
+/* ---- Private Variables ------------------------------------------------ */
+static struct mtd_info *board_mtd;
+static void __iomem *bcm_umi_io_base;
+static void *virtPtr;
+static dma_addr_t physPtr;
+static struct completion nand_comp;
+
+/* ---- Private Functions ------------------------------------------------ */
+#if NAND_ECC_BCH
+#include "bcm_umi_bch.c"
+#else
+#include "bcm_umi_hamming.c"
+#endif
+
+#if USE_DMA
+
+/* Handler called when the DMA finishes. */
+static void nand_dma_handler(DMA_Device_t dev, int reason, void *userData)
+{
+	complete(&nand_comp);
+}
+
+static int nand_dma_init(void)
+{
+	int rc;
+
+	rc = dma_set_device_handler(DMA_DEVICE_NAND_MEM_TO_MEM,
+		nand_dma_handler, NULL);
+	if (rc != 0) {
+		printk(KERN_ERR "dma_set_device_handler failed: %d\n", rc);
+		return rc;
+	}
+
+	virtPtr =
+	    dma_alloc_coherent(NULL, DMA_MAX_BUFLEN, &physPtr, GFP_KERNEL);
+	if (virtPtr == NULL) {
+		printk(KERN_ERR "NAND - Failed to allocate memory for DMA buffer\n");
+		return -ENOMEM;
+	}
+
+	return 0;
+}
+
+static void nand_dma_term(void)
+{
+	if (virtPtr != NULL)
+		dma_free_coherent(NULL, DMA_MAX_BUFLEN, virtPtr, physPtr);
+}
+
+static void nand_dma_read(void *buf, int len)
+{
+	int offset = 0;
+	int tmp_len = 0;
+	int len_left = len;
+	DMA_Handle_t hndl;
+
+	if (virtPtr == NULL)
+		panic("nand_dma_read: virtPtr == NULL\n");
+
+	if ((void *)physPtr == NULL)
+		panic("nand_dma_read: physPtr == NULL\n");
+
+	hndl = dma_request_channel(DMA_DEVICE_NAND_MEM_TO_MEM);
+	if (hndl < 0) {
+		printk(KERN_ERR
+		       "nand_dma_read: unable to allocate dma channel: %d\n",
+		       (int)hndl);
+		panic("\n");
+	}
+
+	while (len_left > 0) {
+		if (len_left > DMA_MAX_LEN) {
+			tmp_len = DMA_MAX_LEN;
+			len_left -= DMA_MAX_LEN;
+		} else {
+			tmp_len = len_left;
+			len_left = 0;
+		}
+
+		init_completion(&nand_comp);
+		dma_transfer_mem_to_mem(hndl, REG_NAND_DATA_PADDR,
+					physPtr + offset, tmp_len);
+		wait_for_completion(&nand_comp);
+
+		offset += tmp_len;
+	}
+
+	dma_free_channel(hndl);
+
+	if (buf != NULL)
+		memcpy(buf, virtPtr, len);
+}
+
+static void nand_dma_write(const void *buf, int len)
+{
+	int offset = 0;
+	int tmp_len = 0;
+	int len_left = len;
+	DMA_Handle_t hndl;
+
+	if (buf == NULL)
+		panic("nand_dma_write: buf == NULL\n");
+
+	if (virtPtr == NULL)
+		panic("nand_dma_write: virtPtr == NULL\n");
+
+	if ((void *)physPtr == NULL)
+		panic("nand_dma_write: physPtr == NULL\n");
+
+	memcpy(virtPtr, buf, len);
+
+
+	hndl = dma_request_channel(DMA_DEVICE_NAND_MEM_TO_MEM);
+	if (hndl < 0) {
+		printk(KERN_ERR
+		       "nand_dma_write: unable to allocate dma channel: %d\n",
+		       (int)hndl);
+		panic("\n");
+	}
+
+	while (len_left > 0) {
+		if (len_left > DMA_MAX_LEN) {
+			tmp_len = DMA_MAX_LEN;
+			len_left -= DMA_MAX_LEN;
+		} else {
+			tmp_len = len_left;
+			len_left = 0;
+		}
+
+		init_completion(&nand_comp);
+		dma_transfer_mem_to_mem(hndl, physPtr + offset,
+					REG_NAND_DATA_PADDR, tmp_len);
+		wait_for_completion(&nand_comp);
+
+		offset += tmp_len;
+	}
+
+	dma_free_channel(hndl);
+}
+
+#endif
+
+static int nand_dev_ready(struct mtd_info *mtd)
+{
+	return nand_bcm_umi_dev_ready();
+}
+
+/****************************************************************************
+*
+*  bcm_umi_nand_inithw
+*
+*   This routine does the necessary hardware (board-specific)
+*   initializations.  This includes setting up the timings, etc.
+*
+***************************************************************************/
+int bcm_umi_nand_inithw(void)
+{
+	/* Configure nand timing parameters */
+	REG_UMI_NAND_TCR &= ~0x7ffff;
+	REG_UMI_NAND_TCR |= HW_CFG_NAND_TCR;
+
+#if !defined(CONFIG_MTD_NAND_BCM_UMI_HWCS)
+	/* enable software control of CS */
+	REG_UMI_NAND_TCR |= REG_UMI_NAND_TCR_CS_SWCTRL;
+#endif
+
+	/* keep NAND chip select asserted */
+	REG_UMI_NAND_RCSR |= REG_UMI_NAND_RCSR_CS_ASSERTED;
+
+	REG_UMI_NAND_TCR &= ~REG_UMI_NAND_TCR_WORD16;
+	/* enable writes to flash */
+	REG_UMI_MMD_ICR |= REG_UMI_MMD_ICR_FLASH_WP;
+
+	writel(NAND_CMD_RESET, bcm_umi_io_base + REG_NAND_CMD_OFFSET);
+	nand_bcm_umi_wait_till_ready();
+
+#if NAND_ECC_BCH
+	nand_bcm_umi_bch_config_ecc(NAND_ECC_NUM_BYTES);
+#endif
+
+	return 0;
+}
+
+/* Used to turn latch the proper register for access. */
+static void bcm_umi_nand_hwcontrol(struct mtd_info *mtd, int cmd,
+				   unsigned int ctrl)
+{
+	/* send command to hardware */
+	struct nand_chip *chip = mtd->priv;
+	if (ctrl & NAND_CTRL_CHANGE) {
+		if (ctrl & NAND_CLE) {
+			chip->IO_ADDR_W = bcm_umi_io_base + REG_NAND_CMD_OFFSET;
+			goto CMD;
+		}
+		if (ctrl & NAND_ALE) {
+			chip->IO_ADDR_W =
+			    bcm_umi_io_base + REG_NAND_ADDR_OFFSET;
+			goto CMD;
+		}
+		chip->IO_ADDR_W = bcm_umi_io_base + REG_NAND_DATA8_OFFSET;
+	}
+
+CMD:
+	/* Send command to chip directly */
+	if (cmd != NAND_CMD_NONE)
+		writeb(cmd, chip->IO_ADDR_W);
+}
+
+static void bcm_umi_nand_write_buf(struct mtd_info *mtd, const u_char * buf,
+				   int len)
+{
+	if (USE_DIRECT_IO(len)) {
+		/* Do it the old way if the buffer is small or too large.
+		 * Probably quicker than starting and checking dma. */
+		int i;
+		struct nand_chip *this = mtd->priv;
+
+		for (i = 0; i < len; i++)
+			writeb(buf[i], this->IO_ADDR_W);
+	}
+#if USE_DMA
+	else
+		nand_dma_write(buf, len);
+#endif
+}
+
+static void bcm_umi_nand_read_buf(struct mtd_info *mtd, u_char * buf, int len)
+{
+	if (USE_DIRECT_IO(len)) {
+		int i;
+		struct nand_chip *this = mtd->priv;
+
+		for (i = 0; i < len; i++)
+			buf[i] = readb(this->IO_ADDR_R);
+	}
+#if USE_DMA
+	else
+		nand_dma_read(buf, len);
+#endif
+}
+
+static uint8_t readbackbuf[NAND_MAX_PAGESIZE];
+static int bcm_umi_nand_verify_buf(struct mtd_info *mtd, const u_char * buf,
+				   int len)
+{
+	/*
+	 * Try to readback page with ECC correction. This is necessary
+	 * for MLC parts which may have permanently stuck bits.
+	 */
+	struct nand_chip *chip = mtd->priv;
+	int ret = chip->ecc.read_page(mtd, chip, readbackbuf, 0);
+	if (ret < 0)
+		return -EFAULT;
+	else {
+		if (memcmp(readbackbuf, buf, len) == 0)
+			return 0;
+
+		return -EFAULT;
+	}
+	return 0;
+}
+
+static int __devinit bcm_umi_nand_probe(struct platform_device *pdev)
+{
+	struct nand_chip *this;
+	struct resource *r;
+	int err = 0;
+
+	printk(gBanner);
+
+	/* Allocate memory for MTD device structure and private data */
+	board_mtd =
+	    kmalloc(sizeof(struct mtd_info) + sizeof(struct nand_chip),
+		    GFP_KERNEL);
+	if (!board_mtd) {
+		printk(KERN_WARNING
+		       "Unable to allocate NAND MTD device structure.\n");
+		return -ENOMEM;
+	}
+
+	r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+
+	if (!r)
+		return -ENXIO;
+
+	/* map physical adress */
+	bcm_umi_io_base = ioremap(r->start, r->end - r->start + 1);
+
+	if (!bcm_umi_io_base) {
+		printk(KERN_ERR "ioremap to access BCM UMI NAND chip failed\n");
+		kfree(board_mtd);
+		return -EIO;
+	}
+
+	/* Get pointer to private data */
+	this = (struct nand_chip *)(&board_mtd[1]);
+
+	/* Initialize structures */
+	memset((char *)board_mtd, 0, sizeof(struct mtd_info));
+	memset((char *)this, 0, sizeof(struct nand_chip));
+
+	/* Link the private data with the MTD structure */
+	board_mtd->priv = this;
+
+	/* Initialize the NAND hardware.  */
+	if (bcm_umi_nand_inithw() < 0) {
+		printk(KERN_ERR "BCM UMI NAND chip could not be initialized\n");
+		iounmap(bcm_umi_io_base);
+		kfree(board_mtd);
+		return -EIO;
+	}
+
+	/* Set address of NAND IO lines */
+	this->IO_ADDR_W = bcm_umi_io_base + REG_NAND_DATA8_OFFSET;
+	this->IO_ADDR_R = bcm_umi_io_base + REG_NAND_DATA8_OFFSET;
+
+	/* Set command delay time, see datasheet for correct value */
+	this->chip_delay = 0;
+	/* Assign the device ready function, if available */
+	this->dev_ready = nand_dev_ready;
+	this->options = 0;
+
+	this->write_buf = bcm_umi_nand_write_buf;
+	this->read_buf = bcm_umi_nand_read_buf;
+	this->verify_buf = bcm_umi_nand_verify_buf;
+
+	this->cmd_ctrl = bcm_umi_nand_hwcontrol;
+	this->ecc.mode = NAND_ECC_HW;
+	this->ecc.size = 512;
+	this->ecc.bytes = NAND_ECC_NUM_BYTES;
+#if NAND_ECC_BCH
+	this->ecc.read_page = bcm_umi_bch_read_page_hwecc;
+	this->ecc.write_page = bcm_umi_bch_write_page_hwecc;
+#else
+	this->ecc.correct = nand_correct_data512;
+	this->ecc.calculate = bcm_umi_hamming_get_hw_ecc;
+	this->ecc.hwctl = bcm_umi_hamming_enable_hwecc;
+#endif
+
+#if USE_DMA
+	err = nand_dma_init();
+	if (err != 0)
+		return err;
+#endif
+
+	/* Figure out the size of the device that we have.
+	 * We need to do this to figure out which ECC
+	 * layout we'll be using.
+	 */
+
+	err = nand_scan_ident(board_mtd, 1);
+	if (err) {
+		printk(KERN_ERR "nand_scan failed: %d\n", err);
+		iounmap(bcm_umi_io_base);
+		kfree(board_mtd);
+		return err;
+	}
+
+	/* Now that we know the nand size, we can setup the ECC layout */
+
+	switch (board_mtd->writesize) {	/* writesize is the pagesize */
+	case 4096:
+		this->ecc.layout = &nand_hw_eccoob_4096;
+		break;
+	case 2048:
+		this->ecc.layout = &nand_hw_eccoob_2048;
+		break;
+	case 512:
+		this->ecc.layout = &nand_hw_eccoob_512;
+		break;
+	default:
+		{
+			printk(KERN_ERR "NAND - Unrecognized pagesize: %d\n",
+					 board_mtd->writesize);
+			return -EINVAL;
+		}
+	}
+
+#if NAND_ECC_BCH
+	if (board_mtd->writesize > 512) {
+		if (this->options & NAND_USE_FLASH_BBT)
+			largepage_bbt.options = NAND_BBT_SCAN2NDPAGE;
+		this->badblock_pattern = &largepage_bbt;
+	}
+#endif
+
+	/* Now finish off the scan, now that ecc.layout has been initialized. */
+
+	err = nand_scan_tail(board_mtd);
+	if (err) {
+		printk(KERN_ERR "nand_scan failed: %d\n", err);
+		iounmap(bcm_umi_io_base);
+		kfree(board_mtd);
+		return err;
+	}
+
+	/* Register the partitions */
+	{
+		int nr_partitions;
+		struct mtd_partition *partition_info;
+
+		board_mtd->name = "bcm_umi-nand";
+		nr_partitions =
+		    parse_mtd_partitions(board_mtd, part_probes,
+					 &partition_info, 0);
+
+		if (nr_partitions <= 0) {
+			printk(KERN_ERR "BCM UMI NAND: Too few partitions - %d\n",
+			       nr_partitions);
+			iounmap(bcm_umi_io_base);
+			kfree(board_mtd);
+			return -EIO;
+		}
+		add_mtd_partitions(board_mtd, partition_info, nr_partitions);
+	}
+
+	/* Return happy */
+	return 0;
+}
+
+static int bcm_umi_nand_remove(struct platform_device *pdev)
+{
+#if USE_DMA
+	nand_dma_term();
+#endif
+
+	/* Release resources, unregister device */
+	nand_release(board_mtd);
+
+	/* unmap physical adress */
+	iounmap(bcm_umi_io_base);
+
+	/* Free the MTD device structure */
+	kfree(board_mtd);
+
+	return 0;
+}
+
+#ifdef CONFIG_PM
+static int bcm_umi_nand_suspend(struct platform_device *pdev,
+				pm_message_t state)
+{
+	printk(KERN_ERR "MTD NAND suspend is being called\n");
+	return 0;
+}
+
+static int bcm_umi_nand_resume(struct platform_device *pdev)
+{
+	printk(KERN_ERR "MTD NAND resume is being called\n");
+	return 0;
+}
+#else
+#define bcm_umi_nand_suspend   NULL
+#define bcm_umi_nand_resume    NULL
+#endif
+
+static struct platform_driver nand_driver = {
+	.driver = {
+		   .name = "bcm-nand",
+		   .owner = THIS_MODULE,
+		   },
+	.probe = bcm_umi_nand_probe,
+	.remove = bcm_umi_nand_remove,
+	.suspend = bcm_umi_nand_suspend,
+	.resume = bcm_umi_nand_resume,
+};
+
+static int __init nand_init(void)
+{
+	return platform_driver_register(&nand_driver);
+}
+
+static void __exit nand_exit(void)
+{
+	platform_driver_unregister(&nand_driver);
+}
+
+module_init(nand_init);
+module_exit(nand_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Broadcom");
+MODULE_DESCRIPTION("BCM UMI MTD NAND driver");
diff --git a/drivers/mtd/nand/davinci_nand.c b/drivers/mtd/nand/davinci_nand.c
index f13f5b9afaf7..fe3eba87de40 100644
--- a/drivers/mtd/nand/davinci_nand.c
+++ b/drivers/mtd/nand/davinci_nand.c
@@ -591,6 +591,8 @@ static int __init nand_davinci_probe(struct platform_device *pdev)
 
 	/* options such as NAND_USE_FLASH_BBT or 16-bit widths */
 	info->chip.options	= pdata->options;
+	info->chip.bbt_td	= pdata->bbt_td;
+	info->chip.bbt_md	= pdata->bbt_md;
 
 	info->ioaddr		= (uint32_t __force) vaddr;
 
@@ -599,7 +601,7 @@ static int __init nand_davinci_probe(struct platform_device *pdev)
 	info->mask_chipsel	= pdata->mask_chipsel;
 
 	/* use nandboot-capable ALE/CLE masks by default */
-	info->mask_ale		= pdata->mask_cle ? : MASK_ALE;
+	info->mask_ale		= pdata->mask_ale ? : MASK_ALE;
 	info->mask_cle		= pdata->mask_cle ? : MASK_CLE;
 
 	/* Set address of hardware control function */
diff --git a/drivers/mtd/nand/diskonchip.c b/drivers/mtd/nand/diskonchip.c
index e51c1ed7ac18..b126cf887476 100644
--- a/drivers/mtd/nand/diskonchip.c
+++ b/drivers/mtd/nand/diskonchip.c
@@ -1056,7 +1056,7 @@ static struct nand_ecclayout doc200x_oobinfo = {
 };
 
 /* Find the (I)NFTL Media Header, and optionally also the mirror media header.
-   On sucessful return, buf will contain a copy of the media header for
+   On successful return, buf will contain a copy of the media header for
    further processing.  id is the string to scan for, and will presumably be
    either "ANAND" or "BNAND".  If findmirror=1, also look for the mirror media
    header.  The page #s of the found media headers are placed in mh0_page and
diff --git a/drivers/mtd/nand/excite_nandflash.c b/drivers/mtd/nand/excite_nandflash.c
deleted file mode 100644
index 72446fb48d4b..000000000000
--- a/drivers/mtd/nand/excite_nandflash.c
+++ /dev/null
@@ -1,248 +0,0 @@
-/*
-*  Copyright (C) 2005 - 2007 by Basler Vision Technologies AG
-*  Author: Thomas Koeller <thomas.koeller.qbaslerweb.com>
-*  Original code by Thies Moeller <thies.moeller@baslerweb.com>
-*
-*  This program is free software; you can redistribute it and/or modify
-*  it under the terms of the GNU General Public License as published by
-*  the Free Software Foundation; either version 2 of the License, or
-*  (at your option) any later version.
-*
-*  This program is distributed in the hope that it will be useful,
-*  but WITHOUT ANY WARRANTY; without even the implied warranty of
-*  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-*  GNU General Public License for more details.
-*
-*  You should have received a copy of the GNU General Public License
-*  along with this program; if not, write to the Free Software
-*  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-*/
-
-#include <linux/module.h>
-#include <linux/types.h>
-#include <linux/init.h>
-#include <linux/kernel.h>
-#include <linux/string.h>
-#include <linux/ioport.h>
-#include <linux/platform_device.h>
-#include <linux/delay.h>
-#include <linux/err.h>
-
-#include <linux/mtd/mtd.h>
-#include <linux/mtd/nand.h>
-#include <linux/mtd/nand_ecc.h>
-#include <linux/mtd/partitions.h>
-
-#include <asm/io.h>
-#include <asm/rm9k-ocd.h>
-
-#include <excite_nandflash.h>
-
-#define EXCITE_NANDFLASH_VERSION "0.1"
-
-/* I/O register offsets */
-#define EXCITE_NANDFLASH_DATA_BYTE   0x00
-#define EXCITE_NANDFLASH_STATUS_BYTE 0x0c
-#define EXCITE_NANDFLASH_ADDR_BYTE   0x10
-#define EXCITE_NANDFLASH_CMD_BYTE    0x14
-
-/* prefix for debug output */
-static const char module_id[] = "excite_nandflash";
-
-/*
- * partition definition
- */
-static const struct mtd_partition partition_info[] = {
-	{
-		.name = "eXcite RootFS",
-		.offset = 0,
-		.size = MTDPART_SIZ_FULL
-	}
-};
-
-static inline const struct resource *
-excite_nand_get_resource(struct platform_device *d, unsigned long flags,
-			 const char *basename)
-{
-	char buf[80];
-
-	if (snprintf(buf, sizeof buf, "%s_%u", basename, d->id) >= sizeof buf)
-		return NULL;
-	return platform_get_resource_byname(d, flags, buf);
-}
-
-static inline void __iomem *
-excite_nand_map_regs(struct platform_device *d, const char *basename)
-{
-	void *result = NULL;
-	const struct resource *const r =
-	    excite_nand_get_resource(d, IORESOURCE_MEM, basename);
-
-	if (r)
-		result = ioremap_nocache(r->start, r->end + 1 - r->start);
-	return result;
-}
-
-/* controller and mtd information */
-struct excite_nand_drvdata {
-	struct mtd_info board_mtd;
-	struct nand_chip board_chip;
-	void __iomem *regs;
-	void __iomem *tgt;
-};
-
-/* Control function */
-static void excite_nand_control(struct mtd_info *mtd, int cmd,
-				       unsigned int ctrl)
-{
-	struct excite_nand_drvdata * const d =
-	    container_of(mtd, struct excite_nand_drvdata, board_mtd);
-
-	switch (ctrl) {
-	case NAND_CTRL_CHANGE | NAND_CTRL_CLE:
-		d->tgt = d->regs + EXCITE_NANDFLASH_CMD_BYTE;
-		break;
-	case NAND_CTRL_CHANGE | NAND_CTRL_ALE:
-		d->tgt = d->regs + EXCITE_NANDFLASH_ADDR_BYTE;
-		break;
-	case NAND_CTRL_CHANGE | NAND_NCE:
-		d->tgt = d->regs + EXCITE_NANDFLASH_DATA_BYTE;
-		break;
-	}
-
-	if (cmd != NAND_CMD_NONE)
-		__raw_writeb(cmd, d->tgt);
-}
-
-/* Return 0 if flash is busy, 1 if ready */
-static int excite_nand_devready(struct mtd_info *mtd)
-{
-	struct excite_nand_drvdata * const drvdata =
-	    container_of(mtd, struct excite_nand_drvdata, board_mtd);
-
-	return __raw_readb(drvdata->regs + EXCITE_NANDFLASH_STATUS_BYTE);
-}
-
-/*
- * Called by device layer to remove the driver.
- * The binding to the mtd and all allocated
- * resources are released.
- */
-static int __exit excite_nand_remove(struct platform_device *dev)
-{
-	struct excite_nand_drvdata * const this = platform_get_drvdata(dev);
-
-	platform_set_drvdata(dev, NULL);
-
-	if (unlikely(!this)) {
-		printk(KERN_ERR "%s: called %s without private data!!",
-		       module_id, __func__);
-		return -EINVAL;
-	}
-
-	/* first thing we need to do is release our mtd
-	 * then go through freeing the resource used
-	 */
-	nand_release(&this->board_mtd);
-
-	/* free the common resources */
-	iounmap(this->regs);
-	kfree(this);
-
-	DEBUG(MTD_DEBUG_LEVEL1, "%s: removed\n", module_id);
-	return 0;
-}
-
-/*
- * Called by device layer when it finds a device matching
- * one our driver can handle. This code checks to see if
- * it can allocate all necessary resources then calls the
- * nand layer to look for devices.
-*/
-static int __init excite_nand_probe(struct platform_device *pdev)
-{
-	struct excite_nand_drvdata *drvdata;	/* private driver data */
-	struct nand_chip *board_chip;	/* private flash chip data */
-	struct mtd_info *board_mtd;	/* mtd info for this board */
-	int scan_res;
-
-	drvdata = kzalloc(sizeof(*drvdata), GFP_KERNEL);
-	if (unlikely(!drvdata)) {
-		printk(KERN_ERR "%s: no memory for drvdata\n",
-		       module_id);
-		return -ENOMEM;
-	}
-
-	/* bind private data into driver */
-	platform_set_drvdata(pdev, drvdata);
-
-	/* allocate and map the resource */
-	drvdata->regs =
-		excite_nand_map_regs(pdev, EXCITE_NANDFLASH_RESOURCE_REGS);
-
-	if (unlikely(!drvdata->regs)) {
-		printk(KERN_ERR "%s: cannot reserve register region\n",
-		       module_id);
-		kfree(drvdata);
-		return -ENXIO;
-	}
-	
-	drvdata->tgt = drvdata->regs + EXCITE_NANDFLASH_DATA_BYTE;
-
-	/* initialise our chip */
-	board_chip = &drvdata->board_chip;
-	board_chip->IO_ADDR_R = board_chip->IO_ADDR_W =
-		drvdata->regs + EXCITE_NANDFLASH_DATA_BYTE;
-	board_chip->cmd_ctrl = excite_nand_control;
-	board_chip->dev_ready = excite_nand_devready;
-	board_chip->chip_delay = 25;
-	board_chip->ecc.mode = NAND_ECC_SOFT;
-
-	/* link chip to mtd */
-	board_mtd = &drvdata->board_mtd;
-	board_mtd->priv = board_chip;
-
-	DEBUG(MTD_DEBUG_LEVEL2, "%s: device scan\n", module_id);
-	scan_res = nand_scan(&drvdata->board_mtd, 1);
-
-	if (likely(!scan_res)) {
-		DEBUG(MTD_DEBUG_LEVEL2, "%s: register partitions\n", module_id);
-		add_mtd_partitions(&drvdata->board_mtd, partition_info,
-				   ARRAY_SIZE(partition_info));
-	} else {
-		iounmap(drvdata->regs);
-		kfree(drvdata);
-		printk(KERN_ERR "%s: device scan failed\n", module_id);
-		return -EIO;
-	}
-	return 0;
-}
-
-static struct platform_driver excite_nand_driver = {
-	.driver = {
-		.name = "excite_nand",
-		.owner		= THIS_MODULE,
-	},
-	.probe = excite_nand_probe,
-	.remove = __devexit_p(excite_nand_remove)
-};
-
-static int __init excite_nand_init(void)
-{
-	pr_info("Basler eXcite nand flash driver Version "
-		EXCITE_NANDFLASH_VERSION "\n");
-	return platform_driver_register(&excite_nand_driver);
-}
-
-static void __exit excite_nand_exit(void)
-{
-	platform_driver_unregister(&excite_nand_driver);
-}
-
-module_init(excite_nand_init);
-module_exit(excite_nand_exit);
-
-MODULE_AUTHOR("Thomas Koeller <thomas.koeller@baslerweb.com>");
-MODULE_DESCRIPTION("Basler eXcite NAND-Flash driver");
-MODULE_LICENSE("GPL");
-MODULE_VERSION(EXCITE_NANDFLASH_VERSION)
diff --git a/drivers/mtd/nand/fsl_elbc_nand.c b/drivers/mtd/nand/fsl_elbc_nand.c
index ddd37d2554ed..ae30fb6eed97 100644
--- a/drivers/mtd/nand/fsl_elbc_nand.c
+++ b/drivers/mtd/nand/fsl_elbc_nand.c
@@ -237,12 +237,15 @@ static int fsl_elbc_run_command(struct mtd_info *mtd)
 
 	ctrl->use_mdr = 0;
 
-	dev_vdbg(ctrl->dev,
-	         "fsl_elbc_run_command: stat=%08x mdr=%08x fmr=%08x\n",
-	         ctrl->status, ctrl->mdr, in_be32(&lbc->fmr));
+	if (ctrl->status != LTESR_CC) {
+		dev_info(ctrl->dev,
+		         "command failed: fir %x fcr %x status %x mdr %x\n",
+		         in_be32(&lbc->fir), in_be32(&lbc->fcr),
+		         ctrl->status, ctrl->mdr);
+		return -EIO;
+	}
 
-	/* returns 0 on success otherwise non-zero) */
-	return ctrl->status == LTESR_CC ? 0 : -EIO;
+	return 0;
 }
 
 static void fsl_elbc_do_read(struct nand_chip *chip, int oob)
@@ -253,17 +256,17 @@ static void fsl_elbc_do_read(struct nand_chip *chip, int oob)
 
 	if (priv->page_size) {
 		out_be32(&lbc->fir,
-		         (FIR_OP_CW0 << FIR_OP0_SHIFT) |
+		         (FIR_OP_CM0 << FIR_OP0_SHIFT) |
 		         (FIR_OP_CA  << FIR_OP1_SHIFT) |
 		         (FIR_OP_PA  << FIR_OP2_SHIFT) |
-		         (FIR_OP_CW1 << FIR_OP3_SHIFT) |
+		         (FIR_OP_CM1 << FIR_OP3_SHIFT) |
 		         (FIR_OP_RBW << FIR_OP4_SHIFT));
 
 		out_be32(&lbc->fcr, (NAND_CMD_READ0 << FCR_CMD0_SHIFT) |
 		                    (NAND_CMD_READSTART << FCR_CMD1_SHIFT));
 	} else {
 		out_be32(&lbc->fir,
-		         (FIR_OP_CW0 << FIR_OP0_SHIFT) |
+		         (FIR_OP_CM0 << FIR_OP0_SHIFT) |
 		         (FIR_OP_CA  << FIR_OP1_SHIFT) |
 		         (FIR_OP_PA  << FIR_OP2_SHIFT) |
 		         (FIR_OP_RBW << FIR_OP3_SHIFT));
@@ -332,7 +335,7 @@ static void fsl_elbc_cmdfunc(struct mtd_info *mtd, unsigned int command,
 	case NAND_CMD_READID:
 		dev_vdbg(ctrl->dev, "fsl_elbc_cmdfunc: NAND_CMD_READID.\n");
 
-		out_be32(&lbc->fir, (FIR_OP_CW0 << FIR_OP0_SHIFT) |
+		out_be32(&lbc->fir, (FIR_OP_CM0 << FIR_OP0_SHIFT) |
 		                    (FIR_OP_UA  << FIR_OP1_SHIFT) |
 		                    (FIR_OP_RBW << FIR_OP2_SHIFT));
 		out_be32(&lbc->fcr, NAND_CMD_READID << FCR_CMD0_SHIFT);
@@ -359,16 +362,20 @@ static void fsl_elbc_cmdfunc(struct mtd_info *mtd, unsigned int command,
 		dev_vdbg(ctrl->dev, "fsl_elbc_cmdfunc: NAND_CMD_ERASE2.\n");
 
 		out_be32(&lbc->fir,
-		         (FIR_OP_CW0 << FIR_OP0_SHIFT) |
+		         (FIR_OP_CM0 << FIR_OP0_SHIFT) |
 		         (FIR_OP_PA  << FIR_OP1_SHIFT) |
-		         (FIR_OP_CM1 << FIR_OP2_SHIFT));
+		         (FIR_OP_CM2 << FIR_OP2_SHIFT) |
+		         (FIR_OP_CW1 << FIR_OP3_SHIFT) |
+		         (FIR_OP_RS  << FIR_OP4_SHIFT));
 
 		out_be32(&lbc->fcr,
 		         (NAND_CMD_ERASE1 << FCR_CMD0_SHIFT) |
-		         (NAND_CMD_ERASE2 << FCR_CMD1_SHIFT));
+		         (NAND_CMD_STATUS << FCR_CMD1_SHIFT) |
+		         (NAND_CMD_ERASE2 << FCR_CMD2_SHIFT));
 
 		out_be32(&lbc->fbcr, 0);
 		ctrl->read_bytes = 0;
+		ctrl->use_mdr = 1;
 
 		fsl_elbc_run_command(mtd);
 		return;
@@ -383,40 +390,41 @@ static void fsl_elbc_cmdfunc(struct mtd_info *mtd, unsigned int command,
 
 		ctrl->column = column;
 		ctrl->oob = 0;
+		ctrl->use_mdr = 1;
 
-		if (priv->page_size) {
-			fcr = (NAND_CMD_SEQIN << FCR_CMD0_SHIFT) |
-			      (NAND_CMD_PAGEPROG << FCR_CMD1_SHIFT);
+		fcr = (NAND_CMD_STATUS   << FCR_CMD1_SHIFT) |
+		      (NAND_CMD_SEQIN    << FCR_CMD2_SHIFT) |
+		      (NAND_CMD_PAGEPROG << FCR_CMD3_SHIFT);
 
+		if (priv->page_size) {
 			out_be32(&lbc->fir,
-			         (FIR_OP_CW0 << FIR_OP0_SHIFT) |
+			         (FIR_OP_CM2 << FIR_OP0_SHIFT) |
 			         (FIR_OP_CA  << FIR_OP1_SHIFT) |
 			         (FIR_OP_PA  << FIR_OP2_SHIFT) |
 			         (FIR_OP_WB  << FIR_OP3_SHIFT) |
-			         (FIR_OP_CW1 << FIR_OP4_SHIFT));
+			         (FIR_OP_CM3 << FIR_OP4_SHIFT) |
+			         (FIR_OP_CW1 << FIR_OP5_SHIFT) |
+			         (FIR_OP_RS  << FIR_OP6_SHIFT));
 		} else {
-			fcr = (NAND_CMD_PAGEPROG << FCR_CMD1_SHIFT) |
-			      (NAND_CMD_SEQIN << FCR_CMD2_SHIFT);
-
 			out_be32(&lbc->fir,
-			         (FIR_OP_CW0 << FIR_OP0_SHIFT) |
+			         (FIR_OP_CM0 << FIR_OP0_SHIFT) |
 			         (FIR_OP_CM2 << FIR_OP1_SHIFT) |
 			         (FIR_OP_CA  << FIR_OP2_SHIFT) |
 			         (FIR_OP_PA  << FIR_OP3_SHIFT) |
 			         (FIR_OP_WB  << FIR_OP4_SHIFT) |
-			         (FIR_OP_CW1 << FIR_OP5_SHIFT));
+			         (FIR_OP_CM3 << FIR_OP5_SHIFT) |
+			         (FIR_OP_CW1 << FIR_OP6_SHIFT) |
+			         (FIR_OP_RS  << FIR_OP7_SHIFT));
 
 			if (column >= mtd->writesize) {
 				/* OOB area --> READOOB */
 				column -= mtd->writesize;
 				fcr |= NAND_CMD_READOOB << FCR_CMD0_SHIFT;
 				ctrl->oob = 1;
-			} else if (column < 256) {
+			} else {
+				WARN_ON(column != 0);
 				/* First 256 bytes --> READ0 */
 				fcr |= NAND_CMD_READ0 << FCR_CMD0_SHIFT;
-			} else {
-				/* Second 256 bytes --> READ1 */
-				fcr |= NAND_CMD_READ1 << FCR_CMD0_SHIFT;
 			}
 		}
 
@@ -628,22 +636,6 @@ static int fsl_elbc_wait(struct mtd_info *mtd, struct nand_chip *chip)
 {
 	struct fsl_elbc_mtd *priv = chip->priv;
 	struct fsl_elbc_ctrl *ctrl = priv->ctrl;
-	struct fsl_lbc_regs __iomem *lbc = ctrl->regs;
-
-	if (ctrl->status != LTESR_CC)
-		return NAND_STATUS_FAIL;
-
-	/* Use READ_STATUS command, but wait for the device to be ready */
-	ctrl->use_mdr = 0;
-	out_be32(&lbc->fir,
-	         (FIR_OP_CW0 << FIR_OP0_SHIFT) |
-	         (FIR_OP_RBW << FIR_OP1_SHIFT));
-	out_be32(&lbc->fcr, NAND_CMD_STATUS << FCR_CMD0_SHIFT);
-	out_be32(&lbc->fbcr, 1);
-	set_addr(mtd, 0, 0, 0);
-	ctrl->read_bytes = 1;
-
-	fsl_elbc_run_command(mtd);
 
 	if (ctrl->status != LTESR_CC)
 		return NAND_STATUS_FAIL;
@@ -651,8 +643,7 @@ static int fsl_elbc_wait(struct mtd_info *mtd, struct nand_chip *chip)
 	/* The chip always seems to report that it is
 	 * write-protected, even when it is not.
 	 */
-	setbits8(ctrl->addr, NAND_STATUS_WP);
-	return fsl_elbc_read_byte(mtd);
+	return (ctrl->mdr & 0xff) | NAND_STATUS_WP;
 }
 
 static int fsl_elbc_chip_init_tail(struct mtd_info *mtd)
@@ -946,6 +937,13 @@ static int __devinit fsl_elbc_ctrl_init(struct fsl_elbc_ctrl *ctrl)
 {
 	struct fsl_lbc_regs __iomem *lbc = ctrl->regs;
 
+	/*
+	 * NAND transactions can tie up the bus for a long time, so set the
+	 * bus timeout to max by clearing LBCR[BMT] (highest base counter
+	 * value) and setting LBCR[BMTPS] to the highest prescaler value.
+	 */
+	clrsetbits_be32(&lbc->lbcr, LBCR_BMT, 15);
+
 	/* clear event registers */
 	setbits32(&lbc->ltesr, LTESR_NAND_MASK);
 	out_be32(&lbc->lteatr, 0);
diff --git a/drivers/mtd/nand/fsl_upm.c b/drivers/mtd/nand/fsl_upm.c
index d120cd8d7267..071a60cb4204 100644
--- a/drivers/mtd/nand/fsl_upm.c
+++ b/drivers/mtd/nand/fsl_upm.c
@@ -112,7 +112,7 @@ static void fun_select_chip(struct mtd_info *mtd, int mchip_nr)
 
 	if (mchip_nr == -1) {
 		chip->cmd_ctrl(mtd, NAND_CMD_NONE, 0 | NAND_CTRL_CHANGE);
-	} else if (mchip_nr >= 0) {
+	} else if (mchip_nr >= 0 && mchip_nr < NAND_MAX_CHIPS) {
 		fun->mchip_number = mchip_nr;
 		chip->IO_ADDR_R = fun->io_base + fun->mchip_offsets[mchip_nr];
 		chip->IO_ADDR_W = chip->IO_ADDR_R;
diff --git a/drivers/mtd/nand/mxc_nand.c b/drivers/mtd/nand/mxc_nand.c
index 65b26d5a5c0d..45dec5770da0 100644
--- a/drivers/mtd/nand/mxc_nand.c
+++ b/drivers/mtd/nand/mxc_nand.c
@@ -33,9 +33,13 @@
 
 #include <asm/mach/flash.h>
 #include <mach/mxc_nand.h>
+#include <mach/hardware.h>
 
 #define DRIVER_NAME "mxc_nand"
 
+#define nfc_is_v21()		(cpu_is_mx25() || cpu_is_mx35())
+#define nfc_is_v1()		(cpu_is_mx31() || cpu_is_mx27())
+
 /* Addresses for NFC registers */
 #define NFC_BUF_SIZE		0xE00
 #define NFC_BUF_ADDR		0xE04
@@ -46,24 +50,14 @@
 #define NFC_RSLTMAIN_AREA	0xE0E
 #define NFC_RSLTSPARE_AREA	0xE10
 #define NFC_WRPROT		0xE12
-#define NFC_UNLOCKSTART_BLKADDR	0xE14
-#define NFC_UNLOCKEND_BLKADDR	0xE16
+#define NFC_V1_UNLOCKSTART_BLKADDR	0xe14
+#define NFC_V1_UNLOCKEND_BLKADDR	0xe16
+#define NFC_V21_UNLOCKSTART_BLKADDR	0xe20
+#define NFC_V21_UNLOCKEND_BLKADDR	0xe22
 #define NFC_NF_WRPRST		0xE18
 #define NFC_CONFIG1		0xE1A
 #define NFC_CONFIG2		0xE1C
 
-/* Addresses for NFC RAM BUFFER Main area 0 */
-#define MAIN_AREA0		0x000
-#define MAIN_AREA1		0x200
-#define MAIN_AREA2		0x400
-#define MAIN_AREA3		0x600
-
-/* Addresses for NFC SPARE BUFFER Spare area 0 */
-#define SPARE_AREA0		0x800
-#define SPARE_AREA1		0x810
-#define SPARE_AREA2		0x820
-#define SPARE_AREA3		0x830
-
 /* Set INT to 0, FCMD to 1, rest to 0 in NFC_CONFIG2 Register
  * for Command operation */
 #define NFC_CMD            0x1
@@ -106,48 +100,66 @@ struct mxc_nand_host {
 	struct mtd_partition	*parts;
 	struct device		*dev;
 
+	void			*spare0;
+	void			*main_area0;
+	void			*main_area1;
+
+	void __iomem		*base;
 	void __iomem		*regs;
-	int			spare_only;
 	int			status_request;
-	int			pagesize_2k;
-	uint16_t		col_addr;
 	struct clk		*clk;
 	int			clk_act;
 	int			irq;
 
 	wait_queue_head_t	irq_waitq;
-};
-
-/* Define delays in microsec for NAND device operations */
-#define TROP_US_DELAY   2000
-/* Macros to get byte and bit positions of ECC */
-#define COLPOS(x)  ((x) >> 3)
-#define BITPOS(x) ((x) & 0xf)
 
-/* Define single bit Error positions in Main & Spare area */
-#define MAIN_SINGLEBIT_ERROR 0x4
-#define SPARE_SINGLEBIT_ERROR 0x1
-
-/* OOB placement block for use with hardware ecc generation */
-static struct nand_ecclayout nand_hw_eccoob_8 = {
-	.eccbytes = 5,
-	.eccpos = {6, 7, 8, 9, 10},
-	.oobfree = {{0, 5}, {11, 5}, }
+	uint8_t			*data_buf;
+	unsigned int		buf_start;
+	int			spare_len;
 };
 
-static struct nand_ecclayout nand_hw_eccoob_16 = {
+/* OOB placement block for use with hardware ecc generation */
+static struct nand_ecclayout nandv1_hw_eccoob_smallpage = {
 	.eccbytes = 5,
 	.eccpos = {6, 7, 8, 9, 10},
-	.oobfree = {{0, 5}, {11, 5}, }
+	.oobfree = {{0, 5}, {12, 4}, }
 };
 
-static struct nand_ecclayout nand_hw_eccoob_64 = {
+static struct nand_ecclayout nandv1_hw_eccoob_largepage = {
 	.eccbytes = 20,
 	.eccpos = {6, 7, 8, 9, 10, 22, 23, 24, 25, 26,
 		   38, 39, 40, 41, 42, 54, 55, 56, 57, 58},
 	.oobfree = {{2, 4}, {11, 10}, {27, 10}, {43, 10}, {59, 5}, }
 };
 
+/* OOB description for 512 byte pages with 16 byte OOB */
+static struct nand_ecclayout nandv2_hw_eccoob_smallpage = {
+	.eccbytes = 1 * 9,
+	.eccpos = {
+		 7,  8,  9, 10, 11, 12, 13, 14, 15
+	},
+	.oobfree = {
+		{.offset = 0, .length = 5}
+	}
+};
+
+/* OOB description for 2048 byte pages with 64 byte OOB */
+static struct nand_ecclayout nandv2_hw_eccoob_largepage = {
+	.eccbytes = 4 * 9,
+	.eccpos = {
+		 7,  8,  9, 10, 11, 12, 13, 14, 15,
+		23, 24, 25, 26, 27, 28, 29, 30, 31,
+		39, 40, 41, 42, 43, 44, 45, 46, 47,
+		55, 56, 57, 58, 59, 60, 61, 62, 63
+	},
+	.oobfree = {
+		{.offset = 2, .length = 4},
+		{.offset = 16, .length = 7},
+		{.offset = 32, .length = 7},
+		{.offset = 48, .length = 7}
+	}
+};
+
 #ifdef CONFIG_MTD_PARTITIONS
 static const char *part_probes[] = { "RedBoot", "cmdlinepart", NULL };
 #endif
@@ -170,10 +182,10 @@ static irqreturn_t mxc_nfc_irq(int irq, void *dev_id)
 /* This function polls the NANDFC to wait for the basic operation to
  * complete by checking the INT bit of config2 register.
  */
-static void wait_op_done(struct mxc_nand_host *host, int max_retries,
-				uint16_t param, int useirq)
+static void wait_op_done(struct mxc_nand_host *host, int useirq)
 {
 	uint32_t tmp;
+	int max_retries = 2000;
 
 	if (useirq) {
 		if ((readw(host->regs + NFC_CONFIG2) & NFC_INT) == 0) {
@@ -200,8 +212,8 @@ static void wait_op_done(struct mxc_nand_host *host, int max_retries,
 			udelay(1);
 		}
 		if (max_retries < 0)
-			DEBUG(MTD_DEBUG_LEVEL0, "%s(%d): INT not set\n",
-			      __func__, param);
+			DEBUG(MTD_DEBUG_LEVEL0, "%s: INT not set\n",
+			      __func__);
 	}
 }
 
@@ -215,7 +227,7 @@ static void send_cmd(struct mxc_nand_host *host, uint16_t cmd, int useirq)
 	writew(NFC_CMD, host->regs + NFC_CONFIG2);
 
 	/* Wait for operation to complete */
-	wait_op_done(host, TROP_US_DELAY, cmd, useirq);
+	wait_op_done(host, useirq);
 }
 
 /* This function sends an address (or partial address) to the
@@ -229,82 +241,47 @@ static void send_addr(struct mxc_nand_host *host, uint16_t addr, int islast)
 	writew(NFC_ADDR, host->regs + NFC_CONFIG2);
 
 	/* Wait for operation to complete */
-	wait_op_done(host, TROP_US_DELAY, addr, islast);
+	wait_op_done(host, islast);
 }
 
-/* This function requests the NANDFC to initate the transfer
- * of data currently in the NANDFC RAM buffer to the NAND device. */
-static void send_prog_page(struct mxc_nand_host *host, uint8_t buf_id,
-			int spare_only)
+static void send_page(struct mtd_info *mtd, unsigned int ops)
 {
-	DEBUG(MTD_DEBUG_LEVEL3, "send_prog_page (%d)\n", spare_only);
-
-	/* NANDFC buffer 0 is used for page read/write */
-	writew(buf_id, host->regs + NFC_BUF_ADDR);
-
-	/* Configure spare or page+spare access */
-	if (!host->pagesize_2k) {
-		uint16_t config1 = readw(host->regs + NFC_CONFIG1);
-		if (spare_only)
-			config1 |= NFC_SP_EN;
-		else
-			config1 &= ~(NFC_SP_EN);
-		writew(config1, host->regs + NFC_CONFIG1);
-	}
+	struct nand_chip *nand_chip = mtd->priv;
+	struct mxc_nand_host *host = nand_chip->priv;
+	int bufs, i;
 
-	writew(NFC_INPUT, host->regs + NFC_CONFIG2);
+	if (nfc_is_v1() && mtd->writesize > 512)
+		bufs = 4;
+	else
+		bufs = 1;
 
-	/* Wait for operation to complete */
-	wait_op_done(host, TROP_US_DELAY, spare_only, true);
-}
+	for (i = 0; i < bufs; i++) {
 
-/* Requests NANDFC to initated the transfer of data from the
- * NAND device into in the NANDFC ram buffer. */
-static void send_read_page(struct mxc_nand_host *host, uint8_t buf_id,
-		int spare_only)
-{
-	DEBUG(MTD_DEBUG_LEVEL3, "send_read_page (%d)\n", spare_only);
+		/* NANDFC buffer 0 is used for page read/write */
+		writew(i, host->regs + NFC_BUF_ADDR);
 
-	/* NANDFC buffer 0 is used for page read/write */
-	writew(buf_id, host->regs + NFC_BUF_ADDR);
+		writew(ops, host->regs + NFC_CONFIG2);
 
-	/* Configure spare or page+spare access */
-	if (!host->pagesize_2k) {
-		uint32_t config1 = readw(host->regs + NFC_CONFIG1);
-		if (spare_only)
-			config1 |= NFC_SP_EN;
-		else
-			config1 &= ~NFC_SP_EN;
-		writew(config1, host->regs + NFC_CONFIG1);
+		/* Wait for operation to complete */
+		wait_op_done(host, true);
 	}
-
-	writew(NFC_OUTPUT, host->regs + NFC_CONFIG2);
-
-	/* Wait for operation to complete */
-	wait_op_done(host, TROP_US_DELAY, spare_only, true);
 }
 
 /* Request the NANDFC to perform a read of the NAND device ID. */
 static void send_read_id(struct mxc_nand_host *host)
 {
 	struct nand_chip *this = &host->nand;
-	uint16_t tmp;
 
 	/* NANDFC buffer 0 is used for device ID output */
 	writew(0x0, host->regs + NFC_BUF_ADDR);
 
-	/* Read ID into main buffer */
-	tmp = readw(host->regs + NFC_CONFIG1);
-	tmp &= ~NFC_SP_EN;
-	writew(tmp, host->regs + NFC_CONFIG1);
-
 	writew(NFC_ID, host->regs + NFC_CONFIG2);
 
 	/* Wait for operation to complete */
-	wait_op_done(host, TROP_US_DELAY, 0, true);
+	wait_op_done(host, true);
 
 	if (this->options & NAND_BUSWIDTH_16) {
-		void __iomem *main_buf = host->regs + MAIN_AREA0;
+		void __iomem *main_buf = host->main_area0;
 		/* compress the ID info */
 		writeb(readb(main_buf + 2), main_buf + 1);
 		writeb(readb(main_buf + 4), main_buf + 2);
@@ -312,15 +289,16 @@ static void send_read_id(struct mxc_nand_host *host)
 		writeb(readb(main_buf + 8), main_buf + 4);
 		writeb(readb(main_buf + 10), main_buf + 5);
 	}
+	memcpy(host->data_buf, host->main_area0, 16);
 }
 
 /* This function requests the NANDFC to perform a read of the
  * NAND device status and returns the current status. */
 static uint16_t get_dev_status(struct mxc_nand_host *host)
 {
-	void __iomem *main_buf = host->regs + MAIN_AREA1;
+	void __iomem *main_buf = host->main_area1;
 	uint32_t store;
-	uint16_t ret, tmp;
+	uint16_t ret;
 	/* Issue status request to NAND device */
 
 	/* store the main area1 first word, later do recovery */
@@ -329,15 +307,10 @@ static uint16_t get_dev_status(struct mxc_nand_host *host)
 	 * corruption of read/write buffer on status requests. */
 	writew(1, host->regs + NFC_BUF_ADDR);
 
-	/* Read status into main buffer */
-	tmp = readw(host->regs + NFC_CONFIG1);
-	tmp &= ~NFC_SP_EN;
-	writew(tmp, host->regs + NFC_CONFIG1);
-
 	writew(NFC_STATUS, host->regs + NFC_CONFIG2);
 
 	/* Wait for operation to complete */
-	wait_op_done(host, TROP_US_DELAY, 0, true);
+	wait_op_done(host, true);
 
 	/* Status is placed in first word of main buffer */
 	/* get status, then recovery area 1 data */
@@ -397,32 +370,14 @@ static u_char mxc_nand_read_byte(struct mtd_info *mtd)
 {
 	struct nand_chip *nand_chip = mtd->priv;
 	struct mxc_nand_host *host = nand_chip->priv;
-	uint8_t ret = 0;
-	uint16_t col, rd_word;
-	uint16_t __iomem *main_buf = host->regs + MAIN_AREA0;
-	uint16_t __iomem *spare_buf = host->regs + SPARE_AREA0;
+	uint8_t ret;
 
 	/* Check for status request */
 	if (host->status_request)
 		return get_dev_status(host) & 0xFF;
 
-	/* Get column for 16-bit access */
-	col = host->col_addr >> 1;
-
-	/* If we are accessing the spare region */
-	if (host->spare_only)
-		rd_word = readw(&spare_buf[col]);
-	else
-		rd_word = readw(&main_buf[col]);
-
-	/* Pick upper/lower byte of word from RAM buffer */
-	if (host->col_addr & 0x1)
-		ret = (rd_word >> 8) & 0xFF;
-	else
-		ret = rd_word & 0xFF;
-
-	/* Update saved column address */
-	host->col_addr++;
+	ret = *(uint8_t *)(host->data_buf + host->buf_start);
+	host->buf_start++;
 
 	return ret;
 }
@@ -431,33 +386,10 @@ static uint16_t mxc_nand_read_word(struct mtd_info *mtd)
 {
 	struct nand_chip *nand_chip = mtd->priv;
 	struct mxc_nand_host *host = nand_chip->priv;
-	uint16_t col, rd_word, ret;
-	uint16_t __iomem *p;
-
-	DEBUG(MTD_DEBUG_LEVEL3,
-	      "mxc_nand_read_word(col = %d)\n", host->col_addr);
-
-	col = host->col_addr;
-	/* Adjust saved column address */
-	if (col < mtd->writesize && host->spare_only)
-		col += mtd->writesize;
+	uint16_t ret;
 
-	if (col < mtd->writesize)
-		p = (host->regs + MAIN_AREA0) + (col >> 1);
-	else
-		p = (host->regs + SPARE_AREA0) + ((col - mtd->writesize) >> 1);
-
-	if (col & 1) {
-		rd_word = readw(p);
-		ret = (rd_word >> 8) & 0xff;
-		rd_word = readw(&p[1]);
-		ret |= (rd_word << 8) & 0xff00;
-
-	} else
-		ret = readw(p);
-
-	/* Update saved column address */
-	host->col_addr = col + 2;
+	ret = *(uint16_t *)(host->data_buf + host->buf_start);
+	host->buf_start += 2;
 
 	return ret;
 }
@@ -470,94 +402,14 @@ static void mxc_nand_write_buf(struct mtd_info *mtd,
 {
 	struct nand_chip *nand_chip = mtd->priv;
 	struct mxc_nand_host *host = nand_chip->priv;
-	int n, col, i = 0;
-
-	DEBUG(MTD_DEBUG_LEVEL3,
-	      "mxc_nand_write_buf(col = %d, len = %d)\n", host->col_addr,
-	      len);
-
-	col = host->col_addr;
+	u16 col = host->buf_start;
+	int n = mtd->oobsize + mtd->writesize - col;
 
-	/* Adjust saved column address */
-	if (col < mtd->writesize && host->spare_only)
-		col += mtd->writesize;
+	n = min(n, len);
 
-	n = mtd->writesize + mtd->oobsize - col;
-	n = min(len, n);
-
-	DEBUG(MTD_DEBUG_LEVEL3,
-	      "%s:%d: col = %d, n = %d\n", __func__, __LINE__, col, n);
-
-	while (n) {
-		void __iomem *p;
-
-		if (col < mtd->writesize)
-			p = host->regs + MAIN_AREA0 + (col & ~3);
-		else
-			p = host->regs + SPARE_AREA0 -
-						mtd->writesize + (col & ~3);
-
-		DEBUG(MTD_DEBUG_LEVEL3, "%s:%d: p = %p\n", __func__,
-		      __LINE__, p);
-
-		if (((col | (int)&buf[i]) & 3) || n < 16) {
-			uint32_t data = 0;
-
-			if (col & 3 || n < 4)
-				data = readl(p);
-
-			switch (col & 3) {
-			case 0:
-				if (n) {
-					data = (data & 0xffffff00) |
-					    (buf[i++] << 0);
-					n--;
-					col++;
-				}
-			case 1:
-				if (n) {
-					data = (data & 0xffff00ff) |
-					    (buf[i++] << 8);
-					n--;
-					col++;
-				}
-			case 2:
-				if (n) {
-					data = (data & 0xff00ffff) |
-					    (buf[i++] << 16);
-					n--;
-					col++;
-				}
-			case 3:
-				if (n) {
-					data = (data & 0x00ffffff) |
-					    (buf[i++] << 24);
-					n--;
-					col++;
-				}
-			}
-
-			writel(data, p);
-		} else {
-			int m = mtd->writesize - col;
+	memcpy(host->data_buf + col, buf, n);
 
-			if (col >= mtd->writesize)
-				m += mtd->oobsize;
-
-			m = min(n, m) & ~3;
-
-			DEBUG(MTD_DEBUG_LEVEL3,
-			      "%s:%d: n = %d, m = %d, i = %d, col = %d\n",
-			      __func__,  __LINE__, n, m, i, col);
-
-			memcpy(p, &buf[i], m);
-			col += m;
-			i += m;
-			n -= m;
-		}
-	}
-	/* Update saved column address */
-	host->col_addr = col;
+	host->buf_start += n;
 }
 
 /* Read the data buffer from the NAND Flash. To read the data from NAND
@@ -568,75 +420,14 @@ static void mxc_nand_read_buf(struct mtd_info *mtd, u_char *buf, int len)
 {
 	struct nand_chip *nand_chip = mtd->priv;
 	struct mxc_nand_host *host = nand_chip->priv;
-	int n, col, i = 0;
-
-	DEBUG(MTD_DEBUG_LEVEL3,
-	      "mxc_nand_read_buf(col = %d, len = %d)\n", host->col_addr, len);
-
-	col = host->col_addr;
+	u16 col = host->buf_start;
+	int n = mtd->oobsize + mtd->writesize - col;
 
-	/* Adjust saved column address */
-	if (col < mtd->writesize && host->spare_only)
-		col += mtd->writesize;
+	n = min(n, len);
 
-	n = mtd->writesize + mtd->oobsize - col;
-	n = min(len, n);
-
-	while (n) {
-		void __iomem *p;
-
-		if (col < mtd->writesize)
-			p = host->regs + MAIN_AREA0 + (col & ~3);
-		else
-			p = host->regs + SPARE_AREA0 -
-					mtd->writesize + (col & ~3);
-
-		if (((col | (int)&buf[i]) & 3) || n < 16) {
-			uint32_t data;
-
-			data = readl(p);
-			switch (col & 3) {
-			case 0:
-				if (n) {
-					buf[i++] = (uint8_t) (data);
-					n--;
-					col++;
-				}
-			case 1:
-				if (n) {
-					buf[i++] = (uint8_t) (data >> 8);
-					n--;
-					col++;
-				}
-			case 2:
-				if (n) {
-					buf[i++] = (uint8_t) (data >> 16);
-					n--;
-					col++;
-				}
-			case 3:
-				if (n) {
-					buf[i++] = (uint8_t) (data >> 24);
-					n--;
-					col++;
-				}
-			}
-		} else {
-			int m = mtd->writesize - col;
-
-			if (col >= mtd->writesize)
-				m += mtd->oobsize;
-
-			m = min(n, m) & ~3;
-			memcpy(&buf[i], p, m);
-			col += m;
-			i += m;
-			n -= m;
-		}
-	}
-	/* Update saved column address */
-	host->col_addr = col;
+	memcpy(buf, host->data_buf + col, len);
 
+	host->buf_start += len;
 }
 
 /* Used by the upper layer to verify the data in NAND Flash
@@ -654,23 +445,6 @@ static void mxc_nand_select_chip(struct mtd_info *mtd, int chip)
 	struct nand_chip *nand_chip = mtd->priv;
 	struct mxc_nand_host *host = nand_chip->priv;
 
-#ifdef CONFIG_MTD_NAND_MXC_FORCE_CE
-	if (chip > 0) {
-		DEBUG(MTD_DEBUG_LEVEL0,
-		      "ERROR:  Illegal chip select (chip = %d)\n", chip);
-		return;
-	}
-
-	if (chip == -1) {
-		writew(readw(host->regs + NFC_CONFIG1) & ~NFC_CE,
-				host->regs + NFC_CONFIG1);
-		return;
-	}
-
-	writew(readw(host->regs + NFC_CONFIG1) | NFC_CE,
-			host->regs + NFC_CONFIG1);
-#endif
-
 	switch (chip) {
 	case -1:
 		/* Disable the NFC clock */
@@ -692,94 +466,40 @@ static void mxc_nand_select_chip(struct mtd_info *mtd, int chip)
 	}
 }
 
-/* Used by the upper layer to write command to NAND Flash for
- * different operations to be carried out on NAND Flash */
-static void mxc_nand_command(struct mtd_info *mtd, unsigned command,
-				int column, int page_addr)
+/*
+ * Function to transfer data to/from spare area.
+ */
+static void copy_spare(struct mtd_info *mtd, bool bfrom)
 {
-	struct nand_chip *nand_chip = mtd->priv;
-	struct mxc_nand_host *host = nand_chip->priv;
-	int useirq = true;
-
-	DEBUG(MTD_DEBUG_LEVEL3,
-	      "mxc_nand_command (cmd = 0x%x, col = 0x%x, page = 0x%x)\n",
-	      command, column, page_addr);
-
-	/* Reset command state information */
-	host->status_request = false;
-
-	/* Command pre-processing step */
-	switch (command) {
-
-	case NAND_CMD_STATUS:
-		host->col_addr = 0;
-		host->status_request = true;
-		break;
-
-	case NAND_CMD_READ0:
-		host->col_addr = column;
-		host->spare_only = false;
-		useirq = false;
-		break;
-
-	case NAND_CMD_READOOB:
-		host->col_addr = column;
-		host->spare_only = true;
-		useirq = false;
-		if (host->pagesize_2k)
-			command = NAND_CMD_READ0; /* only READ0 is valid */
-		break;
-
-	case NAND_CMD_SEQIN:
-		if (column >= mtd->writesize) {
-			/*
-			 * FIXME: before send SEQIN command for write OOB,
-			 * We must read one page out.
-			 * For K9F1GXX has no READ1 command to set current HW
-			 * pointer to spare area, we must write the whole page
-			 * including OOB together.
-			 */
-			if (host->pagesize_2k)
-				/* call ourself to read a page */
-				mxc_nand_command(mtd, NAND_CMD_READ0, 0,
-						page_addr);
-
-			host->col_addr = column - mtd->writesize;
-			host->spare_only = true;
-
-			/* Set program pointer to spare region */
-			if (!host->pagesize_2k)
-				send_cmd(host, NAND_CMD_READOOB, false);
-		} else {
-			host->spare_only = false;
-			host->col_addr = column;
-
-			/* Set program pointer to page start */
-			if (!host->pagesize_2k)
-				send_cmd(host, NAND_CMD_READ0, false);
-		}
-		useirq = false;
-		break;
-
-	case NAND_CMD_PAGEPROG:
-		send_prog_page(host, 0, host->spare_only);
-
-		if (host->pagesize_2k) {
-			/* data in 4 areas datas */
-			send_prog_page(host, 1, host->spare_only);
-			send_prog_page(host, 2, host->spare_only);
-			send_prog_page(host, 3, host->spare_only);
-		}
-
-		break;
+	struct nand_chip *this = mtd->priv;
+	struct mxc_nand_host *host = this->priv;
+	u16 i, j;
+	u16 n = mtd->writesize >> 9;
+	u8 *d = host->data_buf + mtd->writesize;
+	u8 *s = host->spare0;
+	u16 t = host->spare_len;
+
+	j = (mtd->oobsize / n >> 1) << 1;
+
+	if (bfrom) {
+		for (i = 0; i < n - 1; i++)
+			memcpy(d + i * j, s + i * t, j);
+
+		/* the last section */
+		memcpy(d + i * j, s + i * t, mtd->oobsize - i * j);
+	} else {
+		for (i = 0; i < n - 1; i++)
+			memcpy(&s[i * t], &d[i * j], j);
 
-	case NAND_CMD_ERASE1:
-		useirq = false;
-		break;
+		/* the last section */
+		memcpy(&s[i * t], &d[i * j], mtd->oobsize - i * j);
 	}
+}
 
-	/* Write out the command to the device. */
-	send_cmd(host, command, useirq);
+static void mxc_do_addr_cycle(struct mtd_info *mtd, int column, int page_addr)
+{
+	struct nand_chip *nand_chip = mtd->priv;
+	struct mxc_nand_host *host = nand_chip->priv;
 
 	/* Write out column address, if necessary */
 	if (column != -1) {
@@ -791,7 +511,7 @@ static void mxc_nand_command(struct mtd_info *mtd, unsigned command,
 		 * the full page.
 		 */
 		send_addr(host, 0, page_addr == -1);
-		if (host->pagesize_2k)
+		if (mtd->writesize > 512)
 			/* another col addr cycle for 2k page */
 			send_addr(host, 0, false);
 	}
@@ -801,7 +521,7 @@ static void mxc_nand_command(struct mtd_info *mtd, unsigned command,
 		/* paddr_0 - p_addr_7 */
 		send_addr(host, (page_addr & 0xff), false);
 
-		if (host->pagesize_2k) {
+		if (mtd->writesize > 512) {
 			if (mtd->size >= 0x10000000) {
 				/* paddr_8 - paddr_15 */
 				send_addr(host, (page_addr >> 8) & 0xff, false);
@@ -820,52 +540,136 @@ static void mxc_nand_command(struct mtd_info *mtd, unsigned command,
 				send_addr(host, (page_addr >> 8) & 0xff, true);
 		}
 	}
+}
+
+/* Used by the upper layer to write command to NAND Flash for
+ * different operations to be carried out on NAND Flash */
+static void mxc_nand_command(struct mtd_info *mtd, unsigned command,
+				int column, int page_addr)
+{
+	struct nand_chip *nand_chip = mtd->priv;
+	struct mxc_nand_host *host = nand_chip->priv;
+
+	DEBUG(MTD_DEBUG_LEVEL3,
+	      "mxc_nand_command (cmd = 0x%x, col = 0x%x, page = 0x%x)\n",
+	      command, column, page_addr);
+
+	/* Reset command state information */
+	host->status_request = false;
 
-	/* Command post-processing step */
+	/* Command pre-processing step */
 	switch (command) {
 
-	case NAND_CMD_RESET:
+	case NAND_CMD_STATUS:
+		host->buf_start = 0;
+		host->status_request = true;
+
+		send_cmd(host, command, true);
+		mxc_do_addr_cycle(mtd, column, page_addr);
 		break;
 
-	case NAND_CMD_READOOB:
 	case NAND_CMD_READ0:
-		if (host->pagesize_2k) {
-			/* send read confirm command */
+	case NAND_CMD_READOOB:
+		if (command == NAND_CMD_READ0)
+			host->buf_start = column;
+		else
+			host->buf_start = column + mtd->writesize;
+
+		if (mtd->writesize > 512)
+			command = NAND_CMD_READ0; /* only READ0 is valid */
+
+		send_cmd(host, command, false);
+		mxc_do_addr_cycle(mtd, column, page_addr);
+
+		if (mtd->writesize > 512)
 			send_cmd(host, NAND_CMD_READSTART, true);
-			/* read for each AREA */
-			send_read_page(host, 0, host->spare_only);
-			send_read_page(host, 1, host->spare_only);
-			send_read_page(host, 2, host->spare_only);
-			send_read_page(host, 3, host->spare_only);
-		} else
-			send_read_page(host, 0, host->spare_only);
+
+		send_page(mtd, NFC_OUTPUT);
+
+		memcpy(host->data_buf, host->main_area0, mtd->writesize);
+		copy_spare(mtd, true);
 		break;
 
-	case NAND_CMD_READID:
-		host->col_addr = 0;
-		send_read_id(host);
+	case NAND_CMD_SEQIN:
+		if (column >= mtd->writesize) {
+			/*
+			 * FIXME: before send SEQIN command for write OOB,
+			 * We must read one page out.
+			 * For K9F1GXX has no READ1 command to set current HW
+			 * pointer to spare area, we must write the whole page
+			 * including OOB together.
+			 */
+			if (mtd->writesize > 512)
+				/* call ourself to read a page */
+				mxc_nand_command(mtd, NAND_CMD_READ0, 0,
+						page_addr);
+
+			host->buf_start = column;
+
+			/* Set program pointer to spare region */
+			if (mtd->writesize == 512)
+				send_cmd(host, NAND_CMD_READOOB, false);
+		} else {
+			host->buf_start = column;
+
+			/* Set program pointer to page start */
+			if (mtd->writesize == 512)
+				send_cmd(host, NAND_CMD_READ0, false);
+		}
+
+		send_cmd(host, command, false);
+		mxc_do_addr_cycle(mtd, column, page_addr);
 		break;
 
 	case NAND_CMD_PAGEPROG:
+		memcpy(host->main_area0, host->data_buf, mtd->writesize);
+		copy_spare(mtd, false);
+		send_page(mtd, NFC_INPUT);
+		send_cmd(host, command, true);
+		mxc_do_addr_cycle(mtd, column, page_addr);
 		break;
 
-	case NAND_CMD_STATUS:
+	case NAND_CMD_READID:
+		send_cmd(host, command, true);
+		mxc_do_addr_cycle(mtd, column, page_addr);
+		send_read_id(host);
+		host->buf_start = column;
 		break;
 
+	case NAND_CMD_ERASE1:
 	case NAND_CMD_ERASE2:
+		send_cmd(host, command, false);
+		mxc_do_addr_cycle(mtd, column, page_addr);
+
 		break;
 	}
 }
 
-/* Define some generic bad / good block scan pattern which are used
- * while scanning a device for factory marked good / bad blocks. */
-static uint8_t scan_ff_pattern[] = { 0xff, 0xff };
+/*
+ * The generic flash bbt decriptors overlap with our ecc
+ * hardware, so define some i.MX specific ones.
+ */
+static uint8_t bbt_pattern[] = { 'B', 'b', 't', '0' };
+static uint8_t mirror_pattern[] = { '1', 't', 'b', 'B' };
+
+static struct nand_bbt_descr bbt_main_descr = {
+	.options = NAND_BBT_LASTBLOCK | NAND_BBT_CREATE | NAND_BBT_WRITE
+	    | NAND_BBT_2BIT | NAND_BBT_VERSION | NAND_BBT_PERCHIP,
+	.offs = 0,
+	.len = 4,
+	.veroffs = 4,
+	.maxblocks = 4,
+	.pattern = bbt_pattern,
+};
 
-static struct nand_bbt_descr smallpage_memorybased = {
-	.options = NAND_BBT_SCAN2NDPAGE,
-	.offs = 5,
-	.len = 1,
-	.pattern = scan_ff_pattern
+static struct nand_bbt_descr bbt_mirror_descr = {
+	.options = NAND_BBT_LASTBLOCK | NAND_BBT_CREATE | NAND_BBT_WRITE
+	    | NAND_BBT_2BIT | NAND_BBT_VERSION | NAND_BBT_PERCHIP,
+	.offs = 0,
+	.len = 4,
+	.veroffs = 4,
+	.maxblocks = 4,
+	.pattern = mirror_pattern,
 };
 
 static int __init mxcnd_probe(struct platform_device *pdev)
@@ -877,12 +681,16 @@ static int __init mxcnd_probe(struct platform_device *pdev)
 	struct resource *res;
 	uint16_t tmp;
 	int err = 0, nr_parts = 0;
+	struct nand_ecclayout *oob_smallpage, *oob_largepage;
 
 	/* Allocate memory for MTD device structure and private data */
-	host = kzalloc(sizeof(struct mxc_nand_host), GFP_KERNEL);
+	host = kzalloc(sizeof(struct mxc_nand_host) + NAND_MAX_PAGESIZE +
+			NAND_MAX_OOBSIZE, GFP_KERNEL);
 	if (!host)
 		return -ENOMEM;
 
+	host->data_buf = (uint8_t *)(host + 1);
+
 	host->dev = &pdev->dev;
 	/* structures must be linked */
 	this = &host->nand;
@@ -890,7 +698,7 @@ static int __init mxcnd_probe(struct platform_device *pdev)
 	mtd->priv = this;
 	mtd->owner = THIS_MODULE;
 	mtd->dev.parent = &pdev->dev;
-	mtd->name = "mxc_nand";
+	mtd->name = DRIVER_NAME;
 
 	/* 50 us command delay time */
 	this->chip_delay = 5;
@@ -920,62 +728,93 @@ static int __init mxcnd_probe(struct platform_device *pdev)
 		goto eres;
 	}
 
-	host->regs = ioremap(res->start, res->end - res->start + 1);
-	if (!host->regs) {
+	host->base = ioremap(res->start, resource_size(res));
+	if (!host->base) {
 		err = -ENOMEM;
 		goto eres;
 	}
 
+	host->main_area0 = host->base;
+	host->main_area1 = host->base + 0x200;
+
+	if (nfc_is_v21()) {
+		host->regs = host->base + 0x1000;
+		host->spare0 = host->base + 0x1000;
+		host->spare_len = 64;
+		oob_smallpage = &nandv2_hw_eccoob_smallpage;
+		oob_largepage = &nandv2_hw_eccoob_largepage;
+	} else if (nfc_is_v1()) {
+		host->regs = host->base;
+		host->spare0 = host->base + 0x800;
+		host->spare_len = 16;
+		oob_smallpage = &nandv1_hw_eccoob_smallpage;
+		oob_largepage = &nandv1_hw_eccoob_largepage;
+	} else
+		BUG();
+
+	/* disable interrupt and spare enable */
 	tmp = readw(host->regs + NFC_CONFIG1);
 	tmp |= NFC_INT_MSK;
+	tmp &= ~NFC_SP_EN;
 	writew(tmp, host->regs + NFC_CONFIG1);
 
 	init_waitqueue_head(&host->irq_waitq);
 
 	host->irq = platform_get_irq(pdev, 0);
 
-	err = request_irq(host->irq, mxc_nfc_irq, 0, "mxc_nd", host);
+	err = request_irq(host->irq, mxc_nfc_irq, 0, DRIVER_NAME, host);
 	if (err)
 		goto eirq;
 
+	/* Reset NAND */
+	this->cmdfunc(mtd, NAND_CMD_RESET, -1, -1);
+
+	/* preset operation */
+	/* Unlock the internal RAM Buffer */
+	writew(0x2, host->regs + NFC_CONFIG);
+
+	/* Blocks to be unlocked */
+	if (nfc_is_v21()) {
+		writew(0x0, host->regs + NFC_V21_UNLOCKSTART_BLKADDR);
+	        writew(0xffff, host->regs + NFC_V21_UNLOCKEND_BLKADDR);
+		this->ecc.bytes = 9;
+	} else if (nfc_is_v1()) {
+		writew(0x0, host->regs + NFC_V1_UNLOCKSTART_BLKADDR);
+	        writew(0x4000, host->regs + NFC_V1_UNLOCKEND_BLKADDR);
+		this->ecc.bytes = 3;
+	} else
+		BUG();
+
+	/* Unlock Block Command for given address range */
+	writew(0x4, host->regs + NFC_WRPROT);
+
+	this->ecc.size = 512;
+	this->ecc.layout = oob_smallpage;
+
 	if (pdata->hw_ecc) {
 		this->ecc.calculate = mxc_nand_calculate_ecc;
 		this->ecc.hwctl = mxc_nand_enable_hwecc;
 		this->ecc.correct = mxc_nand_correct_data;
 		this->ecc.mode = NAND_ECC_HW;
-		this->ecc.size = 512;
-		this->ecc.bytes = 3;
 		tmp = readw(host->regs + NFC_CONFIG1);
 		tmp |= NFC_ECC_EN;
 		writew(tmp, host->regs + NFC_CONFIG1);
 	} else {
-		this->ecc.size = 512;
-		this->ecc.bytes = 3;
-		this->ecc.layout = &nand_hw_eccoob_8;
 		this->ecc.mode = NAND_ECC_SOFT;
 		tmp = readw(host->regs + NFC_CONFIG1);
 		tmp &= ~NFC_ECC_EN;
 		writew(tmp, host->regs + NFC_CONFIG1);
 	}
 
-	/* Reset NAND */
-	this->cmdfunc(mtd, NAND_CMD_RESET, -1, -1);
-
-	/* preset operation */
-	/* Unlock the internal RAM Buffer */
-	writew(0x2, host->regs + NFC_CONFIG);
-
-	/* Blocks to be unlocked */
-	writew(0x0, host->regs + NFC_UNLOCKSTART_BLKADDR);
-	writew(0x4000, host->regs + NFC_UNLOCKEND_BLKADDR);
-
-	/* Unlock Block Command for given address range */
-	writew(0x4, host->regs + NFC_WRPROT);
-
 	/* NAND bus width determines access funtions used by upper layer */
-	if (pdata->width == 2) {
+	if (pdata->width == 2)
 		this->options |= NAND_BUSWIDTH_16;
-		this->ecc.layout = &nand_hw_eccoob_16;
+
+	if (pdata->flash_bbt) {
+		this->bbt_td = &bbt_main_descr;
+		this->bbt_md = &bbt_mirror_descr;
+		/* update flash based bbt */
+		this->options |= NAND_USE_FLASH_BBT;
 	}
 
 	/* first scan to find the device and get the page size */
@@ -984,38 +823,8 @@ static int __init mxcnd_probe(struct platform_device *pdev)
 		goto escan;
 	}
 
-	if (mtd->writesize == 2048) {
-		host->pagesize_2k = 1;
-		this->badblock_pattern = &smallpage_memorybased;
-	}
-
-	if (this->ecc.mode == NAND_ECC_HW) {
-		switch (mtd->oobsize) {
-		case 8:
-			this->ecc.layout = &nand_hw_eccoob_8;
-			break;
-		case 16:
-			this->ecc.layout = &nand_hw_eccoob_16;
-			break;
-		case 64:
-			this->ecc.layout = &nand_hw_eccoob_64;
-			break;
-		default:
-			/* page size not handled by HW ECC */
-			/* switching back to soft ECC */
-			this->ecc.size = 512;
-			this->ecc.bytes = 3;
-			this->ecc.layout = &nand_hw_eccoob_8;
-			this->ecc.mode = NAND_ECC_SOFT;
-			this->ecc.calculate = NULL;
-			this->ecc.correct = NULL;
-			this->ecc.hwctl = NULL;
-			tmp = readw(host->regs + NFC_CONFIG1);
-			tmp &= ~NFC_ECC_EN;
-			writew(tmp, host->regs + NFC_CONFIG1);
-			break;
-		}
-	}
+	if (mtd->writesize == 2048)
+		this->ecc.layout = oob_largepage;
 
 	/* second phase scan */
 	if (nand_scan_tail(mtd)) {
@@ -1043,7 +852,7 @@ static int __init mxcnd_probe(struct platform_device *pdev)
 escan:
 	free_irq(host->irq, host);
 eirq:
-	iounmap(host->regs);
+	iounmap(host->base);
 eres:
 	clk_put(host->clk);
 eclk:
@@ -1062,7 +871,7 @@ static int __devexit mxcnd_remove(struct platform_device *pdev)
 
 	nand_release(&host->mtd);
 	free_irq(host->irq, host);
-	iounmap(host->regs);
+	iounmap(host->base);
 	kfree(host);
 
 	return 0;
@@ -1113,7 +922,7 @@ static struct platform_driver mxcnd_driver = {
 	.driver = {
 		   .name = DRIVER_NAME,
 		   },
-	.remove = __exit_p(mxcnd_remove),
+	.remove = __devexit_p(mxcnd_remove),
 	.suspend = mxcnd_suspend,
 	.resume = mxcnd_resume,
 };
diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
index 2957cc70da3d..8f2958fe2148 100644
--- a/drivers/mtd/nand/nand_base.c
+++ b/drivers/mtd/nand/nand_base.c
@@ -428,6 +428,28 @@ static int nand_block_checkbad(struct mtd_info *mtd, loff_t ofs, int getchip,
 	return nand_isbad_bbt(mtd, ofs, allowbbt);
 }
 
+/**
+ * panic_nand_wait_ready - [GENERIC] Wait for the ready pin after commands.
+ * @mtd:	MTD device structure
+ * @timeo:	Timeout
+ *
+ * Helper function for nand_wait_ready used when needing to wait in interrupt
+ * context.
+ */
+static void panic_nand_wait_ready(struct mtd_info *mtd, unsigned long timeo)
+{
+	struct nand_chip *chip = mtd->priv;
+	int i;
+
+	/* Wait for the device to get ready */
+	for (i = 0; i < timeo; i++) {
+		if (chip->dev_ready(mtd))
+			break;
+		touch_softlockup_watchdog();
+		mdelay(1);
+	}
+}
+
 /*
  * Wait for the ready pin, after a command
  * The timeout is catched later.
@@ -437,6 +459,10 @@ void nand_wait_ready(struct mtd_info *mtd)
 	struct nand_chip *chip = mtd->priv;
 	unsigned long timeo = jiffies + 2;
 
+	/* 400ms timeout */
+	if (in_interrupt() || oops_in_progress)
+		return panic_nand_wait_ready(mtd, 400);
+
 	led_trigger_event(nand_led_trigger, LED_FULL);
 	/* wait until command is processed or timeout occures */
 	do {
@@ -672,6 +698,22 @@ static void nand_command_lp(struct mtd_info *mtd, unsigned int command,
 }
 
 /**
+ * panic_nand_get_device - [GENERIC] Get chip for selected access
+ * @chip:	the nand chip descriptor
+ * @mtd:	MTD device structure
+ * @new_state:	the state which is requested
+ *
+ * Used when in panic, no locks are taken.
+ */
+static void panic_nand_get_device(struct nand_chip *chip,
+		      struct mtd_info *mtd, int new_state)
+{
+	/* Hardware controller shared among independend devices */
+	chip->controller->active = chip;
+	chip->state = new_state;
+}
+
+/**
  * nand_get_device - [GENERIC] Get chip for selected access
  * @chip:	the nand chip descriptor
  * @mtd:	MTD device structure
@@ -698,8 +740,14 @@ nand_get_device(struct nand_chip *chip, struct mtd_info *mtd, int new_state)
 		return 0;
 	}
 	if (new_state == FL_PM_SUSPENDED) {
-		spin_unlock(lock);
-		return (chip->state == FL_PM_SUSPENDED) ? 0 : -EAGAIN;
+		if (chip->controller->active->state == FL_PM_SUSPENDED) {
+			chip->state = FL_PM_SUSPENDED;
+			spin_unlock(lock);
+			return 0;
+		} else {
+			spin_unlock(lock);
+			return -EAGAIN;
+		}
 	}
 	set_current_state(TASK_UNINTERRUPTIBLE);
 	add_wait_queue(wq, &wait);
@@ -710,6 +758,32 @@ nand_get_device(struct nand_chip *chip, struct mtd_info *mtd, int new_state)
 }
 
 /**
+ * panic_nand_wait - [GENERIC]  wait until the command is done
+ * @mtd:	MTD device structure
+ * @chip:	NAND chip structure
+ * @timeo:	Timeout
+ *
+ * Wait for command done. This is a helper function for nand_wait used when
+ * we are in interrupt context. May happen when in panic and trying to write
+ * an oops trough mtdoops.
+ */
+static void panic_nand_wait(struct mtd_info *mtd, struct nand_chip *chip,
+			    unsigned long timeo)
+{
+	int i;
+	for (i = 0; i < timeo; i++) {
+		if (chip->dev_ready) {
+			if (chip->dev_ready(mtd))
+				break;
+		} else {
+			if (chip->read_byte(mtd) & NAND_STATUS_READY)
+				break;
+		}
+		mdelay(1);
+        }
+}
+
+/**
  * nand_wait - [DEFAULT]  wait until the command is done
  * @mtd:	MTD device structure
  * @chip:	NAND chip structure
@@ -740,15 +814,19 @@ static int nand_wait(struct mtd_info *mtd, struct nand_chip *chip)
 	else
 		chip->cmdfunc(mtd, NAND_CMD_STATUS, -1, -1);
 
-	while (time_before(jiffies, timeo)) {
-		if (chip->dev_ready) {
-			if (chip->dev_ready(mtd))
-				break;
-		} else {
-			if (chip->read_byte(mtd) & NAND_STATUS_READY)
-				break;
+	if (in_interrupt() || oops_in_progress)
+		panic_nand_wait(mtd, chip, timeo);
+	else {
+		while (time_before(jiffies, timeo)) {
+			if (chip->dev_ready) {
+				if (chip->dev_ready(mtd))
+					break;
+			} else {
+				if (chip->read_byte(mtd) & NAND_STATUS_READY)
+					break;
+			}
+			cond_resched();
 		}
-		cond_resched();
 	}
 	led_trigger_event(nand_led_trigger, LED_OFF);
 
@@ -1949,6 +2027,45 @@ static int nand_do_write_ops(struct mtd_info *mtd, loff_t to,
 }
 
 /**
+ * panic_nand_write - [MTD Interface] NAND write with ECC
+ * @mtd:	MTD device structure
+ * @to:		offset to write to
+ * @len:	number of bytes to write
+ * @retlen:	pointer to variable to store the number of written bytes
+ * @buf:	the data to write
+ *
+ * NAND write with ECC. Used when performing writes in interrupt context, this
+ * may for example be called by mtdoops when writing an oops while in panic.
+ */
+static int panic_nand_write(struct mtd_info *mtd, loff_t to, size_t len,
+			    size_t *retlen, const uint8_t *buf)
+{
+	struct nand_chip *chip = mtd->priv;
+	int ret;
+
+	/* Do not allow reads past end of device */
+	if ((to + len) > mtd->size)
+		return -EINVAL;
+	if (!len)
+		return 0;
+
+	/* Wait for the device to get ready.  */
+	panic_nand_wait(mtd, chip, 400);
+
+	/* Grab the device.  */
+	panic_nand_get_device(chip, mtd, FL_WRITING);
+
+	chip->ops.len = len;
+	chip->ops.datbuf = (uint8_t *)buf;
+	chip->ops.oobbuf = NULL;
+
+	ret = nand_do_write_ops(mtd, to, &chip->ops);
+
+	*retlen = chip->ops.retlen;
+	return ret;
+}
+
+/**
  * nand_write - [MTD Interface] NAND write with ECC
  * @mtd:	MTD device structure
  * @to:		offset to write to
@@ -2645,7 +2762,8 @@ int nand_scan_ident(struct mtd_info *mtd, int maxchips)
 	type = nand_get_flash_type(mtd, chip, busw, &nand_maf_id);
 
 	if (IS_ERR(type)) {
-		printk(KERN_WARNING "No NAND device found!!!\n");
+		if (!(chip->options & NAND_SCAN_SILENT_NODEV))
+			printk(KERN_WARNING "No NAND device found.\n");
 		chip->select_chip(mtd, -1);
 		return PTR_ERR(type);
 	}
@@ -2877,6 +2995,7 @@ int nand_scan_tail(struct mtd_info *mtd)
 	mtd->unpoint = NULL;
 	mtd->read = nand_read;
 	mtd->write = nand_write;
+	mtd->panic_write = panic_nand_write;
 	mtd->read_oob = nand_read_oob;
 	mtd->write_oob = nand_write_oob;
 	mtd->sync = nand_sync;
diff --git a/drivers/mtd/nand/nand_bcm_umi.c b/drivers/mtd/nand/nand_bcm_umi.c
new file mode 100644
index 000000000000..46a6bc9c4b74
--- /dev/null
+++ b/drivers/mtd/nand/nand_bcm_umi.c
@@ -0,0 +1,149 @@
+/*****************************************************************************
+* Copyright 2004 - 2009 Broadcom Corporation.  All rights reserved.
+*
+* Unless you and Broadcom execute a separate written software license
+* agreement governing use of this software, this software is licensed to you
+* under the terms of the GNU General Public License version 2, available at
+* http://www.broadcom.com/licenses/GPLv2.php (the "GPL").
+*
+* Notwithstanding the above, under no circumstances may you combine this
+* software in any way with any other Broadcom software provided under a
+* license other than the GPL, without Broadcom's express prior written
+* consent.
+*****************************************************************************/
+
+/* ---- Include Files ---------------------------------------------------- */
+#include <mach/reg_umi.h>
+#include "nand_bcm_umi.h"
+#ifdef BOOT0_BUILD
+#include <uart.h>
+#endif
+
+/* ---- External Variable Declarations ----------------------------------- */
+/* ---- External Function Prototypes ------------------------------------- */
+/* ---- Public Variables ------------------------------------------------- */
+/* ---- Private Constants and Types -------------------------------------- */
+/* ---- Private Function Prototypes -------------------------------------- */
+/* ---- Private Variables ------------------------------------------------ */
+/* ---- Private Functions ------------------------------------------------ */
+
+#if NAND_ECC_BCH
+/****************************************************************************
+*  nand_bch_ecc_flip_bit - Routine to flip an errored bit
+*
+*  PURPOSE:
+*     This is a helper routine that flips the bit (0 -> 1 or 1 -> 0) of the
+*     errored bit specified
+*
+*  PARAMETERS:
+*     datap - Container that holds the 512 byte data
+*     errorLocation - Location of the bit that needs to be flipped
+*
+*  RETURNS:
+*     None
+****************************************************************************/
+static void nand_bcm_umi_bch_ecc_flip_bit(uint8_t *datap, int errorLocation)
+{
+	int locWithinAByte = (errorLocation & REG_UMI_BCH_ERR_LOC_BYTE) >> 0;
+	int locWithinAWord = (errorLocation & REG_UMI_BCH_ERR_LOC_WORD) >> 3;
+	int locWithinAPage = (errorLocation & REG_UMI_BCH_ERR_LOC_PAGE) >> 5;
+
+	uint8_t errorByte = 0;
+	uint8_t byteMask = 1 << locWithinAByte;
+
+	/* BCH uses big endian, need to change the location
+	 * bits to little endian */
+	locWithinAWord = 3 - locWithinAWord;
+
+	errorByte = datap[locWithinAPage * sizeof(uint32_t) + locWithinAWord];
+
+#ifdef BOOT0_BUILD
+	puthexs("\nECC Correct Offset: ",
+		locWithinAPage * sizeof(uint32_t) + locWithinAWord);
+	puthexs(" errorByte:", errorByte);
+	puthex8(" Bit: ", locWithinAByte);
+#endif
+
+	if (errorByte & byteMask) {
+		/* bit needs to be cleared */
+		errorByte &= ~byteMask;
+	} else {
+		/* bit needs to be set */
+		errorByte |= byteMask;
+	}
+
+	/* write back the value with the fixed bit */
+	datap[locWithinAPage * sizeof(uint32_t) + locWithinAWord] = errorByte;
+}
+
+/****************************************************************************
+*  nand_correct_page_bch - Routine to correct bit errors when reading NAND
+*
+*  PURPOSE:
+*     This routine reads the BCH registers to determine if there are any bit
+*     errors during the read of the last 512 bytes of data + ECC bytes.  If
+*     errors exists, the routine fixes it.
+*
+*  PARAMETERS:
+*     datap - Container that holds the 512 byte data
+*
+*  RETURNS:
+*     0 or greater = Number of errors corrected
+*                    (No errors are found or errors have been fixed)
+*    -1 = Error(s) cannot be fixed
+****************************************************************************/
+int nand_bcm_umi_bch_correct_page(uint8_t *datap, uint8_t *readEccData,
+				  int numEccBytes)
+{
+	int numErrors;
+	int errorLocation;
+	int idx;
+	uint32_t regValue;
+
+	/* wait for read ECC to be valid */
+	regValue = nand_bcm_umi_bch_poll_read_ecc_calc();
+
+	/*
+	 * read the control status register to determine if there
+	 * are error'ed bits
+	 * see if errors are correctible
+	 */
+	if ((regValue & REG_UMI_BCH_CTRL_STATUS_UNCORR_ERR) > 0) {
+		int i;
+
+		for (i = 0; i < numEccBytes; i++) {
+			if (readEccData[i] != 0xff) {
+				/* errors cannot be fixed, return -1 */
+				return -1;
+			}
+		}
+		/* If ECC is unprogrammed then we can't correct,
+		 * assume everything OK */
+		return 0;
+	}
+
+	if ((regValue & REG_UMI_BCH_CTRL_STATUS_CORR_ERR) == 0) {
+		/* no errors */
+		return 0;
+	}
+
+	/*
+	 * Fix errored bits by doing the following:
+	 * 1. Read the number of errors in the control and status register
+	 * 2. Read the error location registers that corresponds to the number
+	 *    of errors reported
+	 * 3. Invert the bit in the data
+	 */
+	numErrors = (regValue & REG_UMI_BCH_CTRL_STATUS_NB_CORR_ERROR) >> 20;
+
+	for (idx = 0; idx < numErrors; idx++) {
+		errorLocation =
+		    REG_UMI_BCH_ERR_LOC_ADDR(idx) & REG_UMI_BCH_ERR_LOC_MASK;
+
+		/* Flip bit */
+		nand_bcm_umi_bch_ecc_flip_bit(datap, errorLocation);
+	}
+	/* Errors corrected */
+	return numErrors;
+}
+#endif
diff --git a/drivers/mtd/nand/nand_bcm_umi.h b/drivers/mtd/nand/nand_bcm_umi.h
new file mode 100644
index 000000000000..7cec2cd97854
--- /dev/null
+++ b/drivers/mtd/nand/nand_bcm_umi.h
@@ -0,0 +1,358 @@
+/*****************************************************************************
+* Copyright 2003 - 2009 Broadcom Corporation.  All rights reserved.
+*
+* Unless you and Broadcom execute a separate written software license
+* agreement governing use of this software, this software is licensed to you
+* under the terms of the GNU General Public License version 2, available at
+* http://www.broadcom.com/licenses/GPLv2.php (the "GPL").
+*
+* Notwithstanding the above, under no circumstances may you combine this
+* software in any way with any other Broadcom software provided under a
+* license other than the GPL, without Broadcom's express prior written
+* consent.
+*****************************************************************************/
+#ifndef NAND_BCM_UMI_H
+#define NAND_BCM_UMI_H
+
+/* ---- Include Files ---------------------------------------------------- */
+#include <mach/reg_umi.h>
+#include <mach/reg_nand.h>
+#include <cfg_global.h>
+
+/* ---- Constants and Types ---------------------------------------------- */
+#if (CFG_GLOBAL_CHIP_FAMILY == CFG_GLOBAL_CHIP_FAMILY_BCMRING)
+#define NAND_ECC_BCH (CFG_GLOBAL_CHIP_REV > 0xA0)
+#else
+#define NAND_ECC_BCH 0
+#endif
+
+#define CFG_GLOBAL_NAND_ECC_BCH_NUM_BYTES	13
+
+#if NAND_ECC_BCH
+#ifdef BOOT0_BUILD
+#define NAND_ECC_NUM_BYTES 13
+#else
+#define NAND_ECC_NUM_BYTES CFG_GLOBAL_NAND_ECC_BCH_NUM_BYTES
+#endif
+#else
+#define NAND_ECC_NUM_BYTES 3
+#endif
+
+#define NAND_DATA_ACCESS_SIZE 512
+
+/* ---- Variable Externs ------------------------------------------ */
+/* ---- Function Prototypes --------------------------------------- */
+int nand_bcm_umi_bch_correct_page(uint8_t *datap, uint8_t *readEccData,
+				  int numEccBytes);
+
+/* Check in device is ready */
+static inline int nand_bcm_umi_dev_ready(void)
+{
+	return REG_UMI_NAND_RCSR & REG_UMI_NAND_RCSR_RDY;
+}
+
+/* Wait until device is ready */
+static inline void nand_bcm_umi_wait_till_ready(void)
+{
+	while (nand_bcm_umi_dev_ready() == 0)
+		;
+}
+
+/* Enable Hamming ECC */
+static inline void nand_bcm_umi_hamming_enable_hwecc(void)
+{
+	/* disable and reset ECC, 512 byte page */
+	REG_UMI_NAND_ECC_CSR &= ~(REG_UMI_NAND_ECC_CSR_ECC_ENABLE |
+		REG_UMI_NAND_ECC_CSR_256BYTE);
+	/* enable ECC */
+	REG_UMI_NAND_ECC_CSR |= REG_UMI_NAND_ECC_CSR_ECC_ENABLE;
+}
+
+#if NAND_ECC_BCH
+/* BCH ECC specifics */
+#define ECC_BITS_PER_CORRECTABLE_BIT 13
+
+/* Enable BCH Read ECC */
+static inline void nand_bcm_umi_bch_enable_read_hwecc(void)
+{
+	/* disable and reset ECC */
+	REG_UMI_BCH_CTRL_STATUS = REG_UMI_BCH_CTRL_STATUS_RD_ECC_VALID;
+	/* Turn on ECC */
+	REG_UMI_BCH_CTRL_STATUS = REG_UMI_BCH_CTRL_STATUS_ECC_RD_EN;
+}
+
+/* Enable BCH Write ECC */
+static inline void nand_bcm_umi_bch_enable_write_hwecc(void)
+{
+	/* disable and reset ECC */
+	REG_UMI_BCH_CTRL_STATUS = REG_UMI_BCH_CTRL_STATUS_WR_ECC_VALID;
+	/* Turn on ECC */
+	REG_UMI_BCH_CTRL_STATUS = REG_UMI_BCH_CTRL_STATUS_ECC_WR_EN;
+}
+
+/* Config number of BCH ECC bytes */
+static inline void nand_bcm_umi_bch_config_ecc(uint8_t numEccBytes)
+{
+	uint32_t nValue;
+	uint32_t tValue;
+	uint32_t kValue;
+	uint32_t numBits = numEccBytes * 8;
+
+	/* disable and reset ECC */
+	REG_UMI_BCH_CTRL_STATUS =
+	    REG_UMI_BCH_CTRL_STATUS_WR_ECC_VALID |
+	    REG_UMI_BCH_CTRL_STATUS_RD_ECC_VALID;
+
+	/* Every correctible bit requires 13 ECC bits */
+	tValue = (uint32_t) (numBits / ECC_BITS_PER_CORRECTABLE_BIT);
+
+	/* Total data in number of bits for generating and computing BCH ECC */
+	nValue = (NAND_DATA_ACCESS_SIZE + numEccBytes) * 8;
+
+	/* K parameter is used internally.  K = N - (T * 13) */
+	kValue = nValue - (tValue * ECC_BITS_PER_CORRECTABLE_BIT);
+
+	/* Write the settings */
+	REG_UMI_BCH_N = nValue;
+	REG_UMI_BCH_T = tValue;
+	REG_UMI_BCH_K = kValue;
+}
+
+/* Pause during ECC read calculation to skip bytes in OOB */
+static inline void nand_bcm_umi_bch_pause_read_ecc_calc(void)
+{
+	REG_UMI_BCH_CTRL_STATUS =
+	    REG_UMI_BCH_CTRL_STATUS_ECC_RD_EN |
+	    REG_UMI_BCH_CTRL_STATUS_PAUSE_ECC_DEC;
+}
+
+/* Resume during ECC read calculation after skipping bytes in OOB */
+static inline void nand_bcm_umi_bch_resume_read_ecc_calc(void)
+{
+	REG_UMI_BCH_CTRL_STATUS = REG_UMI_BCH_CTRL_STATUS_ECC_RD_EN;
+}
+
+/* Poll read ECC calc to check when hardware completes */
+static inline uint32_t nand_bcm_umi_bch_poll_read_ecc_calc(void)
+{
+	uint32_t regVal;
+
+	do {
+		/* wait for ECC to be valid */
+		regVal = REG_UMI_BCH_CTRL_STATUS;
+	} while ((regVal & REG_UMI_BCH_CTRL_STATUS_RD_ECC_VALID) == 0);
+
+	return regVal;
+}
+
+/* Poll write ECC calc to check when hardware completes */
+static inline void nand_bcm_umi_bch_poll_write_ecc_calc(void)
+{
+	/* wait for ECC to be valid */
+	while ((REG_UMI_BCH_CTRL_STATUS & REG_UMI_BCH_CTRL_STATUS_WR_ECC_VALID)
+	       == 0)
+		;
+}
+
+/* Read the OOB and ECC, for kernel write OOB to a buffer */
+#if defined(__KERNEL__) && !defined(STANDALONE)
+static inline void nand_bcm_umi_bch_read_oobEcc(uint32_t pageSize,
+	uint8_t *eccCalc, int numEccBytes, uint8_t *oobp)
+#else
+static inline void nand_bcm_umi_bch_read_oobEcc(uint32_t pageSize,
+	uint8_t *eccCalc, int numEccBytes)
+#endif
+{
+	int eccPos = 0;
+	int numToRead = 16;	/* There are 16 bytes per sector in the OOB */
+
+	/* ECC is already paused when this function is called */
+
+	if (pageSize == NAND_DATA_ACCESS_SIZE) {
+		while (numToRead > numEccBytes) {
+			/* skip free oob region */
+#if defined(__KERNEL__) && !defined(STANDALONE)
+			*oobp++ = REG_NAND_DATA8;
+#else
+			REG_NAND_DATA8;
+#endif
+			numToRead--;
+		}
+
+		/* read ECC bytes before BI */
+		nand_bcm_umi_bch_resume_read_ecc_calc();
+
+		while (numToRead > 11) {
+#if defined(__KERNEL__) && !defined(STANDALONE)
+			*oobp = REG_NAND_DATA8;
+			eccCalc[eccPos++] = *oobp;
+			oobp++;
+#else
+			eccCalc[eccPos++] = REG_NAND_DATA8;
+#endif
+		}
+
+		nand_bcm_umi_bch_pause_read_ecc_calc();
+
+		if (numToRead == 11) {
+			/* read BI */
+#if defined(__KERNEL__) && !defined(STANDALONE)
+			*oobp++ = REG_NAND_DATA8;
+#else
+			REG_NAND_DATA8;
+#endif
+			numToRead--;
+		}
+
+		/* read ECC bytes */
+		nand_bcm_umi_bch_resume_read_ecc_calc();
+		while (numToRead) {
+#if defined(__KERNEL__) && !defined(STANDALONE)
+			*oobp = REG_NAND_DATA8;
+			eccCalc[eccPos++] = *oobp;
+			oobp++;
+#else
+			eccCalc[eccPos++] = REG_NAND_DATA8;
+#endif
+			numToRead--;
+		}
+	} else {
+		/* skip BI */
+#if defined(__KERNEL__) && !defined(STANDALONE)
+		*oobp++ = REG_NAND_DATA8;
+#else
+		REG_NAND_DATA8;
+#endif
+		numToRead--;
+
+		while (numToRead > numEccBytes) {
+			/* skip free oob region */
+#if defined(__KERNEL__) && !defined(STANDALONE)
+			*oobp++ = REG_NAND_DATA8;
+#else
+			REG_NAND_DATA8;
+#endif
+			numToRead--;
+		}
+
+		/* read ECC bytes */
+		nand_bcm_umi_bch_resume_read_ecc_calc();
+		while (numToRead) {
+#if defined(__KERNEL__) && !defined(STANDALONE)
+			*oobp = REG_NAND_DATA8;
+			eccCalc[eccPos++] = *oobp;
+			oobp++;
+#else
+			eccCalc[eccPos++] = REG_NAND_DATA8;
+#endif
+			numToRead--;
+		}
+	}
+}
+
+/* Helper function to write ECC */
+static inline void NAND_BCM_UMI_ECC_WRITE(int numEccBytes, int eccBytePos,
+					  uint8_t *oobp, uint8_t eccVal)
+{
+	if (eccBytePos <= numEccBytes)
+		*oobp = eccVal;
+}
+
+/* Write OOB with ECC */
+static inline void nand_bcm_umi_bch_write_oobEcc(uint32_t pageSize,
+						 uint8_t *oobp, int numEccBytes)
+{
+	uint32_t eccVal = 0xffffffff;
+
+	/* wait for write ECC to be valid */
+	nand_bcm_umi_bch_poll_write_ecc_calc();
+
+	/*
+	 ** Get the hardware ecc from the 32-bit result registers.
+	 ** Read after 512 byte accesses. Format B3B2B1B0
+	 ** where B3 = ecc3, etc.
+	 */
+
+	if (pageSize == NAND_DATA_ACCESS_SIZE) {
+		/* Now fill in the ECC bytes */
+		if (numEccBytes >= 13)
+			eccVal = REG_UMI_BCH_WR_ECC_3;
+
+		/* Usually we skip CM in oob[0,1] */
+		NAND_BCM_UMI_ECC_WRITE(numEccBytes, 15, &oobp[0],
+			(eccVal >> 16) & 0xff);
+		NAND_BCM_UMI_ECC_WRITE(numEccBytes, 14, &oobp[1],
+			(eccVal >> 8) & 0xff);
+
+		/* Write ECC in oob[2,3,4] */
+		NAND_BCM_UMI_ECC_WRITE(numEccBytes, 13, &oobp[2],
+			eccVal & 0xff);	/* ECC 12 */
+
+		if (numEccBytes >= 9)
+			eccVal = REG_UMI_BCH_WR_ECC_2;
+
+		NAND_BCM_UMI_ECC_WRITE(numEccBytes, 12, &oobp[3],
+			(eccVal >> 24) & 0xff);	/* ECC11 */
+		NAND_BCM_UMI_ECC_WRITE(numEccBytes, 11, &oobp[4],
+			(eccVal >> 16) & 0xff);	/* ECC10 */
+
+		/* Always Skip BI in oob[5] */
+	} else {
+		/* Always Skip BI in oob[0] */
+
+		/* Now fill in the ECC bytes */
+		if (numEccBytes >= 13)
+			eccVal = REG_UMI_BCH_WR_ECC_3;
+
+		/* Usually skip CM in oob[1,2] */
+		NAND_BCM_UMI_ECC_WRITE(numEccBytes, 15, &oobp[1],
+			(eccVal >> 16) & 0xff);
+		NAND_BCM_UMI_ECC_WRITE(numEccBytes, 14, &oobp[2],
+			(eccVal >> 8) & 0xff);
+
+		/* Write ECC in oob[3-15] */
+		NAND_BCM_UMI_ECC_WRITE(numEccBytes, 13, &oobp[3],
+			eccVal & 0xff);	/* ECC12 */
+
+		if (numEccBytes >= 9)
+			eccVal = REG_UMI_BCH_WR_ECC_2;
+
+		NAND_BCM_UMI_ECC_WRITE(numEccBytes, 12, &oobp[4],
+			(eccVal >> 24) & 0xff);	/* ECC11 */
+		NAND_BCM_UMI_ECC_WRITE(numEccBytes, 11, &oobp[5],
+			(eccVal >> 16) & 0xff);	/* ECC10 */
+	}
+
+	/* Fill in the remainder of ECC locations */
+	NAND_BCM_UMI_ECC_WRITE(numEccBytes, 10, &oobp[6],
+		(eccVal >> 8) & 0xff);	/* ECC9 */
+	NAND_BCM_UMI_ECC_WRITE(numEccBytes, 9, &oobp[7],
+		eccVal & 0xff);	/* ECC8 */
+
+	if (numEccBytes >= 5)
+		eccVal = REG_UMI_BCH_WR_ECC_1;
+
+	NAND_BCM_UMI_ECC_WRITE(numEccBytes, 8, &oobp[8],
+		(eccVal >> 24) & 0xff);	/* ECC7 */
+	NAND_BCM_UMI_ECC_WRITE(numEccBytes, 7, &oobp[9],
+		(eccVal >> 16) & 0xff);	/* ECC6 */
+	NAND_BCM_UMI_ECC_WRITE(numEccBytes, 6, &oobp[10],
+		(eccVal >> 8) & 0xff);	/* ECC5 */
+	NAND_BCM_UMI_ECC_WRITE(numEccBytes, 5, &oobp[11],
+		eccVal & 0xff);	/* ECC4 */
+
+	if (numEccBytes >= 1)
+		eccVal = REG_UMI_BCH_WR_ECC_0;
+
+	NAND_BCM_UMI_ECC_WRITE(numEccBytes, 4, &oobp[12],
+		(eccVal >> 24) & 0xff);	/* ECC3 */
+	NAND_BCM_UMI_ECC_WRITE(numEccBytes, 3, &oobp[13],
+		(eccVal >> 16) & 0xff);	/* ECC2 */
+	NAND_BCM_UMI_ECC_WRITE(numEccBytes, 2, &oobp[14],
+		(eccVal >> 8) & 0xff);	/* ECC1 */
+	NAND_BCM_UMI_ECC_WRITE(numEccBytes, 1, &oobp[15],
+		eccVal & 0xff);	/* ECC0 */
+}
+#endif
+
+#endif /* NAND_BCM_UMI_H */
diff --git a/drivers/mtd/nand/nand_ecc.c b/drivers/mtd/nand/nand_ecc.c
index db7ae9d6a296..271b8e735e8f 100644
--- a/drivers/mtd/nand/nand_ecc.c
+++ b/drivers/mtd/nand/nand_ecc.c
@@ -150,20 +150,19 @@ static const char addressbits[256] = {
 };
 
 /**
- * nand_calculate_ecc - [NAND Interface] Calculate 3-byte ECC for 256/512-byte
+ * __nand_calculate_ecc - [NAND Interface] Calculate 3-byte ECC for 256/512-byte
  *			 block
- * @mtd:	MTD block structure
  * @buf:	input buffer with raw data
+ * @eccsize:	data bytes per ecc step (256 or 512)
  * @code:	output buffer with ECC
  */
-int nand_calculate_ecc(struct mtd_info *mtd, const unsigned char *buf,
+void __nand_calculate_ecc(const unsigned char *buf, unsigned int eccsize,
 		       unsigned char *code)
 {
 	int i;
 	const uint32_t *bp = (uint32_t *)buf;
 	/* 256 or 512 bytes/ecc  */
-	const uint32_t eccsize_mult =
-			(((struct nand_chip *)mtd->priv)->ecc.size) >> 8;
+	const uint32_t eccsize_mult = eccsize >> 8;
 	uint32_t cur;		/* current value in buffer */
 	/* rp0..rp15..rp17 are the various accumulated parities (per byte) */
 	uint32_t rp0, rp1, rp2, rp3, rp4, rp5, rp6, rp7;
@@ -412,6 +411,22 @@ int nand_calculate_ecc(struct mtd_info *mtd, const unsigned char *buf,
 		    (invparity[par & 0x55] << 2) |
 		    (invparity[rp17] << 1) |
 		    (invparity[rp16] << 0);
+}
+EXPORT_SYMBOL(__nand_calculate_ecc);
+
+/**
+ * nand_calculate_ecc - [NAND Interface] Calculate 3-byte ECC for 256/512-byte
+ *			 block
+ * @mtd:	MTD block structure
+ * @buf:	input buffer with raw data
+ * @code:	output buffer with ECC
+ */
+int nand_calculate_ecc(struct mtd_info *mtd, const unsigned char *buf,
+		       unsigned char *code)
+{
+	__nand_calculate_ecc(buf,
+			((struct nand_chip *)mtd->priv)->ecc.size, code);
+
 	return 0;
 }
 EXPORT_SYMBOL(nand_calculate_ecc);
@@ -475,7 +490,7 @@ int __nand_correct_data(unsigned char *buf,
 		 *
 		 * The b2 shift is there to get rid of the lowest two bits.
 		 * We could also do addressbits[b2] >> 1 but for the
-		 * performace it does not make any difference
+		 * performance it does not make any difference
 		 */
 		if (eccsize_mult == 1)
 			byte_addr = (addressbits[b1] << 4) + addressbits[b0];
diff --git a/drivers/mtd/nand/nandsim.c b/drivers/mtd/nand/nandsim.c
index cd0711b83ac4..7281000fef2d 100644
--- a/drivers/mtd/nand/nandsim.c
+++ b/drivers/mtd/nand/nandsim.c
@@ -161,7 +161,7 @@ MODULE_PARM_DESC(overridesize,   "Specifies the NAND Flash size overriding the I
 MODULE_PARM_DESC(cache_file,     "File to use to cache nand pages instead of memory");
 
 /* The largest possible page size */
-#define NS_LARGEST_PAGE_SIZE	2048
+#define NS_LARGEST_PAGE_SIZE	4096
 
 /* The prefix for simulator output */
 #define NS_OUTPUT_PREFIX "[nandsim]"
@@ -259,7 +259,8 @@ MODULE_PARM_DESC(cache_file,     "File to use to cache nand pages instead of mem
 #define OPT_SMARTMEDIA   0x00000010 /* SmartMedia technology chips */
 #define OPT_AUTOINCR     0x00000020 /* page number auto inctimentation is possible */
 #define OPT_PAGE512_8BIT 0x00000040 /* 512-byte page chips with 8-bit bus width */
-#define OPT_LARGEPAGE    (OPT_PAGE2048) /* 2048-byte page chips */
+#define OPT_PAGE4096     0x00000080 /* 4096-byte page chips */
+#define OPT_LARGEPAGE    (OPT_PAGE2048 | OPT_PAGE4096) /* 2048 & 4096-byte page chips */
 #define OPT_SMALLPAGE    (OPT_PAGE256  | OPT_PAGE512)  /* 256 and 512-byte page chips */
 
 /* Remove action bits ftom state */
@@ -588,6 +589,8 @@ static int init_nandsim(struct mtd_info *mtd)
 			ns->options |= OPT_PAGE512_8BIT;
 	} else if (ns->geom.pgsz == 2048) {
 		ns->options |= OPT_PAGE2048;
+	} else if (ns->geom.pgsz == 4096) {
+		ns->options |= OPT_PAGE4096;
 	} else {
 		NS_ERR("init_nandsim: unknown page size %u\n", ns->geom.pgsz);
 		return -EIO;
diff --git a/drivers/mtd/nand/nomadik_nand.c b/drivers/mtd/nand/nomadik_nand.c
index 7c302d55910e..66123419f65d 100644
--- a/drivers/mtd/nand/nomadik_nand.c
+++ b/drivers/mtd/nand/nomadik_nand.c
@@ -216,7 +216,7 @@ static int nomadik_nand_resume(struct device *dev)
 	return 0;
 }
 
-static struct dev_pm_ops nomadik_nand_pm_ops = {
+static const struct dev_pm_ops nomadik_nand_pm_ops = {
 	.suspend = nomadik_nand_suspend,
 	.resume = nomadik_nand_resume,
 };
diff --git a/drivers/mtd/nand/plat_nand.c b/drivers/mtd/nand/plat_nand.c
index 4e16c6f5bdd5..8d467315f02b 100644
--- a/drivers/mtd/nand/plat_nand.c
+++ b/drivers/mtd/nand/plat_nand.c
@@ -34,7 +34,12 @@ static int __devinit plat_nand_probe(struct platform_device *pdev)
 {
 	struct platform_nand_data *pdata = pdev->dev.platform_data;
 	struct plat_nand_data *data;
-	int res = 0;
+	struct resource *res;
+	int err = 0;
+
+	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	if (!res)
+		return -ENXIO;
 
 	/* Allocate memory for the device structure (and zero it) */
 	data = kzalloc(sizeof(struct plat_nand_data), GFP_KERNEL);
@@ -43,12 +48,18 @@ static int __devinit plat_nand_probe(struct platform_device *pdev)
 		return -ENOMEM;
 	}
 
-	data->io_base = ioremap(pdev->resource[0].start,
-				pdev->resource[0].end - pdev->resource[0].start + 1);
+	if (!request_mem_region(res->start, resource_size(res),
+				dev_name(&pdev->dev))) {
+		dev_err(&pdev->dev, "request_mem_region failed\n");
+		err = -EBUSY;
+		goto out_free;
+	}
+
+	data->io_base = ioremap(res->start, resource_size(res));
 	if (data->io_base == NULL) {
 		dev_err(&pdev->dev, "ioremap failed\n");
-		kfree(data);
-		return -EIO;
+		err = -EIO;
+		goto out_release_io;
 	}
 
 	data->chip.priv = &data;
@@ -74,24 +85,24 @@ static int __devinit plat_nand_probe(struct platform_device *pdev)
 
 	/* Handle any platform specific setup */
 	if (pdata->ctrl.probe) {
-		res = pdata->ctrl.probe(pdev);
-		if (res)
+		err = pdata->ctrl.probe(pdev);
+		if (err)
 			goto out;
 	}
 
 	/* Scan to find existance of the device */
 	if (nand_scan(&data->mtd, 1)) {
-		res = -ENXIO;
+		err = -ENXIO;
 		goto out;
 	}
 
 #ifdef CONFIG_MTD_PARTITIONS
 	if (pdata->chip.part_probe_types) {
-		res = parse_mtd_partitions(&data->mtd,
+		err = parse_mtd_partitions(&data->mtd,
 					pdata->chip.part_probe_types,
 					&data->parts, 0);
-		if (res > 0) {
-			add_mtd_partitions(&data->mtd, data->parts, res);
+		if (err > 0) {
+			add_mtd_partitions(&data->mtd, data->parts, err);
 			return 0;
 		}
 	}
@@ -99,14 +110,14 @@ static int __devinit plat_nand_probe(struct platform_device *pdev)
 		pdata->chip.set_parts(data->mtd.size, &pdata->chip);
 	if (pdata->chip.partitions) {
 		data->parts = pdata->chip.partitions;
-		res = add_mtd_partitions(&data->mtd, data->parts,
+		err = add_mtd_partitions(&data->mtd, data->parts,
 			pdata->chip.nr_partitions);
 	} else
 #endif
-	res = add_mtd_device(&data->mtd);
+	err = add_mtd_device(&data->mtd);
 
-	if (!res)
-		return res;
+	if (!err)
+		return err;
 
 	nand_release(&data->mtd);
 out:
@@ -114,8 +125,11 @@ out:
 		pdata->ctrl.remove(pdev);
 	platform_set_drvdata(pdev, NULL);
 	iounmap(data->io_base);
+out_release_io:
+	release_mem_region(res->start, resource_size(res));
+out_free:
 	kfree(data);
-	return res;
+	return err;
 }
 
 /*
@@ -125,6 +139,9 @@ static int __devexit plat_nand_remove(struct platform_device *pdev)
 {
 	struct plat_nand_data *data = platform_get_drvdata(pdev);
 	struct platform_nand_data *pdata = pdev->dev.platform_data;
+	struct resource *res;
+
+	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 
 	nand_release(&data->mtd);
 #ifdef CONFIG_MTD_PARTITIONS
@@ -134,6 +151,7 @@ static int __devexit plat_nand_remove(struct platform_device *pdev)
 	if (pdata->ctrl.remove)
 		pdata->ctrl.remove(pdev);
 	iounmap(data->io_base);
+	release_mem_region(res->start, resource_size(res));
 	kfree(data);
 
 	return 0;
diff --git a/drivers/mtd/nand/s3c2410.c b/drivers/mtd/nand/s3c2410.c
index 11dc7e69c4fb..fa6e9c7fe511 100644
--- a/drivers/mtd/nand/s3c2410.c
+++ b/drivers/mtd/nand/s3c2410.c
@@ -774,7 +774,7 @@ static void s3c2410_nand_init_chip(struct s3c2410_nand_info *info,
 	chip->select_chip  = s3c2410_nand_select_chip;
 	chip->chip_delay   = 50;
 	chip->priv	   = nmtd;
-	chip->options	   = 0;
+	chip->options	   = set->options;
 	chip->controller   = &info->controller;
 
 	switch (info->cpu_type) {
@@ -875,7 +875,7 @@ static void s3c2410_nand_init_chip(struct s3c2410_nand_info *info,
  * @info: The controller instance.
  * @nmtd: The driver version of the MTD instance.
  *
- * This routine is called after the chip probe has succesfully completed
+ * This routine is called after the chip probe has successfully completed
  * and the relevant per-chip information updated. This call ensure that
  * we update the internal state accordingly.
  *
diff --git a/drivers/mtd/nand/txx9ndfmc.c b/drivers/mtd/nand/txx9ndfmc.c
index 73af8324d0d0..863513c3b69a 100644
--- a/drivers/mtd/nand/txx9ndfmc.c
+++ b/drivers/mtd/nand/txx9ndfmc.c
@@ -429,11 +429,10 @@ static int __exit txx9ndfmc_remove(struct platform_device *dev)
 		chip = mtd->priv;
 		txx9_priv = chip->priv;
 
+		nand_release(mtd);
 #ifdef CONFIG_MTD_PARTITIONS
-		del_mtd_partitions(mtd);
 		kfree(drvdata->parts[i]);
 #endif
-		del_mtd_device(mtd);
 		kfree(txx9_priv->mtdname);
 		kfree(txx9_priv);
 	}
diff --git a/drivers/mtd/onenand/Kconfig b/drivers/mtd/onenand/Kconfig
index a38f580c2bb3..3a9f15784600 100644
--- a/drivers/mtd/onenand/Kconfig
+++ b/drivers/mtd/onenand/Kconfig
@@ -1,7 +1,3 @@
-#
-# linux/drivers/mtd/onenand/Kconfig
-#
-
 menuconfig MTD_ONENAND
 	tristate "OneNAND Device Support"
 	depends on MTD
diff --git a/drivers/mtd/onenand/omap2.c b/drivers/mtd/onenand/omap2.c
index 86c4f6dcdc65..75f38b95811e 100644
--- a/drivers/mtd/onenand/omap2.c
+++ b/drivers/mtd/onenand/omap2.c
@@ -112,10 +112,24 @@ static int omap2_onenand_wait(struct mtd_info *mtd, int state)
 	unsigned long timeout;
 	u32 syscfg;
 
-	if (state == FL_RESETING) {
-		int i;
+	if (state == FL_RESETING || state == FL_PREPARING_ERASE ||
+	    state == FL_VERIFYING_ERASE) {
+		int i = 21;
+		unsigned int intr_flags = ONENAND_INT_MASTER;
+
+		switch (state) {
+		case FL_RESETING:
+			intr_flags |= ONENAND_INT_RESET;
+			break;
+		case FL_PREPARING_ERASE:
+			intr_flags |= ONENAND_INT_ERASE;
+			break;
+		case FL_VERIFYING_ERASE:
+			i = 101;
+			break;
+		}
 
-		for (i = 0; i < 20; i++) {
+		while (--i) {
 			udelay(1);
 			intr = read_reg(c, ONENAND_REG_INTERRUPT);
 			if (intr & ONENAND_INT_MASTER)
@@ -126,7 +140,7 @@ static int omap2_onenand_wait(struct mtd_info *mtd, int state)
 			wait_err("controller error", state, ctrl, intr);
 			return -EIO;
 		}
-		if (!(intr & ONENAND_INT_RESET)) {
+		if ((intr & intr_flags) != intr_flags) {
 			wait_err("timeout", state, ctrl, intr);
 			return -EIO;
 		}
diff --git a/drivers/mtd/onenand/onenand_base.c b/drivers/mtd/onenand/onenand_base.c
index ff66e4330aa7..f63b1db3ffb3 100644
--- a/drivers/mtd/onenand/onenand_base.c
+++ b/drivers/mtd/onenand/onenand_base.c
@@ -1,17 +1,19 @@
 /*
  *  linux/drivers/mtd/onenand/onenand_base.c
  *
- *  Copyright (C) 2005-2007 Samsung Electronics
+ *  Copyright © 2005-2009 Samsung Electronics
+ *  Copyright © 2007 Nokia Corporation
+ *
  *  Kyungmin Park <kyungmin.park@samsung.com>
  *
  *  Credits:
  *	Adrian Hunter <ext-adrian.hunter@nokia.com>:
  *	auto-placement support, read-while load support, various fixes
- *	Copyright (C) Nokia Corporation, 2007
  *
  *	Vishak G <vishak.g at samsung.com>, Rohit Hagargundgi <h.rohit at samsung.com>
  *	Flex-OneNAND support
- *	Copyright (C) Samsung Electronics, 2008
+ *	Amul Kumar Saha <amul.saha at samsung.com>
+ *	OTP support
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -32,6 +34,13 @@
 
 #include <asm/io.h>
 
+/*
+ * Multiblock erase if number of blocks to erase is 2 or more.
+ * Maximum number of blocks for simultaneous erase is 64.
+ */
+#define MB_ERASE_MIN_BLK_COUNT 2
+#define MB_ERASE_MAX_BLK_COUNT 64
+
 /* Default Flex-OneNAND boundary and lock respectively */
 static int flex_bdry[MAX_DIES * 2] = { -1, 0, -1, 0 };
 
@@ -43,6 +52,18 @@ MODULE_PARM_DESC(flex_bdry,	"SLC Boundary information for Flex-OneNAND"
 				"    : 0->Set boundary in unlocked status"
 				"    : 1->Set boundary in locked status");
 
+/* Default OneNAND/Flex-OneNAND OTP options*/
+static int otp;
+
+module_param(otp, int, 0400);
+MODULE_PARM_DESC(otp,	"Corresponding behaviour of OneNAND in OTP"
+			"Syntax : otp=LOCK_TYPE"
+			"LOCK_TYPE : Keys issued, for specific OTP Lock type"
+			"	   : 0 -> Default (No Blocks Locked)"
+			"	   : 1 -> OTP Block lock"
+			"	   : 2 -> 1st Block lock"
+			"	   : 3 -> BOTH OTP Block and 1st Block lock");
+
 /**
  *  onenand_oob_128 - oob info for Flex-Onenand with 4KB page
  *  For now, we expose only 64 out of 80 ecc bytes
@@ -339,6 +360,8 @@ static int onenand_command(struct mtd_info *mtd, int cmd, loff_t addr, size_t le
 		break;
 
 	case ONENAND_CMD_ERASE:
+	case ONENAND_CMD_MULTIBLOCK_ERASE:
+	case ONENAND_CMD_ERASE_VERIFY:
 	case ONENAND_CMD_BUFFERRAM:
 	case ONENAND_CMD_OTP_ACCESS:
 		block = onenand_block(this, addr);
@@ -483,7 +506,7 @@ static int onenand_wait(struct mtd_info *mtd, int state)
 		if (interrupt & flags)
 			break;
 
-		if (state != FL_READING)
+		if (state != FL_READING && state != FL_PREPARING_ERASE)
 			cond_resched();
 	}
 	/* To get correct interrupt status in timeout case */
@@ -500,25 +523,40 @@ static int onenand_wait(struct mtd_info *mtd, int state)
 		int ecc = onenand_read_ecc(this);
 		if (ecc) {
 			if (ecc & ONENAND_ECC_2BIT_ALL) {
-				printk(KERN_ERR "onenand_wait: ECC error = 0x%04x\n", ecc);
+				printk(KERN_ERR "%s: ECC error = 0x%04x\n",
+					__func__, ecc);
 				mtd->ecc_stats.failed++;
 				return -EBADMSG;
 			} else if (ecc & ONENAND_ECC_1BIT_ALL) {
-				printk(KERN_DEBUG "onenand_wait: correctable ECC error = 0x%04x\n", ecc);
+				printk(KERN_DEBUG "%s: correctable ECC error = 0x%04x\n",
+					__func__, ecc);
 				mtd->ecc_stats.corrected++;
 			}
 		}
 	} else if (state == FL_READING) {
-		printk(KERN_ERR "onenand_wait: read timeout! ctrl=0x%04x intr=0x%04x\n", ctrl, interrupt);
+		printk(KERN_ERR "%s: read timeout! ctrl=0x%04x intr=0x%04x\n",
+			__func__, ctrl, interrupt);
+		return -EIO;
+	}
+
+	if (state == FL_PREPARING_ERASE && !(interrupt & ONENAND_INT_ERASE)) {
+		printk(KERN_ERR "%s: mb erase timeout! ctrl=0x%04x intr=0x%04x\n",
+		       __func__, ctrl, interrupt);
+		return -EIO;
+	}
+
+	if (!(interrupt & ONENAND_INT_MASTER)) {
+		printk(KERN_ERR "%s: timeout! ctrl=0x%04x intr=0x%04x\n",
+		       __func__, ctrl, interrupt);
 		return -EIO;
 	}
 
 	/* If there's controller error, it's a real error */
 	if (ctrl & ONENAND_CTRL_ERROR) {
-		printk(KERN_ERR "onenand_wait: controller error = 0x%04x\n",
-			ctrl);
+		printk(KERN_ERR "%s: controller error = 0x%04x\n",
+			__func__, ctrl);
 		if (ctrl & ONENAND_CTRL_LOCK)
-			printk(KERN_ERR "onenand_wait: it's locked error.\n");
+			printk(KERN_ERR "%s: it's locked error.\n", __func__);
 		return -EIO;
 	}
 
@@ -1015,7 +1053,8 @@ static int onenand_recover_lsb(struct mtd_info *mtd, loff_t addr, int status)
 	/* We are attempting to reread, so decrement stats.failed
 	 * which was incremented by onenand_wait due to read failure
 	 */
-	printk(KERN_INFO "onenand_recover_lsb: Attempting to recover from uncorrectable read\n");
+	printk(KERN_INFO "%s: Attempting to recover from uncorrectable read\n",
+		__func__);
 	mtd->ecc_stats.failed--;
 
 	/* Issue the LSB page recovery command */
@@ -1046,7 +1085,8 @@ static int onenand_mlc_read_ops_nolock(struct mtd_info *mtd, loff_t from,
 	int ret = 0;
 	int writesize = this->writesize;
 
-	DEBUG(MTD_DEBUG_LEVEL3, "onenand_mlc_read_ops_nolock: from = 0x%08x, len = %i\n", (unsigned int) from, (int) len);
+	DEBUG(MTD_DEBUG_LEVEL3, "%s: from = 0x%08x, len = %i\n",
+	      __func__, (unsigned int) from, (int) len);
 
 	if (ops->mode == MTD_OOB_AUTO)
 		oobsize = this->ecclayout->oobavail;
@@ -1057,7 +1097,8 @@ static int onenand_mlc_read_ops_nolock(struct mtd_info *mtd, loff_t from,
 
 	/* Do not allow reads past end of device */
 	if (from + len > mtd->size) {
-		printk(KERN_ERR "onenand_mlc_read_ops_nolock: Attempt read beyond end of device\n");
+		printk(KERN_ERR "%s: Attempt read beyond end of device\n",
+			__func__);
 		ops->retlen = 0;
 		ops->oobretlen = 0;
 		return -EINVAL;
@@ -1146,7 +1187,8 @@ static int onenand_read_ops_nolock(struct mtd_info *mtd, loff_t from,
 	int ret = 0, boundary = 0;
 	int writesize = this->writesize;
 
-	DEBUG(MTD_DEBUG_LEVEL3, "onenand_read_ops_nolock: from = 0x%08x, len = %i\n", (unsigned int) from, (int) len);
+	DEBUG(MTD_DEBUG_LEVEL3, "%s: from = 0x%08x, len = %i\n",
+			__func__, (unsigned int) from, (int) len);
 
 	if (ops->mode == MTD_OOB_AUTO)
 		oobsize = this->ecclayout->oobavail;
@@ -1157,7 +1199,8 @@ static int onenand_read_ops_nolock(struct mtd_info *mtd, loff_t from,
 
 	/* Do not allow reads past end of device */
 	if ((from + len) > mtd->size) {
-		printk(KERN_ERR "onenand_read_ops_nolock: Attempt read beyond end of device\n");
+		printk(KERN_ERR "%s: Attempt read beyond end of device\n",
+			__func__);
 		ops->retlen = 0;
 		ops->oobretlen = 0;
 		return -EINVAL;
@@ -1275,7 +1318,8 @@ static int onenand_read_oob_nolock(struct mtd_info *mtd, loff_t from,
 
 	from += ops->ooboffs;
 
-	DEBUG(MTD_DEBUG_LEVEL3, "onenand_read_oob_nolock: from = 0x%08x, len = %i\n", (unsigned int) from, (int) len);
+	DEBUG(MTD_DEBUG_LEVEL3, "%s: from = 0x%08x, len = %i\n",
+		__func__, (unsigned int) from, (int) len);
 
 	/* Initialize return length value */
 	ops->oobretlen = 0;
@@ -1288,7 +1332,8 @@ static int onenand_read_oob_nolock(struct mtd_info *mtd, loff_t from,
 	column = from & (mtd->oobsize - 1);
 
 	if (unlikely(column >= oobsize)) {
-		printk(KERN_ERR "onenand_read_oob_nolock: Attempted to start read outside oob\n");
+		printk(KERN_ERR "%s: Attempted to start read outside oob\n",
+			__func__);
 		return -EINVAL;
 	}
 
@@ -1296,7 +1341,8 @@ static int onenand_read_oob_nolock(struct mtd_info *mtd, loff_t from,
 	if (unlikely(from >= mtd->size ||
 		     column + len > ((mtd->size >> this->page_shift) -
 				     (from >> this->page_shift)) * oobsize)) {
-		printk(KERN_ERR "onenand_read_oob_nolock: Attempted to read beyond end of device\n");
+		printk(KERN_ERR "%s: Attempted to read beyond end of device\n",
+			__func__);
 		return -EINVAL;
 	}
 
@@ -1319,7 +1365,8 @@ static int onenand_read_oob_nolock(struct mtd_info *mtd, loff_t from,
 			ret = onenand_recover_lsb(mtd, from, ret);
 
 		if (ret && ret != -EBADMSG) {
-			printk(KERN_ERR "onenand_read_oob_nolock: read failed = 0x%x\n", ret);
+			printk(KERN_ERR "%s: read failed = 0x%x\n",
+				__func__, ret);
 			break;
 		}
 
@@ -1450,20 +1497,21 @@ static int onenand_bbt_wait(struct mtd_info *mtd, int state)
 	if (interrupt & ONENAND_INT_READ) {
 		int ecc = onenand_read_ecc(this);
 		if (ecc & ONENAND_ECC_2BIT_ALL) {
-			printk(KERN_INFO "onenand_bbt_wait: ecc error = 0x%04x"
-				", controller error 0x%04x\n", ecc, ctrl);
+			printk(KERN_WARNING "%s: ecc error = 0x%04x, "
+				"controller error 0x%04x\n",
+				__func__, ecc, ctrl);
 			return ONENAND_BBT_READ_ECC_ERROR;
 		}
 	} else {
-		printk(KERN_ERR "onenand_bbt_wait: read timeout!"
-			"ctrl=0x%04x intr=0x%04x\n", ctrl, interrupt);
+		printk(KERN_ERR "%s: read timeout! ctrl=0x%04x intr=0x%04x\n",
+			__func__, ctrl, interrupt);
 		return ONENAND_BBT_READ_FATAL_ERROR;
 	}
 
 	/* Initial bad block case: 0x2400 or 0x0400 */
 	if (ctrl & ONENAND_CTRL_ERROR) {
-		printk(KERN_DEBUG "onenand_bbt_wait: "
-			"controller error = 0x%04x\n", ctrl);
+		printk(KERN_DEBUG "%s: controller error = 0x%04x\n",
+			__func__, ctrl);
 		return ONENAND_BBT_READ_ERROR;
 	}
 
@@ -1487,14 +1535,16 @@ int onenand_bbt_read_oob(struct mtd_info *mtd, loff_t from,
 	size_t len = ops->ooblen;
 	u_char *buf = ops->oobbuf;
 
-	DEBUG(MTD_DEBUG_LEVEL3, "onenand_bbt_read_oob: from = 0x%08x, len = %zi\n", (unsigned int) from, len);
+	DEBUG(MTD_DEBUG_LEVEL3, "%s: from = 0x%08x, len = %zi\n",
+		__func__, (unsigned int) from, len);
 
 	/* Initialize return value */
 	ops->oobretlen = 0;
 
 	/* Do not allow reads past end of device */
 	if (unlikely((from + len) > mtd->size)) {
-		printk(KERN_ERR "onenand_bbt_read_oob: Attempt read beyond end of device\n");
+		printk(KERN_ERR "%s: Attempt read beyond end of device\n",
+			__func__);
 		return ONENAND_BBT_READ_FATAL_ERROR;
 	}
 
@@ -1661,21 +1711,23 @@ static int onenand_panic_write(struct mtd_info *mtd, loff_t to, size_t len,
 	/* Wait for any existing operation to clear */
 	onenand_panic_wait(mtd);
 
-	DEBUG(MTD_DEBUG_LEVEL3, "onenand_panic_write: to = 0x%08x, len = %i\n",
-	      (unsigned int) to, (int) len);
+	DEBUG(MTD_DEBUG_LEVEL3, "%s: to = 0x%08x, len = %i\n",
+		__func__, (unsigned int) to, (int) len);
 
 	/* Initialize retlen, in case of early exit */
 	*retlen = 0;
 
 	/* Do not allow writes past end of device */
 	if (unlikely((to + len) > mtd->size)) {
-		printk(KERN_ERR "onenand_panic_write: Attempt write to past end of device\n");
+		printk(KERN_ERR "%s: Attempt write to past end of device\n",
+			__func__);
 		return -EINVAL;
 	}
 
 	/* Reject writes, which are not page aligned */
         if (unlikely(NOTALIGNED(to) || NOTALIGNED(len))) {
-                printk(KERN_ERR "onenand_panic_write: Attempt to write not page aligned data\n");
+		printk(KERN_ERR "%s: Attempt to write not page aligned data\n",
+			__func__);
                 return -EINVAL;
         }
 
@@ -1711,7 +1763,7 @@ static int onenand_panic_write(struct mtd_info *mtd, loff_t to, size_t len,
 		}
 
 		if (ret) {
-			printk(KERN_ERR "onenand_panic_write: write failed %d\n", ret);
+			printk(KERN_ERR "%s: write failed %d\n", __func__, ret);
 			break;
 		}
 
@@ -1792,7 +1844,8 @@ static int onenand_write_ops_nolock(struct mtd_info *mtd, loff_t to,
 	u_char *oobbuf;
 	int ret = 0;
 
-	DEBUG(MTD_DEBUG_LEVEL3, "onenand_write_ops_nolock: to = 0x%08x, len = %i\n", (unsigned int) to, (int) len);
+	DEBUG(MTD_DEBUG_LEVEL3, "%s: to = 0x%08x, len = %i\n",
+		__func__, (unsigned int) to, (int) len);
 
 	/* Initialize retlen, in case of early exit */
 	ops->retlen = 0;
@@ -1800,13 +1853,15 @@ static int onenand_write_ops_nolock(struct mtd_info *mtd, loff_t to,
 
 	/* Do not allow writes past end of device */
 	if (unlikely((to + len) > mtd->size)) {
-		printk(KERN_ERR "onenand_write_ops_nolock: Attempt write to past end of device\n");
+		printk(KERN_ERR "%s: Attempt write to past end of device\n",
+			__func__);
 		return -EINVAL;
 	}
 
 	/* Reject writes, which are not page aligned */
         if (unlikely(NOTALIGNED(to) || NOTALIGNED(len))) {
-                printk(KERN_ERR "onenand_write_ops_nolock: Attempt to write not page aligned data\n");
+		printk(KERN_ERR "%s: Attempt to write not page aligned data\n",
+			__func__);
                 return -EINVAL;
         }
 
@@ -1879,7 +1934,8 @@ static int onenand_write_ops_nolock(struct mtd_info *mtd, loff_t to,
 			onenand_update_bufferram(mtd, prev, !ret && !prev_subpage);
 			if (ret) {
 				written -= prevlen;
-				printk(KERN_ERR "onenand_write_ops_nolock: write failed %d\n", ret);
+				printk(KERN_ERR "%s: write failed %d\n",
+					__func__, ret);
 				break;
 			}
 
@@ -1887,7 +1943,8 @@ static int onenand_write_ops_nolock(struct mtd_info *mtd, loff_t to,
 				/* Only check verify write turn on */
 				ret = onenand_verify(mtd, buf - len, to - len, len);
 				if (ret)
-					printk(KERN_ERR "onenand_write_ops_nolock: verify failed %d\n", ret);
+					printk(KERN_ERR "%s: verify failed %d\n",
+						__func__, ret);
 				break;
 			}
 
@@ -1905,14 +1962,16 @@ static int onenand_write_ops_nolock(struct mtd_info *mtd, loff_t to,
 			/* In partial page write we don't update bufferram */
 			onenand_update_bufferram(mtd, to, !ret && !subpage);
 			if (ret) {
-				printk(KERN_ERR "onenand_write_ops_nolock: write failed %d\n", ret);
+				printk(KERN_ERR "%s: write failed %d\n",
+					__func__, ret);
 				break;
 			}
 
 			/* Only check verify write turn on */
 			ret = onenand_verify(mtd, buf, to, thislen);
 			if (ret) {
-				printk(KERN_ERR "onenand_write_ops_nolock: verify failed %d\n", ret);
+				printk(KERN_ERR "%s: verify failed %d\n",
+					__func__, ret);
 				break;
 			}
 
@@ -1968,7 +2027,8 @@ static int onenand_write_oob_nolock(struct mtd_info *mtd, loff_t to,
 
 	to += ops->ooboffs;
 
-	DEBUG(MTD_DEBUG_LEVEL3, "onenand_write_oob_nolock: to = 0x%08x, len = %i\n", (unsigned int) to, (int) len);
+	DEBUG(MTD_DEBUG_LEVEL3, "%s: to = 0x%08x, len = %i\n",
+		__func__, (unsigned int) to, (int) len);
 
 	/* Initialize retlen, in case of early exit */
 	ops->oobretlen = 0;
@@ -1981,14 +2041,15 @@ static int onenand_write_oob_nolock(struct mtd_info *mtd, loff_t to,
 	column = to & (mtd->oobsize - 1);
 
 	if (unlikely(column >= oobsize)) {
-		printk(KERN_ERR "onenand_write_oob_nolock: Attempted to start write outside oob\n");
+		printk(KERN_ERR "%s: Attempted to start write outside oob\n",
+			__func__);
 		return -EINVAL;
 	}
 
 	/* For compatibility with NAND: Do not allow write past end of page */
 	if (unlikely(column + len > oobsize)) {
-		printk(KERN_ERR "onenand_write_oob_nolock: "
-		      "Attempt to write past end of page\n");
+		printk(KERN_ERR "%s: Attempt to write past end of page\n",
+			__func__);
 		return -EINVAL;
 	}
 
@@ -1996,7 +2057,8 @@ static int onenand_write_oob_nolock(struct mtd_info *mtd, loff_t to,
 	if (unlikely(to >= mtd->size ||
 		     column + len > ((mtd->size >> this->page_shift) -
 				     (to >> this->page_shift)) * oobsize)) {
-		printk(KERN_ERR "onenand_write_oob_nolock: Attempted to write past end of device\n");
+		printk(KERN_ERR "%s: Attempted to write past end of device\n",
+		       __func__);
 		return -EINVAL;
 	}
 
@@ -2038,13 +2100,14 @@ static int onenand_write_oob_nolock(struct mtd_info *mtd, loff_t to,
 
 		ret = this->wait(mtd, FL_WRITING);
 		if (ret) {
-			printk(KERN_ERR "onenand_write_oob_nolock: write failed %d\n", ret);
+			printk(KERN_ERR "%s: write failed %d\n", __func__, ret);
 			break;
 		}
 
 		ret = onenand_verify_oob(mtd, oobbuf, to);
 		if (ret) {
-			printk(KERN_ERR "onenand_write_oob_nolock: verify failed %d\n", ret);
+			printk(KERN_ERR "%s: verify failed %d\n",
+				__func__, ret);
 			break;
 		}
 
@@ -2140,78 +2203,186 @@ static int onenand_block_isbad_nolock(struct mtd_info *mtd, loff_t ofs, int allo
 	return bbm->isbad_bbt(mtd, ofs, allowbbt);
 }
 
+
+static int onenand_multiblock_erase_verify(struct mtd_info *mtd,
+					   struct erase_info *instr)
+{
+	struct onenand_chip *this = mtd->priv;
+	loff_t addr = instr->addr;
+	int len = instr->len;
+	unsigned int block_size = (1 << this->erase_shift);
+	int ret = 0;
+
+	while (len) {
+		this->command(mtd, ONENAND_CMD_ERASE_VERIFY, addr, block_size);
+		ret = this->wait(mtd, FL_VERIFYING_ERASE);
+		if (ret) {
+			printk(KERN_ERR "%s: Failed verify, block %d\n",
+			       __func__, onenand_block(this, addr));
+			instr->state = MTD_ERASE_FAILED;
+			instr->fail_addr = addr;
+			return -1;
+		}
+		len -= block_size;
+		addr += block_size;
+	}
+	return 0;
+}
+
 /**
- * onenand_erase - [MTD Interface] erase block(s)
+ * onenand_multiblock_erase - [Internal] erase block(s) using multiblock erase
  * @param mtd		MTD device structure
  * @param instr		erase instruction
+ * @param region	erase region
  *
- * Erase one ore more blocks
+ * Erase one or more blocks up to 64 block at a time
  */
-static int onenand_erase(struct mtd_info *mtd, struct erase_info *instr)
+static int onenand_multiblock_erase(struct mtd_info *mtd,
+				    struct erase_info *instr,
+				    unsigned int block_size)
 {
 	struct onenand_chip *this = mtd->priv;
-	unsigned int block_size;
 	loff_t addr = instr->addr;
-	loff_t len = instr->len;
-	int ret = 0, i;
-	struct mtd_erase_region_info *region = NULL;
-	loff_t region_end = 0;
+	int len = instr->len;
+	int eb_count = 0;
+	int ret = 0;
+	int bdry_block = 0;
 
-	DEBUG(MTD_DEBUG_LEVEL3, "onenand_erase: start = 0x%012llx, len = %llu\n", (unsigned long long) instr->addr, (unsigned long long) instr->len);
+	instr->state = MTD_ERASING;
 
-	/* Do not allow erase past end of device */
-	if (unlikely((len + addr) > mtd->size)) {
-		printk(KERN_ERR "onenand_erase: Erase past end of device\n");
-		return -EINVAL;
+	if (ONENAND_IS_DDP(this)) {
+		loff_t bdry_addr = this->chipsize >> 1;
+		if (addr < bdry_addr && (addr + len) > bdry_addr)
+			bdry_block = bdry_addr >> this->erase_shift;
 	}
 
-	if (FLEXONENAND(this)) {
-		/* Find the eraseregion of this address */
-		i = flexonenand_region(mtd, addr);
-		region = &mtd->eraseregions[i];
+	/* Pre-check bbs */
+	while (len) {
+		/* Check if we have a bad block, we do not erase bad blocks */
+		if (onenand_block_isbad_nolock(mtd, addr, 0)) {
+			printk(KERN_WARNING "%s: attempt to erase a bad block "
+			       "at addr 0x%012llx\n",
+			       __func__, (unsigned long long) addr);
+			instr->state = MTD_ERASE_FAILED;
+			return -EIO;
+		}
+		len -= block_size;
+		addr += block_size;
+	}
 
-		block_size = region->erasesize;
-		region_end = region->offset + region->erasesize * region->numblocks;
+	len = instr->len;
+	addr = instr->addr;
 
-		/* Start address within region must align on block boundary.
-		 * Erase region's start offset is always block start address.
-		 */
-		if (unlikely((addr - region->offset) & (block_size - 1))) {
-			printk(KERN_ERR "onenand_erase: Unaligned address\n");
-			return -EINVAL;
+	/* loop over 64 eb batches */
+	while (len) {
+		struct erase_info verify_instr = *instr;
+		int max_eb_count = MB_ERASE_MAX_BLK_COUNT;
+
+		verify_instr.addr = addr;
+		verify_instr.len = 0;
+
+		/* do not cross chip boundary */
+		if (bdry_block) {
+			int this_block = (addr >> this->erase_shift);
+
+			if (this_block < bdry_block) {
+				max_eb_count = min(max_eb_count,
+						   (bdry_block - this_block));
+			}
 		}
-	} else {
-		block_size = 1 << this->erase_shift;
 
-		/* Start address must align on block boundary */
-		if (unlikely(addr & (block_size - 1))) {
-			printk(KERN_ERR "onenand_erase: Unaligned address\n");
-			return -EINVAL;
+		eb_count = 0;
+
+		while (len > block_size && eb_count < (max_eb_count - 1)) {
+			this->command(mtd, ONENAND_CMD_MULTIBLOCK_ERASE,
+				      addr, block_size);
+			onenand_invalidate_bufferram(mtd, addr, block_size);
+
+			ret = this->wait(mtd, FL_PREPARING_ERASE);
+			if (ret) {
+				printk(KERN_ERR "%s: Failed multiblock erase, "
+				       "block %d\n", __func__,
+				       onenand_block(this, addr));
+				instr->state = MTD_ERASE_FAILED;
+				instr->fail_addr = MTD_FAIL_ADDR_UNKNOWN;
+				return -EIO;
+			}
+
+			len -= block_size;
+			addr += block_size;
+			eb_count++;
+		}
+
+		/* last block of 64-eb series */
+		cond_resched();
+		this->command(mtd, ONENAND_CMD_ERASE, addr, block_size);
+		onenand_invalidate_bufferram(mtd, addr, block_size);
+
+		ret = this->wait(mtd, FL_ERASING);
+		/* Check if it is write protected */
+		if (ret) {
+			printk(KERN_ERR "%s: Failed erase, block %d\n",
+			       __func__, onenand_block(this, addr));
+			instr->state = MTD_ERASE_FAILED;
+			instr->fail_addr = MTD_FAIL_ADDR_UNKNOWN;
+			return -EIO;
+		}
+
+		len -= block_size;
+		addr += block_size;
+		eb_count++;
+
+		/* verify */
+		verify_instr.len = eb_count * block_size;
+		if (onenand_multiblock_erase_verify(mtd, &verify_instr)) {
+			instr->state = verify_instr.state;
+			instr->fail_addr = verify_instr.fail_addr;
+			return -EIO;
 		}
-	}
 
-	/* Length must align on block boundary */
-	if (unlikely(len & (block_size - 1))) {
-		printk(KERN_ERR "onenand_erase: Length not block aligned\n");
-		return -EINVAL;
 	}
+	return 0;
+}
 
-	instr->fail_addr = MTD_FAIL_ADDR_UNKNOWN;
 
-	/* Grab the lock and see if the device is available */
-	onenand_get_device(mtd, FL_ERASING);
+/**
+ * onenand_block_by_block_erase - [Internal] erase block(s) using regular erase
+ * @param mtd		MTD device structure
+ * @param instr		erase instruction
+ * @param region	erase region
+ * @param block_size	erase block size
+ *
+ * Erase one or more blocks one block at a time
+ */
+static int onenand_block_by_block_erase(struct mtd_info *mtd,
+					struct erase_info *instr,
+					struct mtd_erase_region_info *region,
+					unsigned int block_size)
+{
+	struct onenand_chip *this = mtd->priv;
+	loff_t addr = instr->addr;
+	int len = instr->len;
+	loff_t region_end = 0;
+	int ret = 0;
+
+	if (region) {
+		/* region is set for Flex-OneNAND */
+		region_end = region->offset + region->erasesize * region->numblocks;
+	}
 
-	/* Loop through the blocks */
 	instr->state = MTD_ERASING;
 
+	/* Loop through the blocks */
 	while (len) {
 		cond_resched();
 
 		/* Check if we have a bad block, we do not erase bad blocks */
 		if (onenand_block_isbad_nolock(mtd, addr, 0)) {
-			printk (KERN_WARNING "onenand_erase: attempt to erase a bad block at addr 0x%012llx\n", (unsigned long long) addr);
+			printk(KERN_WARNING "%s: attempt to erase a bad block "
+					"at addr 0x%012llx\n",
+					__func__, (unsigned long long) addr);
 			instr->state = MTD_ERASE_FAILED;
-			goto erase_exit;
+			return -EIO;
 		}
 
 		this->command(mtd, ONENAND_CMD_ERASE, addr, block_size);
@@ -2221,11 +2392,11 @@ static int onenand_erase(struct mtd_info *mtd, struct erase_info *instr)
 		ret = this->wait(mtd, FL_ERASING);
 		/* Check, if it is write protected */
 		if (ret) {
-			printk(KERN_ERR "onenand_erase: Failed erase, block %d\n",
-						 onenand_block(this, addr));
+			printk(KERN_ERR "%s: Failed erase, block %d\n",
+				__func__, onenand_block(this, addr));
 			instr->state = MTD_ERASE_FAILED;
 			instr->fail_addr = addr;
-			goto erase_exit;
+			return -EIO;
 		}
 
 		len -= block_size;
@@ -2241,25 +2412,88 @@ static int onenand_erase(struct mtd_info *mtd, struct erase_info *instr)
 
 			if (len & (block_size - 1)) {
 				/* FIXME: This should be handled at MTD partitioning level. */
-				printk(KERN_ERR "onenand_erase: Unaligned address\n");
-				goto erase_exit;
+				printk(KERN_ERR "%s: Unaligned address\n",
+					__func__);
+				return -EIO;
 			}
 		}
+	}
+	return 0;
+}
+
+/**
+ * onenand_erase - [MTD Interface] erase block(s)
+ * @param mtd		MTD device structure
+ * @param instr		erase instruction
+ *
+ * Erase one or more blocks
+ */
+static int onenand_erase(struct mtd_info *mtd, struct erase_info *instr)
+{
+	struct onenand_chip *this = mtd->priv;
+	unsigned int block_size;
+	loff_t addr = instr->addr;
+	loff_t len = instr->len;
+	int ret = 0;
+	struct mtd_erase_region_info *region = NULL;
+	loff_t region_offset = 0;
+
+	DEBUG(MTD_DEBUG_LEVEL3, "%s: start=0x%012llx, len=%llu\n", __func__,
+	      (unsigned long long) instr->addr, (unsigned long long) instr->len);
+
+	/* Do not allow erase past end of device */
+	if (unlikely((len + addr) > mtd->size)) {
+		printk(KERN_ERR "%s: Erase past end of device\n", __func__);
+		return -EINVAL;
+	}
+
+	if (FLEXONENAND(this)) {
+		/* Find the eraseregion of this address */
+		int i = flexonenand_region(mtd, addr);
+
+		region = &mtd->eraseregions[i];
+		block_size = region->erasesize;
+
+		/* Start address within region must align on block boundary.
+		 * Erase region's start offset is always block start address.
+		 */
+		region_offset = region->offset;
+	} else
+		block_size = 1 << this->erase_shift;
+
+	/* Start address must align on block boundary */
+	if (unlikely((addr - region_offset) & (block_size - 1))) {
+		printk(KERN_ERR "%s: Unaligned address\n", __func__);
+		return -EINVAL;
+	}
 
+	/* Length must align on block boundary */
+	if (unlikely(len & (block_size - 1))) {
+		printk(KERN_ERR "%s: Length not block aligned\n", __func__);
+		return -EINVAL;
 	}
 
-	instr->state = MTD_ERASE_DONE;
+	instr->fail_addr = MTD_FAIL_ADDR_UNKNOWN;
 
-erase_exit:
+	/* Grab the lock and see if the device is available */
+	onenand_get_device(mtd, FL_ERASING);
 
-	ret = instr->state == MTD_ERASE_DONE ? 0 : -EIO;
+	if (region || instr->len < MB_ERASE_MIN_BLK_COUNT * block_size) {
+		/* region is set for Flex-OneNAND (no mb erase) */
+		ret = onenand_block_by_block_erase(mtd, instr,
+						   region, block_size);
+	} else {
+		ret = onenand_multiblock_erase(mtd, instr, block_size);
+	}
 
 	/* Deselect and wake up anyone waiting on the device */
 	onenand_release_device(mtd);
 
 	/* Do call back function */
-	if (!ret)
+	if (!ret) {
+		instr->state = MTD_ERASE_DONE;
 		mtd_erase_callback(instr);
+	}
 
 	return ret;
 }
@@ -2272,7 +2506,7 @@ erase_exit:
  */
 static void onenand_sync(struct mtd_info *mtd)
 {
-	DEBUG(MTD_DEBUG_LEVEL3, "onenand_sync: called\n");
+	DEBUG(MTD_DEBUG_LEVEL3, "%s: called\n", __func__);
 
 	/* Grab the lock and see if the device is available */
 	onenand_get_device(mtd, FL_SYNCING);
@@ -2406,7 +2640,8 @@ static int onenand_do_lock_cmd(struct mtd_info *mtd, loff_t ofs, size_t len, int
 		/* Check lock status */
 		status = this->read_word(this->base + ONENAND_REG_WP_STATUS);
 		if (!(status & wp_status_mask))
-			printk(KERN_ERR "wp status = 0x%x\n", status);
+			printk(KERN_ERR "%s: wp status = 0x%x\n",
+				__func__, status);
 
 		return 0;
 	}
@@ -2435,7 +2670,8 @@ static int onenand_do_lock_cmd(struct mtd_info *mtd, loff_t ofs, size_t len, int
 		/* Check lock status */
 		status = this->read_word(this->base + ONENAND_REG_WP_STATUS);
 		if (!(status & wp_status_mask))
-			printk(KERN_ERR "block = %d, wp status = 0x%x\n", block, status);
+			printk(KERN_ERR "%s: block = %d, wp status = 0x%x\n",
+				__func__, block, status);
 	}
 
 	return 0;
@@ -2502,7 +2738,8 @@ static int onenand_check_lock_status(struct onenand_chip *this)
 		/* Check lock status */
 		status = this->read_word(this->base + ONENAND_REG_WP_STATUS);
 		if (!(status & ONENAND_WP_US)) {
-			printk(KERN_ERR "block = %d, wp status = 0x%x\n", block, status);
+			printk(KERN_ERR "%s: block = %d, wp status = 0x%x\n",
+				__func__, block, status);
 			return 0;
 		}
 	}
@@ -2557,6 +2794,208 @@ static void onenand_unlock_all(struct mtd_info *mtd)
 
 #ifdef CONFIG_MTD_ONENAND_OTP
 
+/**
+ * onenand_otp_command - Send OTP specific command to OneNAND device
+ * @param mtd	 MTD device structure
+ * @param cmd	 the command to be sent
+ * @param addr	 offset to read from or write to
+ * @param len	 number of bytes to read or write
+ */
+static int onenand_otp_command(struct mtd_info *mtd, int cmd, loff_t addr,
+				size_t len)
+{
+	struct onenand_chip *this = mtd->priv;
+	int value, block, page;
+
+	/* Address translation */
+	switch (cmd) {
+	case ONENAND_CMD_OTP_ACCESS:
+		block = (int) (addr >> this->erase_shift);
+		page = -1;
+		break;
+
+	default:
+		block = (int) (addr >> this->erase_shift);
+		page = (int) (addr >> this->page_shift);
+
+		if (ONENAND_IS_2PLANE(this)) {
+			/* Make the even block number */
+			block &= ~1;
+			/* Is it the odd plane? */
+			if (addr & this->writesize)
+				block++;
+			page >>= 1;
+		}
+		page &= this->page_mask;
+		break;
+	}
+
+	if (block != -1) {
+		/* Write 'DFS, FBA' of Flash */
+		value = onenand_block_address(this, block);
+		this->write_word(value, this->base +
+				ONENAND_REG_START_ADDRESS1);
+	}
+
+	if (page != -1) {
+		/* Now we use page size operation */
+		int sectors = 4, count = 4;
+		int dataram;
+
+		switch (cmd) {
+		default:
+			if (ONENAND_IS_2PLANE(this) && cmd == ONENAND_CMD_PROG)
+				cmd = ONENAND_CMD_2X_PROG;
+			dataram = ONENAND_CURRENT_BUFFERRAM(this);
+			break;
+		}
+
+		/* Write 'FPA, FSA' of Flash */
+		value = onenand_page_address(page, sectors);
+		this->write_word(value, this->base +
+				ONENAND_REG_START_ADDRESS8);
+
+		/* Write 'BSA, BSC' of DataRAM */
+		value = onenand_buffer_address(dataram, sectors, count);
+		this->write_word(value, this->base + ONENAND_REG_START_BUFFER);
+	}
+
+	/* Interrupt clear */
+	this->write_word(ONENAND_INT_CLEAR, this->base + ONENAND_REG_INTERRUPT);
+
+	/* Write command */
+	this->write_word(cmd, this->base + ONENAND_REG_COMMAND);
+
+	return 0;
+}
+
+/**
+ * onenand_otp_write_oob_nolock - [Internal] OneNAND write out-of-band, specific to OTP
+ * @param mtd		MTD device structure
+ * @param to		offset to write to
+ * @param len		number of bytes to write
+ * @param retlen	pointer to variable to store the number of written bytes
+ * @param buf		the data to write
+ *
+ * OneNAND write out-of-band only for OTP
+ */
+static int onenand_otp_write_oob_nolock(struct mtd_info *mtd, loff_t to,
+				    struct mtd_oob_ops *ops)
+{
+	struct onenand_chip *this = mtd->priv;
+	int column, ret = 0, oobsize;
+	int written = 0;
+	u_char *oobbuf;
+	size_t len = ops->ooblen;
+	const u_char *buf = ops->oobbuf;
+	int block, value, status;
+
+	to += ops->ooboffs;
+
+	/* Initialize retlen, in case of early exit */
+	ops->oobretlen = 0;
+
+	oobsize = mtd->oobsize;
+
+	column = to & (mtd->oobsize - 1);
+
+	oobbuf = this->oob_buf;
+
+	/* Loop until all data write */
+	while (written < len) {
+		int thislen = min_t(int, oobsize, len - written);
+
+		cond_resched();
+
+		block = (int) (to >> this->erase_shift);
+		/*
+		 * Write 'DFS, FBA' of Flash
+		 * Add: F100h DQ=DFS, FBA
+		 */
+
+		value = onenand_block_address(this, block);
+		this->write_word(value, this->base +
+				ONENAND_REG_START_ADDRESS1);
+
+		/*
+		 * Select DataRAM for DDP
+		 * Add: F101h DQ=DBS
+		 */
+
+		value = onenand_bufferram_address(this, block);
+		this->write_word(value, this->base +
+				ONENAND_REG_START_ADDRESS2);
+		ONENAND_SET_NEXT_BUFFERRAM(this);
+
+		/*
+		 * Enter OTP access mode
+		 */
+		this->command(mtd, ONENAND_CMD_OTP_ACCESS, 0, 0);
+		this->wait(mtd, FL_OTPING);
+
+		/* We send data to spare ram with oobsize
+		 * to prevent byte access */
+		memcpy(oobbuf + column, buf, thislen);
+
+		/*
+		 * Write Data into DataRAM
+		 * Add: 8th Word
+		 * in sector0/spare/page0
+		 * DQ=XXFCh
+		 */
+		this->write_bufferram(mtd, ONENAND_SPARERAM,
+					oobbuf, 0, mtd->oobsize);
+
+		onenand_otp_command(mtd, ONENAND_CMD_PROGOOB, to, mtd->oobsize);
+		onenand_update_bufferram(mtd, to, 0);
+		if (ONENAND_IS_2PLANE(this)) {
+			ONENAND_SET_BUFFERRAM1(this);
+			onenand_update_bufferram(mtd, to + this->writesize, 0);
+		}
+
+		ret = this->wait(mtd, FL_WRITING);
+		if (ret) {
+			printk(KERN_ERR "%s: write failed %d\n", __func__, ret);
+			break;
+		}
+
+		/* Exit OTP access mode */
+		this->command(mtd, ONENAND_CMD_RESET, 0, 0);
+		this->wait(mtd, FL_RESETING);
+
+		status = this->read_word(this->base + ONENAND_REG_CTRL_STATUS);
+		status &= 0x60;
+
+		if (status == 0x60) {
+			printk(KERN_DEBUG "\nBLOCK\tSTATUS\n");
+			printk(KERN_DEBUG "1st Block\tLOCKED\n");
+			printk(KERN_DEBUG "OTP Block\tLOCKED\n");
+		} else if (status == 0x20) {
+			printk(KERN_DEBUG "\nBLOCK\tSTATUS\n");
+			printk(KERN_DEBUG "1st Block\tLOCKED\n");
+			printk(KERN_DEBUG "OTP Block\tUN-LOCKED\n");
+		} else if (status == 0x40) {
+			printk(KERN_DEBUG "\nBLOCK\tSTATUS\n");
+			printk(KERN_DEBUG "1st Block\tUN-LOCKED\n");
+			printk(KERN_DEBUG "OTP Block\tLOCKED\n");
+		} else {
+			printk(KERN_DEBUG "Reboot to check\n");
+		}
+
+		written += thislen;
+		if (written == len)
+			break;
+
+		to += mtd->writesize;
+		buf += thislen;
+		column = 0;
+	}
+
+	ops->oobretlen = written;
+
+	return ret;
+}
+
 /* Internal OTP operation */
 typedef int (*otp_op_t)(struct mtd_info *mtd, loff_t form, size_t len,
 		size_t *retlen, u_char *buf);
@@ -2659,11 +3098,11 @@ static int do_otp_lock(struct mtd_info *mtd, loff_t from, size_t len,
 	struct mtd_oob_ops ops;
 	int ret;
 
-	/* Enter OTP access mode */
-	this->command(mtd, ONENAND_CMD_OTP_ACCESS, 0, 0);
-	this->wait(mtd, FL_OTPING);
-
 	if (FLEXONENAND(this)) {
+
+		/* Enter OTP access mode */
+		this->command(mtd, ONENAND_CMD_OTP_ACCESS, 0, 0);
+		this->wait(mtd, FL_OTPING);
 		/*
 		 * For Flex-OneNAND, we write lock mark to 1st word of sector 4 of
 		 * main area of page 49.
@@ -2674,19 +3113,19 @@ static int do_otp_lock(struct mtd_info *mtd, loff_t from, size_t len,
 		ops.oobbuf = NULL;
 		ret = onenand_write_ops_nolock(mtd, mtd->writesize * 49, &ops);
 		*retlen = ops.retlen;
+
+		/* Exit OTP access mode */
+		this->command(mtd, ONENAND_CMD_RESET, 0, 0);
+		this->wait(mtd, FL_RESETING);
 	} else {
 		ops.mode = MTD_OOB_PLACE;
 		ops.ooblen = len;
 		ops.oobbuf = buf;
 		ops.ooboffs = 0;
-		ret = onenand_write_oob_nolock(mtd, from, &ops);
+		ret = onenand_otp_write_oob_nolock(mtd, from, &ops);
 		*retlen = ops.oobretlen;
 	}
 
-	/* Exit OTP access mode */
-	this->command(mtd, ONENAND_CMD_RESET, 0, 0);
-	this->wait(mtd, FL_RESETING);
-
 	return ret;
 }
 
@@ -2717,16 +3156,21 @@ static int onenand_otp_walk(struct mtd_info *mtd, loff_t from, size_t len,
 	if (density < ONENAND_DEVICE_DENSITY_512Mb)
 		otp_pages = 20;
 	else
-		otp_pages = 10;
+		otp_pages = 50;
 
 	if (mode == MTD_OTP_FACTORY) {
 		from += mtd->writesize * otp_pages;
-		otp_pages = 64 - otp_pages;
+		otp_pages = ONENAND_PAGES_PER_BLOCK - otp_pages;
 	}
 
 	/* Check User/Factory boundary */
-	if (((mtd->writesize * otp_pages) - (from + len)) < 0)
-		return 0;
+	if (mode == MTD_OTP_USER) {
+		if (mtd->writesize * otp_pages < from + len)
+			return 0;
+	} else {
+		if (mtd->writesize * otp_pages <  len)
+			return 0;
+	}
 
 	onenand_get_device(mtd, FL_OTPING);
 	while (len > 0 && otp_pages > 0) {
@@ -2749,13 +3193,12 @@ static int onenand_otp_walk(struct mtd_info *mtd, loff_t from, size_t len,
 			*retlen += sizeof(struct otp_info);
 		} else {
 			size_t tmp_retlen;
-			int size = len;
 
 			ret = action(mtd, from, len, &tmp_retlen, buf);
 
-			buf += size;
-			len -= size;
-			*retlen += size;
+			buf += tmp_retlen;
+			len -= tmp_retlen;
+			*retlen += tmp_retlen;
 
 			if (ret)
 				break;
@@ -2868,21 +3311,11 @@ static int onenand_lock_user_prot_reg(struct mtd_info *mtd, loff_t from,
 	u_char *buf = FLEXONENAND(this) ? this->page_buf : this->oob_buf;
 	size_t retlen;
 	int ret;
+	unsigned int otp_lock_offset = ONENAND_OTP_LOCK_OFFSET;
 
 	memset(buf, 0xff, FLEXONENAND(this) ? this->writesize
 						 : mtd->oobsize);
 	/*
-	 * Note: OTP lock operation
-	 *       OTP block : 0xXXFC
-	 *       1st block : 0xXXF3 (If chip support)
-	 *       Both      : 0xXXF0 (If chip support)
-	 */
-	if (FLEXONENAND(this))
-		buf[FLEXONENAND_OTP_LOCK_OFFSET] = 0xFC;
-	else
-		buf[ONENAND_OTP_LOCK_OFFSET] = 0xFC;
-
-	/*
 	 * Write lock mark to 8th word of sector0 of page0 of the spare0.
 	 * We write 16 bytes spare area instead of 2 bytes.
 	 * For Flex-OneNAND, we write lock mark to 1st word of sector 4 of
@@ -2892,10 +3325,30 @@ static int onenand_lock_user_prot_reg(struct mtd_info *mtd, loff_t from,
 	from = 0;
 	len = FLEXONENAND(this) ? mtd->writesize : 16;
 
+	/*
+	 * Note: OTP lock operation
+	 *       OTP block : 0xXXFC			XX 1111 1100
+	 *       1st block : 0xXXF3 (If chip support)	XX 1111 0011
+	 *       Both      : 0xXXF0 (If chip support)	XX 1111 0000
+	 */
+	if (FLEXONENAND(this))
+		otp_lock_offset = FLEXONENAND_OTP_LOCK_OFFSET;
+
+	/* ONENAND_OTP_AREA | ONENAND_OTP_BLOCK0 | ONENAND_OTP_AREA_BLOCK0 */
+	if (otp == 1)
+		buf[otp_lock_offset] = 0xFC;
+	else if (otp == 2)
+		buf[otp_lock_offset] = 0xF3;
+	else if (otp == 3)
+		buf[otp_lock_offset] = 0xF0;
+	else if (otp != 0)
+		printk(KERN_DEBUG "[OneNAND] Invalid option selected for OTP\n");
+
 	ret = onenand_otp_walk(mtd, from, len, &retlen, buf, do_otp_lock, MTD_OTP_USER);
 
 	return ret ? : retlen;
 }
+
 #endif	/* CONFIG_MTD_ONENAND_OTP */
 
 /**
@@ -3172,7 +3625,8 @@ static int flexonenand_check_blocks_erased(struct mtd_info *mtd, int start, int
 				break;
 
 		if (i != mtd->oobsize) {
-			printk(KERN_WARNING "Block %d not erased.\n", block);
+			printk(KERN_WARNING "%s: Block %d not erased.\n",
+				__func__, block);
 			return 1;
 		}
 	}
@@ -3204,8 +3658,8 @@ int flexonenand_set_boundary(struct mtd_info *mtd, int die,
 	blksperdie >>= ONENAND_IS_DDP(this) ? 1 : 0;
 
 	if (boundary >= blksperdie) {
-		printk(KERN_ERR "flexonenand_set_boundary: Invalid boundary value. "
-				"Boundary not changed.\n");
+		printk(KERN_ERR "%s: Invalid boundary value. "
+				"Boundary not changed.\n", __func__);
 		return -EINVAL;
 	}
 
@@ -3214,7 +3668,8 @@ int flexonenand_set_boundary(struct mtd_info *mtd, int die,
 	new = boundary + (die * this->density_mask);
 	ret = flexonenand_check_blocks_erased(mtd, min(old, new) + 1, max(old, new));
 	if (ret) {
-		printk(KERN_ERR "flexonenand_set_boundary: Please erase blocks before boundary change\n");
+		printk(KERN_ERR "%s: Please erase blocks "
+				"before boundary change\n", __func__);
 		return ret;
 	}
 
@@ -3227,12 +3682,12 @@ int flexonenand_set_boundary(struct mtd_info *mtd, int die,
 
 	thisboundary = this->read_word(this->base + ONENAND_DATARAM);
 	if ((thisboundary >> FLEXONENAND_PI_UNLOCK_SHIFT) != 3) {
-		printk(KERN_ERR "flexonenand_set_boundary: boundary locked\n");
+		printk(KERN_ERR "%s: boundary locked\n", __func__);
 		ret = 1;
 		goto out;
 	}
 
-	printk(KERN_INFO "flexonenand_set_boundary: Changing die %d boundary: %d%s\n",
+	printk(KERN_INFO "Changing die %d boundary: %d%s\n",
 			die, boundary, lock ? "(Locked)" : "(Unlocked)");
 
 	addr = die ? this->diesize[0] : 0;
@@ -3243,7 +3698,8 @@ int flexonenand_set_boundary(struct mtd_info *mtd, int die,
 	this->command(mtd, ONENAND_CMD_ERASE, addr, 0);
 	ret = this->wait(mtd, FL_ERASING);
 	if (ret) {
-		printk(KERN_ERR "flexonenand_set_boundary: Failed PI erase for Die %d\n", die);
+		printk(KERN_ERR "%s: Failed PI erase for Die %d\n",
+		       __func__, die);
 		goto out;
 	}
 
@@ -3251,7 +3707,8 @@ int flexonenand_set_boundary(struct mtd_info *mtd, int die,
 	this->command(mtd, ONENAND_CMD_PROG, addr, 0);
 	ret = this->wait(mtd, FL_WRITING);
 	if (ret) {
-		printk(KERN_ERR "flexonenand_set_boundary: Failed PI write for Die %d\n", die);
+		printk(KERN_ERR "%s: Failed PI write for Die %d\n",
+			__func__, die);
 		goto out;
 	}
 
@@ -3408,8 +3865,8 @@ static void onenand_resume(struct mtd_info *mtd)
 	if (this->state == FL_PM_SUSPENDED)
 		onenand_release_device(mtd);
 	else
-		printk(KERN_ERR "resume() called for the chip which is not"
-				"in suspended state\n");
+		printk(KERN_ERR "%s: resume() called for the chip which is not "
+				"in suspended state\n", __func__);
 }
 
 /**
@@ -3464,7 +3921,8 @@ int onenand_scan(struct mtd_info *mtd, int maxchips)
 	if (!this->page_buf) {
 		this->page_buf = kzalloc(mtd->writesize, GFP_KERNEL);
 		if (!this->page_buf) {
-			printk(KERN_ERR "onenand_scan(): Can't allocate page_buf\n");
+			printk(KERN_ERR "%s: Can't allocate page_buf\n",
+				__func__);
 			return -ENOMEM;
 		}
 		this->options |= ONENAND_PAGEBUF_ALLOC;
@@ -3472,7 +3930,8 @@ int onenand_scan(struct mtd_info *mtd, int maxchips)
 	if (!this->oob_buf) {
 		this->oob_buf = kzalloc(mtd->oobsize, GFP_KERNEL);
 		if (!this->oob_buf) {
-			printk(KERN_ERR "onenand_scan(): Can't allocate oob_buf\n");
+			printk(KERN_ERR "%s: Can't allocate oob_buf\n",
+				__func__);
 			if (this->options & ONENAND_PAGEBUF_ALLOC) {
 				this->options &= ~ONENAND_PAGEBUF_ALLOC;
 				kfree(this->page_buf);
@@ -3505,8 +3964,8 @@ int onenand_scan(struct mtd_info *mtd, int maxchips)
 		break;
 
 	default:
-		printk(KERN_WARNING "No OOB scheme defined for oobsize %d\n",
-			mtd->oobsize);
+		printk(KERN_WARNING "%s: No OOB scheme defined for oobsize %d\n",
+			__func__, mtd->oobsize);
 		mtd->subpage_sft = 0;
 		/* To prevent kernel oops */
 		this->ecclayout = &onenand_oob_32;
diff --git a/drivers/mtd/tests/Makefile b/drivers/mtd/tests/Makefile
index c1d501335006..b44dcab940d8 100644
--- a/drivers/mtd/tests/Makefile
+++ b/drivers/mtd/tests/Makefile
@@ -5,3 +5,4 @@ obj-$(CONFIG_MTD_TESTS) += mtd_speedtest.o
 obj-$(CONFIG_MTD_TESTS) += mtd_stresstest.o
 obj-$(CONFIG_MTD_TESTS) += mtd_subpagetest.o
 obj-$(CONFIG_MTD_TESTS) += mtd_torturetest.o
+obj-$(CONFIG_MTD_TESTS) += mtd_nandecctest.o
diff --git a/drivers/mtd/tests/mtd_nandecctest.c b/drivers/mtd/tests/mtd_nandecctest.c
new file mode 100644
index 000000000000..c1f31051784c
--- /dev/null
+++ b/drivers/mtd/tests/mtd_nandecctest.c
@@ -0,0 +1,87 @@
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/list.h>
+#include <linux/slab.h>
+#include <linux/random.h>
+#include <linux/string.h>
+#include <linux/bitops.h>
+#include <linux/jiffies.h>
+#include <linux/mtd/nand_ecc.h>
+
+#if defined(CONFIG_MTD_NAND) || defined(CONFIG_MTD_NAND_MODULE)
+
+static void inject_single_bit_error(void *data, size_t size)
+{
+	unsigned long offset = random32() % (size * BITS_PER_BYTE);
+
+	__change_bit(offset, data);
+}
+
+static unsigned char data[512];
+static unsigned char error_data[512];
+
+static int nand_ecc_test(const size_t size)
+{
+	unsigned char code[3];
+	unsigned char error_code[3];
+	char testname[30];
+
+	BUG_ON(sizeof(data) < size);
+
+	sprintf(testname, "nand-ecc-%zu", size);
+
+	get_random_bytes(data, size);
+
+	memcpy(error_data, data, size);
+	inject_single_bit_error(error_data, size);
+
+	__nand_calculate_ecc(data, size, code);
+	__nand_calculate_ecc(error_data, size, error_code);
+	__nand_correct_data(error_data, code, error_code, size);
+
+	if (!memcmp(data, error_data, size)) {
+		printk(KERN_INFO "mtd_nandecctest: ok - %s\n", testname);
+		return 0;
+	}
+
+	printk(KERN_ERR "mtd_nandecctest: not ok - %s\n", testname);
+
+	printk(KERN_DEBUG "hexdump of data:\n");
+	print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_OFFSET, 16, 4,
+			data, size, false);
+	printk(KERN_DEBUG "hexdump of error data:\n");
+	print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_OFFSET, 16, 4,
+			error_data, size, false);
+
+	return -1;
+}
+
+#else
+
+static int nand_ecc_test(const size_t size)
+{
+	return 0;
+}
+
+#endif
+
+static int __init ecc_test_init(void)
+{
+	srandom32(jiffies);
+
+	nand_ecc_test(256);
+	nand_ecc_test(512);
+
+	return 0;
+}
+
+static void __exit ecc_test_exit(void)
+{
+}
+
+module_init(ecc_test_init);
+module_exit(ecc_test_exit);
+
+MODULE_DESCRIPTION("NAND ECC function test module");
+MODULE_AUTHOR("Akinobu Mita");
+MODULE_LICENSE("GPL");
diff --git a/drivers/mtd/tests/mtd_oobtest.c b/drivers/mtd/tests/mtd_oobtest.c
index 5553cd4eab20..5813920e79a5 100644
--- a/drivers/mtd/tests/mtd_oobtest.c
+++ b/drivers/mtd/tests/mtd_oobtest.c
@@ -343,7 +343,6 @@ static int scan_for_bad_eraseblocks(void)
 		printk(PRINT_PREF "error: cannot allocate memory\n");
 		return -ENOMEM;
 	}
-	memset(bbt, 0 , ebcnt);
 
 	printk(PRINT_PREF "scanning for bad eraseblocks\n");
 	for (i = 0; i < ebcnt; ++i) {
@@ -392,7 +391,6 @@ static int __init mtd_oobtest_init(void)
 	       mtd->writesize, ebcnt, pgcnt, mtd->oobsize);
 
 	err = -ENOMEM;
-	mtd->erasesize = mtd->erasesize;
 	readbuf = kmalloc(mtd->erasesize, GFP_KERNEL);
 	if (!readbuf) {
 		printk(PRINT_PREF "error: cannot allocate memory\n");
@@ -476,18 +474,10 @@ static int __init mtd_oobtest_init(void)
 	use_len_max = mtd->ecclayout->oobavail;
 	vary_offset = 1;
 	simple_srand(5);
-	printk(PRINT_PREF "writing OOBs of whole device\n");
-	for (i = 0; i < ebcnt; ++i) {
-		if (bbt[i])
-			continue;
-		err = write_eraseblock(i);
-		if (err)
-			goto out;
-		if (i % 256 == 0)
-			printk(PRINT_PREF "written up to eraseblock %u\n", i);
-		cond_resched();
-	}
-	printk(PRINT_PREF "written %u eraseblocks\n", i);
+
+	err = write_whole_device();
+	if (err)
+		goto out;
 
 	/* Check all eraseblocks */
 	use_offset = 0;
diff --git a/drivers/mtd/tests/mtd_pagetest.c b/drivers/mtd/tests/mtd_pagetest.c
index 103cac480fee..ce17cbe918c5 100644
--- a/drivers/mtd/tests/mtd_pagetest.c
+++ b/drivers/mtd/tests/mtd_pagetest.c
@@ -523,6 +523,7 @@ static int __init mtd_pagetest_init(void)
 	do_div(tmp, mtd->erasesize);
 	ebcnt = tmp;
 	pgcnt = mtd->erasesize / mtd->writesize;
+	pgsize = mtd->writesize;
 
 	printk(PRINT_PREF "MTD device size %llu, eraseblock size %u, "
 	       "page size %u, count of eraseblocks %u, pages per "
diff --git a/drivers/mtd/ubi/Kconfig b/drivers/mtd/ubi/Kconfig
index b1cd7a1a2191..0a8c7ea764ae 100644
--- a/drivers/mtd/ubi/Kconfig
+++ b/drivers/mtd/ubi/Kconfig
@@ -1,5 +1,3 @@
-# drivers/mtd/ubi/Kconfig
-
 menu "UBI - Unsorted block images"
 	depends on MTD
 
diff --git a/drivers/mtd/ubi/kapi.c b/drivers/mtd/ubi/kapi.c
index 88a72e9c8beb..277786ebaa2c 100644
--- a/drivers/mtd/ubi/kapi.c
+++ b/drivers/mtd/ubi/kapi.c
@@ -22,6 +22,8 @@
 
 #include <linux/module.h>
 #include <linux/err.h>
+#include <linux/namei.h>
+#include <linux/fs.h>
 #include <asm/div64.h>
 #include "ubi.h"
 
@@ -280,6 +282,44 @@ struct ubi_volume_desc *ubi_open_volume_nm(int ubi_num, const char *name,
 EXPORT_SYMBOL_GPL(ubi_open_volume_nm);
 
 /**
+ * ubi_open_volume_path - open UBI volume by its character device node path.
+ * @pathname: volume character device node path
+ * @mode: open mode
+ *
+ * This function is similar to 'ubi_open_volume()', but opens a volume the path
+ * to its character device node.
+ */
+struct ubi_volume_desc *ubi_open_volume_path(const char *pathname, int mode)
+{
+	int error, ubi_num, vol_id;
+	struct ubi_volume_desc *ret;
+	struct inode *inode;
+	struct path path;
+
+	dbg_gen("open volume %s, mode %d", pathname, mode);
+
+	if (!pathname || !*pathname)
+		return ERR_PTR(-EINVAL);
+
+	error = kern_path(pathname, LOOKUP_FOLLOW, &path);
+	if (error)
+		return ERR_PTR(error);
+
+	inode = path.dentry->d_inode;
+	ubi_num = ubi_major2num(imajor(inode));
+	vol_id = iminor(inode) - 1;
+
+	if (vol_id >= 0 && ubi_num >= 0)
+		ret = ubi_open_volume(ubi_num, vol_id, mode);
+	else
+		ret = ERR_PTR(-ENODEV);
+
+	path_put(&path);
+	return ret;
+}
+EXPORT_SYMBOL_GPL(ubi_open_volume_path);
+
+/**
  * ubi_close_volume - close UBI volume.
  * @desc: volume descriptor
  */
diff --git a/drivers/mtd/ubi/upd.c b/drivers/mtd/ubi/upd.c
index 74fdc40c8627..c1d7b880c795 100644
--- a/drivers/mtd/ubi/upd.c
+++ b/drivers/mtd/ubi/upd.c
@@ -147,12 +147,14 @@ int ubi_start_update(struct ubi_device *ubi, struct ubi_volume *vol,
 	}
 
 	if (bytes == 0) {
+		err = ubi_wl_flush(ubi);
+		if (err)
+			return err;
+
 		err = clear_update_marker(ubi, vol, 0);
 		if (err)
 			return err;
-		err = ubi_wl_flush(ubi);
-		if (!err)
-			vol->updating = 0;
+		vol->updating = 0;
 	}
 
 	vol->upd_buf = vmalloc(ubi->leb_size);
@@ -362,16 +364,16 @@ int ubi_more_update_data(struct ubi_device *ubi, struct ubi_volume *vol,
 
 	ubi_assert(vol->upd_received <= vol->upd_bytes);
 	if (vol->upd_received == vol->upd_bytes) {
+		err = ubi_wl_flush(ubi);
+		if (err)
+			return err;
 		/* The update is finished, clear the update marker */
 		err = clear_update_marker(ubi, vol, vol->upd_bytes);
 		if (err)
 			return err;
-		err = ubi_wl_flush(ubi);
-		if (err == 0) {
-			vol->updating = 0;
-			err = to_write;
-			vfree(vol->upd_buf);
-		}
+		vol->updating = 0;
+		err = to_write;
+		vfree(vol->upd_buf);
 	}
 
 	return err;
diff --git a/drivers/net/3c507.c b/drivers/net/3c507.c
index fbc231153e55..77cf0901a441 100644
--- a/drivers/net/3c507.c
+++ b/drivers/net/3c507.c
@@ -56,6 +56,7 @@ static const char version[] =
 #include <linux/errno.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
+#include <linux/if_ether.h>
 #include <linux/skbuff.h>
 #include <linux/slab.h>
 #include <linux/init.h>
@@ -734,8 +735,7 @@ static void init_82586_mem(struct net_device *dev)
 	memcpy_toio(lp->base, init_words + 5, sizeof(init_words) - 10);
 
 	/* Fill in the station address. */
-	memcpy_toio(lp->base+SA_OFFSET, dev->dev_addr,
-		   sizeof(dev->dev_addr));
+	memcpy_toio(lp->base+SA_OFFSET, dev->dev_addr, ETH_ALEN);
 
 	/* The Tx-block list is written as needed.  We just set up the values. */
 	lp->tx_cmd_link = IDLELOOP + 4;
diff --git a/drivers/net/3c59x.c b/drivers/net/3c59x.c
index 78b7167a8ce3..39db0e96815d 100644
--- a/drivers/net/3c59x.c
+++ b/drivers/net/3c59x.c
@@ -837,7 +837,7 @@ static int vortex_resume(struct device *dev)
 	return 0;
 }
 
-static struct dev_pm_ops vortex_pm_ops = {
+static const struct dev_pm_ops vortex_pm_ops = {
 	.suspend = vortex_suspend,
 	.resume = vortex_resume,
 	.freeze = vortex_suspend,
diff --git a/drivers/net/82596.c b/drivers/net/82596.c
index ea6b139b812c..1663bc9e45de 100644
--- a/drivers/net/82596.c
+++ b/drivers/net/82596.c
@@ -19,7 +19,7 @@
    TBD:
    * look at deferring rx frames rather than discarding (as per tulip)
    * handle tx ring full as per tulip
-   * performace test to tune rx_copybreak
+   * performance test to tune rx_copybreak
 
    Most of my modifications relate to the braindead big-endian
    implementation by Intel.  When the i596 is operating in
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index 18ff622703be..dd9a09c72dff 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -1953,6 +1953,8 @@ config BCM63XX_ENET
 
 source "drivers/net/fs_enet/Kconfig"
 
+source "drivers/net/octeon/Kconfig"
+
 endif # NET_ETHERNET
 
 #
@@ -2698,6 +2700,7 @@ config NETXEN_NIC
 config NIU
 	tristate "Sun Neptune 10Gbit Ethernet support"
 	depends on PCI
+	select CRC32
 	help
 	  This enables support for cards based upon Sun's
 	  Neptune chipset.
diff --git a/drivers/net/Makefile b/drivers/net/Makefile
index 246323d7f161..ad1346dd9da9 100644
--- a/drivers/net/Makefile
+++ b/drivers/net/Makefile
@@ -285,3 +285,5 @@ obj-$(CONFIG_VIRTIO_NET) += virtio_net.o
 obj-$(CONFIG_SFC) += sfc/
 
 obj-$(CONFIG_WIMAX) += wimax/
+
+obj-$(CONFIG_OCTEON_MGMT_ETHERNET) += octeon/
diff --git a/drivers/net/amd8111e.c b/drivers/net/amd8111e.c
index 4e6359fff0e1..766aabfdfc75 100644
--- a/drivers/net/amd8111e.c
+++ b/drivers/net/amd8111e.c
@@ -1633,8 +1633,13 @@ static int amd8111e_enable_link_change(struct amd8111e_priv* lp)
 	readl(lp->mmio + CMD7);
 	return 0;
 }
-/* This function is called when a packet transmission fails to complete within a  resonable period, on the assumption that an interrupts have been failed or the  interface is locked up. This function will reinitialize the hardware */
 
+/*
+ * This function is called when a packet transmission fails to complete
+ * within a reasonable period, on the assumption that an interrupt have
+ * failed or the interface is locked up. This function will reinitialize
+ * the hardware.
+ */
 static void amd8111e_tx_timeout(struct net_device *dev)
 {
 	struct amd8111e_priv* lp = netdev_priv(dev);
diff --git a/drivers/net/appletalk/cops.c b/drivers/net/appletalk/cops.c
index 50cecf417471..73b38c204eb9 100644
--- a/drivers/net/appletalk/cops.c
+++ b/drivers/net/appletalk/cops.c
@@ -120,7 +120,7 @@ static int irq = 5;		/* Default IRQ */
  *      DAYNA driver mode:
  *              Dayna DL2000/DaynaTalk PC (Half Length), COPS LT-95, 
  *		Farallon PhoneNET PC III, Farallon PhoneNET PC II
- *	Other cards possibly supported mode unkown though:
+ *	Other cards possibly supported mode unknown though:
  *		Dayna DL2000 (Full length), COPS LT/M (Micro-Channel)
  *
  *	Cards NOT supported by this driver but supported by the ltpc.c
diff --git a/drivers/net/ariadne.h b/drivers/net/ariadne.h
index bb613f292e04..727be5cdd1ea 100644
--- a/drivers/net/ariadne.h
+++ b/drivers/net/ariadne.h
@@ -244,7 +244,7 @@ struct Am79C960 {
 #define DLNKTST		0x0010	/* Disable Link Status */
 #define DAPC		0x0008	/* Disable Automatic Polarity Correction */
 #define MENDECL		0x0004	/* MENDEC Loopback Mode */
-#define LRTTSEL		0x0002	/* Low Receive Treshold/Transmit Mode Select */
+#define LRTTSEL		0x0002	/* Low Receive Threshold/Transmit Mode Select */
 #define PORTSEL1	0x0001	/* Port Select Bits */
 #define PORTSEL2	0x8000	/* Port Select Bits */
 #define INTL		0x4000	/* Internal Loopback */
diff --git a/drivers/net/arm/Kconfig b/drivers/net/arm/Kconfig
index c37ee9e6b67b..39e1c0d39476 100644
--- a/drivers/net/arm/Kconfig
+++ b/drivers/net/arm/Kconfig
@@ -68,6 +68,7 @@ config W90P910_ETH
 	tristate "Nuvoton w90p910 Ethernet support"
 	depends on ARM && ARCH_W90X900
 	select PHYLIB
+	select MII
 	help
 	  Say Y here if you want to use built-in Ethernet ports
 	  on w90p910 processor.
diff --git a/drivers/net/arm/ixp4xx_eth.c b/drivers/net/arm/ixp4xx_eth.c
index 691b81eb0f46..c3dfbdd2cdcf 100644
--- a/drivers/net/arm/ixp4xx_eth.c
+++ b/drivers/net/arm/ixp4xx_eth.c
@@ -322,7 +322,7 @@ static int ixp4xx_mdio_write(struct mii_bus *bus, int phy_id, int location,
 	ret = ixp4xx_mdio_cmd(bus, phy_id, location, 1, val);
 	spin_unlock_irqrestore(&mdio_lock, flags);
 #if DEBUG_MDIO
-	printk(KERN_DEBUG "%s #%i: MII read [%i] <- 0x%X, err = %i\n",
+	printk(KERN_DEBUG "%s #%i: MII write [%i] <- 0x%X, err = %i\n",
 	       bus->name, phy_id, location, val, ret);
 #endif
 	return ret;
diff --git a/drivers/net/atarilance.c b/drivers/net/atarilance.c
index c5721cb38265..cc9ed8643910 100644
--- a/drivers/net/atarilance.c
+++ b/drivers/net/atarilance.c
@@ -663,7 +663,7 @@ static int lance_open( struct net_device *dev )
 	while (--i > 0)
 		if (DREG & CSR0_IDON)
 			break;
-	if (i < 0 || (DREG & CSR0_ERR)) {
+	if (i <= 0 || (DREG & CSR0_ERR)) {
 		DPRINTK( 2, ( "lance_open(): opening %s failed, i=%d, csr0=%04x\n",
 					  dev->name, i, DREG ));
 		DREG = CSR0_STOP;
diff --git a/drivers/net/atl1c/atl1c_main.c b/drivers/net/atl1c/atl1c_main.c
index 666261b5851e..2f4be59b9c0b 100644
--- a/drivers/net/atl1c/atl1c_main.c
+++ b/drivers/net/atl1c/atl1c_main.c
@@ -1541,7 +1541,7 @@ static irqreturn_t atl1c_intr(int irq, void *data)
 		if (status & ISR_OVER)
 			if (netif_msg_intr(adapter))
 				dev_warn(&pdev->dev,
-					"TX/RX over flow (status = 0x%x)\n",
+					"TX/RX overflow (status = 0x%x)\n",
 					status & ISR_OVER);
 
 		/* link event */
diff --git a/drivers/net/atlx/atl2.c b/drivers/net/atlx/atl2.c
index c0451d75cdcf..ec52529394ad 100644
--- a/drivers/net/atlx/atl2.c
+++ b/drivers/net/atlx/atl2.c
@@ -1959,12 +1959,15 @@ static int atl2_get_eeprom(struct net_device *netdev,
 		return -ENOMEM;
 
 	for (i = first_dword; i < last_dword; i++) {
-		if (!atl2_read_eeprom(hw, i*4, &(eeprom_buff[i-first_dword])))
-			return -EIO;
+		if (!atl2_read_eeprom(hw, i*4, &(eeprom_buff[i-first_dword]))) {
+			ret_val = -EIO;
+			goto free;
+		}
 	}
 
 	memcpy(bytes, (u8 *)eeprom_buff + (eeprom->offset & 3),
 		eeprom->len);
+free:
 	kfree(eeprom_buff);
 
 	return ret_val;
diff --git a/drivers/net/ax88796.c b/drivers/net/ax88796.c
index 62d9c9cc5671..1dd4403247ca 100644
--- a/drivers/net/ax88796.c
+++ b/drivers/net/ax88796.c
@@ -921,7 +921,7 @@ static int ax_probe(struct platform_device *pdev)
  		size = (res->end - res->start) + 1;
 
 		ax->mem2 = request_mem_region(res->start, size, pdev->name);
-		if (ax->mem == NULL) {
+		if (ax->mem2 == NULL) {
 			dev_err(&pdev->dev, "cannot reserve registers\n");
 			ret = -ENXIO;
 			goto exit_mem1;
diff --git a/drivers/net/bcm63xx_enet.c b/drivers/net/bcm63xx_enet.c
index 1f6c5486d715..0bd47d32ec42 100644
--- a/drivers/net/bcm63xx_enet.c
+++ b/drivers/net/bcm63xx_enet.c
@@ -1245,9 +1245,15 @@ static void bcm_enet_get_drvinfo(struct net_device *netdev,
 	drvinfo->n_stats = BCM_ENET_STATS_LEN;
 }
 
-static int bcm_enet_get_stats_count(struct net_device *netdev)
+static int bcm_enet_get_sset_count(struct net_device *netdev,
+					int string_set)
 {
-	return BCM_ENET_STATS_LEN;
+	switch (string_set) {
+	case ETH_SS_STATS:
+		return BCM_ENET_STATS_LEN;
+	default:
+		return -EINVAL;
+	}
 }
 
 static void bcm_enet_get_strings(struct net_device *netdev,
@@ -1473,7 +1479,7 @@ static int bcm_enet_set_pauseparam(struct net_device *dev,
 
 static struct ethtool_ops bcm_enet_ethtool_ops = {
 	.get_strings		= bcm_enet_get_strings,
-	.get_stats_count	= bcm_enet_get_stats_count,
+	.get_sset_count		= bcm_enet_get_sset_count,
 	.get_ethtool_stats      = bcm_enet_get_ethtool_stats,
 	.get_settings		= bcm_enet_get_settings,
 	.set_settings		= bcm_enet_set_settings,
diff --git a/drivers/net/benet/be.h b/drivers/net/benet/be.h
index 9e56014d27ed..5bc74590c73e 100644
--- a/drivers/net/benet/be.h
+++ b/drivers/net/benet/be.h
@@ -275,8 +275,14 @@ struct be_adapter {
 	u32 tx_fc;		/* Tx flow control */
 	int link_speed;
 	u8 port_type;
+	u8 transceiver;
+	u8 generation;		/* BladeEngine ASIC generation */
 };
 
+/* BladeEngine Generation numbers */
+#define BE_GEN2 2
+#define BE_GEN3 3
+
 extern const struct ethtool_ops be_ethtool_ops;
 
 #define drvr_stats(adapter)		(&adapter->stats.drvr_stats)
diff --git a/drivers/net/benet/be_cmds.c b/drivers/net/benet/be_cmds.c
index 1b68bd98dc0c..fee6eee7ae5b 100644
--- a/drivers/net/benet/be_cmds.c
+++ b/drivers/net/benet/be_cmds.c
@@ -286,7 +286,7 @@ static void be_wrb_hdr_prepare(struct be_mcc_wrb *wrb, int payload_len,
 				MCC_WRB_SGE_CNT_SHIFT;
 	wrb->payload_length = payload_len;
 	wrb->tag0 = opcode;
-	be_dws_cpu_to_le(wrb, 20);
+	be_dws_cpu_to_le(wrb, 8);
 }
 
 /* Don't touch the hdr after it's prepared */
@@ -1479,6 +1479,41 @@ err:
 	return status;
 }
 
+int be_cmd_set_loopback(struct be_adapter *adapter, u8 port_num,
+			u8 loopback_type, u8 enable)
+{
+	struct be_mcc_wrb *wrb;
+	struct be_cmd_req_set_lmode *req;
+	int status;
+
+	spin_lock_bh(&adapter->mcc_lock);
+
+	wrb = wrb_from_mccq(adapter);
+	if (!wrb) {
+		status = -EBUSY;
+		goto err;
+	}
+
+	req = embedded_payload(wrb);
+
+	be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0,
+				OPCODE_LOWLEVEL_SET_LOOPBACK_MODE);
+
+	be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_LOWLEVEL,
+			OPCODE_LOWLEVEL_SET_LOOPBACK_MODE,
+			sizeof(*req));
+
+	req->src_port = port_num;
+	req->dest_port = port_num;
+	req->loopback_type = loopback_type;
+	req->loopback_state = enable;
+
+	status = be_mcc_notify_wait(adapter);
+err:
+	spin_unlock_bh(&adapter->mcc_lock);
+	return status;
+}
+
 int be_cmd_loopback_test(struct be_adapter *adapter, u32 port_num,
 		u32 loopback_type, u32 pkt_size, u32 num_pkts, u64 pattern)
 {
@@ -1501,6 +1536,7 @@ int be_cmd_loopback_test(struct be_adapter *adapter, u32 port_num,
 
 	be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_LOWLEVEL,
 			OPCODE_LOWLEVEL_LOOPBACK_TEST, sizeof(*req));
+	req->hdr.timeout = 4;
 
 	req->pattern = cpu_to_le64(pattern);
 	req->src_port = cpu_to_le32(port_num);
diff --git a/drivers/net/benet/be_cmds.h b/drivers/net/benet/be_cmds.h
index e7323be507d0..13b33c841083 100644
--- a/drivers/net/benet/be_cmds.h
+++ b/drivers/net/benet/be_cmds.h
@@ -155,6 +155,7 @@ struct be_mcc_mailbox {
 
 #define OPCODE_LOWLEVEL_HOST_DDR_DMA                    17
 #define OPCODE_LOWLEVEL_LOOPBACK_TEST                   18
+#define OPCODE_LOWLEVEL_SET_LOOPBACK_MODE		19
 
 struct be_cmd_req_hdr {
 	u8 opcode;		/* dword 0 */
@@ -163,7 +164,8 @@ struct be_cmd_req_hdr {
 	u8 domain;		/* dword 0 */
 	u32 timeout;		/* dword 1 */
 	u32 request_length;	/* dword 2 */
-	u32 rsvd;		/* dword 3 */
+	u8 version;		/* dword 3 */
+	u8 rsvd[3];		/* dword 3 */
 };
 
 #define RESP_HDR_INFO_OPCODE_SHIFT	0	/* bits 0 - 7 */
@@ -444,7 +446,7 @@ enum be_if_flags {
  * filtering capabilities. */
 struct be_cmd_req_if_create {
 	struct be_cmd_req_hdr hdr;
-	u32 version;		/* ignore currntly */
+	u32 version;		/* ignore currently */
 	u32 capability_flags;
 	u32 enable_flags;
 	u8 mac_addr[ETH_ALEN];
@@ -821,6 +823,19 @@ struct be_cmd_resp_loopback_test {
 	u32    ticks_compl;
 };
 
+struct be_cmd_req_set_lmode {
+	struct be_cmd_req_hdr hdr;
+	u8 src_port;
+	u8 dest_port;
+	u8 loopback_type;
+	u8 loopback_state;
+};
+
+struct be_cmd_resp_set_lmode {
+	struct be_cmd_resp_hdr resp_hdr;
+	u8 rsvd0[4];
+};
+
 /********************** DDR DMA test *********************/
 struct be_cmd_req_ddrdma_test {
 	struct be_cmd_req_hdr hdr;
@@ -912,3 +927,5 @@ extern int be_cmd_loopback_test(struct be_adapter *adapter, u32 port_num,
 				u32 num_pkts, u64 pattern);
 extern int be_cmd_ddr_dma_test(struct be_adapter *adapter, u64 pattern,
 			u32 byte_cnt, struct be_dma_mem *cmd);
+extern int be_cmd_set_loopback(struct be_adapter *adapter, u8 port_num,
+				u8 loopback_type, u8 enable);
diff --git a/drivers/net/benet/be_ethtool.c b/drivers/net/benet/be_ethtool.c
index 298b92cbd689..5d001c4deac1 100644
--- a/drivers/net/benet/be_ethtool.c
+++ b/drivers/net/benet/be_ethtool.c
@@ -118,6 +118,7 @@ static const char et_self_tests[][ETH_GSTRING_LEN] = {
 #define BE_MAC_LOOPBACK 0x0
 #define BE_PHY_LOOPBACK 0x1
 #define BE_ONE_PORT_EXT_LOOPBACK 0x2
+#define BE_NO_LOOPBACK 0xff
 
 static void
 be_get_drvinfo(struct net_device *netdev, struct ethtool_drvinfo *drvinfo)
@@ -339,28 +340,50 @@ static int be_get_settings(struct net_device *netdev, struct ethtool_cmd *ecmd)
 
 		status = be_cmd_read_port_type(adapter, adapter->port_num,
 						&connector);
-		switch (connector) {
-		case 7:
-			ecmd->port = PORT_FIBRE;
-			break;
-		default:
-			ecmd->port = PORT_TP;
-			break;
+		if (!status) {
+			switch (connector) {
+			case 7:
+				ecmd->port = PORT_FIBRE;
+				ecmd->transceiver = XCVR_EXTERNAL;
+				break;
+			case 0:
+				ecmd->port = PORT_TP;
+				ecmd->transceiver = XCVR_EXTERNAL;
+				break;
+			default:
+				ecmd->port = PORT_TP;
+				ecmd->transceiver = XCVR_INTERNAL;
+				break;
+			}
+		} else {
+			ecmd->port = PORT_AUI;
+			ecmd->transceiver = XCVR_INTERNAL;
 		}
 
 		/* Save for future use */
 		adapter->link_speed = ecmd->speed;
 		adapter->port_type = ecmd->port;
+		adapter->transceiver = ecmd->transceiver;
 	} else {
 		ecmd->speed = adapter->link_speed;
 		ecmd->port = adapter->port_type;
+		ecmd->transceiver = adapter->transceiver;
 	}
 
 	ecmd->duplex = DUPLEX_FULL;
 	ecmd->autoneg = AUTONEG_DISABLE;
-	ecmd->supported = (SUPPORTED_10000baseT_Full | SUPPORTED_TP);
 	ecmd->phy_address = adapter->port_num;
-	ecmd->transceiver = XCVR_INTERNAL;
+	switch (ecmd->port) {
+	case PORT_FIBRE:
+		ecmd->supported = (SUPPORTED_10000baseT_Full | SUPPORTED_FIBRE);
+		break;
+	case PORT_TP:
+		ecmd->supported = (SUPPORTED_10000baseT_Full | SUPPORTED_TP);
+		break;
+	case PORT_AUI:
+		ecmd->supported = (SUPPORTED_10000baseT_Full | SUPPORTED_AUI);
+		break;
+	}
 
 	return 0;
 }
@@ -489,6 +512,19 @@ err:
 	return ret;
 }
 
+static u64 be_loopback_test(struct be_adapter *adapter, u8 loopback_type,
+				u64 *status)
+{
+	be_cmd_set_loopback(adapter, adapter->port_num,
+				loopback_type, 1);
+	*status = be_cmd_loopback_test(adapter, adapter->port_num,
+				loopback_type, 1500,
+				2, 0xabc);
+	be_cmd_set_loopback(adapter, adapter->port_num,
+				BE_NO_LOOPBACK, 1);
+	return *status;
+}
+
 static void
 be_self_test(struct net_device *netdev, struct ethtool_test *test, u64 *data)
 {
@@ -497,23 +533,18 @@ be_self_test(struct net_device *netdev, struct ethtool_test *test, u64 *data)
 	memset(data, 0, sizeof(u64) * ETHTOOL_TESTS_NUM);
 
 	if (test->flags & ETH_TEST_FL_OFFLINE) {
-		data[0] = be_cmd_loopback_test(adapter, adapter->port_num,
-						BE_MAC_LOOPBACK, 1500,
-						2, 0xabc);
-		if (data[0] != 0)
+		if (be_loopback_test(adapter, BE_MAC_LOOPBACK,
+						&data[0]) != 0) {
 			test->flags |= ETH_TEST_FL_FAILED;
-
-		data[1] = be_cmd_loopback_test(adapter, adapter->port_num,
-						BE_PHY_LOOPBACK, 1500,
-						2, 0xabc);
-		if (data[1] != 0)
+		}
+		if (be_loopback_test(adapter, BE_PHY_LOOPBACK,
+						&data[1]) != 0) {
 			test->flags |= ETH_TEST_FL_FAILED;
-
-		data[2] = be_cmd_loopback_test(adapter, adapter->port_num,
-						BE_ONE_PORT_EXT_LOOPBACK,
-						1500, 2, 0xabc);
-		if (data[2] != 0)
+		}
+		if (be_loopback_test(adapter, BE_ONE_PORT_EXT_LOOPBACK,
+						&data[2]) != 0) {
 			test->flags |= ETH_TEST_FL_FAILED;
+		}
 
 		data[3] = be_test_ddr_dma(adapter);
 		if (data[3] != 0)
diff --git a/drivers/net/benet/be_main.c b/drivers/net/benet/be_main.c
index 957a0f7f2764..626b76c0ebc7 100644
--- a/drivers/net/benet/be_main.c
+++ b/drivers/net/benet/be_main.c
@@ -759,7 +759,7 @@ static void be_rx_compl_process(struct be_adapter *adapter,
 
 	/* vlanf could be wrongly set in some cards.
 	 * ignore if vtm is not set */
-	if ((adapter->cap == 0x400) && !vtm)
+	if ((adapter->cap & 0x400) && !vtm)
 		vlanf = 0;
 
 	skb = netdev_alloc_skb_ip_align(adapter->netdev, BE_HDR_LEN);
@@ -816,7 +816,7 @@ static void be_rx_compl_process_gro(struct be_adapter *adapter,
 
 	/* vlanf could be wrongly set in some cards.
 	 * ignore if vtm is not set */
-	if ((adapter->cap == 0x400) && !vtm)
+	if ((adapter->cap & 0x400) && !vtm)
 		vlanf = 0;
 
 	skb = napi_get_frags(&eq_obj->napi);
@@ -910,7 +910,7 @@ static inline struct page *be_alloc_pages(u32 size)
 static void be_post_rx_frags(struct be_adapter *adapter)
 {
 	struct be_rx_page_info *page_info_tbl = adapter->rx_obj.page_info_tbl;
-	struct be_rx_page_info *page_info = NULL;
+	struct be_rx_page_info *page_info = NULL, *prev_page_info = NULL;
 	struct be_queue_info *rxq = &adapter->rx_obj.q;
 	struct page *pagep = NULL;
 	struct be_eth_rx_d *rxd;
@@ -941,7 +941,6 @@ static void be_post_rx_frags(struct be_adapter *adapter)
 		rxd = queue_head_node(rxq);
 		rxd->fragpa_lo = cpu_to_le32(frag_dmaaddr & 0xFFFFFFFF);
 		rxd->fragpa_hi = cpu_to_le32(upper_32_bits(frag_dmaaddr));
-		queue_head_inc(rxq);
 
 		/* Any space left in the current big page for another frag? */
 		if ((page_offset + rx_frag_size + rx_frag_size) >
@@ -949,10 +948,13 @@ static void be_post_rx_frags(struct be_adapter *adapter)
 			pagep = NULL;
 			page_info->last_page_user = true;
 		}
+
+		prev_page_info = page_info;
+		queue_head_inc(rxq);
 		page_info = &page_info_tbl[rxq->head];
 	}
 	if (pagep)
-		page_info->last_page_user = true;
+		prev_page_info->last_page_user = true;
 
 	if (posted) {
 		atomic_add(posted, &rxq->used);
@@ -1348,7 +1350,7 @@ static irqreturn_t be_intx(int irq, void *dev)
 	int isr;
 
 	isr = ioread32(adapter->csr + CEV_ISR0_OFFSET +
-			be_pci_func(adapter) * CEV_ISR_SIZE);
+		(adapter->tx_eq.q.id/ 8) * CEV_ISR_SIZE);
 	if (!isr)
 		return IRQ_NONE;
 
@@ -1982,7 +1984,7 @@ int be_load_fw(struct be_adapter *adapter, u8 *func)
 		goto fw_exit;
 	}
 
-	dev_info(&adapter->pdev->dev, "Firmware flashed succesfully\n");
+	dev_info(&adapter->pdev->dev, "Firmware flashed successfully\n");
 
 fw_exit:
 	release_firmware(fw);
@@ -2049,6 +2051,7 @@ static void be_unmap_pci_bars(struct be_adapter *adapter)
 static int be_map_pci_bars(struct be_adapter *adapter)
 {
 	u8 __iomem *addr;
+	int pcicfg_reg;
 
 	addr = ioremap_nocache(pci_resource_start(adapter->pdev, 2),
 			pci_resource_len(adapter->pdev, 2));
@@ -2062,8 +2065,13 @@ static int be_map_pci_bars(struct be_adapter *adapter)
 		goto pci_map_err;
 	adapter->db = addr;
 
-	addr = ioremap_nocache(pci_resource_start(adapter->pdev, 1),
-			pci_resource_len(adapter->pdev, 1));
+	if (adapter->generation == BE_GEN2)
+		pcicfg_reg = 1;
+	else
+		pcicfg_reg = 0;
+
+	addr = ioremap_nocache(pci_resource_start(adapter->pdev, pcicfg_reg),
+			pci_resource_len(adapter->pdev, pcicfg_reg));
 	if (addr == NULL)
 		goto pci_map_err;
 	adapter->pcicfg = addr;
@@ -2160,6 +2168,7 @@ static int be_stats_init(struct be_adapter *adapter)
 	cmd->va = pci_alloc_consistent(adapter->pdev, cmd->size, &cmd->dma);
 	if (cmd->va == NULL)
 		return -1;
+	memset(cmd->va, 0, cmd->size);
 	return 0;
 }
 
@@ -2238,6 +2247,20 @@ static int __devinit be_probe(struct pci_dev *pdev,
 		goto rel_reg;
 	}
 	adapter = netdev_priv(netdev);
+
+	switch (pdev->device) {
+	case BE_DEVICE_ID1:
+	case OC_DEVICE_ID1:
+		adapter->generation = BE_GEN2;
+		break;
+	case BE_DEVICE_ID2:
+	case OC_DEVICE_ID2:
+		adapter->generation = BE_GEN3;
+		break;
+	default:
+		adapter->generation = 0;
+	}
+
 	adapter->pdev = pdev;
 	pci_set_drvdata(pdev, adapter);
 	adapter->netdev = netdev;
diff --git a/drivers/net/bfin_mac.c b/drivers/net/bfin_mac.c
index 8ffea3990d07..0b23bc4f56c6 100644
--- a/drivers/net/bfin_mac.c
+++ b/drivers/net/bfin_mac.c
@@ -33,6 +33,7 @@
 #include <asm/dma.h>
 #include <linux/dma-mapping.h>
 
+#include <asm/dpmc.h>
 #include <asm/blackfin.h>
 #include <asm/cacheflush.h>
 #include <asm/portmux.h>
@@ -386,8 +387,8 @@ static int mii_probe(struct net_device *dev)
 	u32 sclk, mdc_div;
 
 	/* Enable PHY output early */
-	if (!(bfin_read_VR_CTL() & PHYCLKOE))
-		bfin_write_VR_CTL(bfin_read_VR_CTL() | PHYCLKOE);
+	if (!(bfin_read_VR_CTL() & CLKBUFOE))
+		bfin_write_VR_CTL(bfin_read_VR_CTL() | CLKBUFOE);
 
 	sclk = get_sclk();
 	mdc_div = ((sclk / MDC_CLK) / 2) - 1;
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index 4bfc80812926..65df1de447e4 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -653,12 +653,20 @@ static void
 bnx2_netif_stop(struct bnx2 *bp)
 {
 	bnx2_cnic_stop(bp);
-	bnx2_disable_int_sync(bp);
 	if (netif_running(bp->dev)) {
+		int i;
+
 		bnx2_napi_disable(bp);
 		netif_tx_disable(bp->dev);
-		bp->dev->trans_start = jiffies;	/* prevent tx timeout */
+		/* prevent tx timeout */
+		for (i = 0; i <  bp->dev->num_tx_queues; i++) {
+			struct netdev_queue *txq;
+
+			txq = netdev_get_tx_queue(bp->dev, i);
+			txq->trans_start = jiffies;
+		}
 	}
+	bnx2_disable_int_sync(bp);
 }
 
 static void
diff --git a/drivers/net/bnx2x_main.c b/drivers/net/bnx2x_main.c
index 77ba13520d87..306c2b8165e2 100644
--- a/drivers/net/bnx2x_main.c
+++ b/drivers/net/bnx2x_main.c
@@ -7593,6 +7593,8 @@ static int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
 		if (bp->cnic_eth_dev.drv_state & CNIC_DRV_STATE_REGD) {
 			bnx2x_set_iscsi_eth_mac_addr(bp, 1);
 			bp->cnic_flags |= BNX2X_CNIC_FLAG_MAC_SET;
+			bnx2x_init_sb(bp, bp->cnic_sb, bp->cnic_sb_mapping,
+				      CNIC_SB_ID(bp));
 		}
 		mutex_unlock(&bp->cnic_mutex);
 #endif
diff --git a/drivers/net/bnx2x_reg.h b/drivers/net/bnx2x_reg.h
index b668173ffcb4..944964e78c81 100644
--- a/drivers/net/bnx2x_reg.h
+++ b/drivers/net/bnx2x_reg.h
@@ -2536,7 +2536,7 @@
 /* [RC 1] A flag to indicate that overflow error occurred in one of the
    queues. */
 #define QM_REG_OVFERROR 					 0x16805c
-/* [RC 7] the Q were the qverflow occurs */
+/* [RC 7] the Q where the overflow occurs */
 #define QM_REG_OVFQNUM						 0x168058
 /* [R 16] Pause state for physical queues 15-0 */
 #define QM_REG_PAUSESTATE0					 0x168410
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index d69e6838f21e..822f586d72af 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -20,6 +20,8 @@
  *
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/skbuff.h>
 #include <linux/if_ether.h>
 #include <linux/netdevice.h>
@@ -352,7 +354,8 @@ static u16 __get_link_speed(struct port *port)
 		}
 	}
 
-	pr_debug("Port %d Received link speed %d update from adapter\n", port->actor_port_number, speed);
+	pr_debug("Port %d Received link speed %d update from adapter\n",
+		 port->actor_port_number, speed);
 	return speed;
 }
 
@@ -378,12 +381,14 @@ static u8 __get_duplex(struct port *port)
 		switch (slave->duplex) {
 		case DUPLEX_FULL:
 			retval=0x1;
-			pr_debug("Port %d Received status full duplex update from adapter\n", port->actor_port_number);
+			pr_debug("Port %d Received status full duplex update from adapter\n",
+				 port->actor_port_number);
 			break;
 		case DUPLEX_HALF:
 		default:
 			retval=0x0;
-			pr_debug("Port %d Received status NOT full duplex update from adapter\n", port->actor_port_number);
+			pr_debug("Port %d Received status NOT full duplex update from adapter\n",
+				 port->actor_port_number);
 			break;
 		}
 	}
@@ -980,7 +985,9 @@ static void ad_mux_machine(struct port *port)
 
 	// check if the state machine was changed
 	if (port->sm_mux_state != last_state) {
-		pr_debug("Mux Machine: Port=%d, Last State=%d, Curr State=%d\n", port->actor_port_number, last_state, port->sm_mux_state);
+		pr_debug("Mux Machine: Port=%d, Last State=%d, Curr State=%d\n",
+			 port->actor_port_number, last_state,
+			 port->sm_mux_state);
 		switch (port->sm_mux_state) {
 		case AD_MUX_DETACHED:
 			__detach_bond_from_agg(port);
@@ -1079,7 +1086,9 @@ static void ad_rx_machine(struct lacpdu *lacpdu, struct port *port)
 
 	// check if the State machine was changed or new lacpdu arrived
 	if ((port->sm_rx_state != last_state) || (lacpdu)) {
-		pr_debug("Rx Machine: Port=%d, Last State=%d, Curr State=%d\n", port->actor_port_number, last_state, port->sm_rx_state);
+		pr_debug("Rx Machine: Port=%d, Last State=%d, Curr State=%d\n",
+			 port->actor_port_number, last_state,
+			 port->sm_rx_state);
 		switch (port->sm_rx_state) {
 		case AD_RX_INITIALIZE:
 			if (!(port->actor_oper_port_key & AD_DUPLEX_KEY_BITS)) {
@@ -1126,9 +1135,8 @@ static void ad_rx_machine(struct lacpdu *lacpdu, struct port *port)
 			// detect loopback situation
 			if (!MAC_ADDRESS_COMPARE(&(lacpdu->actor_system), &(port->actor_system))) {
 				// INFO_RECEIVED_LOOPBACK_FRAMES
-				pr_err(DRV_NAME ": %s: An illegal loopback occurred on "
-				       "adapter (%s). Check the configuration to verify that all "
-				       "Adapters are connected to 802.3ad compliant switch ports\n",
+				pr_err("%s: An illegal loopback occurred on adapter (%s).\n"
+				       "Check the configuration to verify that all adapters are connected to 802.3ad compliant switch ports\n",
 				       port->slave->dev->master->name, port->slave->dev->name);
 				__release_rx_machine_lock(port);
 				return;
@@ -1166,7 +1174,8 @@ static void ad_tx_machine(struct port *port)
 			__update_lacpdu_from_port(port);
 
 			if (ad_lacpdu_send(port) >= 0) {
-				pr_debug("Sent LACPDU on port %d\n", port->actor_port_number);
+				pr_debug("Sent LACPDU on port %d\n",
+					 port->actor_port_number);
 
 				/* mark ntt as false, so it will not be sent again until
 				   demanded */
@@ -1241,7 +1250,9 @@ static void ad_periodic_machine(struct port *port)
 
 	// check if the state machine was changed
 	if (port->sm_periodic_state != last_state) {
-		pr_debug("Periodic Machine: Port=%d, Last State=%d, Curr State=%d\n", port->actor_port_number, last_state, port->sm_periodic_state);
+		pr_debug("Periodic Machine: Port=%d, Last State=%d, Curr State=%d\n",
+			 port->actor_port_number, last_state,
+			 port->sm_periodic_state);
 		switch (port->sm_periodic_state) {
 		case AD_NO_PERIODIC:
 			port->sm_periodic_timer_counter = 0;	   // zero timer
@@ -1298,7 +1309,9 @@ static void ad_port_selection_logic(struct port *port)
 				port->next_port_in_aggregator=NULL;
 				port->actor_port_aggregator_identifier=0;
 
-				pr_debug("Port %d left LAG %d\n", port->actor_port_number, temp_aggregator->aggregator_identifier);
+				pr_debug("Port %d left LAG %d\n",
+					 port->actor_port_number,
+					 temp_aggregator->aggregator_identifier);
 				// if the aggregator is empty, clear its parameters, and set it ready to be attached
 				if (!temp_aggregator->lag_ports) {
 					ad_clear_agg(temp_aggregator);
@@ -1307,9 +1320,7 @@ static void ad_port_selection_logic(struct port *port)
 			}
 		}
 		if (!curr_port) { // meaning: the port was related to an aggregator but was not on the aggregator port list
-			pr_warning(DRV_NAME ": %s: Warning: Port %d (on %s) "
-				   "was related to aggregator %d but was not "
-				   "on its port list\n",
+			pr_warning("%s: Warning: Port %d (on %s) was related to aggregator %d but was not on its port list\n",
 				   port->slave->dev->master->name,
 				   port->actor_port_number,
 				   port->slave->dev->name,
@@ -1343,7 +1354,9 @@ static void ad_port_selection_logic(struct port *port)
 			port->next_port_in_aggregator=aggregator->lag_ports;
 			port->aggregator->num_of_ports++;
 			aggregator->lag_ports=port;
-			pr_debug("Port %d joined LAG %d(existing LAG)\n", port->actor_port_number, port->aggregator->aggregator_identifier);
+			pr_debug("Port %d joined LAG %d(existing LAG)\n",
+				 port->actor_port_number,
+				 port->aggregator->aggregator_identifier);
 
 			// mark this port as selected
 			port->sm_vars |= AD_PORT_SELECTED;
@@ -1380,10 +1393,11 @@ static void ad_port_selection_logic(struct port *port)
 			// mark this port as selected
 			port->sm_vars |= AD_PORT_SELECTED;
 
-			pr_debug("Port %d joined LAG %d(new LAG)\n", port->actor_port_number, port->aggregator->aggregator_identifier);
+			pr_debug("Port %d joined LAG %d(new LAG)\n",
+				 port->actor_port_number,
+				 port->aggregator->aggregator_identifier);
 		} else {
-			pr_err(DRV_NAME ": %s: Port %d (on %s) did not find "
-			       "a suitable aggregator\n",
+			pr_err("%s: Port %d (on %s) did not find a suitable aggregator\n",
 			       port->slave->dev->master->name,
 			       port->actor_port_number, port->slave->dev->name);
 		}
@@ -1460,8 +1474,7 @@ static struct aggregator *ad_agg_selection_test(struct aggregator *best,
 		break;
 
 	default:
-		pr_warning(DRV_NAME
-			   ": %s: Impossible agg select mode %d\n",
+		pr_warning("%s: Impossible agg select mode %d\n",
 			   curr->slave->dev->master->name,
 			   __get_agg_selection_mode(curr->lag_ports));
 		break;
@@ -1546,40 +1559,38 @@ static void ad_agg_selection_logic(struct aggregator *agg)
 	// if there is new best aggregator, activate it
 	if (best) {
 		pr_debug("best Agg=%d; P=%d; a k=%d; p k=%d; Ind=%d; Act=%d\n",
-		       best->aggregator_identifier, best->num_of_ports,
-		       best->actor_oper_aggregator_key,
-		       best->partner_oper_aggregator_key,
-		       best->is_individual, best->is_active);
+			 best->aggregator_identifier, best->num_of_ports,
+			 best->actor_oper_aggregator_key,
+			 best->partner_oper_aggregator_key,
+			 best->is_individual, best->is_active);
 		pr_debug("best ports %p slave %p %s\n",
-		       best->lag_ports, best->slave,
-		       best->slave ? best->slave->dev->name : "NULL");
+			 best->lag_ports, best->slave,
+			 best->slave ? best->slave->dev->name : "NULL");
 
 		for (agg = __get_first_agg(best->lag_ports); agg;
 		     agg = __get_next_agg(agg)) {
 
 			pr_debug("Agg=%d; P=%d; a k=%d; p k=%d; Ind=%d; Act=%d\n",
-				agg->aggregator_identifier, agg->num_of_ports,
-				agg->actor_oper_aggregator_key,
-				agg->partner_oper_aggregator_key,
-				agg->is_individual, agg->is_active);
+				 agg->aggregator_identifier, agg->num_of_ports,
+				 agg->actor_oper_aggregator_key,
+				 agg->partner_oper_aggregator_key,
+				 agg->is_individual, agg->is_active);
 		}
 
 		// check if any partner replys
 		if (best->is_individual) {
-			pr_warning(DRV_NAME ": %s: Warning: No 802.3ad"
-			       " response from the link partner for any"
-			       " adapters in the bond\n",
-			       best->slave->dev->master->name);
+			pr_warning("%s: Warning: No 802.3ad response from the link partner for any adapters in the bond\n",
+				   best->slave ? best->slave->dev->master->name : "NULL");
 		}
 
 		best->is_active = 1;
 		pr_debug("LAG %d chosen as the active LAG\n",
-			best->aggregator_identifier);
+			 best->aggregator_identifier);
 		pr_debug("Agg=%d; P=%d; a k=%d; p k=%d; Ind=%d; Act=%d\n",
-			best->aggregator_identifier, best->num_of_ports,
-			best->actor_oper_aggregator_key,
-			best->partner_oper_aggregator_key,
-			best->is_individual, best->is_active);
+			 best->aggregator_identifier, best->num_of_ports,
+			 best->actor_oper_aggregator_key,
+			 best->partner_oper_aggregator_key,
+			 best->is_individual, best->is_active);
 
 		// disable the ports that were related to the former active_aggregator
 		if (active) {
@@ -1633,7 +1644,8 @@ static void ad_clear_agg(struct aggregator *aggregator)
 		aggregator->lag_ports = NULL;
 		aggregator->is_active = 0;
 		aggregator->num_of_ports = 0;
-		pr_debug("LAG %d was cleared\n", aggregator->aggregator_identifier);
+		pr_debug("LAG %d was cleared\n",
+			 aggregator->aggregator_identifier);
 	}
 }
 
@@ -1728,7 +1740,9 @@ static void ad_initialize_port(struct port *port, int lacp_fast)
 static void ad_enable_collecting_distributing(struct port *port)
 {
 	if (port->aggregator->is_active) {
-		pr_debug("Enabling port %d(LAG %d)\n", port->actor_port_number, port->aggregator->aggregator_identifier);
+		pr_debug("Enabling port %d(LAG %d)\n",
+			 port->actor_port_number,
+			 port->aggregator->aggregator_identifier);
 		__enable_port(port);
 	}
 }
@@ -1741,7 +1755,9 @@ static void ad_enable_collecting_distributing(struct port *port)
 static void ad_disable_collecting_distributing(struct port *port)
 {
 	if (port->aggregator && MAC_ADDRESS_COMPARE(&(port->aggregator->partner_system), &(null_mac_addr))) {
-		pr_debug("Disabling port %d(LAG %d)\n", port->actor_port_number, port->aggregator->aggregator_identifier);
+		pr_debug("Disabling port %d(LAG %d)\n",
+			 port->actor_port_number,
+			 port->aggregator->aggregator_identifier);
 		__disable_port(port);
 	}
 }
@@ -1779,7 +1795,8 @@ static void ad_marker_info_send(struct port *port)
 
 	// send the marker information
 	if (ad_marker_send(port, &marker) >= 0) {
-		pr_debug("Sent Marker Information on port %d\n", port->actor_port_number);
+		pr_debug("Sent Marker Information on port %d\n",
+			 port->actor_port_number);
 	}
 }
 #endif
@@ -1803,7 +1820,8 @@ static void ad_marker_info_received(struct bond_marker *marker_info,
 	// send the marker response
 
 	if (ad_marker_send(port, &marker) >= 0) {
-		pr_debug("Sent Marker Response on port %d\n", port->actor_port_number);
+		pr_debug("Sent Marker Response on port %d\n",
+			 port->actor_port_number);
 	}
 }
 
@@ -1889,8 +1907,7 @@ int bond_3ad_bind_slave(struct slave *slave)
 	struct aggregator *aggregator;
 
 	if (bond == NULL) {
-		pr_err(DRV_NAME ": %s: The slave %s is not attached to "
-		       "its bond\n",
+		pr_err("%s: The slave %s is not attached to its bond\n",
 		       slave->dev->master->name, slave->dev->name);
 		return -1;
 	}
@@ -1966,13 +1983,13 @@ void bond_3ad_unbind_slave(struct slave *slave)
 
 	// if slave is null, the whole port is not initialized
 	if (!port->slave) {
-		pr_warning(DRV_NAME ": Warning: %s: Trying to "
-			   "unbind an uninitialized port on %s\n",
+		pr_warning("Warning: %s: Trying to unbind an uninitialized port on %s\n",
 			   slave->dev->master->name, slave->dev->name);
 		return;
 	}
 
-	pr_debug("Unbinding Link Aggregation Group %d\n", aggregator->aggregator_identifier);
+	pr_debug("Unbinding Link Aggregation Group %d\n",
+		 aggregator->aggregator_identifier);
 
 	/* Tell the partner that this port is not suitable for aggregation */
 	port->actor_oper_port_state &= ~AD_STATE_AGGREGATION;
@@ -1996,10 +2013,12 @@ void bond_3ad_unbind_slave(struct slave *slave)
 			// if new aggregator found, copy the aggregator's parameters
 			// and connect the related lag_ports to the new aggregator
 			if ((new_aggregator) && ((!new_aggregator->lag_ports) || ((new_aggregator->lag_ports == port) && !new_aggregator->lag_ports->next_port_in_aggregator))) {
-				pr_debug("Some port(s) related to LAG %d - replaceing with LAG %d\n", aggregator->aggregator_identifier, new_aggregator->aggregator_identifier);
+				pr_debug("Some port(s) related to LAG %d - replaceing with LAG %d\n",
+					 aggregator->aggregator_identifier,
+					 new_aggregator->aggregator_identifier);
 
 				if ((new_aggregator->lag_ports == port) && new_aggregator->is_active) {
-					pr_info(DRV_NAME ": %s: Removing an active aggregator\n",
+					pr_info("%s: Removing an active aggregator\n",
 						aggregator->slave->dev->master->name);
 					// select new active aggregator
 					 select_new_active_agg = 1;
@@ -2030,8 +2049,7 @@ void bond_3ad_unbind_slave(struct slave *slave)
 					ad_agg_selection_logic(__get_first_agg(port));
 				}
 			} else {
-				pr_warning(DRV_NAME ": %s: Warning: unbinding aggregator, "
-					   "and could not find a new aggregator for its ports\n",
+				pr_warning("%s: Warning: unbinding aggregator, and could not find a new aggregator for its ports\n",
 					   slave->dev->master->name);
 			}
 		} else { // in case that the only port related to this aggregator is the one we want to remove
@@ -2039,7 +2057,7 @@ void bond_3ad_unbind_slave(struct slave *slave)
 			// clear the aggregator
 			ad_clear_agg(aggregator);
 			if (select_new_active_agg) {
-				pr_info(DRV_NAME ": %s: Removing an active aggregator\n",
+				pr_info("%s: Removing an active aggregator\n",
 					slave->dev->master->name);
 				// select new active aggregator
 				ad_agg_selection_logic(__get_first_agg(port));
@@ -2066,7 +2084,7 @@ void bond_3ad_unbind_slave(struct slave *slave)
 					// clear the aggregator
 					ad_clear_agg(temp_aggregator);
 					if (select_new_active_agg) {
-						pr_info(DRV_NAME ": %s: Removing an active aggregator\n",
+						pr_info("%s: Removing an active aggregator\n",
 							slave->dev->master->name);
 						// select new active aggregator
 						ad_agg_selection_logic(__get_first_agg(port));
@@ -2115,8 +2133,8 @@ void bond_3ad_state_machine_handler(struct work_struct *work)
 		// select the active aggregator for the bond
 		if ((port = __get_first_port(bond))) {
 			if (!port->slave) {
-				pr_warning(DRV_NAME ": %s: Warning: bond's first port is "
-					   "uninitialized\n", bond->dev->name);
+				pr_warning("%s: Warning: bond's first port is uninitialized\n",
+					   bond->dev->name);
 				goto re_arm;
 			}
 
@@ -2129,8 +2147,8 @@ void bond_3ad_state_machine_handler(struct work_struct *work)
 	// for each port run the state machines
 	for (port = __get_first_port(bond); port; port = __get_next_port(port)) {
 		if (!port->slave) {
-			pr_warning(DRV_NAME ": %s: Warning: Found an uninitialized "
-				   "port\n", bond->dev->name);
+			pr_warning("%s: Warning: Found an uninitialized port\n",
+				   bond->dev->name);
 			goto re_arm;
 		}
 
@@ -2171,15 +2189,15 @@ static void bond_3ad_rx_indication(struct lacpdu *lacpdu, struct slave *slave, u
 		port = &(SLAVE_AD_INFO(slave).port);
 
 		if (!port->slave) {
-			pr_warning(DRV_NAME ": %s: Warning: port of slave %s "
-				   "is uninitialized\n",
+			pr_warning("%s: Warning: port of slave %s is uninitialized\n",
 				   slave->dev->name, slave->dev->master->name);
 			return;
 		}
 
 		switch (lacpdu->subtype) {
 		case AD_TYPE_LACPDU:
-			pr_debug("Received LACPDU on port %d\n", port->actor_port_number);
+			pr_debug("Received LACPDU on port %d\n",
+				 port->actor_port_number);
 			ad_rx_machine(lacpdu, port);
 			break;
 
@@ -2188,17 +2206,20 @@ static void bond_3ad_rx_indication(struct lacpdu *lacpdu, struct slave *slave, u
 
 			switch (((struct bond_marker *)lacpdu)->tlv_type) {
 			case AD_MARKER_INFORMATION_SUBTYPE:
-				pr_debug("Received Marker Information on port %d\n", port->actor_port_number);
+				pr_debug("Received Marker Information on port %d\n",
+					 port->actor_port_number);
 				ad_marker_info_received((struct bond_marker *)lacpdu, port);
 				break;
 
 			case AD_MARKER_RESPONSE_SUBTYPE:
-				pr_debug("Received Marker Response on port %d\n", port->actor_port_number);
+				pr_debug("Received Marker Response on port %d\n",
+					 port->actor_port_number);
 				ad_marker_response_received((struct bond_marker *)lacpdu, port);
 				break;
 
 			default:
-				pr_debug("Received an unknown Marker subtype on slot %d\n", port->actor_port_number);
+				pr_debug("Received an unknown Marker subtype on slot %d\n",
+					 port->actor_port_number);
 			}
 		}
 	}
@@ -2218,8 +2239,7 @@ void bond_3ad_adapter_speed_changed(struct slave *slave)
 
 	// if slave is null, the whole port is not initialized
 	if (!port->slave) {
-		pr_warning(DRV_NAME ": Warning: %s: speed "
-			   "changed for uninitialized port on %s\n",
+		pr_warning("Warning: %s: speed changed for uninitialized port on %s\n",
 			   slave->dev->master->name, slave->dev->name);
 		return;
 	}
@@ -2246,8 +2266,7 @@ void bond_3ad_adapter_duplex_changed(struct slave *slave)
 
 	// if slave is null, the whole port is not initialized
 	if (!port->slave) {
-		pr_warning(DRV_NAME ": %s: Warning: duplex changed "
-			   "for uninitialized port on %s\n",
+		pr_warning("%s: Warning: duplex changed for uninitialized port on %s\n",
 			   slave->dev->master->name, slave->dev->name);
 		return;
 	}
@@ -2275,8 +2294,7 @@ void bond_3ad_handle_link_change(struct slave *slave, char link)
 
 	// if slave is null, the whole port is not initialized
 	if (!port->slave) {
-		pr_warning(DRV_NAME ": Warning: %s: link status changed for "
-			   "uninitialized port on %s\n",
+		pr_warning("Warning: %s: link status changed for uninitialized port on %s\n",
 			   slave->dev->master->name, slave->dev->name);
 		return;
 	}
@@ -2381,8 +2399,8 @@ int bond_3ad_xmit_xor(struct sk_buff *skb, struct net_device *dev)
 	}
 
 	if (bond_3ad_get_active_agg_info(bond, &ad_info)) {
-		pr_debug(DRV_NAME ": %s: Error: "
-			 "bond_3ad_get_active_agg_info failed\n", dev->name);
+		pr_debug("%s: Error: bond_3ad_get_active_agg_info failed\n",
+			 dev->name);
 		goto out;
 	}
 
@@ -2391,8 +2409,7 @@ int bond_3ad_xmit_xor(struct sk_buff *skb, struct net_device *dev)
 
 	if (slaves_in_agg == 0) {
 		/*the aggregator is empty*/
-		pr_debug(DRV_NAME ": %s: Error: active aggregator is empty\n",
-			 dev->name);
+		pr_debug("%s: Error: active aggregator is empty\n", dev->name);
 		goto out;
 	}
 
@@ -2410,8 +2427,8 @@ int bond_3ad_xmit_xor(struct sk_buff *skb, struct net_device *dev)
 	}
 
 	if (slave_agg_no >= 0) {
-		pr_err(DRV_NAME ": %s: Error: Couldn't find a slave to tx on "
-		       "for aggregator ID %d\n", dev->name, agg_id);
+		pr_err("%s: Error: Couldn't find a slave to tx on for aggregator ID %d\n",
+		       dev->name, agg_id);
 		goto out;
 	}
 
diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
index 0d30d1e5e53f..40fdc41446cc 100644
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c
@@ -20,6 +20,8 @@
  *
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
@@ -201,8 +203,7 @@ static int tlb_initialize(struct bonding *bond)
 
 	new_hashtbl = kzalloc(size, GFP_KERNEL);
 	if (!new_hashtbl) {
-		pr_err(DRV_NAME
-		       ": %s: Error: Failed to allocate TLB hash table\n",
+		pr_err("%s: Error: Failed to allocate TLB hash table\n",
 		       bond->dev->name);
 		return -1;
 	}
@@ -514,8 +515,7 @@ static void rlb_update_client(struct rlb_client_info *client_info)
 				 client_info->slave->dev->dev_addr,
 				 client_info->mac_dst);
 		if (!skb) {
-			pr_err(DRV_NAME
-			       ": %s: Error: failed to create an ARP packet\n",
+			pr_err("%s: Error: failed to create an ARP packet\n",
 			       client_info->slave->dev->master->name);
 			continue;
 		}
@@ -525,8 +525,7 @@ static void rlb_update_client(struct rlb_client_info *client_info)
 		if (client_info->tag) {
 			skb = vlan_put_tag(skb, client_info->vlan_id);
 			if (!skb) {
-				pr_err(DRV_NAME
-				       ": %s: Error: failed to insert VLAN tag\n",
+				pr_err("%s: Error: failed to insert VLAN tag\n",
 				       client_info->slave->dev->master->name);
 				continue;
 			}
@@ -556,7 +555,7 @@ static void rlb_update_rx_clients(struct bonding *bond)
 		}
 	}
 
-	/* do not update the entries again untill this counter is zero so that
+	/* do not update the entries again until this counter is zero so that
 	 * not to confuse the clients.
 	 */
 	bond_info->rlb_update_delay_counter = RLB_UPDATE_DELAY;
@@ -609,9 +608,7 @@ static void rlb_req_update_subnet_clients(struct bonding *bond, __be32 src_ip)
 		client_info = &(bond_info->rx_hashtbl[hash_index]);
 
 		if (!client_info->slave) {
-			pr_err(DRV_NAME
-			       ": %s: Error: found a client with no channel in "
-			       "the client's hash table\n",
+			pr_err("%s: Error: found a client with no channel in the client's hash table\n",
 			       bond->dev->name);
 			continue;
 		}
@@ -806,8 +803,7 @@ static int rlb_initialize(struct bonding *bond)
 
 	new_hashtbl = kmalloc(size, GFP_KERNEL);
 	if (!new_hashtbl) {
-		pr_err(DRV_NAME
-		       ": %s: Error: Failed to allocate RLB hash table\n",
+		pr_err("%s: Error: Failed to allocate RLB hash table\n",
 		       bond->dev->name);
 		return -1;
 	}
@@ -928,8 +924,7 @@ static void alb_send_learning_packets(struct slave *slave, u8 mac_addr[])
 
 			skb = vlan_put_tag(skb, vlan->vlan_id);
 			if (!skb) {
-				pr_err(DRV_NAME
-				       ": %s: Error: failed to insert VLAN tag\n",
+				pr_err("%s: Error: failed to insert VLAN tag\n",
 				       bond->dev->name);
 				continue;
 			}
@@ -958,11 +953,8 @@ static int alb_set_slave_mac_addr(struct slave *slave, u8 addr[], int hw)
 	memcpy(s_addr.sa_data, addr, dev->addr_len);
 	s_addr.sa_family = dev->type;
 	if (dev_set_mac_address(dev, &s_addr)) {
-		pr_err(DRV_NAME
-		       ": %s: Error: dev_set_mac_address of dev %s failed! ALB "
-		       "mode requires that the base driver support setting "
-		       "the hw address also when the network device's "
-		       "interface is open\n",
+		pr_err("%s: Error: dev_set_mac_address of dev %s failed!\n"
+		       "ALB mode requires that the base driver support setting the hw address also when the network device's interface is open\n",
 		       dev->master->name, dev->name);
 		return -EOPNOTSUPP;
 	}
@@ -1169,18 +1161,12 @@ static int alb_handle_addr_collision_on_attach(struct bonding *bond, struct slav
 		alb_set_slave_mac_addr(slave, free_mac_slave->perm_hwaddr,
 				       bond->alb_info.rlb_enabled);
 
-		pr_warning(DRV_NAME
-			   ": %s: Warning: the hw address of slave %s is "
-			   "in use by the bond; giving it the hw address "
-			   "of %s\n",
+		pr_warning("%s: Warning: the hw address of slave %s is in use by the bond; giving it the hw address of %s\n",
 			   bond->dev->name, slave->dev->name,
 			   free_mac_slave->dev->name);
 
 	} else if (has_bond_addr) {
-		pr_err(DRV_NAME
-		       ": %s: Error: the hw address of slave %s is in use by the "
-		       "bond; couldn't find a slave with a free hw address to "
-		       "give it (this should not have happened)\n",
+		pr_err("%s: Error: the hw address of slave %s is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened)\n",
 		       bond->dev->name, slave->dev->name);
 		return -EFAULT;
 	}
diff --git a/drivers/net/bonding/bond_ipv6.c b/drivers/net/bonding/bond_ipv6.c
index b72e1dc8cf8f..6dd64cf3cb76 100644
--- a/drivers/net/bonding/bond_ipv6.c
+++ b/drivers/net/bonding/bond_ipv6.c
@@ -20,6 +20,8 @@
  *
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/types.h>
 #include <linux/if_vlan.h>
 #include <net/ipv6.h>
@@ -74,20 +76,20 @@ static void bond_na_send(struct net_device *slave_dev,
 	addrconf_addr_solict_mult(daddr, &mcaddr);
 
 	pr_debug("ipv6 na on slave %s: dest %pI6, src %pI6\n",
-	       slave_dev->name, &mcaddr, daddr);
+		 slave_dev->name, &mcaddr, daddr);
 
 	skb = ndisc_build_skb(slave_dev, &mcaddr, daddr, &icmp6h, daddr,
 			      ND_OPT_TARGET_LL_ADDR);
 
 	if (!skb) {
-		pr_err(DRV_NAME ": NA packet allocation failed\n");
+		pr_err("NA packet allocation failed\n");
 		return;
 	}
 
 	if (vlan_id) {
 		skb = vlan_put_tag(skb, vlan_id);
 		if (!skb) {
-			pr_err(DRV_NAME ": failed to insert VLAN tag\n");
+			pr_err("failed to insert VLAN tag\n");
 			return;
 		}
 	}
@@ -109,8 +111,8 @@ void bond_send_unsolicited_na(struct bonding *bond)
 	struct inet6_dev *idev;
 	int is_router;
 
-	pr_debug("bond_send_unsol_na: bond %s slave %s\n", bond->dev->name,
-				slave ? slave->dev->name : "NULL");
+	pr_debug("%s: bond %s slave %s\n", bond->dev->name,
+		 __func__, slave ? slave->dev->name : "NULL");
 
 	if (!slave || !bond->send_unsol_na ||
 	    test_bit(__LINK_STATE_LINKWATCH_PENDING, &slave->dev->state))
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index af9b9c4eb496..efa0e41bf3ec 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -31,6 +31,8 @@
  *
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/types.h>
@@ -260,7 +262,7 @@ static int bond_add_vlan(struct bonding *bond, unsigned short vlan_id)
 	struct vlan_entry *vlan;
 
 	pr_debug("bond: %s, vlan id %d\n",
-		(bond ? bond->dev->name : "None"), vlan_id);
+		 (bond ? bond->dev->name : "None"), vlan_id);
 
 	vlan = kzalloc(sizeof(struct vlan_entry), GFP_KERNEL);
 	if (!vlan)
@@ -303,8 +305,8 @@ static int bond_del_vlan(struct bonding *bond, unsigned short vlan_id)
 			if (bond_is_lb(bond))
 				bond_alb_clear_vlan(bond, vlan_id);
 
-			pr_debug("removed VLAN ID %d from bond %s\n", vlan_id,
-				bond->dev->name);
+			pr_debug("removed VLAN ID %d from bond %s\n",
+				 vlan_id, bond->dev->name);
 
 			kfree(vlan);
 
@@ -323,8 +325,8 @@ static int bond_del_vlan(struct bonding *bond, unsigned short vlan_id)
 		}
 	}
 
-	pr_debug("couldn't find VLAN ID %d in bond %s\n", vlan_id,
-		bond->dev->name);
+	pr_debug("couldn't find VLAN ID %d in bond %s\n",
+		 vlan_id, bond->dev->name);
 
 out:
 	write_unlock_bh(&bond->lock);
@@ -348,7 +350,7 @@ static int bond_has_challenged_slaves(struct bonding *bond)
 	bond_for_each_slave(bond, slave, i) {
 		if (slave->dev->features & NETIF_F_VLAN_CHALLENGED) {
 			pr_debug("found VLAN challenged slave - %s\n",
-				slave->dev->name);
+				 slave->dev->name);
 			return 1;
 		}
 	}
@@ -499,8 +501,7 @@ static void bond_vlan_rx_add_vid(struct net_device *bond_dev, uint16_t vid)
 
 	res = bond_add_vlan(bond, vid);
 	if (res) {
-		pr_err(DRV_NAME
-		       ": %s: Error: Failed to add vlan id %d\n",
+		pr_err("%s: Error: Failed to add vlan id %d\n",
 		       bond_dev->name, vid);
 	}
 }
@@ -534,8 +535,7 @@ static void bond_vlan_rx_kill_vid(struct net_device *bond_dev, uint16_t vid)
 
 	res = bond_del_vlan(bond, vid);
 	if (res) {
-		pr_err(DRV_NAME
-		       ": %s: Error: Failed to remove vlan id %d\n",
+		pr_err("%s: Error: Failed to remove vlan id %d\n",
 		       bond_dev->name, vid);
 	}
 }
@@ -1053,8 +1053,7 @@ static void bond_do_fail_over_mac(struct bonding *bond,
 
 		rv = dev_set_mac_address(new_active->dev, &saddr);
 		if (rv) {
-			pr_err(DRV_NAME
-			       ": %s: Error %d setting MAC of slave %s\n",
+			pr_err("%s: Error %d setting MAC of slave %s\n",
 			       bond->dev->name, -rv, new_active->dev->name);
 			goto out;
 		}
@@ -1067,16 +1066,14 @@ static void bond_do_fail_over_mac(struct bonding *bond,
 
 		rv = dev_set_mac_address(old_active->dev, &saddr);
 		if (rv)
-			pr_err(DRV_NAME
-			       ": %s: Error %d setting MAC of slave %s\n",
+			pr_err("%s: Error %d setting MAC of slave %s\n",
 			       bond->dev->name, -rv, new_active->dev->name);
 out:
 		read_lock(&bond->lock);
 		write_lock_bh(&bond->curr_slave_lock);
 		break;
 	default:
-		pr_err(DRV_NAME
-		       ": %s: bond_do_fail_over_mac impossible: bad policy %d\n",
+		pr_err("%s: bond_do_fail_over_mac impossible: bad policy %d\n",
 		       bond->dev->name, bond->params.fail_over_mac);
 		break;
 	}
@@ -1178,11 +1175,9 @@ void bond_change_active_slave(struct bonding *bond, struct slave *new_active)
 
 		if (new_active->link == BOND_LINK_BACK) {
 			if (USES_PRIMARY(bond->params.mode)) {
-				pr_info(DRV_NAME
-				       ": %s: making interface %s the new "
-				       "active one %d ms earlier.\n",
-				       bond->dev->name, new_active->dev->name,
-				       (bond->params.updelay - new_active->delay) * bond->params.miimon);
+				pr_info("%s: making interface %s the new active one %d ms earlier.\n",
+					bond->dev->name, new_active->dev->name,
+					(bond->params.updelay - new_active->delay) * bond->params.miimon);
 			}
 
 			new_active->delay = 0;
@@ -1195,10 +1190,8 @@ void bond_change_active_slave(struct bonding *bond, struct slave *new_active)
 				bond_alb_handle_link_change(bond, new_active, BOND_LINK_UP);
 		} else {
 			if (USES_PRIMARY(bond->params.mode)) {
-				pr_info(DRV_NAME
-				       ": %s: making interface %s the new "
-				       "active one.\n",
-				       bond->dev->name, new_active->dev->name);
+				pr_info("%s: making interface %s the new active one.\n",
+					bond->dev->name, new_active->dev->name);
 			}
 		}
 	}
@@ -1268,13 +1261,11 @@ void bond_select_active_slave(struct bonding *bond)
 			return;
 
 		if (netif_carrier_ok(bond->dev)) {
-			pr_info(DRV_NAME
-			       ": %s: first active interface up!\n",
-			       bond->dev->name);
+			pr_info("%s: first active interface up!\n",
+				bond->dev->name);
 		} else {
-			pr_info(DRV_NAME ": %s: "
-			       "now running without any active interface !\n",
-			       bond->dev->name);
+			pr_info("%s: now running without any active interface !\n",
+				bond->dev->name);
 		}
 	}
 }
@@ -1423,16 +1414,14 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
 
 	if (!bond->params.use_carrier && slave_dev->ethtool_ops == NULL &&
 		slave_ops->ndo_do_ioctl == NULL) {
-		pr_warning(DRV_NAME
-		       ": %s: Warning: no link monitoring support for %s\n",
-		       bond_dev->name, slave_dev->name);
+		pr_warning("%s: Warning: no link monitoring support for %s\n",
+			   bond_dev->name, slave_dev->name);
 	}
 
 	/* bond must be initialized by bond_open() before enslaving */
 	if (!(bond_dev->flags & IFF_UP)) {
-		pr_warning(DRV_NAME
-			" %s: master_dev is not up in bond_enslave\n",
-			bond_dev->name);
+		pr_warning("%s: master_dev is not up in bond_enslave\n",
+			   bond_dev->name);
 	}
 
 	/* already enslaved */
@@ -1446,19 +1435,13 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
 	if (slave_dev->features & NETIF_F_VLAN_CHALLENGED) {
 		pr_debug("%s: NETIF_F_VLAN_CHALLENGED\n", slave_dev->name);
 		if (!list_empty(&bond->vlan_list)) {
-			pr_err(DRV_NAME
-			       ": %s: Error: cannot enslave VLAN "
-			       "challenged slave %s on VLAN enabled "
-			       "bond %s\n", bond_dev->name, slave_dev->name,
-			       bond_dev->name);
+			pr_err("%s: Error: cannot enslave VLAN challenged slave %s on VLAN enabled bond %s\n",
+			       bond_dev->name, slave_dev->name, bond_dev->name);
 			return -EPERM;
 		} else {
-			pr_warning(DRV_NAME
-			       ": %s: Warning: enslaved VLAN challenged "
-			       "slave %s. Adding VLANs will be blocked as "
-			       "long as %s is part of bond %s\n",
-			       bond_dev->name, slave_dev->name, slave_dev->name,
-			       bond_dev->name);
+			pr_warning("%s: Warning: enslaved VLAN challenged slave %s. Adding VLANs will be blocked as long as %s is part of bond %s\n",
+				   bond_dev->name, slave_dev->name,
+				   slave_dev->name, bond_dev->name);
 			bond_dev->features |= NETIF_F_VLAN_CHALLENGED;
 		}
 	} else {
@@ -1478,8 +1461,7 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
 	 * enslaving it; the old ifenslave will not.
 	 */
 	if ((slave_dev->flags & IFF_UP)) {
-		pr_err(DRV_NAME ": %s is up. "
-		       "This may be due to an out of date ifenslave.\n",
+		pr_err("%s is up. This may be due to an out of date ifenslave.\n",
 		       slave_dev->name);
 		res = -EPERM;
 		goto err_undo_flags;
@@ -1495,7 +1477,8 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
 	if (bond->slave_cnt == 0) {
 		if (bond_dev->type != slave_dev->type) {
 			pr_debug("%s: change device type from %d to %d\n",
-				bond_dev->name, bond_dev->type, slave_dev->type);
+				 bond_dev->name,
+				 bond_dev->type, slave_dev->type);
 
 			netdev_bonding_change(bond_dev, NETDEV_BONDING_OLDTYPE);
 
@@ -1507,28 +1490,21 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
 			netdev_bonding_change(bond_dev, NETDEV_BONDING_NEWTYPE);
 		}
 	} else if (bond_dev->type != slave_dev->type) {
-		pr_err(DRV_NAME ": %s ether type (%d) is different "
-			"from other slaves (%d), can not enslave it.\n",
-			slave_dev->name,
-			slave_dev->type, bond_dev->type);
-			res = -EINVAL;
-			goto err_undo_flags;
+		pr_err("%s ether type (%d) is different from other slaves (%d), can not enslave it.\n",
+		       slave_dev->name,
+		       slave_dev->type, bond_dev->type);
+		res = -EINVAL;
+		goto err_undo_flags;
 	}
 
 	if (slave_ops->ndo_set_mac_address == NULL) {
 		if (bond->slave_cnt == 0) {
-			pr_warning(DRV_NAME
-			       ": %s: Warning: The first slave device "
-			       "specified does not support setting the MAC "
-			       "address. Setting fail_over_mac to active.",
-			       bond_dev->name);
+			pr_warning("%s: Warning: The first slave device specified does not support setting the MAC address. Setting fail_over_mac to active.",
+				   bond_dev->name);
 			bond->params.fail_over_mac = BOND_FOM_ACTIVE;
 		} else if (bond->params.fail_over_mac != BOND_FOM_ACTIVE) {
-			pr_err(DRV_NAME
-				": %s: Error: The slave device specified "
-				"does not support setting the MAC address, "
-				"but fail_over_mac is not set to active.\n"
-				, bond_dev->name);
+			pr_err("%s: Error: The slave device specified does not support setting the MAC address, but fail_over_mac is not set to active.\n",
+			       bond_dev->name);
 			res = -EOPNOTSUPP;
 			goto err_undo_flags;
 		}
@@ -1655,22 +1631,12 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
 			 * supported); thus, we don't need to change
 			 * the messages for netif_carrier.
 			 */
-			pr_warning(DRV_NAME
-			       ": %s: Warning: MII and ETHTOOL support not "
-			       "available for interface %s, and "
-			       "arp_interval/arp_ip_target module parameters "
-			       "not specified, thus bonding will not detect "
-			       "link failures! see bonding.txt for details.\n",
+			pr_warning("%s: Warning: MII and ETHTOOL support not available for interface %s, and arp_interval/arp_ip_target module parameters not specified, thus bonding will not detect link failures! see bonding.txt for details.\n",
 			       bond_dev->name, slave_dev->name);
 		} else if (link_reporting == -1) {
 			/* unable get link status using mii/ethtool */
-			pr_warning(DRV_NAME
-			       ": %s: Warning: can't get link status from "
-			       "interface %s; the network driver associated "
-			       "with this interface does not support MII or "
-			       "ETHTOOL link status reporting, thus miimon "
-			       "has no effect on this interface.\n",
-			       bond_dev->name, slave_dev->name);
+			pr_warning("%s: Warning: can't get link status from interface %s; the network driver associated with this interface does not support MII or ETHTOOL link status reporting, thus miimon has no effect on this interface.\n",
+				   bond_dev->name, slave_dev->name);
 		}
 	}
 
@@ -1678,34 +1644,27 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
 	if (!bond->params.miimon ||
 	    (bond_check_dev_link(bond, slave_dev, 0) == BMSR_LSTATUS)) {
 		if (bond->params.updelay) {
-			pr_debug("Initial state of slave_dev is "
-				"BOND_LINK_BACK\n");
+			pr_debug("Initial state of slave_dev is BOND_LINK_BACK\n");
 			new_slave->link  = BOND_LINK_BACK;
 			new_slave->delay = bond->params.updelay;
 		} else {
-			pr_debug("Initial state of slave_dev is "
-				"BOND_LINK_UP\n");
+			pr_debug("Initial state of slave_dev is BOND_LINK_UP\n");
 			new_slave->link  = BOND_LINK_UP;
 		}
 		new_slave->jiffies = jiffies;
 	} else {
-		pr_debug("Initial state of slave_dev is "
-			"BOND_LINK_DOWN\n");
+		pr_debug("Initial state of slave_dev is BOND_LINK_DOWN\n");
 		new_slave->link  = BOND_LINK_DOWN;
 	}
 
 	if (bond_update_speed_duplex(new_slave) &&
 	    (new_slave->link != BOND_LINK_DOWN)) {
-		pr_warning(DRV_NAME
-		       ": %s: Warning: failed to get speed and duplex from %s, "
-		       "assumed to be 100Mb/sec and Full.\n",
-		       bond_dev->name, new_slave->dev->name);
+		pr_warning("%s: Warning: failed to get speed and duplex from %s, assumed to be 100Mb/sec and Full.\n",
+			   bond_dev->name, new_slave->dev->name);
 
 		if (bond->params.mode == BOND_MODE_8023AD) {
-			pr_warning(DRV_NAME
-			       ": %s: Warning: Operation of 802.3ad mode requires ETHTOOL "
-			       "support in base driver for proper aggregator "
-			       "selection.\n", bond_dev->name);
+			pr_warning("%s: Warning: Operation of 802.3ad mode requires ETHTOOL support in base driver for proper aggregator selection.\n",
+				   bond_dev->name);
 		}
 	}
 
@@ -1777,11 +1736,10 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
 	if (res)
 		goto err_close;
 
-	pr_info(DRV_NAME
-	       ": %s: enslaving %s as a%s interface with a%s link.\n",
-	       bond_dev->name, slave_dev->name,
-	       new_slave->state == BOND_STATE_ACTIVE ? "n active" : " backup",
-	       new_slave->link != BOND_LINK_DOWN ? "n up" : " down");
+	pr_info("%s: enslaving %s as a%s interface with a%s link.\n",
+		bond_dev->name, slave_dev->name,
+		new_slave->state == BOND_STATE_ACTIVE ? "n active" : " backup",
+		new_slave->link != BOND_LINK_DOWN ? "n up" : " down");
 
 	/* enslave is successful */
 	return 0;
@@ -1833,8 +1791,7 @@ int bond_release(struct net_device *bond_dev, struct net_device *slave_dev)
 	/* slave is not a slave or master is not master of this slave */
 	if (!(slave_dev->flags & IFF_SLAVE) ||
 	    (slave_dev->master != bond_dev)) {
-		pr_err(DRV_NAME
-		       ": %s: Error: cannot release %s.\n",
+		pr_err("%s: Error: cannot release %s.\n",
 		       bond_dev->name, slave_dev->name);
 		return -EINVAL;
 	}
@@ -1844,9 +1801,8 @@ int bond_release(struct net_device *bond_dev, struct net_device *slave_dev)
 	slave = bond_get_slave_by_dev(bond, slave_dev);
 	if (!slave) {
 		/* not a slave of this bond */
-		pr_info(DRV_NAME
-		       ": %s: %s not enslaved\n",
-		       bond_dev->name, slave_dev->name);
+		pr_info("%s: %s not enslaved\n",
+			bond_dev->name, slave_dev->name);
 		write_unlock_bh(&bond->lock);
 		return -EINVAL;
 	}
@@ -1854,14 +1810,10 @@ int bond_release(struct net_device *bond_dev, struct net_device *slave_dev)
 	if (!bond->params.fail_over_mac) {
 		if (!compare_ether_addr(bond_dev->dev_addr, slave->perm_hwaddr) &&
 		    bond->slave_cnt > 1)
-			pr_warning(DRV_NAME
-			       ": %s: Warning: the permanent HWaddr of %s - "
-			       "%pM - is still in use by %s. "
-			       "Set the HWaddr of %s to a different address "
-			       "to avoid conflicts.\n",
-			       bond_dev->name, slave_dev->name,
-			       slave->perm_hwaddr,
-			       bond_dev->name, slave_dev->name);
+			pr_warning("%s: Warning: the permanent HWaddr of %s - %pM - is still in use by %s. Set the HWaddr of %s to a different address to avoid conflicts.\n",
+				   bond_dev->name, slave_dev->name,
+				   slave->perm_hwaddr,
+				   bond_dev->name, slave_dev->name);
 	}
 
 	/* Inform AD package of unbinding of slave. */
@@ -1872,12 +1824,10 @@ int bond_release(struct net_device *bond_dev, struct net_device *slave_dev)
 		bond_3ad_unbind_slave(slave);
 	}
 
-	pr_info(DRV_NAME
-	       ": %s: releasing %s interface %s\n",
-	       bond_dev->name,
-	       (slave->state == BOND_STATE_ACTIVE)
-	       ? "active" : "backup",
-	       slave_dev->name);
+	pr_info("%s: releasing %s interface %s\n",
+		bond_dev->name,
+		(slave->state == BOND_STATE_ACTIVE) ? "active" : "backup",
+		slave_dev->name);
 
 	oldcurrent = bond->curr_active_slave;
 
@@ -1934,21 +1884,15 @@ int bond_release(struct net_device *bond_dev, struct net_device *slave_dev)
 		if (list_empty(&bond->vlan_list)) {
 			bond_dev->features |= NETIF_F_VLAN_CHALLENGED;
 		} else {
-			pr_warning(DRV_NAME
-			       ": %s: Warning: clearing HW address of %s while it "
-			       "still has VLANs.\n",
-			       bond_dev->name, bond_dev->name);
-			pr_warning(DRV_NAME
-			       ": %s: When re-adding slaves, make sure the bond's "
-			       "HW address matches its VLANs'.\n",
-			       bond_dev->name);
+			pr_warning("%s: Warning: clearing HW address of %s while it still has VLANs.\n",
+				   bond_dev->name, bond_dev->name);
+			pr_warning("%s: When re-adding slaves, make sure the bond's HW address matches its VLANs'.\n",
+				   bond_dev->name);
 		}
 	} else if ((bond_dev->features & NETIF_F_VLAN_CHALLENGED) &&
 		   !bond_has_challenged_slaves(bond)) {
-		pr_info(DRV_NAME
-		       ": %s: last VLAN challenged slave %s "
-		       "left bond %s. VLAN blocking is removed\n",
-		       bond_dev->name, slave_dev->name, bond_dev->name);
+		pr_info("%s: last VLAN challenged slave %s left bond %s. VLAN blocking is removed\n",
+			bond_dev->name, slave_dev->name, bond_dev->name);
 		bond_dev->features &= ~NETIF_F_VLAN_CHALLENGED;
 	}
 
@@ -2011,8 +1955,8 @@ int  bond_release_and_destroy(struct net_device *bond_dev,
 
 	ret = bond_release(bond_dev, slave_dev);
 	if ((ret == 0) && (bond->slave_cnt == 0)) {
-		pr_info(DRV_NAME ": %s: destroying bond %s.\n",
-		       bond_dev->name, bond_dev->name);
+		pr_info("%s: destroying bond %s.\n",
+			bond_dev->name, bond_dev->name);
 		unregister_netdevice(bond_dev);
 	}
 	return ret;
@@ -2116,19 +2060,13 @@ static int bond_release_all(struct net_device *bond_dev)
 	if (list_empty(&bond->vlan_list))
 		bond_dev->features |= NETIF_F_VLAN_CHALLENGED;
 	else {
-		pr_warning(DRV_NAME
-		       ": %s: Warning: clearing HW address of %s while it "
-		       "still has VLANs.\n",
-		       bond_dev->name, bond_dev->name);
-		pr_warning(DRV_NAME
-		       ": %s: When re-adding slaves, make sure the bond's "
-		       "HW address matches its VLANs'.\n",
-		       bond_dev->name);
+		pr_warning("%s: Warning: clearing HW address of %s while it still has VLANs.\n",
+			   bond_dev->name, bond_dev->name);
+		pr_warning("%s: When re-adding slaves, make sure the bond's HW address matches its VLANs'.\n",
+			   bond_dev->name);
 	}
 
-	pr_info(DRV_NAME
-	       ": %s: released all slaves\n",
-	       bond_dev->name);
+	pr_info("%s: released all slaves\n", bond_dev->name);
 
 out:
 	write_unlock_bh(&bond->lock);
@@ -2254,16 +2192,14 @@ static int bond_miimon_inspect(struct bonding *bond)
 			slave->link = BOND_LINK_FAIL;
 			slave->delay = bond->params.downdelay;
 			if (slave->delay) {
-				pr_info(DRV_NAME
-				       ": %s: link status down for %s"
-				       "interface %s, disabling it in %d ms.\n",
-				       bond->dev->name,
-				       (bond->params.mode ==
-					BOND_MODE_ACTIVEBACKUP) ?
-				       ((slave->state == BOND_STATE_ACTIVE) ?
-					"active " : "backup ") : "",
-				       slave->dev->name,
-				       bond->params.downdelay * bond->params.miimon);
+				pr_info("%s: link status down for %sinterface %s, disabling it in %d ms.\n",
+					bond->dev->name,
+					(bond->params.mode ==
+					 BOND_MODE_ACTIVEBACKUP) ?
+					((slave->state == BOND_STATE_ACTIVE) ?
+					 "active " : "backup ") : "",
+					slave->dev->name,
+					bond->params.downdelay * bond->params.miimon);
 			}
 			/*FALLTHRU*/
 		case BOND_LINK_FAIL:
@@ -2273,13 +2209,11 @@ static int bond_miimon_inspect(struct bonding *bond)
 				 */
 				slave->link = BOND_LINK_UP;
 				slave->jiffies = jiffies;
-				pr_info(DRV_NAME
-				       ": %s: link status up again after %d "
-				       "ms for interface %s.\n",
-				       bond->dev->name,
-				       (bond->params.downdelay - slave->delay) *
-				       bond->params.miimon,
-				       slave->dev->name);
+				pr_info("%s: link status up again after %d ms for interface %s.\n",
+					bond->dev->name,
+					(bond->params.downdelay - slave->delay) *
+					bond->params.miimon,
+					slave->dev->name);
 				continue;
 			}
 
@@ -2300,25 +2234,21 @@ static int bond_miimon_inspect(struct bonding *bond)
 			slave->delay = bond->params.updelay;
 
 			if (slave->delay) {
-				pr_info(DRV_NAME
-				       ": %s: link status up for "
-				       "interface %s, enabling it in %d ms.\n",
-				       bond->dev->name, slave->dev->name,
-				       ignore_updelay ? 0 :
-				       bond->params.updelay *
-				       bond->params.miimon);
+				pr_info("%s: link status up for interface %s, enabling it in %d ms.\n",
+					bond->dev->name, slave->dev->name,
+					ignore_updelay ? 0 :
+					bond->params.updelay *
+					bond->params.miimon);
 			}
 			/*FALLTHRU*/
 		case BOND_LINK_BACK:
 			if (!link_state) {
 				slave->link = BOND_LINK_DOWN;
-				pr_info(DRV_NAME
-				       ": %s: link status down again after %d "
-				       "ms for interface %s.\n",
-				       bond->dev->name,
-				       (bond->params.updelay - slave->delay) *
-				       bond->params.miimon,
-				       slave->dev->name);
+				pr_info("%s: link status down again after %d ms for interface %s.\n",
+					bond->dev->name,
+					(bond->params.updelay - slave->delay) *
+					bond->params.miimon,
+					slave->dev->name);
 
 				continue;
 			}
@@ -2366,10 +2296,8 @@ static void bond_miimon_commit(struct bonding *bond)
 				slave->state = BOND_STATE_BACKUP;
 			}
 
-			pr_info(DRV_NAME
-			       ": %s: link status definitely "
-			       "up for interface %s.\n",
-			       bond->dev->name, slave->dev->name);
+			pr_info("%s: link status definitely up for interface %s.\n",
+				bond->dev->name, slave->dev->name);
 
 			/* notify ad that the link status has changed */
 			if (bond->params.mode == BOND_MODE_8023AD)
@@ -2395,10 +2323,8 @@ static void bond_miimon_commit(struct bonding *bond)
 			    bond->params.mode == BOND_MODE_8023AD)
 				bond_set_slave_inactive_flags(slave);
 
-			pr_info(DRV_NAME
-			       ": %s: link status definitely down for "
-			       "interface %s, disabling it\n",
-			       bond->dev->name, slave->dev->name);
+			pr_info("%s: link status definitely down for interface %s, disabling it\n",
+				bond->dev->name, slave->dev->name);
 
 			if (bond->params.mode == BOND_MODE_8023AD)
 				bond_3ad_handle_link_change(slave,
@@ -2414,8 +2340,7 @@ static void bond_miimon_commit(struct bonding *bond)
 			continue;
 
 		default:
-			pr_err(DRV_NAME
-			       ": %s: invalid new link %d on slave %s\n",
+			pr_err("%s: invalid new link %d on slave %s\n",
 			       bond->dev->name, slave->new_link,
 			       slave->dev->name);
 			slave->new_link = BOND_LINK_NOCHANGE;
@@ -2534,19 +2459,19 @@ static void bond_arp_send(struct net_device *slave_dev, int arp_op, __be32 dest_
 	struct sk_buff *skb;
 
 	pr_debug("arp %d on slave %s: dst %x src %x vid %d\n", arp_op,
-	       slave_dev->name, dest_ip, src_ip, vlan_id);
+		 slave_dev->name, dest_ip, src_ip, vlan_id);
 
 	skb = arp_create(arp_op, ETH_P_ARP, dest_ip, slave_dev, src_ip,
 			 NULL, slave_dev->dev_addr, NULL);
 
 	if (!skb) {
-		pr_err(DRV_NAME ": ARP packet allocation failed\n");
+		pr_err("ARP packet allocation failed\n");
 		return;
 	}
 	if (vlan_id) {
 		skb = vlan_put_tag(skb, vlan_id);
 		if (!skb) {
-			pr_err(DRV_NAME ": failed to insert VLAN tag\n");
+			pr_err("failed to insert VLAN tag\n");
 			return;
 		}
 	}
@@ -2586,9 +2511,8 @@ static void bond_arp_send_all(struct bonding *bond, struct slave *slave)
 		rv = ip_route_output_key(dev_net(bond->dev), &rt, &fl);
 		if (rv) {
 			if (net_ratelimit()) {
-				pr_warning(DRV_NAME
-			     ": %s: no route to arp_ip_target %pI4\n",
-				       bond->dev->name, &fl.fl4_dst);
+				pr_warning("%s: no route to arp_ip_target %pI4\n",
+					   bond->dev->name, &fl.fl4_dst);
 			}
 			continue;
 		}
@@ -2623,10 +2547,9 @@ static void bond_arp_send_all(struct bonding *bond, struct slave *slave)
 		}
 
 		if (net_ratelimit()) {
-			pr_warning(DRV_NAME
-	       ": %s: no path to arp_ip_target %pI4 via rt.dev %s\n",
-			       bond->dev->name, &fl.fl4_dst,
-			       rt->u.dst.dev ? rt->u.dst.dev->name : "NULL");
+			pr_warning("%s: no path to arp_ip_target %pI4 via rt.dev %s\n",
+				   bond->dev->name, &fl.fl4_dst,
+				   rt->u.dst.dev ? rt->u.dst.dev->name : "NULL");
 		}
 		ip_rt_put(rt);
 	}
@@ -2644,8 +2567,8 @@ static void bond_send_gratuitous_arp(struct bonding *bond)
 	struct vlan_entry *vlan;
 	struct net_device *vlan_dev;
 
-	pr_debug("bond_send_grat_arp: bond %s slave %s\n", bond->dev->name,
-				slave ? slave->dev->name : "NULL");
+	pr_debug("bond_send_grat_arp: bond %s slave %s\n",
+		 bond->dev->name, slave ? slave->dev->name : "NULL");
 
 	if (!slave || !bond->send_grat_arp ||
 	    test_bit(__LINK_STATE_LINKWATCH_PENDING, &slave->dev->state))
@@ -2674,7 +2597,8 @@ static void bond_validate_arp(struct bonding *bond, struct slave *slave, __be32
 
 	for (i = 0; (i < BOND_MAX_ARP_TARGETS) && targets[i]; i++) {
 		pr_debug("bva: sip %pI4 tip %pI4 t[%d] %pI4 bhti(tip) %d\n",
-			&sip, &tip, i, &targets[i], bond_has_this_ip(bond, tip));
+			 &sip, &tip, i, &targets[i],
+			 bond_has_this_ip(bond, tip));
 		if (sip == targets[i]) {
 			if (bond_has_this_ip(bond, tip))
 				slave->last_arp_rx = jiffies;
@@ -2698,8 +2622,8 @@ static int bond_arp_rcv(struct sk_buff *skb, struct net_device *dev, struct pack
 	read_lock(&bond->lock);
 
 	pr_debug("bond_arp_rcv: bond %s skb->dev %s orig_dev %s\n",
-		bond->dev->name, skb->dev ? skb->dev->name : "NULL",
-		orig_dev ? orig_dev->name : "NULL");
+		 bond->dev->name, skb->dev ? skb->dev->name : "NULL",
+		 orig_dev ? orig_dev->name : "NULL");
 
 	slave = bond_get_slave_by_dev(bond, orig_dev);
 	if (!slave || !slave_do_arp_validate(bond, slave))
@@ -2724,9 +2648,9 @@ static int bond_arp_rcv(struct sk_buff *skb, struct net_device *dev, struct pack
 	memcpy(&tip, arp_ptr, 4);
 
 	pr_debug("bond_arp_rcv: %s %s/%d av %d sv %d sip %pI4 tip %pI4\n",
-		bond->dev->name, slave->dev->name, slave->state,
-		bond->params.arp_validate, slave_do_arp_validate(bond, slave),
-		&sip, &tip);
+		 bond->dev->name, slave->dev->name, slave->state,
+		 bond->params.arp_validate, slave_do_arp_validate(bond, slave),
+		 &sip, &tip);
 
 	/*
 	 * Backup slaves won't see the ARP reply, but do come through
@@ -2800,17 +2724,14 @@ void bond_loadbalance_arp_mon(struct work_struct *work)
 				 * is closed.
 				 */
 				if (!oldcurrent) {
-					pr_info(DRV_NAME
-					       ": %s: link status definitely "
-					       "up for interface %s, ",
-					       bond->dev->name,
-					       slave->dev->name);
+					pr_info("%s: link status definitely up for interface %s, ",
+						bond->dev->name,
+						slave->dev->name);
 					do_failover = 1;
 				} else {
-					pr_info(DRV_NAME
-					       ": %s: interface %s is now up\n",
-					       bond->dev->name,
-					       slave->dev->name);
+					pr_info("%s: interface %s is now up\n",
+						bond->dev->name,
+						slave->dev->name);
 				}
 			}
 		} else {
@@ -2829,10 +2750,9 @@ void bond_loadbalance_arp_mon(struct work_struct *work)
 				if (slave->link_failure_count < UINT_MAX)
 					slave->link_failure_count++;
 
-				pr_info(DRV_NAME
-				       ": %s: interface %s is now down.\n",
-				       bond->dev->name,
-				       slave->dev->name);
+				pr_info("%s: interface %s is now down.\n",
+					bond->dev->name,
+					slave->dev->name);
 
 				if (slave == oldcurrent)
 					do_failover = 1;
@@ -2965,9 +2885,7 @@ static void bond_ab_arp_commit(struct bonding *bond, int delta_in_ticks)
 				slave->link = BOND_LINK_UP;
 				bond->current_arp_slave = NULL;
 
-				pr_info(DRV_NAME
-					": %s: link status definitely "
-					"up for interface %s.\n",
+				pr_info("%s: link status definitely up for interface %s.\n",
 					bond->dev->name, slave->dev->name);
 
 				if (!bond->curr_active_slave ||
@@ -2985,9 +2903,7 @@ static void bond_ab_arp_commit(struct bonding *bond, int delta_in_ticks)
 			slave->link = BOND_LINK_DOWN;
 			bond_set_slave_inactive_flags(slave);
 
-			pr_info(DRV_NAME
-				": %s: link status definitely down for "
-				"interface %s, disabling it\n",
+			pr_info("%s: link status definitely down for interface %s, disabling it\n",
 				bond->dev->name, slave->dev->name);
 
 			if (slave == bond->curr_active_slave) {
@@ -2998,8 +2914,7 @@ static void bond_ab_arp_commit(struct bonding *bond, int delta_in_ticks)
 			continue;
 
 		default:
-			pr_err(DRV_NAME
-			       ": %s: impossible: new_link %d on slave %s\n",
+			pr_err("%s: impossible: new_link %d on slave %s\n",
 			       bond->dev->name, slave->new_link,
 			       slave->dev->name);
 			continue;
@@ -3028,9 +2943,9 @@ static void bond_ab_arp_probe(struct bonding *bond)
 	read_lock(&bond->curr_slave_lock);
 
 	if (bond->current_arp_slave && bond->curr_active_slave)
-		pr_info(DRV_NAME "PROBE: c_arp %s && cas %s BAD\n",
-		       bond->current_arp_slave->dev->name,
-		       bond->curr_active_slave->dev->name);
+		pr_info("PROBE: c_arp %s && cas %s BAD\n",
+			bond->current_arp_slave->dev->name,
+			bond->curr_active_slave->dev->name);
 
 	if (bond->curr_active_slave) {
 		bond_arp_send_all(bond, bond->curr_active_slave);
@@ -3078,9 +2993,8 @@ static void bond_ab_arp_probe(struct bonding *bond)
 
 			bond_set_slave_inactive_flags(slave);
 
-			pr_info(DRV_NAME
-			       ": %s: backup interface %s is now down.\n",
-			       bond->dev->name, slave->dev->name);
+			pr_info("%s: backup interface %s is now down.\n",
+				bond->dev->name, slave->dev->name);
 		}
 	}
 }
@@ -3360,9 +3274,8 @@ static void bond_create_proc_entry(struct bonding *bond)
 						    S_IRUGO, bn->proc_dir,
 						    &bond_info_fops, bond);
 		if (bond->proc_entry == NULL)
-			pr_warning(DRV_NAME
-			       ": Warning: Cannot create /proc/net/%s/%s\n",
-			       DRV_NAME, bond_dev->name);
+			pr_warning("Warning: Cannot create /proc/net/%s/%s\n",
+				   DRV_NAME, bond_dev->name);
 		else
 			memcpy(bond->proc_file_name, bond_dev->name, IFNAMSIZ);
 	}
@@ -3388,9 +3301,8 @@ static void bond_create_proc_dir(struct bond_net *bn)
 	if (!bn->proc_dir) {
 		bn->proc_dir = proc_mkdir(DRV_NAME, bn->net->proc_net);
 		if (!bn->proc_dir)
-			pr_warning(DRV_NAME
-				": Warning: cannot create /proc/net/%s\n",
-				DRV_NAME);
+			pr_warning("Warning: cannot create /proc/net/%s\n",
+				   DRV_NAME);
 	}
 }
 
@@ -3539,8 +3451,8 @@ static int bond_netdev_event(struct notifier_block *this,
 	struct net_device *event_dev = (struct net_device *)ptr;
 
 	pr_debug("event_dev: %s, event: %lx\n",
-		(event_dev ? event_dev->name : "None"),
-		event);
+		 event_dev ? event_dev->name : "None",
+		 event);
 
 	if (!(event_dev->priv_flags & IFF_BONDING))
 		return NOTIFY_DONE;
@@ -3727,7 +3639,7 @@ static int bond_open(struct net_device *bond_dev)
 		 */
 		if (bond_alb_initialize(bond, (bond->params.mode == BOND_MODE_ALB))) {
 			/* something went wrong - fail the open operation */
-			return -1;
+			return -ENOMEM;
 		}
 
 		INIT_DELAYED_WORK(&bond->alb_work, bond_alb_monitor);
@@ -3875,8 +3787,7 @@ static int bond_do_ioctl(struct net_device *bond_dev, struct ifreq *ifr, int cmd
 	struct mii_ioctl_data *mii = NULL;
 	int res = 0;
 
-	pr_debug("bond_ioctl: master=%s, cmd=%d\n",
-		bond_dev->name, cmd);
+	pr_debug("bond_ioctl: master=%s, cmd=%d\n", bond_dev->name, cmd);
 
 	switch (cmd) {
 	case SIOCGMIIPHY:
@@ -3945,12 +3856,12 @@ static int bond_do_ioctl(struct net_device *bond_dev, struct ifreq *ifr, int cmd
 
 	slave_dev = dev_get_by_name(dev_net(bond_dev), ifr->ifr_slave);
 
-	pr_debug("slave_dev=%p: \n", slave_dev);
+	pr_debug("slave_dev=%p:\n", slave_dev);
 
 	if (!slave_dev)
 		res = -ENODEV;
 	else {
-		pr_debug("slave_dev->name=%s: \n", slave_dev->name);
+		pr_debug("slave_dev->name=%s:\n", slave_dev->name);
 		switch (cmd) {
 		case BOND_ENSLAVE_OLD:
 		case SIOCBONDENSLAVE:
@@ -4059,7 +3970,7 @@ static int bond_change_mtu(struct net_device *bond_dev, int new_mtu)
 	int i;
 
 	pr_debug("bond=%p, name=%s, new_mtu=%d\n", bond,
-		(bond_dev ? bond_dev->name : "None"), new_mtu);
+		 (bond_dev ? bond_dev->name : "None"), new_mtu);
 
 	/* Can't hold bond->lock with bh disabled here since
 	 * some base drivers panic. On the other hand we can't
@@ -4077,8 +3988,10 @@ static int bond_change_mtu(struct net_device *bond_dev, int new_mtu)
 	 */
 
 	bond_for_each_slave(bond, slave, i) {
-		pr_debug("s %p s->p %p c_m %p\n", slave,
-			slave->prev, slave->dev->netdev_ops->ndo_change_mtu);
+		pr_debug("s %p s->p %p c_m %p\n",
+			 slave,
+			 slave->prev,
+			 slave->dev->netdev_ops->ndo_change_mtu);
 
 		res = dev_set_mtu(slave->dev, new_mtu);
 
@@ -4108,8 +4021,8 @@ unwind:
 
 		tmp_res = dev_set_mtu(slave->dev, bond_dev->mtu);
 		if (tmp_res) {
-			pr_debug("unwind err %d dev %s\n", tmp_res,
-				slave->dev->name);
+			pr_debug("unwind err %d dev %s\n",
+				 tmp_res, slave->dev->name);
 		}
 	}
 
@@ -4135,7 +4048,8 @@ static int bond_set_mac_address(struct net_device *bond_dev, void *addr)
 		return bond_alb_set_mac_address(bond_dev, addr);
 
 
-	pr_debug("bond=%p, name=%s\n", bond, (bond_dev ? bond_dev->name : "None"));
+	pr_debug("bond=%p, name=%s\n",
+		 bond, bond_dev ? bond_dev->name : "None");
 
 	/*
 	 * If fail_over_mac is set to active, do nothing and return
@@ -4200,8 +4114,8 @@ unwind:
 
 		tmp_res = dev_set_mac_address(slave->dev, &tmp_sa);
 		if (tmp_res) {
-			pr_debug("unwind err %d dev %s\n", tmp_res,
-				slave->dev->name);
+			pr_debug("unwind err %d dev %s\n",
+				 tmp_res, slave->dev->name);
 		}
 	}
 
@@ -4357,9 +4271,7 @@ static int bond_xmit_broadcast(struct sk_buff *skb, struct net_device *bond_dev)
 			if (tx_dev) {
 				struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
 				if (!skb2) {
-					pr_err(DRV_NAME
-					       ": %s: Error: bond_xmit_broadcast(): "
-					       "skb_clone() failed\n",
+					pr_err("%s: Error: bond_xmit_broadcast(): skb_clone() failed\n",
 					       bond_dev->name);
 					continue;
 				}
@@ -4425,8 +4337,8 @@ static netdev_tx_t bond_start_xmit(struct sk_buff *skb, struct net_device *dev)
 		return bond_alb_xmit(skb, dev);
 	default:
 		/* Should never happen, mode already checked */
-		pr_err(DRV_NAME ": %s: Error: Unknown bonding mode %d\n",
-		     dev->name, bond->params.mode);
+		pr_err("%s: Error: Unknown bonding mode %d\n",
+		       dev->name, bond->params.mode);
 		WARN_ON_ONCE(1);
 		dev_kfree_skb(skb);
 		return NETDEV_TX_OK;
@@ -4462,10 +4374,8 @@ void bond_set_mode_ops(struct bonding *bond, int mode)
 		break;
 	default:
 		/* Should never happen, mode already checked */
-		pr_err(DRV_NAME
-		       ": %s: Error: Unknown bonding mode %d\n",
-		       bond_dev->name,
-		       mode);
+		pr_err("%s: Error: Unknown bonding mode %d\n",
+		       bond_dev->name, mode);
 		break;
 	}
 }
@@ -4650,8 +4560,7 @@ static int bond_check_params(struct bond_params *params)
 	if (mode) {
 		bond_mode = bond_parse_parm(mode, bond_mode_tbl);
 		if (bond_mode == -1) {
-			pr_err(DRV_NAME
-			       ": Error: Invalid bonding mode \"%s\"\n",
+			pr_err("Error: Invalid bonding mode \"%s\"\n",
 			       mode == NULL ? "NULL" : mode);
 			return -EINVAL;
 		}
@@ -4660,16 +4569,13 @@ static int bond_check_params(struct bond_params *params)
 	if (xmit_hash_policy) {
 		if ((bond_mode != BOND_MODE_XOR) &&
 		    (bond_mode != BOND_MODE_8023AD)) {
-			pr_info(DRV_NAME
-				": xmit_hash_policy param is irrelevant in"
-				" mode %s\n",
+			pr_info("xmit_hash_policy param is irrelevant in mode %s\n",
 			       bond_mode_name(bond_mode));
 		} else {
 			xmit_hashtype = bond_parse_parm(xmit_hash_policy,
 							xmit_hashtype_tbl);
 			if (xmit_hashtype == -1) {
-				pr_err(DRV_NAME
-				       ": Error: Invalid xmit_hash_policy \"%s\"\n",
+				pr_err("Error: Invalid xmit_hash_policy \"%s\"\n",
 				       xmit_hash_policy == NULL ? "NULL" :
 				       xmit_hash_policy);
 				return -EINVAL;
@@ -4679,14 +4585,12 @@ static int bond_check_params(struct bond_params *params)
 
 	if (lacp_rate) {
 		if (bond_mode != BOND_MODE_8023AD) {
-			pr_info(DRV_NAME
-			       ": lacp_rate param is irrelevant in mode %s\n",
-			       bond_mode_name(bond_mode));
+			pr_info("lacp_rate param is irrelevant in mode %s\n",
+				bond_mode_name(bond_mode));
 		} else {
 			lacp_fast = bond_parse_parm(lacp_rate, bond_lacp_tbl);
 			if (lacp_fast == -1) {
-				pr_err(DRV_NAME
-				       ": Error: Invalid lacp rate \"%s\"\n",
+				pr_err("Error: Invalid lacp rate \"%s\"\n",
 				       lacp_rate == NULL ? "NULL" : lacp_rate);
 				return -EINVAL;
 			}
@@ -4696,82 +4600,64 @@ static int bond_check_params(struct bond_params *params)
 	if (ad_select) {
 		params->ad_select = bond_parse_parm(ad_select, ad_select_tbl);
 		if (params->ad_select == -1) {
-			pr_err(DRV_NAME
-			       ": Error: Invalid ad_select \"%s\"\n",
+			pr_err("Error: Invalid ad_select \"%s\"\n",
 			       ad_select == NULL ? "NULL" : ad_select);
 			return -EINVAL;
 		}
 
 		if (bond_mode != BOND_MODE_8023AD) {
-			pr_warning(DRV_NAME
-			       ": ad_select param only affects 802.3ad mode\n");
+			pr_warning("ad_select param only affects 802.3ad mode\n");
 		}
 	} else {
 		params->ad_select = BOND_AD_STABLE;
 	}
 
 	if (max_bonds < 0) {
-		pr_warning(DRV_NAME
-		       ": Warning: max_bonds (%d) not in range %d-%d, so it "
-		       "was reset to BOND_DEFAULT_MAX_BONDS (%d)\n",
-		       max_bonds, 0, INT_MAX, BOND_DEFAULT_MAX_BONDS);
+		pr_warning("Warning: max_bonds (%d) not in range %d-%d, so it was reset to BOND_DEFAULT_MAX_BONDS (%d)\n",
+			   max_bonds, 0, INT_MAX, BOND_DEFAULT_MAX_BONDS);
 		max_bonds = BOND_DEFAULT_MAX_BONDS;
 	}
 
 	if (miimon < 0) {
-		pr_warning(DRV_NAME
-		       ": Warning: miimon module parameter (%d), "
-		       "not in range 0-%d, so it was reset to %d\n",
-		       miimon, INT_MAX, BOND_LINK_MON_INTERV);
+		pr_warning("Warning: miimon module parameter (%d), not in range 0-%d, so it was reset to %d\n",
+			   miimon, INT_MAX, BOND_LINK_MON_INTERV);
 		miimon = BOND_LINK_MON_INTERV;
 	}
 
 	if (updelay < 0) {
-		pr_warning(DRV_NAME
-		       ": Warning: updelay module parameter (%d), "
-		       "not in range 0-%d, so it was reset to 0\n",
-		       updelay, INT_MAX);
+		pr_warning("Warning: updelay module parameter (%d), not in range 0-%d, so it was reset to 0\n",
+			   updelay, INT_MAX);
 		updelay = 0;
 	}
 
 	if (downdelay < 0) {
-		pr_warning(DRV_NAME
-		       ": Warning: downdelay module parameter (%d), "
-		       "not in range 0-%d, so it was reset to 0\n",
-		       downdelay, INT_MAX);
+		pr_warning("Warning: downdelay module parameter (%d), not in range 0-%d, so it was reset to 0\n",
+			   downdelay, INT_MAX);
 		downdelay = 0;
 	}
 
 	if ((use_carrier != 0) && (use_carrier != 1)) {
-		pr_warning(DRV_NAME
-		       ": Warning: use_carrier module parameter (%d), "
-		       "not of valid value (0/1), so it was set to 1\n",
-		       use_carrier);
+		pr_warning("Warning: use_carrier module parameter (%d), not of valid value (0/1), so it was set to 1\n",
+			   use_carrier);
 		use_carrier = 1;
 	}
 
 	if (num_grat_arp < 0 || num_grat_arp > 255) {
-		pr_warning(DRV_NAME
-		       ": Warning: num_grat_arp (%d) not in range 0-255 so it "
-		       "was reset to 1 \n", num_grat_arp);
+		pr_warning("Warning: num_grat_arp (%d) not in range 0-255 so it was reset to 1 \n",
+			   num_grat_arp);
 		num_grat_arp = 1;
 	}
 
 	if (num_unsol_na < 0 || num_unsol_na > 255) {
-		pr_warning(DRV_NAME
-		       ": Warning: num_unsol_na (%d) not in range 0-255 so it "
-		       "was reset to 1 \n", num_unsol_na);
+		pr_warning("Warning: num_unsol_na (%d) not in range 0-255 so it was reset to 1 \n",
+			   num_unsol_na);
 		num_unsol_na = 1;
 	}
 
 	/* reset values for 802.3ad */
 	if (bond_mode == BOND_MODE_8023AD) {
 		if (!miimon) {
-			pr_warning(DRV_NAME
-			       ": Warning: miimon must be specified, "
-			       "otherwise bonding will not detect link "
-			       "failure, speed and duplex which are "
-			       "essential for 802.3ad operation\n");
+			pr_warning("Warning: miimon must be specified, otherwise bonding will not detect link failure, speed and duplex which are essential for 802.3ad operation\n");
 			pr_warning("Forcing miimon to 100msec\n");
 			miimon = 100;
 		}
@@ -4781,24 +4667,15 @@ static int bond_check_params(struct bond_params *params)
 	if ((bond_mode == BOND_MODE_TLB) ||
 	    (bond_mode == BOND_MODE_ALB)) {
 		if (!miimon) {
-			pr_warning(DRV_NAME
-			       ": Warning: miimon must be specified, "
-			       "otherwise bonding will not detect link "
-			       "failure and link speed which are essential "
-			       "for TLB/ALB load balancing\n");
+			pr_warning("Warning: miimon must be specified, otherwise bonding will not detect link failure and link speed which are essential for TLB/ALB load balancing\n");
 			pr_warning("Forcing miimon to 100msec\n");
 			miimon = 100;
 		}
 	}
 
 	if (bond_mode == BOND_MODE_ALB) {
-		pr_notice(DRV_NAME
-		       ": In ALB mode you might experience client "
-		       "disconnections upon reconnection of a link if the "
-		       "bonding module updelay parameter (%d msec) is "
-		       "incompatible with the forwarding delay time of the "
-		       "switch\n",
-		       updelay);
+		pr_notice("In ALB mode you might experience client disconnections upon reconnection of a link if the bonding module updelay parameter (%d msec) is incompatible with the forwarding delay time of the switch\n",
+			  updelay);
 	}
 
 	if (!miimon) {
@@ -4806,49 +4683,37 @@ static int bond_check_params(struct bond_params *params)
 			/* just warn the user the up/down delay will have
 			 * no effect since miimon is zero...
 			 */
-			pr_warning(DRV_NAME
-			       ": Warning: miimon module parameter not set "
-			       "and updelay (%d) or downdelay (%d) module "
-			       "parameter is set; updelay and downdelay have "
-			       "no effect unless miimon is set\n",
-			       updelay, downdelay);
+			pr_warning("Warning: miimon module parameter not set and updelay (%d) or downdelay (%d) module parameter is set; updelay and downdelay have no effect unless miimon is set\n",
+				   updelay, downdelay);
 		}
 	} else {
 		/* don't allow arp monitoring */
 		if (arp_interval) {
-			pr_warning(DRV_NAME
-			       ": Warning: miimon (%d) and arp_interval (%d) "
-			       "can't be used simultaneously, disabling ARP "
-			       "monitoring\n",
-			       miimon, arp_interval);
+			pr_warning("Warning: miimon (%d) and arp_interval (%d) can't be used simultaneously, disabling ARP monitoring\n",
+				   miimon, arp_interval);
 			arp_interval = 0;
 		}
 
 		if ((updelay % miimon) != 0) {
-			pr_warning(DRV_NAME
-			       ": Warning: updelay (%d) is not a multiple "
-			       "of miimon (%d), updelay rounded to %d ms\n",
-			       updelay, miimon, (updelay / miimon) * miimon);
+			pr_warning("Warning: updelay (%d) is not a multiple of miimon (%d), updelay rounded to %d ms\n",
+				   updelay, miimon,
+				   (updelay / miimon) * miimon);
 		}
 
 		updelay /= miimon;
 
 		if ((downdelay % miimon) != 0) {
-			pr_warning(DRV_NAME
-			       ": Warning: downdelay (%d) is not a multiple "
-			       "of miimon (%d), downdelay rounded to %d ms\n",
-			       downdelay, miimon,
-			       (downdelay / miimon) * miimon);
+			pr_warning("Warning: downdelay (%d) is not a multiple of miimon (%d), downdelay rounded to %d ms\n",
+				   downdelay, miimon,
+				   (downdelay / miimon) * miimon);
 		}
 
 		downdelay /= miimon;
 	}
 
 	if (arp_interval < 0) {
-		pr_warning(DRV_NAME
-		       ": Warning: arp_interval module parameter (%d) "
-		       ", not in range 0-%d, so it was reset to %d\n",
-		       arp_interval, INT_MAX, BOND_LINK_ARP_INTERV);
+		pr_warning("Warning: arp_interval module parameter (%d) , not in range 0-%d, so it was reset to %d\n",
+			   arp_interval, INT_MAX, BOND_LINK_ARP_INTERV);
 		arp_interval = BOND_LINK_ARP_INTERV;
 	}
 
@@ -4858,10 +4723,8 @@ static int bond_check_params(struct bond_params *params)
 		/* not complete check, but should be good enough to
 		   catch mistakes */
 		if (!isdigit(arp_ip_target[arp_ip_count][0])) {
-			pr_warning(DRV_NAME
-			       ": Warning: bad arp_ip_target module parameter "
-			       "(%s), ARP monitoring will not be performed\n",
-			       arp_ip_target[arp_ip_count]);
+			pr_warning("Warning: bad arp_ip_target module parameter (%s), ARP monitoring will not be performed\n",
+				   arp_ip_target[arp_ip_count]);
 			arp_interval = 0;
 		} else {
 			__be32 ip = in_aton(arp_ip_target[arp_ip_count]);
@@ -4871,31 +4734,25 @@ static int bond_check_params(struct bond_params *params)
 
 	if (arp_interval && !arp_ip_count) {
 		/* don't allow arping if no arp_ip_target given... */
-		pr_warning(DRV_NAME
-		       ": Warning: arp_interval module parameter (%d) "
-		       "specified without providing an arp_ip_target "
-		       "parameter, arp_interval was reset to 0\n",
-		       arp_interval);
+		pr_warning("Warning: arp_interval module parameter (%d) specified without providing an arp_ip_target parameter, arp_interval was reset to 0\n",
+			   arp_interval);
 		arp_interval = 0;
 	}
 
 	if (arp_validate) {
 		if (bond_mode != BOND_MODE_ACTIVEBACKUP) {
-			pr_err(DRV_NAME
-			       ": arp_validate only supported in active-backup mode\n");
+			pr_err("arp_validate only supported in active-backup mode\n");
 			return -EINVAL;
 		}
 		if (!arp_interval) {
-			pr_err(DRV_NAME
-			       ": arp_validate requires arp_interval\n");
+			pr_err("arp_validate requires arp_interval\n");
 			return -EINVAL;
 		}
 
 		arp_validate_value = bond_parse_parm(arp_validate,
 						     arp_validate_tbl);
 		if (arp_validate_value == -1) {
-			pr_err(DRV_NAME
-			       ": Error: invalid arp_validate \"%s\"\n",
+			pr_err("Error: invalid arp_validate \"%s\"\n",
 			       arp_validate == NULL ? "NULL" : arp_validate);
 			return -EINVAL;
 		}
@@ -4903,17 +4760,14 @@ static int bond_check_params(struct bond_params *params)
 		arp_validate_value = 0;
 
 	if (miimon) {
-		pr_info(DRV_NAME
-		       ": MII link monitoring set to %d ms\n",
-		       miimon);
+		pr_info("MII link monitoring set to %d ms\n", miimon);
 	} else if (arp_interval) {
 		int i;
 
-		pr_info(DRV_NAME ": ARP monitoring set to %d ms,"
-		       " validate %s, with %d target(s):",
-		       arp_interval,
-		       arp_validate_tbl[arp_validate_value].modename,
-		       arp_ip_count);
+		pr_info("ARP monitoring set to %d ms, validate %s, with %d target(s):",
+			arp_interval,
+			arp_validate_tbl[arp_validate_value].modename,
+			arp_ip_count);
 
 		for (i = 0; i < arp_ip_count; i++)
 			pr_info(" %s", arp_ip_target[i]);
@@ -4924,21 +4778,15 @@ static int bond_check_params(struct bond_params *params)
 		/* miimon and arp_interval not set, we need one so things
 		 * work as expected, see bonding.txt for details
 		 */
-		pr_warning(DRV_NAME
-		       ": Warning: either miimon or arp_interval and "
-		       "arp_ip_target module parameters must be specified, "
-		       "otherwise bonding will not detect link failures! see "
-		       "bonding.txt for details.\n");
+		pr_warning("Warning: either miimon or arp_interval and arp_ip_target module parameters must be specified, otherwise bonding will not detect link failures! see bonding.txt for details.\n");
 	}
 
 	if (primary && !USES_PRIMARY(bond_mode)) {
 		/* currently, using a primary only makes sense
 		 * in active backup, TLB or ALB modes
 		 */
-		pr_warning(DRV_NAME
-		       ": Warning: %s primary device specified but has no "
-		       "effect in %s mode\n",
-		       primary, bond_mode_name(bond_mode));
+		pr_warning("Warning: %s primary device specified but has no effect in %s mode\n",
+			   primary, bond_mode_name(bond_mode));
 		primary = NULL;
 	}
 
@@ -4946,8 +4794,7 @@ static int bond_check_params(struct bond_params *params)
 		primary_reselect_value = bond_parse_parm(primary_reselect,
 							 pri_reselect_tbl);
 		if (primary_reselect_value == -1) {
-			pr_err(DRV_NAME
-			       ": Error: Invalid primary_reselect \"%s\"\n",
+			pr_err("Error: Invalid primary_reselect \"%s\"\n",
 			       primary_reselect ==
 					NULL ? "NULL" : primary_reselect);
 			return -EINVAL;
@@ -4960,16 +4807,13 @@ static int bond_check_params(struct bond_params *params)
 		fail_over_mac_value = bond_parse_parm(fail_over_mac,
 						      fail_over_mac_tbl);
 		if (fail_over_mac_value == -1) {
-			pr_err(DRV_NAME
-			       ": Error: invalid fail_over_mac \"%s\"\n",
+			pr_err("Error: invalid fail_over_mac \"%s\"\n",
 			       arp_validate == NULL ? "NULL" : arp_validate);
 			return -EINVAL;
 		}
 
 		if (bond_mode != BOND_MODE_ACTIVEBACKUP)
-			pr_warning(DRV_NAME
-			       ": Warning: fail_over_mac only affects "
-			       "active-backup mode.\n");
+			pr_warning("Warning: fail_over_mac only affects active-backup mode.\n");
 	} else {
 		fail_over_mac_value = BOND_FOM_NONE;
 	}
@@ -5076,8 +4920,7 @@ int bond_create(struct net *net, const char *name)
 	bond_dev = alloc_netdev(sizeof(struct bonding), name ? name : "",
 				bond_setup);
 	if (!bond_dev) {
-		pr_err(DRV_NAME ": %s: eek! can't alloc netdev!\n",
-		       name);
+		pr_err("%s: eek! can't alloc netdev!\n", name);
 		res = -ENOMEM;
 		goto out;
 	}
diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
index 4e00b4f83641..5acd557cea9b 100644
--- a/drivers/net/bonding/bond_sysfs.c
+++ b/drivers/net/bonding/bond_sysfs.c
@@ -19,6 +19,9 @@
  * file called LICENSE.
  *
  */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/device.h>
@@ -109,11 +112,10 @@ static ssize_t bonding_store_bonds(struct class *cls,
 		goto err_no_cmd;
 
 	if (command[0] == '+') {
-		pr_info(DRV_NAME
-			": %s is being created...\n", ifname);
+		pr_info("%s is being created...\n", ifname);
 		rv = bond_create(net, ifname);
 		if (rv) {
-			pr_info(DRV_NAME ": Bond creation failed.\n");
+			pr_info("Bond creation failed.\n");
 			res = rv;
 		}
 	} else if (command[0] == '-') {
@@ -122,12 +124,10 @@ static ssize_t bonding_store_bonds(struct class *cls,
 		rtnl_lock();
 		bond_dev = bond_get_by_name(net, ifname);
 		if (bond_dev) {
-			pr_info(DRV_NAME ": %s is being deleted...\n",
-				ifname);
+			pr_info("%s is being deleted...\n", ifname);
 			unregister_netdevice(bond_dev);
 		} else {
-			pr_err(DRV_NAME ": unable to delete non-existent %s\n",
-			       ifname);
+			pr_err("unable to delete non-existent %s\n", ifname);
 			res = -ENODEV;
 		}
 		rtnl_unlock();
@@ -140,8 +140,7 @@ static ssize_t bonding_store_bonds(struct class *cls,
 	return res;
 
 err_no_cmd:
-	pr_err(DRV_NAME ": no command found in bonding_masters."
-	       " Use +ifname or -ifname.\n");
+	pr_err("no command found in bonding_masters. Use +ifname or -ifname.\n");
 	return -EPERM;
 }
 
@@ -225,8 +224,8 @@ static ssize_t bonding_store_slaves(struct device *d,
 
 	/* Quick sanity check -- is the bond interface up? */
 	if (!(bond->dev->flags & IFF_UP)) {
-		pr_warning(DRV_NAME ": %s: doing slave updates when "
-			   "interface is down.\n", bond->dev->name);
+		pr_warning("%s: doing slave updates when interface is down.\n",
+			   bond->dev->name);
 	}
 
 	/* Note:  We can't hold bond->lock here, as bond_create grabs it. */
@@ -247,17 +246,14 @@ static ssize_t bonding_store_slaves(struct device *d,
 
 		dev = __dev_get_by_name(dev_net(bond->dev), ifname);
 		if (!dev) {
-			pr_info(DRV_NAME
-			       ": %s: Interface %s does not exist!\n",
-			       bond->dev->name, ifname);
+			pr_info("%s: Interface %s does not exist!\n",
+				bond->dev->name, ifname);
 			ret = -ENODEV;
 			goto out;
 		}
 
 		if (dev->flags & IFF_UP) {
-			pr_err(DRV_NAME
-			       ": %s: Error: Unable to enslave %s "
-			       "because it is already up.\n",
+			pr_err("%s: Error: Unable to enslave %s because it is already up.\n",
 			       bond->dev->name, dev->name);
 			ret = -EPERM;
 			goto out;
@@ -266,8 +262,7 @@ static ssize_t bonding_store_slaves(struct device *d,
 		read_lock(&bond->lock);
 		bond_for_each_slave(bond, slave, i)
 			if (slave->dev == dev) {
-				pr_err(DRV_NAME
-				       ": %s: Interface %s is already enslaved!\n",
+				pr_err("%s: Interface %s is already enslaved!\n",
 				       bond->dev->name, ifname);
 				ret = -EPERM;
 				read_unlock(&bond->lock);
@@ -275,8 +270,7 @@ static ssize_t bonding_store_slaves(struct device *d,
 			}
 		read_unlock(&bond->lock);
 
-		pr_info(DRV_NAME ": %s: Adding slave %s.\n",
-			bond->dev->name, ifname);
+		pr_info("%s: Adding slave %s.\n", bond->dev->name, ifname);
 
 		/* If this is the first slave, then we need to set
 		   the master's hardware address to be the same as the
@@ -313,7 +307,7 @@ static ssize_t bonding_store_slaves(struct device *d,
 				break;
 			}
 		if (dev) {
-			pr_info(DRV_NAME ": %s: Removing slave %s\n",
+			pr_info("%s: Removing slave %s\n",
 				bond->dev->name, dev->name);
 				res = bond_release(bond->dev, dev);
 			if (res) {
@@ -323,16 +317,16 @@ static ssize_t bonding_store_slaves(struct device *d,
 			/* set the slave MTU to the default */
 			dev_set_mtu(dev, original_mtu);
 		} else {
-			pr_err(DRV_NAME ": unable to remove non-existent"
-			       " slave %s for bond %s.\n",
-				ifname, bond->dev->name);
+			pr_err("unable to remove non-existent slave %s for bond %s.\n",
+			       ifname, bond->dev->name);
 			ret = -ENODEV;
 		}
 		goto out;
 	}
 
 err_no_cmd:
-	pr_err(DRV_NAME ": no command found in slaves file for bond %s. Use +ifname or -ifname.\n", bond->dev->name);
+	pr_err("no command found in slaves file for bond %s. Use +ifname or -ifname.\n",
+	       bond->dev->name);
 	ret = -EPERM;
 
 out:
@@ -365,18 +359,16 @@ static ssize_t bonding_store_mode(struct device *d,
 	struct bonding *bond = to_bond(d);
 
 	if (bond->dev->flags & IFF_UP) {
-		pr_err(DRV_NAME ": unable to update mode of %s"
-		       " because interface is up.\n", bond->dev->name);
+		pr_err("unable to update mode of %s because interface is up.\n",
+		       bond->dev->name);
 		ret = -EPERM;
 		goto out;
 	}
 
 	new_value = bond_parse_parm(buf, bond_mode_tbl);
 	if (new_value < 0)  {
-		pr_err(DRV_NAME
-		       ": %s: Ignoring invalid mode value %.*s.\n",
-		       bond->dev->name,
-		       (int)strlen(buf) - 1, buf);
+		pr_err("%s: Ignoring invalid mode value %.*s.\n",
+		       bond->dev->name, (int)strlen(buf) - 1, buf);
 		ret = -EINVAL;
 		goto out;
 	} else {
@@ -388,8 +380,8 @@ static ssize_t bonding_store_mode(struct device *d,
 
 		bond->params.mode = new_value;
 		bond_set_mode_ops(bond, bond->params.mode);
-		pr_info(DRV_NAME ": %s: setting mode to %s (%d).\n",
-		       bond->dev->name, bond_mode_tbl[new_value].modename,
+		pr_info("%s: setting mode to %s (%d).\n",
+			bond->dev->name, bond_mode_tbl[new_value].modename,
 		       new_value);
 	}
 out:
@@ -421,8 +413,7 @@ static ssize_t bonding_store_xmit_hash(struct device *d,
 	struct bonding *bond = to_bond(d);
 
 	if (bond->dev->flags & IFF_UP) {
-		pr_err(DRV_NAME
-		       "%s: Interface is up. Unable to update xmit policy.\n",
+		pr_err("%s: Interface is up. Unable to update xmit policy.\n",
 		       bond->dev->name);
 		ret = -EPERM;
 		goto out;
@@ -430,8 +421,7 @@ static ssize_t bonding_store_xmit_hash(struct device *d,
 
 	new_value = bond_parse_parm(buf, xmit_hashtype_tbl);
 	if (new_value < 0)  {
-		pr_err(DRV_NAME
-		       ": %s: Ignoring invalid xmit hash policy value %.*s.\n",
+		pr_err("%s: Ignoring invalid xmit hash policy value %.*s.\n",
 		       bond->dev->name,
 		       (int)strlen(buf) - 1, buf);
 		ret = -EINVAL;
@@ -439,7 +429,7 @@ static ssize_t bonding_store_xmit_hash(struct device *d,
 	} else {
 		bond->params.xmit_policy = new_value;
 		bond_set_mode_ops(bond, bond->params.mode);
-		pr_info(DRV_NAME ": %s: setting xmit hash policy to %s (%d).\n",
+		pr_info("%s: setting xmit hash policy to %s (%d).\n",
 			bond->dev->name,
 			xmit_hashtype_tbl[new_value].modename, new_value);
 	}
@@ -472,20 +462,18 @@ static ssize_t bonding_store_arp_validate(struct device *d,
 
 	new_value = bond_parse_parm(buf, arp_validate_tbl);
 	if (new_value < 0) {
-		pr_err(DRV_NAME
-		       ": %s: Ignoring invalid arp_validate value %s\n",
+		pr_err("%s: Ignoring invalid arp_validate value %s\n",
 		       bond->dev->name, buf);
 		return -EINVAL;
 	}
 	if (new_value && (bond->params.mode != BOND_MODE_ACTIVEBACKUP)) {
-		pr_err(DRV_NAME
-		       ": %s: arp_validate only supported in active-backup mode.\n",
+		pr_err("%s: arp_validate only supported in active-backup mode.\n",
 		       bond->dev->name);
 		return -EINVAL;
 	}
-	pr_info(DRV_NAME ": %s: setting arp_validate to %s (%d).\n",
-	       bond->dev->name, arp_validate_tbl[new_value].modename,
-	       new_value);
+	pr_info("%s: setting arp_validate to %s (%d).\n",
+		bond->dev->name, arp_validate_tbl[new_value].modename,
+		new_value);
 
 	if (!bond->params.arp_validate && new_value)
 		bond_register_arp(bond);
@@ -523,24 +511,22 @@ static ssize_t bonding_store_fail_over_mac(struct device *d,
 	struct bonding *bond = to_bond(d);
 
 	if (bond->slave_cnt != 0) {
-		pr_err(DRV_NAME
-		       ": %s: Can't alter fail_over_mac with slaves in bond.\n",
+		pr_err("%s: Can't alter fail_over_mac with slaves in bond.\n",
 		       bond->dev->name);
 		return -EPERM;
 	}
 
 	new_value = bond_parse_parm(buf, fail_over_mac_tbl);
 	if (new_value < 0) {
-		pr_err(DRV_NAME
-		       ": %s: Ignoring invalid fail_over_mac value %s.\n",
+		pr_err("%s: Ignoring invalid fail_over_mac value %s.\n",
 		       bond->dev->name, buf);
 		return -EINVAL;
 	}
 
 	bond->params.fail_over_mac = new_value;
-	pr_info(DRV_NAME ": %s: Setting fail_over_mac to %s (%d).\n",
-	       bond->dev->name, fail_over_mac_tbl[new_value].modename,
-	       new_value);
+	pr_info("%s: Setting fail_over_mac to %s (%d).\n",
+		bond->dev->name, fail_over_mac_tbl[new_value].modename,
+		new_value);
 
 	return count;
 }
@@ -571,31 +557,26 @@ static ssize_t bonding_store_arp_interval(struct device *d,
 	struct bonding *bond = to_bond(d);
 
 	if (sscanf(buf, "%d", &new_value) != 1) {
-		pr_err(DRV_NAME
-		       ": %s: no arp_interval value specified.\n",
+		pr_err("%s: no arp_interval value specified.\n",
 		       bond->dev->name);
 		ret = -EINVAL;
 		goto out;
 	}
 	if (new_value < 0) {
-		pr_err(DRV_NAME
-		       ": %s: Invalid arp_interval value %d not in range 1-%d; rejected.\n",
+		pr_err("%s: Invalid arp_interval value %d not in range 1-%d; rejected.\n",
 		       bond->dev->name, new_value, INT_MAX);
 		ret = -EINVAL;
 		goto out;
 	}
 
-	pr_info(DRV_NAME
-	       ": %s: Setting ARP monitoring interval to %d.\n",
-	       bond->dev->name, new_value);
+	pr_info("%s: Setting ARP monitoring interval to %d.\n",
+		bond->dev->name, new_value);
 	bond->params.arp_interval = new_value;
 	if (bond->params.arp_interval)
 		bond->dev->priv_flags |= IFF_MASTER_ARPMON;
 	if (bond->params.miimon) {
-		pr_info(DRV_NAME
-		       ": %s: ARP monitoring cannot be used with MII monitoring. "
-		       "%s Disabling MII monitoring.\n",
-		       bond->dev->name, bond->dev->name);
+		pr_info("%s: ARP monitoring cannot be used with MII monitoring. %s Disabling MII monitoring.\n",
+			bond->dev->name, bond->dev->name);
 		bond->params.miimon = 0;
 		if (delayed_work_pending(&bond->mii_work)) {
 			cancel_delayed_work(&bond->mii_work);
@@ -603,10 +584,8 @@ static ssize_t bonding_store_arp_interval(struct device *d,
 		}
 	}
 	if (!bond->params.arp_targets[0]) {
-		pr_info(DRV_NAME
-		       ": %s: ARP monitoring has been set up, "
-		       "but no ARP targets have been specified.\n",
-		       bond->dev->name);
+		pr_info("%s: ARP monitoring has been set up, but no ARP targets have been specified.\n",
+			bond->dev->name);
 	}
 	if (bond->dev->flags & IFF_UP) {
 		/* If the interface is up, we may need to fire off
@@ -666,8 +645,7 @@ static ssize_t bonding_store_arp_targets(struct device *d,
 	/* look for adds */
 	if (buf[0] == '+') {
 		if ((newtarget == 0) || (newtarget == htonl(INADDR_BROADCAST))) {
-			pr_err(DRV_NAME
-			       ": %s: invalid ARP target %pI4 specified for addition\n",
+			pr_err("%s: invalid ARP target %pI4 specified for addition\n",
 			       bond->dev->name, &newtarget);
 			ret = -EINVAL;
 			goto out;
@@ -675,23 +653,20 @@ static ssize_t bonding_store_arp_targets(struct device *d,
 		/* look for an empty slot to put the target in, and check for dupes */
 		for (i = 0; (i < BOND_MAX_ARP_TARGETS) && !done; i++) {
 			if (targets[i] == newtarget) { /* duplicate */
-				pr_err(DRV_NAME
-				       ": %s: ARP target %pI4 is already present\n",
+				pr_err("%s: ARP target %pI4 is already present\n",
 				       bond->dev->name, &newtarget);
 				ret = -EINVAL;
 				goto out;
 			}
 			if (targets[i] == 0) {
-				pr_info(DRV_NAME
-				       ": %s: adding ARP target %pI4.\n",
-				       bond->dev->name, &newtarget);
+				pr_info("%s: adding ARP target %pI4.\n",
+					bond->dev->name, &newtarget);
 				done = 1;
 				targets[i] = newtarget;
 			}
 		}
 		if (!done) {
-			pr_err(DRV_NAME
-			       ": %s: ARP target table is full!\n",
+			pr_err("%s: ARP target table is full!\n",
 			       bond->dev->name);
 			ret = -EINVAL;
 			goto out;
@@ -699,8 +674,7 @@ static ssize_t bonding_store_arp_targets(struct device *d,
 
 	} else if (buf[0] == '-')	{
 		if ((newtarget == 0) || (newtarget == htonl(INADDR_BROADCAST))) {
-			pr_err(DRV_NAME
-			       ": %s: invalid ARP target %pI4 specified for removal\n",
+			pr_err("%s: invalid ARP target %pI4 specified for removal\n",
 			       bond->dev->name, &newtarget);
 			ret = -EINVAL;
 			goto out;
@@ -709,9 +683,8 @@ static ssize_t bonding_store_arp_targets(struct device *d,
 		for (i = 0; (i < BOND_MAX_ARP_TARGETS) && !done; i++) {
 			if (targets[i] == newtarget) {
 				int j;
-				pr_info(DRV_NAME
-				       ": %s: removing ARP target %pI4.\n",
-				       bond->dev->name, &newtarget);
+				pr_info("%s: removing ARP target %pI4.\n",
+					bond->dev->name, &newtarget);
 				for (j = i; (j < (BOND_MAX_ARP_TARGETS-1)) && targets[j+1]; j++)
 					targets[j] = targets[j+1];
 
@@ -720,16 +693,14 @@ static ssize_t bonding_store_arp_targets(struct device *d,
 			}
 		}
 		if (!done) {
-			pr_info(DRV_NAME
-			       ": %s: unable to remove nonexistent ARP target %pI4.\n",
-			       bond->dev->name, &newtarget);
+			pr_info("%s: unable to remove nonexistent ARP target %pI4.\n",
+				bond->dev->name, &newtarget);
 			ret = -EINVAL;
 			goto out;
 		}
 	} else {
-		pr_err(DRV_NAME ": no command found in arp_ip_targets file"
-		       " for bond %s. Use +<addr> or -<addr>.\n",
-			bond->dev->name);
+		pr_err("no command found in arp_ip_targets file for bond %s. Use +<addr> or -<addr>.\n",
+		       bond->dev->name);
 		ret = -EPERM;
 		goto out;
 	}
@@ -761,41 +732,34 @@ static ssize_t bonding_store_downdelay(struct device *d,
 	struct bonding *bond = to_bond(d);
 
 	if (!(bond->params.miimon)) {
-		pr_err(DRV_NAME
-		       ": %s: Unable to set down delay as MII monitoring is disabled\n",
+		pr_err("%s: Unable to set down delay as MII monitoring is disabled\n",
 		       bond->dev->name);
 		ret = -EPERM;
 		goto out;
 	}
 
 	if (sscanf(buf, "%d", &new_value) != 1) {
-		pr_err(DRV_NAME
-		       ": %s: no down delay value specified.\n",
-		       bond->dev->name);
+		pr_err("%s: no down delay value specified.\n", bond->dev->name);
 		ret = -EINVAL;
 		goto out;
 	}
 	if (new_value < 0) {
-		pr_err(DRV_NAME
-		       ": %s: Invalid down delay value %d not in range %d-%d; rejected.\n",
+		pr_err("%s: Invalid down delay value %d not in range %d-%d; rejected.\n",
 		       bond->dev->name, new_value, 1, INT_MAX);
 		ret = -EINVAL;
 		goto out;
 	} else {
 		if ((new_value % bond->params.miimon) != 0) {
-			pr_warning(DRV_NAME
-				   ": %s: Warning: down delay (%d) is not a "
-				   "multiple of miimon (%d), delay rounded "
-				   "to %d ms\n",
+			pr_warning("%s: Warning: down delay (%d) is not a multiple of miimon (%d), delay rounded to %d ms\n",
 				   bond->dev->name, new_value,
 				   bond->params.miimon,
 				   (new_value / bond->params.miimon) *
 				   bond->params.miimon);
 		}
 		bond->params.downdelay = new_value / bond->params.miimon;
-		pr_info(DRV_NAME ": %s: Setting down delay to %d.\n",
-		       bond->dev->name,
-		       bond->params.downdelay * bond->params.miimon);
+		pr_info("%s: Setting down delay to %d.\n",
+			bond->dev->name,
+			bond->params.downdelay * bond->params.miimon);
 
 	}
 
@@ -823,41 +787,35 @@ static ssize_t bonding_store_updelay(struct device *d,
 	struct bonding *bond = to_bond(d);
 
 	if (!(bond->params.miimon)) {
-		pr_err(DRV_NAME
-		       ": %s: Unable to set up delay as MII monitoring is disabled\n",
+		pr_err("%s: Unable to set up delay as MII monitoring is disabled\n",
 		       bond->dev->name);
 		ret = -EPERM;
 		goto out;
 	}
 
 	if (sscanf(buf, "%d", &new_value) != 1) {
-		pr_err(DRV_NAME
-		       ": %s: no up delay value specified.\n",
+		pr_err("%s: no up delay value specified.\n",
 		       bond->dev->name);
 		ret = -EINVAL;
 		goto out;
 	}
 	if (new_value < 0) {
-		pr_err(DRV_NAME
-		       ": %s: Invalid down delay value %d not in range %d-%d; rejected.\n",
+		pr_err("%s: Invalid down delay value %d not in range %d-%d; rejected.\n",
 		       bond->dev->name, new_value, 1, INT_MAX);
 		ret = -EINVAL;
 		goto out;
 	} else {
 		if ((new_value % bond->params.miimon) != 0) {
-			pr_warning(DRV_NAME
-				   ": %s: Warning: up delay (%d) is not a "
-				   "multiple of miimon (%d), updelay rounded "
-				   "to %d ms\n",
+			pr_warning("%s: Warning: up delay (%d) is not a multiple of miimon (%d), updelay rounded to %d ms\n",
 				   bond->dev->name, new_value,
 				   bond->params.miimon,
 				   (new_value / bond->params.miimon) *
 				   bond->params.miimon);
 		}
 		bond->params.updelay = new_value / bond->params.miimon;
-		pr_info(DRV_NAME ": %s: Setting up delay to %d.\n",
-		       bond->dev->name, bond->params.updelay * bond->params.miimon);
-
+		pr_info("%s: Setting up delay to %d.\n",
+			bond->dev->name,
+			bond->params.updelay * bond->params.miimon);
 	}
 
 out:
@@ -889,16 +847,14 @@ static ssize_t bonding_store_lacp(struct device *d,
 	struct bonding *bond = to_bond(d);
 
 	if (bond->dev->flags & IFF_UP) {
-		pr_err(DRV_NAME
-		       ": %s: Unable to update LACP rate because interface is up.\n",
+		pr_err("%s: Unable to update LACP rate because interface is up.\n",
 		       bond->dev->name);
 		ret = -EPERM;
 		goto out;
 	}
 
 	if (bond->params.mode != BOND_MODE_8023AD) {
-		pr_err(DRV_NAME
-		       ": %s: Unable to update LACP rate because bond is not in 802.3ad mode.\n",
+		pr_err("%s: Unable to update LACP rate because bond is not in 802.3ad mode.\n",
 		       bond->dev->name);
 		ret = -EPERM;
 		goto out;
@@ -908,12 +864,11 @@ static ssize_t bonding_store_lacp(struct device *d,
 
 	if ((new_value == 1) || (new_value == 0)) {
 		bond->params.lacp_fast = new_value;
-		pr_info(DRV_NAME ": %s: Setting LACP rate to %s (%d).\n",
+		pr_info("%s: Setting LACP rate to %s (%d).\n",
 			bond->dev->name, bond_lacp_tbl[new_value].modename,
 			new_value);
 	} else {
-		pr_err(DRV_NAME
-		       ": %s: Ignoring invalid LACP rate value %.*s.\n",
+		pr_err("%s: Ignoring invalid LACP rate value %.*s.\n",
 		       bond->dev->name, (int)strlen(buf) - 1, buf);
 		ret = -EINVAL;
 	}
@@ -943,9 +898,8 @@ static ssize_t bonding_store_ad_select(struct device *d,
 	struct bonding *bond = to_bond(d);
 
 	if (bond->dev->flags & IFF_UP) {
-		pr_err(DRV_NAME
-		       ": %s: Unable to update ad_select because interface "
-		       "is up.\n", bond->dev->name);
+		pr_err("%s: Unable to update ad_select because interface is up.\n",
+		       bond->dev->name);
 		ret = -EPERM;
 		goto out;
 	}
@@ -954,13 +908,11 @@ static ssize_t bonding_store_ad_select(struct device *d,
 
 	if (new_value != -1) {
 		bond->params.ad_select = new_value;
-		pr_info(DRV_NAME
-		       ": %s: Setting ad_select to %s (%d).\n",
-		       bond->dev->name, ad_select_tbl[new_value].modename,
-		       new_value);
+		pr_info("%s: Setting ad_select to %s (%d).\n",
+			bond->dev->name, ad_select_tbl[new_value].modename,
+			new_value);
 	} else {
-		pr_err(DRV_NAME
-		       ": %s: Ignoring invalid ad_select value %.*s.\n",
+		pr_err("%s: Ignoring invalid ad_select value %.*s.\n",
 		       bond->dev->name, (int)strlen(buf) - 1, buf);
 		ret = -EINVAL;
 	}
@@ -990,15 +942,13 @@ static ssize_t bonding_store_n_grat_arp(struct device *d,
 	struct bonding *bond = to_bond(d);
 
 	if (sscanf(buf, "%d", &new_value) != 1) {
-		pr_err(DRV_NAME
-		       ": %s: no num_grat_arp value specified.\n",
+		pr_err("%s: no num_grat_arp value specified.\n",
 		       bond->dev->name);
 		ret = -EINVAL;
 		goto out;
 	}
 	if (new_value < 0 || new_value > 255) {
-		pr_err(DRV_NAME
-		       ": %s: Invalid num_grat_arp value %d not in range 0-255; rejected.\n",
+		pr_err("%s: Invalid num_grat_arp value %d not in range 0-255; rejected.\n",
 		       bond->dev->name, new_value);
 		ret = -EINVAL;
 		goto out;
@@ -1031,16 +981,14 @@ static ssize_t bonding_store_n_unsol_na(struct device *d,
 	struct bonding *bond = to_bond(d);
 
 	if (sscanf(buf, "%d", &new_value) != 1) {
-		pr_err(DRV_NAME
-		       ": %s: no num_unsol_na value specified.\n",
+		pr_err("%s: no num_unsol_na value specified.\n",
 		       bond->dev->name);
 		ret = -EINVAL;
 		goto out;
 	}
 
 	if (new_value < 0 || new_value > 255) {
-		pr_err(DRV_NAME
-		       ": %s: Invalid num_unsol_na value %d not in range 0-255; rejected.\n",
+		pr_err("%s: Invalid num_unsol_na value %d not in range 0-255; rejected.\n",
 		       bond->dev->name, new_value);
 		ret = -EINVAL;
 		goto out;
@@ -1075,40 +1023,31 @@ static ssize_t bonding_store_miimon(struct device *d,
 	struct bonding *bond = to_bond(d);
 
 	if (sscanf(buf, "%d", &new_value) != 1) {
-		pr_err(DRV_NAME
-		       ": %s: no miimon value specified.\n",
+		pr_err("%s: no miimon value specified.\n",
 		       bond->dev->name);
 		ret = -EINVAL;
 		goto out;
 	}
 	if (new_value < 0) {
-		pr_err(DRV_NAME
-		       ": %s: Invalid miimon value %d not in range %d-%d; rejected.\n",
+		pr_err("%s: Invalid miimon value %d not in range %d-%d; rejected.\n",
 		       bond->dev->name, new_value, 1, INT_MAX);
 		ret = -EINVAL;
 		goto out;
 	} else {
-		pr_info(DRV_NAME
-		       ": %s: Setting MII monitoring interval to %d.\n",
-		       bond->dev->name, new_value);
+		pr_info("%s: Setting MII monitoring interval to %d.\n",
+			bond->dev->name, new_value);
 		bond->params.miimon = new_value;
 		if (bond->params.updelay)
-			pr_info(DRV_NAME
-			      ": %s: Note: Updating updelay (to %d) "
-			      "since it is a multiple of the miimon value.\n",
-			      bond->dev->name,
-			      bond->params.updelay * bond->params.miimon);
+			pr_info("%s: Note: Updating updelay (to %d) since it is a multiple of the miimon value.\n",
+				bond->dev->name,
+				bond->params.updelay * bond->params.miimon);
 		if (bond->params.downdelay)
-			pr_info(DRV_NAME
-			      ": %s: Note: Updating downdelay (to %d) "
-			      "since it is a multiple of the miimon value.\n",
-			      bond->dev->name,
-			      bond->params.downdelay * bond->params.miimon);
+			pr_info("%s: Note: Updating downdelay (to %d) since it is a multiple of the miimon value.\n",
+				bond->dev->name,
+				bond->params.downdelay * bond->params.miimon);
 		if (bond->params.arp_interval) {
-			pr_info(DRV_NAME
-			       ": %s: MII monitoring cannot be used with "
-			       "ARP monitoring. Disabling ARP monitoring...\n",
-			       bond->dev->name);
+			pr_info("%s: MII monitoring cannot be used with ARP monitoring. Disabling ARP monitoring...\n",
+				bond->dev->name);
 			bond->params.arp_interval = 0;
 			bond->dev->priv_flags &= ~IFF_MASTER_ARPMON;
 			if (bond->params.arp_validate) {
@@ -1176,17 +1115,15 @@ static ssize_t bonding_store_primary(struct device *d,
 	write_lock_bh(&bond->curr_slave_lock);
 
 	if (!USES_PRIMARY(bond->params.mode)) {
-		pr_info(DRV_NAME
-		       ": %s: Unable to set primary slave; %s is in mode %d\n",
-		       bond->dev->name, bond->dev->name, bond->params.mode);
+		pr_info("%s: Unable to set primary slave; %s is in mode %d\n",
+			bond->dev->name, bond->dev->name, bond->params.mode);
 	} else {
 		bond_for_each_slave(bond, slave, i) {
 			if (strnicmp
 			    (slave->dev->name, buf,
 			     strlen(slave->dev->name)) == 0) {
-				pr_info(DRV_NAME
-				       ": %s: Setting %s as primary slave.\n",
-				       bond->dev->name, slave->dev->name);
+				pr_info("%s: Setting %s as primary slave.\n",
+					bond->dev->name, slave->dev->name);
 				bond->primary_slave = slave;
 				strcpy(bond->params.primary, slave->dev->name);
 				bond_select_active_slave(bond);
@@ -1197,15 +1134,13 @@ static ssize_t bonding_store_primary(struct device *d,
 		/* if we got here, then we didn't match the name of any slave */
 
 		if (strlen(buf) == 0 || buf[0] == '\n') {
-			pr_info(DRV_NAME
-			       ": %s: Setting primary slave to None.\n",
-			       bond->dev->name);
+			pr_info("%s: Setting primary slave to None.\n",
+				bond->dev->name);
 			bond->primary_slave = NULL;
 				bond_select_active_slave(bond);
 		} else {
-			pr_info(DRV_NAME
-			       ": %s: Unable to set %.*s as primary slave as it is not a slave.\n",
-			       bond->dev->name, (int)strlen(buf) - 1, buf);
+			pr_info("%s: Unable to set %.*s as primary slave as it is not a slave.\n",
+				bond->dev->name, (int)strlen(buf) - 1, buf);
 		}
 	}
 out:
@@ -1244,8 +1179,7 @@ static ssize_t bonding_store_primary_reselect(struct device *d,
 
 	new_value = bond_parse_parm(buf, pri_reselect_tbl);
 	if (new_value < 0)  {
-		pr_err(DRV_NAME
-		       ": %s: Ignoring invalid primary_reselect value %.*s.\n",
+		pr_err("%s: Ignoring invalid primary_reselect value %.*s.\n",
 		       bond->dev->name,
 		       (int) strlen(buf) - 1, buf);
 		ret = -EINVAL;
@@ -1253,7 +1187,7 @@ static ssize_t bonding_store_primary_reselect(struct device *d,
 	}
 
 	bond->params.primary_reselect = new_value;
-	pr_info(DRV_NAME ": %s: setting primary_reselect to %s (%d).\n",
+	pr_info("%s: setting primary_reselect to %s (%d).\n",
 		bond->dev->name, pri_reselect_tbl[new_value].modename,
 		new_value);
 
@@ -1291,20 +1225,18 @@ static ssize_t bonding_store_carrier(struct device *d,
 
 
 	if (sscanf(buf, "%d", &new_value) != 1) {
-		pr_err(DRV_NAME
-		       ": %s: no use_carrier value specified.\n",
+		pr_err("%s: no use_carrier value specified.\n",
 		       bond->dev->name);
 		ret = -EINVAL;
 		goto out;
 	}
 	if ((new_value == 0) || (new_value == 1)) {
 		bond->params.use_carrier = new_value;
-		pr_info(DRV_NAME ": %s: Setting use_carrier to %d.\n",
-		       bond->dev->name, new_value);
+		pr_info("%s: Setting use_carrier to %d.\n",
+			bond->dev->name, new_value);
 	} else {
-		pr_info(DRV_NAME
-		       ": %s: Ignoring invalid use_carrier value %d.\n",
-		       bond->dev->name, new_value);
+		pr_info("%s: Ignoring invalid use_carrier value %d.\n",
+			bond->dev->name, new_value);
 	}
 out:
 	return count;
@@ -1349,8 +1281,7 @@ static ssize_t bonding_store_active_slave(struct device *d,
 	write_lock_bh(&bond->curr_slave_lock);
 
 	if (!USES_PRIMARY(bond->params.mode))
-		pr_info(DRV_NAME ": %s: Unable to change active slave;"
-			" %s is in mode %d\n",
+		pr_info("%s: Unable to change active slave; %s is in mode %d\n",
 			bond->dev->name, bond->dev->name, bond->params.mode);
 	else {
 		bond_for_each_slave(bond, slave, i) {
@@ -1361,9 +1292,9 @@ static ssize_t bonding_store_active_slave(struct device *d,
         			new_active = slave;
         			if (new_active == old_active) {
 					/* do nothing */
-					pr_info(DRV_NAME
-						": %s: %s is already the current active slave.\n",
-						bond->dev->name, slave->dev->name);
+					pr_info("%s: %s is already the current active slave.\n",
+						bond->dev->name,
+						slave->dev->name);
 					goto out;
 				}
 				else {
@@ -1371,16 +1302,15 @@ static ssize_t bonding_store_active_slave(struct device *d,
             				    (old_active) &&
 				            (new_active->link == BOND_LINK_UP) &&
 				            IS_UP(new_active->dev)) {
-						pr_info(DRV_NAME
-							": %s: Setting %s as active slave.\n",
-							bond->dev->name, slave->dev->name);
+						pr_info("%s: Setting %s as active slave.\n",
+							bond->dev->name,
+							slave->dev->name);
 							bond_change_active_slave(bond, new_active);
         				}
 					else {
-						pr_info(DRV_NAME
-							": %s: Could not set %s as active slave; "
-							"either %s is down or the link is down.\n",
-							bond->dev->name, slave->dev->name,
+						pr_info("%s: Could not set %s as active slave; either %s is down or the link is down.\n",
+							bond->dev->name,
+							slave->dev->name,
 							slave->dev->name);
 					}
 					goto out;
@@ -1391,14 +1321,12 @@ static ssize_t bonding_store_active_slave(struct device *d,
 		/* if we got here, then we didn't match the name of any slave */
 
 		if (strlen(buf) == 0 || buf[0] == '\n') {
-			pr_info(DRV_NAME
-				": %s: Setting active slave to None.\n",
+			pr_info("%s: Setting active slave to None.\n",
 				bond->dev->name);
 			bond->primary_slave = NULL;
 			bond_select_active_slave(bond);
 		} else {
-			pr_info(DRV_NAME ": %s: Unable to set %.*s"
-				" as active slave as it is not a slave.\n",
+			pr_info("%s: Unable to set %.*s as active slave as it is not a slave.\n",
 				bond->dev->name, (int)strlen(buf) - 1, buf);
 		}
 	}
@@ -1600,8 +1528,7 @@ int bond_create_sysfs(void)
 		/* Is someone being kinky and naming a device bonding_master? */
 		if (__dev_get_by_name(&init_net,
 				      class_attr_bonding_masters.attr.name))
-			pr_err("network device named %s already "
-			       "exists in sysfs",
+			pr_err("network device named %s already exists in sysfs",
 			       class_attr_bonding_masters.attr.name);
 		ret = 0;
 	}
diff --git a/drivers/net/can/Kconfig b/drivers/net/can/Kconfig
index bb803fa1e6a7..05b751719bd5 100644
--- a/drivers/net/can/Kconfig
+++ b/drivers/net/can/Kconfig
@@ -50,10 +50,19 @@ config CAN_TI_HECC
 
 config CAN_MCP251X
 	tristate "Microchip MCP251x SPI CAN controllers"
-	depends on CAN_DEV && SPI
+	depends on CAN_DEV && SPI && HAS_DMA
 	---help---
 	  Driver for the Microchip MCP251x SPI CAN controllers.
 
+config CAN_BFIN
+	depends on CAN_DEV && (BF534 || BF536 || BF537 || BF538 || BF539 || BF54x)
+	tristate "Analog Devices Blackfin on-chip CAN"
+	---help---
+	  Driver for the Analog Devices Blackfin on-chip CAN controllers
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called bfin_can.
+
 source "drivers/net/can/mscan/Kconfig"
 
 source "drivers/net/can/sja1000/Kconfig"
diff --git a/drivers/net/can/Makefile b/drivers/net/can/Makefile
index 56899fef1c6a..7a702f28d01c 100644
--- a/drivers/net/can/Makefile
+++ b/drivers/net/can/Makefile
@@ -14,5 +14,6 @@ obj-$(CONFIG_CAN_MSCAN)		+= mscan/
 obj-$(CONFIG_CAN_AT91)		+= at91_can.o
 obj-$(CONFIG_CAN_TI_HECC)	+= ti_hecc.o
 obj-$(CONFIG_CAN_MCP251X)	+= mcp251x.o
+obj-$(CONFIG_CAN_BFIN)		+= bfin_can.o
 
 ccflags-$(CONFIG_CAN_DEBUG_DEVICES) := -DDEBUG
diff --git a/drivers/net/can/at91_can.c b/drivers/net/can/at91_can.c
index cbe3fce53e3b..166cc7e579c0 100644
--- a/drivers/net/can/at91_can.c
+++ b/drivers/net/can/at91_can.c
@@ -474,7 +474,7 @@ static void at91_read_mb(struct net_device *dev, unsigned int mb,
 	reg_msr = at91_read(priv, AT91_MSR(mb));
 	if (reg_msr & AT91_MSR_MRTR)
 		cf->can_id |= CAN_RTR_FLAG;
-	cf->can_dlc = min_t(__u8, (reg_msr >> 16) & 0xf, 8);
+	cf->can_dlc = get_can_dlc((reg_msr >> 16) & 0xf);
 
 	*(u32 *)(cf->data + 0) = at91_read(priv, AT91_MDL(mb));
 	*(u32 *)(cf->data + 4) = at91_read(priv, AT91_MDH(mb));
@@ -1037,7 +1037,7 @@ static int __init at91_can_probe(struct platform_device *pdev)
 
 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 	irq = platform_get_irq(pdev, 0);
-	if (!res || !irq) {
+	if (!res || irq <= 0) {
 		err = -ENODEV;
 		goto exit_put;
 	}
diff --git a/drivers/net/can/bfin_can.c b/drivers/net/can/bfin_can.c
new file mode 100644
index 000000000000..0ec1524523cc
--- /dev/null
+++ b/drivers/net/can/bfin_can.c
@@ -0,0 +1,783 @@
+/*
+ * Blackfin On-Chip CAN Driver
+ *
+ * Copyright 2004-2009 Analog Devices Inc.
+ *
+ * Enter bugs at http://blackfin.uclinux.org/
+ *
+ * Licensed under the GPL-2 or later.
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/bitops.h>
+#include <linux/interrupt.h>
+#include <linux/errno.h>
+#include <linux/netdevice.h>
+#include <linux/skbuff.h>
+#include <linux/platform_device.h>
+
+#include <linux/can.h>
+#include <linux/can/dev.h>
+#include <linux/can/error.h>
+
+#include <asm/portmux.h>
+
+#define DRV_NAME "bfin_can"
+#define BFIN_CAN_TIMEOUT 100
+
+/*
+ * transmit and receive channels
+ */
+#define TRANSMIT_CHL            24
+#define RECEIVE_STD_CHL         0
+#define RECEIVE_EXT_CHL         4
+#define RECEIVE_RTR_CHL         8
+#define RECEIVE_EXT_RTR_CHL     12
+#define MAX_CHL_NUMBER          32
+
+/*
+ * bfin can registers layout
+ */
+struct bfin_can_mask_regs {
+	u16 aml;
+	u16 dummy1;
+	u16 amh;
+	u16 dummy2;
+};
+
+struct bfin_can_channel_regs {
+	u16 data[8];
+	u16 dlc;
+	u16 dummy1;
+	u16 tsv;
+	u16 dummy2;
+	u16 id0;
+	u16 dummy3;
+	u16 id1;
+	u16 dummy4;
+};
+
+struct bfin_can_regs {
+	/*
+	 * global control and status registers
+	 */
+	u16 mc1;           /* offset 0 */
+	u16 dummy1;
+	u16 md1;           /* offset 4 */
+	u16 rsv1[13];
+	u16 mbtif1;        /* offset 0x20 */
+	u16 dummy2;
+	u16 mbrif1;        /* offset 0x24 */
+	u16 dummy3;
+	u16 mbim1;         /* offset 0x28 */
+	u16 rsv2[11];
+	u16 mc2;           /* offset 0x40 */
+	u16 dummy4;
+	u16 md2;           /* offset 0x44 */
+	u16 dummy5;
+	u16 trs2;          /* offset 0x48 */
+	u16 rsv3[11];
+	u16 mbtif2;        /* offset 0x60 */
+	u16 dummy6;
+	u16 mbrif2;        /* offset 0x64 */
+	u16 dummy7;
+	u16 mbim2;         /* offset 0x68 */
+	u16 rsv4[11];
+	u16 clk;           /* offset 0x80 */
+	u16 dummy8;
+	u16 timing;        /* offset 0x84 */
+	u16 rsv5[3];
+	u16 status;        /* offset 0x8c */
+	u16 dummy9;
+	u16 cec;           /* offset 0x90 */
+	u16 dummy10;
+	u16 gis;           /* offset 0x94 */
+	u16 dummy11;
+	u16 gim;           /* offset 0x98 */
+	u16 rsv6[3];
+	u16 ctrl;          /* offset 0xa0 */
+	u16 dummy12;
+	u16 intr;          /* offset 0xa4 */
+	u16 rsv7[7];
+	u16 esr;           /* offset 0xb4 */
+	u16 rsv8[37];
+
+	/*
+	 * channel(mailbox) mask and message registers
+	 */
+	struct bfin_can_mask_regs msk[MAX_CHL_NUMBER];    /* offset 0x100 */
+	struct bfin_can_channel_regs chl[MAX_CHL_NUMBER]; /* offset 0x200 */
+};
+
+/*
+ * bfin can private data
+ */
+struct bfin_can_priv {
+	struct can_priv can;	/* must be the first member */
+	struct net_device *dev;
+	void __iomem *membase;
+	int rx_irq;
+	int tx_irq;
+	int err_irq;
+	unsigned short *pin_list;
+};
+
+/*
+ * bfin can timing parameters
+ */
+static struct can_bittiming_const bfin_can_bittiming_const = {
+	.name = DRV_NAME,
+	.tseg1_min = 1,
+	.tseg1_max = 16,
+	.tseg2_min = 1,
+	.tseg2_max = 8,
+	.sjw_max = 4,
+	/*
+	 * Although the BRP field can be set to any value, it is recommended
+	 * that the value be greater than or equal to 4, as restrictions
+	 * apply to the bit timing configuration when BRP is less than 4.
+	 */
+	.brp_min = 4,
+	.brp_max = 1024,
+	.brp_inc = 1,
+};
+
+static int bfin_can_set_bittiming(struct net_device *dev)
+{
+	struct bfin_can_priv *priv = netdev_priv(dev);
+	struct bfin_can_regs __iomem *reg = priv->membase;
+	struct can_bittiming *bt = &priv->can.bittiming;
+	u16 clk, timing;
+
+	clk = bt->brp - 1;
+	timing = ((bt->sjw - 1) << 8) | (bt->prop_seg + bt->phase_seg1 - 1) |
+		((bt->phase_seg2 - 1) << 4);
+
+	/*
+	 * If the SAM bit is set, the input signal is oversampled three times
+	 * at the SCLK rate.
+	 */
+	if (priv->can.ctrlmode & CAN_CTRLMODE_3_SAMPLES)
+		timing |= SAM;
+
+	bfin_write16(&reg->clk, clk);
+	bfin_write16(&reg->timing, timing);
+
+	dev_info(dev->dev.parent, "setting CLOCK=0x%04x TIMING=0x%04x\n",
+			clk, timing);
+
+	return 0;
+}
+
+static void bfin_can_set_reset_mode(struct net_device *dev)
+{
+	struct bfin_can_priv *priv = netdev_priv(dev);
+	struct bfin_can_regs __iomem *reg = priv->membase;
+	int timeout = BFIN_CAN_TIMEOUT;
+	int i;
+
+	/* disable interrupts */
+	bfin_write16(&reg->mbim1, 0);
+	bfin_write16(&reg->mbim2, 0);
+	bfin_write16(&reg->gim, 0);
+
+	/* reset can and enter configuration mode */
+	bfin_write16(&reg->ctrl, SRS | CCR);
+	SSYNC();
+	bfin_write16(&reg->ctrl, CCR);
+	SSYNC();
+	while (!(bfin_read16(&reg->ctrl) & CCA)) {
+		udelay(10);
+		if (--timeout == 0) {
+			dev_err(dev->dev.parent,
+					"fail to enter configuration mode\n");
+			BUG();
+		}
+	}
+
+	/*
+	 * All mailbox configurations are marked as inactive
+	 * by writing to CAN Mailbox Configuration Registers 1 and 2
+	 * For all bits: 0 - Mailbox disabled, 1 - Mailbox enabled
+	 */
+	bfin_write16(&reg->mc1, 0);
+	bfin_write16(&reg->mc2, 0);
+
+	/* Set Mailbox Direction */
+	bfin_write16(&reg->md1, 0xFFFF);   /* mailbox 1-16 are RX */
+	bfin_write16(&reg->md2, 0);   /* mailbox 17-32 are TX */
+
+	/* RECEIVE_STD_CHL */
+	for (i = 0; i < 2; i++) {
+		bfin_write16(&reg->chl[RECEIVE_STD_CHL + i].id0, 0);
+		bfin_write16(&reg->chl[RECEIVE_STD_CHL + i].id1, AME);
+		bfin_write16(&reg->chl[RECEIVE_STD_CHL + i].dlc, 0);
+		bfin_write16(&reg->msk[RECEIVE_STD_CHL + i].amh, 0x1FFF);
+		bfin_write16(&reg->msk[RECEIVE_STD_CHL + i].aml, 0xFFFF);
+	}
+
+	/* RECEIVE_EXT_CHL */
+	for (i = 0; i < 2; i++) {
+		bfin_write16(&reg->chl[RECEIVE_EXT_CHL + i].id0, 0);
+		bfin_write16(&reg->chl[RECEIVE_EXT_CHL + i].id1, AME | IDE);
+		bfin_write16(&reg->chl[RECEIVE_EXT_CHL + i].dlc, 0);
+		bfin_write16(&reg->msk[RECEIVE_EXT_CHL + i].amh, 0x1FFF);
+		bfin_write16(&reg->msk[RECEIVE_EXT_CHL + i].aml, 0xFFFF);
+	}
+
+	bfin_write16(&reg->mc2, BIT(TRANSMIT_CHL - 16));
+	bfin_write16(&reg->mc1, BIT(RECEIVE_STD_CHL) + BIT(RECEIVE_EXT_CHL));
+	SSYNC();
+
+	priv->can.state = CAN_STATE_STOPPED;
+}
+
+static void bfin_can_set_normal_mode(struct net_device *dev)
+{
+	struct bfin_can_priv *priv = netdev_priv(dev);
+	struct bfin_can_regs __iomem *reg = priv->membase;
+	int timeout = BFIN_CAN_TIMEOUT;
+
+	/*
+	 * leave configuration mode
+	 */
+	bfin_write16(&reg->ctrl, bfin_read16(&reg->ctrl) & ~CCR);
+
+	while (bfin_read16(&reg->status) & CCA) {
+		udelay(10);
+		if (--timeout == 0) {
+			dev_err(dev->dev.parent,
+					"fail to leave configuration mode\n");
+			BUG();
+		}
+	}
+
+	/*
+	 * clear _All_  tx and rx interrupts
+	 */
+	bfin_write16(&reg->mbtif1, 0xFFFF);
+	bfin_write16(&reg->mbtif2, 0xFFFF);
+	bfin_write16(&reg->mbrif1, 0xFFFF);
+	bfin_write16(&reg->mbrif2, 0xFFFF);
+
+	/*
+	 * clear global interrupt status register
+	 */
+	bfin_write16(&reg->gis, 0x7FF); /* overwrites with '1' */
+
+	/*
+	 * Initialize Interrupts
+	 * - set bits in the mailbox interrupt mask register
+	 * - global interrupt mask
+	 */
+	bfin_write16(&reg->mbim1, BIT(RECEIVE_STD_CHL) + BIT(RECEIVE_EXT_CHL));
+	bfin_write16(&reg->mbim2, BIT(TRANSMIT_CHL - 16));
+
+	bfin_write16(&reg->gim, EPIM | BOIM | RMLIM);
+	SSYNC();
+}
+
+static void bfin_can_start(struct net_device *dev)
+{
+	struct bfin_can_priv *priv = netdev_priv(dev);
+
+	/* enter reset mode */
+	if (priv->can.state != CAN_STATE_STOPPED)
+		bfin_can_set_reset_mode(dev);
+
+	/* leave reset mode */
+	bfin_can_set_normal_mode(dev);
+}
+
+static int bfin_can_set_mode(struct net_device *dev, enum can_mode mode)
+{
+	switch (mode) {
+	case CAN_MODE_START:
+		bfin_can_start(dev);
+		if (netif_queue_stopped(dev))
+			netif_wake_queue(dev);
+		break;
+
+	default:
+		return -EOPNOTSUPP;
+	}
+
+	return 0;
+}
+
+static int bfin_can_start_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+	struct bfin_can_priv *priv = netdev_priv(dev);
+	struct bfin_can_regs __iomem *reg = priv->membase;
+	struct can_frame *cf = (struct can_frame *)skb->data;
+	u8 dlc = cf->can_dlc;
+	canid_t id = cf->can_id;
+	u8 *data = cf->data;
+	u16 val;
+	int i;
+
+	netif_stop_queue(dev);
+
+	/* fill id */
+	if (id & CAN_EFF_FLAG) {
+		bfin_write16(&reg->chl[TRANSMIT_CHL].id0, id);
+		if (id & CAN_RTR_FLAG)
+			writew(((id & 0x1FFF0000) >> 16) | IDE | AME | RTR,
+					&reg->chl[TRANSMIT_CHL].id1);
+		else
+			writew(((id & 0x1FFF0000) >> 16) | IDE | AME,
+					&reg->chl[TRANSMIT_CHL].id1);
+
+	} else {
+		if (id & CAN_RTR_FLAG)
+			writew((id << 2) | AME | RTR,
+				&reg->chl[TRANSMIT_CHL].id1);
+		else
+			bfin_write16(&reg->chl[TRANSMIT_CHL].id1,
+					(id << 2) | AME);
+	}
+
+	/* fill payload */
+	for (i = 0; i < 8; i += 2) {
+		val = ((7 - i) < dlc ? (data[7 - i]) : 0) +
+			((6 - i) < dlc ? (data[6 - i] << 8) : 0);
+		bfin_write16(&reg->chl[TRANSMIT_CHL].data[i], val);
+	}
+
+	/* fill data length code */
+	bfin_write16(&reg->chl[TRANSMIT_CHL].dlc, dlc);
+
+	dev->trans_start = jiffies;
+
+	can_put_echo_skb(skb, dev, 0);
+
+	/* set transmit request */
+	bfin_write16(&reg->trs2, BIT(TRANSMIT_CHL - 16));
+
+	return 0;
+}
+
+static void bfin_can_rx(struct net_device *dev, u16 isrc)
+{
+	struct bfin_can_priv *priv = netdev_priv(dev);
+	struct net_device_stats *stats = &dev->stats;
+	struct bfin_can_regs __iomem *reg = priv->membase;
+	struct can_frame *cf;
+	struct sk_buff *skb;
+	int obj;
+	int i;
+	u16 val;
+
+	skb = alloc_can_skb(dev, &cf);
+	if (skb == NULL)
+		return;
+
+	/* get id */
+	if (isrc & BIT(RECEIVE_EXT_CHL)) {
+		/* extended frame format (EFF) */
+		cf->can_id = ((bfin_read16(&reg->chl[RECEIVE_EXT_CHL].id1)
+			     & 0x1FFF) << 16)
+			     + bfin_read16(&reg->chl[RECEIVE_EXT_CHL].id0);
+		cf->can_id |= CAN_EFF_FLAG;
+		obj = RECEIVE_EXT_CHL;
+	} else {
+		/* standard frame format (SFF) */
+		cf->can_id = (bfin_read16(&reg->chl[RECEIVE_STD_CHL].id1)
+			     & 0x1ffc) >> 2;
+		obj = RECEIVE_STD_CHL;
+	}
+	if (bfin_read16(&reg->chl[obj].id1) & RTR)
+		cf->can_id |= CAN_RTR_FLAG;
+
+	/* get data length code */
+	cf->can_dlc = get_can_dlc(bfin_read16(&reg->chl[obj].dlc) & 0xF);
+
+	/* get payload */
+	for (i = 0; i < 8; i += 2) {
+		val = bfin_read16(&reg->chl[obj].data[i]);
+		cf->data[7 - i] = (7 - i) < cf->can_dlc ? val : 0;
+		cf->data[6 - i] = (6 - i) < cf->can_dlc ? (val >> 8) : 0;
+	}
+
+	netif_rx(skb);
+
+	stats->rx_packets++;
+	stats->rx_bytes += cf->can_dlc;
+}
+
+static int bfin_can_err(struct net_device *dev, u16 isrc, u16 status)
+{
+	struct bfin_can_priv *priv = netdev_priv(dev);
+	struct bfin_can_regs __iomem *reg = priv->membase;
+	struct net_device_stats *stats = &dev->stats;
+	struct can_frame *cf;
+	struct sk_buff *skb;
+	enum can_state state = priv->can.state;
+
+	skb = alloc_can_err_skb(dev, &cf);
+	if (skb == NULL)
+		return -ENOMEM;
+
+	if (isrc & RMLIS) {
+		/* data overrun interrupt */
+		dev_dbg(dev->dev.parent, "data overrun interrupt\n");
+		cf->can_id |= CAN_ERR_CRTL;
+		cf->data[1] = CAN_ERR_CRTL_RX_OVERFLOW;
+		stats->rx_over_errors++;
+		stats->rx_errors++;
+	}
+
+	if (isrc & BOIS) {
+		dev_dbg(dev->dev.parent, "bus-off mode interrupt\n");
+		state = CAN_STATE_BUS_OFF;
+		cf->can_id |= CAN_ERR_BUSOFF;
+		can_bus_off(dev);
+	}
+
+	if (isrc & EPIS) {
+		/* error passive interrupt */
+		dev_dbg(dev->dev.parent, "error passive interrupt\n");
+		state = CAN_STATE_ERROR_PASSIVE;
+	}
+
+	if ((isrc & EWTIS) || (isrc & EWRIS)) {
+		dev_dbg(dev->dev.parent,
+				"Error Warning Transmit/Receive Interrupt\n");
+		state = CAN_STATE_ERROR_WARNING;
+	}
+
+	if (state != priv->can.state && (state == CAN_STATE_ERROR_WARNING ||
+				state == CAN_STATE_ERROR_PASSIVE)) {
+		u16 cec = bfin_read16(&reg->cec);
+		u8 rxerr = cec;
+		u8 txerr = cec >> 8;
+
+		cf->can_id |= CAN_ERR_CRTL;
+		if (state == CAN_STATE_ERROR_WARNING) {
+			priv->can.can_stats.error_warning++;
+			cf->data[1] = (txerr > rxerr) ?
+				CAN_ERR_CRTL_TX_WARNING :
+				CAN_ERR_CRTL_RX_WARNING;
+		} else {
+			priv->can.can_stats.error_passive++;
+			cf->data[1] = (txerr > rxerr) ?
+				CAN_ERR_CRTL_TX_PASSIVE :
+				CAN_ERR_CRTL_RX_PASSIVE;
+		}
+	}
+
+	if (status) {
+		priv->can.can_stats.bus_error++;
+
+		cf->can_id |= CAN_ERR_PROT | CAN_ERR_BUSERROR;
+
+		if (status & BEF)
+			cf->data[2] |= CAN_ERR_PROT_BIT;
+		else if (status & FER)
+			cf->data[2] |= CAN_ERR_PROT_FORM;
+		else if (status & SER)
+			cf->data[2] |= CAN_ERR_PROT_STUFF;
+		else
+			cf->data[2] |= CAN_ERR_PROT_UNSPEC;
+	}
+
+	priv->can.state = state;
+
+	netif_rx(skb);
+
+	stats->rx_packets++;
+	stats->rx_bytes += cf->can_dlc;
+
+	return 0;
+}
+
+irqreturn_t bfin_can_interrupt(int irq, void *dev_id)
+{
+	struct net_device *dev = dev_id;
+	struct bfin_can_priv *priv = netdev_priv(dev);
+	struct bfin_can_regs __iomem *reg = priv->membase;
+	struct net_device_stats *stats = &dev->stats;
+	u16 status, isrc;
+
+	if ((irq == priv->tx_irq) && bfin_read16(&reg->mbtif2)) {
+		/* transmission complete interrupt */
+		bfin_write16(&reg->mbtif2, 0xFFFF);
+		stats->tx_packets++;
+		stats->tx_bytes += bfin_read16(&reg->chl[TRANSMIT_CHL].dlc);
+		can_get_echo_skb(dev, 0);
+		netif_wake_queue(dev);
+	} else if ((irq == priv->rx_irq) && bfin_read16(&reg->mbrif1)) {
+		/* receive interrupt */
+		isrc = bfin_read16(&reg->mbrif1);
+		bfin_write16(&reg->mbrif1, 0xFFFF);
+		bfin_can_rx(dev, isrc);
+	} else if ((irq == priv->err_irq) && bfin_read16(&reg->gis)) {
+		/* error interrupt */
+		isrc = bfin_read16(&reg->gis);
+		status = bfin_read16(&reg->esr);
+		bfin_write16(&reg->gis, 0x7FF);
+		bfin_can_err(dev, isrc, status);
+	} else {
+		return IRQ_NONE;
+	}
+
+	return IRQ_HANDLED;
+}
+
+static int bfin_can_open(struct net_device *dev)
+{
+	struct bfin_can_priv *priv = netdev_priv(dev);
+	int err;
+
+	/* set chip into reset mode */
+	bfin_can_set_reset_mode(dev);
+
+	/* common open */
+	err = open_candev(dev);
+	if (err)
+		goto exit_open;
+
+	/* register interrupt handler */
+	err = request_irq(priv->rx_irq, &bfin_can_interrupt, 0,
+			"bfin-can-rx", dev);
+	if (err)
+		goto exit_rx_irq;
+	err = request_irq(priv->tx_irq, &bfin_can_interrupt, 0,
+			"bfin-can-tx", dev);
+	if (err)
+		goto exit_tx_irq;
+	err = request_irq(priv->err_irq, &bfin_can_interrupt, 0,
+			"bfin-can-err", dev);
+	if (err)
+		goto exit_err_irq;
+
+	bfin_can_start(dev);
+
+	netif_start_queue(dev);
+
+	return 0;
+
+exit_err_irq:
+	free_irq(priv->tx_irq, dev);
+exit_tx_irq:
+	free_irq(priv->rx_irq, dev);
+exit_rx_irq:
+	close_candev(dev);
+exit_open:
+	return err;
+}
+
+static int bfin_can_close(struct net_device *dev)
+{
+	struct bfin_can_priv *priv = netdev_priv(dev);
+
+	netif_stop_queue(dev);
+	bfin_can_set_reset_mode(dev);
+
+	close_candev(dev);
+
+	free_irq(priv->rx_irq, dev);
+	free_irq(priv->tx_irq, dev);
+	free_irq(priv->err_irq, dev);
+
+	return 0;
+}
+
+struct net_device *alloc_bfin_candev(void)
+{
+	struct net_device *dev;
+	struct bfin_can_priv *priv;
+
+	dev = alloc_candev(sizeof(*priv));
+	if (!dev)
+		return NULL;
+
+	priv = netdev_priv(dev);
+
+	priv->dev = dev;
+	priv->can.bittiming_const = &bfin_can_bittiming_const;
+	priv->can.do_set_bittiming = bfin_can_set_bittiming;
+	priv->can.do_set_mode = bfin_can_set_mode;
+
+	return dev;
+}
+
+static const struct net_device_ops bfin_can_netdev_ops = {
+	.ndo_open               = bfin_can_open,
+	.ndo_stop               = bfin_can_close,
+	.ndo_start_xmit         = bfin_can_start_xmit,
+};
+
+static int __devinit bfin_can_probe(struct platform_device *pdev)
+{
+	int err;
+	struct net_device *dev;
+	struct bfin_can_priv *priv;
+	struct resource *res_mem, *rx_irq, *tx_irq, *err_irq;
+	unsigned short *pdata;
+
+	pdata = pdev->dev.platform_data;
+	if (!pdata) {
+		dev_err(&pdev->dev, "No platform data provided!\n");
+		err = -EINVAL;
+		goto exit;
+	}
+
+	res_mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	rx_irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+	tx_irq = platform_get_resource(pdev, IORESOURCE_IRQ, 1);
+	err_irq = platform_get_resource(pdev, IORESOURCE_IRQ, 2);
+	if (!res_mem || !rx_irq || !tx_irq || !err_irq) {
+		err = -EINVAL;
+		goto exit;
+	}
+
+	if (!request_mem_region(res_mem->start, resource_size(res_mem),
+				dev_name(&pdev->dev))) {
+		err = -EBUSY;
+		goto exit;
+	}
+
+	/* request peripheral pins */
+	err = peripheral_request_list(pdata, dev_name(&pdev->dev));
+	if (err)
+		goto exit_mem_release;
+
+	dev = alloc_bfin_candev();
+	if (!dev) {
+		err = -ENOMEM;
+		goto exit_peri_pin_free;
+	}
+
+	priv = netdev_priv(dev);
+	priv->membase = (void __iomem *)res_mem->start;
+	priv->rx_irq = rx_irq->start;
+	priv->tx_irq = tx_irq->start;
+	priv->err_irq = err_irq->start;
+	priv->pin_list = pdata;
+	priv->can.clock.freq = get_sclk();
+
+	dev_set_drvdata(&pdev->dev, dev);
+	SET_NETDEV_DEV(dev, &pdev->dev);
+
+	dev->flags |= IFF_ECHO;	/* we support local echo */
+	dev->netdev_ops = &bfin_can_netdev_ops;
+
+	bfin_can_set_reset_mode(dev);
+
+	err = register_candev(dev);
+	if (err) {
+		dev_err(&pdev->dev, "registering failed (err=%d)\n", err);
+		goto exit_candev_free;
+	}
+
+	dev_info(&pdev->dev,
+		"%s device registered"
+		"(&reg_base=%p, rx_irq=%d, tx_irq=%d, err_irq=%d, sclk=%d)\n",
+		DRV_NAME, (void *)priv->membase, priv->rx_irq,
+		priv->tx_irq, priv->err_irq, priv->can.clock.freq);
+	return 0;
+
+exit_candev_free:
+	free_candev(dev);
+exit_peri_pin_free:
+	peripheral_free_list(pdata);
+exit_mem_release:
+	release_mem_region(res_mem->start, resource_size(res_mem));
+exit:
+	return err;
+}
+
+static int __devexit bfin_can_remove(struct platform_device *pdev)
+{
+	struct net_device *dev = dev_get_drvdata(&pdev->dev);
+	struct bfin_can_priv *priv = netdev_priv(dev);
+	struct resource *res;
+
+	bfin_can_set_reset_mode(dev);
+
+	unregister_candev(dev);
+
+	dev_set_drvdata(&pdev->dev, NULL);
+
+	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	release_mem_region(res->start, resource_size(res));
+
+	peripheral_free_list(priv->pin_list);
+
+	free_candev(dev);
+	return 0;
+}
+
+#ifdef CONFIG_PM
+static int bfin_can_suspend(struct platform_device *pdev, pm_message_t mesg)
+{
+	struct net_device *dev = dev_get_drvdata(&pdev->dev);
+	struct bfin_can_priv *priv = netdev_priv(dev);
+	struct bfin_can_regs __iomem *reg = priv->membase;
+	int timeout = BFIN_CAN_TIMEOUT;
+
+	if (netif_running(dev)) {
+		/* enter sleep mode */
+		bfin_write16(&reg->ctrl, bfin_read16(&reg->ctrl) | SMR);
+		SSYNC();
+		while (!(bfin_read16(&reg->intr) & SMACK)) {
+			udelay(10);
+			if (--timeout == 0) {
+				dev_err(dev->dev.parent,
+						"fail to enter sleep mode\n");
+				BUG();
+			}
+		}
+	}
+
+	return 0;
+}
+
+static int bfin_can_resume(struct platform_device *pdev)
+{
+	struct net_device *dev = dev_get_drvdata(&pdev->dev);
+	struct bfin_can_priv *priv = netdev_priv(dev);
+	struct bfin_can_regs __iomem *reg = priv->membase;
+
+	if (netif_running(dev)) {
+		/* leave sleep mode */
+		bfin_write16(&reg->intr, 0);
+		SSYNC();
+	}
+
+	return 0;
+}
+#else
+#define bfin_can_suspend NULL
+#define bfin_can_resume NULL
+#endif	/* CONFIG_PM */
+
+static struct platform_driver bfin_can_driver = {
+	.probe = bfin_can_probe,
+	.remove = __devexit_p(bfin_can_remove),
+	.suspend = bfin_can_suspend,
+	.resume = bfin_can_resume,
+	.driver = {
+		.name = DRV_NAME,
+		.owner = THIS_MODULE,
+	},
+};
+
+static int __init bfin_can_init(void)
+{
+	return platform_driver_register(&bfin_can_driver);
+}
+module_init(bfin_can_init);
+
+static void __exit bfin_can_exit(void)
+{
+	platform_driver_unregister(&bfin_can_driver);
+}
+module_exit(bfin_can_exit);
+
+MODULE_AUTHOR("Barry Song <21cnbao@gmail.com>");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("Blackfin on-chip CAN netdevice driver");
diff --git a/drivers/net/can/mcp251x.c b/drivers/net/can/mcp251x.c
index 78b1b69b2921..1a72ca066a17 100644
--- a/drivers/net/can/mcp251x.c
+++ b/drivers/net/can/mcp251x.c
@@ -403,9 +403,8 @@ static void mcp251x_hw_rx_frame(struct spi_device *spi, u8 *buf,
 
 		for (i = 1; i < RXBDAT_OFF; i++)
 			buf[i] = mcp251x_read_reg(spi, RXBCTRL(buf_idx) + i);
-		len = buf[RXBDLC_OFF] & RXBDLC_LEN_MASK;
-		if (len > 8)
-			len = 8;
+
+		len = get_can_dlc(buf[RXBDLC_OFF] & RXBDLC_LEN_MASK);
 		for (; i < (RXBDAT_OFF + len); i++)
 			buf[i] = mcp251x_read_reg(spi, RXBCTRL(buf_idx) + i);
 	} else {
@@ -455,13 +454,7 @@ static void mcp251x_hw_rx(struct spi_device *spi, int buf_idx)
 			(buf[RXBSIDL_OFF] >> RXBSIDL_SHIFT);
 	}
 	/* Data length */
-	frame->can_dlc = buf[RXBDLC_OFF] & RXBDLC_LEN_MASK;
-	if (frame->can_dlc > 8) {
-		dev_warn(&spi->dev, "invalid frame recevied\n");
-		priv->net->stats.rx_errors++;
-		dev_kfree_skb(skb);
-		return;
-	}
+	frame->can_dlc = get_can_dlc(buf[RXBDLC_OFF] & RXBDLC_LEN_MASK);
 	memcpy(frame->data, buf + RXBDAT_OFF, frame->can_dlc);
 
 	priv->net->stats.rx_packets++;
@@ -997,7 +990,7 @@ static int __devinit mcp251x_can_probe(struct spi_device *spi)
 			goto error_tx_buf;
 		}
 		priv->spi_rx_buf = kmalloc(SPI_TRANSFER_BUF_LEN, GFP_KERNEL);
-		if (!priv->spi_tx_buf) {
+		if (!priv->spi_rx_buf) {
 			ret = -ENOMEM;
 			goto error_rx_buf;
 		}
diff --git a/drivers/net/can/mscan/mscan.c b/drivers/net/can/mscan/mscan.c
index bb06dfb58f25..07346f880ca6 100644
--- a/drivers/net/can/mscan/mscan.c
+++ b/drivers/net/can/mscan/mscan.c
@@ -297,7 +297,8 @@ static void mscan_get_rx_frame(struct net_device *dev, struct can_frame *frame)
 	frame->can_id |= can_id >> 1;
 	if (can_id & 1)
 		frame->can_id |= CAN_RTR_FLAG;
-	frame->can_dlc = in_8(&regs->rx.dlr) & 0xf;
+
+	frame->can_dlc = get_can_dlc(in_8(&regs->rx.dlr) & 0xf);
 
 	if (!(frame->can_id & CAN_RTR_FLAG)) {
 		void __iomem *data = &regs->rx.dsr1_0;
diff --git a/drivers/net/can/sja1000/sja1000.c b/drivers/net/can/sja1000/sja1000.c
index b4ba88a31075..542a4f7255b4 100644
--- a/drivers/net/can/sja1000/sja1000.c
+++ b/drivers/net/can/sja1000/sja1000.c
@@ -293,15 +293,14 @@ static void sja1000_rx(struct net_device *dev)
 	uint8_t fi;
 	uint8_t dreg;
 	canid_t id;
-	uint8_t dlc;
 	int i;
 
+	/* create zero'ed CAN frame buffer */
 	skb = alloc_can_skb(dev, &cf);
 	if (skb == NULL)
 		return;
 
 	fi = priv->read_reg(priv, REG_FI);
-	dlc = fi & 0x0F;
 
 	if (fi & FI_FF) {
 		/* extended frame format (EFF) */
@@ -318,16 +317,15 @@ static void sja1000_rx(struct net_device *dev)
 		    | (priv->read_reg(priv, REG_ID2) >> 5);
 	}
 
-	if (fi & FI_RTR)
+	if (fi & FI_RTR) {
 		id |= CAN_RTR_FLAG;
+	} else {
+		cf->can_dlc = get_can_dlc(fi & 0x0F);
+		for (i = 0; i < cf->can_dlc; i++)
+			cf->data[i] = priv->read_reg(priv, dreg++);
+	}
 
 	cf->can_id = id;
-	cf->can_dlc = dlc;
-	for (i = 0; i < dlc; i++)
-		cf->data[i] = priv->read_reg(priv, dreg++);
-
-	while (i < 8)
-		cf->data[i++] = 0;
 
 	/* release receive buffer */
 	priv->write_reg(priv, REG_CMR, CMD_RRB);
@@ -335,7 +333,7 @@ static void sja1000_rx(struct net_device *dev)
 	netif_rx(skb);
 
 	stats->rx_packets++;
-	stats->rx_bytes += dlc;
+	stats->rx_bytes += cf->can_dlc;
 }
 
 static int sja1000_err(struct net_device *dev, uint8_t isrc, uint8_t status)
diff --git a/drivers/net/can/ti_hecc.c b/drivers/net/can/ti_hecc.c
index 07e8016b17ec..5c993c2da528 100644
--- a/drivers/net/can/ti_hecc.c
+++ b/drivers/net/can/ti_hecc.c
@@ -552,7 +552,7 @@ static int ti_hecc_rx_pkt(struct ti_hecc_priv *priv, int mbxno)
 	data = hecc_read_mbx(priv, mbxno, HECC_CANMCF);
 	if (data & HECC_CANMCF_RTR)
 		cf->can_id |= CAN_RTR_FLAG;
-	cf->can_dlc = data & 0xF;
+	cf->can_dlc = get_can_dlc(data & 0xF);
 	data = hecc_read_mbx(priv, mbxno, HECC_CANMDL);
 	*(u32 *)(cf->data) = cpu_to_be32(data);
 	if (cf->can_dlc > 4) {
diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c
index 591eb0eb1c2b..efbb05c71bf4 100644
--- a/drivers/net/can/usb/ems_usb.c
+++ b/drivers/net/can/usb/ems_usb.c
@@ -316,7 +316,7 @@ static void ems_usb_rx_can_msg(struct ems_usb *dev, struct ems_cpc_msg *msg)
 		return;
 
 	cf->can_id = le32_to_cpu(msg->msg.can_msg.id);
-	cf->can_dlc = min_t(u8, msg->msg.can_msg.length, 8);
+	cf->can_dlc = get_can_dlc(msg->msg.can_msg.length & 0xF);
 
 	if (msg->type == CPC_MSG_TYPE_EXT_CAN_FRAME ||
 	    msg->type == CPC_MSG_TYPE_EXT_RTR_FRAME)
diff --git a/drivers/net/chelsio/sge.c b/drivers/net/chelsio/sge.c
index 8c658cf6f62f..109d2783e4d8 100644
--- a/drivers/net/chelsio/sge.c
+++ b/drivers/net/chelsio/sge.c
@@ -1378,7 +1378,7 @@ static void sge_rx(struct sge *sge, struct freelQ *fl, unsigned int len)
 	}
 	__skb_pull(skb, sizeof(*p));
 
-	st = per_cpu_ptr(sge->port_stats[p->iff], smp_processor_id());
+	st = this_cpu_ptr(sge->port_stats[p->iff]);
 
 	skb->protocol = eth_type_trans(skb, adapter->port[p->iff].dev);
 	if ((adapter->flags & RX_CSUM_ENABLED) && p->csum == 0xffff &&
@@ -1780,8 +1780,7 @@ netdev_tx_t t1_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
 	struct adapter *adapter = dev->ml_priv;
 	struct sge *sge = adapter->sge;
-	struct sge_port_stats *st = per_cpu_ptr(sge->port_stats[dev->if_port],
-						smp_processor_id());
+	struct sge_port_stats *st = this_cpu_ptr(sge->port_stats[dev->if_port]);
 	struct cpl_tx_pkt *cpl;
 	struct sk_buff *orig_skb = skb;
 	int ret;
diff --git a/drivers/net/cnic.c b/drivers/net/cnic.c
index d4c6e7fcff53..4332b3a2fafb 100644
--- a/drivers/net/cnic.c
+++ b/drivers/net/cnic.c
@@ -1104,6 +1104,8 @@ static int cnic_alloc_bnx2x_resc(struct cnic_dev *dev)
 	cp->bnx2x_status_blk = cp->status_blk;
 	cp->bnx2x_def_status_blk = cp->ethdev->irq_arr[1].status_blk;
 
+	memset(cp->bnx2x_status_blk, 0, sizeof(struct host_status_block));
+
 	cp->l2_rx_ring_size = 15;
 
 	ret = cnic_alloc_l2_rings(dev, 4);
@@ -4183,6 +4185,12 @@ static void cnic_shutdown_rings(struct cnic_dev *dev)
 		cnic_submit_kwqe_16(dev, RAMROD_CMD_ID_ETH_HALT,
 			BNX2X_ISCSI_L2_CID, ETH_CONNECTION_TYPE, &l5_data);
 		msleep(10);
+
+		memset(&l5_data, 0, sizeof(l5_data));
+		cnic_submit_kwqe_16(dev, RAMROD_CMD_ID_ETH_CFC_DEL,
+			BNX2X_ISCSI_L2_CID, ETH_CONNECTION_TYPE |
+			(1 << SPE_HDR_COMMON_RAMROD_SHIFT), &l5_data);
+		msleep(10);
 	}
 }
 
@@ -4289,6 +4297,9 @@ static void cnic_stop_bnx2x_hw(struct cnic_dev *dev)
 		  offsetof(struct cstorm_status_block_c,
 			   index_values[HC_INDEX_C_ISCSI_EQ_CONS]),
 		  0);
+	CNIC_WR(dev, BAR_CSTRORM_INTMEM +
+		CSTORM_ISCSI_EQ_CONS_OFFSET(cp->func, 0), 0);
+	CNIC_WR16(dev, cp->kcq_io_addr, 0);
 	cnic_free_resc(dev);
 }
 
diff --git a/drivers/net/cpmac.c b/drivers/net/cpmac.c
index 678222389407..8d0be26f94e3 100644
--- a/drivers/net/cpmac.c
+++ b/drivers/net/cpmac.c
@@ -1163,7 +1163,7 @@ static int __devinit cpmac_probe(struct platform_device *pdev)
 	priv->dev = dev;
 	priv->ring_size = 64;
 	priv->msg_enable = netif_msg_init(debug_level, 0xff);
-	memcpy(dev->dev_addr, pdata->dev_addr, sizeof(dev->dev_addr));
+	memcpy(dev->dev_addr, pdata->dev_addr, sizeof(pdata->dev_addr));
 
 	snprintf(priv->phy_name, MII_BUS_ID_SIZE, PHY_ID_FMT, mdio_bus_id, phy_id);
 
diff --git a/drivers/net/cs89x0.c b/drivers/net/cs89x0.c
index af9321617ce4..0e79cef95c0a 100644
--- a/drivers/net/cs89x0.c
+++ b/drivers/net/cs89x0.c
@@ -1325,8 +1325,7 @@ net_open(struct net_device *dev)
 		write_irq(dev, lp->chip_type, dev->irq);
 		ret = request_irq(dev->irq, net_interrupt, 0, dev->name, dev);
 		if (ret) {
-			if (net_debug)
-				printk(KERN_DEBUG "cs89x0: request_irq(%d) failed\n", dev->irq);
+			printk(KERN_ERR "cs89x0: request_irq(%d) failed\n", dev->irq);
 			goto bad_out;
 		}
 	}
diff --git a/drivers/net/cxgb3/cxgb3_main.c b/drivers/net/cxgb3/cxgb3_main.c
index cef3f882e2b6..89bec9c3c141 100644
--- a/drivers/net/cxgb3/cxgb3_main.c
+++ b/drivers/net/cxgb3/cxgb3_main.c
@@ -2860,6 +2860,7 @@ static int t3_reenable_adapter(struct adapter *adapter)
 	}
 	pci_set_master(adapter->pdev);
 	pci_restore_state(adapter->pdev);
+	pci_save_state(adapter->pdev);
 
 	/* Free sge resources */
 	t3_free_sge_resources(adapter);
diff --git a/drivers/net/cxgb3/sge.c b/drivers/net/cxgb3/sge.c
index 49f3de79118c..318a018ca7c5 100644
--- a/drivers/net/cxgb3/sge.c
+++ b/drivers/net/cxgb3/sge.c
@@ -1285,7 +1285,7 @@ netdev_tx_t t3_eth_xmit(struct sk_buff *skb, struct net_device *dev)
 
 	/*
 	 * We do not use Tx completion interrupts to free DMAd Tx packets.
-	 * This is good for performamce but means that we rely on new Tx
+	 * This is good for performance but means that we rely on new Tx
 	 * packets arriving to run the destructors of completed packets,
 	 * which open up space in their sockets' send queues.  Sometimes
 	 * we do not get such new packets causing Tx to stall.  A single
@@ -2079,6 +2079,7 @@ static void lro_add_page(struct adapter *adap, struct sge_qset *qs,
 			 struct sge_fl *fl, int len, int complete)
 {
 	struct rx_sw_desc *sd = &fl->sdesc[fl->cidx];
+	struct port_info *pi = netdev_priv(qs->netdev);
 	struct sk_buff *skb = NULL;
 	struct cpl_rx_pkt *cpl;
 	struct skb_frag_struct *rx_frag;
@@ -2116,11 +2117,18 @@ static void lro_add_page(struct adapter *adap, struct sge_qset *qs,
 
 	if (!nr_frags) {
 		offset = 2 + sizeof(struct cpl_rx_pkt);
-		qs->lro_va = sd->pg_chunk.va + 2;
-	}
-	len -= offset;
+		cpl = qs->lro_va = sd->pg_chunk.va + 2;
 
-	prefetch(qs->lro_va);
+		if ((pi->rx_offload & T3_RX_CSUM) &&
+		     cpl->csum_valid && cpl->csum == htons(0xffff)) {
+			skb->ip_summed = CHECKSUM_UNNECESSARY;
+			qs->port_stats[SGE_PSTAT_RX_CSUM_GOOD]++;
+		} else
+			skb->ip_summed = CHECKSUM_NONE;
+	} else
+		cpl = qs->lro_va;
+
+	len -= offset;
 
 	rx_frag += nr_frags;
 	rx_frag->page = sd->pg_chunk.page;
@@ -2136,12 +2144,8 @@ static void lro_add_page(struct adapter *adap, struct sge_qset *qs,
 		return;
 
 	skb_record_rx_queue(skb, qs - &adap->sge.qs[0]);
-	skb->ip_summed = CHECKSUM_UNNECESSARY;
-	cpl = qs->lro_va;
 
 	if (unlikely(cpl->vlan_valid)) {
-		struct net_device *dev = qs->netdev;
-		struct port_info *pi = netdev_priv(dev);
 		struct vlan_group *grp = pi->vlan_grp;
 
 		if (likely(grp != NULL)) {
diff --git a/drivers/net/davinci_emac.c b/drivers/net/davinci_emac.c
index 8edac8915ea8..33c4fe26178c 100644
--- a/drivers/net/davinci_emac.c
+++ b/drivers/net/davinci_emac.c
@@ -2272,7 +2272,7 @@ static int emac_mii_reset(struct mii_bus *bus)
 	unsigned int clk_div;
 	int mdio_bus_freq = emac_bus_frequency;
 
-	if (mdio_max_freq & mdio_bus_freq)
+	if (mdio_max_freq && mdio_bus_freq)
 		clk_div = ((mdio_bus_freq / mdio_max_freq) - 1);
 	else
 		clk_div = 0xFF;
@@ -2711,6 +2711,8 @@ static int __devinit davinci_emac_probe(struct platform_device *pdev)
 	SET_ETHTOOL_OPS(ndev, &ethtool_ops);
 	netif_napi_add(ndev, &priv->napi, emac_poll, EMAC_POLL_WEIGHT);
 
+	clk_enable(emac_clk);
+
 	/* register the network device */
 	SET_NETDEV_DEV(ndev, &pdev->dev);
 	rc = register_netdev(ndev);
@@ -2720,7 +2722,6 @@ static int __devinit davinci_emac_probe(struct platform_device *pdev)
 		goto netdev_reg_err;
 	}
 
-	clk_enable(emac_clk);
 
 	/* MII/Phy intialisation, mdio bus registration */
 	emac_mii = mdiobus_alloc();
@@ -2760,6 +2761,7 @@ mdiobus_quit:
 
 netdev_reg_err:
 mdio_alloc_err:
+	clk_disable(emac_clk);
 no_irq_res:
 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 	release_mem_region(res->start, res->end - res->start + 1);
diff --git a/drivers/net/dm9000.c b/drivers/net/dm9000.c
index 0cbe3c0e7c06..b37730065688 100644
--- a/drivers/net/dm9000.c
+++ b/drivers/net/dm9000.c
@@ -1646,7 +1646,7 @@ dm9000_drv_resume(struct device *dev)
 	return 0;
 }
 
-static struct dev_pm_ops dm9000_drv_pm_ops = {
+static const struct dev_pm_ops dm9000_drv_pm_ops = {
 	.suspend	= dm9000_drv_suspend,
 	.resume		= dm9000_drv_resume,
 };
diff --git a/drivers/net/e100.c b/drivers/net/e100.c
index 929701ca07d3..839fb2b136d3 100644
--- a/drivers/net/e100.c
+++ b/drivers/net/e100.c
@@ -1829,6 +1829,7 @@ static int e100_alloc_cbs(struct nic *nic)
 				  &nic->cbs_dma_addr);
 	if (!nic->cbs)
 		return -ENOMEM;
+	memset(nic->cbs, 0, count * sizeof(struct cb));
 
 	for (cb = nic->cbs, i = 0; i < count; cb++, i++) {
 		cb->next = (i + 1 < count) ? cb + 1 : nic->cbs;
@@ -1837,7 +1838,6 @@ static int e100_alloc_cbs(struct nic *nic)
 		cb->dma_addr = nic->cbs_dma_addr + i * sizeof(struct cb);
 		cb->link = cpu_to_le32(nic->cbs_dma_addr +
 			((i+1) % count) * sizeof(struct cb));
-		cb->skb = NULL;
 	}
 
 	nic->cb_to_use = nic->cb_to_send = nic->cb_to_clean = nic->cbs;
diff --git a/drivers/net/e1000/e1000.h b/drivers/net/e1000/e1000.h
index 2a567df3ea71..e8932db7ee77 100644
--- a/drivers/net/e1000/e1000.h
+++ b/drivers/net/e1000/e1000.h
@@ -326,6 +326,8 @@ struct e1000_adapter {
 	/* for ioport free */
 	int bars;
 	int need_ioport;
+
+	bool discarding;
 };
 
 enum e1000_state_t {
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index 7e855f9bbd97..d29bb532eccf 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -1698,18 +1698,6 @@ static void e1000_setup_rctl(struct e1000_adapter *adapter)
 	rctl &= ~E1000_RCTL_SZ_4096;
 	rctl |= E1000_RCTL_BSEX;
 	switch (adapter->rx_buffer_len) {
-		case E1000_RXBUFFER_256:
-			rctl |= E1000_RCTL_SZ_256;
-			rctl &= ~E1000_RCTL_BSEX;
-			break;
-		case E1000_RXBUFFER_512:
-			rctl |= E1000_RCTL_SZ_512;
-			rctl &= ~E1000_RCTL_BSEX;
-			break;
-		case E1000_RXBUFFER_1024:
-			rctl |= E1000_RCTL_SZ_1024;
-			rctl &= ~E1000_RCTL_BSEX;
-			break;
 		case E1000_RXBUFFER_2048:
 		default:
 			rctl |= E1000_RCTL_SZ_2048;
@@ -2802,13 +2790,13 @@ static int e1000_tx_map(struct e1000_adapter *adapter,
 dma_error:
 	dev_err(&pdev->dev, "TX DMA map failed\n");
 	buffer_info->dma = 0;
-	count--;
-
-	while (count >= 0) {
+	if (count)
 		count--;
-		i--;
-		if (i < 0)
+
+	while (count--) {
+		if (i==0)
 			i += tx_ring->count;
+		i--;
 		buffer_info = &tx_ring->buffer_info[i];
 		e1000_unmap_and_free_tx_resource(adapter, buffer_info);
 	}
@@ -3176,13 +3164,7 @@ static int e1000_change_mtu(struct net_device *netdev, int new_mtu)
 	 *  however with the new *_jumbo_rx* routines, jumbo receives will use
 	 *  fragmented skbs */
 
-	if (max_frame <= E1000_RXBUFFER_256)
-		adapter->rx_buffer_len = E1000_RXBUFFER_256;
-	else if (max_frame <= E1000_RXBUFFER_512)
-		adapter->rx_buffer_len = E1000_RXBUFFER_512;
-	else if (max_frame <= E1000_RXBUFFER_1024)
-		adapter->rx_buffer_len = E1000_RXBUFFER_1024;
-	else if (max_frame <= E1000_RXBUFFER_2048)
+	if (max_frame <= E1000_RXBUFFER_2048)
 		adapter->rx_buffer_len = E1000_RXBUFFER_2048;
 	else
 #if (PAGE_SIZE >= E1000_RXBUFFER_16384)
@@ -3850,13 +3832,22 @@ static bool e1000_clean_rx_irq(struct e1000_adapter *adapter,
 
 		length = le16_to_cpu(rx_desc->length);
 		/* !EOP means multiple descriptors were used to store a single
-		 * packet, also make sure the frame isn't just CRC only */
-		if (unlikely(!(status & E1000_RXD_STAT_EOP) || (length <= 4))) {
+		 * packet, if thats the case we need to toss it.  In fact, we
+		 * to toss every packet with the EOP bit clear and the next
+		 * frame that _does_ have the EOP bit set, as it is by
+		 * definition only a frame fragment
+		 */
+		if (unlikely(!(status & E1000_RXD_STAT_EOP)))
+			adapter->discarding = true;
+
+		if (adapter->discarding) {
 			/* All receives must fit into a single buffer */
 			E1000_DBG("%s: Receive packet consumed multiple"
 				  " buffers\n", netdev->name);
 			/* recycle */
 			buffer_info->skb = skb;
+			if (status & E1000_RXD_STAT_EOP)
+				adapter->discarding = false;
 			goto next_desc;
 		}
 
diff --git a/drivers/net/e1000e/82571.c b/drivers/net/e1000e/82571.c
index c1a42cfc80ba..02d67d047d96 100644
--- a/drivers/net/e1000e/82571.c
+++ b/drivers/net/e1000e/82571.c
@@ -237,6 +237,8 @@ static s32 e1000_init_mac_params_82571(struct e1000_adapter *adapter)
 	/* Set if manageability features are enabled. */
 	mac->arc_subsystem_valid = (er32(FWSM) & E1000_FWSM_MODE_MASK)
 	                ? true : false;
+	/* Adaptive IFS supported */
+	mac->adaptive_ifs = true;
 
 	/* check for link */
 	switch (hw->phy.media_type) {
@@ -1290,7 +1292,6 @@ static s32 e1000_setup_link_82571(struct e1000_hw *hw)
 static s32 e1000_setup_copper_link_82571(struct e1000_hw *hw)
 {
 	u32 ctrl;
-	u32 led_ctrl;
 	s32 ret_val;
 
 	ctrl = er32(CTRL);
@@ -1305,11 +1306,6 @@ static s32 e1000_setup_copper_link_82571(struct e1000_hw *hw)
 		break;
 	case e1000_phy_igp_2:
 		ret_val = e1000e_copper_link_setup_igp(hw);
-		/* Setup activity LED */
-		led_ctrl = er32(LEDCTL);
-		led_ctrl &= IGP_ACTIVITY_LED_MASK;
-		led_ctrl |= (IGP_ACTIVITY_LED_ENABLE | IGP_LED3_MODE);
-		ew32(LEDCTL, led_ctrl);
 		break;
 	default:
 		return -E1000_ERR_PHY;
diff --git a/drivers/net/e1000e/e1000.h b/drivers/net/e1000e/e1000.h
index cebbd9079d53..d236efaf7478 100644
--- a/drivers/net/e1000e/e1000.h
+++ b/drivers/net/e1000e/e1000.h
@@ -421,6 +421,7 @@ struct e1000_info {
 /* CRC Stripping defines */
 #define FLAG2_CRC_STRIPPING               (1 << 0)
 #define FLAG2_HAS_PHY_WAKEUP              (1 << 1)
+#define FLAG2_IS_DISCARDING               (1 << 2)
 
 #define E1000_RX_DESC_PS(R, i)	    \
 	(&(((union e1000_rx_desc_packet_split *)((R).desc))[i]))
@@ -582,7 +583,6 @@ extern s32 e1000_read_phy_reg_hv_locked(struct e1000_hw *hw, u32 offset,
 extern s32 e1000_write_phy_reg_hv(struct e1000_hw *hw, u32 offset, u16 data);
 extern s32 e1000_write_phy_reg_hv_locked(struct e1000_hw *hw, u32 offset,
                                          u16 data);
-extern s32 e1000_set_mdio_slow_mode_hv(struct e1000_hw *hw, bool slow);
 extern s32 e1000_link_stall_workaround_hv(struct e1000_hw *hw);
 extern s32 e1000_copper_link_setup_82577(struct e1000_hw *hw);
 extern s32 e1000_check_polarity_82577(struct e1000_hw *hw);
diff --git a/drivers/net/e1000e/es2lan.c b/drivers/net/e1000e/es2lan.c
index 3028f23da891..e2aa3b788564 100644
--- a/drivers/net/e1000e/es2lan.c
+++ b/drivers/net/e1000e/es2lan.c
@@ -224,6 +224,8 @@ static s32 e1000_init_mac_params_80003es2lan(struct e1000_adapter *adapter)
 	/* Set if manageability features are enabled. */
 	mac->arc_subsystem_valid = (er32(FWSM) & E1000_FWSM_MODE_MASK)
                         ? true : false;
+	/* Adaptive IFS not supported */
+	mac->adaptive_ifs = false;
 
 	/* check for link */
 	switch (hw->phy.media_type) {
diff --git a/drivers/net/e1000e/hw.h b/drivers/net/e1000e/hw.h
index 2784cf44a6f3..eccf29b75c41 100644
--- a/drivers/net/e1000e/hw.h
+++ b/drivers/net/e1000e/hw.h
@@ -818,6 +818,7 @@ struct e1000_mac_info {
 
 	u8  forced_speed_duplex;
 
+	bool adaptive_ifs;
 	bool arc_subsystem_valid;
 	bool autoneg;
 	bool autoneg_failed;
diff --git a/drivers/net/e1000e/ich8lan.c b/drivers/net/e1000e/ich8lan.c
index 9b09246af064..8b6ecd127889 100644
--- a/drivers/net/e1000e/ich8lan.c
+++ b/drivers/net/e1000e/ich8lan.c
@@ -138,6 +138,10 @@
 #define E1000_NVM_K1_CONFIG 0x1B /* NVM K1 Config Word */
 #define E1000_NVM_K1_ENABLE 0x1  /* NVM Enable K1 bit */
 
+/* KMRN Mode Control */
+#define HV_KMRN_MODE_CTRL      PHY_REG(769, 16)
+#define HV_KMRN_MDIO_SLOW      0x0400
+
 /* ICH GbE Flash Hardware Sequencing Flash Status Register bit breakdown */
 /* Offset 04h HSFSTS */
 union ich8_hws_flash_status {
@@ -219,6 +223,7 @@ static s32 e1000_set_lplu_state_pchlan(struct e1000_hw *hw, bool active);
 static void e1000_power_down_phy_copper_ich8lan(struct e1000_hw *hw);
 static void e1000_lan_init_done_ich8lan(struct e1000_hw *hw);
 static s32  e1000_k1_gig_workaround_hv(struct e1000_hw *hw, bool link);
+static s32 e1000_set_mdio_slow_mode_hv(struct e1000_hw *hw);
 
 static inline u16 __er16flash(struct e1000_hw *hw, unsigned long reg)
 {
@@ -270,7 +275,21 @@ static s32 e1000_init_phy_params_pchlan(struct e1000_hw *hw)
 	phy->autoneg_mask             = AUTONEG_ADVERTISE_SPEED_DEFAULT;
 
 	phy->id = e1000_phy_unknown;
-	e1000e_get_phy_id(hw);
+	ret_val = e1000e_get_phy_id(hw);
+	if (ret_val)
+		goto out;
+	if ((phy->id == 0) || (phy->id == PHY_REVISION_MASK)) {
+		/*
+		 * In case the PHY needs to be in mdio slow mode (eg. 82577),
+		 * set slow mode and try to get the PHY id again.
+		 */
+		ret_val = e1000_set_mdio_slow_mode_hv(hw);
+		if (ret_val)
+			goto out;
+		ret_val = e1000e_get_phy_id(hw);
+		if (ret_val)
+			goto out;
+	}
 	phy->type = e1000e_get_phy_type_from_id(phy->id);
 
 	switch (phy->type) {
@@ -292,6 +311,7 @@ static s32 e1000_init_phy_params_pchlan(struct e1000_hw *hw)
 		break;
 	}
 
+out:
 	return ret_val;
 }
 
@@ -454,6 +474,8 @@ static s32 e1000_init_mac_params_ich8lan(struct e1000_adapter *adapter)
 		mac->rar_entry_count--;
 	/* Set if manageability features are enabled. */
 	mac->arc_subsystem_valid = true;
+	/* Adaptive IFS supported */
+	mac->adaptive_ifs = true;
 
 	/* LED operations */
 	switch (mac->type) {
@@ -1074,16 +1096,44 @@ out:
 
 
 /**
+ *  e1000_set_mdio_slow_mode_hv - Set slow MDIO access mode
+ *  @hw:   pointer to the HW structure
+ **/
+static s32 e1000_set_mdio_slow_mode_hv(struct e1000_hw *hw)
+{
+	s32 ret_val;
+	u16 data;
+
+	ret_val = e1e_rphy(hw, HV_KMRN_MODE_CTRL, &data);
+	if (ret_val)
+		return ret_val;
+
+	data |= HV_KMRN_MDIO_SLOW;
+
+	ret_val = e1e_wphy(hw, HV_KMRN_MODE_CTRL, data);
+
+	return ret_val;
+}
+
+/**
  *  e1000_hv_phy_workarounds_ich8lan - A series of Phy workarounds to be
  *  done after every PHY reset.
  **/
 static s32 e1000_hv_phy_workarounds_ich8lan(struct e1000_hw *hw)
 {
 	s32 ret_val = 0;
+	u16 phy_data;
 
 	if (hw->mac.type != e1000_pchlan)
 		return ret_val;
 
+	/* Set MDIO slow mode before any other MDIO access */
+	if (hw->phy.type == e1000_phy_82577) {
+		ret_val = e1000_set_mdio_slow_mode_hv(hw);
+		if (ret_val)
+			goto out;
+	}
+
 	if (((hw->phy.type == e1000_phy_82577) &&
 	     ((hw->phy.revision == 1) || (hw->phy.revision == 2))) ||
 	    ((hw->phy.type == e1000_phy_82578) && (hw->phy.revision == 1))) {
@@ -1116,16 +1166,32 @@ static s32 e1000_hv_phy_workarounds_ich8lan(struct e1000_hw *hw)
 
 	hw->phy.addr = 1;
 	ret_val = e1000e_write_phy_reg_mdic(hw, IGP01E1000_PHY_PAGE_SELECT, 0);
+	hw->phy.ops.release(hw);
 	if (ret_val)
 		goto out;
-	hw->phy.ops.release(hw);
 
 	/*
 	 * Configure the K1 Si workaround during phy reset assuming there is
 	 * link so that it disables K1 if link is in 1Gbps.
 	 */
 	ret_val = e1000_k1_gig_workaround_hv(hw, true);
+	if (ret_val)
+		goto out;
 
+	/* Workaround for link disconnects on a busy hub in half duplex */
+	ret_val = hw->phy.ops.acquire(hw);
+	if (ret_val)
+		goto out;
+	ret_val = hw->phy.ops.read_reg_locked(hw,
+	                                      PHY_REG(BM_PORT_CTRL_PAGE, 17),
+	                                      &phy_data);
+	if (ret_val)
+		goto release;
+	ret_val = hw->phy.ops.write_reg_locked(hw,
+	                                       PHY_REG(BM_PORT_CTRL_PAGE, 17),
+	                                       phy_data & 0x00FF);
+release:
+	hw->phy.ops.release(hw);
 out:
 	return ret_val;
 }
@@ -1182,6 +1248,7 @@ static s32 e1000_phy_hw_reset_ich8lan(struct e1000_hw *hw)
 	/* Allow time for h/w to get to a quiescent state after reset */
 	mdelay(10);
 
+	/* Perform any necessary post-reset workarounds */
 	if (hw->mac.type == e1000_pchlan) {
 		ret_val = e1000_hv_phy_workarounds_ich8lan(hw);
 		if (ret_val)
@@ -2482,6 +2549,10 @@ static s32 e1000_reset_hw_ich8lan(struct e1000_hw *hw)
 	if (!ret_val)
 		e1000_release_swflag_ich8lan(hw);
 
+	/* Perform any necessary post-reset workarounds */
+	if (hw->mac.type == e1000_pchlan)
+		ret_val = e1000_hv_phy_workarounds_ich8lan(hw);
+
 	if (ctrl & E1000_CTRL_PHY_RST)
 		ret_val = hw->phy.ops.get_cfg_done(hw);
 
@@ -2526,9 +2597,6 @@ static s32 e1000_reset_hw_ich8lan(struct e1000_hw *hw)
 	kab |= E1000_KABGTXD_BGSQLBIAS;
 	ew32(KABGTXD, kab);
 
-	if (hw->mac.type == e1000_pchlan)
-		ret_val = e1000_hv_phy_workarounds_ich8lan(hw);
-
 out:
 	return ret_val;
 }
diff --git a/drivers/net/e1000e/lib.c b/drivers/net/e1000e/lib.c
index a86c17548c1e..2fa9b36a2c5a 100644
--- a/drivers/net/e1000e/lib.c
+++ b/drivers/net/e1000e/lib.c
@@ -125,6 +125,7 @@ void e1000_write_vfta_generic(struct e1000_hw *hw, u32 offset, u32 value)
 void e1000e_init_rx_addrs(struct e1000_hw *hw, u16 rar_count)
 {
 	u32 i;
+	u8 mac_addr[ETH_ALEN] = {0};
 
 	/* Setup the receive address */
 	e_dbg("Programming MAC Address into RAR[0]\n");
@@ -133,12 +134,8 @@ void e1000e_init_rx_addrs(struct e1000_hw *hw, u16 rar_count)
 
 	/* Zero out the other (rar_entry_count - 1) receive addresses */
 	e_dbg("Clearing RAR[1-%u]\n", rar_count-1);
-	for (i = 1; i < rar_count; i++) {
-		E1000_WRITE_REG_ARRAY(hw, E1000_RA, (i << 1), 0);
-		e1e_flush();
-		E1000_WRITE_REG_ARRAY(hw, E1000_RA, ((i << 1) + 1), 0);
-		e1e_flush();
-	}
+	for (i = 1; i < rar_count; i++)
+		e1000e_rar_set(hw, mac_addr, i);
 }
 
 /**
@@ -164,10 +161,19 @@ void e1000e_rar_set(struct e1000_hw *hw, u8 *addr, u32 index)
 
 	rar_high = ((u32) addr[4] | ((u32) addr[5] << 8));
 
-	rar_high |= E1000_RAH_AV;
+	/* If MAC address zero, no need to set the AV bit */
+	if (rar_low || rar_high)
+		rar_high |= E1000_RAH_AV;
 
-	E1000_WRITE_REG_ARRAY(hw, E1000_RA, (index << 1), rar_low);
-	E1000_WRITE_REG_ARRAY(hw, E1000_RA, ((index << 1) + 1), rar_high);
+	/*
+	 * Some bridges will combine consecutive 32-bit writes into
+	 * a single burst write, which will malfunction on some parts.
+	 * The flushes avoid this.
+	 */
+	ew32(RAL(index), rar_low);
+	e1e_flush();
+	ew32(RAH(index), rar_high);
+	e1e_flush();
 }
 
 /**
@@ -1609,6 +1615,11 @@ void e1000e_reset_adaptive(struct e1000_hw *hw)
 {
 	struct e1000_mac_info *mac = &hw->mac;
 
+	if (!mac->adaptive_ifs) {
+		e_dbg("Not in Adaptive IFS mode!\n");
+		goto out;
+	}
+
 	mac->current_ifs_val = 0;
 	mac->ifs_min_val = IFS_MIN;
 	mac->ifs_max_val = IFS_MAX;
@@ -1617,6 +1628,8 @@ void e1000e_reset_adaptive(struct e1000_hw *hw)
 
 	mac->in_ifs_mode = false;
 	ew32(AIT, 0);
+out:
+	return;
 }
 
 /**
@@ -1630,6 +1643,11 @@ void e1000e_update_adaptive(struct e1000_hw *hw)
 {
 	struct e1000_mac_info *mac = &hw->mac;
 
+	if (!mac->adaptive_ifs) {
+		e_dbg("Not in Adaptive IFS mode!\n");
+		goto out;
+	}
+
 	if ((mac->collision_delta * mac->ifs_ratio) > mac->tx_packet_delta) {
 		if (mac->tx_packet_delta > MIN_NUM_XMITS) {
 			mac->in_ifs_mode = true;
@@ -1650,6 +1668,8 @@ void e1000e_update_adaptive(struct e1000_hw *hw)
 			ew32(AIT, 0);
 		}
 	}
+out:
+	return;
 }
 
 /**
@@ -2287,10 +2307,12 @@ bool e1000e_enable_tx_pkt_filtering(struct e1000_hw *hw)
 	s32 ret_val, hdr_csum, csum;
 	u8 i, len;
 
+	hw->mac.tx_pkt_filtering = true;
+
 	/* No manageability, no filtering */
 	if (!e1000e_check_mng_mode(hw)) {
 		hw->mac.tx_pkt_filtering = false;
-		return 0;
+		goto out;
 	}
 
 	/*
@@ -2298,9 +2320,9 @@ bool e1000e_enable_tx_pkt_filtering(struct e1000_hw *hw)
 	 * reason, disable filtering.
 	 */
 	ret_val = e1000_mng_enable_host_if(hw);
-	if (ret_val != 0) {
+	if (ret_val) {
 		hw->mac.tx_pkt_filtering = false;
-		return ret_val;
+		goto out;
 	}
 
 	/* Read in the header.  Length and offset are in dwords. */
@@ -2319,17 +2341,17 @@ bool e1000e_enable_tx_pkt_filtering(struct e1000_hw *hw)
 	 */
 	if ((hdr_csum != csum) || (hdr->signature != E1000_IAMT_SIGNATURE)) {
 		hw->mac.tx_pkt_filtering = true;
-		return 1;
+		goto out;
 	}
 
 	/* Cookie area is valid, make the final check for filtering. */
 	if (!(hdr->status & E1000_MNG_DHCP_COOKIE_STATUS_PARSING)) {
 		hw->mac.tx_pkt_filtering = false;
-		return 0;
+		goto out;
 	}
 
-	hw->mac.tx_pkt_filtering = true;
-	return 1;
+out:
+	return hw->mac.tx_pkt_filtering;
 }
 
 /**
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index 762b697ce731..57f149b75fbe 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -450,13 +450,23 @@ static bool e1000_clean_rx_irq(struct e1000_adapter *adapter,
 
 		length = le16_to_cpu(rx_desc->length);
 
-		/* !EOP means multiple descriptors were used to store a single
-		 * packet, also make sure the frame isn't just CRC only */
-		if (!(status & E1000_RXD_STAT_EOP) || (length <= 4)) {
+		/*
+		 * !EOP means multiple descriptors were used to store a single
+		 * packet, if that's the case we need to toss it.  In fact, we
+		 * need to toss every packet with the EOP bit clear and the
+		 * next frame that _does_ have the EOP bit set, as it is by
+		 * definition only a frame fragment
+		 */
+		if (unlikely(!(status & E1000_RXD_STAT_EOP)))
+			adapter->flags2 |= FLAG2_IS_DISCARDING;
+
+		if (adapter->flags2 & FLAG2_IS_DISCARDING) {
 			/* All receives must fit into a single buffer */
 			e_dbg("Receive packet consumed multiple buffers\n");
 			/* recycle */
 			buffer_info->skb = skb;
+			if (status & E1000_RXD_STAT_EOP)
+				adapter->flags2 &= ~FLAG2_IS_DISCARDING;
 			goto next_desc;
 		}
 
@@ -745,10 +755,16 @@ static bool e1000_clean_rx_irq_ps(struct e1000_adapter *adapter,
 				 PCI_DMA_FROMDEVICE);
 		buffer_info->dma = 0;
 
-		if (!(staterr & E1000_RXD_STAT_EOP)) {
+		/* see !EOP comment in other rx routine */
+		if (!(staterr & E1000_RXD_STAT_EOP))
+			adapter->flags2 |= FLAG2_IS_DISCARDING;
+
+		if (adapter->flags2 & FLAG2_IS_DISCARDING) {
 			e_dbg("Packet Split buffers didn't pick up the full "
 			      "packet\n");
 			dev_kfree_skb_irq(skb);
+			if (staterr & E1000_RXD_STAT_EOP)
+				adapter->flags2 &= ~FLAG2_IS_DISCARDING;
 			goto next_desc;
 		}
 
@@ -1118,6 +1134,7 @@ static void e1000_clean_rx_ring(struct e1000_adapter *adapter)
 
 	rx_ring->next_to_clean = 0;
 	rx_ring->next_to_use = 0;
+	adapter->flags2 &= ~FLAG2_IS_DISCARDING;
 
 	writel(0, adapter->hw.hw_addr + rx_ring->head);
 	writel(0, adapter->hw.hw_addr + rx_ring->tail);
@@ -2333,18 +2350,6 @@ static void e1000_setup_rctl(struct e1000_adapter *adapter)
 	rctl &= ~E1000_RCTL_SZ_4096;
 	rctl |= E1000_RCTL_BSEX;
 	switch (adapter->rx_buffer_len) {
-	case 256:
-		rctl |= E1000_RCTL_SZ_256;
-		rctl &= ~E1000_RCTL_BSEX;
-		break;
-	case 512:
-		rctl |= E1000_RCTL_SZ_512;
-		rctl &= ~E1000_RCTL_BSEX;
-		break;
-	case 1024:
-		rctl |= E1000_RCTL_SZ_1024;
-		rctl &= ~E1000_RCTL_BSEX;
-		break;
 	case 2048:
 	default:
 		rctl |= E1000_RCTL_SZ_2048;
@@ -3315,24 +3320,24 @@ void e1000e_update_stats(struct e1000_adapter *adapter)
 	if ((hw->phy.type == e1000_phy_82578) ||
 	    (hw->phy.type == e1000_phy_82577)) {
 		e1e_rphy(hw, HV_SCC_UPPER, &phy_data);
-		e1e_rphy(hw, HV_SCC_LOWER, &phy_data);
-		adapter->stats.scc += phy_data;
+		if (!e1e_rphy(hw, HV_SCC_LOWER, &phy_data))
+			adapter->stats.scc += phy_data;
 
 		e1e_rphy(hw, HV_ECOL_UPPER, &phy_data);
-		e1e_rphy(hw, HV_ECOL_LOWER, &phy_data);
-		adapter->stats.ecol += phy_data;
+		if (!e1e_rphy(hw, HV_ECOL_LOWER, &phy_data))
+			adapter->stats.ecol += phy_data;
 
 		e1e_rphy(hw, HV_MCC_UPPER, &phy_data);
-		e1e_rphy(hw, HV_MCC_LOWER, &phy_data);
-		adapter->stats.mcc += phy_data;
+		if (!e1e_rphy(hw, HV_MCC_LOWER, &phy_data))
+			adapter->stats.mcc += phy_data;
 
 		e1e_rphy(hw, HV_LATECOL_UPPER, &phy_data);
-		e1e_rphy(hw, HV_LATECOL_LOWER, &phy_data);
-		adapter->stats.latecol += phy_data;
+		if (!e1e_rphy(hw, HV_LATECOL_LOWER, &phy_data))
+			adapter->stats.latecol += phy_data;
 
 		e1e_rphy(hw, HV_DC_UPPER, &phy_data);
-		e1e_rphy(hw, HV_DC_LOWER, &phy_data);
-		adapter->stats.dc += phy_data;
+		if (!e1e_rphy(hw, HV_DC_LOWER, &phy_data))
+			adapter->stats.dc += phy_data;
 	} else {
 		adapter->stats.scc += er32(SCC);
 		adapter->stats.ecol += er32(ECOL);
@@ -3360,8 +3365,8 @@ void e1000e_update_stats(struct e1000_adapter *adapter)
 	if ((hw->phy.type == e1000_phy_82578) ||
 	    (hw->phy.type == e1000_phy_82577)) {
 		e1e_rphy(hw, HV_COLC_UPPER, &phy_data);
-		e1e_rphy(hw, HV_COLC_LOWER, &phy_data);
-		hw->mac.collision_delta = phy_data;
+		if (!e1e_rphy(hw, HV_COLC_LOWER, &phy_data))
+			hw->mac.collision_delta = phy_data;
 	} else {
 		hw->mac.collision_delta = er32(COLC);
 	}
@@ -3372,8 +3377,8 @@ void e1000e_update_stats(struct e1000_adapter *adapter)
 	if ((hw->phy.type == e1000_phy_82578) ||
 	    (hw->phy.type == e1000_phy_82577)) {
 		e1e_rphy(hw, HV_TNCRS_UPPER, &phy_data);
-		e1e_rphy(hw, HV_TNCRS_LOWER, &phy_data);
-		adapter->stats.tncrs += phy_data;
+		if (!e1e_rphy(hw, HV_TNCRS_LOWER, &phy_data))
+			adapter->stats.tncrs += phy_data;
 	} else {
 		if ((hw->mac.type != e1000_82574) &&
 		    (hw->mac.type != e1000_82583))
@@ -3781,7 +3786,7 @@ static int e1000_tso(struct e1000_adapter *adapter,
 		                                         0, IPPROTO_TCP, 0);
 		cmd_length = E1000_TXD_CMD_IP;
 		ipcse = skb_transport_offset(skb) - 1;
-	} else if (skb_shinfo(skb)->gso_type == SKB_GSO_TCPV6) {
+	} else if (skb_is_gso_v6(skb)) {
 		ipv6_hdr(skb)->payload_len = 0;
 		tcp_hdr(skb)->check = ~csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
 		                                       &ipv6_hdr(skb)->daddr,
@@ -3962,13 +3967,13 @@ static int e1000_tx_map(struct e1000_adapter *adapter,
 dma_error:
 	dev_err(&pdev->dev, "TX DMA map failed\n");
 	buffer_info->dma = 0;
-	count--;
-
-	while (count >= 0) {
+	if (count)
 		count--;
-		i--;
-		if (i < 0)
+
+	while (count--) {
+		if (i==0)
 			i += tx_ring->count;
+		i--;
 		buffer_info = &tx_ring->buffer_info[i];
 		e1000_put_txbuf(adapter, buffer_info);;
 	}
@@ -4317,13 +4322,7 @@ static int e1000_change_mtu(struct net_device *netdev, int new_mtu)
 	 * fragmented skbs
 	 */
 
-	if (max_frame <= 256)
-		adapter->rx_buffer_len = 256;
-	else if (max_frame <= 512)
-		adapter->rx_buffer_len = 512;
-	else if (max_frame <= 1024)
-		adapter->rx_buffer_len = 1024;
-	else if (max_frame <= 2048)
+	if (max_frame <= 2048)
 		adapter->rx_buffer_len = 2048;
 	else
 		adapter->rx_buffer_len = 4096;
@@ -4674,6 +4673,7 @@ static int e1000_resume(struct pci_dev *pdev)
 
 	pci_set_power_state(pdev, PCI_D0);
 	pci_restore_state(pdev);
+	pci_save_state(pdev);
 	e1000e_disable_l1aspm(pdev);
 
 	err = pci_enable_device_mem(pdev);
@@ -4825,6 +4825,7 @@ static pci_ers_result_t e1000_io_slot_reset(struct pci_dev *pdev)
 	} else {
 		pci_set_master(pdev);
 		pci_restore_state(pdev);
+		pci_save_state(pdev);
 
 		pci_enable_wake(pdev, PCI_D3hot, 0);
 		pci_enable_wake(pdev, PCI_D3cold, 0);
diff --git a/drivers/net/e1000e/phy.c b/drivers/net/e1000e/phy.c
index 55a2c0acfee7..7f3ceb9dad6a 100644
--- a/drivers/net/e1000e/phy.c
+++ b/drivers/net/e1000e/phy.c
@@ -152,32 +152,9 @@ s32 e1000e_get_phy_id(struct e1000_hw *hw)
 		if (phy->id != 0 && phy->id != PHY_REVISION_MASK)
 			goto out;
 
-		/*
-		 * If the PHY ID is still unknown, we may have an 82577
-		 * without link.  We will try again after setting Slow MDIC
-		 * mode. No harm in trying again in this case since the PHY
-		 * ID is unknown at this point anyway.
-		 */
-		ret_val = phy->ops.acquire(hw);
-		if (ret_val)
-			goto out;
-		ret_val = e1000_set_mdio_slow_mode_hv(hw, true);
-		if (ret_val)
-			goto out;
-		phy->ops.release(hw);
-
 		retry_count++;
 	}
 out:
-	/* Revert to MDIO fast mode, if applicable */
-	if (retry_count) {
-		ret_val = phy->ops.acquire(hw);
-		if (ret_val)
-			return ret_val;
-		ret_val = e1000_set_mdio_slow_mode_hv(hw, false);
-		phy->ops.release(hw);
-	}
-
 	return ret_val;
 }
 
@@ -2791,38 +2768,6 @@ static s32 e1000_set_d0_lplu_state(struct e1000_hw *hw, bool active)
 }
 
 /**
- *  e1000_set_mdio_slow_mode_hv - Set slow MDIO access mode
- *  @hw:   pointer to the HW structure
- *  @slow: true for slow mode, false for normal mode
- *
- *  Assumes semaphore already acquired.
- **/
-s32 e1000_set_mdio_slow_mode_hv(struct e1000_hw *hw, bool slow)
-{
-	s32 ret_val = 0;
-	u16 data = 0;
-
-	/* Set MDIO mode - page 769, register 16: 0x2580==slow, 0x2180==fast */
-	hw->phy.addr = 1;
-	ret_val = e1000e_write_phy_reg_mdic(hw, IGP01E1000_PHY_PAGE_SELECT,
-				         (BM_PORT_CTRL_PAGE << IGP_PAGE_SHIFT));
-	if (ret_val)
-		goto out;
-
-	ret_val = e1000e_write_phy_reg_mdic(hw, BM_CS_CTRL1,
-	                                   (0x2180 | (slow << 10)));
-	if (ret_val)
-		goto out;
-
-	/* dummy read when reverting to fast mode - throw away result */
-	if (!slow)
-		ret_val = e1000e_read_phy_reg_mdic(hw, BM_CS_CTRL1, &data);
-
-out:
-	return ret_val;
-}
-
-/**
  *  __e1000_read_phy_reg_hv -  Read HV PHY register
  *  @hw: pointer to the HW structure
  *  @offset: register offset to be read
@@ -2839,7 +2784,6 @@ static s32 __e1000_read_phy_reg_hv(struct e1000_hw *hw, u32 offset, u16 *data,
 	s32 ret_val;
 	u16 page = BM_PHY_REG_PAGE(offset);
 	u16 reg = BM_PHY_REG_NUM(offset);
-	bool in_slow_mode = false;
 
 	if (!locked) {
 		ret_val = hw->phy.ops.acquire(hw);
@@ -2847,16 +2791,6 @@ static s32 __e1000_read_phy_reg_hv(struct e1000_hw *hw, u32 offset, u16 *data,
 			return ret_val;
 	}
 
-	/* Workaround failure in MDIO access while cable is disconnected */
-	if ((hw->phy.type == e1000_phy_82577) &&
-	    !(er32(STATUS) & E1000_STATUS_LU)) {
-		ret_val = e1000_set_mdio_slow_mode_hv(hw, true);
-		if (ret_val)
-			goto out;
-
-		in_slow_mode = true;
-	}
-
 	/* Page 800 works differently than the rest so it has its own func */
 	if (page == BM_WUC_PAGE) {
 		ret_val = e1000_access_phy_wakeup_reg_bm(hw, offset,
@@ -2893,10 +2827,6 @@ static s32 __e1000_read_phy_reg_hv(struct e1000_hw *hw, u32 offset, u16 *data,
 	ret_val = e1000e_read_phy_reg_mdic(hw, MAX_PHY_REG_ADDRESS & reg,
 	                                  data);
 out:
-	/* Revert to MDIO fast mode, if applicable */
-	if ((hw->phy.type == e1000_phy_82577) && in_slow_mode)
-		ret_val |= e1000_set_mdio_slow_mode_hv(hw, false);
-
 	if (!locked)
 		hw->phy.ops.release(hw);
 
@@ -2948,7 +2878,6 @@ static s32 __e1000_write_phy_reg_hv(struct e1000_hw *hw, u32 offset, u16 data,
 	s32 ret_val;
 	u16 page = BM_PHY_REG_PAGE(offset);
 	u16 reg = BM_PHY_REG_NUM(offset);
-	bool in_slow_mode = false;
 
 	if (!locked) {
 		ret_val = hw->phy.ops.acquire(hw);
@@ -2956,16 +2885,6 @@ static s32 __e1000_write_phy_reg_hv(struct e1000_hw *hw, u32 offset, u16 data,
 			return ret_val;
 	}
 
-	/* Workaround failure in MDIO access while cable is disconnected */
-	if ((hw->phy.type == e1000_phy_82577) &&
-	    !(er32(STATUS) & E1000_STATUS_LU)) {
-		ret_val = e1000_set_mdio_slow_mode_hv(hw, true);
-		if (ret_val)
-			goto out;
-
-		in_slow_mode = true;
-	}
-
 	/* Page 800 works differently than the rest so it has its own func */
 	if (page == BM_WUC_PAGE) {
 		ret_val = e1000_access_phy_wakeup_reg_bm(hw, offset,
@@ -3019,10 +2938,6 @@ static s32 __e1000_write_phy_reg_hv(struct e1000_hw *hw, u32 offset, u16 data,
 	                                  data);
 
 out:
-	/* Revert to MDIO fast mode, if applicable */
-	if ((hw->phy.type == e1000_phy_82577) && in_slow_mode)
-		ret_val |= e1000_set_mdio_slow_mode_hv(hw, false);
-
 	if (!locked)
 		hw->phy.ops.release(hw);
 
diff --git a/drivers/net/ehea/ehea_ethtool.c b/drivers/net/ehea/ehea_ethtool.c
index d76885223366..75b099ce49c9 100644
--- a/drivers/net/ehea/ehea_ethtool.c
+++ b/drivers/net/ehea/ehea_ethtool.c
@@ -118,7 +118,7 @@ doit:
 	ret = ehea_set_portspeed(port, sp);
 
 	if (!ret)
-		ehea_info("%s: Port speed succesfully set: %dMbps "
+		ehea_info("%s: Port speed successfully set: %dMbps "
 			  "%s Duplex",
 			  port->netdev->name, port->port_speed,
 			  port->full_duplex == 1 ? "Full" : "Half");
@@ -134,7 +134,7 @@ static int ehea_nway_reset(struct net_device *dev)
 	ret = ehea_set_portspeed(port, EHEA_SPEED_AUTONEG);
 
 	if (!ret)
-		ehea_info("%s: Port speed succesfully set: %dMbps "
+		ehea_info("%s: Port speed successfully set: %dMbps "
 			  "%s Duplex",
 			  port->netdev->name, port->port_speed,
 			  port->full_duplex == 1 ? "Full" : "Half");
diff --git a/drivers/net/ehea/ehea_hcall.h b/drivers/net/ehea/ehea_hcall.h
deleted file mode 100644
index 8e7d1c3edc60..000000000000
--- a/drivers/net/ehea/ehea_hcall.h
+++ /dev/null
@@ -1,51 +0,0 @@
-/*
- *  linux/drivers/net/ehea/ehea_hcall.h
- *
- *  eHEA ethernet device driver for IBM eServer System p
- *
- *  (C) Copyright IBM Corp. 2006
- *
- *  Authors:
- *       Christoph Raisch <raisch@de.ibm.com>
- *       Jan-Bernd Themann <themann@de.ibm.com>
- *       Thomas Klein <tklein@de.ibm.com>
- *
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2, or (at your option)
- * any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.	 See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
- */
-
-#ifndef __EHEA_HCALL_H__
-#define __EHEA_HCALL_H__
-
-/**
- * This file contains HCALL defines that are to be included in the appropriate
- * kernel files later
- */
-
-#define H_ALLOC_HEA_RESOURCE   0x278
-#define H_MODIFY_HEA_QP        0x250
-#define H_QUERY_HEA_QP         0x254
-#define H_QUERY_HEA            0x258
-#define H_QUERY_HEA_PORT       0x25C
-#define H_MODIFY_HEA_PORT      0x260
-#define H_REG_BCMC             0x264
-#define H_DEREG_BCMC           0x268
-#define H_REGISTER_HEA_RPAGES  0x26C
-#define H_DISABLE_AND_GET_HEA  0x270
-#define H_GET_HEA_INFO         0x274
-#define H_ADD_CONN             0x284
-#define H_DEL_CONN             0x288
-
-#endif	/* __EHEA_HCALL_H__ */
diff --git a/drivers/net/ehea/ehea_phyp.h b/drivers/net/ehea/ehea_phyp.h
index f3628c803567..2f8174c248bc 100644
--- a/drivers/net/ehea/ehea_phyp.h
+++ b/drivers/net/ehea/ehea_phyp.h
@@ -33,7 +33,6 @@
 #include <asm/hvcall.h>
 #include "ehea.h"
 #include "ehea_hw.h"
-#include "ehea_hcall.h"
 
 /* Some abbreviations used here:
  *
diff --git a/drivers/net/fsl_pq_mdio.c b/drivers/net/fsl_pq_mdio.c
index 25fabb3eedc5..d5160edf2fcf 100644
--- a/drivers/net/fsl_pq_mdio.c
+++ b/drivers/net/fsl_pq_mdio.c
@@ -46,6 +46,11 @@
 #include "gianfar.h"
 #include "fsl_pq_mdio.h"
 
+struct fsl_pq_mdio_priv {
+	void __iomem *map;
+	struct fsl_pq_mdio __iomem *regs;
+};
+
 /*
  * Write value to the PHY at mii_id at register regnum,
  * on the bus attached to the local interface, which may be different from the
@@ -105,7 +110,9 @@ int fsl_pq_local_mdio_read(struct fsl_pq_mdio __iomem *regs,
 
 static struct fsl_pq_mdio __iomem *fsl_pq_mdio_get_regs(struct mii_bus *bus)
 {
-	return (void __iomem __force *)bus->priv;
+	struct fsl_pq_mdio_priv *priv = bus->priv;
+
+	return priv->regs;
 }
 
 /*
@@ -266,6 +273,7 @@ static int fsl_pq_mdio_probe(struct of_device *ofdev,
 {
 	struct device_node *np = ofdev->node;
 	struct device_node *tbi;
+	struct fsl_pq_mdio_priv *priv;
 	struct fsl_pq_mdio __iomem *regs = NULL;
 	void __iomem *map;
 	u32 __iomem *tbipa;
@@ -274,14 +282,19 @@ static int fsl_pq_mdio_probe(struct of_device *ofdev,
 	u64 addr = 0, size = 0;
 	int err = 0;
 
+	priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+	if (!priv)
+		return -ENOMEM;
+
 	new_bus = mdiobus_alloc();
 	if (NULL == new_bus)
-		return -ENOMEM;
+		goto err_free_priv;
 
 	new_bus->name = "Freescale PowerQUICC MII Bus",
 	new_bus->read = &fsl_pq_mdio_read,
 	new_bus->write = &fsl_pq_mdio_write,
 	new_bus->reset = &fsl_pq_mdio_reset,
+	new_bus->priv = priv;
 	fsl_pq_mdio_bus_name(new_bus->id, np);
 
 	/* Set the PHY base address */
@@ -291,6 +304,7 @@ static int fsl_pq_mdio_probe(struct of_device *ofdev,
 		err = -ENOMEM;
 		goto err_free_bus;
 	}
+	priv->map = map;
 
 	if (of_device_is_compatible(np, "fsl,gianfar-mdio") ||
 			of_device_is_compatible(np, "fsl,gianfar-tbi") ||
@@ -298,8 +312,7 @@ static int fsl_pq_mdio_probe(struct of_device *ofdev,
 			of_device_is_compatible(np, "ucc_geth_phy"))
 		map -= offsetof(struct fsl_pq_mdio, miimcfg);
 	regs = map;
-
-	new_bus->priv = (void __force *)regs;
+	priv->regs = regs;
 
 	new_bus->irq = kcalloc(PHY_MAX_ADDR, sizeof(int), GFP_KERNEL);
 
@@ -392,10 +405,11 @@ static int fsl_pq_mdio_probe(struct of_device *ofdev,
 err_free_irqs:
 	kfree(new_bus->irq);
 err_unmap_regs:
-	iounmap(regs);
+	iounmap(priv->map);
 err_free_bus:
 	kfree(new_bus);
-
+err_free_priv:
+	kfree(priv);
 	return err;
 }
 
@@ -404,14 +418,16 @@ static int fsl_pq_mdio_remove(struct of_device *ofdev)
 {
 	struct device *device = &ofdev->dev;
 	struct mii_bus *bus = dev_get_drvdata(device);
+	struct fsl_pq_mdio_priv *priv = bus->priv;
 
 	mdiobus_unregister(bus);
 
 	dev_set_drvdata(device, NULL);
 
-	iounmap(fsl_pq_mdio_get_regs(bus));
+	iounmap(priv->map);
 	bus->priv = NULL;
 	mdiobus_free(bus);
+	kfree(priv);
 
 	return 0;
 }
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index 6850dc0a7b91..8bd3c9f17532 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -143,7 +143,6 @@ void gfar_start(struct net_device *dev);
 static void gfar_clear_exact_match(struct net_device *dev);
 static void gfar_set_mac_for_addr(struct net_device *dev, int num, u8 *addr);
 static int gfar_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
-u16 gfar_select_queue(struct net_device *dev, struct sk_buff *skb);
 
 MODULE_AUTHOR("Freescale Semiconductor, Inc");
 MODULE_DESCRIPTION("Gianfar Ethernet Driver");
@@ -357,8 +356,11 @@ static void gfar_init_mac(struct net_device *ndev)
 	/* Configure the coalescing support */
 	gfar_configure_coalescing(priv, 0xFF, 0xFF);
 
-	if (priv->rx_filer_enable)
+	if (priv->rx_filer_enable) {
 		rctrl |= RCTRL_FILREN;
+		/* Program the RIR0 reg with the required distribution */
+		gfar_write(&regs->rir0, DEFAULT_RIR0);
+	}
 
 	if (priv->rx_csum_enable)
 		rctrl |= RCTRL_CHECKSUMMING;
@@ -414,6 +416,36 @@ static void gfar_init_mac(struct net_device *ndev)
 	gfar_write(&regs->fifo_tx_starve_shutoff, priv->fifo_starve_off);
 }
 
+static struct net_device_stats *gfar_get_stats(struct net_device *dev)
+{
+	struct gfar_private *priv = netdev_priv(dev);
+	struct netdev_queue *txq;
+	unsigned long rx_packets = 0, rx_bytes = 0, rx_dropped = 0;
+	unsigned long tx_packets = 0, tx_bytes = 0;
+	int i = 0;
+
+	for (i = 0; i < priv->num_rx_queues; i++) {
+		rx_packets += priv->rx_queue[i]->stats.rx_packets;
+		rx_bytes += priv->rx_queue[i]->stats.rx_bytes;
+		rx_dropped += priv->rx_queue[i]->stats.rx_dropped;
+	}
+
+	dev->stats.rx_packets = rx_packets;
+	dev->stats.rx_bytes = rx_bytes;
+	dev->stats.rx_dropped = rx_dropped;
+
+	for (i = 0; i < priv->num_tx_queues; i++) {
+		txq = netdev_get_tx_queue(dev, i);
+		tx_bytes += txq->tx_bytes;
+		tx_packets += txq->tx_packets;
+	}
+
+	dev->stats.tx_bytes = tx_bytes;
+	dev->stats.tx_packets = tx_packets;
+
+	return &dev->stats;
+}
+
 static const struct net_device_ops gfar_netdev_ops = {
 	.ndo_open = gfar_enet_open,
 	.ndo_start_xmit = gfar_start_xmit,
@@ -422,7 +454,7 @@ static const struct net_device_ops gfar_netdev_ops = {
 	.ndo_set_multicast_list = gfar_set_multi,
 	.ndo_tx_timeout = gfar_timeout,
 	.ndo_do_ioctl = gfar_ioctl,
-	.ndo_select_queue = gfar_select_queue,
+	.ndo_get_stats = gfar_get_stats,
 	.ndo_vlan_rx_register = gfar_vlan_rx_register,
 	.ndo_set_mac_address = eth_mac_addr,
 	.ndo_validate_addr = eth_validate_addr,
@@ -472,10 +504,6 @@ static inline int gfar_uses_fcb(struct gfar_private *priv)
 	return priv->vlgrp || priv->rx_csum_enable;
 }
 
-u16 gfar_select_queue(struct net_device *dev, struct sk_buff *skb)
-{
-	return skb_get_queue_mapping(skb);
-}
 static void free_tx_pointers(struct gfar_private *priv)
 {
 	int i = 0;
@@ -1022,6 +1050,9 @@ static int gfar_probe(struct of_device *ofdev,
 		priv->rx_queue[i]->rxic = DEFAULT_RXIC;
 	}
 
+	/* enable filer if using multiple RX queues*/
+	if(priv->num_rx_queues > 1)
+		priv->rx_filer_enable = 1;
 	/* Enable most messages by default */
 	priv->msg_enable = (NETIF_MSG_IFUP << 1 ) - 1;
 
@@ -1937,7 +1968,8 @@ static int gfar_start_xmit(struct sk_buff *skb, struct net_device *dev)
 	}
 
 	/* Update transmit stats */
-	dev->stats.tx_bytes += skb->len;
+	txq->tx_bytes += skb->len;
+	txq->tx_packets ++;
 
 	txbdp = txbdp_start = tx_queue->cur_tx;
 
@@ -2295,8 +2327,6 @@ static int gfar_clean_tx_ring(struct gfar_priv_tx_q *tx_queue)
 	tx_queue->skb_dirtytx = skb_dirtytx;
 	tx_queue->dirty_tx = bdp;
 
-	dev->stats.tx_packets += howmany;
-
 	return howmany;
 }
 
@@ -2434,10 +2464,11 @@ static int gfar_process_frame(struct net_device *dev, struct sk_buff *skb,
 	fcb = (struct rxfcb *)skb->data;
 
 	/* Remove the FCB from the skb */
-	skb_set_queue_mapping(skb, fcb->rq);
 	/* Remove the padded bytes, if there are any */
-	if (amount_pull)
+	if (amount_pull) {
+		skb_record_rx_queue(skb, fcb->rq);
 		skb_pull(skb, amount_pull);
+	}
 
 	if (priv->rx_csum_enable)
 		gfar_rx_checksum(skb, fcb);
@@ -2510,22 +2541,22 @@ int gfar_clean_rx_ring(struct gfar_priv_rx_q *rx_queue, int rx_work_limit)
 			}
 		} else {
 			/* Increment the number of packets */
-			dev->stats.rx_packets++;
+			rx_queue->stats.rx_packets++;
 			howmany++;
 
 			if (likely(skb)) {
 				pkt_len = bdp->length - ETH_FCS_LEN;
 				/* Remove the FCS from the packet length */
 				skb_put(skb, pkt_len);
-				dev->stats.rx_bytes += pkt_len;
-
+				rx_queue->stats.rx_bytes += pkt_len;
+				skb_record_rx_queue(skb, rx_queue->qindex);
 				gfar_process_frame(dev, skb, amount_pull);
 
 			} else {
 				if (netif_msg_rx_err(priv))
 					printk(KERN_WARNING
 					       "%s: Missing skb!\n", dev->name);
-				dev->stats.rx_dropped++;
+				rx_queue->stats.rx_dropped++;
 				priv->extra_stats.rx_skbmissing++;
 			}
 
diff --git a/drivers/net/gianfar.h b/drivers/net/gianfar.h
index cbb451011cb5..3d72dc43dca5 100644
--- a/drivers/net/gianfar.h
+++ b/drivers/net/gianfar.h
@@ -333,7 +333,7 @@ extern const char gfar_driver_version[];
 #define IMASK_BSY               0x20000000
 #define IMASK_EBERR             0x10000000
 #define IMASK_MSRO		0x04000000
-#define IMASK_GRSC              0x02000000
+#define IMASK_GTSC              0x02000000
 #define IMASK_BABT		0x01000000
 #define IMASK_TXC               0x00800000
 #define IMASK_TXEEN		0x00400000
@@ -344,7 +344,7 @@ extern const char gfar_driver_version[];
 #define IMASK_XFUN		0x00010000
 #define IMASK_RXB0              0x00008000
 #define IMASK_MAG		0x00000800
-#define IMASK_GTSC              0x00000100
+#define IMASK_GRSC              0x00000100
 #define IMASK_RXFEN0		0x00000080
 #define IMASK_FIR		0x00000008
 #define IMASK_FIQ		0x00000004
@@ -401,6 +401,10 @@ extern const char gfar_driver_version[];
 #define FPR_FILER_MASK	0xFFFFFFFF
 #define MAX_FILER_IDX	0xFF
 
+/* This default RIR value directly corresponds
+ * to the 3-bit hash value generated */
+#define DEFAULT_RIR0	0x05397700
+
 /* RQFCR register bits */
 #define RQFCR_GPI		0x80000000
 #define RQFCR_HASHTBL_Q		0x00000000
@@ -936,6 +940,15 @@ struct gfar_priv_tx_q {
 	unsigned short txtime;
 };
 
+/*
+ * Per RX queue stats
+ */
+struct rx_q_stats {
+	unsigned long rx_packets;
+	unsigned long rx_bytes;
+	unsigned long rx_dropped;
+};
+
 /**
  *	struct gfar_priv_rx_q - per rx queue structure
  *	@rxlock: per queue rx spin lock
@@ -958,6 +971,7 @@ struct gfar_priv_rx_q {
 	struct	rxbd8 *cur_rx;
 	struct	net_device *dev;
 	struct gfar_priv_grp *grp;
+	struct rx_q_stats stats;
 	u16	skb_currx;
 	u16	qindex;
 	unsigned int	rx_ring_size;
diff --git a/drivers/net/hamradio/baycom_ser_fdx.c b/drivers/net/hamradio/baycom_ser_fdx.c
index ed60fd664273..0cab992b3d1a 100644
--- a/drivers/net/hamradio/baycom_ser_fdx.c
+++ b/drivers/net/hamradio/baycom_ser_fdx.c
@@ -35,7 +35,7 @@
  *          driver only supports standard serial hardware (8250, 16450, 16550A)
  *
  *          This modem usually draws its supply current out of the otherwise unused
- *          TXD pin of the serial port. Thus a contignuous stream of 0x00-bytes
+ *          TXD pin of the serial port. Thus a contiguous stream of 0x00-bytes
  *          is transmitted to achieve a positive supply voltage.
  *
  *  hsk:    This is a 4800 baud FSK modem, designed for TNC use. It works fine
diff --git a/drivers/net/hamradio/bpqether.c b/drivers/net/hamradio/bpqether.c
index ae5f11c8fc13..bdadf3e23c94 100644
--- a/drivers/net/hamradio/bpqether.c
+++ b/drivers/net/hamradio/bpqether.c
@@ -248,6 +248,7 @@ static netdev_tx_t bpq_xmit(struct sk_buff *skb, struct net_device *dev)
 {
 	unsigned char *ptr;
 	struct bpqdev *bpq;
+	struct net_device *orig_dev;
 	int size;
 
 	/*
@@ -282,8 +283,9 @@ static netdev_tx_t bpq_xmit(struct sk_buff *skb, struct net_device *dev)
 
 	bpq = netdev_priv(dev);
 
+	orig_dev = dev;
 	if ((dev = bpq_get_ether_dev(dev)) == NULL) {
-		dev->stats.tx_dropped++;
+		orig_dev->stats.tx_dropped++;
 		kfree_skb(skb);
 		return NETDEV_TX_OK;
 	}
diff --git a/drivers/net/ibmlana.c b/drivers/net/ibmlana.c
index 090a6d3af112..052c74091d91 100644
--- a/drivers/net/ibmlana.c
+++ b/drivers/net/ibmlana.c
@@ -87,6 +87,7 @@ History:
 #include <linux/module.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
+#include <linux/if_ether.h>
 #include <linux/skbuff.h>
 #include <linux/bitops.h>
 
@@ -988,7 +989,7 @@ static int __devinit ibmlana_init_one(struct device *kdev)
 
 	/* copy out MAC address */
 
-	for (z = 0; z < sizeof(dev->dev_addr); z++)
+	for (z = 0; z < ETH_ALEN; z++)
 		dev->dev_addr[z] = inb(dev->base_addr + MACADDRPROM + z);
 
 	/* print config */
diff --git a/drivers/net/igb/e1000_82575.c b/drivers/net/igb/e1000_82575.c
index e8e9e9194a88..c505b50d1fa3 100644
--- a/drivers/net/igb/e1000_82575.c
+++ b/drivers/net/igb/e1000_82575.c
@@ -1096,9 +1096,7 @@ static s32 igb_setup_serdes_link_82575(struct e1000_hw *hw)
 		hw_dbg("Configuring Autoneg:PCS_LCTL=0x%08X\n", reg);
 	} else {
 		/* Set PCS register for forced link */
-		reg |= E1000_PCS_LCTL_FSD |        /* Force Speed */
-		       E1000_PCS_LCTL_FORCE_LINK | /* Force Link */
-		       E1000_PCS_LCTL_FLV_LINK_UP; /* Force link value up */
+		reg |= E1000_PCS_LCTL_FSD;        /* Force Speed */
 
 		hw_dbg("Configuring Forced Link:PCS_LCTL=0x%08X\n", reg);
 	}
diff --git a/drivers/net/igb/e1000_phy.c b/drivers/net/igb/e1000_phy.c
index 5c9d73e9bb8d..3670a66401b8 100644
--- a/drivers/net/igb/e1000_phy.c
+++ b/drivers/net/igb/e1000_phy.c
@@ -457,15 +457,6 @@ s32 igb_copper_link_setup_82580(struct e1000_hw *hw)
 	phy_data |= I82580_CFG_ENABLE_DOWNSHIFT;
 
 	ret_val = phy->ops.write_reg(hw, I82580_CFG_REG, phy_data);
-	if (ret_val)
-		goto out;
-
-	/* Set number of link attempts before downshift */
-	ret_val = phy->ops.read_reg(hw, I82580_CTRL_REG, &phy_data);
-	if (ret_val)
-		goto out;
-	phy_data &= ~I82580_CTRL_DOWNSHIFT_MASK;
-	ret_val = phy->ops.write_reg(hw, I82580_CTRL_REG, phy_data);
 
 out:
 	return ret_val;
diff --git a/drivers/net/igb/igb_ethtool.c b/drivers/net/igb/igb_ethtool.c
index ac9d5272650d..f771a6c08777 100644
--- a/drivers/net/igb/igb_ethtool.c
+++ b/drivers/net/igb/igb_ethtool.c
@@ -1795,7 +1795,7 @@ static int igb_wol_exclusion(struct igb_adapter *adapter,
 		/* dual port cards only support WoL on port A from now on
 		 * unless it was enabled in the eeprom for port B
 		 * so exclude FUNC_1 ports from having WoL enabled */
-		if (rd32(E1000_STATUS) & E1000_STATUS_FUNC_1 &&
+		if ((rd32(E1000_STATUS) & E1000_STATUS_FUNC_MASK) &&
 		    !adapter->eeprom_wol) {
 			wol->supported = 0;
 			break;
diff --git a/drivers/net/igb/igb_main.c b/drivers/net/igb/igb_main.c
index 16349ba68736..c881347cb26d 100644
--- a/drivers/net/igb/igb_main.c
+++ b/drivers/net/igb/igb_main.c
@@ -421,6 +421,8 @@ static void igb_assign_vector(struct igb_q_vector *q_vector, int msix_vector)
 			msixbm = E1000_EICR_RX_QUEUE0 << rx_queue;
 		if (tx_queue > IGB_N0_QUEUE)
 			msixbm |= E1000_EICR_TX_QUEUE0 << tx_queue;
+		if (!adapter->msix_entries && msix_vector == 0)
+			msixbm |= E1000_EIMS_OTHER;
 		array_wr32(E1000_MSIXBM(0), msix_vector, msixbm);
 		q_vector->eims_value = msixbm;
 		break;
@@ -877,7 +879,6 @@ static int igb_request_irq(struct igb_adapter *adapter)
 {
 	struct net_device *netdev = adapter->netdev;
 	struct pci_dev *pdev = adapter->pdev;
-	struct e1000_hw *hw = &adapter->hw;
 	int err = 0;
 
 	if (adapter->msix_entries) {
@@ -909,20 +910,7 @@ static int igb_request_irq(struct igb_adapter *adapter)
 		igb_setup_all_tx_resources(adapter);
 		igb_setup_all_rx_resources(adapter);
 	} else {
-		switch (hw->mac.type) {
-		case e1000_82575:
-			wr32(E1000_MSIXBM(0),
-			     (E1000_EICR_RX_QUEUE0 |
-			      E1000_EICR_TX_QUEUE0 |
-			      E1000_EIMS_OTHER));
-			break;
-		case e1000_82580:
-		case e1000_82576:
-			wr32(E1000_IVAR0, E1000_IVAR_VALID);
-			break;
-		default:
-			break;
-		}
+		igb_assign_vector(adapter->q_vector[0], 0);
 	}
 
 	if (adapter->flags & IGB_FLAG_HAS_MSI) {
@@ -1140,6 +1128,8 @@ int igb_up(struct igb_adapter *adapter)
 	}
 	if (adapter->msix_entries)
 		igb_configure_msix(adapter);
+	else
+		igb_assign_vector(adapter->q_vector[0], 0);
 
 	/* Clear any pending interrupts. */
 	rd32(E1000_ICR);
@@ -1306,13 +1296,8 @@ void igb_reset(struct igb_adapter *adapter)
 	hwm = min(((pba << 10) * 9 / 10),
 			((pba << 10) - 2 * adapter->max_frame_size));
 
-	if (mac->type < e1000_82576) {
-		fc->high_water = hwm & 0xFFF8;	/* 8-byte granularity */
-		fc->low_water = fc->high_water - 8;
-	} else {
-		fc->high_water = hwm & 0xFFF0;	/* 16-byte granularity */
-		fc->low_water = fc->high_water - 16;
-	}
+	fc->high_water = hwm & 0xFFF0;	/* 16-byte granularity */
+	fc->low_water = fc->high_water - 16;
 	fc->pause_time = 0xFFFF;
 	fc->send_xon = 1;
 	fc->current_mode = fc->requested_mode;
@@ -3427,7 +3412,7 @@ static inline int igb_tso_adv(struct igb_ring *tx_ring,
 							 iph->daddr, 0,
 							 IPPROTO_TCP,
 							 0);
-	} else if (skb_shinfo(skb)->gso_type == SKB_GSO_TCPV6) {
+	} else if (skb_is_gso_v6(skb)) {
 		ipv6_hdr(skb)->payload_len = 0;
 		tcp_hdr(skb)->check = ~csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
 						       &ipv6_hdr(skb)->daddr,
@@ -3589,6 +3574,7 @@ static inline int igb_tx_map_adv(struct igb_ring *tx_ring, struct sk_buff *skb,
 	for (f = 0; f < skb_shinfo(skb)->nr_frags; f++) {
 		struct skb_frag_struct *frag;
 
+		count++;
 		i++;
 		if (i == tx_ring->count)
 			i = 0;
@@ -3610,7 +3596,6 @@ static inline int igb_tx_map_adv(struct igb_ring *tx_ring, struct sk_buff *skb,
 		if (pci_dma_mapping_error(pdev, buffer_info->dma))
 			goto dma_error;
 
-		count++;
 	}
 
 	tx_ring->buffer_info[i].skb = skb;
@@ -4608,8 +4593,14 @@ static void igb_rcv_msg_from_vf(struct igb_adapter *adapter, u32 vf)
 
 	retval = igb_read_mbx(hw, msgbuf, E1000_VFMAILBOX_SIZE, vf);
 
-	if (retval)
+	if (retval) {
+		/* if receive failed revoke VF CTS stats and restart init */
 		dev_err(&pdev->dev, "Error receiving message from VF\n");
+		vf_data->flags &= ~IGB_VF_FLAG_CTS;
+		if (!time_after(jiffies, vf_data->last_nack + (2 * HZ)))
+			return;
+		goto out;
+	}
 
 	/* this is a message we already processed, do nothing */
 	if (msgbuf[0] & (E1000_VT_MSGTYPE_ACK | E1000_VT_MSGTYPE_NACK))
@@ -4626,12 +4617,10 @@ static void igb_rcv_msg_from_vf(struct igb_adapter *adapter, u32 vf)
 	}
 
 	if (!(vf_data->flags & IGB_VF_FLAG_CTS)) {
-		msgbuf[0] = E1000_VT_MSGTYPE_NACK;
-		if (time_after(jiffies, vf_data->last_nack + (2 * HZ))) {
-			igb_write_mbx(hw, msgbuf, 1, vf);
-			vf_data->last_nack = jiffies;
-		}
-		return;
+		if (!time_after(jiffies, vf_data->last_nack + (2 * HZ)))
+			return;
+		retval = -1;
+		goto out;
 	}
 
 	switch ((msgbuf[0] & 0xFFFF)) {
@@ -4656,14 +4645,14 @@ static void igb_rcv_msg_from_vf(struct igb_adapter *adapter, u32 vf)
 		break;
 	}
 
+	msgbuf[0] |= E1000_VT_MSGTYPE_CTS;
+out:
 	/* notify the VF of the results of what it sent us */
 	if (retval)
 		msgbuf[0] |= E1000_VT_MSGTYPE_NACK;
 	else
 		msgbuf[0] |= E1000_VT_MSGTYPE_ACK;
 
-	msgbuf[0] |= E1000_VT_MSGTYPE_CTS;
-
 	igb_write_mbx(hw, msgbuf, 1, vf);
 }
 
diff --git a/drivers/net/igbvf/igbvf.h b/drivers/net/igbvf/igbvf.h
index 3d1ee7a8478e..a1774b29d222 100644
--- a/drivers/net/igbvf/igbvf.h
+++ b/drivers/net/igbvf/igbvf.h
@@ -276,6 +276,7 @@ struct igbvf_adapter {
 	unsigned long led_status;
 
 	unsigned int flags;
+	unsigned long last_reset;
 };
 
 struct igbvf_info {
diff --git a/drivers/net/igbvf/netdev.c b/drivers/net/igbvf/netdev.c
index a127620dc653..2aa71a766c35 100644
--- a/drivers/net/igbvf/netdev.c
+++ b/drivers/net/igbvf/netdev.c
@@ -1469,6 +1469,8 @@ static void igbvf_reset(struct igbvf_adapter *adapter)
 		memcpy(netdev->perm_addr, adapter->hw.mac.addr,
 		       netdev->addr_len);
 	}
+
+	adapter->last_reset = jiffies;
 }
 
 int igbvf_up(struct igbvf_adapter *adapter)
@@ -1812,11 +1814,15 @@ static bool igbvf_has_link(struct igbvf_adapter *adapter)
 	s32 ret_val = E1000_SUCCESS;
 	bool link_active;
 
+	/* If interface is down, stay link down */
+	if (test_bit(__IGBVF_DOWN, &adapter->state))
+		return false;
+
 	ret_val = hw->mac.ops.check_for_link(hw);
 	link_active = !hw->mac.get_link_status;
 
 	/* if check for link returns error we will need to reset */
-	if (ret_val)
+	if (ret_val && time_after(jiffies, adapter->last_reset + (10 * HZ)))
 		schedule_work(&adapter->reset_task);
 
 	return link_active;
@@ -1957,7 +1963,7 @@ static int igbvf_tso(struct igbvf_adapter *adapter,
 		                                         iph->daddr, 0,
 		                                         IPPROTO_TCP,
 		                                         0);
-	} else if (skb_shinfo(skb)->gso_type == SKB_GSO_TCPV6) {
+	} else if (skb_is_gso_v6(skb)) {
 		ipv6_hdr(skb)->payload_len = 0;
 		tcp_hdr(skb)->check = ~csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
 		                                       &ipv6_hdr(skb)->daddr,
@@ -2111,6 +2117,7 @@ static inline int igbvf_tx_map_adv(struct igbvf_adapter *adapter,
 	/* set time_stamp *before* dma to help avoid a possible race */
 	buffer_info->time_stamp = jiffies;
 	buffer_info->next_to_watch = i;
+	buffer_info->mapped_as_page = false;
 	buffer_info->dma = pci_map_single(pdev, skb->data, len,
 					  PCI_DMA_TODEVICE);
 	if (pci_dma_mapping_error(pdev, buffer_info->dma))
@@ -2120,6 +2127,7 @@ static inline int igbvf_tx_map_adv(struct igbvf_adapter *adapter,
 	for (f = 0; f < skb_shinfo(skb)->nr_frags; f++) {
 		struct skb_frag_struct *frag;
 
+		count++;
 		i++;
 		if (i == tx_ring->count)
 			i = 0;
@@ -2140,7 +2148,6 @@ static inline int igbvf_tx_map_adv(struct igbvf_adapter *adapter,
 						PCI_DMA_TODEVICE);
 		if (pci_dma_mapping_error(pdev, buffer_info->dma))
 			goto dma_error;
-		count++;
 	}
 
 	tx_ring->buffer_info[i].skb = skb;
@@ -2157,14 +2164,14 @@ dma_error:
 	buffer_info->length = 0;
 	buffer_info->next_to_watch = 0;
 	buffer_info->mapped_as_page = false;
-	count--;
+	if (count)
+		count--;
 
 	/* clear timestamp and dma mappings for remaining portion of packet */
-	while (count >= 0) {
-		count--;
-		i--;
-		if (i < 0)
+	while (count--) {
+		if (i==0)
 			i += tx_ring->count;
+		i--;
 		buffer_info = &tx_ring->buffer_info[i];
 		igbvf_put_txbuf(adapter, buffer_info);
 	}
@@ -2757,7 +2764,8 @@ static int __devinit igbvf_probe(struct pci_dev *pdev,
 	err = hw->mac.ops.reset_hw(hw);
 	if (err) {
 		dev_info(&pdev->dev,
-		         "PF still in reset state, assigning new address\n");
+			 "PF still in reset state, assigning new address."
+			 " Is the PF interface up?\n");
 		random_ether_addr(hw->mac.addr);
 	} else {
 		err = hw->mac.ops.read_mac_addr(hw);
diff --git a/drivers/net/irda/smsc-ircc2.c b/drivers/net/irda/smsc-ircc2.c
index 1e8dd8c74a64..8f7d0d146f24 100644
--- a/drivers/net/irda/smsc-ircc2.c
+++ b/drivers/net/irda/smsc-ircc2.c
@@ -115,7 +115,7 @@ struct smsc_ircc_subsystem_configuration {
 	unsigned short vendor; /* PCI vendor ID */
 	unsigned short device; /* PCI vendor ID */
 	unsigned short subvendor; /* PCI subsystem vendor ID */
-	unsigned short subdevice; /* PCI sybsystem device ID */
+	unsigned short subdevice; /* PCI subsystem device ID */
 	unsigned short sir_io; /* I/O port for SIR */
 	unsigned short fir_io; /* I/O port for FIR */
 	unsigned char  fir_irq; /* FIR IRQ */
diff --git a/drivers/net/iseries_veth.c b/drivers/net/iseries_veth.c
index 49997194bdd0..16c91910d6c1 100644
--- a/drivers/net/iseries_veth.c
+++ b/drivers/net/iseries_veth.c
@@ -1384,7 +1384,7 @@ static inline void veth_build_dma_list(struct dma_chunk *list,
 	unsigned long done;
 	int i = 1;
 
-	/* FIXME: skbs are continguous in real addresses.  Do we
+	/* FIXME: skbs are contiguous in real addresses.  Do we
 	 * really need to break it into PAGE_SIZE chunks, or can we do
 	 * it just at the granularity of iSeries real->absolute
 	 * mapping?  Indeed, given the way the allocator works, can we
diff --git a/drivers/net/ixgb/ixgb_main.c b/drivers/net/ixgb/ixgb_main.c
index bcd0f01d5feb..593d1a4f217c 100644
--- a/drivers/net/ixgb/ixgb_main.c
+++ b/drivers/net/ixgb/ixgb_main.c
@@ -1363,13 +1363,13 @@ ixgb_tx_map(struct ixgb_adapter *adapter, struct sk_buff *skb,
 dma_error:
 	dev_err(&pdev->dev, "TX DMA map failed\n");
 	buffer_info->dma = 0;
-	count--;
-
-	while (count >= 0) {
+	if (count)
 		count--;
-		i--;
-		if (i < 0)
+
+	while (count--) {
+		if (i==0)
 			i += tx_ring->count;
+		i--;
 		buffer_info = &tx_ring->buffer_info[i];
 		ixgb_unmap_and_free_tx_resource(adapter, buffer_info);
 	}
diff --git a/drivers/net/ixgbe/Makefile b/drivers/net/ixgbe/Makefile
index 21b41f42b61c..bfef0ebcba9a 100644
--- a/drivers/net/ixgbe/Makefile
+++ b/drivers/net/ixgbe/Makefile
@@ -1,7 +1,7 @@
 ################################################################################
 #
 # Intel 10 Gigabit PCI Express Linux driver
-# Copyright(c) 1999 - 2009 Intel Corporation.
+# Copyright(c) 1999 - 2010 Intel Corporation.
 #
 # This program is free software; you can redistribute it and/or modify it
 # under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe.h b/drivers/net/ixgbe/ixgbe.h
index 8da8eb535084..303e7bd39b67 100644
--- a/drivers/net/ixgbe/ixgbe.h
+++ b/drivers/net/ixgbe/ixgbe.h
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe_82598.c b/drivers/net/ixgbe/ixgbe_82598.c
index e2d5343f1275..3103f4165311 100644
--- a/drivers/net/ixgbe/ixgbe_82598.c
+++ b/drivers/net/ixgbe/ixgbe_82598.c
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
@@ -510,6 +510,40 @@ static s32 ixgbe_start_mac_link_82598(struct ixgbe_hw *hw,
 }
 
 /**
+ *  ixgbe_validate_link_ready - Function looks for phy link
+ *  @hw: pointer to hardware structure
+ *
+ *  Function indicates success when phy link is available. If phy is not ready
+ *  within 5 seconds of MAC indicating link, the function returns error.
+ **/
+static s32 ixgbe_validate_link_ready(struct ixgbe_hw *hw)
+{
+	u32 timeout;
+	u16 an_reg;
+
+	if (hw->device_id != IXGBE_DEV_ID_82598AT2)
+		return 0;
+
+	for (timeout = 0;
+	     timeout < IXGBE_VALIDATE_LINK_READY_TIMEOUT; timeout++) {
+		hw->phy.ops.read_reg(hw, MDIO_STAT1, MDIO_MMD_AN, &an_reg);
+
+		if ((an_reg & MDIO_AN_STAT1_COMPLETE) &&
+		    (an_reg & MDIO_STAT1_LSTATUS))
+			break;
+
+		msleep(100);
+	}
+
+	if (timeout == IXGBE_VALIDATE_LINK_READY_TIMEOUT) {
+		hw_dbg(hw, "Link was indicated but link is down\n");
+		return IXGBE_ERR_LINK_SETUP;
+	}
+
+	return 0;
+}
+
+/**
  *  ixgbe_check_mac_link_82598 - Get link/speed status
  *  @hw: pointer to hardware structure
  *  @speed: pointer to link speed
@@ -589,6 +623,10 @@ static s32 ixgbe_check_mac_link_82598(struct ixgbe_hw *hw,
 	else
 		*speed = IXGBE_LINK_SPEED_1GB_FULL;
 
+	if ((hw->device_id == IXGBE_DEV_ID_82598AT2) && (*link_up == true) &&
+	    (ixgbe_validate_link_ready(hw) != 0))
+		*link_up = false;
+
 	/* if link is down, zero out the current_mode */
 	if (*link_up == false) {
 		hw->fc.current_mode = ixgbe_fc_none;
diff --git a/drivers/net/ixgbe/ixgbe_82599.c b/drivers/net/ixgbe/ixgbe_82599.c
index 538340527aa6..b49bd6b9feb7 100644
--- a/drivers/net/ixgbe/ixgbe_82599.c
+++ b/drivers/net/ixgbe/ixgbe_82599.c
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe_common.c b/drivers/net/ixgbe/ixgbe_common.c
index 688b8ca5da32..21f158f79dd0 100644
--- a/drivers/net/ixgbe/ixgbe_common.c
+++ b/drivers/net/ixgbe/ixgbe_common.c
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe_common.h b/drivers/net/ixgbe/ixgbe_common.h
index 27f3214bed2e..dfff0ffaa502 100644
--- a/drivers/net/ixgbe/ixgbe_common.h
+++ b/drivers/net/ixgbe/ixgbe_common.h
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe_dcb.c b/drivers/net/ixgbe/ixgbe_dcb.c
index a1562287342f..9aea4f04bbd2 100644
--- a/drivers/net/ixgbe/ixgbe_dcb.c
+++ b/drivers/net/ixgbe/ixgbe_dcb.c
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe_dcb.h b/drivers/net/ixgbe/ixgbe_dcb.h
index 64a9fa15c059..5caafd4afbc3 100644
--- a/drivers/net/ixgbe/ixgbe_dcb.h
+++ b/drivers/net/ixgbe/ixgbe_dcb.h
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe_dcb_82598.c b/drivers/net/ixgbe/ixgbe_dcb_82598.c
index f30263898ebc..f0e9279d4669 100644
--- a/drivers/net/ixgbe/ixgbe_dcb_82598.c
+++ b/drivers/net/ixgbe/ixgbe_dcb_82598.c
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe_dcb_82598.h b/drivers/net/ixgbe/ixgbe_dcb_82598.h
index ebbe53c352a7..cc728fa092e2 100644
--- a/drivers/net/ixgbe/ixgbe_dcb_82598.h
+++ b/drivers/net/ixgbe/ixgbe_dcb_82598.h
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe_dcb_82599.c b/drivers/net/ixgbe/ixgbe_dcb_82599.c
index ec8a252636d3..4f7a26ab411e 100644
--- a/drivers/net/ixgbe/ixgbe_dcb_82599.c
+++ b/drivers/net/ixgbe/ixgbe_dcb_82599.c
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe_dcb_82599.h b/drivers/net/ixgbe/ixgbe_dcb_82599.h
index 9e5e2827e4af..0f3f791e1e1d 100644
--- a/drivers/net/ixgbe/ixgbe_dcb_82599.h
+++ b/drivers/net/ixgbe/ixgbe_dcb_82599.h
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe_dcb_nl.c b/drivers/net/ixgbe/ixgbe_dcb_nl.c
index 3c7a79a7d7c6..dd4883f642be 100644
--- a/drivers/net/ixgbe/ixgbe_dcb_nl.c
+++ b/drivers/net/ixgbe/ixgbe_dcb_nl.c
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
@@ -223,7 +223,7 @@ static void ixgbe_dcbnl_set_pg_bwg_cfg_tx(struct net_device *netdev, int bwg_id,
 
 	if (adapter->temp_dcb_cfg.bw_percentage[0][bwg_id] !=
 	    adapter->dcb_cfg.bw_percentage[0][bwg_id]) {
-		adapter->dcb_set_bitmap |= BIT_PG_RX;
+		adapter->dcb_set_bitmap |= BIT_PG_TX;
 		adapter->dcb_set_bitmap |= BIT_RESETLINK;
 	}
 }
@@ -341,6 +341,12 @@ static u8 ixgbe_dcbnl_set_all(struct net_device *netdev)
 	if (!adapter->dcb_set_bitmap)
 		return DCB_NO_HW_CHG;
 
+	ret = ixgbe_copy_dcb_cfg(&adapter->temp_dcb_cfg, &adapter->dcb_cfg,
+				 adapter->ring_feature[RING_F_DCB].indices);
+
+	if (ret)
+		return DCB_NO_HW_CHG;
+
 	/*
 	 * Only take down the adapter if the configuration change
 	 * requires a reset.
@@ -359,14 +365,6 @@ static u8 ixgbe_dcbnl_set_all(struct net_device *netdev)
 		}
 	}
 
-	ret = ixgbe_copy_dcb_cfg(&adapter->temp_dcb_cfg, &adapter->dcb_cfg,
-				 adapter->ring_feature[RING_F_DCB].indices);
-	if (ret) {
-		if (adapter->dcb_set_bitmap & BIT_RESETLINK)
-			clear_bit(__IXGBE_RESETTING, &adapter->state);
-		return DCB_NO_HW_CHG;
-	}
-
 	if (adapter->dcb_cfg.pfc_mode_enable) {
 		if ((adapter->hw.mac.type != ixgbe_mac_82598EB) &&
 			(adapter->hw.fc.current_mode != ixgbe_fc_pfc))
diff --git a/drivers/net/ixgbe/ixgbe_ethtool.c b/drivers/net/ixgbe/ixgbe_ethtool.c
index 0bd49d3b9f65..d77961fc75f9 100644
--- a/drivers/net/ixgbe/ixgbe_ethtool.c
+++ b/drivers/net/ixgbe/ixgbe_ethtool.c
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe_fcoe.c b/drivers/net/ixgbe/ixgbe_fcoe.c
index da32a108a7b4..e9a20c88c155 100644
--- a/drivers/net/ixgbe/ixgbe_fcoe.c
+++ b/drivers/net/ixgbe/ixgbe_fcoe.c
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe_fcoe.h b/drivers/net/ixgbe/ixgbe_fcoe.h
index de8ff53187da..abf4b2b3f252 100644
--- a/drivers/net/ixgbe/ixgbe_fcoe.h
+++ b/drivers/net/ixgbe/ixgbe_fcoe.h
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index 35ea8c93fd80..7b7c8486c0bf 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
@@ -52,7 +52,7 @@ static const char ixgbe_driver_string[] =
 
 #define DRV_VERSION "2.0.44-k2"
 const char ixgbe_driver_version[] = DRV_VERSION;
-static char ixgbe_copyright[] = "Copyright (c) 1999-2009 Intel Corporation.";
+static char ixgbe_copyright[] = "Copyright (c) 1999-2010 Intel Corporation.";
 
 static const struct ixgbe_info *ixgbe_info_tbl[] = {
 	[board_82598] = &ixgbe_82598_info,
@@ -262,10 +262,12 @@ static inline bool ixgbe_tx_is_paused(struct ixgbe_adapter *adapter,
 		int reg_idx = tx_ring->reg_idx;
 		int dcb_i = adapter->ring_feature[RING_F_DCB].indices;
 
-		if (adapter->hw.mac.type == ixgbe_mac_82598EB) {
+		switch (adapter->hw.mac.type) {
+		case ixgbe_mac_82598EB:
 			tc = reg_idx >> 2;
 			txoff = IXGBE_TFCS_TXOFF0;
-		} else if (adapter->hw.mac.type == ixgbe_mac_82599EB) {
+			break;
+		case ixgbe_mac_82599EB:
 			tc = 0;
 			txoff = IXGBE_TFCS_TXOFF;
 			if (dcb_i == 8) {
@@ -284,6 +286,9 @@ static inline bool ixgbe_tx_is_paused(struct ixgbe_adapter *adapter,
 						tc += (reg_idx - 96) >> 4;
 				}
 			}
+			break;
+		default:
+			tc = 0;
 		}
 		txoff <<= tc;
 	}
@@ -4373,6 +4378,11 @@ static int ixgbe_resume(struct pci_dev *pdev)
 
 	pci_set_power_state(pdev, PCI_D0);
 	pci_restore_state(pdev);
+	/*
+	 * pci_restore_state clears dev->state_saved so call
+	 * pci_save_state to restore it.
+	 */
+	pci_save_state(pdev);
 
 	err = pci_enable_device_mem(pdev);
 	if (err) {
@@ -4511,6 +4521,7 @@ void ixgbe_update_stats(struct ixgbe_adapter *adapter)
 	struct ixgbe_hw *hw = &adapter->hw;
 	u64 total_mpc = 0;
 	u32 i, missed_rx = 0, mpc, bprc, lxon, lxoff, xon_off_tot;
+	u64 non_eop_descs = 0, restart_queue = 0;
 
 	if (adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED) {
 		u64 rsc_count = 0;
@@ -4528,10 +4539,12 @@ void ixgbe_update_stats(struct ixgbe_adapter *adapter)
 
 	/* gather some stats to the adapter struct that are per queue */
 	for (i = 0; i < adapter->num_tx_queues; i++)
-		adapter->restart_queue += adapter->tx_ring[i].restart_queue;
+		restart_queue += adapter->tx_ring[i].restart_queue;
+	adapter->restart_queue = restart_queue;
 
 	for (i = 0; i < adapter->num_rx_queues; i++)
-		adapter->non_eop_descs += adapter->tx_ring[i].non_eop_descs;
+		non_eop_descs += adapter->rx_ring[i].non_eop_descs;
+	adapter->non_eop_descs = non_eop_descs;
 
 	adapter->stats.crcerrs += IXGBE_READ_REG(hw, IXGBE_CRCERRS);
 	for (i = 0; i < 8; i++) {
@@ -4915,7 +4928,7 @@ static int ixgbe_tso(struct ixgbe_adapter *adapter,
 			                                         iph->daddr, 0,
 			                                         IPPROTO_TCP,
 			                                         0);
-		} else if (skb_shinfo(skb)->gso_type == SKB_GSO_TCPV6) {
+		} else if (skb_is_gso_v6(skb)) {
 			ipv6_hdr(skb)->payload_len = 0;
 			tcp_hdr(skb)->check =
 			    ~csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
@@ -5003,7 +5016,18 @@ static bool ixgbe_tx_csum(struct ixgbe_adapter *adapter,
 		                    IXGBE_ADVTXD_DTYP_CTXT);
 
 		if (skb->ip_summed == CHECKSUM_PARTIAL) {
-			switch (skb->protocol) {
+			__be16 protocol;
+
+			if (skb->protocol == cpu_to_be16(ETH_P_8021Q)) {
+				const struct vlan_ethhdr *vhdr =
+					(const struct vlan_ethhdr *)skb->data;
+
+				protocol = vhdr->h_vlan_encapsulated_proto;
+			} else {
+				protocol = skb->protocol;
+			}
+
+			switch (protocol) {
 			case cpu_to_be16(ETH_P_IP):
 				type_tucmd_mlhl |= IXGBE_ADVTXD_TUCMD_IPV4;
 				if (ip_hdr(skb)->protocol == IPPROTO_TCP)
@@ -5143,19 +5167,19 @@ dma_error:
 	tx_buffer_info->dma = 0;
 	tx_buffer_info->time_stamp = 0;
 	tx_buffer_info->next_to_watch = 0;
-	count--;
+	if (count)
+		count--;
 
 	/* clear timestamp and dma mappings for remaining portion of packet */
-	while (count >= 0) {
-		count--;
-		i--;
-		if (i < 0)
+	while (count--) {
+		if (i==0)
 			i += tx_ring->count;
+		i--;
 		tx_buffer_info = &tx_ring->tx_buffer_info[i];
 		ixgbe_unmap_and_free_tx_resource(adapter, tx_buffer_info);
 	}
 
-	return count;
+	return 0;
 }
 
 static void ixgbe_tx_queue(struct ixgbe_adapter *adapter,
@@ -5305,8 +5329,11 @@ static u16 ixgbe_select_queue(struct net_device *dev, struct sk_buff *skb)
 	struct ixgbe_adapter *adapter = netdev_priv(dev);
 	int txq = smp_processor_id();
 
-	if (adapter->flags & IXGBE_FLAG_FDIR_HASH_CAPABLE)
+	if (adapter->flags & IXGBE_FLAG_FDIR_HASH_CAPABLE) {
+		while (unlikely(txq >= dev->real_num_tx_queues))
+			txq -= dev->real_num_tx_queues;
 		return txq;
+	}
 
 #ifdef IXGBE_FCOE
 	if ((adapter->flags & IXGBE_FLAG_FCOE_ENABLED) &&
@@ -5552,6 +5579,10 @@ static void ixgbe_netpoll(struct net_device *netdev)
 	struct ixgbe_adapter *adapter = netdev_priv(netdev);
 	int i;
 
+	/* if interface is down do nothing */
+	if (test_bit(__IXGBE_DOWN, &adapter->state))
+		return;
+
 	adapter->flags |= IXGBE_FLAG_IN_NETPOLL;
 	if (adapter->flags & IXGBE_FLAG_MSIX_ENABLED) {
 		int num_q_vectors = adapter->num_msix_vectors - NON_Q_VECTORS;
diff --git a/drivers/net/ixgbe/ixgbe_phy.c b/drivers/net/ixgbe/ixgbe_phy.c
index 9ecad17522c3..1c1efd386956 100644
--- a/drivers/net/ixgbe/ixgbe_phy.c
+++ b/drivers/net/ixgbe/ixgbe_phy.c
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe_phy.h b/drivers/net/ixgbe/ixgbe_phy.h
index 9b700f5bf1ed..9cf5f3b4cc5d 100644
--- a/drivers/net/ixgbe/ixgbe_phy.h
+++ b/drivers/net/ixgbe/ixgbe_phy.h
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
diff --git a/drivers/net/ixgbe/ixgbe_type.h b/drivers/net/ixgbe/ixgbe_type.h
index f3e8d52610b7..9eafddfa1b97 100644
--- a/drivers/net/ixgbe/ixgbe_type.h
+++ b/drivers/net/ixgbe/ixgbe_type.h
@@ -1,7 +1,7 @@
 /*******************************************************************************
 
   Intel 10 Gigabit PCI Express Linux driver
-  Copyright(c) 1999 - 2009 Intel Corporation.
+  Copyright(c) 1999 - 2010 Intel Corporation.
 
   This program is free software; you can redistribute it and/or modify it
   under the terms and conditions of the GNU General Public License,
@@ -841,6 +841,8 @@
 #define IXGBE_MPVC      0x04318
 #define IXGBE_SGMIIC    0x04314
 
+#define IXGBE_VALIDATE_LINK_READY_TIMEOUT 50
+
 /* Omer CORECTL */
 #define IXGBE_CORECTL           0x014F00
 /* BARCTRL */
diff --git a/drivers/net/ks8851_mll.c b/drivers/net/ks8851_mll.c
index c146304d8d6c..c0ceebccaa49 100644
--- a/drivers/net/ks8851_mll.c
+++ b/drivers/net/ks8851_mll.c
@@ -854,8 +854,8 @@ static void ks_update_link_status(struct net_device *netdev, struct ks_net *ks)
 
 static irqreturn_t ks_irq(int irq, void *pw)
 {
-	struct ks_net *ks = pw;
-	struct net_device *netdev = ks->netdev;
+	struct net_device *netdev = pw;
+	struct ks_net *ks = netdev_priv(netdev);
 	u16 status;
 
 	/*this should be the first in IRQ handler */
diff --git a/drivers/net/lasi_82596.c b/drivers/net/lasi_82596.c
index a0c578585a50..b77238dbafb8 100644
--- a/drivers/net/lasi_82596.c
+++ b/drivers/net/lasi_82596.c
@@ -47,7 +47,7 @@
    TBD:
    * look at deferring rx frames rather than discarding (as per tulip)
    * handle tx ring full as per tulip
-   * performace test to tune rx_copybreak
+   * performance test to tune rx_copybreak
 
    Most of my modifications relate to the braindead big-endian
    implementation by Intel.  When the i596 is operating in
diff --git a/drivers/net/lib82596.c b/drivers/net/lib82596.c
index 7a07430206e3..b117f7f8b194 100644
--- a/drivers/net/lib82596.c
+++ b/drivers/net/lib82596.c
@@ -47,7 +47,7 @@
    TBD:
    * look at deferring rx frames rather than discarding (as per tulip)
    * handle tx ring full as per tulip
-   * performace test to tune rx_copybreak
+   * performance test to tune rx_copybreak
 
    Most of my modifications relate to the braindead big-endian
    implementation by Intel.  When the i596 is operating in
diff --git a/drivers/net/ll_temac_main.c b/drivers/net/ll_temac_main.c
index 336e7c7a9275..a8522bd73ae7 100644
--- a/drivers/net/ll_temac_main.c
+++ b/drivers/net/ll_temac_main.c
@@ -134,7 +134,7 @@ static int temac_dma_bd_init(struct net_device *ndev)
 	struct sk_buff *skb;
 	int i;
 
-	lp->rx_skb = kzalloc(sizeof(struct sk_buff)*RX_BD_NUM, GFP_KERNEL);
+	lp->rx_skb = kzalloc(sizeof(*lp->rx_skb) * RX_BD_NUM, GFP_KERNEL);
 	/* allocate the tx and rx ring buffer descriptors. */
 	/* returns a virtual addres and a physical address. */
 	lp->tx_bd_v = dma_alloc_coherent(ndev->dev.parent,
diff --git a/drivers/net/loopback.c b/drivers/net/loopback.c
index eae4ad749e9d..b9fcc9819837 100644
--- a/drivers/net/loopback.c
+++ b/drivers/net/loopback.c
@@ -81,7 +81,7 @@ static netdev_tx_t loopback_xmit(struct sk_buff *skb,
 
 	/* it's OK to use per_cpu_ptr() because BHs are off */
 	pcpu_lstats = dev->ml_priv;
-	lb_stats = per_cpu_ptr(pcpu_lstats, smp_processor_id());
+	lb_stats = this_cpu_ptr(pcpu_lstats);
 
 	len = skb->len;
 	if (likely(netif_rx(skb) == NET_RX_SUCCESS)) {
diff --git a/drivers/net/mlx4/alloc.c b/drivers/net/mlx4/alloc.c
index ad95d5f7b630..8c8515619b8e 100644
--- a/drivers/net/mlx4/alloc.c
+++ b/drivers/net/mlx4/alloc.c
@@ -72,35 +72,6 @@ void mlx4_bitmap_free(struct mlx4_bitmap *bitmap, u32 obj)
 	mlx4_bitmap_free_range(bitmap, obj, 1);
 }
 
-static unsigned long find_aligned_range(unsigned long *bitmap,
-					u32 start, u32 nbits,
-					int len, int align)
-{
-	unsigned long end, i;
-
-again:
-	start = ALIGN(start, align);
-
-	while ((start < nbits) && test_bit(start, bitmap))
-		start += align;
-
-	if (start >= nbits)
-		return -1;
-
-	end = start+len;
-	if (end > nbits)
-		return -1;
-
-	for (i = start + 1; i < end; i++) {
-		if (test_bit(i, bitmap)) {
-			start = i + 1;
-			goto again;
-		}
-	}
-
-	return start;
-}
-
 u32 mlx4_bitmap_alloc_range(struct mlx4_bitmap *bitmap, int cnt, int align)
 {
 	u32 obj, i;
@@ -110,13 +81,13 @@ u32 mlx4_bitmap_alloc_range(struct mlx4_bitmap *bitmap, int cnt, int align)
 
 	spin_lock(&bitmap->lock);
 
-	obj = find_aligned_range(bitmap->table, bitmap->last,
-				 bitmap->max, cnt, align);
+	obj = bitmap_find_next_zero_area(bitmap->table, bitmap->max,
+				bitmap->last, cnt, align - 1);
 	if (obj >= bitmap->max) {
 		bitmap->top = (bitmap->top + bitmap->max + bitmap->reserved_top)
 				& bitmap->mask;
-		obj = find_aligned_range(bitmap->table, 0, bitmap->max,
-					 cnt, align);
+		obj = bitmap_find_next_zero_area(bitmap->table, bitmap->max,
+						0, cnt, align - 1);
 	}
 
 	if (obj < bitmap->max) {
diff --git a/drivers/net/mlx4/en_rx.c b/drivers/net/mlx4/en_rx.c
index 03b781a7a182..829b9ec9ff67 100644
--- a/drivers/net/mlx4/en_rx.c
+++ b/drivers/net/mlx4/en_rx.c
@@ -204,7 +204,7 @@ static void mlx4_en_free_rx_desc(struct mlx4_en_priv *priv,
 		en_dbg(DRV, priv, "Freeing fragment:%d\n", nr);
 		dma = be64_to_cpu(rx_desc->data[nr].addr);
 
-		en_dbg(DRV, priv, "Unmaping buffer at dma:0x%llx\n", (u64) dma);
+		en_dbg(DRV, priv, "Unmapping buffer at dma:0x%llx\n", (u64) dma);
 		pci_unmap_single(mdev->pdev, dma, skb_frags[nr].size,
 				 PCI_DMA_FROMDEVICE);
 		put_page(skb_frags[nr].page);
diff --git a/drivers/net/mlx4/en_tx.c b/drivers/net/mlx4/en_tx.c
index 8c7279965b44..3d1396af9462 100644
--- a/drivers/net/mlx4/en_tx.c
+++ b/drivers/net/mlx4/en_tx.c
@@ -47,7 +47,7 @@ enum {
 static int inline_thold __read_mostly = MAX_INLINE;
 
 module_param_named(inline_thold, inline_thold, int, 0444);
-MODULE_PARM_DESC(inline_thold, "treshold for using inline data");
+MODULE_PARM_DESC(inline_thold, "threshold for using inline data");
 
 int mlx4_en_create_tx_ring(struct mlx4_en_priv *priv,
 			   struct mlx4_en_tx_ring *ring, u32 size,
diff --git a/drivers/net/mlx4/fw.c b/drivers/net/mlx4/fw.c
index 3c16602172fc..04f42ae1eda0 100644
--- a/drivers/net/mlx4/fw.c
+++ b/drivers/net/mlx4/fw.c
@@ -90,6 +90,7 @@ static void dump_dev_cap_flags(struct mlx4_dev *dev, u32 flags)
 		[ 9] = "Q_Key violation counter",
 		[10] = "VMM",
 		[12] = "DPDP",
+		[15] = "Big LSO headers",
 		[16] = "MW support",
 		[17] = "APM support",
 		[18] = "Atomic ops support",
@@ -235,7 +236,7 @@ int mlx4_QUERY_DEV_CAP(struct mlx4_dev *dev, struct mlx4_dev_cap *dev_cap)
 	MLX4_GET(field, outbox, QUERY_DEV_CAP_MAX_MPT_OFFSET);
 	dev_cap->max_mpts = 1 << (field & 0x3f);
 	MLX4_GET(field, outbox, QUERY_DEV_CAP_RSVD_EQ_OFFSET);
-	dev_cap->reserved_eqs = 1 << (field & 0xf);
+	dev_cap->reserved_eqs = field & 0xf;
 	MLX4_GET(field, outbox, QUERY_DEV_CAP_MAX_EQ_OFFSET);
 	dev_cap->max_eqs = 1 << (field & 0xf);
 	MLX4_GET(field, outbox, QUERY_DEV_CAP_RSVD_MTT_OFFSET);
diff --git a/drivers/net/mlx4/main.c b/drivers/net/mlx4/main.c
index 291a505fd4fc..3cf56d90d859 100644
--- a/drivers/net/mlx4/main.c
+++ b/drivers/net/mlx4/main.c
@@ -1174,7 +1174,7 @@ static int __mlx4_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
 	return 0;
 
 err_port:
-	for (port = 1; port <= dev->caps.num_ports; port++)
+	for (--port; port >= 1; --port)
 		mlx4_cleanup_port_info(&priv->port[port]);
 
 	mlx4_cleanup_mcg_table(dev);
diff --git a/drivers/net/mlx4/mlx4_en.h b/drivers/net/mlx4/mlx4_en.h
index 4376147b0ea0..82c3ebc584e3 100644
--- a/drivers/net/mlx4/mlx4_en.h
+++ b/drivers/net/mlx4/mlx4_en.h
@@ -162,7 +162,7 @@ enum {
 #define MLX4_EN_DEF_RX_PAUSE	1
 #define MLX4_EN_DEF_TX_PAUSE	1
 
-/* Interval between sucessive polls in the Tx routine when polling is used
+/* Interval between successive polls in the Tx routine when polling is used
    instead of interrupts (in per-core Tx rings) - should be power of 2 */
 #define MLX4_EN_TX_POLL_MODER	16
 #define MLX4_EN_TX_POLL_TIMEOUT	(HZ / 4)
diff --git a/drivers/net/mlx4/sense.c b/drivers/net/mlx4/sense.c
index f36ae691cab3..015fbe785c13 100644
--- a/drivers/net/mlx4/sense.c
+++ b/drivers/net/mlx4/sense.c
@@ -53,7 +53,7 @@ static int mlx4_SENSE_PORT(struct mlx4_dev *dev, int port,
 
 	if (out_param > 2) {
 		mlx4_err(dev, "Sense returned illegal value: 0x%llx\n", out_param);
-		return EINVAL;
+		return -EINVAL;
 	}
 
 	*type = out_param;
diff --git a/drivers/net/mv643xx_eth.c b/drivers/net/mv643xx_eth.c
index 1405a170bb43..af67af55efe7 100644
--- a/drivers/net/mv643xx_eth.c
+++ b/drivers/net/mv643xx_eth.c
@@ -656,6 +656,7 @@ static int rxq_refill(struct rx_queue *rxq, int budget)
 		struct sk_buff *skb;
 		int rx;
 		struct rx_desc *rx_desc;
+		int size;
 
 		skb = __skb_dequeue(&mp->rx_recycle);
 		if (skb == NULL)
@@ -678,10 +679,11 @@ static int rxq_refill(struct rx_queue *rxq, int budget)
 
 		rx_desc = rxq->rx_desc_area + rx;
 
+		size = skb->end - skb->data;
 		rx_desc->buf_ptr = dma_map_single(mp->dev->dev.parent,
-						  skb->data, mp->skb_size,
+						  skb->data, size,
 						  DMA_FROM_DEVICE);
-		rx_desc->buf_size = mp->skb_size;
+		rx_desc->buf_size = size;
 		rxq->rx_skb[rx] = skb;
 		wmb();
 		rx_desc->cmd_sts = BUFFER_OWNED_BY_DMA | RX_ENABLE_INTERRUPT;
diff --git a/drivers/net/netxen/netxen_nic.h b/drivers/net/netxen/netxen_nic.h
index 76cd1f3e9fc8..9bc5bd1d538a 100644
--- a/drivers/net/netxen/netxen_nic.h
+++ b/drivers/net/netxen/netxen_nic.h
@@ -53,8 +53,8 @@
 
 #define _NETXEN_NIC_LINUX_MAJOR 4
 #define _NETXEN_NIC_LINUX_MINOR 0
-#define _NETXEN_NIC_LINUX_SUBVERSION 65
-#define NETXEN_NIC_LINUX_VERSIONID  "4.0.65"
+#define _NETXEN_NIC_LINUX_SUBVERSION 72
+#define NETXEN_NIC_LINUX_VERSIONID  "4.0.72"
 
 #define NETXEN_VERSION_CODE(a, b, c)	(((a) << 24) + ((b) << 16) + (c))
 #define _major(v)	(((v) >> 24) & 0xff)
diff --git a/drivers/net/netxen/netxen_nic_ethtool.c b/drivers/net/netxen/netxen_nic_ethtool.c
index ddd704ae0188..542f408333ff 100644
--- a/drivers/net/netxen/netxen_nic_ethtool.c
+++ b/drivers/net/netxen/netxen_nic_ethtool.c
@@ -66,7 +66,7 @@ static const char netxen_nic_gstrings_test[][ETH_GSTRING_LEN] = {
 
 #define NETXEN_NIC_TEST_LEN	ARRAY_SIZE(netxen_nic_gstrings_test)
 
-#define NETXEN_NIC_REGS_COUNT 42
+#define NETXEN_NIC_REGS_COUNT 30
 #define NETXEN_NIC_REGS_LEN (NETXEN_NIC_REGS_COUNT * sizeof(__le32))
 #define NETXEN_MAX_EEPROM_LEN   1024
 
@@ -312,150 +312,91 @@ static int netxen_nic_get_regs_len(struct net_device *dev)
 	return NETXEN_NIC_REGS_LEN;
 }
 
-struct netxen_niu_regs {
-	__u32 reg[NETXEN_NIC_REGS_COUNT];
-};
-
-static struct netxen_niu_regs niu_registers[] = {
-	{
-	 /* GB Mode */
-	 {
-	  NETXEN_NIU_GB_SERDES_RESET,
-	  NETXEN_NIU_GB0_MII_MODE,
-	  NETXEN_NIU_GB1_MII_MODE,
-	  NETXEN_NIU_GB2_MII_MODE,
-	  NETXEN_NIU_GB3_MII_MODE,
-	  NETXEN_NIU_GB0_GMII_MODE,
-	  NETXEN_NIU_GB1_GMII_MODE,
-	  NETXEN_NIU_GB2_GMII_MODE,
-	  NETXEN_NIU_GB3_GMII_MODE,
-	  NETXEN_NIU_REMOTE_LOOPBACK,
-	  NETXEN_NIU_GB0_HALF_DUPLEX,
-	  NETXEN_NIU_GB1_HALF_DUPLEX,
-	  NETXEN_NIU_RESET_SYS_FIFOS,
-	  NETXEN_NIU_GB_CRC_DROP,
-	  NETXEN_NIU_GB_DROP_WRONGADDR,
-	  NETXEN_NIU_TEST_MUX_CTL,
-
-	  NETXEN_NIU_GB_MAC_CONFIG_0(0),
-	  NETXEN_NIU_GB_MAC_CONFIG_1(0),
-	  NETXEN_NIU_GB_HALF_DUPLEX_CTRL(0),
-	  NETXEN_NIU_GB_MAX_FRAME_SIZE(0),
-	  NETXEN_NIU_GB_TEST_REG(0),
-	  NETXEN_NIU_GB_MII_MGMT_CONFIG(0),
-	  NETXEN_NIU_GB_MII_MGMT_COMMAND(0),
-	  NETXEN_NIU_GB_MII_MGMT_ADDR(0),
-	  NETXEN_NIU_GB_MII_MGMT_CTRL(0),
-	  NETXEN_NIU_GB_MII_MGMT_STATUS(0),
-	  NETXEN_NIU_GB_MII_MGMT_INDICATE(0),
-	  NETXEN_NIU_GB_INTERFACE_CTRL(0),
-	  NETXEN_NIU_GB_INTERFACE_STATUS(0),
-	  NETXEN_NIU_GB_STATION_ADDR_0(0),
-	  NETXEN_NIU_GB_STATION_ADDR_1(0),
-	  -1,
-	  }
-	 },
-	{
-	 /* XG Mode */
-	 {
-	  NETXEN_NIU_XG_SINGLE_TERM,
-	  NETXEN_NIU_XG_DRIVE_HI,
-	  NETXEN_NIU_XG_DRIVE_LO,
-	  NETXEN_NIU_XG_DTX,
-	  NETXEN_NIU_XG_DEQ,
-	  NETXEN_NIU_XG_WORD_ALIGN,
-	  NETXEN_NIU_XG_RESET,
-	  NETXEN_NIU_XG_POWER_DOWN,
-	  NETXEN_NIU_XG_RESET_PLL,
-	  NETXEN_NIU_XG_SERDES_LOOPBACK,
-	  NETXEN_NIU_XG_DO_BYTE_ALIGN,
-	  NETXEN_NIU_XG_TX_ENABLE,
-	  NETXEN_NIU_XG_RX_ENABLE,
-	  NETXEN_NIU_XG_STATUS,
-	  NETXEN_NIU_XG_PAUSE_THRESHOLD,
-	  NETXEN_NIU_XGE_CONFIG_0,
-	  NETXEN_NIU_XGE_CONFIG_1,
-	  NETXEN_NIU_XGE_IPG,
-	  NETXEN_NIU_XGE_STATION_ADDR_0_HI,
-	  NETXEN_NIU_XGE_STATION_ADDR_0_1,
-	  NETXEN_NIU_XGE_STATION_ADDR_1_LO,
-	  NETXEN_NIU_XGE_STATUS,
-	  NETXEN_NIU_XGE_MAX_FRAME_SIZE,
-	  NETXEN_NIU_XGE_PAUSE_FRAME_VALUE,
-	  NETXEN_NIU_XGE_TX_BYTE_CNT,
-	  NETXEN_NIU_XGE_TX_FRAME_CNT,
-	  NETXEN_NIU_XGE_RX_BYTE_CNT,
-	  NETXEN_NIU_XGE_RX_FRAME_CNT,
-	  NETXEN_NIU_XGE_AGGR_ERROR_CNT,
-	  NETXEN_NIU_XGE_MULTICAST_FRAME_CNT,
-	  NETXEN_NIU_XGE_UNICAST_FRAME_CNT,
-	  NETXEN_NIU_XGE_CRC_ERROR_CNT,
-	  NETXEN_NIU_XGE_OVERSIZE_FRAME_ERR,
-	  NETXEN_NIU_XGE_UNDERSIZE_FRAME_ERR,
-	  NETXEN_NIU_XGE_LOCAL_ERROR_CNT,
-	  NETXEN_NIU_XGE_REMOTE_ERROR_CNT,
-	  NETXEN_NIU_XGE_CONTROL_CHAR_CNT,
-	  NETXEN_NIU_XGE_PAUSE_FRAME_CNT,
-	  -1,
-	  }
-	 }
-};
-
 static void
 netxen_nic_get_regs(struct net_device *dev, struct ethtool_regs *regs, void *p)
 {
 	struct netxen_adapter *adapter = netdev_priv(dev);
-	__u32 mode, *regs_buff = p;
-	int i, window;
+	struct netxen_recv_context *recv_ctx = &adapter->recv_ctx;
+	struct nx_host_sds_ring *sds_ring;
+	u32 *regs_buff = p;
+	int ring, i = 0;
+	int port = adapter->physical_port;
 
 	memset(p, 0, NETXEN_NIC_REGS_LEN);
+
 	regs->version = (1 << 24) | (adapter->ahw.revision_id << 16) |
 	    (adapter->pdev)->device;
-	/* which mode */
-	regs_buff[0] = NXRD32(adapter, NETXEN_NIU_MODE);
-	mode = regs_buff[0];
-
-	/* Common registers to all the modes */
-	regs_buff[2] = NXRD32(adapter, NETXEN_NIU_STRAP_VALUE_SAVE_HIGHER);
-	/* GB/XGB Mode */
-	mode = (mode / 2) - 1;
-	window = 0;
-	if (mode <= 1) {
-		for (i = 3; niu_registers[mode].reg[i - 3] != -1; i++) {
-			/* GB: port specific registers */
-			if (mode == 0 && i >= 19)
-				window = adapter->physical_port *
-					NETXEN_NIC_PORT_WINDOW;
-
-			regs_buff[i] = NXRD32(adapter,
-				niu_registers[mode].reg[i - 3] + window);
-		}
 
+	if (adapter->is_up != NETXEN_ADAPTER_UP_MAGIC)
+		return;
+
+	regs_buff[i++] = NXRD32(adapter, CRB_CMDPEG_STATE);
+	regs_buff[i++] = NXRD32(adapter, CRB_RCVPEG_STATE);
+	regs_buff[i++] = NXRD32(adapter, CRB_FW_CAPABILITIES_1);
+	regs_buff[i++] = NXRDIO(adapter, adapter->crb_int_state_reg);
+	regs_buff[i++] = NXRD32(adapter, NX_CRB_DEV_REF_COUNT);
+	regs_buff[i++] = NXRD32(adapter, NX_CRB_DEV_STATE);
+	regs_buff[i++] = NXRD32(adapter, NETXEN_PEG_ALIVE_COUNTER);
+	regs_buff[i++] = NXRD32(adapter, NETXEN_PEG_HALT_STATUS1);
+	regs_buff[i++] = NXRD32(adapter, NETXEN_PEG_HALT_STATUS2);
+
+	regs_buff[i++] = NXRD32(adapter, NETXEN_CRB_PEG_NET_0+0x3c);
+	regs_buff[i++] = NXRD32(adapter, NETXEN_CRB_PEG_NET_1+0x3c);
+	regs_buff[i++] = NXRD32(adapter, NETXEN_CRB_PEG_NET_2+0x3c);
+	regs_buff[i++] = NXRD32(adapter, NETXEN_CRB_PEG_NET_3+0x3c);
+
+	if (NX_IS_REVISION_P3(adapter->ahw.revision_id)) {
+
+		regs_buff[i++] = NXRD32(adapter, NETXEN_CRB_PEG_NET_4+0x3c);
+		i += 2;
+
+		regs_buff[i++] = NXRD32(adapter, CRB_XG_STATE_P3);
+		regs_buff[i++] = le32_to_cpu(*(adapter->tx_ring->hw_consumer));
+
+	} else {
+		i++;
+
+		regs_buff[i++] = NXRD32(adapter,
+					NETXEN_NIU_XGE_CONFIG_0+(0x10000*port));
+		regs_buff[i++] = NXRD32(adapter,
+					NETXEN_NIU_XGE_CONFIG_1+(0x10000*port));
+
+		regs_buff[i++] = NXRD32(adapter, CRB_XG_STATE);
+		regs_buff[i++] = NXRDIO(adapter,
+				 adapter->tx_ring->crb_cmd_consumer);
+	}
+
+	regs_buff[i++] = NXRDIO(adapter, adapter->tx_ring->crb_cmd_producer);
+
+	regs_buff[i++] = NXRDIO(adapter,
+			 recv_ctx->rds_rings[0].crb_rcv_producer);
+	regs_buff[i++] = NXRDIO(adapter,
+			 recv_ctx->rds_rings[1].crb_rcv_producer);
+
+	regs_buff[i++] = adapter->max_sds_rings;
+
+	for (ring = 0; ring < adapter->max_sds_rings; ring++) {
+		sds_ring = &(recv_ctx->sds_rings[ring]);
+		regs_buff[i++] = NXRDIO(adapter,
+					sds_ring->crb_sts_consumer);
 	}
 }
 
 static u32 netxen_nic_test_link(struct net_device *dev)
 {
 	struct netxen_adapter *adapter = netdev_priv(dev);
-	__u32 status;
-	int val;
+	u32 val, port;
 
-	/* read which mode */
-	if (adapter->ahw.port_type == NETXEN_NIC_GBE) {
-		if (adapter->phy_read &&
-		    adapter->phy_read(adapter,
-				      NETXEN_NIU_GB_MII_MGMT_ADDR_PHY_STATUS,
-				      &status) != 0)
-			return -EIO;
-		else {
-			val = netxen_get_phy_link(status);
-			return !val;
-		}
-	} else if (adapter->ahw.port_type == NETXEN_NIC_XGBE) {
+	port = adapter->physical_port;
+	if (NX_IS_REVISION_P3(adapter->ahw.revision_id)) {
+		val = NXRD32(adapter, CRB_XG_STATE_P3);
+		val = XG_LINK_STATE_P3(adapter->ahw.pci_func, val);
+		return (val == XG_LINK_UP_P3) ? 0 : 1;
+	} else {
 		val = NXRD32(adapter, CRB_XG_STATE);
+		val = (val >> port*8) & 0xff;
 		return (val == XG_LINK_UP) ? 0 : 1;
 	}
-	return -EIO;
 }
 
 static int
diff --git a/drivers/net/netxen/netxen_nic_hw.c b/drivers/net/netxen/netxen_nic_hw.c
index 2e364fee3cbb..85e28e60ecf1 100644
--- a/drivers/net/netxen/netxen_nic_hw.c
+++ b/drivers/net/netxen/netxen_nic_hw.c
@@ -345,8 +345,7 @@ netxen_pcie_sem_lock(struct netxen_adapter *adapter, int sem, u32 id_reg)
 void
 netxen_pcie_sem_unlock(struct netxen_adapter *adapter, int sem)
 {
-	int val;
-	val = NXRD32(adapter, NETXEN_PCIE_REG(PCIE_SEM_UNLOCK(sem)));
+	NXRD32(adapter, NETXEN_PCIE_REG(PCIE_SEM_UNLOCK(sem)));
 }
 
 int netxen_niu_xg_init_port(struct netxen_adapter *adapter, int port)
@@ -691,6 +690,9 @@ void netxen_p3_nic_set_multi(struct net_device *netdev)
 	struct list_head *head;
 	nx_mac_list_t *cur;
 
+	if (adapter->is_up != NETXEN_ADAPTER_UP_MAGIC)
+		return;
+
 	list_splice_tail_init(&adapter->mac_list, &del_list);
 
 	nx_p3_nic_add_mac(adapter, adapter->mac_addr, &del_list);
diff --git a/drivers/net/netxen/netxen_nic_init.c b/drivers/net/netxen/netxen_nic_init.c
index 02f8d4b4db63..64cff68d372c 100644
--- a/drivers/net/netxen/netxen_nic_init.c
+++ b/drivers/net/netxen/netxen_nic_init.c
@@ -184,6 +184,8 @@ skip_rds:
 
 	tx_ring = adapter->tx_ring;
 	vfree(tx_ring->cmd_buf_arr);
+	kfree(tx_ring);
+	adapter->tx_ring = NULL;
 }
 
 int netxen_alloc_sw_resources(struct netxen_adapter *adapter)
@@ -782,7 +784,7 @@ netxen_need_fw_reset(struct netxen_adapter *adapter)
 	if (NXRD32(adapter, CRB_CMDPEG_STATE) == PHAN_INITIALIZE_FAILED)
 		return 1;
 
-	old_count = count = NXRD32(adapter, NETXEN_PEG_ALIVE_COUNTER);
+	old_count = NXRD32(adapter, NETXEN_PEG_ALIVE_COUNTER);
 
 	for (i = 0; i < 10; i++) {
 
diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index f4996846a234..24279e6e55f5 100644
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -57,7 +57,9 @@ static int use_msi = 1;
 
 static int use_msi_x = 1;
 
-static unsigned long auto_fw_reset = AUTO_FW_RESET_ENABLED;
+static int auto_fw_reset = AUTO_FW_RESET_ENABLED;
+module_param(auto_fw_reset, int, 0644);
+MODULE_PARM_DESC(auto_fw_reset,"Auto firmware reset (0=disabled, 1=enabled");
 
 static int __devinit netxen_nic_probe(struct pci_dev *pdev,
 		const struct pci_device_id *ent);
@@ -338,7 +340,7 @@ netxen_check_hw_init(struct netxen_adapter *adapter, int first_boot)
 		if (!(first_boot & 0x4)) {
 			first_boot |= 0x4;
 			NXWR32(adapter, NETXEN_PCIE_REG(0x4), first_boot);
-			first_boot = NXRD32(adapter, NETXEN_PCIE_REG(0x4));
+			NXRD32(adapter, NETXEN_PCIE_REG(0x4));
 		}
 
 		/* This is the first boot after power up */
@@ -1896,12 +1898,8 @@ static void netxen_nic_handle_phy_intr(struct netxen_adapter *adapter)
 		linkup = (val == XG_LINK_UP_P3);
 	} else {
 		val = NXRD32(adapter, CRB_XG_STATE);
-		if (adapter->ahw.port_type == NETXEN_NIC_GBE)
-			linkup = (val >> port) & 1;
-		else {
-			val = (val >> port*8) & 0xff;
-			linkup = (val == XG_LINK_UP);
-		}
+		val = (val >> port*8) & 0xff;
+		linkup = (val == XG_LINK_UP);
 	}
 
 	netxen_advert_link_change(adapter, linkup);
@@ -1943,7 +1941,7 @@ static void netxen_tx_timeout_task(struct work_struct *work)
 		netif_wake_queue(adapter->netdev);
 
 		clear_bit(__NX_RESETTING, &adapter->state);
-
+		return;
 	} else {
 		clear_bit(__NX_RESETTING, &adapter->state);
 		if (!netxen_nic_reset_context(adapter)) {
@@ -2242,7 +2240,9 @@ netxen_detach_work(struct work_struct *work)
 
 	netxen_nic_down(adapter, netdev);
 
+	rtnl_lock();
 	netxen_nic_detach(adapter);
+	rtnl_unlock();
 
 	status = NXRD32(adapter, NETXEN_PEG_HALT_STATUS1);
 
@@ -2534,42 +2534,6 @@ static struct bin_attribute bin_attr_mem = {
 	.write = netxen_sysfs_write_mem,
 };
 
-#ifdef CONFIG_MODULES
-static ssize_t
-netxen_store_auto_fw_reset(struct module_attribute *mattr,
-		struct module *mod, const char *buf, size_t count)
-
-{
-	unsigned long new;
-
-	if (strict_strtoul(buf, 16, &new))
-		return -EINVAL;
-
-	if ((new == AUTO_FW_RESET_ENABLED) || (new == AUTO_FW_RESET_DISABLED)) {
-		auto_fw_reset = new;
-		return count;
-	}
-
-	return -EINVAL;
-}
-
-static ssize_t
-netxen_show_auto_fw_reset(struct module_attribute *mattr,
-		struct module *mod, char *buf)
-
-{
-	if (auto_fw_reset == AUTO_FW_RESET_ENABLED)
-		return sprintf(buf, "enabled\n");
-	else
-		return sprintf(buf, "disabled\n");
-}
-
-static struct module_attribute mod_attr_fw_reset = {
-	.attr = {.name = "auto_fw_reset", .mode = (S_IRUGO | S_IWUSR)},
-	.show = netxen_show_auto_fw_reset,
-	.store = netxen_store_auto_fw_reset,
-};
-#endif
 
 static void
 netxen_create_sysfs_entries(struct netxen_adapter *adapter)
@@ -2775,23 +2739,12 @@ static struct pci_driver netxen_driver = {
 
 static int __init netxen_init_module(void)
 {
-#ifdef CONFIG_MODULES
-	struct module *mod = THIS_MODULE;
-#endif
-
 	printk(KERN_INFO "%s\n", netxen_nic_driver_string);
 
 #ifdef CONFIG_INET
 	register_netdevice_notifier(&netxen_netdev_cb);
 	register_inetaddr_notifier(&netxen_inetaddr_cb);
 #endif
-
-#ifdef CONFIG_MODULES
-	if (sysfs_create_file(&mod->mkobj.kobj, &mod_attr_fw_reset.attr))
-		printk(KERN_ERR "%s: Failed to create auto_fw_reset "
-				"sysfs entry.", netxen_nic_driver_name);
-#endif
-
 	return pci_register_driver(&netxen_driver);
 }
 
@@ -2799,12 +2752,6 @@ module_init(netxen_init_module);
 
 static void __exit netxen_exit_module(void)
 {
-#ifdef CONFIG_MODULES
-	struct module *mod = THIS_MODULE;
-
-	sysfs_remove_file(&mod->mkobj.kobj, &mod_attr_fw_reset.attr);
-#endif
-
 	pci_unregister_driver(&netxen_driver);
 
 #ifdef CONFIG_INET
diff --git a/drivers/net/niu.c b/drivers/net/niu.c
index 8ce58c4c7dd3..2aed2b382c40 100644
--- a/drivers/net/niu.c
+++ b/drivers/net/niu.c
@@ -2844,7 +2844,7 @@ static int tcam_wait_bit(struct niu *np, u64 bit)
 			break;
 		udelay(1);
 	}
-	if (limit < 0)
+	if (limit <= 0)
 		return -ENODEV;
 
 	return 0;
diff --git a/drivers/net/octeon/Kconfig b/drivers/net/octeon/Kconfig
new file mode 100644
index 000000000000..1e56bbf3f5c0
--- /dev/null
+++ b/drivers/net/octeon/Kconfig
@@ -0,0 +1,10 @@
+config OCTEON_MGMT_ETHERNET
+	tristate "Octeon Management port ethernet driver (CN5XXX, CN6XXX)"
+	depends on  CPU_CAVIUM_OCTEON
+	select PHYLIB
+	select MDIO_OCTEON
+	default y
+	help
+	  This option enables the ethernet driver for the management
+	  port on Cavium Networks' Octeon CN57XX, CN56XX, CN55XX,
+	  CN54XX, CN52XX, and CN6XXX chips.
diff --git a/drivers/net/octeon/Makefile b/drivers/net/octeon/Makefile
new file mode 100644
index 000000000000..906edecacfd3
--- /dev/null
+++ b/drivers/net/octeon/Makefile
@@ -0,0 +1,2 @@
+
+obj-$(CONFIG_OCTEON_MGMT_ETHERNET)	+= octeon_mgmt.o
diff --git a/drivers/net/octeon/octeon_mgmt.c b/drivers/net/octeon/octeon_mgmt.c
new file mode 100644
index 000000000000..050538bf155a
--- /dev/null
+++ b/drivers/net/octeon/octeon_mgmt.c
@@ -0,0 +1,1176 @@
+/*
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright (C) 2009 Cavium Networks
+ */
+
+#include <linux/capability.h>
+#include <linux/dma-mapping.h>
+#include <linux/init.h>
+#include <linux/platform_device.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/if_vlan.h>
+#include <linux/phy.h>
+#include <linux/spinlock.h>
+
+#include <asm/octeon/octeon.h>
+#include <asm/octeon/cvmx-mixx-defs.h>
+#include <asm/octeon/cvmx-agl-defs.h>
+
+#define DRV_NAME "octeon_mgmt"
+#define DRV_VERSION "2.0"
+#define DRV_DESCRIPTION \
+	"Cavium Networks Octeon MII (management) port Network Driver"
+
+#define OCTEON_MGMT_NAPI_WEIGHT 16
+
+/*
+ * Ring sizes that are powers of two allow for more efficient modulo
+ * opertions.
+ */
+#define OCTEON_MGMT_RX_RING_SIZE 512
+#define OCTEON_MGMT_TX_RING_SIZE 128
+
+/* Allow 8 bytes for vlan and FCS. */
+#define OCTEON_MGMT_RX_HEADROOM (ETH_HLEN + ETH_FCS_LEN + VLAN_HLEN)
+
+union mgmt_port_ring_entry {
+	u64 d64;
+	struct {
+		u64    reserved_62_63:2;
+		/* Length of the buffer/packet in bytes */
+		u64    len:14;
+		/* For TX, signals that the packet should be timestamped */
+		u64    tstamp:1;
+		/* The RX error code */
+		u64    code:7;
+#define RING_ENTRY_CODE_DONE 0xf
+#define RING_ENTRY_CODE_MORE 0x10
+		/* Physical address of the buffer */
+		u64    addr:40;
+	} s;
+};
+
+struct octeon_mgmt {
+	struct net_device *netdev;
+	int port;
+	int irq;
+	u64 *tx_ring;
+	dma_addr_t tx_ring_handle;
+	unsigned int tx_next;
+	unsigned int tx_next_clean;
+	unsigned int tx_current_fill;
+	/* The tx_list lock also protects the ring related variables */
+	struct sk_buff_head tx_list;
+
+	/* RX variables only touched in napi_poll.  No locking necessary. */
+	u64 *rx_ring;
+	dma_addr_t rx_ring_handle;
+	unsigned int rx_next;
+	unsigned int rx_next_fill;
+	unsigned int rx_current_fill;
+	struct sk_buff_head rx_list;
+
+	spinlock_t lock;
+	unsigned int last_duplex;
+	unsigned int last_link;
+	struct device *dev;
+	struct napi_struct napi;
+	struct tasklet_struct tx_clean_tasklet;
+	struct phy_device *phydev;
+};
+
+static void octeon_mgmt_set_rx_irq(struct octeon_mgmt *p, int enable)
+{
+	int port = p->port;
+	union cvmx_mixx_intena mix_intena;
+	unsigned long flags;
+
+	spin_lock_irqsave(&p->lock, flags);
+	mix_intena.u64 = cvmx_read_csr(CVMX_MIXX_INTENA(port));
+	mix_intena.s.ithena = enable ? 1 : 0;
+	cvmx_write_csr(CVMX_MIXX_INTENA(port), mix_intena.u64);
+	spin_unlock_irqrestore(&p->lock, flags);
+}
+
+static void octeon_mgmt_set_tx_irq(struct octeon_mgmt *p, int enable)
+{
+	int port = p->port;
+	union cvmx_mixx_intena mix_intena;
+	unsigned long flags;
+
+	spin_lock_irqsave(&p->lock, flags);
+	mix_intena.u64 = cvmx_read_csr(CVMX_MIXX_INTENA(port));
+	mix_intena.s.othena = enable ? 1 : 0;
+	cvmx_write_csr(CVMX_MIXX_INTENA(port), mix_intena.u64);
+	spin_unlock_irqrestore(&p->lock, flags);
+}
+
+static inline void octeon_mgmt_enable_rx_irq(struct octeon_mgmt *p)
+{
+	octeon_mgmt_set_rx_irq(p, 1);
+}
+
+static inline void octeon_mgmt_disable_rx_irq(struct octeon_mgmt *p)
+{
+	octeon_mgmt_set_rx_irq(p, 0);
+}
+
+static inline void octeon_mgmt_enable_tx_irq(struct octeon_mgmt *p)
+{
+	octeon_mgmt_set_tx_irq(p, 1);
+}
+
+static inline void octeon_mgmt_disable_tx_irq(struct octeon_mgmt *p)
+{
+	octeon_mgmt_set_tx_irq(p, 0);
+}
+
+static unsigned int ring_max_fill(unsigned int ring_size)
+{
+	return ring_size - 8;
+}
+
+static unsigned int ring_size_to_bytes(unsigned int ring_size)
+{
+	return ring_size * sizeof(union mgmt_port_ring_entry);
+}
+
+static void octeon_mgmt_rx_fill_ring(struct net_device *netdev)
+{
+	struct octeon_mgmt *p = netdev_priv(netdev);
+	int port = p->port;
+
+	while (p->rx_current_fill < ring_max_fill(OCTEON_MGMT_RX_RING_SIZE)) {
+		unsigned int size;
+		union mgmt_port_ring_entry re;
+		struct sk_buff *skb;
+
+		/* CN56XX pass 1 needs 8 bytes of padding.  */
+		size = netdev->mtu + OCTEON_MGMT_RX_HEADROOM + 8 + NET_IP_ALIGN;
+
+		skb = netdev_alloc_skb(netdev, size);
+		if (!skb)
+			break;
+		skb_reserve(skb, NET_IP_ALIGN);
+		__skb_queue_tail(&p->rx_list, skb);
+
+		re.d64 = 0;
+		re.s.len = size;
+		re.s.addr = dma_map_single(p->dev, skb->data,
+					   size,
+					   DMA_FROM_DEVICE);
+
+		/* Put it in the ring.  */
+		p->rx_ring[p->rx_next_fill] = re.d64;
+		dma_sync_single_for_device(p->dev, p->rx_ring_handle,
+					   ring_size_to_bytes(OCTEON_MGMT_RX_RING_SIZE),
+					   DMA_BIDIRECTIONAL);
+		p->rx_next_fill =
+			(p->rx_next_fill + 1) % OCTEON_MGMT_RX_RING_SIZE;
+		p->rx_current_fill++;
+		/* Ring the bell.  */
+		cvmx_write_csr(CVMX_MIXX_IRING2(port), 1);
+	}
+}
+
+static void octeon_mgmt_clean_tx_buffers(struct octeon_mgmt *p)
+{
+	int port = p->port;
+	union cvmx_mixx_orcnt mix_orcnt;
+	union mgmt_port_ring_entry re;
+	struct sk_buff *skb;
+	int cleaned = 0;
+	unsigned long flags;
+
+	mix_orcnt.u64 = cvmx_read_csr(CVMX_MIXX_ORCNT(port));
+	while (mix_orcnt.s.orcnt) {
+		dma_sync_single_for_cpu(p->dev, p->tx_ring_handle,
+					ring_size_to_bytes(OCTEON_MGMT_TX_RING_SIZE),
+					DMA_BIDIRECTIONAL);
+
+		spin_lock_irqsave(&p->tx_list.lock, flags);
+
+		re.d64 = p->tx_ring[p->tx_next_clean];
+		p->tx_next_clean =
+			(p->tx_next_clean + 1) % OCTEON_MGMT_TX_RING_SIZE;
+		skb = __skb_dequeue(&p->tx_list);
+
+		mix_orcnt.u64 = 0;
+		mix_orcnt.s.orcnt = 1;
+
+		/* Acknowledge to hardware that we have the buffer.  */
+		cvmx_write_csr(CVMX_MIXX_ORCNT(port), mix_orcnt.u64);
+		p->tx_current_fill--;
+
+		spin_unlock_irqrestore(&p->tx_list.lock, flags);
+
+		dma_unmap_single(p->dev, re.s.addr, re.s.len,
+				 DMA_TO_DEVICE);
+		dev_kfree_skb_any(skb);
+		cleaned++;
+
+		mix_orcnt.u64 = cvmx_read_csr(CVMX_MIXX_ORCNT(port));
+	}
+
+	if (cleaned && netif_queue_stopped(p->netdev))
+		netif_wake_queue(p->netdev);
+}
+
+static void octeon_mgmt_clean_tx_tasklet(unsigned long arg)
+{
+	struct octeon_mgmt *p = (struct octeon_mgmt *)arg;
+	octeon_mgmt_clean_tx_buffers(p);
+	octeon_mgmt_enable_tx_irq(p);
+}
+
+static void octeon_mgmt_update_rx_stats(struct net_device *netdev)
+{
+	struct octeon_mgmt *p = netdev_priv(netdev);
+	int port = p->port;
+	unsigned long flags;
+	u64 drop, bad;
+
+	/* These reads also clear the count registers.  */
+	drop = cvmx_read_csr(CVMX_AGL_GMX_RXX_STATS_PKTS_DRP(port));
+	bad = cvmx_read_csr(CVMX_AGL_GMX_RXX_STATS_PKTS_BAD(port));
+
+	if (drop || bad) {
+		/* Do an atomic update. */
+		spin_lock_irqsave(&p->lock, flags);
+		netdev->stats.rx_errors += bad;
+		netdev->stats.rx_dropped += drop;
+		spin_unlock_irqrestore(&p->lock, flags);
+	}
+}
+
+static void octeon_mgmt_update_tx_stats(struct net_device *netdev)
+{
+	struct octeon_mgmt *p = netdev_priv(netdev);
+	int port = p->port;
+	unsigned long flags;
+
+	union cvmx_agl_gmx_txx_stat0 s0;
+	union cvmx_agl_gmx_txx_stat1 s1;
+
+	/* These reads also clear the count registers.  */
+	s0.u64 = cvmx_read_csr(CVMX_AGL_GMX_TXX_STAT0(port));
+	s1.u64 = cvmx_read_csr(CVMX_AGL_GMX_TXX_STAT1(port));
+
+	if (s0.s.xsdef || s0.s.xscol || s1.s.scol || s1.s.mcol) {
+		/* Do an atomic update. */
+		spin_lock_irqsave(&p->lock, flags);
+		netdev->stats.tx_errors += s0.s.xsdef + s0.s.xscol;
+		netdev->stats.collisions += s1.s.scol + s1.s.mcol;
+		spin_unlock_irqrestore(&p->lock, flags);
+	}
+}
+
+/*
+ * Dequeue a receive skb and its corresponding ring entry.  The ring
+ * entry is returned, *pskb is updated to point to the skb.
+ */
+static u64 octeon_mgmt_dequeue_rx_buffer(struct octeon_mgmt *p,
+					 struct sk_buff **pskb)
+{
+	union mgmt_port_ring_entry re;
+
+	dma_sync_single_for_cpu(p->dev, p->rx_ring_handle,
+				ring_size_to_bytes(OCTEON_MGMT_RX_RING_SIZE),
+				DMA_BIDIRECTIONAL);
+
+	re.d64 = p->rx_ring[p->rx_next];
+	p->rx_next = (p->rx_next + 1) % OCTEON_MGMT_RX_RING_SIZE;
+	p->rx_current_fill--;
+	*pskb = __skb_dequeue(&p->rx_list);
+
+	dma_unmap_single(p->dev, re.s.addr,
+			 ETH_FRAME_LEN + OCTEON_MGMT_RX_HEADROOM,
+			 DMA_FROM_DEVICE);
+
+	return re.d64;
+}
+
+
+static int octeon_mgmt_receive_one(struct octeon_mgmt *p)
+{
+	int port = p->port;
+	struct net_device *netdev = p->netdev;
+	union cvmx_mixx_ircnt mix_ircnt;
+	union mgmt_port_ring_entry re;
+	struct sk_buff *skb;
+	struct sk_buff *skb2;
+	struct sk_buff *skb_new;
+	union mgmt_port_ring_entry re2;
+	int rc = 1;
+
+
+	re.d64 = octeon_mgmt_dequeue_rx_buffer(p, &skb);
+	if (likely(re.s.code == RING_ENTRY_CODE_DONE)) {
+		/* A good packet, send it up. */
+		skb_put(skb, re.s.len);
+good:
+		skb->protocol = eth_type_trans(skb, netdev);
+		netdev->stats.rx_packets++;
+		netdev->stats.rx_bytes += skb->len;
+		netdev->last_rx = jiffies;
+		netif_receive_skb(skb);
+		rc = 0;
+	} else if (re.s.code == RING_ENTRY_CODE_MORE) {
+		/*
+		 * Packet split across skbs.  This can happen if we
+		 * increase the MTU.  Buffers that are already in the
+		 * rx ring can then end up being too small.  As the rx
+		 * ring is refilled, buffers sized for the new MTU
+		 * will be used and we should go back to the normal
+		 * non-split case.
+		 */
+		skb_put(skb, re.s.len);
+		do {
+			re2.d64 = octeon_mgmt_dequeue_rx_buffer(p, &skb2);
+			if (re2.s.code != RING_ENTRY_CODE_MORE
+				&& re2.s.code != RING_ENTRY_CODE_DONE)
+				goto split_error;
+			skb_put(skb2,  re2.s.len);
+			skb_new = skb_copy_expand(skb, 0, skb2->len,
+						  GFP_ATOMIC);
+			if (!skb_new)
+				goto split_error;
+			if (skb_copy_bits(skb2, 0, skb_tail_pointer(skb_new),
+					  skb2->len))
+				goto split_error;
+			skb_put(skb_new, skb2->len);
+			dev_kfree_skb_any(skb);
+			dev_kfree_skb_any(skb2);
+			skb = skb_new;
+		} while (re2.s.code == RING_ENTRY_CODE_MORE);
+		goto good;
+	} else {
+		/* Some other error, discard it. */
+		dev_kfree_skb_any(skb);
+		/*
+		 * Error statistics are accumulated in
+		 * octeon_mgmt_update_rx_stats.
+		 */
+	}
+	goto done;
+split_error:
+	/* Discard the whole mess. */
+	dev_kfree_skb_any(skb);
+	dev_kfree_skb_any(skb2);
+	while (re2.s.code == RING_ENTRY_CODE_MORE) {
+		re2.d64 = octeon_mgmt_dequeue_rx_buffer(p, &skb2);
+		dev_kfree_skb_any(skb2);
+	}
+	netdev->stats.rx_errors++;
+
+done:
+	/* Tell the hardware we processed a packet.  */
+	mix_ircnt.u64 = 0;
+	mix_ircnt.s.ircnt = 1;
+	cvmx_write_csr(CVMX_MIXX_IRCNT(port), mix_ircnt.u64);
+	return rc;
+
+}
+
+static int octeon_mgmt_receive_packets(struct octeon_mgmt *p, int budget)
+{
+	int port = p->port;
+	unsigned int work_done = 0;
+	union cvmx_mixx_ircnt mix_ircnt;
+	int rc;
+
+
+	mix_ircnt.u64 = cvmx_read_csr(CVMX_MIXX_IRCNT(port));
+	while (work_done < budget && mix_ircnt.s.ircnt) {
+
+		rc = octeon_mgmt_receive_one(p);
+		if (!rc)
+			work_done++;
+
+		/* Check for more packets. */
+		mix_ircnt.u64 = cvmx_read_csr(CVMX_MIXX_IRCNT(port));
+	}
+
+	octeon_mgmt_rx_fill_ring(p->netdev);
+
+	return work_done;
+}
+
+static int octeon_mgmt_napi_poll(struct napi_struct *napi, int budget)
+{
+	struct octeon_mgmt *p = container_of(napi, struct octeon_mgmt, napi);
+	struct net_device *netdev = p->netdev;
+	unsigned int work_done = 0;
+
+	work_done = octeon_mgmt_receive_packets(p, budget);
+
+	if (work_done < budget) {
+		/* We stopped because no more packets were available. */
+		napi_complete(napi);
+		octeon_mgmt_enable_rx_irq(p);
+	}
+	octeon_mgmt_update_rx_stats(netdev);
+
+	return work_done;
+}
+
+/* Reset the hardware to clean state.  */
+static void octeon_mgmt_reset_hw(struct octeon_mgmt *p)
+{
+	union cvmx_mixx_ctl mix_ctl;
+	union cvmx_mixx_bist mix_bist;
+	union cvmx_agl_gmx_bist agl_gmx_bist;
+
+	mix_ctl.u64 = 0;
+	cvmx_write_csr(CVMX_MIXX_CTL(p->port), mix_ctl.u64);
+	do {
+		mix_ctl.u64 = cvmx_read_csr(CVMX_MIXX_CTL(p->port));
+	} while (mix_ctl.s.busy);
+	mix_ctl.s.reset = 1;
+	cvmx_write_csr(CVMX_MIXX_CTL(p->port), mix_ctl.u64);
+	cvmx_read_csr(CVMX_MIXX_CTL(p->port));
+	cvmx_wait(64);
+
+	mix_bist.u64 = cvmx_read_csr(CVMX_MIXX_BIST(p->port));
+	if (mix_bist.u64)
+		dev_warn(p->dev, "MIX failed BIST (0x%016llx)\n",
+			(unsigned long long)mix_bist.u64);
+
+	agl_gmx_bist.u64 = cvmx_read_csr(CVMX_AGL_GMX_BIST);
+	if (agl_gmx_bist.u64)
+		dev_warn(p->dev, "AGL failed BIST (0x%016llx)\n",
+			 (unsigned long long)agl_gmx_bist.u64);
+}
+
+struct octeon_mgmt_cam_state {
+	u64 cam[6];
+	u64 cam_mask;
+	int cam_index;
+};
+
+static void octeon_mgmt_cam_state_add(struct octeon_mgmt_cam_state *cs,
+				      unsigned char *addr)
+{
+	int i;
+
+	for (i = 0; i < 6; i++)
+		cs->cam[i] |= (u64)addr[i] << (8 * (cs->cam_index));
+	cs->cam_mask |= (1ULL << cs->cam_index);
+	cs->cam_index++;
+}
+
+static void octeon_mgmt_set_rx_filtering(struct net_device *netdev)
+{
+	struct octeon_mgmt *p = netdev_priv(netdev);
+	int port = p->port;
+	int i;
+	union cvmx_agl_gmx_rxx_adr_ctl adr_ctl;
+	union cvmx_agl_gmx_prtx_cfg agl_gmx_prtx;
+	unsigned long flags;
+	unsigned int prev_packet_enable;
+	unsigned int cam_mode = 1; /* 1 - Accept on CAM match */
+	unsigned int multicast_mode = 1; /* 1 - Reject all multicast.  */
+	struct octeon_mgmt_cam_state cam_state;
+	struct dev_addr_list *list;
+	struct list_head *pos;
+	int available_cam_entries;
+
+	memset(&cam_state, 0, sizeof(cam_state));
+
+	if ((netdev->flags & IFF_PROMISC) || netdev->dev_addrs.count > 7) {
+		cam_mode = 0;
+		available_cam_entries = 8;
+	} else {
+		/*
+		 * One CAM entry for the primary address, leaves seven
+		 * for the secondary addresses.
+		 */
+		available_cam_entries = 7 - netdev->dev_addrs.count;
+	}
+
+	if (netdev->flags & IFF_MULTICAST) {
+		if (cam_mode == 0 || (netdev->flags & IFF_ALLMULTI)
+		    || netdev->mc_count  > available_cam_entries)
+			multicast_mode = 2; /* 1 - Accept all multicast.  */
+		else
+			multicast_mode = 0; /* 0 - Use CAM.  */
+	}
+
+	if (cam_mode == 1) {
+		/* Add primary address. */
+		octeon_mgmt_cam_state_add(&cam_state, netdev->dev_addr);
+		list_for_each(pos, &netdev->dev_addrs.list) {
+			struct netdev_hw_addr *hw_addr;
+			hw_addr = list_entry(pos, struct netdev_hw_addr, list);
+			octeon_mgmt_cam_state_add(&cam_state, hw_addr->addr);
+			list = list->next;
+		}
+	}
+	if (multicast_mode == 0) {
+		i = netdev->mc_count;
+		list = netdev->mc_list;
+		while (i--) {
+			octeon_mgmt_cam_state_add(&cam_state, list->da_addr);
+			list = list->next;
+		}
+	}
+
+
+	spin_lock_irqsave(&p->lock, flags);
+
+	/* Disable packet I/O. */
+	agl_gmx_prtx.u64 = cvmx_read_csr(CVMX_AGL_GMX_PRTX_CFG(port));
+	prev_packet_enable = agl_gmx_prtx.s.en;
+	agl_gmx_prtx.s.en = 0;
+	cvmx_write_csr(CVMX_AGL_GMX_PRTX_CFG(port), agl_gmx_prtx.u64);
+
+
+	adr_ctl.u64 = 0;
+	adr_ctl.s.cam_mode = cam_mode;
+	adr_ctl.s.mcst = multicast_mode;
+	adr_ctl.s.bcst = 1;     /* Allow broadcast */
+
+	cvmx_write_csr(CVMX_AGL_GMX_RXX_ADR_CTL(port), adr_ctl.u64);
+
+	cvmx_write_csr(CVMX_AGL_GMX_RXX_ADR_CAM0(port), cam_state.cam[0]);
+	cvmx_write_csr(CVMX_AGL_GMX_RXX_ADR_CAM1(port), cam_state.cam[1]);
+	cvmx_write_csr(CVMX_AGL_GMX_RXX_ADR_CAM2(port), cam_state.cam[2]);
+	cvmx_write_csr(CVMX_AGL_GMX_RXX_ADR_CAM3(port), cam_state.cam[3]);
+	cvmx_write_csr(CVMX_AGL_GMX_RXX_ADR_CAM4(port), cam_state.cam[4]);
+	cvmx_write_csr(CVMX_AGL_GMX_RXX_ADR_CAM5(port), cam_state.cam[5]);
+	cvmx_write_csr(CVMX_AGL_GMX_RXX_ADR_CAM_EN(port), cam_state.cam_mask);
+
+	/* Restore packet I/O. */
+	agl_gmx_prtx.s.en = prev_packet_enable;
+	cvmx_write_csr(CVMX_AGL_GMX_PRTX_CFG(port), agl_gmx_prtx.u64);
+
+	spin_unlock_irqrestore(&p->lock, flags);
+}
+
+static int octeon_mgmt_set_mac_address(struct net_device *netdev, void *addr)
+{
+	struct sockaddr *sa = addr;
+
+	if (!is_valid_ether_addr(sa->sa_data))
+		return -EADDRNOTAVAIL;
+
+	memcpy(netdev->dev_addr, sa->sa_data, ETH_ALEN);
+
+	octeon_mgmt_set_rx_filtering(netdev);
+
+	return 0;
+}
+
+static int octeon_mgmt_change_mtu(struct net_device *netdev, int new_mtu)
+{
+	struct octeon_mgmt *p = netdev_priv(netdev);
+	int port = p->port;
+	int size_without_fcs = new_mtu + OCTEON_MGMT_RX_HEADROOM;
+
+	/*
+	 * Limit the MTU to make sure the ethernet packets are between
+	 * 64 bytes and 16383 bytes.
+	 */
+	if (size_without_fcs < 64 || size_without_fcs > 16383) {
+		dev_warn(p->dev, "MTU must be between %d and %d.\n",
+			 64 - OCTEON_MGMT_RX_HEADROOM,
+			 16383 - OCTEON_MGMT_RX_HEADROOM);
+		return -EINVAL;
+	}
+
+	netdev->mtu = new_mtu;
+
+	cvmx_write_csr(CVMX_AGL_GMX_RXX_FRM_MAX(port), size_without_fcs);
+	cvmx_write_csr(CVMX_AGL_GMX_RXX_JABBER(port),
+		       (size_without_fcs + 7) & 0xfff8);
+
+	return 0;
+}
+
+static irqreturn_t octeon_mgmt_interrupt(int cpl, void *dev_id)
+{
+	struct net_device *netdev = dev_id;
+	struct octeon_mgmt *p = netdev_priv(netdev);
+	int port = p->port;
+	union cvmx_mixx_isr mixx_isr;
+
+	mixx_isr.u64 = cvmx_read_csr(CVMX_MIXX_ISR(port));
+
+	/* Clear any pending interrupts */
+	cvmx_write_csr(CVMX_MIXX_ISR(port),
+		       cvmx_read_csr(CVMX_MIXX_ISR(port)));
+	cvmx_read_csr(CVMX_MIXX_ISR(port));
+
+	if (mixx_isr.s.irthresh) {
+		octeon_mgmt_disable_rx_irq(p);
+		napi_schedule(&p->napi);
+	}
+	if (mixx_isr.s.orthresh) {
+		octeon_mgmt_disable_tx_irq(p);
+		tasklet_schedule(&p->tx_clean_tasklet);
+	}
+
+	return IRQ_HANDLED;
+}
+
+static int octeon_mgmt_ioctl(struct net_device *netdev,
+			     struct ifreq *rq, int cmd)
+{
+	struct octeon_mgmt *p = netdev_priv(netdev);
+
+	if (!netif_running(netdev))
+		return -EINVAL;
+
+	if (!p->phydev)
+		return -EINVAL;
+
+	return phy_mii_ioctl(p->phydev, if_mii(rq), cmd);
+}
+
+static void octeon_mgmt_adjust_link(struct net_device *netdev)
+{
+	struct octeon_mgmt *p = netdev_priv(netdev);
+	int port = p->port;
+	union cvmx_agl_gmx_prtx_cfg prtx_cfg;
+	unsigned long flags;
+	int link_changed = 0;
+
+	spin_lock_irqsave(&p->lock, flags);
+	if (p->phydev->link) {
+		if (!p->last_link)
+			link_changed = 1;
+		if (p->last_duplex != p->phydev->duplex) {
+			p->last_duplex = p->phydev->duplex;
+			prtx_cfg.u64 =
+				cvmx_read_csr(CVMX_AGL_GMX_PRTX_CFG(port));
+			prtx_cfg.s.duplex = p->phydev->duplex;
+			cvmx_write_csr(CVMX_AGL_GMX_PRTX_CFG(port),
+				       prtx_cfg.u64);
+		}
+	} else {
+		if (p->last_link)
+			link_changed = -1;
+	}
+	p->last_link = p->phydev->link;
+	spin_unlock_irqrestore(&p->lock, flags);
+
+	if (link_changed != 0) {
+		if (link_changed > 0) {
+			netif_carrier_on(netdev);
+			pr_info("%s: Link is up - %d/%s\n", netdev->name,
+				p->phydev->speed,
+				DUPLEX_FULL == p->phydev->duplex ?
+				"Full" : "Half");
+		} else {
+			netif_carrier_off(netdev);
+			pr_info("%s: Link is down\n", netdev->name);
+		}
+	}
+}
+
+static int octeon_mgmt_init_phy(struct net_device *netdev)
+{
+	struct octeon_mgmt *p = netdev_priv(netdev);
+	char phy_id[20];
+
+	if (octeon_is_simulation()) {
+		/* No PHYs in the simulator. */
+		netif_carrier_on(netdev);
+		return 0;
+	}
+
+	snprintf(phy_id, sizeof(phy_id), PHY_ID_FMT, "0", p->port);
+
+	p->phydev = phy_connect(netdev, phy_id, octeon_mgmt_adjust_link, 0,
+				PHY_INTERFACE_MODE_MII);
+
+	if (IS_ERR(p->phydev)) {
+		p->phydev = NULL;
+		return -1;
+	}
+
+	phy_start_aneg(p->phydev);
+
+	return 0;
+}
+
+static int octeon_mgmt_open(struct net_device *netdev)
+{
+	struct octeon_mgmt *p = netdev_priv(netdev);
+	int port = p->port;
+	union cvmx_mixx_ctl mix_ctl;
+	union cvmx_agl_gmx_inf_mode agl_gmx_inf_mode;
+	union cvmx_mixx_oring1 oring1;
+	union cvmx_mixx_iring1 iring1;
+	union cvmx_agl_gmx_prtx_cfg prtx_cfg;
+	union cvmx_agl_gmx_rxx_frm_ctl rxx_frm_ctl;
+	union cvmx_mixx_irhwm mix_irhwm;
+	union cvmx_mixx_orhwm mix_orhwm;
+	union cvmx_mixx_intena mix_intena;
+	struct sockaddr sa;
+
+	/* Allocate ring buffers.  */
+	p->tx_ring = kzalloc(ring_size_to_bytes(OCTEON_MGMT_TX_RING_SIZE),
+			     GFP_KERNEL);
+	if (!p->tx_ring)
+		return -ENOMEM;
+	p->tx_ring_handle =
+		dma_map_single(p->dev, p->tx_ring,
+			       ring_size_to_bytes(OCTEON_MGMT_TX_RING_SIZE),
+			       DMA_BIDIRECTIONAL);
+	p->tx_next = 0;
+	p->tx_next_clean = 0;
+	p->tx_current_fill = 0;
+
+
+	p->rx_ring = kzalloc(ring_size_to_bytes(OCTEON_MGMT_RX_RING_SIZE),
+			     GFP_KERNEL);
+	if (!p->rx_ring)
+		goto err_nomem;
+	p->rx_ring_handle =
+		dma_map_single(p->dev, p->rx_ring,
+			       ring_size_to_bytes(OCTEON_MGMT_RX_RING_SIZE),
+			       DMA_BIDIRECTIONAL);
+
+	p->rx_next = 0;
+	p->rx_next_fill = 0;
+	p->rx_current_fill = 0;
+
+	octeon_mgmt_reset_hw(p);
+
+	mix_ctl.u64 = cvmx_read_csr(CVMX_MIXX_CTL(port));
+
+	/* Bring it out of reset if needed. */
+	if (mix_ctl.s.reset) {
+		mix_ctl.s.reset = 0;
+		cvmx_write_csr(CVMX_MIXX_CTL(port), mix_ctl.u64);
+		do {
+			mix_ctl.u64 = cvmx_read_csr(CVMX_MIXX_CTL(port));
+		} while (mix_ctl.s.reset);
+	}
+
+	agl_gmx_inf_mode.u64 = 0;
+	agl_gmx_inf_mode.s.en = 1;
+	cvmx_write_csr(CVMX_AGL_GMX_INF_MODE, agl_gmx_inf_mode.u64);
+
+	oring1.u64 = 0;
+	oring1.s.obase = p->tx_ring_handle >> 3;
+	oring1.s.osize = OCTEON_MGMT_TX_RING_SIZE;
+	cvmx_write_csr(CVMX_MIXX_ORING1(port), oring1.u64);
+
+	iring1.u64 = 0;
+	iring1.s.ibase = p->rx_ring_handle >> 3;
+	iring1.s.isize = OCTEON_MGMT_RX_RING_SIZE;
+	cvmx_write_csr(CVMX_MIXX_IRING1(port), iring1.u64);
+
+	/* Disable packet I/O. */
+	prtx_cfg.u64 = cvmx_read_csr(CVMX_AGL_GMX_PRTX_CFG(port));
+	prtx_cfg.s.en = 0;
+	cvmx_write_csr(CVMX_AGL_GMX_PRTX_CFG(port), prtx_cfg.u64);
+
+	memcpy(sa.sa_data, netdev->dev_addr, ETH_ALEN);
+	octeon_mgmt_set_mac_address(netdev, &sa);
+
+	octeon_mgmt_change_mtu(netdev, netdev->mtu);
+
+	/*
+	 * Enable the port HW. Packets are not allowed until
+	 * cvmx_mgmt_port_enable() is called.
+	 */
+	mix_ctl.u64 = 0;
+	mix_ctl.s.crc_strip = 1;    /* Strip the ending CRC */
+	mix_ctl.s.en = 1;           /* Enable the port */
+	mix_ctl.s.nbtarb = 0;       /* Arbitration mode */
+	/* MII CB-request FIFO programmable high watermark */
+	mix_ctl.s.mrq_hwm = 1;
+	cvmx_write_csr(CVMX_MIXX_CTL(port), mix_ctl.u64);
+
+	if (OCTEON_IS_MODEL(OCTEON_CN56XX_PASS1_X)
+	    || OCTEON_IS_MODEL(OCTEON_CN52XX_PASS1_X)) {
+		/*
+		 * Force compensation values, as they are not
+		 * determined properly by HW
+		 */
+		union cvmx_agl_gmx_drv_ctl drv_ctl;
+
+		drv_ctl.u64 = cvmx_read_csr(CVMX_AGL_GMX_DRV_CTL);
+		if (port) {
+			drv_ctl.s.byp_en1 = 1;
+			drv_ctl.s.nctl1 = 6;
+			drv_ctl.s.pctl1 = 6;
+		} else {
+			drv_ctl.s.byp_en = 1;
+			drv_ctl.s.nctl = 6;
+			drv_ctl.s.pctl = 6;
+		}
+		cvmx_write_csr(CVMX_AGL_GMX_DRV_CTL, drv_ctl.u64);
+	}
+
+	octeon_mgmt_rx_fill_ring(netdev);
+
+	/* Clear statistics. */
+	/* Clear on read. */
+	cvmx_write_csr(CVMX_AGL_GMX_RXX_STATS_CTL(port), 1);
+	cvmx_write_csr(CVMX_AGL_GMX_RXX_STATS_PKTS_DRP(port), 0);
+	cvmx_write_csr(CVMX_AGL_GMX_RXX_STATS_PKTS_BAD(port), 0);
+
+	cvmx_write_csr(CVMX_AGL_GMX_TXX_STATS_CTL(port), 1);
+	cvmx_write_csr(CVMX_AGL_GMX_TXX_STAT0(port), 0);
+	cvmx_write_csr(CVMX_AGL_GMX_TXX_STAT1(port), 0);
+
+	/* Clear any pending interrupts */
+	cvmx_write_csr(CVMX_MIXX_ISR(port), cvmx_read_csr(CVMX_MIXX_ISR(port)));
+
+	if (request_irq(p->irq, octeon_mgmt_interrupt, 0, netdev->name,
+			netdev)) {
+		dev_err(p->dev, "request_irq(%d) failed.\n", p->irq);
+		goto err_noirq;
+	}
+
+	/* Interrupt every single RX packet */
+	mix_irhwm.u64 = 0;
+	mix_irhwm.s.irhwm = 0;
+	cvmx_write_csr(CVMX_MIXX_IRHWM(port), mix_irhwm.u64);
+
+	/* Interrupt when we have 5 or more packets to clean.  */
+	mix_orhwm.u64 = 0;
+	mix_orhwm.s.orhwm = 5;
+	cvmx_write_csr(CVMX_MIXX_ORHWM(port), mix_orhwm.u64);
+
+	/* Enable receive and transmit interrupts */
+	mix_intena.u64 = 0;
+	mix_intena.s.ithena = 1;
+	mix_intena.s.othena = 1;
+	cvmx_write_csr(CVMX_MIXX_INTENA(port), mix_intena.u64);
+
+
+	/* Enable packet I/O. */
+
+	rxx_frm_ctl.u64 = 0;
+	rxx_frm_ctl.s.pre_align = 1;
+	/*
+	 * When set, disables the length check for non-min sized pkts
+	 * with padding in the client data.
+	 */
+	rxx_frm_ctl.s.pad_len = 1;
+	/* When set, disables the length check for VLAN pkts */
+	rxx_frm_ctl.s.vlan_len = 1;
+	/* When set, PREAMBLE checking is  less strict */
+	rxx_frm_ctl.s.pre_free = 1;
+	/* Control Pause Frames can match station SMAC */
+	rxx_frm_ctl.s.ctl_smac = 0;
+	/* Control Pause Frames can match globally assign Multicast address */
+	rxx_frm_ctl.s.ctl_mcst = 1;
+	/* Forward pause information to TX block */
+	rxx_frm_ctl.s.ctl_bck = 1;
+	/* Drop Control Pause Frames */
+	rxx_frm_ctl.s.ctl_drp = 1;
+	/* Strip off the preamble */
+	rxx_frm_ctl.s.pre_strp = 1;
+	/*
+	 * This port is configured to send PREAMBLE+SFD to begin every
+	 * frame.  GMX checks that the PREAMBLE is sent correctly.
+	 */
+	rxx_frm_ctl.s.pre_chk = 1;
+	cvmx_write_csr(CVMX_AGL_GMX_RXX_FRM_CTL(port), rxx_frm_ctl.u64);
+
+	/* Enable the AGL block */
+	agl_gmx_inf_mode.u64 = 0;
+	agl_gmx_inf_mode.s.en = 1;
+	cvmx_write_csr(CVMX_AGL_GMX_INF_MODE, agl_gmx_inf_mode.u64);
+
+	/* Configure the port duplex and enables */
+	prtx_cfg.u64 = cvmx_read_csr(CVMX_AGL_GMX_PRTX_CFG(port));
+	prtx_cfg.s.tx_en = 1;
+	prtx_cfg.s.rx_en = 1;
+	prtx_cfg.s.en = 1;
+	p->last_duplex = 1;
+	prtx_cfg.s.duplex = p->last_duplex;
+	cvmx_write_csr(CVMX_AGL_GMX_PRTX_CFG(port), prtx_cfg.u64);
+
+	p->last_link = 0;
+	netif_carrier_off(netdev);
+
+	if (octeon_mgmt_init_phy(netdev)) {
+		dev_err(p->dev, "Cannot initialize PHY.\n");
+		goto err_noirq;
+	}
+
+	netif_wake_queue(netdev);
+	napi_enable(&p->napi);
+
+	return 0;
+err_noirq:
+	octeon_mgmt_reset_hw(p);
+	dma_unmap_single(p->dev, p->rx_ring_handle,
+			 ring_size_to_bytes(OCTEON_MGMT_RX_RING_SIZE),
+			 DMA_BIDIRECTIONAL);
+	kfree(p->rx_ring);
+err_nomem:
+	dma_unmap_single(p->dev, p->tx_ring_handle,
+			 ring_size_to_bytes(OCTEON_MGMT_TX_RING_SIZE),
+			 DMA_BIDIRECTIONAL);
+	kfree(p->tx_ring);
+	return -ENOMEM;
+}
+
+static int octeon_mgmt_stop(struct net_device *netdev)
+{
+	struct octeon_mgmt *p = netdev_priv(netdev);
+
+	napi_disable(&p->napi);
+	netif_stop_queue(netdev);
+
+	if (p->phydev)
+		phy_disconnect(p->phydev);
+
+	netif_carrier_off(netdev);
+
+	octeon_mgmt_reset_hw(p);
+
+
+	free_irq(p->irq, netdev);
+
+	/* dma_unmap is a nop on Octeon, so just free everything.  */
+	skb_queue_purge(&p->tx_list);
+	skb_queue_purge(&p->rx_list);
+
+	dma_unmap_single(p->dev, p->rx_ring_handle,
+			 ring_size_to_bytes(OCTEON_MGMT_RX_RING_SIZE),
+			 DMA_BIDIRECTIONAL);
+	kfree(p->rx_ring);
+
+	dma_unmap_single(p->dev, p->tx_ring_handle,
+			 ring_size_to_bytes(OCTEON_MGMT_TX_RING_SIZE),
+			 DMA_BIDIRECTIONAL);
+	kfree(p->tx_ring);
+
+
+	return 0;
+}
+
+static int octeon_mgmt_xmit(struct sk_buff *skb, struct net_device *netdev)
+{
+	struct octeon_mgmt *p = netdev_priv(netdev);
+	int port = p->port;
+	union mgmt_port_ring_entry re;
+	unsigned long flags;
+
+	re.d64 = 0;
+	re.s.len = skb->len;
+	re.s.addr = dma_map_single(p->dev, skb->data,
+				   skb->len,
+				   DMA_TO_DEVICE);
+
+	spin_lock_irqsave(&p->tx_list.lock, flags);
+
+	if (unlikely(p->tx_current_fill >=
+		     ring_max_fill(OCTEON_MGMT_TX_RING_SIZE))) {
+		spin_unlock_irqrestore(&p->tx_list.lock, flags);
+
+		dma_unmap_single(p->dev, re.s.addr, re.s.len,
+				 DMA_TO_DEVICE);
+
+		netif_stop_queue(netdev);
+		return NETDEV_TX_BUSY;
+	}
+
+	__skb_queue_tail(&p->tx_list, skb);
+
+	/* Put it in the ring.  */
+	p->tx_ring[p->tx_next] = re.d64;
+	p->tx_next = (p->tx_next + 1) % OCTEON_MGMT_TX_RING_SIZE;
+	p->tx_current_fill++;
+
+	spin_unlock_irqrestore(&p->tx_list.lock, flags);
+
+	dma_sync_single_for_device(p->dev, p->tx_ring_handle,
+				   ring_size_to_bytes(OCTEON_MGMT_TX_RING_SIZE),
+				   DMA_BIDIRECTIONAL);
+
+	netdev->stats.tx_packets++;
+	netdev->stats.tx_bytes += skb->len;
+
+	/* Ring the bell.  */
+	cvmx_write_csr(CVMX_MIXX_ORING2(port), 1);
+
+	netdev->trans_start = jiffies;
+	octeon_mgmt_clean_tx_buffers(p);
+	octeon_mgmt_update_tx_stats(netdev);
+	return NETDEV_TX_OK;
+}
+
+#ifdef CONFIG_NET_POLL_CONTROLLER
+static void octeon_mgmt_poll_controller(struct net_device *netdev)
+{
+	struct octeon_mgmt *p = netdev_priv(netdev);
+
+	octeon_mgmt_receive_packets(p, 16);
+	octeon_mgmt_update_rx_stats(netdev);
+	return;
+}
+#endif
+
+static void octeon_mgmt_get_drvinfo(struct net_device *netdev,
+				    struct ethtool_drvinfo *info)
+{
+	strncpy(info->driver, DRV_NAME, sizeof(info->driver));
+	strncpy(info->version, DRV_VERSION, sizeof(info->version));
+	strncpy(info->fw_version, "N/A", sizeof(info->fw_version));
+	strncpy(info->bus_info, "N/A", sizeof(info->bus_info));
+	info->n_stats = 0;
+	info->testinfo_len = 0;
+	info->regdump_len = 0;
+	info->eedump_len = 0;
+}
+
+static int octeon_mgmt_get_settings(struct net_device *netdev,
+				    struct ethtool_cmd *cmd)
+{
+	struct octeon_mgmt *p = netdev_priv(netdev);
+
+	if (p->phydev)
+		return phy_ethtool_gset(p->phydev, cmd);
+
+	return -EINVAL;
+}
+
+static int octeon_mgmt_set_settings(struct net_device *netdev,
+				    struct ethtool_cmd *cmd)
+{
+	struct octeon_mgmt *p = netdev_priv(netdev);
+
+	if (!capable(CAP_NET_ADMIN))
+		return -EPERM;
+
+	if (p->phydev)
+		return phy_ethtool_sset(p->phydev, cmd);
+
+	return -EINVAL;
+}
+
+static const struct ethtool_ops octeon_mgmt_ethtool_ops = {
+	.get_drvinfo = octeon_mgmt_get_drvinfo,
+	.get_link = ethtool_op_get_link,
+	.get_settings = octeon_mgmt_get_settings,
+	.set_settings = octeon_mgmt_set_settings
+};
+
+static const struct net_device_ops octeon_mgmt_ops = {
+	.ndo_open =			octeon_mgmt_open,
+	.ndo_stop =			octeon_mgmt_stop,
+	.ndo_start_xmit =		octeon_mgmt_xmit,
+	.ndo_set_rx_mode = 		octeon_mgmt_set_rx_filtering,
+	.ndo_set_multicast_list =	octeon_mgmt_set_rx_filtering,
+	.ndo_set_mac_address =		octeon_mgmt_set_mac_address,
+	.ndo_do_ioctl = 		octeon_mgmt_ioctl,
+	.ndo_change_mtu =		octeon_mgmt_change_mtu,
+#ifdef CONFIG_NET_POLL_CONTROLLER
+	.ndo_poll_controller =		octeon_mgmt_poll_controller,
+#endif
+};
+
+static int __init octeon_mgmt_probe(struct platform_device *pdev)
+{
+	struct resource *res_irq;
+	struct net_device *netdev;
+	struct octeon_mgmt *p;
+	int i;
+
+	netdev = alloc_etherdev(sizeof(struct octeon_mgmt));
+	if (netdev == NULL)
+		return -ENOMEM;
+
+	dev_set_drvdata(&pdev->dev, netdev);
+	p = netdev_priv(netdev);
+	netif_napi_add(netdev, &p->napi, octeon_mgmt_napi_poll,
+		       OCTEON_MGMT_NAPI_WEIGHT);
+
+	p->netdev = netdev;
+	p->dev = &pdev->dev;
+
+	p->port = pdev->id;
+	snprintf(netdev->name, IFNAMSIZ, "mgmt%d", p->port);
+
+	res_irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+	if (!res_irq)
+		goto err;
+
+	p->irq = res_irq->start;
+	spin_lock_init(&p->lock);
+
+	skb_queue_head_init(&p->tx_list);
+	skb_queue_head_init(&p->rx_list);
+	tasklet_init(&p->tx_clean_tasklet,
+		     octeon_mgmt_clean_tx_tasklet, (unsigned long)p);
+
+	netdev->netdev_ops = &octeon_mgmt_ops;
+	netdev->ethtool_ops = &octeon_mgmt_ethtool_ops;
+
+
+	/* The mgmt ports get the first N MACs.  */
+	for (i = 0; i < 6; i++)
+		netdev->dev_addr[i] = octeon_bootinfo->mac_addr_base[i];
+	netdev->dev_addr[5] += p->port;
+
+	if (p->port >= octeon_bootinfo->mac_addr_count)
+		dev_err(&pdev->dev,
+			"Error %s: Using MAC outside of the assigned range: "
+			"%02x:%02x:%02x:%02x:%02x:%02x\n", netdev->name,
+			netdev->dev_addr[0], netdev->dev_addr[1],
+			netdev->dev_addr[2], netdev->dev_addr[3],
+			netdev->dev_addr[4], netdev->dev_addr[5]);
+
+	if (register_netdev(netdev))
+		goto err;
+
+	dev_info(&pdev->dev, "Version " DRV_VERSION "\n");
+	return 0;
+err:
+	free_netdev(netdev);
+	return -ENOENT;
+}
+
+static int __exit octeon_mgmt_remove(struct platform_device *pdev)
+{
+	struct net_device *netdev = dev_get_drvdata(&pdev->dev);
+
+	unregister_netdev(netdev);
+	free_netdev(netdev);
+	return 0;
+}
+
+static struct platform_driver octeon_mgmt_driver = {
+	.driver = {
+		.name		= "octeon_mgmt",
+		.owner		= THIS_MODULE,
+	},
+	.probe		= octeon_mgmt_probe,
+	.remove		= __exit_p(octeon_mgmt_remove),
+};
+
+extern void octeon_mdiobus_force_mod_depencency(void);
+
+static int __init octeon_mgmt_mod_init(void)
+{
+	/* Force our mdiobus driver module to be loaded first. */
+	octeon_mdiobus_force_mod_depencency();
+	return platform_driver_register(&octeon_mgmt_driver);
+}
+
+static void __exit octeon_mgmt_mod_exit(void)
+{
+	platform_driver_unregister(&octeon_mgmt_driver);
+}
+
+module_init(octeon_mgmt_mod_init);
+module_exit(octeon_mgmt_mod_exit);
+
+MODULE_DESCRIPTION(DRV_DESCRIPTION);
+MODULE_AUTHOR("David Daney");
+MODULE_LICENSE("GPL");
+MODULE_VERSION(DRV_VERSION);
diff --git a/drivers/net/pcmcia/3c574_cs.c b/drivers/net/pcmcia/3c574_cs.c
index 17a27225cc98..98938ea9e0bd 100644
--- a/drivers/net/pcmcia/3c574_cs.c
+++ b/drivers/net/pcmcia/3c574_cs.c
@@ -912,7 +912,11 @@ static void media_check(unsigned long arg)
 	if ((inw(ioaddr + EL3_STATUS) & IntLatch) && (inb(ioaddr + Timer) == 0xff)) {
 		if (!lp->fast_poll)
 			printk(KERN_INFO "%s: interrupt(s) dropped!\n", dev->name);
+
+		local_irq_save(flags);
 		el3_interrupt(dev->irq, dev);
+		local_irq_restore(flags);
+
 		lp->fast_poll = HZ;
 	}
 	if (lp->fast_poll) {
diff --git a/drivers/net/pcmcia/3c589_cs.c b/drivers/net/pcmcia/3c589_cs.c
index 6f8d7e2e5922..322e11df0097 100644
--- a/drivers/net/pcmcia/3c589_cs.c
+++ b/drivers/net/pcmcia/3c589_cs.c
@@ -711,7 +711,11 @@ static void media_check(unsigned long arg)
 	(inb(ioaddr + EL3_TIMER) == 0xff)) {
 	if (!lp->fast_poll)
 	    printk(KERN_WARNING "%s: interrupt(s) dropped!\n", dev->name);
+
+	local_irq_save(flags);
 	el3_interrupt(dev->irq, dev);
+	local_irq_restore(flags);
+
 	lp->fast_poll = HZ;
     }
     if (lp->fast_poll) {
diff --git a/drivers/net/pcmcia/axnet_cs.c b/drivers/net/pcmcia/axnet_cs.c
index 81bafd578478..d431b59e7d11 100644
--- a/drivers/net/pcmcia/axnet_cs.c
+++ b/drivers/net/pcmcia/axnet_cs.c
@@ -270,7 +270,7 @@ static int try_io_port(struct pcmcia_device *link)
 	    /* for master/slave multifunction cards */
 	    link->io.Attributes2 = IO_DATA_PATH_WIDTH_8;
 	    link->irq.Attributes =
-		IRQ_TYPE_DYNAMIC_SHARING|IRQ_FIRST_SHARED;
+		IRQ_TYPE_DYNAMIC_SHARING;
 	}
     } else {
 	/* This should be two 16-port windows */
diff --git a/drivers/net/pcmcia/fmvj18x_cs.c b/drivers/net/pcmcia/fmvj18x_cs.c
index 8ad8384fc1c0..7b17404d0858 100644
--- a/drivers/net/pcmcia/fmvj18x_cs.c
+++ b/drivers/net/pcmcia/fmvj18x_cs.c
@@ -426,7 +426,7 @@ static int fmvj18x_config(struct pcmcia_device *link)
 
     if (link->io.NumPorts2 != 0) {
     	link->irq.Attributes =
-		IRQ_TYPE_DYNAMIC_SHARING|IRQ_FIRST_SHARED;
+		IRQ_TYPE_DYNAMIC_SHARING;
 	ret = mfc_try_io_port(link);
 	if (ret != 0) goto failed;
     } else if (cardtype == UNGERMANN) {
@@ -717,6 +717,7 @@ static struct pcmcia_device_id fmvj18x_ids[] = {
 	PCMCIA_PFC_DEVICE_PROD_ID12(0, "NEC", "PK-UG-J001" ,0x18df0ba0 ,0x831b1064),
 	PCMCIA_PFC_DEVICE_MANF_CARD(0, 0x0105, 0x0d0a),
 	PCMCIA_PFC_DEVICE_MANF_CARD(0, 0x0105, 0x0e0a),
+	PCMCIA_PFC_DEVICE_MANF_CARD(0, 0x0032, 0x0e01),
 	PCMCIA_PFC_DEVICE_MANF_CARD(0, 0x0032, 0x0a05),
 	PCMCIA_PFC_DEVICE_MANF_CARD(0, 0x0032, 0x1101),
 	PCMCIA_DEVICE_NULL,
diff --git a/drivers/net/pcmcia/nmclan_cs.c b/drivers/net/pcmcia/nmclan_cs.c
index 8a5ae3b182ed..12e3233868e9 100644
--- a/drivers/net/pcmcia/nmclan_cs.c
+++ b/drivers/net/pcmcia/nmclan_cs.c
@@ -1402,7 +1402,6 @@ static void BuildLAF(int *ladrf, int *adr)
   for (i = 0; i < 8; i++)
     printk(KERN_CONT " %02X", ladrf[i]);
   printk(KERN_CONT "\n");
-  }
 #endif
 } /* BuildLAF */
 
diff --git a/drivers/net/pcmcia/pcnet_cs.c b/drivers/net/pcmcia/pcnet_cs.c
index 2d26b6ca28b9..776cad2f5715 100644
--- a/drivers/net/pcmcia/pcnet_cs.c
+++ b/drivers/net/pcmcia/pcnet_cs.c
@@ -490,7 +490,7 @@ static int try_io_port(struct pcmcia_device *link)
 	    /* for master/slave multifunction cards */
 	    link->io.Attributes2 = IO_DATA_PATH_WIDTH_8;
 	    link->irq.Attributes =
-		IRQ_TYPE_DYNAMIC_SHARING|IRQ_FIRST_SHARED;
+		IRQ_TYPE_DYNAMIC_SHARING;
 	}
     } else {
 	/* This should be two 16-port windows */
@@ -1741,7 +1741,7 @@ static struct pcmcia_device_id pcnet_ids[] = {
 	PCMCIA_MFC_DEVICE_CIS_PROD_ID4(0, "NSC MF LAN/Modem", 0x58fc6056, "cis/DP83903.cis"),
 	PCMCIA_MFC_DEVICE_CIS_MANF_CARD(0, 0x0175, 0x0000, "cis/DP83903.cis"),
 	PCMCIA_DEVICE_CIS_MANF_CARD(0xc00f, 0x0002, "cis/LA-PCM.cis"),
-	PCMCIA_DEVICE_CIS_PROD_ID12("KTI", "PE520 PLUS", 0xad180345, 0x9d58d392, "PE520.cis"),
+	PCMCIA_DEVICE_CIS_PROD_ID12("KTI", "PE520 PLUS", 0xad180345, 0x9d58d392, "cis/PE520.cis"),
 	PCMCIA_DEVICE_CIS_PROD_ID12("NDC", "Ethernet", 0x01c43ae1, 0x00b2e941, "cis/NE2K.cis"),
 	PCMCIA_DEVICE_CIS_PROD_ID12("PMX   ", "PE-200", 0x34f3f1c8, 0x10b59f8c, "cis/PE-200.cis"),
 	PCMCIA_DEVICE_CIS_PROD_ID12("TAMARACK", "Ethernet", 0xcf434fba, 0x00b2e941, "cis/tamarack.cis"),
@@ -1754,7 +1754,7 @@ MODULE_DEVICE_TABLE(pcmcia, pcnet_ids);
 MODULE_FIRMWARE("cis/PCMLM28.cis");
 MODULE_FIRMWARE("cis/DP83903.cis");
 MODULE_FIRMWARE("cis/LA-PCM.cis");
-MODULE_FIRMWARE("PE520.cis");
+MODULE_FIRMWARE("cis/PE520.cis");
 MODULE_FIRMWARE("cis/NE2K.cis");
 MODULE_FIRMWARE("cis/PE-200.cis");
 MODULE_FIRMWARE("cis/tamarack.cis");
diff --git a/drivers/net/pcmcia/smc91c92_cs.c b/drivers/net/pcmcia/smc91c92_cs.c
index cc4853bc0253..6dd486d2977b 100644
--- a/drivers/net/pcmcia/smc91c92_cs.c
+++ b/drivers/net/pcmcia/smc91c92_cs.c
@@ -454,7 +454,7 @@ static int mhz_mfc_config(struct pcmcia_device *link)
     link->conf.Attributes |= CONF_ENABLE_SPKR;
     link->conf.Status = CCSR_AUDIO_ENA;
     link->irq.Attributes =
-	IRQ_TYPE_DYNAMIC_SHARING|IRQ_FIRST_SHARED;
+	IRQ_TYPE_DYNAMIC_SHARING;
     link->io.IOAddrLines = 16;
     link->io.Attributes2 = IO_DATA_PATH_WIDTH_8;
     link->io.NumPorts2 = 8;
diff --git a/drivers/net/pcmcia/xirc2ps_cs.c b/drivers/net/pcmcia/xirc2ps_cs.c
index a2eda28f903e..466fc72698c0 100644
--- a/drivers/net/pcmcia/xirc2ps_cs.c
+++ b/drivers/net/pcmcia/xirc2ps_cs.c
@@ -841,7 +841,7 @@ xirc2ps_config(struct pcmcia_device * link)
 	    link->conf.Attributes |= CONF_ENABLE_SPKR;
 	    link->conf.Status |= CCSR_AUDIO_ENA;
 	}
-	link->irq.Attributes |= IRQ_TYPE_DYNAMIC_SHARING|IRQ_FIRST_SHARED ;
+	link->irq.Attributes |= IRQ_TYPE_DYNAMIC_SHARING;
 	link->io.NumPorts2 = 8;
 	link->io.Attributes2 = IO_DATA_PATH_WIDTH_8;
 	if (local->dingo) {
diff --git a/drivers/net/pcnet32.c b/drivers/net/pcnet32.c
index dcc67a35e8f2..e154677ff706 100644
--- a/drivers/net/pcnet32.c
+++ b/drivers/net/pcnet32.c
@@ -45,6 +45,7 @@ static const char *const version =
 #include <linux/crc32.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
+#include <linux/if_ether.h>
 #include <linux/skbuff.h>
 #include <linux/spinlock.h>
 #include <linux/moduleparam.h>
@@ -1765,7 +1766,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
 
 	/* if the ethernet address is not valid, force to 00:00:00:00:00:00 */
 	if (!is_valid_ether_addr(dev->perm_addr))
-		memset(dev->dev_addr, 0, sizeof(dev->dev_addr));
+		memset(dev->dev_addr, 0, ETH_ALEN);
 
 	if (pcnet32_debug & NETIF_MSG_PROBE) {
 		printk(" %pM", dev->dev_addr);
diff --git a/drivers/net/phy/Kconfig b/drivers/net/phy/Kconfig
index d5d8e1c5bc91..fc5938ba3d78 100644
--- a/drivers/net/phy/Kconfig
+++ b/drivers/net/phy/Kconfig
@@ -115,4 +115,15 @@ config MDIO_GPIO
 	  To compile this driver as a module, choose M here: the module
 	  will be called mdio-gpio.
 
+config MDIO_OCTEON
+	tristate "Support for MDIO buses on Octeon SOCs"
+	depends on  CPU_CAVIUM_OCTEON
+	default y
+	help
+
+	  This module provides a driver for the Octeon MDIO busses.
+	  It is required by the Octeon Ethernet device drivers.
+
+	  If in doubt, say Y.
+
 endif # PHYLIB
diff --git a/drivers/net/phy/Makefile b/drivers/net/phy/Makefile
index edfaac48cbd5..1342585af381 100644
--- a/drivers/net/phy/Makefile
+++ b/drivers/net/phy/Makefile
@@ -20,3 +20,4 @@ obj-$(CONFIG_MDIO_BITBANG)	+= mdio-bitbang.o
 obj-$(CONFIG_MDIO_GPIO)		+= mdio-gpio.o
 obj-$(CONFIG_NATIONAL_PHY)	+= national.o
 obj-$(CONFIG_STE10XP)		+= ste10Xp.o
+obj-$(CONFIG_MDIO_OCTEON)	+= mdio-octeon.o
diff --git a/drivers/net/phy/broadcom.c b/drivers/net/phy/broadcom.c
index f63c96a4ecb4..33c4b12a63ba 100644
--- a/drivers/net/phy/broadcom.c
+++ b/drivers/net/phy/broadcom.c
@@ -326,12 +326,13 @@ error:
 
 static void bcm54xx_adjust_rxrefclk(struct phy_device *phydev)
 {
-	u32 val, orig;
+	u32 orig;
+	int val;
 	bool clk125en = true;
 
 	/* Abort if we are using an untested phy. */
-	if (BRCM_PHY_MODEL(phydev) != PHY_ID_BCM57780 ||
-	    BRCM_PHY_MODEL(phydev) != PHY_ID_BCM50610 ||
+	if (BRCM_PHY_MODEL(phydev) != PHY_ID_BCM57780 &&
+	    BRCM_PHY_MODEL(phydev) != PHY_ID_BCM50610 &&
 	    BRCM_PHY_MODEL(phydev) != PHY_ID_BCM50610M)
 		return;
 
diff --git a/drivers/net/phy/mdio-octeon.c b/drivers/net/phy/mdio-octeon.c
new file mode 100644
index 000000000000..61a4461cbda5
--- /dev/null
+++ b/drivers/net/phy/mdio-octeon.c
@@ -0,0 +1,180 @@
+/*
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright (C) 2009 Cavium Networks
+ */
+
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/phy.h>
+
+#include <asm/octeon/octeon.h>
+#include <asm/octeon/cvmx-smix-defs.h>
+
+#define DRV_VERSION "1.0"
+#define DRV_DESCRIPTION "Cavium Networks Octeon SMI/MDIO driver"
+
+struct octeon_mdiobus {
+	struct mii_bus *mii_bus;
+	int unit;
+	int phy_irq[PHY_MAX_ADDR];
+};
+
+static int octeon_mdiobus_read(struct mii_bus *bus, int phy_id, int regnum)
+{
+	struct octeon_mdiobus *p = bus->priv;
+	union cvmx_smix_cmd smi_cmd;
+	union cvmx_smix_rd_dat smi_rd;
+	int timeout = 1000;
+
+	smi_cmd.u64 = 0;
+	smi_cmd.s.phy_op = 1; /* MDIO_CLAUSE_22_READ */
+	smi_cmd.s.phy_adr = phy_id;
+	smi_cmd.s.reg_adr = regnum;
+	cvmx_write_csr(CVMX_SMIX_CMD(p->unit), smi_cmd.u64);
+
+	do {
+		/*
+		 * Wait 1000 clocks so we don't saturate the RSL bus
+		 * doing reads.
+		 */
+		cvmx_wait(1000);
+		smi_rd.u64 = cvmx_read_csr(CVMX_SMIX_RD_DAT(p->unit));
+	} while (smi_rd.s.pending && --timeout);
+
+	if (smi_rd.s.val)
+		return smi_rd.s.dat;
+	else
+		return -EIO;
+}
+
+static int octeon_mdiobus_write(struct mii_bus *bus, int phy_id,
+				int regnum, u16 val)
+{
+	struct octeon_mdiobus *p = bus->priv;
+	union cvmx_smix_cmd smi_cmd;
+	union cvmx_smix_wr_dat smi_wr;
+	int timeout = 1000;
+
+	smi_wr.u64 = 0;
+	smi_wr.s.dat = val;
+	cvmx_write_csr(CVMX_SMIX_WR_DAT(p->unit), smi_wr.u64);
+
+	smi_cmd.u64 = 0;
+	smi_cmd.s.phy_op = 0; /* MDIO_CLAUSE_22_WRITE */
+	smi_cmd.s.phy_adr = phy_id;
+	smi_cmd.s.reg_adr = regnum;
+	cvmx_write_csr(CVMX_SMIX_CMD(p->unit), smi_cmd.u64);
+
+	do {
+		/*
+		 * Wait 1000 clocks so we don't saturate the RSL bus
+		 * doing reads.
+		 */
+		cvmx_wait(1000);
+		smi_wr.u64 = cvmx_read_csr(CVMX_SMIX_WR_DAT(p->unit));
+	} while (smi_wr.s.pending && --timeout);
+
+	if (timeout <= 0)
+		return -EIO;
+
+	return 0;
+}
+
+static int __init octeon_mdiobus_probe(struct platform_device *pdev)
+{
+	struct octeon_mdiobus *bus;
+	int i;
+	int err = -ENOENT;
+
+	bus = devm_kzalloc(&pdev->dev, sizeof(*bus), GFP_KERNEL);
+	if (!bus)
+		return -ENOMEM;
+
+	/* The platform_device id is our unit number.  */
+	bus->unit = pdev->id;
+
+	bus->mii_bus = mdiobus_alloc();
+
+	if (!bus->mii_bus)
+		goto err;
+
+	/*
+	 * Standard Octeon evaluation boards don't support phy
+	 * interrupts, we need to poll.
+	 */
+	for (i = 0; i < PHY_MAX_ADDR; i++)
+		bus->phy_irq[i] = PHY_POLL;
+
+	bus->mii_bus->priv = bus;
+	bus->mii_bus->irq = bus->phy_irq;
+	bus->mii_bus->name = "mdio-octeon";
+	snprintf(bus->mii_bus->id, MII_BUS_ID_SIZE, "%x", bus->unit);
+	bus->mii_bus->parent = &pdev->dev;
+
+	bus->mii_bus->read = octeon_mdiobus_read;
+	bus->mii_bus->write = octeon_mdiobus_write;
+
+	dev_set_drvdata(&pdev->dev, bus);
+
+	err = mdiobus_register(bus->mii_bus);
+	if (err)
+		goto err_register;
+
+	dev_info(&pdev->dev, "Version " DRV_VERSION "\n");
+
+	return 0;
+err_register:
+	mdiobus_free(bus->mii_bus);
+
+err:
+	devm_kfree(&pdev->dev, bus);
+	return err;
+}
+
+static int __exit octeon_mdiobus_remove(struct platform_device *pdev)
+{
+	struct octeon_mdiobus *bus;
+
+	bus = dev_get_drvdata(&pdev->dev);
+
+	mdiobus_unregister(bus->mii_bus);
+	mdiobus_free(bus->mii_bus);
+	return 0;
+}
+
+static struct platform_driver octeon_mdiobus_driver = {
+	.driver = {
+		.name		= "mdio-octeon",
+		.owner		= THIS_MODULE,
+	},
+	.probe		= octeon_mdiobus_probe,
+	.remove		= __exit_p(octeon_mdiobus_remove),
+};
+
+void octeon_mdiobus_force_mod_depencency(void)
+{
+	/* Let ethernet drivers force us to be loaded.  */
+}
+EXPORT_SYMBOL(octeon_mdiobus_force_mod_depencency);
+
+static int __init octeon_mdiobus_mod_init(void)
+{
+	return platform_driver_register(&octeon_mdiobus_driver);
+}
+
+static void __exit octeon_mdiobus_mod_exit(void)
+{
+	platform_driver_unregister(&octeon_mdiobus_driver);
+}
+
+module_init(octeon_mdiobus_mod_init);
+module_exit(octeon_mdiobus_mod_exit);
+
+MODULE_DESCRIPTION(DRV_DESCRIPTION);
+MODULE_VERSION(DRV_VERSION);
+MODULE_AUTHOR("David Daney");
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index bd4e8d72dc08..e17b70291bbc 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -264,6 +264,8 @@ static int mdio_bus_match(struct device *dev, struct device_driver *drv)
 		(phydev->phy_id & phydrv->phy_id_mask));
 }
 
+#ifdef CONFIG_PM
+
 static bool mdio_bus_phy_may_suspend(struct phy_device *phydev)
 {
 	struct device_driver *drv = phydev->dev.driver;
@@ -295,34 +297,88 @@ static bool mdio_bus_phy_may_suspend(struct phy_device *phydev)
 	return true;
 }
 
-/* Suspend and resume.  Copied from platform_suspend and
- * platform_resume
- */
-static int mdio_bus_suspend(struct device * dev, pm_message_t state)
+static int mdio_bus_suspend(struct device *dev)
 {
 	struct phy_driver *phydrv = to_phy_driver(dev->driver);
 	struct phy_device *phydev = to_phy_device(dev);
 
+	/*
+	 * We must stop the state machine manually, otherwise it stops out of
+	 * control, possibly with the phydev->lock held. Upon resume, netdev
+	 * may call phy routines that try to grab the same lock, and that may
+	 * lead to a deadlock.
+	 */
+	if (phydev->attached_dev)
+		phy_stop_machine(phydev);
+
 	if (!mdio_bus_phy_may_suspend(phydev))
 		return 0;
+
 	return phydrv->suspend(phydev);
 }
 
-static int mdio_bus_resume(struct device * dev)
+static int mdio_bus_resume(struct device *dev)
 {
 	struct phy_driver *phydrv = to_phy_driver(dev->driver);
 	struct phy_device *phydev = to_phy_device(dev);
+	int ret;
 
 	if (!mdio_bus_phy_may_suspend(phydev))
+		goto no_resume;
+
+	ret = phydrv->resume(phydev);
+	if (ret < 0)
+		return ret;
+
+no_resume:
+	if (phydev->attached_dev)
+		phy_start_machine(phydev, NULL);
+
+	return 0;
+}
+
+static int mdio_bus_restore(struct device *dev)
+{
+	struct phy_device *phydev = to_phy_device(dev);
+	struct net_device *netdev = phydev->attached_dev;
+	int ret;
+
+	if (!netdev)
 		return 0;
-	return phydrv->resume(phydev);
+
+	ret = phy_init_hw(phydev);
+	if (ret < 0)
+		return ret;
+
+	/* The PHY needs to renegotiate. */
+	phydev->link = 0;
+	phydev->state = PHY_UP;
+
+	phy_start_machine(phydev, NULL);
+
+	return 0;
 }
 
+static struct dev_pm_ops mdio_bus_pm_ops = {
+	.suspend = mdio_bus_suspend,
+	.resume = mdio_bus_resume,
+	.freeze = mdio_bus_suspend,
+	.thaw = mdio_bus_resume,
+	.restore = mdio_bus_restore,
+};
+
+#define MDIO_BUS_PM_OPS (&mdio_bus_pm_ops)
+
+#else
+
+#define MDIO_BUS_PM_OPS NULL
+
+#endif /* CONFIG_PM */
+
 struct bus_type mdio_bus_type = {
 	.name		= "mdio_bus",
 	.match		= mdio_bus_match,
-	.suspend	= mdio_bus_suspend,
-	.resume		= mdio_bus_resume,
+	.pm		= MDIO_BUS_PM_OPS,
 };
 EXPORT_SYMBOL(mdio_bus_type);
 
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index b0e9f9c51721..0295097d6c44 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -410,7 +410,6 @@ EXPORT_SYMBOL(phy_start_aneg);
 
 
 static void phy_change(struct work_struct *work);
-static void phy_state_machine(struct work_struct *work);
 
 /**
  * phy_start_machine - start PHY state machine tracking
@@ -430,7 +429,6 @@ void phy_start_machine(struct phy_device *phydev,
 {
 	phydev->adjust_state = handler;
 
-	INIT_DELAYED_WORK(&phydev->state_queue, phy_state_machine);
 	schedule_delayed_work(&phydev->state_queue, HZ);
 }
 
@@ -761,7 +759,7 @@ EXPORT_SYMBOL(phy_start);
  * phy_state_machine - Handle the state machine
  * @work: work_struct that describes the work to be done
  */
-static void phy_state_machine(struct work_struct *work)
+void phy_state_machine(struct work_struct *work)
 {
 	struct delayed_work *dwork = to_delayed_work(work);
 	struct phy_device *phydev =
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index b10fedd82143..adbc0fded130 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -177,6 +177,7 @@ struct phy_device* phy_device_create(struct mii_bus *bus, int addr, int phy_id)
 	dev->state = PHY_DOWN;
 
 	mutex_init(&dev->lock);
+	INIT_DELAYED_WORK(&dev->state_queue, phy_state_machine);
 
 	return dev;
 }
@@ -378,6 +379,20 @@ void phy_disconnect(struct phy_device *phydev)
 }
 EXPORT_SYMBOL(phy_disconnect);
 
+int phy_init_hw(struct phy_device *phydev)
+{
+	int ret;
+
+	if (!phydev->drv || !phydev->drv->config_init)
+		return 0;
+
+	ret = phy_scan_fixups(phydev);
+	if (ret < 0)
+		return ret;
+
+	return phydev->drv->config_init(phydev);
+}
+
 /**
  * phy_attach_direct - attach a network device to a given PHY device pointer
  * @dev: network device to attach
@@ -425,21 +440,7 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
 	/* Do initial configuration here, now that
 	 * we have certain key parameters
 	 * (dev_flags and interface) */
-	if (phydev->drv->config_init) {
-		int err;
-
-		err = phy_scan_fixups(phydev);
-
-		if (err < 0)
-			return err;
-
-		err = phydev->drv->config_init(phydev);
-
-		if (err < 0)
-			return err;
-	}
-
-	return 0;
+	return phy_init_hw(phydev);
 }
 EXPORT_SYMBOL(phy_attach_direct);
 
diff --git a/drivers/net/ps3_gelic_net.c b/drivers/net/ps3_gelic_net.c
index 89c4948300a5..0c768593aad0 100644
--- a/drivers/net/ps3_gelic_net.c
+++ b/drivers/net/ps3_gelic_net.c
@@ -314,7 +314,7 @@ static void gelic_card_reset_chain(struct gelic_card *card,
  * @card: card structure
  * @descr: descriptor to re-init
  *
- * return 0 on succes, <0 on failure
+ * return 0 on success, <0 on failure
  *
  * allocates a new rx skb, iommu-maps it and attaches it to the descriptor.
  * Activate the descriptor state-wise
diff --git a/drivers/net/ps3_gelic_wireless.h b/drivers/net/ps3_gelic_wireless.h
index 5b631c6c9775..0a88b535197a 100644
--- a/drivers/net/ps3_gelic_wireless.h
+++ b/drivers/net/ps3_gelic_wireless.h
@@ -199,7 +199,7 @@ struct gelic_eurus_rssi_info {
 /* for 'stat' member of gelic_wl_info */
 enum gelic_wl_info_status_bit {
 	GELIC_WL_STAT_CONFIGURED,
-	GELIC_WL_STAT_CH_INFO,   /* ch info aquired */
+	GELIC_WL_STAT_CH_INFO,   /* ch info acquired */
 	GELIC_WL_STAT_ESSID_SET, /* ESSID specified by userspace */
 	GELIC_WL_STAT_BSSID_SET, /* BSSID specified by userspace */
 	GELIC_WL_STAT_WPA_PSK_SET, /* PMK specified by userspace */
diff --git a/drivers/net/qla3xxx.c b/drivers/net/qla3xxx.c
index e3e6bc917c87..dd35066a7f8d 100644
--- a/drivers/net/qla3xxx.c
+++ b/drivers/net/qla3xxx.c
@@ -3651,7 +3651,7 @@ static int ql_adapter_up(struct ql3_adapter *qdev)
 		ql_sem_unlock(qdev, QL_DRVR_SEM_MASK);
 	} else {
 		printk(KERN_ERR PFX
-		       "%s: Could not aquire driver lock.\n",
+		       "%s: Could not acquire driver lock.\n",
 		       ndev->name);
 		goto err_lock;
 	}
diff --git a/drivers/net/qlge/qlge_main.c b/drivers/net/qlge/qlge_main.c
index 707b391afa02..894a7c84faef 100644
--- a/drivers/net/qlge/qlge_main.c
+++ b/drivers/net/qlge/qlge_main.c
@@ -4119,7 +4119,7 @@ static int __devinit ql_init_device(struct pci_dev *pdev,
 	err = pcie_set_readrq(pdev, 4096);
 	if (err) {
 		dev_err(&pdev->dev, "Set readrq failed.\n");
-		goto err_out;
+		goto err_out1;
 	}
 
 	err = pci_request_regions(pdev, DRV_NAME);
@@ -4140,7 +4140,7 @@ static int __devinit ql_init_device(struct pci_dev *pdev,
 
 	if (err) {
 		dev_err(&pdev->dev, "No usable DMA configuration.\n");
-		goto err_out;
+		goto err_out2;
 	}
 
 	/* Set PCIe reset type for EEH to fundamental. */
@@ -4152,7 +4152,7 @@ static int __devinit ql_init_device(struct pci_dev *pdev,
 	if (!qdev->reg_base) {
 		dev_err(&pdev->dev, "Register mapping failed.\n");
 		err = -ENOMEM;
-		goto err_out;
+		goto err_out2;
 	}
 
 	qdev->doorbell_area_size = pci_resource_len(pdev, 3);
@@ -4162,14 +4162,14 @@ static int __devinit ql_init_device(struct pci_dev *pdev,
 	if (!qdev->doorbell_area) {
 		dev_err(&pdev->dev, "Doorbell register mapping failed.\n");
 		err = -ENOMEM;
-		goto err_out;
+		goto err_out2;
 	}
 
 	err = ql_get_board_info(qdev);
 	if (err) {
 		dev_err(&pdev->dev, "Register access failed.\n");
 		err = -EIO;
-		goto err_out;
+		goto err_out2;
 	}
 	qdev->msg_enable = netif_msg_init(debug, default_msg);
 	spin_lock_init(&qdev->hw_lock);
@@ -4179,7 +4179,7 @@ static int __devinit ql_init_device(struct pci_dev *pdev,
 	err = qdev->nic_ops->get_flash(qdev);
 	if (err) {
 		dev_err(&pdev->dev, "Invalid FLASH.\n");
-		goto err_out;
+		goto err_out2;
 	}
 
 	memcpy(ndev->perm_addr, ndev->dev_addr, ndev->addr_len);
@@ -4212,8 +4212,9 @@ static int __devinit ql_init_device(struct pci_dev *pdev,
 			 DRV_NAME, DRV_VERSION);
 	}
 	return 0;
-err_out:
+err_out2:
 	ql_release_all(pdev);
+err_out1:
 	pci_disable_device(pdev);
 	return err;
 }
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index acfc5a3aa490..60f96c468a24 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -4859,7 +4859,7 @@ out:
 	return 0;
 }
 
-static struct dev_pm_ops rtl8169_pm_ops = {
+static const struct dev_pm_ops rtl8169_pm_ops = {
 	.suspend = rtl8169_suspend,
 	.resume = rtl8169_resume,
 	.freeze = rtl8169_suspend,
diff --git a/drivers/net/rrunner.c b/drivers/net/rrunner.c
index 20a71749154a..1c257098d0a6 100644
--- a/drivers/net/rrunner.c
+++ b/drivers/net/rrunner.c
@@ -1293,7 +1293,7 @@ static void rr_dump(struct net_device *dev)
 
 	printk("Error code 0x%x\n", readl(&regs->Fail1));
 
-	index = (((readl(&regs->EvtPrd) >> 8) & 0xff ) - 1) % EVT_RING_ENTRIES;
+	index = (((readl(&regs->EvtPrd) >> 8) & 0xff) - 1) % TX_RING_ENTRIES;
 	cons = rrpriv->dirty_tx;
 	printk("TX ring index %i, TX consumer %i\n",
 	       index, cons);
diff --git a/drivers/net/s2io.c b/drivers/net/s2io.c
index 0dd7839322bc..3c4836d0898f 100644
--- a/drivers/net/s2io.c
+++ b/drivers/net/s2io.c
@@ -3238,7 +3238,7 @@ static u64 s2io_mdio_read(u32 mmd_type, u64 addr, struct net_device *dev)
 
 /**
  *  s2io_chk_xpak_counter - Function to check the status of the xpak counters
- *  @counter      : couter value to be updated
+ *  @counter      : counter value to be updated
  *  @flag         : flag to indicate the status
  *  @type         : counter type
  *  Description:
@@ -3421,7 +3421,7 @@ static int wait_for_cmd_complete(void __iomem *addr, u64 busy_bit,
 				break;
 			}
 		} else {
-			if (!(val64 & busy_bit)) {
+			if (val64 & busy_bit) {
 				ret = SUCCESS;
 				break;
 			}
diff --git a/drivers/net/sfc/efx.c b/drivers/net/sfc/efx.c
index f983e3b507cc..46997e177ee3 100644
--- a/drivers/net/sfc/efx.c
+++ b/drivers/net/sfc/efx.c
@@ -741,14 +741,14 @@ static int efx_probe_port(struct efx_nic *efx)
 
 	EFX_LOG(efx, "create port\n");
 
+	if (phy_flash_cfg)
+		efx->phy_mode = PHY_MODE_SPECIAL;
+
 	/* Connect up MAC/PHY operations table */
 	rc = efx->type->probe_port(efx);
 	if (rc)
 		goto err;
 
-	if (phy_flash_cfg)
-		efx->phy_mode = PHY_MODE_SPECIAL;
-
 	/* Sanity check MAC address */
 	if (is_valid_ether_addr(efx->mac_address)) {
 		memcpy(efx->net_dev->dev_addr, efx->mac_address, ETH_ALEN);
@@ -2284,6 +2284,7 @@ static int __devinit efx_pci_probe(struct pci_dev *pci_dev,
  fail2:
 	efx_fini_struct(efx);
  fail1:
+	WARN_ON(rc > 0);
 	EFX_LOG(efx, "initialisation failed. rc=%d\n", rc);
 	free_netdev(net_dev);
 	return rc;
diff --git a/drivers/net/sfc/falcon.c b/drivers/net/sfc/falcon.c
index 17afcd26e870..9d009c46e962 100644
--- a/drivers/net/sfc/falcon.c
+++ b/drivers/net/sfc/falcon.c
@@ -925,6 +925,7 @@ static int falcon_probe_port(struct efx_nic *efx)
 
 static void falcon_remove_port(struct efx_nic *efx)
 {
+	efx->phy_op->remove(efx);
 	efx_nic_free_buffer(efx, &efx->stats_buffer);
 }
 
diff --git a/drivers/net/sfc/falcon_xmac.c b/drivers/net/sfc/falcon_xmac.c
index 3da933f8f079..8ccab2c67a20 100644
--- a/drivers/net/sfc/falcon_xmac.c
+++ b/drivers/net/sfc/falcon_xmac.c
@@ -111,16 +111,12 @@ static void falcon_mask_status_intr(struct efx_nic *efx, bool enable)
 	efx_writeo(efx, &reg, FR_AB_XM_MGT_INT_MASK);
 }
 
-/* Get status of XAUI link */
-static bool falcon_xaui_link_ok(struct efx_nic *efx)
+static bool falcon_xgxs_link_ok(struct efx_nic *efx)
 {
 	efx_oword_t reg;
 	bool align_done, link_ok = false;
 	int sync_status;
 
-	if (LOOPBACK_INTERNAL(efx))
-		return true;
-
 	/* Read link status */
 	efx_reado(efx, &reg, FR_AB_XX_CORE_STAT);
 
@@ -135,14 +131,24 @@ static bool falcon_xaui_link_ok(struct efx_nic *efx)
 	EFX_SET_OWORD_FIELD(reg, FRF_AB_XX_DISPERR, FFE_AB_XX_STAT_ALL_LANES);
 	efx_writeo(efx, &reg, FR_AB_XX_CORE_STAT);
 
-	/* If the link is up, then check the phy side of the xaui link */
-	if (efx->link_state.up && link_ok)
-		if (efx->mdio.mmds & (1 << MDIO_MMD_PHYXS))
-			link_ok = efx_mdio_phyxgxs_lane_sync(efx);
-
 	return link_ok;
 }
 
+static bool falcon_xmac_link_ok(struct efx_nic *efx)
+{
+	/*
+	 * Check MAC's XGXS link status except when using XGMII loopback
+	 * which bypasses the XGXS block.
+	 * If possible, check PHY's XGXS link status except when using
+	 * MAC loopback.
+	 */
+	return (efx->loopback_mode == LOOPBACK_XGMII ||
+		falcon_xgxs_link_ok(efx)) &&
+		(!(efx->mdio.mmds & (1 << MDIO_MMD_PHYXS)) ||
+		 LOOPBACK_INTERNAL(efx) || 
+		 efx_mdio_phyxgxs_lane_sync(efx));
+}
+
 void falcon_reconfigure_xmac_core(struct efx_nic *efx)
 {
 	unsigned int max_frame_len;
@@ -245,9 +251,9 @@ static void falcon_reconfigure_xgxs_core(struct efx_nic *efx)
 
 
 /* Try to bring up the Falcon side of the Falcon-Phy XAUI link */
-static bool falcon_check_xaui_link_up(struct efx_nic *efx, int tries)
+static bool falcon_xmac_link_ok_retry(struct efx_nic *efx, int tries)
 {
-	bool mac_up = falcon_xaui_link_ok(efx);
+	bool mac_up = falcon_xmac_link_ok(efx);
 
 	if (LOOPBACK_MASK(efx) & LOOPBACKS_EXTERNAL(efx) & LOOPBACKS_WS ||
 	    efx_phy_mode_disabled(efx->phy_mode))
@@ -261,7 +267,7 @@ static bool falcon_check_xaui_link_up(struct efx_nic *efx, int tries)
 		falcon_reset_xaui(efx);
 		udelay(200);
 
-		mac_up = falcon_xaui_link_ok(efx);
+		mac_up = falcon_xmac_link_ok(efx);
 		--tries;
 	}
 
@@ -272,7 +278,7 @@ static bool falcon_check_xaui_link_up(struct efx_nic *efx, int tries)
 
 static bool falcon_xmac_check_fault(struct efx_nic *efx)
 {
-	return !falcon_check_xaui_link_up(efx, 5);
+	return !falcon_xmac_link_ok_retry(efx, 5);
 }
 
 static int falcon_reconfigure_xmac(struct efx_nic *efx)
@@ -284,7 +290,7 @@ static int falcon_reconfigure_xmac(struct efx_nic *efx)
 
 	falcon_reconfigure_mac_wrapper(efx);
 
-	efx->xmac_poll_required = !falcon_check_xaui_link_up(efx, 5);
+	efx->xmac_poll_required = !falcon_xmac_link_ok_retry(efx, 5);
 	falcon_mask_status_intr(efx, true);
 
 	return 0;
@@ -357,7 +363,7 @@ void falcon_poll_xmac(struct efx_nic *efx)
 		return;
 
 	falcon_mask_status_intr(efx, false);
-	efx->xmac_poll_required = !falcon_check_xaui_link_up(efx, 1);
+	efx->xmac_poll_required = !falcon_xmac_link_ok_retry(efx, 1);
 	falcon_mask_status_intr(efx, true);
 }
 
diff --git a/drivers/net/sfc/mcdi.c b/drivers/net/sfc/mcdi.c
index 683353b904c7..9f035b9f0350 100644
--- a/drivers/net/sfc/mcdi.c
+++ b/drivers/net/sfc/mcdi.c
@@ -142,8 +142,9 @@ static int efx_mcdi_poll(struct efx_nic *efx)
 		if (spins != 0) {
 			--spins;
 			udelay(1);
-		} else
-			schedule();
+		} else {
+			schedule_timeout_uninterruptible(1);
+		}
 
 		time = get_seconds();
 
@@ -803,7 +804,7 @@ int efx_mcdi_nvram_read(struct efx_nic *efx, unsigned int type,
 			loff_t offset, u8 *buffer, size_t length)
 {
 	u8 inbuf[MC_CMD_NVRAM_READ_IN_LEN];
-	u8 outbuf[MC_CMD_NVRAM_READ_OUT_LEN(length)];
+	u8 outbuf[MC_CMD_NVRAM_READ_OUT_LEN(EFX_MCDI_NVRAM_LEN_MAX)];
 	size_t outlen;
 	int rc;
 
@@ -827,7 +828,7 @@ fail:
 int efx_mcdi_nvram_write(struct efx_nic *efx, unsigned int type,
 			   loff_t offset, const u8 *buffer, size_t length)
 {
-	u8 inbuf[MC_CMD_NVRAM_WRITE_IN_LEN(length)];
+	u8 inbuf[MC_CMD_NVRAM_WRITE_IN_LEN(EFX_MCDI_NVRAM_LEN_MAX)];
 	int rc;
 
 	MCDI_SET_DWORD(inbuf, NVRAM_WRITE_IN_TYPE, type);
@@ -837,7 +838,8 @@ int efx_mcdi_nvram_write(struct efx_nic *efx, unsigned int type,
 
 	BUILD_BUG_ON(MC_CMD_NVRAM_WRITE_OUT_LEN != 0);
 
-	rc = efx_mcdi_rpc(efx, MC_CMD_NVRAM_WRITE, inbuf, sizeof(inbuf),
+	rc = efx_mcdi_rpc(efx, MC_CMD_NVRAM_WRITE, inbuf,
+			  ALIGN(MC_CMD_NVRAM_WRITE_IN_LEN(length), 4),
 			  NULL, 0, NULL);
 	if (rc)
 		goto fail;
diff --git a/drivers/net/sfc/mcdi.h b/drivers/net/sfc/mcdi.h
index de916728c2e3..10ce98f4c0fb 100644
--- a/drivers/net/sfc/mcdi.h
+++ b/drivers/net/sfc/mcdi.h
@@ -111,6 +111,7 @@ extern int efx_mcdi_nvram_read(struct efx_nic *efx, unsigned int type,
 extern int efx_mcdi_nvram_write(struct efx_nic *efx, unsigned int type,
 				loff_t offset, const u8 *buffer,
 				size_t length);
+#define EFX_MCDI_NVRAM_LEN_MAX 128
 extern int efx_mcdi_nvram_erase(struct efx_nic *efx, unsigned int type,
 				loff_t offset, size_t length);
 extern int efx_mcdi_nvram_update_finish(struct efx_nic *efx,
diff --git a/drivers/net/sfc/mcdi_pcol.h b/drivers/net/sfc/mcdi_pcol.h
index 2a85360a46f0..73e71f420624 100644
--- a/drivers/net/sfc/mcdi_pcol.h
+++ b/drivers/net/sfc/mcdi_pcol.h
@@ -1090,8 +1090,10 @@
 #define MC_CMD_MAC_RX_LANES01_DISP_ERR 57
 #define MC_CMD_MAC_RX_LANES23_DISP_ERR 58
 #define MC_CMD_MAC_RX_MATCH_FAULT 59
+#define MC_CMD_GMAC_DMABUF_START 64
+#define MC_CMD_GMAC_DMABUF_END   95
 /* Insert new members here. */
-#define MC_CMD_MAC_GENERATION_END 60
+#define MC_CMD_MAC_GENERATION_END 96
 #define MC_CMD_MAC_NSTATS (MC_CMD_MAC_GENERATION_END+1)
 
 /* MC_CMD_MAC_STATS:
diff --git a/drivers/net/sfc/mcdi_phy.c b/drivers/net/sfc/mcdi_phy.c
index 0e1bcc5a0d52..eb694af7a473 100644
--- a/drivers/net/sfc/mcdi_phy.c
+++ b/drivers/net/sfc/mcdi_phy.c
@@ -304,31 +304,47 @@ static u32 mcdi_to_ethtool_media(u32 media)
 
 static int efx_mcdi_phy_probe(struct efx_nic *efx)
 {
-	struct efx_mcdi_phy_cfg *phy_cfg;
+	struct efx_mcdi_phy_cfg *phy_data;
+	u8 outbuf[MC_CMD_GET_LINK_OUT_LEN];
+	u32 caps;
 	int rc;
 
-	/* TODO: Move phy_data initialisation to
-	 * phy_op->probe/remove, rather than init/fini */
-	phy_cfg = kzalloc(sizeof(*phy_cfg), GFP_KERNEL);
-	if (phy_cfg == NULL) {
-		rc = -ENOMEM;
-		goto fail_alloc;
-	}
-	rc = efx_mcdi_get_phy_cfg(efx, phy_cfg);
+	/* Initialise and populate phy_data */
+	phy_data = kzalloc(sizeof(*phy_data), GFP_KERNEL);
+	if (phy_data == NULL)
+		return -ENOMEM;
+
+	rc = efx_mcdi_get_phy_cfg(efx, phy_data);
 	if (rc != 0)
 		goto fail;
 
-	efx->phy_type = phy_cfg->type;
+	/* Read initial link advertisement */
+	BUILD_BUG_ON(MC_CMD_GET_LINK_IN_LEN != 0);
+	rc = efx_mcdi_rpc(efx, MC_CMD_GET_LINK, NULL, 0,
+			  outbuf, sizeof(outbuf), NULL);
+	if (rc)
+		goto fail;
+
+	/* Fill out nic state */
+	efx->phy_data = phy_data;
+	efx->phy_type = phy_data->type;
 
-	efx->mdio_bus = phy_cfg->channel;
-	efx->mdio.prtad = phy_cfg->port;
-	efx->mdio.mmds = phy_cfg->mmd_mask & ~(1 << MC_CMD_MMD_CLAUSE22);
+	efx->mdio_bus = phy_data->channel;
+	efx->mdio.prtad = phy_data->port;
+	efx->mdio.mmds = phy_data->mmd_mask & ~(1 << MC_CMD_MMD_CLAUSE22);
 	efx->mdio.mode_support = 0;
-	if (phy_cfg->mmd_mask & (1 << MC_CMD_MMD_CLAUSE22))
+	if (phy_data->mmd_mask & (1 << MC_CMD_MMD_CLAUSE22))
 		efx->mdio.mode_support |= MDIO_SUPPORTS_C22;
-	if (phy_cfg->mmd_mask & ~(1 << MC_CMD_MMD_CLAUSE22))
+	if (phy_data->mmd_mask & ~(1 << MC_CMD_MMD_CLAUSE22))
 		efx->mdio.mode_support |= MDIO_SUPPORTS_C45 | MDIO_EMULATE_C22;
 
+	caps = MCDI_DWORD(outbuf, GET_LINK_OUT_CAP);
+	if (caps & (1 << MC_CMD_PHY_CAP_AN_LBN))
+		efx->link_advertising =
+			mcdi_to_ethtool_cap(phy_data->media, caps);
+	else
+		phy_data->forced_cap = caps;
+
 	/* Assert that we can map efx -> mcdi loopback modes */
 	BUILD_BUG_ON(LOOPBACK_NONE != MC_CMD_LOOPBACK_NONE);
 	BUILD_BUG_ON(LOOPBACK_DATA != MC_CMD_LOOPBACK_DATA);
@@ -365,46 +381,6 @@ static int efx_mcdi_phy_probe(struct efx_nic *efx)
 	 * but by convention we don't */
 	efx->loopback_modes &= ~(1 << LOOPBACK_NONE);
 
-	kfree(phy_cfg);
-
-	return 0;
-
-fail:
-	kfree(phy_cfg);
-fail_alloc:
-	return rc;
-}
-
-static int efx_mcdi_phy_init(struct efx_nic *efx)
-{
-	struct efx_mcdi_phy_cfg *phy_data;
-	u8 outbuf[MC_CMD_GET_LINK_OUT_LEN];
-	u32 caps;
-	int rc;
-
-	phy_data = kzalloc(sizeof(*phy_data), GFP_KERNEL);
-	if (phy_data == NULL)
-		return -ENOMEM;
-
-	rc = efx_mcdi_get_phy_cfg(efx, phy_data);
-	if (rc != 0)
-		goto fail;
-
-	efx->phy_data = phy_data;
-
-	BUILD_BUG_ON(MC_CMD_GET_LINK_IN_LEN != 0);
-	rc = efx_mcdi_rpc(efx, MC_CMD_GET_LINK, NULL, 0,
-			  outbuf, sizeof(outbuf), NULL);
-	if (rc)
-		goto fail;
-
-	caps = MCDI_DWORD(outbuf, GET_LINK_OUT_CAP);
-	if (caps & (1 << MC_CMD_PHY_CAP_AN_LBN))
-		efx->link_advertising =
-			mcdi_to_ethtool_cap(phy_data->media, caps);
-	else
-		phy_data->forced_cap = caps;
-
 	return 0;
 
 fail:
@@ -504,7 +480,7 @@ static bool efx_mcdi_phy_poll(struct efx_nic *efx)
 	return !efx_link_state_equal(&efx->link_state, &old_state);
 }
 
-static void efx_mcdi_phy_fini(struct efx_nic *efx)
+static void efx_mcdi_phy_remove(struct efx_nic *efx)
 {
 	struct efx_mcdi_phy_data *phy_data = efx->phy_data;
 
@@ -586,10 +562,11 @@ static int efx_mcdi_phy_set_settings(struct efx_nic *efx, struct ethtool_cmd *ec
 
 struct efx_phy_operations efx_mcdi_phy_ops = {
 	.probe		= efx_mcdi_phy_probe,
-	.init 	 	= efx_mcdi_phy_init,
+	.init 	 	= efx_port_dummy_op_int,
 	.reconfigure	= efx_mcdi_phy_reconfigure,
 	.poll		= efx_mcdi_phy_poll,
-	.fini		= efx_mcdi_phy_fini,
+	.fini		= efx_port_dummy_op_void,
+	.remove		= efx_mcdi_phy_remove,
 	.get_settings	= efx_mcdi_phy_get_settings,
 	.set_settings	= efx_mcdi_phy_set_settings,
 	.run_tests	= NULL,
diff --git a/drivers/net/sfc/mtd.c b/drivers/net/sfc/mtd.c
index 3a464529a46b..407bbaddfea6 100644
--- a/drivers/net/sfc/mtd.c
+++ b/drivers/net/sfc/mtd.c
@@ -23,7 +23,6 @@
 #include "mcdi_pcol.h"
 
 #define EFX_SPI_VERIFY_BUF_LEN 16
-#define EFX_MCDI_CHUNK_LEN 128
 
 struct efx_mtd_partition {
 	struct mtd_info mtd;
@@ -428,7 +427,7 @@ static int siena_mtd_read(struct mtd_info *mtd, loff_t start,
 	int rc = 0;
 
 	while (offset < end) {
-		chunk = min_t(size_t, end - offset, EFX_MCDI_CHUNK_LEN);
+		chunk = min_t(size_t, end - offset, EFX_MCDI_NVRAM_LEN_MAX);
 		rc = efx_mcdi_nvram_read(efx, part->mcdi.nvram_type, offset,
 					 buffer, chunk);
 		if (rc)
@@ -491,7 +490,7 @@ static int siena_mtd_write(struct mtd_info *mtd, loff_t start,
 	}
 
 	while (offset < end) {
-		chunk = min_t(size_t, end - offset, EFX_MCDI_CHUNK_LEN);
+		chunk = min_t(size_t, end - offset, EFX_MCDI_NVRAM_LEN_MAX);
 		rc = efx_mcdi_nvram_write(efx, part->mcdi.nvram_type, offset,
 					  buffer, chunk);
 		if (rc)
diff --git a/drivers/net/sfc/net_driver.h b/drivers/net/sfc/net_driver.h
index 34c381f009b7..d5aab5b3fa06 100644
--- a/drivers/net/sfc/net_driver.h
+++ b/drivers/net/sfc/net_driver.h
@@ -524,6 +524,7 @@ struct efx_phy_operations {
 	int (*probe) (struct efx_nic *efx);
 	int (*init) (struct efx_nic *efx);
 	void (*fini) (struct efx_nic *efx);
+	void (*remove) (struct efx_nic *efx);
 	int (*reconfigure) (struct efx_nic *efx);
 	bool (*poll) (struct efx_nic *efx);
 	void (*get_settings) (struct efx_nic *efx,
diff --git a/drivers/net/sfc/nic.c b/drivers/net/sfc/nic.c
index a577be227862..db44224ed2ca 100644
--- a/drivers/net/sfc/nic.c
+++ b/drivers/net/sfc/nic.c
@@ -1576,6 +1576,8 @@ void efx_nic_init_common(struct efx_nic *efx)
 	EFX_SET_OWORD_FIELD(temp, FRF_AZ_TX_SOFT_EVT_EN, 1);
 	/* Prefetch threshold 2 => fetch when descriptor cache half empty */
 	EFX_SET_OWORD_FIELD(temp, FRF_AZ_TX_PREF_THRESHOLD, 2);
+	/* Disable hardware watchdog which can misfire */
+	EFX_SET_OWORD_FIELD(temp, FRF_AZ_TX_PREF_WD_TMR, 0x3fffff);
 	/* Squash TX of packets of 16 bytes or less */
 	if (efx_nic_rev(efx) >= EFX_REV_FALCON_B0)
 		EFX_SET_OWORD_FIELD(temp, FRF_BZ_TX_FLUSH_MIN_LEN_EN, 1);
diff --git a/drivers/net/sfc/qt202x_phy.c b/drivers/net/sfc/qt202x_phy.c
index 3800fc791b2f..67eec7a6e487 100644
--- a/drivers/net/sfc/qt202x_phy.c
+++ b/drivers/net/sfc/qt202x_phy.c
@@ -33,6 +33,9 @@
 #define PCS_FW_HEARTBEAT_REG	0xd7ee
 #define PCS_FW_HEARTB_LBN	0
 #define PCS_FW_HEARTB_WIDTH	8
+#define PCS_FW_PRODUCT_CODE_1	0xd7f0
+#define PCS_FW_VERSION_1	0xd7f3
+#define PCS_FW_BUILD_1		0xd7f6
 #define PCS_UC8051_STATUS_REG	0xd7fd
 #define PCS_UC_STATUS_LBN	0
 #define PCS_UC_STATUS_WIDTH	8
@@ -52,14 +55,24 @@ void falcon_qt202x_set_led(struct efx_nic *p, int led, int mode)
 
 struct qt202x_phy_data {
 	enum efx_phy_mode phy_mode;
+	bool bug17190_in_bad_state;
+	unsigned long bug17190_timer;
+	u32 firmware_ver;
 };
 
 #define QT2022C2_MAX_RESET_TIME 500
 #define QT2022C2_RESET_WAIT 10
 
-static int qt2025c_wait_reset(struct efx_nic *efx)
+#define QT2025C_MAX_HEARTB_TIME (5 * HZ)
+#define QT2025C_HEARTB_WAIT 100
+#define QT2025C_MAX_FWSTART_TIME (25 * HZ / 10)
+#define QT2025C_FWSTART_WAIT 100
+
+#define BUG17190_INTERVAL (2 * HZ)
+
+static int qt2025c_wait_heartbeat(struct efx_nic *efx)
 {
-	unsigned long timeout = jiffies + 10 * HZ;
+	unsigned long timeout = jiffies + QT2025C_MAX_HEARTB_TIME;
 	int reg, old_counter = 0;
 
 	/* Wait for firmware heartbeat to start */
@@ -74,11 +87,25 @@ static int qt2025c_wait_reset(struct efx_nic *efx)
 			old_counter = counter;
 		else if (counter != old_counter)
 			break;
-		if (time_after(jiffies, timeout))
+		if (time_after(jiffies, timeout)) {
+			/* Some cables have EEPROMs that conflict with the
+			 * PHY's on-board EEPROM so it cannot load firmware */
+			EFX_ERR(efx, "If an SFP+ direct attach cable is"
+				" connected, please check that it complies"
+				" with the SFP+ specification\n");
 			return -ETIMEDOUT;
-		msleep(10);
+		}
+		msleep(QT2025C_HEARTB_WAIT);
 	}
 
+	return 0;
+}
+
+static int qt2025c_wait_fw_status_good(struct efx_nic *efx)
+{
+	unsigned long timeout = jiffies + QT2025C_MAX_FWSTART_TIME;
+	int reg;
+
 	/* Wait for firmware status to look good */
 	for (;;) {
 		reg = efx_mdio_read(efx, MDIO_MMD_PCS, PCS_UC8051_STATUS_REG);
@@ -90,7 +117,178 @@ static int qt2025c_wait_reset(struct efx_nic *efx)
 			break;
 		if (time_after(jiffies, timeout))
 			return -ETIMEDOUT;
+		msleep(QT2025C_FWSTART_WAIT);
+	}
+
+	return 0;
+}
+
+static void qt2025c_restart_firmware(struct efx_nic *efx)
+{
+	/* Restart microcontroller execution of firmware from RAM */
+	efx_mdio_write(efx, 3, 0xe854, 0x00c0);
+	efx_mdio_write(efx, 3, 0xe854, 0x0040);
+	msleep(50);
+}
+
+static int qt2025c_wait_reset(struct efx_nic *efx)
+{
+	int rc;
+
+	rc = qt2025c_wait_heartbeat(efx);
+	if (rc != 0)
+		return rc;
+
+	rc = qt2025c_wait_fw_status_good(efx);
+	if (rc == -ETIMEDOUT) {
+		/* Bug 17689: occasionally heartbeat starts but firmware status
+		 * code never progresses beyond 0x00.  Try again, once, after
+		 * restarting execution of the firmware image. */
+		EFX_LOG(efx, "bashing QT2025C microcontroller\n");
+		qt2025c_restart_firmware(efx);
+		rc = qt2025c_wait_heartbeat(efx);
+		if (rc != 0)
+			return rc;
+		rc = qt2025c_wait_fw_status_good(efx);
+	}
+
+	return rc;
+}
+
+static void qt2025c_firmware_id(struct efx_nic *efx)
+{
+	struct qt202x_phy_data *phy_data = efx->phy_data;
+	u8 firmware_id[9];
+	size_t i;
+
+	for (i = 0; i < sizeof(firmware_id); i++)
+		firmware_id[i] = efx_mdio_read(efx, MDIO_MMD_PCS,
+					       PCS_FW_PRODUCT_CODE_1 + i);
+	EFX_INFO(efx, "QT2025C firmware %xr%d v%d.%d.%d.%d [20%02d-%02d-%02d]\n",
+		 (firmware_id[0] << 8) | firmware_id[1], firmware_id[2],
+		 firmware_id[3] >> 4, firmware_id[3] & 0xf,
+		 firmware_id[4], firmware_id[5],
+		 firmware_id[6], firmware_id[7], firmware_id[8]);
+	phy_data->firmware_ver = ((firmware_id[3] & 0xf0) << 20) |
+				 ((firmware_id[3] & 0x0f) << 16) |
+				 (firmware_id[4] << 8) | firmware_id[5];
+}
+
+static void qt2025c_bug17190_workaround(struct efx_nic *efx)
+{
+	struct qt202x_phy_data *phy_data = efx->phy_data;
+
+	/* The PHY can get stuck in a state where it reports PHY_XS and PMA/PMD
+	 * layers up, but PCS down (no block_lock).  If we notice this state
+	 * persisting for a couple of seconds, we switch PMA/PMD loopback
+	 * briefly on and then off again, which is normally sufficient to
+	 * recover it.
+	 */
+	if (efx->link_state.up ||
+	    !efx_mdio_links_ok(efx, MDIO_DEVS_PMAPMD | MDIO_DEVS_PHYXS)) {
+		phy_data->bug17190_in_bad_state = false;
+		return;
+	}
+
+	if (!phy_data->bug17190_in_bad_state) {
+		phy_data->bug17190_in_bad_state = true;
+		phy_data->bug17190_timer = jiffies + BUG17190_INTERVAL;
+		return;
+	}
+
+	if (time_after_eq(jiffies, phy_data->bug17190_timer)) {
+		EFX_LOG(efx, "bashing QT2025C PMA/PMD\n");
+		efx_mdio_set_flag(efx, MDIO_MMD_PMAPMD, MDIO_CTRL1,
+				  MDIO_PMA_CTRL1_LOOPBACK, true);
 		msleep(100);
+		efx_mdio_set_flag(efx, MDIO_MMD_PMAPMD, MDIO_CTRL1,
+				  MDIO_PMA_CTRL1_LOOPBACK, false);
+		phy_data->bug17190_timer = jiffies + BUG17190_INTERVAL;
+	}
+}
+
+static int qt2025c_select_phy_mode(struct efx_nic *efx)
+{
+	struct qt202x_phy_data *phy_data = efx->phy_data;
+	struct falcon_board *board = falcon_board(efx);
+	int reg, rc, i;
+	uint16_t phy_op_mode;
+
+	/* Only 2.0.1.0+ PHY firmware supports the more optimal SFP+
+	 * Self-Configure mode.  Don't attempt any switching if we encounter
+	 * older firmware. */
+	if (phy_data->firmware_ver < 0x02000100)
+		return 0;
+
+	/* In general we will get optimal behaviour in "SFP+ Self-Configure"
+	 * mode; however, that powers down most of the PHY when no module is
+	 * present, so we must use a different mode (any fixed mode will do)
+	 * to be sure that loopbacks will work. */
+	phy_op_mode = (efx->loopback_mode == LOOPBACK_NONE) ? 0x0038 : 0x0020;
+
+	/* Only change mode if really necessary */
+	reg = efx_mdio_read(efx, 1, 0xc319);
+	if ((reg & 0x0038) == phy_op_mode)
+		return 0;
+	EFX_LOG(efx, "Switching PHY to mode 0x%04x\n", phy_op_mode);
+
+	/* This sequence replicates the register writes configured in the boot
+	 * EEPROM (including the differences between board revisions), except
+	 * that the operating mode is changed, and the PHY is prevented from
+	 * unnecessarily reloading the main firmware image again. */
+	efx_mdio_write(efx, 1, 0xc300, 0x0000);
+	/* (Note: this portion of the boot EEPROM sequence, which bit-bashes 9
+	 * STOPs onto the firmware/module I2C bus to reset it, varies across
+	 * board revisions, as the bus is connected to different GPIO/LED
+	 * outputs on the PHY.) */
+	if (board->major == 0 && board->minor < 2) {
+		efx_mdio_write(efx, 1, 0xc303, 0x4498);
+		for (i = 0; i < 9; i++) {
+			efx_mdio_write(efx, 1, 0xc303, 0x4488);
+			efx_mdio_write(efx, 1, 0xc303, 0x4480);
+			efx_mdio_write(efx, 1, 0xc303, 0x4490);
+			efx_mdio_write(efx, 1, 0xc303, 0x4498);
+		}
+	} else {
+		efx_mdio_write(efx, 1, 0xc303, 0x0920);
+		efx_mdio_write(efx, 1, 0xd008, 0x0004);
+		for (i = 0; i < 9; i++) {
+			efx_mdio_write(efx, 1, 0xc303, 0x0900);
+			efx_mdio_write(efx, 1, 0xd008, 0x0005);
+			efx_mdio_write(efx, 1, 0xc303, 0x0920);
+			efx_mdio_write(efx, 1, 0xd008, 0x0004);
+		}
+		efx_mdio_write(efx, 1, 0xc303, 0x4900);
+	}
+	efx_mdio_write(efx, 1, 0xc303, 0x4900);
+	efx_mdio_write(efx, 1, 0xc302, 0x0004);
+	efx_mdio_write(efx, 1, 0xc316, 0x0013);
+	efx_mdio_write(efx, 1, 0xc318, 0x0054);
+	efx_mdio_write(efx, 1, 0xc319, phy_op_mode);
+	efx_mdio_write(efx, 1, 0xc31a, 0x0098);
+	efx_mdio_write(efx, 3, 0x0026, 0x0e00);
+	efx_mdio_write(efx, 3, 0x0027, 0x0013);
+	efx_mdio_write(efx, 3, 0x0028, 0xa528);
+	efx_mdio_write(efx, 1, 0xd006, 0x000a);
+	efx_mdio_write(efx, 1, 0xd007, 0x0009);
+	efx_mdio_write(efx, 1, 0xd008, 0x0004);
+	/* This additional write is not present in the boot EEPROM.  It
+	 * prevents the PHY's internal boot ROM doing another pointless (and
+	 * slow) reload of the firmware image (the microcontroller's code
+	 * memory is not affected by the microcontroller reset). */
+	efx_mdio_write(efx, 1, 0xc317, 0x00ff);
+	efx_mdio_write(efx, 1, 0xc300, 0x0002);
+	msleep(20);
+
+	/* Restart microcontroller execution of firmware from RAM */
+	qt2025c_restart_firmware(efx);
+
+	/* Wait for the microcontroller to be ready again */
+	rc = qt2025c_wait_reset(efx);
+	if (rc < 0) {
+		EFX_ERR(efx, "PHY microcontroller reset during mode switch "
+				"timed out\n");
+		return rc;
 	}
 
 	return 0;
@@ -120,15 +318,9 @@ static int qt202x_reset_phy(struct efx_nic *efx)
 	/* Wait 250ms for the PHY to complete bootup */
 	msleep(250);
 
-	/* Check that all the MMDs we expect are present and responding. We
-	 * expect faults on some if the link is down, but not on the PHY XS */
-	rc = efx_mdio_check_mmds(efx, QT202X_REQUIRED_DEVS, MDIO_DEVS_PHYXS);
-	if (rc < 0)
-		goto fail;
-
 	falcon_board(efx)->type->init_phy(efx);
 
-	return rc;
+	return 0;
 
  fail:
 	EFX_ERR(efx, "PHY reset timed out\n");
@@ -137,6 +329,16 @@ static int qt202x_reset_phy(struct efx_nic *efx)
 
 static int qt202x_phy_probe(struct efx_nic *efx)
 {
+	struct qt202x_phy_data *phy_data;
+
+	phy_data = kzalloc(sizeof(struct qt202x_phy_data), GFP_KERNEL);
+	if (!phy_data)
+		return -ENOMEM;
+	efx->phy_data = phy_data;
+	phy_data->phy_mode = efx->phy_mode;
+	phy_data->bug17190_in_bad_state = false;
+	phy_data->bug17190_timer = 0;
+
 	efx->mdio.mmds = QT202X_REQUIRED_DEVS;
 	efx->mdio.mode_support = MDIO_SUPPORTS_C45 | MDIO_EMULATE_C22;
 	efx->loopback_modes = QT202X_LOOPBACKS | FALCON_XMAC_LOOPBACKS;
@@ -145,7 +347,6 @@ static int qt202x_phy_probe(struct efx_nic *efx)
 
 static int qt202x_phy_init(struct efx_nic *efx)
 {
-	struct qt202x_phy_data *phy_data;
 	u32 devid;
 	int rc;
 
@@ -155,17 +356,14 @@ static int qt202x_phy_init(struct efx_nic *efx)
 		return rc;
 	}
 
-	phy_data = kzalloc(sizeof(struct qt202x_phy_data), GFP_KERNEL);
-	if (!phy_data)
-		return -ENOMEM;
-	efx->phy_data = phy_data;
-
 	devid = efx_mdio_read_id(efx, MDIO_MMD_PHYXS);
 	EFX_INFO(efx, "PHY ID reg %x (OUI %06x model %02x revision %x)\n",
 		 devid, efx_mdio_id_oui(devid), efx_mdio_id_model(devid),
 		 efx_mdio_id_rev(devid));
 
-	phy_data->phy_mode = efx->phy_mode;
+	if (efx->phy_type == PHY_TYPE_QT2025C)
+		qt2025c_firmware_id(efx);
+
 	return 0;
 }
 
@@ -183,6 +381,9 @@ static bool qt202x_phy_poll(struct efx_nic *efx)
 	efx->link_state.fd = true;
 	efx->link_state.fc = efx->wanted_fc;
 
+	if (efx->phy_type == PHY_TYPE_QT2025C)
+		qt2025c_bug17190_workaround(efx);
+
 	return efx->link_state.up != was_up;
 }
 
@@ -191,6 +392,10 @@ static int qt202x_phy_reconfigure(struct efx_nic *efx)
 	struct qt202x_phy_data *phy_data = efx->phy_data;
 
 	if (efx->phy_type == PHY_TYPE_QT2025C) {
+		int rc = qt2025c_select_phy_mode(efx);
+		if (rc)
+			return rc;
+
 		/* There are several different register bits which can
 		 * disable TX (and save power) on direct-attach cables
 		 * or optical transceivers, varying somewhat between
@@ -224,7 +429,7 @@ static void qt202x_phy_get_settings(struct efx_nic *efx, struct ethtool_cmd *ecm
 	mdio45_ethtool_gset(&efx->mdio, ecmd);
 }
 
-static void qt202x_phy_fini(struct efx_nic *efx)
+static void qt202x_phy_remove(struct efx_nic *efx)
 {
 	/* Free the context block */
 	kfree(efx->phy_data);
@@ -236,7 +441,8 @@ struct efx_phy_operations falcon_qt202x_phy_ops = {
 	.init		 = qt202x_phy_init,
 	.reconfigure	 = qt202x_phy_reconfigure,
 	.poll	     	 = qt202x_phy_poll,
-	.fini	  	 = qt202x_phy_fini,
+	.fini		 = efx_port_dummy_op_void,
+	.remove	  	 = qt202x_phy_remove,
 	.get_settings	 = qt202x_phy_get_settings,
 	.set_settings	 = efx_mdio_set_settings,
 };
diff --git a/drivers/net/sfc/selftest.c b/drivers/net/sfc/selftest.c
index 14949bb303a0..250c8827b842 100644
--- a/drivers/net/sfc/selftest.c
+++ b/drivers/net/sfc/selftest.c
@@ -47,7 +47,7 @@ static const unsigned char payload_source[ETH_ALEN] = {
 	0x00, 0x0f, 0x53, 0x1b, 0x1b, 0x1b,
 };
 
-static const char *payload_msg =
+static const char payload_msg[] =
 	"Hello world! This is an Efx loopback test in progress!";
 
 /**
@@ -79,10 +79,14 @@ struct efx_loopback_state {
 static int efx_test_mdio(struct efx_nic *efx, struct efx_self_tests *tests)
 {
 	int rc = 0;
-	int devad = __ffs(efx->mdio.mmds);
+	int devad;
 	u16 physid1, physid2;
 
-	if (efx->phy_type == PHY_TYPE_NONE)
+	if (efx->mdio.mode_support & MDIO_SUPPORTS_C45)
+		devad = __ffs(efx->mdio.mmds);
+	else if (efx->mdio.mode_support & MDIO_SUPPORTS_C22)
+		devad = MDIO_DEVAD_NONE;
+	else
 		return 0;
 
 	mutex_lock(&efx->mac_lock);
diff --git a/drivers/net/sfc/siena.c b/drivers/net/sfc/siena.c
index de07a4f031b2..f8c6771e66d8 100644
--- a/drivers/net/sfc/siena.c
+++ b/drivers/net/sfc/siena.c
@@ -133,6 +133,7 @@ static int siena_probe_port(struct efx_nic *efx)
 
 void siena_remove_port(struct efx_nic *efx)
 {
+	efx->phy_op->remove(efx);
 	efx_nic_free_buffer(efx, &efx->stats_buffer);
 }
 
diff --git a/drivers/net/sfc/tenxpress.c b/drivers/net/sfc/tenxpress.c
index ca11572a49a9..3009c297c135 100644
--- a/drivers/net/sfc/tenxpress.c
+++ b/drivers/net/sfc/tenxpress.c
@@ -202,10 +202,14 @@ static ssize_t set_phy_short_reach(struct device *dev,
 	int rc;
 
 	rtnl_lock();
-	efx_mdio_set_flag(efx, MDIO_MMD_PMAPMD, MDIO_PMA_10GBT_TXPWR,
-			  MDIO_PMA_10GBT_TXPWR_SHORT,
-			  count != 0 && *buf != '0');
-	rc = efx_reconfigure_port(efx);
+	if (efx->state != STATE_RUNNING) {
+		rc = -EBUSY;
+	} else {
+		efx_mdio_set_flag(efx, MDIO_MMD_PMAPMD, MDIO_PMA_10GBT_TXPWR,
+				  MDIO_PMA_10GBT_TXPWR_SHORT,
+				  count != 0 && *buf != '0');
+		rc = efx_reconfigure_port(efx);
+	}
 	rtnl_unlock();
 
 	return rc < 0 ? rc : (ssize_t)count;
@@ -298,36 +302,62 @@ static int tenxpress_init(struct efx_nic *efx)
 	return 0;
 }
 
-static int sfx7101_phy_probe(struct efx_nic *efx)
+static int tenxpress_phy_probe(struct efx_nic *efx)
 {
-	efx->mdio.mmds = TENXPRESS_REQUIRED_DEVS;
-	efx->mdio.mode_support = MDIO_SUPPORTS_C45 | MDIO_EMULATE_C22;
-	efx->loopback_modes = SFX7101_LOOPBACKS | FALCON_XMAC_LOOPBACKS;
-	return 0;
-}
+	struct tenxpress_phy_data *phy_data;
+	int rc;
+
+	/* Allocate phy private storage */
+	phy_data = kzalloc(sizeof(*phy_data), GFP_KERNEL);
+	if (!phy_data)
+		return -ENOMEM;
+	efx->phy_data = phy_data;
+	phy_data->phy_mode = efx->phy_mode;
+
+	/* Create any special files */
+	if (efx->phy_type == PHY_TYPE_SFT9001B) {
+		rc = device_create_file(&efx->pci_dev->dev,
+					&dev_attr_phy_short_reach);
+		if (rc)
+			goto fail;
+	}
+
+	if (efx->phy_type == PHY_TYPE_SFX7101) {
+		efx->mdio.mmds = TENXPRESS_REQUIRED_DEVS;
+		efx->mdio.mode_support = MDIO_SUPPORTS_C45;
+
+		efx->loopback_modes = SFX7101_LOOPBACKS | FALCON_XMAC_LOOPBACKS;
+
+		efx->link_advertising = (ADVERTISED_TP | ADVERTISED_Autoneg |
+					 ADVERTISED_10000baseT_Full);
+	} else {
+		efx->mdio.mmds = TENXPRESS_REQUIRED_DEVS;
+		efx->mdio.mode_support = MDIO_SUPPORTS_C45 | MDIO_EMULATE_C22;
+
+		efx->loopback_modes = (SFT9001_LOOPBACKS |
+				       FALCON_XMAC_LOOPBACKS | 
+				       FALCON_GMAC_LOOPBACKS);
+
+		efx->link_advertising = (ADVERTISED_TP | ADVERTISED_Autoneg |
+					 ADVERTISED_10000baseT_Full |
+					 ADVERTISED_1000baseT_Full |
+					 ADVERTISED_100baseT_Full);
+	}
 
-static int sft9001_phy_probe(struct efx_nic *efx)
-{
-	efx->mdio.mmds = TENXPRESS_REQUIRED_DEVS;
-	efx->mdio.mode_support = MDIO_SUPPORTS_C45 | MDIO_EMULATE_C22;
-	efx->loopback_modes = (SFT9001_LOOPBACKS | FALCON_XMAC_LOOPBACKS |
-			       FALCON_GMAC_LOOPBACKS);
 	return 0;
+
+fail:
+	kfree(efx->phy_data);
+	efx->phy_data = NULL;
+	return rc;
 }
 
 static int tenxpress_phy_init(struct efx_nic *efx)
 {
-	struct tenxpress_phy_data *phy_data;
-	int rc = 0;
+	int rc;
 
 	falcon_board(efx)->type->init_phy(efx);
 
-	phy_data = kzalloc(sizeof(*phy_data), GFP_KERNEL);
-	if (!phy_data)
-		return -ENOMEM;
-	efx->phy_data = phy_data;
-	phy_data->phy_mode = efx->phy_mode;
-
 	if (!(efx->phy_mode & PHY_MODE_SPECIAL)) {
 		if (efx->phy_type == PHY_TYPE_SFT9001A) {
 			int reg;
@@ -341,44 +371,27 @@ static int tenxpress_phy_init(struct efx_nic *efx)
 
 		rc = efx_mdio_wait_reset_mmds(efx, TENXPRESS_REQUIRED_DEVS);
 		if (rc < 0)
-			goto fail;
+			return rc;
 
 		rc = efx_mdio_check_mmds(efx, TENXPRESS_REQUIRED_DEVS, 0);
 		if (rc < 0)
-			goto fail;
+			return rc;
 	}
 
 	rc = tenxpress_init(efx);
 	if (rc < 0)
-		goto fail;
+		return rc;
 
-	/* Initialise advertising flags */
-	efx->link_advertising = (ADVERTISED_TP | ADVERTISED_Autoneg |
-				  ADVERTISED_10000baseT_Full);
-	if (efx->phy_type != PHY_TYPE_SFX7101)
-		efx->link_advertising |= (ADVERTISED_1000baseT_Full |
-					   ADVERTISED_100baseT_Full);
+	/* Reinitialise flow control settings */
 	efx_link_set_wanted_fc(efx, efx->wanted_fc);
 	efx_mdio_an_reconfigure(efx);
 
-	if (efx->phy_type == PHY_TYPE_SFT9001B) {
-		rc = device_create_file(&efx->pci_dev->dev,
-					&dev_attr_phy_short_reach);
-		if (rc)
-			goto fail;
-	}
-
 	schedule_timeout_uninterruptible(HZ / 5); /* 200ms */
 
 	/* Let XGXS and SerDes out of reset */
 	falcon_reset_xaui(efx);
 
 	return 0;
-
- fail:
-	kfree(efx->phy_data);
-	efx->phy_data = NULL;
-	return rc;
 }
 
 /* Perform a "special software reset" on the PHY. The caller is
@@ -589,25 +602,26 @@ static bool tenxpress_phy_poll(struct efx_nic *efx)
 	return !efx_link_state_equal(&efx->link_state, &old_state);
 }
 
-static void tenxpress_phy_fini(struct efx_nic *efx)
+static void sfx7101_phy_fini(struct efx_nic *efx)
 {
 	int reg;
 
+	/* Power down the LNPGA */
+	reg = (1 << PMA_PMD_LNPGA_POWERDOWN_LBN);
+	efx_mdio_write(efx, MDIO_MMD_PMAPMD, PMA_PMD_XCONTROL_REG, reg);
+
+	/* Waiting here ensures that the board fini, which can turn
+	 * off the power to the PHY, won't get run until the LNPGA
+	 * powerdown has been given long enough to complete. */
+	schedule_timeout_uninterruptible(LNPGA_PDOWN_WAIT); /* 200 ms */
+}
+
+static void tenxpress_phy_remove(struct efx_nic *efx)
+{
 	if (efx->phy_type == PHY_TYPE_SFT9001B)
 		device_remove_file(&efx->pci_dev->dev,
 				   &dev_attr_phy_short_reach);
 
-	if (efx->phy_type == PHY_TYPE_SFX7101) {
-		/* Power down the LNPGA */
-		reg = (1 << PMA_PMD_LNPGA_POWERDOWN_LBN);
-		efx_mdio_write(efx, MDIO_MMD_PMAPMD, PMA_PMD_XCONTROL_REG, reg);
-
-		/* Waiting here ensures that the board fini, which can turn
-		 * off the power to the PHY, won't get run until the LNPGA
-		 * powerdown has been given long enough to complete. */
-		schedule_timeout_uninterruptible(LNPGA_PDOWN_WAIT); /* 200 ms */
-	}
-
 	kfree(efx->phy_data);
 	efx->phy_data = NULL;
 }
@@ -819,11 +833,12 @@ static void sft9001_set_npage_adv(struct efx_nic *efx, u32 advertising)
 }
 
 struct efx_phy_operations falcon_sfx7101_phy_ops = {
-	.probe		  = sfx7101_phy_probe,
+	.probe		  = tenxpress_phy_probe,
 	.init             = tenxpress_phy_init,
 	.reconfigure      = tenxpress_phy_reconfigure,
 	.poll             = tenxpress_phy_poll,
-	.fini             = tenxpress_phy_fini,
+	.fini             = sfx7101_phy_fini,
+	.remove		  = tenxpress_phy_remove,
 	.get_settings	  = tenxpress_get_settings,
 	.set_settings	  = tenxpress_set_settings,
 	.set_npage_adv    = sfx7101_set_npage_adv,
@@ -832,11 +847,12 @@ struct efx_phy_operations falcon_sfx7101_phy_ops = {
 };
 
 struct efx_phy_operations falcon_sft9001_phy_ops = {
-	.probe		  = sft9001_phy_probe,
+	.probe		  = tenxpress_phy_probe,
 	.init             = tenxpress_phy_init,
 	.reconfigure      = tenxpress_phy_reconfigure,
 	.poll             = tenxpress_phy_poll,
-	.fini             = tenxpress_phy_fini,
+	.fini             = efx_port_dummy_op_void,
+	.remove		  = tenxpress_phy_remove,
 	.get_settings	  = tenxpress_get_settings,
 	.set_settings	  = tenxpress_set_settings,
 	.set_npage_adv    = sft9001_set_npage_adv,
diff --git a/drivers/net/sfc/tx.c b/drivers/net/sfc/tx.c
index e669f94e821b..a8b70ef6d817 100644
--- a/drivers/net/sfc/tx.c
+++ b/drivers/net/sfc/tx.c
@@ -821,8 +821,6 @@ static void efx_enqueue_unwind(struct efx_tx_queue *tx_queue)
 					   EFX_TXQ_MASK];
 		efx_tsoh_free(tx_queue, buffer);
 		EFX_BUG_ON_PARANOID(buffer->skb);
-		buffer->len = 0;
-		buffer->continuation = true;
 		if (buffer->unmap_len) {
 			unmap_addr = (buffer->dma_addr + buffer->len -
 				      buffer->unmap_len);
@@ -836,6 +834,8 @@ static void efx_enqueue_unwind(struct efx_tx_queue *tx_queue)
 					       PCI_DMA_TODEVICE);
 			buffer->unmap_len = 0;
 		}
+		buffer->len = 0;
+		buffer->continuation = true;
 	}
 }
 
diff --git a/drivers/net/sh_eth.c b/drivers/net/sh_eth.c
index c88bc1013047..7402b858cab7 100644
--- a/drivers/net/sh_eth.c
+++ b/drivers/net/sh_eth.c
@@ -84,6 +84,8 @@ static struct sh_eth_cpu_data sh_eth_my_cpu_data = {
 	.mpr		= 1,
 	.tpauser	= 1,
 	.hw_swap	= 1,
+	.rpadir		= 1,
+	.rpadir_value	= 0x00020000, /* NET_IP_ALIGN assumed to be 2 */
 };
 
 #elif defined(CONFIG_CPU_SUBTYPE_SH7763)
@@ -108,7 +110,7 @@ static void sh_eth_reset(struct net_device *ndev)
 		mdelay(1);
 		cnt--;
 	}
-	if (cnt < 0)
+	if (cnt == 0)
 		printk(KERN_ERR "Device reset fail\n");
 
 	/* Table Init */
@@ -175,7 +177,6 @@ static struct sh_eth_cpu_data sh_eth_my_cpu_data = {
 	.tpauser	= 1,
 	.bculr		= 1,
 	.hw_swap	= 1,
-	.rpadir		= 1,
 	.no_trimd	= 1,
 	.no_ade		= 1,
 };
@@ -501,6 +502,8 @@ static int sh_eth_ring_init(struct net_device *ndev)
 	 */
 	mdp->rx_buf_sz = (ndev->mtu <= 1492 ? PKT_BUF_SZ :
 			  (((ndev->mtu + 26 + 7) & ~7) + 2 + 16));
+	if (mdp->cd->rpadir)
+		mdp->rx_buf_sz += NET_IP_ALIGN;
 
 	/* Allocate RX and TX skb rings */
 	mdp->rx_skbuff = kmalloc(sizeof(*mdp->rx_skbuff) * RX_RING_SIZE,
@@ -715,6 +718,8 @@ static int sh_eth_rx(struct net_device *ndev)
 					pkt_len + 2);
 			skb = mdp->rx_skbuff[entry];
 			mdp->rx_skbuff[entry] = NULL;
+			if (mdp->cd->rpadir)
+				skb_reserve(skb, NET_IP_ALIGN);
 			skb_put(skb, pkt_len);
 			skb->protocol = eth_type_trans(skb, ndev);
 			netif_rx(skb);
diff --git a/drivers/net/sis900.c b/drivers/net/sis900.c
index 9a12d88ac2d9..7360d4bbf75e 100644
--- a/drivers/net/sis900.c
+++ b/drivers/net/sis900.c
@@ -1760,7 +1760,7 @@ static int sis900_rx(struct net_device *net_dev)
 				sis_priv->rx_ring[entry].bufptr, RX_BUF_SIZE,
 				PCI_DMA_FROMDEVICE);
 
-			/* refill the Rx buffer, what if there is not enought
+			/* refill the Rx buffer, what if there is not enough
 			 * memory for new socket buffer ?? */
 			if ((skb = dev_alloc_skb(RX_BUF_SIZE)) == NULL) {
 				/*
@@ -1775,7 +1775,7 @@ static int sis900_rx(struct net_device *net_dev)
 			}
 
 			/* This situation should never happen, but due to
-			   some unknow bugs, it is possible that
+			   some unknown bugs, it is possible that
 			   we are working on NULL sk_buff :-( */
 			if (sis_priv->rx_skbuff[entry] == NULL) {
 				if (netif_msg_rx_err(sis_priv))
diff --git a/drivers/net/skfp/h/smc.h b/drivers/net/skfp/h/smc.h
index 1758d9548361..026a83b9f743 100644
--- a/drivers/net/skfp/h/smc.h
+++ b/drivers/net/skfp/h/smc.h
@@ -393,10 +393,10 @@ struct smt_config {
 					 */
 	u_long	mac_d_max ;		/* MAC : D_Max timer value */
 
-	u_long lct_short ;		/* LCT : error threshhold */
-	u_long lct_medium ;		/* LCT : error threshhold */
-	u_long lct_long ;		/* LCT : error threshhold */
-	u_long lct_extended ;		/* LCT : error threshhold */
+	u_long lct_short ;		/* LCT : error threshold */
+	u_long lct_medium ;		/* LCT : error threshold */
+	u_long lct_long ;		/* LCT : error threshold */
+	u_long lct_extended ;		/* LCT : error threshold */
 } ;
 
 #ifdef	DEBUG
diff --git a/drivers/net/skfp/skfddi.c b/drivers/net/skfp/skfddi.c
index b27156eaf267..db216a728503 100644
--- a/drivers/net/skfp/skfddi.c
+++ b/drivers/net/skfp/skfddi.c
@@ -1002,7 +1002,7 @@ static int skfp_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
 		}
 		break;
 	default:
-		printk("ioctl for %s: unknow cmd: %04x\n", dev->name, ioc.cmd);
+		printk("ioctl for %s: unknown cmd: %04x\n", dev->name, ioc.cmd);
 		status = -EOPNOTSUPP;
 
 	}			// switch
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index 3943d89afb2b..67249c3c9f50 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -1025,11 +1025,8 @@ static void sky2_prefetch_init(struct sky2_hw *hw, u32 qaddr,
 static inline struct sky2_tx_le *get_tx_le(struct sky2_port *sky2, u16 *slot)
 {
 	struct sky2_tx_le *le = sky2->tx_le + *slot;
-	struct tx_ring_info *re = sky2->tx_ring + *slot;
 
 	*slot = RING_NEXT(*slot, sky2->tx_ring_size);
-	re->flags = 0;
-	re->skb = NULL;
 	le->ctrl = 0;
 	return le;
 }
@@ -1622,8 +1619,7 @@ static unsigned tx_le_req(const struct sk_buff *skb)
 	return count;
 }
 
-static void sky2_tx_unmap(struct pci_dev *pdev,
-			  const struct tx_ring_info *re)
+static void sky2_tx_unmap(struct pci_dev *pdev, struct tx_ring_info *re)
 {
 	if (re->flags & TX_MAP_SINGLE)
 		pci_unmap_single(pdev, pci_unmap_addr(re, mapaddr),
@@ -1633,6 +1629,7 @@ static void sky2_tx_unmap(struct pci_dev *pdev,
 		pci_unmap_page(pdev, pci_unmap_addr(re, mapaddr),
 			       pci_unmap_len(re, maplen),
 			       PCI_DMA_TODEVICE);
+	re->flags = 0;
 }
 
 /*
@@ -1839,6 +1836,7 @@ static void sky2_tx_complete(struct sky2_port *sky2, u16 done)
 			dev->stats.tx_packets++;
 			dev->stats.tx_bytes += skb->len;
 
+			re->skb = NULL;
 			dev_kfree_skb_any(skb);
 
 			sky2->tx_next = RING_NEXT(idx, sky2->tx_ring_size);
@@ -1848,7 +1846,8 @@ static void sky2_tx_complete(struct sky2_port *sky2, u16 done)
 	sky2->tx_cons = idx;
 	smp_mb();
 
-	if (tx_avail(sky2) > MAX_SKB_TX_LE + 4)
+	/* Wake unless it's detached, and called e.g. from sky2_down() */
+	if (tx_avail(sky2) > MAX_SKB_TX_LE + 4 && netif_device_present(dev))
 		netif_wake_queue(dev);
 }
 
@@ -2017,7 +2016,7 @@ static void sky2_link_down(struct sky2_port *sky2)
 
 	netif_carrier_off(sky2->netdev);
 
-	/* Turn on link LED */
+	/* Turn off link LED */
 	sky2_write8(hw, SK_REG(port, LNK_LED_REG), LINKLED_OFF);
 
 	if (netif_msg_link(sky2))
@@ -2152,7 +2151,9 @@ static void sky2_qlink_intr(struct sky2_hw *hw)
 
 	/* reset PHY Link Detect */
 	phy = sky2_pci_read16(hw, PSM_CONFIG_REG4);
+	sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_ON);
 	sky2_pci_write16(hw, PSM_CONFIG_REG4, phy | 1);
+	sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_OFF);
 
 	sky2_link_up(sky2);
 }
@@ -2968,8 +2969,13 @@ static int __devinit sky2_init(struct sky2_hw *hw)
 		break;
 
 	case CHIP_ID_YUKON_UL_2:
+		hw->flags = SKY2_HW_GIGABIT
+			| SKY2_HW_ADV_POWER_CTL;
+		break;
+
 	case CHIP_ID_YUKON_OPT:
 		hw->flags = SKY2_HW_GIGABIT
+			| SKY2_HW_NEW_LE
 			| SKY2_HW_ADV_POWER_CTL;
 		break;
 
@@ -3077,6 +3083,7 @@ static void sky2_reset(struct sky2_hw *hw)
 		reg <<= PSM_CONFIG_REG4_TIMER_PHY_LINK_DETECT_BASE;
 
 		/* reset PHY Link Detect */
+		sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_ON);
 		sky2_pci_write16(hw, PSM_CONFIG_REG4,
 				 reg | PSM_CONFIG_REG4_RST_PHY_LINK_DETECT);
 		sky2_pci_write16(hw, PSM_CONFIG_REG4, reg);
@@ -3094,6 +3101,7 @@ static void sky2_reset(struct sky2_hw *hw)
 			/* restore the PCIe Link Control register */
 			sky2_pci_write16(hw, cap + PCI_EXP_LNKCTL, reg);
 		}
+		sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_OFF);
 
 		/* re-enable PEX PM in PEX PHY debug reg. 8 (clear bit 12) */
 		sky2_write32(hw, Y2_PEX_PHY_DATA, PEX_DB_ACCESS | (0x08UL << 16));
@@ -3231,6 +3239,27 @@ static inline u8 sky2_wol_supported(const struct sky2_hw *hw)
 	return sky2_is_copper(hw) ? (WAKE_PHY | WAKE_MAGIC) : 0;
 }
 
+static void sky2_hw_set_wol(struct sky2_hw *hw)
+{
+	int wol = 0;
+	int i;
+
+	for (i = 0; i < hw->ports; i++) {
+		struct net_device *dev = hw->dev[i];
+		struct sky2_port *sky2 = netdev_priv(dev);
+
+		if (sky2->wol)
+			wol = 1;
+	}
+
+	if (hw->chip_id == CHIP_ID_YUKON_EC_U ||
+	    hw->chip_id == CHIP_ID_YUKON_EX ||
+	    hw->chip_id == CHIP_ID_YUKON_FE_P)
+		sky2_write32(hw, B0_CTST, wol ? Y2_HW_WOL_ON : Y2_HW_WOL_OFF);
+
+	device_set_wakeup_enable(&hw->pdev->dev, wol);
+}
+
 static void sky2_get_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
 {
 	const struct sky2_port *sky2 = netdev_priv(dev);
@@ -3250,13 +3279,7 @@ static int sky2_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
 
 	sky2->wol = wol->wolopts;
 
-	if (hw->chip_id == CHIP_ID_YUKON_EC_U ||
-	    hw->chip_id == CHIP_ID_YUKON_EX ||
-	    hw->chip_id == CHIP_ID_YUKON_FE_P)
-		sky2_write32(hw, B0_CTST, sky2->wol
-			     ? Y2_HW_WOL_ON : Y2_HW_WOL_OFF);
-
-	device_set_wakeup_enable(&hw->pdev->dev, sky2->wol);
+	sky2_hw_set_wol(hw);
 
 	if (!netif_running(dev))
 		sky2_wol_init(sky2);
@@ -4521,7 +4544,7 @@ static const char *sky2_name(u8 chipid, char *buf, int sz)
 		"Optima",	/* 0xbc */
 	};
 
-	if (chipid >= CHIP_ID_YUKON_XL && chipid < CHIP_ID_YUKON_OPT)
+	if (chipid >= CHIP_ID_YUKON_XL && chipid <= CHIP_ID_YUKON_OPT)
 		strncpy(buf, name[chipid - CHIP_ID_YUKON_XL], sz);
 	else
 		snprintf(buf, sz, "(chip %#x)", chipid);
@@ -4688,6 +4711,7 @@ static int __devinit sky2_probe(struct pci_dev *pdev,
 	INIT_WORK(&hw->restart_work, sky2_restart);
 
 	pci_set_drvdata(pdev, hw);
+	pdev->d3_delay = 150;
 
 	return 0;
 
diff --git a/drivers/net/smc91x.c b/drivers/net/smc91x.c
index ae4983a5127d..ea4fae79d6ec 100644
--- a/drivers/net/smc91x.c
+++ b/drivers/net/smc91x.c
@@ -534,9 +534,9 @@ static inline void  smc_rcv(struct net_device *dev)
 #define smc_special_lock(lock, flags)		spin_lock_irqsave(lock, flags)
 #define smc_special_unlock(lock, flags) 	spin_unlock_irqrestore(lock, flags)
 #else
-#define smc_special_trylock(lock, flags)	(1)
-#define smc_special_lock(lock, flags)   	do { } while (0)
-#define smc_special_unlock(lock, flags)	do { } while (0)
+#define smc_special_trylock(lock, flags)	(flags == flags)
+#define smc_special_lock(lock, flags)   	do { flags = 0; } while (0)
+#define smc_special_unlock(lock, flags)	do { flags = 0; } while (0)
 #endif
 
 /*
@@ -2387,7 +2387,7 @@ static int smc_drv_resume(struct device *dev)
 
 	if (ndev) {
 		struct smc_local *lp = netdev_priv(ndev);
-		smc_enable_device(dev);
+		smc_enable_device(pdev);
 		if (netif_running(ndev)) {
 			smc_reset(ndev);
 			smc_enable(ndev);
diff --git a/drivers/net/smc91x.h b/drivers/net/smc91x.h
index 7815bfc300f5..54799544bda3 100644
--- a/drivers/net/smc91x.h
+++ b/drivers/net/smc91x.h
@@ -206,21 +206,6 @@ SMC_outw(u16 val, void __iomem *ioaddr, int reg)
 	}
 }
 
-#elif	defined(CONFIG_ARCH_OMAP)
-
-/* We can only do 16-bit reads and writes in the static memory space. */
-#define SMC_CAN_USE_8BIT	0
-#define SMC_CAN_USE_16BIT	1
-#define SMC_CAN_USE_32BIT	0
-#define SMC_IO_SHIFT		0
-#define SMC_NOWAIT		1
-
-#define SMC_inw(a, r)		readw((a) + (r))
-#define SMC_outw(v, a, r)	writew(v, (a) + (r))
-#define SMC_insw(a, r, p, l)	readsw((a) + (r), p, l)
-#define SMC_outsw(a, r, p, l)	writesw((a) + (r), p, l)
-#define	SMC_IRQ_FLAGS		(-1)	/* from resource */
-
 #elif	defined(CONFIG_SH_SH4202_MICRODEV)
 
 #define SMC_CAN_USE_8BIT	0
diff --git a/drivers/net/smsc911x.c b/drivers/net/smsc911x.c
index 4d0d5c56bed8..494cd91ea39c 100644
--- a/drivers/net/smsc911x.c
+++ b/drivers/net/smsc911x.c
@@ -816,7 +816,7 @@ static int smsc911x_mii_probe(struct net_device *dev)
 	SMSC_TRACE(HW, "Passed Loop Back Test");
 #endif				/* USE_PHY_WORK_AROUND */
 
-	SMSC_TRACE(HW, "phy initialised succesfully");
+	SMSC_TRACE(HW, "phy initialised successfully");
 	return 0;
 }
 
@@ -2154,7 +2154,7 @@ static int smsc911x_resume(struct device *dev)
 	return (to == 0) ? -EIO : 0;
 }
 
-static struct dev_pm_ops smsc911x_pm_ops = {
+static const struct dev_pm_ops smsc911x_pm_ops = {
 	.suspend	= smsc911x_suspend,
 	.resume		= smsc911x_resume,
 };
diff --git a/drivers/net/smsc911x.h b/drivers/net/smsc911x.h
index b5716bd8a597..016360c65ce2 100644
--- a/drivers/net/smsc911x.h
+++ b/drivers/net/smsc911x.h
@@ -30,7 +30,7 @@
 #define SMSC_NAPI_WEIGHT	16
 
 /* implements a PHY loopback test at initialisation time, to ensure a packet
- * can be succesfully looped back */
+ * can be successfully looped back */
 #define USE_PHY_WORK_AROUND
 
 #define DPRINTK(nlevel, klevel, fmt, args...) \
diff --git a/drivers/net/spider_net.c b/drivers/net/spider_net.c
index 782910cf220f..218524857bfc 100644
--- a/drivers/net/spider_net.c
+++ b/drivers/net/spider_net.c
@@ -410,7 +410,7 @@ spider_net_free_rx_chain_contents(struct spider_net_card *card)
  * @card: card structure
  * @descr: descriptor to re-init
  *
- * Return 0 on succes, <0 on failure.
+ * Return 0 on success, <0 on failure.
  *
  * Allocates a new rx skb, iommu-maps it and attaches it to the
  * descriptor. Mark the descriptor as activated, ready-to-use.
diff --git a/drivers/net/starfire.c b/drivers/net/starfire.c
index 95db60adde41..f9521136a869 100644
--- a/drivers/net/starfire.c
+++ b/drivers/net/starfire.c
@@ -1063,7 +1063,7 @@ static int netdev_open(struct net_device *dev)
 	if (retval) {
 		printk(KERN_ERR "starfire: Failed to load firmware \"%s\"\n",
 		       FIRMWARE_RX);
-		return retval;
+		goto out_init;
 	}
 	if (fw_rx->size % 4) {
 		printk(KERN_ERR "starfire: bogus length %zu in \"%s\"\n",
@@ -1108,6 +1108,9 @@ out_tx:
 	release_firmware(fw_tx);
 out_rx:
 	release_firmware(fw_rx);
+out_init:
+	if (retval)
+		netdev_close(dev);
 	return retval;
 }
 
diff --git a/drivers/net/stmmac/gmac.c b/drivers/net/stmmac/gmac.c
index b624bb5bae0a..52586ee68953 100644
--- a/drivers/net/stmmac/gmac.c
+++ b/drivers/net/stmmac/gmac.c
@@ -112,7 +112,7 @@ static void gmac_dma_operation_mode(unsigned long ioaddr, int txmode,
 			      " (threshold = %d)\n", txmode);
 		csr6 &= ~DMA_CONTROL_TSF;
 		csr6 &= DMA_CONTROL_TC_TX_MASK;
-		/* Set the transmit threashold */
+		/* Set the transmit threshold */
 		if (txmode <= 32)
 			csr6 |= DMA_CONTROL_TTC_32;
 		else if (txmode <= 64)
diff --git a/drivers/net/stmmac/gmac.h b/drivers/net/stmmac/gmac.h
index 684a363120a9..2e82d6c9a148 100644
--- a/drivers/net/stmmac/gmac.h
+++ b/drivers/net/stmmac/gmac.h
@@ -154,14 +154,14 @@ enum rx_tx_priority_ratio {
 #define DMA_CONTROL_DT		0x04000000 /* Disable Drop TCP/IP csum error */
 #define DMA_CONTROL_RSF		0x02000000 /* Receive Store and Forward */
 #define DMA_CONTROL_DFF		0x01000000 /* Disaable flushing */
-/* Theshold for Activating the FC */
+/* Threshold for Activating the FC */
 enum rfa {
 	act_full_minus_1 = 0x00800000,
 	act_full_minus_2 = 0x00800200,
 	act_full_minus_3 = 0x00800400,
 	act_full_minus_4 = 0x00800600,
 };
-/* Theshold for Deactivating the FC */
+/* Threshold for Deactivating the FC */
 enum rfd {
 	deac_full_minus_1 = 0x00400000,
 	deac_full_minus_2 = 0x00400800,
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index 3a74d2168598..7f82b0238e08 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -4,7 +4,7 @@
  * Copyright (C) 2001, 2002, 2003, 2004 David S. Miller (davem@redhat.com)
  * Copyright (C) 2001, 2002, 2003 Jeff Garzik (jgarzik@pobox.com)
  * Copyright (C) 2004 Sun Microsystems Inc.
- * Copyright (C) 2005-2009 Broadcom Corporation.
+ * Copyright (C) 2005-2010 Broadcom Corporation.
  *
  * Firmware is:
  *	Derived from proprietary unpublished source code,
@@ -68,8 +68,8 @@
 
 #define DRV_MODULE_NAME		"tg3"
 #define PFX DRV_MODULE_NAME	": "
-#define DRV_MODULE_VERSION	"3.105"
-#define DRV_MODULE_RELDATE	"December 2, 2009"
+#define DRV_MODULE_VERSION	"3.106"
+#define DRV_MODULE_RELDATE	"January 12, 2010"
 
 #define TG3_DEF_MAC_MODE	0
 #define TG3_DEF_RX_MODE		0
@@ -1037,7 +1037,11 @@ static void tg3_mdio_start(struct tg3 *tp)
 		else
 			tp->phy_addr = 1;
 
-		is_serdes = tr32(SG_DIG_STATUS) & SG_DIG_IS_SERDES;
+		if (tp->pci_chip_rev_id != CHIPREV_ID_5717_A0)
+			is_serdes = tr32(SG_DIG_STATUS) & SG_DIG_IS_SERDES;
+		else
+			is_serdes = tr32(TG3_CPMU_PHY_STRAP) &
+				    TG3_CPMU_PHY_STRAP_IS_SERDES;
 		if (is_serdes)
 			tp->phy_addr += 7;
 	} else
@@ -4693,8 +4697,9 @@ next_pkt:
 		(*post_ptr)++;
 
 		if (unlikely(rx_std_posted >= tp->rx_std_max_post)) {
-			u32 idx = *post_ptr % TG3_RX_RING_SIZE;
-			tw32_rx_mbox(TG3_RX_STD_PROD_IDX_REG, idx);
+			tpr->rx_std_prod_idx = std_prod_idx % TG3_RX_RING_SIZE;
+			tw32_rx_mbox(TG3_RX_STD_PROD_IDX_REG,
+				     tpr->rx_std_prod_idx);
 			work_mask &= ~RXD_OPAQUE_RING_STD;
 			rx_std_posted = 0;
 		}
@@ -7742,7 +7747,7 @@ static int tg3_reset_hw(struct tg3 *tp, int reset_phy)
 	     ((u64) tpr->rx_std_mapping >> 32));
 	tw32(RCVDBDI_STD_BD + TG3_BDINFO_HOST_ADDR + TG3_64BIT_REG_LOW,
 	     ((u64) tpr->rx_std_mapping & 0xffffffff));
-	if (!(tp->tg3_flags3 & TG3_FLG3_5755_PLUS))
+	if (GET_ASIC_REV(tp->pci_chip_rev_id) != ASIC_REV_5717)
 		tw32(RCVDBDI_STD_BD + TG3_BDINFO_NIC_ADDR,
 		     NIC_SRAM_RX_BUFFER_DESC);
 
@@ -12122,7 +12127,8 @@ static void __devinit tg3_get_eeprom_hw_cfg(struct tg3 *tp)
 
 		tp->phy_id = eeprom_phy_id;
 		if (eeprom_phy_serdes) {
-			if (tp->tg3_flags2 & TG3_FLG2_5780_CLASS)
+			if ((tp->tg3_flags2 & TG3_FLG2_5780_CLASS) ||
+			    GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5717)
 				tp->tg3_flags2 |= TG3_FLG2_MII_SERDES;
 			else
 				tp->tg3_flags2 |= TG3_FLG2_PHY_SERDES;
@@ -13384,6 +13390,11 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
 	if (err)
 		return err;
 
+	if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5717 &&
+	    (tp->pci_chip_rev_id != CHIPREV_ID_5717_A0 ||
+		 (tp->tg3_flags2 & TG3_FLG2_MII_SERDES)))
+		return -ENOTSUPP;
+
 	/* Initialize data/descriptor byte/word swapping. */
 	val = tr32(GRC_MODE);
 	val &= GRC_MODE_HOST_STACKUP;
diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h
index cd30889650f8..8a167912902b 100644
--- a/drivers/net/tg3.h
+++ b/drivers/net/tg3.h
@@ -4,6 +4,7 @@
  * Copyright (C) 2001, 2002, 2003, 2004 David S. Miller (davem@redhat.com)
  * Copyright (C) 2001 Jeff Garzik (jgarzik@pobox.com)
  * Copyright (C) 2004 Sun Microsystems Inc.
+ * Copyright (C) 2007-2010 Broadcom Corporation.
  */
 
 #ifndef _T3_H
@@ -1054,6 +1055,8 @@
 #define  CPMU_MUTEX_REQ_DRIVER		 0x00001000
 #define TG3_CPMU_MUTEX_GNT		0x00003660
 #define  CPMU_MUTEX_GNT_DRIVER		 0x00001000
+#define TG3_CPMU_PHY_STRAP		0x00003664
+#define TG3_CPMU_PHY_STRAP_IS_SERDES	 0x00000020
 /* 0x3664 --> 0x3800 unused */
 
 /* Mbuf cluster free registers */
diff --git a/drivers/net/tokenring/ibmtr.c b/drivers/net/tokenring/ibmtr.c
index 5db0270957ac..66272f2a0758 100644
--- a/drivers/net/tokenring/ibmtr.c
+++ b/drivers/net/tokenring/ibmtr.c
@@ -96,7 +96,7 @@
  *
  *      Change by Mike Sullivan et al.:
  *      + added turbo card support. No need to use lanaid to configure
- *      the adapter into isa compatiblity mode.
+ *      the adapter into isa compatibility mode.
  *
  *      Changes by Burt Silverman to allow the computer to behave nicely when
  *	a cable is pulled or not in place, or a PCMCIA card is removed hot.
diff --git a/drivers/net/tokenring/smctr.c b/drivers/net/tokenring/smctr.c
index 427a8970b6fe..5401d86a7be4 100644
--- a/drivers/net/tokenring/smctr.c
+++ b/drivers/net/tokenring/smctr.c
@@ -426,7 +426,7 @@ static int smctr_alloc_shared_memory(struct net_device *dev)
         smctr_malloc(dev, 1L);
 
         /* Allocate Non-MAC receive data buffers.
-         * To guarantee a minimum of 256 contigous memory to
+         * To guarantee a minimum of 256 contiguous memory to
          * UM_Receive_Packet's lookahead pointer, before a page
          * change or ring end is encountered, place each rx buffer on
          * a 256 byte boundary.
diff --git a/drivers/net/tulip/Kconfig b/drivers/net/tulip/Kconfig
index 1cc8cf4425d1..516713fa0a05 100644
--- a/drivers/net/tulip/Kconfig
+++ b/drivers/net/tulip/Kconfig
@@ -101,6 +101,10 @@ config TULIP_NAPI_HW_MITIGATION
 
 	  If in doubt, say Y.
 
+config TULIP_DM910X
+	def_bool y
+	depends on TULIP && SPARC
+
 config DE4X5
 	tristate "Generic DECchip & DIGITAL EtherWORKS PCI/EISA"
 	depends on PCI || EISA
diff --git a/drivers/net/tulip/dmfe.c b/drivers/net/tulip/dmfe.c
index ad63621913c3..6f44ebf58910 100644
--- a/drivers/net/tulip/dmfe.c
+++ b/drivers/net/tulip/dmfe.c
@@ -92,6 +92,10 @@
 #include <asm/uaccess.h>
 #include <asm/irq.h>
 
+#ifdef CONFIG_TULIP_DM910X
+#include <linux/of.h>
+#endif
+
 
 /* Board/System/Debug information/definition ---------------- */
 #define PCI_DM9132_ID   0x91321282      /* Davicom DM9132 ID */
@@ -377,6 +381,23 @@ static int __devinit dmfe_init_one (struct pci_dev *pdev,
 	if (!printed_version++)
 		printk(version);
 
+	/*
+	 *	SPARC on-board DM910x chips should be handled by the main
+	 *	tulip driver, except for early DM9100s.
+	 */
+#ifdef CONFIG_TULIP_DM910X
+	if ((ent->driver_data == PCI_DM9100_ID && pdev->revision >= 0x30) ||
+	    ent->driver_data == PCI_DM9102_ID) {
+		struct device_node *dp = pci_device_to_OF_node(pdev);
+
+		if (dp && of_get_property(dp, "local-mac-address", NULL)) {
+			printk(KERN_INFO DRV_NAME
+			       ": skipping on-board DM910x (use tulip)\n");
+			return -ENODEV;
+		}
+	}
+#endif
+
 	/* Init network device */
 	dev = alloc_etherdev(sizeof(*db));
 	if (dev == NULL)
diff --git a/drivers/net/tulip/tulip_core.c b/drivers/net/tulip/tulip_core.c
index 0fa3140d65bf..20696b5d60a5 100644
--- a/drivers/net/tulip/tulip_core.c
+++ b/drivers/net/tulip/tulip_core.c
@@ -196,9 +196,13 @@ struct tulip_chip_table tulip_tbl[] = {
 	| HAS_NWAY | HAS_PCI_MWI, tulip_timer, tulip_media_task },
 
   /* DM910X */
+#ifdef CONFIG_TULIP_DM910X
   { "Davicom DM9102/DM9102A", 128, 0x0001ebef,
 	HAS_MII | HAS_MEDIA_TABLE | CSR12_IN_SROM | HAS_ACPI,
 	tulip_timer, tulip_media_task },
+#else
+  { NULL },
+#endif
 
   /* RS7112 */
   { "Conexant LANfinity", 256, 0x0001ebef,
@@ -228,8 +232,10 @@ static struct pci_device_id tulip_pci_tbl[] = {
 	{ 0x1259, 0xa120, PCI_ANY_ID, PCI_ANY_ID, 0, 0, COMET },
 	{ 0x11F6, 0x9881, PCI_ANY_ID, PCI_ANY_ID, 0, 0, COMPEX9881 },
 	{ 0x8086, 0x0039, PCI_ANY_ID, PCI_ANY_ID, 0, 0, I21145 },
+#ifdef CONFIG_TULIP_DM910X
 	{ 0x1282, 0x9100, PCI_ANY_ID, PCI_ANY_ID, 0, 0, DM910X },
 	{ 0x1282, 0x9102, PCI_ANY_ID, PCI_ANY_ID, 0, 0, DM910X },
+#endif
 	{ 0x1113, 0x1216, PCI_ANY_ID, PCI_ANY_ID, 0, 0, COMET },
 	{ 0x1113, 0x1217, PCI_ANY_ID, PCI_ANY_ID, 0, 0, MX98715 },
 	{ 0x1113, 0x9511, PCI_ANY_ID, PCI_ANY_ID, 0, 0, COMET },
@@ -243,6 +249,7 @@ static struct pci_device_id tulip_pci_tbl[] = {
 	{ 0x17B3, 0xAB08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, COMET },
 	{ 0x10b7, 0x9300, PCI_ANY_ID, PCI_ANY_ID, 0, 0, COMET }, /* 3Com 3CSOHO100B-TX */
 	{ 0x14ea, 0xab08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, COMET }, /* Planex FNW-3602-TX */
+	{ 0x1414, 0x0001, PCI_ANY_ID, PCI_ANY_ID, 0, 0, COMET }, /* Microsoft MN-120 */
 	{ 0x1414, 0x0002, PCI_ANY_ID, PCI_ANY_ID, 0, 0, COMET },
 	{ } /* terminate list */
 };
@@ -1299,18 +1306,30 @@ static int __devinit tulip_init_one (struct pci_dev *pdev,
 	}
 
 	/*
-	 *	Early DM9100's need software CRC and the DMFE driver
+	 *	DM910x chips should be handled by the dmfe driver, except
+	 *	on-board chips on SPARC systems.  Also, early DM9100s need
+	 *	software CRC which only the dmfe driver supports.
 	 */
 
-	if (pdev->vendor == 0x1282 && pdev->device == 0x9100)
-	{
-		/* Read Chip revision */
-		if (pdev->revision < 0x30)
-		{
-			printk(KERN_ERR PFX "skipping early DM9100 with Crc bug (use dmfe)\n");
+#ifdef CONFIG_TULIP_DM910X
+	if (chip_idx == DM910X) {
+		struct device_node *dp;
+
+		if (pdev->vendor == 0x1282 && pdev->device == 0x9100 &&
+		    pdev->revision < 0x30) {
+			printk(KERN_INFO PFX
+			       "skipping early DM9100 with Crc bug (use dmfe)\n");
+			return -ENODEV;
+		}
+
+		dp = pci_device_to_OF_node(pdev);
+		if (!(dp && of_get_property(dp, "local-mac-address", NULL))) {
+			printk(KERN_INFO PFX
+			       "skipping DM910x expansion card (use dmfe)\n");
 			return -ENODEV;
 		}
 	}
+#endif
 
 	/*
 	 *	Looks for early PCI chipsets where people report hangs
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 01e99f22210e..2834a01bae24 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -849,13 +849,13 @@ static void tun_sock_write_space(struct sock *sk)
 	if (sk->sk_sleep && waitqueue_active(sk->sk_sleep))
 		wake_up_interruptible_sync(sk->sk_sleep);
 
-	tun = container_of(sk, struct tun_sock, sk)->tun;
+	tun = tun_sk(sk)->tun;
 	kill_fasync(&tun->fasync, SIGIO, POLL_OUT);
 }
 
 static void tun_sock_destruct(struct sock *sk)
 {
-	free_netdev(container_of(sk, struct tun_sock, sk)->tun->dev);
+	free_netdev(tun_sk(sk)->tun->dev);
 }
 
 static struct proto tun_proto = {
@@ -990,7 +990,7 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
 		sk->sk_write_space = tun_sock_write_space;
 		sk->sk_sndbuf = INT_MAX;
 
-		container_of(sk, struct tun_sock, sk)->tun = tun;
+		tun_sk(sk)->tun = tun;
 
 		security_tun_dev_post_create(sk);
 
diff --git a/drivers/net/ucc_geth.c b/drivers/net/ucc_geth.c
index 9f44c99777a8..eb8fe7e16c6c 100644
--- a/drivers/net/ucc_geth.c
+++ b/drivers/net/ucc_geth.c
@@ -1563,7 +1563,10 @@ static int ugeth_disable(struct ucc_geth_private *ugeth, enum comm_dir mode)
 
 static void ugeth_quiesce(struct ucc_geth_private *ugeth)
 {
-	/* Wait for and prevent any further xmits. */
+	/* Prevent any further xmits, plus detach the device. */
+	netif_device_detach(ugeth->ndev);
+
+	/* Wait for any current xmits to finish. */
 	netif_tx_disable(ugeth->ndev);
 
 	/* Disable the interrupt to avoid NAPI rescheduling. */
@@ -1577,7 +1580,7 @@ static void ugeth_activate(struct ucc_geth_private *ugeth)
 {
 	napi_enable(&ugeth->napi);
 	enable_irq(ugeth->ug_info->uf_info.irq);
-	netif_tx_wake_all_queues(ugeth->ndev);
+	netif_device_attach(ugeth->ndev);
 }
 
 /* Called every time the controller might need to be made
@@ -1648,25 +1651,28 @@ static void adjust_link(struct net_device *dev)
 			ugeth->oldspeed = phydev->speed;
 		}
 
-		/*
-		 * To change the MAC configuration we need to disable the
-		 * controller. To do so, we have to either grab ugeth->lock,
-		 * which is a bad idea since 'graceful stop' commands might
-		 * take quite a while, or we can quiesce driver's activity.
-		 */
-		ugeth_quiesce(ugeth);
-		ugeth_disable(ugeth, COMM_DIR_RX_AND_TX);
-
-		out_be32(&ug_regs->maccfg2, tempval);
-		out_be32(&uf_regs->upsmr, upsmr);
-
-		ugeth_enable(ugeth, COMM_DIR_RX_AND_TX);
-		ugeth_activate(ugeth);
-
 		if (!ugeth->oldlink) {
 			new_state = 1;
 			ugeth->oldlink = 1;
 		}
+
+		if (new_state) {
+			/*
+			 * To change the MAC configuration we need to disable
+			 * the controller. To do so, we have to either grab
+			 * ugeth->lock, which is a bad idea since 'graceful
+			 * stop' commands might take quite a while, or we can
+			 * quiesce driver's activity.
+			 */
+			ugeth_quiesce(ugeth);
+			ugeth_disable(ugeth, COMM_DIR_RX_AND_TX);
+
+			out_be32(&ug_regs->maccfg2, tempval);
+			out_be32(&uf_regs->upsmr, upsmr);
+
+			ugeth_enable(ugeth, COMM_DIR_RX_AND_TX);
+			ugeth_activate(ugeth);
+		}
 	} else if (ugeth->oldlink) {
 			new_state = 1;
 			ugeth->oldlink = 0;
@@ -3273,13 +3279,12 @@ static int ucc_geth_tx(struct net_device *dev, u8 txQ)
 		/* Handle the transmitted buffer and release */
 		/* the BD to be used with the current frame  */
 
-		if ((bd == ugeth->txBd[txQ]) && (netif_queue_stopped(dev) == 0))
+		skb = ugeth->tx_skbuff[txQ][ugeth->skb_dirtytx[txQ]];
+		if (!skb)
 			break;
 
 		dev->stats.tx_packets++;
 
-		skb = ugeth->tx_skbuff[txQ][ugeth->skb_dirtytx[txQ]];
-
 		if (skb_queue_len(&ugeth->rx_recycle) < RX_BD_RING_LEN &&
 			     skb_recycle_check(skb,
 				    ugeth->ug_info->uf_info.max_rx_buf_length +
@@ -3601,6 +3606,7 @@ static int ucc_geth_suspend(struct of_device *ofdev, pm_message_t state)
 	if (!netif_running(ndev))
 		return 0;
 
+	netif_device_detach(ndev);
 	napi_disable(&ugeth->napi);
 
 	/*
@@ -3659,7 +3665,7 @@ static int ucc_geth_resume(struct of_device *ofdev)
 	phy_start(ugeth->phydev);
 
 	napi_enable(&ugeth->napi);
-	netif_start_queue(ndev);
+	netif_device_attach(ndev);
 
 	return 0;
 }
@@ -3798,7 +3804,7 @@ static int ucc_geth_probe(struct of_device* ofdev, const struct of_device_id *ma
 		prop = of_get_property(np, "tx-clock", NULL);
 		if (!prop) {
 			printk(KERN_ERR
-				"ucc_geth: mising tx-clock-name property\n");
+				"ucc_geth: missing tx-clock-name property\n");
 			return -EINVAL;
 		}
 		if ((*prop < QE_CLK_NONE) || (*prop > QE_CLK24)) {
diff --git a/drivers/net/ucc_geth.h b/drivers/net/ucc_geth.h
index 03a6ca016d5a..ef1fbeb11c6e 100644
--- a/drivers/net/ucc_geth.h
+++ b/drivers/net/ucc_geth.h
@@ -80,16 +80,16 @@ struct ucc_geth {
 				   frames) received that were between 128
 				   (Including FCS length==4) and 255 octets */
 	u32 txok;		/* Total number of octets residing in frames
-				   that where involved in succesfull
+				   that where involved in successfull
 				   transmission */
 	u16 txcf;		/* Total number of PAUSE control frames
 				   transmitted by this MAC */
 	u8 res4[0x2];
 	u32 tmca;		/* Total number of frames that were transmitted
-				   succesfully with the group address bit set
+				   successfully with the group address bit set
 				   that are not broadcast frames */
 	u32 tbca;		/* Total number of frames transmitted
-				   succesfully that had destination address
+				   successfully that had destination address
 				   field equal to the broadcast address */
 	u32 rxfok;		/* Total number of frames received OK */
 	u32 rxbok;		/* Total number of octets received OK */
@@ -98,9 +98,9 @@ struct ucc_geth {
 				   HW because it includes octets in frames that
 				   never even reach the UCC */
 	u32 rmca;		/* Total number of frames that were received
-				   succesfully with the group address bit set
+				   successfully with the group address bit set
 				   that are not broadcast frames */
-	u32 rbca;		/* Total number of frames received succesfully
+	u32 rbca;		/* Total number of frames received successfully
 				   that had destination address equal to the
 				   broadcast address */
 	u32 scar;		/* Statistics carry register */
@@ -759,15 +759,15 @@ struct ucc_geth_hardware_statistics {
 				   frames) received that were between 128
 				   (Including FCS length==4) and 255 octets */
 	u32 txok;		/* Total number of octets residing in frames
-				   that where involved in succesfull
+				   that where involved in successfull
 				   transmission */
 	u16 txcf;		/* Total number of PAUSE control frames
 				   transmitted by this MAC */
 	u32 tmca;		/* Total number of frames that were transmitted
-				   succesfully with the group address bit set
+				   successfully with the group address bit set
 				   that are not broadcast frames */
 	u32 tbca;		/* Total number of frames transmitted
-				   succesfully that had destination address
+				   successfully that had destination address
 				   field equal to the broadcast address */
 	u32 rxfok;		/* Total number of frames received OK */
 	u32 rxbok;		/* Total number of octets received OK */
@@ -776,9 +776,9 @@ struct ucc_geth_hardware_statistics {
 				   HW because it includes octets in frames that
 				   never even reach the UCC */
 	u32 rmca;		/* Total number of frames that were received
-				   succesfully with the group address bit set
+				   successfully with the group address bit set
 				   that are not broadcast frames */
-	u32 rbca;		/* Total number of frames received succesfully
+	u32 rbca;		/* Total number of frames received successfully
 				   that had destination address equal to the
 				   broadcast address */
 } __attribute__ ((packed));
@@ -838,13 +838,13 @@ struct ucc_geth_hardware_statistics {
 							   using the maximum is
 							   easier */
 #define UCC_GETH_SEND_QUEUE_QUEUE_DESCRIPTOR_ALIGNMENT	32
-#define UCC_GETH_SCHEDULER_ALIGNMENT		4	/* This is a guess */
+#define UCC_GETH_SCHEDULER_ALIGNMENT		8	/* This is a guess */
 #define UCC_GETH_TX_STATISTICS_ALIGNMENT	4	/* This is a guess */
 #define UCC_GETH_RX_STATISTICS_ALIGNMENT	4	/* This is a guess */
 #define UCC_GETH_RX_INTERRUPT_COALESCING_ALIGNMENT	64
 #define UCC_GETH_RX_BD_QUEUES_ALIGNMENT		8	/* This is a guess */
 #define UCC_GETH_RX_PREFETCHED_BDS_ALIGNMENT	128	/* This is a guess */
-#define UCC_GETH_RX_EXTENDED_FILTERING_GLOBAL_PARAMETERS_ALIGNMENT 4	/* This
+#define UCC_GETH_RX_EXTENDED_FILTERING_GLOBAL_PARAMETERS_ALIGNMENT 8	/* This
 									   is a
 									   guess
 									 */
@@ -899,16 +899,17 @@ struct ucc_geth_hardware_statistics {
 #define UCC_GETH_UTFS_INIT                      512	/* Tx virtual FIFO size
 							 */
 #define UCC_GETH_UTFET_INIT                     256	/* 1/2 utfs */
-#define UCC_GETH_UTFTT_INIT                     128
+#define UCC_GETH_UTFTT_INIT                     512
 /* Gigabit Ethernet (1000 Mbps) */
 #define UCC_GETH_URFS_GIGA_INIT                 4096/*2048*/	/* Rx virtual
 								   FIFO size */
 #define UCC_GETH_URFET_GIGA_INIT                2048/*1024*/	/* 1/2 urfs */
 #define UCC_GETH_URFSET_GIGA_INIT               3072/*1536*/	/* 3/4 urfs */
-#define UCC_GETH_UTFS_GIGA_INIT                 8192/*2048*/	/* Tx virtual
+#define UCC_GETH_UTFS_GIGA_INIT                 4096/*2048*/	/* Tx virtual
+								   FIFO size */
+#define UCC_GETH_UTFET_GIGA_INIT                2048/*1024*/	/* 1/2 utfs */
+#define UCC_GETH_UTFTT_GIGA_INIT                4096/*0x40*/	/* Tx virtual
 								   FIFO size */
-#define UCC_GETH_UTFET_GIGA_INIT                4096/*1024*/	/* 1/2 utfs */
-#define UCC_GETH_UTFTT_GIGA_INIT                0x400/*0x40*/	/* */
 
 #define UCC_GETH_REMODER_INIT                   0	/* bits that must be
 							   set */
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 21e183a83b99..4f27f022fbf7 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -419,7 +419,7 @@ static int cdc_manage_power(struct usbnet *dev, int on)
 
 static const struct driver_info	cdc_info = {
 	.description =	"CDC Ethernet Device",
-	.flags =	FLAG_ETHER | FLAG_LINK_INTR,
+	.flags =	FLAG_ETHER,
 	// .check_connect = cdc_check_connect,
 	.bind =		cdc_bind,
 	.unbind =	usbnet_cdc_unbind,
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index f78f0903b073..6895f1531238 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -286,6 +286,7 @@ struct hso_device {
 	u8 usb_gone;
 	struct work_struct async_get_intf;
 	struct work_struct async_put_intf;
+	struct work_struct reset_device;
 
 	struct usb_device *usb;
 	struct usb_interface *interface;
@@ -332,7 +333,8 @@ static void hso_kick_transmit(struct hso_serial *serial);
 /* Helper functions */
 static int hso_mux_submit_intr_urb(struct hso_shared_int *mux_int,
 				   struct usb_device *usb, gfp_t gfp);
-static void log_usb_status(int status, const char *function);
+static void handle_usb_error(int status, const char *function,
+			     struct hso_device *hso_dev);
 static struct usb_endpoint_descriptor *hso_get_ep(struct usb_interface *intf,
 						  int type, int dir);
 static int hso_get_mux_ports(struct usb_interface *intf, unsigned char *ports);
@@ -350,6 +352,7 @@ static void async_put_intf(struct work_struct *data);
 static int hso_put_activity(struct hso_device *hso_dev);
 static int hso_get_activity(struct hso_device *hso_dev);
 static void tiocmget_intr_callback(struct urb *urb);
+static void reset_device(struct work_struct *data);
 /*****************************************************************************/
 /* Helping functions                                                         */
 /*****************************************************************************/
@@ -461,10 +464,17 @@ static const struct usb_device_id hso_ids[] = {
 	{USB_DEVICE(0x0af0, 0x7501)},		/* GTM 382 */
 	{USB_DEVICE(0x0af0, 0x7601)},		/* GE40x */
 	{USB_DEVICE(0x0af0, 0x7701)},
+	{USB_DEVICE(0x0af0, 0x7706)},
 	{USB_DEVICE(0x0af0, 0x7801)},
 	{USB_DEVICE(0x0af0, 0x7901)},
+	{USB_DEVICE(0x0af0, 0x7A01)},
+	{USB_DEVICE(0x0af0, 0x7A05)},
 	{USB_DEVICE(0x0af0, 0x8200)},
 	{USB_DEVICE(0x0af0, 0x8201)},
+	{USB_DEVICE(0x0af0, 0x8300)},
+	{USB_DEVICE(0x0af0, 0x8302)},
+	{USB_DEVICE(0x0af0, 0x8304)},
+	{USB_DEVICE(0x0af0, 0x8400)},
 	{USB_DEVICE(0x0af0, 0xd035)},
 	{USB_DEVICE(0x0af0, 0xd055)},
 	{USB_DEVICE(0x0af0, 0xd155)},
@@ -473,6 +483,8 @@ static const struct usb_device_id hso_ids[] = {
 	{USB_DEVICE(0x0af0, 0xd157)},
 	{USB_DEVICE(0x0af0, 0xd257)},
 	{USB_DEVICE(0x0af0, 0xd357)},
+	{USB_DEVICE(0x0af0, 0xd058)},
+	{USB_DEVICE(0x0af0, 0xc100)},
 	{}
 };
 MODULE_DEVICE_TABLE(usb, hso_ids);
@@ -655,8 +667,8 @@ static void set_serial_by_index(unsigned index, struct hso_serial *serial)
 	spin_unlock_irqrestore(&serial_table_lock, flags);
 }
 
-/* log a meaningful explanation of an USB status */
-static void log_usb_status(int status, const char *function)
+static void handle_usb_error(int status, const char *function,
+			     struct hso_device *hso_dev)
 {
 	char *explanation;
 
@@ -685,10 +697,20 @@ static void log_usb_status(int status, const char *function)
 	case -EMSGSIZE:
 		explanation = "internal error";
 		break;
+	case -EILSEQ:
+	case -EPROTO:
+	case -ETIME:
+	case -ETIMEDOUT:
+		explanation = "protocol error";
+		if (hso_dev)
+			schedule_work(&hso_dev->reset_device);
+		break;
 	default:
 		explanation = "unknown status";
 		break;
 	}
+
+	/* log a meaningful explanation of an USB status */
 	D1("%s: received USB status - %s (%d)", function, explanation, status);
 }
 
@@ -762,7 +784,7 @@ static void write_bulk_callback(struct urb *urb)
 	/* log status, but don't act on it, we don't need to resubmit anything
 	 * anyhow */
 	if (status)
-		log_usb_status(status, __func__);
+		handle_usb_error(status, __func__, odev->parent);
 
 	hso_put_activity(odev->parent);
 
@@ -806,7 +828,7 @@ static netdev_tx_t hso_net_start_xmit(struct sk_buff *skb,
 	result = usb_submit_urb(odev->mux_bulk_tx_urb, GFP_ATOMIC);
 	if (result) {
 		dev_warn(&odev->parent->interface->dev,
-			"failed mux_bulk_tx_urb %d", result);
+			"failed mux_bulk_tx_urb %d\n", result);
 		net->stats.tx_errors++;
 		netif_start_queue(net);
 	} else {
@@ -998,7 +1020,7 @@ static void read_bulk_callback(struct urb *urb)
 
 	/* is al ok?  (Filip: Who's Al ?) */
 	if (status) {
-		log_usb_status(status, __func__);
+		handle_usb_error(status, __func__, odev->parent);
 		return;
 	}
 
@@ -1019,7 +1041,8 @@ static void read_bulk_callback(struct urb *urb)
 	if (odev->parent->port_spec & HSO_INFO_CRC_BUG) {
 		u32 rest;
 		u8 crc_check[4] = { 0xDE, 0xAD, 0xBE, 0xEF };
-		rest = urb->actual_length % odev->in_endp->wMaxPacketSize;
+		rest = urb->actual_length %
+			le16_to_cpu(odev->in_endp->wMaxPacketSize);
 		if (((rest == 5) || (rest == 6)) &&
 		    !memcmp(((u8 *) urb->transfer_buffer) +
 			    urb->actual_length - 4, crc_check, 4)) {
@@ -1053,7 +1076,7 @@ static void read_bulk_callback(struct urb *urb)
 	result = usb_submit_urb(urb, GFP_ATOMIC);
 	if (result)
 		dev_warn(&odev->parent->interface->dev,
-			 "%s failed submit mux_bulk_rx_urb %d", __func__,
+			 "%s failed submit mux_bulk_rx_urb %d\n", __func__,
 			 result);
 }
 
@@ -1207,7 +1230,7 @@ static void hso_std_serial_read_bulk_callback(struct urb *urb)
 		D1("serial == NULL");
 		return;
 	} else if (status) {
-		log_usb_status(status, __func__);
+		handle_usb_error(status, __func__, serial->parent);
 		return;
 	}
 
@@ -1225,7 +1248,7 @@ static void hso_std_serial_read_bulk_callback(struct urb *urb)
 			u8 crc_check[4] = { 0xDE, 0xAD, 0xBE, 0xEF };
 			rest =
 			    urb->actual_length %
-			    serial->in_endp->wMaxPacketSize;
+			    le16_to_cpu(serial->in_endp->wMaxPacketSize);
 			if (((rest == 5) || (rest == 6)) &&
 			    !memcmp(((u8 *) urb->transfer_buffer) +
 				    urb->actual_length - 4, crc_check, 4)) {
@@ -1513,7 +1536,7 @@ static void tiocmget_intr_callback(struct urb *urb)
 	if (!serial)
 		return;
 	if (status) {
-		log_usb_status(status, __func__);
+		handle_usb_error(status, __func__, serial->parent);
 		return;
 	}
 	tiocmget = serial->tiocmget;
@@ -1700,6 +1723,10 @@ static int hso_serial_tiocmset(struct tty_struct *tty, struct file *file,
 		D1("no tty structures");
 		return -EINVAL;
 	}
+
+	if ((serial->parent->port_spec & HSO_PORT_MASK) != HSO_PORT_MODEM)
+		return -EINVAL;
+
 	if_num = serial->parent->interface->altsetting->desc.bInterfaceNumber;
 
 	spin_lock_irqsave(&serial->serial_lock, flags);
@@ -1838,7 +1865,7 @@ static int mux_device_request(struct hso_serial *serial, u8 type, u16 port,
 	result = usb_submit_urb(ctrl_urb, GFP_ATOMIC);
 	if (result) {
 		dev_err(&ctrl_urb->dev->dev,
-			"%s failed submit ctrl_urb %d type %d", __func__,
+			"%s failed submit ctrl_urb %d type %d\n", __func__,
 			result, type);
 		return result;
 	}
@@ -1888,7 +1915,7 @@ static void intr_callback(struct urb *urb)
 
 	/* status check */
 	if (status) {
-		log_usb_status(status, __func__);
+		handle_usb_error(status, __func__, NULL);
 		return;
 	}
 	D4("\n--- Got intr callback 0x%02X ---", status);
@@ -1905,18 +1932,18 @@ static void intr_callback(struct urb *urb)
 			if (serial != NULL) {
 				D1("Pending read interrupt on port %d\n", i);
 				spin_lock(&serial->serial_lock);
-				if (serial->rx_state == RX_IDLE) {
+				if (serial->rx_state == RX_IDLE &&
+					serial->open_count > 0) {
 					/* Setup and send a ctrl req read on
 					 * port i */
-				if (!serial->rx_urb_filled[0]) {
+					if (!serial->rx_urb_filled[0]) {
 						serial->rx_state = RX_SENT;
 						hso_mux_serial_read(serial);
 					} else
 						serial->rx_state = RX_PENDING;
-
 				} else {
-					D1("Already pending a read on "
-					   "port %d\n", i);
+					D1("Already a read pending on "
+					   "port %d or port not open\n", i);
 				}
 				spin_unlock(&serial->serial_lock);
 			}
@@ -1958,7 +1985,7 @@ static void hso_std_serial_write_bulk_callback(struct urb *urb)
 	tty = tty_kref_get(serial->tty);
 	spin_unlock(&serial->serial_lock);
 	if (status) {
-		log_usb_status(status, __func__);
+		handle_usb_error(status, __func__, serial->parent);
 		tty_kref_put(tty);
 		return;
 	}
@@ -2014,7 +2041,7 @@ static void ctrl_callback(struct urb *urb)
 	tty = tty_kref_get(serial->tty);
 	spin_unlock(&serial->serial_lock);
 	if (status) {
-		log_usb_status(status, __func__);
+		handle_usb_error(status, __func__, serial->parent);
 		tty_kref_put(tty);
 		return;
 	}
@@ -2358,12 +2385,12 @@ static int hso_serial_common_create(struct hso_serial *serial, int num_urbs,
 	serial->tx_data_length = tx_size;
 	serial->tx_data = kzalloc(serial->tx_data_length, GFP_KERNEL);
 	if (!serial->tx_data) {
-		dev_err(dev, "%s - Out of memory", __func__);
+		dev_err(dev, "%s - Out of memory\n", __func__);
 		goto exit;
 	}
 	serial->tx_buffer = kzalloc(serial->tx_data_length, GFP_KERNEL);
 	if (!serial->tx_buffer) {
-		dev_err(dev, "%s - Out of memory", __func__);
+		dev_err(dev, "%s - Out of memory\n", __func__);
 		goto exit;
 	}
 
@@ -2391,6 +2418,7 @@ static struct hso_device *hso_create_device(struct usb_interface *intf,
 
 	INIT_WORK(&hso_dev->async_get_intf, async_get_intf);
 	INIT_WORK(&hso_dev->async_put_intf, async_put_intf);
+	INIT_WORK(&hso_dev->reset_device, reset_device);
 
 	return hso_dev;
 }
@@ -2831,13 +2859,14 @@ struct hso_shared_int *hso_create_shared_int(struct usb_interface *interface)
 
 	mux->shared_intr_urb = usb_alloc_urb(0, GFP_KERNEL);
 	if (!mux->shared_intr_urb) {
-		dev_err(&interface->dev, "Could not allocate intr urb?");
+		dev_err(&interface->dev, "Could not allocate intr urb?\n");
 		goto exit;
 	}
-	mux->shared_intr_buf = kzalloc(mux->intr_endp->wMaxPacketSize,
-				       GFP_KERNEL);
+	mux->shared_intr_buf =
+		kzalloc(le16_to_cpu(mux->intr_endp->wMaxPacketSize),
+			GFP_KERNEL);
 	if (!mux->shared_intr_buf) {
-		dev_err(&interface->dev, "Could not allocate intr buf?");
+		dev_err(&interface->dev, "Could not allocate intr buf?\n");
 		goto exit;
 	}
 
@@ -3132,6 +3161,26 @@ out:
 	return result;
 }
 
+static void reset_device(struct work_struct *data)
+{
+	struct hso_device *hso_dev =
+	    container_of(data, struct hso_device, reset_device);
+	struct usb_device *usb = hso_dev->usb;
+	int result;
+
+	if (hso_dev->usb_gone) {
+		D1("No reset during disconnect\n");
+	} else {
+		result = usb_lock_device_for_reset(usb, hso_dev->interface);
+		if (result < 0)
+			D1("unable to lock device for reset: %d\n", result);
+		else {
+			usb_reset_device(usb);
+			usb_unlock_device(usb);
+		}
+	}
+}
+
 static void hso_serial_ref_free(struct kref *ref)
 {
 	struct hso_device *hso_dev = container_of(ref, struct hso_device, ref);
@@ -3232,13 +3281,13 @@ static int hso_mux_submit_intr_urb(struct hso_shared_int *shared_int,
 			 usb_rcvintpipe(usb,
 				shared_int->intr_endp->bEndpointAddress & 0x7F),
 			 shared_int->shared_intr_buf,
-			 shared_int->intr_endp->wMaxPacketSize,
+			 1,
 			 intr_callback, shared_int,
 			 shared_int->intr_endp->bInterval);
 
 	result = usb_submit_urb(shared_int->shared_intr_urb, gfp);
 	if (result)
-		dev_warn(&usb->dev, "%s failed mux_intr_urb %d", __func__,
+		dev_warn(&usb->dev, "%s failed mux_intr_urb %d\n", __func__,
 			result);
 
 	return result;
diff --git a/drivers/net/usb/kaweth.c b/drivers/net/usb/kaweth.c
index 3b80e8d2d621..f1d64ef67efa 100644
--- a/drivers/net/usb/kaweth.c
+++ b/drivers/net/usb/kaweth.c
@@ -716,7 +716,7 @@ static int kaweth_open(struct net_device *net)
 	return 0;
 
 err_out:
-	usb_autopm_enable(kaweth->intf);
+	usb_autopm_put_interface(kaweth->intf);
 	return -EIO;
 }
 
@@ -753,7 +753,7 @@ static int kaweth_close(struct net_device *net)
 
 	kaweth->status &= ~KAWETH_STATUS_CLOSING;
 
-	usb_autopm_enable(kaweth->intf);
+	usb_autopm_put_interface(kaweth->intf);
 
 	return 0;
 }
diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c
index b091e20ca167..fd19db0d2504 100644
--- a/drivers/net/usb/rtl8150.c
+++ b/drivers/net/usb/rtl8150.c
@@ -270,7 +270,7 @@ static int read_mii_word(rtl8150_t * dev, u8 phy, __u8 indx, u16 * reg)
 		get_registers(dev, PHYCNT, 1, data);
 	} while ((data[0] & PHY_GO) && (i++ < MII_TIMEOUT));
 
-	if (i < MII_TIMEOUT) {
+	if (i <= MII_TIMEOUT) {
 		get_registers(dev, PHYDAT, 2, data);
 		*reg = data[0] | (data[1] << 8);
 		return 0;
@@ -295,7 +295,7 @@ static int write_mii_word(rtl8150_t * dev, u8 phy, __u8 indx, u16 reg)
 		get_registers(dev, PHYCNT, 1, data);
 	} while ((data[0] & PHY_GO) && (i++ < MII_TIMEOUT));
 
-	if (i < MII_TIMEOUT)
+	if (i <= MII_TIMEOUT)
 		return 0;
 	else
 		return 1;
@@ -324,7 +324,7 @@ static int rtl8150_set_mac_address(struct net_device *netdev, void *p)
 		dbg("%02X:", netdev->dev_addr[i]);
 	dbg("%02X\n", netdev->dev_addr[i]);
 	/* Set the IDR registers. */
-	set_registers(dev, IDR, sizeof(netdev->dev_addr), netdev->dev_addr);
+	set_registers(dev, IDR, netdev->addr_len, netdev->dev_addr);
 #ifdef EEPROM_WRITE
 	{
 	u8 cr;
diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index c6c922247d05..0c3c738d7419 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -748,7 +748,7 @@ static int smsc95xx_phy_initialize(struct usbnet *dev)
 	mii_nway_restart(&dev->mii);
 
 	if (netif_msg_ifup(dev))
-		devdbg(dev, "phy initialised succesfully");
+		devdbg(dev, "phy initialised successfully");
 	return 0;
 }
 
diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index 63099c58a6dd..3a15de56df9c 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -153,15 +153,14 @@ static netdev_tx_t veth_xmit(struct sk_buff *skb, struct net_device *dev)
 	struct net_device *rcv = NULL;
 	struct veth_priv *priv, *rcv_priv;
 	struct veth_net_stats *stats, *rcv_stats;
-	int length, cpu;
+	int length;
 
 	priv = netdev_priv(dev);
 	rcv = priv->peer;
 	rcv_priv = netdev_priv(rcv);
 
-	cpu = smp_processor_id();
-	stats = per_cpu_ptr(priv->stats, cpu);
-	rcv_stats = per_cpu_ptr(rcv_priv->stats, cpu);
+	stats = this_cpu_ptr(priv->stats);
+	rcv_stats = this_cpu_ptr(rcv_priv->stats);
 
 	if (!(rcv->flags & IFF_UP))
 		goto tx_drop;
diff --git a/drivers/net/via-rhine.c b/drivers/net/via-rhine.c
index 593e01f64e9b..611b80435955 100644
--- a/drivers/net/via-rhine.c
+++ b/drivers/net/via-rhine.c
@@ -102,6 +102,7 @@ static const int multicast_filter_limit = 32;
 #include <linux/ethtool.h>
 #include <linux/crc32.h>
 #include <linux/bitops.h>
+#include <linux/workqueue.h>
 #include <asm/processor.h>	/* Processor type for cache alignment. */
 #include <asm/io.h>
 #include <asm/irq.h>
@@ -389,6 +390,7 @@ struct rhine_private {
 	struct net_device *dev;
 	struct napi_struct napi;
 	spinlock_t lock;
+	struct work_struct reset_task;
 
 	/* Frequently used values: keep some adjacent for cache effect. */
 	u32 quirks;
@@ -407,6 +409,7 @@ struct rhine_private {
 static int  mdio_read(struct net_device *dev, int phy_id, int location);
 static void mdio_write(struct net_device *dev, int phy_id, int location, int value);
 static int  rhine_open(struct net_device *dev);
+static void rhine_reset_task(struct work_struct *work);
 static void rhine_tx_timeout(struct net_device *dev);
 static netdev_tx_t rhine_start_tx(struct sk_buff *skb,
 				  struct net_device *dev);
@@ -775,6 +778,8 @@ static int __devinit rhine_init_one(struct pci_dev *pdev,
 	dev->irq = pdev->irq;
 
 	spin_lock_init(&rp->lock);
+	INIT_WORK(&rp->reset_task, rhine_reset_task);
+
 	rp->mii_if.dev = dev;
 	rp->mii_if.mdio_read = mdio_read;
 	rp->mii_if.mdio_write = mdio_write;
@@ -1179,22 +1184,18 @@ static int rhine_open(struct net_device *dev)
 	return 0;
 }
 
-static void rhine_tx_timeout(struct net_device *dev)
+static void rhine_reset_task(struct work_struct *work)
 {
-	struct rhine_private *rp = netdev_priv(dev);
-	void __iomem *ioaddr = rp->base;
-
-	printk(KERN_WARNING "%s: Transmit timed out, status %4.4x, PHY status "
-	       "%4.4x, resetting...\n",
-	       dev->name, ioread16(ioaddr + IntrStatus),
-	       mdio_read(dev, rp->mii_if.phy_id, MII_BMSR));
+	struct rhine_private *rp = container_of(work, struct rhine_private,
+						reset_task);
+	struct net_device *dev = rp->dev;
 
 	/* protect against concurrent rx interrupts */
 	disable_irq(rp->pdev->irq);
 
 	napi_disable(&rp->napi);
 
-	spin_lock(&rp->lock);
+	spin_lock_bh(&rp->lock);
 
 	/* clear all descriptors */
 	free_tbufs(dev);
@@ -1206,7 +1207,7 @@ static void rhine_tx_timeout(struct net_device *dev)
 	rhine_chip_reset(dev);
 	init_registers(dev);
 
-	spin_unlock(&rp->lock);
+	spin_unlock_bh(&rp->lock);
 	enable_irq(rp->pdev->irq);
 
 	dev->trans_start = jiffies;
@@ -1214,6 +1215,19 @@ static void rhine_tx_timeout(struct net_device *dev)
 	netif_wake_queue(dev);
 }
 
+static void rhine_tx_timeout(struct net_device *dev)
+{
+	struct rhine_private *rp = netdev_priv(dev);
+	void __iomem *ioaddr = rp->base;
+
+	printk(KERN_WARNING "%s: Transmit timed out, status %4.4x, PHY status "
+	       "%4.4x, resetting...\n",
+	       dev->name, ioread16(ioaddr + IntrStatus),
+	       mdio_read(dev, rp->mii_if.phy_id, MII_BMSR));
+
+	schedule_work(&rp->reset_task);
+}
+
 static netdev_tx_t rhine_start_tx(struct sk_buff *skb,
 				  struct net_device *dev)
 {
@@ -1830,10 +1844,11 @@ static int rhine_close(struct net_device *dev)
 	struct rhine_private *rp = netdev_priv(dev);
 	void __iomem *ioaddr = rp->base;
 
-	spin_lock_irq(&rp->lock);
-
-	netif_stop_queue(dev);
 	napi_disable(&rp->napi);
+	cancel_work_sync(&rp->reset_task);
+	netif_stop_queue(dev);
+
+	spin_lock_irq(&rp->lock);
 
 	if (debug > 1)
 		printk(KERN_DEBUG "%s: Shutting down ethercard, "
diff --git a/drivers/net/via-velocity.c b/drivers/net/via-velocity.c
index 4ceb441f2687..317aa34b21cf 100644
--- a/drivers/net/via-velocity.c
+++ b/drivers/net/via-velocity.c
@@ -1877,13 +1877,12 @@ static void velocity_error(struct velocity_info *vptr, int status)
 /**
  *	tx_srv		-	transmit interrupt service
  *	@vptr; Velocity
- *	@status:
  *
  *	Scan the queues looking for transmitted packets that
  *	we can complete and clean up. Update any statistics as
  *	necessary/
  */
-static int velocity_tx_srv(struct velocity_info *vptr, u32 status)
+static int velocity_tx_srv(struct velocity_info *vptr)
 {
 	struct tx_desc *td;
 	int qnum;
@@ -2090,14 +2089,12 @@ static int velocity_receive_frame(struct velocity_info *vptr, int idx)
 /**
  *	velocity_rx_srv		-	service RX interrupt
  *	@vptr: velocity
- *	@status: adapter status (unused)
  *
  *	Walk the receive ring of the velocity adapter and remove
  *	any received packets from the receive queue. Hand the ring
  *	slots back to the adapter for reuse.
  */
-static int velocity_rx_srv(struct velocity_info *vptr, int status,
-		int budget_left)
+static int velocity_rx_srv(struct velocity_info *vptr, int budget_left)
 {
 	struct net_device_stats *stats = &vptr->dev->stats;
 	int rd_curr = vptr->rx.curr;
@@ -2151,32 +2148,24 @@ static int velocity_poll(struct napi_struct *napi, int budget)
 	struct velocity_info *vptr = container_of(napi,
 			struct velocity_info, napi);
 	unsigned int rx_done;
-	u32 isr_status;
-
-	spin_lock(&vptr->lock);
-	isr_status = mac_read_isr(vptr->mac_regs);
-
-	/* Ack the interrupt */
-	mac_write_isr(vptr->mac_regs, isr_status);
-	if (isr_status & (~(ISR_PRXI | ISR_PPRXI | ISR_PTXI | ISR_PPTXI)))
-		velocity_error(vptr, isr_status);
+	unsigned long flags;
 
+	spin_lock_irqsave(&vptr->lock, flags);
 	/*
 	 * Do rx and tx twice for performance (taken from the VIA
 	 * out-of-tree driver).
 	 */
-	rx_done = velocity_rx_srv(vptr, isr_status, budget / 2);
-	velocity_tx_srv(vptr, isr_status);
-	rx_done += velocity_rx_srv(vptr, isr_status, budget - rx_done);
-	velocity_tx_srv(vptr, isr_status);
-
-	spin_unlock(&vptr->lock);
+	rx_done = velocity_rx_srv(vptr, budget / 2);
+	velocity_tx_srv(vptr);
+	rx_done += velocity_rx_srv(vptr, budget - rx_done);
+	velocity_tx_srv(vptr);
 
 	/* If budget not fully consumed, exit the polling mode */
 	if (rx_done < budget) {
 		napi_complete(napi);
 		mac_enable_int(vptr->mac_regs);
 	}
+	spin_unlock_irqrestore(&vptr->lock, flags);
 
 	return rx_done;
 }
@@ -2206,10 +2195,17 @@ static irqreturn_t velocity_intr(int irq, void *dev_instance)
 		return IRQ_NONE;
 	}
 
+	/* Ack the interrupt */
+	mac_write_isr(vptr->mac_regs, isr_status);
+
 	if (likely(napi_schedule_prep(&vptr->napi))) {
 		mac_disable_int(vptr->mac_regs);
 		__napi_schedule(&vptr->napi);
 	}
+
+	if (isr_status & (~(ISR_PRXI | ISR_PPRXI | ISR_PTXI | ISR_PPTXI)))
+		velocity_error(vptr, isr_status);
+
 	spin_unlock(&vptr->lock);
 
 	return IRQ_HANDLED;
@@ -2237,8 +2233,6 @@ static int velocity_open(struct net_device *dev)
 	/* Ensure chip is running */
 	pci_set_power_state(vptr->pdev, PCI_D0);
 
-	velocity_give_many_rx_descs(vptr);
-
 	velocity_init_registers(vptr, VELOCITY_INIT_COLD);
 
 	ret = request_irq(vptr->pdev->irq, velocity_intr, IRQF_SHARED,
@@ -2250,6 +2244,8 @@ static int velocity_open(struct net_device *dev)
 		goto out;
 	}
 
+	velocity_give_many_rx_descs(vptr);
+
 	mac_enable_int(vptr->mac_regs);
 	netif_start_queue(dev);
 	napi_enable(&vptr->napi);
@@ -2339,10 +2335,10 @@ static int velocity_change_mtu(struct net_device *dev, int new_mtu)
 
 		dev->mtu = new_mtu;
 
-		velocity_give_many_rx_descs(vptr);
-
 		velocity_init_registers(vptr, VELOCITY_INIT_COLD);
 
+		velocity_give_many_rx_descs(vptr);
+
 		mac_enable_int(vptr->mac_regs);
 		netif_start_queue(dev);
 
@@ -3100,7 +3096,7 @@ static int velocity_resume(struct pci_dev *pdev)
 	velocity_init_registers(vptr, VELOCITY_INIT_WOL);
 	mac_disable_int(vptr->mac_regs);
 
-	velocity_tx_srv(vptr, 0);
+	velocity_tx_srv(vptr);
 
 	for (i = 0; i < vptr->tx.numq; i++) {
 		if (vptr->tx.used[i])
@@ -3344,6 +3340,7 @@ static int velocity_set_coalesce(struct net_device *dev,
 {
 	struct velocity_info *vptr = netdev_priv(dev);
 	int max_us = 0x3f * 64;
+	unsigned long flags;
 
 	/* 6 bits of  */
 	if (ecmd->tx_coalesce_usecs > max_us)
@@ -3365,6 +3362,7 @@ static int velocity_set_coalesce(struct net_device *dev,
 			ecmd->tx_coalesce_usecs);
 
 	/* Setup the interrupt suppression and queue timers */
+	spin_lock_irqsave(&vptr->lock, flags);
 	mac_disable_int(vptr->mac_regs);
 	setup_adaptive_interrupts(vptr);
 	setup_queue_timers(vptr);
@@ -3372,6 +3370,7 @@ static int velocity_set_coalesce(struct net_device *dev,
 	mac_write_int_mask(vptr->int_mask, vptr->mac_regs);
 	mac_clear_isr(vptr->mac_regs);
 	mac_enable_int(vptr->mac_regs);
+	spin_unlock_irqrestore(&vptr->lock, flags);
 
 	return 0;
 }
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index c708ecc3cb2e..9ead30bd00c4 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -395,8 +395,7 @@ static void refill_work(struct work_struct *work)
 
 	vi = container_of(work, struct virtnet_info, refill.work);
 	napi_disable(&vi->napi);
-	try_fill_recv(vi, GFP_KERNEL);
-	still_empty = (vi->num == 0);
+	still_empty = !try_fill_recv(vi, GFP_KERNEL);
 	napi_enable(&vi->napi);
 
 	/* In theory, this can happen: if we don't get any buffers in
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index 1ceb9d0f8b97..9cc438282d77 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -2689,7 +2689,7 @@ vmxnet3_resume(struct device *device)
 	return 0;
 }
 
-static struct dev_pm_ops vmxnet3_pm_ops = {
+static const struct dev_pm_ops vmxnet3_pm_ops = {
 	.suspend = vmxnet3_suspend,
 	.resume = vmxnet3_resume,
 };
diff --git a/drivers/net/vxge/vxge-main.c b/drivers/net/vxge/vxge-main.c
index f1c4b2a1e867..b9685e82f7b6 100644
--- a/drivers/net/vxge/vxge-main.c
+++ b/drivers/net/vxge/vxge-main.c
@@ -310,7 +310,7 @@ static int vxge_rx_map(void *dtrh, struct vxge_ring *ring)
 	dma_addr = pci_map_single(ring->pdev, rx_priv->skb_data,
 				rx_priv->data_size, PCI_DMA_FROMDEVICE);
 
-	if (dma_addr == 0) {
+	if (unlikely(pci_dma_mapping_error(ring->pdev, dma_addr))) {
 		ring->stats.pci_map_fail++;
 		return -EIO;
 	}
@@ -4087,21 +4087,21 @@ vxge_probe(struct pci_dev *pdev, const struct pci_device_id *pre)
 		goto _exit0;
 	}
 
-	if (!pci_set_dma_mask(pdev, 0xffffffffffffffffULL)) {
+	if (!pci_set_dma_mask(pdev, DMA_BIT_MASK(64))) {
 		vxge_debug_ll_config(VXGE_TRACE,
 			"%s : using 64bit DMA", __func__);
 
 		high_dma = 1;
 
 		if (pci_set_consistent_dma_mask(pdev,
-						0xffffffffffffffffULL)) {
+						DMA_BIT_MASK(64))) {
 			vxge_debug_init(VXGE_ERR,
 				"%s : unable to obtain 64bit DMA for "
 				"consistent allocations", __func__);
 			ret = -ENOMEM;
 			goto _exit1;
 		}
-	} else if (!pci_set_dma_mask(pdev, 0xffffffffUL)) {
+	} else if (!pci_set_dma_mask(pdev, DMA_BIT_MASK(32))) {
 		vxge_debug_ll_config(VXGE_TRACE,
 			"%s : using 32bit DMA", __func__);
 	} else {
diff --git a/drivers/net/wan/hdlc_fr.c b/drivers/net/wan/hdlc_fr.c
index a7d4fc1a03a2..0e52993e2079 100644
--- a/drivers/net/wan/hdlc_fr.c
+++ b/drivers/net/wan/hdlc_fr.c
@@ -182,7 +182,7 @@ static inline pvc_device* find_pvc(hdlc_device *hdlc, u16 dlci)
 		if (pvc->dlci == dlci)
 			return pvc;
 		if (pvc->dlci > dlci)
-			return NULL; /* the listed is sorted */
+			return NULL; /* the list is sorted */
 		pvc = pvc->next;
 	}
 
diff --git a/drivers/net/wan/lmc/lmc_main.c b/drivers/net/wan/lmc/lmc_main.c
index 2ebe935d1058..4b6f27e7c820 100644
--- a/drivers/net/wan/lmc/lmc_main.c
+++ b/drivers/net/wan/lmc/lmc_main.c
@@ -927,7 +927,7 @@ static int __devinit lmc_init_one(struct pci_dev *pdev,
         sc->lmc_media = &lmc_t1_media;
         break;
     default:
-	printk(KERN_WARNING "%s: LMC UNKOWN CARD!\n", dev->name);
+	printk(KERN_WARNING "%s: LMC UNKNOWN CARD!\n", dev->name);
         break;
     }
 
diff --git a/drivers/net/wimax/i2400m/i2400m-usb.h b/drivers/net/wimax/i2400m/i2400m-usb.h
index 5cc0f279417e..2d7c96d7e865 100644
--- a/drivers/net/wimax/i2400m/i2400m-usb.h
+++ b/drivers/net/wimax/i2400m/i2400m-usb.h
@@ -151,6 +151,7 @@ enum {
 
 	/* Device IDs */
 	USB_DEVICE_ID_I6050 = 0x0186,
+	USB_DEVICE_ID_I6050_2 = 0x0188,
 };
 
 
@@ -234,6 +235,7 @@ struct i2400mu {
 	u8 rx_size_auto_shrink;
 
 	struct dentry *debugfs_dentry;
+	unsigned i6050:1;	/* 1 if this is a 6050 based SKU */
 };
 
 
diff --git a/drivers/net/wimax/i2400m/rx.c b/drivers/net/wimax/i2400m/rx.c
index e3d2a9de023c..7ddb173fd4a7 100644
--- a/drivers/net/wimax/i2400m/rx.c
+++ b/drivers/net/wimax/i2400m/rx.c
@@ -1194,7 +1194,7 @@ error:
  * device. See the file header for the format. Run all checks on the
  * buffer header, then run over each payload's descriptors, verify
  * their consistency and act on each payload's contents.  If
- * everything is succesful, update the device's statistics.
+ * everything is successful, update the device's statistics.
  *
  * Note: You need to set the skb to contain only the length of the
  * received buffer; for that, use skb_trim(skb, RECEIVED_SIZE).
diff --git a/drivers/net/wimax/i2400m/usb.c b/drivers/net/wimax/i2400m/usb.c
index 47e84ef355c5..98f4f8c5fb68 100644
--- a/drivers/net/wimax/i2400m/usb.c
+++ b/drivers/net/wimax/i2400m/usb.c
@@ -478,7 +478,16 @@ int i2400mu_probe(struct usb_interface *iface,
 	i2400m->bus_bm_wait_for_ack = i2400mu_bus_bm_wait_for_ack;
 	i2400m->bus_bm_mac_addr_impaired = 0;
 
-	if (id->idProduct == USB_DEVICE_ID_I6050) {
+	switch (id->idProduct) {
+	case USB_DEVICE_ID_I6050:
+	case USB_DEVICE_ID_I6050_2:
+		i2400mu->i6050 = 1;
+		break;
+	default:
+		break;
+	}
+
+	if (i2400mu->i6050) {
 		i2400m->bus_fw_names = i2400mu_bus_fw_names_6050;
 		i2400mu->endpoint_cfg.bulk_out = 0;
 		i2400mu->endpoint_cfg.notification = 3;
@@ -579,7 +588,7 @@ void i2400mu_disconnect(struct usb_interface *iface)
  *
  *    As well, the device might refuse going to sleep for whichever
  *    reason. In this case we just fail. For system suspend/hibernate,
- *    we *can't* fail. We look at usb_dev->auto_pm to see if the
+ *    we *can't* fail. We check PM_EVENT_AUTO to see if the
  *    suspend call comes from the USB stack or from the system and act
  *    in consequence.
  *
@@ -591,14 +600,11 @@ int i2400mu_suspend(struct usb_interface *iface, pm_message_t pm_msg)
 	int result = 0;
 	struct device *dev = &iface->dev;
 	struct i2400mu *i2400mu = usb_get_intfdata(iface);
-#ifdef CONFIG_PM
-	struct usb_device *usb_dev = i2400mu->usb_dev;
-#endif
 	unsigned is_autosuspend = 0;
 	struct i2400m *i2400m = &i2400mu->i2400m;
 
 #ifdef CONFIG_PM
-	if (usb_dev->auto_pm > 0)
+	if (pm_msg.event & PM_EVENT_AUTO)
 		is_autosuspend = 1;
 #endif
 
@@ -722,6 +728,7 @@ int i2400mu_post_reset(struct usb_interface *iface)
 static
 struct usb_device_id i2400mu_id_table[] = {
 	{ USB_DEVICE(0x8086, USB_DEVICE_ID_I6050) },
+	{ USB_DEVICE(0x8086, USB_DEVICE_ID_I6050_2) },
 	{ USB_DEVICE(0x8086, 0x0181) },
 	{ USB_DEVICE(0x8086, 0x1403) },
 	{ USB_DEVICE(0x8086, 0x1405) },
diff --git a/drivers/net/wireless/ath/ath5k/base.h b/drivers/net/wireless/ath/ath5k/base.h
index b72338c9bde7..952b3a21bbc3 100644
--- a/drivers/net/wireless/ath/ath5k/base.h
+++ b/drivers/net/wireless/ath/ath5k/base.h
@@ -36,7 +36,7 @@
  */
 
 /*
- * Defintions for the Atheros Wireless LAN controller driver.
+ * Definitions for the Atheros Wireless LAN controller driver.
  */
 #ifndef _DEV_ATH_ATHVAR_H
 #define _DEV_ATH_ATHVAR_H
@@ -190,7 +190,7 @@ struct ath5k_softc {
 	struct ath5k_txq	*cabq;		/* content after beacon */
 
 	int 			power_level;	/* Requested tx power in dbm */
-	bool			assoc;		/* assocate state */
+	bool			assoc;		/* associate state */
 	bool			enable_beacon;	/* true if beacons are on */
 };
 
diff --git a/drivers/net/wireless/ath/ath5k/eeprom.c b/drivers/net/wireless/ath/ath5k/eeprom.c
index 9a96550006ad..6a3f4da7fb48 100644
--- a/drivers/net/wireless/ath/ath5k/eeprom.c
+++ b/drivers/net/wireless/ath/ath5k/eeprom.c
@@ -1517,7 +1517,7 @@ ath5k_eeprom_read_target_rate_pwr_info(struct ath5k_hw *ah, unsigned int mode)
  * This info is used to calibrate the baseband power table. Imagine
  * that for each channel there is a power curve that's hw specific
  * (depends on amplifier etc) and we try to "correct" this curve using
- * offests we pass on to phy chip (baseband -> before amplifier) so that
+ * offsets we pass on to phy chip (baseband -> before amplifier) so that
  * it can use accurate power values when setting tx power (takes amplifier's
  * performance on each channel into account).
  *
diff --git a/drivers/net/wireless/ath/ath5k/phy.c b/drivers/net/wireless/ath/ath5k/phy.c
index bbfdcd5e7cb1..72474c0ccaff 100644
--- a/drivers/net/wireless/ath/ath5k/phy.c
+++ b/drivers/net/wireless/ath/ath5k/phy.c
@@ -117,7 +117,7 @@ static unsigned int ath5k_hw_rfb_op(struct ath5k_hw *ah,
 
 /*
  * This code is used to optimize rf gain on different environments
- * (temprature mostly) based on feedback from a power detector.
+ * (temperature mostly) based on feedback from a power detector.
  *
  * It's only used on RF5111 and RF5112, later RF chips seem to have
  * auto adjustment on hw -notice they have a much smaller BANK 7 and
@@ -2746,7 +2746,7 @@ ath5k_setup_channel_powertable(struct ath5k_hw *ah,
 		/* Fill curves in reverse order
 		 * from lower power (max gain)
 		 * to higher power. Use curve -> idx
-		 * backmaping we did on eeprom init */
+		 * backmapping we did on eeprom init */
 		u8 idx = pdg_curve_to_idx[pdg];
 
 		/* Grab the needed curves by index */
@@ -2848,7 +2848,7 @@ ath5k_setup_channel_powertable(struct ath5k_hw *ah,
 	/* Now we have a set of curves for this
 	 * channel on tmpL (x range is table_max - table_min
 	 * and y values are tmpL[pdg][]) sorted in the same
-	 * order as EEPROM (because we've used the backmaping).
+	 * order as EEPROM (because we've used the backmapping).
 	 * So for RF5112 it's from higher power to lower power
 	 * and for RF2413 it's from lower power to higher power.
 	 * For RF5111 we only have one curve. */
diff --git a/drivers/net/wireless/ath/ath9k/rc.c b/drivers/net/wireless/ath/ath9k/rc.c
index c915954d4d5b..70fdb9d8db82 100644
--- a/drivers/net/wireless/ath/ath9k/rc.c
+++ b/drivers/net/wireless/ath/ath9k/rc.c
@@ -880,7 +880,7 @@ static bool ath_rc_update_per(struct ath_softc *sc,
 				 * Since this probe succeeded, we allow the next
 				 * probe twice as soon.  This allows the maxRate
 				 * to move up faster if the probes are
-				 * succesful.
+				 * successful.
 				 */
 				ath_rc_priv->probe_time =
 					now_msec - rate_table->probe_interval / 2;
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index fcbf0e27d9f3..490fb45d1d05 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -2965,7 +2965,7 @@ static void do_periodic_work(struct b43_wldev *dev)
 /* Periodic work locking policy:
  * 	The whole periodic work handler is protected by
  * 	wl->mutex. If another lock is needed somewhere in the
- * 	pwork callchain, it's aquired in-place, where it's needed.
+ * 	pwork callchain, it's acquired in-place, where it's needed.
  */
 static void b43_periodic_work_handler(struct work_struct *work)
 {
diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c
index ab6a18c2e9d9..4a905b6a886b 100644
--- a/drivers/net/wireless/b43legacy/main.c
+++ b/drivers/net/wireless/b43legacy/main.c
@@ -2277,7 +2277,7 @@ static void do_periodic_work(struct b43legacy_wldev *dev)
 /* Periodic work locking policy:
  * 	The whole periodic work handler is protected by
  * 	wl->mutex. If another lock is needed somewhere in the
- * 	pwork callchain, it's aquired in-place, where it's needed.
+ * 	pwork callchain, it's acquired in-place, where it's needed.
  */
 static void b43legacy_periodic_work_handler(struct work_struct *work)
 {
diff --git a/drivers/net/wireless/ipw2x00/ipw2100.c b/drivers/net/wireless/ipw2x00/ipw2100.c
index 17a9cb3528fc..56afcf041f81 100644
--- a/drivers/net/wireless/ipw2x00/ipw2100.c
+++ b/drivers/net/wireless/ipw2x00/ipw2100.c
@@ -578,7 +578,7 @@ static int ipw2100_get_ordinal(struct ipw2100_priv *priv, u32 ord,
 		/* get number of entries */
 		field_count = *(((u16 *) & field_info) + 1);
 
-		/* abort if no enought memory */
+		/* abort if no enough memory */
 		total_length = field_len * field_count;
 		if (total_length > *len) {
 			*len = total_length;
@@ -3127,7 +3127,7 @@ static void ipw2100_tx_send_data(struct ipw2100_priv *priv)
 			     IPW_MAX_BDS)) {
 			/* TODO: Support merging buffers if more than
 			 * IPW_MAX_BDS are used */
-			IPW_DEBUG_INFO("%s: Maximum BD theshold exceeded.  "
+			IPW_DEBUG_INFO("%s: Maximum BD threshold exceeded.  "
 				       "Increase fragmentation level.\n",
 				       priv->net_dev->name);
 		}
@@ -6897,7 +6897,7 @@ static int ipw2100_wx_get_range(struct net_device *dev,
 	range->max_qual.updated = 7;	/* Updated all three */
 
 	range->avg_qual.qual = 70;	/* > 8% missed beacons is 'bad' */
-	/* TODO: Find real 'good' to 'bad' threshol value for RSSI */
+	/* TODO: Find real 'good' to 'bad' threshold value for RSSI */
 	range->avg_qual.level = 20 + IPW2100_RSSI_TO_DBM;
 	range->avg_qual.noise = 0;
 	range->avg_qual.updated = 7;	/* Updated all three */
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
index c28984ae46ff..09ddd3e6bedc 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -792,7 +792,7 @@ static int ipw_get_ordinal(struct ipw_priv *priv, u32 ord, void *val, u32 * len)
 		/* get number of entries */
 		field_count = *(((u16 *) & field_info) + 1);
 
-		/* abort if not enought memory */
+		/* abort if not enough memory */
 		total_len = field_len * field_count;
 		if (total_len > *len) {
 			*len = total_len;
@@ -7760,7 +7760,7 @@ static void ipw_rebuild_decrypted_skb(struct ipw_priv *priv,
 	case SEC_LEVEL_0:
 		break;
 	default:
-		printk(KERN_ERR "Unknow security level %d\n",
+		printk(KERN_ERR "Unknown security level %d\n",
 		       priv->ieee->sec.level);
 		break;
 	}
@@ -8926,7 +8926,7 @@ static int ipw_wx_get_range(struct net_device *dev,
 	range->max_qual.updated = 7;	/* Updated all three */
 
 	range->avg_qual.qual = 70;
-	/* TODO: Find real 'good' to 'bad' threshol value for RSSI */
+	/* TODO: Find real 'good' to 'bad' threshold value for RSSI */
 	range->avg_qual.level = 0;	/* FIXME to real average level */
 	range->avg_qual.noise = 0;
 	range->avg_qual.updated = 7;	/* Updated all three */
@@ -10299,7 +10299,7 @@ static int ipw_tx_skb(struct ipw_priv *priv, struct libipw_txb *txb,
 		case SEC_LEVEL_0:
 			break;
 		default:
-			printk(KERN_ERR "Unknow security level %d\n",
+			printk(KERN_ERR "Unknown security level %d\n",
 			       priv->ieee->sec.level);
 			break;
 		}
diff --git a/drivers/net/wireless/ipw2x00/libipw_module.c b/drivers/net/wireless/ipw2x00/libipw_module.c
index bf21eb383dbd..1ae0b2b02c38 100644
--- a/drivers/net/wireless/ipw2x00/libipw_module.c
+++ b/drivers/net/wireless/ipw2x00/libipw_module.c
@@ -199,7 +199,7 @@ struct net_device *alloc_ieee80211(int sizeof_priv, int monitor)
 	ieee->host_decrypt = 1;
 	ieee->host_mc_decrypt = 1;
 
-	/* Host fragementation in Open mode. Default is enabled.
+	/* Host fragmentation in Open mode. Default is enabled.
 	 * Note: host fragmentation is always enabled if host encryption
 	 * is enabled. For cards can do hardware encryption, they must do
 	 * hardware fragmentation as well. So we don't need a variable
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.h b/drivers/net/wireless/iwlwifi/iwl-core.h
index 675b7df632fc..27ca859e7453 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.h
+++ b/drivers/net/wireless/iwlwifi/iwl-core.h
@@ -63,7 +63,7 @@
 #ifndef __iwl_core_h__
 #define __iwl_core_h__
 
-#include <linux/utsrelease.h>
+#include <generated/utsrelease.h>
 
 /************************
  * forward declarations *
diff --git a/drivers/net/wireless/iwmc3200wifi/hal.c b/drivers/net/wireless/iwmc3200wifi/hal.c
index c430418248b4..d13c8853ee82 100644
--- a/drivers/net/wireless/iwmc3200wifi/hal.c
+++ b/drivers/net/wireless/iwmc3200wifi/hal.c
@@ -411,7 +411,7 @@ static void iwm_build_lmac_hdr(struct iwm_priv *iwm, struct iwm_lmac_hdr *hdr,
 /*
  * iwm_hal_send_host_cmd(): sends commands to the UMAC or the LMAC.
  * Sending command to the LMAC is equivalent to sending a
- * regular UMAC command with the LMAC passtrough or the LMAC
+ * regular UMAC command with the LMAC passthrough or the LMAC
  * wrapper UMAC command IDs.
  */
 int iwm_hal_send_host_cmd(struct iwm_priv *iwm,
diff --git a/drivers/net/wireless/iwmc3200wifi/rx.c b/drivers/net/wireless/iwmc3200wifi/rx.c
index 64d16fe37f9a..f727b4a83196 100644
--- a/drivers/net/wireless/iwmc3200wifi/rx.c
+++ b/drivers/net/wireless/iwmc3200wifi/rx.c
@@ -1578,7 +1578,7 @@ static void iwm_rx_process_packet(struct iwm_priv *iwm,
 		kfree_skb(packet->skb);
 		break;
 	default:
-		IWM_ERR(iwm, "Unknow ticket action: %d\n",
+		IWM_ERR(iwm, "Unknown ticket action: %d\n",
 			le16_to_cpu(ticket_node->ticket->action));
 		kfree_skb(packet->skb);
 	}
diff --git a/drivers/net/wireless/libertas/cmd.c b/drivers/net/wireless/libertas/cmd.c
index b9b371bfa30f..42611bea76a3 100644
--- a/drivers/net/wireless/libertas/cmd.c
+++ b/drivers/net/wireless/libertas/cmd.c
@@ -1365,7 +1365,7 @@ static void lbs_send_confirmsleep(struct lbs_private *priv)
 	priv->dnld_sent = DNLD_RES_RECEIVED;
 
 	/* If nothing to do, go back to sleep (?) */
-	if (!__kfifo_len(priv->event_fifo) && !priv->resp_len[priv->resp_idx])
+	if (!kfifo_len(&priv->event_fifo) && !priv->resp_len[priv->resp_idx])
 		priv->psstate = PS_STATE_SLEEP;
 
 	spin_unlock_irqrestore(&priv->driver_lock, flags);
@@ -1439,7 +1439,7 @@ void lbs_ps_confirm_sleep(struct lbs_private *priv)
 	}
 
 	/* Pending events or command responses? */
-	if (__kfifo_len(priv->event_fifo) || priv->resp_len[priv->resp_idx]) {
+	if (kfifo_len(&priv->event_fifo) || priv->resp_len[priv->resp_idx]) {
 		allowed = 0;
 		lbs_deb_host("pending events or command responses\n");
 	}
diff --git a/drivers/net/wireless/libertas/dev.h b/drivers/net/wireless/libertas/dev.h
index 6a8d2b291d8c..05bb298dfae9 100644
--- a/drivers/net/wireless/libertas/dev.h
+++ b/drivers/net/wireless/libertas/dev.h
@@ -10,7 +10,7 @@
 #include "scan.h"
 #include "assoc.h"
 
-
+#include <linux/kfifo.h>
 
 /** sleep_params */
 struct sleep_params {
@@ -120,7 +120,7 @@ struct lbs_private {
 	u32 resp_len[2];
 
 	/* Events sent from hardware to driver */
-	struct kfifo *event_fifo;
+	struct kfifo event_fifo;
 
 	/** thread to service interrupts */
 	struct task_struct *main_thread;
diff --git a/drivers/net/wireless/libertas/if_sdio.c b/drivers/net/wireless/libertas/if_sdio.c
index 09fcfad742e7..7a73f625273b 100644
--- a/drivers/net/wireless/libertas/if_sdio.c
+++ b/drivers/net/wireless/libertas/if_sdio.c
@@ -993,7 +993,7 @@ static int if_sdio_probe(struct sdio_func *func,
 	}
 
 	if (i == ARRAY_SIZE(if_sdio_models)) {
-		lbs_pr_err("unkown card model 0x%x\n", card->model);
+		lbs_pr_err("unknown card model 0x%x\n", card->model);
 		ret = -ENODEV;
 		goto free;
 	}
diff --git a/drivers/net/wireless/libertas/main.c b/drivers/net/wireless/libertas/main.c
index db38a5a719fa..c2975c8e2f21 100644
--- a/drivers/net/wireless/libertas/main.c
+++ b/drivers/net/wireless/libertas/main.c
@@ -459,7 +459,7 @@ static int lbs_thread(void *data)
 		else if (!list_empty(&priv->cmdpendingq) &&
 					!(priv->wakeup_dev_required))
 			shouldsleep = 0;	/* We have a command to send */
-		else if (__kfifo_len(priv->event_fifo))
+		else if (kfifo_len(&priv->event_fifo))
 			shouldsleep = 0;	/* We have an event to process */
 		else
 			shouldsleep = 1;	/* No command */
@@ -511,10 +511,13 @@ static int lbs_thread(void *data)
 
 		/* Process hardware events, e.g. card removed, link lost */
 		spin_lock_irq(&priv->driver_lock);
-		while (__kfifo_len(priv->event_fifo)) {
+		while (kfifo_len(&priv->event_fifo)) {
 			u32 event;
-			__kfifo_get(priv->event_fifo, (unsigned char *) &event,
-				sizeof(event));
+
+			if (kfifo_out(&priv->event_fifo,
+				(unsigned char *) &event, sizeof(event)) !=
+				sizeof(event))
+					break;
 			spin_unlock_irq(&priv->driver_lock);
 			lbs_process_event(priv, event);
 			spin_lock_irq(&priv->driver_lock);
@@ -883,10 +886,9 @@ static int lbs_init_adapter(struct lbs_private *priv)
 	priv->resp_len[0] = priv->resp_len[1] = 0;
 
 	/* Create the event FIFO */
-	priv->event_fifo = kfifo_alloc(sizeof(u32) * 16, GFP_KERNEL, NULL);
-	if (IS_ERR(priv->event_fifo)) {
+	ret = kfifo_alloc(&priv->event_fifo, sizeof(u32) * 16, GFP_KERNEL);
+	if (ret) {
 		lbs_pr_err("Out of memory allocating event FIFO buffer\n");
-		ret = -ENOMEM;
 		goto out;
 	}
 
@@ -901,8 +903,7 @@ static void lbs_free_adapter(struct lbs_private *priv)
 	lbs_deb_enter(LBS_DEB_MAIN);
 
 	lbs_free_cmd_buffer(priv);
-	if (priv->event_fifo)
-		kfifo_free(priv->event_fifo);
+	kfifo_free(&priv->event_fifo);
 	del_timer(&priv->command_timer);
 	del_timer(&priv->auto_deepsleep_timer);
 	kfree(priv->networks);
@@ -1177,7 +1178,7 @@ void lbs_queue_event(struct lbs_private *priv, u32 event)
 	if (priv->psstate == PS_STATE_SLEEP)
 		priv->psstate = PS_STATE_AWAKE;
 
-	__kfifo_put(priv->event_fifo, (unsigned char *) &event, sizeof(u32));
+	kfifo_in(&priv->event_fifo, (unsigned char *) &event, sizeof(u32));
 
 	wake_up_interruptible(&priv->waitq);
 
diff --git a/drivers/net/wireless/libertas/mesh.c b/drivers/net/wireless/libertas/mesh.c
index 2f91c9b808af..92b7a357a5e4 100644
--- a/drivers/net/wireless/libertas/mesh.c
+++ b/drivers/net/wireless/libertas/mesh.c
@@ -2,6 +2,7 @@
 #include <linux/delay.h>
 #include <linux/etherdevice.h>
 #include <linux/netdevice.h>
+#include <linux/if_ether.h>
 #include <linux/if_arp.h>
 #include <linux/kthread.h>
 #include <linux/kfifo.h>
@@ -351,8 +352,7 @@ int lbs_add_mesh(struct lbs_private *priv)
 
 	mesh_dev->netdev_ops = &mesh_netdev_ops;
 	mesh_dev->ethtool_ops = &lbs_ethtool_ops;
-	memcpy(mesh_dev->dev_addr, priv->dev->dev_addr,
-			sizeof(priv->dev->dev_addr));
+	memcpy(mesh_dev->dev_addr, priv->dev->dev_addr, ETH_ALEN);
 
 	SET_NETDEV_DEV(priv->mesh_dev, priv->dev->dev.parent);
 
diff --git a/drivers/net/wireless/orinoco/hermes_dld.c b/drivers/net/wireless/orinoco/hermes_dld.c
index 6d5660defd87..fb157eb889ca 100644
--- a/drivers/net/wireless/orinoco/hermes_dld.c
+++ b/drivers/net/wireless/orinoco/hermes_dld.c
@@ -550,7 +550,7 @@ static const struct {							\
 
 #define DEFAULT_PDR(pid) default_pdr_data_##pid
 
-/*  HWIF Compatiblity */
+/*  HWIF Compatibility */
 DEFINE_DEFAULT_PDR(0x0005, 10, "\x00\x00\x06\x00\x01\x00\x01\x00\x01\x00");
 
 /* PPPPSign */
@@ -656,7 +656,7 @@ int hermes_apply_pda_with_defaults(hermes_t *hw,
 					 record_id + 1, pdi);
 			}
 			break;
-		case 0x5: /*  HWIF Compatiblity */
+		case 0x5: /*  HWIF Compatibility */
 			default_pdi = (struct pdi *) &DEFAULT_PDR(0x0005);
 			break;
 		case 0x108: /* PPPPSign */
diff --git a/drivers/net/wireless/prism54/isl_ioctl.c b/drivers/net/wireless/prism54/isl_ioctl.c
index bc08464d8323..f7f5c793514b 100644
--- a/drivers/net/wireless/prism54/isl_ioctl.c
+++ b/drivers/net/wireless/prism54/isl_ioctl.c
@@ -1897,7 +1897,7 @@ prism54_get_mac(struct net_device *ndev, struct iw_request_info *info,
 	return 0;
 }
 
-/* Setting policy also clears the MAC acl, even if we don't change the defaut
+/* Setting policy also clears the MAC acl, even if we don't change the default
  * policy
  */
 
@@ -2323,7 +2323,7 @@ prism54_process_trap_helper(islpci_private *priv, enum oid_num_t oid,
 
 	case DOT11_OID_BEACON:
 		send_formatted_event(priv,
-				     "Received a beacon from an unkown AP",
+				     "Received a beacon from an unknown AP",
 				     mlme, 0);
 		break;
 
diff --git a/drivers/net/wireless/rt2x00/rt2400pci.h b/drivers/net/wireless/rt2x00/rt2400pci.h
index 6c21ef66dfe0..c3dea697b907 100644
--- a/drivers/net/wireless/rt2x00/rt2400pci.h
+++ b/drivers/net/wireless/rt2x00/rt2400pci.h
@@ -35,7 +35,7 @@
 
 /*
  * Signal information.
- * Defaul offset is required for RSSI <-> dBm conversion.
+ * Default offset is required for RSSI <-> dBm conversion.
  */
 #define DEFAULT_RSSI_OFFSET		100
 
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.h b/drivers/net/wireless/rt2x00/rt2500pci.h
index b0075674c09b..c6bd1fcae7eb 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.h
+++ b/drivers/net/wireless/rt2x00/rt2500pci.h
@@ -46,7 +46,7 @@
 
 /*
  * Signal information.
- * Defaul offset is required for RSSI <-> dBm conversion.
+ * Default offset is required for RSSI <-> dBm conversion.
  */
 #define DEFAULT_RSSI_OFFSET		121
 
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.h b/drivers/net/wireless/rt2x00/rt2500usb.h
index 341a70454635..b493306a7eed 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.h
+++ b/drivers/net/wireless/rt2x00/rt2500usb.h
@@ -46,7 +46,7 @@
 
 /*
  * Signal information.
- * Defaul offset is required for RSSI <-> dBm conversion.
+ * Default offset is required for RSSI <-> dBm conversion.
  */
 #define DEFAULT_RSSI_OFFSET		120
 
diff --git a/drivers/net/wireless/rt2x00/rt61pci.h b/drivers/net/wireless/rt2x00/rt61pci.h
index 6f33f7f5668c..8f13810622bd 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.h
+++ b/drivers/net/wireless/rt2x00/rt61pci.h
@@ -37,7 +37,7 @@
 
 /*
  * Signal information.
- * Defaul offset is required for RSSI <-> dBm conversion.
+ * Default offset is required for RSSI <-> dBm conversion.
  */
 #define DEFAULT_RSSI_OFFSET		120
 
diff --git a/drivers/net/wireless/rt2x00/rt73usb.h b/drivers/net/wireless/rt2x00/rt73usb.h
index e783a099a8f1..7942f810e928 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.h
+++ b/drivers/net/wireless/rt2x00/rt73usb.h
@@ -37,7 +37,7 @@
 
 /*
  * Signal information.
- * Defaul offset is required for RSSI <-> dBm conversion.
+ * Default offset is required for RSSI <-> dBm conversion.
  */
 #define DEFAULT_RSSI_OFFSET		120
 
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.c b/drivers/net/wireless/zd1211rw/zd_mac.c
index 9d9b263733e6..f14deb0c8514 100644
--- a/drivers/net/wireless/zd1211rw/zd_mac.c
+++ b/drivers/net/wireless/zd1211rw/zd_mac.c
@@ -374,7 +374,7 @@ static void zd_mac_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb,
  * zd_mac_tx_failed - callback for failed frames
  * @dev: the mac80211 wireless device
  *
- * This function is called if a frame couldn't be succesfully be
+ * This function is called if a frame couldn't be successfully be
  * transferred. The first frame from the tx queue, will be selected and
  * reported as error to the upper layers.
  */
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index baa051d5bfbe..a869b45d3d37 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -42,6 +42,7 @@
 #include <linux/mm.h>
 #include <net/ip.h>
 
+#include <xen/xen.h>
 #include <xen/xenbus.h>
 #include <xen/events.h>
 #include <xen/page.h>
diff --git a/drivers/of/platform.c b/drivers/of/platform.c
index 298de0f95d70..d58ade170c4b 100644
--- a/drivers/of/platform.c
+++ b/drivers/of/platform.c
@@ -65,47 +65,322 @@ static int of_platform_device_remove(struct device *dev)
 	return 0;
 }
 
-static int of_platform_device_suspend(struct device *dev, pm_message_t state)
+static void of_platform_device_shutdown(struct device *dev)
 {
 	struct of_device *of_dev = to_of_device(dev);
 	struct of_platform_driver *drv = to_of_platform_driver(dev->driver);
-	int error = 0;
 
-	if (dev->driver && drv->suspend)
-		error = drv->suspend(of_dev, state);
-	return error;
+	if (dev->driver && drv->shutdown)
+		drv->shutdown(of_dev);
 }
 
-static int of_platform_device_resume(struct device * dev)
+#ifdef CONFIG_PM_SLEEP
+
+static int of_platform_legacy_suspend(struct device *dev, pm_message_t mesg)
 {
 	struct of_device *of_dev = to_of_device(dev);
 	struct of_platform_driver *drv = to_of_platform_driver(dev->driver);
-	int error = 0;
+	int ret = 0;
 
-	if (dev->driver && drv->resume)
-		error = drv->resume(of_dev);
-	return error;
+	if (dev->driver && drv->suspend)
+		ret = drv->suspend(of_dev, mesg);
+	return ret;
 }
 
-static void of_platform_device_shutdown(struct device *dev)
+static int of_platform_legacy_resume(struct device *dev)
 {
 	struct of_device *of_dev = to_of_device(dev);
 	struct of_platform_driver *drv = to_of_platform_driver(dev->driver);
+	int ret = 0;
 
-	if (dev->driver && drv->shutdown)
-		drv->shutdown(of_dev);
+	if (dev->driver && drv->resume)
+		ret = drv->resume(of_dev);
+	return ret;
+}
+
+static int of_platform_pm_prepare(struct device *dev)
+{
+	struct device_driver *drv = dev->driver;
+	int ret = 0;
+
+	if (drv && drv->pm && drv->pm->prepare)
+		ret = drv->pm->prepare(dev);
+
+	return ret;
+}
+
+static void of_platform_pm_complete(struct device *dev)
+{
+	struct device_driver *drv = dev->driver;
+
+	if (drv && drv->pm && drv->pm->complete)
+		drv->pm->complete(dev);
+}
+
+#ifdef CONFIG_SUSPEND
+
+static int of_platform_pm_suspend(struct device *dev)
+{
+	struct device_driver *drv = dev->driver;
+	int ret = 0;
+
+	if (!drv)
+		return 0;
+
+	if (drv->pm) {
+		if (drv->pm->suspend)
+			ret = drv->pm->suspend(dev);
+	} else {
+		ret = of_platform_legacy_suspend(dev, PMSG_SUSPEND);
+	}
+
+	return ret;
 }
 
+static int of_platform_pm_suspend_noirq(struct device *dev)
+{
+	struct device_driver *drv = dev->driver;
+	int ret = 0;
+
+	if (!drv)
+		return 0;
+
+	if (drv->pm) {
+		if (drv->pm->suspend_noirq)
+			ret = drv->pm->suspend_noirq(dev);
+	}
+
+	return ret;
+}
+
+static int of_platform_pm_resume(struct device *dev)
+{
+	struct device_driver *drv = dev->driver;
+	int ret = 0;
+
+	if (!drv)
+		return 0;
+
+	if (drv->pm) {
+		if (drv->pm->resume)
+			ret = drv->pm->resume(dev);
+	} else {
+		ret = of_platform_legacy_resume(dev);
+	}
+
+	return ret;
+}
+
+static int of_platform_pm_resume_noirq(struct device *dev)
+{
+	struct device_driver *drv = dev->driver;
+	int ret = 0;
+
+	if (!drv)
+		return 0;
+
+	if (drv->pm) {
+		if (drv->pm->resume_noirq)
+			ret = drv->pm->resume_noirq(dev);
+	}
+
+	return ret;
+}
+
+#else /* !CONFIG_SUSPEND */
+
+#define of_platform_pm_suspend		NULL
+#define of_platform_pm_resume		NULL
+#define of_platform_pm_suspend_noirq	NULL
+#define of_platform_pm_resume_noirq	NULL
+
+#endif /* !CONFIG_SUSPEND */
+
+#ifdef CONFIG_HIBERNATION
+
+static int of_platform_pm_freeze(struct device *dev)
+{
+	struct device_driver *drv = dev->driver;
+	int ret = 0;
+
+	if (!drv)
+		return 0;
+
+	if (drv->pm) {
+		if (drv->pm->freeze)
+			ret = drv->pm->freeze(dev);
+	} else {
+		ret = of_platform_legacy_suspend(dev, PMSG_FREEZE);
+	}
+
+	return ret;
+}
+
+static int of_platform_pm_freeze_noirq(struct device *dev)
+{
+	struct device_driver *drv = dev->driver;
+	int ret = 0;
+
+	if (!drv)
+		return 0;
+
+	if (drv->pm) {
+		if (drv->pm->freeze_noirq)
+			ret = drv->pm->freeze_noirq(dev);
+	}
+
+	return ret;
+}
+
+static int of_platform_pm_thaw(struct device *dev)
+{
+	struct device_driver *drv = dev->driver;
+	int ret = 0;
+
+	if (!drv)
+		return 0;
+
+	if (drv->pm) {
+		if (drv->pm->thaw)
+			ret = drv->pm->thaw(dev);
+	} else {
+		ret = of_platform_legacy_resume(dev);
+	}
+
+	return ret;
+}
+
+static int of_platform_pm_thaw_noirq(struct device *dev)
+{
+	struct device_driver *drv = dev->driver;
+	int ret = 0;
+
+	if (!drv)
+		return 0;
+
+	if (drv->pm) {
+		if (drv->pm->thaw_noirq)
+			ret = drv->pm->thaw_noirq(dev);
+	}
+
+	return ret;
+}
+
+static int of_platform_pm_poweroff(struct device *dev)
+{
+	struct device_driver *drv = dev->driver;
+	int ret = 0;
+
+	if (!drv)
+		return 0;
+
+	if (drv->pm) {
+		if (drv->pm->poweroff)
+			ret = drv->pm->poweroff(dev);
+	} else {
+		ret = of_platform_legacy_suspend(dev, PMSG_HIBERNATE);
+	}
+
+	return ret;
+}
+
+static int of_platform_pm_poweroff_noirq(struct device *dev)
+{
+	struct device_driver *drv = dev->driver;
+	int ret = 0;
+
+	if (!drv)
+		return 0;
+
+	if (drv->pm) {
+		if (drv->pm->poweroff_noirq)
+			ret = drv->pm->poweroff_noirq(dev);
+	}
+
+	return ret;
+}
+
+static int of_platform_pm_restore(struct device *dev)
+{
+	struct device_driver *drv = dev->driver;
+	int ret = 0;
+
+	if (!drv)
+		return 0;
+
+	if (drv->pm) {
+		if (drv->pm->restore)
+			ret = drv->pm->restore(dev);
+	} else {
+		ret = of_platform_legacy_resume(dev);
+	}
+
+	return ret;
+}
+
+static int of_platform_pm_restore_noirq(struct device *dev)
+{
+	struct device_driver *drv = dev->driver;
+	int ret = 0;
+
+	if (!drv)
+		return 0;
+
+	if (drv->pm) {
+		if (drv->pm->restore_noirq)
+			ret = drv->pm->restore_noirq(dev);
+	}
+
+	return ret;
+}
+
+#else /* !CONFIG_HIBERNATION */
+
+#define of_platform_pm_freeze		NULL
+#define of_platform_pm_thaw		NULL
+#define of_platform_pm_poweroff		NULL
+#define of_platform_pm_restore		NULL
+#define of_platform_pm_freeze_noirq	NULL
+#define of_platform_pm_thaw_noirq		NULL
+#define of_platform_pm_poweroff_noirq	NULL
+#define of_platform_pm_restore_noirq	NULL
+
+#endif /* !CONFIG_HIBERNATION */
+
+static struct dev_pm_ops of_platform_dev_pm_ops = {
+	.prepare = of_platform_pm_prepare,
+	.complete = of_platform_pm_complete,
+	.suspend = of_platform_pm_suspend,
+	.resume = of_platform_pm_resume,
+	.freeze = of_platform_pm_freeze,
+	.thaw = of_platform_pm_thaw,
+	.poweroff = of_platform_pm_poweroff,
+	.restore = of_platform_pm_restore,
+	.suspend_noirq = of_platform_pm_suspend_noirq,
+	.resume_noirq = of_platform_pm_resume_noirq,
+	.freeze_noirq = of_platform_pm_freeze_noirq,
+	.thaw_noirq = of_platform_pm_thaw_noirq,
+	.poweroff_noirq = of_platform_pm_poweroff_noirq,
+	.restore_noirq = of_platform_pm_restore_noirq,
+};
+
+#define OF_PLATFORM_PM_OPS_PTR	(&of_platform_dev_pm_ops)
+
+#else /* !CONFIG_PM_SLEEP */
+
+#define OF_PLATFORM_PM_OPS_PTR	NULL
+
+#endif /* !CONFIG_PM_SLEEP */
+
 int of_bus_type_init(struct bus_type *bus, const char *name)
 {
 	bus->name = name;
 	bus->match = of_platform_bus_match;
 	bus->probe = of_platform_device_probe;
 	bus->remove = of_platform_device_remove;
-	bus->suspend = of_platform_device_suspend;
-	bus->resume = of_platform_device_resume;
 	bus->shutdown = of_platform_device_shutdown;
 	bus->dev_attrs = of_platform_device_attrs;
+	bus->pm = OF_PLATFORM_PM_OPS_PTR;
 	return bus_register(bus);
 }
 
diff --git a/drivers/oprofile/cpu_buffer.c b/drivers/oprofile/cpu_buffer.c
index a7aae24f2889..166b67ea622f 100644
--- a/drivers/oprofile/cpu_buffer.c
+++ b/drivers/oprofile/cpu_buffer.c
@@ -47,7 +47,7 @@
  */
 static struct ring_buffer *op_ring_buffer_read;
 static struct ring_buffer *op_ring_buffer_write;
-DEFINE_PER_CPU(struct oprofile_cpu_buffer, cpu_buffer);
+DEFINE_PER_CPU(struct oprofile_cpu_buffer, op_cpu_buffer);
 
 static void wq_sync_buffer(struct work_struct *work);
 
@@ -61,8 +61,7 @@ unsigned long oprofile_get_cpu_buffer_size(void)
 
 void oprofile_cpu_buffer_inc_smpl_lost(void)
 {
-	struct oprofile_cpu_buffer *cpu_buf
-		= &__get_cpu_var(cpu_buffer);
+	struct oprofile_cpu_buffer *cpu_buf = &__get_cpu_var(op_cpu_buffer);
 
 	cpu_buf->sample_lost_overflow++;
 }
@@ -95,7 +94,7 @@ int alloc_cpu_buffers(void)
 		goto fail;
 
 	for_each_possible_cpu(i) {
-		struct oprofile_cpu_buffer *b = &per_cpu(cpu_buffer, i);
+		struct oprofile_cpu_buffer *b = &per_cpu(op_cpu_buffer, i);
 
 		b->last_task = NULL;
 		b->last_is_kernel = -1;
@@ -122,7 +121,7 @@ void start_cpu_work(void)
 	work_enabled = 1;
 
 	for_each_online_cpu(i) {
-		struct oprofile_cpu_buffer *b = &per_cpu(cpu_buffer, i);
+		struct oprofile_cpu_buffer *b = &per_cpu(op_cpu_buffer, i);
 
 		/*
 		 * Spread the work by 1 jiffy per cpu so they dont all
@@ -139,7 +138,7 @@ void end_cpu_work(void)
 	work_enabled = 0;
 
 	for_each_online_cpu(i) {
-		struct oprofile_cpu_buffer *b = &per_cpu(cpu_buffer, i);
+		struct oprofile_cpu_buffer *b = &per_cpu(op_cpu_buffer, i);
 
 		cancel_delayed_work(&b->work);
 	}
@@ -330,7 +329,7 @@ static inline void
 __oprofile_add_ext_sample(unsigned long pc, struct pt_regs * const regs,
 			  unsigned long event, int is_kernel)
 {
-	struct oprofile_cpu_buffer *cpu_buf = &__get_cpu_var(cpu_buffer);
+	struct oprofile_cpu_buffer *cpu_buf = &__get_cpu_var(op_cpu_buffer);
 	unsigned long backtrace = oprofile_backtrace_depth;
 
 	/*
@@ -375,7 +374,7 @@ oprofile_write_reserve(struct op_entry *entry, struct pt_regs * const regs,
 {
 	struct op_sample *sample;
 	int is_kernel = !user_mode(regs);
-	struct oprofile_cpu_buffer *cpu_buf = &__get_cpu_var(cpu_buffer);
+	struct oprofile_cpu_buffer *cpu_buf = &__get_cpu_var(op_cpu_buffer);
 
 	cpu_buf->sample_received++;
 
@@ -430,13 +429,13 @@ int oprofile_write_commit(struct op_entry *entry)
 
 void oprofile_add_pc(unsigned long pc, int is_kernel, unsigned long event)
 {
-	struct oprofile_cpu_buffer *cpu_buf = &__get_cpu_var(cpu_buffer);
+	struct oprofile_cpu_buffer *cpu_buf = &__get_cpu_var(op_cpu_buffer);
 	log_sample(cpu_buf, pc, 0, is_kernel, event);
 }
 
 void oprofile_add_trace(unsigned long pc)
 {
-	struct oprofile_cpu_buffer *cpu_buf = &__get_cpu_var(cpu_buffer);
+	struct oprofile_cpu_buffer *cpu_buf = &__get_cpu_var(op_cpu_buffer);
 
 	if (!cpu_buf->tracing)
 		return;
diff --git a/drivers/oprofile/cpu_buffer.h b/drivers/oprofile/cpu_buffer.h
index 272995d20293..68ea16ab645f 100644
--- a/drivers/oprofile/cpu_buffer.h
+++ b/drivers/oprofile/cpu_buffer.h
@@ -50,7 +50,7 @@ struct oprofile_cpu_buffer {
 	struct delayed_work work;
 };
 
-DECLARE_PER_CPU(struct oprofile_cpu_buffer, cpu_buffer);
+DECLARE_PER_CPU(struct oprofile_cpu_buffer, op_cpu_buffer);
 
 /*
  * Resets the cpu buffer to a sane state.
@@ -60,7 +60,7 @@ DECLARE_PER_CPU(struct oprofile_cpu_buffer, cpu_buffer);
  */
 static inline void op_cpu_buffer_reset(int cpu)
 {
-	struct oprofile_cpu_buffer *cpu_buf = &per_cpu(cpu_buffer, cpu);
+	struct oprofile_cpu_buffer *cpu_buf = &per_cpu(op_cpu_buffer, cpu);
 
 	cpu_buf->last_is_kernel = -1;
 	cpu_buf->last_task = NULL;
diff --git a/drivers/oprofile/oprofile_stats.c b/drivers/oprofile/oprofile_stats.c
index 61689e814d46..917d28ebeacd 100644
--- a/drivers/oprofile/oprofile_stats.c
+++ b/drivers/oprofile/oprofile_stats.c
@@ -23,7 +23,7 @@ void oprofile_reset_stats(void)
 	int i;
 
 	for_each_possible_cpu(i) {
-		cpu_buf = &per_cpu(cpu_buffer, i);
+		cpu_buf = &per_cpu(op_cpu_buffer, i);
 		cpu_buf->sample_received = 0;
 		cpu_buf->sample_lost_overflow = 0;
 		cpu_buf->backtrace_aborted = 0;
@@ -51,7 +51,7 @@ void oprofile_create_stats_files(struct super_block *sb, struct dentry *root)
 		return;
 
 	for_each_possible_cpu(i) {
-		cpu_buf = &per_cpu(cpu_buffer, i);
+		cpu_buf = &per_cpu(op_cpu_buffer, i);
 		snprintf(buf, 10, "cpu%d", i);
 		cpudir = oprofilefs_mkdir(sb, dir, buf);
 
diff --git a/drivers/parisc/ccio-dma.c b/drivers/parisc/ccio-dma.c
index a6b4a5a53d40..f511e70d454c 100644
--- a/drivers/parisc/ccio-dma.c
+++ b/drivers/parisc/ccio-dma.c
@@ -650,7 +650,7 @@ ccio_clear_io_tlb(struct ioc *ioc, dma_addr_t iovp, size_t byte_cnt)
  * Mark the I/O Pdir entries invalid and blow away the corresponding I/O
  * TLB entries.
  *
- * FIXME: at some threshhold it might be "cheaper" to just blow
+ * FIXME: at some threshold it might be "cheaper" to just blow
  *        away the entire I/O TLB instead of individual entries.
  *
  * FIXME: Uturn has 256 TLB entries. We don't need to purge every
diff --git a/drivers/parisc/dino.c b/drivers/parisc/dino.c
index d69bde6a2343..c542c7bb7454 100644
--- a/drivers/parisc/dino.c
+++ b/drivers/parisc/dino.c
@@ -354,7 +354,7 @@ static unsigned int dino_startup_irq(unsigned int irq)
 }
 
 static struct irq_chip dino_interrupt_type = {
-	.typename	= "GSC-PCI",
+	.name		= "GSC-PCI",
 	.startup	= dino_startup_irq,
 	.shutdown	= dino_disable_irq,
 	.enable		= dino_enable_irq, 
diff --git a/drivers/parisc/eisa.c b/drivers/parisc/eisa.c
index 51220749cb65..46f503fb7fc5 100644
--- a/drivers/parisc/eisa.c
+++ b/drivers/parisc/eisa.c
@@ -189,7 +189,7 @@ static unsigned int eisa_startup_irq(unsigned int irq)
 }
 
 static struct irq_chip eisa_interrupt_type = {
-	.typename =	"EISA",
+	.name	 =	"EISA",
 	.startup =	eisa_startup_irq,
 	.shutdown =	eisa_disable_irq,
 	.enable =	eisa_enable_irq,
diff --git a/drivers/parisc/eisa_eeprom.c b/drivers/parisc/eisa_eeprom.c
index 8c0b26e9b98a..cce00ed81f37 100644
--- a/drivers/parisc/eisa_eeprom.c
+++ b/drivers/parisc/eisa_eeprom.c
@@ -75,17 +75,8 @@ static ssize_t eisa_eeprom_read(struct file * file,
 	return ret;
 }
 
-static int eisa_eeprom_ioctl(struct inode *inode, struct file *file, 
-			   unsigned int cmd,
-			   unsigned long arg)
-{
-	return -ENOTTY;
-}
-
 static int eisa_eeprom_open(struct inode *inode, struct file *file)
 {
-	cycle_kernel_lock();
-
 	if (file->f_mode & FMODE_WRITE)
 		return -EINVAL;
    
@@ -104,7 +95,6 @@ static const struct file_operations eisa_eeprom_fops = {
 	.owner =	THIS_MODULE,
 	.llseek =	eisa_eeprom_llseek,
 	.read =		eisa_eeprom_read,
-	.ioctl =	eisa_eeprom_ioctl,
 	.open =		eisa_eeprom_open,
 	.release =	eisa_eeprom_release,
 };
diff --git a/drivers/parisc/gsc.c b/drivers/parisc/gsc.c
index 647adc9f85ad..c4e1f3c3c2fa 100644
--- a/drivers/parisc/gsc.c
+++ b/drivers/parisc/gsc.c
@@ -149,7 +149,7 @@ static unsigned int gsc_asic_startup_irq(unsigned int irq)
 }
 
 static struct irq_chip gsc_asic_interrupt_type = {
-	.typename =	"GSC-ASIC",
+	.name	 =	"GSC-ASIC",
 	.startup =	gsc_asic_startup_irq,
 	.shutdown =	gsc_asic_disable_irq,
 	.enable =	gsc_asic_enable_irq,
diff --git a/drivers/parisc/iosapic.c b/drivers/parisc/iosapic.c
index 88e333553212..c76836727cae 100644
--- a/drivers/parisc/iosapic.c
+++ b/drivers/parisc/iosapic.c
@@ -730,7 +730,7 @@ static int iosapic_set_affinity_irq(unsigned int irq,
 #endif
 
 static struct irq_chip iosapic_interrupt_type = {
-	.typename =	"IO-SAPIC-level",
+	.name	 =	"IO-SAPIC-level",
 	.startup =	iosapic_startup_irq,
 	.shutdown =	iosapic_disable_irq,
 	.enable =	iosapic_enable_irq,
diff --git a/drivers/parisc/led.c b/drivers/parisc/led.c
index 79caf1ca4a29..188bc8496a26 100644
--- a/drivers/parisc/led.c
+++ b/drivers/parisc/led.c
@@ -38,6 +38,7 @@
 #include <linux/kernel_stat.h>
 #include <linux/reboot.h>
 #include <linux/proc_fs.h>
+#include <linux/seq_file.h>
 #include <linux/ctype.h>
 #include <linux/blkdev.h>
 #include <linux/workqueue.h>
@@ -147,41 +148,34 @@ device_initcall(start_task);
 static void (*led_func_ptr) (unsigned char) __read_mostly;
 
 #ifdef CONFIG_PROC_FS
-static int led_proc_read(char *page, char **start, off_t off, int count, 
-	int *eof, void *data)
+static int led_proc_show(struct seq_file *m, void *v)
 {
-	char *out = page;
-	int len;
-
-	switch ((long)data)
+	switch ((long)m->private)
 	{
 	case LED_NOLCD:
-		out += sprintf(out, "Heartbeat: %d\n", led_heartbeat);
-		out += sprintf(out, "Disk IO: %d\n", led_diskio);
-		out += sprintf(out, "LAN Rx/Tx: %d\n", led_lanrxtx);
+		seq_printf(m, "Heartbeat: %d\n", led_heartbeat);
+		seq_printf(m, "Disk IO: %d\n", led_diskio);
+		seq_printf(m, "LAN Rx/Tx: %d\n", led_lanrxtx);
 		break;
 	case LED_HASLCD:
-		out += sprintf(out, "%s\n", lcd_text);
+		seq_printf(m, "%s\n", lcd_text);
 		break;
 	default:
-		*eof = 1;
 		return 0;
 	}
+	return 0;
+}
 
-	len = out - page - off;
-	if (len < count) {
-		*eof = 1;
-		if (len <= 0) return 0;
-	} else {
-		len = count;
-	}
-	*start = page + off;
-	return len;
+static int led_proc_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, led_proc_show, PDE(inode)->data);
 }
 
-static int led_proc_write(struct file *file, const char *buf, 
-	unsigned long count, void *data)
+
+static ssize_t led_proc_write(struct file *file, const char *buf,
+	size_t count, loff_t *pos)
 {
+	void *data = PDE(file->f_path.dentry->d_inode)->data;
 	char *cur, lbuf[count + 1];
 	int d;
 
@@ -234,6 +228,15 @@ parse_error:
 	return -EINVAL;
 }
 
+static const struct file_operations led_proc_fops = {
+	.owner		= THIS_MODULE,
+	.open		= led_proc_open,
+	.read		= seq_read,
+	.llseek		= seq_lseek,
+	.release	= single_release,
+	.write		= led_proc_write,
+};
+
 static int __init led_create_procfs(void)
 {
 	struct proc_dir_entry *proc_pdc_root = NULL;
@@ -243,19 +246,15 @@ static int __init led_create_procfs(void)
 
 	proc_pdc_root = proc_mkdir("pdc", 0);
 	if (!proc_pdc_root) return -1;
-	ent = create_proc_entry("led", S_IFREG|S_IRUGO|S_IWUSR, proc_pdc_root);
+	ent = proc_create_data("led", S_IRUGO|S_IWUSR, proc_pdc_root,
+				&led_proc_fops, (void *)LED_NOLCD); /* LED */
 	if (!ent) return -1;
-	ent->data = (void *)LED_NOLCD; /* LED */
-	ent->read_proc = led_proc_read;
-	ent->write_proc = led_proc_write;
 
 	if (led_type == LED_HASLCD)
 	{
-		ent = create_proc_entry("lcd", S_IFREG|S_IRUGO|S_IWUSR, proc_pdc_root);
+		ent = proc_create_data("lcd", S_IRUGO|S_IWUSR, proc_pdc_root,
+					&led_proc_fops, (void *)LED_HASLCD); /* LCD */
 		if (!ent) return -1;
-		ent->data = (void *)LED_HASLCD; /* LCD */
-		ent->read_proc = led_proc_read;
-		ent->write_proc = led_proc_write;
 	}
 
 	return 0;
diff --git a/drivers/parisc/pdc_stable.c b/drivers/parisc/pdc_stable.c
index 13a64bc081b6..0bc5d474b168 100644
--- a/drivers/parisc/pdc_stable.c
+++ b/drivers/parisc/pdc_stable.c
@@ -779,12 +779,9 @@ static ssize_t pdcs_auto_write(struct kobject *kobj,
 	read_unlock(&pathentry->rw_lock);
 	
 	DPRINTK("%s: flags before: 0x%X\n", __func__, flags);
-			
-	temp = in;
-	
-	while (*temp && isspace(*temp))
-		temp++;
-	
+
+	temp = skip_spaces(in);
+
 	c = *temp++ - '0';
 	if ((c != 0) && (c != 1))
 		goto parse_error;
diff --git a/drivers/parisc/superio.c b/drivers/parisc/superio.c
index 675f04e6597a..a35c9c5b89e8 100644
--- a/drivers/parisc/superio.c
+++ b/drivers/parisc/superio.c
@@ -326,7 +326,7 @@ static unsigned int superio_startup_irq(unsigned int irq)
 }
 
 static struct irq_chip superio_interrupt_type = {
-	.typename =	SUPERIO,
+	.name	 =	SUPERIO,
 	.startup =	superio_startup_irq,
 	.shutdown =	superio_disable_irq,
 	.enable =	superio_enable_irq,
diff --git a/drivers/parport/parport_pc.c b/drivers/parport/parport_pc.c
index 2597145a066e..ad113b0f62db 100644
--- a/drivers/parport/parport_pc.c
+++ b/drivers/parport/parport_pc.c
@@ -3403,7 +3403,7 @@ static int __init parport_parse_param(const char *s, int *val,
 		*val = automatic;
 	else if (!strncmp(s, "none", 4))
 		*val = none;
-	else if (nofifo && !strncmp(s, "nofifo", 4))
+	else if (nofifo && !strncmp(s, "nofifo", 6))
 		*val = nofifo;
 	else {
 		char *ep;
diff --git a/drivers/pci/Kconfig b/drivers/pci/Kconfig
index fdc864f9cf23..b1ecefa2a23d 100644
--- a/drivers/pci/Kconfig
+++ b/drivers/pci/Kconfig
@@ -27,10 +27,10 @@ config PCI_LEGACY
 	default y
 	help
 	  Say Y here if you want to include support for the deprecated
-	  pci_find_slot() and pci_find_device() APIs.  Most drivers have
-	  been converted over to using the proper hotplug APIs, so this
-	  option serves to include/exclude only a few drivers that are
-	  still using this API.
+	  pci_find_device() API.  Most drivers have been converted over
+	  to using the proper hotplug APIs, so this option serves to
+	  include/exclude only a few drivers that are still using this
+	  API.
 
 config PCI_DEBUG
 	bool "PCI Debugging"
@@ -69,3 +69,10 @@ config PCI_IOV
 	  physical resources.
 
 	  If unsure, say N.
+
+config PCI_IOAPIC
+	bool
+	depends on PCI
+	depends on ACPI
+	depends on HOTPLUG
+	default y
diff --git a/drivers/pci/Makefile b/drivers/pci/Makefile
index 4a7f11d8f432..4df48d58eaa6 100644
--- a/drivers/pci/Makefile
+++ b/drivers/pci/Makefile
@@ -14,6 +14,8 @@ CFLAGS_legacy.o += -Wno-deprecated-declarations
 # Build PCI Express stuff if needed
 obj-$(CONFIG_PCIEPORTBUS) += pcie/
 
+obj-$(CONFIG_PCI_IOAPIC) += ioapic.o
+
 obj-$(CONFIG_HOTPLUG) += hotplug.o
 
 # Build the PCI Hotplug drivers if we were asked to
diff --git a/drivers/pci/dmar.c b/drivers/pci/dmar.c
index 416f6ac65b76..83aae4747594 100644
--- a/drivers/pci/dmar.c
+++ b/drivers/pci/dmar.c
@@ -320,7 +320,7 @@ found:
 	for (bus = dev->bus; bus; bus = bus->parent) {
 		struct pci_dev *bridge = bus->self;
 
-		if (!bridge || !bridge->is_pcie ||
+		if (!bridge || !pci_is_pcie(bridge) ||
 		    bridge->pcie_type == PCI_EXP_TYPE_PCI_BRIDGE)
 			return 0;
 
@@ -339,6 +339,35 @@ found:
 }
 #endif
 
+#ifdef CONFIG_ACPI_NUMA
+static int __init
+dmar_parse_one_rhsa(struct acpi_dmar_header *header)
+{
+	struct acpi_dmar_rhsa *rhsa;
+	struct dmar_drhd_unit *drhd;
+
+	rhsa = (struct acpi_dmar_rhsa *)header;
+	for_each_drhd_unit(drhd) {
+		if (drhd->reg_base_addr == rhsa->base_address) {
+			int node = acpi_map_pxm_to_node(rhsa->proximity_domain);
+
+			if (!node_online(node))
+				node = -1;
+			drhd->iommu->node = node;
+			return 0;
+		}
+	}
+	WARN(1, "Your BIOS is broken; RHSA refers to non-existent DMAR unit at %llx\n"
+	     "BIOS vendor: %s; Ver: %s; Product Version: %s\n",
+	     drhd->reg_base_addr,
+	     dmi_get_system_info(DMI_BIOS_VENDOR),
+	     dmi_get_system_info(DMI_BIOS_VERSION),
+	     dmi_get_system_info(DMI_PRODUCT_VERSION));
+
+	return 0;
+}
+#endif
+
 static void __init
 dmar_table_print_dmar_entry(struct acpi_dmar_header *header)
 {
@@ -458,7 +487,9 @@ parse_dmar_table(void)
 #endif
 			break;
 		case ACPI_DMAR_HARDWARE_AFFINITY:
-			/* We don't do anything with RHSA (yet?) */
+#ifdef CONFIG_ACPI_NUMA
+			ret = dmar_parse_one_rhsa(entry_header);
+#endif
 			break;
 		default:
 			printk(KERN_WARNING PREFIX
@@ -582,6 +613,8 @@ int __init dmar_table_init(void)
 	return 0;
 }
 
+static int bios_warned;
+
 int __init check_zero_address(void)
 {
 	struct acpi_table_dmar *dmar;
@@ -601,6 +634,9 @@ int __init check_zero_address(void)
 		}
 
 		if (entry_header->type == ACPI_DMAR_TYPE_HARDWARE_UNIT) {
+			void __iomem *addr;
+			u64 cap, ecap;
+
 			drhd = (void *)entry_header;
 			if (!drhd->address) {
 				/* Promote an attitude of violence to a BIOS engineer today */
@@ -609,17 +645,40 @@ int __init check_zero_address(void)
 				     dmi_get_system_info(DMI_BIOS_VENDOR),
 				     dmi_get_system_info(DMI_BIOS_VERSION),
 				     dmi_get_system_info(DMI_PRODUCT_VERSION));
-#ifdef CONFIG_DMAR
-				dmar_disabled = 1;
-#endif
-				return 0;
+				bios_warned = 1;
+				goto failed;
+			}
+
+			addr = early_ioremap(drhd->address, VTD_PAGE_SIZE);
+			if (!addr ) {
+				printk("IOMMU: can't validate: %llx\n", drhd->address);
+				goto failed;
+			}
+			cap = dmar_readq(addr + DMAR_CAP_REG);
+			ecap = dmar_readq(addr + DMAR_ECAP_REG);
+			early_iounmap(addr, VTD_PAGE_SIZE);
+			if (cap == (uint64_t)-1 && ecap == (uint64_t)-1) {
+				/* Promote an attitude of violence to a BIOS engineer today */
+				WARN(1, "Your BIOS is broken; DMAR reported at address %llx returns all ones!\n"
+				     "BIOS vendor: %s; Ver: %s; Product Version: %s\n",
+				      drhd->address,
+				      dmi_get_system_info(DMI_BIOS_VENDOR),
+				      dmi_get_system_info(DMI_BIOS_VERSION),
+				      dmi_get_system_info(DMI_PRODUCT_VERSION));
+				bios_warned = 1;
+				goto failed;
 			}
-			break;
 		}
 
 		entry_header = ((void *)entry_header + entry_header->length);
 	}
 	return 1;
+
+failed:
+#ifdef CONFIG_DMAR
+	dmar_disabled = 1;
+#endif
+	return 0;
 }
 
 void __init detect_intel_iommu(void)
@@ -645,8 +704,11 @@ void __init detect_intel_iommu(void)
 			       "x2apic and Intr-remapping.\n");
 #endif
 #ifdef CONFIG_DMAR
-		if (ret && !no_iommu && !iommu_detected && !dmar_disabled)
+		if (ret && !no_iommu && !iommu_detected && !dmar_disabled) {
 			iommu_detected = 1;
+			/* Make sure ACS will be enabled */
+			pci_request_acs();
+		}
 #endif
 #ifdef CONFIG_X86
 		if (ret)
@@ -667,6 +729,18 @@ int alloc_iommu(struct dmar_drhd_unit *drhd)
 	int agaw = 0;
 	int msagaw = 0;
 
+	if (!drhd->reg_base_addr) {
+		if (!bios_warned) {
+			WARN(1, "Your BIOS is broken; DMAR reported at address zero!\n"
+			     "BIOS vendor: %s; Ver: %s; Product Version: %s\n",
+			     dmi_get_system_info(DMI_BIOS_VENDOR),
+			     dmi_get_system_info(DMI_BIOS_VERSION),
+			     dmi_get_system_info(DMI_PRODUCT_VERSION));
+			bios_warned = 1;
+		}
+		return -EINVAL;
+	}
+
 	iommu = kzalloc(sizeof(*iommu), GFP_KERNEL);
 	if (!iommu)
 		return -ENOMEM;
@@ -683,13 +757,16 @@ int alloc_iommu(struct dmar_drhd_unit *drhd)
 	iommu->ecap = dmar_readq(iommu->reg + DMAR_ECAP_REG);
 
 	if (iommu->cap == (uint64_t)-1 && iommu->ecap == (uint64_t)-1) {
-		/* Promote an attitude of violence to a BIOS engineer today */
-		WARN(1, "Your BIOS is broken; DMAR reported at address %llx returns all ones!\n"
-		     "BIOS vendor: %s; Ver: %s; Product Version: %s\n",
-		     drhd->reg_base_addr,
-		     dmi_get_system_info(DMI_BIOS_VENDOR),
-		     dmi_get_system_info(DMI_BIOS_VERSION),
-		     dmi_get_system_info(DMI_PRODUCT_VERSION));
+		if (!bios_warned) {
+			/* Promote an attitude of violence to a BIOS engineer today */
+			WARN(1, "Your BIOS is broken; DMAR reported at address %llx returns all ones!\n"
+			     "BIOS vendor: %s; Ver: %s; Product Version: %s\n",
+			     drhd->reg_base_addr,
+			     dmi_get_system_info(DMI_BIOS_VENDOR),
+			     dmi_get_system_info(DMI_BIOS_VERSION),
+			     dmi_get_system_info(DMI_PRODUCT_VERSION));
+			bios_warned = 1;
+		}
 		goto err_unmap;
 	}
 
@@ -712,6 +789,8 @@ int alloc_iommu(struct dmar_drhd_unit *drhd)
 	iommu->agaw = agaw;
 	iommu->msagaw = msagaw;
 
+	iommu->node = -1;
+
 	/* the registers might be more than one page */
 	map_size = max_t(int, ecap_max_iotlb_offset(iommu->ecap),
 		cap_max_fault_reg_offset(iommu->cap));
@@ -1053,6 +1132,7 @@ static void __dmar_enable_qi(struct intel_iommu *iommu)
 int dmar_enable_qi(struct intel_iommu *iommu)
 {
 	struct q_inval *qi;
+	struct page *desc_page;
 
 	if (!ecap_qis(iommu->ecap))
 		return -ENOENT;
@@ -1069,13 +1149,16 @@ int dmar_enable_qi(struct intel_iommu *iommu)
 
 	qi = iommu->qi;
 
-	qi->desc = (void *)(get_zeroed_page(GFP_ATOMIC));
-	if (!qi->desc) {
+
+	desc_page = alloc_pages_node(iommu->node, GFP_ATOMIC | __GFP_ZERO, 0);
+	if (!desc_page) {
 		kfree(qi);
 		iommu->qi = 0;
 		return -ENOMEM;
 	}
 
+	qi->desc = page_address(desc_page);
+
 	qi->desc_status = kmalloc(QI_LENGTH * sizeof(int), GFP_ATOMIC);
 	if (!qi->desc_status) {
 		free_page((unsigned long) qi->desc);
diff --git a/drivers/pci/hotplug/Makefile b/drivers/pci/hotplug/Makefile
index 3625b094bf7e..6cd9f3c9887d 100644
--- a/drivers/pci/hotplug/Makefile
+++ b/drivers/pci/hotplug/Makefile
@@ -6,18 +6,22 @@ obj-$(CONFIG_HOTPLUG_PCI)		+= pci_hotplug.o
 obj-$(CONFIG_HOTPLUG_PCI_COMPAQ)	+= cpqphp.o
 obj-$(CONFIG_HOTPLUG_PCI_IBM)		+= ibmphp.o
 
-# pciehp should be linked before acpiphp in order to allow the native driver
-# to attempt to bind first. We can then fall back to generic support.
+# native drivers should be linked before acpiphp in order to allow the
+# native driver to attempt to bind first. We can then fall back to
+# generic support.
 
 obj-$(CONFIG_HOTPLUG_PCI_PCIE)		+= pciehp.o
-obj-$(CONFIG_HOTPLUG_PCI_ACPI)		+= acpiphp.o
-obj-$(CONFIG_HOTPLUG_PCI_ACPI_IBM)	+= acpiphp_ibm.o
 obj-$(CONFIG_HOTPLUG_PCI_CPCI_ZT5550)	+= cpcihp_zt5550.o
 obj-$(CONFIG_HOTPLUG_PCI_CPCI_GENERIC)	+= cpcihp_generic.o
 obj-$(CONFIG_HOTPLUG_PCI_SHPC)		+= shpchp.o
 obj-$(CONFIG_HOTPLUG_PCI_RPA)		+= rpaphp.o
 obj-$(CONFIG_HOTPLUG_PCI_RPA_DLPAR)	+= rpadlpar_io.o
 obj-$(CONFIG_HOTPLUG_PCI_SGI)		+= sgi_hotplug.o
+obj-$(CONFIG_HOTPLUG_PCI_ACPI)		+= acpiphp.o
+
+# acpiphp_ibm extends acpiphp, so should be linked afterwards.
+
+obj-$(CONFIG_HOTPLUG_PCI_ACPI_IBM)	+= acpiphp_ibm.o
 
 # Link this last so it doesn't claim devices that have a real hotplug driver
 obj-$(CONFIG_HOTPLUG_PCI_FAKE)		+= fakephp.o
diff --git a/drivers/pci/hotplug/acpi_pcihp.c b/drivers/pci/hotplug/acpi_pcihp.c
index a73028ec52e5..3c76fc67cf0e 100644
--- a/drivers/pci/hotplug/acpi_pcihp.c
+++ b/drivers/pci/hotplug/acpi_pcihp.c
@@ -362,6 +362,8 @@ int acpi_get_hp_hw_control_from_firmware(struct pci_dev *pdev, u32 flags)
 		status = acpi_pci_osc_control_set(handle, flags);
 		if (ACPI_SUCCESS(status))
 			goto got_one;
+		if (status == AE_SUPPORT)
+			goto no_control;
 		kfree(string.pointer);
 		string = (struct acpi_buffer){ ACPI_ALLOCATE_BUFFER, NULL };
 	}
@@ -394,10 +396,9 @@ int acpi_get_hp_hw_control_from_firmware(struct pci_dev *pdev, u32 flags)
 		if (ACPI_FAILURE(status))
 			break;
 	}
-
+no_control:
 	dbg("Cannot get control of hotplug hardware for pci %s\n",
 	    pci_name(pdev));
-
 	kfree(string.pointer);
 	return -ENODEV;
 got_one:
@@ -471,7 +472,7 @@ int acpi_pci_detect_ejectable(acpi_handle handle)
 		return found;
 
 	acpi_walk_namespace(ACPI_TYPE_DEVICE, handle, 1,
-			    check_hotplug, (void *)&found, NULL);
+			    check_hotplug, NULL, (void *)&found, NULL);
 	return found;
 }
 EXPORT_SYMBOL_GPL(acpi_pci_detect_ejectable);
diff --git a/drivers/pci/hotplug/acpiphp.h b/drivers/pci/hotplug/acpiphp.h
index 7d938df79206..bab52047baa8 100644
--- a/drivers/pci/hotplug/acpiphp.h
+++ b/drivers/pci/hotplug/acpiphp.h
@@ -146,12 +146,6 @@ struct acpiphp_attention_info
 	struct module *owner;
 };
 
-struct acpiphp_ioapic {
-	struct pci_dev *dev;
-	u32 gsi_base;
-	struct list_head list;
-};
-
 /* PCI bus bridge HID */
 #define ACPI_PCI_HOST_HID		"PNP0A03"
 
diff --git a/drivers/pci/hotplug/acpiphp_glue.c b/drivers/pci/hotplug/acpiphp_glue.c
index 58d25a163a8b..8e952fdab764 100644
--- a/drivers/pci/hotplug/acpiphp_glue.c
+++ b/drivers/pci/hotplug/acpiphp_glue.c
@@ -52,8 +52,6 @@
 #include "acpiphp.h"
 
 static LIST_HEAD(bridge_list);
-static LIST_HEAD(ioapic_list);
-static DEFINE_SPINLOCK(ioapic_list_lock);
 
 #define MY_NAME "acpiphp_glue"
 
@@ -266,7 +264,7 @@ static int detect_ejectable_slots(acpi_handle handle)
 	int found = acpi_pci_detect_ejectable(handle);
 	if (!found) {
 		acpi_walk_namespace(ACPI_TYPE_DEVICE, handle, (u32)1,
-				    is_pci_dock_device, (void *)&found, NULL);
+				    is_pci_dock_device, NULL, (void *)&found, NULL);
 	}
 	return found;
 }
@@ -281,7 +279,7 @@ static void init_bridge_misc(struct acpiphp_bridge *bridge)
 
 	/* register all slot objects under this bridge */
 	status = acpi_walk_namespace(ACPI_TYPE_DEVICE, bridge->handle, (u32)1,
-				     register_slot, bridge, NULL);
+				     register_slot, NULL, bridge, NULL);
 	if (ACPI_FAILURE(status)) {
 		list_del(&bridge->list);
 		return;
@@ -311,17 +309,13 @@ static void init_bridge_misc(struct acpiphp_bridge *bridge)
 /* find acpiphp_func from acpiphp_bridge */
 static struct acpiphp_func *acpiphp_bridge_handle_to_function(acpi_handle handle)
 {
-	struct list_head *node, *l;
 	struct acpiphp_bridge *bridge;
 	struct acpiphp_slot *slot;
 	struct acpiphp_func *func;
 
-	list_for_each(node, &bridge_list) {
-		bridge = list_entry(node, struct acpiphp_bridge, list);
+	list_for_each_entry(bridge, &bridge_list, list) {
 		for (slot = bridge->slots; slot; slot = slot->next) {
-			list_for_each(l, &slot->funcs) {
-				func = list_entry(l, struct acpiphp_func,
-							sibling);
+			list_for_each_entry(func, &slot->funcs, sibling) {
 				if (func->handle == handle)
 					return func;
 			}
@@ -447,7 +441,7 @@ find_p2p_bridge(acpi_handle handle, u32 lvl, void *context, void **rv)
 
 	/* search P2P bridges under this p2p bridge */
 	status = acpi_walk_namespace(ACPI_TYPE_DEVICE, handle, (u32)1,
-				     find_p2p_bridge, NULL, NULL);
+				     find_p2p_bridge, NULL, NULL, NULL);
 	if (ACPI_FAILURE(status))
 		warn("find_p2p_bridge failed (error code = 0x%x)\n", status);
 
@@ -485,7 +479,7 @@ static int add_bridge(acpi_handle handle)
 
 	/* search P2P bridges under this host bridge */
 	status = acpi_walk_namespace(ACPI_TYPE_DEVICE, handle, (u32)1,
-				     find_p2p_bridge, NULL, NULL);
+				     find_p2p_bridge, NULL, NULL, NULL);
 
 	if (ACPI_FAILURE(status))
 		warn("find_p2p_bridge failed (error code = 0x%x)\n", status);
@@ -495,21 +489,19 @@ static int add_bridge(acpi_handle handle)
 
 static struct acpiphp_bridge *acpiphp_handle_to_bridge(acpi_handle handle)
 {
-	struct list_head *head;
-	list_for_each(head, &bridge_list) {
-		struct acpiphp_bridge *bridge = list_entry(head,
-						struct acpiphp_bridge, list);
+	struct acpiphp_bridge *bridge;
+
+	list_for_each_entry(bridge, &bridge_list, list)
 		if (bridge->handle == handle)
 			return bridge;
-	}
 
 	return NULL;
 }
 
 static void cleanup_bridge(struct acpiphp_bridge *bridge)
 {
-	struct list_head *list, *tmp;
-	struct acpiphp_slot *slot;
+	struct acpiphp_slot *slot, *next;
+	struct acpiphp_func *func, *tmp;
 	acpi_status status;
 	acpi_handle handle = bridge->handle;
 
@@ -530,10 +522,8 @@ static void cleanup_bridge(struct acpiphp_bridge *bridge)
 
 	slot = bridge->slots;
 	while (slot) {
-		struct acpiphp_slot *next = slot->next;
-		list_for_each_safe (list, tmp, &slot->funcs) {
-			struct acpiphp_func *func;
-			func = list_entry(list, struct acpiphp_func, sibling);
+		next = slot->next;
+		list_for_each_entry_safe(func, tmp, &slot->funcs, sibling) {
 			if (is_dock_device(func->handle)) {
 				unregister_hotplug_dock_device(func->handle);
 				unregister_dock_notifier(&func->nb);
@@ -545,7 +535,7 @@ static void cleanup_bridge(struct acpiphp_bridge *bridge)
 				if (ACPI_FAILURE(status))
 					err("failed to remove notify handler\n");
 			}
-			list_del(list);
+			list_del(&func->sibling);
 			kfree(func);
 		}
 		acpiphp_unregister_hotplug_slot(slot);
@@ -573,7 +563,7 @@ cleanup_p2p_bridge(acpi_handle handle, u32 lvl, void *context, void **rv)
 	/* cleanup p2p bridges under this P2P bridge
 	   in a depth-first manner */
 	acpi_walk_namespace(ACPI_TYPE_DEVICE, handle, (u32)1,
-				cleanup_p2p_bridge, NULL, NULL);
+				cleanup_p2p_bridge, NULL, NULL, NULL);
 
 	bridge = acpiphp_handle_to_bridge(handle);
 	if (bridge)
@@ -589,7 +579,7 @@ static void remove_bridge(acpi_handle handle)
 	/* cleanup p2p bridges under this host bridge
 	   in a depth-first manner */
 	acpi_walk_namespace(ACPI_TYPE_DEVICE, handle,
-				(u32)1, cleanup_p2p_bridge, NULL, NULL);
+				(u32)1, cleanup_p2p_bridge, NULL, NULL, NULL);
 
 	/*
 	 * On root bridges with hotplug slots directly underneath (ie,
@@ -606,204 +596,17 @@ static void remove_bridge(acpi_handle handle)
 					   handle_hotplug_event_bridge);
 }
 
-static struct pci_dev * get_apic_pci_info(acpi_handle handle)
-{
-	struct pci_dev *dev;
-
-	dev = acpi_get_pci_dev(handle);
-	if (!dev)
-		return NULL;
-
-	if ((dev->class != PCI_CLASS_SYSTEM_PIC_IOAPIC) &&
-	    (dev->class != PCI_CLASS_SYSTEM_PIC_IOXAPIC))
-	{
-		pci_dev_put(dev);
-		return NULL;
-	}
-
-	return dev;
-}
-
-static int get_gsi_base(acpi_handle handle, u32 *gsi_base)
-{
-	acpi_status status;
-	int result = -1;
-	unsigned long long gsb;
-	struct acpi_buffer buffer = {ACPI_ALLOCATE_BUFFER, NULL};
-	union acpi_object *obj;
-	void *table;
-
-	status = acpi_evaluate_integer(handle, "_GSB", NULL, &gsb);
-	if (ACPI_SUCCESS(status)) {
-		*gsi_base = (u32)gsb;
-		return 0;
-	}
-
-	status = acpi_evaluate_object(handle, "_MAT", NULL, &buffer);
-	if (ACPI_FAILURE(status) || !buffer.length || !buffer.pointer)
-		return -1;
-
-	obj = buffer.pointer;
-	if (obj->type != ACPI_TYPE_BUFFER)
-		goto out;
-
-	table = obj->buffer.pointer;
-	switch (((struct acpi_subtable_header *)table)->type) {
-	case ACPI_MADT_TYPE_IO_SAPIC:
-		*gsi_base = ((struct acpi_madt_io_sapic *)table)->global_irq_base;
-		result = 0;
-		break;
-	case ACPI_MADT_TYPE_IO_APIC:
-		*gsi_base = ((struct acpi_madt_io_apic *)table)->global_irq_base;
-		result = 0;
-		break;
-	default:
-		break;
-	}
- out:
-	kfree(buffer.pointer);
-	return result;
-}
-
-static acpi_status
-ioapic_add(acpi_handle handle, u32 lvl, void *context, void **rv)
-{
-	acpi_status status;
-	unsigned long long sta;
-	acpi_handle tmp;
-	struct pci_dev *pdev;
-	u32 gsi_base;
-	u64 phys_addr;
-	struct acpiphp_ioapic *ioapic;
-
-	/* Evaluate _STA if present */
-	status = acpi_evaluate_integer(handle, "_STA", NULL, &sta);
-	if (ACPI_SUCCESS(status) && sta != ACPI_STA_ALL)
-		return AE_CTRL_DEPTH;
-
-	/* Scan only PCI bus scope */
-	status = acpi_get_handle(handle, "_HID", &tmp);
-	if (ACPI_SUCCESS(status))
-		return AE_CTRL_DEPTH;
-
-	if (get_gsi_base(handle, &gsi_base))
-		return AE_OK;
-
-	ioapic = kmalloc(sizeof(*ioapic), GFP_KERNEL);
-	if (!ioapic)
-		return AE_NO_MEMORY;
-
-	pdev = get_apic_pci_info(handle);
-	if (!pdev)
-		goto exit_kfree;
-
-	if (pci_enable_device(pdev))
-		goto exit_pci_dev_put;
-
-	pci_set_master(pdev);
-
-	if (pci_request_region(pdev, 0, "I/O APIC(acpiphp)"))
-		goto exit_pci_disable_device;
-
-	phys_addr = pci_resource_start(pdev, 0);
-	if (acpi_register_ioapic(handle, phys_addr, gsi_base))
-		goto exit_pci_release_region;
-
-	ioapic->gsi_base = gsi_base;
-	ioapic->dev = pdev;
-	spin_lock(&ioapic_list_lock);
-	list_add_tail(&ioapic->list, &ioapic_list);
-	spin_unlock(&ioapic_list_lock);
-
-	return AE_OK;
-
- exit_pci_release_region:
-	pci_release_region(pdev, 0);
- exit_pci_disable_device:
-	pci_disable_device(pdev);
- exit_pci_dev_put:
-	pci_dev_put(pdev);
- exit_kfree:
-	kfree(ioapic);
-
-	return AE_OK;
-}
-
-static acpi_status
-ioapic_remove(acpi_handle handle, u32 lvl, void *context, void **rv)
-{
-	acpi_status status;
-	unsigned long long sta;
-	acpi_handle tmp;
-	u32 gsi_base;
-	struct acpiphp_ioapic *pos, *n, *ioapic = NULL;
-
-	/* Evaluate _STA if present */
-	status = acpi_evaluate_integer(handle, "_STA", NULL, &sta);
-	if (ACPI_SUCCESS(status) && sta != ACPI_STA_ALL)
-		return AE_CTRL_DEPTH;
-
-	/* Scan only PCI bus scope */
-	status = acpi_get_handle(handle, "_HID", &tmp);
-	if (ACPI_SUCCESS(status))
-		return AE_CTRL_DEPTH;
-
-	if (get_gsi_base(handle, &gsi_base))
-		return AE_OK;
-
-	acpi_unregister_ioapic(handle, gsi_base);
-
-	spin_lock(&ioapic_list_lock);
-	list_for_each_entry_safe(pos, n, &ioapic_list, list) {
-		if (pos->gsi_base != gsi_base)
-			continue;
-		ioapic = pos;
-		list_del(&ioapic->list);
-		break;
-	}
-	spin_unlock(&ioapic_list_lock);
-
-	if (!ioapic)
-		return AE_OK;
-
-	pci_release_region(ioapic->dev, 0);
-	pci_disable_device(ioapic->dev);
-	pci_dev_put(ioapic->dev);
-	kfree(ioapic);
-
-	return AE_OK;
-}
-
-static int acpiphp_configure_ioapics(acpi_handle handle)
-{
-	ioapic_add(handle, 0, NULL, NULL);
-	acpi_walk_namespace(ACPI_TYPE_DEVICE, handle,
-			    ACPI_UINT32_MAX, ioapic_add, NULL, NULL);
-	return 0;
-}
-
-static int acpiphp_unconfigure_ioapics(acpi_handle handle)
-{
-	ioapic_remove(handle, 0, NULL, NULL);
-	acpi_walk_namespace(ACPI_TYPE_DEVICE, handle,
-			    ACPI_UINT32_MAX, ioapic_remove, NULL, NULL);
-	return 0;
-}
-
 static int power_on_slot(struct acpiphp_slot *slot)
 {
 	acpi_status status;
 	struct acpiphp_func *func;
-	struct list_head *l;
 	int retval = 0;
 
 	/* if already enabled, just skip */
 	if (slot->flags & SLOT_POWEREDON)
 		goto err_exit;
 
-	list_for_each (l, &slot->funcs) {
-		func = list_entry(l, struct acpiphp_func, sibling);
-
+	list_for_each_entry(func, &slot->funcs, sibling) {
 		if (func->flags & FUNC_HAS_PS0) {
 			dbg("%s: executing _PS0\n", __func__);
 			status = acpi_evaluate_object(func->handle, "_PS0", NULL, NULL);
@@ -829,7 +632,6 @@ static int power_off_slot(struct acpiphp_slot *slot)
 {
 	acpi_status status;
 	struct acpiphp_func *func;
-	struct list_head *l;
 
 	int retval = 0;
 
@@ -837,9 +639,7 @@ static int power_off_slot(struct acpiphp_slot *slot)
 	if ((slot->flags & SLOT_POWEREDON) == 0)
 		goto err_exit;
 
-	list_for_each (l, &slot->funcs) {
-		func = list_entry(l, struct acpiphp_func, sibling);
-
+	list_for_each_entry(func, &slot->funcs, sibling) {
 		if (func->flags & FUNC_HAS_PS3) {
 			status = acpi_evaluate_object(func->handle, "_PS3", NULL, NULL);
 			if (ACPI_FAILURE(status)) {
@@ -966,7 +766,6 @@ static int __ref enable_device(struct acpiphp_slot *slot)
 {
 	struct pci_dev *dev;
 	struct pci_bus *bus = slot->bridge->pci_bus;
-	struct list_head *l;
 	struct acpiphp_func *func;
 	int retval = 0;
 	int num, max, pass;
@@ -1006,21 +805,16 @@ static int __ref enable_device(struct acpiphp_slot *slot)
 		}
 	}
 
-	list_for_each (l, &slot->funcs) {
-		func = list_entry(l, struct acpiphp_func, sibling);
+	list_for_each_entry(func, &slot->funcs, sibling)
 		acpiphp_bus_add(func);
-	}
 
 	pci_bus_assign_resources(bus);
 	acpiphp_sanitize_bus(bus);
 	acpiphp_set_hpp_values(bus);
-	list_for_each_entry(func, &slot->funcs, sibling)
-		acpiphp_configure_ioapics(func->handle);
 	pci_enable_bridges(bus);
 	pci_bus_add_devices(bus);
 
-	list_for_each (l, &slot->funcs) {
-		func = list_entry(l, struct acpiphp_func, sibling);
+	list_for_each_entry(func, &slot->funcs, sibling) {
 		dev = pci_get_slot(bus, PCI_DEVFN(slot->device,
 						  func->function));
 		if (!dev)
@@ -1091,7 +885,6 @@ static int disable_device(struct acpiphp_slot *slot)
 	}
 
 	list_for_each_entry(func, &slot->funcs, sibling) {
-		acpiphp_unconfigure_ioapics(func->handle);
 		acpiphp_bus_trim(func->handle);
 	}
 
@@ -1119,12 +912,9 @@ static unsigned int get_slot_status(struct acpiphp_slot *slot)
 	acpi_status status;
 	unsigned long long sta = 0;
 	u32 dvid;
-	struct list_head *l;
 	struct acpiphp_func *func;
 
-	list_for_each (l, &slot->funcs) {
-		func = list_entry(l, struct acpiphp_func, sibling);
-
+	list_for_each_entry(func, &slot->funcs, sibling) {
 		if (func->flags & FUNC_HAS_STA) {
 			status = acpi_evaluate_integer(func->handle, "_STA", NULL, &sta);
 			if (ACPI_SUCCESS(status) && sta)
@@ -1152,13 +942,10 @@ int acpiphp_eject_slot(struct acpiphp_slot *slot)
 {
 	acpi_status status;
 	struct acpiphp_func *func;
-	struct list_head *l;
 	struct acpi_object_list arg_list;
 	union acpi_object arg;
 
-	list_for_each (l, &slot->funcs) {
-		func = list_entry(l, struct acpiphp_func, sibling);
-
+	list_for_each_entry(func, &slot->funcs, sibling) {
 		/* We don't want to call _EJ0 on non-existing functions. */
 		if ((func->flags & FUNC_HAS_EJ0)) {
 			/* _EJ0 method take one argument */
@@ -1275,7 +1062,6 @@ static int acpiphp_configure_bridge (acpi_handle handle)
 	acpiphp_sanitize_bus(bus);
 	acpiphp_set_hpp_values(bus);
 	pci_enable_bridges(bus);
-	acpiphp_configure_ioapics(handle);
 	return 0;
 }
 
@@ -1367,7 +1153,7 @@ static void handle_hotplug_event_bridge(acpi_handle handle, u32 type, void *cont
 	bridge = acpiphp_handle_to_bridge(handle);
 	if (type == ACPI_NOTIFY_BUS_CHECK) {
 		acpi_walk_namespace(ACPI_TYPE_DEVICE, handle, ACPI_UINT32_MAX,
-			count_sub_bridges, &num_sub_bridges, NULL);
+			count_sub_bridges, NULL, &num_sub_bridges, NULL);
 	}
 
 	if (!bridge && !num_sub_bridges) {
@@ -1388,7 +1174,7 @@ static void handle_hotplug_event_bridge(acpi_handle handle, u32 type, void *cont
 		}
 		if (num_sub_bridges)
 			acpi_walk_namespace(ACPI_TYPE_DEVICE, handle,
-				ACPI_UINT32_MAX, check_sub_bridges, NULL, NULL);
+				ACPI_UINT32_MAX, check_sub_bridges, NULL, NULL, NULL);
 		break;
 
 	case ACPI_NOTIFY_DEVICE_CHECK:
@@ -1512,7 +1298,7 @@ int __init acpiphp_glue_init(void)
 	int num = 0;
 
 	acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT,
-			ACPI_UINT32_MAX, find_root_bridges, &num, NULL);
+			ACPI_UINT32_MAX, find_root_bridges, NULL, &num, NULL);
 
 	if (num <= 0)
 		return -1;
@@ -1542,7 +1328,7 @@ int __init acpiphp_get_num_slots(void)
 	struct acpiphp_bridge *bridge;
 	int num_slots = 0;
 
-	list_for_each_entry (bridge, &bridge_list, list) {
+	list_for_each_entry(bridge, &bridge_list, list) {
 		dbg("Bus %04x:%02x has %d slot%s\n",
 				pci_domain_nr(bridge->pci_bus),
 				bridge->pci_bus->number, bridge->nr_slots,
diff --git a/drivers/pci/hotplug/acpiphp_ibm.c b/drivers/pci/hotplug/acpiphp_ibm.c
index e7be66dbac21..aa5df485f8cf 100644
--- a/drivers/pci/hotplug/acpiphp_ibm.c
+++ b/drivers/pci/hotplug/acpiphp_ibm.c
@@ -434,7 +434,7 @@ static int __init ibm_acpiphp_init(void)
 	dbg("%s\n", __func__);
 
 	if (acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT,
-			ACPI_UINT32_MAX, ibm_find_acpi_device,
+			ACPI_UINT32_MAX, ibm_find_acpi_device, NULL,
 			&ibm_acpi_handle, NULL) != FOUND_APCI) {
 		err("%s: acpi_walk_namespace failed\n", __func__);
 		retval = -ENODEV;
diff --git a/drivers/pci/hotplug/ibmphp_hpc.c b/drivers/pci/hotplug/ibmphp_hpc.c
index 83f337c891a9..c7084f0eca5a 100644
--- a/drivers/pci/hotplug/ibmphp_hpc.c
+++ b/drivers/pci/hotplug/ibmphp_hpc.c
@@ -890,7 +890,7 @@ static int poll_hpc(void *data)
 			msleep(POLL_INTERVAL_SEC * 1000);
 
 			if (kthread_should_stop())
-				break;
+				goto out_sleep;
 			
 			down (&semOperations);
 			
@@ -904,6 +904,7 @@ static int poll_hpc(void *data)
 		/* give up the hardware semaphore */
 		up (&semOperations);
 		/* sleep for a short time just for good measure */
+out_sleep:
 		msleep(100);
 	}
 	up (&sem_exit);
diff --git a/drivers/pci/hotplug/pci_hotplug_core.c b/drivers/pci/hotplug/pci_hotplug_core.c
index 0325d989bb46..38183a534b65 100644
--- a/drivers/pci/hotplug/pci_hotplug_core.c
+++ b/drivers/pci/hotplug/pci_hotplug_core.c
@@ -68,26 +68,26 @@ static DEFINE_MUTEX(pci_hp_mutex);
 static char *pci_bus_speed_strings[] = {
 	"33 MHz PCI",		/* 0x00 */
 	"66 MHz PCI",		/* 0x01 */
-	"66 MHz PCIX", 		/* 0x02 */
-	"100 MHz PCIX",		/* 0x03 */
-	"133 MHz PCIX",		/* 0x04 */
+	"66 MHz PCI-X",		/* 0x02 */
+	"100 MHz PCI-X",	/* 0x03 */
+	"133 MHz PCI-X",	/* 0x04 */
 	NULL,			/* 0x05 */
 	NULL,			/* 0x06 */
 	NULL,			/* 0x07 */
 	NULL,			/* 0x08 */
-	"66 MHz PCIX 266",	/* 0x09 */
-	"100 MHz PCIX 266",	/* 0x0a */
-	"133 MHz PCIX 266",	/* 0x0b */
+	"66 MHz PCI-X 266",	/* 0x09 */
+	"100 MHz PCI-X 266",	/* 0x0a */
+	"133 MHz PCI-X 266",	/* 0x0b */
 	NULL,			/* 0x0c */
 	NULL,			/* 0x0d */
 	NULL,			/* 0x0e */
 	NULL,			/* 0x0f */
 	NULL,			/* 0x10 */
-	"66 MHz PCIX 533",	/* 0x11 */
-	"100 MHz PCIX 533",	/* 0x12 */
-	"133 MHz PCIX 533",	/* 0x13 */
-	"2.5 GT/s PCI-E",	/* 0x14 */
-	"5.0 GT/s PCI-E",	/* 0x15 */
+	"66 MHz PCI-X 533",	/* 0x11 */
+	"100 MHz PCI-X 533",	/* 0x12 */
+	"133 MHz PCI-X 533",	/* 0x13 */
+	"2.5 GT/s PCIe",	/* 0x14 */
+	"5.0 GT/s PCIe",	/* 0x15 */
 };
 
 #ifdef CONFIG_HOTPLUG_PCI_CPCI
diff --git a/drivers/pci/hotplug/pciehp.h b/drivers/pci/hotplug/pciehp.h
index 3070f77eb56a..4ed76b47b6dc 100644
--- a/drivers/pci/hotplug/pciehp.h
+++ b/drivers/pci/hotplug/pciehp.h
@@ -91,7 +91,6 @@ struct controller {
 	struct slot *slot;
 	wait_queue_head_t queue;	/* sleep & wake process */
 	u32 slot_cap;
-	u8 cap_base;
 	struct timer_list poll_timer;
 	unsigned int cmd_busy:1;
 	unsigned int no_cmd_complete:1;
diff --git a/drivers/pci/hotplug/pciehp_acpi.c b/drivers/pci/hotplug/pciehp_acpi.c
index 37c8d3d0323e..b09b083011d6 100644
--- a/drivers/pci/hotplug/pciehp_acpi.c
+++ b/drivers/pci/hotplug/pciehp_acpi.c
@@ -87,7 +87,8 @@ static int __init dummy_probe(struct pcie_device *dev)
 	/* Note: pciehp_detect_mode != PCIEHP_DETECT_ACPI here */
 	if (pciehp_get_hp_hw_control_from_firmware(pdev))
 		return -ENODEV;
-	if (!(pos = pci_find_capability(pdev, PCI_CAP_ID_EXP)))
+	pos = pci_pcie_cap(pdev);
+	if (!pos)
 		return -ENODEV;
 	pci_read_config_dword(pdev, pos + PCI_EXP_SLTCAP, &slot_cap);
 	slot = kzalloc(sizeof(*slot), GFP_KERNEL);
diff --git a/drivers/pci/hotplug/pciehp_core.c b/drivers/pci/hotplug/pciehp_core.c
index bc234719b1df..5674b2075bdc 100644
--- a/drivers/pci/hotplug/pciehp_core.c
+++ b/drivers/pci/hotplug/pciehp_core.c
@@ -72,18 +72,6 @@ static int get_adapter_status	(struct hotplug_slot *slot, u8 *value);
 static int get_max_bus_speed	(struct hotplug_slot *slot, enum pci_bus_speed *value);
 static int get_cur_bus_speed	(struct hotplug_slot *slot, enum pci_bus_speed *value);
 
-static struct hotplug_slot_ops pciehp_hotplug_slot_ops = {
-	.set_attention_status =	set_attention_status,
-	.enable_slot =		enable_slot,
-	.disable_slot =		disable_slot,
-	.get_power_status =	get_power_status,
-	.get_attention_status =	get_attention_status,
-	.get_latch_status =	get_latch_status,
-	.get_adapter_status =	get_adapter_status,
-  	.get_max_bus_speed =	get_max_bus_speed,
-  	.get_cur_bus_speed =	get_cur_bus_speed,
-};
-
 /**
  * release_slot - free up the memory used by a slot
  * @hotplug_slot: slot to free
@@ -95,6 +83,7 @@ static void release_slot(struct hotplug_slot *hotplug_slot)
 	ctrl_dbg(slot->ctrl, "%s: physical_slot = %s\n",
 		 __func__, hotplug_slot_name(hotplug_slot));
 
+	kfree(hotplug_slot->ops);
 	kfree(hotplug_slot->info);
 	kfree(hotplug_slot);
 }
@@ -104,6 +93,7 @@ static int init_slot(struct controller *ctrl)
 	struct slot *slot = ctrl->slot;
 	struct hotplug_slot *hotplug = NULL;
 	struct hotplug_slot_info *info = NULL;
+	struct hotplug_slot_ops *ops = NULL;
 	char name[SLOT_NAME_SIZE];
 	int retval = -ENOMEM;
 
@@ -115,11 +105,28 @@ static int init_slot(struct controller *ctrl)
 	if (!info)
 		goto out;
 
+	/* Setup hotplug slot ops */
+	ops = kzalloc(sizeof(*ops), GFP_KERNEL);
+	if (!ops)
+		goto out;
+	ops->enable_slot = enable_slot;
+	ops->disable_slot = disable_slot;
+	ops->get_power_status = get_power_status;
+	ops->get_adapter_status = get_adapter_status;
+	ops->get_max_bus_speed = get_max_bus_speed;
+	ops->get_cur_bus_speed = get_cur_bus_speed;
+	if (MRL_SENS(ctrl))
+		ops->get_latch_status = get_latch_status;
+	if (ATTN_LED(ctrl)) {
+		ops->get_attention_status = get_attention_status;
+		ops->set_attention_status = set_attention_status;
+	}
+
 	/* register this slot with the hotplug pci core */
 	hotplug->info = info;
 	hotplug->private = slot;
 	hotplug->release = &release_slot;
-	hotplug->ops = &pciehp_hotplug_slot_ops;
+	hotplug->ops = ops;
 	slot->hotplug_slot = hotplug;
 	snprintf(name, SLOT_NAME_SIZE, "%u", PSN(ctrl));
 
@@ -128,17 +135,12 @@ static int init_slot(struct controller *ctrl)
 		 ctrl->pcie->port->subordinate->number, PSN(ctrl));
 	retval = pci_hp_register(hotplug,
 				 ctrl->pcie->port->subordinate, 0, name);
-	if (retval) {
+	if (retval)
 		ctrl_err(ctrl,
 			 "pci_hp_register failed with error %d\n", retval);
-		goto out;
-	}
-	get_power_status(hotplug, &info->power_status);
-	get_attention_status(hotplug, &info->attention_status);
-	get_latch_status(hotplug, &info->latch_status);
-	get_adapter_status(hotplug, &info->adapter_status);
 out:
 	if (retval) {
+		kfree(ops);
 		kfree(info);
 		kfree(hotplug);
 	}
@@ -160,12 +162,7 @@ static int set_attention_status(struct hotplug_slot *hotplug_slot, u8 status)
 	ctrl_dbg(slot->ctrl, "%s: physical_slot = %s\n",
 		  __func__, slot_name(slot));
 
-	hotplug_slot->info->attention_status = status;
-
-	if (ATTN_LED(slot->ctrl))
-		pciehp_set_attention_status(slot, status);
-
-	return 0;
+	return pciehp_set_attention_status(slot, status);
 }
 
 
@@ -193,92 +190,62 @@ static int disable_slot(struct hotplug_slot *hotplug_slot)
 static int get_power_status(struct hotplug_slot *hotplug_slot, u8 *value)
 {
 	struct slot *slot = hotplug_slot->private;
-	int retval;
 
 	ctrl_dbg(slot->ctrl, "%s: physical_slot = %s\n",
 		  __func__, slot_name(slot));
 
-	retval = pciehp_get_power_status(slot, value);
-	if (retval < 0)
-		*value = hotplug_slot->info->power_status;
-
-	return 0;
+	return pciehp_get_power_status(slot, value);
 }
 
 static int get_attention_status(struct hotplug_slot *hotplug_slot, u8 *value)
 {
 	struct slot *slot = hotplug_slot->private;
-	int retval;
 
 	ctrl_dbg(slot->ctrl, "%s: physical_slot = %s\n",
 		  __func__, slot_name(slot));
 
-	retval = pciehp_get_attention_status(slot, value);
-	if (retval < 0)
-		*value = hotplug_slot->info->attention_status;
-
-	return 0;
+	return pciehp_get_attention_status(slot, value);
 }
 
 static int get_latch_status(struct hotplug_slot *hotplug_slot, u8 *value)
 {
 	struct slot *slot = hotplug_slot->private;
-	int retval;
 
 	ctrl_dbg(slot->ctrl, "%s: physical_slot = %s\n",
 		 __func__, slot_name(slot));
 
-	retval = pciehp_get_latch_status(slot, value);
-	if (retval < 0)
-		*value = hotplug_slot->info->latch_status;
-
-	return 0;
+	return pciehp_get_latch_status(slot, value);
 }
 
 static int get_adapter_status(struct hotplug_slot *hotplug_slot, u8 *value)
 {
 	struct slot *slot = hotplug_slot->private;
-	int retval;
 
 	ctrl_dbg(slot->ctrl, "%s: physical_slot = %s\n",
 		 __func__, slot_name(slot));
 
-	retval = pciehp_get_adapter_status(slot, value);
-	if (retval < 0)
-		*value = hotplug_slot->info->adapter_status;
-
-	return 0;
+	return pciehp_get_adapter_status(slot, value);
 }
 
 static int get_max_bus_speed(struct hotplug_slot *hotplug_slot,
 				enum pci_bus_speed *value)
 {
 	struct slot *slot = hotplug_slot->private;
-	int retval;
 
 	ctrl_dbg(slot->ctrl, "%s: physical_slot = %s\n",
 		 __func__, slot_name(slot));
 
-	retval = pciehp_get_max_link_speed(slot, value);
-	if (retval < 0)
-		*value = PCI_SPEED_UNKNOWN;
-
-	return 0;
+	return pciehp_get_max_link_speed(slot, value);
 }
 
 static int get_cur_bus_speed(struct hotplug_slot *hotplug_slot, enum pci_bus_speed *value)
 {
 	struct slot *slot = hotplug_slot->private;
-	int retval;
 
 	ctrl_dbg(slot->ctrl, "%s: physical_slot = %s\n",
 		 __func__, slot_name(slot));
 
-	retval = pciehp_get_cur_link_speed(slot, value);
-	if (retval < 0)
-		*value = PCI_SPEED_UNKNOWN;
-
-	return 0;
+	return pciehp_get_cur_link_speed(slot, value);
 }
 
 static int pciehp_probe(struct pcie_device *dev)
@@ -286,14 +253,13 @@ static int pciehp_probe(struct pcie_device *dev)
 	int rc;
 	struct controller *ctrl;
 	struct slot *slot;
-	u8 value;
-	struct pci_dev *pdev = dev->port;
+	u8 occupied, poweron;
 
 	if (pciehp_force)
 		dev_info(&dev->device,
 			 "Bypassing BIOS check for pciehp use on %s\n",
-			 pci_name(pdev));
-	else if (pciehp_get_hp_hw_control_from_firmware(pdev))
+			 pci_name(dev->port));
+	else if (pciehp_get_hp_hw_control_from_firmware(dev->port))
 		goto err_out_none;
 
 	ctrl = pcie_init(dev);
@@ -318,23 +284,18 @@ static int pciehp_probe(struct pcie_device *dev)
 	rc = pcie_init_notification(ctrl);
 	if (rc) {
 		ctrl_err(ctrl, "Notification initialization failed\n");
-		goto err_out_release_ctlr;
+		goto err_out_free_ctrl_slot;
 	}
 
 	/* Check if slot is occupied */
 	slot = ctrl->slot;
-	pciehp_get_adapter_status(slot, &value);
-	if (value) {
-		if (pciehp_force)
-			pciehp_enable_slot(slot);
-	} else {
-		/* Power off slot if not occupied */
-		if (POWER_CTRL(ctrl)) {
-			rc = pciehp_power_off_slot(slot);
-			if (rc)
-				goto err_out_free_ctrl_slot;
-		}
-	}
+	pciehp_get_adapter_status(slot, &occupied);
+	pciehp_get_power_status(slot, &poweron);
+	if (occupied && pciehp_force)
+		pciehp_enable_slot(slot);
+	/* If empty slot's power status is on, turn power off */
+	if (!occupied && poweron && POWER_CTRL(ctrl))
+		pciehp_power_off_slot(slot);
 
 	return 0;
 
diff --git a/drivers/pci/hotplug/pciehp_ctrl.c b/drivers/pci/hotplug/pciehp_ctrl.c
index 84487d126e4d..d6ac1b261dd9 100644
--- a/drivers/pci/hotplug/pciehp_ctrl.c
+++ b/drivers/pci/hotplug/pciehp_ctrl.c
@@ -142,23 +142,9 @@ u8 pciehp_handle_power_fault(struct slot *p_slot)
 
 	/* power fault */
 	ctrl_dbg(ctrl, "Power fault interrupt received\n");
-
-	if (!pciehp_query_power_fault(p_slot)) {
-		/*
-		 * power fault Cleared
-		 */
-		ctrl_info(ctrl, "Power fault cleared on Slot(%s)\n",
-			  slot_name(p_slot));
-		event_type = INT_POWER_FAULT_CLEAR;
-	} else {
-		/*
-		 *   power fault
-		 */
-		ctrl_info(ctrl, "Power fault on Slot(%s)\n", slot_name(p_slot));
-		event_type = INT_POWER_FAULT;
-		ctrl_info(ctrl, "Power fault bit %x set\n", 0);
-	}
-
+	ctrl_err(ctrl, "Power fault on slot %s\n", slot_name(p_slot));
+	event_type = INT_POWER_FAULT;
+	ctrl_info(ctrl, "Power fault bit %x set\n", 0);
 	queue_interrupt_event(p_slot, event_type);
 
 	return 1;
@@ -224,13 +210,12 @@ static int board_added(struct slot *p_slot)
 	retval = pciehp_check_link_status(ctrl);
 	if (retval) {
 		ctrl_err(ctrl, "Failed to check link status\n");
-		set_slot_off(ctrl, p_slot);
-		return retval;
+		goto err_exit;
 	}
 
 	/* Check for a power fault */
-	if (pciehp_query_power_fault(p_slot)) {
-		ctrl_dbg(ctrl, "Power fault detected\n");
+	if (ctrl->power_fault_detected || pciehp_query_power_fault(p_slot)) {
+		ctrl_err(ctrl, "Power fault on slot %s\n", slot_name(p_slot));
 		retval = -EIO;
 		goto err_exit;
 	}
@@ -363,25 +348,6 @@ void pciehp_queue_pushbutton_work(struct work_struct *work)
 	mutex_unlock(&p_slot->lock);
 }
 
-static int update_slot_info(struct slot *slot)
-{
-	struct hotplug_slot_info *info;
-	int result;
-
-	info = kmalloc(sizeof(*info), GFP_KERNEL);
-	if (!info)
-		return -ENOMEM;
-
-	pciehp_get_power_status(slot, &info->power_status);
-	pciehp_get_attention_status(slot, &info->attention_status);
-	pciehp_get_latch_status(slot, &info->latch_status);
-	pciehp_get_adapter_status(slot, &info->adapter_status);
-
-	result = pci_hp_change_slot_info(slot->hotplug_slot, info);
-	kfree (info);
-	return result;
-}
-
 /*
  * Note: This function must be called with slot->lock held
  */
@@ -442,7 +408,6 @@ static void handle_button_press_event(struct slot *p_slot)
 		 * to hot-add or hot-remove is undergoing
 		 */
 		ctrl_info(ctrl, "Button ignore on Slot(%s)\n", slot_name(p_slot));
-		update_slot_info(p_slot);
 		break;
 	default:
 		ctrl_warn(ctrl, "Not a valid state\n");
@@ -500,11 +465,9 @@ static void interrupt_event_handler(struct work_struct *work)
 		if (!HP_SUPR_RM(ctrl))
 			break;
 		ctrl_dbg(ctrl, "Surprise Removal\n");
-		update_slot_info(p_slot);
 		handle_surprise_event(p_slot);
 		break;
 	default:
-		update_slot_info(p_slot);
 		break;
 	}
 	mutex_unlock(&p_slot->lock);
@@ -547,9 +510,6 @@ int pciehp_enable_slot(struct slot *p_slot)
 	if (rc) {
 		pciehp_get_latch_status(p_slot, &getstatus);
 	}
-
-	update_slot_info(p_slot);
-
 	return rc;
 }
 
@@ -590,10 +550,7 @@ int pciehp_disable_slot(struct slot *p_slot)
 		}
 	}
 
-	ret = remove_board(p_slot);
-	update_slot_info(p_slot);
-
-	return ret;
+	return remove_board(p_slot);
 }
 
 int pciehp_sysfs_enable_slot(struct slot *p_slot)
diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c
index 9ef4605c1ef6..10040d58c8ef 100644
--- a/drivers/pci/hotplug/pciehp_hpc.c
+++ b/drivers/pci/hotplug/pciehp_hpc.c
@@ -45,25 +45,25 @@ static atomic_t pciehp_num_controllers = ATOMIC_INIT(0);
 static inline int pciehp_readw(struct controller *ctrl, int reg, u16 *value)
 {
 	struct pci_dev *dev = ctrl->pcie->port;
-	return pci_read_config_word(dev, ctrl->cap_base + reg, value);
+	return pci_read_config_word(dev, pci_pcie_cap(dev) + reg, value);
 }
 
 static inline int pciehp_readl(struct controller *ctrl, int reg, u32 *value)
 {
 	struct pci_dev *dev = ctrl->pcie->port;
-	return pci_read_config_dword(dev, ctrl->cap_base + reg, value);
+	return pci_read_config_dword(dev, pci_pcie_cap(dev) + reg, value);
 }
 
 static inline int pciehp_writew(struct controller *ctrl, int reg, u16 value)
 {
 	struct pci_dev *dev = ctrl->pcie->port;
-	return pci_write_config_word(dev, ctrl->cap_base + reg, value);
+	return pci_write_config_word(dev, pci_pcie_cap(dev) + reg, value);
 }
 
 static inline int pciehp_writel(struct controller *ctrl, int reg, u32 value)
 {
 	struct pci_dev *dev = ctrl->pcie->port;
-	return pci_write_config_dword(dev, ctrl->cap_base + reg, value);
+	return pci_write_config_dword(dev, pci_pcie_cap(dev) + reg, value);
 }
 
 /* Power Control Command */
@@ -318,8 +318,8 @@ int pciehp_get_attention_status(struct slot *slot, u8 *status)
 		return retval;
 	}
 
-	ctrl_dbg(ctrl, "%s: SLOTCTRL %x, value read %x\n",
-		 __func__, ctrl->cap_base + PCI_EXP_SLTCTL, slot_ctrl);
+	ctrl_dbg(ctrl, "%s: SLOTCTRL %x, value read %x\n", __func__,
+		 pci_pcie_cap(ctrl->pcie->port) + PCI_EXP_SLTCTL, slot_ctrl);
 
 	atten_led_state = (slot_ctrl & PCI_EXP_SLTCTL_AIC) >> 6;
 
@@ -356,8 +356,8 @@ int pciehp_get_power_status(struct slot *slot, u8 *status)
 		ctrl_err(ctrl, "%s: Cannot read SLOTCTRL register\n", __func__);
 		return retval;
 	}
-	ctrl_dbg(ctrl, "%s: SLOTCTRL %x value read %x\n",
-		 __func__, ctrl->cap_base + PCI_EXP_SLTCTL, slot_ctrl);
+	ctrl_dbg(ctrl, "%s: SLOTCTRL %x value read %x\n", __func__,
+		 pci_pcie_cap(ctrl->pcie->port) + PCI_EXP_SLTCTL, slot_ctrl);
 
 	pwr_state = (slot_ctrl & PCI_EXP_SLTCTL_PCC) >> 10;
 
@@ -427,27 +427,24 @@ int pciehp_set_attention_status(struct slot *slot, u8 value)
 	struct controller *ctrl = slot->ctrl;
 	u16 slot_cmd;
 	u16 cmd_mask;
-	int rc;
 
 	cmd_mask = PCI_EXP_SLTCTL_AIC;
 	switch (value) {
-		case 0 :	/* turn off */
-			slot_cmd = 0x00C0;
-			break;
-		case 1:		/* turn on */
-			slot_cmd = 0x0040;
-			break;
-		case 2:		/* turn blink */
-			slot_cmd = 0x0080;
-			break;
-		default:
-			return -1;
+	case 0 :	/* turn off */
+		slot_cmd = 0x00C0;
+		break;
+	case 1:		/* turn on */
+		slot_cmd = 0x0040;
+		break;
+	case 2:		/* turn blink */
+		slot_cmd = 0x0080;
+		break;
+	default:
+		return -EINVAL;
 	}
-	rc = pcie_write_cmd(ctrl, slot_cmd, cmd_mask);
-	ctrl_dbg(ctrl, "%s: SLOTCTRL %x write cmd %x\n",
-		 __func__, ctrl->cap_base + PCI_EXP_SLTCTL, slot_cmd);
-
-	return rc;
+	ctrl_dbg(ctrl, "%s: SLOTCTRL %x write cmd %x\n", __func__,
+		 pci_pcie_cap(ctrl->pcie->port) + PCI_EXP_SLTCTL, slot_cmd);
+	return pcie_write_cmd(ctrl, slot_cmd, cmd_mask);
 }
 
 void pciehp_green_led_on(struct slot *slot)
@@ -459,8 +456,8 @@ void pciehp_green_led_on(struct slot *slot)
 	slot_cmd = 0x0100;
 	cmd_mask = PCI_EXP_SLTCTL_PIC;
 	pcie_write_cmd(ctrl, slot_cmd, cmd_mask);
-	ctrl_dbg(ctrl, "%s: SLOTCTRL %x write cmd %x\n",
-		 __func__, ctrl->cap_base + PCI_EXP_SLTCTL, slot_cmd);
+	ctrl_dbg(ctrl, "%s: SLOTCTRL %x write cmd %x\n", __func__,
+		 pci_pcie_cap(ctrl->pcie->port) + PCI_EXP_SLTCTL, slot_cmd);
 }
 
 void pciehp_green_led_off(struct slot *slot)
@@ -472,8 +469,8 @@ void pciehp_green_led_off(struct slot *slot)
 	slot_cmd = 0x0300;
 	cmd_mask = PCI_EXP_SLTCTL_PIC;
 	pcie_write_cmd(ctrl, slot_cmd, cmd_mask);
-	ctrl_dbg(ctrl, "%s: SLOTCTRL %x write cmd %x\n",
-		 __func__, ctrl->cap_base + PCI_EXP_SLTCTL, slot_cmd);
+	ctrl_dbg(ctrl, "%s: SLOTCTRL %x write cmd %x\n", __func__,
+		 pci_pcie_cap(ctrl->pcie->port) + PCI_EXP_SLTCTL, slot_cmd);
 }
 
 void pciehp_green_led_blink(struct slot *slot)
@@ -485,8 +482,8 @@ void pciehp_green_led_blink(struct slot *slot)
 	slot_cmd = 0x0200;
 	cmd_mask = PCI_EXP_SLTCTL_PIC;
 	pcie_write_cmd(ctrl, slot_cmd, cmd_mask);
-	ctrl_dbg(ctrl, "%s: SLOTCTRL %x write cmd %x\n",
-		 __func__, ctrl->cap_base + PCI_EXP_SLTCTL, slot_cmd);
+	ctrl_dbg(ctrl, "%s: SLOTCTRL %x write cmd %x\n", __func__,
+		 pci_pcie_cap(ctrl->pcie->port) + PCI_EXP_SLTCTL, slot_cmd);
 }
 
 int pciehp_power_on_slot(struct slot * slot)
@@ -514,97 +511,38 @@ int pciehp_power_on_slot(struct slot * slot)
 			return retval;
 		}
 	}
+	ctrl->power_fault_detected = 0;
 
 	slot_cmd = POWER_ON;
 	cmd_mask = PCI_EXP_SLTCTL_PCC;
-	if (!pciehp_poll_mode) {
-		/* Enable power fault detection turned off at power off time */
-		slot_cmd |= PCI_EXP_SLTCTL_PFDE;
-		cmd_mask |= PCI_EXP_SLTCTL_PFDE;
-	}
-
 	retval = pcie_write_cmd(ctrl, slot_cmd, cmd_mask);
 	if (retval) {
 		ctrl_err(ctrl, "Write %x command failed!\n", slot_cmd);
 		return retval;
 	}
-	ctrl_dbg(ctrl, "%s: SLOTCTRL %x write cmd %x\n",
-		 __func__, ctrl->cap_base + PCI_EXP_SLTCTL, slot_cmd);
+	ctrl_dbg(ctrl, "%s: SLOTCTRL %x write cmd %x\n", __func__,
+		 pci_pcie_cap(ctrl->pcie->port) + PCI_EXP_SLTCTL, slot_cmd);
 
-	ctrl->power_fault_detected = 0;
 	return retval;
 }
 
-static inline int pcie_mask_bad_dllp(struct controller *ctrl)
-{
-	struct pci_dev *dev = ctrl->pcie->port;
-	int pos;
-	u32 reg;
-
-	pos = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ERR);
-	if (!pos)
-		return 0;
-	pci_read_config_dword(dev, pos + PCI_ERR_COR_MASK, &reg);
-	if (reg & PCI_ERR_COR_BAD_DLLP)
-		return 0;
-	reg |= PCI_ERR_COR_BAD_DLLP;
-	pci_write_config_dword(dev, pos + PCI_ERR_COR_MASK, reg);
-	return 1;
-}
-
-static inline void pcie_unmask_bad_dllp(struct controller *ctrl)
-{
-	struct pci_dev *dev = ctrl->pcie->port;
-	u32 reg;
-	int pos;
-
-	pos = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ERR);
-	if (!pos)
-		return;
-	pci_read_config_dword(dev, pos + PCI_ERR_COR_MASK, &reg);
-	if (!(reg & PCI_ERR_COR_BAD_DLLP))
-		return;
-	reg &= ~PCI_ERR_COR_BAD_DLLP;
-	pci_write_config_dword(dev, pos + PCI_ERR_COR_MASK, reg);
-}
-
 int pciehp_power_off_slot(struct slot * slot)
 {
 	struct controller *ctrl = slot->ctrl;
 	u16 slot_cmd;
 	u16 cmd_mask;
-	int retval = 0;
-	int changed;
-
-	/*
-	 * Set Bad DLLP Mask bit in Correctable Error Mask
-	 * Register. This is the workaround against Bad DLLP error
-	 * that sometimes happens during turning power off the slot
-	 * which conforms to PCI Express 1.0a spec.
-	 */
-	changed = pcie_mask_bad_dllp(ctrl);
+	int retval;
 
 	slot_cmd = POWER_OFF;
 	cmd_mask = PCI_EXP_SLTCTL_PCC;
-	if (!pciehp_poll_mode) {
-		/* Disable power fault detection */
-		slot_cmd &= ~PCI_EXP_SLTCTL_PFDE;
-		cmd_mask |= PCI_EXP_SLTCTL_PFDE;
-	}
-
 	retval = pcie_write_cmd(ctrl, slot_cmd, cmd_mask);
 	if (retval) {
 		ctrl_err(ctrl, "Write command failed!\n");
-		retval = -1;
-		goto out;
+		return retval;
 	}
-	ctrl_dbg(ctrl, "%s: SLOTCTRL %x write cmd %x\n",
-		 __func__, ctrl->cap_base + PCI_EXP_SLTCTL, slot_cmd);
- out:
-	if (changed)
-		pcie_unmask_bad_dllp(ctrl);
-
-	return retval;
+	ctrl_dbg(ctrl, "%s: SLOTCTRL %x write cmd %x\n", __func__,
+		 pci_pcie_cap(ctrl->pcie->port) + PCI_EXP_SLTCTL, slot_cmd);
+	return 0;
 }
 
 static irqreturn_t pcie_isr(int irq, void *dev_id)
@@ -840,11 +778,19 @@ int pcie_enable_notification(struct controller *ctrl)
 {
 	u16 cmd, mask;
 
+	/*
+	 * TBD: Power fault detected software notification support.
+	 *
+	 * Power fault detected software notification is not enabled
+	 * now, because it caused power fault detected interrupt storm
+	 * on some machines. On those machines, power fault detected
+	 * bit in the slot status register was set again immediately
+	 * when it is cleared in the interrupt service routine, and
+	 * next power fault detected interrupt was notified again.
+	 */
 	cmd = PCI_EXP_SLTCTL_PDCE;
 	if (ATTN_BUTTN(ctrl))
 		cmd |= PCI_EXP_SLTCTL_ABPE;
-	if (POWER_CTRL(ctrl))
-		cmd |= PCI_EXP_SLTCTL_PFDE;
 	if (MRL_SENS(ctrl))
 		cmd |= PCI_EXP_SLTCTL_MRLSCE;
 	if (!pciehp_poll_mode)
@@ -866,7 +812,8 @@ static void pcie_disable_notification(struct controller *ctrl)
 	u16 mask;
 	mask = (PCI_EXP_SLTCTL_PDCE | PCI_EXP_SLTCTL_ABPE |
 		PCI_EXP_SLTCTL_MRLSCE | PCI_EXP_SLTCTL_PFDE |
-		PCI_EXP_SLTCTL_HPIE | PCI_EXP_SLTCTL_CCIE);
+		PCI_EXP_SLTCTL_HPIE | PCI_EXP_SLTCTL_CCIE |
+		PCI_EXP_SLTCTL_DLLSCE);
 	if (pcie_write_cmd(ctrl, 0, mask))
 		ctrl_warn(ctrl, "Cannot disable software notification\n");
 }
@@ -934,7 +881,8 @@ static inline void dbg_ctrl(struct controller *ctrl)
 		  pdev->subsystem_device);
 	ctrl_info(ctrl, "  Subsystem Vendor ID  : 0x%04x\n",
 		  pdev->subsystem_vendor);
-	ctrl_info(ctrl, "  PCIe Cap offset      : 0x%02x\n", ctrl->cap_base);
+	ctrl_info(ctrl, "  PCIe Cap offset      : 0x%02x\n",
+		  pci_pcie_cap(pdev));
 	for (i = 0; i < DEVICE_COUNT_RESOURCE; i++) {
 		if (!pci_resource_len(pdev, i))
 			continue;
@@ -978,8 +926,7 @@ struct controller *pcie_init(struct pcie_device *dev)
 		goto abort;
 	}
 	ctrl->pcie = dev;
-	ctrl->cap_base = pci_find_capability(pdev, PCI_CAP_ID_EXP);
-	if (!ctrl->cap_base) {
+	if (!pci_pcie_cap(pdev)) {
 		ctrl_err(ctrl, "Cannot find PCI Express capability\n");
 		goto abort_ctrl;
 	}
diff --git a/drivers/pci/hotplug/pcihp_slot.c b/drivers/pci/hotplug/pcihp_slot.c
index cc8ec3aa41a7..80b461c98557 100644
--- a/drivers/pci/hotplug/pcihp_slot.c
+++ b/drivers/pci/hotplug/pcihp_slot.c
@@ -43,7 +43,7 @@ static void program_hpp_type0(struct pci_dev *dev, struct hpp_type0 *hpp)
 		 * Perhaps we *should* use default settings for PCIe, but
 		 * pciehp didn't, so we won't either.
 		 */
-		if (dev->is_pcie)
+		if (pci_is_pcie(dev))
 			return;
 		dev_info(&dev->dev, "using default PCI settings\n");
 		hpp = &pci_default_type0;
@@ -102,7 +102,7 @@ static void program_hpp_type2(struct pci_dev *dev, struct hpp_type2 *hpp)
 		return;
 
 	/* Find PCI Express capability */
-	pos = pci_find_capability(dev, PCI_CAP_ID_EXP);
+	pos = pci_pcie_cap(dev);
 	if (!pos)
 		return;
 
diff --git a/drivers/pci/hotplug/shpchp.h b/drivers/pci/hotplug/shpchp.h
index bd588eb8e922..8e210cd76e55 100644
--- a/drivers/pci/hotplug/shpchp.h
+++ b/drivers/pci/hotplug/shpchp.h
@@ -121,7 +121,7 @@ struct controller {
 #define PCI_DEVICE_ID_AMD_GOLAM_7450	0x7450
 #define PCI_DEVICE_ID_AMD_POGO_7458	0x7458
 
-/* AMD PCIX bridge registers */
+/* AMD PCI-X bridge registers */
 #define PCIX_MEM_BASE_LIMIT_OFFSET	0x1C
 #define PCIX_MISCII_OFFSET		0x48
 #define PCIX_MISC_BRIDGE_ERRORS_OFFSET	0x80
diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c
index 9261327b49f3..417312528ddf 100644
--- a/drivers/pci/intel-iommu.c
+++ b/drivers/pci/intel-iommu.c
@@ -277,6 +277,7 @@ static int hw_pass_through = 1;
 
 struct dmar_domain {
 	int	id;			/* domain id */
+	int	nid;			/* node id */
 	unsigned long iommu_bmp;	/* bitmap of iommus this domain uses*/
 
 	struct list_head devices; 	/* all devices' list */
@@ -304,7 +305,7 @@ struct device_domain_info {
 	int segment;		/* PCI domain */
 	u8 bus;			/* PCI bus number */
 	u8 devfn;		/* PCI devfn number */
-	struct pci_dev *dev; /* it's NULL for PCIE-to-PCI bridge */
+	struct pci_dev *dev; /* it's NULL for PCIe-to-PCI bridge */
 	struct intel_iommu *iommu; /* IOMMU used by this device */
 	struct dmar_domain *domain; /* pointer to domain */
 };
@@ -386,30 +387,14 @@ static struct kmem_cache *iommu_domain_cache;
 static struct kmem_cache *iommu_devinfo_cache;
 static struct kmem_cache *iommu_iova_cache;
 
-static inline void *iommu_kmem_cache_alloc(struct kmem_cache *cachep)
+static inline void *alloc_pgtable_page(int node)
 {
-	unsigned int flags;
-	void *vaddr;
-
-	/* trying to avoid low memory issues */
-	flags = current->flags & PF_MEMALLOC;
-	current->flags |= PF_MEMALLOC;
-	vaddr = kmem_cache_alloc(cachep, GFP_ATOMIC);
-	current->flags &= (~PF_MEMALLOC | flags);
-	return vaddr;
-}
-
+	struct page *page;
+	void *vaddr = NULL;
 
-static inline void *alloc_pgtable_page(void)
-{
-	unsigned int flags;
-	void *vaddr;
-
-	/* trying to avoid low memory issues */
-	flags = current->flags & PF_MEMALLOC;
-	current->flags |= PF_MEMALLOC;
-	vaddr = (void *)get_zeroed_page(GFP_ATOMIC);
-	current->flags &= (~PF_MEMALLOC | flags);
+	page = alloc_pages_node(node, GFP_ATOMIC | __GFP_ZERO, 0);
+	if (page)
+		vaddr = page_address(page);
 	return vaddr;
 }
 
@@ -420,7 +405,7 @@ static inline void free_pgtable_page(void *vaddr)
 
 static inline void *alloc_domain_mem(void)
 {
-	return iommu_kmem_cache_alloc(iommu_domain_cache);
+	return kmem_cache_alloc(iommu_domain_cache, GFP_ATOMIC);
 }
 
 static void free_domain_mem(void *vaddr)
@@ -430,7 +415,7 @@ static void free_domain_mem(void *vaddr)
 
 static inline void * alloc_devinfo_mem(void)
 {
-	return iommu_kmem_cache_alloc(iommu_devinfo_cache);
+	return kmem_cache_alloc(iommu_devinfo_cache, GFP_ATOMIC);
 }
 
 static inline void free_devinfo_mem(void *vaddr)
@@ -440,7 +425,7 @@ static inline void free_devinfo_mem(void *vaddr)
 
 struct iova *alloc_iova_mem(void)
 {
-	return iommu_kmem_cache_alloc(iommu_iova_cache);
+	return kmem_cache_alloc(iommu_iova_cache, GFP_ATOMIC);
 }
 
 void free_iova_mem(struct iova *iova)
@@ -589,7 +574,8 @@ static struct context_entry * device_to_context_entry(struct intel_iommu *iommu,
 	root = &iommu->root_entry[bus];
 	context = get_context_addr_from_root(root);
 	if (!context) {
-		context = (struct context_entry *)alloc_pgtable_page();
+		context = (struct context_entry *)
+				alloc_pgtable_page(iommu->node);
 		if (!context) {
 			spin_unlock_irqrestore(&iommu->lock, flags);
 			return NULL;
@@ -732,7 +718,7 @@ static struct dma_pte *pfn_to_dma_pte(struct dmar_domain *domain,
 		if (!dma_pte_present(pte)) {
 			uint64_t pteval;
 
-			tmp_page = alloc_pgtable_page();
+			tmp_page = alloc_pgtable_page(domain->nid);
 
 			if (!tmp_page)
 				return NULL;
@@ -868,7 +854,7 @@ static int iommu_alloc_root_entry(struct intel_iommu *iommu)
 	struct root_entry *root;
 	unsigned long flags;
 
-	root = (struct root_entry *)alloc_pgtable_page();
+	root = (struct root_entry *)alloc_pgtable_page(iommu->node);
 	if (!root)
 		return -ENOMEM;
 
@@ -1263,6 +1249,7 @@ static struct dmar_domain *alloc_domain(void)
 	if (!domain)
 		return NULL;
 
+	domain->nid = -1;
 	memset(&domain->iommu_bmp, 0, sizeof(unsigned long));
 	domain->flags = 0;
 
@@ -1420,9 +1407,10 @@ static int domain_init(struct dmar_domain *domain, int guest_width)
 		domain->iommu_snooping = 0;
 
 	domain->iommu_count = 1;
+	domain->nid = iommu->node;
 
 	/* always allocate the top pgd */
-	domain->pgd = (struct dma_pte *)alloc_pgtable_page();
+	domain->pgd = (struct dma_pte *)alloc_pgtable_page(domain->nid);
 	if (!domain->pgd)
 		return -ENOMEM;
 	__iommu_flush_cache(iommu, domain->pgd, PAGE_SIZE);
@@ -1523,12 +1511,15 @@ static int domain_context_mapping_one(struct dmar_domain *domain, int segment,
 
 		/* Skip top levels of page tables for
 		 * iommu which has less agaw than default.
+		 * Unnecessary for PT mode.
 		 */
-		for (agaw = domain->agaw; agaw != iommu->agaw; agaw--) {
-			pgd = phys_to_virt(dma_pte_addr(pgd));
-			if (!dma_pte_present(pgd)) {
-				spin_unlock_irqrestore(&iommu->lock, flags);
-				return -ENOMEM;
+		if (translation != CONTEXT_TT_PASS_THROUGH) {
+			for (agaw = domain->agaw; agaw != iommu->agaw; agaw--) {
+				pgd = phys_to_virt(dma_pte_addr(pgd));
+				if (!dma_pte_present(pgd)) {
+					spin_unlock_irqrestore(&iommu->lock, flags);
+					return -ENOMEM;
+				}
 			}
 		}
 	}
@@ -1577,6 +1568,8 @@ static int domain_context_mapping_one(struct dmar_domain *domain, int segment,
 	spin_lock_irqsave(&domain->iommu_lock, flags);
 	if (!test_and_set_bit(iommu->seq_id, &domain->iommu_bmp)) {
 		domain->iommu_count++;
+		if (domain->iommu_count == 1)
+			domain->nid = iommu->node;
 		domain_update_iommu_cap(domain);
 	}
 	spin_unlock_irqrestore(&domain->iommu_lock, flags);
@@ -1611,7 +1604,7 @@ domain_context_mapping(struct dmar_domain *domain, struct pci_dev *pdev,
 			return ret;
 		parent = parent->bus->self;
 	}
-	if (tmp->is_pcie) /* this is a PCIE-to-PCI bridge */
+	if (pci_is_pcie(tmp)) /* this is a PCIe-to-PCI bridge */
 		return domain_context_mapping_one(domain,
 					pci_domain_nr(tmp->subordinate),
 					tmp->subordinate->number, 0,
@@ -1651,7 +1644,7 @@ static int domain_context_mapped(struct pci_dev *pdev)
 			return ret;
 		parent = parent->bus->self;
 	}
-	if (tmp->is_pcie)
+	if (pci_is_pcie(tmp))
 		return device_context_mapped(iommu, tmp->subordinate->number,
 					     0);
 	else
@@ -1821,7 +1814,7 @@ static struct dmar_domain *get_domain_for_dev(struct pci_dev *pdev, int gaw)
 
 	dev_tmp = pci_find_upstream_pcie_bridge(pdev);
 	if (dev_tmp) {
-		if (dev_tmp->is_pcie) {
+		if (pci_is_pcie(dev_tmp)) {
 			bus = dev_tmp->subordinate->number;
 			devfn = 0;
 		} else {
@@ -1991,6 +1984,16 @@ static int iommu_prepare_identity_map(struct pci_dev *pdev,
 	       "IOMMU: Setting identity map for device %s [0x%Lx - 0x%Lx]\n",
 	       pci_name(pdev), start, end);
 	
+	if (end < start) {
+		WARN(1, "Your BIOS is broken; RMRR ends before it starts!\n"
+			"BIOS vendor: %s; Ver: %s; Product Version: %s\n",
+			dmi_get_system_info(DMI_BIOS_VENDOR),
+			dmi_get_system_info(DMI_BIOS_VERSION),
+		     dmi_get_system_info(DMI_PRODUCT_VERSION));
+		ret = -EIO;
+		goto error;
+	}
+
 	if (end >> agaw_to_width(domain->agaw)) {
 		WARN(1, "Your BIOS is broken; RMRR exceeds permitted address width (%d bits)\n"
 		     "BIOS vendor: %s; Ver: %s; Product Version: %s\n",
@@ -2182,7 +2185,7 @@ static int iommu_should_identity_map(struct pci_dev *pdev, int startup)
 	 * the 1:1 domain, just in _case_ one of their siblings turns out
 	 * not to be able to map all of memory.
 	 */
-	if (!pdev->is_pcie) {
+	if (!pci_is_pcie(pdev)) {
 		if (!pci_is_root_bus(pdev->bus))
 			return 0;
 		if (pdev->class >> 8 == PCI_CLASS_BRIDGE_PCI)
@@ -3228,6 +3231,9 @@ static int device_notifier(struct notifier_block *nb,
 	struct pci_dev *pdev = to_pci_dev(dev);
 	struct dmar_domain *domain;
 
+	if (iommu_no_mapping(dev))
+		return 0;
+
 	domain = find_domain(pdev);
 	if (!domain)
 		return 0;
@@ -3319,7 +3325,7 @@ static void iommu_detach_dependent_devices(struct intel_iommu *iommu,
 					 parent->devfn);
 			parent = parent->bus->self;
 		}
-		if (tmp->is_pcie) /* this is a PCIE-to-PCI bridge */
+		if (pci_is_pcie(tmp)) /* this is a PCIe-to-PCI bridge */
 			iommu_detach_dev(iommu,
 				tmp->subordinate->number, 0);
 		else /* this is a legacy PCI bridge */
@@ -3455,6 +3461,7 @@ static struct dmar_domain *iommu_alloc_vm_domain(void)
 		return NULL;
 
 	domain->id = vm_domid++;
+	domain->nid = -1;
 	memset(&domain->iommu_bmp, 0, sizeof(unsigned long));
 	domain->flags = DOMAIN_FLAG_VIRTUAL_MACHINE;
 
@@ -3481,9 +3488,10 @@ static int md_domain_init(struct dmar_domain *domain, int guest_width)
 	domain->iommu_coherency = 0;
 	domain->iommu_snooping = 0;
 	domain->max_addr = 0;
+	domain->nid = -1;
 
 	/* always allocate the top pgd */
-	domain->pgd = (struct dma_pte *)alloc_pgtable_page();
+	domain->pgd = (struct dma_pte *)alloc_pgtable_page(domain->nid);
 	if (!domain->pgd)
 		return -ENOMEM;
 	domain_flush_cache(domain, domain->pgd, PAGE_SIZE);
diff --git a/drivers/pci/intr_remapping.c b/drivers/pci/intr_remapping.c
index 0ed78a764ded..95b849130ad4 100644
--- a/drivers/pci/intr_remapping.c
+++ b/drivers/pci/intr_remapping.c
@@ -2,6 +2,7 @@
 #include <linux/dmar.h>
 #include <linux/spinlock.h>
 #include <linux/jiffies.h>
+#include <linux/hpet.h>
 #include <linux/pci.h>
 #include <linux/irq.h>
 #include <asm/io_apic.h>
@@ -14,7 +15,8 @@
 #include "pci.h"
 
 static struct ioapic_scope ir_ioapic[MAX_IO_APICS];
-static int ir_ioapic_num;
+static struct hpet_scope ir_hpet[MAX_HPET_TBS];
+static int ir_ioapic_num, ir_hpet_num;
 int intr_remapping_enabled;
 
 static int disable_intremap;
@@ -343,6 +345,16 @@ int flush_irte(int irq)
 	return rc;
 }
 
+struct intel_iommu *map_hpet_to_ir(u8 hpet_id)
+{
+	int i;
+
+	for (i = 0; i < MAX_HPET_TBS; i++)
+		if (ir_hpet[i].id == hpet_id)
+			return ir_hpet[i].iommu;
+	return NULL;
+}
+
 struct intel_iommu *map_ioapic_to_ir(int apic)
 {
 	int i;
@@ -470,6 +482,36 @@ int set_ioapic_sid(struct irte *irte, int apic)
 	return 0;
 }
 
+int set_hpet_sid(struct irte *irte, u8 id)
+{
+	int i;
+	u16 sid = 0;
+
+	if (!irte)
+		return -1;
+
+	for (i = 0; i < MAX_HPET_TBS; i++) {
+		if (ir_hpet[i].id == id) {
+			sid = (ir_hpet[i].bus << 8) | ir_hpet[i].devfn;
+			break;
+		}
+	}
+
+	if (sid == 0) {
+		pr_warning("Failed to set source-id of HPET block (%d)\n", id);
+		return -1;
+	}
+
+	/*
+	 * Should really use SQ_ALL_16. Some platforms are broken.
+	 * While we figure out the right quirks for these broken platforms, use
+	 * SQ_13_IGNORE_3 for now.
+	 */
+	set_irte_sid(irte, SVT_VERIFY_SID_SQ, SQ_13_IGNORE_3, sid);
+
+	return 0;
+}
+
 int set_msi_sid(struct irte *irte, struct pci_dev *dev)
 {
 	struct pci_dev *bridge;
@@ -478,7 +520,7 @@ int set_msi_sid(struct irte *irte, struct pci_dev *dev)
 		return -1;
 
 	/* PCIe device or Root Complex integrated PCI device */
-	if (dev->is_pcie || !dev->bus->parent) {
+	if (pci_is_pcie(dev) || !dev->bus->parent) {
 		set_irte_sid(irte, SVT_VERIFY_SID_SQ, SQ_ALL_16,
 			     (dev->bus->number << 8) | dev->devfn);
 		return 0;
@@ -486,7 +528,7 @@ int set_msi_sid(struct irte *irte, struct pci_dev *dev)
 
 	bridge = pci_find_upstream_pcie_bridge(dev);
 	if (bridge) {
-		if (bridge->is_pcie) /* this is a PCIE-to-PCI/PCIX bridge */
+		if (pci_is_pcie(bridge))/* this is a PCIe-to-PCI/PCIX bridge */
 			set_irte_sid(irte, SVT_VERIFY_BUS, SQ_ALL_16,
 				(bridge->bus->number << 8) | dev->bus->number);
 		else /* this is a legacy PCI bridge */
@@ -548,7 +590,8 @@ static int setup_intr_remapping(struct intel_iommu *iommu, int mode)
 	if (!iommu->ir_table)
 		return -ENOMEM;
 
-	pages = alloc_pages(GFP_ATOMIC | __GFP_ZERO, INTR_REMAP_PAGE_ORDER);
+	pages = alloc_pages_node(iommu->node, GFP_ATOMIC | __GFP_ZERO,
+				 INTR_REMAP_PAGE_ORDER);
 
 	if (!pages) {
 		printk(KERN_ERR "failed to allocate pages of order %d\n",
@@ -711,6 +754,34 @@ error:
 	return -1;
 }
 
+static void ir_parse_one_hpet_scope(struct acpi_dmar_device_scope *scope,
+				      struct intel_iommu *iommu)
+{
+	struct acpi_dmar_pci_path *path;
+	u8 bus;
+	int count;
+
+	bus = scope->bus;
+	path = (struct acpi_dmar_pci_path *)(scope + 1);
+	count = (scope->length - sizeof(struct acpi_dmar_device_scope))
+		/ sizeof(struct acpi_dmar_pci_path);
+
+	while (--count > 0) {
+		/*
+		 * Access PCI directly due to the PCI
+		 * subsystem isn't initialized yet.
+		 */
+		bus = read_pci_config_byte(bus, path->dev, path->fn,
+					   PCI_SECONDARY_BUS);
+		path++;
+	}
+	ir_hpet[ir_hpet_num].bus   = bus;
+	ir_hpet[ir_hpet_num].devfn = PCI_DEVFN(path->dev, path->fn);
+	ir_hpet[ir_hpet_num].iommu = iommu;
+	ir_hpet[ir_hpet_num].id    = scope->enumeration_id;
+	ir_hpet_num++;
+}
+
 static void ir_parse_one_ioapic_scope(struct acpi_dmar_device_scope *scope,
 				      struct intel_iommu *iommu)
 {
@@ -740,8 +811,8 @@ static void ir_parse_one_ioapic_scope(struct acpi_dmar_device_scope *scope,
 	ir_ioapic_num++;
 }
 
-static int ir_parse_ioapic_scope(struct acpi_dmar_header *header,
-				 struct intel_iommu *iommu)
+static int ir_parse_ioapic_hpet_scope(struct acpi_dmar_header *header,
+				      struct intel_iommu *iommu)
 {
 	struct acpi_dmar_hardware_unit *drhd;
 	struct acpi_dmar_device_scope *scope;
@@ -765,6 +836,17 @@ static int ir_parse_ioapic_scope(struct acpi_dmar_header *header,
 			       drhd->address);
 
 			ir_parse_one_ioapic_scope(scope, iommu);
+		} else if (scope->entry_type == ACPI_DMAR_SCOPE_TYPE_HPET) {
+			if (ir_hpet_num == MAX_HPET_TBS) {
+				printk(KERN_WARNING "Exceeded Max HPET blocks\n");
+				return -1;
+			}
+
+			printk(KERN_INFO "HPET id %d under DRHD base"
+			       " 0x%Lx\n", scope->enumeration_id,
+			       drhd->address);
+
+			ir_parse_one_hpet_scope(scope, iommu);
 		}
 		start += scope->length;
 	}
@@ -785,7 +867,7 @@ int __init parse_ioapics_under_ir(void)
 		struct intel_iommu *iommu = drhd->iommu;
 
 		if (ecap_ir_support(iommu->ecap)) {
-			if (ir_parse_ioapic_scope(drhd->hdr, iommu))
+			if (ir_parse_ioapic_hpet_scope(drhd->hdr, iommu))
 				return -1;
 
 			ir_supported = 1;
diff --git a/drivers/pci/intr_remapping.h b/drivers/pci/intr_remapping.h
index 63a263c18415..5662fecfee60 100644
--- a/drivers/pci/intr_remapping.h
+++ b/drivers/pci/intr_remapping.h
@@ -7,4 +7,11 @@ struct ioapic_scope {
 	unsigned int devfn;	/* PCI devfn number */
 };
 
+struct hpet_scope {
+	struct intel_iommu *iommu;
+	u8 id;
+	unsigned int bus;
+	unsigned int devfn;
+};
+
 #define IR_X2APIC_MODE(mode) (mode ? (1 << 11) : 0)
diff --git a/drivers/pci/ioapic.c b/drivers/pci/ioapic.c
new file mode 100644
index 000000000000..3e0d7b5dd1b9
--- /dev/null
+++ b/drivers/pci/ioapic.c
@@ -0,0 +1,127 @@
+/*
+ * IOAPIC/IOxAPIC/IOSAPIC driver
+ *
+ * Copyright (C) 2009 Fujitsu Limited.
+ * (c) Copyright 2009 Hewlett-Packard Development Company, L.P.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+/*
+ * This driver manages PCI I/O APICs added by hotplug after boot.  We try to
+ * claim all I/O APIC PCI devices, but those present at boot were registered
+ * when we parsed the ACPI MADT, so we'll fail when we try to re-register
+ * them.
+ */
+
+#include <linux/pci.h>
+#include <linux/acpi.h>
+#include <acpi/acpi_bus.h>
+
+struct ioapic {
+	acpi_handle	handle;
+	u32		gsi_base;
+};
+
+static int ioapic_probe(struct pci_dev *dev, const struct pci_device_id *ent)
+{
+	acpi_handle handle;
+	acpi_status status;
+	unsigned long long gsb;
+	struct ioapic *ioapic;
+	u64 addr;
+	int ret;
+	char *type;
+
+	handle = DEVICE_ACPI_HANDLE(&dev->dev);
+	if (!handle)
+		return -EINVAL;
+
+	status = acpi_evaluate_integer(handle, "_GSB", NULL, &gsb);
+	if (ACPI_FAILURE(status))
+		return -EINVAL;
+
+	/*
+	 * The previous code in acpiphp evaluated _MAT if _GSB failed, but
+	 * ACPI spec 4.0 sec 6.2.2 requires _GSB for hot-pluggable I/O APICs.
+	 */
+
+	ioapic = kzalloc(sizeof(*ioapic), GFP_KERNEL);
+	if (!ioapic)
+		return -ENOMEM;
+
+	ioapic->handle = handle;
+	ioapic->gsi_base = (u32) gsb;
+
+	if (dev->class == PCI_CLASS_SYSTEM_PIC_IOAPIC)
+		type = "IOAPIC";
+	else
+		type = "IOxAPIC";
+
+	ret = pci_enable_device(dev);
+	if (ret < 0)
+		goto exit_free;
+
+	pci_set_master(dev);
+
+	if (pci_request_region(dev, 0, type))
+		goto exit_disable;
+
+	addr = pci_resource_start(dev, 0);
+	if (acpi_register_ioapic(ioapic->handle, addr, ioapic->gsi_base))
+		goto exit_release;
+
+	pci_set_drvdata(dev, ioapic);
+	dev_info(&dev->dev, "%s at %#llx, GSI %u\n", type, addr,
+		 ioapic->gsi_base);
+	return 0;
+
+exit_release:
+	pci_release_region(dev, 0);
+exit_disable:
+	pci_disable_device(dev);
+exit_free:
+	kfree(ioapic);
+	return -ENODEV;
+}
+
+static void ioapic_remove(struct pci_dev *dev)
+{
+	struct ioapic *ioapic = pci_get_drvdata(dev);
+
+	acpi_unregister_ioapic(ioapic->handle, ioapic->gsi_base);
+	pci_release_region(dev, 0);
+	pci_disable_device(dev);
+	kfree(ioapic);
+}
+
+
+static struct pci_device_id ioapic_devices[] = {
+	{ PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
+	  PCI_CLASS_SYSTEM_PIC_IOAPIC << 8, 0xffff00, },
+	{ PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
+	  PCI_CLASS_SYSTEM_PIC_IOXAPIC << 8, 0xffff00, },
+	{ }
+};
+
+static struct pci_driver ioapic_driver = {
+	.name		= "ioapic",
+	.id_table	= ioapic_devices,
+	.probe		= ioapic_probe,
+	.remove		= __devexit_p(ioapic_remove),
+};
+
+static int __init ioapic_init(void)
+{
+	return pci_register_driver(&ioapic_driver);
+}
+
+static void __exit ioapic_exit(void)
+{
+	pci_unregister_driver(&ioapic_driver);
+}
+
+module_init(ioapic_init);
+module_exit(ioapic_exit);
diff --git a/drivers/pci/iov.c b/drivers/pci/iov.c
index e03fe98f0619..b2a448e19fe6 100644
--- a/drivers/pci/iov.c
+++ b/drivers/pci/iov.c
@@ -555,7 +555,7 @@ int pci_iov_init(struct pci_dev *dev)
 {
 	int pos;
 
-	if (!dev->is_pcie)
+	if (!pci_is_pcie(dev))
 		return -ENODEV;
 
 	pos = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_SRIOV);
diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c
index 33317df47699..7e2829538a4c 100644
--- a/drivers/pci/pci-acpi.c
+++ b/drivers/pci/pci-acpi.c
@@ -112,11 +112,7 @@ static bool acpi_pci_can_wakeup(struct pci_dev *dev)
 static void acpi_pci_propagate_wakeup_enable(struct pci_bus *bus, bool enable)
 {
 	while (bus->parent) {
-		struct pci_dev *bridge = bus->self;
-		int ret;
-
-		ret = acpi_pm_device_sleep_wake(&bridge->dev, enable);
-		if (!ret || bridge->is_pcie)
+		if (!acpi_pm_device_sleep_wake(&bus->self->dev, enable))
 			return;
 		bus = bus->parent;
 	}
@@ -131,9 +127,7 @@ static int acpi_pci_sleep_wake(struct pci_dev *dev, bool enable)
 	if (acpi_pci_can_wakeup(dev))
 		return acpi_pm_device_sleep_wake(&dev->dev, enable);
 
-	if (!dev->is_pcie)
-		acpi_pci_propagate_wakeup_enable(dev->bus, enable);
-
+	acpi_pci_propagate_wakeup_enable(dev->bus, enable);
 	return 0;
 }
 
diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
index 0f6382f090ee..807224ec8351 100644
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -74,7 +74,12 @@ static ssize_t local_cpus_show(struct device *dev,
 	const struct cpumask *mask;
 	int len;
 
+#ifdef CONFIG_NUMA
+	mask = (dev_to_node(dev) == -1) ? cpu_online_mask :
+					  cpumask_of_node(dev_to_node(dev));
+#else
 	mask = cpumask_of_pcibus(to_pci_dev(dev)->bus);
+#endif
 	len = cpumask_scnprintf(buf, PAGE_SIZE-2, mask);
 	buf[len++] = '\n';
 	buf[len] = '\0';
@@ -88,7 +93,12 @@ static ssize_t local_cpulist_show(struct device *dev,
 	const struct cpumask *mask;
 	int len;
 
+#ifdef CONFIG_NUMA
+	mask = (dev_to_node(dev) == -1) ? cpu_online_mask :
+					  cpumask_of_node(dev_to_node(dev));
+#else
 	mask = cpumask_of_pcibus(to_pci_dev(dev)->bus);
+#endif
 	len = cpulist_scnprintf(buf, PAGE_SIZE-2, mask);
 	buf[len++] = '\n';
 	buf[len] = '\0';
@@ -176,6 +186,21 @@ numa_node_show(struct device *dev, struct device_attribute *attr, char *buf)
 #endif
 
 static ssize_t
+dma_mask_bits_show(struct device *dev, struct device_attribute *attr, char *buf)
+{
+	struct pci_dev *pdev = to_pci_dev(dev);
+
+	return sprintf (buf, "%d\n", fls64(pdev->dma_mask));
+}
+
+static ssize_t
+consistent_dma_mask_bits_show(struct device *dev, struct device_attribute *attr,
+				 char *buf)
+{
+	return sprintf (buf, "%d\n", fls64(dev->coherent_dma_mask));
+}
+
+static ssize_t
 msi_bus_show(struct device *dev, struct device_attribute *attr, char *buf)
 {
 	struct pci_dev *pdev = to_pci_dev(dev);
@@ -306,6 +331,8 @@ struct device_attribute pci_dev_attrs[] = {
 #ifdef CONFIG_NUMA
 	__ATTR_RO(numa_node),
 #endif
+	__ATTR_RO(dma_mask_bits),
+	__ATTR_RO(consistent_dma_mask_bits),
 	__ATTR(enable, 0600, is_enabled_show, is_enabled_store),
 	__ATTR(broken_parity_status,(S_IRUGO|S_IWUSR),
 		broken_parity_status_show,broken_parity_status_store),
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 4e4c295a049f..315fea47e784 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -29,7 +29,17 @@ const char *pci_power_names[] = {
 };
 EXPORT_SYMBOL_GPL(pci_power_names);
 
-unsigned int pci_pm_d3_delay = PCI_PM_D3_WAIT;
+unsigned int pci_pm_d3_delay;
+
+static void pci_dev_d3_sleep(struct pci_dev *dev)
+{
+	unsigned int delay = dev->d3_delay;
+
+	if (delay < pci_pm_d3_delay)
+		delay = pci_pm_d3_delay;
+
+	msleep(delay);
+}
 
 #ifdef CONFIG_PCI_DOMAINS
 int pci_domains_supported = 1;
@@ -47,6 +57,15 @@ unsigned long pci_cardbus_mem_size = DEFAULT_CARDBUS_MEM_SIZE;
 unsigned long pci_hotplug_io_size  = DEFAULT_HOTPLUG_IO_SIZE;
 unsigned long pci_hotplug_mem_size = DEFAULT_HOTPLUG_MEM_SIZE;
 
+/*
+ * The default CLS is used if arch didn't set CLS explicitly and not
+ * all pci devices agree on the same value.  Arch can override either
+ * the dfl or actual value as it sees fit.  Don't forget this is
+ * measured in 32-bit words, not bytes.
+ */
+u8 pci_dfl_cache_line_size __devinitdata = L1_CACHE_BYTES >> 2;
+u8 pci_cache_line_size;
+
 /**
  * pci_bus_max_busnr - returns maximum PCI bus number of given bus' children
  * @bus: pointer to PCI bus structure to search
@@ -373,8 +392,12 @@ pci_find_parent_resource(const struct pci_dev *dev, struct resource *res)
 			continue;	/* Wrong type */
 		if (!((res->flags ^ r->flags) & IORESOURCE_PREFETCH))
 			return r;	/* Exact match */
-		if ((res->flags & IORESOURCE_PREFETCH) && !(r->flags & IORESOURCE_PREFETCH))
-			best = r;	/* Approximating prefetchable by non-prefetchable */
+		/* We can't insert a non-prefetch resource inside a prefetchable parent .. */
+		if (r->flags & IORESOURCE_PREFETCH)
+			continue;
+		/* .. but we can put a prefetchable resource inside a non-prefetchable one */
+		if (!best)
+			best = r;
 	}
 	return best;
 }
@@ -509,7 +532,7 @@ static int pci_raw_set_power_state(struct pci_dev *dev, pci_power_t state)
 	/* Mandatory power management transition delays */
 	/* see PCI PM 1.1 5.6.1 table 18 */
 	if (state == PCI_D3hot || dev->current_state == PCI_D3hot)
-		msleep(pci_pm_d3_delay);
+		pci_dev_d3_sleep(dev);
 	else if (state == PCI_D2 || dev->current_state == PCI_D2)
 		udelay(PCI_PM_D2_DELAY);
 
@@ -728,8 +751,8 @@ static int pci_save_pcie_state(struct pci_dev *dev)
 	u16 *cap;
 	u16 flags;
 
-	pos = pci_find_capability(dev, PCI_CAP_ID_EXP);
-	if (pos <= 0)
+	pos = pci_pcie_cap(dev);
+	if (!pos)
 		return 0;
 
 	save_state = pci_find_saved_cap(dev, PCI_CAP_ID_EXP);
@@ -837,7 +860,7 @@ pci_save_state(struct pci_dev *dev)
 	int i;
 	/* XXX: 100% dword access ok here? */
 	for (i = 0; i < 16; i++)
-		pci_read_config_dword(dev, i * 4,&dev->saved_config_space[i]);
+		pci_read_config_dword(dev, i * 4, &dev->saved_config_space[i]);
 	dev->state_saved = true;
 	if ((i = pci_save_pcie_state(dev)) != 0)
 		return i;
@@ -1140,11 +1163,11 @@ pci_disable_device(struct pci_dev *dev)
 
 /**
  * pcibios_set_pcie_reset_state - set reset state for device dev
- * @dev: the PCI-E device reset
+ * @dev: the PCIe device reset
  * @state: Reset state to enter into
  *
  *
- * Sets the PCI-E reset state for the device. This is the default
+ * Sets the PCIe reset state for the device. This is the default
  * implementation. Architecture implementations can override this.
  */
 int __attribute__ ((weak)) pcibios_set_pcie_reset_state(struct pci_dev *dev,
@@ -1155,7 +1178,7 @@ int __attribute__ ((weak)) pcibios_set_pcie_reset_state(struct pci_dev *dev,
 
 /**
  * pci_set_pcie_reset_state - set reset state for device dev
- * @dev: the PCI-E device reset
+ * @dev: the PCIe device reset
  * @state: Reset state to enter into
  *
  *
@@ -1202,7 +1225,7 @@ void pci_pme_active(struct pci_dev *dev, bool enable)
 
 	pci_write_config_word(dev, dev->pm_cap + PCI_PM_CTRL, pmcsr);
 
-	dev_printk(KERN_INFO, &dev->dev, "PME# %s\n",
+	dev_printk(KERN_DEBUG, &dev->dev, "PME# %s\n",
 			enable ? "enabled" : "disabled");
 }
 
@@ -1396,6 +1419,7 @@ void pci_pm_init(struct pci_dev *dev)
 	}
 
 	dev->pm_cap = pm;
+	dev->d3_delay = PCI_PM_D3_WAIT;
 
 	dev->d1_support = false;
 	dev->d2_support = false;
@@ -1413,7 +1437,8 @@ void pci_pm_init(struct pci_dev *dev)
 
 	pmc &= PCI_PM_CAP_PME_MASK;
 	if (pmc) {
-		dev_info(&dev->dev, "PME# supported from%s%s%s%s%s\n",
+		dev_printk(KERN_DEBUG, &dev->dev,
+			 "PME# supported from%s%s%s%s%s\n",
 			 (pmc & PCI_PM_CAP_PME_D0) ? " D0" : "",
 			 (pmc & PCI_PM_CAP_PME_D1) ? " D1" : "",
 			 (pmc & PCI_PM_CAP_PME_D2) ? " D2" : "",
@@ -1510,7 +1535,7 @@ void pci_enable_ari(struct pci_dev *dev)
 	u16 ctrl;
 	struct pci_dev *bridge;
 
-	if (!dev->is_pcie || dev->devfn)
+	if (!pci_is_pcie(dev) || dev->devfn)
 		return;
 
 	pos = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ARI);
@@ -1518,10 +1543,10 @@ void pci_enable_ari(struct pci_dev *dev)
 		return;
 
 	bridge = dev->bus->self;
-	if (!bridge || !bridge->is_pcie)
+	if (!bridge || !pci_is_pcie(bridge))
 		return;
 
-	pos = pci_find_capability(bridge, PCI_CAP_ID_EXP);
+	pos = pci_pcie_cap(bridge);
 	if (!pos)
 		return;
 
@@ -1536,6 +1561,54 @@ void pci_enable_ari(struct pci_dev *dev)
 	bridge->ari_enabled = 1;
 }
 
+static int pci_acs_enable;
+
+/**
+ * pci_request_acs - ask for ACS to be enabled if supported
+ */
+void pci_request_acs(void)
+{
+	pci_acs_enable = 1;
+}
+
+/**
+ * pci_enable_acs - enable ACS if hardware support it
+ * @dev: the PCI device
+ */
+void pci_enable_acs(struct pci_dev *dev)
+{
+	int pos;
+	u16 cap;
+	u16 ctrl;
+
+	if (!pci_acs_enable)
+		return;
+
+	if (!pci_is_pcie(dev))
+		return;
+
+	pos = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ACS);
+	if (!pos)
+		return;
+
+	pci_read_config_word(dev, pos + PCI_ACS_CAP, &cap);
+	pci_read_config_word(dev, pos + PCI_ACS_CTRL, &ctrl);
+
+	/* Source Validation */
+	ctrl |= (cap & PCI_ACS_SV);
+
+	/* P2P Request Redirect */
+	ctrl |= (cap & PCI_ACS_RR);
+
+	/* P2P Completion Redirect */
+	ctrl |= (cap & PCI_ACS_CR);
+
+	/* Upstream Forwarding */
+	ctrl |= (cap & PCI_ACS_UF);
+
+	pci_write_config_word(dev, pos + PCI_ACS_CTRL, ctrl);
+}
+
 /**
  * pci_swizzle_interrupt_pin - swizzle INTx for device behind bridge
  * @dev: the PCI device
@@ -1669,9 +1742,7 @@ static int __pci_request_region(struct pci_dev *pdev, int bar, const char *res_n
 	return 0;
 
 err_out:
-	dev_warn(&pdev->dev, "BAR %d: can't reserve %s region %pR\n",
-		 bar,
-		 pci_resource_flags(pdev, bar) & IORESOURCE_IO ? "I/O" : "mem",
+	dev_warn(&pdev->dev, "BAR %d: can't reserve %pR\n", bar,
 		 &pdev->resource[bar]);
 	return -EBUSY;
 }
@@ -1866,31 +1937,6 @@ void pci_clear_master(struct pci_dev *dev)
 	__pci_set_master(dev, false);
 }
 
-#ifdef PCI_DISABLE_MWI
-int pci_set_mwi(struct pci_dev *dev)
-{
-	return 0;
-}
-
-int pci_try_set_mwi(struct pci_dev *dev)
-{
-	return 0;
-}
-
-void pci_clear_mwi(struct pci_dev *dev)
-{
-}
-
-#else
-
-#ifndef PCI_CACHE_LINE_BYTES
-#define PCI_CACHE_LINE_BYTES L1_CACHE_BYTES
-#endif
-
-/* This can be overridden by arch code. */
-/* Don't forget this is measured in 32-bit words, not bytes */
-u8 pci_cache_line_size = PCI_CACHE_LINE_BYTES / 4;
-
 /**
  * pci_set_cacheline_size - ensure the CACHE_LINE_SIZE register is programmed
  * @dev: the PCI device for which MWI is to be enabled
@@ -1901,13 +1947,12 @@ u8 pci_cache_line_size = PCI_CACHE_LINE_BYTES / 4;
  *
  * RETURNS: An appropriate -ERRNO error value on error, or zero for success.
  */
-static int
-pci_set_cacheline_size(struct pci_dev *dev)
+int pci_set_cacheline_size(struct pci_dev *dev)
 {
 	u8 cacheline_size;
 
 	if (!pci_cache_line_size)
-		return -EINVAL;		/* The system doesn't support MWI. */
+		return -EINVAL;
 
 	/* Validate current setting: the PCI_CACHE_LINE_SIZE must be
 	   equal to or multiple of the right value. */
@@ -1928,6 +1973,24 @@ pci_set_cacheline_size(struct pci_dev *dev)
 
 	return -EINVAL;
 }
+EXPORT_SYMBOL_GPL(pci_set_cacheline_size);
+
+#ifdef PCI_DISABLE_MWI
+int pci_set_mwi(struct pci_dev *dev)
+{
+	return 0;
+}
+
+int pci_try_set_mwi(struct pci_dev *dev)
+{
+	return 0;
+}
+
+void pci_clear_mwi(struct pci_dev *dev)
+{
+}
+
+#else
 
 /**
  * pci_set_mwi - enables memory-write-invalidate PCI transaction
@@ -2062,6 +2125,7 @@ pci_set_dma_mask(struct pci_dev *dev, u64 mask)
 		return -EIO;
 
 	dev->dma_mask = mask;
+	dev_dbg(&dev->dev, "using %dbit DMA mask\n", fls64(mask));
 
 	return 0;
 }
@@ -2073,6 +2137,7 @@ pci_set_consistent_dma_mask(struct pci_dev *dev, u64 mask)
 		return -EIO;
 
 	dev->dev.coherent_dma_mask = mask;
+	dev_dbg(&dev->dev, "using %dbit consistent DMA mask\n", fls64(mask));
 
 	return 0;
 }
@@ -2099,9 +2164,9 @@ static int pcie_flr(struct pci_dev *dev, int probe)
 	int i;
 	int pos;
 	u32 cap;
-	u16 status;
+	u16 status, control;
 
-	pos = pci_find_capability(dev, PCI_CAP_ID_EXP);
+	pos = pci_pcie_cap(dev);
 	if (!pos)
 		return -ENOTTY;
 
@@ -2126,8 +2191,10 @@ static int pcie_flr(struct pci_dev *dev, int probe)
 			"proceeding with reset anyway\n");
 
 clear:
-	pci_write_config_word(dev, pos + PCI_EXP_DEVCTL,
-				PCI_EXP_DEVCTL_BCR_FLR);
+	pci_read_config_word(dev, pos + PCI_EXP_DEVCTL, &control);
+	control |= PCI_EXP_DEVCTL_BCR_FLR;
+	pci_write_config_word(dev, pos + PCI_EXP_DEVCTL, control);
+
 	msleep(100);
 
 	return 0;
@@ -2191,12 +2258,12 @@ static int pci_pm_reset(struct pci_dev *dev, int probe)
 	csr &= ~PCI_PM_CTRL_STATE_MASK;
 	csr |= PCI_D3hot;
 	pci_write_config_word(dev, dev->pm_cap + PCI_PM_CTRL, csr);
-	msleep(pci_pm_d3_delay);
+	pci_dev_d3_sleep(dev);
 
 	csr &= ~PCI_PM_CTRL_STATE_MASK;
 	csr |= PCI_D0;
 	pci_write_config_word(dev, dev->pm_cap + PCI_PM_CTRL, csr);
-	msleep(pci_pm_d3_delay);
+	pci_dev_d3_sleep(dev);
 
 	return 0;
 }
@@ -2240,6 +2307,10 @@ static int pci_dev_reset(struct pci_dev *dev, int probe)
 		down(&dev->dev.sem);
 	}
 
+	rc = pci_dev_specific_reset(dev, probe);
+	if (rc != -ENOTTY)
+		goto done;
+
 	rc = pcie_flr(dev, probe);
 	if (rc != -ENOTTY)
 		goto done;
@@ -2450,7 +2521,7 @@ int pcie_get_readrq(struct pci_dev *dev)
 	int ret, cap;
 	u16 ctl;
 
-	cap = pci_find_capability(dev, PCI_CAP_ID_EXP);
+	cap = pci_pcie_cap(dev);
 	if (!cap)
 		return -EINVAL;
 
@@ -2480,7 +2551,7 @@ int pcie_set_readrq(struct pci_dev *dev, int rq)
 
 	v = (ffs(rq) - 8) << 12;
 
-	cap = pci_find_capability(dev, PCI_CAP_ID_EXP);
+	cap = pci_pcie_cap(dev);
 	if (!cap)
 		goto out;
 
@@ -2540,7 +2611,7 @@ int pci_resource_bar(struct pci_dev *dev, int resno, enum pci_bar_type *type)
 			return reg;
 	}
 
-	dev_err(&dev->dev, "BAR: invalid resource #%d\n", resno);
+	dev_err(&dev->dev, "BAR %d: invalid resource\n", resno);
 	return 0;
 }
 
@@ -2590,7 +2661,7 @@ int pci_set_vga_state(struct pci_dev *dev, bool decode,
 
 #define RESOURCE_ALIGNMENT_PARAM_SIZE COMMAND_LINE_SIZE
 static char resource_alignment_param[RESOURCE_ALIGNMENT_PARAM_SIZE] = {0};
-spinlock_t resource_alignment_lock = SPIN_LOCK_UNLOCKED;
+static DEFINE_SPINLOCK(resource_alignment_lock);
 
 /**
  * pci_specified_resource_alignment - get resource alignment specified by user.
@@ -2723,6 +2794,11 @@ int __attribute__ ((weak)) pci_ext_cfg_avail(struct pci_dev *dev)
 	return 1;
 }
 
+void __weak pci_fixup_cardbus(struct pci_bus *bus)
+{
+}
+EXPORT_SYMBOL(pci_fixup_cardbus);
+
 static int __init pci_setup(char *str)
 {
 	while (str) {
diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
index d92d1954a2fb..fbd0e3adbca3 100644
--- a/drivers/pci/pci.h
+++ b/drivers/pci/pci.h
@@ -311,4 +311,14 @@ static inline int pci_resource_alignment(struct pci_dev *dev,
 	return resource_alignment(res);
 }
 
+extern void pci_enable_acs(struct pci_dev *dev);
+
+struct pci_dev_reset_methods {
+	u16 vendor;
+	u16 device;
+	int (*reset)(struct pci_dev *dev, int probe);
+};
+
+extern int pci_dev_specific_reset(struct pci_dev *dev, int probe);
+
 #endif /* DRIVERS_PCI_H */
diff --git a/drivers/pci/pcie/aer/Kconfig.debug b/drivers/pci/pcie/aer/Kconfig.debug
index b8c925c1f6aa..9142949734f5 100644
--- a/drivers/pci/pcie/aer/Kconfig.debug
+++ b/drivers/pci/pcie/aer/Kconfig.debug
@@ -3,14 +3,14 @@
 #
 
 config PCIEAER_INJECT
-	tristate "PCIE AER error injector support"
+	tristate "PCIe AER error injector support"
 	depends on PCIEAER
 	default n
 	help
 	  This enables PCI Express Root Port Advanced Error Reporting
 	  (AER) software error injector.
 
-	  Debuging PCIE AER code is quite difficult because it is hard
+	  Debugging PCIe AER code is quite difficult because it is hard
 	  to trigger various real hardware errors. Software based
 	  error injection can fake almost all kinds of errors with the
 	  help of a user space helper tool aer-inject, which can be
diff --git a/drivers/pci/pcie/aer/aer_inject.c b/drivers/pci/pcie/aer/aer_inject.c
index 62d15f652bb6..8c30a9544d61 100644
--- a/drivers/pci/pcie/aer/aer_inject.c
+++ b/drivers/pci/pcie/aer/aer_inject.c
@@ -1,7 +1,7 @@
 /*
- * PCIE AER software error injection support.
+ * PCIe AER software error injection support.
  *
- * Debuging PCIE AER code is quite difficult because it is hard to
+ * Debuging PCIe AER code is quite difficult because it is hard to
  * trigger various real hardware errors. Software based error
  * injection can fake almost all kinds of errors with the help of a
  * user space helper tool aer-inject, which can be gotten from:
@@ -23,6 +23,7 @@
 #include <linux/pci.h>
 #include <linux/fs.h>
 #include <linux/uaccess.h>
+#include <linux/stddef.h>
 #include "aerdrv.h"
 
 struct aer_error_inj {
@@ -35,10 +36,12 @@ struct aer_error_inj {
 	u32 header_log1;
 	u32 header_log2;
 	u32 header_log3;
+	u16 domain;
 };
 
 struct aer_error {
 	struct list_head list;
+	u16 domain;
 	unsigned int bus;
 	unsigned int devfn;
 	int pos_cap_err;
@@ -66,22 +69,27 @@ static LIST_HEAD(pci_bus_ops_list);
 /* Protect einjected and pci_bus_ops_list */
 static DEFINE_SPINLOCK(inject_lock);
 
-static void aer_error_init(struct aer_error *err, unsigned int bus,
-			   unsigned int devfn, int pos_cap_err)
+static void aer_error_init(struct aer_error *err, u16 domain,
+			   unsigned int bus, unsigned int devfn,
+			   int pos_cap_err)
 {
 	INIT_LIST_HEAD(&err->list);
+	err->domain = domain;
 	err->bus = bus;
 	err->devfn = devfn;
 	err->pos_cap_err = pos_cap_err;
 }
 
 /* inject_lock must be held before calling */
-static struct aer_error *__find_aer_error(unsigned int bus, unsigned int devfn)
+static struct aer_error *__find_aer_error(u16 domain, unsigned int bus,
+					  unsigned int devfn)
 {
 	struct aer_error *err;
 
 	list_for_each_entry(err, &einjected, list) {
-		if (bus == err->bus && devfn == err->devfn)
+		if (domain == err->domain &&
+		    bus == err->bus &&
+		    devfn == err->devfn)
 			return err;
 	}
 	return NULL;
@@ -90,7 +98,10 @@ static struct aer_error *__find_aer_error(unsigned int bus, unsigned int devfn)
 /* inject_lock must be held before calling */
 static struct aer_error *__find_aer_error_by_dev(struct pci_dev *dev)
 {
-	return __find_aer_error(dev->bus->number, dev->devfn);
+	int domain = pci_domain_nr(dev->bus);
+	if (domain < 0)
+		return NULL;
+	return __find_aer_error((u16)domain, dev->bus->number, dev->devfn);
 }
 
 /* inject_lock must be held before calling */
@@ -172,11 +183,15 @@ static int pci_read_aer(struct pci_bus *bus, unsigned int devfn, int where,
 	struct aer_error *err;
 	unsigned long flags;
 	struct pci_ops *ops;
+	int domain;
 
 	spin_lock_irqsave(&inject_lock, flags);
 	if (size != sizeof(u32))
 		goto out;
-	err = __find_aer_error(bus->number, devfn);
+	domain = pci_domain_nr(bus);
+	if (domain < 0)
+		goto out;
+	err = __find_aer_error((u16)domain, bus->number, devfn);
 	if (!err)
 		goto out;
 
@@ -200,11 +215,15 @@ int pci_write_aer(struct pci_bus *bus, unsigned int devfn, int where, int size,
 	unsigned long flags;
 	int rw1cs;
 	struct pci_ops *ops;
+	int domain;
 
 	spin_lock_irqsave(&inject_lock, flags);
 	if (size != sizeof(u32))
 		goto out;
-	err = __find_aer_error(bus->number, devfn);
+	domain = pci_domain_nr(bus);
+	if (domain < 0)
+		goto out;
+	err = __find_aer_error((u16)domain, bus->number, devfn);
 	if (!err)
 		goto out;
 
@@ -262,7 +281,7 @@ out:
 static struct pci_dev *pcie_find_root_port(struct pci_dev *dev)
 {
 	while (1) {
-		if (!dev->is_pcie)
+		if (!pci_is_pcie(dev))
 			break;
 		if (dev->pcie_type == PCI_EXP_TYPE_ROOT_PORT)
 			return dev;
@@ -302,28 +321,28 @@ static int aer_inject(struct aer_error_inj *einj)
 	unsigned long flags;
 	unsigned int devfn = PCI_DEVFN(einj->dev, einj->fn);
 	int pos_cap_err, rp_pos_cap_err;
-	u32 sever;
+	u32 sever, mask;
 	int ret = 0;
 
-	dev = pci_get_bus_and_slot(einj->bus, devfn);
+	dev = pci_get_domain_bus_and_slot((int)einj->domain, einj->bus, devfn);
 	if (!dev)
-		return -EINVAL;
+		return -ENODEV;
 	rpdev = pcie_find_root_port(dev);
 	if (!rpdev) {
-		ret = -EINVAL;
+		ret = -ENOTTY;
 		goto out_put;
 	}
 
 	pos_cap_err = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ERR);
 	if (!pos_cap_err) {
-		ret = -EIO;
+		ret = -ENOTTY;
 		goto out_put;
 	}
 	pci_read_config_dword(dev, pos_cap_err + PCI_ERR_UNCOR_SEVER, &sever);
 
 	rp_pos_cap_err = pci_find_ext_capability(rpdev, PCI_EXT_CAP_ID_ERR);
 	if (!rp_pos_cap_err) {
-		ret = -EIO;
+		ret = -ENOTTY;
 		goto out_put;
 	}
 
@@ -344,7 +363,8 @@ static int aer_inject(struct aer_error_inj *einj)
 	if (!err) {
 		err = err_alloc;
 		err_alloc = NULL;
-		aer_error_init(err, einj->bus, devfn, pos_cap_err);
+		aer_error_init(err, einj->domain, einj->bus, devfn,
+			       pos_cap_err);
 		list_add(&err->list, &einjected);
 	}
 	err->uncor_status |= einj->uncor_status;
@@ -354,11 +374,30 @@ static int aer_inject(struct aer_error_inj *einj)
 	err->header_log2 = einj->header_log2;
 	err->header_log3 = einj->header_log3;
 
+	pci_read_config_dword(dev, pos_cap_err + PCI_ERR_COR_MASK, &mask);
+	if (einj->cor_status && !(einj->cor_status & ~mask)) {
+		ret = -EINVAL;
+		printk(KERN_WARNING "The correctable error(s) is masked "
+				"by device\n");
+		spin_unlock_irqrestore(&inject_lock, flags);
+		goto out_put;
+	}
+
+	pci_read_config_dword(dev, pos_cap_err + PCI_ERR_UNCOR_MASK, &mask);
+	if (einj->uncor_status && !(einj->uncor_status & ~mask)) {
+		ret = -EINVAL;
+		printk(KERN_WARNING "The uncorrectable error(s) is masked "
+				"by device\n");
+		spin_unlock_irqrestore(&inject_lock, flags);
+		goto out_put;
+	}
+
 	rperr = __find_aer_error_by_dev(rpdev);
 	if (!rperr) {
 		rperr = rperr_alloc;
 		rperr_alloc = NULL;
-		aer_error_init(rperr, rpdev->bus->number, rpdev->devfn,
+		aer_error_init(rperr, pci_domain_nr(rpdev->bus),
+			       rpdev->bus->number, rpdev->devfn,
 			       rp_pos_cap_err);
 		list_add(&rperr->list, &einjected);
 	}
@@ -392,8 +431,14 @@ static int aer_inject(struct aer_error_inj *einj)
 	if (ret)
 		goto out_put;
 
-	if (find_aer_device(rpdev, &edev))
+	if (find_aer_device(rpdev, &edev)) {
+		if (!get_service_data(edev)) {
+			printk(KERN_WARNING "AER service is not initialized\n");
+			ret = -EINVAL;
+			goto out_put;
+		}
 		aer_irq(-1, edev);
+	}
 	else
 		ret = -EINVAL;
 out_put:
@@ -411,10 +456,11 @@ static ssize_t aer_inject_write(struct file *filp, const char __user *ubuf,
 
 	if (!capable(CAP_SYS_ADMIN))
 		return -EPERM;
-
-	if (usize != sizeof(struct aer_error_inj))
+	if (usize < offsetof(struct aer_error_inj, domain) ||
+	    usize > sizeof(einj))
 		return -EINVAL;
 
+	memset(&einj, 0, sizeof(einj));
 	if (copy_from_user(&einj, ubuf, usize))
 		return -EFAULT;
 
@@ -452,7 +498,7 @@ static void __exit aer_inject_exit(void)
 	}
 
 	spin_lock_irqsave(&inject_lock, flags);
-	list_for_each_entry_safe(err, err_next, &pci_bus_ops_list, list) {
+	list_for_each_entry_safe(err, err_next, &einjected, list) {
 		list_del(&err->list);
 		kfree(err);
 	}
@@ -462,5 +508,5 @@ static void __exit aer_inject_exit(void)
 module_init(aer_inject_init);
 module_exit(aer_inject_exit);
 
-MODULE_DESCRIPTION("PCIE AER software error injector");
+MODULE_DESCRIPTION("PCIe AER software error injector");
 MODULE_LICENSE("GPL");
diff --git a/drivers/pci/pcie/aer/aerdrv.c b/drivers/pci/pcie/aer/aerdrv.c
index 40c3cc5d1caf..21f215f4daa3 100644
--- a/drivers/pci/pcie/aer/aerdrv.c
+++ b/drivers/pci/pcie/aer/aerdrv.c
@@ -53,7 +53,7 @@ static struct pci_error_handlers aer_error_handlers = {
 
 static struct pcie_port_service_driver aerdriver = {
 	.name		= "aer",
-	.port_type	= PCIE_RC_PORT,
+	.port_type	= PCI_EXP_TYPE_ROOT_PORT,
 	.service	= PCIE_PORT_SERVICE_AER,
 
 	.probe		= aer_probe,
@@ -155,7 +155,7 @@ static struct aer_rpc *aer_alloc_rpc(struct pcie_device *dev)
 	mutex_init(&rpc->rpc_mutex);
 	init_waitqueue_head(&rpc->wait_release);
 
-	/* Use PCIE bus function to store rpc into PCIE device */
+	/* Use PCIe bus function to store rpc into PCIe device */
 	set_service_data(dev, rpc);
 
 	return rpc;
@@ -295,7 +295,7 @@ static void aer_error_resume(struct pci_dev *dev)
 	u16 reg16;
 
 	/* Clean up Root device status */
-	pos = pci_find_capability(dev, PCI_CAP_ID_EXP);
+	pos = pci_pcie_cap(dev);
 	pci_read_config_word(dev, pos + PCI_EXP_DEVSTA, &reg16);
 	pci_write_config_word(dev, pos + PCI_EXP_DEVSTA, reg16);
 
diff --git a/drivers/pci/pcie/aer/aerdrv_acpi.c b/drivers/pci/pcie/aer/aerdrv_acpi.c
index 8edb2f300e8f..04814087658d 100644
--- a/drivers/pci/pcie/aer/aerdrv_acpi.c
+++ b/drivers/pci/pcie/aer/aerdrv_acpi.c
@@ -24,7 +24,7 @@
  *
  * @return: Zero on success. Nonzero otherwise.
  *
- * Invoked when PCIE bus loads AER service driver. To avoid conflict with
+ * Invoked when PCIe bus loads AER service driver. To avoid conflict with
  * BIOS AER support requires BIOS to yield AER control to OS native driver.
  **/
 int aer_osc_setup(struct pcie_device *pciedev)
diff --git a/drivers/pci/pcie/aer/aerdrv_core.c b/drivers/pci/pcie/aer/aerdrv_core.c
index 9f5ccbeb4fa5..c843a799814d 100644
--- a/drivers/pci/pcie/aer/aerdrv_core.c
+++ b/drivers/pci/pcie/aer/aerdrv_core.c
@@ -35,11 +35,14 @@ int pci_enable_pcie_error_reporting(struct pci_dev *dev)
 	u16 reg16 = 0;
 	int pos;
 
+	if (dev->aer_firmware_first)
+		return -EIO;
+
 	pos = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ERR);
 	if (!pos)
 		return -EIO;
 
-	pos = pci_find_capability(dev, PCI_CAP_ID_EXP);
+	pos = pci_pcie_cap(dev);
 	if (!pos)
 		return -EIO;
 
@@ -60,7 +63,10 @@ int pci_disable_pcie_error_reporting(struct pci_dev *dev)
 	u16 reg16 = 0;
 	int pos;
 
-	pos = pci_find_capability(dev, PCI_CAP_ID_EXP);
+	if (dev->aer_firmware_first)
+		return -EIO;
+
+	pos = pci_pcie_cap(dev);
 	if (!pos)
 		return -EIO;
 
@@ -78,48 +84,27 @@ EXPORT_SYMBOL_GPL(pci_disable_pcie_error_reporting);
 int pci_cleanup_aer_uncorrect_error_status(struct pci_dev *dev)
 {
 	int pos;
-	u32 status, mask;
+	u32 status;
 
 	pos = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ERR);
 	if (!pos)
 		return -EIO;
 
 	pci_read_config_dword(dev, pos + PCI_ERR_UNCOR_STATUS, &status);
-	pci_read_config_dword(dev, pos + PCI_ERR_UNCOR_SEVER, &mask);
-	if (dev->error_state == pci_channel_io_normal)
-		status &= ~mask; /* Clear corresponding nonfatal bits */
-	else
-		status &= mask; /* Clear corresponding fatal bits */
-	pci_write_config_dword(dev, pos + PCI_ERR_UNCOR_STATUS, status);
+	if (status)
+		pci_write_config_dword(dev, pos + PCI_ERR_UNCOR_STATUS, status);
 
 	return 0;
 }
 EXPORT_SYMBOL_GPL(pci_cleanup_aer_uncorrect_error_status);
 
-#if 0
-int pci_cleanup_aer_correct_error_status(struct pci_dev *dev)
-{
-	int pos;
-	u32 status;
-
-	pos = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ERR);
-	if (!pos)
-		return -EIO;
-
-	pci_read_config_dword(dev, pos + PCI_ERR_COR_STATUS, &status);
-	pci_write_config_dword(dev, pos + PCI_ERR_COR_STATUS, status);
-
-	return 0;
-}
-#endif  /*  0  */
-
 static int set_device_error_reporting(struct pci_dev *dev, void *data)
 {
 	bool enable = *((bool *)data);
 
-	if (dev->pcie_type == PCIE_RC_PORT ||
-	    dev->pcie_type == PCIE_SW_UPSTREAM_PORT ||
-	    dev->pcie_type == PCIE_SW_DOWNSTREAM_PORT) {
+	if ((dev->pcie_type == PCI_EXP_TYPE_ROOT_PORT) ||
+	    (dev->pcie_type == PCI_EXP_TYPE_UPSTREAM) ||
+	    (dev->pcie_type == PCI_EXP_TYPE_DOWNSTREAM)) {
 		if (enable)
 			pci_enable_pcie_error_reporting(dev);
 		else
@@ -218,7 +203,7 @@ static int find_device_iter(struct pci_dev *dev, void *data)
 	 */
 	if (atomic_read(&dev->enable_cnt) == 0)
 		return 0;
-	pos = pci_find_capability(dev, PCI_CAP_ID_EXP);
+	pos = pci_pcie_cap(dev);
 	if (!pos)
 		return 0;
 	/* Check if AER is enabled */
@@ -431,10 +416,9 @@ static int find_aer_service_iter(struct device *device, void *data)
 	result = (struct find_aer_service_data *) data;
 
 	if (device->bus == &pcie_port_bus_type) {
-		struct pcie_port_data *port_data;
+		struct pcie_device *pcie = to_pcie_device(device);
 
-		port_data = pci_get_drvdata(to_pcie_device(device)->port);
-		if (port_data->port_type == PCIE_SW_DOWNSTREAM_PORT)
+		if (pcie->port->pcie_type == PCI_EXP_TYPE_DOWNSTREAM)
 			result->is_downstream = 1;
 
 		driver = device->driver;
@@ -603,7 +587,7 @@ static void handle_error_source(struct pcie_device *aerdev,
  * aer_enable_rootport - enable Root Port's interrupts when receiving messages
  * @rpc: pointer to a Root Port data structure
  *
- * Invoked when PCIE bus loads AER service driver.
+ * Invoked when PCIe bus loads AER service driver.
  */
 void aer_enable_rootport(struct aer_rpc *rpc)
 {
@@ -612,8 +596,8 @@ void aer_enable_rootport(struct aer_rpc *rpc)
 	u16 reg16;
 	u32 reg32;
 
-	pos = pci_find_capability(pdev, PCI_CAP_ID_EXP);
-	/* Clear PCIE Capability's Device Status */
+	pos = pci_pcie_cap(pdev);
+	/* Clear PCIe Capability's Device Status */
 	pci_read_config_word(pdev, pos+PCI_EXP_DEVSTA, &reg16);
 	pci_write_config_word(pdev, pos+PCI_EXP_DEVSTA, reg16);
 
@@ -647,7 +631,7 @@ void aer_enable_rootport(struct aer_rpc *rpc)
  * disable_root_aer - disable Root Port's interrupts when receiving messages
  * @rpc: pointer to a Root Port data structure
  *
- * Invoked when PCIE bus unloads AER service driver.
+ * Invoked when PCIe bus unloads AER service driver.
  */
 static void disable_root_aer(struct aer_rpc *rpc)
 {
@@ -874,8 +858,22 @@ void aer_delete_rootport(struct aer_rpc *rpc)
  */
 int aer_init(struct pcie_device *dev)
 {
-	if (aer_osc_setup(dev) && !forceload)
-		return -ENXIO;
+	if (dev->port->aer_firmware_first) {
+		dev_printk(KERN_DEBUG, &dev->device,
+			   "PCIe errors handled by platform firmware.\n");
+		goto out;
+	}
+
+	if (aer_osc_setup(dev))
+		goto out;
 
 	return 0;
+out:
+	if (forceload) {
+		dev_printk(KERN_DEBUG, &dev->device,
+			   "aerdrv forceload requested.\n");
+		dev->port->aer_firmware_first = 0;
+		return 0;
+	}
+	return -ENXIO;
 }
diff --git a/drivers/pci/pcie/aer/aerdrv_errprint.c b/drivers/pci/pcie/aer/aerdrv_errprint.c
index 44acde72294f..9d3e4c8d0184 100644
--- a/drivers/pci/pcie/aer/aerdrv_errprint.c
+++ b/drivers/pci/pcie/aer/aerdrv_errprint.c
@@ -184,7 +184,7 @@ void aer_print_error(struct pci_dev *dev, struct aer_err_info *info)
 
 	if (info->status == 0) {
 		AER_PR(info, dev,
-			"PCIE Bus Error: severity=%s, type=Unaccessible, "
+			"PCIe Bus Error: severity=%s, type=Unaccessible, "
 			"id=%04x(Unregistered Agent ID)\n",
 			aer_error_severity_string[info->severity], id);
 	} else {
@@ -194,7 +194,7 @@ void aer_print_error(struct pci_dev *dev, struct aer_err_info *info)
 		agent = AER_GET_AGENT(info->severity, info->status);
 
 		AER_PR(info, dev,
-			"PCIE Bus Error: severity=%s, type=%s, id=%04x(%s)\n",
+			"PCIe Bus Error: severity=%s, type=%s, id=%04x(%s)\n",
 			aer_error_severity_string[info->severity],
 			aer_error_layer[layer], id, aer_agent_string[agent]);
 
diff --git a/drivers/pci/pcie/aer/ecrc.c b/drivers/pci/pcie/aer/ecrc.c
index a928d8ab6bda..a2747a663bc9 100644
--- a/drivers/pci/pcie/aer/ecrc.c
+++ b/drivers/pci/pcie/aer/ecrc.c
@@ -51,7 +51,7 @@ static int enable_ecrc_checking(struct pci_dev *dev)
 	int pos;
 	u32 reg32;
 
-	if (!dev->is_pcie)
+	if (!pci_is_pcie(dev))
 		return -ENODEV;
 
 	pos = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ERR);
@@ -79,7 +79,7 @@ static int disable_ecrc_checking(struct pci_dev *dev)
 	int pos;
 	u32 reg32;
 
-	if (!dev->is_pcie)
+	if (!pci_is_pcie(dev))
 		return -ENODEV;
 
 	pos = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ERR);
diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
index 5b7056cec00c..be53d98fa384 100644
--- a/drivers/pci/pcie/aspm.c
+++ b/drivers/pci/pcie/aspm.c
@@ -1,6 +1,6 @@
 /*
  * File:	drivers/pci/pcie/aspm.c
- * Enabling PCIE link L0s/L1 state and Clock Power Management
+ * Enabling PCIe link L0s/L1 state and Clock Power Management
  *
  * Copyright (C) 2007 Intel
  * Copyright (C) Zhang Yanmin (yanmin.zhang@intel.com)
@@ -122,7 +122,7 @@ static void pcie_set_clkpm_nocheck(struct pcie_link_state *link, int enable)
 	struct pci_bus *linkbus = link->pdev->subordinate;
 
 	list_for_each_entry(child, &linkbus->devices, bus_list) {
-		pos = pci_find_capability(child, PCI_CAP_ID_EXP);
+		pos = pci_pcie_cap(child);
 		if (!pos)
 			return;
 		pci_read_config_word(child, pos + PCI_EXP_LNKCTL, &reg16);
@@ -156,7 +156,7 @@ static void pcie_clkpm_cap_init(struct pcie_link_state *link, int blacklist)
 
 	/* All functions should have the same cap and state, take the worst */
 	list_for_each_entry(child, &linkbus->devices, bus_list) {
-		pos = pci_find_capability(child, PCI_CAP_ID_EXP);
+		pos = pci_pcie_cap(child);
 		if (!pos)
 			return;
 		pci_read_config_dword(child, pos + PCI_EXP_LNKCAP, &reg32);
@@ -191,23 +191,23 @@ static void pcie_aspm_configure_common_clock(struct pcie_link_state *link)
 	 * Configuration, so just check one function
 	 */
 	child = list_entry(linkbus->devices.next, struct pci_dev, bus_list);
-	BUG_ON(!child->is_pcie);
+	BUG_ON(!pci_is_pcie(child));
 
 	/* Check downstream component if bit Slot Clock Configuration is 1 */
-	cpos = pci_find_capability(child, PCI_CAP_ID_EXP);
+	cpos = pci_pcie_cap(child);
 	pci_read_config_word(child, cpos + PCI_EXP_LNKSTA, &reg16);
 	if (!(reg16 & PCI_EXP_LNKSTA_SLC))
 		same_clock = 0;
 
 	/* Check upstream component if bit Slot Clock Configuration is 1 */
-	ppos = pci_find_capability(parent, PCI_CAP_ID_EXP);
+	ppos = pci_pcie_cap(parent);
 	pci_read_config_word(parent, ppos + PCI_EXP_LNKSTA, &reg16);
 	if (!(reg16 & PCI_EXP_LNKSTA_SLC))
 		same_clock = 0;
 
 	/* Configure downstream component, all functions */
 	list_for_each_entry(child, &linkbus->devices, bus_list) {
-		cpos = pci_find_capability(child, PCI_CAP_ID_EXP);
+		cpos = pci_pcie_cap(child);
 		pci_read_config_word(child, cpos + PCI_EXP_LNKCTL, &reg16);
 		child_reg[PCI_FUNC(child->devfn)] = reg16;
 		if (same_clock)
@@ -247,7 +247,7 @@ static void pcie_aspm_configure_common_clock(struct pcie_link_state *link)
 	dev_printk(KERN_ERR, &parent->dev,
 		   "ASPM: Could not configure common clock\n");
 	list_for_each_entry(child, &linkbus->devices, bus_list) {
-		cpos = pci_find_capability(child, PCI_CAP_ID_EXP);
+		cpos = pci_pcie_cap(child);
 		pci_write_config_word(child, cpos + PCI_EXP_LNKCTL,
 				      child_reg[PCI_FUNC(child->devfn)]);
 	}
@@ -300,7 +300,7 @@ static void pcie_get_aspm_reg(struct pci_dev *pdev,
 	u16 reg16;
 	u32 reg32;
 
-	pos = pci_find_capability(pdev, PCI_CAP_ID_EXP);
+	pos = pci_pcie_cap(pdev);
 	pci_read_config_dword(pdev, pos + PCI_EXP_LNKCAP, &reg32);
 	info->support = (reg32 & PCI_EXP_LNKCAP_ASPMS) >> 10;
 	info->latency_encoding_l0s = (reg32 & PCI_EXP_LNKCAP_L0SEL) >> 12;
@@ -420,7 +420,7 @@ static void pcie_aspm_cap_init(struct pcie_link_state *link, int blacklist)
 		    child->pcie_type != PCI_EXP_TYPE_LEG_END)
 			continue;
 
-		pos = pci_find_capability(child, PCI_CAP_ID_EXP);
+		pos = pci_pcie_cap(child);
 		pci_read_config_dword(child, pos + PCI_EXP_DEVCAP, &reg32);
 		/* Calculate endpoint L0s acceptable latency */
 		encoding = (reg32 & PCI_EXP_DEVCAP_L0S) >> 6;
@@ -436,7 +436,7 @@ static void pcie_aspm_cap_init(struct pcie_link_state *link, int blacklist)
 static void pcie_config_aspm_dev(struct pci_dev *pdev, u32 val)
 {
 	u16 reg16;
-	int pos = pci_find_capability(pdev, PCI_CAP_ID_EXP);
+	int pos = pci_pcie_cap(pdev);
 
 	pci_read_config_word(pdev, pos + PCI_EXP_LNKCTL, &reg16);
 	reg16 &= ~0x3;
@@ -499,11 +499,11 @@ static int pcie_aspm_sanity_check(struct pci_dev *pdev)
 	int pos;
 	u32 reg32;
 	/*
-	 * Some functions in a slot might not all be PCIE functions,
+	 * Some functions in a slot might not all be PCIe functions,
 	 * very strange. Disable ASPM for the whole slot
 	 */
 	list_for_each_entry(child, &pdev->subordinate->devices, bus_list) {
-		pos = pci_find_capability(child, PCI_CAP_ID_EXP);
+		pos = pci_pcie_cap(child);
 		if (!pos)
 			return -EINVAL;
 		/*
@@ -563,7 +563,7 @@ void pcie_aspm_init_link_state(struct pci_dev *pdev)
 	struct pcie_link_state *link;
 	int blacklist = !!pcie_aspm_sanity_check(pdev);
 
-	if (aspm_disabled || !pdev->is_pcie || pdev->link_state)
+	if (aspm_disabled || !pci_is_pcie(pdev) || pdev->link_state)
 		return;
 	if (pdev->pcie_type != PCI_EXP_TYPE_ROOT_PORT &&
 	    pdev->pcie_type != PCI_EXP_TYPE_DOWNSTREAM)
@@ -629,7 +629,8 @@ void pcie_aspm_exit_link_state(struct pci_dev *pdev)
 	struct pci_dev *parent = pdev->bus->self;
 	struct pcie_link_state *link, *root, *parent_link;
 
-	if (aspm_disabled || !pdev->is_pcie || !parent || !parent->link_state)
+	if (aspm_disabled || !pci_is_pcie(pdev) ||
+	    !parent || !parent->link_state)
 		return;
 	if ((parent->pcie_type != PCI_EXP_TYPE_ROOT_PORT) &&
 	    (parent->pcie_type != PCI_EXP_TYPE_DOWNSTREAM))
@@ -670,7 +671,7 @@ void pcie_aspm_pm_state_change(struct pci_dev *pdev)
 {
 	struct pcie_link_state *link = pdev->link_state;
 
-	if (aspm_disabled || !pdev->is_pcie || !link)
+	if (aspm_disabled || !pci_is_pcie(pdev) || !link)
 		return;
 	if ((pdev->pcie_type != PCI_EXP_TYPE_ROOT_PORT) &&
 	    (pdev->pcie_type != PCI_EXP_TYPE_DOWNSTREAM))
@@ -696,7 +697,7 @@ void pci_disable_link_state(struct pci_dev *pdev, int state)
 	struct pci_dev *parent = pdev->bus->self;
 	struct pcie_link_state *link;
 
-	if (aspm_disabled || !pdev->is_pcie)
+	if (aspm_disabled || !pci_is_pcie(pdev))
 		return;
 	if (pdev->pcie_type == PCI_EXP_TYPE_ROOT_PORT ||
 	    pdev->pcie_type == PCI_EXP_TYPE_DOWNSTREAM)
@@ -841,8 +842,9 @@ void pcie_aspm_create_sysfs_dev_files(struct pci_dev *pdev)
 {
 	struct pcie_link_state *link_state = pdev->link_state;
 
-	if (!pdev->is_pcie || (pdev->pcie_type != PCI_EXP_TYPE_ROOT_PORT &&
-		pdev->pcie_type != PCI_EXP_TYPE_DOWNSTREAM) || !link_state)
+	if (!pci_is_pcie(pdev) ||
+	    (pdev->pcie_type != PCI_EXP_TYPE_ROOT_PORT &&
+	     pdev->pcie_type != PCI_EXP_TYPE_DOWNSTREAM) || !link_state)
 		return;
 
 	if (link_state->aspm_support)
@@ -857,8 +859,9 @@ void pcie_aspm_remove_sysfs_dev_files(struct pci_dev *pdev)
 {
 	struct pcie_link_state *link_state = pdev->link_state;
 
-	if (!pdev->is_pcie || (pdev->pcie_type != PCI_EXP_TYPE_ROOT_PORT &&
-		pdev->pcie_type != PCI_EXP_TYPE_DOWNSTREAM) || !link_state)
+	if (!pci_is_pcie(pdev) ||
+	    (pdev->pcie_type != PCI_EXP_TYPE_ROOT_PORT &&
+	     pdev->pcie_type != PCI_EXP_TYPE_DOWNSTREAM) || !link_state)
 		return;
 
 	if (link_state->aspm_support)
diff --git a/drivers/pci/pcie/portdrv.h b/drivers/pci/pcie/portdrv.h
index 17ad53868f9f..aaeb9d21cba5 100644
--- a/drivers/pci/pcie/portdrv.h
+++ b/drivers/pci/pcie/portdrv.h
@@ -11,31 +11,16 @@
 
 #include <linux/compiler.h>
 
-#if !defined(PCI_CAP_ID_PME)
-#define PCI_CAP_ID_PME			1
-#endif
-
-#if !defined(PCI_CAP_ID_EXP)
-#define PCI_CAP_ID_EXP			0x10
-#endif
-
-#define PORT_TYPE_MASK			0xf
-#define PORT_TO_SLOT_MASK		0x100
-#define SLOT_HP_CAPABLE_MASK		0x40
-#define PCIE_CAPABILITIES_REG		0x2
-#define PCIE_SLOT_CAPABILITIES_REG	0x14
-#define PCIE_PORT_DEVICE_MAXSERVICES	4
-#define PCIE_PORT_MSI_VECTOR_MASK	0x1f
+#define PCIE_PORT_DEVICE_MAXSERVICES   4
 /*
- * According to the PCI Express Base Specification 2.0, the indices of the MSI-X
- * table entires used by port services must not exceed 31
+ * According to the PCI Express Base Specification 2.0, the indices of
+ * the MSI-X table entires used by port services must not exceed 31
  */
 #define PCIE_PORT_MAX_MSIX_ENTRIES	32
 
 #define get_descriptor_id(type, service) (((type - 4) << 4) | service)
 
 extern struct bus_type pcie_port_bus_type;
-extern int pcie_port_device_probe(struct pci_dev *dev);
 extern int pcie_port_device_register(struct pci_dev *dev);
 #ifdef CONFIG_PM
 extern int pcie_port_device_suspend(struct device *dev);
diff --git a/drivers/pci/pcie/portdrv_bus.c b/drivers/pci/pcie/portdrv_bus.c
index ef3a4eeaebb4..18bf90f748f6 100644
--- a/drivers/pci/pcie/portdrv_bus.c
+++ b/drivers/pci/pcie/portdrv_bus.c
@@ -26,7 +26,6 @@ EXPORT_SYMBOL_GPL(pcie_port_bus_type);
 static int pcie_port_bus_match(struct device *dev, struct device_driver *drv)
 {
 	struct pcie_device *pciedev;
-	struct pcie_port_data *port_data;
 	struct pcie_port_service_driver *driver;
 
 	if (drv->bus != &pcie_port_bus_type || dev->bus != &pcie_port_bus_type)
@@ -38,10 +37,8 @@ static int pcie_port_bus_match(struct device *dev, struct device_driver *drv)
 	if (driver->service != pciedev->service)
 		return 0;
 
-	port_data = pci_get_drvdata(pciedev->port);
-
-	if (driver->port_type != PCIE_ANY_PORT
-	     && driver->port_type != port_data->port_type)
+	if ((driver->port_type != PCIE_ANY_PORT) &&
+	    (driver->port_type != pciedev->port->pcie_type))
 		return 0;
 
 	return 1;
diff --git a/drivers/pci/pcie/portdrv_core.c b/drivers/pci/pcie/portdrv_core.c
index 52f84fca9f7d..b174188ac121 100644
--- a/drivers/pci/pcie/portdrv_core.c
+++ b/drivers/pci/pcie/portdrv_core.c
@@ -27,7 +27,7 @@
  */
 static void release_pcie_device(struct device *dev)
 {
-	kfree(to_pcie_device(dev));			
+	kfree(to_pcie_device(dev));
 }
 
 /**
@@ -108,9 +108,9 @@ static int pcie_port_enable_msix(struct pci_dev *dev, int *vectors, int mask)
 		 * the value in this field indicates which MSI-X Table entry is
 		 * used to generate the interrupt message."
 		 */
-		pos = pci_find_capability(dev, PCI_CAP_ID_EXP);
-		pci_read_config_word(dev, pos + PCIE_CAPABILITIES_REG, &reg16);
-		entry = (reg16 >> 9) & PCIE_PORT_MSI_VECTOR_MASK;
+		pos = pci_pcie_cap(dev);
+		pci_read_config_word(dev, pos + PCI_EXP_FLAGS, &reg16);
+		entry = (reg16 & PCI_EXP_FLAGS_IRQ) >> 9;
 		if (entry >= nr_entries)
 			goto Error;
 
@@ -177,37 +177,40 @@ static int pcie_port_enable_msix(struct pci_dev *dev, int *vectors, int mask)
 }
 
 /**
- * assign_interrupt_mode - choose interrupt mode for PCI Express port services
- *                         (INTx, MSI-X, MSI) and set up vectors
+ * init_service_irqs - initialize irqs for PCI Express port services
  * @dev: PCI Express port to handle
- * @vectors: Array of interrupt vectors to populate
+ * @irqs: Array of irqs to populate
  * @mask: Bitmask of port capabilities returned by get_port_device_capability()
  *
  * Return value: Interrupt mode associated with the port
  */
-static int assign_interrupt_mode(struct pci_dev *dev, int *vectors, int mask)
+static int init_service_irqs(struct pci_dev *dev, int *irqs, int mask)
 {
-	int irq, interrupt_mode = PCIE_PORT_NO_IRQ;
-	int i;
+	int i, irq;
 
 	/* Try to use MSI-X if supported */
-	if (!pcie_port_enable_msix(dev, vectors, mask))
-		return PCIE_PORT_MSIX_MODE;
-
+	if (!pcie_port_enable_msix(dev, irqs, mask))
+		return 0;
 	/* We're not going to use MSI-X, so try MSI and fall back to INTx */
-	if (!pci_enable_msi(dev))
-		interrupt_mode = PCIE_PORT_MSI_MODE;
-
-	if (interrupt_mode == PCIE_PORT_NO_IRQ && dev->pin)
-		interrupt_mode = PCIE_PORT_INTx_MODE;
+	irq = -1;
+	if (!pci_enable_msi(dev) || dev->pin)
+		irq = dev->irq;
 
-	irq = interrupt_mode != PCIE_PORT_NO_IRQ ? dev->irq : -1;
 	for (i = 0; i < PCIE_PORT_DEVICE_MAXSERVICES; i++)
-		vectors[i] = irq;
+		irqs[i] = irq;
+	irqs[PCIE_PORT_SERVICE_VC_SHIFT] = -1;
 
-	vectors[PCIE_PORT_SERVICE_VC_SHIFT] = -1;
+	if (irq < 0)
+		return -ENODEV;
+	return 0;
+}
 
-	return interrupt_mode;
+static void cleanup_service_irqs(struct pci_dev *dev)
+{
+	if (dev->msix_enabled)
+		pci_disable_msix(dev);
+	else if (dev->msi_enabled)
+		pci_disable_msi(dev);
 }
 
 /**
@@ -226,13 +229,12 @@ static int get_port_device_capability(struct pci_dev *dev)
 	u16 reg16;
 	u32 reg32;
 
-	pos = pci_find_capability(dev, PCI_CAP_ID_EXP);
-	pci_read_config_word(dev, pos + PCIE_CAPABILITIES_REG, &reg16);
+	pos = pci_pcie_cap(dev);
+	pci_read_config_word(dev, pos + PCI_EXP_FLAGS, &reg16);
 	/* Hot-Plug Capable */
-	if (reg16 & PORT_TO_SLOT_MASK) {
-		pci_read_config_dword(dev, 
-			pos + PCIE_SLOT_CAPABILITIES_REG, &reg32);
-		if (reg32 & SLOT_HP_CAPABLE_MASK)
+	if (reg16 & PCI_EXP_FLAGS_SLOT) {
+		pci_read_config_dword(dev, pos + PCI_EXP_SLTCAP, &reg32);
+		if (reg32 & PCI_EXP_SLTCAP_HPC)
 			services |= PCIE_PORT_SERVICE_HP;
 	}
 	/* AER capable */
@@ -241,80 +243,47 @@ static int get_port_device_capability(struct pci_dev *dev)
 	/* VC support */
 	if (pci_find_ext_capability(dev, PCI_EXT_CAP_ID_VC))
 		services |= PCIE_PORT_SERVICE_VC;
+	/* Root ports are capable of generating PME too */
+	if (dev->pcie_type == PCI_EXP_TYPE_ROOT_PORT)
+		services |= PCIE_PORT_SERVICE_PME;
 
 	return services;
 }
 
 /**
- * pcie_device_init - initialize PCI Express port service device
- * @dev: Port service device to initialize
- * @parent: PCI Express port to associate the service device with
- * @port_type: Type of the port
- * @service_type: Type of service to associate with the service device
+ * pcie_device_init - allocate and initialize PCI Express port service device
+ * @pdev: PCI Express port to associate the service device with
+ * @service: Type of service to associate with the service device
  * @irq: Interrupt vector to associate with the service device
  */
-static void pcie_device_init(struct pci_dev *parent, struct pcie_device *dev, 
-	int service_type, int irq)
+static int pcie_device_init(struct pci_dev *pdev, int service, int irq)
 {
-	struct pcie_port_data *port_data = pci_get_drvdata(parent);
+	int retval;
+	struct pcie_device *pcie;
 	struct device *device;
-	int port_type = port_data->port_type;
 
-	dev->port = parent;
-	dev->irq = irq;
-	dev->service = service_type;
+	pcie = kzalloc(sizeof(*pcie), GFP_KERNEL);
+	if (!pcie)
+		return -ENOMEM;
+	pcie->port = pdev;
+	pcie->irq = irq;
+	pcie->service = service;
 
 	/* Initialize generic device interface */
-	device = &dev->device;
-	memset(device, 0, sizeof(struct device));
+	device = &pcie->device;
 	device->bus = &pcie_port_bus_type;
-	device->driver = NULL;
-	dev_set_drvdata(device, NULL);
 	device->release = release_pcie_device;	/* callback to free pcie dev */
 	dev_set_name(device, "%s:pcie%02x",
-		 pci_name(parent), get_descriptor_id(port_type, service_type));
-	device->parent = &parent->dev;
-}
-
-/**
- * alloc_pcie_device - allocate PCI Express port service device structure
- * @parent: PCI Express port to associate the service device with
- * @port_type: Type of the port
- * @service_type: Type of service to associate with the service device
- * @irq: Interrupt vector to associate with the service device
- */
-static struct pcie_device* alloc_pcie_device(struct pci_dev *parent,
-	int service_type, int irq)
-{
-	struct pcie_device *device;
-
-	device = kzalloc(sizeof(struct pcie_device), GFP_KERNEL);
-	if (!device)
-		return NULL;
-
-	pcie_device_init(parent, device, service_type, irq);
-	return device;
-}
-
-/**
- * pcie_port_device_probe - check if device is a PCI Express port
- * @dev: Device to check
- */
-int pcie_port_device_probe(struct pci_dev *dev)
-{
-	int pos, type;
-	u16 reg;
-
-	if (!(pos = pci_find_capability(dev, PCI_CAP_ID_EXP)))
-		return -ENODEV;
-
-	pci_read_config_word(dev, pos + PCIE_CAPABILITIES_REG, &reg);
-	type = (reg >> 4) & PORT_TYPE_MASK;
-	if (	type == PCIE_RC_PORT || type == PCIE_SW_UPSTREAM_PORT ||
-		type == PCIE_SW_DOWNSTREAM_PORT )
-		return 0;
-
-	return -ENODEV;
+		     pci_name(pdev),
+		     get_descriptor_id(pdev->pcie_type, service));
+	device->parent = &pdev->dev;
+
+	retval = device_register(device);
+	if (retval)
+		kfree(pcie);
+	else
+		get_device(device);
+	return retval;
 }
 
 /**
@@ -326,77 +295,49 @@ int pcie_port_device_probe(struct pci_dev *dev)
  */
 int pcie_port_device_register(struct pci_dev *dev)
 {
-	struct pcie_port_data *port_data;
-	int status, capabilities, irq_mode, i, nr_serv;
-	int vectors[PCIE_PORT_DEVICE_MAXSERVICES];
-	u16 reg16;
-
-	port_data = kzalloc(sizeof(*port_data), GFP_KERNEL);
-	if (!port_data)
-		return -ENOMEM;
-	pci_set_drvdata(dev, port_data);
-
-	/* Get port type */
-	pci_read_config_word(dev,
-		pci_find_capability(dev, PCI_CAP_ID_EXP) +
-		PCIE_CAPABILITIES_REG, &reg16);
-	port_data->port_type = (reg16 >> 4) & PORT_TYPE_MASK;
+	int status, capabilities, i, nr_service;
+	int irqs[PCIE_PORT_DEVICE_MAXSERVICES];
 
+	/* Get and check PCI Express port services */
 	capabilities = get_port_device_capability(dev);
-	/* Root ports are capable of generating PME too */
-	if (port_data->port_type == PCIE_RC_PORT)
-		capabilities |= PCIE_PORT_SERVICE_PME;
-
-	irq_mode = assign_interrupt_mode(dev, vectors, capabilities);
-	if (irq_mode == PCIE_PORT_NO_IRQ) {
-		/*
-		 * Don't use service devices that require interrupts if there is
-		 * no way to generate them.
-		 */
-		if (!(capabilities & PCIE_PORT_SERVICE_VC)) {
-			status = -ENODEV;
-			goto Error;
-		}
-		capabilities = PCIE_PORT_SERVICE_VC;
-	}
-	port_data->port_irq_mode = irq_mode;
+	if (!capabilities)
+		return -ENODEV;
 
+	/* Enable PCI Express port device */
 	status = pci_enable_device(dev);
 	if (status)
-		goto Error;
+		return status;
 	pci_set_master(dev);
+	/*
+	 * Initialize service irqs. Don't use service devices that
+	 * require interrupts if there is no way to generate them.
+	 */
+	status = init_service_irqs(dev, irqs, capabilities);
+	if (status) {
+		capabilities &= PCIE_PORT_SERVICE_VC;
+		if (!capabilities)
+			goto error_disable;
+	}
 
 	/* Allocate child services if any */
-	for (i = 0, nr_serv = 0; i < PCIE_PORT_DEVICE_MAXSERVICES; i++) {
-		struct pcie_device *child;
+	status = -ENODEV;
+	nr_service = 0;
+	for (i = 0; i < PCIE_PORT_DEVICE_MAXSERVICES; i++) {
 		int service = 1 << i;
-
 		if (!(capabilities & service))
 			continue;
-
-		child = alloc_pcie_device(dev, service, vectors[i]);
-		if (!child)
-			continue;
-
-		status = device_register(&child->device);
-		if (status) {
-			kfree(child);
-			continue;
-		}
-
-		get_device(&child->device);
-		nr_serv++;
-	}
-	if (!nr_serv) {
-		pci_disable_device(dev);
-		status = -ENODEV;
-		goto Error;
+		if (!pcie_device_init(dev, service, irqs[i]))
+			nr_service++;
 	}
+	if (!nr_service)
+		goto error_cleanup_irqs;
 
 	return 0;
 
- Error:
-	kfree(port_data);
+error_cleanup_irqs:
+	cleanup_service_irqs(dev);
+error_disable:
+	pci_disable_device(dev);
 	return status;
 }
 
@@ -405,12 +346,11 @@ static int suspend_iter(struct device *dev, void *data)
 {
 	struct pcie_port_service_driver *service_driver;
 
- 	if ((dev->bus == &pcie_port_bus_type) &&
- 	    (dev->driver)) {
- 		service_driver = to_service_driver(dev->driver);
- 		if (service_driver->suspend)
- 			service_driver->suspend(to_pcie_device(dev));
-  	}
+	if ((dev->bus == &pcie_port_bus_type) && dev->driver) {
+		service_driver = to_service_driver(dev->driver);
+		if (service_driver->suspend)
+			service_driver->suspend(to_pcie_device(dev));
+	}
 	return 0;
 }
 
@@ -464,21 +404,9 @@ static int remove_iter(struct device *dev, void *data)
  */
 void pcie_port_device_remove(struct pci_dev *dev)
 {
-	struct pcie_port_data *port_data = pci_get_drvdata(dev);
-
 	device_for_each_child(&dev->dev, NULL, remove_iter);
+	cleanup_service_irqs(dev);
 	pci_disable_device(dev);
-
-	switch (port_data->port_irq_mode) {
-	case PCIE_PORT_MSIX_MODE:
-		pci_disable_msix(dev);
-		break;
-	case PCIE_PORT_MSI_MODE:
-		pci_disable_msi(dev);
-		break;
-	}
-
-	kfree(port_data);
 }
 
 /**
@@ -565,6 +493,7 @@ int pcie_port_service_register(struct pcie_port_service_driver *new)
 
 	return driver_register(&new->driver);
 }
+EXPORT_SYMBOL(pcie_port_service_register);
 
 /**
  * pcie_port_service_unregister - unregister PCI Express port service driver
@@ -574,6 +503,4 @@ void pcie_port_service_unregister(struct pcie_port_service_driver *drv)
 {
 	driver_unregister(&drv->driver);
 }
-
-EXPORT_SYMBOL(pcie_port_service_register);
 EXPORT_SYMBOL(pcie_port_service_unregister);
diff --git a/drivers/pci/pcie/portdrv_pci.c b/drivers/pci/pcie/portdrv_pci.c
index f635e476d632..13c8972886e6 100644
--- a/drivers/pci/pcie/portdrv_pci.c
+++ b/drivers/pci/pcie/portdrv_pci.c
@@ -24,7 +24,7 @@
  */
 #define DRIVER_VERSION "v1.0"
 #define DRIVER_AUTHOR "tom.l.nguyen@intel.com"
-#define DRIVER_DESC "PCIE Port Bus Driver"
+#define DRIVER_DESC "PCIe Port Bus Driver"
 MODULE_AUTHOR(DRIVER_AUTHOR);
 MODULE_DESCRIPTION(DRIVER_DESC);
 MODULE_LICENSE("GPL");
@@ -43,7 +43,7 @@ static int pcie_portdrv_restore_config(struct pci_dev *dev)
 }
 
 #ifdef CONFIG_PM
-static struct dev_pm_ops pcie_portdrv_pm_ops = {
+static const struct dev_pm_ops pcie_portdrv_pm_ops = {
 	.suspend	= pcie_port_device_suspend,
 	.resume		= pcie_port_device_resume,
 	.freeze		= pcie_port_device_suspend,
@@ -63,20 +63,22 @@ static struct dev_pm_ops pcie_portdrv_pm_ops = {
  * pcie_portdrv_probe - Probe PCI-Express port devices
  * @dev: PCI-Express port device being probed
  *
- * If detected invokes the pcie_port_device_register() method for 
+ * If detected invokes the pcie_port_device_register() method for
  * this port device.
  *
  */
-static int __devinit pcie_portdrv_probe (struct pci_dev *dev, 
-				const struct pci_device_id *id )
+static int __devinit pcie_portdrv_probe(struct pci_dev *dev,
+					const struct pci_device_id *id)
 {
-	int			status;
+	int status;
 
-	status = pcie_port_device_probe(dev);
-	if (status)
-		return status;
+	if (!pci_is_pcie(dev) ||
+	    ((dev->pcie_type != PCI_EXP_TYPE_ROOT_PORT) &&
+	     (dev->pcie_type != PCI_EXP_TYPE_UPSTREAM) &&
+	     (dev->pcie_type != PCI_EXP_TYPE_DOWNSTREAM)))
+		return -ENODEV;
 
-        if (!dev->irq && dev->pin) {
+	if (!dev->irq && dev->pin) {
 		dev_warn(&dev->dev, "device [%04x:%04x] has invalid IRQ; "
 			 "check vendor BIOS\n", dev->vendor, dev->device);
 	}
@@ -89,7 +91,7 @@ static int __devinit pcie_portdrv_probe (struct pci_dev *dev,
 	return 0;
 }
 
-static void pcie_portdrv_remove (struct pci_dev *dev)
+static void pcie_portdrv_remove(struct pci_dev *dev)
 {
 	pcie_port_device_remove(dev);
 	pci_disable_device(dev);
@@ -127,14 +129,13 @@ static int error_detected_iter(struct device *device, void *data)
 static pci_ers_result_t pcie_portdrv_error_detected(struct pci_dev *dev,
 					enum pci_channel_state error)
 {
-	struct aer_broadcast_data result_data =
-			{error, PCI_ERS_RESULT_CAN_RECOVER};
-	int retval;
+	struct aer_broadcast_data data = {error, PCI_ERS_RESULT_CAN_RECOVER};
+	int ret;
 
 	/* can not fail */
-	retval = device_for_each_child(&dev->dev, &result_data, error_detected_iter);
+	ret = device_for_each_child(&dev->dev, &data, error_detected_iter);
 
-	return result_data.result;
+	return data.result;
 }
 
 static int mmio_enabled_iter(struct device *device, void *data)
@@ -288,7 +289,7 @@ static int __init pcie_portdrv_init(void)
 	return retval;
 }
 
-static void __exit pcie_portdrv_exit(void) 
+static void __exit pcie_portdrv_exit(void)
 {
 	pci_unregister_driver(&pcie_portdriver);
 	pcie_port_bus_unregister();
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index 8105e32117f6..98ffb2de22e9 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -10,6 +10,7 @@
 #include <linux/module.h>
 #include <linux/cpumask.h>
 #include <linux/pci-aspm.h>
+#include <acpi/acpi_hest.h>
 #include "pci.h"
 
 #define CARDBUS_LATENCY_TIMER	176	/* secondary latency timer */
@@ -163,12 +164,12 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,
 {
 	u32 l, sz, mask;
 
-	mask = type ? ~PCI_ROM_ADDRESS_ENABLE : ~0;
+	mask = type ? PCI_ROM_ADDRESS_MASK : ~0;
 
 	res->name = pci_name(dev);
 
 	pci_read_config_dword(dev, pos, &l);
-	pci_write_config_dword(dev, pos, mask);
+	pci_write_config_dword(dev, pos, l | mask);
 	pci_read_config_dword(dev, pos, &sz);
 	pci_write_config_dword(dev, pos, l);
 
@@ -223,9 +224,13 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,
 			goto fail;
 
 		if ((sizeof(resource_size_t) < 8) && (sz64 > 0x100000000ULL)) {
-			dev_err(&dev->dev, "can't handle 64-bit BAR\n");
+			dev_err(&dev->dev, "reg %x: can't handle 64-bit BAR\n",
+				pos);
 			goto fail;
-		} else if ((sizeof(resource_size_t) < 8) && l) {
+		}
+
+		res->flags |= IORESOURCE_MEM_64;
+		if ((sizeof(resource_size_t) < 8) && l) {
 			/* Address above 32-bit boundary; disable the BAR */
 			pci_write_config_dword(dev, pos, 0);
 			pci_write_config_dword(dev, pos + 4, 0);
@@ -234,14 +239,9 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,
 		} else {
 			res->start = l64;
 			res->end = l64 + sz64;
-			dev_printk(KERN_DEBUG, &dev->dev,
-				"reg %x %s: %pR\n", pos,
-				 (res->flags & IORESOURCE_PREFETCH) ?
-					"64bit mmio pref" : "64bit mmio",
-				 res);
+			dev_printk(KERN_DEBUG, &dev->dev, "reg %x: %pR\n",
+				   pos, res);
 		}
-
-		res->flags |= IORESOURCE_MEM_64;
 	} else {
 		sz = pci_size(l, sz, mask);
 
@@ -251,11 +251,7 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,
 		res->start = l;
 		res->end = l + sz;
 
-		dev_printk(KERN_DEBUG, &dev->dev, "reg %x %s: %pR\n", pos,
-			(res->flags & IORESOURCE_IO) ? "io port" :
-			 ((res->flags & IORESOURCE_PREFETCH) ?
-				 "32bit mmio pref" : "32bit mmio"),
-			res);
+		dev_printk(KERN_DEBUG, &dev->dev, "reg %x: %pR\n", pos, res);
 	}
 
  out:
@@ -297,8 +293,11 @@ void __devinit pci_read_bridge_bases(struct pci_bus *child)
 	if (pci_is_root_bus(child))	/* It's a host bus, nothing to read */
 		return;
 
+	dev_info(&dev->dev, "PCI bridge to [bus %02x-%02x]%s\n",
+		 child->secondary, child->subordinate,
+		 dev->transparent ? " (subtractive decode)": "");
+
 	if (dev->transparent) {
-		dev_info(&dev->dev, "transparent bridge\n");
 		for(i = 3; i < PCI_BUS_NUM_RESOURCES; i++)
 			child->resource[i] = child->parent->resource[i - 3];
 	}
@@ -323,7 +322,7 @@ void __devinit pci_read_bridge_bases(struct pci_bus *child)
 			res->start = base;
 		if (!res->end)
 			res->end = limit + 0xfff;
-		dev_printk(KERN_DEBUG, &dev->dev, "bridge io port: %pR\n", res);
+		dev_printk(KERN_DEBUG, &dev->dev, "  bridge window %pR\n", res);
 	}
 
 	res = child->resource[1];
@@ -335,8 +334,7 @@ void __devinit pci_read_bridge_bases(struct pci_bus *child)
 		res->flags = (mem_base_lo & PCI_MEMORY_RANGE_TYPE_MASK) | IORESOURCE_MEM;
 		res->start = base;
 		res->end = limit + 0xfffff;
-		dev_printk(KERN_DEBUG, &dev->dev, "bridge 32bit mmio: %pR\n",
-			res);
+		dev_printk(KERN_DEBUG, &dev->dev, "  bridge window %pR\n", res);
 	}
 
 	res = child->resource[2];
@@ -375,9 +373,7 @@ void __devinit pci_read_bridge_bases(struct pci_bus *child)
 			res->flags |= IORESOURCE_MEM_64;
 		res->start = base;
 		res->end = limit + 0xfffff;
-		dev_printk(KERN_DEBUG, &dev->dev, "bridge %sbit mmio pref: %pR\n",
-			(res->flags & PCI_PREF_RANGE_TYPE_64) ? "64" : "32",
-			res);
+		dev_printk(KERN_DEBUG, &dev->dev, "  bridge window %pR\n", res);
 	}
 }
 
@@ -651,13 +647,14 @@ int __devinit pci_scan_bridge(struct pci_bus *bus, struct pci_dev *dev, int max,
 		    (child->number > bus->subordinate) ||
 		    (child->number < bus->number) ||
 		    (child->subordinate < bus->number)) {
-			pr_debug("PCI: Bus #%02x (-#%02x) is %s "
-				"hidden behind%s bridge #%02x (-#%02x)\n",
+			dev_info(&child->dev, "[bus %02x-%02x] %s "
+				"hidden behind%s bridge %s [bus %02x-%02x]\n",
 				child->number, child->subordinate,
 				(bus->number > child->subordinate &&
 				 bus->subordinate < child->number) ?
 					"wholly" : "partially",
 				bus->self->transparent ? " transparent" : "",
+				dev_name(&bus->dev),
 				bus->number, bus->subordinate);
 		}
 		bus = bus->parent;
@@ -693,6 +690,7 @@ static void set_pcie_port_type(struct pci_dev *pdev)
 	if (!pos)
 		return;
 	pdev->is_pcie = 1;
+	pdev->pcie_cap = pos;
 	pci_read_config_word(pdev, pos + PCI_EXP_FLAGS, &reg16);
 	pdev->pcie_type = (reg16 & PCI_EXP_FLAGS_TYPE) >> 4;
 }
@@ -703,7 +701,7 @@ static void set_pcie_hotplug_bridge(struct pci_dev *pdev)
 	u16 reg16;
 	u32 reg32;
 
-	pos = pci_find_capability(pdev, PCI_CAP_ID_EXP);
+	pos = pci_pcie_cap(pdev);
 	if (!pos)
 		return;
 	pci_read_config_word(pdev, pos + PCI_EXP_FLAGS, &reg16);
@@ -714,6 +712,12 @@ static void set_pcie_hotplug_bridge(struct pci_dev *pdev)
 		pdev->is_hotplug_bridge = 1;
 }
 
+static void set_pci_aer_firmware_first(struct pci_dev *pdev)
+{
+	if (acpi_hest_firmware_first_pci(pdev))
+		pdev->aer_firmware_first = 1;
+}
+
 #define LEGACY_IO_RESOURCE	(IORESOURCE_IO | IORESOURCE_PCI_FIXED)
 
 /**
@@ -731,6 +735,7 @@ int pci_setup_device(struct pci_dev *dev)
 	u32 class;
 	u8 hdr_type;
 	struct pci_slot *slot;
+	int pos = 0;
 
 	if (pci_read_config_byte(dev, PCI_HEADER_TYPE, &hdr_type))
 		return -EIO;
@@ -742,6 +747,7 @@ int pci_setup_device(struct pci_dev *dev)
 	dev->multifunction = !!(hdr_type & 0x80);
 	dev->error_state = pci_channel_io_normal;
 	set_pcie_port_type(dev);
+	set_pci_aer_firmware_first(dev);
 
 	list_for_each_entry(slot, &dev->bus->slots, list)
 		if (PCI_SLOT(dev->devfn) == slot->number)
@@ -822,6 +828,11 @@ int pci_setup_device(struct pci_dev *dev)
 		dev->transparent = ((dev->class & 0xff) == 1);
 		pci_read_bases(dev, 2, PCI_ROM_ADDRESS1);
 		set_pcie_hotplug_bridge(dev);
+		pos = pci_find_capability(dev, PCI_CAP_ID_SSVID);
+		if (pos) {
+			pci_read_config_word(dev, pos + PCI_SSVID_VENDOR_ID, &dev->subsystem_vendor);
+			pci_read_config_word(dev, pos + PCI_SSVID_DEVICE_ID, &dev->subsystem_device);
+		}
 		break;
 
 	case PCI_HEADER_TYPE_CARDBUS:		    /* CardBus bridge header */
@@ -907,7 +918,7 @@ int pci_cfg_space_size(struct pci_dev *dev)
 	if (class == PCI_CLASS_BRIDGE_HOST)
 		return pci_cfg_space_size_ext(dev);
 
-	pos = pci_find_capability(dev, PCI_CAP_ID_EXP);
+	pos = pci_pcie_cap(dev);
 	if (!pos) {
 		pos = pci_find_capability(dev, PCI_CAP_ID_PCIX);
 		if (!pos)
@@ -1014,6 +1025,9 @@ static void pci_init_capabilities(struct pci_dev *dev)
 
 	/* Single Root I/O Virtualization */
 	pci_iov_init(dev);
+
+	/* Enable ACS P2P upstream forwarding */
+	pci_enable_acs(dev);
 }
 
 void pci_device_add(struct pci_dev *dev, struct pci_bus *bus)
@@ -1110,7 +1124,7 @@ unsigned int __devinit pci_scan_child_bus(struct pci_bus *bus)
 	unsigned int devfn, pass, max = bus->secondary;
 	struct pci_dev *dev;
 
-	pr_debug("PCI: Scanning bus %04x:%02x\n", pci_domain_nr(bus), bus->number);
+	dev_dbg(&bus->dev, "scanning bus\n");
 
 	/* Go find them, Rover! */
 	for (devfn = 0; devfn < 0x100; devfn += 8)
@@ -1124,8 +1138,7 @@ unsigned int __devinit pci_scan_child_bus(struct pci_bus *bus)
 	 * all PCI-to-PCI bridges on this bus.
 	 */
 	if (!bus->is_added) {
-		pr_debug("PCI: Fixups for bus %04x:%02x\n",
-			 pci_domain_nr(bus), bus->number);
+		dev_dbg(&bus->dev, "fixups for bus\n");
 		pcibios_fixup_bus(bus);
 		if (pci_is_root_bus(bus))
 			bus->is_added = 1;
@@ -1145,8 +1158,7 @@ unsigned int __devinit pci_scan_child_bus(struct pci_bus *bus)
 	 *
 	 * Return how far we've got finding sub-buses.
 	 */
-	pr_debug("PCI: Bus scan for %04x:%02x returning with max=%02x\n",
-		pci_domain_nr(bus), bus->number, max);
+	dev_dbg(&bus->dev, "bus scan returning with max=%02x\n", max);
 	return max;
 }
 
@@ -1154,7 +1166,7 @@ struct pci_bus * pci_create_bus(struct device *parent,
 		int bus, struct pci_ops *ops, void *sysdata)
 {
 	int error;
-	struct pci_bus *b;
+	struct pci_bus *b, *b2;
 	struct device *dev;
 
 	b = pci_alloc_bus();
@@ -1170,9 +1182,10 @@ struct pci_bus * pci_create_bus(struct device *parent,
 	b->sysdata = sysdata;
 	b->ops = ops;
 
-	if (pci_find_bus(pci_domain_nr(b), bus)) {
+	b2 = pci_find_bus(pci_domain_nr(b), bus);
+	if (b2) {
 		/* If we already got to this bus through a different bridge, ignore it */
-		pr_debug("PCI: Bus %04x:%02x already known\n", pci_domain_nr(b), bus);
+		dev_dbg(&b2->dev, "bus already known\n");
 		goto err_out;
 	}
 
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 245d2cdb4765..c74694345b6e 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -357,7 +357,7 @@ static void __devinit quirk_io_region(struct pci_dev *dev, unsigned region,
 		pcibios_bus_to_resource(dev, res, &bus_region);
 
 		pci_claim_resource(dev, nr);
-		dev_info(&dev->dev, "quirk: region %04x-%04x claimed by %s\n", region, region + size - 1, name);
+		dev_info(&dev->dev, "quirk: %pR claimed by %s\n", res, name);
 	}
 }	
 
@@ -1680,6 +1680,7 @@ DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_SERVERWORKS,   PCI_DEVICE_ID_SERVERWORKS_
  */
 #define AMD_813X_MISC			0x40
 #define AMD_813X_NOIOAMODE		(1<<0)
+#define AMD_813X_REV_B1			0x12
 #define AMD_813X_REV_B2			0x13
 
 static void quirk_disable_amd_813x_boot_interrupt(struct pci_dev *dev)
@@ -1688,7 +1689,8 @@ static void quirk_disable_amd_813x_boot_interrupt(struct pci_dev *dev)
 
 	if (noioapicquirk)
 		return;
-	if (dev->revision == AMD_813X_REV_B2)
+	if ((dev->revision == AMD_813X_REV_B1) ||
+	    (dev->revision == AMD_813X_REV_B2))
 		return;
 
 	pci_read_config_dword(dev, AMD_813X_MISC, &pci_config_dword);
@@ -1698,8 +1700,10 @@ static void quirk_disable_amd_813x_boot_interrupt(struct pci_dev *dev)
 	dev_info(&dev->dev, "disabled boot interrupts on device [%04x:%04x]\n",
 		 dev->vendor, dev->device);
 }
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD,   PCI_DEVICE_ID_AMD_8131_BRIDGE, 	quirk_disable_amd_813x_boot_interrupt);
-DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_AMD,   PCI_DEVICE_ID_AMD_8132_BRIDGE, 	quirk_disable_amd_813x_boot_interrupt);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD,	PCI_DEVICE_ID_AMD_8131_BRIDGE,	quirk_disable_amd_813x_boot_interrupt);
+DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_AMD,	PCI_DEVICE_ID_AMD_8131_BRIDGE,	quirk_disable_amd_813x_boot_interrupt);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD,	PCI_DEVICE_ID_AMD_8132_BRIDGE,	quirk_disable_amd_813x_boot_interrupt);
+DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_AMD,	PCI_DEVICE_ID_AMD_8132_BRIDGE,	quirk_disable_amd_813x_boot_interrupt);
 
 #define AMD_8111_PCI_IRQ_ROUTING	0x56
 
@@ -2595,16 +2599,116 @@ void pci_fixup_device(enum pci_fixup_pass pass, struct pci_dev *dev)
 static int __init pci_apply_final_quirks(void)
 {
 	struct pci_dev *dev = NULL;
+	u8 cls = 0;
+	u8 tmp;
+
+	if (pci_cache_line_size)
+		printk(KERN_DEBUG "PCI: CLS %u bytes\n",
+		       pci_cache_line_size << 2);
 
 	while ((dev = pci_get_device(PCI_ANY_ID, PCI_ANY_ID, dev)) != NULL) {
 		pci_fixup_device(pci_fixup_final, dev);
+		/*
+		 * If arch hasn't set it explicitly yet, use the CLS
+		 * value shared by all PCI devices.  If there's a
+		 * mismatch, fall back to the default value.
+		 */
+		if (!pci_cache_line_size) {
+			pci_read_config_byte(dev, PCI_CACHE_LINE_SIZE, &tmp);
+			if (!cls)
+				cls = tmp;
+			if (!tmp || cls == tmp)
+				continue;
+
+			printk(KERN_DEBUG "PCI: CLS mismatch (%u != %u), "
+			       "using %u bytes\n", cls << 2, tmp << 2,
+			       pci_dfl_cache_line_size << 2);
+			pci_cache_line_size = pci_dfl_cache_line_size;
+		}
+	}
+	if (!pci_cache_line_size) {
+		printk(KERN_DEBUG "PCI: CLS %u bytes, default %u\n",
+		       cls << 2, pci_dfl_cache_line_size << 2);
+		pci_cache_line_size = cls ? cls : pci_dfl_cache_line_size;
 	}
 
 	return 0;
 }
 
 fs_initcall_sync(pci_apply_final_quirks);
+
+/*
+ * Followings are device-specific reset methods which can be used to
+ * reset a single function if other methods (e.g. FLR, PM D0->D3) are
+ * not available.
+ */
+static int reset_intel_generic_dev(struct pci_dev *dev, int probe)
+{
+	int pos;
+
+	/* only implement PCI_CLASS_SERIAL_USB at present */
+	if (dev->class == PCI_CLASS_SERIAL_USB) {
+		pos = pci_find_capability(dev, PCI_CAP_ID_VNDR);
+		if (!pos)
+			return -ENOTTY;
+
+		if (probe)
+			return 0;
+
+		pci_write_config_byte(dev, pos + 0x4, 1);
+		msleep(100);
+
+		return 0;
+	} else {
+		return -ENOTTY;
+	}
+}
+
+static int reset_intel_82599_sfp_virtfn(struct pci_dev *dev, int probe)
+{
+	int pos;
+
+	pos = pci_find_capability(dev, PCI_CAP_ID_EXP);
+	if (!pos)
+		return -ENOTTY;
+
+	if (probe)
+		return 0;
+
+	pci_write_config_word(dev, pos + PCI_EXP_DEVCTL,
+				PCI_EXP_DEVCTL_BCR_FLR);
+	msleep(100);
+
+	return 0;
+}
+
+#define PCI_DEVICE_ID_INTEL_82599_SFP_VF   0x10ed
+
+static const struct pci_dev_reset_methods pci_dev_reset_methods[] = {
+	{ PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82599_SFP_VF,
+		 reset_intel_82599_sfp_virtfn },
+	{ PCI_VENDOR_ID_INTEL, PCI_ANY_ID,
+		reset_intel_generic_dev },
+	{ 0 }
+};
+
+int pci_dev_specific_reset(struct pci_dev *dev, int probe)
+{
+	const struct pci_dev_reset_methods *i;
+
+	for (i = pci_dev_reset_methods; i->reset; i++) {
+		if ((i->vendor == dev->vendor ||
+		     i->vendor == (u16)PCI_ANY_ID) &&
+		    (i->device == dev->device ||
+		     i->device == (u16)PCI_ANY_ID))
+			return i->reset(dev, probe);
+	}
+
+	return -ENOTTY;
+}
+
 #else
 void pci_fixup_device(enum pci_fixup_pass pass, struct pci_dev *dev) {}
+int pci_dev_specific_reset(struct pci_dev *dev, int probe) { return -ENOTTY; }
 #endif
 EXPORT_SYMBOL(pci_fixup_device);
diff --git a/drivers/pci/search.c b/drivers/pci/search.c
index ec415352d9ba..4a471dc4f4b9 100644
--- a/drivers/pci/search.c
+++ b/drivers/pci/search.c
@@ -15,9 +15,9 @@
 
 DECLARE_RWSEM(pci_bus_sem);
 /*
- * find the upstream PCIE-to-PCI bridge of a PCI device
+ * find the upstream PCIe-to-PCI bridge of a PCI device
  * if the device is PCIE, return NULL
- * if the device isn't connected to a PCIE bridge (that is its parent is a
+ * if the device isn't connected to a PCIe bridge (that is its parent is a
  * legacy PCI bridge and the bridge is directly connected to bus 0), return its
  * parent
  */
@@ -26,18 +26,18 @@ pci_find_upstream_pcie_bridge(struct pci_dev *pdev)
 {
 	struct pci_dev *tmp = NULL;
 
-	if (pdev->is_pcie)
+	if (pci_is_pcie(pdev))
 		return NULL;
 	while (1) {
 		if (pci_is_root_bus(pdev->bus))
 			break;
 		pdev = pdev->bus->self;
 		/* a p2p bridge */
-		if (!pdev->is_pcie) {
+		if (!pci_is_pcie(pdev)) {
 			tmp = pdev;
 			continue;
 		}
-		/* PCI device should connect to a PCIE bridge */
+		/* PCI device should connect to a PCIe bridge */
 		if (pdev->pcie_type != PCI_EXP_TYPE_PCI_BRIDGE) {
 			/* Busted hardware? */
 			WARN_ON_ONCE(1);
@@ -149,32 +149,33 @@ struct pci_dev * pci_get_slot(struct pci_bus *bus, unsigned int devfn)
 }
 
 /**
- * pci_get_bus_and_slot - locate PCI device from a given PCI bus & slot
- * @bus: number of PCI bus on which desired PCI device resides
- * @devfn: encodes number of PCI slot in which the desired PCI
- * device resides and the logical device number within that slot
- * in case of multi-function devices.
- *
- * Note: the bus/slot search is limited to PCI domain (segment) 0.
+ * pci_get_domain_bus_and_slot - locate PCI device for a given PCI domain (segment), bus, and slot
+ * @domain: PCI domain/segment on which the PCI device resides.
+ * @bus: PCI bus on which desired PCI device resides
+ * @devfn: encodes number of PCI slot in which the desired PCI device
+ * resides and the logical device number within that slot in case of
+ * multi-function devices.
  *
- * Given a PCI bus and slot/function number, the desired PCI device
- * is located in system global list of PCI devices.  If the device
- * is found, a pointer to its data structure is returned.  If no
- * device is found, %NULL is returned. The returned device has its
- * reference count bumped by one.
+ * Given a PCI domain, bus, and slot/function number, the desired PCI
+ * device is located in the list of PCI devices. If the device is
+ * found, its reference count is increased and this function returns a
+ * pointer to its data structure.  The caller must decrement the
+ * reference count by calling pci_dev_put().  If no device is found,
+ * %NULL is returned.
  */
-
-struct pci_dev * pci_get_bus_and_slot(unsigned int bus, unsigned int devfn)
+struct pci_dev *pci_get_domain_bus_and_slot(int domain, unsigned int bus,
+					    unsigned int devfn)
 {
 	struct pci_dev *dev = NULL;
 
 	while ((dev = pci_get_device(PCI_ANY_ID, PCI_ANY_ID, dev)) != NULL) {
-		if (pci_domain_nr(dev->bus) == 0 &&
-		   (dev->bus->number == bus && dev->devfn == devfn))
+		if (pci_domain_nr(dev->bus) == domain &&
+		    (dev->bus->number == bus && dev->devfn == devfn))
 			return dev;
 	}
 	return NULL;
 }
+EXPORT_SYMBOL(pci_get_domain_bus_and_slot);
 
 static int match_pci_dev_by_id(struct device *dev, void *data)
 {
@@ -354,5 +355,4 @@ EXPORT_SYMBOL(pci_find_next_bus);
 EXPORT_SYMBOL(pci_get_device);
 EXPORT_SYMBOL(pci_get_subsys);
 EXPORT_SYMBOL(pci_get_slot);
-EXPORT_SYMBOL(pci_get_bus_and_slot);
 EXPORT_SYMBOL(pci_get_class);
diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c
index cb1a027eb552..c48cd377b3f5 100644
--- a/drivers/pci/setup-bus.c
+++ b/drivers/pci/setup-bus.c
@@ -71,53 +71,50 @@ static void pbus_assign_resources_sorted(const struct pci_bus *bus)
 void pci_setup_cardbus(struct pci_bus *bus)
 {
 	struct pci_dev *bridge = bus->self;
+	struct resource *res;
 	struct pci_bus_region region;
 
-	dev_info(&bridge->dev, "CardBus bridge, secondary bus %04x:%02x\n",
-		 pci_domain_nr(bus), bus->number);
+	dev_info(&bridge->dev, "CardBus bridge to [bus %02x-%02x]\n",
+		 bus->secondary, bus->subordinate);
 
-	pcibios_resource_to_bus(bridge, &region, bus->resource[0]);
-	if (bus->resource[0]->flags & IORESOURCE_IO) {
+	res = bus->resource[0];
+	pcibios_resource_to_bus(bridge, &region, res);
+	if (res->flags & IORESOURCE_IO) {
 		/*
 		 * The IO resource is allocated a range twice as large as it
 		 * would normally need.  This allows us to set both IO regs.
 		 */
-		dev_info(&bridge->dev, "  IO window: %#08lx-%#08lx\n",
-		       (unsigned long)region.start,
-		       (unsigned long)region.end);
+		dev_info(&bridge->dev, "  bridge window %pR\n", res);
 		pci_write_config_dword(bridge, PCI_CB_IO_BASE_0,
 					region.start);
 		pci_write_config_dword(bridge, PCI_CB_IO_LIMIT_0,
 					region.end);
 	}
 
-	pcibios_resource_to_bus(bridge, &region, bus->resource[1]);
-	if (bus->resource[1]->flags & IORESOURCE_IO) {
-		dev_info(&bridge->dev, "  IO window: %#08lx-%#08lx\n",
-		       (unsigned long)region.start,
-		       (unsigned long)region.end);
+	res = bus->resource[1];
+	pcibios_resource_to_bus(bridge, &region, res);
+	if (res->flags & IORESOURCE_IO) {
+		dev_info(&bridge->dev, "  bridge window %pR\n", res);
 		pci_write_config_dword(bridge, PCI_CB_IO_BASE_1,
 					region.start);
 		pci_write_config_dword(bridge, PCI_CB_IO_LIMIT_1,
 					region.end);
 	}
 
-	pcibios_resource_to_bus(bridge, &region, bus->resource[2]);
-	if (bus->resource[2]->flags & IORESOURCE_MEM) {
-		dev_info(&bridge->dev, "  PREFETCH window: %#08lx-%#08lx\n",
-		       (unsigned long)region.start,
-		       (unsigned long)region.end);
+	res = bus->resource[2];
+	pcibios_resource_to_bus(bridge, &region, res);
+	if (res->flags & IORESOURCE_MEM) {
+		dev_info(&bridge->dev, "  bridge window %pR\n", res);
 		pci_write_config_dword(bridge, PCI_CB_MEMORY_BASE_0,
 					region.start);
 		pci_write_config_dword(bridge, PCI_CB_MEMORY_LIMIT_0,
 					region.end);
 	}
 
-	pcibios_resource_to_bus(bridge, &region, bus->resource[3]);
-	if (bus->resource[3]->flags & IORESOURCE_MEM) {
-		dev_info(&bridge->dev, "  MEM window: %#08lx-%#08lx\n",
-		       (unsigned long)region.start,
-		       (unsigned long)region.end);
+	res = bus->resource[3];
+	pcibios_resource_to_bus(bridge, &region, res);
+	if (res->flags & IORESOURCE_MEM) {
+		dev_info(&bridge->dev, "  bridge window %pR\n", res);
 		pci_write_config_dword(bridge, PCI_CB_MEMORY_BASE_1,
 					region.start);
 		pci_write_config_dword(bridge, PCI_CB_MEMORY_LIMIT_1,
@@ -140,34 +137,33 @@ EXPORT_SYMBOL(pci_setup_cardbus);
 static void pci_setup_bridge(struct pci_bus *bus)
 {
 	struct pci_dev *bridge = bus->self;
+	struct resource *res;
 	struct pci_bus_region region;
 	u32 l, bu, lu, io_upper16;
-	int pref_mem64;
 
 	if (pci_is_enabled(bridge))
 		return;
 
-	dev_info(&bridge->dev, "PCI bridge, secondary bus %04x:%02x\n",
-		 pci_domain_nr(bus), bus->number);
+	dev_info(&bridge->dev, "PCI bridge to [bus %02x-%02x]\n",
+		 bus->secondary, bus->subordinate);
 
 	/* Set up the top and bottom of the PCI I/O segment for this bus. */
-	pcibios_resource_to_bus(bridge, &region, bus->resource[0]);
-	if (bus->resource[0]->flags & IORESOURCE_IO) {
+	res = bus->resource[0];
+	pcibios_resource_to_bus(bridge, &region, res);
+	if (res->flags & IORESOURCE_IO) {
 		pci_read_config_dword(bridge, PCI_IO_BASE, &l);
 		l &= 0xffff0000;
 		l |= (region.start >> 8) & 0x00f0;
 		l |= region.end & 0xf000;
 		/* Set up upper 16 bits of I/O base/limit. */
 		io_upper16 = (region.end & 0xffff0000) | (region.start >> 16);
-		dev_info(&bridge->dev, "  IO window: %#04lx-%#04lx\n",
-		    (unsigned long)region.start,
-		    (unsigned long)region.end);
+		dev_info(&bridge->dev, "  bridge window %pR\n", res);
 	}
 	else {
 		/* Clear upper 16 bits of I/O base/limit. */
 		io_upper16 = 0;
 		l = 0x00f0;
-		dev_info(&bridge->dev, "  IO window: disabled\n");
+		dev_info(&bridge->dev, "  bridge window [io  disabled]\n");
 	}
 	/* Temporarily disable the I/O range before updating PCI_IO_BASE. */
 	pci_write_config_dword(bridge, PCI_IO_BASE_UPPER16, 0x0000ffff);
@@ -178,17 +174,16 @@ static void pci_setup_bridge(struct pci_bus *bus)
 
 	/* Set up the top and bottom of the PCI Memory segment
 	   for this bus. */
-	pcibios_resource_to_bus(bridge, &region, bus->resource[1]);
-	if (bus->resource[1]->flags & IORESOURCE_MEM) {
+	res = bus->resource[1];
+	pcibios_resource_to_bus(bridge, &region, res);
+	if (res->flags & IORESOURCE_MEM) {
 		l = (region.start >> 16) & 0xfff0;
 		l |= region.end & 0xfff00000;
-		dev_info(&bridge->dev, "  MEM window: %#08lx-%#08lx\n",
-		    (unsigned long)region.start,
-		    (unsigned long)region.end);
+		dev_info(&bridge->dev, "  bridge window %pR\n", res);
 	}
 	else {
 		l = 0x0000fff0;
-		dev_info(&bridge->dev, "  MEM window: disabled\n");
+		dev_info(&bridge->dev, "  bridge window [mem disabled]\n");
 	}
 	pci_write_config_dword(bridge, PCI_MEMORY_BASE, l);
 
@@ -198,34 +193,27 @@ static void pci_setup_bridge(struct pci_bus *bus)
 	pci_write_config_dword(bridge, PCI_PREF_LIMIT_UPPER32, 0);
 
 	/* Set up PREF base/limit. */
-	pref_mem64 = 0;
 	bu = lu = 0;
-	pcibios_resource_to_bus(bridge, &region, bus->resource[2]);
-	if (bus->resource[2]->flags & IORESOURCE_PREFETCH) {
-		int width = 8;
+	res = bus->resource[2];
+	pcibios_resource_to_bus(bridge, &region, res);
+	if (res->flags & IORESOURCE_PREFETCH) {
 		l = (region.start >> 16) & 0xfff0;
 		l |= region.end & 0xfff00000;
-		if (bus->resource[2]->flags & IORESOURCE_MEM_64) {
-			pref_mem64 = 1;
+		if (res->flags & IORESOURCE_MEM_64) {
 			bu = upper_32_bits(region.start);
 			lu = upper_32_bits(region.end);
-			width = 16;
 		}
-		dev_info(&bridge->dev, "  PREFETCH window: %#0*llx-%#0*llx\n",
-				width, (unsigned long long)region.start,
-				width, (unsigned long long)region.end);
+		dev_info(&bridge->dev, "  bridge window %pR\n", res);
 	}
 	else {
 		l = 0x0000fff0;
-		dev_info(&bridge->dev, "  PREFETCH window: disabled\n");
+		dev_info(&bridge->dev, "  bridge window [mem pref disabled]\n");
 	}
 	pci_write_config_dword(bridge, PCI_PREF_MEMORY_BASE, l);
 
-	if (pref_mem64) {
-		/* Set the upper 32 bits of PREF base & limit. */
-		pci_write_config_dword(bridge, PCI_PREF_BASE_UPPER32, bu);
-		pci_write_config_dword(bridge, PCI_PREF_LIMIT_UPPER32, lu);
-	}
+	/* Set the upper 32 bits of PREF base & limit. */
+	pci_write_config_dword(bridge, PCI_PREF_BASE_UPPER32, bu);
+	pci_write_config_dword(bridge, PCI_PREF_LIMIT_UPPER32, lu);
 
 	pci_write_config_word(bridge, PCI_BRIDGE_CONTROL, bus->bridge_ctl);
 }
@@ -345,6 +333,10 @@ static void pbus_size_io(struct pci_bus *bus, resource_size_t min_size)
 #endif
 	size = ALIGN(size + size1, 4096);
 	if (!size) {
+		if (b_res->start || b_res->end)
+			dev_info(&bus->self->dev, "disabling bridge window "
+				 "%pR to [bus %02x-%02x] (unused)\n", b_res,
+				 bus->secondary, bus->subordinate);
 		b_res->flags = 0;
 		return;
 	}
@@ -390,8 +382,9 @@ static int pbus_size_mem(struct pci_bus *bus, unsigned long mask,
 			align = pci_resource_alignment(dev, r);
 			order = __ffs(align) - 20;
 			if (order > 11) {
-				dev_warn(&dev->dev, "BAR %d bad alignment %llx: "
-					 "%pR\n", i, (unsigned long long)align, r);
+				dev_warn(&dev->dev, "disabling BAR %d: %pR "
+					 "(bad alignment %#llx)\n", i, r,
+					 (unsigned long long) align);
 				r->flags = 0;
 				continue;
 			}
@@ -425,6 +418,10 @@ static int pbus_size_mem(struct pci_bus *bus, unsigned long mask,
 	}
 	size = ALIGN(size, min_align);
 	if (!size) {
+		if (b_res->start || b_res->end)
+			dev_info(&bus->self->dev, "disabling bridge window "
+				 "%pR to [bus %02x-%02x] (unused)\n", b_res,
+				 bus->secondary, bus->subordinate);
 		b_res->flags = 0;
 		return 1;
 	}
@@ -582,10 +579,7 @@ static void pci_bus_dump_res(struct pci_bus *bus)
                 if (!res || !res->end)
                         continue;
 
-		dev_printk(KERN_DEBUG, &bus->dev, "resource %d %s %pR\n", i,
-			   (res->flags & IORESOURCE_IO) ? "io: " :
-			    ((res->flags & IORESOURCE_PREFETCH)? "pref mem":"mem:"),
-			   res);
+		dev_printk(KERN_DEBUG, &bus->dev, "resource %d %pR\n", i, res);
         }
 }
 
diff --git a/drivers/pci/setup-res.c b/drivers/pci/setup-res.c
index c54526b206b5..7d678bb15ffb 100644
--- a/drivers/pci/setup-res.c
+++ b/drivers/pci/setup-res.c
@@ -51,12 +51,6 @@ void pci_update_resource(struct pci_dev *dev, int resno)
 
 	pcibios_resource_to_bus(dev, &region, res);
 
-	dev_dbg(&dev->dev, "BAR %d: got res %pR bus [%#llx-%#llx] "
-		"flags %#lx\n", resno, res,
-		 (unsigned long long)region.start,
-		 (unsigned long long)region.end,
-		 (unsigned long)res->flags);
-
 	new = region.start | (res->flags & PCI_REGION_FLAG_MASK);
 	if (res->flags & IORESOURCE_IO)
 		mask = (u32)PCI_BASE_ADDRESS_IO_MASK;
@@ -91,9 +85,9 @@ void pci_update_resource(struct pci_dev *dev, int resno)
 		}
 	}
 	res->flags &= ~IORESOURCE_UNSET;
-	dev_dbg(&dev->dev, "BAR %d: moved to bus [%#llx-%#llx] flags %#lx\n",
-		resno, (unsigned long long)region.start,
-		(unsigned long long)region.end, res->flags);
+	dev_info(&dev->dev, "BAR %d: set to %pR (PCI address [%#llx-%#llx]\n",
+		 resno, res, (unsigned long long)region.start,
+		 (unsigned long long)region.end);
 }
 
 int pci_claim_resource(struct pci_dev *dev, int resource)
@@ -103,20 +97,17 @@ int pci_claim_resource(struct pci_dev *dev, int resource)
 	int err;
 
 	root = pci_find_parent_resource(dev, res);
-
-	err = -EINVAL;
-	if (root != NULL)
-		err = request_resource(root, res);
-
-	if (err) {
-		const char *dtype = resource < PCI_BRIDGE_RESOURCES ? "device" : "bridge";
-		dev_err(&dev->dev, "BAR %d: %s of %s %pR\n",
-			resource,
-			root ? "address space collision on" :
-				"no parent found for",
-			dtype, res);
+	if (!root) {
+		dev_err(&dev->dev, "no compatible bridge window for %pR\n",
+			res);
+		return -EINVAL;
 	}
 
+	err = request_resource(root, res);
+	if (err)
+		dev_err(&dev->dev,
+			"address space collision: %pR already in use\n", res);
+
 	return err;
 }
 EXPORT_SYMBOL(pci_claim_resource);
@@ -124,7 +115,7 @@ EXPORT_SYMBOL(pci_claim_resource);
 #ifdef CONFIG_PCI_QUIRKS
 void pci_disable_bridge_window(struct pci_dev *dev)
 {
-	dev_dbg(&dev->dev, "Disabling bridge window.\n");
+	dev_info(&dev->dev, "disabling bridge mem windows\n");
 
 	/* MMIO Base/Limit */
 	pci_write_config_dword(dev, PCI_MEMORY_BASE, 0x0000fff0);
@@ -165,6 +156,7 @@ static int __pci_assign_resource(struct pci_bus *bus, struct pci_dev *dev,
 
 	if (!ret) {
 		res->flags &= ~IORESOURCE_STARTALIGN;
+		dev_info(&dev->dev, "BAR %d: assigned %pR\n", resno, res);
 		if (resno < PCI_BRIDGE_RESOURCES)
 			pci_update_resource(dev, resno);
 	}
@@ -178,12 +170,12 @@ int pci_assign_resource(struct pci_dev *dev, int resno)
 	resource_size_t align;
 	struct pci_bus *bus;
 	int ret;
+	char *type;
 
 	align = pci_resource_alignment(dev, res);
 	if (!align) {
-		dev_info(&dev->dev, "BAR %d: can't allocate resource (bogus "
-			"alignment) %pR flags %#lx\n",
-			resno, res, res->flags);
+		dev_info(&dev->dev, "BAR %d: can't assign %pR "
+			 "(bogus alignment)\n", resno, res);
 		return -EINVAL;
 	}
 
@@ -198,9 +190,20 @@ int pci_assign_resource(struct pci_dev *dev, int resno)
 		break;
 	}
 
-	if (ret)
-		dev_info(&dev->dev, "BAR %d: can't allocate %s resource %pR\n",
-			resno, res->flags & IORESOURCE_IO ? "I/O" : "mem", res);
+	if (ret) {
+		if (res->flags & IORESOURCE_MEM)
+			if (res->flags & IORESOURCE_PREFETCH)
+				type = "mem pref";
+			else
+				type = "mem";
+		else if (res->flags & IORESOURCE_IO)
+			type = "io";
+		else
+			type = "unknown";
+		dev_info(&dev->dev,
+			 "BAR %d: can't assign %s (size %#llx)\n",
+			 resno, type, (unsigned long long) resource_size(res));
+	}
 
 	return ret;
 }
@@ -225,9 +228,8 @@ void pdev_sort_resources(struct pci_dev *dev, struct resource_list *head)
 
 		r_align = pci_resource_alignment(dev, r);
 		if (!r_align) {
-			dev_warn(&dev->dev, "BAR %d: bogus alignment "
-				"%pR flags %#lx\n",
-				i, r, r->flags);
+			dev_warn(&dev->dev, "BAR %d: %pR has bogus alignment\n",
+				 i, r);
 			continue;
 		}
 		for (list = head; ; list = list->next) {
@@ -274,8 +276,8 @@ int pci_enable_resources(struct pci_dev *dev, int mask)
 			continue;
 
 		if (!r->parent) {
-			dev_err(&dev->dev, "device not available because of "
-				"BAR %d %pR collisions\n", i, r);
+			dev_err(&dev->dev, "device not available "
+				"(can't reserve %pR)\n", r);
 			return -EINVAL;
 		}
 
diff --git a/drivers/pcmcia/Kconfig b/drivers/pcmcia/Kconfig
index cd5082d3ca19..9f3adbd9f700 100644
--- a/drivers/pcmcia/Kconfig
+++ b/drivers/pcmcia/Kconfig
@@ -64,7 +64,7 @@ config PCMCIA_IOCTL
 	  If unsure, say Y.
 
 config CARDBUS
-	bool "32-bit CardBus support"	
+	bool "32-bit CardBus support"
 	depends on PCI
 	default y
 	---help---
@@ -87,8 +87,8 @@ config YENTA
 	select PCCARD_NONSTATIC
 	---help---
 	  This option enables support for CardBus host bridges.  Virtually
-	  all modern PCMCIA bridges are CardBus compatible.  A "bridge" is 
-	  the hardware inside your computer that PCMCIA cards are plugged 
+	  all modern PCMCIA bridges are CardBus compatible.  A "bridge" is
+	  the hardware inside your computer that PCMCIA cards are plugged
 	  into.
 
 	  To compile this driver as modules, choose M here: the
@@ -208,7 +208,7 @@ config PCMCIA_PXA2XX
 	depends on ARM && ARCH_PXA && PCMCIA
 	depends on (ARCH_LUBBOCK || MACH_MAINSTONE || PXA_SHARPSL \
 		    || MACH_ARMCORE || ARCH_PXA_PALM || TRIZEPS_PCMCIA \
-		    || ARCH_VIPER || ARCH_PXA_ESERIES || MACH_STARGATE2)
+		    || ARCOM_PCMCIA || ARCH_PXA_ESERIES || MACH_STARGATE2)
 	select PCMCIA_SOC_COMMON
 	help
 	  Say Y here to include support for the PXA2xx PCMCIA controller
diff --git a/drivers/pcmcia/Makefile b/drivers/pcmcia/Makefile
index 382938313991..83ff802de544 100644
--- a/drivers/pcmcia/Makefile
+++ b/drivers/pcmcia/Makefile
@@ -67,7 +67,7 @@ pxa2xx-obj-$(CONFIG_ARCH_LUBBOCK)		+= pxa2xx_lubbock_cs.o
 pxa2xx-obj-$(CONFIG_MACH_MAINSTONE)		+= pxa2xx_mainstone.o
 pxa2xx-obj-$(CONFIG_PXA_SHARPSL)		+= pxa2xx_sharpsl.o
 pxa2xx-obj-$(CONFIG_MACH_ARMCORE)		+= pxa2xx_cm_x2xx_cs.o
-pxa2xx-obj-$(CONFIG_ARCH_VIPER)			+= pxa2xx_viper.o
+pxa2xx-obj-$(CONFIG_ARCOM_PCMCIA)		+= pxa2xx_viper.o
 pxa2xx-obj-$(CONFIG_TRIZEPS_PCMCIA)		+= pxa2xx_trizeps4.o
 pxa2xx-obj-$(CONFIG_MACH_PALMTX)		+= pxa2xx_palmtx.o
 pxa2xx-obj-$(CONFIG_MACH_PALMTC)		+= pxa2xx_palmtc.o
diff --git a/drivers/pcmcia/cardbus.c b/drivers/pcmcia/cardbus.c
index 4cd70d056810..d99f846451a3 100644
--- a/drivers/pcmcia/cardbus.c
+++ b/drivers/pcmcia/cardbus.c
@@ -27,8 +27,8 @@
 #include <linux/mm.h>
 #include <linux/pci.h>
 #include <linux/ioport.h>
+#include <linux/io.h>
 #include <asm/irq.h>
-#include <asm/io.h>
 
 #include <pcmcia/cs_types.h>
 #include <pcmcia/ss.h>
@@ -58,7 +58,7 @@
     image number and an offset within that image.  xlate_rom_addr()
     converts an image/offset address to an absolute offset from the
     ROM's base address.
-    
+
 =====================================================================*/
 
 static u_int xlate_rom_addr(void __iomem *b, u_int addr)
@@ -85,10 +85,10 @@ static u_int xlate_rom_addr(void __iomem *b, u_int addr)
     These are similar to setup_cis_mem and release_cis_mem for 16-bit
     cards.  The "result" that is used externally is the cb_cis_virt
     pointer in the struct pcmcia_socket structure.
-    
+
 =====================================================================*/
 
-static void cb_release_cis_mem(struct pcmcia_socket * s)
+static void cb_release_cis_mem(struct pcmcia_socket *s)
 {
 	if (s->cb_cis_virt) {
 		dev_dbg(&s->dev, "cb_release_cis_mem()\n");
@@ -98,7 +98,7 @@ static void cb_release_cis_mem(struct pcmcia_socket * s)
 	}
 }
 
-static int cb_setup_cis_mem(struct pcmcia_socket * s, struct resource *res)
+static int cb_setup_cis_mem(struct pcmcia_socket *s, struct resource *res)
 {
 	unsigned int start, size;
 
@@ -124,10 +124,11 @@ static int cb_setup_cis_mem(struct pcmcia_socket * s, struct resource *res)
 
     This is used by the CIS processing code to read CIS information
     from a CardBus device.
-    
+
 =====================================================================*/
 
-int read_cb_mem(struct pcmcia_socket * s, int space, u_int addr, u_int len, void *ptr)
+int read_cb_mem(struct pcmcia_socket *s, int space, u_int addr, u_int len,
+		void *ptr)
 {
 	struct pci_dev *dev;
 	struct resource *res;
@@ -181,40 +182,47 @@ fail:
     cb_alloc() and cb_free() allocate and free the kernel data
     structures for a Cardbus device, and handle the lowest level PCI
     device setup issues.
-    
+
 =====================================================================*/
 
-/*
- * Since there is only one interrupt available to CardBus
- * devices, all devices downstream of this device must
- * be using this IRQ.
- */
-static void cardbus_assign_irqs(struct pci_bus *bus, int irq)
+static void cardbus_config_irq_and_cls(struct pci_bus *bus, int irq)
 {
 	struct pci_dev *dev;
 
 	list_for_each_entry(dev, &bus->devices, bus_list) {
 		u8 irq_pin;
 
+		/*
+		 * Since there is only one interrupt available to
+		 * CardBus devices, all devices downstream of this
+		 * device must be using this IRQ.
+		 */
 		pci_read_config_byte(dev, PCI_INTERRUPT_PIN, &irq_pin);
 		if (irq_pin) {
 			dev->irq = irq;
 			pci_write_config_byte(dev, PCI_INTERRUPT_LINE, dev->irq);
 		}
 
+		/*
+		 * Some controllers transfer very slowly with 0 CLS.
+		 * Configure it.  This may fail as CLS configuration
+		 * is mandatory only for MWI.
+		 */
+		pci_set_cacheline_size(dev);
+
 		if (dev->subordinate)
-			cardbus_assign_irqs(dev->subordinate, irq);
+			cardbus_config_irq_and_cls(dev->subordinate, irq);
 	}
 }
 
-int __ref cb_alloc(struct pcmcia_socket * s)
+int __ref cb_alloc(struct pcmcia_socket *s)
 {
 	struct pci_bus *bus = s->cb_dev->subordinate;
 	struct pci_dev *dev;
 	unsigned int max, pass;
 
 	s->functions = pci_scan_slot(bus, PCI_DEVFN(0, 0));
-//	pcibios_fixup_bus(bus);
+	pci_fixup_cardbus(bus); 
 
 	max = bus->secondary;
 	for (pass = 0; pass < 2; pass++)
@@ -228,7 +236,7 @@ int __ref cb_alloc(struct pcmcia_socket * s)
 	 */
 	pci_bus_size_bridges(bus);
 	pci_bus_assign_resources(bus);
-	cardbus_assign_irqs(bus, s->pci_irq);
+	cardbus_config_irq_and_cls(bus, s->pci_irq);
 
 	/* socket specific tune function */
 	if (s->tune_bridge)
@@ -241,7 +249,7 @@ int __ref cb_alloc(struct pcmcia_socket * s)
 	return 0;
 }
 
-void cb_free(struct pcmcia_socket * s)
+void cb_free(struct pcmcia_socket *s)
 {
 	struct pci_dev *bridge = s->cb_dev;
 
diff --git a/drivers/pcmcia/cistpl.c b/drivers/pcmcia/cistpl.c
index 8c1b73cf021b..25b1cd219e37 100644
--- a/drivers/pcmcia/cistpl.c
+++ b/drivers/pcmcia/cistpl.c
@@ -23,7 +23,7 @@
 #include <linux/mm.h>
 #include <linux/pci.h>
 #include <linux/ioport.h>
-#include <asm/io.h>
+#include <linux/io.h>
 #include <asm/byteorder.h>
 #include <asm/unaligned.h>
 
@@ -125,7 +125,7 @@ set_cis_map(struct pcmcia_socket *s, unsigned int card_offset, unsigned int flag
 
     Low-level functions to read and write CIS memory.  I think the
     write routine is only useful for writing one-byte registers.
-    
+
 ======================================================================*/
 
 /* Bits in attr field */
@@ -137,7 +137,7 @@ int pcmcia_read_cis_mem(struct pcmcia_socket *s, int attr, u_int addr,
 {
     void __iomem *sys, *end;
     unsigned char *buf = ptr;
-    
+
     dev_dbg(&s->dev, "pcmcia_read_cis_mem(%d, %#x, %u)\n", attr, addr, len);
 
     if (attr & IS_INDIRECT) {
@@ -203,7 +203,7 @@ void pcmcia_write_cis_mem(struct pcmcia_socket *s, int attr, u_int addr,
 {
     void __iomem *sys, *end;
     unsigned char *buf = ptr;
-    
+
     dev_dbg(&s->dev, "pcmcia_write_cis_mem(%d, %#x, %u)\n", attr, addr, len);
 
     if (attr & IS_INDIRECT) {
@@ -262,7 +262,7 @@ EXPORT_SYMBOL(pcmcia_write_cis_mem);
     This is a wrapper around read_cis_mem, with the same interface,
     but which caches information, for cards whose CIS may not be
     readable all the time.
-    
+
 ======================================================================*/
 
 static void read_cis_cache(struct pcmcia_socket *s, int attr, u_int addr,
@@ -342,7 +342,7 @@ EXPORT_SYMBOL(destroy_cis_cache);
 
     This verifies if the CIS of a card matches what is in the CIS
     cache.
-    
+
 ======================================================================*/
 
 int verify_cis_cache(struct pcmcia_socket *s)
@@ -381,7 +381,7 @@ int verify_cis_cache(struct pcmcia_socket *s)
 
     For really bad cards, we provide a facility for uploading a
     replacement CIS.
-    
+
 ======================================================================*/
 
 int pcmcia_replace_cis(struct pcmcia_socket *s,
@@ -406,7 +406,7 @@ EXPORT_SYMBOL(pcmcia_replace_cis);
 /*======================================================================
 
     The high-level CIS tuple services
-    
+
 ======================================================================*/
 
 typedef struct tuple_flags {
@@ -421,8 +421,6 @@ typedef struct tuple_flags {
 #define MFC_FN(f)	(((tuple_flags *)(&(f)))->mfc_fn)
 #define SPACE(f)	(((tuple_flags *)(&(f)))->space)
 
-int pccard_get_next_tuple(struct pcmcia_socket *s, unsigned int func, tuple_t *tuple);
-
 int pccard_get_first_tuple(struct pcmcia_socket *s, unsigned int function, tuple_t *tuple)
 {
     if (!s)
@@ -523,10 +521,11 @@ int pccard_get_next_tuple(struct pcmcia_socket *s, unsigned int function, tuple_
 		ofs++; continue;
 	    }
 	}
-	
+
 	/* End of chain?  Follow long link if possible */
 	if (link[0] == CISTPL_END) {
-	    if ((ofs = follow_link(s, tuple)) < 0)
+	    ofs = follow_link(s, tuple);
+	    if (ofs < 0)
 		return -ENOSPC;
 	    attr = SPACE(tuple->Flags);
 	    read_cis_cache(s, attr, ofs, 2, link);
@@ -578,7 +577,7 @@ int pccard_get_next_tuple(struct pcmcia_socket *s, unsigned int function, tuple_
 	} else
 	    if (tuple->DesiredTuple == RETURN_FIRST_TUPLE)
 		break;
-	
+
 	if (link[0] == tuple->DesiredTuple)
 	    break;
 	ofs += link[1] + 2;
@@ -587,7 +586,7 @@ int pccard_get_next_tuple(struct pcmcia_socket *s, unsigned int function, tuple_
 	dev_dbg(&s->dev, "cs: overrun in pcmcia_get_next_tuple\n");
 	return -ENOSPC;
     }
-    
+
     tuple->TupleCode = link[0];
     tuple->TupleLink = link[1];
     tuple->CISOffset = ofs + 2;
@@ -623,7 +622,7 @@ EXPORT_SYMBOL(pccard_get_tuple_data);
 /*======================================================================
 
     Parsing routines for individual tuples
-    
+
 ======================================================================*/
 
 static int parse_device(tuple_t *tuple, cistpl_device_t *device)
@@ -637,26 +636,37 @@ static int parse_device(tuple_t *tuple, cistpl_device_t *device)
 
     device->ndev = 0;
     for (i = 0; i < CISTPL_MAX_DEVICES; i++) {
-	
-	if (*p == 0xff) break;
+
+	if (*p == 0xff)
+		break;
 	device->dev[i].type = (*p >> 4);
 	device->dev[i].wp = (*p & 0x08) ? 1 : 0;
 	switch (*p & 0x07) {
-	case 0: device->dev[i].speed = 0;   break;
-	case 1: device->dev[i].speed = 250; break;
-	case 2: device->dev[i].speed = 200; break;
-	case 3: device->dev[i].speed = 150; break;
-	case 4: device->dev[i].speed = 100; break;
+	case 0:
+		device->dev[i].speed = 0;
+		break;
+	case 1:
+		device->dev[i].speed = 250;
+		break;
+	case 2:
+		device->dev[i].speed = 200;
+		break;
+	case 3:
+		device->dev[i].speed = 150;
+		break;
+	case 4:
+		device->dev[i].speed = 100;
+		break;
 	case 7:
-	    if (++p == q)
-		    return -EINVAL;
-	    device->dev[i].speed = SPEED_CVT(*p);
-	    while (*p & 0x80)
 		if (++p == q)
 			return -EINVAL;
-	    break;
+		device->dev[i].speed = SPEED_CVT(*p);
+		while (*p & 0x80)
+			if (++p == q)
+				return -EINVAL;
+		break;
 	default:
-	    return -EINVAL;
+		return -EINVAL;
 	}
 
 	if (++p == q)
@@ -671,7 +681,7 @@ static int parse_device(tuple_t *tuple, cistpl_device_t *device)
 	if (++p == q)
 		break;
     }
-    
+
     return 0;
 }
 
@@ -706,9 +716,9 @@ static int parse_longlink_mfc(tuple_t *tuple,
 {
     u_char *p;
     int i;
-    
+
     p = (u_char *)tuple->TupleData;
-    
+
     link->nfn = *p; p++;
     if (tuple->TupleDataLen <= link->nfn*5)
 	return -EINVAL;
@@ -737,11 +747,13 @@ static int parse_strings(u_char *p, u_char *q, int max,
 	ns++;
 	for (;;) {
 	    s[j++] = (*p == 0xff) ? '\0' : *p;
-	    if ((*p == '\0') || (*p == 0xff)) break;
+	    if ((*p == '\0') || (*p == 0xff))
+		    break;
 	    if (++p == q)
 		    return -EINVAL;
 	}
-	if ((*p == 0xff) || (++p == q)) break;
+	if ((*p == 0xff) || (++p == q))
+		break;
     }
     if (found) {
 	*found = ns;
@@ -756,10 +768,10 @@ static int parse_strings(u_char *p, u_char *q, int max,
 static int parse_vers_1(tuple_t *tuple, cistpl_vers_1_t *vers_1)
 {
     u_char *p, *q;
-    
+
     p = (u_char *)tuple->TupleData;
     q = p + tuple->TupleDataLen;
-    
+
     vers_1->major = *p; p++;
     vers_1->minor = *p; p++;
     if (p >= q)
@@ -774,10 +786,10 @@ static int parse_vers_1(tuple_t *tuple, cistpl_vers_1_t *vers_1)
 static int parse_altstr(tuple_t *tuple, cistpl_altstr_t *altstr)
 {
     u_char *p, *q;
-    
+
     p = (u_char *)tuple->TupleData;
     q = p + tuple->TupleDataLen;
-    
+
     return parse_strings(p, q, CISTPL_MAX_ALTSTR_STRINGS,
 			 altstr->str, altstr->ofs, &altstr->ns);
 }
@@ -793,7 +805,8 @@ static int parse_jedec(tuple_t *tuple, cistpl_jedec_t *jedec)
     q = p + tuple->TupleDataLen;
 
     for (nid = 0; nid < CISTPL_MAX_DEVICES; nid++) {
-	if (p > q-2) break;
+	if (p > q-2)
+		break;
 	jedec->id[nid].mfr = p[0];
 	jedec->id[nid].info = p[1];
 	p += 2;
@@ -871,7 +884,7 @@ static int parse_config(tuple_t *tuple, cistpl_config_t *config)
 
     The following routines are all used to parse the nightmarish
     config table entries.
-    
+
 ======================================================================*/
 
 static u_char *parse_power(u_char *p, u_char *q,
@@ -880,17 +893,20 @@ static u_char *parse_power(u_char *p, u_char *q,
     int i;
     u_int scale;
 
-    if (p == q) return NULL;
+    if (p == q)
+	    return NULL;
     pwr->present = *p;
     pwr->flags = 0;
     p++;
     for (i = 0; i < 7; i++)
 	if (pwr->present & (1<<i)) {
-	    if (p == q) return NULL;
+	    if (p == q)
+		    return NULL;
 	    pwr->param[i] = POWER_CVT(*p);
 	    scale = POWER_SCALE(*p);
 	    while (*p & 0x80) {
-		if (++p == q) return NULL;
+		if (++p == q)
+			return NULL;
 		if ((*p & 0x7f) < 100)
 		    pwr->param[i] += (*p & 0x7f) * scale / 100;
 		else if (*p == 0x7d)
@@ -914,24 +930,28 @@ static u_char *parse_timing(u_char *p, u_char *q,
 {
     u_char scale;
 
-    if (p == q) return NULL;
+    if (p == q)
+	    return NULL;
     scale = *p;
     if ((scale & 3) != 3) {
-	if (++p == q) return NULL;
+	if (++p == q)
+		return NULL;
 	timing->wait = SPEED_CVT(*p);
 	timing->waitscale = exponent[scale & 3];
     } else
 	timing->wait = 0;
     scale >>= 2;
     if ((scale & 7) != 7) {
-	if (++p == q) return NULL;
+	if (++p == q)
+		return NULL;
 	timing->ready = SPEED_CVT(*p);
 	timing->rdyscale = exponent[scale & 7];
     } else
 	timing->ready = 0;
     scale >>= 3;
     if (scale != 7) {
-	if (++p == q) return NULL;
+	if (++p == q)
+		return NULL;
 	timing->reserved = SPEED_CVT(*p);
 	timing->rsvscale = exponent[scale];
     } else
@@ -946,7 +966,8 @@ static u_char *parse_io(u_char *p, u_char *q, cistpl_io_t *io)
 {
     int i, j, bsz, lsz;
 
-    if (p == q) return NULL;
+    if (p == q)
+	    return NULL;
     io->flags = *p;
 
     if (!(*p & 0x80)) {
@@ -955,24 +976,29 @@ static u_char *parse_io(u_char *p, u_char *q, cistpl_io_t *io)
 	io->win[0].len = (1 << (io->flags & CISTPL_IO_LINES_MASK));
 	return p+1;
     }
-    
-    if (++p == q) return NULL;
+
+    if (++p == q)
+	    return NULL;
     io->nwin = (*p & 0x0f) + 1;
     bsz = (*p & 0x30) >> 4;
-    if (bsz == 3) bsz++;
+    if (bsz == 3)
+	    bsz++;
     lsz = (*p & 0xc0) >> 6;
-    if (lsz == 3) lsz++;
+    if (lsz == 3)
+	    lsz++;
     p++;
-    
+
     for (i = 0; i < io->nwin; i++) {
 	io->win[i].base = 0;
 	io->win[i].len = 1;
 	for (j = 0; j < bsz; j++, p++) {
-	    if (p == q) return NULL;
+	    if (p == q)
+		    return NULL;
 	    io->win[i].base += *p << (j*8);
 	}
 	for (j = 0; j < lsz; j++, p++) {
-	    if (p == q) return NULL;
+	    if (p == q)
+		    return NULL;
 	    io->win[i].len += *p << (j*8);
 	}
     }
@@ -986,27 +1012,32 @@ static u_char *parse_mem(u_char *p, u_char *q, cistpl_mem_t *mem)
     int i, j, asz, lsz, has_ha;
     u_int len, ca, ha;
 
-    if (p == q) return NULL;
+    if (p == q)
+	    return NULL;
 
     mem->nwin = (*p & 0x07) + 1;
     lsz = (*p & 0x18) >> 3;
     asz = (*p & 0x60) >> 5;
     has_ha = (*p & 0x80);
-    if (++p == q) return NULL;
-    
+    if (++p == q)
+	    return NULL;
+
     for (i = 0; i < mem->nwin; i++) {
 	len = ca = ha = 0;
 	for (j = 0; j < lsz; j++, p++) {
-	    if (p == q) return NULL;
+	    if (p == q)
+		    return NULL;
 	    len += *p << (j*8);
 	}
 	for (j = 0; j < asz; j++, p++) {
-	    if (p == q) return NULL;
+	    if (p == q)
+		    return NULL;
 	    ca += *p << (j*8);
 	}
 	if (has_ha)
 	    for (j = 0; j < asz; j++, p++) {
-		if (p == q) return NULL;
+		if (p == q)
+			return NULL;
 		ha += *p << (j*8);
 	    }
 	mem->win[i].len = len << 8;
@@ -1095,7 +1126,7 @@ static int parse_cftable_entry(tuple_t *tuple,
 	entry->timing.ready = 0;
 	entry->timing.reserved = 0;
     }
-    
+
     /* I/O window options */
     if (features & 0x08) {
 	p = parse_io(p, q, &entry->io);
@@ -1103,7 +1134,7 @@ static int parse_cftable_entry(tuple_t *tuple,
 		return -EINVAL;
     } else
 	entry->io.nwin = 0;
-    
+
     /* Interrupt options */
     if (features & 0x10) {
 	p = parse_irq(p, q, &entry->irq);
@@ -1153,7 +1184,7 @@ static int parse_cftable_entry(tuple_t *tuple,
     }
 
     entry->subtuples = q-p;
-    
+
     return 0;
 }
 
@@ -1176,7 +1207,7 @@ static int parse_bar(tuple_t *tuple, cistpl_bar_t *bar)
 static int parse_config_cb(tuple_t *tuple, cistpl_config_t *config)
 {
     u_char *p;
-    
+
     p = (u_char *)tuple->TupleData;
     if ((*p != 3) || (tuple->TupleDataLen < 6))
 	return -EINVAL;
@@ -1231,7 +1262,7 @@ static int parse_cftable_entry_cb(tuple_t *tuple,
 	entry->io = *p; p++;
     } else
 	entry->io = 0;
-    
+
     /* Interrupt options */
     if (features & 0x10) {
 	p = parse_irq(p, q, &entry->irq);
@@ -1264,7 +1295,7 @@ static int parse_cftable_entry_cb(tuple_t *tuple,
     }
 
     entry->subtuples = q-p;
-    
+
     return 0;
 }
 
@@ -1281,7 +1312,8 @@ static int parse_device_geo(tuple_t *tuple, cistpl_device_geo_t *geo)
     q = p + tuple->TupleDataLen;
 
     for (n = 0; n < CISTPL_MAX_DEVICES; n++) {
-	if (p > q-6) break;
+	if (p > q-6)
+		break;
 	geo->geo[n].buswidth = p[0];
 	geo->geo[n].erase_block = 1 << (p[1]-1);
 	geo->geo[n].read_block  = 1 << (p[2]-1);
@@ -1302,13 +1334,13 @@ static int parse_vers_2(tuple_t *tuple, cistpl_vers_2_t *v2)
 
     if (tuple->TupleDataLen < 10)
 	return -EINVAL;
-    
+
     p = tuple->TupleData;
     q = p + tuple->TupleDataLen;
 
     v2->vers = p[0];
     v2->comply = p[1];
-    v2->dindex = get_unaligned_le16(p +2 );
+    v2->dindex = get_unaligned_le16(p + 2);
     v2->vspec8 = p[6];
     v2->vspec9 = p[7];
     v2->nhdr = p[8];
@@ -1322,7 +1354,7 @@ static int parse_org(tuple_t *tuple, cistpl_org_t *org)
 {
     u_char *p, *q;
     int i;
-    
+
     p = tuple->TupleData;
     q = p + tuple->TupleDataLen;
     if (p == q)
@@ -1332,7 +1364,8 @@ static int parse_org(tuple_t *tuple, cistpl_org_t *org)
 	    return -EINVAL;
     for (i = 0; i < 30; i++) {
 	org->desc[i] = *p;
-	if (*p == '\0') break;
+	if (*p == '\0')
+		break;
 	if (++p == q)
 		return -EINVAL;
     }
@@ -1363,7 +1396,7 @@ static int parse_format(tuple_t *tuple, cistpl_format_t *fmt)
 int pcmcia_parse_tuple(tuple_t *tuple, cisparse_t *parse)
 {
     int ret = 0;
-    
+
     if (tuple->TupleDataLen > tuple->TupleDataMax)
 	return -EINVAL;
     switch (tuple->TupleCode) {
@@ -1448,7 +1481,7 @@ EXPORT_SYMBOL(pcmcia_parse_tuple);
 /*======================================================================
 
     This is used internally by Card Services to look up CIS stuff.
-    
+
 ======================================================================*/
 
 int pccard_read_tuple(struct pcmcia_socket *s, unsigned int function, cisdata_t code, void *parse)
@@ -1550,7 +1583,7 @@ EXPORT_SYMBOL(pccard_loop_tuple);
     checks include making sure several critical tuples are present and
     valid; seeing if the total number of tuples is reasonable; and
     looking for tuples that use reserved codes.
-    
+
 ======================================================================*/
 
 int pccard_validate_cis(struct pcmcia_socket *s, unsigned int *info)
diff --git a/drivers/pcmcia/cs.c b/drivers/pcmcia/cs.c
index 790af87a922f..6d6f82b38a68 100644
--- a/drivers/pcmcia/cs.c
+++ b/drivers/pcmcia/cs.c
@@ -135,7 +135,7 @@ int pcmcia_socket_dev_resume(struct device *dev)
 EXPORT_SYMBOL(pcmcia_socket_dev_resume);
 
 
-struct pcmcia_socket * pcmcia_get_socket(struct pcmcia_socket *skt)
+struct pcmcia_socket *pcmcia_get_socket(struct pcmcia_socket *skt)
 {
 	struct device *dev = get_device(&skt->dev);
 	if (!dev)
@@ -145,7 +145,7 @@ struct pcmcia_socket * pcmcia_get_socket(struct pcmcia_socket *skt)
 		put_device(&skt->dev);
 		return NULL;
 	}
-	return (skt);
+	return skt;
 }
 EXPORT_SYMBOL(pcmcia_get_socket);
 
@@ -297,7 +297,7 @@ void pcmcia_unregister_socket(struct pcmcia_socket *socket)
 EXPORT_SYMBOL(pcmcia_unregister_socket);
 
 
-struct pcmcia_socket * pcmcia_get_socket_by_nr(unsigned int nr)
+struct pcmcia_socket *pcmcia_get_socket_by_nr(unsigned int nr)
 {
 	struct pcmcia_socket *s;
 
@@ -736,7 +736,7 @@ EXPORT_SYMBOL(pcmcia_parse_events);
 /* register pcmcia_callback */
 int pccard_register_pcmcia(struct pcmcia_socket *s, struct pcmcia_callback *c)
 {
-        int ret = 0;
+	int ret = 0;
 
 	/* s->skt_mutex also protects s->callback */
 	mutex_lock(&s->skt_mutex);
@@ -848,7 +848,7 @@ EXPORT_SYMBOL(pcmcia_suspend_card);
 int pcmcia_resume_card(struct pcmcia_socket *skt)
 {
 	int ret;
-    
+
 	dev_dbg(&skt->dev, "waking up socket\n");
 
 	mutex_lock(&skt->skt_mutex);
@@ -876,7 +876,7 @@ EXPORT_SYMBOL(pcmcia_resume_card);
 int pcmcia_eject_card(struct pcmcia_socket *skt)
 {
 	int ret;
-    
+
 	dev_dbg(&skt->dev, "user eject request\n");
 
 	mutex_lock(&skt->skt_mutex);
diff --git a/drivers/pcmcia/ds.c b/drivers/pcmcia/ds.c
index 05893d41dd41..1a4a3c49cc15 100644
--- a/drivers/pcmcia/ds.c
+++ b/drivers/pcmcia/ds.c
@@ -57,7 +57,7 @@ static void pcmcia_check_driver(struct pcmcia_driver *p_drv)
 		       "function\n", p_drv->drv.name);
 
 	while (did && did->match_flags) {
-		for (i=0; i<4; i++) {
+		for (i = 0; i < 4; i++) {
 			if (!did->prod_id[i])
 				continue;
 
@@ -105,7 +105,7 @@ pcmcia_store_new_id(struct device_driver *driver, const char *buf, size_t count)
 	__u16 match_flags, manf_id, card_id;
 	__u8 func_id, function, device_no;
 	__u32 prod_id_hash[4] = {0, 0, 0, 0};
-	int fields=0;
+	int fields = 0;
 	int retval = 0;
 
 	fields = sscanf(buf, "%hx %hx %hx %hhx %hhx %hhx %x %x %x %x",
@@ -214,7 +214,7 @@ EXPORT_SYMBOL(pcmcia_unregister_driver);
 
 /* pcmcia_device handling */
 
-struct pcmcia_device * pcmcia_get_dev(struct pcmcia_device *p_dev)
+struct pcmcia_device *pcmcia_get_dev(struct pcmcia_device *p_dev)
 {
 	struct device *tmp_dev;
 	tmp_dev = get_device(&p_dev->dev);
@@ -258,7 +258,7 @@ static void pcmcia_add_device_later(struct pcmcia_socket *s, int mfc)
 	return;
 }
 
-static int pcmcia_device_probe(struct device * dev)
+static int pcmcia_device_probe(struct device *dev)
 {
 	struct pcmcia_device *p_dev;
 	struct pcmcia_driver *p_drv;
@@ -325,7 +325,7 @@ put_module:
 put_dev:
 	if (ret)
 		put_device(dev);
-	return (ret);
+	return ret;
 }
 
 
@@ -354,7 +354,7 @@ static void pcmcia_card_remove(struct pcmcia_socket *s, struct pcmcia_device *le
 
 		spin_lock_irqsave(&pcmcia_dev_list_lock, flags);
 		list_del(&p_dev->socket_device_list);
-		p_dev->_removed=1;
+		p_dev->_removed = 1;
 		spin_unlock_irqrestore(&pcmcia_dev_list_lock, flags);
 
 		dev_dbg(&p_dev->dev, "unregistering device\n");
@@ -364,7 +364,7 @@ static void pcmcia_card_remove(struct pcmcia_socket *s, struct pcmcia_device *le
 	return;
 }
 
-static int pcmcia_device_remove(struct device * dev)
+static int pcmcia_device_remove(struct device *dev)
 {
 	struct pcmcia_device *p_dev;
 	struct pcmcia_driver *p_drv;
@@ -391,7 +391,7 @@ static int pcmcia_device_remove(struct device * dev)
 		return 0;
 
 	if (p_drv->remove)
-	       	p_drv->remove(p_dev);
+		p_drv->remove(p_dev);
 
 	p_dev->dev_node = NULL;
 
@@ -499,7 +499,7 @@ static int pcmcia_device_query(struct pcmcia_device *p_dev)
  */
 static DEFINE_MUTEX(device_add_lock);
 
-struct pcmcia_device * pcmcia_device_add(struct pcmcia_socket *s, unsigned int function)
+struct pcmcia_device *pcmcia_device_add(struct pcmcia_socket *s, unsigned int function)
 {
 	struct pcmcia_device *p_dev, *tmp_dev;
 	unsigned long flags;
@@ -545,8 +545,8 @@ struct pcmcia_device * pcmcia_device_add(struct pcmcia_socket *s, unsigned int f
 	 * Note that this is serialized by the device_add_lock, so that
 	 * only one such struct will be created.
 	 */
-        list_for_each_entry(tmp_dev, &s->devices_list, socket_device_list)
-                if (p_dev->func == tmp_dev->func) {
+	list_for_each_entry(tmp_dev, &s->devices_list, socket_device_list)
+		if (p_dev->func == tmp_dev->func) {
 			p_dev->function_config = tmp_dev->function_config;
 			p_dev->io = tmp_dev->io;
 			p_dev->irq = tmp_dev->irq;
@@ -627,10 +627,10 @@ static int pcmcia_card_add(struct pcmcia_socket *s)
 		no_funcs = 1;
 	s->functions = no_funcs;
 
-	for (i=0; i < no_funcs; i++)
+	for (i = 0; i < no_funcs; i++)
 		pcmcia_device_add(s, i);
 
-	return (ret);
+	return ret;
 }
 
 
@@ -756,7 +756,7 @@ static int pcmcia_load_firmware(struct pcmcia_device *dev, char * filename)
  release:
 	release_firmware(fw);
 
-	return (ret);
+	return ret;
 }
 
 #else /* !CONFIG_PCMCIA_LOAD_CIS */
@@ -852,7 +852,7 @@ static inline int pcmcia_devmatch(struct pcmcia_device *dev,
 
 	if (did->match_flags & PCMCIA_DEV_ID_MATCH_ANONYMOUS) {
 		int i;
-		for (i=0; i<4; i++)
+		for (i = 0; i < 4; i++)
 			if (dev->prod_id[i])
 				return 0;
 		if (dev->has_manf_id || dev->has_card_id || dev->has_func_id)
@@ -865,9 +865,10 @@ static inline int pcmcia_devmatch(struct pcmcia_device *dev,
 }
 
 
-static int pcmcia_bus_match(struct device * dev, struct device_driver * drv) {
-	struct pcmcia_device * p_dev = to_pcmcia_dev(dev);
-	struct pcmcia_driver * p_drv = to_pcmcia_drv(drv);
+static int pcmcia_bus_match(struct device *dev, struct device_driver *drv)
+{
+	struct pcmcia_device *p_dev = to_pcmcia_dev(dev);
+	struct pcmcia_driver *p_drv = to_pcmcia_drv(drv);
 	struct pcmcia_device_id *did = p_drv->id_table;
 	struct pcmcia_dynid *dynid;
 
@@ -917,7 +918,7 @@ static int pcmcia_bus_uevent(struct device *dev, struct kobj_uevent_env *env)
 	p_dev = to_pcmcia_dev(dev);
 
 	/* calculate hashes */
-	for (i=0; i<4; i++) {
+	for (i = 0; i < 4; i++) {
 		if (!p_dev->prod_id[i])
 			continue;
 		hash[i] = crc32(0, p_dev->prod_id[i], strlen(p_dev->prod_id[i]));
@@ -984,14 +985,14 @@ static void runtime_resume(struct device *dev)
 static ssize_t field##_show (struct device *dev, struct device_attribute *attr, char *buf)		\
 {									\
 	struct pcmcia_device *p_dev = to_pcmcia_dev(dev);		\
-	return p_dev->test ? sprintf (buf, format, p_dev->field) : -ENODEV; \
+	return p_dev->test ? sprintf(buf, format, p_dev->field) : -ENODEV; \
 }
 
 #define pcmcia_device_stringattr(name, field)					\
 static ssize_t name##_show (struct device *dev, struct device_attribute *attr, char *buf)		\
 {									\
 	struct pcmcia_device *p_dev = to_pcmcia_dev(dev);		\
-	return p_dev->field ? sprintf (buf, "%s\n", p_dev->field) : -ENODEV; \
+	return p_dev->field ? sprintf(buf, "%s\n", p_dev->field) : -ENODEV; \
 }
 
 pcmcia_device_attr(func, socket, "0x%02x\n");
@@ -1020,8 +1021,8 @@ static ssize_t pcmcia_store_pm_state(struct device *dev, struct device_attribute
 	struct pcmcia_device *p_dev = to_pcmcia_dev(dev);
 	int ret = 0;
 
-        if (!count)
-                return -EINVAL;
+	if (!count)
+		return -EINVAL;
 
 	if ((!p_dev->suspended) && !strncmp(buf, "off", 3))
 		ret = runtime_suspend(dev);
@@ -1039,10 +1040,11 @@ static ssize_t modalias_show(struct device *dev, struct device_attribute *attr,
 	u32 hash[4] = { 0, 0, 0, 0};
 
 	/* calculate hashes */
-	for (i=0; i<4; i++) {
+	for (i = 0; i < 4; i++) {
 		if (!p_dev->prod_id[i])
 			continue;
-		hash[i] = crc32(0,p_dev->prod_id[i],strlen(p_dev->prod_id[i]));
+		hash[i] = crc32(0, p_dev->prod_id[i],
+				strlen(p_dev->prod_id[i]));
 	}
 	return sprintf(buf, "pcmcia:m%04Xc%04Xf%02Xfn%02Xpfn%02X"
 				"pa%08Xpb%08Xpc%08Xpd%08X\n",
@@ -1091,7 +1093,7 @@ static struct device_attribute pcmcia_dev_attrs[] = {
 
 /* PM support, also needed for reset */
 
-static int pcmcia_dev_suspend(struct device * dev, pm_message_t state)
+static int pcmcia_dev_suspend(struct device *dev, pm_message_t state)
 {
 	struct pcmcia_device *p_dev = to_pcmcia_dev(dev);
 	struct pcmcia_driver *p_drv = NULL;
@@ -1131,10 +1133,10 @@ static int pcmcia_dev_suspend(struct device * dev, pm_message_t state)
 }
 
 
-static int pcmcia_dev_resume(struct device * dev)
+static int pcmcia_dev_resume(struct device *dev)
 {
 	struct pcmcia_device *p_dev = to_pcmcia_dev(dev);
-        struct pcmcia_driver *p_drv = NULL;
+	struct pcmcia_driver *p_drv = NULL;
 	int ret = 0;
 
 	if (!p_dev->suspended)
@@ -1211,7 +1213,7 @@ static int pcmcia_bus_suspend(struct pcmcia_socket *skt)
 /*======================================================================
 
     The card status event handler.
-    
+
 ======================================================================*/
 
 /* Normally, the event is passed to individual drivers after
@@ -1264,7 +1266,7 @@ static int ds_event(struct pcmcia_socket *skt, event_t event, int priority)
 } /* ds_event */
 
 
-struct pcmcia_device * pcmcia_dev_present(struct pcmcia_device *_p_dev)
+struct pcmcia_device *pcmcia_dev_present(struct pcmcia_device *_p_dev)
 {
 	struct pcmcia_device *p_dev;
 	struct pcmcia_device *ret = NULL;
@@ -1329,7 +1331,7 @@ static int __devinit pcmcia_bus_add_socket(struct device *dev,
 	if (ret) {
 		dev_printk(KERN_ERR, dev, "PCMCIA registration failed\n");
 		pcmcia_put_socket(socket);
-		return (ret);
+		return ret;
 	}
 
 	return 0;
@@ -1400,7 +1402,7 @@ static int __init init_pcmcia_bus(void)
 
 	return 0;
 }
-fs_initcall(init_pcmcia_bus); /* one level after subsys_initcall so that 
+fs_initcall(init_pcmcia_bus); /* one level after subsys_initcall so that
 			       * pcmcia_socket_class is already registered */
 
 
diff --git a/drivers/pcmcia/pcmcia_ioctl.c b/drivers/pcmcia/pcmcia_ioctl.c
index c4d7908fa37f..f73fd5beaa37 100644
--- a/drivers/pcmcia/pcmcia_ioctl.c
+++ b/drivers/pcmcia/pcmcia_ioctl.c
@@ -88,12 +88,12 @@ static struct pcmcia_driver *get_pcmcia_driver(dev_info_t *dev_info)
 
 	p_drv = container_of(drv, struct pcmcia_driver, drv);
 
-	return (p_drv);
+	return p_drv;
 }
 
 
 #ifdef CONFIG_PROC_FS
-static struct proc_dir_entry *proc_pccard = NULL;
+static struct proc_dir_entry *proc_pccard;
 
 static int proc_read_drivers_callback(struct device_driver *driver, void *_m)
 {
@@ -158,7 +158,8 @@ static int adjust_irq(struct pcmcia_socket *s, adjust_t *adj)
 
 #else
 
-static inline int adjust_irq(struct pcmcia_socket *s, adjust_t *adj) {
+static inline int adjust_irq(struct pcmcia_socket *s, adjust_t *adj)
+{
 	return 0;
 }
 
@@ -195,7 +196,7 @@ static int pcmcia_adjust_resource_info(adjust_t *adj)
 				begin = adj->resource.memory.Base;
 				end = adj->resource.memory.Base + adj->resource.memory.Size - 1;
 				if (s->resource_ops->add_mem)
-					ret =s->resource_ops->add_mem(s, adj->Action, begin, end);
+					ret = s->resource_ops->add_mem(s, adj->Action, begin, end);
 			case RES_IO_RANGE:
 				begin = adj->resource.io.BasePort;
 				end = adj->resource.io.BasePort + adj->resource.io.NumPorts - 1;
@@ -215,7 +216,7 @@ static int pcmcia_adjust_resource_info(adjust_t *adj)
 	}
 	up_read(&pcmcia_socket_list_rwsem);
 
-	return (ret);
+	return ret;
 }
 
 
@@ -490,7 +491,7 @@ static int bind_request(struct pcmcia_socket *s, bind_info_t *bind_info)
 	}
 
 	spin_lock_irqsave(&pcmcia_dev_list_lock, flags);
-        list_for_each_entry(p_dev, &s->devices_list, socket_device_list) {
+	list_for_each_entry(p_dev, &s->devices_list, socket_device_list) {
 		if (p_dev->func == bind_info->function) {
 			if ((p_dev->dev.driver == &p_drv->drv)) {
 				if (p_dev->cardmgr) {
@@ -558,7 +559,7 @@ rescan:
  err_put:
 	pcmcia_put_socket(s);
 
-	return (ret);
+	return ret;
 } /* bind_request */
 
 #ifdef CONFIG_CARDBUS
@@ -655,7 +656,7 @@ static int get_device_info(struct pcmcia_socket *s, bind_info_t *bind_info, int
 
  err_put:
 	pcmcia_put_dev(p_dev);
-	return (ret);
+	return ret;
 } /* get_device_info */
 
 
@@ -664,7 +665,7 @@ static int ds_open(struct inode *inode, struct file *file)
     socket_t i = iminor(inode);
     struct pcmcia_socket *s;
     user_info_t *user;
-    static int warning_printed = 0;
+    static int warning_printed;
     int ret = 0;
 
     pr_debug("ds_open(socket %d)\n", i);
@@ -738,12 +739,13 @@ static int ds_release(struct inode *inode, struct file *file)
     s = user->socket;
 
     /* Unlink user data structure */
-    if ((file->f_flags & O_ACCMODE) != O_RDONLY) {
+    if ((file->f_flags & O_ACCMODE) != O_RDONLY)
 	s->pcmcia_state.busy = 0;
-    }
+
     file->private_data = NULL;
     for (link = &s->user; *link; link = &(*link)->next)
-	if (*link == user) break;
+	if (*link == user)
+		break;
     if (link == NULL)
 	goto out;
     *link = user->next;
@@ -774,7 +776,7 @@ static ssize_t ds_read(struct file *file, char __user *buf,
 
     s = user->socket;
     if (s->pcmcia_state.dead)
-        return -EIO;
+	return -EIO;
 
     ret = wait_event_interruptible(s->queue, !queue_empty(user));
     if (ret == 0)
@@ -824,7 +826,7 @@ static u_int ds_poll(struct file *file, poll_table *wait)
 
 /*====================================================================*/
 
-static int ds_ioctl(struct inode * inode, struct file * file,
+static int ds_ioctl(struct inode *inode, struct file *file,
 		    u_int cmd, u_long arg)
 {
     struct pcmcia_socket *s;
@@ -842,10 +844,11 @@ static int ds_ioctl(struct inode * inode, struct file * file,
 
     s = user->socket;
     if (s->pcmcia_state.dead)
-        return -EIO;
+	return -EIO;
 
     size = (cmd & IOCSIZE_MASK) >> IOCSIZE_SHIFT;
-    if (size > sizeof(ds_ioctl_arg_t)) return -EINVAL;
+    if (size > sizeof(ds_ioctl_arg_t))
+	return -EINVAL;
 
     /* Permission check */
     if (!(cmd & IOC_OUT) && !capable(CAP_SYS_ADMIN))
@@ -1024,8 +1027,8 @@ static int ds_ioctl(struct inode * inode, struct file * file,
     }
 
     if (cmd & IOC_OUT) {
-        if (__copy_to_user(uarg, (char *)buf, size))
-            err = -EFAULT;
+	if (__copy_to_user(uarg, (char *)buf, size))
+		err = -EFAULT;
     }
 
 free_out:
@@ -1045,7 +1048,8 @@ static const struct file_operations ds_fops = {
 	.poll		= ds_poll,
 };
 
-void __init pcmcia_setup_ioctl(void) {
+void __init pcmcia_setup_ioctl(void)
+{
 	int i;
 
 	/* Set up character device for user mode clients */
@@ -1064,7 +1068,8 @@ void __init pcmcia_setup_ioctl(void) {
 }
 
 
-void __exit pcmcia_cleanup_ioctl(void) {
+void __exit pcmcia_cleanup_ioctl(void)
+{
 #ifdef CONFIG_PROC_FS
 	if (proc_pccard) {
 		remove_proc_entry("drivers", proc_pccard);
diff --git a/drivers/pcmcia/pcmcia_resource.c b/drivers/pcmcia/pcmcia_resource.c
index a8bf8c1b45ed..d5db95644b64 100644
--- a/drivers/pcmcia/pcmcia_resource.c
+++ b/drivers/pcmcia/pcmcia_resource.c
@@ -33,7 +33,7 @@
 
 
 /* Access speed for IO windows */
-static int io_speed = 0;
+static int io_speed;
 module_param(io_speed, int, 0444);
 
 
@@ -62,7 +62,8 @@ static int alloc_io_space(struct pcmcia_socket *s, u_int attr,
 			       num, align);
 			align = 0;
 		} else
-			while (align && (align < num)) align <<= 1;
+			while (align && (align < num))
+				align <<= 1;
 	}
 	if (*base & ~(align-1)) {
 		dev_dbg(&s->dev, "odd IO request: base %#x align %#x\n",
@@ -338,7 +339,7 @@ static int pcmcia_release_io(struct pcmcia_device *p_dev, io_req_t *req)
 	struct pcmcia_socket *s = p_dev->socket;
 	config_t *c = p_dev->function_config;
 
-	if (!p_dev->_io )
+	if (!p_dev->_io)
 		return -EINVAL;
 
 	p_dev->_io = 0;
@@ -362,7 +363,7 @@ static int pcmcia_release_io(struct pcmcia_device *p_dev, io_req_t *req)
 static int pcmcia_release_irq(struct pcmcia_device *p_dev, irq_req_t *req)
 {
 	struct pcmcia_socket *s = p_dev->socket;
-	config_t *c= p_dev->function_config;
+	config_t *c = p_dev->function_config;
 
 	if (!p_dev->_irq)
 		return -EINVAL;
@@ -383,9 +384,8 @@ static int pcmcia_release_irq(struct pcmcia_device *p_dev, irq_req_t *req)
 		s->irq.AssignedIRQ = 0;
 	}
 
-	if (req->Handler) {
+	if (req->Handler)
 		free_irq(req->AssignedIRQ, p_dev->priv);
-	}
 
 #ifdef CONFIG_PCMCIA_PROBE
 	pcmcia_used_irq[req->AssignedIRQ]--;
@@ -656,7 +656,8 @@ int pcmcia_request_irq(struct pcmcia_device *p_dev, irq_req_t *req)
 		type = IRQF_SHARED;
 	else if (req->Attributes & IRQ_TYPE_DYNAMIC_SHARING)
 		type = IRQF_SHARED;
-	else printk(KERN_WARNING "pcmcia: Driver needs updating to support IRQ sharing.\n");
+	else
+		printk(KERN_WARNING "pcmcia: Driver needs updating to support IRQ sharing.\n");
 
 #ifdef CONFIG_PCMCIA_PROBE
 
@@ -788,7 +789,8 @@ int pcmcia_request_window(struct pcmcia_device *p_dev, win_req_t *req, window_ha
 
 	/* Allocate system memory window */
 	for (w = 0; w < MAX_WIN; w++)
-		if (!(s->state & SOCKET_WIN_REQ(w))) break;
+		if (!(s->state & SOCKET_WIN_REQ(w)))
+			break;
 	if (w == MAX_WIN) {
 		dev_dbg(&s->dev, "all windows are used already\n");
 		return -EINVAL;
@@ -826,18 +828,19 @@ int pcmcia_request_window(struct pcmcia_device *p_dev, win_req_t *req, window_ha
 	s->state |= SOCKET_WIN_REQ(w);
 
 	/* Return window handle */
-	if (s->features & SS_CAP_STATIC_MAP) {
+	if (s->features & SS_CAP_STATIC_MAP)
 		req->Base = win->static_start;
-	} else {
+	else
 		req->Base = win->res->start;
-	}
+
 	*wh = w + 1;
 
 	return 0;
 } /* pcmcia_request_window */
 EXPORT_SYMBOL(pcmcia_request_window);
 
-void pcmcia_disable_device(struct pcmcia_device *p_dev) {
+void pcmcia_disable_device(struct pcmcia_device *p_dev)
+{
 	pcmcia_release_configuration(p_dev);
 	pcmcia_release_io(p_dev, &p_dev->io);
 	pcmcia_release_irq(p_dev, &p_dev->irq);
@@ -970,7 +973,7 @@ int pcmcia_loop_tuple(struct pcmcia_device *p_dev, cisdata_t code,
 
 	return pccard_loop_tuple(p_dev->socket, p_dev->func, code, NULL,
 				 &loop, pcmcia_do_loop_tuple);
-};
+}
 EXPORT_SYMBOL(pcmcia_loop_tuple);
 
 
@@ -1000,7 +1003,7 @@ static int pcmcia_do_get_tuple(struct pcmcia_device *p_dev, tuple_t *tuple,
 	} else
 		dev_dbg(&p_dev->dev, "do_get_tuple: out of memory\n");
 	return 0;
-};
+}
 
 /**
  * pcmcia_get_tuple() - get first tuple from CIS
@@ -1024,7 +1027,7 @@ size_t pcmcia_get_tuple(struct pcmcia_device *p_dev, cisdata_t code,
 	pcmcia_loop_tuple(p_dev, code, pcmcia_do_get_tuple, &get);
 
 	return get.len;
-};
+}
 EXPORT_SYMBOL(pcmcia_get_tuple);
 
 
@@ -1057,7 +1060,7 @@ static int pcmcia_do_get_mac(struct pcmcia_device *p_dev, tuple_t *tuple,
 	for (i = 0; i < 6; i++)
 		dev->dev_addr[i] = tuple->TupleData[i+2];
 	return 0;
-};
+}
 
 /**
  * pcmcia_get_mac_from_cis() - read out MAC address from CISTPL_FUNCE
@@ -1071,6 +1074,6 @@ static int pcmcia_do_get_mac(struct pcmcia_device *p_dev, tuple_t *tuple,
 int pcmcia_get_mac_from_cis(struct pcmcia_device *p_dev, struct net_device *dev)
 {
 	return pcmcia_loop_tuple(p_dev, CISTPL_FUNCE, pcmcia_do_get_mac, dev);
-};
+}
 EXPORT_SYMBOL(pcmcia_get_mac_from_cis);
 
diff --git a/drivers/pcmcia/pxa2xx_base.c b/drivers/pcmcia/pxa2xx_base.c
index 84dde7768ad5..76e640bccde8 100644
--- a/drivers/pcmcia/pxa2xx_base.c
+++ b/drivers/pcmcia/pxa2xx_base.c
@@ -214,7 +214,8 @@ static void pxa2xx_configure_sockets(struct device *dev)
 	MECR |= MECR_CIT;
 
 	/* Set MECR:NOS (Number Of Sockets) */
-	if ((ops->first + ops->nr) > 1 || machine_is_viper())
+	if ((ops->first + ops->nr) > 1 ||
+	    machine_is_viper() || machine_is_arcom_zeus())
 		MECR |= MECR_NOS;
 	else
 		MECR &= ~MECR_NOS;
@@ -252,6 +253,7 @@ int pxa2xx_drv_pcmcia_add_one(struct soc_pcmcia_socket *skt)
 
 	return soc_pcmcia_add_one(skt);
 }
+EXPORT_SYMBOL(pxa2xx_drv_pcmcia_add_one);
 
 void pxa2xx_drv_pcmcia_ops(struct pcmcia_low_level *ops)
 {
@@ -261,19 +263,19 @@ void pxa2xx_drv_pcmcia_ops(struct pcmcia_low_level *ops)
 	ops->frequency_change = pxa2xx_pcmcia_frequency_change;
 #endif
 }
+EXPORT_SYMBOL(pxa2xx_drv_pcmcia_ops);
 
-int __pxa2xx_drv_pcmcia_probe(struct device *dev)
+static int pxa2xx_drv_pcmcia_probe(struct platform_device *dev)
 {
 	int i, ret = 0;
 	struct pcmcia_low_level *ops;
 	struct skt_dev_info *sinfo;
 	struct soc_pcmcia_socket *skt;
 
-	if (!dev || !dev->platform_data)
+	ops = (struct pcmcia_low_level *)dev->dev.platform_data;
+	if (!ops)
 		return -ENODEV;
 
-	ops = (struct pcmcia_low_level *)dev->platform_data;
-
 	pxa2xx_drv_pcmcia_ops(ops);
 
 	sinfo = kzalloc(SKT_DEV_INFO_SIZE(ops->nr), GFP_KERNEL);
@@ -289,7 +291,7 @@ int __pxa2xx_drv_pcmcia_probe(struct device *dev)
 		skt->nr = ops->first + i;
 		skt->ops = ops;
 		skt->socket.owner = ops->owner;
-		skt->socket.dev.parent = dev;
+		skt->socket.dev.parent = &dev->dev;
 		skt->socket.pci_irq = NO_IRQ;
 
 		ret = pxa2xx_drv_pcmcia_add_one(skt);
@@ -302,19 +304,12 @@ int __pxa2xx_drv_pcmcia_probe(struct device *dev)
 			soc_pcmcia_remove_one(&sinfo->skt[i]);
 		kfree(sinfo);
 	} else {
-		pxa2xx_configure_sockets(dev);
-		dev_set_drvdata(dev, sinfo);
+		pxa2xx_configure_sockets(&dev->dev);
+		dev_set_drvdata(&dev->dev, sinfo);
 	}
 
 	return ret;
 }
-EXPORT_SYMBOL(__pxa2xx_drv_pcmcia_probe);
-
-
-static int pxa2xx_drv_pcmcia_probe(struct platform_device *dev)
-{
-	return __pxa2xx_drv_pcmcia_probe(&dev->dev);
-}
 
 static int pxa2xx_drv_pcmcia_remove(struct platform_device *dev)
 {
@@ -341,7 +336,7 @@ static int pxa2xx_drv_pcmcia_resume(struct device *dev)
 	return pcmcia_socket_dev_resume(dev);
 }
 
-static struct dev_pm_ops  pxa2xx_drv_pcmcia_pm_ops = {
+static const struct dev_pm_ops pxa2xx_drv_pcmcia_pm_ops = {
 	.suspend	= pxa2xx_drv_pcmcia_suspend,
 	.resume		= pxa2xx_drv_pcmcia_resume,
 };
diff --git a/drivers/pcmcia/pxa2xx_base.h b/drivers/pcmcia/pxa2xx_base.h
index cb5efaec886f..bb62ea87b8f9 100644
--- a/drivers/pcmcia/pxa2xx_base.h
+++ b/drivers/pcmcia/pxa2xx_base.h
@@ -1,6 +1,3 @@
-/* temporary measure */
-extern int __pxa2xx_drv_pcmcia_probe(struct device *);
-
 int pxa2xx_drv_pcmcia_add_one(struct soc_pcmcia_socket *skt);
 void pxa2xx_drv_pcmcia_ops(struct pcmcia_low_level *ops);
 
diff --git a/drivers/pcmcia/pxa2xx_palmtc.c b/drivers/pcmcia/pxa2xx_palmtc.c
index 3a8993ed5621..459a232d66be 100644
--- a/drivers/pcmcia/pxa2xx_palmtc.c
+++ b/drivers/pcmcia/pxa2xx_palmtc.c
@@ -67,7 +67,7 @@ static int palmtc_pcmcia_hw_init(struct soc_pcmcia_socket *skt)
 	if (ret)
 		goto err7;
 
-	skt->irq = IRQ_GPIO(GPIO_NR_PALMTC_PCMCIA_READY);
+	skt->socket.pci_irq = IRQ_GPIO(GPIO_NR_PALMTC_PCMCIA_READY);
 	return 0;
 
 err7:
diff --git a/drivers/pcmcia/pxa2xx_stargate2.c b/drivers/pcmcia/pxa2xx_stargate2.c
index 490749ea677f..d08802fe35f9 100644
--- a/drivers/pcmcia/pxa2xx_stargate2.c
+++ b/drivers/pcmcia/pxa2xx_stargate2.c
@@ -40,7 +40,7 @@ static struct pcmcia_irqs irqs[] = {
 
 static int sg2_pcmcia_hw_init(struct soc_pcmcia_socket *skt)
 {
-	skt->irq = IRQ_GPIO(SG2_S0_GPIO_READY);
+	skt->socket.pci_irq = IRQ_GPIO(SG2_S0_GPIO_READY);
 	return soc_pcmcia_request_irqs(skt, irqs, ARRAY_SIZE(irqs));
 }
 
diff --git a/drivers/pcmcia/pxa2xx_viper.c b/drivers/pcmcia/pxa2xx_viper.c
index 27be2e154df2..a51f2077644a 100644
--- a/drivers/pcmcia/pxa2xx_viper.c
+++ b/drivers/pcmcia/pxa2xx_viper.c
@@ -1,9 +1,8 @@
 /*
- * VIPER PCMCIA support
+ * Viper/Zeus PCMCIA support
  *   Copyright 2004 Arcom Control Systems
  *
  * Maintained by Marc Zyngier <maz@misterjones.org>
- * 			      <marc.zyngier@altran.com>
  *
  * Based on:
  *   iPAQ h2200 PCMCIA support
@@ -26,37 +25,47 @@
 
 #include <asm/irq.h>
 
-#include <mach/viper.h>
-#include <asm/mach-types.h>
+#include <mach/arcom-pcmcia.h>
 
 #include "soc_common.h"
 #include "pxa2xx_base.h"
 
+static struct platform_device *arcom_pcmcia_dev;
+
 static struct pcmcia_irqs irqs[] = {
-	{ 0, gpio_to_irq(VIPER_CF_CD_GPIO),  "PCMCIA_CD" }
+	{
+		.sock	= 0,
+		.str	= "PCMCIA_CD",
+	},
 };
 
+static inline struct arcom_pcmcia_pdata *viper_get_pdata(void)
+{
+	return arcom_pcmcia_dev->dev.platform_data;
+}
+
 static int viper_pcmcia_hw_init(struct soc_pcmcia_socket *skt)
 {
+	struct arcom_pcmcia_pdata *pdata = viper_get_pdata();
 	unsigned long flags;
 
-	skt->socket.pci_irq = gpio_to_irq(VIPER_CF_RDY_GPIO);
+	skt->socket.pci_irq = gpio_to_irq(pdata->rdy_gpio);
+	irqs[0].irq = gpio_to_irq(pdata->cd_gpio);
 
-	if (gpio_request(VIPER_CF_CD_GPIO, "CF detect"))
+	if (gpio_request(pdata->cd_gpio, "CF detect"))
 		goto err_request_cd;
 
-	if (gpio_request(VIPER_CF_RDY_GPIO, "CF ready"))
+	if (gpio_request(pdata->rdy_gpio, "CF ready"))
 		goto err_request_rdy;
 
-	if (gpio_request(VIPER_CF_POWER_GPIO, "CF power"))
+	if (gpio_request(pdata->pwr_gpio, "CF power"))
 		goto err_request_pwr;
 
 	local_irq_save(flags);
 
-	/* GPIO 82 is the CF power enable line. initially off */
-	if (gpio_direction_output(VIPER_CF_POWER_GPIO, 0) ||
-	    gpio_direction_input(VIPER_CF_CD_GPIO) ||
-	    gpio_direction_input(VIPER_CF_RDY_GPIO)) {
+	if (gpio_direction_output(pdata->pwr_gpio, 0) ||
+	    gpio_direction_input(pdata->cd_gpio) ||
+	    gpio_direction_input(pdata->rdy_gpio)) {
 		local_irq_restore(flags);
 		goto err_dir;
 	}
@@ -66,13 +75,13 @@ static int viper_pcmcia_hw_init(struct soc_pcmcia_socket *skt)
 	return soc_pcmcia_request_irqs(skt, irqs, ARRAY_SIZE(irqs));
 
 err_dir:
-	gpio_free(VIPER_CF_POWER_GPIO);
+	gpio_free(pdata->pwr_gpio);
 err_request_pwr:
-	gpio_free(VIPER_CF_RDY_GPIO);
+	gpio_free(pdata->rdy_gpio);
 err_request_rdy:
-	gpio_free(VIPER_CF_CD_GPIO);
+	gpio_free(pdata->cd_gpio);
 err_request_cd:
-	printk(KERN_ERR "viper: Failed to setup PCMCIA GPIOs\n");
+	dev_err(&arcom_pcmcia_dev->dev, "Failed to setup PCMCIA GPIOs\n");
 	return -1;
 }
 
@@ -81,17 +90,21 @@ err_request_cd:
  */
 static void viper_pcmcia_hw_shutdown(struct soc_pcmcia_socket *skt)
 {
+	struct arcom_pcmcia_pdata *pdata = viper_get_pdata();
+
 	soc_pcmcia_free_irqs(skt, irqs, ARRAY_SIZE(irqs));
-	gpio_free(VIPER_CF_POWER_GPIO);
-	gpio_free(VIPER_CF_RDY_GPIO);
-	gpio_free(VIPER_CF_CD_GPIO);
+	gpio_free(pdata->pwr_gpio);
+	gpio_free(pdata->rdy_gpio);
+	gpio_free(pdata->cd_gpio);
 }
 
 static void viper_pcmcia_socket_state(struct soc_pcmcia_socket *skt,
 				      struct pcmcia_state *state)
 {
-	state->detect = gpio_get_value(VIPER_CF_CD_GPIO) ? 0 : 1;
-	state->ready  = gpio_get_value(VIPER_CF_RDY_GPIO) ? 1 : 0;
+	struct arcom_pcmcia_pdata *pdata = viper_get_pdata();
+
+	state->detect = !gpio_get_value(pdata->cd_gpio);
+	state->ready  = !!gpio_get_value(pdata->rdy_gpio);
 	state->bvd1   = 1;
 	state->bvd2   = 1;
 	state->wrprot = 0;
@@ -102,20 +115,21 @@ static void viper_pcmcia_socket_state(struct soc_pcmcia_socket *skt,
 static int viper_pcmcia_configure_socket(struct soc_pcmcia_socket *skt,
 					 const socket_state_t *state)
 {
+	struct arcom_pcmcia_pdata *pdata = viper_get_pdata();
+
 	/* Silently ignore Vpp, output enable, speaker enable. */
-	viper_cf_rst(state->flags & SS_RESET);
+	pdata->reset(state->flags & SS_RESET);
 
 	/* Apply socket voltage */
 	switch (state->Vcc) {
 	case 0:
-		gpio_set_value(VIPER_CF_POWER_GPIO, 0);
+		gpio_set_value(pdata->pwr_gpio, 0);
 		break;
 	case 33:
-		gpio_set_value(VIPER_CF_POWER_GPIO, 1);
+		gpio_set_value(pdata->pwr_gpio, 1);
 		break;
 	default:
-		printk(KERN_ERR "%s: Unsupported Vcc:%d\n",
-		       __func__, state->Vcc);
+		dev_err(&arcom_pcmcia_dev->dev, "Unsupported Vcc:%d\n", state->Vcc);
 		return -1;
 	}
 
@@ -130,7 +144,7 @@ static void viper_pcmcia_socket_suspend(struct soc_pcmcia_socket *skt)
 {
 }
 
-static struct pcmcia_low_level viper_pcmcia_ops __initdata = {
+static struct pcmcia_low_level viper_pcmcia_ops = {
 	.owner          	= THIS_MODULE,
 	.hw_init        	= viper_pcmcia_hw_init,
 	.hw_shutdown		= viper_pcmcia_hw_shutdown,
@@ -143,17 +157,25 @@ static struct pcmcia_low_level viper_pcmcia_ops __initdata = {
 
 static struct platform_device *viper_pcmcia_device;
 
-static int __init viper_pcmcia_init(void)
+static int viper_pcmcia_probe(struct platform_device *pdev)
 {
 	int ret;
 
-	if (!machine_is_viper())
-		return -ENODEV;
+	/* I can't imagine more than one device, but you never know... */
+	if (arcom_pcmcia_dev)
+		return -EEXIST;
+
+	if (!pdev->dev.platform_data)
+		return -EINVAL;
 
 	viper_pcmcia_device = platform_device_alloc("pxa2xx-pcmcia", -1);
 	if (!viper_pcmcia_device)
 		return -ENOMEM;
 
+	arcom_pcmcia_dev = pdev;
+
+	viper_pcmcia_device->dev.parent = &pdev->dev;
+
 	ret = platform_device_add_data(viper_pcmcia_device,
 				       &viper_pcmcia_ops,
 				       sizeof(viper_pcmcia_ops));
@@ -161,18 +183,49 @@ static int __init viper_pcmcia_init(void)
 	if (!ret)
 		ret = platform_device_add(viper_pcmcia_device);
 
-	if (ret)
+	if (ret) {
 		platform_device_put(viper_pcmcia_device);
+		arcom_pcmcia_dev = NULL;
+	}
 
 	return ret;
 }
 
-static void __exit viper_pcmcia_exit(void)
+static int viper_pcmcia_remove(struct platform_device *pdev)
 {
 	platform_device_unregister(viper_pcmcia_device);
+	arcom_pcmcia_dev = NULL;
+	return 0;
+}
+
+static struct platform_device_id viper_pcmcia_id_table[] = {
+	{ .name = "viper-pcmcia", },
+	{ .name = "zeus-pcmcia",  },
+	{ },
+};
+
+static struct platform_driver viper_pcmcia_driver = {
+	.probe		= viper_pcmcia_probe,
+	.remove		= viper_pcmcia_remove,
+	.driver		= {
+		.name	= "arcom-pcmcia",
+		.owner	= THIS_MODULE,
+	},
+	.id_table	= viper_pcmcia_id_table,
+};
+
+static int __init viper_pcmcia_init(void)
+{
+	return platform_driver_register(&viper_pcmcia_driver);
+}
+
+static void __exit viper_pcmcia_exit(void)
+{
+	return platform_driver_unregister(&viper_pcmcia_driver);
 }
 
 module_init(viper_pcmcia_init);
 module_exit(viper_pcmcia_exit);
 
+MODULE_DEVICE_TABLE(platform, viper_pcmcia_id_table);
 MODULE_LICENSE("GPL");
diff --git a/drivers/pcmcia/rsrc_mgr.c b/drivers/pcmcia/rsrc_mgr.c
index de0e770ce6a3..52db17263d8b 100644
--- a/drivers/pcmcia/rsrc_mgr.c
+++ b/drivers/pcmcia/rsrc_mgr.c
@@ -126,16 +126,16 @@ static void pcmcia_align(void *align_data, struct resource *res,
 	res->start = start;
 
 #ifdef CONFIG_X86
-        if (res->flags & IORESOURCE_IO) {
-                if (start & 0x300) {
-                        start = (start + 0x3ff) & ~0x3ff;
-                        res->start = start;
-                }
-        }
+	if (res->flags & IORESOURCE_IO) {
+		if (start & 0x300) {
+			start = (start + 0x3ff) & ~0x3ff;
+			res->start = start;
+		}
+	}
 #endif
 
 #ifdef CONFIG_M68K
-        if (res->flags & IORESOURCE_IO) {
+	if (res->flags & IORESOURCE_IO) {
 		if ((res->start + size - 1) >= 1024)
 			res->start = res->end;
 	}
diff --git a/drivers/pcmcia/rsrc_nonstatic.c b/drivers/pcmcia/rsrc_nonstatic.c
index 7039f3cf5b77..9b0dc433a8c3 100644
--- a/drivers/pcmcia/rsrc_nonstatic.c
+++ b/drivers/pcmcia/rsrc_nonstatic.c
@@ -24,9 +24,9 @@
 #include <linux/timer.h>
 #include <linux/pci.h>
 #include <linux/device.h>
+#include <linux/io.h>
 
 #include <asm/irq.h>
-#include <asm/io.h>
 
 #include <pcmcia/cs_types.h>
 #include <pcmcia/ss.h>
@@ -144,43 +144,44 @@ static int add_interval(struct resource_map *map, u_long base, u_long num)
 
 static int sub_interval(struct resource_map *map, u_long base, u_long num)
 {
-    struct resource_map *p, *q;
-
-    for (p = map; ; p = q) {
-	q = p->next;
-	if (q == map)
-	    break;
-	if ((q->base+q->num > base) && (base+num > q->base)) {
-	    if (q->base >= base) {
-		if (q->base+q->num <= base+num) {
-		    /* Delete whole block */
-		    p->next = q->next;
-		    kfree(q);
-		    /* don't advance the pointer yet */
-		    q = p;
-		} else {
-		    /* Cut off bit from the front */
-		    q->num = q->base + q->num - base - num;
-		    q->base = base + num;
-		}
-	    } else if (q->base+q->num <= base+num) {
-		/* Cut off bit from the end */
-		q->num = base - q->base;
-	    } else {
-		/* Split the block into two pieces */
-		p = kmalloc(sizeof(struct resource_map), GFP_KERNEL);
-		if (!p) {
-		    printk(KERN_WARNING "out of memory to update resources\n");
-		    return -ENOMEM;
+	struct resource_map *p, *q;
+
+	for (p = map; ; p = q) {
+		q = p->next;
+		if (q == map)
+			break;
+		if ((q->base+q->num > base) && (base+num > q->base)) {
+			if (q->base >= base) {
+				if (q->base+q->num <= base+num) {
+					/* Delete whole block */
+					p->next = q->next;
+					kfree(q);
+					/* don't advance the pointer yet */
+					q = p;
+				} else {
+					/* Cut off bit from the front */
+					q->num = q->base + q->num - base - num;
+					q->base = base + num;
+				}
+			} else if (q->base+q->num <= base+num) {
+				/* Cut off bit from the end */
+				q->num = base - q->base;
+			} else {
+				/* Split the block into two pieces */
+				p = kmalloc(sizeof(struct resource_map),
+					GFP_KERNEL);
+				if (!p) {
+					printk(KERN_WARNING "out of memory to update resources\n");
+					return -ENOMEM;
+				}
+				p->base = base+num;
+				p->num = q->base+q->num - p->base;
+				q->num = base - q->base;
+				p->next = q->next ; q->next = p;
+			}
 		}
-		p->base = base+num;
-		p->num = q->base+q->num - p->base;
-		q->num = base - q->base;
-		p->next = q->next ; q->next = p;
-	    }
 	}
-    }
-    return 0;
+	return 0;
 }
 
 /*======================================================================
@@ -194,69 +195,72 @@ static int sub_interval(struct resource_map *map, u_long base, u_long num)
 static void do_io_probe(struct pcmcia_socket *s, unsigned int base,
 			unsigned int num)
 {
-    struct resource *res;
-    struct socket_data *s_data = s->resource_data;
-    unsigned int i, j, bad;
-    int any;
-    u_char *b, hole, most;
-
-    dev_printk(KERN_INFO, &s->dev, "cs: IO port probe %#x-%#x:",
-	       base, base+num-1);
-
-    /* First, what does a floating port look like? */
-    b = kzalloc(256, GFP_KERNEL);
-    if (!b) {
-	    printk("\n");
-	    dev_printk(KERN_ERR, &s->dev,
-		   "do_io_probe: unable to kmalloc 256 bytes");
-            return;
-    }
-    for (i = base, most = 0; i < base+num; i += 8) {
-	res = claim_region(NULL, i, 8, IORESOURCE_IO, "PCMCIA IO probe");
-	if (!res)
-	    continue;
-	hole = inb(i);
-	for (j = 1; j < 8; j++)
-	    if (inb(i+j) != hole) break;
-	free_region(res);
-	if ((j == 8) && (++b[hole] > b[most]))
-	    most = hole;
-	if (b[most] == 127) break;
-    }
-    kfree(b);
-
-    bad = any = 0;
-    for (i = base; i < base+num; i += 8) {
-	res = claim_region(NULL, i, 8, IORESOURCE_IO, "PCMCIA IO probe");
-	if (!res)
-	    continue;
-	for (j = 0; j < 8; j++)
-	    if (inb(i+j) != most) break;
-	free_region(res);
-	if (j < 8) {
-	    if (!any)
-		printk(" excluding");
-	    if (!bad)
-		bad = any = i;
-	} else {
-	    if (bad) {
-		sub_interval(&s_data->io_db, bad, i-bad);
-		printk(" %#x-%#x", bad, i-1);
-		bad = 0;
-	    }
+	struct resource *res;
+	struct socket_data *s_data = s->resource_data;
+	unsigned int i, j, bad;
+	int any;
+	u_char *b, hole, most;
+
+	dev_printk(KERN_INFO, &s->dev, "cs: IO port probe %#x-%#x:",
+		base, base+num-1);
+
+	/* First, what does a floating port look like? */
+	b = kzalloc(256, GFP_KERNEL);
+	if (!b) {
+		printk("\n");
+		dev_printk(KERN_ERR, &s->dev,
+			"do_io_probe: unable to kmalloc 256 bytes");
+		return;
 	}
-    }
-    if (bad) {
-	if ((num > 16) && (bad == base) && (i == base+num)) {
-	    printk(" nothing: probe failed.\n");
-	    return;
-	} else {
-	    sub_interval(&s_data->io_db, bad, i-bad);
-	    printk(" %#x-%#x", bad, i-1);
+	for (i = base, most = 0; i < base+num; i += 8) {
+		res = claim_region(NULL, i, 8, IORESOURCE_IO, "PCMCIA ioprobe");
+		if (!res)
+			continue;
+		hole = inb(i);
+		for (j = 1; j < 8; j++)
+			if (inb(i+j) != hole)
+				break;
+		free_region(res);
+		if ((j == 8) && (++b[hole] > b[most]))
+			most = hole;
+		if (b[most] == 127)
+			break;
 	}
-    }
+	kfree(b);
 
-    printk(any ? "\n" : " clean.\n");
+	bad = any = 0;
+	for (i = base; i < base+num; i += 8) {
+		res = claim_region(NULL, i, 8, IORESOURCE_IO, "PCMCIA ioprobe");
+		if (!res)
+			continue;
+		for (j = 0; j < 8; j++)
+			if (inb(i+j) != most)
+				break;
+		free_region(res);
+		if (j < 8) {
+			if (!any)
+				printk(" excluding");
+			if (!bad)
+				bad = any = i;
+		} else {
+			if (bad) {
+				sub_interval(&s_data->io_db, bad, i-bad);
+				printk(" %#x-%#x", bad, i-1);
+				bad = 0;
+			}
+		}
+	}
+	if (bad) {
+		if ((num > 16) && (bad == base) && (i == base+num)) {
+			printk(" nothing: probe failed.\n");
+			return;
+		} else {
+			sub_interval(&s_data->io_db, bad, i-bad);
+			printk(" %#x-%#x", bad, i-1);
+		}
+	}
+
+	printk(any ? "\n" : " clean.\n");
 }
 #endif
 
@@ -327,8 +331,9 @@ cis_readable(struct pcmcia_socket *s, unsigned long base, unsigned long size)
 	unsigned int info1, info2;
 	int ret = 0;
 
-	res1 = claim_region(s, base, size/2, IORESOURCE_MEM, "cs memory probe");
-	res2 = claim_region(s, base + size/2, size/2, IORESOURCE_MEM, "cs memory probe");
+	res1 = claim_region(s, base, size/2, IORESOURCE_MEM, "PCMCIA memprobe");
+	res2 = claim_region(s, base + size/2, size/2, IORESOURCE_MEM,
+			"PCMCIA memprobe");
 
 	if (res1 && res2) {
 		ret = readable(s, res1, &info1);
@@ -347,8 +352,9 @@ checksum_match(struct pcmcia_socket *s, unsigned long base, unsigned long size)
 	struct resource *res1, *res2;
 	int a = -1, b = -1;
 
-	res1 = claim_region(s, base, size/2, IORESOURCE_MEM, "cs memory probe");
-	res2 = claim_region(s, base + size/2, size/2, IORESOURCE_MEM, "cs memory probe");
+	res1 = claim_region(s, base, size/2, IORESOURCE_MEM, "PCMCIA memprobe");
+	res2 = claim_region(s, base + size/2, size/2, IORESOURCE_MEM,
+			"PCMCIA memprobe");
 
 	if (res1 && res2) {
 		a = checksum(s, res1);
@@ -371,42 +377,43 @@ checksum_match(struct pcmcia_socket *s, unsigned long base, unsigned long size)
 
 static int do_mem_probe(u_long base, u_long num, struct pcmcia_socket *s)
 {
-    struct socket_data *s_data = s->resource_data;
-    u_long i, j, bad, fail, step;
-
-    dev_printk(KERN_INFO, &s->dev, "cs: memory probe 0x%06lx-0x%06lx:",
-	       base, base+num-1);
-    bad = fail = 0;
-    step = (num < 0x20000) ? 0x2000 : ((num>>4) & ~0x1fff);
-    /* don't allow too large steps */
-    if (step > 0x800000)
-	step = 0x800000;
-    /* cis_readable wants to map 2x map_size */
-    if (step < 2 * s->map_size)
-	step = 2 * s->map_size;
-    for (i = j = base; i < base+num; i = j + step) {
-	if (!fail) {
-	    for (j = i; j < base+num; j += step) {
-		if (cis_readable(s, j, step))
-		    break;
-	    }
-	    fail = ((i == base) && (j == base+num));
-	}
-	if (fail) {
-	    for (j = i; j < base+num; j += 2*step)
-		if (checksum_match(s, j, step) &&
-		    checksum_match(s, j + step, step))
-		    break;
-	}
-	if (i != j) {
-	    if (!bad) printk(" excluding");
-	    printk(" %#05lx-%#05lx", i, j-1);
-	    sub_interval(&s_data->mem_db, i, j-i);
-	    bad += j-i;
+	struct socket_data *s_data = s->resource_data;
+	u_long i, j, bad, fail, step;
+
+	dev_printk(KERN_INFO, &s->dev, "cs: memory probe 0x%06lx-0x%06lx:",
+		base, base+num-1);
+	bad = fail = 0;
+	step = (num < 0x20000) ? 0x2000 : ((num>>4) & ~0x1fff);
+	/* don't allow too large steps */
+	if (step > 0x800000)
+		step = 0x800000;
+	/* cis_readable wants to map 2x map_size */
+	if (step < 2 * s->map_size)
+		step = 2 * s->map_size;
+	for (i = j = base; i < base+num; i = j + step) {
+		if (!fail) {
+			for (j = i; j < base+num; j += step) {
+				if (cis_readable(s, j, step))
+					break;
+			}
+			fail = ((i == base) && (j == base+num));
+		}
+		if (fail) {
+			for (j = i; j < base+num; j += 2*step)
+				if (checksum_match(s, j, step) &&
+					checksum_match(s, j + step, step))
+					break;
+		}
+		if (i != j) {
+			if (!bad)
+				printk(" excluding");
+			printk(" %#05lx-%#05lx", i, j-1);
+			sub_interval(&s_data->mem_db, i, j-i);
+			bad += j-i;
+		}
 	}
-    }
-    printk(bad ? "\n" : " clean.\n");
-    return (num - bad);
+	printk(bad ? "\n" : " clean.\n");
+	return num - bad;
 }
 
 #ifdef CONFIG_PCMCIA_PROBE
@@ -656,7 +663,7 @@ static struct resource *nonstatic_find_io_region(unsigned long base, int num,
 	return res;
 }
 
-static struct resource * nonstatic_find_mem_region(u_long base, u_long num,
+static struct resource *nonstatic_find_mem_region(u_long base, u_long num,
 		u_long align, int low, struct pcmcia_socket *s)
 {
 	struct resource *res = make_resource(0, num, IORESOURCE_MEM, dev_name(&s->dev));
@@ -794,7 +801,7 @@ static int nonstatic_autoadd_resources(struct pcmcia_socket *s)
 		return -EINVAL;
 #endif
 
-	for (i=0; i < PCI_BUS_NUM_RESOURCES; i++) {
+	for (i = 0; i < PCI_BUS_NUM_RESOURCES; i++) {
 		res = s->cb_dev->bus->resource[i];
 		if (!res)
 			continue;
@@ -908,14 +915,14 @@ static ssize_t show_io_db(struct device *dev,
 	for (p = data->io_db.next; p != &data->io_db; p = p->next) {
 		if (ret > (PAGE_SIZE - 10))
 			continue;
-		ret += snprintf (&buf[ret], (PAGE_SIZE - ret - 1),
-				 "0x%08lx - 0x%08lx\n",
-				 ((unsigned long) p->base),
-				 ((unsigned long) p->base + p->num - 1));
+		ret += snprintf(&buf[ret], (PAGE_SIZE - ret - 1),
+				"0x%08lx - 0x%08lx\n",
+				((unsigned long) p->base),
+				((unsigned long) p->base + p->num - 1));
 	}
 
 	mutex_unlock(&rsrc_mutex);
-	return (ret);
+	return ret;
 }
 
 static ssize_t store_io_db(struct device *dev,
@@ -927,12 +934,13 @@ static ssize_t store_io_db(struct device *dev,
 	unsigned int add = ADD_MANAGED_RESOURCE;
 	ssize_t ret = 0;
 
-	ret = sscanf (buf, "+ 0x%lx - 0x%lx", &start_addr, &end_addr);
+	ret = sscanf(buf, "+ 0x%lx - 0x%lx", &start_addr, &end_addr);
 	if (ret != 2) {
-		ret = sscanf (buf, "- 0x%lx - 0x%lx", &start_addr, &end_addr);
+		ret = sscanf(buf, "- 0x%lx - 0x%lx", &start_addr, &end_addr);
 		add = REMOVE_MANAGED_RESOURCE;
 		if (ret != 2) {
-			ret = sscanf (buf, "0x%lx - 0x%lx", &start_addr, &end_addr);
+			ret = sscanf(buf, "0x%lx - 0x%lx", &start_addr,
+				&end_addr);
 			add = ADD_MANAGED_RESOURCE;
 			if (ret != 2)
 				return -EINVAL;
@@ -963,14 +971,14 @@ static ssize_t show_mem_db(struct device *dev,
 	for (p = data->mem_db.next; p != &data->mem_db; p = p->next) {
 		if (ret > (PAGE_SIZE - 10))
 			continue;
-		ret += snprintf (&buf[ret], (PAGE_SIZE - ret - 1),
-				 "0x%08lx - 0x%08lx\n",
-				 ((unsigned long) p->base),
-				 ((unsigned long) p->base + p->num - 1));
+		ret += snprintf(&buf[ret], (PAGE_SIZE - ret - 1),
+				"0x%08lx - 0x%08lx\n",
+				((unsigned long) p->base),
+				((unsigned long) p->base + p->num - 1));
 	}
 
 	mutex_unlock(&rsrc_mutex);
-	return (ret);
+	return ret;
 }
 
 static ssize_t store_mem_db(struct device *dev,
@@ -982,12 +990,13 @@ static ssize_t store_mem_db(struct device *dev,
 	unsigned int add = ADD_MANAGED_RESOURCE;
 	ssize_t ret = 0;
 
-	ret = sscanf (buf, "+ 0x%lx - 0x%lx", &start_addr, &end_addr);
+	ret = sscanf(buf, "+ 0x%lx - 0x%lx", &start_addr, &end_addr);
 	if (ret != 2) {
-		ret = sscanf (buf, "- 0x%lx - 0x%lx", &start_addr, &end_addr);
+		ret = sscanf(buf, "- 0x%lx - 0x%lx", &start_addr, &end_addr);
 		add = REMOVE_MANAGED_RESOURCE;
 		if (ret != 2) {
-			ret = sscanf (buf, "0x%lx - 0x%lx", &start_addr, &end_addr);
+			ret = sscanf(buf, "0x%lx - 0x%lx", &start_addr,
+				&end_addr);
 			add = ADD_MANAGED_RESOURCE;
 			if (ret != 2)
 				return -EINVAL;
diff --git a/drivers/pcmcia/socket_sysfs.c b/drivers/pcmcia/socket_sysfs.c
index 78d5aab542f7..7a456000332a 100644
--- a/drivers/pcmcia/socket_sysfs.c
+++ b/drivers/pcmcia/socket_sysfs.c
@@ -164,7 +164,7 @@ static ssize_t pccard_store_irq_mask(struct device *dev,
 	if (!count)
 		return -EINVAL;
 
-	ret = sscanf (buf, "0x%x\n", &mask);
+	ret = sscanf(buf, "0x%x\n", &mask);
 
 	if (ret == 1) {
 		s->irq_mask &= mask;
@@ -278,7 +278,7 @@ static ssize_t pccard_extract_cis(struct pcmcia_socket *s, char *buf, loff_t off
  free_tuple:
 	kfree(tuplebuffer);
 
-	return (ret);
+	return ret;
 }
 
 static ssize_t pccard_show_cis(struct kobject *kobj,
@@ -308,7 +308,7 @@ static ssize_t pccard_show_cis(struct kobject *kobj,
 		count = pccard_extract_cis(s, buf, off, count);
 	}
 
-	return (count);
+	return count;
 }
 
 static ssize_t pccard_store_cis(struct kobject *kobj,
diff --git a/drivers/pcmcia/yenta_socket.c b/drivers/pcmcia/yenta_socket.c
index 8be4cc447a17..e4d12acdd525 100644
--- a/drivers/pcmcia/yenta_socket.c
+++ b/drivers/pcmcia/yenta_socket.c
@@ -6,7 +6,7 @@
  * Changelog:
  * Aug 2002: Manfred Spraul <manfred@colorfullife.com>
  * 	Dynamically adjust the size of the bridge resource
- * 	
+ *
  * May 2003: Dominik Brodowski <linux@brodo.de>
  * 	Merge pci_socket.c and yenta.c into one file
  */
@@ -16,13 +16,12 @@
 #include <linux/interrupt.h>
 #include <linux/delay.h>
 #include <linux/module.h>
+#include <linux/io.h>
 
 #include <pcmcia/cs_types.h>
 #include <pcmcia/ss.h>
 #include <pcmcia/cs.h>
 
-#include <asm/io.h>
-
 #include "yenta_socket.h"
 #include "i82365.h"
 
@@ -55,7 +54,7 @@ static int yenta_probe_cb_irq(struct yenta_socket *socket);
 
 static unsigned int override_bios;
 module_param(override_bios, uint, 0000);
-MODULE_PARM_DESC (override_bios, "yenta ignore bios resource allocation");
+MODULE_PARM_DESC(override_bios, "yenta ignore bios resource allocation");
 
 /*
  * Generate easy-to-use ways of reading a cardbus sockets
@@ -237,24 +236,42 @@ static void yenta_set_power(struct yenta_socket *socket, socket_state_t *state)
 		/* i82365SL-DF style */
 		if (socket->flags & YENTA_16BIT_POWER_DF) {
 			switch (state->Vcc) {
-			case 33: reg |= I365_VCC_3V; break;
-			case 50: reg |= I365_VCC_5V; break;
-			default: reg = 0; break;
+			case 33:
+				reg |= I365_VCC_3V;
+				break;
+			case 50:
+				reg |= I365_VCC_5V;
+				break;
+			default:
+				reg = 0;
+				break;
 			}
 			switch (state->Vpp) {
 			case 33:
-			case 50: reg |= I365_VPP1_5V; break;
-			case 120: reg |= I365_VPP1_12V; break;
+			case 50:
+				reg |= I365_VPP1_5V;
+				break;
+			case 120:
+				reg |= I365_VPP1_12V;
+				break;
 			}
 		} else {
 			/* i82365SL-B style */
 			switch (state->Vcc) {
-			case 50: reg |= I365_VCC_5V; break;
-			default: reg = 0; break;
+			case 50:
+				reg |= I365_VCC_5V;
+				break;
+			default:
+				reg = 0;
+				break;
 			}
 			switch (state->Vpp) {
-			case 50: reg |= I365_VPP1_5V | I365_VPP2_5V; break;
-			case 120: reg |= I365_VPP1_12V | I365_VPP2_12V; break;
+			case 50:
+				reg |= I365_VPP1_5V | I365_VPP2_5V;
+				break;
+			case 120:
+				reg |= I365_VPP1_12V | I365_VPP2_12V;
+				break;
 			}
 		}
 
@@ -263,14 +280,26 @@ static void yenta_set_power(struct yenta_socket *socket, socket_state_t *state)
 	} else {
 		u32 reg = 0;	/* CB_SC_STPCLK? */
 		switch (state->Vcc) {
-		case 33: reg = CB_SC_VCC_3V; break;
-		case 50: reg = CB_SC_VCC_5V; break;
-		default: reg = 0; break;
+		case 33:
+			reg = CB_SC_VCC_3V;
+			break;
+		case 50:
+			reg = CB_SC_VCC_5V;
+			break;
+		default:
+			reg = 0;
+			break;
 		}
 		switch (state->Vpp) {
-		case 33:  reg |= CB_SC_VPP_3V; break;
-		case 50:  reg |= CB_SC_VPP_5V; break;
-		case 120: reg |= CB_SC_VPP_12V; break;
+		case 33:
+			reg |= CB_SC_VPP_3V;
+			break;
+		case 50:
+			reg |= CB_SC_VPP_5V;
+			break;
+		case 120:
+			reg |= CB_SC_VPP_12V;
+			break;
 		}
 		if (reg != cb_readl(socket, CB_SOCKET_CONTROL))
 			cb_writel(socket, CB_SOCKET_CONTROL, reg);
@@ -314,23 +343,29 @@ static int yenta_set_socket(struct pcmcia_socket *sock, socket_state_t *state)
 
 		reg = exca_readb(socket, I365_POWER) & (I365_VCC_MASK|I365_VPP1_MASK);
 		reg |= I365_PWR_NORESET;
-		if (state->flags & SS_PWR_AUTO) reg |= I365_PWR_AUTO;
-		if (state->flags & SS_OUTPUT_ENA) reg |= I365_PWR_OUT;
+		if (state->flags & SS_PWR_AUTO)
+			reg |= I365_PWR_AUTO;
+		if (state->flags & SS_OUTPUT_ENA)
+			reg |= I365_PWR_OUT;
 		if (exca_readb(socket, I365_POWER) != reg)
 			exca_writeb(socket, I365_POWER, reg);
 
 		/* CSC interrupt: no ISA irq for CSC */
 		reg = I365_CSC_DETECT;
 		if (state->flags & SS_IOCARD) {
-			if (state->csc_mask & SS_STSCHG) reg |= I365_CSC_STSCHG;
+			if (state->csc_mask & SS_STSCHG)
+				reg |= I365_CSC_STSCHG;
 		} else {
-			if (state->csc_mask & SS_BATDEAD) reg |= I365_CSC_BVD1;
-			if (state->csc_mask & SS_BATWARN) reg |= I365_CSC_BVD2;
-			if (state->csc_mask & SS_READY) reg |= I365_CSC_READY;
+			if (state->csc_mask & SS_BATDEAD)
+				reg |= I365_CSC_BVD1;
+			if (state->csc_mask & SS_BATWARN)
+				reg |= I365_CSC_BVD2;
+			if (state->csc_mask & SS_READY)
+				reg |= I365_CSC_READY;
 		}
 		exca_writeb(socket, I365_CSCINT, reg);
 		exca_readb(socket, I365_CSC);
-		if(sock->zoom_video)
+		if (sock->zoom_video)
 			sock->zoom_video(sock, state->flags & SS_ZVCARD);
 	}
 	config_writew(socket, CB_BRIDGE_CONTROL, bridge);
@@ -368,9 +403,12 @@ static int yenta_set_io_map(struct pcmcia_socket *sock, struct pccard_io_map *io
 	exca_writew(socket, I365_IO(map)+I365_W_STOP, io->stop);
 
 	ioctl = exca_readb(socket, I365_IOCTL) & ~I365_IOCTL_MASK(map);
-	if (io->flags & MAP_0WS) ioctl |= I365_IOCTL_0WS(map);
-	if (io->flags & MAP_16BIT) ioctl |= I365_IOCTL_16BIT(map);
-	if (io->flags & MAP_AUTOSZ) ioctl |= I365_IOCTL_IOCS16(map);
+	if (io->flags & MAP_0WS)
+		ioctl |= I365_IOCTL_0WS(map);
+	if (io->flags & MAP_16BIT)
+		ioctl |= I365_IOCTL_16BIT(map);
+	if (io->flags & MAP_AUTOSZ)
+		ioctl |= I365_IOCTL_IOCS16(map);
 	exca_writeb(socket, I365_IOCTL, ioctl);
 
 	if (io->flags & MAP_ACTIVE)
@@ -416,10 +454,17 @@ static int yenta_set_mem_map(struct pcmcia_socket *sock, struct pccard_mem_map *
 
 	word = (stop >> 12) & 0x0fff;
 	switch (to_cycles(mem->speed)) {
-		case 0: break;
-		case 1:  word |= I365_MEM_WS0; break;
-		case 2:  word |= I365_MEM_WS1; break;
-		default: word |= I365_MEM_WS1 | I365_MEM_WS0; break;
+	case 0:
+		break;
+	case 1:
+		word |= I365_MEM_WS0;
+		break;
+	case 2:
+		word |= I365_MEM_WS1;
+		break;
+	default:
+		word |= I365_MEM_WS1 | I365_MEM_WS0;
+		break;
 	}
 	exca_writew(socket, I365_MEM(map) + I365_W_STOP, word);
 
@@ -547,9 +592,9 @@ static int yenta_sock_suspend(struct pcmcia_socket *sock)
  * max 4 MB, min 16 kB. We try very hard to not get below
  * the "ACC" values, though.
  */
-#define BRIDGE_MEM_MAX 4*1024*1024
-#define BRIDGE_MEM_ACC 128*1024
-#define BRIDGE_MEM_MIN 16*1024
+#define BRIDGE_MEM_MAX (4*1024*1024)
+#define BRIDGE_MEM_ACC (128*1024)
+#define BRIDGE_MEM_MIN (16*1024)
 
 #define BRIDGE_IO_MAX 512
 #define BRIDGE_IO_ACC 256
@@ -574,7 +619,7 @@ static int yenta_search_one_res(struct resource *root, struct resource *res,
 		int i;
 		size = BRIDGE_MEM_MAX;
 		if (size > avail/8) {
-			size=(avail+1)/8;
+			size = (avail+1)/8;
 			/* round size down to next power of 2 */
 			i = 0;
 			while ((size /= 2) != 0)
@@ -590,7 +635,7 @@ static int yenta_search_one_res(struct resource *root, struct resource *res,
 
 	do {
 		if (allocate_resource(root, res, size, start, end, align,
-				      NULL, NULL)==0) {
+				      NULL, NULL) == 0) {
 			return 1;
 		}
 		size = size/2;
@@ -605,8 +650,8 @@ static int yenta_search_res(struct yenta_socket *socket, struct resource *res,
 			    u32 min)
 {
 	int i;
-	for (i=0; i<PCI_BUS_NUM_RESOURCES; i++) {
-		struct resource * root = socket->dev->bus->resource[i];
+	for (i = 0; i < PCI_BUS_NUM_RESOURCES; i++) {
+		struct resource *root = socket->dev->bus->resource[i];
 		if (!root)
 			continue;
 
@@ -704,7 +749,7 @@ static void yenta_allocate_resources(struct yenta_socket *socket)
 static void yenta_free_resources(struct yenta_socket *socket)
 {
 	int i;
-	for (i=0;i<4;i++) {
+	for (i = 0; i < 4; i++) {
 		struct resource *res;
 		res = socket->dev->resource + PCI_BRIDGE_RESOURCES + i;
 		if (res->start != 0 && res->end != 0)
@@ -726,7 +771,7 @@ static void __devexit yenta_close(struct pci_dev *dev)
 
 	/* we don't want a dying socket registered */
 	pcmcia_unregister_socket(&sock->socket);
-	
+
 	/* Disable all events so we don't die in an IRQ storm */
 	cb_writel(sock, CB_SOCKET_MASK, 0x0);
 	exca_writeb(sock, I365_CSCINT, 0);
@@ -898,7 +943,7 @@ static irqreturn_t yenta_probe_handler(int irq, void *dev_id)
 {
 	struct yenta_socket *socket = (struct yenta_socket *) dev_id;
 	u8 csc;
-        u32 cb_event;
+	u32 cb_event;
 
 	/* Clear interrupt status for the event */
 	cb_event = cb_readl(socket, CB_SOCKET_EVENT);
@@ -1019,7 +1064,7 @@ static void yenta_fixup_parent_bridge(struct pci_bus *cardbus_bridge)
 {
 	struct list_head *tmp;
 	unsigned char upper_limit;
- 	/*
+	/*
 	 * We only check and fix the parent bridge: All systems which need
 	 * this fixup that have been reviewed are laptops and the only bridge
 	 * which needed fixing was the parent bridge of the CardBus bridge:
@@ -1038,7 +1083,7 @@ static void yenta_fixup_parent_bridge(struct pci_bus *cardbus_bridge)
 
 	/* check the bus ranges of all silbling bridges to prevent overlap */
 	list_for_each(tmp, &bridge_to_fix->parent->children) {
-		struct pci_bus * silbling = pci_bus_b(tmp);
+		struct pci_bus *silbling = pci_bus_b(tmp);
 		/*
 		 * If the silbling has a higher secondary bus number
 		 * and it's secondary is equal or smaller than our
@@ -1083,7 +1128,7 @@ static void yenta_fixup_parent_bridge(struct pci_bus *cardbus_bridge)
  * interrupt, and that we can map the cardbus area. Fill in the
  * socket information structure..
  */
-static int __devinit yenta_probe (struct pci_dev *dev, const struct pci_device_id *id)
+static int __devinit yenta_probe(struct pci_dev *dev, const struct pci_device_id *id)
 {
 	struct yenta_socket *socket;
 	int ret;
@@ -1285,7 +1330,7 @@ static int yenta_dev_resume(struct device *dev)
 	return 0;
 }
 
-static struct dev_pm_ops yenta_pm_ops = {
+static const struct dev_pm_ops yenta_pm_ops = {
 	.suspend_noirq = yenta_dev_suspend_noirq,
 	.resume_noirq = yenta_dev_resume_noirq,
 	.resume = yenta_dev_resume,
@@ -1302,7 +1347,7 @@ static struct dev_pm_ops yenta_pm_ops = {
 #define YENTA_PM_OPS	NULL
 #endif
 
-#define CB_ID(vend,dev,type)				\
+#define CB_ID(vend, dev, type)				\
 	{						\
 		.vendor		= vend,			\
 		.device		= dev,			\
@@ -1313,7 +1358,7 @@ static struct dev_pm_ops yenta_pm_ops = {
 		.driver_data	= CARDBUS_TYPE_##type,	\
 	}
 
-static struct pci_device_id yenta_table [] = {
+static struct pci_device_id yenta_table[] = {
 	CB_ID(PCI_VENDOR_ID_TI, PCI_DEVICE_ID_TI_1031, TI),
 
 	/*
@@ -1403,13 +1448,13 @@ static struct pci_driver yenta_cardbus_driver = {
 
 static int __init yenta_socket_init(void)
 {
-	return pci_register_driver (&yenta_cardbus_driver);
+	return pci_register_driver(&yenta_cardbus_driver);
 }
 
 
-static void __exit yenta_socket_exit (void)
+static void __exit yenta_socket_exit(void)
 {
-	pci_unregister_driver (&yenta_cardbus_driver);
+	pci_unregister_driver(&yenta_cardbus_driver);
 }
 
 
diff --git a/drivers/platform/Kconfig b/drivers/platform/Kconfig
index 9652c3fe7f5e..8390dca2b4e1 100644
--- a/drivers/platform/Kconfig
+++ b/drivers/platform/Kconfig
@@ -1,5 +1,3 @@
-# drivers/platform/Kconfig
-
 if X86
 source "drivers/platform/x86/Kconfig"
 endif
diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
index 55ca39dea42e..f526e735c5ab 100644
--- a/drivers/platform/x86/Kconfig
+++ b/drivers/platform/x86/Kconfig
@@ -231,8 +231,36 @@ config THINKPAD_ACPI
 
 	  This driver was formerly known as ibm-acpi.
 
+	  Extra functionality will be available if the rfkill (CONFIG_RFKILL)
+	  and/or ALSA (CONFIG_SND) subsystems are available in the kernel.
+	  Note that if you want ThinkPad-ACPI to be built-in instead of
+	  modular, ALSA and rfkill will also have to be built-in.
+
 	  If you have an IBM or Lenovo ThinkPad laptop, say Y or M here.
 
+config THINKPAD_ACPI_ALSA_SUPPORT
+	bool "Console audio control ALSA interface"
+	depends on THINKPAD_ACPI
+	depends on SND
+	depends on SND = y || THINKPAD_ACPI = SND
+	default y
+	---help---
+	  Enables monitoring of the built-in console audio output control
+	  (headphone and speakers), which is operated by the mute and (in
+	  some ThinkPad models) volume hotkeys.
+
+	  If this option is enabled, ThinkPad-ACPI will export an ALSA card
+	  with a single read-only mixer control, which should be used for
+	  on-screen-display feedback purposes by the Desktop Environment.
+
+	  Optionally, the driver will also allow software control (the
+	  ALSA mixer will be made read-write).  Please refer to the driver
+	  documentation for details.
+
+	  All IBM models have both volume and mute control.  Newer Lenovo
+	  models only have mute control (the volume hotkeys are just normal
+	  keys and volume control is done through the main HDA mixer).
+
 config THINKPAD_ACPI_DEBUGFACILITIES
 	bool "Maintainer debug facilities"
 	depends on THINKPAD_ACPI
@@ -334,6 +362,9 @@ config EEEPC_LAPTOP
 	depends on HOTPLUG_PCI
 	select BACKLIGHT_CLASS_DEVICE
 	select HWMON
+	select LEDS_CLASS
+	select NEW_LEDS
+	select INPUT_SPARSEKMAP
 	---help---
 	  This driver supports the Fn-Fx keys on Eee PC laptops.
 
@@ -365,6 +396,18 @@ config ACPI_WMI
 	  It is safe to enable this driver even if your DSDT doesn't define
 	  any ACPI-WMI devices.
 
+config MSI_WMI
+	tristate "MSI WMI extras"
+	depends on ACPI_WMI
+	depends on INPUT
+	depends on BACKLIGHT_CLASS_DEVICE
+	select INPUT_SPARSEKMAP
+	help
+	 Say Y here if you want to support WMI-based hotkeys on MSI laptops.
+
+	 To compile this driver as a module, choose M here: the module will
+	 be called msi-wmi.
+
 config ACPI_ASUS
 	tristate "ASUS/Medion Laptop Extras (DEPRECATED)"
 	depends on ACPI
@@ -435,4 +478,31 @@ config ACPI_TOSHIBA
 
 	  If you have a legacy free Toshiba laptop (such as the Libretto L1
 	  series), say Y.
+
+config TOSHIBA_BT_RFKILL
+	tristate "Toshiba Bluetooth RFKill switch support"
+	depends on ACPI
+	---help---
+	  This driver adds support for Bluetooth events for the RFKill
+	  switch on modern Toshiba laptops with full ACPI support and
+	  an RFKill switch.
+
+	  This driver handles RFKill events for the TOS6205 Bluetooth,
+	  and re-enables it when the switch is set back to the 'on'
+	  position.
+
+	  If you have a modern Toshiba laptop with a Bluetooth and an
+	  RFKill switch (such as the Portege R500), say Y.
+
+config ACPI_CMPC
+	tristate "CMPC Laptop Extras"
+	depends on X86 && ACPI
+	select INPUT
+	select BACKLIGHT_CLASS_DEVICE
+	default n
+	help
+	  Support for Intel Classmate PC ACPI devices, including some
+	  keys as input device, backlight device, tablet and accelerometer
+	  devices.
+
 endif # X86_PLATFORM_DEVICES
diff --git a/drivers/platform/x86/Makefile b/drivers/platform/x86/Makefile
index d1c16210a512..9cd9fa0a27e6 100644
--- a/drivers/platform/x86/Makefile
+++ b/drivers/platform/x86/Makefile
@@ -5,6 +5,7 @@
 obj-$(CONFIG_ASUS_LAPTOP)	+= asus-laptop.o
 obj-$(CONFIG_EEEPC_LAPTOP)	+= eeepc-laptop.o
 obj-$(CONFIG_MSI_LAPTOP)	+= msi-laptop.o
+obj-$(CONFIG_ACPI_CMPC)		+= classmate-laptop.o
 obj-$(CONFIG_COMPAL_LAPTOP)	+= compal-laptop.o
 obj-$(CONFIG_DELL_LAPTOP)	+= dell-laptop.o
 obj-$(CONFIG_DELL_WMI)		+= dell-wmi.o
@@ -18,6 +19,8 @@ obj-$(CONFIG_FUJITSU_LAPTOP)	+= fujitsu-laptop.o
 obj-$(CONFIG_PANASONIC_LAPTOP)	+= panasonic-laptop.o
 obj-$(CONFIG_INTEL_MENLOW)	+= intel_menlow.o
 obj-$(CONFIG_ACPI_WMI)		+= wmi.o
+obj-$(CONFIG_MSI_WMI)		+= msi-wmi.o
 obj-$(CONFIG_ACPI_ASUS)		+= asus_acpi.o
 obj-$(CONFIG_TOPSTAR_LAPTOP)	+= topstar-laptop.o
 obj-$(CONFIG_ACPI_TOSHIBA)	+= toshiba_acpi.o
+obj-$(CONFIG_TOSHIBA_BT_RFKILL)	+= toshiba_bluetooth.o
diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
index 454970d2d701..07d14dfdf0b4 100644
--- a/drivers/platform/x86/acer-wmi.c
+++ b/drivers/platform/x86/acer-wmi.c
@@ -96,9 +96,6 @@ struct acer_quirks {
 MODULE_ALIAS("wmi:67C3371D-95A3-4C37-BB61-DD47B491DAAB");
 MODULE_ALIAS("wmi:6AF4F258-B401-42fd-BE91-3D4AC2D7C0D3");
 
-/* Temporary workaround until the WMI sysfs interface goes in */
-MODULE_ALIAS("dmi:*:*Acer*:*:");
-
 /*
  * Interface capability flags
  */
diff --git a/drivers/platform/x86/acerhdf.c b/drivers/platform/x86/acerhdf.c
index ab64522aaa64..7b2384d674d0 100644
--- a/drivers/platform/x86/acerhdf.c
+++ b/drivers/platform/x86/acerhdf.c
@@ -52,7 +52,7 @@
  */
 #undef START_IN_KERNEL_MODE
 
-#define DRV_VER "0.5.18"
+#define DRV_VER "0.5.22"
 
 /*
  * According to the Atom N270 datasheet,
@@ -112,12 +112,14 @@ module_param_string(force_product, force_product, 16, 0);
 MODULE_PARM_DESC(force_product, "Force BIOS product and omit BIOS check");
 
 /*
- * cmd_off: to switch the fan completely off / to check if the fan is off
+ * cmd_off: to switch the fan completely off
+ * chk_off: to check if the fan is off
  *	cmd_auto: to set the BIOS in control of the fan. The BIOS regulates then
  *		the fan speed depending on the temperature
  */
 struct fancmd {
 	u8 cmd_off;
+	u8 chk_off;
 	u8 cmd_auto;
 };
 
@@ -134,32 +136,47 @@ struct bios_settings_t {
 /* Register addresses and values for different BIOS versions */
 static const struct bios_settings_t bios_tbl[] = {
 	/* AOA110 */
-	{"Acer", "AOA110", "v0.3109", 0x55, 0x58, {0x1f, 0x00} },
-	{"Acer", "AOA110", "v0.3114", 0x55, 0x58, {0x1f, 0x00} },
-	{"Acer", "AOA110", "v0.3301", 0x55, 0x58, {0xaf, 0x00} },
-	{"Acer", "AOA110", "v0.3304", 0x55, 0x58, {0xaf, 0x00} },
-	{"Acer", "AOA110", "v0.3305", 0x55, 0x58, {0xaf, 0x00} },
-	{"Acer", "AOA110", "v0.3307", 0x55, 0x58, {0xaf, 0x00} },
-	{"Acer", "AOA110", "v0.3308", 0x55, 0x58, {0x21, 0x00} },
-	{"Acer", "AOA110", "v0.3309", 0x55, 0x58, {0x21, 0x00} },
-	{"Acer", "AOA110", "v0.3310", 0x55, 0x58, {0x21, 0x00} },
+	{"Acer", "AOA110", "v0.3109", 0x55, 0x58, {0x1f, 0x1f, 0x00} },
+	{"Acer", "AOA110", "v0.3114", 0x55, 0x58, {0x1f, 0x1f, 0x00} },
+	{"Acer", "AOA110", "v0.3301", 0x55, 0x58, {0xaf, 0xaf, 0x00} },
+	{"Acer", "AOA110", "v0.3304", 0x55, 0x58, {0xaf, 0xaf, 0x00} },
+	{"Acer", "AOA110", "v0.3305", 0x55, 0x58, {0xaf, 0xaf, 0x00} },
+	{"Acer", "AOA110", "v0.3307", 0x55, 0x58, {0xaf, 0xaf, 0x00} },
+	{"Acer", "AOA110", "v0.3308", 0x55, 0x58, {0x21, 0x21, 0x00} },
+	{"Acer", "AOA110", "v0.3309", 0x55, 0x58, {0x21, 0x21, 0x00} },
+	{"Acer", "AOA110", "v0.3310", 0x55, 0x58, {0x21, 0x21, 0x00} },
 	/* AOA150 */
-	{"Acer", "AOA150", "v0.3114", 0x55, 0x58, {0x20, 0x00} },
-	{"Acer", "AOA150", "v0.3301", 0x55, 0x58, {0x20, 0x00} },
-	{"Acer", "AOA150", "v0.3304", 0x55, 0x58, {0x20, 0x00} },
-	{"Acer", "AOA150", "v0.3305", 0x55, 0x58, {0x20, 0x00} },
-	{"Acer", "AOA150", "v0.3307", 0x55, 0x58, {0x20, 0x00} },
-	{"Acer", "AOA150", "v0.3308", 0x55, 0x58, {0x20, 0x00} },
-	{"Acer", "AOA150", "v0.3309", 0x55, 0x58, {0x20, 0x00} },
-	{"Acer", "AOA150", "v0.3310", 0x55, 0x58, {0x20, 0x00} },
-	/* special BIOS / other */
-	{"Gateway", "AOA110", "v0.3103", 0x55, 0x58, {0x21, 0x00} },
-	{"Gateway", "AOA150", "v0.3103", 0x55, 0x58, {0x20, 0x00} },
-	{"Packard Bell", "DOA150", "v0.3104", 0x55, 0x58, {0x21, 0x00} },
-	{"Packard Bell", "AOA110", "v0.3105", 0x55, 0x58, {0x21, 0x00} },
-	{"Packard Bell", "AOA150", "v0.3105", 0x55, 0x58, {0x20, 0x00} },
+	{"Acer", "AOA150", "v0.3114", 0x55, 0x58, {0x20, 0x20, 0x00} },
+	{"Acer", "AOA150", "v0.3301", 0x55, 0x58, {0x20, 0x20, 0x00} },
+	{"Acer", "AOA150", "v0.3304", 0x55, 0x58, {0x20, 0x20, 0x00} },
+	{"Acer", "AOA150", "v0.3305", 0x55, 0x58, {0x20, 0x20, 0x00} },
+	{"Acer", "AOA150", "v0.3307", 0x55, 0x58, {0x20, 0x20, 0x00} },
+	{"Acer", "AOA150", "v0.3308", 0x55, 0x58, {0x20, 0x20, 0x00} },
+	{"Acer", "AOA150", "v0.3309", 0x55, 0x58, {0x20, 0x20, 0x00} },
+	{"Acer", "AOA150", "v0.3310", 0x55, 0x58, {0x20, 0x20, 0x00} },
+	/* Acer 1410 */
+	{"Acer", "Aspire 1410", "v0.3120", 0x55, 0x58, {0x9e, 0x9e, 0x00} },
+	{"Acer", "Aspire 1410", "v1.3303", 0x55, 0x58, {0x9e, 0x9e, 0x00} },
+	/* Acer 1810xx */
+	{"Acer", "Aspire 1810TZ", "v0.3120", 0x55, 0x58, {0x9e, 0x9e, 0x00} },
+	{"Acer", "Aspire 1810T", "v0.3120", 0x55, 0x58, {0x9e, 0x9e, 0x00} },
+	{"Acer", "Aspire 1810T", "v1.3303", 0x55, 0x58, {0x9e, 0x9e, 0x00} },
+	{"Acer", "Aspire 1810TZ", "v1.3303", 0x55, 0x58, {0x9e, 0x9e, 0x00} },
+	/* Gateway */
+	{"Gateway", "AOA110", "v0.3103", 0x55, 0x58, {0x21, 0x21, 0x00} },
+	{"Gateway", "AOA150", "v0.3103", 0x55, 0x58, {0x20, 0x20, 0x00} },
+	{"Gateway", "LT31", "v1.3103", 0x55, 0x58, {0x10, 0x0f, 0x00} },
+	{"Gateway", "LT31", "v1.3201", 0x55, 0x58, {0x10, 0x0f, 0x00} },
+	{"Gateway", "LT31", "v1.3302", 0x55, 0x58, {0x10, 0x0f, 0x00} },
+	/* Packard Bell */
+	{"Packard Bell", "DOA150", "v0.3104", 0x55, 0x58, {0x21, 0x21, 0x00} },
+	{"Packard Bell", "DOA150", "v0.3105", 0x55, 0x58, {0x20, 0x20, 0x00} },
+	{"Packard Bell", "AOA110", "v0.3105", 0x55, 0x58, {0x21, 0x21, 0x00} },
+	{"Packard Bell", "AOA150", "v0.3105", 0x55, 0x58, {0x20, 0x20, 0x00} },
+	{"Packard Bell", "DOTMU", "v1.3303", 0x55, 0x58, {0x9e, 0x9e, 0x00} },
+	{"Packard Bell", "DOTMU", "v0.3120", 0x55, 0x58, {0x9e, 0x9e, 0x00} },
 	/* pewpew-terminator */
-	{"", "", "", 0, 0, {0, 0} }
+	{"", "", "", 0, 0, {0, 0, 0} }
 };
 
 static const struct bios_settings_t *bios_cfg __read_mostly;
@@ -183,7 +200,7 @@ static int acerhdf_get_fanstate(int *state)
 	if (ec_read(bios_cfg->fanreg, &fan))
 		return -EINVAL;
 
-	if (fan != bios_cfg->cmd.cmd_off)
+	if (fan != bios_cfg->cmd.chk_off)
 		*state = ACERHDF_FAN_AUTO;
 	else
 		*state = ACERHDF_FAN_OFF;
@@ -460,7 +477,7 @@ static int acerhdf_remove(struct platform_device *device)
 	return 0;
 }
 
-static struct dev_pm_ops acerhdf_pm_ops = {
+static const struct dev_pm_ops acerhdf_pm_ops = {
 	.suspend = acerhdf_suspend,
 	.freeze  = acerhdf_suspend,
 };
@@ -475,13 +492,26 @@ static struct platform_driver acerhdf_driver = {
 	.remove = acerhdf_remove,
 };
 
+/* checks if str begins with start */
+static int str_starts_with(const char *str, const char *start)
+{
+	unsigned long str_len = 0, start_len = 0;
+
+	str_len = strlen(str);
+	start_len = strlen(start);
+
+	if (str_len >= start_len &&
+			!strncmp(str, start, start_len))
+		return 1;
+
+	return 0;
+}
 
 /* check hardware */
 static int acerhdf_check_hardware(void)
 {
 	char const *vendor, *version, *product;
-	int i;
-	unsigned long prod_len = 0;
+	const struct bios_settings_t *bt = NULL;
 
 	/* get BIOS data */
 	vendor  = dmi_get_system_info(DMI_SYS_VENDOR);
@@ -503,20 +533,20 @@ static int acerhdf_check_hardware(void)
 		kernelmode = 0;
 	}
 
-	prod_len = strlen(product);
-
 	if (verbose)
 		pr_info("BIOS info: %s %s, product: %s\n",
 			vendor, version, product);
 
 	/* search BIOS version and vendor in BIOS settings table */
-	for (i = 0; bios_tbl[i].version[0]; i++) {
-		if (strlen(bios_tbl[i].product) >= prod_len &&
-		    !strncmp(bios_tbl[i].product, product,
-			   strlen(bios_tbl[i].product)) &&
-		    !strcmp(bios_tbl[i].vendor, vendor) &&
-		    !strcmp(bios_tbl[i].version, version)) {
-			bios_cfg = &bios_tbl[i];
+	for (bt = bios_tbl; bt->vendor[0]; bt++) {
+		/*
+		 * check if actual hardware BIOS vendor, product and version
+		 * IDs start with the strings of BIOS table entry
+		 */
+		if (str_starts_with(vendor, bt->vendor) &&
+				str_starts_with(product, bt->product) &&
+				str_starts_with(version, bt->version)) {
+			bios_cfg = bt;
 			break;
 		}
 	}
@@ -629,9 +659,14 @@ static void __exit acerhdf_exit(void)
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Peter Feuerer");
 MODULE_DESCRIPTION("Aspire One temperature and fan driver");
-MODULE_ALIAS("dmi:*:*Acer*:*:");
-MODULE_ALIAS("dmi:*:*Gateway*:*:");
-MODULE_ALIAS("dmi:*:*Packard Bell*:*:");
+MODULE_ALIAS("dmi:*:*Acer*:pnAOA*:");
+MODULE_ALIAS("dmi:*:*Acer*:pnAspire 1410*:");
+MODULE_ALIAS("dmi:*:*Acer*:pnAspire 1810*:");
+MODULE_ALIAS("dmi:*:*Gateway*:pnAOA*:");
+MODULE_ALIAS("dmi:*:*Gateway*:pnLT31*:");
+MODULE_ALIAS("dmi:*:*Packard Bell*:pnAOA*:");
+MODULE_ALIAS("dmi:*:*Packard Bell*:pnDOA*:");
+MODULE_ALIAS("dmi:*:*Packard Bell*:pnDOTMU*:");
 
 module_init(acerhdf_init);
 module_exit(acerhdf_exit);
diff --git a/drivers/platform/x86/asus-laptop.c b/drivers/platform/x86/asus-laptop.c
index b39d2bb3e75b..61a1c7503658 100644
--- a/drivers/platform/x86/asus-laptop.c
+++ b/drivers/platform/x86/asus-laptop.c
@@ -221,6 +221,7 @@ static struct asus_hotk *hotk;
  */
 static const struct acpi_device_id asus_device_ids[] = {
 	{"ATK0100", 0},
+	{"ATK0101", 0},
 	{"", 0},
 };
 MODULE_DEVICE_TABLE(acpi, asus_device_ids);
@@ -232,6 +233,7 @@ static void asus_hotk_notify(struct acpi_device *device, u32 event);
 static struct acpi_driver asus_hotk_driver = {
 	.name = ASUS_HOTK_NAME,
 	.class = ASUS_HOTK_CLASS,
+	.owner = THIS_MODULE,
 	.ids = asus_device_ids,
 	.flags = ACPI_DRIVER_ALL_NOTIFY_EVENTS,
 	.ops = {
@@ -293,6 +295,11 @@ struct key_entry {
 enum { KE_KEY, KE_END };
 
 static struct key_entry asus_keymap[] = {
+	{KE_KEY, 0x02, KEY_SCREENLOCK},
+	{KE_KEY, 0x05, KEY_WLAN},
+	{KE_KEY, 0x08, KEY_F13},
+	{KE_KEY, 0x17, KEY_ZOOM},
+	{KE_KEY, 0x1f, KEY_BATTERY},
 	{KE_KEY, 0x30, KEY_VOLUMEUP},
 	{KE_KEY, 0x31, KEY_VOLUMEDOWN},
 	{KE_KEY, 0x32, KEY_MUTE},
@@ -312,8 +319,11 @@ static struct key_entry asus_keymap[] = {
 	{KE_KEY, 0x5F, KEY_WLAN},
 	{KE_KEY, 0x60, KEY_SWITCHVIDEOMODE},
 	{KE_KEY, 0x61, KEY_SWITCHVIDEOMODE},
-	{KE_KEY, 0x6B, BTN_TOUCH}, /* Lock Mouse */
+	{KE_KEY, 0x62, KEY_SWITCHVIDEOMODE},
+	{KE_KEY, 0x63, KEY_SWITCHVIDEOMODE},
+	{KE_KEY, 0x6B, KEY_F13}, /* Lock Touchpad */
 	{KE_KEY, 0x82, KEY_CAMERA},
+	{KE_KEY, 0x88, KEY_WLAN },
 	{KE_KEY, 0x8A, KEY_PROG1},
 	{KE_KEY, 0x95, KEY_MEDIA},
 	{KE_KEY, 0x99, KEY_PHONE},
@@ -1240,9 +1250,6 @@ static int asus_hotk_add(struct acpi_device *device)
 {
 	int result;
 
-	if (!device)
-		return -EINVAL;
-
 	pr_notice("Asus Laptop Support version %s\n",
 	       ASUS_LAPTOP_VERSION);
 
@@ -1283,8 +1290,8 @@ static int asus_hotk_add(struct acpi_device *device)
 	hotk->ledd_status = 0xFFF;
 
 	/* Set initial values of light sensor and level */
-	hotk->light_switch = 1;	/* Default to light sensor disabled */
-	hotk->light_level = 0;	/* level 5 for sensor sensitivity */
+	hotk->light_switch = 0;	/* Default to light sensor disabled */
+	hotk->light_level = 5;	/* level 5 for sensor sensitivity */
 
 	if (ls_switch_handle)
 		set_light_sens_switch(hotk->light_switch);
@@ -1306,9 +1313,6 @@ end:
 
 static int asus_hotk_remove(struct acpi_device *device, int type)
 {
-	if (!device || !acpi_driver_data(device))
-		return -EINVAL;
-
 	kfree(hotk->name);
 	kfree(hotk);
 
@@ -1444,9 +1448,6 @@ static int __init asus_laptop_init(void)
 {
 	int result;
 
-	if (acpi_disabled)
-		return -ENODEV;
-
 	result = acpi_bus_register_driver(&asus_hotk_driver);
 	if (result < 0)
 		return result;
diff --git a/drivers/platform/x86/asus_acpi.c b/drivers/platform/x86/asus_acpi.c
index ddf5240ade8c..c1d2aeeea948 100644
--- a/drivers/platform/x86/asus_acpi.c
+++ b/drivers/platform/x86/asus_acpi.c
@@ -35,6 +35,7 @@
 #include <linux/init.h>
 #include <linux/types.h>
 #include <linux/proc_fs.h>
+#include <linux/seq_file.h>
 #include <linux/backlight.h>
 #include <acpi/acpi_drivers.h>
 #include <acpi/acpi_bus.h>
@@ -466,6 +467,7 @@ MODULE_DEVICE_TABLE(acpi, asus_device_ids);
 static struct acpi_driver asus_hotk_driver = {
 	.name = "asus_acpi",
 	.class = ACPI_HOTK_CLASS,
+	.owner = THIS_MODULE,
 	.ids = asus_device_ids,
 	.flags = ACPI_DRIVER_ALL_NOTIFY_EVENTS,
 	.ops = {
@@ -512,26 +514,12 @@ static int read_acpi_int(acpi_handle handle, const char *method, int *val)
 	return (status == AE_OK) && (out_obj.type == ACPI_TYPE_INTEGER);
 }
 
-/*
- * We write our info in page, we begin at offset off and cannot write more
- * than count bytes. We set eof to 1 if we handle those 2 values. We return the
- * number of bytes written in page
- */
-static int
-proc_read_info(char *page, char **start, off_t off, int count, int *eof,
-	       void *data)
+static int asus_info_proc_show(struct seq_file *m, void *v)
 {
-	int len = 0;
 	int temp;
-	char buf[16];		/* enough for all info */
-	/*
-	 * We use the easy way, we don't care of off and count,
-	 * so we don't set eof to 1
-	 */
 
-	len += sprintf(page, ACPI_HOTK_NAME " " ASUS_ACPI_VERSION "\n");
-	len += sprintf(page + len, "Model reference    : %s\n",
-		       hotk->methods->name);
+	seq_printf(m, ACPI_HOTK_NAME " " ASUS_ACPI_VERSION "\n");
+	seq_printf(m, "Model reference    : %s\n", hotk->methods->name);
 	/*
 	 * The SFUN method probably allows the original driver to get the list
 	 * of features supported by a given model. For now, 0x0100 or 0x0800
@@ -539,8 +527,7 @@ proc_read_info(char *page, char **start, off_t off, int count, int *eof,
 	 * The significance of others is yet to be found.
 	 */
 	if (read_acpi_int(hotk->handle, "SFUN", &temp))
-		len +=
-		    sprintf(page + len, "SFUN value         : 0x%04x\n", temp);
+		seq_printf(m, "SFUN value         : 0x%04x\n", temp);
 	/*
 	 * Another value for userspace: the ASYM method returns 0x02 for
 	 * battery low and 0x04 for battery critical, its readings tend to be
@@ -549,30 +536,34 @@ proc_read_info(char *page, char **start, off_t off, int count, int *eof,
 	 * silently ignored.
 	 */
 	if (read_acpi_int(hotk->handle, "ASYM", &temp))
-		len +=
-		    sprintf(page + len, "ASYM value         : 0x%04x\n", temp);
+		seq_printf(m, "ASYM value         : 0x%04x\n", temp);
 	if (asus_info) {
-		snprintf(buf, 16, "%d", asus_info->length);
-		len += sprintf(page + len, "DSDT length        : %s\n", buf);
-		snprintf(buf, 16, "%d", asus_info->checksum);
-		len += sprintf(page + len, "DSDT checksum      : %s\n", buf);
-		snprintf(buf, 16, "%d", asus_info->revision);
-		len += sprintf(page + len, "DSDT revision      : %s\n", buf);
-		snprintf(buf, 7, "%s", asus_info->oem_id);
-		len += sprintf(page + len, "OEM id             : %s\n", buf);
-		snprintf(buf, 9, "%s", asus_info->oem_table_id);
-		len += sprintf(page + len, "OEM table id       : %s\n", buf);
-		snprintf(buf, 16, "%x", asus_info->oem_revision);
-		len += sprintf(page + len, "OEM revision       : 0x%s\n", buf);
-		snprintf(buf, 5, "%s", asus_info->asl_compiler_id);
-		len += sprintf(page + len, "ASL comp vendor id : %s\n", buf);
-		snprintf(buf, 16, "%x", asus_info->asl_compiler_revision);
-		len += sprintf(page + len, "ASL comp revision  : 0x%s\n", buf);
+		seq_printf(m, "DSDT length        : %d\n", asus_info->length);
+		seq_printf(m, "DSDT checksum      : %d\n", asus_info->checksum);
+		seq_printf(m, "DSDT revision      : %d\n", asus_info->revision);
+		seq_printf(m, "OEM id             : %.*s\n", ACPI_OEM_ID_SIZE, asus_info->oem_id);
+		seq_printf(m, "OEM table id       : %.*s\n", ACPI_OEM_TABLE_ID_SIZE, asus_info->oem_table_id);
+		seq_printf(m, "OEM revision       : 0x%x\n", asus_info->oem_revision);
+		seq_printf(m, "ASL comp vendor id : %.*s\n", ACPI_NAME_SIZE, asus_info->asl_compiler_id);
+		seq_printf(m, "ASL comp revision  : 0x%x\n", asus_info->asl_compiler_revision);
 	}
 
-	return len;
+	return 0;
+}
+
+static int asus_info_proc_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, asus_info_proc_show, NULL);
 }
 
+static const struct file_operations asus_info_proc_fops = {
+	.owner		= THIS_MODULE,
+	.open		= asus_info_proc_open,
+	.read		= seq_read,
+	.llseek		= seq_lseek,
+	.release	= single_release,
+};
+
 /*
  * /proc handlers
  * We write our info in page, we begin at offset off and cannot write more
@@ -638,34 +629,48 @@ write_led(const char __user *buffer, unsigned long count,
 /*
  * Proc handlers for MLED
  */
-static int
-proc_read_mled(char *page, char **start, off_t off, int count, int *eof,
-	       void *data)
+static int mled_proc_show(struct seq_file *m, void *v)
 {
-	return sprintf(page, "%d\n",
-		       read_led(hotk->methods->mled_status, MLED_ON));
+	seq_printf(m, "%d\n", read_led(hotk->methods->mled_status, MLED_ON));
+	return 0;
 }
 
-static int
-proc_write_mled(struct file *file, const char __user *buffer,
-		unsigned long count, void *data)
+static int mled_proc_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, mled_proc_show, NULL);
+}
+
+static ssize_t mled_proc_write(struct file *file, const char __user *buffer,
+		size_t count, loff_t *pos)
 {
 	return write_led(buffer, count, hotk->methods->mt_mled, MLED_ON, 1);
 }
 
+static const struct file_operations mled_proc_fops = {
+	.owner		= THIS_MODULE,
+	.open		= mled_proc_open,
+	.read		= seq_read,
+	.llseek		= seq_lseek,
+	.release	= single_release,
+	.write		= mled_proc_write,
+};
+
 /*
  * Proc handlers for LED display
  */
-static int
-proc_read_ledd(char *page, char **start, off_t off, int count, int *eof,
-	       void *data)
+static int ledd_proc_show(struct seq_file *m, void *v)
 {
-	return sprintf(page, "0x%08x\n", hotk->ledd_status);
+	seq_printf(m, "0x%08x\n", hotk->ledd_status);
+	return 0;
 }
 
-static int
-proc_write_ledd(struct file *file, const char __user *buffer,
-		unsigned long count, void *data)
+static int ledd_proc_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, ledd_proc_show, NULL);
+}
+
+static ssize_t ledd_proc_write(struct file *file, const char __user *buffer,
+		size_t count, loff_t *pos)
 {
 	int rv, value;
 
@@ -681,61 +686,104 @@ proc_write_ledd(struct file *file, const char __user *buffer,
 	return rv;
 }
 
+static const struct file_operations ledd_proc_fops = {
+	.owner		= THIS_MODULE,
+	.open		= ledd_proc_open,
+	.read		= seq_read,
+	.llseek		= seq_lseek,
+	.release	= single_release,
+	.write		= ledd_proc_write,
+};
+
 /*
  * Proc handlers for WLED
  */
-static int
-proc_read_wled(char *page, char **start, off_t off, int count, int *eof,
-	       void *data)
+static int wled_proc_show(struct seq_file *m, void *v)
 {
-	return sprintf(page, "%d\n",
-		       read_led(hotk->methods->wled_status, WLED_ON));
+	seq_printf(m, "%d\n", read_led(hotk->methods->wled_status, WLED_ON));
+	return 0;
 }
 
-static int
-proc_write_wled(struct file *file, const char __user *buffer,
-		unsigned long count, void *data)
+static int wled_proc_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, wled_proc_show, NULL);
+}
+
+static ssize_t wled_proc_write(struct file *file, const char __user *buffer,
+		size_t count, loff_t *pos)
 {
 	return write_led(buffer, count, hotk->methods->mt_wled, WLED_ON, 0);
 }
 
+static const struct file_operations wled_proc_fops = {
+	.owner		= THIS_MODULE,
+	.open		= wled_proc_open,
+	.read		= seq_read,
+	.llseek		= seq_lseek,
+	.release	= single_release,
+	.write		= wled_proc_write,
+};
+
 /*
  * Proc handlers for Bluetooth
  */
-static int
-proc_read_bluetooth(char *page, char **start, off_t off, int count, int *eof,
-		    void *data)
+static int bluetooth_proc_show(struct seq_file *m, void *v)
 {
-	return sprintf(page, "%d\n", read_led(hotk->methods->bt_status, BT_ON));
+	seq_printf(m, "%d\n", read_led(hotk->methods->bt_status, BT_ON));
+	return 0;
 }
 
-static int
-proc_write_bluetooth(struct file *file, const char __user *buffer,
-		     unsigned long count, void *data)
+static int bluetooth_proc_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, bluetooth_proc_show, NULL);
+}
+
+static ssize_t bluetooth_proc_write(struct file *file,
+		const char __user *buffer, size_t count, loff_t *pos)
 {
 	/* Note: mt_bt_switch controls both internal Bluetooth adapter's
 	   presence and its LED */
 	return write_led(buffer, count, hotk->methods->mt_bt_switch, BT_ON, 0);
 }
 
+static const struct file_operations bluetooth_proc_fops = {
+	.owner		= THIS_MODULE,
+	.open		= bluetooth_proc_open,
+	.read		= seq_read,
+	.llseek		= seq_lseek,
+	.release	= single_release,
+	.write		= bluetooth_proc_write,
+};
+
 /*
  * Proc handlers for TLED
  */
-static int
-proc_read_tled(char *page, char **start, off_t off, int count, int *eof,
-	       void *data)
+static int tled_proc_show(struct seq_file *m, void *v)
 {
-	return sprintf(page, "%d\n",
-		       read_led(hotk->methods->tled_status, TLED_ON));
+	seq_printf(m, "%d\n", read_led(hotk->methods->tled_status, TLED_ON));
+	return 0;
 }
 
-static int
-proc_write_tled(struct file *file, const char __user *buffer,
-		unsigned long count, void *data)
+static int tled_proc_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, tled_proc_show, NULL);
+}
+
+static ssize_t tled_proc_write(struct file *file, const char __user *buffer,
+		size_t count, loff_t *pos)
 {
 	return write_led(buffer, count, hotk->methods->mt_tled, TLED_ON, 0);
 }
 
+static const struct file_operations tled_proc_fops = {
+	.owner		= THIS_MODULE,
+	.open		= tled_proc_open,
+	.read		= seq_read,
+	.llseek		= seq_lseek,
+	.release	= single_release,
+	.write		= tled_proc_write,
+};
+
 static int get_lcd_state(void)
 {
 	int lcd = 0;
@@ -828,16 +876,19 @@ static int set_lcd_state(int value)
 
 }
 
-static int
-proc_read_lcd(char *page, char **start, off_t off, int count, int *eof,
-	      void *data)
+static int lcd_proc_show(struct seq_file *m, void *v)
 {
-	return sprintf(page, "%d\n", get_lcd_state());
+	seq_printf(m, "%d\n", get_lcd_state());
+	return 0;
 }
 
-static int
-proc_write_lcd(struct file *file, const char __user *buffer,
-	       unsigned long count, void *data)
+static int lcd_proc_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, lcd_proc_show, NULL);
+}
+
+static ssize_t lcd_proc_write(struct file *file, const char __user *buffer,
+	       size_t count, loff_t *pos)
 {
 	int rv, value;
 
@@ -847,6 +898,15 @@ proc_write_lcd(struct file *file, const char __user *buffer,
 	return rv;
 }
 
+static const struct file_operations lcd_proc_fops = {
+	.owner		= THIS_MODULE,
+	.open		= lcd_proc_open,
+	.read		= seq_read,
+	.llseek		= seq_lseek,
+	.release	= single_release,
+	.write		= lcd_proc_write,
+};
+
 static int read_brightness(struct backlight_device *bd)
 {
 	int value;
@@ -906,16 +966,19 @@ static int set_brightness_status(struct backlight_device *bd)
 	return set_brightness(bd->props.brightness);
 }
 
-static int
-proc_read_brn(char *page, char **start, off_t off, int count, int *eof,
-	      void *data)
+static int brn_proc_show(struct seq_file *m, void *v)
 {
-	return sprintf(page, "%d\n", read_brightness(NULL));
+	seq_printf(m, "%d\n", read_brightness(NULL));
+	return 0;
 }
 
-static int
-proc_write_brn(struct file *file, const char __user *buffer,
-	       unsigned long count, void *data)
+static int brn_proc_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, brn_proc_show, NULL);
+}
+
+static ssize_t brn_proc_write(struct file *file, const char __user *buffer,
+	       size_t count, loff_t *pos)
 {
 	int rv, value;
 
@@ -928,6 +991,15 @@ proc_write_brn(struct file *file, const char __user *buffer,
 	return rv;
 }
 
+static const struct file_operations brn_proc_fops = {
+	.owner		= THIS_MODULE,
+	.open		= brn_proc_open,
+	.read		= seq_read,
+	.llseek		= seq_lseek,
+	.release	= single_release,
+	.write		= brn_proc_write,
+};
+
 static void set_display(int value)
 {
 	/* no sanity check needed for now */
@@ -941,9 +1013,7 @@ static void set_display(int value)
  * Now, *this* one could be more user-friendly, but so far, no-one has
  * complained. The significance of bits is the same as in proc_write_disp()
  */
-static int
-proc_read_disp(char *page, char **start, off_t off, int count, int *eof,
-	       void *data)
+static int disp_proc_show(struct seq_file *m, void *v)
 {
 	int value = 0;
 
@@ -951,7 +1021,13 @@ proc_read_disp(char *page, char **start, off_t off, int count, int *eof,
 		printk(KERN_WARNING
 		       "Asus ACPI: Error reading display status\n");
 	value &= 0x07;	/* needed for some models, shouldn't hurt others */
-	return sprintf(page, "%d\n", value);
+	seq_printf(m, "%d\n", value);
+	return 0;
+}
+
+static int disp_proc_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, disp_proc_show, NULL);
 }
 
 /*
@@ -960,9 +1036,8 @@ proc_read_disp(char *page, char **start, off_t off, int count, int *eof,
  * (bitwise) of these will suffice. I never actually tested 3 displays hooked
  * up simultaneously, so be warned. See the acpi4asus README for more info.
  */
-static int
-proc_write_disp(struct file *file, const char __user *buffer,
-		unsigned long count, void *data)
+static ssize_t disp_proc_write(struct file *file, const char __user *buffer,
+		size_t count, loff_t *pos)
 {
 	int rv, value;
 
@@ -972,25 +1047,27 @@ proc_write_disp(struct file *file, const char __user *buffer,
 	return rv;
 }
 
-typedef int (proc_readfunc) (char *page, char **start, off_t off, int count,
-			     int *eof, void *data);
-typedef int (proc_writefunc) (struct file *file, const char __user *buffer,
-			      unsigned long count, void *data);
+static const struct file_operations disp_proc_fops = {
+	.owner		= THIS_MODULE,
+	.open		= disp_proc_open,
+	.read		= seq_read,
+	.llseek		= seq_lseek,
+	.release	= single_release,
+	.write		= disp_proc_write,
+};
 
 static int
-asus_proc_add(char *name, proc_writefunc *writefunc,
-		     proc_readfunc *readfunc, mode_t mode,
+asus_proc_add(char *name, const struct file_operations *proc_fops, mode_t mode,
 		     struct acpi_device *device)
 {
-	struct proc_dir_entry *proc =
-	    create_proc_entry(name, mode, acpi_device_dir(device));
+	struct proc_dir_entry *proc;
+
+	proc = proc_create_data(name, mode, acpi_device_dir(device),
+				proc_fops, acpi_driver_data(device));
 	if (!proc) {
 		printk(KERN_WARNING "  Unable to create %s fs entry\n", name);
 		return -1;
 	}
-	proc->write_proc = writefunc;
-	proc->read_proc = readfunc;
-	proc->data = acpi_driver_data(device);
 	proc->uid = asus_uid;
 	proc->gid = asus_gid;
 	return 0;
@@ -1019,10 +1096,9 @@ static int asus_hotk_add_fs(struct acpi_device *device)
 	if (!acpi_device_dir(device))
 		return -ENODEV;
 
-	proc = create_proc_entry(PROC_INFO, mode, acpi_device_dir(device));
+	proc = proc_create(PROC_INFO, mode, acpi_device_dir(device),
+			   &asus_info_proc_fops);
 	if (proc) {
-		proc->read_proc = proc_read_info;
-		proc->data = acpi_driver_data(device);
 		proc->uid = asus_uid;
 		proc->gid = asus_gid;
 	} else {
@@ -1031,28 +1107,23 @@ static int asus_hotk_add_fs(struct acpi_device *device)
 	}
 
 	if (hotk->methods->mt_wled) {
-		asus_proc_add(PROC_WLED, &proc_write_wled, &proc_read_wled,
-			      mode, device);
+		asus_proc_add(PROC_WLED, &wled_proc_fops, mode, device);
 	}
 
 	if (hotk->methods->mt_ledd) {
-		asus_proc_add(PROC_LEDD, &proc_write_ledd, &proc_read_ledd,
-			      mode, device);
+		asus_proc_add(PROC_LEDD, &ledd_proc_fops, mode, device);
 	}
 
 	if (hotk->methods->mt_mled) {
-		asus_proc_add(PROC_MLED, &proc_write_mled, &proc_read_mled,
-			      mode, device);
+		asus_proc_add(PROC_MLED, &mled_proc_fops, mode, device);
 	}
 
 	if (hotk->methods->mt_tled) {
-		asus_proc_add(PROC_TLED, &proc_write_tled, &proc_read_tled,
-			      mode, device);
+		asus_proc_add(PROC_TLED, &tled_proc_fops, mode, device);
 	}
 
 	if (hotk->methods->mt_bt_switch) {
-		asus_proc_add(PROC_BT, &proc_write_bluetooth,
-			      &proc_read_bluetooth, mode, device);
+		asus_proc_add(PROC_BT, &bluetooth_proc_fops, mode, device);
 	}
 
 	/*
@@ -1060,19 +1131,16 @@ static int asus_hotk_add_fs(struct acpi_device *device)
 	 * accessible from the keyboard
 	 */
 	if (hotk->methods->mt_lcd_switch && hotk->methods->lcd_status) {
-		asus_proc_add(PROC_LCD, &proc_write_lcd, &proc_read_lcd, mode,
-			      device);
+		asus_proc_add(PROC_LCD, &lcd_proc_fops, mode, device);
 	}
 
 	if ((hotk->methods->brightness_up && hotk->methods->brightness_down) ||
 	    (hotk->methods->brightness_get && hotk->methods->brightness_set)) {
-		asus_proc_add(PROC_BRN, &proc_write_brn, &proc_read_brn, mode,
-			      device);
+		asus_proc_add(PROC_BRN, &brn_proc_fops, mode, device);
 	}
 
 	if (hotk->methods->display_set) {
-		asus_proc_add(PROC_DISP, &proc_write_disp, &proc_read_disp,
-			      mode, device);
+		asus_proc_add(PROC_DISP, &disp_proc_fops, mode, device);
 	}
 
 	return 0;
@@ -1334,9 +1402,6 @@ static int asus_hotk_add(struct acpi_device *device)
 	acpi_status status = AE_OK;
 	int result;
 
-	if (!device)
-		return -EINVAL;
-
 	printk(KERN_NOTICE "Asus Laptop ACPI Extras version %s\n",
 	       ASUS_ACPI_VERSION);
 
@@ -1392,9 +1457,6 @@ end:
 
 static int asus_hotk_remove(struct acpi_device *device, int type)
 {
-	if (!device || !acpi_driver_data(device))
-		return -EINVAL;
-
 	asus_hotk_remove_fs(device);
 
 	kfree(hotk);
@@ -1422,21 +1484,17 @@ static int __init asus_acpi_init(void)
 {
 	int result;
 
-	if (acpi_disabled)
-		return -ENODEV;
+	result = acpi_bus_register_driver(&asus_hotk_driver);
+	if (result < 0)
+		return result;
 
 	asus_proc_dir = proc_mkdir(PROC_ASUS, acpi_root_dir);
 	if (!asus_proc_dir) {
 		printk(KERN_ERR "Asus ACPI: Unable to create /proc entry\n");
+		acpi_bus_unregister_driver(&asus_hotk_driver);
 		return -ENODEV;
 	}
 
-	result = acpi_bus_register_driver(&asus_hotk_driver);
-	if (result < 0) {
-		remove_proc_entry(PROC_ASUS, acpi_root_dir);
-		return result;
-	}
-
 	/*
 	 * This is a bit of a kludge.  We only want this module loaded
 	 * for ASUS systems, but there's currently no way to probe the
diff --git a/drivers/platform/x86/classmate-laptop.c b/drivers/platform/x86/classmate-laptop.c
new file mode 100644
index 000000000000..ed90082cdf1d
--- /dev/null
+++ b/drivers/platform/x86/classmate-laptop.c
@@ -0,0 +1,609 @@
+/*
+ *  Copyright (C) 2009  Thadeu Lima de Souza Cascardo <cascardo@holoscopio.com>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License along
+ *  with this program; if not, write to the Free Software Foundation, Inc.,
+ *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/workqueue.h>
+#include <acpi/acpi_drivers.h>
+#include <linux/backlight.h>
+#include <linux/input.h>
+
+MODULE_LICENSE("GPL");
+
+
+struct cmpc_accel {
+	int sensitivity;
+};
+
+#define CMPC_ACCEL_SENSITIVITY_DEFAULT		5
+
+
+/*
+ * Generic input device code.
+ */
+
+typedef void (*input_device_init)(struct input_dev *dev);
+
+static int cmpc_add_acpi_notify_device(struct acpi_device *acpi, char *name,
+				       input_device_init idev_init)
+{
+	struct input_dev *inputdev;
+	int error;
+
+	inputdev = input_allocate_device();
+	if (!inputdev)
+		return -ENOMEM;
+	inputdev->name = name;
+	inputdev->dev.parent = &acpi->dev;
+	idev_init(inputdev);
+	error = input_register_device(inputdev);
+	if (error) {
+		input_free_device(inputdev);
+		return error;
+	}
+	dev_set_drvdata(&acpi->dev, inputdev);
+	return 0;
+}
+
+static int cmpc_remove_acpi_notify_device(struct acpi_device *acpi)
+{
+	struct input_dev *inputdev = dev_get_drvdata(&acpi->dev);
+	input_unregister_device(inputdev);
+	return 0;
+}
+
+/*
+ * Accelerometer code.
+ */
+static acpi_status cmpc_start_accel(acpi_handle handle)
+{
+	union acpi_object param[2];
+	struct acpi_object_list input;
+	acpi_status status;
+
+	param[0].type = ACPI_TYPE_INTEGER;
+	param[0].integer.value = 0x3;
+	param[1].type = ACPI_TYPE_INTEGER;
+	input.count = 2;
+	input.pointer = param;
+	status = acpi_evaluate_object(handle, "ACMD", &input, NULL);
+	return status;
+}
+
+static acpi_status cmpc_stop_accel(acpi_handle handle)
+{
+	union acpi_object param[2];
+	struct acpi_object_list input;
+	acpi_status status;
+
+	param[0].type = ACPI_TYPE_INTEGER;
+	param[0].integer.value = 0x4;
+	param[1].type = ACPI_TYPE_INTEGER;
+	input.count = 2;
+	input.pointer = param;
+	status = acpi_evaluate_object(handle, "ACMD", &input, NULL);
+	return status;
+}
+
+static acpi_status cmpc_accel_set_sensitivity(acpi_handle handle, int val)
+{
+	union acpi_object param[2];
+	struct acpi_object_list input;
+
+	param[0].type = ACPI_TYPE_INTEGER;
+	param[0].integer.value = 0x02;
+	param[1].type = ACPI_TYPE_INTEGER;
+	param[1].integer.value = val;
+	input.count = 2;
+	input.pointer = param;
+	return acpi_evaluate_object(handle, "ACMD", &input, NULL);
+}
+
+static acpi_status cmpc_get_accel(acpi_handle handle,
+				  unsigned char *x,
+				  unsigned char *y,
+				  unsigned char *z)
+{
+	union acpi_object param[2];
+	struct acpi_object_list input;
+	struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, 0 };
+	unsigned char *locs;
+	acpi_status status;
+
+	param[0].type = ACPI_TYPE_INTEGER;
+	param[0].integer.value = 0x01;
+	param[1].type = ACPI_TYPE_INTEGER;
+	input.count = 2;
+	input.pointer = param;
+	status = acpi_evaluate_object(handle, "ACMD", &input, &output);
+	if (ACPI_SUCCESS(status)) {
+		union acpi_object *obj;
+		obj = output.pointer;
+		locs = obj->buffer.pointer;
+		*x = locs[0];
+		*y = locs[1];
+		*z = locs[2];
+		kfree(output.pointer);
+	}
+	return status;
+}
+
+static void cmpc_accel_handler(struct acpi_device *dev, u32 event)
+{
+	if (event == 0x81) {
+		unsigned char x, y, z;
+		acpi_status status;
+
+		status = cmpc_get_accel(dev->handle, &x, &y, &z);
+		if (ACPI_SUCCESS(status)) {
+			struct input_dev *inputdev = dev_get_drvdata(&dev->dev);
+
+			input_report_abs(inputdev, ABS_X, x);
+			input_report_abs(inputdev, ABS_Y, y);
+			input_report_abs(inputdev, ABS_Z, z);
+			input_sync(inputdev);
+		}
+	}
+}
+
+static ssize_t cmpc_accel_sensitivity_show(struct device *dev,
+					   struct device_attribute *attr,
+					   char *buf)
+{
+	struct acpi_device *acpi;
+	struct input_dev *inputdev;
+	struct cmpc_accel *accel;
+
+	acpi = to_acpi_device(dev);
+	inputdev = dev_get_drvdata(&acpi->dev);
+	accel = dev_get_drvdata(&inputdev->dev);
+
+	return sprintf(buf, "%d\n", accel->sensitivity);
+}
+
+static ssize_t cmpc_accel_sensitivity_store(struct device *dev,
+					    struct device_attribute *attr,
+					    const char *buf, size_t count)
+{
+	struct acpi_device *acpi;
+	struct input_dev *inputdev;
+	struct cmpc_accel *accel;
+	unsigned long sensitivity;
+	int r;
+
+	acpi = to_acpi_device(dev);
+	inputdev = dev_get_drvdata(&acpi->dev);
+	accel = dev_get_drvdata(&inputdev->dev);
+
+	r = strict_strtoul(buf, 0, &sensitivity);
+	if (r)
+		return r;
+
+	accel->sensitivity = sensitivity;
+	cmpc_accel_set_sensitivity(acpi->handle, sensitivity);
+
+	return strnlen(buf, count);
+}
+
+struct device_attribute cmpc_accel_sensitivity_attr = {
+	.attr = { .name = "sensitivity", .mode = 0660 },
+	.show = cmpc_accel_sensitivity_show,
+	.store = cmpc_accel_sensitivity_store
+};
+
+static int cmpc_accel_open(struct input_dev *input)
+{
+	struct acpi_device *acpi;
+
+	acpi = to_acpi_device(input->dev.parent);
+	if (ACPI_SUCCESS(cmpc_start_accel(acpi->handle)))
+		return 0;
+	return -EIO;
+}
+
+static void cmpc_accel_close(struct input_dev *input)
+{
+	struct acpi_device *acpi;
+
+	acpi = to_acpi_device(input->dev.parent);
+	cmpc_stop_accel(acpi->handle);
+}
+
+static void cmpc_accel_idev_init(struct input_dev *inputdev)
+{
+	set_bit(EV_ABS, inputdev->evbit);
+	input_set_abs_params(inputdev, ABS_X, 0, 255, 8, 0);
+	input_set_abs_params(inputdev, ABS_Y, 0, 255, 8, 0);
+	input_set_abs_params(inputdev, ABS_Z, 0, 255, 8, 0);
+	inputdev->open = cmpc_accel_open;
+	inputdev->close = cmpc_accel_close;
+}
+
+static int cmpc_accel_add(struct acpi_device *acpi)
+{
+	int error;
+	struct input_dev *inputdev;
+	struct cmpc_accel *accel;
+
+	accel = kmalloc(sizeof(*accel), GFP_KERNEL);
+	if (!accel)
+		return -ENOMEM;
+
+	accel->sensitivity = CMPC_ACCEL_SENSITIVITY_DEFAULT;
+	cmpc_accel_set_sensitivity(acpi->handle, accel->sensitivity);
+
+	error = device_create_file(&acpi->dev, &cmpc_accel_sensitivity_attr);
+	if (error)
+		goto failed_file;
+
+	error = cmpc_add_acpi_notify_device(acpi, "cmpc_accel",
+					    cmpc_accel_idev_init);
+	if (error)
+		goto failed_input;
+
+	inputdev = dev_get_drvdata(&acpi->dev);
+	dev_set_drvdata(&inputdev->dev, accel);
+
+	return 0;
+
+failed_input:
+	device_remove_file(&acpi->dev, &cmpc_accel_sensitivity_attr);
+failed_file:
+	kfree(accel);
+	return error;
+}
+
+static int cmpc_accel_remove(struct acpi_device *acpi, int type)
+{
+	struct input_dev *inputdev;
+	struct cmpc_accel *accel;
+
+	inputdev = dev_get_drvdata(&acpi->dev);
+	accel = dev_get_drvdata(&inputdev->dev);
+
+	device_remove_file(&acpi->dev, &cmpc_accel_sensitivity_attr);
+	return cmpc_remove_acpi_notify_device(acpi);
+}
+
+static const struct acpi_device_id cmpc_accel_device_ids[] = {
+	{"ACCE0000", 0},
+	{"", 0}
+};
+MODULE_DEVICE_TABLE(acpi, cmpc_accel_device_ids);
+
+static struct acpi_driver cmpc_accel_acpi_driver = {
+	.owner = THIS_MODULE,
+	.name = "cmpc_accel",
+	.class = "cmpc_accel",
+	.ids = cmpc_accel_device_ids,
+	.ops = {
+		.add = cmpc_accel_add,
+		.remove = cmpc_accel_remove,
+		.notify = cmpc_accel_handler,
+	}
+};
+
+
+/*
+ * Tablet mode code.
+ */
+static acpi_status cmpc_get_tablet(acpi_handle handle,
+				   unsigned long long *value)
+{
+	union acpi_object param;
+	struct acpi_object_list input;
+	unsigned long long output;
+	acpi_status status;
+
+	param.type = ACPI_TYPE_INTEGER;
+	param.integer.value = 0x01;
+	input.count = 1;
+	input.pointer = &param;
+	status = acpi_evaluate_integer(handle, "TCMD", &input, &output);
+	if (ACPI_SUCCESS(status))
+		*value = output;
+	return status;
+}
+
+static void cmpc_tablet_handler(struct acpi_device *dev, u32 event)
+{
+	unsigned long long val = 0;
+	struct input_dev *inputdev = dev_get_drvdata(&dev->dev);
+
+	if (event == 0x81) {
+		if (ACPI_SUCCESS(cmpc_get_tablet(dev->handle, &val)))
+			input_report_switch(inputdev, SW_TABLET_MODE, !val);
+	}
+}
+
+static void cmpc_tablet_idev_init(struct input_dev *inputdev)
+{
+	unsigned long long val = 0;
+	struct acpi_device *acpi;
+
+	set_bit(EV_SW, inputdev->evbit);
+	set_bit(SW_TABLET_MODE, inputdev->swbit);
+
+	acpi = to_acpi_device(inputdev->dev.parent);
+	if (ACPI_SUCCESS(cmpc_get_tablet(acpi->handle, &val)))
+		input_report_switch(inputdev, SW_TABLET_MODE, !val);
+}
+
+static int cmpc_tablet_add(struct acpi_device *acpi)
+{
+	return cmpc_add_acpi_notify_device(acpi, "cmpc_tablet",
+					   cmpc_tablet_idev_init);
+}
+
+static int cmpc_tablet_remove(struct acpi_device *acpi, int type)
+{
+	return cmpc_remove_acpi_notify_device(acpi);
+}
+
+static int cmpc_tablet_resume(struct acpi_device *acpi)
+{
+	struct input_dev *inputdev = dev_get_drvdata(&acpi->dev);
+	unsigned long long val = 0;
+	if (ACPI_SUCCESS(cmpc_get_tablet(acpi->handle, &val)))
+		input_report_switch(inputdev, SW_TABLET_MODE, !val);
+	return 0;
+}
+
+static const struct acpi_device_id cmpc_tablet_device_ids[] = {
+	{"TBLT0000", 0},
+	{"", 0}
+};
+MODULE_DEVICE_TABLE(acpi, cmpc_tablet_device_ids);
+
+static struct acpi_driver cmpc_tablet_acpi_driver = {
+	.owner = THIS_MODULE,
+	.name = "cmpc_tablet",
+	.class = "cmpc_tablet",
+	.ids = cmpc_tablet_device_ids,
+	.ops = {
+		.add = cmpc_tablet_add,
+		.remove = cmpc_tablet_remove,
+		.resume = cmpc_tablet_resume,
+		.notify = cmpc_tablet_handler,
+	}
+};
+
+
+/*
+ * Backlight code.
+ */
+
+static acpi_status cmpc_get_brightness(acpi_handle handle,
+				       unsigned long long *value)
+{
+	union acpi_object param;
+	struct acpi_object_list input;
+	unsigned long long output;
+	acpi_status status;
+
+	param.type = ACPI_TYPE_INTEGER;
+	param.integer.value = 0xC0;
+	input.count = 1;
+	input.pointer = &param;
+	status = acpi_evaluate_integer(handle, "GRDI", &input, &output);
+	if (ACPI_SUCCESS(status))
+		*value = output;
+	return status;
+}
+
+static acpi_status cmpc_set_brightness(acpi_handle handle,
+				       unsigned long long value)
+{
+	union acpi_object param[2];
+	struct acpi_object_list input;
+	acpi_status status;
+	unsigned long long output;
+
+	param[0].type = ACPI_TYPE_INTEGER;
+	param[0].integer.value = 0xC0;
+	param[1].type = ACPI_TYPE_INTEGER;
+	param[1].integer.value = value;
+	input.count = 2;
+	input.pointer = param;
+	status = acpi_evaluate_integer(handle, "GWRI", &input, &output);
+	return status;
+}
+
+static int cmpc_bl_get_brightness(struct backlight_device *bd)
+{
+	acpi_status status;
+	acpi_handle handle;
+	unsigned long long brightness;
+
+	handle = bl_get_data(bd);
+	status = cmpc_get_brightness(handle, &brightness);
+	if (ACPI_SUCCESS(status))
+		return brightness;
+	else
+		return -1;
+}
+
+static int cmpc_bl_update_status(struct backlight_device *bd)
+{
+	acpi_status status;
+	acpi_handle handle;
+
+	handle = bl_get_data(bd);
+	status = cmpc_set_brightness(handle, bd->props.brightness);
+	if (ACPI_SUCCESS(status))
+		return 0;
+	else
+		return -1;
+}
+
+static struct backlight_ops cmpc_bl_ops = {
+	.get_brightness = cmpc_bl_get_brightness,
+	.update_status = cmpc_bl_update_status
+};
+
+static int cmpc_bl_add(struct acpi_device *acpi)
+{
+	struct backlight_device *bd;
+
+	bd = backlight_device_register("cmpc_bl", &acpi->dev,
+				       acpi->handle, &cmpc_bl_ops);
+	bd->props.max_brightness = 7;
+	dev_set_drvdata(&acpi->dev, bd);
+	return 0;
+}
+
+static int cmpc_bl_remove(struct acpi_device *acpi, int type)
+{
+	struct backlight_device *bd;
+
+	bd = dev_get_drvdata(&acpi->dev);
+	backlight_device_unregister(bd);
+	return 0;
+}
+
+static const struct acpi_device_id cmpc_device_ids[] = {
+	{"IPML200", 0},
+	{"", 0}
+};
+MODULE_DEVICE_TABLE(acpi, cmpc_device_ids);
+
+static struct acpi_driver cmpc_bl_acpi_driver = {
+	.owner = THIS_MODULE,
+	.name = "cmpc",
+	.class = "cmpc",
+	.ids = cmpc_device_ids,
+	.ops = {
+		.add = cmpc_bl_add,
+		.remove = cmpc_bl_remove
+	}
+};
+
+
+/*
+ * Extra keys code.
+ */
+static int cmpc_keys_codes[] = {
+	KEY_UNKNOWN,
+	KEY_WLAN,
+	KEY_SWITCHVIDEOMODE,
+	KEY_BRIGHTNESSDOWN,
+	KEY_BRIGHTNESSUP,
+	KEY_VENDOR,
+	KEY_MAX
+};
+
+static void cmpc_keys_handler(struct acpi_device *dev, u32 event)
+{
+	struct input_dev *inputdev;
+	int code = KEY_MAX;
+
+	if ((event & 0x0F) < ARRAY_SIZE(cmpc_keys_codes))
+		code = cmpc_keys_codes[event & 0x0F];
+	inputdev = dev_get_drvdata(&dev->dev);;
+	input_report_key(inputdev, code, !(event & 0x10));
+}
+
+static void cmpc_keys_idev_init(struct input_dev *inputdev)
+{
+	int i;
+
+	set_bit(EV_KEY, inputdev->evbit);
+	for (i = 0; cmpc_keys_codes[i] != KEY_MAX; i++)
+		set_bit(cmpc_keys_codes[i], inputdev->keybit);
+}
+
+static int cmpc_keys_add(struct acpi_device *acpi)
+{
+	return cmpc_add_acpi_notify_device(acpi, "cmpc_keys",
+					   cmpc_keys_idev_init);
+}
+
+static int cmpc_keys_remove(struct acpi_device *acpi, int type)
+{
+	return cmpc_remove_acpi_notify_device(acpi);
+}
+
+static const struct acpi_device_id cmpc_keys_device_ids[] = {
+	{"FnBT0000", 0},
+	{"", 0}
+};
+MODULE_DEVICE_TABLE(acpi, cmpc_keys_device_ids);
+
+static struct acpi_driver cmpc_keys_acpi_driver = {
+	.owner = THIS_MODULE,
+	.name = "cmpc_keys",
+	.class = "cmpc_keys",
+	.ids = cmpc_keys_device_ids,
+	.ops = {
+		.add = cmpc_keys_add,
+		.remove = cmpc_keys_remove,
+		.notify = cmpc_keys_handler,
+	}
+};
+
+
+/*
+ * General init/exit code.
+ */
+
+static int cmpc_init(void)
+{
+	int r;
+
+	r = acpi_bus_register_driver(&cmpc_keys_acpi_driver);
+	if (r)
+		goto failed_keys;
+
+	r = acpi_bus_register_driver(&cmpc_bl_acpi_driver);
+	if (r)
+		goto failed_bl;
+
+	r = acpi_bus_register_driver(&cmpc_tablet_acpi_driver);
+	if (r)
+		goto failed_tablet;
+
+	r = acpi_bus_register_driver(&cmpc_accel_acpi_driver);
+	if (r)
+		goto failed_accel;
+
+	return r;
+
+failed_accel:
+	acpi_bus_unregister_driver(&cmpc_tablet_acpi_driver);
+
+failed_tablet:
+	acpi_bus_unregister_driver(&cmpc_bl_acpi_driver);
+
+failed_bl:
+	acpi_bus_unregister_driver(&cmpc_keys_acpi_driver);
+
+failed_keys:
+	return r;
+}
+
+static void cmpc_exit(void)
+{
+	acpi_bus_unregister_driver(&cmpc_accel_acpi_driver);
+	acpi_bus_unregister_driver(&cmpc_tablet_acpi_driver);
+	acpi_bus_unregister_driver(&cmpc_bl_acpi_driver);
+	acpi_bus_unregister_driver(&cmpc_keys_acpi_driver);
+}
+
+module_init(cmpc_init);
+module_exit(cmpc_exit);
diff --git a/drivers/platform/x86/compal-laptop.c b/drivers/platform/x86/compal-laptop.c
index 11003bba10d3..1a387e79f719 100644
--- a/drivers/platform/x86/compal-laptop.c
+++ b/drivers/platform/x86/compal-laptop.c
@@ -51,7 +51,6 @@
 #include <linux/dmi.h>
 #include <linux/backlight.h>
 #include <linux/platform_device.h>
-#include <linux/autoconf.h>
 
 #define COMPAL_DRIVER_VERSION "0.2.6"
 
diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c
index 74909c4aaeea..3780994dc8f2 100644
--- a/drivers/platform/x86/dell-laptop.c
+++ b/drivers/platform/x86/dell-laptop.c
@@ -58,6 +58,14 @@ static int da_command_code;
 static int da_num_tokens;
 static struct calling_interface_token *da_tokens;
 
+static struct platform_driver platform_driver = {
+	.driver = {
+		.name = "dell-laptop",
+		.owner = THIS_MODULE,
+	}
+};
+
+static struct platform_device *platform_device;
 static struct backlight_device *dell_backlight_device;
 static struct rfkill *wifi_rfkill;
 static struct rfkill *bluetooth_rfkill;
@@ -74,7 +82,7 @@ static const struct dmi_system_id __initdata dell_device_table[] = {
 	{ }
 };
 
-static void parse_da_table(const struct dmi_header *dm)
+static void __init parse_da_table(const struct dmi_header *dm)
 {
 	/* Final token is a terminator, so we don't want to copy it */
 	int tokens = (dm->length-11)/sizeof(struct calling_interface_token)-1;
@@ -103,7 +111,7 @@ static void parse_da_table(const struct dmi_header *dm)
 	da_num_tokens += tokens;
 }
 
-static void find_tokens(const struct dmi_header *dm, void *dummy)
+static void __init find_tokens(const struct dmi_header *dm, void *dummy)
 {
 	switch (dm->type) {
 	case 0xd4: /* Indexed IO */
@@ -197,8 +205,8 @@ static void dell_rfkill_query(struct rfkill *rfkill, void *data)
 	dell_send_request(&buffer, 17, 11);
 	status = buffer.output[1];
 
-	if (status & BIT(bit))
-		rfkill_set_hw_state(rfkill, !!(status & BIT(16)));
+	rfkill_set_sw_state(rfkill, !!(status & BIT(bit)));
+	rfkill_set_hw_state(rfkill, !(status & BIT(16)));
 }
 
 static const struct rfkill_ops dell_rfkill_ops = {
@@ -206,7 +214,7 @@ static const struct rfkill_ops dell_rfkill_ops = {
 	.query = dell_rfkill_query,
 };
 
-static int dell_setup_rfkill(void)
+static int __init dell_setup_rfkill(void)
 {
 	struct calling_interface_buffer buffer;
 	int status;
@@ -217,7 +225,8 @@ static int dell_setup_rfkill(void)
 	status = buffer.output[1];
 
 	if ((status & (1<<2|1<<8)) == (1<<2|1<<8)) {
-		wifi_rfkill = rfkill_alloc("dell-wifi", NULL, RFKILL_TYPE_WLAN,
+		wifi_rfkill = rfkill_alloc("dell-wifi", &platform_device->dev,
+					   RFKILL_TYPE_WLAN,
 					   &dell_rfkill_ops, (void *) 1);
 		if (!wifi_rfkill) {
 			ret = -ENOMEM;
@@ -229,7 +238,8 @@ static int dell_setup_rfkill(void)
 	}
 
 	if ((status & (1<<3|1<<9)) == (1<<3|1<<9)) {
-		bluetooth_rfkill = rfkill_alloc("dell-bluetooth", NULL,
+		bluetooth_rfkill = rfkill_alloc("dell-bluetooth",
+						&platform_device->dev,
 						RFKILL_TYPE_BLUETOOTH,
 						&dell_rfkill_ops, (void *) 2);
 		if (!bluetooth_rfkill) {
@@ -242,7 +252,9 @@ static int dell_setup_rfkill(void)
 	}
 
 	if ((status & (1<<4|1<<10)) == (1<<4|1<<10)) {
-		wwan_rfkill = rfkill_alloc("dell-wwan", NULL, RFKILL_TYPE_WWAN,
+		wwan_rfkill = rfkill_alloc("dell-wwan",
+					   &platform_device->dev,
+					   RFKILL_TYPE_WWAN,
 					   &dell_rfkill_ops, (void *) 3);
 		if (!wwan_rfkill) {
 			ret = -ENOMEM;
@@ -268,6 +280,22 @@ err_wifi:
 	return ret;
 }
 
+static void dell_cleanup_rfkill(void)
+{
+	if (wifi_rfkill) {
+		rfkill_unregister(wifi_rfkill);
+		rfkill_destroy(wifi_rfkill);
+	}
+	if (bluetooth_rfkill) {
+		rfkill_unregister(bluetooth_rfkill);
+		rfkill_destroy(bluetooth_rfkill);
+	}
+	if (wwan_rfkill) {
+		rfkill_unregister(wwan_rfkill);
+		rfkill_destroy(wwan_rfkill);
+	}
+}
+
 static int dell_send_intensity(struct backlight_device *bd)
 {
 	struct calling_interface_buffer buffer;
@@ -326,11 +354,23 @@ static int __init dell_init(void)
 		return -ENODEV;
 	}
 
+	ret = platform_driver_register(&platform_driver);
+	if (ret)
+		goto fail_platform_driver;
+	platform_device = platform_device_alloc("dell-laptop", -1);
+	if (!platform_device) {
+		ret = -ENOMEM;
+		goto fail_platform_device1;
+	}
+	ret = platform_device_add(platform_device);
+	if (ret)
+		goto fail_platform_device2;
+
 	ret = dell_setup_rfkill();
 
 	if (ret) {
 		printk(KERN_WARNING "dell-laptop: Unable to setup rfkill\n");
-		goto out;
+		goto fail_rfkill;
 	}
 
 #ifdef CONFIG_ACPI
@@ -352,13 +392,13 @@ static int __init dell_init(void)
 	if (max_intensity) {
 		dell_backlight_device = backlight_device_register(
 			"dell_backlight",
-			NULL, NULL,
+			&platform_device->dev, NULL,
 			&dell_ops);
 
 		if (IS_ERR(dell_backlight_device)) {
 			ret = PTR_ERR(dell_backlight_device);
 			dell_backlight_device = NULL;
-			goto out;
+			goto fail_backlight;
 		}
 
 		dell_backlight_device->props.max_brightness = max_intensity;
@@ -368,13 +408,16 @@ static int __init dell_init(void)
 	}
 
 	return 0;
-out:
-	if (wifi_rfkill)
-		rfkill_unregister(wifi_rfkill);
-	if (bluetooth_rfkill)
-		rfkill_unregister(bluetooth_rfkill);
-	if (wwan_rfkill)
-		rfkill_unregister(wwan_rfkill);
+
+fail_backlight:
+	dell_cleanup_rfkill();
+fail_rfkill:
+	platform_device_del(platform_device);
+fail_platform_device2:
+	platform_device_put(platform_device);
+fail_platform_device1:
+	platform_driver_unregister(&platform_driver);
+fail_platform_driver:
 	kfree(da_tokens);
 	return ret;
 }
@@ -382,12 +425,7 @@ out:
 static void __exit dell_exit(void)
 {
 	backlight_device_unregister(dell_backlight_device);
-	if (wifi_rfkill)
-		rfkill_unregister(wifi_rfkill);
-	if (bluetooth_rfkill)
-		rfkill_unregister(bluetooth_rfkill);
-	if (wwan_rfkill)
-		rfkill_unregister(wwan_rfkill);
+	dell_cleanup_rfkill();
 }
 
 module_init(dell_init);
diff --git a/drivers/platform/x86/dell-wmi.c b/drivers/platform/x86/dell-wmi.c
index 0f900cc9fa7a..1b1dddbd5744 100644
--- a/drivers/platform/x86/dell-wmi.c
+++ b/drivers/platform/x86/dell-wmi.c
@@ -31,6 +31,7 @@
 #include <acpi/acpi_drivers.h>
 #include <linux/acpi.h>
 #include <linux/string.h>
+#include <linux/dmi.h>
 
 MODULE_AUTHOR("Matthew Garrett <mjg@redhat.com>");
 MODULE_DESCRIPTION("Dell laptop WMI hotkeys driver");
@@ -38,6 +39,8 @@ MODULE_LICENSE("GPL");
 
 #define DELL_EVENT_GUID "9DBB5994-A997-11DA-B012-B622A1EF5492"
 
+static int acpi_video;
+
 MODULE_ALIAS("wmi:"DELL_EVENT_GUID);
 
 struct key_entry {
@@ -54,7 +57,7 @@ enum { KE_KEY, KE_SW, KE_IGNORE, KE_END };
  * via the keyboard controller so should not be sent again.
  */
 
-static struct key_entry dell_wmi_keymap[] = {
+static struct key_entry dell_legacy_wmi_keymap[] = {
 	{KE_KEY, 0xe045, KEY_PROG1},
 	{KE_KEY, 0xe009, KEY_EJECTCD},
 
@@ -72,7 +75,7 @@ static struct key_entry dell_wmi_keymap[] = {
 
 	/* The next device is at offset 6, the active devices are at
 	   offset 8 and the attached devices at offset 10 */
-	{KE_KEY, 0xe00b, KEY_DISPLAYTOGGLE},
+	{KE_KEY, 0xe00b, KEY_SWITCHVIDEOMODE},
 
 	{KE_IGNORE, 0xe00c, KEY_KBDILLUMTOGGLE},
 
@@ -96,6 +99,47 @@ static struct key_entry dell_wmi_keymap[] = {
 	{KE_END, 0}
 };
 
+static bool dell_new_hk_type;
+
+struct dell_new_keymap_entry {
+	u16 scancode;
+	u16 keycode;
+};
+
+struct dell_hotkey_table {
+	struct dmi_header header;
+	struct dell_new_keymap_entry keymap[];
+
+};
+
+static struct key_entry *dell_new_wmi_keymap;
+
+static u16 bios_to_linux_keycode[256] = {
+
+	KEY_MEDIA,	KEY_NEXTSONG,	KEY_PLAYPAUSE, KEY_PREVIOUSSONG,
+	KEY_STOPCD,	KEY_UNKNOWN,	KEY_UNKNOWN,	KEY_UNKNOWN,
+	KEY_WWW,	KEY_UNKNOWN,	KEY_VOLUMEDOWN, KEY_MUTE,
+	KEY_VOLUMEUP,	KEY_UNKNOWN,	KEY_BATTERY,	KEY_EJECTCD,
+	KEY_UNKNOWN,	KEY_SLEEP,	KEY_PROG1, KEY_BRIGHTNESSDOWN,
+	KEY_BRIGHTNESSUP,	KEY_UNKNOWN,	KEY_KBDILLUMTOGGLE,
+	KEY_UNKNOWN,	KEY_SWITCHVIDEOMODE,	KEY_UNKNOWN, KEY_UNKNOWN,
+	KEY_SWITCHVIDEOMODE,	KEY_UNKNOWN,	KEY_UNKNOWN, KEY_PROG2,
+	KEY_UNKNOWN, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+	KEY_PROG3
+};
+
+
+static struct key_entry *dell_wmi_keymap = dell_legacy_wmi_keymap;
+
 static struct input_dev *dell_wmi_input_dev;
 
 static struct key_entry *dell_wmi_get_entry_by_scancode(int code)
@@ -158,30 +202,90 @@ static void dell_wmi_notify(u32 value, void *context)
 	struct acpi_buffer response = { ACPI_ALLOCATE_BUFFER, NULL };
 	static struct key_entry *key;
 	union acpi_object *obj;
+	acpi_status status;
 
-	wmi_get_event_data(value, &response);
+	status = wmi_get_event_data(value, &response);
+	if (status != AE_OK) {
+		printk(KERN_INFO "dell-wmi: bad event status 0x%x\n", status);
+		return;
+	}
 
 	obj = (union acpi_object *)response.pointer;
 
 	if (obj && obj->type == ACPI_TYPE_BUFFER) {
-		int *buffer = (int *)obj->buffer.pointer;
-		/*
-		 *  The upper bytes of the event may contain
-		 *  additional information, so mask them off for the
-		 *  scancode lookup
-		 */
-		key = dell_wmi_get_entry_by_scancode(buffer[1] & 0xFFFF);
-		if (key) {
+		int reported_key;
+		u16 *buffer_entry = (u16 *)obj->buffer.pointer;
+		if (dell_new_hk_type && (buffer_entry[1] != 0x10)) {
+			printk(KERN_INFO "dell-wmi: Received unknown WMI event"
+					 " (0x%x)\n", buffer_entry[1]);
+			return;
+		}
+
+		if (dell_new_hk_type)
+			reported_key = (int)buffer_entry[2];
+		else
+			reported_key = (int)buffer_entry[1] & 0xffff;
+
+		key = dell_wmi_get_entry_by_scancode(reported_key);
+
+		if (!key) {
+			printk(KERN_INFO "dell-wmi: Unknown key %x pressed\n",
+				reported_key);
+		} else if ((key->keycode == KEY_BRIGHTNESSUP ||
+			    key->keycode == KEY_BRIGHTNESSDOWN) && acpi_video) {
+			/* Don't report brightness notifications that will also
+			 * come via ACPI */
+			return;
+		} else {
 			input_report_key(dell_wmi_input_dev, key->keycode, 1);
 			input_sync(dell_wmi_input_dev);
 			input_report_key(dell_wmi_input_dev, key->keycode, 0);
 			input_sync(dell_wmi_input_dev);
-		} else if (buffer[1] & 0xFFFF)
-			printk(KERN_INFO "dell-wmi: Unknown key %x pressed\n",
-			       buffer[1] & 0xFFFF);
+		}
+	}
+	kfree(obj);
+}
+
+
+static void setup_new_hk_map(const struct dmi_header *dm)
+{
+
+	int i;
+	int hotkey_num = (dm->length-4)/sizeof(struct dell_new_keymap_entry);
+	struct dell_hotkey_table *table =
+		container_of(dm, struct dell_hotkey_table, header);
+
+	dell_new_wmi_keymap = kzalloc((hotkey_num+1) *
+				      sizeof(struct key_entry), GFP_KERNEL);
+
+	for (i = 0; i < hotkey_num; i++) {
+		dell_new_wmi_keymap[i].type = KE_KEY;
+		dell_new_wmi_keymap[i].code = table->keymap[i].scancode;
+		dell_new_wmi_keymap[i].keycode =
+			(table->keymap[i].keycode > 255) ? 0 :
+			bios_to_linux_keycode[table->keymap[i].keycode];
+	}
+
+	dell_new_wmi_keymap[i].type = KE_END;
+	dell_new_wmi_keymap[i].code = 0;
+	dell_new_wmi_keymap[i].keycode = 0;
+
+	dell_wmi_keymap = dell_new_wmi_keymap;
+
+}
+
+
+static void find_hk_type(const struct dmi_header *dm, void *dummy)
+{
+
+	if ((dm->type == 0xb2) && (dm->length > 6)) {
+		dell_new_hk_type = true;
+		setup_new_hk_map(dm);
 	}
+
 }
 
+
 static int __init dell_wmi_input_setup(void)
 {
 	struct key_entry *key;
@@ -224,34 +328,37 @@ static int __init dell_wmi_input_setup(void)
 static int __init dell_wmi_init(void)
 {
 	int err;
+	acpi_status status;
 
-	if (wmi_has_guid(DELL_EVENT_GUID)) {
-		err = dell_wmi_input_setup();
+	if (!wmi_has_guid(DELL_EVENT_GUID)) {
+		printk(KERN_WARNING "dell-wmi: No known WMI GUID found\n");
+		return -ENODEV;
+	}
 
-		if (err)
-			return err;
+	dmi_walk(find_hk_type, NULL);
+	acpi_video = acpi_video_backlight_support();
 
-		err = wmi_install_notify_handler(DELL_EVENT_GUID,
-						 dell_wmi_notify, NULL);
-		if (err) {
-			input_unregister_device(dell_wmi_input_dev);
-			printk(KERN_ERR "dell-wmi: Unable to register"
-			       " notify handler - %d\n", err);
-			return err;
-		}
+	err = dell_wmi_input_setup();
+	if (err)
+		return err;
 
-	} else
-		printk(KERN_WARNING "dell-wmi: No known WMI GUID found\n");
+	status = wmi_install_notify_handler(DELL_EVENT_GUID,
+					 dell_wmi_notify, NULL);
+	if (ACPI_FAILURE(status)) {
+		input_unregister_device(dell_wmi_input_dev);
+		printk(KERN_ERR
+			"dell-wmi: Unable to register notify handler - %d\n",
+			status);
+		return -ENODEV;
+	}
 
 	return 0;
 }
 
 static void __exit dell_wmi_exit(void)
 {
-	if (wmi_has_guid(DELL_EVENT_GUID)) {
-		wmi_remove_notify_handler(DELL_EVENT_GUID);
-		input_unregister_device(dell_wmi_input_dev);
-	}
+	wmi_remove_notify_handler(DELL_EVENT_GUID);
+	input_unregister_device(dell_wmi_input_dev);
 }
 
 module_init(dell_wmi_init);
diff --git a/drivers/platform/x86/eeepc-laptop.c b/drivers/platform/x86/eeepc-laptop.c
index 4226e5352738..e2be6bb33d92 100644
--- a/drivers/platform/x86/eeepc-laptop.c
+++ b/drivers/platform/x86/eeepc-laptop.c
@@ -1,5 +1,5 @@
 /*
- *  eepc-laptop.c - Asus Eee PC extras
+ *  eeepc-laptop.c - Asus Eee PC extras
  *
  *  Based on asus_acpi.c as patched for the Eee PC by Asus:
  *  ftp://ftp.asus.com/pub/ASUS/EeePC/701/ASUS_ACPI_071126.rar
@@ -31,23 +31,36 @@
 #include <acpi/acpi_bus.h>
 #include <linux/uaccess.h>
 #include <linux/input.h>
+#include <linux/input/sparse-keymap.h>
 #include <linux/rfkill.h>
 #include <linux/pci.h>
 #include <linux/pci_hotplug.h>
+#include <linux/leds.h>
+#include <linux/dmi.h>
 
 #define EEEPC_LAPTOP_VERSION	"0.1"
+#define EEEPC_LAPTOP_NAME	"Eee PC Hotkey Driver"
+#define EEEPC_LAPTOP_FILE	"eeepc"
 
-#define EEEPC_HOTK_NAME		"Eee PC Hotkey Driver"
-#define EEEPC_HOTK_FILE		"eeepc"
-#define EEEPC_HOTK_CLASS	"hotkey"
-#define EEEPC_HOTK_DEVICE_NAME	"Hotkey"
-#define EEEPC_HOTK_HID		"ASUS010"
+#define EEEPC_ACPI_CLASS	"hotkey"
+#define EEEPC_ACPI_DEVICE_NAME	"Hotkey"
+#define EEEPC_ACPI_HID		"ASUS010"
 
+MODULE_AUTHOR("Corentin Chary, Eric Cooper");
+MODULE_DESCRIPTION(EEEPC_LAPTOP_NAME);
+MODULE_LICENSE("GPL");
+
+static bool hotplug_disabled;
+
+module_param(hotplug_disabled, bool, 0644);
+MODULE_PARM_DESC(hotplug_disabled,
+		 "Disable hotplug for wireless device. "
+		 "If your laptop need that, please report to "
+		 "acpi4asus-user@lists.sourceforge.net.");
 
 /*
  * Definitions for Asus EeePC
  */
-#define	NOTIFY_WLAN_ON	0x10
 #define NOTIFY_BRN_MIN	0x20
 #define NOTIFY_BRN_MAX	0x2f
 
@@ -117,145 +130,64 @@ static const char *cm_setv[] = {
 	NULL, NULL, "PBPS", "TPDS"
 };
 
-#define EEEPC_EC	"\\_SB.PCI0.SBRG.EC0."
-
-#define EEEPC_EC_FAN_PWM	EEEPC_EC "SC02" /* Fan PWM duty cycle (%) */
-#define EEEPC_EC_SC02		0x63
-#define EEEPC_EC_FAN_HRPM	EEEPC_EC "SC05" /* High byte, fan speed (RPM) */
-#define EEEPC_EC_FAN_LRPM	EEEPC_EC "SC06" /* Low byte, fan speed (RPM) */
-#define EEEPC_EC_FAN_CTRL	EEEPC_EC "SFB3" /* Byte containing SF25  */
-#define EEEPC_EC_SFB3		0xD3
+static const struct key_entry eeepc_keymap[] = {
+	{ KE_KEY, 0x10, { KEY_WLAN } },
+	{ KE_KEY, 0x11, { KEY_WLAN } },
+	{ KE_KEY, 0x12, { KEY_PROG1 } },
+	{ KE_KEY, 0x13, { KEY_MUTE } },
+	{ KE_KEY, 0x14, { KEY_VOLUMEDOWN } },
+	{ KE_KEY, 0x15, { KEY_VOLUMEUP } },
+	{ KE_KEY, 0x16, { KEY_DISPLAY_OFF } },
+	{ KE_KEY, 0x1a, { KEY_COFFEE } },
+	{ KE_KEY, 0x1b, { KEY_ZOOM } },
+	{ KE_KEY, 0x1c, { KEY_PROG2 } },
+	{ KE_KEY, 0x1d, { KEY_PROG3 } },
+	{ KE_KEY, NOTIFY_BRN_MIN, { KEY_BRIGHTNESSDOWN } },
+	{ KE_KEY, NOTIFY_BRN_MAX, { KEY_BRIGHTNESSUP } },
+	{ KE_KEY, 0x30, { KEY_SWITCHVIDEOMODE } },
+	{ KE_KEY, 0x31, { KEY_SWITCHVIDEOMODE } },
+	{ KE_KEY, 0x32, { KEY_SWITCHVIDEOMODE } },
+	{ KE_KEY, 0x37, { KEY_F13 } }, /* Disable Touchpad */
+	{ KE_KEY, 0x38, { KEY_F14 } },
+	{ KE_END, 0 },
+};
 
 /*
  * This is the main structure, we can use it to store useful information
- * about the hotk device
  */
-struct eeepc_hotk {
-	struct acpi_device *device;	/* the device we are in */
-	acpi_handle handle;		/* the handle of the hotk device */
+struct eeepc_laptop {
+	acpi_handle handle;		/* the handle of the acpi device */
 	u32 cm_supported;		/* the control methods supported
 					   by this BIOS */
-	uint init_flag;			/* Init flags */
+	bool cpufv_disabled;
+	bool hotplug_disabled;
 	u16 event_count[128];		/* count for each event */
+
+	struct platform_device *platform_device;
+	struct device *hwmon_device;
+	struct backlight_device *backlight_device;
+
 	struct input_dev *inputdev;
-	u16 *keycode_map;
+	struct key_entry *keymap;
+
 	struct rfkill *wlan_rfkill;
 	struct rfkill *bluetooth_rfkill;
 	struct rfkill *wwan3g_rfkill;
 	struct rfkill *wimax_rfkill;
+
 	struct hotplug_slot *hotplug_slot;
 	struct mutex hotplug_lock;
-};
-
-/* The actual device the driver binds to */
-static struct eeepc_hotk *ehotk;
 
-/* Platform device/driver */
-static int eeepc_hotk_thaw(struct device *device);
-static int eeepc_hotk_restore(struct device *device);
-
-static struct dev_pm_ops eeepc_pm_ops = {
-	.thaw = eeepc_hotk_thaw,
-	.restore = eeepc_hotk_restore,
-};
-
-static struct platform_driver platform_driver = {
-	.driver = {
-		.name = EEEPC_HOTK_FILE,
-		.owner = THIS_MODULE,
-		.pm = &eeepc_pm_ops,
-	}
-};
-
-static struct platform_device *platform_device;
-
-struct key_entry {
-	char type;
-	u8 code;
-	u16 keycode;
-};
-
-enum { KE_KEY, KE_END };
-
-static struct key_entry eeepc_keymap[] = {
-	/* Sleep already handled via generic ACPI code */
-	{KE_KEY, 0x10, KEY_WLAN },
-	{KE_KEY, 0x11, KEY_WLAN },
-	{KE_KEY, 0x12, KEY_PROG1 },
-	{KE_KEY, 0x13, KEY_MUTE },
-	{KE_KEY, 0x14, KEY_VOLUMEDOWN },
-	{KE_KEY, 0x15, KEY_VOLUMEUP },
-	{KE_KEY, 0x1a, KEY_COFFEE },
-	{KE_KEY, 0x1b, KEY_ZOOM },
-	{KE_KEY, 0x1c, KEY_PROG2 },
-	{KE_KEY, 0x1d, KEY_PROG3 },
-	{KE_KEY, NOTIFY_BRN_MIN,     KEY_BRIGHTNESSDOWN },
-	{KE_KEY, NOTIFY_BRN_MIN + 2, KEY_BRIGHTNESSUP },
-	{KE_KEY, 0x30, KEY_SWITCHVIDEOMODE },
-	{KE_KEY, 0x31, KEY_SWITCHVIDEOMODE },
-	{KE_KEY, 0x32, KEY_SWITCHVIDEOMODE },
-	{KE_END, 0},
+	struct led_classdev tpd_led;
+	int tpd_led_wk;
+	struct workqueue_struct *led_workqueue;
+	struct work_struct tpd_led_work;
 };
 
 /*
- * The hotkey driver declaration
- */
-static int eeepc_hotk_add(struct acpi_device *device);
-static int eeepc_hotk_remove(struct acpi_device *device, int type);
-static void eeepc_hotk_notify(struct acpi_device *device, u32 event);
-
-static const struct acpi_device_id eeepc_device_ids[] = {
-	{EEEPC_HOTK_HID, 0},
-	{"", 0},
-};
-MODULE_DEVICE_TABLE(acpi, eeepc_device_ids);
-
-static struct acpi_driver eeepc_hotk_driver = {
-	.name = EEEPC_HOTK_NAME,
-	.class = EEEPC_HOTK_CLASS,
-	.ids = eeepc_device_ids,
-	.flags = ACPI_DRIVER_ALL_NOTIFY_EVENTS,
-	.ops = {
-		.add = eeepc_hotk_add,
-		.remove = eeepc_hotk_remove,
-		.notify = eeepc_hotk_notify,
-	},
-};
-
-/* PCI hotplug ops */
-static int eeepc_get_adapter_status(struct hotplug_slot *slot, u8 *value);
-
-static struct hotplug_slot_ops eeepc_hotplug_slot_ops = {
-	.owner = THIS_MODULE,
-	.get_adapter_status = eeepc_get_adapter_status,
-	.get_power_status = eeepc_get_adapter_status,
-};
-
-/* The backlight device /sys/class/backlight */
-static struct backlight_device *eeepc_backlight_device;
-
-/* The hwmon device */
-static struct device *eeepc_hwmon_device;
-
-/*
- * The backlight class declaration
- */
-static int read_brightness(struct backlight_device *bd);
-static int update_bl_status(struct backlight_device *bd);
-static struct backlight_ops eeepcbl_ops = {
-	.get_brightness = read_brightness,
-	.update_status = update_bl_status,
-};
-
-MODULE_AUTHOR("Corentin Chary, Eric Cooper");
-MODULE_DESCRIPTION(EEEPC_HOTK_NAME);
-MODULE_LICENSE("GPL");
-
-/*
  * ACPI Helpers
  */
-static int write_acpi_int(acpi_handle handle, const char *method, int val,
-			  struct acpi_buffer *output)
+static int write_acpi_int(acpi_handle handle, const char *method, int val)
 {
 	struct acpi_object_list params;
 	union acpi_object in_obj;
@@ -266,7 +198,7 @@ static int write_acpi_int(acpi_handle handle, const char *method, int val,
 	in_obj.type = ACPI_TYPE_INTEGER;
 	in_obj.integer.value = val;
 
-	status = acpi_evaluate_object(handle, (char *)method, &params, output);
+	status = acpi_evaluate_object(handle, (char *)method, &params, NULL);
 	return (status == AE_OK ? 0 : -1);
 }
 
@@ -285,81 +217,56 @@ static int read_acpi_int(acpi_handle handle, const char *method, int *val)
 	}
 }
 
-static int set_acpi(int cm, int value)
+static int set_acpi(struct eeepc_laptop *eeepc, int cm, int value)
 {
-	if (ehotk->cm_supported & (0x1 << cm)) {
-		const char *method = cm_setv[cm];
-		if (method == NULL)
-			return -ENODEV;
-		if (write_acpi_int(ehotk->handle, method, value, NULL))
-			pr_warning("Error writing %s\n", method);
-	}
-	return 0;
-}
-
-static int get_acpi(int cm)
-{
-	int value = -ENODEV;
-	if ((ehotk->cm_supported & (0x1 << cm))) {
-		const char *method = cm_getv[cm];
-		if (method == NULL)
-			return -ENODEV;
-		if (read_acpi_int(ehotk->handle, method, &value))
-			pr_warning("Error reading %s\n", method);
-	}
-	return value;
-}
+	const char *method = cm_setv[cm];
 
-/*
- * Backlight
- */
-static int read_brightness(struct backlight_device *bd)
-{
-	return get_acpi(CM_ASL_PANELBRIGHT);
-}
+	if (method == NULL)
+		return -ENODEV;
+	if ((eeepc->cm_supported & (0x1 << cm)) == 0)
+		return -ENODEV;
 
-static int set_brightness(struct backlight_device *bd, int value)
-{
-	value = max(0, min(15, value));
-	return set_acpi(CM_ASL_PANELBRIGHT, value);
+	if (write_acpi_int(eeepc->handle, method, value))
+		pr_warning("Error writing %s\n", method);
+	return 0;
 }
 
-static int update_bl_status(struct backlight_device *bd)
+static int get_acpi(struct eeepc_laptop *eeepc, int cm)
 {
-	return set_brightness(bd, bd->props.brightness);
-}
+	const char *method = cm_getv[cm];
+	int value;
 
-/*
- * Rfkill helpers
- */
+	if (method == NULL)
+		return -ENODEV;
+	if ((eeepc->cm_supported & (0x1 << cm)) == 0)
+		return -ENODEV;
 
-static bool eeepc_wlan_rfkill_blocked(void)
-{
-	if (get_acpi(CM_ASL_WLAN) == 1)
-		return false;
-	return true;
+	if (read_acpi_int(eeepc->handle, method, &value))
+		pr_warning("Error reading %s\n", method);
+	return value;
 }
 
-static int eeepc_rfkill_set(void *data, bool blocked)
+static int acpi_setter_handle(struct eeepc_laptop *eeepc, int cm,
+			      acpi_handle *handle)
 {
-	unsigned long asl = (unsigned long)data;
-	return set_acpi(asl, !blocked);
-}
+	const char *method = cm_setv[cm];
+	acpi_status status;
 
-static const struct rfkill_ops eeepc_rfkill_ops = {
-	.set_block = eeepc_rfkill_set,
-};
+	if (method == NULL)
+		return -ENODEV;
+	if ((eeepc->cm_supported & (0x1 << cm)) == 0)
+		return -ENODEV;
 
-static void __devinit eeepc_enable_camera(void)
-{
-	/*
-	 * If the following call to set_acpi() fails, it's because there's no
-	 * camera so we can ignore the error.
-	 */
-	if (get_acpi(CM_ASL_CAMERA) == 0)
-		set_acpi(CM_ASL_CAMERA, 1);
+	status = acpi_get_handle(eeepc->handle, (char *)method,
+				 handle);
+	if (status != AE_OK) {
+		pr_warning("Error finding %s\n", method);
+		return -ENODEV;
+	}
+	return 0;
 }
 
+
 /*
  * Sys helpers
  */
@@ -372,60 +279,63 @@ static int parse_arg(const char *buf, unsigned long count, int *val)
 	return count;
 }
 
-static ssize_t store_sys_acpi(int cm, const char *buf, size_t count)
+static ssize_t store_sys_acpi(struct device *dev, int cm,
+			      const char *buf, size_t count)
 {
+	struct eeepc_laptop *eeepc = dev_get_drvdata(dev);
 	int rv, value;
 
 	rv = parse_arg(buf, count, &value);
 	if (rv > 0)
-		value = set_acpi(cm, value);
+		value = set_acpi(eeepc, cm, value);
 	if (value < 0)
-		return value;
+		return -EIO;
 	return rv;
 }
 
-static ssize_t show_sys_acpi(int cm, char *buf)
+static ssize_t show_sys_acpi(struct device *dev, int cm, char *buf)
 {
-	int value = get_acpi(cm);
+	struct eeepc_laptop *eeepc = dev_get_drvdata(dev);
+	int value = get_acpi(eeepc, cm);
 
 	if (value < 0)
-		return value;
+		return -EIO;
 	return sprintf(buf, "%d\n", value);
 }
 
-#define EEEPC_CREATE_DEVICE_ATTR(_name, _cm)				\
+#define EEEPC_CREATE_DEVICE_ATTR(_name, _mode, _cm)			\
 	static ssize_t show_##_name(struct device *dev,			\
 				    struct device_attribute *attr,	\
 				    char *buf)				\
 	{								\
-		return show_sys_acpi(_cm, buf);				\
+		return show_sys_acpi(dev, _cm, buf);			\
 	}								\
 	static ssize_t store_##_name(struct device *dev,		\
 				     struct device_attribute *attr,	\
 				     const char *buf, size_t count)	\
 	{								\
-		return store_sys_acpi(_cm, buf, count);			\
+		return store_sys_acpi(dev, _cm, buf, count);		\
 	}								\
 	static struct device_attribute dev_attr_##_name = {		\
 		.attr = {						\
 			.name = __stringify(_name),			\
-			.mode = 0644 },					\
+			.mode = _mode },				\
 		.show   = show_##_name,					\
 		.store  = store_##_name,				\
 	}
 
-EEEPC_CREATE_DEVICE_ATTR(camera, CM_ASL_CAMERA);
-EEEPC_CREATE_DEVICE_ATTR(cardr, CM_ASL_CARDREADER);
-EEEPC_CREATE_DEVICE_ATTR(disp, CM_ASL_DISPLAYSWITCH);
+EEEPC_CREATE_DEVICE_ATTR(camera, 0644, CM_ASL_CAMERA);
+EEEPC_CREATE_DEVICE_ATTR(cardr, 0644, CM_ASL_CARDREADER);
+EEEPC_CREATE_DEVICE_ATTR(disp, 0200, CM_ASL_DISPLAYSWITCH);
 
 struct eeepc_cpufv {
 	int num;
 	int cur;
 };
 
-static int get_cpufv(struct eeepc_cpufv *c)
+static int get_cpufv(struct eeepc_laptop *eeepc, struct eeepc_cpufv *c)
 {
-	c->cur = get_acpi(CM_ASL_CPUFV);
+	c->cur = get_acpi(eeepc, CM_ASL_CPUFV);
 	c->num = (c->cur >> 8) & 0xff;
 	c->cur &= 0xff;
 	if (c->cur < 0 || c->num <= 0 || c->num > 12)
@@ -437,11 +347,12 @@ static ssize_t show_available_cpufv(struct device *dev,
 				    struct device_attribute *attr,
 				    char *buf)
 {
+	struct eeepc_laptop *eeepc = dev_get_drvdata(dev);
 	struct eeepc_cpufv c;
 	int i;
 	ssize_t len = 0;
 
-	if (get_cpufv(&c))
+	if (get_cpufv(eeepc, &c))
 		return -ENODEV;
 	for (i = 0; i < c.num; i++)
 		len += sprintf(buf + len, "%d ", i);
@@ -453,9 +364,10 @@ static ssize_t show_cpufv(struct device *dev,
 			  struct device_attribute *attr,
 			  char *buf)
 {
+	struct eeepc_laptop *eeepc = dev_get_drvdata(dev);
 	struct eeepc_cpufv c;
 
-	if (get_cpufv(&c))
+	if (get_cpufv(eeepc, &c))
 		return -ENODEV;
 	return sprintf(buf, "%#x\n", (c.num << 8) | c.cur);
 }
@@ -464,20 +376,58 @@ static ssize_t store_cpufv(struct device *dev,
 			   struct device_attribute *attr,
 			   const char *buf, size_t count)
 {
+	struct eeepc_laptop *eeepc = dev_get_drvdata(dev);
 	struct eeepc_cpufv c;
 	int rv, value;
 
-	if (get_cpufv(&c))
+	if (eeepc->cpufv_disabled)
+		return -EPERM;
+	if (get_cpufv(eeepc, &c))
 		return -ENODEV;
 	rv = parse_arg(buf, count, &value);
 	if (rv < 0)
 		return rv;
 	if (!rv || value < 0 || value >= c.num)
 		return -EINVAL;
-	set_acpi(CM_ASL_CPUFV, value);
+	set_acpi(eeepc, CM_ASL_CPUFV, value);
 	return rv;
 }
 
+static ssize_t show_cpufv_disabled(struct device *dev,
+			  struct device_attribute *attr,
+			  char *buf)
+{
+	struct eeepc_laptop *eeepc = dev_get_drvdata(dev);
+
+	return sprintf(buf, "%d\n", eeepc->cpufv_disabled);
+}
+
+static ssize_t store_cpufv_disabled(struct device *dev,
+			   struct device_attribute *attr,
+			   const char *buf, size_t count)
+{
+	struct eeepc_laptop *eeepc = dev_get_drvdata(dev);
+	int rv, value;
+
+	rv = parse_arg(buf, count, &value);
+	if (rv < 0)
+		return rv;
+
+	switch (value) {
+	case 0:
+		if (eeepc->cpufv_disabled)
+			pr_warning("cpufv enabled (not officially supported "
+				"on this model)\n");
+		eeepc->cpufv_disabled = false;
+		return rv;
+	case 1:
+		return -EPERM;
+	default:
+		return -EINVAL;
+	}
+}
+
+
 static struct device_attribute dev_attr_cpufv = {
 	.attr = {
 		.name = "cpufv",
@@ -493,12 +443,22 @@ static struct device_attribute dev_attr_available_cpufv = {
 	.show   = show_available_cpufv
 };
 
+static struct device_attribute dev_attr_cpufv_disabled = {
+	.attr = {
+		.name = "cpufv_disabled",
+		.mode = 0644 },
+	.show   = show_cpufv_disabled,
+	.store  = store_cpufv_disabled
+};
+
+
 static struct attribute *platform_attributes[] = {
 	&dev_attr_camera.attr,
 	&dev_attr_cardr.attr,
 	&dev_attr_disp.attr,
 	&dev_attr_cpufv.attr,
 	&dev_attr_available_cpufv.attr,
+	&dev_attr_cpufv_disabled.attr,
 	NULL
 };
 
@@ -506,156 +466,125 @@ static struct attribute_group platform_attribute_group = {
 	.attrs = platform_attributes
 };
 
-/*
- * Hotkey functions
- */
-static struct key_entry *eepc_get_entry_by_scancode(int code)
+static int eeepc_platform_init(struct eeepc_laptop *eeepc)
 {
-	struct key_entry *key;
-
-	for (key = eeepc_keymap; key->type != KE_END; key++)
-		if (code == key->code)
-			return key;
+	int result;
 
-	return NULL;
-}
+	eeepc->platform_device = platform_device_alloc(EEEPC_LAPTOP_FILE, -1);
+	if (!eeepc->platform_device)
+		return -ENOMEM;
+	platform_set_drvdata(eeepc->platform_device, eeepc);
 
-static struct key_entry *eepc_get_entry_by_keycode(int code)
-{
-	struct key_entry *key;
+	result = platform_device_add(eeepc->platform_device);
+	if (result)
+		goto fail_platform_device;
 
-	for (key = eeepc_keymap; key->type != KE_END; key++)
-		if (code == key->keycode && key->type == KE_KEY)
-			return key;
+	result = sysfs_create_group(&eeepc->platform_device->dev.kobj,
+				    &platform_attribute_group);
+	if (result)
+		goto fail_sysfs;
+	return 0;
 
-	return NULL;
+fail_sysfs:
+	platform_device_del(eeepc->platform_device);
+fail_platform_device:
+	platform_device_put(eeepc->platform_device);
+	return result;
 }
 
-static int eeepc_getkeycode(struct input_dev *dev, int scancode, int *keycode)
+static void eeepc_platform_exit(struct eeepc_laptop *eeepc)
 {
-	struct key_entry *key = eepc_get_entry_by_scancode(scancode);
+	sysfs_remove_group(&eeepc->platform_device->dev.kobj,
+			   &platform_attribute_group);
+	platform_device_unregister(eeepc->platform_device);
+}
 
-	if (key && key->type == KE_KEY) {
-		*keycode = key->keycode;
-		return 0;
-	}
+/*
+ * LEDs
+ */
+/*
+ * These functions actually update the LED's, and are called from a
+ * workqueue. By doing this as separate work rather than when the LED
+ * subsystem asks, we avoid messing with the Asus ACPI stuff during a
+ * potentially bad time, such as a timer interrupt.
+ */
+static void tpd_led_update(struct work_struct *work)
+ {
+	struct eeepc_laptop *eeepc;
 
-	return -EINVAL;
+	eeepc = container_of(work, struct eeepc_laptop, tpd_led_work);
+
+	set_acpi(eeepc, CM_ASL_TPD, eeepc->tpd_led_wk);
 }
 
-static int eeepc_setkeycode(struct input_dev *dev, int scancode, int keycode)
+static void tpd_led_set(struct led_classdev *led_cdev,
+			enum led_brightness value)
 {
-	struct key_entry *key;
-	int old_keycode;
+	struct eeepc_laptop *eeepc;
 
-	if (keycode < 0 || keycode > KEY_MAX)
-		return -EINVAL;
+	eeepc = container_of(led_cdev, struct eeepc_laptop, tpd_led);
 
-	key = eepc_get_entry_by_scancode(scancode);
-	if (key && key->type == KE_KEY) {
-		old_keycode = key->keycode;
-		key->keycode = keycode;
-		set_bit(keycode, dev->keybit);
-		if (!eepc_get_entry_by_keycode(old_keycode))
-			clear_bit(old_keycode, dev->keybit);
-		return 0;
-	}
-
-	return -EINVAL;
+	eeepc->tpd_led_wk = (value > 0) ? 1 : 0;
+	queue_work(eeepc->led_workqueue, &eeepc->tpd_led_work);
 }
 
-static void cmsg_quirk(int cm, const char *name)
+static int eeepc_led_init(struct eeepc_laptop *eeepc)
 {
-	int dummy;
+	int rv;
 
-	/* Some BIOSes do not report cm although it is avaliable.
-	   Check if cm_getv[cm] works and, if yes, assume cm should be set. */
-	if (!(ehotk->cm_supported & (1 << cm))
-	    && !read_acpi_int(ehotk->handle, cm_getv[cm], &dummy)) {
-		pr_info("%s (%x) not reported by BIOS,"
-			" enabling anyway\n", name, 1 << cm);
-		ehotk->cm_supported |= 1 << cm;
-	}
-}
+	if (get_acpi(eeepc, CM_ASL_TPD) == -ENODEV)
+		return 0;
 
-static void cmsg_quirks(void)
-{
-	cmsg_quirk(CM_ASL_LID, "LID");
-	cmsg_quirk(CM_ASL_TYPE, "TYPE");
-	cmsg_quirk(CM_ASL_PANELPOWER, "PANELPOWER");
-	cmsg_quirk(CM_ASL_TPD, "TPD");
-}
+	eeepc->led_workqueue = create_singlethread_workqueue("led_workqueue");
+	if (!eeepc->led_workqueue)
+		return -ENOMEM;
+	INIT_WORK(&eeepc->tpd_led_work, tpd_led_update);
 
-static int eeepc_hotk_check(void)
-{
-	struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
-	int result;
+	eeepc->tpd_led.name = "eeepc::touchpad";
+	eeepc->tpd_led.brightness_set = tpd_led_set;
+	eeepc->tpd_led.max_brightness = 1;
 
-	result = acpi_bus_get_status(ehotk->device);
-	if (result)
-		return result;
-	if (ehotk->device->status.present) {
-		if (write_acpi_int(ehotk->handle, "INIT", ehotk->init_flag,
-				    &buffer)) {
-			pr_err("Hotkey initialization failed\n");
-			return -ENODEV;
-		} else {
-			pr_notice("Hotkey init flags 0x%x\n", ehotk->init_flag);
-		}
-		/* get control methods supported */
-		if (read_acpi_int(ehotk->handle, "CMSG"
-				   , &ehotk->cm_supported)) {
-			pr_err("Get control methods supported failed\n");
-			return -ENODEV;
-		} else {
-			cmsg_quirks();
-			pr_info("Get control methods supported: 0x%x\n",
-				ehotk->cm_supported);
-		}
-	} else {
-		pr_err("Hotkey device not present, aborting\n");
-		return -EINVAL;
+	rv = led_classdev_register(&eeepc->platform_device->dev,
+				   &eeepc->tpd_led);
+	if (rv) {
+		destroy_workqueue(eeepc->led_workqueue);
+		return rv;
 	}
+
 	return 0;
 }
 
-static int notify_brn(void)
+static void eeepc_led_exit(struct eeepc_laptop *eeepc)
 {
-	/* returns the *previous* brightness, or -1 */
-	struct backlight_device *bd = eeepc_backlight_device;
-	if (bd) {
-		int old = bd->props.brightness;
-		backlight_force_update(bd, BACKLIGHT_UPDATE_HOTKEY);
-		return old;
-	}
-	return -1;
+	if (eeepc->tpd_led.dev)
+		led_classdev_unregister(&eeepc->tpd_led);
+	if (eeepc->led_workqueue)
+		destroy_workqueue(eeepc->led_workqueue);
 }
 
-static int eeepc_get_adapter_status(struct hotplug_slot *hotplug_slot,
-				    u8 *value)
-{
-	int val = get_acpi(CM_ASL_WLAN);
-
-	if (val == 1 || val == 0)
-		*value = val;
-	else
-		return -EINVAL;
 
-	return 0;
+/*
+ * PCI hotplug (for wlan rfkill)
+ */
+static bool eeepc_wlan_rfkill_blocked(struct eeepc_laptop *eeepc)
+{
+	if (get_acpi(eeepc, CM_ASL_WLAN) == 1)
+		return false;
+	return true;
 }
 
-static void eeepc_rfkill_hotplug(void)
+static void eeepc_rfkill_hotplug(struct eeepc_laptop *eeepc)
 {
 	struct pci_dev *dev;
 	struct pci_bus *bus;
-	bool blocked = eeepc_wlan_rfkill_blocked();
+	bool blocked = eeepc_wlan_rfkill_blocked(eeepc);
 
-	if (ehotk->wlan_rfkill)
-		rfkill_set_sw_state(ehotk->wlan_rfkill, blocked);
+	if (eeepc->wlan_rfkill)
+		rfkill_set_sw_state(eeepc->wlan_rfkill, blocked);
 
-	mutex_lock(&ehotk->hotplug_lock);
+	mutex_lock(&eeepc->hotplug_lock);
 
-	if (ehotk->hotplug_slot) {
+	if (eeepc->hotplug_slot) {
 		bus = pci_find_bus(0, 1);
 		if (!bus) {
 			pr_warning("Unable to find PCI bus 1?\n");
@@ -685,69 +614,23 @@ static void eeepc_rfkill_hotplug(void)
 	}
 
 out_unlock:
-	mutex_unlock(&ehotk->hotplug_lock);
+	mutex_unlock(&eeepc->hotplug_lock);
 }
 
 static void eeepc_rfkill_notify(acpi_handle handle, u32 event, void *data)
 {
+	struct eeepc_laptop *eeepc = data;
+
 	if (event != ACPI_NOTIFY_BUS_CHECK)
 		return;
 
-	eeepc_rfkill_hotplug();
-}
-
-static void eeepc_hotk_notify(struct acpi_device *device, u32 event)
-{
-	static struct key_entry *key;
-	u16 count;
-	int brn = -ENODEV;
-
-	if (!ehotk)
-		return;
-	if (event > ACPI_MAX_SYS_NOTIFY)
-		return;
-	if (event >= NOTIFY_BRN_MIN && event <= NOTIFY_BRN_MAX)
-		brn = notify_brn();
-	count = ehotk->event_count[event % 128]++;
-	acpi_bus_generate_proc_event(ehotk->device, event, count);
-	acpi_bus_generate_netlink_event(ehotk->device->pnp.device_class,
-					dev_name(&ehotk->device->dev), event,
-					count);
-	if (ehotk->inputdev) {
-		if (brn != -ENODEV) {
-			/* brightness-change events need special
-			 * handling for conversion to key events
-			 */
-			if (brn < 0)
-				brn = event;
-			else
-				brn += NOTIFY_BRN_MIN;
-			if (event < brn)
-				event = NOTIFY_BRN_MIN; /* brightness down */
-			else if (event > brn)
-				event = NOTIFY_BRN_MIN + 2; /* ... up */
-			else
-				event = NOTIFY_BRN_MIN + 1; /* ... unchanged */
-		}
-		key = eepc_get_entry_by_scancode(event);
-		if (key) {
-			switch (key->type) {
-			case KE_KEY:
-				input_report_key(ehotk->inputdev, key->keycode,
-						 1);
-				input_sync(ehotk->inputdev);
-				input_report_key(ehotk->inputdev, key->keycode,
-						 0);
-				input_sync(ehotk->inputdev);
-				break;
-			}
-		}
-	}
+	eeepc_rfkill_hotplug(eeepc);
 }
 
-static int eeepc_register_rfkill_notifier(char *node)
+static int eeepc_register_rfkill_notifier(struct eeepc_laptop *eeepc,
+					  char *node)
 {
-	acpi_status status = AE_OK;
+	acpi_status status;
 	acpi_handle handle;
 
 	status = acpi_get_handle(NULL, node, &handle);
@@ -756,7 +639,7 @@ static int eeepc_register_rfkill_notifier(char *node)
 		status = acpi_install_notify_handler(handle,
 						     ACPI_SYSTEM_NOTIFY,
 						     eeepc_rfkill_notify,
-						     NULL);
+						     eeepc);
 		if (ACPI_FAILURE(status))
 			pr_warning("Failed to register notify on %s\n", node);
 	} else
@@ -765,7 +648,8 @@ static int eeepc_register_rfkill_notifier(char *node)
 	return 0;
 }
 
-static void eeepc_unregister_rfkill_notifier(char *node)
+static void eeepc_unregister_rfkill_notifier(struct eeepc_laptop *eeepc,
+					     char *node)
 {
 	acpi_status status = AE_OK;
 	acpi_handle handle;
@@ -782,13 +666,33 @@ static void eeepc_unregister_rfkill_notifier(char *node)
 	}
 }
 
+static int eeepc_get_adapter_status(struct hotplug_slot *hotplug_slot,
+				    u8 *value)
+{
+	struct eeepc_laptop *eeepc = hotplug_slot->private;
+	int val = get_acpi(eeepc, CM_ASL_WLAN);
+
+	if (val == 1 || val == 0)
+		*value = val;
+	else
+		return -EINVAL;
+
+	return 0;
+}
+
 static void eeepc_cleanup_pci_hotplug(struct hotplug_slot *hotplug_slot)
 {
 	kfree(hotplug_slot->info);
 	kfree(hotplug_slot);
 }
 
-static int eeepc_setup_pci_hotplug(void)
+static struct hotplug_slot_ops eeepc_hotplug_slot_ops = {
+	.owner = THIS_MODULE,
+	.get_adapter_status = eeepc_get_adapter_status,
+	.get_power_status = eeepc_get_adapter_status,
+};
+
+static int eeepc_setup_pci_hotplug(struct eeepc_laptop *eeepc)
 {
 	int ret = -ENOMEM;
 	struct pci_bus *bus = pci_find_bus(0, 1);
@@ -798,22 +702,22 @@ static int eeepc_setup_pci_hotplug(void)
 		return -ENODEV;
 	}
 
-	ehotk->hotplug_slot = kzalloc(sizeof(struct hotplug_slot), GFP_KERNEL);
-	if (!ehotk->hotplug_slot)
+	eeepc->hotplug_slot = kzalloc(sizeof(struct hotplug_slot), GFP_KERNEL);
+	if (!eeepc->hotplug_slot)
 		goto error_slot;
 
-	ehotk->hotplug_slot->info = kzalloc(sizeof(struct hotplug_slot_info),
+	eeepc->hotplug_slot->info = kzalloc(sizeof(struct hotplug_slot_info),
 					    GFP_KERNEL);
-	if (!ehotk->hotplug_slot->info)
+	if (!eeepc->hotplug_slot->info)
 		goto error_info;
 
-	ehotk->hotplug_slot->private = ehotk;
-	ehotk->hotplug_slot->release = &eeepc_cleanup_pci_hotplug;
-	ehotk->hotplug_slot->ops = &eeepc_hotplug_slot_ops;
-	eeepc_get_adapter_status(ehotk->hotplug_slot,
-				 &ehotk->hotplug_slot->info->adapter_status);
+	eeepc->hotplug_slot->private = eeepc;
+	eeepc->hotplug_slot->release = &eeepc_cleanup_pci_hotplug;
+	eeepc->hotplug_slot->ops = &eeepc_hotplug_slot_ops;
+	eeepc_get_adapter_status(eeepc->hotplug_slot,
+				 &eeepc->hotplug_slot->info->adapter_status);
 
-	ret = pci_hp_register(ehotk->hotplug_slot, bus, 0, "eeepc-wifi");
+	ret = pci_hp_register(eeepc->hotplug_slot, bus, 0, "eeepc-wifi");
 	if (ret) {
 		pr_err("Unable to register hotplug slot - %d\n", ret);
 		goto error_register;
@@ -822,17 +726,159 @@ static int eeepc_setup_pci_hotplug(void)
 	return 0;
 
 error_register:
-	kfree(ehotk->hotplug_slot->info);
+	kfree(eeepc->hotplug_slot->info);
 error_info:
-	kfree(ehotk->hotplug_slot);
-	ehotk->hotplug_slot = NULL;
+	kfree(eeepc->hotplug_slot);
+	eeepc->hotplug_slot = NULL;
 error_slot:
 	return ret;
 }
 
+/*
+ * Rfkill devices
+ */
+static int eeepc_rfkill_set(void *data, bool blocked)
+{
+	acpi_handle handle = data;
+
+	return write_acpi_int(handle, NULL, !blocked);
+}
+
+static const struct rfkill_ops eeepc_rfkill_ops = {
+	.set_block = eeepc_rfkill_set,
+};
+
+static int eeepc_new_rfkill(struct eeepc_laptop *eeepc,
+			    struct rfkill **rfkill,
+			    const char *name,
+			    enum rfkill_type type, int cm)
+{
+	acpi_handle handle;
+	int result;
+
+	result = acpi_setter_handle(eeepc, cm, &handle);
+	if (result < 0)
+		return result;
+
+	*rfkill = rfkill_alloc(name, &eeepc->platform_device->dev, type,
+			       &eeepc_rfkill_ops, handle);
+
+	if (!*rfkill)
+		return -EINVAL;
+
+	rfkill_init_sw_state(*rfkill, get_acpi(eeepc, cm) != 1);
+	result = rfkill_register(*rfkill);
+	if (result) {
+		rfkill_destroy(*rfkill);
+		*rfkill = NULL;
+		return result;
+	}
+	return 0;
+}
+
+static void eeepc_rfkill_exit(struct eeepc_laptop *eeepc)
+{
+	eeepc_unregister_rfkill_notifier(eeepc, "\\_SB.PCI0.P0P5");
+	eeepc_unregister_rfkill_notifier(eeepc, "\\_SB.PCI0.P0P6");
+	eeepc_unregister_rfkill_notifier(eeepc, "\\_SB.PCI0.P0P7");
+	if (eeepc->wlan_rfkill) {
+		rfkill_unregister(eeepc->wlan_rfkill);
+		rfkill_destroy(eeepc->wlan_rfkill);
+		eeepc->wlan_rfkill = NULL;
+	}
+	/*
+	 * Refresh pci hotplug in case the rfkill state was changed after
+	 * eeepc_unregister_rfkill_notifier()
+	 */
+	eeepc_rfkill_hotplug(eeepc);
+	if (eeepc->hotplug_slot)
+		pci_hp_deregister(eeepc->hotplug_slot);
+
+	if (eeepc->bluetooth_rfkill) {
+		rfkill_unregister(eeepc->bluetooth_rfkill);
+		rfkill_destroy(eeepc->bluetooth_rfkill);
+		eeepc->bluetooth_rfkill = NULL;
+	}
+	if (eeepc->wwan3g_rfkill) {
+		rfkill_unregister(eeepc->wwan3g_rfkill);
+		rfkill_destroy(eeepc->wwan3g_rfkill);
+		eeepc->wwan3g_rfkill = NULL;
+	}
+	if (eeepc->wimax_rfkill) {
+		rfkill_unregister(eeepc->wimax_rfkill);
+		rfkill_destroy(eeepc->wimax_rfkill);
+		eeepc->wimax_rfkill = NULL;
+	}
+}
+
+static int eeepc_rfkill_init(struct eeepc_laptop *eeepc)
+{
+	int result = 0;
+
+	mutex_init(&eeepc->hotplug_lock);
+
+	result = eeepc_new_rfkill(eeepc, &eeepc->wlan_rfkill,
+				  "eeepc-wlan", RFKILL_TYPE_WLAN,
+				  CM_ASL_WLAN);
+
+	if (result && result != -ENODEV)
+		goto exit;
+
+	result = eeepc_new_rfkill(eeepc, &eeepc->bluetooth_rfkill,
+				  "eeepc-bluetooth", RFKILL_TYPE_BLUETOOTH,
+				  CM_ASL_BLUETOOTH);
+
+	if (result && result != -ENODEV)
+		goto exit;
+
+	result = eeepc_new_rfkill(eeepc, &eeepc->wwan3g_rfkill,
+				  "eeepc-wwan3g", RFKILL_TYPE_WWAN,
+				  CM_ASL_3G);
+
+	if (result && result != -ENODEV)
+		goto exit;
+
+	result = eeepc_new_rfkill(eeepc, &eeepc->wimax_rfkill,
+				  "eeepc-wimax", RFKILL_TYPE_WIMAX,
+				  CM_ASL_WIMAX);
+
+	if (result && result != -ENODEV)
+		goto exit;
+
+	if (eeepc->hotplug_disabled)
+		return 0;
+
+	result = eeepc_setup_pci_hotplug(eeepc);
+	/*
+	 * If we get -EBUSY then something else is handling the PCI hotplug -
+	 * don't fail in this case
+	 */
+	if (result == -EBUSY)
+		result = 0;
+
+	eeepc_register_rfkill_notifier(eeepc, "\\_SB.PCI0.P0P5");
+	eeepc_register_rfkill_notifier(eeepc, "\\_SB.PCI0.P0P6");
+	eeepc_register_rfkill_notifier(eeepc, "\\_SB.PCI0.P0P7");
+	/*
+	 * Refresh pci hotplug in case the rfkill state was changed during
+	 * setup.
+	 */
+	eeepc_rfkill_hotplug(eeepc);
+
+exit:
+	if (result && result != -ENODEV)
+		eeepc_rfkill_exit(eeepc);
+	return result;
+}
+
+/*
+ * Platform driver - hibernate/resume callbacks
+ */
 static int eeepc_hotk_thaw(struct device *device)
 {
-	if (ehotk->wlan_rfkill) {
+	struct eeepc_laptop *eeepc = dev_get_drvdata(device);
+
+	if (eeepc->wlan_rfkill) {
 		bool wlan;
 
 		/*
@@ -840,8 +886,8 @@ static int eeepc_hotk_thaw(struct device *device)
 		 * during suspend.  Normally it restores it on resume, but
 		 * we should kick it ourselves in case hibernation is aborted.
 		 */
-		wlan = get_acpi(CM_ASL_WLAN);
-		set_acpi(CM_ASL_WLAN, wlan);
+		wlan = get_acpi(eeepc, CM_ASL_WLAN);
+		set_acpi(eeepc, CM_ASL_WLAN, wlan);
 	}
 
 	return 0;
@@ -849,70 +895,96 @@ static int eeepc_hotk_thaw(struct device *device)
 
 static int eeepc_hotk_restore(struct device *device)
 {
+	struct eeepc_laptop *eeepc = dev_get_drvdata(device);
+
 	/* Refresh both wlan rfkill state and pci hotplug */
-	if (ehotk->wlan_rfkill)
-		eeepc_rfkill_hotplug();
-
-	if (ehotk->bluetooth_rfkill)
-		rfkill_set_sw_state(ehotk->bluetooth_rfkill,
-				    get_acpi(CM_ASL_BLUETOOTH) != 1);
-	if (ehotk->wwan3g_rfkill)
-		rfkill_set_sw_state(ehotk->wwan3g_rfkill,
-				    get_acpi(CM_ASL_3G) != 1);
-	if (ehotk->wimax_rfkill)
-		rfkill_set_sw_state(ehotk->wimax_rfkill,
-				    get_acpi(CM_ASL_WIMAX) != 1);
+	if (eeepc->wlan_rfkill)
+		eeepc_rfkill_hotplug(eeepc);
+
+	if (eeepc->bluetooth_rfkill)
+		rfkill_set_sw_state(eeepc->bluetooth_rfkill,
+				    get_acpi(eeepc, CM_ASL_BLUETOOTH) != 1);
+	if (eeepc->wwan3g_rfkill)
+		rfkill_set_sw_state(eeepc->wwan3g_rfkill,
+				    get_acpi(eeepc, CM_ASL_3G) != 1);
+	if (eeepc->wimax_rfkill)
+		rfkill_set_sw_state(eeepc->wimax_rfkill,
+				    get_acpi(eeepc, CM_ASL_WIMAX) != 1);
 
 	return 0;
 }
 
+static const struct dev_pm_ops eeepc_pm_ops = {
+	.thaw = eeepc_hotk_thaw,
+	.restore = eeepc_hotk_restore,
+};
+
+static struct platform_driver platform_driver = {
+	.driver = {
+		.name = EEEPC_LAPTOP_FILE,
+		.owner = THIS_MODULE,
+		.pm = &eeepc_pm_ops,
+	}
+};
+
 /*
- * Hwmon
+ * Hwmon device
  */
+
+#define EEEPC_EC_SC00      0x61
+#define EEEPC_EC_FAN_PWM   (EEEPC_EC_SC00 + 2) /* Fan PWM duty cycle (%) */
+#define EEEPC_EC_FAN_HRPM  (EEEPC_EC_SC00 + 5) /* High byte, fan speed (RPM) */
+#define EEEPC_EC_FAN_LRPM  (EEEPC_EC_SC00 + 6) /* Low byte, fan speed (RPM) */
+
+#define EEEPC_EC_SFB0      0xD0
+#define EEEPC_EC_FAN_CTRL  (EEEPC_EC_SFB0 + 3) /* Byte containing SF25  */
+
 static int eeepc_get_fan_pwm(void)
 {
-	int value = 0;
+	u8 value = 0;
 
-	read_acpi_int(NULL, EEEPC_EC_FAN_PWM, &value);
-	value = value * 255 / 100;
-	return (value);
+	ec_read(EEEPC_EC_FAN_PWM, &value);
+	return value * 255 / 100;
 }
 
 static void eeepc_set_fan_pwm(int value)
 {
 	value = SENSORS_LIMIT(value, 0, 255);
 	value = value * 100 / 255;
-	ec_write(EEEPC_EC_SC02, value);
+	ec_write(EEEPC_EC_FAN_PWM, value);
 }
 
 static int eeepc_get_fan_rpm(void)
 {
-	int high = 0;
-	int low = 0;
+	u8 high = 0;
+	u8 low = 0;
 
-	read_acpi_int(NULL, EEEPC_EC_FAN_HRPM, &high);
-	read_acpi_int(NULL, EEEPC_EC_FAN_LRPM, &low);
-	return (high << 8 | low);
+	ec_read(EEEPC_EC_FAN_HRPM, &high);
+	ec_read(EEEPC_EC_FAN_LRPM, &low);
+	return high << 8 | low;
 }
 
 static int eeepc_get_fan_ctrl(void)
 {
-	int value = 0;
+	u8 value = 0;
 
-	read_acpi_int(NULL, EEEPC_EC_FAN_CTRL, &value);
-	return ((value & 0x02 ? 1 : 0));
+	ec_read(EEEPC_EC_FAN_CTRL, &value);
+	if (value & 0x02)
+		return 1; /* manual */
+	else
+		return 2; /* automatic */
 }
 
 static void eeepc_set_fan_ctrl(int manual)
 {
-	int value = 0;
+	u8 value = 0;
 
-	read_acpi_int(NULL, EEEPC_EC_FAN_CTRL, &value);
-	if (manual)
+	ec_read(EEEPC_EC_FAN_CTRL, &value);
+	if (manual == 1)
 		value |= 0x02;
 	else
 		value &= ~0x02;
-	ec_write(EEEPC_EC_SFB3, value);
+	ec_write(EEEPC_EC_FAN_CTRL, value);
 }
 
 static ssize_t store_sys_hwmon(void (*set)(int), const char *buf, size_t count)
@@ -970,348 +1042,461 @@ static struct attribute_group hwmon_attribute_group = {
 	.attrs = hwmon_attributes
 };
 
-/*
- * exit/init
- */
-static void eeepc_backlight_exit(void)
+static void eeepc_hwmon_exit(struct eeepc_laptop *eeepc)
 {
-	if (eeepc_backlight_device)
-		backlight_device_unregister(eeepc_backlight_device);
-	eeepc_backlight_device = NULL;
+	struct device *hwmon;
+
+	hwmon = eeepc->hwmon_device;
+	if (!hwmon)
+		return;
+	sysfs_remove_group(&hwmon->kobj,
+			   &hwmon_attribute_group);
+	hwmon_device_unregister(hwmon);
+	eeepc->hwmon_device = NULL;
 }
 
-static void eeepc_rfkill_exit(void)
+static int eeepc_hwmon_init(struct eeepc_laptop *eeepc)
 {
-	eeepc_unregister_rfkill_notifier("\\_SB.PCI0.P0P5");
-	eeepc_unregister_rfkill_notifier("\\_SB.PCI0.P0P6");
-	eeepc_unregister_rfkill_notifier("\\_SB.PCI0.P0P7");
-	if (ehotk->wlan_rfkill) {
-		rfkill_unregister(ehotk->wlan_rfkill);
-		rfkill_destroy(ehotk->wlan_rfkill);
-		ehotk->wlan_rfkill = NULL;
-	}
-	/*
-	 * Refresh pci hotplug in case the rfkill state was changed after
-	 * eeepc_unregister_rfkill_notifier()
-	 */
-	eeepc_rfkill_hotplug();
-	if (ehotk->hotplug_slot)
-		pci_hp_deregister(ehotk->hotplug_slot);
-
-	if (ehotk->bluetooth_rfkill) {
-		rfkill_unregister(ehotk->bluetooth_rfkill);
-		rfkill_destroy(ehotk->bluetooth_rfkill);
-		ehotk->bluetooth_rfkill = NULL;
-	}
-	if (ehotk->wwan3g_rfkill) {
-		rfkill_unregister(ehotk->wwan3g_rfkill);
-		rfkill_destroy(ehotk->wwan3g_rfkill);
-		ehotk->wwan3g_rfkill = NULL;
-	}
-	if (ehotk->wimax_rfkill) {
-		rfkill_unregister(ehotk->wimax_rfkill);
-		rfkill_destroy(ehotk->wimax_rfkill);
-		ehotk->wimax_rfkill = NULL;
+	struct device *hwmon;
+	int result;
+
+	hwmon = hwmon_device_register(&eeepc->platform_device->dev);
+	if (IS_ERR(hwmon)) {
+		pr_err("Could not register eeepc hwmon device\n");
+		eeepc->hwmon_device = NULL;
+		return PTR_ERR(hwmon);
 	}
+	eeepc->hwmon_device = hwmon;
+	result = sysfs_create_group(&hwmon->kobj,
+				    &hwmon_attribute_group);
+	if (result)
+		eeepc_hwmon_exit(eeepc);
+	return result;
 }
 
-static void eeepc_input_exit(void)
+/*
+ * Backlight device
+ */
+static int read_brightness(struct backlight_device *bd)
 {
-	if (ehotk->inputdev)
-		input_unregister_device(ehotk->inputdev);
+	struct eeepc_laptop *eeepc = bl_get_data(bd);
+
+	return get_acpi(eeepc, CM_ASL_PANELBRIGHT);
 }
 
-static void eeepc_hwmon_exit(void)
+static int set_brightness(struct backlight_device *bd, int value)
 {
-	struct device *hwmon;
+	struct eeepc_laptop *eeepc = bl_get_data(bd);
 
-	hwmon = eeepc_hwmon_device;
-	if (!hwmon)
-		return ;
-	sysfs_remove_group(&hwmon->kobj,
-			   &hwmon_attribute_group);
-	hwmon_device_unregister(hwmon);
-	eeepc_hwmon_device = NULL;
+	return set_acpi(eeepc, CM_ASL_PANELBRIGHT, value);
 }
 
-static int eeepc_new_rfkill(struct rfkill **rfkill,
-			    const char *name, struct device *dev,
-			    enum rfkill_type type, int cm)
+static int update_bl_status(struct backlight_device *bd)
 {
-	int result;
+	return set_brightness(bd, bd->props.brightness);
+}
 
-	result = get_acpi(cm);
-	if (result < 0)
-		return result;
+static struct backlight_ops eeepcbl_ops = {
+	.get_brightness = read_brightness,
+	.update_status = update_bl_status,
+};
 
-	*rfkill = rfkill_alloc(name, dev, type,
-			       &eeepc_rfkill_ops, (void *)(unsigned long)cm);
+static int eeepc_backlight_notify(struct eeepc_laptop *eeepc)
+{
+	struct backlight_device *bd = eeepc->backlight_device;
+	int old = bd->props.brightness;
 
-	if (!*rfkill)
-		return -EINVAL;
+	backlight_force_update(bd, BACKLIGHT_UPDATE_HOTKEY);
 
-	rfkill_init_sw_state(*rfkill, get_acpi(cm) != 1);
-	result = rfkill_register(*rfkill);
-	if (result) {
-		rfkill_destroy(*rfkill);
-		*rfkill = NULL;
-		return result;
+	return old;
+}
+
+static int eeepc_backlight_init(struct eeepc_laptop *eeepc)
+{
+	struct backlight_device *bd;
+
+	bd = backlight_device_register(EEEPC_LAPTOP_FILE,
+				       &eeepc->platform_device->dev,
+				       eeepc, &eeepcbl_ops);
+	if (IS_ERR(bd)) {
+		pr_err("Could not register eeepc backlight device\n");
+		eeepc->backlight_device = NULL;
+		return PTR_ERR(bd);
 	}
+	eeepc->backlight_device = bd;
+	bd->props.max_brightness = 15;
+	bd->props.brightness = read_brightness(bd);
+	bd->props.power = FB_BLANK_UNBLANK;
+	backlight_update_status(bd);
 	return 0;
 }
 
+static void eeepc_backlight_exit(struct eeepc_laptop *eeepc)
+{
+	if (eeepc->backlight_device)
+		backlight_device_unregister(eeepc->backlight_device);
+	eeepc->backlight_device = NULL;
+}
 
-static int eeepc_rfkill_init(struct device *dev)
+
+/*
+ * Input device (i.e. hotkeys)
+ */
+static int eeepc_input_init(struct eeepc_laptop *eeepc)
 {
-	int result = 0;
+	struct input_dev *input;
+	int error;
 
-	mutex_init(&ehotk->hotplug_lock);
+	input = input_allocate_device();
+	if (!input) {
+		pr_info("Unable to allocate input device\n");
+		return -ENOMEM;
+	}
 
-	result = eeepc_new_rfkill(&ehotk->wlan_rfkill,
-				  "eeepc-wlan", dev,
-				  RFKILL_TYPE_WLAN, CM_ASL_WLAN);
+	input->name = "Asus EeePC extra buttons";
+	input->phys = EEEPC_LAPTOP_FILE "/input0";
+	input->id.bustype = BUS_HOST;
+	input->dev.parent = &eeepc->platform_device->dev;
 
-	if (result && result != -ENODEV)
-		goto exit;
+	error = sparse_keymap_setup(input, eeepc_keymap, NULL);
+	if (error) {
+		pr_err("Unable to setup input device keymap\n");
+		goto err_free_dev;
+	}
 
-	result = eeepc_new_rfkill(&ehotk->bluetooth_rfkill,
-				  "eeepc-bluetooth", dev,
-				  RFKILL_TYPE_BLUETOOTH, CM_ASL_BLUETOOTH);
+	error = input_register_device(input);
+	if (error) {
+		pr_err("Unable to register input device\n");
+		goto err_free_keymap;
+	}
 
-	if (result && result != -ENODEV)
-		goto exit;
+	eeepc->inputdev = input;
+	return 0;
 
-	result = eeepc_new_rfkill(&ehotk->wwan3g_rfkill,
-				  "eeepc-wwan3g", dev,
-				  RFKILL_TYPE_WWAN, CM_ASL_3G);
+ err_free_keymap:
+	sparse_keymap_free(input);
+ err_free_dev:
+	input_free_device(input);
+	return error;
+}
 
-	if (result && result != -ENODEV)
-		goto exit;
+static void eeepc_input_exit(struct eeepc_laptop *eeepc)
+{
+	if (eeepc->inputdev) {
+		input_unregister_device(eeepc->inputdev);
+		kfree(eeepc->keymap);
+	}
+}
+
+/*
+ * ACPI driver
+ */
+static void eeepc_acpi_notify(struct acpi_device *device, u32 event)
+{
+	struct eeepc_laptop *eeepc = acpi_driver_data(device);
+	u16 count;
 
-	result = eeepc_new_rfkill(&ehotk->wimax_rfkill,
-				  "eeepc-wimax", dev,
-				  RFKILL_TYPE_WIMAX, CM_ASL_WIMAX);
+	if (event > ACPI_MAX_SYS_NOTIFY)
+		return;
+	count = eeepc->event_count[event % 128]++;
+	acpi_bus_generate_proc_event(device, event, count);
+	acpi_bus_generate_netlink_event(device->pnp.device_class,
+					dev_name(&device->dev), event,
+					count);
 
-	if (result && result != -ENODEV)
-		goto exit;
+	/* Brightness events are special */
+	if (event >= NOTIFY_BRN_MIN && event <= NOTIFY_BRN_MAX) {
+
+		/* Ignore them completely if the acpi video driver is used */
+		if (eeepc->backlight_device != NULL) {
+			int old_brightness, new_brightness;
+
+			/* Update the backlight device. */
+			old_brightness = eeepc_backlight_notify(eeepc);
+
+			/* Convert event to keypress (obsolescent hack) */
+			new_brightness = event - NOTIFY_BRN_MIN;
+
+			if (new_brightness < old_brightness) {
+				event = NOTIFY_BRN_MIN; /* brightness down */
+			} else if (new_brightness > old_brightness) {
+				event = NOTIFY_BRN_MAX; /* brightness up */
+			} else {
+				/*
+				* no change in brightness - already at min/max,
+				* event will be desired value (or else ignored)
+				*/
+			}
+			sparse_keymap_report_event(eeepc->inputdev, event,
+						   1, true);
+		}
+	} else {
+		/* Everything else is a bona-fide keypress event */
+		sparse_keymap_report_event(eeepc->inputdev, event, 1, true);
+	}
+}
+
+static void eeepc_dmi_check(struct eeepc_laptop *eeepc)
+{
+	const char *model;
+
+	model = dmi_get_system_info(DMI_PRODUCT_NAME);
+	if (!model)
+		return;
 
-	result = eeepc_setup_pci_hotplug();
 	/*
-	 * If we get -EBUSY then something else is handling the PCI hotplug -
-	 * don't fail in this case
+	 * Blacklist for setting cpufv (cpu speed).
+	 *
+	 * EeePC 4G ("701") implements CFVS, but it is not supported
+	 * by the pre-installed OS, and the original option to change it
+	 * in the BIOS setup screen was removed in later versions.
+	 *
+	 * Judging by the lack of "Super Hybrid Engine" on Asus product pages,
+	 * this applies to all "701" models (4G/4G Surf/2G Surf).
+	 *
+	 * So Asus made a deliberate decision not to support it on this model.
+	 * We have several reports that using it can cause the system to hang
+	 *
+	 * The hang has also been reported on a "702" (Model name "8G"?).
+	 *
+	 * We avoid dmi_check_system() / dmi_match(), because they use
+	 * substring matching.  We don't want to affect the "701SD"
+	 * and "701SDX" models, because they do support S.H.E.
 	 */
-	if (result == -EBUSY)
-		result = 0;
+	if (strcmp(model, "701") == 0 || strcmp(model, "702") == 0) {
+		eeepc->cpufv_disabled = true;
+		pr_info("model %s does not officially support setting cpu "
+			"speed\n", model);
+		pr_info("cpufv disabled to avoid instability\n");
+	}
 
-	eeepc_register_rfkill_notifier("\\_SB.PCI0.P0P5");
-	eeepc_register_rfkill_notifier("\\_SB.PCI0.P0P6");
-	eeepc_register_rfkill_notifier("\\_SB.PCI0.P0P7");
 	/*
-	 * Refresh pci hotplug in case the rfkill state was changed during
-	 * setup.
+	 * Blacklist for wlan hotplug
+	 *
+	 * Eeepc 1005HA doesn't work like others models and don't need the
+	 * hotplug code. In fact, current hotplug code seems to unplug another
+	 * device...
 	 */
-	eeepc_rfkill_hotplug();
-
-exit:
-	if (result && result != -ENODEV)
-		eeepc_rfkill_exit();
-	return result;
+	if (strcmp(model, "1005HA") == 0 || strcmp(model, "1201N") == 0) {
+		eeepc->hotplug_disabled = true;
+		pr_info("wlan hotplug disabled\n");
+	}
 }
 
-static int eeepc_backlight_init(struct device *dev)
+static void cmsg_quirk(struct eeepc_laptop *eeepc, int cm, const char *name)
 {
-	struct backlight_device *bd;
+	int dummy;
 
-	bd = backlight_device_register(EEEPC_HOTK_FILE, dev,
-				       NULL, &eeepcbl_ops);
-	if (IS_ERR(bd)) {
-		pr_err("Could not register eeepc backlight device\n");
-		eeepc_backlight_device = NULL;
-		return PTR_ERR(bd);
+	/* Some BIOSes do not report cm although it is avaliable.
+	   Check if cm_getv[cm] works and, if yes, assume cm should be set. */
+	if (!(eeepc->cm_supported & (1 << cm))
+	    && !read_acpi_int(eeepc->handle, cm_getv[cm], &dummy)) {
+		pr_info("%s (%x) not reported by BIOS,"
+			" enabling anyway\n", name, 1 << cm);
+		eeepc->cm_supported |= 1 << cm;
 	}
-	eeepc_backlight_device = bd;
-	bd->props.max_brightness = 15;
-	bd->props.brightness = read_brightness(NULL);
-	bd->props.power = FB_BLANK_UNBLANK;
-	backlight_update_status(bd);
-	return 0;
 }
 
-static int eeepc_hwmon_init(struct device *dev)
+static void cmsg_quirks(struct eeepc_laptop *eeepc)
 {
-	struct device *hwmon;
-	int result;
-
-	hwmon = hwmon_device_register(dev);
-	if (IS_ERR(hwmon)) {
-		pr_err("Could not register eeepc hwmon device\n");
-		eeepc_hwmon_device = NULL;
-		return PTR_ERR(hwmon);
-	}
-	eeepc_hwmon_device = hwmon;
-	result = sysfs_create_group(&hwmon->kobj,
-				    &hwmon_attribute_group);
-	if (result)
-		eeepc_hwmon_exit();
-	return result;
+	cmsg_quirk(eeepc, CM_ASL_LID, "LID");
+	cmsg_quirk(eeepc, CM_ASL_TYPE, "TYPE");
+	cmsg_quirk(eeepc, CM_ASL_PANELPOWER, "PANELPOWER");
+	cmsg_quirk(eeepc, CM_ASL_TPD, "TPD");
 }
 
-static int eeepc_input_init(struct device *dev)
+static int eeepc_acpi_init(struct eeepc_laptop *eeepc,
+			   struct acpi_device *device)
 {
-	const struct key_entry *key;
+	unsigned int init_flags;
 	int result;
 
-	ehotk->inputdev = input_allocate_device();
-	if (!ehotk->inputdev) {
-		pr_info("Unable to allocate input device\n");
-		return -ENOMEM;
+	result = acpi_bus_get_status(device);
+	if (result)
+		return result;
+	if (!device->status.present) {
+		pr_err("Hotkey device not present, aborting\n");
+		return -ENODEV;
 	}
-	ehotk->inputdev->name = "Asus EeePC extra buttons";
-	ehotk->inputdev->dev.parent = dev;
-	ehotk->inputdev->phys = EEEPC_HOTK_FILE "/input0";
-	ehotk->inputdev->id.bustype = BUS_HOST;
-	ehotk->inputdev->getkeycode = eeepc_getkeycode;
-	ehotk->inputdev->setkeycode = eeepc_setkeycode;
-
-	for (key = eeepc_keymap; key->type != KE_END; key++) {
-		switch (key->type) {
-		case KE_KEY:
-			set_bit(EV_KEY, ehotk->inputdev->evbit);
-			set_bit(key->keycode, ehotk->inputdev->keybit);
-			break;
-		}
+
+	init_flags = DISABLE_ASL_WLAN | DISABLE_ASL_DISPLAYSWITCH;
+	pr_notice("Hotkey init flags 0x%x\n", init_flags);
+
+	if (write_acpi_int(eeepc->handle, "INIT", init_flags)) {
+		pr_err("Hotkey initialization failed\n");
+		return -ENODEV;
 	}
-	result = input_register_device(ehotk->inputdev);
-	if (result) {
-		pr_info("Unable to register input device\n");
-		input_free_device(ehotk->inputdev);
-		return result;
+
+	/* get control methods supported */
+	if (read_acpi_int(eeepc->handle, "CMSG", &eeepc->cm_supported)) {
+		pr_err("Get control methods supported failed\n");
+		return -ENODEV;
 	}
+	cmsg_quirks(eeepc);
+	pr_info("Get control methods supported: 0x%x\n", eeepc->cm_supported);
+
 	return 0;
 }
 
-static int __devinit eeepc_hotk_add(struct acpi_device *device)
+static void __devinit eeepc_enable_camera(struct eeepc_laptop *eeepc)
+{
+	/*
+	 * If the following call to set_acpi() fails, it's because there's no
+	 * camera so we can ignore the error.
+	 */
+	if (get_acpi(eeepc, CM_ASL_CAMERA) == 0)
+		set_acpi(eeepc, CM_ASL_CAMERA, 1);
+}
+
+static bool eeepc_device_present;
+
+static int __devinit eeepc_acpi_add(struct acpi_device *device)
 {
-	struct device *dev;
+	struct eeepc_laptop *eeepc;
 	int result;
 
-	if (!device)
-		return -EINVAL;
-	pr_notice(EEEPC_HOTK_NAME "\n");
-	ehotk = kzalloc(sizeof(struct eeepc_hotk), GFP_KERNEL);
-	if (!ehotk)
+	pr_notice(EEEPC_LAPTOP_NAME "\n");
+	eeepc = kzalloc(sizeof(struct eeepc_laptop), GFP_KERNEL);
+	if (!eeepc)
 		return -ENOMEM;
-	ehotk->init_flag = DISABLE_ASL_WLAN | DISABLE_ASL_DISPLAYSWITCH;
-	ehotk->handle = device->handle;
-	strcpy(acpi_device_name(device), EEEPC_HOTK_DEVICE_NAME);
-	strcpy(acpi_device_class(device), EEEPC_HOTK_CLASS);
-	device->driver_data = ehotk;
-	ehotk->device = device;
-
-	result = eeepc_hotk_check();
-	if (result)
-		goto fail_platform_driver;
-	eeepc_enable_camera();
+	eeepc->handle = device->handle;
+	strcpy(acpi_device_name(device), EEEPC_ACPI_DEVICE_NAME);
+	strcpy(acpi_device_class(device), EEEPC_ACPI_CLASS);
+	device->driver_data = eeepc;
 
-	/* Register platform stuff */
-	result = platform_driver_register(&platform_driver);
-	if (result)
-		goto fail_platform_driver;
-	platform_device = platform_device_alloc(EEEPC_HOTK_FILE, -1);
-	if (!platform_device) {
-		result = -ENOMEM;
-		goto fail_platform_device1;
-	}
-	result = platform_device_add(platform_device);
-	if (result)
-		goto fail_platform_device2;
-	result = sysfs_create_group(&platform_device->dev.kobj,
-				    &platform_attribute_group);
+	eeepc->hotplug_disabled = hotplug_disabled;
+
+	eeepc_dmi_check(eeepc);
+
+	result = eeepc_acpi_init(eeepc, device);
 	if (result)
-		goto fail_sysfs;
+		goto fail_platform;
+	eeepc_enable_camera(eeepc);
 
-	dev = &platform_device->dev;
+	/*
+	 * Register the platform device first.  It is used as a parent for the
+	 * sub-devices below.
+	 *
+	 * Note that if there are multiple instances of this ACPI device it
+	 * will bail out, because the platform device is registered with a
+	 * fixed name.  Of course it doesn't make sense to have more than one,
+	 * and machine-specific scripts find the fixed name convenient.  But
+	 * It's also good for us to exclude multiple instances because both
+	 * our hwmon and our wlan rfkill subdevice use global ACPI objects
+	 * (the EC and the wlan PCI slot respectively).
+	 */
+	result = eeepc_platform_init(eeepc);
+	if (result)
+		goto fail_platform;
 
 	if (!acpi_video_backlight_support()) {
-		result = eeepc_backlight_init(dev);
+		result = eeepc_backlight_init(eeepc);
 		if (result)
 			goto fail_backlight;
 	} else
-		pr_info("Backlight controlled by ACPI video "
-			"driver\n");
+		pr_info("Backlight controlled by ACPI video driver\n");
 
-	result = eeepc_input_init(dev);
+	result = eeepc_input_init(eeepc);
 	if (result)
 		goto fail_input;
 
-	result = eeepc_hwmon_init(dev);
+	result = eeepc_hwmon_init(eeepc);
 	if (result)
 		goto fail_hwmon;
 
-	result = eeepc_rfkill_init(dev);
+	result = eeepc_led_init(eeepc);
+	if (result)
+		goto fail_led;
+
+	result = eeepc_rfkill_init(eeepc);
 	if (result)
 		goto fail_rfkill;
 
+	eeepc_device_present = true;
 	return 0;
 
 fail_rfkill:
-	eeepc_hwmon_exit();
+	eeepc_led_exit(eeepc);
+fail_led:
+	eeepc_hwmon_exit(eeepc);
 fail_hwmon:
-	eeepc_input_exit();
+	eeepc_input_exit(eeepc);
 fail_input:
-	eeepc_backlight_exit();
+	eeepc_backlight_exit(eeepc);
 fail_backlight:
-	sysfs_remove_group(&platform_device->dev.kobj,
-			   &platform_attribute_group);
-fail_sysfs:
-	platform_device_del(platform_device);
-fail_platform_device2:
-	platform_device_put(platform_device);
-fail_platform_device1:
-	platform_driver_unregister(&platform_driver);
-fail_platform_driver:
-	kfree(ehotk);
+	eeepc_platform_exit(eeepc);
+fail_platform:
+	kfree(eeepc);
 
 	return result;
 }
 
-static int eeepc_hotk_remove(struct acpi_device *device, int type)
+static int eeepc_acpi_remove(struct acpi_device *device, int type)
 {
-	if (!device || !acpi_driver_data(device))
-		return -EINVAL;
+	struct eeepc_laptop *eeepc = acpi_driver_data(device);
 
-	eeepc_backlight_exit();
-	eeepc_rfkill_exit();
-	eeepc_input_exit();
-	eeepc_hwmon_exit();
-	sysfs_remove_group(&platform_device->dev.kobj,
-			   &platform_attribute_group);
-	platform_device_unregister(platform_device);
-	platform_driver_unregister(&platform_driver);
+	eeepc_backlight_exit(eeepc);
+	eeepc_rfkill_exit(eeepc);
+	eeepc_input_exit(eeepc);
+	eeepc_hwmon_exit(eeepc);
+	eeepc_led_exit(eeepc);
+	eeepc_platform_exit(eeepc);
 
-	kfree(ehotk);
+	kfree(eeepc);
 	return 0;
 }
 
+
+static const struct acpi_device_id eeepc_device_ids[] = {
+	{EEEPC_ACPI_HID, 0},
+	{"", 0},
+};
+MODULE_DEVICE_TABLE(acpi, eeepc_device_ids);
+
+static struct acpi_driver eeepc_acpi_driver = {
+	.name = EEEPC_LAPTOP_NAME,
+	.class = EEEPC_ACPI_CLASS,
+	.owner = THIS_MODULE,
+	.ids = eeepc_device_ids,
+	.flags = ACPI_DRIVER_ALL_NOTIFY_EVENTS,
+	.ops = {
+		.add = eeepc_acpi_add,
+		.remove = eeepc_acpi_remove,
+		.notify = eeepc_acpi_notify,
+	},
+};
+
+
 static int __init eeepc_laptop_init(void)
 {
 	int result;
 
-	if (acpi_disabled)
-		return -ENODEV;
-	result = acpi_bus_register_driver(&eeepc_hotk_driver);
+	result = platform_driver_register(&platform_driver);
 	if (result < 0)
 		return result;
-	if (!ehotk) {
-		acpi_bus_unregister_driver(&eeepc_hotk_driver);
-		return -ENODEV;
+
+	result = acpi_bus_register_driver(&eeepc_acpi_driver);
+	if (result < 0)
+		goto fail_acpi_driver;
+
+	if (!eeepc_device_present) {
+		result = -ENODEV;
+		goto fail_no_device;
 	}
+
 	return 0;
+
+fail_no_device:
+	acpi_bus_unregister_driver(&eeepc_acpi_driver);
+fail_acpi_driver:
+	platform_driver_unregister(&platform_driver);
+	return result;
 }
 
 static void __exit eeepc_laptop_exit(void)
 {
-	acpi_bus_unregister_driver(&eeepc_hotk_driver);
+	acpi_bus_unregister_driver(&eeepc_acpi_driver);
+	platform_driver_unregister(&platform_driver);
 }
 
 module_init(eeepc_laptop_init);
diff --git a/drivers/platform/x86/fujitsu-laptop.c b/drivers/platform/x86/fujitsu-laptop.c
index bcd4ba8be7db..5f3320d468f6 100644
--- a/drivers/platform/x86/fujitsu-laptop.c
+++ b/drivers/platform/x86/fujitsu-laptop.c
@@ -164,7 +164,7 @@ struct fujitsu_hotkey_t {
 	struct input_dev *input;
 	char phys[32];
 	struct platform_device *pf_device;
-	struct kfifo *fifo;
+	struct kfifo fifo;
 	spinlock_t fifo_lock;
 	int rfkill_supported;
 	int rfkill_state;
@@ -376,8 +376,8 @@ static int get_lcd_level(void)
 
 	status =
 	    acpi_evaluate_integer(fujitsu->acpi_handle, "GBLL", NULL, &state);
-	if (status < 0)
-		return status;
+	if (ACPI_FAILURE(status))
+		return 0;
 
 	fujitsu->brightness_level = state & 0x0fffffff;
 
@@ -398,8 +398,8 @@ static int get_max_brightness(void)
 
 	status =
 	    acpi_evaluate_integer(fujitsu->acpi_handle, "RBLL", NULL, &state);
-	if (status < 0)
-		return status;
+	if (ACPI_FAILURE(status))
+		return -1;
 
 	fujitsu->max_brightness = state;
 
@@ -824,12 +824,10 @@ static int acpi_fujitsu_hotkey_add(struct acpi_device *device)
 
 	/* kfifo */
 	spin_lock_init(&fujitsu_hotkey->fifo_lock);
-	fujitsu_hotkey->fifo =
-	    kfifo_alloc(RINGBUFFERSIZE * sizeof(int), GFP_KERNEL,
-			&fujitsu_hotkey->fifo_lock);
-	if (IS_ERR(fujitsu_hotkey->fifo)) {
+	error = kfifo_alloc(&fujitsu_hotkey->fifo, RINGBUFFERSIZE * sizeof(int),
+			GFP_KERNEL);
+	if (error) {
 		printk(KERN_ERR "kfifo_alloc failed\n");
-		error = PTR_ERR(fujitsu_hotkey->fifo);
 		goto err_stop;
 	}
 
@@ -934,7 +932,7 @@ err_unregister_input_dev:
 err_free_input_dev:
 	input_free_device(input);
 err_free_fifo:
-	kfifo_free(fujitsu_hotkey->fifo);
+	kfifo_free(&fujitsu_hotkey->fifo);
 err_stop:
 	return result;
 }
@@ -956,7 +954,7 @@ static int acpi_fujitsu_hotkey_remove(struct acpi_device *device, int type)
 
 	input_free_device(input);
 
-	kfifo_free(fujitsu_hotkey->fifo);
+	kfifo_free(&fujitsu_hotkey->fifo);
 
 	fujitsu_hotkey->acpi_handle = NULL;
 
@@ -1008,9 +1006,10 @@ static void acpi_fujitsu_hotkey_notify(struct acpi_device *device, u32 event)
 				vdbg_printk(FUJLAPTOP_DBG_TRACE,
 					"Push keycode into ringbuffer [%d]\n",
 					keycode);
-				status = kfifo_put(fujitsu_hotkey->fifo,
+				status = kfifo_in_locked(&fujitsu_hotkey->fifo,
 						   (unsigned char *)&keycode,
-						   sizeof(keycode));
+						   sizeof(keycode),
+						   &fujitsu_hotkey->fifo_lock);
 				if (status != sizeof(keycode)) {
 					vdbg_printk(FUJLAPTOP_DBG_WARN,
 					    "Could not push keycode [0x%x]\n",
@@ -1021,11 +1020,12 @@ static void acpi_fujitsu_hotkey_notify(struct acpi_device *device, u32 event)
 				}
 			} else if (keycode == 0) {
 				while ((status =
-					kfifo_get
-					(fujitsu_hotkey->fifo, (unsigned char *)
-					 &keycode_r,
-					 sizeof
-					 (keycode_r))) == sizeof(keycode_r)) {
+					kfifo_out_locked(
+					 &fujitsu_hotkey->fifo,
+					 (unsigned char *) &keycode_r,
+					 sizeof(keycode_r),
+					 &fujitsu_hotkey->fifo_lock))
+					 == sizeof(keycode_r)) {
 					input_report_key(input, keycode_r, 0);
 					input_sync(input);
 					vdbg_printk(FUJLAPTOP_DBG_TRACE,
diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c
index c2842171cec6..ad4c414dbfbc 100644
--- a/drivers/platform/x86/hp-wmi.c
+++ b/drivers/platform/x86/hp-wmi.c
@@ -51,6 +51,12 @@ MODULE_ALIAS("wmi:5FB7F034-2C63-45e9-BE91-3D44E2C707E4");
 #define HPWMI_WIRELESS_QUERY 0x5
 #define HPWMI_HOTKEY_QUERY 0xc
 
+enum hp_wmi_radio {
+	HPWMI_WIFI = 0,
+	HPWMI_BLUETOOTH = 1,
+	HPWMI_WWAN = 2,
+};
+
 static int __init hp_wmi_bios_setup(struct platform_device *device);
 static int __exit hp_wmi_bios_remove(struct platform_device *device);
 static int hp_wmi_resume_handler(struct device *device);
@@ -94,7 +100,7 @@ static struct rfkill *wifi_rfkill;
 static struct rfkill *bluetooth_rfkill;
 static struct rfkill *wwan_rfkill;
 
-static struct dev_pm_ops hp_wmi_pm_ops = {
+static const struct dev_pm_ops hp_wmi_pm_ops = {
 	.resume  = hp_wmi_resume_handler,
 	.restore  = hp_wmi_resume_handler,
 };
@@ -128,10 +134,15 @@ static int hp_wmi_perform_query(int query, int write, int value)
 
 	obj = output.pointer;
 
-	if (!obj || obj->type != ACPI_TYPE_BUFFER)
+	if (!obj)
 		return -EINVAL;
+	else if (obj->type != ACPI_TYPE_BUFFER) {
+		kfree(obj);
+		return -EINVAL;
+	}
 
 	bios_return = *((struct bios_return *)obj->buffer.pointer);
+	kfree(obj);
 	if (bios_return.return_code > 0)
 		return bios_return.return_code * -1;
 	else
@@ -175,8 +186,8 @@ static int hp_wmi_tablet_state(void)
 
 static int hp_wmi_set_block(void *data, bool blocked)
 {
-	unsigned long b = (unsigned long) data;
-	int query = BIT(b + 8) | ((!blocked) << b);
+	enum hp_wmi_radio r = (enum hp_wmi_radio) data;
+	int query = BIT(r + 8) | ((!blocked) << r);
 
 	return hp_wmi_perform_query(HPWMI_WIRELESS_QUERY, 1, query);
 }
@@ -185,31 +196,23 @@ static const struct rfkill_ops hp_wmi_rfkill_ops = {
 	.set_block = hp_wmi_set_block,
 };
 
-static bool hp_wmi_wifi_state(void)
-{
-	int wireless = hp_wmi_perform_query(HPWMI_WIRELESS_QUERY, 0, 0);
-
-	if (wireless & 0x100)
-		return false;
-	else
-		return true;
-}
-
-static bool hp_wmi_bluetooth_state(void)
+static bool hp_wmi_get_sw_state(enum hp_wmi_radio r)
 {
 	int wireless = hp_wmi_perform_query(HPWMI_WIRELESS_QUERY, 0, 0);
+	int mask = 0x200 << (r * 8);
 
-	if (wireless & 0x10000)
+	if (wireless & mask)
 		return false;
 	else
 		return true;
 }
 
-static bool hp_wmi_wwan_state(void)
+static bool hp_wmi_get_hw_state(enum hp_wmi_radio r)
 {
 	int wireless = hp_wmi_perform_query(HPWMI_WIRELESS_QUERY, 0, 0);
+	int mask = 0x800 << (r * 8);
 
-	if (wireless & 0x1000000)
+	if (wireless & mask)
 		return false;
 	else
 		return true;
@@ -334,49 +337,62 @@ static void hp_wmi_notify(u32 value, void *context)
 	struct acpi_buffer response = { ACPI_ALLOCATE_BUFFER, NULL };
 	static struct key_entry *key;
 	union acpi_object *obj;
+	int eventcode;
+	acpi_status status;
 
-	wmi_get_event_data(value, &response);
+	status = wmi_get_event_data(value, &response);
+	if (status != AE_OK) {
+		printk(KERN_INFO "hp-wmi: bad event status 0x%x\n", status);
+		return;
+	}
 
 	obj = (union acpi_object *)response.pointer;
 
-	if (obj && obj->type == ACPI_TYPE_BUFFER && obj->buffer.length == 8) {
-		int eventcode = *((u8 *) obj->buffer.pointer);
-		if (eventcode == 0x4)
-			eventcode = hp_wmi_perform_query(HPWMI_HOTKEY_QUERY, 0,
-							 0);
-		key = hp_wmi_get_entry_by_scancode(eventcode);
-		if (key) {
-			switch (key->type) {
-			case KE_KEY:
-				input_report_key(hp_wmi_input_dev,
-						 key->keycode, 1);
-				input_sync(hp_wmi_input_dev);
-				input_report_key(hp_wmi_input_dev,
-						 key->keycode, 0);
-				input_sync(hp_wmi_input_dev);
-				break;
-			}
-		} else if (eventcode == 0x1) {
-			input_report_switch(hp_wmi_input_dev, SW_DOCK,
-					    hp_wmi_dock_state());
-			input_report_switch(hp_wmi_input_dev, SW_TABLET_MODE,
-					    hp_wmi_tablet_state());
+	if (!obj || obj->type != ACPI_TYPE_BUFFER || obj->buffer.length != 8) {
+		printk(KERN_INFO "HP WMI: Unknown response received\n");
+		kfree(obj);
+		return;
+	}
+
+	eventcode = *((u8 *) obj->buffer.pointer);
+	kfree(obj);
+	if (eventcode == 0x4)
+		eventcode = hp_wmi_perform_query(HPWMI_HOTKEY_QUERY, 0,
+						0);
+	key = hp_wmi_get_entry_by_scancode(eventcode);
+	if (key) {
+		switch (key->type) {
+		case KE_KEY:
+			input_report_key(hp_wmi_input_dev,
+					 key->keycode, 1);
+			input_sync(hp_wmi_input_dev);
+			input_report_key(hp_wmi_input_dev,
+					 key->keycode, 0);
 			input_sync(hp_wmi_input_dev);
-		} else if (eventcode == 0x5) {
-			if (wifi_rfkill)
-				rfkill_set_sw_state(wifi_rfkill,
-						    hp_wmi_wifi_state());
-			if (bluetooth_rfkill)
-				rfkill_set_sw_state(bluetooth_rfkill,
-						    hp_wmi_bluetooth_state());
-			if (wwan_rfkill)
-				rfkill_set_sw_state(wwan_rfkill,
-						    hp_wmi_wwan_state());
-		} else
-			printk(KERN_INFO "HP WMI: Unknown key pressed - %x\n",
-			       eventcode);
+			break;
+		}
+	} else if (eventcode == 0x1) {
+		input_report_switch(hp_wmi_input_dev, SW_DOCK,
+				    hp_wmi_dock_state());
+		input_report_switch(hp_wmi_input_dev, SW_TABLET_MODE,
+				    hp_wmi_tablet_state());
+		input_sync(hp_wmi_input_dev);
+	} else if (eventcode == 0x5) {
+		if (wifi_rfkill)
+			rfkill_set_states(wifi_rfkill,
+					  hp_wmi_get_sw_state(HPWMI_WIFI),
+					  hp_wmi_get_hw_state(HPWMI_WIFI));
+		if (bluetooth_rfkill)
+			rfkill_set_states(bluetooth_rfkill,
+					  hp_wmi_get_sw_state(HPWMI_BLUETOOTH),
+					  hp_wmi_get_hw_state(HPWMI_BLUETOOTH));
+		if (wwan_rfkill)
+			rfkill_set_states(wwan_rfkill,
+					  hp_wmi_get_sw_state(HPWMI_WWAN),
+					  hp_wmi_get_hw_state(HPWMI_WWAN));
 	} else
-		printk(KERN_INFO "HP WMI: Unknown response received\n");
+		printk(KERN_INFO "HP WMI: Unknown key pressed - %x\n",
+			eventcode);
 }
 
 static int __init hp_wmi_input_setup(void)
@@ -455,7 +471,11 @@ static int __init hp_wmi_bios_setup(struct platform_device *device)
 		wifi_rfkill = rfkill_alloc("hp-wifi", &device->dev,
 					   RFKILL_TYPE_WLAN,
 					   &hp_wmi_rfkill_ops,
-					   (void *) 0);
+					   (void *) HPWMI_WIFI);
+		rfkill_init_sw_state(wifi_rfkill,
+				     hp_wmi_get_sw_state(HPWMI_WIFI));
+		rfkill_set_hw_state(wifi_rfkill,
+				    hp_wmi_get_hw_state(HPWMI_WIFI));
 		err = rfkill_register(wifi_rfkill);
 		if (err)
 			goto register_wifi_error;
@@ -465,7 +485,11 @@ static int __init hp_wmi_bios_setup(struct platform_device *device)
 		bluetooth_rfkill = rfkill_alloc("hp-bluetooth", &device->dev,
 						RFKILL_TYPE_BLUETOOTH,
 						&hp_wmi_rfkill_ops,
-						(void *) 1);
+						(void *) HPWMI_BLUETOOTH);
+		rfkill_init_sw_state(bluetooth_rfkill,
+				     hp_wmi_get_sw_state(HPWMI_BLUETOOTH));
+		rfkill_set_hw_state(bluetooth_rfkill,
+				    hp_wmi_get_hw_state(HPWMI_BLUETOOTH));
 		err = rfkill_register(bluetooth_rfkill);
 		if (err)
 			goto register_bluetooth_error;
@@ -475,7 +499,11 @@ static int __init hp_wmi_bios_setup(struct platform_device *device)
 		wwan_rfkill = rfkill_alloc("hp-wwan", &device->dev,
 					   RFKILL_TYPE_WWAN,
 					   &hp_wmi_rfkill_ops,
-					   (void *) 2);
+					   (void *) HPWMI_WWAN);
+		rfkill_init_sw_state(wwan_rfkill,
+				     hp_wmi_get_sw_state(HPWMI_WWAN));
+		rfkill_set_hw_state(wwan_rfkill,
+				    hp_wmi_get_hw_state(HPWMI_WWAN));
 		err = rfkill_register(wwan_rfkill);
 		if (err)
 			goto register_wwan_err;
@@ -533,6 +561,19 @@ static int hp_wmi_resume_handler(struct device *device)
 		input_sync(hp_wmi_input_dev);
 	}
 
+	if (wifi_rfkill)
+		rfkill_set_states(wifi_rfkill,
+				  hp_wmi_get_sw_state(HPWMI_WIFI),
+				  hp_wmi_get_hw_state(HPWMI_WIFI));
+	if (bluetooth_rfkill)
+		rfkill_set_states(bluetooth_rfkill,
+				  hp_wmi_get_sw_state(HPWMI_BLUETOOTH),
+				  hp_wmi_get_hw_state(HPWMI_BLUETOOTH));
+	if (wwan_rfkill)
+		rfkill_set_states(wwan_rfkill,
+				  hp_wmi_get_sw_state(HPWMI_WWAN),
+				  hp_wmi_get_hw_state(HPWMI_WWAN));
+
 	return 0;
 }
 
@@ -543,7 +584,7 @@ static int __init hp_wmi_init(void)
 	if (wmi_has_guid(HPWMI_EVENT_GUID)) {
 		err = wmi_install_notify_handler(HPWMI_EVENT_GUID,
 						 hp_wmi_notify, NULL);
-		if (!err)
+		if (ACPI_SUCCESS(err))
 			hp_wmi_input_setup();
 	}
 
diff --git a/drivers/platform/x86/intel_menlow.c b/drivers/platform/x86/intel_menlow.c
index 29432a50be45..f0a90a6bf396 100644
--- a/drivers/platform/x86/intel_menlow.c
+++ b/drivers/platform/x86/intel_menlow.c
@@ -510,7 +510,7 @@ static int __init intel_menlow_module_init(void)
 	/* Looking for sensors in each ACPI thermal zone */
 	status = acpi_walk_namespace(ACPI_TYPE_THERMAL, ACPI_ROOT_OBJECT,
 				     ACPI_UINT32_MAX,
-				     intel_menlow_register_sensor, NULL, NULL);
+				     intel_menlow_register_sensor, NULL, NULL, NULL);
 	if (ACPI_FAILURE(status))
 		return -ENODEV;
 
diff --git a/drivers/platform/x86/msi-wmi.c b/drivers/platform/x86/msi-wmi.c
new file mode 100644
index 000000000000..f5f70d4c6913
--- /dev/null
+++ b/drivers/platform/x86/msi-wmi.c
@@ -0,0 +1,288 @@
+/*
+ * MSI WMI hotkeys
+ *
+ * Copyright (C) 2009 Novell <trenn@suse.de>
+ *
+ * Most stuff taken over from hp-wmi
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+
+#include <linux/kernel.h>
+#include <linux/input.h>
+#include <linux/input/sparse-keymap.h>
+#include <linux/acpi.h>
+#include <linux/backlight.h>
+
+MODULE_AUTHOR("Thomas Renninger <trenn@suse.de>");
+MODULE_DESCRIPTION("MSI laptop WMI hotkeys driver");
+MODULE_LICENSE("GPL");
+
+MODULE_ALIAS("wmi:551A1F84-FBDD-4125-91DB-3EA8F44F1D45");
+MODULE_ALIAS("wmi:B6F3EEF2-3D2F-49DC-9DE3-85BCE18C62F2");
+
+#define DRV_NAME "msi-wmi"
+#define DRV_PFX DRV_NAME ": "
+
+#define MSIWMI_BIOS_GUID "551A1F84-FBDD-4125-91DB-3EA8F44F1D45"
+#define MSIWMI_EVENT_GUID "B6F3EEF2-3D2F-49DC-9DE3-85BCE18C62F2"
+
+#define dprintk(msg...) pr_debug(DRV_PFX msg)
+
+#define KEYCODE_BASE 0xD0
+#define MSI_WMI_BRIGHTNESSUP   KEYCODE_BASE
+#define MSI_WMI_BRIGHTNESSDOWN (KEYCODE_BASE + 1)
+#define MSI_WMI_VOLUMEUP       (KEYCODE_BASE + 2)
+#define MSI_WMI_VOLUMEDOWN     (KEYCODE_BASE + 3)
+static struct key_entry msi_wmi_keymap[] = {
+	{ KE_KEY, MSI_WMI_BRIGHTNESSUP,   {KEY_BRIGHTNESSUP} },
+	{ KE_KEY, MSI_WMI_BRIGHTNESSDOWN, {KEY_BRIGHTNESSDOWN} },
+	{ KE_KEY, MSI_WMI_VOLUMEUP,       {KEY_VOLUMEUP} },
+	{ KE_KEY, MSI_WMI_VOLUMEDOWN,     {KEY_VOLUMEDOWN} },
+	{ KE_END, 0}
+};
+static ktime_t last_pressed[ARRAY_SIZE(msi_wmi_keymap) - 1];
+
+struct backlight_device *backlight;
+
+static int backlight_map[] = { 0x00, 0x33, 0x66, 0x99, 0xCC, 0xFF };
+
+static struct input_dev *msi_wmi_input_dev;
+
+static int msi_wmi_query_block(int instance, int *ret)
+{
+	acpi_status status;
+	union acpi_object *obj;
+
+	struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL };
+
+	status = wmi_query_block(MSIWMI_BIOS_GUID, instance, &output);
+
+	obj = output.pointer;
+
+	if (!obj || obj->type != ACPI_TYPE_INTEGER) {
+		if (obj) {
+			printk(KERN_ERR DRV_PFX "query block returned object "
+			       "type: %d - buffer length:%d\n", obj->type,
+			       obj->type == ACPI_TYPE_BUFFER ?
+			       obj->buffer.length : 0);
+		}
+		kfree(obj);
+		return -EINVAL;
+	}
+	*ret = obj->integer.value;
+	kfree(obj);
+	return 0;
+}
+
+static int msi_wmi_set_block(int instance, int value)
+{
+	acpi_status status;
+
+	struct acpi_buffer input = { sizeof(int), &value };
+
+	dprintk("Going to set block of instance: %d - value: %d\n",
+		instance, value);
+
+	status = wmi_set_block(MSIWMI_BIOS_GUID, instance, &input);
+
+	return ACPI_SUCCESS(status) ? 0 : 1;
+}
+
+static int bl_get(struct backlight_device *bd)
+{
+	int level, err, ret;
+
+	/* Instance 1 is "get backlight", cmp with DSDT */
+	err = msi_wmi_query_block(1, &ret);
+	if (err) {
+		printk(KERN_ERR DRV_PFX "Could not query backlight: %d\n", err);
+		return -EINVAL;
+	}
+	dprintk("Get: Query block returned: %d\n", ret);
+	for (level = 0; level < ARRAY_SIZE(backlight_map); level++) {
+		if (backlight_map[level] == ret) {
+			dprintk("Current backlight level: 0x%X - index: %d\n",
+				backlight_map[level], level);
+			break;
+		}
+	}
+	if (level == ARRAY_SIZE(backlight_map)) {
+		printk(KERN_ERR DRV_PFX "get: Invalid brightness value: 0x%X\n",
+		       ret);
+		return -EINVAL;
+	}
+	return level;
+}
+
+static int bl_set_status(struct backlight_device *bd)
+{
+	int bright = bd->props.brightness;
+	if (bright >= ARRAY_SIZE(backlight_map) || bright < 0)
+		return -EINVAL;
+
+	/* Instance 0 is "set backlight" */
+	return msi_wmi_set_block(0, backlight_map[bright]);
+}
+
+static struct backlight_ops msi_backlight_ops = {
+	.get_brightness	= bl_get,
+	.update_status	= bl_set_status,
+};
+
+static void msi_wmi_notify(u32 value, void *context)
+{
+	struct acpi_buffer response = { ACPI_ALLOCATE_BUFFER, NULL };
+	static struct key_entry *key;
+	union acpi_object *obj;
+	ktime_t cur;
+	acpi_status status;
+
+	status = wmi_get_event_data(value, &response);
+	if (status != AE_OK) {
+		printk(KERN_INFO DRV_PFX "bad event status 0x%x\n", status);
+		return;
+	}
+
+	obj = (union acpi_object *)response.pointer;
+
+	if (obj && obj->type == ACPI_TYPE_INTEGER) {
+		int eventcode = obj->integer.value;
+		dprintk("Eventcode: 0x%x\n", eventcode);
+		key = sparse_keymap_entry_from_scancode(msi_wmi_input_dev,
+				eventcode);
+		if (key) {
+			ktime_t diff;
+			cur = ktime_get_real();
+			diff = ktime_sub(cur, last_pressed[key->code -
+					KEYCODE_BASE]);
+			/* Ignore event if the same event happened in a 50 ms
+			   timeframe -> Key press may result in 10-20 GPEs */
+			if (ktime_to_us(diff) < 1000 * 50) {
+				dprintk("Suppressed key event 0x%X - "
+					"Last press was %lld us ago\n",
+					 key->code, ktime_to_us(diff));
+				return;
+			}
+			last_pressed[key->code - KEYCODE_BASE] = cur;
+
+			if (key->type == KE_KEY &&
+			/* Brightness is served via acpi video driver */
+			(!acpi_video_backlight_support() ||
+			(key->code != MSI_WMI_BRIGHTNESSUP &&
+			key->code != MSI_WMI_BRIGHTNESSDOWN))) {
+				dprintk("Send key: 0x%X - "
+					"Input layer keycode: %d\n", key->code,
+					 key->keycode);
+				sparse_keymap_report_entry(msi_wmi_input_dev,
+						key, 1, true);
+			}
+		} else
+			printk(KERN_INFO "Unknown key pressed - %x\n",
+			       eventcode);
+	} else
+		printk(KERN_INFO DRV_PFX "Unknown event received\n");
+	kfree(response.pointer);
+}
+
+static int __init msi_wmi_input_setup(void)
+{
+	int err;
+
+	msi_wmi_input_dev = input_allocate_device();
+	if (!msi_wmi_input_dev)
+		return -ENOMEM;
+
+	msi_wmi_input_dev->name = "MSI WMI hotkeys";
+	msi_wmi_input_dev->phys = "wmi/input0";
+	msi_wmi_input_dev->id.bustype = BUS_HOST;
+
+	err = sparse_keymap_setup(msi_wmi_input_dev, msi_wmi_keymap, NULL);
+	if (err)
+		goto err_free_dev;
+
+	err = input_register_device(msi_wmi_input_dev);
+
+	if (err)
+		goto err_free_keymap;
+
+	memset(last_pressed, 0, sizeof(last_pressed));
+
+	return 0;
+
+err_free_keymap:
+	sparse_keymap_free(msi_wmi_input_dev);
+err_free_dev:
+	input_free_device(msi_wmi_input_dev);
+	return err;
+}
+
+static int __init msi_wmi_init(void)
+{
+	int err;
+
+	if (!wmi_has_guid(MSIWMI_EVENT_GUID)) {
+		printk(KERN_ERR
+		       "This machine doesn't have MSI-hotkeys through WMI\n");
+		return -ENODEV;
+	}
+	err = wmi_install_notify_handler(MSIWMI_EVENT_GUID,
+			msi_wmi_notify, NULL);
+	if (ACPI_FAILURE(err))
+		return -EINVAL;
+
+	err = msi_wmi_input_setup();
+	if (err)
+		goto err_uninstall_notifier;
+
+	if (!acpi_video_backlight_support()) {
+		backlight = backlight_device_register(DRV_NAME,
+				NULL, NULL, &msi_backlight_ops);
+		if (IS_ERR(backlight))
+			goto err_free_input;
+
+		backlight->props.max_brightness = ARRAY_SIZE(backlight_map) - 1;
+		err = bl_get(NULL);
+		if (err < 0)
+			goto err_free_backlight;
+
+		backlight->props.brightness = err;
+	}
+	dprintk("Event handler installed\n");
+
+	return 0;
+
+err_free_backlight:
+	backlight_device_unregister(backlight);
+err_free_input:
+	input_unregister_device(msi_wmi_input_dev);
+err_uninstall_notifier:
+	wmi_remove_notify_handler(MSIWMI_EVENT_GUID);
+	return err;
+}
+
+static void __exit msi_wmi_exit(void)
+{
+	if (wmi_has_guid(MSIWMI_EVENT_GUID)) {
+		wmi_remove_notify_handler(MSIWMI_EVENT_GUID);
+		sparse_keymap_free(msi_wmi_input_dev);
+		input_unregister_device(msi_wmi_input_dev);
+		backlight_device_unregister(backlight);
+	}
+}
+
+module_init(msi_wmi_init);
+module_exit(msi_wmi_exit);
diff --git a/drivers/platform/x86/sony-laptop.c b/drivers/platform/x86/sony-laptop.c
index a2a742c8ff7e..3f71a605a492 100644
--- a/drivers/platform/x86/sony-laptop.c
+++ b/drivers/platform/x86/sony-laptop.c
@@ -131,6 +131,7 @@ enum sony_nc_rfkill {
 	N_SONY_RFKILL,
 };
 
+static int sony_rfkill_handle;
 static struct rfkill *sony_rfkill_devices[N_SONY_RFKILL];
 static int sony_rfkill_address[N_SONY_RFKILL] = {0x300, 0x500, 0x700, 0x900};
 static void sony_nc_rfkill_update(void);
@@ -142,7 +143,7 @@ struct sony_laptop_input_s {
 	atomic_t		users;
 	struct input_dev	*jog_dev;
 	struct input_dev	*key_dev;
-	struct kfifo		*fifo;
+	struct kfifo		fifo;
 	spinlock_t		fifo_lock;
 	struct workqueue_struct	*wq;
 };
@@ -232,6 +233,7 @@ static int sony_laptop_input_index[] = {
 	56,	/* 69 SONYPI_EVENT_VOLUME_INC_PRESSED */
 	57,	/* 70 SONYPI_EVENT_VOLUME_DEC_PRESSED */
 	-1,	/* 71 SONYPI_EVENT_BRIGHTNESS_PRESSED */
+	58,	/* 72 SONYPI_EVENT_MEDIA_PRESSED */
 };
 
 static int sony_laptop_input_keycode_map[] = {
@@ -293,6 +295,7 @@ static int sony_laptop_input_keycode_map[] = {
 	KEY_F15,	/* 55 SONYPI_EVENT_SETTINGKEY_PRESSED */
 	KEY_VOLUMEUP,	/* 56 SONYPI_EVENT_VOLUME_INC_PRESSED */
 	KEY_VOLUMEDOWN,	/* 57 SONYPI_EVENT_VOLUME_DEC_PRESSED */
+	KEY_MEDIA,	/* 58 SONYPI_EVENT_MEDIA_PRESSED */
 };
 
 /* release buttons after a short delay if pressed */
@@ -300,8 +303,9 @@ static void do_sony_laptop_release_key(struct work_struct *work)
 {
 	struct sony_laptop_keypress kp;
 
-	while (kfifo_get(sony_laptop_input.fifo, (unsigned char *)&kp,
-			 sizeof(kp)) == sizeof(kp)) {
+	while (kfifo_out_locked(&sony_laptop_input.fifo, (unsigned char *)&kp,
+			sizeof(kp), &sony_laptop_input.fifo_lock)
+			== sizeof(kp)) {
 		msleep(10);
 		input_report_key(kp.dev, kp.key, 0);
 		input_sync(kp.dev);
@@ -362,8 +366,9 @@ static void sony_laptop_report_input_event(u8 event)
 		/* we emit the scancode so we can always remap the key */
 		input_event(kp.dev, EV_MSC, MSC_SCAN, event);
 		input_sync(kp.dev);
-		kfifo_put(sony_laptop_input.fifo,
-			  (unsigned char *)&kp, sizeof(kp));
+		kfifo_in_locked(&sony_laptop_input.fifo,
+			  (unsigned char *)&kp, sizeof(kp),
+			  &sony_laptop_input.fifo_lock);
 
 		if (!work_pending(&sony_laptop_release_key_work))
 			queue_work(sony_laptop_input.wq,
@@ -385,12 +390,10 @@ static int sony_laptop_setup_input(struct acpi_device *acpi_device)
 
 	/* kfifo */
 	spin_lock_init(&sony_laptop_input.fifo_lock);
-	sony_laptop_input.fifo =
-		kfifo_alloc(SONY_LAPTOP_BUF_SIZE, GFP_KERNEL,
-			    &sony_laptop_input.fifo_lock);
-	if (IS_ERR(sony_laptop_input.fifo)) {
+	error =
+	 kfifo_alloc(&sony_laptop_input.fifo, SONY_LAPTOP_BUF_SIZE, GFP_KERNEL);
+	if (error) {
 		printk(KERN_ERR DRV_PFX "kfifo_alloc failed\n");
-		error = PTR_ERR(sony_laptop_input.fifo);
 		goto err_dec_users;
 	}
 
@@ -474,7 +477,7 @@ err_destroy_wq:
 	destroy_workqueue(sony_laptop_input.wq);
 
 err_free_kfifo:
-	kfifo_free(sony_laptop_input.fifo);
+	kfifo_free(&sony_laptop_input.fifo);
 
 err_dec_users:
 	atomic_dec(&sony_laptop_input.users);
@@ -500,7 +503,7 @@ static void sony_laptop_remove_input(void)
 	}
 
 	destroy_workqueue(sony_laptop_input.wq);
-	kfifo_free(sony_laptop_input.fifo);
+	kfifo_free(&sony_laptop_input.fifo);
 }
 
 /*********** Platform Device ***********/
@@ -890,6 +893,8 @@ static struct sony_nc_event sony_100_events[] = {
 	{ 0x0C, SONYPI_EVENT_FNKEY_RELEASED },
 	{ 0x9f, SONYPI_EVENT_CD_EJECT_PRESSED },
 	{ 0x1f, SONYPI_EVENT_ANYBUTTON_RELEASED },
+	{ 0xa1, SONYPI_EVENT_MEDIA_PRESSED },
+	{ 0x21, SONYPI_EVENT_ANYBUTTON_RELEASED },
 	{ 0, 0 },
 };
 
@@ -961,7 +966,7 @@ static void sony_nc_notify(struct acpi_device *device, u32 event)
 				else
 					sony_laptop_report_input_event(ev);
 			}
-		} else if (sony_find_snc_handle(0x124) == ev) {
+		} else if (sony_find_snc_handle(sony_rfkill_handle) == ev) {
 			sony_nc_rfkill_update();
 			return;
 		}
@@ -1067,7 +1072,7 @@ static int sony_nc_rfkill_set(void *data, bool blocked)
 	if (!blocked)
 		argument |= 0xff0000;
 
-	return sony_call_snc_handle(0x124, argument, &result);
+	return sony_call_snc_handle(sony_rfkill_handle, argument, &result);
 }
 
 static const struct rfkill_ops sony_rfkill_ops = {
@@ -1110,7 +1115,7 @@ static int sony_nc_setup_rfkill(struct acpi_device *device,
 	if (!rfk)
 		return -ENOMEM;
 
-	sony_call_snc_handle(0x124, 0x200, &result);
+	sony_call_snc_handle(sony_rfkill_handle, 0x200, &result);
 	hwblock = !(result & 0x1);
 	rfkill_set_hw_state(rfk, hwblock);
 
@@ -1129,7 +1134,7 @@ static void sony_nc_rfkill_update()
 	int result;
 	bool hwblock;
 
-	sony_call_snc_handle(0x124, 0x200, &result);
+	sony_call_snc_handle(sony_rfkill_handle, 0x200, &result);
 	hwblock = !(result & 0x1);
 
 	for (i = 0; i < N_SONY_RFKILL; i++) {
@@ -1145,36 +1150,82 @@ static void sony_nc_rfkill_update()
 			continue;
 		}
 
-		sony_call_snc_handle(0x124, argument, &result);
+		sony_call_snc_handle(sony_rfkill_handle, argument, &result);
 		rfkill_set_states(sony_rfkill_devices[i],
 				  !(result & 0xf), false);
 	}
 }
 
-static int sony_nc_rfkill_setup(struct acpi_device *device)
+static void sony_nc_rfkill_setup(struct acpi_device *device)
 {
-	int result, ret;
+	int offset;
+	u8 dev_code, i;
+	acpi_status status;
+	struct acpi_object_list params;
+	union acpi_object in_obj;
+	union acpi_object *device_enum;
+	struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
 
-	if (sony_find_snc_handle(0x124) == -1)
-		return -1;
+	offset = sony_find_snc_handle(0x124);
+	if (offset == -1) {
+		offset = sony_find_snc_handle(0x135);
+		if (offset == -1)
+			return;
+		else
+			sony_rfkill_handle = 0x135;
+	} else
+		sony_rfkill_handle = 0x124;
+	dprintk("Found rkfill handle: 0x%.4x\n", sony_rfkill_handle);
 
-	ret = sony_call_snc_handle(0x124, 0xb00, &result);
-	if (ret) {
-		printk(KERN_INFO DRV_PFX
-		       "Unable to enumerate rfkill devices: %x\n", ret);
-		return ret;
+	/* need to read the whole buffer returned by the acpi call to SN06
+	 * here otherwise we may miss some features
+	 */
+	params.count = 1;
+	params.pointer = &in_obj;
+	in_obj.type = ACPI_TYPE_INTEGER;
+	in_obj.integer.value = offset;
+	status = acpi_evaluate_object(sony_nc_acpi_handle, "SN06", &params,
+			&buffer);
+	if (ACPI_FAILURE(status)) {
+		dprintk("Radio device enumeration failed\n");
+		return;
 	}
 
-	if (result & 0x1)
-		sony_nc_setup_rfkill(device, SONY_WIFI);
-	if (result & 0x2)
-		sony_nc_setup_rfkill(device, SONY_BLUETOOTH);
-	if (result & 0x1c)
-		sony_nc_setup_rfkill(device, SONY_WWAN);
-	if (result & 0x20)
-		sony_nc_setup_rfkill(device, SONY_WIMAX);
+	device_enum = (union acpi_object *) buffer.pointer;
+	if (!device_enum || device_enum->type != ACPI_TYPE_BUFFER) {
+		printk(KERN_ERR "Invalid SN06 return object 0x%.2x\n",
+				device_enum->type);
+		goto out_no_enum;
+	}
 
-	return 0;
+	/* the buffer is filled with magic numbers describing the devices
+	 * available, 0xff terminates the enumeration
+	 */
+	for (i = 0; i < device_enum->buffer.length; i++) {
+
+		dev_code = *(device_enum->buffer.pointer + i);
+		if (dev_code == 0xff)
+			break;
+
+		dprintk("Radio devices, looking at 0x%.2x\n", dev_code);
+
+		if (dev_code == 0 && !sony_rfkill_devices[SONY_WIFI])
+			sony_nc_setup_rfkill(device, SONY_WIFI);
+
+		if (dev_code == 0x10 && !sony_rfkill_devices[SONY_BLUETOOTH])
+			sony_nc_setup_rfkill(device, SONY_BLUETOOTH);
+
+		if ((0xf0 & dev_code) == 0x20 &&
+				!sony_rfkill_devices[SONY_WWAN])
+			sony_nc_setup_rfkill(device, SONY_WWAN);
+
+		if (dev_code == 0x30 && !sony_rfkill_devices[SONY_WIMAX])
+			sony_nc_setup_rfkill(device, SONY_WIMAX);
+	}
+
+out_no_enum:
+	kfree(buffer.pointer);
+	return;
 }
 
 static int sony_nc_add(struct acpi_device *device)
@@ -1203,7 +1254,7 @@ static int sony_nc_add(struct acpi_device *device)
 
 	if (debug) {
 		status = acpi_walk_namespace(ACPI_TYPE_METHOD, sony_nc_acpi_handle,
-					     1, sony_walk_callback, NULL, NULL);
+					     1, sony_walk_callback, NULL, NULL, NULL);
 		if (ACPI_FAILURE(status)) {
 			printk(KERN_WARNING DRV_PFX "unable to walk acpi resources\n");
 			result = -ENODEV;
@@ -2079,7 +2130,7 @@ static struct attribute_group spic_attribute_group = {
 
 struct sonypi_compat_s {
 	struct fasync_struct	*fifo_async;
-	struct kfifo		*fifo;
+	struct kfifo		fifo;
 	spinlock_t		fifo_lock;
 	wait_queue_head_t	fifo_proc_list;
 	atomic_t		open_count;
@@ -2104,12 +2155,12 @@ static int sonypi_misc_open(struct inode *inode, struct file *file)
 	/* Flush input queue on first open */
 	unsigned long flags;
 
-	spin_lock_irqsave(sonypi_compat.fifo->lock, flags);
+	spin_lock_irqsave(&sonypi_compat.fifo_lock, flags);
 
 	if (atomic_inc_return(&sonypi_compat.open_count) == 1)
-		__kfifo_reset(sonypi_compat.fifo);
+		kfifo_reset(&sonypi_compat.fifo);
 
-	spin_unlock_irqrestore(sonypi_compat.fifo->lock, flags);
+	spin_unlock_irqrestore(&sonypi_compat.fifo_lock, flags);
 
 	return 0;
 }
@@ -2120,17 +2171,18 @@ static ssize_t sonypi_misc_read(struct file *file, char __user *buf,
 	ssize_t ret;
 	unsigned char c;
 
-	if ((kfifo_len(sonypi_compat.fifo) == 0) &&
+	if ((kfifo_len(&sonypi_compat.fifo) == 0) &&
 	    (file->f_flags & O_NONBLOCK))
 		return -EAGAIN;
 
 	ret = wait_event_interruptible(sonypi_compat.fifo_proc_list,
-				       kfifo_len(sonypi_compat.fifo) != 0);
+				       kfifo_len(&sonypi_compat.fifo) != 0);
 	if (ret)
 		return ret;
 
 	while (ret < count &&
-	       (kfifo_get(sonypi_compat.fifo, &c, sizeof(c)) == sizeof(c))) {
+	       (kfifo_out_locked(&sonypi_compat.fifo, &c, sizeof(c),
+			  &sonypi_compat.fifo_lock) == sizeof(c))) {
 		if (put_user(c, buf++))
 			return -EFAULT;
 		ret++;
@@ -2147,7 +2199,7 @@ static ssize_t sonypi_misc_read(struct file *file, char __user *buf,
 static unsigned int sonypi_misc_poll(struct file *file, poll_table *wait)
 {
 	poll_wait(file, &sonypi_compat.fifo_proc_list, wait);
-	if (kfifo_len(sonypi_compat.fifo))
+	if (kfifo_len(&sonypi_compat.fifo))
 		return POLLIN | POLLRDNORM;
 	return 0;
 }
@@ -2309,7 +2361,8 @@ static struct miscdevice sonypi_misc_device = {
 
 static void sonypi_compat_report_event(u8 event)
 {
-	kfifo_put(sonypi_compat.fifo, (unsigned char *)&event, sizeof(event));
+	kfifo_in_locked(&sonypi_compat.fifo, (unsigned char *)&event,
+			sizeof(event), &sonypi_compat.fifo_lock);
 	kill_fasync(&sonypi_compat.fifo_async, SIGIO, POLL_IN);
 	wake_up_interruptible(&sonypi_compat.fifo_proc_list);
 }
@@ -2319,11 +2372,11 @@ static int sonypi_compat_init(void)
 	int error;
 
 	spin_lock_init(&sonypi_compat.fifo_lock);
-	sonypi_compat.fifo = kfifo_alloc(SONY_LAPTOP_BUF_SIZE, GFP_KERNEL,
-					 &sonypi_compat.fifo_lock);
-	if (IS_ERR(sonypi_compat.fifo)) {
+	error =
+	 kfifo_alloc(&sonypi_compat.fifo, SONY_LAPTOP_BUF_SIZE, GFP_KERNEL);
+	if (error) {
 		printk(KERN_ERR DRV_PFX "kfifo_alloc failed\n");
-		return PTR_ERR(sonypi_compat.fifo);
+		return error;
 	}
 
 	init_waitqueue_head(&sonypi_compat.fifo_proc_list);
@@ -2342,14 +2395,14 @@ static int sonypi_compat_init(void)
 	return 0;
 
 err_free_kfifo:
-	kfifo_free(sonypi_compat.fifo);
+	kfifo_free(&sonypi_compat.fifo);
 	return error;
 }
 
 static void sonypi_compat_exit(void)
 {
 	misc_deregister(&sonypi_misc_device);
-	kfifo_free(sonypi_compat.fifo);
+	kfifo_free(&sonypi_compat.fifo);
 }
 #else
 static int sonypi_compat_init(void) { return 0; }
diff --git a/drivers/platform/x86/tc1100-wmi.c b/drivers/platform/x86/tc1100-wmi.c
index 44166003d4ef..dd33b51c3486 100644
--- a/drivers/platform/x86/tc1100-wmi.c
+++ b/drivers/platform/x86/tc1100-wmi.c
@@ -47,22 +47,6 @@ MODULE_DESCRIPTION("HP Compaq TC1100 Tablet WMI Extras");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("wmi:C364AC71-36DB-495A-8494-B439D472A505");
 
-static int tc1100_probe(struct platform_device *device);
-static int tc1100_remove(struct platform_device *device);
-static int tc1100_suspend(struct platform_device *device, pm_message_t state);
-static int tc1100_resume(struct platform_device *device);
-
-static struct platform_driver tc1100_driver = {
-	.driver = {
-		.name = "tc1100-wmi",
-		.owner = THIS_MODULE,
-	},
-	.probe = tc1100_probe,
-	.remove = tc1100_remove,
-	.suspend = tc1100_suspend,
-	.resume = tc1100_resume,
-};
-
 static struct platform_device *tc1100_device;
 
 struct tc1100_data {
@@ -183,51 +167,35 @@ static DEVICE_ATTR(value, S_IWUGO | S_IRUGO | S_IWUSR, \
 show_set_bool(wireless, TC1100_INSTANCE_WIRELESS);
 show_set_bool(jogdial, TC1100_INSTANCE_JOGDIAL);
 
-static void remove_fs(void)
-{
-	device_remove_file(&tc1100_device->dev, &dev_attr_wireless);
-	device_remove_file(&tc1100_device->dev, &dev_attr_jogdial);
-}
-
-static int add_fs(void)
-{
-	int ret;
-
-	ret = device_create_file(&tc1100_device->dev, &dev_attr_wireless);
-	if (ret)
-		goto add_sysfs_error;
-
-	ret = device_create_file(&tc1100_device->dev, &dev_attr_jogdial);
-	if (ret)
-		goto add_sysfs_error;
-
-	return ret;
+static struct attribute *tc1100_attributes[] = {
+	&dev_attr_wireless.attr,
+	&dev_attr_jogdial.attr,
+	NULL
+};
 
-add_sysfs_error:
-	remove_fs();
-	return ret;
-}
+static struct attribute_group tc1100_attribute_group = {
+	.attrs	= tc1100_attributes,
+};
 
 /* --------------------------------------------------------------------------
 				Driver Model
    -------------------------------------------------------------------------- */
 
-static int tc1100_probe(struct platform_device *device)
+static int __init tc1100_probe(struct platform_device *device)
 {
-	int result = 0;
-
-	result = add_fs();
-	return result;
+	return sysfs_create_group(&device->dev.kobj, &tc1100_attribute_group);
 }
 
 
-static int tc1100_remove(struct platform_device *device)
+static int __devexit tc1100_remove(struct platform_device *device)
 {
-	remove_fs();
+	sysfs_remove_group(&device->dev.kobj, &tc1100_attribute_group);
+
 	return 0;
 }
 
-static int tc1100_suspend(struct platform_device *dev, pm_message_t state)
+#ifdef CONFIG_PM
+static int tc1100_suspend(struct device *dev)
 {
 	int ret;
 
@@ -239,10 +207,10 @@ static int tc1100_suspend(struct platform_device *dev, pm_message_t state)
 	if (ret)
 		return ret;
 
-	return ret;
+	return 0;
 }
 
-static int tc1100_resume(struct platform_device *dev)
+static int tc1100_resume(struct device *dev)
 {
 	int ret;
 
@@ -254,34 +222,61 @@ static int tc1100_resume(struct platform_device *dev)
 	if (ret)
 		return ret;
 
-	return ret;
+	return 0;
 }
 
+static const struct dev_pm_ops tc1100_pm_ops = {
+	.suspend	= tc1100_suspend,
+	.resume		= tc1100_resume,
+	.freeze		= tc1100_suspend,
+	.restore	= tc1100_resume,
+};
+#endif
+
+static struct platform_driver tc1100_driver = {
+	.driver = {
+		.name = "tc1100-wmi",
+		.owner = THIS_MODULE,
+#ifdef CONFIG_PM
+		.pm = &tc1100_pm_ops,
+#endif
+	},
+	.remove = __devexit_p(tc1100_remove),
+};
+
 static int __init tc1100_init(void)
 {
-	int result = 0;
+	int error;
 
 	if (!wmi_has_guid(GUID))
 		return -ENODEV;
 
-	result = platform_driver_register(&tc1100_driver);
-	if (result)
-		return result;
-
 	tc1100_device = platform_device_alloc("tc1100-wmi", -1);
-	platform_device_add(tc1100_device);
+	if (!tc1100_device)
+		return -ENOMEM;
+
+	error = platform_device_add(tc1100_device);
+	if (error)
+		goto err_device_put;
+
+	error = platform_driver_probe(&tc1100_driver, tc1100_probe);
+	if (error)
+		goto err_device_del;
 
 	printk(TC1100_INFO "HP Compaq TC1100 Tablet WMI Extras loaded\n");
+	return 0;
 
-	return result;
+ err_device_del:
+	platform_device_del(tc1100_device);
+ err_device_put:
+	platform_device_put(tc1100_device);
+	return error;
 }
 
 static void __exit tc1100_exit(void)
 {
-	platform_device_del(tc1100_device);
+	platform_device_unregister(tc1100_device);
 	platform_driver_unregister(&tc1100_driver);
-
-	printk(TC1100_INFO "HP Compaq TC1100 Tablet WMI Extras unloaded\n");
 }
 
 module_init(tc1100_init);
diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
index a848c7e20aeb..e67e4feb35cb 100644
--- a/drivers/platform/x86/thinkpad_acpi.c
+++ b/drivers/platform/x86/thinkpad_acpi.c
@@ -21,8 +21,8 @@
  *  02110-1301, USA.
  */
 
-#define TPACPI_VERSION "0.23"
-#define TPACPI_SYSFS_VERSION 0x020500
+#define TPACPI_VERSION "0.24"
+#define TPACPI_SYSFS_VERSION 0x020700
 
 /*
  *  Changelog:
@@ -61,6 +61,7 @@
 
 #include <linux/nvram.h>
 #include <linux/proc_fs.h>
+#include <linux/seq_file.h>
 #include <linux/sysfs.h>
 #include <linux/backlight.h>
 #include <linux/fb.h>
@@ -76,6 +77,10 @@
 #include <linux/jiffies.h>
 #include <linux/workqueue.h>
 
+#include <sound/core.h>
+#include <sound/control.h>
+#include <sound/initval.h>
+
 #include <acpi/acpi_drivers.h>
 
 #include <linux/pci_ids.h>
@@ -231,6 +236,7 @@ enum tpacpi_hkey_event_t {
 #define TPACPI_DBG_HKEY		0x0008
 #define TPACPI_DBG_FAN		0x0010
 #define TPACPI_DBG_BRGHT	0x0020
+#define TPACPI_DBG_MIXER	0x0040
 
 #define onoff(status, bit) ((status) & (1 << (bit)) ? "on" : "off")
 #define enabled(status, bit) ((status) & (1 << (bit)) ? "enabled" : "disabled")
@@ -256,7 +262,7 @@ struct tp_acpi_drv_struct {
 struct ibm_struct {
 	char *name;
 
-	int (*read) (char *);
+	int (*read) (struct seq_file *);
 	int (*write) (char *);
 	void (*exit) (void);
 	void (*resume) (void);
@@ -298,6 +304,7 @@ static struct {
 	u32 fan_ctrl_status_undef:1;
 	u32 second_fan:1;
 	u32 beep_needs_two_args:1;
+	u32 mixer_no_level_control:1;
 	u32 input_device_registered:1;
 	u32 platform_drv_registered:1;
 	u32 platform_drv_attrs_registered:1;
@@ -309,6 +316,7 @@ static struct {
 
 static struct {
 	u16 hotkey_mask_ff:1;
+	u16 volume_ctrl_forbidden:1;
 } tp_warned;
 
 struct thinkpad_id_data {
@@ -425,6 +433,12 @@ static void tpacpi_log_usertask(const char * const what)
 	  .ec = TPACPI_MATCH_ANY,		\
 	  .quirks = (__quirk) }
 
+#define TPACPI_QEC_LNV(__id1, __id2, __quirk)	\
+	{ .vendor = PCI_VENDOR_ID_LENOVO,	\
+	  .bios = TPACPI_MATCH_ANY,		\
+	  .ec = TPID(__id1, __id2),		\
+	  .quirks = (__quirk) }
+
 struct tpacpi_quirk {
 	unsigned int vendor;
 	u16 bios;
@@ -776,36 +790,25 @@ static int __init register_tpacpi_subdriver(struct ibm_struct *ibm)
  ****************************************************************************
  ****************************************************************************/
 
-static int dispatch_procfs_read(char *page, char **start, off_t off,
-			int count, int *eof, void *data)
+static int dispatch_proc_show(struct seq_file *m, void *v)
 {
-	struct ibm_struct *ibm = data;
-	int len;
+	struct ibm_struct *ibm = m->private;
 
 	if (!ibm || !ibm->read)
 		return -EINVAL;
+	return ibm->read(m);
+}
 
-	len = ibm->read(page);
-	if (len < 0)
-		return len;
-
-	if (len <= off + count)
-		*eof = 1;
-	*start = page + off;
-	len -= off;
-	if (len > count)
-		len = count;
-	if (len < 0)
-		len = 0;
-
-	return len;
+static int dispatch_proc_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, dispatch_proc_show, PDE(inode)->data);
 }
 
-static int dispatch_procfs_write(struct file *file,
+static ssize_t dispatch_proc_write(struct file *file,
 			const char __user *userbuf,
-			unsigned long count, void *data)
+			size_t count, loff_t *pos)
 {
-	struct ibm_struct *ibm = data;
+	struct ibm_struct *ibm = PDE(file->f_path.dentry->d_inode)->data;
 	char *kernbuf;
 	int ret;
 
@@ -834,6 +837,15 @@ static int dispatch_procfs_write(struct file *file,
 	return ret;
 }
 
+static const struct file_operations dispatch_proc_fops = {
+	.owner		= THIS_MODULE,
+	.open		= dispatch_proc_open,
+	.read		= seq_read,
+	.llseek		= seq_lseek,
+	.release	= single_release,
+	.write		= dispatch_proc_write,
+};
+
 static char *next_cmd(char **cmds)
 {
 	char *start = *cmds;
@@ -1006,11 +1018,8 @@ static int parse_strtoul(const char *buf,
 {
 	char *endp;
 
-	while (*buf && isspace(*buf))
-		buf++;
-	*value = simple_strtoul(buf, &endp, 0);
-	while (*endp && isspace(*endp))
-		endp++;
+	*value = simple_strtoul(skip_spaces(buf), &endp, 0);
+	endp = skip_spaces(endp);
 	if (*endp || *value > max)
 		return -EINVAL;
 
@@ -1087,7 +1096,7 @@ static int __init tpacpi_check_std_acpi_brightness_support(void)
 	 */
 
 	status = acpi_walk_namespace(ACPI_TYPE_METHOD, vid_handle, 3,
-				     tpacpi_acpi_walk_find_bcl, NULL,
+				     tpacpi_acpi_walk_find_bcl, NULL, NULL,
 				     &bcl_ptr);
 
 	if (ACPI_SUCCESS(status) && bcl_levels > 2) {
@@ -1264,6 +1273,7 @@ static int __init tpacpi_new_rfkill(const enum tpacpi_rfk_id id,
 	struct tpacpi_rfk *atp_rfk;
 	int res;
 	bool sw_state = false;
+	bool hw_state;
 	int sw_status;
 
 	BUG_ON(id >= TPACPI_RFK_SW_MAX || tpacpi_rfkill_switches[id]);
@@ -1298,7 +1308,8 @@ static int __init tpacpi_new_rfkill(const enum tpacpi_rfk_id id,
 			rfkill_init_sw_state(atp_rfk->rfkill, sw_state);
 		}
 	}
-	rfkill_set_hw_state(atp_rfk->rfkill, tpacpi_rfk_check_hwblock_state());
+	hw_state = tpacpi_rfk_check_hwblock_state();
+	rfkill_set_hw_state(atp_rfk->rfkill, hw_state);
 
 	res = rfkill_register(atp_rfk->rfkill);
 	if (res < 0) {
@@ -1311,6 +1322,9 @@ static int __init tpacpi_new_rfkill(const enum tpacpi_rfk_id id,
 	}
 
 	tpacpi_rfkill_switches[id] = atp_rfk;
+
+	printk(TPACPI_INFO "rfkill switch %s: radio is %sblocked\n",
+		name, (sw_state || hw_state) ? "" : "un");
 	return 0;
 }
 
@@ -1383,12 +1397,10 @@ static ssize_t tpacpi_rfk_sysfs_enable_store(const enum tpacpi_rfk_id id,
 }
 
 /* procfs -------------------------------------------------------------- */
-static int tpacpi_rfk_procfs_read(const enum tpacpi_rfk_id id, char *p)
+static int tpacpi_rfk_procfs_read(const enum tpacpi_rfk_id id, struct seq_file *m)
 {
-	int len = 0;
-
 	if (id >= TPACPI_RFK_SW_MAX)
-		len += sprintf(p + len, "status:\t\tnot supported\n");
+		seq_printf(m, "status:\t\tnot supported\n");
 	else {
 		int status;
 
@@ -1402,13 +1414,13 @@ static int tpacpi_rfk_procfs_read(const enum tpacpi_rfk_id id, char *p)
 				return status;
 		}
 
-		len += sprintf(p + len, "status:\t\t%s\n",
+		seq_printf(m, "status:\t\t%s\n",
 				(status == TPACPI_RFK_RADIO_ON) ?
 					"enabled" : "disabled");
-		len += sprintf(p + len, "commands:\tenable, disable\n");
+		seq_printf(m, "commands:\tenable, disable\n");
 	}
 
-	return len;
+	return 0;
 }
 
 static int tpacpi_rfk_procfs_write(const enum tpacpi_rfk_id id, char *buf)
@@ -1779,7 +1791,7 @@ static const struct tpacpi_quirk tpacpi_bios_version_qtable[] __initconst = {
 
 	TPV_QL1('7', '9',  'E', '3',  '5', '0'), /* T60/p */
 	TPV_QL1('7', 'C',  'D', '2',  '2', '2'), /* R60, R60i */
-	TPV_QL0('7', 'E',  'D', '0'),		 /* R60e, R60i */
+	TPV_QL1('7', 'E',  'D', '0',  '1', '5'), /* R60e, R60i */
 
 	/*      BIOS FW    BIOS VERS  EC FW     EC VERS */
 	TPV_QI2('1', 'W',  '9', '0',  '1', 'V', '2', '8'), /* R50e (1) */
@@ -1795,8 +1807,8 @@ static const struct tpacpi_quirk tpacpi_bios_version_qtable[] __initconst = {
 	TPV_QI1('7', '4',  '6', '4',  '2', '7'), /* X41 (0) */
 	TPV_QI1('7', '5',  '6', '0',  '2', '0'), /* X41t (0) */
 
-	TPV_QL0('7', 'B',  'D', '7'),		 /* X60/s */
-	TPV_QL0('7', 'J',  '3', '0'),		 /* X60t */
+	TPV_QL1('7', 'B',  'D', '7',  '4', '0'), /* X60/s */
+	TPV_QL1('7', 'J',  '3', '0',  '1', '3'), /* X60t */
 
 	/* (0) - older versions lack DMI EC fw string and functionality */
 	/* (1) - older versions known to lack functionality */
@@ -1886,14 +1898,11 @@ static int __init thinkpad_acpi_driver_init(struct ibm_init_struct *iibm)
 	return 0;
 }
 
-static int thinkpad_acpi_driver_read(char *p)
+static int thinkpad_acpi_driver_read(struct seq_file *m)
 {
-	int len = 0;
-
-	len += sprintf(p + len, "driver:\t\t%s\n", TPACPI_DESC);
-	len += sprintf(p + len, "version:\t%s\n", TPACPI_VERSION);
-
-	return len;
+	seq_printf(m, "driver:\t\t%s\n", TPACPI_DESC);
+	seq_printf(m, "version:\t%s\n", TPACPI_VERSION);
+	return 0;
 }
 
 static struct ibm_struct thinkpad_acpi_driver_data = {
@@ -2189,7 +2198,8 @@ static int hotkey_mask_set(u32 mask)
 		       fwmask, hotkey_acpi_mask);
 	}
 
-	hotkey_mask_warn_incomplete_mask();
+	if (tpacpi_lifecycle != TPACPI_LIFE_EXITING)
+		hotkey_mask_warn_incomplete_mask();
 
 	return rc;
 }
@@ -3185,6 +3195,8 @@ static int __init hotkey_init(struct ibm_init_struct *iibm)
 	int res, i;
 	int status;
 	int hkeyv;
+	bool radiosw_state  = false;
+	bool tabletsw_state = false;
 
 	unsigned long quirks;
 
@@ -3290,6 +3302,7 @@ static int __init hotkey_init(struct ibm_init_struct *iibm)
 #ifdef CONFIG_THINKPAD_ACPI_DEBUGFACILITIES
 	if (dbg_wlswemul) {
 		tp_features.hotkey_wlsw = 1;
+		radiosw_state = !!tpacpi_wlsw_emulstate;
 		printk(TPACPI_INFO
 			"radio switch emulation enabled\n");
 	} else
@@ -3297,6 +3310,7 @@ static int __init hotkey_init(struct ibm_init_struct *iibm)
 	/* Not all thinkpads have a hardware radio switch */
 	if (acpi_evalf(hkey_handle, &status, "WLSW", "qd")) {
 		tp_features.hotkey_wlsw = 1;
+		radiosw_state = !!status;
 		printk(TPACPI_INFO
 			"radio switch found; radios are %s\n",
 			enabled(status, 0));
@@ -3308,11 +3322,11 @@ static int __init hotkey_init(struct ibm_init_struct *iibm)
 	/* For X41t, X60t, X61t Tablets... */
 	if (!res && acpi_evalf(hkey_handle, &status, "MHKG", "qd")) {
 		tp_features.hotkey_tablet = 1;
+		tabletsw_state = !!(status & TP_HOTKEY_TABLET_MASK);
 		printk(TPACPI_INFO
 			"possible tablet mode switch found; "
 			"ThinkPad in %s mode\n",
-			(status & TP_HOTKEY_TABLET_MASK)?
-				"tablet" : "laptop");
+			(tabletsw_state) ? "tablet" : "laptop");
 		res = add_to_attr_set(hotkey_dev_attributes,
 				&dev_attr_hotkey_tablet_mode.attr);
 	}
@@ -3347,16 +3361,14 @@ static int __init hotkey_init(struct ibm_init_struct *iibm)
 			TPACPI_HOTKEY_MAP_SIZE);
 	}
 
-	set_bit(EV_KEY, tpacpi_inputdev->evbit);
-	set_bit(EV_MSC, tpacpi_inputdev->evbit);
-	set_bit(MSC_SCAN, tpacpi_inputdev->mscbit);
+	input_set_capability(tpacpi_inputdev, EV_MSC, MSC_SCAN);
 	tpacpi_inputdev->keycodesize = TPACPI_HOTKEY_MAP_TYPESIZE;
 	tpacpi_inputdev->keycodemax = TPACPI_HOTKEY_MAP_LEN;
 	tpacpi_inputdev->keycode = hotkey_keycode_map;
 	for (i = 0; i < TPACPI_HOTKEY_MAP_LEN; i++) {
 		if (hotkey_keycode_map[i] != KEY_RESERVED) {
-			set_bit(hotkey_keycode_map[i],
-				tpacpi_inputdev->keybit);
+			input_set_capability(tpacpi_inputdev, EV_KEY,
+						hotkey_keycode_map[i]);
 		} else {
 			if (i < sizeof(hotkey_reserved_mask)*8)
 				hotkey_reserved_mask |= 1 << i;
@@ -3364,12 +3376,14 @@ static int __init hotkey_init(struct ibm_init_struct *iibm)
 	}
 
 	if (tp_features.hotkey_wlsw) {
-		set_bit(EV_SW, tpacpi_inputdev->evbit);
-		set_bit(SW_RFKILL_ALL, tpacpi_inputdev->swbit);
+		input_set_capability(tpacpi_inputdev, EV_SW, SW_RFKILL_ALL);
+		input_report_switch(tpacpi_inputdev,
+				    SW_RFKILL_ALL, radiosw_state);
 	}
 	if (tp_features.hotkey_tablet) {
-		set_bit(EV_SW, tpacpi_inputdev->evbit);
-		set_bit(SW_TABLET_MODE, tpacpi_inputdev->swbit);
+		input_set_capability(tpacpi_inputdev, EV_SW, SW_TABLET_MODE);
+		input_report_switch(tpacpi_inputdev,
+				    SW_TABLET_MODE, tabletsw_state);
 	}
 
 	/* Do not issue duplicate brightness change events to
@@ -3436,8 +3450,6 @@ static int __init hotkey_init(struct ibm_init_struct *iibm)
 	tpacpi_inputdev->close = &hotkey_inputdev_close;
 
 	hotkey_poll_setup_safe(true);
-	tpacpi_send_radiosw_update();
-	tpacpi_input_send_tabletsw();
 
 	return 0;
 
@@ -3545,49 +3557,57 @@ static bool hotkey_notify_usrevent(const u32 hkey,
 	}
 }
 
+static void thermal_dump_all_sensors(void);
+
 static bool hotkey_notify_thermal(const u32 hkey,
 				 bool *send_acpi_ev,
 				 bool *ignore_acpi_ev)
 {
+	bool known = true;
+
 	/* 0x6000-0x6FFF: thermal alarms */
 	*send_acpi_ev = true;
 	*ignore_acpi_ev = false;
 
 	switch (hkey) {
+	case TP_HKEY_EV_THM_TABLE_CHANGED:
+		printk(TPACPI_INFO
+			"EC reports that Thermal Table has changed\n");
+		/* recommended action: do nothing, we don't have
+		 * Lenovo ATM information */
+		return true;
 	case TP_HKEY_EV_ALARM_BAT_HOT:
 		printk(TPACPI_CRIT
 			"THERMAL ALARM: battery is too hot!\n");
 		/* recommended action: warn user through gui */
-		return true;
+		break;
 	case TP_HKEY_EV_ALARM_BAT_XHOT:
 		printk(TPACPI_ALERT
 			"THERMAL EMERGENCY: battery is extremely hot!\n");
 		/* recommended action: immediate sleep/hibernate */
-		return true;
+		break;
 	case TP_HKEY_EV_ALARM_SENSOR_HOT:
 		printk(TPACPI_CRIT
 			"THERMAL ALARM: "
 			"a sensor reports something is too hot!\n");
 		/* recommended action: warn user through gui, that */
 		/* some internal component is too hot */
-		return true;
+		break;
 	case TP_HKEY_EV_ALARM_SENSOR_XHOT:
 		printk(TPACPI_ALERT
 			"THERMAL EMERGENCY: "
 			"a sensor reports something is extremely hot!\n");
 		/* recommended action: immediate sleep/hibernate */
-		return true;
-	case TP_HKEY_EV_THM_TABLE_CHANGED:
-		printk(TPACPI_INFO
-			"EC reports that Thermal Table has changed\n");
-		/* recommended action: do nothing, we don't have
-		 * Lenovo ATM information */
-		return true;
+		break;
 	default:
 		printk(TPACPI_ALERT
 			 "THERMAL ALERT: unknown thermal alarm received\n");
-		return false;
+		known = false;
 	}
+
+	thermal_dump_all_sensors();
+
+	return known;
 }
 
 static void hotkey_notify(struct ibm_struct *ibm, u32 event)
@@ -3730,14 +3750,13 @@ static void hotkey_resume(void)
 }
 
 /* procfs -------------------------------------------------------------- */
-static int hotkey_read(char *p)
+static int hotkey_read(struct seq_file *m)
 {
 	int res, status;
-	int len = 0;
 
 	if (!tp_features.hotkey) {
-		len += sprintf(p + len, "status:\t\tnot supported\n");
-		return len;
+		seq_printf(m, "status:\t\tnot supported\n");
+		return 0;
 	}
 
 	if (mutex_lock_killable(&hotkey_mutex))
@@ -3749,17 +3768,16 @@ static int hotkey_read(char *p)
 	if (res)
 		return res;
 
-	len += sprintf(p + len, "status:\t\t%s\n", enabled(status, 0));
+	seq_printf(m, "status:\t\t%s\n", enabled(status, 0));
 	if (hotkey_all_mask) {
-		len += sprintf(p + len, "mask:\t\t0x%08x\n", hotkey_user_mask);
-		len += sprintf(p + len,
-			       "commands:\tenable, disable, reset, <mask>\n");
+		seq_printf(m, "mask:\t\t0x%08x\n", hotkey_user_mask);
+		seq_printf(m, "commands:\tenable, disable, reset, <mask>\n");
 	} else {
-		len += sprintf(p + len, "mask:\t\tnot supported\n");
-		len += sprintf(p + len, "commands:\tenable, disable, reset\n");
+		seq_printf(m, "mask:\t\tnot supported\n");
+		seq_printf(m, "commands:\tenable, disable, reset\n");
 	}
 
-	return len;
+	return 0;
 }
 
 static void hotkey_enabledisable_warn(bool enable)
@@ -3866,15 +3884,6 @@ enum {
 
 #define TPACPI_RFK_BLUETOOTH_SW_NAME	"tpacpi_bluetooth_sw"
 
-static void bluetooth_suspend(pm_message_t state)
-{
-	/* Try to make sure radio will resume powered off */
-	if (!acpi_evalf(NULL, NULL, "\\BLTH", "vd",
-		   TP_ACPI_BLTH_PWR_OFF_ON_RESUME))
-		vdbg_printk(TPACPI_DBG_RFKILL,
-			"bluetooth power down on resume request failed\n");
-}
-
 static int bluetooth_get_status(void)
 {
 	int status;
@@ -3908,10 +3917,9 @@ static int bluetooth_set_status(enum tpacpi_rfkill_state state)
 #endif
 
 	/* We make sure to keep TP_ACPI_BLUETOOTH_RESUMECTRL off */
+	status = TP_ACPI_BLUETOOTH_RESUMECTRL;
 	if (state == TPACPI_RFK_RADIO_ON)
-		status = TP_ACPI_BLUETOOTH_RADIOSSW;
-	else
-		status = 0;
+		status |= TP_ACPI_BLUETOOTH_RADIOSSW;
 
 	if (!acpi_evalf(hkey_handle, NULL, "SBDC", "vd", status))
 		return -EIO;
@@ -4035,9 +4043,9 @@ static int __init bluetooth_init(struct ibm_init_struct *iibm)
 }
 
 /* procfs -------------------------------------------------------------- */
-static int bluetooth_read(char *p)
+static int bluetooth_read(struct seq_file *m)
 {
-	return tpacpi_rfk_procfs_read(TPACPI_RFK_BLUETOOTH_SW_ID, p);
+	return tpacpi_rfk_procfs_read(TPACPI_RFK_BLUETOOTH_SW_ID, m);
 }
 
 static int bluetooth_write(char *buf)
@@ -4050,7 +4058,6 @@ static struct ibm_struct bluetooth_driver_data = {
 	.read = bluetooth_read,
 	.write = bluetooth_write,
 	.exit = bluetooth_exit,
-	.suspend = bluetooth_suspend,
 	.shutdown = bluetooth_shutdown,
 };
 
@@ -4068,15 +4075,6 @@ enum {
 
 #define TPACPI_RFK_WWAN_SW_NAME		"tpacpi_wwan_sw"
 
-static void wan_suspend(pm_message_t state)
-{
-	/* Try to make sure radio will resume powered off */
-	if (!acpi_evalf(NULL, NULL, "\\WGSV", "qvd",
-		   TP_ACPI_WGSV_PWR_OFF_ON_RESUME))
-		vdbg_printk(TPACPI_DBG_RFKILL,
-			"WWAN power down on resume request failed\n");
-}
-
 static int wan_get_status(void)
 {
 	int status;
@@ -4109,11 +4107,10 @@ static int wan_set_status(enum tpacpi_rfkill_state state)
 	}
 #endif
 
-	/* We make sure to keep TP_ACPI_WANCARD_RESUMECTRL off */
+	/* We make sure to set TP_ACPI_WANCARD_RESUMECTRL */
+	status = TP_ACPI_WANCARD_RESUMECTRL;
 	if (state == TPACPI_RFK_RADIO_ON)
-		status = TP_ACPI_WANCARD_RADIOSSW;
-	else
-		status = 0;
+		status |= TP_ACPI_WANCARD_RADIOSSW;
 
 	if (!acpi_evalf(hkey_handle, NULL, "SWAN", "vd", status))
 		return -EIO;
@@ -4236,9 +4233,9 @@ static int __init wan_init(struct ibm_init_struct *iibm)
 }
 
 /* procfs -------------------------------------------------------------- */
-static int wan_read(char *p)
+static int wan_read(struct seq_file *m)
 {
-	return tpacpi_rfk_procfs_read(TPACPI_RFK_WWAN_SW_ID, p);
+	return tpacpi_rfk_procfs_read(TPACPI_RFK_WWAN_SW_ID, m);
 }
 
 static int wan_write(char *buf)
@@ -4251,7 +4248,6 @@ static struct ibm_struct wan_driver_data = {
 	.read = wan_read,
 	.write = wan_write,
 	.exit = wan_exit,
-	.suspend = wan_suspend,
 	.shutdown = wan_shutdown,
 };
 
@@ -4614,14 +4610,13 @@ static int video_expand_toggle(void)
 	/* not reached */
 }
 
-static int video_read(char *p)
+static int video_read(struct seq_file *m)
 {
 	int status, autosw;
-	int len = 0;
 
 	if (video_supported == TPACPI_VIDEO_NONE) {
-		len += sprintf(p + len, "status:\t\tnot supported\n");
-		return len;
+		seq_printf(m, "status:\t\tnot supported\n");
+		return 0;
 	}
 
 	status = video_outputsw_get();
@@ -4632,20 +4627,20 @@ static int video_read(char *p)
 	if (autosw < 0)
 		return autosw;
 
-	len += sprintf(p + len, "status:\t\tsupported\n");
-	len += sprintf(p + len, "lcd:\t\t%s\n", enabled(status, 0));
-	len += sprintf(p + len, "crt:\t\t%s\n", enabled(status, 1));
+	seq_printf(m, "status:\t\tsupported\n");
+	seq_printf(m, "lcd:\t\t%s\n", enabled(status, 0));
+	seq_printf(m, "crt:\t\t%s\n", enabled(status, 1));
 	if (video_supported == TPACPI_VIDEO_NEW)
-		len += sprintf(p + len, "dvi:\t\t%s\n", enabled(status, 3));
-	len += sprintf(p + len, "auto:\t\t%s\n", enabled(autosw, 0));
-	len += sprintf(p + len, "commands:\tlcd_enable, lcd_disable\n");
-	len += sprintf(p + len, "commands:\tcrt_enable, crt_disable\n");
+		seq_printf(m, "dvi:\t\t%s\n", enabled(status, 3));
+	seq_printf(m, "auto:\t\t%s\n", enabled(autosw, 0));
+	seq_printf(m, "commands:\tlcd_enable, lcd_disable\n");
+	seq_printf(m, "commands:\tcrt_enable, crt_disable\n");
 	if (video_supported == TPACPI_VIDEO_NEW)
-		len += sprintf(p + len, "commands:\tdvi_enable, dvi_disable\n");
-	len += sprintf(p + len, "commands:\tauto_enable, auto_disable\n");
-	len += sprintf(p + len, "commands:\tvideo_switch, expand_toggle\n");
+		seq_printf(m, "commands:\tdvi_enable, dvi_disable\n");
+	seq_printf(m, "commands:\tauto_enable, auto_disable\n");
+	seq_printf(m, "commands:\tvideo_switch, expand_toggle\n");
 
-	return len;
+	return 0;
 }
 
 static int video_write(char *buf)
@@ -4837,25 +4832,24 @@ static void light_exit(void)
 		flush_workqueue(tpacpi_wq);
 }
 
-static int light_read(char *p)
+static int light_read(struct seq_file *m)
 {
-	int len = 0;
 	int status;
 
 	if (!tp_features.light) {
-		len += sprintf(p + len, "status:\t\tnot supported\n");
+		seq_printf(m, "status:\t\tnot supported\n");
 	} else if (!tp_features.light_status) {
-		len += sprintf(p + len, "status:\t\tunknown\n");
-		len += sprintf(p + len, "commands:\ton, off\n");
+		seq_printf(m, "status:\t\tunknown\n");
+		seq_printf(m, "commands:\ton, off\n");
 	} else {
 		status = light_get_status();
 		if (status < 0)
 			return status;
-		len += sprintf(p + len, "status:\t\t%s\n", onoff(status, 0));
-		len += sprintf(p + len, "commands:\ton, off\n");
+		seq_printf(m, "status:\t\t%s\n", onoff(status, 0));
+		seq_printf(m, "commands:\ton, off\n");
 	}
 
-	return len;
+	return 0;
 }
 
 static int light_write(char *buf)
@@ -4933,20 +4927,18 @@ static void cmos_exit(void)
 	device_remove_file(&tpacpi_pdev->dev, &dev_attr_cmos_command);
 }
 
-static int cmos_read(char *p)
+static int cmos_read(struct seq_file *m)
 {
-	int len = 0;
-
 	/* cmos not supported on 570, 600e/x, 770e, 770x, A21e, A2xm/p,
 	   R30, R31, T20-22, X20-21 */
 	if (!cmos_handle)
-		len += sprintf(p + len, "status:\t\tnot supported\n");
+		seq_printf(m, "status:\t\tnot supported\n");
 	else {
-		len += sprintf(p + len, "status:\t\tsupported\n");
-		len += sprintf(p + len, "commands:\t<cmd> (<cmd> is 0-21)\n");
+		seq_printf(m, "status:\t\tsupported\n");
+		seq_printf(m, "commands:\t<cmd> (<cmd> is 0-21)\n");
 	}
 
-	return len;
+	return 0;
 }
 
 static int cmos_write(char *buf)
@@ -5321,15 +5313,13 @@ static int __init led_init(struct ibm_init_struct *iibm)
 	((s) == TPACPI_LED_OFF ? "off" : \
 		((s) == TPACPI_LED_ON ? "on" : "blinking"))
 
-static int led_read(char *p)
+static int led_read(struct seq_file *m)
 {
-	int len = 0;
-
 	if (!led_supported) {
-		len += sprintf(p + len, "status:\t\tnot supported\n");
-		return len;
+		seq_printf(m, "status:\t\tnot supported\n");
+		return 0;
 	}
-	len += sprintf(p + len, "status:\t\tsupported\n");
+	seq_printf(m, "status:\t\tsupported\n");
 
 	if (led_supported == TPACPI_LED_570) {
 		/* 570 */
@@ -5338,15 +5328,15 @@ static int led_read(char *p)
 			status = led_get_status(i);
 			if (status < 0)
 				return -EIO;
-			len += sprintf(p + len, "%d:\t\t%s\n",
+			seq_printf(m, "%d:\t\t%s\n",
 				       i, str_led_status(status));
 		}
 	}
 
-	len += sprintf(p + len, "commands:\t"
+	seq_printf(m, "commands:\t"
 		       "<led> on, <led> off, <led> blink (<led> is 0-15)\n");
 
-	return len;
+	return 0;
 }
 
 static int led_write(char *buf)
@@ -5419,18 +5409,16 @@ static int __init beep_init(struct ibm_init_struct *iibm)
 	return (beep_handle)? 0 : 1;
 }
 
-static int beep_read(char *p)
+static int beep_read(struct seq_file *m)
 {
-	int len = 0;
-
 	if (!beep_handle)
-		len += sprintf(p + len, "status:\t\tnot supported\n");
+		seq_printf(m, "status:\t\tnot supported\n");
 	else {
-		len += sprintf(p + len, "status:\t\tsupported\n");
-		len += sprintf(p + len, "commands:\t<cmd> (<cmd> is 0-17)\n");
+		seq_printf(m, "status:\t\tsupported\n");
+		seq_printf(m, "commands:\t<cmd> (<cmd> is 0-17)\n");
 	}
 
-	return len;
+	return 0;
 }
 
 static int beep_write(char *buf)
@@ -5483,8 +5471,11 @@ enum { /* TPACPI_THERMAL_TPEC_* */
 	TP_EC_THERMAL_TMP0 = 0x78,	/* ACPI EC regs TMP 0..7 */
 	TP_EC_THERMAL_TMP8 = 0xC0,	/* ACPI EC regs TMP 8..15 */
 	TP_EC_THERMAL_TMP_NA = -128,	/* ACPI EC sensor not available */
+
+	TPACPI_THERMAL_SENSOR_NA = -128000, /* Sensor not available */
 };
 
+
 #define TPACPI_MAX_THERMAL_SENSORS 16	/* Max thermal sensors supported */
 struct ibm_thermal_sensors_struct {
 	s32 temp[TPACPI_MAX_THERMAL_SENSORS];
@@ -5574,6 +5565,28 @@ static int thermal_get_sensors(struct ibm_thermal_sensors_struct *s)
 	return n;
 }
 
+static void thermal_dump_all_sensors(void)
+{
+	int n, i;
+	struct ibm_thermal_sensors_struct t;
+
+	n = thermal_get_sensors(&t);
+	if (n <= 0)
+		return;
+
+	printk(TPACPI_NOTICE
+		"temperatures (Celsius):");
+
+	for (i = 0; i < n; i++) {
+		if (t.temp[i] != TPACPI_THERMAL_SENSOR_NA)
+			printk(KERN_CONT " %d", (int)(t.temp[i] / 1000));
+		else
+			printk(KERN_CONT " N/A");
+	}
+
+	printk(KERN_CONT "\n");
+}
+
 /* sysfs temp##_input -------------------------------------------------- */
 
 static ssize_t thermal_temp_input_show(struct device *dev,
@@ -5589,7 +5602,7 @@ static ssize_t thermal_temp_input_show(struct device *dev,
 	res = thermal_get_sensor(idx, &value);
 	if (res)
 		return res;
-	if (value == TP_EC_THERMAL_TMP_NA * 1000)
+	if (value == TPACPI_THERMAL_SENSOR_NA)
 		return -ENXIO;
 
 	return snprintf(buf, PAGE_SIZE, "%d\n", value);
@@ -5766,9 +5779,8 @@ static void thermal_exit(void)
 	}
 }
 
-static int thermal_read(char *p)
+static int thermal_read(struct seq_file *m)
 {
-	int len = 0;
 	int n, i;
 	struct ibm_thermal_sensors_struct t;
 
@@ -5776,16 +5788,16 @@ static int thermal_read(char *p)
 	if (unlikely(n < 0))
 		return n;
 
-	len += sprintf(p + len, "temperatures:\t");
+	seq_printf(m, "temperatures:\t");
 
 	if (n > 0) {
 		for (i = 0; i < (n - 1); i++)
-			len += sprintf(p + len, "%d ", t.temp[i] / 1000);
-		len += sprintf(p + len, "%d\n", t.temp[i] / 1000);
+			seq_printf(m, "%d ", t.temp[i] / 1000);
+		seq_printf(m, "%d\n", t.temp[i] / 1000);
 	} else
-		len += sprintf(p + len, "not supported\n");
+		seq_printf(m, "not supported\n");
 
-	return len;
+	return 0;
 }
 
 static struct ibm_struct thermal_driver_data = {
@@ -5800,39 +5812,38 @@ static struct ibm_struct thermal_driver_data = {
 
 static u8 ecdump_regs[256];
 
-static int ecdump_read(char *p)
+static int ecdump_read(struct seq_file *m)
 {
-	int len = 0;
 	int i, j;
 	u8 v;
 
-	len += sprintf(p + len, "EC      "
+	seq_printf(m, "EC      "
 		       " +00 +01 +02 +03 +04 +05 +06 +07"
 		       " +08 +09 +0a +0b +0c +0d +0e +0f\n");
 	for (i = 0; i < 256; i += 16) {
-		len += sprintf(p + len, "EC 0x%02x:", i);
+		seq_printf(m, "EC 0x%02x:", i);
 		for (j = 0; j < 16; j++) {
 			if (!acpi_ec_read(i + j, &v))
 				break;
 			if (v != ecdump_regs[i + j])
-				len += sprintf(p + len, " *%02x", v);
+				seq_printf(m, " *%02x", v);
 			else
-				len += sprintf(p + len, "  %02x", v);
+				seq_printf(m, "  %02x", v);
 			ecdump_regs[i + j] = v;
 		}
-		len += sprintf(p + len, "\n");
+		seq_putc(m, '\n');
 		if (j != 16)
 			break;
 	}
 
 	/* These are way too dangerous to advertise openly... */
 #if 0
-	len += sprintf(p + len, "commands:\t0x<offset> 0x<value>"
+	seq_printf(m, "commands:\t0x<offset> 0x<value>"
 		       " (<offset> is 00-ff, <value> is 00-ff)\n");
-	len += sprintf(p + len, "commands:\t0x<offset> <value>  "
+	seq_printf(m, "commands:\t0x<offset> <value>  "
 		       " (<offset> is 00-ff, <value> is 0-255)\n");
 #endif
-	return len;
+	return 0;
 }
 
 static int ecdump_write(char *buf)
@@ -6095,6 +6106,12 @@ static int brightness_get(struct backlight_device *bd)
 	return status & TP_EC_BACKLIGHT_LVLMSK;
 }
 
+static void tpacpi_brightness_notify_change(void)
+{
+	backlight_force_update(ibm_backlight_device,
+			       BACKLIGHT_UPDATE_HOTKEY);
+}
+
 static struct backlight_ops ibm_backlight_data = {
 	.get_brightness = brightness_get,
 	.update_status  = brightness_update_status,
@@ -6123,8 +6140,8 @@ static const struct tpacpi_quirk brightness_quirk_table[] __initconst = {
 
 	/* Models with Intel Extreme Graphics 2 */
 	TPACPI_Q_IBM('1', 'U', TPACPI_BRGHT_Q_NOEC),
-	TPACPI_Q_IBM('1', 'V', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_NOEC),
-	TPACPI_Q_IBM('1', 'W', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_NOEC),
+	TPACPI_Q_IBM('1', 'V', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_EC),
+	TPACPI_Q_IBM('1', 'W', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_EC),
 
 	/* Models with Intel GMA900 */
 	TPACPI_Q_IBM('7', '0', TPACPI_BRGHT_Q_NOEC),	/* T43, R52 */
@@ -6249,6 +6266,12 @@ static int __init brightness_init(struct ibm_init_struct *iibm)
 	ibm_backlight_device->props.brightness = b & TP_EC_BACKLIGHT_LVLMSK;
 	backlight_update_status(ibm_backlight_device);
 
+	vdbg_printk(TPACPI_DBG_INIT | TPACPI_DBG_BRGHT,
+			"brightness: registering brightness hotkeys "
+			"as change notification\n");
+	tpacpi_hotkey_driver_mask_set(hotkey_driver_mask
+				| TP_ACPI_HKEY_BRGHTUP_MASK
+				| TP_ACPI_HKEY_BRGHTDWN_MASK);;
 	return 0;
 }
 
@@ -6273,23 +6296,22 @@ static void brightness_exit(void)
 	tpacpi_brightness_checkpoint_nvram();
 }
 
-static int brightness_read(char *p)
+static int brightness_read(struct seq_file *m)
 {
-	int len = 0;
 	int level;
 
 	level = brightness_get(NULL);
 	if (level < 0) {
-		len += sprintf(p + len, "level:\t\tunreadable\n");
+		seq_printf(m, "level:\t\tunreadable\n");
 	} else {
-		len += sprintf(p + len, "level:\t\t%d\n", level);
-		len += sprintf(p + len, "commands:\tup, down\n");
-		len += sprintf(p + len, "commands:\tlevel <level>"
+		seq_printf(m, "level:\t\t%d\n", level);
+		seq_printf(m, "commands:\tup, down\n");
+		seq_printf(m, "commands:\tlevel <level>"
 			       " (<level> is 0-%d)\n",
 			       (tp_features.bright_16levels) ? 15 : 7);
 	}
 
-	return len;
+	return 0;
 }
 
 static int brightness_write(char *buf)
@@ -6325,6 +6347,9 @@ static int brightness_write(char *buf)
 	 * Doing it this way makes the syscall restartable in case of EINTR
 	 */
 	rc = brightness_set(level);
+	if (!rc && ibm_backlight_device)
+		backlight_force_update(ibm_backlight_device,
+					BACKLIGHT_UPDATE_SYSFS);
 	return (rc == -EINTR)? -ERESTARTSYS : rc;
 }
 
@@ -6341,101 +6366,685 @@ static struct ibm_struct brightness_driver_data = {
  * Volume subdriver
  */
 
-static int volume_offset = 0x30;
+/*
+ * IBM ThinkPads have a simple volume controller with MUTE gating.
+ * Very early Lenovo ThinkPads follow the IBM ThinkPad spec.
+ *
+ * Since the *61 series (and probably also the later *60 series), Lenovo
+ * ThinkPads only implement the MUTE gate.
+ *
+ * EC register 0x30
+ *   Bit 6: MUTE (1 mutes sound)
+ *   Bit 3-0: Volume
+ *   Other bits should be zero as far as we know.
+ *
+ * This is also stored in CMOS NVRAM, byte 0x60, bit 6 (MUTE), and
+ * bits 3-0 (volume).  Other bits in NVRAM may have other functions,
+ * such as bit 7 which is used to detect repeated presses of MUTE,
+ * and we leave them unchanged.
+ */
+
+#ifdef CONFIG_THINKPAD_ACPI_ALSA_SUPPORT
+
+#define TPACPI_ALSA_DRVNAME  "ThinkPad EC"
+#define TPACPI_ALSA_SHRTNAME "ThinkPad Console Audio Control"
+#define TPACPI_ALSA_MIXERNAME TPACPI_ALSA_SHRTNAME
+
+static int alsa_index = ~((1 << (SNDRV_CARDS - 3)) - 1); /* last three slots */
+static char *alsa_id = "ThinkPadEC";
+static int alsa_enable = SNDRV_DEFAULT_ENABLE1;
+
+struct tpacpi_alsa_data {
+	struct snd_card *card;
+	struct snd_ctl_elem_id *ctl_mute_id;
+	struct snd_ctl_elem_id *ctl_vol_id;
+};
 
-static int volume_read(char *p)
+static struct snd_card *alsa_card;
+
+enum {
+	TP_EC_AUDIO = 0x30,
+
+	/* TP_EC_AUDIO bits */
+	TP_EC_AUDIO_MUTESW = 6,
+
+	/* TP_EC_AUDIO bitmasks */
+	TP_EC_AUDIO_LVL_MSK = 0x0F,
+	TP_EC_AUDIO_MUTESW_MSK = (1 << TP_EC_AUDIO_MUTESW),
+
+	/* Maximum volume */
+	TP_EC_VOLUME_MAX = 14,
+};
+
+enum tpacpi_volume_access_mode {
+	TPACPI_VOL_MODE_AUTO = 0,	/* Not implemented yet */
+	TPACPI_VOL_MODE_EC,		/* Pure EC control */
+	TPACPI_VOL_MODE_UCMS_STEP,	/* UCMS step-based control: N/A */
+	TPACPI_VOL_MODE_ECNVRAM,	/* EC control w/ NVRAM store */
+	TPACPI_VOL_MODE_MAX
+};
+
+enum tpacpi_volume_capabilities {
+	TPACPI_VOL_CAP_AUTO = 0,	/* Use white/blacklist */
+	TPACPI_VOL_CAP_VOLMUTE,		/* Output vol and mute */
+	TPACPI_VOL_CAP_MUTEONLY,	/* Output mute only */
+	TPACPI_VOL_CAP_MAX
+};
+
+static enum tpacpi_volume_access_mode volume_mode =
+	TPACPI_VOL_MODE_MAX;
+
+static enum tpacpi_volume_capabilities volume_capabilities;
+static int volume_control_allowed;
+
+/*
+ * Used to syncronize writers to TP_EC_AUDIO and
+ * TP_NVRAM_ADDR_MIXER, as we need to do read-modify-write
+ */
+static struct mutex volume_mutex;
+
+static void tpacpi_volume_checkpoint_nvram(void)
 {
-	int len = 0;
-	u8 level;
+	u8 lec = 0;
+	u8 b_nvram;
+	u8 ec_mask;
 
-	if (!acpi_ec_read(volume_offset, &level)) {
-		len += sprintf(p + len, "level:\t\tunreadable\n");
+	if (volume_mode != TPACPI_VOL_MODE_ECNVRAM)
+		return;
+	if (!volume_control_allowed)
+		return;
+
+	vdbg_printk(TPACPI_DBG_MIXER,
+		"trying to checkpoint mixer state to NVRAM...\n");
+
+	if (tp_features.mixer_no_level_control)
+		ec_mask = TP_EC_AUDIO_MUTESW_MSK;
+	else
+		ec_mask = TP_EC_AUDIO_MUTESW_MSK | TP_EC_AUDIO_LVL_MSK;
+
+	if (mutex_lock_killable(&volume_mutex) < 0)
+		return;
+
+	if (unlikely(!acpi_ec_read(TP_EC_AUDIO, &lec)))
+		goto unlock;
+	lec &= ec_mask;
+	b_nvram = nvram_read_byte(TP_NVRAM_ADDR_MIXER);
+
+	if (lec != (b_nvram & ec_mask)) {
+		/* NVRAM needs update */
+		b_nvram &= ~ec_mask;
+		b_nvram |= lec;
+		nvram_write_byte(b_nvram, TP_NVRAM_ADDR_MIXER);
+		dbg_printk(TPACPI_DBG_MIXER,
+			   "updated NVRAM mixer status to 0x%02x (0x%02x)\n",
+			   (unsigned int) lec, (unsigned int) b_nvram);
 	} else {
-		len += sprintf(p + len, "level:\t\t%d\n", level & 0xf);
-		len += sprintf(p + len, "mute:\t\t%s\n", onoff(level, 6));
-		len += sprintf(p + len, "commands:\tup, down, mute\n");
-		len += sprintf(p + len, "commands:\tlevel <level>"
-			       " (<level> is 0-15)\n");
+		vdbg_printk(TPACPI_DBG_MIXER,
+			   "NVRAM mixer status already is 0x%02x (0x%02x)\n",
+			   (unsigned int) lec, (unsigned int) b_nvram);
 	}
 
-	return len;
+unlock:
+	mutex_unlock(&volume_mutex);
 }
 
-static int volume_write(char *buf)
+static int volume_get_status_ec(u8 *status)
 {
-	int cmos_cmd, inc, i;
-	u8 level, mute;
-	int new_level, new_mute;
-	char *cmd;
+	u8 s;
 
-	while ((cmd = next_cmd(&buf))) {
-		if (!acpi_ec_read(volume_offset, &level))
-			return -EIO;
-		new_mute = mute = level & 0x40;
-		new_level = level = level & 0xf;
+	if (!acpi_ec_read(TP_EC_AUDIO, &s))
+		return -EIO;
 
-		if (strlencmp(cmd, "up") == 0) {
-			if (mute)
-				new_mute = 0;
-			else
-				new_level = level == 15 ? 15 : level + 1;
-		} else if (strlencmp(cmd, "down") == 0) {
-			if (mute)
-				new_mute = 0;
-			else
-				new_level = level == 0 ? 0 : level - 1;
-		} else if (sscanf(cmd, "level %d", &new_level) == 1 &&
-			   new_level >= 0 && new_level <= 15) {
-			/* new_level set */
-		} else if (strlencmp(cmd, "mute") == 0) {
-			new_mute = 0x40;
-		} else
-			return -EINVAL;
+	*status = s;
 
-		if (new_level != level) {
-			/* mute doesn't change */
+	dbg_printk(TPACPI_DBG_MIXER, "status 0x%02x\n", s);
 
-			cmos_cmd = (new_level > level) ?
-					TP_CMOS_VOLUME_UP : TP_CMOS_VOLUME_DOWN;
-			inc = new_level > level ? 1 : -1;
+	return 0;
+}
 
-			if (mute && (issue_thinkpad_cmos_command(cmos_cmd) ||
-				     !acpi_ec_write(volume_offset, level)))
-				return -EIO;
+static int volume_get_status(u8 *status)
+{
+	return volume_get_status_ec(status);
+}
+
+static int volume_set_status_ec(const u8 status)
+{
+	if (!acpi_ec_write(TP_EC_AUDIO, status))
+		return -EIO;
 
-			for (i = level; i != new_level; i += inc)
-				if (issue_thinkpad_cmos_command(cmos_cmd) ||
-				    !acpi_ec_write(volume_offset, i + inc))
-					return -EIO;
+	dbg_printk(TPACPI_DBG_MIXER, "set EC mixer to 0x%02x\n", status);
 
-			if (mute &&
-			    (issue_thinkpad_cmos_command(TP_CMOS_VOLUME_MUTE) ||
-			     !acpi_ec_write(volume_offset, new_level + mute))) {
-				return -EIO;
-			}
+	return 0;
+}
+
+static int volume_set_status(const u8 status)
+{
+	return volume_set_status_ec(status);
+}
+
+static int volume_set_mute_ec(const bool mute)
+{
+	int rc;
+	u8 s, n;
+
+	if (mutex_lock_killable(&volume_mutex) < 0)
+		return -EINTR;
+
+	rc = volume_get_status_ec(&s);
+	if (rc)
+		goto unlock;
+
+	n = (mute) ? s | TP_EC_AUDIO_MUTESW_MSK :
+		     s & ~TP_EC_AUDIO_MUTESW_MSK;
+
+	if (n != s)
+		rc = volume_set_status_ec(n);
+
+unlock:
+	mutex_unlock(&volume_mutex);
+	return rc;
+}
+
+static int volume_set_mute(const bool mute)
+{
+	dbg_printk(TPACPI_DBG_MIXER, "trying to %smute\n",
+		   (mute) ? "" : "un");
+	return volume_set_mute_ec(mute);
+}
+
+static int volume_set_volume_ec(const u8 vol)
+{
+	int rc;
+	u8 s, n;
+
+	if (vol > TP_EC_VOLUME_MAX)
+		return -EINVAL;
+
+	if (mutex_lock_killable(&volume_mutex) < 0)
+		return -EINTR;
+
+	rc = volume_get_status_ec(&s);
+	if (rc)
+		goto unlock;
+
+	n = (s & ~TP_EC_AUDIO_LVL_MSK) | vol;
+
+	if (n != s)
+		rc = volume_set_status_ec(n);
+
+unlock:
+	mutex_unlock(&volume_mutex);
+	return rc;
+}
+
+static int volume_set_volume(const u8 vol)
+{
+	dbg_printk(TPACPI_DBG_MIXER,
+		   "trying to set volume level to %hu\n", vol);
+	return volume_set_volume_ec(vol);
+}
+
+static void volume_alsa_notify_change(void)
+{
+	struct tpacpi_alsa_data *d;
+
+	if (alsa_card && alsa_card->private_data) {
+		d = alsa_card->private_data;
+		if (d->ctl_mute_id)
+			snd_ctl_notify(alsa_card,
+					SNDRV_CTL_EVENT_MASK_VALUE,
+					d->ctl_mute_id);
+		if (d->ctl_vol_id)
+			snd_ctl_notify(alsa_card,
+					SNDRV_CTL_EVENT_MASK_VALUE,
+					d->ctl_vol_id);
+	}
+}
+
+static int volume_alsa_vol_info(struct snd_kcontrol *kcontrol,
+				struct snd_ctl_elem_info *uinfo)
+{
+	uinfo->type = SNDRV_CTL_ELEM_TYPE_INTEGER;
+	uinfo->count = 1;
+	uinfo->value.integer.min = 0;
+	uinfo->value.integer.max = TP_EC_VOLUME_MAX;
+	return 0;
+}
+
+static int volume_alsa_vol_get(struct snd_kcontrol *kcontrol,
+				struct snd_ctl_elem_value *ucontrol)
+{
+	u8 s;
+	int rc;
+
+	rc = volume_get_status(&s);
+	if (rc < 0)
+		return rc;
+
+	ucontrol->value.integer.value[0] = s & TP_EC_AUDIO_LVL_MSK;
+	return 0;
+}
+
+static int volume_alsa_vol_put(struct snd_kcontrol *kcontrol,
+				struct snd_ctl_elem_value *ucontrol)
+{
+	return volume_set_volume(ucontrol->value.integer.value[0]);
+}
+
+#define volume_alsa_mute_info snd_ctl_boolean_mono_info
+
+static int volume_alsa_mute_get(struct snd_kcontrol *kcontrol,
+				struct snd_ctl_elem_value *ucontrol)
+{
+	u8 s;
+	int rc;
+
+	rc = volume_get_status(&s);
+	if (rc < 0)
+		return rc;
+
+	ucontrol->value.integer.value[0] =
+				(s & TP_EC_AUDIO_MUTESW_MSK) ? 0 : 1;
+	return 0;
+}
+
+static int volume_alsa_mute_put(struct snd_kcontrol *kcontrol,
+				struct snd_ctl_elem_value *ucontrol)
+{
+	return volume_set_mute(!ucontrol->value.integer.value[0]);
+}
+
+static struct snd_kcontrol_new volume_alsa_control_vol __devinitdata = {
+	.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
+	.name = "Console Playback Volume",
+	.index = 0,
+	.access = SNDRV_CTL_ELEM_ACCESS_READ,
+	.info = volume_alsa_vol_info,
+	.get = volume_alsa_vol_get,
+};
+
+static struct snd_kcontrol_new volume_alsa_control_mute __devinitdata = {
+	.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
+	.name = "Console Playback Switch",
+	.index = 0,
+	.access = SNDRV_CTL_ELEM_ACCESS_READ,
+	.info = volume_alsa_mute_info,
+	.get = volume_alsa_mute_get,
+};
+
+static void volume_suspend(pm_message_t state)
+{
+	tpacpi_volume_checkpoint_nvram();
+}
+
+static void volume_resume(void)
+{
+	volume_alsa_notify_change();
+}
+
+static void volume_shutdown(void)
+{
+	tpacpi_volume_checkpoint_nvram();
+}
+
+static void volume_exit(void)
+{
+	if (alsa_card) {
+		snd_card_free(alsa_card);
+		alsa_card = NULL;
+	}
+
+	tpacpi_volume_checkpoint_nvram();
+}
+
+static int __init volume_create_alsa_mixer(void)
+{
+	struct snd_card *card;
+	struct tpacpi_alsa_data *data;
+	struct snd_kcontrol *ctl_vol;
+	struct snd_kcontrol *ctl_mute;
+	int rc;
+
+	rc = snd_card_create(alsa_index, alsa_id, THIS_MODULE,
+			    sizeof(struct tpacpi_alsa_data), &card);
+	if (rc < 0 || !card) {
+		printk(TPACPI_ERR
+			"Failed to create ALSA card structures: %d\n", rc);
+		return 1;
+	}
+
+	BUG_ON(!card->private_data);
+	data = card->private_data;
+	data->card = card;
+
+	strlcpy(card->driver, TPACPI_ALSA_DRVNAME,
+		sizeof(card->driver));
+	strlcpy(card->shortname, TPACPI_ALSA_SHRTNAME,
+		sizeof(card->shortname));
+	snprintf(card->mixername, sizeof(card->mixername), "ThinkPad EC %s",
+		 (thinkpad_id.ec_version_str) ?
+			thinkpad_id.ec_version_str : "(unknown)");
+	snprintf(card->longname, sizeof(card->longname),
+		 "%s at EC reg 0x%02x, fw %s", card->shortname, TP_EC_AUDIO,
+		 (thinkpad_id.ec_version_str) ?
+			thinkpad_id.ec_version_str : "unknown");
+
+	if (volume_control_allowed) {
+		volume_alsa_control_vol.put = volume_alsa_vol_put;
+		volume_alsa_control_vol.access =
+				SNDRV_CTL_ELEM_ACCESS_READWRITE;
+
+		volume_alsa_control_mute.put = volume_alsa_mute_put;
+		volume_alsa_control_mute.access =
+				SNDRV_CTL_ELEM_ACCESS_READWRITE;
+	}
+
+	if (!tp_features.mixer_no_level_control) {
+		ctl_vol = snd_ctl_new1(&volume_alsa_control_vol, NULL);
+		rc = snd_ctl_add(card, ctl_vol);
+		if (rc < 0) {
+			printk(TPACPI_ERR
+				"Failed to create ALSA volume control: %d\n",
+				rc);
+			goto err_exit;
 		}
+		data->ctl_vol_id = &ctl_vol->id;
+	}
 
-		if (new_mute != mute) {
-			/* level doesn't change */
+	ctl_mute = snd_ctl_new1(&volume_alsa_control_mute, NULL);
+	rc = snd_ctl_add(card, ctl_mute);
+	if (rc < 0) {
+		printk(TPACPI_ERR "Failed to create ALSA mute control: %d\n",
+			rc);
+		goto err_exit;
+	}
+	data->ctl_mute_id = &ctl_mute->id;
 
-			cmos_cmd = (new_mute) ?
-				   TP_CMOS_VOLUME_MUTE : TP_CMOS_VOLUME_UP;
+	snd_card_set_dev(card, &tpacpi_pdev->dev);
+	rc = snd_card_register(card);
+	if (rc < 0) {
+		printk(TPACPI_ERR "Failed to register ALSA card: %d\n", rc);
+		goto err_exit;
+	}
 
-			if (issue_thinkpad_cmos_command(cmos_cmd) ||
-			    !acpi_ec_write(volume_offset, level + new_mute))
-				return -EIO;
+	alsa_card = card;
+	return 0;
+
+err_exit:
+	snd_card_free(card);
+	return 1;
+}
+
+#define TPACPI_VOL_Q_MUTEONLY	0x0001	/* Mute-only control available */
+#define TPACPI_VOL_Q_LEVEL	0x0002  /* Volume control available */
+
+static const struct tpacpi_quirk volume_quirk_table[] __initconst = {
+	/* Whitelist volume level on all IBM by default */
+	{ .vendor = PCI_VENDOR_ID_IBM,
+	  .bios   = TPACPI_MATCH_ANY,
+	  .ec     = TPACPI_MATCH_ANY,
+	  .quirks = TPACPI_VOL_Q_LEVEL },
+
+	/* Lenovo models with volume control (needs confirmation) */
+	TPACPI_QEC_LNV('7', 'C', TPACPI_VOL_Q_LEVEL), /* R60/i */
+	TPACPI_QEC_LNV('7', 'E', TPACPI_VOL_Q_LEVEL), /* R60e/i */
+	TPACPI_QEC_LNV('7', '9', TPACPI_VOL_Q_LEVEL), /* T60/p */
+	TPACPI_QEC_LNV('7', 'B', TPACPI_VOL_Q_LEVEL), /* X60/s */
+	TPACPI_QEC_LNV('7', 'J', TPACPI_VOL_Q_LEVEL), /* X60t */
+	TPACPI_QEC_LNV('7', '7', TPACPI_VOL_Q_LEVEL), /* Z60 */
+	TPACPI_QEC_LNV('7', 'F', TPACPI_VOL_Q_LEVEL), /* Z61 */
+
+	/* Whitelist mute-only on all Lenovo by default */
+	{ .vendor = PCI_VENDOR_ID_LENOVO,
+	  .bios   = TPACPI_MATCH_ANY,
+	  .ec	  = TPACPI_MATCH_ANY,
+	  .quirks = TPACPI_VOL_Q_MUTEONLY }
+};
+
+static int __init volume_init(struct ibm_init_struct *iibm)
+{
+	unsigned long quirks;
+	int rc;
+
+	vdbg_printk(TPACPI_DBG_INIT, "initializing volume subdriver\n");
+
+	mutex_init(&volume_mutex);
+
+	/*
+	 * Check for module parameter bogosity, note that we
+	 * init volume_mode to TPACPI_VOL_MODE_MAX in order to be
+	 * able to detect "unspecified"
+	 */
+	if (volume_mode > TPACPI_VOL_MODE_MAX)
+		return -EINVAL;
+
+	if (volume_mode == TPACPI_VOL_MODE_UCMS_STEP) {
+		printk(TPACPI_ERR
+			"UCMS step volume mode not implemented, "
+			"please contact %s\n", TPACPI_MAIL);
+		return 1;
+	}
+
+	if (volume_capabilities >= TPACPI_VOL_CAP_MAX)
+		return -EINVAL;
+
+	/*
+	 * The ALSA mixer is our primary interface.
+	 * When disabled, don't install the subdriver at all
+	 */
+	if (!alsa_enable) {
+		vdbg_printk(TPACPI_DBG_INIT | TPACPI_DBG_MIXER,
+			    "ALSA mixer disabled by parameter, "
+			    "not loading volume subdriver...\n");
+		return 1;
+	}
+
+	quirks = tpacpi_check_quirks(volume_quirk_table,
+				     ARRAY_SIZE(volume_quirk_table));
+
+	switch (volume_capabilities) {
+	case TPACPI_VOL_CAP_AUTO:
+		if (quirks & TPACPI_VOL_Q_MUTEONLY)
+			tp_features.mixer_no_level_control = 1;
+		else if (quirks & TPACPI_VOL_Q_LEVEL)
+			tp_features.mixer_no_level_control = 0;
+		else
+			return 1; /* no mixer */
+		break;
+	case TPACPI_VOL_CAP_VOLMUTE:
+		tp_features.mixer_no_level_control = 0;
+		break;
+	case TPACPI_VOL_CAP_MUTEONLY:
+		tp_features.mixer_no_level_control = 1;
+		break;
+	default:
+		return 1;
+	}
+
+	if (volume_capabilities != TPACPI_VOL_CAP_AUTO)
+		dbg_printk(TPACPI_DBG_INIT | TPACPI_DBG_MIXER,
+				"using user-supplied volume_capabilities=%d\n",
+				volume_capabilities);
+
+	if (volume_mode == TPACPI_VOL_MODE_AUTO ||
+	    volume_mode == TPACPI_VOL_MODE_MAX) {
+		volume_mode = TPACPI_VOL_MODE_ECNVRAM;
+
+		dbg_printk(TPACPI_DBG_INIT | TPACPI_DBG_MIXER,
+				"driver auto-selected volume_mode=%d\n",
+				volume_mode);
+	} else {
+		dbg_printk(TPACPI_DBG_INIT | TPACPI_DBG_MIXER,
+				"using user-supplied volume_mode=%d\n",
+				volume_mode);
+	}
+
+	vdbg_printk(TPACPI_DBG_INIT | TPACPI_DBG_MIXER,
+			"mute is supported, volume control is %s\n",
+			str_supported(!tp_features.mixer_no_level_control));
+
+	rc = volume_create_alsa_mixer();
+	if (rc) {
+		printk(TPACPI_ERR
+			"Could not create the ALSA mixer interface\n");
+		return rc;
+	}
+
+	printk(TPACPI_INFO
+		"Console audio control enabled, mode: %s\n",
+		(volume_control_allowed) ?
+			"override (read/write)" :
+			"monitor (read only)");
+
+	vdbg_printk(TPACPI_DBG_INIT | TPACPI_DBG_MIXER,
+		"registering volume hotkeys as change notification\n");
+	tpacpi_hotkey_driver_mask_set(hotkey_driver_mask
+			| TP_ACPI_HKEY_VOLUP_MASK
+			| TP_ACPI_HKEY_VOLDWN_MASK
+			| TP_ACPI_HKEY_MUTE_MASK);
+
+	return 0;
+}
+
+static int volume_read(struct seq_file *m)
+{
+	u8 status;
+
+	if (volume_get_status(&status) < 0) {
+		seq_printf(m, "level:\t\tunreadable\n");
+	} else {
+		if (tp_features.mixer_no_level_control)
+			seq_printf(m, "level:\t\tunsupported\n");
+		else
+			seq_printf(m, "level:\t\t%d\n",
+					status & TP_EC_AUDIO_LVL_MSK);
+
+		seq_printf(m, "mute:\t\t%s\n",
+				onoff(status, TP_EC_AUDIO_MUTESW));
+
+		if (volume_control_allowed) {
+			seq_printf(m, "commands:\tunmute, mute\n");
+			if (!tp_features.mixer_no_level_control) {
+				seq_printf(m,
+					       "commands:\tup, down\n");
+				seq_printf(m,
+					       "commands:\tlevel <level>"
+					       " (<level> is 0-%d)\n",
+					       TP_EC_VOLUME_MAX);
+			}
 		}
 	}
 
 	return 0;
 }
 
+static int volume_write(char *buf)
+{
+	u8 s;
+	u8 new_level, new_mute;
+	int l;
+	char *cmd;
+	int rc;
+
+	/*
+	 * We do allow volume control at driver startup, so that the
+	 * user can set initial state through the volume=... parameter hack.
+	 */
+	if (!volume_control_allowed && tpacpi_lifecycle != TPACPI_LIFE_INIT) {
+		if (unlikely(!tp_warned.volume_ctrl_forbidden)) {
+			tp_warned.volume_ctrl_forbidden = 1;
+			printk(TPACPI_NOTICE
+				"Console audio control in monitor mode, "
+				"changes are not allowed.\n");
+			printk(TPACPI_NOTICE
+				"Use the volume_control=1 module parameter "
+				"to enable volume control\n");
+		}
+		return -EPERM;
+	}
+
+	rc = volume_get_status(&s);
+	if (rc < 0)
+		return rc;
+
+	new_level = s & TP_EC_AUDIO_LVL_MSK;
+	new_mute  = s & TP_EC_AUDIO_MUTESW_MSK;
+
+	while ((cmd = next_cmd(&buf))) {
+		if (!tp_features.mixer_no_level_control) {
+			if (strlencmp(cmd, "up") == 0) {
+				if (new_mute)
+					new_mute = 0;
+				else if (new_level < TP_EC_VOLUME_MAX)
+					new_level++;
+				continue;
+			} else if (strlencmp(cmd, "down") == 0) {
+				if (new_mute)
+					new_mute = 0;
+				else if (new_level > 0)
+					new_level--;
+				continue;
+			} else if (sscanf(cmd, "level %u", &l) == 1 &&
+				   l >= 0 && l <= TP_EC_VOLUME_MAX) {
+					new_level = l;
+				continue;
+			}
+		}
+		if (strlencmp(cmd, "mute") == 0)
+			new_mute = TP_EC_AUDIO_MUTESW_MSK;
+		else if (strlencmp(cmd, "unmute") == 0)
+			new_mute = 0;
+		else
+			return -EINVAL;
+	}
+
+	if (tp_features.mixer_no_level_control) {
+		tpacpi_disclose_usertask("procfs volume", "%smute\n",
+					new_mute ? "" : "un");
+		rc = volume_set_mute(!!new_mute);
+	} else {
+		tpacpi_disclose_usertask("procfs volume",
+					"%smute and set level to %d\n",
+					new_mute ? "" : "un", new_level);
+		rc = volume_set_status(new_mute | new_level);
+	}
+	volume_alsa_notify_change();
+
+	return (rc == -EINTR) ? -ERESTARTSYS : rc;
+}
+
 static struct ibm_struct volume_driver_data = {
 	.name = "volume",
 	.read = volume_read,
 	.write = volume_write,
+	.exit = volume_exit,
+	.suspend = volume_suspend,
+	.resume = volume_resume,
+	.shutdown = volume_shutdown,
 };
 
+#else /* !CONFIG_THINKPAD_ACPI_ALSA_SUPPORT */
+
+#define alsa_card NULL
+
+static void inline volume_alsa_notify_change(void)
+{
+}
+
+static int __init volume_init(struct ibm_init_struct *iibm)
+{
+	printk(TPACPI_INFO
+		"volume: disabled as there is no ALSA support in this kernel\n");
+
+	return 1;
+}
+
+static struct ibm_struct volume_driver_data = {
+	.name = "volume",
+};
+
+#endif /* CONFIG_THINKPAD_ACPI_ALSA_SUPPORT */
+
 /*************************************************************************
  * Fan subdriver
  */
@@ -6545,7 +7154,7 @@ static struct ibm_struct volume_driver_data = {
  * 	The speeds are stored on handles
  * 	(FANA:FAN9), (FANC:FANB), (FANE:FAND).
  *
- * 	There are three default speed sets, acessible as handles:
+ * 	There are three default speed sets, accessible as handles:
  * 	FS1L,FS1M,FS1H; FS2L,FS2M,FS2H; FS3L,FS3M,FS3H
  *
  * 	ACPI DSDT switches which set is in use depending on various
@@ -7510,9 +8119,8 @@ static void fan_resume(void)
 	}
 }
 
-static int fan_read(char *p)
+static int fan_read(struct seq_file *m)
 {
-	int len = 0;
 	int rc;
 	u8 status;
 	unsigned int speed = 0;
@@ -7524,7 +8132,7 @@ static int fan_read(char *p)
 		if (rc < 0)
 			return rc;
 
-		len += sprintf(p + len, "status:\t\t%s\n"
+		seq_printf(m, "status:\t\t%s\n"
 			       "level:\t\t%d\n",
 			       (status != 0) ? "enabled" : "disabled", status);
 		break;
@@ -7535,54 +8143,54 @@ static int fan_read(char *p)
 		if (rc < 0)
 			return rc;
 
-		len += sprintf(p + len, "status:\t\t%s\n",
+		seq_printf(m, "status:\t\t%s\n",
 			       (status != 0) ? "enabled" : "disabled");
 
 		rc = fan_get_speed(&speed);
 		if (rc < 0)
 			return rc;
 
-		len += sprintf(p + len, "speed:\t\t%d\n", speed);
+		seq_printf(m, "speed:\t\t%d\n", speed);
 
 		if (status & TP_EC_FAN_FULLSPEED)
 			/* Disengaged mode takes precedence */
-			len += sprintf(p + len, "level:\t\tdisengaged\n");
+			seq_printf(m, "level:\t\tdisengaged\n");
 		else if (status & TP_EC_FAN_AUTO)
-			len += sprintf(p + len, "level:\t\tauto\n");
+			seq_printf(m, "level:\t\tauto\n");
 		else
-			len += sprintf(p + len, "level:\t\t%d\n", status);
+			seq_printf(m, "level:\t\t%d\n", status);
 		break;
 
 	case TPACPI_FAN_NONE:
 	default:
-		len += sprintf(p + len, "status:\t\tnot supported\n");
+		seq_printf(m, "status:\t\tnot supported\n");
 	}
 
 	if (fan_control_commands & TPACPI_FAN_CMD_LEVEL) {
-		len += sprintf(p + len, "commands:\tlevel <level>");
+		seq_printf(m, "commands:\tlevel <level>");
 
 		switch (fan_control_access_mode) {
 		case TPACPI_FAN_WR_ACPI_SFAN:
-			len += sprintf(p + len, " (<level> is 0-7)\n");
+			seq_printf(m, " (<level> is 0-7)\n");
 			break;
 
 		default:
-			len += sprintf(p + len, " (<level> is 0-7, "
+			seq_printf(m, " (<level> is 0-7, "
 				       "auto, disengaged, full-speed)\n");
 			break;
 		}
 	}
 
 	if (fan_control_commands & TPACPI_FAN_CMD_ENABLE)
-		len += sprintf(p + len, "commands:\tenable, disable\n"
+		seq_printf(m, "commands:\tenable, disable\n"
 			       "commands:\twatchdog <timeout> (<timeout> "
 			       "is 0 (off), 1-120 (seconds))\n");
 
 	if (fan_control_commands & TPACPI_FAN_CMD_SPEED)
-		len += sprintf(p + len, "commands:\tspeed <speed>"
+		seq_printf(m, "commands:\tspeed <speed>"
 			       " (<speed> is 0-65535)\n");
 
-	return len;
+	return 0;
 }
 
 static int fan_write_cmd_level(const char *cmd, int *rc)
@@ -7724,10 +8332,23 @@ static struct ibm_struct fan_driver_data = {
  */
 static void tpacpi_driver_event(const unsigned int hkey_event)
 {
+	if (ibm_backlight_device) {
+		switch (hkey_event) {
+		case TP_HKEY_EV_BRGHT_UP:
+		case TP_HKEY_EV_BRGHT_DOWN:
+			tpacpi_brightness_notify_change();
+		}
+	}
+	if (alsa_card) {
+		switch (hkey_event) {
+		case TP_HKEY_EV_VOL_UP:
+		case TP_HKEY_EV_VOL_DOWN:
+		case TP_HKEY_EV_VOL_MUTE:
+			volume_alsa_notify_change();
+		}
+	}
 }
 
-
-
 static void hotkey_driver_event(const unsigned int scancode)
 {
 	tpacpi_driver_event(TP_HKEY_EV_HOTKEY_BASE + scancode);
@@ -7856,19 +8477,19 @@ static int __init ibm_init(struct ibm_init_struct *iibm)
 		"%s installed\n", ibm->name);
 
 	if (ibm->read) {
-		entry = create_proc_entry(ibm->name,
-					  S_IFREG | S_IRUGO | S_IWUSR,
-					  proc_dir);
+		mode_t mode;
+
+		mode = S_IRUGO;
+		if (ibm->write)
+			mode |= S_IWUSR;
+		entry = proc_create_data(ibm->name, mode, proc_dir,
+					 &dispatch_proc_fops, ibm);
 		if (!entry) {
 			printk(TPACPI_ERR "unable to create proc entry %s\n",
 			       ibm->name);
 			ret = -ENODEV;
 			goto err_out;
 		}
-		entry->data = ibm;
-		entry->read_proc = &dispatch_procfs_read;
-		if (ibm->write)
-			entry->write_proc = &dispatch_procfs_write;
 		ibm->flags.proc_created = 1;
 	}
 
@@ -8080,6 +8701,7 @@ static struct ibm_init_struct ibms_init[] __initdata = {
 		.data = &brightness_driver_data,
 	},
 	{
+		.init = volume_init,
 		.data = &volume_driver_data,
 	},
 	{
@@ -8115,36 +8737,61 @@ static int __init set_ibm_param(const char *val, struct kernel_param *kp)
 	return -EINVAL;
 }
 
-module_param(experimental, int, 0);
+module_param(experimental, int, 0444);
 MODULE_PARM_DESC(experimental,
 		 "Enables experimental features when non-zero");
 
 module_param_named(debug, dbg_level, uint, 0);
 MODULE_PARM_DESC(debug, "Sets debug level bit-mask");
 
-module_param(force_load, bool, 0);
+module_param(force_load, bool, 0444);
 MODULE_PARM_DESC(force_load,
 		 "Attempts to load the driver even on a "
 		 "mis-identified ThinkPad when true");
 
-module_param_named(fan_control, fan_control_allowed, bool, 0);
+module_param_named(fan_control, fan_control_allowed, bool, 0444);
 MODULE_PARM_DESC(fan_control,
 		 "Enables setting fan parameters features when true");
 
-module_param_named(brightness_mode, brightness_mode, uint, 0);
+module_param_named(brightness_mode, brightness_mode, uint, 0444);
 MODULE_PARM_DESC(brightness_mode,
 		 "Selects brightness control strategy: "
 		 "0=auto, 1=EC, 2=UCMS, 3=EC+NVRAM");
 
-module_param(brightness_enable, uint, 0);
+module_param(brightness_enable, uint, 0444);
 MODULE_PARM_DESC(brightness_enable,
 		 "Enables backlight control when 1, disables when 0");
 
-module_param(hotkey_report_mode, uint, 0);
+module_param(hotkey_report_mode, uint, 0444);
 MODULE_PARM_DESC(hotkey_report_mode,
 		 "used for backwards compatibility with userspace, "
 		 "see documentation");
 
+#ifdef CONFIG_THINKPAD_ACPI_ALSA_SUPPORT
+module_param_named(volume_mode, volume_mode, uint, 0444);
+MODULE_PARM_DESC(volume_mode,
+		 "Selects volume control strategy: "
+		 "0=auto, 1=EC, 2=N/A, 3=EC+NVRAM");
+
+module_param_named(volume_capabilities, volume_capabilities, uint, 0444);
+MODULE_PARM_DESC(volume_capabilities,
+		 "Selects the mixer capabilites: "
+		 "0=auto, 1=volume and mute, 2=mute only");
+
+module_param_named(volume_control, volume_control_allowed, bool, 0444);
+MODULE_PARM_DESC(volume_control,
+		 "Enables software override for the console audio "
+		 "control when true");
+
+/* ALSA module API parameters */
+module_param_named(index, alsa_index, int, 0444);
+MODULE_PARM_DESC(index, "ALSA index for the ACPI EC Mixer");
+module_param_named(id, alsa_id, charp, 0444);
+MODULE_PARM_DESC(id, "ALSA id for the ACPI EC Mixer");
+module_param_named(enable, alsa_enable, bool, 0444);
+MODULE_PARM_DESC(enable, "Enable the ALSA interface for the ACPI EC Mixer");
+#endif /* CONFIG_THINKPAD_ACPI_ALSA_SUPPORT */
+
 #define TPACPI_PARAM(feature) \
 	module_param_call(feature, set_ibm_param, NULL, NULL, 0); \
 	MODULE_PARM_DESC(feature, "Simulates thinkpad-acpi procfs command " \
@@ -8163,25 +8810,25 @@ TPACPI_PARAM(volume);
 TPACPI_PARAM(fan);
 
 #ifdef CONFIG_THINKPAD_ACPI_DEBUGFACILITIES
-module_param(dbg_wlswemul, uint, 0);
+module_param(dbg_wlswemul, uint, 0444);
 MODULE_PARM_DESC(dbg_wlswemul, "Enables WLSW emulation");
 module_param_named(wlsw_state, tpacpi_wlsw_emulstate, bool, 0);
 MODULE_PARM_DESC(wlsw_state,
 		 "Initial state of the emulated WLSW switch");
 
-module_param(dbg_bluetoothemul, uint, 0);
+module_param(dbg_bluetoothemul, uint, 0444);
 MODULE_PARM_DESC(dbg_bluetoothemul, "Enables bluetooth switch emulation");
 module_param_named(bluetooth_state, tpacpi_bluetooth_emulstate, bool, 0);
 MODULE_PARM_DESC(bluetooth_state,
 		 "Initial state of the emulated bluetooth switch");
 
-module_param(dbg_wwanemul, uint, 0);
+module_param(dbg_wwanemul, uint, 0444);
 MODULE_PARM_DESC(dbg_wwanemul, "Enables WWAN switch emulation");
 module_param_named(wwan_state, tpacpi_wwan_emulstate, bool, 0);
 MODULE_PARM_DESC(wwan_state,
 		 "Initial state of the emulated WWAN switch");
 
-module_param(dbg_uwbemul, uint, 0);
+module_param(dbg_uwbemul, uint, 0444);
 MODULE_PARM_DESC(dbg_uwbemul, "Enables UWB switch emulation");
 module_param_named(uwb_state, tpacpi_uwb_emulstate, bool, 0);
 MODULE_PARM_DESC(uwb_state,
@@ -8374,6 +9021,7 @@ static int __init thinkpad_acpi_module_init(void)
 						PCI_VENDOR_ID_IBM;
 		tpacpi_inputdev->id.product = TPACPI_HKEY_INPUT_PRODUCT;
 		tpacpi_inputdev->id.version = TPACPI_HKEY_INPUT_VERSION;
+		tpacpi_inputdev->dev.parent = &tpacpi_pdev->dev;
 	}
 	for (i = 0; i < ARRAY_SIZE(ibms_init); i++) {
 		ret = ibm_init(&ibms_init[i]);
diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c
index 51c0a8bee414..77bf5d8f893a 100644
--- a/drivers/platform/x86/toshiba_acpi.c
+++ b/drivers/platform/x86/toshiba_acpi.c
@@ -42,6 +42,7 @@
 #include <linux/init.h>
 #include <linux/types.h>
 #include <linux/proc_fs.h>
+#include <linux/seq_file.h>
 #include <linux/backlight.h>
 #include <linux/platform_device.h>
 #include <linux/rfkill.h>
@@ -357,63 +358,6 @@ static int force_fan;
 static int last_key_event;
 static int key_event_valid;
 
-typedef struct _ProcItem {
-	const char *name;
-	char *(*read_func) (char *);
-	unsigned long (*write_func) (const char *, unsigned long);
-} ProcItem;
-
-/* proc file handlers
- */
-
-static int
-dispatch_read(char *page, char **start, off_t off, int count, int *eof,
-	      ProcItem * item)
-{
-	char *p = page;
-	int len;
-
-	if (off == 0)
-		p = item->read_func(p);
-
-	/* ISSUE: I don't understand this code */
-	len = (p - page);
-	if (len <= off + count)
-		*eof = 1;
-	*start = page + off;
-	len -= off;
-	if (len > count)
-		len = count;
-	if (len < 0)
-		len = 0;
-	return len;
-}
-
-static int
-dispatch_write(struct file *file, const char __user * buffer,
-	       unsigned long count, ProcItem * item)
-{
-	int result;
-	char *tmp_buffer;
-
-	/* Arg buffer points to userspace memory, which can't be accessed
-	 * directly.  Since we're making a copy, zero-terminate the
-	 * destination so that sscanf can be used on it safely.
-	 */
-	tmp_buffer = kmalloc(count + 1, GFP_KERNEL);
-	if (!tmp_buffer)
-		return -ENOMEM;
-
-	if (copy_from_user(tmp_buffer, buffer, count)) {
-		result = -EFAULT;
-	} else {
-		tmp_buffer[count] = 0;
-		result = item->write_func(tmp_buffer, count);
-	}
-	kfree(tmp_buffer);
-	return result;
-}
-
 static int get_lcd(struct backlight_device *bd)
 {
 	u32 hci_result;
@@ -426,19 +370,24 @@ static int get_lcd(struct backlight_device *bd)
 		return -EFAULT;
 }
 
-static char *read_lcd(char *p)
+static int lcd_proc_show(struct seq_file *m, void *v)
 {
 	int value = get_lcd(NULL);
 
 	if (value >= 0) {
-		p += sprintf(p, "brightness:              %d\n", value);
-		p += sprintf(p, "brightness_levels:       %d\n",
+		seq_printf(m, "brightness:              %d\n", value);
+		seq_printf(m, "brightness_levels:       %d\n",
 			     HCI_LCD_BRIGHTNESS_LEVELS);
 	} else {
 		printk(MY_ERR "Error reading LCD brightness\n");
 	}
 
-	return p;
+	return 0;
+}
+
+static int lcd_proc_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, lcd_proc_show, NULL);
 }
 
 static int set_lcd(int value)
@@ -458,12 +407,20 @@ static int set_lcd_status(struct backlight_device *bd)
 	return set_lcd(bd->props.brightness);
 }
 
-static unsigned long write_lcd(const char *buffer, unsigned long count)
+static ssize_t lcd_proc_write(struct file *file, const char __user *buf,
+			      size_t count, loff_t *pos)
 {
+	char cmd[42];
+	size_t len;
 	int value;
 	int ret;
 
-	if (sscanf(buffer, " brightness : %i", &value) == 1 &&
+	len = min(count, sizeof(cmd) - 1);
+	if (copy_from_user(cmd, buf, len))
+		return -EFAULT;
+	cmd[len] = '\0';
+
+	if (sscanf(cmd, " brightness : %i", &value) == 1 &&
 	    value >= 0 && value < HCI_LCD_BRIGHTNESS_LEVELS) {
 		ret = set_lcd(value);
 		if (ret == 0)
@@ -474,7 +431,16 @@ static unsigned long write_lcd(const char *buffer, unsigned long count)
 	return ret;
 }
 
-static char *read_video(char *p)
+static const struct file_operations lcd_proc_fops = {
+	.owner		= THIS_MODULE,
+	.open		= lcd_proc_open,
+	.read		= seq_read,
+	.llseek		= seq_lseek,
+	.release	= single_release,
+	.write		= lcd_proc_write,
+};
+
+static int video_proc_show(struct seq_file *m, void *v)
 {
 	u32 hci_result;
 	u32 value;
@@ -484,18 +450,25 @@ static char *read_video(char *p)
 		int is_lcd = (value & HCI_VIDEO_OUT_LCD) ? 1 : 0;
 		int is_crt = (value & HCI_VIDEO_OUT_CRT) ? 1 : 0;
 		int is_tv = (value & HCI_VIDEO_OUT_TV) ? 1 : 0;
-		p += sprintf(p, "lcd_out:                 %d\n", is_lcd);
-		p += sprintf(p, "crt_out:                 %d\n", is_crt);
-		p += sprintf(p, "tv_out:                  %d\n", is_tv);
+		seq_printf(m, "lcd_out:                 %d\n", is_lcd);
+		seq_printf(m, "crt_out:                 %d\n", is_crt);
+		seq_printf(m, "tv_out:                  %d\n", is_tv);
 	} else {
 		printk(MY_ERR "Error reading video out status\n");
 	}
 
-	return p;
+	return 0;
 }
 
-static unsigned long write_video(const char *buffer, unsigned long count)
+static int video_proc_open(struct inode *inode, struct file *file)
 {
+	return single_open(file, video_proc_show, NULL);
+}
+
+static ssize_t video_proc_write(struct file *file, const char __user *buf,
+				size_t count, loff_t *pos)
+{
+	char *cmd, *buffer;
 	int value;
 	int remain = count;
 	int lcd_out = -1;
@@ -504,6 +477,17 @@ static unsigned long write_video(const char *buffer, unsigned long count)
 	u32 hci_result;
 	u32 video_out;
 
+	cmd = kmalloc(count + 1, GFP_KERNEL);
+	if (!cmd)
+		return -ENOMEM;
+	if (copy_from_user(cmd, buf, count)) {
+		kfree(cmd);
+		return -EFAULT;
+	}
+	cmd[count] = '\0';
+
+	buffer = cmd;
+
 	/* scan expression.  Multiple expressions may be delimited with ;
 	 *
 	 *  NOTE: to keep scanning simple, invalid fields are ignored
@@ -523,6 +507,8 @@ static unsigned long write_video(const char *buffer, unsigned long count)
 		while (remain && *(buffer - 1) != ';');
 	}
 
+	kfree(cmd);
+
 	hci_read1(HCI_VIDEO_OUT, &video_out, &hci_result);
 	if (hci_result == HCI_SUCCESS) {
 		unsigned int new_video_out = video_out;
@@ -543,28 +529,50 @@ static unsigned long write_video(const char *buffer, unsigned long count)
 	return count;
 }
 
-static char *read_fan(char *p)
+static const struct file_operations video_proc_fops = {
+	.owner		= THIS_MODULE,
+	.open		= video_proc_open,
+	.read		= seq_read,
+	.llseek		= seq_lseek,
+	.release	= single_release,
+	.write		= video_proc_write,
+};
+
+static int fan_proc_show(struct seq_file *m, void *v)
 {
 	u32 hci_result;
 	u32 value;
 
 	hci_read1(HCI_FAN, &value, &hci_result);
 	if (hci_result == HCI_SUCCESS) {
-		p += sprintf(p, "running:                 %d\n", (value > 0));
-		p += sprintf(p, "force_on:                %d\n", force_fan);
+		seq_printf(m, "running:                 %d\n", (value > 0));
+		seq_printf(m, "force_on:                %d\n", force_fan);
 	} else {
 		printk(MY_ERR "Error reading fan status\n");
 	}
 
-	return p;
+	return 0;
+}
+
+static int fan_proc_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, fan_proc_show, NULL);
 }
 
-static unsigned long write_fan(const char *buffer, unsigned long count)
+static ssize_t fan_proc_write(struct file *file, const char __user *buf,
+			      size_t count, loff_t *pos)
 {
+	char cmd[42];
+	size_t len;
 	int value;
 	u32 hci_result;
 
-	if (sscanf(buffer, " force_on : %i", &value) == 1 &&
+	len = min(count, sizeof(cmd) - 1);
+	if (copy_from_user(cmd, buf, len))
+		return -EFAULT;
+	cmd[len] = '\0';
+
+	if (sscanf(cmd, " force_on : %i", &value) == 1 &&
 	    value >= 0 && value <= 1) {
 		hci_write1(HCI_FAN, value, &hci_result);
 		if (hci_result != HCI_SUCCESS)
@@ -578,7 +586,16 @@ static unsigned long write_fan(const char *buffer, unsigned long count)
 	return count;
 }
 
-static char *read_keys(char *p)
+static const struct file_operations fan_proc_fops = {
+	.owner		= THIS_MODULE,
+	.open		= fan_proc_open,
+	.read		= seq_read,
+	.llseek		= seq_lseek,
+	.release	= single_release,
+	.write		= fan_proc_write,
+};
+
+static int keys_proc_show(struct seq_file *m, void *v)
 {
 	u32 hci_result;
 	u32 value;
@@ -602,18 +619,30 @@ static char *read_keys(char *p)
 		}
 	}
 
-	p += sprintf(p, "hotkey_ready:            %d\n", key_event_valid);
-	p += sprintf(p, "hotkey:                  0x%04x\n", last_key_event);
+	seq_printf(m, "hotkey_ready:            %d\n", key_event_valid);
+	seq_printf(m, "hotkey:                  0x%04x\n", last_key_event);
+end:
+	return 0;
+}
 
-      end:
-	return p;
+static int keys_proc_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, keys_proc_show, NULL);
 }
 
-static unsigned long write_keys(const char *buffer, unsigned long count)
+static ssize_t keys_proc_write(struct file *file, const char __user *buf,
+			       size_t count, loff_t *pos)
 {
+	char cmd[42];
+	size_t len;
 	int value;
 
-	if (sscanf(buffer, " hotkey_ready : %i", &value) == 1 && value == 0) {
+	len = min(count, sizeof(cmd) - 1);
+	if (copy_from_user(cmd, buf, len))
+		return -EFAULT;
+	cmd[len] = '\0';
+
+	if (sscanf(cmd, " hotkey_ready : %i", &value) == 1 && value == 0) {
 		key_event_valid = 0;
 	} else {
 		return -EINVAL;
@@ -622,52 +651,58 @@ static unsigned long write_keys(const char *buffer, unsigned long count)
 	return count;
 }
 
-static char *read_version(char *p)
+static const struct file_operations keys_proc_fops = {
+	.owner		= THIS_MODULE,
+	.open		= keys_proc_open,
+	.read		= seq_read,
+	.llseek		= seq_lseek,
+	.release	= single_release,
+	.write		= keys_proc_write,
+};
+
+static int version_proc_show(struct seq_file *m, void *v)
 {
-	p += sprintf(p, "driver:                  %s\n", TOSHIBA_ACPI_VERSION);
-	p += sprintf(p, "proc_interface:          %d\n",
-		     PROC_INTERFACE_VERSION);
-	return p;
+	seq_printf(m, "driver:                  %s\n", TOSHIBA_ACPI_VERSION);
+	seq_printf(m, "proc_interface:          %d\n", PROC_INTERFACE_VERSION);
+	return 0;
 }
 
+static int version_proc_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, version_proc_show, PDE(inode)->data);
+}
+
+static const struct file_operations version_proc_fops = {
+	.owner		= THIS_MODULE,
+	.open		= version_proc_open,
+	.read		= seq_read,
+	.llseek		= seq_lseek,
+	.release	= single_release,
+};
+
 /* proc and module init
  */
 
 #define PROC_TOSHIBA		"toshiba"
 
-static ProcItem proc_items[] = {
-	{"lcd", read_lcd, write_lcd},
-	{"video", read_video, write_video},
-	{"fan", read_fan, write_fan},
-	{"keys", read_keys, write_keys},
-	{"version", read_version, NULL},
-	{NULL}
-};
-
 static acpi_status __init add_device(void)
 {
-	struct proc_dir_entry *proc;
-	ProcItem *item;
-
-	for (item = proc_items; item->name; ++item) {
-		proc = create_proc_read_entry(item->name,
-					      S_IFREG | S_IRUGO | S_IWUSR,
-					      toshiba_proc_dir,
-					      (read_proc_t *) dispatch_read,
-					      item);
-		if (proc && item->write_func)
-			proc->write_proc = (write_proc_t *) dispatch_write;
-	}
+	proc_create("lcd", S_IRUGO | S_IWUSR, toshiba_proc_dir, &lcd_proc_fops);
+	proc_create("video", S_IRUGO | S_IWUSR, toshiba_proc_dir, &video_proc_fops);
+	proc_create("fan", S_IRUGO | S_IWUSR, toshiba_proc_dir, &fan_proc_fops);
+	proc_create("keys", S_IRUGO | S_IWUSR, toshiba_proc_dir, &keys_proc_fops);
+	proc_create("version", S_IRUGO, toshiba_proc_dir, &version_proc_fops);
 
 	return AE_OK;
 }
 
 static acpi_status remove_device(void)
 {
-	ProcItem *item;
-
-	for (item = proc_items; item->name; ++item)
-		remove_proc_entry(item->name, toshiba_proc_dir);
+	remove_proc_entry("lcd", toshiba_proc_dir);
+	remove_proc_entry("video", toshiba_proc_dir);
+	remove_proc_entry("fan", toshiba_proc_dir);
+	remove_proc_entry("keys", toshiba_proc_dir);
+	remove_proc_entry("version", toshiba_proc_dir);
 	return AE_OK;
 }
 
diff --git a/drivers/platform/x86/toshiba_bluetooth.c b/drivers/platform/x86/toshiba_bluetooth.c
new file mode 100644
index 000000000000..a350418e87ea
--- /dev/null
+++ b/drivers/platform/x86/toshiba_bluetooth.c
@@ -0,0 +1,144 @@
+/*
+ * Toshiba Bluetooth Enable Driver
+ *
+ * Copyright (C) 2009 Jes Sorensen <Jes.Sorensen@gmail.com>
+ *
+ * Thanks to Matthew Garrett for background info on ACPI innards which
+ * normal people aren't meant to understand :-)
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * Note the Toshiba Bluetooth RFKill switch seems to be a strange
+ * fish. It only provides a BT event when the switch is flipped to
+ * the 'on' position. When flipping it to 'off', the USB device is
+ * simply pulled away underneath us, without any BT event being
+ * delivered.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/types.h>
+#include <acpi/acpi_bus.h>
+#include <acpi/acpi_drivers.h>
+
+MODULE_AUTHOR("Jes Sorensen <Jes.Sorensen@gmail.com>");
+MODULE_DESCRIPTION("Toshiba Laptop ACPI Bluetooth Enable Driver");
+MODULE_LICENSE("GPL");
+
+
+static int toshiba_bt_rfkill_add(struct acpi_device *device);
+static int toshiba_bt_rfkill_remove(struct acpi_device *device, int type);
+static void toshiba_bt_rfkill_notify(struct acpi_device *device, u32 event);
+static int toshiba_bt_resume(struct acpi_device *device);
+
+static const struct acpi_device_id bt_device_ids[] = {
+	{ "TOS6205", 0},
+	{ "", 0},
+};
+MODULE_DEVICE_TABLE(acpi, bt_device_ids);
+
+static struct acpi_driver toshiba_bt_rfkill_driver = {
+	.name =		"Toshiba BT",
+	.class =	"Toshiba",
+	.ids =		bt_device_ids,
+	.ops =		{
+				.add =		toshiba_bt_rfkill_add,
+				.remove =	toshiba_bt_rfkill_remove,
+				.notify =	toshiba_bt_rfkill_notify,
+				.resume =	toshiba_bt_resume,
+			},
+	.owner = 	THIS_MODULE,
+};
+
+
+static int toshiba_bluetooth_enable(acpi_handle handle)
+{
+	acpi_status res1, res2;
+	acpi_integer result;
+
+	/*
+	 * Query ACPI to verify RFKill switch is set to 'on'.
+	 * If not, we return silently, no need to report it as
+	 * an error.
+	 */
+	res1 = acpi_evaluate_integer(handle, "BTST", NULL, &result);
+	if (ACPI_FAILURE(res1))
+		return res1;
+	if (!(result & 0x01))
+		return 0;
+
+	printk(KERN_INFO "toshiba_bluetooth: Re-enabling Toshiba Bluetooth\n");
+	res1 = acpi_evaluate_object(handle, "AUSB", NULL, NULL);
+	res2 = acpi_evaluate_object(handle, "BTPO", NULL, NULL);
+	if (!ACPI_FAILURE(res1) || !ACPI_FAILURE(res2))
+		return 0;
+
+	printk(KERN_WARNING "toshiba_bluetooth: Failed to re-enable "
+	       "Toshiba Bluetooth\n");
+
+	return -ENODEV;
+}
+
+static void toshiba_bt_rfkill_notify(struct acpi_device *device, u32 event)
+{
+	toshiba_bluetooth_enable(device->handle);
+}
+
+static int toshiba_bt_resume(struct acpi_device *device)
+{
+	return toshiba_bluetooth_enable(device->handle);
+}
+
+static int toshiba_bt_rfkill_add(struct acpi_device *device)
+{
+	acpi_status status;
+	acpi_integer bt_present;
+	int result = -ENODEV;
+
+	/*
+	 * Some Toshiba laptops may have a fake TOS6205 device in
+	 * their ACPI BIOS, so query the _STA method to see if there
+	 * is really anything there, before trying to enable it.
+	 */
+	status = acpi_evaluate_integer(device->handle, "_STA", NULL,
+				       &bt_present);
+
+	if (!ACPI_FAILURE(status) && bt_present) {
+		printk(KERN_INFO "Detected Toshiba ACPI Bluetooth device - "
+		      "installing RFKill handler\n");
+		result = toshiba_bluetooth_enable(device->handle);
+	}
+
+	return result;
+}
+
+static int __init toshiba_bt_rfkill_init(void)
+{
+	int result;
+
+	result = acpi_bus_register_driver(&toshiba_bt_rfkill_driver);
+	if (result < 0) {
+		ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+				  "Error registering driver\n"));
+		return result;
+	}
+
+	return 0;
+}
+
+static int toshiba_bt_rfkill_remove(struct acpi_device *device, int type)
+{
+	/* clean up */
+	return 0;
+}
+
+static void __exit toshiba_bt_rfkill_exit(void)
+{
+	acpi_bus_unregister_driver(&toshiba_bt_rfkill_driver);
+}
+
+module_init(toshiba_bt_rfkill_init);
+module_exit(toshiba_bt_rfkill_exit);
diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
index 177f8d767df4..b104302fea0a 100644
--- a/drivers/platform/x86/wmi.c
+++ b/drivers/platform/x86/wmi.c
@@ -30,6 +30,7 @@
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/types.h>
+#include <linux/device.h>
 #include <linux/list.h>
 #include <linux/acpi.h>
 #include <acpi/acpi_bus.h>
@@ -65,6 +66,7 @@ struct wmi_block {
 	acpi_handle handle;
 	wmi_notify_handler handler;
 	void *handler_data;
+	struct device *dev;
 };
 
 static struct wmi_block wmi_blocks;
@@ -195,6 +197,34 @@ static bool wmi_parse_guid(const u8 *src, u8 *dest)
 	return true;
 }
 
+/*
+ * Convert a raw GUID to the ACII string representation
+ */
+static int wmi_gtoa(const char *in, char *out)
+{
+	int i;
+
+	for (i = 3; i >= 0; i--)
+		out += sprintf(out, "%02X", in[i] & 0xFF);
+
+	out += sprintf(out, "-");
+	out += sprintf(out, "%02X", in[5] & 0xFF);
+	out += sprintf(out, "%02X", in[4] & 0xFF);
+	out += sprintf(out, "-");
+	out += sprintf(out, "%02X", in[7] & 0xFF);
+	out += sprintf(out, "%02X", in[6] & 0xFF);
+	out += sprintf(out, "-");
+	out += sprintf(out, "%02X", in[8] & 0xFF);
+	out += sprintf(out, "%02X", in[9] & 0xFF);
+	out += sprintf(out, "-");
+
+	for (i = 10; i <= 15; i++)
+		out += sprintf(out, "%02X", in[i] & 0xFF);
+
+	out = '\0';
+	return 0;
+}
+
 static bool find_guid(const char *guid_string, struct wmi_block **out)
 {
 	char tmp[16], guid_input[16];
@@ -462,8 +492,7 @@ wmi_notify_handler handler, void *data)
 	if (!guid || !handler)
 		return AE_BAD_PARAMETER;
 
-	find_guid(guid, &block);
-	if (!block)
+	if (!find_guid(guid, &block))
 		return AE_NOT_EXIST;
 
 	if (block->handler)
@@ -491,8 +520,7 @@ acpi_status wmi_remove_notify_handler(const char *guid)
 	if (!guid)
 		return AE_BAD_PARAMETER;
 
-	find_guid(guid, &block);
-	if (!block)
+	if (!find_guid(guid, &block))
 		return AE_NOT_EXIST;
 
 	if (!block->handler)
@@ -510,8 +538,8 @@ EXPORT_SYMBOL_GPL(wmi_remove_notify_handler);
 /**
  * wmi_get_event_data - Get WMI data associated with an event
  *
- * @event - Event to find
- * &out - Buffer to hold event data
+ * @event: Event to find
+ * @out: Buffer to hold event data. out->pointer should be freed with kfree()
  *
  * Returns extra data associated with an event in WMI.
  */
@@ -555,6 +583,154 @@ bool wmi_has_guid(const char *guid_string)
 EXPORT_SYMBOL_GPL(wmi_has_guid);
 
 /*
+ * sysfs interface
+ */
+static ssize_t show_modalias(struct device *dev, struct device_attribute *attr,
+			     char *buf)
+{
+	char guid_string[37];
+	struct wmi_block *wblock;
+
+	wblock = dev_get_drvdata(dev);
+	if (!wblock)
+		return -ENOMEM;
+
+	wmi_gtoa(wblock->gblock.guid, guid_string);
+
+	return sprintf(buf, "wmi:%s\n", guid_string);
+}
+static DEVICE_ATTR(modalias, S_IRUGO, show_modalias, NULL);
+
+static int wmi_dev_uevent(struct device *dev, struct kobj_uevent_env *env)
+{
+	char guid_string[37];
+
+	struct wmi_block *wblock;
+
+	if (add_uevent_var(env, "MODALIAS="))
+		return -ENOMEM;
+
+	wblock = dev_get_drvdata(dev);
+	if (!wblock)
+		return -ENOMEM;
+
+	wmi_gtoa(wblock->gblock.guid, guid_string);
+
+	strcpy(&env->buf[env->buflen - 1], "wmi:");
+	memcpy(&env->buf[env->buflen - 1 + 4], guid_string, 36);
+	env->buflen += 40;
+
+	return 0;
+}
+
+static void wmi_dev_free(struct device *dev)
+{
+	kfree(dev);
+}
+
+static struct class wmi_class = {
+	.name = "wmi",
+	.dev_release = wmi_dev_free,
+	.dev_uevent = wmi_dev_uevent,
+};
+
+static int wmi_create_devs(void)
+{
+	int result;
+	char guid_string[37];
+	struct guid_block *gblock;
+	struct wmi_block *wblock;
+	struct list_head *p;
+	struct device *guid_dev;
+
+	/* Create devices for all the GUIDs */
+	list_for_each(p, &wmi_blocks.list) {
+		wblock = list_entry(p, struct wmi_block, list);
+
+		guid_dev = kzalloc(sizeof(struct device), GFP_KERNEL);
+		if (!guid_dev)
+			return -ENOMEM;
+
+		wblock->dev = guid_dev;
+
+		guid_dev->class = &wmi_class;
+		dev_set_drvdata(guid_dev, wblock);
+
+		gblock = &wblock->gblock;
+
+		wmi_gtoa(gblock->guid, guid_string);
+		dev_set_name(guid_dev, guid_string);
+
+		result = device_register(guid_dev);
+		if (result)
+			return result;
+
+		result = device_create_file(guid_dev, &dev_attr_modalias);
+		if (result)
+			return result;
+	}
+
+	return 0;
+}
+
+static void wmi_remove_devs(void)
+{
+	struct guid_block *gblock;
+	struct wmi_block *wblock;
+	struct list_head *p;
+	struct device *guid_dev;
+
+	/* Delete devices for all the GUIDs */
+	list_for_each(p, &wmi_blocks.list) {
+		wblock = list_entry(p, struct wmi_block, list);
+
+		guid_dev = wblock->dev;
+		gblock = &wblock->gblock;
+
+		device_remove_file(guid_dev, &dev_attr_modalias);
+
+		device_unregister(guid_dev);
+	}
+}
+
+static void wmi_class_exit(void)
+{
+	wmi_remove_devs();
+	class_unregister(&wmi_class);
+}
+
+static int wmi_class_init(void)
+{
+	int ret;
+
+	ret = class_register(&wmi_class);
+	if (ret)
+		return ret;
+
+	ret = wmi_create_devs();
+	if (ret)
+		wmi_class_exit();
+
+	return ret;
+}
+
+static bool guid_already_parsed(const char *guid_string)
+{
+	struct guid_block *gblock;
+	struct wmi_block *wblock;
+	struct list_head *p;
+
+	list_for_each(p, &wmi_blocks.list) {
+		wblock = list_entry(p, struct wmi_block, list);
+		gblock = &wblock->gblock;
+
+		if (strncmp(gblock->guid, guid_string, 16) == 0)
+			return true;
+	}
+	return false;
+}
+
+/*
  * Parse the _WDG method for the GUID data blocks
  */
 static __init acpi_status parse_wdg(acpi_handle handle)
@@ -563,6 +739,7 @@ static __init acpi_status parse_wdg(acpi_handle handle)
 	union acpi_object *obj;
 	struct guid_block *gblock;
 	struct wmi_block *wblock;
+	char guid_string[37];
 	acpi_status status;
 	u32 i, total;
 
@@ -585,6 +762,19 @@ static __init acpi_status parse_wdg(acpi_handle handle)
 	memcpy(gblock, obj->buffer.pointer, obj->buffer.length);
 
 	for (i = 0; i < total; i++) {
+		/*
+		  Some WMI devices, like those for nVidia hooks, have a
+		  duplicate GUID. It's not clear what we should do in this
+		  case yet, so for now, we'll just ignore the duplicate.
+		  Anyone who wants to add support for that device can come
+		  up with a better workaround for the mess then.
+		*/
+		if (guid_already_parsed(gblock[i].guid) == true) {
+			wmi_gtoa(gblock[i].guid, guid_string);
+			printk(KERN_INFO PREFIX "Skipping duplicate GUID %s\n",
+				guid_string);
+			continue;
+		}
 		wblock = kzalloc(sizeof(struct wmi_block), GFP_KERNEL);
 		if (!wblock)
 			return AE_NO_MEMORY;
@@ -709,10 +899,17 @@ static int __init acpi_wmi_init(void)
 
 	if (result < 0) {
 		printk(KERN_INFO PREFIX "Error loading mapper\n");
-	} else {
-		printk(KERN_INFO PREFIX "Mapper loaded\n");
+		return -ENODEV;
+	}
+
+	result = wmi_class_init();
+	if (result) {
+		acpi_bus_unregister_driver(&acpi_wmi_driver);
+		return result;
 	}
 
+	printk(KERN_INFO PREFIX "Mapper loaded\n");
+
 	return result;
 }
 
@@ -721,6 +918,8 @@ static void __exit acpi_wmi_exit(void)
 	struct list_head *p, *tmp;
 	struct wmi_block *wblock;
 
+	wmi_class_exit();
+
 	acpi_bus_unregister_driver(&acpi_wmi_driver);
 
 	list_for_each_safe(p, tmp, &wmi_blocks.list) {
diff --git a/drivers/pnp/interface.c b/drivers/pnp/interface.c
index c3f1c8e9d254..68b0c04987e4 100644
--- a/drivers/pnp/interface.c
+++ b/drivers/pnp/interface.c
@@ -310,8 +310,7 @@ static ssize_t pnp_set_current_resources(struct device *dmdev,
 		goto done;
 	}
 
-	while (isspace(*buf))
-		++buf;
+	buf = skip_spaces(buf);
 	if (!strnicmp(buf, "disable", 7)) {
 		retval = pnp_disable_dev(dev);
 		goto done;
@@ -353,19 +352,13 @@ static ssize_t pnp_set_current_resources(struct device *dmdev,
 		pnp_init_resources(dev);
 		mutex_lock(&pnp_res_mutex);
 		while (1) {
-			while (isspace(*buf))
-				++buf;
+			buf = skip_spaces(buf);
 			if (!strnicmp(buf, "io", 2)) {
-				buf += 2;
-				while (isspace(*buf))
-					++buf;
+				buf = skip_spaces(buf + 2);
 				start = simple_strtoul(buf, &buf, 0);
-				while (isspace(*buf))
-					++buf;
+				buf = skip_spaces(buf);
 				if (*buf == '-') {
-					buf += 1;
-					while (isspace(*buf))
-						++buf;
+					buf = skip_spaces(buf + 1);
 					end = simple_strtoul(buf, &buf, 0);
 				} else
 					end = start;
@@ -373,16 +366,11 @@ static ssize_t pnp_set_current_resources(struct device *dmdev,
 				continue;
 			}
 			if (!strnicmp(buf, "mem", 3)) {
-				buf += 3;
-				while (isspace(*buf))
-					++buf;
+				buf = skip_spaces(buf + 3);
 				start = simple_strtoul(buf, &buf, 0);
-				while (isspace(*buf))
-					++buf;
+				buf = skip_spaces(buf);
 				if (*buf == '-') {
-					buf += 1;
-					while (isspace(*buf))
-						++buf;
+					buf = skip_spaces(buf + 1);
 					end = simple_strtoul(buf, &buf, 0);
 				} else
 					end = start;
@@ -390,17 +378,13 @@ static ssize_t pnp_set_current_resources(struct device *dmdev,
 				continue;
 			}
 			if (!strnicmp(buf, "irq", 3)) {
-				buf += 3;
-				while (isspace(*buf))
-					++buf;
+				buf = skip_spaces(buf + 3);
 				start = simple_strtoul(buf, &buf, 0);
 				pnp_add_irq_resource(dev, start, 0);
 				continue;
 			}
 			if (!strnicmp(buf, "dma", 3)) {
-				buf += 3;
-				while (isspace(*buf))
-					++buf;
+				buf = skip_spaces(buf + 3);
 				start = simple_strtoul(buf, &buf, 0);
 				pnp_add_dma_resource(dev, start, 0);
 				continue;
diff --git a/drivers/pnp/pnpacpi/core.c b/drivers/pnp/pnpacpi/core.c
index 83b8b5ac49c9..5314bf630bc4 100644
--- a/drivers/pnp/pnpacpi/core.c
+++ b/drivers/pnp/pnpacpi/core.c
@@ -80,7 +80,8 @@ static int pnpacpi_get_resources(struct pnp_dev *dev)
 
 static int pnpacpi_set_resources(struct pnp_dev *dev)
 {
-	acpi_handle handle = dev->data;
+	struct acpi_device *acpi_dev = dev->data;
+	acpi_handle handle = acpi_dev->handle;
 	struct acpi_buffer buffer;
 	int ret;
 
@@ -103,7 +104,8 @@ static int pnpacpi_set_resources(struct pnp_dev *dev)
 
 static int pnpacpi_disable_resources(struct pnp_dev *dev)
 {
-	acpi_handle handle = dev->data;
+	struct acpi_device *acpi_dev = dev->data;
+	acpi_handle handle = acpi_dev->handle;
 	int ret;
 
 	dev_dbg(&dev->dev, "disable resources\n");
@@ -121,6 +123,8 @@ static int pnpacpi_disable_resources(struct pnp_dev *dev)
 #ifdef CONFIG_ACPI_SLEEP
 static int pnpacpi_suspend(struct pnp_dev *dev, pm_message_t state)
 {
+	struct acpi_device *acpi_dev = dev->data;
+	acpi_handle handle = acpi_dev->handle;
 	int power_state;
 
 	power_state = acpi_pm_device_sleep_state(&dev->dev, NULL);
@@ -128,16 +132,19 @@ static int pnpacpi_suspend(struct pnp_dev *dev, pm_message_t state)
 		power_state = (state.event == PM_EVENT_ON) ?
 				ACPI_STATE_D0 : ACPI_STATE_D3;
 
-	return acpi_bus_set_power((acpi_handle) dev->data, power_state);
+	return acpi_bus_set_power(handle, power_state);
 }
 
 static int pnpacpi_resume(struct pnp_dev *dev)
 {
-	return acpi_bus_set_power((acpi_handle) dev->data, ACPI_STATE_D0);
+	struct acpi_device *acpi_dev = dev->data;
+	acpi_handle handle = acpi_dev->handle;
+
+	return acpi_bus_set_power(handle, ACPI_STATE_D0);
 }
 #endif
 
-static struct pnp_protocol pnpacpi_protocol = {
+struct pnp_protocol pnpacpi_protocol = {
 	.name	 = "Plug and Play ACPI",
 	.get	 = pnpacpi_get_resources,
 	.set	 = pnpacpi_set_resources,
@@ -147,6 +154,7 @@ static struct pnp_protocol pnpacpi_protocol = {
 	.resume = pnpacpi_resume,
 #endif
 };
+EXPORT_SYMBOL(pnpacpi_protocol);
 
 static int __init pnpacpi_add_device(struct acpi_device *device)
 {
@@ -168,7 +176,7 @@ static int __init pnpacpi_add_device(struct acpi_device *device)
 	if (!dev)
 		return -ENOMEM;
 
-	dev->data = device->handle;
+	dev->data = device;
 	/* .enabled means the device can decode the resources */
 	dev->active = device->status.enabled;
 	status = acpi_get_handle(device->handle, "_SRS", &temp);
diff --git a/drivers/pnp/pnpacpi/rsparser.c b/drivers/pnp/pnpacpi/rsparser.c
index ef3a2cd3a7a0..5702b2c8691f 100644
--- a/drivers/pnp/pnpacpi/rsparser.c
+++ b/drivers/pnp/pnpacpi/rsparser.c
@@ -465,7 +465,8 @@ static acpi_status pnpacpi_allocated_resource(struct acpi_resource *res,
 
 int pnpacpi_parse_allocated_resource(struct pnp_dev *dev)
 {
-	acpi_handle handle = dev->data;
+	struct acpi_device *acpi_dev = dev->data;
+	acpi_handle handle = acpi_dev->handle;
 	acpi_status status;
 
 	pnp_dbg(&dev->dev, "parse allocated resources\n");
@@ -773,7 +774,8 @@ static __init acpi_status pnpacpi_option_resource(struct acpi_resource *res,
 
 int __init pnpacpi_parse_resource_option_data(struct pnp_dev *dev)
 {
-	acpi_handle handle = dev->data;
+	struct acpi_device *acpi_dev = dev->data;
+	acpi_handle handle = acpi_dev->handle;
 	acpi_status status;
 	struct acpipnp_parse_option_s parse_data;
 
@@ -845,7 +847,8 @@ static acpi_status pnpacpi_type_resources(struct acpi_resource *res, void *data)
 int pnpacpi_build_resource_template(struct pnp_dev *dev,
 				    struct acpi_buffer *buffer)
 {
-	acpi_handle handle = dev->data;
+	struct acpi_device *acpi_dev = dev->data;
+	acpi_handle handle = acpi_dev->handle;
 	struct acpi_resource *resource;
 	int res_cnt = 0;
 	acpi_status status;
diff --git a/drivers/pnp/pnpbios/proc.c b/drivers/pnp/pnpbios/proc.c
index b35d921bac6e..2d8ac43f78e8 100644
--- a/drivers/pnp/pnpbios/proc.c
+++ b/drivers/pnp/pnpbios/proc.c
@@ -24,6 +24,7 @@
 #include <linux/types.h>
 #include <linux/proc_fs.h>
 #include <linux/pnp.h>
+#include <linux/seq_file.h>
 #include <linux/init.h>
 
 #include <asm/uaccess.h>
@@ -33,42 +34,65 @@
 static struct proc_dir_entry *proc_pnp = NULL;
 static struct proc_dir_entry *proc_pnp_boot = NULL;
 
-static int proc_read_pnpconfig(char *buf, char **start, off_t pos,
-			       int count, int *eof, void *data)
+static int pnpconfig_proc_show(struct seq_file *m, void *v)
 {
 	struct pnp_isa_config_struc pnps;
 
 	if (pnp_bios_isapnp_config(&pnps))
 		return -EIO;
-	return snprintf(buf, count,
-			"structure_revision %d\n"
-			"number_of_CSNs %d\n"
-			"ISA_read_data_port 0x%x\n",
-			pnps.revision, pnps.no_csns, pnps.isa_rd_data_port);
+	seq_printf(m, "structure_revision %d\n"
+		      "number_of_CSNs %d\n"
+		      "ISA_read_data_port 0x%x\n",
+		   pnps.revision, pnps.no_csns, pnps.isa_rd_data_port);
+	return 0;
 }
 
-static int proc_read_escdinfo(char *buf, char **start, off_t pos,
-			      int count, int *eof, void *data)
+static int pnpconfig_proc_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, pnpconfig_proc_show, NULL);
+}
+
+static const struct file_operations pnpconfig_proc_fops = {
+	.owner		= THIS_MODULE,
+	.open		= pnpconfig_proc_open,
+	.read		= seq_read,
+	.llseek		= seq_lseek,
+	.release	= single_release,
+};
+
+static int escd_info_proc_show(struct seq_file *m, void *v)
 {
 	struct escd_info_struc escd;
 
 	if (pnp_bios_escd_info(&escd))
 		return -EIO;
-	return snprintf(buf, count,
-			"min_ESCD_write_size %d\n"
+	seq_printf(m, "min_ESCD_write_size %d\n"
 			"ESCD_size %d\n"
 			"NVRAM_base 0x%x\n",
 			escd.min_escd_write_size,
 			escd.escd_size, escd.nv_storage_base);
+	return 0;
 }
 
+static int escd_info_proc_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, escd_info_proc_show, NULL);
+}
+
+static const struct file_operations escd_info_proc_fops = {
+	.owner		= THIS_MODULE,
+	.open		= escd_info_proc_open,
+	.read		= seq_read,
+	.llseek		= seq_lseek,
+	.release	= single_release,
+};
+
 #define MAX_SANE_ESCD_SIZE (32*1024)
-static int proc_read_escd(char *buf, char **start, off_t pos,
-			  int count, int *eof, void *data)
+static int escd_proc_show(struct seq_file *m, void *v)
 {
 	struct escd_info_struc escd;
 	char *tmpbuf;
-	int escd_size, escd_left_to_read, n;
+	int escd_size;
 
 	if (pnp_bios_escd_info(&escd))
 		return -EIO;
@@ -76,7 +100,7 @@ static int proc_read_escd(char *buf, char **start, off_t pos,
 	/* sanity check */
 	if (escd.escd_size > MAX_SANE_ESCD_SIZE) {
 		printk(KERN_ERR
-		       "PnPBIOS: proc_read_escd: ESCD size reported by BIOS escd_info call is too great\n");
+		       "PnPBIOS: %s: ESCD size reported by BIOS escd_info call is too great\n", __func__);
 		return -EFBIG;
 	}
 
@@ -94,56 +118,75 @@ static int proc_read_escd(char *buf, char **start, off_t pos,
 
 	/* sanity check */
 	if (escd_size > MAX_SANE_ESCD_SIZE) {
-		printk(KERN_ERR "PnPBIOS: proc_read_escd: ESCD size reported by"
-				" BIOS read_escd call is too great\n");
+		printk(KERN_ERR "PnPBIOS: %s: ESCD size reported by"
+				" BIOS read_escd call is too great\n", __func__);
 		kfree(tmpbuf);
 		return -EFBIG;
 	}
 
-	escd_left_to_read = escd_size - pos;
-	if (escd_left_to_read < 0)
-		escd_left_to_read = 0;
-	if (escd_left_to_read == 0)
-		*eof = 1;
-	n = min(count, escd_left_to_read);
-	memcpy(buf, tmpbuf + pos, n);
+	seq_write(m, tmpbuf, escd_size);
 	kfree(tmpbuf);
-	*start = buf;
-	return n;
+	return 0;
 }
 
-static int proc_read_legacyres(char *buf, char **start, off_t pos,
-			       int count, int *eof, void *data)
+static int escd_proc_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, escd_proc_show, NULL);
+}
+
+static const struct file_operations escd_proc_fops = {
+	.owner		= THIS_MODULE,
+	.open		= escd_proc_open,
+	.read		= seq_read,
+	.llseek		= seq_lseek,
+	.release	= single_release,
+};
+
+static int pnp_legacyres_proc_show(struct seq_file *m, void *v)
 {
-	/* Assume that the following won't overflow the buffer */
-	if (pnp_bios_get_stat_res(buf))
+	void *buf;
+
+	buf = kmalloc(65536, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+	if (pnp_bios_get_stat_res(buf)) {
+		kfree(buf);
 		return -EIO;
+	}
+
+	seq_write(m, buf, 65536);
+	kfree(buf);
+	return 0;
+}
 
-	return count;		// FIXME: Return actual length
+static int pnp_legacyres_proc_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, pnp_legacyres_proc_show, NULL);
 }
 
-static int proc_read_devices(char *buf, char **start, off_t pos,
-			     int count, int *eof, void *data)
+static const struct file_operations pnp_legacyres_proc_fops = {
+	.owner		= THIS_MODULE,
+	.open		= pnp_legacyres_proc_open,
+	.read		= seq_read,
+	.llseek		= seq_lseek,
+	.release	= single_release,
+};
+
+static int pnp_devices_proc_show(struct seq_file *m, void *v)
 {
 	struct pnp_bios_node *node;
 	u8 nodenum;
-	char *p = buf;
-
-	if (pos >= 0xff)
-		return 0;
 
 	node = kzalloc(node_info.max_node_size, GFP_KERNEL);
 	if (!node)
 		return -ENOMEM;
 
-	for (nodenum = pos; nodenum < 0xff;) {
+	for (nodenum = 0; nodenum < 0xff;) {
 		u8 thisnodenum = nodenum;
-		/* 26 = the number of characters per line sprintf'ed */
-		if ((p - buf + 26) > count)
-			break;
+
 		if (pnp_bios_get_dev_node(&nodenum, PNPMODE_DYNAMIC, node))
 			break;
-		p += sprintf(p, "%02x\t%08x\t%02x:%02x:%02x\t%04x\n",
+		seq_printf(m, "%02x\t%08x\t%02x:%02x:%02x\t%04x\n",
 			     node->handle, node->eisa_id,
 			     node->type_code[0], node->type_code[1],
 			     node->type_code[2], node->flags);
@@ -153,20 +196,29 @@ static int proc_read_devices(char *buf, char **start, off_t pos,
 			       "PnPBIOS: proc_read_devices:",
 			       (unsigned int)nodenum,
 			       (unsigned int)thisnodenum);
-			*eof = 1;
 			break;
 		}
 	}
 	kfree(node);
-	if (nodenum == 0xff)
-		*eof = 1;
-	*start = (char *)((off_t) nodenum - pos);
-	return p - buf;
+	return 0;
+}
+
+static int pnp_devices_proc_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, pnp_devices_proc_show, NULL);
 }
 
-static int proc_read_node(char *buf, char **start, off_t pos,
-			  int count, int *eof, void *data)
+static const struct file_operations pnp_devices_proc_fops = {
+	.owner		= THIS_MODULE,
+	.open		= pnp_devices_proc_open,
+	.read		= seq_read,
+	.llseek		= seq_lseek,
+	.release	= single_release,
+};
+
+static int pnpbios_proc_show(struct seq_file *m, void *v)
 {
+	void *data = m->private;
 	struct pnp_bios_node *node;
 	int boot = (long)data >> 8;
 	u8 nodenum = (long)data;
@@ -180,14 +232,20 @@ static int proc_read_node(char *buf, char **start, off_t pos,
 		return -EIO;
 	}
 	len = node->size - sizeof(struct pnp_bios_node);
-	memcpy(buf, node->data, len);
+	seq_write(m, node->data, len);
 	kfree(node);
-	return len;
+	return 0;
+}
+
+static int pnpbios_proc_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, pnpbios_proc_show, PDE(inode)->data);
 }
 
-static int proc_write_node(struct file *file, const char __user * buf,
-			   unsigned long count, void *data)
+static ssize_t pnpbios_proc_write(struct file *file, const char __user *buf,
+				  size_t count, loff_t *pos)
 {
+	void *data = PDE(file->f_path.dentry->d_inode)->data;
 	struct pnp_bios_node *node;
 	int boot = (long)data >> 8;
 	u8 nodenum = (long)data;
@@ -218,34 +276,33 @@ out:
 	return ret;
 }
 
+static const struct file_operations pnpbios_proc_fops = {
+	.owner		= THIS_MODULE,
+	.open		= pnpbios_proc_open,
+	.read		= seq_read,
+	.llseek		= seq_lseek,
+	.release	= single_release,
+	.write		= pnpbios_proc_write,
+};
+
 int pnpbios_interface_attach_device(struct pnp_bios_node *node)
 {
 	char name[3];
-	struct proc_dir_entry *ent;
 
 	sprintf(name, "%02x", node->handle);
 
 	if (!proc_pnp)
 		return -EIO;
 	if (!pnpbios_dont_use_current_config) {
-		ent = create_proc_entry(name, 0, proc_pnp);
-		if (ent) {
-			ent->read_proc = proc_read_node;
-			ent->write_proc = proc_write_node;
-			ent->data = (void *)(long)(node->handle);
-		}
+		proc_create_data(name, 0644, proc_pnp, &pnpbios_proc_fops,
+				 (void *)(long)(node->handle));
 	}
 
 	if (!proc_pnp_boot)
 		return -EIO;
-	ent = create_proc_entry(name, 0, proc_pnp_boot);
-	if (ent) {
-		ent->read_proc = proc_read_node;
-		ent->write_proc = proc_write_node;
-		ent->data = (void *)(long)(node->handle + 0x100);
+	if (proc_create_data(name, 0644, proc_pnp_boot, &pnpbios_proc_fops,
+			     (void *)(long)(node->handle + 0x100)))
 		return 0;
-	}
-
 	return -EIO;
 }
 
@@ -262,14 +319,11 @@ int __init pnpbios_proc_init(void)
 	proc_pnp_boot = proc_mkdir("boot", proc_pnp);
 	if (!proc_pnp_boot)
 		return -EIO;
-	create_proc_read_entry("devices", 0, proc_pnp, proc_read_devices, NULL);
-	create_proc_read_entry("configuration_info", 0, proc_pnp,
-			       proc_read_pnpconfig, NULL);
-	create_proc_read_entry("escd_info", 0, proc_pnp, proc_read_escdinfo,
-			       NULL);
-	create_proc_read_entry("escd", S_IRUSR, proc_pnp, proc_read_escd, NULL);
-	create_proc_read_entry("legacy_device_resources", 0, proc_pnp,
-			       proc_read_legacyres, NULL);
+	proc_create("devices", 0, proc_pnp, &pnp_devices_proc_fops);
+	proc_create("configuration_info", 0, proc_pnp, &pnpconfig_proc_fops);
+	proc_create("escd_info", 0, proc_pnp, &escd_info_proc_fops);
+	proc_create("escd", S_IRUSR, proc_pnp, &escd_proc_fops);
+	proc_create("legacy_device_resources", 0, proc_pnp, &pnp_legacyres_proc_fops);
 
 	return 0;
 }
diff --git a/drivers/pnp/pnpbios/rsparser.c b/drivers/pnp/pnpbios/rsparser.c
index 87b4f49a5251..a5135ebe5f07 100644
--- a/drivers/pnp/pnpbios/rsparser.c
+++ b/drivers/pnp/pnpbios/rsparser.c
@@ -191,7 +191,7 @@ static unsigned char *pnpbios_parse_allocated_resource_data(struct pnp_dev *dev,
 			return (unsigned char *)p;
 			break;
 
-		default:	/* an unkown tag */
+		default:	/* an unknown tag */
 len_err:
 			dev_err(&dev->dev, "unknown tag %#x length %d\n",
 				tag, len);
@@ -405,7 +405,7 @@ pnpbios_parse_resource_option_data(unsigned char *p, unsigned char *end,
 		case SMALL_TAG_END:
 			return p + 2;
 
-		default:	/* an unkown tag */
+		default:	/* an unknown tag */
 len_err:
 			dev_err(&dev->dev, "unknown tag %#x length %d\n",
 				tag, len);
@@ -475,7 +475,7 @@ static unsigned char *pnpbios_parse_compatible_ids(unsigned char *p,
 			return (unsigned char *)p;
 			break;
 
-		default:	/* an unkown tag */
+		default:	/* an unknown tag */
 len_err:
 			dev_err(&dev->dev, "unknown tag %#x length %d\n",
 				tag, len);
@@ -744,7 +744,7 @@ static unsigned char *pnpbios_encode_allocated_resource_data(struct pnp_dev
 			return (unsigned char *)p;
 			break;
 
-		default:	/* an unkown tag */
+		default:	/* an unknown tag */
 len_err:
 			dev_err(&dev->dev, "unknown tag %#x length %d\n",
 				tag, len);
diff --git a/drivers/pnp/quirks.c b/drivers/pnp/quirks.c
index 8473fe5ed7ff..dfbd5a6cc58b 100644
--- a/drivers/pnp/quirks.c
+++ b/drivers/pnp/quirks.c
@@ -285,15 +285,10 @@ static void quirk_system_pci_resources(struct pnp_dev *dev)
 				 * the PCI region, and that might prevent a PCI
 				 * driver from requesting its resources.
 				 */
-				dev_warn(&dev->dev, "%s resource "
-					"(0x%llx-0x%llx) overlaps %s BAR %d "
-					"(0x%llx-0x%llx), disabling\n",
-					pnp_resource_type_name(res),
-					(unsigned long long) pnp_start,
-					(unsigned long long) pnp_end,
-					pci_name(pdev), i,
-					(unsigned long long) pci_start,
-					(unsigned long long) pci_end);
+				dev_warn(&dev->dev,
+					 "disabling %pR because it overlaps "
+					 "%s BAR %d %pR\n", res,
+					 pci_name(pdev), i, &pdev->resource[i]);
 				res->flags |= IORESOURCE_DISABLED;
 			}
 		}
diff --git a/drivers/pnp/resource.c b/drivers/pnp/resource.c
index ba9765427886..64d0596bafb5 100644
--- a/drivers/pnp/resource.c
+++ b/drivers/pnp/resource.c
@@ -517,7 +517,7 @@ struct pnp_resource *pnp_add_irq_resource(struct pnp_dev *dev, int irq,
 	res->start = irq;
 	res->end = irq;
 
-	pnp_dbg(&dev->dev, "  add irq %d flags %#x\n", irq, flags);
+	pnp_dbg(&dev->dev, "  add %pr\n", res);
 	return pnp_res;
 }
 
@@ -538,7 +538,7 @@ struct pnp_resource *pnp_add_dma_resource(struct pnp_dev *dev, int dma,
 	res->start = dma;
 	res->end = dma;
 
-	pnp_dbg(&dev->dev, "  add dma %d flags %#x\n", dma, flags);
+	pnp_dbg(&dev->dev, "  add %pr\n", res);
 	return pnp_res;
 }
 
@@ -562,8 +562,7 @@ struct pnp_resource *pnp_add_io_resource(struct pnp_dev *dev,
 	res->start = start;
 	res->end = end;
 
-	pnp_dbg(&dev->dev, "  add io  %#llx-%#llx flags %#x\n",
-		(unsigned long long) start, (unsigned long long) end, flags);
+	pnp_dbg(&dev->dev, "  add %pr\n", res);
 	return pnp_res;
 }
 
@@ -587,8 +586,7 @@ struct pnp_resource *pnp_add_mem_resource(struct pnp_dev *dev,
 	res->start = start;
 	res->end = end;
 
-	pnp_dbg(&dev->dev, "  add mem %#llx-%#llx flags %#x\n",
-		(unsigned long long) start, (unsigned long long) end, flags);
+	pnp_dbg(&dev->dev, "  add %pr\n", res);
 	return pnp_res;
 }
 
diff --git a/drivers/pnp/support.c b/drivers/pnp/support.c
index 63087d5ce609..9585c1c1cc36 100644
--- a/drivers/pnp/support.c
+++ b/drivers/pnp/support.c
@@ -75,47 +75,14 @@ char *pnp_resource_type_name(struct resource *res)
 
 void dbg_pnp_show_resources(struct pnp_dev *dev, char *desc)
 {
-	char buf[128];
-	int len;
 	struct pnp_resource *pnp_res;
-	struct resource *res;
 
-	if (list_empty(&dev->resources)) {
+	if (list_empty(&dev->resources))
 		pnp_dbg(&dev->dev, "%s: no current resources\n", desc);
-		return;
-	}
-
-	pnp_dbg(&dev->dev, "%s: current resources:\n", desc);
-	list_for_each_entry(pnp_res, &dev->resources, list) {
-		res = &pnp_res->res;
-		len = 0;
-
-		len += scnprintf(buf + len, sizeof(buf) - len, "  %-3s ",
-				 pnp_resource_type_name(res));
-
-		if (res->flags & IORESOURCE_DISABLED) {
-			pnp_dbg(&dev->dev, "%sdisabled\n", buf);
-			continue;
-		}
-
-		switch (pnp_resource_type(res)) {
-		case IORESOURCE_IO:
-		case IORESOURCE_MEM:
-			len += scnprintf(buf + len, sizeof(buf) - len,
-					 "%#llx-%#llx flags %#lx",
-					 (unsigned long long) res->start,
-					 (unsigned long long) res->end,
-					 res->flags);
-			break;
-		case IORESOURCE_IRQ:
-		case IORESOURCE_DMA:
-			len += scnprintf(buf + len, sizeof(buf) - len,
-					 "%lld flags %#lx",
-					 (unsigned long long) res->start,
-					 res->flags);
-			break;
-		}
-		pnp_dbg(&dev->dev, "%s\n", buf);
+	else {
+		pnp_dbg(&dev->dev, "%s: current resources:\n", desc);
+		list_for_each_entry(pnp_res, &dev->resources, list)
+			pnp_dbg(&dev->dev, "%pr\n", &pnp_res->res);
 	}
 }
 
diff --git a/drivers/pnp/system.c b/drivers/pnp/system.c
index 59b90922da8c..49c1720df59a 100644
--- a/drivers/pnp/system.c
+++ b/drivers/pnp/system.c
@@ -22,11 +22,11 @@ static const struct pnp_device_id pnp_dev_table[] = {
 	{"", 0}
 };
 
-static void reserve_range(struct pnp_dev *dev, resource_size_t start,
-			  resource_size_t end, int port)
+static void reserve_range(struct pnp_dev *dev, struct resource *r, int port)
 {
 	char *regionid;
 	const char *pnpid = dev_name(&dev->dev);
+	resource_size_t start = r->start, end = r->end;
 	struct resource *res;
 
 	regionid = kmalloc(16, GFP_KERNEL);
@@ -48,10 +48,8 @@ static void reserve_range(struct pnp_dev *dev, resource_size_t start,
 	 * example do reserve stuff they know about too, so we may well
 	 * have double reservations.
 	 */
-	dev_info(&dev->dev, "%s range 0x%llx-0x%llx %s reserved\n",
-		port ? "ioport" : "iomem",
-		(unsigned long long) start, (unsigned long long) end,
-		res ? "has been" : "could not be");
+	dev_info(&dev->dev, "%pR %s reserved\n", r,
+		 res ? "has been" : "could not be");
 }
 
 static void reserve_resources_of_dev(struct pnp_dev *dev)
@@ -77,14 +75,14 @@ static void reserve_resources_of_dev(struct pnp_dev *dev)
 		if (res->end < res->start)
 			continue;	/* invalid */
 
-		reserve_range(dev, res->start, res->end, 1);
+		reserve_range(dev, res, 1);
 	}
 
 	for (i = 0; (res = pnp_get_resource(dev, IORESOURCE_MEM, i)); i++) {
 		if (res->flags & IORESOURCE_DISABLED)
 			continue;
 
-		reserve_range(dev, res->start, res->end, 0);
+		reserve_range(dev, res, 0);
 	}
 }
 
diff --git a/drivers/power/Kconfig b/drivers/power/Kconfig
index 118674925516..d4b3d67f0548 100644
--- a/drivers/power/Kconfig
+++ b/drivers/power/Kconfig
@@ -29,6 +29,13 @@ config APM_POWER
 	  Say Y here to enable support APM status emulation using
 	  battery class devices.
 
+config WM831X_BACKUP
+	tristate "WM831X backup battery charger support"
+	depends on MFD_WM831X
+	help
+	  Say Y here to enable support for the backup battery charger
+	  in the Wolfson Microelectronics WM831x PMICs.
+
 config WM831X_POWER
 	tristate "WM831X PMU support"
 	depends on MFD_WM831X
diff --git a/drivers/power/Makefile b/drivers/power/Makefile
index 356cdfd3c8b2..573597c683b4 100644
--- a/drivers/power/Makefile
+++ b/drivers/power/Makefile
@@ -16,6 +16,7 @@ obj-$(CONFIG_POWER_SUPPLY)	+= power_supply.o
 
 obj-$(CONFIG_PDA_POWER)		+= pda_power.o
 obj-$(CONFIG_APM_POWER)		+= apm_power.o
+obj-$(CONFIG_WM831X_BACKUP)	+= wm831x_backup.o
 obj-$(CONFIG_WM831X_POWER)	+= wm831x_power.o
 obj-$(CONFIG_WM8350_POWER)	+= wm8350_power.o
 
diff --git a/drivers/power/pcf50633-charger.c b/drivers/power/pcf50633-charger.c
index e8b278f71781..ea3fdfaca90d 100644
--- a/drivers/power/pcf50633-charger.c
+++ b/drivers/power/pcf50633-charger.c
@@ -29,15 +29,12 @@
 struct pcf50633_mbc {
 	struct pcf50633 *pcf;
 
-	int adapter_active;
 	int adapter_online;
-	int usb_active;
 	int usb_online;
 
 	struct power_supply usb;
 	struct power_supply adapter;
-
-	struct delayed_work charging_restart_work;
+	struct power_supply ac;
 };
 
 int pcf50633_mbc_usb_curlim_set(struct pcf50633 *pcf, int ma)
@@ -47,16 +44,21 @@ int pcf50633_mbc_usb_curlim_set(struct pcf50633 *pcf, int ma)
 	u8 bits;
 	int charging_start = 1;
 	u8 mbcs2, chgmod;
+	unsigned int mbcc5;
 
-	if (ma >= 1000)
+	if (ma >= 1000) {
 		bits = PCF50633_MBCC7_USB_1000mA;
-	else if (ma >= 500)
+		ma = 1000;
+	} else if (ma >= 500) {
 		bits = PCF50633_MBCC7_USB_500mA;
-	else if (ma >= 100)
+		ma = 500;
+	} else if (ma >= 100) {
 		bits = PCF50633_MBCC7_USB_100mA;
-	else {
+		ma = 100;
+	} else {
 		bits = PCF50633_MBCC7_USB_SUSPEND;
 		charging_start = 0;
+		ma = 0;
 	}
 
 	ret = pcf50633_reg_set_bit_mask(pcf, PCF50633_REG_MBCC7,
@@ -66,21 +68,40 @@ int pcf50633_mbc_usb_curlim_set(struct pcf50633 *pcf, int ma)
 	else
 		dev_info(pcf->dev, "usb curlim to %d mA\n", ma);
 
-	/* Manual charging start */
-	mbcs2 = pcf50633_reg_read(pcf, PCF50633_REG_MBCS2);
+	/*
+	 * We limit the charging current to be the USB current limit.
+	 * The reason is that on pcf50633, when it enters PMU Standby mode,
+	 * which it does when the device goes "off", the USB current limit
+	 * reverts to the variant default.  In at least one common case, that
+	 * default is 500mA.  By setting the charging current to be the same
+	 * as the USB limit we set here before PMU standby, we enforce it only
+	 * using the correct amount of current even when the USB current limit
+	 * gets reset to the wrong thing
+	 */
+
+	if (mbc->pcf->pdata->charger_reference_current_ma) {
+		mbcc5 = (ma << 8) / mbc->pcf->pdata->charger_reference_current_ma;
+		if (mbcc5 > 255)
+			mbcc5 = 255;
+		pcf50633_reg_write(mbc->pcf, PCF50633_REG_MBCC5, mbcc5);
+	}
+
+	mbcs2 = pcf50633_reg_read(mbc->pcf, PCF50633_REG_MBCS2);
 	chgmod = (mbcs2 & PCF50633_MBCS2_MBC_MASK);
 
 	/* If chgmod == BATFULL, setting chgena has no effect.
-	 * We need to set resume instead.
+	 * Datasheet says we need to set resume instead but when autoresume is
+	 * used resume doesn't work. Clear and set chgena instead.
 	 */
 	if (chgmod != PCF50633_MBCS2_MBC_BAT_FULL)
 		pcf50633_reg_set_bit_mask(pcf, PCF50633_REG_MBCC1,
 				PCF50633_MBCC1_CHGENA, PCF50633_MBCC1_CHGENA);
-	else
+	else {
+		pcf50633_reg_clear_bits(pcf, PCF50633_REG_MBCC1,
+				PCF50633_MBCC1_CHGENA);
 		pcf50633_reg_set_bit_mask(pcf, PCF50633_REG_MBCC1,
-				PCF50633_MBCC1_RESUME, PCF50633_MBCC1_RESUME);
-
-	mbc->usb_active = charging_start;
+				PCF50633_MBCC1_CHGENA, PCF50633_MBCC1_CHGENA);
+	}
 
 	power_supply_changed(&mbc->usb);
 
@@ -92,20 +113,44 @@ int pcf50633_mbc_get_status(struct pcf50633 *pcf)
 {
 	struct pcf50633_mbc *mbc  = platform_get_drvdata(pcf->mbc_pdev);
 	int status = 0;
+	u8 chgmod;
+
+	if (!mbc)
+		return 0;
+
+	chgmod = pcf50633_reg_read(mbc->pcf, PCF50633_REG_MBCS2)
+		& PCF50633_MBCS2_MBC_MASK;
 
 	if (mbc->usb_online)
 		status |= PCF50633_MBC_USB_ONLINE;
-	if (mbc->usb_active)
+	if (chgmod == PCF50633_MBCS2_MBC_USB_PRE ||
+	    chgmod == PCF50633_MBCS2_MBC_USB_PRE_WAIT ||
+	    chgmod == PCF50633_MBCS2_MBC_USB_FAST ||
+	    chgmod == PCF50633_MBCS2_MBC_USB_FAST_WAIT)
 		status |= PCF50633_MBC_USB_ACTIVE;
 	if (mbc->adapter_online)
 		status |= PCF50633_MBC_ADAPTER_ONLINE;
-	if (mbc->adapter_active)
+	if (chgmod == PCF50633_MBCS2_MBC_ADP_PRE ||
+	    chgmod == PCF50633_MBCS2_MBC_ADP_PRE_WAIT ||
+	    chgmod == PCF50633_MBCS2_MBC_ADP_FAST ||
+	    chgmod == PCF50633_MBCS2_MBC_ADP_FAST_WAIT)
 		status |= PCF50633_MBC_ADAPTER_ACTIVE;
 
 	return status;
 }
 EXPORT_SYMBOL_GPL(pcf50633_mbc_get_status);
 
+int pcf50633_mbc_get_usb_online_status(struct pcf50633 *pcf)
+{
+	struct pcf50633_mbc *mbc  = platform_get_drvdata(pcf->mbc_pdev);
+
+	if (!mbc)
+		return 0;
+
+	return mbc->usb_online;
+}
+EXPORT_SYMBOL_GPL(pcf50633_mbc_get_usb_online_status);
+
 static ssize_t
 show_chgmode(struct device *dev, struct device_attribute *attr, char *buf)
 {
@@ -156,9 +201,55 @@ static ssize_t set_usblim(struct device *dev,
 
 static DEVICE_ATTR(usb_curlim, S_IRUGO | S_IWUSR, show_usblim, set_usblim);
 
+static ssize_t
+show_chglim(struct device *dev, struct device_attribute *attr, char *buf)
+{
+	struct pcf50633_mbc *mbc = dev_get_drvdata(dev);
+	u8 mbcc5 = pcf50633_reg_read(mbc->pcf, PCF50633_REG_MBCC5);
+	unsigned int ma;
+
+	if (!mbc->pcf->pdata->charger_reference_current_ma)
+		return -ENODEV;
+
+	ma = (mbc->pcf->pdata->charger_reference_current_ma *  mbcc5) >> 8;
+
+	return sprintf(buf, "%u\n", ma);
+}
+
+static ssize_t set_chglim(struct device *dev,
+		struct device_attribute *attr, const char *buf, size_t count)
+{
+	struct pcf50633_mbc *mbc = dev_get_drvdata(dev);
+	unsigned long ma;
+	unsigned int mbcc5;
+	int ret;
+
+	if (!mbc->pcf->pdata->charger_reference_current_ma)
+		return -ENODEV;
+
+	ret = strict_strtoul(buf, 10, &ma);
+	if (ret)
+		return -EINVAL;
+
+	mbcc5 = (ma << 8) / mbc->pcf->pdata->charger_reference_current_ma;
+	if (mbcc5 > 255)
+		mbcc5 = 255;
+	pcf50633_reg_write(mbc->pcf, PCF50633_REG_MBCC5, mbcc5);
+
+	return count;
+}
+
+/*
+ * This attribute allows to change MBC charging limit on the fly
+ * independently of usb current limit. It also gets set automatically every
+ * time usb current limit is changed.
+ */
+static DEVICE_ATTR(chg_curlim, S_IRUGO | S_IWUSR, show_chglim, set_chglim);
+
 static struct attribute *pcf50633_mbc_sysfs_entries[] = {
 	&dev_attr_chgmode.attr,
 	&dev_attr_usb_curlim.attr,
+	&dev_attr_chg_curlim.attr,
 	NULL,
 };
 
@@ -167,76 +258,26 @@ static struct attribute_group mbc_attr_group = {
 	.attrs	= pcf50633_mbc_sysfs_entries,
 };
 
-/* MBC state machine switches into charging mode when the battery voltage
- * falls below 96% of a battery float voltage. But the voltage drop in Li-ion
- * batteries is marginal(1~2 %) till about 80% of its capacity - which means,
- * after a BATFULL, charging won't be restarted until 80%.
- *
- * This work_struct function restarts charging at regular intervals to make
- * sure we don't discharge too much
- */
-
-static void pcf50633_mbc_charging_restart(struct work_struct *work)
-{
-	struct pcf50633_mbc *mbc;
-	u8 mbcs2, chgmod;
-
-	mbc = container_of(work, struct pcf50633_mbc,
-				charging_restart_work.work);
-
-	mbcs2 = pcf50633_reg_read(mbc->pcf, PCF50633_REG_MBCS2);
-	chgmod = (mbcs2 & PCF50633_MBCS2_MBC_MASK);
-
-	if (chgmod != PCF50633_MBCS2_MBC_BAT_FULL)
-		return;
-
-	/* Restart charging */
-	pcf50633_reg_set_bit_mask(mbc->pcf, PCF50633_REG_MBCC1,
-				PCF50633_MBCC1_RESUME, PCF50633_MBCC1_RESUME);
-	mbc->usb_active = 1;
-	power_supply_changed(&mbc->usb);
-
-	dev_info(mbc->pcf->dev, "Charging restarted\n");
-}
-
 static void
 pcf50633_mbc_irq_handler(int irq, void *data)
 {
 	struct pcf50633_mbc *mbc = data;
-	int chg_restart_interval =
-			mbc->pcf->pdata->charging_restart_interval;
 
 	/* USB */
 	if (irq == PCF50633_IRQ_USBINS) {
 		mbc->usb_online = 1;
 	} else if (irq == PCF50633_IRQ_USBREM) {
 		mbc->usb_online = 0;
-		mbc->usb_active = 0;
 		pcf50633_mbc_usb_curlim_set(mbc->pcf, 0);
-		cancel_delayed_work_sync(&mbc->charging_restart_work);
 	}
 
 	/* Adapter */
-	if (irq == PCF50633_IRQ_ADPINS) {
+	if (irq == PCF50633_IRQ_ADPINS)
 		mbc->adapter_online = 1;
-		mbc->adapter_active = 1;
-	} else if (irq == PCF50633_IRQ_ADPREM) {
+	else if (irq == PCF50633_IRQ_ADPREM)
 		mbc->adapter_online = 0;
-		mbc->adapter_active = 0;
-	}
-
-	if (irq == PCF50633_IRQ_BATFULL) {
-		mbc->usb_active = 0;
-		mbc->adapter_active = 0;
-
-		if (chg_restart_interval > 0)
-			schedule_delayed_work(&mbc->charging_restart_work,
-							chg_restart_interval);
-	} else if (irq == PCF50633_IRQ_USBLIMON)
-		mbc->usb_active = 0;
-	else if (irq == PCF50633_IRQ_USBLIMOFF)
-		mbc->usb_active = 1;
 
+	power_supply_changed(&mbc->ac);
 	power_supply_changed(&mbc->usb);
 	power_supply_changed(&mbc->adapter);
 
@@ -269,10 +310,34 @@ static int usb_get_property(struct power_supply *psy,
 {
 	struct pcf50633_mbc *mbc = container_of(psy, struct pcf50633_mbc, usb);
 	int ret = 0;
+	u8 usblim = pcf50633_reg_read(mbc->pcf, PCF50633_REG_MBCC7) &
+						PCF50633_MBCC7_USB_MASK;
 
 	switch (psp) {
 	case POWER_SUPPLY_PROP_ONLINE:
-		val->intval = mbc->usb_online;
+		val->intval = mbc->usb_online &&
+				(usblim <= PCF50633_MBCC7_USB_500mA);
+		break;
+	default:
+		ret = -EINVAL;
+		break;
+	}
+	return ret;
+}
+
+static int ac_get_property(struct power_supply *psy,
+			enum power_supply_property psp,
+			union power_supply_propval *val)
+{
+	struct pcf50633_mbc *mbc = container_of(psy, struct pcf50633_mbc, ac);
+	int ret = 0;
+	u8 usblim = pcf50633_reg_read(mbc->pcf, PCF50633_REG_MBCC7) &
+						PCF50633_MBCC7_USB_MASK;
+
+	switch (psp) {
+	case POWER_SUPPLY_PROP_ONLINE:
+		val->intval = mbc->usb_online &&
+				(usblim == PCF50633_MBCC7_USB_1000mA);
 		break;
 	default:
 		ret = -EINVAL;
@@ -303,7 +368,6 @@ static const u8 mbc_irq_handlers[] = {
 static int __devinit pcf50633_mbc_probe(struct platform_device *pdev)
 {
 	struct pcf50633_mbc *mbc;
-	struct pcf50633_subdev_pdata *pdata = pdev->dev.platform_data;
 	int ret;
 	int i;
 	u8 mbcs1;
@@ -313,7 +377,7 @@ static int __devinit pcf50633_mbc_probe(struct platform_device *pdev)
 		return -ENOMEM;
 
 	platform_set_drvdata(pdev, mbc);
-	mbc->pcf = pdata->pcf;
+	mbc->pcf = dev_to_pcf50633(pdev->dev.parent);
 
 	/* Set up IRQ handlers */
 	for (i = 0; i < ARRAY_SIZE(mbc_irq_handlers); i++)
@@ -337,6 +401,14 @@ static int __devinit pcf50633_mbc_probe(struct platform_device *pdev)
 	mbc->usb.supplied_to		= mbc->pcf->pdata->batteries;
 	mbc->usb.num_supplicants	= mbc->pcf->pdata->num_batteries;
 
+	mbc->ac.name			= "ac";
+	mbc->ac.type			= POWER_SUPPLY_TYPE_MAINS;
+	mbc->ac.properties		= power_props;
+	mbc->ac.num_properties		= ARRAY_SIZE(power_props);
+	mbc->ac.get_property		= ac_get_property;
+	mbc->ac.supplied_to		= mbc->pcf->pdata->batteries;
+	mbc->ac.num_supplicants		= mbc->pcf->pdata->num_batteries;
+
 	ret = power_supply_register(&pdev->dev, &mbc->adapter);
 	if (ret) {
 		dev_err(mbc->pcf->dev, "failed to register adapter\n");
@@ -352,8 +424,14 @@ static int __devinit pcf50633_mbc_probe(struct platform_device *pdev)
 		return ret;
 	}
 
-	INIT_DELAYED_WORK(&mbc->charging_restart_work,
-				pcf50633_mbc_charging_restart);
+	ret = power_supply_register(&pdev->dev, &mbc->ac);
+	if (ret) {
+		dev_err(mbc->pcf->dev, "failed to register ac\n");
+		power_supply_unregister(&mbc->adapter);
+		power_supply_unregister(&mbc->usb);
+		kfree(mbc);
+		return ret;
+	}
 
 	ret = sysfs_create_group(&pdev->dev.kobj, &mbc_attr_group);
 	if (ret)
@@ -379,8 +457,7 @@ static int __devexit pcf50633_mbc_remove(struct platform_device *pdev)
 
 	power_supply_unregister(&mbc->usb);
 	power_supply_unregister(&mbc->adapter);
-
-	cancel_delayed_work_sync(&mbc->charging_restart_work);
+	power_supply_unregister(&mbc->ac);
 
 	kfree(mbc);
 
diff --git a/drivers/power/pmu_battery.c b/drivers/power/pmu_battery.c
index 9346a862f1f2..9c87ad564803 100644
--- a/drivers/power/pmu_battery.c
+++ b/drivers/power/pmu_battery.c
@@ -89,6 +89,8 @@ static int pmu_bat_get_property(struct power_supply *psy,
 	case POWER_SUPPLY_PROP_STATUS:
 		if (pbi->flags & PMU_BATT_CHARGING)
 			val->intval = POWER_SUPPLY_STATUS_CHARGING;
+		else if (pmu_power_flags & PMU_PWR_AC_PRESENT)
+			val->intval = POWER_SUPPLY_STATUS_FULL;
 		else
 			val->intval = POWER_SUPPLY_STATUS_DISCHARGING;
 		break;
diff --git a/drivers/power/power_supply_sysfs.c b/drivers/power/power_supply_sysfs.c
index 08144393d64b..c790e0c77d4b 100644
--- a/drivers/power/power_supply_sysfs.c
+++ b/drivers/power/power_supply_sysfs.c
@@ -65,7 +65,10 @@ static ssize_t power_supply_show_property(struct device *dev,
 	ret = psy->get_property(psy, off, &value);
 
 	if (ret < 0) {
-		if (ret != -ENODEV)
+		if (ret == -ENODATA)
+			dev_dbg(dev, "driver has no data for `%s' property\n",
+				attr->attr.name);
+		else if (ret != -ENODEV)
 			dev_err(dev, "driver failed to report `%s' property\n",
 				attr->attr.name);
 		return ret;
diff --git a/drivers/power/wm831x_backup.c b/drivers/power/wm831x_backup.c
new file mode 100644
index 000000000000..bf4f387a8009
--- /dev/null
+++ b/drivers/power/wm831x_backup.c
@@ -0,0 +1,233 @@
+/*
+ * Backup battery driver for Wolfson Microelectronics wm831x PMICs
+ *
+ * Copyright 2009 Wolfson Microelectronics PLC.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/module.h>
+#include <linux/err.h>
+#include <linux/platform_device.h>
+#include <linux/power_supply.h>
+
+#include <linux/mfd/wm831x/core.h>
+#include <linux/mfd/wm831x/auxadc.h>
+#include <linux/mfd/wm831x/pmu.h>
+#include <linux/mfd/wm831x/pdata.h>
+
+struct wm831x_backup {
+	struct wm831x *wm831x;
+	struct power_supply backup;
+};
+
+static int wm831x_backup_read_voltage(struct wm831x *wm831x,
+				     enum wm831x_auxadc src,
+				     union power_supply_propval *val)
+{
+	int ret;
+
+	ret = wm831x_auxadc_read_uv(wm831x, src);
+	if (ret >= 0)
+		val->intval = ret;
+
+	return ret;
+}
+
+/*********************************************************************
+ *		Backup supply properties
+ *********************************************************************/
+
+static void wm831x_config_backup(struct wm831x *wm831x)
+{
+	struct wm831x_pdata *wm831x_pdata = wm831x->dev->platform_data;
+	struct wm831x_backup_pdata *pdata;
+	int ret, reg;
+
+	if (!wm831x_pdata || !wm831x_pdata->backup) {
+		dev_warn(wm831x->dev,
+			 "No backup battery charger configuration\n");
+		return;
+	}
+
+	pdata = wm831x_pdata->backup;
+
+	reg = 0;
+
+	if (pdata->charger_enable)
+		reg |= WM831X_BKUP_CHG_ENA | WM831X_BKUP_BATT_DET_ENA;
+	if (pdata->no_constant_voltage)
+		reg |= WM831X_BKUP_CHG_MODE;
+
+	switch (pdata->vlim) {
+	case 2500:
+		break;
+	case 3100:
+		reg |= WM831X_BKUP_CHG_VLIM;
+		break;
+	default:
+		dev_err(wm831x->dev, "Invalid backup voltage limit %dmV\n",
+			pdata->vlim);
+	}
+
+	switch (pdata->ilim) {
+	case 100:
+		break;
+	case 200:
+		reg |= 1;
+		break;
+	case 300:
+		reg |= 2;
+		break;
+	case 400:
+		reg |= 3;
+		break;
+	default:
+		dev_err(wm831x->dev, "Invalid backup current limit %duA\n",
+			pdata->ilim);
+	}
+
+	ret = wm831x_reg_unlock(wm831x);
+	if (ret != 0) {
+		dev_err(wm831x->dev, "Failed to unlock registers: %d\n", ret);
+		return;
+	}
+
+	ret = wm831x_set_bits(wm831x, WM831X_BACKUP_CHARGER_CONTROL,
+			      WM831X_BKUP_CHG_ENA_MASK |
+			      WM831X_BKUP_CHG_MODE_MASK |
+			      WM831X_BKUP_BATT_DET_ENA_MASK |
+			      WM831X_BKUP_CHG_VLIM_MASK |
+			      WM831X_BKUP_CHG_ILIM_MASK,
+			      reg);
+	if (ret != 0)
+		dev_err(wm831x->dev,
+			"Failed to set backup charger config: %d\n", ret);
+
+	wm831x_reg_lock(wm831x);
+}
+
+static int wm831x_backup_get_prop(struct power_supply *psy,
+				  enum power_supply_property psp,
+				  union power_supply_propval *val)
+{
+	struct wm831x_backup *devdata = dev_get_drvdata(psy->dev->parent);
+	struct wm831x *wm831x = devdata->wm831x;
+	int ret = 0;
+
+	ret = wm831x_reg_read(wm831x, WM831X_BACKUP_CHARGER_CONTROL);
+	if (ret < 0)
+		return ret;
+
+	switch (psp) {
+	case POWER_SUPPLY_PROP_STATUS:
+		if (ret & WM831X_BKUP_CHG_STS)
+			val->intval = POWER_SUPPLY_STATUS_CHARGING;
+		else
+			val->intval = POWER_SUPPLY_STATUS_NOT_CHARGING;
+		break;
+
+	case POWER_SUPPLY_PROP_VOLTAGE_NOW:
+		ret = wm831x_backup_read_voltage(wm831x, WM831X_AUX_BKUP_BATT,
+						val);
+		break;
+
+	case POWER_SUPPLY_PROP_PRESENT:
+		if (ret & WM831X_BKUP_CHG_STS)
+			val->intval = 1;
+		else
+			val->intval = 0;
+		break;
+
+	default:
+		ret = -EINVAL;
+		break;
+	}
+
+	return ret;
+}
+
+static enum power_supply_property wm831x_backup_props[] = {
+	POWER_SUPPLY_PROP_STATUS,
+	POWER_SUPPLY_PROP_VOLTAGE_NOW,
+	POWER_SUPPLY_PROP_PRESENT,
+};
+
+/*********************************************************************
+ *		Initialisation
+ *********************************************************************/
+
+static __devinit int wm831x_backup_probe(struct platform_device *pdev)
+{
+	struct wm831x *wm831x = dev_get_drvdata(pdev->dev.parent);
+	struct wm831x_backup *devdata;
+	struct power_supply *backup;
+	int ret;
+
+	devdata = kzalloc(sizeof(struct wm831x_backup), GFP_KERNEL);
+	if (devdata == NULL)
+		return -ENOMEM;
+
+	devdata->wm831x = wm831x;
+	platform_set_drvdata(pdev, devdata);
+
+	backup = &devdata->backup;
+
+	/* We ignore configuration failures since we can still read
+	 * back the status without enabling the charger (which may
+	 * already be enabled anyway).
+	 */
+	wm831x_config_backup(wm831x);
+
+	backup->name = "wm831x-backup";
+	backup->type = POWER_SUPPLY_TYPE_BATTERY;
+	backup->properties = wm831x_backup_props;
+	backup->num_properties = ARRAY_SIZE(wm831x_backup_props);
+	backup->get_property = wm831x_backup_get_prop;
+	ret = power_supply_register(&pdev->dev, backup);
+	if (ret)
+		goto err_kmalloc;
+
+	return ret;
+
+err_kmalloc:
+	kfree(devdata);
+	return ret;
+}
+
+static __devexit int wm831x_backup_remove(struct platform_device *pdev)
+{
+	struct wm831x_backup *devdata = platform_get_drvdata(pdev);
+
+	power_supply_unregister(&devdata->backup);
+	kfree(devdata);
+
+	return 0;
+}
+
+static struct platform_driver wm831x_backup_driver = {
+	.probe = wm831x_backup_probe,
+	.remove = __devexit_p(wm831x_backup_remove),
+	.driver = {
+		.name = "wm831x-backup",
+	},
+};
+
+static int __init wm831x_backup_init(void)
+{
+	return platform_driver_register(&wm831x_backup_driver);
+}
+module_init(wm831x_backup_init);
+
+static void __exit wm831x_backup_exit(void)
+{
+	platform_driver_unregister(&wm831x_backup_driver);
+}
+module_exit(wm831x_backup_exit);
+
+MODULE_DESCRIPTION("Backup battery charger driver for WM831x PMICs");
+MODULE_AUTHOR("Mark Brown <broonie@opensource.wolfsonmicro.com>");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:wm831x-backup");
diff --git a/drivers/power/wm831x_power.c b/drivers/power/wm831x_power.c
index 2a4c8b0b829c..f85e80b1b400 100644
--- a/drivers/power/wm831x_power.c
+++ b/drivers/power/wm831x_power.c
@@ -21,7 +21,6 @@
 struct wm831x_power {
 	struct wm831x *wm831x;
 	struct power_supply wall;
-	struct power_supply backup;
 	struct power_supply usb;
 	struct power_supply battery;
 };
@@ -454,125 +453,6 @@ static irqreturn_t wm831x_bat_irq(int irq, void *data)
 
 
 /*********************************************************************
- *		Backup supply properties
- *********************************************************************/
-
-static void wm831x_config_backup(struct wm831x *wm831x)
-{
-	struct wm831x_pdata *wm831x_pdata = wm831x->dev->platform_data;
-	struct wm831x_backup_pdata *pdata;
-	int ret, reg;
-
-	if (!wm831x_pdata || !wm831x_pdata->backup) {
-		dev_warn(wm831x->dev,
-			 "No backup battery charger configuration\n");
-		return;
-	}
-
-	pdata = wm831x_pdata->backup;
-
-	reg = 0;
-
-	if (pdata->charger_enable)
-		reg |= WM831X_BKUP_CHG_ENA | WM831X_BKUP_BATT_DET_ENA;
-	if (pdata->no_constant_voltage)
-		reg |= WM831X_BKUP_CHG_MODE;
-
-	switch (pdata->vlim) {
-	case 2500:
-		break;
-	case 3100:
-		reg |= WM831X_BKUP_CHG_VLIM;
-		break;
-	default:
-		dev_err(wm831x->dev, "Invalid backup voltage limit %dmV\n",
-			pdata->vlim);
-	}
-
-	switch (pdata->ilim) {
-	case 100:
-		break;
-	case 200:
-		reg |= 1;
-		break;
-	case 300:
-		reg |= 2;
-		break;
-	case 400:
-		reg |= 3;
-		break;
-	default:
-		dev_err(wm831x->dev, "Invalid backup current limit %duA\n",
-			pdata->ilim);
-	}
-
-	ret = wm831x_reg_unlock(wm831x);
-	if (ret != 0) {
-		dev_err(wm831x->dev, "Failed to unlock registers: %d\n", ret);
-		return;
-	}
-
-	ret = wm831x_set_bits(wm831x, WM831X_BACKUP_CHARGER_CONTROL,
-			      WM831X_BKUP_CHG_ENA_MASK |
-			      WM831X_BKUP_CHG_MODE_MASK |
-			      WM831X_BKUP_BATT_DET_ENA_MASK |
-			      WM831X_BKUP_CHG_VLIM_MASK |
-			      WM831X_BKUP_CHG_ILIM_MASK,
-			      reg);
-	if (ret != 0)
-		dev_err(wm831x->dev,
-			"Failed to set backup charger config: %d\n", ret);
-
-	wm831x_reg_lock(wm831x);
-}
-
-static int wm831x_backup_get_prop(struct power_supply *psy,
-				  enum power_supply_property psp,
-				  union power_supply_propval *val)
-{
-	struct wm831x_power *wm831x_power = dev_get_drvdata(psy->dev->parent);
-	struct wm831x *wm831x = wm831x_power->wm831x;
-	int ret = 0;
-
-	ret = wm831x_reg_read(wm831x, WM831X_BACKUP_CHARGER_CONTROL);
-	if (ret < 0)
-		return ret;
-
-	switch (psp) {
-	case POWER_SUPPLY_PROP_STATUS:
-		if (ret & WM831X_BKUP_CHG_STS)
-			val->intval = POWER_SUPPLY_STATUS_CHARGING;
-		else
-			val->intval = POWER_SUPPLY_STATUS_NOT_CHARGING;
-		break;
-
-	case POWER_SUPPLY_PROP_VOLTAGE_NOW:
-		ret = wm831x_power_read_voltage(wm831x, WM831X_AUX_BKUP_BATT,
-						val);
-		break;
-
-	case POWER_SUPPLY_PROP_PRESENT:
-		if (ret & WM831X_BKUP_CHG_STS)
-			val->intval = 1;
-		else
-			val->intval = 0;
-		break;
-
-	default:
-		ret = -EINVAL;
-		break;
-	}
-
-	return ret;
-}
-
-static enum power_supply_property wm831x_backup_props[] = {
-	POWER_SUPPLY_PROP_STATUS,
-	POWER_SUPPLY_PROP_VOLTAGE_NOW,
-	POWER_SUPPLY_PROP_PRESENT,
-};
-
-/*********************************************************************
  *		Initialisation
  *********************************************************************/
 
@@ -595,10 +475,7 @@ static irqreturn_t wm831x_pwr_src_irq(int irq, void *data)
 
 	dev_dbg(wm831x->dev, "Power source changed\n");
 
-	/* Just notify for everything - little harm in overnotifying.
-	 * The backup battery is not a power source while the system
-	 * is running so skip that.
-	 */
+	/* Just notify for everything - little harm in overnotifying. */
 	power_supply_changed(&wm831x_power->battery);
 	power_supply_changed(&wm831x_power->usb);
 	power_supply_changed(&wm831x_power->wall);
@@ -613,7 +490,6 @@ static __devinit int wm831x_power_probe(struct platform_device *pdev)
 	struct power_supply *usb;
 	struct power_supply *battery;
 	struct power_supply *wall;
-	struct power_supply *backup;
 	int ret, irq, i;
 
 	power = kzalloc(sizeof(struct wm831x_power), GFP_KERNEL);
@@ -626,13 +502,11 @@ static __devinit int wm831x_power_probe(struct platform_device *pdev)
 	usb = &power->usb;
 	battery = &power->battery;
 	wall = &power->wall;
-	backup = &power->backup;
 
 	/* We ignore configuration failures since we can still read back
-	 * the status without enabling either of the chargers.
+	 * the status without enabling the charger.
 	 */
 	wm831x_config_battery(wm831x);
-	wm831x_config_backup(wm831x);
 
 	wall->name = "wm831x-wall";
 	wall->type = POWER_SUPPLY_TYPE_MAINS;
@@ -661,15 +535,6 @@ static __devinit int wm831x_power_probe(struct platform_device *pdev)
 	if (ret)
 		goto err_battery;
 
-	backup->name = "wm831x-backup";
-	backup->type = POWER_SUPPLY_TYPE_BATTERY;
-	backup->properties = wm831x_backup_props;
-	backup->num_properties = ARRAY_SIZE(wm831x_backup_props);
-	backup->get_property = wm831x_backup_get_prop;
-	ret = power_supply_register(&pdev->dev, backup);
-	if (ret)
-		goto err_usb;
-
 	irq = platform_get_irq_byname(pdev, "SYSLO");
 	ret = wm831x_request_irq(wm831x, irq, wm831x_syslo_irq,
 				 IRQF_TRIGGER_RISING, "SYSLO",
@@ -677,7 +542,7 @@ static __devinit int wm831x_power_probe(struct platform_device *pdev)
 	if (ret != 0) {
 		dev_err(&pdev->dev, "Failed to request SYSLO IRQ %d: %d\n",
 			irq, ret);
-		goto err_backup;
+		goto err_usb;
 	}
 
 	irq = platform_get_irq_byname(pdev, "PWR SRC");
@@ -716,8 +581,6 @@ err_bat_irq:
 err_syslo:
 	irq = platform_get_irq_byname(pdev, "SYSLO");
 	wm831x_free_irq(wm831x, irq, power);
-err_backup:
-	power_supply_unregister(backup);
 err_usb:
 	power_supply_unregister(usb);
 err_battery:
@@ -746,7 +609,6 @@ static __devexit int wm831x_power_remove(struct platform_device *pdev)
 	irq = platform_get_irq_byname(pdev, "SYSLO");
 	wm831x_free_irq(wm831x, irq, wm831x_power);
 
-	power_supply_unregister(&wm831x_power->backup);
 	power_supply_unregister(&wm831x_power->battery);
 	power_supply_unregister(&wm831x_power->wall);
 	power_supply_unregister(&wm831x_power->usb);
diff --git a/drivers/power/wm8350_power.c b/drivers/power/wm8350_power.c
index 28b0299c0043..ad4f071e1287 100644
--- a/drivers/power/wm8350_power.c
+++ b/drivers/power/wm8350_power.c
@@ -184,8 +184,9 @@ static ssize_t charger_state_show(struct device *dev,
 
 static DEVICE_ATTR(charger_state, 0444, charger_state_show, NULL);
 
-static void wm8350_charger_handler(struct wm8350 *wm8350, int irq, void *data)
+static irqreturn_t wm8350_charger_handler(int irq, void *data)
 {
+	struct wm8350 *wm8350 = data;
 	struct wm8350_power *power = &wm8350->power;
 	struct wm8350_charger_policy *policy = power->policy;
 
@@ -238,6 +239,8 @@ static void wm8350_charger_handler(struct wm8350 *wm8350, int irq, void *data)
 	default:
 		dev_err(wm8350->dev, "Unknown interrupt %d\n", irq);
 	}
+
+	return IRQ_HANDLED;
 }
 
 /*********************************************************************
@@ -387,73 +390,55 @@ static void wm8350_init_charger(struct wm8350 *wm8350)
 {
 	/* register our interest in charger events */
 	wm8350_register_irq(wm8350, WM8350_IRQ_CHG_BAT_HOT,
-			    wm8350_charger_handler, NULL);
-	wm8350_unmask_irq(wm8350, WM8350_IRQ_CHG_BAT_HOT);
+			    wm8350_charger_handler, 0, "Battery hot", wm8350);
 	wm8350_register_irq(wm8350, WM8350_IRQ_CHG_BAT_COLD,
-			    wm8350_charger_handler, NULL);
-	wm8350_unmask_irq(wm8350, WM8350_IRQ_CHG_BAT_COLD);
+			    wm8350_charger_handler, 0, "Battery cold", wm8350);
 	wm8350_register_irq(wm8350, WM8350_IRQ_CHG_BAT_FAIL,
-			    wm8350_charger_handler, NULL);
-	wm8350_unmask_irq(wm8350, WM8350_IRQ_CHG_BAT_FAIL);
+			    wm8350_charger_handler, 0, "Battery fail", wm8350);
 	wm8350_register_irq(wm8350, WM8350_IRQ_CHG_TO,
-			    wm8350_charger_handler, NULL);
-	wm8350_unmask_irq(wm8350, WM8350_IRQ_CHG_TO);
+			    wm8350_charger_handler, 0,
+			    "Charger timeout", wm8350);
 	wm8350_register_irq(wm8350, WM8350_IRQ_CHG_END,
-			    wm8350_charger_handler, NULL);
-	wm8350_unmask_irq(wm8350, WM8350_IRQ_CHG_END);
+			    wm8350_charger_handler, 0,
+			    "Charge end", wm8350);
 	wm8350_register_irq(wm8350, WM8350_IRQ_CHG_START,
-			    wm8350_charger_handler, NULL);
-	wm8350_unmask_irq(wm8350, WM8350_IRQ_CHG_START);
+			    wm8350_charger_handler, 0,
+			    "Charge start", wm8350);
 	wm8350_register_irq(wm8350, WM8350_IRQ_CHG_FAST_RDY,
-			    wm8350_charger_handler, NULL);
-	wm8350_unmask_irq(wm8350, WM8350_IRQ_CHG_FAST_RDY);
+			    wm8350_charger_handler, 0,
+			    "Fast charge ready", wm8350);
 	wm8350_register_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P9,
-			    wm8350_charger_handler, NULL);
-	wm8350_unmask_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P9);
+			    wm8350_charger_handler, 0,
+			    "Battery <3.9V", wm8350);
 	wm8350_register_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P1,
-			    wm8350_charger_handler, NULL);
-	wm8350_unmask_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P1);
+			    wm8350_charger_handler, 0,
+			    "Battery <3.1V", wm8350);
 	wm8350_register_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_2P85,
-			    wm8350_charger_handler, NULL);
-	wm8350_unmask_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_2P85);
+			    wm8350_charger_handler, 0,
+			    "Battery <2.85V", wm8350);
 
 	/* and supply change events */
 	wm8350_register_irq(wm8350, WM8350_IRQ_EXT_USB_FB,
-			    wm8350_charger_handler, NULL);
-	wm8350_unmask_irq(wm8350, WM8350_IRQ_EXT_USB_FB);
+			    wm8350_charger_handler, 0, "USB", wm8350);
 	wm8350_register_irq(wm8350, WM8350_IRQ_EXT_WALL_FB,
-			    wm8350_charger_handler, NULL);
-	wm8350_unmask_irq(wm8350, WM8350_IRQ_EXT_WALL_FB);
+			    wm8350_charger_handler, 0, "Wall", wm8350);
 	wm8350_register_irq(wm8350, WM8350_IRQ_EXT_BAT_FB,
-			    wm8350_charger_handler, NULL);
-	wm8350_unmask_irq(wm8350, WM8350_IRQ_EXT_BAT_FB);
+			    wm8350_charger_handler, 0, "Battery", wm8350);
 }
 
 static void free_charger_irq(struct wm8350 *wm8350)
 {
-	wm8350_mask_irq(wm8350, WM8350_IRQ_CHG_BAT_HOT);
 	wm8350_free_irq(wm8350, WM8350_IRQ_CHG_BAT_HOT);
-	wm8350_mask_irq(wm8350, WM8350_IRQ_CHG_BAT_COLD);
 	wm8350_free_irq(wm8350, WM8350_IRQ_CHG_BAT_COLD);
-	wm8350_mask_irq(wm8350, WM8350_IRQ_CHG_BAT_FAIL);
 	wm8350_free_irq(wm8350, WM8350_IRQ_CHG_BAT_FAIL);
-	wm8350_mask_irq(wm8350, WM8350_IRQ_CHG_TO);
 	wm8350_free_irq(wm8350, WM8350_IRQ_CHG_TO);
-	wm8350_mask_irq(wm8350, WM8350_IRQ_CHG_END);
 	wm8350_free_irq(wm8350, WM8350_IRQ_CHG_END);
-	wm8350_mask_irq(wm8350, WM8350_IRQ_CHG_START);
 	wm8350_free_irq(wm8350, WM8350_IRQ_CHG_START);
-	wm8350_mask_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P9);
 	wm8350_free_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P9);
-	wm8350_mask_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P1);
 	wm8350_free_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P1);
-	wm8350_mask_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_2P85);
 	wm8350_free_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_2P85);
-	wm8350_mask_irq(wm8350, WM8350_IRQ_EXT_USB_FB);
 	wm8350_free_irq(wm8350, WM8350_IRQ_EXT_USB_FB);
-	wm8350_mask_irq(wm8350, WM8350_IRQ_EXT_WALL_FB);
 	wm8350_free_irq(wm8350, WM8350_IRQ_EXT_WALL_FB);
-	wm8350_mask_irq(wm8350, WM8350_IRQ_EXT_BAT_FB);
 	wm8350_free_irq(wm8350, WM8350_IRQ_EXT_BAT_FB);
 }
 
diff --git a/drivers/power/wm97xx_battery.c b/drivers/power/wm97xx_battery.c
index f2bfd296dbae..fa39e759a275 100644
--- a/drivers/power/wm97xx_battery.c
+++ b/drivers/power/wm97xx_battery.c
@@ -157,7 +157,7 @@ static int wm97xx_bat_resume(struct device *dev)
 	return 0;
 }
 
-static struct dev_pm_ops wm97xx_bat_pm_ops = {
+static const struct dev_pm_ops wm97xx_bat_pm_ops = {
 	.suspend	= wm97xx_bat_suspend,
 	.resume		= wm97xx_bat_resume,
 };
diff --git a/drivers/ps3/ps3-sys-manager.c b/drivers/ps3/ps3-sys-manager.c
index 88cb74088611..3cbaf1811bd0 100644
--- a/drivers/ps3/ps3-sys-manager.c
+++ b/drivers/ps3/ps3-sys-manager.c
@@ -46,7 +46,7 @@
 /**
  * struct ps3_sys_manager_header - System manager message header.
  * @version: Header version, currently 1.
- * @size: Header size in bytes, curently 16.
+ * @size: Header size in bytes, currently 16.
  * @payload_size: Message payload size in bytes.
  * @service_id: Message type, one of enum ps3_sys_manager_service_id.
  * @request_tag: Unique number to identify reply.
diff --git a/drivers/regulator/88pm8607.c b/drivers/regulator/88pm8607.c
new file mode 100644
index 000000000000..04719551381b
--- /dev/null
+++ b/drivers/regulator/88pm8607.c
@@ -0,0 +1,685 @@
+/*
+ * Regulators driver for Marvell 88PM8607
+ *
+ * Copyright (C) 2009 Marvell International Ltd.
+ * 	Haojian Zhuang <haojian.zhuang@marvell.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/err.h>
+#include <linux/platform_device.h>
+#include <linux/regulator/driver.h>
+#include <linux/regulator/machine.h>
+#include <linux/mfd/88pm8607.h>
+
+struct pm8607_regulator_info {
+	struct regulator_desc	desc;
+	struct pm8607_chip	*chip;
+	struct regulator_dev	*regulator;
+
+	int	min_uV;
+	int	max_uV;
+	int	step_uV;
+	int	vol_reg;
+	int	vol_shift;
+	int	vol_nbits;
+	int	update_reg;
+	int	update_bit;
+	int	enable_reg;
+	int	enable_bit;
+	int	slope_double;
+};
+
+static inline int check_range(struct pm8607_regulator_info *info,
+				int min_uV, int max_uV)
+{
+	if (max_uV < info->min_uV || min_uV > info->max_uV || min_uV > max_uV)
+		return -EINVAL;
+
+	return 0;
+}
+
+static int pm8607_list_voltage(struct regulator_dev *rdev, unsigned index)
+{
+	struct pm8607_regulator_info *info = rdev_get_drvdata(rdev);
+	uint8_t chip_id = info->chip->chip_id;
+	int ret = -EINVAL;
+
+	switch (info->desc.id) {
+	case PM8607_ID_BUCK1:
+		ret = (index < 0x1d) ? (index * 25000 + 800000) :
+			((index < 0x20) ? 1500000 :
+			((index < 0x40) ? ((index - 0x20) * 25000) :
+			-EINVAL));
+		break;
+	case PM8607_ID_BUCK3:
+		ret = (index < 0x3d) ? (index * 25000) :
+			((index < 0x40) ? 1500000 : -EINVAL);
+		if (ret < 0)
+			break;
+		if (info->slope_double)
+			ret <<= 1;
+		break;
+	case PM8607_ID_LDO1:
+		ret = (index == 0) ? 1800000 :
+			((index == 1) ? 1200000 :
+			((index == 2) ? 2800000 : -EINVAL));
+		break;
+	case PM8607_ID_LDO5:
+		ret = (index == 0) ? 2900000 :
+			((index == 1) ? 3000000 :
+			((index == 2) ? 3100000 : 3300000));
+		break;
+	case PM8607_ID_LDO7:
+	case PM8607_ID_LDO8:
+		ret = (index < 3) ? (index * 50000 + 1800000) :
+			((index < 8) ? (index * 50000 + 2550000) :
+			 -EINVAL);
+		break;
+	case PM8607_ID_LDO12:
+		ret = (index < 2) ? (index * 100000 + 1800000) :
+			((index < 7) ? (index * 100000 + 2500000) :
+			((index == 7) ? 3300000 : 1200000));
+		break;
+	case PM8607_ID_LDO2:
+	case PM8607_ID_LDO3:
+	case PM8607_ID_LDO9:
+		switch (chip_id) {
+		case PM8607_CHIP_A0:
+		case PM8607_CHIP_A1:
+			ret = (index < 3) ? (index * 50000 + 1800000) :
+				((index < 8) ? (index * 50000 + 2550000) :
+				 -EINVAL);
+			break;
+		case PM8607_CHIP_B0:
+			ret = (index < 3) ? (index * 50000 + 1800000) :
+				((index < 7) ? (index * 50000 + 2550000) :
+				3300000);
+			break;
+		}
+		break;
+	case PM8607_ID_LDO4:
+		switch (chip_id) {
+		case PM8607_CHIP_A0:
+		case PM8607_CHIP_A1:
+			ret = (index < 3) ? (index * 50000 + 1800000) :
+				((index < 8) ? (index * 50000 + 2550000) :
+				 -EINVAL);
+			break;
+		case PM8607_CHIP_B0:
+			ret = (index < 3) ? (index * 50000 + 1800000) :
+				((index < 6) ? (index * 50000 + 2550000) :
+				((index == 6) ? 2900000 : 3300000));
+			break;
+		}
+		break;
+	case PM8607_ID_LDO6:
+		switch (chip_id) {
+		case PM8607_CHIP_A0:
+		case PM8607_CHIP_A1:
+			ret = (index < 3) ? (index * 50000 + 1800000) :
+				((index < 8) ? (index * 50000 + 2450000) :
+				-EINVAL);
+			break;
+		case PM8607_CHIP_B0:
+			ret = (index < 2) ? (index * 50000 + 1800000) :
+				((index < 7) ? (index * 50000 + 2500000) :
+				3300000);
+			break;
+		}
+		break;
+	case PM8607_ID_LDO10:
+		switch (chip_id) {
+		case PM8607_CHIP_A0:
+		case PM8607_CHIP_A1:
+			ret = (index < 3) ? (index * 50000 + 1800000) :
+				((index < 8) ? (index * 50000 + 2550000) :
+				1200000);
+			break;
+		case PM8607_CHIP_B0:
+			ret = (index < 3) ? (index * 50000 + 1800000) :
+				((index < 7) ? (index * 50000 + 2550000) :
+				((index == 7) ? 3300000 : 1200000));
+			break;
+		}
+		break;
+	case PM8607_ID_LDO14:
+		switch (chip_id) {
+		case PM8607_CHIP_A0:
+		case PM8607_CHIP_A1:
+			ret = (index < 3) ? (index * 50000 + 1800000) :
+				((index < 8) ? (index * 50000 + 2550000) :
+				 -EINVAL);
+			break;
+		case PM8607_CHIP_B0:
+			ret = (index < 2) ? (index * 50000 + 1800000) :
+				((index < 7) ? (index * 50000 + 2600000) :
+				3300000);
+			break;
+		}
+		break;
+	}
+	return ret;
+}
+
+static int choose_voltage(struct regulator_dev *rdev, int min_uV, int max_uV)
+{
+	struct pm8607_regulator_info *info = rdev_get_drvdata(rdev);
+	uint8_t chip_id = info->chip->chip_id;
+	int val = -ENOENT;
+	int ret;
+
+	switch (info->desc.id) {
+	case PM8607_ID_BUCK1:
+		if (min_uV >= 800000) 		/* 800mV ~ 1500mV / 25mV */
+			val = (min_uV - 775001) / 25000;
+		else {				/* 25mV ~ 775mV / 25mV */
+			val = (min_uV + 249999) / 25000;
+			val += 32;
+		}
+		break;
+	case PM8607_ID_BUCK3:
+		if (info->slope_double)
+			min_uV = min_uV >> 1;
+		val = (min_uV + 249999) / 25000; /* 0mV ~ 1500mV / 25mV */
+
+		break;
+	case PM8607_ID_LDO1:
+		if (min_uV > 1800000)
+			val = 2;
+		else if (min_uV > 1200000)
+			val = 0;
+		else
+			val = 1;
+		break;
+	case PM8607_ID_LDO5:
+		if (min_uV > 3100000)
+			val = 3;
+		else				/* 2900mV ~ 3100mV / 100mV */
+			val = (min_uV - 2800001) / 100000;
+		break;
+	case PM8607_ID_LDO7:
+	case PM8607_ID_LDO8:
+		if (min_uV < 2700000) {	/* 1800mV ~ 1900mV / 50mV */
+			if (min_uV <= 1800000)
+				val = 0;	/* 1800mv */
+			else if (min_uV <= 1900000)
+				val = (min_uV - 1750001) / 50000;
+			else
+				val = 3;	/* 2700mV */
+		} else {		 /* 2700mV ~ 2900mV / 50mV */
+			if (min_uV <= 2900000) {
+				val = (min_uV - 2650001) / 50000;
+				val += 3;
+			} else
+				val = -EINVAL;
+		}
+		break;
+	case PM8607_ID_LDO10:
+		if (min_uV > 2850000)
+			val = 7;
+		else if (min_uV <= 1200000)
+			val = 8;
+		else if (min_uV < 2700000)	/* 1800mV ~ 1900mV / 50mV */
+			val = (min_uV - 1750001) / 50000;
+		else {				/* 2700mV ~ 2850mV / 50mV */
+			val = (min_uV - 2650001) / 50000;
+			val += 3;
+		}
+		break;
+	case PM8607_ID_LDO12:
+		if (min_uV < 2700000) {		/* 1800mV ~ 1900mV / 100mV */
+			if (min_uV <= 1200000)
+				val = 8;	/* 1200mV */
+			else if (min_uV <= 1800000)
+				val = 0;	/* 1800mV */
+			else if (min_uV <= 1900000)
+				val = (min_uV - 1700001) / 100000;
+			else
+				val = 2;	/* 2700mV */
+		} else {			/* 2700mV ~ 3100mV / 100mV */
+			if (min_uV <= 3100000) {
+				val = (min_uV - 2600001) / 100000;
+				val += 2;
+			} else if (min_uV <= 3300000)
+				val = 7;
+			else
+				val = -EINVAL;
+		}
+		break;
+	case PM8607_ID_LDO2:
+	case PM8607_ID_LDO3:
+	case PM8607_ID_LDO9:
+		switch (chip_id) {
+		case PM8607_CHIP_A0:
+		case PM8607_CHIP_A1:
+			if (min_uV < 2700000)	/* 1800mV ~ 1900mV / 50mV */
+				if (min_uV <= 1800000)
+					val = 0;
+				else if (min_uV <= 1900000)
+					val = (min_uV - 1750001) / 50000;
+				else
+					val = 3;	/* 2700mV */
+			else {			/* 2700mV ~ 2900mV / 50mV */
+				if (min_uV <= 2900000) {
+					val = (min_uV - 2650001) / 50000;
+					val += 3;
+				} else
+					val = -EINVAL;
+			}
+			break;
+		case PM8607_CHIP_B0:
+			if (min_uV < 2700000) {	/* 1800mV ~ 1900mV / 50mV */
+				if (min_uV <= 1800000)
+					val = 0;
+				else if (min_uV <= 1900000)
+					val = (min_uV - 1750001) / 50000;
+				else
+					val = 3;	/* 2700mV */
+			} else {		 /* 2700mV ~ 2850mV / 50mV */
+				if (min_uV <= 2850000) {
+					val = (min_uV - 2650001) / 50000;
+					val += 3;
+				} else if (min_uV <= 3300000)
+					val = 7;
+				else
+					val = -EINVAL;
+			}
+			break;
+		}
+		break;
+	case PM8607_ID_LDO4:
+		switch (chip_id) {
+		case PM8607_CHIP_A0:
+		case PM8607_CHIP_A1:
+			if (min_uV < 2700000)	/* 1800mV ~ 1900mV / 50mV */
+				if (min_uV <= 1800000)
+					val = 0;
+				else if (min_uV <= 1900000)
+					val = (min_uV - 1750001) / 50000;
+				else
+					val = 3;	/* 2700mV */
+			else {			/* 2700mV ~ 2900mV / 50mV */
+				if (min_uV <= 2900000) {
+					val = (min_uV - 2650001) / 50000;
+					val += 3;
+				} else
+					val = -EINVAL;
+			}
+			break;
+		case PM8607_CHIP_B0:
+			if (min_uV < 2700000) {	/* 1800mV ~ 1900mV / 50mV */
+				if (min_uV <= 1800000)
+					val = 0;
+				else if (min_uV <= 1900000)
+					val = (min_uV - 1750001) / 50000;
+				else
+					val = 3;	/* 2700mV */
+			} else {		 /* 2700mV ~ 2800mV / 50mV */
+				if (min_uV <= 2850000) {
+					val = (min_uV - 2650001) / 50000;
+					val += 3;
+				} else if (min_uV <= 2900000)
+					val = 6;
+				else if (min_uV <= 3300000)
+					val = 7;
+				else
+					val = -EINVAL;
+			}
+			break;
+		}
+		break;
+	case PM8607_ID_LDO6:
+		switch (chip_id) {
+		case PM8607_CHIP_A0:
+		case PM8607_CHIP_A1:
+			if (min_uV < 2600000) {	/* 1800mV ~ 1900mV / 50mV */
+				if (min_uV <= 1800000)
+					val = 0;
+				else if (min_uV <= 1900000)
+					val = (min_uV - 1750001) / 50000;
+				else
+					val = 3;	/* 2600mV */
+			} else {		/* 2600mV ~ 2800mV / 50mV */
+				if (min_uV <= 2800000) {
+					val = (min_uV - 2550001) / 50000;
+					val += 3;
+				} else
+					val = -EINVAL;
+			}
+			break;
+		case PM8607_CHIP_B0:
+			if (min_uV < 2600000) {	/* 1800mV ~ 1850mV / 50mV */
+				if (min_uV <= 1800000)
+					val = 0;
+				else if (min_uV <= 1850000)
+					val = (min_uV - 1750001) / 50000;
+				else
+					val = 2;	/* 2600mV */
+			} else {		/* 2600mV ~ 2800mV / 50mV */
+				if (min_uV <= 2800000) {
+					val = (min_uV - 2550001) / 50000;
+					val += 2;
+				} else if (min_uV <= 3300000)
+					val = 7;
+				else
+					val = -EINVAL;
+			}
+			break;
+		}
+		break;
+	case PM8607_ID_LDO14:
+		switch (chip_id) {
+		case PM8607_CHIP_A0:
+		case PM8607_CHIP_A1:
+			if (min_uV < 2700000) {	/* 1800mV ~ 1900mV / 50mV */
+				if (min_uV <= 1800000)
+					val = 0;
+				else if (min_uV <= 1900000)
+					val = (min_uV - 1750001) / 50000;
+				else
+					val = 3;	/* 2700mV */
+			} else {		 /* 2700mV ~ 2900mV / 50mV */
+				if (min_uV <= 2900000) {
+					val = (min_uV - 2650001) / 50000;
+					val += 3;
+				} else
+					val = -EINVAL;
+			}
+			break;
+		case PM8607_CHIP_B0:
+			if (min_uV < 2700000) {	/* 1800mV ~ 1850mV / 50mV */
+				if (min_uV <= 1800000)
+					val = 0;
+				else if (min_uV <= 1850000)
+					val = (min_uV - 1750001) / 50000;
+				else
+					val = 2;	/* 2700mV */
+			} else {		 /* 2700mV ~ 2900mV / 50mV */
+				if (min_uV <= 2900000) {
+					val = (min_uV - 2650001) / 50000;
+					val += 2;
+				} else if (min_uV <= 3300000)
+					val = 7;
+				else
+					val = -EINVAL;
+			}
+			break;
+		}
+		break;
+	}
+	if (val >= 0) {
+		ret = pm8607_list_voltage(rdev, val);
+		if (ret > max_uV) {
+			pr_err("exceed voltage range (%d %d) uV",
+				min_uV, max_uV);
+			return -EINVAL;
+		}
+	} else
+		pr_err("invalid voltage range (%d %d) uV", min_uV, max_uV);
+	return val;
+}
+
+static int pm8607_set_voltage(struct regulator_dev *rdev,
+			      int min_uV, int max_uV)
+{
+	struct pm8607_regulator_info *info = rdev_get_drvdata(rdev);
+	struct pm8607_chip *chip = info->chip;
+	uint8_t val, mask;
+	int ret;
+
+	if (check_range(info, min_uV, max_uV)) {
+		pr_err("invalid voltage range (%d, %d) uV\n", min_uV, max_uV);
+		return -EINVAL;
+	}
+
+	ret = choose_voltage(rdev, min_uV, max_uV);
+	if (ret < 0)
+		return -EINVAL;
+	val = (uint8_t)(ret << info->vol_shift);
+	mask = ((1 << info->vol_nbits) - 1)  << info->vol_shift;
+
+	ret = pm8607_set_bits(chip, info->vol_reg, mask, val);
+	if (ret)
+		return ret;
+	switch (info->desc.id) {
+	case PM8607_ID_BUCK1:
+	case PM8607_ID_BUCK3:
+		ret = pm8607_set_bits(chip, info->update_reg,
+				      1 << info->update_bit,
+				      1 << info->update_bit);
+		break;
+	}
+	return ret;
+}
+
+static int pm8607_get_voltage(struct regulator_dev *rdev)
+{
+	struct pm8607_regulator_info *info = rdev_get_drvdata(rdev);
+	struct pm8607_chip *chip = info->chip;
+	uint8_t val, mask;
+	int ret;
+
+	ret = pm8607_reg_read(chip, info->vol_reg);
+	if (ret < 0)
+		return ret;
+
+	mask = ((1 << info->vol_nbits) - 1)  << info->vol_shift;
+	val = ((unsigned char)ret & mask) >> info->vol_shift;
+
+	return pm8607_list_voltage(rdev, val);
+}
+
+static int pm8607_enable(struct regulator_dev *rdev)
+{
+	struct pm8607_regulator_info *info = rdev_get_drvdata(rdev);
+	struct pm8607_chip *chip = info->chip;
+
+	return pm8607_set_bits(chip, info->enable_reg,
+			       1 << info->enable_bit,
+			       1 << info->enable_bit);
+}
+
+static int pm8607_disable(struct regulator_dev *rdev)
+{
+	struct pm8607_regulator_info *info = rdev_get_drvdata(rdev);
+	struct pm8607_chip *chip = info->chip;
+
+	return pm8607_set_bits(chip, info->enable_reg,
+			       1 << info->enable_bit, 0);
+}
+
+static int pm8607_is_enabled(struct regulator_dev *rdev)
+{
+	struct pm8607_regulator_info *info = rdev_get_drvdata(rdev);
+	struct pm8607_chip *chip = info->chip;
+	int ret;
+
+	ret = pm8607_reg_read(chip, info->enable_reg);
+	if (ret < 0)
+		return ret;
+
+	return !!((unsigned char)ret & (1 << info->enable_bit));
+}
+
+static struct regulator_ops pm8607_regulator_ops = {
+	.set_voltage	= pm8607_set_voltage,
+	.get_voltage	= pm8607_get_voltage,
+	.enable		= pm8607_enable,
+	.disable	= pm8607_disable,
+	.is_enabled	= pm8607_is_enabled,
+};
+
+#define PM8607_DVC(_id, min, max, step, vreg, nbits, ureg, ubit, ereg, ebit) \
+{									\
+	.desc	= {							\
+		.name	= "BUCK" #_id,					\
+		.ops	= &pm8607_regulator_ops,			\
+		.type	= REGULATOR_VOLTAGE,				\
+		.id	= PM8607_ID_BUCK##_id,				\
+		.owner	= THIS_MODULE,					\
+	},								\
+	.min_uV		= (min) * 1000,					\
+	.max_uV		= (max) * 1000,					\
+	.step_uV	= (step) * 1000,				\
+	.vol_reg	= PM8607_##vreg,				\
+	.vol_shift	= (0),						\
+	.vol_nbits	= (nbits),					\
+	.update_reg	= PM8607_##ureg,				\
+	.update_bit	= (ubit),					\
+	.enable_reg	= PM8607_##ereg,				\
+	.enable_bit	= (ebit),					\
+	.slope_double	= (0),						\
+}
+
+#define PM8607_LDO(_id, min, max, step, vreg, shift, nbits, ereg, ebit)	\
+{									\
+	.desc	= {							\
+		.name	= "LDO" #_id,					\
+		.ops	= &pm8607_regulator_ops,			\
+		.type	= REGULATOR_VOLTAGE,				\
+		.id	= PM8607_ID_LDO##_id,				\
+		.owner	= THIS_MODULE,					\
+	},								\
+	.min_uV		= (min) * 1000,					\
+	.max_uV		= (max) * 1000,					\
+	.step_uV	= (step) * 1000,				\
+	.vol_reg	= PM8607_##vreg,				\
+	.vol_shift	= (shift),					\
+	.vol_nbits	= (nbits),					\
+	.enable_reg	= PM8607_##ereg,				\
+	.enable_bit	= (ebit),					\
+	.slope_double	= (0),						\
+}
+
+static struct pm8607_regulator_info pm8607_regulator_info[] = {
+	PM8607_DVC(1, 0, 1500, 25, BUCK1, 6, GO, 0, SUPPLIES_EN11, 0),
+	PM8607_DVC(3, 0, 1500, 25, BUCK3, 6, GO, 2, SUPPLIES_EN11, 2),
+
+	PM8607_LDO(1 , 1200, 2800, 0, LDO1 , 0, 2, SUPPLIES_EN11, 3),
+	PM8607_LDO(2 , 1800, 3300, 0, LDO2 , 0, 3, SUPPLIES_EN11, 4),
+	PM8607_LDO(3 , 1800, 3300, 0, LDO3 , 0, 3, SUPPLIES_EN11, 5),
+	PM8607_LDO(4 , 1800, 3300, 0, LDO4 , 0, 3, SUPPLIES_EN11, 6),
+	PM8607_LDO(5 , 2900, 3300, 0, LDO5 , 0, 2, SUPPLIES_EN11, 7),
+	PM8607_LDO(6 , 1800, 3300, 0, LDO6 , 0, 3, SUPPLIES_EN12, 0),
+	PM8607_LDO(7 , 1800, 2900, 0, LDO7 , 0, 3, SUPPLIES_EN12, 1),
+	PM8607_LDO(8 , 1800, 2900, 0, LDO8 , 0, 3, SUPPLIES_EN12, 2),
+	PM8607_LDO(9 , 1800, 3300, 0, LDO9 , 0, 3, SUPPLIES_EN12, 3),
+	PM8607_LDO(10, 1200, 3300, 0, LDO10, 0, 4, SUPPLIES_EN11, 4),
+	PM8607_LDO(12, 1200, 3300, 0, LDO12, 0, 4, SUPPLIES_EN11, 5),
+	PM8607_LDO(14, 1800, 3300, 0, LDO14, 0, 3, SUPPLIES_EN11, 6),
+};
+
+static inline struct pm8607_regulator_info *find_regulator_info(int id)
+{
+	struct pm8607_regulator_info *info;
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(pm8607_regulator_info); i++) {
+		info = &pm8607_regulator_info[i];
+		if (info->desc.id == id)
+			return info;
+	}
+	return NULL;
+}
+
+static int __devinit pm8607_regulator_probe(struct platform_device *pdev)
+{
+	struct pm8607_chip *chip = dev_get_drvdata(pdev->dev.parent);
+	struct pm8607_platform_data *pdata = chip->dev->platform_data;
+	struct pm8607_regulator_info *info = NULL;
+
+	info = find_regulator_info(pdev->id);
+	if (info == NULL) {
+		dev_err(&pdev->dev, "invalid regulator ID specified\n");
+		return -EINVAL;
+	}
+
+	info->chip = chip;
+
+	info->regulator = regulator_register(&info->desc, &pdev->dev,
+					     pdata->regulator[pdev->id], info);
+	if (IS_ERR(info->regulator)) {
+		dev_err(&pdev->dev, "failed to register regulator %s\n",
+			info->desc.name);
+		return PTR_ERR(info->regulator);
+	}
+
+	/* check DVC ramp slope double */
+	if (info->desc.id == PM8607_ID_BUCK3)
+		if (info->chip->buck3_double)
+			info->slope_double = 1;
+
+	platform_set_drvdata(pdev, info);
+	return 0;
+}
+
+static int __devexit pm8607_regulator_remove(struct platform_device *pdev)
+{
+	struct pm8607_regulator_info *info = platform_get_drvdata(pdev);
+
+	regulator_unregister(info->regulator);
+	return 0;
+}
+
+#define PM8607_REGULATOR_DRIVER(_name)				\
+{								\
+	.driver		= {					\
+		.name	= "88pm8607-" #_name,			\
+		.owner	= THIS_MODULE,				\
+	},							\
+	.probe		= pm8607_regulator_probe,		\
+	.remove		= __devexit_p(pm8607_regulator_remove),	\
+}
+
+static struct platform_driver pm8607_regulator_driver[] = {
+	PM8607_REGULATOR_DRIVER(buck1),
+	PM8607_REGULATOR_DRIVER(buck2),
+	PM8607_REGULATOR_DRIVER(buck3),
+	PM8607_REGULATOR_DRIVER(ldo1),
+	PM8607_REGULATOR_DRIVER(ldo2),
+	PM8607_REGULATOR_DRIVER(ldo3),
+	PM8607_REGULATOR_DRIVER(ldo4),
+	PM8607_REGULATOR_DRIVER(ldo5),
+	PM8607_REGULATOR_DRIVER(ldo6),
+	PM8607_REGULATOR_DRIVER(ldo7),
+	PM8607_REGULATOR_DRIVER(ldo8),
+	PM8607_REGULATOR_DRIVER(ldo9),
+	PM8607_REGULATOR_DRIVER(ldo10),
+	PM8607_REGULATOR_DRIVER(ldo12),
+	PM8607_REGULATOR_DRIVER(ldo14),
+};
+
+static int __init pm8607_regulator_init(void)
+{
+	int i, count, ret;
+
+	count = ARRAY_SIZE(pm8607_regulator_driver);
+	for (i = 0; i < count; i++) {
+		ret = platform_driver_register(&pm8607_regulator_driver[i]);
+		if (ret != 0)
+			pr_err("Failed to register regulator driver: %d\n",
+				ret);
+	}
+	return 0;
+}
+subsys_initcall(pm8607_regulator_init);
+
+static void __exit pm8607_regulator_exit(void)
+{
+	int i, count;
+
+	count = ARRAY_SIZE(pm8607_regulator_driver);
+	for (i = 0; i < count; i++)
+		platform_driver_unregister(&pm8607_regulator_driver[i]);
+}
+module_exit(pm8607_regulator_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Haojian Zhuang <haojian.zhuang@marvell.com>");
+MODULE_DESCRIPTION("Regulator Driver for Marvell 88PM8607 PMIC");
+MODULE_ALIAS("platform:88pm8607-regulator");
diff --git a/drivers/regulator/Kconfig b/drivers/regulator/Kconfig
index bcbb161bde0b..262f62eec837 100644
--- a/drivers/regulator/Kconfig
+++ b/drivers/regulator/Kconfig
@@ -69,8 +69,15 @@ config REGULATOR_MAX1586
 	  regulator via I2C bus. The provided regulator is suitable
 	  for PXA27x chips to control VCC_CORE and VCC_USIM voltages.
 
+config REGULATOR_MAX8660
+	tristate "Maxim 8660/8661 voltage regulator"
+	depends on I2C
+	help
+	  This driver controls a Maxim 8660/8661 voltage output
+	  regulator via I2C bus.
+
 config REGULATOR_TWL4030
-	bool "TI TWL4030/TWL5030/TPS695x0 PMIC"
+	bool "TI TWL4030/TWL5030/TWL6030/TPS695x0 PMIC"
 	depends on TWL4030_CORE
 	help
 	  This driver supports the voltage regulators provided by
@@ -157,5 +164,11 @@ config REGULATOR_TPS6507X
 	  three step-down converters and two general-purpose LDO voltage regulators.
 	  It supports TI's software based Class-2 SmartReflex implementation.
 
+config REGULATOR_88PM8607
+	bool "Marvell 88PM8607 Power regulators"
+	depends on MFD_88PM8607=y
+	help
+	  This driver supports 88PM8607 voltage regulator chips.
+
 endif
 
diff --git a/drivers/regulator/Makefile b/drivers/regulator/Makefile
index 4257a8683778..b3c806c79415 100644
--- a/drivers/regulator/Makefile
+++ b/drivers/regulator/Makefile
@@ -11,7 +11,8 @@ obj-$(CONFIG_REGULATOR_USERSPACE_CONSUMER) += userspace-consumer.o
 obj-$(CONFIG_REGULATOR_BQ24022) += bq24022.o
 obj-$(CONFIG_REGULATOR_LP3971) += lp3971.o
 obj-$(CONFIG_REGULATOR_MAX1586) += max1586.o
-obj-$(CONFIG_REGULATOR_TWL4030) += twl4030-regulator.o
+obj-$(CONFIG_REGULATOR_TWL4030) += twl-regulator.o
+obj-$(CONFIG_REGULATOR_MAX8660) += max8660.o
 obj-$(CONFIG_REGULATOR_WM831X) += wm831x-dcdc.o
 obj-$(CONFIG_REGULATOR_WM831X) += wm831x-isink.o
 obj-$(CONFIG_REGULATOR_WM831X) += wm831x-ldo.o
@@ -20,10 +21,11 @@ obj-$(CONFIG_REGULATOR_WM8400) += wm8400-regulator.o
 obj-$(CONFIG_REGULATOR_DA903X)	+= da903x.o
 obj-$(CONFIG_REGULATOR_PCF50633) += pcf50633-regulator.o
 obj-$(CONFIG_REGULATOR_PCAP) += pcap-regulator.o
-obj-$(CONFIG_REGULATOR_MC13783) += mc13783.o
+obj-$(CONFIG_REGULATOR_MC13783) += mc13783-regulator.o
 obj-$(CONFIG_REGULATOR_AB3100) += ab3100.o
 
 obj-$(CONFIG_REGULATOR_TPS65023) += tps65023-regulator.o
 obj-$(CONFIG_REGULATOR_TPS6507X) += tps6507x-regulator.o
+obj-$(CONFIG_REGULATOR_88PM8607) += 88pm8607.o
 
 ccflags-$(CONFIG_REGULATOR_DEBUG) += -DDEBUG
diff --git a/drivers/regulator/ab3100.c b/drivers/regulator/ab3100.c
index 49aeee823a25..b349db4504b7 100644
--- a/drivers/regulator/ab3100.c
+++ b/drivers/regulator/ab3100.c
@@ -81,7 +81,7 @@ static const u8 ab3100_reg_init_order[AB3100_NUM_REGULATORS+2] = {
 #define LDO_C_VOLTAGE 2650000
 #define LDO_D_VOLTAGE 2650000
 
-static const int const ldo_e_buck_typ_voltages[] = {
+static const int ldo_e_buck_typ_voltages[] = {
 	1800000,
 	1400000,
 	1300000,
@@ -91,7 +91,7 @@ static const int const ldo_e_buck_typ_voltages[] = {
 	900000,
 };
 
-static const int const ldo_f_typ_voltages[] = {
+static const int ldo_f_typ_voltages[] = {
 	1800000,
 	1400000,
 	1300000,
@@ -102,21 +102,21 @@ static const int const ldo_f_typ_voltages[] = {
 	2650000,
 };
 
-static const int const ldo_g_typ_voltages[] = {
+static const int ldo_g_typ_voltages[] = {
 	2850000,
 	2750000,
 	1800000,
 	1500000,
 };
 
-static const int const ldo_h_typ_voltages[] = {
+static const int ldo_h_typ_voltages[] = {
 	2750000,
 	1800000,
 	1500000,
 	1200000,
 };
 
-static const int const ldo_k_typ_voltages[] = {
+static const int ldo_k_typ_voltages[] = {
 	2750000,
 	1800000,
 };
@@ -241,24 +241,12 @@ static int ab3100_disable_regulator(struct regulator_dev *reg)
 	 * LDO D is a special regulator. When it is disabled, the entire
 	 * system is shut down. So this is handled specially.
 	 */
+	pr_info("Called ab3100_disable_regulator\n");
 	if (abreg->regreg == AB3100_LDO_D) {
-		int i;
-
 		dev_info(&reg->dev, "disabling LDO D - shut down system\n");
-		/*
-		 * Set regulators to default values, ignore any errors,
-		 * we're going DOWN
-		 */
-		for (i = 0; i < ARRAY_SIZE(ab3100_reg_init_order); i++) {
-			(void) ab3100_set_register_interruptible(abreg->ab3100,
-					ab3100_reg_init_order[i],
-					abreg->plfdata->reg_initvals[i]);
-		}
-
 		/* Setting LDO D to 0x00 cuts the power to the SoC */
 		return ab3100_set_register_interruptible(abreg->ab3100,
 							 AB3100_LDO_D, 0x00U);
-
 	}
 
 	/*
@@ -607,13 +595,6 @@ static int __init ab3100_regulators_probe(struct platform_device *pdev)
 		}
 	}
 
-	if (err) {
-		dev_err(&pdev->dev,
-			"LDO D regulator initialization failed with error %d\n",
-			err);
-		return err;
-	}
-
 	/* Register the regulators */
 	for (i = 0; i < AB3100_NUM_REGULATORS; i++) {
 		struct ab3100_regulator *reg = &ab3100_regulators[i];
@@ -688,7 +669,7 @@ static __init int ab3100_regulators_init(void)
 
 static __exit void ab3100_regulators_exit(void)
 {
-	platform_driver_register(&ab3100_regulators_driver);
+	platform_driver_unregister(&ab3100_regulators_driver);
 }
 
 subsys_initcall(ab3100_regulators_init);
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index efe568deda12..686ef270ecf7 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -66,6 +66,16 @@ static unsigned int _regulator_get_mode(struct regulator_dev *rdev);
 static void _notifier_call_chain(struct regulator_dev *rdev,
 				  unsigned long event, void *data);
 
+static const char *rdev_get_name(struct regulator_dev *rdev)
+{
+	if (rdev->constraints && rdev->constraints->name)
+		return rdev->constraints->name;
+	else if (rdev->desc->name)
+		return rdev->desc->name;
+	else
+		return "";
+}
+
 /* gets the regulator for a given consumer device */
 static struct regulator *get_device_regulator(struct device *dev)
 {
@@ -96,12 +106,12 @@ static int regulator_check_voltage(struct regulator_dev *rdev,
 
 	if (!rdev->constraints) {
 		printk(KERN_ERR "%s: no constraints for %s\n", __func__,
-		       rdev->desc->name);
+		       rdev_get_name(rdev));
 		return -ENODEV;
 	}
 	if (!(rdev->constraints->valid_ops_mask & REGULATOR_CHANGE_VOLTAGE)) {
 		printk(KERN_ERR "%s: operation not allowed for %s\n",
-		       __func__, rdev->desc->name);
+		       __func__, rdev_get_name(rdev));
 		return -EPERM;
 	}
 
@@ -124,12 +134,12 @@ static int regulator_check_current_limit(struct regulator_dev *rdev,
 
 	if (!rdev->constraints) {
 		printk(KERN_ERR "%s: no constraints for %s\n", __func__,
-		       rdev->desc->name);
+		       rdev_get_name(rdev));
 		return -ENODEV;
 	}
 	if (!(rdev->constraints->valid_ops_mask & REGULATOR_CHANGE_CURRENT)) {
 		printk(KERN_ERR "%s: operation not allowed for %s\n",
-		       __func__, rdev->desc->name);
+		       __func__, rdev_get_name(rdev));
 		return -EPERM;
 	}
 
@@ -159,17 +169,17 @@ static int regulator_check_mode(struct regulator_dev *rdev, int mode)
 
 	if (!rdev->constraints) {
 		printk(KERN_ERR "%s: no constraints for %s\n", __func__,
-		       rdev->desc->name);
+		       rdev_get_name(rdev));
 		return -ENODEV;
 	}
 	if (!(rdev->constraints->valid_ops_mask & REGULATOR_CHANGE_MODE)) {
 		printk(KERN_ERR "%s: operation not allowed for %s\n",
-		       __func__, rdev->desc->name);
+		       __func__, rdev_get_name(rdev));
 		return -EPERM;
 	}
 	if (!(rdev->constraints->valid_modes_mask & mode)) {
 		printk(KERN_ERR "%s: invalid mode %x for %s\n",
-		       __func__, mode, rdev->desc->name);
+		       __func__, mode, rdev_get_name(rdev));
 		return -EINVAL;
 	}
 	return 0;
@@ -180,12 +190,12 @@ static int regulator_check_drms(struct regulator_dev *rdev)
 {
 	if (!rdev->constraints) {
 		printk(KERN_ERR "%s: no constraints for %s\n", __func__,
-		       rdev->desc->name);
+		       rdev_get_name(rdev));
 		return -ENODEV;
 	}
 	if (!(rdev->constraints->valid_ops_mask & REGULATOR_CHANGE_DRMS)) {
 		printk(KERN_ERR "%s: operation not allowed for %s\n",
-		       __func__, rdev->desc->name);
+		       __func__, rdev_get_name(rdev));
 		return -EPERM;
 	}
 	return 0;
@@ -230,16 +240,8 @@ static ssize_t regulator_name_show(struct device *dev,
 			     struct device_attribute *attr, char *buf)
 {
 	struct regulator_dev *rdev = dev_get_drvdata(dev);
-	const char *name;
 
-	if (rdev->constraints && rdev->constraints->name)
-		name = rdev->constraints->name;
-	else if (rdev->desc->name)
-		name = rdev->desc->name;
-	else
-		name = "";
-
-	return sprintf(buf, "%s\n", name);
+	return sprintf(buf, "%s\n", rdev_get_name(rdev));
 }
 
 static ssize_t regulator_print_opmode(char *buf, int mode)
@@ -388,7 +390,7 @@ static ssize_t regulator_total_uA_show(struct device *dev,
 
 	mutex_lock(&rdev->mutex);
 	list_for_each_entry(regulator, &rdev->consumer_list, list)
-	    uA += regulator->uA_load;
+		uA += regulator->uA_load;
 	mutex_unlock(&rdev->mutex);
 	return sprintf(buf, "%d\n", uA);
 }
@@ -563,7 +565,7 @@ static void drms_uA_update(struct regulator_dev *rdev)
 
 	/* calc total requested load */
 	list_for_each_entry(sibling, &rdev->consumer_list, list)
-	    current_uA += sibling->uA_load;
+		current_uA += sibling->uA_load;
 
 	/* now get the optimum mode for our new total regulator load */
 	mode = rdev->desc->ops->get_optimum_mode(rdev, input_uV,
@@ -579,10 +581,29 @@ static int suspend_set_state(struct regulator_dev *rdev,
 	struct regulator_state *rstate)
 {
 	int ret = 0;
+	bool can_set_state;
 
-	/* enable & disable are mandatory for suspend control */
-	if (!rdev->desc->ops->set_suspend_enable ||
-		!rdev->desc->ops->set_suspend_disable) {
+	can_set_state = rdev->desc->ops->set_suspend_enable &&
+		rdev->desc->ops->set_suspend_disable;
+
+	/* If we have no suspend mode configration don't set anything;
+	 * only warn if the driver actually makes the suspend mode
+	 * configurable.
+	 */
+	if (!rstate->enabled && !rstate->disabled) {
+		if (can_set_state)
+			printk(KERN_WARNING "%s: No configuration for %s\n",
+			       __func__, rdev_get_name(rdev));
+		return 0;
+	}
+
+	if (rstate->enabled && rstate->disabled) {
+		printk(KERN_ERR "%s: invalid configuration for %s\n",
+		       __func__, rdev_get_name(rdev));
+		return -EINVAL;
+	}
+
+	if (!can_set_state) {
 		printk(KERN_ERR "%s: no way to set suspend state\n",
 			__func__);
 		return -EINVAL;
@@ -641,25 +662,43 @@ static void print_constraints(struct regulator_dev *rdev)
 {
 	struct regulation_constraints *constraints = rdev->constraints;
 	char buf[80];
-	int count;
+	int count = 0;
+	int ret;
 
-	if (rdev->desc->type == REGULATOR_VOLTAGE) {
+	if (constraints->min_uV && constraints->max_uV) {
 		if (constraints->min_uV == constraints->max_uV)
-			count = sprintf(buf, "%d mV ",
-					constraints->min_uV / 1000);
+			count += sprintf(buf + count, "%d mV ",
+					 constraints->min_uV / 1000);
 		else
-			count = sprintf(buf, "%d <--> %d mV ",
-					constraints->min_uV / 1000,
-					constraints->max_uV / 1000);
-	} else {
+			count += sprintf(buf + count, "%d <--> %d mV ",
+					 constraints->min_uV / 1000,
+					 constraints->max_uV / 1000);
+	}
+
+	if (!constraints->min_uV ||
+	    constraints->min_uV != constraints->max_uV) {
+		ret = _regulator_get_voltage(rdev);
+		if (ret > 0)
+			count += sprintf(buf + count, "at %d mV ", ret / 1000);
+	}
+
+	if (constraints->min_uA && constraints->max_uA) {
 		if (constraints->min_uA == constraints->max_uA)
-			count = sprintf(buf, "%d mA ",
-					constraints->min_uA / 1000);
+			count += sprintf(buf + count, "%d mA ",
+					 constraints->min_uA / 1000);
 		else
-			count = sprintf(buf, "%d <--> %d mA ",
-					constraints->min_uA / 1000,
-					constraints->max_uA / 1000);
+			count += sprintf(buf + count, "%d <--> %d mA ",
+					 constraints->min_uA / 1000,
+					 constraints->max_uA / 1000);
 	}
+
+	if (!constraints->min_uA ||
+	    constraints->min_uA != constraints->max_uA) {
+		ret = _regulator_get_current_limit(rdev);
+		if (ret > 0)
+			count += sprintf(buf + count, "at %d uA ", ret / 1000);
+	}
+
 	if (constraints->valid_modes_mask & REGULATOR_MODE_FAST)
 		count += sprintf(buf + count, "fast ");
 	if (constraints->valid_modes_mask & REGULATOR_MODE_NORMAL)
@@ -669,33 +708,30 @@ static void print_constraints(struct regulator_dev *rdev)
 	if (constraints->valid_modes_mask & REGULATOR_MODE_STANDBY)
 		count += sprintf(buf + count, "standby");
 
-	printk(KERN_INFO "regulator: %s: %s\n", rdev->desc->name, buf);
+	printk(KERN_INFO "regulator: %s: %s\n", rdev_get_name(rdev), buf);
 }
 
-/**
- * set_machine_constraints - sets regulator constraints
- * @rdev: regulator source
- * @constraints: constraints to apply
- *
- * Allows platform initialisation code to define and constrain
- * regulator circuits e.g. valid voltage/current ranges, etc.  NOTE:
- * Constraints *must* be set by platform code in order for some
- * regulator operations to proceed i.e. set_voltage, set_current_limit,
- * set_mode.
- */
-static int set_machine_constraints(struct regulator_dev *rdev,
+static int machine_constraints_voltage(struct regulator_dev *rdev,
 	struct regulation_constraints *constraints)
 {
-	int ret = 0;
-	const char *name;
 	struct regulator_ops *ops = rdev->desc->ops;
+	const char *name = rdev_get_name(rdev);
+	int ret;
 
-	if (constraints->name)
-		name = constraints->name;
-	else if (rdev->desc->name)
-		name = rdev->desc->name;
-	else
-		name = "regulator";
+	/* do we need to apply the constraint voltage */
+	if (rdev->constraints->apply_uV &&
+		rdev->constraints->min_uV == rdev->constraints->max_uV &&
+		ops->set_voltage) {
+		ret = ops->set_voltage(rdev,
+			rdev->constraints->min_uV, rdev->constraints->max_uV);
+			if (ret < 0) {
+				printk(KERN_ERR "%s: failed to apply %duV constraint to %s\n",
+				       __func__,
+				       rdev->constraints->min_uV, name);
+				rdev->constraints = NULL;
+				return ret;
+			}
+	}
 
 	/* constrain machine-level voltage specs to fit
 	 * the actual range supported by this regulator.
@@ -719,14 +755,13 @@ static int set_machine_constraints(struct regulator_dev *rdev,
 
 		/* voltage constraints are optional */
 		if ((cmin == 0) && (cmax == 0))
-			goto out;
+			return 0;
 
 		/* else require explicit machine-level constraints */
 		if (cmin <= 0 || cmax <= 0 || cmax < cmin) {
 			pr_err("%s: %s '%s' voltage constraints\n",
 				       __func__, "invalid", name);
-			ret = -EINVAL;
-			goto out;
+			return -EINVAL;
 		}
 
 		/* initial: [cmin..cmax] valid, [min_uV..max_uV] not */
@@ -748,8 +783,7 @@ static int set_machine_constraints(struct regulator_dev *rdev,
 		if (max_uV < min_uV) {
 			pr_err("%s: %s '%s' voltage constraints\n",
 				       __func__, "unsupportable", name);
-			ret = -EINVAL;
-			goto out;
+			return -EINVAL;
 		}
 
 		/* use regulator's subset of machine constraints */
@@ -767,22 +801,34 @@ static int set_machine_constraints(struct regulator_dev *rdev,
 		}
 	}
 
+	return 0;
+}
+
+/**
+ * set_machine_constraints - sets regulator constraints
+ * @rdev: regulator source
+ * @constraints: constraints to apply
+ *
+ * Allows platform initialisation code to define and constrain
+ * regulator circuits e.g. valid voltage/current ranges, etc.  NOTE:
+ * Constraints *must* be set by platform code in order for some
+ * regulator operations to proceed i.e. set_voltage, set_current_limit,
+ * set_mode.
+ */
+static int set_machine_constraints(struct regulator_dev *rdev,
+	struct regulation_constraints *constraints)
+{
+	int ret = 0;
+	const char *name;
+	struct regulator_ops *ops = rdev->desc->ops;
+
 	rdev->constraints = constraints;
 
-	/* do we need to apply the constraint voltage */
-	if (rdev->constraints->apply_uV &&
-		rdev->constraints->min_uV == rdev->constraints->max_uV &&
-		ops->set_voltage) {
-		ret = ops->set_voltage(rdev,
-			rdev->constraints->min_uV, rdev->constraints->max_uV);
-			if (ret < 0) {
-				printk(KERN_ERR "%s: failed to apply %duV constraint to %s\n",
-				       __func__,
-				       rdev->constraints->min_uV, name);
-				rdev->constraints = NULL;
-				goto out;
-			}
-	}
+	name = rdev_get_name(rdev);
+
+	ret = machine_constraints_voltage(rdev, constraints);
+	if (ret != 0)
+		goto out;
 
 	/* do we need to setup our suspend state */
 	if (constraints->initial_state) {
@@ -903,7 +949,7 @@ static int set_consumer_device_supply(struct regulator_dev *rdev,
 				dev_name(&node->regulator->dev),
 				node->regulator->desc->name,
 				supply,
-				dev_name(&rdev->dev), rdev->desc->name);
+				dev_name(&rdev->dev), rdev_get_name(rdev));
 		return -EBUSY;
 	}
 
@@ -1212,7 +1258,7 @@ static int _regulator_enable(struct regulator_dev *rdev)
 		ret = _regulator_enable(rdev->supply);
 		if (ret < 0) {
 			printk(KERN_ERR "%s: failed to enable %s: %d\n",
-			       __func__, rdev->desc->name, ret);
+			       __func__, rdev_get_name(rdev), ret);
 			return ret;
 		}
 	}
@@ -1238,7 +1284,7 @@ static int _regulator_enable(struct regulator_dev *rdev)
 			}
 		} else if (ret < 0) {
 			printk(KERN_ERR "%s: is_enabled() failed for %s: %d\n",
-			       __func__, rdev->desc->name, ret);
+			       __func__, rdev_get_name(rdev), ret);
 			return ret;
 		}
 		/* Fallthrough on positive return values - already enabled */
@@ -1279,7 +1325,7 @@ static int _regulator_disable(struct regulator_dev *rdev)
 
 	if (WARN(rdev->use_count <= 0,
 			"unbalanced disables for %s\n",
-			rdev->desc->name))
+			rdev_get_name(rdev)))
 		return -EIO;
 
 	/* are we the last user and permitted to disable ? */
@@ -1292,7 +1338,7 @@ static int _regulator_disable(struct regulator_dev *rdev)
 			ret = rdev->desc->ops->disable(rdev);
 			if (ret < 0) {
 				printk(KERN_ERR "%s: failed to disable %s\n",
-				       __func__, rdev->desc->name);
+				       __func__, rdev_get_name(rdev));
 				return ret;
 			}
 		}
@@ -1349,7 +1395,7 @@ static int _regulator_force_disable(struct regulator_dev *rdev)
 		ret = rdev->desc->ops->disable(rdev);
 		if (ret < 0) {
 			printk(KERN_ERR "%s: failed to force disable %s\n",
-			       __func__, rdev->desc->name);
+			       __func__, rdev_get_name(rdev));
 			return ret;
 		}
 		/* notify other consumers that power has been forced off */
@@ -1766,7 +1812,7 @@ int regulator_set_optimum_mode(struct regulator *regulator, int uA_load)
 	output_uV = rdev->desc->ops->get_voltage(rdev);
 	if (output_uV <= 0) {
 		printk(KERN_ERR "%s: invalid output voltage found for %s\n",
-			__func__, rdev->desc->name);
+			__func__, rdev_get_name(rdev));
 		goto out;
 	}
 
@@ -1777,13 +1823,13 @@ int regulator_set_optimum_mode(struct regulator *regulator, int uA_load)
 		input_uV = rdev->constraints->input_uV;
 	if (input_uV <= 0) {
 		printk(KERN_ERR "%s: invalid input voltage found for %s\n",
-			__func__, rdev->desc->name);
+			__func__, rdev_get_name(rdev));
 		goto out;
 	}
 
 	/* calc total requested load for this regulator */
 	list_for_each_entry(consumer, &rdev->consumer_list, list)
-	    total_uA_load += consumer->uA_load;
+		total_uA_load += consumer->uA_load;
 
 	mode = rdev->desc->ops->get_optimum_mode(rdev,
 						 input_uV, output_uV,
@@ -1791,7 +1837,7 @@ int regulator_set_optimum_mode(struct regulator *regulator, int uA_load)
 	ret = regulator_check_mode(rdev, mode);
 	if (ret < 0) {
 		printk(KERN_ERR "%s: failed to get optimum mode for %s @"
-			" %d uA %d -> %d uV\n", __func__, rdev->desc->name,
+			" %d uA %d -> %d uV\n", __func__, rdev_get_name(rdev),
 			total_uA_load, input_uV, output_uV);
 		goto out;
 	}
@@ -1799,7 +1845,7 @@ int regulator_set_optimum_mode(struct regulator *regulator, int uA_load)
 	ret = rdev->desc->ops->set_mode(rdev, mode);
 	if (ret < 0) {
 		printk(KERN_ERR "%s: failed to set optimum mode %x for %s\n",
-			__func__, mode, rdev->desc->name);
+			__func__, mode, rdev_get_name(rdev));
 		goto out;
 	}
 	ret = mode;
@@ -1852,9 +1898,9 @@ static void _notifier_call_chain(struct regulator_dev *rdev,
 
 	/* now notify regulator we supply */
 	list_for_each_entry(_rdev, &rdev->supply_list, slist) {
-	  mutex_lock(&_rdev->mutex);
-	  _notifier_call_chain(_rdev, event, data);
-	  mutex_unlock(&_rdev->mutex);
+		mutex_lock(&_rdev->mutex);
+		_notifier_call_chain(_rdev, event, data);
+		mutex_unlock(&_rdev->mutex);
 	}
 }
 
@@ -1885,9 +1931,9 @@ int regulator_bulk_get(struct device *dev, int num_consumers,
 		consumers[i].consumer = regulator_get(dev,
 						      consumers[i].supply);
 		if (IS_ERR(consumers[i].consumer)) {
-			dev_err(dev, "Failed to get supply '%s'\n",
-				consumers[i].supply);
 			ret = PTR_ERR(consumers[i].consumer);
+			dev_err(dev, "Failed to get supply '%s': %d\n",
+				consumers[i].supply, ret);
 			consumers[i].consumer = NULL;
 			goto err;
 		}
@@ -1930,8 +1976,8 @@ int regulator_bulk_enable(int num_consumers,
 	return 0;
 
 err:
-	printk(KERN_ERR "Failed to enable %s\n", consumers[i].supply);
-	for (i = 0; i < num_consumers; i++)
+	printk(KERN_ERR "Failed to enable %s: %d\n", consumers[i].supply, ret);
+	for (--i; i >= 0; --i)
 		regulator_disable(consumers[i].consumer);
 
 	return ret;
@@ -1965,8 +2011,9 @@ int regulator_bulk_disable(int num_consumers,
 	return 0;
 
 err:
-	printk(KERN_ERR "Failed to disable %s\n", consumers[i].supply);
-	for (i = 0; i < num_consumers; i++)
+	printk(KERN_ERR "Failed to disable %s: %d\n", consumers[i].supply,
+	       ret);
+	for (--i; i >= 0; --i)
 		regulator_enable(consumers[i].consumer);
 
 	return ret;
@@ -2316,7 +2363,7 @@ int regulator_suspend_prepare(suspend_state_t state)
 
 		if (ret < 0) {
 			printk(KERN_ERR "%s: failed to prepare %s\n",
-				__func__, rdev->desc->name);
+				__func__, rdev_get_name(rdev));
 			goto out;
 		}
 	}
@@ -2429,12 +2476,7 @@ static int __init regulator_init_complete(void)
 		ops = rdev->desc->ops;
 		c = rdev->constraints;
 
-		if (c && c->name)
-			name = c->name;
-		else if (rdev->desc->name)
-			name = rdev->desc->name;
-		else
-			name = "regulator";
+		name = rdev_get_name(rdev);
 
 		if (!ops->disable || (c && c->always_on))
 			continue;
diff --git a/drivers/regulator/da903x.c b/drivers/regulator/da903x.c
index aa224d936e0d..f8c4661a7a81 100644
--- a/drivers/regulator/da903x.c
+++ b/drivers/regulator/da903x.c
@@ -331,7 +331,7 @@ static int da9034_get_ldo12_voltage(struct regulator_dev *rdev)
 static int da9034_list_ldo12_voltage(struct regulator_dev *rdev,
 				     unsigned selector)
 {
-	if (selector > ARRAY_SIZE(da9034_ldo12_data))
+	if (selector >= ARRAY_SIZE(da9034_ldo12_data))
 		return -EINVAL;
 	return da9034_ldo12_data[selector] * 1000;
 }
diff --git a/drivers/regulator/lp3971.c b/drivers/regulator/lp3971.c
index 7803a320543b..76d08c282f9c 100644
--- a/drivers/regulator/lp3971.c
+++ b/drivers/regulator/lp3971.c
@@ -446,8 +446,8 @@ static int setup_regulators(struct lp3971 *lp3971,
 		lp3971->rdev[i] = regulator_register(&regulators[id],
 			lp3971->dev, pdata->regulators[i].initdata, lp3971);
 
-		err = IS_ERR(lp3971->rdev[i]);
-		if (err) {
+		if (IS_ERR(lp3971->rdev[i])) {
+			err = PTR_ERR(lp3971->rdev[i]);
 			dev_err(lp3971->dev, "regulator init failed: %d\n",
 				err);
 			goto error;
diff --git a/drivers/regulator/max8660.c b/drivers/regulator/max8660.c
new file mode 100644
index 000000000000..acc2fb7b6087
--- /dev/null
+++ b/drivers/regulator/max8660.c
@@ -0,0 +1,510 @@
+/*
+ * max8660.c  --  Voltage regulation for the Maxim 8660/8661
+ *
+ * based on max1586.c and wm8400-regulator.c
+ *
+ * Copyright (C) 2009 Wolfram Sang, Pengutronix e.K.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
+ * Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ * Some info:
+ *
+ * Datasheet: http://datasheets.maxim-ic.com/en/ds/MAX8660-MAX8661.pdf
+ *
+ * This chip is a bit nasty because it is a write-only device. Thus, the driver
+ * uses shadow registers to keep track of its values. The main problem appears
+ * to be the initialization: When Linux boots up, we cannot know if the chip is
+ * in the default state or not, so we would have to pass such information in
+ * platform_data. As this adds a bit of complexity to the driver, this is left
+ * out for now until it is really needed.
+ *
+ * [A|S|M]DTV1 registers are currently not used, but [A|S|M]DTV2.
+ *
+ * If the driver is feature complete, it might be worth to check if one set of
+ * functions for V3-V7 is sufficient. For maximum flexibility during
+ * development, they are separated for now.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/err.h>
+#include <linux/i2c.h>
+#include <linux/platform_device.h>
+#include <linux/regulator/driver.h>
+#include <linux/regulator/max8660.h>
+
+#define MAX8660_DCDC_MIN_UV	 725000
+#define MAX8660_DCDC_MAX_UV	1800000
+#define MAX8660_DCDC_STEP	  25000
+#define MAX8660_DCDC_MAX_SEL	0x2b
+
+#define MAX8660_LDO5_MIN_UV	1700000
+#define MAX8660_LDO5_MAX_UV	2000000
+#define MAX8660_LDO5_STEP	  25000
+#define MAX8660_LDO5_MAX_SEL	0x0c
+
+#define MAX8660_LDO67_MIN_UV	1800000
+#define MAX8660_LDO67_MAX_UV	3300000
+#define MAX8660_LDO67_STEP	 100000
+#define MAX8660_LDO67_MAX_SEL	0x0f
+
+enum {
+	MAX8660_OVER1,
+	MAX8660_OVER2,
+	MAX8660_VCC1,
+	MAX8660_ADTV1,
+	MAX8660_ADTV2,
+	MAX8660_SDTV1,
+	MAX8660_SDTV2,
+	MAX8660_MDTV1,
+	MAX8660_MDTV2,
+	MAX8660_L12VCR,
+	MAX8660_FPWM,
+	MAX8660_N_REGS,	/* not a real register */
+};
+
+struct max8660 {
+	struct i2c_client *client;
+	u8 shadow_regs[MAX8660_N_REGS];		/* as chip is write only */
+	struct regulator_dev *rdev[];
+};
+
+static int max8660_write(struct max8660 *max8660, u8 reg, u8 mask, u8 val)
+{
+	static const u8 max8660_addresses[MAX8660_N_REGS] =
+	  { 0x10, 0x12, 0x20, 0x23, 0x24, 0x29, 0x2a, 0x32, 0x33, 0x39, 0x80 };
+
+	int ret;
+	u8 reg_val = (max8660->shadow_regs[reg] & mask) | val;
+	dev_vdbg(&max8660->client->dev, "Writing reg %02x with %02x\n",
+			max8660_addresses[reg], reg_val);
+
+	ret = i2c_smbus_write_byte_data(max8660->client,
+			max8660_addresses[reg], reg_val);
+	if (ret == 0)
+		max8660->shadow_regs[reg] = reg_val;
+
+	return ret;
+}
+
+
+/*
+ * DCDC functions
+ */
+
+static int max8660_dcdc_is_enabled(struct regulator_dev *rdev)
+{
+	struct max8660 *max8660 = rdev_get_drvdata(rdev);
+	u8 val = max8660->shadow_regs[MAX8660_OVER1];
+	u8 mask = (rdev_get_id(rdev) == MAX8660_V3) ? 1 : 4;
+	return !!(val & mask);
+}
+
+static int max8660_dcdc_enable(struct regulator_dev *rdev)
+{
+	struct max8660 *max8660 = rdev_get_drvdata(rdev);
+	u8 bit = (rdev_get_id(rdev) == MAX8660_V3) ? 1 : 4;
+	return max8660_write(max8660, MAX8660_OVER1, 0xff, bit);
+}
+
+static int max8660_dcdc_disable(struct regulator_dev *rdev)
+{
+	struct max8660 *max8660 = rdev_get_drvdata(rdev);
+	u8 mask = (rdev_get_id(rdev) == MAX8660_V3) ? ~1 : ~4;
+	return max8660_write(max8660, MAX8660_OVER1, mask, 0);
+}
+
+static int max8660_dcdc_list(struct regulator_dev *rdev, unsigned selector)
+{
+	if (selector > MAX8660_DCDC_MAX_SEL)
+		return -EINVAL;
+	return MAX8660_DCDC_MIN_UV + selector * MAX8660_DCDC_STEP;
+}
+
+static int max8660_dcdc_get(struct regulator_dev *rdev)
+{
+	struct max8660 *max8660 = rdev_get_drvdata(rdev);
+	u8 reg = (rdev_get_id(rdev) == MAX8660_V3) ? MAX8660_ADTV2 : MAX8660_SDTV2;
+	u8 selector = max8660->shadow_regs[reg];
+	return MAX8660_DCDC_MIN_UV + selector * MAX8660_DCDC_STEP;
+}
+
+static int max8660_dcdc_set(struct regulator_dev *rdev, int min_uV, int max_uV)
+{
+	struct max8660 *max8660 = rdev_get_drvdata(rdev);
+	u8 reg, selector, bits;
+	int ret;
+
+	if (min_uV < MAX8660_DCDC_MIN_UV || min_uV > MAX8660_DCDC_MAX_UV)
+		return -EINVAL;
+	if (max_uV < MAX8660_DCDC_MIN_UV || max_uV > MAX8660_DCDC_MAX_UV)
+		return -EINVAL;
+
+	selector = (min_uV - (MAX8660_DCDC_MIN_UV - MAX8660_DCDC_STEP + 1))
+			/ MAX8660_DCDC_STEP;
+
+	ret = max8660_dcdc_list(rdev, selector);
+	if (ret < 0 || ret > max_uV)
+		return -EINVAL;
+
+	reg = (rdev_get_id(rdev) == MAX8660_V3) ? MAX8660_ADTV2 : MAX8660_SDTV2;
+	ret = max8660_write(max8660, reg, 0, selector);
+	if (ret)
+		return ret;
+
+	/* Select target voltage register and activate regulation */
+	bits = (rdev_get_id(rdev) == MAX8660_V3) ? 0x03 : 0x30;
+	return max8660_write(max8660, MAX8660_VCC1, 0xff, bits);
+}
+
+static struct regulator_ops max8660_dcdc_ops = {
+	.is_enabled = max8660_dcdc_is_enabled,
+	.list_voltage = max8660_dcdc_list,
+	.set_voltage = max8660_dcdc_set,
+	.get_voltage = max8660_dcdc_get,
+};
+
+
+/*
+ * LDO5 functions
+ */
+
+static int max8660_ldo5_list(struct regulator_dev *rdev, unsigned selector)
+{
+	if (selector > MAX8660_LDO5_MAX_SEL)
+		return -EINVAL;
+	return MAX8660_LDO5_MIN_UV + selector * MAX8660_LDO5_STEP;
+}
+
+static int max8660_ldo5_get(struct regulator_dev *rdev)
+{
+	struct max8660 *max8660 = rdev_get_drvdata(rdev);
+	u8 selector = max8660->shadow_regs[MAX8660_MDTV2];
+
+	return MAX8660_LDO5_MIN_UV + selector * MAX8660_LDO5_STEP;
+}
+
+static int max8660_ldo5_set(struct regulator_dev *rdev, int min_uV, int max_uV)
+{
+	struct max8660 *max8660 = rdev_get_drvdata(rdev);
+	u8 selector;
+	int ret;
+
+	if (min_uV < MAX8660_LDO5_MIN_UV || min_uV > MAX8660_LDO5_MAX_UV)
+		return -EINVAL;
+	if (max_uV < MAX8660_LDO5_MIN_UV || max_uV > MAX8660_LDO5_MAX_UV)
+		return -EINVAL;
+
+	selector = (min_uV - (MAX8660_LDO5_MIN_UV - MAX8660_LDO5_STEP + 1))
+			/ MAX8660_LDO5_STEP;
+	ret = max8660_ldo5_list(rdev, selector);
+	if (ret < 0 || ret > max_uV)
+		return -EINVAL;
+
+	ret = max8660_write(max8660, MAX8660_MDTV2, 0, selector);
+	if (ret)
+		return ret;
+
+	/* Select target voltage register and activate regulation */
+	return max8660_write(max8660, MAX8660_VCC1, 0xff, 0xc0);
+}
+
+static struct regulator_ops max8660_ldo5_ops = {
+	.list_voltage = max8660_ldo5_list,
+	.set_voltage = max8660_ldo5_set,
+	.get_voltage = max8660_ldo5_get,
+};
+
+
+/*
+ * LDO67 functions
+ */
+
+static int max8660_ldo67_is_enabled(struct regulator_dev *rdev)
+{
+	struct max8660 *max8660 = rdev_get_drvdata(rdev);
+	u8 val = max8660->shadow_regs[MAX8660_OVER2];
+	u8 mask = (rdev_get_id(rdev) == MAX8660_V6) ? 2 : 4;
+	return !!(val & mask);
+}
+
+static int max8660_ldo67_enable(struct regulator_dev *rdev)
+{
+	struct max8660 *max8660 = rdev_get_drvdata(rdev);
+	u8 bit = (rdev_get_id(rdev) == MAX8660_V6) ? 2 : 4;
+	return max8660_write(max8660, MAX8660_OVER2, 0xff, bit);
+}
+
+static int max8660_ldo67_disable(struct regulator_dev *rdev)
+{
+	struct max8660 *max8660 = rdev_get_drvdata(rdev);
+	u8 mask = (rdev_get_id(rdev) == MAX8660_V6) ? ~2 : ~4;
+	return max8660_write(max8660, MAX8660_OVER2, mask, 0);
+}
+
+static int max8660_ldo67_list(struct regulator_dev *rdev, unsigned selector)
+{
+	if (selector > MAX8660_LDO67_MAX_SEL)
+		return -EINVAL;
+	return MAX8660_LDO67_MIN_UV + selector * MAX8660_LDO67_STEP;
+}
+
+static int max8660_ldo67_get(struct regulator_dev *rdev)
+{
+	struct max8660 *max8660 = rdev_get_drvdata(rdev);
+	u8 shift = (rdev_get_id(rdev) == MAX8660_V6) ? 0 : 4;
+	u8 selector = (max8660->shadow_regs[MAX8660_L12VCR] >> shift) & 0xf;
+
+	return MAX8660_LDO67_MIN_UV + selector * MAX8660_LDO67_STEP;
+}
+
+static int max8660_ldo67_set(struct regulator_dev *rdev, int min_uV, int max_uV)
+{
+	struct max8660 *max8660 = rdev_get_drvdata(rdev);
+	u8 selector;
+	int ret;
+
+	if (min_uV < MAX8660_LDO67_MIN_UV || min_uV > MAX8660_LDO67_MAX_UV)
+		return -EINVAL;
+	if (max_uV < MAX8660_LDO67_MIN_UV || max_uV > MAX8660_LDO67_MAX_UV)
+		return -EINVAL;
+
+	selector = (min_uV - (MAX8660_LDO67_MIN_UV - MAX8660_LDO67_STEP + 1))
+			/ MAX8660_LDO67_STEP;
+
+	ret = max8660_ldo67_list(rdev, selector);
+	if (ret < 0 || ret > max_uV)
+		return -EINVAL;
+
+	if (rdev_get_id(rdev) == MAX8660_V6)
+		return max8660_write(max8660, MAX8660_L12VCR, 0xf0, selector);
+	else
+		return max8660_write(max8660, MAX8660_L12VCR, 0x0f, selector << 4);
+}
+
+static struct regulator_ops max8660_ldo67_ops = {
+	.is_enabled = max8660_ldo67_is_enabled,
+	.enable = max8660_ldo67_enable,
+	.disable = max8660_ldo67_disable,
+	.list_voltage = max8660_ldo67_list,
+	.get_voltage = max8660_ldo67_get,
+	.set_voltage = max8660_ldo67_set,
+};
+
+static struct regulator_desc max8660_reg[] = {
+	{
+		.name = "V3(DCDC)",
+		.id = MAX8660_V3,
+		.ops = &max8660_dcdc_ops,
+		.type = REGULATOR_VOLTAGE,
+		.n_voltages = MAX8660_DCDC_MAX_SEL + 1,
+		.owner = THIS_MODULE,
+	},
+	{
+		.name = "V4(DCDC)",
+		.id = MAX8660_V4,
+		.ops = &max8660_dcdc_ops,
+		.type = REGULATOR_VOLTAGE,
+		.n_voltages = MAX8660_DCDC_MAX_SEL + 1,
+		.owner = THIS_MODULE,
+	},
+	{
+		.name = "V5(LDO)",
+		.id = MAX8660_V5,
+		.ops = &max8660_ldo5_ops,
+		.type = REGULATOR_VOLTAGE,
+		.n_voltages = MAX8660_LDO5_MAX_SEL + 1,
+		.owner = THIS_MODULE,
+	},
+	{
+		.name = "V6(LDO)",
+		.id = MAX8660_V6,
+		.ops = &max8660_ldo67_ops,
+		.type = REGULATOR_VOLTAGE,
+		.n_voltages = MAX8660_LDO67_MAX_SEL + 1,
+		.owner = THIS_MODULE,
+	},
+	{
+		.name = "V7(LDO)",
+		.id = MAX8660_V7,
+		.ops = &max8660_ldo67_ops,
+		.type = REGULATOR_VOLTAGE,
+		.n_voltages = MAX8660_LDO67_MAX_SEL + 1,
+		.owner = THIS_MODULE,
+	},
+};
+
+static int max8660_probe(struct i2c_client *client,
+			      const struct i2c_device_id *i2c_id)
+{
+	struct regulator_dev **rdev;
+	struct max8660_platform_data *pdata = client->dev.platform_data;
+	struct max8660 *max8660;
+	int boot_on, i, id, ret = -EINVAL;
+
+	if (pdata->num_subdevs > MAX8660_V_END) {
+		dev_err(&client->dev, "Too much regulators found!\n");
+		goto out;
+	}
+
+	max8660 = kzalloc(sizeof(struct max8660) +
+			sizeof(struct regulator_dev *) * MAX8660_V_END,
+			GFP_KERNEL);
+	if (!max8660) {
+		ret = -ENOMEM;
+		goto out;
+	}
+
+	max8660->client = client;
+	rdev = max8660->rdev;
+
+	if (pdata->en34_is_high) {
+		/* Simulate always on */
+		max8660->shadow_regs[MAX8660_OVER1] = 5;
+	} else {
+		/* Otherwise devices can be toggled via software */
+		max8660_dcdc_ops.enable = max8660_dcdc_enable;
+		max8660_dcdc_ops.disable = max8660_dcdc_disable;
+	}
+
+	/*
+	 * First, set up shadow registers to prevent glitches. As some
+	 * registers are shared between regulators, everything must be properly
+	 * set up for all regulators in advance.
+	 */
+	max8660->shadow_regs[MAX8660_ADTV1] =
+		max8660->shadow_regs[MAX8660_ADTV2] =
+		max8660->shadow_regs[MAX8660_SDTV1] =
+		max8660->shadow_regs[MAX8660_SDTV2] = 0x1b;
+	max8660->shadow_regs[MAX8660_MDTV1] =
+		max8660->shadow_regs[MAX8660_MDTV2] = 0x04;
+
+	for (i = 0; i < pdata->num_subdevs; i++) {
+
+		if (!pdata->subdevs[i].platform_data)
+			goto err_free;
+
+		boot_on = pdata->subdevs[i].platform_data->constraints.boot_on;
+
+		switch (pdata->subdevs[i].id) {
+		case MAX8660_V3:
+			if (boot_on)
+				max8660->shadow_regs[MAX8660_OVER1] |= 1;
+			break;
+
+		case MAX8660_V4:
+			if (boot_on)
+				max8660->shadow_regs[MAX8660_OVER1] |= 4;
+			break;
+
+		case MAX8660_V5:
+			break;
+
+		case MAX8660_V6:
+			if (boot_on)
+				max8660->shadow_regs[MAX8660_OVER2] |= 2;
+			break;
+
+		case MAX8660_V7:
+			if (!strcmp(i2c_id->name, "max8661")) {
+				dev_err(&client->dev, "Regulator not on this chip!\n");
+				goto err_free;
+			}
+
+			if (boot_on)
+				max8660->shadow_regs[MAX8660_OVER2] |= 4;
+			break;
+
+		default:
+			dev_err(&client->dev, "invalid regulator %s\n",
+				 pdata->subdevs[i].name);
+			goto err_free;
+		}
+	}
+
+	/* Finally register devices */
+	for (i = 0; i < pdata->num_subdevs; i++) {
+
+		id = pdata->subdevs[i].id;
+
+		rdev[i] = regulator_register(&max8660_reg[id], &client->dev,
+					     pdata->subdevs[i].platform_data,
+					     max8660);
+		if (IS_ERR(rdev[i])) {
+			ret = PTR_ERR(rdev[i]);
+			dev_err(&client->dev, "failed to register %s\n",
+				max8660_reg[id].name);
+			goto err_unregister;
+		}
+	}
+
+	i2c_set_clientdata(client, rdev);
+	dev_info(&client->dev, "Maxim 8660/8661 regulator driver loaded\n");
+	return 0;
+
+err_unregister:
+	while (--i >= 0)
+		regulator_unregister(rdev[i]);
+err_free:
+	kfree(max8660);
+out:
+	return ret;
+}
+
+static int max8660_remove(struct i2c_client *client)
+{
+	struct regulator_dev **rdev = i2c_get_clientdata(client);
+	int i;
+
+	for (i = 0; i < MAX8660_V_END; i++)
+		if (rdev[i])
+			regulator_unregister(rdev[i]);
+	kfree(rdev);
+	i2c_set_clientdata(client, NULL);
+
+	return 0;
+}
+
+static const struct i2c_device_id max8660_id[] = {
+	{ "max8660", 0 },
+	{ "max8661", 0 },
+	{ }
+};
+MODULE_DEVICE_TABLE(i2c, max8660_id);
+
+static struct i2c_driver max8660_driver = {
+	.probe = max8660_probe,
+	.remove = max8660_remove,
+	.driver		= {
+		.name	= "max8660",
+	},
+	.id_table	= max8660_id,
+};
+
+static int __init max8660_init(void)
+{
+	return i2c_add_driver(&max8660_driver);
+}
+subsys_initcall(max8660_init);
+
+static void __exit max8660_exit(void)
+{
+	i2c_del_driver(&max8660_driver);
+}
+module_exit(max8660_exit);
+
+/* Module information */
+MODULE_DESCRIPTION("MAXIM 8660/8661 voltage regulator driver");
+MODULE_AUTHOR("Wolfram Sang");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/regulator/mc13783-regulator.c b/drivers/regulator/mc13783-regulator.c
new file mode 100644
index 000000000000..39c495300045
--- /dev/null
+++ b/drivers/regulator/mc13783-regulator.c
@@ -0,0 +1,245 @@
+/*
+ * Regulator Driver for Freescale MC13783 PMIC
+ *
+ * Copyright (C) 2008 Sascha Hauer, Pengutronix <s.hauer@pengutronix.de>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/mfd/mc13783.h>
+#include <linux/regulator/machine.h>
+#include <linux/regulator/driver.h>
+#include <linux/platform_device.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/err.h>
+
+#define MC13783_REG_SWITCHERS4			28
+#define MC13783_REG_SWITCHERS4_PLLEN			(1 << 18)
+
+#define MC13783_REG_SWITCHERS5			29
+#define MC13783_REG_SWITCHERS5_SW3EN			(1 << 20)
+
+#define MC13783_REG_REGULATORMODE0		32
+#define MC13783_REG_REGULATORMODE0_VAUDIOEN		(1 << 0)
+#define MC13783_REG_REGULATORMODE0_VIOHIEN		(1 << 3)
+#define MC13783_REG_REGULATORMODE0_VIOLOEN		(1 << 6)
+#define MC13783_REG_REGULATORMODE0_VDIGEN		(1 << 9)
+#define MC13783_REG_REGULATORMODE0_VGENEN		(1 << 12)
+#define MC13783_REG_REGULATORMODE0_VRFDIGEN		(1 << 15)
+#define MC13783_REG_REGULATORMODE0_VRFREFEN		(1 << 18)
+#define MC13783_REG_REGULATORMODE0_VRFCPEN		(1 << 21)
+
+#define MC13783_REG_REGULATORMODE1		33
+#define MC13783_REG_REGULATORMODE1_VSIMEN		(1 << 0)
+#define MC13783_REG_REGULATORMODE1_VESIMEN		(1 << 3)
+#define MC13783_REG_REGULATORMODE1_VCAMEN		(1 << 6)
+#define MC13783_REG_REGULATORMODE1_VRFBGEN		(1 << 9)
+#define MC13783_REG_REGULATORMODE1_VVIBEN		(1 << 11)
+#define MC13783_REG_REGULATORMODE1_VRF1EN		(1 << 12)
+#define MC13783_REG_REGULATORMODE1_VRF2EN		(1 << 15)
+#define MC13783_REG_REGULATORMODE1_VMMC1EN		(1 << 18)
+#define MC13783_REG_REGULATORMODE1_VMMC2EN		(1 << 21)
+
+#define MC13783_REG_POWERMISC			34
+#define MC13783_REG_POWERMISC_GPO1EN			(1 << 6)
+#define MC13783_REG_POWERMISC_GPO2EN			(1 << 8)
+#define MC13783_REG_POWERMISC_GPO3EN			(1 << 10)
+#define MC13783_REG_POWERMISC_GPO4EN			(1 << 12)
+
+struct mc13783_regulator {
+	struct regulator_desc desc;
+	int reg;
+	int enable_bit;
+};
+
+static struct regulator_ops mc13783_regulator_ops;
+
+#define MC13783_DEFINE(prefix, _name, _reg)				\
+	[MC13783_ ## prefix ## _ ## _name] = {				\
+		.desc = {						\
+			.name = #prefix "_" #_name,			\
+			.ops = &mc13783_regulator_ops,			\
+			.type = REGULATOR_VOLTAGE,			\
+			.id = MC13783_ ## prefix ## _ ## _name,		\
+			.owner = THIS_MODULE,				\
+		},							\
+		.reg = MC13783_REG_ ## _reg,				\
+		.enable_bit = MC13783_REG_ ## _reg ## _ ## _name ## EN,	\
+	}
+
+#define MC13783_DEFINE_SW(_name, _reg) MC13783_DEFINE(SW, _name, _reg)
+#define MC13783_DEFINE_REGU(_name, _reg) MC13783_DEFINE(REGU, _name, _reg)
+
+static struct mc13783_regulator mc13783_regulators[] = {
+	MC13783_DEFINE_SW(SW3, SWITCHERS5),
+	MC13783_DEFINE_SW(PLL, SWITCHERS4),
+
+	MC13783_DEFINE_REGU(VAUDIO, REGULATORMODE0),
+	MC13783_DEFINE_REGU(VIOHI, REGULATORMODE0),
+	MC13783_DEFINE_REGU(VIOLO, REGULATORMODE0),
+	MC13783_DEFINE_REGU(VDIG, REGULATORMODE0),
+	MC13783_DEFINE_REGU(VGEN, REGULATORMODE0),
+	MC13783_DEFINE_REGU(VRFDIG, REGULATORMODE0),
+	MC13783_DEFINE_REGU(VRFREF, REGULATORMODE0),
+	MC13783_DEFINE_REGU(VRFCP, REGULATORMODE0),
+	MC13783_DEFINE_REGU(VSIM, REGULATORMODE1),
+	MC13783_DEFINE_REGU(VESIM, REGULATORMODE1),
+	MC13783_DEFINE_REGU(VCAM, REGULATORMODE1),
+	MC13783_DEFINE_REGU(VRFBG, REGULATORMODE1),
+	MC13783_DEFINE_REGU(VVIB, REGULATORMODE1),
+	MC13783_DEFINE_REGU(VRF1, REGULATORMODE1),
+	MC13783_DEFINE_REGU(VRF2, REGULATORMODE1),
+	MC13783_DEFINE_REGU(VMMC1, REGULATORMODE1),
+	MC13783_DEFINE_REGU(VMMC2, REGULATORMODE1),
+	MC13783_DEFINE_REGU(GPO1, POWERMISC),
+	MC13783_DEFINE_REGU(GPO2, POWERMISC),
+	MC13783_DEFINE_REGU(GPO3, POWERMISC),
+	MC13783_DEFINE_REGU(GPO4, POWERMISC),
+};
+
+struct mc13783_regulator_priv {
+	struct mc13783 *mc13783;
+	struct regulator_dev *regulators[];
+};
+
+static int mc13783_regulator_enable(struct regulator_dev *rdev)
+{
+	struct mc13783_regulator_priv *priv = rdev_get_drvdata(rdev);
+	int id = rdev_get_id(rdev);
+	int ret;
+
+	dev_dbg(rdev_get_dev(rdev), "%s id: %d\n", __func__, id);
+
+	mc13783_lock(priv->mc13783);
+	ret = mc13783_reg_rmw(priv->mc13783, mc13783_regulators[id].reg,
+			mc13783_regulators[id].enable_bit,
+			mc13783_regulators[id].enable_bit);
+	mc13783_unlock(priv->mc13783);
+
+	return ret;
+}
+
+static int mc13783_regulator_disable(struct regulator_dev *rdev)
+{
+	struct mc13783_regulator_priv *priv = rdev_get_drvdata(rdev);
+	int id = rdev_get_id(rdev);
+	int ret;
+
+	dev_dbg(rdev_get_dev(rdev), "%s id: %d\n", __func__, id);
+
+	mc13783_lock(priv->mc13783);
+	ret = mc13783_reg_rmw(priv->mc13783, mc13783_regulators[id].reg,
+			mc13783_regulators[id].enable_bit, 0);
+	mc13783_unlock(priv->mc13783);
+
+	return ret;
+}
+
+static int mc13783_regulator_is_enabled(struct regulator_dev *rdev)
+{
+	struct mc13783_regulator_priv *priv = rdev_get_drvdata(rdev);
+	int ret, id = rdev_get_id(rdev);
+	unsigned int val;
+
+	mc13783_lock(priv->mc13783);
+	ret = mc13783_reg_read(priv->mc13783, mc13783_regulators[id].reg, &val);
+	mc13783_unlock(priv->mc13783);
+
+	if (ret)
+		return ret;
+
+	return (val & mc13783_regulators[id].enable_bit) != 0;
+}
+
+static struct regulator_ops mc13783_regulator_ops = {
+	.enable = mc13783_regulator_enable,
+	.disable = mc13783_regulator_disable,
+	.is_enabled = mc13783_regulator_is_enabled,
+};
+
+static int __devinit mc13783_regulator_probe(struct platform_device *pdev)
+{
+	struct mc13783_regulator_priv *priv;
+	struct mc13783 *mc13783 = dev_get_drvdata(pdev->dev.parent);
+	struct mc13783_regulator_platform_data *pdata =
+		dev_get_platdata(&pdev->dev);
+	struct mc13783_regulator_init_data *init_data;
+	int i, ret;
+
+	dev_dbg(&pdev->dev, "mc13783_regulator_probe id %d\n", pdev->id);
+
+	priv = kzalloc(sizeof(*priv) +
+			pdata->num_regulators * sizeof(priv->regulators[0]),
+			GFP_KERNEL);
+	if (!priv)
+		return -ENOMEM;
+
+	priv->mc13783 = mc13783;
+
+	for (i = 0; i < pdata->num_regulators; i++) {
+		init_data = &pdata->regulators[i];
+		priv->regulators[i] = regulator_register(
+				&mc13783_regulators[init_data->id].desc,
+				&pdev->dev, init_data->init_data, priv);
+
+		if (IS_ERR(priv->regulators[i])) {
+			dev_err(&pdev->dev, "failed to register regulator %s\n",
+				mc13783_regulators[i].desc.name);
+			ret = PTR_ERR(priv->regulators[i]);
+			goto err;
+		}
+	}
+
+	platform_set_drvdata(pdev, priv);
+
+	return 0;
+err:
+	while (--i >= 0)
+		regulator_unregister(priv->regulators[i]);
+
+	kfree(priv);
+
+	return ret;
+}
+
+static int __devexit mc13783_regulator_remove(struct platform_device *pdev)
+{
+	struct mc13783_regulator_priv *priv = platform_get_drvdata(pdev);
+	struct mc13783_regulator_platform_data *pdata =
+		dev_get_platdata(&pdev->dev);
+	int i;
+
+	for (i = 0; i < pdata->num_regulators; i++)
+		regulator_unregister(priv->regulators[i]);
+
+	return 0;
+}
+
+static struct platform_driver mc13783_regulator_driver = {
+	.driver	= {
+		.name	= "mc13783-regulator",
+		.owner	= THIS_MODULE,
+	},
+	.remove		= __devexit_p(mc13783_regulator_remove),
+	.probe		= mc13783_regulator_probe,
+};
+
+static int __init mc13783_regulator_init(void)
+{
+	return platform_driver_register(&mc13783_regulator_driver);
+}
+subsys_initcall(mc13783_regulator_init);
+
+static void __exit mc13783_regulator_exit(void)
+{
+	platform_driver_unregister(&mc13783_regulator_driver);
+}
+module_exit(mc13783_regulator_exit);
+
+MODULE_LICENSE("GPL v2");
+MODULE_AUTHOR("Sascha Hauer <s.hauer@pengutronix.de");
+MODULE_DESCRIPTION("Regulator Driver for Freescale MC13783 PMIC");
+MODULE_ALIAS("platform:mc13783-regulator");
diff --git a/drivers/regulator/mc13783.c b/drivers/regulator/mc13783.c
deleted file mode 100644
index 710211f67449..000000000000
--- a/drivers/regulator/mc13783.c
+++ /dev/null
@@ -1,410 +0,0 @@
-/*
- * Regulator Driver for Freescale MC13783 PMIC
- *
- * Copyright (C) 2008 Sascha Hauer, Pengutronix <s.hauer@pengutronix.de>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#include <linux/mfd/mc13783-private.h>
-#include <linux/regulator/machine.h>
-#include <linux/regulator/driver.h>
-#include <linux/platform_device.h>
-#include <linux/mfd/mc13783.h>
-#include <linux/kernel.h>
-#include <linux/init.h>
-#include <linux/err.h>
-
-struct mc13783_regulator {
-	struct regulator_desc desc;
-	int reg;
-	int enable_bit;
-};
-
-static struct regulator_ops mc13783_regulator_ops;
-
-static struct mc13783_regulator mc13783_regulators[] = {
-	[MC13783_SW_SW3] = {
-		.desc = {
-			.name	= "SW_SW3",
-			.ops	= &mc13783_regulator_ops,
-			.type	= REGULATOR_VOLTAGE,
-			.id	= MC13783_SW_SW3,
-			.owner	= THIS_MODULE,
-		},
-		.reg = MC13783_REG_SWITCHERS_5,
-		.enable_bit = MC13783_SWCTRL_SW3_EN,
-	},
-	[MC13783_SW_PLL] = {
-		.desc = {
-			.name	= "SW_PLL",
-			.ops	= &mc13783_regulator_ops,
-			.type	= REGULATOR_VOLTAGE,
-			.id	= MC13783_SW_PLL,
-			.owner	= THIS_MODULE,
-		},
-		.reg = MC13783_REG_SWITCHERS_4,
-		.enable_bit = MC13783_SWCTRL_PLL_EN,
-	},
-	[MC13783_REGU_VAUDIO] = {
-		.desc = {
-			.name	= "REGU_VAUDIO",
-			.ops	= &mc13783_regulator_ops,
-			.type	= REGULATOR_VOLTAGE,
-			.id	= MC13783_REGU_VAUDIO,
-			.owner	= THIS_MODULE,
-		},
-		.reg = MC13783_REG_REGULATOR_MODE_0,
-		.enable_bit = MC13783_REGCTRL_VAUDIO_EN,
-	},
-	[MC13783_REGU_VIOHI] = {
-		.desc = {
-			.name	= "REGU_VIOHI",
-			.ops	= &mc13783_regulator_ops,
-			.type	= REGULATOR_VOLTAGE,
-			.id	= MC13783_REGU_VIOHI,
-			.owner	= THIS_MODULE,
-		},
-		.reg = MC13783_REG_REGULATOR_MODE_0,
-		.enable_bit = MC13783_REGCTRL_VIOHI_EN,
-	},
-	[MC13783_REGU_VIOLO] = {
-		.desc = {
-			.name	= "REGU_VIOLO",
-			.ops	= &mc13783_regulator_ops,
-			.type	= REGULATOR_VOLTAGE,
-			.id	= MC13783_REGU_VIOLO,
-			.owner	= THIS_MODULE,
-		},
-		.reg = MC13783_REG_REGULATOR_MODE_0,
-		.enable_bit = MC13783_REGCTRL_VIOLO_EN,
-	},
-	[MC13783_REGU_VDIG] = {
-		.desc = {
-			.name	= "REGU_VDIG",
-			.ops	= &mc13783_regulator_ops,
-			.type	= REGULATOR_VOLTAGE,
-			.id	= MC13783_REGU_VDIG,
-			.owner	= THIS_MODULE,
-		},
-		.reg = MC13783_REG_REGULATOR_MODE_0,
-		.enable_bit = MC13783_REGCTRL_VDIG_EN,
-	},
-	[MC13783_REGU_VGEN] = {
-		.desc = {
-			.name	= "REGU_VGEN",
-			.ops	= &mc13783_regulator_ops,
-			.type	= REGULATOR_VOLTAGE,
-			.id	= MC13783_REGU_VGEN,
-			.owner	= THIS_MODULE,
-		},
-		.reg = MC13783_REG_REGULATOR_MODE_0,
-		.enable_bit = MC13783_REGCTRL_VGEN_EN,
-	},
-	[MC13783_REGU_VRFDIG] = {
-		.desc = {
-			.name	= "REGU_VRFDIG",
-			.ops	= &mc13783_regulator_ops,
-			.type	= REGULATOR_VOLTAGE,
-			.id	= MC13783_REGU_VRFDIG,
-			.owner	= THIS_MODULE,
-		},
-		.reg = MC13783_REG_REGULATOR_MODE_0,
-		.enable_bit = MC13783_REGCTRL_VRFDIG_EN,
-	},
-	[MC13783_REGU_VRFREF] = {
-		.desc = {
-			.name	= "REGU_VRFREF",
-			.ops	= &mc13783_regulator_ops,
-			.type	= REGULATOR_VOLTAGE,
-			.id	= MC13783_REGU_VRFREF,
-			.owner	= THIS_MODULE,
-		},
-		.reg = MC13783_REG_REGULATOR_MODE_0,
-		.enable_bit = MC13783_REGCTRL_VRFREF_EN,
-	},
-	[MC13783_REGU_VRFCP] = {
-		.desc = {
-			.name	= "REGU_VRFCP",
-			.ops	= &mc13783_regulator_ops,
-			.type	= REGULATOR_VOLTAGE,
-			.id	= MC13783_REGU_VRFCP,
-			.owner	= THIS_MODULE,
-		},
-		.reg = MC13783_REG_REGULATOR_MODE_0,
-		.enable_bit = MC13783_REGCTRL_VRFCP_EN,
-	},
-	[MC13783_REGU_VSIM] = {
-		.desc = {
-			.name	= "REGU_VSIM",
-			.ops	= &mc13783_regulator_ops,
-			.type	= REGULATOR_VOLTAGE,
-			.id	= MC13783_REGU_VSIM,
-			.owner	= THIS_MODULE,
-		},
-		.reg = MC13783_REG_REGULATOR_MODE_1,
-		.enable_bit = MC13783_REGCTRL_VSIM_EN,
-	},
-	[MC13783_REGU_VESIM] = {
-		.desc = {
-			.name	= "REGU_VESIM",
-			.ops	= &mc13783_regulator_ops,
-			.type	= REGULATOR_VOLTAGE,
-			.id	= MC13783_REGU_VESIM,
-			.owner	= THIS_MODULE,
-		},
-		.reg = MC13783_REG_REGULATOR_MODE_1,
-		.enable_bit = MC13783_REGCTRL_VESIM_EN,
-	},
-	[MC13783_REGU_VCAM] = {
-		.desc = {
-			.name	= "REGU_VCAM",
-			.ops	= &mc13783_regulator_ops,
-			.type	= REGULATOR_VOLTAGE,
-			.id	= MC13783_REGU_VCAM,
-			.owner	= THIS_MODULE,
-		},
-		.reg = MC13783_REG_REGULATOR_MODE_1,
-		.enable_bit = MC13783_REGCTRL_VCAM_EN,
-	},
-	[MC13783_REGU_VRFBG] = {
-		.desc = {
-			.name	= "REGU_VRFBG",
-			.ops	= &mc13783_regulator_ops,
-			.type	= REGULATOR_VOLTAGE,
-			.id	= MC13783_REGU_VRFBG,
-			.owner	= THIS_MODULE,
-		},
-		.reg = MC13783_REG_REGULATOR_MODE_1,
-		.enable_bit = MC13783_REGCTRL_VRFBG_EN,
-	},
-	[MC13783_REGU_VVIB] = {
-		.desc = {
-			.name	= "REGU_VVIB",
-			.ops	= &mc13783_regulator_ops,
-			.type	= REGULATOR_VOLTAGE,
-			.id	= MC13783_REGU_VVIB,
-			.owner	= THIS_MODULE,
-		},
-		.reg = MC13783_REG_REGULATOR_MODE_1,
-		.enable_bit = MC13783_REGCTRL_VVIB_EN,
-	},
-	[MC13783_REGU_VRF1] = {
-		.desc = {
-			.name	= "REGU_VRF1",
-			.ops	= &mc13783_regulator_ops,
-			.type	= REGULATOR_VOLTAGE,
-			.id	= MC13783_REGU_VRF1,
-			.owner	= THIS_MODULE,
-		},
-		.reg = MC13783_REG_REGULATOR_MODE_1,
-		.enable_bit = MC13783_REGCTRL_VRF1_EN,
-	},
-	[MC13783_REGU_VRF2] = {
-		.desc = {
-			.name	= "REGU_VRF2",
-			.ops	= &mc13783_regulator_ops,
-			.type	= REGULATOR_VOLTAGE,
-			.id	= MC13783_REGU_VRF2,
-			.owner	= THIS_MODULE,
-		},
-		.reg = MC13783_REG_REGULATOR_MODE_1,
-		.enable_bit = MC13783_REGCTRL_VRF2_EN,
-	},
-	[MC13783_REGU_VMMC1] = {
-		.desc = {
-			.name	= "REGU_VMMC1",
-			.ops	= &mc13783_regulator_ops,
-			.type	= REGULATOR_VOLTAGE,
-			.id	= MC13783_REGU_VMMC1,
-			.owner	= THIS_MODULE,
-		},
-		.reg = MC13783_REG_REGULATOR_MODE_1,
-		.enable_bit = MC13783_REGCTRL_VMMC1_EN,
-	},
-	[MC13783_REGU_VMMC2] = {
-		.desc = {
-			.name	= "REGU_VMMC2",
-			.ops	= &mc13783_regulator_ops,
-			.type	= REGULATOR_VOLTAGE,
-			.id	= MC13783_REGU_VMMC2,
-			.owner	= THIS_MODULE,
-		},
-		.reg = MC13783_REG_REGULATOR_MODE_1,
-		.enable_bit = MC13783_REGCTRL_VMMC2_EN,
-	},
-	[MC13783_REGU_GPO1] = {
-		.desc = {
-			.name	= "REGU_GPO1",
-			.ops	= &mc13783_regulator_ops,
-			.type	= REGULATOR_VOLTAGE,
-			.id	= MC13783_REGU_GPO1,
-			.owner	= THIS_MODULE,
-		},
-		.reg = MC13783_REG_POWER_MISCELLANEOUS,
-		.enable_bit = MC13783_REGCTRL_GPO1_EN,
-	},
-	[MC13783_REGU_GPO2] = {
-		.desc = {
-			.name	= "REGU_GPO2",
-			.ops	= &mc13783_regulator_ops,
-			.type	= REGULATOR_VOLTAGE,
-			.id	= MC13783_REGU_GPO2,
-			.owner	= THIS_MODULE,
-		},
-		.reg = MC13783_REG_POWER_MISCELLANEOUS,
-		.enable_bit = MC13783_REGCTRL_GPO2_EN,
-	},
-	[MC13783_REGU_GPO3] = {
-		.desc = {
-			.name	= "REGU_GPO3",
-			.ops	= &mc13783_regulator_ops,
-			.type	= REGULATOR_VOLTAGE,
-			.id	= MC13783_REGU_GPO3,
-			.owner	= THIS_MODULE,
-		},
-		.reg = MC13783_REG_POWER_MISCELLANEOUS,
-		.enable_bit = MC13783_REGCTRL_GPO3_EN,
-	},
-	[MC13783_REGU_GPO4] = {
-		.desc = {
-			.name	= "REGU_GPO4",
-			.ops	= &mc13783_regulator_ops,
-			.type	= REGULATOR_VOLTAGE,
-			.id	= MC13783_REGU_GPO4,
-			.owner	= THIS_MODULE,
-		},
-		.reg = MC13783_REG_POWER_MISCELLANEOUS,
-		.enable_bit = MC13783_REGCTRL_GPO4_EN,
-	},
-};
-
-struct mc13783_priv {
-	struct regulator_desc desc[ARRAY_SIZE(mc13783_regulators)];
-	struct mc13783 *mc13783;
-	struct regulator_dev *regulators[0];
-};
-
-static int mc13783_enable(struct regulator_dev *rdev)
-{
-	struct mc13783_priv *priv = rdev_get_drvdata(rdev);
-	int id = rdev_get_id(rdev);
-
-	dev_dbg(rdev_get_dev(rdev), "%s id: %d\n", __func__, id);
-
-	return mc13783_set_bits(priv->mc13783, mc13783_regulators[id].reg,
-			mc13783_regulators[id].enable_bit,
-			mc13783_regulators[id].enable_bit);
-}
-
-static int mc13783_disable(struct regulator_dev *rdev)
-{
-	struct mc13783_priv *priv = rdev_get_drvdata(rdev);
-	int id = rdev_get_id(rdev);
-
-	dev_dbg(rdev_get_dev(rdev), "%s id: %d\n", __func__, id);
-
-	return mc13783_set_bits(priv->mc13783, mc13783_regulators[id].reg,
-			mc13783_regulators[id].enable_bit, 0);
-}
-
-static int mc13783_is_enabled(struct regulator_dev *rdev)
-{
-	struct mc13783_priv *priv = rdev_get_drvdata(rdev);
-	int ret, id = rdev_get_id(rdev);
-	unsigned int val;
-
-	ret = mc13783_reg_read(priv->mc13783, mc13783_regulators[id].reg, &val);
-	if (ret)
-		return ret;
-
-	return (val & mc13783_regulators[id].enable_bit) != 0;
-}
-
-static struct regulator_ops mc13783_regulator_ops = {
-	.enable		= mc13783_enable,
-	.disable	= mc13783_disable,
-	.is_enabled	= mc13783_is_enabled,
-};
-
-static int __devinit mc13783_regulator_probe(struct platform_device *pdev)
-{
-	struct mc13783_priv *priv;
-	struct mc13783 *mc13783 = dev_get_drvdata(pdev->dev.parent);
-	struct mc13783_regulator_init_data *init_data;
-	int i, ret;
-
-	dev_dbg(&pdev->dev, "mc13783_regulator_probe id %d\n", pdev->id);
-
-	priv = kzalloc(sizeof(*priv) + mc13783->num_regulators * sizeof(void *),
-			GFP_KERNEL);
-	if (!priv)
-		return -ENOMEM;
-
-	priv->mc13783 = mc13783;
-
-	for (i = 0; i < mc13783->num_regulators; i++) {
-		init_data = &mc13783->regulators[i];
-		priv->regulators[i] = regulator_register(
-				&mc13783_regulators[init_data->id].desc,
-				&pdev->dev, init_data->init_data, priv);
-
-		if (IS_ERR(priv->regulators[i])) {
-			dev_err(&pdev->dev, "failed to register regulator %s\n",
-				mc13783_regulators[i].desc.name);
-			ret = PTR_ERR(priv->regulators[i]);
-			goto err;
-		}
-	}
-
-	platform_set_drvdata(pdev, priv);
-
-	return 0;
-err:
-	while (--i >= 0)
-		regulator_unregister(priv->regulators[i]);
-
-	kfree(priv);
-
-	return ret;
-}
-
-static int __devexit mc13783_regulator_remove(struct platform_device *pdev)
-{
-	struct mc13783_priv *priv = platform_get_drvdata(pdev);
-	struct mc13783 *mc13783 = priv->mc13783;
-	int i;
-
-	for (i = 0; i < mc13783->num_regulators; i++)
-		regulator_unregister(priv->regulators[i]);
-
-	return 0;
-}
-
-static struct platform_driver mc13783_regulator_driver = {
-	.driver	= {
-		.name	= "mc13783-regulator",
-		.owner	= THIS_MODULE,
-	},
-	.remove		= __devexit_p(mc13783_regulator_remove),
-};
-
-static int __init mc13783_regulator_init(void)
-{
-	return platform_driver_probe(&mc13783_regulator_driver,
-			mc13783_regulator_probe);
-}
-subsys_initcall(mc13783_regulator_init);
-
-static void __exit mc13783_regulator_exit(void)
-{
-	platform_driver_unregister(&mc13783_regulator_driver);
-}
-module_exit(mc13783_regulator_exit);
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Sascha Hauer <s.hauer@pengutronix.de");
-MODULE_DESCRIPTION("Regulator Driver for Freescale MC13783 PMIC");
-MODULE_ALIAS("platform:mc13783-regulator");
diff --git a/drivers/regulator/pcf50633-regulator.c b/drivers/regulator/pcf50633-regulator.c
index 0803ffe6236d..c8f41dc05b76 100644
--- a/drivers/regulator/pcf50633-regulator.c
+++ b/drivers/regulator/pcf50633-regulator.c
@@ -314,13 +314,15 @@ static int __devinit pcf50633_regulator_probe(struct platform_device *pdev)
 	struct pcf50633 *pcf;
 
 	/* Already set by core driver */
-	pcf = platform_get_drvdata(pdev);
+	pcf = dev_to_pcf50633(pdev->dev.parent);
 
 	rdev = regulator_register(&regulators[pdev->id], &pdev->dev,
 				  pdev->dev.platform_data, pcf);
 	if (IS_ERR(rdev))
 		return PTR_ERR(rdev);
 
+	platform_set_drvdata(pdev, rdev);
+
 	if (pcf->pdata->regulator_registered)
 		pcf->pdata->regulator_registered(pcf, pdev->id);
 
@@ -331,6 +333,7 @@ static int __devexit pcf50633_regulator_remove(struct platform_device *pdev)
 {
 	struct regulator_dev *rdev = platform_get_drvdata(pdev);
 
+	platform_set_drvdata(pdev, NULL);
 	regulator_unregister(rdev);
 
 	return 0;
diff --git a/drivers/regulator/twl4030-regulator.c b/drivers/regulator/twl-regulator.c
index e2032fb60b55..7e674859bd59 100644
--- a/drivers/regulator/twl4030-regulator.c
+++ b/drivers/regulator/twl-regulator.c
@@ -1,5 +1,5 @@
 /*
- * twl4030-regulator.c -- support regulators in twl4030 family chips
+ * twl-regulator.c -- support regulators in twl4030/twl6030 family chips
  *
  * Copyright (C) 2008 David Brownell
  *
@@ -12,14 +12,15 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/err.h>
+#include <linux/delay.h>
 #include <linux/platform_device.h>
 #include <linux/regulator/driver.h>
 #include <linux/regulator/machine.h>
-#include <linux/i2c/twl4030.h>
+#include <linux/i2c/twl.h>
 
 
 /*
- * The TWL4030/TW5030/TPS659x0 family chips include power management, a
+ * The TWL4030/TW5030/TPS659x0/TWL6030 family chips include power management, a
  * USB OTG transceiver, an RTC, ADC, PWM, and lots more.  Some versions
  * include an audio codec, battery charger, and more voltage regulators.
  * These chips are often used in OMAP-based systems.
@@ -33,13 +34,19 @@ struct twlreg_info {
 	/* start of regulator's PM_RECEIVER control register bank */
 	u8			base;
 
-	/* twl4030 resource ID, for resource control state machine */
+	/* twl resource ID, for resource control state machine */
 	u8			id;
 
 	/* voltage in mV = table[VSEL]; table_len must be a power-of-two */
 	u8			table_len;
 	const u16		*table;
 
+	/* regulator specific turn-on delay */
+	u16			delay;
+
+	/* State REMAP default configuration */
+	u8			remap;
+
 	/* chip constraints on regulator behavior */
 	u16			min_mV;
 
@@ -52,27 +59,38 @@ struct twlreg_info {
  * The first three registers of all power resource banks help hardware to
  * manage the various resource groups.
  */
+/* Common offset in TWL4030/6030 */
 #define VREG_GRP		0
+/* TWL4030 register offsets */
 #define VREG_TYPE		1
 #define VREG_REMAP		2
 #define VREG_DEDICATED		3	/* LDO control */
-
+/* TWL6030 register offsets */
+#define VREG_TRANS		1
+#define VREG_STATE		2
+#define VREG_VOLTAGE		3
+/* TWL6030 Misc register offsets */
+#define VREG_BC_ALL		1
+#define VREG_BC_REF		2
+#define VREG_BC_PROC		3
+#define VREG_BC_CLK_RST		4
 
 static inline int
-twl4030reg_read(struct twlreg_info *info, unsigned offset)
+twlreg_read(struct twlreg_info *info, unsigned slave_subgp, unsigned offset)
 {
 	u8 value;
 	int status;
 
-	status = twl4030_i2c_read_u8(TWL4030_MODULE_PM_RECEIVER,
+	status = twl_i2c_read_u8(slave_subgp,
 			&value, info->base + offset);
 	return (status < 0) ? status : value;
 }
 
 static inline int
-twl4030reg_write(struct twlreg_info *info, unsigned offset, u8 value)
+twlreg_write(struct twlreg_info *info, unsigned slave_subgp, unsigned offset,
+						 u8 value)
 {
-	return twl4030_i2c_write_u8(TWL4030_MODULE_PM_RECEIVER,
+	return twl_i2c_write_u8(slave_subgp,
 			value, info->base + offset);
 }
 
@@ -80,59 +98,84 @@ twl4030reg_write(struct twlreg_info *info, unsigned offset, u8 value)
 
 /* generic power resource operations, which work on all regulators */
 
-static int twl4030reg_grp(struct regulator_dev *rdev)
+static int twlreg_grp(struct regulator_dev *rdev)
 {
-	return twl4030reg_read(rdev_get_drvdata(rdev), VREG_GRP);
+	return twlreg_read(rdev_get_drvdata(rdev), TWL_MODULE_PM_RECEIVER,
+								 VREG_GRP);
 }
 
 /*
  * Enable/disable regulators by joining/leaving the P1 (processor) group.
  * We assume nobody else is updating the DEV_GRP registers.
  */
-
-#define P3_GRP		BIT(7)		/* "peripherals" */
-#define P2_GRP		BIT(6)		/* secondary processor, modem, etc */
-#define P1_GRP		BIT(5)		/* CPU/Linux */
-
-static int twl4030reg_is_enabled(struct regulator_dev *rdev)
+/* definition for 4030 family */
+#define P3_GRP_4030	BIT(7)		/* "peripherals" */
+#define P2_GRP_4030	BIT(6)		/* secondary processor, modem, etc */
+#define P1_GRP_4030	BIT(5)		/* CPU/Linux */
+/* definition for 6030 family */
+#define P3_GRP_6030	BIT(2)		/* secondary processor, modem, etc */
+#define P2_GRP_6030	BIT(1)		/* "peripherals" */
+#define P1_GRP_6030	BIT(0)		/* CPU/Linux */
+
+static int twlreg_is_enabled(struct regulator_dev *rdev)
 {
-	int	state = twl4030reg_grp(rdev);
+	int	state = twlreg_grp(rdev);
 
 	if (state < 0)
 		return state;
 
-	return (state & P1_GRP) != 0;
+	if (twl_class_is_4030())
+		state &= P1_GRP_4030;
+	else
+		state &= P1_GRP_6030;
+	return state;
 }
 
-static int twl4030reg_enable(struct regulator_dev *rdev)
+static int twlreg_enable(struct regulator_dev *rdev)
 {
 	struct twlreg_info	*info = rdev_get_drvdata(rdev);
 	int			grp;
+	int			ret;
 
-	grp = twl4030reg_read(info, VREG_GRP);
+	grp = twlreg_read(info, TWL_MODULE_PM_RECEIVER, VREG_GRP);
 	if (grp < 0)
 		return grp;
 
-	grp |= P1_GRP;
-	return twl4030reg_write(info, VREG_GRP, grp);
+	if (twl_class_is_4030())
+		grp |= P1_GRP_4030;
+	else
+		grp |= P1_GRP_6030;
+
+	ret = twlreg_write(info, TWL_MODULE_PM_RECEIVER, VREG_GRP, grp);
+
+	udelay(info->delay);
+
+	return ret;
 }
 
-static int twl4030reg_disable(struct regulator_dev *rdev)
+static int twlreg_disable(struct regulator_dev *rdev)
 {
 	struct twlreg_info	*info = rdev_get_drvdata(rdev);
 	int			grp;
 
-	grp = twl4030reg_read(info, VREG_GRP);
+	grp = twlreg_read(info, TWL_MODULE_PM_RECEIVER, VREG_GRP);
 	if (grp < 0)
 		return grp;
 
-	grp &= ~P1_GRP;
-	return twl4030reg_write(info, VREG_GRP, grp);
+	if (twl_class_is_4030())
+		grp &= ~(P1_GRP_4030 | P2_GRP_4030 | P3_GRP_4030);
+	else
+		grp &= ~(P1_GRP_6030 | P2_GRP_6030 | P3_GRP_6030);
+
+	return twlreg_write(info, TWL_MODULE_PM_RECEIVER, VREG_GRP, grp);
 }
 
-static int twl4030reg_get_status(struct regulator_dev *rdev)
+static int twlreg_get_status(struct regulator_dev *rdev)
 {
-	int	state = twl4030reg_grp(rdev);
+	int	state = twlreg_grp(rdev);
+
+	if (twl_class_is_6030())
+		return 0; /* FIXME return for 6030 regulator */
 
 	if (state < 0)
 		return state;
@@ -146,12 +189,15 @@ static int twl4030reg_get_status(struct regulator_dev *rdev)
 		: REGULATOR_STATUS_STANDBY;
 }
 
-static int twl4030reg_set_mode(struct regulator_dev *rdev, unsigned mode)
+static int twlreg_set_mode(struct regulator_dev *rdev, unsigned mode)
 {
 	struct twlreg_info	*info = rdev_get_drvdata(rdev);
 	unsigned		message;
 	int			status;
 
+	if (twl_class_is_6030())
+		return 0; /* FIXME return for 6030 regulator */
+
 	/* We can only set the mode through state machine commands... */
 	switch (mode) {
 	case REGULATOR_MODE_NORMAL:
@@ -165,18 +211,18 @@ static int twl4030reg_set_mode(struct regulator_dev *rdev, unsigned mode)
 	}
 
 	/* Ensure the resource is associated with some group */
-	status = twl4030reg_grp(rdev);
+	status = twlreg_grp(rdev);
 	if (status < 0)
 		return status;
-	if (!(status & (P3_GRP | P2_GRP | P1_GRP)))
+	if (!(status & (P3_GRP_4030 | P2_GRP_4030 | P1_GRP_4030)))
 		return -EACCES;
 
-	status = twl4030_i2c_write_u8(TWL4030_MODULE_PM_MASTER,
+	status = twl_i2c_write_u8(TWL_MODULE_PM_MASTER,
 			message >> 8, 0x15 /* PB_WORD_MSB */ );
 	if (status >= 0)
 		return status;
 
-	return twl4030_i2c_write_u8(TWL4030_MODULE_PM_MASTER,
+	return twl_i2c_write_u8(TWL_MODULE_PM_MASTER,
 			message, 0x16 /* PB_WORD_LSB */ );
 }
 
@@ -260,9 +306,43 @@ static const u16 VSIM_VSEL_table[] = {
 static const u16 VDAC_VSEL_table[] = {
 	1200, 1300, 1800, 1800,
 };
+static const u16 VDD1_VSEL_table[] = {
+	800, 1450,
+};
+static const u16 VDD2_VSEL_table[] = {
+	800, 1450, 1500,
+};
+static const u16 VIO_VSEL_table[] = {
+	1800, 1850,
+};
+static const u16 VINTANA2_VSEL_table[] = {
+	2500, 2750,
+};
+static const u16 VAUX1_6030_VSEL_table[] = {
+	1000, 1300, 1800, 2500,
+	2800, 2900, 3000, 3000,
+};
+static const u16 VAUX2_6030_VSEL_table[] = {
+	1200, 1800, 2500, 2750,
+	2800, 2800, 2800, 2800,
+};
+static const u16 VAUX3_6030_VSEL_table[] = {
+	1000, 1200, 1300, 1800,
+	2500, 2800, 3000, 3000,
+};
+static const u16 VMMC_VSEL_table[] = {
+	1200, 1800, 2800, 2900,
+	3000, 3000, 3000, 3000,
+};
+static const u16 VPP_VSEL_table[] = {
+	1800, 1900, 2000, 2100,
+	2200, 2300, 2400, 2500,
+};
+static const u16 VUSIM_VSEL_table[] = {
+	1200, 1800, 2500, 2900,
+};
 
-
-static int twl4030ldo_list_voltage(struct regulator_dev *rdev, unsigned index)
+static int twlldo_list_voltage(struct regulator_dev *rdev, unsigned index)
 {
 	struct twlreg_info	*info = rdev_get_drvdata(rdev);
 	int			mV = info->table[index];
@@ -271,7 +351,7 @@ static int twl4030ldo_list_voltage(struct regulator_dev *rdev, unsigned index)
 }
 
 static int
-twl4030ldo_set_voltage(struct regulator_dev *rdev, int min_uV, int max_uV)
+twlldo_set_voltage(struct regulator_dev *rdev, int min_uV, int max_uV)
 {
 	struct twlreg_info	*info = rdev_get_drvdata(rdev);
 	int			vsel;
@@ -288,16 +368,18 @@ twl4030ldo_set_voltage(struct regulator_dev *rdev, int min_uV, int max_uV)
 
 		/* use the first in-range value */
 		if (min_uV <= uV && uV <= max_uV)
-			return twl4030reg_write(info, VREG_DEDICATED, vsel);
+			return twlreg_write(info, TWL_MODULE_PM_RECEIVER,
+							VREG_VOLTAGE, vsel);
 	}
 
 	return -EDOM;
 }
 
-static int twl4030ldo_get_voltage(struct regulator_dev *rdev)
+static int twlldo_get_voltage(struct regulator_dev *rdev)
 {
 	struct twlreg_info	*info = rdev_get_drvdata(rdev);
-	int			vsel = twl4030reg_read(info, VREG_DEDICATED);
+	int		vsel = twlreg_read(info, TWL_MODULE_PM_RECEIVER,
+								VREG_VOLTAGE);
 
 	if (vsel < 0)
 		return vsel;
@@ -306,19 +388,19 @@ static int twl4030ldo_get_voltage(struct regulator_dev *rdev)
 	return LDO_MV(info->table[vsel]) * 1000;
 }
 
-static struct regulator_ops twl4030ldo_ops = {
-	.list_voltage	= twl4030ldo_list_voltage,
+static struct regulator_ops twlldo_ops = {
+	.list_voltage	= twlldo_list_voltage,
 
-	.set_voltage	= twl4030ldo_set_voltage,
-	.get_voltage	= twl4030ldo_get_voltage,
+	.set_voltage	= twlldo_set_voltage,
+	.get_voltage	= twlldo_get_voltage,
 
-	.enable		= twl4030reg_enable,
-	.disable	= twl4030reg_disable,
-	.is_enabled	= twl4030reg_is_enabled,
+	.enable		= twlreg_enable,
+	.disable	= twlreg_disable,
+	.is_enabled	= twlreg_is_enabled,
 
-	.set_mode	= twl4030reg_set_mode,
+	.set_mode	= twlreg_set_mode,
 
-	.get_status	= twl4030reg_get_status,
+	.get_status	= twlreg_get_status,
 };
 
 /*----------------------------------------------------------------------*/
@@ -326,60 +408,82 @@ static struct regulator_ops twl4030ldo_ops = {
 /*
  * Fixed voltage LDOs don't have a VSEL field to update.
  */
-static int twl4030fixed_list_voltage(struct regulator_dev *rdev, unsigned index)
+static int twlfixed_list_voltage(struct regulator_dev *rdev, unsigned index)
 {
 	struct twlreg_info	*info = rdev_get_drvdata(rdev);
 
 	return info->min_mV * 1000;
 }
 
-static int twl4030fixed_get_voltage(struct regulator_dev *rdev)
+static int twlfixed_get_voltage(struct regulator_dev *rdev)
 {
 	struct twlreg_info	*info = rdev_get_drvdata(rdev);
 
 	return info->min_mV * 1000;
 }
 
-static struct regulator_ops twl4030fixed_ops = {
-	.list_voltage	= twl4030fixed_list_voltage,
+static struct regulator_ops twlfixed_ops = {
+	.list_voltage	= twlfixed_list_voltage,
 
-	.get_voltage	= twl4030fixed_get_voltage,
+	.get_voltage	= twlfixed_get_voltage,
 
-	.enable		= twl4030reg_enable,
-	.disable	= twl4030reg_disable,
-	.is_enabled	= twl4030reg_is_enabled,
+	.enable		= twlreg_enable,
+	.disable	= twlreg_disable,
+	.is_enabled	= twlreg_is_enabled,
 
-	.set_mode	= twl4030reg_set_mode,
+	.set_mode	= twlreg_set_mode,
 
-	.get_status	= twl4030reg_get_status,
+	.get_status	= twlreg_get_status,
 };
 
 /*----------------------------------------------------------------------*/
 
-#define TWL_ADJUSTABLE_LDO(label, offset, num) { \
+#define TWL4030_ADJUSTABLE_LDO(label, offset, num, turnon_delay, remap_conf) \
+		TWL_ADJUSTABLE_LDO(label, offset, num, turnon_delay, \
+			remap_conf, TWL4030)
+#define TWL4030_FIXED_LDO(label, offset, mVolts, num, turnon_delay, \
+			remap_conf) \
+		TWL_FIXED_LDO(label, offset, mVolts, num, turnon_delay, \
+			remap_conf, TWL4030)
+#define TWL6030_ADJUSTABLE_LDO(label, offset, num, turnon_delay, \
+			remap_conf) \
+		TWL_ADJUSTABLE_LDO(label, offset, num, turnon_delay, \
+			remap_conf, TWL6030)
+#define TWL6030_FIXED_LDO(label, offset, mVolts, num, turnon_delay, \
+			remap_conf) \
+		TWL_FIXED_LDO(label, offset, mVolts, num, turnon_delay, \
+			remap_conf, TWL6030)
+
+#define TWL_ADJUSTABLE_LDO(label, offset, num, turnon_delay, remap_conf, \
+		family) { \
 	.base = offset, \
 	.id = num, \
 	.table_len = ARRAY_SIZE(label##_VSEL_table), \
 	.table = label##_VSEL_table, \
+	.delay = turnon_delay, \
+	.remap = remap_conf, \
 	.desc = { \
 		.name = #label, \
-		.id = TWL4030_REG_##label, \
+		.id = family##_REG_##label, \
 		.n_voltages = ARRAY_SIZE(label##_VSEL_table), \
-		.ops = &twl4030ldo_ops, \
+		.ops = &twlldo_ops, \
 		.type = REGULATOR_VOLTAGE, \
 		.owner = THIS_MODULE, \
 		}, \
 	}
 
-#define TWL_FIXED_LDO(label, offset, mVolts, num) { \
+#define TWL_FIXED_LDO(label, offset, mVolts, num, turnon_delay, remap_conf, \
+		family) { \
 	.base = offset, \
 	.id = num, \
 	.min_mV = mVolts, \
+	.delay = turnon_delay, \
+	.remap = remap_conf, \
 	.desc = { \
 		.name = #label, \
-		.id = TWL4030_REG_##label, \
+		.id = family##_REG_##label, \
 		.n_voltages = 1, \
-		.ops = &twl4030fixed_ops, \
+		.ops = &twlfixed_ops, \
 		.type = REGULATOR_VOLTAGE, \
 		.owner = THIS_MODULE, \
 		}, \
@@ -389,35 +493,45 @@ static struct regulator_ops twl4030fixed_ops = {
  * We list regulators here if systems need some level of
  * software control over them after boot.
  */
-static struct twlreg_info twl4030_regs[] = {
-	TWL_ADJUSTABLE_LDO(VAUX1, 0x17, 1),
-	TWL_ADJUSTABLE_LDO(VAUX2_4030, 0x1b, 2),
-	TWL_ADJUSTABLE_LDO(VAUX2, 0x1b, 2),
-	TWL_ADJUSTABLE_LDO(VAUX3, 0x1f, 3),
-	TWL_ADJUSTABLE_LDO(VAUX4, 0x23, 4),
-	TWL_ADJUSTABLE_LDO(VMMC1, 0x27, 5),
-	TWL_ADJUSTABLE_LDO(VMMC2, 0x2b, 6),
-	/*
-	TWL_ADJUSTABLE_LDO(VPLL1, 0x2f, 7),
-	*/
-	TWL_ADJUSTABLE_LDO(VPLL2, 0x33, 8),
-	TWL_ADJUSTABLE_LDO(VSIM, 0x37, 9),
-	TWL_ADJUSTABLE_LDO(VDAC, 0x3b, 10),
-	/*
-	TWL_ADJUSTABLE_LDO(VINTANA1, 0x3f, 11),
-	TWL_ADJUSTABLE_LDO(VINTANA2, 0x43, 12),
-	TWL_ADJUSTABLE_LDO(VINTDIG, 0x47, 13),
-	TWL_SMPS(VIO, 0x4b, 14),
-	TWL_SMPS(VDD1, 0x55, 15),
-	TWL_SMPS(VDD2, 0x63, 16),
-	 */
-	TWL_FIXED_LDO(VUSB1V5, 0x71, 1500, 17),
-	TWL_FIXED_LDO(VUSB1V8, 0x74, 1800, 18),
-	TWL_FIXED_LDO(VUSB3V1, 0x77, 3100, 19),
+static struct twlreg_info twl_regs[] = {
+	TWL4030_ADJUSTABLE_LDO(VAUX1, 0x17, 1, 100, 0x08),
+	TWL4030_ADJUSTABLE_LDO(VAUX2_4030, 0x1b, 2, 100, 0x08),
+	TWL4030_ADJUSTABLE_LDO(VAUX2, 0x1b, 2, 100, 0x08),
+	TWL4030_ADJUSTABLE_LDO(VAUX3, 0x1f, 3, 100, 0x08),
+	TWL4030_ADJUSTABLE_LDO(VAUX4, 0x23, 4, 100, 0x08),
+	TWL4030_ADJUSTABLE_LDO(VMMC1, 0x27, 5, 100, 0x08),
+	TWL4030_ADJUSTABLE_LDO(VMMC2, 0x2b, 6, 100, 0x08),
+	TWL4030_ADJUSTABLE_LDO(VPLL1, 0x2f, 7, 100, 0x00),
+	TWL4030_ADJUSTABLE_LDO(VPLL2, 0x33, 8, 100, 0x08),
+	TWL4030_ADJUSTABLE_LDO(VSIM, 0x37, 9, 100, 0x00),
+	TWL4030_ADJUSTABLE_LDO(VDAC, 0x3b, 10, 100, 0x08),
+	TWL4030_FIXED_LDO(VINTANA1, 0x3f, 1500, 11, 100, 0x08),
+	TWL4030_ADJUSTABLE_LDO(VINTANA2, 0x43, 12, 100, 0x08),
+	TWL4030_FIXED_LDO(VINTDIG, 0x47, 1500, 13, 100, 0x08),
+	TWL4030_ADJUSTABLE_LDO(VIO, 0x4b, 14, 1000, 0x08),
+	TWL4030_ADJUSTABLE_LDO(VDD1, 0x55, 15, 1000, 0x08),
+	TWL4030_ADJUSTABLE_LDO(VDD2, 0x63, 16, 1000, 0x08),
+	TWL4030_FIXED_LDO(VUSB1V5, 0x71, 1500, 17, 100, 0x08),
+	TWL4030_FIXED_LDO(VUSB1V8, 0x74, 1800, 18, 100, 0x08),
+	TWL4030_FIXED_LDO(VUSB3V1, 0x77, 3100, 19, 150, 0x08),
 	/* VUSBCP is managed *only* by the USB subchip */
+
+	/* 6030 REG with base as PMC Slave Misc : 0x0030 */
+	/* Turnon-delay and remap configuration values for 6030 are not
+	   verified since the specification is not public */
+	TWL6030_ADJUSTABLE_LDO(VAUX1_6030, 0x54, 1, 0, 0x08),
+	TWL6030_ADJUSTABLE_LDO(VAUX2_6030, 0x58, 2, 0, 0x08),
+	TWL6030_ADJUSTABLE_LDO(VAUX3_6030, 0x5c, 3, 0, 0x08),
+	TWL6030_ADJUSTABLE_LDO(VMMC, 0x68, 4, 0, 0x08),
+	TWL6030_ADJUSTABLE_LDO(VPP, 0x6c, 5, 0, 0x08),
+	TWL6030_ADJUSTABLE_LDO(VUSIM, 0x74, 7, 0, 0x08),
+	TWL6030_FIXED_LDO(VANA, 0x50, 2100, 15, 0, 0x08),
+	TWL6030_FIXED_LDO(VCXIO, 0x60, 1800, 16, 0, 0x08),
+	TWL6030_FIXED_LDO(VDAC, 0x64, 1800, 17, 0, 0x08),
+	TWL6030_FIXED_LDO(VUSB, 0x70, 3300, 18, 0, 0x08)
 };
 
-static int twl4030reg_probe(struct platform_device *pdev)
+static int twlreg_probe(struct platform_device *pdev)
 {
 	int				i;
 	struct twlreg_info		*info;
@@ -425,10 +539,10 @@ static int twl4030reg_probe(struct platform_device *pdev)
 	struct regulation_constraints	*c;
 	struct regulator_dev		*rdev;
 
-	for (i = 0, info = NULL; i < ARRAY_SIZE(twl4030_regs); i++) {
-		if (twl4030_regs[i].desc.id != pdev->id)
+	for (i = 0, info = NULL; i < ARRAY_SIZE(twl_regs); i++) {
+		if (twl_regs[i].desc.id != pdev->id)
 			continue;
-		info = twl4030_regs + i;
+		info = twl_regs + i;
 		break;
 	}
 	if (!info)
@@ -446,6 +560,19 @@ static int twl4030reg_probe(struct platform_device *pdev)
 	c->valid_ops_mask &= REGULATOR_CHANGE_VOLTAGE
 				| REGULATOR_CHANGE_MODE
 				| REGULATOR_CHANGE_STATUS;
+	switch (pdev->id) {
+	case TWL4030_REG_VIO:
+	case TWL4030_REG_VDD1:
+	case TWL4030_REG_VDD2:
+	case TWL4030_REG_VPLL1:
+	case TWL4030_REG_VINTANA1:
+	case TWL4030_REG_VINTANA2:
+	case TWL4030_REG_VINTDIG:
+		c->always_on = true;
+		break;
+	default:
+		break;
+	}
 
 	rdev = regulator_register(&info->desc, &pdev->dev, initdata, info);
 	if (IS_ERR(rdev)) {
@@ -455,6 +582,9 @@ static int twl4030reg_probe(struct platform_device *pdev)
 	}
 	platform_set_drvdata(pdev, rdev);
 
+	twlreg_write(info, TWL_MODULE_PM_RECEIVER, VREG_REMAP,
+						info->remap);
+
 	/* NOTE:  many regulators support short-circuit IRQs (presentable
 	 * as REGULATOR_OVER_CURRENT notifications?) configured via:
 	 *  - SC_CONFIG
@@ -466,35 +596,35 @@ static int twl4030reg_probe(struct platform_device *pdev)
 	return 0;
 }
 
-static int __devexit twl4030reg_remove(struct platform_device *pdev)
+static int __devexit twlreg_remove(struct platform_device *pdev)
 {
 	regulator_unregister(platform_get_drvdata(pdev));
 	return 0;
 }
 
-MODULE_ALIAS("platform:twl4030_reg");
+MODULE_ALIAS("platform:twl_reg");
 
-static struct platform_driver twl4030reg_driver = {
-	.probe		= twl4030reg_probe,
-	.remove		= __devexit_p(twl4030reg_remove),
+static struct platform_driver twlreg_driver = {
+	.probe		= twlreg_probe,
+	.remove		= __devexit_p(twlreg_remove),
 	/* NOTE: short name, to work around driver model truncation of
-	 * "twl4030_regulator.12" (and friends) to "twl4030_regulator.1".
+	 * "twl_regulator.12" (and friends) to "twl_regulator.1".
 	 */
-	.driver.name	= "twl4030_reg",
+	.driver.name	= "twl_reg",
 	.driver.owner	= THIS_MODULE,
 };
 
-static int __init twl4030reg_init(void)
+static int __init twlreg_init(void)
 {
-	return platform_driver_register(&twl4030reg_driver);
+	return platform_driver_register(&twlreg_driver);
 }
-subsys_initcall(twl4030reg_init);
+subsys_initcall(twlreg_init);
 
-static void __exit twl4030reg_exit(void)
+static void __exit twlreg_exit(void)
 {
-	platform_driver_unregister(&twl4030reg_driver);
+	platform_driver_unregister(&twlreg_driver);
 }
-module_exit(twl4030reg_exit)
+module_exit(twlreg_exit)
 
-MODULE_DESCRIPTION("TWL4030 regulator driver");
+MODULE_DESCRIPTION("TWL regulator driver");
 MODULE_LICENSE("GPL");
diff --git a/drivers/regulator/wm831x-dcdc.c b/drivers/regulator/wm831x-dcdc.c
index 2eefc1a0cf08..0a6577577e8d 100644
--- a/drivers/regulator/wm831x-dcdc.c
+++ b/drivers/regulator/wm831x-dcdc.c
@@ -19,6 +19,8 @@
 #include <linux/i2c.h>
 #include <linux/platform_device.h>
 #include <linux/regulator/driver.h>
+#include <linux/regulator/machine.h>
+#include <linux/gpio.h>
 
 #include <linux/mfd/wm831x/core.h>
 #include <linux/mfd/wm831x/regulator.h>
@@ -39,6 +41,7 @@
 #define WM831X_DCDC_CONTROL_2     1
 #define WM831X_DCDC_ON_CONFIG     2
 #define WM831X_DCDC_SLEEP_CONTROL 3
+#define WM831X_DCDC_DVS_CONTROL   4
 
 /*
  * Shared
@@ -50,6 +53,10 @@ struct wm831x_dcdc {
 	int base;
 	struct wm831x *wm831x;
 	struct regulator_dev *regulator;
+	int dvs_gpio;
+	int dvs_gpio_state;
+	int on_vsel;
+	int dvs_vsel;
 };
 
 static int wm831x_dcdc_is_enabled(struct regulator_dev *rdev)
@@ -240,11 +247,9 @@ static int wm831x_buckv_list_voltage(struct regulator_dev *rdev,
 	return -EINVAL;
 }
 
-static int wm831x_buckv_set_voltage_int(struct regulator_dev *rdev, int reg,
-					 int min_uV, int max_uV)
+static int wm831x_buckv_select_min_voltage(struct regulator_dev *rdev,
+					   int min_uV, int max_uV)
 {
-	struct wm831x_dcdc *dcdc = rdev_get_drvdata(rdev);
-	struct wm831x *wm831x = dcdc->wm831x;
 	u16 vsel;
 
 	if (min_uV < 600000)
@@ -257,39 +262,126 @@ static int wm831x_buckv_set_voltage_int(struct regulator_dev *rdev, int reg,
 	if (wm831x_buckv_list_voltage(rdev, vsel) > max_uV)
 		return -EINVAL;
 
-	return wm831x_set_bits(wm831x, reg, WM831X_DC1_ON_VSEL_MASK, vsel);
+	return vsel;
+}
+
+static int wm831x_buckv_select_max_voltage(struct regulator_dev *rdev,
+					   int min_uV, int max_uV)
+{
+	u16 vsel;
+
+	if (max_uV < 600000 || max_uV > 1800000)
+		return -EINVAL;
+
+	vsel = ((max_uV - 600000) / 12500) + 8;
+
+	if (wm831x_buckv_list_voltage(rdev, vsel) < min_uV ||
+	    wm831x_buckv_list_voltage(rdev, vsel) < max_uV)
+		return -EINVAL;
+
+	return vsel;
+}
+
+static int wm831x_buckv_set_dvs(struct regulator_dev *rdev, int state)
+{
+	struct wm831x_dcdc *dcdc = rdev_get_drvdata(rdev);
+
+	if (state == dcdc->dvs_gpio_state)
+		return 0;
+
+	dcdc->dvs_gpio_state = state;
+	gpio_set_value(dcdc->dvs_gpio, state);
+
+	/* Should wait for DVS state change to be asserted if we have
+	 * a GPIO for it, for now assume the device is configured
+	 * for the fastest possible transition.
+	 */
+
+	return 0;
 }
 
 static int wm831x_buckv_set_voltage(struct regulator_dev *rdev,
-				     int min_uV, int max_uV)
+				    int min_uV, int max_uV)
 {
 	struct wm831x_dcdc *dcdc = rdev_get_drvdata(rdev);
-	u16 reg = dcdc->base + WM831X_DCDC_ON_CONFIG;
+	struct wm831x *wm831x = dcdc->wm831x;
+	int on_reg = dcdc->base + WM831X_DCDC_ON_CONFIG;
+	int dvs_reg = dcdc->base + WM831X_DCDC_DVS_CONTROL;
+	int vsel, ret;
+
+	vsel = wm831x_buckv_select_min_voltage(rdev, min_uV, max_uV);
+	if (vsel < 0)
+		return vsel;
+
+	/* If this value is already set then do a GPIO update if we can */
+	if (dcdc->dvs_gpio && dcdc->on_vsel == vsel)
+		return wm831x_buckv_set_dvs(rdev, 0);
+
+	if (dcdc->dvs_gpio && dcdc->dvs_vsel == vsel)
+		return wm831x_buckv_set_dvs(rdev, 1);
+
+	/* Always set the ON status to the minimum voltage */
+	ret = wm831x_set_bits(wm831x, on_reg, WM831X_DC1_ON_VSEL_MASK, vsel);
+	if (ret < 0)
+		return ret;
+	dcdc->on_vsel = vsel;
+
+	if (!dcdc->dvs_gpio)
+		return ret;
+
+	/* Kick the voltage transition now */
+	ret = wm831x_buckv_set_dvs(rdev, 0);
+	if (ret < 0)
+		return ret;
+
+	/* Set the high voltage as the DVS voltage.  This is optimised
+	 * for CPUfreq usage, most processors will keep the maximum
+	 * voltage constant and lower the minimum with the frequency. */
+	vsel = wm831x_buckv_select_max_voltage(rdev, min_uV, max_uV);
+	if (vsel < 0) {
+		/* This should never happen - at worst the same vsel
+		 * should be chosen */
+		WARN_ON(vsel < 0);
+		return 0;
+	}
+
+	/* Don't bother if it's the same VSEL we're already using */
+	if (vsel == dcdc->on_vsel)
+		return 0;
 
-	return wm831x_buckv_set_voltage_int(rdev, reg, min_uV, max_uV);
+	ret = wm831x_set_bits(wm831x, dvs_reg, WM831X_DC1_DVS_VSEL_MASK, vsel);
+	if (ret == 0)
+		dcdc->dvs_vsel = vsel;
+	else
+		dev_warn(wm831x->dev, "Failed to set DCDC DVS VSEL: %d\n",
+			 ret);
+
+	return 0;
 }
 
 static int wm831x_buckv_set_suspend_voltage(struct regulator_dev *rdev,
-					     int uV)
+					    int uV)
 {
 	struct wm831x_dcdc *dcdc = rdev_get_drvdata(rdev);
+	struct wm831x *wm831x = dcdc->wm831x;
 	u16 reg = dcdc->base + WM831X_DCDC_SLEEP_CONTROL;
+	int vsel;
+
+	vsel = wm831x_buckv_select_min_voltage(rdev, uV, uV);
+	if (vsel < 0)
+		return vsel;
 
-	return wm831x_buckv_set_voltage_int(rdev, reg, uV, uV);
+	return wm831x_set_bits(wm831x, reg, WM831X_DC1_SLP_VSEL_MASK, vsel);
 }
 
 static int wm831x_buckv_get_voltage(struct regulator_dev *rdev)
 {
 	struct wm831x_dcdc *dcdc = rdev_get_drvdata(rdev);
-	struct wm831x *wm831x = dcdc->wm831x;
-	u16 reg = dcdc->base + WM831X_DCDC_ON_CONFIG;
-	int val;
 
-	val = wm831x_reg_read(wm831x, reg);
-	if (val < 0)
-		return val;
-
-	return wm831x_buckv_list_voltage(rdev, val & WM831X_DC1_ON_VSEL_MASK);
+	if (dcdc->dvs_gpio && dcdc->dvs_gpio_state)
+		return wm831x_buckv_list_voltage(rdev, dcdc->dvs_vsel);
+	else
+		return wm831x_buckv_list_voltage(rdev, dcdc->on_vsel);
 }
 
 /* Current limit options */
@@ -346,6 +438,64 @@ static struct regulator_ops wm831x_buckv_ops = {
 	.set_suspend_mode = wm831x_dcdc_set_suspend_mode,
 };
 
+/*
+ * Set up DVS control.  We just log errors since we can still run
+ * (with reduced performance) if we fail.
+ */
+static __devinit void wm831x_buckv_dvs_init(struct wm831x_dcdc *dcdc,
+					    struct wm831x_buckv_pdata *pdata)
+{
+	struct wm831x *wm831x = dcdc->wm831x;
+	int ret;
+	u16 ctrl;
+
+	if (!pdata || !pdata->dvs_gpio)
+		return;
+
+	switch (pdata->dvs_control_src) {
+	case 1:
+		ctrl = 2 << WM831X_DC1_DVS_SRC_SHIFT;
+		break;
+	case 2:
+		ctrl = 3 << WM831X_DC1_DVS_SRC_SHIFT;
+		break;
+	default:
+		dev_err(wm831x->dev, "Invalid DVS control source %d for %s\n",
+			pdata->dvs_control_src, dcdc->name);
+		return;
+	}
+
+	ret = wm831x_set_bits(wm831x, dcdc->base + WM831X_DCDC_DVS_CONTROL,
+			      WM831X_DC1_DVS_SRC_MASK, ctrl);
+	if (ret < 0) {
+		dev_err(wm831x->dev, "Failed to set %s DVS source: %d\n",
+			dcdc->name, ret);
+		return;
+	}
+
+	ret = gpio_request(pdata->dvs_gpio, "DCDC DVS");
+	if (ret < 0) {
+		dev_err(wm831x->dev, "Failed to get %s DVS GPIO: %d\n",
+			dcdc->name, ret);
+		return;
+	}
+
+	/* gpiolib won't let us read the GPIO status so pick the higher
+	 * of the two existing voltages so we take it as platform data.
+	 */
+	dcdc->dvs_gpio_state = pdata->dvs_init_state;
+
+	ret = gpio_direction_output(pdata->dvs_gpio, dcdc->dvs_gpio_state);
+	if (ret < 0) {
+		dev_err(wm831x->dev, "Failed to enable %s DVS GPIO: %d\n",
+			dcdc->name, ret);
+		gpio_free(pdata->dvs_gpio);
+		return;
+	}
+
+	dcdc->dvs_gpio = pdata->dvs_gpio;
+}
+
 static __devinit int wm831x_buckv_probe(struct platform_device *pdev)
 {
 	struct wm831x *wm831x = dev_get_drvdata(pdev->dev.parent);
@@ -384,6 +534,23 @@ static __devinit int wm831x_buckv_probe(struct platform_device *pdev)
 	dcdc->desc.ops = &wm831x_buckv_ops;
 	dcdc->desc.owner = THIS_MODULE;
 
+	ret = wm831x_reg_read(wm831x, dcdc->base + WM831X_DCDC_ON_CONFIG);
+	if (ret < 0) {
+		dev_err(wm831x->dev, "Failed to read ON VSEL: %d\n", ret);
+		goto err;
+	}
+	dcdc->on_vsel = ret & WM831X_DC1_ON_VSEL_MASK;
+
+	ret = wm831x_reg_read(wm831x, dcdc->base + WM831X_DCDC_ON_CONFIG);
+	if (ret < 0) {
+		dev_err(wm831x->dev, "Failed to read DVS VSEL: %d\n", ret);
+		goto err;
+	}
+	dcdc->dvs_vsel = ret & WM831X_DC1_DVS_VSEL_MASK;
+
+	if (pdata->dcdc[id])
+		wm831x_buckv_dvs_init(dcdc, pdata->dcdc[id]->driver_data);
+
 	dcdc->regulator = regulator_register(&dcdc->desc, &pdev->dev,
 					     pdata->dcdc[id], dcdc);
 	if (IS_ERR(dcdc->regulator)) {
@@ -422,6 +589,8 @@ err_uv:
 err_regulator:
 	regulator_unregister(dcdc->regulator);
 err:
+	if (dcdc->dvs_gpio)
+		gpio_free(dcdc->dvs_gpio);
 	kfree(dcdc);
 	return ret;
 }
@@ -434,6 +603,8 @@ static __devexit int wm831x_buckv_remove(struct platform_device *pdev)
 	wm831x_free_irq(wm831x, platform_get_irq_byname(pdev, "HC"), dcdc);
 	wm831x_free_irq(wm831x, platform_get_irq_byname(pdev, "UV"), dcdc);
 	regulator_unregister(dcdc->regulator);
+	if (dcdc->dvs_gpio)
+		gpio_free(dcdc->dvs_gpio);
 	kfree(dcdc);
 
 	return 0;
diff --git a/drivers/regulator/wm831x-ldo.c b/drivers/regulator/wm831x-ldo.c
index 902db56ce099..61e02ac2fda3 100644
--- a/drivers/regulator/wm831x-ldo.c
+++ b/drivers/regulator/wm831x-ldo.c
@@ -470,7 +470,7 @@ static unsigned int wm831x_aldo_get_mode(struct regulator_dev *rdev)
 	struct wm831x_ldo *ldo = rdev_get_drvdata(rdev);
 	struct wm831x *wm831x = ldo->wm831x;
 	int on_reg = ldo->base + WM831X_LDO_ON_CONTROL;
-	unsigned int ret;
+	int ret;
 
 	ret = wm831x_reg_read(wm831x, on_reg);
 	if (ret < 0)
diff --git a/drivers/regulator/wm8350-regulator.c b/drivers/regulator/wm8350-regulator.c
index 768bd0e5b48b..1bbff099a546 100644
--- a/drivers/regulator/wm8350-regulator.c
+++ b/drivers/regulator/wm8350-regulator.c
@@ -1330,9 +1330,10 @@ static struct regulator_desc wm8350_reg[NUM_WM8350_REGULATORS] = {
 	 },
 };
 
-static void pmic_uv_handler(struct wm8350 *wm8350, int irq, void *data)
+static irqreturn_t pmic_uv_handler(int irq, void *data)
 {
 	struct regulator_dev *rdev = (struct regulator_dev *)data;
+	struct wm8350 *wm8350 = rdev_get_drvdata(rdev);
 
 	mutex_lock(&rdev->mutex);
 	if (irq == WM8350_IRQ_CS1 || irq == WM8350_IRQ_CS2)
@@ -1344,6 +1345,8 @@ static void pmic_uv_handler(struct wm8350 *wm8350, int irq, void *data)
 					      REGULATOR_EVENT_UNDER_VOLTAGE,
 					      wm8350);
 	mutex_unlock(&rdev->mutex);
+
+	return IRQ_HANDLED;
 }
 
 static int wm8350_regulator_probe(struct platform_device *pdev)
@@ -1388,7 +1391,7 @@ static int wm8350_regulator_probe(struct platform_device *pdev)
 
 	/* register regulator IRQ */
 	ret = wm8350_register_irq(wm8350, wm8350_reg[pdev->id].irq,
-				  pmic_uv_handler, rdev);
+				  pmic_uv_handler, 0, "UV", rdev);
 	if (ret < 0) {
 		regulator_unregister(rdev);
 		dev_err(&pdev->dev, "failed to register regulator %s IRQ\n",
@@ -1396,8 +1399,6 @@ static int wm8350_regulator_probe(struct platform_device *pdev)
 		return ret;
 	}
 
-	wm8350_unmask_irq(wm8350, wm8350_reg[pdev->id].irq);
-
 	return 0;
 }
 
@@ -1406,7 +1407,6 @@ static int wm8350_regulator_remove(struct platform_device *pdev)
 	struct regulator_dev *rdev = platform_get_drvdata(pdev);
 	struct wm8350 *wm8350 = rdev_get_drvdata(rdev);
 
-	wm8350_mask_irq(wm8350, wm8350_reg[pdev->id].irq);
 	wm8350_free_irq(wm8350, wm8350_reg[pdev->id].irq);
 
 	regulator_unregister(rdev);
diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig
index f2e1004d12c7..8167e9e6827a 100644
--- a/drivers/rtc/Kconfig
+++ b/drivers/rtc/Kconfig
@@ -242,6 +242,15 @@ config RTC_DRV_M41T80_WDT
 	  If you say Y here you will get support for the
 	  watchdog timer in the ST M41T60 and M41T80 RTC chips series.
 
+config RTC_DRV_BQ32K
+	tristate "TI BQ32000"
+	help
+	  If you say Y here you will get support for the TI
+	  BQ32000 I2C RTC chip.
+
+	  This driver can also be built as a module. If so, the module
+	  will be called rtc-bq32k.
+
 config RTC_DRV_DM355EVM
 	tristate "TI DaVinci DM355 EVM RTC"
 	depends on MFD_DM355EVM_MSP
@@ -258,14 +267,14 @@ config RTC_DRV_TWL92330
 	  the Menelaus driver; it's not separate module.
 
 config RTC_DRV_TWL4030
-	tristate "TI TWL4030/TWL5030/TPS659x0"
+	tristate "TI TWL4030/TWL5030/TWL6030/TPS659x0"
 	depends on RTC_CLASS && TWL4030_CORE
 	help
 	  If you say yes here you get support for the RTC on the
-	  TWL4030 family chips, used mostly with OMAP3 platforms.
+	  TWL4030/TWL5030/TWL6030 family chips, used mostly with OMAP3 platforms.
 
 	  This driver can also be built as a module. If so, the module
-	  will be called rtc-twl4030.
+	  will be called rtc-twl.
 
 config RTC_DRV_S35390A
 	tristate "Seiko Instruments S-35390A"
@@ -592,15 +601,22 @@ config RTC_DRV_AB3100
 	  Select this to enable the ST-Ericsson AB3100 Mixed Signal IC RTC
 	  support. This chip contains a battery- and capacitor-backed RTC.
 
+config RTC_DRV_NUC900
+	tristate "NUC910/NUC920 RTC driver"
+	depends on RTC_CLASS && ARCH_W90X900
+	help
+	  If you say yes here you get support for the RTC subsystem of the
+	  NUC910/NUC920 used in embedded systems.
 
 comment "on-CPU RTC drivers"
 
 config RTC_DRV_OMAP
 	tristate "TI OMAP1"
-	depends on ARCH_OMAP15XX || ARCH_OMAP16XX || ARCH_OMAP730
+	depends on ARCH_OMAP15XX || ARCH_OMAP16XX || ARCH_OMAP730 || ARCH_DAVINCI_DA8XX
 	help
-	  Say "yes" here to support the real time clock on TI OMAP1 chips.
-	  This driver can also be built as a module called rtc-omap.
+	  Say "yes" here to support the real time clock on TI OMAP1 and
+	  DA8xx/OMAP-L13x chips.  This driver can also be built as a
+	  module called rtc-omap.
 
 config RTC_DRV_S3C
 	tristate "Samsung S3C series SoC RTC"
@@ -846,4 +862,10 @@ config RTC_DRV_PCAP
 	  If you say Y here you will get support for the RTC found on
 	  the PCAP2 ASIC used on some Motorola phones.
 
+config RTC_DRV_MC13783
+	depends on MFD_MC13783
+	tristate "Freescale MC13783 RTC"
+	help
+	  This enables support for the Freescale MC13783 PMIC RTC
+
 endif # RTC_CLASS
diff --git a/drivers/rtc/Makefile b/drivers/rtc/Makefile
index af1ba7ae2857..e5160fddc446 100644
--- a/drivers/rtc/Makefile
+++ b/drivers/rtc/Makefile
@@ -23,6 +23,7 @@ obj-$(CONFIG_RTC_DRV_AT91RM9200)+= rtc-at91rm9200.o
 obj-$(CONFIG_RTC_DRV_AT91SAM9)	+= rtc-at91sam9.o
 obj-$(CONFIG_RTC_DRV_AU1XXX)	+= rtc-au1xxx.o
 obj-$(CONFIG_RTC_DRV_BFIN)	+= rtc-bfin.o
+obj-$(CONFIG_RTC_DRV_BQ32K)	+= rtc-bq32k.o
 obj-$(CONFIG_RTC_DRV_BQ4802)	+= rtc-bq4802.o
 obj-$(CONFIG_RTC_DRV_CMOS)	+= rtc-cmos.o
 obj-$(CONFIG_RTC_DRV_COH901331)	+= rtc-coh901331.o
@@ -52,8 +53,10 @@ obj-$(CONFIG_RTC_DRV_M48T86)	+= rtc-m48t86.o
 obj-$(CONFIG_RTC_MXC)		+= rtc-mxc.o
 obj-$(CONFIG_RTC_DRV_MAX6900)	+= rtc-max6900.o
 obj-$(CONFIG_RTC_DRV_MAX6902)	+= rtc-max6902.o
+obj-$(CONFIG_RTC_DRV_MC13783)	+= rtc-mc13783.o
 obj-$(CONFIG_RTC_DRV_MSM6242)	+= rtc-msm6242.o
 obj-$(CONFIG_RTC_DRV_MV)	+= rtc-mv.o
+obj-$(CONFIG_RTC_DRV_NUC900)	+= rtc-nuc900.o
 obj-$(CONFIG_RTC_DRV_OMAP)	+= rtc-omap.o
 obj-$(CONFIG_RTC_DRV_PCAP)	+= rtc-pcap.o
 obj-$(CONFIG_RTC_DRV_PCF8563)	+= rtc-pcf8563.o
@@ -80,7 +83,7 @@ obj-$(CONFIG_RTC_DRV_STK17TA8)	+= rtc-stk17ta8.o
 obj-$(CONFIG_RTC_DRV_STMP)	+= rtc-stmp3xxx.o
 obj-$(CONFIG_RTC_DRV_SUN4V)	+= rtc-sun4v.o
 obj-$(CONFIG_RTC_DRV_TEST)	+= rtc-test.o
-obj-$(CONFIG_RTC_DRV_TWL4030)	+= rtc-twl4030.o
+obj-$(CONFIG_RTC_DRV_TWL4030)	+= rtc-twl.o
 obj-$(CONFIG_RTC_DRV_TX4939)	+= rtc-tx4939.o
 obj-$(CONFIG_RTC_DRV_V3020)	+= rtc-v3020.o
 obj-$(CONFIG_RTC_DRV_VR41XX)	+= rtc-vr41xx.o
diff --git a/drivers/rtc/rtc-at32ap700x.c b/drivers/rtc/rtc-at32ap700x.c
index e1ec33e40e38..8825695777df 100644
--- a/drivers/rtc/rtc-at32ap700x.c
+++ b/drivers/rtc/rtc-at32ap700x.c
@@ -256,6 +256,8 @@ static int __init at32_rtc_probe(struct platform_device *pdev)
 		goto out_iounmap;
 	}
 
+	platform_set_drvdata(pdev, rtc);
+
 	rtc->rtc = rtc_device_register(pdev->name, &pdev->dev,
 				&at32_rtc_ops, THIS_MODULE);
 	if (IS_ERR(rtc->rtc)) {
@@ -264,7 +266,6 @@ static int __init at32_rtc_probe(struct platform_device *pdev)
 		goto out_free_irq;
 	}
 
-	platform_set_drvdata(pdev, rtc);
 	device_init_wakeup(&pdev->dev, 1);
 
 	dev_info(&pdev->dev, "Atmel RTC for AT32AP700x at %08lx irq %ld\n",
@@ -273,6 +274,7 @@ static int __init at32_rtc_probe(struct platform_device *pdev)
 	return 0;
 
 out_free_irq:
+	platform_set_drvdata(pdev, NULL);
 	free_irq(irq, rtc);
 out_iounmap:
 	iounmap(rtc->regs);
diff --git a/drivers/rtc/rtc-bq32k.c b/drivers/rtc/rtc-bq32k.c
new file mode 100644
index 000000000000..408cc8f735be
--- /dev/null
+++ b/drivers/rtc/rtc-bq32k.c
@@ -0,0 +1,204 @@
+/*
+ * Driver for TI BQ32000 RTC.
+ *
+ * Copyright (C) 2009 Semihalf.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/module.h>
+#include <linux/i2c.h>
+#include <linux/rtc.h>
+#include <linux/init.h>
+#include <linux/errno.h>
+#include <linux/bcd.h>
+
+#define BQ32K_SECONDS		0x00	/* Seconds register address */
+#define BQ32K_SECONDS_MASK	0x7F	/* Mask over seconds value */
+#define BQ32K_STOP		0x80	/* Oscillator Stop flat */
+
+#define BQ32K_MINUTES		0x01	/* Minutes register address */
+#define BQ32K_MINUTES_MASK	0x7F	/* Mask over minutes value */
+#define BQ32K_OF		0x80	/* Oscillator Failure flag */
+
+#define BQ32K_HOURS_MASK	0x3F	/* Mask over hours value */
+#define BQ32K_CENT		0x40	/* Century flag */
+#define BQ32K_CENT_EN		0x80	/* Century flag enable bit */
+
+struct bq32k_regs {
+	uint8_t		seconds;
+	uint8_t		minutes;
+	uint8_t		cent_hours;
+	uint8_t		day;
+	uint8_t		date;
+	uint8_t		month;
+	uint8_t		years;
+};
+
+static struct i2c_driver bq32k_driver;
+
+static int bq32k_read(struct device *dev, void *data, uint8_t off, uint8_t len)
+{
+	struct i2c_client *client = to_i2c_client(dev);
+	struct i2c_msg msgs[] = {
+		{
+			.addr = client->addr,
+			.flags = 0,
+			.len = 1,
+			.buf = &off,
+		}, {
+			.addr = client->addr,
+			.flags = I2C_M_RD,
+			.len = len,
+			.buf = data,
+		}
+	};
+
+	if (i2c_transfer(client->adapter, msgs, 2) == 2)
+		return 0;
+
+	return -EIO;
+}
+
+static int bq32k_write(struct device *dev, void *data, uint8_t off, uint8_t len)
+{
+	struct i2c_client *client = to_i2c_client(dev);
+	uint8_t buffer[len + 1];
+
+	buffer[0] = off;
+	memcpy(&buffer[1], data, len);
+
+	if (i2c_master_send(client, buffer, len + 1) == len + 1)
+		return 0;
+
+	return -EIO;
+}
+
+static int bq32k_rtc_read_time(struct device *dev, struct rtc_time *tm)
+{
+	struct bq32k_regs regs;
+	int error;
+
+	error = bq32k_read(dev, &regs, 0, sizeof(regs));
+	if (error)
+		return error;
+
+	tm->tm_sec = bcd2bin(regs.seconds & BQ32K_SECONDS_MASK);
+	tm->tm_min = bcd2bin(regs.minutes & BQ32K_SECONDS_MASK);
+	tm->tm_hour = bcd2bin(regs.cent_hours & BQ32K_HOURS_MASK);
+	tm->tm_mday = bcd2bin(regs.date);
+	tm->tm_wday = bcd2bin(regs.day) - 1;
+	tm->tm_mon = bcd2bin(regs.month) - 1;
+	tm->tm_year = bcd2bin(regs.years) +
+				((regs.cent_hours & BQ32K_CENT) ? 100 : 0);
+
+	return rtc_valid_tm(tm);
+}
+
+static int bq32k_rtc_set_time(struct device *dev, struct rtc_time *tm)
+{
+	struct bq32k_regs regs;
+
+	regs.seconds = bin2bcd(tm->tm_sec);
+	regs.minutes = bin2bcd(tm->tm_min);
+	regs.cent_hours = bin2bcd(tm->tm_hour) | BQ32K_CENT_EN;
+	regs.day = bin2bcd(tm->tm_wday + 1);
+	regs.date = bin2bcd(tm->tm_mday);
+	regs.month = bin2bcd(tm->tm_mon + 1);
+
+	if (tm->tm_year >= 100) {
+		regs.cent_hours |= BQ32K_CENT;
+		regs.years = bin2bcd(tm->tm_year - 100);
+	} else
+		regs.years = bin2bcd(tm->tm_year);
+
+	return bq32k_write(dev, &regs, 0, sizeof(regs));
+}
+
+static const struct rtc_class_ops bq32k_rtc_ops = {
+	.read_time	= bq32k_rtc_read_time,
+	.set_time	= bq32k_rtc_set_time,
+};
+
+static int bq32k_probe(struct i2c_client *client,
+				const struct i2c_device_id *id)
+{
+	struct device *dev = &client->dev;
+	struct rtc_device *rtc;
+	uint8_t reg;
+	int error;
+
+	if (!i2c_check_functionality(client->adapter, I2C_FUNC_I2C))
+		return -ENODEV;
+
+	/* Check Oscillator Stop flag */
+	error = bq32k_read(dev, &reg, BQ32K_SECONDS, 1);
+	if (!error && (reg & BQ32K_STOP)) {
+		dev_warn(dev, "Oscillator was halted. Restarting...\n");
+		reg &= ~BQ32K_STOP;
+		error = bq32k_write(dev, &reg, BQ32K_SECONDS, 1);
+	}
+	if (error)
+		return error;
+
+	/* Check Oscillator Failure flag */
+	error = bq32k_read(dev, &reg, BQ32K_MINUTES, 1);
+	if (!error && (reg & BQ32K_OF)) {
+		dev_warn(dev, "Oscillator Failure. Check RTC battery.\n");
+		reg &= ~BQ32K_OF;
+		error = bq32k_write(dev, &reg, BQ32K_MINUTES, 1);
+	}
+	if (error)
+		return error;
+
+	rtc = rtc_device_register(bq32k_driver.driver.name, &client->dev,
+						&bq32k_rtc_ops, THIS_MODULE);
+	if (IS_ERR(rtc))
+		return PTR_ERR(rtc);
+
+	i2c_set_clientdata(client, rtc);
+
+	return 0;
+}
+
+static int __devexit bq32k_remove(struct i2c_client *client)
+{
+	struct rtc_device *rtc = i2c_get_clientdata(client);
+
+	rtc_device_unregister(rtc);
+	return 0;
+}
+
+static const struct i2c_device_id bq32k_id[] = {
+	{ "bq32000", 0 },
+	{ }
+};
+MODULE_DEVICE_TABLE(i2c, bq32k_id);
+
+static struct i2c_driver bq32k_driver = {
+	.driver = {
+		.name	= "bq32k",
+		.owner	= THIS_MODULE,
+	},
+	.probe		= bq32k_probe,
+	.remove		= __devexit_p(bq32k_remove),
+	.id_table	= bq32k_id,
+};
+
+static __init int bq32k_init(void)
+{
+	return i2c_add_driver(&bq32k_driver);
+}
+module_init(bq32k_init);
+
+static __exit void bq32k_exit(void)
+{
+	i2c_del_driver(&bq32k_driver);
+}
+module_exit(bq32k_exit);
+
+MODULE_AUTHOR("Semihalf, Piotr Ziecik <kosmo@semihalf.com>");
+MODULE_DESCRIPTION("TI BQ32000 I2C RTC driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/rtc/rtc-bq4802.c b/drivers/rtc/rtc-bq4802.c
index d00a274df8fc..280fe48ada0b 100644
--- a/drivers/rtc/rtc-bq4802.c
+++ b/drivers/rtc/rtc-bq4802.c
@@ -169,6 +169,8 @@ static int __devinit bq4802_probe(struct platform_device *pdev)
 		goto out_free;
 	}
 
+	platform_set_drvdata(pdev, p);
+
 	p->rtc = rtc_device_register("bq4802", &pdev->dev,
 				     &bq4802_ops, THIS_MODULE);
 	if (IS_ERR(p->rtc)) {
@@ -176,7 +178,6 @@ static int __devinit bq4802_probe(struct platform_device *pdev)
 		goto out_iounmap;
 	}
 
-	platform_set_drvdata(pdev, p);
 	err = 0;
 out:
 	return err;
diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
index f7a4701bf863..e9aa814ddd23 100644
--- a/drivers/rtc/rtc-cmos.c
+++ b/drivers/rtc/rtc-cmos.c
@@ -420,49 +420,43 @@ static int cmos_irq_set_state(struct device *dev, int enabled)
 	return 0;
 }
 
-#if defined(CONFIG_RTC_INTF_DEV) || defined(CONFIG_RTC_INTF_DEV_MODULE)
-
-static int
-cmos_rtc_ioctl(struct device *dev, unsigned int cmd, unsigned long arg)
+static int cmos_alarm_irq_enable(struct device *dev, unsigned int enabled)
 {
 	struct cmos_rtc	*cmos = dev_get_drvdata(dev);
 	unsigned long	flags;
 
-	switch (cmd) {
-	case RTC_AIE_OFF:
-	case RTC_AIE_ON:
-	case RTC_UIE_OFF:
-	case RTC_UIE_ON:
-		if (!is_valid_irq(cmos->irq))
-			return -EINVAL;
-		break;
-	/* PIE ON/OFF is handled by cmos_irq_set_state() */
-	default:
-		return -ENOIOCTLCMD;
-	}
+	if (!is_valid_irq(cmos->irq))
+		return -EINVAL;
 
 	spin_lock_irqsave(&rtc_lock, flags);
-	switch (cmd) {
-	case RTC_AIE_OFF:	/* alarm off */
-		cmos_irq_disable(cmos, RTC_AIE);
-		break;
-	case RTC_AIE_ON:	/* alarm on */
+
+	if (enabled)
 		cmos_irq_enable(cmos, RTC_AIE);
-		break;
-	case RTC_UIE_OFF:	/* update off */
-		cmos_irq_disable(cmos, RTC_UIE);
-		break;
-	case RTC_UIE_ON:	/* update on */
-		cmos_irq_enable(cmos, RTC_UIE);
-		break;
-	}
+	else
+		cmos_irq_disable(cmos, RTC_AIE);
+
 	spin_unlock_irqrestore(&rtc_lock, flags);
 	return 0;
 }
 
-#else
-#define	cmos_rtc_ioctl	NULL
-#endif
+static int cmos_update_irq_enable(struct device *dev, unsigned int enabled)
+{
+	struct cmos_rtc	*cmos = dev_get_drvdata(dev);
+	unsigned long	flags;
+
+	if (!is_valid_irq(cmos->irq))
+		return -EINVAL;
+
+	spin_lock_irqsave(&rtc_lock, flags);
+
+	if (enabled)
+		cmos_irq_enable(cmos, RTC_UIE);
+	else
+		cmos_irq_disable(cmos, RTC_UIE);
+
+	spin_unlock_irqrestore(&rtc_lock, flags);
+	return 0;
+}
 
 #if defined(CONFIG_RTC_INTF_PROC) || defined(CONFIG_RTC_INTF_PROC_MODULE)
 
@@ -503,14 +497,15 @@ static int cmos_procfs(struct device *dev, struct seq_file *seq)
 #endif
 
 static const struct rtc_class_ops cmos_rtc_ops = {
-	.ioctl		= cmos_rtc_ioctl,
-	.read_time	= cmos_read_time,
-	.set_time	= cmos_set_time,
-	.read_alarm	= cmos_read_alarm,
-	.set_alarm	= cmos_set_alarm,
-	.proc		= cmos_procfs,
-	.irq_set_freq	= cmos_irq_set_freq,
-	.irq_set_state	= cmos_irq_set_state,
+	.read_time		= cmos_read_time,
+	.set_time		= cmos_set_time,
+	.read_alarm		= cmos_read_alarm,
+	.set_alarm		= cmos_set_alarm,
+	.proc			= cmos_procfs,
+	.irq_set_freq		= cmos_irq_set_freq,
+	.irq_set_state		= cmos_irq_set_state,
+	.alarm_irq_enable	= cmos_alarm_irq_enable,
+	.update_irq_enable	= cmos_update_irq_enable,
 };
 
 /*----------------------------------------------------------------*/
@@ -691,7 +686,8 @@ cmos_do_probe(struct device *dev, struct resource *ports, int rtc_irq)
 	 */
 #if	defined(CONFIG_ATARI)
 	address_space = 64;
-#elif defined(__i386__) || defined(__x86_64__) || defined(__arm__) || defined(__sparc__)
+#elif defined(__i386__) || defined(__x86_64__) || defined(__arm__) \
+			|| defined(__sparc__) || defined(__mips__)
 	address_space = 128;
 #else
 #warning Assuming 128 bytes of RTC+NVRAM address space, not 64 bytes.
@@ -871,8 +867,9 @@ static int cmos_suspend(struct device *dev, pm_message_t mesg)
 			mask = RTC_IRQMASK;
 		tmp &= ~mask;
 		CMOS_WRITE(tmp, RTC_CONTROL);
-		hpet_mask_rtc_irq_bit(mask);
 
+		/* shut down hpet emulation - we don't need it for alarm */
+		hpet_mask_rtc_irq_bit(RTC_PIE|RTC_AIE|RTC_UIE);
 		cmos_checkintr(cmos, tmp);
 	}
 	spin_unlock_irq(&rtc_lock);
@@ -1099,9 +1096,9 @@ static int cmos_pnp_resume(struct pnp_dev *pnp)
 #define	cmos_pnp_resume		NULL
 #endif
 
-static void cmos_pnp_shutdown(struct device *pdev)
+static void cmos_pnp_shutdown(struct pnp_dev *pnp)
 {
-	if (system_state == SYSTEM_POWER_OFF && !cmos_poweroff(pdev))
+	if (system_state == SYSTEM_POWER_OFF && !cmos_poweroff(&pnp->dev))
 		return;
 
 	cmos_do_shutdown();
@@ -1120,15 +1117,12 @@ static struct pnp_driver cmos_pnp_driver = {
 	.id_table	= rtc_ids,
 	.probe		= cmos_pnp_probe,
 	.remove		= __exit_p(cmos_pnp_remove),
+	.shutdown	= cmos_pnp_shutdown,
 
 	/* flag ensures resume() gets called, and stops syslog spam */
 	.flags		= PNP_DRIVER_RES_DO_NOT_CHANGE,
 	.suspend	= cmos_pnp_suspend,
 	.resume		= cmos_pnp_resume,
-	.driver		= {
-		.name	  = (char *)driver_name,
-		.shutdown = cmos_pnp_shutdown,
-	}
 };
 
 #endif	/* CONFIG_PNP */
diff --git a/drivers/rtc/rtc-ds1302.c b/drivers/rtc/rtc-ds1302.c
index d490628b64da..532acf9b05d8 100644
--- a/drivers/rtc/rtc-ds1302.c
+++ b/drivers/rtc/rtc-ds1302.c
@@ -143,7 +143,6 @@ static int ds1302_rtc_ioctl(struct device *dev, unsigned int cmd,
 #ifdef RTC_SET_CHARGE
 	case RTC_SET_CHARGE:
 	{
-		struct ds1302_rtc *rtc = dev_get_drvdata(dev);
 		int tcs_val;
 
 		if (copy_from_user(&tcs_val, (int __user *)arg, sizeof(int)))
@@ -201,7 +200,7 @@ static struct platform_driver ds1302_platform_driver = {
 		.name	= DRV_NAME,
 		.owner	= THIS_MODULE,
 	},
-	.remove		= __exit_p(ds1302_rtc_remove),
+	.remove		= __devexit_p(ds1302_rtc_remove),
 };
 
 static int __init ds1302_rtc_init(void)
diff --git a/drivers/rtc/rtc-ds1305.c b/drivers/rtc/rtc-ds1305.c
index 2736b11a1b1e..9630e7d3314e 100644
--- a/drivers/rtc/rtc-ds1305.c
+++ b/drivers/rtc/rtc-ds1305.c
@@ -617,7 +617,6 @@ static struct bin_attribute nvram = {
 static int __devinit ds1305_probe(struct spi_device *spi)
 {
 	struct ds1305			*ds1305;
-	struct rtc_device		*rtc;
 	int				status;
 	u8				addr, value;
 	struct ds1305_platform_data	*pdata = spi->dev.platform_data;
@@ -756,14 +755,13 @@ static int __devinit ds1305_probe(struct spi_device *spi)
 		dev_dbg(&spi->dev, "AM/PM\n");
 
 	/* register RTC ... from here on, ds1305->ctrl needs locking */
-	rtc = rtc_device_register("ds1305", &spi->dev,
+	ds1305->rtc = rtc_device_register("ds1305", &spi->dev,
 			&ds1305_ops, THIS_MODULE);
-	if (IS_ERR(rtc)) {
-		status = PTR_ERR(rtc);
+	if (IS_ERR(ds1305->rtc)) {
+		status = PTR_ERR(ds1305->rtc);
 		dev_dbg(&spi->dev, "register rtc --> %d\n", status);
 		goto fail0;
 	}
-	ds1305->rtc = rtc;
 
 	/* Maybe set up alarm IRQ; be ready to handle it triggering right
 	 * away.  NOTE that we don't share this.  The signal is active low,
@@ -774,12 +772,14 @@ static int __devinit ds1305_probe(struct spi_device *spi)
 	if (spi->irq) {
 		INIT_WORK(&ds1305->work, ds1305_work);
 		status = request_irq(spi->irq, ds1305_irq,
-				0, dev_name(&rtc->dev), ds1305);
+				0, dev_name(&ds1305->rtc->dev), ds1305);
 		if (status < 0) {
 			dev_dbg(&spi->dev, "request_irq %d --> %d\n",
 					spi->irq, status);
 			goto fail1;
 		}
+
+		device_set_wakeup_capable(&spi->dev, 1);
 	}
 
 	/* export NVRAM */
@@ -794,7 +794,7 @@ static int __devinit ds1305_probe(struct spi_device *spi)
 fail2:
 	free_irq(spi->irq, ds1305);
 fail1:
-	rtc_device_unregister(rtc);
+	rtc_device_unregister(ds1305->rtc);
 fail0:
 	kfree(ds1305);
 	return status;
@@ -802,7 +802,7 @@ fail0:
 
 static int __devexit ds1305_remove(struct spi_device *spi)
 {
-	struct ds1305	*ds1305 = spi_get_drvdata(spi);
+	struct ds1305 *ds1305 = spi_get_drvdata(spi);
 
 	sysfs_remove_bin_file(&spi->dev.kobj, &nvram);
 
diff --git a/drivers/rtc/rtc-ds1307.c b/drivers/rtc/rtc-ds1307.c
index eb99ee4fa0f5..c4ec5c158aa1 100644
--- a/drivers/rtc/rtc-ds1307.c
+++ b/drivers/rtc/rtc-ds1307.c
@@ -874,13 +874,15 @@ read_rtc:
 	}
 
 	if (want_irq) {
-		err = request_irq(client->irq, ds1307_irq, 0,
+		err = request_irq(client->irq, ds1307_irq, IRQF_SHARED,
 			  ds1307->rtc->name, client);
 		if (err) {
 			dev_err(&client->dev,
 				"unable to request IRQ!\n");
 			goto exit_irq;
 		}
+
+		device_set_wakeup_capable(&client->dev, 1);
 		set_bit(HAS_ALARM, &ds1307->flags);
 		dev_dbg(&client->dev, "got IRQ %d\n", client->irq);
 	}
diff --git a/drivers/rtc/rtc-ds1374.c b/drivers/rtc/rtc-ds1374.c
index 713f7bf5afb3..5317bbcbc7a0 100644
--- a/drivers/rtc/rtc-ds1374.c
+++ b/drivers/rtc/rtc-ds1374.c
@@ -383,6 +383,8 @@ static int ds1374_probe(struct i2c_client *client,
 			dev_err(&client->dev, "unable to request IRQ\n");
 			goto out_free;
 		}
+
+		device_set_wakeup_capable(&client->dev, 1);
 	}
 
 	ds1374->rtc = rtc_device_register(client->name, &client->dev,
diff --git a/drivers/rtc/rtc-ds1511.c b/drivers/rtc/rtc-ds1511.c
index 0b6b7730c716..4166b84cb514 100644
--- a/drivers/rtc/rtc-ds1511.c
+++ b/drivers/rtc/rtc-ds1511.c
@@ -2,7 +2,7 @@
  * An rtc driver for the Dallas DS1511
  *
  * Copyright (C) 2006 Atsushi Nemoto <anemo@mba.ocn.ne.jp>
- * Copyright (C) 2007 Andrew Sharp <andy.sharp@onstor.com>
+ * Copyright (C) 2007 Andrew Sharp <andy.sharp@lsi.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -87,7 +87,6 @@ enum ds1511reg {
 struct rtc_plat_data {
 	struct rtc_device *rtc;
 	void __iomem *ioaddr;		/* virtual base address */
-	unsigned long baseaddr;		/* physical base address */
 	int size;				/* amount of memory mapped */
 	int irq;
 	unsigned int irqen;
@@ -95,6 +94,7 @@ struct rtc_plat_data {
 	int alrm_min;
 	int alrm_hour;
 	int alrm_mday;
+	spinlock_t lock;
 };
 
 static DEFINE_SPINLOCK(ds1511_lock);
@@ -302,7 +302,7 @@ ds1511_rtc_update_alarm(struct rtc_plat_data *pdata)
 {
 	unsigned long flags;
 
-	spin_lock_irqsave(&pdata->rtc->irq_lock, flags);
+	spin_lock_irqsave(&pdata->lock, flags);
 	rtc_write(pdata->alrm_mday < 0 || (pdata->irqen & RTC_UF) ?
 	       0x80 : bin2bcd(pdata->alrm_mday) & 0x3f,
 	       RTC_ALARM_DATE);
@@ -317,7 +317,7 @@ ds1511_rtc_update_alarm(struct rtc_plat_data *pdata)
 	       RTC_ALARM_SEC);
 	rtc_write(rtc_read(RTC_CMD) | (pdata->irqen ? RTC_TIE : 0), RTC_CMD);
 	rtc_read(RTC_CMD1);	/* clear interrupts */
-	spin_unlock_irqrestore(&pdata->rtc->irq_lock, flags);
+	spin_unlock_irqrestore(&pdata->lock, flags);
 }
 
  static int
@@ -362,61 +362,63 @@ ds1511_interrupt(int irq, void *dev_id)
 {
 	struct platform_device *pdev = dev_id;
 	struct rtc_plat_data *pdata = platform_get_drvdata(pdev);
-	unsigned long events = RTC_IRQF;
+	unsigned long events = 0;
 
+	spin_lock(&pdata->lock);
 	/*
 	 * read and clear interrupt
 	 */
-	if (!(rtc_read(RTC_CMD1) & DS1511_IRQF)) {
-		return IRQ_NONE;
-	}
-	if (rtc_read(RTC_ALARM_SEC) & 0x80) {
-		events |= RTC_UF;
-	} else {
-		events |= RTC_AF;
-	}
-	rtc_update_irq(pdata->rtc, 1, events);
-	return IRQ_HANDLED;
+	if (rtc_read(RTC_CMD1) & DS1511_IRQF) {
+		events = RTC_IRQF;
+		if (rtc_read(RTC_ALARM_SEC) & 0x80)
+			events |= RTC_UF;
+		else
+			events |= RTC_AF;
+		if (likely(pdata->rtc))
+			rtc_update_irq(pdata->rtc, 1, events);
+	}
+	spin_unlock(&pdata->lock);
+	return events ? IRQ_HANDLED : IRQ_NONE;
 }
 
- static int
-ds1511_rtc_ioctl(struct device *dev, unsigned int cmd, unsigned long arg)
+static int ds1511_rtc_alarm_irq_enable(struct device *dev, unsigned int enabled)
 {
 	struct platform_device *pdev = to_platform_device(dev);
 	struct rtc_plat_data *pdata = platform_get_drvdata(pdev);
 
-	if (pdata->irq <= 0) {
-		return -ENOIOCTLCMD; /* fall back into rtc-dev's emulation */
-	}
-	switch (cmd) {
-	case RTC_AIE_OFF:
-		pdata->irqen &= ~RTC_AF;
-		ds1511_rtc_update_alarm(pdata);
-		break;
-	case RTC_AIE_ON:
+	if (pdata->irq <= 0)
+		return -EINVAL;
+	if (enabled)
 		pdata->irqen |= RTC_AF;
-		ds1511_rtc_update_alarm(pdata);
-		break;
-	case RTC_UIE_OFF:
-		pdata->irqen &= ~RTC_UF;
-		ds1511_rtc_update_alarm(pdata);
-		break;
-	case RTC_UIE_ON:
+	else
+		pdata->irqen &= ~RTC_AF;
+	ds1511_rtc_update_alarm(pdata);
+	return 0;
+}
+
+static int ds1511_rtc_update_irq_enable(struct device *dev,
+	unsigned int enabled)
+{
+	struct platform_device *pdev = to_platform_device(dev);
+	struct rtc_plat_data *pdata = platform_get_drvdata(pdev);
+
+	if (pdata->irq <= 0)
+		return -EINVAL;
+	if (enabled)
 		pdata->irqen |= RTC_UF;
-		ds1511_rtc_update_alarm(pdata);
-		break;
-	default:
-		return -ENOIOCTLCMD;
-	}
+	else
+		pdata->irqen &= ~RTC_UF;
+	ds1511_rtc_update_alarm(pdata);
 	return 0;
 }
 
 static const struct rtc_class_ops ds1511_rtc_ops = {
-	.read_time	= ds1511_rtc_read_time,
-	.set_time	= ds1511_rtc_set_time,
-	.read_alarm	= ds1511_rtc_read_alarm,
-	.set_alarm	= ds1511_rtc_set_alarm,
-	.ioctl		= ds1511_rtc_ioctl,
+	.read_time		= ds1511_rtc_read_time,
+	.set_time		= ds1511_rtc_set_time,
+	.read_alarm		= ds1511_rtc_read_alarm,
+	.set_alarm		= ds1511_rtc_set_alarm,
+	.alarm_irq_enable	= ds1511_rtc_alarm_irq_enable,
+	.update_irq_enable	= ds1511_rtc_update_irq_enable,
 };
 
  static ssize_t
@@ -492,29 +494,23 @@ ds1511_rtc_probe(struct platform_device *pdev)
 {
 	struct rtc_device *rtc;
 	struct resource *res;
-	struct rtc_plat_data *pdata = NULL;
+	struct rtc_plat_data *pdata;
 	int ret = 0;
 
 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 	if (!res) {
 		return -ENODEV;
 	}
-	pdata = kzalloc(sizeof(*pdata), GFP_KERNEL);
-	if (!pdata) {
+	pdata = devm_kzalloc(&pdev->dev, sizeof(*pdata), GFP_KERNEL);
+	if (!pdata)
 		return -ENOMEM;
-	}
 	pdata->size = res->end - res->start + 1;
-	if (!request_mem_region(res->start, pdata->size, pdev->name)) {
-		ret = -EBUSY;
-		goto out;
-	}
-	pdata->baseaddr = res->start;
-	pdata->size = pdata->size;
-	ds1511_base = ioremap(pdata->baseaddr, pdata->size);
-	if (!ds1511_base) {
-		ret = -ENOMEM;
-		goto out;
-	}
+	if (!devm_request_mem_region(&pdev->dev, res->start, pdata->size,
+			pdev->name))
+		return -EBUSY;
+	ds1511_base = devm_ioremap(&pdev->dev, res->start, pdata->size);
+	if (!ds1511_base)
+		return -ENOMEM;
 	pdata->ioaddr = ds1511_base;
 	pdata->irq = platform_get_irq(pdev, 0);
 
@@ -540,13 +536,15 @@ ds1511_rtc_probe(struct platform_device *pdev)
 		dev_warn(&pdev->dev, "voltage-low detected.\n");
 	}
 
+	spin_lock_init(&pdata->lock);
+	platform_set_drvdata(pdev, pdata);
 	/*
 	 * if the platform has an interrupt in mind for this device,
 	 * then by all means, set it
 	 */
 	if (pdata->irq > 0) {
 		rtc_read(RTC_CMD1);
-		if (request_irq(pdata->irq, ds1511_interrupt,
+		if (devm_request_irq(&pdev->dev, pdata->irq, ds1511_interrupt,
 			IRQF_DISABLED | IRQF_SHARED, pdev->name, pdev) < 0) {
 
 			dev_warn(&pdev->dev, "interrupt not available.\n");
@@ -556,33 +554,13 @@ ds1511_rtc_probe(struct platform_device *pdev)
 
 	rtc = rtc_device_register(pdev->name, &pdev->dev, &ds1511_rtc_ops,
 		THIS_MODULE);
-	if (IS_ERR(rtc)) {
-		ret = PTR_ERR(rtc);
-		goto out;
-	}
+	if (IS_ERR(rtc))
+		return PTR_ERR(rtc);
 	pdata->rtc = rtc;
-	platform_set_drvdata(pdev, pdata);
+
 	ret = sysfs_create_bin_file(&pdev->dev.kobj, &ds1511_nvram_attr);
-	if (ret) {
-		goto out;
-	}
-	return 0;
- out:
-	if (pdata->rtc) {
+	if (ret)
 		rtc_device_unregister(pdata->rtc);
-	}
-	if (pdata->irq > 0) {
-		free_irq(pdata->irq, pdev);
-	}
-	if (ds1511_base) {
-		iounmap(ds1511_base);
-		ds1511_base = NULL;
-	}
-	if (pdata->baseaddr) {
-		release_mem_region(pdata->baseaddr, pdata->size);
-	}
-
-	kfree(pdata);
 	return ret;
 }
 
@@ -593,19 +571,13 @@ ds1511_rtc_remove(struct platform_device *pdev)
 
 	sysfs_remove_bin_file(&pdev->dev.kobj, &ds1511_nvram_attr);
 	rtc_device_unregister(pdata->rtc);
-	pdata->rtc = NULL;
 	if (pdata->irq > 0) {
 		/*
 		 * disable the alarm interrupt
 		 */
 		rtc_write(rtc_read(RTC_CMD) & ~RTC_TIE, RTC_CMD);
 		rtc_read(RTC_CMD1);
-		free_irq(pdata->irq, pdev);
 	}
-	iounmap(pdata->ioaddr);
-	ds1511_base = NULL;
-	release_mem_region(pdata->baseaddr, pdata->size);
-	kfree(pdata);
 	return 0;
 }
 
@@ -636,7 +608,7 @@ ds1511_rtc_exit(void)
 module_init(ds1511_rtc_init);
 module_exit(ds1511_rtc_exit);
 
-MODULE_AUTHOR("Andrew Sharp <andy.sharp@onstor.com>");
+MODULE_AUTHOR("Andrew Sharp <andy.sharp@lsi.com>");
 MODULE_DESCRIPTION("Dallas DS1511 RTC driver");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(DRV_VERSION);
diff --git a/drivers/rtc/rtc-ds1553.c b/drivers/rtc/rtc-ds1553.c
index 717288527c6b..ed1ef7c9cc06 100644
--- a/drivers/rtc/rtc-ds1553.c
+++ b/drivers/rtc/rtc-ds1553.c
@@ -18,7 +18,7 @@
 #include <linux/platform_device.h>
 #include <linux/io.h>
 
-#define DRV_VERSION "0.2"
+#define DRV_VERSION "0.3"
 
 #define RTC_REG_SIZE		0x2000
 #define RTC_OFFSET		0x1ff0
@@ -61,7 +61,6 @@
 struct rtc_plat_data {
 	struct rtc_device *rtc;
 	void __iomem *ioaddr;
-	resource_size_t baseaddr;
 	unsigned long last_jiffies;
 	int irq;
 	unsigned int irqen;
@@ -69,6 +68,7 @@ struct rtc_plat_data {
 	int alrm_min;
 	int alrm_hour;
 	int alrm_mday;
+	spinlock_t lock;
 };
 
 static int ds1553_rtc_set_time(struct device *dev, struct rtc_time *tm)
@@ -139,7 +139,7 @@ static void ds1553_rtc_update_alarm(struct rtc_plat_data *pdata)
 	void __iomem *ioaddr = pdata->ioaddr;
 	unsigned long flags;
 
-	spin_lock_irqsave(&pdata->rtc->irq_lock, flags);
+	spin_lock_irqsave(&pdata->lock, flags);
 	writeb(pdata->alrm_mday < 0 || (pdata->irqen & RTC_UF) ?
 	       0x80 : bin2bcd(pdata->alrm_mday),
 	       ioaddr + RTC_DATE_ALARM);
@@ -154,7 +154,7 @@ static void ds1553_rtc_update_alarm(struct rtc_plat_data *pdata)
 	       ioaddr + RTC_SECONDS_ALARM);
 	writeb(pdata->irqen ? RTC_INTS_AE : 0, ioaddr + RTC_INTERRUPTS);
 	readb(ioaddr + RTC_FLAGS);	/* clear interrupts */
-	spin_unlock_irqrestore(&pdata->rtc->irq_lock, flags);
+	spin_unlock_irqrestore(&pdata->lock, flags);
 }
 
 static int ds1553_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
@@ -194,64 +194,69 @@ static irqreturn_t ds1553_rtc_interrupt(int irq, void *dev_id)
 	struct platform_device *pdev = dev_id;
 	struct rtc_plat_data *pdata = platform_get_drvdata(pdev);
 	void __iomem *ioaddr = pdata->ioaddr;
-	unsigned long events = RTC_IRQF;
+	unsigned long events = 0;
 
+	spin_lock(&pdata->lock);
 	/* read and clear interrupt */
-	if (!(readb(ioaddr + RTC_FLAGS) & RTC_FLAGS_AF))
-		return IRQ_NONE;
-	if (readb(ioaddr + RTC_SECONDS_ALARM) & 0x80)
-		events |= RTC_UF;
-	else
-		events |= RTC_AF;
-	rtc_update_irq(pdata->rtc, 1, events);
-	return IRQ_HANDLED;
+	if (readb(ioaddr + RTC_FLAGS) & RTC_FLAGS_AF) {
+		events = RTC_IRQF;
+		if (readb(ioaddr + RTC_SECONDS_ALARM) & 0x80)
+			events |= RTC_UF;
+		else
+			events |= RTC_AF;
+		if (likely(pdata->rtc))
+			rtc_update_irq(pdata->rtc, 1, events);
+	}
+	spin_unlock(&pdata->lock);
+	return events ? IRQ_HANDLED : IRQ_NONE;
 }
 
-static int ds1553_rtc_ioctl(struct device *dev, unsigned int cmd,
-			    unsigned long arg)
+static int ds1553_rtc_alarm_irq_enable(struct device *dev, unsigned int enabled)
 {
 	struct platform_device *pdev = to_platform_device(dev);
 	struct rtc_plat_data *pdata = platform_get_drvdata(pdev);
 
 	if (pdata->irq <= 0)
-		return -ENOIOCTLCMD; /* fall back into rtc-dev's emulation */
-	switch (cmd) {
-	case RTC_AIE_OFF:
-		pdata->irqen &= ~RTC_AF;
-		ds1553_rtc_update_alarm(pdata);
-		break;
-	case RTC_AIE_ON:
+		return -EINVAL;
+	if (enabled)
 		pdata->irqen |= RTC_AF;
-		ds1553_rtc_update_alarm(pdata);
-		break;
-	case RTC_UIE_OFF:
-		pdata->irqen &= ~RTC_UF;
-		ds1553_rtc_update_alarm(pdata);
-		break;
-	case RTC_UIE_ON:
+	else
+		pdata->irqen &= ~RTC_AF;
+	ds1553_rtc_update_alarm(pdata);
+	return 0;
+}
+
+static int ds1553_rtc_update_irq_enable(struct device *dev,
+	unsigned int enabled)
+{
+	struct platform_device *pdev = to_platform_device(dev);
+	struct rtc_plat_data *pdata = platform_get_drvdata(pdev);
+
+	if (pdata->irq <= 0)
+		return -EINVAL;
+	if (enabled)
 		pdata->irqen |= RTC_UF;
-		ds1553_rtc_update_alarm(pdata);
-		break;
-	default:
-		return -ENOIOCTLCMD;
-	}
+	else
+		pdata->irqen &= ~RTC_UF;
+	ds1553_rtc_update_alarm(pdata);
 	return 0;
 }
 
 static const struct rtc_class_ops ds1553_rtc_ops = {
-	.read_time	= ds1553_rtc_read_time,
-	.set_time	= ds1553_rtc_set_time,
-	.read_alarm	= ds1553_rtc_read_alarm,
-	.set_alarm	= ds1553_rtc_set_alarm,
-	.ioctl		= ds1553_rtc_ioctl,
+	.read_time		= ds1553_rtc_read_time,
+	.set_time		= ds1553_rtc_set_time,
+	.read_alarm		= ds1553_rtc_read_alarm,
+	.set_alarm		= ds1553_rtc_set_alarm,
+	.alarm_irq_enable	= ds1553_rtc_alarm_irq_enable,
+	.update_irq_enable	= ds1553_rtc_update_irq_enable,
 };
 
 static ssize_t ds1553_nvram_read(struct kobject *kobj,
 				 struct bin_attribute *bin_attr,
 				 char *buf, loff_t pos, size_t size)
 {
-	struct platform_device *pdev =
-		to_platform_device(container_of(kobj, struct device, kobj));
+	struct device *dev = container_of(kobj, struct device, kobj);
+	struct platform_device *pdev = to_platform_device(dev);
 	struct rtc_plat_data *pdata = platform_get_drvdata(pdev);
 	void __iomem *ioaddr = pdata->ioaddr;
 	ssize_t count;
@@ -265,8 +270,8 @@ static ssize_t ds1553_nvram_write(struct kobject *kobj,
 				  struct bin_attribute *bin_attr,
 				  char *buf, loff_t pos, size_t size)
 {
-	struct platform_device *pdev =
-		to_platform_device(container_of(kobj, struct device, kobj));
+	struct device *dev = container_of(kobj, struct device, kobj);
+	struct platform_device *pdev = to_platform_device(dev);
 	struct rtc_plat_data *pdata = platform_get_drvdata(pdev);
 	void __iomem *ioaddr = pdata->ioaddr;
 	ssize_t count;
@@ -291,26 +296,23 @@ static int __devinit ds1553_rtc_probe(struct platform_device *pdev)
 	struct rtc_device *rtc;
 	struct resource *res;
 	unsigned int cen, sec;
-	struct rtc_plat_data *pdata = NULL;
-	void __iomem *ioaddr = NULL;
+	struct rtc_plat_data *pdata;
+	void __iomem *ioaddr;
 	int ret = 0;
 
 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 	if (!res)
 		return -ENODEV;
-	pdata = kzalloc(sizeof(*pdata), GFP_KERNEL);
+	pdata = devm_kzalloc(&pdev->dev, sizeof(*pdata), GFP_KERNEL);
 	if (!pdata)
 		return -ENOMEM;
-	if (!request_mem_region(res->start, RTC_REG_SIZE, pdev->name)) {
-		ret = -EBUSY;
-		goto out;
-	}
-	pdata->baseaddr = res->start;
-	ioaddr = ioremap(pdata->baseaddr, RTC_REG_SIZE);
-	if (!ioaddr) {
-		ret = -ENOMEM;
-		goto out;
-	}
+	if (!devm_request_mem_region(&pdev->dev, res->start, RTC_REG_SIZE,
+			pdev->name))
+		return -EBUSY;
+
+	ioaddr = devm_ioremap(&pdev->dev, res->start, RTC_REG_SIZE);
+	if (!ioaddr)
+		return -ENOMEM;
 	pdata->ioaddr = ioaddr;
 	pdata->irq = platform_get_irq(pdev, 0);
 
@@ -326,9 +328,13 @@ static int __devinit ds1553_rtc_probe(struct platform_device *pdev)
 	if (readb(ioaddr + RTC_FLAGS) & RTC_FLAGS_BLF)
 		dev_warn(&pdev->dev, "voltage-low detected.\n");
 
+	spin_lock_init(&pdata->lock);
+	pdata->last_jiffies = jiffies;
+	platform_set_drvdata(pdev, pdata);
 	if (pdata->irq > 0) {
 		writeb(0, ioaddr + RTC_INTERRUPTS);
-		if (request_irq(pdata->irq, ds1553_rtc_interrupt,
+		if (devm_request_irq(&pdev->dev, pdata->irq,
+				ds1553_rtc_interrupt,
 				IRQF_DISABLED, pdev->name, pdev) < 0) {
 			dev_warn(&pdev->dev, "interrupt not available.\n");
 			pdata->irq = 0;
@@ -337,27 +343,13 @@ static int __devinit ds1553_rtc_probe(struct platform_device *pdev)
 
 	rtc = rtc_device_register(pdev->name, &pdev->dev,
 				  &ds1553_rtc_ops, THIS_MODULE);
-	if (IS_ERR(rtc)) {
-		ret = PTR_ERR(rtc);
-		goto out;
-	}
+	if (IS_ERR(rtc))
+		return PTR_ERR(rtc);
 	pdata->rtc = rtc;
-	pdata->last_jiffies = jiffies;
-	platform_set_drvdata(pdev, pdata);
+
 	ret = sysfs_create_bin_file(&pdev->dev.kobj, &ds1553_nvram_attr);
 	if (ret)
-		goto out;
-	return 0;
- out:
-	if (pdata->rtc)
-		rtc_device_unregister(pdata->rtc);
-	if (pdata->irq > 0)
-		free_irq(pdata->irq, pdev);
-	if (ioaddr)
-		iounmap(ioaddr);
-	if (pdata->baseaddr)
-		release_mem_region(pdata->baseaddr, RTC_REG_SIZE);
-	kfree(pdata);
+		rtc_device_unregister(rtc);
 	return ret;
 }
 
@@ -367,13 +359,8 @@ static int __devexit ds1553_rtc_remove(struct platform_device *pdev)
 
 	sysfs_remove_bin_file(&pdev->dev.kobj, &ds1553_nvram_attr);
 	rtc_device_unregister(pdata->rtc);
-	if (pdata->irq > 0) {
+	if (pdata->irq > 0)
 		writeb(0, pdata->ioaddr + RTC_INTERRUPTS);
-		free_irq(pdata->irq, pdev);
-	}
-	iounmap(pdata->ioaddr);
-	release_mem_region(pdata->baseaddr, RTC_REG_SIZE);
-	kfree(pdata);
 	return 0;
 }
 
diff --git a/drivers/rtc/rtc-ds1742.c b/drivers/rtc/rtc-ds1742.c
index 09249459e9a4..a1273360a44e 100644
--- a/drivers/rtc/rtc-ds1742.c
+++ b/drivers/rtc/rtc-ds1742.c
@@ -21,7 +21,7 @@
 #include <linux/platform_device.h>
 #include <linux/io.h>
 
-#define DRV_VERSION "0.3"
+#define DRV_VERSION "0.4"
 
 #define RTC_SIZE		8
 
@@ -55,7 +55,6 @@ struct rtc_plat_data {
 	void __iomem *ioaddr_rtc;
 	size_t size_nvram;
 	size_t size;
-	resource_size_t baseaddr;
 	unsigned long last_jiffies;
 	struct bin_attribute nvram_attr;
 };
@@ -132,8 +131,8 @@ static ssize_t ds1742_nvram_read(struct kobject *kobj,
 				 struct bin_attribute *bin_attr,
 				 char *buf, loff_t pos, size_t size)
 {
-	struct platform_device *pdev =
-		to_platform_device(container_of(kobj, struct device, kobj));
+	struct device *dev = container_of(kobj, struct device, kobj);
+	struct platform_device *pdev = to_platform_device(dev);
 	struct rtc_plat_data *pdata = platform_get_drvdata(pdev);
 	void __iomem *ioaddr = pdata->ioaddr_nvram;
 	ssize_t count;
@@ -147,8 +146,8 @@ static ssize_t ds1742_nvram_write(struct kobject *kobj,
 				  struct bin_attribute *bin_attr,
 				  char *buf, loff_t pos, size_t size)
 {
-	struct platform_device *pdev =
-		to_platform_device(container_of(kobj, struct device, kobj));
+	struct device *dev = container_of(kobj, struct device, kobj);
+	struct platform_device *pdev = to_platform_device(dev);
 	struct rtc_plat_data *pdata = platform_get_drvdata(pdev);
 	void __iomem *ioaddr = pdata->ioaddr_nvram;
 	ssize_t count;
@@ -163,27 +162,24 @@ static int __devinit ds1742_rtc_probe(struct platform_device *pdev)
 	struct rtc_device *rtc;
 	struct resource *res;
 	unsigned int cen, sec;
-	struct rtc_plat_data *pdata = NULL;
-	void __iomem *ioaddr = NULL;
+	struct rtc_plat_data *pdata;
+	void __iomem *ioaddr;
 	int ret = 0;
 
 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 	if (!res)
 		return -ENODEV;
-	pdata = kzalloc(sizeof(*pdata), GFP_KERNEL);
+	pdata = devm_kzalloc(&pdev->dev, sizeof(*pdata), GFP_KERNEL);
 	if (!pdata)
 		return -ENOMEM;
 	pdata->size = res->end - res->start + 1;
-	if (!request_mem_region(res->start, pdata->size, pdev->name)) {
-		ret = -EBUSY;
-		goto out;
-	}
-	pdata->baseaddr = res->start;
-	ioaddr = ioremap(pdata->baseaddr, pdata->size);
-	if (!ioaddr) {
-		ret = -ENOMEM;
-		goto out;
-	}
+	if (!devm_request_mem_region(&pdev->dev, res->start, pdata->size,
+		pdev->name))
+		return -EBUSY;
+	ioaddr = devm_ioremap(&pdev->dev, res->start, pdata->size);
+	if (!ioaddr)
+		return -ENOMEM;
+
 	pdata->ioaddr_nvram = ioaddr;
 	pdata->size_nvram = pdata->size - RTC_SIZE;
 	pdata->ioaddr_rtc = ioaddr + pdata->size_nvram;
@@ -207,31 +203,19 @@ static int __devinit ds1742_rtc_probe(struct platform_device *pdev)
 	if (!(readb(ioaddr + RTC_DAY) & RTC_BATT_FLAG))
 		dev_warn(&pdev->dev, "voltage-low detected.\n");
 
+	pdata->last_jiffies = jiffies;
+	platform_set_drvdata(pdev, pdata);
 	rtc = rtc_device_register(pdev->name, &pdev->dev,
 				  &ds1742_rtc_ops, THIS_MODULE);
-	if (IS_ERR(rtc)) {
-		ret = PTR_ERR(rtc);
-		goto out;
-	}
+	if (IS_ERR(rtc))
+		return PTR_ERR(rtc);
 	pdata->rtc = rtc;
-	pdata->last_jiffies = jiffies;
-	platform_set_drvdata(pdev, pdata);
 
 	ret = sysfs_create_bin_file(&pdev->dev.kobj, &pdata->nvram_attr);
 	if (ret) {
 		dev_err(&pdev->dev, "creating nvram file in sysfs failed\n");
-		goto out;
+		rtc_device_unregister(rtc);
 	}
-
-	return 0;
- out:
-	if (pdata->rtc)
-		rtc_device_unregister(pdata->rtc);
-	if (pdata->ioaddr_nvram)
-		iounmap(pdata->ioaddr_nvram);
-	if (pdata->baseaddr)
-		release_mem_region(pdata->baseaddr, pdata->size);
-	kfree(pdata);
 	return ret;
 }
 
@@ -241,9 +225,6 @@ static int __devexit ds1742_rtc_remove(struct platform_device *pdev)
 
 	sysfs_remove_bin_file(&pdev->dev.kobj, &pdata->nvram_attr);
 	rtc_device_unregister(pdata->rtc);
-	iounmap(pdata->ioaddr_nvram);
-	release_mem_region(pdata->baseaddr, pdata->size);
-	kfree(pdata);
 	return 0;
 }
 
diff --git a/drivers/rtc/rtc-m48t35.c b/drivers/rtc/rtc-m48t35.c
index 0b2197559940..8cb5b8959e5b 100644
--- a/drivers/rtc/rtc-m48t35.c
+++ b/drivers/rtc/rtc-m48t35.c
@@ -142,7 +142,6 @@ static const struct rtc_class_ops m48t35_ops = {
 
 static int __devinit m48t35_probe(struct platform_device *pdev)
 {
-	struct rtc_device *rtc;
 	struct resource *res;
 	struct m48t35_priv *priv;
 	int ret = 0;
@@ -171,20 +170,21 @@ static int __devinit m48t35_probe(struct platform_device *pdev)
 		ret = -ENOMEM;
 		goto out;
 	}
+
 	spin_lock_init(&priv->lock);
-	rtc = rtc_device_register("m48t35", &pdev->dev,
+
+	platform_set_drvdata(pdev, priv);
+
+	priv->rtc = rtc_device_register("m48t35", &pdev->dev,
 				  &m48t35_ops, THIS_MODULE);
-	if (IS_ERR(rtc)) {
-		ret = PTR_ERR(rtc);
+	if (IS_ERR(priv->rtc)) {
+		ret = PTR_ERR(priv->rtc);
 		goto out;
 	}
-	priv->rtc = rtc;
-	platform_set_drvdata(pdev, priv);
+
 	return 0;
 
 out:
-	if (priv->rtc)
-		rtc_device_unregister(priv->rtc);
 	if (priv->reg)
 		iounmap(priv->reg);
 	if (priv->baseaddr)
diff --git a/drivers/rtc/rtc-m48t59.c b/drivers/rtc/rtc-m48t59.c
index 33921a6b1707..ede43b846859 100644
--- a/drivers/rtc/rtc-m48t59.c
+++ b/drivers/rtc/rtc-m48t59.c
@@ -481,6 +481,9 @@ static int __devinit m48t59_rtc_probe(struct platform_device *pdev)
 		goto out;
 	}
 
+	spin_lock_init(&m48t59->lock);
+	platform_set_drvdata(pdev, m48t59);
+
 	m48t59->rtc = rtc_device_register(name, &pdev->dev, ops, THIS_MODULE);
 	if (IS_ERR(m48t59->rtc)) {
 		ret = PTR_ERR(m48t59->rtc);
@@ -490,16 +493,14 @@ static int __devinit m48t59_rtc_probe(struct platform_device *pdev)
 	m48t59_nvram_attr.size = pdata->offset;
 
 	ret = sysfs_create_bin_file(&pdev->dev.kobj, &m48t59_nvram_attr);
-	if (ret)
+	if (ret) {
+		rtc_device_unregister(m48t59->rtc);
 		goto out;
+	}
 
-	spin_lock_init(&m48t59->lock);
-	platform_set_drvdata(pdev, m48t59);
 	return 0;
 
 out:
-	if (!IS_ERR(m48t59->rtc))
-		rtc_device_unregister(m48t59->rtc);
 	if (m48t59->irq != NO_IRQ)
 		free_irq(m48t59->irq, &pdev->dev);
 	if (m48t59->ioaddr)
diff --git a/drivers/rtc/rtc-mc13783.c b/drivers/rtc/rtc-mc13783.c
new file mode 100644
index 000000000000..850f983c039c
--- /dev/null
+++ b/drivers/rtc/rtc-mc13783.c
@@ -0,0 +1,262 @@
+/*
+ * Real Time Clock driver for Freescale MC13783 PMIC
+ *
+ * (C) 2009 Sascha Hauer, Pengutronix
+ * (C) 2009 Uwe Kleine-Koenig, Pengutronix
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/mfd/mc13783.h>
+#include <linux/platform_device.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/rtc.h>
+
+#define DRIVER_NAME "mc13783-rtc"
+
+#define MC13783_RTCTOD	20
+#define MC13783_RTCTODA	21
+#define MC13783_RTCDAY	22
+#define MC13783_RTCDAYA	23
+
+struct mc13783_rtc {
+	struct rtc_device *rtc;
+	struct mc13783 *mc13783;
+	int valid;
+};
+
+static int mc13783_rtc_read_time(struct device *dev, struct rtc_time *tm)
+{
+	struct mc13783_rtc *priv = dev_get_drvdata(dev);
+	unsigned int seconds, days1, days2;
+	unsigned long s1970;
+	int ret;
+
+	mc13783_lock(priv->mc13783);
+
+	if (!priv->valid) {
+		ret = -ENODATA;
+		goto out;
+	}
+
+	ret = mc13783_reg_read(priv->mc13783, MC13783_RTCDAY, &days1);
+	if (unlikely(ret))
+		goto out;
+
+	ret = mc13783_reg_read(priv->mc13783, MC13783_RTCTOD, &seconds);
+	if (unlikely(ret))
+		goto out;
+
+	ret = mc13783_reg_read(priv->mc13783, MC13783_RTCDAY, &days2);
+out:
+	mc13783_unlock(priv->mc13783);
+
+	if (ret)
+		return ret;
+
+	if (days2 == days1 + 1) {
+		if (seconds >= 86400 / 2)
+			days2 = days1;
+		else
+			days1 = days2;
+	}
+
+	if (days1 != days2)
+		return -EIO;
+
+	s1970 = days1 * 86400 + seconds;
+
+	rtc_time_to_tm(s1970, tm);
+
+	return rtc_valid_tm(tm);
+}
+
+static int mc13783_rtc_set_mmss(struct device *dev, unsigned long secs)
+{
+	struct mc13783_rtc *priv = dev_get_drvdata(dev);
+	unsigned int seconds, days;
+	int ret;
+
+	seconds = secs % 86400;
+	days = secs / 86400;
+
+	mc13783_lock(priv->mc13783);
+
+	/*
+	 * first write seconds=0 to prevent a day switch between writing days
+	 * and seconds below
+	 */
+	ret = mc13783_reg_write(priv->mc13783, MC13783_RTCTOD, 0);
+	if (unlikely(ret))
+		goto out;
+
+	ret = mc13783_reg_write(priv->mc13783, MC13783_RTCDAY, days);
+	if (unlikely(ret))
+		goto out;
+
+	ret = mc13783_reg_write(priv->mc13783, MC13783_RTCTOD, seconds);
+	if (unlikely(ret))
+		goto out;
+
+	ret = mc13783_ackirq(priv->mc13783, MC13783_IRQ_RTCRST);
+	if (unlikely(ret))
+		goto out;
+
+	ret = mc13783_unmask(priv->mc13783, MC13783_IRQ_RTCRST);
+out:
+	priv->valid = !ret;
+
+	mc13783_unlock(priv->mc13783);
+
+	return ret;
+}
+
+static irqreturn_t mc13783_rtc_update_handler(int irq, void *dev)
+{
+	struct mc13783_rtc *priv = dev;
+	struct mc13783 *mc13783 = priv->mc13783;
+
+	dev_dbg(&priv->rtc->dev, "1HZ\n");
+
+	rtc_update_irq(priv->rtc, 1, RTC_IRQF | RTC_UF);
+
+	mc13783_ackirq(mc13783, irq);
+
+	return IRQ_HANDLED;
+}
+
+static int mc13783_rtc_update_irq_enable(struct device *dev,
+		unsigned int enabled)
+{
+	struct mc13783_rtc *priv = dev_get_drvdata(dev);
+	int ret = -ENODATA;
+
+	mc13783_lock(priv->mc13783);
+	if (!priv->valid)
+		goto out;
+
+	ret = (enabled ? mc13783_unmask : mc13783_mask)(priv->mc13783,
+			MC13783_IRQ_1HZ);
+out:
+	mc13783_unlock(priv->mc13783);
+
+	return ret;
+}
+
+static const struct rtc_class_ops mc13783_rtc_ops = {
+	.read_time = mc13783_rtc_read_time,
+	.set_mmss = mc13783_rtc_set_mmss,
+	.update_irq_enable = mc13783_rtc_update_irq_enable,
+};
+
+static irqreturn_t mc13783_rtc_reset_handler(int irq, void *dev)
+{
+	struct mc13783_rtc *priv = dev;
+	struct mc13783 *mc13783 = priv->mc13783;
+
+	dev_dbg(&priv->rtc->dev, "RTCRST\n");
+	priv->valid = 0;
+
+	mc13783_mask(mc13783, irq);
+
+	return IRQ_HANDLED;
+}
+
+static int __devinit mc13783_rtc_probe(struct platform_device *pdev)
+{
+	int ret;
+	struct mc13783_rtc *priv;
+
+	priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+	if (!priv)
+		return -ENOMEM;
+
+	priv->mc13783 = dev_get_drvdata(pdev->dev.parent);
+	platform_set_drvdata(pdev, priv);
+
+	priv->valid = 1;
+
+	mc13783_lock(priv->mc13783);
+
+	ret = mc13783_irq_request(priv->mc13783, MC13783_IRQ_RTCRST,
+			mc13783_rtc_reset_handler, DRIVER_NAME, priv);
+	if (ret)
+		goto err_reset_irq_request;
+
+	ret = mc13783_irq_request_nounmask(priv->mc13783, MC13783_IRQ_1HZ,
+			mc13783_rtc_update_handler, DRIVER_NAME, priv);
+	if (ret)
+		goto err_update_irq_request;
+
+	mc13783_unlock(priv->mc13783);
+
+	priv->rtc = rtc_device_register(pdev->name,
+			&pdev->dev, &mc13783_rtc_ops, THIS_MODULE);
+
+	if (IS_ERR(priv->rtc)) {
+		ret = PTR_ERR(priv->rtc);
+
+		mc13783_lock(priv->mc13783);
+
+		mc13783_irq_free(priv->mc13783, MC13783_IRQ_1HZ, priv);
+err_update_irq_request:
+
+		mc13783_irq_free(priv->mc13783, MC13783_IRQ_RTCRST, priv);
+err_reset_irq_request:
+
+		mc13783_unlock(priv->mc13783);
+
+		platform_set_drvdata(pdev, NULL);
+		kfree(priv);
+	}
+
+	return ret;
+}
+
+static int __devexit mc13783_rtc_remove(struct platform_device *pdev)
+{
+	struct mc13783_rtc *priv = platform_get_drvdata(pdev);
+
+	rtc_device_unregister(priv->rtc);
+
+	mc13783_lock(priv->mc13783);
+
+	mc13783_irq_free(priv->mc13783, MC13783_IRQ_1HZ, priv);
+	mc13783_irq_free(priv->mc13783, MC13783_IRQ_RTCRST, priv);
+
+	mc13783_unlock(priv->mc13783);
+
+	platform_set_drvdata(pdev, NULL);
+
+	kfree(priv);
+
+	return 0;
+}
+
+static struct platform_driver mc13783_rtc_driver = {
+	.remove = __devexit_p(mc13783_rtc_remove),
+	.driver = {
+		.name = DRIVER_NAME,
+		.owner = THIS_MODULE,
+	},
+};
+
+static int __init mc13783_rtc_init(void)
+{
+	return platform_driver_probe(&mc13783_rtc_driver, &mc13783_rtc_probe);
+}
+module_init(mc13783_rtc_init);
+
+static void __exit mc13783_rtc_exit(void)
+{
+	platform_driver_unregister(&mc13783_rtc_driver);
+}
+module_exit(mc13783_rtc_exit);
+
+MODULE_AUTHOR("Sascha Hauer <s.hauer@pengutronix.de>");
+MODULE_DESCRIPTION("RTC driver for Freescale MC13783 PMIC");
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:" DRIVER_NAME);
diff --git a/drivers/rtc/rtc-mv.c b/drivers/rtc/rtc-mv.c
index e0263d2005ee..dc052ce6e63a 100644
--- a/drivers/rtc/rtc-mv.c
+++ b/drivers/rtc/rtc-mv.c
@@ -27,10 +27,17 @@
 #define RTC_MONTH_OFFS		8
 #define RTC_YEAR_OFFS		16
 
+#define RTC_ALARM_TIME_REG_OFFS	8
+#define RTC_ALARM_DATE_REG_OFFS	0xc
+#define RTC_ALARM_VALID		(1 << 7)
+
+#define RTC_ALARM_INTERRUPT_MASK_REG_OFFS	0x10
+#define RTC_ALARM_INTERRUPT_CASUE_REG_OFFS	0x14
 
 struct rtc_plat_data {
 	struct rtc_device *rtc;
 	void __iomem *ioaddr;
+	int		irq;
 };
 
 static int mv_rtc_set_time(struct device *dev, struct rtc_time *tm)
@@ -84,12 +91,134 @@ static int mv_rtc_read_time(struct device *dev, struct rtc_time *tm)
 	return rtc_valid_tm(tm);
 }
 
+static int mv_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alm)
+{
+	struct rtc_plat_data *pdata = dev_get_drvdata(dev);
+	void __iomem *ioaddr = pdata->ioaddr;
+	u32	rtc_time, rtc_date;
+	unsigned int year, month, day, hour, minute, second, wday;
+
+	rtc_time = readl(ioaddr + RTC_ALARM_TIME_REG_OFFS);
+	rtc_date = readl(ioaddr + RTC_ALARM_DATE_REG_OFFS);
+
+	second = rtc_time & 0x7f;
+	minute = (rtc_time >> RTC_MINUTES_OFFS) & 0x7f;
+	hour = (rtc_time >> RTC_HOURS_OFFS) & 0x3f; /* assume 24 hours mode */
+	wday = (rtc_time >> RTC_WDAY_OFFS) & 0x7;
+
+	day = rtc_date & 0x3f;
+	month = (rtc_date >> RTC_MONTH_OFFS) & 0x3f;
+	year = (rtc_date >> RTC_YEAR_OFFS) & 0xff;
+
+	alm->time.tm_sec = bcd2bin(second);
+	alm->time.tm_min = bcd2bin(minute);
+	alm->time.tm_hour = bcd2bin(hour);
+	alm->time.tm_mday = bcd2bin(day);
+	alm->time.tm_wday = bcd2bin(wday);
+	alm->time.tm_mon = bcd2bin(month) - 1;
+	/* hw counts from year 2000, but tm_year is relative to 1900 */
+	alm->time.tm_year = bcd2bin(year) + 100;
+
+	if (rtc_valid_tm(&alm->time) < 0) {
+		dev_err(dev, "retrieved alarm date/time is not valid.\n");
+		rtc_time_to_tm(0, &alm->time);
+	}
+
+	alm->enabled = !!readl(ioaddr + RTC_ALARM_INTERRUPT_MASK_REG_OFFS);
+	return 0;
+}
+
+static int mv_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alm)
+{
+	struct rtc_plat_data *pdata = dev_get_drvdata(dev);
+	void __iomem *ioaddr = pdata->ioaddr;
+	u32 rtc_reg = 0;
+
+	if (alm->time.tm_sec >= 0)
+		rtc_reg |= (RTC_ALARM_VALID | bin2bcd(alm->time.tm_sec))
+			<< RTC_SECONDS_OFFS;
+	if (alm->time.tm_min >= 0)
+		rtc_reg |= (RTC_ALARM_VALID | bin2bcd(alm->time.tm_min))
+			<< RTC_MINUTES_OFFS;
+	if (alm->time.tm_hour >= 0)
+		rtc_reg |= (RTC_ALARM_VALID | bin2bcd(alm->time.tm_hour))
+			<< RTC_HOURS_OFFS;
+
+	writel(rtc_reg, ioaddr + RTC_ALARM_TIME_REG_OFFS);
+
+	if (alm->time.tm_mday >= 0)
+		rtc_reg = (RTC_ALARM_VALID | bin2bcd(alm->time.tm_mday))
+			<< RTC_MDAY_OFFS;
+	else
+		rtc_reg = 0;
+
+	if (alm->time.tm_mon >= 0)
+		rtc_reg |= (RTC_ALARM_VALID | bin2bcd(alm->time.tm_mon + 1))
+			<< RTC_MONTH_OFFS;
+
+	if (alm->time.tm_year >= 0)
+		rtc_reg |= (RTC_ALARM_VALID | bin2bcd(alm->time.tm_year % 100))
+			<< RTC_YEAR_OFFS;
+
+	writel(rtc_reg, ioaddr + RTC_ALARM_DATE_REG_OFFS);
+	writel(0, ioaddr + RTC_ALARM_INTERRUPT_CASUE_REG_OFFS);
+	writel(alm->enabled ? 1 : 0,
+	       ioaddr + RTC_ALARM_INTERRUPT_MASK_REG_OFFS);
+
+	return 0;
+}
+
+static int mv_rtc_ioctl(struct device *dev, unsigned int cmd,
+			unsigned long arg)
+{
+	struct platform_device *pdev = to_platform_device(dev);
+	struct rtc_plat_data *pdata = platform_get_drvdata(pdev);
+	void __iomem *ioaddr = pdata->ioaddr;
+
+	if (pdata->irq < 0)
+		return -ENOIOCTLCMD; /* fall back into rtc-dev's emulation */
+	switch (cmd) {
+	case RTC_AIE_OFF:
+		writel(0, ioaddr + RTC_ALARM_INTERRUPT_MASK_REG_OFFS);
+		break;
+	case RTC_AIE_ON:
+		writel(1, ioaddr + RTC_ALARM_INTERRUPT_MASK_REG_OFFS);
+		break;
+	default:
+		return -ENOIOCTLCMD;
+	}
+	return 0;
+}
+
+static irqreturn_t mv_rtc_interrupt(int irq, void *data)
+{
+	struct rtc_plat_data *pdata = data;
+	void __iomem *ioaddr = pdata->ioaddr;
+
+	/* alarm irq? */
+	if (!readl(ioaddr + RTC_ALARM_INTERRUPT_CASUE_REG_OFFS))
+		return IRQ_NONE;
+
+	/* clear interrupt */
+	writel(0, ioaddr + RTC_ALARM_INTERRUPT_CASUE_REG_OFFS);
+	rtc_update_irq(pdata->rtc, 1, RTC_IRQF | RTC_AF);
+	return IRQ_HANDLED;
+}
+
 static const struct rtc_class_ops mv_rtc_ops = {
 	.read_time	= mv_rtc_read_time,
 	.set_time	= mv_rtc_set_time,
 };
 
-static int __init mv_rtc_probe(struct platform_device *pdev)
+static const struct rtc_class_ops mv_rtc_alarm_ops = {
+	.read_time	= mv_rtc_read_time,
+	.set_time	= mv_rtc_set_time,
+	.read_alarm	= mv_rtc_read_alarm,
+	.set_alarm	= mv_rtc_set_alarm,
+	.ioctl		= mv_rtc_ioctl,
+};
+
+static int __devinit mv_rtc_probe(struct platform_device *pdev)
 {
 	struct resource *res;
 	struct rtc_plat_data *pdata;
@@ -130,12 +259,31 @@ static int __init mv_rtc_probe(struct platform_device *pdev)
 		}
 	}
 
+	pdata->irq = platform_get_irq(pdev, 0);
+
 	platform_set_drvdata(pdev, pdata);
-	pdata->rtc = rtc_device_register(pdev->name, &pdev->dev,
-					 &mv_rtc_ops, THIS_MODULE);
+
+	if (pdata->irq >= 0) {
+		device_init_wakeup(&pdev->dev, 1);
+		pdata->rtc = rtc_device_register(pdev->name, &pdev->dev,
+						 &mv_rtc_alarm_ops,
+						 THIS_MODULE);
+	} else
+		pdata->rtc = rtc_device_register(pdev->name, &pdev->dev,
+						 &mv_rtc_ops, THIS_MODULE);
 	if (IS_ERR(pdata->rtc))
 		return PTR_ERR(pdata->rtc);
 
+	if (pdata->irq >= 0) {
+		writel(0, pdata->ioaddr + RTC_ALARM_INTERRUPT_MASK_REG_OFFS);
+		if (devm_request_irq(&pdev->dev, pdata->irq, mv_rtc_interrupt,
+				     IRQF_DISABLED | IRQF_SHARED,
+				     pdev->name, pdata) < 0) {
+			dev_warn(&pdev->dev, "interrupt not available.\n");
+			pdata->irq = -1;
+		}
+	}
+
 	return 0;
 }
 
@@ -143,6 +291,9 @@ static int __exit mv_rtc_remove(struct platform_device *pdev)
 {
 	struct rtc_plat_data *pdata = platform_get_drvdata(pdev);
 
+	if (pdata->irq >= 0)
+		device_init_wakeup(&pdev->dev, 0);
+
 	rtc_device_unregister(pdata->rtc);
 	return 0;
 }
diff --git a/drivers/rtc/rtc-nuc900.c b/drivers/rtc/rtc-nuc900.c
new file mode 100644
index 000000000000..bf59c9c586b2
--- /dev/null
+++ b/drivers/rtc/rtc-nuc900.c
@@ -0,0 +1,342 @@
+/*
+ * Copyright (c) 2008-2009 Nuvoton technology corporation.
+ *
+ * Wan ZongShun <mcuos.com@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation;version 2 of the License.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/platform_device.h>
+#include <linux/rtc.h>
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/bcd.h>
+
+/* RTC Control Registers */
+#define REG_RTC_INIR		0x00
+#define REG_RTC_AER		0x04
+#define REG_RTC_FCR		0x08
+#define REG_RTC_TLR		0x0C
+#define REG_RTC_CLR		0x10
+#define REG_RTC_TSSR		0x14
+#define REG_RTC_DWR		0x18
+#define REG_RTC_TAR		0x1C
+#define REG_RTC_CAR		0x20
+#define REG_RTC_LIR		0x24
+#define REG_RTC_RIER		0x28
+#define REG_RTC_RIIR		0x2C
+#define REG_RTC_TTR		0x30
+
+#define RTCSET			0x01
+#define AERRWENB		0x10000
+#define INIRRESET		0xa5eb1357
+#define AERPOWERON		0xA965
+#define AERPOWEROFF		0x0000
+#define LEAPYEAR		0x0001
+#define TICKENB			0x80
+#define TICKINTENB		0x0002
+#define ALARMINTENB		0x0001
+#define MODE24			0x0001
+
+struct nuc900_rtc {
+	int			irq_num;
+	void __iomem		*rtc_reg;
+	struct rtc_device	*rtcdev;
+};
+
+struct nuc900_bcd_time {
+	int bcd_sec;
+	int bcd_min;
+	int bcd_hour;
+	int bcd_mday;
+	int bcd_mon;
+	int bcd_year;
+};
+
+static irqreturn_t nuc900_rtc_interrupt(int irq, void *_rtc)
+{
+	struct nuc900_rtc *rtc = _rtc;
+	unsigned long events = 0, rtc_irq;
+
+	rtc_irq = __raw_readl(rtc->rtc_reg + REG_RTC_RIIR);
+
+	if (rtc_irq & ALARMINTENB) {
+		rtc_irq &= ~ALARMINTENB;
+		__raw_writel(rtc_irq, rtc->rtc_reg + REG_RTC_RIIR);
+		events |= RTC_AF | RTC_IRQF;
+	}
+
+	if (rtc_irq & TICKINTENB) {
+		rtc_irq &= ~TICKINTENB;
+		__raw_writel(rtc_irq, rtc->rtc_reg + REG_RTC_RIIR);
+		events |= RTC_UF | RTC_IRQF;
+	}
+
+	rtc_update_irq(rtc->rtcdev, 1, events);
+
+	return IRQ_HANDLED;
+}
+
+static int *check_rtc_access_enable(struct nuc900_rtc *nuc900_rtc)
+{
+	unsigned int i;
+	__raw_writel(INIRRESET, nuc900_rtc->rtc_reg + REG_RTC_INIR);
+
+	mdelay(10);
+
+	__raw_writel(AERPOWERON, nuc900_rtc->rtc_reg + REG_RTC_AER);
+
+	for (i = 0; i < 1000; i++) {
+		if (__raw_readl(nuc900_rtc->rtc_reg + REG_RTC_AER) & AERRWENB)
+			return 0;
+	}
+
+	if ((__raw_readl(nuc900_rtc->rtc_reg + REG_RTC_AER) & AERRWENB) == 0x0)
+		return ERR_PTR(-ENODEV);
+
+	return ERR_PTR(-EPERM);
+}
+
+static void nuc900_rtc_bcd2bin(unsigned int timereg,
+				unsigned int calreg, struct rtc_time *tm)
+{
+	tm->tm_mday	= bcd2bin(calreg >> 0);
+	tm->tm_mon	= bcd2bin(calreg >> 8);
+	tm->tm_year	= bcd2bin(calreg >> 16) + 100;
+
+	tm->tm_sec	= bcd2bin(timereg >> 0);
+	tm->tm_min	= bcd2bin(timereg >> 8);
+	tm->tm_hour	= bcd2bin(timereg >> 16);
+
+	rtc_valid_tm(tm);
+}
+
+static void nuc900_rtc_bin2bcd(struct rtc_time *settm,
+						struct nuc900_bcd_time *gettm)
+{
+	gettm->bcd_mday = bin2bcd(settm->tm_mday) << 0;
+	gettm->bcd_mon  = bin2bcd(settm->tm_mon) << 8;
+	gettm->bcd_year = bin2bcd(settm->tm_year - 100) << 16;
+
+	gettm->bcd_sec  = bin2bcd(settm->tm_sec) << 0;
+	gettm->bcd_min  = bin2bcd(settm->tm_min) << 8;
+	gettm->bcd_hour = bin2bcd(settm->tm_hour) << 16;
+}
+
+static int nuc900_update_irq_enable(struct device *dev, unsigned int enabled)
+{
+	struct nuc900_rtc *rtc = dev_get_drvdata(dev);
+
+	if (enabled)
+		__raw_writel(__raw_readl(rtc->rtc_reg + REG_RTC_RIER)|
+				(TICKINTENB), rtc->rtc_reg + REG_RTC_RIER);
+	else
+		__raw_writel(__raw_readl(rtc->rtc_reg + REG_RTC_RIER)&
+				(~TICKINTENB), rtc->rtc_reg + REG_RTC_RIER);
+
+	return 0;
+}
+
+static int nuc900_alarm_irq_enable(struct device *dev, unsigned int enabled)
+{
+	struct nuc900_rtc *rtc = dev_get_drvdata(dev);
+
+	if (enabled)
+		__raw_writel(__raw_readl(rtc->rtc_reg + REG_RTC_RIER)|
+				(ALARMINTENB), rtc->rtc_reg + REG_RTC_RIER);
+	else
+		__raw_writel(__raw_readl(rtc->rtc_reg + REG_RTC_RIER)&
+				(~ALARMINTENB), rtc->rtc_reg + REG_RTC_RIER);
+
+	return 0;
+}
+
+static int nuc900_rtc_read_time(struct device *dev, struct rtc_time *tm)
+{
+	struct nuc900_rtc *rtc = dev_get_drvdata(dev);
+	unsigned int timeval, clrval;
+
+	timeval = __raw_readl(rtc->rtc_reg + REG_RTC_TLR);
+	clrval	= __raw_readl(rtc->rtc_reg + REG_RTC_CLR);
+
+	nuc900_rtc_bcd2bin(timeval, clrval, tm);
+
+	return 0;
+}
+
+static int nuc900_rtc_set_time(struct device *dev, struct rtc_time *tm)
+{
+	struct nuc900_rtc *rtc = dev_get_drvdata(dev);
+	struct nuc900_bcd_time gettm;
+	unsigned long val;
+	int *err;
+
+	nuc900_rtc_bin2bcd(tm, &gettm);
+
+	err = check_rtc_access_enable(rtc);
+	if (IS_ERR(err))
+		return PTR_ERR(err);
+
+	val = gettm.bcd_mday | gettm.bcd_mon | gettm.bcd_year;
+	__raw_writel(val, rtc->rtc_reg + REG_RTC_CLR);
+
+	val = gettm.bcd_sec | gettm.bcd_min | gettm.bcd_hour;
+	__raw_writel(val, rtc->rtc_reg + REG_RTC_TLR);
+
+	return 0;
+}
+
+static int nuc900_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+{
+	struct nuc900_rtc *rtc = dev_get_drvdata(dev);
+	unsigned int timeval, carval;
+
+	timeval = __raw_readl(rtc->rtc_reg + REG_RTC_TAR);
+	carval	= __raw_readl(rtc->rtc_reg + REG_RTC_CAR);
+
+	nuc900_rtc_bcd2bin(timeval, carval, &alrm->time);
+
+	return 0;
+}
+
+static int nuc900_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+{
+	struct nuc900_rtc *rtc = dev_get_drvdata(dev);
+	struct nuc900_bcd_time tm;
+	unsigned long val;
+	int *err;
+
+	nuc900_rtc_bin2bcd(&alrm->time, &tm);
+
+	err = check_rtc_access_enable(rtc);
+	if (IS_ERR(err))
+		return PTR_ERR(err);
+
+	val = tm.bcd_mday | tm.bcd_mon | tm.bcd_year;
+	__raw_writel(val, rtc->rtc_reg + REG_RTC_CAR);
+
+	val = tm.bcd_sec | tm.bcd_min | tm.bcd_hour;
+	__raw_writel(val, rtc->rtc_reg + REG_RTC_TAR);
+
+	return 0;
+}
+
+static struct rtc_class_ops nuc900_rtc_ops = {
+	.read_time = nuc900_rtc_read_time,
+	.set_time = nuc900_rtc_set_time,
+	.read_alarm = nuc900_rtc_read_alarm,
+	.set_alarm = nuc900_rtc_set_alarm,
+	.alarm_irq_enable = nuc900_alarm_irq_enable,
+	.update_irq_enable = nuc900_update_irq_enable,
+};
+
+static int __devinit nuc900_rtc_probe(struct platform_device *pdev)
+{
+	struct resource *res;
+	struct nuc900_rtc *nuc900_rtc;
+	int err = 0;
+
+	nuc900_rtc = kzalloc(sizeof(struct nuc900_rtc), GFP_KERNEL);
+	if (!nuc900_rtc) {
+		dev_err(&pdev->dev, "kzalloc nuc900_rtc failed\n");
+		return -ENOMEM;
+	}
+	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	if (!res) {
+		dev_err(&pdev->dev, "platform_get_resource failed\n");
+		err = -ENXIO;
+		goto fail1;
+	}
+
+	if (!request_mem_region(res->start, resource_size(res),
+				pdev->name)) {
+		dev_err(&pdev->dev, "request_mem_region failed\n");
+		err = -EBUSY;
+		goto fail1;
+	}
+
+	nuc900_rtc->rtc_reg = ioremap(res->start, resource_size(res));
+	if (!nuc900_rtc->rtc_reg) {
+		dev_err(&pdev->dev, "ioremap rtc_reg failed\n");
+		err = -ENOMEM;
+		goto fail2;
+	}
+
+	nuc900_rtc->irq_num = platform_get_irq(pdev, 0);
+	if (request_irq(nuc900_rtc->irq_num, nuc900_rtc_interrupt,
+				IRQF_DISABLED, "nuc900rtc", nuc900_rtc)) {
+		dev_err(&pdev->dev, "NUC900 RTC request irq failed\n");
+		err = -EBUSY;
+		goto fail3;
+	}
+
+	nuc900_rtc->rtcdev = rtc_device_register(pdev->name, &pdev->dev,
+						&nuc900_rtc_ops, THIS_MODULE);
+	if (IS_ERR(nuc900_rtc->rtcdev)) {
+		dev_err(&pdev->dev, "rtc device register faild\n");
+		err = PTR_ERR(nuc900_rtc->rtcdev);
+		goto fail4;
+	}
+
+	platform_set_drvdata(pdev, nuc900_rtc);
+	__raw_writel(__raw_readl(nuc900_rtc->rtc_reg + REG_RTC_TSSR) | MODE24,
+					nuc900_rtc->rtc_reg + REG_RTC_TSSR);
+
+	return 0;
+
+fail4:	free_irq(nuc900_rtc->irq_num, nuc900_rtc);
+fail3:	iounmap(nuc900_rtc->rtc_reg);
+fail2:	release_mem_region(res->start, resource_size(res));
+fail1:	kfree(nuc900_rtc);
+	return err;
+}
+
+static int __devexit nuc900_rtc_remove(struct platform_device *pdev)
+{
+	struct nuc900_rtc *nuc900_rtc = platform_get_drvdata(pdev);
+	struct resource *res;
+
+	rtc_device_unregister(nuc900_rtc->rtcdev);
+	free_irq(nuc900_rtc->irq_num, nuc900_rtc);
+	iounmap(nuc900_rtc->rtc_reg);
+
+	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	release_mem_region(res->start, resource_size(res));
+
+	kfree(nuc900_rtc);
+
+	platform_set_drvdata(pdev, NULL);
+
+	return 0;
+}
+
+static struct platform_driver nuc900_rtc_driver = {
+	.remove		= __devexit_p(nuc900_rtc_remove),
+	.driver		= {
+		.name	= "nuc900-rtc",
+		.owner	= THIS_MODULE,
+	},
+};
+
+static int __init nuc900_rtc_init(void)
+{
+	return platform_driver_probe(&nuc900_rtc_driver, nuc900_rtc_probe);
+}
+
+static void __exit nuc900_rtc_exit(void)
+{
+	platform_driver_unregister(&nuc900_rtc_driver);
+}
+
+module_init(nuc900_rtc_init);
+module_exit(nuc900_rtc_exit);
+
+MODULE_AUTHOR("Wan ZongShun <mcuos.com@gmail.com>");
+MODULE_DESCRIPTION("nuc910/nuc920 RTC driver");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:nuc900-rtc");
diff --git a/drivers/rtc/rtc-omap.c b/drivers/rtc/rtc-omap.c
index 0587d53987fe..64d9727b7229 100644
--- a/drivers/rtc/rtc-omap.c
+++ b/drivers/rtc/rtc-omap.c
@@ -87,9 +87,10 @@
 #define OMAP_RTC_INTERRUPTS_IT_ALARM    (1<<3)
 #define OMAP_RTC_INTERRUPTS_IT_TIMER    (1<<2)
 
+static void __iomem	*rtc_base;
 
-#define rtc_read(addr)		omap_readb(OMAP_RTC_BASE + (addr))
-#define rtc_write(val, addr)	omap_writeb(val, OMAP_RTC_BASE + (addr))
+#define rtc_read(addr)		__raw_readb(rtc_base + (addr))
+#define rtc_write(val, addr)	__raw_writeb(val, rtc_base + (addr))
 
 
 /* we rely on the rtc framework to handle locking (rtc->ops_lock),
@@ -330,32 +331,31 @@ static int __init omap_rtc_probe(struct platform_device *pdev)
 		return -ENOENT;
 	}
 
-	/* NOTE:  using static mapping for RTC registers */
 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-	if (res && res->start != OMAP_RTC_BASE) {
-		pr_debug("%s: RTC registers at %08x, expected %08x\n",
-			pdev->name, (unsigned) res->start, OMAP_RTC_BASE);
+	if (!res) {
+		pr_debug("%s: RTC resource data missing\n", pdev->name);
 		return -ENOENT;
 	}
 
-	if (res)
-		mem = request_mem_region(res->start,
-				res->end - res->start + 1,
-				pdev->name);
-	else
-		mem = NULL;
+	mem = request_mem_region(res->start, resource_size(res), pdev->name);
 	if (!mem) {
 		pr_debug("%s: RTC registers at %08x are not free\n",
-			pdev->name, OMAP_RTC_BASE);
+			pdev->name, res->start);
 		return -EBUSY;
 	}
 
+	rtc_base = ioremap(res->start, resource_size(res));
+	if (!rtc_base) {
+		pr_debug("%s: RTC registers can't be mapped\n", pdev->name);
+		goto fail;
+	}
+
 	rtc = rtc_device_register(pdev->name, &pdev->dev,
 			&omap_rtc_ops, THIS_MODULE);
 	if (IS_ERR(rtc)) {
 		pr_debug("%s: can't register RTC device, err %ld\n",
 			pdev->name, PTR_ERR(rtc));
-		goto fail;
+		goto fail0;
 	}
 	platform_set_drvdata(pdev, rtc);
 	dev_set_drvdata(&rtc->dev, mem);
@@ -380,13 +380,14 @@ static int __init omap_rtc_probe(struct platform_device *pdev)
 			dev_name(&rtc->dev), rtc)) {
 		pr_debug("%s: RTC timer interrupt IRQ%d already claimed\n",
 			pdev->name, omap_rtc_timer);
-		goto fail0;
+		goto fail1;
 	}
-	if (request_irq(omap_rtc_alarm, rtc_irq, IRQF_DISABLED,
-			dev_name(&rtc->dev), rtc)) {
+	if ((omap_rtc_timer != omap_rtc_alarm) &&
+		(request_irq(omap_rtc_alarm, rtc_irq, IRQF_DISABLED,
+			dev_name(&rtc->dev), rtc))) {
 		pr_debug("%s: RTC alarm interrupt IRQ%d already claimed\n",
 			pdev->name, omap_rtc_alarm);
-		goto fail1;
+		goto fail2;
 	}
 
 	/* On boards with split power, RTC_ON_NOFF won't reset the RTC */
@@ -419,10 +420,12 @@ static int __init omap_rtc_probe(struct platform_device *pdev)
 
 	return 0;
 
-fail1:
+fail2:
 	free_irq(omap_rtc_timer, NULL);
-fail0:
+fail1:
 	rtc_device_unregister(rtc);
+fail0:
+	iounmap(rtc_base);
 fail:
 	release_resource(mem);
 	return -EIO;
@@ -438,7 +441,9 @@ static int __exit omap_rtc_remove(struct platform_device *pdev)
 	rtc_write(0, OMAP_RTC_INTERRUPTS_REG);
 
 	free_irq(omap_rtc_timer, rtc);
-	free_irq(omap_rtc_alarm, rtc);
+
+	if (omap_rtc_timer != omap_rtc_alarm)
+		free_irq(omap_rtc_alarm, rtc);
 
 	release_resource(dev_get_drvdata(&rtc->dev));
 	rtc_device_unregister(rtc);
diff --git a/drivers/rtc/rtc-pcf50633.c b/drivers/rtc/rtc-pcf50633.c
index 4c5d5d0c4cfc..854c3cb365a1 100644
--- a/drivers/rtc/rtc-pcf50633.c
+++ b/drivers/rtc/rtc-pcf50633.c
@@ -58,6 +58,7 @@ struct pcf50633_time {
 struct pcf50633_rtc {
 	int alarm_enabled;
 	int second_enabled;
+	int alarm_pending;
 
 	struct pcf50633 *pcf;
 	struct rtc_device *rtc_dev;
@@ -209,6 +210,7 @@ static int pcf50633_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm)
 	rtc = dev_get_drvdata(dev);
 
 	alrm->enabled = rtc->alarm_enabled;
+	alrm->pending = rtc->alarm_pending;
 
 	ret = pcf50633_read_block(rtc->pcf, PCF50633_REG_RTCSCA,
 				PCF50633_TI_EXTENT, &pcf_tm.time[0]);
@@ -244,6 +246,8 @@ static int pcf50633_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
 	/* Returns 0 on success */
 	ret = pcf50633_write_block(rtc->pcf, PCF50633_REG_RTCSCA,
 				PCF50633_TI_EXTENT, &pcf_tm.time[0]);
+	if (!alrm->enabled)
+		rtc->alarm_pending = 0;
 
 	if (!alarm_masked || alrm->enabled)
 		pcf50633_irq_unmask(rtc->pcf, PCF50633_IRQ_ALARM);
@@ -268,6 +272,7 @@ static void pcf50633_rtc_irq(int irq, void *data)
 	switch (irq) {
 	case PCF50633_IRQ_ALARM:
 		rtc_update_irq(rtc->rtc_dev, 1, RTC_AF | RTC_IRQF);
+		rtc->alarm_pending = 1;
 		break;
 	case PCF50633_IRQ_SECOND:
 		rtc_update_irq(rtc->rtc_dev, 1, RTC_UF | RTC_IRQF);
@@ -277,16 +282,13 @@ static void pcf50633_rtc_irq(int irq, void *data)
 
 static int __devinit pcf50633_rtc_probe(struct platform_device *pdev)
 {
-	struct pcf50633_subdev_pdata *pdata;
 	struct pcf50633_rtc *rtc;
 
-
 	rtc = kzalloc(sizeof(*rtc), GFP_KERNEL);
 	if (!rtc)
 		return -ENOMEM;
 
-	pdata = pdev->dev.platform_data;
-	rtc->pcf = pdata->pcf;
+	rtc->pcf = dev_to_pcf50633(pdev->dev.parent);
 	platform_set_drvdata(pdev, rtc);
 	rtc->rtc_dev = rtc_device_register("pcf50633-rtc", &pdev->dev,
 				&pcf50633_rtc_ops, THIS_MODULE);
diff --git a/drivers/rtc/rtc-pcf8563.c b/drivers/rtc/rtc-pcf8563.c
index b725913ccbe8..65f346b2fbae 100644
--- a/drivers/rtc/rtc-pcf8563.c
+++ b/drivers/rtc/rtc-pcf8563.c
@@ -212,6 +212,8 @@ static int pcf8563_probe(struct i2c_client *client,
 
 	dev_info(&client->dev, "chip found, driver version " DRV_VERSION "\n");
 
+	i2c_set_clientdata(client, pcf8563);
+
 	pcf8563->rtc = rtc_device_register(pcf8563_driver.driver.name,
 				&client->dev, &pcf8563_rtc_ops, THIS_MODULE);
 
@@ -220,8 +222,6 @@ static int pcf8563_probe(struct i2c_client *client,
 		goto exit_kfree;
 	}
 
-	i2c_set_clientdata(client, pcf8563);
-
 	return 0;
 
 exit_kfree:
diff --git a/drivers/rtc/rtc-pcf8583.c b/drivers/rtc/rtc-pcf8583.c
index 7d33cda3f8f6..2d201afead3b 100644
--- a/drivers/rtc/rtc-pcf8583.c
+++ b/drivers/rtc/rtc-pcf8583.c
@@ -277,6 +277,8 @@ static int pcf8583_probe(struct i2c_client *client,
 	if (!pcf8583)
 		return -ENOMEM;
 
+	i2c_set_clientdata(client, pcf8583);
+
 	pcf8583->rtc = rtc_device_register(pcf8583_driver.driver.name,
 			&client->dev, &pcf8583_rtc_ops, THIS_MODULE);
 
@@ -285,7 +287,6 @@ static int pcf8583_probe(struct i2c_client *client,
 		goto exit_kfree;
 	}
 
-	i2c_set_clientdata(client, pcf8583);
 	return 0;
 
 exit_kfree:
diff --git a/drivers/rtc/rtc-pl031.c b/drivers/rtc/rtc-pl031.c
index f41873f98f66..0264b117893b 100644
--- a/drivers/rtc/rtc-pl031.c
+++ b/drivers/rtc/rtc-pl031.c
@@ -51,10 +51,10 @@ static int pl031_ioctl(struct device *dev, unsigned int cmd, unsigned long arg)
 
 	switch (cmd) {
 	case RTC_AIE_OFF:
-		__raw_writel(1, ldata->base + RTC_MIS);
+		writel(1, ldata->base + RTC_MIS);
 		return 0;
 	case RTC_AIE_ON:
-		__raw_writel(0, ldata->base + RTC_MIS);
+		writel(0, ldata->base + RTC_MIS);
 		return 0;
 	}
 
@@ -65,7 +65,7 @@ static int pl031_read_time(struct device *dev, struct rtc_time *tm)
 {
 	struct pl031_local *ldata = dev_get_drvdata(dev);
 
-	rtc_time_to_tm(__raw_readl(ldata->base + RTC_DR), tm);
+	rtc_time_to_tm(readl(ldata->base + RTC_DR), tm);
 
 	return 0;
 }
@@ -76,7 +76,7 @@ static int pl031_set_time(struct device *dev, struct rtc_time *tm)
 	struct pl031_local *ldata = dev_get_drvdata(dev);
 
 	rtc_tm_to_time(tm, &time);
-	__raw_writel(time, ldata->base + RTC_LR);
+	writel(time, ldata->base + RTC_LR);
 
 	return 0;
 }
@@ -85,9 +85,9 @@ static int pl031_read_alarm(struct device *dev, struct rtc_wkalrm *alarm)
 {
 	struct pl031_local *ldata = dev_get_drvdata(dev);
 
-	rtc_time_to_tm(__raw_readl(ldata->base + RTC_MR), &alarm->time);
-	alarm->pending = __raw_readl(ldata->base + RTC_RIS);
-	alarm->enabled = __raw_readl(ldata->base + RTC_IMSC);
+	rtc_time_to_tm(readl(ldata->base + RTC_MR), &alarm->time);
+	alarm->pending = readl(ldata->base + RTC_RIS);
+	alarm->enabled = readl(ldata->base + RTC_IMSC);
 
 	return 0;
 }
@@ -99,8 +99,8 @@ static int pl031_set_alarm(struct device *dev, struct rtc_wkalrm *alarm)
 
 	rtc_tm_to_time(&alarm->time, &time);
 
-	__raw_writel(time, ldata->base + RTC_MR);
-	__raw_writel(!alarm->enabled, ldata->base + RTC_MIS);
+	writel(time, ldata->base + RTC_MR);
+	writel(!alarm->enabled, ldata->base + RTC_MIS);
 
 	return 0;
 }
@@ -180,8 +180,9 @@ err_req:
 
 static struct amba_id pl031_ids[] __initdata = {
 	{
-		 .id = 0x00041031,
-	 	.mask = 0x000fffff, },
+		.id = 0x00041031,
+		.mask = 0x000fffff,
+	},
 	{0, 0},
 };
 
diff --git a/drivers/rtc/rtc-pxa.c b/drivers/rtc/rtc-pxa.c
index 747ca194fad4..e6351b743da6 100644
--- a/drivers/rtc/rtc-pxa.c
+++ b/drivers/rtc/rtc-pxa.c
@@ -456,7 +456,7 @@ static int pxa_rtc_resume(struct device *dev)
 	return 0;
 }
 
-static struct dev_pm_ops pxa_rtc_pm_ops = {
+static const struct dev_pm_ops pxa_rtc_pm_ops = {
 	.suspend	= pxa_rtc_suspend,
 	.resume		= pxa_rtc_resume,
 };
diff --git a/drivers/rtc/rtc-sa1100.c b/drivers/rtc/rtc-sa1100.c
index 29f98a70586e..e4a44b641702 100644
--- a/drivers/rtc/rtc-sa1100.c
+++ b/drivers/rtc/rtc-sa1100.c
@@ -407,7 +407,7 @@ static int sa1100_rtc_resume(struct device *dev)
 	return 0;
 }
 
-static struct dev_pm_ops sa1100_rtc_pm_ops = {
+static const struct dev_pm_ops sa1100_rtc_pm_ops = {
 	.suspend	= sa1100_rtc_suspend,
 	.resume		= sa1100_rtc_resume,
 };
diff --git a/drivers/rtc/rtc-sh.c b/drivers/rtc/rtc-sh.c
index e6ed5404bca0..e95cc6f8d61e 100644
--- a/drivers/rtc/rtc-sh.c
+++ b/drivers/rtc/rtc-sh.c
@@ -826,7 +826,7 @@ static int sh_rtc_resume(struct device *dev)
 	return 0;
 }
 
-static struct dev_pm_ops sh_rtc_dev_pm_ops = {
+static const struct dev_pm_ops sh_rtc_dev_pm_ops = {
 	.suspend = sh_rtc_suspend,
 	.resume = sh_rtc_resume,
 };
diff --git a/drivers/rtc/rtc-stk17ta8.c b/drivers/rtc/rtc-stk17ta8.c
index 7d1547b0070e..67700831b5c9 100644
--- a/drivers/rtc/rtc-stk17ta8.c
+++ b/drivers/rtc/rtc-stk17ta8.c
@@ -62,7 +62,6 @@
 struct rtc_plat_data {
 	struct rtc_device *rtc;
 	void __iomem *ioaddr;
-	unsigned long baseaddr;
 	unsigned long last_jiffies;
 	int irq;
 	unsigned int irqen;
@@ -70,6 +69,7 @@ struct rtc_plat_data {
 	int alrm_min;
 	int alrm_hour;
 	int alrm_mday;
+	spinlock_t lock;
 };
 
 static int stk17ta8_rtc_set_time(struct device *dev, struct rtc_time *tm)
@@ -142,7 +142,7 @@ static void stk17ta8_rtc_update_alarm(struct rtc_plat_data *pdata)
 	unsigned long irqflags;
 	u8 flags;
 
-	spin_lock_irqsave(&pdata->rtc->irq_lock, irqflags);
+	spin_lock_irqsave(&pdata->lock, irqflags);
 
 	flags = readb(ioaddr + RTC_FLAGS);
 	writeb(flags | RTC_WRITE, ioaddr + RTC_FLAGS);
@@ -162,7 +162,7 @@ static void stk17ta8_rtc_update_alarm(struct rtc_plat_data *pdata)
 	writeb(pdata->irqen ? RTC_INTS_AIE : 0, ioaddr + RTC_INTERRUPTS);
 	readb(ioaddr + RTC_FLAGS);	/* clear interrupts */
 	writeb(flags & ~RTC_WRITE, ioaddr + RTC_FLAGS);
-	spin_unlock_irqrestore(&pdata->rtc->irq_lock, irqflags);
+	spin_unlock_irqrestore(&pdata->lock, irqflags);
 }
 
 static int stk17ta8_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
@@ -202,56 +202,53 @@ static irqreturn_t stk17ta8_rtc_interrupt(int irq, void *dev_id)
 	struct platform_device *pdev = dev_id;
 	struct rtc_plat_data *pdata = platform_get_drvdata(pdev);
 	void __iomem *ioaddr = pdata->ioaddr;
-	unsigned long events = RTC_IRQF;
+	unsigned long events = 0;
 
+	spin_lock(&pdata->lock);
 	/* read and clear interrupt */
-	if (!(readb(ioaddr + RTC_FLAGS) & RTC_FLAGS_AF))
-		return IRQ_NONE;
-	if (readb(ioaddr + RTC_SECONDS_ALARM) & 0x80)
-		events |= RTC_UF;
-	else
-		events |= RTC_AF;
-	rtc_update_irq(pdata->rtc, 1, events);
-	return IRQ_HANDLED;
+	if (readb(ioaddr + RTC_FLAGS) & RTC_FLAGS_AF) {
+		events = RTC_IRQF;
+		if (readb(ioaddr + RTC_SECONDS_ALARM) & 0x80)
+			events |= RTC_UF;
+		else
+			events |= RTC_AF;
+		if (likely(pdata->rtc))
+			rtc_update_irq(pdata->rtc, 1, events);
+	}
+	spin_unlock(&pdata->lock);
+	return events ? IRQ_HANDLED : IRQ_NONE;
 }
 
-static int stk17ta8_rtc_ioctl(struct device *dev, unsigned int cmd,
-			    unsigned long arg)
+static int stk17ta8_rtc_alarm_irq_enable(struct device *dev,
+	unsigned int enabled)
 {
 	struct platform_device *pdev = to_platform_device(dev);
 	struct rtc_plat_data *pdata = platform_get_drvdata(pdev);
 
 	if (pdata->irq <= 0)
-		return -ENOIOCTLCMD; /* fall back into rtc-dev's emulation */
-	switch (cmd) {
-	case RTC_AIE_OFF:
-		pdata->irqen &= ~RTC_AF;
-		stk17ta8_rtc_update_alarm(pdata);
-		break;
-	case RTC_AIE_ON:
+		return -EINVAL;
+	if (enabled)
 		pdata->irqen |= RTC_AF;
-		stk17ta8_rtc_update_alarm(pdata);
-		break;
-	default:
-		return -ENOIOCTLCMD;
-	}
+	else
+		pdata->irqen &= ~RTC_AF;
+	stk17ta8_rtc_update_alarm(pdata);
 	return 0;
 }
 
 static const struct rtc_class_ops stk17ta8_rtc_ops = {
-	.read_time	= stk17ta8_rtc_read_time,
-	.set_time	= stk17ta8_rtc_set_time,
-	.read_alarm	= stk17ta8_rtc_read_alarm,
-	.set_alarm	= stk17ta8_rtc_set_alarm,
-	.ioctl		= stk17ta8_rtc_ioctl,
+	.read_time		= stk17ta8_rtc_read_time,
+	.set_time		= stk17ta8_rtc_set_time,
+	.read_alarm		= stk17ta8_rtc_read_alarm,
+	.set_alarm		= stk17ta8_rtc_set_alarm,
+	.alarm_irq_enable	= stk17ta8_rtc_alarm_irq_enable,
 };
 
 static ssize_t stk17ta8_nvram_read(struct kobject *kobj,
 				 struct bin_attribute *attr, char *buf,
 				 loff_t pos, size_t size)
 {
-	struct platform_device *pdev =
-		to_platform_device(container_of(kobj, struct device, kobj));
+	struct device *dev = container_of(kobj, struct device, kobj);
+	struct platform_device *pdev = to_platform_device(dev);
 	struct rtc_plat_data *pdata = platform_get_drvdata(pdev);
 	void __iomem *ioaddr = pdata->ioaddr;
 	ssize_t count;
@@ -265,8 +262,8 @@ static ssize_t stk17ta8_nvram_write(struct kobject *kobj,
 				  struct bin_attribute *attr, char *buf,
 				  loff_t pos, size_t size)
 {
-	struct platform_device *pdev =
-		to_platform_device(container_of(kobj, struct device, kobj));
+	struct device *dev = container_of(kobj, struct device, kobj);
+	struct platform_device *pdev = to_platform_device(dev);
 	struct rtc_plat_data *pdata = platform_get_drvdata(pdev);
 	void __iomem *ioaddr = pdata->ioaddr;
 	ssize_t count;
@@ -286,33 +283,28 @@ static struct bin_attribute stk17ta8_nvram_attr = {
 	.write = stk17ta8_nvram_write,
 };
 
-static int __init stk17ta8_rtc_probe(struct platform_device *pdev)
+static int __devinit stk17ta8_rtc_probe(struct platform_device *pdev)
 {
-	struct rtc_device *rtc;
 	struct resource *res;
 	unsigned int cal;
 	unsigned int flags;
 	struct rtc_plat_data *pdata;
-	void __iomem *ioaddr = NULL;
+	void __iomem *ioaddr;
 	int ret = 0;
 
 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 	if (!res)
 		return -ENODEV;
 
-	pdata = kzalloc(sizeof(*pdata), GFP_KERNEL);
+	pdata = devm_kzalloc(&pdev->dev, sizeof(*pdata), GFP_KERNEL);
 	if (!pdata)
 		return -ENOMEM;
-	if (!request_mem_region(res->start, RTC_REG_SIZE, pdev->name)) {
-		ret = -EBUSY;
-		goto out;
-	}
-	pdata->baseaddr = res->start;
-	ioaddr = ioremap(pdata->baseaddr, RTC_REG_SIZE);
-	if (!ioaddr) {
-		ret = -ENOMEM;
-		goto out;
-	}
+	if (!devm_request_mem_region(&pdev->dev, res->start, RTC_REG_SIZE,
+			pdev->name))
+		return -EBUSY;
+	ioaddr = devm_ioremap(&pdev->dev, res->start, RTC_REG_SIZE);
+	if (!ioaddr)
+		return -ENOMEM;
 	pdata->ioaddr = ioaddr;
 	pdata->irq = platform_get_irq(pdev, 0);
 
@@ -328,9 +320,13 @@ static int __init stk17ta8_rtc_probe(struct platform_device *pdev)
 	if (readb(ioaddr + RTC_FLAGS) & RTC_FLAGS_PF)
 		dev_warn(&pdev->dev, "voltage-low detected.\n");
 
+	spin_lock_init(&pdata->lock);
+	pdata->last_jiffies = jiffies;
+	platform_set_drvdata(pdev, pdata);
 	if (pdata->irq > 0) {
 		writeb(0, ioaddr + RTC_INTERRUPTS);
-		if (request_irq(pdata->irq, stk17ta8_rtc_interrupt,
+		if (devm_request_irq(&pdev->dev, pdata->irq,
+				stk17ta8_rtc_interrupt,
 				IRQF_DISABLED | IRQF_SHARED,
 				pdev->name, pdev) < 0) {
 			dev_warn(&pdev->dev, "interrupt not available.\n");
@@ -338,29 +334,14 @@ static int __init stk17ta8_rtc_probe(struct platform_device *pdev)
 		}
 	}
 
-	rtc = rtc_device_register(pdev->name, &pdev->dev,
+	pdata->rtc = rtc_device_register(pdev->name, &pdev->dev,
 				  &stk17ta8_rtc_ops, THIS_MODULE);
-	if (IS_ERR(rtc)) {
-		ret = PTR_ERR(rtc);
-		goto out;
-	}
-	pdata->rtc = rtc;
-	pdata->last_jiffies = jiffies;
-	platform_set_drvdata(pdev, pdata);
+	if (IS_ERR(pdata->rtc))
+		return PTR_ERR(pdata->rtc);
+
 	ret = sysfs_create_bin_file(&pdev->dev.kobj, &stk17ta8_nvram_attr);
 	if (ret)
-		goto out;
-	return 0;
- out:
-	if (pdata->rtc)
 		rtc_device_unregister(pdata->rtc);
-	if (pdata->irq > 0)
-		free_irq(pdata->irq, pdev);
-	if (ioaddr)
-		iounmap(ioaddr);
-	if (pdata->baseaddr)
-		release_mem_region(pdata->baseaddr, RTC_REG_SIZE);
-	kfree(pdata);
 	return ret;
 }
 
@@ -370,13 +351,8 @@ static int __devexit stk17ta8_rtc_remove(struct platform_device *pdev)
 
 	sysfs_remove_bin_file(&pdev->dev.kobj, &stk17ta8_nvram_attr);
 	rtc_device_unregister(pdata->rtc);
-	if (pdata->irq > 0) {
+	if (pdata->irq > 0)
 		writeb(0, pdata->ioaddr + RTC_INTERRUPTS);
-		free_irq(pdata->irq, pdev);
-	}
-	iounmap(pdata->ioaddr);
-	release_mem_region(pdata->baseaddr, RTC_REG_SIZE);
-	kfree(pdata);
 	return 0;
 }
 
diff --git a/drivers/rtc/rtc-twl4030.c b/drivers/rtc/rtc-twl.c
index 9c8c70c497dc..c6a83a2a722c 100644
--- a/drivers/rtc/rtc-twl4030.c
+++ b/drivers/rtc/rtc-twl.c
@@ -1,5 +1,5 @@
 /*
- * rtc-twl4030.c -- TWL4030 Real Time Clock interface
+ * rtc-twl.c -- TWL Real Time Clock interface
  *
  * Copyright (C) 2007 MontaVista Software, Inc
  * Author: Alexandre Rusev <source@mvista.com>
@@ -28,33 +28,81 @@
 #include <linux/platform_device.h>
 #include <linux/interrupt.h>
 
-#include <linux/i2c/twl4030.h>
+#include <linux/i2c/twl.h>
 
 
 /*
  * RTC block register offsets (use TWL_MODULE_RTC)
  */
-#define REG_SECONDS_REG                          0x00
-#define REG_MINUTES_REG                          0x01
-#define REG_HOURS_REG                            0x02
-#define REG_DAYS_REG                             0x03
-#define REG_MONTHS_REG                           0x04
-#define REG_YEARS_REG                            0x05
-#define REG_WEEKS_REG                            0x06
-
-#define REG_ALARM_SECONDS_REG                    0x07
-#define REG_ALARM_MINUTES_REG                    0x08
-#define REG_ALARM_HOURS_REG                      0x09
-#define REG_ALARM_DAYS_REG                       0x0A
-#define REG_ALARM_MONTHS_REG                     0x0B
-#define REG_ALARM_YEARS_REG                      0x0C
-
-#define REG_RTC_CTRL_REG                         0x0D
-#define REG_RTC_STATUS_REG                       0x0E
-#define REG_RTC_INTERRUPTS_REG                   0x0F
-
-#define REG_RTC_COMP_LSB_REG                     0x10
-#define REG_RTC_COMP_MSB_REG                     0x11
+enum {
+	REG_SECONDS_REG = 0,
+	REG_MINUTES_REG,
+	REG_HOURS_REG,
+	REG_DAYS_REG,
+	REG_MONTHS_REG,
+	REG_YEARS_REG,
+	REG_WEEKS_REG,
+
+	REG_ALARM_SECONDS_REG,
+	REG_ALARM_MINUTES_REG,
+	REG_ALARM_HOURS_REG,
+	REG_ALARM_DAYS_REG,
+	REG_ALARM_MONTHS_REG,
+	REG_ALARM_YEARS_REG,
+
+	REG_RTC_CTRL_REG,
+	REG_RTC_STATUS_REG,
+	REG_RTC_INTERRUPTS_REG,
+
+	REG_RTC_COMP_LSB_REG,
+	REG_RTC_COMP_MSB_REG,
+};
+const static u8 twl4030_rtc_reg_map[] = {
+	[REG_SECONDS_REG] = 0x00,
+	[REG_MINUTES_REG] = 0x01,
+	[REG_HOURS_REG] = 0x02,
+	[REG_DAYS_REG] = 0x03,
+	[REG_MONTHS_REG] = 0x04,
+	[REG_YEARS_REG] = 0x05,
+	[REG_WEEKS_REG] = 0x06,
+
+	[REG_ALARM_SECONDS_REG] = 0x07,
+	[REG_ALARM_MINUTES_REG] = 0x08,
+	[REG_ALARM_HOURS_REG] = 0x09,
+	[REG_ALARM_DAYS_REG] = 0x0A,
+	[REG_ALARM_MONTHS_REG] = 0x0B,
+	[REG_ALARM_YEARS_REG] = 0x0C,
+
+	[REG_RTC_CTRL_REG] = 0x0D,
+	[REG_RTC_STATUS_REG] = 0x0E,
+	[REG_RTC_INTERRUPTS_REG] = 0x0F,
+
+	[REG_RTC_COMP_LSB_REG] = 0x10,
+	[REG_RTC_COMP_MSB_REG] = 0x11,
+};
+const static u8 twl6030_rtc_reg_map[] = {
+	[REG_SECONDS_REG] = 0x00,
+	[REG_MINUTES_REG] = 0x01,
+	[REG_HOURS_REG] = 0x02,
+	[REG_DAYS_REG] = 0x03,
+	[REG_MONTHS_REG] = 0x04,
+	[REG_YEARS_REG] = 0x05,
+	[REG_WEEKS_REG] = 0x06,
+
+	[REG_ALARM_SECONDS_REG] = 0x08,
+	[REG_ALARM_MINUTES_REG] = 0x09,
+	[REG_ALARM_HOURS_REG] = 0x0A,
+	[REG_ALARM_DAYS_REG] = 0x0B,
+	[REG_ALARM_MONTHS_REG] = 0x0C,
+	[REG_ALARM_YEARS_REG] = 0x0D,
+
+	[REG_RTC_CTRL_REG] = 0x10,
+	[REG_RTC_STATUS_REG] = 0x11,
+	[REG_RTC_INTERRUPTS_REG] = 0x12,
+
+	[REG_RTC_COMP_LSB_REG] = 0x13,
+	[REG_RTC_COMP_MSB_REG] = 0x14,
+};
 
 /* RTC_CTRL_REG bitfields */
 #define BIT_RTC_CTRL_REG_STOP_RTC_M              0x01
@@ -84,31 +132,32 @@
 #define ALL_TIME_REGS		6
 
 /*----------------------------------------------------------------------*/
+static u8  *rtc_reg_map;
 
 /*
- * Supports 1 byte read from TWL4030 RTC register.
+ * Supports 1 byte read from TWL RTC register.
  */
-static int twl4030_rtc_read_u8(u8 *data, u8 reg)
+static int twl_rtc_read_u8(u8 *data, u8 reg)
 {
 	int ret;
 
-	ret = twl4030_i2c_read_u8(TWL4030_MODULE_RTC, data, reg);
+	ret = twl_i2c_read_u8(TWL_MODULE_RTC, data, (rtc_reg_map[reg]));
 	if (ret < 0)
-		pr_err("twl4030_rtc: Could not read TWL4030"
+		pr_err("twl_rtc: Could not read TWL"
 		       "register %X - error %d\n", reg, ret);
 	return ret;
 }
 
 /*
- * Supports 1 byte write to TWL4030 RTC registers.
+ * Supports 1 byte write to TWL RTC registers.
  */
-static int twl4030_rtc_write_u8(u8 data, u8 reg)
+static int twl_rtc_write_u8(u8 data, u8 reg)
 {
 	int ret;
 
-	ret = twl4030_i2c_write_u8(TWL4030_MODULE_RTC, data, reg);
+	ret = twl_i2c_write_u8(TWL_MODULE_RTC, data, (rtc_reg_map[reg]));
 	if (ret < 0)
-		pr_err("twl4030_rtc: Could not write TWL4030"
+		pr_err("twl_rtc: Could not write TWL"
 		       "register %X - error %d\n", reg, ret);
 	return ret;
 }
@@ -129,7 +178,7 @@ static int set_rtc_irq_bit(unsigned char bit)
 
 	val = rtc_irq_bits | bit;
 	val &= ~BIT_RTC_INTERRUPTS_REG_EVERY_M;
-	ret = twl4030_rtc_write_u8(val, REG_RTC_INTERRUPTS_REG);
+	ret = twl_rtc_write_u8(val, REG_RTC_INTERRUPTS_REG);
 	if (ret == 0)
 		rtc_irq_bits = val;
 
@@ -145,14 +194,14 @@ static int mask_rtc_irq_bit(unsigned char bit)
 	int ret;
 
 	val = rtc_irq_bits & ~bit;
-	ret = twl4030_rtc_write_u8(val, REG_RTC_INTERRUPTS_REG);
+	ret = twl_rtc_write_u8(val, REG_RTC_INTERRUPTS_REG);
 	if (ret == 0)
 		rtc_irq_bits = val;
 
 	return ret;
 }
 
-static int twl4030_rtc_alarm_irq_enable(struct device *dev, unsigned enabled)
+static int twl_rtc_alarm_irq_enable(struct device *dev, unsigned enabled)
 {
 	int ret;
 
@@ -164,7 +213,7 @@ static int twl4030_rtc_alarm_irq_enable(struct device *dev, unsigned enabled)
 	return ret;
 }
 
-static int twl4030_rtc_update_irq_enable(struct device *dev, unsigned enabled)
+static int twl_rtc_update_irq_enable(struct device *dev, unsigned enabled)
 {
 	int ret;
 
@@ -177,7 +226,7 @@ static int twl4030_rtc_update_irq_enable(struct device *dev, unsigned enabled)
 }
 
 /*
- * Gets current TWL4030 RTC time and date parameters.
+ * Gets current TWL RTC time and date parameters.
  *
  * The RTC's time/alarm representation is not what gmtime(3) requires
  * Linux to use:
@@ -185,24 +234,24 @@ static int twl4030_rtc_update_irq_enable(struct device *dev, unsigned enabled)
  *  - Months are 1..12 vs Linux 0-11
  *  - Years are 0..99 vs Linux 1900..N (we assume 21st century)
  */
-static int twl4030_rtc_read_time(struct device *dev, struct rtc_time *tm)
+static int twl_rtc_read_time(struct device *dev, struct rtc_time *tm)
 {
 	unsigned char rtc_data[ALL_TIME_REGS + 1];
 	int ret;
 	u8 save_control;
 
-	ret = twl4030_rtc_read_u8(&save_control, REG_RTC_CTRL_REG);
+	ret = twl_rtc_read_u8(&save_control, REG_RTC_CTRL_REG);
 	if (ret < 0)
 		return ret;
 
 	save_control |= BIT_RTC_CTRL_REG_GET_TIME_M;
 
-	ret = twl4030_rtc_write_u8(save_control, REG_RTC_CTRL_REG);
+	ret = twl_rtc_write_u8(save_control, REG_RTC_CTRL_REG);
 	if (ret < 0)
 		return ret;
 
-	ret = twl4030_i2c_read(TWL4030_MODULE_RTC, rtc_data,
-			       REG_SECONDS_REG, ALL_TIME_REGS);
+	ret = twl_i2c_read(TWL_MODULE_RTC, rtc_data,
+			(rtc_reg_map[REG_SECONDS_REG]), ALL_TIME_REGS);
 
 	if (ret < 0) {
 		dev_err(dev, "rtc_read_time error %d\n", ret);
@@ -219,7 +268,7 @@ static int twl4030_rtc_read_time(struct device *dev, struct rtc_time *tm)
 	return ret;
 }
 
-static int twl4030_rtc_set_time(struct device *dev, struct rtc_time *tm)
+static int twl_rtc_set_time(struct device *dev, struct rtc_time *tm)
 {
 	unsigned char save_control;
 	unsigned char rtc_data[ALL_TIME_REGS + 1];
@@ -233,18 +282,18 @@ static int twl4030_rtc_set_time(struct device *dev, struct rtc_time *tm)
 	rtc_data[6] = bin2bcd(tm->tm_year - 100);
 
 	/* Stop RTC while updating the TC registers */
-	ret = twl4030_rtc_read_u8(&save_control, REG_RTC_CTRL_REG);
+	ret = twl_rtc_read_u8(&save_control, REG_RTC_CTRL_REG);
 	if (ret < 0)
 		goto out;
 
 	save_control &= ~BIT_RTC_CTRL_REG_STOP_RTC_M;
-	twl4030_rtc_write_u8(save_control, REG_RTC_CTRL_REG);
+	twl_rtc_write_u8(save_control, REG_RTC_CTRL_REG);
 	if (ret < 0)
 		goto out;
 
 	/* update all the time registers in one shot */
-	ret = twl4030_i2c_write(TWL4030_MODULE_RTC, rtc_data,
-			REG_SECONDS_REG, ALL_TIME_REGS);
+	ret = twl_i2c_write(TWL_MODULE_RTC, rtc_data,
+		(rtc_reg_map[REG_SECONDS_REG]), ALL_TIME_REGS);
 	if (ret < 0) {
 		dev_err(dev, "rtc_set_time error %d\n", ret);
 		goto out;
@@ -252,22 +301,22 @@ static int twl4030_rtc_set_time(struct device *dev, struct rtc_time *tm)
 
 	/* Start back RTC */
 	save_control |= BIT_RTC_CTRL_REG_STOP_RTC_M;
-	ret = twl4030_rtc_write_u8(save_control, REG_RTC_CTRL_REG);
+	ret = twl_rtc_write_u8(save_control, REG_RTC_CTRL_REG);
 
 out:
 	return ret;
 }
 
 /*
- * Gets current TWL4030 RTC alarm time.
+ * Gets current TWL RTC alarm time.
  */
-static int twl4030_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alm)
+static int twl_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alm)
 {
 	unsigned char rtc_data[ALL_TIME_REGS + 1];
 	int ret;
 
-	ret = twl4030_i2c_read(TWL4030_MODULE_RTC, rtc_data,
-			       REG_ALARM_SECONDS_REG, ALL_TIME_REGS);
+	ret = twl_i2c_read(TWL_MODULE_RTC, rtc_data,
+			(rtc_reg_map[REG_ALARM_SECONDS_REG]), ALL_TIME_REGS);
 	if (ret < 0) {
 		dev_err(dev, "rtc_read_alarm error %d\n", ret);
 		return ret;
@@ -288,12 +337,12 @@ static int twl4030_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alm)
 	return ret;
 }
 
-static int twl4030_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alm)
+static int twl_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alm)
 {
 	unsigned char alarm_data[ALL_TIME_REGS + 1];
 	int ret;
 
-	ret = twl4030_rtc_alarm_irq_enable(dev, 0);
+	ret = twl_rtc_alarm_irq_enable(dev, 0);
 	if (ret)
 		goto out;
 
@@ -305,20 +354,20 @@ static int twl4030_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alm)
 	alarm_data[6] = bin2bcd(alm->time.tm_year - 100);
 
 	/* update all the alarm registers in one shot */
-	ret = twl4030_i2c_write(TWL4030_MODULE_RTC, alarm_data,
-			REG_ALARM_SECONDS_REG, ALL_TIME_REGS);
+	ret = twl_i2c_write(TWL_MODULE_RTC, alarm_data,
+		(rtc_reg_map[REG_ALARM_SECONDS_REG]), ALL_TIME_REGS);
 	if (ret) {
 		dev_err(dev, "rtc_set_alarm error %d\n", ret);
 		goto out;
 	}
 
 	if (alm->enabled)
-		ret = twl4030_rtc_alarm_irq_enable(dev, 1);
+		ret = twl_rtc_alarm_irq_enable(dev, 1);
 out:
 	return ret;
 }
 
-static irqreturn_t twl4030_rtc_interrupt(int irq, void *rtc)
+static irqreturn_t twl_rtc_interrupt(int irq, void *rtc)
 {
 	unsigned long events = 0;
 	int ret = IRQ_NONE;
@@ -333,7 +382,7 @@ static irqreturn_t twl4030_rtc_interrupt(int irq, void *rtc)
 	local_irq_enable();
 #endif
 
-	res = twl4030_rtc_read_u8(&rd_reg, REG_RTC_STATUS_REG);
+	res = twl_rtc_read_u8(&rd_reg, REG_RTC_STATUS_REG);
 	if (res)
 		goto out;
 	/*
@@ -347,26 +396,28 @@ static irqreturn_t twl4030_rtc_interrupt(int irq, void *rtc)
 	else
 		events |= RTC_IRQF | RTC_UF;
 
-	res = twl4030_rtc_write_u8(rd_reg | BIT_RTC_STATUS_REG_ALARM_M,
+	res = twl_rtc_write_u8(rd_reg | BIT_RTC_STATUS_REG_ALARM_M,
 				   REG_RTC_STATUS_REG);
 	if (res)
 		goto out;
 
-	/* Clear on Read enabled. RTC_IT bit of TWL4030_INT_PWR_ISR1
-	 * needs 2 reads to clear the interrupt. One read is done in
-	 * do_twl4030_pwrirq(). Doing the second read, to clear
-	 * the bit.
-	 *
-	 * FIXME the reason PWR_ISR1 needs an extra read is that
-	 * RTC_IF retriggered until we cleared REG_ALARM_M above.
-	 * But re-reading like this is a bad hack; by doing so we
-	 * risk wrongly clearing status for some other IRQ (losing
-	 * the interrupt).  Be smarter about handling RTC_UF ...
-	 */
-	res = twl4030_i2c_read_u8(TWL4030_MODULE_INT,
+	if (twl_class_is_4030()) {
+		/* Clear on Read enabled. RTC_IT bit of TWL4030_INT_PWR_ISR1
+		 * needs 2 reads to clear the interrupt. One read is done in
+		 * do_twl_pwrirq(). Doing the second read, to clear
+		 * the bit.
+		 *
+		 * FIXME the reason PWR_ISR1 needs an extra read is that
+		 * RTC_IF retriggered until we cleared REG_ALARM_M above.
+		 * But re-reading like this is a bad hack; by doing so we
+		 * risk wrongly clearing status for some other IRQ (losing
+		 * the interrupt).  Be smarter about handling RTC_UF ...
+		 */
+		res = twl_i2c_read_u8(TWL4030_MODULE_INT,
 			&rd_reg, TWL4030_INT_PWR_ISR1);
-	if (res)
-		goto out;
+		if (res)
+			goto out;
+	}
 
 	/* Notify RTC core on event */
 	rtc_update_irq(rtc, 1, events);
@@ -376,18 +427,18 @@ out:
 	return ret;
 }
 
-static struct rtc_class_ops twl4030_rtc_ops = {
-	.read_time	= twl4030_rtc_read_time,
-	.set_time	= twl4030_rtc_set_time,
-	.read_alarm	= twl4030_rtc_read_alarm,
-	.set_alarm	= twl4030_rtc_set_alarm,
-	.alarm_irq_enable = twl4030_rtc_alarm_irq_enable,
-	.update_irq_enable = twl4030_rtc_update_irq_enable,
+static struct rtc_class_ops twl_rtc_ops = {
+	.read_time	= twl_rtc_read_time,
+	.set_time	= twl_rtc_set_time,
+	.read_alarm	= twl_rtc_read_alarm,
+	.set_alarm	= twl_rtc_set_alarm,
+	.alarm_irq_enable = twl_rtc_alarm_irq_enable,
+	.update_irq_enable = twl_rtc_update_irq_enable,
 };
 
 /*----------------------------------------------------------------------*/
 
-static int __devinit twl4030_rtc_probe(struct platform_device *pdev)
+static int __devinit twl_rtc_probe(struct platform_device *pdev)
 {
 	struct rtc_device *rtc;
 	int ret = 0;
@@ -398,7 +449,7 @@ static int __devinit twl4030_rtc_probe(struct platform_device *pdev)
 		return -EINVAL;
 
 	rtc = rtc_device_register(pdev->name,
-				  &pdev->dev, &twl4030_rtc_ops, THIS_MODULE);
+				  &pdev->dev, &twl_rtc_ops, THIS_MODULE);
 	if (IS_ERR(rtc)) {
 		ret = PTR_ERR(rtc);
 		dev_err(&pdev->dev, "can't register RTC device, err %ld\n",
@@ -409,7 +460,7 @@ static int __devinit twl4030_rtc_probe(struct platform_device *pdev)
 
 	platform_set_drvdata(pdev, rtc);
 
-	ret = twl4030_rtc_read_u8(&rd_reg, REG_RTC_STATUS_REG);
+	ret = twl_rtc_read_u8(&rd_reg, REG_RTC_STATUS_REG);
 	if (ret < 0)
 		goto out1;
 
@@ -420,11 +471,11 @@ static int __devinit twl4030_rtc_probe(struct platform_device *pdev)
 		dev_warn(&pdev->dev, "Pending Alarm interrupt detected.\n");
 
 	/* Clear RTC Power up reset and pending alarm interrupts */
-	ret = twl4030_rtc_write_u8(rd_reg, REG_RTC_STATUS_REG);
+	ret = twl_rtc_write_u8(rd_reg, REG_RTC_STATUS_REG);
 	if (ret < 0)
 		goto out1;
 
-	ret = request_irq(irq, twl4030_rtc_interrupt,
+	ret = request_irq(irq, twl_rtc_interrupt,
 				IRQF_TRIGGER_RISING,
 				dev_name(&rtc->dev), rtc);
 	if (ret < 0) {
@@ -432,21 +483,28 @@ static int __devinit twl4030_rtc_probe(struct platform_device *pdev)
 		goto out1;
 	}
 
+	if (twl_class_is_6030()) {
+		twl6030_interrupt_unmask(TWL6030_RTC_INT_MASK,
+			REG_INT_MSK_LINE_A);
+		twl6030_interrupt_unmask(TWL6030_RTC_INT_MASK,
+			REG_INT_MSK_STS_A);
+	}
+
 	/* Check RTC module status, Enable if it is off */
-	ret = twl4030_rtc_read_u8(&rd_reg, REG_RTC_CTRL_REG);
+	ret = twl_rtc_read_u8(&rd_reg, REG_RTC_CTRL_REG);
 	if (ret < 0)
 		goto out2;
 
 	if (!(rd_reg & BIT_RTC_CTRL_REG_STOP_RTC_M)) {
-		dev_info(&pdev->dev, "Enabling TWL4030-RTC.\n");
+		dev_info(&pdev->dev, "Enabling TWL-RTC.\n");
 		rd_reg = BIT_RTC_CTRL_REG_STOP_RTC_M;
-		ret = twl4030_rtc_write_u8(rd_reg, REG_RTC_CTRL_REG);
+		ret = twl_rtc_write_u8(rd_reg, REG_RTC_CTRL_REG);
 		if (ret < 0)
 			goto out2;
 	}
 
 	/* init cached IRQ enable bits */
-	ret = twl4030_rtc_read_u8(&rtc_irq_bits, REG_RTC_INTERRUPTS_REG);
+	ret = twl_rtc_read_u8(&rtc_irq_bits, REG_RTC_INTERRUPTS_REG);
 	if (ret < 0)
 		goto out2;
 
@@ -461,10 +519,10 @@ out0:
 }
 
 /*
- * Disable all TWL4030 RTC module interrupts.
+ * Disable all TWL RTC module interrupts.
  * Sets status flag to free.
  */
-static int __devexit twl4030_rtc_remove(struct platform_device *pdev)
+static int __devexit twl_rtc_remove(struct platform_device *pdev)
 {
 	/* leave rtc running, but disable irqs */
 	struct rtc_device *rtc = platform_get_drvdata(pdev);
@@ -472,6 +530,13 @@ static int __devexit twl4030_rtc_remove(struct platform_device *pdev)
 
 	mask_rtc_irq_bit(BIT_RTC_INTERRUPTS_REG_IT_ALARM_M);
 	mask_rtc_irq_bit(BIT_RTC_INTERRUPTS_REG_IT_TIMER_M);
+	if (twl_class_is_6030()) {
+		twl6030_interrupt_mask(TWL6030_RTC_INT_MASK,
+			REG_INT_MSK_LINE_A);
+		twl6030_interrupt_mask(TWL6030_RTC_INT_MASK,
+			REG_INT_MSK_STS_A);
+	}
+
 
 	free_irq(irq, rtc);
 
@@ -480,7 +545,7 @@ static int __devexit twl4030_rtc_remove(struct platform_device *pdev)
 	return 0;
 }
 
-static void twl4030_rtc_shutdown(struct platform_device *pdev)
+static void twl_rtc_shutdown(struct platform_device *pdev)
 {
 	/* mask timer interrupts, but leave alarm interrupts on to enable
 	   power-on when alarm is triggered */
@@ -491,7 +556,7 @@ static void twl4030_rtc_shutdown(struct platform_device *pdev)
 
 static unsigned char irqstat;
 
-static int twl4030_rtc_suspend(struct platform_device *pdev, pm_message_t state)
+static int twl_rtc_suspend(struct platform_device *pdev, pm_message_t state)
 {
 	irqstat = rtc_irq_bits;
 
@@ -499,42 +564,47 @@ static int twl4030_rtc_suspend(struct platform_device *pdev, pm_message_t state)
 	return 0;
 }
 
-static int twl4030_rtc_resume(struct platform_device *pdev)
+static int twl_rtc_resume(struct platform_device *pdev)
 {
 	set_rtc_irq_bit(irqstat);
 	return 0;
 }
 
 #else
-#define twl4030_rtc_suspend NULL
-#define twl4030_rtc_resume  NULL
+#define twl_rtc_suspend NULL
+#define twl_rtc_resume  NULL
 #endif
 
-MODULE_ALIAS("platform:twl4030_rtc");
+MODULE_ALIAS("platform:twl_rtc");
 
 static struct platform_driver twl4030rtc_driver = {
-	.probe		= twl4030_rtc_probe,
-	.remove		= __devexit_p(twl4030_rtc_remove),
-	.shutdown	= twl4030_rtc_shutdown,
-	.suspend	= twl4030_rtc_suspend,
-	.resume		= twl4030_rtc_resume,
+	.probe		= twl_rtc_probe,
+	.remove		= __devexit_p(twl_rtc_remove),
+	.shutdown	= twl_rtc_shutdown,
+	.suspend	= twl_rtc_suspend,
+	.resume		= twl_rtc_resume,
 	.driver		= {
 		.owner	= THIS_MODULE,
-		.name	= "twl4030_rtc",
+		.name	= "twl_rtc",
 	},
 };
 
-static int __init twl4030_rtc_init(void)
+static int __init twl_rtc_init(void)
 {
+	if (twl_class_is_4030())
+		rtc_reg_map = (u8 *) twl4030_rtc_reg_map;
+	else
+		rtc_reg_map = (u8 *) twl6030_rtc_reg_map;
+
 	return platform_driver_register(&twl4030rtc_driver);
 }
-module_init(twl4030_rtc_init);
+module_init(twl_rtc_init);
 
-static void __exit twl4030_rtc_exit(void)
+static void __exit twl_rtc_exit(void)
 {
 	platform_driver_unregister(&twl4030rtc_driver);
 }
-module_exit(twl4030_rtc_exit);
+module_exit(twl_rtc_exit);
 
 MODULE_AUTHOR("Texas Instruments, MontaVista Software");
 MODULE_LICENSE("GPL");
diff --git a/drivers/rtc/rtc-tx4939.c b/drivers/rtc/rtc-tx4939.c
index 4a6ed1104fbb..9ee81d8aa7c0 100644
--- a/drivers/rtc/rtc-tx4939.c
+++ b/drivers/rtc/rtc-tx4939.c
@@ -17,6 +17,7 @@
 struct tx4939rtc_plat_data {
 	struct rtc_device *rtc;
 	struct tx4939_rtc_reg __iomem *rtcreg;
+	spinlock_t lock;
 };
 
 static struct tx4939rtc_plat_data *get_tx4939rtc_plat_data(struct device *dev)
@@ -52,14 +53,14 @@ static int tx4939_rtc_set_mmss(struct device *dev, unsigned long secs)
 	buf[3] = secs >> 8;
 	buf[4] = secs >> 16;
 	buf[5] = secs >> 24;
-	spin_lock_irq(&pdata->rtc->irq_lock);
+	spin_lock_irq(&pdata->lock);
 	__raw_writel(0, &rtcreg->adr);
 	for (i = 0; i < 6; i++)
 		__raw_writel(buf[i], &rtcreg->dat);
 	ret = tx4939_rtc_cmd(rtcreg,
 			     TX4939_RTCCTL_COMMAND_SETTIME |
 			     (__raw_readl(&rtcreg->ctl) & TX4939_RTCCTL_ALME));
-	spin_unlock_irq(&pdata->rtc->irq_lock);
+	spin_unlock_irq(&pdata->lock);
 	return ret;
 }
 
@@ -71,18 +72,18 @@ static int tx4939_rtc_read_time(struct device *dev, struct rtc_time *tm)
 	unsigned long sec;
 	unsigned char buf[6];
 
-	spin_lock_irq(&pdata->rtc->irq_lock);
+	spin_lock_irq(&pdata->lock);
 	ret = tx4939_rtc_cmd(rtcreg,
 			     TX4939_RTCCTL_COMMAND_GETTIME |
 			     (__raw_readl(&rtcreg->ctl) & TX4939_RTCCTL_ALME));
 	if (ret) {
-		spin_unlock_irq(&pdata->rtc->irq_lock);
+		spin_unlock_irq(&pdata->lock);
 		return ret;
 	}
 	__raw_writel(2, &rtcreg->adr);
 	for (i = 2; i < 6; i++)
 		buf[i] = __raw_readl(&rtcreg->dat);
-	spin_unlock_irq(&pdata->rtc->irq_lock);
+	spin_unlock_irq(&pdata->lock);
 	sec = (buf[5] << 24) | (buf[4] << 16) | (buf[3] << 8) | buf[2];
 	rtc_time_to_tm(sec, tm);
 	return rtc_valid_tm(tm);
@@ -110,13 +111,13 @@ static int tx4939_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
 	buf[3] = sec >> 8;
 	buf[4] = sec >> 16;
 	buf[5] = sec >> 24;
-	spin_lock_irq(&pdata->rtc->irq_lock);
+	spin_lock_irq(&pdata->lock);
 	__raw_writel(0, &rtcreg->adr);
 	for (i = 0; i < 6; i++)
 		__raw_writel(buf[i], &rtcreg->dat);
 	ret = tx4939_rtc_cmd(rtcreg, TX4939_RTCCTL_COMMAND_SETALARM |
 			     (alrm->enabled ? TX4939_RTCCTL_ALME : 0));
-	spin_unlock_irq(&pdata->rtc->irq_lock);
+	spin_unlock_irq(&pdata->lock);
 	return ret;
 }
 
@@ -129,12 +130,12 @@ static int tx4939_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm)
 	unsigned char buf[6];
 	u32 ctl;
 
-	spin_lock_irq(&pdata->rtc->irq_lock);
+	spin_lock_irq(&pdata->lock);
 	ret = tx4939_rtc_cmd(rtcreg,
 			     TX4939_RTCCTL_COMMAND_GETALARM |
 			     (__raw_readl(&rtcreg->ctl) & TX4939_RTCCTL_ALME));
 	if (ret) {
-		spin_unlock_irq(&pdata->rtc->irq_lock);
+		spin_unlock_irq(&pdata->lock);
 		return ret;
 	}
 	__raw_writel(2, &rtcreg->adr);
@@ -143,7 +144,7 @@ static int tx4939_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm)
 	ctl = __raw_readl(&rtcreg->ctl);
 	alrm->enabled = (ctl & TX4939_RTCCTL_ALME) ? 1 : 0;
 	alrm->pending = (ctl & TX4939_RTCCTL_ALMD) ? 1 : 0;
-	spin_unlock_irq(&pdata->rtc->irq_lock);
+	spin_unlock_irq(&pdata->lock);
 	sec = (buf[5] << 24) | (buf[4] << 16) | (buf[3] << 8) | buf[2];
 	rtc_time_to_tm(sec, &alrm->time);
 	return rtc_valid_tm(&alrm->time);
@@ -153,11 +154,11 @@ static int tx4939_rtc_alarm_irq_enable(struct device *dev, unsigned int enabled)
 {
 	struct tx4939rtc_plat_data *pdata = get_tx4939rtc_plat_data(dev);
 
-	spin_lock_irq(&pdata->rtc->irq_lock);
+	spin_lock_irq(&pdata->lock);
 	tx4939_rtc_cmd(pdata->rtcreg,
 		       TX4939_RTCCTL_COMMAND_NOP |
 		       (enabled ? TX4939_RTCCTL_ALME : 0));
-	spin_unlock_irq(&pdata->rtc->irq_lock);
+	spin_unlock_irq(&pdata->lock);
 	return 0;
 }
 
@@ -167,13 +168,14 @@ static irqreturn_t tx4939_rtc_interrupt(int irq, void *dev_id)
 	struct tx4939_rtc_reg __iomem *rtcreg = pdata->rtcreg;
 	unsigned long events = RTC_IRQF;
 
-	spin_lock(&pdata->rtc->irq_lock);
+	spin_lock(&pdata->lock);
 	if (__raw_readl(&rtcreg->ctl) & TX4939_RTCCTL_ALMD) {
 		events |= RTC_AF;
 		tx4939_rtc_cmd(rtcreg, TX4939_RTCCTL_COMMAND_NOP);
 	}
-	spin_unlock(&pdata->rtc->irq_lock);
-	rtc_update_irq(pdata->rtc, 1, events);
+	spin_unlock(&pdata->lock);
+	if (likely(pdata->rtc))
+		rtc_update_irq(pdata->rtc, 1, events);
 	return IRQ_HANDLED;
 }
 
@@ -194,13 +196,13 @@ static ssize_t tx4939_rtc_nvram_read(struct kobject *kobj,
 	struct tx4939_rtc_reg __iomem *rtcreg = pdata->rtcreg;
 	ssize_t count;
 
-	spin_lock_irq(&pdata->rtc->irq_lock);
+	spin_lock_irq(&pdata->lock);
 	for (count = 0; size > 0 && pos < TX4939_RTC_REG_RAMSIZE;
 	     count++, size--) {
 		__raw_writel(pos++, &rtcreg->adr);
 		*buf++ = __raw_readl(&rtcreg->dat);
 	}
-	spin_unlock_irq(&pdata->rtc->irq_lock);
+	spin_unlock_irq(&pdata->lock);
 	return count;
 }
 
@@ -213,13 +215,13 @@ static ssize_t tx4939_rtc_nvram_write(struct kobject *kobj,
 	struct tx4939_rtc_reg __iomem *rtcreg = pdata->rtcreg;
 	ssize_t count;
 
-	spin_lock_irq(&pdata->rtc->irq_lock);
+	spin_lock_irq(&pdata->lock);
 	for (count = 0; size > 0 && pos < TX4939_RTC_REG_RAMSIZE;
 	     count++, size--) {
 		__raw_writel(pos++, &rtcreg->adr);
 		__raw_writel(*buf++, &rtcreg->dat);
 	}
-	spin_unlock_irq(&pdata->rtc->irq_lock);
+	spin_unlock_irq(&pdata->lock);
 	return count;
 }
 
@@ -259,6 +261,7 @@ static int __init tx4939_rtc_probe(struct platform_device *pdev)
 	if (!pdata->rtcreg)
 		return -EBUSY;
 
+	spin_lock_init(&pdata->lock);
 	tx4939_rtc_cmd(pdata->rtcreg, TX4939_RTCCTL_COMMAND_NOP);
 	if (devm_request_irq(&pdev->dev, irq, tx4939_rtc_interrupt,
 			     IRQF_DISABLED, pdev->name, &pdev->dev) < 0)
@@ -277,14 +280,12 @@ static int __init tx4939_rtc_probe(struct platform_device *pdev)
 static int __exit tx4939_rtc_remove(struct platform_device *pdev)
 {
 	struct tx4939rtc_plat_data *pdata = platform_get_drvdata(pdev);
-	struct rtc_device *rtc = pdata->rtc;
 
-	spin_lock_irq(&rtc->irq_lock);
-	tx4939_rtc_cmd(pdata->rtcreg, TX4939_RTCCTL_COMMAND_NOP);
-	spin_unlock_irq(&rtc->irq_lock);
 	sysfs_remove_bin_file(&pdev->dev.kobj, &tx4939_rtc_nvram_attr);
-	rtc_device_unregister(rtc);
-	platform_set_drvdata(pdev, NULL);
+	rtc_device_unregister(pdata->rtc);
+	spin_lock_irq(&pdata->lock);
+	tx4939_rtc_cmd(pdata->rtcreg, TX4939_RTCCTL_COMMAND_NOP);
+	spin_unlock_irq(&pdata->lock);
 	return 0;
 }
 
diff --git a/drivers/rtc/rtc-v3020.c b/drivers/rtc/rtc-v3020.c
index 423cd5a30b10..bed4cab07043 100644
--- a/drivers/rtc/rtc-v3020.c
+++ b/drivers/rtc/rtc-v3020.c
@@ -304,7 +304,6 @@ static int rtc_probe(struct platform_device *pdev)
 {
 	struct v3020_platform_data *pdata = pdev->dev.platform_data;
 	struct v3020 *chip;
-	struct rtc_device *rtc;
 	int retval = -EBUSY;
 	int i;
 	int temp;
@@ -335,7 +334,7 @@ static int rtc_probe(struct platform_device *pdev)
 		goto err_io;
 	}
 
-	/* Make sure frequency measurment mode, test modes, and lock
+	/* Make sure frequency measurement mode, test modes, and lock
 	 * are all disabled */
 	v3020_set_reg(chip, V3020_STATUS_0, 0x0);
 
@@ -353,13 +352,12 @@ static int rtc_probe(struct platform_device *pdev)
 
 	platform_set_drvdata(pdev, chip);
 
-	rtc = rtc_device_register("v3020",
+	chip->rtc = rtc_device_register("v3020",
 				&pdev->dev, &v3020_rtc_ops, THIS_MODULE);
-	if (IS_ERR(rtc)) {
-		retval = PTR_ERR(rtc);
+	if (IS_ERR(chip->rtc)) {
+		retval = PTR_ERR(chip->rtc);
 		goto err_io;
 	}
-	chip->rtc = rtc;
 
 	return 0;
 
diff --git a/drivers/rtc/rtc-vr41xx.c b/drivers/rtc/rtc-vr41xx.c
index fadddac1e5a4..c3244244e8cf 100644
--- a/drivers/rtc/rtc-vr41xx.c
+++ b/drivers/rtc/rtc-vr41xx.c
@@ -327,7 +327,7 @@ static int __devinit rtc_probe(struct platform_device *pdev)
 	if (!res)
 		return -EBUSY;
 
-	rtc1_base = ioremap(res->start, res->end - res->start + 1);
+	rtc1_base = ioremap(res->start, resource_size(res));
 	if (!rtc1_base)
 		return -EBUSY;
 
@@ -337,7 +337,7 @@ static int __devinit rtc_probe(struct platform_device *pdev)
 		goto err_rtc1_iounmap;
 	}
 
-	rtc2_base = ioremap(res->start, res->end - res->start + 1);
+	rtc2_base = ioremap(res->start, resource_size(res));
 	if (!rtc2_base) {
 		retval = -EBUSY;
 		goto err_rtc1_iounmap;
diff --git a/drivers/rtc/rtc-wm831x.c b/drivers/rtc/rtc-wm831x.c
index 79795cdf6ed8..000c7e481e59 100644
--- a/drivers/rtc/rtc-wm831x.c
+++ b/drivers/rtc/rtc-wm831x.c
@@ -485,7 +485,7 @@ static int __devexit wm831x_rtc_remove(struct platform_device *pdev)
 	return 0;
 }
 
-static struct dev_pm_ops wm831x_rtc_pm_ops = {
+static const struct dev_pm_ops wm831x_rtc_pm_ops = {
 	.suspend = wm831x_rtc_suspend,
 	.resume = wm831x_rtc_resume,
 
diff --git a/drivers/rtc/rtc-wm8350.c b/drivers/rtc/rtc-wm8350.c
index c91edc572eb6..f1e440521c54 100644
--- a/drivers/rtc/rtc-wm8350.c
+++ b/drivers/rtc/rtc-wm8350.c
@@ -315,9 +315,9 @@ static int wm8350_rtc_update_irq_enable(struct device *dev,
 	return 0;
 }
 
-static void wm8350_rtc_alarm_handler(struct wm8350 *wm8350, int irq,
-				     void *data)
+static irqreturn_t wm8350_rtc_alarm_handler(int irq, void *data)
 {
+	struct wm8350 *wm8350 = data;
 	struct rtc_device *rtc = wm8350->rtc.rtc;
 	int ret;
 
@@ -330,14 +330,18 @@ static void wm8350_rtc_alarm_handler(struct wm8350 *wm8350, int irq,
 		dev_err(&(wm8350->rtc.pdev->dev),
 			"Failed to disable alarm: %d\n", ret);
 	}
+
+	return IRQ_HANDLED;
 }
 
-static void wm8350_rtc_update_handler(struct wm8350 *wm8350, int irq,
-				      void *data)
+static irqreturn_t wm8350_rtc_update_handler(int irq, void *data)
 {
+	struct wm8350 *wm8350 = data;
 	struct rtc_device *rtc = wm8350->rtc.rtc;
 
 	rtc_update_irq(rtc, 1, RTC_IRQF | RTC_UF);
+
+	return IRQ_HANDLED;
 }
 
 static const struct rtc_class_ops wm8350_rtc_ops = {
@@ -350,8 +354,9 @@ static const struct rtc_class_ops wm8350_rtc_ops = {
 };
 
 #ifdef CONFIG_PM
-static int wm8350_rtc_suspend(struct platform_device *pdev, pm_message_t state)
+static int wm8350_rtc_suspend(struct device *dev)
 {
+	struct platform_device *pdev = to_platform_device(dev);
 	struct wm8350 *wm8350 = dev_get_drvdata(&pdev->dev);
 	int ret = 0;
 	u16 reg;
@@ -369,8 +374,9 @@ static int wm8350_rtc_suspend(struct platform_device *pdev, pm_message_t state)
 	return ret;
 }
 
-static int wm8350_rtc_resume(struct platform_device *pdev)
+static int wm8350_rtc_resume(struct device *dev)
 {
+	struct platform_device *pdev = to_platform_device(dev);
 	struct wm8350 *wm8350 = dev_get_drvdata(&pdev->dev);
 	int ret;
 
@@ -455,15 +461,14 @@ static int wm8350_rtc_probe(struct platform_device *pdev)
 		return ret;
 	}
 
-	wm8350_mask_irq(wm8350, WM8350_IRQ_RTC_SEC);
-	wm8350_mask_irq(wm8350, WM8350_IRQ_RTC_PER);
-
 	wm8350_register_irq(wm8350, WM8350_IRQ_RTC_SEC,
-			    wm8350_rtc_update_handler, NULL);
+			    wm8350_rtc_update_handler, 0,
+			    "RTC Seconds", wm8350);
+	wm8350_mask_irq(wm8350, WM8350_IRQ_RTC_SEC);
 
 	wm8350_register_irq(wm8350, WM8350_IRQ_RTC_ALM,
-			    wm8350_rtc_alarm_handler, NULL);
-	wm8350_unmask_irq(wm8350, WM8350_IRQ_RTC_ALM);
+			    wm8350_rtc_alarm_handler, 0,
+			    "RTC Alarm", wm8350);
 
 	return 0;
 }
@@ -473,8 +478,6 @@ static int __devexit wm8350_rtc_remove(struct platform_device *pdev)
 	struct wm8350 *wm8350 = platform_get_drvdata(pdev);
 	struct wm8350_rtc *wm_rtc = &wm8350->rtc;
 
-	wm8350_mask_irq(wm8350, WM8350_IRQ_RTC_SEC);
-
 	wm8350_free_irq(wm8350, WM8350_IRQ_RTC_SEC);
 	wm8350_free_irq(wm8350, WM8350_IRQ_RTC_ALM);
 
@@ -483,13 +486,17 @@ static int __devexit wm8350_rtc_remove(struct platform_device *pdev)
 	return 0;
 }
 
+static struct dev_pm_ops wm8350_rtc_pm_ops = {
+	.suspend = wm8350_rtc_suspend,
+	.resume = wm8350_rtc_resume,
+};
+
 static struct platform_driver wm8350_rtc_driver = {
 	.probe = wm8350_rtc_probe,
 	.remove = __devexit_p(wm8350_rtc_remove),
-	.suspend = wm8350_rtc_suspend,
-	.resume = wm8350_rtc_resume,
 	.driver = {
 		.name = "wm8350-rtc",
+		.pm = &wm8350_rtc_pm_ops,
 	},
 };
 
diff --git a/drivers/rtc/rtc-x1205.c b/drivers/rtc/rtc-x1205.c
index 6583c1a8b070..9aae49139a0a 100644
--- a/drivers/rtc/rtc-x1205.c
+++ b/drivers/rtc/rtc-x1205.c
@@ -155,11 +155,11 @@ static int x1205_get_status(struct i2c_client *client, unsigned char *sr)
 }
 
 static int x1205_set_datetime(struct i2c_client *client, struct rtc_time *tm,
-			int datetoo, u8 reg_base, unsigned char alm_enable)
+			u8 reg_base, unsigned char alm_enable)
 {
-	int i, xfer, nbytes;
-	unsigned char buf[8];
+	int i, xfer;
 	unsigned char rdata[10] = { 0, reg_base };
+	unsigned char *buf = rdata + 2;
 
 	static const unsigned char wel[3] = { 0, X1205_REG_SR,
 						X1205_SR_WEL };
@@ -170,9 +170,9 @@ static int x1205_set_datetime(struct i2c_client *client, struct rtc_time *tm,
 	static const unsigned char diswe[3] = { 0, X1205_REG_SR, 0 };
 
 	dev_dbg(&client->dev,
-		"%s: secs=%d, mins=%d, hours=%d\n",
-		__func__,
-		tm->tm_sec, tm->tm_min, tm->tm_hour);
+		"%s: sec=%d min=%d hour=%d mday=%d mon=%d year=%d wday=%d\n",
+		__func__, tm->tm_sec, tm->tm_min, tm->tm_hour, tm->tm_mday,
+		tm->tm_mon, tm->tm_year, tm->tm_wday);
 
 	buf[CCR_SEC] = bin2bcd(tm->tm_sec);
 	buf[CCR_MIN] = bin2bcd(tm->tm_min);
@@ -180,23 +180,15 @@ static int x1205_set_datetime(struct i2c_client *client, struct rtc_time *tm,
 	/* set hour and 24hr bit */
 	buf[CCR_HOUR] = bin2bcd(tm->tm_hour) | X1205_HR_MIL;
 
-	/* should we also set the date? */
-	if (datetoo) {
-		dev_dbg(&client->dev,
-			"%s: mday=%d, mon=%d, year=%d, wday=%d\n",
-			__func__,
-			tm->tm_mday, tm->tm_mon, tm->tm_year, tm->tm_wday);
+	buf[CCR_MDAY] = bin2bcd(tm->tm_mday);
 
-		buf[CCR_MDAY] = bin2bcd(tm->tm_mday);
+	/* month, 1 - 12 */
+	buf[CCR_MONTH] = bin2bcd(tm->tm_mon + 1);
 
-		/* month, 1 - 12 */
-		buf[CCR_MONTH] = bin2bcd(tm->tm_mon + 1);
-
-		/* year, since the rtc epoch*/
-		buf[CCR_YEAR] = bin2bcd(tm->tm_year % 100);
-		buf[CCR_WDAY] = tm->tm_wday & 0x07;
-		buf[CCR_Y2K] = bin2bcd((tm->tm_year + 1900) / 100);
-	}
+	/* year, since the rtc epoch*/
+	buf[CCR_YEAR] = bin2bcd(tm->tm_year % 100);
+	buf[CCR_WDAY] = tm->tm_wday & 0x07;
+	buf[CCR_Y2K] = bin2bcd((tm->tm_year + 1900) / 100);
 
 	/* If writing alarm registers, set compare bits on registers 0-4 */
 	if (reg_base < X1205_CCR_BASE)
@@ -214,17 +206,8 @@ static int x1205_set_datetime(struct i2c_client *client, struct rtc_time *tm,
 		return -EIO;
 	}
 
-
-	/* write register's data */
-	if (datetoo)
-		nbytes = 8;
-	else
-		nbytes = 3;
-	for (i = 0; i < nbytes; i++)
-		rdata[2+i] = buf[i];
-
-	xfer = i2c_master_send(client, rdata, nbytes+2);
-	if (xfer != nbytes+2) {
+	xfer = i2c_master_send(client, rdata, sizeof(rdata));
+	if (xfer != sizeof(rdata)) {
 		dev_err(&client->dev,
 			"%s: result=%d addr=%02x, data=%02x\n",
 			__func__,
@@ -282,7 +265,7 @@ static int x1205_fix_osc(struct i2c_client *client)
 
 	memset(&tm, 0, sizeof(tm));
 
-	err = x1205_set_datetime(client, &tm, 1, X1205_CCR_BASE, 0);
+	err = x1205_set_datetime(client, &tm, X1205_CCR_BASE, 0);
 	if (err < 0)
 		dev_err(&client->dev, "unable to restart the oscillator\n");
 
@@ -481,7 +464,7 @@ static int x1205_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm)
 static int x1205_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
 {
 	return x1205_set_datetime(to_i2c_client(dev),
-		&alrm->time, 1, X1205_ALM0_BASE, alrm->enabled);
+		&alrm->time, X1205_ALM0_BASE, alrm->enabled);
 }
 
 static int x1205_rtc_read_time(struct device *dev, struct rtc_time *tm)
@@ -493,7 +476,7 @@ static int x1205_rtc_read_time(struct device *dev, struct rtc_time *tm)
 static int x1205_rtc_set_time(struct device *dev, struct rtc_time *tm)
 {
 	return x1205_set_datetime(to_i2c_client(dev),
-		tm, 1, X1205_CCR_BASE, 0);
+		tm, X1205_CCR_BASE, 0);
 }
 
 static int x1205_rtc_proc(struct device *dev, struct seq_file *seq)
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index aaccc8ecfa8f..fdb2e7c14506 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -24,7 +24,6 @@
 #include <asm/ccwdev.h>
 #include <asm/ebcdic.h>
 #include <asm/idals.h>
-#include <asm/todclk.h>
 #include <asm/itcw.h>
 
 /* This is ugly... */
@@ -64,6 +63,7 @@ static void do_restore_device(struct work_struct *);
 static void dasd_return_cqr_cb(struct dasd_ccw_req *, void *);
 static void dasd_device_timeout(unsigned long);
 static void dasd_block_timeout(unsigned long);
+static void __dasd_process_erp(struct dasd_device *, struct dasd_ccw_req *);
 
 /*
  * SECTION: Operations on the device structure.
@@ -960,7 +960,7 @@ static void dasd_device_timeout(unsigned long ptr)
 	device = (struct dasd_device *) ptr;
 	spin_lock_irqsave(get_ccwdev_lock(device->cdev), flags);
 	/* re-activate request queue */
-        device->stopped &= ~DASD_STOPPED_PENDING;
+	dasd_device_remove_stop_bits(device, DASD_STOPPED_PENDING);
 	spin_unlock_irqrestore(get_ccwdev_lock(device->cdev), flags);
 	dasd_schedule_device_bh(device);
 }
@@ -994,10 +994,9 @@ static void dasd_handle_killed_request(struct ccw_device *cdev,
 		return;
 	cqr = (struct dasd_ccw_req *) intparm;
 	if (cqr->status != DASD_CQR_IN_IO) {
-		DBF_EVENT(DBF_DEBUG,
-			"invalid status in handle_killed_request: "
-			"bus_id %s, status %02x",
-			dev_name(&cdev->dev), cqr->status);
+		DBF_EVENT_DEVID(DBF_DEBUG, cdev,
+				"invalid status in handle_killed_request: "
+				"%02x", cqr->status);
 		return;
 	}
 
@@ -1023,7 +1022,7 @@ void dasd_generic_handle_state_change(struct dasd_device *device)
 	/* First of all start sense subsystem status request. */
 	dasd_eer_snss(device);
 
-	device->stopped &= ~DASD_STOPPED_PENDING;
+	dasd_device_remove_stop_bits(device, DASD_STOPPED_PENDING);
 	dasd_schedule_device_bh(device);
 	if (device->block)
 		dasd_schedule_block_bh(device->block);
@@ -1045,12 +1044,13 @@ void dasd_int_handler(struct ccw_device *cdev, unsigned long intparm,
 		case -EIO:
 			break;
 		case -ETIMEDOUT:
-			DBF_EVENT(DBF_WARNING, "%s(%s): request timed out\n",
-			       __func__, dev_name(&cdev->dev));
+			DBF_EVENT_DEVID(DBF_WARNING, cdev, "%s: "
+					"request timed out\n", __func__);
 			break;
 		default:
-			DBF_EVENT(DBF_WARNING, "%s(%s): unknown error %ld\n",
-			       __func__, dev_name(&cdev->dev), PTR_ERR(irb));
+			DBF_EVENT_DEVID(DBF_WARNING, cdev, "%s: "
+					"unknown error %ld\n", __func__,
+					PTR_ERR(irb));
 		}
 		dasd_handle_killed_request(cdev, intparm);
 		return;
@@ -1405,6 +1405,20 @@ void dasd_schedule_device_bh(struct dasd_device *device)
 	tasklet_hi_schedule(&device->tasklet);
 }
 
+void dasd_device_set_stop_bits(struct dasd_device *device, int bits)
+{
+	device->stopped |= bits;
+}
+EXPORT_SYMBOL_GPL(dasd_device_set_stop_bits);
+
+void dasd_device_remove_stop_bits(struct dasd_device *device, int bits)
+{
+	device->stopped &= ~bits;
+	if (!device->stopped)
+		wake_up(&generic_waitq);
+}
+EXPORT_SYMBOL_GPL(dasd_device_remove_stop_bits);
+
 /*
  * Queue a request to the head of the device ccw_queue.
  * Start the I/O if possible.
@@ -1465,58 +1479,135 @@ static inline int _wait_for_wakeup(struct dasd_ccw_req *cqr)
 }
 
 /*
- * Queue a request to the tail of the device ccw_queue and wait for
- * it's completion.
+ * checks if error recovery is necessary, returns 1 if yes, 0 otherwise.
  */
-int dasd_sleep_on(struct dasd_ccw_req *cqr)
+static int __dasd_sleep_on_erp(struct dasd_ccw_req *cqr)
 {
 	struct dasd_device *device;
-	int rc;
+	dasd_erp_fn_t erp_fn;
 
+	if (cqr->status == DASD_CQR_FILLED)
+		return 0;
 	device = cqr->startdev;
+	if (test_bit(DASD_CQR_FLAGS_USE_ERP, &cqr->flags)) {
+		if (cqr->status == DASD_CQR_TERMINATED) {
+			device->discipline->handle_terminated_request(cqr);
+			return 1;
+		}
+		if (cqr->status == DASD_CQR_NEED_ERP) {
+			erp_fn = device->discipline->erp_action(cqr);
+			erp_fn(cqr);
+			return 1;
+		}
+		if (cqr->status == DASD_CQR_FAILED)
+			dasd_log_sense(cqr, &cqr->irb);
+		if (cqr->refers) {
+			__dasd_process_erp(device, cqr);
+			return 1;
+		}
+	}
+	return 0;
+}
 
-	cqr->callback = dasd_wakeup_cb;
-	cqr->callback_data = (void *) &generic_waitq;
-	dasd_add_request_tail(cqr);
-	wait_event(generic_waitq, _wait_for_wakeup(cqr));
+static int __dasd_sleep_on_loop_condition(struct dasd_ccw_req *cqr)
+{
+	if (test_bit(DASD_CQR_FLAGS_USE_ERP, &cqr->flags)) {
+		if (cqr->refers) /* erp is not done yet */
+			return 1;
+		return ((cqr->status != DASD_CQR_DONE) &&
+			(cqr->status != DASD_CQR_FAILED));
+	} else
+		return (cqr->status == DASD_CQR_FILLED);
+}
 
-	if (cqr->status == DASD_CQR_DONE)
+static int _dasd_sleep_on(struct dasd_ccw_req *maincqr, int interruptible)
+{
+	struct dasd_device *device;
+	int rc;
+	struct list_head ccw_queue;
+	struct dasd_ccw_req *cqr;
+
+	INIT_LIST_HEAD(&ccw_queue);
+	maincqr->status = DASD_CQR_FILLED;
+	device = maincqr->startdev;
+	list_add(&maincqr->blocklist, &ccw_queue);
+	for (cqr = maincqr;  __dasd_sleep_on_loop_condition(cqr);
+	     cqr = list_first_entry(&ccw_queue,
+				    struct dasd_ccw_req, blocklist)) {
+
+		if (__dasd_sleep_on_erp(cqr))
+			continue;
+		if (cqr->status != DASD_CQR_FILLED) /* could be failed */
+			continue;
+
+		/* Non-temporary stop condition will trigger fail fast */
+		if (device->stopped & ~DASD_STOPPED_PENDING &&
+		    test_bit(DASD_CQR_FLAGS_FAILFAST, &cqr->flags) &&
+		    (!dasd_eer_enabled(device))) {
+			cqr->status = DASD_CQR_FAILED;
+			continue;
+		}
+
+		/* Don't try to start requests if device is stopped */
+		if (interruptible) {
+			rc = wait_event_interruptible(
+				generic_waitq, !(device->stopped));
+			if (rc == -ERESTARTSYS) {
+				cqr->status = DASD_CQR_FAILED;
+				maincqr->intrc = rc;
+				continue;
+			}
+		} else
+			wait_event(generic_waitq, !(device->stopped));
+
+		cqr->callback = dasd_wakeup_cb;
+		cqr->callback_data = (void *) &generic_waitq;
+		dasd_add_request_tail(cqr);
+		if (interruptible) {
+			rc = wait_event_interruptible(
+				generic_waitq, _wait_for_wakeup(cqr));
+			if (rc == -ERESTARTSYS) {
+				dasd_cancel_req(cqr);
+				/* wait (non-interruptible) for final status */
+				wait_event(generic_waitq,
+					   _wait_for_wakeup(cqr));
+				cqr->status = DASD_CQR_FAILED;
+				maincqr->intrc = rc;
+				continue;
+			}
+		} else
+			wait_event(generic_waitq, _wait_for_wakeup(cqr));
+	}
+
+	maincqr->endclk = get_clock();
+	if ((maincqr->status != DASD_CQR_DONE) &&
+	    (maincqr->intrc != -ERESTARTSYS))
+		dasd_log_sense(maincqr, &maincqr->irb);
+	if (maincqr->status == DASD_CQR_DONE)
 		rc = 0;
-	else if (cqr->intrc)
-		rc = cqr->intrc;
+	else if (maincqr->intrc)
+		rc = maincqr->intrc;
 	else
 		rc = -EIO;
 	return rc;
 }
 
 /*
+ * Queue a request to the tail of the device ccw_queue and wait for
+ * it's completion.
+ */
+int dasd_sleep_on(struct dasd_ccw_req *cqr)
+{
+	return _dasd_sleep_on(cqr, 0);
+}
+
+/*
  * Queue a request to the tail of the device ccw_queue and wait
  * interruptible for it's completion.
  */
 int dasd_sleep_on_interruptible(struct dasd_ccw_req *cqr)
 {
-	struct dasd_device *device;
-	int rc;
-
-	device = cqr->startdev;
-	cqr->callback = dasd_wakeup_cb;
-	cqr->callback_data = (void *) &generic_waitq;
-	dasd_add_request_tail(cqr);
-	rc = wait_event_interruptible(generic_waitq, _wait_for_wakeup(cqr));
-	if (rc == -ERESTARTSYS) {
-		dasd_cancel_req(cqr);
-		/* wait (non-interruptible) for final status */
-		wait_event(generic_waitq, _wait_for_wakeup(cqr));
-		cqr->intrc = rc;
-	}
-
-	if (cqr->status == DASD_CQR_DONE)
-		rc = 0;
-	else if (cqr->intrc)
-		rc = cqr->intrc;
-	else
-		rc = -EIO;
-	return rc;
+	return _dasd_sleep_on(cqr, 1);
 }
 
 /*
@@ -1630,7 +1721,7 @@ static void dasd_block_timeout(unsigned long ptr)
 	block = (struct dasd_block *) ptr;
 	spin_lock_irqsave(get_ccwdev_lock(block->base->cdev), flags);
 	/* re-activate request queue */
-	block->base->stopped &= ~DASD_STOPPED_PENDING;
+	dasd_device_remove_stop_bits(block->base, DASD_STOPPED_PENDING);
 	spin_unlock_irqrestore(get_ccwdev_lock(block->base->cdev), flags);
 	dasd_schedule_block_bh(block);
 }
@@ -1657,11 +1748,10 @@ void dasd_block_clear_timer(struct dasd_block *block)
 /*
  * Process finished error recovery ccw.
  */
-static inline void __dasd_block_process_erp(struct dasd_block *block,
-					    struct dasd_ccw_req *cqr)
+static void __dasd_process_erp(struct dasd_device *device,
+			       struct dasd_ccw_req *cqr)
 {
 	dasd_erp_fn_t erp_fn;
-	struct dasd_device *device = block->base;
 
 	if (cqr->status == DASD_CQR_DONE)
 		DBF_DEV_EVENT(DBF_NOTICE, device, "%s", "ERP successful");
@@ -1725,9 +1815,12 @@ static void __dasd_process_request_queue(struct dasd_block *block)
 				 */
 				if (!list_empty(&block->ccw_queue))
 					break;
-				spin_lock_irqsave(get_ccwdev_lock(basedev->cdev), flags);
-				basedev->stopped |= DASD_STOPPED_PENDING;
-				spin_unlock_irqrestore(get_ccwdev_lock(basedev->cdev), flags);
+				spin_lock_irqsave(
+					get_ccwdev_lock(basedev->cdev), flags);
+				dasd_device_set_stop_bits(basedev,
+							  DASD_STOPPED_PENDING);
+				spin_unlock_irqrestore(
+					get_ccwdev_lock(basedev->cdev), flags);
 				dasd_block_set_timer(block, HZ/2);
 				break;
 			}
@@ -1813,7 +1906,7 @@ restart:
 			cqr->status = DASD_CQR_FILLED;
 			cqr->retries = 255;
 			spin_lock_irqsave(get_ccwdev_lock(base->cdev), flags);
-			base->stopped |= DASD_STOPPED_QUIESCE;
+			dasd_device_set_stop_bits(base, DASD_STOPPED_QUIESCE);
 			spin_unlock_irqrestore(get_ccwdev_lock(base->cdev),
 					       flags);
 			goto restart;
@@ -1821,7 +1914,7 @@ restart:
 
 		/* Process finished ERP request. */
 		if (cqr->refers) {
-			__dasd_block_process_erp(block, cqr);
+			__dasd_process_erp(base, cqr);
 			goto restart;
 		}
 
@@ -1952,7 +2045,7 @@ restart_cb:
 		/* Process finished ERP request. */
 		if (cqr->refers) {
 			spin_lock_bh(&block->queue_lock);
-			__dasd_block_process_erp(block, cqr);
+			__dasd_process_erp(block->base, cqr);
 			spin_unlock_bh(&block->queue_lock);
 			/* restart list_for_xx loop since dasd_process_erp
 			 * might remove multiple elements */
@@ -2208,18 +2301,11 @@ int dasd_generic_probe(struct ccw_device *cdev,
 {
 	int ret;
 
-	ret = ccw_device_set_options(cdev, CCWDEV_DO_PATHGROUP);
-	if (ret) {
-		DBF_EVENT(DBF_WARNING,
-		       "dasd_generic_probe: could not set ccw-device options "
-		       "for %s\n", dev_name(&cdev->dev));
-		return ret;
-	}
 	ret = dasd_add_sysfs_files(cdev);
 	if (ret) {
-		DBF_EVENT(DBF_WARNING,
-		       "dasd_generic_probe: could not add sysfs entries "
-		       "for %s\n", dev_name(&cdev->dev));
+		DBF_EVENT_DEVID(DBF_WARNING, cdev, "%s",
+				"dasd_generic_probe: could not add "
+				"sysfs entries");
 		return ret;
 	}
 	cdev->handler = &dasd_int_handler;
@@ -2418,16 +2504,16 @@ int dasd_generic_notify(struct ccw_device *cdev, int event)
 				cqr->status = DASD_CQR_QUEUED;
 				cqr->retries++;
 			}
-		device->stopped |= DASD_STOPPED_DC_WAIT;
+		dasd_device_set_stop_bits(device, DASD_STOPPED_DC_WAIT);
 		dasd_device_clear_timer(device);
 		dasd_schedule_device_bh(device);
 		ret = 1;
 		break;
 	case CIO_OPER:
 		/* FIXME: add a sanity check. */
-		device->stopped &= ~DASD_STOPPED_DC_WAIT;
+		dasd_device_remove_stop_bits(device, DASD_STOPPED_DC_WAIT);
 		if (device->stopped & DASD_UNRESUMED_PM) {
-			device->stopped &= ~DASD_UNRESUMED_PM;
+			dasd_device_remove_stop_bits(device, DASD_UNRESUMED_PM);
 			dasd_restore_device(device);
 			ret = 1;
 			break;
@@ -2452,7 +2538,7 @@ int dasd_generic_pm_freeze(struct ccw_device *cdev)
 	if (IS_ERR(device))
 		return PTR_ERR(device);
 	/* disallow new I/O  */
-	device->stopped |= DASD_STOPPED_PM;
+	dasd_device_set_stop_bits(device, DASD_STOPPED_PM);
 	/* clear active requests */
 	INIT_LIST_HEAD(&freeze_queue);
 	spin_lock_irq(get_ccwdev_lock(cdev));
@@ -2504,14 +2590,18 @@ int dasd_generic_restore_device(struct ccw_device *cdev)
 		return PTR_ERR(device);
 
 	/* allow new IO again */
-	device->stopped &= ~DASD_STOPPED_PM;
-	device->stopped &= ~DASD_UNRESUMED_PM;
+	dasd_device_remove_stop_bits(device,
+				     (DASD_STOPPED_PM | DASD_UNRESUMED_PM));
 
 	dasd_schedule_device_bh(device);
 
-	if (device->discipline->restore)
+	/*
+	 * call discipline restore function
+	 * if device is stopped do nothing e.g. for disconnected devices
+	 */
+	if (device->discipline->restore && !(device->stopped))
 		rc = device->discipline->restore(device);
-	if (rc)
+	if (rc || device->stopped)
 		/*
 		 * if the resume failed for the DASD we put it in
 		 * an UNRESUMED stop state
@@ -2561,8 +2651,7 @@ static struct dasd_ccw_req *dasd_generic_build_rdc(struct dasd_device *device,
 	cqr->startdev = device;
 	cqr->memdev = device;
 	cqr->expires = 10*HZ;
-	clear_bit(DASD_CQR_FLAGS_USE_ERP, &cqr->flags);
-	cqr->retries = 2;
+	cqr->retries = 256;
 	cqr->buildclk = get_clock();
 	cqr->status = DASD_CQR_FILLED;
 	return cqr;
diff --git a/drivers/s390/block/dasd_3990_erp.c b/drivers/s390/block/dasd_3990_erp.c
index e8ff7b0c961d..44796ba4eb9b 100644
--- a/drivers/s390/block/dasd_3990_erp.c
+++ b/drivers/s390/block/dasd_3990_erp.c
@@ -12,7 +12,6 @@
 #include <linux/timer.h>
 #include <linux/slab.h>
 #include <asm/idals.h>
-#include <asm/todclk.h>
 
 #define PRINTK_HEADER "dasd_erp(3990): "
 
@@ -70,8 +69,7 @@ dasd_3990_erp_cleanup(struct dasd_ccw_req * erp, char final_status)
  *   processing until the started timer has expired or an related
  *   interrupt was received.
  */
-static void
-dasd_3990_erp_block_queue(struct dasd_ccw_req * erp, int expires)
+static void dasd_3990_erp_block_queue(struct dasd_ccw_req *erp, int expires)
 {
 
 	struct dasd_device *device = erp->startdev;
@@ -81,10 +79,13 @@ dasd_3990_erp_block_queue(struct dasd_ccw_req * erp, int expires)
 		    "blocking request queue for %is", expires/HZ);
 
 	spin_lock_irqsave(get_ccwdev_lock(device->cdev), flags);
-	device->stopped |= DASD_STOPPED_PENDING;
+	dasd_device_set_stop_bits(device, DASD_STOPPED_PENDING);
 	spin_unlock_irqrestore(get_ccwdev_lock(device->cdev), flags);
 	erp->status = DASD_CQR_FILLED;
-	dasd_block_set_timer(device->block, expires);
+	if (erp->block)
+		dasd_block_set_timer(erp->block, expires);
+	else
+		dasd_device_set_timer(device, expires);
 }
 
 /*
@@ -243,9 +244,13 @@ dasd_3990_erp_DCTL(struct dasd_ccw_req * erp, char modifier)
  * DESCRIPTION
  *   Setup ERP to do the ERP action 1 (see Reference manual).
  *   Repeat the operation on a different channel path.
- *   If all alternate paths have been tried, the request is posted with a
- *   permanent error.
- *   Note: duplex handling is not implemented (yet).
+ *   As deviation from the recommended recovery action, we reset the path mask
+ *   after we have tried each path and go through all paths a second time.
+ *   This will cover situations where only one path at a time is actually down,
+ *   but all paths fail and recover just with the same sequence and timing as
+ *   we try to use them (flapping links).
+ *   If all alternate paths have been tried twice, the request is posted with
+ *   a permanent error.
  *
  *  PARAMETER
  *   erp		pointer to the current ERP
@@ -254,17 +259,25 @@ dasd_3990_erp_DCTL(struct dasd_ccw_req * erp, char modifier)
  *   erp		pointer to the ERP
  *
  */
-static struct dasd_ccw_req *
-dasd_3990_erp_action_1(struct dasd_ccw_req * erp)
+static struct dasd_ccw_req *dasd_3990_erp_action_1_sec(struct dasd_ccw_req *erp)
 {
+	erp->function = dasd_3990_erp_action_1_sec;
+	dasd_3990_erp_alternate_path(erp);
+	return erp;
+}
 
+static struct dasd_ccw_req *dasd_3990_erp_action_1(struct dasd_ccw_req *erp)
+{
 	erp->function = dasd_3990_erp_action_1;
-
 	dasd_3990_erp_alternate_path(erp);
-
+	if (erp->status == DASD_CQR_FAILED) {
+		erp->status = DASD_CQR_FILLED;
+		erp->retries = 10;
+		erp->lpm = LPM_ANYPATH;
+		erp->function = dasd_3990_erp_action_1_sec;
+	}
 	return erp;
-
-}				/* end dasd_3990_erp_action_1 */
+}				/* end dasd_3990_erp_action_1(b) */
 
 /*
  * DASD_3990_ERP_ACTION_4
@@ -2295,6 +2308,7 @@ static struct dasd_ccw_req *dasd_3990_erp_add_erp(struct dasd_ccw_req *cqr)
 		return cqr;
 	}
 
+	ccw = cqr->cpaddr;
 	if (cqr->cpmode == 1) {
 		/* make a shallow copy of the original tcw but set new tsb */
 		erp->cpmode = 1;
@@ -2303,6 +2317,9 @@ static struct dasd_ccw_req *dasd_3990_erp_add_erp(struct dasd_ccw_req *cqr)
 		tsb = (struct tsb *) &tcw[1];
 		*tcw = *((struct tcw *)cqr->cpaddr);
 		tcw->tsb = (long)tsb;
+	} else if (ccw->cmd_code == DASD_ECKD_CCW_PSF) {
+		/* PSF cannot be chained from NOOP/TIC */
+		erp->cpaddr = cqr->cpaddr;
 	} else {
 		/* initialize request with default TIC to current ERP/CQR */
 		ccw = erp->cpaddr;
@@ -2487,6 +2504,8 @@ dasd_3990_erp_further_erp(struct dasd_ccw_req *erp)
 
 		erp = dasd_3990_erp_action_1(erp);
 
+	} else if (erp->function == dasd_3990_erp_action_1_sec) {
+		erp = dasd_3990_erp_action_1_sec(erp);
 	} else if (erp->function == dasd_3990_erp_action_5) {
 
 		/* retries have not been successful */
diff --git a/drivers/s390/block/dasd_alias.c b/drivers/s390/block/dasd_alias.c
index 70a008c00522..148b1dd24070 100644
--- a/drivers/s390/block/dasd_alias.c
+++ b/drivers/s390/block/dasd_alias.c
@@ -152,6 +152,7 @@ static struct alias_lcu *_allocate_lcu(struct dasd_uid *uid)
 	INIT_WORK(&lcu->suc_data.worker, summary_unit_check_handling_work);
 	INIT_DELAYED_WORK(&lcu->ruac_data.dwork, lcu_update_work);
 	spin_lock_init(&lcu->lock);
+	init_completion(&lcu->lcu_setup);
 	return lcu;
 
 out_err4:
@@ -217,7 +218,7 @@ int dasd_alias_make_device_known_to_lcu(struct dasd_device *device)
 		spin_unlock_irqrestore(&aliastree.lock, flags);
 		newlcu = _allocate_lcu(uid);
 		if (IS_ERR(newlcu))
-			return PTR_ERR(lcu);
+			return PTR_ERR(newlcu);
 		spin_lock_irqsave(&aliastree.lock, flags);
 		lcu = _find_lcu(server, uid);
 		if (!lcu) {
@@ -240,6 +241,67 @@ int dasd_alias_make_device_known_to_lcu(struct dasd_device *device)
 }
 
 /*
+ * The first device to be registered on an LCU will have to do
+ * some additional setup steps to configure that LCU on the
+ * storage server. All further devices should wait with their
+ * initialization until the first device is done.
+ * To synchronize this work, the first device will call
+ * dasd_alias_lcu_setup_complete when it is done, and all
+ * other devices will wait for it with dasd_alias_wait_for_lcu_setup.
+ */
+void dasd_alias_lcu_setup_complete(struct dasd_device *device)
+{
+	struct dasd_eckd_private *private;
+	unsigned long flags;
+	struct alias_server *server;
+	struct alias_lcu *lcu;
+	struct dasd_uid *uid;
+
+	private = (struct dasd_eckd_private *) device->private;
+	uid = &private->uid;
+	lcu = NULL;
+	spin_lock_irqsave(&aliastree.lock, flags);
+	server = _find_server(uid);
+	if (server)
+		lcu = _find_lcu(server, uid);
+	spin_unlock_irqrestore(&aliastree.lock, flags);
+	if (!lcu) {
+		DBF_EVENT_DEVID(DBF_ERR, device->cdev,
+				"could not find lcu for %04x %02x",
+				uid->ssid, uid->real_unit_addr);
+		WARN_ON(1);
+		return;
+	}
+	complete_all(&lcu->lcu_setup);
+}
+
+void dasd_alias_wait_for_lcu_setup(struct dasd_device *device)
+{
+	struct dasd_eckd_private *private;
+	unsigned long flags;
+	struct alias_server *server;
+	struct alias_lcu *lcu;
+	struct dasd_uid *uid;
+
+	private = (struct dasd_eckd_private *) device->private;
+	uid = &private->uid;
+	lcu = NULL;
+	spin_lock_irqsave(&aliastree.lock, flags);
+	server = _find_server(uid);
+	if (server)
+		lcu = _find_lcu(server, uid);
+	spin_unlock_irqrestore(&aliastree.lock, flags);
+	if (!lcu) {
+		DBF_EVENT_DEVID(DBF_ERR, device->cdev,
+				"could not find lcu for %04x %02x",
+				uid->ssid, uid->real_unit_addr);
+		WARN_ON(1);
+		return;
+	}
+	wait_for_completion(&lcu->lcu_setup);
+}
+
+/*
  * This function removes a device from the scope of alias management.
  * The complicated part is to make sure that it is not in use by
  * any of the workers. If necessary cancel the work.
@@ -755,11 +817,11 @@ static void __stop_device_on_lcu(struct dasd_device *device,
 {
 	/* If pos == device then device is already locked! */
 	if (pos == device) {
-		pos->stopped |= DASD_STOPPED_SU;
+		dasd_device_set_stop_bits(pos, DASD_STOPPED_SU);
 		return;
 	}
 	spin_lock(get_ccwdev_lock(pos->cdev));
-	pos->stopped |= DASD_STOPPED_SU;
+	dasd_device_set_stop_bits(pos, DASD_STOPPED_SU);
 	spin_unlock(get_ccwdev_lock(pos->cdev));
 }
 
@@ -793,26 +855,26 @@ static void _unstop_all_devices_on_lcu(struct alias_lcu *lcu)
 
 	list_for_each_entry(device, &lcu->active_devices, alias_list) {
 		spin_lock_irqsave(get_ccwdev_lock(device->cdev), flags);
-		device->stopped &= ~DASD_STOPPED_SU;
+		dasd_device_remove_stop_bits(device, DASD_STOPPED_SU);
 		spin_unlock_irqrestore(get_ccwdev_lock(device->cdev), flags);
 	}
 
 	list_for_each_entry(device, &lcu->inactive_devices, alias_list) {
 		spin_lock_irqsave(get_ccwdev_lock(device->cdev), flags);
-		device->stopped &= ~DASD_STOPPED_SU;
+		dasd_device_remove_stop_bits(device, DASD_STOPPED_SU);
 		spin_unlock_irqrestore(get_ccwdev_lock(device->cdev), flags);
 	}
 
 	list_for_each_entry(pavgroup, &lcu->grouplist, group) {
 		list_for_each_entry(device, &pavgroup->baselist, alias_list) {
 			spin_lock_irqsave(get_ccwdev_lock(device->cdev), flags);
-			device->stopped &= ~DASD_STOPPED_SU;
+			dasd_device_remove_stop_bits(device, DASD_STOPPED_SU);
 			spin_unlock_irqrestore(get_ccwdev_lock(device->cdev),
 					       flags);
 		}
 		list_for_each_entry(device, &pavgroup->aliaslist, alias_list) {
 			spin_lock_irqsave(get_ccwdev_lock(device->cdev), flags);
-			device->stopped &= ~DASD_STOPPED_SU;
+			dasd_device_remove_stop_bits(device, DASD_STOPPED_SU);
 			spin_unlock_irqrestore(get_ccwdev_lock(device->cdev),
 					       flags);
 		}
@@ -836,7 +898,8 @@ static void summary_unit_check_handling_work(struct work_struct *work)
 
 	/* 2. reset summary unit check */
 	spin_lock_irqsave(get_ccwdev_lock(device->cdev), flags);
-	device->stopped &= ~(DASD_STOPPED_SU | DASD_STOPPED_PENDING);
+	dasd_device_remove_stop_bits(device,
+				     (DASD_STOPPED_SU | DASD_STOPPED_PENDING));
 	spin_unlock_irqrestore(get_ccwdev_lock(device->cdev), flags);
 	reset_summary_unit_check(lcu, device, suc_data->reason);
 
diff --git a/drivers/s390/block/dasd_diag.c b/drivers/s390/block/dasd_diag.c
index 4e49b4a6c880..6e14863f5c70 100644
--- a/drivers/s390/block/dasd_diag.c
+++ b/drivers/s390/block/dasd_diag.c
@@ -8,7 +8,7 @@
  *
  */
 
-#define KMSG_COMPONENT "dasd-diag"
+#define KMSG_COMPONENT "dasd"
 
 #include <linux/stddef.h>
 #include <linux/kernel.h>
@@ -24,7 +24,6 @@
 #include <asm/ebcdic.h>
 #include <asm/io.h>
 #include <asm/s390_ext.h>
-#include <asm/todclk.h>
 #include <asm/vtoc.h>
 #include <asm/diag.h>
 
@@ -145,9 +144,18 @@ dasd_diag_erp(struct dasd_device *device)
 
 	mdsk_term_io(device);
 	rc = mdsk_init_io(device, device->block->bp_block, 0, NULL);
+	if (rc == 4) {
+		if (!(device->features & DASD_FEATURE_READONLY)) {
+			pr_warning("%s: The access mode of a DIAG device "
+				   "changed to read-only\n",
+				   dev_name(&device->cdev->dev));
+			device->features |= DASD_FEATURE_READONLY;
+		}
+		rc = 0;
+	}
 	if (rc)
-		dev_warn(&device->cdev->dev, "DIAG ERP failed with "
-			    "rc=%d\n", rc);
+		pr_warning("%s: DIAG ERP failed with "
+			    "rc=%d\n", dev_name(&device->cdev->dev), rc);
 }
 
 /* Start a given request at the device. Return zero on success, non-zero
@@ -363,8 +371,9 @@ dasd_diag_check_device(struct dasd_device *device)
 		private->pt_block = 2;
 		break;
 	default:
-		dev_warn(&device->cdev->dev, "Device type %d is not supported "
-			    "in DIAG mode\n", private->rdc_data.vdev_class);
+		pr_warning("%s: Device type %d is not supported "
+			   "in DIAG mode\n", dev_name(&device->cdev->dev),
+			   private->rdc_data.vdev_class);
 		rc = -EOPNOTSUPP;
 		goto out;
 	}
@@ -405,8 +414,8 @@ dasd_diag_check_device(struct dasd_device *device)
 		private->iob.flaga = DASD_DIAG_FLAGA_DEFAULT;
 		rc = dia250(&private->iob, RW_BIO);
 		if (rc == 3) {
-			dev_warn(&device->cdev->dev,
-				"A 64-bit DIAG call failed\n");
+			pr_warning("%s: A 64-bit DIAG call failed\n",
+				   dev_name(&device->cdev->dev));
 			rc = -EOPNOTSUPP;
 			goto out_label;
 		}
@@ -415,8 +424,9 @@ dasd_diag_check_device(struct dasd_device *device)
 			break;
 	}
 	if (bsize > PAGE_SIZE) {
-		dev_warn(&device->cdev->dev, "Accessing the DASD failed because"
-			 " of an incorrect format (rc=%d)\n", rc);
+		pr_warning("%s: Accessing the DASD failed because of an "
+			   "incorrect format (rc=%d)\n",
+			   dev_name(&device->cdev->dev), rc);
 		rc = -EIO;
 		goto out_label;
 	}
@@ -433,16 +443,20 @@ dasd_diag_check_device(struct dasd_device *device)
 	for (sb = 512; sb < bsize; sb = sb << 1)
 		block->s2b_shift++;
 	rc = mdsk_init_io(device, block->bp_block, 0, NULL);
-	if (rc) {
-		dev_warn(&device->cdev->dev, "DIAG initialization "
-			"failed with rc=%d\n", rc);
+	if (rc && (rc != 4)) {
+		pr_warning("%s: DIAG initialization failed with rc=%d\n",
+			   dev_name(&device->cdev->dev), rc);
 		rc = -EIO;
 	} else {
-		dev_info(&device->cdev->dev,
-			 "New DASD with %ld byte/block, total size %ld KB\n",
-			 (unsigned long) block->bp_block,
-			 (unsigned long) (block->blocks <<
-					  block->s2b_shift) >> 1);
+		if (rc == 4)
+			device->features |= DASD_FEATURE_READONLY;
+		pr_info("%s: New DASD with %ld byte/block, total size %ld "
+			"KB%s\n", dev_name(&device->cdev->dev),
+			(unsigned long) block->bp_block,
+			(unsigned long) (block->blocks <<
+					 block->s2b_shift) >> 1,
+			(rc == 4) ? ", read-only device" : "");
+		rc = 0;
 	}
 out_label:
 	free_page((long) label);
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index 417b97cd3f94..1c500c462225 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -23,8 +23,8 @@
 #include <asm/debug.h>
 #include <asm/idals.h>
 #include <asm/ebcdic.h>
+#include <asm/compat.h>
 #include <asm/io.h>
-#include <asm/todclk.h>
 #include <asm/uaccess.h>
 #include <asm/cio.h>
 #include <asm/ccwdev.h>
@@ -78,6 +78,11 @@ MODULE_DEVICE_TABLE(ccw, dasd_eckd_ids);
 
 static struct ccw_driver dasd_eckd_driver; /* see below */
 
+#define INIT_CQR_OK 0
+#define INIT_CQR_UNFORMATTED 1
+#define INIT_CQR_ERROR 2
+
+
 /* initial attempt at a probe function. this can be simplified once
  * the other detection code is gone */
 static int
@@ -86,11 +91,12 @@ dasd_eckd_probe (struct ccw_device *cdev)
 	int ret;
 
 	/* set ECKD specific ccw-device options */
-	ret = ccw_device_set_options(cdev, CCWDEV_ALLOW_FORCE);
+	ret = ccw_device_set_options(cdev, CCWDEV_ALLOW_FORCE |
+				     CCWDEV_DO_PATHGROUP | CCWDEV_DO_MULTIPATH);
 	if (ret) {
-		DBF_EVENT(DBF_WARNING,
-		       "dasd_eckd_probe: could not set ccw-device options "
-		       "for %s\n", dev_name(&cdev->dev));
+		DBF_EVENT_DEVID(DBF_WARNING, cdev, "%s",
+				"dasd_eckd_probe: could not set "
+				"ccw-device options");
 		return ret;
 	}
 	ret = dasd_generic_probe(cdev, &dasd_eckd_discipline);
@@ -749,8 +755,7 @@ static struct dasd_ccw_req *dasd_eckd_build_rcd_lpm(struct dasd_device *device,
 	cqr->block = NULL;
 	cqr->expires = 10*HZ;
 	cqr->lpm = lpm;
-	clear_bit(DASD_CQR_FLAGS_USE_ERP, &cqr->flags);
-	cqr->retries = 2;
+	cqr->retries = 256;
 	cqr->buildclk = get_clock();
 	cqr->status = DASD_CQR_FILLED;
 	return cqr;
@@ -885,16 +890,15 @@ static int dasd_eckd_read_conf(struct dasd_device *device)
 			rc = dasd_eckd_read_conf_lpm(device, &conf_data,
 						     &conf_len, lpm);
 			if (rc && rc != -EOPNOTSUPP) {	/* -EOPNOTSUPP is ok */
-				DBF_EVENT(DBF_WARNING,
+				DBF_EVENT_DEVID(DBF_WARNING, device->cdev,
 					  "Read configuration data returned "
-					  "error %d for device: %s", rc,
-					  dev_name(&device->cdev->dev));
+					  "error %d", rc);
 				return rc;
 			}
 			if (conf_data == NULL) {
-				DBF_EVENT(DBF_WARNING, "No configuration "
-					  "data retrieved for device: %s",
-					  dev_name(&device->cdev->dev));
+				DBF_EVENT_DEVID(DBF_WARNING, device->cdev, "%s",
+						"No configuration data "
+						"retrieved");
 				continue;	/* no error */
 			}
 			/* save first valid configuration data */
@@ -941,16 +945,14 @@ static int dasd_eckd_read_features(struct dasd_device *device)
 				    sizeof(struct dasd_rssd_features)),
 				   device);
 	if (IS_ERR(cqr)) {
-		DBF_EVENT(DBF_WARNING, "Could not allocate initialization "
-			  "request for device: %s",
-			  dev_name(&device->cdev->dev));
+		DBF_EVENT_DEVID(DBF_WARNING, device->cdev, "%s", "Could not "
+				"allocate initialization request");
 		return PTR_ERR(cqr);
 	}
 	cqr->startdev = device;
 	cqr->memdev = device;
 	cqr->block = NULL;
-	clear_bit(DASD_CQR_FLAGS_USE_ERP, &cqr->flags);
-	cqr->retries = 5;
+	cqr->retries = 256;
 	cqr->expires = 10 * HZ;
 
 	/* Prepare for Read Subsystem Data */
@@ -1012,9 +1014,9 @@ static struct dasd_ccw_req *dasd_eckd_build_psf_ssc(struct dasd_device *device,
 	}
 	psf_ssc_data = (struct dasd_psf_ssc_data *)cqr->data;
 	psf_ssc_data->order = PSF_ORDER_SSC;
-	psf_ssc_data->suborder = 0x40;
+	psf_ssc_data->suborder = 0xc0;
 	if (enable_pav) {
-		psf_ssc_data->suborder |= 0x88;
+		psf_ssc_data->suborder |= 0x08;
 		psf_ssc_data->reserved[0] = 0x88;
 	}
 	ccw = cqr->cpaddr;
@@ -1025,6 +1027,7 @@ static struct dasd_ccw_req *dasd_eckd_build_psf_ssc(struct dasd_device *device,
 	cqr->startdev = device;
 	cqr->memdev = device;
 	cqr->block = NULL;
+	cqr->retries = 256;
 	cqr->expires = 10*HZ;
 	cqr->buildclk = get_clock();
 	cqr->status = DASD_CQR_FILLED;
@@ -1057,7 +1060,7 @@ dasd_eckd_psf_ssc(struct dasd_device *device, int enable_pav)
 /*
  * Valide storage server of current device.
  */
-static int dasd_eckd_validate_server(struct dasd_device *device)
+static void dasd_eckd_validate_server(struct dasd_device *device)
 {
 	int rc;
 	struct dasd_eckd_private *private;
@@ -1068,15 +1071,12 @@ static int dasd_eckd_validate_server(struct dasd_device *device)
 	else
 		enable_pav = 1;
 	rc = dasd_eckd_psf_ssc(device, enable_pav);
+
 	/* may be requested feature is not available on server,
 	 * therefore just report error and go ahead */
 	private = (struct dasd_eckd_private *) device->private;
-	DBF_EVENT(DBF_WARNING, "PSF-SSC on storage subsystem %s.%s.%04x "
-		  "returned rc=%d for device: %s",
-		  private->uid.vendor, private->uid.serial,
-		  private->uid.ssid, rc, dev_name(&device->cdev->dev));
-	/* RE-Read Configuration Data */
-	return dasd_eckd_read_conf(device);
+	DBF_EVENT_DEVID(DBF_WARNING, device->cdev, "PSF-SSC for SSID %04x "
+			"returned rc=%d", private->uid.ssid, rc);
 }
 
 /*
@@ -1090,6 +1090,15 @@ dasd_eckd_check_characteristics(struct dasd_device *device)
 	struct dasd_block *block;
 	int is_known, rc;
 
+	if (!ccw_device_is_pathgroup(device->cdev)) {
+		dev_warn(&device->cdev->dev,
+			 "A channel path group could not be established\n");
+		return -EIO;
+	}
+	if (!ccw_device_is_multipath(device->cdev)) {
+		dev_info(&device->cdev->dev,
+			 "The DASD is not operating in multipath mode\n");
+	}
 	private = (struct dasd_eckd_private *) device->private;
 	if (!private) {
 		private = kzalloc(sizeof(*private), GFP_KERNEL | GFP_DMA);
@@ -1123,9 +1132,9 @@ dasd_eckd_check_characteristics(struct dasd_device *device)
 	if (private->uid.type == UA_BASE_DEVICE) {
 		block = dasd_alloc_block();
 		if (IS_ERR(block)) {
-			DBF_EVENT(DBF_WARNING, "could not allocate dasd "
-				  "block structure for device: %s",
-				  dev_name(&device->cdev->dev));
+			DBF_EVENT_DEVID(DBF_WARNING, device->cdev, "%s",
+					"could not allocate dasd "
+					"block structure");
 			rc = PTR_ERR(block);
 			goto out_err1;
 		}
@@ -1139,12 +1148,21 @@ dasd_eckd_check_characteristics(struct dasd_device *device)
 		rc = is_known;
 		goto out_err2;
 	}
+	/*
+	 * dasd_eckd_vaildate_server is done on the first device that
+	 * is found for an LCU. All later other devices have to wait
+	 * for it, so they will read the correct feature codes.
+	 */
 	if (!is_known) {
-		/* new lcu found */
-		rc = dasd_eckd_validate_server(device); /* will switch pav on */
-		if (rc)
-			goto out_err3;
-	}
+		dasd_eckd_validate_server(device);
+		dasd_alias_lcu_setup_complete(device);
+	} else
+		dasd_alias_wait_for_lcu_setup(device);
+
+	/* device may report different configuration data after LCU setup */
+	rc = dasd_eckd_read_conf(device);
+	if (rc)
+		goto out_err3;
 
 	/* Read Feature Codes */
 	dasd_eckd_read_features(device);
@@ -1153,9 +1171,8 @@ dasd_eckd_check_characteristics(struct dasd_device *device)
 	rc = dasd_generic_read_dev_chars(device, DASD_ECKD_MAGIC,
 					 &private->rdc_data, 64);
 	if (rc) {
-		DBF_EVENT(DBF_WARNING,
-			  "Read device characteristics failed, rc=%d for "
-			  "device: %s", rc, dev_name(&device->cdev->dev));
+		DBF_EVENT_DEVID(DBF_WARNING, device->cdev,
+				"Read device characteristic failed, rc=%d", rc);
 		goto out_err3;
 	}
 	/* find the vaild cylinder size */
@@ -1256,12 +1273,29 @@ dasd_eckd_analysis_ccw(struct dasd_device *device)
 	cqr->block = NULL;
 	cqr->startdev = device;
 	cqr->memdev = device;
-	cqr->retries = 0;
+	cqr->retries = 255;
 	cqr->buildclk = get_clock();
 	cqr->status = DASD_CQR_FILLED;
 	return cqr;
 }
 
+/* differentiate between 'no record found' and any other error */
+static int dasd_eckd_analysis_evaluation(struct dasd_ccw_req *init_cqr)
+{
+	char *sense;
+	if (init_cqr->status == DASD_CQR_DONE)
+		return INIT_CQR_OK;
+	else if (init_cqr->status == DASD_CQR_NEED_ERP ||
+		 init_cqr->status == DASD_CQR_FAILED) {
+		sense = dasd_get_sense(&init_cqr->irb);
+		if (sense && (sense[1] & SNS1_NO_REC_FOUND))
+			return INIT_CQR_UNFORMATTED;
+		else
+			return INIT_CQR_ERROR;
+	} else
+		return INIT_CQR_ERROR;
+}
+
 /*
  * This is the callback function for the init_analysis cqr. It saves
  * the status of the initial analysis ccw before it frees it and kicks
@@ -1269,21 +1303,20 @@ dasd_eckd_analysis_ccw(struct dasd_device *device)
  * dasd_eckd_do_analysis again (if the devices has not been marked
  * for deletion in the meantime).
  */
-static void
-dasd_eckd_analysis_callback(struct dasd_ccw_req *init_cqr, void *data)
+static void dasd_eckd_analysis_callback(struct dasd_ccw_req *init_cqr,
+					void *data)
 {
 	struct dasd_eckd_private *private;
 	struct dasd_device *device;
 
 	device = init_cqr->startdev;
 	private = (struct dasd_eckd_private *) device->private;
-	private->init_cqr_status = init_cqr->status;
+	private->init_cqr_status = dasd_eckd_analysis_evaluation(init_cqr);
 	dasd_sfree_request(init_cqr, device);
 	dasd_kick_device(device);
 }
 
-static int
-dasd_eckd_start_analysis(struct dasd_block *block)
+static int dasd_eckd_start_analysis(struct dasd_block *block)
 {
 	struct dasd_eckd_private *private;
 	struct dasd_ccw_req *init_cqr;
@@ -1295,27 +1328,44 @@ dasd_eckd_start_analysis(struct dasd_block *block)
 	init_cqr->callback = dasd_eckd_analysis_callback;
 	init_cqr->callback_data = NULL;
 	init_cqr->expires = 5*HZ;
+	/* first try without ERP, so we can later handle unformatted
+	 * devices as special case
+	 */
+	clear_bit(DASD_CQR_FLAGS_USE_ERP, &init_cqr->flags);
+	init_cqr->retries = 0;
 	dasd_add_request_head(init_cqr);
 	return -EAGAIN;
 }
 
-static int
-dasd_eckd_end_analysis(struct dasd_block *block)
+static int dasd_eckd_end_analysis(struct dasd_block *block)
 {
 	struct dasd_device *device;
 	struct dasd_eckd_private *private;
 	struct eckd_count *count_area;
 	unsigned int sb, blk_per_trk;
 	int status, i;
+	struct dasd_ccw_req *init_cqr;
 
 	device = block->base;
 	private = (struct dasd_eckd_private *) device->private;
 	status = private->init_cqr_status;
 	private->init_cqr_status = -1;
-	if (status != DASD_CQR_DONE) {
-		dev_warn(&device->cdev->dev,
-			    "The DASD is not formatted\n");
+	if (status == INIT_CQR_ERROR) {
+		/* try again, this time with full ERP */
+		init_cqr = dasd_eckd_analysis_ccw(device);
+		dasd_sleep_on(init_cqr);
+		status = dasd_eckd_analysis_evaluation(init_cqr);
+		dasd_sfree_request(init_cqr, device);
+	}
+
+	if (status == INIT_CQR_UNFORMATTED) {
+		dev_warn(&device->cdev->dev, "The DASD is not formatted\n");
 		return -EMEDIUMTYPE;
+	} else if (status == INIT_CQR_ERROR) {
+		dev_err(&device->cdev->dev,
+			"Detecting the DASD disk layout failed because "
+			"of an I/O error\n");
+		return -EIO;
 	}
 
 	private->uses_cdl = 1;
@@ -1607,8 +1657,7 @@ dasd_eckd_format_device(struct dasd_device * device,
 	}
 	fcp->startdev = device;
 	fcp->memdev = device;
-	clear_bit(DASD_CQR_FLAGS_USE_ERP, &fcp->flags);
-	fcp->retries = 5;	/* set retry counter to enable default ERP */
+	fcp->retries = 256;
 	fcp->buildclk = get_clock();
 	fcp->status = DASD_CQR_FILLED;
 	return fcp;
@@ -2690,6 +2739,7 @@ dasd_eckd_performance(struct dasd_device *device, void __user *argp)
 	cqr->startdev = device;
 	cqr->memdev = device;
 	cqr->retries = 0;
+	clear_bit(DASD_CQR_FLAGS_USE_ERP, &cqr->flags);
 	cqr->expires = 10 * HZ;
 
 	/* Prepare for Read Subsystem Data */
@@ -2795,13 +2845,16 @@ static int dasd_symm_io(struct dasd_device *device, void __user *argp)
 	rc = -EFAULT;
 	if (copy_from_user(&usrparm, argp, sizeof(usrparm)))
 		goto out;
-#ifndef CONFIG_64BIT
-	/* Make sure pointers are sane even on 31 bit. */
-	if ((usrparm.psf_data >> 32) != 0 || (usrparm.rssd_result >> 32) != 0) {
+	if (is_compat_task() || sizeof(long) == 4) {
+		/* Make sure pointers are sane even on 31 bit. */
 		rc = -EINVAL;
-		goto out;
+		if ((usrparm.psf_data >> 32) != 0)
+			goto out;
+		if ((usrparm.rssd_result >> 32) != 0)
+			goto out;
+		usrparm.psf_data &= 0x7fffffffULL;
+		usrparm.rssd_result &= 0x7fffffffULL;
 	}
-#endif
 	/* alloc I/O data area */
 	psf_data = kzalloc(usrparm.psf_data_len, GFP_KERNEL | GFP_DMA);
 	rssd_result = kzalloc(usrparm.rssd_result_len, GFP_KERNEL | GFP_DMA);
@@ -3240,11 +3293,15 @@ int dasd_eckd_restore_device(struct dasd_device *device)
 	if (is_known < 0)
 		return is_known;
 	if (!is_known) {
-		/* new lcu found */
-		rc = dasd_eckd_validate_server(device); /* will switch pav on */
-		if (rc)
-			goto out_err;
-	}
+		dasd_eckd_validate_server(device);
+		dasd_alias_lcu_setup_complete(device);
+	} else
+		dasd_alias_wait_for_lcu_setup(device);
+
+	/* RE-Read Configuration Data */
+	rc = dasd_eckd_read_conf(device);
+	if (rc)
+		goto out_err;
 
 	/* Read Feature Codes */
 	dasd_eckd_read_features(device);
@@ -3253,9 +3310,8 @@ int dasd_eckd_restore_device(struct dasd_device *device)
 	rc = dasd_generic_read_dev_chars(device, DASD_ECKD_MAGIC,
 					 &temp_rdc_data, 64);
 	if (rc) {
-		DBF_EVENT(DBF_WARNING,
-			  "Read device characteristics failed, rc=%d for "
-			  "device: %s", rc, dev_name(&device->cdev->dev));
+		DBF_EVENT_DEVID(DBF_WARNING, device->cdev,
+				"Read device characteristic failed, rc=%d", rc);
 		goto out_err;
 	}
 	spin_lock_irqsave(get_ccwdev_lock(device->cdev), flags);
diff --git a/drivers/s390/block/dasd_eckd.h b/drivers/s390/block/dasd_eckd.h
index ad45bcac3ce4..864d53c04201 100644
--- a/drivers/s390/block/dasd_eckd.h
+++ b/drivers/s390/block/dasd_eckd.h
@@ -414,6 +414,7 @@ struct alias_lcu {
 	struct summary_unit_check_work_data suc_data;
 	struct read_uac_work_data ruac_data;
 	struct dasd_ccw_req *rsu_cqr;
+	struct completion lcu_setup;
 };
 
 struct alias_pav_group {
@@ -460,5 +461,6 @@ int dasd_alias_remove_device(struct dasd_device *);
 struct dasd_device *dasd_alias_get_start_dev(struct dasd_device *);
 void dasd_alias_handle_summary_unit_check(struct dasd_device *, struct irb *);
 void dasd_eckd_reset_ccw_to_base_io(struct dasd_ccw_req *);
-
+void dasd_alias_lcu_setup_complete(struct dasd_device *);
+void dasd_alias_wait_for_lcu_setup(struct dasd_device *);
 #endif				/* DASD_ECKD_H */
diff --git a/drivers/s390/block/dasd_eer.c b/drivers/s390/block/dasd_eer.c
index d96039eae59b..1f3e967aaba8 100644
--- a/drivers/s390/block/dasd_eer.c
+++ b/drivers/s390/block/dasd_eer.c
@@ -536,7 +536,6 @@ static int dasd_eer_open(struct inode *inp, struct file *filp)
 	eerb = kzalloc(sizeof(struct eerbuffer), GFP_KERNEL);
 	if (!eerb)
 		return -ENOMEM;
-	lock_kernel();
 	eerb->buffer_page_count = eer_pages;
 	if (eerb->buffer_page_count < 1 ||
 	    eerb->buffer_page_count > INT_MAX / PAGE_SIZE) {
@@ -544,7 +543,6 @@ static int dasd_eer_open(struct inode *inp, struct file *filp)
 		DBF_EVENT(DBF_WARNING, "can't open device since module "
 			"parameter eer_pages is smaller than 1 or"
 			" bigger than %d", (int)(INT_MAX / PAGE_SIZE));
-		unlock_kernel();
 		return -EINVAL;
 	}
 	eerb->buffersize = eerb->buffer_page_count * PAGE_SIZE;
@@ -552,14 +550,12 @@ static int dasd_eer_open(struct inode *inp, struct file *filp)
 			       GFP_KERNEL);
         if (!eerb->buffer) {
 		kfree(eerb);
-		unlock_kernel();
                 return -ENOMEM;
 	}
 	if (dasd_eer_allocate_buffer_pages(eerb->buffer,
 					   eerb->buffer_page_count)) {
 		kfree(eerb->buffer);
 		kfree(eerb);
-		unlock_kernel();
 		return -ENOMEM;
 	}
 	filp->private_data = eerb;
@@ -567,7 +563,6 @@ static int dasd_eer_open(struct inode *inp, struct file *filp)
 	list_add(&eerb->list, &bufferlist);
 	spin_unlock_irqrestore(&bufferlock, flags);
 
-	unlock_kernel();
 	return nonseekable_open(inp,filp);
 }
 
diff --git a/drivers/s390/block/dasd_fba.c b/drivers/s390/block/dasd_fba.c
index f245377e8e27..0f152444ac77 100644
--- a/drivers/s390/block/dasd_fba.c
+++ b/drivers/s390/block/dasd_fba.c
@@ -20,7 +20,6 @@
 #include <asm/idals.h>
 #include <asm/ebcdic.h>
 #include <asm/io.h>
-#include <asm/todclk.h>
 #include <asm/ccwdev.h>
 
 #include "dasd_int.h"
@@ -141,9 +140,8 @@ dasd_fba_check_characteristics(struct dasd_device *device)
 	}
 	block = dasd_alloc_block();
 	if (IS_ERR(block)) {
-		DBF_EVENT(DBF_WARNING, "could not allocate dasd block "
-			  "structure for device: %s",
-			  dev_name(&device->cdev->dev));
+		DBF_EVENT_DEVID(DBF_WARNING, cdev, "%s", "could not allocate "
+				"dasd block structure");
 		device->private = NULL;
 		kfree(private);
 		return PTR_ERR(block);
@@ -155,9 +153,8 @@ dasd_fba_check_characteristics(struct dasd_device *device)
 	rc = dasd_generic_read_dev_chars(device, DASD_FBA_MAGIC,
 					 &private->rdc_data, 32);
 	if (rc) {
-		DBF_EVENT(DBF_WARNING, "Read device characteristics returned "
-			  "error %d for device: %s",
-			  rc, dev_name(&device->cdev->dev));
+		DBF_EVENT_DEVID(DBF_WARNING, cdev, "Read device "
+				"characteristics returned error %d", rc);
 		device->block = NULL;
 		dasd_free_block(block);
 		device->private = NULL;
diff --git a/drivers/s390/block/dasd_int.h b/drivers/s390/block/dasd_int.h
index 8afd9fa00875..e4c2143dabf6 100644
--- a/drivers/s390/block/dasd_int.h
+++ b/drivers/s390/block/dasd_int.h
@@ -108,6 +108,16 @@ do { \
 			    d_data); \
 } while(0)
 
+#define DBF_EVENT_DEVID(d_level, d_cdev, d_str, d_data...)	\
+do { \
+	struct ccw_dev_id __dev_id;			\
+	ccw_device_get_id(d_cdev, &__dev_id);		\
+	debug_sprintf_event(dasd_debug_area,		\
+			    d_level,					\
+			    "0.%x.%04x " d_str "\n",			\
+			    __dev_id.ssid, __dev_id.devno, d_data);	\
+} while (0)
+
 #define DBF_EXC(d_level, d_str, d_data...)\
 do { \
 	debug_sprintf_exception(dasd_debug_area, \
@@ -595,6 +605,9 @@ int dasd_generic_restore_device(struct ccw_device *);
 int dasd_generic_read_dev_chars(struct dasd_device *, int, void *, int);
 char *dasd_get_sense(struct irb *);
 
+void dasd_device_set_stop_bits(struct dasd_device *, int);
+void dasd_device_remove_stop_bits(struct dasd_device *, int);
+
 /* externals in dasd_devmap.c */
 extern int dasd_max_devindex;
 extern int dasd_probeonly;
diff --git a/drivers/s390/block/dasd_ioctl.c b/drivers/s390/block/dasd_ioctl.c
index f756a1b0c57a..fc7b30b4a255 100644
--- a/drivers/s390/block/dasd_ioctl.c
+++ b/drivers/s390/block/dasd_ioctl.c
@@ -17,7 +17,7 @@
 #include <linux/fs.h>
 #include <linux/blkpg.h>
 #include <linux/smp_lock.h>
-
+#include <asm/compat.h>
 #include <asm/ccwdev.h>
 #include <asm/cmb.h>
 #include <asm/uaccess.h>
@@ -101,7 +101,7 @@ static int dasd_ioctl_quiesce(struct dasd_block *block)
 	pr_info("%s: The DASD has been put in the quiesce "
 		"state\n", dev_name(&base->cdev->dev));
 	spin_lock_irqsave(get_ccwdev_lock(base->cdev), flags);
-	base->stopped |= DASD_STOPPED_QUIESCE;
+	dasd_device_set_stop_bits(base, DASD_STOPPED_QUIESCE);
 	spin_unlock_irqrestore(get_ccwdev_lock(base->cdev), flags);
 	return 0;
 }
@@ -122,7 +122,7 @@ static int dasd_ioctl_resume(struct dasd_block *block)
 	pr_info("%s: I/O operations have been resumed "
 		"on the DASD\n", dev_name(&base->cdev->dev));
 	spin_lock_irqsave(get_ccwdev_lock(base->cdev), flags);
-	base->stopped &= ~DASD_STOPPED_QUIESCE;
+	dasd_device_remove_stop_bits(base, DASD_STOPPED_QUIESCE);
 	spin_unlock_irqrestore(get_ccwdev_lock(base->cdev), flags);
 
 	dasd_schedule_block_bh(block);
@@ -358,9 +358,8 @@ dasd_ioctl_set_ro(struct block_device *bdev, void __user *argp)
 }
 
 static int dasd_ioctl_readall_cmb(struct dasd_block *block, unsigned int cmd,
-		unsigned long arg)
+				  struct cmbdata __user *argp)
 {
-	struct cmbdata __user *argp = (void __user *) arg;
 	size_t size = _IOC_SIZE(cmd);
 	struct cmbdata data;
 	int ret;
@@ -376,7 +375,12 @@ dasd_do_ioctl(struct block_device *bdev, fmode_t mode,
 	      unsigned int cmd, unsigned long arg)
 {
 	struct dasd_block *block = bdev->bd_disk->private_data;
-	void __user *argp = (void __user *)arg;
+	void __user *argp;
+
+	if (is_compat_task())
+		argp = compat_ptr(arg);
+	else
+		argp = (void __user *)arg;
 
 	if (!block)
                 return -ENODEV;
@@ -414,7 +418,7 @@ dasd_do_ioctl(struct block_device *bdev, fmode_t mode,
 	case BIODASDCMFDISABLE:
 		return disable_cmf(block->base->cdev);
 	case BIODASDREADALLCMB:
-		return dasd_ioctl_readall_cmb(block, cmd, arg);
+		return dasd_ioctl_readall_cmb(block, cmd, argp);
 	default:
 		/* if the discipline has an ioctl method try it. */
 		if (block->base->discipline->ioctl) {
diff --git a/drivers/s390/block/dasd_proc.c b/drivers/s390/block/dasd_proc.c
index 654daa3cdfda..6315fbd8e68b 100644
--- a/drivers/s390/block/dasd_proc.c
+++ b/drivers/s390/block/dasd_proc.c
@@ -14,6 +14,7 @@
 #define KMSG_COMPONENT "dasd"
 
 #include <linux/ctype.h>
+#include <linux/string.h>
 #include <linux/seq_file.h>
 #include <linux/vmalloc.h>
 #include <linux/proc_fs.h>
@@ -215,7 +216,7 @@ dasd_statistics_read(char *page, char **start, off_t off,
 	}
 
 	prof = &dasd_global_profile;
-	/* prevent couter 'overflow' on output */
+	/* prevent counter 'overflow' on output */
 	for (factor = 1; (prof->dasd_io_reqs / factor) > 9999999;
 	     factor *= 10);
 
@@ -272,10 +273,10 @@ dasd_statistics_write(struct file *file, const char __user *user_buf,
 	DBF_EVENT(DBF_DEBUG, "/proc/dasd/statictics: '%s'\n", buffer);
 
 	/* check for valid verbs */
-	for (str = buffer; isspace(*str); str++);
+	str = skip_spaces(buffer);
 	if (strncmp(str, "set", 3) == 0 && isspace(str[3])) {
 		/* 'set xxx' was given */
-		for (str = str + 4; isspace(*str); str++);
+		str = skip_spaces(str + 4);
 		if (strcmp(str, "on") == 0) {
 			/* switch on statistics profiling */
 			dasd_profile_level = DASD_PROFILE_ON;
diff --git a/drivers/s390/block/dcssblk.c b/drivers/s390/block/dcssblk.c
index f76f4bd82b9f..9b43ae94beba 100644
--- a/drivers/s390/block/dcssblk.c
+++ b/drivers/s390/block/dcssblk.c
@@ -1005,7 +1005,7 @@ static int dcssblk_thaw(struct device *dev)
 	return 0;
 }
 
-static struct dev_pm_ops dcssblk_pm_ops = {
+static const struct dev_pm_ops dcssblk_pm_ops = {
 	.freeze		= dcssblk_freeze,
 	.thaw		= dcssblk_thaw,
 	.restore	= dcssblk_restore,
diff --git a/drivers/s390/block/xpram.c b/drivers/s390/block/xpram.c
index 116d1b3eeb15..118de392af63 100644
--- a/drivers/s390/block/xpram.c
+++ b/drivers/s390/block/xpram.c
@@ -407,7 +407,7 @@ static int xpram_restore(struct device *dev)
 	return 0;
 }
 
-static struct dev_pm_ops xpram_pm_ops = {
+static const struct dev_pm_ops xpram_pm_ops = {
 	.restore	= xpram_restore,
 };
 
diff --git a/drivers/s390/char/con3215.c b/drivers/s390/char/con3215.c
index 21639d6c996f..59ec073724bf 100644
--- a/drivers/s390/char/con3215.c
+++ b/drivers/s390/char/con3215.c
@@ -857,7 +857,6 @@ static struct console con3215 = {
 
 /*
  * 3215 console initialization code called from console_init().
- * NOTE: This is called before kmalloc is available.
  */
 static int __init con3215_init(void)
 {
@@ -1038,22 +1037,6 @@ static void tty3215_flush_buffer(struct tty_struct *tty)
 }
 
 /*
- * Currently we don't have any io controls for 3215 ttys
- */
-static int tty3215_ioctl(struct tty_struct *tty, struct file * file,
-			 unsigned int cmd, unsigned long arg)
-{
-	if (tty->flags & (1 << TTY_IO_ERROR))
-		return -EIO;
-
-	switch (cmd) {
-	default:
-		return -ENOIOCTLCMD;
-	}
-	return 0;
-}
-
-/*
  * Disable reading from a 3215 tty
  */
 static void tty3215_throttle(struct tty_struct * tty)
@@ -1118,7 +1101,6 @@ static const struct tty_operations tty3215_ops = {
 	.write_room = tty3215_write_room,
 	.chars_in_buffer = tty3215_chars_in_buffer,
 	.flush_buffer = tty3215_flush_buffer,
-	.ioctl = tty3215_ioctl,
 	.throttle = tty3215_throttle,
 	.unthrottle = tty3215_unthrottle,
 	.stop = tty3215_stop,
diff --git a/drivers/s390/char/con3270.c b/drivers/s390/char/con3270.c
index bb838bdf829d..6bca81aea396 100644
--- a/drivers/s390/char/con3270.c
+++ b/drivers/s390/char/con3270.c
@@ -572,7 +572,6 @@ static struct console con3270 = {
 
 /*
  * 3270 console initialization code called from console_init().
- * NOTE: This is called before kmalloc is available.
  */
 static int __init
 con3270_init(void)
diff --git a/drivers/s390/char/fs3270.c b/drivers/s390/char/fs3270.c
index 097d3846a828..31c59b0d6df0 100644
--- a/drivers/s390/char/fs3270.c
+++ b/drivers/s390/char/fs3270.c
@@ -15,6 +15,7 @@
 #include <linux/types.h>
 #include <linux/smp_lock.h>
 
+#include <asm/compat.h>
 #include <asm/ccwdev.h>
 #include <asm/cio.h>
 #include <asm/ebcdic.h>
@@ -38,6 +39,8 @@ struct fs3270 {
 	size_t rdbuf_size;		/* size of data returned by RDBUF */
 };
 
+static DEFINE_MUTEX(fs3270_mutex);
+
 static void
 fs3270_wake_up(struct raw3270_request *rq, void *data)
 {
@@ -74,7 +77,7 @@ fs3270_do_io(struct raw3270_view *view, struct raw3270_request *rq)
 		}
 		rc = raw3270_start(view, rq);
 		if (rc == 0) {
-			/* Started sucessfully. Now wait for completion. */
+			/* Started successfully. Now wait for completion. */
 			wait_event(fp->wait, raw3270_request_final(rq));
 		}
 	} while (rc == -EACCES);
@@ -320,6 +323,7 @@ fs3270_write(struct file *filp, const char __user *data, size_t count, loff_t *o
 static long
 fs3270_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 {
+	char __user *argp;
 	struct fs3270 *fp;
 	struct raw3270_iocb iocb;
 	int rc;
@@ -327,8 +331,12 @@ fs3270_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 	fp = filp->private_data;
 	if (!fp)
 		return -ENODEV;
+	if (is_compat_task())
+		argp = compat_ptr(arg);
+	else
+		argp = (char __user *)arg;
 	rc = 0;
-	lock_kernel();
+	mutex_lock(&fs3270_mutex);
 	switch (cmd) {
 	case TUBICMD:
 		fp->read_command = arg;
@@ -337,10 +345,10 @@ fs3270_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 		fp->write_command = arg;
 		break;
 	case TUBGETI:
-		rc = put_user(fp->read_command, (char __user *) arg);
+		rc = put_user(fp->read_command, argp);
 		break;
 	case TUBGETO:
-		rc = put_user(fp->write_command,(char __user *) arg);
+		rc = put_user(fp->write_command, argp);
 		break;
 	case TUBGETMOD:
 		iocb.model = fp->view.model;
@@ -349,12 +357,11 @@ fs3270_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 		iocb.pf_cnt = 24;
 		iocb.re_cnt = 20;
 		iocb.map = 0;
-		if (copy_to_user((char __user *) arg, &iocb,
-				 sizeof(struct raw3270_iocb)))
+		if (copy_to_user(argp, &iocb, sizeof(struct raw3270_iocb)))
 			rc = -EFAULT;
 		break;
 	}
-	unlock_kernel();
+	mutex_unlock(&fs3270_mutex);
 	return rc;
 }
 
@@ -437,7 +444,7 @@ fs3270_open(struct inode *inode, struct file *filp)
 		minor = tty->index + RAW3270_FIRSTMINOR;
 		tty_kref_put(tty);
 	}
-	lock_kernel();
+	mutex_lock(&fs3270_mutex);
 	/* Check if some other program is already using fullscreen mode. */
 	fp = (struct fs3270 *) raw3270_find_view(&fs3270_fn, minor);
 	if (!IS_ERR(fp)) {
@@ -465,7 +472,7 @@ fs3270_open(struct inode *inode, struct file *filp)
 	if (IS_ERR(ib)) {
 		raw3270_put_view(&fp->view);
 		raw3270_del_view(&fp->view);
-		rc = PTR_ERR(fp);
+		rc = PTR_ERR(ib);
 		goto out;
 	}
 	fp->rdbuf = ib;
@@ -478,7 +485,7 @@ fs3270_open(struct inode *inode, struct file *filp)
 	}
 	filp->private_data = fp;
 out:
-	unlock_kernel();
+	mutex_unlock(&fs3270_mutex);
 	return rc;
 }
 
@@ -509,8 +516,8 @@ static const struct file_operations fs3270_fops = {
 	.write		 = fs3270_write,	/* write */
 	.unlocked_ioctl	 = fs3270_ioctl,	/* ioctl */
 	.compat_ioctl	 = fs3270_ioctl,	/* ioctl */
-	.open	 	= fs3270_open,		/* open */
-	.release 	= fs3270_close,		/* release */
+	.open		 = fs3270_open,		/* open */
+	.release	 = fs3270_close,	/* release */
 };
 
 /*
diff --git a/drivers/s390/char/monreader.c b/drivers/s390/char/monreader.c
index 66e21dd23154..33e96484d54f 100644
--- a/drivers/s390/char/monreader.c
+++ b/drivers/s390/char/monreader.c
@@ -12,7 +12,6 @@
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/init.h>
-#include <linux/smp_lock.h>
 #include <linux/errno.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
@@ -283,7 +282,6 @@ static int mon_open(struct inode *inode, struct file *filp)
 	/*
 	 * only one user allowed
 	 */
-	lock_kernel();
 	rc = -EBUSY;
 	if (test_and_set_bit(MON_IN_USE, &mon_in_use))
 		goto out;
@@ -321,7 +319,6 @@ static int mon_open(struct inode *inode, struct file *filp)
 	}
 	filp->private_data = monpriv;
 	dev_set_drvdata(monreader_device, monpriv);
-	unlock_kernel();
 	return nonseekable_open(inode, filp);
 
 out_path:
@@ -331,7 +328,6 @@ out_priv:
 out_use:
 	clear_bit(MON_IN_USE, &mon_in_use);
 out:
-	unlock_kernel();
 	return rc;
 }
 
@@ -533,7 +529,7 @@ static int monreader_restore(struct device *dev)
 	return monreader_thaw(dev);
 }
 
-static struct dev_pm_ops monreader_pm_ops = {
+static const struct dev_pm_ops monreader_pm_ops = {
 	.freeze  = monreader_freeze,
 	.thaw	 = monreader_thaw,
 	.restore = monreader_restore,
@@ -607,6 +603,10 @@ static int __init mon_init(void)
 	}
 	dcss_mkname(mon_dcss_name, &user_data_connect[8]);
 
+	/*
+	 * misc_register() has to be the last action in module_init(), because
+	 * file operations will be available right after this.
+	 */
 	rc = misc_register(&mon_dev);
 	if (rc < 0 )
 		goto out;
diff --git a/drivers/s390/char/monwriter.c b/drivers/s390/char/monwriter.c
index 66fb8eba93f4..668a0579b26b 100644
--- a/drivers/s390/char/monwriter.c
+++ b/drivers/s390/char/monwriter.c
@@ -13,7 +13,6 @@
 #include <linux/moduleparam.h>
 #include <linux/init.h>
 #include <linux/errno.h>
-#include <linux/smp_lock.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/miscdevice.h>
@@ -185,13 +184,11 @@ static int monwrite_open(struct inode *inode, struct file *filp)
 	monpriv = kzalloc(sizeof(struct mon_private), GFP_KERNEL);
 	if (!monpriv)
 		return -ENOMEM;
-	lock_kernel();
 	INIT_LIST_HEAD(&monpriv->list);
 	monpriv->hdr_to_read = sizeof(monpriv->hdr);
 	mutex_init(&monpriv->thread_mutex);
 	filp->private_data = monpriv;
 	list_add_tail(&monpriv->priv_list, &mon_priv_list);
-	unlock_kernel();
 	return nonseekable_open(inode, filp);
 }
 
@@ -326,7 +323,7 @@ static int monwriter_thaw(struct device *dev)
 	return monwriter_restore(dev);
 }
 
-static struct dev_pm_ops monwriter_pm_ops = {
+static const struct dev_pm_ops monwriter_pm_ops = {
 	.freeze		= monwriter_freeze,
 	.thaw		= monwriter_thaw,
 	.restore	= monwriter_restore,
@@ -364,6 +361,10 @@ static int __init mon_init(void)
 		goto out_driver;
 	}
 
+	/*
+	 * misc_register() has to be the last action in module_init(), because
+	 * file operations will be available right after this.
+	 */
 	rc = misc_register(&mon_dev);
 	if (rc)
 		goto out_device;
diff --git a/drivers/s390/char/sclp.c b/drivers/s390/char/sclp.c
index a983f5086788..ec88c59842e3 100644
--- a/drivers/s390/char/sclp.c
+++ b/drivers/s390/char/sclp.c
@@ -1019,7 +1019,7 @@ static int sclp_restore(struct device *dev)
 	return sclp_undo_suspend(SCLP_PM_EVENT_RESTORE);
 }
 
-static struct dev_pm_ops sclp_pm_ops = {
+static const struct dev_pm_ops sclp_pm_ops = {
 	.freeze		= sclp_freeze,
 	.thaw		= sclp_thaw,
 	.restore	= sclp_restore,
diff --git a/drivers/s390/char/sclp_cmd.c b/drivers/s390/char/sclp_cmd.c
index 5cc11c636d38..b3beab610da4 100644
--- a/drivers/s390/char/sclp_cmd.c
+++ b/drivers/s390/char/sclp_cmd.c
@@ -84,6 +84,7 @@ static void __init sclp_read_info_early(void)
 		do {
 			memset(sccb, 0, sizeof(*sccb));
 			sccb->header.length = sizeof(*sccb);
+			sccb->header.function_code = 0x80;
 			sccb->header.control_mask[2] = 0x80;
 			rc = sclp_cmd_sync_early(commands[i], sccb);
 		} while (rc == -EBUSY);
@@ -546,7 +547,7 @@ struct read_storage_sccb {
 	u32 entries[0];
 } __packed;
 
-static struct dev_pm_ops sclp_mem_pm_ops = {
+static const struct dev_pm_ops sclp_mem_pm_ops = {
 	.freeze		= sclp_mem_freeze,
 };
 
diff --git a/drivers/s390/char/tape.h b/drivers/s390/char/tape.h
index a26333774701..7a242f073632 100644
--- a/drivers/s390/char/tape.h
+++ b/drivers/s390/char/tape.h
@@ -212,6 +212,9 @@ struct tape_device {
 	struct tape_class_device *	nt;
 	struct tape_class_device *	rt;
 
+	/* Device mutex to serialize tape commands. */
+	struct mutex			mutex;
+
 	/* Device discipline information. */
 	struct tape_discipline *	discipline;
 	void *				discdata;
@@ -292,9 +295,9 @@ extern int tape_generic_pm_suspend(struct ccw_device *);
 extern int tape_generic_probe(struct ccw_device *);
 extern void tape_generic_remove(struct ccw_device *);
 
-extern struct tape_device *tape_get_device(int devindex);
-extern struct tape_device *tape_get_device_reference(struct tape_device *);
-extern struct tape_device *tape_put_device(struct tape_device *);
+extern struct tape_device *tape_find_device(int devindex);
+extern struct tape_device *tape_get_device(struct tape_device *);
+extern void tape_put_device(struct tape_device *);
 
 /* Externals from tape_char.c */
 extern int tapechar_init(void);
diff --git a/drivers/s390/char/tape_34xx.c b/drivers/s390/char/tape_34xx.c
index 2fe45ff77b75..cb70fa1cf539 100644
--- a/drivers/s390/char/tape_34xx.c
+++ b/drivers/s390/char/tape_34xx.c
@@ -9,6 +9,7 @@
  */
 
 #define KMSG_COMPONENT "tape_34xx"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
 
 #include <linux/module.h>
 #include <linux/init.h>
@@ -113,16 +114,16 @@ tape_34xx_work_handler(struct work_struct *work)
 {
 	struct tape_34xx_work *p =
 		container_of(work, struct tape_34xx_work, work);
+	struct tape_device *device = p->device;
 
 	switch(p->op) {
 		case TO_MSEN:
-			tape_34xx_medium_sense(p->device);
+			tape_34xx_medium_sense(device);
 			break;
 		default:
 			DBF_EVENT(3, "T34XX: internal error: unknown work\n");
 	}
-
-	p->device = tape_put_device(p->device);
+	tape_put_device(device);
 	kfree(p);
 }
 
@@ -136,7 +137,7 @@ tape_34xx_schedule_work(struct tape_device *device, enum tape_op op)
 
 	INIT_WORK(&p->work, tape_34xx_work_handler);
 
-	p->device = tape_get_device_reference(device);
+	p->device = tape_get_device(device);
 	p->op     = op;
 
 	schedule_work(&p->work);
diff --git a/drivers/s390/char/tape_3590.c b/drivers/s390/char/tape_3590.c
index e4cc3aae9162..9821c5886613 100644
--- a/drivers/s390/char/tape_3590.c
+++ b/drivers/s390/char/tape_3590.c
@@ -9,6 +9,7 @@
  */
 
 #define KMSG_COMPONENT "tape_3590"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
 
 #include <linux/module.h>
 #include <linux/init.h>
@@ -136,7 +137,7 @@ static void int_to_ext_kekl(struct tape3592_kekl *in,
 		out->type_on_tape = TAPE390_KEKL_TYPE_LABEL;
 	memcpy(out->label, in->label, sizeof(in->label));
 	EBCASC(out->label, sizeof(in->label));
-	strstrip(out->label);
+	strim(out->label);
 }
 
 static void int_to_ext_kekl_pair(struct tape3592_kekl_pair *in,
@@ -608,7 +609,7 @@ tape_3590_schedule_work(struct tape_device *device, enum tape_op op)
 
 	INIT_WORK(&p->work, tape_3590_work_handler);
 
-	p->device = tape_get_device_reference(device);
+	p->device = tape_get_device(device);
 	p->op = op;
 
 	schedule_work(&p->work);
diff --git a/drivers/s390/char/tape_block.c b/drivers/s390/char/tape_block.c
index 0c0705b91c28..8d3d720737da 100644
--- a/drivers/s390/char/tape_block.c
+++ b/drivers/s390/char/tape_block.c
@@ -11,6 +11,7 @@
  */
 
 #define KMSG_COMPONENT "tape"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
 
 #include <linux/fs.h>
 #include <linux/module.h>
@@ -45,8 +46,6 @@
  */
 static int tapeblock_open(struct block_device *, fmode_t);
 static int tapeblock_release(struct gendisk *, fmode_t);
-static int tapeblock_ioctl(struct block_device *, fmode_t, unsigned int,
-				unsigned long);
 static int tapeblock_medium_changed(struct gendisk *);
 static int tapeblock_revalidate_disk(struct gendisk *);
 
@@ -54,7 +53,6 @@ static const struct block_device_operations tapeblock_fops = {
 	.owner		 = THIS_MODULE,
 	.open		 = tapeblock_open,
 	.release	 = tapeblock_release,
-	.locked_ioctl           = tapeblock_ioctl,
 	.media_changed   = tapeblock_medium_changed,
 	.revalidate_disk = tapeblock_revalidate_disk,
 };
@@ -239,7 +237,7 @@ tapeblock_setup_device(struct tape_device * device)
 	disk->major = tapeblock_major;
 	disk->first_minor = device->first_minor;
 	disk->fops = &tapeblock_fops;
-	disk->private_data = tape_get_device_reference(device);
+	disk->private_data = tape_get_device(device);
 	disk->queue = blkdat->request_queue;
 	set_capacity(disk, 0);
 	sprintf(disk->disk_name, "btibm%d",
@@ -247,11 +245,11 @@ tapeblock_setup_device(struct tape_device * device)
 
 	blkdat->disk = disk;
 	blkdat->medium_changed = 1;
-	blkdat->request_queue->queuedata = tape_get_device_reference(device);
+	blkdat->request_queue->queuedata = tape_get_device(device);
 
 	add_disk(disk);
 
-	tape_get_device_reference(device);
+	tape_get_device(device);
 	INIT_WORK(&blkdat->requeue_task, tapeblock_requeue);
 
 	return 0;
@@ -274,13 +272,14 @@ tapeblock_cleanup_device(struct tape_device *device)
 	}
 
 	del_gendisk(device->blk_data.disk);
-	device->blk_data.disk->private_data =
-		tape_put_device(device->blk_data.disk->private_data);
+	device->blk_data.disk->private_data = NULL;
+	tape_put_device(device);
 	put_disk(device->blk_data.disk);
 
 	device->blk_data.disk = NULL;
 cleanup_queue:
-	device->blk_data.request_queue->queuedata = tape_put_device(device);
+	device->blk_data.request_queue->queuedata = NULL;
+	tape_put_device(device);
 
 	blk_cleanup_queue(device->blk_data.request_queue);
 	device->blk_data.request_queue = NULL;
@@ -363,7 +362,7 @@ tapeblock_open(struct block_device *bdev, fmode_t mode)
 	struct tape_device *	device;
 	int			rc;
 
-	device = tape_get_device_reference(disk->private_data);
+	device = tape_get_device(disk->private_data);
 
 	if (device->required_tapemarks) {
 		DBF_EVENT(2, "TBLOCK: missing tapemarks\n");
@@ -414,42 +413,6 @@ tapeblock_release(struct gendisk *disk, fmode_t mode)
 }
 
 /*
- * Support of some generic block device IOCTLs.
- */
-static int
-tapeblock_ioctl(
-	struct block_device *	bdev,
-	fmode_t			mode,
-	unsigned int		command,
-	unsigned long		arg
-) {
-	int rc;
-	int minor;
-	struct gendisk *disk = bdev->bd_disk;
-	struct tape_device *device;
-
-	rc     = 0;
-	BUG_ON(!disk);
-	device = disk->private_data;
-	BUG_ON(!device);
-	minor  = MINOR(bdev->bd_dev);
-
-	DBF_LH(6, "tapeblock_ioctl(0x%0x)\n", command);
-	DBF_LH(6, "device = %d:%d\n", tapeblock_major, minor);
-
-	switch (command) {
-		/* Refuse some IOCTL calls without complaining (mount). */
-		case 0x5310:		/* CDROMMULTISESSION */
-			rc = -EINVAL;
-			break;
-		default:
-			rc = -EINVAL;
-	}
-
-	return rc;
-}
-
-/*
  * Initialize block device frontend.
  */
 int
diff --git a/drivers/s390/char/tape_char.c b/drivers/s390/char/tape_char.c
index 31566c55adfe..539045acaad4 100644
--- a/drivers/s390/char/tape_char.c
+++ b/drivers/s390/char/tape_char.c
@@ -10,11 +10,15 @@
  *		 Martin Schwidefsky <schwidefsky@de.ibm.com>
  */
 
+#define KMSG_COMPONENT "tape"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/module.h>
 #include <linux/types.h>
 #include <linux/proc_fs.h>
 #include <linux/mtio.h>
 #include <linux/smp_lock.h>
+#include <linux/compat.h>
 
 #include <asm/uaccess.h>
 
@@ -33,18 +37,20 @@ static ssize_t tapechar_read(struct file *, char __user *, size_t, loff_t *);
 static ssize_t tapechar_write(struct file *, const char __user *, size_t, loff_t *);
 static int tapechar_open(struct inode *,struct file *);
 static int tapechar_release(struct inode *,struct file *);
-static int tapechar_ioctl(struct inode *, struct file *, unsigned int,
-			  unsigned long);
-static long tapechar_compat_ioctl(struct file *, unsigned int,
-			  unsigned long);
+static long tapechar_ioctl(struct file *, unsigned int, unsigned long);
+#ifdef CONFIG_COMPAT
+static long tapechar_compat_ioctl(struct file *, unsigned int, unsigned long);
+#endif
 
 static const struct file_operations tape_fops =
 {
 	.owner = THIS_MODULE,
 	.read = tapechar_read,
 	.write = tapechar_write,
-	.ioctl = tapechar_ioctl,
+	.unlocked_ioctl = tapechar_ioctl,
+#ifdef CONFIG_COMPAT
 	.compat_ioctl = tapechar_compat_ioctl,
+#endif
 	.open = tapechar_open,
 	.release = tapechar_release,
 };
@@ -170,7 +176,6 @@ tapechar_read(struct file *filp, char __user *data, size_t count, loff_t *ppos)
 	if (rc == 0) {
 		rc = block_size - request->rescnt;
 		DBF_EVENT(6, "TCHAR:rbytes:  %x\n", rc);
-		filp->f_pos += rc;
 		/* Copy data from idal buffer to user space. */
 		if (idal_buffer_to_user(device->char_data.idal_buf,
 					data, rc) != 0)
@@ -238,7 +243,6 @@ tapechar_write(struct file *filp, const char __user *data, size_t count, loff_t
 			break;
 		DBF_EVENT(6, "TCHAR:wbytes: %lx\n",
 			  block_size - request->rescnt);
-		filp->f_pos += block_size - request->rescnt;
 		written += block_size - request->rescnt;
 		if (request->rescnt != 0)
 			break;
@@ -286,26 +290,20 @@ tapechar_open (struct inode *inode, struct file *filp)
 	if (imajor(filp->f_path.dentry->d_inode) != tapechar_major)
 		return -ENODEV;
 
-	lock_kernel();
 	minor = iminor(filp->f_path.dentry->d_inode);
-	device = tape_get_device(minor / TAPE_MINORS_PER_DEV);
+	device = tape_find_device(minor / TAPE_MINORS_PER_DEV);
 	if (IS_ERR(device)) {
-		DBF_EVENT(3, "TCHAR:open: tape_get_device() failed\n");
-		rc = PTR_ERR(device);
-		goto out;
+		DBF_EVENT(3, "TCHAR:open: tape_find_device() failed\n");
+		return PTR_ERR(device);
 	}
 
-
 	rc = tape_open(device);
 	if (rc == 0) {
 		filp->private_data = device;
-		rc = nonseekable_open(inode, filp);
-	}
-	else
+		nonseekable_open(inode, filp);
+	} else
 		tape_put_device(device);
 
-out:
-	unlock_kernel();
 	return rc;
 }
 
@@ -342,7 +340,8 @@ tapechar_release(struct inode *inode, struct file *filp)
 		device->char_data.idal_buf = NULL;
 	}
 	tape_release(device);
-	filp->private_data = tape_put_device(device);
+	filp->private_data = NULL;
+	tape_put_device(device);
 
 	return 0;
 }
@@ -351,16 +350,11 @@ tapechar_release(struct inode *inode, struct file *filp)
  * Tape device io controls.
  */
 static int
-tapechar_ioctl(struct inode *inp, struct file *filp,
-	       unsigned int no, unsigned long data)
+__tapechar_ioctl(struct tape_device *device,
+		 unsigned int no, unsigned long data)
 {
-	struct tape_device *device;
 	int rc;
 
-	DBF_EVENT(6, "TCHAR:ioct\n");
-
-	device = (struct tape_device *) filp->private_data;
-
 	if (no == MTIOCTOP) {
 		struct mtop op;
 
@@ -453,21 +447,44 @@ tapechar_ioctl(struct inode *inp, struct file *filp,
 }
 
 static long
+tapechar_ioctl(struct file *filp, unsigned int no, unsigned long data)
+{
+	struct tape_device *device;
+	long rc;
+
+	DBF_EVENT(6, "TCHAR:ioct\n");
+
+	device = (struct tape_device *) filp->private_data;
+	mutex_lock(&device->mutex);
+	rc = __tapechar_ioctl(device, no, data);
+	mutex_unlock(&device->mutex);
+	return rc;
+}
+
+#ifdef CONFIG_COMPAT
+static long
 tapechar_compat_ioctl(struct file *filp, unsigned int no, unsigned long data)
 {
 	struct tape_device *device = filp->private_data;
 	int rval = -ENOIOCTLCMD;
+	unsigned long argp;
 
+	/* The 'arg' argument of any ioctl function may only be used for
+	 * pointers because of the compat pointer conversion.
+	 * Consider this when adding new ioctls.
+	 */
+	argp = (unsigned long) compat_ptr(data);
 	if (device->discipline->ioctl_fn) {
-		lock_kernel();
-		rval = device->discipline->ioctl_fn(device, no, data);
-		unlock_kernel();
+		mutex_lock(&device->mutex);
+		rval = device->discipline->ioctl_fn(device, no, argp);
+		mutex_unlock(&device->mutex);
 		if (rval == -EINVAL)
 			rval = -ENOIOCTLCMD;
 	}
 
 	return rval;
 }
+#endif /* CONFIG_COMPAT */
 
 /*
  * Initialize character device frontend.
diff --git a/drivers/s390/char/tape_class.c b/drivers/s390/char/tape_class.c
index ddc914ccea8f..b2864e3edb6d 100644
--- a/drivers/s390/char/tape_class.c
+++ b/drivers/s390/char/tape_class.c
@@ -7,6 +7,10 @@
  * Author: Stefan Bader <shbader@de.ibm.com>
  * Based on simple class device code by Greg K-H
  */
+
+#define KMSG_COMPONENT "tape"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include "tape_class.h"
 
 MODULE_AUTHOR("Stefan Bader <shbader@de.ibm.com>");
diff --git a/drivers/s390/char/tape_core.c b/drivers/s390/char/tape_core.c
index 5cd31e071647..81b094e480e6 100644
--- a/drivers/s390/char/tape_core.c
+++ b/drivers/s390/char/tape_core.c
@@ -12,6 +12,8 @@
  */
 
 #define KMSG_COMPONENT "tape"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/module.h>
 #include <linux/init.h>	     // for kernel parameters
 #include <linux/kmod.h>	     // for requesting modules
@@ -492,6 +494,7 @@ tape_alloc_device(void)
 		kfree(device);
 		return ERR_PTR(-ENOMEM);
 	}
+	mutex_init(&device->mutex);
 	INIT_LIST_HEAD(&device->req_queue);
 	INIT_LIST_HEAD(&device->node);
 	init_waitqueue_head(&device->state_change_wq);
@@ -511,11 +514,12 @@ tape_alloc_device(void)
  * increment the reference count.
  */
 struct tape_device *
-tape_get_device_reference(struct tape_device *device)
+tape_get_device(struct tape_device *device)
 {
-	DBF_EVENT(4, "tape_get_device_reference(%p) = %i\n", device,
-		atomic_inc_return(&device->ref_count));
+	int count;
 
+	count = atomic_inc_return(&device->ref_count);
+	DBF_EVENT(4, "tape_get_device(%p) = %i\n", device, count);
 	return device;
 }
 
@@ -525,32 +529,25 @@ tape_get_device_reference(struct tape_device *device)
  * The function returns a NULL pointer to be used by the caller
  * for clearing reference pointers.
  */
-struct tape_device *
+void
 tape_put_device(struct tape_device *device)
 {
-	int remain;
+	int count;
 
-	remain = atomic_dec_return(&device->ref_count);
-	if (remain > 0) {
-		DBF_EVENT(4, "tape_put_device(%p) -> %i\n", device, remain);
-	} else {
-		if (remain < 0) {
-			DBF_EVENT(4, "put device without reference\n");
-		} else {
-			DBF_EVENT(4, "tape_free_device(%p)\n", device);
-			kfree(device->modeset_byte);
-			kfree(device);
-		}
+	count = atomic_dec_return(&device->ref_count);
+	DBF_EVENT(4, "tape_put_device(%p) -> %i\n", device, count);
+	BUG_ON(count < 0);
+	if (count == 0) {
+		kfree(device->modeset_byte);
+		kfree(device);
 	}
-
-	return NULL;			
 }
 
 /*
  * Find tape device by a device index.
  */
 struct tape_device *
-tape_get_device(int devindex)
+tape_find_device(int devindex)
 {
 	struct tape_device *device, *tmp;
 
@@ -558,7 +555,7 @@ tape_get_device(int devindex)
 	read_lock(&tape_device_lock);
 	list_for_each_entry(tmp, &tape_device_list, node) {
 		if (tmp->first_minor / TAPE_MINORS_PER_DEV == devindex) {
-			device = tape_get_device_reference(tmp);
+			device = tape_get_device(tmp);
 			break;
 		}
 	}
@@ -579,7 +576,8 @@ tape_generic_probe(struct ccw_device *cdev)
 	device = tape_alloc_device();
 	if (IS_ERR(device))
 		return -ENODEV;
-	ccw_device_set_options(cdev, CCWDEV_DO_PATHGROUP);
+	ccw_device_set_options(cdev, CCWDEV_DO_PATHGROUP |
+				     CCWDEV_DO_MULTIPATH);
 	ret = sysfs_create_group(&cdev->dev.kobj, &tape_attr_group);
 	if (ret) {
 		tape_put_device(device);
@@ -606,7 +604,8 @@ __tape_discard_requests(struct tape_device *device)
 		list_del(&request->list);
 
 		/* Decrease ref_count for removed request. */
-		request->device = tape_put_device(device);
+		request->device = NULL;
+		tape_put_device(device);
 		request->rc = -EIO;
 		if (request->callback != NULL)
 			request->callback(request, request->callback_data);
@@ -664,9 +663,11 @@ tape_generic_remove(struct ccw_device *cdev)
 			tape_cleanup_device(device);
 	}
 
-	if (!dev_get_drvdata(&cdev->dev)) {
+	device = dev_get_drvdata(&cdev->dev);
+	if (device) {
 		sysfs_remove_group(&cdev->dev.kobj, &tape_attr_group);
-		dev_set_drvdata(&cdev->dev, tape_put_device(dev_get_drvdata(&cdev->dev)));
+		dev_set_drvdata(&cdev->dev, NULL);
+		tape_put_device(device);
 	}
 }
 
@@ -721,9 +722,8 @@ tape_free_request (struct tape_request * request)
 {
 	DBF_LH(6, "Free request %p\n", request);
 
-	if (request->device != NULL) {
-		request->device = tape_put_device(request->device);
-	}
+	if (request->device)
+		tape_put_device(request->device);
 	kfree(request->cpdata);
 	kfree(request->cpaddr);
 	kfree(request);
@@ -838,7 +838,8 @@ static void tape_long_busy_timeout(unsigned long data)
 	BUG_ON(request->status != TAPE_REQUEST_LONG_BUSY);
 	DBF_LH(6, "%08x: Long busy timeout.\n", device->cdev_id);
 	__tape_start_next_request(device);
-	device->lb_timeout.data = (unsigned long) tape_put_device(device);
+	device->lb_timeout.data = 0UL;
+	tape_put_device(device);
 	spin_unlock_irq(get_ccwdev_lock(device->cdev));
 }
 
@@ -918,7 +919,7 @@ __tape_start_request(struct tape_device *device, struct tape_request *request)
 	}
 
 	/* Increase use count of device for the added request. */
-	request->device = tape_get_device_reference(device);
+	request->device = tape_get_device(device);
 
 	if (list_empty(&device->req_queue)) {
 		/* No other requests are on the queue. Start this one. */
@@ -1117,8 +1118,8 @@ __tape_do_irq (struct ccw_device *cdev, unsigned long intparm, struct irb *irb)
 		if (req->status == TAPE_REQUEST_LONG_BUSY) {
 			DBF_EVENT(3, "(%08x): del timer\n", device->cdev_id);
 			if (del_timer(&device->lb_timeout)) {
-				device->lb_timeout.data = (unsigned long)
-					tape_put_device(device);
+				device->lb_timeout.data = 0UL;
+				tape_put_device(device);
 				__tape_start_next_request(device);
 			}
 			return;
@@ -1173,7 +1174,7 @@ __tape_do_irq (struct ccw_device *cdev, unsigned long intparm, struct irb *irb)
 			break;
 		case TAPE_IO_LONG_BUSY:
 			device->lb_timeout.data =
-				(unsigned long)tape_get_device_reference(device);
+				(unsigned long) tape_get_device(device);
 			device->lb_timeout.expires = jiffies +
 				LONG_BUSY_TIMEOUT * HZ;
 			DBF_EVENT(3, "(%08x): add timer\n", device->cdev_id);
@@ -1326,7 +1327,7 @@ EXPORT_SYMBOL(tape_generic_online);
 EXPORT_SYMBOL(tape_generic_offline);
 EXPORT_SYMBOL(tape_generic_pm_suspend);
 EXPORT_SYMBOL(tape_put_device);
-EXPORT_SYMBOL(tape_get_device_reference);
+EXPORT_SYMBOL(tape_get_device);
 EXPORT_SYMBOL(tape_state_verbose);
 EXPORT_SYMBOL(tape_op_verbose);
 EXPORT_SYMBOL(tape_state_set);
diff --git a/drivers/s390/char/tape_proc.c b/drivers/s390/char/tape_proc.c
index 202f42132939..0ceb37984f77 100644
--- a/drivers/s390/char/tape_proc.c
+++ b/drivers/s390/char/tape_proc.c
@@ -11,6 +11,9 @@
  * PROCFS Functions
  */
 
+#define KMSG_COMPONENT "tape"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/module.h>
 #include <linux/vmalloc.h>
 #include <linux/seq_file.h>
@@ -45,7 +48,7 @@ static int tape_proc_show(struct seq_file *m, void *v)
 		seq_printf(m, "TapeNo\tBusID      CuType/Model\t"
 			"DevType/Model\tBlkSize\tState\tOp\tMedState\n");
 	}
-	device = tape_get_device(n);
+	device = tape_find_device(n);
 	if (IS_ERR(device))
 		return 0;
 	spin_lock_irq(get_ccwdev_lock(device->cdev));
diff --git a/drivers/s390/char/tape_std.c b/drivers/s390/char/tape_std.c
index 750354ad16e5..03f07e5dd6e9 100644
--- a/drivers/s390/char/tape_std.c
+++ b/drivers/s390/char/tape_std.c
@@ -11,6 +11,9 @@
  *		 Stefan Bader <shbader@de.ibm.com>
  */
 
+#define KMSG_COMPONENT "tape"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/stddef.h>
 #include <linux/kernel.h>
 #include <linux/bio.h>
diff --git a/drivers/s390/char/tty3270.c b/drivers/s390/char/tty3270.c
index 38385677c653..911822db614d 100644
--- a/drivers/s390/char/tty3270.c
+++ b/drivers/s390/char/tty3270.c
@@ -19,6 +19,7 @@
 
 #include <linux/slab.h>
 #include <linux/bootmem.h>
+#include <linux/compat.h>
 
 #include <asm/ccwdev.h>
 #include <asm/cio.h>
@@ -1731,6 +1732,22 @@ tty3270_ioctl(struct tty_struct *tty, struct file *file,
 	return kbd_ioctl(tp->kbd, file, cmd, arg);
 }
 
+#ifdef CONFIG_COMPAT
+static long
+tty3270_compat_ioctl(struct tty_struct *tty, struct file *file,
+	      unsigned int cmd, unsigned long arg)
+{
+	struct tty3270 *tp;
+
+	tp = tty->driver_data;
+	if (!tp)
+		return -ENODEV;
+	if (tty->flags & (1 << TTY_IO_ERROR))
+		return -EIO;
+	return kbd_ioctl(tp->kbd, file, cmd, (unsigned long)compat_ptr(arg));
+}
+#endif
+
 static const struct tty_operations tty3270_ops = {
 	.open = tty3270_open,
 	.close = tty3270_close,
@@ -1745,6 +1762,9 @@ static const struct tty_operations tty3270_ops = {
 	.hangup = tty3270_hangup,
 	.wait_until_sent = tty3270_wait_until_sent,
 	.ioctl = tty3270_ioctl,
+#ifdef CONFIG_COMPAT
+	.compat_ioctl = tty3270_compat_ioctl,
+#endif
 	.set_termios = tty3270_set_termios
 };
 
diff --git a/drivers/s390/char/vmcp.c b/drivers/s390/char/vmcp.c
index a6087cec55b4..921dcda77676 100644
--- a/drivers/s390/char/vmcp.c
+++ b/drivers/s390/char/vmcp.c
@@ -19,6 +19,7 @@
 #include <linux/kernel.h>
 #include <linux/miscdevice.h>
 #include <linux/module.h>
+#include <asm/compat.h>
 #include <asm/cpcmd.h>
 #include <asm/debug.h>
 #include <asm/uaccess.h>
@@ -139,21 +140,26 @@ vmcp_write(struct file *file, const char __user *buff, size_t count,
 static long vmcp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
 	struct vmcp_session *session;
+	int __user *argp;
 	int temp;
 
 	session = (struct vmcp_session *)file->private_data;
+	if (is_compat_task())
+		argp = compat_ptr(arg);
+	else
+		argp = (int __user *)arg;
 	if (mutex_lock_interruptible(&session->mutex))
 		return -ERESTARTSYS;
 	switch (cmd) {
 	case VMCP_GETCODE:
 		temp = session->resp_code;
 		mutex_unlock(&session->mutex);
-		return put_user(temp, (int __user *)arg);
+		return put_user(temp, argp);
 	case VMCP_SETBUF:
 		free_pages((unsigned long)session->response,
 				get_order(session->bufsize));
 		session->response=NULL;
-		temp = get_user(session->bufsize, (int __user *)arg);
+		temp = get_user(session->bufsize, argp);
 		if (get_order(session->bufsize) > 8) {
 			session->bufsize = PAGE_SIZE;
 			temp = -EINVAL;
@@ -163,7 +169,7 @@ static long vmcp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 	case VMCP_GETSIZE:
 		temp = session->resp_size;
 		mutex_unlock(&session->mutex);
-		return put_user(temp, (int __user *)arg);
+		return put_user(temp, argp);
 	default:
 		mutex_unlock(&session->mutex);
 		return -ENOIOCTLCMD;
diff --git a/drivers/s390/char/vmlogrdr.c b/drivers/s390/char/vmlogrdr.c
index d1a142fa3eb4..7dfa5412d5a8 100644
--- a/drivers/s390/char/vmlogrdr.c
+++ b/drivers/s390/char/vmlogrdr.c
@@ -312,11 +312,9 @@ static int vmlogrdr_open (struct inode *inode, struct file *filp)
 		return -ENOSYS;
 
 	/* Besure this device hasn't already been opened */
-	lock_kernel();
 	spin_lock_bh(&logptr->priv_lock);
 	if (logptr->dev_in_use)	{
 		spin_unlock_bh(&logptr->priv_lock);
-		unlock_kernel();
 		return -EBUSY;
 	}
 	logptr->dev_in_use = 1;
@@ -360,9 +358,8 @@ static int vmlogrdr_open (struct inode *inode, struct file *filp)
 		   || (logptr->iucv_path_severed));
 	if (logptr->iucv_path_severed)
 		goto out_record;
- 	ret = nonseekable_open(inode, filp);
-	unlock_kernel();
-	return ret;
+	nonseekable_open(inode, filp);
+	return 0;
 
 out_record:
 	if (logptr->autorecording)
@@ -372,7 +369,6 @@ out_path:
 	logptr->path = NULL;
 out_dev:
 	logptr->dev_in_use = 0;
-	unlock_kernel();
 	return -EIO;
 }
 
@@ -679,7 +675,7 @@ static int vmlogrdr_pm_prepare(struct device *dev)
 }
 
 
-static struct dev_pm_ops vmlogrdr_pm_ops = {
+static const struct dev_pm_ops vmlogrdr_pm_ops = {
 	.prepare = vmlogrdr_pm_prepare,
 };
 
diff --git a/drivers/s390/char/vmur.c b/drivers/s390/char/vmur.c
index 77571b68539a..cc56fc708bae 100644
--- a/drivers/s390/char/vmur.c
+++ b/drivers/s390/char/vmur.c
@@ -695,7 +695,6 @@ static int ur_open(struct inode *inode, struct file *file)
 
 	if (accmode == O_RDWR)
 		return -EACCES;
-	lock_kernel();
 	/*
 	 * We treat the minor number as the devno of the ur device
 	 * to find in the driver tree.
@@ -749,7 +748,6 @@ static int ur_open(struct inode *inode, struct file *file)
 		goto fail_urfile_free;
 	urf->file_reclen = rc;
 	file->private_data = urf;
-	unlock_kernel();
 	return 0;
 
 fail_urfile_free:
@@ -761,7 +759,6 @@ fail_unlock:
 fail_put:
 	urdev_put(urd);
 out:
-	unlock_kernel();
 	return rc;
 }
 
diff --git a/drivers/s390/char/vmwatchdog.c b/drivers/s390/char/vmwatchdog.c
index f2bc287b69e4..c974058e48d2 100644
--- a/drivers/s390/char/vmwatchdog.c
+++ b/drivers/s390/char/vmwatchdog.c
@@ -19,7 +19,6 @@
 #include <linux/moduleparam.h>
 #include <linux/suspend.h>
 #include <linux/watchdog.h>
-#include <linux/smp_lock.h>
 
 #include <asm/ebcdic.h>
 #include <asm/io.h>
@@ -49,6 +48,8 @@ static unsigned int vmwdt_interval = 60;
 static unsigned long vmwdt_is_open;
 static int vmwdt_expect_close;
 
+static DEFINE_MUTEX(vmwdt_mutex);
+
 #define VMWDT_OPEN	0	/* devnode is open or suspend in progress */
 #define VMWDT_RUNNING	1	/* The watchdog is armed */
 
@@ -133,15 +134,11 @@ static int __init vmwdt_probe(void)
 static int vmwdt_open(struct inode *i, struct file *f)
 {
 	int ret;
-	lock_kernel();
-	if (test_and_set_bit(VMWDT_OPEN, &vmwdt_is_open)) {
-		unlock_kernel();
+	if (test_and_set_bit(VMWDT_OPEN, &vmwdt_is_open))
 		return -EBUSY;
-	}
 	ret = vmwdt_keepalive();
 	if (ret)
 		clear_bit(VMWDT_OPEN, &vmwdt_is_open);
-	unlock_kernel();
 	return ret ? ret : nonseekable_open(i, f);
 }
 
@@ -160,8 +157,7 @@ static struct watchdog_info vmwdt_info = {
 	.identity = "z/VM Watchdog Timer",
 };
 
-static int vmwdt_ioctl(struct inode *i, struct file *f,
-			  unsigned int cmd, unsigned long arg)
+static int __vmwdt_ioctl(unsigned int cmd, unsigned long arg)
 {
 	switch (cmd) {
 	case WDIOC_GETSUPPORT:
@@ -205,10 +201,19 @@ static int vmwdt_ioctl(struct inode *i, struct file *f,
 	case WDIOC_KEEPALIVE:
 		return vmwdt_keepalive();
 	}
-
 	return -EINVAL;
 }
 
+static long vmwdt_ioctl(struct file *f, unsigned int cmd, unsigned long arg)
+{
+	int rc;
+
+	mutex_lock(&vmwdt_mutex);
+	rc = __vmwdt_ioctl(cmd, arg);
+	mutex_unlock(&vmwdt_mutex);
+	return (long) rc;
+}
+
 static ssize_t vmwdt_write(struct file *f, const char __user *buf,
 				size_t count, loff_t *ppos)
 {
@@ -288,7 +293,7 @@ static struct notifier_block vmwdt_power_notifier = {
 static const struct file_operations vmwdt_fops = {
 	.open    = &vmwdt_open,
 	.release = &vmwdt_close,
-	.ioctl   = &vmwdt_ioctl,
+	.unlocked_ioctl = &vmwdt_ioctl,
 	.write   = &vmwdt_write,
 	.owner   = THIS_MODULE,
 };
@@ -309,6 +314,10 @@ static int __init vmwdt_init(void)
 	ret = register_pm_notifier(&vmwdt_power_notifier);
 	if (ret)
 		return ret;
+	/*
+	 * misc_register() has to be the last action in module_init(), because
+	 * file operations will be available right after this.
+	 */
 	ret = misc_register(&vmwdt_dev);
 	if (ret) {
 		unregister_pm_notifier(&vmwdt_power_notifier);
diff --git a/drivers/s390/cio/Makefile b/drivers/s390/cio/Makefile
index fa4c9662f65e..e1b700a19648 100644
--- a/drivers/s390/cio/Makefile
+++ b/drivers/s390/cio/Makefile
@@ -3,12 +3,12 @@
 #
 
 obj-y += airq.o blacklist.o chsc.o cio.o css.o chp.o idset.o isc.o \
-	fcx.o itcw.o crw.o
+	fcx.o itcw.o crw.o ccwreq.o
 ccw_device-objs += device.o device_fsm.o device_ops.o
 ccw_device-objs += device_id.o device_pgid.o device_status.o
 obj-y += ccw_device.o cmf.o
 obj-$(CONFIG_CHSC_SCH) += chsc_sch.o
 obj-$(CONFIG_CCWGROUP) += ccwgroup.o
 
-qdio-objs := qdio_main.o qdio_thinint.o qdio_debug.o qdio_perf.o qdio_setup.o
+qdio-objs := qdio_main.o qdio_thinint.o qdio_debug.o qdio_setup.o
 obj-$(CONFIG_QDIO) += qdio.o
diff --git a/drivers/s390/cio/ccwgroup.c b/drivers/s390/cio/ccwgroup.c
index a5a62f1f7747..5f97ea2ee6b1 100644
--- a/drivers/s390/cio/ccwgroup.c
+++ b/drivers/s390/cio/ccwgroup.c
@@ -560,7 +560,7 @@ static int ccwgroup_pm_restore(struct device *dev)
 	return gdrv->restore ? gdrv->restore(gdev) : 0;
 }
 
-static struct dev_pm_ops ccwgroup_pm_ops = {
+static const struct dev_pm_ops ccwgroup_pm_ops = {
 	.prepare = ccwgroup_pm_prepare,
 	.complete = ccwgroup_pm_complete,
 	.freeze = ccwgroup_pm_freeze,
diff --git a/drivers/s390/cio/ccwreq.c b/drivers/s390/cio/ccwreq.c
new file mode 100644
index 000000000000..7a28a3029a3f
--- /dev/null
+++ b/drivers/s390/cio/ccwreq.c
@@ -0,0 +1,325 @@
+/*
+ *  Handling of internal CCW device requests.
+ *
+ *    Copyright IBM Corp. 2009
+ *    Author(s): Peter Oberparleiter <peter.oberparleiter@de.ibm.com>
+ */
+
+#include <linux/types.h>
+#include <linux/err.h>
+#include <asm/ccwdev.h>
+#include <asm/cio.h>
+
+#include "io_sch.h"
+#include "cio.h"
+#include "device.h"
+#include "cio_debug.h"
+
+/**
+ * lpm_adjust - adjust path mask
+ * @lpm: path mask to adjust
+ * @mask: mask of available paths
+ *
+ * Shift @lpm right until @lpm and @mask have at least one bit in common or
+ * until @lpm is zero. Return the resulting lpm.
+ */
+int lpm_adjust(int lpm, int mask)
+{
+	while (lpm && ((lpm & mask) == 0))
+		lpm >>= 1;
+	return lpm;
+}
+
+/*
+ * Adjust path mask to use next path and reset retry count. Return resulting
+ * path mask.
+ */
+static u16 ccwreq_next_path(struct ccw_device *cdev)
+{
+	struct ccw_request *req = &cdev->private->req;
+
+	req->retries	= req->maxretries;
+	req->mask	= lpm_adjust(req->mask >>= 1, req->lpm);
+
+	return req->mask;
+}
+
+/*
+ * Clean up device state and report to callback.
+ */
+static void ccwreq_stop(struct ccw_device *cdev, int rc)
+{
+	struct ccw_request *req = &cdev->private->req;
+
+	if (req->done)
+		return;
+	req->done = 1;
+	ccw_device_set_timeout(cdev, 0);
+	memset(&cdev->private->irb, 0, sizeof(struct irb));
+	if (rc && rc != -ENODEV && req->drc)
+		rc = req->drc;
+	req->callback(cdev, req->data, rc);
+}
+
+/*
+ * (Re-)Start the operation until retries and paths are exhausted.
+ */
+static void ccwreq_do(struct ccw_device *cdev)
+{
+	struct ccw_request *req = &cdev->private->req;
+	struct subchannel *sch = to_subchannel(cdev->dev.parent);
+	struct ccw1 *cp = req->cp;
+	int rc = -EACCES;
+
+	while (req->mask) {
+		if (req->retries-- == 0) {
+			/* Retries exhausted, try next path. */
+			ccwreq_next_path(cdev);
+			continue;
+		}
+		/* Perform start function. */
+		memset(&cdev->private->irb, 0, sizeof(struct irb));
+		rc = cio_start(sch, cp, (u8) req->mask);
+		if (rc == 0) {
+			/* I/O started successfully. */
+			ccw_device_set_timeout(cdev, req->timeout);
+			return;
+		}
+		if (rc == -ENODEV) {
+			/* Permanent device error. */
+			break;
+		}
+		if (rc == -EACCES) {
+			/* Permant path error. */
+			ccwreq_next_path(cdev);
+			continue;
+		}
+		/* Temporary improper status. */
+		rc = cio_clear(sch);
+		if (rc)
+			break;
+		return;
+	}
+	ccwreq_stop(cdev, rc);
+}
+
+/**
+ * ccw_request_start - perform I/O request
+ * @cdev: ccw device
+ *
+ * Perform the I/O request specified by cdev->req.
+ */
+void ccw_request_start(struct ccw_device *cdev)
+{
+	struct ccw_request *req = &cdev->private->req;
+
+	/* Try all paths twice to counter link flapping. */
+	req->mask	= 0x8080;
+	req->retries	= req->maxretries;
+	req->mask	= lpm_adjust(req->mask, req->lpm);
+	req->drc	= 0;
+	req->done	= 0;
+	req->cancel	= 0;
+	if (!req->mask)
+		goto out_nopath;
+	ccwreq_do(cdev);
+	return;
+
+out_nopath:
+	ccwreq_stop(cdev, -EACCES);
+}
+
+/**
+ * ccw_request_cancel - cancel running I/O request
+ * @cdev: ccw device
+ *
+ * Cancel the I/O request specified by cdev->req. Return non-zero if request
+ * has already finished, zero otherwise.
+ */
+int ccw_request_cancel(struct ccw_device *cdev)
+{
+	struct subchannel *sch = to_subchannel(cdev->dev.parent);
+	struct ccw_request *req = &cdev->private->req;
+	int rc;
+
+	if (req->done)
+		return 1;
+	req->cancel = 1;
+	rc = cio_clear(sch);
+	if (rc)
+		ccwreq_stop(cdev, rc);
+	return 0;
+}
+
+/*
+ * Return the status of the internal I/O started on the specified ccw device.
+ * Perform BASIC SENSE if required.
+ */
+static enum io_status ccwreq_status(struct ccw_device *cdev, struct irb *lcirb)
+{
+	struct irb *irb = &cdev->private->irb;
+	struct cmd_scsw *scsw = &irb->scsw.cmd;
+
+	/* Perform BASIC SENSE if needed. */
+	if (ccw_device_accumulate_and_sense(cdev, lcirb))
+		return IO_RUNNING;
+	/* Check for halt/clear interrupt. */
+	if (scsw->fctl & (SCSW_FCTL_HALT_FUNC | SCSW_FCTL_CLEAR_FUNC))
+		return IO_KILLED;
+	/* Check for path error. */
+	if (scsw->cc == 3 || scsw->pno)
+		return IO_PATH_ERROR;
+	/* Handle BASIC SENSE data. */
+	if (irb->esw.esw0.erw.cons) {
+		CIO_TRACE_EVENT(2, "sensedata");
+		CIO_HEX_EVENT(2, &cdev->private->dev_id,
+			      sizeof(struct ccw_dev_id));
+		CIO_HEX_EVENT(2, &cdev->private->irb.ecw, SENSE_MAX_COUNT);
+		/* Check for command reject. */
+		if (irb->ecw[0] & SNS0_CMD_REJECT)
+			return IO_REJECTED;
+		/* Assume that unexpected SENSE data implies an error. */
+		return IO_STATUS_ERROR;
+	}
+	/* Check for channel errors. */
+	if (scsw->cstat != 0)
+		return IO_STATUS_ERROR;
+	/* Check for device errors. */
+	if (scsw->dstat & ~(DEV_STAT_CHN_END | DEV_STAT_DEV_END))
+		return IO_STATUS_ERROR;
+	/* Check for final state. */
+	if (!(scsw->dstat & DEV_STAT_DEV_END))
+		return IO_RUNNING;
+	/* Check for other improper status. */
+	if (scsw->cc == 1 && (scsw->stctl & SCSW_STCTL_ALERT_STATUS))
+		return IO_STATUS_ERROR;
+	return IO_DONE;
+}
+
+/*
+ * Log ccw request status.
+ */
+static void ccwreq_log_status(struct ccw_device *cdev, enum io_status status)
+{
+	struct ccw_request *req = &cdev->private->req;
+	struct {
+		struct ccw_dev_id dev_id;
+		u16 retries;
+		u8 lpm;
+		u8 status;
+	}  __attribute__ ((packed)) data;
+	data.dev_id	= cdev->private->dev_id;
+	data.retries	= req->retries;
+	data.lpm	= (u8) req->mask;
+	data.status	= (u8) status;
+	CIO_TRACE_EVENT(2, "reqstat");
+	CIO_HEX_EVENT(2, &data, sizeof(data));
+}
+
+/**
+ * ccw_request_handler - interrupt handler for I/O request procedure.
+ * @cdev: ccw device
+ *
+ * Handle interrupt during I/O request procedure.
+ */
+void ccw_request_handler(struct ccw_device *cdev)
+{
+	struct ccw_request *req = &cdev->private->req;
+	struct irb *irb = (struct irb *) __LC_IRB;
+	enum io_status status;
+	int rc = -EOPNOTSUPP;
+
+	/* Check status of I/O request. */
+	status = ccwreq_status(cdev, irb);
+	if (req->filter)
+		status = req->filter(cdev, req->data, irb, status);
+	if (status != IO_RUNNING)
+		ccw_device_set_timeout(cdev, 0);
+	if (status != IO_DONE && status != IO_RUNNING)
+		ccwreq_log_status(cdev, status);
+	switch (status) {
+	case IO_DONE:
+		break;
+	case IO_RUNNING:
+		return;
+	case IO_REJECTED:
+		goto err;
+	case IO_PATH_ERROR:
+		goto out_next_path;
+	case IO_STATUS_ERROR:
+		goto out_restart;
+	case IO_KILLED:
+		/* Check if request was cancelled on purpose. */
+		if (req->cancel) {
+			rc = -EIO;
+			goto err;
+		}
+		goto out_restart;
+	}
+	/* Check back with request initiator. */
+	if (!req->check)
+		goto out;
+	switch (req->check(cdev, req->data)) {
+	case 0:
+		break;
+	case -EAGAIN:
+		goto out_restart;
+	case -EACCES:
+		goto out_next_path;
+	default:
+		goto err;
+	}
+out:
+	ccwreq_stop(cdev, 0);
+	return;
+
+out_next_path:
+	/* Try next path and restart I/O. */
+	if (!ccwreq_next_path(cdev)) {
+		rc = -EACCES;
+		goto err;
+	}
+out_restart:
+	/* Restart. */
+	ccwreq_do(cdev);
+	return;
+err:
+	ccwreq_stop(cdev, rc);
+}
+
+
+/**
+ * ccw_request_timeout - timeout handler for I/O request procedure
+ * @cdev: ccw device
+ *
+ * Handle timeout during I/O request procedure.
+ */
+void ccw_request_timeout(struct ccw_device *cdev)
+{
+	struct subchannel *sch = to_subchannel(cdev->dev.parent);
+	struct ccw_request *req = &cdev->private->req;
+	int rc;
+
+	if (!ccwreq_next_path(cdev)) {
+		/* set the final return code for this request */
+		req->drc = -ETIME;
+	}
+	rc = cio_clear(sch);
+	if (rc)
+		goto err;
+	return;
+
+err:
+	ccwreq_stop(cdev, rc);
+}
+
+/**
+ * ccw_request_notoper - notoper handler for I/O request procedure
+ * @cdev: ccw device
+ *
+ * Handle timeout during I/O request procedure.
+ */
+void ccw_request_notoper(struct ccw_device *cdev)
+{
+	ccwreq_stop(cdev, -ENODEV);
+}
diff --git a/drivers/s390/cio/chp.c b/drivers/s390/cio/chp.c
index 8ab51608da55..c268a2e5b7c3 100644
--- a/drivers/s390/cio/chp.c
+++ b/drivers/s390/cio/chp.c
@@ -65,7 +65,7 @@ static void set_chp_logically_online(struct chp_id chpid, int onoff)
 	chpid_to_chp(chpid)->state = onoff;
 }
 
-/* On succes return 0 if channel-path is varied offline, 1 if it is varied
+/* On success return 0 if channel-path is varied offline, 1 if it is varied
  * online. Return -ENODEV if channel-path is not registered. */
 int chp_get_status(struct chp_id chpid)
 {
diff --git a/drivers/s390/cio/chsc_sch.c b/drivers/s390/cio/chsc_sch.c
index cc5144b6f9d9..c84ac9443079 100644
--- a/drivers/s390/cio/chsc_sch.c
+++ b/drivers/s390/cio/chsc_sch.c
@@ -12,6 +12,7 @@
 #include <linux/uaccess.h>
 #include <linux/miscdevice.h>
 
+#include <asm/compat.h>
 #include <asm/cio.h>
 #include <asm/chsc.h>
 #include <asm/isc.h>
@@ -770,24 +771,30 @@ out_free:
 static long chsc_ioctl(struct file *filp, unsigned int cmd,
 		       unsigned long arg)
 {
+	void __user *argp;
+
 	CHSC_MSG(2, "chsc_ioctl called, cmd=%x\n", cmd);
+	if (is_compat_task())
+		argp = compat_ptr(arg);
+	else
+		argp = (void __user *)arg;
 	switch (cmd) {
 	case CHSC_START:
-		return chsc_ioctl_start((void __user *)arg);
+		return chsc_ioctl_start(argp);
 	case CHSC_INFO_CHANNEL_PATH:
-		return chsc_ioctl_info_channel_path((void __user *)arg);
+		return chsc_ioctl_info_channel_path(argp);
 	case CHSC_INFO_CU:
-		return chsc_ioctl_info_cu((void __user *)arg);
+		return chsc_ioctl_info_cu(argp);
 	case CHSC_INFO_SCH_CU:
-		return chsc_ioctl_info_sch_cu((void __user *)arg);
+		return chsc_ioctl_info_sch_cu(argp);
 	case CHSC_INFO_CI:
-		return chsc_ioctl_conf_info((void __user *)arg);
+		return chsc_ioctl_conf_info(argp);
 	case CHSC_INFO_CCL:
-		return chsc_ioctl_conf_comp_list((void __user *)arg);
+		return chsc_ioctl_conf_comp_list(argp);
 	case CHSC_INFO_CPD:
-		return chsc_ioctl_chpd((void __user *)arg);
+		return chsc_ioctl_chpd(argp);
 	case CHSC_INFO_DCAL:
-		return chsc_ioctl_dcal((void __user *)arg);
+		return chsc_ioctl_dcal(argp);
 	default: /* unknown ioctl number */
 		return -ENOIOCTLCMD;
 	}
diff --git a/drivers/s390/cio/cio.c b/drivers/s390/cio/cio.c
index 138124fcfcad..126f240715a4 100644
--- a/drivers/s390/cio/cio.c
+++ b/drivers/s390/cio/cio.c
@@ -618,6 +618,7 @@ void __irq_entry do_IRQ(struct pt_regs *regs)
 	old_regs = set_irq_regs(regs);
 	s390_idle_check();
 	irq_enter();
+	__get_cpu_var(s390_idle).nohz_delay = 1;
 	if (S390_lowcore.int_clock >= S390_lowcore.clock_comparator)
 		/* Serve timer interrupts first. */
 		clock_comparator_work();
diff --git a/drivers/s390/cio/cio.h b/drivers/s390/cio/cio.h
index 2e43558c704b..bf7f80f5a330 100644
--- a/drivers/s390/cio/cio.h
+++ b/drivers/s390/cio/cio.h
@@ -68,6 +68,11 @@ struct schib {
 	__u8 mda[4];		 /* model dependent area */
 } __attribute__ ((packed,aligned(4)));
 
+enum sch_todo {
+	SCH_TODO_NOTHING,
+	SCH_TODO_UNREG,
+};
+
 /* subchannel data structure used by I/O subroutines */
 struct subchannel {
 	struct subchannel_id schid;
@@ -95,7 +100,8 @@ struct subchannel {
 	struct device dev;	/* entry in device tree */
 	struct css_driver *driver;
 	void *private; /* private per subchannel type data */
-	struct work_struct work;
+	enum sch_todo todo;
+	struct work_struct todo_work;
 	struct schib_config config;
 } __attribute__ ((aligned(8)));
 
diff --git a/drivers/s390/cio/cmf.c b/drivers/s390/cio/cmf.c
index 30f516111307..2985eb439485 100644
--- a/drivers/s390/cio/cmf.c
+++ b/drivers/s390/cio/cmf.c
@@ -462,7 +462,7 @@ static struct cmb_area cmb_area = {
  * block of memory, which can not be moved as long as any channel
  * is active. Therefore, a maximum number of subchannels needs to
  * be defined somewhere. This is a module parameter, defaulting to
- * a resonable value of 1024, or 32 kb of memory.
+ * a reasonable value of 1024, or 32 kb of memory.
  * Current kernels don't allow kmalloc with more than 128kb, so the
  * maximum is 4096.
  */
diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c
index 91c25706fa83..7679aee6fa14 100644
--- a/drivers/s390/cio/css.c
+++ b/drivers/s390/cio/css.c
@@ -133,6 +133,8 @@ out:
 	return rc;
 }
 
+static void css_sch_todo(struct work_struct *work);
+
 static struct subchannel *
 css_alloc_subchannel(struct subchannel_id schid)
 {
@@ -147,6 +149,7 @@ css_alloc_subchannel(struct subchannel_id schid)
 		kfree(sch);
 		return ERR_PTR(ret);
 	}
+	INIT_WORK(&sch->todo_work, css_sch_todo);
 	return sch;
 }
 
@@ -190,6 +193,51 @@ void css_sch_device_unregister(struct subchannel *sch)
 }
 EXPORT_SYMBOL_GPL(css_sch_device_unregister);
 
+static void css_sch_todo(struct work_struct *work)
+{
+	struct subchannel *sch;
+	enum sch_todo todo;
+
+	sch = container_of(work, struct subchannel, todo_work);
+	/* Find out todo. */
+	spin_lock_irq(sch->lock);
+	todo = sch->todo;
+	CIO_MSG_EVENT(4, "sch_todo: sch=0.%x.%04x, todo=%d\n", sch->schid.ssid,
+		      sch->schid.sch_no, todo);
+	sch->todo = SCH_TODO_NOTHING;
+	spin_unlock_irq(sch->lock);
+	/* Perform todo. */
+	if (todo == SCH_TODO_UNREG)
+		css_sch_device_unregister(sch);
+	/* Release workqueue ref. */
+	put_device(&sch->dev);
+}
+
+/**
+ * css_sched_sch_todo - schedule a subchannel operation
+ * @sch: subchannel
+ * @todo: todo
+ *
+ * Schedule the operation identified by @todo to be performed on the slow path
+ * workqueue. Do nothing if another operation with higher priority is already
+ * scheduled. Needs to be called with subchannel lock held.
+ */
+void css_sched_sch_todo(struct subchannel *sch, enum sch_todo todo)
+{
+	CIO_MSG_EVENT(4, "sch_todo: sched sch=0.%x.%04x todo=%d\n",
+		      sch->schid.ssid, sch->schid.sch_no, todo);
+	if (sch->todo >= todo)
+		return;
+	/* Get workqueue ref. */
+	if (!get_device(&sch->dev))
+		return;
+	sch->todo = todo;
+	if (!queue_work(slow_path_wq, &sch->todo_work)) {
+		/* Already queued, release workqueue ref. */
+		put_device(&sch->dev);
+	}
+}
+
 static void ssd_from_pmcw(struct chsc_ssd_info *ssd, struct pmcw *pmcw)
 {
 	int i;
@@ -376,8 +424,8 @@ static int css_evaluate_new_subchannel(struct subchannel_id schid, int slow)
 		/* Unusable - ignore. */
 		return 0;
 	}
-	CIO_MSG_EVENT(4, "Evaluating schid 0.%x.%04x, event %d, unknown, "
-			 "slow path.\n", schid.ssid, schid.sch_no, CIO_OPER);
+	CIO_MSG_EVENT(4, "event: sch 0.%x.%04x, new\n", schid.ssid,
+		      schid.sch_no);
 
 	return css_probe_device(schid);
 }
@@ -394,6 +442,10 @@ static int css_evaluate_known_subchannel(struct subchannel *sch, int slow)
 				"Got subchannel machine check but "
 				"no sch_event handler provided.\n");
 	}
+	if (ret != 0 && ret != -EAGAIN) {
+		CIO_MSG_EVENT(2, "eval: sch 0.%x.%04x, rc=%d\n",
+			      sch->schid.ssid, sch->schid.sch_no, ret);
+	}
 	return ret;
 }
 
@@ -684,6 +736,7 @@ static int __init setup_css(int nr)
 	css->pseudo_subchannel->dev.parent = &css->device;
 	css->pseudo_subchannel->dev.release = css_subchannel_release;
 	dev_set_name(&css->pseudo_subchannel->dev, "defunct");
+	mutex_init(&css->pseudo_subchannel->reg_mutex);
 	ret = cio_create_sch_lock(css->pseudo_subchannel);
 	if (ret) {
 		kfree(css->pseudo_subchannel);
@@ -1095,7 +1148,7 @@ static int css_pm_restore(struct device *dev)
 	return drv->restore ? drv->restore(sch) : 0;
 }
 
-static struct dev_pm_ops css_pm_ops = {
+static const struct dev_pm_ops css_pm_ops = {
 	.prepare = css_pm_prepare,
 	.complete = css_pm_complete,
 	.freeze = css_pm_freeze,
diff --git a/drivers/s390/cio/css.h b/drivers/s390/cio/css.h
index 68d6b0bf151c..fe84b92cde60 100644
--- a/drivers/s390/cio/css.h
+++ b/drivers/s390/cio/css.h
@@ -11,6 +11,8 @@
 #include <asm/chpid.h>
 #include <asm/schid.h>
 
+#include "cio.h"
+
 /*
  * path grouping stuff
  */
@@ -151,4 +153,5 @@ int css_sch_is_valid(struct schib *);
 
 extern struct workqueue_struct *slow_path_wq;
 void css_wait_for_slow_path(void);
+void css_sched_sch_todo(struct subchannel *sch, enum sch_todo todo);
 #endif
diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
index 2490b741e16a..a6c7d5426fb2 100644
--- a/drivers/s390/cio/device.c
+++ b/drivers/s390/cio/device.c
@@ -7,6 +7,10 @@
  *		 Cornelia Huck (cornelia.huck@de.ibm.com)
  *		 Martin Schwidefsky (schwidefsky@de.ibm.com)
  */
+
+#define KMSG_COMPONENT "cio"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/spinlock.h>
@@ -299,53 +303,18 @@ int ccw_device_is_orphan(struct ccw_device *cdev)
 
 static void ccw_device_unregister(struct ccw_device *cdev)
 {
-	if (test_and_clear_bit(1, &cdev->private->registered)) {
+	if (device_is_registered(&cdev->dev)) {
+		/* Undo device_add(). */
 		device_del(&cdev->dev);
+	}
+	if (cdev->private->flags.initialized) {
+		cdev->private->flags.initialized = 0;
 		/* Release reference from device_initialize(). */
 		put_device(&cdev->dev);
 	}
 }
 
-static void ccw_device_remove_orphan_cb(struct work_struct *work)
-{
-	struct ccw_device_private *priv;
-	struct ccw_device *cdev;
-
-	priv = container_of(work, struct ccw_device_private, kick_work);
-	cdev = priv->cdev;
-	ccw_device_unregister(cdev);
-	/* Release cdev reference for workqueue processing. */
-	put_device(&cdev->dev);
-}
-
-static void
-ccw_device_remove_disconnected(struct ccw_device *cdev)
-{
-	unsigned long flags;
-
-	/*
-	 * Forced offline in disconnected state means
-	 * 'throw away device'.
-	 */
-	if (ccw_device_is_orphan(cdev)) {
-		/*
-		 * Deregister ccw device.
-		 * Unfortunately, we cannot do this directly from the
-		 * attribute method.
-		 */
-		/* Get cdev reference for workqueue processing. */
-		if (!get_device(&cdev->dev))
-			return;
-		spin_lock_irqsave(cdev->ccwlock, flags);
-		cdev->private->state = DEV_STATE_NOT_OPER;
-		spin_unlock_irqrestore(cdev->ccwlock, flags);
-		PREPARE_WORK(&cdev->private->kick_work,
-				ccw_device_remove_orphan_cb);
-		queue_work(slow_path_wq, &cdev->private->kick_work);
-	} else
-		/* Deregister subchannel, which will kill the ccw device. */
-		ccw_device_schedule_sch_unregister(cdev);
-}
+static void io_subchannel_quiesce(struct subchannel *);
 
 /**
  * ccw_device_set_offline() - disable a ccw device for I/O
@@ -360,7 +329,8 @@ ccw_device_remove_disconnected(struct ccw_device *cdev)
  */
 int ccw_device_set_offline(struct ccw_device *cdev)
 {
-	int ret;
+	struct subchannel *sch;
+	int ret, state;
 
 	if (!cdev)
 		return -ENODEV;
@@ -374,6 +344,7 @@ int ccw_device_set_offline(struct ccw_device *cdev)
 	}
 	cdev->online = 0;
 	spin_lock_irq(cdev->ccwlock);
+	sch = to_subchannel(cdev->dev.parent);
 	/* Wait until a final state or DISCONNECTED is reached */
 	while (!dev_fsm_final_state(cdev) &&
 	       cdev->private->state != DEV_STATE_DISCONNECTED) {
@@ -382,20 +353,37 @@ int ccw_device_set_offline(struct ccw_device *cdev)
 			   cdev->private->state == DEV_STATE_DISCONNECTED));
 		spin_lock_irq(cdev->ccwlock);
 	}
-	ret = ccw_device_offline(cdev);
-	if (ret)
-		goto error;
+	do {
+		ret = ccw_device_offline(cdev);
+		if (!ret)
+			break;
+		CIO_MSG_EVENT(0, "ccw_device_offline returned %d, device "
+			      "0.%x.%04x\n", ret, cdev->private->dev_id.ssid,
+			      cdev->private->dev_id.devno);
+		if (ret != -EBUSY)
+			goto error;
+		state = cdev->private->state;
+		spin_unlock_irq(cdev->ccwlock);
+		io_subchannel_quiesce(sch);
+		spin_lock_irq(cdev->ccwlock);
+		cdev->private->state = state;
+	} while (ret == -EBUSY);
 	spin_unlock_irq(cdev->ccwlock);
 	wait_event(cdev->private->wait_q, (dev_fsm_final_state(cdev) ||
 		   cdev->private->state == DEV_STATE_DISCONNECTED));
+	/* Inform the user if set offline failed. */
+	if (cdev->private->state == DEV_STATE_BOXED) {
+		pr_warning("%s: The device entered boxed state while "
+			   "being set offline\n", dev_name(&cdev->dev));
+	} else if (cdev->private->state == DEV_STATE_NOT_OPER) {
+		pr_warning("%s: The device stopped operating while "
+			   "being set offline\n", dev_name(&cdev->dev));
+	}
 	/* Give up reference from ccw_device_set_online(). */
 	put_device(&cdev->dev);
 	return 0;
 
 error:
-	CIO_MSG_EVENT(0, "ccw_device_offline returned %d, device 0.%x.%04x\n",
-		      ret, cdev->private->dev_id.ssid,
-		      cdev->private->dev_id.devno);
 	cdev->private->state = DEV_STATE_OFFLINE;
 	dev_fsm_event(cdev, DEV_EVENT_NOTOPER);
 	spin_unlock_irq(cdev->ccwlock);
@@ -448,6 +436,16 @@ int ccw_device_set_online(struct ccw_device *cdev)
 	if ((cdev->private->state != DEV_STATE_ONLINE) &&
 	    (cdev->private->state != DEV_STATE_W4SENSE)) {
 		spin_unlock_irq(cdev->ccwlock);
+		/* Inform the user that set online failed. */
+		if (cdev->private->state == DEV_STATE_BOXED) {
+			pr_warning("%s: Setting the device online failed "
+				   "because it is boxed\n",
+				   dev_name(&cdev->dev));
+		} else if (cdev->private->state == DEV_STATE_NOT_OPER) {
+			pr_warning("%s: Setting the device online failed "
+				   "because it is not operational\n",
+				   dev_name(&cdev->dev));
+		}
 		/* Give up online reference since onlining failed. */
 		put_device(&cdev->dev);
 		return -ENODEV;
@@ -494,27 +492,22 @@ error:
 
 static int online_store_handle_offline(struct ccw_device *cdev)
 {
-	if (cdev->private->state == DEV_STATE_DISCONNECTED)
-		ccw_device_remove_disconnected(cdev);
-	else if (cdev->online && cdev->drv && cdev->drv->set_offline)
+	if (cdev->private->state == DEV_STATE_DISCONNECTED) {
+		spin_lock_irq(cdev->ccwlock);
+		ccw_device_sched_todo(cdev, CDEV_TODO_UNREG_EVAL);
+		spin_unlock_irq(cdev->ccwlock);
+	} else if (cdev->online && cdev->drv && cdev->drv->set_offline)
 		return ccw_device_set_offline(cdev);
 	return 0;
 }
 
 static int online_store_recog_and_online(struct ccw_device *cdev)
 {
-	int ret;
-
 	/* Do device recognition, if needed. */
 	if (cdev->private->state == DEV_STATE_BOXED) {
-		ret = ccw_device_recognition(cdev);
-		if (ret) {
-			CIO_MSG_EVENT(0, "Couldn't start recognition "
-				      "for device 0.%x.%04x (ret=%d)\n",
-				      cdev->private->dev_id.ssid,
-				      cdev->private->dev_id.devno, ret);
-			return ret;
-		}
+		spin_lock_irq(cdev->ccwlock);
+		ccw_device_recognition(cdev);
+		spin_unlock_irq(cdev->ccwlock);
 		wait_event(cdev->private->wait_q,
 			   cdev->private->flags.recog_done);
 		if (cdev->private->state != DEV_STATE_OFFLINE)
@@ -553,11 +546,10 @@ static ssize_t online_store (struct device *dev, struct device_attribute *attr,
 	int force, ret;
 	unsigned long i;
 
-	if ((cdev->private->state != DEV_STATE_OFFLINE &&
-	     cdev->private->state != DEV_STATE_ONLINE &&
-	     cdev->private->state != DEV_STATE_BOXED &&
-	     cdev->private->state != DEV_STATE_DISCONNECTED) ||
-	    atomic_cmpxchg(&cdev->private->onoff, 0, 1) != 0)
+	if (!dev_fsm_final_state(cdev) &&
+	    cdev->private->state != DEV_STATE_DISCONNECTED)
+		return -EAGAIN;
+	if (atomic_cmpxchg(&cdev->private->onoff, 0, 1) != 0)
 		return -EAGAIN;
 
 	if (cdev->drv && !try_module_get(cdev->drv->owner)) {
@@ -665,81 +657,31 @@ static int ccw_device_register(struct ccw_device *cdev)
 			   cdev->private->dev_id.devno);
 	if (ret)
 		return ret;
-	ret = device_add(dev);
-	if (ret)
-		return ret;
-
-	set_bit(1, &cdev->private->registered);
-	return ret;
+	return device_add(dev);
 }
 
-struct match_data {
-	struct ccw_dev_id dev_id;
-	struct ccw_device * sibling;
-};
-
-static int
-match_devno(struct device * dev, void * data)
-{
-	struct match_data * d = data;
-	struct ccw_device * cdev;
-
-	cdev = to_ccwdev(dev);
-	if ((cdev->private->state == DEV_STATE_DISCONNECTED) &&
-	    !ccw_device_is_orphan(cdev) &&
-	    ccw_dev_id_is_equal(&cdev->private->dev_id, &d->dev_id) &&
-	    (cdev != d->sibling))
-		return 1;
-	return 0;
-}
-
-static struct ccw_device * get_disc_ccwdev_by_dev_id(struct ccw_dev_id *dev_id,
-						     struct ccw_device *sibling)
-{
-	struct device *dev;
-	struct match_data data;
-
-	data.dev_id = *dev_id;
-	data.sibling = sibling;
-	dev = bus_find_device(&ccw_bus_type, NULL, &data, match_devno);
-
-	return dev ? to_ccwdev(dev) : NULL;
-}
-
-static int match_orphan(struct device *dev, void *data)
+static int match_dev_id(struct device *dev, void *data)
 {
-	struct ccw_dev_id *dev_id;
-	struct ccw_device *cdev;
+	struct ccw_device *cdev = to_ccwdev(dev);
+	struct ccw_dev_id *dev_id = data;
 
-	dev_id = data;
-	cdev = to_ccwdev(dev);
 	return ccw_dev_id_is_equal(&cdev->private->dev_id, dev_id);
 }
 
-static struct ccw_device *
-get_orphaned_ccwdev_by_dev_id(struct channel_subsystem *css,
-			      struct ccw_dev_id *dev_id)
+static struct ccw_device *get_ccwdev_by_dev_id(struct ccw_dev_id *dev_id)
 {
 	struct device *dev;
 
-	dev = device_find_child(&css->pseudo_subchannel->dev, dev_id,
-				match_orphan);
+	dev = bus_find_device(&ccw_bus_type, NULL, dev_id, match_dev_id);
 
 	return dev ? to_ccwdev(dev) : NULL;
 }
 
-void ccw_device_do_unbind_bind(struct work_struct *work)
+static void ccw_device_do_unbind_bind(struct ccw_device *cdev)
 {
-	struct ccw_device_private *priv;
-	struct ccw_device *cdev;
-	struct subchannel *sch;
 	int ret;
 
-	priv = container_of(work, struct ccw_device_private, kick_work);
-	cdev = priv->cdev;
-	sch = to_subchannel(cdev->dev.parent);
-
-	if (test_bit(1, &cdev->private->registered)) {
+	if (device_is_registered(&cdev->dev)) {
 		device_release_driver(&cdev->dev);
 		ret = device_attach(&cdev->dev);
 		WARN_ON(ret == -ENODEV);
@@ -773,6 +715,8 @@ static struct ccw_device * io_subchannel_allocate_dev(struct subchannel *sch)
 	return ERR_PTR(-ENOMEM);
 }
 
+static void ccw_device_todo(struct work_struct *work);
+
 static int io_subchannel_initialize_dev(struct subchannel *sch,
 					struct ccw_device *cdev)
 {
@@ -780,7 +724,7 @@ static int io_subchannel_initialize_dev(struct subchannel *sch,
 	atomic_set(&cdev->private->onoff, 0);
 	cdev->dev.parent = &sch->dev;
 	cdev->dev.release = ccw_device_release;
-	INIT_WORK(&cdev->private->kick_work, NULL);
+	INIT_WORK(&cdev->private->todo_work, ccw_device_todo);
 	cdev->dev.groups = ccwdev_attr_groups;
 	/* Do first half of device_register. */
 	device_initialize(&cdev->dev);
@@ -789,6 +733,7 @@ static int io_subchannel_initialize_dev(struct subchannel *sch,
 		put_device(&cdev->dev);
 		return -ENODEV;
 	}
+	cdev->private->flags.initialized = 1;
 	return 0;
 }
 
@@ -806,76 +751,7 @@ static struct ccw_device * io_subchannel_create_ccwdev(struct subchannel *sch)
 	return cdev;
 }
 
-static int io_subchannel_recog(struct ccw_device *, struct subchannel *);
-
-static void sch_attach_device(struct subchannel *sch,
-			      struct ccw_device *cdev)
-{
-	css_update_ssd_info(sch);
-	spin_lock_irq(sch->lock);
-	sch_set_cdev(sch, cdev);
-	cdev->private->schid = sch->schid;
-	cdev->ccwlock = sch->lock;
-	ccw_device_trigger_reprobe(cdev);
-	spin_unlock_irq(sch->lock);
-}
-
-static void sch_attach_disconnected_device(struct subchannel *sch,
-					   struct ccw_device *cdev)
-{
-	struct subchannel *other_sch;
-	int ret;
-
-	/* Get reference for new parent. */
-	if (!get_device(&sch->dev))
-		return;
-	other_sch = to_subchannel(cdev->dev.parent);
-	/* Note: device_move() changes cdev->dev.parent */
-	ret = device_move(&cdev->dev, &sch->dev, DPM_ORDER_PARENT_BEFORE_DEV);
-	if (ret) {
-		CIO_MSG_EVENT(0, "Moving disconnected device 0.%x.%04x failed "
-			      "(ret=%d)!\n", cdev->private->dev_id.ssid,
-			      cdev->private->dev_id.devno, ret);
-		/* Put reference for new parent. */
-		put_device(&sch->dev);
-		return;
-	}
-	sch_set_cdev(other_sch, NULL);
-	/* No need to keep a subchannel without ccw device around. */
-	css_sch_device_unregister(other_sch);
-	sch_attach_device(sch, cdev);
-	/* Put reference for old parent. */
-	put_device(&other_sch->dev);
-}
-
-static void sch_attach_orphaned_device(struct subchannel *sch,
-				       struct ccw_device *cdev)
-{
-	int ret;
-	struct subchannel *pseudo_sch;
-
-	/* Get reference for new parent. */
-	if (!get_device(&sch->dev))
-		return;
-	pseudo_sch = to_subchannel(cdev->dev.parent);
-	/*
-	 * Try to move the ccw device to its new subchannel.
-	 * Note: device_move() changes cdev->dev.parent
-	 */
-	ret = device_move(&cdev->dev, &sch->dev, DPM_ORDER_PARENT_BEFORE_DEV);
-	if (ret) {
-		CIO_MSG_EVENT(0, "Moving device 0.%x.%04x from orphanage "
-			      "failed (ret=%d)!\n",
-			      cdev->private->dev_id.ssid,
-			      cdev->private->dev_id.devno, ret);
-		/* Put reference for new parent. */
-		put_device(&sch->dev);
-		return;
-	}
-	sch_attach_device(sch, cdev);
-	/* Put reference on pseudo subchannel. */
-	put_device(&pseudo_sch->dev);
-}
+static void io_subchannel_recog(struct ccw_device *, struct subchannel *);
 
 static void sch_create_and_recog_new_device(struct subchannel *sch)
 {
@@ -888,100 +764,19 @@ static void sch_create_and_recog_new_device(struct subchannel *sch)
 		css_sch_device_unregister(sch);
 		return;
 	}
-	spin_lock_irq(sch->lock);
-	sch_set_cdev(sch, cdev);
-	spin_unlock_irq(sch->lock);
 	/* Start recognition for the new ccw device. */
-	if (io_subchannel_recog(cdev, sch)) {
-		spin_lock_irq(sch->lock);
-		sch_set_cdev(sch, NULL);
-		spin_unlock_irq(sch->lock);
-		css_sch_device_unregister(sch);
-		/* Put reference from io_subchannel_create_ccwdev(). */
-		put_device(&sch->dev);
-		/* Give up initial reference. */
-		put_device(&cdev->dev);
-	}
-}
-
-
-void ccw_device_move_to_orphanage(struct work_struct *work)
-{
-	struct ccw_device_private *priv;
-	struct ccw_device *cdev;
-	struct ccw_device *replacing_cdev;
-	struct subchannel *sch;
-	int ret;
-	struct channel_subsystem *css;
-	struct ccw_dev_id dev_id;
-
-	priv = container_of(work, struct ccw_device_private, kick_work);
-	cdev = priv->cdev;
-	sch = to_subchannel(cdev->dev.parent);
-	css = to_css(sch->dev.parent);
-	dev_id.devno = sch->schib.pmcw.dev;
-	dev_id.ssid = sch->schid.ssid;
-
-	/* Increase refcount for pseudo subchannel. */
-	get_device(&css->pseudo_subchannel->dev);
-	/*
-	 * Move the orphaned ccw device to the orphanage so the replacing
-	 * ccw device can take its place on the subchannel.
-	 * Note: device_move() changes cdev->dev.parent
-	 */
-	ret = device_move(&cdev->dev, &css->pseudo_subchannel->dev,
-		DPM_ORDER_NONE);
-	if (ret) {
-		CIO_MSG_EVENT(0, "Moving device 0.%x.%04x to orphanage failed "
-			      "(ret=%d)!\n", cdev->private->dev_id.ssid,
-			      cdev->private->dev_id.devno, ret);
-		/* Decrease refcount for pseudo subchannel again. */
-		put_device(&css->pseudo_subchannel->dev);
-		return;
-	}
-	cdev->ccwlock = css->pseudo_subchannel->lock;
-	/*
-	 * Search for the replacing ccw device
-	 * - among the disconnected devices
-	 * - in the orphanage
-	 */
-	replacing_cdev = get_disc_ccwdev_by_dev_id(&dev_id, cdev);
-	if (replacing_cdev) {
-		sch_attach_disconnected_device(sch, replacing_cdev);
-		/* Release reference from get_disc_ccwdev_by_dev_id() */
-		put_device(&replacing_cdev->dev);
-		/* Release reference of subchannel from old cdev. */
-		put_device(&sch->dev);
-		return;
-	}
-	replacing_cdev = get_orphaned_ccwdev_by_dev_id(css, &dev_id);
-	if (replacing_cdev) {
-		sch_attach_orphaned_device(sch, replacing_cdev);
-		/* Release reference from get_orphaned_ccwdev_by_dev_id() */
-		put_device(&replacing_cdev->dev);
-		/* Release reference of subchannel from old cdev. */
-		put_device(&sch->dev);
-		return;
-	}
-	sch_create_and_recog_new_device(sch);
-	/* Release reference of subchannel from old cdev. */
-	put_device(&sch->dev);
+	io_subchannel_recog(cdev, sch);
 }
 
 /*
  * Register recognized device.
  */
-static void
-io_subchannel_register(struct work_struct *work)
+static void io_subchannel_register(struct ccw_device *cdev)
 {
-	struct ccw_device_private *priv;
-	struct ccw_device *cdev;
 	struct subchannel *sch;
 	int ret;
 	unsigned long flags;
 
-	priv = container_of(work, struct ccw_device_private, kick_work);
-	cdev = priv->cdev;
 	sch = to_subchannel(cdev->dev.parent);
 	/*
 	 * Check if subchannel is still registered. It may have become
@@ -1033,41 +828,23 @@ out:
 	cdev->private->flags.recog_done = 1;
 	wake_up(&cdev->private->wait_q);
 out_err:
-	/* Release reference for workqueue processing. */
-	put_device(&cdev->dev);
 	if (atomic_dec_and_test(&ccw_device_init_count))
 		wake_up(&ccw_device_init_wq);
 }
 
-static void ccw_device_call_sch_unregister(struct work_struct *work)
+static void ccw_device_call_sch_unregister(struct ccw_device *cdev)
 {
-	struct ccw_device_private *priv;
-	struct ccw_device *cdev;
 	struct subchannel *sch;
 
-	priv = container_of(work, struct ccw_device_private, kick_work);
-	cdev = priv->cdev;
 	/* Get subchannel reference for local processing. */
 	if (!get_device(cdev->dev.parent))
 		return;
 	sch = to_subchannel(cdev->dev.parent);
 	css_sch_device_unregister(sch);
-	/* Release cdev reference for workqueue processing.*/
-	put_device(&cdev->dev);
 	/* Release subchannel reference for local processing. */
 	put_device(&sch->dev);
 }
 
-void ccw_device_schedule_sch_unregister(struct ccw_device *cdev)
-{
-	/* Get cdev reference for workqueue processing. */
-	if (!get_device(&cdev->dev))
-		return;
-	PREPARE_WORK(&cdev->private->kick_work,
-		     ccw_device_call_sch_unregister);
-	queue_work(slow_path_wq, &cdev->private->kick_work);
-}
-
 /*
  * subchannel recognition done. Called from the state machine.
  */
@@ -1083,7 +860,8 @@ io_subchannel_recog_done(struct ccw_device *cdev)
 		/* Device did not respond in time. */
 	case DEV_STATE_NOT_OPER:
 		cdev->private->flags.recog_done = 1;
-		ccw_device_schedule_sch_unregister(cdev);
+		/* Remove device found not operational. */
+		ccw_device_sched_todo(cdev, CDEV_TODO_UNREG);
 		if (atomic_dec_and_test(&ccw_device_init_count))
 			wake_up(&ccw_device_init_wq);
 		break;
@@ -1092,22 +870,15 @@ io_subchannel_recog_done(struct ccw_device *cdev)
 		 * We can't register the device in interrupt context so
 		 * we schedule a work item.
 		 */
-		if (!get_device(&cdev->dev))
-			break;
-		PREPARE_WORK(&cdev->private->kick_work,
-			     io_subchannel_register);
-		queue_work(slow_path_wq, &cdev->private->kick_work);
+		ccw_device_sched_todo(cdev, CDEV_TODO_REGISTER);
 		break;
 	}
 }
 
-static int
-io_subchannel_recog(struct ccw_device *cdev, struct subchannel *sch)
+static void io_subchannel_recog(struct ccw_device *cdev, struct subchannel *sch)
 {
-	int rc;
 	struct ccw_device_private *priv;
 
-	sch_set_cdev(sch, cdev);
 	cdev->ccwlock = sch->lock;
 
 	/* Init private data. */
@@ -1125,62 +896,81 @@ io_subchannel_recog(struct ccw_device *cdev, struct subchannel *sch)
 
 	/* Start async. device sensing. */
 	spin_lock_irq(sch->lock);
-	rc = ccw_device_recognition(cdev);
+	sch_set_cdev(sch, cdev);
+	ccw_device_recognition(cdev);
 	spin_unlock_irq(sch->lock);
-	if (rc) {
-		if (atomic_dec_and_test(&ccw_device_init_count))
-			wake_up(&ccw_device_init_wq);
-	}
-	return rc;
 }
 
-static void ccw_device_move_to_sch(struct work_struct *work)
+static int ccw_device_move_to_sch(struct ccw_device *cdev,
+				  struct subchannel *sch)
 {
-	struct ccw_device_private *priv;
-	int rc;
-	struct subchannel *sch;
-	struct ccw_device *cdev;
-	struct subchannel *former_parent;
+	struct subchannel *old_sch;
+	int rc, old_enabled = 0;
 
-	priv = container_of(work, struct ccw_device_private, kick_work);
-	sch = priv->sch;
-	cdev = priv->cdev;
-	former_parent = to_subchannel(cdev->dev.parent);
-	/* Get reference for new parent. */
+	old_sch = to_subchannel(cdev->dev.parent);
+	/* Obtain child reference for new parent. */
 	if (!get_device(&sch->dev))
-		return;
+		return -ENODEV;
+
+	if (!sch_is_pseudo_sch(old_sch)) {
+		spin_lock_irq(old_sch->lock);
+		old_enabled = old_sch->schib.pmcw.ena;
+		rc = 0;
+		if (old_enabled)
+			rc = cio_disable_subchannel(old_sch);
+		spin_unlock_irq(old_sch->lock);
+		if (rc == -EBUSY) {
+			/* Release child reference for new parent. */
+			put_device(&sch->dev);
+			return rc;
+		}
+	}
+
 	mutex_lock(&sch->reg_mutex);
-	/*
-	 * Try to move the ccw device to its new subchannel.
-	 * Note: device_move() changes cdev->dev.parent
-	 */
 	rc = device_move(&cdev->dev, &sch->dev, DPM_ORDER_PARENT_BEFORE_DEV);
 	mutex_unlock(&sch->reg_mutex);
 	if (rc) {
-		CIO_MSG_EVENT(0, "Moving device 0.%x.%04x to subchannel "
-			      "0.%x.%04x failed (ret=%d)!\n",
+		CIO_MSG_EVENT(0, "device_move(0.%x.%04x,0.%x.%04x)=%d\n",
 			      cdev->private->dev_id.ssid,
 			      cdev->private->dev_id.devno, sch->schid.ssid,
-			      sch->schid.sch_no, rc);
-		css_sch_device_unregister(sch);
-		/* Put reference for new parent again. */
+			      sch->schib.pmcw.dev, rc);
+		if (old_enabled) {
+			/* Try to reenable the old subchannel. */
+			spin_lock_irq(old_sch->lock);
+			cio_enable_subchannel(old_sch, (u32)(addr_t)old_sch);
+			spin_unlock_irq(old_sch->lock);
+		}
+		/* Release child reference for new parent. */
 		put_device(&sch->dev);
-		goto out;
+		return rc;
 	}
-	if (!sch_is_pseudo_sch(former_parent)) {
-		spin_lock_irq(former_parent->lock);
-		sch_set_cdev(former_parent, NULL);
-		spin_unlock_irq(former_parent->lock);
-		css_sch_device_unregister(former_parent);
-		/* Reset intparm to zeroes. */
-		former_parent->config.intparm = 0;
-		cio_commit_config(former_parent);
+	/* Clean up old subchannel. */
+	if (!sch_is_pseudo_sch(old_sch)) {
+		spin_lock_irq(old_sch->lock);
+		sch_set_cdev(old_sch, NULL);
+		spin_unlock_irq(old_sch->lock);
+		css_schedule_eval(old_sch->schid);
 	}
-	sch_attach_device(sch, cdev);
-out:
-	/* Put reference for old parent. */
-	put_device(&former_parent->dev);
-	put_device(&cdev->dev);
+	/* Release child reference for old parent. */
+	put_device(&old_sch->dev);
+	/* Initialize new subchannel. */
+	spin_lock_irq(sch->lock);
+	cdev->private->schid = sch->schid;
+	cdev->ccwlock = sch->lock;
+	if (!sch_is_pseudo_sch(sch))
+		sch_set_cdev(sch, cdev);
+	spin_unlock_irq(sch->lock);
+	if (!sch_is_pseudo_sch(sch))
+		css_update_ssd_info(sch);
+	return 0;
+}
+
+static int ccw_device_move_to_orph(struct ccw_device *cdev)
+{
+	struct subchannel *sch = to_subchannel(cdev->dev.parent);
+	struct channel_subsystem *css = to_css(sch->dev.parent);
+
+	return ccw_device_move_to_sch(cdev, css->pseudo_subchannel);
 }
 
 static void io_subchannel_irq(struct subchannel *sch)
@@ -1199,9 +989,6 @@ void io_subchannel_init_config(struct subchannel *sch)
 {
 	memset(&sch->config, 0, sizeof(sch->config));
 	sch->config.csense = 1;
-	/* Use subchannel mp mode when there is more than 1 installed CHPID. */
-	if ((sch->schib.pmcw.pim & (sch->schib.pmcw.pim - 1)) != 0)
-		sch->config.mp = 1;
 }
 
 static void io_subchannel_init_fields(struct subchannel *sch)
@@ -1222,23 +1009,6 @@ static void io_subchannel_init_fields(struct subchannel *sch)
 	io_subchannel_init_config(sch);
 }
 
-static void io_subchannel_do_unreg(struct work_struct *work)
-{
-	struct subchannel *sch;
-
-	sch = container_of(work, struct subchannel, work);
-	css_sch_device_unregister(sch);
-	put_device(&sch->dev);
-}
-
-/* Schedule unregister if we have no cdev. */
-static void io_subchannel_schedule_removal(struct subchannel *sch)
-{
-	get_device(&sch->dev);
-	INIT_WORK(&sch->work, io_subchannel_do_unreg);
-	queue_work(slow_path_wq, &sch->work);
-}
-
 /*
  * Note: We always return 0 so that we bind to the device even on error.
  * This is needed so that our remove function is called on unregister.
@@ -1247,8 +1017,6 @@ static int io_subchannel_probe(struct subchannel *sch)
 {
 	struct ccw_device *cdev;
 	int rc;
-	unsigned long flags;
-	struct ccw_dev_id dev_id;
 
 	if (cio_is_console(sch->schid)) {
 		rc = sysfs_create_group(&sch->dev.kobj,
@@ -1268,6 +1036,7 @@ static int io_subchannel_probe(struct subchannel *sch)
 		cdev = sch_get_cdev(sch);
 		cdev->dev.groups = ccwdev_attr_groups;
 		device_initialize(&cdev->dev);
+		cdev->private->flags.initialized = 1;
 		ccw_device_register(cdev);
 		/*
 		 * Check if the device is already online. If it is
@@ -1292,44 +1061,14 @@ static int io_subchannel_probe(struct subchannel *sch)
 	sch->private = kzalloc(sizeof(struct io_subchannel_private),
 			       GFP_KERNEL | GFP_DMA);
 	if (!sch->private)
-		goto out_err;
-	/*
-	 * First check if a fitting device may be found amongst the
-	 * disconnected devices or in the orphanage.
-	 */
-	dev_id.devno = sch->schib.pmcw.dev;
-	dev_id.ssid = sch->schid.ssid;
-	cdev = get_disc_ccwdev_by_dev_id(&dev_id, NULL);
-	if (!cdev)
-		cdev = get_orphaned_ccwdev_by_dev_id(to_css(sch->dev.parent),
-						     &dev_id);
-	if (cdev) {
-		/*
-		 * Schedule moving the device until when we have a registered
-		 * subchannel to move to and succeed the probe. We can
-		 * unregister later again, when the probe is through.
-		 */
-		cdev->private->sch = sch;
-		PREPARE_WORK(&cdev->private->kick_work,
-			     ccw_device_move_to_sch);
-		queue_work(slow_path_wq, &cdev->private->kick_work);
-		return 0;
-	}
-	cdev = io_subchannel_create_ccwdev(sch);
-	if (IS_ERR(cdev))
-		goto out_err;
-	rc = io_subchannel_recog(cdev, sch);
-	if (rc) {
-		spin_lock_irqsave(sch->lock, flags);
-		io_subchannel_recog_done(cdev);
-		spin_unlock_irqrestore(sch->lock, flags);
-	}
+		goto out_schedule;
+	css_schedule_eval(sch->schid);
 	return 0;
-out_err:
-	kfree(sch->private);
-	sysfs_remove_group(&sch->dev.kobj, &io_subchannel_attr_group);
+
 out_schedule:
-	io_subchannel_schedule_removal(sch);
+	spin_lock_irq(sch->lock);
+	css_sched_sch_todo(sch, SCH_TODO_UNREG);
+	spin_unlock_irq(sch->lock);
 	return 0;
 }
 
@@ -1337,32 +1076,23 @@ static int
 io_subchannel_remove (struct subchannel *sch)
 {
 	struct ccw_device *cdev;
-	unsigned long flags;
 
 	cdev = sch_get_cdev(sch);
 	if (!cdev)
-		return 0;
+		goto out_free;
+	io_subchannel_quiesce(sch);
 	/* Set ccw device to not operational and drop reference. */
-	spin_lock_irqsave(cdev->ccwlock, flags);
+	spin_lock_irq(cdev->ccwlock);
 	sch_set_cdev(sch, NULL);
 	cdev->private->state = DEV_STATE_NOT_OPER;
-	spin_unlock_irqrestore(cdev->ccwlock, flags);
+	spin_unlock_irq(cdev->ccwlock);
 	ccw_device_unregister(cdev);
+out_free:
 	kfree(sch->private);
 	sysfs_remove_group(&sch->dev.kobj, &io_subchannel_attr_group);
 	return 0;
 }
 
-static int io_subchannel_notify(struct subchannel *sch, int event)
-{
-	struct ccw_device *cdev;
-
-	cdev = sch_get_cdev(sch);
-	if (!cdev)
-		return 0;
-	return ccw_device_notify(cdev, event);
-}
-
 static void io_subchannel_verify(struct subchannel *sch)
 {
 	struct ccw_device *cdev;
@@ -1372,36 +1102,6 @@ static void io_subchannel_verify(struct subchannel *sch)
 		dev_fsm_event(cdev, DEV_EVENT_VERIFY);
 }
 
-static int check_for_io_on_path(struct subchannel *sch, int mask)
-{
-	if (cio_update_schib(sch))
-		return 0;
-	if (scsw_actl(&sch->schib.scsw) && sch->schib.pmcw.lpum == mask)
-		return 1;
-	return 0;
-}
-
-static void terminate_internal_io(struct subchannel *sch,
-				  struct ccw_device *cdev)
-{
-	if (cio_clear(sch)) {
-		/* Recheck device in case clear failed. */
-		sch->lpm = 0;
-		if (cdev->online)
-			dev_fsm_event(cdev, DEV_EVENT_VERIFY);
-		else
-			css_schedule_eval(sch->schid);
-		return;
-	}
-	cdev->private->state = DEV_STATE_CLEAR_VERIFY;
-	/* Request retry of internal operation. */
-	cdev->private->flags.intretry = 1;
-	/* Call handler. */
-	if (cdev->handler)
-		cdev->handler(cdev, cdev->private->intparm,
-			      ERR_PTR(-EIO));
-}
-
 static void io_subchannel_terminate_path(struct subchannel *sch, u8 mask)
 {
 	struct ccw_device *cdev;
@@ -1409,18 +1109,24 @@ static void io_subchannel_terminate_path(struct subchannel *sch, u8 mask)
 	cdev = sch_get_cdev(sch);
 	if (!cdev)
 		return;
-	if (check_for_io_on_path(sch, mask)) {
-		if (cdev->private->state == DEV_STATE_ONLINE)
-			ccw_device_kill_io(cdev);
-		else {
-			terminate_internal_io(sch, cdev);
-			/* Re-start path verification. */
-			dev_fsm_event(cdev, DEV_EVENT_VERIFY);
-		}
-	} else
-		/* trigger path verification. */
-		dev_fsm_event(cdev, DEV_EVENT_VERIFY);
+	if (cio_update_schib(sch))
+		goto err;
+	/* Check for I/O on path. */
+	if (scsw_actl(&sch->schib.scsw) == 0 || sch->schib.pmcw.lpum != mask)
+		goto out;
+	if (cdev->private->state == DEV_STATE_ONLINE) {
+		ccw_device_kill_io(cdev);
+		goto out;
+	}
+	if (cio_clear(sch))
+		goto err;
+out:
+	/* Trigger path verification. */
+	dev_fsm_event(cdev, DEV_EVENT_VERIFY);
+	return;
 
+err:
+	dev_fsm_event(cdev, DEV_EVENT_NOTOPER);
 }
 
 static int io_subchannel_chp_event(struct subchannel *sch,
@@ -1457,46 +1163,41 @@ static int io_subchannel_chp_event(struct subchannel *sch,
 	return 0;
 }
 
-static void
-io_subchannel_shutdown(struct subchannel *sch)
+static void io_subchannel_quiesce(struct subchannel *sch)
 {
 	struct ccw_device *cdev;
 	int ret;
 
+	spin_lock_irq(sch->lock);
 	cdev = sch_get_cdev(sch);
-
 	if (cio_is_console(sch->schid))
-		return;
+		goto out_unlock;
 	if (!sch->schib.pmcw.ena)
-		/* Nothing to do. */
-		return;
+		goto out_unlock;
 	ret = cio_disable_subchannel(sch);
 	if (ret != -EBUSY)
-		/* Subchannel is disabled, we're done. */
-		return;
-	cdev->private->state = DEV_STATE_QUIESCE;
+		goto out_unlock;
 	if (cdev->handler)
-		cdev->handler(cdev, cdev->private->intparm,
-			      ERR_PTR(-EIO));
-	ret = ccw_device_cancel_halt_clear(cdev);
-	if (ret == -EBUSY) {
-		ccw_device_set_timeout(cdev, HZ/10);
-		wait_event(cdev->private->wait_q, dev_fsm_final_state(cdev));
+		cdev->handler(cdev, cdev->private->intparm, ERR_PTR(-EIO));
+	while (ret == -EBUSY) {
+		cdev->private->state = DEV_STATE_QUIESCE;
+		ret = ccw_device_cancel_halt_clear(cdev);
+		if (ret == -EBUSY) {
+			ccw_device_set_timeout(cdev, HZ/10);
+			spin_unlock_irq(sch->lock);
+			wait_event(cdev->private->wait_q,
+				   cdev->private->state != DEV_STATE_QUIESCE);
+			spin_lock_irq(sch->lock);
+		}
+		ret = cio_disable_subchannel(sch);
 	}
-	cio_disable_subchannel(sch);
+out_unlock:
+	spin_unlock_irq(sch->lock);
 }
 
-static int io_subchannel_get_status(struct subchannel *sch)
+static void io_subchannel_shutdown(struct subchannel *sch)
 {
-	struct schib schib;
-
-	if (stsch(sch->schid, &schib) || !schib.pmcw.dnv)
-		return CIO_GONE;
-	if (sch->schib.pmcw.dnv && (schib.pmcw.dev != sch->schib.pmcw.dev))
-		return CIO_REVALIDATE;
-	if (!sch->lpm)
-		return CIO_NO_PATH;
-	return CIO_OPER;
+	io_subchannel_quiesce(sch);
 }
 
 static int device_is_disconnected(struct ccw_device *cdev)
@@ -1575,20 +1276,16 @@ static void ccw_device_schedule_recovery(void)
 static int purge_fn(struct device *dev, void *data)
 {
 	struct ccw_device *cdev = to_ccwdev(dev);
-	struct ccw_device_private *priv = cdev->private;
-	int unreg;
+	struct ccw_dev_id *id = &cdev->private->dev_id;
 
 	spin_lock_irq(cdev->ccwlock);
-	unreg = is_blacklisted(priv->dev_id.ssid, priv->dev_id.devno) &&
-		(priv->state == DEV_STATE_OFFLINE);
+	if (is_blacklisted(id->ssid, id->devno) &&
+	    (cdev->private->state == DEV_STATE_OFFLINE)) {
+		CIO_MSG_EVENT(3, "ccw: purging 0.%x.%04x\n", id->ssid,
+			      id->devno);
+		ccw_device_sched_todo(cdev, CDEV_TODO_UNREG);
+	}
 	spin_unlock_irq(cdev->ccwlock);
-	if (!unreg)
-		goto out;
-	CIO_MSG_EVENT(3, "ccw: purging 0.%x.%04x\n", priv->dev_id.ssid,
-		      priv->dev_id.devno);
-	ccw_device_schedule_sch_unregister(cdev);
-
-out:
 	/* Abort loop in case of pending signal. */
 	if (signal_pending(current))
 		return -EINTR;
@@ -1630,91 +1327,169 @@ void ccw_device_set_notoper(struct ccw_device *cdev)
 	cdev->private->state = DEV_STATE_NOT_OPER;
 }
 
-static int io_subchannel_sch_event(struct subchannel *sch, int slow)
+enum io_sch_action {
+	IO_SCH_UNREG,
+	IO_SCH_ORPH_UNREG,
+	IO_SCH_ATTACH,
+	IO_SCH_UNREG_ATTACH,
+	IO_SCH_ORPH_ATTACH,
+	IO_SCH_REPROBE,
+	IO_SCH_VERIFY,
+	IO_SCH_DISC,
+	IO_SCH_NOP,
+};
+
+static enum io_sch_action sch_get_action(struct subchannel *sch)
+{
+	struct ccw_device *cdev;
+
+	cdev = sch_get_cdev(sch);
+	if (cio_update_schib(sch)) {
+		/* Not operational. */
+		if (!cdev)
+			return IO_SCH_UNREG;
+		if (!ccw_device_notify(cdev, CIO_GONE))
+			return IO_SCH_UNREG;
+		return IO_SCH_ORPH_UNREG;
+	}
+	/* Operational. */
+	if (!cdev)
+		return IO_SCH_ATTACH;
+	if (sch->schib.pmcw.dev != cdev->private->dev_id.devno) {
+		if (!ccw_device_notify(cdev, CIO_GONE))
+			return IO_SCH_UNREG_ATTACH;
+		return IO_SCH_ORPH_ATTACH;
+	}
+	if ((sch->schib.pmcw.pam & sch->opm) == 0) {
+		if (!ccw_device_notify(cdev, CIO_NO_PATH))
+			return IO_SCH_UNREG;
+		return IO_SCH_DISC;
+	}
+	if (device_is_disconnected(cdev))
+		return IO_SCH_REPROBE;
+	if (cdev->online)
+		return IO_SCH_VERIFY;
+	return IO_SCH_NOP;
+}
+
+/**
+ * io_subchannel_sch_event - process subchannel event
+ * @sch: subchannel
+ * @process: non-zero if function is called in process context
+ *
+ * An unspecified event occurred for this subchannel. Adjust data according
+ * to the current operational state of the subchannel and device. Return
+ * zero when the event has been handled sufficiently or -EAGAIN when this
+ * function should be called again in process context.
+ */
+static int io_subchannel_sch_event(struct subchannel *sch, int process)
 {
-	int event, ret, disc;
 	unsigned long flags;
-	enum { NONE, UNREGISTER, UNREGISTER_PROBE, REPROBE, DISC } action;
 	struct ccw_device *cdev;
+	struct ccw_dev_id dev_id;
+	enum io_sch_action action;
+	int rc = -EAGAIN;
 
 	spin_lock_irqsave(sch->lock, flags);
+	if (!device_is_registered(&sch->dev))
+		goto out_unlock;
+	if (work_pending(&sch->todo_work))
+		goto out_unlock;
 	cdev = sch_get_cdev(sch);
-	disc = device_is_disconnected(cdev);
-	if (disc && slow) {
-		/* Disconnected devices are evaluated directly only.*/
-		spin_unlock_irqrestore(sch->lock, flags);
-		return 0;
-	}
-	/* No interrupt after machine check - kill pending timers. */
-	if (cdev)
-		ccw_device_set_timeout(cdev, 0);
-	if (!disc && !slow) {
-		/* Non-disconnected devices are evaluated on the slow path. */
-		spin_unlock_irqrestore(sch->lock, flags);
-		return -EAGAIN;
+	if (cdev && work_pending(&cdev->private->todo_work))
+		goto out_unlock;
+	action = sch_get_action(sch);
+	CIO_MSG_EVENT(2, "event: sch 0.%x.%04x, process=%d, action=%d\n",
+		      sch->schid.ssid, sch->schid.sch_no, process,
+		      action);
+	/* Perform immediate actions while holding the lock. */
+	switch (action) {
+	case IO_SCH_REPROBE:
+		/* Trigger device recognition. */
+		ccw_device_trigger_reprobe(cdev);
+		rc = 0;
+		goto out_unlock;
+	case IO_SCH_VERIFY:
+		/* Trigger path verification. */
+		io_subchannel_verify(sch);
+		rc = 0;
+		goto out_unlock;
+	case IO_SCH_DISC:
+		ccw_device_set_disconnected(cdev);
+		rc = 0;
+		goto out_unlock;
+	case IO_SCH_ORPH_UNREG:
+	case IO_SCH_ORPH_ATTACH:
+		ccw_device_set_disconnected(cdev);
+		break;
+	case IO_SCH_UNREG_ATTACH:
+	case IO_SCH_UNREG:
+		if (cdev)
+			ccw_device_set_notoper(cdev);
+		break;
+	case IO_SCH_NOP:
+		rc = 0;
+		goto out_unlock;
+	default:
+		break;
 	}
-	event = io_subchannel_get_status(sch);
-	CIO_MSG_EVENT(4, "Evaluating schid 0.%x.%04x, event %d, %s, %s path.\n",
-		      sch->schid.ssid, sch->schid.sch_no, event,
-		      disc ? "disconnected" : "normal",
-		      slow ? "slow" : "fast");
-	/* Analyze subchannel status. */
-	action = NONE;
-	switch (event) {
-	case CIO_NO_PATH:
-		if (disc) {
-			/* Check if paths have become available. */
-			action = REPROBE;
-			break;
-		}
-		/* fall through */
-	case CIO_GONE:
-		/* Ask driver what to do with device. */
-		if (io_subchannel_notify(sch, event))
-			action = DISC;
-		else
-			action = UNREGISTER;
+	spin_unlock_irqrestore(sch->lock, flags);
+	/* All other actions require process context. */
+	if (!process)
+		goto out;
+	/* Handle attached ccw device. */
+	switch (action) {
+	case IO_SCH_ORPH_UNREG:
+	case IO_SCH_ORPH_ATTACH:
+		/* Move ccw device to orphanage. */
+		rc = ccw_device_move_to_orph(cdev);
+		if (rc)
+			goto out;
 		break;
-	case CIO_REVALIDATE:
-		/* Device will be removed, so no notify necessary. */
-		if (disc)
-			/* Reprobe because immediate unregister might block. */
-			action = REPROBE;
-		else
-			action = UNREGISTER_PROBE;
+	case IO_SCH_UNREG_ATTACH:
+		/* Unregister ccw device. */
+		ccw_device_unregister(cdev);
 		break;
-	case CIO_OPER:
-		if (disc)
-			/* Get device operational again. */
-			action = REPROBE;
+	default:
 		break;
 	}
-	/* Perform action. */
-	ret = 0;
+	/* Handle subchannel. */
 	switch (action) {
-	case UNREGISTER:
-	case UNREGISTER_PROBE:
-		ccw_device_set_notoper(cdev);
-		/* Unregister device (will use subchannel lock). */
-		spin_unlock_irqrestore(sch->lock, flags);
+	case IO_SCH_ORPH_UNREG:
+	case IO_SCH_UNREG:
 		css_sch_device_unregister(sch);
-		spin_lock_irqsave(sch->lock, flags);
 		break;
-	case REPROBE:
+	case IO_SCH_ORPH_ATTACH:
+	case IO_SCH_UNREG_ATTACH:
+	case IO_SCH_ATTACH:
+		dev_id.ssid = sch->schid.ssid;
+		dev_id.devno = sch->schib.pmcw.dev;
+		cdev = get_ccwdev_by_dev_id(&dev_id);
+		if (!cdev) {
+			sch_create_and_recog_new_device(sch);
+			break;
+		}
+		rc = ccw_device_move_to_sch(cdev, sch);
+		if (rc) {
+			/* Release reference from get_ccwdev_by_dev_id() */
+			put_device(&cdev->dev);
+			goto out;
+		}
+		spin_lock_irqsave(sch->lock, flags);
 		ccw_device_trigger_reprobe(cdev);
-		break;
-	case DISC:
-		ccw_device_set_disconnected(cdev);
+		spin_unlock_irqrestore(sch->lock, flags);
+		/* Release reference from get_ccwdev_by_dev_id() */
+		put_device(&cdev->dev);
 		break;
 	default:
 		break;
 	}
-	spin_unlock_irqrestore(sch->lock, flags);
-	/* Probe if necessary. */
-	if (action == UNREGISTER_PROBE)
-		ret = css_probe_device(sch->schid);
+	return 0;
 
-	return ret;
+out_unlock:
+	spin_unlock_irqrestore(sch->lock, flags);
+out:
+	return rc;
 }
 
 #ifdef CONFIG_CCW_CONSOLE
@@ -1744,10 +1519,8 @@ static int ccw_device_console_enable(struct ccw_device *cdev,
 	sch->driver = &io_subchannel_driver;
 	/* Initialize the ccw_device structure. */
 	cdev->dev.parent= &sch->dev;
-	rc = io_subchannel_recog(cdev, sch);
-	if (rc)
-		return rc;
-
+	sch_set_cdev(sch, cdev);
+	io_subchannel_recog(cdev, sch);
 	/* Now wait for the async. recognition to come to an end. */
 	spin_lock_irq(cdev->ccwlock);
 	while (!dev_fsm_final_state(cdev))
@@ -1763,7 +1536,7 @@ static int ccw_device_console_enable(struct ccw_device *cdev,
 	rc = 0;
 out_unlock:
 	spin_unlock_irq(cdev->ccwlock);
-	return 0;
+	return rc;
 }
 
 struct ccw_device *
@@ -1919,7 +1692,7 @@ static int ccw_device_pm_prepare(struct device *dev)
 {
 	struct ccw_device *cdev = to_ccwdev(dev);
 
-	if (work_pending(&cdev->private->kick_work))
+	if (work_pending(&cdev->private->todo_work))
 		return -EAGAIN;
 	/* Fail while device is being set online/offline. */
 	if (atomic_read(&cdev->private->onoff))
@@ -2005,7 +1778,6 @@ static int ccw_device_pm_thaw(struct device *dev)
 static void __ccw_device_pm_restore(struct ccw_device *cdev)
 {
 	struct subchannel *sch = to_subchannel(cdev->dev.parent);
-	int ret;
 
 	if (cio_is_console(sch->schid))
 		goto out;
@@ -2015,22 +1787,10 @@ static void __ccw_device_pm_restore(struct ccw_device *cdev)
 	 */
 	spin_lock_irq(sch->lock);
 	cdev->private->flags.resuming = 1;
-	ret = ccw_device_recognition(cdev);
+	ccw_device_recognition(cdev);
 	spin_unlock_irq(sch->lock);
-	if (ret) {
-		CIO_MSG_EVENT(0, "Couldn't start recognition for device "
-			      "0.%x.%04x (ret=%d)\n",
-			      cdev->private->dev_id.ssid,
-			      cdev->private->dev_id.devno, ret);
-		spin_lock_irq(sch->lock);
-		cdev->private->state = DEV_STATE_DISCONNECTED;
-		spin_unlock_irq(sch->lock);
-		/* notify driver after the resume cb */
-		goto out;
-	}
 	wait_event(cdev->private->wait_q, dev_fsm_final_state(cdev) ||
 		   cdev->private->state == DEV_STATE_DISCONNECTED);
-
 out:
 	cdev->private->flags.resuming = 0;
 }
@@ -2040,7 +1800,7 @@ static int resume_handle_boxed(struct ccw_device *cdev)
 	cdev->private->state = DEV_STATE_BOXED;
 	if (ccw_device_notify(cdev, CIO_BOXED))
 		return 0;
-	ccw_device_schedule_sch_unregister(cdev);
+	ccw_device_sched_todo(cdev, CDEV_TODO_UNREG);
 	return -ENODEV;
 }
 
@@ -2049,7 +1809,7 @@ static int resume_handle_disc(struct ccw_device *cdev)
 	cdev->private->state = DEV_STATE_DISCONNECTED;
 	if (ccw_device_notify(cdev, CIO_GONE))
 		return 0;
-	ccw_device_schedule_sch_unregister(cdev);
+	ccw_device_sched_todo(cdev, CDEV_TODO_UNREG);
 	return -ENODEV;
 }
 
@@ -2094,9 +1854,7 @@ static int ccw_device_pm_restore(struct device *dev)
 	/* check if the device type has changed */
 	if (!ccw_device_test_sense_data(cdev)) {
 		ccw_device_update_sense_data(cdev);
-		PREPARE_WORK(&cdev->private->kick_work,
-			     ccw_device_do_unbind_bind);
-		queue_work(ccw_device_work, &cdev->private->kick_work);
+		ccw_device_sched_todo(cdev, CDEV_TODO_REBIND);
 		ret = -ENODEV;
 		goto out_unlock;
 	}
@@ -2140,14 +1898,14 @@ out_disc_unlock:
 	goto out_restore;
 
 out_unreg_unlock:
-	ccw_device_schedule_sch_unregister(cdev);
+	ccw_device_sched_todo(cdev, CDEV_TODO_UNREG_EVAL);
 	ret = -ENODEV;
 out_unlock:
 	spin_unlock_irq(sch->lock);
 	return ret;
 }
 
-static struct dev_pm_ops ccw_pm_ops = {
+static const struct dev_pm_ops ccw_pm_ops = {
 	.prepare = ccw_device_pm_prepare,
 	.complete = ccw_device_pm_complete,
 	.freeze = ccw_device_pm_freeze,
@@ -2205,6 +1963,77 @@ ccw_device_get_subchannel_id(struct ccw_device *cdev)
 	return sch->schid;
 }
 
+static void ccw_device_todo(struct work_struct *work)
+{
+	struct ccw_device_private *priv;
+	struct ccw_device *cdev;
+	struct subchannel *sch;
+	enum cdev_todo todo;
+
+	priv = container_of(work, struct ccw_device_private, todo_work);
+	cdev = priv->cdev;
+	sch = to_subchannel(cdev->dev.parent);
+	/* Find out todo. */
+	spin_lock_irq(cdev->ccwlock);
+	todo = priv->todo;
+	priv->todo = CDEV_TODO_NOTHING;
+	CIO_MSG_EVENT(4, "cdev_todo: cdev=0.%x.%04x todo=%d\n",
+		      priv->dev_id.ssid, priv->dev_id.devno, todo);
+	spin_unlock_irq(cdev->ccwlock);
+	/* Perform todo. */
+	switch (todo) {
+	case CDEV_TODO_ENABLE_CMF:
+		cmf_reenable(cdev);
+		break;
+	case CDEV_TODO_REBIND:
+		ccw_device_do_unbind_bind(cdev);
+		break;
+	case CDEV_TODO_REGISTER:
+		io_subchannel_register(cdev);
+		break;
+	case CDEV_TODO_UNREG_EVAL:
+		if (!sch_is_pseudo_sch(sch))
+			css_schedule_eval(sch->schid);
+		/* fall-through */
+	case CDEV_TODO_UNREG:
+		if (sch_is_pseudo_sch(sch))
+			ccw_device_unregister(cdev);
+		else
+			ccw_device_call_sch_unregister(cdev);
+		break;
+	default:
+		break;
+	}
+	/* Release workqueue ref. */
+	put_device(&cdev->dev);
+}
+
+/**
+ * ccw_device_sched_todo - schedule ccw device operation
+ * @cdev: ccw device
+ * @todo: todo
+ *
+ * Schedule the operation identified by @todo to be performed on the slow path
+ * workqueue. Do nothing if another operation with higher priority is already
+ * scheduled. Needs to be called with ccwdev lock held.
+ */
+void ccw_device_sched_todo(struct ccw_device *cdev, enum cdev_todo todo)
+{
+	CIO_MSG_EVENT(4, "cdev_todo: sched cdev=0.%x.%04x todo=%d\n",
+		      cdev->private->dev_id.ssid, cdev->private->dev_id.devno,
+		      todo);
+	if (cdev->private->todo >= todo)
+		return;
+	cdev->private->todo = todo;
+	/* Get workqueue ref. */
+	if (!get_device(&cdev->dev))
+		return;
+	if (!queue_work(slow_path_wq, &cdev->private->todo_work)) {
+		/* Already queued, release workqueue ref. */
+		put_device(&cdev->dev);
+	}
+}
+
 MODULE_LICENSE("GPL");
 EXPORT_SYMBOL(ccw_device_set_online);
 EXPORT_SYMBOL(ccw_device_set_offline);
diff --git a/drivers/s390/cio/device.h b/drivers/s390/cio/device.h
index 246c6482842c..bcfe13e42638 100644
--- a/drivers/s390/cio/device.h
+++ b/drivers/s390/cio/device.h
@@ -21,7 +21,6 @@ enum dev_state {
 	DEV_STATE_DISBAND_PGID,
 	DEV_STATE_BOXED,
 	/* states to wait for i/o completion before doing something */
-	DEV_STATE_CLEAR_VERIFY,
 	DEV_STATE_TIMEOUT_KILL,
 	DEV_STATE_QUIESCE,
 	/* special states for devices gone not operational */
@@ -29,6 +28,7 @@ enum dev_state {
 	DEV_STATE_DISCONNECTED_SENSE_ID,
 	DEV_STATE_CMFCHANGE,
 	DEV_STATE_CMFUPDATE,
+	DEV_STATE_STEAL_LOCK,
 	/* last element! */
 	NR_DEV_STATES
 };
@@ -81,17 +81,16 @@ void io_subchannel_init_config(struct subchannel *sch);
 
 int ccw_device_cancel_halt_clear(struct ccw_device *);
 
-void ccw_device_do_unbind_bind(struct work_struct *);
-void ccw_device_move_to_orphanage(struct work_struct *);
 int ccw_device_is_orphan(struct ccw_device *);
 
-int ccw_device_recognition(struct ccw_device *);
+void ccw_device_recognition(struct ccw_device *);
 int ccw_device_online(struct ccw_device *);
 int ccw_device_offline(struct ccw_device *);
 void ccw_device_update_sense_data(struct ccw_device *);
 int ccw_device_test_sense_data(struct ccw_device *);
 void ccw_device_schedule_sch_unregister(struct ccw_device *);
 int ccw_purge_blacklisted(void);
+void ccw_device_sched_todo(struct ccw_device *cdev, enum cdev_todo todo);
 
 /* Function prototypes for device status and basic sense stuff. */
 void ccw_device_accumulate_irb(struct ccw_device *, struct irb *);
@@ -99,24 +98,28 @@ void ccw_device_accumulate_basic_sense(struct ccw_device *, struct irb *);
 int ccw_device_accumulate_and_sense(struct ccw_device *, struct irb *);
 int ccw_device_do_sense(struct ccw_device *, struct irb *);
 
+/* Function prototype for internal request handling. */
+int lpm_adjust(int lpm, int mask);
+void ccw_request_start(struct ccw_device *);
+int ccw_request_cancel(struct ccw_device *cdev);
+void ccw_request_handler(struct ccw_device *cdev);
+void ccw_request_timeout(struct ccw_device *cdev);
+void ccw_request_notoper(struct ccw_device *cdev);
+
 /* Function prototypes for sense id stuff. */
 void ccw_device_sense_id_start(struct ccw_device *);
-void ccw_device_sense_id_irq(struct ccw_device *, enum dev_event);
 void ccw_device_sense_id_done(struct ccw_device *, int);
 
 /* Function prototypes for path grouping stuff. */
-void ccw_device_sense_pgid_start(struct ccw_device *);
-void ccw_device_sense_pgid_irq(struct ccw_device *, enum dev_event);
-void ccw_device_sense_pgid_done(struct ccw_device *, int);
-
 void ccw_device_verify_start(struct ccw_device *);
-void ccw_device_verify_irq(struct ccw_device *, enum dev_event);
 void ccw_device_verify_done(struct ccw_device *, int);
 
 void ccw_device_disband_start(struct ccw_device *);
-void ccw_device_disband_irq(struct ccw_device *, enum dev_event);
 void ccw_device_disband_done(struct ccw_device *, int);
 
+void ccw_device_stlck_start(struct ccw_device *, void *, void *, void *);
+void ccw_device_stlck_done(struct ccw_device *, void *, int);
+
 int ccw_device_call_handler(struct ccw_device *);
 
 int ccw_device_stlck(struct ccw_device *);
diff --git a/drivers/s390/cio/device_fsm.c b/drivers/s390/cio/device_fsm.c
index b9613d7df9ef..ae760658a131 100644
--- a/drivers/s390/cio/device_fsm.c
+++ b/drivers/s390/cio/device_fsm.c
@@ -229,8 +229,8 @@ ccw_device_recog_done(struct ccw_device *cdev, int state)
 
 	sch = to_subchannel(cdev->dev.parent);
 
-	ccw_device_set_timeout(cdev, 0);
-	cio_disable_subchannel(sch);
+	if (cio_disable_subchannel(sch))
+		state = DEV_STATE_NOT_OPER;
 	/*
 	 * Now that we tried recognition, we have performed device selection
 	 * through ssch() and the path information is up to date.
@@ -263,22 +263,10 @@ ccw_device_recog_done(struct ccw_device *cdev, int state)
 	}
 	switch (state) {
 	case DEV_STATE_NOT_OPER:
-		CIO_MSG_EVENT(2, "SenseID : unknown device %04x on "
-			      "subchannel 0.%x.%04x\n",
-			      cdev->private->dev_id.devno,
-			      sch->schid.ssid, sch->schid.sch_no);
 		break;
 	case DEV_STATE_OFFLINE:
 		if (!cdev->online) {
 			ccw_device_update_sense_data(cdev);
-			/* Issue device info message. */
-			CIO_MSG_EVENT(4, "SenseID : device 0.%x.%04x reports: "
-				      "CU  Type/Mod = %04X/%02X, Dev Type/Mod "
-				      "= %04X/%02X\n",
-				      cdev->private->dev_id.ssid,
-				      cdev->private->dev_id.devno,
-				      cdev->id.cu_type, cdev->id.cu_model,
-				      cdev->id.dev_type, cdev->id.dev_model);
 			break;
 		}
 		cdev->private->state = DEV_STATE_OFFLINE;
@@ -289,16 +277,10 @@ ccw_device_recog_done(struct ccw_device *cdev, int state)
 			wake_up(&cdev->private->wait_q);
 		} else {
 			ccw_device_update_sense_data(cdev);
-			PREPARE_WORK(&cdev->private->kick_work,
-				     ccw_device_do_unbind_bind);
-			queue_work(ccw_device_work, &cdev->private->kick_work);
+			ccw_device_sched_todo(cdev, CDEV_TODO_REBIND);
 		}
 		return;
 	case DEV_STATE_BOXED:
-		CIO_MSG_EVENT(0, "SenseID : boxed device %04x on "
-			      " subchannel 0.%x.%04x\n",
-			      cdev->private->dev_id.devno,
-			      sch->schid.ssid, sch->schid.sch_no);
 		if (cdev->id.cu_type != 0) { /* device was recognized before */
 			cdev->private->flags.recog_done = 1;
 			cdev->private->state = DEV_STATE_BOXED;
@@ -343,28 +325,16 @@ int ccw_device_notify(struct ccw_device *cdev, int event)
 	return cdev->drv->notify ? cdev->drv->notify(cdev, event) : 0;
 }
 
-static void cmf_reenable_delayed(struct work_struct *work)
-{
-	struct ccw_device_private *priv;
-	struct ccw_device *cdev;
-
-	priv = container_of(work, struct ccw_device_private, kick_work);
-	cdev = priv->cdev;
-	cmf_reenable(cdev);
-}
-
 static void ccw_device_oper_notify(struct ccw_device *cdev)
 {
 	if (ccw_device_notify(cdev, CIO_OPER)) {
 		/* Reenable channel measurements, if needed. */
-		PREPARE_WORK(&cdev->private->kick_work, cmf_reenable_delayed);
-		queue_work(ccw_device_work, &cdev->private->kick_work);
+		ccw_device_sched_todo(cdev, CDEV_TODO_ENABLE_CMF);
 		return;
 	}
 	/* Driver doesn't want device back. */
 	ccw_device_set_notoper(cdev);
-	PREPARE_WORK(&cdev->private->kick_work, ccw_device_do_unbind_bind);
-	queue_work(ccw_device_work, &cdev->private->kick_work);
+	ccw_device_sched_todo(cdev, CDEV_TODO_REBIND);
 }
 
 /*
@@ -392,14 +362,14 @@ ccw_device_done(struct ccw_device *cdev, int state)
 		CIO_MSG_EVENT(0, "Boxed device %04x on subchannel %04x\n",
 			      cdev->private->dev_id.devno, sch->schid.sch_no);
 		if (cdev->online && !ccw_device_notify(cdev, CIO_BOXED))
-			ccw_device_schedule_sch_unregister(cdev);
+			ccw_device_sched_todo(cdev, CDEV_TODO_UNREG);
 		cdev->private->flags.donotify = 0;
 		break;
 	case DEV_STATE_NOT_OPER:
 		CIO_MSG_EVENT(0, "Device %04x gone on subchannel %04x\n",
 			      cdev->private->dev_id.devno, sch->schid.sch_no);
 		if (!ccw_device_notify(cdev, CIO_GONE))
-			ccw_device_schedule_sch_unregister(cdev);
+			ccw_device_sched_todo(cdev, CDEV_TODO_UNREG);
 		else
 			ccw_device_set_disconnected(cdev);
 		cdev->private->flags.donotify = 0;
@@ -409,7 +379,7 @@ ccw_device_done(struct ccw_device *cdev, int state)
 			      "%04x\n", cdev->private->dev_id.devno,
 			      sch->schid.sch_no);
 		if (!ccw_device_notify(cdev, CIO_NO_PATH))
-			ccw_device_schedule_sch_unregister(cdev);
+			ccw_device_sched_todo(cdev, CDEV_TODO_UNREG);
 		else
 			ccw_device_set_disconnected(cdev);
 		cdev->private->flags.donotify = 0;
@@ -425,107 +395,12 @@ ccw_device_done(struct ccw_device *cdev, int state)
 	wake_up(&cdev->private->wait_q);
 }
 
-static int cmp_pgid(struct pgid *p1, struct pgid *p2)
-{
-	char *c1;
-	char *c2;
-
-	c1 = (char *)p1;
-	c2 = (char *)p2;
-
-	return memcmp(c1 + 1, c2 + 1, sizeof(struct pgid) - 1);
-}
-
-static void __ccw_device_get_common_pgid(struct ccw_device *cdev)
-{
-	int i;
-	int last;
-
-	last = 0;
-	for (i = 0; i < 8; i++) {
-		if (cdev->private->pgid[i].inf.ps.state1 == SNID_STATE1_RESET)
-			/* No PGID yet */
-			continue;
-		if (cdev->private->pgid[last].inf.ps.state1 ==
-		    SNID_STATE1_RESET) {
-			/* First non-zero PGID */
-			last = i;
-			continue;
-		}
-		if (cmp_pgid(&cdev->private->pgid[i],
-			     &cdev->private->pgid[last]) == 0)
-			/* Non-conflicting PGIDs */
-			continue;
-
-		/* PGID mismatch, can't pathgroup. */
-		CIO_MSG_EVENT(0, "SNID - pgid mismatch for device "
-			      "0.%x.%04x, can't pathgroup\n",
-			      cdev->private->dev_id.ssid,
-			      cdev->private->dev_id.devno);
-		cdev->private->options.pgroup = 0;
-		return;
-	}
-	if (cdev->private->pgid[last].inf.ps.state1 ==
-	    SNID_STATE1_RESET)
-		/* No previous pgid found */
-		memcpy(&cdev->private->pgid[0],
-		       &channel_subsystems[0]->global_pgid,
-		       sizeof(struct pgid));
-	else
-		/* Use existing pgid */
-		memcpy(&cdev->private->pgid[0], &cdev->private->pgid[last],
-		       sizeof(struct pgid));
-}
-
-/*
- * Function called from device_pgid.c after sense path ground has completed.
- */
-void
-ccw_device_sense_pgid_done(struct ccw_device *cdev, int err)
-{
-	struct subchannel *sch;
-
-	sch = to_subchannel(cdev->dev.parent);
-	switch (err) {
-	case -EOPNOTSUPP: /* path grouping not supported, use nop instead. */
-		cdev->private->options.pgroup = 0;
-		break;
-	case 0: /* success */
-	case -EACCES: /* partial success, some paths not operational */
-		/* Check if all pgids are equal or 0. */
-		__ccw_device_get_common_pgid(cdev);
-		break;
-	case -ETIME:		/* Sense path group id stopped by timeout. */
-	case -EUSERS:		/* device is reserved for someone else. */
-		ccw_device_done(cdev, DEV_STATE_BOXED);
-		return;
-	default:
-		ccw_device_done(cdev, DEV_STATE_NOT_OPER);
-		return;
-	}
-	/* Start Path Group verification. */
-	cdev->private->state = DEV_STATE_VERIFY;
-	cdev->private->flags.doverify = 0;
-	ccw_device_verify_start(cdev);
-}
-
 /*
  * Start device recognition.
  */
-int
-ccw_device_recognition(struct ccw_device *cdev)
+void ccw_device_recognition(struct ccw_device *cdev)
 {
-	struct subchannel *sch;
-	int ret;
-
-	sch = to_subchannel(cdev->dev.parent);
-	ret = cio_enable_subchannel(sch, (u32)(addr_t)sch);
-	if (ret != 0)
-		/* Couldn't enable the subchannel for i/o. Sick device. */
-		return ret;
-
-	/* After 60s the device recognition is considered to have failed. */
-	ccw_device_set_timeout(cdev, 60*HZ);
+	struct subchannel *sch = to_subchannel(cdev->dev.parent);
 
 	/*
 	 * We used to start here with a sense pgid to find out whether a device
@@ -537,32 +412,33 @@ ccw_device_recognition(struct ccw_device *cdev)
 	 */
 	cdev->private->flags.recog_done = 0;
 	cdev->private->state = DEV_STATE_SENSE_ID;
+	if (cio_enable_subchannel(sch, (u32) (addr_t) sch)) {
+		ccw_device_recog_done(cdev, DEV_STATE_NOT_OPER);
+		return;
+	}
 	ccw_device_sense_id_start(cdev);
-	return 0;
 }
 
 /*
- * Handle timeout in device recognition.
+ * Handle events for states that use the ccw request infrastructure.
  */
-static void
-ccw_device_recog_timeout(struct ccw_device *cdev, enum dev_event dev_event)
+static void ccw_device_request_event(struct ccw_device *cdev, enum dev_event e)
 {
-	int ret;
-
-	ret = ccw_device_cancel_halt_clear(cdev);
-	switch (ret) {
-	case 0:
-		ccw_device_recog_done(cdev, DEV_STATE_BOXED);
+	switch (e) {
+	case DEV_EVENT_NOTOPER:
+		ccw_request_notoper(cdev);
 		break;
-	case -ENODEV:
-		ccw_device_recog_done(cdev, DEV_STATE_NOT_OPER);
+	case DEV_EVENT_INTERRUPT:
+		ccw_request_handler(cdev);
+		break;
+	case DEV_EVENT_TIMEOUT:
+		ccw_request_timeout(cdev);
 		break;
 	default:
-		ccw_device_set_timeout(cdev, 3*HZ);
+		break;
 	}
 }
 
-
 void
 ccw_device_verify_done(struct ccw_device *cdev, int err)
 {
@@ -571,21 +447,18 @@ ccw_device_verify_done(struct ccw_device *cdev, int err)
 	sch = to_subchannel(cdev->dev.parent);
 	/* Update schib - pom may have changed. */
 	if (cio_update_schib(sch)) {
-		cdev->private->flags.donotify = 0;
-		ccw_device_done(cdev, DEV_STATE_NOT_OPER);
-		return;
+		err = -ENODEV;
+		goto callback;
 	}
 	/* Update lpm with verified path mask. */
 	sch->lpm = sch->vpm;
 	/* Repeat path verification? */
 	if (cdev->private->flags.doverify) {
-		cdev->private->flags.doverify = 0;
 		ccw_device_verify_start(cdev);
 		return;
 	}
+callback:
 	switch (err) {
-	case -EOPNOTSUPP: /* path grouping not supported, just set online. */
-		cdev->private->options.pgroup = 0;
 	case 0:
 		ccw_device_done(cdev, DEV_STATE_ONLINE);
 		/* Deliver fake irb to device driver, if needed. */
@@ -604,18 +477,20 @@ ccw_device_verify_done(struct ccw_device *cdev, int err)
 		}
 		break;
 	case -ETIME:
+	case -EUSERS:
 		/* Reset oper notify indication after verify error. */
 		cdev->private->flags.donotify = 0;
 		ccw_device_done(cdev, DEV_STATE_BOXED);
 		break;
+	case -EACCES:
+		/* Reset oper notify indication after verify error. */
+		cdev->private->flags.donotify = 0;
+		ccw_device_done(cdev, DEV_STATE_DISCONNECTED);
+		break;
 	default:
 		/* Reset oper notify indication after verify error. */
 		cdev->private->flags.donotify = 0;
-		if (cdev->online) {
-			ccw_device_set_timeout(cdev, 0);
-			dev_fsm_event(cdev, DEV_EVENT_NOTOPER);
-		} else
-			ccw_device_done(cdev, DEV_STATE_NOT_OPER);
+		ccw_device_done(cdev, DEV_STATE_NOT_OPER);
 		break;
 	}
 }
@@ -640,17 +515,9 @@ ccw_device_online(struct ccw_device *cdev)
 			dev_fsm_event(cdev, DEV_EVENT_NOTOPER);
 		return ret;
 	}
-	/* Do we want to do path grouping? */
-	if (!cdev->private->options.pgroup) {
-		/* Start initial path verification. */
-		cdev->private->state = DEV_STATE_VERIFY;
-		cdev->private->flags.doverify = 0;
-		ccw_device_verify_start(cdev);
-		return 0;
-	}
-	/* Do a SensePGID first. */
-	cdev->private->state = DEV_STATE_SENSE_PGID;
-	ccw_device_sense_pgid_start(cdev);
+	/* Start initial path verification. */
+	cdev->private->state = DEV_STATE_VERIFY;
+	ccw_device_verify_start(cdev);
 	return 0;
 }
 
@@ -666,7 +533,6 @@ ccw_device_disband_done(struct ccw_device *cdev, int err)
 		break;
 	default:
 		cdev->private->flags.donotify = 0;
-		dev_fsm_event(cdev, DEV_EVENT_NOTOPER);
 		ccw_device_done(cdev, DEV_STATE_NOT_OPER);
 		break;
 	}
@@ -703,7 +569,7 @@ ccw_device_offline(struct ccw_device *cdev)
 	if (cdev->private->state != DEV_STATE_ONLINE)
 		return -EINVAL;
 	/* Are we doing path grouping? */
-	if (!cdev->private->options.pgroup) {
+	if (!cdev->private->flags.pgroup) {
 		/* No, set state offline immediately. */
 		ccw_device_done(cdev, DEV_STATE_OFFLINE);
 		return 0;
@@ -715,43 +581,13 @@ ccw_device_offline(struct ccw_device *cdev)
 }
 
 /*
- * Handle timeout in device online/offline process.
- */
-static void
-ccw_device_onoff_timeout(struct ccw_device *cdev, enum dev_event dev_event)
-{
-	int ret;
-
-	ret = ccw_device_cancel_halt_clear(cdev);
-	switch (ret) {
-	case 0:
-		ccw_device_done(cdev, DEV_STATE_BOXED);
-		break;
-	case -ENODEV:
-		ccw_device_done(cdev, DEV_STATE_NOT_OPER);
-		break;
-	default:
-		ccw_device_set_timeout(cdev, 3*HZ);
-	}
-}
-
-/*
- * Handle not oper event in device recognition.
- */
-static void
-ccw_device_recog_notoper(struct ccw_device *cdev, enum dev_event dev_event)
-{
-	ccw_device_recog_done(cdev, DEV_STATE_NOT_OPER);
-}
-
-/*
  * Handle not operational event in non-special state.
  */
 static void ccw_device_generic_notoper(struct ccw_device *cdev,
 				       enum dev_event dev_event)
 {
 	if (!ccw_device_notify(cdev, CIO_GONE))
-		ccw_device_schedule_sch_unregister(cdev);
+		ccw_device_sched_todo(cdev, CDEV_TODO_UNREG);
 	else
 		ccw_device_set_disconnected(cdev);
 }
@@ -802,11 +638,27 @@ ccw_device_online_verify(struct ccw_device *cdev, enum dev_event dev_event)
 	}
 	/* Device is idle, we can do the path verification. */
 	cdev->private->state = DEV_STATE_VERIFY;
-	cdev->private->flags.doverify = 0;
 	ccw_device_verify_start(cdev);
 }
 
 /*
+ * Handle path verification event in boxed state.
+ */
+static void ccw_device_boxed_verify(struct ccw_device *cdev,
+				    enum dev_event dev_event)
+{
+	struct subchannel *sch = to_subchannel(cdev->dev.parent);
+
+	if (cdev->online) {
+		if (cio_enable_subchannel(sch, (u32) (addr_t) sch))
+			ccw_device_done(cdev, DEV_STATE_NOT_OPER);
+		else
+			ccw_device_online_verify(cdev, dev_event);
+	} else
+		css_schedule_eval(sch->schid);
+}
+
+/*
  * Got an interrupt for a normal io (state online).
  */
 static void
@@ -904,12 +756,6 @@ ccw_device_w4sense(struct ccw_device *cdev, enum dev_event dev_event)
 	 */
 	if (scsw_fctl(&irb->scsw) &
 	    (SCSW_FCTL_CLEAR_FUNC | SCSW_FCTL_HALT_FUNC)) {
-		/* Retry Basic Sense if requested. */
-		if (cdev->private->flags.intretry) {
-			cdev->private->flags.intretry = 0;
-			ccw_device_do_sense(cdev, irb);
-			return;
-		}
 		cdev->private->flags.dosense = 0;
 		memset(&cdev->private->irb, 0, sizeof(struct irb));
 		ccw_device_accumulate_irb(cdev, irb);
@@ -933,21 +779,6 @@ call_handler:
 }
 
 static void
-ccw_device_clear_verify(struct ccw_device *cdev, enum dev_event dev_event)
-{
-	struct irb *irb;
-
-	irb = (struct irb *) __LC_IRB;
-	/* Accumulate status. We don't do basic sense. */
-	ccw_device_accumulate_irb(cdev, irb);
-	/* Remember to clear irb to avoid residuals. */
-	memset(&cdev->private->irb, 0, sizeof(struct irb));
-	/* Try to start delayed device verification. */
-	ccw_device_online_verify(cdev, 0);
-	/* Note: Don't call handler for cio initiated clear! */
-}
-
-static void
 ccw_device_killing_irq(struct ccw_device *cdev, enum dev_event dev_event)
 {
 	struct subchannel *sch;
@@ -1004,32 +835,6 @@ ccw_device_delay_verify(struct ccw_device *cdev, enum dev_event dev_event)
 }
 
 static void
-ccw_device_stlck_done(struct ccw_device *cdev, enum dev_event dev_event)
-{
-	struct irb *irb;
-
-	switch (dev_event) {
-	case DEV_EVENT_INTERRUPT:
-		irb = (struct irb *) __LC_IRB;
-		/* Check for unsolicited interrupt. */
-		if ((scsw_stctl(&irb->scsw) ==
-		     (SCSW_STCTL_STATUS_PEND | SCSW_STCTL_ALERT_STATUS)) &&
-		    (!scsw_cc(&irb->scsw)))
-			/* FIXME: we should restart stlck here, but this
-			 * is extremely unlikely ... */
-			goto out_wakeup;
-
-		ccw_device_accumulate_irb(cdev, irb);
-		/* We don't care about basic sense etc. */
-		break;
-	default: /* timeout */
-		break;
-	}
-out_wakeup:
-	wake_up(&cdev->private->wait_q);
-}
-
-static void
 ccw_device_start_id(struct ccw_device *cdev, enum dev_event dev_event)
 {
 	struct subchannel *sch;
@@ -1038,10 +843,6 @@ ccw_device_start_id(struct ccw_device *cdev, enum dev_event dev_event)
 	if (cio_enable_subchannel(sch, (u32)(addr_t)sch) != 0)
 		/* Couldn't enable the subchannel for i/o. Sick device. */
 		return;
-
-	/* After 60s the device recognition is considered to have failed. */
-	ccw_device_set_timeout(cdev, 60*HZ);
-
 	cdev->private->state = DEV_STATE_DISCONNECTED_SENSE_ID;
 	ccw_device_sense_id_start(cdev);
 }
@@ -1072,22 +873,20 @@ void ccw_device_trigger_reprobe(struct ccw_device *cdev)
 
 	/* We should also udate ssd info, but this has to wait. */
 	/* Check if this is another device which appeared on the same sch. */
-	if (sch->schib.pmcw.dev != cdev->private->dev_id.devno) {
-		PREPARE_WORK(&cdev->private->kick_work,
-			     ccw_device_move_to_orphanage);
-		queue_work(slow_path_wq, &cdev->private->kick_work);
-	} else
+	if (sch->schib.pmcw.dev != cdev->private->dev_id.devno)
+		css_schedule_eval(sch->schid);
+	else
 		ccw_device_start_id(cdev, 0);
 }
 
-static void
-ccw_device_offline_irq(struct ccw_device *cdev, enum dev_event dev_event)
+static void ccw_device_disabled_irq(struct ccw_device *cdev,
+				    enum dev_event dev_event)
 {
 	struct subchannel *sch;
 
 	sch = to_subchannel(cdev->dev.parent);
 	/*
-	 * An interrupt in state offline means a previous disable was not
+	 * An interrupt in a disabled state means a previous disable was not
 	 * successful - should not happen, but we try to disable again.
 	 */
 	cio_disable_subchannel(sch);
@@ -1113,10 +912,7 @@ static void
 ccw_device_quiesce_done(struct ccw_device *cdev, enum dev_event dev_event)
 {
 	ccw_device_set_timeout(cdev, 0);
-	if (dev_event == DEV_EVENT_NOTOPER)
-		cdev->private->state = DEV_STATE_NOT_OPER;
-	else
-		cdev->private->state = DEV_STATE_OFFLINE;
+	cdev->private->state = DEV_STATE_NOT_OPER;
 	wake_up(&cdev->private->wait_q);
 }
 
@@ -1126,17 +922,11 @@ ccw_device_quiesce_timeout(struct ccw_device *cdev, enum dev_event dev_event)
 	int ret;
 
 	ret = ccw_device_cancel_halt_clear(cdev);
-	switch (ret) {
-	case 0:
-		cdev->private->state = DEV_STATE_OFFLINE;
-		wake_up(&cdev->private->wait_q);
-		break;
-	case -ENODEV:
+	if (ret == -EBUSY) {
+		ccw_device_set_timeout(cdev, HZ/10);
+	} else {
 		cdev->private->state = DEV_STATE_NOT_OPER;
 		wake_up(&cdev->private->wait_q);
-		break;
-	default:
-		ccw_device_set_timeout(cdev, HZ/10);
 	}
 }
 
@@ -1150,50 +940,37 @@ ccw_device_nop(struct ccw_device *cdev, enum dev_event dev_event)
 }
 
 /*
- * Bug operation action. 
- */
-static void
-ccw_device_bug(struct ccw_device *cdev, enum dev_event dev_event)
-{
-	CIO_MSG_EVENT(0, "Internal state [%i][%i] not handled for device "
-		      "0.%x.%04x\n", cdev->private->state, dev_event,
-		      cdev->private->dev_id.ssid,
-		      cdev->private->dev_id.devno);
-	BUG();
-}
-
-/*
  * device statemachine
  */
 fsm_func_t *dev_jumptable[NR_DEV_STATES][NR_DEV_EVENTS] = {
 	[DEV_STATE_NOT_OPER] = {
 		[DEV_EVENT_NOTOPER]	= ccw_device_nop,
-		[DEV_EVENT_INTERRUPT]	= ccw_device_bug,
+		[DEV_EVENT_INTERRUPT]	= ccw_device_disabled_irq,
 		[DEV_EVENT_TIMEOUT]	= ccw_device_nop,
 		[DEV_EVENT_VERIFY]	= ccw_device_nop,
 	},
 	[DEV_STATE_SENSE_PGID] = {
-		[DEV_EVENT_NOTOPER]	= ccw_device_generic_notoper,
-		[DEV_EVENT_INTERRUPT]	= ccw_device_sense_pgid_irq,
-		[DEV_EVENT_TIMEOUT]	= ccw_device_onoff_timeout,
+		[DEV_EVENT_NOTOPER]	= ccw_device_request_event,
+		[DEV_EVENT_INTERRUPT]	= ccw_device_request_event,
+		[DEV_EVENT_TIMEOUT]	= ccw_device_request_event,
 		[DEV_EVENT_VERIFY]	= ccw_device_nop,
 	},
 	[DEV_STATE_SENSE_ID] = {
-		[DEV_EVENT_NOTOPER]	= ccw_device_recog_notoper,
-		[DEV_EVENT_INTERRUPT]	= ccw_device_sense_id_irq,
-		[DEV_EVENT_TIMEOUT]	= ccw_device_recog_timeout,
+		[DEV_EVENT_NOTOPER]	= ccw_device_request_event,
+		[DEV_EVENT_INTERRUPT]	= ccw_device_request_event,
+		[DEV_EVENT_TIMEOUT]	= ccw_device_request_event,
 		[DEV_EVENT_VERIFY]	= ccw_device_nop,
 	},
 	[DEV_STATE_OFFLINE] = {
 		[DEV_EVENT_NOTOPER]	= ccw_device_generic_notoper,
-		[DEV_EVENT_INTERRUPT]	= ccw_device_offline_irq,
+		[DEV_EVENT_INTERRUPT]	= ccw_device_disabled_irq,
 		[DEV_EVENT_TIMEOUT]	= ccw_device_nop,
 		[DEV_EVENT_VERIFY]	= ccw_device_offline_verify,
 	},
 	[DEV_STATE_VERIFY] = {
-		[DEV_EVENT_NOTOPER]	= ccw_device_generic_notoper,
-		[DEV_EVENT_INTERRUPT]	= ccw_device_verify_irq,
-		[DEV_EVENT_TIMEOUT]	= ccw_device_onoff_timeout,
+		[DEV_EVENT_NOTOPER]	= ccw_device_request_event,
+		[DEV_EVENT_INTERRUPT]	= ccw_device_request_event,
+		[DEV_EVENT_TIMEOUT]	= ccw_device_request_event,
 		[DEV_EVENT_VERIFY]	= ccw_device_delay_verify,
 	},
 	[DEV_STATE_ONLINE] = {
@@ -1209,24 +986,18 @@ fsm_func_t *dev_jumptable[NR_DEV_STATES][NR_DEV_EVENTS] = {
 		[DEV_EVENT_VERIFY]	= ccw_device_online_verify,
 	},
 	[DEV_STATE_DISBAND_PGID] = {
-		[DEV_EVENT_NOTOPER]	= ccw_device_generic_notoper,
-		[DEV_EVENT_INTERRUPT]	= ccw_device_disband_irq,
-		[DEV_EVENT_TIMEOUT]	= ccw_device_onoff_timeout,
+		[DEV_EVENT_NOTOPER]	= ccw_device_request_event,
+		[DEV_EVENT_INTERRUPT]	= ccw_device_request_event,
+		[DEV_EVENT_TIMEOUT]	= ccw_device_request_event,
 		[DEV_EVENT_VERIFY]	= ccw_device_nop,
 	},
 	[DEV_STATE_BOXED] = {
 		[DEV_EVENT_NOTOPER]	= ccw_device_generic_notoper,
-		[DEV_EVENT_INTERRUPT]	= ccw_device_stlck_done,
-		[DEV_EVENT_TIMEOUT]	= ccw_device_stlck_done,
-		[DEV_EVENT_VERIFY]	= ccw_device_nop,
-	},
-	/* states to wait for i/o completion before doing something */
-	[DEV_STATE_CLEAR_VERIFY] = {
-		[DEV_EVENT_NOTOPER]	= ccw_device_generic_notoper,
-		[DEV_EVENT_INTERRUPT]   = ccw_device_clear_verify,
+		[DEV_EVENT_INTERRUPT]	= ccw_device_nop,
 		[DEV_EVENT_TIMEOUT]	= ccw_device_nop,
-		[DEV_EVENT_VERIFY]	= ccw_device_nop,
+		[DEV_EVENT_VERIFY]	= ccw_device_boxed_verify,
 	},
+	/* states to wait for i/o completion before doing something */
 	[DEV_STATE_TIMEOUT_KILL] = {
 		[DEV_EVENT_NOTOPER]	= ccw_device_generic_notoper,
 		[DEV_EVENT_INTERRUPT]	= ccw_device_killing_irq,
@@ -1243,13 +1014,13 @@ fsm_func_t *dev_jumptable[NR_DEV_STATES][NR_DEV_EVENTS] = {
 	[DEV_STATE_DISCONNECTED] = {
 		[DEV_EVENT_NOTOPER]	= ccw_device_nop,
 		[DEV_EVENT_INTERRUPT]	= ccw_device_start_id,
-		[DEV_EVENT_TIMEOUT]	= ccw_device_bug,
+		[DEV_EVENT_TIMEOUT]	= ccw_device_nop,
 		[DEV_EVENT_VERIFY]	= ccw_device_start_id,
 	},
 	[DEV_STATE_DISCONNECTED_SENSE_ID] = {
-		[DEV_EVENT_NOTOPER]	= ccw_device_recog_notoper,
-		[DEV_EVENT_INTERRUPT]	= ccw_device_sense_id_irq,
-		[DEV_EVENT_TIMEOUT]	= ccw_device_recog_timeout,
+		[DEV_EVENT_NOTOPER]	= ccw_device_request_event,
+		[DEV_EVENT_INTERRUPT]	= ccw_device_request_event,
+		[DEV_EVENT_TIMEOUT]	= ccw_device_request_event,
 		[DEV_EVENT_VERIFY]	= ccw_device_nop,
 	},
 	[DEV_STATE_CMFCHANGE] = {
@@ -1264,6 +1035,12 @@ fsm_func_t *dev_jumptable[NR_DEV_STATES][NR_DEV_EVENTS] = {
 		[DEV_EVENT_TIMEOUT]	= ccw_device_update_cmfblock,
 		[DEV_EVENT_VERIFY]	= ccw_device_update_cmfblock,
 	},
+	[DEV_STATE_STEAL_LOCK] = {
+		[DEV_EVENT_NOTOPER]	= ccw_device_request_event,
+		[DEV_EVENT_INTERRUPT]	= ccw_device_request_event,
+		[DEV_EVENT_TIMEOUT]	= ccw_device_request_event,
+		[DEV_EVENT_VERIFY]	= ccw_device_nop,
+	},
 };
 
 EXPORT_SYMBOL_GPL(ccw_device_set_timeout);
diff --git a/drivers/s390/cio/device_id.c b/drivers/s390/cio/device_id.c
index 1bdaa614e34f..78a0b43862c5 100644
--- a/drivers/s390/cio/device_id.c
+++ b/drivers/s390/cio/device_id.c
@@ -1,40 +1,39 @@
 /*
- * drivers/s390/cio/device_id.c
+ *  CCW device SENSE ID I/O handling.
  *
- *    Copyright (C) 2002 IBM Deutschland Entwicklung GmbH,
- *			 IBM Corporation
- *    Author(s): Cornelia Huck (cornelia.huck@de.ibm.com)
- *		 Martin Schwidefsky (schwidefsky@de.ibm.com)
- *
- * Sense ID functions.
+ *    Copyright IBM Corp. 2002,2009
+ *    Author(s): Cornelia Huck <cornelia.huck@de.ibm.com>
+ *		 Martin Schwidefsky <schwidefsky@de.ibm.com>
+ *		 Peter Oberparleiter <peter.oberparleiter@de.ibm.com>
  */
 
-#include <linux/module.h>
-#include <linux/init.h>
 #include <linux/kernel.h>
-
+#include <linux/string.h>
+#include <linux/types.h>
+#include <linux/errno.h>
 #include <asm/ccwdev.h>
-#include <asm/delay.h>
+#include <asm/setup.h>
 #include <asm/cio.h>
-#include <asm/lowcore.h>
 #include <asm/diag.h>
 
 #include "cio.h"
 #include "cio_debug.h"
-#include "css.h"
 #include "device.h"
-#include "ioasm.h"
 #include "io_sch.h"
 
+#define SENSE_ID_RETRIES	256
+#define SENSE_ID_TIMEOUT	(10 * HZ)
+#define SENSE_ID_MIN_LEN	4
+#define SENSE_ID_BASIC_LEN	7
+
 /**
- * vm_vdev_to_cu_type - Convert vm virtual device into control unit type
- *			for certain devices.
- * @class: virtual device class
- * @type: virtual device type
+ * diag210_to_senseid - convert diag 0x210 data to sense id information
+ * @senseid: sense id
+ * @diag: diag 0x210 data
  *
- * Returns control unit type if a match was made or %0xffff otherwise.
+ * Return 0 on success, non-zero otherwise.
  */
-static int vm_vdev_to_cu_type(int class, int type)
+static int diag210_to_senseid(struct senseid *senseid, struct diag210 *diag)
 {
 	static struct {
 		int class, type, cu_type;
@@ -71,253 +70,153 @@ static int vm_vdev_to_cu_type(int class, int type)
 	};
 	int i;
 
-	for (i = 0; i < ARRAY_SIZE(vm_devices); i++)
-		if (class == vm_devices[i].class && type == vm_devices[i].type)
-			return vm_devices[i].cu_type;
+	/* Special case for osa devices. */
+	if (diag->vrdcvcla == 0x02 && diag->vrdcvtyp == 0x20) {
+		senseid->cu_type = 0x3088;
+		senseid->cu_model = 0x60;
+		senseid->reserved = 0xff;
+		return 0;
+	}
+	for (i = 0; i < ARRAY_SIZE(vm_devices); i++) {
+		if (diag->vrdcvcla == vm_devices[i].class &&
+		    diag->vrdcvtyp == vm_devices[i].type) {
+			senseid->cu_type = vm_devices[i].cu_type;
+			senseid->reserved = 0xff;
+			return 0;
+		}
+	}
 
-	return 0xffff;
+	return -ENODEV;
 }
 
 /**
- * diag_get_dev_info - retrieve device information via DIAG X'210'
- * @devno: device number
- * @ps: pointer to sense ID data area
+ * diag_get_dev_info - retrieve device information via diag 0x210
+ * @cdev: ccw device
  *
  * Returns zero on success, non-zero otherwise.
  */
-static int diag_get_dev_info(u16 devno, struct senseid *ps)
+static int diag210_get_dev_info(struct ccw_device *cdev)
 {
+	struct ccw_dev_id *dev_id = &cdev->private->dev_id;
+	struct senseid *senseid = &cdev->private->senseid;
 	struct diag210 diag_data;
-	int ccode;
-
-	CIO_TRACE_EVENT (4, "VMvdinf");
-
-	diag_data = (struct diag210) {
-		.vrdcdvno = devno,
-		.vrdclen = sizeof (diag_data),
-	};
-
-	ccode = diag210 (&diag_data);
-	if ((ccode == 0) || (ccode == 2)) {
-		ps->reserved = 0xff;
-
-		/* Special case for osa devices. */
-		if (diag_data.vrdcvcla == 0x02 && diag_data.vrdcvtyp == 0x20) {
-			ps->cu_type = 0x3088;
-			ps->cu_model = 0x60;
-			return 0;
-		}
-		ps->cu_type = vm_vdev_to_cu_type(diag_data.vrdcvcla,
-						diag_data.vrdcvtyp);
-		if (ps->cu_type != 0xffff)
-			return 0;
-	}
-
-	CIO_MSG_EVENT(0, "DIAG X'210' for device %04X returned (cc = %d):"
-		      "vdev class : %02X, vdev type : %04X \n ...  "
-		      "rdev class : %02X, rdev type : %04X, "
-		      "rdev model: %02X\n",
-		      devno, ccode,
-		      diag_data.vrdcvcla, diag_data.vrdcvtyp,
-		      diag_data.vrdcrccl, diag_data.vrdccrty,
-		      diag_data.vrdccrmd);
-
+	int rc;
+
+	if (dev_id->ssid != 0)
+		return -ENODEV;
+	memset(&diag_data, 0, sizeof(diag_data));
+	diag_data.vrdcdvno	= dev_id->devno;
+	diag_data.vrdclen	= sizeof(diag_data);
+	rc = diag210(&diag_data);
+	CIO_TRACE_EVENT(4, "diag210");
+	CIO_HEX_EVENT(4, &rc, sizeof(rc));
+	CIO_HEX_EVENT(4, &diag_data, sizeof(diag_data));
+	if (rc != 0 && rc != 2)
+		goto err_failed;
+	if (diag210_to_senseid(senseid, &diag_data))
+		goto err_unknown;
+	return 0;
+
+err_unknown:
+	CIO_MSG_EVENT(0, "snsid: device 0.%x.%04x: unknown diag210 data\n",
+		      dev_id->ssid, dev_id->devno);
+	return -ENODEV;
+err_failed:
+	CIO_MSG_EVENT(0, "snsid: device 0.%x.%04x: diag210 failed (rc=%d)\n",
+		      dev_id->ssid, dev_id->devno, rc);
 	return -ENODEV;
 }
 
 /*
- * Start Sense ID helper function.
- * Try to obtain the 'control unit'/'device type' information
- *  associated with the subchannel.
+ * Initialize SENSE ID data.
  */
-static int
-__ccw_device_sense_id_start(struct ccw_device *cdev)
-{
-	struct subchannel *sch;
-	struct ccw1 *ccw;
-	int ret;
-
-	sch = to_subchannel(cdev->dev.parent);
-	/* Setup sense channel program. */
-	ccw = cdev->private->iccws;
-	ccw->cmd_code = CCW_CMD_SENSE_ID;
-	ccw->cda = (__u32) __pa (&cdev->private->senseid);
-	ccw->count = sizeof (struct senseid);
-	ccw->flags = CCW_FLAG_SLI;
-
-	/* Reset device status. */
-	memset(&cdev->private->irb, 0, sizeof(struct irb));
-
-	/* Try on every path. */
-	ret = -ENODEV;
-	while (cdev->private->imask != 0) {
-		cdev->private->senseid.cu_type = 0xFFFF;
-		if ((sch->opm & cdev->private->imask) != 0 &&
-		    cdev->private->iretry > 0) {
-			cdev->private->iretry--;
-			/* Reset internal retry indication. */
-			cdev->private->flags.intretry = 0;
-			ret = cio_start (sch, cdev->private->iccws,
-					 cdev->private->imask);
-			/* ret is 0, -EBUSY, -EACCES or -ENODEV */
-			if (ret != -EACCES)
-				return ret;
-		}
-		cdev->private->imask >>= 1;
-		cdev->private->iretry = 5;
-	}
-	return ret;
-}
-
-void
-ccw_device_sense_id_start(struct ccw_device *cdev)
+static void snsid_init(struct ccw_device *cdev)
 {
-	int ret;
-
-	memset (&cdev->private->senseid, 0, sizeof (struct senseid));
-	cdev->private->imask = 0x80;
-	cdev->private->iretry = 5;
-	ret = __ccw_device_sense_id_start(cdev);
-	if (ret && ret != -EBUSY)
-		ccw_device_sense_id_done(cdev, ret);
+	cdev->private->flags.esid = 0;
+	memset(&cdev->private->senseid, 0, sizeof(cdev->private->senseid));
+	cdev->private->senseid.cu_type = 0xffff;
 }
 
 /*
- * Called from interrupt context to check if a valid answer
- * to Sense ID was received.
+ * Check for complete SENSE ID data.
  */
-static int
-ccw_device_check_sense_id(struct ccw_device *cdev)
+static int snsid_check(struct ccw_device *cdev, void *data)
 {
-	struct subchannel *sch;
-	struct irb *irb;
-
-	sch = to_subchannel(cdev->dev.parent);
-	irb = &cdev->private->irb;
-
-	/* Check the error cases. */
-	if (irb->scsw.cmd.fctl & (SCSW_FCTL_HALT_FUNC | SCSW_FCTL_CLEAR_FUNC)) {
-		/* Retry Sense ID if requested. */
-		if (cdev->private->flags.intretry) {
-			cdev->private->flags.intretry = 0;
-			return -EAGAIN;
-		}
-		return -ETIME;
-	}
-	if (irb->esw.esw0.erw.cons && (irb->ecw[0] & SNS0_CMD_REJECT)) {
-		/*
-		 * if the device doesn't support the SenseID
-		 *  command further retries wouldn't help ...
-		 * NB: We don't check here for intervention required like we
-		 *     did before, because tape devices with no tape inserted
-		 *     may present this status *in conjunction with* the
-		 *     sense id information. So, for intervention required,
-		 *     we use the "whack it until it talks" strategy...
-		 */
-		CIO_MSG_EVENT(0, "SenseID : device %04x on Subchannel "
-			      "0.%x.%04x reports cmd reject\n",
-			      cdev->private->dev_id.devno, sch->schid.ssid,
-			      sch->schid.sch_no);
+	struct cmd_scsw *scsw = &cdev->private->irb.scsw.cmd;
+	int len = sizeof(struct senseid) - scsw->count;
+
+	/* Check for incomplete SENSE ID data. */
+	if (len < SENSE_ID_MIN_LEN)
+		goto out_restart;
+	if (cdev->private->senseid.cu_type == 0xffff)
+		goto out_restart;
+	/* Check for incompatible SENSE ID data. */
+	if (cdev->private->senseid.reserved != 0xff)
 		return -EOPNOTSUPP;
-	}
-	if (irb->esw.esw0.erw.cons) {
-		CIO_MSG_EVENT(2, "SenseID : UC on dev 0.%x.%04x, "
-			      "lpum %02X, cnt %02d, sns :"
-			      " %02X%02X%02X%02X %02X%02X%02X%02X ...\n",
-			      cdev->private->dev_id.ssid,
-			      cdev->private->dev_id.devno,
-			      irb->esw.esw0.sublog.lpum,
-			      irb->esw.esw0.erw.scnt,
-			      irb->ecw[0], irb->ecw[1],
-			      irb->ecw[2], irb->ecw[3],
-			      irb->ecw[4], irb->ecw[5],
-			      irb->ecw[6], irb->ecw[7]);
-		return -EAGAIN;
-	}
-	if (irb->scsw.cmd.cc == 3) {
-		u8 lpm;
+	/* Check for extended-identification information. */
+	if (len > SENSE_ID_BASIC_LEN)
+		cdev->private->flags.esid = 1;
+	return 0;
 
-		lpm = to_io_private(sch)->orb.cmd.lpm;
-		if ((lpm & sch->schib.pmcw.pim & sch->schib.pmcw.pam) != 0)
-			CIO_MSG_EVENT(4, "SenseID : path %02X for device %04x "
-				      "on subchannel 0.%x.%04x is "
-				      "'not operational'\n", lpm,
-				      cdev->private->dev_id.devno,
-				      sch->schid.ssid, sch->schid.sch_no);
-		return -EACCES;
-	}
-
-	/* Did we get a proper answer ? */
-	if (irb->scsw.cmd.cc == 0 && cdev->private->senseid.cu_type != 0xFFFF &&
-	    cdev->private->senseid.reserved == 0xFF) {
-		if (irb->scsw.cmd.count < sizeof(struct senseid) - 8)
-			cdev->private->flags.esid = 1;
-		return 0; /* Success */
-	}
-
-	/* Hmm, whatever happened, try again. */
-	CIO_MSG_EVENT(2, "SenseID : start_IO() for device %04x on "
-		      "subchannel 0.%x.%04x returns status %02X%02X\n",
-		      cdev->private->dev_id.devno, sch->schid.ssid,
-		      sch->schid.sch_no,
-		      irb->scsw.cmd.dstat, irb->scsw.cmd.cstat);
+out_restart:
+	snsid_init(cdev);
 	return -EAGAIN;
 }
 
 /*
- * Got interrupt for Sense ID.
+ * Process SENSE ID request result.
  */
-void
-ccw_device_sense_id_irq(struct ccw_device *cdev, enum dev_event dev_event)
+static void snsid_callback(struct ccw_device *cdev, void *data, int rc)
 {
-	struct subchannel *sch;
-	struct irb *irb;
-	int ret;
-
-	sch = to_subchannel(cdev->dev.parent);
-	irb = (struct irb *) __LC_IRB;
-	/* Retry sense id, if needed. */
-	if (irb->scsw.cmd.stctl ==
-	    (SCSW_STCTL_STATUS_PEND | SCSW_STCTL_ALERT_STATUS)) {
-		if ((irb->scsw.cmd.cc == 1) || !irb->scsw.cmd.actl) {
-			ret = __ccw_device_sense_id_start(cdev);
-			if (ret && ret != -EBUSY)
-				ccw_device_sense_id_done(cdev, ret);
+	struct ccw_dev_id *id = &cdev->private->dev_id;
+	struct senseid *senseid = &cdev->private->senseid;
+	int vm = 0;
+
+	if (rc && MACHINE_IS_VM) {
+		/* Try diag 0x210 fallback on z/VM. */
+		snsid_init(cdev);
+		if (diag210_get_dev_info(cdev) == 0) {
+			rc = 0;
+			vm = 1;
 		}
-		return;
 	}
-	if (ccw_device_accumulate_and_sense(cdev, irb) != 0)
-		return;
-	ret = ccw_device_check_sense_id(cdev);
-	memset(&cdev->private->irb, 0, sizeof(struct irb));
-	switch (ret) {
-	/* 0, -ETIME, -EOPNOTSUPP, -EAGAIN or -EACCES */
-	case 0:			/* Sense id succeeded. */
-	case -ETIME:		/* Sense id stopped by timeout. */
-		ccw_device_sense_id_done(cdev, ret);
-		break;
-	case -EACCES:		/* channel is not operational. */
-		sch->lpm &= ~cdev->private->imask;
-		cdev->private->imask >>= 1;
-		cdev->private->iretry = 5;
-		/* fall through. */
-	case -EAGAIN:		/* try again. */
-		ret = __ccw_device_sense_id_start(cdev);
-		if (ret == 0 || ret == -EBUSY)
-			break;
-		/* fall through. */
-	default:		/* Sense ID failed. Try asking VM. */
-		if (MACHINE_IS_VM)
-			ret = diag_get_dev_info(cdev->private->dev_id.devno,
-						&cdev->private->senseid);
-		else
-			/*
-			 * If we can't couldn't identify the device type we
-			 *  consider the device "not operational".
-			 */
-			ret = -ENODEV;
+	CIO_MSG_EVENT(2, "snsid: device 0.%x.%04x: rc=%d %04x/%02x "
+		      "%04x/%02x%s\n", id->ssid, id->devno, rc,
+		      senseid->cu_type, senseid->cu_model, senseid->dev_type,
+		      senseid->dev_model, vm ? " (diag210)" : "");
+	ccw_device_sense_id_done(cdev, rc);
+}
 
-		ccw_device_sense_id_done(cdev, ret);
-		break;
-	}
+/**
+ * ccw_device_sense_id_start - perform SENSE ID
+ * @cdev: ccw device
+ *
+ * Execute a SENSE ID channel program on @cdev to update its sense id
+ * information. When finished, call ccw_device_sense_id_done with a
+ * return code specifying the result.
+ */
+void ccw_device_sense_id_start(struct ccw_device *cdev)
+{
+	struct subchannel *sch = to_subchannel(cdev->dev.parent);
+	struct ccw_request *req = &cdev->private->req;
+	struct ccw1 *cp = cdev->private->iccws;
+
+	CIO_TRACE_EVENT(4, "snsid");
+	CIO_HEX_EVENT(4, &cdev->private->dev_id, sizeof(cdev->private->dev_id));
+	/* Data setup. */
+	snsid_init(cdev);
+	/* Channel program setup. */
+	cp->cmd_code	= CCW_CMD_SENSE_ID;
+	cp->cda		= (u32) (addr_t) &cdev->private->senseid;
+	cp->count	= sizeof(struct senseid);
+	cp->flags	= CCW_FLAG_SLI;
+	/* Request setup. */
+	memset(req, 0, sizeof(*req));
+	req->cp		= cp;
+	req->timeout	= SENSE_ID_TIMEOUT;
+	req->maxretries	= SENSE_ID_RETRIES;
+	req->lpm	= sch->schib.pmcw.pam & sch->opm;
+	req->check	= snsid_check;
+	req->callback	= snsid_callback;
+	ccw_request_start(cdev);
 }
diff --git a/drivers/s390/cio/device_ops.c b/drivers/s390/cio/device_ops.c
index 2d0efee8a290..6da84543dfe9 100644
--- a/drivers/s390/cio/device_ops.c
+++ b/drivers/s390/cio/device_ops.c
@@ -11,6 +11,7 @@
 #include <linux/list.h>
 #include <linux/device.h>
 #include <linux/delay.h>
+#include <linux/completion.h>
 
 #include <asm/ccwdev.h>
 #include <asm/idals.h>
@@ -46,6 +47,7 @@ int ccw_device_set_options_mask(struct ccw_device *cdev, unsigned long flags)
 	cdev->private->options.repall = (flags & CCWDEV_REPORT_ALL) != 0;
 	cdev->private->options.pgroup = (flags & CCWDEV_DO_PATHGROUP) != 0;
 	cdev->private->options.force = (flags & CCWDEV_ALLOW_FORCE) != 0;
+	cdev->private->options.mpath = (flags & CCWDEV_DO_MULTIPATH) != 0;
 	return 0;
 }
 
@@ -74,6 +76,7 @@ int ccw_device_set_options(struct ccw_device *cdev, unsigned long flags)
 	cdev->private->options.repall |= (flags & CCWDEV_REPORT_ALL) != 0;
 	cdev->private->options.pgroup |= (flags & CCWDEV_DO_PATHGROUP) != 0;
 	cdev->private->options.force |= (flags & CCWDEV_ALLOW_FORCE) != 0;
+	cdev->private->options.mpath |= (flags & CCWDEV_DO_MULTIPATH) != 0;
 	return 0;
 }
 
@@ -90,9 +93,34 @@ void ccw_device_clear_options(struct ccw_device *cdev, unsigned long flags)
 	cdev->private->options.repall &= (flags & CCWDEV_REPORT_ALL) == 0;
 	cdev->private->options.pgroup &= (flags & CCWDEV_DO_PATHGROUP) == 0;
 	cdev->private->options.force &= (flags & CCWDEV_ALLOW_FORCE) == 0;
+	cdev->private->options.mpath &= (flags & CCWDEV_DO_MULTIPATH) == 0;
 }
 
 /**
+ * ccw_device_is_pathgroup - determine if paths to this device are grouped
+ * @cdev: ccw device
+ *
+ * Return non-zero if there is a path group, zero otherwise.
+ */
+int ccw_device_is_pathgroup(struct ccw_device *cdev)
+{
+	return cdev->private->flags.pgroup;
+}
+EXPORT_SYMBOL(ccw_device_is_pathgroup);
+
+/**
+ * ccw_device_is_multipath - determine if device is operating in multipath mode
+ * @cdev: ccw device
+ *
+ * Return non-zero if device is operating in multipath mode, zero otherwise.
+ */
+int ccw_device_is_multipath(struct ccw_device *cdev)
+{
+	return cdev->private->flags.mpath;
+}
+EXPORT_SYMBOL(ccw_device_is_multipath);
+
+/**
  * ccw_device_clear() - terminate I/O request processing
  * @cdev: target ccw device
  * @intparm: interruption parameter; value is only used if no I/O is
@@ -167,8 +195,7 @@ int ccw_device_start_key(struct ccw_device *cdev, struct ccw1 *cpa,
 		return -EINVAL;
 	if (cdev->private->state == DEV_STATE_NOT_OPER)
 		return -ENODEV;
-	if (cdev->private->state == DEV_STATE_VERIFY ||
-	    cdev->private->state == DEV_STATE_CLEAR_VERIFY) {
+	if (cdev->private->state == DEV_STATE_VERIFY) {
 		/* Remember to fake irb when finished. */
 		if (!cdev->private->flags.fake_irb) {
 			cdev->private->flags.fake_irb = 1;
@@ -478,74 +505,65 @@ __u8 ccw_device_get_path_mask(struct ccw_device *cdev)
 	return sch->lpm;
 }
 
-/*
- * Try to break the lock on a boxed device.
- */
-int
-ccw_device_stlck(struct ccw_device *cdev)
-{
-	void *buf, *buf2;
-	unsigned long flags;
-	struct subchannel *sch;
-	int ret;
+struct stlck_data {
+	struct completion done;
+	int rc;
+};
 
-	if (!cdev)
-		return -ENODEV;
+void ccw_device_stlck_done(struct ccw_device *cdev, void *data, int rc)
+{
+	struct stlck_data *sdata = data;
 
-	if (cdev->drv && !cdev->private->options.force)
-		return -EINVAL;
+	sdata->rc = rc;
+	complete(&sdata->done);
+}
 
-	sch = to_subchannel(cdev->dev.parent);
-	
-	CIO_TRACE_EVENT(2, "stl lock");
-	CIO_TRACE_EVENT(2, dev_name(&cdev->dev));
+/*
+ * Perform unconditional reserve + release.
+ */
+int ccw_device_stlck(struct ccw_device *cdev)
+{
+	struct subchannel *sch = to_subchannel(cdev->dev.parent);
+	struct stlck_data data;
+	u8 *buffer;
+	int rc;
 
-	buf = kmalloc(32*sizeof(char), GFP_DMA|GFP_KERNEL);
-	if (!buf)
-		return -ENOMEM;
-	buf2 = kmalloc(32*sizeof(char), GFP_DMA|GFP_KERNEL);
-	if (!buf2) {
-		kfree(buf);
-		return -ENOMEM;
+	/* Check if steal lock operation is valid for this device. */
+	if (cdev->drv) {
+		if (!cdev->private->options.force)
+			return -EINVAL;
 	}
-	spin_lock_irqsave(sch->lock, flags);
-	ret = cio_enable_subchannel(sch, (u32)(addr_t)sch);
-	if (ret)
-		goto out_unlock;
-	/*
-	 * Setup ccw. We chain an unconditional reserve and a release so we
-	 * only break the lock.
-	 */
-	cdev->private->iccws[0].cmd_code = CCW_CMD_STLCK;
-	cdev->private->iccws[0].cda = (__u32) __pa(buf);
-	cdev->private->iccws[0].count = 32;
-	cdev->private->iccws[0].flags = CCW_FLAG_CC;
-	cdev->private->iccws[1].cmd_code = CCW_CMD_RELEASE;
-	cdev->private->iccws[1].cda = (__u32) __pa(buf2);
-	cdev->private->iccws[1].count = 32;
-	cdev->private->iccws[1].flags = 0;
-	ret = cio_start(sch, cdev->private->iccws, 0);
-	if (ret) {
-		cio_disable_subchannel(sch); //FIXME: return code?
+	buffer = kzalloc(64, GFP_DMA | GFP_KERNEL);
+	if (!buffer)
+		return -ENOMEM;
+	init_completion(&data.done);
+	data.rc = -EIO;
+	spin_lock_irq(sch->lock);
+	rc = cio_enable_subchannel(sch, (u32) (addr_t) sch);
+	if (rc)
 		goto out_unlock;
+	/* Perform operation. */
+	cdev->private->state = DEV_STATE_STEAL_LOCK,
+	ccw_device_stlck_start(cdev, &data, &buffer[0], &buffer[32]);
+	spin_unlock_irq(sch->lock);
+	/* Wait for operation to finish. */
+	if (wait_for_completion_interruptible(&data.done)) {
+		/* Got a signal. */
+		spin_lock_irq(sch->lock);
+		ccw_request_cancel(cdev);
+		spin_unlock_irq(sch->lock);
+		wait_for_completion(&data.done);
 	}
-	cdev->private->irb.scsw.cmd.actl |= SCSW_ACTL_START_PEND;
-	spin_unlock_irqrestore(sch->lock, flags);
-	wait_event(cdev->private->wait_q,
-		   cdev->private->irb.scsw.cmd.actl == 0);
-	spin_lock_irqsave(sch->lock, flags);
-	cio_disable_subchannel(sch); //FIXME: return code?
-	if ((cdev->private->irb.scsw.cmd.dstat !=
-	     (DEV_STAT_CHN_END|DEV_STAT_DEV_END)) ||
-	    (cdev->private->irb.scsw.cmd.cstat != 0))
-		ret = -EIO;
-	/* Clear irb. */
-	memset(&cdev->private->irb, 0, sizeof(struct irb));
+	rc = data.rc;
+	/* Check results. */
+	spin_lock_irq(sch->lock);
+	cio_disable_subchannel(sch);
+	cdev->private->state = DEV_STATE_BOXED;
 out_unlock:
-	kfree(buf);
-	kfree(buf2);
-	spin_unlock_irqrestore(sch->lock, flags);
-	return ret;
+	spin_unlock_irq(sch->lock);
+	kfree(buffer);
+
+	return rc;
 }
 
 void *ccw_device_get_chp_desc(struct ccw_device *cdev, int chp_no)
diff --git a/drivers/s390/cio/device_pgid.c b/drivers/s390/cio/device_pgid.c
index fc5ca1dd52b3..6facb5499a65 100644
--- a/drivers/s390/cio/device_pgid.c
+++ b/drivers/s390/cio/device_pgid.c
@@ -1,594 +1,568 @@
 /*
- * drivers/s390/cio/device_pgid.c
+ *  CCW device PGID and path verification I/O handling.
  *
- *    Copyright (C) 2002 IBM Deutschland Entwicklung GmbH,
- *			 IBM Corporation
- *    Author(s): Cornelia Huck (cornelia.huck@de.ibm.com)
- *		 Martin Schwidefsky (schwidefsky@de.ibm.com)
- *
- * Path Group ID functions.
+ *    Copyright IBM Corp. 2002,2009
+ *    Author(s): Cornelia Huck <cornelia.huck@de.ibm.com>
+ *		 Martin Schwidefsky <schwidefsky@de.ibm.com>
+ *		 Peter Oberparleiter <peter.oberparleiter@de.ibm.com>
  */
 
-#include <linux/module.h>
-#include <linux/init.h>
-
+#include <linux/kernel.h>
+#include <linux/string.h>
+#include <linux/types.h>
+#include <linux/errno.h>
+#include <linux/bitops.h>
 #include <asm/ccwdev.h>
 #include <asm/cio.h>
-#include <asm/delay.h>
-#include <asm/lowcore.h>
 
 #include "cio.h"
 #include "cio_debug.h"
-#include "css.h"
 #include "device.h"
-#include "ioasm.h"
 #include "io_sch.h"
 
+#define PGID_RETRIES	256
+#define PGID_TIMEOUT	(10 * HZ)
+
 /*
- * Helper function called from interrupt context to decide whether an
- * operation should be tried again.
+ * Process path verification data and report result.
  */
-static int __ccw_device_should_retry(union scsw *scsw)
+static void verify_done(struct ccw_device *cdev, int rc)
 {
-	/* CC is only valid if start function bit is set. */
-	if ((scsw->cmd.fctl & SCSW_FCTL_START_FUNC) && scsw->cmd.cc == 1)
-		return 1;
-	/* No more activity. For sense and set PGID we stubbornly try again. */
-	if (!scsw->cmd.actl)
-		return 1;
-	return 0;
+	struct subchannel *sch = to_subchannel(cdev->dev.parent);
+	struct ccw_dev_id *id = &cdev->private->dev_id;
+	int mpath = cdev->private->flags.mpath;
+	int pgroup = cdev->private->flags.pgroup;
+
+	if (rc)
+		goto out;
+	/* Ensure consistent multipathing state at device and channel. */
+	if (sch->config.mp != mpath) {
+		sch->config.mp = mpath;
+		rc = cio_commit_config(sch);
+	}
+out:
+	CIO_MSG_EVENT(2, "vrfy: device 0.%x.%04x: rc=%d pgroup=%d mpath=%d "
+			 "vpm=%02x\n", id->ssid, id->devno, rc, pgroup, mpath,
+			 sch->vpm);
+	ccw_device_verify_done(cdev, rc);
 }
 
 /*
- * Start Sense Path Group ID helper function. Used in ccw_device_recog
- * and ccw_device_sense_pgid.
+ * Create channel program to perform a NOOP.
  */
-static int
-__ccw_device_sense_pgid_start(struct ccw_device *cdev)
+static void nop_build_cp(struct ccw_device *cdev)
 {
-	struct subchannel *sch;
-	struct ccw1 *ccw;
-	int ret;
-	int i;
-
-	sch = to_subchannel(cdev->dev.parent);
-	/* Return if we already checked on all paths. */
-	if (cdev->private->imask == 0)
-		return (sch->lpm == 0) ? -ENODEV : -EACCES;
-	i = 8 - ffs(cdev->private->imask);
-
-	/* Setup sense path group id channel program. */
-	ccw = cdev->private->iccws;
-	ccw->cmd_code = CCW_CMD_SENSE_PGID;
-	ccw->count = sizeof (struct pgid);
-	ccw->flags = CCW_FLAG_SLI;
-
-	/* Reset device status. */
-	memset(&cdev->private->irb, 0, sizeof(struct irb));
-	/* Try on every path. */
-	ret = -ENODEV;
-	while (cdev->private->imask != 0) {
-		/* Try every path multiple times. */
-		ccw->cda = (__u32) __pa (&cdev->private->pgid[i]);
-		if (cdev->private->iretry > 0) {
-			cdev->private->iretry--;
-			/* Reset internal retry indication. */
-			cdev->private->flags.intretry = 0;
-			ret = cio_start (sch, cdev->private->iccws, 
-					 cdev->private->imask);
-			/* ret is 0, -EBUSY, -EACCES or -ENODEV */
-			if (ret != -EACCES)
-				return ret;
-			CIO_MSG_EVENT(3, "SNID - Device %04x on Subchannel "
-				      "0.%x.%04x, lpm %02X, became 'not "
-				      "operational'\n",
-				      cdev->private->dev_id.devno,
-				      sch->schid.ssid,
-				      sch->schid.sch_no, cdev->private->imask);
-
-		}
-		cdev->private->imask >>= 1;
-		cdev->private->iretry = 5;
-		i++;
-	}
-
-	return ret;
+	struct ccw_request *req = &cdev->private->req;
+	struct ccw1 *cp = cdev->private->iccws;
+
+	cp->cmd_code	= CCW_CMD_NOOP;
+	cp->cda		= 0;
+	cp->count	= 0;
+	cp->flags	= CCW_FLAG_SLI;
+	req->cp		= cp;
 }
 
-void
-ccw_device_sense_pgid_start(struct ccw_device *cdev)
+/*
+ * Perform NOOP on a single path.
+ */
+static void nop_do(struct ccw_device *cdev)
 {
-	int ret;
-
-	/* Set a timeout of 60s */
-	ccw_device_set_timeout(cdev, 60*HZ);
-
-	cdev->private->state = DEV_STATE_SENSE_PGID;
-	cdev->private->imask = 0x80;
-	cdev->private->iretry = 5;
-	memset (&cdev->private->pgid, 0, sizeof (cdev->private->pgid));
-	ret = __ccw_device_sense_pgid_start(cdev);
-	if (ret && ret != -EBUSY)
-		ccw_device_sense_pgid_done(cdev, ret);
+	struct subchannel *sch = to_subchannel(cdev->dev.parent);
+	struct ccw_request *req = &cdev->private->req;
+
+	/* Adjust lpm. */
+	req->lpm = lpm_adjust(req->lpm, sch->schib.pmcw.pam & sch->opm);
+	if (!req->lpm)
+		goto out_nopath;
+	nop_build_cp(cdev);
+	ccw_request_start(cdev);
+	return;
+
+out_nopath:
+	verify_done(cdev, sch->vpm ? 0 : -EACCES);
 }
 
 /*
- * Called from interrupt context to check if a valid answer
- * to Sense Path Group ID was received.
+ * Adjust NOOP I/O status.
  */
-static int
-__ccw_device_check_sense_pgid(struct ccw_device *cdev)
+static enum io_status nop_filter(struct ccw_device *cdev, void *data,
+				 struct irb *irb, enum io_status status)
 {
-	struct subchannel *sch;
-	struct irb *irb;
-	int i;
-
-	sch = to_subchannel(cdev->dev.parent);
-	irb = &cdev->private->irb;
-	if (irb->scsw.cmd.fctl & (SCSW_FCTL_HALT_FUNC | SCSW_FCTL_CLEAR_FUNC)) {
-		/* Retry Sense PGID if requested. */
-		if (cdev->private->flags.intretry) {
-			cdev->private->flags.intretry = 0;
-			return -EAGAIN;
-		}
-		return -ETIME;
-	}
-	if (irb->esw.esw0.erw.cons &&
-	    (irb->ecw[0]&(SNS0_CMD_REJECT|SNS0_INTERVENTION_REQ))) {
-		/*
-		 * If the device doesn't support the Sense Path Group ID
-		 *  command further retries wouldn't help ...
-		 */
-		return -EOPNOTSUPP;
-	}
-	if (irb->esw.esw0.erw.cons) {
-		CIO_MSG_EVENT(2, "SNID - device 0.%x.%04x, unit check, "
-			      "lpum %02X, cnt %02d, sns : "
-			      "%02X%02X%02X%02X %02X%02X%02X%02X ...\n",
-			      cdev->private->dev_id.ssid,
-			      cdev->private->dev_id.devno,
-			      irb->esw.esw0.sublog.lpum,
-			      irb->esw.esw0.erw.scnt,
-			      irb->ecw[0], irb->ecw[1],
-			      irb->ecw[2], irb->ecw[3],
-			      irb->ecw[4], irb->ecw[5],
-			      irb->ecw[6], irb->ecw[7]);
-		return -EAGAIN;
-	}
-	if (irb->scsw.cmd.cc == 3) {
-		u8 lpm;
-
-		lpm = to_io_private(sch)->orb.cmd.lpm;
-		CIO_MSG_EVENT(3, "SNID - Device %04x on Subchannel 0.%x.%04x,"
-			      " lpm %02X, became 'not operational'\n",
-			      cdev->private->dev_id.devno, sch->schid.ssid,
-			      sch->schid.sch_no, lpm);
-		return -EACCES;
-	}
-	i = 8 - ffs(cdev->private->imask);
-	if (cdev->private->pgid[i].inf.ps.state2 == SNID_STATE2_RESVD_ELSE) {
-		CIO_MSG_EVENT(2, "SNID - Device %04x on Subchannel 0.%x.%04x "
-			      "is reserved by someone else\n",
-			      cdev->private->dev_id.devno, sch->schid.ssid,
-			      sch->schid.sch_no);
-		return -EUSERS;
-	}
-	return 0;
+	/* Only subchannel status might indicate a path error. */
+	if (status == IO_STATUS_ERROR && irb->scsw.cmd.cstat == 0)
+		return IO_DONE;
+	return status;
 }
 
 /*
- * Got interrupt for Sense Path Group ID.
+ * Process NOOP request result for a single path.
  */
-void
-ccw_device_sense_pgid_irq(struct ccw_device *cdev, enum dev_event dev_event)
+static void nop_callback(struct ccw_device *cdev, void *data, int rc)
 {
-	struct subchannel *sch;
-	struct irb *irb;
-	int ret;
-
-	irb = (struct irb *) __LC_IRB;
-
-	if (irb->scsw.cmd.stctl ==
-	    (SCSW_STCTL_STATUS_PEND | SCSW_STCTL_ALERT_STATUS)) {
-		if (__ccw_device_should_retry(&irb->scsw)) {
-			ret = __ccw_device_sense_pgid_start(cdev);
-			if (ret && ret != -EBUSY)
-				ccw_device_sense_pgid_done(cdev, ret);
-		}
-		return;
-	}
-	if (ccw_device_accumulate_and_sense(cdev, irb) != 0)
-		return;
-	sch = to_subchannel(cdev->dev.parent);
-	ret = __ccw_device_check_sense_pgid(cdev);
-	memset(&cdev->private->irb, 0, sizeof(struct irb));
-	switch (ret) {
-	/* 0, -ETIME, -EOPNOTSUPP, -EAGAIN, -EACCES or -EUSERS */
-	case -EOPNOTSUPP:	/* Sense Path Group ID not supported */
-		ccw_device_sense_pgid_done(cdev, -EOPNOTSUPP);
-		break;
-	case -ETIME:		/* Sense path group id stopped by timeout. */
-		ccw_device_sense_pgid_done(cdev, -ETIME);
-		break;
-	case -EACCES:		/* channel is not operational. */
-		sch->lpm &= ~cdev->private->imask;
-		/* Fall through. */
-	case 0:			/* Sense Path Group ID successful. */
-		cdev->private->imask >>= 1;
-		cdev->private->iretry = 5;
-		/* Fall through. */
-	case -EAGAIN:		/* Try again. */
-		ret = __ccw_device_sense_pgid_start(cdev);
-		if (ret != 0 && ret != -EBUSY)
-			ccw_device_sense_pgid_done(cdev, ret);
-		break;
-	case -EUSERS:		/* device is reserved for someone else. */
-		ccw_device_sense_pgid_done(cdev, -EUSERS);
-		break;
-	}
+	struct subchannel *sch = to_subchannel(cdev->dev.parent);
+	struct ccw_request *req = &cdev->private->req;
+
+	if (rc == 0)
+		sch->vpm |= req->lpm;
+	else if (rc != -EACCES)
+		goto err;
+	req->lpm >>= 1;
+	nop_do(cdev);
+	return;
+
+err:
+	verify_done(cdev, rc);
 }
 
 /*
- * Path Group ID helper function.
+ * Create channel program to perform SET PGID on a single path.
  */
-static int
-__ccw_device_do_pgid(struct ccw_device *cdev, __u8 func)
+static void spid_build_cp(struct ccw_device *cdev, u8 fn)
 {
-	struct subchannel *sch;
-	struct ccw1 *ccw;
-	int ret;
-
-	sch = to_subchannel(cdev->dev.parent);
-
-	/* Setup sense path group id channel program. */
-	cdev->private->pgid[0].inf.fc = func;
-	ccw = cdev->private->iccws;
-	if (cdev->private->flags.pgid_single)
-		cdev->private->pgid[0].inf.fc |= SPID_FUNC_SINGLE_PATH;
-	else
-		cdev->private->pgid[0].inf.fc |= SPID_FUNC_MULTI_PATH;
-	ccw->cmd_code = CCW_CMD_SET_PGID;
-	ccw->cda = (__u32) __pa (&cdev->private->pgid[0]);
-	ccw->count = sizeof (struct pgid);
-	ccw->flags = CCW_FLAG_SLI;
-
-	/* Reset device status. */
-	memset(&cdev->private->irb, 0, sizeof(struct irb));
-
-	/* Try multiple times. */
-	ret = -EACCES;
-	if (cdev->private->iretry > 0) {
-		cdev->private->iretry--;
-		/* Reset internal retry indication. */
-		cdev->private->flags.intretry = 0;
-		ret = cio_start (sch, cdev->private->iccws,
-				 cdev->private->imask);
-		/* We expect an interrupt in case of success or busy
-		 * indication. */
-		if ((ret == 0) || (ret == -EBUSY))
-			return ret;
-	}
-	/* PGID command failed on this path. */
-	CIO_MSG_EVENT(3, "SPID - Device %04x on Subchannel "
-		      "0.%x.%04x, lpm %02X, became 'not operational'\n",
-		      cdev->private->dev_id.devno, sch->schid.ssid,
-		      sch->schid.sch_no, cdev->private->imask);
-	return ret;
+	struct ccw_request *req = &cdev->private->req;
+	struct ccw1 *cp = cdev->private->iccws;
+	int i = 8 - ffs(req->lpm);
+	struct pgid *pgid = &cdev->private->pgid[i];
+
+	pgid->inf.fc	= fn;
+	cp->cmd_code	= CCW_CMD_SET_PGID;
+	cp->cda		= (u32) (addr_t) pgid;
+	cp->count	= sizeof(*pgid);
+	cp->flags	= CCW_FLAG_SLI;
+	req->cp		= cp;
 }
 
 /*
- * Helper function to send a nop ccw down a path.
+ * Perform establish/resign SET PGID on a single path.
  */
-static int __ccw_device_do_nop(struct ccw_device *cdev)
+static void spid_do(struct ccw_device *cdev)
 {
-	struct subchannel *sch;
-	struct ccw1 *ccw;
-	int ret;
-
-	sch = to_subchannel(cdev->dev.parent);
-
-	/* Setup nop channel program. */
-	ccw = cdev->private->iccws;
-	ccw->cmd_code = CCW_CMD_NOOP;
-	ccw->cda = 0;
-	ccw->count = 0;
-	ccw->flags = CCW_FLAG_SLI;
-
-	/* Reset device status. */
-	memset(&cdev->private->irb, 0, sizeof(struct irb));
-
-	/* Try multiple times. */
-	ret = -EACCES;
-	if (cdev->private->iretry > 0) {
-		cdev->private->iretry--;
-		/* Reset internal retry indication. */
-		cdev->private->flags.intretry = 0;
-		ret = cio_start (sch, cdev->private->iccws,
-				 cdev->private->imask);
-		/* We expect an interrupt in case of success or busy
-		 * indication. */
-		if ((ret == 0) || (ret == -EBUSY))
-			return ret;
-	}
-	/* nop command failed on this path. */
-	CIO_MSG_EVENT(3, "NOP - Device %04x on Subchannel "
-		      "0.%x.%04x, lpm %02X, became 'not operational'\n",
-		      cdev->private->dev_id.devno, sch->schid.ssid,
-		      sch->schid.sch_no, cdev->private->imask);
-	return ret;
+	struct subchannel *sch = to_subchannel(cdev->dev.parent);
+	struct ccw_request *req = &cdev->private->req;
+	u8 fn;
+
+	/* Use next available path that is not already in correct state. */
+	req->lpm = lpm_adjust(req->lpm, cdev->private->pgid_todo_mask);
+	if (!req->lpm)
+		goto out_nopath;
+	/* Channel program setup. */
+	if (req->lpm & sch->opm)
+		fn = SPID_FUNC_ESTABLISH;
+	else
+		fn = SPID_FUNC_RESIGN;
+	if (cdev->private->flags.mpath)
+		fn |= SPID_FUNC_MULTI_PATH;
+	spid_build_cp(cdev, fn);
+	ccw_request_start(cdev);
+	return;
+
+out_nopath:
+	verify_done(cdev, sch->vpm ? 0 : -EACCES);
 }
 
+static void verify_start(struct ccw_device *cdev);
 
 /*
- * Called from interrupt context to check if a valid answer
- * to Set Path Group ID was received.
+ * Process SET PGID request result for a single path.
  */
-static int
-__ccw_device_check_pgid(struct ccw_device *cdev)
+static void spid_callback(struct ccw_device *cdev, void *data, int rc)
 {
-	struct subchannel *sch;
-	struct irb *irb;
-
-	sch = to_subchannel(cdev->dev.parent);
-	irb = &cdev->private->irb;
-	if (irb->scsw.cmd.fctl & (SCSW_FCTL_HALT_FUNC | SCSW_FCTL_CLEAR_FUNC)) {
-		/* Retry Set PGID if requested. */
-		if (cdev->private->flags.intretry) {
-			cdev->private->flags.intretry = 0;
-			return -EAGAIN;
+	struct subchannel *sch = to_subchannel(cdev->dev.parent);
+	struct ccw_request *req = &cdev->private->req;
+
+	switch (rc) {
+	case 0:
+		sch->vpm |= req->lpm & sch->opm;
+		break;
+	case -EACCES:
+		break;
+	case -EOPNOTSUPP:
+		if (cdev->private->flags.mpath) {
+			/* Try without multipathing. */
+			cdev->private->flags.mpath = 0;
+			goto out_restart;
 		}
-		return -ETIME;
-	}
-	if (irb->esw.esw0.erw.cons) {
-		if (irb->ecw[0] & SNS0_CMD_REJECT)
-			return -EOPNOTSUPP;
-		/* Hmm, whatever happened, try again. */
-		CIO_MSG_EVENT(2, "SPID - device 0.%x.%04x, unit check, "
-			      "cnt %02d, "
-			      "sns : %02X%02X%02X%02X %02X%02X%02X%02X ...\n",
-			      cdev->private->dev_id.ssid,
-			      cdev->private->dev_id.devno,
-			      irb->esw.esw0.erw.scnt,
-			      irb->ecw[0], irb->ecw[1],
-			      irb->ecw[2], irb->ecw[3],
-			      irb->ecw[4], irb->ecw[5],
-			      irb->ecw[6], irb->ecw[7]);
-		return -EAGAIN;
+		/* Try without pathgrouping. */
+		cdev->private->flags.pgroup = 0;
+		goto out_restart;
+	default:
+		goto err;
 	}
-	if (irb->scsw.cmd.cc == 3) {
-		CIO_MSG_EVENT(3, "SPID - Device %04x on Subchannel 0.%x.%04x,"
-			      " lpm %02X, became 'not operational'\n",
-			      cdev->private->dev_id.devno, sch->schid.ssid,
-			      sch->schid.sch_no, cdev->private->imask);
-		return -EACCES;
-	}
-	return 0;
+	req->lpm >>= 1;
+	spid_do(cdev);
+	return;
+
+out_restart:
+	verify_start(cdev);
+	return;
+err:
+	verify_done(cdev, rc);
+}
+
+static void spid_start(struct ccw_device *cdev)
+{
+	struct ccw_request *req = &cdev->private->req;
+
+	/* Initialize request data. */
+	memset(req, 0, sizeof(*req));
+	req->timeout	= PGID_TIMEOUT;
+	req->maxretries	= PGID_RETRIES;
+	req->lpm	= 0x80;
+	req->callback	= spid_callback;
+	spid_do(cdev);
+}
+
+static int pgid_cmp(struct pgid *p1, struct pgid *p2)
+{
+	return memcmp((char *) p1 + 1, (char *) p2 + 1,
+		      sizeof(struct pgid) - 1);
 }
 
 /*
- * Called from interrupt context to check the path status after a nop has
- * been send.
+ * Determine pathgroup state from PGID data.
  */
-static int __ccw_device_check_nop(struct ccw_device *cdev)
+static void pgid_analyze(struct ccw_device *cdev, struct pgid **p,
+			 int *mismatch, int *reserved, int *reset)
 {
-	struct subchannel *sch;
-	struct irb *irb;
-
-	sch = to_subchannel(cdev->dev.parent);
-	irb = &cdev->private->irb;
-	if (irb->scsw.cmd.fctl & (SCSW_FCTL_HALT_FUNC | SCSW_FCTL_CLEAR_FUNC)) {
-		/* Retry NOP if requested. */
-		if (cdev->private->flags.intretry) {
-			cdev->private->flags.intretry = 0;
-			return -EAGAIN;
+	struct pgid *pgid = &cdev->private->pgid[0];
+	struct pgid *first = NULL;
+	int lpm;
+	int i;
+
+	*mismatch = 0;
+	*reserved = 0;
+	*reset = 0;
+	for (i = 0, lpm = 0x80; i < 8; i++, pgid++, lpm >>= 1) {
+		if ((cdev->private->pgid_valid_mask & lpm) == 0)
+			continue;
+		if (pgid->inf.ps.state2 == SNID_STATE2_RESVD_ELSE)
+			*reserved = 1;
+		if (pgid->inf.ps.state1 == SNID_STATE1_RESET) {
+			/* A PGID was reset. */
+			*reset = 1;
+			continue;
 		}
-		return -ETIME;
-	}
-	if (irb->scsw.cmd.cc == 3) {
-		CIO_MSG_EVENT(3, "NOP - Device %04x on Subchannel 0.%x.%04x,"
-			      " lpm %02X, became 'not operational'\n",
-			      cdev->private->dev_id.devno, sch->schid.ssid,
-			      sch->schid.sch_no, cdev->private->imask);
-		return -EACCES;
+		if (!first) {
+			first = pgid;
+			continue;
+		}
+		if (pgid_cmp(pgid, first) != 0)
+			*mismatch = 1;
 	}
-	return 0;
+	if (!first)
+		first = &channel_subsystems[0]->global_pgid;
+	*p = first;
 }
 
-static void
-__ccw_device_verify_start(struct ccw_device *cdev)
+static u8 pgid_to_donepm(struct ccw_device *cdev)
 {
-	struct subchannel *sch;
-	__u8 func;
-	int ret;
-
-	sch = to_subchannel(cdev->dev.parent);
-	/* Repeat for all paths. */
-	for (; cdev->private->imask; cdev->private->imask >>= 1,
-				     cdev->private->iretry = 5) {
-		if ((cdev->private->imask & sch->schib.pmcw.pam) == 0)
-			/* Path not available, try next. */
+	struct subchannel *sch = to_subchannel(cdev->dev.parent);
+	struct pgid *pgid;
+	int i;
+	int lpm;
+	u8 donepm = 0;
+
+	/* Set bits for paths which are already in the target state. */
+	for (i = 0; i < 8; i++) {
+		lpm = 0x80 >> i;
+		if ((cdev->private->pgid_valid_mask & lpm) == 0)
 			continue;
-		if (cdev->private->options.pgroup) {
-			if (sch->opm & cdev->private->imask)
-				func = SPID_FUNC_ESTABLISH;
-			else
-				func = SPID_FUNC_RESIGN;
-			ret = __ccw_device_do_pgid(cdev, func);
-		} else
-			ret = __ccw_device_do_nop(cdev);
-		/* We expect an interrupt in case of success or busy
-		 * indication. */
-		if (ret == 0 || ret == -EBUSY)
-			return;
-		/* Permanent path failure, try next. */
+		pgid = &cdev->private->pgid[i];
+		if (sch->opm & lpm) {
+			if (pgid->inf.ps.state1 != SNID_STATE1_GROUPED)
+				continue;
+		} else {
+			if (pgid->inf.ps.state1 != SNID_STATE1_UNGROUPED)
+				continue;
+		}
+		if (cdev->private->flags.mpath) {
+			if (pgid->inf.ps.state3 != SNID_STATE3_MULTI_PATH)
+				continue;
+		} else {
+			if (pgid->inf.ps.state3 != SNID_STATE3_SINGLE_PATH)
+				continue;
+		}
+		donepm |= lpm;
 	}
-	/* Done with all paths. */
-	ccw_device_verify_done(cdev, (sch->vpm != 0) ? 0 : -ENODEV);
+
+	return donepm;
 }
-		
-/*
- * Got interrupt for Set Path Group ID.
- */
-void
-ccw_device_verify_irq(struct ccw_device *cdev, enum dev_event dev_event)
+
+static void pgid_fill(struct ccw_device *cdev, struct pgid *pgid)
 {
-	struct subchannel *sch;
-	struct irb *irb;
-	int ret;
+	int i;
 
-	irb = (struct irb *) __LC_IRB;
+	for (i = 0; i < 8; i++)
+		memcpy(&cdev->private->pgid[i], pgid, sizeof(struct pgid));
+}
 
-	if (irb->scsw.cmd.stctl ==
-	    (SCSW_STCTL_STATUS_PEND | SCSW_STCTL_ALERT_STATUS)) {
-		if (__ccw_device_should_retry(&irb->scsw))
-			__ccw_device_verify_start(cdev);
-		return;
+/*
+ * Process SENSE PGID data and report result.
+ */
+static void snid_done(struct ccw_device *cdev, int rc)
+{
+	struct ccw_dev_id *id = &cdev->private->dev_id;
+	struct subchannel *sch = to_subchannel(cdev->dev.parent);
+	struct pgid *pgid;
+	int mismatch = 0;
+	int reserved = 0;
+	int reset = 0;
+	u8 donepm;
+
+	if (rc)
+		goto out;
+	pgid_analyze(cdev, &pgid, &mismatch, &reserved, &reset);
+	if (reserved)
+		rc = -EUSERS;
+	else if (mismatch)
+		rc = -EOPNOTSUPP;
+	else {
+		donepm = pgid_to_donepm(cdev);
+		sch->vpm = donepm & sch->opm;
+		cdev->private->pgid_todo_mask &= ~donepm;
+		pgid_fill(cdev, pgid);
 	}
-	if (ccw_device_accumulate_and_sense(cdev, irb) != 0)
-		return;
-	sch = to_subchannel(cdev->dev.parent);
-	if (cdev->private->options.pgroup)
-		ret = __ccw_device_check_pgid(cdev);
-	else
-		ret = __ccw_device_check_nop(cdev);
-	memset(&cdev->private->irb, 0, sizeof(struct irb));
-
-	switch (ret) {
-	/* 0, -ETIME, -EAGAIN, -EOPNOTSUPP or -EACCES */
+out:
+	CIO_MSG_EVENT(2, "snid: device 0.%x.%04x: rc=%d pvm=%02x vpm=%02x "
+		      "todo=%02x mism=%d rsvd=%d reset=%d\n", id->ssid,
+		      id->devno, rc, cdev->private->pgid_valid_mask, sch->vpm,
+		      cdev->private->pgid_todo_mask, mismatch, reserved, reset);
+	switch (rc) {
 	case 0:
-		/* Path verification ccw finished successfully, update lpm. */
-		sch->vpm |= sch->opm & cdev->private->imask;
-		/* Go on with next path. */
-		cdev->private->imask >>= 1;
-		cdev->private->iretry = 5;
-		__ccw_device_verify_start(cdev);
+		/* Anything left to do? */
+		if (cdev->private->pgid_todo_mask == 0) {
+			verify_done(cdev, sch->vpm == 0 ? -EACCES : 0);
+			return;
+		}
+		/* Perform path-grouping. */
+		spid_start(cdev);
 		break;
 	case -EOPNOTSUPP:
-		/*
-		 * One of those strange devices which claim to be able
-		 * to do multipathing but not for Set Path Group ID.
-		 */
-		if (cdev->private->flags.pgid_single)
-			cdev->private->options.pgroup = 0;
-		else
-			cdev->private->flags.pgid_single = 1;
-		/* Retry */
-		sch->vpm = 0;
-		cdev->private->imask = 0x80;
-		cdev->private->iretry = 5;
-		/* fall through. */
-	case -EAGAIN:		/* Try again. */
-		__ccw_device_verify_start(cdev);
-		break;
-	case -ETIME:		/* Set path group id stopped by timeout. */
-		ccw_device_verify_done(cdev, -ETIME);
-		break;
-	case -EACCES:		/* channel is not operational. */
-		cdev->private->imask >>= 1;
-		cdev->private->iretry = 5;
-		__ccw_device_verify_start(cdev);
+		/* Path-grouping not supported. */
+		cdev->private->flags.pgroup = 0;
+		cdev->private->flags.mpath = 0;
+		verify_start(cdev);
 		break;
+	default:
+		verify_done(cdev, rc);
 	}
 }
 
-void
-ccw_device_verify_start(struct ccw_device *cdev)
+/*
+ * Create channel program to perform a SENSE PGID on a single path.
+ */
+static void snid_build_cp(struct ccw_device *cdev)
+{
+	struct ccw_request *req = &cdev->private->req;
+	struct ccw1 *cp = cdev->private->iccws;
+	int i = 8 - ffs(req->lpm);
+
+	/* Channel program setup. */
+	cp->cmd_code	= CCW_CMD_SENSE_PGID;
+	cp->cda		= (u32) (addr_t) &cdev->private->pgid[i];
+	cp->count	= sizeof(struct pgid);
+	cp->flags	= CCW_FLAG_SLI;
+	req->cp		= cp;
+}
+
+/*
+ * Perform SENSE PGID on a single path.
+ */
+static void snid_do(struct ccw_device *cdev)
 {
 	struct subchannel *sch = to_subchannel(cdev->dev.parent);
+	struct ccw_request *req = &cdev->private->req;
+
+	/* Adjust lpm if paths are not set in pam. */
+	req->lpm = lpm_adjust(req->lpm, sch->schib.pmcw.pam);
+	if (!req->lpm)
+		goto out_nopath;
+	snid_build_cp(cdev);
+	ccw_request_start(cdev);
+	return;
+
+out_nopath:
+	snid_done(cdev, cdev->private->pgid_valid_mask ? 0 : -EACCES);
+}
 
-	cdev->private->flags.pgid_single = 0;
-	cdev->private->imask = 0x80;
-	cdev->private->iretry = 5;
+/*
+ * Process SENSE PGID request result for single path.
+ */
+static void snid_callback(struct ccw_device *cdev, void *data, int rc)
+{
+	struct ccw_request *req = &cdev->private->req;
+
+	if (rc == 0)
+		cdev->private->pgid_valid_mask |= req->lpm;
+	else if (rc != -EACCES)
+		goto err;
+	req->lpm >>= 1;
+	snid_do(cdev);
+	return;
+
+err:
+	snid_done(cdev, rc);
+}
 
-	/* Start with empty vpm. */
-	sch->vpm = 0;
+/*
+ * Perform path verification.
+ */
+static void verify_start(struct ccw_device *cdev)
+{
+	struct subchannel *sch = to_subchannel(cdev->dev.parent);
+	struct ccw_request *req = &cdev->private->req;
+	struct ccw_dev_id *devid = &cdev->private->dev_id;
 
-	/* Get current pam. */
-	if (cio_update_schib(sch)) {
-		ccw_device_verify_done(cdev, -ENODEV);
-		return;
+	sch->vpm = 0;
+	sch->lpm = sch->schib.pmcw.pam;
+	/* Initialize request data. */
+	memset(req, 0, sizeof(*req));
+	req->timeout	= PGID_TIMEOUT;
+	req->maxretries	= PGID_RETRIES;
+	req->lpm	= 0x80;
+	if (cdev->private->flags.pgroup) {
+		CIO_TRACE_EVENT(4, "snid");
+		CIO_HEX_EVENT(4, devid, sizeof(*devid));
+		req->callback	= snid_callback;
+		snid_do(cdev);
+	} else {
+		CIO_TRACE_EVENT(4, "nop");
+		CIO_HEX_EVENT(4, devid, sizeof(*devid));
+		req->filter	= nop_filter;
+		req->callback	= nop_callback;
+		nop_do(cdev);
 	}
-	/* After 60s path verification is considered to have failed. */
-	ccw_device_set_timeout(cdev, 60*HZ);
-	__ccw_device_verify_start(cdev);
 }
 
-static void
-__ccw_device_disband_start(struct ccw_device *cdev)
+/**
+ * ccw_device_verify_start - perform path verification
+ * @cdev: ccw device
+ *
+ * Perform an I/O on each available channel path to @cdev to determine which
+ * paths are operational. The resulting path mask is stored in sch->vpm.
+ * If device options specify pathgrouping, establish a pathgroup for the
+ * operational paths. When finished, call ccw_device_verify_done with a
+ * return code specifying the result.
+ */
+void ccw_device_verify_start(struct ccw_device *cdev)
 {
-	struct subchannel *sch;
-	int ret;
-
-	sch = to_subchannel(cdev->dev.parent);
-	while (cdev->private->imask != 0) {
-		if (sch->lpm & cdev->private->imask) {
-			ret = __ccw_device_do_pgid(cdev, SPID_FUNC_DISBAND);
-			if (ret == 0)
-				return;
-		}
-		cdev->private->iretry = 5;
-		cdev->private->imask >>= 1;
-	}
-	ccw_device_disband_done(cdev, (sch->lpm != 0) ? 0 : -ENODEV);
+	struct subchannel *sch = to_subchannel(cdev->dev.parent);
+
+	CIO_TRACE_EVENT(4, "vrfy");
+	CIO_HEX_EVENT(4, &cdev->private->dev_id, sizeof(cdev->private->dev_id));
+	/* Initialize PGID data. */
+	memset(cdev->private->pgid, 0, sizeof(cdev->private->pgid));
+	cdev->private->pgid_valid_mask = 0;
+	cdev->private->pgid_todo_mask = sch->schib.pmcw.pam;
+	/*
+	 * Initialize pathgroup and multipath state with target values.
+	 * They may change in the course of path verification.
+	 */
+	cdev->private->flags.pgroup = cdev->private->options.pgroup;
+	cdev->private->flags.mpath = cdev->private->options.mpath;
+	cdev->private->flags.doverify = 0;
+	verify_start(cdev);
 }
 
 /*
- * Got interrupt for Unset Path Group ID.
+ * Process disband SET PGID request result.
  */
-void
-ccw_device_disband_irq(struct ccw_device *cdev, enum dev_event dev_event)
+static void disband_callback(struct ccw_device *cdev, void *data, int rc)
 {
-	struct subchannel *sch;
-	struct irb *irb;
-	int ret;
+	struct subchannel *sch = to_subchannel(cdev->dev.parent);
+	struct ccw_dev_id *id = &cdev->private->dev_id;
+
+	if (rc)
+		goto out;
+	/* Ensure consistent multipathing state at device and channel. */
+	cdev->private->flags.mpath = 0;
+	if (sch->config.mp) {
+		sch->config.mp = 0;
+		rc = cio_commit_config(sch);
+	}
+out:
+	CIO_MSG_EVENT(0, "disb: device 0.%x.%04x: rc=%d\n", id->ssid, id->devno,
+		      rc);
+	ccw_device_disband_done(cdev, rc);
+}
 
-	irb = (struct irb *) __LC_IRB;
+/**
+ * ccw_device_disband_start - disband pathgroup
+ * @cdev: ccw device
+ *
+ * Execute a SET PGID channel program on @cdev to disband a previously
+ * established pathgroup. When finished, call ccw_device_disband_done with
+ * a return code specifying the result.
+ */
+void ccw_device_disband_start(struct ccw_device *cdev)
+{
+	struct subchannel *sch = to_subchannel(cdev->dev.parent);
+	struct ccw_request *req = &cdev->private->req;
+	u8 fn;
+
+	CIO_TRACE_EVENT(4, "disb");
+	CIO_HEX_EVENT(4, &cdev->private->dev_id, sizeof(cdev->private->dev_id));
+	/* Request setup. */
+	memset(req, 0, sizeof(*req));
+	req->timeout	= PGID_TIMEOUT;
+	req->maxretries	= PGID_RETRIES;
+	req->lpm	= sch->schib.pmcw.pam & sch->opm;
+	req->callback	= disband_callback;
+	fn = SPID_FUNC_DISBAND;
+	if (cdev->private->flags.mpath)
+		fn |= SPID_FUNC_MULTI_PATH;
+	spid_build_cp(cdev, fn);
+	ccw_request_start(cdev);
+}
 
-	if (irb->scsw.cmd.stctl ==
-	    (SCSW_STCTL_STATUS_PEND | SCSW_STCTL_ALERT_STATUS)) {
-		if (__ccw_device_should_retry(&irb->scsw))
-			__ccw_device_disband_start(cdev);
-		return;
-	}
-	if (ccw_device_accumulate_and_sense(cdev, irb) != 0)
-		return;
-	sch = to_subchannel(cdev->dev.parent);
-	ret = __ccw_device_check_pgid(cdev);
-	memset(&cdev->private->irb, 0, sizeof(struct irb));
-	switch (ret) {
-	/* 0, -ETIME, -EAGAIN, -EOPNOTSUPP or -EACCES */
-	case 0:			/* disband successful. */
-		ccw_device_disband_done(cdev, ret);
-		break;
-	case -EOPNOTSUPP:
-		/*
-		 * One of those strange devices which claim to be able
-		 * to do multipathing but not for Unset Path Group ID.
-		 */
-		cdev->private->flags.pgid_single = 1;
-		/* fall through. */
-	case -EAGAIN:		/* Try again. */
-		__ccw_device_disband_start(cdev);
-		break;
-	case -ETIME:		/* Set path group id stopped by timeout. */
-		ccw_device_disband_done(cdev, -ETIME);
-		break;
-	case -EACCES:		/* channel is not operational. */
-		cdev->private->imask >>= 1;
-		cdev->private->iretry = 5;
-		__ccw_device_disband_start(cdev);
-		break;
-	}
+static void stlck_build_cp(struct ccw_device *cdev, void *buf1, void *buf2)
+{
+	struct ccw_request *req = &cdev->private->req;
+	struct ccw1 *cp = cdev->private->iccws;
+
+	cp[0].cmd_code = CCW_CMD_STLCK;
+	cp[0].cda = (u32) (addr_t) buf1;
+	cp[0].count = 32;
+	cp[0].flags = CCW_FLAG_CC;
+	cp[1].cmd_code = CCW_CMD_RELEASE;
+	cp[1].cda = (u32) (addr_t) buf2;
+	cp[1].count = 32;
+	cp[1].flags = 0;
+	req->cp = cp;
 }
 
-void
-ccw_device_disband_start(struct ccw_device *cdev)
+static void stlck_callback(struct ccw_device *cdev, void *data, int rc)
 {
-	/* After 60s disbanding is considered to have failed. */
-	ccw_device_set_timeout(cdev, 60*HZ);
+	ccw_device_stlck_done(cdev, data, rc);
+}
 
-	cdev->private->flags.pgid_single = 0;
-	cdev->private->iretry = 5;
-	cdev->private->imask = 0x80;
-	__ccw_device_disband_start(cdev);
+/**
+ * ccw_device_stlck_start - perform unconditional release
+ * @cdev: ccw device
+ * @data: data pointer to be passed to ccw_device_stlck_done
+ * @buf1: data pointer used in channel program
+ * @buf2: data pointer used in channel program
+ *
+ * Execute a channel program on @cdev to release an existing PGID reservation.
+ * When finished, call ccw_device_stlck_done with a return code specifying the
+ * result.
+ */
+void ccw_device_stlck_start(struct ccw_device *cdev, void *data, void *buf1,
+			    void *buf2)
+{
+	struct subchannel *sch = to_subchannel(cdev->dev.parent);
+	struct ccw_request *req = &cdev->private->req;
+
+	CIO_TRACE_EVENT(4, "stlck");
+	CIO_HEX_EVENT(4, &cdev->private->dev_id, sizeof(cdev->private->dev_id));
+	/* Request setup. */
+	memset(req, 0, sizeof(*req));
+	req->timeout	= PGID_TIMEOUT;
+	req->maxretries	= PGID_RETRIES;
+	req->lpm	= sch->schib.pmcw.pam & sch->opm;
+	req->data	= data;
+	req->callback	= stlck_callback;
+	stlck_build_cp(cdev, buf1, buf2);
+	ccw_request_start(cdev);
 }
+
diff --git a/drivers/s390/cio/device_status.c b/drivers/s390/cio/device_status.c
index 5814dbee2410..66d8066ef22a 100644
--- a/drivers/s390/cio/device_status.c
+++ b/drivers/s390/cio/device_status.c
@@ -336,9 +336,6 @@ ccw_device_do_sense(struct ccw_device *cdev, struct irb *irb)
 	sense_ccw->count = SENSE_MAX_COUNT;
 	sense_ccw->flags = CCW_FLAG_SLI;
 
-	/* Reset internal retry indication. */
-	cdev->private->flags.intretry = 0;
-
 	rc = cio_start(sch, sense_ccw, 0xff);
 	if (rc == -ENODEV || rc == -EACCES)
 		dev_fsm_event(cdev, DEV_EVENT_VERIFY);
diff --git a/drivers/s390/cio/fcx.c b/drivers/s390/cio/fcx.c
index 61677dfbdc9b..ca5e9bb9d458 100644
--- a/drivers/s390/cio/fcx.c
+++ b/drivers/s390/cio/fcx.c
@@ -163,7 +163,7 @@ void tcw_finalize(struct tcw *tcw, int num_tidaws)
 	/* Add tcat to tccb. */
 	tccb = tcw_get_tccb(tcw);
 	tcat = (struct tccb_tcat *) &tccb->tca[tca_size(tccb)];
-	memset(tcat, 0, sizeof(tcat));
+	memset(tcat, 0, sizeof(*tcat));
 	/* Calculate tcw input/output count and tcat transport count. */
 	count = calc_dcw_count(tccb);
 	if (tcw->w && (tcw->flags & TCW_FLAGS_OUTPUT_TIDA))
@@ -269,7 +269,7 @@ EXPORT_SYMBOL(tccb_init);
  */
 void tsb_init(struct tsb *tsb)
 {
-	memset(tsb, 0, sizeof(tsb));
+	memset(tsb, 0, sizeof(*tsb));
 }
 EXPORT_SYMBOL(tsb_init);
 
diff --git a/drivers/s390/cio/io_sch.h b/drivers/s390/cio/io_sch.h
index 0b8f381bd20e..b9ce712a7f25 100644
--- a/drivers/s390/cio/io_sch.h
+++ b/drivers/s390/cio/io_sch.h
@@ -1,7 +1,10 @@
 #ifndef S390_IO_SCH_H
 #define S390_IO_SCH_H
 
+#include <linux/types.h>
 #include <asm/schid.h>
+#include <asm/ccwdev.h>
+#include "css.h"
 
 /*
  * command-mode operation request block
@@ -68,6 +71,52 @@ struct io_subchannel_private {
 #define MAX_CIWS 8
 
 /*
+ * Possible status values for a CCW request's I/O.
+ */
+enum io_status {
+	IO_DONE,
+	IO_RUNNING,
+	IO_STATUS_ERROR,
+	IO_PATH_ERROR,
+	IO_REJECTED,
+	IO_KILLED
+};
+
+/**
+ * ccw_request - Internal CCW request.
+ * @cp: channel program to start
+ * @timeout: maximum allowable time in jiffies between start I/O and interrupt
+ * @maxretries: number of retries per I/O operation and path
+ * @lpm: mask of paths to use
+ * @check: optional callback that determines if results are final
+ * @filter: optional callback to adjust request status based on IRB data
+ * @callback: final callback
+ * @data: user-defined pointer passed to all callbacks
+ * @mask: current path mask
+ * @retries: current number of retries
+ * @drc: delayed return code
+ * @cancel: non-zero if request was cancelled
+ * @done: non-zero if request was finished
+ */
+struct ccw_request {
+	struct ccw1 *cp;
+	unsigned long timeout;
+	u16 maxretries;
+	u8 lpm;
+	int (*check)(struct ccw_device *, void *);
+	enum io_status (*filter)(struct ccw_device *, void *, struct irb *,
+				 enum io_status);
+	void (*callback)(struct ccw_device *, void *, int);
+	void *data;
+	/* These fields are used internally. */
+	u16 mask;
+	u16 retries;
+	int drc;
+	int cancel:1;
+	int done:1;
+} __attribute__((packed));
+
+/*
  * sense-id response buffer layout
  */
 struct senseid {
@@ -82,32 +131,44 @@ struct senseid {
 	struct ciw ciw[MAX_CIWS];	/* variable # of CIWs */
 }  __attribute__ ((packed, aligned(4)));
 
+enum cdev_todo {
+	CDEV_TODO_NOTHING,
+	CDEV_TODO_ENABLE_CMF,
+	CDEV_TODO_REBIND,
+	CDEV_TODO_REGISTER,
+	CDEV_TODO_UNREG,
+	CDEV_TODO_UNREG_EVAL,
+};
+
 struct ccw_device_private {
 	struct ccw_device *cdev;
 	struct subchannel *sch;
 	int state;		/* device state */
 	atomic_t onoff;
-	unsigned long registered;
 	struct ccw_dev_id dev_id;	/* device id */
 	struct subchannel_id schid;	/* subchannel number */
-	u8 imask;		/* lpm mask for SNID/SID/SPGID */
-	int iretry;		/* retry counter SNID/SID/SPGID */
+	struct ccw_request req;		/* internal I/O request */
+	int iretry;
+	u8 pgid_valid_mask;		/* mask of valid PGIDs */
+	u8 pgid_todo_mask;		/* mask of PGIDs to be adjusted */
 	struct {
 		unsigned int fast:1;	/* post with "channel end" */
 		unsigned int repall:1;	/* report every interrupt status */
 		unsigned int pgroup:1;	/* do path grouping */
 		unsigned int force:1;	/* allow forced online */
+		unsigned int mpath:1;	/* do multipathing */
 	} __attribute__ ((packed)) options;
 	struct {
-		unsigned int pgid_single:1; /* use single path for Set PGID */
 		unsigned int esid:1;	    /* Ext. SenseID supported by HW */
 		unsigned int dosense:1;	    /* delayed SENSE required */
 		unsigned int doverify:1;    /* delayed path verification */
 		unsigned int donotify:1;    /* call notify function */
 		unsigned int recog_done:1;  /* dev. recog. complete */
 		unsigned int fake_irb:1;    /* deliver faked irb */
-		unsigned int intretry:1;    /* retry internal operation */
 		unsigned int resuming:1;    /* recognition while resume */
+		unsigned int pgroup:1;	    /* pathgroup is set up */
+		unsigned int mpath:1;	    /* multipathing is set up */
+		unsigned int initialized:1; /* set if initial reference held */
 	} __attribute__((packed)) flags;
 	unsigned long intparm;	/* user interruption parameter */
 	struct qdio_irq *qdio_data;
@@ -115,7 +176,8 @@ struct ccw_device_private {
 	struct senseid senseid;	/* SenseID info */
 	struct pgid pgid[8];	/* path group IDs per chpid*/
 	struct ccw1 iccws[2];	/* ccws for SNID/SID/SPGID commands */
-	struct work_struct kick_work;
+	struct work_struct todo_work;
+	enum cdev_todo todo;
 	wait_queue_head_t wait_q;
 	struct timer_list timer;
 	void *cmb;			/* measurement information */
diff --git a/drivers/s390/cio/qdio.h b/drivers/s390/cio/qdio.h
index ff7748a9199d..44f2f6a97f33 100644
--- a/drivers/s390/cio/qdio.h
+++ b/drivers/s390/cio/qdio.h
@@ -182,6 +182,34 @@ struct scssc_area {
 	u32:32;
 } __attribute__ ((packed));
 
+struct qdio_dev_perf_stat {
+	unsigned int adapter_int;
+	unsigned int qdio_int;
+	unsigned int pci_request_int;
+
+	unsigned int tasklet_inbound;
+	unsigned int tasklet_inbound_resched;
+	unsigned int tasklet_inbound_resched2;
+	unsigned int tasklet_outbound;
+
+	unsigned int siga_read;
+	unsigned int siga_write;
+	unsigned int siga_sync;
+
+	unsigned int inbound_call;
+	unsigned int inbound_handler;
+	unsigned int stop_polling;
+	unsigned int inbound_queue_full;
+	unsigned int outbound_call;
+	unsigned int outbound_handler;
+	unsigned int fast_requeue;
+	unsigned int target_full;
+	unsigned int eqbs;
+	unsigned int eqbs_partial;
+	unsigned int sqbs;
+	unsigned int sqbs_partial;
+};
+
 struct qdio_input_q {
 	/* input buffer acknowledgement flag */
 	int polling;
@@ -269,6 +297,7 @@ struct qdio_irq {
 	u32 *dsci;		/* address of device state change indicator */
 	struct ccw_device *cdev;
 	struct dentry *debugfs_dev;
+	struct dentry *debugfs_perf;
 
 	unsigned long int_parm;
 	struct subchannel_id schid;
@@ -286,9 +315,10 @@ struct qdio_irq {
 	struct ciw aqueue;
 
 	struct qdio_ssqd_desc ssqd_desc;
-
 	void (*orig_handler) (struct ccw_device *, unsigned long, struct irb *);
 
+	struct qdio_dev_perf_stat perf_stat;
+	int perf_stat_enabled;
 	/*
 	 * Warning: Leave these members together at the end so they won't be
 	 * cleared in qdio_setup_irq.
@@ -311,6 +341,10 @@ struct qdio_irq {
 	(irq->qib.qfmt == QDIO_IQDIO_QFMT || \
 	 css_general_characteristics.aif_osa)
 
+#define qperf(qdev,attr)	qdev->perf_stat.attr
+#define qperf_inc(q,attr)	if (q->irq_ptr->perf_stat_enabled) \
+					q->irq_ptr->perf_stat.attr++
+
 /* the highest iqdio queue is used for multicast */
 static inline int multicast_outbound(struct qdio_q *q)
 {
diff --git a/drivers/s390/cio/qdio_debug.c b/drivers/s390/cio/qdio_debug.c
index 76769978285f..f49761ff9a00 100644
--- a/drivers/s390/cio/qdio_debug.c
+++ b/drivers/s390/cio/qdio_debug.c
@@ -55,13 +55,11 @@ static int qstat_show(struct seq_file *m, void *v)
 	if (!q)
 		return 0;
 
-	seq_printf(m, "device state indicator: %d\n", *(u32 *)q->irq_ptr->dsci);
-	seq_printf(m, "nr_used: %d\n", atomic_read(&q->nr_buf_used));
-	seq_printf(m, "ftc: %d\n", q->first_to_check);
-	seq_printf(m, "last_move: %d\n", q->last_move);
-	seq_printf(m, "polling: %d\n", q->u.in.polling);
-	seq_printf(m, "ack start: %d\n", q->u.in.ack_start);
-	seq_printf(m, "ack count: %d\n", q->u.in.ack_count);
+	seq_printf(m, "DSCI: %d   nr_used: %d\n",
+		   *(u32 *)q->irq_ptr->dsci, atomic_read(&q->nr_buf_used));
+	seq_printf(m, "ftc: %d  last_move: %d\n", q->first_to_check, q->last_move);
+	seq_printf(m, "polling: %d  ack start: %d  ack count: %d\n",
+		   q->u.in.polling, q->u.in.ack_start, q->u.in.ack_count);
 	seq_printf(m, "slsb buffer states:\n");
 	seq_printf(m, "|0      |8      |16     |24     |32     |40     |48     |56  63|\n");
 
@@ -110,7 +108,6 @@ static ssize_t qstat_seq_write(struct file *file, const char __user *buf,
 
 	if (!q)
 		return 0;
-
 	if (q->is_input_q)
 		xchg(q->irq_ptr->dsci, 1);
 	local_bh_disable();
@@ -134,6 +131,98 @@ static const struct file_operations debugfs_fops = {
 	.release = single_release,
 };
 
+static char *qperf_names[] = {
+	"Assumed adapter interrupts",
+	"QDIO interrupts",
+	"Requested PCIs",
+	"Inbound tasklet runs",
+	"Inbound tasklet resched",
+	"Inbound tasklet resched2",
+	"Outbound tasklet runs",
+	"SIGA read",
+	"SIGA write",
+	"SIGA sync",
+	"Inbound calls",
+	"Inbound handler",
+	"Inbound stop_polling",
+	"Inbound queue full",
+	"Outbound calls",
+	"Outbound handler",
+	"Outbound fast_requeue",
+	"Outbound target_full",
+	"QEBSM eqbs",
+	"QEBSM eqbs partial",
+	"QEBSM sqbs",
+	"QEBSM sqbs partial"
+};
+
+static int qperf_show(struct seq_file *m, void *v)
+{
+	struct qdio_irq *irq_ptr = m->private;
+	unsigned int *stat;
+	int i;
+
+	if (!irq_ptr)
+		return 0;
+	if (!irq_ptr->perf_stat_enabled) {
+		seq_printf(m, "disabled\n");
+		return 0;
+	}
+	stat = (unsigned int *)&irq_ptr->perf_stat;
+
+	for (i = 0; i < ARRAY_SIZE(qperf_names); i++)
+		seq_printf(m, "%26s:\t%u\n",
+			   qperf_names[i], *(stat + i));
+	return 0;
+}
+
+static ssize_t qperf_seq_write(struct file *file, const char __user *ubuf,
+			       size_t count, loff_t *off)
+{
+	struct seq_file *seq = file->private_data;
+	struct qdio_irq *irq_ptr = seq->private;
+	unsigned long val;
+	char buf[8];
+	int ret;
+
+	if (!irq_ptr)
+		return 0;
+	if (count >= sizeof(buf))
+		return -EINVAL;
+	if (copy_from_user(&buf, ubuf, count))
+		return -EFAULT;
+	buf[count] = 0;
+
+	ret = strict_strtoul(buf, 10, &val);
+	if (ret < 0)
+		return ret;
+
+	switch (val) {
+	case 0:
+		irq_ptr->perf_stat_enabled = 0;
+		memset(&irq_ptr->perf_stat, 0, sizeof(irq_ptr->perf_stat));
+		break;
+	case 1:
+		irq_ptr->perf_stat_enabled = 1;
+		break;
+	}
+	return count;
+}
+
+static int qperf_seq_open(struct inode *inode, struct file *filp)
+{
+	return single_open(filp, qperf_show,
+			   filp->f_path.dentry->d_inode->i_private);
+}
+
+static struct file_operations debugfs_perf_fops = {
+	.owner	 = THIS_MODULE,
+	.open	 = qperf_seq_open,
+	.read	 = seq_read,
+	.write	 = qperf_seq_write,
+	.llseek  = seq_lseek,
+	.release = single_release,
+};
 static void setup_debugfs_entry(struct qdio_q *q, struct ccw_device *cdev)
 {
 	char name[QDIO_DEBUGFS_NAME_LEN];
@@ -156,6 +245,14 @@ void qdio_setup_debug_entries(struct qdio_irq *irq_ptr, struct ccw_device *cdev)
 						  debugfs_root);
 	if (IS_ERR(irq_ptr->debugfs_dev))
 		irq_ptr->debugfs_dev = NULL;
+
+	irq_ptr->debugfs_perf = debugfs_create_file("statistics",
+				S_IFREG | S_IRUGO | S_IWUSR,
+				irq_ptr->debugfs_dev, irq_ptr,
+				&debugfs_perf_fops);
+	if (IS_ERR(irq_ptr->debugfs_perf))
+		irq_ptr->debugfs_perf = NULL;
+
 	for_each_input_queue(irq_ptr, q, i)
 		setup_debugfs_entry(q, cdev);
 	for_each_output_queue(irq_ptr, q, i)
@@ -171,6 +268,7 @@ void qdio_shutdown_debug_entries(struct qdio_irq *irq_ptr, struct ccw_device *cd
 		debugfs_remove(q->debugfs_q);
 	for_each_output_queue(irq_ptr, q, i)
 		debugfs_remove(q->debugfs_q);
+	debugfs_remove(irq_ptr->debugfs_perf);
 	debugfs_remove(irq_ptr->debugfs_dev);
 }
 
diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
index 4be6e84b9599..999fe80c4051 100644
--- a/drivers/s390/cio/qdio_main.c
+++ b/drivers/s390/cio/qdio_main.c
@@ -22,7 +22,6 @@
 #include "device.h"
 #include "qdio.h"
 #include "qdio_debug.h"
-#include "qdio_perf.h"
 
 MODULE_AUTHOR("Utz Bacher <utz.bacher@de.ibm.com>,"\
 	"Jan Glauber <jang@linux.vnet.ibm.com>");
@@ -126,7 +125,7 @@ static int qdio_do_eqbs(struct qdio_q *q, unsigned char *state,
 	int rc;
 
 	BUG_ON(!q->irq_ptr->sch_token);
-	qdio_perf_stat_inc(&perf_stats.debug_eqbs_all);
+	qperf_inc(q, eqbs);
 
 	if (!q->is_input_q)
 		nr += q->irq_ptr->nr_input_qs;
@@ -139,7 +138,7 @@ again:
 	 * buffers later.
 	 */
 	if ((ccq == 96) && (count != tmp_count)) {
-		qdio_perf_stat_inc(&perf_stats.debug_eqbs_incomplete);
+		qperf_inc(q, eqbs_partial);
 		return (count - tmp_count);
 	}
 
@@ -182,7 +181,7 @@ static int qdio_do_sqbs(struct qdio_q *q, unsigned char state, int start,
 		return 0;
 
 	BUG_ON(!q->irq_ptr->sch_token);
-	qdio_perf_stat_inc(&perf_stats.debug_sqbs_all);
+	qperf_inc(q, sqbs);
 
 	if (!q->is_input_q)
 		nr += q->irq_ptr->nr_input_qs;
@@ -191,7 +190,7 @@ again:
 	rc = qdio_check_ccq(q, ccq);
 	if (rc == 1) {
 		DBF_DEV_EVENT(DBF_INFO, q->irq_ptr, "SQBS again:%2d", ccq);
-		qdio_perf_stat_inc(&perf_stats.debug_sqbs_incomplete);
+		qperf_inc(q, sqbs_partial);
 		goto again;
 	}
 	if (rc < 0) {
@@ -285,7 +284,7 @@ static inline int qdio_siga_sync(struct qdio_q *q, unsigned int output,
 		return 0;
 
 	DBF_DEV_EVENT(DBF_INFO, q->irq_ptr, "siga-s:%1d", q->nr);
-	qdio_perf_stat_inc(&perf_stats.siga_sync);
+	qperf_inc(q, siga_sync);
 
 	cc = do_siga_sync(q->irq_ptr->schid, output, input);
 	if (cc)
@@ -350,7 +349,7 @@ static inline int qdio_siga_input(struct qdio_q *q)
 	int cc;
 
 	DBF_DEV_EVENT(DBF_INFO, q->irq_ptr, "siga-r:%1d", q->nr);
-	qdio_perf_stat_inc(&perf_stats.siga_in);
+	qperf_inc(q, siga_read);
 
 	cc = do_siga_input(q->irq_ptr->schid, q->mask);
 	if (cc)
@@ -382,7 +381,7 @@ static inline void qdio_stop_polling(struct qdio_q *q)
 		return;
 
 	q->u.in.polling = 0;
-	qdio_perf_stat_inc(&perf_stats.debug_stop_polling);
+	qperf_inc(q, stop_polling);
 
 	/* show the card that we are not polling anymore */
 	if (is_qebsm(q)) {
@@ -400,7 +399,7 @@ static void announce_buffer_error(struct qdio_q *q, int count)
 	/* special handling for no target buffer empty */
 	if ((!q->is_input_q &&
 	    (q->sbal[q->first_to_check]->element[15].flags & 0xff) == 0x10)) {
-		qdio_perf_stat_inc(&perf_stats.outbound_target_full);
+		qperf_inc(q, target_full);
 		DBF_DEV_EVENT(DBF_INFO, q->irq_ptr, "OUTFULL FTC:%02x",
 			      q->first_to_check);
 		return;
@@ -486,7 +485,8 @@ static int get_inbound_buffer_frontier(struct qdio_q *q)
 	case SLSB_P_INPUT_PRIMED:
 		inbound_primed(q, count);
 		q->first_to_check = add_buf(q->first_to_check, count);
-		atomic_sub(count, &q->nr_buf_used);
+		if (atomic_sub(count, &q->nr_buf_used) == 0)
+			qperf_inc(q, inbound_queue_full);
 		break;
 	case SLSB_P_INPUT_ERROR:
 		announce_buffer_error(q, count);
@@ -566,9 +566,10 @@ static void qdio_kick_handler(struct qdio_q *q)
 	count = sub_buf(end, start);
 
 	if (q->is_input_q) {
-		qdio_perf_stat_inc(&perf_stats.inbound_handler);
+		qperf_inc(q, inbound_handler);
 		DBF_DEV_EVENT(DBF_INFO, q->irq_ptr, "kih s:%02x c:%02x", start, count);
 	} else
+		qperf_inc(q, outbound_handler);
 		DBF_DEV_EVENT(DBF_INFO, q->irq_ptr, "koh: s:%02x c:%02x",
 			      start, count);
 
@@ -582,24 +583,28 @@ static void qdio_kick_handler(struct qdio_q *q)
 
 static void __qdio_inbound_processing(struct qdio_q *q)
 {
-	qdio_perf_stat_inc(&perf_stats.tasklet_inbound);
+	qperf_inc(q, tasklet_inbound);
 again:
 	if (!qdio_inbound_q_moved(q))
 		return;
 
 	qdio_kick_handler(q);
 
-	if (!qdio_inbound_q_done(q))
+	if (!qdio_inbound_q_done(q)) {
 		/* means poll time is not yet over */
+		qperf_inc(q, tasklet_inbound_resched);
 		goto again;
+	}
 
 	qdio_stop_polling(q);
 	/*
 	 * We need to check again to not lose initiative after
 	 * resetting the ACK state.
 	 */
-	if (!qdio_inbound_q_done(q))
+	if (!qdio_inbound_q_done(q)) {
+		qperf_inc(q, tasklet_inbound_resched2);
 		goto again;
+	}
 }
 
 void qdio_inbound_processing(unsigned long data)
@@ -687,7 +692,7 @@ static int qdio_kick_outbound_q(struct qdio_q *q)
 		return 0;
 
 	DBF_DEV_EVENT(DBF_INFO, q->irq_ptr, "siga-w:%1d", q->nr);
-	qdio_perf_stat_inc(&perf_stats.siga_out);
+	qperf_inc(q, siga_write);
 
 	cc = qdio_siga_output(q, &busy_bit);
 	switch (cc) {
@@ -710,7 +715,7 @@ static int qdio_kick_outbound_q(struct qdio_q *q)
 
 static void __qdio_outbound_processing(struct qdio_q *q)
 {
-	qdio_perf_stat_inc(&perf_stats.tasklet_outbound);
+	qperf_inc(q, tasklet_outbound);
 	BUG_ON(atomic_read(&q->nr_buf_used) < 0);
 
 	if (qdio_outbound_q_moved(q))
@@ -738,12 +743,9 @@ static void __qdio_outbound_processing(struct qdio_q *q)
 	 */
 	if (qdio_outbound_q_done(q))
 		del_timer(&q->u.out.timer);
-	else {
-		if (!timer_pending(&q->u.out.timer)) {
+	else
+		if (!timer_pending(&q->u.out.timer))
 			mod_timer(&q->u.out.timer, jiffies + 10 * HZ);
-			qdio_perf_stat_inc(&perf_stats.debug_tl_out_timer);
-		}
-	}
 	return;
 
 sched:
@@ -783,7 +785,7 @@ static inline void qdio_check_outbound_after_thinint(struct qdio_q *q)
 
 static void __tiqdio_inbound_processing(struct qdio_q *q)
 {
-	qdio_perf_stat_inc(&perf_stats.thinint_inbound);
+	qperf_inc(q, tasklet_inbound);
 	qdio_sync_after_thinint(q);
 
 	/*
@@ -798,7 +800,7 @@ static void __tiqdio_inbound_processing(struct qdio_q *q)
 	qdio_kick_handler(q);
 
 	if (!qdio_inbound_q_done(q)) {
-		qdio_perf_stat_inc(&perf_stats.thinint_inbound_loop);
+		qperf_inc(q, tasklet_inbound_resched);
 		if (likely(q->irq_ptr->state != QDIO_IRQ_STATE_STOPPED)) {
 			tasklet_schedule(&q->tasklet);
 			return;
@@ -811,7 +813,7 @@ static void __tiqdio_inbound_processing(struct qdio_q *q)
 	 * resetting the ACK state.
 	 */
 	if (!qdio_inbound_q_done(q)) {
-		qdio_perf_stat_inc(&perf_stats.thinint_inbound_loop2);
+		qperf_inc(q, tasklet_inbound_resched2);
 		if (likely(q->irq_ptr->state != QDIO_IRQ_STATE_STOPPED))
 			tasklet_schedule(&q->tasklet);
 	}
@@ -850,8 +852,6 @@ static void qdio_int_handler_pci(struct qdio_irq *irq_ptr)
 	if (unlikely(irq_ptr->state == QDIO_IRQ_STATE_STOPPED))
 		return;
 
-	qdio_perf_stat_inc(&perf_stats.pci_int);
-
 	for_each_input_queue(irq_ptr, q, i)
 		tasklet_schedule(&q->tasklet);
 
@@ -922,8 +922,6 @@ void qdio_int_handler(struct ccw_device *cdev, unsigned long intparm,
 	struct qdio_irq *irq_ptr = cdev->private->qdio_data;
 	int cstat, dstat;
 
-	qdio_perf_stat_inc(&perf_stats.qdio_int);
-
 	if (!intparm || !irq_ptr) {
 		DBF_ERROR("qint:%4x", cdev->private->schid.sch_no);
 		return;
@@ -1382,6 +1380,8 @@ static int handle_inbound(struct qdio_q *q, unsigned int callflags,
 {
 	int used, diff;
 
+	qperf_inc(q, inbound_call);
+
 	if (!q->u.in.polling)
 		goto set;
 
@@ -1437,14 +1437,16 @@ static int handle_outbound(struct qdio_q *q, unsigned int callflags,
 	unsigned char state;
 	int used, rc = 0;
 
-	qdio_perf_stat_inc(&perf_stats.outbound_handler);
+	qperf_inc(q, outbound_call);
 
 	count = set_buf_states(q, bufnr, SLSB_CU_OUTPUT_PRIMED, count);
 	used = atomic_add_return(count, &q->nr_buf_used);
 	BUG_ON(used > QDIO_MAX_BUFFERS_PER_Q);
 
-	if (callflags & QDIO_FLAG_PCI_OUT)
+	if (callflags & QDIO_FLAG_PCI_OUT) {
 		q->u.out.pci_out_enabled = 1;
+		qperf_inc(q, pci_request_int);
+	}
 	else
 		q->u.out.pci_out_enabled = 0;
 
@@ -1483,7 +1485,7 @@ static int handle_outbound(struct qdio_q *q, unsigned int callflags,
 	if (state != SLSB_CU_OUTPUT_PRIMED)
 		rc = qdio_kick_outbound_q(q);
 	else
-		qdio_perf_stat_inc(&perf_stats.fast_requeue);
+		qperf_inc(q, fast_requeue);
 
 out:
 	tasklet_schedule(&q->tasklet);
@@ -1539,16 +1541,11 @@ static int __init init_QDIO(void)
 	rc = qdio_debug_init();
 	if (rc)
 		goto out_ti;
-	rc = qdio_setup_perf_stats();
-	if (rc)
-		goto out_debug;
 	rc = tiqdio_register_thinints();
 	if (rc)
-		goto out_perf;
+		goto out_debug;
 	return 0;
 
-out_perf:
-	qdio_remove_perf_stats();
 out_debug:
 	qdio_debug_exit();
 out_ti:
@@ -1562,7 +1559,6 @@ static void __exit exit_QDIO(void)
 {
 	tiqdio_unregister_thinints();
 	tiqdio_free_memory();
-	qdio_remove_perf_stats();
 	qdio_debug_exit();
 	qdio_setup_exit();
 }
diff --git a/drivers/s390/cio/qdio_perf.c b/drivers/s390/cio/qdio_perf.c
deleted file mode 100644
index 968e3c7c2632..000000000000
--- a/drivers/s390/cio/qdio_perf.c
+++ /dev/null
@@ -1,147 +0,0 @@
-/*
- *  drivers/s390/cio/qdio_perf.c
- *
- *  Copyright IBM Corp. 2008
- *
- *  Author: Jan Glauber (jang@linux.vnet.ibm.com)
- */
-#include <linux/kernel.h>
-#include <linux/proc_fs.h>
-#include <linux/seq_file.h>
-#include <asm/ccwdev.h>
-
-#include "cio.h"
-#include "css.h"
-#include "device.h"
-#include "ioasm.h"
-#include "chsc.h"
-#include "qdio_debug.h"
-#include "qdio_perf.h"
-
-int qdio_performance_stats;
-struct qdio_perf_stats perf_stats;
-
-#ifdef CONFIG_PROC_FS
-static struct proc_dir_entry *qdio_perf_pde;
-#endif
-
-/*
- * procfs functions
- */
-static int qdio_perf_proc_show(struct seq_file *m, void *v)
-{
-	seq_printf(m, "Number of qdio interrupts\t\t\t: %li\n",
-		   (long)atomic_long_read(&perf_stats.qdio_int));
-	seq_printf(m, "Number of PCI interrupts\t\t\t: %li\n",
-		   (long)atomic_long_read(&perf_stats.pci_int));
-	seq_printf(m, "Number of adapter interrupts\t\t\t: %li\n",
-		   (long)atomic_long_read(&perf_stats.thin_int));
-	seq_printf(m, "\n");
-	seq_printf(m, "Inbound tasklet runs\t\t\t\t: %li\n",
-		   (long)atomic_long_read(&perf_stats.tasklet_inbound));
-	seq_printf(m, "Outbound tasklet runs\t\t\t\t: %li\n",
-		   (long)atomic_long_read(&perf_stats.tasklet_outbound));
-	seq_printf(m, "Adapter interrupt tasklet runs/loops\t\t: %li/%li\n",
-		   (long)atomic_long_read(&perf_stats.tasklet_thinint),
-		   (long)atomic_long_read(&perf_stats.tasklet_thinint_loop));
-	seq_printf(m, "Adapter interrupt inbound tasklet runs/loops\t: %li/%li\n",
-		   (long)atomic_long_read(&perf_stats.thinint_inbound),
-		   (long)atomic_long_read(&perf_stats.thinint_inbound_loop));
-	seq_printf(m, "\n");
-	seq_printf(m, "Number of SIGA In issued\t\t\t: %li\n",
-		   (long)atomic_long_read(&perf_stats.siga_in));
-	seq_printf(m, "Number of SIGA Out issued\t\t\t: %li\n",
-		   (long)atomic_long_read(&perf_stats.siga_out));
-	seq_printf(m, "Number of SIGA Sync issued\t\t\t: %li\n",
-		   (long)atomic_long_read(&perf_stats.siga_sync));
-	seq_printf(m, "\n");
-	seq_printf(m, "Number of inbound transfers\t\t\t: %li\n",
-		   (long)atomic_long_read(&perf_stats.inbound_handler));
-	seq_printf(m, "Number of outbound transfers\t\t\t: %li\n",
-		   (long)atomic_long_read(&perf_stats.outbound_handler));
-	seq_printf(m, "\n");
-	seq_printf(m, "Number of fast requeues (outg. SBAL w/o SIGA)\t: %li\n",
-		   (long)atomic_long_read(&perf_stats.fast_requeue));
-	seq_printf(m, "Number of outbound target full condition\t: %li\n",
-		   (long)atomic_long_read(&perf_stats.outbound_target_full));
-	seq_printf(m, "Number of outbound tasklet mod_timer calls\t: %li\n",
-		   (long)atomic_long_read(&perf_stats.debug_tl_out_timer));
-	seq_printf(m, "Number of stop polling calls\t\t\t: %li\n",
-		   (long)atomic_long_read(&perf_stats.debug_stop_polling));
-	seq_printf(m, "AI inbound tasklet loops after stop polling\t: %li\n",
-		   (long)atomic_long_read(&perf_stats.thinint_inbound_loop2));
-	seq_printf(m, "QEBSM EQBS total/incomplete\t\t\t: %li/%li\n",
-		   (long)atomic_long_read(&perf_stats.debug_eqbs_all),
-		   (long)atomic_long_read(&perf_stats.debug_eqbs_incomplete));
-	seq_printf(m, "QEBSM SQBS total/incomplete\t\t\t: %li/%li\n",
-		   (long)atomic_long_read(&perf_stats.debug_sqbs_all),
-		   (long)atomic_long_read(&perf_stats.debug_sqbs_incomplete));
-	seq_printf(m, "\n");
-	return 0;
-}
-static int qdio_perf_seq_open(struct inode *inode, struct file *filp)
-{
-	return single_open(filp, qdio_perf_proc_show, NULL);
-}
-
-static const struct file_operations qdio_perf_proc_fops = {
-	.owner	 = THIS_MODULE,
-	.open	 = qdio_perf_seq_open,
-	.read	 = seq_read,
-	.llseek  = seq_lseek,
-	.release = single_release,
-};
-
-/*
- * sysfs functions
- */
-static ssize_t qdio_perf_stats_show(struct bus_type *bus, char *buf)
-{
-	return sprintf(buf, "%i\n", qdio_performance_stats ? 1 : 0);
-}
-
-static ssize_t qdio_perf_stats_store(struct bus_type *bus,
-			      const char *buf, size_t count)
-{
-	unsigned long i;
-
-	if (strict_strtoul(buf, 16, &i) != 0)
-		return -EINVAL;
-	if ((i != 0) && (i != 1))
-		return -EINVAL;
-	if (i == qdio_performance_stats)
-		return count;
-
-	qdio_performance_stats = i;
-	/* reset performance statistics */
-	if (i == 0)
-		memset(&perf_stats, 0, sizeof(struct qdio_perf_stats));
-	return count;
-}
-
-static BUS_ATTR(qdio_performance_stats, 0644, qdio_perf_stats_show,
-		qdio_perf_stats_store);
-
-int __init qdio_setup_perf_stats(void)
-{
-	int rc;
-
-	rc = bus_create_file(&ccw_bus_type, &bus_attr_qdio_performance_stats);
-	if (rc)
-		return rc;
-
-#ifdef CONFIG_PROC_FS
-	memset(&perf_stats, 0, sizeof(struct qdio_perf_stats));
-	qdio_perf_pde = proc_create("qdio_perf", S_IFREG | S_IRUGO,
-				    NULL, &qdio_perf_proc_fops);
-#endif
-	return 0;
-}
-
-void qdio_remove_perf_stats(void)
-{
-#ifdef CONFIG_PROC_FS
-	remove_proc_entry("qdio_perf", NULL);
-#endif
-	bus_remove_file(&ccw_bus_type, &bus_attr_qdio_performance_stats);
-}
diff --git a/drivers/s390/cio/qdio_perf.h b/drivers/s390/cio/qdio_perf.h
deleted file mode 100644
index ff4504ce1e3c..000000000000
--- a/drivers/s390/cio/qdio_perf.h
+++ /dev/null
@@ -1,61 +0,0 @@
-/*
- *  drivers/s390/cio/qdio_perf.h
- *
- *  Copyright IBM Corp. 2008
- *
- *  Author: Jan Glauber (jang@linux.vnet.ibm.com)
- */
-#ifndef QDIO_PERF_H
-#define QDIO_PERF_H
-
-#include <linux/types.h>
-#include <asm/atomic.h>
-
-struct qdio_perf_stats {
-	/* interrupt handler calls */
-	atomic_long_t qdio_int;
-	atomic_long_t pci_int;
-	atomic_long_t thin_int;
-
-	/* tasklet runs */
-	atomic_long_t tasklet_inbound;
-	atomic_long_t tasklet_outbound;
-	atomic_long_t tasklet_thinint;
-	atomic_long_t tasklet_thinint_loop;
-	atomic_long_t thinint_inbound;
-	atomic_long_t thinint_inbound_loop;
-	atomic_long_t thinint_inbound_loop2;
-
-	/* signal adapter calls */
-	atomic_long_t siga_out;
-	atomic_long_t siga_in;
-	atomic_long_t siga_sync;
-
-	/* misc */
-	atomic_long_t inbound_handler;
-	atomic_long_t outbound_handler;
-	atomic_long_t fast_requeue;
-	atomic_long_t outbound_target_full;
-
-	/* for debugging */
-	atomic_long_t debug_tl_out_timer;
-	atomic_long_t debug_stop_polling;
-	atomic_long_t debug_eqbs_all;
-	atomic_long_t debug_eqbs_incomplete;
-	atomic_long_t debug_sqbs_all;
-	atomic_long_t debug_sqbs_incomplete;
-};
-
-extern struct qdio_perf_stats perf_stats;
-extern int qdio_performance_stats;
-
-static inline void qdio_perf_stat_inc(atomic_long_t *count)
-{
-	if (qdio_performance_stats)
-		atomic_long_inc(count);
-}
-
-int qdio_setup_perf_stats(void);
-void qdio_remove_perf_stats(void);
-
-#endif
diff --git a/drivers/s390/cio/qdio_setup.c b/drivers/s390/cio/qdio_setup.c
index 18d54fc21ce9..8c2dea5fa2b4 100644
--- a/drivers/s390/cio/qdio_setup.c
+++ b/drivers/s390/cio/qdio_setup.c
@@ -48,7 +48,6 @@ static void set_impl_params(struct qdio_irq *irq_ptr,
 	if (!irq_ptr)
 		return;
 
-	WARN_ON((unsigned long)&irq_ptr->qib & 0xff);
 	irq_ptr->qib.pfmt = qib_param_field_format;
 	if (qib_param_field)
 		memcpy(irq_ptr->qib.parm, qib_param_field,
@@ -82,14 +81,12 @@ static int __qdio_allocate_qs(struct qdio_q **irq_ptr_qs, int nr_queues)
 		q = kmem_cache_alloc(qdio_q_cache, GFP_KERNEL);
 		if (!q)
 			return -ENOMEM;
-		WARN_ON((unsigned long)q & 0xff);
 
 		q->slib = (struct slib *) __get_free_page(GFP_KERNEL);
 		if (!q->slib) {
 			kmem_cache_free(qdio_q_cache, q);
 			return -ENOMEM;
 		}
-		WARN_ON((unsigned long)q->slib & 0x7ff);
 		irq_ptr_qs[i] = q;
 	}
 	return 0;
@@ -131,7 +128,7 @@ static void setup_storage_lists(struct qdio_q *q, struct qdio_irq *irq_ptr,
 	/* fill in sbal */
 	for (j = 0; j < QDIO_MAX_BUFFERS_PER_Q; j++) {
 		q->sbal[j] = *sbals_array++;
-		WARN_ON((unsigned long)q->sbal[j] & 0xff);
+		BUG_ON((unsigned long)q->sbal[j] & 0xff);
 	}
 
 	/* fill in slib */
@@ -147,11 +144,6 @@ static void setup_storage_lists(struct qdio_q *q, struct qdio_irq *irq_ptr,
 	/* fill in sl */
 	for (j = 0; j < QDIO_MAX_BUFFERS_PER_Q; j++)
 		q->sl->element[j].sbal = (unsigned long)q->sbal[j];
-
-	DBF_EVENT("sl-slsb-sbal");
-	DBF_HEX(q->sl, sizeof(void *));
-	DBF_HEX(&q->slsb, sizeof(void *));
-	DBF_HEX(q->sbal, sizeof(void *));
 }
 
 static void setup_queues(struct qdio_irq *irq_ptr,
diff --git a/drivers/s390/cio/qdio_thinint.c b/drivers/s390/cio/qdio_thinint.c
index 981a77ea7ee2..091d904d3182 100644
--- a/drivers/s390/cio/qdio_thinint.c
+++ b/drivers/s390/cio/qdio_thinint.c
@@ -1,9 +1,7 @@
 /*
  * linux/drivers/s390/cio/thinint_qdio.c
  *
- * thin interrupt support for qdio
- *
- * Copyright 2000-2008 IBM Corp.
+ * Copyright 2000,2009 IBM Corp.
  * Author(s): Utz Bacher <utz.bacher@de.ibm.com>
  *	      Cornelia Huck <cornelia.huck@de.ibm.com>
  *	      Jan Glauber <jang@linux.vnet.ibm.com>
@@ -19,7 +17,6 @@
 #include "ioasm.h"
 #include "qdio.h"
 #include "qdio_debug.h"
-#include "qdio_perf.h"
 
 /*
  * Restriction: only 63 iqdio subchannels would have its own indicator,
@@ -132,8 +129,6 @@ static void tiqdio_thinint_handler(void *ind, void *drv_data)
 {
 	struct qdio_q *q;
 
-	qdio_perf_stat_inc(&perf_stats.thin_int);
-
 	/*
 	 * SVS only when needed: issue SVS to benefit from iqdio interrupt
 	 * avoidance (SVS clears adapter interrupt suppression overwrite)
@@ -154,6 +149,7 @@ static void tiqdio_thinint_handler(void *ind, void *drv_data)
 	list_for_each_entry_rcu(q, &tiq_list, entry)
 		/* only process queues from changed sets */
 		if (*q->irq_ptr->dsci) {
+			qperf_inc(q, adapter_int);
 
 			/* only clear it if the indicator is non-shared */
 			if (!shared_ind(q->irq_ptr))
diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
index 1294876bf7b4..20836eff88c5 100644
--- a/drivers/s390/crypto/ap_bus.c
+++ b/drivers/s390/crypto/ap_bus.c
@@ -102,6 +102,7 @@ static atomic_t ap_poll_requests = ATOMIC_INIT(0);
 static DECLARE_WAIT_QUEUE_HEAD(ap_poll_wait);
 static struct task_struct *ap_poll_kthread = NULL;
 static DEFINE_MUTEX(ap_poll_thread_mutex);
+static DEFINE_SPINLOCK(ap_poll_timer_lock);
 static void *ap_interrupt_indicator;
 static struct hrtimer ap_poll_timer;
 /* In LPAR poll with 4kHz frequency. Poll every 250000 nanoseconds.
@@ -282,6 +283,7 @@ static int ap_queue_enable_interruption(ap_qid_t qid, void *ind)
  * @psmid: The program supplied message identifier
  * @msg: The message text
  * @length: The message length
+ * @special: Special Bit
  *
  * Returns AP queue status structure.
  * Condition code 1 on NQAP can't happen because the L bit is 1.
@@ -289,7 +291,8 @@ static int ap_queue_enable_interruption(ap_qid_t qid, void *ind)
  * because a segment boundary was reached. The NQAP is repeated.
  */
 static inline struct ap_queue_status
-__ap_send(ap_qid_t qid, unsigned long long psmid, void *msg, size_t length)
+__ap_send(ap_qid_t qid, unsigned long long psmid, void *msg, size_t length,
+	  unsigned int special)
 {
 	typedef struct { char _[length]; } msgblock;
 	register unsigned long reg0 asm ("0") = qid | 0x40000000UL;
@@ -299,6 +302,9 @@ __ap_send(ap_qid_t qid, unsigned long long psmid, void *msg, size_t length)
 	register unsigned long reg4 asm ("4") = (unsigned int) (psmid >> 32);
 	register unsigned long reg5 asm ("5") = (unsigned int) psmid;
 
+	if (special == 1)
+		reg0 |= 0x400000UL;
+
 	asm volatile (
 		"0: .long 0xb2ad0042\n"		/* DQAP */
 		"   brc   2,0b"
@@ -312,13 +318,15 @@ int ap_send(ap_qid_t qid, unsigned long long psmid, void *msg, size_t length)
 {
 	struct ap_queue_status status;
 
-	status = __ap_send(qid, psmid, msg, length);
+	status = __ap_send(qid, psmid, msg, length, 0);
 	switch (status.response_code) {
 	case AP_RESPONSE_NORMAL:
 		return 0;
 	case AP_RESPONSE_Q_FULL:
 	case AP_RESPONSE_RESET_IN_PROGRESS:
 		return -EBUSY;
+	case AP_RESPONSE_REQ_FAC_NOT_INST:
+		return -EINVAL;
 	default:	/* Device is gone. */
 		return -ENODEV;
 	}
@@ -1008,7 +1016,7 @@ static int ap_probe_device_type(struct ap_device *ap_dev)
 	}
 
 	status = __ap_send(ap_dev->qid, 0x0102030405060708ULL,
-			   msg, sizeof(msg));
+			   msg, sizeof(msg), 0);
 	if (status.response_code != AP_RESPONSE_NORMAL) {
 		rc = -ENODEV;
 		goto out_free;
@@ -1163,16 +1171,19 @@ ap_config_timeout(unsigned long ptr)
 static inline void ap_schedule_poll_timer(void)
 {
 	ktime_t hr_time;
+
+	spin_lock_bh(&ap_poll_timer_lock);
 	if (ap_using_interrupts() || ap_suspend_flag)
-		return;
+		goto out;
 	if (hrtimer_is_queued(&ap_poll_timer))
-		return;
+		goto out;
 	if (ktime_to_ns(hrtimer_expires_remaining(&ap_poll_timer)) <= 0) {
 		hr_time = ktime_set(0, poll_timeout);
 		hrtimer_forward_now(&ap_poll_timer, hr_time);
 		hrtimer_restart(&ap_poll_timer);
 	}
-	return;
+out:
+	spin_unlock_bh(&ap_poll_timer_lock);
 }
 
 /**
@@ -1243,7 +1254,7 @@ static int ap_poll_write(struct ap_device *ap_dev, unsigned long *flags)
 	/* Start the next request on the queue. */
 	ap_msg = list_entry(ap_dev->requestq.next, struct ap_message, list);
 	status = __ap_send(ap_dev->qid, ap_msg->psmid,
-			   ap_msg->message, ap_msg->length);
+			   ap_msg->message, ap_msg->length, ap_msg->special);
 	switch (status.response_code) {
 	case AP_RESPONSE_NORMAL:
 		atomic_inc(&ap_poll_requests);
@@ -1261,6 +1272,7 @@ static int ap_poll_write(struct ap_device *ap_dev, unsigned long *flags)
 		*flags |= 2;
 		break;
 	case AP_RESPONSE_MESSAGE_TOO_BIG:
+	case AP_RESPONSE_REQ_FAC_NOT_INST:
 		return -EINVAL;
 	default:
 		return -ENODEV;
@@ -1302,7 +1314,8 @@ static int __ap_queue_message(struct ap_device *ap_dev, struct ap_message *ap_ms
 	if (list_empty(&ap_dev->requestq) &&
 	    ap_dev->queue_count < ap_dev->queue_depth) {
 		status = __ap_send(ap_dev->qid, ap_msg->psmid,
-				   ap_msg->message, ap_msg->length);
+				   ap_msg->message, ap_msg->length,
+				   ap_msg->special);
 		switch (status.response_code) {
 		case AP_RESPONSE_NORMAL:
 			list_add_tail(&ap_msg->list, &ap_dev->pendingq);
@@ -1317,6 +1330,7 @@ static int __ap_queue_message(struct ap_device *ap_dev, struct ap_message *ap_ms
 			ap_dev->requestq_count++;
 			ap_dev->total_request_count++;
 			return -EBUSY;
+		case AP_RESPONSE_REQ_FAC_NOT_INST:
 		case AP_RESPONSE_MESSAGE_TOO_BIG:
 			ap_dev->drv->receive(ap_dev, ap_msg, ERR_PTR(-EINVAL));
 			return -EINVAL;
@@ -1658,6 +1672,7 @@ int __init ap_module_init(void)
 	 */
 	if (MACHINE_IS_VM)
 		poll_timeout = 1500000;
+	spin_lock_init(&ap_poll_timer_lock);
 	hrtimer_init(&ap_poll_timer, CLOCK_MONOTONIC, HRTIMER_MODE_ABS);
 	ap_poll_timer.function = ap_poll_timeout;
 
diff --git a/drivers/s390/crypto/ap_bus.h b/drivers/s390/crypto/ap_bus.h
index a35362241805..4785d07cd447 100644
--- a/drivers/s390/crypto/ap_bus.h
+++ b/drivers/s390/crypto/ap_bus.h
@@ -87,6 +87,7 @@ struct ap_queue_status {
 #define AP_RESPONSE_INDEX_TOO_BIG	0x11
 #define AP_RESPONSE_NO_FIRST_PART	0x13
 #define AP_RESPONSE_MESSAGE_TOO_BIG	0x15
+#define AP_RESPONSE_REQ_FAC_NOT_INST	0x16
 
 /*
  * Known device types
@@ -96,8 +97,8 @@ struct ap_queue_status {
 #define AP_DEVICE_TYPE_PCIXCC	5
 #define AP_DEVICE_TYPE_CEX2A	6
 #define AP_DEVICE_TYPE_CEX2C	7
-#define AP_DEVICE_TYPE_CEX2A2	8
-#define AP_DEVICE_TYPE_CEX2C2	9
+#define AP_DEVICE_TYPE_CEX3A	8
+#define AP_DEVICE_TYPE_CEX3C	9
 
 /*
  * AP reset flag states
@@ -161,12 +162,25 @@ struct ap_message {
 	size_t length;			/* Message length. */
 
 	void *private;			/* ap driver private pointer. */
+	unsigned int special:1;		/* Used for special commands. */
 };
 
 #define AP_DEVICE(dt)					\
 	.dev_type=(dt),					\
 	.match_flags=AP_DEVICE_ID_MATCH_DEVICE_TYPE,
 
+/**
+ * ap_init_message() - Initialize ap_message.
+ * Initialize a message before using. Otherwise this might result in
+ * unexpected behaviour.
+ */
+static inline void ap_init_message(struct ap_message *ap_msg)
+{
+	ap_msg->psmid = 0;
+	ap_msg->length = 0;
+	ap_msg->special = 0;
+}
+
 /*
  * Note: don't use ap_send/ap_recv after using ap_queue_message
  * for the first time. Otherwise the ap message queue will get
diff --git a/drivers/s390/crypto/zcrypt_api.c b/drivers/s390/crypto/zcrypt_api.c
index 65b6a96afe6b..c68be24e27d9 100644
--- a/drivers/s390/crypto/zcrypt_api.c
+++ b/drivers/s390/crypto/zcrypt_api.c
@@ -299,9 +299,7 @@ static ssize_t zcrypt_write(struct file *filp, const char __user *buf,
  */
 static int zcrypt_open(struct inode *inode, struct file *filp)
 {
-	lock_kernel();
 	atomic_inc(&zcrypt_open_count);
-	unlock_kernel();
 	return 0;
 }
 
@@ -395,10 +393,12 @@ static long zcrypt_rsa_crt(struct ica_rsa_modexpo_crt *crt)
 			 * u_mult_inv > 128 bytes.
 			 */
 			if (copied == 0) {
-				int len;
+				unsigned int len;
 				spin_unlock_bh(&zcrypt_device_lock);
 				/* len is max 256 / 2 - 120 = 8 */
 				len = crt->inputdatalength / 2 - 120;
+				if (len > sizeof(z1))
+					return -EFAULT;
 				z1 = z2 = z3 = 0;
 				if (copy_from_user(&z1, crt->np_prime, len) ||
 				    copy_from_user(&z2, crt->bp_key, len) ||
@@ -1009,6 +1009,10 @@ static int zcrypt_status_read(char *resp_buff, char **start, off_t offset,
 		       zcrypt_count_type(ZCRYPT_CEX2C));
 	len += sprintf(resp_buff + len, "CEX2A count: %d\n",
 		       zcrypt_count_type(ZCRYPT_CEX2A));
+	len += sprintf(resp_buff + len, "CEX3C count: %d\n",
+		       zcrypt_count_type(ZCRYPT_CEX3C));
+	len += sprintf(resp_buff + len, "CEX3A count: %d\n",
+		       zcrypt_count_type(ZCRYPT_CEX3A));
 	len += sprintf(resp_buff + len, "requestq count: %d\n",
 		       zcrypt_requestq_count());
 	len += sprintf(resp_buff + len, "pendingq count: %d\n",
@@ -1017,7 +1021,7 @@ static int zcrypt_status_read(char *resp_buff, char **start, off_t offset,
 		       atomic_read(&zcrypt_open_count));
 	zcrypt_status_mask(workarea);
 	len += sprinthx("Online devices: 1=PCICA 2=PCICC 3=PCIXCC(MCL2) "
-			"4=PCIXCC(MCL3) 5=CEX2C 6=CEX2A",
+			"4=PCIXCC(MCL3) 5=CEX2C 6=CEX2A 7=CEX3C 8=CEX3A",
 			resp_buff+len, workarea, AP_DEVICES);
 	zcrypt_qdepth_mask(workarea);
 	len += sprinthx("Waiting work element counts",
@@ -1095,8 +1099,9 @@ static int zcrypt_status_write(struct file *file, const char __user *buffer,
 		 * '0' for no device, '1' for PCICA, '2' for PCICC,
 		 * '3' for PCIXCC_MCL2, '4' for PCIXCC_MCL3,
 		 * '5' for CEX2C and '6' for CEX2A'
+		 * '7' for CEX3C and '8' for CEX3A
 		 */
-		if (*ptr >= '0' && *ptr <= '6')
+		if (*ptr >= '0' && *ptr <= '8')
 			j++;
 		else if (*ptr == 'd' || *ptr == 'D')
 			zcrypt_disable_card(j++);
diff --git a/drivers/s390/crypto/zcrypt_api.h b/drivers/s390/crypto/zcrypt_api.h
index 1d1ec74dadb2..8e7ffbf2466c 100644
--- a/drivers/s390/crypto/zcrypt_api.h
+++ b/drivers/s390/crypto/zcrypt_api.h
@@ -71,6 +71,8 @@ struct ica_z90_status {
 #define ZCRYPT_PCIXCC_MCL3	4
 #define ZCRYPT_CEX2C		5
 #define ZCRYPT_CEX2A		6
+#define ZCRYPT_CEX3C		7
+#define ZCRYPT_CEX3A		8
 
 /**
  * Large random numbers are pulled in 4096 byte chunks from the crypto cards
diff --git a/drivers/s390/crypto/zcrypt_cex2a.c b/drivers/s390/crypto/zcrypt_cex2a.c
index 326ea08f67c9..c6fb0aa89507 100644
--- a/drivers/s390/crypto/zcrypt_cex2a.c
+++ b/drivers/s390/crypto/zcrypt_cex2a.c
@@ -39,17 +39,24 @@
 
 #define CEX2A_MIN_MOD_SIZE	  1	/*    8 bits	*/
 #define CEX2A_MAX_MOD_SIZE	256	/* 2048 bits	*/
+#define CEX3A_MIN_MOD_SIZE	CEX2A_MIN_MOD_SIZE
+#define CEX3A_MAX_MOD_SIZE	CEX2A_MAX_MOD_SIZE
 
 #define CEX2A_SPEED_RATING	970
+#define CEX3A_SPEED_RATING	900 /* Fixme: Needs finetuning */
 
 #define CEX2A_MAX_MESSAGE_SIZE	0x390	/* sizeof(struct type50_crb2_msg)    */
 #define CEX2A_MAX_RESPONSE_SIZE 0x110	/* max outputdatalength + type80_hdr */
 
+#define CEX3A_MAX_MESSAGE_SIZE	CEX2A_MAX_MESSAGE_SIZE
+#define CEX3A_MAX_RESPONSE_SIZE	CEX2A_MAX_RESPONSE_SIZE
+
 #define CEX2A_CLEANUP_TIME	(15*HZ)
+#define CEX3A_CLEANUP_TIME	CEX2A_CLEANUP_TIME
 
 static struct ap_device_id zcrypt_cex2a_ids[] = {
 	{ AP_DEVICE(AP_DEVICE_TYPE_CEX2A) },
-	{ AP_DEVICE(AP_DEVICE_TYPE_CEX2A2) },
+	{ AP_DEVICE(AP_DEVICE_TYPE_CEX3A) },
 	{ /* end of list */ },
 };
 
@@ -298,6 +305,7 @@ static long zcrypt_cex2a_modexpo(struct zcrypt_device *zdev,
 	struct completion work;
 	int rc;
 
+	ap_init_message(&ap_msg);
 	ap_msg.message = kmalloc(CEX2A_MAX_MESSAGE_SIZE, GFP_KERNEL);
 	if (!ap_msg.message)
 		return -ENOMEM;
@@ -335,6 +343,7 @@ static long zcrypt_cex2a_modexpo_crt(struct zcrypt_device *zdev,
 	struct completion work;
 	int rc;
 
+	ap_init_message(&ap_msg);
 	ap_msg.message = kmalloc(CEX2A_MAX_MESSAGE_SIZE, GFP_KERNEL);
 	if (!ap_msg.message)
 		return -ENOMEM;
@@ -373,31 +382,45 @@ static struct zcrypt_ops zcrypt_cex2a_ops = {
  */
 static int zcrypt_cex2a_probe(struct ap_device *ap_dev)
 {
-	struct zcrypt_device *zdev;
-	int rc;
-
-	zdev = zcrypt_device_alloc(CEX2A_MAX_RESPONSE_SIZE);
-	if (!zdev)
-		return -ENOMEM;
-	zdev->ap_dev = ap_dev;
-	zdev->ops = &zcrypt_cex2a_ops;
-	zdev->online = 1;
-	zdev->user_space_type = ZCRYPT_CEX2A;
-	zdev->type_string = "CEX2A";
-	zdev->min_mod_size = CEX2A_MIN_MOD_SIZE;
-	zdev->max_mod_size = CEX2A_MAX_MOD_SIZE;
-	zdev->short_crt = 1;
-	zdev->speed_rating = CEX2A_SPEED_RATING;
-	ap_dev->reply = &zdev->reply;
-	ap_dev->private = zdev;
-	rc = zcrypt_device_register(zdev);
-	if (rc)
-		goto out_free;
-	return 0;
-
-out_free:
-	ap_dev->private = NULL;
-	zcrypt_device_free(zdev);
+	struct zcrypt_device *zdev = NULL;
+	int rc = 0;
+
+	switch (ap_dev->device_type) {
+	case AP_DEVICE_TYPE_CEX2A:
+		zdev = zcrypt_device_alloc(CEX2A_MAX_RESPONSE_SIZE);
+		if (!zdev)
+			return -ENOMEM;
+		zdev->user_space_type = ZCRYPT_CEX2A;
+		zdev->type_string = "CEX2A";
+		zdev->min_mod_size = CEX2A_MIN_MOD_SIZE;
+		zdev->max_mod_size = CEX2A_MAX_MOD_SIZE;
+		zdev->short_crt = 1;
+		zdev->speed_rating = CEX2A_SPEED_RATING;
+		break;
+	case AP_DEVICE_TYPE_CEX3A:
+		zdev = zcrypt_device_alloc(CEX3A_MAX_RESPONSE_SIZE);
+		if (!zdev)
+			return -ENOMEM;
+		zdev->user_space_type = ZCRYPT_CEX3A;
+		zdev->type_string = "CEX3A";
+		zdev->min_mod_size = CEX3A_MIN_MOD_SIZE;
+		zdev->max_mod_size = CEX3A_MAX_MOD_SIZE;
+		zdev->short_crt = 1;
+		zdev->speed_rating = CEX3A_SPEED_RATING;
+		break;
+	}
+	if (zdev != NULL) {
+		zdev->ap_dev = ap_dev;
+		zdev->ops = &zcrypt_cex2a_ops;
+		zdev->online = 1;
+		ap_dev->reply = &zdev->reply;
+		ap_dev->private = zdev;
+		rc = zcrypt_device_register(zdev);
+	}
+	if (rc) {
+		ap_dev->private = NULL;
+		zcrypt_device_free(zdev);
+	}
 	return rc;
 }
 
diff --git a/drivers/s390/crypto/zcrypt_pcica.c b/drivers/s390/crypto/zcrypt_pcica.c
index 17ba81b58c78..e78df3671caf 100644
--- a/drivers/s390/crypto/zcrypt_pcica.c
+++ b/drivers/s390/crypto/zcrypt_pcica.c
@@ -281,6 +281,7 @@ static long zcrypt_pcica_modexpo(struct zcrypt_device *zdev,
 	struct completion work;
 	int rc;
 
+	ap_init_message(&ap_msg);
 	ap_msg.message = kmalloc(PCICA_MAX_MESSAGE_SIZE, GFP_KERNEL);
 	if (!ap_msg.message)
 		return -ENOMEM;
@@ -318,6 +319,7 @@ static long zcrypt_pcica_modexpo_crt(struct zcrypt_device *zdev,
 	struct completion work;
 	int rc;
 
+	ap_init_message(&ap_msg);
 	ap_msg.message = kmalloc(PCICA_MAX_MESSAGE_SIZE, GFP_KERNEL);
 	if (!ap_msg.message)
 		return -ENOMEM;
diff --git a/drivers/s390/crypto/zcrypt_pcicc.c b/drivers/s390/crypto/zcrypt_pcicc.c
index f4b0c4795434..a23726a0735c 100644
--- a/drivers/s390/crypto/zcrypt_pcicc.c
+++ b/drivers/s390/crypto/zcrypt_pcicc.c
@@ -483,6 +483,7 @@ static long zcrypt_pcicc_modexpo(struct zcrypt_device *zdev,
 	struct completion work;
 	int rc;
 
+	ap_init_message(&ap_msg);
 	ap_msg.message = (void *) get_zeroed_page(GFP_KERNEL);
 	if (!ap_msg.message)
 		return -ENOMEM;
@@ -521,6 +522,7 @@ static long zcrypt_pcicc_modexpo_crt(struct zcrypt_device *zdev,
 	struct completion work;
 	int rc;
 
+	ap_init_message(&ap_msg);
 	ap_msg.message = (void *) get_zeroed_page(GFP_KERNEL);
 	if (!ap_msg.message)
 		return -ENOMEM;
diff --git a/drivers/s390/crypto/zcrypt_pcixcc.c b/drivers/s390/crypto/zcrypt_pcixcc.c
index 5677b40e4ac0..79c120578e61 100644
--- a/drivers/s390/crypto/zcrypt_pcixcc.c
+++ b/drivers/s390/crypto/zcrypt_pcixcc.c
@@ -43,10 +43,13 @@
 #define PCIXCC_MIN_MOD_SIZE	 16	/*  128 bits	*/
 #define PCIXCC_MIN_MOD_SIZE_OLD	 64	/*  512 bits	*/
 #define PCIXCC_MAX_MOD_SIZE	256	/* 2048 bits	*/
+#define CEX3C_MIN_MOD_SIZE	PCIXCC_MIN_MOD_SIZE
+#define CEX3C_MAX_MOD_SIZE	PCIXCC_MAX_MOD_SIZE
 
-#define PCIXCC_MCL2_SPEED_RATING	7870	/* FIXME: needs finetuning */
+#define PCIXCC_MCL2_SPEED_RATING	7870
 #define PCIXCC_MCL3_SPEED_RATING	7870
-#define CEX2C_SPEED_RATING		8540
+#define CEX2C_SPEED_RATING		7000
+#define CEX3C_SPEED_RATING		6500	/* FIXME: needs finetuning */
 
 #define PCIXCC_MAX_ICA_MESSAGE_SIZE 0x77c  /* max size type6 v2 crt message */
 #define PCIXCC_MAX_ICA_RESPONSE_SIZE 0x77c /* max size type86 v2 reply	    */
@@ -72,7 +75,7 @@ struct response_type {
 static struct ap_device_id zcrypt_pcixcc_ids[] = {
 	{ AP_DEVICE(AP_DEVICE_TYPE_PCIXCC) },
 	{ AP_DEVICE(AP_DEVICE_TYPE_CEX2C) },
-	{ AP_DEVICE(AP_DEVICE_TYPE_CEX2C2) },
+	{ AP_DEVICE(AP_DEVICE_TYPE_CEX3C) },
 	{ /* end of list */ },
 };
 
@@ -326,6 +329,11 @@ static int XCRB_msg_to_type6CPRB_msgX(struct zcrypt_device *zdev,
 	function_code = ((unsigned char *)&msg->cprbx) + msg->cprbx.cprb_len;
 	memcpy(msg->hdr.function_code, function_code, sizeof(msg->hdr.function_code));
 
+	if (memcmp(function_code, "US", 2) == 0)
+		ap_msg->special = 1;
+	else
+		ap_msg->special = 0;
+
 	/* copy data block */
 	if (xcRB->request_data_length &&
 	    copy_from_user(req_data, xcRB->request_data_address,
@@ -688,6 +696,7 @@ static long zcrypt_pcixcc_modexpo(struct zcrypt_device *zdev,
 	};
 	int rc;
 
+	ap_init_message(&ap_msg);
 	ap_msg.message = (void *) get_zeroed_page(GFP_KERNEL);
 	if (!ap_msg.message)
 		return -ENOMEM;
@@ -727,6 +736,7 @@ static long zcrypt_pcixcc_modexpo_crt(struct zcrypt_device *zdev,
 	};
 	int rc;
 
+	ap_init_message(&ap_msg);
 	ap_msg.message = (void *) get_zeroed_page(GFP_KERNEL);
 	if (!ap_msg.message)
 		return -ENOMEM;
@@ -766,6 +776,7 @@ static long zcrypt_pcixcc_send_cprb(struct zcrypt_device *zdev,
 	};
 	int rc;
 
+	ap_init_message(&ap_msg);
 	ap_msg.message = kmalloc(PCIXCC_MAX_XCRB_MESSAGE_SIZE, GFP_KERNEL);
 	if (!ap_msg.message)
 		return -ENOMEM;
@@ -805,6 +816,7 @@ static long zcrypt_pcixcc_rng(struct zcrypt_device *zdev,
 	};
 	int rc;
 
+	ap_init_message(&ap_msg);
 	ap_msg.message = kmalloc(PCIXCC_MAX_XCRB_MESSAGE_SIZE, GFP_KERNEL);
 	if (!ap_msg.message)
 		return -ENOMEM;
@@ -972,6 +984,7 @@ static int zcrypt_pcixcc_rng_supported(struct ap_device *ap_dev)
 	} __attribute__((packed)) *reply;
 	int rc, i;
 
+	ap_init_message(&ap_msg);
 	ap_msg.message = (void *) get_zeroed_page(GFP_KERNEL);
 	if (!ap_msg.message)
 		return -ENOMEM;
@@ -1016,14 +1029,15 @@ out_free:
 static int zcrypt_pcixcc_probe(struct ap_device *ap_dev)
 {
 	struct zcrypt_device *zdev;
-	int rc;
+	int rc = 0;
 
 	zdev = zcrypt_device_alloc(PCIXCC_MAX_RESPONSE_SIZE);
 	if (!zdev)
 		return -ENOMEM;
 	zdev->ap_dev = ap_dev;
 	zdev->online = 1;
-	if (ap_dev->device_type == AP_DEVICE_TYPE_PCIXCC) {
+	switch (ap_dev->device_type) {
+	case AP_DEVICE_TYPE_PCIXCC:
 		rc = zcrypt_pcixcc_mcl(ap_dev);
 		if (rc < 0) {
 			zcrypt_device_free(zdev);
@@ -1041,13 +1055,25 @@ static int zcrypt_pcixcc_probe(struct ap_device *ap_dev)
 			zdev->min_mod_size = PCIXCC_MIN_MOD_SIZE;
 			zdev->max_mod_size = PCIXCC_MAX_MOD_SIZE;
 		}
-	} else {
+		break;
+	case AP_DEVICE_TYPE_CEX2C:
 		zdev->user_space_type = ZCRYPT_CEX2C;
 		zdev->type_string = "CEX2C";
 		zdev->speed_rating = CEX2C_SPEED_RATING;
 		zdev->min_mod_size = PCIXCC_MIN_MOD_SIZE;
 		zdev->max_mod_size = PCIXCC_MAX_MOD_SIZE;
+		break;
+	case AP_DEVICE_TYPE_CEX3C:
+		zdev->user_space_type = ZCRYPT_CEX3C;
+		zdev->type_string = "CEX3C";
+		zdev->speed_rating = CEX3C_SPEED_RATING;
+		zdev->min_mod_size = CEX3C_MIN_MOD_SIZE;
+		zdev->max_mod_size = CEX3C_MAX_MOD_SIZE;
+		break;
+	default:
+		goto out_free;
 	}
+
 	rc = zcrypt_pcixcc_rng_supported(ap_dev);
 	if (rc < 0) {
 		zcrypt_device_free(zdev);
diff --git a/drivers/s390/net/claw.c b/drivers/s390/net/claw.c
index 3c77bfe0764c..147bb1a69aba 100644
--- a/drivers/s390/net/claw.c
+++ b/drivers/s390/net/claw.c
@@ -3398,7 +3398,7 @@ claw_init(void)
 		goto out_err;
 	}
 	CLAW_DBF_TEXT(2, setup, "init_mod");
-	claw_root_dev = root_device_register("qeth");
+	claw_root_dev = root_device_register("claw");
 	ret = IS_ERR(claw_root_dev) ? PTR_ERR(claw_root_dev) : 0;
 	if (ret)
 		goto register_err;
diff --git a/drivers/s390/net/netiucv.c b/drivers/s390/net/netiucv.c
index 395c04c2b00f..65ebee0a3266 100644
--- a/drivers/s390/net/netiucv.c
+++ b/drivers/s390/net/netiucv.c
@@ -113,11 +113,9 @@ static inline int iucv_dbf_passes(debug_info_t *dbf_grp, int level)
 #define IUCV_DBF_TEXT_(name, level, text...) \
 	do { \
 		if (iucv_dbf_passes(iucv_dbf_##name, level)) { \
-			char* iucv_dbf_txt_buf = \
-					get_cpu_var(iucv_dbf_txt_buf); \
-			sprintf(iucv_dbf_txt_buf, text); \
-			debug_text_event(iucv_dbf_##name, level, \
-						iucv_dbf_txt_buf); \
+			char* __buf = get_cpu_var(iucv_dbf_txt_buf); \
+			sprintf(__buf, text); \
+			debug_text_event(iucv_dbf_##name, level, __buf); \
 			put_cpu_var(iucv_dbf_txt_buf); \
 		} \
 	} while (0)
@@ -161,7 +159,7 @@ static void netiucv_pm_complete(struct device *);
 static int netiucv_pm_freeze(struct device *);
 static int netiucv_pm_restore_thaw(struct device *);
 
-static struct dev_pm_ops netiucv_pm_ops = {
+static const struct dev_pm_ops netiucv_pm_ops = {
 	.prepare = netiucv_pm_prepare,
 	.complete = netiucv_pm_complete,
 	.freeze = netiucv_pm_freeze,
diff --git a/drivers/s390/net/qeth_core_mpc.h b/drivers/s390/net/qeth_core_mpc.h
index 52c03438dbec..1ba51152f667 100644
--- a/drivers/s390/net/qeth_core_mpc.h
+++ b/drivers/s390/net/qeth_core_mpc.h
@@ -528,7 +528,7 @@ extern unsigned char ULP_ENABLE[];
 		(PDU_ENCAPSULATION(buffer) + 0x17)
 #define QETH_ULP_ENABLE_RESP_LINK_TYPE(buffer) \
 		(PDU_ENCAPSULATION(buffer) + 0x2b)
-/* Layer 2 defintions */
+/* Layer 2 definitions */
 #define QETH_PROT_LAYER2 0x08
 #define QETH_PROT_TCPIP  0x03
 #define QETH_PROT_OSN2   0x0a
diff --git a/drivers/s390/net/smsgiucv.c b/drivers/s390/net/smsgiucv.c
index 3012355f8304..67f2485d2372 100644
--- a/drivers/s390/net/smsgiucv.c
+++ b/drivers/s390/net/smsgiucv.c
@@ -168,7 +168,7 @@ static int smsg_pm_restore_thaw(struct device *dev)
 	return 0;
 }
 
-static struct dev_pm_ops smsg_pm_ops = {
+static const struct dev_pm_ops smsg_pm_ops = {
 	.freeze = smsg_pm_freeze,
 	.thaw = smsg_pm_restore_thaw,
 	.restore = smsg_pm_restore_thaw,
diff --git a/drivers/s390/scsi/zfcp_aux.c b/drivers/s390/scsi/zfcp_aux.c
index 2889e5f2dfd3..9d0c941b7d33 100644
--- a/drivers/s390/scsi/zfcp_aux.c
+++ b/drivers/s390/scsi/zfcp_aux.c
@@ -31,6 +31,7 @@
 #include <linux/miscdevice.h>
 #include <linux/seq_file.h>
 #include "zfcp_ext.h"
+#include "zfcp_fc.h"
 
 #define ZFCP_BUS_ID_SIZE	20
 
@@ -80,48 +81,40 @@ int zfcp_reqlist_isempty(struct zfcp_adapter *adapter)
 
 static void __init zfcp_init_device_configure(char *busid, u64 wwpn, u64 lun)
 {
-	struct ccw_device *ccwdev;
+	struct ccw_device *cdev;
 	struct zfcp_adapter *adapter;
 	struct zfcp_port *port;
 	struct zfcp_unit *unit;
 
-	ccwdev = get_ccwdev_by_busid(&zfcp_ccw_driver, busid);
-	if (!ccwdev)
+	cdev = get_ccwdev_by_busid(&zfcp_ccw_driver, busid);
+	if (!cdev)
 		return;
 
-	if (ccw_device_set_online(ccwdev))
-		goto out_ccwdev;
+	if (ccw_device_set_online(cdev))
+		goto out_ccw_device;
 
-	mutex_lock(&zfcp_data.config_mutex);
-	adapter = dev_get_drvdata(&ccwdev->dev);
+	adapter = zfcp_ccw_adapter_by_cdev(cdev);
 	if (!adapter)
-		goto out_unlock;
-	zfcp_adapter_get(adapter);
+		goto out_ccw_device;
 
 	port = zfcp_get_port_by_wwpn(adapter, wwpn);
 	if (!port)
 		goto out_port;
 
-	zfcp_port_get(port);
 	unit = zfcp_unit_enqueue(port, lun);
 	if (IS_ERR(unit))
 		goto out_unit;
-	mutex_unlock(&zfcp_data.config_mutex);
 
 	zfcp_erp_unit_reopen(unit, 0, "auidc_1", NULL);
 	zfcp_erp_wait(adapter);
 	flush_work(&unit->scsi_work);
 
-	mutex_lock(&zfcp_data.config_mutex);
-	zfcp_unit_put(unit);
 out_unit:
-	zfcp_port_put(port);
+	put_device(&port->sysfs_device);
 out_port:
-	zfcp_adapter_put(adapter);
-out_unlock:
-	mutex_unlock(&zfcp_data.config_mutex);
-out_ccwdev:
-	put_device(&ccwdev->dev);
+	zfcp_ccw_adapter_put(adapter);
+out_ccw_device:
+	put_device(&cdev->dev);
 	return;
 }
 
@@ -167,7 +160,7 @@ static int __init zfcp_module_init(void)
 	int retval = -ENOMEM;
 
 	zfcp_data.gpn_ft_cache = zfcp_cache_hw_align("zfcp_gpn",
-					sizeof(struct ct_iu_gpn_ft_req));
+					sizeof(struct zfcp_fc_gpn_ft_req));
 	if (!zfcp_data.gpn_ft_cache)
 		goto out;
 
@@ -182,12 +175,14 @@ static int __init zfcp_module_init(void)
 		goto out_sr_cache;
 
 	zfcp_data.gid_pn_cache = zfcp_cache_hw_align("zfcp_gid",
-					sizeof(struct zfcp_gid_pn_data));
+					sizeof(struct zfcp_fc_gid_pn));
 	if (!zfcp_data.gid_pn_cache)
 		goto out_gid_cache;
 
-	mutex_init(&zfcp_data.config_mutex);
-	rwlock_init(&zfcp_data.config_lock);
+	zfcp_data.adisc_cache = zfcp_cache_hw_align("zfcp_adisc",
+					sizeof(struct zfcp_fc_els_adisc));
+	if (!zfcp_data.adisc_cache)
+		goto out_adisc_cache;
 
 	zfcp_data.scsi_transport_template =
 		fc_attach_transport(&zfcp_transport_functions);
@@ -200,7 +195,7 @@ static int __init zfcp_module_init(void)
 		goto out_misc;
 	}
 
-	retval = zfcp_ccw_register();
+	retval = ccw_driver_register(&zfcp_ccw_driver);
 	if (retval) {
 		pr_err("The zfcp device driver could not register with "
 		       "the common I/O layer\n");
@@ -216,6 +211,8 @@ out_ccw_register:
 out_misc:
 	fc_release_transport(zfcp_data.scsi_transport_template);
 out_transport:
+	kmem_cache_destroy(zfcp_data.adisc_cache);
+out_adisc_cache:
 	kmem_cache_destroy(zfcp_data.gid_pn_cache);
 out_gid_cache:
 	kmem_cache_destroy(zfcp_data.sr_buffer_cache);
@@ -229,6 +226,20 @@ out:
 
 module_init(zfcp_module_init);
 
+static void __exit zfcp_module_exit(void)
+{
+	ccw_driver_unregister(&zfcp_ccw_driver);
+	misc_deregister(&zfcp_cfdc_misc);
+	fc_release_transport(zfcp_data.scsi_transport_template);
+	kmem_cache_destroy(zfcp_data.adisc_cache);
+	kmem_cache_destroy(zfcp_data.gid_pn_cache);
+	kmem_cache_destroy(zfcp_data.sr_buffer_cache);
+	kmem_cache_destroy(zfcp_data.qtcb_cache);
+	kmem_cache_destroy(zfcp_data.gpn_ft_cache);
+}
+
+module_exit(zfcp_module_exit);
+
 /**
  * zfcp_get_unit_by_lun - find unit in unit list of port by FCP LUN
  * @port: pointer to port to search for unit
@@ -238,12 +249,18 @@ module_init(zfcp_module_init);
  */
 struct zfcp_unit *zfcp_get_unit_by_lun(struct zfcp_port *port, u64 fcp_lun)
 {
+	unsigned long flags;
 	struct zfcp_unit *unit;
 
-	list_for_each_entry(unit, &port->unit_list_head, list)
-		if ((unit->fcp_lun == fcp_lun) &&
-		    !(atomic_read(&unit->status) & ZFCP_STATUS_COMMON_REMOVE))
-		    return unit;
+	read_lock_irqsave(&port->unit_list_lock, flags);
+	list_for_each_entry(unit, &port->unit_list, list)
+		if (unit->fcp_lun == fcp_lun) {
+			if (!get_device(&unit->sysfs_device))
+				unit = NULL;
+			read_unlock_irqrestore(&port->unit_list_lock, flags);
+			return unit;
+		}
+	read_unlock_irqrestore(&port->unit_list_lock, flags);
 	return NULL;
 }
 
@@ -257,18 +274,35 @@ struct zfcp_unit *zfcp_get_unit_by_lun(struct zfcp_port *port, u64 fcp_lun)
 struct zfcp_port *zfcp_get_port_by_wwpn(struct zfcp_adapter *adapter,
 					u64 wwpn)
 {
+	unsigned long flags;
 	struct zfcp_port *port;
 
-	list_for_each_entry(port, &adapter->port_list_head, list)
-		if ((port->wwpn == wwpn) &&
-		    !(atomic_read(&port->status) & ZFCP_STATUS_COMMON_REMOVE))
+	read_lock_irqsave(&adapter->port_list_lock, flags);
+	list_for_each_entry(port, &adapter->port_list, list)
+		if (port->wwpn == wwpn) {
+			if (!get_device(&port->sysfs_device))
+				port = NULL;
+			read_unlock_irqrestore(&adapter->port_list_lock, flags);
 			return port;
+		}
+	read_unlock_irqrestore(&adapter->port_list_lock, flags);
 	return NULL;
 }
 
-static void zfcp_sysfs_unit_release(struct device *dev)
+/**
+ * zfcp_unit_release - dequeue unit
+ * @dev: pointer to device
+ *
+ * waits until all work is done on unit and removes it then from the unit->list
+ * of the associated port.
+ */
+static void zfcp_unit_release(struct device *dev)
 {
-	kfree(container_of(dev, struct zfcp_unit, sysfs_device));
+	struct zfcp_unit *unit = container_of(dev, struct zfcp_unit,
+					      sysfs_device);
+
+	put_device(&unit->port->sysfs_device);
+	kfree(unit);
 }
 
 /**
@@ -276,43 +310,40 @@ static void zfcp_sysfs_unit_release(struct device *dev)
  * @port: pointer to port where unit is added
  * @fcp_lun: FCP LUN of unit to be enqueued
  * Returns: pointer to enqueued unit on success, ERR_PTR on error
- * Locks: config_mutex must be held to serialize changes to the unit list
  *
  * Sets up some unit internal structures and creates sysfs entry.
  */
 struct zfcp_unit *zfcp_unit_enqueue(struct zfcp_port *port, u64 fcp_lun)
 {
 	struct zfcp_unit *unit;
+	int retval = -ENOMEM;
 
-	read_lock_irq(&zfcp_data.config_lock);
-	if (zfcp_get_unit_by_lun(port, fcp_lun)) {
-		read_unlock_irq(&zfcp_data.config_lock);
-		return ERR_PTR(-EINVAL);
+	get_device(&port->sysfs_device);
+
+	unit = zfcp_get_unit_by_lun(port, fcp_lun);
+	if (unit) {
+		put_device(&unit->sysfs_device);
+		retval = -EEXIST;
+		goto err_out;
 	}
-	read_unlock_irq(&zfcp_data.config_lock);
 
 	unit = kzalloc(sizeof(struct zfcp_unit), GFP_KERNEL);
 	if (!unit)
-		return ERR_PTR(-ENOMEM);
-
-	atomic_set(&unit->refcount, 0);
-	init_waitqueue_head(&unit->remove_wq);
-	INIT_WORK(&unit->scsi_work, zfcp_scsi_scan);
+		goto err_out;
 
 	unit->port = port;
 	unit->fcp_lun = fcp_lun;
+	unit->sysfs_device.parent = &port->sysfs_device;
+	unit->sysfs_device.release = zfcp_unit_release;
 
 	if (dev_set_name(&unit->sysfs_device, "0x%016llx",
 			 (unsigned long long) fcp_lun)) {
 		kfree(unit);
-		return ERR_PTR(-ENOMEM);
+		goto err_out;
 	}
-	unit->sysfs_device.parent = &port->sysfs_device;
-	unit->sysfs_device.release = zfcp_sysfs_unit_release;
-	dev_set_drvdata(&unit->sysfs_device, unit);
+	retval = -EINVAL;
 
-	/* mark unit unusable as long as sysfs registration is not complete */
-	atomic_set_mask(ZFCP_STATUS_COMMON_REMOVE, &unit->status);
+	INIT_WORK(&unit->scsi_work, zfcp_scsi_scan);
 
 	spin_lock_init(&unit->latencies.lock);
 	unit->latencies.write.channel.min = 0xFFFFFFFF;
@@ -324,50 +355,30 @@ struct zfcp_unit *zfcp_unit_enqueue(struct zfcp_port *port, u64 fcp_lun)
 
 	if (device_register(&unit->sysfs_device)) {
 		put_device(&unit->sysfs_device);
-		return ERR_PTR(-EINVAL);
+		goto err_out;
 	}
 
 	if (sysfs_create_group(&unit->sysfs_device.kobj,
-			       &zfcp_sysfs_unit_attrs)) {
-		device_unregister(&unit->sysfs_device);
-		return ERR_PTR(-EINVAL);
-	}
+			       &zfcp_sysfs_unit_attrs))
+		goto err_out_put;
 
-	zfcp_unit_get(unit);
+	write_lock_irq(&port->unit_list_lock);
+	list_add_tail(&unit->list, &port->unit_list);
+	write_unlock_irq(&port->unit_list_lock);
 
-	write_lock_irq(&zfcp_data.config_lock);
-	list_add_tail(&unit->list, &port->unit_list_head);
-	atomic_clear_mask(ZFCP_STATUS_COMMON_REMOVE, &unit->status);
 	atomic_set_mask(ZFCP_STATUS_COMMON_RUNNING, &unit->status);
 
-	write_unlock_irq(&zfcp_data.config_lock);
-
-	zfcp_port_get(port);
-
 	return unit;
-}
 
-/**
- * zfcp_unit_dequeue - dequeue unit
- * @unit: pointer to zfcp_unit
- *
- * waits until all work is done on unit and removes it then from the unit->list
- * of the associated port.
- */
-void zfcp_unit_dequeue(struct zfcp_unit *unit)
-{
-	wait_event(unit->remove_wq, atomic_read(&unit->refcount) == 0);
-	write_lock_irq(&zfcp_data.config_lock);
-	list_del(&unit->list);
-	write_unlock_irq(&zfcp_data.config_lock);
-	zfcp_port_put(unit->port);
-	sysfs_remove_group(&unit->sysfs_device.kobj, &zfcp_sysfs_unit_attrs);
+err_out_put:
 	device_unregister(&unit->sysfs_device);
+err_out:
+	put_device(&port->sysfs_device);
+	return ERR_PTR(retval);
 }
 
 static int zfcp_allocate_low_mem_buffers(struct zfcp_adapter *adapter)
 {
-	/* must only be called with zfcp_data.config_mutex taken */
 	adapter->pool.erp_req =
 		mempool_create_kmalloc_pool(1, sizeof(struct zfcp_fsf_req));
 	if (!adapter->pool.erp_req)
@@ -405,9 +416,9 @@ static int zfcp_allocate_low_mem_buffers(struct zfcp_adapter *adapter)
 	if (!adapter->pool.status_read_data)
 		return -ENOMEM;
 
-	adapter->pool.gid_pn_data =
+	adapter->pool.gid_pn =
 		mempool_create_slab_pool(1, zfcp_data.gid_pn_cache);
-	if (!adapter->pool.gid_pn_data)
+	if (!adapter->pool.gid_pn)
 		return -ENOMEM;
 
 	return 0;
@@ -415,7 +426,6 @@ static int zfcp_allocate_low_mem_buffers(struct zfcp_adapter *adapter)
 
 static void zfcp_free_low_mem_buffers(struct zfcp_adapter *adapter)
 {
-	/* zfcp_data.config_mutex must be held */
 	if (adapter->pool.erp_req)
 		mempool_destroy(adapter->pool.erp_req);
 	if (adapter->pool.scsi_req)
@@ -428,8 +438,8 @@ static void zfcp_free_low_mem_buffers(struct zfcp_adapter *adapter)
 		mempool_destroy(adapter->pool.status_read_req);
 	if (adapter->pool.status_read_data)
 		mempool_destroy(adapter->pool.status_read_data);
-	if (adapter->pool.gid_pn_data)
-		mempool_destroy(adapter->pool.gid_pn_data);
+	if (adapter->pool.gid_pn)
+		mempool_destroy(adapter->pool.gid_pn);
 }
 
 /**
@@ -497,53 +507,56 @@ static void zfcp_destroy_adapter_work_queue(struct zfcp_adapter *adapter)
  * zfcp_adapter_enqueue - enqueue a new adapter to the list
  * @ccw_device: pointer to the struct cc_device
  *
- * Returns:	0             if a new adapter was successfully enqueued
- *		-ENOMEM       if alloc failed
+ * Returns:	struct zfcp_adapter*
  * Enqueues an adapter at the end of the adapter list in the driver data.
  * All adapter internal structures are set up.
  * Proc-fs entries are also created.
- * locks: config_mutex must be held to serialize changes to the adapter list
  */
-int zfcp_adapter_enqueue(struct ccw_device *ccw_device)
+struct zfcp_adapter *zfcp_adapter_enqueue(struct ccw_device *ccw_device)
 {
 	struct zfcp_adapter *adapter;
 
-	/*
-	 * Note: It is safe to release the list_lock, as any list changes
-	 * are protected by the config_mutex, which must be held to get here
-	 */
+	if (!get_device(&ccw_device->dev))
+		return ERR_PTR(-ENODEV);
 
 	adapter = kzalloc(sizeof(struct zfcp_adapter), GFP_KERNEL);
-	if (!adapter)
-		return -ENOMEM;
+	if (!adapter) {
+		put_device(&ccw_device->dev);
+		return ERR_PTR(-ENOMEM);
+	}
+
+	kref_init(&adapter->ref);
 
 	ccw_device->handler = NULL;
 	adapter->ccw_device = ccw_device;
-	atomic_set(&adapter->refcount, 0);
+
+	INIT_WORK(&adapter->stat_work, _zfcp_status_read_scheduler);
+	INIT_WORK(&adapter->scan_work, zfcp_fc_scan_ports);
 
 	if (zfcp_qdio_setup(adapter))
-		goto qdio_failed;
+		goto failed;
 
 	if (zfcp_allocate_low_mem_buffers(adapter))
-		goto low_mem_buffers_failed;
+		goto failed;
 
 	if (zfcp_reqlist_alloc(adapter))
-		goto low_mem_buffers_failed;
+		goto failed;
 
 	if (zfcp_dbf_adapter_register(adapter))
-		goto debug_register_failed;
+		goto failed;
 
 	if (zfcp_setup_adapter_work_queue(adapter))
-		goto work_queue_failed;
+		goto failed;
 
 	if (zfcp_fc_gs_setup(adapter))
-		goto generic_services_failed;
+		goto failed;
+
+	rwlock_init(&adapter->port_list_lock);
+	INIT_LIST_HEAD(&adapter->port_list);
 
-	init_waitqueue_head(&adapter->remove_wq);
 	init_waitqueue_head(&adapter->erp_ready_wq);
 	init_waitqueue_head(&adapter->erp_done_wqh);
 
-	INIT_LIST_HEAD(&adapter->port_list_head);
 	INIT_LIST_HEAD(&adapter->erp_ready_head);
 	INIT_LIST_HEAD(&adapter->erp_running_head);
 
@@ -553,83 +566,85 @@ int zfcp_adapter_enqueue(struct ccw_device *ccw_device)
 	rwlock_init(&adapter->abort_lock);
 
 	if (zfcp_erp_thread_setup(adapter))
-		goto erp_thread_failed;
-
-	INIT_WORK(&adapter->stat_work, _zfcp_status_read_scheduler);
-	INIT_WORK(&adapter->scan_work, _zfcp_fc_scan_ports_later);
+		goto failed;
 
 	adapter->service_level.seq_print = zfcp_print_sl;
 
-	/* mark adapter unusable as long as sysfs registration is not complete */
-	atomic_set_mask(ZFCP_STATUS_COMMON_REMOVE, &adapter->status);
-
 	dev_set_drvdata(&ccw_device->dev, adapter);
 
 	if (sysfs_create_group(&ccw_device->dev.kobj,
 			       &zfcp_sysfs_adapter_attrs))
-		goto sysfs_failed;
-
-	atomic_clear_mask(ZFCP_STATUS_COMMON_REMOVE, &adapter->status);
+		goto failed;
 
 	if (!zfcp_adapter_scsi_register(adapter))
-		return 0;
+		return adapter;
 
-sysfs_failed:
-	zfcp_erp_thread_kill(adapter);
-erp_thread_failed:
-	zfcp_fc_gs_destroy(adapter);
-generic_services_failed:
+failed:
+	zfcp_adapter_unregister(adapter);
+	return ERR_PTR(-ENOMEM);
+}
+
+void zfcp_adapter_unregister(struct zfcp_adapter *adapter)
+{
+	struct ccw_device *cdev = adapter->ccw_device;
+
+	cancel_work_sync(&adapter->scan_work);
+	cancel_work_sync(&adapter->stat_work);
 	zfcp_destroy_adapter_work_queue(adapter);
-work_queue_failed:
+
+	zfcp_fc_wka_ports_force_offline(adapter->gs);
+	zfcp_adapter_scsi_unregister(adapter);
+	sysfs_remove_group(&cdev->dev.kobj, &zfcp_sysfs_adapter_attrs);
+
+	zfcp_erp_thread_kill(adapter);
 	zfcp_dbf_adapter_unregister(adapter->dbf);
-debug_register_failed:
-	dev_set_drvdata(&ccw_device->dev, NULL);
-	kfree(adapter->req_list);
-low_mem_buffers_failed:
-	zfcp_free_low_mem_buffers(adapter);
-qdio_failed:
 	zfcp_qdio_destroy(adapter->qdio);
-	kfree(adapter);
-	return -ENOMEM;
+
+	zfcp_ccw_adapter_put(adapter); /* final put to release */
 }
 
 /**
- * zfcp_adapter_dequeue - remove the adapter from the resource list
- * @adapter: pointer to struct zfcp_adapter which should be removed
+ * zfcp_adapter_release - remove the adapter from the resource list
+ * @ref: pointer to struct kref
  * locks:	adapter list write lock is assumed to be held by caller
  */
-void zfcp_adapter_dequeue(struct zfcp_adapter *adapter)
+void zfcp_adapter_release(struct kref *ref)
 {
-	int retval = 0;
-	unsigned long flags;
+	struct zfcp_adapter *adapter = container_of(ref, struct zfcp_adapter,
+						    ref);
+	struct ccw_device *cdev = adapter->ccw_device;
 
-	cancel_work_sync(&adapter->stat_work);
-	zfcp_fc_wka_ports_force_offline(adapter->gs);
-	sysfs_remove_group(&adapter->ccw_device->dev.kobj,
-			   &zfcp_sysfs_adapter_attrs);
 	dev_set_drvdata(&adapter->ccw_device->dev, NULL);
-	/* sanity check: no pending FSF requests */
-	spin_lock_irqsave(&adapter->req_list_lock, flags);
-	retval = zfcp_reqlist_isempty(adapter);
-	spin_unlock_irqrestore(&adapter->req_list_lock, flags);
-	if (!retval)
-		return;
-
 	zfcp_fc_gs_destroy(adapter);
-	zfcp_erp_thread_kill(adapter);
-	zfcp_destroy_adapter_work_queue(adapter);
-	zfcp_dbf_adapter_unregister(adapter->dbf);
 	zfcp_free_low_mem_buffers(adapter);
-	zfcp_qdio_destroy(adapter->qdio);
 	kfree(adapter->req_list);
 	kfree(adapter->fc_stats);
 	kfree(adapter->stats_reset_data);
 	kfree(adapter);
+	put_device(&cdev->dev);
 }
 
-static void zfcp_sysfs_port_release(struct device *dev)
+/**
+ * zfcp_device_unregister - remove port, unit from system
+ * @dev: reference to device which is to be removed
+ * @grp: related reference to attribute group
+ *
+ * Helper function to unregister port, unit from system
+ */
+void zfcp_device_unregister(struct device *dev,
+			    const struct attribute_group *grp)
 {
-	kfree(container_of(dev, struct zfcp_port, sysfs_device));
+	sysfs_remove_group(&dev->kobj, grp);
+	device_unregister(dev);
+}
+
+static void zfcp_port_release(struct device *dev)
+{
+	struct zfcp_port *port = container_of(dev, struct zfcp_port,
+					      sysfs_device);
+
+	zfcp_ccw_adapter_put(port->adapter);
+	kfree(port);
 }
 
 /**
@@ -639,7 +654,6 @@ static void zfcp_sysfs_port_release(struct device *dev)
  * @status: initial status for the port
  * @d_id: destination id of the remote port to be enqueued
  * Returns: pointer to enqueued port on success, ERR_PTR on error
- * Locks: config_mutex must be held to serialize changes to the port list
  *
  * All port internal structures are set up and the sysfs entry is generated.
  * d_id is used to enqueue ports with a well known address like the Directory
@@ -649,20 +663,24 @@ struct zfcp_port *zfcp_port_enqueue(struct zfcp_adapter *adapter, u64 wwpn,
 				     u32 status, u32 d_id)
 {
 	struct zfcp_port *port;
+	int retval = -ENOMEM;
 
-	read_lock_irq(&zfcp_data.config_lock);
-	if (zfcp_get_port_by_wwpn(adapter, wwpn)) {
-		read_unlock_irq(&zfcp_data.config_lock);
-		return ERR_PTR(-EINVAL);
+	kref_get(&adapter->ref);
+
+	port = zfcp_get_port_by_wwpn(adapter, wwpn);
+	if (port) {
+		put_device(&port->sysfs_device);
+		retval = -EEXIST;
+		goto err_out;
 	}
-	read_unlock_irq(&zfcp_data.config_lock);
 
 	port = kzalloc(sizeof(struct zfcp_port), GFP_KERNEL);
 	if (!port)
-		return ERR_PTR(-ENOMEM);
+		goto err_out;
+
+	rwlock_init(&port->unit_list_lock);
+	INIT_LIST_HEAD(&port->unit_list);
 
-	init_waitqueue_head(&port->remove_wq);
-	INIT_LIST_HEAD(&port->unit_list_head);
 	INIT_WORK(&port->gid_pn_work, zfcp_fc_port_did_lookup);
 	INIT_WORK(&port->test_link_work, zfcp_fc_link_test_work);
 	INIT_WORK(&port->rport_work, zfcp_scsi_rport_work);
@@ -671,58 +689,38 @@ struct zfcp_port *zfcp_port_enqueue(struct zfcp_adapter *adapter, u64 wwpn,
 	port->d_id = d_id;
 	port->wwpn = wwpn;
 	port->rport_task = RPORT_NONE;
-
-	/* mark port unusable as long as sysfs registration is not complete */
-	atomic_set_mask(status | ZFCP_STATUS_COMMON_REMOVE, &port->status);
-	atomic_set(&port->refcount, 0);
+	port->sysfs_device.parent = &adapter->ccw_device->dev;
+	port->sysfs_device.release = zfcp_port_release;
 
 	if (dev_set_name(&port->sysfs_device, "0x%016llx",
 			 (unsigned long long)wwpn)) {
 		kfree(port);
-		return ERR_PTR(-ENOMEM);
+		goto err_out;
 	}
-	port->sysfs_device.parent = &adapter->ccw_device->dev;
-	port->sysfs_device.release = zfcp_sysfs_port_release;
-	dev_set_drvdata(&port->sysfs_device, port);
+	retval = -EINVAL;
 
 	if (device_register(&port->sysfs_device)) {
 		put_device(&port->sysfs_device);
-		return ERR_PTR(-EINVAL);
+		goto err_out;
 	}
 
 	if (sysfs_create_group(&port->sysfs_device.kobj,
-			       &zfcp_sysfs_port_attrs)) {
-		device_unregister(&port->sysfs_device);
-		return ERR_PTR(-EINVAL);
-	}
+			       &zfcp_sysfs_port_attrs))
+		goto err_out_put;
 
-	zfcp_port_get(port);
+	write_lock_irq(&adapter->port_list_lock);
+	list_add_tail(&port->list, &adapter->port_list);
+	write_unlock_irq(&adapter->port_list_lock);
 
-	write_lock_irq(&zfcp_data.config_lock);
-	list_add_tail(&port->list, &adapter->port_list_head);
-	atomic_clear_mask(ZFCP_STATUS_COMMON_REMOVE, &port->status);
-	atomic_set_mask(ZFCP_STATUS_COMMON_RUNNING, &port->status);
+	atomic_set_mask(status | ZFCP_STATUS_COMMON_RUNNING, &port->status);
 
-	write_unlock_irq(&zfcp_data.config_lock);
-
-	zfcp_adapter_get(adapter);
 	return port;
-}
 
-/**
- * zfcp_port_dequeue - dequeues a port from the port list of the adapter
- * @port: pointer to struct zfcp_port which should be removed
- */
-void zfcp_port_dequeue(struct zfcp_port *port)
-{
-	write_lock_irq(&zfcp_data.config_lock);
-	list_del(&port->list);
-	write_unlock_irq(&zfcp_data.config_lock);
-	wait_event(port->remove_wq, atomic_read(&port->refcount) == 0);
-	cancel_work_sync(&port->rport_work); /* usually not necessary */
-	zfcp_adapter_put(port->adapter);
-	sysfs_remove_group(&port->sysfs_device.kobj, &zfcp_sysfs_port_attrs);
+err_out_put:
 	device_unregister(&port->sysfs_device);
+err_out:
+	zfcp_ccw_adapter_put(adapter);
+	return ERR_PTR(retval);
 }
 
 /**
diff --git a/drivers/s390/scsi/zfcp_ccw.c b/drivers/s390/scsi/zfcp_ccw.c
index e08339428ecf..c22cb72a5ae8 100644
--- a/drivers/s390/scsi/zfcp_ccw.c
+++ b/drivers/s390/scsi/zfcp_ccw.c
@@ -13,28 +13,34 @@
 
 #define ZFCP_MODEL_PRIV 0x4
 
-static int zfcp_ccw_suspend(struct ccw_device *cdev)
+static DEFINE_SPINLOCK(zfcp_ccw_adapter_ref_lock);
 
+struct zfcp_adapter *zfcp_ccw_adapter_by_cdev(struct ccw_device *cdev)
 {
-	struct zfcp_adapter *adapter = dev_get_drvdata(&cdev->dev);
-
-	if (!adapter)
-		return 0;
-
-	mutex_lock(&zfcp_data.config_mutex);
+	struct zfcp_adapter *adapter;
+	unsigned long flags;
 
-	zfcp_erp_adapter_shutdown(adapter, 0, "ccsusp1", NULL);
-	zfcp_erp_wait(adapter);
+	spin_lock_irqsave(&zfcp_ccw_adapter_ref_lock, flags);
+	adapter = dev_get_drvdata(&cdev->dev);
+	if (adapter)
+		kref_get(&adapter->ref);
+	spin_unlock_irqrestore(&zfcp_ccw_adapter_ref_lock, flags);
+	return adapter;
+}
 
-	mutex_unlock(&zfcp_data.config_mutex);
+void zfcp_ccw_adapter_put(struct zfcp_adapter *adapter)
+{
+	unsigned long flags;
 
-	return 0;
+	spin_lock_irqsave(&zfcp_ccw_adapter_ref_lock, flags);
+	kref_put(&adapter->ref, zfcp_adapter_release);
+	spin_unlock_irqrestore(&zfcp_ccw_adapter_ref_lock, flags);
 }
 
 static int zfcp_ccw_activate(struct ccw_device *cdev)
 
 {
-	struct zfcp_adapter *adapter = dev_get_drvdata(&cdev->dev);
+	struct zfcp_adapter *adapter = zfcp_ccw_adapter_by_cdev(cdev);
 
 	if (!adapter)
 		return 0;
@@ -46,6 +52,8 @@ static int zfcp_ccw_activate(struct ccw_device *cdev)
 	zfcp_erp_wait(adapter);
 	flush_work(&adapter->scan_work);
 
+	zfcp_ccw_adapter_put(adapter);
+
 	return 0;
 }
 
@@ -67,28 +75,28 @@ int zfcp_ccw_priv_sch(struct zfcp_adapter *adapter)
 
 /**
  * zfcp_ccw_probe - probe function of zfcp driver
- * @ccw_device: pointer to belonging ccw device
+ * @cdev: pointer to belonging ccw device
  *
  * This function gets called by the common i/o layer for each FCP
  * device found on the current system. This is only a stub to make cio
  * work: To only allocate adapter resources for devices actually used,
  * the allocation is deferred to the first call to ccw_set_online.
  */
-static int zfcp_ccw_probe(struct ccw_device *ccw_device)
+static int zfcp_ccw_probe(struct ccw_device *cdev)
 {
 	return 0;
 }
 
 /**
  * zfcp_ccw_remove - remove function of zfcp driver
- * @ccw_device: pointer to belonging ccw device
+ * @cdev: pointer to belonging ccw device
  *
  * This function gets called by the common i/o layer and removes an adapter
  * from the system. Task of this function is to get rid of all units and
  * ports that belong to this adapter. And in addition all resources of this
  * adapter will be freed too.
  */
-static void zfcp_ccw_remove(struct ccw_device *ccw_device)
+static void zfcp_ccw_remove(struct ccw_device *cdev)
 {
 	struct zfcp_adapter *adapter;
 	struct zfcp_port *port, *p;
@@ -96,49 +104,37 @@ static void zfcp_ccw_remove(struct ccw_device *ccw_device)
 	LIST_HEAD(unit_remove_lh);
 	LIST_HEAD(port_remove_lh);
 
-	ccw_device_set_offline(ccw_device);
+	ccw_device_set_offline(cdev);
 
-	mutex_lock(&zfcp_data.config_mutex);
-	adapter = dev_get_drvdata(&ccw_device->dev);
+	adapter = zfcp_ccw_adapter_by_cdev(cdev);
 	if (!adapter)
-		goto out;
-	mutex_unlock(&zfcp_data.config_mutex);
+		return;
 
-	cancel_work_sync(&adapter->scan_work);
-
-	mutex_lock(&zfcp_data.config_mutex);
-
-	/* this also removes the scsi devices, so call it first */
-	zfcp_adapter_scsi_unregister(adapter);
-
-	write_lock_irq(&zfcp_data.config_lock);
-	list_for_each_entry_safe(port, p, &adapter->port_list_head, list) {
-		list_for_each_entry_safe(unit, u, &port->unit_list_head, list) {
+	write_lock_irq(&adapter->port_list_lock);
+	list_for_each_entry_safe(port, p, &adapter->port_list, list) {
+		write_lock(&port->unit_list_lock);
+		list_for_each_entry_safe(unit, u, &port->unit_list, list)
 			list_move(&unit->list, &unit_remove_lh);
-			atomic_set_mask(ZFCP_STATUS_COMMON_REMOVE,
-					&unit->status);
-		}
+		write_unlock(&port->unit_list_lock);
 		list_move(&port->list, &port_remove_lh);
-		atomic_set_mask(ZFCP_STATUS_COMMON_REMOVE, &port->status);
 	}
-	atomic_set_mask(ZFCP_STATUS_COMMON_REMOVE, &adapter->status);
-	write_unlock_irq(&zfcp_data.config_lock);
+	write_unlock_irq(&adapter->port_list_lock);
+	zfcp_ccw_adapter_put(adapter); /* put from zfcp_ccw_adapter_by_cdev */
 
-	list_for_each_entry_safe(port, p, &port_remove_lh, list) {
-		list_for_each_entry_safe(unit, u, &unit_remove_lh, list)
-			zfcp_unit_dequeue(unit);
-		zfcp_port_dequeue(port);
-	}
-	wait_event(adapter->remove_wq, atomic_read(&adapter->refcount) == 0);
-	zfcp_adapter_dequeue(adapter);
+	list_for_each_entry_safe(unit, u, &unit_remove_lh, list)
+		zfcp_device_unregister(&unit->sysfs_device,
+				       &zfcp_sysfs_unit_attrs);
 
-out:
-	mutex_unlock(&zfcp_data.config_mutex);
+	list_for_each_entry_safe(port, p, &port_remove_lh, list)
+		zfcp_device_unregister(&port->sysfs_device,
+				       &zfcp_sysfs_port_attrs);
+
+	zfcp_adapter_unregister(adapter);
 }
 
 /**
  * zfcp_ccw_set_online - set_online function of zfcp driver
- * @ccw_device: pointer to belonging ccw device
+ * @cdev: pointer to belonging ccw device
  *
  * This function gets called by the common i/o layer and sets an
  * adapter into state online.  The first call will allocate all
@@ -149,23 +145,20 @@ out:
  * the SCSI stack, that the QDIO queues will be set up and that the
  * adapter will be opened.
  */
-static int zfcp_ccw_set_online(struct ccw_device *ccw_device)
+static int zfcp_ccw_set_online(struct ccw_device *cdev)
 {
-	struct zfcp_adapter *adapter;
-	int ret = 0;
-
-	mutex_lock(&zfcp_data.config_mutex);
-	adapter = dev_get_drvdata(&ccw_device->dev);
+	struct zfcp_adapter *adapter = zfcp_ccw_adapter_by_cdev(cdev);
 
 	if (!adapter) {
-		ret = zfcp_adapter_enqueue(ccw_device);
-		if (ret) {
-			dev_err(&ccw_device->dev,
+		adapter = zfcp_adapter_enqueue(cdev);
+
+		if (IS_ERR(adapter)) {
+			dev_err(&cdev->dev,
 				"Setting up data structures for the "
 				"FCP adapter failed\n");
-			goto out;
+			return PTR_ERR(adapter);
 		}
-		adapter = dev_get_drvdata(&ccw_device->dev);
+		kref_get(&adapter->ref);
 	}
 
 	/* initialize request counter */
@@ -177,58 +170,61 @@ static int zfcp_ccw_set_online(struct ccw_device *ccw_device)
 	zfcp_erp_adapter_reopen(adapter, ZFCP_STATUS_COMMON_ERP_FAILED,
 				"ccsonl2", NULL);
 	zfcp_erp_wait(adapter);
-out:
-	mutex_unlock(&zfcp_data.config_mutex);
-	if (!ret)
-		flush_work(&adapter->scan_work);
-	return ret;
+
+	flush_work(&adapter->scan_work);
+
+	zfcp_ccw_adapter_put(adapter);
+	return 0;
 }
 
 /**
  * zfcp_ccw_set_offline - set_offline function of zfcp driver
- * @ccw_device: pointer to belonging ccw device
+ * @cdev: pointer to belonging ccw device
  *
  * This function gets called by the common i/o layer and sets an adapter
  * into state offline.
  */
-static int zfcp_ccw_set_offline(struct ccw_device *ccw_device)
+static int zfcp_ccw_set_offline(struct ccw_device *cdev)
 {
-	struct zfcp_adapter *adapter;
+	struct zfcp_adapter *adapter = zfcp_ccw_adapter_by_cdev(cdev);
+
+	if (!adapter)
+		return 0;
 
-	mutex_lock(&zfcp_data.config_mutex);
-	adapter = dev_get_drvdata(&ccw_device->dev);
 	zfcp_erp_adapter_shutdown(adapter, 0, "ccsoff1", NULL);
 	zfcp_erp_wait(adapter);
-	mutex_unlock(&zfcp_data.config_mutex);
+
+	zfcp_ccw_adapter_put(adapter);
 	return 0;
 }
 
 /**
  * zfcp_ccw_notify - ccw notify function
- * @ccw_device: pointer to belonging ccw device
+ * @cdev: pointer to belonging ccw device
  * @event: indicates if adapter was detached or attached
  *
  * This function gets called by the common i/o layer if an adapter has gone
  * or reappeared.
  */
-static int zfcp_ccw_notify(struct ccw_device *ccw_device, int event)
+static int zfcp_ccw_notify(struct ccw_device *cdev, int event)
 {
-	struct zfcp_adapter *adapter = dev_get_drvdata(&ccw_device->dev);
+	struct zfcp_adapter *adapter = zfcp_ccw_adapter_by_cdev(cdev);
+
+	if (!adapter)
+		return 1;
 
 	switch (event) {
 	case CIO_GONE:
-		dev_warn(&adapter->ccw_device->dev,
-			 "The FCP device has been detached\n");
+		dev_warn(&cdev->dev, "The FCP device has been detached\n");
 		zfcp_erp_adapter_shutdown(adapter, 0, "ccnoti1", NULL);
 		break;
 	case CIO_NO_PATH:
-		dev_warn(&adapter->ccw_device->dev,
+		dev_warn(&cdev->dev,
 			 "The CHPID for the FCP device is offline\n");
 		zfcp_erp_adapter_shutdown(adapter, 0, "ccnoti2", NULL);
 		break;
 	case CIO_OPER:
-		dev_info(&adapter->ccw_device->dev,
-			 "The FCP device is operational again\n");
+		dev_info(&cdev->dev, "The FCP device is operational again\n");
 		zfcp_erp_modify_adapter_status(adapter, "ccnoti3", NULL,
 					       ZFCP_STATUS_COMMON_RUNNING,
 					       ZFCP_SET);
@@ -236,11 +232,13 @@ static int zfcp_ccw_notify(struct ccw_device *ccw_device, int event)
 					"ccnoti4", NULL);
 		break;
 	case CIO_BOXED:
-		dev_warn(&adapter->ccw_device->dev, "The FCP device "
-			 "did not respond within the specified time\n");
+		dev_warn(&cdev->dev, "The FCP device did not respond within "
+				     "the specified time\n");
 		zfcp_erp_adapter_shutdown(adapter, 0, "ccnoti5", NULL);
 		break;
 	}
+
+	zfcp_ccw_adapter_put(adapter);
 	return 1;
 }
 
@@ -250,18 +248,16 @@ static int zfcp_ccw_notify(struct ccw_device *ccw_device, int event)
  */
 static void zfcp_ccw_shutdown(struct ccw_device *cdev)
 {
-	struct zfcp_adapter *adapter;
+	struct zfcp_adapter *adapter = zfcp_ccw_adapter_by_cdev(cdev);
 
-	mutex_lock(&zfcp_data.config_mutex);
-	adapter = dev_get_drvdata(&cdev->dev);
 	if (!adapter)
-		goto out;
+		return;
 
 	zfcp_erp_adapter_shutdown(adapter, 0, "ccshut1", NULL);
 	zfcp_erp_wait(adapter);
 	zfcp_erp_thread_kill(adapter);
-out:
-	mutex_unlock(&zfcp_data.config_mutex);
+
+	zfcp_ccw_adapter_put(adapter);
 }
 
 struct ccw_driver zfcp_ccw_driver = {
@@ -274,18 +270,7 @@ struct ccw_driver zfcp_ccw_driver = {
 	.set_offline = zfcp_ccw_set_offline,
 	.notify      = zfcp_ccw_notify,
 	.shutdown    = zfcp_ccw_shutdown,
-	.freeze      = zfcp_ccw_suspend,
+	.freeze      = zfcp_ccw_set_offline,
 	.thaw	     = zfcp_ccw_activate,
 	.restore     = zfcp_ccw_activate,
 };
-
-/**
- * zfcp_ccw_register - ccw register function
- *
- * Registers the driver at the common i/o layer. This function will be called
- * at module load time/system start.
- */
-int __init zfcp_ccw_register(void)
-{
-	return ccw_driver_register(&zfcp_ccw_driver);
-}
diff --git a/drivers/s390/scsi/zfcp_cfdc.c b/drivers/s390/scsi/zfcp_cfdc.c
index ef681dfed0cc..f932400e980a 100644
--- a/drivers/s390/scsi/zfcp_cfdc.c
+++ b/drivers/s390/scsi/zfcp_cfdc.c
@@ -86,22 +86,17 @@ static int zfcp_cfdc_copy_to_user(void __user  *user_buffer,
 static struct zfcp_adapter *zfcp_cfdc_get_adapter(u32 devno)
 {
 	char busid[9];
-	struct ccw_device *ccwdev;
-	struct zfcp_adapter *adapter = NULL;
+	struct ccw_device *cdev;
+	struct zfcp_adapter *adapter;
 
 	snprintf(busid, sizeof(busid), "0.0.%04x", devno);
-	ccwdev = get_ccwdev_by_busid(&zfcp_ccw_driver, busid);
-	if (!ccwdev)
-		goto out;
-
-	adapter = dev_get_drvdata(&ccwdev->dev);
-	if (!adapter)
-		goto out_put;
-
-	zfcp_adapter_get(adapter);
-out_put:
-	put_device(&ccwdev->dev);
-out:
+	cdev = get_ccwdev_by_busid(&zfcp_ccw_driver, busid);
+	if (!cdev)
+		return NULL;
+
+	adapter = zfcp_ccw_adapter_by_cdev(cdev);
+
+	put_device(&cdev->dev);
 	return adapter;
 }
 
@@ -212,7 +207,6 @@ static long zfcp_cfdc_dev_ioctl(struct file *file, unsigned int command,
 		retval = -ENXIO;
 		goto free_buffer;
 	}
-	zfcp_adapter_get(adapter);
 
 	retval = zfcp_cfdc_sg_setup(data->command, fsf_cfdc->sg,
 				    data_user->control_file);
@@ -245,7 +239,7 @@ static long zfcp_cfdc_dev_ioctl(struct file *file, unsigned int command,
  free_sg:
 	zfcp_sg_free_table(fsf_cfdc->sg, ZFCP_CFDC_PAGES);
  adapter_put:
-	zfcp_adapter_put(adapter);
+	zfcp_ccw_adapter_put(adapter);
  free_buffer:
 	kfree(data);
  no_mem_sense:
diff --git a/drivers/s390/scsi/zfcp_dbf.c b/drivers/s390/scsi/zfcp_dbf.c
index 215b70749e95..84450955ae11 100644
--- a/drivers/s390/scsi/zfcp_dbf.c
+++ b/drivers/s390/scsi/zfcp_dbf.c
@@ -13,6 +13,7 @@
 #include <asm/debug.h>
 #include "zfcp_dbf.h"
 #include "zfcp_ext.h"
+#include "zfcp_fc.h"
 
 static u32 dbfsize = 4;
 
@@ -177,8 +178,7 @@ void _zfcp_dbf_hba_fsf_response(const char *tag2, int level,
 
 	case FSF_QTCB_SEND_ELS:
 		send_els = (struct zfcp_send_els *)fsf_req->data;
-		response->u.els.d_id = qtcb->bottom.support.d_id;
-		response->u.els.ls_code = send_els->ls_code >> 24;
+		response->u.els.d_id = ntoh24(qtcb->bottom.support.d_id);
 		break;
 
 	case FSF_QTCB_ABORT_FCP_CMND:
@@ -348,7 +348,6 @@ static void zfcp_dbf_hba_view_response(char **p,
 
 	case FSF_QTCB_SEND_ELS:
 		zfcp_dbf_out(p, "d_id", "0x%06x", r->u.els.d_id);
-		zfcp_dbf_out(p, "ls_code", "0x%02x", r->u.els.ls_code);
 		break;
 
 	case FSF_QTCB_ABORT_FCP_CMND:
@@ -677,14 +676,14 @@ void zfcp_dbf_rec_action(char *id2, struct zfcp_erp_action *erp_action)
 /**
  * zfcp_dbf_san_ct_request - trace event for issued CT request
  * @fsf_req: request containing issued CT data
+ * @d_id: destination id where ct request is sent to
  */
-void zfcp_dbf_san_ct_request(struct zfcp_fsf_req *fsf_req)
+void zfcp_dbf_san_ct_request(struct zfcp_fsf_req *fsf_req, u32 d_id)
 {
-	struct zfcp_send_ct *ct = (struct zfcp_send_ct *)fsf_req->data;
-	struct zfcp_wka_port *wka_port = ct->wka_port;
-	struct zfcp_adapter *adapter = wka_port->adapter;
+	struct zfcp_fsf_ct_els *ct = (struct zfcp_fsf_ct_els *)fsf_req->data;
+	struct zfcp_adapter *adapter = fsf_req->adapter;
 	struct zfcp_dbf *dbf = adapter->dbf;
-	struct ct_hdr *hdr = sg_virt(ct->req);
+	struct fc_ct_hdr *hdr = sg_virt(ct->req);
 	struct zfcp_dbf_san_record *r = &dbf->san_buf;
 	struct zfcp_dbf_san_record_ct_request *oct = &r->u.ct_req;
 	int level = 3;
@@ -695,19 +694,18 @@ void zfcp_dbf_san_ct_request(struct zfcp_fsf_req *fsf_req)
 	strncpy(r->tag, "octc", ZFCP_DBF_TAG_SIZE);
 	r->fsf_reqid = fsf_req->req_id;
 	r->fsf_seqno = fsf_req->seq_no;
-	r->s_id = fc_host_port_id(adapter->scsi_host);
-	r->d_id = wka_port->d_id;
-	oct->cmd_req_code = hdr->cmd_rsp_code;
-	oct->revision = hdr->revision;
-	oct->gs_type = hdr->gs_type;
-	oct->gs_subtype = hdr->gs_subtype;
-	oct->options = hdr->options;
-	oct->max_res_size = hdr->max_res_size;
-	oct->len = min((int)ct->req->length - (int)sizeof(struct ct_hdr),
+	oct->d_id = d_id;
+	oct->cmd_req_code = hdr->ct_cmd;
+	oct->revision = hdr->ct_rev;
+	oct->gs_type = hdr->ct_fs_type;
+	oct->gs_subtype = hdr->ct_fs_subtype;
+	oct->options = hdr->ct_options;
+	oct->max_res_size = hdr->ct_mr_size;
+	oct->len = min((int)ct->req->length - (int)sizeof(struct fc_ct_hdr),
 		       ZFCP_DBF_SAN_MAX_PAYLOAD);
 	debug_event(dbf->san, level, r, sizeof(*r));
 	zfcp_dbf_hexdump(dbf->san, r, sizeof(*r), level,
-			 (void *)hdr + sizeof(struct ct_hdr), oct->len);
+			 (void *)hdr + sizeof(struct fc_ct_hdr), oct->len);
 	spin_unlock_irqrestore(&dbf->san_lock, flags);
 }
 
@@ -717,10 +715,9 @@ void zfcp_dbf_san_ct_request(struct zfcp_fsf_req *fsf_req)
  */
 void zfcp_dbf_san_ct_response(struct zfcp_fsf_req *fsf_req)
 {
-	struct zfcp_send_ct *ct = (struct zfcp_send_ct *)fsf_req->data;
-	struct zfcp_wka_port *wka_port = ct->wka_port;
-	struct zfcp_adapter *adapter = wka_port->adapter;
-	struct ct_hdr *hdr = sg_virt(ct->resp);
+	struct zfcp_fsf_ct_els *ct = (struct zfcp_fsf_ct_els *)fsf_req->data;
+	struct zfcp_adapter *adapter = fsf_req->adapter;
+	struct fc_ct_hdr *hdr = sg_virt(ct->resp);
 	struct zfcp_dbf *dbf = adapter->dbf;
 	struct zfcp_dbf_san_record *r = &dbf->san_buf;
 	struct zfcp_dbf_san_record_ct_response *rct = &r->u.ct_resp;
@@ -732,25 +729,23 @@ void zfcp_dbf_san_ct_response(struct zfcp_fsf_req *fsf_req)
 	strncpy(r->tag, "rctc", ZFCP_DBF_TAG_SIZE);
 	r->fsf_reqid = fsf_req->req_id;
 	r->fsf_seqno = fsf_req->seq_no;
-	r->s_id = wka_port->d_id;
-	r->d_id = fc_host_port_id(adapter->scsi_host);
-	rct->cmd_rsp_code = hdr->cmd_rsp_code;
-	rct->revision = hdr->revision;
-	rct->reason_code = hdr->reason_code;
-	rct->expl = hdr->reason_code_expl;
-	rct->vendor_unique = hdr->vendor_unique;
-	rct->max_res_size = hdr->max_res_size;
-	rct->len = min((int)ct->resp->length - (int)sizeof(struct ct_hdr),
+	rct->cmd_rsp_code = hdr->ct_cmd;
+	rct->revision = hdr->ct_rev;
+	rct->reason_code = hdr->ct_reason;
+	rct->expl = hdr->ct_explan;
+	rct->vendor_unique = hdr->ct_vendor;
+	rct->max_res_size = hdr->ct_mr_size;
+	rct->len = min((int)ct->resp->length - (int)sizeof(struct fc_ct_hdr),
 		       ZFCP_DBF_SAN_MAX_PAYLOAD);
 	debug_event(dbf->san, level, r, sizeof(*r));
 	zfcp_dbf_hexdump(dbf->san, r, sizeof(*r), level,
-			 (void *)hdr + sizeof(struct ct_hdr), rct->len);
+			 (void *)hdr + sizeof(struct fc_ct_hdr), rct->len);
 	spin_unlock_irqrestore(&dbf->san_lock, flags);
 }
 
 static void zfcp_dbf_san_els(const char *tag, int level,
-			     struct zfcp_fsf_req *fsf_req, u32 s_id, u32 d_id,
-			     u8 ls_code, void *buffer, int buflen)
+			     struct zfcp_fsf_req *fsf_req, u32 d_id,
+			     void *buffer, int buflen)
 {
 	struct zfcp_adapter *adapter = fsf_req->adapter;
 	struct zfcp_dbf *dbf = adapter->dbf;
@@ -762,9 +757,7 @@ static void zfcp_dbf_san_els(const char *tag, int level,
 	strncpy(rec->tag, tag, ZFCP_DBF_TAG_SIZE);
 	rec->fsf_reqid = fsf_req->req_id;
 	rec->fsf_seqno = fsf_req->seq_no;
-	rec->s_id = s_id;
-	rec->d_id = d_id;
-	rec->u.els.ls_code = ls_code;
+	rec->u.els.d_id = d_id;
 	debug_event(dbf->san, level, rec, sizeof(*rec));
 	zfcp_dbf_hexdump(dbf->san, rec, sizeof(*rec), level,
 			 buffer, min(buflen, ZFCP_DBF_SAN_MAX_PAYLOAD));
@@ -777,12 +770,11 @@ static void zfcp_dbf_san_els(const char *tag, int level,
  */
 void zfcp_dbf_san_els_request(struct zfcp_fsf_req *fsf_req)
 {
-	struct zfcp_send_els *els = (struct zfcp_send_els *)fsf_req->data;
+	struct zfcp_fsf_ct_els *els = (struct zfcp_fsf_ct_els *)fsf_req->data;
+	u32 d_id = ntoh24(fsf_req->qtcb->bottom.support.d_id);
 
-	zfcp_dbf_san_els("oels", 2, fsf_req,
-			       fc_host_port_id(els->adapter->scsi_host),
-			       els->d_id, *(u8 *) sg_virt(els->req),
-			       sg_virt(els->req), els->req->length);
+	zfcp_dbf_san_els("oels", 2, fsf_req, d_id,
+			 sg_virt(els->req), els->req->length);
 }
 
 /**
@@ -791,12 +783,11 @@ void zfcp_dbf_san_els_request(struct zfcp_fsf_req *fsf_req)
  */
 void zfcp_dbf_san_els_response(struct zfcp_fsf_req *fsf_req)
 {
-	struct zfcp_send_els *els = (struct zfcp_send_els *)fsf_req->data;
+	struct zfcp_fsf_ct_els *els = (struct zfcp_fsf_ct_els *)fsf_req->data;
+	u32 d_id = ntoh24(fsf_req->qtcb->bottom.support.d_id);
 
-	zfcp_dbf_san_els("rels", 2, fsf_req, els->d_id,
-			       fc_host_port_id(els->adapter->scsi_host),
-			       *(u8 *)sg_virt(els->req), sg_virt(els->resp),
-			       els->resp->length);
+	zfcp_dbf_san_els("rels", 2, fsf_req, d_id,
+			       sg_virt(els->resp), els->resp->length);
 }
 
 /**
@@ -805,16 +796,13 @@ void zfcp_dbf_san_els_response(struct zfcp_fsf_req *fsf_req)
  */
 void zfcp_dbf_san_incoming_els(struct zfcp_fsf_req *fsf_req)
 {
-	struct zfcp_adapter *adapter = fsf_req->adapter;
 	struct fsf_status_read_buffer *buf =
 			(struct fsf_status_read_buffer *)fsf_req->data;
 	int length = (int)buf->length -
 		     (int)((void *)&buf->payload - (void *)buf);
 
-	zfcp_dbf_san_els("iels", 1, fsf_req, buf->d_id,
-			       fc_host_port_id(adapter->scsi_host),
-			       buf->payload.data[0], (void *)buf->payload.data,
-			       length);
+	zfcp_dbf_san_els("iels", 1, fsf_req, ntoh24(buf->d_id),
+			       (void *)buf->payload.data, length);
 }
 
 static int zfcp_dbf_san_view_format(debug_info_t *id, struct debug_view *view,
@@ -829,11 +817,10 @@ static int zfcp_dbf_san_view_format(debug_info_t *id, struct debug_view *view,
 	zfcp_dbf_tag(&p, "tag", r->tag);
 	zfcp_dbf_out(&p, "fsf_reqid", "0x%0Lx", r->fsf_reqid);
 	zfcp_dbf_out(&p, "fsf_seqno", "0x%08x", r->fsf_seqno);
-	zfcp_dbf_out(&p, "s_id", "0x%06x", r->s_id);
-	zfcp_dbf_out(&p, "d_id", "0x%06x", r->d_id);
 
 	if (strncmp(r->tag, "octc", ZFCP_DBF_TAG_SIZE) == 0) {
 		struct zfcp_dbf_san_record_ct_request *ct = &r->u.ct_req;
+		zfcp_dbf_out(&p, "d_id", "0x%06x", ct->d_id);
 		zfcp_dbf_out(&p, "cmd_req_code", "0x%04x", ct->cmd_req_code);
 		zfcp_dbf_out(&p, "revision", "0x%02x", ct->revision);
 		zfcp_dbf_out(&p, "gs_type", "0x%02x", ct->gs_type);
@@ -852,7 +839,7 @@ static int zfcp_dbf_san_view_format(debug_info_t *id, struct debug_view *view,
 		   strncmp(r->tag, "rels", ZFCP_DBF_TAG_SIZE) == 0 ||
 		   strncmp(r->tag, "iels", ZFCP_DBF_TAG_SIZE) == 0) {
 		struct zfcp_dbf_san_record_els *els = &r->u.els;
-		zfcp_dbf_out(&p, "ls_code", "0x%02x", els->ls_code);
+		zfcp_dbf_out(&p, "d_id", "0x%06x", els->d_id);
 	}
 	return p - out_buf;
 }
@@ -870,8 +857,9 @@ void _zfcp_dbf_scsi(const char *tag, const char *tag2, int level,
 	struct zfcp_dbf_scsi_record *rec = &dbf->scsi_buf;
 	struct zfcp_dbf_dump *dump = (struct zfcp_dbf_dump *)rec;
 	unsigned long flags;
-	struct fcp_rsp_iu *fcp_rsp;
-	char *fcp_rsp_info = NULL, *fcp_sns_info = NULL;
+	struct fcp_resp_with_ext *fcp_rsp;
+	struct fcp_resp_rsp_info *fcp_rsp_info = NULL;
+	char *fcp_sns_info = NULL;
 	int offset = 0, buflen = 0;
 
 	spin_lock_irqsave(&dbf->scsi_lock, flags);
@@ -895,20 +883,22 @@ void _zfcp_dbf_scsi(const char *tag, const char *tag2, int level,
 				rec->scsi_allowed = scsi_cmnd->allowed;
 			}
 			if (fsf_req != NULL) {
-				fcp_rsp = (struct fcp_rsp_iu *)
-				    &(fsf_req->qtcb->bottom.io.fcp_rsp);
-				fcp_rsp_info = (unsigned char *) &fcp_rsp[1];
-				fcp_sns_info =
-				    zfcp_get_fcp_sns_info_ptr(fcp_rsp);
-
-				rec->rsp_validity = fcp_rsp->validity.value;
-				rec->rsp_scsi_status = fcp_rsp->scsi_status;
-				rec->rsp_resid = fcp_rsp->fcp_resid;
-				if (fcp_rsp->validity.bits.fcp_rsp_len_valid)
-					rec->rsp_code = *(fcp_rsp_info + 3);
-				if (fcp_rsp->validity.bits.fcp_sns_len_valid) {
-					buflen = min((int)fcp_rsp->fcp_sns_len,
-						     ZFCP_DBF_SCSI_MAX_FCP_SNS_INFO);
+				fcp_rsp = (struct fcp_resp_with_ext *)
+					&(fsf_req->qtcb->bottom.io.fcp_rsp);
+				fcp_rsp_info = (struct fcp_resp_rsp_info *)
+					&fcp_rsp[1];
+				fcp_sns_info = (char *) &fcp_rsp[1];
+				if (fcp_rsp->resp.fr_flags & FCP_RSP_LEN_VAL)
+					fcp_sns_info += fcp_rsp->ext.fr_sns_len;
+
+				rec->rsp_validity = fcp_rsp->resp.fr_flags;
+				rec->rsp_scsi_status = fcp_rsp->resp.fr_status;
+				rec->rsp_resid = fcp_rsp->ext.fr_resid;
+				if (fcp_rsp->resp.fr_flags & FCP_RSP_LEN_VAL)
+					rec->rsp_code = fcp_rsp_info->rsp_code;
+				if (fcp_rsp->resp.fr_flags & FCP_SNS_LEN_VAL) {
+					buflen = min(fcp_rsp->ext.fr_sns_len,
+					   (u32)ZFCP_DBF_SCSI_MAX_FCP_SNS_INFO);
 					rec->sns_info_len = buflen;
 					memcpy(rec->sns_info, fcp_sns_info,
 					       min(buflen,
@@ -1067,6 +1057,8 @@ err_out:
  */
 void zfcp_dbf_adapter_unregister(struct zfcp_dbf *dbf)
 {
+	if (!dbf)
+		return;
 	debug_unregister(dbf->scsi);
 	debug_unregister(dbf->san);
 	debug_unregister(dbf->hba);
diff --git a/drivers/s390/scsi/zfcp_dbf.h b/drivers/s390/scsi/zfcp_dbf.h
index 6b1461e8f847..8b7fd9a1033e 100644
--- a/drivers/s390/scsi/zfcp_dbf.h
+++ b/drivers/s390/scsi/zfcp_dbf.h
@@ -22,6 +22,7 @@
 #ifndef ZFCP_DBF_H
 #define ZFCP_DBF_H
 
+#include <scsi/fc/fc_fcp.h>
 #include "zfcp_ext.h"
 #include "zfcp_fsf.h"
 #include "zfcp_def.h"
@@ -122,7 +123,6 @@ struct zfcp_dbf_hba_record_response {
 		} unit;
 		struct {
 			u32 d_id;
-			u8 ls_code;
 		} els;
 	} u;
 } __attribute__ ((packed));
@@ -166,6 +166,7 @@ struct zfcp_dbf_san_record_ct_request {
 	u8 options;
 	u16 max_res_size;
 	u32 len;
+	u32 d_id;
 } __attribute__ ((packed));
 
 struct zfcp_dbf_san_record_ct_response {
@@ -179,16 +180,13 @@ struct zfcp_dbf_san_record_ct_response {
 } __attribute__ ((packed));
 
 struct zfcp_dbf_san_record_els {
-	u8 ls_code;
-	u32 len;
+	u32 d_id;
 } __attribute__ ((packed));
 
 struct zfcp_dbf_san_record {
 	u8 tag[ZFCP_DBF_TAG_SIZE];
 	u64 fsf_reqid;
 	u32 fsf_seqno;
-	u32 s_id;
-	u32 d_id;
 	union {
 		struct zfcp_dbf_san_record_ct_request ct_req;
 		struct zfcp_dbf_san_record_ct_response ct_resp;
@@ -343,7 +341,7 @@ static inline
 void zfcp_dbf_scsi_devreset(const char *tag, u8 flag, struct zfcp_unit *unit,
 			    struct scsi_cmnd *scsi_cmnd)
 {
-	zfcp_dbf_scsi(flag == FCP_TARGET_RESET ? "trst" : "lrst", tag, 1,
+	zfcp_dbf_scsi(flag == FCP_TMF_TGT_RESET ? "trst" : "lrst", tag, 1,
 			    unit->port->adapter->dbf, scsi_cmnd, NULL, 0);
 }
 
diff --git a/drivers/s390/scsi/zfcp_def.h b/drivers/s390/scsi/zfcp_def.h
index 7da2fad8f515..e1b5b88e2ddb 100644
--- a/drivers/s390/scsi/zfcp_def.h
+++ b/drivers/s390/scsi/zfcp_def.h
@@ -71,131 +71,6 @@
 /* timeout value for "default timer" for fsf requests */
 #define ZFCP_FSF_REQUEST_TIMEOUT (60*HZ)
 
-/*************** FIBRE CHANNEL PROTOCOL SPECIFIC DEFINES ********************/
-
-/* task attribute values in FCP-2 FCP_CMND IU */
-#define SIMPLE_Q	0
-#define HEAD_OF_Q	1
-#define ORDERED_Q	2
-#define ACA_Q		4
-#define UNTAGGED	5
-
-/* task management flags in FCP-2 FCP_CMND IU */
-#define FCP_CLEAR_ACA		0x40
-#define FCP_TARGET_RESET	0x20
-#define FCP_LOGICAL_UNIT_RESET	0x10
-#define FCP_CLEAR_TASK_SET	0x04
-#define FCP_ABORT_TASK_SET	0x02
-
-#define FCP_CDB_LENGTH		16
-
-#define ZFCP_DID_MASK           0x00FFFFFF
-
-/* FCP(-2) FCP_CMND IU */
-struct fcp_cmnd_iu {
-	u64 fcp_lun;	   /* FCP logical unit number */
-	u8  crn;	           /* command reference number */
-	u8  reserved0:5;	   /* reserved */
-	u8  task_attribute:3;	   /* task attribute */
-	u8  task_management_flags; /* task management flags */
-	u8  add_fcp_cdb_length:6;  /* additional FCP_CDB length */
-	u8  rddata:1;              /* read data */
-	u8  wddata:1;              /* write data */
-	u8  fcp_cdb[FCP_CDB_LENGTH];
-} __attribute__((packed));
-
-/* FCP(-2) FCP_RSP IU */
-struct fcp_rsp_iu {
-	u8  reserved0[10];
-	union {
-		struct {
-			u8 reserved1:3;
-			u8 fcp_conf_req:1;
-			u8 fcp_resid_under:1;
-			u8 fcp_resid_over:1;
-			u8 fcp_sns_len_valid:1;
-			u8 fcp_rsp_len_valid:1;
-		} bits;
-		u8 value;
-	} validity;
-	u8  scsi_status;
-	u32 fcp_resid;
-	u32 fcp_sns_len;
-	u32 fcp_rsp_len;
-} __attribute__((packed));
-
-
-#define RSP_CODE_GOOD		 0
-#define RSP_CODE_LENGTH_MISMATCH 1
-#define RSP_CODE_FIELD_INVALID	 2
-#define RSP_CODE_RO_MISMATCH	 3
-#define RSP_CODE_TASKMAN_UNSUPP	 4
-#define RSP_CODE_TASKMAN_FAILED	 5
-
-/* see fc-fs */
-#define LS_RSCN  0x61
-#define LS_LOGO  0x05
-#define LS_PLOGI 0x03
-
-struct fcp_rscn_head {
-        u8  command;
-        u8  page_length; /* always 0x04 */
-        u16 payload_len;
-} __attribute__((packed));
-
-struct fcp_rscn_element {
-        u8  reserved:2;
-        u8  event_qual:4;
-        u8  addr_format:2;
-        u32 nport_did:24;
-} __attribute__((packed));
-
-/* see fc-ph */
-struct fcp_logo {
-        u32 command;
-        u32 nport_did;
-	u64 nport_wwpn;
-} __attribute__((packed));
-
-/*
- * FC-FS stuff
- */
-#define R_A_TOV				10 /* seconds */
-
-#define ZFCP_LS_RLS			0x0f
-#define ZFCP_LS_ADISC			0x52
-#define ZFCP_LS_RPS			0x56
-#define ZFCP_LS_RSCN			0x61
-#define ZFCP_LS_RNID			0x78
-
-struct zfcp_ls_adisc {
-	u8		code;
-	u8		field[3];
-	u32		hard_nport_id;
-	u64		wwpn;
-	u64		wwnn;
-	u32		nport_id;
-} __attribute__ ((packed));
-
-/*
- * FC-GS-2 stuff
- */
-#define ZFCP_CT_REVISION		0x01
-#define ZFCP_CT_DIRECTORY_SERVICE	0xFC
-#define ZFCP_CT_NAME_SERVER		0x02
-#define ZFCP_CT_SYNCHRONOUS		0x00
-#define ZFCP_CT_SCSI_FCP		0x08
-#define ZFCP_CT_UNABLE_TO_PERFORM_CMD	0x09
-#define ZFCP_CT_GID_PN			0x0121
-#define ZFCP_CT_GPN_FT			0x0172
-#define ZFCP_CT_ACCEPT			0x8002
-#define ZFCP_CT_REJECT			0x8001
-
-/*
- * FC-GS-4 stuff
- */
-#define ZFCP_CT_TIMEOUT			(3 * R_A_TOV)
-
 /*************** ADAPTER/PORT/UNIT AND FSF_REQ STATUS FLAGS ******************/
 
 /*
@@ -205,7 +80,6 @@ struct zfcp_ls_adisc {
 #define ZFCP_COMMON_FLAGS			0xfff00000
 
 /* common status bits */
-#define ZFCP_STATUS_COMMON_REMOVE		0x80000000
 #define ZFCP_STATUS_COMMON_RUNNING		0x40000000
 #define ZFCP_STATUS_COMMON_ERP_FAILED		0x20000000
 #define ZFCP_STATUS_COMMON_UNBLOCKED		0x10000000
@@ -222,21 +96,10 @@ struct zfcp_ls_adisc {
 #define ZFCP_STATUS_ADAPTER_ERP_PENDING		0x00000100
 #define ZFCP_STATUS_ADAPTER_LINK_UNPLUGGED	0x00000200
 
-/* FC-PH/FC-GS well-known address identifiers for generic services */
-#define ZFCP_DID_WKA				0xFFFFF0
-
 /* remote port status */
 #define ZFCP_STATUS_PORT_PHYS_OPEN		0x00000001
 #define ZFCP_STATUS_PORT_LINK_TEST		0x00000002
 
-/* well known address (WKA) port status*/
-enum zfcp_wka_status {
-	ZFCP_WKA_PORT_OFFLINE,
-	ZFCP_WKA_PORT_CLOSING,
-	ZFCP_WKA_PORT_OPENING,
-	ZFCP_WKA_PORT_ONLINE,
-};
-
 /* logical unit status */
 #define ZFCP_STATUS_UNIT_SHARED			0x00000004
 #define ZFCP_STATUS_UNIT_READONLY		0x00000008
@@ -247,10 +110,7 @@ enum zfcp_wka_status {
 #define ZFCP_STATUS_FSFREQ_CLEANUP		0x00000010
 #define ZFCP_STATUS_FSFREQ_ABORTSUCCEEDED	0x00000040
 #define ZFCP_STATUS_FSFREQ_ABORTNOTNEEDED       0x00000080
-#define ZFCP_STATUS_FSFREQ_ABORTED              0x00000100
 #define ZFCP_STATUS_FSFREQ_TMFUNCFAILED         0x00000200
-#define ZFCP_STATUS_FSFREQ_TMFUNCNOTSUPP        0x00000400
-#define ZFCP_STATUS_FSFREQ_RETRY                0x00000800
 #define ZFCP_STATUS_FSFREQ_DISMISSED            0x00001000
 
 /************************* STRUCTURE DEFINITIONS *****************************/
@@ -265,125 +125,10 @@ struct zfcp_adapter_mempool {
 	mempool_t *scsi_abort;
 	mempool_t *status_read_req;
 	mempool_t *status_read_data;
-	mempool_t *gid_pn_data;
+	mempool_t *gid_pn;
 	mempool_t *qtcb_pool;
 };
 
-/*
- * header for CT_IU
- */
-struct ct_hdr {
-	u8 revision;		// 0x01
-	u8 in_id[3];		// 0x00
-	u8 gs_type;		// 0xFC	Directory Service
-	u8 gs_subtype;		// 0x02	Name Server
-	u8 options;		// 0x00 single bidirectional exchange
-	u8 reserved0;
-	u16 cmd_rsp_code;	// 0x0121 GID_PN, or 0x0100 GA_NXT
-	u16 max_res_size;	// <= (4096 - 16) / 4
-	u8 reserved1;
-	u8 reason_code;
-	u8 reason_code_expl;
-	u8 vendor_unique;
-} __attribute__ ((packed));
-
-/* nameserver request CT_IU -- for requests where
- * a port name is required */
-struct ct_iu_gid_pn_req {
-	struct ct_hdr header;
-	u64 wwpn;
-} __attribute__ ((packed));
-
-/* FS_ACC IU and data unit for GID_PN nameserver request */
-struct ct_iu_gid_pn_resp {
-	struct ct_hdr header;
-	u32 d_id;
-} __attribute__ ((packed));
-
-struct ct_iu_gpn_ft_req {
-	struct ct_hdr header;
-	u8 flags;
-	u8 domain_id_scope;
-	u8 area_id_scope;
-	u8 fc4_type;
-} __attribute__ ((packed));
-
-
-/**
- * struct zfcp_send_ct - used to pass parameters to function zfcp_fsf_send_ct
- * @wka_port: port where the request is sent to
- * @req: scatter-gather list for request
- * @resp: scatter-gather list for response
- * @handler: handler function (called for response to the request)
- * @handler_data: data passed to handler function
- * @completion: completion for synchronization purposes
- * @status: used to pass error status to calling function
- */
-struct zfcp_send_ct {
-	struct zfcp_wka_port *wka_port;
-	struct scatterlist *req;
-	struct scatterlist *resp;
-	void (*handler)(unsigned long);
-	unsigned long handler_data;
-	struct completion *completion;
-	int status;
-};
-
-/* used for name server requests in error recovery */
-struct zfcp_gid_pn_data {
-	struct zfcp_send_ct ct;
-	struct scatterlist req;
-	struct scatterlist resp;
-	struct ct_iu_gid_pn_req ct_iu_req;
-	struct ct_iu_gid_pn_resp ct_iu_resp;
-        struct zfcp_port *port;
-};
-
-/**
- * struct zfcp_send_els - used to pass parameters to function zfcp_fsf_send_els
- * @adapter: adapter where request is sent from
- * @port: port where ELS is destinated (port reference count has to be increased)
- * @d_id: destiniation id of port where request is sent to
- * @req: scatter-gather list for request
- * @resp: scatter-gather list for response
- * @handler: handler function (called for response to the request)
- * @handler_data: data passed to handler function
- * @completion: completion for synchronization purposes
- * @ls_code: hex code of ELS command
- * @status: used to pass error status to calling function
- */
-struct zfcp_send_els {
-	struct zfcp_adapter *adapter;
-	struct zfcp_port *port;
-	u32 d_id;
-	struct scatterlist *req;
-	struct scatterlist *resp;
-	void (*handler)(unsigned long);
-	unsigned long handler_data;
-	struct completion *completion;
-	int ls_code;
-	int status;
-};
-
-struct zfcp_wka_port {
-	struct zfcp_adapter	*adapter;
-	wait_queue_head_t	completion_wq;
-	enum zfcp_wka_status	status;
-	atomic_t		refcount;
-	u32			d_id;
-	u32			handle;
-	struct mutex		mutex;
-	struct delayed_work	work;
-};
-
-struct zfcp_wka_ports {
-	struct zfcp_wka_port ms; 	/* management service */
-	struct zfcp_wka_port ts; 	/* time service */
-	struct zfcp_wka_port ds; 	/* directory service */
-	struct zfcp_wka_port as; 	/* alias service */
-	struct zfcp_wka_port ks; 	/* key distribution service */
-};
-
 struct zfcp_qdio_queue {
 	struct qdio_buffer *sbal[QDIO_MAX_BUFFERS_PER_Q];
 	u8		   first;	/* index of next free bfr in queue */
@@ -446,9 +191,7 @@ struct zfcp_qdio {
 };
 
 struct zfcp_adapter {
-	atomic_t                refcount;          /* reference count */
-	wait_queue_head_t	remove_wq;         /* can be used to wait for
-						      refcount drop to zero */
+	struct kref		ref;
 	u64			peer_wwnn;	   /* P2P peer WWNN */
 	u64			peer_wwpn;	   /* P2P peer WWPN */
 	u32			peer_d_id;	   /* P2P peer D_ID */
@@ -461,7 +204,8 @@ struct zfcp_adapter {
         u32			hardware_version;  /* of FCP channel */
 	u16			timer_ticks;       /* time int for a tick */
 	struct Scsi_Host	*scsi_host;	   /* Pointer to mid-layer */
-	struct list_head	port_list_head;	   /* remote port list */
+	struct list_head	port_list;	   /* remote port list */
+	rwlock_t		port_list_lock;    /* port list lock */
 	unsigned long		req_no;		   /* unique FSF req number */
 	struct list_head	*req_list;	   /* list of pending reqs */
 	spinlock_t		req_list_lock;	   /* request list lock */
@@ -485,7 +229,7 @@ struct zfcp_adapter {
 	u32			erp_low_mem_count; /* nr of erp actions waiting
 						      for memory */
 	struct task_struct	*erp_thread;
-	struct zfcp_wka_ports	*gs;		   /* generic services */
+	struct zfcp_fc_wka_ports *gs;		   /* generic services */
 	struct zfcp_dbf		*dbf;		   /* debug traces */
 	struct zfcp_adapter_mempool	pool;      /* Adapter memory pools */
 	struct fc_host_statistics *fc_stats;
@@ -500,11 +244,9 @@ struct zfcp_port {
 	struct device          sysfs_device;   /* sysfs device */
 	struct fc_rport        *rport;         /* rport of fc transport class */
 	struct list_head       list;	       /* list of remote ports */
-	atomic_t               refcount;       /* reference count */
-	wait_queue_head_t      remove_wq;      /* can be used to wait for
-						  refcount drop to zero */
 	struct zfcp_adapter    *adapter;       /* adapter used to access port */
-	struct list_head       unit_list_head; /* head of logical unit list */
+	struct list_head	unit_list;	/* head of logical unit list */
+	rwlock_t		unit_list_lock; /* unit list lock */
 	atomic_t	       status;	       /* status of this remote port */
 	u64		       wwnn;	       /* WWNN if known */
 	u64		       wwpn;	       /* WWPN */
@@ -523,9 +265,6 @@ struct zfcp_port {
 struct zfcp_unit {
 	struct device          sysfs_device;   /* sysfs device */
 	struct list_head       list;	       /* list of logical units */
-	atomic_t               refcount;       /* reference count */
-	wait_queue_head_t      remove_wq;      /* can be used to wait for
-						  refcount drop to zero */
 	struct zfcp_port       *port;	       /* remote port of unit */
 	atomic_t	       status;	       /* status of this logical unit */
 	u64		       fcp_lun;	       /* own FCP_LUN */
@@ -601,14 +340,11 @@ struct zfcp_fsf_req {
 struct zfcp_data {
 	struct scsi_host_template scsi_host_template;
 	struct scsi_transport_template *scsi_transport_template;
-	rwlock_t                config_lock;        /* serialises changes
-						       to adapter/port/unit
-						       lists */
-	struct mutex		config_mutex;
 	struct kmem_cache	*gpn_ft_cache;
 	struct kmem_cache	*qtcb_cache;
 	struct kmem_cache	*sr_buffer_cache;
 	struct kmem_cache	*gid_pn_cache;
+	struct kmem_cache	*adisc_cache;
 };
 
 /********************** ZFCP SPECIFIC DEFINES ********************************/
@@ -657,47 +393,4 @@ zfcp_reqlist_find_safe(struct zfcp_adapter *adapter, struct zfcp_fsf_req *req)
 	return NULL;
 }
 
-/*
- *  functions needed for reference/usage counting
- */
-
-static inline void
-zfcp_unit_get(struct zfcp_unit *unit)
-{
-	atomic_inc(&unit->refcount);
-}
-
-static inline void
-zfcp_unit_put(struct zfcp_unit *unit)
-{
-	if (atomic_dec_return(&unit->refcount) == 0)
-		wake_up(&unit->remove_wq);
-}
-
-static inline void
-zfcp_port_get(struct zfcp_port *port)
-{
-	atomic_inc(&port->refcount);
-}
-
-static inline void
-zfcp_port_put(struct zfcp_port *port)
-{
-	if (atomic_dec_return(&port->refcount) == 0)
-		wake_up(&port->remove_wq);
-}
-
-static inline void
-zfcp_adapter_get(struct zfcp_adapter *adapter)
-{
-	atomic_inc(&adapter->refcount);
-}
-
-static inline void
-zfcp_adapter_put(struct zfcp_adapter *adapter)
-{
-	if (atomic_dec_return(&adapter->refcount) == 0)
-		wake_up(&adapter->remove_wq);
-}
-
 #endif /* ZFCP_DEF_H */
diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c
index f73e2180f333..b51a11a82e63 100644
--- a/drivers/s390/scsi/zfcp_erp.c
+++ b/drivers/s390/scsi/zfcp_erp.c
@@ -99,9 +99,12 @@ static void zfcp_erp_action_dismiss_port(struct zfcp_port *port)
 
 	if (atomic_read(&port->status) & ZFCP_STATUS_COMMON_ERP_INUSE)
 		zfcp_erp_action_dismiss(&port->erp_action);
-	else
-		list_for_each_entry(unit, &port->unit_list_head, list)
-		    zfcp_erp_action_dismiss_unit(unit);
+	else {
+		read_lock(&port->unit_list_lock);
+		list_for_each_entry(unit, &port->unit_list, list)
+			zfcp_erp_action_dismiss_unit(unit);
+		read_unlock(&port->unit_list_lock);
+	}
 }
 
 static void zfcp_erp_action_dismiss_adapter(struct zfcp_adapter *adapter)
@@ -110,9 +113,12 @@ static void zfcp_erp_action_dismiss_adapter(struct zfcp_adapter *adapter)
 
 	if (atomic_read(&adapter->status) & ZFCP_STATUS_COMMON_ERP_INUSE)
 		zfcp_erp_action_dismiss(&adapter->erp_action);
-	else
-		list_for_each_entry(port, &adapter->port_list_head, list)
+	else {
+		read_lock(&adapter->port_list_lock);
+		list_for_each_entry(port, &adapter->port_list, list)
 		    zfcp_erp_action_dismiss_port(port);
+		read_unlock(&adapter->port_list_lock);
+	}
 }
 
 static int zfcp_erp_required_act(int want, struct zfcp_adapter *adapter,
@@ -168,7 +174,8 @@ static struct zfcp_erp_action *zfcp_erp_setup_act(int need,
 
 	switch (need) {
 	case ZFCP_ERP_ACTION_REOPEN_UNIT:
-		zfcp_unit_get(unit);
+		if (!get_device(&unit->sysfs_device))
+			return NULL;
 		atomic_set_mask(ZFCP_STATUS_COMMON_ERP_INUSE, &unit->status);
 		erp_action = &unit->erp_action;
 		if (!(atomic_read(&unit->status) & ZFCP_STATUS_COMMON_RUNNING))
@@ -177,7 +184,8 @@ static struct zfcp_erp_action *zfcp_erp_setup_act(int need,
 
 	case ZFCP_ERP_ACTION_REOPEN_PORT:
 	case ZFCP_ERP_ACTION_REOPEN_PORT_FORCED:
-		zfcp_port_get(port);
+		if (!get_device(&port->sysfs_device))
+			return NULL;
 		zfcp_erp_action_dismiss_port(port);
 		atomic_set_mask(ZFCP_STATUS_COMMON_ERP_INUSE, &port->status);
 		erp_action = &port->erp_action;
@@ -186,7 +194,7 @@ static struct zfcp_erp_action *zfcp_erp_setup_act(int need,
 		break;
 
 	case ZFCP_ERP_ACTION_REOPEN_ADAPTER:
-		zfcp_adapter_get(adapter);
+		kref_get(&adapter->ref);
 		zfcp_erp_action_dismiss_adapter(adapter);
 		atomic_set_mask(ZFCP_STATUS_COMMON_ERP_INUSE, &adapter->status);
 		erp_action = &adapter->erp_action;
@@ -264,11 +272,16 @@ void zfcp_erp_adapter_reopen(struct zfcp_adapter *adapter, int clear,
 {
 	unsigned long flags;
 
-	read_lock_irqsave(&zfcp_data.config_lock, flags);
-	write_lock(&adapter->erp_lock);
-	_zfcp_erp_adapter_reopen(adapter, clear, id, ref);
-	write_unlock(&adapter->erp_lock);
-	read_unlock_irqrestore(&zfcp_data.config_lock, flags);
+	zfcp_erp_adapter_block(adapter, clear);
+	zfcp_scsi_schedule_rports_block(adapter);
+
+	write_lock_irqsave(&adapter->erp_lock, flags);
+	if (atomic_read(&adapter->status) & ZFCP_STATUS_COMMON_ERP_FAILED)
+		zfcp_erp_adapter_failed(adapter, "erareo1", NULL);
+	else
+		zfcp_erp_action_enqueue(ZFCP_ERP_ACTION_REOPEN_ADAPTER, adapter,
+					NULL, NULL, id, ref);
+	write_unlock_irqrestore(&adapter->erp_lock, flags);
 }
 
 /**
@@ -345,11 +358,9 @@ void zfcp_erp_port_forced_reopen(struct zfcp_port *port, int clear, char *id,
 	unsigned long flags;
 	struct zfcp_adapter *adapter = port->adapter;
 
-	read_lock_irqsave(&zfcp_data.config_lock, flags);
-	write_lock(&adapter->erp_lock);
+	write_lock_irqsave(&adapter->erp_lock, flags);
 	_zfcp_erp_port_forced_reopen(port, clear, id, ref);
-	write_unlock(&adapter->erp_lock);
-	read_unlock_irqrestore(&zfcp_data.config_lock, flags);
+	write_unlock_irqrestore(&adapter->erp_lock, flags);
 }
 
 static int _zfcp_erp_port_reopen(struct zfcp_port *port, int clear, char *id,
@@ -377,15 +388,13 @@ static int _zfcp_erp_port_reopen(struct zfcp_port *port, int clear, char *id,
  */
 int zfcp_erp_port_reopen(struct zfcp_port *port, int clear, char *id, void *ref)
 {
-	unsigned long flags;
 	int retval;
+	unsigned long flags;
 	struct zfcp_adapter *adapter = port->adapter;
 
-	read_lock_irqsave(&zfcp_data.config_lock, flags);
-	write_lock(&adapter->erp_lock);
+	write_lock_irqsave(&adapter->erp_lock, flags);
 	retval = _zfcp_erp_port_reopen(port, clear, id, ref);
-	write_unlock(&adapter->erp_lock);
-	read_unlock_irqrestore(&zfcp_data.config_lock, flags);
+	write_unlock_irqrestore(&adapter->erp_lock, flags);
 
 	return retval;
 }
@@ -424,11 +433,9 @@ void zfcp_erp_unit_reopen(struct zfcp_unit *unit, int clear, char *id,
 	struct zfcp_port *port = unit->port;
 	struct zfcp_adapter *adapter = port->adapter;
 
-	read_lock_irqsave(&zfcp_data.config_lock, flags);
-	write_lock(&adapter->erp_lock);
+	write_lock_irqsave(&adapter->erp_lock, flags);
 	_zfcp_erp_unit_reopen(unit, clear, id, ref);
-	write_unlock(&adapter->erp_lock);
-	read_unlock_irqrestore(&zfcp_data.config_lock, flags);
+	write_unlock_irqrestore(&adapter->erp_lock, flags);
 }
 
 static int status_change_set(unsigned long mask, atomic_t *status)
@@ -540,8 +547,10 @@ static void _zfcp_erp_port_reopen_all(struct zfcp_adapter *adapter,
 {
 	struct zfcp_port *port;
 
-	list_for_each_entry(port, &adapter->port_list_head, list)
+	read_lock(&adapter->port_list_lock);
+	list_for_each_entry(port, &adapter->port_list, list)
 		_zfcp_erp_port_reopen(port, clear, id, ref);
+	read_unlock(&adapter->port_list_lock);
 }
 
 static void _zfcp_erp_unit_reopen_all(struct zfcp_port *port, int clear,
@@ -549,8 +558,10 @@ static void _zfcp_erp_unit_reopen_all(struct zfcp_port *port, int clear,
 {
 	struct zfcp_unit *unit;
 
-	list_for_each_entry(unit, &port->unit_list_head, list)
+	read_lock(&port->unit_list_lock);
+	list_for_each_entry(unit, &port->unit_list, list)
 		_zfcp_erp_unit_reopen(unit, clear, id, ref);
+	read_unlock(&port->unit_list_lock);
 }
 
 static void zfcp_erp_strategy_followup_failed(struct zfcp_erp_action *act)
@@ -590,16 +601,14 @@ static void zfcp_erp_wakeup(struct zfcp_adapter *adapter)
 {
 	unsigned long flags;
 
-	read_lock_irqsave(&zfcp_data.config_lock, flags);
-	read_lock(&adapter->erp_lock);
+	read_lock_irqsave(&adapter->erp_lock, flags);
 	if (list_empty(&adapter->erp_ready_head) &&
 	    list_empty(&adapter->erp_running_head)) {
 			atomic_clear_mask(ZFCP_STATUS_ADAPTER_ERP_PENDING,
 					  &adapter->status);
 			wake_up(&adapter->erp_done_wqh);
 	}
-	read_unlock(&adapter->erp_lock);
-	read_unlock_irqrestore(&zfcp_data.config_lock, flags);
+	read_unlock_irqrestore(&adapter->erp_lock, flags);
 }
 
 static int zfcp_erp_adapter_strategy_open_qdio(struct zfcp_erp_action *act)
@@ -1170,28 +1179,28 @@ static void zfcp_erp_action_cleanup(struct zfcp_erp_action *act, int result)
 	switch (act->action) {
 	case ZFCP_ERP_ACTION_REOPEN_UNIT:
 		if ((result == ZFCP_ERP_SUCCEEDED) && !unit->device) {
-			zfcp_unit_get(unit);
+			get_device(&unit->sysfs_device);
 			if (scsi_queue_work(unit->port->adapter->scsi_host,
 					    &unit->scsi_work) <= 0)
-				zfcp_unit_put(unit);
+				put_device(&unit->sysfs_device);
 		}
-		zfcp_unit_put(unit);
+		put_device(&unit->sysfs_device);
 		break;
 
 	case ZFCP_ERP_ACTION_REOPEN_PORT_FORCED:
 	case ZFCP_ERP_ACTION_REOPEN_PORT:
 		if (result == ZFCP_ERP_SUCCEEDED)
 			zfcp_scsi_schedule_rport_register(port);
-		zfcp_port_put(port);
+		put_device(&port->sysfs_device);
 		break;
 
 	case ZFCP_ERP_ACTION_REOPEN_ADAPTER:
 		if (result == ZFCP_ERP_SUCCEEDED) {
 			register_service_level(&adapter->service_level);
-			schedule_work(&adapter->scan_work);
+			queue_work(adapter->work_queue, &adapter->scan_work);
 		} else
 			unregister_service_level(&adapter->service_level);
-		zfcp_adapter_put(adapter);
+		kref_put(&adapter->ref, zfcp_adapter_release);
 		break;
 	}
 }
@@ -1214,12 +1223,12 @@ static int zfcp_erp_strategy_do_action(struct zfcp_erp_action *erp_action)
 static int zfcp_erp_strategy(struct zfcp_erp_action *erp_action)
 {
 	int retval;
-	struct zfcp_adapter *adapter = erp_action->adapter;
 	unsigned long flags;
+	struct zfcp_adapter *adapter = erp_action->adapter;
 
-	read_lock_irqsave(&zfcp_data.config_lock, flags);
-	write_lock(&adapter->erp_lock);
+	kref_get(&adapter->ref);
 
+	write_lock_irqsave(&adapter->erp_lock, flags);
 	zfcp_erp_strategy_check_fsfreq(erp_action);
 
 	if (erp_action->status & ZFCP_STATUS_ERP_DISMISSED) {
@@ -1231,11 +1240,9 @@ static int zfcp_erp_strategy(struct zfcp_erp_action *erp_action)
 	zfcp_erp_action_to_running(erp_action);
 
 	/* no lock to allow for blocking operations */
-	write_unlock(&adapter->erp_lock);
-	read_unlock_irqrestore(&zfcp_data.config_lock, flags);
+	write_unlock_irqrestore(&adapter->erp_lock, flags);
 	retval = zfcp_erp_strategy_do_action(erp_action);
-	read_lock_irqsave(&zfcp_data.config_lock, flags);
-	write_lock(&adapter->erp_lock);
+	write_lock_irqsave(&adapter->erp_lock, flags);
 
 	if (erp_action->status & ZFCP_STATUS_ERP_DISMISSED)
 		retval = ZFCP_ERP_CONTINUES;
@@ -1273,12 +1280,12 @@ static int zfcp_erp_strategy(struct zfcp_erp_action *erp_action)
 		zfcp_erp_strategy_followup_failed(erp_action);
 
  unlock:
-	write_unlock(&adapter->erp_lock);
-	read_unlock_irqrestore(&zfcp_data.config_lock, flags);
+	write_unlock_irqrestore(&adapter->erp_lock, flags);
 
 	if (retval != ZFCP_ERP_CONTINUES)
 		zfcp_erp_action_cleanup(erp_action, retval);
 
+	kref_put(&adapter->ref, zfcp_adapter_release);
 	return retval;
 }
 
@@ -1415,6 +1422,7 @@ void zfcp_erp_modify_adapter_status(struct zfcp_adapter *adapter, char *id,
 				    void *ref, u32 mask, int set_or_clear)
 {
 	struct zfcp_port *port;
+	unsigned long flags;
 	u32 common_mask = mask & ZFCP_COMMON_FLAGS;
 
 	if (set_or_clear == ZFCP_SET) {
@@ -1429,10 +1437,13 @@ void zfcp_erp_modify_adapter_status(struct zfcp_adapter *adapter, char *id,
 			atomic_set(&adapter->erp_counter, 0);
 	}
 
-	if (common_mask)
-		list_for_each_entry(port, &adapter->port_list_head, list)
+	if (common_mask) {
+		read_lock_irqsave(&adapter->port_list_lock, flags);
+		list_for_each_entry(port, &adapter->port_list, list)
 			zfcp_erp_modify_port_status(port, id, ref, common_mask,
 						    set_or_clear);
+		read_unlock_irqrestore(&adapter->port_list_lock, flags);
+	}
 }
 
 /**
@@ -1449,6 +1460,7 @@ void zfcp_erp_modify_port_status(struct zfcp_port *port, char *id, void *ref,
 				 u32 mask, int set_or_clear)
 {
 	struct zfcp_unit *unit;
+	unsigned long flags;
 	u32 common_mask = mask & ZFCP_COMMON_FLAGS;
 
 	if (set_or_clear == ZFCP_SET) {
@@ -1463,10 +1475,13 @@ void zfcp_erp_modify_port_status(struct zfcp_port *port, char *id, void *ref,
 			atomic_set(&port->erp_counter, 0);
 	}
 
-	if (common_mask)
-		list_for_each_entry(unit, &port->unit_list_head, list)
+	if (common_mask) {
+		read_lock_irqsave(&port->unit_list_lock, flags);
+		list_for_each_entry(unit, &port->unit_list, list)
 			zfcp_erp_modify_unit_status(unit, id, ref, common_mask,
 						    set_or_clear);
+		read_unlock_irqrestore(&port->unit_list_lock, flags);
+	}
 }
 
 /**
@@ -1502,12 +1517,8 @@ void zfcp_erp_modify_unit_status(struct zfcp_unit *unit, char *id, void *ref,
  */
 void zfcp_erp_port_boxed(struct zfcp_port *port, char *id, void *ref)
 {
-	unsigned long flags;
-
-	read_lock_irqsave(&zfcp_data.config_lock, flags);
 	zfcp_erp_modify_port_status(port, id, ref,
 				    ZFCP_STATUS_COMMON_ACCESS_BOXED, ZFCP_SET);
-	read_unlock_irqrestore(&zfcp_data.config_lock, flags);
 	zfcp_erp_port_reopen(port, ZFCP_STATUS_COMMON_ERP_FAILED, id, ref);
 }
 
@@ -1535,13 +1546,9 @@ void zfcp_erp_unit_boxed(struct zfcp_unit *unit, char *id, void *ref)
  */
 void zfcp_erp_port_access_denied(struct zfcp_port *port, char *id, void *ref)
 {
-	unsigned long flags;
-
-	read_lock_irqsave(&zfcp_data.config_lock, flags);
 	zfcp_erp_modify_port_status(port, id, ref,
 				    ZFCP_STATUS_COMMON_ERP_FAILED |
 				    ZFCP_STATUS_COMMON_ACCESS_DENIED, ZFCP_SET);
-	read_unlock_irqrestore(&zfcp_data.config_lock, flags);
 }
 
 /**
@@ -1574,12 +1581,15 @@ static void zfcp_erp_port_access_changed(struct zfcp_port *port, char *id,
 					 void *ref)
 {
 	struct zfcp_unit *unit;
+	unsigned long flags;
 	int status = atomic_read(&port->status);
 
 	if (!(status & (ZFCP_STATUS_COMMON_ACCESS_DENIED |
 			ZFCP_STATUS_COMMON_ACCESS_BOXED))) {
-		list_for_each_entry(unit, &port->unit_list_head, list)
+		read_lock_irqsave(&port->unit_list_lock, flags);
+		list_for_each_entry(unit, &port->unit_list, list)
 				    zfcp_erp_unit_access_changed(unit, id, ref);
+		read_unlock_irqrestore(&port->unit_list_lock, flags);
 		return;
 	}
 
@@ -1595,14 +1605,14 @@ static void zfcp_erp_port_access_changed(struct zfcp_port *port, char *id,
 void zfcp_erp_adapter_access_changed(struct zfcp_adapter *adapter, char *id,
 				     void *ref)
 {
-	struct zfcp_port *port;
 	unsigned long flags;
+	struct zfcp_port *port;
 
 	if (adapter->connection_features & FSF_FEATURE_NPIV_MODE)
 		return;
 
-	read_lock_irqsave(&zfcp_data.config_lock, flags);
-	list_for_each_entry(port, &adapter->port_list_head, list)
+	read_lock_irqsave(&adapter->port_list_lock, flags);
+	list_for_each_entry(port, &adapter->port_list, list)
 		zfcp_erp_port_access_changed(port, id, ref);
-	read_unlock_irqrestore(&zfcp_data.config_lock, flags);
+	read_unlock_irqrestore(&adapter->port_list_lock, flags);
 }
diff --git a/drivers/s390/scsi/zfcp_ext.h b/drivers/s390/scsi/zfcp_ext.h
index b3f28deb4505..03dec832b465 100644
--- a/drivers/s390/scsi/zfcp_ext.h
+++ b/drivers/s390/scsi/zfcp_ext.h
@@ -9,26 +9,31 @@
 #ifndef ZFCP_EXT_H
 #define ZFCP_EXT_H
 
+#include <linux/types.h>
+#include <scsi/fc/fc_els.h>
 #include "zfcp_def.h"
+#include "zfcp_fc.h"
 
 /* zfcp_aux.c */
 extern struct zfcp_unit *zfcp_get_unit_by_lun(struct zfcp_port *, u64);
 extern struct zfcp_port *zfcp_get_port_by_wwpn(struct zfcp_adapter *, u64);
-extern int zfcp_adapter_enqueue(struct ccw_device *);
-extern void zfcp_adapter_dequeue(struct zfcp_adapter *);
+extern struct zfcp_adapter *zfcp_adapter_enqueue(struct ccw_device *);
 extern struct zfcp_port *zfcp_port_enqueue(struct zfcp_adapter *, u64, u32,
 					   u32);
-extern void zfcp_port_dequeue(struct zfcp_port *);
 extern struct zfcp_unit *zfcp_unit_enqueue(struct zfcp_port *, u64);
-extern void zfcp_unit_dequeue(struct zfcp_unit *);
 extern int zfcp_reqlist_isempty(struct zfcp_adapter *);
 extern void zfcp_sg_free_table(struct scatterlist *, int);
 extern int zfcp_sg_setup_table(struct scatterlist *, int);
+extern void zfcp_device_unregister(struct device *,
+				   const struct attribute_group *);
+extern void zfcp_adapter_release(struct kref *);
+extern void zfcp_adapter_unregister(struct zfcp_adapter *);
 
 /* zfcp_ccw.c */
-extern int zfcp_ccw_register(void);
 extern int zfcp_ccw_priv_sch(struct zfcp_adapter *);
 extern struct ccw_driver zfcp_ccw_driver;
+extern struct zfcp_adapter *zfcp_ccw_adapter_by_cdev(struct ccw_device *);
+extern void zfcp_ccw_adapter_put(struct zfcp_adapter *);
 
 /* zfcp_cfdc.c */
 extern struct miscdevice zfcp_cfdc_misc;
@@ -51,7 +56,7 @@ extern void _zfcp_dbf_hba_fsf_unsol(const char *, int level, struct zfcp_dbf *,
 					  struct fsf_status_read_buffer *);
 extern void zfcp_dbf_hba_qdio(struct zfcp_dbf *, unsigned int, int, int);
 extern void zfcp_dbf_hba_berr(struct zfcp_dbf *, struct zfcp_fsf_req *);
-extern void zfcp_dbf_san_ct_request(struct zfcp_fsf_req *);
+extern void zfcp_dbf_san_ct_request(struct zfcp_fsf_req *, u32);
 extern void zfcp_dbf_san_ct_response(struct zfcp_fsf_req *);
 extern void zfcp_dbf_san_els_request(struct zfcp_fsf_req *);
 extern void zfcp_dbf_san_els_response(struct zfcp_fsf_req *);
@@ -92,24 +97,22 @@ extern void zfcp_erp_adapter_access_changed(struct zfcp_adapter *, char *,
 extern void zfcp_erp_timeout_handler(unsigned long);
 
 /* zfcp_fc.c */
-extern int zfcp_fc_scan_ports(struct zfcp_adapter *);
-extern void _zfcp_fc_scan_ports_later(struct work_struct *);
+extern void zfcp_fc_scan_ports(struct work_struct *);
 extern void zfcp_fc_incoming_els(struct zfcp_fsf_req *);
 extern void zfcp_fc_port_did_lookup(struct work_struct *);
 extern void zfcp_fc_trigger_did_lookup(struct zfcp_port *);
-extern void zfcp_fc_plogi_evaluate(struct zfcp_port *, struct fsf_plogi *);
+extern void zfcp_fc_plogi_evaluate(struct zfcp_port *, struct fc_els_flogi *);
 extern void zfcp_fc_test_link(struct zfcp_port *);
 extern void zfcp_fc_link_test_work(struct work_struct *);
-extern void zfcp_fc_wka_ports_force_offline(struct zfcp_wka_ports *);
+extern void zfcp_fc_wka_ports_force_offline(struct zfcp_fc_wka_ports *);
 extern int zfcp_fc_gs_setup(struct zfcp_adapter *);
 extern void zfcp_fc_gs_destroy(struct zfcp_adapter *);
-extern int zfcp_fc_execute_els_fc_job(struct fc_bsg_job *);
-extern int zfcp_fc_execute_ct_fc_job(struct fc_bsg_job *);
+extern int zfcp_fc_exec_bsg_job(struct fc_bsg_job *);
 
 /* zfcp_fsf.c */
 extern int zfcp_fsf_open_port(struct zfcp_erp_action *);
-extern int zfcp_fsf_open_wka_port(struct zfcp_wka_port *);
-extern int zfcp_fsf_close_wka_port(struct zfcp_wka_port *);
+extern int zfcp_fsf_open_wka_port(struct zfcp_fc_wka_port *);
+extern int zfcp_fsf_close_wka_port(struct zfcp_fc_wka_port *);
 extern int zfcp_fsf_close_port(struct zfcp_erp_action *);
 extern int zfcp_fsf_close_physical_port(struct zfcp_erp_action *);
 extern int zfcp_fsf_open_unit(struct zfcp_erp_action *);
@@ -125,8 +128,10 @@ extern struct zfcp_fsf_req *zfcp_fsf_control_file(struct zfcp_adapter *,
 extern void zfcp_fsf_req_dismiss_all(struct zfcp_adapter *);
 extern int zfcp_fsf_status_read(struct zfcp_qdio *);
 extern int zfcp_status_read_refill(struct zfcp_adapter *adapter);
-extern int zfcp_fsf_send_ct(struct zfcp_send_ct *, mempool_t *);
-extern int zfcp_fsf_send_els(struct zfcp_send_els *);
+extern int zfcp_fsf_send_ct(struct zfcp_fc_wka_port *, struct zfcp_fsf_ct_els *,
+			    mempool_t *);
+extern int zfcp_fsf_send_els(struct zfcp_adapter *, u32,
+			     struct zfcp_fsf_ct_els *);
 extern int zfcp_fsf_send_fcp_command_task(struct zfcp_unit *,
 					  struct scsi_cmnd *);
 extern void zfcp_fsf_req_free(struct zfcp_fsf_req *);
@@ -153,7 +158,6 @@ extern void zfcp_qdio_close(struct zfcp_qdio *);
 extern struct zfcp_data zfcp_data;
 extern int zfcp_adapter_scsi_register(struct zfcp_adapter *);
 extern void zfcp_adapter_scsi_unregister(struct zfcp_adapter *);
-extern char *zfcp_get_fcp_sns_info_ptr(struct fcp_rsp_iu *);
 extern struct fc_function_template zfcp_transport_functions;
 extern void zfcp_scsi_rport_work(struct work_struct *);
 extern void zfcp_scsi_schedule_rport_register(struct zfcp_port *);
diff --git a/drivers/s390/scsi/zfcp_fc.c b/drivers/s390/scsi/zfcp_fc.c
index df23bcead23d..ac5e3b7a3576 100644
--- a/drivers/s390/scsi/zfcp_fc.c
+++ b/drivers/s390/scsi/zfcp_fc.c
@@ -9,73 +9,38 @@
 #define KMSG_COMPONENT "zfcp"
 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
 
+#include <linux/types.h>
+#include <scsi/fc/fc_els.h>
+#include <scsi/libfc.h>
 #include "zfcp_ext.h"
+#include "zfcp_fc.h"
 
-enum rscn_address_format {
-	RSCN_PORT_ADDRESS	= 0x0,
-	RSCN_AREA_ADDRESS	= 0x1,
-	RSCN_DOMAIN_ADDRESS	= 0x2,
-	RSCN_FABRIC_ADDRESS	= 0x3,
+static u32 zfcp_fc_rscn_range_mask[] = {
+	[ELS_ADDR_FMT_PORT]		= 0xFFFFFF,
+	[ELS_ADDR_FMT_AREA]		= 0xFFFF00,
+	[ELS_ADDR_FMT_DOM]		= 0xFF0000,
+	[ELS_ADDR_FMT_FAB]		= 0x000000,
 };
 
-static u32 rscn_range_mask[] = {
-	[RSCN_PORT_ADDRESS]		= 0xFFFFFF,
-	[RSCN_AREA_ADDRESS]		= 0xFFFF00,
-	[RSCN_DOMAIN_ADDRESS]		= 0xFF0000,
-	[RSCN_FABRIC_ADDRESS]		= 0x000000,
-};
-
-struct gpn_ft_resp_acc {
-	u8 control;
-	u8 port_id[3];
-	u8 reserved[4];
-	u64 wwpn;
-} __attribute__ ((packed));
-
-#define ZFCP_CT_SIZE_ONE_PAGE	(PAGE_SIZE - sizeof(struct ct_hdr))
-#define ZFCP_GPN_FT_ENTRIES	(ZFCP_CT_SIZE_ONE_PAGE \
-					/ sizeof(struct gpn_ft_resp_acc))
-#define ZFCP_GPN_FT_BUFFERS 4
-#define ZFCP_GPN_FT_MAX_SIZE (ZFCP_GPN_FT_BUFFERS * PAGE_SIZE \
-				- sizeof(struct ct_hdr))
-#define ZFCP_GPN_FT_MAX_ENTRIES ZFCP_GPN_FT_BUFFERS * (ZFCP_GPN_FT_ENTRIES + 1)
-
-struct ct_iu_gpn_ft_resp {
-	struct ct_hdr header;
-	struct gpn_ft_resp_acc accept[ZFCP_GPN_FT_ENTRIES];
-} __attribute__ ((packed));
-
-struct zfcp_gpn_ft {
-	struct zfcp_send_ct ct;
-	struct scatterlist sg_req;
-	struct scatterlist sg_resp[ZFCP_GPN_FT_BUFFERS];
-};
-
-struct zfcp_fc_ns_handler_data {
-	struct completion done;
-	void (*handler)(unsigned long);
-	unsigned long handler_data;
-};
-
-static int zfcp_fc_wka_port_get(struct zfcp_wka_port *wka_port)
+static int zfcp_fc_wka_port_get(struct zfcp_fc_wka_port *wka_port)
 {
 	if (mutex_lock_interruptible(&wka_port->mutex))
 		return -ERESTARTSYS;
 
-	if (wka_port->status == ZFCP_WKA_PORT_OFFLINE ||
-	    wka_port->status == ZFCP_WKA_PORT_CLOSING) {
-		wka_port->status = ZFCP_WKA_PORT_OPENING;
+	if (wka_port->status == ZFCP_FC_WKA_PORT_OFFLINE ||
+	    wka_port->status == ZFCP_FC_WKA_PORT_CLOSING) {
+		wka_port->status = ZFCP_FC_WKA_PORT_OPENING;
 		if (zfcp_fsf_open_wka_port(wka_port))
-			wka_port->status = ZFCP_WKA_PORT_OFFLINE;
+			wka_port->status = ZFCP_FC_WKA_PORT_OFFLINE;
 	}
 
 	mutex_unlock(&wka_port->mutex);
 
 	wait_event(wka_port->completion_wq,
-		   wka_port->status == ZFCP_WKA_PORT_ONLINE ||
-		   wka_port->status == ZFCP_WKA_PORT_OFFLINE);
+		   wka_port->status == ZFCP_FC_WKA_PORT_ONLINE ||
+		   wka_port->status == ZFCP_FC_WKA_PORT_OFFLINE);
 
-	if (wka_port->status == ZFCP_WKA_PORT_ONLINE) {
+	if (wka_port->status == ZFCP_FC_WKA_PORT_ONLINE) {
 		atomic_inc(&wka_port->refcount);
 		return 0;
 	}
@@ -85,24 +50,24 @@ static int zfcp_fc_wka_port_get(struct zfcp_wka_port *wka_port)
 static void zfcp_fc_wka_port_offline(struct work_struct *work)
 {
 	struct delayed_work *dw = to_delayed_work(work);
-	struct zfcp_wka_port *wka_port =
-			container_of(dw, struct zfcp_wka_port, work);
+	struct zfcp_fc_wka_port *wka_port =
+			container_of(dw, struct zfcp_fc_wka_port, work);
 
 	mutex_lock(&wka_port->mutex);
 	if ((atomic_read(&wka_port->refcount) != 0) ||
-	    (wka_port->status != ZFCP_WKA_PORT_ONLINE))
+	    (wka_port->status != ZFCP_FC_WKA_PORT_ONLINE))
 		goto out;
 
-	wka_port->status = ZFCP_WKA_PORT_CLOSING;
+	wka_port->status = ZFCP_FC_WKA_PORT_CLOSING;
 	if (zfcp_fsf_close_wka_port(wka_port)) {
-		wka_port->status = ZFCP_WKA_PORT_OFFLINE;
+		wka_port->status = ZFCP_FC_WKA_PORT_OFFLINE;
 		wake_up(&wka_port->completion_wq);
 	}
 out:
 	mutex_unlock(&wka_port->mutex);
 }
 
-static void zfcp_fc_wka_port_put(struct zfcp_wka_port *wka_port)
+static void zfcp_fc_wka_port_put(struct zfcp_fc_wka_port *wka_port)
 {
 	if (atomic_dec_return(&wka_port->refcount) != 0)
 		return;
@@ -110,7 +75,7 @@ static void zfcp_fc_wka_port_put(struct zfcp_wka_port *wka_port)
 	schedule_delayed_work(&wka_port->work, HZ / 100);
 }
 
-static void zfcp_fc_wka_port_init(struct zfcp_wka_port *wka_port, u32 d_id,
+static void zfcp_fc_wka_port_init(struct zfcp_fc_wka_port *wka_port, u32 d_id,
 				  struct zfcp_adapter *adapter)
 {
 	init_waitqueue_head(&wka_port->completion_wq);
@@ -118,107 +83,107 @@ static void zfcp_fc_wka_port_init(struct zfcp_wka_port *wka_port, u32 d_id,
 	wka_port->adapter = adapter;
 	wka_port->d_id = d_id;
 
-	wka_port->status = ZFCP_WKA_PORT_OFFLINE;
+	wka_port->status = ZFCP_FC_WKA_PORT_OFFLINE;
 	atomic_set(&wka_port->refcount, 0);
 	mutex_init(&wka_port->mutex);
 	INIT_DELAYED_WORK(&wka_port->work, zfcp_fc_wka_port_offline);
 }
 
-static void zfcp_fc_wka_port_force_offline(struct zfcp_wka_port *wka)
+static void zfcp_fc_wka_port_force_offline(struct zfcp_fc_wka_port *wka)
 {
 	cancel_delayed_work_sync(&wka->work);
 	mutex_lock(&wka->mutex);
-	wka->status = ZFCP_WKA_PORT_OFFLINE;
+	wka->status = ZFCP_FC_WKA_PORT_OFFLINE;
 	mutex_unlock(&wka->mutex);
 }
 
-void zfcp_fc_wka_ports_force_offline(struct zfcp_wka_ports *gs)
+void zfcp_fc_wka_ports_force_offline(struct zfcp_fc_wka_ports *gs)
 {
+	if (!gs)
+		return;
 	zfcp_fc_wka_port_force_offline(&gs->ms);
 	zfcp_fc_wka_port_force_offline(&gs->ts);
 	zfcp_fc_wka_port_force_offline(&gs->ds);
 	zfcp_fc_wka_port_force_offline(&gs->as);
-	zfcp_fc_wka_port_force_offline(&gs->ks);
 }
 
 static void _zfcp_fc_incoming_rscn(struct zfcp_fsf_req *fsf_req, u32 range,
-				   struct fcp_rscn_element *elem)
+				   struct fc_els_rscn_page *page)
 {
 	unsigned long flags;
+	struct zfcp_adapter *adapter = fsf_req->adapter;
 	struct zfcp_port *port;
 
-	read_lock_irqsave(&zfcp_data.config_lock, flags);
-	list_for_each_entry(port, &fsf_req->adapter->port_list_head, list) {
-		if ((port->d_id & range) == (elem->nport_did & range))
+	read_lock_irqsave(&adapter->port_list_lock, flags);
+	list_for_each_entry(port, &adapter->port_list, list) {
+		if ((port->d_id & range) == (ntoh24(page->rscn_fid) & range))
 			zfcp_fc_test_link(port);
 		if (!port->d_id)
 			zfcp_erp_port_reopen(port,
 					     ZFCP_STATUS_COMMON_ERP_FAILED,
 					     "fcrscn1", NULL);
 	}
-
-	read_unlock_irqrestore(&zfcp_data.config_lock, flags);
+	read_unlock_irqrestore(&adapter->port_list_lock, flags);
 }
 
 static void zfcp_fc_incoming_rscn(struct zfcp_fsf_req *fsf_req)
 {
 	struct fsf_status_read_buffer *status_buffer = (void *)fsf_req->data;
-	struct fcp_rscn_head *fcp_rscn_head;
-	struct fcp_rscn_element *fcp_rscn_element;
+	struct fc_els_rscn *head;
+	struct fc_els_rscn_page *page;
 	u16 i;
 	u16 no_entries;
-	u32 range_mask;
+	unsigned int afmt;
 
-	fcp_rscn_head = (struct fcp_rscn_head *) status_buffer->payload.data;
-	fcp_rscn_element = (struct fcp_rscn_element *) fcp_rscn_head;
+	head = (struct fc_els_rscn *) status_buffer->payload.data;
+	page = (struct fc_els_rscn_page *) head;
 
 	/* see FC-FS */
-	no_entries = fcp_rscn_head->payload_len /
-			sizeof(struct fcp_rscn_element);
+	no_entries = head->rscn_plen / sizeof(struct fc_els_rscn_page);
 
 	for (i = 1; i < no_entries; i++) {
 		/* skip head and start with 1st element */
-		fcp_rscn_element++;
-		range_mask = rscn_range_mask[fcp_rscn_element->addr_format];
-		_zfcp_fc_incoming_rscn(fsf_req, range_mask, fcp_rscn_element);
+		page++;
+		afmt = page->rscn_page_flags & ELS_RSCN_ADDR_FMT_MASK;
+		_zfcp_fc_incoming_rscn(fsf_req, zfcp_fc_rscn_range_mask[afmt],
+				       page);
 	}
-	schedule_work(&fsf_req->adapter->scan_work);
+	queue_work(fsf_req->adapter->work_queue, &fsf_req->adapter->scan_work);
 }
 
 static void zfcp_fc_incoming_wwpn(struct zfcp_fsf_req *req, u64 wwpn)
 {
+	unsigned long flags;
 	struct zfcp_adapter *adapter = req->adapter;
 	struct zfcp_port *port;
-	unsigned long flags;
 
-	read_lock_irqsave(&zfcp_data.config_lock, flags);
-	list_for_each_entry(port, &adapter->port_list_head, list)
-		if (port->wwpn == wwpn)
+	read_lock_irqsave(&adapter->port_list_lock, flags);
+	list_for_each_entry(port, &adapter->port_list, list)
+		if (port->wwpn == wwpn) {
+			zfcp_erp_port_forced_reopen(port, 0, "fciwwp1", req);
 			break;
-	read_unlock_irqrestore(&zfcp_data.config_lock, flags);
-
-	if (port && (port->wwpn == wwpn))
-		zfcp_erp_port_forced_reopen(port, 0, "fciwwp1", req);
+		}
+	read_unlock_irqrestore(&adapter->port_list_lock, flags);
 }
 
 static void zfcp_fc_incoming_plogi(struct zfcp_fsf_req *req)
 {
-	struct fsf_status_read_buffer *status_buffer =
-		(struct fsf_status_read_buffer *)req->data;
-	struct fsf_plogi *els_plogi =
-		(struct fsf_plogi *) status_buffer->payload.data;
+	struct fsf_status_read_buffer *status_buffer;
+	struct fc_els_flogi *plogi;
 
-	zfcp_fc_incoming_wwpn(req, els_plogi->serv_param.wwpn);
+	status_buffer = (struct fsf_status_read_buffer *) req->data;
+	plogi = (struct fc_els_flogi *) status_buffer->payload.data;
+	zfcp_fc_incoming_wwpn(req, plogi->fl_wwpn);
 }
 
 static void zfcp_fc_incoming_logo(struct zfcp_fsf_req *req)
 {
 	struct fsf_status_read_buffer *status_buffer =
 		(struct fsf_status_read_buffer *)req->data;
-	struct fcp_logo *els_logo =
-		(struct fcp_logo *) status_buffer->payload.data;
+	struct fc_els_logo *logo =
+		(struct fc_els_logo *) status_buffer->payload.data;
 
-	zfcp_fc_incoming_wwpn(req, els_logo->nport_wwpn);
+	zfcp_fc_incoming_wwpn(req, logo->fl_n_port_wwn);
 }
 
 /**
@@ -232,79 +197,72 @@ void zfcp_fc_incoming_els(struct zfcp_fsf_req *fsf_req)
 	unsigned int els_type = status_buffer->payload.data[0];
 
 	zfcp_dbf_san_incoming_els(fsf_req);
-	if (els_type == LS_PLOGI)
+	if (els_type == ELS_PLOGI)
 		zfcp_fc_incoming_plogi(fsf_req);
-	else if (els_type == LS_LOGO)
+	else if (els_type == ELS_LOGO)
 		zfcp_fc_incoming_logo(fsf_req);
-	else if (els_type == LS_RSCN)
+	else if (els_type == ELS_RSCN)
 		zfcp_fc_incoming_rscn(fsf_req);
 }
 
-static void zfcp_fc_ns_handler(unsigned long data)
+static void zfcp_fc_ns_gid_pn_eval(void *data)
 {
-	struct zfcp_fc_ns_handler_data *compl_rec =
-			(struct zfcp_fc_ns_handler_data *) data;
-
-	if (compl_rec->handler)
-		compl_rec->handler(compl_rec->handler_data);
-
-	complete(&compl_rec->done);
-}
-
-static void zfcp_fc_ns_gid_pn_eval(unsigned long data)
-{
-	struct zfcp_gid_pn_data *gid_pn = (struct zfcp_gid_pn_data *) data;
-	struct zfcp_send_ct *ct = &gid_pn->ct;
-	struct ct_iu_gid_pn_req *ct_iu_req = sg_virt(ct->req);
-	struct ct_iu_gid_pn_resp *ct_iu_resp = sg_virt(ct->resp);
+	struct zfcp_fc_gid_pn *gid_pn = data;
+	struct zfcp_fsf_ct_els *ct = &gid_pn->ct;
+	struct zfcp_fc_gid_pn_req *gid_pn_req = sg_virt(ct->req);
+	struct zfcp_fc_gid_pn_resp *gid_pn_resp = sg_virt(ct->resp);
 	struct zfcp_port *port = gid_pn->port;
 
 	if (ct->status)
 		return;
-	if (ct_iu_resp->header.cmd_rsp_code != ZFCP_CT_ACCEPT)
+	if (gid_pn_resp->ct_hdr.ct_cmd != FC_FS_ACC)
 		return;
 
 	/* paranoia */
-	if (ct_iu_req->wwpn != port->wwpn)
+	if (gid_pn_req->gid_pn.fn_wwpn != port->wwpn)
 		return;
 	/* looks like a valid d_id */
-	port->d_id = ct_iu_resp->d_id & ZFCP_DID_MASK;
+	port->d_id = ntoh24(gid_pn_resp->gid_pn.fp_fid);
+}
+
+static void zfcp_fc_complete(void *data)
+{
+	complete(data);
 }
 
 static int zfcp_fc_ns_gid_pn_request(struct zfcp_port *port,
-				     struct zfcp_gid_pn_data *gid_pn)
+				     struct zfcp_fc_gid_pn *gid_pn)
 {
 	struct zfcp_adapter *adapter = port->adapter;
-	struct zfcp_fc_ns_handler_data compl_rec;
+	DECLARE_COMPLETION_ONSTACK(completion);
 	int ret;
 
 	/* setup parameters for send generic command */
 	gid_pn->port = port;
-	gid_pn->ct.wka_port = &adapter->gs->ds;
-	gid_pn->ct.handler = zfcp_fc_ns_handler;
-	gid_pn->ct.handler_data = (unsigned long) &compl_rec;
-	gid_pn->ct.req = &gid_pn->req;
-	gid_pn->ct.resp = &gid_pn->resp;
-	sg_init_one(&gid_pn->req, &gid_pn->ct_iu_req,
-		    sizeof(struct ct_iu_gid_pn_req));
-	sg_init_one(&gid_pn->resp, &gid_pn->ct_iu_resp,
-		    sizeof(struct ct_iu_gid_pn_resp));
+	gid_pn->ct.handler = zfcp_fc_complete;
+	gid_pn->ct.handler_data = &completion;
+	gid_pn->ct.req = &gid_pn->sg_req;
+	gid_pn->ct.resp = &gid_pn->sg_resp;
+	sg_init_one(&gid_pn->sg_req, &gid_pn->gid_pn_req,
+		    sizeof(struct zfcp_fc_gid_pn_req));
+	sg_init_one(&gid_pn->sg_resp, &gid_pn->gid_pn_resp,
+		    sizeof(struct zfcp_fc_gid_pn_resp));
 
 	/* setup nameserver request */
-	gid_pn->ct_iu_req.header.revision = ZFCP_CT_REVISION;
-	gid_pn->ct_iu_req.header.gs_type = ZFCP_CT_DIRECTORY_SERVICE;
-	gid_pn->ct_iu_req.header.gs_subtype = ZFCP_CT_NAME_SERVER;
-	gid_pn->ct_iu_req.header.options = ZFCP_CT_SYNCHRONOUS;
-	gid_pn->ct_iu_req.header.cmd_rsp_code = ZFCP_CT_GID_PN;
-	gid_pn->ct_iu_req.header.max_res_size = ZFCP_CT_SIZE_ONE_PAGE / 4;
-	gid_pn->ct_iu_req.wwpn = port->wwpn;
-
-	init_completion(&compl_rec.done);
-	compl_rec.handler = zfcp_fc_ns_gid_pn_eval;
-	compl_rec.handler_data = (unsigned long) gid_pn;
-	ret = zfcp_fsf_send_ct(&gid_pn->ct, adapter->pool.gid_pn_req);
-	if (!ret)
-		wait_for_completion(&compl_rec.done);
+	gid_pn->gid_pn_req.ct_hdr.ct_rev = FC_CT_REV;
+	gid_pn->gid_pn_req.ct_hdr.ct_fs_type = FC_FST_DIR;
+	gid_pn->gid_pn_req.ct_hdr.ct_fs_subtype = FC_NS_SUBTYPE;
+	gid_pn->gid_pn_req.ct_hdr.ct_options = 0;
+	gid_pn->gid_pn_req.ct_hdr.ct_cmd = FC_NS_GID_PN;
+	gid_pn->gid_pn_req.ct_hdr.ct_mr_size = ZFCP_FC_CT_SIZE_PAGE / 4;
+	gid_pn->gid_pn_req.gid_pn.fn_wwpn = port->wwpn;
+
+	ret = zfcp_fsf_send_ct(&adapter->gs->ds, &gid_pn->ct,
+			       adapter->pool.gid_pn_req);
+	if (!ret) {
+		wait_for_completion(&completion);
+		zfcp_fc_ns_gid_pn_eval(gid_pn);
+	}
 	return ret;
 }
 
@@ -316,10 +274,10 @@ static int zfcp_fc_ns_gid_pn_request(struct zfcp_port *port,
 static int zfcp_fc_ns_gid_pn(struct zfcp_port *port)
 {
 	int ret;
-	struct zfcp_gid_pn_data *gid_pn;
+	struct zfcp_fc_gid_pn *gid_pn;
 	struct zfcp_adapter *adapter = port->adapter;
 
-	gid_pn = mempool_alloc(adapter->pool.gid_pn_data, GFP_ATOMIC);
+	gid_pn = mempool_alloc(adapter->pool.gid_pn, GFP_ATOMIC);
 	if (!gid_pn)
 		return -ENOMEM;
 
@@ -333,7 +291,7 @@ static int zfcp_fc_ns_gid_pn(struct zfcp_port *port)
 
 	zfcp_fc_wka_port_put(&adapter->gs->ds);
 out:
-	mempool_free(gid_pn, adapter->pool.gid_pn_data);
+	mempool_free(gid_pn, adapter->pool.gid_pn);
 	return ret;
 }
 
@@ -357,7 +315,7 @@ void zfcp_fc_port_did_lookup(struct work_struct *work)
 
 	zfcp_erp_port_reopen(port, 0, "fcgpn_3", NULL);
 out:
-	zfcp_port_put(port);
+	put_device(&port->sysfs_device);
 }
 
 /**
@@ -366,9 +324,9 @@ out:
  */
 void zfcp_fc_trigger_did_lookup(struct zfcp_port *port)
 {
-	zfcp_port_get(port);
+	get_device(&port->sysfs_device);
 	if (!queue_work(port->adapter->work_queue, &port->gid_pn_work))
-		zfcp_port_put(port);
+		put_device(&port->sysfs_device);
 }
 
 /**
@@ -378,33 +336,36 @@ void zfcp_fc_trigger_did_lookup(struct zfcp_port *port)
  *
  * Evaluate PLOGI playload and copy important fields into zfcp_port structure
  */
-void zfcp_fc_plogi_evaluate(struct zfcp_port *port, struct fsf_plogi *plogi)
-{
-	port->maxframe_size = plogi->serv_param.common_serv_param[7] |
-		((plogi->serv_param.common_serv_param[6] & 0x0F) << 8);
-	if (plogi->serv_param.class1_serv_param[0] & 0x80)
+void zfcp_fc_plogi_evaluate(struct zfcp_port *port, struct fc_els_flogi *plogi)
+{
+	if (plogi->fl_wwpn != port->wwpn) {
+		port->d_id = 0;
+		dev_warn(&port->adapter->ccw_device->dev,
+			 "A port opened with WWPN 0x%016Lx returned data that "
+			 "identifies it as WWPN 0x%016Lx\n",
+			 (unsigned long long) port->wwpn,
+			 (unsigned long long) plogi->fl_wwpn);
+		return;
+	}
+
+	port->wwnn = plogi->fl_wwnn;
+	port->maxframe_size = plogi->fl_csp.sp_bb_data;
+
+	if (plogi->fl_cssp[0].cp_class & FC_CPC_VALID)
 		port->supported_classes |= FC_COS_CLASS1;
-	if (plogi->serv_param.class2_serv_param[0] & 0x80)
+	if (plogi->fl_cssp[1].cp_class & FC_CPC_VALID)
 		port->supported_classes |= FC_COS_CLASS2;
-	if (plogi->serv_param.class3_serv_param[0] & 0x80)
+	if (plogi->fl_cssp[2].cp_class & FC_CPC_VALID)
 		port->supported_classes |= FC_COS_CLASS3;
-	if (plogi->serv_param.class4_serv_param[0] & 0x80)
+	if (plogi->fl_cssp[3].cp_class & FC_CPC_VALID)
 		port->supported_classes |= FC_COS_CLASS4;
 }
 
-struct zfcp_els_adisc {
-	struct zfcp_send_els els;
-	struct scatterlist req;
-	struct scatterlist resp;
-	struct zfcp_ls_adisc ls_adisc;
-	struct zfcp_ls_adisc ls_adisc_acc;
-};
-
-static void zfcp_fc_adisc_handler(unsigned long data)
+static void zfcp_fc_adisc_handler(void *data)
 {
-	struct zfcp_els_adisc *adisc = (struct zfcp_els_adisc *) data;
+	struct zfcp_fc_els_adisc *adisc = data;
 	struct zfcp_port *port = adisc->els.port;
-	struct zfcp_ls_adisc *ls_adisc = &adisc->ls_adisc_acc;
+	struct fc_els_adisc *adisc_resp = &adisc->adisc_resp;
 
 	if (adisc->els.status) {
 		/* request rejected or timed out */
@@ -414,9 +375,9 @@ static void zfcp_fc_adisc_handler(unsigned long data)
 	}
 
 	if (!port->wwnn)
-		port->wwnn = ls_adisc->wwnn;
+		port->wwnn = adisc_resp->adisc_wwnn;
 
-	if ((port->wwpn != ls_adisc->wwpn) ||
+	if ((port->wwpn != adisc_resp->adisc_wwpn) ||
 	    !(atomic_read(&port->status) & ZFCP_STATUS_COMMON_OPEN)) {
 		zfcp_erp_port_reopen(port, ZFCP_STATUS_COMMON_ERP_FAILED,
 				     "fcadh_2", NULL);
@@ -427,40 +388,44 @@ static void zfcp_fc_adisc_handler(unsigned long data)
 	zfcp_scsi_schedule_rport_register(port);
  out:
 	atomic_clear_mask(ZFCP_STATUS_PORT_LINK_TEST, &port->status);
-	zfcp_port_put(port);
-	kfree(adisc);
+	put_device(&port->sysfs_device);
+	kmem_cache_free(zfcp_data.adisc_cache, adisc);
 }
 
 static int zfcp_fc_adisc(struct zfcp_port *port)
 {
-	struct zfcp_els_adisc *adisc;
+	struct zfcp_fc_els_adisc *adisc;
 	struct zfcp_adapter *adapter = port->adapter;
+	int ret;
 
-	adisc = kzalloc(sizeof(struct zfcp_els_adisc), GFP_ATOMIC);
+	adisc = kmem_cache_alloc(zfcp_data.adisc_cache, GFP_ATOMIC);
 	if (!adisc)
 		return -ENOMEM;
 
+	adisc->els.port = port;
 	adisc->els.req = &adisc->req;
 	adisc->els.resp = &adisc->resp;
-	sg_init_one(adisc->els.req, &adisc->ls_adisc,
-		    sizeof(struct zfcp_ls_adisc));
-	sg_init_one(adisc->els.resp, &adisc->ls_adisc_acc,
-		    sizeof(struct zfcp_ls_adisc));
+	sg_init_one(adisc->els.req, &adisc->adisc_req,
+		    sizeof(struct fc_els_adisc));
+	sg_init_one(adisc->els.resp, &adisc->adisc_resp,
+		    sizeof(struct fc_els_adisc));
 
-	adisc->els.adapter = adapter;
-	adisc->els.port = port;
-	adisc->els.d_id = port->d_id;
 	adisc->els.handler = zfcp_fc_adisc_handler;
-	adisc->els.handler_data = (unsigned long) adisc;
-	adisc->els.ls_code = adisc->ls_adisc.code = ZFCP_LS_ADISC;
+	adisc->els.handler_data = adisc;
 
 	/* acc. to FC-FS, hard_nport_id in ADISC should not be set for ports
 	   without FC-AL-2 capability, so we don't set it */
-	adisc->ls_adisc.wwpn = fc_host_port_name(adapter->scsi_host);
-	adisc->ls_adisc.wwnn = fc_host_node_name(adapter->scsi_host);
-	adisc->ls_adisc.nport_id = fc_host_port_id(adapter->scsi_host);
+	adisc->adisc_req.adisc_wwpn = fc_host_port_name(adapter->scsi_host);
+	adisc->adisc_req.adisc_wwnn = fc_host_node_name(adapter->scsi_host);
+	adisc->adisc_req.adisc_cmd = ELS_ADISC;
+	hton24(adisc->adisc_req.adisc_port_id,
+	       fc_host_port_id(adapter->scsi_host));
+
+	ret = zfcp_fsf_send_els(adapter, port->d_id, &adisc->els);
+	if (ret)
+		kmem_cache_free(zfcp_data.adisc_cache, adisc);
 
-	return zfcp_fsf_send_els(&adisc->els);
+	return ret;
 }
 
 void zfcp_fc_link_test_work(struct work_struct *work)
@@ -469,7 +434,7 @@ void zfcp_fc_link_test_work(struct work_struct *work)
 		container_of(work, struct zfcp_port, test_link_work);
 	int retval;
 
-	zfcp_port_get(port);
+	get_device(&port->sysfs_device);
 	port->rport_task = RPORT_DEL;
 	zfcp_scsi_rport_work(&port->rport_work);
 
@@ -488,7 +453,7 @@ void zfcp_fc_link_test_work(struct work_struct *work)
 	zfcp_erp_port_forced_reopen(port, 0, "fcltwk1", NULL);
 
 out:
-	zfcp_port_put(port);
+	put_device(&port->sysfs_device);
 }
 
 /**
@@ -501,12 +466,12 @@ out:
  */
 void zfcp_fc_test_link(struct zfcp_port *port)
 {
-	zfcp_port_get(port);
+	get_device(&port->sysfs_device);
 	if (!queue_work(port->adapter->work_queue, &port->test_link_work))
-		zfcp_port_put(port);
+		put_device(&port->sysfs_device);
 }
 
-static void zfcp_free_sg_env(struct zfcp_gpn_ft *gpn_ft, int buf_num)
+static void zfcp_free_sg_env(struct zfcp_fc_gpn_ft *gpn_ft, int buf_num)
 {
 	struct scatterlist *sg = &gpn_ft->sg_req;
 
@@ -516,10 +481,10 @@ static void zfcp_free_sg_env(struct zfcp_gpn_ft *gpn_ft, int buf_num)
 	kfree(gpn_ft);
 }
 
-static struct zfcp_gpn_ft *zfcp_alloc_sg_env(int buf_num)
+static struct zfcp_fc_gpn_ft *zfcp_alloc_sg_env(int buf_num)
 {
-	struct zfcp_gpn_ft *gpn_ft;
-	struct ct_iu_gpn_ft_req *req;
+	struct zfcp_fc_gpn_ft *gpn_ft;
+	struct zfcp_fc_gpn_ft_req *req;
 
 	gpn_ft = kzalloc(sizeof(*gpn_ft), GFP_KERNEL);
 	if (!gpn_ft)
@@ -542,159 +507,152 @@ out:
 }
 
 
-static int zfcp_fc_send_gpn_ft(struct zfcp_gpn_ft *gpn_ft,
+static int zfcp_fc_send_gpn_ft(struct zfcp_fc_gpn_ft *gpn_ft,
 			       struct zfcp_adapter *adapter, int max_bytes)
 {
-	struct zfcp_send_ct *ct = &gpn_ft->ct;
-	struct ct_iu_gpn_ft_req *req = sg_virt(&gpn_ft->sg_req);
-	struct zfcp_fc_ns_handler_data compl_rec;
+	struct zfcp_fsf_ct_els *ct = &gpn_ft->ct;
+	struct zfcp_fc_gpn_ft_req *req = sg_virt(&gpn_ft->sg_req);
+	DECLARE_COMPLETION_ONSTACK(completion);
 	int ret;
 
 	/* prepare CT IU for GPN_FT */
-	req->header.revision = ZFCP_CT_REVISION;
-	req->header.gs_type = ZFCP_CT_DIRECTORY_SERVICE;
-	req->header.gs_subtype = ZFCP_CT_NAME_SERVER;
-	req->header.options = ZFCP_CT_SYNCHRONOUS;
-	req->header.cmd_rsp_code = ZFCP_CT_GPN_FT;
-	req->header.max_res_size = max_bytes / 4;
-	req->flags = 0;
-	req->domain_id_scope = 0;
-	req->area_id_scope = 0;
-	req->fc4_type = ZFCP_CT_SCSI_FCP;
+	req->ct_hdr.ct_rev = FC_CT_REV;
+	req->ct_hdr.ct_fs_type = FC_FST_DIR;
+	req->ct_hdr.ct_fs_subtype = FC_NS_SUBTYPE;
+	req->ct_hdr.ct_options = 0;
+	req->ct_hdr.ct_cmd = FC_NS_GPN_FT;
+	req->ct_hdr.ct_mr_size = max_bytes / 4;
+	req->gpn_ft.fn_domain_id_scope = 0;
+	req->gpn_ft.fn_area_id_scope = 0;
+	req->gpn_ft.fn_fc4_type = FC_TYPE_FCP;
 
 	/* prepare zfcp_send_ct */
-	ct->wka_port = &adapter->gs->ds;
-	ct->handler = zfcp_fc_ns_handler;
-	ct->handler_data = (unsigned long)&compl_rec;
+	ct->handler = zfcp_fc_complete;
+	ct->handler_data = &completion;
 	ct->req = &gpn_ft->sg_req;
 	ct->resp = gpn_ft->sg_resp;
 
-	init_completion(&compl_rec.done);
-	compl_rec.handler = NULL;
-	ret = zfcp_fsf_send_ct(ct, NULL);
+	ret = zfcp_fsf_send_ct(&adapter->gs->ds, ct, NULL);
 	if (!ret)
-		wait_for_completion(&compl_rec.done);
+		wait_for_completion(&completion);
 	return ret;
 }
 
-static void zfcp_fc_validate_port(struct zfcp_port *port)
+static void zfcp_fc_validate_port(struct zfcp_port *port, struct list_head *lh)
 {
-	struct zfcp_adapter *adapter = port->adapter;
-
 	if (!(atomic_read(&port->status) & ZFCP_STATUS_COMMON_NOESC))
 		return;
 
 	atomic_clear_mask(ZFCP_STATUS_COMMON_NOESC, &port->status);
 
 	if ((port->supported_classes != 0) ||
-	    !list_empty(&port->unit_list_head)) {
-		zfcp_port_put(port);
+	    !list_empty(&port->unit_list))
 		return;
-	}
-	zfcp_erp_port_shutdown(port, 0, "fcpval1", NULL);
-	zfcp_erp_wait(adapter);
-	zfcp_port_put(port);
-	zfcp_port_dequeue(port);
+
+	list_move_tail(&port->list, lh);
 }
 
-static int zfcp_fc_eval_gpn_ft(struct zfcp_gpn_ft *gpn_ft, int max_entries)
+static int zfcp_fc_eval_gpn_ft(struct zfcp_fc_gpn_ft *gpn_ft,
+			       struct zfcp_adapter *adapter, int max_entries)
 {
-	struct zfcp_send_ct *ct = &gpn_ft->ct;
+	struct zfcp_fsf_ct_els *ct = &gpn_ft->ct;
 	struct scatterlist *sg = gpn_ft->sg_resp;
-	struct ct_hdr *hdr = sg_virt(sg);
-	struct gpn_ft_resp_acc *acc = sg_virt(sg);
-	struct zfcp_adapter *adapter = ct->wka_port->adapter;
+	struct fc_ct_hdr *hdr = sg_virt(sg);
+	struct fc_gpn_ft_resp *acc = sg_virt(sg);
 	struct zfcp_port *port, *tmp;
+	unsigned long flags;
+	LIST_HEAD(remove_lh);
 	u32 d_id;
 	int ret = 0, x, last = 0;
 
 	if (ct->status)
 		return -EIO;
 
-	if (hdr->cmd_rsp_code != ZFCP_CT_ACCEPT) {
-		if (hdr->reason_code == ZFCP_CT_UNABLE_TO_PERFORM_CMD)
+	if (hdr->ct_cmd != FC_FS_ACC) {
+		if (hdr->ct_reason == FC_BA_RJT_UNABLE)
 			return -EAGAIN; /* might be a temporary condition */
 		return -EIO;
 	}
 
-	if (hdr->max_res_size) {
+	if (hdr->ct_mr_size) {
 		dev_warn(&adapter->ccw_device->dev,
 			 "The name server reported %d words residual data\n",
-			 hdr->max_res_size);
+			 hdr->ct_mr_size);
 		return -E2BIG;
 	}
 
-	mutex_lock(&zfcp_data.config_mutex);
-
 	/* first entry is the header */
 	for (x = 1; x < max_entries && !last; x++) {
-		if (x % (ZFCP_GPN_FT_ENTRIES + 1))
+		if (x % (ZFCP_FC_GPN_FT_ENT_PAGE + 1))
 			acc++;
 		else
 			acc = sg_virt(++sg);
 
-		last = acc->control & 0x80;
-		d_id = acc->port_id[0] << 16 | acc->port_id[1] << 8 |
-		       acc->port_id[2];
+		last = acc->fp_flags & FC_NS_FID_LAST;
+		d_id = ntoh24(acc->fp_fid);
 
 		/* don't attach ports with a well known address */
-		if ((d_id & ZFCP_DID_WKA) == ZFCP_DID_WKA)
+		if (d_id >= FC_FID_WELL_KNOWN_BASE)
 			continue;
 		/* skip the adapter's port and known remote ports */
-		if (acc->wwpn == fc_host_port_name(adapter->scsi_host))
-			continue;
-		port = zfcp_get_port_by_wwpn(adapter, acc->wwpn);
-		if (port)
+		if (acc->fp_wwpn == fc_host_port_name(adapter->scsi_host))
 			continue;
 
-		port = zfcp_port_enqueue(adapter, acc->wwpn,
+		port = zfcp_port_enqueue(adapter, acc->fp_wwpn,
 					 ZFCP_STATUS_COMMON_NOESC, d_id);
-		if (IS_ERR(port))
-			ret = PTR_ERR(port);
-		else
+		if (!IS_ERR(port))
 			zfcp_erp_port_reopen(port, 0, "fcegpf1", NULL);
+		else if (PTR_ERR(port) != -EEXIST)
+			ret = PTR_ERR(port);
 	}
 
 	zfcp_erp_wait(adapter);
-	list_for_each_entry_safe(port, tmp, &adapter->port_list_head, list)
-		zfcp_fc_validate_port(port);
-	mutex_unlock(&zfcp_data.config_mutex);
+	write_lock_irqsave(&adapter->port_list_lock, flags);
+	list_for_each_entry_safe(port, tmp, &adapter->port_list, list)
+		zfcp_fc_validate_port(port, &remove_lh);
+	write_unlock_irqrestore(&adapter->port_list_lock, flags);
+
+	list_for_each_entry_safe(port, tmp, &remove_lh, list) {
+		zfcp_erp_port_shutdown(port, 0, "fcegpf2", NULL);
+		zfcp_device_unregister(&port->sysfs_device,
+				       &zfcp_sysfs_port_attrs);
+	}
+
 	return ret;
 }
 
 /**
  * zfcp_fc_scan_ports - scan remote ports and attach new ports
- * @adapter: pointer to struct zfcp_adapter
+ * @work: reference to scheduled work
  */
-int zfcp_fc_scan_ports(struct zfcp_adapter *adapter)
+void zfcp_fc_scan_ports(struct work_struct *work)
 {
+	struct zfcp_adapter *adapter = container_of(work, struct zfcp_adapter,
+						    scan_work);
 	int ret, i;
-	struct zfcp_gpn_ft *gpn_ft;
+	struct zfcp_fc_gpn_ft *gpn_ft;
 	int chain, max_entries, buf_num, max_bytes;
 
 	chain = adapter->adapter_features & FSF_FEATURE_ELS_CT_CHAINED_SBALS;
-	buf_num = chain ? ZFCP_GPN_FT_BUFFERS : 1;
-	max_entries = chain ? ZFCP_GPN_FT_MAX_ENTRIES : ZFCP_GPN_FT_ENTRIES;
-	max_bytes = chain ? ZFCP_GPN_FT_MAX_SIZE : ZFCP_CT_SIZE_ONE_PAGE;
+	buf_num = chain ? ZFCP_FC_GPN_FT_NUM_BUFS : 1;
+	max_entries = chain ? ZFCP_FC_GPN_FT_MAX_ENT : ZFCP_FC_GPN_FT_ENT_PAGE;
+	max_bytes = chain ? ZFCP_FC_GPN_FT_MAX_SIZE : ZFCP_FC_CT_SIZE_PAGE;
 
 	if (fc_host_port_type(adapter->scsi_host) != FC_PORTTYPE_NPORT &&
 	    fc_host_port_type(adapter->scsi_host) != FC_PORTTYPE_NPIV)
-		return 0;
+		return;
 
-	ret = zfcp_fc_wka_port_get(&adapter->gs->ds);
-	if (ret)
-		return ret;
+	if (zfcp_fc_wka_port_get(&adapter->gs->ds))
+		return;
 
 	gpn_ft = zfcp_alloc_sg_env(buf_num);
-	if (!gpn_ft) {
-		ret = -ENOMEM;
+	if (!gpn_ft)
 		goto out;
-	}
 
 	for (i = 0; i < 3; i++) {
 		ret = zfcp_fc_send_gpn_ft(gpn_ft, adapter, max_bytes);
 		if (!ret) {
-			ret = zfcp_fc_eval_gpn_ft(gpn_ft, max_entries);
+			ret = zfcp_fc_eval_gpn_ft(gpn_ft, adapter, max_entries);
 			if (ret == -EAGAIN)
 				ssleep(1);
 			else
@@ -704,174 +662,116 @@ int zfcp_fc_scan_ports(struct zfcp_adapter *adapter)
 	zfcp_free_sg_env(gpn_ft, buf_num);
 out:
 	zfcp_fc_wka_port_put(&adapter->gs->ds);
-	return ret;
-}
-
-
-void _zfcp_fc_scan_ports_later(struct work_struct *work)
-{
-	zfcp_fc_scan_ports(container_of(work, struct zfcp_adapter, scan_work));
 }
 
-struct zfcp_els_fc_job {
-	struct zfcp_send_els els;
-	struct fc_bsg_job *job;
-};
-
-static void zfcp_fc_generic_els_handler(unsigned long data)
+static void zfcp_fc_ct_els_job_handler(void *data)
 {
-	struct zfcp_els_fc_job *els_fc_job = (struct zfcp_els_fc_job *) data;
-	struct fc_bsg_job *job = els_fc_job->job;
-	struct fc_bsg_reply *reply = job->reply;
-
-	if (els_fc_job->els.status) {
-		/* request rejected or timed out */
-		reply->reply_data.ctels_reply.status = FC_CTELS_STATUS_REJECT;
-		goto out;
-	}
-
-	reply->reply_data.ctels_reply.status = FC_CTELS_STATUS_OK;
-	reply->reply_payload_rcv_len = job->reply_payload.payload_len;
+	struct fc_bsg_job *job = data;
+	struct zfcp_fsf_ct_els *zfcp_ct_els = job->dd_data;
+	int status = zfcp_ct_els->status;
+	int reply_status;
 
-out:
-	job->state_flags = FC_RQST_STATE_DONE;
+	reply_status = status ? FC_CTELS_STATUS_REJECT : FC_CTELS_STATUS_OK;
+	job->reply->reply_data.ctels_reply.status = reply_status;
+	job->reply->reply_payload_rcv_len = job->reply_payload.payload_len;
 	job->job_done(job);
-	kfree(els_fc_job);
 }
 
-int zfcp_fc_execute_els_fc_job(struct fc_bsg_job *job)
+static int zfcp_fc_exec_els_job(struct fc_bsg_job *job,
+				struct zfcp_adapter *adapter)
 {
-	struct zfcp_els_fc_job *els_fc_job;
+	struct zfcp_fsf_ct_els *els = job->dd_data;
 	struct fc_rport *rport = job->rport;
-	struct Scsi_Host *shost;
-	struct zfcp_adapter *adapter;
 	struct zfcp_port *port;
-	u8 *port_did;
-
-	shost = rport ? rport_to_shost(rport) : job->shost;
-	adapter = (struct zfcp_adapter *)shost->hostdata[0];
-
-	if (!(atomic_read(&adapter->status) & ZFCP_STATUS_COMMON_OPEN))
-		return -EINVAL;
-
-	els_fc_job = kzalloc(sizeof(struct zfcp_els_fc_job), GFP_KERNEL);
-	if (!els_fc_job)
-		return -ENOMEM;
+	u32 d_id;
 
-	els_fc_job->els.adapter = adapter;
 	if (rport) {
-		read_lock_irq(&zfcp_data.config_lock);
 		port = zfcp_get_port_by_wwpn(adapter, rport->port_name);
-		if (port)
-			els_fc_job->els.d_id = port->d_id;
-		read_unlock_irq(&zfcp_data.config_lock);
-		if (!port) {
-			kfree(els_fc_job);
+		if (!port)
 			return -EINVAL;
-		}
-	} else {
-		port_did = job->request->rqst_data.h_els.port_id;
-		els_fc_job->els.d_id = (port_did[0] << 16) +
-					(port_did[1] << 8) + port_did[2];
-	}
-
-	els_fc_job->els.req = job->request_payload.sg_list;
-	els_fc_job->els.resp = job->reply_payload.sg_list;
-	els_fc_job->els.handler = zfcp_fc_generic_els_handler;
-	els_fc_job->els.handler_data = (unsigned long) els_fc_job;
-	els_fc_job->job = job;
-
-	return zfcp_fsf_send_els(&els_fc_job->els);
-}
-
-struct zfcp_ct_fc_job {
-	struct zfcp_send_ct ct;
-	struct fc_bsg_job *job;
-};
-
-static void zfcp_fc_generic_ct_handler(unsigned long data)
-{
-	struct zfcp_ct_fc_job *ct_fc_job = (struct zfcp_ct_fc_job *) data;
-	struct fc_bsg_job *job = ct_fc_job->job;
-
-	job->reply->reply_data.ctels_reply.status = ct_fc_job->ct.status ?
-				FC_CTELS_STATUS_REJECT : FC_CTELS_STATUS_OK;
-	job->reply->reply_payload_rcv_len = job->reply_payload.payload_len;
-	job->state_flags = FC_RQST_STATE_DONE;
-	job->job_done(job);
 
-	zfcp_fc_wka_port_put(ct_fc_job->ct.wka_port);
+		d_id = port->d_id;
+		put_device(&port->sysfs_device);
+	} else
+		d_id = ntoh24(job->request->rqst_data.h_els.port_id);
 
-	kfree(ct_fc_job);
+	return zfcp_fsf_send_els(adapter, d_id, els);
 }
 
-int zfcp_fc_execute_ct_fc_job(struct fc_bsg_job *job)
+static int zfcp_fc_exec_ct_job(struct fc_bsg_job *job,
+			       struct zfcp_adapter *adapter)
 {
 	int ret;
 	u8 gs_type;
-	struct fc_rport *rport = job->rport;
-	struct Scsi_Host *shost;
-	struct zfcp_adapter *adapter;
-	struct zfcp_ct_fc_job *ct_fc_job;
+	struct zfcp_fsf_ct_els *ct = job->dd_data;
+	struct zfcp_fc_wka_port *wka_port;
 	u32 preamble_word1;
 
-	shost = rport ? rport_to_shost(rport) : job->shost;
-
-	adapter = (struct zfcp_adapter *)shost->hostdata[0];
-	if (!(atomic_read(&adapter->status) & ZFCP_STATUS_COMMON_OPEN))
-		return -EINVAL;
-
-	ct_fc_job = kzalloc(sizeof(struct zfcp_ct_fc_job), GFP_KERNEL);
-	if (!ct_fc_job)
-		return -ENOMEM;
-
 	preamble_word1 = job->request->rqst_data.r_ct.preamble_word1;
 	gs_type = (preamble_word1 & 0xff000000) >> 24;
 
 	switch (gs_type) {
 	case FC_FST_ALIAS:
-		ct_fc_job->ct.wka_port = &adapter->gs->as;
+		wka_port = &adapter->gs->as;
 		break;
 	case FC_FST_MGMT:
-		ct_fc_job->ct.wka_port = &adapter->gs->ms;
+		wka_port = &adapter->gs->ms;
 		break;
 	case FC_FST_TIME:
-		ct_fc_job->ct.wka_port = &adapter->gs->ts;
+		wka_port = &adapter->gs->ts;
 		break;
 	case FC_FST_DIR:
-		ct_fc_job->ct.wka_port = &adapter->gs->ds;
+		wka_port = &adapter->gs->ds;
 		break;
 	default:
-		kfree(ct_fc_job);
 		return -EINVAL; /* no such service */
 	}
 
-	ret = zfcp_fc_wka_port_get(ct_fc_job->ct.wka_port);
-	if (ret) {
-		kfree(ct_fc_job);
+	ret = zfcp_fc_wka_port_get(wka_port);
+	if (ret)
 		return ret;
-	}
 
-	ct_fc_job->ct.req = job->request_payload.sg_list;
-	ct_fc_job->ct.resp = job->reply_payload.sg_list;
-	ct_fc_job->ct.handler = zfcp_fc_generic_ct_handler;
-	ct_fc_job->ct.handler_data = (unsigned long) ct_fc_job;
-	ct_fc_job->ct.completion = NULL;
-	ct_fc_job->job = job;
+	ret = zfcp_fsf_send_ct(wka_port, ct, NULL);
+	if (ret)
+		zfcp_fc_wka_port_put(wka_port);
 
-	ret = zfcp_fsf_send_ct(&ct_fc_job->ct, NULL);
-	if (ret) {
-		kfree(ct_fc_job);
-		zfcp_fc_wka_port_put(ct_fc_job->ct.wka_port);
-	}
 	return ret;
 }
 
+int zfcp_fc_exec_bsg_job(struct fc_bsg_job *job)
+{
+	struct Scsi_Host *shost;
+	struct zfcp_adapter *adapter;
+	struct zfcp_fsf_ct_els *ct_els = job->dd_data;
+
+	shost = job->rport ? rport_to_shost(job->rport) : job->shost;
+	adapter = (struct zfcp_adapter *)shost->hostdata[0];
+
+	if (!(atomic_read(&adapter->status) & ZFCP_STATUS_COMMON_OPEN))
+		return -EINVAL;
+
+	ct_els->req = job->request_payload.sg_list;
+	ct_els->resp = job->reply_payload.sg_list;
+	ct_els->handler = zfcp_fc_ct_els_job_handler;
+	ct_els->handler_data = job;
+
+	switch (job->request->msgcode) {
+	case FC_BSG_RPT_ELS:
+	case FC_BSG_HST_ELS_NOLOGIN:
+		return zfcp_fc_exec_els_job(job, adapter);
+	case FC_BSG_RPT_CT:
+	case FC_BSG_HST_CT:
+		return zfcp_fc_exec_ct_job(job, adapter);
+	default:
+		return -EINVAL;
+	}
+}
+
 int zfcp_fc_gs_setup(struct zfcp_adapter *adapter)
 {
-	struct zfcp_wka_ports *wka_ports;
+	struct zfcp_fc_wka_ports *wka_ports;
 
-	wka_ports = kzalloc(sizeof(struct zfcp_wka_ports), GFP_KERNEL);
+	wka_ports = kzalloc(sizeof(struct zfcp_fc_wka_ports), GFP_KERNEL);
 	if (!wka_ports)
 		return -ENOMEM;
 
@@ -880,7 +780,6 @@ int zfcp_fc_gs_setup(struct zfcp_adapter *adapter)
 	zfcp_fc_wka_port_init(&wka_ports->ts, FC_FID_TIME_SERV, adapter);
 	zfcp_fc_wka_port_init(&wka_ports->ds, FC_FID_DIR_SERV, adapter);
 	zfcp_fc_wka_port_init(&wka_ports->as, FC_FID_ALIASES, adapter);
-	zfcp_fc_wka_port_init(&wka_ports->ks, FC_FID_SEC_KEY, adapter);
 
 	return 0;
 }
diff --git a/drivers/s390/scsi/zfcp_fc.h b/drivers/s390/scsi/zfcp_fc.h
new file mode 100644
index 000000000000..cb2a3669a384
--- /dev/null
+++ b/drivers/s390/scsi/zfcp_fc.h
@@ -0,0 +1,260 @@
+/*
+ * zfcp device driver
+ *
+ * Fibre Channel related definitions and inline functions for the zfcp
+ * device driver
+ *
+ * Copyright IBM Corporation 2009
+ */
+
+#ifndef ZFCP_FC_H
+#define ZFCP_FC_H
+
+#include <scsi/fc/fc_els.h>
+#include <scsi/fc/fc_fcp.h>
+#include <scsi/fc/fc_ns.h>
+#include <scsi/scsi_cmnd.h>
+#include <scsi/scsi_tcq.h>
+#include "zfcp_fsf.h"
+
+#define ZFCP_FC_CT_SIZE_PAGE	  (PAGE_SIZE - sizeof(struct fc_ct_hdr))
+#define ZFCP_FC_GPN_FT_ENT_PAGE	  (ZFCP_FC_CT_SIZE_PAGE \
+					/ sizeof(struct fc_gpn_ft_resp))
+#define ZFCP_FC_GPN_FT_NUM_BUFS	  4 /* memory pages */
+
+#define ZFCP_FC_GPN_FT_MAX_SIZE	  (ZFCP_FC_GPN_FT_NUM_BUFS * PAGE_SIZE \
+					- sizeof(struct fc_ct_hdr))
+#define ZFCP_FC_GPN_FT_MAX_ENT	  (ZFCP_FC_GPN_FT_NUM_BUFS * \
+					(ZFCP_FC_GPN_FT_ENT_PAGE + 1))
+
+/**
+ * struct zfcp_fc_gid_pn_req - container for ct header plus gid_pn request
+ * @ct_hdr: FC GS common transport header
+ * @gid_pn: GID_PN request
+ */
+struct zfcp_fc_gid_pn_req {
+	struct fc_ct_hdr	ct_hdr;
+	struct fc_ns_gid_pn	gid_pn;
+} __packed;
+
+/**
+ * struct zfcp_fc_gid_pn_resp - container for ct header plus gid_pn response
+ * @ct_hdr: FC GS common transport header
+ * @gid_pn: GID_PN response
+ */
+struct zfcp_fc_gid_pn_resp {
+	struct fc_ct_hdr	ct_hdr;
+	struct fc_gid_pn_resp	gid_pn;
+} __packed;
+
+/**
+ * struct zfcp_fc_gid_pn - everything required in zfcp for gid_pn request
+ * @ct: data passed to zfcp_fsf for issuing fsf request
+ * @sg_req: scatterlist entry for request data
+ * @sg_resp: scatterlist entry for response data
+ * @gid_pn_req: GID_PN request data
+ * @gid_pn_resp: GID_PN response data
+ */
+struct zfcp_fc_gid_pn {
+	struct zfcp_fsf_ct_els ct;
+	struct scatterlist sg_req;
+	struct scatterlist sg_resp;
+	struct zfcp_fc_gid_pn_req gid_pn_req;
+	struct zfcp_fc_gid_pn_resp gid_pn_resp;
+	struct zfcp_port *port;
+};
+
+/**
+ * struct zfcp_fc_gpn_ft - container for ct header plus gpn_ft request
+ * @ct_hdr: FC GS common transport header
+ * @gpn_ft: GPN_FT request
+ */
+struct zfcp_fc_gpn_ft_req {
+	struct fc_ct_hdr	ct_hdr;
+	struct fc_ns_gid_ft	gpn_ft;
+} __packed;
+
+/**
+ * struct zfcp_fc_gpn_ft_resp - container for ct header plus gpn_ft response
+ * @ct_hdr: FC GS common transport header
+ * @gpn_ft: Array of gpn_ft response data to fill one memory page
+ */
+struct zfcp_fc_gpn_ft_resp {
+	struct fc_ct_hdr	ct_hdr;
+	struct fc_gpn_ft_resp	gpn_ft[ZFCP_FC_GPN_FT_ENT_PAGE];
+} __packed;
+
+/**
+ * struct zfcp_fc_gpn_ft - zfcp data for gpn_ft request
+ * @ct: data passed to zfcp_fsf for issuing fsf request
+ * @sg_req: scatter list entry for gpn_ft request
+ * @sg_resp: scatter list entries for gpn_ft responses (per memory page)
+ */
+struct zfcp_fc_gpn_ft {
+	struct zfcp_fsf_ct_els ct;
+	struct scatterlist sg_req;
+	struct scatterlist sg_resp[ZFCP_FC_GPN_FT_NUM_BUFS];
+};
+
+/**
+ * struct zfcp_fc_els_adisc - everything required in zfcp for issuing ELS ADISC
+ * @els: data required for issuing els fsf command
+ * @req: scatterlist entry for ELS ADISC request
+ * @resp: scatterlist entry for ELS ADISC response
+ * @adisc_req: ELS ADISC request data
+ * @adisc_resp: ELS ADISC response data
+ */
+struct zfcp_fc_els_adisc {
+	struct zfcp_fsf_ct_els els;
+	struct scatterlist req;
+	struct scatterlist resp;
+	struct fc_els_adisc adisc_req;
+	struct fc_els_adisc adisc_resp;
+};
+
+/**
+ * enum zfcp_fc_wka_status - FC WKA port status in zfcp
+ * @ZFCP_FC_WKA_PORT_OFFLINE: Port is closed and not in use
+ * @ZFCP_FC_WKA_PORT_CLOSING: The FSF "close port" request is pending
+ * @ZFCP_FC_WKA_PORT_OPENING: The FSF "open port" request is pending
+ * @ZFCP_FC_WKA_PORT_ONLINE: The port is open and the port handle is valid
+ */
+enum zfcp_fc_wka_status {
+	ZFCP_FC_WKA_PORT_OFFLINE,
+	ZFCP_FC_WKA_PORT_CLOSING,
+	ZFCP_FC_WKA_PORT_OPENING,
+	ZFCP_FC_WKA_PORT_ONLINE,
+};
+
+/**
+ * struct zfcp_fc_wka_port - representation of well-known-address (WKA) FC port
+ * @adapter: Pointer to adapter structure this WKA port belongs to
+ * @completion_wq: Wait for completion of open/close command
+ * @status: Current status of WKA port
+ * @refcount: Reference count to keep port open as long as it is in use
+ * @d_id: FC destination id or well-known-address
+ * @handle: FSF handle for the open WKA port
+ * @mutex: Mutex used during opening/closing state changes
+ * @work: For delaying the closing of the WKA port
+ */
+struct zfcp_fc_wka_port {
+	struct zfcp_adapter	*adapter;
+	wait_queue_head_t	completion_wq;
+	enum zfcp_fc_wka_status	status;
+	atomic_t		refcount;
+	u32			d_id;
+	u32			handle;
+	struct mutex		mutex;
+	struct delayed_work	work;
+};
+
+/**
+ * struct zfcp_fc_wka_ports - Data structures for FC generic services
+ * @ms: FC Management service
+ * @ts: FC time service
+ * @ds: FC directory service
+ * @as: FC alias service
+ */
+struct zfcp_fc_wka_ports {
+	struct zfcp_fc_wka_port ms;
+	struct zfcp_fc_wka_port ts;
+	struct zfcp_fc_wka_port ds;
+	struct zfcp_fc_wka_port as;
+};
+
+/**
+ * zfcp_fc_scsi_to_fcp - setup FCP command with data from scsi_cmnd
+ * @fcp: fcp_cmnd to setup
+ * @scsi: scsi_cmnd where to get LUN, task attributes/flags and CDB
+ */
+static inline
+void zfcp_fc_scsi_to_fcp(struct fcp_cmnd *fcp, struct scsi_cmnd *scsi)
+{
+	char tag[2];
+
+	int_to_scsilun(scsi->device->lun, (struct scsi_lun *) &fcp->fc_lun);
+
+	if (scsi_populate_tag_msg(scsi, tag)) {
+		switch (tag[0]) {
+		case MSG_ORDERED_TAG:
+			fcp->fc_pri_ta |= FCP_PTA_ORDERED;
+			break;
+		case MSG_SIMPLE_TAG:
+			fcp->fc_pri_ta |= FCP_PTA_SIMPLE;
+			break;
+		};
+	} else
+		fcp->fc_pri_ta = FCP_PTA_SIMPLE;
+
+	if (scsi->sc_data_direction == DMA_FROM_DEVICE)
+		fcp->fc_flags |= FCP_CFL_RDDATA;
+	if (scsi->sc_data_direction == DMA_TO_DEVICE)
+		fcp->fc_flags |= FCP_CFL_WRDATA;
+
+	memcpy(fcp->fc_cdb, scsi->cmnd, scsi->cmd_len);
+
+	fcp->fc_dl = scsi_bufflen(scsi);
+}
+
+/**
+ * zfcp_fc_fcp_tm - setup FCP command as task management command
+ * @fcp: fcp_cmnd to setup
+ * @dev: scsi_device where to send the task management command
+ * @tm: task management flags to setup tm command
+ */
+static inline
+void zfcp_fc_fcp_tm(struct fcp_cmnd *fcp, struct scsi_device *dev, u8 tm_flags)
+{
+	int_to_scsilun(dev->lun, (struct scsi_lun *) &fcp->fc_lun);
+	fcp->fc_tm_flags |= tm_flags;
+}
+
+/**
+ * zfcp_fc_evap_fcp_rsp - evaluate FCP RSP IU and update scsi_cmnd accordingly
+ * @fcp_rsp: FCP RSP IU to evaluate
+ * @scsi: SCSI command where to update status and sense buffer
+ */
+static inline
+void zfcp_fc_eval_fcp_rsp(struct fcp_resp_with_ext *fcp_rsp,
+			  struct scsi_cmnd *scsi)
+{
+	struct fcp_resp_rsp_info *rsp_info;
+	char *sense;
+	u32 sense_len, resid;
+	u8 rsp_flags;
+
+	set_msg_byte(scsi, COMMAND_COMPLETE);
+	scsi->result |= fcp_rsp->resp.fr_status;
+
+	rsp_flags = fcp_rsp->resp.fr_flags;
+
+	if (unlikely(rsp_flags & FCP_RSP_LEN_VAL)) {
+		rsp_info = (struct fcp_resp_rsp_info *) &fcp_rsp[1];
+		if (rsp_info->rsp_code == FCP_TMF_CMPL)
+			set_host_byte(scsi, DID_OK);
+		else {
+			set_host_byte(scsi, DID_ERROR);
+			return;
+		}
+	}
+
+	if (unlikely(rsp_flags & FCP_SNS_LEN_VAL)) {
+		sense = (char *) &fcp_rsp[1];
+		if (rsp_flags & FCP_RSP_LEN_VAL)
+			sense += fcp_rsp->ext.fr_sns_len;
+		sense_len = min(fcp_rsp->ext.fr_sns_len,
+				(u32) SCSI_SENSE_BUFFERSIZE);
+		memcpy(scsi->sense_buffer, sense, sense_len);
+	}
+
+	if (unlikely(rsp_flags & FCP_RESID_UNDER)) {
+		resid = fcp_rsp->ext.fr_resid;
+		scsi_set_resid(scsi, resid);
+		if (scsi_bufflen(scsi) - resid < scsi->underflow &&
+		     !(rsp_flags & FCP_SNS_LEN_VAL) &&
+		     fcp_rsp->resp.fr_status == SAM_STAT_GOOD)
+			set_host_byte(scsi, DID_ERROR);
+	}
+}
+
+#endif
diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c
index 4e41baa0c141..482dcd97aa5d 100644
--- a/drivers/s390/scsi/zfcp_fsf.c
+++ b/drivers/s390/scsi/zfcp_fsf.c
@@ -10,7 +10,9 @@
 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
 
 #include <linux/blktrace_api.h>
+#include <scsi/fc/fc_els.h>
 #include "zfcp_ext.h"
+#include "zfcp_fc.h"
 #include "zfcp_dbf.h"
 
 static void zfcp_fsf_request_timeout_handler(unsigned long data)
@@ -122,36 +124,32 @@ void zfcp_fsf_req_free(struct zfcp_fsf_req *req)
 
 static void zfcp_fsf_status_read_port_closed(struct zfcp_fsf_req *req)
 {
+	unsigned long flags;
 	struct fsf_status_read_buffer *sr_buf = req->data;
 	struct zfcp_adapter *adapter = req->adapter;
 	struct zfcp_port *port;
-	int d_id = sr_buf->d_id & ZFCP_DID_MASK;
-	unsigned long flags;
+	int d_id = ntoh24(sr_buf->d_id);
 
-	read_lock_irqsave(&zfcp_data.config_lock, flags);
-	list_for_each_entry(port, &adapter->port_list_head, list)
+	read_lock_irqsave(&adapter->port_list_lock, flags);
+	list_for_each_entry(port, &adapter->port_list, list)
 		if (port->d_id == d_id) {
-			read_unlock_irqrestore(&zfcp_data.config_lock, flags);
 			zfcp_erp_port_reopen(port, 0, "fssrpc1", req);
-			return;
+			break;
 		}
-	read_unlock_irqrestore(&zfcp_data.config_lock, flags);
+	read_unlock_irqrestore(&adapter->port_list_lock, flags);
 }
 
 static void zfcp_fsf_link_down_info_eval(struct zfcp_fsf_req *req, char *id,
 					 struct fsf_link_down_info *link_down)
 {
 	struct zfcp_adapter *adapter = req->adapter;
-	unsigned long flags;
 
 	if (atomic_read(&adapter->status) & ZFCP_STATUS_ADAPTER_LINK_UNPLUGGED)
 		return;
 
 	atomic_set_mask(ZFCP_STATUS_ADAPTER_LINK_UNPLUGGED, &adapter->status);
 
-	read_lock_irqsave(&zfcp_data.config_lock, flags);
 	zfcp_scsi_schedule_rports_block(adapter);
-	read_unlock_irqrestore(&zfcp_data.config_lock, flags);
 
 	if (!link_down)
 		goto out;
@@ -291,7 +289,7 @@ static void zfcp_fsf_status_read_handler(struct zfcp_fsf_req *req)
 			zfcp_erp_adapter_access_changed(adapter, "fssrh_3",
 							req);
 		if (sr_buf->status_subtype & FSF_STATUS_READ_SUB_INCOMING_ELS)
-			schedule_work(&adapter->scan_work);
+			queue_work(adapter->work_queue, &adapter->scan_work);
 		break;
 	case FSF_STATUS_READ_CFDC_UPDATED:
 		zfcp_erp_adapter_access_changed(adapter, "fssrh_4", req);
@@ -317,7 +315,6 @@ static void zfcp_fsf_fsfstatus_qual_eval(struct zfcp_fsf_req *req)
 	case FSF_SQ_ULP_DEPENDENT_ERP_REQUIRED:
 		return;
 	case FSF_SQ_COMMAND_ABORTED:
-		req->status |= ZFCP_STATUS_FSFREQ_ABORTED;
 		break;
 	case FSF_SQ_NO_RECOM:
 		dev_err(&req->adapter->ccw_device->dev,
@@ -358,8 +355,7 @@ static void zfcp_fsf_protstatus_eval(struct zfcp_fsf_req *req)
 	zfcp_dbf_hba_fsf_response(req);
 
 	if (req->status & ZFCP_STATUS_FSFREQ_DISMISSED) {
-		req->status |= ZFCP_STATUS_FSFREQ_ERROR |
-			ZFCP_STATUS_FSFREQ_RETRY; /* only for SCSI cmnds. */
+		req->status |= ZFCP_STATUS_FSFREQ_ERROR;
 		return;
 	}
 
@@ -377,7 +373,7 @@ static void zfcp_fsf_protstatus_eval(struct zfcp_fsf_req *req)
 	case FSF_PROT_ERROR_STATE:
 	case FSF_PROT_SEQ_NUMB_ERROR:
 		zfcp_erp_adapter_reopen(adapter, 0, "fspse_2", req);
-		req->status |= ZFCP_STATUS_FSFREQ_RETRY;
+		req->status |= ZFCP_STATUS_FSFREQ_ERROR;
 		break;
 	case FSF_PROT_UNSUPP_QTCB_TYPE:
 		dev_err(&adapter->ccw_device->dev,
@@ -480,20 +476,27 @@ void zfcp_fsf_req_dismiss_all(struct zfcp_adapter *adapter)
 
 static int zfcp_fsf_exchange_config_evaluate(struct zfcp_fsf_req *req)
 {
-	struct fsf_qtcb_bottom_config *bottom;
+	struct fsf_qtcb_bottom_config *bottom = &req->qtcb->bottom.config;
 	struct zfcp_adapter *adapter = req->adapter;
 	struct Scsi_Host *shost = adapter->scsi_host;
+	struct fc_els_flogi *nsp, *plogi;
 
-	bottom = &req->qtcb->bottom.config;
+	/* adjust pointers for missing command code */
+	nsp = (struct fc_els_flogi *) ((u8 *)&bottom->nport_serv_param
+					- sizeof(u32));
+	plogi = (struct fc_els_flogi *) ((u8 *)&bottom->plogi_payload
+					- sizeof(u32));
 
 	if (req->data)
 		memcpy(req->data, bottom, sizeof(*bottom));
 
-	fc_host_node_name(shost) = bottom->nport_serv_param.wwnn;
-	fc_host_port_name(shost) = bottom->nport_serv_param.wwpn;
-	fc_host_port_id(shost) = bottom->s_id & ZFCP_DID_MASK;
+	fc_host_port_name(shost) = nsp->fl_wwpn;
+	fc_host_node_name(shost) = nsp->fl_wwnn;
+	fc_host_port_id(shost) = ntoh24(bottom->s_id);
 	fc_host_speed(shost) = bottom->fc_link_speed;
 	fc_host_supported_classes(shost) = FC_COS_CLASS2 | FC_COS_CLASS3;
+	fc_host_supported_fc4s(shost)[2] = 1; /* FCP */
+	fc_host_active_fc4s(shost)[2] = 1; /* FCP */
 
 	adapter->hydra_version = bottom->adapter_type;
 	adapter->timer_ticks = bottom->timer_interval;
@@ -503,9 +506,9 @@ static int zfcp_fsf_exchange_config_evaluate(struct zfcp_fsf_req *req)
 
 	switch (bottom->fc_topology) {
 	case FSF_TOPO_P2P:
-		adapter->peer_d_id = bottom->peer_d_id & ZFCP_DID_MASK;
-		adapter->peer_wwpn = bottom->plogi_payload.wwpn;
-		adapter->peer_wwnn = bottom->plogi_payload.wwnn;
+		adapter->peer_d_id = ntoh24(bottom->peer_d_id);
+		adapter->peer_wwpn = plogi->fl_wwpn;
+		adapter->peer_wwnn = plogi->fl_wwnn;
 		fc_host_port_type(shost) = FC_PORTTYPE_PTP;
 		break;
 	case FSF_TOPO_FABRIC:
@@ -881,13 +884,11 @@ static void zfcp_fsf_abort_fcp_command_handler(struct zfcp_fsf_req *req)
 		break;
 	case FSF_PORT_BOXED:
 		zfcp_erp_port_boxed(unit->port, "fsafch3", req);
-		req->status |= ZFCP_STATUS_FSFREQ_ERROR |
-			       ZFCP_STATUS_FSFREQ_RETRY;
+		req->status |= ZFCP_STATUS_FSFREQ_ERROR;
 		break;
 	case FSF_LUN_BOXED:
 		zfcp_erp_unit_boxed(unit, "fsafch4", req);
-		req->status |= ZFCP_STATUS_FSFREQ_ERROR |
-			       ZFCP_STATUS_FSFREQ_RETRY;
+		req->status |= ZFCP_STATUS_FSFREQ_ERROR;
                 break;
 	case FSF_ADAPTER_STATUS_AVAILABLE:
 		switch (fsq->word[0]) {
@@ -958,10 +959,10 @@ out:
 static void zfcp_fsf_send_ct_handler(struct zfcp_fsf_req *req)
 {
 	struct zfcp_adapter *adapter = req->adapter;
-	struct zfcp_send_ct *send_ct = req->data;
+	struct zfcp_fsf_ct_els *ct = req->data;
 	struct fsf_qtcb_header *header = &req->qtcb->header;
 
-	send_ct->status = -EINVAL;
+	ct->status = -EINVAL;
 
 	if (req->status & ZFCP_STATUS_FSFREQ_ERROR)
 		goto skip_fsfstatus;
@@ -969,7 +970,7 @@ static void zfcp_fsf_send_ct_handler(struct zfcp_fsf_req *req)
 	switch (header->fsf_status) {
         case FSF_GOOD:
 		zfcp_dbf_san_ct_response(req);
-		send_ct->status = 0;
+		ct->status = 0;
 		break;
         case FSF_SERVICE_CLASS_NOT_SUPPORTED:
 		zfcp_fsf_class_not_supp(req);
@@ -985,8 +986,7 @@ static void zfcp_fsf_send_ct_handler(struct zfcp_fsf_req *req)
 	case FSF_ACCESS_DENIED:
 		break;
         case FSF_PORT_BOXED:
-		req->status |= ZFCP_STATUS_FSFREQ_ERROR |
-			       ZFCP_STATUS_FSFREQ_RETRY;
+		req->status |= ZFCP_STATUS_FSFREQ_ERROR;
 		break;
 	case FSF_PORT_HANDLE_NOT_VALID:
 		zfcp_erp_adapter_reopen(adapter, 0, "fsscth1", req);
@@ -1001,8 +1001,8 @@ static void zfcp_fsf_send_ct_handler(struct zfcp_fsf_req *req)
 	}
 
 skip_fsfstatus:
-	if (send_ct->handler)
-		send_ct->handler(send_ct->handler_data);
+	if (ct->handler)
+		ct->handler(ct->handler_data);
 }
 
 static void zfcp_fsf_setup_ct_els_unchained(struct qdio_buffer_element *sbale,
@@ -1071,15 +1071,17 @@ static int zfcp_fsf_setup_ct_els(struct zfcp_fsf_req *req,
 				 int max_sbals)
 {
 	int ret;
+	unsigned int fcp_chan_timeout;
 
 	ret = zfcp_fsf_setup_ct_els_sbals(req, sg_req, sg_resp, max_sbals);
 	if (ret)
 		return ret;
 
 	/* common settings for ct/gs and els requests */
+	fcp_chan_timeout = 2 * FC_DEF_R_A_TOV / 1000;
 	req->qtcb->bottom.support.service_class = FSF_CLASS_3;
-	req->qtcb->bottom.support.timeout = 2 * R_A_TOV;
-	zfcp_fsf_start_timer(req, (2 * R_A_TOV + 10) * HZ);
+	req->qtcb->bottom.support.timeout = fcp_chan_timeout;
+	zfcp_fsf_start_timer(req, (fcp_chan_timeout + 10) * HZ);
 
 	return 0;
 }
@@ -1089,9 +1091,9 @@ static int zfcp_fsf_setup_ct_els(struct zfcp_fsf_req *req,
  * @ct: pointer to struct zfcp_send_ct with data for request
  * @pool: if non-null this mempool is used to allocate struct zfcp_fsf_req
  */
-int zfcp_fsf_send_ct(struct zfcp_send_ct *ct, mempool_t *pool)
+int zfcp_fsf_send_ct(struct zfcp_fc_wka_port *wka_port,
+		     struct zfcp_fsf_ct_els *ct, mempool_t *pool)
 {
-	struct zfcp_wka_port *wka_port = ct->wka_port;
 	struct zfcp_qdio *qdio = wka_port->adapter->qdio;
 	struct zfcp_fsf_req *req;
 	int ret = -EIO;
@@ -1117,7 +1119,7 @@ int zfcp_fsf_send_ct(struct zfcp_send_ct *ct, mempool_t *pool)
 	req->qtcb->header.port_handle = wka_port->handle;
 	req->data = ct;
 
-	zfcp_dbf_san_ct_request(req);
+	zfcp_dbf_san_ct_request(req, wka_port->d_id);
 
 	ret = zfcp_fsf_req_send(req);
 	if (ret)
@@ -1134,7 +1136,7 @@ out:
 
 static void zfcp_fsf_send_els_handler(struct zfcp_fsf_req *req)
 {
-	struct zfcp_send_els *send_els = req->data;
+	struct zfcp_fsf_ct_els *send_els = req->data;
 	struct zfcp_port *port = send_els->port;
 	struct fsf_qtcb_header *header = &req->qtcb->header;
 
@@ -1154,9 +1156,6 @@ static void zfcp_fsf_send_els_handler(struct zfcp_fsf_req *req)
 	case FSF_ADAPTER_STATUS_AVAILABLE:
 		switch (header->fsf_status_qual.word[0]){
 		case FSF_SQ_INVOKE_LINK_TEST_PROCEDURE:
-			if (port && (send_els->ls_code != ZFCP_LS_ADISC))
-				zfcp_fc_test_link(port);
-			/*fall through */
 		case FSF_SQ_ULP_DEPENDENT_ERP_REQUIRED:
 		case FSF_SQ_RETRY_IF_POSSIBLE:
 			req->status |= ZFCP_STATUS_FSFREQ_ERROR;
@@ -1188,10 +1187,11 @@ skip_fsfstatus:
  * zfcp_fsf_send_els - initiate an ELS command (FC-FS)
  * @els: pointer to struct zfcp_send_els with data for the command
  */
-int zfcp_fsf_send_els(struct zfcp_send_els *els)
+int zfcp_fsf_send_els(struct zfcp_adapter *adapter, u32 d_id,
+		      struct zfcp_fsf_ct_els *els)
 {
 	struct zfcp_fsf_req *req;
-	struct zfcp_qdio *qdio = els->adapter->qdio;
+	struct zfcp_qdio *qdio = adapter->qdio;
 	int ret = -EIO;
 
 	spin_lock_bh(&qdio->req_q_lock);
@@ -1211,7 +1211,7 @@ int zfcp_fsf_send_els(struct zfcp_send_els *els)
 	if (ret)
 		goto failed_send;
 
-	req->qtcb->bottom.support.d_id = els->d_id;
+	hton24(req->qtcb->bottom.support.d_id, d_id);
 	req->handler = zfcp_fsf_send_els_handler;
 	req->data = els;
 
@@ -1422,7 +1422,7 @@ static void zfcp_fsf_open_port_handler(struct zfcp_fsf_req *req)
 {
 	struct zfcp_port *port = req->data;
 	struct fsf_qtcb_header *header = &req->qtcb->header;
-	struct fsf_plogi *plogi;
+	struct fc_els_flogi *plogi;
 
 	if (req->status & ZFCP_STATUS_FSFREQ_ERROR)
 		goto out;
@@ -1472,23 +1472,10 @@ static void zfcp_fsf_open_port_handler(struct zfcp_fsf_req *req)
 		 * another GID_PN straight after a port has been opened.
 		 * Alternately, an ADISC/PDISC ELS should suffice, as well.
 		 */
-		plogi = (struct fsf_plogi *) req->qtcb->bottom.support.els;
+		plogi = (struct fc_els_flogi *) req->qtcb->bottom.support.els;
 		if (req->qtcb->bottom.support.els1_length >=
-		    FSF_PLOGI_MIN_LEN) {
-			if (plogi->serv_param.wwpn != port->wwpn) {
-				port->d_id = 0;
-				dev_warn(&port->adapter->ccw_device->dev,
-					 "A port opened with WWPN 0x%016Lx "
-					 "returned data that identifies it as "
-					 "WWPN 0x%016Lx\n",
-					 (unsigned long long) port->wwpn,
-					 (unsigned long long)
-					  plogi->serv_param.wwpn);
-			} else {
-				port->wwnn = plogi->serv_param.wwnn;
+		    FSF_PLOGI_MIN_LEN)
 				zfcp_fc_plogi_evaluate(port, plogi);
-			}
-		}
 		break;
 	case FSF_UNKNOWN_OP_SUBTYPE:
 		req->status |= ZFCP_STATUS_FSFREQ_ERROR;
@@ -1496,7 +1483,7 @@ static void zfcp_fsf_open_port_handler(struct zfcp_fsf_req *req)
 	}
 
 out:
-	zfcp_port_put(port);
+	put_device(&port->sysfs_device);
 }
 
 /**
@@ -1530,18 +1517,18 @@ int zfcp_fsf_open_port(struct zfcp_erp_action *erp_action)
         sbale[1].flags |= SBAL_FLAGS_LAST_ENTRY;
 
 	req->handler = zfcp_fsf_open_port_handler;
-	req->qtcb->bottom.support.d_id = port->d_id;
+	hton24(req->qtcb->bottom.support.d_id, port->d_id);
 	req->data = port;
 	req->erp_action = erp_action;
 	erp_action->fsf_req = req;
-	zfcp_port_get(port);
+	get_device(&port->sysfs_device);
 
 	zfcp_fsf_start_erp_timer(req);
 	retval = zfcp_fsf_req_send(req);
 	if (retval) {
 		zfcp_fsf_req_free(req);
 		erp_action->fsf_req = NULL;
-		zfcp_port_put(port);
+		put_device(&port->sysfs_device);
 	}
 out:
 	spin_unlock_bh(&qdio->req_q_lock);
@@ -1618,11 +1605,11 @@ out:
 
 static void zfcp_fsf_open_wka_port_handler(struct zfcp_fsf_req *req)
 {
-	struct zfcp_wka_port *wka_port = req->data;
+	struct zfcp_fc_wka_port *wka_port = req->data;
 	struct fsf_qtcb_header *header = &req->qtcb->header;
 
 	if (req->status & ZFCP_STATUS_FSFREQ_ERROR) {
-		wka_port->status = ZFCP_WKA_PORT_OFFLINE;
+		wka_port->status = ZFCP_FC_WKA_PORT_OFFLINE;
 		goto out;
 	}
 
@@ -1635,13 +1622,13 @@ static void zfcp_fsf_open_wka_port_handler(struct zfcp_fsf_req *req)
 		req->status |= ZFCP_STATUS_FSFREQ_ERROR;
 		/* fall through */
 	case FSF_ACCESS_DENIED:
-		wka_port->status = ZFCP_WKA_PORT_OFFLINE;
+		wka_port->status = ZFCP_FC_WKA_PORT_OFFLINE;
 		break;
 	case FSF_GOOD:
 		wka_port->handle = header->port_handle;
 		/* fall through */
 	case FSF_PORT_ALREADY_OPEN:
-		wka_port->status = ZFCP_WKA_PORT_ONLINE;
+		wka_port->status = ZFCP_FC_WKA_PORT_ONLINE;
 	}
 out:
 	wake_up(&wka_port->completion_wq);
@@ -1649,10 +1636,10 @@ out:
 
 /**
  * zfcp_fsf_open_wka_port - create and send open wka-port request
- * @wka_port: pointer to struct zfcp_wka_port
+ * @wka_port: pointer to struct zfcp_fc_wka_port
  * Returns: 0 on success, error otherwise
  */
-int zfcp_fsf_open_wka_port(struct zfcp_wka_port *wka_port)
+int zfcp_fsf_open_wka_port(struct zfcp_fc_wka_port *wka_port)
 {
 	struct qdio_buffer_element *sbale;
 	struct zfcp_qdio *qdio = wka_port->adapter->qdio;
@@ -1677,7 +1664,7 @@ int zfcp_fsf_open_wka_port(struct zfcp_wka_port *wka_port)
 	sbale[1].flags |= SBAL_FLAGS_LAST_ENTRY;
 
 	req->handler = zfcp_fsf_open_wka_port_handler;
-	req->qtcb->bottom.support.d_id = wka_port->d_id;
+	hton24(req->qtcb->bottom.support.d_id, wka_port->d_id);
 	req->data = wka_port;
 
 	zfcp_fsf_start_timer(req, ZFCP_FSF_REQUEST_TIMEOUT);
@@ -1691,23 +1678,23 @@ out:
 
 static void zfcp_fsf_close_wka_port_handler(struct zfcp_fsf_req *req)
 {
-	struct zfcp_wka_port *wka_port = req->data;
+	struct zfcp_fc_wka_port *wka_port = req->data;
 
 	if (req->qtcb->header.fsf_status == FSF_PORT_HANDLE_NOT_VALID) {
 		req->status |= ZFCP_STATUS_FSFREQ_ERROR;
 		zfcp_erp_adapter_reopen(wka_port->adapter, 0, "fscwph1", req);
 	}
 
-	wka_port->status = ZFCP_WKA_PORT_OFFLINE;
+	wka_port->status = ZFCP_FC_WKA_PORT_OFFLINE;
 	wake_up(&wka_port->completion_wq);
 }
 
 /**
  * zfcp_fsf_close_wka_port - create and send close wka port request
- * @erp_action: pointer to struct zfcp_erp_action
+ * @wka_port: WKA port to open
  * Returns: 0 on success, error otherwise
  */
-int zfcp_fsf_close_wka_port(struct zfcp_wka_port *wka_port)
+int zfcp_fsf_close_wka_port(struct zfcp_fc_wka_port *wka_port)
 {
 	struct qdio_buffer_element *sbale;
 	struct zfcp_qdio *qdio = wka_port->adapter->qdio;
@@ -1765,13 +1752,13 @@ static void zfcp_fsf_close_physical_port_handler(struct zfcp_fsf_req *req)
 		/* can't use generic zfcp_erp_modify_port_status because
 		 * ZFCP_STATUS_COMMON_OPEN must not be reset for the port */
 		atomic_clear_mask(ZFCP_STATUS_PORT_PHYS_OPEN, &port->status);
-		list_for_each_entry(unit, &port->unit_list_head, list)
+		read_lock(&port->unit_list_lock);
+		list_for_each_entry(unit, &port->unit_list, list)
 			atomic_clear_mask(ZFCP_STATUS_COMMON_OPEN,
 					  &unit->status);
+		read_unlock(&port->unit_list_lock);
 		zfcp_erp_port_boxed(port, "fscpph2", req);
-		req->status |= ZFCP_STATUS_FSFREQ_ERROR |
-			       ZFCP_STATUS_FSFREQ_RETRY;
-
+		req->status |= ZFCP_STATUS_FSFREQ_ERROR;
 		break;
 	case FSF_ADAPTER_STATUS_AVAILABLE:
 		switch (header->fsf_status_qual.word[0]) {
@@ -1787,9 +1774,11 @@ static void zfcp_fsf_close_physical_port_handler(struct zfcp_fsf_req *req)
 		 * ZFCP_STATUS_COMMON_OPEN must not be reset for the port
 		 */
 		atomic_clear_mask(ZFCP_STATUS_PORT_PHYS_OPEN, &port->status);
-		list_for_each_entry(unit, &port->unit_list_head, list)
+		read_lock(&port->unit_list_lock);
+		list_for_each_entry(unit, &port->unit_list, list)
 			atomic_clear_mask(ZFCP_STATUS_COMMON_OPEN,
 					  &unit->status);
+		read_unlock(&port->unit_list_lock);
 		break;
 	}
 }
@@ -1873,8 +1862,7 @@ static void zfcp_fsf_open_unit_handler(struct zfcp_fsf_req *req)
 		break;
 	case FSF_PORT_BOXED:
 		zfcp_erp_port_boxed(unit->port, "fsouh_2", req);
-		req->status |= ZFCP_STATUS_FSFREQ_ERROR |
-			       ZFCP_STATUS_FSFREQ_RETRY;
+		req->status |= ZFCP_STATUS_FSFREQ_ERROR;
 		break;
 	case FSF_LUN_SHARING_VIOLATION:
 		if (header->fsf_status_qual.word[0])
@@ -2036,8 +2024,7 @@ static void zfcp_fsf_close_unit_handler(struct zfcp_fsf_req *req)
 		break;
 	case FSF_PORT_BOXED:
 		zfcp_erp_port_boxed(unit->port, "fscuh_3", req);
-		req->status |= ZFCP_STATUS_FSFREQ_ERROR |
-			       ZFCP_STATUS_FSFREQ_RETRY;
+		req->status |= ZFCP_STATUS_FSFREQ_ERROR;
 		break;
 	case FSF_ADAPTER_STATUS_AVAILABLE:
 		switch (req->qtcb->header.fsf_status_qual.word[0]) {
@@ -2109,72 +2096,57 @@ static void zfcp_fsf_update_lat(struct fsf_latency_record *lat_rec, u32 lat)
 	lat_rec->max = max(lat_rec->max, lat);
 }
 
-static void zfcp_fsf_req_latency(struct zfcp_fsf_req *req)
+static void zfcp_fsf_req_trace(struct zfcp_fsf_req *req, struct scsi_cmnd *scsi)
 {
-	struct fsf_qual_latency_info *lat_inf;
-	struct latency_cont *lat;
+	struct fsf_qual_latency_info *lat_in;
+	struct latency_cont *lat = NULL;
 	struct zfcp_unit *unit = req->unit;
+	struct zfcp_blk_drv_data blktrc;
+	int ticks = req->adapter->timer_ticks;
 
-	lat_inf = &req->qtcb->prefix.prot_status_qual.latency_info;
-
-	switch (req->qtcb->bottom.io.data_direction) {
-	case FSF_DATADIR_READ:
-		lat = &unit->latencies.read;
-		break;
-	case FSF_DATADIR_WRITE:
-		lat = &unit->latencies.write;
-		break;
-	case FSF_DATADIR_CMND:
-		lat = &unit->latencies.cmd;
-		break;
-	default:
-		return;
-	}
+	lat_in = &req->qtcb->prefix.prot_status_qual.latency_info;
 
-	spin_lock(&unit->latencies.lock);
-	zfcp_fsf_update_lat(&lat->channel, lat_inf->channel_lat);
-	zfcp_fsf_update_lat(&lat->fabric, lat_inf->fabric_lat);
-	lat->counter++;
-	spin_unlock(&unit->latencies.lock);
-}
-
-#ifdef CONFIG_BLK_DEV_IO_TRACE
-static void zfcp_fsf_trace_latency(struct zfcp_fsf_req *fsf_req)
-{
-	struct fsf_qual_latency_info *lat_inf;
-	struct scsi_cmnd *scsi_cmnd = (struct scsi_cmnd *)fsf_req->data;
-	struct request *req = scsi_cmnd->request;
-	struct zfcp_blk_drv_data trace;
-	int ticks = fsf_req->adapter->timer_ticks;
+	blktrc.flags = 0;
+	blktrc.magic = ZFCP_BLK_DRV_DATA_MAGIC;
+	if (req->status & ZFCP_STATUS_FSFREQ_ERROR)
+		blktrc.flags |= ZFCP_BLK_REQ_ERROR;
+	blktrc.inb_usage = req->queue_req.qdio_inb_usage;
+	blktrc.outb_usage = req->queue_req.qdio_outb_usage;
+
+	if (req->adapter->adapter_features & FSF_FEATURE_MEASUREMENT_DATA) {
+		blktrc.flags |= ZFCP_BLK_LAT_VALID;
+		blktrc.channel_lat = lat_in->channel_lat * ticks;
+		blktrc.fabric_lat = lat_in->fabric_lat * ticks;
+
+		switch (req->qtcb->bottom.io.data_direction) {
+		case FSF_DATADIR_READ:
+			lat = &unit->latencies.read;
+			break;
+		case FSF_DATADIR_WRITE:
+			lat = &unit->latencies.write;
+			break;
+		case FSF_DATADIR_CMND:
+			lat = &unit->latencies.cmd;
+			break;
+		}
 
-	trace.flags = 0;
-	trace.magic = ZFCP_BLK_DRV_DATA_MAGIC;
-	if (fsf_req->adapter->adapter_features & FSF_FEATURE_MEASUREMENT_DATA) {
-		trace.flags |= ZFCP_BLK_LAT_VALID;
-		lat_inf = &fsf_req->qtcb->prefix.prot_status_qual.latency_info;
-		trace.channel_lat = lat_inf->channel_lat * ticks;
-		trace.fabric_lat = lat_inf->fabric_lat * ticks;
+		if (lat) {
+			spin_lock(&unit->latencies.lock);
+			zfcp_fsf_update_lat(&lat->channel, lat_in->channel_lat);
+			zfcp_fsf_update_lat(&lat->fabric, lat_in->fabric_lat);
+			lat->counter++;
+			spin_unlock(&unit->latencies.lock);
+		}
 	}
-	if (fsf_req->status & ZFCP_STATUS_FSFREQ_ERROR)
-		trace.flags |= ZFCP_BLK_REQ_ERROR;
-	trace.inb_usage = fsf_req->queue_req.qdio_inb_usage;
-	trace.outb_usage = fsf_req->queue_req.qdio_outb_usage;
 
-	blk_add_driver_data(req->q, req, &trace, sizeof(trace));
-}
-#else
-static inline void zfcp_fsf_trace_latency(struct zfcp_fsf_req *fsf_req)
-{
+	blk_add_driver_data(scsi->request->q, scsi->request, &blktrc,
+			    sizeof(blktrc));
 }
-#endif
 
 static void zfcp_fsf_send_fcp_command_task_handler(struct zfcp_fsf_req *req)
 {
 	struct scsi_cmnd *scpnt;
-	struct fcp_rsp_iu *fcp_rsp_iu = (struct fcp_rsp_iu *)
-	    &(req->qtcb->bottom.io.fcp_rsp);
-	u32 sns_len;
-	char *fcp_rsp_info = (unsigned char *) &fcp_rsp_iu[1];
+	struct fcp_resp_with_ext *fcp_rsp;
 	unsigned long flags;
 
 	read_lock_irqsave(&req->adapter->abort_lock, flags);
@@ -2185,50 +2157,16 @@ static void zfcp_fsf_send_fcp_command_task_handler(struct zfcp_fsf_req *req)
 		return;
 	}
 
-	if (unlikely(req->status & ZFCP_STATUS_FSFREQ_ABORTED)) {
-		set_host_byte(scpnt, DID_SOFT_ERROR);
-		goto skip_fsfstatus;
-	}
-
 	if (unlikely(req->status & ZFCP_STATUS_FSFREQ_ERROR)) {
-		set_host_byte(scpnt, DID_ERROR);
+		set_host_byte(scpnt, DID_TRANSPORT_DISRUPTED);
 		goto skip_fsfstatus;
 	}
 
-	set_msg_byte(scpnt, COMMAND_COMPLETE);
-
-	scpnt->result |= fcp_rsp_iu->scsi_status;
+	fcp_rsp = (struct fcp_resp_with_ext *) &req->qtcb->bottom.io.fcp_rsp;
+	zfcp_fc_eval_fcp_rsp(fcp_rsp, scpnt);
 
-	if (req->adapter->adapter_features & FSF_FEATURE_MEASUREMENT_DATA)
-		zfcp_fsf_req_latency(req);
-
-	zfcp_fsf_trace_latency(req);
-
-	if (unlikely(fcp_rsp_iu->validity.bits.fcp_rsp_len_valid)) {
-		if (fcp_rsp_info[3] == RSP_CODE_GOOD)
-			set_host_byte(scpnt, DID_OK);
-		else {
-			set_host_byte(scpnt, DID_ERROR);
-			goto skip_fsfstatus;
-		}
-	}
-
-	if (unlikely(fcp_rsp_iu->validity.bits.fcp_sns_len_valid)) {
-		sns_len = FSF_FCP_RSP_SIZE - sizeof(struct fcp_rsp_iu) +
-			  fcp_rsp_iu->fcp_rsp_len;
-		sns_len = min(sns_len, (u32) SCSI_SENSE_BUFFERSIZE);
-		sns_len = min(sns_len, fcp_rsp_iu->fcp_sns_len);
-
-		memcpy(scpnt->sense_buffer,
-		       zfcp_get_fcp_sns_info_ptr(fcp_rsp_iu), sns_len);
-	}
+	zfcp_fsf_req_trace(req, scpnt);
 
-	if (unlikely(fcp_rsp_iu->validity.bits.fcp_resid_under)) {
-		scsi_set_resid(scpnt, fcp_rsp_iu->fcp_resid);
-		if (scsi_bufflen(scpnt) - scsi_get_resid(scpnt) <
-		    scpnt->underflow)
-			set_host_byte(scpnt, DID_ERROR);
-	}
 skip_fsfstatus:
 	if (scpnt->result != 0)
 		zfcp_dbf_scsi_result("erro", 3, req->adapter->dbf, scpnt, req);
@@ -2250,11 +2188,13 @@ skip_fsfstatus:
 
 static void zfcp_fsf_send_fcp_ctm_handler(struct zfcp_fsf_req *req)
 {
-	struct fcp_rsp_iu *fcp_rsp_iu = (struct fcp_rsp_iu *)
-	    &(req->qtcb->bottom.io.fcp_rsp);
-	char *fcp_rsp_info = (unsigned char *) &fcp_rsp_iu[1];
+	struct fcp_resp_with_ext *fcp_rsp;
+	struct fcp_resp_rsp_info *rsp_info;
+
+	fcp_rsp = (struct fcp_resp_with_ext *) &req->qtcb->bottom.io.fcp_rsp;
+	rsp_info = (struct fcp_resp_rsp_info *) &fcp_rsp[1];
 
-	if ((fcp_rsp_info[3] != RSP_CODE_GOOD) ||
+	if ((rsp_info->rsp_code != FCP_TMF_CMPL) ||
 	     (req->status & ZFCP_STATUS_FSFREQ_ERROR))
 		req->status |= ZFCP_STATUS_FSFREQ_TMFUNCFAILED;
 }
@@ -2314,13 +2254,11 @@ static void zfcp_fsf_send_fcp_command_handler(struct zfcp_fsf_req *req)
 		break;
 	case FSF_PORT_BOXED:
 		zfcp_erp_port_boxed(unit->port, "fssfch5", req);
-		req->status |= ZFCP_STATUS_FSFREQ_ERROR |
-			       ZFCP_STATUS_FSFREQ_RETRY;
+		req->status |= ZFCP_STATUS_FSFREQ_ERROR;
 		break;
 	case FSF_LUN_BOXED:
 		zfcp_erp_unit_boxed(unit, "fssfch6", req);
-		req->status |= ZFCP_STATUS_FSFREQ_ERROR |
-			       ZFCP_STATUS_FSFREQ_RETRY;
+		req->status |= ZFCP_STATUS_FSFREQ_ERROR;
 		break;
 	case FSF_ADAPTER_STATUS_AVAILABLE:
 		if (header->fsf_status_qual.word[0] ==
@@ -2335,24 +2273,10 @@ skip_fsfstatus:
 	else {
 		zfcp_fsf_send_fcp_command_task_handler(req);
 		req->unit = NULL;
-		zfcp_unit_put(unit);
+		put_device(&unit->sysfs_device);
 	}
 }
 
-static void zfcp_set_fcp_dl(struct fcp_cmnd_iu *fcp_cmd, u32 fcp_dl)
-{
-	u32 *fcp_dl_ptr;
-
-	/*
-	 * fcp_dl_addr = start address of fcp_cmnd structure +
-	 * size of fixed part + size of dynamically sized add_dcp_cdb field
-	 * SEE FCP-2 documentation
-	 */
-	fcp_dl_ptr = (u32 *) ((unsigned char *) &fcp_cmd[1] +
-			(fcp_cmd->add_fcp_cdb_length << 2));
-	*fcp_dl_ptr = fcp_dl;
-}
-
 /**
  * zfcp_fsf_send_fcp_command_task - initiate an FCP command (for a SCSI command)
  * @unit: unit where command is sent to
@@ -2362,7 +2286,7 @@ int zfcp_fsf_send_fcp_command_task(struct zfcp_unit *unit,
 				   struct scsi_cmnd *scsi_cmnd)
 {
 	struct zfcp_fsf_req *req;
-	struct fcp_cmnd_iu *fcp_cmnd_iu;
+	struct fcp_cmnd *fcp_cmnd;
 	unsigned int sbtype = SBAL_FLAGS0_TYPE_READ;
 	int real_bytes, retval = -EIO;
 	struct zfcp_adapter *adapter = unit->port->adapter;
@@ -2387,23 +2311,21 @@ int zfcp_fsf_send_fcp_command_task(struct zfcp_unit *unit,
 	}
 
 	req->status |= ZFCP_STATUS_FSFREQ_CLEANUP;
-	zfcp_unit_get(unit);
+	get_device(&unit->sysfs_device);
 	req->unit = unit;
 	req->data = scsi_cmnd;
 	req->handler = zfcp_fsf_send_fcp_command_handler;
 	req->qtcb->header.lun_handle = unit->handle;
 	req->qtcb->header.port_handle = unit->port->handle;
 	req->qtcb->bottom.io.service_class = FSF_CLASS_3;
+	req->qtcb->bottom.io.fcp_cmnd_length = FCP_CMND_LEN;
 
 	scsi_cmnd->host_scribble = (unsigned char *) req->req_id;
 
-	fcp_cmnd_iu = (struct fcp_cmnd_iu *) &(req->qtcb->bottom.io.fcp_cmnd);
-	fcp_cmnd_iu->fcp_lun = unit->fcp_lun;
 	/*
 	 * set depending on data direction:
 	 *      data direction bits in SBALE (SB Type)
 	 *      data direction bits in QTCB
-	 *      data direction bits in FCP_CMND IU
 	 */
 	switch (scsi_cmnd->sc_data_direction) {
 	case DMA_NONE:
@@ -2411,32 +2333,17 @@ int zfcp_fsf_send_fcp_command_task(struct zfcp_unit *unit,
 		break;
 	case DMA_FROM_DEVICE:
 		req->qtcb->bottom.io.data_direction = FSF_DATADIR_READ;
-		fcp_cmnd_iu->rddata = 1;
 		break;
 	case DMA_TO_DEVICE:
 		req->qtcb->bottom.io.data_direction = FSF_DATADIR_WRITE;
 		sbtype = SBAL_FLAGS0_TYPE_WRITE;
-		fcp_cmnd_iu->wddata = 1;
 		break;
 	case DMA_BIDIRECTIONAL:
 		goto failed_scsi_cmnd;
 	}
 
-	if (likely((scsi_cmnd->device->simple_tags) ||
-		   ((atomic_read(&unit->status) & ZFCP_STATUS_UNIT_READONLY) &&
-		    (atomic_read(&unit->status) & ZFCP_STATUS_UNIT_SHARED))))
-		fcp_cmnd_iu->task_attribute = SIMPLE_Q;
-	else
-		fcp_cmnd_iu->task_attribute = UNTAGGED;
-
-	if (unlikely(scsi_cmnd->cmd_len > FCP_CDB_LENGTH))
-		fcp_cmnd_iu->add_fcp_cdb_length =
-			(scsi_cmnd->cmd_len - FCP_CDB_LENGTH) >> 2;
-
-	memcpy(fcp_cmnd_iu->fcp_cdb, scsi_cmnd->cmnd, scsi_cmnd->cmd_len);
-
-	req->qtcb->bottom.io.fcp_cmnd_length = sizeof(struct fcp_cmnd_iu) +
-		fcp_cmnd_iu->add_fcp_cdb_length + sizeof(u32);
+	fcp_cmnd = (struct fcp_cmnd *) &req->qtcb->bottom.io.fcp_cmnd;
+	zfcp_fc_scsi_to_fcp(fcp_cmnd, scsi_cmnd);
 
 	real_bytes = zfcp_qdio_sbals_from_sg(qdio, &req->queue_req, sbtype,
 					     scsi_sglist(scsi_cmnd),
@@ -2454,8 +2361,6 @@ int zfcp_fsf_send_fcp_command_task(struct zfcp_unit *unit,
 		goto failed_scsi_cmnd;
 	}
 
-	zfcp_set_fcp_dl(fcp_cmnd_iu, real_bytes);
-
 	retval = zfcp_fsf_req_send(req);
 	if (unlikely(retval))
 		goto failed_scsi_cmnd;
@@ -2463,7 +2368,7 @@ int zfcp_fsf_send_fcp_command_task(struct zfcp_unit *unit,
 	goto out;
 
 failed_scsi_cmnd:
-	zfcp_unit_put(unit);
+	put_device(&unit->sysfs_device);
 	zfcp_fsf_req_free(req);
 	scsi_cmnd->host_scribble = NULL;
 out:
@@ -2481,7 +2386,7 @@ struct zfcp_fsf_req *zfcp_fsf_send_fcp_ctm(struct zfcp_unit *unit, u8 tm_flags)
 {
 	struct qdio_buffer_element *sbale;
 	struct zfcp_fsf_req *req = NULL;
-	struct fcp_cmnd_iu *fcp_cmnd_iu;
+	struct fcp_cmnd *fcp_cmnd;
 	struct zfcp_qdio *qdio = unit->port->adapter->qdio;
 
 	if (unlikely(!(atomic_read(&unit->status) &
@@ -2507,16 +2412,14 @@ struct zfcp_fsf_req *zfcp_fsf_send_fcp_ctm(struct zfcp_unit *unit, u8 tm_flags)
 	req->qtcb->header.port_handle = unit->port->handle;
 	req->qtcb->bottom.io.data_direction = FSF_DATADIR_CMND;
 	req->qtcb->bottom.io.service_class = FSF_CLASS_3;
-	req->qtcb->bottom.io.fcp_cmnd_length = 	sizeof(struct fcp_cmnd_iu) +
-						sizeof(u32);
+	req->qtcb->bottom.io.fcp_cmnd_length = FCP_CMND_LEN;
 
 	sbale = zfcp_qdio_sbale_req(qdio, &req->queue_req);
 	sbale[0].flags |= SBAL_FLAGS0_TYPE_WRITE;
 	sbale[1].flags |= SBAL_FLAGS_LAST_ENTRY;
 
-	fcp_cmnd_iu = (struct fcp_cmnd_iu *) &req->qtcb->bottom.io.fcp_cmnd;
-	fcp_cmnd_iu->fcp_lun = unit->fcp_lun;
-	fcp_cmnd_iu->task_management_flags = tm_flags;
+	fcp_cmnd = (struct fcp_cmnd *) &req->qtcb->bottom.io.fcp_cmnd;
+	zfcp_fc_fcp_tm(fcp_cmnd, unit->device, tm_flags);
 
 	zfcp_fsf_start_timer(req, ZFCP_SCSI_ER_TIMEOUT);
 	if (!zfcp_fsf_req_send(req))
diff --git a/drivers/s390/scsi/zfcp_fsf.h b/drivers/s390/scsi/zfcp_fsf.h
index dcc7c1dbcf58..b3de682b64cf 100644
--- a/drivers/s390/scsi/zfcp_fsf.h
+++ b/drivers/s390/scsi/zfcp_fsf.h
@@ -11,6 +11,7 @@
 
 #include <linux/pfn.h>
 #include <linux/scatterlist.h>
+#include <scsi/libfc.h>
 
 #define FSF_QTCB_CURRENT_VERSION		0x00000001
 
@@ -228,7 +229,8 @@ struct fsf_status_read_buffer {
 	u32 length;
 	u32 res1;
 	struct fsf_queue_designator queue_designator;
-	u32 d_id;
+	u8 res2;
+	u8 d_id[3];
 	u32 class;
 	u64 fcp_lun;
 	u8  res3[24];
@@ -309,22 +311,7 @@ struct fsf_qtcb_header {
 	u8  res4[16];
 } __attribute__ ((packed));
 
-struct fsf_nport_serv_param {
-	u8  common_serv_param[16];
-	u64 wwpn;
-	u64 wwnn;
-	u8  class1_serv_param[16];
-	u8  class2_serv_param[16];
-	u8  class3_serv_param[16];
-	u8  class4_serv_param[16];
-	u8  vendor_version_level[16];
-} __attribute__ ((packed));
-
 #define FSF_PLOGI_MIN_LEN	112
-struct fsf_plogi {
-	u32    code;
-	struct fsf_nport_serv_param serv_param;
-} __attribute__ ((packed));
 
 #define FSF_FCP_CMND_SIZE	288
 #define FSF_FCP_RSP_SIZE	128
@@ -342,8 +329,8 @@ struct fsf_qtcb_bottom_io {
 
 struct fsf_qtcb_bottom_support {
 	u32 operation_subtype;
-	u8  res1[12];
-	u32 d_id;
+	u8  res1[13];
+	u8 d_id[3];
 	u32 option;
 	u64 fcp_lun;
 	u64 res2;
@@ -372,18 +359,18 @@ struct fsf_qtcb_bottom_config {
 	u32 fc_topology;
 	u32 fc_link_speed;
 	u32 adapter_type;
-	u32 peer_d_id;
+	u8 res0;
+	u8 peer_d_id[3];
 	u8 res1[2];
 	u16 timer_interval;
-	u8 res2[8];
-	u32 s_id;
-	struct fsf_nport_serv_param nport_serv_param;
-	u8 reserved_nport_serv_param[16];
+	u8 res2[9];
+	u8 s_id[3];
+	u8 nport_serv_param[128];
 	u8 res3[8];
 	u32 adapter_ports;
 	u32 hardware_version;
 	u8 serial_number[32];
-	struct fsf_nport_serv_param plogi_payload;
+	u8 plogi_payload[112];
 	struct fsf_statistics_info stat_info;
 	u8 res4[112];
 } __attribute__ ((packed));
@@ -450,4 +437,22 @@ struct zfcp_blk_drv_data {
 	u64 fabric_lat;
 } __attribute__ ((packed));
 
+/**
+ * struct zfcp_fsf_ct_els - zfcp data for ct or els request
+ * @req: scatter-gather list for request
+ * @resp: scatter-gather list for response
+ * @handler: handler function (called for response to the request)
+ * @handler_data: data passed to handler function
+ * @port: Optional pointer to port for zfcp internal ELS (only test link ADISC)
+ * @status: used to pass error status to calling function
+ */
+struct zfcp_fsf_ct_els {
+	struct scatterlist *req;
+	struct scatterlist *resp;
+	void (*handler)(void *);
+	void *handler_data;
+	struct zfcp_port *port;
+	int status;
+};
+
 #endif				/* FSF_H */
diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c
index 0e1a34627a2e..771cc536a989 100644
--- a/drivers/s390/scsi/zfcp_scsi.c
+++ b/drivers/s390/scsi/zfcp_scsi.c
@@ -9,29 +9,33 @@
 #define KMSG_COMPONENT "zfcp"
 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
 
+#include <linux/types.h>
+#include <scsi/fc/fc_fcp.h>
 #include <asm/atomic.h>
 #include "zfcp_ext.h"
 #include "zfcp_dbf.h"
+#include "zfcp_fc.h"
 
 static unsigned int default_depth = 32;
 module_param_named(queue_depth, default_depth, uint, 0600);
 MODULE_PARM_DESC(queue_depth, "Default queue depth for new SCSI devices");
 
-/* Find start of Sense Information in FCP response unit*/
-char *zfcp_get_fcp_sns_info_ptr(struct fcp_rsp_iu *fcp_rsp_iu)
+static int zfcp_scsi_change_queue_depth(struct scsi_device *sdev, int depth,
+					int reason)
 {
-	char *fcp_sns_info_ptr;
-
-	fcp_sns_info_ptr = (unsigned char *) &fcp_rsp_iu[1];
-	if (fcp_rsp_iu->validity.bits.fcp_rsp_len_valid)
-		fcp_sns_info_ptr += fcp_rsp_iu->fcp_rsp_len;
-
-	return fcp_sns_info_ptr;
-}
-
-static int zfcp_scsi_change_queue_depth(struct scsi_device *sdev, int depth)
-{
-	scsi_adjust_queue_depth(sdev, scsi_get_tag_type(sdev), depth);
+	switch (reason) {
+	case SCSI_QDEPTH_DEFAULT:
+		scsi_adjust_queue_depth(sdev, scsi_get_tag_type(sdev), depth);
+		break;
+	case SCSI_QDEPTH_QFULL:
+		scsi_track_queue_full(sdev, depth);
+		break;
+	case SCSI_QDEPTH_RAMP_UP:
+		scsi_adjust_queue_depth(sdev, scsi_get_tag_type(sdev), depth);
+		break;
+	default:
+		return -EOPNOTSUPP;
+	}
 	return sdev->queue_depth;
 }
 
@@ -39,7 +43,7 @@ static void zfcp_scsi_slave_destroy(struct scsi_device *sdpnt)
 {
 	struct zfcp_unit *unit = (struct zfcp_unit *) sdpnt->hostdata;
 	unit->device = NULL;
-	zfcp_unit_put(unit);
+	put_device(&unit->sysfs_device);
 }
 
 static int zfcp_scsi_slave_configure(struct scsi_device *sdp)
@@ -99,12 +103,26 @@ static int zfcp_scsi_queuecommand(struct scsi_cmnd *scpnt,
 	}
 
 	status = atomic_read(&unit->status);
-	if (unlikely((status & ZFCP_STATUS_COMMON_ERP_FAILED) ||
-		     !(status & ZFCP_STATUS_COMMON_RUNNING))) {
+	if (unlikely(status & ZFCP_STATUS_COMMON_ERP_FAILED) &&
+		     !(atomic_read(&unit->port->status) &
+		       ZFCP_STATUS_COMMON_ERP_FAILED)) {
+		/* only unit access denied, but port is good
+		 * not covered by FC transport, have to fail here */
 		zfcp_scsi_command_fail(scpnt, DID_ERROR);
 		return 0;
 	}
 
+	if (unlikely(!(status & ZFCP_STATUS_COMMON_UNBLOCKED))) {
+		/* This could be either
+		 * open unit pending: this is temporary, will result in
+		 * 	open unit or ERP_FAILED, so retry command
+		 * call to rport_delete pending: mimic retry from
+		 * 	fc_remote_port_chkready until rport is BLOCKED
+		 */
+		zfcp_scsi_command_fail(scpnt, DID_IMM_RETRY);
+		return 0;
+	}
+
 	ret = zfcp_fsf_send_fcp_command_task(unit, scpnt);
 	if (unlikely(ret == -EBUSY))
 		return SCSI_MLQUEUE_DEVICE_BUSY;
@@ -115,49 +133,44 @@ static int zfcp_scsi_queuecommand(struct scsi_cmnd *scpnt,
 }
 
 static struct zfcp_unit *zfcp_unit_lookup(struct zfcp_adapter *adapter,
-					  int channel, unsigned int id,
-					  unsigned int lun)
+					  unsigned int id, u64 lun)
 {
+	unsigned long flags;
 	struct zfcp_port *port;
-	struct zfcp_unit *unit;
-	int scsi_lun;
+	struct zfcp_unit *unit = NULL;
 
-	list_for_each_entry(port, &adapter->port_list_head, list) {
+	read_lock_irqsave(&adapter->port_list_lock, flags);
+	list_for_each_entry(port, &adapter->port_list, list) {
 		if (!port->rport || (id != port->rport->scsi_target_id))
 			continue;
-		list_for_each_entry(unit, &port->unit_list_head, list) {
-			scsi_lun = scsilun_to_int(
-				(struct scsi_lun *)&unit->fcp_lun);
-			if (lun == scsi_lun)
-				return unit;
-		}
+		unit = zfcp_get_unit_by_lun(port, lun);
+		if (unit)
+			break;
 	}
+	read_unlock_irqrestore(&adapter->port_list_lock, flags);
 
-	return NULL;
+	return unit;
 }
 
 static int zfcp_scsi_slave_alloc(struct scsi_device *sdp)
 {
 	struct zfcp_adapter *adapter;
 	struct zfcp_unit *unit;
-	unsigned long flags;
-	int retval = -ENXIO;
+	u64 lun;
 
 	adapter = (struct zfcp_adapter *) sdp->host->hostdata[0];
 	if (!adapter)
 		goto out;
 
-	read_lock_irqsave(&zfcp_data.config_lock, flags);
-	unit = zfcp_unit_lookup(adapter, sdp->channel, sdp->id, sdp->lun);
+	int_to_scsilun(sdp->lun, (struct scsi_lun *)&lun);
+	unit = zfcp_unit_lookup(adapter, sdp->id, lun);
 	if (unit) {
 		sdp->hostdata = unit;
 		unit->device = sdp;
-		zfcp_unit_get(unit);
-		retval = 0;
+		return 0;
 	}
-	read_unlock_irqrestore(&zfcp_data.config_lock, flags);
 out:
-	return retval;
+	return -ENXIO;
 }
 
 static int zfcp_scsi_eh_abort_handler(struct scsi_cmnd *scpnt)
@@ -196,6 +209,7 @@ static int zfcp_scsi_eh_abort_handler(struct scsi_cmnd *scpnt)
 			break;
 
 		zfcp_erp_wait(adapter);
+		fc_block_scsi_eh(scpnt);
 		if (!(atomic_read(&adapter->status) &
 		      ZFCP_STATUS_COMMON_RUNNING)) {
 			zfcp_dbf_scsi_abort("nres", adapter->dbf, scpnt, NULL,
@@ -235,6 +249,7 @@ static int zfcp_task_mgmt_function(struct scsi_cmnd *scpnt, u8 tm_flags)
 			break;
 
 		zfcp_erp_wait(adapter);
+		fc_block_scsi_eh(scpnt);
 		if (!(atomic_read(&adapter->status) &
 		      ZFCP_STATUS_COMMON_RUNNING)) {
 			zfcp_dbf_scsi_devreset("nres", tm_flags, unit, scpnt);
@@ -249,9 +264,6 @@ static int zfcp_task_mgmt_function(struct scsi_cmnd *scpnt, u8 tm_flags)
 	if (fsf_req->status & ZFCP_STATUS_FSFREQ_TMFUNCFAILED) {
 		zfcp_dbf_scsi_devreset("fail", tm_flags, unit, scpnt);
 		retval = FAILED;
-	} else if (fsf_req->status & ZFCP_STATUS_FSFREQ_TMFUNCNOTSUPP) {
-		zfcp_dbf_scsi_devreset("nsup", tm_flags, unit, scpnt);
-		retval = FAILED;
 	} else
 		zfcp_dbf_scsi_devreset("okay", tm_flags, unit, scpnt);
 
@@ -261,12 +273,12 @@ static int zfcp_task_mgmt_function(struct scsi_cmnd *scpnt, u8 tm_flags)
 
 static int zfcp_scsi_eh_device_reset_handler(struct scsi_cmnd *scpnt)
 {
-	return zfcp_task_mgmt_function(scpnt, FCP_LOGICAL_UNIT_RESET);
+	return zfcp_task_mgmt_function(scpnt, FCP_TMF_LUN_RESET);
 }
 
 static int zfcp_scsi_eh_target_reset_handler(struct scsi_cmnd *scpnt)
 {
-	return zfcp_task_mgmt_function(scpnt, FCP_TARGET_RESET);
+	return zfcp_task_mgmt_function(scpnt, FCP_TMF_TGT_RESET);
 }
 
 static int zfcp_scsi_eh_host_reset_handler(struct scsi_cmnd *scpnt)
@@ -276,6 +288,7 @@ static int zfcp_scsi_eh_host_reset_handler(struct scsi_cmnd *scpnt)
 
 	zfcp_erp_adapter_reopen(adapter, 0, "schrh_1", scpnt);
 	zfcp_erp_wait(adapter);
+	fc_block_scsi_eh(scpnt);
 
 	return SUCCESS;
 }
@@ -303,7 +316,7 @@ int zfcp_adapter_scsi_register(struct zfcp_adapter *adapter)
 	adapter->scsi_host->max_lun = 1;
 	adapter->scsi_host->max_channel = 0;
 	adapter->scsi_host->unique_id = dev_id.devno;
-	adapter->scsi_host->max_cmd_len = 255;
+	adapter->scsi_host->max_cmd_len = 16; /* in struct fcp_cmnd */
 	adapter->scsi_host->transportt = zfcp_data.scsi_transport_template;
 
 	adapter->scsi_host->hostdata[0] = (unsigned long) adapter;
@@ -325,12 +338,11 @@ void zfcp_adapter_scsi_unregister(struct zfcp_adapter *adapter)
 	if (!shost)
 		return;
 
-	read_lock_irq(&zfcp_data.config_lock);
-	list_for_each_entry(port, &adapter->port_list_head, list)
-		if (port->rport)
-			port->rport = NULL;
+	read_lock_irq(&adapter->port_list_lock);
+	list_for_each_entry(port, &adapter->port_list, list)
+		port->rport = NULL;
+	read_unlock_irq(&adapter->port_list_lock);
 
-	read_unlock_irq(&zfcp_data.config_lock);
 	fc_remove_host(shost);
 	scsi_remove_host(shost);
 	scsi_host_put(shost);
@@ -348,7 +360,7 @@ zfcp_init_fc_host_stats(struct zfcp_adapter *adapter)
 		fc_stats = kmalloc(sizeof(*fc_stats), GFP_KERNEL);
 		if (!fc_stats)
 			return NULL;
-		adapter->fc_stats = fc_stats; /* freed in adater_dequeue */
+		adapter->fc_stats = fc_stats; /* freed in adapter_release */
 	}
 	memset(adapter->fc_stats, 0, sizeof(*adapter->fc_stats));
 	return adapter->fc_stats;
@@ -464,7 +476,7 @@ static void zfcp_reset_fc_host_stats(struct Scsi_Host *shost)
 		adapter->stats_reset = jiffies/HZ;
 		kfree(adapter->stats_reset_data);
 		adapter->stats_reset_data = data; /* finally freed in
-						     adapter_dequeue */
+						     adapter_release */
 	}
 }
 
@@ -495,7 +507,7 @@ static void zfcp_set_rport_dev_loss_tmo(struct fc_rport *rport, u32 timeout)
  * @rport: The FC rport where to teminate I/O
  *
  * Abort all pending SCSI commands for a port by closing the
- * port. Using a reopen for avoids a conflict with a shutdown
+ * port. Using a reopen avoiding a conflict with a shutdown
  * overwriting a reopen.
  */
 static void zfcp_scsi_terminate_rport_io(struct fc_rport *rport)
@@ -505,15 +517,11 @@ static void zfcp_scsi_terminate_rport_io(struct fc_rport *rport)
 	struct zfcp_adapter *adapter =
 		(struct zfcp_adapter *)shost->hostdata[0];
 
-	write_lock_irq(&zfcp_data.config_lock);
 	port = zfcp_get_port_by_wwpn(adapter, rport->port_name);
-	if (port)
-		zfcp_port_get(port);
-	write_unlock_irq(&zfcp_data.config_lock);
 
 	if (port) {
 		zfcp_erp_port_reopen(port, 0, "sctrpi1", NULL);
-		zfcp_port_put(port);
+		put_device(&port->sysfs_device);
 	}
 }
 
@@ -555,31 +563,34 @@ static void zfcp_scsi_rport_block(struct zfcp_port *port)
 
 void zfcp_scsi_schedule_rport_register(struct zfcp_port *port)
 {
-	zfcp_port_get(port);
+	get_device(&port->sysfs_device);
 	port->rport_task = RPORT_ADD;
 
 	if (!queue_work(port->adapter->work_queue, &port->rport_work))
-		zfcp_port_put(port);
+		put_device(&port->sysfs_device);
 }
 
 void zfcp_scsi_schedule_rport_block(struct zfcp_port *port)
 {
-	zfcp_port_get(port);
+	get_device(&port->sysfs_device);
 	port->rport_task = RPORT_DEL;
 
 	if (port->rport && queue_work(port->adapter->work_queue,
 				      &port->rport_work))
 		return;
 
-	zfcp_port_put(port);
+	put_device(&port->sysfs_device);
 }
 
 void zfcp_scsi_schedule_rports_block(struct zfcp_adapter *adapter)
 {
+	unsigned long flags;
 	struct zfcp_port *port;
 
-	list_for_each_entry(port, &adapter->port_list_head, list)
+	read_lock_irqsave(&adapter->port_list_lock, flags);
+	list_for_each_entry(port, &adapter->port_list, list)
 		zfcp_scsi_schedule_rport_block(port);
+	read_unlock_irqrestore(&adapter->port_list_lock, flags);
 }
 
 void zfcp_scsi_rport_work(struct work_struct *work)
@@ -597,7 +608,7 @@ void zfcp_scsi_rport_work(struct work_struct *work)
 		}
 	}
 
-	zfcp_port_put(port);
+	put_device(&port->sysfs_device);
 }
 
 
@@ -615,21 +626,7 @@ void zfcp_scsi_scan(struct work_struct *work)
 				 scsilun_to_int((struct scsi_lun *)
 						&unit->fcp_lun), 0);
 
-	zfcp_unit_put(unit);
-}
-
-static int zfcp_execute_fc_job(struct fc_bsg_job *job)
-{
-	switch (job->request->msgcode) {
-	case FC_BSG_RPT_ELS:
-	case FC_BSG_HST_ELS_NOLOGIN:
-		return zfcp_fc_execute_els_fc_job(job);
-	case FC_BSG_RPT_CT:
-	case FC_BSG_HST_CT:
-		return zfcp_fc_execute_ct_fc_job(job);
-	default:
-		return -EINVAL;
-	}
+	put_device(&unit->sysfs_device);
 }
 
 struct fc_function_template zfcp_transport_functions = {
@@ -643,6 +640,7 @@ struct fc_function_template zfcp_transport_functions = {
 	.show_host_port_name = 1,
 	.show_host_permanent_port_name = 1,
 	.show_host_supported_classes = 1,
+	.show_host_supported_fc4s = 1,
 	.show_host_supported_speeds = 1,
 	.show_host_maxframe_size = 1,
 	.show_host_serial_number = 1,
@@ -652,13 +650,15 @@ struct fc_function_template zfcp_transport_functions = {
 	.get_host_port_state = zfcp_get_host_port_state,
 	.terminate_rport_io = zfcp_scsi_terminate_rport_io,
 	.show_host_port_state = 1,
-	.bsg_request = zfcp_execute_fc_job,
+	.show_host_active_fc4s = 1,
+	.bsg_request = zfcp_fc_exec_bsg_job,
 	/* no functions registered for following dynamic attributes but
 	   directly set by LLDD */
 	.show_host_port_type = 1,
 	.show_host_speed = 1,
 	.show_host_port_id = 1,
 	.disable_target_scan = 1,
+	.dd_bsg_size = sizeof(struct zfcp_fsf_ct_els),
 };
 
 struct zfcp_data zfcp_data = {
diff --git a/drivers/s390/scsi/zfcp_sysfs.c b/drivers/s390/scsi/zfcp_sysfs.c
index d31000886ca8..f539e006683c 100644
--- a/drivers/s390/scsi/zfcp_sysfs.c
+++ b/drivers/s390/scsi/zfcp_sysfs.c
@@ -3,7 +3,7 @@
  *
  * sysfs attributes.
  *
- * Copyright IBM Corporation 2008
+ * Copyright IBM Corporation 2008, 2009
  */
 
 #define KMSG_COMPONENT "zfcp"
@@ -19,30 +19,44 @@ static ssize_t zfcp_sysfs_##_feat##_##_name##_show(struct device *dev,	       \
 						   struct device_attribute *at,\
 						   char *buf)		       \
 {									       \
-	struct _feat_def *_feat = dev_get_drvdata(dev);			       \
+	struct _feat_def *_feat = container_of(dev, struct _feat_def,	       \
+					       sysfs_device);		       \
 									       \
 	return sprintf(buf, _format, _value);				       \
 }									       \
 static ZFCP_DEV_ATTR(_feat, _name, S_IRUGO,				       \
 		     zfcp_sysfs_##_feat##_##_name##_show, NULL);
 
-ZFCP_DEFINE_ATTR(zfcp_adapter, adapter, status, "0x%08x\n",
-		 atomic_read(&adapter->status));
-ZFCP_DEFINE_ATTR(zfcp_adapter, adapter, peer_wwnn, "0x%016llx\n",
-		 (unsigned long long) adapter->peer_wwnn);
-ZFCP_DEFINE_ATTR(zfcp_adapter, adapter, peer_wwpn, "0x%016llx\n",
-		 (unsigned long long) adapter->peer_wwpn);
-ZFCP_DEFINE_ATTR(zfcp_adapter, adapter, peer_d_id, "0x%06x\n",
-		 adapter->peer_d_id);
-ZFCP_DEFINE_ATTR(zfcp_adapter, adapter, card_version, "0x%04x\n",
-		 adapter->hydra_version);
-ZFCP_DEFINE_ATTR(zfcp_adapter, adapter, lic_version, "0x%08x\n",
-		 adapter->fsf_lic_version);
-ZFCP_DEFINE_ATTR(zfcp_adapter, adapter, hardware_version, "0x%08x\n",
-		 adapter->hardware_version);
-ZFCP_DEFINE_ATTR(zfcp_adapter, adapter, in_recovery, "%d\n",
-		 (atomic_read(&adapter->status) &
-		  ZFCP_STATUS_COMMON_ERP_INUSE) != 0);
+#define ZFCP_DEFINE_A_ATTR(_name, _format, _value)			     \
+static ssize_t zfcp_sysfs_adapter_##_name##_show(struct device *dev,	     \
+						 struct device_attribute *at,\
+						 char *buf)		     \
+{									     \
+	struct ccw_device *cdev = to_ccwdev(dev);			     \
+	struct zfcp_adapter *adapter = zfcp_ccw_adapter_by_cdev(cdev);	     \
+	int i;								     \
+									     \
+	if (!adapter)							     \
+		return -ENODEV;						     \
+									     \
+	i = sprintf(buf, _format, _value);				     \
+	zfcp_ccw_adapter_put(adapter);					     \
+	return i;							     \
+}									     \
+static ZFCP_DEV_ATTR(adapter, _name, S_IRUGO,				     \
+		     zfcp_sysfs_adapter_##_name##_show, NULL);
+
+ZFCP_DEFINE_A_ATTR(status, "0x%08x\n", atomic_read(&adapter->status));
+ZFCP_DEFINE_A_ATTR(peer_wwnn, "0x%016llx\n",
+		   (unsigned long long) adapter->peer_wwnn);
+ZFCP_DEFINE_A_ATTR(peer_wwpn, "0x%016llx\n",
+		   (unsigned long long) adapter->peer_wwpn);
+ZFCP_DEFINE_A_ATTR(peer_d_id, "0x%06x\n", adapter->peer_d_id);
+ZFCP_DEFINE_A_ATTR(card_version, "0x%04x\n", adapter->hydra_version);
+ZFCP_DEFINE_A_ATTR(lic_version, "0x%08x\n", adapter->fsf_lic_version);
+ZFCP_DEFINE_A_ATTR(hardware_version, "0x%08x\n", adapter->hardware_version);
+ZFCP_DEFINE_A_ATTR(in_recovery, "%d\n", (atomic_read(&adapter->status) &
+					 ZFCP_STATUS_COMMON_ERP_INUSE) != 0);
 
 ZFCP_DEFINE_ATTR(zfcp_port, port, status, "0x%08x\n",
 		 atomic_read(&port->status));
@@ -73,7 +87,8 @@ static ssize_t zfcp_sysfs_##_feat##_failed_show(struct device *dev,	       \
 						struct device_attribute *attr, \
 						char *buf)		       \
 {									       \
-	struct _feat_def *_feat = dev_get_drvdata(dev);			       \
+	struct _feat_def *_feat = container_of(dev, struct _feat_def,	       \
+					       sysfs_device);		       \
 									       \
 	if (atomic_read(&_feat->status) & ZFCP_STATUS_COMMON_ERP_FAILED)       \
 		return sprintf(buf, "1\n");				       \
@@ -84,15 +99,13 @@ static ssize_t zfcp_sysfs_##_feat##_failed_store(struct device *dev,	       \
 						 struct device_attribute *attr,\
 						 const char *buf, size_t count)\
 {									       \
-	struct _feat_def *_feat = dev_get_drvdata(dev);			       \
+	struct _feat_def *_feat = container_of(dev, struct _feat_def,	       \
+					       sysfs_device);		       \
 	unsigned long val;						       \
 	int retval = 0;							       \
 									       \
-	mutex_lock(&zfcp_data.config_mutex);				       \
-	if (atomic_read(&_feat->status) & ZFCP_STATUS_COMMON_REMOVE) {	       \
-		retval = -EBUSY;					       \
-		goto out;						       \
-	}								       \
+	if (!(_feat && get_device(&_feat->sysfs_device)))		       \
+		return -EBUSY;						       \
 									       \
 	if (strict_strtoul(buf, 0, &val) || val != 0) {			       \
 		retval = -EINVAL;					       \
@@ -105,29 +118,82 @@ static ssize_t zfcp_sysfs_##_feat##_failed_store(struct device *dev,	       \
 				  _reopen_id, NULL);			       \
 	zfcp_erp_wait(_adapter);					       \
 out:									       \
-	mutex_unlock(&zfcp_data.config_mutex);				       \
+	put_device(&_feat->sysfs_device);				       \
 	return retval ? retval : (ssize_t) count;			       \
 }									       \
 static ZFCP_DEV_ATTR(_feat, failed, S_IWUSR | S_IRUGO,			       \
 		     zfcp_sysfs_##_feat##_failed_show,			       \
 		     zfcp_sysfs_##_feat##_failed_store);
 
-ZFCP_SYSFS_FAILED(zfcp_adapter, adapter, adapter, "syafai1", "syafai2");
 ZFCP_SYSFS_FAILED(zfcp_port, port, port->adapter, "sypfai1", "sypfai2");
 ZFCP_SYSFS_FAILED(zfcp_unit, unit, unit->port->adapter, "syufai1", "syufai2");
 
+static ssize_t zfcp_sysfs_adapter_failed_show(struct device *dev,
+					      struct device_attribute *attr,
+					      char *buf)
+{
+	struct ccw_device *cdev = to_ccwdev(dev);
+	struct zfcp_adapter *adapter = zfcp_ccw_adapter_by_cdev(cdev);
+	int i;
+
+	if (!adapter)
+		return -ENODEV;
+
+	if (atomic_read(&adapter->status) & ZFCP_STATUS_COMMON_ERP_FAILED)
+		i = sprintf(buf, "1\n");
+	else
+		i = sprintf(buf, "0\n");
+
+	zfcp_ccw_adapter_put(adapter);
+	return i;
+}
+
+static ssize_t zfcp_sysfs_adapter_failed_store(struct device *dev,
+					       struct device_attribute *attr,
+					       const char *buf, size_t count)
+{
+	struct ccw_device *cdev = to_ccwdev(dev);
+	struct zfcp_adapter *adapter = zfcp_ccw_adapter_by_cdev(cdev);
+	unsigned long val;
+	int retval = 0;
+
+	if (!adapter)
+		return -ENODEV;
+
+	if (strict_strtoul(buf, 0, &val) || val != 0) {
+		retval = -EINVAL;
+		goto out;
+	}
+
+	zfcp_erp_modify_adapter_status(adapter, "syafai1", NULL,
+				       ZFCP_STATUS_COMMON_RUNNING, ZFCP_SET);
+	zfcp_erp_adapter_reopen(adapter, ZFCP_STATUS_COMMON_ERP_FAILED,
+				"syafai2", NULL);
+	zfcp_erp_wait(adapter);
+out:
+	zfcp_ccw_adapter_put(adapter);
+	return retval ? retval : (ssize_t) count;
+}
+static ZFCP_DEV_ATTR(adapter, failed, S_IWUSR | S_IRUGO,
+		     zfcp_sysfs_adapter_failed_show,
+		     zfcp_sysfs_adapter_failed_store);
+
 static ssize_t zfcp_sysfs_port_rescan_store(struct device *dev,
 					    struct device_attribute *attr,
 					    const char *buf, size_t count)
 {
-	struct zfcp_adapter *adapter = dev_get_drvdata(dev);
-	int ret;
+	struct ccw_device *cdev = to_ccwdev(dev);
+	struct zfcp_adapter *adapter = zfcp_ccw_adapter_by_cdev(cdev);
 
-	if (atomic_read(&adapter->status) & ZFCP_STATUS_COMMON_REMOVE)
-		return -EBUSY;
+	if (!adapter)
+		return -ENODEV;
 
-	ret = zfcp_fc_scan_ports(adapter);
-	return ret ? ret : (ssize_t) count;
+	/* sync the user-space- with the kernel-invocation of scan_work */
+	queue_work(adapter->work_queue, &adapter->scan_work);
+	flush_work(&adapter->scan_work);
+	zfcp_ccw_adapter_put(adapter);
+
+	return (ssize_t) count;
 }
 static ZFCP_DEV_ATTR(adapter, port_rescan, S_IWUSR, NULL,
 		     zfcp_sysfs_port_rescan_store);
@@ -136,44 +202,34 @@ static ssize_t zfcp_sysfs_port_remove_store(struct device *dev,
 					    struct device_attribute *attr,
 					    const char *buf, size_t count)
 {
-	struct zfcp_adapter *adapter = dev_get_drvdata(dev);
+	struct ccw_device *cdev = to_ccwdev(dev);
+	struct zfcp_adapter *adapter = zfcp_ccw_adapter_by_cdev(cdev);
 	struct zfcp_port *port;
 	u64 wwpn;
-	int retval = 0;
-	LIST_HEAD(port_remove_lh);
+	int retval = -EINVAL;
 
-	mutex_lock(&zfcp_data.config_mutex);
-	if (atomic_read(&adapter->status) & ZFCP_STATUS_COMMON_REMOVE) {
-		retval = -EBUSY;
-		goto out;
-	}
+	if (!adapter)
+		return -ENODEV;
 
-	if (strict_strtoull(buf, 0, (unsigned long long *) &wwpn)) {
-		retval = -EINVAL;
+	if (strict_strtoull(buf, 0, (unsigned long long *) &wwpn))
 		goto out;
-	}
 
-	write_lock_irq(&zfcp_data.config_lock);
 	port = zfcp_get_port_by_wwpn(adapter, wwpn);
-	if (port && (atomic_read(&port->refcount) == 0)) {
-		zfcp_port_get(port);
-		atomic_set_mask(ZFCP_STATUS_COMMON_REMOVE, &port->status);
-		list_move(&port->list, &port_remove_lh);
-	} else
-		port = NULL;
-	write_unlock_irq(&zfcp_data.config_lock);
-
-	if (!port) {
-		retval = -ENXIO;
+	if (!port)
 		goto out;
-	}
+	else
+		retval = 0;
+
+	write_lock_irq(&adapter->port_list_lock);
+	list_del(&port->list);
+	write_unlock_irq(&adapter->port_list_lock);
+
+	put_device(&port->sysfs_device);
 
 	zfcp_erp_port_shutdown(port, 0, "syprs_1", NULL);
-	zfcp_erp_wait(adapter);
-	zfcp_port_put(port);
-	zfcp_port_dequeue(port);
+	zfcp_device_unregister(&port->sysfs_device, &zfcp_sysfs_port_attrs);
  out:
-	mutex_unlock(&zfcp_data.config_mutex);
+	zfcp_ccw_adapter_put(adapter);
 	return retval ? retval : (ssize_t) count;
 }
 static ZFCP_DEV_ATTR(adapter, port_remove, S_IWUSR, NULL,
@@ -202,16 +258,14 @@ static ssize_t zfcp_sysfs_unit_add_store(struct device *dev,
 					 struct device_attribute *attr,
 					 const char *buf, size_t count)
 {
-	struct zfcp_port *port = dev_get_drvdata(dev);
+	struct zfcp_port *port = container_of(dev, struct zfcp_port,
+					      sysfs_device);
 	struct zfcp_unit *unit;
 	u64 fcp_lun;
 	int retval = -EINVAL;
 
-	mutex_lock(&zfcp_data.config_mutex);
-	if (atomic_read(&port->status) & ZFCP_STATUS_COMMON_REMOVE) {
-		retval = -EBUSY;
-		goto out;
-	}
+	if (!(port && get_device(&port->sysfs_device)))
+		return -EBUSY;
 
 	if (strict_strtoull(buf, 0, (unsigned long long *) &fcp_lun))
 		goto out;
@@ -219,15 +273,14 @@ static ssize_t zfcp_sysfs_unit_add_store(struct device *dev,
 	unit = zfcp_unit_enqueue(port, fcp_lun);
 	if (IS_ERR(unit))
 		goto out;
-
-	retval = 0;
+	else
+		retval = 0;
 
 	zfcp_erp_unit_reopen(unit, 0, "syuas_1", NULL);
 	zfcp_erp_wait(unit->port->adapter);
 	flush_work(&unit->scsi_work);
-	zfcp_unit_put(unit);
 out:
-	mutex_unlock(&zfcp_data.config_mutex);
+	put_device(&port->sysfs_device);
 	return retval ? retval : (ssize_t) count;
 }
 static DEVICE_ATTR(unit_add, S_IWUSR, NULL, zfcp_sysfs_unit_add_store);
@@ -236,54 +289,37 @@ static ssize_t zfcp_sysfs_unit_remove_store(struct device *dev,
 					    struct device_attribute *attr,
 					    const char *buf, size_t count)
 {
-	struct zfcp_port *port = dev_get_drvdata(dev);
+	struct zfcp_port *port = container_of(dev, struct zfcp_port,
+					      sysfs_device);
 	struct zfcp_unit *unit;
 	u64 fcp_lun;
-	int retval = 0;
-	LIST_HEAD(unit_remove_lh);
+	int retval = -EINVAL;
 
-	mutex_lock(&zfcp_data.config_mutex);
-	if (atomic_read(&port->status) & ZFCP_STATUS_COMMON_REMOVE) {
-		retval = -EBUSY;
-		goto out;
-	}
+	if (!(port && get_device(&port->sysfs_device)))
+		return -EBUSY;
 
-	if (strict_strtoull(buf, 0, (unsigned long long *) &fcp_lun)) {
-		retval = -EINVAL;
+	if (strict_strtoull(buf, 0, (unsigned long long *) &fcp_lun))
 		goto out;
-	}
 
-	write_lock_irq(&zfcp_data.config_lock);
 	unit = zfcp_get_unit_by_lun(port, fcp_lun);
-	if (unit) {
-		write_unlock_irq(&zfcp_data.config_lock);
-		/* wait for possible timeout during SCSI probe */
-		flush_work(&unit->scsi_work);
-		write_lock_irq(&zfcp_data.config_lock);
-
-		if (atomic_read(&unit->refcount) == 0) {
-			zfcp_unit_get(unit);
-			atomic_set_mask(ZFCP_STATUS_COMMON_REMOVE,
-					&unit->status);
-			list_move(&unit->list, &unit_remove_lh);
-		} else {
-			unit = NULL;
-		}
-	}
+	if (!unit)
+		goto out;
+	else
+		retval = 0;
 
-	write_unlock_irq(&zfcp_data.config_lock);
+	/* wait for possible timeout during SCSI probe */
+	flush_work(&unit->scsi_work);
 
-	if (!unit) {
-		retval = -ENXIO;
-		goto out;
-	}
+	write_lock_irq(&port->unit_list_lock);
+	list_del(&unit->list);
+	write_unlock_irq(&port->unit_list_lock);
+
+	put_device(&unit->sysfs_device);
 
 	zfcp_erp_unit_shutdown(unit, 0, "syurs_1", NULL);
-	zfcp_erp_wait(unit->port->adapter);
-	zfcp_unit_put(unit);
-	zfcp_unit_dequeue(unit);
+	zfcp_device_unregister(&unit->sysfs_device, &zfcp_sysfs_unit_attrs);
 out:
-	mutex_unlock(&zfcp_data.config_mutex);
+	put_device(&port->sysfs_device);
 	return retval ? retval : (ssize_t) count;
 }
 static DEVICE_ATTR(unit_remove, S_IWUSR, NULL, zfcp_sysfs_unit_remove_store);
diff --git a/drivers/sbus/char/bbc_envctrl.c b/drivers/sbus/char/bbc_envctrl.c
index 7c815d3327f7..28d86f9df83c 100644
--- a/drivers/sbus/char/bbc_envctrl.c
+++ b/drivers/sbus/char/bbc_envctrl.c
@@ -522,6 +522,40 @@ static void attach_one_fan(struct bbc_i2c_bus *bp, struct of_device *op,
 	set_fan_speeds(fp);
 }
 
+static void destroy_one_temp(struct bbc_cpu_temperature *tp)
+{
+	bbc_i2c_detach(tp->client);
+	kfree(tp);
+}
+
+static void destroy_all_temps(struct bbc_i2c_bus *bp)
+{
+	struct bbc_cpu_temperature *tp, *tpos;
+
+	list_for_each_entry_safe(tp, tpos, &bp->temps, bp_list) {
+		list_del(&tp->bp_list);
+		list_del(&tp->glob_list);
+		destroy_one_temp(tp);
+	}
+}
+
+static void destroy_one_fan(struct bbc_fan_control *fp)
+{
+	bbc_i2c_detach(fp->client);
+	kfree(fp);
+}
+
+static void destroy_all_fans(struct bbc_i2c_bus *bp)
+{
+	struct bbc_fan_control *fp, *fpos;
+
+	list_for_each_entry_safe(fp, fpos, &bp->fans, bp_list) {
+		list_del(&fp->bp_list);
+		list_del(&fp->glob_list);
+		destroy_one_fan(fp);
+	}
+}
+
 int bbc_envctrl_init(struct bbc_i2c_bus *bp)
 {
 	struct of_device *op;
@@ -541,6 +575,8 @@ int bbc_envctrl_init(struct bbc_i2c_bus *bp)
 			int err = PTR_ERR(kenvctrld_task);
 
 			kenvctrld_task = NULL;
+			destroy_all_temps(bp);
+			destroy_all_fans(bp);
 			return err;
 		}
 	}
@@ -548,35 +584,11 @@ int bbc_envctrl_init(struct bbc_i2c_bus *bp)
 	return 0;
 }
 
-static void destroy_one_temp(struct bbc_cpu_temperature *tp)
-{
-	bbc_i2c_detach(tp->client);
-	kfree(tp);
-}
-
-static void destroy_one_fan(struct bbc_fan_control *fp)
-{
-	bbc_i2c_detach(fp->client);
-	kfree(fp);
-}
-
 void bbc_envctrl_cleanup(struct bbc_i2c_bus *bp)
 {
-	struct bbc_cpu_temperature *tp, *tpos;
-	struct bbc_fan_control *fp, *fpos;
-
 	if (kenvctrld_task)
 		kthread_stop(kenvctrld_task);
 
-	list_for_each_entry_safe(tp, tpos, &bp->temps, bp_list) {
-		list_del(&tp->bp_list);
-		list_del(&tp->glob_list);
-		destroy_one_temp(tp);
-	}
-
-	list_for_each_entry_safe(fp, fpos, &bp->fans, bp_list) {
-		list_del(&fp->bp_list);
-		list_del(&fp->glob_list);
-		destroy_one_fan(fp);
-	}
+	destroy_all_temps(bp);
+	destroy_all_fans(bp);
 }
diff --git a/drivers/sbus/char/envctrl.c b/drivers/sbus/char/envctrl.c
index 58e583b61e60..aa2b60a868ba 100644
--- a/drivers/sbus/char/envctrl.c
+++ b/drivers/sbus/char/envctrl.c
@@ -92,11 +92,11 @@
 #define ENVCTRL_CPUTEMP_MON			1    /* cpu temperature monitor */
 #define ENVCTRL_CPUVOLTAGE_MON	  	2    /* voltage monitor         */
 #define ENVCTRL_FANSTAT_MON  		3    /* fan status monitor      */
-#define ENVCTRL_ETHERTEMP_MON		4    /* ethernet temperarture */
+#define ENVCTRL_ETHERTEMP_MON		4    /* ethernet temperature */
 					     /* monitor                     */
 #define ENVCTRL_VOLTAGESTAT_MON	  	5    /* voltage status monitor  */
 #define ENVCTRL_MTHRBDTEMP_MON		6    /* motherboard temperature */
-#define ENVCTRL_SCSITEMP_MON		7    /* scsi temperarture */
+#define ENVCTRL_SCSITEMP_MON		7    /* scsi temperature */
 #define ENVCTRL_GLOBALADDR_MON		8    /* global address */
 
 /* Child device type.
diff --git a/drivers/scsi/3w-9xxx.c b/drivers/scsi/3w-9xxx.c
index 36c21b19e5d7..84d3bbaa95e7 100644
--- a/drivers/scsi/3w-9xxx.c
+++ b/drivers/scsi/3w-9xxx.c
@@ -76,6 +76,7 @@
                  Fix bug in twa_get_param() on 4GB+.
                  Use pci_resource_len() for ioremap().
    2.26.02.012 - Add power management support.
+   2.26.02.013 - Fix bug in twa_load_sgl().
 */
 
 #include <linux/module.h>
@@ -100,7 +101,7 @@
 #include "3w-9xxx.h"
 
 /* Globals */
-#define TW_DRIVER_VERSION "2.26.02.012"
+#define TW_DRIVER_VERSION "2.26.02.013"
 static TW_Device_Extension *twa_device_extension_list[TW_MAX_SLOT];
 static unsigned int twa_device_extension_count;
 static int twa_major = -1;
@@ -186,8 +187,12 @@ static ssize_t twa_show_stats(struct device *dev,
 } /* End twa_show_stats() */
 
 /* This function will set a devices queue depth */
-static int twa_change_queue_depth(struct scsi_device *sdev, int queue_depth)
+static int twa_change_queue_depth(struct scsi_device *sdev, int queue_depth,
+				  int reason)
 {
+	if (reason != SCSI_QDEPTH_DEFAULT)
+		return -EOPNOTSUPP;
+
 	if (queue_depth > TW_Q_LENGTH-2)
 		queue_depth = TW_Q_LENGTH-2;
 	scsi_adjust_queue_depth(sdev, MSG_ORDERED_TAG, queue_depth);
@@ -732,7 +737,7 @@ static int twa_chrdev_ioctl(struct inode *inode, struct file *file, unsigned int
 		break;
 	case TW_IOCTL_GET_COMPATIBILITY_INFO:
 		tw_ioctl->driver_command.status = 0;
-		/* Copy compatiblity struct into ioctl data buffer */
+		/* Copy compatibility struct into ioctl data buffer */
 		tw_compat_info = (TW_Compatibility_Info *)tw_ioctl->data_buffer;
 		memcpy(tw_compat_info, &tw_dev->tw_compat_info, sizeof(TW_Compatibility_Info));
 		break;
@@ -1378,10 +1383,12 @@ static void twa_load_sgl(TW_Device_Extension *tw_dev, TW_Command_Full *full_comm
 		newcommand = &full_command_packet->command.newcommand;
 		newcommand->request_id__lunl =
 			cpu_to_le16(TW_REQ_LUN_IN(TW_LUN_OUT(newcommand->request_id__lunl), request_id));
-		newcommand->sg_list[0].address = TW_CPU_TO_SGL(dma_handle + sizeof(TW_Ioctl_Buf_Apache) - 1);
-		newcommand->sg_list[0].length = cpu_to_le32(length);
+		if (length) {
+			newcommand->sg_list[0].address = TW_CPU_TO_SGL(dma_handle + sizeof(TW_Ioctl_Buf_Apache) - 1);
+			newcommand->sg_list[0].length = cpu_to_le32(length);
+		}
 		newcommand->sgl_entries__lunh =
-			cpu_to_le16(TW_REQ_LUN_IN(TW_LUN_OUT(newcommand->sgl_entries__lunh), 1));
+			cpu_to_le16(TW_REQ_LUN_IN(TW_LUN_OUT(newcommand->sgl_entries__lunh), length ? 1 : 0));
 	} else {
 		oldcommand = &full_command_packet->command.oldcommand;
 		oldcommand->request_id = request_id;
diff --git a/drivers/scsi/3w-sas.c b/drivers/scsi/3w-sas.c
new file mode 100644
index 000000000000..4d314d740de4
--- /dev/null
+++ b/drivers/scsi/3w-sas.c
@@ -0,0 +1,1924 @@
+/*
+   3w-sas.c -- LSI 3ware SAS/SATA-RAID Controller device driver for Linux.
+
+   Written By: Adam Radford <linuxraid@lsi.com>
+
+   Copyright (C) 2009 LSI Corporation.
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; version 2 of the License.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   NO WARRANTY
+   THE PROGRAM IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OR
+   CONDITIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED INCLUDING, WITHOUT
+   LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE, NON-INFRINGEMENT,
+   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each Recipient is
+   solely responsible for determining the appropriateness of using and
+   distributing the Program and assumes all risks associated with its
+   exercise of rights under this Agreement, including but not limited to
+   the risks and costs of program errors, damage to or loss of data,
+   programs or equipment, and unavailability or interruption of operations.
+
+   DISCLAIMER OF LIABILITY
+   NEITHER RECIPIENT NOR ANY CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY
+   DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+   DAMAGES (INCLUDING WITHOUT LIMITATION LOST PROFITS), HOWEVER CAUSED AND
+   ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
+   TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
+   USE OR DISTRIBUTION OF THE PROGRAM OR THE EXERCISE OF ANY RIGHTS GRANTED
+   HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES
+
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+   Controllers supported by this driver:
+
+   LSI 3ware 9750 6Gb/s SAS/SATA-RAID
+
+   Bugs/Comments/Suggestions should be mailed to:
+   linuxraid@lsi.com
+
+   For more information, goto:
+   http://www.lsi.com
+
+   History
+   -------
+   3.26.02.000 - Initial driver release.
+*/
+
+#include <linux/module.h>
+#include <linux/reboot.h>
+#include <linux/spinlock.h>
+#include <linux/interrupt.h>
+#include <linux/moduleparam.h>
+#include <linux/errno.h>
+#include <linux/types.h>
+#include <linux/delay.h>
+#include <linux/pci.h>
+#include <linux/time.h>
+#include <linux/mutex.h>
+#include <linux/smp_lock.h>
+#include <asm/io.h>
+#include <asm/irq.h>
+#include <asm/uaccess.h>
+#include <scsi/scsi.h>
+#include <scsi/scsi_host.h>
+#include <scsi/scsi_tcq.h>
+#include <scsi/scsi_cmnd.h>
+#include "3w-sas.h"
+
+/* Globals */
+#define TW_DRIVER_VERSION "3.26.02.000"
+static TW_Device_Extension *twl_device_extension_list[TW_MAX_SLOT];
+static unsigned int twl_device_extension_count;
+static int twl_major = -1;
+extern struct timezone sys_tz;
+
+/* Module parameters */
+MODULE_AUTHOR ("LSI");
+MODULE_DESCRIPTION ("LSI 3ware SAS/SATA-RAID Linux Driver");
+MODULE_LICENSE("GPL");
+MODULE_VERSION(TW_DRIVER_VERSION);
+
+static int use_msi;
+module_param(use_msi, int, S_IRUGO);
+MODULE_PARM_DESC(use_msi, "Use Message Signaled Interrupts. Default: 0");
+
+/* Function prototypes */
+static int twl_reset_device_extension(TW_Device_Extension *tw_dev, int ioctl_reset);
+
+/* Functions */
+
+/* This function returns AENs through sysfs */
+static ssize_t twl_sysfs_aen_read(struct kobject *kobj,
+				  struct bin_attribute *bin_attr,
+				  char *outbuf, loff_t offset, size_t count)
+{
+	struct device *dev = container_of(kobj, struct device, kobj);
+	struct Scsi_Host *shost = class_to_shost(dev);
+	TW_Device_Extension *tw_dev = (TW_Device_Extension *)shost->hostdata;
+	unsigned long flags = 0;
+	ssize_t ret;
+
+	if (!capable(CAP_SYS_ADMIN))
+		return -EACCES;
+
+	spin_lock_irqsave(tw_dev->host->host_lock, flags);
+	ret = memory_read_from_buffer(outbuf, count, &offset, tw_dev->event_queue[0], sizeof(TW_Event) * TW_Q_LENGTH);
+	spin_unlock_irqrestore(tw_dev->host->host_lock, flags);
+
+	return ret;
+} /* End twl_sysfs_aen_read() */
+
+/* aen_read sysfs attribute initializer */
+static struct bin_attribute twl_sysfs_aen_read_attr = {
+	.attr = {
+		.name = "3ware_aen_read",
+		.mode = S_IRUSR,
+	}, 
+	.size = 0,
+	.read = twl_sysfs_aen_read
+};
+
+/* This function returns driver compatibility info through sysfs */
+static ssize_t twl_sysfs_compat_info(struct kobject *kobj,
+				     struct bin_attribute *bin_attr,
+				     char *outbuf, loff_t offset, size_t count)
+{
+	struct device *dev = container_of(kobj, struct device, kobj);
+	struct Scsi_Host *shost = class_to_shost(dev);
+	TW_Device_Extension *tw_dev = (TW_Device_Extension *)shost->hostdata;
+	unsigned long flags = 0;
+	ssize_t ret;
+
+	if (!capable(CAP_SYS_ADMIN))
+		return -EACCES;
+
+	spin_lock_irqsave(tw_dev->host->host_lock, flags);
+	ret = memory_read_from_buffer(outbuf, count, &offset, &tw_dev->tw_compat_info, sizeof(TW_Compatibility_Info));
+	spin_unlock_irqrestore(tw_dev->host->host_lock, flags);
+
+	return ret;
+} /* End twl_sysfs_compat_info() */
+
+/* compat_info sysfs attribute initializer */
+static struct bin_attribute twl_sysfs_compat_info_attr = {
+	.attr = {
+		.name = "3ware_compat_info",
+		.mode = S_IRUSR,
+	}, 
+	.size = 0,
+	.read = twl_sysfs_compat_info
+};
+
+/* Show some statistics about the card */
+static ssize_t twl_show_stats(struct device *dev,
+			      struct device_attribute *attr, char *buf)
+{
+	struct Scsi_Host *host = class_to_shost(dev);
+	TW_Device_Extension *tw_dev = (TW_Device_Extension *)host->hostdata;
+	unsigned long flags = 0;
+	ssize_t len;
+
+	spin_lock_irqsave(tw_dev->host->host_lock, flags);
+	len = snprintf(buf, PAGE_SIZE, "3w-sas Driver version: %s\n"
+		       "Current commands posted:   %4d\n"
+		       "Max commands posted:       %4d\n"
+		       "Last sgl length:           %4d\n"
+		       "Max sgl length:            %4d\n"
+		       "Last sector count:         %4d\n"
+		       "Max sector count:          %4d\n"
+		       "SCSI Host Resets:          %4d\n"
+		       "AEN's:                     %4d\n", 
+		       TW_DRIVER_VERSION,
+		       tw_dev->posted_request_count,
+		       tw_dev->max_posted_request_count,
+		       tw_dev->sgl_entries,
+		       tw_dev->max_sgl_entries,
+		       tw_dev->sector_count,
+		       tw_dev->max_sector_count,
+		       tw_dev->num_resets,
+		       tw_dev->aen_count);
+	spin_unlock_irqrestore(tw_dev->host->host_lock, flags);
+	return len;
+} /* End twl_show_stats() */
+
+/* This function will set a devices queue depth */
+static int twl_change_queue_depth(struct scsi_device *sdev, int queue_depth,
+				  int reason)
+{
+	if (reason != SCSI_QDEPTH_DEFAULT)
+		return -EOPNOTSUPP;
+
+	if (queue_depth > TW_Q_LENGTH-2)
+		queue_depth = TW_Q_LENGTH-2;
+	scsi_adjust_queue_depth(sdev, MSG_ORDERED_TAG, queue_depth);
+	return queue_depth;
+} /* End twl_change_queue_depth() */
+
+/* stats sysfs attribute initializer */
+static struct device_attribute twl_host_stats_attr = {
+	.attr = {
+		.name = 	"3ware_stats",
+		.mode =		S_IRUGO,
+	},
+	.show = twl_show_stats
+};
+
+/* Host attributes initializer */
+static struct device_attribute *twl_host_attrs[] = {
+	&twl_host_stats_attr,
+	NULL,
+};
+
+/* This function will look up an AEN severity string */
+static char *twl_aen_severity_lookup(unsigned char severity_code)
+{
+	char *retval = NULL;
+
+	if ((severity_code < (unsigned char) TW_AEN_SEVERITY_ERROR) ||
+	    (severity_code > (unsigned char) TW_AEN_SEVERITY_DEBUG))
+		goto out;
+
+	retval = twl_aen_severity_table[severity_code];
+out:
+	return retval;
+} /* End twl_aen_severity_lookup() */
+
+/* This function will queue an event */
+static void twl_aen_queue_event(TW_Device_Extension *tw_dev, TW_Command_Apache_Header *header)
+{
+	u32 local_time;
+	struct timeval time;
+	TW_Event *event;
+	unsigned short aen;
+	char host[16];
+	char *error_str;
+
+	tw_dev->aen_count++;
+
+	/* Fill out event info */
+	event = tw_dev->event_queue[tw_dev->error_index];
+
+	host[0] = '\0';
+	if (tw_dev->host)
+		sprintf(host, " scsi%d:", tw_dev->host->host_no);
+
+	aen = le16_to_cpu(header->status_block.error);
+	memset(event, 0, sizeof(TW_Event));
+
+	event->severity = TW_SEV_OUT(header->status_block.severity__reserved);
+	do_gettimeofday(&time);
+	local_time = (u32)(time.tv_sec - (sys_tz.tz_minuteswest * 60));
+	event->time_stamp_sec = local_time;
+	event->aen_code = aen;
+	event->retrieved = TW_AEN_NOT_RETRIEVED;
+	event->sequence_id = tw_dev->error_sequence_id;
+	tw_dev->error_sequence_id++;
+
+	/* Check for embedded error string */
+	error_str = &(header->err_specific_desc[strlen(header->err_specific_desc)+1]);
+
+	header->err_specific_desc[sizeof(header->err_specific_desc) - 1] = '\0';
+	event->parameter_len = strlen(header->err_specific_desc);
+	memcpy(event->parameter_data, header->err_specific_desc, event->parameter_len + 1 + strlen(error_str));
+	if (event->severity != TW_AEN_SEVERITY_DEBUG)
+		printk(KERN_WARNING "3w-sas:%s AEN: %s (0x%02X:0x%04X): %s:%s.\n",
+		       host,
+		       twl_aen_severity_lookup(TW_SEV_OUT(header->status_block.severity__reserved)),
+		       TW_MESSAGE_SOURCE_CONTROLLER_EVENT, aen, error_str,
+		       header->err_specific_desc);
+	else
+		tw_dev->aen_count--;
+
+	tw_dev->error_index = (tw_dev->error_index + 1 ) % TW_Q_LENGTH;
+} /* End twl_aen_queue_event() */
+
+/* This function will attempt to post a command packet to the board */
+static int twl_post_command_packet(TW_Device_Extension *tw_dev, int request_id)
+{
+	dma_addr_t command_que_value;
+
+	command_que_value = tw_dev->command_packet_phys[request_id];
+	command_que_value += TW_COMMAND_OFFSET;
+
+	/* First write upper 4 bytes */
+	writel((u32)((u64)command_que_value >> 32), TWL_HIBQPH_REG_ADDR(tw_dev));
+	/* Then the lower 4 bytes */
+	writel((u32)(command_que_value | TWL_PULL_MODE), TWL_HIBQPL_REG_ADDR(tw_dev));
+
+	tw_dev->state[request_id] = TW_S_POSTED;
+	tw_dev->posted_request_count++;
+	if (tw_dev->posted_request_count > tw_dev->max_posted_request_count)
+		tw_dev->max_posted_request_count = tw_dev->posted_request_count;
+
+	return 0;
+} /* End twl_post_command_packet() */
+
+/* This function will perform a pci-dma mapping for a scatter gather list */
+static int twl_map_scsi_sg_data(TW_Device_Extension *tw_dev, int request_id)
+{
+	int use_sg;
+	struct scsi_cmnd *cmd = tw_dev->srb[request_id];
+
+	use_sg = scsi_dma_map(cmd);
+	if (!use_sg)
+		return 0;
+	else if (use_sg < 0) {
+		TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1, "Failed to map scatter gather list");
+		return 0;
+	}
+
+	cmd->SCp.phase = TW_PHASE_SGLIST;
+	cmd->SCp.have_data_in = use_sg;
+
+	return use_sg;
+} /* End twl_map_scsi_sg_data() */
+
+/* This function hands scsi cdb's to the firmware */
+static int twl_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id, char *cdb, int use_sg, TW_SG_Entry_ISO *sglistarg)
+{
+	TW_Command_Full *full_command_packet;
+	TW_Command_Apache *command_packet;
+	int i, sg_count;
+	struct scsi_cmnd *srb = NULL;
+	struct scatterlist *sglist = NULL, *sg;
+	int retval = 1;
+
+	if (tw_dev->srb[request_id]) {
+		srb = tw_dev->srb[request_id];
+		if (scsi_sglist(srb))
+			sglist = scsi_sglist(srb);
+	}
+
+	/* Initialize command packet */
+	full_command_packet = tw_dev->command_packet_virt[request_id];
+	full_command_packet->header.header_desc.size_header = 128;
+	full_command_packet->header.status_block.error = 0;
+	full_command_packet->header.status_block.severity__reserved = 0;
+
+	command_packet = &full_command_packet->command.newcommand;
+	command_packet->status = 0;
+	command_packet->opcode__reserved = TW_OPRES_IN(0, TW_OP_EXECUTE_SCSI);
+
+	/* We forced 16 byte cdb use earlier */
+	if (!cdb)
+		memcpy(command_packet->cdb, srb->cmnd, TW_MAX_CDB_LEN);
+	else
+		memcpy(command_packet->cdb, cdb, TW_MAX_CDB_LEN);
+
+	if (srb) {
+		command_packet->unit = srb->device->id;
+		command_packet->request_id__lunl =
+			cpu_to_le16(TW_REQ_LUN_IN(srb->device->lun, request_id));
+	} else {
+		command_packet->request_id__lunl =
+			cpu_to_le16(TW_REQ_LUN_IN(0, request_id));
+		command_packet->unit = 0;
+	}
+
+	command_packet->sgl_offset = 16;
+
+	if (!sglistarg) {
+		/* Map sglist from scsi layer to cmd packet */
+		if (scsi_sg_count(srb)) {
+			sg_count = twl_map_scsi_sg_data(tw_dev, request_id);
+			if (sg_count == 0)
+				goto out;
+
+			scsi_for_each_sg(srb, sg, sg_count, i) {
+				command_packet->sg_list[i].address = TW_CPU_TO_SGL(sg_dma_address(sg));
+				command_packet->sg_list[i].length = TW_CPU_TO_SGL(sg_dma_len(sg));
+			}
+			command_packet->sgl_entries__lunh = cpu_to_le16(TW_REQ_LUN_IN((srb->device->lun >> 4), scsi_sg_count(tw_dev->srb[request_id])));
+		}
+	} else {
+		/* Internal cdb post */
+		for (i = 0; i < use_sg; i++) {
+			command_packet->sg_list[i].address = TW_CPU_TO_SGL(sglistarg[i].address);
+			command_packet->sg_list[i].length = TW_CPU_TO_SGL(sglistarg[i].length);
+		}
+		command_packet->sgl_entries__lunh = cpu_to_le16(TW_REQ_LUN_IN(0, use_sg));
+	}
+
+	/* Update some stats */
+	if (srb) {
+		tw_dev->sector_count = scsi_bufflen(srb) / 512;
+		if (tw_dev->sector_count > tw_dev->max_sector_count)
+			tw_dev->max_sector_count = tw_dev->sector_count;
+		tw_dev->sgl_entries = scsi_sg_count(srb);
+		if (tw_dev->sgl_entries > tw_dev->max_sgl_entries)
+			tw_dev->max_sgl_entries = tw_dev->sgl_entries;
+	}
+
+	/* Now post the command to the board */
+	retval = twl_post_command_packet(tw_dev, request_id);
+
+out:
+	return retval;
+} /* End twl_scsiop_execute_scsi() */
+
+/* This function will read the aen queue from the isr */
+static int twl_aen_read_queue(TW_Device_Extension *tw_dev, int request_id)
+{
+	char cdb[TW_MAX_CDB_LEN];
+	TW_SG_Entry_ISO sglist[1];
+	TW_Command_Full *full_command_packet;
+	int retval = 1;
+
+	full_command_packet = tw_dev->command_packet_virt[request_id];
+	memset(full_command_packet, 0, sizeof(TW_Command_Full));
+
+	/* Initialize cdb */
+	memset(&cdb, 0, TW_MAX_CDB_LEN);
+	cdb[0] = REQUEST_SENSE; /* opcode */
+	cdb[4] = TW_ALLOCATION_LENGTH; /* allocation length */
+
+	/* Initialize sglist */
+	memset(&sglist, 0, sizeof(TW_SG_Entry_ISO));
+	sglist[0].length = TW_SECTOR_SIZE;
+	sglist[0].address = tw_dev->generic_buffer_phys[request_id];
+
+	/* Mark internal command */
+	tw_dev->srb[request_id] = NULL;
+
+	/* Now post the command packet */
+	if (twl_scsiop_execute_scsi(tw_dev, request_id, cdb, 1, sglist)) {
+		TW_PRINTK(tw_dev->host, TW_DRIVER, 0x2, "Post failed while reading AEN queue");
+		goto out;
+	}
+	retval = 0;
+out:
+	return retval;
+} /* End twl_aen_read_queue() */
+
+/* This function will sync firmware time with the host time */
+static void twl_aen_sync_time(TW_Device_Extension *tw_dev, int request_id)
+{
+	u32 schedulertime;
+	struct timeval utc;
+	TW_Command_Full *full_command_packet;
+	TW_Command *command_packet;
+	TW_Param_Apache *param;
+	u32 local_time;
+
+	/* Fill out the command packet */
+	full_command_packet = tw_dev->command_packet_virt[request_id];
+	memset(full_command_packet, 0, sizeof(TW_Command_Full));
+	command_packet = &full_command_packet->command.oldcommand;
+	command_packet->opcode__sgloffset = TW_OPSGL_IN(2, TW_OP_SET_PARAM);
+	command_packet->request_id = request_id;
+	command_packet->byte8_offset.param.sgl[0].address = TW_CPU_TO_SGL(tw_dev->generic_buffer_phys[request_id]);
+	command_packet->byte8_offset.param.sgl[0].length = TW_CPU_TO_SGL(TW_SECTOR_SIZE);
+	command_packet->size = TW_COMMAND_SIZE;
+	command_packet->byte6_offset.parameter_count = cpu_to_le16(1);
+
+	/* Setup the param */
+	param = (TW_Param_Apache *)tw_dev->generic_buffer_virt[request_id];
+	memset(param, 0, TW_SECTOR_SIZE);
+	param->table_id = cpu_to_le16(TW_TIMEKEEP_TABLE | 0x8000); /* Controller time keep table */
+	param->parameter_id = cpu_to_le16(0x3); /* SchedulerTime */
+	param->parameter_size_bytes = cpu_to_le16(4);
+
+	/* Convert system time in UTC to local time seconds since last 
+           Sunday 12:00AM */
+	do_gettimeofday(&utc);
+	local_time = (u32)(utc.tv_sec - (sys_tz.tz_minuteswest * 60));
+	schedulertime = local_time - (3 * 86400);
+	schedulertime = cpu_to_le32(schedulertime % 604800);
+
+	memcpy(param->data, &schedulertime, sizeof(u32));
+
+	/* Mark internal command */
+	tw_dev->srb[request_id] = NULL;
+
+	/* Now post the command */
+	twl_post_command_packet(tw_dev, request_id);
+} /* End twl_aen_sync_time() */
+
+/* This function will assign an available request id */
+static void twl_get_request_id(TW_Device_Extension *tw_dev, int *request_id)
+{
+	*request_id = tw_dev->free_queue[tw_dev->free_head];
+	tw_dev->free_head = (tw_dev->free_head + 1) % TW_Q_LENGTH;
+	tw_dev->state[*request_id] = TW_S_STARTED;
+} /* End twl_get_request_id() */
+
+/* This function will free a request id */
+static void twl_free_request_id(TW_Device_Extension *tw_dev, int request_id)
+{
+	tw_dev->free_queue[tw_dev->free_tail] = request_id;
+	tw_dev->state[request_id] = TW_S_FINISHED;
+	tw_dev->free_tail = (tw_dev->free_tail + 1) % TW_Q_LENGTH;
+} /* End twl_free_request_id() */
+
+/* This function will complete an aen request from the isr */
+static int twl_aen_complete(TW_Device_Extension *tw_dev, int request_id)
+{
+	TW_Command_Full *full_command_packet;
+	TW_Command *command_packet;
+	TW_Command_Apache_Header *header;
+	unsigned short aen;
+	int retval = 1;
+
+	header = (TW_Command_Apache_Header *)tw_dev->generic_buffer_virt[request_id];
+	tw_dev->posted_request_count--;
+	aen = le16_to_cpu(header->status_block.error);
+	full_command_packet = tw_dev->command_packet_virt[request_id];
+	command_packet = &full_command_packet->command.oldcommand;
+
+	/* First check for internal completion of set param for time sync */
+	if (TW_OP_OUT(command_packet->opcode__sgloffset) == TW_OP_SET_PARAM) {
+		/* Keep reading the queue in case there are more aen's */
+		if (twl_aen_read_queue(tw_dev, request_id))
+			goto out2;
+	        else {
+			retval = 0;
+			goto out;
+		}
+	}
+
+	switch (aen) {
+	case TW_AEN_QUEUE_EMPTY:
+		/* Quit reading the queue if this is the last one */
+		break;
+	case TW_AEN_SYNC_TIME_WITH_HOST:
+		twl_aen_sync_time(tw_dev, request_id);
+		retval = 0;
+		goto out;
+	default:
+		twl_aen_queue_event(tw_dev, header);
+
+		/* If there are more aen's, keep reading the queue */
+		if (twl_aen_read_queue(tw_dev, request_id))
+			goto out2;
+		else {
+			retval = 0;
+			goto out;
+		}
+	}
+	retval = 0;
+out2:
+	tw_dev->state[request_id] = TW_S_COMPLETED;
+	twl_free_request_id(tw_dev, request_id);
+	clear_bit(TW_IN_ATTENTION_LOOP, &tw_dev->flags);
+out:
+	return retval;
+} /* End twl_aen_complete() */
+
+/* This function will poll for a response */
+static int twl_poll_response(TW_Device_Extension *tw_dev, int request_id, int seconds)
+{
+	unsigned long before;
+	dma_addr_t mfa;
+	u32 regh, regl;
+	u32 response;
+	int retval = 1;
+	int found = 0;
+
+	before = jiffies;
+
+	while (!found) {
+		if (sizeof(dma_addr_t) > 4) {
+			regh = readl(TWL_HOBQPH_REG_ADDR(tw_dev));
+			regl = readl(TWL_HOBQPL_REG_ADDR(tw_dev));
+			mfa = ((u64)regh << 32) | regl;
+		} else
+			mfa = readl(TWL_HOBQPL_REG_ADDR(tw_dev));
+
+		response = (u32)mfa;
+
+		if (TW_RESID_OUT(response) == request_id)
+			found = 1;
+
+		if (time_after(jiffies, before + HZ * seconds))
+			goto out;
+
+		msleep(50);
+	}
+	retval = 0;
+out: 
+	return retval;
+} /* End twl_poll_response() */
+
+/* This function will drain the aen queue */
+static int twl_aen_drain_queue(TW_Device_Extension *tw_dev, int no_check_reset)
+{
+	int request_id = 0;
+	char cdb[TW_MAX_CDB_LEN];
+	TW_SG_Entry_ISO sglist[1];
+	int finished = 0, count = 0;
+	TW_Command_Full *full_command_packet;
+	TW_Command_Apache_Header *header;
+	unsigned short aen;
+	int first_reset = 0, queue = 0, retval = 1;
+
+	if (no_check_reset)
+		first_reset = 0;
+	else
+		first_reset = 1;
+
+	full_command_packet = tw_dev->command_packet_virt[request_id];
+	memset(full_command_packet, 0, sizeof(TW_Command_Full));
+
+	/* Initialize cdb */
+	memset(&cdb, 0, TW_MAX_CDB_LEN);
+	cdb[0] = REQUEST_SENSE; /* opcode */
+	cdb[4] = TW_ALLOCATION_LENGTH; /* allocation length */
+
+	/* Initialize sglist */
+	memset(&sglist, 0, sizeof(TW_SG_Entry_ISO));
+	sglist[0].length = TW_SECTOR_SIZE;
+	sglist[0].address = tw_dev->generic_buffer_phys[request_id];
+
+	/* Mark internal command */
+	tw_dev->srb[request_id] = NULL;
+
+	do {
+		/* Send command to the board */
+		if (twl_scsiop_execute_scsi(tw_dev, request_id, cdb, 1, sglist)) {
+			TW_PRINTK(tw_dev->host, TW_DRIVER, 0x3, "Error posting request sense");
+			goto out;
+		}
+
+		/* Now poll for completion */
+		if (twl_poll_response(tw_dev, request_id, 30)) {
+			TW_PRINTK(tw_dev->host, TW_DRIVER, 0x4, "No valid response while draining AEN queue");
+			tw_dev->posted_request_count--;
+			goto out;
+		}
+
+		tw_dev->posted_request_count--;
+		header = (TW_Command_Apache_Header *)tw_dev->generic_buffer_virt[request_id];
+		aen = le16_to_cpu(header->status_block.error);
+		queue = 0;
+		count++;
+
+		switch (aen) {
+		case TW_AEN_QUEUE_EMPTY:
+			if (first_reset != 1)
+				goto out;
+			else
+				finished = 1;
+			break;
+		case TW_AEN_SOFT_RESET:
+			if (first_reset == 0)
+				first_reset = 1;
+			else
+				queue = 1;
+			break;
+		case TW_AEN_SYNC_TIME_WITH_HOST:
+			break;
+		default:
+			queue = 1;
+		}
+
+		/* Now queue an event info */
+		if (queue)
+			twl_aen_queue_event(tw_dev, header);
+	} while ((finished == 0) && (count < TW_MAX_AEN_DRAIN));
+
+	if (count == TW_MAX_AEN_DRAIN)
+		goto out;
+
+	retval = 0;
+out:
+	tw_dev->state[request_id] = TW_S_INITIAL;
+	return retval;
+} /* End twl_aen_drain_queue() */
+
+/* This function will allocate memory and check if it is correctly aligned */
+static int twl_allocate_memory(TW_Device_Extension *tw_dev, int size, int which)
+{
+	int i;
+	dma_addr_t dma_handle;
+	unsigned long *cpu_addr;
+	int retval = 1;
+
+	cpu_addr = pci_alloc_consistent(tw_dev->tw_pci_dev, size*TW_Q_LENGTH, &dma_handle);
+	if (!cpu_addr) {
+		TW_PRINTK(tw_dev->host, TW_DRIVER, 0x5, "Memory allocation failed");
+		goto out;
+	}
+
+	memset(cpu_addr, 0, size*TW_Q_LENGTH);
+
+	for (i = 0; i < TW_Q_LENGTH; i++) {
+		switch(which) {
+		case 0:
+			tw_dev->command_packet_phys[i] = dma_handle+(i*size);
+			tw_dev->command_packet_virt[i] = (TW_Command_Full *)((unsigned char *)cpu_addr + (i*size));
+			break;
+		case 1:
+			tw_dev->generic_buffer_phys[i] = dma_handle+(i*size);
+			tw_dev->generic_buffer_virt[i] = (unsigned long *)((unsigned char *)cpu_addr + (i*size));
+			break;
+		case 2:
+			tw_dev->sense_buffer_phys[i] = dma_handle+(i*size);
+			tw_dev->sense_buffer_virt[i] = (TW_Command_Apache_Header *)((unsigned char *)cpu_addr + (i*size));
+			break;
+		}
+	}
+	retval = 0;
+out:
+	return retval;
+} /* End twl_allocate_memory() */
+
+/* This function will load the request id and various sgls for ioctls */
+static void twl_load_sgl(TW_Device_Extension *tw_dev, TW_Command_Full *full_command_packet, int request_id, dma_addr_t dma_handle, int length)
+{
+	TW_Command *oldcommand;
+	TW_Command_Apache *newcommand;
+	TW_SG_Entry_ISO *sgl;
+	unsigned int pae = 0;
+
+	if ((sizeof(long) < 8) && (sizeof(dma_addr_t) > 4))
+		pae = 1;
+
+	if (TW_OP_OUT(full_command_packet->command.newcommand.opcode__reserved) == TW_OP_EXECUTE_SCSI) {
+		newcommand = &full_command_packet->command.newcommand;
+		newcommand->request_id__lunl =
+			cpu_to_le16(TW_REQ_LUN_IN(TW_LUN_OUT(newcommand->request_id__lunl), request_id));
+		if (length) {
+			newcommand->sg_list[0].address = TW_CPU_TO_SGL(dma_handle + sizeof(TW_Ioctl_Buf_Apache) - 1);
+			newcommand->sg_list[0].length = TW_CPU_TO_SGL(length);
+		}
+		newcommand->sgl_entries__lunh =
+			cpu_to_le16(TW_REQ_LUN_IN(TW_LUN_OUT(newcommand->sgl_entries__lunh), length ? 1 : 0));
+	} else {
+		oldcommand = &full_command_packet->command.oldcommand;
+		oldcommand->request_id = request_id;
+
+		if (TW_SGL_OUT(oldcommand->opcode__sgloffset)) {
+			/* Load the sg list */
+			sgl = (TW_SG_Entry_ISO *)((u32 *)oldcommand+oldcommand->size - (sizeof(TW_SG_Entry_ISO)/4) + pae + (sizeof(dma_addr_t) > 4 ? 1 : 0));
+			sgl->address = TW_CPU_TO_SGL(dma_handle + sizeof(TW_Ioctl_Buf_Apache) - 1);
+			sgl->length = TW_CPU_TO_SGL(length);
+			oldcommand->size += pae;
+			oldcommand->size += sizeof(dma_addr_t) > 4 ? 1 : 0;
+		}
+	}
+} /* End twl_load_sgl() */
+
+/* This function handles ioctl for the character device
+   This interface is used by smartmontools open source software */
+static int twl_chrdev_ioctl(struct inode *inode, struct file *file, unsigned int cmd, unsigned long arg)
+{
+	long timeout;
+	unsigned long *cpu_addr, data_buffer_length_adjusted = 0, flags = 0;
+	dma_addr_t dma_handle;
+	int request_id = 0;
+	TW_Ioctl_Driver_Command driver_command;
+	TW_Ioctl_Buf_Apache *tw_ioctl;
+	TW_Command_Full *full_command_packet;
+	TW_Device_Extension *tw_dev = twl_device_extension_list[iminor(inode)];
+	int retval = -EFAULT;
+	void __user *argp = (void __user *)arg;
+
+	/* Only let one of these through at a time */
+	if (mutex_lock_interruptible(&tw_dev->ioctl_lock)) {
+		retval = -EINTR;
+		goto out;
+	}
+
+	/* First copy down the driver command */
+	if (copy_from_user(&driver_command, argp, sizeof(TW_Ioctl_Driver_Command)))
+		goto out2;
+
+	/* Check data buffer size */
+	if (driver_command.buffer_length > TW_MAX_SECTORS * 2048) {
+		retval = -EINVAL;
+		goto out2;
+	}
+
+	/* Hardware can only do multiple of 512 byte transfers */
+	data_buffer_length_adjusted = (driver_command.buffer_length + 511) & ~511;
+
+	/* Now allocate ioctl buf memory */
+	cpu_addr = dma_alloc_coherent(&tw_dev->tw_pci_dev->dev, data_buffer_length_adjusted+sizeof(TW_Ioctl_Buf_Apache) - 1, &dma_handle, GFP_KERNEL);
+	if (!cpu_addr) {
+		retval = -ENOMEM;
+		goto out2;
+	}
+
+	tw_ioctl = (TW_Ioctl_Buf_Apache *)cpu_addr;
+
+	/* Now copy down the entire ioctl */
+	if (copy_from_user(tw_ioctl, argp, driver_command.buffer_length + sizeof(TW_Ioctl_Buf_Apache) - 1))
+		goto out3;
+
+	/* See which ioctl we are doing */
+	switch (cmd) {
+	case TW_IOCTL_FIRMWARE_PASS_THROUGH:
+		spin_lock_irqsave(tw_dev->host->host_lock, flags);
+		twl_get_request_id(tw_dev, &request_id);
+
+		/* Flag internal command */
+		tw_dev->srb[request_id] = NULL;
+
+		/* Flag chrdev ioctl */
+		tw_dev->chrdev_request_id = request_id;
+
+		full_command_packet = (TW_Command_Full *)&tw_ioctl->firmware_command;
+
+		/* Load request id and sglist for both command types */
+		twl_load_sgl(tw_dev, full_command_packet, request_id, dma_handle, data_buffer_length_adjusted);
+
+		memcpy(tw_dev->command_packet_virt[request_id], &(tw_ioctl->firmware_command), sizeof(TW_Command_Full));
+
+		/* Now post the command packet to the controller */
+		twl_post_command_packet(tw_dev, request_id);
+		spin_unlock_irqrestore(tw_dev->host->host_lock, flags);
+
+		timeout = TW_IOCTL_CHRDEV_TIMEOUT*HZ;
+
+		/* Now wait for command to complete */
+		timeout = wait_event_timeout(tw_dev->ioctl_wqueue, tw_dev->chrdev_request_id == TW_IOCTL_CHRDEV_FREE, timeout);
+
+		/* We timed out, and didn't get an interrupt */
+		if (tw_dev->chrdev_request_id != TW_IOCTL_CHRDEV_FREE) {
+			/* Now we need to reset the board */
+			printk(KERN_WARNING "3w-sas: scsi%d: WARNING: (0x%02X:0x%04X): Character ioctl (0x%x) timed out, resetting card.\n",
+			       tw_dev->host->host_no, TW_DRIVER, 0x6,
+			       cmd);
+			retval = -EIO;
+			twl_reset_device_extension(tw_dev, 1);
+			goto out3;
+		}
+
+		/* Now copy in the command packet response */
+		memcpy(&(tw_ioctl->firmware_command), tw_dev->command_packet_virt[request_id], sizeof(TW_Command_Full));
+		
+		/* Now complete the io */
+		spin_lock_irqsave(tw_dev->host->host_lock, flags);
+		tw_dev->posted_request_count--;
+		tw_dev->state[request_id] = TW_S_COMPLETED;
+		twl_free_request_id(tw_dev, request_id);
+		spin_unlock_irqrestore(tw_dev->host->host_lock, flags);
+		break;
+	default:
+		retval = -ENOTTY;
+		goto out3;
+	}
+
+	/* Now copy the entire response to userspace */
+	if (copy_to_user(argp, tw_ioctl, sizeof(TW_Ioctl_Buf_Apache) + driver_command.buffer_length - 1) == 0)
+		retval = 0;
+out3:
+	/* Now free ioctl buf memory */
+	dma_free_coherent(&tw_dev->tw_pci_dev->dev, data_buffer_length_adjusted+sizeof(TW_Ioctl_Buf_Apache) - 1, cpu_addr, dma_handle);
+out2:
+	mutex_unlock(&tw_dev->ioctl_lock);
+out:
+	return retval;
+} /* End twl_chrdev_ioctl() */
+
+/* This function handles open for the character device */
+static int twl_chrdev_open(struct inode *inode, struct file *file)
+{
+	unsigned int minor_number;
+	int retval = -ENODEV;
+
+	if (!capable(CAP_SYS_ADMIN)) {
+		retval = -EACCES;
+		goto out;
+	}
+
+	cycle_kernel_lock();
+	minor_number = iminor(inode);
+	if (minor_number >= twl_device_extension_count)
+		goto out;
+	retval = 0;
+out:
+	return retval;
+} /* End twl_chrdev_open() */
+
+/* File operations struct for character device */
+static const struct file_operations twl_fops = {
+	.owner		= THIS_MODULE,
+	.ioctl		= twl_chrdev_ioctl,
+	.open		= twl_chrdev_open,
+	.release	= NULL
+};
+
+/* This function passes sense data from firmware to scsi layer */
+static int twl_fill_sense(TW_Device_Extension *tw_dev, int i, int request_id, int copy_sense, int print_host)
+{
+	TW_Command_Apache_Header *header;
+	TW_Command_Full *full_command_packet;
+	unsigned short error;
+	char *error_str;
+	int retval = 1;
+
+	header = tw_dev->sense_buffer_virt[i];
+	full_command_packet = tw_dev->command_packet_virt[request_id];
+
+	/* Get embedded firmware error string */
+	error_str = &(header->err_specific_desc[strlen(header->err_specific_desc) + 1]);
+
+	/* Don't print error for Logical unit not supported during rollcall */
+	error = le16_to_cpu(header->status_block.error);
+	if ((error != TW_ERROR_LOGICAL_UNIT_NOT_SUPPORTED) && (error != TW_ERROR_UNIT_OFFLINE) && (error != TW_ERROR_INVALID_FIELD_IN_CDB)) {
+		if (print_host)
+			printk(KERN_WARNING "3w-sas: scsi%d: ERROR: (0x%02X:0x%04X): %s:%s.\n",
+			       tw_dev->host->host_no,
+			       TW_MESSAGE_SOURCE_CONTROLLER_ERROR,
+			       header->status_block.error,
+			       error_str, 
+			       header->err_specific_desc);
+		else
+			printk(KERN_WARNING "3w-sas: ERROR: (0x%02X:0x%04X): %s:%s.\n",
+			       TW_MESSAGE_SOURCE_CONTROLLER_ERROR,
+			       header->status_block.error,
+			       error_str,
+			       header->err_specific_desc);
+	}
+
+	if (copy_sense) {
+		memcpy(tw_dev->srb[request_id]->sense_buffer, header->sense_data, TW_SENSE_DATA_LENGTH);
+		tw_dev->srb[request_id]->result = (full_command_packet->command.newcommand.status << 1);
+		goto out;
+	}
+out:
+	return retval;
+} /* End twl_fill_sense() */
+
+/* This function will free up device extension resources */
+static void twl_free_device_extension(TW_Device_Extension *tw_dev)
+{
+	if (tw_dev->command_packet_virt[0])
+		pci_free_consistent(tw_dev->tw_pci_dev,
+				    sizeof(TW_Command_Full)*TW_Q_LENGTH,
+				    tw_dev->command_packet_virt[0],
+				    tw_dev->command_packet_phys[0]);
+
+	if (tw_dev->generic_buffer_virt[0])
+		pci_free_consistent(tw_dev->tw_pci_dev,
+				    TW_SECTOR_SIZE*TW_Q_LENGTH,
+				    tw_dev->generic_buffer_virt[0],
+				    tw_dev->generic_buffer_phys[0]);
+
+	if (tw_dev->sense_buffer_virt[0])
+		pci_free_consistent(tw_dev->tw_pci_dev,
+				    sizeof(TW_Command_Apache_Header)*
+				    TW_Q_LENGTH,
+				    tw_dev->sense_buffer_virt[0],
+				    tw_dev->sense_buffer_phys[0]);
+
+	kfree(tw_dev->event_queue[0]);
+} /* End twl_free_device_extension() */
+
+/* This function will get parameter table entries from the firmware */
+static void *twl_get_param(TW_Device_Extension *tw_dev, int request_id, int table_id, int parameter_id, int parameter_size_bytes)
+{
+	TW_Command_Full *full_command_packet;
+	TW_Command *command_packet;
+	TW_Param_Apache *param;
+	void *retval = NULL;
+
+	/* Setup the command packet */
+	full_command_packet = tw_dev->command_packet_virt[request_id];
+	memset(full_command_packet, 0, sizeof(TW_Command_Full));
+	command_packet = &full_command_packet->command.oldcommand;
+
+	command_packet->opcode__sgloffset = TW_OPSGL_IN(2, TW_OP_GET_PARAM);
+	command_packet->size              = TW_COMMAND_SIZE;
+	command_packet->request_id        = request_id;
+	command_packet->byte6_offset.block_count = cpu_to_le16(1);
+
+	/* Now setup the param */
+	param = (TW_Param_Apache *)tw_dev->generic_buffer_virt[request_id];
+	memset(param, 0, TW_SECTOR_SIZE);
+	param->table_id = cpu_to_le16(table_id | 0x8000);
+	param->parameter_id = cpu_to_le16(parameter_id);
+	param->parameter_size_bytes = cpu_to_le16(parameter_size_bytes);
+
+	command_packet->byte8_offset.param.sgl[0].address = TW_CPU_TO_SGL(tw_dev->generic_buffer_phys[request_id]);
+	command_packet->byte8_offset.param.sgl[0].length = TW_CPU_TO_SGL(TW_SECTOR_SIZE);
+
+	/* Post the command packet to the board */
+	twl_post_command_packet(tw_dev, request_id);
+
+	/* Poll for completion */
+	if (twl_poll_response(tw_dev, request_id, 30))
+		TW_PRINTK(tw_dev->host, TW_DRIVER, 0x7, "No valid response during get param")
+	else
+		retval = (void *)&(param->data[0]);
+
+	tw_dev->posted_request_count--;
+	tw_dev->state[request_id] = TW_S_INITIAL;
+
+	return retval;
+} /* End twl_get_param() */
+
+/* This function will send an initconnection command to controller */
+static int twl_initconnection(TW_Device_Extension *tw_dev, int message_credits,
+ 			      u32 set_features, unsigned short current_fw_srl, 
+			      unsigned short current_fw_arch_id, 
+			      unsigned short current_fw_branch, 
+			      unsigned short current_fw_build, 
+			      unsigned short *fw_on_ctlr_srl, 
+			      unsigned short *fw_on_ctlr_arch_id, 
+			      unsigned short *fw_on_ctlr_branch, 
+			      unsigned short *fw_on_ctlr_build, 
+			      u32 *init_connect_result)
+{
+	TW_Command_Full *full_command_packet;
+	TW_Initconnect *tw_initconnect;
+	int request_id = 0, retval = 1;
+
+	/* Initialize InitConnection command packet */
+	full_command_packet = tw_dev->command_packet_virt[request_id];
+	memset(full_command_packet, 0, sizeof(TW_Command_Full));
+	full_command_packet->header.header_desc.size_header = 128;
+	
+	tw_initconnect = (TW_Initconnect *)&full_command_packet->command.oldcommand;
+	tw_initconnect->opcode__reserved = TW_OPRES_IN(0, TW_OP_INIT_CONNECTION);
+	tw_initconnect->request_id = request_id;
+	tw_initconnect->message_credits = cpu_to_le16(message_credits);
+	tw_initconnect->features = set_features;
+
+	/* Turn on 64-bit sgl support if we need to */
+	tw_initconnect->features |= sizeof(dma_addr_t) > 4 ? 1 : 0;
+
+	tw_initconnect->features = cpu_to_le32(tw_initconnect->features);
+
+	if (set_features & TW_EXTENDED_INIT_CONNECT) {
+		tw_initconnect->size = TW_INIT_COMMAND_PACKET_SIZE_EXTENDED;
+		tw_initconnect->fw_srl = cpu_to_le16(current_fw_srl);
+		tw_initconnect->fw_arch_id = cpu_to_le16(current_fw_arch_id);
+		tw_initconnect->fw_branch = cpu_to_le16(current_fw_branch);
+		tw_initconnect->fw_build = cpu_to_le16(current_fw_build);
+	} else 
+		tw_initconnect->size = TW_INIT_COMMAND_PACKET_SIZE;
+
+	/* Send command packet to the board */
+	twl_post_command_packet(tw_dev, request_id);
+
+	/* Poll for completion */
+	if (twl_poll_response(tw_dev, request_id, 30)) {
+		TW_PRINTK(tw_dev->host, TW_DRIVER, 0x8, "No valid response during init connection");
+	} else {
+		if (set_features & TW_EXTENDED_INIT_CONNECT) {
+			*fw_on_ctlr_srl = le16_to_cpu(tw_initconnect->fw_srl);
+			*fw_on_ctlr_arch_id = le16_to_cpu(tw_initconnect->fw_arch_id);
+			*fw_on_ctlr_branch = le16_to_cpu(tw_initconnect->fw_branch);
+			*fw_on_ctlr_build = le16_to_cpu(tw_initconnect->fw_build);
+			*init_connect_result = le32_to_cpu(tw_initconnect->result);
+		}
+		retval = 0;
+	}
+
+	tw_dev->posted_request_count--;
+	tw_dev->state[request_id] = TW_S_INITIAL;
+
+	return retval;
+} /* End twl_initconnection() */
+
+/* This function will initialize the fields of a device extension */
+static int twl_initialize_device_extension(TW_Device_Extension *tw_dev)
+{
+	int i, retval = 1;
+
+	/* Initialize command packet buffers */
+	if (twl_allocate_memory(tw_dev, sizeof(TW_Command_Full), 0)) {
+		TW_PRINTK(tw_dev->host, TW_DRIVER, 0x9, "Command packet memory allocation failed");
+		goto out;
+	}
+
+	/* Initialize generic buffer */
+	if (twl_allocate_memory(tw_dev, TW_SECTOR_SIZE, 1)) {
+		TW_PRINTK(tw_dev->host, TW_DRIVER, 0xa, "Generic memory allocation failed");
+		goto out;
+	}
+
+	/* Allocate sense buffers */
+	if (twl_allocate_memory(tw_dev, sizeof(TW_Command_Apache_Header), 2)) {
+		TW_PRINTK(tw_dev->host, TW_DRIVER, 0xb, "Sense buffer allocation failed");
+		goto out;
+	}
+
+	/* Allocate event info space */
+	tw_dev->event_queue[0] = kcalloc(TW_Q_LENGTH, sizeof(TW_Event), GFP_KERNEL);
+	if (!tw_dev->event_queue[0]) {
+		TW_PRINTK(tw_dev->host, TW_DRIVER, 0xc, "Event info memory allocation failed");
+		goto out;
+	}
+
+	for (i = 0; i < TW_Q_LENGTH; i++) {
+		tw_dev->event_queue[i] = (TW_Event *)((unsigned char *)tw_dev->event_queue[0] + (i * sizeof(TW_Event)));
+		tw_dev->free_queue[i] = i;
+		tw_dev->state[i] = TW_S_INITIAL;
+	}
+
+	tw_dev->free_head = TW_Q_START;
+	tw_dev->free_tail = TW_Q_START;
+	tw_dev->error_sequence_id = 1;
+	tw_dev->chrdev_request_id = TW_IOCTL_CHRDEV_FREE;
+
+	mutex_init(&tw_dev->ioctl_lock);
+	init_waitqueue_head(&tw_dev->ioctl_wqueue);
+
+	retval = 0;
+out:
+	return retval;
+} /* End twl_initialize_device_extension() */
+
+/* This function will perform a pci-dma unmap */
+static void twl_unmap_scsi_data(TW_Device_Extension *tw_dev, int request_id)
+{
+	struct scsi_cmnd *cmd = tw_dev->srb[request_id];
+
+	if (cmd->SCp.phase == TW_PHASE_SGLIST)
+		scsi_dma_unmap(cmd);
+} /* End twl_unmap_scsi_data() */
+
+/* This function will handle attention interrupts */
+static int twl_handle_attention_interrupt(TW_Device_Extension *tw_dev)
+{
+	int retval = 1;
+	u32 request_id, doorbell;
+
+	/* Read doorbell status */
+	doorbell = readl(TWL_HOBDB_REG_ADDR(tw_dev));
+
+	/* Check for controller errors */
+	if (doorbell & TWL_DOORBELL_CONTROLLER_ERROR) {
+		TW_PRINTK(tw_dev->host, TW_DRIVER, 0xd, "Microcontroller Error: clearing");
+		goto out;
+	}
+
+	/* Check if we need to perform an AEN drain */
+	if (doorbell & TWL_DOORBELL_ATTENTION_INTERRUPT) {
+		if (!(test_and_set_bit(TW_IN_ATTENTION_LOOP, &tw_dev->flags))) {
+			twl_get_request_id(tw_dev, &request_id);
+			if (twl_aen_read_queue(tw_dev, request_id)) {
+				tw_dev->state[request_id] = TW_S_COMPLETED;
+				twl_free_request_id(tw_dev, request_id);
+				clear_bit(TW_IN_ATTENTION_LOOP, &tw_dev->flags);
+			}
+		}
+	}
+
+	retval = 0;
+out:
+	/* Clear doorbell interrupt */
+	TWL_CLEAR_DB_INTERRUPT(tw_dev);
+
+	/* Make sure the clear was flushed by reading it back */
+	readl(TWL_HOBDBC_REG_ADDR(tw_dev));
+
+	return retval;
+} /* End twl_handle_attention_interrupt() */
+
+/* Interrupt service routine */
+static irqreturn_t twl_interrupt(int irq, void *dev_instance)
+{
+	TW_Device_Extension *tw_dev = (TW_Device_Extension *)dev_instance;
+	int i, handled = 0, error = 0;
+	dma_addr_t mfa = 0;
+	u32 reg, regl, regh, response, request_id = 0;
+	struct scsi_cmnd *cmd;
+	TW_Command_Full *full_command_packet;
+
+	spin_lock(tw_dev->host->host_lock);
+
+	/* Read host interrupt status */
+	reg = readl(TWL_HISTAT_REG_ADDR(tw_dev));
+
+	/* Check if this is our interrupt, otherwise bail */
+	if (!(reg & TWL_HISTATUS_VALID_INTERRUPT))
+		goto twl_interrupt_bail;
+
+	handled = 1;
+
+	/* If we are resetting, bail */
+	if (test_bit(TW_IN_RESET, &tw_dev->flags))
+		goto twl_interrupt_bail;
+
+	/* Attention interrupt */
+	if (reg & TWL_HISTATUS_ATTENTION_INTERRUPT) {
+		if (twl_handle_attention_interrupt(tw_dev)) {
+			TWL_MASK_INTERRUPTS(tw_dev);
+			goto twl_interrupt_bail;
+		}
+	}
+
+	/* Response interrupt */
+	while (reg & TWL_HISTATUS_RESPONSE_INTERRUPT) {
+		if (sizeof(dma_addr_t) > 4) {
+			regh = readl(TWL_HOBQPH_REG_ADDR(tw_dev));
+			regl = readl(TWL_HOBQPL_REG_ADDR(tw_dev));
+			mfa = ((u64)regh << 32) | regl;
+		} else
+			mfa = readl(TWL_HOBQPL_REG_ADDR(tw_dev));
+
+		error = 0;
+		response = (u32)mfa;
+
+		/* Check for command packet error */
+		if (!TW_NOTMFA_OUT(response)) {
+			for (i=0;i<TW_Q_LENGTH;i++) {
+				if (tw_dev->sense_buffer_phys[i] == mfa) {
+					request_id = le16_to_cpu(tw_dev->sense_buffer_virt[i]->header_desc.request_id);
+					if (tw_dev->srb[request_id] != NULL)
+						error = twl_fill_sense(tw_dev, i, request_id, 1, 1);
+					else {
+						/* Skip ioctl error prints */
+						if (request_id != tw_dev->chrdev_request_id)
+							error = twl_fill_sense(tw_dev, i, request_id, 0, 1);
+						else
+							memcpy(tw_dev->command_packet_virt[request_id], tw_dev->sense_buffer_virt[i], sizeof(TW_Command_Apache_Header));
+					}
+
+					/* Now re-post the sense buffer */
+					writel((u32)((u64)tw_dev->sense_buffer_phys[i] >> 32), TWL_HOBQPH_REG_ADDR(tw_dev));
+					writel((u32)tw_dev->sense_buffer_phys[i], TWL_HOBQPL_REG_ADDR(tw_dev));
+					break;
+				}
+			}
+		} else
+			request_id = TW_RESID_OUT(response);
+
+		full_command_packet = tw_dev->command_packet_virt[request_id];
+
+		/* Check for correct state */
+		if (tw_dev->state[request_id] != TW_S_POSTED) {
+			if (tw_dev->srb[request_id] != NULL) {
+				TW_PRINTK(tw_dev->host, TW_DRIVER, 0xe, "Received a request id that wasn't posted");
+				TWL_MASK_INTERRUPTS(tw_dev);
+				goto twl_interrupt_bail;
+			}
+		}
+
+		/* Check for internal command completion */
+		if (tw_dev->srb[request_id] == NULL) {
+			if (request_id != tw_dev->chrdev_request_id) {
+				if (twl_aen_complete(tw_dev, request_id))
+					TW_PRINTK(tw_dev->host, TW_DRIVER, 0xf, "Error completing AEN during attention interrupt");
+			} else {
+				tw_dev->chrdev_request_id = TW_IOCTL_CHRDEV_FREE;
+				wake_up(&tw_dev->ioctl_wqueue);
+			}
+		} else {
+			cmd = tw_dev->srb[request_id];
+
+			if (!error)
+				cmd->result = (DID_OK << 16);
+			
+			/* Report residual bytes for single sgl */
+			if ((scsi_sg_count(cmd) <= 1) && (full_command_packet->command.newcommand.status == 0)) {
+				if (full_command_packet->command.newcommand.sg_list[0].length < scsi_bufflen(tw_dev->srb[request_id]))
+					scsi_set_resid(cmd, scsi_bufflen(cmd) - full_command_packet->command.newcommand.sg_list[0].length);
+			}
+
+			/* Now complete the io */
+			tw_dev->state[request_id] = TW_S_COMPLETED;
+			twl_free_request_id(tw_dev, request_id);
+			tw_dev->posted_request_count--;
+			tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]);
+			twl_unmap_scsi_data(tw_dev, request_id);
+		}
+
+		/* Check for another response interrupt */
+		reg = readl(TWL_HISTAT_REG_ADDR(tw_dev));
+	}
+
+twl_interrupt_bail:
+	spin_unlock(tw_dev->host->host_lock);
+	return IRQ_RETVAL(handled);
+} /* End twl_interrupt() */
+
+/* This function will poll for a register change */
+static int twl_poll_register(TW_Device_Extension *tw_dev, void *reg, u32 value, u32 result, int seconds)
+{
+	unsigned long before;
+	int retval = 1;
+	u32 reg_value;
+
+	reg_value = readl(reg);
+	before = jiffies;
+
+        while ((reg_value & value) != result) {
+		reg_value = readl(reg);
+		if (time_after(jiffies, before + HZ * seconds))
+			goto out;
+		msleep(50);
+	}
+	retval = 0;
+out:
+	return retval;
+} /* End twl_poll_register() */
+
+/* This function will reset a controller */
+static int twl_reset_sequence(TW_Device_Extension *tw_dev, int soft_reset)
+{
+	int retval = 1;
+	int i = 0;
+	u32 status = 0;
+	unsigned short fw_on_ctlr_srl = 0, fw_on_ctlr_arch_id = 0;
+	unsigned short fw_on_ctlr_branch = 0, fw_on_ctlr_build = 0;
+	u32 init_connect_result = 0;
+	int tries = 0;
+	int do_soft_reset = soft_reset;
+
+	while (tries < TW_MAX_RESET_TRIES) {
+		/* Do a soft reset if one is needed */
+		if (do_soft_reset) {
+			TWL_SOFT_RESET(tw_dev);
+
+			/* Make sure controller is in a good state */
+			if (twl_poll_register(tw_dev, TWL_SCRPD3_REG_ADDR(tw_dev), TWL_CONTROLLER_READY, 0x0, 30)) {
+				TW_PRINTK(tw_dev->host, TW_DRIVER, 0x10, "Controller never went non-ready during reset sequence");
+				tries++;
+				continue;
+			}
+			if (twl_poll_register(tw_dev, TWL_SCRPD3_REG_ADDR(tw_dev), TWL_CONTROLLER_READY, TWL_CONTROLLER_READY, 60)) {
+				TW_PRINTK(tw_dev->host, TW_DRIVER, 0x11, "Controller not ready during reset sequence");
+				tries++;
+				continue;
+			}
+		}
+
+		/* Initconnect */
+		if (twl_initconnection(tw_dev, TW_INIT_MESSAGE_CREDITS,
+				       TW_EXTENDED_INIT_CONNECT, TW_CURRENT_DRIVER_SRL,
+				       TW_9750_ARCH_ID, TW_CURRENT_DRIVER_BRANCH,
+				       TW_CURRENT_DRIVER_BUILD, &fw_on_ctlr_srl,
+				       &fw_on_ctlr_arch_id, &fw_on_ctlr_branch,
+				       &fw_on_ctlr_build, &init_connect_result)) {
+			TW_PRINTK(tw_dev->host, TW_DRIVER, 0x12, "Initconnection failed while checking SRL");
+			do_soft_reset = 1;
+			tries++;
+			continue;
+		}
+
+		/* Load sense buffers */
+		while (i < TW_Q_LENGTH) {
+			writel((u32)((u64)tw_dev->sense_buffer_phys[i] >> 32), TWL_HOBQPH_REG_ADDR(tw_dev));
+			writel((u32)tw_dev->sense_buffer_phys[i], TWL_HOBQPL_REG_ADDR(tw_dev));
+
+			/* Check status for over-run after each write */
+			status = readl(TWL_STATUS_REG_ADDR(tw_dev));
+			if (!(status & TWL_STATUS_OVERRUN_SUBMIT))
+			    i++;
+		}
+
+		/* Now check status */
+		status = readl(TWL_STATUS_REG_ADDR(tw_dev));
+		if (status) {
+			TW_PRINTK(tw_dev->host, TW_DRIVER, 0x13, "Bad controller status after loading sense buffers");
+			do_soft_reset = 1;
+			tries++;
+			continue;
+		}
+
+		/* Drain the AEN queue */
+		if (twl_aen_drain_queue(tw_dev, soft_reset)) {
+			TW_PRINTK(tw_dev->host, TW_DRIVER, 0x14, "AEN drain failed during reset sequence");
+			do_soft_reset = 1;
+			tries++;
+			continue;
+		}
+
+		/* Load rest of compatibility struct */
+		strncpy(tw_dev->tw_compat_info.driver_version, TW_DRIVER_VERSION, strlen(TW_DRIVER_VERSION));
+		tw_dev->tw_compat_info.driver_srl_high = TW_CURRENT_DRIVER_SRL;
+		tw_dev->tw_compat_info.driver_branch_high = TW_CURRENT_DRIVER_BRANCH;
+		tw_dev->tw_compat_info.driver_build_high = TW_CURRENT_DRIVER_BUILD;
+		tw_dev->tw_compat_info.driver_srl_low = TW_BASE_FW_SRL;
+		tw_dev->tw_compat_info.driver_branch_low = TW_BASE_FW_BRANCH;
+		tw_dev->tw_compat_info.driver_build_low = TW_BASE_FW_BUILD;
+		tw_dev->tw_compat_info.fw_on_ctlr_srl = fw_on_ctlr_srl;
+		tw_dev->tw_compat_info.fw_on_ctlr_branch = fw_on_ctlr_branch;
+		tw_dev->tw_compat_info.fw_on_ctlr_build = fw_on_ctlr_build;
+
+		/* If we got here, controller is in a good state */
+		retval = 0;
+		goto out;
+	}
+out:
+	return retval;
+} /* End twl_reset_sequence() */
+
+/* This function will reset a device extension */
+static int twl_reset_device_extension(TW_Device_Extension *tw_dev, int ioctl_reset)
+{
+	int i = 0, retval = 1;
+	unsigned long flags = 0;
+
+	/* Block SCSI requests while we are resetting */
+	if (ioctl_reset)
+		scsi_block_requests(tw_dev->host);
+
+	set_bit(TW_IN_RESET, &tw_dev->flags);
+	TWL_MASK_INTERRUPTS(tw_dev);
+	TWL_CLEAR_DB_INTERRUPT(tw_dev);
+
+	spin_lock_irqsave(tw_dev->host->host_lock, flags);
+
+	/* Abort all requests that are in progress */
+	for (i = 0; i < TW_Q_LENGTH; i++) {
+		if ((tw_dev->state[i] != TW_S_FINISHED) &&
+		    (tw_dev->state[i] != TW_S_INITIAL) &&
+		    (tw_dev->state[i] != TW_S_COMPLETED)) {
+			if (tw_dev->srb[i]) {
+				tw_dev->srb[i]->result = (DID_RESET << 16);
+				tw_dev->srb[i]->scsi_done(tw_dev->srb[i]);
+				twl_unmap_scsi_data(tw_dev, i);
+			}
+		}
+	}
+
+	/* Reset queues and counts */
+	for (i = 0; i < TW_Q_LENGTH; i++) {
+		tw_dev->free_queue[i] = i;
+		tw_dev->state[i] = TW_S_INITIAL;
+	}
+	tw_dev->free_head = TW_Q_START;
+	tw_dev->free_tail = TW_Q_START;
+	tw_dev->posted_request_count = 0;
+
+	spin_unlock_irqrestore(tw_dev->host->host_lock, flags);
+
+	if (twl_reset_sequence(tw_dev, 1))
+		goto out;
+
+	TWL_UNMASK_INTERRUPTS(tw_dev);
+
+	clear_bit(TW_IN_RESET, &tw_dev->flags);
+	tw_dev->chrdev_request_id = TW_IOCTL_CHRDEV_FREE;
+
+	retval = 0;
+out:
+	if (ioctl_reset)
+		scsi_unblock_requests(tw_dev->host);
+	return retval;
+} /* End twl_reset_device_extension() */
+
+/* This funciton returns unit geometry in cylinders/heads/sectors */
+static int twl_scsi_biosparam(struct scsi_device *sdev, struct block_device *bdev, sector_t capacity, int geom[])
+{
+	int heads, sectors;
+	TW_Device_Extension *tw_dev;
+
+	tw_dev = (TW_Device_Extension *)sdev->host->hostdata;
+
+	if (capacity >= 0x200000) {
+		heads = 255;
+		sectors = 63;
+	} else {
+		heads = 64;
+		sectors = 32;
+	}
+
+	geom[0] = heads;
+	geom[1] = sectors;
+	geom[2] = sector_div(capacity, heads * sectors); /* cylinders */
+
+	return 0;
+} /* End twl_scsi_biosparam() */
+
+/* This is the new scsi eh reset function */
+static int twl_scsi_eh_reset(struct scsi_cmnd *SCpnt)
+{
+	TW_Device_Extension *tw_dev = NULL;
+	int retval = FAILED;
+
+	tw_dev = (TW_Device_Extension *)SCpnt->device->host->hostdata;
+
+	tw_dev->num_resets++;
+
+	sdev_printk(KERN_WARNING, SCpnt->device,
+		"WARNING: (0x%02X:0x%04X): Command (0x%x) timed out, resetting card.\n",
+		TW_DRIVER, 0x2c, SCpnt->cmnd[0]);
+
+	/* Make sure we are not issuing an ioctl or resetting from ioctl */
+	mutex_lock(&tw_dev->ioctl_lock);
+
+	/* Now reset the card and some of the device extension data */
+	if (twl_reset_device_extension(tw_dev, 0)) {
+		TW_PRINTK(tw_dev->host, TW_DRIVER, 0x15, "Controller reset failed during scsi host reset");
+		goto out;
+	}
+
+	retval = SUCCESS;
+out:
+	mutex_unlock(&tw_dev->ioctl_lock);
+	return retval;
+} /* End twl_scsi_eh_reset() */
+
+/* This is the main scsi queue function to handle scsi opcodes */
+static int twl_scsi_queue(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_cmnd *))
+{
+	int request_id, retval;
+	TW_Device_Extension *tw_dev = (TW_Device_Extension *)SCpnt->device->host->hostdata;
+
+	/* If we are resetting due to timed out ioctl, report as busy */
+	if (test_bit(TW_IN_RESET, &tw_dev->flags)) {
+		retval = SCSI_MLQUEUE_HOST_BUSY;
+		goto out;
+	}
+
+	/* Save done function into scsi_cmnd struct */
+	SCpnt->scsi_done = done;
+		
+	/* Get a free request id */
+	twl_get_request_id(tw_dev, &request_id);
+
+	/* Save the scsi command for use by the ISR */
+	tw_dev->srb[request_id] = SCpnt;
+
+	/* Initialize phase to zero */
+	SCpnt->SCp.phase = TW_PHASE_INITIAL;
+
+	retval = twl_scsiop_execute_scsi(tw_dev, request_id, NULL, 0, NULL);
+	if (retval) {
+		tw_dev->state[request_id] = TW_S_COMPLETED;
+		twl_free_request_id(tw_dev, request_id);
+		SCpnt->result = (DID_ERROR << 16);
+		done(SCpnt);
+		retval = 0;
+	}
+out:
+	return retval;
+} /* End twl_scsi_queue() */
+
+/* This function tells the controller to shut down */
+static void __twl_shutdown(TW_Device_Extension *tw_dev)
+{
+	/* Disable interrupts */
+	TWL_MASK_INTERRUPTS(tw_dev);
+
+	/* Free up the IRQ */
+	free_irq(tw_dev->tw_pci_dev->irq, tw_dev);
+
+	printk(KERN_WARNING "3w-sas: Shutting down host %d.\n", tw_dev->host->host_no);
+
+	/* Tell the card we are shutting down */
+	if (twl_initconnection(tw_dev, 1, 0, 0, 0, 0, 0, NULL, NULL, NULL, NULL, NULL)) {
+		TW_PRINTK(tw_dev->host, TW_DRIVER, 0x16, "Connection shutdown failed");
+	} else {
+		printk(KERN_WARNING "3w-sas: Shutdown complete.\n");
+	}
+
+	/* Clear doorbell interrupt just before exit */
+	TWL_CLEAR_DB_INTERRUPT(tw_dev);
+} /* End __twl_shutdown() */
+
+/* Wrapper for __twl_shutdown */
+static void twl_shutdown(struct pci_dev *pdev)
+{
+	struct Scsi_Host *host = pci_get_drvdata(pdev);
+	TW_Device_Extension *tw_dev;
+
+	if (!host)
+		return;
+
+	tw_dev = (TW_Device_Extension *)host->hostdata;
+
+	if (tw_dev->online) 
+		__twl_shutdown(tw_dev);
+} /* End twl_shutdown() */
+
+/* This function configures unit settings when a unit is coming on-line */
+static int twl_slave_configure(struct scsi_device *sdev)
+{
+	/* Force 60 second timeout */
+	blk_queue_rq_timeout(sdev->request_queue, 60 * HZ);
+
+	return 0;
+} /* End twl_slave_configure() */
+
+/* scsi_host_template initializer */
+static struct scsi_host_template driver_template = {
+	.module			= THIS_MODULE,
+	.name			= "3w-sas",
+	.queuecommand		= twl_scsi_queue,
+	.eh_host_reset_handler	= twl_scsi_eh_reset,
+	.bios_param		= twl_scsi_biosparam,
+	.change_queue_depth	= twl_change_queue_depth,
+	.can_queue		= TW_Q_LENGTH-2,
+	.slave_configure	= twl_slave_configure,
+	.this_id		= -1,
+	.sg_tablesize		= TW_LIBERATOR_MAX_SGL_LENGTH,
+	.max_sectors		= TW_MAX_SECTORS,
+	.cmd_per_lun		= TW_MAX_CMDS_PER_LUN,
+	.use_clustering		= ENABLE_CLUSTERING,
+	.shost_attrs		= twl_host_attrs,
+	.emulated		= 1
+};
+
+/* This function will probe and initialize a card */
+static int __devinit twl_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id)
+{
+	struct Scsi_Host *host = NULL;
+	TW_Device_Extension *tw_dev;
+	int retval = -ENODEV;
+	int *ptr_phycount, phycount=0;
+
+	retval = pci_enable_device(pdev);
+	if (retval) {
+		TW_PRINTK(host, TW_DRIVER, 0x17, "Failed to enable pci device");
+		goto out_disable_device;
+	}
+
+	pci_set_master(pdev);
+	pci_try_set_mwi(pdev);
+
+	if (pci_set_dma_mask(pdev, DMA_BIT_MASK(64))
+	    || pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64)))
+		if (pci_set_dma_mask(pdev, DMA_BIT_MASK(32))
+		    || pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32))) {
+			TW_PRINTK(host, TW_DRIVER, 0x18, "Failed to set dma mask");
+			retval = -ENODEV;
+			goto out_disable_device;
+		}
+
+	host = scsi_host_alloc(&driver_template, sizeof(TW_Device_Extension));
+	if (!host) {
+		TW_PRINTK(host, TW_DRIVER, 0x19, "Failed to allocate memory for device extension");
+		retval = -ENOMEM;
+		goto out_disable_device;
+	}
+	tw_dev = shost_priv(host);
+
+	/* Save values to device extension */
+	tw_dev->host = host;
+	tw_dev->tw_pci_dev = pdev;
+
+	if (twl_initialize_device_extension(tw_dev)) {
+		TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1a, "Failed to initialize device extension");
+		goto out_free_device_extension;
+	}
+
+	/* Request IO regions */
+	retval = pci_request_regions(pdev, "3w-sas");
+	if (retval) {
+		TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1b, "Failed to get mem region");
+		goto out_free_device_extension;
+	}
+
+	/* Save base address, use region 1 */
+	tw_dev->base_addr = pci_iomap(pdev, 1, 0);
+	if (!tw_dev->base_addr) {
+		TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1c, "Failed to ioremap");
+		goto out_release_mem_region;
+	}
+
+	/* Disable interrupts on the card */
+	TWL_MASK_INTERRUPTS(tw_dev);
+
+	/* Initialize the card */
+	if (twl_reset_sequence(tw_dev, 0)) {
+		TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1d, "Controller reset failed during probe");
+		goto out_iounmap;
+	}
+
+	/* Set host specific parameters */
+	host->max_id = TW_MAX_UNITS;
+	host->max_cmd_len = TW_MAX_CDB_LEN;
+	host->max_lun = TW_MAX_LUNS;
+	host->max_channel = 0;
+
+	/* Register the card with the kernel SCSI layer */
+	retval = scsi_add_host(host, &pdev->dev);
+	if (retval) {
+		TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1e, "scsi add host failed");
+		goto out_iounmap;
+	}
+
+	pci_set_drvdata(pdev, host);
+
+	printk(KERN_WARNING "3w-sas: scsi%d: Found an LSI 3ware %s Controller at 0x%llx, IRQ: %d.\n",
+	       host->host_no,
+	       (char *)twl_get_param(tw_dev, 1, TW_VERSION_TABLE,
+				     TW_PARAM_MODEL, TW_PARAM_MODEL_LENGTH),
+	       (u64)pci_resource_start(pdev, 1), pdev->irq);
+
+	ptr_phycount = twl_get_param(tw_dev, 2, TW_PARAM_PHY_SUMMARY_TABLE,
+				     TW_PARAM_PHYCOUNT, TW_PARAM_PHYCOUNT_LENGTH);
+	if (ptr_phycount)
+		phycount = le32_to_cpu(*(int *)ptr_phycount);
+
+	printk(KERN_WARNING "3w-sas: scsi%d: Firmware %s, BIOS %s, Phys: %d.\n",
+	       host->host_no,
+	       (char *)twl_get_param(tw_dev, 1, TW_VERSION_TABLE,
+				     TW_PARAM_FWVER, TW_PARAM_FWVER_LENGTH),
+	       (char *)twl_get_param(tw_dev, 2, TW_VERSION_TABLE,
+				     TW_PARAM_BIOSVER, TW_PARAM_BIOSVER_LENGTH),
+	       phycount);
+
+	/* Try to enable MSI */
+	if (use_msi && !pci_enable_msi(pdev))
+		set_bit(TW_USING_MSI, &tw_dev->flags);
+
+	/* Now setup the interrupt handler */
+	retval = request_irq(pdev->irq, twl_interrupt, IRQF_SHARED, "3w-sas", tw_dev);
+	if (retval) {
+		TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1f, "Error requesting IRQ");
+		goto out_remove_host;
+	}
+
+	twl_device_extension_list[twl_device_extension_count] = tw_dev;
+	twl_device_extension_count++;
+
+	/* Re-enable interrupts on the card */
+	TWL_UNMASK_INTERRUPTS(tw_dev);
+	
+	/* Finally, scan the host */
+	scsi_scan_host(host);
+
+	/* Add sysfs binary files */
+	if (sysfs_create_bin_file(&host->shost_dev.kobj, &twl_sysfs_aen_read_attr))
+		TW_PRINTK(tw_dev->host, TW_DRIVER, 0x20, "Failed to create sysfs binary file: 3ware_aen_read");
+	if (sysfs_create_bin_file(&host->shost_dev.kobj, &twl_sysfs_compat_info_attr))
+		TW_PRINTK(tw_dev->host, TW_DRIVER, 0x21, "Failed to create sysfs binary file: 3ware_compat_info");
+
+	if (twl_major == -1) {
+		if ((twl_major = register_chrdev (0, "twl", &twl_fops)) < 0)
+			TW_PRINTK(host, TW_DRIVER, 0x22, "Failed to register character device");
+	}
+	tw_dev->online = 1;
+	return 0;
+
+out_remove_host:
+	if (test_bit(TW_USING_MSI, &tw_dev->flags))
+		pci_disable_msi(pdev);
+	scsi_remove_host(host);
+out_iounmap:
+	iounmap(tw_dev->base_addr);
+out_release_mem_region:
+	pci_release_regions(pdev);
+out_free_device_extension:
+	twl_free_device_extension(tw_dev);
+	scsi_host_put(host);
+out_disable_device:
+	pci_disable_device(pdev);
+
+	return retval;
+} /* End twl_probe() */
+
+/* This function is called to remove a device */
+static void twl_remove(struct pci_dev *pdev)
+{
+	struct Scsi_Host *host = pci_get_drvdata(pdev);
+	TW_Device_Extension *tw_dev;
+
+	if (!host)
+		return;
+
+	tw_dev = (TW_Device_Extension *)host->hostdata;
+
+	if (!tw_dev->online)
+		return;
+
+	/* Remove sysfs binary files */
+	sysfs_remove_bin_file(&host->shost_dev.kobj, &twl_sysfs_aen_read_attr);
+	sysfs_remove_bin_file(&host->shost_dev.kobj, &twl_sysfs_compat_info_attr);
+
+	scsi_remove_host(tw_dev->host);
+
+	/* Unregister character device */
+	if (twl_major >= 0) {
+		unregister_chrdev(twl_major, "twl");
+		twl_major = -1;
+	}
+
+	/* Shutdown the card */
+	__twl_shutdown(tw_dev);
+
+	/* Disable MSI if enabled */
+	if (test_bit(TW_USING_MSI, &tw_dev->flags))
+		pci_disable_msi(pdev);
+
+	/* Free IO remapping */
+	iounmap(tw_dev->base_addr);
+
+	/* Free up the mem region */
+	pci_release_regions(pdev);
+
+	/* Free up device extension resources */
+	twl_free_device_extension(tw_dev);
+
+	scsi_host_put(tw_dev->host);
+	pci_disable_device(pdev);
+	twl_device_extension_count--;
+} /* End twl_remove() */
+
+#ifdef CONFIG_PM
+/* This function is called on PCI suspend */
+static int twl_suspend(struct pci_dev *pdev, pm_message_t state)
+{
+	struct Scsi_Host *host = pci_get_drvdata(pdev);
+	TW_Device_Extension *tw_dev = (TW_Device_Extension *)host->hostdata;
+
+	printk(KERN_WARNING "3w-sas: Suspending host %d.\n", tw_dev->host->host_no);
+	/* Disable interrupts */
+	TWL_MASK_INTERRUPTS(tw_dev);
+
+	free_irq(tw_dev->tw_pci_dev->irq, tw_dev);
+
+	/* Tell the card we are shutting down */
+	if (twl_initconnection(tw_dev, 1, 0, 0, 0, 0, 0, NULL, NULL, NULL, NULL, NULL)) {
+		TW_PRINTK(tw_dev->host, TW_DRIVER, 0x23, "Connection shutdown failed during suspend");
+	} else {
+		printk(KERN_WARNING "3w-sas: Suspend complete.\n");
+	}
+
+	/* Clear doorbell interrupt */
+	TWL_CLEAR_DB_INTERRUPT(tw_dev);
+
+	pci_save_state(pdev);
+	pci_disable_device(pdev);
+	pci_set_power_state(pdev, pci_choose_state(pdev, state));
+
+	return 0;
+} /* End twl_suspend() */
+
+/* This function is called on PCI resume */
+static int twl_resume(struct pci_dev *pdev)
+{
+	int retval = 0;
+	struct Scsi_Host *host = pci_get_drvdata(pdev);
+	TW_Device_Extension *tw_dev = (TW_Device_Extension *)host->hostdata;
+
+	printk(KERN_WARNING "3w-sas: Resuming host %d.\n", tw_dev->host->host_no);
+	pci_set_power_state(pdev, PCI_D0);
+	pci_enable_wake(pdev, PCI_D0, 0);
+	pci_restore_state(pdev);
+
+	retval = pci_enable_device(pdev);
+	if (retval) {
+		TW_PRINTK(tw_dev->host, TW_DRIVER, 0x24, "Enable device failed during resume");
+		return retval;
+	}
+
+	pci_set_master(pdev);
+	pci_try_set_mwi(pdev);
+
+	if (pci_set_dma_mask(pdev, DMA_BIT_MASK(64))
+	    || pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64)))
+		if (pci_set_dma_mask(pdev, DMA_BIT_MASK(32))
+		    || pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32))) {
+			TW_PRINTK(host, TW_DRIVER, 0x25, "Failed to set dma mask during resume");
+			retval = -ENODEV;
+			goto out_disable_device;
+		}
+
+	/* Initialize the card */
+	if (twl_reset_sequence(tw_dev, 0)) {
+		retval = -ENODEV;
+		goto out_disable_device;
+	}
+
+	/* Now setup the interrupt handler */
+	retval = request_irq(pdev->irq, twl_interrupt, IRQF_SHARED, "3w-sas", tw_dev);
+	if (retval) {
+		TW_PRINTK(tw_dev->host, TW_DRIVER, 0x26, "Error requesting IRQ during resume");
+		retval = -ENODEV;
+		goto out_disable_device;
+	}
+
+	/* Now enable MSI if enabled */
+	if (test_bit(TW_USING_MSI, &tw_dev->flags))
+		pci_enable_msi(pdev);
+
+	/* Re-enable interrupts on the card */
+	TWL_UNMASK_INTERRUPTS(tw_dev);
+
+	printk(KERN_WARNING "3w-sas: Resume complete.\n");
+	return 0;
+
+out_disable_device:
+	scsi_remove_host(host);
+	pci_disable_device(pdev);
+
+	return retval;
+} /* End twl_resume() */
+#endif
+
+/* PCI Devices supported by this driver */
+static struct pci_device_id twl_pci_tbl[] __devinitdata = {
+	{ PCI_VDEVICE(3WARE, PCI_DEVICE_ID_3WARE_9750) },
+	{ }
+};
+MODULE_DEVICE_TABLE(pci, twl_pci_tbl);
+
+/* pci_driver initializer */
+static struct pci_driver twl_driver = {
+	.name		= "3w-sas",
+	.id_table	= twl_pci_tbl,
+	.probe		= twl_probe,
+	.remove		= twl_remove,
+#ifdef CONFIG_PM
+	.suspend	= twl_suspend,
+	.resume		= twl_resume,
+#endif
+	.shutdown	= twl_shutdown
+};
+
+/* This function is called on driver initialization */
+static int __init twl_init(void)
+{
+	printk(KERN_INFO "LSI 3ware SAS/SATA-RAID Controller device driver for Linux v%s.\n", TW_DRIVER_VERSION);
+
+	return pci_register_driver(&twl_driver);
+} /* End twl_init() */
+
+/* This function is called on driver exit */
+static void __exit twl_exit(void)
+{
+	pci_unregister_driver(&twl_driver);
+} /* End twl_exit() */
+
+module_init(twl_init);
+module_exit(twl_exit);
+
diff --git a/drivers/scsi/3w-sas.h b/drivers/scsi/3w-sas.h
new file mode 100644
index 000000000000..d474892701d4
--- /dev/null
+++ b/drivers/scsi/3w-sas.h
@@ -0,0 +1,396 @@
+/*
+   3w-sas.h -- LSI 3ware SAS/SATA-RAID Controller device driver for Linux.
+
+   Written By: Adam Radford <linuxraid@lsi.com>
+
+   Copyright (C) 2009 LSI Corporation.
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; version 2 of the License.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   NO WARRANTY
+   THE PROGRAM IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OR
+   CONDITIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED INCLUDING, WITHOUT
+   LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE, NON-INFRINGEMENT,
+   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each Recipient is
+   solely responsible for determining the appropriateness of using and
+   distributing the Program and assumes all risks associated with its
+   exercise of rights under this Agreement, including but not limited to
+   the risks and costs of program errors, damage to or loss of data,
+   programs or equipment, and unavailability or interruption of operations.
+
+   DISCLAIMER OF LIABILITY
+   NEITHER RECIPIENT NOR ANY CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY
+   DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+   DAMAGES (INCLUDING WITHOUT LIMITATION LOST PROFITS), HOWEVER CAUSED AND
+   ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
+   TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
+   USE OR DISTRIBUTION OF THE PROGRAM OR THE EXERCISE OF ANY RIGHTS GRANTED
+   HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES
+
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+   Bugs/Comments/Suggestions should be mailed to:
+   linuxraid@lsi.com
+
+   For more information, goto:
+   http://www.lsi.com
+*/
+
+#ifndef _3W_SAS_H
+#define _3W_SAS_H
+
+/* AEN severity table */
+static char *twl_aen_severity_table[] =
+{
+	"None", "ERROR", "WARNING", "INFO", "DEBUG", NULL
+};
+
+/* Liberator register offsets */
+#define TWL_STATUS                         0x0  /* Status */
+#define TWL_HIBDB                          0x20 /* Inbound doorbell */
+#define TWL_HISTAT                         0x30 /* Host interrupt status */
+#define TWL_HIMASK                         0x34 /* Host interrupt mask */
+#define TWL_HOBDB			   0x9C /* Outbound doorbell */
+#define TWL_HOBDBC                         0xA0 /* Outbound doorbell clear */
+#define TWL_SCRPD3                         0xBC /* Scratchpad */
+#define TWL_HIBQPL                         0xC0 /* Host inbound Q low */
+#define TWL_HIBQPH                         0xC4 /* Host inbound Q high */
+#define TWL_HOBQPL                         0xC8 /* Host outbound Q low */
+#define TWL_HOBQPH                         0xCC /* Host outbound Q high */
+#define TWL_HISTATUS_VALID_INTERRUPT	   0xC
+#define TWL_HISTATUS_ATTENTION_INTERRUPT   0x4
+#define TWL_HISTATUS_RESPONSE_INTERRUPT	   0x8
+#define TWL_STATUS_OVERRUN_SUBMIT	   0x2000
+#define TWL_ISSUE_SOFT_RESET		   0x100
+#define TWL_CONTROLLER_READY		   0x2000
+#define TWL_DOORBELL_CONTROLLER_ERROR	   0x200000
+#define TWL_DOORBELL_ATTENTION_INTERRUPT   0x40000
+#define TWL_PULL_MODE			   0x1
+
+/* Command packet opcodes used by the driver */
+#define TW_OP_INIT_CONNECTION 0x1
+#define TW_OP_GET_PARAM	      0x12
+#define TW_OP_SET_PARAM	      0x13
+#define TW_OP_EXECUTE_SCSI    0x10
+
+/* Asynchronous Event Notification (AEN) codes used by the driver */
+#define TW_AEN_QUEUE_EMPTY       0x0000
+#define TW_AEN_SOFT_RESET        0x0001
+#define TW_AEN_SYNC_TIME_WITH_HOST 0x031
+#define TW_AEN_SEVERITY_ERROR    0x1
+#define TW_AEN_SEVERITY_DEBUG    0x4
+#define TW_AEN_NOT_RETRIEVED 0x1
+
+/* Command state defines */
+#define TW_S_INITIAL   0x1  /* Initial state */
+#define TW_S_STARTED   0x2  /* Id in use */
+#define TW_S_POSTED    0x4  /* Posted to the controller */
+#define TW_S_COMPLETED 0x8  /* Completed by isr */
+#define TW_S_FINISHED  0x10 /* I/O completely done */
+
+/* Compatibility defines */
+#define TW_9750_ARCH_ID 10
+#define TW_CURRENT_DRIVER_SRL 40
+#define TW_CURRENT_DRIVER_BUILD 0
+#define TW_CURRENT_DRIVER_BRANCH 0
+
+/* Phase defines */
+#define TW_PHASE_INITIAL 0
+#define TW_PHASE_SGLIST  2
+
+/* Misc defines */
+#define TW_SECTOR_SIZE                        512
+#define TW_MAX_UNITS			      32
+#define TW_INIT_MESSAGE_CREDITS		      0x100
+#define TW_INIT_COMMAND_PACKET_SIZE	      0x3
+#define TW_INIT_COMMAND_PACKET_SIZE_EXTENDED  0x6
+#define TW_EXTENDED_INIT_CONNECT	      0x2
+#define TW_BASE_FW_SRL			      24
+#define TW_BASE_FW_BRANCH		      0
+#define TW_BASE_FW_BUILD		      1
+#define TW_Q_LENGTH			      256
+#define TW_Q_START			      0
+#define TW_MAX_SLOT			      32
+#define TW_MAX_RESET_TRIES		      2
+#define TW_MAX_CMDS_PER_LUN		      254
+#define TW_MAX_AEN_DRAIN		      255
+#define TW_IN_RESET                           2
+#define TW_USING_MSI			      3
+#define TW_IN_ATTENTION_LOOP		      4
+#define TW_MAX_SECTORS                        256
+#define TW_MAX_CDB_LEN                        16
+#define TW_IOCTL_CHRDEV_TIMEOUT               60 /* 60 seconds */
+#define TW_IOCTL_CHRDEV_FREE                  -1
+#define TW_COMMAND_OFFSET                     128 /* 128 bytes */
+#define TW_VERSION_TABLE                      0x0402
+#define TW_TIMEKEEP_TABLE		      0x040A
+#define TW_INFORMATION_TABLE		      0x0403
+#define TW_PARAM_FWVER			      3
+#define TW_PARAM_FWVER_LENGTH		      16
+#define TW_PARAM_BIOSVER		      4
+#define TW_PARAM_BIOSVER_LENGTH		      16
+#define TW_PARAM_MODEL			      8
+#define TW_PARAM_MODEL_LENGTH		      16
+#define TW_PARAM_PHY_SUMMARY_TABLE	      1
+#define TW_PARAM_PHYCOUNT		      2
+#define TW_PARAM_PHYCOUNT_LENGTH	      1
+#define TW_IOCTL_FIRMWARE_PASS_THROUGH        0x108  // Used by smartmontools
+#define TW_ALLOCATION_LENGTH		      128
+#define TW_SENSE_DATA_LENGTH		      18
+#define TW_ERROR_LOGICAL_UNIT_NOT_SUPPORTED   0x10a
+#define TW_ERROR_INVALID_FIELD_IN_CDB	      0x10d
+#define TW_ERROR_UNIT_OFFLINE                 0x128
+#define TW_MESSAGE_SOURCE_CONTROLLER_ERROR    3
+#define TW_MESSAGE_SOURCE_CONTROLLER_EVENT    4
+#define TW_DRIVER 			      6
+#ifndef PCI_DEVICE_ID_3WARE_9750
+#define PCI_DEVICE_ID_3WARE_9750 0x1010
+#endif
+
+/* Bitmask macros to eliminate bitfields */
+
+/* opcode: 5, reserved: 3 */
+#define TW_OPRES_IN(x,y) ((x << 5) | (y & 0x1f))
+#define TW_OP_OUT(x) (x & 0x1f)
+
+/* opcode: 5, sgloffset: 3 */
+#define TW_OPSGL_IN(x,y) ((x << 5) | (y & 0x1f))
+#define TW_SGL_OUT(x) ((x >> 5) & 0x7)
+
+/* severity: 3, reserved: 5 */
+#define TW_SEV_OUT(x) (x & 0x7)
+
+/* not_mfa: 1, reserved: 7, status: 8, request_id: 16 */
+#define TW_RESID_OUT(x) ((x >> 16) & 0xffff)
+#define TW_NOTMFA_OUT(x) (x & 0x1)
+
+/* request_id: 12, lun: 4 */
+#define TW_REQ_LUN_IN(lun, request_id) (((lun << 12) & 0xf000) | (request_id & 0xfff))
+#define TW_LUN_OUT(lun) ((lun >> 12) & 0xf)
+
+/* Register access macros */
+#define TWL_STATUS_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + TWL_STATUS)
+#define TWL_HOBQPL_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + TWL_HOBQPL)
+#define TWL_HOBQPH_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + TWL_HOBQPH)
+#define TWL_HOBDB_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + TWL_HOBDB)
+#define TWL_HOBDBC_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + TWL_HOBDBC)
+#define TWL_HIMASK_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + TWL_HIMASK)
+#define TWL_HISTAT_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + TWL_HISTAT)
+#define TWL_HIBQPH_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + TWL_HIBQPH)
+#define TWL_HIBQPL_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + TWL_HIBQPL)
+#define TWL_HIBDB_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + TWL_HIBDB)
+#define TWL_SCRPD3_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + TWL_SCRPD3)
+#define TWL_MASK_INTERRUPTS(x) (writel(~0, TWL_HIMASK_REG_ADDR(tw_dev)))
+#define TWL_UNMASK_INTERRUPTS(x) (writel(~TWL_HISTATUS_VALID_INTERRUPT, TWL_HIMASK_REG_ADDR(tw_dev)))
+#define TWL_CLEAR_DB_INTERRUPT(x) (writel(~0, TWL_HOBDBC_REG_ADDR(tw_dev)))
+#define TWL_SOFT_RESET(x) (writel(TWL_ISSUE_SOFT_RESET, TWL_HIBDB_REG_ADDR(tw_dev)))
+
+/* Macros */
+#define TW_PRINTK(h,a,b,c) { \
+if (h) \
+printk(KERN_WARNING "3w-sas: scsi%d: ERROR: (0x%02X:0x%04X): %s.\n",h->host_no,a,b,c); \
+else \
+printk(KERN_WARNING "3w-sas: ERROR: (0x%02X:0x%04X): %s.\n",a,b,c); \
+}
+#define TW_MAX_LUNS 16
+#define TW_COMMAND_SIZE (sizeof(dma_addr_t) > 4 ? 6 : 4)
+#define TW_LIBERATOR_MAX_SGL_LENGTH (sizeof(dma_addr_t) > 4 ? 46 : 92)
+#define TW_LIBERATOR_MAX_SGL_LENGTH_OLD (sizeof(dma_addr_t) > 4 ? 47 : 94)
+#define TW_PADDING_LENGTH_LIBERATOR 136
+#define TW_PADDING_LENGTH_LIBERATOR_OLD 132
+#define TW_CPU_TO_SGL(x) (sizeof(dma_addr_t) > 4 ? cpu_to_le64(x) : cpu_to_le32(x))
+
+#pragma pack(1)
+
+/* SGL entry */
+typedef struct TAG_TW_SG_Entry_ISO {
+	dma_addr_t address;
+	dma_addr_t length;
+} TW_SG_Entry_ISO;
+
+/* Old Command Packet with ISO SGL */
+typedef struct TW_Command {
+	unsigned char opcode__sgloffset;
+	unsigned char size;
+	unsigned char request_id;
+	unsigned char unit__hostid;
+	/* Second DWORD */
+	unsigned char status;
+	unsigned char flags;
+	union {
+		unsigned short block_count;
+		unsigned short parameter_count;
+	} byte6_offset;
+	union {
+		struct {
+			u32 lba;
+			TW_SG_Entry_ISO sgl[TW_LIBERATOR_MAX_SGL_LENGTH_OLD];
+			unsigned char padding[TW_PADDING_LENGTH_LIBERATOR_OLD];
+		} io;
+		struct {
+			TW_SG_Entry_ISO sgl[TW_LIBERATOR_MAX_SGL_LENGTH_OLD];
+			u32 padding;
+			unsigned char padding2[TW_PADDING_LENGTH_LIBERATOR_OLD];
+		} param;
+	} byte8_offset;
+} TW_Command;
+
+/* New Command Packet with ISO SGL */
+typedef struct TAG_TW_Command_Apache {
+	unsigned char opcode__reserved;
+	unsigned char unit;
+	unsigned short request_id__lunl;
+	unsigned char status;
+	unsigned char sgl_offset;
+	unsigned short sgl_entries__lunh;
+	unsigned char cdb[16];
+	TW_SG_Entry_ISO sg_list[TW_LIBERATOR_MAX_SGL_LENGTH];
+	unsigned char padding[TW_PADDING_LENGTH_LIBERATOR];
+} TW_Command_Apache;
+
+/* New command packet header */
+typedef struct TAG_TW_Command_Apache_Header {
+	unsigned char sense_data[TW_SENSE_DATA_LENGTH];
+	struct {
+		char reserved[4];
+		unsigned short error;
+		unsigned char padding;
+		unsigned char severity__reserved;
+	} status_block;
+	unsigned char err_specific_desc[98];
+	struct {
+		unsigned char size_header;
+		unsigned short request_id;
+		unsigned char size_sense;
+	} header_desc;
+} TW_Command_Apache_Header;
+
+/* This struct is a union of the 2 command packets */
+typedef struct TAG_TW_Command_Full {
+	TW_Command_Apache_Header header;
+	union {
+		TW_Command oldcommand;
+		TW_Command_Apache newcommand;
+	} command;
+} TW_Command_Full;
+
+/* Initconnection structure */
+typedef struct TAG_TW_Initconnect {
+	unsigned char opcode__reserved;
+	unsigned char size;
+	unsigned char request_id;
+	unsigned char res2;
+	unsigned char status;
+	unsigned char flags;
+	unsigned short message_credits;
+	u32 features;
+	unsigned short fw_srl;
+	unsigned short fw_arch_id;
+	unsigned short fw_branch;
+	unsigned short fw_build;
+	u32 result;
+} TW_Initconnect;
+
+/* Event info structure */
+typedef struct TAG_TW_Event
+{
+	unsigned int sequence_id;
+	unsigned int time_stamp_sec;
+	unsigned short aen_code;
+	unsigned char severity;
+	unsigned char retrieved;
+	unsigned char repeat_count;
+	unsigned char parameter_len;
+	unsigned char parameter_data[98];
+} TW_Event;
+
+typedef struct TAG_TW_Ioctl_Driver_Command {
+	unsigned int control_code;
+	unsigned int status;
+	unsigned int unique_id;
+	unsigned int sequence_id;
+	unsigned int os_specific;
+	unsigned int buffer_length;
+} TW_Ioctl_Driver_Command;
+
+typedef struct TAG_TW_Ioctl_Apache {
+	TW_Ioctl_Driver_Command driver_command;
+        char padding[488];
+	TW_Command_Full firmware_command;
+	char data_buffer[1];
+} TW_Ioctl_Buf_Apache;
+
+/* GetParam descriptor */
+typedef struct {
+	unsigned short	table_id;
+	unsigned short	parameter_id;
+	unsigned short	parameter_size_bytes;
+	unsigned short  actual_parameter_size_bytes;
+	unsigned char	data[1];
+} TW_Param_Apache;
+
+/* Compatibility information structure */
+typedef struct TAG_TW_Compatibility_Info
+{
+	char driver_version[32];
+	unsigned short working_srl;
+	unsigned short working_branch;
+	unsigned short working_build;
+	unsigned short driver_srl_high;
+	unsigned short driver_branch_high;
+	unsigned short driver_build_high;
+	unsigned short driver_srl_low;
+	unsigned short driver_branch_low;
+	unsigned short driver_build_low;
+	unsigned short fw_on_ctlr_srl;
+	unsigned short fw_on_ctlr_branch;
+	unsigned short fw_on_ctlr_build;
+} TW_Compatibility_Info;
+
+#pragma pack()
+
+typedef struct TAG_TW_Device_Extension {
+	void                     __iomem *base_addr;
+	unsigned long	       	*generic_buffer_virt[TW_Q_LENGTH];
+	dma_addr_t	       	generic_buffer_phys[TW_Q_LENGTH];
+	TW_Command_Full	       	*command_packet_virt[TW_Q_LENGTH];
+	dma_addr_t		command_packet_phys[TW_Q_LENGTH];
+	TW_Command_Apache_Header *sense_buffer_virt[TW_Q_LENGTH];
+	dma_addr_t		sense_buffer_phys[TW_Q_LENGTH];
+	struct pci_dev		*tw_pci_dev;
+	struct scsi_cmnd	*srb[TW_Q_LENGTH];
+	unsigned char		free_queue[TW_Q_LENGTH];
+	unsigned char		free_head;
+	unsigned char		free_tail;
+	int     		state[TW_Q_LENGTH];
+	unsigned int		posted_request_count;
+	unsigned int		max_posted_request_count;
+	unsigned int		max_sgl_entries;
+	unsigned int		sgl_entries;
+	unsigned int		num_resets;
+	unsigned int		sector_count;
+	unsigned int		max_sector_count;
+	unsigned int		aen_count;
+	struct Scsi_Host	*host;
+	long			flags;
+	TW_Event                *event_queue[TW_Q_LENGTH];
+	unsigned char           error_index;
+	unsigned int            error_sequence_id;
+	int			chrdev_request_id;
+	wait_queue_head_t	ioctl_wqueue;
+	struct mutex		ioctl_lock;
+	TW_Compatibility_Info	tw_compat_info;
+	char			online;
+} TW_Device_Extension;
+
+#endif /* _3W_SAS_H */
+
diff --git a/drivers/scsi/3w-xxxx.c b/drivers/scsi/3w-xxxx.c
index faa0fcfed71e..f65a1e92340c 100644
--- a/drivers/scsi/3w-xxxx.c
+++ b/drivers/scsi/3w-xxxx.c
@@ -8,7 +8,7 @@
 
    Copyright (C) 1999-2009 3ware Inc.
 
-   Kernel compatiblity By: 	Andre Hedrick <andre@suse.com>
+   Kernel compatibility By: 	Andre Hedrick <andre@suse.com>
    Non-Copyright (C) 2000	Andre Hedrick <andre@suse.com>
    
    Further tiny build fixes and trivial hoovering    Alan Cox
@@ -521,8 +521,12 @@ static ssize_t tw_show_stats(struct device *dev, struct device_attribute *attr,
 } /* End tw_show_stats() */
 
 /* This function will set a devices queue depth */
-static int tw_change_queue_depth(struct scsi_device *sdev, int queue_depth)
+static int tw_change_queue_depth(struct scsi_device *sdev, int queue_depth,
+				 int reason)
 {
+	if (reason != SCSI_QDEPTH_DEFAULT)
+		return -EOPNOTSUPP;
+
 	if (queue_depth > TW_Q_LENGTH-2)
 		queue_depth = TW_Q_LENGTH-2;
 	scsi_adjust_queue_depth(sdev, MSG_ORDERED_TAG, queue_depth);
diff --git a/drivers/scsi/53c700.c b/drivers/scsi/53c700.c
index f5a9addb7050..9f4a911a6d8c 100644
--- a/drivers/scsi/53c700.c
+++ b/drivers/scsi/53c700.c
@@ -175,7 +175,7 @@ STATIC void NCR_700_chip_reset(struct Scsi_Host *host);
 STATIC int NCR_700_slave_alloc(struct scsi_device *SDpnt);
 STATIC int NCR_700_slave_configure(struct scsi_device *SDpnt);
 STATIC void NCR_700_slave_destroy(struct scsi_device *SDpnt);
-static int NCR_700_change_queue_depth(struct scsi_device *SDpnt, int depth);
+static int NCR_700_change_queue_depth(struct scsi_device *SDpnt, int depth, int reason);
 static int NCR_700_change_queue_type(struct scsi_device *SDpnt, int depth);
 
 STATIC struct device_attribute *NCR_700_dev_attrs[];
@@ -1491,7 +1491,7 @@ NCR_700_intr(int irq, void *dev_id)
 	unsigned long flags;
 	int handled = 0;
 
-	/* Use the host lock to serialise acess to the 53c700
+	/* Use the host lock to serialise access to the 53c700
 	 * hardware.  Note: In future, we may need to take the queue
 	 * lock to enter the done routines.  When that happens, we
 	 * need to ensure that for this driver, the host lock and the
@@ -2082,8 +2082,11 @@ NCR_700_slave_destroy(struct scsi_device *SDp)
 }
 
 static int
-NCR_700_change_queue_depth(struct scsi_device *SDp, int depth)
+NCR_700_change_queue_depth(struct scsi_device *SDp, int depth, int reason)
 {
+	if (reason != SCSI_QDEPTH_DEFAULT)
+		return -EOPNOTSUPP;
+
 	if (depth > NCR_700_MAX_TAGS)
 		depth = NCR_700_MAX_TAGS;
 
diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig
index e11cca4c784c..9191d1ea6451 100644
--- a/drivers/scsi/Kconfig
+++ b/drivers/scsi/Kconfig
@@ -388,6 +388,16 @@ config BLK_DEV_3W_XXXX_RAID
 	  Please read the comments at the top of
 	  <file:drivers/scsi/3w-xxxx.c>.
 
+config SCSI_HPSA
+	tristate "HP Smart Array SCSI driver"
+	depends on PCI && SCSI
+	help
+	  This driver supports HP Smart Array Controllers (circa 2009).
+	  It is a SCSI alternative to the cciss driver, which is a block
+	  driver.  Anyone wishing to use HP Smart Array controllers who
+	  would prefer the devices be presented to linux as SCSI devices,
+	  rather than as generic block devices should say Y here.
+
 config SCSI_3W_9XXX
 	tristate "3ware 9xxx SATA-RAID support"
 	depends on PCI && SCSI
@@ -399,6 +409,17 @@ config SCSI_3W_9XXX
 	  Please read the comments at the top of
 	  <file:drivers/scsi/3w-9xxx.c>.
 
+config SCSI_3W_SAS
+	tristate "3ware 97xx SAS/SATA-RAID support"
+	depends on PCI && SCSI
+	help
+	  This driver supports the LSI 3ware 9750 6Gb/s SAS/SATA-RAID cards.
+
+	  <http://www.lsi.com>
+
+	  Please read the comments at the top of
+	  <file:drivers/scsi/3w-sas.c>.
+
 config SCSI_7000FASST
 	tristate "7000FASST SCSI support"
 	depends on ISA && SCSI && ISA_DMA_API
@@ -621,6 +642,14 @@ config SCSI_FLASHPOINT
 	  substantial, so users of MultiMaster Host Adapters may not
 	  wish to include it.
 
+config VMWARE_PVSCSI
+	tristate "VMware PVSCSI driver support"
+	depends on PCI && SCSI && X86
+	help
+	  This driver supports VMware's para virtualized SCSI HBA.
+	  To compile this driver as a module, choose M here: the
+	  module will be called vmw_pvscsi.
+
 config LIBFC
 	tristate "LibFC module"
 	select SCSI_FC_ATTRS
@@ -644,7 +673,7 @@ config FCOE
 config FCOE_FNIC
 	tristate "Cisco FNIC Driver"
 	depends on PCI && X86
-	select LIBFC
+	select LIBFCOE
 	help
 	  This is support for the Cisco PCI-Express FCoE HBA.
 
@@ -1818,6 +1847,14 @@ config SCSI_PMCRAID
 	---help---
 	  This driver supports the PMC SIERRA MaxRAID adapters.
 
+config SCSI_PM8001
+	tristate "PMC-Sierra SPC 8001 SAS/SATA Based Host Adapter driver"
+	depends on PCI && SCSI
+	select SCSI_SAS_LIBSAS
+	help
+	  This driver supports PMC-Sierra PCIE SAS/SATA 8x6G SPC 8001 chip
+	  based host adapters.
+
 config SCSI_SRP
 	tristate "SCSI RDMA Protocol helper library"
 	depends on SCSI && PCI
diff --git a/drivers/scsi/Makefile b/drivers/scsi/Makefile
index 3ad61db5e3fa..92a8c500b23d 100644
--- a/drivers/scsi/Makefile
+++ b/drivers/scsi/Makefile
@@ -70,6 +70,7 @@ obj-$(CONFIG_SCSI_AIC79XX)	+= aic7xxx/
 obj-$(CONFIG_SCSI_AACRAID)	+= aacraid/
 obj-$(CONFIG_SCSI_AIC7XXX_OLD)	+= aic7xxx_old.o
 obj-$(CONFIG_SCSI_AIC94XX)	+= aic94xx/
+obj-$(CONFIG_SCSI_PM8001)	+= pm8001/
 obj-$(CONFIG_SCSI_IPS)		+= ips.o
 obj-$(CONFIG_SCSI_FD_MCS)	+= fd_mcs.o
 obj-$(CONFIG_SCSI_FUTURE_DOMAIN)+= fdomain.o
@@ -90,6 +91,7 @@ obj-$(CONFIG_SCSI_BFA_FC)	+= bfa/
 obj-$(CONFIG_SCSI_PAS16)	+= pas16.o
 obj-$(CONFIG_SCSI_T128)		+= t128.o
 obj-$(CONFIG_SCSI_DMX3191D)	+= dmx3191d.o
+obj-$(CONFIG_SCSI_HPSA)		+= hpsa.o
 obj-$(CONFIG_SCSI_DTC3280)	+= dtc.o
 obj-$(CONFIG_SCSI_SYM53C8XX_2)	+= sym53c8xx_2/
 obj-$(CONFIG_SCSI_ZALON)	+= zalon7xx.o
@@ -113,6 +115,7 @@ obj-$(CONFIG_SCSI_MESH)		+= mesh.o
 obj-$(CONFIG_SCSI_MAC53C94)	+= mac53c94.o
 obj-$(CONFIG_BLK_DEV_3W_XXXX_RAID) += 3w-xxxx.o
 obj-$(CONFIG_SCSI_3W_9XXX)	+= 3w-9xxx.o
+obj-$(CONFIG_SCSI_3W_SAS)	+= 3w-sas.o
 obj-$(CONFIG_SCSI_PPA)		+= ppa.o
 obj-$(CONFIG_SCSI_IMM)		+= imm.o
 obj-$(CONFIG_JAZZ_ESP)		+= esp_scsi.o	jazz_esp.o
@@ -133,6 +136,7 @@ obj-$(CONFIG_SCSI_CXGB3_ISCSI)	+= libiscsi.o libiscsi_tcp.o cxgb3i/
 obj-$(CONFIG_SCSI_BNX2_ISCSI)	+= libiscsi.o bnx2i/
 obj-$(CONFIG_BE2ISCSI)		+= libiscsi.o be2iscsi/
 obj-$(CONFIG_SCSI_PMCRAID)	+= pmcraid.o
+obj-$(CONFIG_VMWARE_PVSCSI)	+= vmw_pvscsi.o
 
 obj-$(CONFIG_ARM)		+= arm/
 
diff --git a/drivers/scsi/aacraid/aacraid.h b/drivers/scsi/aacraid/aacraid.h
index cdbdec9f4fb2..83986ed86556 100644
--- a/drivers/scsi/aacraid/aacraid.h
+++ b/drivers/scsi/aacraid/aacraid.h
@@ -526,10 +526,10 @@ struct aac_driver_ident
 
 /*
  *	The adapter interface specs all queues to be located in the same
- *	physically contigous block. The host structure that defines the
+ *	physically contiguous block. The host structure that defines the
  *	commuication queues will assume they are each a separate physically
- *	contigous memory region that will support them all being one big
- *	contigous block.
+ *	contiguous memory region that will support them all being one big
+ *	contiguous block.
  *	There is a command and response queue for each level and direction of
  *	commuication. These regions are accessed by both the host and adapter.
  */
diff --git a/drivers/scsi/aacraid/comminit.c b/drivers/scsi/aacraid/comminit.c
index d598eba630d0..666d5151d628 100644
--- a/drivers/scsi/aacraid/comminit.c
+++ b/drivers/scsi/aacraid/comminit.c
@@ -226,7 +226,7 @@ static int aac_comm_init(struct aac_dev * dev)
 	spin_lock_init(&dev->fib_lock);
 
 	/*
-	 *	Allocate the physically contigous space for the commuication
+	 *	Allocate the physically contiguous space for the commuication
 	 *	queue headers. 
 	 */
 
diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
index 9b97c3e016fe..e9373a2d14fa 100644
--- a/drivers/scsi/aacraid/linit.c
+++ b/drivers/scsi/aacraid/linit.c
@@ -472,8 +472,12 @@ static int aac_slave_configure(struct scsi_device *sdev)
  *	total capacity and the queue depth supported by the target device.
  */
 
-static int aac_change_queue_depth(struct scsi_device *sdev, int depth)
+static int aac_change_queue_depth(struct scsi_device *sdev, int depth,
+				  int reason)
 {
+	if (reason != SCSI_QDEPTH_DEFAULT)
+		return -EOPNOTSUPP;
+
 	if (sdev->tagged_supported && (sdev->type == TYPE_DISK) &&
 	    (sdev_channel(sdev) == CONTAINER_CHANNEL)) {
 		struct scsi_device * dev;
diff --git a/drivers/scsi/advansys.c b/drivers/scsi/advansys.c
index b756041f0b26..22626abdb630 100644
--- a/drivers/scsi/advansys.c
+++ b/drivers/scsi/advansys.c
@@ -7969,7 +7969,7 @@ static int advansys_reset(struct scsi_cmnd *scp)
 		ASC_DBG(1, "before AscInitAsc1000Driver()\n");
 		status = AscInitAsc1000Driver(asc_dvc);
 
-		/* Refer to ASC_IERR_* defintions for meaning of 'err_code'. */
+		/* Refer to ASC_IERR_* definitions for meaning of 'err_code'. */
 		if (asc_dvc->err_code) {
 			scmd_printk(KERN_INFO, scp, "SCSI bus reset error: "
 				    "0x%x\n", asc_dvc->err_code);
diff --git a/drivers/scsi/aic7xxx/aic79xx.seq b/drivers/scsi/aic7xxx/aic79xx.seq
index 58bc17591b54..2fb78e35a9e5 100644
--- a/drivers/scsi/aic7xxx/aic79xx.seq
+++ b/drivers/scsi/aic7xxx/aic79xx.seq
@@ -217,7 +217,7 @@ BEGIN_CRITICAL;
 scbdma_tohost_done:
 	test	CCSCBCTL, CCARREN jz fill_qoutfifo_dmadone;
 	/*
-	 * An SCB has been succesfully uploaded to the host.
+	 * An SCB has been successfully uploaded to the host.
 	 * If the SCB was uploaded for some reason other than
 	 * bad SCSI status (currently only for underruns), we
 	 * queue the SCB for normal completion.  Otherwise, we
@@ -1281,7 +1281,7 @@ END_CRITICAL;
  * Is it a disconnect message?  Set a flag in the SCB to remind us
  * and await the bus going free.  If this is an untagged transaction
  * store the SCB id for it in our untagged target table for lookup on
- * a reselction.
+ * a reselection.
  */
 mesgin_disconnect:
 	/*
diff --git a/drivers/scsi/aic7xxx/aic79xx_core.c b/drivers/scsi/aic7xxx/aic79xx_core.c
index 63b521d615f2..4d419c155ce9 100644
--- a/drivers/scsi/aic7xxx/aic79xx_core.c
+++ b/drivers/scsi/aic7xxx/aic79xx_core.c
@@ -2487,7 +2487,7 @@ ahd_handle_scsiint(struct ahd_softc *ahd, u_int intstat)
 		/*
 		 * Although the driver does not care about the
 		 * 'Selection in Progress' status bit, the busy
-		 * LED does.  SELINGO is only cleared by a sucessfull
+		 * LED does.  SELINGO is only cleared by a successfull
 		 * selection, so we must manually clear it to insure
 		 * the LED turns off just incase no future successful
 		 * selections occur (e.g. no devices on the bus).
diff --git a/drivers/scsi/aic7xxx/aic79xx_osm.c b/drivers/scsi/aic7xxx/aic79xx_osm.c
index 75b23317bd26..1222a7ac698a 100644
--- a/drivers/scsi/aic7xxx/aic79xx_osm.c
+++ b/drivers/scsi/aic7xxx/aic79xx_osm.c
@@ -2335,7 +2335,7 @@ ahd_linux_queue_abort_cmd(struct scsi_cmnd *cmd)
 			/*
 			 * The sequencer will never re-reference the
 			 * in-core SCB.  To make sure we are notified
-			 * during reslection, set the MK_MESSAGE flag in
+			 * during reselection, set the MK_MESSAGE flag in
 			 * the card's copy of the SCB.
 			 */
 			ahd_outb(ahd, SCB_CONTROL,
diff --git a/drivers/scsi/aic7xxx/aic7xxx.seq b/drivers/scsi/aic7xxx/aic7xxx.seq
index 15196390e28d..5a4cfc954a9f 100644
--- a/drivers/scsi/aic7xxx/aic7xxx.seq
+++ b/drivers/scsi/aic7xxx/aic7xxx.seq
@@ -1693,7 +1693,7 @@ if ((ahc->flags & AHC_INITIATORROLE) != 0) {
  * Is it a disconnect message?  Set a flag in the SCB to remind us
  * and await the bus going free.  If this is an untagged transaction
  * store the SCB id for it in our untagged target table for lookup on
- * a reselction.
+ * a reselection.
  */
 mesgin_disconnect:
 	/*
diff --git a/drivers/scsi/aic7xxx/aic7xxx_core.c b/drivers/scsi/aic7xxx/aic7xxx_core.c
index 8dfb59d58992..45aa728a76b2 100644
--- a/drivers/scsi/aic7xxx/aic7xxx_core.c
+++ b/drivers/scsi/aic7xxx/aic7xxx_core.c
@@ -1733,7 +1733,7 @@ ahc_handle_scsiint(struct ahc_softc *ahc, u_int intstat)
 		/*
 		 * Although the driver does not care about the
 		 * 'Selection in Progress' status bit, the busy
-		 * LED does.  SELINGO is only cleared by a sucessfull
+		 * LED does.  SELINGO is only cleared by a successfull
 		 * selection, so we must manually clear it to insure
 		 * the LED turns off just incase no future successful
 		 * selections occur (e.g. no devices on the bus).
diff --git a/drivers/scsi/aic7xxx/aic7xxx_osm.c b/drivers/scsi/aic7xxx/aic7xxx_osm.c
index fd2b9785ff4f..8cb05dc8e6a1 100644
--- a/drivers/scsi/aic7xxx/aic7xxx_osm.c
+++ b/drivers/scsi/aic7xxx/aic7xxx_osm.c
@@ -2290,7 +2290,7 @@ ahc_linux_queue_recovery_cmd(struct scsi_cmnd *cmd, scb_flag flag)
 		 * In the non-paging case, the sequencer will
 		 * never re-reference the in-core SCB.
 		 * To make sure we are notified during
-		 * reslection, set the MK_MESSAGE flag in
+		 * reselection, set the MK_MESSAGE flag in
 		 * the card's copy of the SCB.
 		 */
 		if ((ahc->flags & AHC_PAGESCBS) == 0) {
diff --git a/drivers/scsi/aic94xx/aic94xx_reg_def.h b/drivers/scsi/aic94xx/aic94xx_reg_def.h
index a43e8cdf4ee4..28aaf349c111 100644
--- a/drivers/scsi/aic94xx/aic94xx_reg_def.h
+++ b/drivers/scsi/aic94xx/aic94xx_reg_def.h
@@ -1,5 +1,5 @@
 /*
- * Aic94xx SAS/SATA driver hardware registers defintions.
+ * Aic94xx SAS/SATA driver hardware registers definitions.
  *
  * Copyright (C) 2004 Adaptec, Inc.  All rights reserved.
  * Copyright (C) 2004 David Chaw <david_chaw@adaptec.com>
diff --git a/drivers/scsi/arcmsr/arcmsr_hba.c b/drivers/scsi/arcmsr/arcmsr_hba.c
index 80aac01b5a6f..47d5d19f8c92 100644
--- a/drivers/scsi/arcmsr/arcmsr_hba.c
+++ b/drivers/scsi/arcmsr/arcmsr_hba.c
@@ -98,8 +98,11 @@ static void arcmsr_flush_hbb_cache(struct AdapterControlBlock *acb);
 static const char *arcmsr_info(struct Scsi_Host *);
 static irqreturn_t arcmsr_interrupt(struct AdapterControlBlock *acb);
 static int arcmsr_adjust_disk_queue_depth(struct scsi_device *sdev,
-								int queue_depth)
+					  int queue_depth, int reason)
 {
+	if (reason != SCSI_QDEPTH_DEFAULT)
+		return -EOPNOTSUPP;
+
 	if (queue_depth > ARCMSR_MAX_CMD_PERLUN)
 		queue_depth = ARCMSR_MAX_CMD_PERLUN;
 	scsi_adjust_queue_depth(sdev, MSG_ORDERED_TAG, queue_depth);
diff --git a/drivers/scsi/be2iscsi/be.h b/drivers/scsi/be2iscsi/be.h
index b36020dcf012..a93a5040f087 100644
--- a/drivers/scsi/be2iscsi/be.h
+++ b/drivers/scsi/be2iscsi/be.h
@@ -20,8 +20,10 @@
 
 #include <linux/pci.h>
 #include <linux/if_vlan.h>
-
-#define FW_VER_LEN 32
+#include <linux/blk-iopoll.h>
+#define FW_VER_LEN	32
+#define MCC_Q_LEN	128
+#define MCC_CQ_LEN	256
 
 struct be_dma_mem {
 	void *va;
@@ -74,18 +76,14 @@ static inline void queue_tail_inc(struct be_queue_info *q)
 
 struct be_eq_obj {
 	struct be_queue_info q;
-	char desc[32];
-
-	/* Adaptive interrupt coalescing (AIC) info */
-	bool enable_aic;
-	u16 min_eqd;		/* in usecs */
-	u16 max_eqd;		/* in usecs */
-	u16 cur_eqd;		/* in usecs */
+	struct beiscsi_hba *phba;
+	struct be_queue_info *cq;
+	struct blk_iopoll	iopoll;
 };
 
 struct be_mcc_obj {
-	struct be_queue_info *q;
-	struct be_queue_info *cq;
+	struct be_queue_info q;
+	struct be_queue_info cq;
 };
 
 struct be_ctrl_info {
@@ -176,8 +174,4 @@ static inline void swap_dws(void *wrb, int len)
 	} while (len);
 #endif /* __BIG_ENDIAN */
 }
-
-extern void beiscsi_cq_notify(struct be_ctrl_info *ctrl, u16 qid, bool arm,
-			      u16 num_popped);
-
 #endif /* BEISCSI_H */
diff --git a/drivers/scsi/be2iscsi/be_cmds.c b/drivers/scsi/be2iscsi/be_cmds.c
index 08007b6e42df..f008708f1b08 100644
--- a/drivers/scsi/be2iscsi/be_cmds.c
+++ b/drivers/scsi/be2iscsi/be_cmds.c
@@ -19,6 +19,16 @@
 #include "be_mgmt.h"
 #include "be_main.h"
 
+static void be_mcc_notify(struct beiscsi_hba *phba)
+{
+	struct be_queue_info *mccq = &phba->ctrl.mcc_obj.q;
+	u32 val = 0;
+
+	val |= mccq->id & DB_MCCQ_RING_ID_MASK;
+	val |= 1 << DB_MCCQ_NUM_POSTED_SHIFT;
+	iowrite32(val, phba->db_va + DB_MCCQ_OFFSET);
+}
+
 static inline bool be_mcc_compl_is_new(struct be_mcc_compl *compl)
 {
 	if (compl->flags != 0) {
@@ -54,13 +64,56 @@ static int be_mcc_compl_process(struct be_ctrl_info *ctrl,
 	return 0;
 }
 
+
 static inline bool is_link_state_evt(u32 trailer)
 {
 	return (((trailer >> ASYNC_TRAILER_EVENT_CODE_SHIFT) &
-		ASYNC_TRAILER_EVENT_CODE_MASK) == ASYNC_EVENT_CODE_LINK_STATE);
+		  ASYNC_TRAILER_EVENT_CODE_MASK) ==
+		  ASYNC_EVENT_CODE_LINK_STATE);
+}
+
+static struct be_mcc_compl *be_mcc_compl_get(struct beiscsi_hba *phba)
+{
+	struct be_queue_info *mcc_cq = &phba->ctrl.mcc_obj.cq;
+	struct be_mcc_compl *compl = queue_tail_node(mcc_cq);
+
+	if (be_mcc_compl_is_new(compl)) {
+		queue_tail_inc(mcc_cq);
+		return compl;
+	}
+	return NULL;
+}
+
+static void be2iscsi_fail_session(struct iscsi_cls_session *cls_session)
+{
+	iscsi_session_failure(cls_session->dd_data, ISCSI_ERR_CONN_FAILED);
+}
+
+static void beiscsi_async_link_state_process(struct beiscsi_hba *phba,
+		struct be_async_event_link_state *evt)
+{
+	switch (evt->port_link_status) {
+	case ASYNC_EVENT_LINK_DOWN:
+		SE_DEBUG(DBG_LVL_1, "Link Down on Physical Port %d \n",
+						evt->physical_port);
+		phba->state |= BE_ADAPTER_LINK_DOWN;
+		break;
+	case ASYNC_EVENT_LINK_UP:
+		phba->state = BE_ADAPTER_UP;
+		SE_DEBUG(DBG_LVL_1, "Link UP on Physical Port %d \n",
+						evt->physical_port);
+		iscsi_host_for_each_session(phba->shost,
+					    be2iscsi_fail_session);
+		break;
+	default:
+		SE_DEBUG(DBG_LVL_1, "Unexpected Async Notification %d on"
+				    "Physical Port %d \n",
+				     evt->port_link_status,
+				     evt->physical_port);
+	}
 }
 
-void beiscsi_cq_notify(struct be_ctrl_info *ctrl, u16 qid, bool arm,
+static void beiscsi_cq_notify(struct beiscsi_hba *phba, u16 qid, bool arm,
 		       u16 num_popped)
 {
 	u32 val = 0;
@@ -68,7 +121,70 @@ void beiscsi_cq_notify(struct be_ctrl_info *ctrl, u16 qid, bool arm,
 	if (arm)
 		val |= 1 << DB_CQ_REARM_SHIFT;
 	val |= num_popped << DB_CQ_NUM_POPPED_SHIFT;
-	iowrite32(val, ctrl->db + DB_CQ_OFFSET);
+	iowrite32(val, phba->db_va + DB_CQ_OFFSET);
+}
+
+
+int beiscsi_process_mcc(struct beiscsi_hba *phba)
+{
+	struct be_mcc_compl *compl;
+	int num = 0, status = 0;
+	struct be_ctrl_info *ctrl = &phba->ctrl;
+
+	spin_lock_bh(&phba->ctrl.mcc_cq_lock);
+	while ((compl = be_mcc_compl_get(phba))) {
+		if (compl->flags & CQE_FLAGS_ASYNC_MASK) {
+			/* Interpret flags as an async trailer */
+			if (is_link_state_evt(compl->flags))
+				/* Interpret compl as a async link evt */
+				beiscsi_async_link_state_process(phba,
+				   (struct be_async_event_link_state *) compl);
+			else
+				SE_DEBUG(DBG_LVL_1,
+					 " Unsupported Async Event, flags"
+					 " = 0x%08x \n", compl->flags);
+
+		} else if (compl->flags & CQE_FLAGS_COMPLETED_MASK) {
+				status = be_mcc_compl_process(ctrl, compl);
+				atomic_dec(&phba->ctrl.mcc_obj.q.used);
+		}
+		be_mcc_compl_use(compl);
+		num++;
+	}
+
+	if (num)
+		beiscsi_cq_notify(phba, phba->ctrl.mcc_obj.cq.id, true, num);
+
+	spin_unlock_bh(&phba->ctrl.mcc_cq_lock);
+	return status;
+}
+
+/* Wait till no more pending mcc requests are present */
+static int be_mcc_wait_compl(struct beiscsi_hba *phba)
+{
+#define mcc_timeout		120000 /* 5s timeout */
+	int i, status;
+	for (i = 0; i < mcc_timeout; i++) {
+		status = beiscsi_process_mcc(phba);
+		if (status)
+			return status;
+
+		if (atomic_read(&phba->ctrl.mcc_obj.q.used) == 0)
+			break;
+		udelay(100);
+	}
+	if (i == mcc_timeout) {
+		dev_err(&phba->pcidev->dev, "mccq poll timed out\n");
+		return -1;
+	}
+	return 0;
+}
+
+/* Notify MCC requests and wait for completion */
+int be_mcc_notify_wait(struct beiscsi_hba *phba)
+{
+	be_mcc_notify(phba);
+	return be_mcc_wait_compl(phba);
 }
 
 static int be_mbox_db_ready_wait(struct be_ctrl_info *ctrl)
@@ -142,6 +258,52 @@ int be_mbox_notify(struct be_ctrl_info *ctrl)
 	return 0;
 }
 
+/*
+ * Insert the mailbox address into the doorbell in two steps
+ * Polls on the mbox doorbell till a command completion (or a timeout) occurs
+ */
+static int be_mbox_notify_wait(struct beiscsi_hba *phba)
+{
+	int status;
+	u32 val = 0;
+	void __iomem *db = phba->ctrl.db + MPU_MAILBOX_DB_OFFSET;
+	struct be_dma_mem *mbox_mem = &phba->ctrl.mbox_mem;
+	struct be_mcc_mailbox *mbox = mbox_mem->va;
+	struct be_mcc_compl *compl = &mbox->compl;
+	struct be_ctrl_info *ctrl = &phba->ctrl;
+
+	val |= MPU_MAILBOX_DB_HI_MASK;
+	/* at bits 2 - 31 place mbox dma addr msb bits 34 - 63 */
+	val |= (upper_32_bits(mbox_mem->dma) >> 2) << 2;
+	iowrite32(val, db);
+
+	/* wait for ready to be set */
+	status = be_mbox_db_ready_wait(ctrl);
+	if (status != 0)
+		return status;
+
+	val = 0;
+	/* at bits 2 - 31 place mbox dma addr lsb bits 4 - 33 */
+	val |= (u32)(mbox_mem->dma >> 4) << 2;
+	iowrite32(val, db);
+
+	status = be_mbox_db_ready_wait(ctrl);
+	if (status != 0)
+		return status;
+
+	/* A cq entry has been made now */
+	if (be_mcc_compl_is_new(compl)) {
+		status = be_mcc_compl_process(ctrl, &mbox->compl);
+		be_mcc_compl_use(compl);
+		if (status)
+			return status;
+	} else {
+		dev_err(&phba->pcidev->dev, "invalid mailbox completion\n");
+		return -1;
+	}
+	return 0;
+}
+
 void be_wrb_hdr_prepare(struct be_mcc_wrb *wrb, int payload_len,
 				bool embedded, u8 sge_cnt)
 {
@@ -203,6 +365,20 @@ struct be_mcc_wrb *wrb_from_mbox(struct be_dma_mem *mbox_mem)
 	return &((struct be_mcc_mailbox *)(mbox_mem->va))->wrb;
 }
 
+struct be_mcc_wrb *wrb_from_mccq(struct beiscsi_hba *phba)
+{
+	struct be_queue_info *mccq = &phba->ctrl.mcc_obj.q;
+	struct be_mcc_wrb *wrb;
+
+	BUG_ON(atomic_read(&mccq->used) >= mccq->len);
+	wrb = queue_head_node(mccq);
+	queue_head_inc(mccq);
+	atomic_inc(&mccq->used);
+	memset(wrb, 0, sizeof(*wrb));
+	return wrb;
+}
+
+
 int beiscsi_cmd_eq_create(struct be_ctrl_info *ctrl,
 			  struct be_queue_info *eq, int eq_delay)
 {
@@ -212,6 +388,7 @@ int beiscsi_cmd_eq_create(struct be_ctrl_info *ctrl,
 	struct be_dma_mem *q_mem = &eq->dma_mem;
 	int status;
 
+	SE_DEBUG(DBG_LVL_8, "In beiscsi_cmd_eq_create\n");
 	spin_lock(&ctrl->mbox_lock);
 	memset(wrb, 0, sizeof(*wrb));
 
@@ -249,6 +426,7 @@ int be_cmd_fw_initialize(struct be_ctrl_info *ctrl)
 	int status;
 	u8 *endian_check;
 
+	SE_DEBUG(DBG_LVL_8, "In be_cmd_fw_initialize\n");
 	spin_lock(&ctrl->mbox_lock);
 	memset(wrb, 0, sizeof(*wrb));
 
@@ -282,6 +460,7 @@ int beiscsi_cmd_cq_create(struct be_ctrl_info *ctrl,
 	void *ctxt = &req->context;
 	int status;
 
+	SE_DEBUG(DBG_LVL_8, "In beiscsi_cmd_cq_create \n");
 	spin_lock(&ctrl->mbox_lock);
 	memset(wrb, 0, sizeof(*wrb));
 
@@ -289,7 +468,6 @@ int beiscsi_cmd_cq_create(struct be_ctrl_info *ctrl,
 
 	be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
 			OPCODE_COMMON_CQ_CREATE, sizeof(*req));
-
 	if (!q_mem->va)
 		SE_DEBUG(DBG_LVL_1, "uninitialized q_mem->va\n");
 
@@ -329,6 +507,53 @@ static u32 be_encoded_q_len(int q_len)
 		len_encoded = 0;
 	return len_encoded;
 }
+
+int beiscsi_cmd_mccq_create(struct beiscsi_hba *phba,
+			struct be_queue_info *mccq,
+			struct be_queue_info *cq)
+{
+	struct be_mcc_wrb *wrb;
+	struct be_cmd_req_mcc_create *req;
+	struct be_dma_mem *q_mem = &mccq->dma_mem;
+	struct be_ctrl_info *ctrl;
+	void *ctxt;
+	int status;
+
+	spin_lock(&phba->ctrl.mbox_lock);
+	ctrl = &phba->ctrl;
+	wrb = wrb_from_mbox(&ctrl->mbox_mem);
+	req = embedded_payload(wrb);
+	ctxt = &req->context;
+
+	be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
+
+	be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
+			OPCODE_COMMON_MCC_CREATE, sizeof(*req));
+
+	req->num_pages = PAGES_4K_SPANNED(q_mem->va, q_mem->size);
+
+	AMAP_SET_BITS(struct amap_mcc_context, fid, ctxt,
+		      PCI_FUNC(phba->pcidev->devfn));
+	AMAP_SET_BITS(struct amap_mcc_context, valid, ctxt, 1);
+	AMAP_SET_BITS(struct amap_mcc_context, ring_size, ctxt,
+		be_encoded_q_len(mccq->len));
+	AMAP_SET_BITS(struct amap_mcc_context, cq_id, ctxt, cq->id);
+
+	be_dws_cpu_to_le(ctxt, sizeof(req->context));
+
+	be_cmd_page_addrs_prepare(req->pages, ARRAY_SIZE(req->pages), q_mem);
+
+	status = be_mbox_notify_wait(phba);
+	if (!status) {
+		struct be_cmd_resp_mcc_create *resp = embedded_payload(wrb);
+		mccq->id = le16_to_cpu(resp->id);
+		mccq->created = true;
+	}
+	spin_unlock(&phba->ctrl.mbox_lock);
+
+	return status;
+}
+
 int beiscsi_cmd_q_destroy(struct be_ctrl_info *ctrl, struct be_queue_info *q,
 			  int queue_type)
 {
@@ -337,6 +562,7 @@ int beiscsi_cmd_q_destroy(struct be_ctrl_info *ctrl, struct be_queue_info *q,
 	u8 subsys = 0, opcode = 0;
 	int status;
 
+	SE_DEBUG(DBG_LVL_8, "In beiscsi_cmd_q_destroy \n");
 	spin_lock(&ctrl->mbox_lock);
 	memset(wrb, 0, sizeof(*wrb));
 	be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
@@ -350,6 +576,10 @@ int beiscsi_cmd_q_destroy(struct be_ctrl_info *ctrl, struct be_queue_info *q,
 		subsys = CMD_SUBSYSTEM_COMMON;
 		opcode = OPCODE_COMMON_CQ_DESTROY;
 		break;
+	case QTYPE_MCCQ:
+		subsys = CMD_SUBSYSTEM_COMMON;
+		opcode = OPCODE_COMMON_MCC_DESTROY;
+		break;
 	case QTYPE_WRBQ:
 		subsys = CMD_SUBSYSTEM_ISCSI;
 		opcode = OPCODE_COMMON_ISCSI_WRBQ_DESTROY;
@@ -377,30 +607,6 @@ int beiscsi_cmd_q_destroy(struct be_ctrl_info *ctrl, struct be_queue_info *q,
 	return status;
 }
 
-int be_cmd_get_mac_addr(struct be_ctrl_info *ctrl, u8 *mac_addr)
-{
-	struct be_mcc_wrb *wrb = wrb_from_mbox(&ctrl->mbox_mem);
-	struct be_cmd_req_get_mac_addr *req = embedded_payload(wrb);
-	int status;
-
-	spin_lock(&ctrl->mbox_lock);
-	memset(wrb, 0, sizeof(*wrb));
-	be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
-	be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_ISCSI,
-			   OPCODE_COMMON_ISCSI_NTWK_GET_NIC_CONFIG,
-			   sizeof(*req));
-
-	status = be_mbox_notify(ctrl);
-	if (!status) {
-		struct be_cmd_resp_get_mac_addr *resp = embedded_payload(wrb);
-
-		memcpy(mac_addr, resp->mac_address, ETH_ALEN);
-	}
-
-	spin_unlock(&ctrl->mbox_lock);
-	return status;
-}
-
 int be_cmd_create_default_pdu_queue(struct be_ctrl_info *ctrl,
 				    struct be_queue_info *cq,
 				    struct be_queue_info *dq, int length,
@@ -412,6 +618,7 @@ int be_cmd_create_default_pdu_queue(struct be_ctrl_info *ctrl,
 	void *ctxt = &req->context;
 	int status;
 
+	SE_DEBUG(DBG_LVL_8, "In be_cmd_create_default_pdu_queue\n");
 	spin_lock(&ctrl->mbox_lock);
 	memset(wrb, 0, sizeof(*wrb));
 
@@ -468,8 +675,10 @@ int be_cmd_wrbq_create(struct be_ctrl_info *ctrl, struct be_dma_mem *q_mem,
 	be_cmd_page_addrs_prepare(req->pages, ARRAY_SIZE(req->pages), q_mem);
 
 	status = be_mbox_notify(ctrl);
-	if (!status)
+	if (!status) {
 		wrbq->id = le16_to_cpu(resp->cid);
+		wrbq->created = true;
+	}
 	spin_unlock(&ctrl->mbox_lock);
 	return status;
 }
diff --git a/drivers/scsi/be2iscsi/be_cmds.h b/drivers/scsi/be2iscsi/be_cmds.h
index c20d686cbb43..5de8acb924cb 100644
--- a/drivers/scsi/be2iscsi/be_cmds.h
+++ b/drivers/scsi/be2iscsi/be_cmds.h
@@ -47,6 +47,8 @@ struct be_mcc_wrb {
 
 #define CQE_FLAGS_VALID_MASK (1 << 31)
 #define CQE_FLAGS_ASYNC_MASK (1 << 30)
+#define CQE_FLAGS_COMPLETED_MASK 	(1 << 28)
+#define CQE_FLAGS_CONSUMED_MASK 	(1 << 27)
 
 /* Completion Status */
 #define MCC_STATUS_SUCCESS 0x0
@@ -173,7 +175,7 @@ struct be_cmd_req_hdr {
 	u8 domain;		/* dword 0 */
 	u32 timeout;		/* dword 1 */
 	u32 request_length;	/* dword 2 */
-	u32 rsvd;		/* dword 3 */
+	u32 rsvd0;		/* dword 3 */
 };
 
 struct be_cmd_resp_hdr {
@@ -382,7 +384,6 @@ struct be_cmd_req_modify_eq_delay {
 
 #define ETH_ALEN	6
 
-
 struct be_cmd_req_get_mac_addr {
 	struct be_cmd_req_hdr hdr;
 	u32 nic_port_count;
@@ -417,14 +418,21 @@ int beiscsi_cmd_cq_create(struct be_ctrl_info *ctrl,
 
 int beiscsi_cmd_q_destroy(struct be_ctrl_info *ctrl, struct be_queue_info *q,
 			  int type);
+int beiscsi_cmd_mccq_create(struct beiscsi_hba *phba,
+			struct be_queue_info *mccq,
+			struct be_queue_info *cq);
+
 int be_poll_mcc(struct be_ctrl_info *ctrl);
-unsigned char mgmt_check_supported_fw(struct be_ctrl_info *ctrl);
-int be_cmd_get_mac_addr(struct be_ctrl_info *ctrl, u8 *mac_addr);
+unsigned char mgmt_check_supported_fw(struct be_ctrl_info *ctrl,
+				      struct beiscsi_hba *phba);
+int be_cmd_get_mac_addr(struct beiscsi_hba *phba, u8 *mac_addr);
 
 /*ISCSI Functuions */
 int be_cmd_fw_initialize(struct be_ctrl_info *ctrl);
 
 struct be_mcc_wrb *wrb_from_mbox(struct be_dma_mem *mbox_mem);
+struct be_mcc_wrb *wrb_from_mccq(struct beiscsi_hba *phba);
+int be_mcc_notify_wait(struct beiscsi_hba *phba);
 
 int be_mbox_notify(struct be_ctrl_info *ctrl);
 
@@ -531,6 +539,23 @@ struct amap_sol_cqe {
 	u8 valid;		/* dword 3 */
 } __packed;
 
+#define SOL_ICD_INDEX_MASK	0x0003FFC0
+struct amap_sol_cqe_ring {
+	u8 hw_sts[8];		/* dword 0 */
+	u8 i_sts[8];		/* dword 0 */
+	u8 i_resp[8];		/* dword 0 */
+	u8 i_flags[7];		/* dword 0 */
+	u8 s;			/* dword 0 */
+	u8 i_exp_cmd_sn[32];	/* dword 1 */
+	u8 code[6];		/* dword 2 */
+	u8 icd_index[12];	/* dword 2 */
+	u8 rsvd[6];		/* dword 2 */
+	u8 i_cmd_wnd[8];	/* dword 2 */
+	u8 i_res_cnt[31];	/* dword 3 */
+	u8 valid;		/* dword 3 */
+} __packed;
+
+
 
 /**
  * Post WRB Queue Doorbell Register used by the host Storage
@@ -664,8 +689,8 @@ struct be_fw_cfg {
 #define	OPCODE_COMMON_TCP_UPLOAD	56
 #define OPCODE_COMMON_ISCSI_ERROR_RECOVERY_INVALIDATE_COMMANDS 1
 /* --- CMD_ISCSI_INVALIDATE_CONNECTION_TYPE --- */
-#define CMD_ISCSI_CONNECTION_INVALIDATE 1
-#define CMD_ISCSI_CONNECTION_ISSUE_TCP_RST 2
+#define CMD_ISCSI_CONNECTION_INVALIDATE 0x8001
+#define CMD_ISCSI_CONNECTION_ISSUE_TCP_RST 0x8002
 #define OPCODE_ISCSI_INI_DRIVER_INVALIDATE_CONNECTION 42
 
 #define INI_WR_CMD			1	/* Initiator write command */
diff --git a/drivers/scsi/be2iscsi/be_iscsi.c b/drivers/scsi/be2iscsi/be_iscsi.c
index 2fd25442cfaf..d587b0362f18 100644
--- a/drivers/scsi/be2iscsi/be_iscsi.c
+++ b/drivers/scsi/be2iscsi/be_iscsi.c
@@ -67,11 +67,11 @@ struct iscsi_cls_session *beiscsi_session_create(struct iscsi_endpoint *ep,
 		cmds_max = beiscsi_ep->phba->params.wrbs_per_cxn;
 	}
 
-	 cls_session = iscsi_session_setup(&beiscsi_iscsi_transport,
-					   shost, cmds_max,
-					   sizeof(*beiscsi_sess),
-					   sizeof(*io_task),
-					   initial_cmdsn, ISCSI_MAX_TARGET);
+	cls_session = iscsi_session_setup(&beiscsi_iscsi_transport,
+					  shost, cmds_max,
+					  sizeof(*beiscsi_sess),
+					  sizeof(*io_task),
+					  initial_cmdsn, ISCSI_MAX_TARGET);
 	if (!cls_session)
 		return NULL;
 	sess = cls_session->dd_data;
@@ -297,7 +297,7 @@ int beiscsi_get_host_param(struct Scsi_Host *shost,
 
 	switch (param) {
 	case ISCSI_HOST_PARAM_HWADDRESS:
-		be_cmd_get_mac_addr(&phba->ctrl, phba->mac_address);
+		be_cmd_get_mac_addr(phba, phba->mac_address);
 		len = sysfs_format_mac(buf, phba->mac_address, ETH_ALEN);
 		break;
 	default:
@@ -377,16 +377,12 @@ int beiscsi_conn_start(struct iscsi_cls_conn *cls_conn)
 	struct beiscsi_conn *beiscsi_conn = conn->dd_data;
 	struct beiscsi_endpoint *beiscsi_ep;
 	struct beiscsi_offload_params params;
-	struct iscsi_session *session = conn->session;
-	struct Scsi_Host *shost = iscsi_session_to_shost(session->cls_session);
-	struct beiscsi_hba *phba = iscsi_host_priv(shost);
 
 	memset(&params, 0, sizeof(struct beiscsi_offload_params));
 	beiscsi_ep = beiscsi_conn->ep;
 	if (!beiscsi_ep)
 		SE_DEBUG(DBG_LVL_1, "In beiscsi_conn_start , no beiscsi_ep\n");
 
-	free_mgmt_sgl_handle(phba, beiscsi_conn->plogin_sgl_handle);
 	beiscsi_conn->login_in_progress = 0;
 	beiscsi_set_params_for_offld(beiscsi_conn, &params);
 	beiscsi_offload_connection(beiscsi_conn, &params);
@@ -498,6 +494,13 @@ beiscsi_ep_connect(struct Scsi_Host *shost, struct sockaddr *dst_addr,
 		SE_DEBUG(DBG_LVL_1, "shost is NULL \n");
 		return ERR_PTR(ret);
 	}
+
+	if (phba->state) {
+		ret = -EBUSY;
+		SE_DEBUG(DBG_LVL_1, "The Adapet state is Not UP \n");
+		return ERR_PTR(ret);
+	}
+
 	ep = iscsi_create_endpoint(sizeof(struct beiscsi_endpoint));
 	if (!ep) {
 		ret = -ENOMEM;
diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c
index 4f1aca346e38..1a557fa77888 100644
--- a/drivers/scsi/be2iscsi/be_main.c
+++ b/drivers/scsi/be2iscsi/be_main.c
@@ -39,7 +39,8 @@
 
 static unsigned int be_iopoll_budget = 10;
 static unsigned int be_max_phys_size = 64;
-static unsigned int enable_msix;
+static unsigned int enable_msix = 1;
+static unsigned int ring_mode;
 
 MODULE_DEVICE_TABLE(pci, beiscsi_pci_id_table);
 MODULE_DESCRIPTION(DRV_DESC " " BUILD_STR);
@@ -58,6 +59,17 @@ static int beiscsi_slave_configure(struct scsi_device *sdev)
 	return 0;
 }
 
+/*------------------- PCI Driver operations and data ----------------- */
+static DEFINE_PCI_DEVICE_TABLE(beiscsi_pci_id_table) = {
+	{ PCI_DEVICE(BE_VENDOR_ID, BE_DEVICE_ID1) },
+	{ PCI_DEVICE(BE_VENDOR_ID, OC_DEVICE_ID1) },
+	{ PCI_DEVICE(BE_VENDOR_ID, OC_DEVICE_ID2) },
+	{ PCI_DEVICE(BE_VENDOR_ID, OC_DEVICE_ID3) },
+	{ PCI_DEVICE(BE_VENDOR_ID, OC_DEVICE_ID4) },
+	{ 0 }
+};
+MODULE_DEVICE_TABLE(pci, beiscsi_pci_id_table);
+
 static struct scsi_host_template beiscsi_sht = {
 	.module = THIS_MODULE,
 	.name = "ServerEngines 10Gbe open-iscsi Initiator Driver",
@@ -76,16 +88,8 @@ static struct scsi_host_template beiscsi_sht = {
 	.cmd_per_lun = BEISCSI_CMD_PER_LUN,
 	.use_clustering = ENABLE_CLUSTERING,
 };
-static struct scsi_transport_template *beiscsi_scsi_transport;
 
-/*------------------- PCI Driver operations and data ----------------- */
-static DEFINE_PCI_DEVICE_TABLE(beiscsi_pci_id_table) = {
-	{ PCI_DEVICE(BE_VENDOR_ID, BE_DEVICE_ID1) },
-	{ PCI_DEVICE(BE_VENDOR_ID, OC_DEVICE_ID1) },
-	{ PCI_DEVICE(BE_VENDOR_ID, OC_DEVICE_ID2) },
-	{ 0 }
-};
-MODULE_DEVICE_TABLE(pci, beiscsi_pci_id_table);
+static struct scsi_transport_template *beiscsi_scsi_transport;
 
 static struct beiscsi_hba *beiscsi_hba_alloc(struct pci_dev *pcidev)
 {
@@ -104,7 +108,6 @@ static struct beiscsi_hba *beiscsi_hba_alloc(struct pci_dev *pcidev)
 	shost->max_cmd_len = BEISCSI_MAX_CMD_LEN;
 	shost->max_lun = BEISCSI_NUM_MAX_LUN;
 	shost->transportt = beiscsi_scsi_transport;
-
 	phba = iscsi_host_priv(shost);
 	memset(phba, 0, sizeof(*phba));
 	phba->shost = shost;
@@ -181,6 +184,7 @@ static int beiscsi_enable_pci(struct pci_dev *pcidev)
 		return ret;
 	}
 
+	pci_set_master(pcidev);
 	if (pci_set_consistent_dma_mask(pcidev, DMA_BIT_MASK(64))) {
 		ret = pci_set_consistent_dma_mask(pcidev, DMA_BIT_MASK(32));
 		if (ret) {
@@ -203,7 +207,6 @@ static int be_ctrl_init(struct beiscsi_hba *phba, struct pci_dev *pdev)
 	status = beiscsi_map_pci_bars(phba, pdev);
 	if (status)
 		return status;
-
 	mbox_mem_alloc->size = sizeof(struct be_mcc_mailbox) + 16;
 	mbox_mem_alloc->va = pci_alloc_consistent(pdev,
 						  mbox_mem_alloc->size,
@@ -219,6 +222,9 @@ static int be_ctrl_init(struct beiscsi_hba *phba, struct pci_dev *pdev)
 	mbox_mem_align->dma = PTR_ALIGN(mbox_mem_alloc->dma, 16);
 	memset(mbox_mem_align->va, 0, sizeof(struct be_mcc_mailbox));
 	spin_lock_init(&ctrl->mbox_lock);
+	spin_lock_init(&phba->ctrl.mcc_lock);
+	spin_lock_init(&phba->ctrl.mcc_cq_lock);
+
 	return status;
 }
 
@@ -268,6 +274,113 @@ static void hwi_ring_eq_db(struct beiscsi_hba *phba,
 }
 
 /**
+ * be_isr_mcc - The isr routine of the driver.
+ * @irq: Not used
+ * @dev_id: Pointer to host adapter structure
+ */
+static irqreturn_t be_isr_mcc(int irq, void *dev_id)
+{
+	struct beiscsi_hba *phba;
+	struct be_eq_entry *eqe = NULL;
+	struct be_queue_info *eq;
+	struct be_queue_info *mcc;
+	unsigned int num_eq_processed;
+	struct be_eq_obj *pbe_eq;
+	unsigned long flags;
+
+	pbe_eq = dev_id;
+	eq = &pbe_eq->q;
+	phba =  pbe_eq->phba;
+	mcc = &phba->ctrl.mcc_obj.cq;
+	eqe = queue_tail_node(eq);
+	if (!eqe)
+		SE_DEBUG(DBG_LVL_1, "eqe is NULL\n");
+
+	num_eq_processed = 0;
+
+	while (eqe->dw[offsetof(struct amap_eq_entry, valid) / 32]
+				& EQE_VALID_MASK) {
+		if (((eqe->dw[offsetof(struct amap_eq_entry,
+		     resource_id) / 32] &
+		     EQE_RESID_MASK) >> 16) == mcc->id) {
+			spin_lock_irqsave(&phba->isr_lock, flags);
+			phba->todo_mcc_cq = 1;
+			spin_unlock_irqrestore(&phba->isr_lock, flags);
+		}
+		AMAP_SET_BITS(struct amap_eq_entry, valid, eqe, 0);
+		queue_tail_inc(eq);
+		eqe = queue_tail_node(eq);
+		num_eq_processed++;
+	}
+	if (phba->todo_mcc_cq)
+		queue_work(phba->wq, &phba->work_cqs);
+	if (num_eq_processed)
+		hwi_ring_eq_db(phba, eq->id, 1,	num_eq_processed, 1, 1);
+
+	return IRQ_HANDLED;
+}
+
+/**
+ * be_isr_msix - The isr routine of the driver.
+ * @irq: Not used
+ * @dev_id: Pointer to host adapter structure
+ */
+static irqreturn_t be_isr_msix(int irq, void *dev_id)
+{
+	struct beiscsi_hba *phba;
+	struct be_eq_entry *eqe = NULL;
+	struct be_queue_info *eq;
+	struct be_queue_info *cq;
+	unsigned int num_eq_processed;
+	struct be_eq_obj *pbe_eq;
+	unsigned long flags;
+
+	pbe_eq = dev_id;
+	eq = &pbe_eq->q;
+	cq = pbe_eq->cq;
+	eqe = queue_tail_node(eq);
+	if (!eqe)
+		SE_DEBUG(DBG_LVL_1, "eqe is NULL\n");
+
+	phba = pbe_eq->phba;
+	num_eq_processed = 0;
+	if (blk_iopoll_enabled) {
+		while (eqe->dw[offsetof(struct amap_eq_entry, valid) / 32]
+					& EQE_VALID_MASK) {
+			if (!blk_iopoll_sched_prep(&pbe_eq->iopoll))
+				blk_iopoll_sched(&pbe_eq->iopoll);
+
+			AMAP_SET_BITS(struct amap_eq_entry, valid, eqe, 0);
+			queue_tail_inc(eq);
+			eqe = queue_tail_node(eq);
+			num_eq_processed++;
+		}
+		if (num_eq_processed)
+			hwi_ring_eq_db(phba, eq->id, 1,	num_eq_processed, 0, 1);
+
+		return IRQ_HANDLED;
+	} else {
+		while (eqe->dw[offsetof(struct amap_eq_entry, valid) / 32]
+						& EQE_VALID_MASK) {
+			spin_lock_irqsave(&phba->isr_lock, flags);
+			phba->todo_cq = 1;
+			spin_unlock_irqrestore(&phba->isr_lock, flags);
+			AMAP_SET_BITS(struct amap_eq_entry, valid, eqe, 0);
+			queue_tail_inc(eq);
+			eqe = queue_tail_node(eq);
+			num_eq_processed++;
+		}
+		if (phba->todo_cq)
+			queue_work(phba->wq, &phba->work_cqs);
+
+		if (num_eq_processed)
+			hwi_ring_eq_db(phba, eq->id, 1, num_eq_processed, 1, 1);
+
+		return IRQ_HANDLED;
+	}
+}
+
+/**
  * be_isr - The isr routine of the driver.
  * @irq: Not used
  * @dev_id: Pointer to host adapter structure
@@ -280,48 +393,70 @@ static irqreturn_t be_isr(int irq, void *dev_id)
 	struct be_eq_entry *eqe = NULL;
 	struct be_queue_info *eq;
 	struct be_queue_info *cq;
+	struct be_queue_info *mcc;
 	unsigned long flags, index;
-	unsigned int num_eq_processed;
+	unsigned int num_mcceq_processed, num_ioeq_processed;
 	struct be_ctrl_info *ctrl;
+	struct be_eq_obj *pbe_eq;
 	int isr;
 
 	phba = dev_id;
-	if (!enable_msix) {
-		ctrl = &phba->ctrl;;
-		isr = ioread32(ctrl->csr + CEV_ISR0_OFFSET +
-			       (PCI_FUNC(ctrl->pdev->devfn) * CEV_ISR_SIZE));
-		if (!isr)
-			return IRQ_NONE;
-	}
+	ctrl = &phba->ctrl;;
+	isr = ioread32(ctrl->csr + CEV_ISR0_OFFSET +
+		       (PCI_FUNC(ctrl->pdev->devfn) * CEV_ISR_SIZE));
+	if (!isr)
+		return IRQ_NONE;
 
 	phwi_ctrlr = phba->phwi_ctrlr;
 	phwi_context = phwi_ctrlr->phwi_ctxt;
-	eq = &phwi_context->be_eq.q;
-	cq = &phwi_context->be_cq;
+	pbe_eq = &phwi_context->be_eq[0];
+
+	eq = &phwi_context->be_eq[0].q;
+	mcc = &phba->ctrl.mcc_obj.cq;
 	index = 0;
 	eqe = queue_tail_node(eq);
 	if (!eqe)
 		SE_DEBUG(DBG_LVL_1, "eqe is NULL\n");
 
-	num_eq_processed = 0;
+	num_ioeq_processed = 0;
+	num_mcceq_processed = 0;
 	if (blk_iopoll_enabled) {
 		while (eqe->dw[offsetof(struct amap_eq_entry, valid) / 32]
 					& EQE_VALID_MASK) {
-			if (!blk_iopoll_sched_prep(&phba->iopoll))
-				blk_iopoll_sched(&phba->iopoll);
-
+			if (((eqe->dw[offsetof(struct amap_eq_entry,
+			     resource_id) / 32] &
+			     EQE_RESID_MASK) >> 16) == mcc->id) {
+				spin_lock_irqsave(&phba->isr_lock, flags);
+				phba->todo_mcc_cq = 1;
+				spin_unlock_irqrestore(&phba->isr_lock, flags);
+				num_mcceq_processed++;
+			} else {
+				if (!blk_iopoll_sched_prep(&pbe_eq->iopoll))
+					blk_iopoll_sched(&pbe_eq->iopoll);
+				num_ioeq_processed++;
+			}
 			AMAP_SET_BITS(struct amap_eq_entry, valid, eqe, 0);
 			queue_tail_inc(eq);
 			eqe = queue_tail_node(eq);
-			num_eq_processed++;
-			SE_DEBUG(DBG_LVL_8, "Valid EQE\n");
 		}
-		if (num_eq_processed) {
-			hwi_ring_eq_db(phba, eq->id, 0,	num_eq_processed, 0, 1);
+		if (num_ioeq_processed || num_mcceq_processed) {
+			if (phba->todo_mcc_cq)
+				queue_work(phba->wq, &phba->work_cqs);
+
+		if ((num_mcceq_processed) && (!num_ioeq_processed))
+				hwi_ring_eq_db(phba, eq->id, 0,
+					      (num_ioeq_processed +
+					       num_mcceq_processed) , 1, 1);
+			else
+				hwi_ring_eq_db(phba, eq->id, 0,
+					       (num_ioeq_processed +
+						num_mcceq_processed), 0, 1);
+
 			return IRQ_HANDLED;
 		} else
 			return IRQ_NONE;
 	} else {
+		cq = &phwi_context->be_cq[0];
 		while (eqe->dw[offsetof(struct amap_eq_entry, valid) / 32]
 						& EQE_VALID_MASK) {
 
@@ -339,13 +474,14 @@ static irqreturn_t be_isr(int irq, void *dev_id)
 			AMAP_SET_BITS(struct amap_eq_entry, valid, eqe, 0);
 			queue_tail_inc(eq);
 			eqe = queue_tail_node(eq);
-			num_eq_processed++;
+			num_ioeq_processed++;
 		}
 		if (phba->todo_cq || phba->todo_mcc_cq)
 			queue_work(phba->wq, &phba->work_cqs);
 
-		if (num_eq_processed) {
-			hwi_ring_eq_db(phba, eq->id, 0, num_eq_processed, 1, 1);
+		if (num_ioeq_processed) {
+			hwi_ring_eq_db(phba, eq->id, 0,
+				       num_ioeq_processed, 1, 1);
 			return IRQ_HANDLED;
 		} else
 			return IRQ_NONE;
@@ -355,13 +491,32 @@ static irqreturn_t be_isr(int irq, void *dev_id)
 static int beiscsi_init_irqs(struct beiscsi_hba *phba)
 {
 	struct pci_dev *pcidev = phba->pcidev;
-	int ret;
+	struct hwi_controller *phwi_ctrlr;
+	struct hwi_context_memory *phwi_context;
+	int ret, msix_vec, i = 0;
+	char desc[32];
 
-	ret = request_irq(pcidev->irq, be_isr, IRQF_SHARED, "beiscsi", phba);
-	if (ret) {
-		shost_printk(KERN_ERR, phba->shost, "beiscsi_init_irqs-"
-			     "Failed to register irq\\n");
-		return ret;
+	phwi_ctrlr = phba->phwi_ctrlr;
+	phwi_context = phwi_ctrlr->phwi_ctxt;
+
+	if (phba->msix_enabled) {
+		for (i = 0; i < phba->num_cpus; i++) {
+			sprintf(desc, "beiscsi_msix_%04x", i);
+			msix_vec = phba->msix_entries[i].vector;
+			ret = request_irq(msix_vec, be_isr_msix, 0, desc,
+					  &phwi_context->be_eq[i]);
+		}
+		msix_vec = phba->msix_entries[i].vector;
+		ret = request_irq(msix_vec, be_isr_mcc, 0, "beiscsi_msix_mcc",
+				  &phwi_context->be_eq[i]);
+	} else {
+		ret = request_irq(pcidev->irq, be_isr, IRQF_SHARED,
+				  "beiscsi", phba);
+		if (ret) {
+			shost_printk(KERN_ERR, phba->shost, "beiscsi_init_irqs-"
+				     "Failed to register irq\\n");
+			return ret;
+		}
 	}
 	return 0;
 }
@@ -378,15 +533,6 @@ static void hwi_ring_cq_db(struct beiscsi_hba *phba,
 	iowrite32(val, phba->db_va + DB_CQ_OFFSET);
 }
 
-/*
- * async pdus include
- * a. unsolicited NOP-In (target initiated NOP-In)
- * b. Async Messages
- * c. Reject PDU
- * d. Login response
- * These headers arrive unprocessed by the EP firmware and iSCSI layer
- * process them
- */
 static unsigned int
 beiscsi_process_async_pdu(struct beiscsi_conn *beiscsi_conn,
 			  struct beiscsi_hba *phba,
@@ -397,6 +543,9 @@ beiscsi_process_async_pdu(struct beiscsi_conn *beiscsi_conn,
 {
 	struct iscsi_conn *conn = beiscsi_conn->conn;
 	struct iscsi_session *session = conn->session;
+	struct iscsi_task *task;
+	struct beiscsi_io_task *io_task;
+	struct iscsi_hdr *login_hdr;
 
 	switch (ppdu->dw[offsetof(struct amap_pdu_base, opcode) / 32] &
 						PDUBASE_OPCODE_MASK) {
@@ -412,6 +561,10 @@ beiscsi_process_async_pdu(struct beiscsi_conn *beiscsi_conn,
 		SE_DEBUG(DBG_LVL_1, "In ISCSI_OP_REJECT\n");
 		break;
 	case ISCSI_OP_LOGIN_RSP:
+		task = conn->login_task;
+		io_task = task->dd_data;
+		login_hdr = (struct iscsi_hdr *)ppdu;
+		login_hdr->itt = io_task->libiscsi_itt;
 		break;
 	default:
 		shost_printk(KERN_WARNING, phba->shost,
@@ -440,7 +593,8 @@ static struct sgl_handle *alloc_io_sgl_handle(struct beiscsi_hba *phba)
 						io_sgl_alloc_index];
 		phba->io_sgl_hndl_base[phba->io_sgl_alloc_index] = NULL;
 		phba->io_sgl_hndl_avbl--;
-		if (phba->io_sgl_alloc_index == (phba->params.ios_per_ctrl - 1))
+		if (phba->io_sgl_alloc_index == (phba->params.
+						 ios_per_ctrl - 1))
 			phba->io_sgl_alloc_index = 0;
 		else
 			phba->io_sgl_alloc_index++;
@@ -490,9 +644,18 @@ struct wrb_handle *alloc_wrb_handle(struct beiscsi_hba *phba, unsigned int cid,
 
 	phwi_ctrlr = phba->phwi_ctrlr;
 	pwrb_context = &phwi_ctrlr->wrb_context[cid];
-	pwrb_handle = pwrb_context->pwrb_handle_base[index];
-	pwrb_handle->wrb_index = index;
-	pwrb_handle->nxt_wrb_index = index;
+	if (pwrb_context->wrb_handles_available) {
+		pwrb_handle = pwrb_context->pwrb_handle_base[
+					    pwrb_context->alloc_index];
+		pwrb_context->wrb_handles_available--;
+		pwrb_handle->nxt_wrb_index = pwrb_handle->wrb_index;
+		if (pwrb_context->alloc_index ==
+						(phba->params.wrbs_per_cxn - 1))
+			pwrb_context->alloc_index = 0;
+		else
+			pwrb_context->alloc_index++;
+	} else
+		pwrb_handle = NULL;
 	return pwrb_handle;
 }
 
@@ -508,11 +671,20 @@ static void
 free_wrb_handle(struct beiscsi_hba *phba, struct hwi_wrb_context *pwrb_context,
 		struct wrb_handle *pwrb_handle)
 {
+	if (!ring_mode)
+		pwrb_context->pwrb_handle_base[pwrb_context->free_index] =
+					       pwrb_handle;
+	pwrb_context->wrb_handles_available++;
+	if (pwrb_context->free_index == (phba->params.wrbs_per_cxn - 1))
+		pwrb_context->free_index = 0;
+	else
+		pwrb_context->free_index++;
+
 	SE_DEBUG(DBG_LVL_8,
-		 "FREE WRB: pwrb_handle=%p free_index=%d=0x%x"
+		 "FREE WRB: pwrb_handle=%p free_index=0x%x"
 		 "wrb_handles_available=%d \n",
 		 pwrb_handle, pwrb_context->free_index,
-		 pwrb_context->free_index, pwrb_context->wrb_handles_available);
+		 pwrb_context->wrb_handles_available);
 }
 
 static struct sgl_handle *alloc_mgmt_sgl_handle(struct beiscsi_hba *phba)
@@ -540,6 +712,8 @@ void
 free_mgmt_sgl_handle(struct beiscsi_hba *phba, struct sgl_handle *psgl_handle)
 {
 
+	SE_DEBUG(DBG_LVL_8, "In  free_mgmt_sgl_handle,eh_sgl_free_index=%d \n",
+			     phba->eh_sgl_free_index);
 	if (phba->eh_sgl_hndl_base[phba->eh_sgl_free_index]) {
 		/*
 		 * this can happen if clean_task is called on a task that
@@ -572,10 +746,10 @@ be_complete_io(struct beiscsi_conn *beiscsi_conn,
 	u32 resid = 0, exp_cmdsn, max_cmdsn;
 	u8 rsp, status, flags;
 
-	exp_cmdsn = be32_to_cpu(psol->
+	exp_cmdsn = (psol->
 			dw[offsetof(struct amap_sol_cqe, i_exp_cmd_sn) / 32]
 			& SOL_EXP_CMD_SN_MASK);
-	max_cmdsn = be32_to_cpu((psol->
+	max_cmdsn = ((psol->
 			dw[offsetof(struct amap_sol_cqe, i_exp_cmd_sn) / 32]
 			& SOL_EXP_CMD_SN_MASK) +
 			((psol->dw[offsetof(struct amap_sol_cqe, i_cmd_wnd)
@@ -610,9 +784,9 @@ be_complete_io(struct beiscsi_conn *beiscsi_conn,
 	}
 
 	if (status == SAM_STAT_CHECK_CONDITION) {
+		unsigned short *slen = (unsigned short *)sts_bhs->sense_info;
 		sense = sts_bhs->sense_info + sizeof(unsigned short);
-		sense_len =
-		    cpu_to_be16((unsigned short)(sts_bhs->sense_info[0]));
+		sense_len =  cpu_to_be16(*slen);
 		memcpy(task->sc->sense_buffer, sense,
 		       min_t(u16, sense_len, SCSI_SENSE_BUFFERSIZE));
 	}
@@ -620,8 +794,8 @@ be_complete_io(struct beiscsi_conn *beiscsi_conn,
 		if (psol->dw[offsetof(struct amap_sol_cqe, i_res_cnt) / 32]
 							& SOL_RES_CNT_MASK)
 			 conn->rxdata_octets += (psol->
-			      dw[offsetof(struct amap_sol_cqe, i_res_cnt) / 32]
-							& SOL_RES_CNT_MASK);
+			     dw[offsetof(struct amap_sol_cqe, i_res_cnt) / 32]
+			     & SOL_RES_CNT_MASK);
 	}
 unmap:
 	scsi_dma_unmap(io_task->scsi_cmnd);
@@ -633,6 +807,7 @@ be_complete_logout(struct beiscsi_conn *beiscsi_conn,
 		   struct iscsi_task *task, struct sol_cqe *psol)
 {
 	struct iscsi_logout_rsp *hdr;
+	struct beiscsi_io_task *io_task = task->dd_data;
 	struct iscsi_conn *conn = beiscsi_conn->conn;
 
 	hdr = (struct iscsi_logout_rsp *)task->hdr;
@@ -651,7 +826,7 @@ be_complete_logout(struct beiscsi_conn *beiscsi_conn,
 			((psol->dw[offsetof(struct amap_sol_cqe, i_cmd_wnd)
 					/ 32] & SOL_CMD_WND_MASK) >> 24) - 1);
 	hdr->hlength = 0;
-
+	hdr->itt = io_task->libiscsi_itt;
 	__iscsi_complete_pdu(conn, (struct iscsi_hdr *)hdr, NULL, 0);
 }
 
@@ -661,6 +836,7 @@ be_complete_tmf(struct beiscsi_conn *beiscsi_conn,
 {
 	struct iscsi_tm_rsp *hdr;
 	struct iscsi_conn *conn = beiscsi_conn->conn;
+	struct beiscsi_io_task *io_task = task->dd_data;
 
 	hdr = (struct iscsi_tm_rsp *)task->hdr;
 	hdr->flags = ((psol->dw[offsetof(struct amap_sol_cqe, i_flags) / 32]
@@ -668,11 +844,12 @@ be_complete_tmf(struct beiscsi_conn *beiscsi_conn,
 	hdr->response = (psol->dw[offsetof(struct amap_sol_cqe, i_resp) /
 					32] & SOL_RESP_MASK);
 	hdr->exp_cmdsn = cpu_to_be32(psol->dw[offsetof(struct amap_sol_cqe,
-				     i_exp_cmd_sn) / 32] & SOL_EXP_CMD_SN_MASK);
+				    i_exp_cmd_sn) / 32] & SOL_EXP_CMD_SN_MASK);
 	hdr->max_cmdsn = be32_to_cpu((psol->dw[offsetof(struct amap_sol_cqe,
 			i_exp_cmd_sn) / 32] & SOL_EXP_CMD_SN_MASK) +
 			((psol->dw[offsetof(struct amap_sol_cqe, i_cmd_wnd)
 			/ 32] & SOL_CMD_WND_MASK) >> 24) - 1);
+	hdr->itt = io_task->libiscsi_itt;
 	__iscsi_complete_pdu(conn, (struct iscsi_hdr *)hdr, NULL, 0);
 }
 
@@ -681,18 +858,36 @@ hwi_complete_drvr_msgs(struct beiscsi_conn *beiscsi_conn,
 		       struct beiscsi_hba *phba, struct sol_cqe *psol)
 {
 	struct hwi_wrb_context *pwrb_context;
-	struct wrb_handle *pwrb_handle;
+	struct wrb_handle *pwrb_handle = NULL;
+	struct sgl_handle *psgl_handle = NULL;
 	struct hwi_controller *phwi_ctrlr;
+	struct iscsi_task *task;
+	struct beiscsi_io_task *io_task;
 	struct iscsi_conn *conn = beiscsi_conn->conn;
 	struct iscsi_session *session = conn->session;
 
 	phwi_ctrlr = phba->phwi_ctrlr;
-	pwrb_context = &phwi_ctrlr->wrb_context[((psol->
+	if (ring_mode) {
+		psgl_handle = phba->sgl_hndl_array[((psol->
+			      dw[offsetof(struct amap_sol_cqe_ring, icd_index) /
+				32] & SOL_ICD_INDEX_MASK) >> 6)];
+		pwrb_context = &phwi_ctrlr->wrb_context[psgl_handle->cid];
+		task = psgl_handle->task;
+		pwrb_handle = NULL;
+	} else {
+		pwrb_context = &phwi_ctrlr->wrb_context[((psol->
 				dw[offsetof(struct amap_sol_cqe, cid) / 32] &
 				SOL_CID_MASK) >> 6)];
-	pwrb_handle = pwrb_context->pwrb_handle_basestd[((psol->
+		pwrb_handle = pwrb_context->pwrb_handle_basestd[((psol->
 				dw[offsetof(struct amap_sol_cqe, wrb_index) /
 				32] & SOL_WRB_INDEX_MASK) >> 16)];
+		task = pwrb_handle->pio_handle;
+	}
+
+	io_task = task->dd_data;
+	spin_lock(&phba->mgmt_sgl_lock);
+	free_mgmt_sgl_handle(phba, io_task->psgl_handle);
+	spin_unlock(&phba->mgmt_sgl_lock);
 	spin_lock_bh(&session->lock);
 	free_wrb_handle(phba, pwrb_context, pwrb_handle);
 	spin_unlock_bh(&session->lock);
@@ -704,6 +899,7 @@ be_complete_nopin_resp(struct beiscsi_conn *beiscsi_conn,
 {
 	struct iscsi_nopin *hdr;
 	struct iscsi_conn *conn = beiscsi_conn->conn;
+	struct beiscsi_io_task *io_task = task->dd_data;
 
 	hdr = (struct iscsi_nopin *)task->hdr;
 	hdr->flags = ((psol->dw[offsetof(struct amap_sol_cqe, i_flags) / 32]
@@ -715,6 +911,7 @@ be_complete_nopin_resp(struct beiscsi_conn *beiscsi_conn,
 			((psol->dw[offsetof(struct amap_sol_cqe, i_cmd_wnd)
 			/ 32] & SOL_CMD_WND_MASK) >> 24) - 1);
 	hdr->opcode = ISCSI_OP_NOOP_IN;
+	hdr->itt = io_task->libiscsi_itt;
 	__iscsi_complete_pdu(conn, (struct iscsi_hdr *)hdr, NULL, 0);
 }
 
@@ -726,25 +923,33 @@ static void hwi_complete_cmd(struct beiscsi_conn *beiscsi_conn,
 	struct iscsi_wrb *pwrb = NULL;
 	struct hwi_controller *phwi_ctrlr;
 	struct iscsi_task *task;
-	struct beiscsi_io_task *io_task;
+	struct sgl_handle *psgl_handle = NULL;
+	unsigned int type;
 	struct iscsi_conn *conn = beiscsi_conn->conn;
 	struct iscsi_session *session = conn->session;
 
 	phwi_ctrlr = phba->phwi_ctrlr;
-
-	pwrb_context = &phwi_ctrlr->
-		wrb_context[((psol->dw[offsetof(struct amap_sol_cqe, cid) / 32]
-		& SOL_CID_MASK) >> 6)];
-	pwrb_handle = pwrb_context->pwrb_handle_basestd[((psol->
+	if (ring_mode) {
+		psgl_handle = phba->sgl_hndl_array[((psol->
+			      dw[offsetof(struct amap_sol_cqe_ring, icd_index) /
+			      32] & SOL_ICD_INDEX_MASK) >> 6)];
+		task = psgl_handle->task;
+		type = psgl_handle->type;
+	} else {
+		pwrb_context = &phwi_ctrlr->
+				wrb_context[((psol->dw[offsetof
+				(struct amap_sol_cqe, cid) / 32]
+				& SOL_CID_MASK) >> 6)];
+		pwrb_handle = pwrb_context->pwrb_handle_basestd[((psol->
 				dw[offsetof(struct amap_sol_cqe, wrb_index) /
 				32] & SOL_WRB_INDEX_MASK) >> 16)];
-
-	task = pwrb_handle->pio_handle;
-	io_task = task->dd_data;
+		task = pwrb_handle->pio_handle;
+		pwrb = pwrb_handle->pwrb;
+		type = (pwrb->dw[offsetof(struct amap_iscsi_wrb, type) / 32] &
+			 WRB_TYPE_MASK) >> 28;
+	}
 	spin_lock_bh(&session->lock);
-	pwrb = pwrb_handle->pwrb;
-	switch ((pwrb->dw[offsetof(struct amap_iscsi_wrb, type) / 32] &
-		 WRB_TYPE_MASK) >> 28) {
+	switch (type) {
 	case HWH_TYPE_IO:
 	case HWH_TYPE_IO_RD:
 		if ((task->hdr->opcode & ISCSI_OPCODE_MASK) ==
@@ -773,12 +978,21 @@ static void hwi_complete_cmd(struct beiscsi_conn *beiscsi_conn,
 		break;
 
 	default:
-		shost_printk(KERN_WARNING, phba->shost,
-			    "wrb_index 0x%x CID 0x%x\n",
-			    ((psol->dw[offsetof(struct amap_iscsi_wrb, type) /
-					32] & SOL_WRB_INDEX_MASK) >> 16),
-			    ((psol->dw[offsetof(struct amap_sol_cqe, cid) / 32]
-					& SOL_CID_MASK) >> 6));
+		if (ring_mode)
+			shost_printk(KERN_WARNING, phba->shost,
+				"In hwi_complete_cmd, unknown type = %d"
+				"icd_index 0x%x CID 0x%x\n", type,
+				((psol->dw[offsetof(struct amap_sol_cqe_ring,
+				icd_index) / 32] & SOL_ICD_INDEX_MASK) >> 6),
+				psgl_handle->cid);
+		else
+			shost_printk(KERN_WARNING, phba->shost,
+				"In hwi_complete_cmd, unknown type = %d"
+				"wrb_index 0x%x CID 0x%x\n", type,
+				((psol->dw[offsetof(struct amap_iscsi_wrb,
+				type) / 32] & SOL_WRB_INDEX_MASK) >> 16),
+				((psol->dw[offsetof(struct amap_sol_cqe,
+				cid) / 32] & SOL_CID_MASK) >> 6));
 		break;
 	}
 
@@ -1208,40 +1422,55 @@ static void hwi_process_default_pdu_ring(struct beiscsi_conn *beiscsi_conn,
 	hwi_post_async_buffers(phba, pasync_handle->is_header);
 }
 
-static unsigned int beiscsi_process_cq(struct beiscsi_hba *phba)
+
+static unsigned int beiscsi_process_cq(struct be_eq_obj *pbe_eq)
 {
-	struct hwi_controller *phwi_ctrlr;
-	struct hwi_context_memory *phwi_context;
 	struct be_queue_info *cq;
 	struct sol_cqe *sol;
 	struct dmsg_cqe *dmsg;
 	unsigned int num_processed = 0;
 	unsigned int tot_nump = 0;
 	struct beiscsi_conn *beiscsi_conn;
+	struct sgl_handle *psgl_handle = NULL;
+	struct beiscsi_hba *phba;
 
-	phwi_ctrlr = phba->phwi_ctrlr;
-	phwi_context = phwi_ctrlr->phwi_ctxt;
-	cq = &phwi_context->be_cq;
+	cq = pbe_eq->cq;
 	sol = queue_tail_node(cq);
+	phba = pbe_eq->phba;
 
 	while (sol->dw[offsetof(struct amap_sol_cqe, valid) / 32] &
 	       CQE_VALID_MASK) {
 		be_dws_le_to_cpu(sol, sizeof(struct sol_cqe));
 
-		beiscsi_conn = phba->conn_table[(u32) (sol->
+		if (ring_mode) {
+			psgl_handle = phba->sgl_hndl_array[((sol->
+				      dw[offsetof(struct amap_sol_cqe_ring,
+				      icd_index) / 32] & SOL_ICD_INDEX_MASK)
+				      >> 6)];
+			beiscsi_conn = phba->conn_table[psgl_handle->cid];
+			if (!beiscsi_conn || !beiscsi_conn->ep) {
+				shost_printk(KERN_WARNING, phba->shost,
+				     "Connection table empty for cid = %d\n",
+				      psgl_handle->cid);
+				return 0;
+			}
+
+		} else {
+			beiscsi_conn = phba->conn_table[(u32) (sol->
 				 dw[offsetof(struct amap_sol_cqe, cid) / 32] &
 				 SOL_CID_MASK) >> 6];
 
-		if (!beiscsi_conn || !beiscsi_conn->ep) {
-			shost_printk(KERN_WARNING, phba->shost,
+			if (!beiscsi_conn || !beiscsi_conn->ep) {
+				shost_printk(KERN_WARNING, phba->shost,
 				     "Connection table empty for cid = %d\n",
 				     (u32)(sol->dw[offsetof(struct amap_sol_cqe,
 				     cid) / 32] & SOL_CID_MASK) >> 6);
-			return 0;
+				return 0;
+			}
 		}
 
 		if (num_processed >= 32) {
-			hwi_ring_cq_db(phba, phwi_context->be_cq.id,
+			hwi_ring_cq_db(phba, cq->id,
 					num_processed, 0, 0);
 			tot_nump += num_processed;
 			num_processed = 0;
@@ -1258,8 +1487,12 @@ static unsigned int beiscsi_process_cq(struct beiscsi_hba *phba)
 			hwi_complete_drvr_msgs(beiscsi_conn, phba, sol);
 			break;
 		case UNSOL_HDR_NOTIFY:
+			SE_DEBUG(DBG_LVL_8, "Received UNSOL_HDR_ NOTIFY\n");
+			hwi_process_default_pdu_ring(beiscsi_conn, phba,
+					     (struct i_t_dpdu_cqe *)sol);
+			break;
 		case UNSOL_DATA_NOTIFY:
-			SE_DEBUG(DBG_LVL_8, "Received UNSOL_HDR/DATA_NOTIFY\n");
+			SE_DEBUG(DBG_LVL_8, "Received UNSOL_DATA_NOTIFY\n");
 			hwi_process_default_pdu_ring(beiscsi_conn, phba,
 					     (struct i_t_dpdu_cqe *)sol);
 			break;
@@ -1278,13 +1511,21 @@ static unsigned int beiscsi_process_cq(struct beiscsi_hba *phba)
 		case CMD_CXN_KILLED_ITT_INVALID:
 		case CMD_CXN_KILLED_SEQ_OUTOFORDER:
 		case CMD_CXN_KILLED_INVALID_DATASN_RCVD:
-			SE_DEBUG(DBG_LVL_1,
+			if (ring_mode) {
+				SE_DEBUG(DBG_LVL_1,
+				 "CQ Error notification for cmd.. "
+				 "code %d cid 0x%x\n",
+				 sol->dw[offsetof(struct amap_sol_cqe, code) /
+				 32] & CQE_CODE_MASK, psgl_handle->cid);
+			} else {
+				SE_DEBUG(DBG_LVL_1,
 				 "CQ Error notification for cmd.. "
 				 "code %d cid 0x%x\n",
 				 sol->dw[offsetof(struct amap_sol_cqe, code) /
 				 32] & CQE_CODE_MASK,
 				 (sol->dw[offsetof(struct amap_sol_cqe, cid) /
 				 32] & SOL_CID_MASK));
+			}
 			break;
 		case UNSOL_DATA_DIGEST_ERROR_NOTIFY:
 			SE_DEBUG(DBG_LVL_1,
@@ -1306,23 +1547,37 @@ static unsigned int beiscsi_process_cq(struct beiscsi_hba *phba)
 		case CXN_KILLED_OVER_RUN_RESIDUAL:
 		case CXN_KILLED_UNDER_RUN_RESIDUAL:
 		case CXN_KILLED_CMND_DATA_NOT_ON_SAME_CONN:
-			SE_DEBUG(DBG_LVL_1, "CQ Error %d, resetting CID "
+			if (ring_mode) {
+				SE_DEBUG(DBG_LVL_1, "CQ Error %d, reset CID "
+				 "0x%x...\n",
+				 sol->dw[offsetof(struct amap_sol_cqe, code) /
+				 32] & CQE_CODE_MASK, psgl_handle->cid);
+			} else {
+				SE_DEBUG(DBG_LVL_1, "CQ Error %d, reset CID "
 				 "0x%x...\n",
 				 sol->dw[offsetof(struct amap_sol_cqe, code) /
 				 32] & CQE_CODE_MASK,
 				 sol->dw[offsetof(struct amap_sol_cqe, cid) /
 				 32] & CQE_CID_MASK);
+			}
 			iscsi_conn_failure(beiscsi_conn->conn,
 					   ISCSI_ERR_CONN_FAILED);
 			break;
 		case CXN_KILLED_RST_SENT:
 		case CXN_KILLED_RST_RCVD:
-			SE_DEBUG(DBG_LVL_1, "CQ Error %d, reset received/sent "
-				 "on CID 0x%x...\n",
+			if (ring_mode) {
+				SE_DEBUG(DBG_LVL_1, "CQ Error %d, reset"
+				"received/sent on CID 0x%x...\n",
+				 sol->dw[offsetof(struct amap_sol_cqe, code) /
+				 32] & CQE_CODE_MASK, psgl_handle->cid);
+			} else {
+				SE_DEBUG(DBG_LVL_1, "CQ Error %d, reset"
+				"received/sent on CID 0x%x...\n",
 				 sol->dw[offsetof(struct amap_sol_cqe, code) /
 				 32] & CQE_CODE_MASK,
 				 sol->dw[offsetof(struct amap_sol_cqe, cid) /
 				 32] & CQE_CID_MASK);
+			}
 			iscsi_conn_failure(beiscsi_conn->conn,
 					   ISCSI_ERR_CONN_FAILED);
 			break;
@@ -1344,8 +1599,7 @@ static unsigned int beiscsi_process_cq(struct beiscsi_hba *phba)
 
 	if (num_processed > 0) {
 		tot_nump += num_processed;
-		hwi_ring_cq_db(phba, phwi_context->be_cq.id, num_processed,
-			       1, 0);
+		hwi_ring_cq_db(phba, cq->id, num_processed, 1, 0);
 	}
 	return tot_nump;
 }
@@ -1353,21 +1607,30 @@ static unsigned int beiscsi_process_cq(struct beiscsi_hba *phba)
 static void beiscsi_process_all_cqs(struct work_struct *work)
 {
 	unsigned long flags;
+	struct hwi_controller *phwi_ctrlr;
+	struct hwi_context_memory *phwi_context;
+	struct be_eq_obj *pbe_eq;
 	struct beiscsi_hba *phba =
 	    container_of(work, struct beiscsi_hba, work_cqs);
 
+	phwi_ctrlr = phba->phwi_ctrlr;
+	phwi_context = phwi_ctrlr->phwi_ctxt;
+	if (phba->msix_enabled)
+		pbe_eq = &phwi_context->be_eq[phba->num_cpus];
+	else
+		pbe_eq = &phwi_context->be_eq[0];
+
 	if (phba->todo_mcc_cq) {
 		spin_lock_irqsave(&phba->isr_lock, flags);
 		phba->todo_mcc_cq = 0;
 		spin_unlock_irqrestore(&phba->isr_lock, flags);
-		SE_DEBUG(DBG_LVL_1, "MCC Interrupt Not expected \n");
 	}
 
 	if (phba->todo_cq) {
 		spin_lock_irqsave(&phba->isr_lock, flags);
 		phba->todo_cq = 0;
 		spin_unlock_irqrestore(&phba->isr_lock, flags);
-		beiscsi_process_cq(phba);
+		beiscsi_process_cq(pbe_eq);
 	}
 }
 
@@ -1375,19 +1638,15 @@ static int be_iopoll(struct blk_iopoll *iop, int budget)
 {
 	static unsigned int ret;
 	struct beiscsi_hba *phba;
+	struct be_eq_obj *pbe_eq;
 
-	phba = container_of(iop, struct beiscsi_hba, iopoll);
-
-	ret = beiscsi_process_cq(phba);
+	pbe_eq = container_of(iop, struct be_eq_obj, iopoll);
+	ret = beiscsi_process_cq(pbe_eq);
 	if (ret < budget) {
-		struct hwi_controller *phwi_ctrlr;
-		struct hwi_context_memory *phwi_context;
-
-		phwi_ctrlr = phba->phwi_ctrlr;
-		phwi_context = phwi_ctrlr->phwi_ctxt;
+		phba = pbe_eq->phba;
 		blk_iopoll_complete(iop);
-		hwi_ring_eq_db(phba, phwi_context->be_eq.q.id, 0,
-							0, 1, 1);
+		SE_DEBUG(DBG_LVL_8, "rearm pbe_eq->q.id =%d\n", pbe_eq->q.id);
+		hwi_ring_eq_db(phba, pbe_eq->q.id, 0, 0, 1, 1);
 	}
 	return ret;
 }
@@ -1537,14 +1796,12 @@ static void hwi_write_buffer(struct iscsi_wrb *pwrb, struct iscsi_task *task)
 
 static void beiscsi_find_mem_req(struct beiscsi_hba *phba)
 {
-	unsigned int num_cq_pages, num_eq_pages, num_async_pdu_buf_pages;
+	unsigned int num_cq_pages, num_async_pdu_buf_pages;
 	unsigned int num_async_pdu_data_pages, wrb_sz_per_cxn;
 	unsigned int num_async_pdu_buf_sgl_pages, num_async_pdu_data_sgl_pages;
 
 	num_cq_pages = PAGES_REQUIRED(phba->params.num_cq_entries * \
 				      sizeof(struct sol_cqe));
-	num_eq_pages = PAGES_REQUIRED(phba->params.num_eq_entries * \
-				      sizeof(struct be_eq_entry));
 	num_async_pdu_buf_pages =
 			PAGES_REQUIRED(phba->params.asyncpdus_per_ctrl * \
 				       phba->params.defpdu_hdr_sz);
@@ -1565,8 +1822,6 @@ static void beiscsi_find_mem_req(struct beiscsi_hba *phba)
 	phba->mem_req[HWI_MEM_ADDN_CONTEXT] =
 					    sizeof(struct hwi_context_memory);
 
-	phba->mem_req[HWI_MEM_CQ] = num_cq_pages * PAGE_SIZE;
-	phba->mem_req[HWI_MEM_EQ] = num_eq_pages * PAGE_SIZE;
 
 	phba->mem_req[HWI_MEM_WRB] = sizeof(struct iscsi_wrb)
 	    * (phba->params.wrbs_per_cxn)
@@ -1751,8 +2006,6 @@ static void beiscsi_init_wrb_handle(struct beiscsi_hba *phba)
 
 	for (index = 0; index < phba->params.cxns_per_ctrl * 2; index += 2) {
 		pwrb_context = &phwi_ctrlr->wrb_context[index];
-		SE_DEBUG(DBG_LVL_8, "cid=%d pwrb_context=%p \n", index,
-						pwrb_context);
 		pwrb_context->pwrb_handle_base =
 				kzalloc(sizeof(struct wrb_handle *) *
 					phba->params.wrbs_per_cxn, GFP_KERNEL);
@@ -1767,6 +2020,7 @@ static void beiscsi_init_wrb_handle(struct beiscsi_hba *phba)
 				pwrb_context->pwrb_handle_basestd[j] =
 								pwrb_handle;
 				pwrb_context->wrb_handles_available++;
+				pwrb_handle->wrb_index = j;
 				pwrb_handle++;
 			}
 			pwrb_context->free_index = 0;
@@ -1785,6 +2039,7 @@ static void beiscsi_init_wrb_handle(struct beiscsi_hba *phba)
 				pwrb_context->pwrb_handle_basestd[j] =
 				    pwrb_handle;
 				pwrb_context->wrb_handles_available++;
+				pwrb_handle->wrb_index = j;
 				pwrb_handle++;
 			}
 			pwrb_context->free_index = 0;
@@ -2042,79 +2297,126 @@ static int be_fill_queue(struct be_queue_info *q,
 	return 0;
 }
 
-static int beiscsi_create_eq(struct beiscsi_hba *phba,
+static int beiscsi_create_eqs(struct beiscsi_hba *phba,
 			     struct hwi_context_memory *phwi_context)
 {
-	unsigned int idx;
-	int ret;
+	unsigned int i, num_eq_pages;
+	int ret, eq_for_mcc;
 	struct be_queue_info *eq;
 	struct be_dma_mem *mem;
-	struct be_mem_descriptor *mem_descr;
 	void *eq_vaddress;
+	dma_addr_t paddr;
 
-	idx = 0;
-	eq = &phwi_context->be_eq.q;
-	mem = &eq->dma_mem;
-	mem_descr = phba->init_mem;
-	mem_descr += HWI_MEM_EQ;
-	eq_vaddress = mem_descr->mem_array[idx].virtual_address;
-
-	ret = be_fill_queue(eq, phba->params.num_eq_entries,
-			    sizeof(struct be_eq_entry), eq_vaddress);
-	if (ret) {
-		shost_printk(KERN_ERR, phba->shost,
-			     "be_fill_queue Failed for EQ \n");
-		return ret;
-	}
+	num_eq_pages = PAGES_REQUIRED(phba->params.num_eq_entries * \
+				      sizeof(struct be_eq_entry));
 
-	mem->dma = mem_descr->mem_array[idx].bus_address.u.a64.address;
+	if (phba->msix_enabled)
+		eq_for_mcc = 1;
+	else
+		eq_for_mcc = 0;
+	for (i = 0; i < (phba->num_cpus + eq_for_mcc); i++) {
+		eq = &phwi_context->be_eq[i].q;
+		mem = &eq->dma_mem;
+		phwi_context->be_eq[i].phba = phba;
+		eq_vaddress = pci_alloc_consistent(phba->pcidev,
+						     num_eq_pages * PAGE_SIZE,
+						     &paddr);
+		if (!eq_vaddress)
+			goto create_eq_error;
+
+		mem->va = eq_vaddress;
+		ret = be_fill_queue(eq, phba->params.num_eq_entries,
+				    sizeof(struct be_eq_entry), eq_vaddress);
+		if (ret) {
+			shost_printk(KERN_ERR, phba->shost,
+				     "be_fill_queue Failed for EQ \n");
+			goto create_eq_error;
+		}
 
-	ret = beiscsi_cmd_eq_create(&phba->ctrl, eq,
-				    phwi_context->be_eq.cur_eqd);
-	if (ret) {
-		shost_printk(KERN_ERR, phba->shost, "beiscsi_cmd_eq_create"
-			     "Failedfor EQ \n");
-		return ret;
+		mem->dma = paddr;
+		ret = beiscsi_cmd_eq_create(&phba->ctrl, eq,
+					    phwi_context->cur_eqd);
+		if (ret) {
+			shost_printk(KERN_ERR, phba->shost,
+				     "beiscsi_cmd_eq_create"
+				     "Failedfor EQ \n");
+			goto create_eq_error;
+		}
+		SE_DEBUG(DBG_LVL_8, "eqid = %d\n", phwi_context->be_eq[i].q.id);
 	}
-	SE_DEBUG(DBG_LVL_8, "eq id is %d\n", phwi_context->be_eq.q.id);
 	return 0;
+create_eq_error:
+	for (i = 0; i < (phba->num_cpus + 1); i++) {
+		eq = &phwi_context->be_eq[i].q;
+		mem = &eq->dma_mem;
+		if (mem->va)
+			pci_free_consistent(phba->pcidev, num_eq_pages
+					    * PAGE_SIZE,
+					    mem->va, mem->dma);
+	}
+	return ret;
 }
 
-static int beiscsi_create_cq(struct beiscsi_hba *phba,
+static int beiscsi_create_cqs(struct beiscsi_hba *phba,
 			     struct hwi_context_memory *phwi_context)
 {
-	unsigned int idx;
+	unsigned int i, num_cq_pages;
 	int ret;
 	struct be_queue_info *cq, *eq;
 	struct be_dma_mem *mem;
-	struct be_mem_descriptor *mem_descr;
+	struct be_eq_obj *pbe_eq;
 	void *cq_vaddress;
+	dma_addr_t paddr;
 
-	idx = 0;
-	cq = &phwi_context->be_cq;
-	eq = &phwi_context->be_eq.q;
-	mem = &cq->dma_mem;
-	mem_descr = phba->init_mem;
-	mem_descr += HWI_MEM_CQ;
-	cq_vaddress = mem_descr->mem_array[idx].virtual_address;
-	ret = be_fill_queue(cq, phba->params.icds_per_ctrl / 2,
-			    sizeof(struct sol_cqe), cq_vaddress);
-	if (ret) {
-		shost_printk(KERN_ERR, phba->shost,
-			     "be_fill_queue Failed for ISCSI CQ \n");
-		return ret;
-	}
+	num_cq_pages = PAGES_REQUIRED(phba->params.num_cq_entries * \
+				      sizeof(struct sol_cqe));
 
-	mem->dma = mem_descr->mem_array[idx].bus_address.u.a64.address;
-	ret = beiscsi_cmd_cq_create(&phba->ctrl, cq, eq, false, false, 0);
-	if (ret) {
-		shost_printk(KERN_ERR, phba->shost,
-			     "beiscsi_cmd_eq_create Failed for ISCSI CQ \n");
-		return ret;
+	for (i = 0; i < phba->num_cpus; i++) {
+		cq = &phwi_context->be_cq[i];
+		eq = &phwi_context->be_eq[i].q;
+		pbe_eq = &phwi_context->be_eq[i];
+		pbe_eq->cq = cq;
+		pbe_eq->phba = phba;
+		mem = &cq->dma_mem;
+		cq_vaddress = pci_alloc_consistent(phba->pcidev,
+						     num_cq_pages * PAGE_SIZE,
+						     &paddr);
+		if (!cq_vaddress)
+			goto create_cq_error;
+		ret = be_fill_queue(cq, phba->params.icds_per_ctrl / 2,
+				    sizeof(struct sol_cqe), cq_vaddress);
+		if (ret) {
+			shost_printk(KERN_ERR, phba->shost,
+				     "be_fill_queue Failed for ISCSI CQ \n");
+			goto create_cq_error;
+		}
+
+		mem->dma = paddr;
+		ret = beiscsi_cmd_cq_create(&phba->ctrl, cq, eq, false,
+					    false, 0);
+		if (ret) {
+			shost_printk(KERN_ERR, phba->shost,
+				     "beiscsi_cmd_eq_create"
+				     "Failed for ISCSI CQ \n");
+			goto create_cq_error;
+		}
+		SE_DEBUG(DBG_LVL_8, "iscsi cq_id is %d for eq_id %d\n",
+						 cq->id, eq->id);
+		SE_DEBUG(DBG_LVL_8, "ISCSI CQ CREATED\n");
 	}
-	SE_DEBUG(DBG_LVL_8, "iscsi cq id is %d\n", phwi_context->be_cq.id);
-	SE_DEBUG(DBG_LVL_8, "ISCSI CQ CREATED\n");
 	return 0;
+
+create_cq_error:
+	for (i = 0; i < phba->num_cpus; i++) {
+		cq = &phwi_context->be_cq[i];
+		mem = &cq->dma_mem;
+		if (mem->va)
+			pci_free_consistent(phba->pcidev, num_cq_pages
+					    * PAGE_SIZE,
+					    mem->va, mem->dma);
+	}
+	return ret;
+
 }
 
 static int
@@ -2132,7 +2434,7 @@ beiscsi_create_def_hdr(struct beiscsi_hba *phba,
 
 	idx = 0;
 	dq = &phwi_context->be_def_hdrq;
-	cq = &phwi_context->be_cq;
+	cq = &phwi_context->be_cq[0];
 	mem = &dq->dma_mem;
 	mem_descr = phba->init_mem;
 	mem_descr += HWI_MEM_ASYNC_HEADER_RING;
@@ -2176,7 +2478,7 @@ beiscsi_create_def_data(struct beiscsi_hba *phba,
 
 	idx = 0;
 	dataq = &phwi_context->be_def_dataq;
-	cq = &phwi_context->be_cq;
+	cq = &phwi_context->be_cq[0];
 	mem = &dataq->dma_mem;
 	mem_descr = phba->init_mem;
 	mem_descr += HWI_MEM_ASYNC_DATA_RING;
@@ -2239,6 +2541,30 @@ beiscsi_post_pages(struct beiscsi_hba *phba)
 	return 0;
 }
 
+static void be_queue_free(struct beiscsi_hba *phba, struct be_queue_info *q)
+{
+	struct be_dma_mem *mem = &q->dma_mem;
+	if (mem->va)
+		pci_free_consistent(phba->pcidev, mem->size,
+			mem->va, mem->dma);
+}
+
+static int be_queue_alloc(struct beiscsi_hba *phba, struct be_queue_info *q,
+		u16 len, u16 entry_size)
+{
+	struct be_dma_mem *mem = &q->dma_mem;
+
+	memset(q, 0, sizeof(*q));
+	q->len = len;
+	q->entry_size = entry_size;
+	mem->size = len * entry_size;
+	mem->va = pci_alloc_consistent(phba->pcidev, mem->size, &mem->dma);
+	if (!mem->va)
+		return -1;
+	memset(mem->va, 0, mem->size);
+	return 0;
+}
+
 static int
 beiscsi_create_wrb_rings(struct beiscsi_hba *phba,
 			 struct hwi_context_memory *phwi_context,
@@ -2328,13 +2654,29 @@ static void free_wrb_handles(struct beiscsi_hba *phba)
 	}
 }
 
+static void be_mcc_queues_destroy(struct beiscsi_hba *phba)
+{
+	struct be_queue_info *q;
+	struct be_ctrl_info *ctrl = &phba->ctrl;
+
+	q = &phba->ctrl.mcc_obj.q;
+	if (q->created)
+		beiscsi_cmd_q_destroy(ctrl, q, QTYPE_MCCQ);
+	be_queue_free(phba, q);
+
+	q = &phba->ctrl.mcc_obj.cq;
+	if (q->created)
+		beiscsi_cmd_q_destroy(ctrl, q, QTYPE_CQ);
+	be_queue_free(phba, q);
+}
+
 static void hwi_cleanup(struct beiscsi_hba *phba)
 {
 	struct be_queue_info *q;
 	struct be_ctrl_info *ctrl = &phba->ctrl;
 	struct hwi_controller *phwi_ctrlr;
 	struct hwi_context_memory *phwi_context;
-	int i;
+	int i, eq_num;
 
 	phwi_ctrlr = phba->phwi_ctrlr;
 	phwi_context = phwi_ctrlr->phwi_ctxt;
@@ -2343,7 +2685,6 @@ static void hwi_cleanup(struct beiscsi_hba *phba)
 		if (q->created)
 			beiscsi_cmd_q_destroy(ctrl, q, QTYPE_WRBQ);
 	}
-
 	free_wrb_handles(phba);
 
 	q = &phwi_context->be_def_hdrq;
@@ -2356,13 +2697,76 @@ static void hwi_cleanup(struct beiscsi_hba *phba)
 
 	beiscsi_cmd_q_destroy(ctrl, NULL, QTYPE_SGL);
 
-	q = &phwi_context->be_cq;
-	if (q->created)
-		beiscsi_cmd_q_destroy(ctrl, q, QTYPE_CQ);
+	for (i = 0; i < (phba->num_cpus); i++) {
+		q = &phwi_context->be_cq[i];
+		if (q->created)
+			beiscsi_cmd_q_destroy(ctrl, q, QTYPE_CQ);
+	}
+	if (phba->msix_enabled)
+		eq_num = 1;
+	else
+		eq_num = 0;
+	for (i = 0; i < (phba->num_cpus + eq_num); i++) {
+		q = &phwi_context->be_eq[i].q;
+		if (q->created)
+			beiscsi_cmd_q_destroy(ctrl, q, QTYPE_EQ);
+	}
+	be_mcc_queues_destroy(phba);
+}
 
-	q = &phwi_context->be_eq.q;
-	if (q->created)
-		beiscsi_cmd_q_destroy(ctrl, q, QTYPE_EQ);
+static int be_mcc_queues_create(struct beiscsi_hba *phba,
+				struct hwi_context_memory *phwi_context)
+{
+	struct be_queue_info *q, *cq;
+	struct be_ctrl_info *ctrl = &phba->ctrl;
+
+	/* Alloc MCC compl queue */
+	cq = &phba->ctrl.mcc_obj.cq;
+	if (be_queue_alloc(phba, cq, MCC_CQ_LEN,
+			sizeof(struct be_mcc_compl)))
+		goto err;
+	/* Ask BE to create MCC compl queue; */
+	if (phba->msix_enabled) {
+		if (beiscsi_cmd_cq_create(ctrl, cq, &phwi_context->be_eq
+					 [phba->num_cpus].q, false, true, 0))
+		goto mcc_cq_free;
+	} else {
+		if (beiscsi_cmd_cq_create(ctrl, cq, &phwi_context->be_eq[0].q,
+					  false, true, 0))
+		goto mcc_cq_free;
+	}
+
+	/* Alloc MCC queue */
+	q = &phba->ctrl.mcc_obj.q;
+	if (be_queue_alloc(phba, q, MCC_Q_LEN, sizeof(struct be_mcc_wrb)))
+		goto mcc_cq_destroy;
+
+	/* Ask BE to create MCC queue */
+	if (beiscsi_cmd_mccq_create(phba, q, cq))
+		goto mcc_q_free;
+
+	return 0;
+
+mcc_q_free:
+	be_queue_free(phba, q);
+mcc_cq_destroy:
+	beiscsi_cmd_q_destroy(ctrl, cq, QTYPE_CQ);
+mcc_cq_free:
+	be_queue_free(phba, cq);
+err:
+	return -1;
+}
+
+static int find_num_cpus(void)
+{
+	int  num_cpus = 0;
+
+	num_cpus = num_online_cpus();
+	if (num_cpus >= MAX_CPUS)
+		num_cpus = MAX_CPUS - 1;
+
+	SE_DEBUG(DBG_LVL_8, "num_cpus = %d \n", num_cpus);
+	return num_cpus;
 }
 
 static int hwi_init_port(struct beiscsi_hba *phba)
@@ -2376,26 +2780,33 @@ static int hwi_init_port(struct beiscsi_hba *phba)
 	def_pdu_ring_sz =
 		phba->params.asyncpdus_per_ctrl * sizeof(struct phys_addr);
 	phwi_ctrlr = phba->phwi_ctrlr;
-
 	phwi_context = phwi_ctrlr->phwi_ctxt;
-	phwi_context->be_eq.max_eqd = 0;
-	phwi_context->be_eq.min_eqd = 0;
-	phwi_context->be_eq.cur_eqd = 64;
-	phwi_context->be_eq.enable_aic = false;
+	phwi_context->max_eqd = 0;
+	phwi_context->min_eqd = 0;
+	phwi_context->cur_eqd = 64;
 	be_cmd_fw_initialize(&phba->ctrl);
-	status = beiscsi_create_eq(phba, phwi_context);
+
+	status = beiscsi_create_eqs(phba, phwi_context);
 	if (status != 0) {
 		shost_printk(KERN_ERR, phba->shost, "EQ not created \n");
 		goto error;
 	}
 
-	status = mgmt_check_supported_fw(ctrl);
+	status = be_mcc_queues_create(phba, phwi_context);
+	if (status != 0)
+		goto error;
+
+	status = mgmt_check_supported_fw(ctrl, phba);
 	if (status != 0) {
 		shost_printk(KERN_ERR, phba->shost,
 			     "Unsupported fw version \n");
 		goto error;
 	}
 
+	if (phba->fw_config.iscsi_features == 0x1)
+		ring_mode = 1;
+	else
+		ring_mode = 0;
 	status = mgmt_get_fw_config(ctrl, phba);
 	if (status != 0) {
 		shost_printk(KERN_ERR, phba->shost,
@@ -2403,7 +2814,7 @@ static int hwi_init_port(struct beiscsi_hba *phba)
 		goto error;
 	}
 
-	status = beiscsi_create_cq(phba, phwi_context);
+	status = beiscsi_create_cqs(phba, phwi_context);
 	if (status != 0) {
 		shost_printk(KERN_ERR, phba->shost, "CQ not created\n");
 		goto error;
@@ -2447,7 +2858,6 @@ error:
 	return -ENOMEM;
 }
 
-
 static int hwi_init_controller(struct beiscsi_hba *phba)
 {
 	struct hwi_controller *phwi_ctrlr;
@@ -2530,6 +2940,18 @@ static int beiscsi_init_sgl_handle(struct beiscsi_hba *phba)
 
 	phba->io_sgl_hndl_avbl = 0;
 	phba->eh_sgl_hndl_avbl = 0;
+
+	if (ring_mode) {
+		phba->sgl_hndl_array = kzalloc(sizeof(struct sgl_handle *) *
+					      phba->params.icds_per_ctrl,
+						 GFP_KERNEL);
+		if (!phba->sgl_hndl_array) {
+			shost_printk(KERN_ERR, phba->shost,
+			     "Mem Alloc Failed. Failing to load\n");
+			return -ENOMEM;
+		}
+	}
+
 	mem_descr_sglh = phba->init_mem;
 	mem_descr_sglh += HWI_MEM_SGLH;
 	if (1 == mem_descr_sglh->num_elements) {
@@ -2537,6 +2959,8 @@ static int beiscsi_init_sgl_handle(struct beiscsi_hba *phba)
 						 phba->params.ios_per_ctrl,
 						 GFP_KERNEL);
 		if (!phba->io_sgl_hndl_base) {
+			if (ring_mode)
+				kfree(phba->sgl_hndl_array);
 			shost_printk(KERN_ERR, phba->shost,
 				     "Mem Alloc Failed. Failing to load\n");
 			return -ENOMEM;
@@ -2656,13 +3080,12 @@ static unsigned char hwi_enable_intr(struct beiscsi_hba *phba)
 	struct hwi_context_memory *phwi_context;
 	struct be_queue_info *eq;
 	u8 __iomem *addr;
-	u32 reg;
+	u32 reg, i;
 	u32 enabled;
 
 	phwi_ctrlr = phba->phwi_ctrlr;
 	phwi_context = phwi_ctrlr->phwi_ctxt;
 
-	eq = &phwi_context->be_eq.q;
 	addr = (u8 __iomem *) ((u8 __iomem *) ctrl->pcicfg +
 			PCICFG_MEMBAR_CTRL_INT_CTRL_OFFSET);
 	reg = ioread32(addr);
@@ -2673,9 +3096,11 @@ static unsigned char hwi_enable_intr(struct beiscsi_hba *phba)
 		reg |= MEMBAR_CTRL_INT_CTRL_HOSTINTR_MASK;
 		SE_DEBUG(DBG_LVL_8, "reg =x%08x addr=%p \n", reg, addr);
 		iowrite32(reg, addr);
-		SE_DEBUG(DBG_LVL_8, "eq->id=%d \n", eq->id);
-
-		hwi_ring_eq_db(phba, eq->id, 0, 0, 1, 1);
+		for (i = 0; i <= phba->num_cpus; i++) {
+			eq = &phwi_context->be_eq[i].q;
+			SE_DEBUG(DBG_LVL_8, "eq->id=%d \n", eq->id);
+			hwi_ring_eq_db(phba, eq->id, 0, 0, 1, 1);
+		}
 	} else
 		shost_printk(KERN_WARNING, phba->shost,
 			     "In hwi_enable_intr, Not Enabled \n");
@@ -2720,6 +3145,8 @@ static int beiscsi_init_port(struct beiscsi_hba *phba)
 	if (hba_setup_cid_tbls(phba)) {
 		shost_printk(KERN_ERR, phba->shost,
 			     "Failed in hba_setup_cid_tbls\n");
+		if (ring_mode)
+			kfree(phba->sgl_hndl_array);
 		kfree(phba->io_sgl_hndl_base);
 		kfree(phba->eh_sgl_hndl_base);
 		goto do_cleanup_ctrlr;
@@ -2738,17 +3165,25 @@ static void hwi_purge_eq(struct beiscsi_hba *phba)
 	struct hwi_context_memory *phwi_context;
 	struct be_queue_info *eq;
 	struct be_eq_entry *eqe = NULL;
+	int i, eq_msix;
 
 	phwi_ctrlr = phba->phwi_ctrlr;
 	phwi_context = phwi_ctrlr->phwi_ctxt;
-	eq = &phwi_context->be_eq.q;
-	eqe = queue_tail_node(eq);
+	if (phba->msix_enabled)
+		eq_msix = 1;
+	else
+		eq_msix = 0;
 
-	while (eqe->dw[offsetof(struct amap_eq_entry, valid) / 32]
-						& EQE_VALID_MASK) {
-		AMAP_SET_BITS(struct amap_eq_entry, valid, eqe, 0);
-		queue_tail_inc(eq);
+	for (i = 0; i < (phba->num_cpus + eq_msix); i++) {
+		eq = &phwi_context->be_eq[i].q;
 		eqe = queue_tail_node(eq);
+
+		while (eqe->dw[offsetof(struct amap_eq_entry, valid) / 32]
+					& EQE_VALID_MASK) {
+			AMAP_SET_BITS(struct amap_eq_entry, valid, eqe, 0);
+			queue_tail_inc(eq);
+			eqe = queue_tail_node(eq);
+		}
 	}
 }
 
@@ -2762,6 +3197,8 @@ static void beiscsi_clean_port(struct beiscsi_hba *phba)
 			     "mgmt_epfw_cleanup FAILED \n");
 	hwi_cleanup(phba);
 	hwi_purge_eq(phba);
+	if (ring_mode)
+		kfree(phba->sgl_hndl_array);
 	kfree(phba->io_sgl_hndl_base);
 	kfree(phba->eh_sgl_hndl_base);
 	kfree(phba->cid_array);
@@ -2846,8 +3283,9 @@ beiscsi_offload_connection(struct beiscsi_conn *beiscsi_conn,
 	be_dws_le_to_cpu(pwrb, sizeof(struct iscsi_target_context_update_wrb));
 
 	doorbell |= beiscsi_conn->beiscsi_conn_cid & DB_WRB_POST_CID_MASK;
-	doorbell |= (pwrb_handle->wrb_index & DB_DEF_PDU_WRB_INDEX_MASK) <<
-					DB_DEF_PDU_WRB_INDEX_SHIFT;
+	if (!ring_mode)
+		doorbell |= (pwrb_handle->wrb_index & DB_DEF_PDU_WRB_INDEX_MASK)
+			     << DB_DEF_PDU_WRB_INDEX_SHIFT;
 	doorbell |= 1 << DB_DEF_PDU_NUM_POSTED_SHIFT;
 
 	iowrite32(doorbell, phba->db_va + DB_TXULP0_OFFSET);
@@ -2856,7 +3294,7 @@ beiscsi_offload_connection(struct beiscsi_conn *beiscsi_conn,
 static void beiscsi_parse_pdu(struct iscsi_conn *conn, itt_t itt,
 			      int *index, int *age)
 {
-	*index = be32_to_cpu(itt) >> 16;
+	*index = (int)itt;
 	if (age)
 		*age = conn->session->age;
 }
@@ -2885,15 +3323,13 @@ static int beiscsi_alloc_pdu(struct iscsi_task *task, uint8_t opcode)
 
 	io_task->cmd_bhs = pci_pool_alloc(beiscsi_sess->bhs_pool,
 					  GFP_KERNEL, &paddr);
-
 	if (!io_task->cmd_bhs)
 		return -ENOMEM;
-
 	io_task->bhs_pa.u.a64.address = paddr;
+	io_task->libiscsi_itt = (itt_t)task->itt;
 	io_task->pwrb_handle = alloc_wrb_handle(phba,
 						beiscsi_conn->beiscsi_conn_cid,
 						task->itt);
-	io_task->pwrb_handle->pio_handle = task;
 	io_task->conn = beiscsi_conn;
 
 	task->hdr = (struct iscsi_hdr *)&io_task->cmd_bhs->iscsi_hdr;
@@ -2905,7 +3341,6 @@ static int beiscsi_alloc_pdu(struct iscsi_task *task, uint8_t opcode)
 		spin_unlock(&phba->io_sgl_lock);
 		if (!io_task->psgl_handle)
 			goto free_hndls;
-
 	} else {
 		io_task->scsi_cmnd = NULL;
 		if ((task->hdr->opcode & ISCSI_OPCODE_MASK) == ISCSI_OP_LOGIN) {
@@ -2932,8 +3367,18 @@ static int beiscsi_alloc_pdu(struct iscsi_task *task, uint8_t opcode)
 				goto free_hndls;
 		}
 	}
-	itt = (itt_t) cpu_to_be32(((unsigned int)task->itt << 16) |
-			(unsigned int)(io_task->psgl_handle->sgl_index));
+	itt = (itt_t) cpu_to_be32(((unsigned int)io_task->pwrb_handle->
+				 wrb_index << 16) | (unsigned int)
+				(io_task->psgl_handle->sgl_index));
+	if (ring_mode) {
+		phba->sgl_hndl_array[io_task->psgl_handle->sgl_index -
+				     phba->fw_config.iscsi_cid_start] =
+				     io_task->psgl_handle;
+		io_task->psgl_handle->task = task;
+		io_task->psgl_handle->cid = beiscsi_conn->beiscsi_conn_cid;
+	} else
+		io_task->pwrb_handle->pio_handle = task;
+
 	io_task->cmd_bhs->iscsi_hdr.itt = itt;
 	return 0;
 
@@ -3006,7 +3451,6 @@ static int beiscsi_iotask(struct iscsi_task *task, struct scatterlist *sg,
 	io_task->bhs_len = sizeof(struct be_cmd_bhs);
 
 	if (writedir) {
-		SE_DEBUG(DBG_LVL_4, " WRITE Command \t");
 		memset(&io_task->cmd_bhs->iscsi_data_pdu, 0, 48);
 		AMAP_SET_BITS(struct amap_pdu_data_out, itt,
 			      &io_task->cmd_bhs->iscsi_data_pdu,
@@ -3016,11 +3460,18 @@ static int beiscsi_iotask(struct iscsi_task *task, struct scatterlist *sg,
 			      ISCSI_OPCODE_SCSI_DATA_OUT);
 		AMAP_SET_BITS(struct amap_pdu_data_out, final_bit,
 			      &io_task->cmd_bhs->iscsi_data_pdu, 1);
-		AMAP_SET_BITS(struct amap_iscsi_wrb, type, pwrb, INI_WR_CMD);
+		if (ring_mode)
+			io_task->psgl_handle->type = INI_WR_CMD;
+		else
+			AMAP_SET_BITS(struct amap_iscsi_wrb, type, pwrb,
+				      INI_WR_CMD);
 		AMAP_SET_BITS(struct amap_iscsi_wrb, dsp, pwrb, 1);
 	} else {
-		SE_DEBUG(DBG_LVL_4, "READ Command \t");
-		AMAP_SET_BITS(struct amap_iscsi_wrb, type, pwrb, INI_RD_CMD);
+		if (ring_mode)
+			io_task->psgl_handle->type = INI_RD_CMD;
+		else
+			AMAP_SET_BITS(struct amap_iscsi_wrb, type, pwrb,
+				      INI_RD_CMD);
 		AMAP_SET_BITS(struct amap_iscsi_wrb, dsp, pwrb, 0);
 	}
 	memcpy(&io_task->cmd_bhs->iscsi_data_pdu.
@@ -3045,7 +3496,8 @@ static int beiscsi_iotask(struct iscsi_task *task, struct scatterlist *sg,
 	be_dws_le_to_cpu(pwrb, sizeof(struct iscsi_wrb));
 
 	doorbell |= beiscsi_conn->beiscsi_conn_cid & DB_WRB_POST_CID_MASK;
-	doorbell |= (io_task->pwrb_handle->wrb_index &
+	if (!ring_mode)
+		doorbell |= (io_task->pwrb_handle->wrb_index &
 		     DB_DEF_PDU_WRB_INDEX_MASK) << DB_DEF_PDU_WRB_INDEX_SHIFT;
 	doorbell |= 1 << DB_DEF_PDU_NUM_POSTED_SHIFT;
 
@@ -3059,10 +3511,16 @@ static int beiscsi_mtask(struct iscsi_task *task)
 	struct iscsi_conn *conn = task->conn;
 	struct beiscsi_conn *beiscsi_conn = conn->dd_data;
 	struct beiscsi_hba *phba = beiscsi_conn->phba;
+	struct iscsi_session *session;
 	struct iscsi_wrb *pwrb = NULL;
+	struct hwi_controller *phwi_ctrlr;
+	struct hwi_wrb_context *pwrb_context;
+	struct wrb_handle *pwrb_handle;
 	unsigned int doorbell = 0;
+	unsigned int i, cid;
 	struct iscsi_task *aborted_task;
 
+	cid = beiscsi_conn->beiscsi_conn_cid;
 	pwrb = io_task->pwrb_handle->pwrb;
 	AMAP_SET_BITS(struct amap_iscsi_wrb, cmdsn_itt, pwrb,
 		      be32_to_cpu(task->cmdsn));
@@ -3073,38 +3531,63 @@ static int beiscsi_mtask(struct iscsi_task *task)
 
 	switch (task->hdr->opcode & ISCSI_OPCODE_MASK) {
 	case ISCSI_OP_LOGIN:
-		AMAP_SET_BITS(struct amap_iscsi_wrb, type, pwrb, TGT_DM_CMD);
+		if (ring_mode)
+			io_task->psgl_handle->type = TGT_DM_CMD;
+		else
+			AMAP_SET_BITS(struct amap_iscsi_wrb, type, pwrb,
+				      TGT_DM_CMD);
 		AMAP_SET_BITS(struct amap_iscsi_wrb, dmsg, pwrb, 0);
 		AMAP_SET_BITS(struct amap_iscsi_wrb, cmdsn_itt, pwrb, 1);
 		hwi_write_buffer(pwrb, task);
 		break;
 	case ISCSI_OP_NOOP_OUT:
-		AMAP_SET_BITS(struct amap_iscsi_wrb, type, pwrb, INI_RD_CMD);
+		if (ring_mode)
+			io_task->psgl_handle->type = INI_RD_CMD;
+		else
+			AMAP_SET_BITS(struct amap_iscsi_wrb, type, pwrb,
+				      INI_RD_CMD);
 		hwi_write_buffer(pwrb, task);
 		break;
 	case ISCSI_OP_TEXT:
-		AMAP_SET_BITS(struct amap_iscsi_wrb, type, pwrb, INI_WR_CMD);
+		if (ring_mode)
+			io_task->psgl_handle->type = INI_WR_CMD;
+		else
+			AMAP_SET_BITS(struct amap_iscsi_wrb, type, pwrb,
+				      INI_WR_CMD);
 		AMAP_SET_BITS(struct amap_iscsi_wrb, dsp, pwrb, 1);
 		hwi_write_buffer(pwrb, task);
 		break;
 	case ISCSI_OP_SCSI_TMFUNC:
-		aborted_task = iscsi_itt_to_task(conn,
-					((struct iscsi_tm *)task->hdr)->rtt);
+		session = conn->session;
+		i = ((struct iscsi_tm *)task->hdr)->rtt;
+		phwi_ctrlr = phba->phwi_ctrlr;
+		pwrb_context = &phwi_ctrlr->wrb_context[cid];
+		pwrb_handle = pwrb_context->pwrb_handle_basestd[be32_to_cpu(i)
+								>> 16];
+		aborted_task = pwrb_handle->pio_handle;
 		 if (!aborted_task)
 			return 0;
+
 		aborted_io_task = aborted_task->dd_data;
 		if (!aborted_io_task->scsi_cmnd)
 			return 0;
 
 		mgmt_invalidate_icds(phba,
 				     aborted_io_task->psgl_handle->sgl_index,
-				     beiscsi_conn->beiscsi_conn_cid);
-		AMAP_SET_BITS(struct amap_iscsi_wrb, type, pwrb, INI_TMF_CMD);
+				     cid);
+		if (ring_mode)
+			io_task->psgl_handle->type = INI_TMF_CMD;
+		else
+			AMAP_SET_BITS(struct amap_iscsi_wrb, type, pwrb,
+				      INI_TMF_CMD);
 		AMAP_SET_BITS(struct amap_iscsi_wrb, dmsg, pwrb, 0);
 		hwi_write_buffer(pwrb, task);
 		break;
 	case ISCSI_OP_LOGOUT:
 		AMAP_SET_BITS(struct amap_iscsi_wrb, dmsg, pwrb, 0);
+		if (ring_mode)
+			io_task->psgl_handle->type = HWH_TYPE_LOGOUT;
+		else
 		AMAP_SET_BITS(struct amap_iscsi_wrb, type, pwrb,
 				HWH_TYPE_LOGOUT);
 		hwi_write_buffer(pwrb, task);
@@ -3122,8 +3605,9 @@ static int beiscsi_mtask(struct iscsi_task *task)
 		      io_task->pwrb_handle->nxt_wrb_index);
 	be_dws_le_to_cpu(pwrb, sizeof(struct iscsi_wrb));
 
-	doorbell |= beiscsi_conn->beiscsi_conn_cid & DB_WRB_POST_CID_MASK;
-	doorbell |= (io_task->pwrb_handle->wrb_index &
+	doorbell |= cid & DB_WRB_POST_CID_MASK;
+	if (!ring_mode)
+		doorbell |= (io_task->pwrb_handle->wrb_index &
 		     DB_DEF_PDU_WRB_INDEX_MASK) << DB_DEF_PDU_WRB_INDEX_SHIFT;
 	doorbell |= 1 << DB_DEF_PDU_NUM_POSTED_SHIFT;
 	iowrite32(doorbell, phba->db_va + DB_TXULP0_OFFSET);
@@ -3165,9 +3649,14 @@ static int beiscsi_task_xmit(struct iscsi_task *task)
 	return beiscsi_iotask(task, sg, num_sg, xferlen, writedir);
 }
 
+
 static void beiscsi_remove(struct pci_dev *pcidev)
 {
 	struct beiscsi_hba *phba = NULL;
+	struct hwi_controller *phwi_ctrlr;
+	struct hwi_context_memory *phwi_context;
+	struct be_eq_obj *pbe_eq;
+	unsigned int i, msix_vec;
 
 	phba = (struct beiscsi_hba *)pci_get_drvdata(pcidev);
 	if (!phba) {
@@ -3175,12 +3664,24 @@ static void beiscsi_remove(struct pci_dev *pcidev)
 		return;
 	}
 
+	phwi_ctrlr = phba->phwi_ctrlr;
+	phwi_context = phwi_ctrlr->phwi_ctxt;
 	hwi_disable_intr(phba);
-	if (phba->pcidev->irq)
-		free_irq(phba->pcidev->irq, phba);
+	if (phba->msix_enabled) {
+		for (i = 0; i <= phba->num_cpus; i++) {
+			msix_vec = phba->msix_entries[i].vector;
+			free_irq(msix_vec, &phwi_context->be_eq[i]);
+		}
+	} else
+		if (phba->pcidev->irq)
+			free_irq(phba->pcidev->irq, phba);
+	pci_disable_msix(phba->pcidev);
 	destroy_workqueue(phba->wq);
 	if (blk_iopoll_enabled)
-		blk_iopoll_disable(&phba->iopoll);
+		for (i = 0; i < phba->num_cpus; i++) {
+			pbe_eq = &phwi_context->be_eq[i];
+			blk_iopoll_disable(&pbe_eq->iopoll);
+		}
 
 	beiscsi_clean_port(phba);
 	beiscsi_free_mem(phba);
@@ -3194,11 +3695,29 @@ static void beiscsi_remove(struct pci_dev *pcidev)
 	iscsi_host_free(phba->shost);
 }
 
+static void beiscsi_msix_enable(struct beiscsi_hba *phba)
+{
+	int i, status;
+
+	for (i = 0; i <= phba->num_cpus; i++)
+		phba->msix_entries[i].entry = i;
+
+	status = pci_enable_msix(phba->pcidev, phba->msix_entries,
+				 (phba->num_cpus + 1));
+	if (!status)
+		phba->msix_enabled = true;
+
+	return;
+}
+
 static int __devinit beiscsi_dev_probe(struct pci_dev *pcidev,
 				const struct pci_device_id *id)
 {
 	struct beiscsi_hba *phba = NULL;
-	int ret;
+	struct hwi_controller *phwi_ctrlr;
+	struct hwi_context_memory *phwi_context;
+	struct be_eq_obj *pbe_eq;
+	int ret, msix_vec, num_cpus, i;
 
 	ret = beiscsi_enable_pci(pcidev);
 	if (ret < 0) {
@@ -3213,8 +3732,18 @@ static int __devinit beiscsi_dev_probe(struct pci_dev *pcidev,
 			" Failed in beiscsi_hba_alloc \n");
 		goto disable_pci;
 	}
+	SE_DEBUG(DBG_LVL_8, " phba = %p \n", phba);
 
 	pci_set_drvdata(pcidev, phba);
+	if (enable_msix)
+		num_cpus = find_num_cpus();
+	else
+		num_cpus = 1;
+	phba->num_cpus = num_cpus;
+	SE_DEBUG(DBG_LVL_8, "num_cpus = %d \n", phba->num_cpus);
+
+	if (enable_msix)
+		beiscsi_msix_enable(phba);
 	ret = be_ctrl_init(phba, pcidev);
 	if (ret) {
 		shost_printk(KERN_ERR, phba->shost, "beiscsi_dev_probe-"
@@ -3235,7 +3764,7 @@ static int __devinit beiscsi_dev_probe(struct pci_dev *pcidev,
 
 	snprintf(phba->wq_name, sizeof(phba->wq_name), "beiscsi_q_irq%u",
 		 phba->shost->host_no);
-	phba->wq = create_singlethread_workqueue(phba->wq_name);
+	phba->wq = create_workqueue(phba->wq_name);
 	if (!phba->wq) {
 		shost_printk(KERN_ERR, phba->shost, "beiscsi_dev_probe-"
 				"Failed to allocate work queue\n");
@@ -3244,11 +3773,16 @@ static int __devinit beiscsi_dev_probe(struct pci_dev *pcidev,
 
 	INIT_WORK(&phba->work_cqs, beiscsi_process_all_cqs);
 
+	phwi_ctrlr = phba->phwi_ctrlr;
+	phwi_context = phwi_ctrlr->phwi_ctxt;
 	if (blk_iopoll_enabled) {
-		blk_iopoll_init(&phba->iopoll, be_iopoll_budget, be_iopoll);
-		blk_iopoll_enable(&phba->iopoll);
+		for (i = 0; i < phba->num_cpus; i++) {
+			pbe_eq = &phwi_context->be_eq[i];
+			blk_iopoll_init(&pbe_eq->iopoll, be_iopoll_budget,
+					be_iopoll);
+			blk_iopoll_enable(&pbe_eq->iopoll);
+		}
 	}
-
 	ret = beiscsi_init_irqs(phba);
 	if (ret < 0) {
 		shost_printk(KERN_ERR, phba->shost, "beiscsi_dev_probe-"
@@ -3261,17 +3795,26 @@ static int __devinit beiscsi_dev_probe(struct pci_dev *pcidev,
 			     "Failed to hwi_enable_intr\n");
 		goto free_ctrlr;
 	}
-
 	SE_DEBUG(DBG_LVL_8, "\n\n\n SUCCESS - DRIVER LOADED \n\n\n");
 	return 0;
 
 free_ctrlr:
-	if (phba->pcidev->irq)
-		free_irq(phba->pcidev->irq, phba);
+	if (phba->msix_enabled) {
+		for (i = 0; i <= phba->num_cpus; i++) {
+			msix_vec = phba->msix_entries[i].vector;
+			free_irq(msix_vec, &phwi_context->be_eq[i]);
+		}
+	} else
+		if (phba->pcidev->irq)
+			free_irq(phba->pcidev->irq, phba);
+	pci_disable_msix(phba->pcidev);
 free_blkenbld:
 	destroy_workqueue(phba->wq);
 	if (blk_iopoll_enabled)
-		blk_iopoll_disable(&phba->iopoll);
+		for (i = 0; i < phba->num_cpus; i++) {
+			pbe_eq = &phwi_context->be_eq[i];
+			blk_iopoll_disable(&pbe_eq->iopoll);
+		}
 free_twq:
 	beiscsi_clean_port(phba);
 	beiscsi_free_mem(phba);
@@ -3316,7 +3859,7 @@ struct iscsi_transport beiscsi_iscsi_transport = {
 		ISCSI_USERNAME | ISCSI_PASSWORD |
 		ISCSI_USERNAME_IN | ISCSI_PASSWORD_IN |
 		ISCSI_FAST_ABORT | ISCSI_ABORT_TMO |
-		ISCSI_LU_RESET_TMO |
+		ISCSI_LU_RESET_TMO | ISCSI_TGT_RESET_TMO |
 		ISCSI_PING_TMO | ISCSI_RECV_TMO |
 		ISCSI_IFACE_NAME | ISCSI_INITIATOR_NAME,
 	.host_param_mask = ISCSI_HOST_HWADDRESS | ISCSI_HOST_IPADDRESS |
@@ -3351,6 +3894,7 @@ static struct pci_driver beiscsi_pci_driver = {
 	.id_table = beiscsi_pci_id_table
 };
 
+
 static int __init beiscsi_module_init(void)
 {
 	int ret;
@@ -3373,6 +3917,7 @@ static int __init beiscsi_module_init(void)
 			 "beiscsi pci driver.\n");
 		goto unregister_iscsi_transport;
 	}
+	ring_mode = 0;
 	return 0;
 
 unregister_iscsi_transport:
diff --git a/drivers/scsi/be2iscsi/be_main.h b/drivers/scsi/be2iscsi/be_main.h
index 53c9b70ac7ac..25e6b208b771 100644
--- a/drivers/scsi/be2iscsi/be_main.h
+++ b/drivers/scsi/be2iscsi/be_main.h
@@ -21,11 +21,9 @@
 #ifndef _BEISCSI_MAIN_
 #define _BEISCSI_MAIN_
 
-
 #include <linux/kernel.h>
 #include <linux/pci.h>
 #include <linux/in.h>
-#include <linux/blk-iopoll.h>
 #include <scsi/scsi.h>
 #include <scsi/scsi_cmnd.h>
 #include <scsi/scsi_device.h>
@@ -35,12 +33,8 @@
 #include <scsi/scsi_transport_iscsi.h>
 
 #include "be.h"
-
-
-
 #define DRV_NAME		"be2iscsi"
 #define BUILD_STR		"2.0.527.0"
-
 #define BE_NAME			"ServerEngines BladeEngine2" \
 				"Linux iSCSI Driver version" BUILD_STR
 #define DRV_DESC		BE_NAME " " "Driver"
@@ -49,6 +43,8 @@
 #define BE_DEVICE_ID1		0x212
 #define OC_DEVICE_ID1		0x702
 #define OC_DEVICE_ID2		0x703
+#define OC_DEVICE_ID3		0x712
+#define OC_DEVICE_ID4		0x222
 
 #define BE2_MAX_SESSIONS	64
 #define BE2_CMDS_PER_CXN	128
@@ -63,6 +59,7 @@
 #define BE2_IO_DEPTH \
 	(BE2_MAX_ICDS / 2 - (BE2_LOGOUTS + BE2_TMFS + BE2_NOPOUT_REQ))
 
+#define MAX_CPUS		31
 #define BEISCSI_SGLIST_ELEMENTS	BE2_SGE
 
 #define BEISCSI_MAX_CMNDS	1024	/* Max IO's per Ctrlr sht->can_queue */
@@ -79,7 +76,7 @@
 #define BE_SENSE_INFO_SIZE		258
 #define BE_ISCSI_PDU_HEADER_SIZE	64
 #define BE_MIN_MEM_SIZE			16384
-
+#define MAX_CMD_SZ			65536
 #define IIOC_SCSI_DATA                  0x05	/* Write Operation */
 
 #define DBG_LVL				0x00000001
@@ -100,6 +97,8 @@ do {							\
 	}						\
 } while (0);
 
+#define BE_ADAPTER_UP		0x00000000
+#define BE_ADAPTER_LINK_DOWN	0x00000001
 /**
  * hardware needs the async PDU buffers to be posted in multiples of 8
  * So have atleast 8 of them by default
@@ -160,21 +159,19 @@ do {							\
 
 enum be_mem_enum {
 	HWI_MEM_ADDN_CONTEXT,
-	HWI_MEM_CQ,
-	HWI_MEM_EQ,
 	HWI_MEM_WRB,
 	HWI_MEM_WRBH,
-	HWI_MEM_SGLH,	/* 5 */
+	HWI_MEM_SGLH,
 	HWI_MEM_SGE,
-	HWI_MEM_ASYNC_HEADER_BUF,
+	HWI_MEM_ASYNC_HEADER_BUF, 	/* 5 */
 	HWI_MEM_ASYNC_DATA_BUF,
 	HWI_MEM_ASYNC_HEADER_RING,
-	HWI_MEM_ASYNC_DATA_RING,	/* 10 */
+	HWI_MEM_ASYNC_DATA_RING,
 	HWI_MEM_ASYNC_HEADER_HANDLE,
-	HWI_MEM_ASYNC_DATA_HANDLE,
+	HWI_MEM_ASYNC_DATA_HANDLE, 	/* 10 */
 	HWI_MEM_ASYNC_PDU_CONTEXT,
 	ISCSI_MEM_GLOBAL_HEADER,
-	SE_MEM_MAX  	/* 15 */
+	SE_MEM_MAX
 };
 
 struct be_bus_address32 {
@@ -212,6 +209,9 @@ struct be_mem_descriptor {
 
 struct sgl_handle {
 	unsigned int sgl_index;
+	unsigned int type;
+	unsigned int cid;
+	struct iscsi_task *task;
 	struct iscsi_sge *pfrag;
 };
 
@@ -274,13 +274,17 @@ struct beiscsi_hba {
 	struct pci_dev *pcidev;
 	unsigned int state;
 	unsigned short asic_revision;
-	struct blk_iopoll	iopoll;
+	unsigned int num_cpus;
+	unsigned int nxt_cqid;
+	struct msix_entry msix_entries[MAX_CPUS + 1];
+	bool msix_enabled;
 	struct be_mem_descriptor *init_mem;
 
 	unsigned short io_sgl_alloc_index;
 	unsigned short io_sgl_free_index;
 	unsigned short io_sgl_hndl_avbl;
 	struct sgl_handle **io_sgl_hndl_base;
+	struct sgl_handle **sgl_hndl_array;
 
 	unsigned short eh_sgl_alloc_index;
 	unsigned short eh_sgl_free_index;
@@ -315,6 +319,7 @@ struct beiscsi_hba {
 		unsigned short cid_alloc;
 		unsigned short cid_free;
 		unsigned short avlbl_cids;
+		unsigned short iscsi_features;
 		spinlock_t cid_lock;
 	} fw_config;
 
@@ -343,6 +348,7 @@ struct beiscsi_conn {
 	unsigned short login_in_progress;
 	struct sgl_handle *plogin_sgl_handle;
 	struct beiscsi_session *beiscsi_sess;
+	struct iscsi_task *task;
 };
 
 /* This structure is used by the chip */
@@ -390,7 +396,7 @@ struct beiscsi_io_task {
 	unsigned int flags;
 	unsigned short cid;
 	unsigned short header_len;
-
+	itt_t libiscsi_itt;
 	struct be_cmd_bhs *cmd_bhs;
 	struct be_bus_address bhs_pa;
 	unsigned short bhs_len;
@@ -599,7 +605,6 @@ struct amap_cq_db {
 
 void beiscsi_process_eq(struct beiscsi_hba *phba);
 
-
 struct iscsi_wrb {
 	u32 dw[16];
 } __packed;
@@ -820,10 +825,12 @@ struct wrb_handle {
 };
 
 struct hwi_context_memory {
-	struct be_eq_obj be_eq;
-	struct be_queue_info be_cq;
-	struct be_queue_info be_mcc_cq;
-	struct be_queue_info be_mcc;
+	/* Adaptive interrupt coalescing (AIC) info */
+	u16 min_eqd;		/* in usecs */
+	u16 max_eqd;		/* in usecs */
+	u16 cur_eqd;		/* in usecs */
+	struct be_eq_obj be_eq[MAX_CPUS];
+	struct be_queue_info be_cq[MAX_CPUS];
 
 	struct be_queue_info be_def_hdrq;
 	struct be_queue_info be_def_dataq;
diff --git a/drivers/scsi/be2iscsi/be_mgmt.c b/drivers/scsi/be2iscsi/be_mgmt.c
index 12e644fc746e..79c2bd525a84 100644
--- a/drivers/scsi/be2iscsi/be_mgmt.c
+++ b/drivers/scsi/be2iscsi/be_mgmt.c
@@ -35,7 +35,6 @@ unsigned char mgmt_get_fw_config(struct be_ctrl_info *ctrl,
 
 	be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
 			   OPCODE_COMMON_QUERY_FIRMWARE_CONFIG, sizeof(*req));
-
 	status = be_mbox_notify(ctrl);
 	if (!status) {
 		struct be_fw_cfg *pfw_cfg;
@@ -58,7 +57,8 @@ unsigned char mgmt_get_fw_config(struct be_ctrl_info *ctrl,
 	return status;
 }
 
-unsigned char mgmt_check_supported_fw(struct be_ctrl_info *ctrl)
+unsigned char mgmt_check_supported_fw(struct be_ctrl_info *ctrl,
+				      struct beiscsi_hba *phba)
 {
 	struct be_dma_mem nonemb_cmd;
 	struct be_mcc_wrb *wrb = wrb_from_mbox(&ctrl->mbox_mem);
@@ -85,7 +85,6 @@ unsigned char mgmt_check_supported_fw(struct be_ctrl_info *ctrl)
 	sge->pa_hi = cpu_to_le32(upper_32_bits(nonemb_cmd.dma));
 	sge->pa_lo = cpu_to_le32(nonemb_cmd.dma & 0xFFFFFFFF);
 	sge->len = cpu_to_le32(nonemb_cmd.size);
-
 	status = be_mbox_notify(ctrl);
 	if (!status) {
 		struct be_mgmt_controller_attributes_resp *resp = nonemb_cmd.va;
@@ -95,21 +94,25 @@ unsigned char mgmt_check_supported_fw(struct be_ctrl_info *ctrl)
 			resp->params.hba_attribs.firmware_version_string);
 		SE_DEBUG(DBG_LVL_8,
 			"Developer Build, not performing version check...\n");
-
+		phba->fw_config.iscsi_features =
+				resp->params.hba_attribs.iscsi_features;
+		SE_DEBUG(DBG_LVL_8, " phba->fw_config.iscsi_features = %d\n",
+				      phba->fw_config.iscsi_features);
 	} else
 		SE_DEBUG(DBG_LVL_1, " Failed in mgmt_check_supported_fw\n");
+	spin_unlock(&ctrl->mbox_lock);
 	if (nonemb_cmd.va)
 		pci_free_consistent(ctrl->pdev, nonemb_cmd.size,
 				    nonemb_cmd.va, nonemb_cmd.dma);
 
-	spin_unlock(&ctrl->mbox_lock);
 	return status;
 }
 
+
 unsigned char mgmt_epfw_cleanup(struct beiscsi_hba *phba, unsigned short chute)
 {
 	struct be_ctrl_info *ctrl = &phba->ctrl;
-	struct be_mcc_wrb *wrb = wrb_from_mbox(&ctrl->mbox_mem);
+	struct be_mcc_wrb *wrb = wrb_from_mccq(phba);
 	struct iscsi_cleanup_req *req = embedded_payload(wrb);
 	int status = 0;
 
@@ -124,7 +127,7 @@ unsigned char mgmt_epfw_cleanup(struct beiscsi_hba *phba, unsigned short chute)
 	req->hdr_ring_id = 0;
 	req->data_ring_id = 0;
 
-	status = be_mbox_notify(ctrl);
+	status =  be_mcc_notify_wait(phba);
 	if (status)
 		shost_printk(KERN_WARNING, phba->shost,
 			     " mgmt_epfw_cleanup , FAILED\n");
@@ -137,7 +140,7 @@ unsigned char mgmt_invalidate_icds(struct beiscsi_hba *phba,
 {
 	struct be_dma_mem nonemb_cmd;
 	struct be_ctrl_info *ctrl = &phba->ctrl;
-	struct be_mcc_wrb *wrb = wrb_from_mbox(&ctrl->mbox_mem);
+	struct be_mcc_wrb *wrb = wrb_from_mccq(phba);
 	struct be_sge *sge = nonembedded_sgl(wrb);
 	struct invalidate_commands_params_in *req;
 	int status = 0;
@@ -169,7 +172,7 @@ unsigned char mgmt_invalidate_icds(struct beiscsi_hba *phba,
 	sge->pa_lo = cpu_to_le32(nonemb_cmd.dma & 0xFFFFFFFF);
 	sge->len = cpu_to_le32(nonemb_cmd.size);
 
-	status = be_mbox_notify(ctrl);
+	status = be_mcc_notify_wait(phba);
 	if (status)
 		SE_DEBUG(DBG_LVL_1, "ICDS Invalidation Failed\n");
 	spin_unlock(&ctrl->mbox_lock);
@@ -186,7 +189,7 @@ unsigned char mgmt_invalidate_connection(struct beiscsi_hba *phba,
 					 unsigned short savecfg_flag)
 {
 	struct be_ctrl_info *ctrl = &phba->ctrl;
-	struct be_mcc_wrb *wrb = wrb_from_mbox(&ctrl->mbox_mem);
+	struct be_mcc_wrb *wrb = wrb_from_mccq(phba);
 	struct iscsi_invalidate_connection_params_in *req =
 						embedded_payload(wrb);
 	int status = 0;
@@ -205,7 +208,7 @@ unsigned char mgmt_invalidate_connection(struct beiscsi_hba *phba,
 	else
 		req->cleanup_type = CMD_ISCSI_CONNECTION_INVALIDATE;
 	req->save_cfg = savecfg_flag;
-	status = be_mbox_notify(ctrl);
+	status =  be_mcc_notify_wait(phba);
 	if (status)
 		SE_DEBUG(DBG_LVL_1, "Invalidation Failed\n");
 
@@ -217,7 +220,7 @@ unsigned char mgmt_upload_connection(struct beiscsi_hba *phba,
 				unsigned short cid, unsigned int upload_flag)
 {
 	struct be_ctrl_info *ctrl = &phba->ctrl;
-	struct be_mcc_wrb *wrb = wrb_from_mbox(&ctrl->mbox_mem);
+	struct be_mcc_wrb *wrb = wrb_from_mccq(phba);
 	struct tcp_upload_params_in *req = embedded_payload(wrb);
 	int status = 0;
 
@@ -229,7 +232,7 @@ unsigned char mgmt_upload_connection(struct beiscsi_hba *phba,
 			   OPCODE_COMMON_TCP_UPLOAD, sizeof(*req));
 	req->id = (unsigned short)cid;
 	req->upload_type = (unsigned char)upload_flag;
-	status = be_mbox_notify(ctrl);
+	status = be_mcc_notify_wait(phba);
 	if (status)
 		SE_DEBUG(DBG_LVL_1, "mgmt_upload_connection Failed\n");
 	spin_unlock(&ctrl->mbox_lock);
@@ -245,13 +248,14 @@ int mgmt_open_connection(struct beiscsi_hba *phba,
 	struct sockaddr_in *daddr_in = (struct sockaddr_in *)dst_addr;
 	struct sockaddr_in6 *daddr_in6 = (struct sockaddr_in6 *)dst_addr;
 	struct be_ctrl_info *ctrl = &phba->ctrl;
-	struct be_mcc_wrb *wrb = wrb_from_mbox(&ctrl->mbox_mem);
+	struct be_mcc_wrb *wrb = wrb_from_mccq(phba);
 	struct tcp_connect_and_offload_in *req = embedded_payload(wrb);
 	unsigned short def_hdr_id;
 	unsigned short def_data_id;
 	struct phys_addr template_address = { 0, 0 };
 	struct phys_addr *ptemplate_address;
 	int status = 0;
+	unsigned int i;
 	unsigned short cid = beiscsi_ep->ep_cid;
 
 	phwi_ctrlr = phba->phwi_ctrlr;
@@ -296,14 +300,18 @@ int mgmt_open_connection(struct beiscsi_hba *phba,
 
 	}
 	req->cid = cid;
-	req->cq_id = phwi_context->be_cq.id;
+	i = phba->nxt_cqid++;
+	if (phba->nxt_cqid == phba->num_cpus)
+		phba->nxt_cqid = 0;
+	req->cq_id = phwi_context->be_cq[i].id;
+	SE_DEBUG(DBG_LVL_8, "i=%d cq_id=%d \n", i, req->cq_id);
 	req->defq_id = def_hdr_id;
 	req->hdr_ring_id = def_hdr_id;
 	req->data_ring_id = def_data_id;
 	req->do_offload = 1;
 	req->dataout_template_pa.lo = ptemplate_address->lo;
 	req->dataout_template_pa.hi = ptemplate_address->hi;
-	status = be_mbox_notify(ctrl);
+	status = be_mcc_notify_wait(phba);
 	if (!status) {
 		struct iscsi_endpoint *ep;
 		struct tcp_connect_and_offload_out *ptcpcnct_out =
@@ -311,7 +319,7 @@ int mgmt_open_connection(struct beiscsi_hba *phba,
 
 		ep = phba->ep_array[ptcpcnct_out->cid];
 		beiscsi_ep = ep->dd_data;
-		beiscsi_ep->fw_handle = 0;
+		beiscsi_ep->fw_handle = ptcpcnct_out->connection_handle;
 		beiscsi_ep->cid_vld = 1;
 		SE_DEBUG(DBG_LVL_8, "mgmt_open_connection Success\n");
 	} else
@@ -319,3 +327,30 @@ int mgmt_open_connection(struct beiscsi_hba *phba,
 	spin_unlock(&ctrl->mbox_lock);
 	return status;
 }
+
+int be_cmd_get_mac_addr(struct beiscsi_hba *phba, u8 *mac_addr)
+{
+	struct be_ctrl_info *ctrl = &phba->ctrl;
+	struct be_mcc_wrb *wrb = wrb_from_mccq(phba);
+	struct be_cmd_req_get_mac_addr *req = embedded_payload(wrb);
+	int status;
+
+	SE_DEBUG(DBG_LVL_8, "In be_cmd_get_mac_addr\n");
+	spin_lock(&ctrl->mbox_lock);
+	memset(wrb, 0, sizeof(*wrb));
+	be_wrb_hdr_prepare(wrb, sizeof(*req), true, 0);
+	be_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_ISCSI,
+			   OPCODE_COMMON_ISCSI_NTWK_GET_NIC_CONFIG,
+			   sizeof(*req));
+
+	status = be_mcc_notify_wait(phba);
+	if (!status) {
+		struct be_cmd_resp_get_mac_addr *resp = embedded_payload(wrb);
+
+		memcpy(mac_addr, resp->mac_address, ETH_ALEN);
+	}
+
+	spin_unlock(&ctrl->mbox_lock);
+	return status;
+}
+
diff --git a/drivers/scsi/be2iscsi/be_mgmt.h b/drivers/scsi/be2iscsi/be_mgmt.h
index 00e816ee8070..24eaff923f85 100644
--- a/drivers/scsi/be2iscsi/be_mgmt.h
+++ b/drivers/scsi/be2iscsi/be_mgmt.h
@@ -175,7 +175,9 @@ struct mgmt_hba_attributes {
 	u8 phy_port;
 	u32 firmware_post_status;
 	u32 hba_mtu[8];
-	u32 future_u32[4];
+	u8 iscsi_features;
+	u8 future_u8[3];
+	u32 future_u32[3];
 } __packed;
 
 struct mgmt_controller_attributes {
@@ -246,4 +248,8 @@ unsigned char mgmt_invalidate_connection(struct beiscsi_hba *phba,
 					 unsigned short cid,
 					 unsigned short issue_reset,
 					 unsigned short savecfg_flag);
+
+unsigned char mgmt_fw_cmd(struct be_ctrl_info *ctrl,
+			  struct beiscsi_hba *phba,
+			  char *buf, unsigned int len);
 #endif
diff --git a/drivers/scsi/bfa/bfa_cb_ioim_macros.h b/drivers/scsi/bfa/bfa_cb_ioim_macros.h
index 0050c838c358..961fe439daad 100644
--- a/drivers/scsi/bfa/bfa_cb_ioim_macros.h
+++ b/drivers/scsi/bfa/bfa_cb_ioim_macros.h
@@ -51,7 +51,7 @@ bfad_int_to_lun(u32 luno)
 	lun.bfa_lun     = 0;
 	lun.scsi_lun[0] = bfa_os_htons(luno);
 
-	return (lun.bfa_lun);
+	return lun.bfa_lun;
 }
 
 /**
@@ -68,7 +68,7 @@ bfa_cb_ioim_get_cdb(struct bfad_ioim_s *dio)
 {
 	struct scsi_cmnd *cmnd = (struct scsi_cmnd *)dio;
 
-	return ((u8 *) cmnd->cmnd);
+	return (u8 *) cmnd->cmnd;
 }
 
 /**
@@ -97,7 +97,7 @@ bfa_cb_ioim_get_size(struct bfad_ioim_s *dio)
 {
 	struct scsi_cmnd *cmnd = (struct scsi_cmnd *)dio;
 
-	return (scsi_bufflen(cmnd));
+	return scsi_bufflen(cmnd);
 }
 
 /**
@@ -129,7 +129,7 @@ bfa_cb_ioim_get_sgaddr(struct bfad_ioim_s *dio, int sgeid)
 	sge = (struct scatterlist *)scsi_sglist(cmnd) + sgeid;
 	addr = (u64) sg_dma_address(sge);
 
-	return (*(union bfi_addr_u *) &addr);
+	return *((union bfi_addr_u *) &addr);
 }
 
 static inline u32
@@ -197,7 +197,7 @@ bfa_cb_ioim_get_cdblen(struct bfad_ioim_s *dio)
 {
 	struct scsi_cmnd *cmnd = (struct scsi_cmnd *)dio;
 
-	return (cmnd->cmd_len);
+	return cmnd->cmd_len;
 }
 
 
diff --git a/drivers/scsi/bfa/bfa_cee.c b/drivers/scsi/bfa/bfa_cee.c
index 7a959c34e789..2b917792c6bc 100644
--- a/drivers/scsi/bfa/bfa_cee.c
+++ b/drivers/scsi/bfa/bfa_cee.c
@@ -228,7 +228,7 @@ bfa_cee_reset_stats_isr(struct bfa_cee_s *cee, bfa_status_t status)
 u32
 bfa_cee_meminfo(void)
 {
-	return (bfa_cee_attr_meminfo() + bfa_cee_stats_meminfo());
+	return bfa_cee_attr_meminfo() + bfa_cee_stats_meminfo();
 }
 
 /**
diff --git a/drivers/scsi/bfa/bfa_csdebug.c b/drivers/scsi/bfa/bfa_csdebug.c
index 1b71d349451a..caeb1143a4e6 100644
--- a/drivers/scsi/bfa/bfa_csdebug.c
+++ b/drivers/scsi/bfa/bfa_csdebug.c
@@ -47,12 +47,12 @@ bfa_q_is_on_q_func(struct list_head *q, struct list_head *qe)
 	tqe = bfa_q_next(q);
 	while (tqe != q) {
 		if (tqe == qe)
-			return (1);
+			return 1;
 		tqe = bfa_q_next(tqe);
 		if (tqe == NULL)
 			break;
 	}
-	return (0);
+	return 0;
 }
 
 
diff --git a/drivers/scsi/bfa/bfa_fcpim.c b/drivers/scsi/bfa/bfa_fcpim.c
index 401babe3494e..790c945aeae6 100644
--- a/drivers/scsi/bfa/bfa_fcpim.c
+++ b/drivers/scsi/bfa/bfa_fcpim.c
@@ -131,7 +131,7 @@ bfa_fcpim_path_tov_get(struct bfa_s *bfa)
 {
 	struct bfa_fcpim_mod_s *fcpim = BFA_FCPIM_MOD(bfa);
 
-	return (fcpim->path_tov / 1000);
+	return fcpim->path_tov / 1000;
 }
 
 bfa_status_t
@@ -169,7 +169,7 @@ bfa_fcpim_qdepth_get(struct bfa_s *bfa)
 {
 	struct bfa_fcpim_mod_s *fcpim = BFA_FCPIM_MOD(bfa);
 
-	return (fcpim->q_depth);
+	return fcpim->q_depth;
 }
 
 
diff --git a/drivers/scsi/bfa/bfa_fcpim_priv.h b/drivers/scsi/bfa/bfa_fcpim_priv.h
index 153206cfb37a..5cf418460f75 100644
--- a/drivers/scsi/bfa/bfa_fcpim_priv.h
+++ b/drivers/scsi/bfa/bfa_fcpim_priv.h
@@ -35,7 +35,7 @@
 #define BFA_FCPIM_PATHTOV_MAX	(90 * 1000)	/* in millisecs */
 
 #define bfa_fcpim_stats(__fcpim, __stats)   \
-    (__fcpim)->stats.__stats ++
+    ((__fcpim)->stats.__stats++)
 
 struct bfa_fcpim_mod_s {
 	struct bfa_s 	*bfa;
@@ -143,7 +143,7 @@ struct bfa_itnim_s {
 	struct bfa_itnim_hal_stats_s	stats;
 };
 
-#define bfa_itnim_is_online(_itnim) (_itnim)->is_online
+#define bfa_itnim_is_online(_itnim) ((_itnim)->is_online)
 #define BFA_FCPIM_MOD(_hal) (&(_hal)->modules.fcpim_mod)
 #define BFA_IOIM_FROM_TAG(_fcpim, _iotag)	\
 	(&fcpim->ioim_arr[_iotag])
diff --git a/drivers/scsi/bfa/bfa_fcport.c b/drivers/scsi/bfa/bfa_fcport.c
index 992435987deb..aef648b55dfc 100644
--- a/drivers/scsi/bfa/bfa_fcport.c
+++ b/drivers/scsi/bfa/bfa_fcport.c
@@ -388,32 +388,29 @@ bfa_pport_sm_linkup(struct bfa_pport_s *pport, enum bfa_pport_sm_event event)
 		bfa_pport_callback(pport, BFA_PPORT_LINKDOWN);
 		bfa_plog_str(pport->bfa->plog, BFA_PL_MID_HAL,
 			     BFA_PL_EID_PORT_ST_CHANGE, 0, "Port Linkdown");
-		if (BFA_PORT_IS_DISABLED(pport->bfa)) {
+		if (BFA_PORT_IS_DISABLED(pport->bfa))
 			bfa_pport_aen_post(pport, BFA_PORT_AEN_OFFLINE);
-		} else {
+		else
 			bfa_pport_aen_post(pport, BFA_PORT_AEN_DISCONNECT);
-		}
 		break;
 
 	case BFA_PPORT_SM_STOP:
 		bfa_sm_set_state(pport, bfa_pport_sm_stopped);
 		bfa_pport_reset_linkinfo(pport);
-		if (BFA_PORT_IS_DISABLED(pport->bfa)) {
+		if (BFA_PORT_IS_DISABLED(pport->bfa))
 			bfa_pport_aen_post(pport, BFA_PORT_AEN_OFFLINE);
-		} else {
+		else
 			bfa_pport_aen_post(pport, BFA_PORT_AEN_DISCONNECT);
-		}
 		break;
 
 	case BFA_PPORT_SM_HWFAIL:
 		bfa_sm_set_state(pport, bfa_pport_sm_iocdown);
 		bfa_pport_reset_linkinfo(pport);
 		bfa_pport_callback(pport, BFA_PPORT_LINKDOWN);
-		if (BFA_PORT_IS_DISABLED(pport->bfa)) {
+		if (BFA_PORT_IS_DISABLED(pport->bfa))
 			bfa_pport_aen_post(pport, BFA_PORT_AEN_OFFLINE);
-		} else {
+		else
 			bfa_pport_aen_post(pport, BFA_PORT_AEN_DISCONNECT);
-		}
 		break;
 
 	default:
@@ -999,10 +996,10 @@ bfa_pport_enable(struct bfa_s *bfa)
 	struct bfa_pport_s *pport = BFA_PORT_MOD(bfa);
 
 	if (pport->diag_busy)
-		return (BFA_STATUS_DIAG_BUSY);
+		return BFA_STATUS_DIAG_BUSY;
 	else if (bfa_sm_cmp_state
 		 (BFA_PORT_MOD(bfa), bfa_pport_sm_disabling_qwait))
-		return (BFA_STATUS_DEVBUSY);
+		return BFA_STATUS_DEVBUSY;
 
 	bfa_sm_send_event(BFA_PORT_MOD(bfa), BFA_PPORT_SM_ENABLE);
 	return BFA_STATUS_OK;
@@ -1032,7 +1029,7 @@ bfa_pport_cfg_speed(struct bfa_s *bfa, enum bfa_pport_speed speed)
 
 	pport->cfg.speed = speed;
 
-	return (BFA_STATUS_OK);
+	return BFA_STATUS_OK;
 }
 
 /**
@@ -1068,7 +1065,7 @@ bfa_pport_cfg_topology(struct bfa_s *bfa, enum bfa_pport_topology topology)
 	}
 
 	pport->cfg.topology = topology;
-	return (BFA_STATUS_OK);
+	return BFA_STATUS_OK;
 }
 
 /**
@@ -1094,7 +1091,7 @@ bfa_pport_cfg_hardalpa(struct bfa_s *bfa, u8 alpa)
 	pport->cfg.cfg_hardalpa = BFA_TRUE;
 	pport->cfg.hardalpa = alpa;
 
-	return (BFA_STATUS_OK);
+	return BFA_STATUS_OK;
 }
 
 bfa_status_t
@@ -1106,7 +1103,7 @@ bfa_pport_clr_hardalpa(struct bfa_s *bfa)
 	bfa_trc(bfa, pport->cfg.hardalpa);
 
 	pport->cfg.cfg_hardalpa = BFA_FALSE;
-	return (BFA_STATUS_OK);
+	return BFA_STATUS_OK;
 }
 
 bfa_boolean_t
@@ -1138,16 +1135,16 @@ bfa_pport_cfg_maxfrsize(struct bfa_s *bfa, u16 maxfrsize)
 	 * with in range
 	 */
 	if ((maxfrsize > FC_MAX_PDUSZ) || (maxfrsize < FC_MIN_PDUSZ))
-		return (BFA_STATUS_INVLD_DFSZ);
+		return BFA_STATUS_INVLD_DFSZ;
 
 	/*
 	 * power of 2, if not the max frame size of 2112
 	 */
 	if ((maxfrsize != FC_MAX_PDUSZ) && (maxfrsize & (maxfrsize - 1)))
-		return (BFA_STATUS_INVLD_DFSZ);
+		return BFA_STATUS_INVLD_DFSZ;
 
 	pport->cfg.maxfrsize = maxfrsize;
-	return (BFA_STATUS_OK);
+	return BFA_STATUS_OK;
 }
 
 u16
@@ -1415,7 +1412,7 @@ bfa_pport_get_stats(struct bfa_s *bfa, union bfa_pport_stats_u *stats,
 
 	if (port->stats_busy) {
 		bfa_trc(bfa, port->stats_busy);
-		return (BFA_STATUS_DEVBUSY);
+		return BFA_STATUS_DEVBUSY;
 	}
 
 	port->stats_busy = BFA_TRUE;
@@ -1427,7 +1424,7 @@ bfa_pport_get_stats(struct bfa_s *bfa, union bfa_pport_stats_u *stats,
 
 	bfa_timer_start(bfa, &port->timer, bfa_port_stats_timeout, port,
 			BFA_PORT_STATS_TOV);
-	return (BFA_STATUS_OK);
+	return BFA_STATUS_OK;
 }
 
 bfa_status_t
@@ -1437,7 +1434,7 @@ bfa_pport_clear_stats(struct bfa_s *bfa, bfa_cb_pport_t cbfn, void *cbarg)
 
 	if (port->stats_busy) {
 		bfa_trc(bfa, port->stats_busy);
-		return (BFA_STATUS_DEVBUSY);
+		return BFA_STATUS_DEVBUSY;
 	}
 
 	port->stats_busy = BFA_TRUE;
@@ -1448,7 +1445,7 @@ bfa_pport_clear_stats(struct bfa_s *bfa, bfa_cb_pport_t cbfn, void *cbarg)
 
 	bfa_timer_start(bfa, &port->timer, bfa_port_stats_clr_timeout, port,
 			BFA_PORT_STATS_TOV);
-	return (BFA_STATUS_OK);
+	return BFA_STATUS_OK;
 }
 
 bfa_status_t
@@ -1515,7 +1512,7 @@ bfa_pport_get_qos_stats(struct bfa_s *bfa, union bfa_pport_stats_u *stats,
 	/*
 	 * QoS stats is embedded in port stats
 	 */
-	return (bfa_pport_get_stats(bfa, stats, cbfn, cbarg));
+	return bfa_pport_get_stats(bfa, stats, cbfn, cbarg);
 }
 
 bfa_status_t
@@ -1525,7 +1522,7 @@ bfa_pport_clear_qos_stats(struct bfa_s *bfa, bfa_cb_pport_t cbfn, void *cbarg)
 
 	if (port->stats_busy) {
 		bfa_trc(bfa, port->stats_busy);
-		return (BFA_STATUS_DEVBUSY);
+		return BFA_STATUS_DEVBUSY;
 	}
 
 	port->stats_busy = BFA_TRUE;
@@ -1536,7 +1533,7 @@ bfa_pport_clear_qos_stats(struct bfa_s *bfa, bfa_cb_pport_t cbfn, void *cbarg)
 
 	bfa_timer_start(bfa, &port->timer, bfa_port_stats_clr_timeout, port,
 			BFA_PORT_STATS_TOV);
-	return (BFA_STATUS_OK);
+	return BFA_STATUS_OK;
 }
 
 /**
@@ -1545,7 +1542,7 @@ bfa_pport_clear_qos_stats(struct bfa_s *bfa, bfa_cb_pport_t cbfn, void *cbarg)
 bfa_status_t
 bfa_pport_trunk_disable(struct bfa_s *bfa)
 {
-	return (BFA_STATUS_OK);
+	return BFA_STATUS_OK;
 }
 
 bfa_boolean_t
@@ -1562,8 +1559,8 @@ bfa_pport_is_disabled(struct bfa_s *bfa)
 {
 	struct bfa_pport_s *port = BFA_PORT_MOD(bfa);
 
-	return (bfa_sm_to_state(hal_pport_sm_table, port->sm) ==
-		BFA_PPORT_ST_DISABLED);
+	return bfa_sm_to_state(hal_pport_sm_table, port->sm) ==
+		BFA_PPORT_ST_DISABLED;
 
 }
 
@@ -1572,7 +1569,7 @@ bfa_pport_is_ratelim(struct bfa_s *bfa)
 {
 	struct bfa_pport_s *pport = BFA_PORT_MOD(bfa);
 
-return (pport->cfg.ratelimit ? BFA_TRUE : BFA_FALSE);
+	return pport->cfg.ratelimit ? BFA_TRUE : BFA_FALSE;
 
 }
 
@@ -1620,7 +1617,7 @@ bfa_pport_cfg_ratelim_speed(struct bfa_s *bfa, enum bfa_pport_speed speed)
 
 	pport->cfg.trl_def_speed = speed;
 
-	return (BFA_STATUS_OK);
+	return BFA_STATUS_OK;
 }
 
 /**
@@ -1632,7 +1629,7 @@ bfa_pport_get_ratelim_speed(struct bfa_s *bfa)
 	struct bfa_pport_s *pport = BFA_PORT_MOD(bfa);
 
 	bfa_trc(bfa, pport->cfg.trl_def_speed);
-	return (pport->cfg.trl_def_speed);
+	return pport->cfg.trl_def_speed;
 
 }
 
diff --git a/drivers/scsi/bfa/bfa_fcs_lport.c b/drivers/scsi/bfa/bfa_fcs_lport.c
index 8975ed041dc0..c7ab257f10a7 100644
--- a/drivers/scsi/bfa/bfa_fcs_lport.c
+++ b/drivers/scsi/bfa/bfa_fcs_lport.c
@@ -568,11 +568,10 @@ bfa_fcs_port_offline_actions(struct bfa_fcs_port_s *port)
 
 	__port_action[port->fabric->fab_type].offline(port);
 
-	if (bfa_fcs_fabric_is_online(port->fabric) == BFA_TRUE) {
+	if (bfa_fcs_fabric_is_online(port->fabric) == BFA_TRUE)
 		bfa_fcs_port_aen_post(port, BFA_LPORT_AEN_DISCONNECT);
-	} else {
+	else
 		bfa_fcs_port_aen_post(port, BFA_LPORT_AEN_OFFLINE);
-	}
 	bfa_fcb_port_offline(port->fcs->bfad, port->port_cfg.roles,
 			port->fabric->vf_drv,
 			(port->vport == NULL) ? NULL : port->vport->vport_drv);
@@ -777,7 +776,7 @@ bfa_fcs_port_get_rport_by_pwwn(struct bfa_fcs_port_s *port, wwn_t pwwn)
 	}
 
 	bfa_trc(port->fcs, pwwn);
-	return (NULL);
+	return NULL;
 }
 
 /**
@@ -796,7 +795,7 @@ bfa_fcs_port_get_rport_by_nwwn(struct bfa_fcs_port_s *port, wwn_t nwwn)
 	}
 
 	bfa_trc(port->fcs, nwwn);
-	return (NULL);
+	return NULL;
 }
 
 /**
@@ -870,7 +869,7 @@ bfa_fcs_port_lip(struct bfa_fcs_port_s *port)
 bfa_boolean_t
 bfa_fcs_port_is_online(struct bfa_fcs_port_s *port)
 {
-	return (bfa_sm_cmp_state(port, bfa_fcs_port_sm_online));
+	return bfa_sm_cmp_state(port, bfa_fcs_port_sm_online);
 }
 
 /**
diff --git a/drivers/scsi/bfa/bfa_fcxp.c b/drivers/scsi/bfa/bfa_fcxp.c
index 4754a0e9006a..cf0ad6782686 100644
--- a/drivers/scsi/bfa/bfa_fcxp.c
+++ b/drivers/scsi/bfa/bfa_fcxp.c
@@ -199,7 +199,7 @@ bfa_fcxp_get(struct bfa_fcxp_mod_s *fm)
 	if (fcxp)
 		list_add_tail(&fcxp->qe, &fm->fcxp_active_q);
 
-	return (fcxp);
+	return fcxp;
 }
 
 static void
@@ -503,7 +503,7 @@ bfa_fcxp_alloc(void *caller, struct bfa_s *bfa, int nreq_sgles,
 
 	fcxp = bfa_fcxp_get(BFA_FCXP_MOD(bfa));
 	if (fcxp == NULL)
-		return (NULL);
+		return NULL;
 
 	bfa_trc(bfa, fcxp->fcxp_tag);
 
@@ -568,7 +568,7 @@ bfa_fcxp_alloc(void *caller, struct bfa_s *bfa, int nreq_sgles,
 		}
 	}
 
-	return (fcxp);
+	return fcxp;
 }
 
 /**
@@ -709,7 +709,7 @@ bfa_status_t
 bfa_fcxp_abort(struct bfa_fcxp_s *fcxp)
 {
 	bfa_assert(0);
-	return (BFA_STATUS_OK);
+	return BFA_STATUS_OK;
 }
 
 void
diff --git a/drivers/scsi/bfa/bfa_intr.c b/drivers/scsi/bfa/bfa_intr.c
index 0ca125712a04..b36540e4ed76 100644
--- a/drivers/scsi/bfa/bfa_intr.c
+++ b/drivers/scsi/bfa/bfa_intr.c
@@ -59,7 +59,7 @@ bfa_intx(struct bfa_s *bfa)
 	qintr = intr & __HFN_INT_RME_MASK;
 	bfa_reg_write(bfa->iocfc.bfa_regs.intr_status, qintr);
 
-	for (queue = 0; queue < BFI_IOC_MAX_CQS_ASIC; queue ++) {
+	for (queue = 0; queue < BFI_IOC_MAX_CQS_ASIC; queue++) {
 		if (intr & (__HFN_INT_RME_Q0 << queue))
 			bfa_msix_rspq(bfa, queue & (BFI_IOC_MAX_CQS - 1));
 	}
diff --git a/drivers/scsi/bfa/bfa_intr_priv.h b/drivers/scsi/bfa/bfa_intr_priv.h
index 8ce6e6b105c8..5fc301cf4d1b 100644
--- a/drivers/scsi/bfa/bfa_intr_priv.h
+++ b/drivers/scsi/bfa/bfa_intr_priv.h
@@ -26,9 +26,9 @@ void bfa_isr_unhandled(struct bfa_s *bfa, struct bfi_msg_s *m);
 void bfa_isr_bind(enum bfi_mclass mc, bfa_isr_func_t isr_func);
 
 
-#define bfa_reqq_pi(__bfa, __reqq)	(__bfa)->iocfc.req_cq_pi[__reqq]
+#define bfa_reqq_pi(__bfa, __reqq)	((__bfa)->iocfc.req_cq_pi[__reqq])
 #define bfa_reqq_ci(__bfa, __reqq)					\
-	*(u32 *)((__bfa)->iocfc.req_cq_shadow_ci[__reqq].kva)
+	(*(u32 *)((__bfa)->iocfc.req_cq_shadow_ci[__reqq].kva))
 
 #define bfa_reqq_full(__bfa, __reqq)				\
 	(((bfa_reqq_pi(__bfa, __reqq) + 1) &			\
@@ -50,14 +50,16 @@ void bfa_isr_bind(enum bfi_mclass mc, bfa_isr_func_t isr_func);
 } while (0)
 
 #define bfa_rspq_pi(__bfa, __rspq)					\
-	*(u32 *)((__bfa)->iocfc.rsp_cq_shadow_pi[__rspq].kva)
+	(*(u32 *)((__bfa)->iocfc.rsp_cq_shadow_pi[__rspq].kva))
 
-#define bfa_rspq_ci(__bfa, __rspq)	(__bfa)->iocfc.rsp_cq_ci[__rspq]
+#define bfa_rspq_ci(__bfa, __rspq)	((__bfa)->iocfc.rsp_cq_ci[__rspq])
 #define bfa_rspq_elem(__bfa, __rspq, __ci)				\
-	&((struct bfi_msg_s *)((__bfa)->iocfc.rsp_cq_ba[__rspq].kva))[__ci]
+	(&((struct bfi_msg_s *)((__bfa)->iocfc.rsp_cq_ba[__rspq].kva))[__ci])
 
-#define CQ_INCR(__index, __size)					\
-			(__index)++; (__index) &= ((__size) - 1)
+#define CQ_INCR(__index, __size) do {					\
+			(__index)++;					\
+			(__index) &= ((__size) - 1);      \
+} while (0)
 
 /**
  * Queue element to wait for room in request queue. FIFO order is
@@ -94,7 +96,7 @@ bfa_reqq_winit(struct bfa_reqq_wait_s *wqe, void (*qresume) (void *cbarg),
 	wqe->cbarg = cbarg;
 }
 
-#define bfa_reqq(__bfa, __reqq)	&(__bfa)->reqq_waitq[__reqq]
+#define bfa_reqq(__bfa, __reqq)	(&(__bfa)->reqq_waitq[__reqq])
 
 /**
  * static inline void
diff --git a/drivers/scsi/bfa/bfa_ioc.c b/drivers/scsi/bfa/bfa_ioc.c
index 149348934ce3..397d7e9eade5 100644
--- a/drivers/scsi/bfa/bfa_ioc.c
+++ b/drivers/scsi/bfa/bfa_ioc.c
@@ -51,7 +51,7 @@ BFA_TRC_FILE(HAL, IOC);
 	 (sizeof(struct bfa_trc_mod_s) -			\
 	  BFA_TRC_MAX * sizeof(struct bfa_trc_s)))
 #define BFA_DBG_FWTRC_OFF(_fn)	(BFI_IOC_TRC_OFF + BFA_DBG_FWTRC_LEN * (_fn))
-#define bfa_ioc_stats(_ioc, _stats)	(_ioc)->stats._stats ++
+#define bfa_ioc_stats(_ioc, _stats)	((_ioc)->stats._stats++)
 
 #define BFA_FLASH_CHUNK_NO(off)         (off / BFI_FLASH_CHUNK_SZ_WORDS)
 #define BFA_FLASH_OFFSET_IN_CHUNK(off)  (off % BFI_FLASH_CHUNK_SZ_WORDS)
@@ -1953,8 +1953,8 @@ bfa_ioc_error_isr(struct bfa_ioc_s *ioc)
 bfa_boolean_t
 bfa_ioc_is_disabled(struct bfa_ioc_s *ioc)
 {
-	return (bfa_fsm_cmp_state(ioc, bfa_ioc_sm_disabling)
-		|| bfa_fsm_cmp_state(ioc, bfa_ioc_sm_disabled));
+	return bfa_fsm_cmp_state(ioc, bfa_ioc_sm_disabling)
+		|| bfa_fsm_cmp_state(ioc, bfa_ioc_sm_disabled);
 }
 
 /**
@@ -1963,9 +1963,9 @@ bfa_ioc_is_disabled(struct bfa_ioc_s *ioc)
 bfa_boolean_t
 bfa_ioc_fw_mismatch(struct bfa_ioc_s *ioc)
 {
-	return (bfa_fsm_cmp_state(ioc, bfa_ioc_sm_reset)
+	return bfa_fsm_cmp_state(ioc, bfa_ioc_sm_reset)
 		|| bfa_fsm_cmp_state(ioc, bfa_ioc_sm_fwcheck)
-		|| bfa_fsm_cmp_state(ioc, bfa_ioc_sm_mismatch));
+		|| bfa_fsm_cmp_state(ioc, bfa_ioc_sm_mismatch);
 }
 
 #define bfa_ioc_state_disabled(__sm)		\
diff --git a/drivers/scsi/bfa/bfa_ioc.h b/drivers/scsi/bfa/bfa_ioc.h
index 58efd4b13143..7c30f05ab137 100644
--- a/drivers/scsi/bfa/bfa_ioc.h
+++ b/drivers/scsi/bfa/bfa_ioc.h
@@ -179,16 +179,16 @@ struct bfa_ioc_s {
 	struct bfa_ioc_mbox_mod_s mbox_mod;
 };
 
-#define bfa_ioc_pcifn(__ioc)		(__ioc)->pcidev.pci_func
-#define bfa_ioc_devid(__ioc)		(__ioc)->pcidev.device_id
-#define bfa_ioc_bar0(__ioc)		(__ioc)->pcidev.pci_bar_kva
+#define bfa_ioc_pcifn(__ioc)		((__ioc)->pcidev.pci_func)
+#define bfa_ioc_devid(__ioc)		((__ioc)->pcidev.device_id)
+#define bfa_ioc_bar0(__ioc)		((__ioc)->pcidev.pci_bar_kva)
 #define bfa_ioc_portid(__ioc)		((__ioc)->port_id)
 #define bfa_ioc_fetch_stats(__ioc, __stats) \
-		((__stats)->drv_stats) = (__ioc)->stats
+		(((__stats)->drv_stats) = (__ioc)->stats)
 #define bfa_ioc_clr_stats(__ioc)	\
 		bfa_os_memset(&(__ioc)->stats, 0, sizeof((__ioc)->stats))
-#define bfa_ioc_maxfrsize(__ioc)	(__ioc)->attr->maxfrsize
-#define bfa_ioc_rx_bbcredit(__ioc)	(__ioc)->attr->rx_bbcredit
+#define bfa_ioc_maxfrsize(__ioc)	((__ioc)->attr->maxfrsize)
+#define bfa_ioc_rx_bbcredit(__ioc)	((__ioc)->attr->rx_bbcredit)
 #define bfa_ioc_speed_sup(__ioc)	\
 	BFI_ADAPTER_GETP(SPEED, (__ioc)->attr->adapter_prop)
 
diff --git a/drivers/scsi/bfa/bfa_iocfc.c b/drivers/scsi/bfa/bfa_iocfc.c
index 12350b022d63..d7ab792a9e54 100644
--- a/drivers/scsi/bfa/bfa_iocfc.c
+++ b/drivers/scsi/bfa/bfa_iocfc.c
@@ -794,7 +794,7 @@ bfa_iocfc_get_stats(struct bfa_s *bfa, struct bfa_iocfc_stats_s *stats,
 
 	if (iocfc->stats_busy) {
 		bfa_trc(bfa, iocfc->stats_busy);
-		return (BFA_STATUS_DEVBUSY);
+		return BFA_STATUS_DEVBUSY;
 	}
 
 	iocfc->stats_busy = BFA_TRUE;
@@ -804,7 +804,7 @@ bfa_iocfc_get_stats(struct bfa_s *bfa, struct bfa_iocfc_stats_s *stats,
 
 	bfa_iocfc_stats_query(bfa);
 
-	return (BFA_STATUS_OK);
+	return BFA_STATUS_OK;
 }
 
 bfa_status_t
@@ -814,7 +814,7 @@ bfa_iocfc_clear_stats(struct bfa_s *bfa, bfa_cb_ioc_t cbfn, void *cbarg)
 
 	if (iocfc->stats_busy) {
 		bfa_trc(bfa, iocfc->stats_busy);
-		return (BFA_STATUS_DEVBUSY);
+		return BFA_STATUS_DEVBUSY;
 	}
 
 	iocfc->stats_busy = BFA_TRUE;
@@ -822,7 +822,7 @@ bfa_iocfc_clear_stats(struct bfa_s *bfa, bfa_cb_ioc_t cbfn, void *cbarg)
 	iocfc->stats_cbarg = cbarg;
 
 	bfa_iocfc_stats_clear(bfa);
-	return (BFA_STATUS_OK);
+	return BFA_STATUS_OK;
 }
 
 /**
diff --git a/drivers/scsi/bfa/bfa_iocfc.h b/drivers/scsi/bfa/bfa_iocfc.h
index 7ad177ed4cfc..ce9a830a4207 100644
--- a/drivers/scsi/bfa/bfa_iocfc.h
+++ b/drivers/scsi/bfa/bfa_iocfc.h
@@ -107,13 +107,13 @@ struct bfa_iocfc_s {
 
 #define bfa_lpuid(__bfa)		bfa_ioc_portid(&(__bfa)->ioc)
 #define bfa_msix_init(__bfa, __nvecs)	\
-	(__bfa)->iocfc.hwif.hw_msix_init(__bfa, __nvecs)
+	((__bfa)->iocfc.hwif.hw_msix_init(__bfa, __nvecs))
 #define bfa_msix_install(__bfa)	\
-	(__bfa)->iocfc.hwif.hw_msix_install(__bfa)
+	((__bfa)->iocfc.hwif.hw_msix_install(__bfa))
 #define bfa_msix_uninstall(__bfa)	\
-	(__bfa)->iocfc.hwif.hw_msix_uninstall(__bfa)
+	((__bfa)->iocfc.hwif.hw_msix_uninstall(__bfa))
 #define bfa_isr_mode_set(__bfa, __msix)	\
-	(__bfa)->iocfc.hwif.hw_isr_mode_set(__bfa, __msix)
+	((__bfa)->iocfc.hwif.hw_isr_mode_set(__bfa, __msix))
 #define bfa_msix_getvecs(__bfa, __vecmap, __nvecs, __maxvec)	\
 	(__bfa)->iocfc.hwif.hw_msix_getvecs(__bfa, __vecmap, __nvecs, __maxvec)
 
diff --git a/drivers/scsi/bfa/bfa_ioim.c b/drivers/scsi/bfa/bfa_ioim.c
index 7ae2552e1e14..f81d359b7089 100644
--- a/drivers/scsi/bfa/bfa_ioim.c
+++ b/drivers/scsi/bfa/bfa_ioim.c
@@ -105,13 +105,13 @@ bfa_ioim_sm_uninit(struct bfa_ioim_s *ioim, enum bfa_ioim_event event)
 				bfa_sm_set_state(ioim, bfa_ioim_sm_hcb);
 				list_del(&ioim->qe);
 				list_add_tail(&ioim->qe,
-					&ioim->fcpim->ioim_comp_q);
+						&ioim->fcpim->ioim_comp_q);
 				bfa_cb_queue(ioim->bfa, &ioim->hcb_qe,
 						__bfa_cb_ioim_pathtov, ioim);
 			} else {
 				list_del(&ioim->qe);
 				list_add_tail(&ioim->qe,
-					&ioim->itnim->pending_q);
+						&ioim->itnim->pending_q);
 			}
 			break;
 		}
diff --git a/drivers/scsi/bfa/bfa_itnim.c b/drivers/scsi/bfa/bfa_itnim.c
index 4d5c61a4f85c..eabf7d38bd09 100644
--- a/drivers/scsi/bfa/bfa_itnim.c
+++ b/drivers/scsi/bfa/bfa_itnim.c
@@ -1029,7 +1029,7 @@ bfa_itnim_create(struct bfa_s *bfa, struct bfa_rport_s *rport, void *ditn)
 	bfa_stats(itnim, creates);
 	bfa_sm_send_event(itnim, BFA_ITNIM_SM_CREATE);
 
-	return (itnim);
+	return itnim;
 }
 
 void
@@ -1061,7 +1061,7 @@ bfa_itnim_offline(struct bfa_itnim_s *itnim)
 bfa_boolean_t
 bfa_itnim_hold_io(struct bfa_itnim_s *itnim)
 {
-	return (
+	return
 		itnim->fcpim->path_tov && itnim->iotov_active &&
 		(bfa_sm_cmp_state(itnim, bfa_itnim_sm_fwcreate) ||
 		 bfa_sm_cmp_state(itnim, bfa_itnim_sm_sler) ||
@@ -1069,7 +1069,7 @@ bfa_itnim_hold_io(struct bfa_itnim_s *itnim)
 		 bfa_sm_cmp_state(itnim, bfa_itnim_sm_fwdelete) ||
 		 bfa_sm_cmp_state(itnim, bfa_itnim_sm_offline) ||
 		 bfa_sm_cmp_state(itnim, bfa_itnim_sm_iocdisable))
-);
+	;
 }
 
 void
diff --git a/drivers/scsi/bfa/bfa_log.c b/drivers/scsi/bfa/bfa_log.c
index c2735e55cf03..e7514016c9c6 100644
--- a/drivers/scsi/bfa/bfa_log.c
+++ b/drivers/scsi/bfa/bfa_log.c
@@ -231,9 +231,9 @@ bfa_log_get_level(struct bfa_log_mod_s *log_mod, int mod_id)
 		return BFA_LOG_INVALID;
 
 	if (log_mod)
-		return (log_mod->log_level[mod_id]);
+		return log_mod->log_level[mod_id];
 	else
-		return (bfa_log_info[mod_id].level);
+		return bfa_log_info[mod_id].level;
 }
 
 enum bfa_log_severity
diff --git a/drivers/scsi/bfa/bfa_port_priv.h b/drivers/scsi/bfa/bfa_port_priv.h
index 4b97e2759908..51f698a06b6d 100644
--- a/drivers/scsi/bfa/bfa_port_priv.h
+++ b/drivers/scsi/bfa/bfa_port_priv.h
@@ -59,8 +59,8 @@ struct bfa_pport_s {
 	u8			*stats_kva;
 	u64		stats_pa;
 	union bfa_pport_stats_u *stats;	/*  pport stats */
-	u32		mypid : 24;
-	u32		rsvd_b : 8;
+	u32		mypid:24;
+	u32		rsvd_b:8;
 	struct bfa_timer_s 	timer;	/*  timer */
 	union bfa_pport_stats_u 	*stats_ret;
 					/*  driver stats location */
diff --git a/drivers/scsi/bfa/bfa_rport.c b/drivers/scsi/bfa/bfa_rport.c
index 16da77a8db28..3e1990a74258 100644
--- a/drivers/scsi/bfa/bfa_rport.c
+++ b/drivers/scsi/bfa/bfa_rport.c
@@ -677,7 +677,7 @@ bfa_rport_alloc(struct bfa_rport_mod_s *mod)
 	if (rport)
 		list_add_tail(&rport->qe, &mod->rp_active_q);
 
-	return (rport);
+	return rport;
 }
 
 static void
@@ -834,7 +834,7 @@ bfa_rport_create(struct bfa_s *bfa, void *rport_drv)
 	rp = bfa_rport_alloc(BFA_RPORT_MOD(bfa));
 
 	if (rp == NULL)
-		return (NULL);
+		return NULL;
 
 	rp->bfa = bfa;
 	rp->rport_drv = rport_drv;
@@ -843,7 +843,7 @@ bfa_rport_create(struct bfa_s *bfa, void *rport_drv)
 	bfa_assert(bfa_sm_cmp_state(rp, bfa_rport_sm_uninit));
 	bfa_sm_send_event(rp, BFA_RPORT_SM_CREATE);
 
-	return (rp);
+	return rp;
 }
 
 void
diff --git a/drivers/scsi/bfa/bfa_tskim.c b/drivers/scsi/bfa/bfa_tskim.c
index 010d40d1e5d3..ff7a4dc0bf3c 100644
--- a/drivers/scsi/bfa/bfa_tskim.c
+++ b/drivers/scsi/bfa/bfa_tskim.c
@@ -23,13 +23,14 @@ BFA_TRC_FILE(HAL, TSKIM);
 /**
  * task management completion handling
  */
-#define bfa_tskim_qcomp(__tskim, __cbfn) do {			     \
-	bfa_cb_queue((__tskim)->bfa, &(__tskim)->hcb_qe, __cbfn, (__tskim)); \
+#define bfa_tskim_qcomp(__tskim, __cbfn) do {			\
+	bfa_cb_queue((__tskim)->bfa, &(__tskim)->hcb_qe,	\
+			 __cbfn, (__tskim));      \
 	bfa_tskim_notify_comp(__tskim);      \
 } while (0)
 
-#define bfa_tskim_notify_comp(__tskim) do {				     \
-	if ((__tskim)->notify)					     	     \
+#define bfa_tskim_notify_comp(__tskim) do {			 \
+	if ((__tskim)->notify)					 \
 		bfa_itnim_tskdone((__tskim)->itnim);      \
 } while (0)
 
diff --git a/drivers/scsi/bfa/bfa_uf.c b/drivers/scsi/bfa/bfa_uf.c
index ff5f9deb1b22..4b3c2417d180 100644
--- a/drivers/scsi/bfa/bfa_uf.c
+++ b/drivers/scsi/bfa/bfa_uf.c
@@ -185,7 +185,7 @@ bfa_uf_get(struct bfa_uf_mod_s *uf_mod)
 	struct bfa_uf_s   *uf;
 
 	bfa_q_deq(&uf_mod->uf_free_q, &uf);
-	return (uf);
+	return uf;
 }
 
 static void
diff --git a/drivers/scsi/bfa/bfad.c b/drivers/scsi/bfa/bfad.c
index 6f2be5abf561..b52b773d49d9 100644
--- a/drivers/scsi/bfa/bfad.c
+++ b/drivers/scsi/bfa/bfad.c
@@ -188,8 +188,8 @@ static struct bfad_port_s *
 bfad_get_drv_port(struct bfad_s *bfad, struct bfad_vf_s *vf_drv,
 		  struct bfad_vport_s *vp_drv)
 {
-	return ((vp_drv) ? (&(vp_drv)->drv_port)
-		: ((vf_drv) ? (&(vf_drv)->base_port) : (&(bfad)->pport)));
+	return (vp_drv) ? (&(vp_drv)->drv_port)
+		: ((vf_drv) ? (&(vf_drv)->base_port) : (&(bfad)->pport));
 }
 
 struct bfad_port_s *
@@ -716,7 +716,7 @@ bfad_drv_init(struct bfad_s *bfad)
 	if ((bfad->bfad_flags & BFAD_MSIX_ON)
 	    && bfad_install_msix_handler(bfad)) {
 		printk(KERN_WARNING "%s: install_msix failed, bfad%d\n",
-		       __FUNCTION__, bfad->inst_no);
+		       __func__, bfad->inst_no);
 	}
 
 	bfad_init_timer(bfad);
diff --git a/drivers/scsi/bfa/bfad_fwimg.c b/drivers/scsi/bfa/bfad_fwimg.c
index bd34b0db2d6b..2ad65f275a92 100644
--- a/drivers/scsi/bfa/bfad_fwimg.c
+++ b/drivers/scsi/bfa/bfad_fwimg.c
@@ -65,10 +65,10 @@ bfad_read_firmware(struct pci_dev *pdev, u32 **bfi_image,
 	memcpy(*bfi_image, fw->data, fw->size);
 	*bfi_image_size = fw->size/sizeof(u32);
 
-	return(*bfi_image);
+	return *bfi_image;
 
 error:
-	return(NULL);
+	return NULL;
 }
 
 u32 *
@@ -78,12 +78,12 @@ bfad_get_firmware_buf(struct pci_dev *pdev)
 		if (bfi_image_ct_size == 0)
 			bfad_read_firmware(pdev, &bfi_image_ct,
 				&bfi_image_ct_size, BFAD_FW_FILE_CT);
-		return(bfi_image_ct);
+		return bfi_image_ct;
 	} else {
 		if (bfi_image_cb_size == 0)
 			bfad_read_firmware(pdev, &bfi_image_cb,
 				&bfi_image_cb_size, BFAD_FW_FILE_CB);
-		return(bfi_image_cb);
+		return bfi_image_cb;
 	}
 }
 
diff --git a/drivers/scsi/bfa/bfad_im.c b/drivers/scsi/bfa/bfad_im.c
index 55d012a9a668..f788c2a0ab07 100644
--- a/drivers/scsi/bfa/bfad_im.c
+++ b/drivers/scsi/bfa/bfad_im.c
@@ -1050,7 +1050,7 @@ bfad_im_itnim_work_handler(struct work_struct *work)
 		} else {
 			printk(KERN_WARNING
 				"%s: itnim %llx is already in online state\n",
-				__FUNCTION__,
+				__func__,
 				bfa_fcs_itnim_get_pwwn(&itnim->fcs_itnim));
 		}
 
diff --git a/drivers/scsi/bfa/bfad_im_compat.h b/drivers/scsi/bfa/bfad_im_compat.h
index 1d3e74ec338c..b36be15044a4 100644
--- a/drivers/scsi/bfa/bfad_im_compat.h
+++ b/drivers/scsi/bfa/bfad_im_compat.h
@@ -31,7 +31,7 @@ u32 *bfad_read_firmware(struct pci_dev *pdev, u32 **bfi_image,
 static inline u32 *
 bfad_load_fwimg(struct pci_dev *pdev)
 {
-	return(bfad_get_firmware_buf(pdev));
+	return bfad_get_firmware_buf(pdev);
 }
 
 static inline void
diff --git a/drivers/scsi/bfa/bfad_intr.c b/drivers/scsi/bfa/bfad_intr.c
index f104e029cac9..7de8832f6fee 100644
--- a/drivers/scsi/bfa/bfad_intr.c
+++ b/drivers/scsi/bfa/bfad_intr.c
@@ -23,13 +23,12 @@ BFA_TRC_FILE(LDRV, INTR);
 /**
  *  bfa_isr BFA driver interrupt functions
  */
-irqreturn_t bfad_intx(int irq, void *dev_id);
 static int msix_disable;
 module_param(msix_disable, int, S_IRUGO | S_IWUSR);
 /**
  * Line based interrupt handler.
  */
-irqreturn_t
+static irqreturn_t
 bfad_intx(int irq, void *dev_id)
 {
 	struct bfad_s         *bfad = dev_id;
diff --git a/drivers/scsi/bfa/fabric.c b/drivers/scsi/bfa/fabric.c
index a8b14c47b009..a4b5dd449573 100644
--- a/drivers/scsi/bfa/fabric.c
+++ b/drivers/scsi/bfa/fabric.c
@@ -36,12 +36,12 @@ BFA_TRC_FILE(FCS, FABRIC);
 #define BFA_FCS_FABRIC_RETRY_DELAY	(2000)	/* Milliseconds */
 #define BFA_FCS_FABRIC_CLEANUP_DELAY	(10000)	/* Milliseconds */
 
-#define bfa_fcs_fabric_set_opertype(__fabric) do {          \
-    if (bfa_pport_get_topology((__fabric)->fcs->bfa)    \
-				== BFA_PPORT_TOPOLOGY_P2P)   \
-	    (__fabric)->oper_type = BFA_PPORT_TYPE_NPORT;       \
-    else                                                    \
-	    (__fabric)->oper_type = BFA_PPORT_TYPE_NLPORT;      \
+#define bfa_fcs_fabric_set_opertype(__fabric) do {             \
+	if (bfa_pport_get_topology((__fabric)->fcs->bfa)       \
+				== BFA_PPORT_TOPOLOGY_P2P)     \
+		(__fabric)->oper_type = BFA_PPORT_TYPE_NPORT;  \
+	else                                                   \
+		(__fabric)->oper_type = BFA_PPORT_TYPE_NLPORT; \
 } while (0)
 
 /*
@@ -887,7 +887,7 @@ bfa_fcs_fabric_modsusp(struct bfa_fcs_s *fcs)
 bfa_boolean_t
 bfa_fcs_fabric_is_loopback(struct bfa_fcs_fabric_s *fabric)
 {
-	return (bfa_sm_cmp_state(fabric, bfa_fcs_fabric_sm_loopback));
+	return bfa_sm_cmp_state(fabric, bfa_fcs_fabric_sm_loopback);
 }
 
 enum bfa_pport_type
@@ -974,7 +974,7 @@ bfa_fcs_fabric_port_delete_comp(struct bfa_fcs_fabric_s *fabric)
 int
 bfa_fcs_fabric_is_online(struct bfa_fcs_fabric_s *fabric)
 {
-	return (bfa_sm_cmp_state(fabric, bfa_fcs_fabric_sm_online));
+	return bfa_sm_cmp_state(fabric, bfa_fcs_fabric_sm_online);
 }
 
 
@@ -1015,7 +1015,7 @@ bfa_fcs_fabric_vport_lookup(struct bfa_fcs_fabric_s *fabric, wwn_t pwwn)
 u16
 bfa_fcs_fabric_vport_count(struct bfa_fcs_fabric_s *fabric)
 {
-	return (fabric->num_vports);
+	return fabric->num_vports;
 }
 
 /**
diff --git a/drivers/scsi/bfa/fcbuild.c b/drivers/scsi/bfa/fcbuild.c
index d174706b9caa..fee5456451cb 100644
--- a/drivers/scsi/bfa/fcbuild.c
+++ b/drivers/scsi/bfa/fcbuild.c
@@ -188,14 +188,14 @@ fc_els_rsp_parse(struct fchs_s *fchs, int len)
 	switch (els_cmd->els_code) {
 	case FC_ELS_LS_RJT:
 		if (ls_rjt->reason_code == FC_LS_RJT_RSN_LOGICAL_BUSY)
-			return (FC_PARSE_BUSY);
+			return FC_PARSE_BUSY;
 		else
-			return (FC_PARSE_FAILURE);
+			return FC_PARSE_FAILURE;
 
 	case FC_ELS_ACC:
-		return (FC_PARSE_OK);
+		return FC_PARSE_OK;
 	}
-	return (FC_PARSE_OK);
+	return FC_PARSE_OK;
 }
 
 static void
@@ -228,7 +228,7 @@ fc_plogi_x_build(struct fchs_s *fchs, void *pld, u32 d_id, u32 s_id,
 	bfa_os_memcpy(&plogi->port_name, &port_name, sizeof(wwn_t));
 	bfa_os_memcpy(&plogi->node_name, &node_name, sizeof(wwn_t));
 
-	return (sizeof(struct fc_logi_s));
+	return sizeof(struct fc_logi_s);
 }
 
 u16
@@ -267,7 +267,7 @@ fc_flogi_build(struct fchs_s *fchs, struct fc_logi_s *flogi, u32 s_id,
 	flogi->csp.npiv_supp    = 1; /* @todo. field name is not correct */
 	vvl_info[0]	= bfa_os_htonl(FLOGI_VVL_BRCD);
 
-	return (sizeof(struct fc_logi_s));
+	return sizeof(struct fc_logi_s);
 }
 
 u16
@@ -287,7 +287,7 @@ fc_flogi_acc_build(struct fchs_s *fchs, struct fc_logi_s *flogi, u32 s_id,
 
 	flogi->csp.bbcred = bfa_os_htons(local_bb_credits);
 
-	return (sizeof(struct fc_logi_s));
+	return sizeof(struct fc_logi_s);
 }
 
 u16
@@ -306,7 +306,7 @@ fc_fdisc_build(struct fchs_s *fchs, struct fc_logi_s *flogi, u32 s_id,
 	flogi->port_name = port_name;
 	flogi->node_name = node_name;
 
-	return (sizeof(struct fc_logi_s));
+	return sizeof(struct fc_logi_s);
 }
 
 u16
@@ -338,26 +338,26 @@ fc_plogi_rsp_parse(struct fchs_s *fchs, int len, wwn_t port_name)
 	case FC_ELS_LS_RJT:
 		ls_rjt = (struct fc_ls_rjt_s *) (fchs + 1);
 		if (ls_rjt->reason_code == FC_LS_RJT_RSN_LOGICAL_BUSY)
-			return (FC_PARSE_BUSY);
+			return FC_PARSE_BUSY;
 		else
-			return (FC_PARSE_FAILURE);
+			return FC_PARSE_FAILURE;
 	case FC_ELS_ACC:
 		plogi = (struct fc_logi_s *) (fchs + 1);
 		if (len < sizeof(struct fc_logi_s))
-			return (FC_PARSE_FAILURE);
+			return FC_PARSE_FAILURE;
 
 		if (!wwn_is_equal(plogi->port_name, port_name))
-			return (FC_PARSE_FAILURE);
+			return FC_PARSE_FAILURE;
 
 		if (!plogi->class3.class_valid)
-			return (FC_PARSE_FAILURE);
+			return FC_PARSE_FAILURE;
 
 		if (bfa_os_ntohs(plogi->class3.rxsz) < (FC_MIN_PDUSZ))
-			return (FC_PARSE_FAILURE);
+			return FC_PARSE_FAILURE;
 
-		return (FC_PARSE_OK);
+		return FC_PARSE_OK;
 	default:
-		return (FC_PARSE_FAILURE);
+		return FC_PARSE_FAILURE;
 	}
 }
 
@@ -372,7 +372,7 @@ fc_plogi_parse(struct fchs_s *fchs)
 	if ((bfa_os_ntohs(plogi->class3.rxsz) < FC_MIN_PDUSZ)
 	    || (bfa_os_ntohs(plogi->class3.rxsz) > FC_MAX_PDUSZ)
 	    || (plogi->class3.rxsz == 0))
-		return (FC_PARSE_FAILURE);
+		return FC_PARSE_FAILURE;
 
 	return FC_PARSE_OK;
 }
@@ -393,7 +393,7 @@ fc_prli_build(struct fchs_s *fchs, void *pld, u32 d_id, u32 s_id,
 	prli->parampage.servparams.task_retry_id = 0;
 	prli->parampage.servparams.confirm       = 1;
 
-	return (sizeof(struct fc_prli_s));
+	return sizeof(struct fc_prli_s);
 }
 
 u16
@@ -414,41 +414,41 @@ fc_prli_acc_build(struct fchs_s *fchs, void *pld, u32 d_id, u32 s_id,
 
 	prli->parampage.rspcode = FC_PRLI_ACC_XQTD;
 
-	return (sizeof(struct fc_prli_s));
+	return sizeof(struct fc_prli_s);
 }
 
 enum fc_parse_status
 fc_prli_rsp_parse(struct fc_prli_s *prli, int len)
 {
 	if (len < sizeof(struct fc_prli_s))
-		return (FC_PARSE_FAILURE);
+		return FC_PARSE_FAILURE;
 
 	if (prli->command != FC_ELS_ACC)
-		return (FC_PARSE_FAILURE);
+		return FC_PARSE_FAILURE;
 
 	if ((prli->parampage.rspcode != FC_PRLI_ACC_XQTD)
 	    && (prli->parampage.rspcode != FC_PRLI_ACC_PREDEF_IMG))
-		return (FC_PARSE_FAILURE);
+		return FC_PARSE_FAILURE;
 
 	if (prli->parampage.servparams.target != 1)
-		return (FC_PARSE_FAILURE);
+		return FC_PARSE_FAILURE;
 
-	return (FC_PARSE_OK);
+	return FC_PARSE_OK;
 }
 
 enum fc_parse_status
 fc_prli_parse(struct fc_prli_s *prli)
 {
 	if (prli->parampage.type != FC_TYPE_FCP)
-		return (FC_PARSE_FAILURE);
+		return FC_PARSE_FAILURE;
 
 	if (!prli->parampage.imagepair)
-		return (FC_PARSE_FAILURE);
+		return FC_PARSE_FAILURE;
 
 	if (!prli->parampage.servparams.initiator)
-		return (FC_PARSE_FAILURE);
+		return FC_PARSE_FAILURE;
 
-	return (FC_PARSE_OK);
+	return FC_PARSE_OK;
 }
 
 u16
@@ -462,7 +462,7 @@ fc_logo_build(struct fchs_s *fchs, struct fc_logo_s *logo, u32 d_id,
 	logo->nport_id = (s_id);
 	logo->orig_port_name = port_name;
 
-	return (sizeof(struct fc_logo_s));
+	return sizeof(struct fc_logo_s);
 }
 
 static          u16
@@ -484,7 +484,7 @@ fc_adisc_x_build(struct fchs_s *fchs, struct fc_adisc_s *adisc, u32 d_id,
 	adisc->orig_node_name = node_name;
 	adisc->nport_id = (s_id);
 
-	return (sizeof(struct fc_adisc_s));
+	return sizeof(struct fc_adisc_s);
 }
 
 u16
@@ -511,15 +511,15 @@ fc_adisc_rsp_parse(struct fc_adisc_s *adisc, int len, wwn_t port_name,
 {
 
 	if (len < sizeof(struct fc_adisc_s))
-		return (FC_PARSE_FAILURE);
+		return FC_PARSE_FAILURE;
 
 	if (adisc->els_cmd.els_code != FC_ELS_ACC)
-		return (FC_PARSE_FAILURE);
+		return FC_PARSE_FAILURE;
 
 	if (!wwn_is_equal(adisc->orig_port_name, port_name))
-		return (FC_PARSE_FAILURE);
+		return FC_PARSE_FAILURE;
 
-	return (FC_PARSE_OK);
+	return FC_PARSE_OK;
 }
 
 enum fc_parse_status
@@ -529,14 +529,14 @@ fc_adisc_parse(struct fchs_s *fchs, void *pld, u32 host_dap,
 	struct fc_adisc_s     *adisc = (struct fc_adisc_s *) pld;
 
 	if (adisc->els_cmd.els_code != FC_ELS_ACC)
-		return (FC_PARSE_FAILURE);
+		return FC_PARSE_FAILURE;
 
 	if ((adisc->nport_id == (host_dap))
 	    && wwn_is_equal(adisc->orig_port_name, port_name)
 	    && wwn_is_equal(adisc->orig_node_name, node_name))
-		return (FC_PARSE_OK);
+		return FC_PARSE_OK;
 
-	return (FC_PARSE_FAILURE);
+	return FC_PARSE_FAILURE;
 }
 
 enum fc_parse_status
@@ -550,13 +550,13 @@ fc_pdisc_parse(struct fchs_s *fchs, wwn_t node_name, wwn_t port_name)
 	if ((bfa_os_ntohs(pdisc->class3.rxsz) <
 		 (FC_MIN_PDUSZ - sizeof(struct fchs_s)))
 	    || (pdisc->class3.rxsz == 0))
-		return (FC_PARSE_FAILURE);
+		return FC_PARSE_FAILURE;
 
 	if (!wwn_is_equal(pdisc->port_name, port_name))
-		return (FC_PARSE_FAILURE);
+		return FC_PARSE_FAILURE;
 
 	if (!wwn_is_equal(pdisc->node_name, node_name))
-		return (FC_PARSE_FAILURE);
+		return FC_PARSE_FAILURE;
 
 	return FC_PARSE_OK;
 }
@@ -570,7 +570,7 @@ fc_abts_build(struct fchs_s *fchs, u32 d_id, u32 s_id, u16 ox_id)
 	fchs->s_id = (s_id);
 	fchs->ox_id = bfa_os_htons(ox_id);
 
-	return (sizeof(struct fchs_s));
+	return sizeof(struct fchs_s);
 }
 
 enum fc_parse_status
@@ -578,9 +578,9 @@ fc_abts_rsp_parse(struct fchs_s *fchs, int len)
 {
 	if ((fchs->cat_info == FC_CAT_BA_ACC)
 	    || (fchs->cat_info == FC_CAT_BA_RJT))
-		return (FC_PARSE_OK);
+		return FC_PARSE_OK;
 
-	return (FC_PARSE_FAILURE);
+	return FC_PARSE_FAILURE;
 }
 
 u16
@@ -597,7 +597,7 @@ fc_rrq_build(struct fchs_s *fchs, struct fc_rrq_s *rrq, u32 d_id,
 	rrq->ox_id = bfa_os_htons(rrq_oxid);
 	rrq->rx_id = FC_RXID_ANY;
 
-	return (sizeof(struct fc_rrq_s));
+	return sizeof(struct fc_rrq_s);
 }
 
 u16
@@ -611,7 +611,7 @@ fc_logo_acc_build(struct fchs_s *fchs, void *pld, u32 d_id, u32 s_id,
 	memset(acc, 0, sizeof(struct fc_els_cmd_s));
 	acc->els_code = FC_ELS_ACC;
 
-	return (sizeof(struct fc_els_cmd_s));
+	return sizeof(struct fc_els_cmd_s);
 }
 
 u16
@@ -627,7 +627,7 @@ fc_ls_rjt_build(struct fchs_s *fchs, struct fc_ls_rjt_s *ls_rjt, u32 d_id,
 	ls_rjt->reason_code_expl = reason_code_expl;
 	ls_rjt->vendor_unique = 0x00;
 
-	return (sizeof(struct fc_ls_rjt_s));
+	return sizeof(struct fc_ls_rjt_s);
 }
 
 u16
@@ -643,7 +643,7 @@ fc_ba_acc_build(struct fchs_s *fchs, struct fc_ba_acc_s *ba_acc, u32 d_id,
 	ba_acc->ox_id = fchs->ox_id;
 	ba_acc->rx_id = fchs->rx_id;
 
-	return (sizeof(struct fc_ba_acc_s));
+	return sizeof(struct fc_ba_acc_s);
 }
 
 u16
@@ -654,7 +654,7 @@ fc_ls_acc_build(struct fchs_s *fchs, struct fc_els_cmd_s *els_cmd,
 	memset(els_cmd, 0, sizeof(struct fc_els_cmd_s));
 	els_cmd->els_code = FC_ELS_ACC;
 
-	return (sizeof(struct fc_els_cmd_s));
+	return sizeof(struct fc_els_cmd_s);
 }
 
 int
@@ -696,7 +696,7 @@ fc_tprlo_acc_build(struct fchs_s *fchs, struct fc_tprlo_acc_s *tprlo_acc,
 		tprlo_acc->tprlo_acc_params[page].orig_process_assc = 0;
 		tprlo_acc->tprlo_acc_params[page].resp_process_assc = 0;
 	}
-	return (bfa_os_ntohs(tprlo_acc->payload_len));
+	return bfa_os_ntohs(tprlo_acc->payload_len);
 }
 
 u16
@@ -721,7 +721,7 @@ fc_prlo_acc_build(struct fchs_s *fchs, struct fc_prlo_acc_s *prlo_acc,
 		prlo_acc->prlo_acc_params[page].resp_process_assc = 0;
 	}
 
-	return (bfa_os_ntohs(prlo_acc->payload_len));
+	return bfa_os_ntohs(prlo_acc->payload_len);
 }
 
 u16
@@ -735,7 +735,7 @@ fc_rnid_build(struct fchs_s *fchs, struct fc_rnid_cmd_s *rnid, u32 d_id,
 	rnid->els_cmd.els_code = FC_ELS_RNID;
 	rnid->node_id_data_format = data_format;
 
-	return (sizeof(struct fc_rnid_cmd_s));
+	return sizeof(struct fc_rnid_cmd_s);
 }
 
 u16
@@ -759,10 +759,10 @@ fc_rnid_acc_build(struct fchs_s *fchs, struct fc_rnid_acc_s *rnid_acc,
 		rnid_acc->specific_id_data_length =
 			sizeof(struct fc_rnid_general_topology_data_s);
 		bfa_os_assign(rnid_acc->gen_topology_data, *gen_topo_data);
-		return (sizeof(struct fc_rnid_acc_s));
+		return sizeof(struct fc_rnid_acc_s);
 	} else {
-		return (sizeof(struct fc_rnid_acc_s) -
-			sizeof(struct fc_rnid_general_topology_data_s));
+		return sizeof(struct fc_rnid_acc_s) -
+			sizeof(struct fc_rnid_general_topology_data_s);
 	}
 
 }
@@ -776,7 +776,7 @@ fc_rpsc_build(struct fchs_s *fchs, struct fc_rpsc_cmd_s *rpsc, u32 d_id,
 	memset(rpsc, 0, sizeof(struct fc_rpsc_cmd_s));
 
 	rpsc->els_cmd.els_code = FC_ELS_RPSC;
-	return (sizeof(struct fc_rpsc_cmd_s));
+	return sizeof(struct fc_rpsc_cmd_s);
 }
 
 u16
@@ -797,8 +797,8 @@ fc_rpsc2_build(struct fchs_s *fchs, struct fc_rpsc2_cmd_s *rpsc2,
 	for (i = 0; i < npids; i++)
 		rpsc2->pid_list[i].pid = pid_list[i];
 
-	return (sizeof(struct fc_rpsc2_cmd_s) + ((npids - 1) *
-			(sizeof(u32))));
+	return sizeof(struct fc_rpsc2_cmd_s) + ((npids - 1) *
+			(sizeof(u32)));
 }
 
 u16
@@ -819,7 +819,7 @@ fc_rpsc_acc_build(struct fchs_s *fchs, struct fc_rpsc_acc_s *rpsc_acc,
 	rpsc_acc->speed_info[0].port_op_speed =
 		bfa_os_htons(oper_speed->port_op_speed);
 
-	return (sizeof(struct fc_rpsc_acc_s));
+	return sizeof(struct fc_rpsc_acc_s);
 
 }
 
@@ -856,7 +856,7 @@ fc_pdisc_build(struct fchs_s *fchs, u32 d_id, u32 s_id,
 	pdisc->port_name = port_name;
 	pdisc->node_name = node_name;
 
-	return (sizeof(struct fc_logi_s));
+	return sizeof(struct fc_logi_s);
 }
 
 u16
@@ -865,21 +865,21 @@ fc_pdisc_rsp_parse(struct fchs_s *fchs, int len, wwn_t port_name)
 	struct fc_logi_s     *pdisc = (struct fc_logi_s *) (fchs + 1);
 
 	if (len < sizeof(struct fc_logi_s))
-		return (FC_PARSE_LEN_INVAL);
+		return FC_PARSE_LEN_INVAL;
 
 	if (pdisc->els_cmd.els_code != FC_ELS_ACC)
-		return (FC_PARSE_ACC_INVAL);
+		return FC_PARSE_ACC_INVAL;
 
 	if (!wwn_is_equal(pdisc->port_name, port_name))
-		return (FC_PARSE_PWWN_NOT_EQUAL);
+		return FC_PARSE_PWWN_NOT_EQUAL;
 
 	if (!pdisc->class3.class_valid)
-		return (FC_PARSE_NWWN_NOT_EQUAL);
+		return FC_PARSE_NWWN_NOT_EQUAL;
 
 	if (bfa_os_ntohs(pdisc->class3.rxsz) < (FC_MIN_PDUSZ))
-		return (FC_PARSE_RXSZ_INVAL);
+		return FC_PARSE_RXSZ_INVAL;
 
-	return (FC_PARSE_OK);
+	return FC_PARSE_OK;
 }
 
 u16
@@ -903,7 +903,7 @@ fc_prlo_build(struct fchs_s *fchs, u32 d_id, u32 s_id, u16 ox_id,
 		prlo->prlo_params[page].resp_process_assc = 0;
 	}
 
-	return (bfa_os_ntohs(prlo->payload_len));
+	return bfa_os_ntohs(prlo->payload_len);
 }
 
 u16
@@ -916,7 +916,7 @@ fc_prlo_rsp_parse(struct fchs_s *fchs, int len)
 	len = len;
 
 	if (prlo->command != FC_ELS_ACC)
-		return (FC_PARSE_FAILURE);
+		return FC_PARSE_FAILURE;
 
 	num_pages = ((bfa_os_ntohs(prlo->payload_len)) - 4) / 16;
 
@@ -936,7 +936,7 @@ fc_prlo_rsp_parse(struct fchs_s *fchs, int len)
 		if (prlo->prlo_acc_params[page].resp_process_assc != 0)
 			return FC_PARSE_FAILURE;
 	}
-	return (FC_PARSE_OK);
+	return FC_PARSE_OK;
 
 }
 
@@ -968,7 +968,7 @@ fc_tprlo_build(struct fchs_s *fchs, u32 d_id, u32 s_id,
 		}
 	}
 
-	return (bfa_os_ntohs(tprlo->payload_len));
+	return bfa_os_ntohs(tprlo->payload_len);
 }
 
 u16
@@ -981,23 +981,23 @@ fc_tprlo_rsp_parse(struct fchs_s *fchs, int len)
 	len = len;
 
 	if (tprlo->command != FC_ELS_ACC)
-		return (FC_PARSE_ACC_INVAL);
+		return FC_PARSE_ACC_INVAL;
 
 	num_pages = (bfa_os_ntohs(tprlo->payload_len) - 4) / 16;
 
 	for (page = 0; page < num_pages; page++) {
 		if (tprlo->tprlo_acc_params[page].type != FC_TYPE_FCP)
-			return (FC_PARSE_NOT_FCP);
+			return FC_PARSE_NOT_FCP;
 		if (tprlo->tprlo_acc_params[page].opa_valid != 0)
-			return (FC_PARSE_OPAFLAG_INVAL);
+			return FC_PARSE_OPAFLAG_INVAL;
 		if (tprlo->tprlo_acc_params[page].rpa_valid != 0)
-			return (FC_PARSE_RPAFLAG_INVAL);
+			return FC_PARSE_RPAFLAG_INVAL;
 		if (tprlo->tprlo_acc_params[page].orig_process_assc != 0)
-			return (FC_PARSE_OPA_INVAL);
+			return FC_PARSE_OPA_INVAL;
 		if (tprlo->tprlo_acc_params[page].resp_process_assc != 0)
-			return (FC_PARSE_RPA_INVAL);
+			return FC_PARSE_RPA_INVAL;
 	}
-	return (FC_PARSE_OK);
+	return FC_PARSE_OK;
 }
 
 enum fc_parse_status
@@ -1024,7 +1024,7 @@ fc_ba_rjt_build(struct fchs_s *fchs, u32 d_id, u32 s_id,
 	fchs->cat_info = FC_CAT_BA_RJT;
 	ba_rjt->reason_code = reason_code;
 	ba_rjt->reason_expl = reason_expl;
-	return (sizeof(struct fc_ba_rjt_s));
+	return sizeof(struct fc_ba_rjt_s);
 }
 
 static void
@@ -1073,7 +1073,7 @@ fc_gidpn_build(struct fchs_s *fchs, void *pyld, u32 s_id, u16 ox_id,
 
 	bfa_os_memset(gidpn, 0, sizeof(struct fcgs_gidpn_req_s));
 	gidpn->port_name = port_name;
-	return (sizeof(struct fcgs_gidpn_req_s) + sizeof(struct ct_hdr_s));
+	return sizeof(struct fcgs_gidpn_req_s) + sizeof(struct ct_hdr_s);
 }
 
 u16
@@ -1090,7 +1090,7 @@ fc_gpnid_build(struct fchs_s *fchs, void *pyld, u32 s_id, u16 ox_id,
 
 	bfa_os_memset(gpnid, 0, sizeof(fcgs_gpnid_req_t));
 	gpnid->dap = port_id;
-	return (sizeof(fcgs_gpnid_req_t) + sizeof(struct ct_hdr_s));
+	return sizeof(fcgs_gpnid_req_t) + sizeof(struct ct_hdr_s);
 }
 
 u16
@@ -1107,7 +1107,7 @@ fc_gnnid_build(struct fchs_s *fchs, void *pyld, u32 s_id, u16 ox_id,
 
 	bfa_os_memset(gnnid, 0, sizeof(fcgs_gnnid_req_t));
 	gnnid->dap = port_id;
-	return (sizeof(fcgs_gnnid_req_t) + sizeof(struct ct_hdr_s));
+	return sizeof(fcgs_gnnid_req_t) + sizeof(struct ct_hdr_s);
 }
 
 u16
@@ -1137,7 +1137,7 @@ fc_scr_build(struct fchs_s *fchs, struct fc_scr_s *scr, u8 set_br_reg,
 	if (set_br_reg)
 		scr->vu_reg_func = FC_VU_SCR_REG_FUNC_FABRIC_NAME_CHANGE;
 
-	return (sizeof(struct fc_scr_s));
+	return sizeof(struct fc_scr_s);
 }
 
 u16
@@ -1157,7 +1157,7 @@ fc_rscn_build(struct fchs_s *fchs, struct fc_rscn_pl_s *rscn, u32 s_id,
 	rscn->event[0].format = FC_RSCN_FORMAT_PORTID;
 	rscn->event[0].portid = s_id;
 
-	return (sizeof(struct fc_rscn_pl_s));
+	return sizeof(struct fc_rscn_pl_s);
 }
 
 u16
@@ -1188,7 +1188,7 @@ fc_rftid_build(struct fchs_s *fchs, void *pyld, u32 s_id, u16 ox_id,
 		rftid->fc4_type[index] |= bfa_os_htonl(type_value);
 	}
 
-	return (sizeof(struct fcgs_rftid_req_s) + sizeof(struct ct_hdr_s));
+	return sizeof(struct fcgs_rftid_req_s) + sizeof(struct ct_hdr_s);
 }
 
 u16
@@ -1210,7 +1210,7 @@ fc_rftid_build_sol(struct fchs_s *fchs, void *pyld, u32 s_id,
 	bfa_os_memcpy((void *)rftid->fc4_type, (void *)fc4_bitmap,
 			(bitmap_size < 32 ? bitmap_size : 32));
 
-	return (sizeof(struct fcgs_rftid_req_s) + sizeof(struct ct_hdr_s));
+	return sizeof(struct fcgs_rftid_req_s) + sizeof(struct ct_hdr_s);
 }
 
 u16
@@ -1231,7 +1231,7 @@ fc_rffid_build(struct fchs_s *fchs, void *pyld, u32 s_id, u16 ox_id,
 	rffid->fc4ftr_bits  = fc4_ftrs;
 	rffid->fc4_type		= fc4_type;
 
-	return (sizeof(struct fcgs_rffid_req_s) + sizeof(struct ct_hdr_s));
+	return sizeof(struct fcgs_rffid_req_s) + sizeof(struct ct_hdr_s);
 }
 
 u16
@@ -1253,7 +1253,7 @@ fc_rspnid_build(struct fchs_s *fchs, void *pyld, u32 s_id, u16 ox_id,
 	rspnid->spn_len = (u8) strlen((char *)name);
 	strncpy((char *)rspnid->spn, (char *)name, rspnid->spn_len);
 
-	return (sizeof(struct fcgs_rspnid_req_s) + sizeof(struct ct_hdr_s));
+	return sizeof(struct fcgs_rspnid_req_s) + sizeof(struct ct_hdr_s);
 }
 
 u16
@@ -1275,7 +1275,7 @@ fc_gid_ft_build(struct fchs_s *fchs, void *pyld, u32 s_id,
 	gidft->domain_id = 0;
 	gidft->area_id = 0;
 
-	return (sizeof(struct fcgs_gidft_req_s) + sizeof(struct ct_hdr_s));
+	return sizeof(struct fcgs_gidft_req_s) + sizeof(struct ct_hdr_s);
 }
 
 u16
@@ -1294,7 +1294,7 @@ fc_rpnid_build(struct fchs_s *fchs, void *pyld, u32 s_id, u32 port_id,
 	rpnid->port_id = port_id;
 	rpnid->port_name = port_name;
 
-	return (sizeof(struct fcgs_rpnid_req_s) + sizeof(struct ct_hdr_s));
+	return sizeof(struct fcgs_rpnid_req_s) + sizeof(struct ct_hdr_s);
 }
 
 u16
@@ -1313,7 +1313,7 @@ fc_rnnid_build(struct fchs_s *fchs, void *pyld, u32 s_id, u32 port_id,
 	rnnid->port_id = port_id;
 	rnnid->node_name = node_name;
 
-	return (sizeof(struct fcgs_rnnid_req_s) + sizeof(struct ct_hdr_s));
+	return sizeof(struct fcgs_rnnid_req_s) + sizeof(struct ct_hdr_s);
 }
 
 u16
@@ -1332,7 +1332,7 @@ fc_rcsid_build(struct fchs_s *fchs, void *pyld, u32 s_id, u32 port_id,
 	rcsid->port_id = port_id;
 	rcsid->cos = cos;
 
-	return (sizeof(struct fcgs_rcsid_req_s) + sizeof(struct ct_hdr_s));
+	return sizeof(struct fcgs_rcsid_req_s) + sizeof(struct ct_hdr_s);
 }
 
 u16
@@ -1351,7 +1351,7 @@ fc_rptid_build(struct fchs_s *fchs, void *pyld, u32 s_id, u32 port_id,
 	rptid->port_id = port_id;
 	rptid->port_type = port_type;
 
-	return (sizeof(struct fcgs_rptid_req_s) + sizeof(struct ct_hdr_s));
+	return sizeof(struct fcgs_rptid_req_s) + sizeof(struct ct_hdr_s);
 }
 
 u16
@@ -1368,7 +1368,7 @@ fc_ganxt_build(struct fchs_s *fchs, void *pyld, u32 s_id, u32 port_id)
 	bfa_os_memset(ganxt, 0, sizeof(struct fcgs_ganxt_req_s));
 	ganxt->port_id = port_id;
 
-	return (sizeof(struct ct_hdr_s) + sizeof(struct fcgs_ganxt_req_s));
+	return sizeof(struct ct_hdr_s) + sizeof(struct fcgs_ganxt_req_s);
 }
 
 /*
@@ -1385,7 +1385,7 @@ fc_fdmi_reqhdr_build(struct fchs_s *fchs, void *pyld, u32 s_id,
 	fc_gs_fchdr_build(fchs, d_id, s_id, 0);
 	fc_gs_fdmi_cthdr_build(cthdr, s_id, cmd_code);
 
-	return (sizeof(struct ct_hdr_s));
+	return sizeof(struct ct_hdr_s);
 }
 
 /*
@@ -1425,7 +1425,7 @@ fc_gmal_req_build(struct fchs_s *fchs, void *pyld, u32 s_id, wwn_t wwn)
 	bfa_os_memset(gmal, 0, sizeof(fcgs_gmal_req_t));
 	gmal->wwn = wwn;
 
-	return (sizeof(struct ct_hdr_s) + sizeof(fcgs_gmal_req_t));
+	return sizeof(struct ct_hdr_s) + sizeof(fcgs_gmal_req_t);
 }
 
 /*
@@ -1445,5 +1445,5 @@ fc_gfn_req_build(struct fchs_s *fchs, void *pyld, u32 s_id, wwn_t wwn)
 	bfa_os_memset(gfn, 0, sizeof(fcgs_gfn_req_t));
 	gfn->wwn = wwn;
 
-	return (sizeof(struct ct_hdr_s) + sizeof(fcgs_gfn_req_t));
+	return sizeof(struct ct_hdr_s) + sizeof(fcgs_gfn_req_t);
 }
diff --git a/drivers/scsi/bfa/fcbuild.h b/drivers/scsi/bfa/fcbuild.h
index 4d248424f7b3..8fa7f270ef7b 100644
--- a/drivers/scsi/bfa/fcbuild.h
+++ b/drivers/scsi/bfa/fcbuild.h
@@ -32,8 +32,8 @@
  * Utility Macros/functions
  */
 
-#define fcif_sof_set(_ifhdr, _sof)	(_ifhdr)->sof = FC_ ## _sof
-#define fcif_eof_set(_ifhdr, _eof)	(_ifhdr)->eof = FC_ ## _eof
+#define fcif_sof_set(_ifhdr, _sof)	((_ifhdr)->sof = FC_ ## _sof)
+#define fcif_eof_set(_ifhdr, _eof)	((_ifhdr)->eof = FC_ ## _eof)
 
 #define wwn_is_equal(_wwn1, _wwn2)		\
 	(memcmp(&(_wwn1), &(_wwn2), sizeof(wwn_t)) == 0)
@@ -49,7 +49,7 @@
 static inline   u32
 fc_get_ctresp_pyld_len(u32 resp_len)
 {
-	return (resp_len - sizeof(struct ct_hdr_s));
+	return resp_len - sizeof(struct ct_hdr_s);
 }
 
 /*
diff --git a/drivers/scsi/bfa/fcpim.c b/drivers/scsi/bfa/fcpim.c
index 8ce5d8934677..1f3c06efaa9e 100644
--- a/drivers/scsi/bfa/fcpim.c
+++ b/drivers/scsi/bfa/fcpim.c
@@ -286,11 +286,10 @@ bfa_fcs_itnim_sm_online(struct bfa_fcs_itnim_s *itnim,
 		bfa_sm_set_state(itnim, bfa_fcs_itnim_sm_hcb_offline);
 		bfa_fcb_itnim_offline(itnim->itnim_drv);
 		bfa_itnim_offline(itnim->bfa_itnim);
-		if (bfa_fcs_port_is_online(itnim->rport->port) == BFA_TRUE) {
+		if (bfa_fcs_port_is_online(itnim->rport->port) == BFA_TRUE)
 			bfa_fcs_itnim_aen_post(itnim, BFA_ITNIM_AEN_DISCONNECT);
-		} else {
+		else
 			bfa_fcs_itnim_aen_post(itnim, BFA_ITNIM_AEN_OFFLINE);
-		}
 		break;
 
 	case BFA_FCS_ITNIM_SM_DELETE:
@@ -732,7 +731,7 @@ bfa_fcs_itnim_lookup(struct bfa_fcs_port_s *port, wwn_t rpwwn)
 		return NULL;
 
 	bfa_assert(rport->itnim != NULL);
-	return (rport->itnim);
+	return rport->itnim;
 }
 
 bfa_status_t
diff --git a/drivers/scsi/bfa/fcs.h b/drivers/scsi/bfa/fcs.h
index deee685e8478..8d08230e6295 100644
--- a/drivers/scsi/bfa/fcs.h
+++ b/drivers/scsi/bfa/fcs.h
@@ -23,7 +23,7 @@
 #ifndef __FCS_H__
 #define __FCS_H__
 
-#define __fcs_min_cfg(__fcs)       (__fcs)->min_cfg
+#define __fcs_min_cfg(__fcs)       ((__fcs)->min_cfg)
 
 void bfa_fcs_modexit_comp(struct bfa_fcs_s *fcs);
 
diff --git a/drivers/scsi/bfa/fdmi.c b/drivers/scsi/bfa/fdmi.c
index b845eb272c78..df2a1e54e16b 100644
--- a/drivers/scsi/bfa/fdmi.c
+++ b/drivers/scsi/bfa/fdmi.c
@@ -72,9 +72,9 @@ static u16 bfa_fcs_port_fdmi_build_rpa_pyld(
 			struct bfa_fcs_port_fdmi_s *fdmi, u8 *pyld);
 static u16 bfa_fcs_port_fdmi_build_portattr_block(
 			struct bfa_fcs_port_fdmi_s *fdmi, u8 *pyld);
-void bfa_fcs_fdmi_get_hbaattr(struct bfa_fcs_port_fdmi_s *fdmi,
+static void bfa_fcs_fdmi_get_hbaattr(struct bfa_fcs_port_fdmi_s *fdmi,
 			struct bfa_fcs_fdmi_hba_attr_s *hba_attr);
-void bfa_fcs_fdmi_get_portattr(struct bfa_fcs_port_fdmi_s *fdmi,
+static void bfa_fcs_fdmi_get_portattr(struct bfa_fcs_port_fdmi_s *fdmi,
 			struct bfa_fcs_fdmi_port_attr_s *port_attr);
 /**
  *  fcs_fdmi_sm FCS FDMI state machine
@@ -1091,7 +1091,7 @@ bfa_fcs_port_fdmi_timeout(void *arg)
 	bfa_sm_send_event(fdmi, FDMISM_EVENT_TIMEOUT);
 }
 
-void
+static void
 bfa_fcs_fdmi_get_hbaattr(struct bfa_fcs_port_fdmi_s *fdmi,
 			 struct bfa_fcs_fdmi_hba_attr_s *hba_attr)
 {
@@ -1145,7 +1145,7 @@ bfa_fcs_fdmi_get_hbaattr(struct bfa_fcs_port_fdmi_s *fdmi,
 
 }
 
-void
+static void
 bfa_fcs_fdmi_get_portattr(struct bfa_fcs_port_fdmi_s *fdmi,
 			  struct bfa_fcs_fdmi_port_attr_s *port_attr)
 {
diff --git a/drivers/scsi/bfa/include/aen/bfa_aen.h b/drivers/scsi/bfa/include/aen/bfa_aen.h
index da8cac093d3d..d9cbc2a783d4 100644
--- a/drivers/scsi/bfa/include/aen/bfa_aen.h
+++ b/drivers/scsi/bfa/include/aen/bfa_aen.h
@@ -54,7 +54,7 @@ bfa_aen_get_max_cfg_entry(void)
 static inline s32
 bfa_aen_get_meminfo(void)
 {
-	return (sizeof(struct bfa_aen_entry_s) * bfa_aen_get_max_cfg_entry());
+	return sizeof(struct bfa_aen_entry_s) * bfa_aen_get_max_cfg_entry();
 }
 
 static inline s32
diff --git a/drivers/scsi/bfa/include/bfa.h b/drivers/scsi/bfa/include/bfa.h
index 64c1412c5703..d4bc0d9fa42c 100644
--- a/drivers/scsi/bfa/include/bfa.h
+++ b/drivers/scsi/bfa/include/bfa.h
@@ -76,11 +76,11 @@ struct bfa_meminfo_s {
 	struct bfa_mem_elem_s meminfo[BFA_MEM_TYPE_MAX];
 };
 #define bfa_meminfo_kva(_m)	\
-	(_m)->meminfo[BFA_MEM_TYPE_KVA - 1].kva_curp
+	((_m)->meminfo[BFA_MEM_TYPE_KVA - 1].kva_curp)
 #define bfa_meminfo_dma_virt(_m)	\
-	(_m)->meminfo[BFA_MEM_TYPE_DMA - 1].kva_curp
+	((_m)->meminfo[BFA_MEM_TYPE_DMA - 1].kva_curp)
 #define bfa_meminfo_dma_phys(_m)	\
-	(_m)->meminfo[BFA_MEM_TYPE_DMA - 1].dma_curp
+	((_m)->meminfo[BFA_MEM_TYPE_DMA - 1].dma_curp)
 
 /**
  * Generic Scatter Gather Element used by driver
@@ -100,7 +100,7 @@ struct bfa_sge_s {
 /*
  * bfa stats interfaces
  */
-#define bfa_stats(_mod, _stats)	(_mod)->stats._stats ++
+#define bfa_stats(_mod, _stats)	((_mod)->stats._stats++)
 
 #define bfa_ioc_get_stats(__bfa, __ioc_stats)	\
 	bfa_ioc_fetch_stats(&(__bfa)->ioc, __ioc_stats)
@@ -136,7 +136,7 @@ void bfa_isr_enable(struct bfa_s *bfa);
 void bfa_isr_disable(struct bfa_s *bfa);
 void bfa_msix_getvecs(struct bfa_s *bfa, u32 *msix_vecs_bmap,
 			u32 *num_vecs, u32 *max_vec_bit);
-#define bfa_msix(__bfa, __vec) (__bfa)->msix.handler[__vec](__bfa, __vec)
+#define bfa_msix(__bfa, __vec) ((__bfa)->msix.handler[__vec](__bfa, __vec))
 
 void bfa_comp_deq(struct bfa_s *bfa, struct list_head *comp_q);
 void bfa_comp_process(struct bfa_s *bfa, struct list_head *comp_q);
diff --git a/drivers/scsi/bfa/include/bfa_svc.h b/drivers/scsi/bfa/include/bfa_svc.h
index 0c80b74f72ef..268d956bad89 100644
--- a/drivers/scsi/bfa/include/bfa_svc.h
+++ b/drivers/scsi/bfa/include/bfa_svc.h
@@ -34,10 +34,10 @@ struct bfa_fcxp_s;
  */
 struct bfa_rport_info_s {
 	u16        max_frmsz;	/*  max rcv pdu size               */
-	u32        pid : 24,	/*  remote port ID                 */
-			lp_tag : 8;
-	u32        local_pid : 24,	/*  local port ID		    */
-			cisc : 8;	/*  CIRO supported		    */
+	u32        pid:24,		/*  remote port ID                 */
+			lp_tag:8;
+	u32        local_pid:24,	/*  local port ID		    */
+			cisc:8;		/*  CIRO supported		    */
 	u8         fc_class;	/*  supported FC classes. enum fc_cos */
 	u8         vf_en;		/*  virtual fabric enable          */
 	u16        vf_id;		/*  virtual fabric ID              */
diff --git a/drivers/scsi/bfa/include/bfi/bfi.h b/drivers/scsi/bfa/include/bfi/bfi.h
index 6cadfe0d4ba1..7042c18e542d 100644
--- a/drivers/scsi/bfa/include/bfi/bfi.h
+++ b/drivers/scsi/bfa/include/bfi/bfi.h
@@ -93,13 +93,13 @@ union bfi_addr_u {
  */
 struct bfi_sge_s {
 #ifdef __BIGENDIAN
-	u32        flags	: 2,
-			rsvd	: 2,
-			sg_len	: 28;
+	u32        flags:2,
+			rsvd:2,
+			sg_len:28;
 #else
-	u32        sg_len	: 28,
-			rsvd	: 2,
-			flags	: 2;
+	u32        sg_len:28,
+			rsvd:2,
+			flags:2;
 #endif
 	union bfi_addr_u sga;
 };
diff --git a/drivers/scsi/bfa/include/bfi/bfi_ioc.h b/drivers/scsi/bfa/include/bfi/bfi_ioc.h
index 026e9c06ae97..96ef05670659 100644
--- a/drivers/scsi/bfa/include/bfi/bfi_ioc.h
+++ b/drivers/scsi/bfa/include/bfi/bfi_ioc.h
@@ -142,7 +142,7 @@ enum {
 	BFI_ADAPTER_UNSUPP    = 0x400000,	/*  unknown adapter type  */
 };
 
-#define BFI_ADAPTER_GETP(__prop,__adap_prop)          		\
+#define BFI_ADAPTER_GETP(__prop, __adap_prop)          		\
     (((__adap_prop) & BFI_ADAPTER_ ## __prop ## _MK) >>         \
      BFI_ADAPTER_ ## __prop ## _SH)
 #define BFI_ADAPTER_SETP(__prop, __val)         		\
diff --git a/drivers/scsi/bfa/include/bfi/bfi_lps.h b/drivers/scsi/bfa/include/bfi/bfi_lps.h
index 414b0e30f6ef..c59d47badb4b 100644
--- a/drivers/scsi/bfa/include/bfi/bfi_lps.h
+++ b/drivers/scsi/bfa/include/bfi/bfi_lps.h
@@ -55,8 +55,8 @@ struct bfi_lps_login_rsp_s {
 	u16	bb_credit;
 	u8		f_port;
 	u8		npiv_en;
-	u32	lp_pid : 24;
-	u32	auth_req : 8;
+	u32	lp_pid:24;
+	u32	auth_req:8;
 	mac_t		lp_mac;
 	mac_t		fcf_mac;
 	u8		ext_status;
diff --git a/drivers/scsi/bfa/include/bfi/bfi_rport.h b/drivers/scsi/bfa/include/bfi/bfi_rport.h
index 3520f55f09d7..e1cd83b56ec6 100644
--- a/drivers/scsi/bfa/include/bfi/bfi_rport.h
+++ b/drivers/scsi/bfa/include/bfi/bfi_rport.h
@@ -38,10 +38,10 @@ struct bfi_rport_create_req_s {
 	struct bfi_mhdr_s  mh;		/*  common msg header		*/
 	u16        bfa_handle;	/*  host rport handle		*/
 	u16        max_frmsz;	/*  max rcv pdu size		*/
-	u32        pid       : 24,	/*  remote port ID		*/
-			lp_tag    : 8;	/*  local port tag		*/
-	u32        local_pid : 24,	/*  local port ID		*/
-			cisc      : 8;
+	u32        pid:24,		/*  remote port ID		*/
+			lp_tag:8;	/*  local port tag		*/
+	u32        local_pid:24,	/*  local port ID		*/
+			cisc:8;
 	u8         fc_class;	/*  supported FC classes	*/
 	u8         vf_en;		/*  virtual fabric enable	*/
 	u16        vf_id;		/*  virtual fabric ID		*/
diff --git a/drivers/scsi/bfa/include/cs/bfa_checksum.h b/drivers/scsi/bfa/include/cs/bfa_checksum.h
index af8c1d533ba8..650f8d0aaff9 100644
--- a/drivers/scsi/bfa/include/cs/bfa_checksum.h
+++ b/drivers/scsi/bfa/include/cs/bfa_checksum.h
@@ -31,7 +31,7 @@ bfa_checksum_u32(u32 *buf, int sz)
 	for (i = 0; i < m; i++)
 		sum ^= buf[i];
 
-	return (sum);
+	return sum;
 }
 
 static inline u16
@@ -43,7 +43,7 @@ bfa_checksum_u16(u16 *buf, int sz)
 	for (i = 0; i < m; i++)
 		sum ^= buf[i];
 
-	return (sum);
+	return sum;
 }
 
 static inline u8
@@ -55,6 +55,6 @@ bfa_checksum_u8(u8 *buf, int sz)
 	for (i = 0; i < sz; i++)
 		sum ^= buf[i];
 
-	return (sum);
+	return sum;
 }
 #endif
diff --git a/drivers/scsi/bfa/include/cs/bfa_sm.h b/drivers/scsi/bfa/include/cs/bfa_sm.h
index 9877066680a6..b0a92baf6657 100644
--- a/drivers/scsi/bfa/include/cs/bfa_sm.h
+++ b/drivers/scsi/bfa/include/cs/bfa_sm.h
@@ -24,8 +24,8 @@
 
 typedef void (*bfa_sm_t)(void *sm, int event);
 
-#define bfa_sm_set_state(_sm, _state)	(_sm)->sm = (bfa_sm_t)(_state)
-#define bfa_sm_send_event(_sm, _event)	(_sm)->sm((_sm), (_event))
+#define bfa_sm_set_state(_sm, _state)	((_sm)->sm = (bfa_sm_t)(_state))
+#define bfa_sm_send_event(_sm, _event)	((_sm)->sm((_sm), (_event)))
 #define bfa_sm_get_state(_sm)		((_sm)->sm)
 #define bfa_sm_cmp_state(_sm, _state)	((_sm)->sm == (bfa_sm_t)(_state))
 
@@ -62,7 +62,7 @@ typedef void (*bfa_fsm_t)(void *fsm, int event);
 } while (0)
 
 #define bfa_fsm_send_event(_fsm, _event)	\
-	(_fsm)->fsm((_fsm), (_event))
+	((_fsm)->fsm((_fsm), (_event)))
 #define bfa_fsm_cmp_state(_fsm, _state)		\
 	((_fsm)->fsm == (bfa_fsm_t)(_state))
 
diff --git a/drivers/scsi/bfa/include/cs/bfa_trc.h b/drivers/scsi/bfa/include/cs/bfa_trc.h
index 3e743928c74c..310771c888e7 100644
--- a/drivers/scsi/bfa/include/cs/bfa_trc.h
+++ b/drivers/scsi/bfa/include/cs/bfa_trc.h
@@ -24,7 +24,7 @@
 #endif
 
 #ifndef BFA_TRC_TS
-#define BFA_TRC_TS(_trcm)	((_trcm)->ticks ++)
+#define BFA_TRC_TS(_trcm)	((_trcm)->ticks++)
 #endif
 
 struct bfa_trc_s {
diff --git a/drivers/scsi/bfa/include/defs/bfa_defs_pport.h b/drivers/scsi/bfa/include/defs/bfa_defs_pport.h
index a000bc4e2d4a..bf320412ee24 100644
--- a/drivers/scsi/bfa/include/defs/bfa_defs_pport.h
+++ b/drivers/scsi/bfa/include/defs/bfa_defs_pport.h
@@ -61,7 +61,7 @@ enum bfa_pport_speed {
  * 		Port operational type (in sync with SNIA port type).
  */
 enum bfa_pport_type {
-	BFA_PPORT_TYPE_UNKNOWN = 1,	/*  port type is unkown */
+	BFA_PPORT_TYPE_UNKNOWN = 1,	/*  port type is unknown */
 	BFA_PPORT_TYPE_TRUNKED = 2,	/*  Trunked mode */
 	BFA_PPORT_TYPE_NPORT   = 5,	/*  P2P with switched fabric */
 	BFA_PPORT_TYPE_NLPORT  = 6,	/*  public loop */
diff --git a/drivers/scsi/bfa/include/defs/bfa_defs_tsensor.h b/drivers/scsi/bfa/include/defs/bfa_defs_tsensor.h
index 31881d218515..ade763dbc8ce 100644
--- a/drivers/scsi/bfa/include/defs/bfa_defs_tsensor.h
+++ b/drivers/scsi/bfa/include/defs/bfa_defs_tsensor.h
@@ -25,7 +25,7 @@
  * Temperature sensor status values
  */
 enum bfa_tsensor_status {
-	BFA_TSENSOR_STATUS_UNKNOWN   = 1,   /*  unkown status */
+	BFA_TSENSOR_STATUS_UNKNOWN   = 1,   /*  unknown status */
 	BFA_TSENSOR_STATUS_FAULTY    = 2,   /*  sensor is faulty */
 	BFA_TSENSOR_STATUS_BELOW_MIN = 3,   /*  temperature below mininum */
 	BFA_TSENSOR_STATUS_NOMINAL   = 4,   /*  normal temperature */
diff --git a/drivers/scsi/bfa/include/fcs/bfa_fcs_fabric.h b/drivers/scsi/bfa/include/fcs/bfa_fcs_fabric.h
index 4ffd2242d3de..08b79d5e46f3 100644
--- a/drivers/scsi/bfa/include/fcs/bfa_fcs_fabric.h
+++ b/drivers/scsi/bfa/include/fcs/bfa_fcs_fabric.h
@@ -75,7 +75,7 @@ struct bfa_fcs_fabric_s {
 							    */
 };
 
-#define bfa_fcs_fabric_npiv_capable(__f)    (__f)->is_npiv
+#define bfa_fcs_fabric_npiv_capable(__f)    ((__f)->is_npiv)
 #define bfa_fcs_fabric_is_switched(__f)			\
 	((__f)->fab_type == BFA_FCS_FABRIC_SWITCHED)
 
diff --git a/drivers/scsi/bfa/include/fcs/bfa_fcs_lport.h b/drivers/scsi/bfa/include/fcs/bfa_fcs_lport.h
index b85cba884b96..967ceb0eb074 100644
--- a/drivers/scsi/bfa/include/fcs/bfa_fcs_lport.h
+++ b/drivers/scsi/bfa/include/fcs/bfa_fcs_lport.h
@@ -125,12 +125,12 @@ union bfa_fcs_port_topo_u {
 struct bfa_fcs_port_s {
 	struct list_head         qe;	/*  used by port/vport */
 	bfa_sm_t               sm;	/*  state machine */
-	struct bfa_fcs_fabric_s *fabric;	/*  parent fabric */
-	struct bfa_port_cfg_s  port_cfg;	/*  port configuration */
+	struct bfa_fcs_fabric_s *fabric;/*  parent fabric */
+	struct bfa_port_cfg_s  port_cfg;/*  port configuration */
 	struct bfa_timer_s link_timer;	/*  timer for link offline */
-	u32        pid : 24;	/*  FC address */
-	u8         lp_tag;		/*  lport tag */
-	u16        num_rports;	/*  Num of r-ports */
+	u32 pid:24;	/*  FC address */
+	u8  lp_tag;	/*  lport tag */
+	u16 num_rports;	/*  Num of r-ports */
 	struct list_head rport_q;	/*  queue of discovered r-ports */
 	struct bfa_fcs_s *fcs;	/*  FCS instance */
 	union bfa_fcs_port_topo_u port_topo;	/*  fabric/loop/n2n details */
@@ -188,13 +188,14 @@ bfa_fcs_port_get_drvport(struct bfa_fcs_port_s *port)
 }
 
 
-#define bfa_fcs_port_get_opertype(_lport)	(_lport)->fabric->oper_type
+#define bfa_fcs_port_get_opertype(_lport)	((_lport)->fabric->oper_type)
 
 
-#define bfa_fcs_port_get_fabric_name(_lport)	(_lport)->fabric->fabric_name
+#define bfa_fcs_port_get_fabric_name(_lport)	((_lport)->fabric->fabric_name)
 
 
-#define bfa_fcs_port_get_fabric_ipaddr(_lport)	(_lport)->fabric->fabric_ip_addr
+#define bfa_fcs_port_get_fabric_ipaddr(_lport) \
+		((_lport)->fabric->fabric_ip_addr)
 
 /**
  * bfa fcs port public functions
diff --git a/drivers/scsi/bfa/include/protocol/ct.h b/drivers/scsi/bfa/include/protocol/ct.h
index c59d6630b070..b82540a230c4 100644
--- a/drivers/scsi/bfa/include/protocol/ct.h
+++ b/drivers/scsi/bfa/include/protocol/ct.h
@@ -82,7 +82,7 @@ enum {
 };
 
 /*
- * defintions for CT reason code
+ * definitions for CT reason code
  */
 enum {
 	CT_RSN_INV_CMD		= 0x01,
@@ -129,7 +129,7 @@ enum {
 };
 
 /*
- * defintions for the explanation code for all servers
+ * definitions for the explanation code for all servers
  */
 enum {
 	CT_EXP_AUTH_EXCEPTION			= 0xF1,
@@ -193,11 +193,11 @@ struct fcgs_rftid_req_s {
 #define FC_GS_FCP_FC4_FEATURE_TARGET	 0x01
 
 struct fcgs_rffid_req_s{
-    u32    rsvd          :8;
-    u32    dap        	  :24;		/* port identifier	*/
-    u32    rsvd1         :16;
-    u32    fc4ftr_bits   :8;		/* fc4 feature bits	*/
-    u32    fc4_type      :8;		/* corresponding FC4 Type */
+    u32    rsvd:8;
+    u32    dap:24;		/* port identifier	*/
+    u32    rsvd1:16;
+    u32    fc4ftr_bits:8;	/* fc4 feature bits	*/
+    u32    fc4_type:8;	/* corresponding FC4 Type */
 };
 
 /**
diff --git a/drivers/scsi/bfa/include/protocol/fc.h b/drivers/scsi/bfa/include/protocol/fc.h
index 3e39ba58cfb5..14969eecf6a9 100644
--- a/drivers/scsi/bfa/include/protocol/fc.h
+++ b/drivers/scsi/bfa/include/protocol/fc.h
@@ -486,14 +486,14 @@ struct fc_rsi_s {
  * see FC-PH-X table 113 & 115 for explanation also FCP table 8
  */
 struct fc_prli_params_s{
-	u32        reserved: 16;
+	u32        reserved:16;
 #ifdef __BIGENDIAN
-	u32        reserved1: 5;
-	u32        rec_support : 1;
-	u32        task_retry_id : 1;
-	u32        retry : 1;
+	u32        reserved1:5;
+	u32        rec_support:1;
+	u32        task_retry_id:1;
+	u32        retry:1;
 
-	u32        confirm : 1;
+	u32        confirm:1;
 	u32        doverlay:1;
 	u32        initiator:1;
 	u32        target:1;
@@ -502,10 +502,10 @@ struct fc_prli_params_s{
 	u32        rxrdisab:1;
 	u32        wxrdisab:1;
 #else
-	u32        retry : 1;
-	u32        task_retry_id : 1;
-	u32        rec_support : 1;
-	u32        reserved1: 5;
+	u32        retry:1;
+	u32        task_retry_id:1;
+	u32        rec_support:1;
+	u32        reserved1:5;
 
 	u32        wxrdisab:1;
 	u32        rxrdisab:1;
@@ -514,7 +514,7 @@ struct fc_prli_params_s{
 	u32        target:1;
 	u32        initiator:1;
 	u32        doverlay:1;
-	u32        confirm : 1;
+	u32        confirm:1;
 #endif
 };
 
diff --git a/drivers/scsi/bfa/loop.c b/drivers/scsi/bfa/loop.c
index a418dedebe9e..f7c7f4f3c640 100644
--- a/drivers/scsi/bfa/loop.c
+++ b/drivers/scsi/bfa/loop.c
@@ -58,49 +58,16 @@ static const u8   port_loop_alpa_map[] = {
 /*
  * Local Functions
  */
-bfa_status_t    bfa_fcs_port_loop_send_plogi(struct bfa_fcs_port_s *port,
-					     u8 alpa);
-
-void            bfa_fcs_port_loop_plogi_response(void *fcsarg,
-						 struct bfa_fcxp_s *fcxp,
-						 void *cbarg,
-						 bfa_status_t req_status,
-						 u32 rsp_len,
-						 u32 resid_len,
-						 struct fchs_s *rsp_fchs);
-
-bfa_status_t    bfa_fcs_port_loop_send_adisc(struct bfa_fcs_port_s *port,
-					     u8 alpa);
-
-void            bfa_fcs_port_loop_adisc_response(void *fcsarg,
-						 struct bfa_fcxp_s *fcxp,
-						 void *cbarg,
-						 bfa_status_t req_status,
-						 u32 rsp_len,
-						 u32 resid_len,
-						 struct fchs_s *rsp_fchs);
-
-bfa_status_t    bfa_fcs_port_loop_send_plogi_acc(struct bfa_fcs_port_s *port,
-						 u8 alpa);
-
-void            bfa_fcs_port_loop_plogi_acc_response(void *fcsarg,
-						     struct bfa_fcxp_s *fcxp,
-						     void *cbarg,
-						     bfa_status_t req_status,
-						     u32 rsp_len,
-						     u32 resid_len,
-						     struct fchs_s *rsp_fchs);
-
-bfa_status_t    bfa_fcs_port_loop_send_adisc_acc(struct bfa_fcs_port_s *port,
-						 u8 alpa);
-
-void            bfa_fcs_port_loop_adisc_acc_response(void *fcsarg,
-						     struct bfa_fcxp_s *fcxp,
-						     void *cbarg,
-						     bfa_status_t req_status,
-						     u32 rsp_len,
-						     u32 resid_len,
-						     struct fchs_s *rsp_fchs);
+static bfa_status_t bfa_fcs_port_loop_send_plogi(struct bfa_fcs_port_s *port,
+					u8 alpa);
+
+static void bfa_fcs_port_loop_plogi_response(void *fcsarg,
+					struct bfa_fcxp_s *fcxp,
+					void *cbarg,
+					bfa_status_t req_status,
+					u32 rsp_len,
+					u32 resid_len,
+					struct fchs_s *rsp_fchs);
 /**
  *   Called by port to initializar in provate LOOP topology.
  */
@@ -179,7 +146,7 @@ bfa_fcs_port_loop_lip(struct bfa_fcs_port_s *port)
 /**
  * Local Functions.
  */
-bfa_status_t
+static bfa_status_t
 bfa_fcs_port_loop_send_plogi(struct bfa_fcs_port_s *port, u8 alpa)
 {
 	struct fchs_s          fchs;
@@ -208,7 +175,7 @@ bfa_fcs_port_loop_send_plogi(struct bfa_fcs_port_s *port, u8 alpa)
 /**
  *   Called by fcxp to notify the Plogi response
  */
-void
+static void
 bfa_fcs_port_loop_plogi_response(void *fcsarg, struct bfa_fcxp_s *fcxp,
 				 void *cbarg, bfa_status_t req_status,
 				 u32 rsp_len, u32 resid_len,
@@ -244,179 +211,3 @@ bfa_fcs_port_loop_plogi_response(void *fcsarg, struct bfa_fcxp_s *fcxp,
 		bfa_assert(0);
 	}
 }
-
-bfa_status_t
-bfa_fcs_port_loop_send_plogi_acc(struct bfa_fcs_port_s *port, u8 alpa)
-{
-	struct fchs_s          fchs;
-	struct bfa_fcxp_s *fcxp;
-	int             len;
-
-	bfa_trc(port->fcs, alpa);
-
-	fcxp = bfa_fcxp_alloc(NULL, port->fcs->bfa, 0, 0, NULL, NULL, NULL,
-				  NULL);
-	bfa_assert(fcxp);
-
-	len = fc_plogi_acc_build(&fchs, bfa_fcxp_get_reqbuf(fcxp), alpa,
-				 bfa_fcs_port_get_fcid(port), 0,
-				 port->port_cfg.pwwn, port->port_cfg.nwwn,
-				 bfa_pport_get_maxfrsize(port->fcs->bfa));
-
-	bfa_fcxp_send(fcxp, NULL, port->fabric->vf_id, port->lp_tag, BFA_FALSE,
-				 FC_CLASS_3, len, &fchs,
-				 bfa_fcs_port_loop_plogi_acc_response,
-				 (void *)port, FC_MAX_PDUSZ, 0); /* No response
-								  * expected
-								  */
-
-	return BFA_STATUS_OK;
-}
-
-/*
- *  Plogi Acc Response
- * We donot do any processing here.
- */
-void
-bfa_fcs_port_loop_plogi_acc_response(void *fcsarg, struct bfa_fcxp_s *fcxp,
-				     void *cbarg, bfa_status_t req_status,
-				     u32 rsp_len, u32 resid_len,
-				     struct fchs_s *rsp_fchs)
-{
-
-	struct bfa_fcs_port_s *port = (struct bfa_fcs_port_s *) cbarg;
-
-	bfa_trc(port->fcs, port->pid);
-
-	/*
-	 * Sanity Checks
-	 */
-	if (req_status != BFA_STATUS_OK) {
-		bfa_trc(port->fcs, req_status);
-		return;
-	}
-}
-
-bfa_status_t
-bfa_fcs_port_loop_send_adisc(struct bfa_fcs_port_s *port, u8 alpa)
-{
-	struct fchs_s          fchs;
-	struct bfa_fcxp_s *fcxp;
-	int             len;
-
-	bfa_trc(port->fcs, alpa);
-
-	fcxp = bfa_fcxp_alloc(NULL, port->fcs->bfa, 0, 0, NULL, NULL, NULL,
-				  NULL);
-	bfa_assert(fcxp);
-
-	len = fc_adisc_build(&fchs, bfa_fcxp_get_reqbuf(fcxp), alpa,
-			     bfa_fcs_port_get_fcid(port), 0,
-			     port->port_cfg.pwwn, port->port_cfg.nwwn);
-
-	bfa_fcxp_send(fcxp, NULL, port->fabric->vf_id, port->lp_tag, BFA_FALSE,
-			  FC_CLASS_3, len, &fchs,
-			  bfa_fcs_port_loop_adisc_response, (void *)port,
-			  FC_MAX_PDUSZ, FC_RA_TOV);
-
-	return BFA_STATUS_OK;
-}
-
-/**
- *   Called by fcxp to notify the ADISC response
- */
-void
-bfa_fcs_port_loop_adisc_response(void *fcsarg, struct bfa_fcxp_s *fcxp,
-				 void *cbarg, bfa_status_t req_status,
-				 u32 rsp_len, u32 resid_len,
-				 struct fchs_s *rsp_fchs)
-{
-	struct bfa_fcs_port_s *port = (struct bfa_fcs_port_s *) cbarg;
-	struct bfa_fcs_rport_s *rport;
-	struct fc_adisc_s     *adisc_resp;
-	struct fc_els_cmd_s   *els_cmd;
-	u32        pid = rsp_fchs->s_id;
-
-	bfa_trc(port->fcs, req_status);
-
-	/*
-	 * Sanity Checks
-	 */
-	if (req_status != BFA_STATUS_OK) {
-		/*
-		 * TBD : we may need to retry certain requests
-		 */
-		bfa_fcxp_free(fcxp);
-		return;
-	}
-
-	els_cmd = (struct fc_els_cmd_s *) BFA_FCXP_RSP_PLD(fcxp);
-	adisc_resp = (struct fc_adisc_s *) els_cmd;
-
-	if (els_cmd->els_code == FC_ELS_ACC) {
-	} else {
-		bfa_trc(port->fcs, adisc_resp->els_cmd.els_code);
-
-		/*
-		 * TBD: we may need to check for reject codes and retry
-		 */
-		rport = bfa_fcs_port_get_rport_by_pid(port, pid);
-		if (rport) {
-			list_del(&rport->qe);
-			bfa_fcs_rport_delete(rport);
-		}
-
-	}
-	return;
-}
-
-bfa_status_t
-bfa_fcs_port_loop_send_adisc_acc(struct bfa_fcs_port_s *port, u8 alpa)
-{
-	struct fchs_s          fchs;
-	struct bfa_fcxp_s *fcxp;
-	int             len;
-
-	bfa_trc(port->fcs, alpa);
-
-	fcxp = bfa_fcxp_alloc(NULL, port->fcs->bfa, 0, 0, NULL, NULL, NULL,
-				  NULL);
-	bfa_assert(fcxp);
-
-	len = fc_adisc_acc_build(&fchs, bfa_fcxp_get_reqbuf(fcxp), alpa,
-				 bfa_fcs_port_get_fcid(port), 0,
-				 port->port_cfg.pwwn, port->port_cfg.nwwn);
-
-	bfa_fcxp_send(fcxp, NULL, port->fabric->vf_id, port->lp_tag, BFA_FALSE,
-				FC_CLASS_3, len, &fchs,
-				bfa_fcs_port_loop_adisc_acc_response,
-				(void *)port, FC_MAX_PDUSZ, 0); /* no reponse
-								 * expected
-								 */
-
-	return BFA_STATUS_OK;
-}
-
-/*
- *  Adisc Acc Response
- * We donot do any processing here.
- */
-void
-bfa_fcs_port_loop_adisc_acc_response(void *fcsarg, struct bfa_fcxp_s *fcxp,
-				     void *cbarg, bfa_status_t req_status,
-				     u32 rsp_len, u32 resid_len,
-				     struct fchs_s *rsp_fchs)
-{
-
-	struct bfa_fcs_port_s *port = (struct bfa_fcs_port_s *) cbarg;
-
-	bfa_trc(port->fcs, port->pid);
-
-	/*
-	 * Sanity Checks
-	 */
-	if (req_status != BFA_STATUS_OK) {
-		bfa_trc(port->fcs, req_status);
-		return;
-	}
-}
diff --git a/drivers/scsi/bfa/lport_api.c b/drivers/scsi/bfa/lport_api.c
index 8f51a83f1834..1e06792cd4c2 100644
--- a/drivers/scsi/bfa/lport_api.c
+++ b/drivers/scsi/bfa/lport_api.c
@@ -43,7 +43,7 @@ bfa_fcs_cfg_base_port(struct bfa_fcs_s *fcs, struct bfa_port_cfg_s *port_cfg)
 struct bfa_fcs_port_s *
 bfa_fcs_get_base_port(struct bfa_fcs_s *fcs)
 {
-	return (&fcs->fabric.bport);
+	return &fcs->fabric.bport;
 }
 
 wwn_t
@@ -88,11 +88,10 @@ bfa_fcs_port_get_rport(struct bfa_fcs_port_s *port, wwn_t wwn, int index,
 	}
 
 	bfa_trc(fcs, i);
-	if (rport) {
+	if (rport)
 		return rport->pwwn;
-	} else {
+	else
 		return (wwn_t) 0;
-	}
 }
 
 void
@@ -198,17 +197,17 @@ bfa_fcs_lookup_port(struct bfa_fcs_s *fcs, u16 vf_id, wwn_t lpwwn)
 	vf = bfa_fcs_vf_lookup(fcs, vf_id);
 	if (vf == NULL) {
 		bfa_trc(fcs, vf_id);
-		return (NULL);
+		return NULL;
 	}
 
 	if (!lpwwn || (vf->bport.port_cfg.pwwn == lpwwn))
-		return (&vf->bport);
+		return &vf->bport;
 
 	vport = bfa_fcs_fabric_vport_lookup(vf, lpwwn);
 	if (vport)
-		return (&vport->lport);
+		return &vport->lport;
 
-	return (NULL);
+	return NULL;
 }
 
 /*
diff --git a/drivers/scsi/bfa/ns.c b/drivers/scsi/bfa/ns.c
index 59fea99d67a4..2f8b880060bb 100644
--- a/drivers/scsi/bfa/ns.c
+++ b/drivers/scsi/bfa/ns.c
@@ -932,11 +932,10 @@ bfa_fcs_port_ns_send_rff_id(void *ns_cbarg, struct bfa_fcxp_s *fcxp_alloced)
 	}
 	ns->fcxp = fcxp;
 
-	if (BFA_FCS_VPORT_IS_INITIATOR_MODE(ns->port)) {
+	if (BFA_FCS_VPORT_IS_INITIATOR_MODE(ns->port))
 		fc4_ftrs = FC_GS_FCP_FC4_FEATURE_INITIATOR;
-	} else if (BFA_FCS_VPORT_IS_TARGET_MODE(ns->port)) {
+	else if (BFA_FCS_VPORT_IS_TARGET_MODE(ns->port))
 		fc4_ftrs = FC_GS_FCP_FC4_FEATURE_TARGET;
-	}
 
 	len = fc_rffid_build(&fchs, bfa_fcxp_get_reqbuf(fcxp),
 			     bfa_fcs_port_get_fcid(port), 0, FC_TYPE_FCP,
diff --git a/drivers/scsi/bfa/plog.c b/drivers/scsi/bfa/plog.c
index 86af818d17bb..fcb8864d3276 100644
--- a/drivers/scsi/bfa/plog.c
+++ b/drivers/scsi/bfa/plog.c
@@ -180,5 +180,5 @@ bfa_plog_disable(struct bfa_plog_s *plog)
 bfa_boolean_t
 bfa_plog_get_setting(struct bfa_plog_s *plog)
 {
-	return((bfa_boolean_t)plog->plog_enabled);
+	return (bfa_boolean_t)plog->plog_enabled;
 }
diff --git a/drivers/scsi/bfa/rport_ftrs.c b/drivers/scsi/bfa/rport_ftrs.c
index 8a1f59d596c1..e1932c885ac2 100644
--- a/drivers/scsi/bfa/rport_ftrs.c
+++ b/drivers/scsi/bfa/rport_ftrs.c
@@ -79,7 +79,7 @@ bfa_fcs_rpf_sm_uninit(struct bfa_fcs_rpf_s *rpf, enum rpf_event event)
 	bfa_trc(rport->fcs, event);
 
 	switch (event) {
-	case RPFSM_EVENT_RPORT_ONLINE :
+	case RPFSM_EVENT_RPORT_ONLINE:
 		if (!BFA_FCS_PID_IS_WKA(rport->pid)) {
 			bfa_sm_set_state(rpf, bfa_fcs_rpf_sm_rpsc_sending);
 			rpf->rpsc_retries = 0;
@@ -87,7 +87,7 @@ bfa_fcs_rpf_sm_uninit(struct bfa_fcs_rpf_s *rpf, enum rpf_event event)
 			break;
 		};
 
-	case RPFSM_EVENT_RPORT_OFFLINE :
+	case RPFSM_EVENT_RPORT_OFFLINE:
 		break;
 
 	default:
@@ -107,7 +107,7 @@ bfa_fcs_rpf_sm_rpsc_sending(struct bfa_fcs_rpf_s *rpf, enum rpf_event event)
 		bfa_sm_set_state(rpf, bfa_fcs_rpf_sm_rpsc);
 		break;
 
-	case RPFSM_EVENT_RPORT_OFFLINE :
+	case RPFSM_EVENT_RPORT_OFFLINE:
 		bfa_sm_set_state(rpf, bfa_fcs_rpf_sm_offline);
 		bfa_fcxp_walloc_cancel(rport->fcs->bfa, &rpf->fcxp_wqe);
 		rpf->rpsc_retries = 0;
@@ -130,11 +130,10 @@ bfa_fcs_rpf_sm_rpsc(struct bfa_fcs_rpf_s *rpf, enum rpf_event event)
 	case RPFSM_EVENT_RPSC_COMP:
 		bfa_sm_set_state(rpf, bfa_fcs_rpf_sm_online);
 		/* Update speed info in f/w via BFA */
-		if (rpf->rpsc_speed != BFA_PPORT_SPEED_UNKNOWN) {
+		if (rpf->rpsc_speed != BFA_PPORT_SPEED_UNKNOWN)
 			bfa_rport_speed(rport->bfa_rport, rpf->rpsc_speed);
-		} else if (rpf->assigned_speed != BFA_PPORT_SPEED_UNKNOWN) {
+		else if (rpf->assigned_speed != BFA_PPORT_SPEED_UNKNOWN)
 			bfa_rport_speed(rport->bfa_rport, rpf->assigned_speed);
-		}
 		break;
 
 	case RPFSM_EVENT_RPSC_FAIL:
@@ -154,7 +153,7 @@ bfa_fcs_rpf_sm_rpsc(struct bfa_fcs_rpf_s *rpf, enum rpf_event event)
 		}
 		break;
 
-	case RPFSM_EVENT_RPORT_OFFLINE :
+	case RPFSM_EVENT_RPORT_OFFLINE:
 		bfa_sm_set_state(rpf, bfa_fcs_rpf_sm_offline);
 		bfa_fcxp_discard(rpf->fcxp);
 		rpf->rpsc_retries = 0;
@@ -174,13 +173,13 @@ bfa_fcs_rpf_sm_rpsc_retry(struct bfa_fcs_rpf_s *rpf, enum rpf_event event)
 	bfa_trc(rport->fcs, event);
 
 	switch (event) {
-	case RPFSM_EVENT_TIMEOUT :
+	case RPFSM_EVENT_TIMEOUT:
 		/* re-send the RPSC */
 		bfa_sm_set_state(rpf, bfa_fcs_rpf_sm_rpsc_sending);
 		bfa_fcs_rpf_send_rpsc2(rpf, NULL);
 		break;
 
-	case RPFSM_EVENT_RPORT_OFFLINE :
+	case RPFSM_EVENT_RPORT_OFFLINE:
 		bfa_timer_stop(&rpf->timer);
 		bfa_sm_set_state(rpf, bfa_fcs_rpf_sm_offline);
 		rpf->rpsc_retries = 0;
@@ -201,7 +200,7 @@ bfa_fcs_rpf_sm_online(struct bfa_fcs_rpf_s *rpf, enum rpf_event event)
 	bfa_trc(rport->fcs, event);
 
 	switch (event) {
-	case RPFSM_EVENT_RPORT_OFFLINE :
+	case RPFSM_EVENT_RPORT_OFFLINE:
 		bfa_sm_set_state(rpf, bfa_fcs_rpf_sm_offline);
 		rpf->rpsc_retries = 0;
 		break;
@@ -221,12 +220,12 @@ bfa_fcs_rpf_sm_offline(struct bfa_fcs_rpf_s *rpf, enum rpf_event event)
 	bfa_trc(rport->fcs, event);
 
 	switch (event) {
-	case RPFSM_EVENT_RPORT_ONLINE :
+	case RPFSM_EVENT_RPORT_ONLINE:
 		bfa_sm_set_state(rpf, bfa_fcs_rpf_sm_rpsc_sending);
 		bfa_fcs_rpf_send_rpsc2(rpf, NULL);
 		break;
 
-	case RPFSM_EVENT_RPORT_OFFLINE :
+	case RPFSM_EVENT_RPORT_OFFLINE:
 		break;
 
 	default:
@@ -366,10 +365,9 @@ bfa_fcs_rpf_rpsc2_response(void *fcsarg, struct bfa_fcxp_s *fcxp, void *cbarg,
 		bfa_trc(rport->fcs, ls_rjt->reason_code);
 		bfa_trc(rport->fcs, ls_rjt->reason_code_expl);
 		rport->stats.rpsc_rejects++;
-		if (ls_rjt->reason_code == FC_LS_RJT_RSN_CMD_NOT_SUPP) {
+		if (ls_rjt->reason_code == FC_LS_RJT_RSN_CMD_NOT_SUPP)
 			bfa_sm_send_event(rpf, RPFSM_EVENT_RPSC_FAIL);
-		} else {
+		else
 			bfa_sm_send_event(rpf, RPFSM_EVENT_RPSC_ERROR);
-		}
 	}
 }
diff --git a/drivers/scsi/bfa/vfapi.c b/drivers/scsi/bfa/vfapi.c
index 31d81fe2fc48..391a4790bebd 100644
--- a/drivers/scsi/bfa/vfapi.c
+++ b/drivers/scsi/bfa/vfapi.c
@@ -189,7 +189,7 @@ bfa_fcs_vf_lookup(struct bfa_fcs_s *fcs, u16 vf_id)
 {
 	bfa_trc(fcs, vf_id);
 	if (vf_id == FC_VF_ID_NULL)
-		return (&fcs->fabric);
+		return &fcs->fabric;
 
 	/**
 	 * @todo vf support
diff --git a/drivers/scsi/bfa/vport.c b/drivers/scsi/bfa/vport.c
index c10af06c5714..e90f1e38c32d 100644
--- a/drivers/scsi/bfa/vport.c
+++ b/drivers/scsi/bfa/vport.c
@@ -31,13 +31,13 @@
 
 BFA_TRC_FILE(FCS, VPORT);
 
-#define __vport_fcs(__vp)       (__vp)->lport.fcs
-#define __vport_pwwn(__vp)      (__vp)->lport.port_cfg.pwwn
-#define __vport_nwwn(__vp)      (__vp)->lport.port_cfg.nwwn
-#define __vport_bfa(__vp)       (__vp)->lport.fcs->bfa
-#define __vport_fcid(__vp)      (__vp)->lport.pid
-#define __vport_fabric(__vp)    (__vp)->lport.fabric
-#define __vport_vfid(__vp)      (__vp)->lport.fabric->vf_id
+#define __vport_fcs(__vp)       ((__vp)->lport.fcs)
+#define __vport_pwwn(__vp)      ((__vp)->lport.port_cfg.pwwn)
+#define __vport_nwwn(__vp)      ((__vp)->lport.port_cfg.nwwn)
+#define __vport_bfa(__vp)       ((__vp)->lport.fcs->bfa)
+#define __vport_fcid(__vp)      ((__vp)->lport.pid)
+#define __vport_fabric(__vp)    ((__vp)->lport.fabric)
+#define __vport_vfid(__vp)      ((__vp)->lport.fabric->vf_id)
 
 #define BFA_FCS_VPORT_MAX_RETRIES  5
 /*
@@ -641,9 +641,9 @@ bfa_fcs_vport_get_max(struct bfa_fcs_s *fcs)
 	bfa_get_attr(fcs->bfa, &ioc_attr);
 
 	if (ioc_attr.pci_attr.device_id == BFA_PCI_DEVICE_ID_CT)
-		return (BFA_FCS_MAX_VPORTS_SUPP_CT);
+		return BFA_FCS_MAX_VPORTS_SUPP_CT;
 	else
-		return (BFA_FCS_MAX_VPORTS_SUPP_CB);
+		return BFA_FCS_MAX_VPORTS_SUPP_CB;
 }
 
 
@@ -675,7 +675,7 @@ bfa_fcs_vport_create(struct bfa_fcs_vport_s *vport, struct bfa_fcs_s *fcs,
 		     struct bfad_vport_s *vport_drv)
 {
 	if (vport_cfg->pwwn == 0)
-		return (BFA_STATUS_INVALID_WWN);
+		return BFA_STATUS_INVALID_WWN;
 
 	if (bfa_fcs_port_get_pwwn(&fcs->fabric.bport) == vport_cfg->pwwn)
 		return BFA_STATUS_VPORT_WWN_BP;
diff --git a/drivers/scsi/bnx2i/bnx2i.h b/drivers/scsi/bnx2i/bnx2i.h
index 5edde1a8c04d..6cf9dc37d78b 100644
--- a/drivers/scsi/bnx2i/bnx2i.h
+++ b/drivers/scsi/bnx2i/bnx2i.h
@@ -232,7 +232,6 @@ struct bnx2i_conn {
 	struct iscsi_cls_conn *cls_conn;
 	struct bnx2i_hba *hba;
 	struct completion cmd_cleanup_cmpl;
-	int is_bound;
 
 	u32 iscsi_conn_cid;
 #define BNX2I_CID_RESERVED	0x5AFF
@@ -685,6 +684,7 @@ extern unsigned int error_mask1, error_mask2;
 extern u64 iscsi_error_mask;
 extern unsigned int en_tcp_dack;
 extern unsigned int event_coal_div;
+extern unsigned int event_coal_min;
 
 extern struct scsi_transport_template *bnx2i_scsi_xport_template;
 extern struct iscsi_transport bnx2i_iscsi_transport;
diff --git a/drivers/scsi/bnx2i/bnx2i_hwi.c b/drivers/scsi/bnx2i/bnx2i_hwi.c
index 5c8d7630c13e..1af578dec276 100644
--- a/drivers/scsi/bnx2i/bnx2i_hwi.c
+++ b/drivers/scsi/bnx2i/bnx2i_hwi.c
@@ -133,20 +133,38 @@ void bnx2i_arm_cq_event_coalescing(struct bnx2i_endpoint *ep, u8 action)
 {
 	struct bnx2i_5771x_cq_db *cq_db;
 	u16 cq_index;
+	u16 next_index;
+	u32 num_active_cmds;
 
+
+	/* Coalesce CQ entries only on 10G devices */
 	if (!test_bit(BNX2I_NX2_DEV_57710, &ep->hba->cnic_dev_type))
 		return;
 
+	/* Do not update CQ DB multiple times before firmware writes
+	 * '0xFFFF' to CQDB->SQN field. Deviation may cause spurious
+	 * interrupts and other unwanted results
+	 */
+	cq_db = (struct bnx2i_5771x_cq_db *) ep->qp.cq_pgtbl_virt;
+	if (cq_db->sqn[0] && cq_db->sqn[0] != 0xFFFF)
+		return;
+
 	if (action == CNIC_ARM_CQE) {
-		cq_index = ep->qp.cqe_exp_seq_sn +
-			   ep->num_active_cmds / event_coal_div;
-		cq_index %= (ep->qp.cqe_size * 2 + 1);
-		if (!cq_index) {
+		num_active_cmds = ep->num_active_cmds;
+		if (num_active_cmds <= event_coal_min)
+			next_index = 1;
+		else
+			next_index = event_coal_min +
+				(num_active_cmds - event_coal_min) / event_coal_div;
+		if (!next_index)
+			next_index = 1;
+		cq_index = ep->qp.cqe_exp_seq_sn + next_index - 1;
+		if (cq_index > ep->qp.cqe_size * 2)
+			cq_index -= ep->qp.cqe_size * 2;
+		if (!cq_index)
 			cq_index = 1;
-			cq_db = (struct bnx2i_5771x_cq_db *)
-					ep->qp.cq_pgtbl_virt;
-			cq_db->sqn[0] = cq_index;
-		}
+
+		cq_db->sqn[0] = cq_index;
 	}
 }
 
@@ -366,6 +384,7 @@ int bnx2i_send_iscsi_tmf(struct bnx2i_conn *bnx2i_conn,
 	struct bnx2i_cmd *bnx2i_cmd;
 	struct bnx2i_tmf_request *tmfabort_wqe;
 	u32 dword;
+	u32 scsi_lun[2];
 
 	bnx2i_cmd = (struct bnx2i_cmd *)mtask->dd_data;
 	tmfabort_hdr = (struct iscsi_tm *)mtask->hdr;
@@ -376,27 +395,35 @@ int bnx2i_send_iscsi_tmf(struct bnx2i_conn *bnx2i_conn,
 	tmfabort_wqe->op_attr = 0;
 	tmfabort_wqe->op_attr =
 		ISCSI_TMF_REQUEST_ALWAYS_ONE | ISCSI_TM_FUNC_ABORT_TASK;
-	tmfabort_wqe->lun[0] = be32_to_cpu(tmfabort_hdr->lun[0]);
-	tmfabort_wqe->lun[1] = be32_to_cpu(tmfabort_hdr->lun[1]);
 
 	tmfabort_wqe->itt = (mtask->itt | (ISCSI_TASK_TYPE_MPATH << 14));
 	tmfabort_wqe->reserved2 = 0;
 	tmfabort_wqe->cmd_sn = be32_to_cpu(tmfabort_hdr->cmdsn);
 
 	ctask = iscsi_itt_to_task(conn, tmfabort_hdr->rtt);
-	if (!ctask || ctask->sc)
+	if (!ctask || !ctask->sc)
 		/*
 		 * the iscsi layer must have completed the cmd while this
 		 * was starting up.
+		 *
+		 * Note: In the case of a SCSI cmd timeout, the task's sc
+		 *       is still active; hence ctask->sc != 0
+		 *       In this case, the task must be aborted
 		 */
 		return 0;
+
 	ref_sc = ctask->sc;
 
+	/* Retrieve LUN directly from the ref_sc */
+	int_to_scsilun(ref_sc->device->lun, (struct scsi_lun *) scsi_lun);
+	tmfabort_wqe->lun[0] = be32_to_cpu(scsi_lun[0]);
+	tmfabort_wqe->lun[1] = be32_to_cpu(scsi_lun[1]);
+
 	if (ref_sc->sc_data_direction == DMA_TO_DEVICE)
 		dword = (ISCSI_TASK_TYPE_WRITE << ISCSI_CMD_REQUEST_TYPE_SHIFT);
 	else
 		dword = (ISCSI_TASK_TYPE_READ << ISCSI_CMD_REQUEST_TYPE_SHIFT);
-	tmfabort_wqe->ref_itt = (dword | tmfabort_hdr->rtt);
+	tmfabort_wqe->ref_itt = (dword | (tmfabort_hdr->rtt & ISCSI_ITT_MASK));
 	tmfabort_wqe->ref_cmd_sn = be32_to_cpu(tmfabort_hdr->refcmdsn);
 
 	tmfabort_wqe->bd_list_addr_lo = (u32) bnx2i_conn->hba->mp_bd_dma;
diff --git a/drivers/scsi/bnx2i/bnx2i_init.c b/drivers/scsi/bnx2i/bnx2i_init.c
index 0c4210d48ee8..6d8172e781cf 100644
--- a/drivers/scsi/bnx2i/bnx2i_init.c
+++ b/drivers/scsi/bnx2i/bnx2i_init.c
@@ -17,8 +17,8 @@ static struct list_head adapter_list = LIST_HEAD_INIT(adapter_list);
 static u32 adapter_count;
 
 #define DRV_MODULE_NAME		"bnx2i"
-#define DRV_MODULE_VERSION	"2.0.1e"
-#define DRV_MODULE_RELDATE	"June 22, 2009"
+#define DRV_MODULE_VERSION	"2.1.0"
+#define DRV_MODULE_RELDATE	"Dec 06, 2009"
 
 static char version[] __devinitdata =
 		"Broadcom NetXtreme II iSCSI Driver " DRV_MODULE_NAME \
@@ -32,6 +32,10 @@ MODULE_VERSION(DRV_MODULE_VERSION);
 
 static DEFINE_MUTEX(bnx2i_dev_lock);
 
+unsigned int event_coal_min = 24;
+module_param(event_coal_min, int, 0664);
+MODULE_PARM_DESC(event_coal_min, "Event Coalescing Minimum Commands");
+
 unsigned int event_coal_div = 1;
 module_param(event_coal_div, int, 0664);
 MODULE_PARM_DESC(event_coal_div, "Event Coalescing Divide Factor");
@@ -83,8 +87,12 @@ void bnx2i_identify_device(struct bnx2i_hba *hba)
 		set_bit(BNX2I_NX2_DEV_5709, &hba->cnic_dev_type);
 		hba->mail_queue_access = BNX2I_MQ_BIN_MODE;
 	} else if (hba->pci_did == PCI_DEVICE_ID_NX2_57710 ||
-		   hba->pci_did == PCI_DEVICE_ID_NX2_57711)
+		   hba->pci_did == PCI_DEVICE_ID_NX2_57711 ||
+		   hba->pci_did == PCI_DEVICE_ID_NX2_57711E)
 		set_bit(BNX2I_NX2_DEV_57710, &hba->cnic_dev_type);
+	else
+		printk(KERN_ALERT "bnx2i: unknown device, 0x%x\n",
+				  hba->pci_did);
 }
 
 
@@ -363,7 +371,7 @@ static int __init bnx2i_mod_init(void)
 
 	printk(KERN_INFO "%s", version);
 
-	if (!is_power_of_2(sq_size))
+	if (sq_size && !is_power_of_2(sq_size))
 		sq_size = roundup_pow_of_two(sq_size);
 
 	mutex_init(&bnx2i_dev_lock);
diff --git a/drivers/scsi/bnx2i/bnx2i_iscsi.c b/drivers/scsi/bnx2i/bnx2i_iscsi.c
index cafb888c2376..33b2294625bb 100644
--- a/drivers/scsi/bnx2i/bnx2i_iscsi.c
+++ b/drivers/scsi/bnx2i/bnx2i_iscsi.c
@@ -485,7 +485,6 @@ static int bnx2i_setup_cmd_pool(struct bnx2i_hba *hba,
 		struct iscsi_task *task = session->cmds[i];
 		struct bnx2i_cmd *cmd = task->dd_data;
 
-		/* Anil */
 		task->hdr = &cmd->hdr;
 		task->hdr_max = sizeof(struct iscsi_hdr);
 
@@ -765,7 +764,6 @@ struct bnx2i_hba *bnx2i_alloc_hba(struct cnic_dev *cnic)
 	hba->pci_svid = hba->pcidev->subsystem_vendor;
 	hba->pci_func = PCI_FUNC(hba->pcidev->devfn);
 	hba->pci_devno = PCI_SLOT(hba->pcidev->devfn);
-	bnx2i_identify_device(hba);
 
 	bnx2i_identify_device(hba);
 	bnx2i_setup_host_queue_size(hba, shost);
@@ -1161,9 +1159,6 @@ static int bnx2i_task_xmit(struct iscsi_task *task)
 	struct bnx2i_cmd *cmd = task->dd_data;
 	struct iscsi_cmd *hdr = (struct iscsi_cmd *) task->hdr;
 
-	if (!bnx2i_conn->is_bound)
-		return -ENOTCONN;
-
 	/*
 	 * If there is no scsi_cmnd this must be a mgmt task
 	 */
@@ -1371,7 +1366,6 @@ static int bnx2i_conn_bind(struct iscsi_cls_session *cls_session,
 	bnx2i_conn->ep = bnx2i_ep;
 	bnx2i_conn->iscsi_conn_cid = bnx2i_ep->ep_iscsi_cid;
 	bnx2i_conn->fw_cid = bnx2i_ep->ep_cid;
-	bnx2i_conn->is_bound = 1;
 
 	ret_code = bnx2i_bind_conn_to_iscsi_cid(hba, bnx2i_conn,
 						bnx2i_ep->ep_iscsi_cid);
@@ -1883,7 +1877,7 @@ static void bnx2i_ep_disconnect(struct iscsi_endpoint *ep)
 
 	bnx2i_ep = ep->dd_data;
 
-	/* driver should not attempt connection cleanup untill TCP_CONNECT
+	/* driver should not attempt connection cleanup until TCP_CONNECT
 	 * completes either successfully or fails. Timeout is 9-secs, so
 	 * wait for it to complete
 	 */
@@ -1896,9 +1890,7 @@ static void bnx2i_ep_disconnect(struct iscsi_endpoint *ep)
 		conn = bnx2i_conn->cls_conn->dd_data;
 		session = conn->session;
 
-		spin_lock_bh(&session->lock);
-		bnx2i_conn->is_bound = 0;
-		spin_unlock_bh(&session->lock);
+		iscsi_suspend_queue(conn);
 	}
 
 	hba = bnx2i_ep->hba;
@@ -2034,7 +2026,7 @@ struct iscsi_transport bnx2i_iscsi_transport = {
 				  ISCSI_USERNAME | ISCSI_PASSWORD |
 				  ISCSI_USERNAME_IN | ISCSI_PASSWORD_IN |
 				  ISCSI_FAST_ABORT | ISCSI_ABORT_TMO |
-				  ISCSI_LU_RESET_TMO |
+				  ISCSI_LU_RESET_TMO | ISCSI_TGT_RESET_TMO |
 				  ISCSI_PING_TMO | ISCSI_RECV_TMO |
 				  ISCSI_IFACE_NAME | ISCSI_INITIATOR_NAME,
 	.host_param_mask	= ISCSI_HOST_HWADDRESS | ISCSI_HOST_NETDEV_NAME,
diff --git a/drivers/scsi/constants.c b/drivers/scsi/constants.c
index 63abb06c4edb..9129bcf117cf 100644
--- a/drivers/scsi/constants.c
+++ b/drivers/scsi/constants.c
@@ -141,6 +141,7 @@ static const struct value_name_pair serv_out12_arr[] = {
 static const struct value_name_pair serv_in16_arr[] = {
 	{0x10, "Read capacity(16)"},
 	{0x11, "Read long(16)"},
+	{0x12, "Get LBA status"},
 };
 #define SERV_IN16_SZ ARRAY_SIZE(serv_in16_arr)
 
diff --git a/drivers/scsi/cxgb3i/cxgb3i_iscsi.c b/drivers/scsi/cxgb3i/cxgb3i_iscsi.c
index 2631bddd255e..969c83162cc4 100644
--- a/drivers/scsi/cxgb3i/cxgb3i_iscsi.c
+++ b/drivers/scsi/cxgb3i/cxgb3i_iscsi.c
@@ -937,7 +937,7 @@ static struct iscsi_transport cxgb3i_iscsi_transport = {
 				ISCSI_USERNAME | ISCSI_PASSWORD |
 				ISCSI_USERNAME_IN | ISCSI_PASSWORD_IN |
 				ISCSI_FAST_ABORT | ISCSI_ABORT_TMO |
-				ISCSI_LU_RESET_TMO |
+				ISCSI_LU_RESET_TMO | ISCSI_TGT_RESET_TMO |
 				ISCSI_PING_TMO | ISCSI_RECV_TMO |
 				ISCSI_IFACE_NAME | ISCSI_INITIATOR_NAME,
 	.host_param_mask	= ISCSI_HOST_HWADDRESS | ISCSI_HOST_IPADDRESS |
diff --git a/drivers/scsi/cxgb3i/cxgb3i_offload.c b/drivers/scsi/cxgb3i/cxgb3i_offload.c
index c1d5be4adf9c..15a00e8b7122 100644
--- a/drivers/scsi/cxgb3i/cxgb3i_offload.c
+++ b/drivers/scsi/cxgb3i/cxgb3i_offload.c
@@ -291,7 +291,7 @@ static void act_open_req_arp_failure(struct t3cdev *dev, struct sk_buff *skb)
 	c3cn_hold(c3cn);
 	spin_lock_bh(&c3cn->lock);
 	if (c3cn->state == C3CN_STATE_CONNECTING)
-		fail_act_open(c3cn, EHOSTUNREACH);
+		fail_act_open(c3cn, -EHOSTUNREACH);
 	spin_unlock_bh(&c3cn->lock);
 	c3cn_put(c3cn);
 	__kfree_skb(skb);
@@ -792,18 +792,18 @@ static int act_open_rpl_status_to_errno(int status)
 {
 	switch (status) {
 	case CPL_ERR_CONN_RESET:
-		return ECONNREFUSED;
+		return -ECONNREFUSED;
 	case CPL_ERR_ARP_MISS:
-		return EHOSTUNREACH;
+		return -EHOSTUNREACH;
 	case CPL_ERR_CONN_TIMEDOUT:
-		return ETIMEDOUT;
+		return -ETIMEDOUT;
 	case CPL_ERR_TCAM_FULL:
-		return ENOMEM;
+		return -ENOMEM;
 	case CPL_ERR_CONN_EXIST:
 		cxgb3i_log_error("ACTIVE_OPEN_RPL: 4-tuple in use\n");
-		return EADDRINUSE;
+		return -EADDRINUSE;
 	default:
-		return EIO;
+		return -EIO;
 	}
 }
 
@@ -817,7 +817,7 @@ static void act_open_retry_timer(unsigned long data)
 	spin_lock_bh(&c3cn->lock);
 	skb = alloc_skb(sizeof(struct cpl_act_open_req), GFP_ATOMIC);
 	if (!skb)
-		fail_act_open(c3cn, ENOMEM);
+		fail_act_open(c3cn, -ENOMEM);
 	else {
 		skb->sk = (struct sock *)c3cn;
 		set_arp_failure_handler(skb, act_open_req_arp_failure);
@@ -966,14 +966,14 @@ static int abort_status_to_errno(struct s3_conn *c3cn, int abort_reason,
 	case CPL_ERR_BAD_SYN: /* fall through */
 	case CPL_ERR_CONN_RESET:
 		return c3cn->state > C3CN_STATE_ESTABLISHED ?
-			EPIPE : ECONNRESET;
+			-EPIPE : -ECONNRESET;
 	case CPL_ERR_XMIT_TIMEDOUT:
 	case CPL_ERR_PERSIST_TIMEDOUT:
 	case CPL_ERR_FINWAIT2_TIMEDOUT:
 	case CPL_ERR_KEEPALIVE_TIMEDOUT:
-		return ETIMEDOUT;
+		return -ETIMEDOUT;
 	default:
-		return EIO;
+		return -EIO;
 	}
 }
 
@@ -1440,6 +1440,10 @@ void cxgb3i_c3cn_release(struct s3_conn *c3cn)
 static int is_cxgb3_dev(struct net_device *dev)
 {
 	struct cxgb3i_sdev_data *cdata;
+	struct net_device *ndev = dev;
+
+	if (dev->priv_flags & IFF_802_1Q_VLAN)
+		ndev = vlan_dev_real_dev(dev);
 
 	write_lock(&cdata_rwlock);
 	list_for_each_entry(cdata, &cdata_list, list) {
@@ -1447,7 +1451,7 @@ static int is_cxgb3_dev(struct net_device *dev)
 		int i;
 
 		for (i = 0; i < ports->nports; i++)
-			if (dev == ports->lldevs[i]) {
+			if (ndev == ports->lldevs[i]) {
 				write_unlock(&cdata_rwlock);
 				return 1;
 			}
@@ -1563,9 +1567,29 @@ free_tid:
 	s3_free_atid(cdev, c3cn->tid);
 	c3cn->tid = 0;
 out_err:
-	return -1;
+	return -EINVAL;
 }
 
+/**
+ * cxgb3i_find_dev - find the interface associated with the given address
+ * @ipaddr: ip address
+ */
+static struct net_device *
+cxgb3i_find_dev(struct net_device *dev, __be32 ipaddr)
+{
+	struct flowi fl;
+	int err;
+	struct rtable *rt;
+
+	memset(&fl, 0, sizeof(fl));
+	fl.nl_u.ip4_u.daddr = ipaddr;
+
+	err = ip_route_output_key(dev ? dev_net(dev) : &init_net, &rt, &fl);
+	if (!err)
+		return (&rt->u.dst)->dev;
+
+	return NULL;
+}
 
 /**
  * cxgb3i_c3cn_connect - initiates an iscsi tcp connection to a given address
@@ -1581,6 +1605,7 @@ int cxgb3i_c3cn_connect(struct net_device *dev, struct s3_conn *c3cn,
 	struct cxgb3i_sdev_data *cdata;
 	struct t3cdev *cdev;
 	__be32 sipv4;
+	struct net_device *dstdev;
 	int err;
 
 	c3cn_conn_debug("c3cn 0x%p, dev 0x%p.\n", c3cn, dev);
@@ -1591,6 +1616,13 @@ int cxgb3i_c3cn_connect(struct net_device *dev, struct s3_conn *c3cn,
 	c3cn->daddr.sin_port = usin->sin_port;
 	c3cn->daddr.sin_addr.s_addr = usin->sin_addr.s_addr;
 
+	dstdev = cxgb3i_find_dev(dev, usin->sin_addr.s_addr);
+	if (!dstdev || !is_cxgb3_dev(dstdev))
+		return -ENETUNREACH;
+
+	if (dstdev->priv_flags & IFF_802_1Q_VLAN)
+		dev = dstdev;
+
 	rt = find_route(dev, c3cn->saddr.sin_addr.s_addr,
 			c3cn->daddr.sin_addr.s_addr,
 			c3cn->saddr.sin_port,
diff --git a/drivers/scsi/cxgb3i/cxgb3i_pdu.c b/drivers/scsi/cxgb3i/cxgb3i_pdu.c
index 709105071177..1fe3b0f1f3c9 100644
--- a/drivers/scsi/cxgb3i/cxgb3i_pdu.c
+++ b/drivers/scsi/cxgb3i/cxgb3i_pdu.c
@@ -388,8 +388,8 @@ int cxgb3i_conn_xmit_pdu(struct iscsi_task *task)
 	if (err > 0) {
 		int pdulen = err;
 
-	cxgb3i_tx_debug("task 0x%p, skb 0x%p, len %u/%u, rv %d.\n",
-			task, skb, skb->len, skb->data_len, err);
+		cxgb3i_tx_debug("task 0x%p, skb 0x%p, len %u/%u, rv %d.\n",
+				task, skb, skb->len, skb->data_len, err);
 
 		if (task->conn->hdrdgst_en)
 			pdulen += ISCSI_DIGEST_SIZE;
diff --git a/drivers/scsi/dc395x.c b/drivers/scsi/dc395x.c
index 075e2397273c..6c59c02c1ed9 100644
--- a/drivers/scsi/dc395x.c
+++ b/drivers/scsi/dc395x.c
@@ -1509,7 +1509,7 @@ static u8 start_scsi(struct AdapterCtlBlk* acb, struct DeviceCtlBlk* dcb,
 		 * Try anyway?
 		 *
 		 * We could, BUT: Sometimes the TRM_S1040 misses to produce a Selection
-		 * Timeout, a Disconnect or a Reselction IRQ, so we would be screwed!
+		 * Timeout, a Disconnect or a Reselection IRQ, so we would be screwed!
 		 * (This is likely to be a bug in the hardware. Obviously, most people
 		 *  only have one initiator per SCSI bus.)
 		 * Instead let this fail and have the timer make sure the command is 
diff --git a/drivers/scsi/device_handler/scsi_dh.c b/drivers/scsi/device_handler/scsi_dh.c
index 3ee1cbc89479..e19a1a55270c 100644
--- a/drivers/scsi/device_handler/scsi_dh.c
+++ b/drivers/scsi/device_handler/scsi_dh.c
@@ -226,7 +226,7 @@ store_dh_state(struct device *dev, struct device_attribute *attr,
 			 * Activate a device handler
 			 */
 			if (scsi_dh->activate)
-				err = scsi_dh->activate(sdev);
+				err = scsi_dh->activate(sdev, NULL, NULL);
 			else
 				err = 0;
 		}
@@ -304,18 +304,15 @@ static int scsi_dh_notifier(struct notifier_block *nb,
 	sdev = to_scsi_device(dev);
 
 	if (action == BUS_NOTIFY_ADD_DEVICE) {
+		err = device_create_file(dev, &scsi_dh_state_attr);
+		/* don't care about err */
 		devinfo = device_handler_match(NULL, sdev);
-		if (!devinfo)
-			goto out;
-
-		err = scsi_dh_handler_attach(sdev, devinfo);
-		if (!err)
-			err = device_create_file(dev, &scsi_dh_state_attr);
+		if (devinfo)
+			err = scsi_dh_handler_attach(sdev, devinfo);
 	} else if (action == BUS_NOTIFY_DEL_DEVICE) {
 		device_remove_file(dev, &scsi_dh_state_attr);
 		scsi_dh_handler_detach(sdev, NULL);
 	}
-out:
 	return err;
 }
 
@@ -423,10 +420,17 @@ EXPORT_SYMBOL_GPL(scsi_unregister_device_handler);
 /*
  * scsi_dh_activate - activate the path associated with the scsi_device
  *      corresponding to the given request queue.
- * @q - Request queue that is associated with the scsi_device to be
- *      activated.
+ *     Returns immediately without waiting for activation to be completed.
+ * @q    - Request queue that is associated with the scsi_device to be
+ *         activated.
+ * @fn   - Function to be called upon completion of the activation.
+ *         Function fn is called with data (below) and the error code.
+ *         Function fn may be called from the same calling context. So,
+ *         do not hold the lock in the caller which may be needed in fn.
+ * @data - data passed to the function fn upon completion.
+ *
  */
-int scsi_dh_activate(struct request_queue *q)
+int scsi_dh_activate(struct request_queue *q, activate_complete fn, void *data)
 {
 	int err = 0;
 	unsigned long flags;
@@ -445,7 +449,7 @@ int scsi_dh_activate(struct request_queue *q)
 		return err;
 
 	if (scsi_dh->activate)
-		err = scsi_dh->activate(sdev);
+		err = scsi_dh->activate(sdev, fn, data);
 	put_device(&sdev->sdev_gendev);
 	return err;
 }
diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c
index b5cdefaf2608..4f0d0138f48b 100644
--- a/drivers/scsi/device_handler/scsi_dh_alua.c
+++ b/drivers/scsi/device_handler/scsi_dh_alua.c
@@ -60,11 +60,17 @@ struct alua_dh_data {
 	int			bufflen;
 	unsigned char		sense[SCSI_SENSE_BUFFERSIZE];
 	int			senselen;
+	struct scsi_device	*sdev;
+	activate_complete	callback_fn;
+	void			*callback_data;
 };
 
 #define ALUA_POLICY_SWITCH_CURRENT	0
 #define ALUA_POLICY_SWITCH_ALL		1
 
+static char print_alua_state(int);
+static int alua_check_sense(struct scsi_device *, struct scsi_sense_hdr *);
+
 static inline struct alua_dh_data *get_alua_data(struct scsi_device *sdev)
 {
 	struct scsi_dh_data *scsi_dh_data = sdev->scsi_dh_data;
@@ -231,18 +237,71 @@ done:
 }
 
 /*
+ * alua_stpg - Evaluate SET TARGET GROUP STATES
+ * @sdev: the device to be evaluated
+ * @state: the new target group state
+ *
+ * Send a SET TARGET GROUP STATES command to the device.
+ * We only have to test here if we should resubmit the command;
+ * any other error is assumed as a failure.
+ */
+static void stpg_endio(struct request *req, int error)
+{
+	struct alua_dh_data *h = req->end_io_data;
+	struct scsi_sense_hdr sense_hdr;
+	unsigned err = SCSI_DH_IO;
+
+	if (error || host_byte(req->errors) != DID_OK ||
+			msg_byte(req->errors) != COMMAND_COMPLETE)
+		goto done;
+
+	if (err == SCSI_DH_IO && h->senselen > 0) {
+		err = scsi_normalize_sense(h->sense, SCSI_SENSE_BUFFERSIZE,
+					   &sense_hdr);
+		if (!err) {
+			err = SCSI_DH_IO;
+			goto done;
+		}
+		err = alua_check_sense(h->sdev, &sense_hdr);
+		if (err == ADD_TO_MLQUEUE) {
+			err = SCSI_DH_RETRY;
+			goto done;
+		}
+		sdev_printk(KERN_INFO, h->sdev,
+			    "%s: stpg sense code: %02x/%02x/%02x\n",
+			    ALUA_DH_NAME, sense_hdr.sense_key,
+			    sense_hdr.asc, sense_hdr.ascq);
+		err = SCSI_DH_IO;
+	}
+	if (err == SCSI_DH_OK) {
+		h->state = TPGS_STATE_OPTIMIZED;
+		sdev_printk(KERN_INFO, h->sdev,
+			    "%s: port group %02x switched to state %c\n",
+			    ALUA_DH_NAME, h->group_id,
+			    print_alua_state(h->state));
+	}
+done:
+	blk_put_request(req);
+	if (h->callback_fn) {
+		h->callback_fn(h->callback_data, err);
+		h->callback_fn = h->callback_data = NULL;
+	}
+	return;
+}
+
+/*
  * submit_stpg - Issue a SET TARGET GROUP STATES command
- * @sdev: sdev the command should be sent to
  *
  * Currently we're only setting the current target port group state
  * to 'active/optimized' and let the array firmware figure out
  * the states of the remaining groups.
  */
-static unsigned submit_stpg(struct scsi_device *sdev, struct alua_dh_data *h)
+static unsigned submit_stpg(struct alua_dh_data *h)
 {
 	struct request *rq;
 	int err = SCSI_DH_RES_TEMP_UNAVAIL;
 	int stpg_len = 8;
+	struct scsi_device *sdev = h->sdev;
 
 	/* Prepare the data buffer */
 	memset(h->buff, 0, stpg_len);
@@ -252,7 +311,7 @@ static unsigned submit_stpg(struct scsi_device *sdev, struct alua_dh_data *h)
 
 	rq = get_alua_req(sdev, h->buff, stpg_len, WRITE);
 	if (!rq)
-		goto done;
+		return SCSI_DH_RES_TEMP_UNAVAIL;
 
 	/* Prepare the command. */
 	rq->cmd[0] = MAINTENANCE_OUT;
@@ -266,17 +325,9 @@ static unsigned submit_stpg(struct scsi_device *sdev, struct alua_dh_data *h)
 	rq->sense = h->sense;
 	memset(rq->sense, 0, SCSI_SENSE_BUFFERSIZE);
 	rq->sense_len = h->senselen = 0;
+	rq->end_io_data = h;
 
-	err = blk_execute_rq(rq->q, NULL, rq, 1);
-	if (err == -EIO) {
-		sdev_printk(KERN_INFO, sdev,
-			    "%s: stpg failed with %x\n",
-			    ALUA_DH_NAME, rq->errors);
-		h->senselen = rq->sense_len;
-		err = SCSI_DH_IO;
-	}
-	blk_put_request(rq);
-done:
+	blk_execute_rq_nowait(rq->q, NULL, rq, 1, stpg_endio);
 	return err;
 }
 
@@ -477,50 +528,6 @@ static int alua_check_sense(struct scsi_device *sdev,
 }
 
 /*
- * alua_stpg - Evaluate SET TARGET GROUP STATES
- * @sdev: the device to be evaluated
- * @state: the new target group state
- *
- * Send a SET TARGET GROUP STATES command to the device.
- * We only have to test here if we should resubmit the command;
- * any other error is assumed as a failure.
- */
-static int alua_stpg(struct scsi_device *sdev, int state,
-		     struct alua_dh_data *h)
-{
-	struct scsi_sense_hdr sense_hdr;
-	unsigned err;
-	int retry = ALUA_FAILOVER_RETRIES;
-
- retry:
-	err = submit_stpg(sdev, h);
-	if (err == SCSI_DH_IO && h->senselen > 0) {
-		err = scsi_normalize_sense(h->sense, SCSI_SENSE_BUFFERSIZE,
-					   &sense_hdr);
-		if (!err)
-			return SCSI_DH_IO;
-		err = alua_check_sense(sdev, &sense_hdr);
-		if (retry > 0 && err == ADD_TO_MLQUEUE) {
-			retry--;
-			goto retry;
-		}
-		sdev_printk(KERN_INFO, sdev,
-			    "%s: stpg sense code: %02x/%02x/%02x\n",
-			    ALUA_DH_NAME, sense_hdr.sense_key,
-			    sense_hdr.asc, sense_hdr.ascq);
-		err = SCSI_DH_IO;
-	}
-	if (err == SCSI_DH_OK) {
-		h->state = state;
-		sdev_printk(KERN_INFO, sdev,
-			    "%s: port group %02x switched to state %c\n",
-			    ALUA_DH_NAME, h->group_id,
-			    print_alua_state(h->state) );
-	}
-	return err;
-}
-
-/*
  * alua_rtpg - Evaluate REPORT TARGET GROUP STATES
  * @sdev: the device to be evaluated.
  *
@@ -652,7 +659,8 @@ out:
  * based on a certain policy. But until we actually encounter them it
  * should be okay.
  */
-static int alua_activate(struct scsi_device *sdev)
+static int alua_activate(struct scsi_device *sdev,
+			activate_complete fn, void *data)
 {
 	struct alua_dh_data *h = get_alua_data(sdev);
 	int err = SCSI_DH_OK;
@@ -663,11 +671,19 @@ static int alua_activate(struct scsi_device *sdev)
 			goto out;
 	}
 
-	if (h->tpgs & TPGS_MODE_EXPLICIT && h->state != TPGS_STATE_OPTIMIZED)
-		err = alua_stpg(sdev, TPGS_STATE_OPTIMIZED, h);
+	if (h->tpgs & TPGS_MODE_EXPLICIT && h->state != TPGS_STATE_OPTIMIZED) {
+		h->callback_fn = fn;
+		h->callback_data = data;
+		err = submit_stpg(h);
+		if (err == SCSI_DH_OK)
+			return 0;
+		h->callback_fn = h->callback_data = NULL;
+	}
 
 out:
-	return err;
+	if (fn)
+		fn(data, err);
+	return 0;
 }
 
 /*
@@ -745,6 +761,7 @@ static int alua_bus_attach(struct scsi_device *sdev)
 	h->rel_port = -1;
 	h->buff = h->inq;
 	h->bufflen = ALUA_INQUIRY_SIZE;
+	h->sdev = sdev;
 
 	err = alua_initialize(sdev, h);
 	if (err != SCSI_DH_OK)
diff --git a/drivers/scsi/device_handler/scsi_dh_emc.c b/drivers/scsi/device_handler/scsi_dh_emc.c
index 0cffe84976fe..61966750bd60 100644
--- a/drivers/scsi/device_handler/scsi_dh_emc.c
+++ b/drivers/scsi/device_handler/scsi_dh_emc.c
@@ -528,7 +528,8 @@ retry:
 	return err;
 }
 
-static int clariion_activate(struct scsi_device *sdev)
+static int clariion_activate(struct scsi_device *sdev,
+				activate_complete fn, void *data)
 {
 	struct clariion_dh_data *csdev = get_clariion_data(sdev);
 	int result;
@@ -559,7 +560,9 @@ done:
 		    csdev->port, lun_state[csdev->lun_state],
 		    csdev->default_sp + 'A');
 
-	return result;
+	if (fn)
+		fn(data, result);
+	return 0;
 }
 /*
  * params - parameters in the following format
diff --git a/drivers/scsi/device_handler/scsi_dh_hp_sw.c b/drivers/scsi/device_handler/scsi_dh_hp_sw.c
index f7da7530875e..857fdd6032b2 100644
--- a/drivers/scsi/device_handler/scsi_dh_hp_sw.c
+++ b/drivers/scsi/device_handler/scsi_dh_hp_sw.c
@@ -39,8 +39,14 @@ struct hp_sw_dh_data {
 	unsigned char sense[SCSI_SENSE_BUFFERSIZE];
 	int path_state;
 	int retries;
+	int retry_cnt;
+	struct scsi_device *sdev;
+	activate_complete	callback_fn;
+	void			*callback_data;
 };
 
+static int hp_sw_start_stop(struct hp_sw_dh_data *);
+
 static inline struct hp_sw_dh_data *get_hp_sw_data(struct scsi_device *sdev)
 {
 	struct scsi_dh_data *scsi_dh_data = sdev->scsi_dh_data;
@@ -191,19 +197,53 @@ static int start_done(struct scsi_device *sdev, unsigned char *sense)
 	return rc;
 }
 
+static void start_stop_endio(struct request *req, int error)
+{
+	struct hp_sw_dh_data *h = req->end_io_data;
+	unsigned err = SCSI_DH_OK;
+
+	if (error || host_byte(req->errors) != DID_OK ||
+			msg_byte(req->errors) != COMMAND_COMPLETE) {
+		sdev_printk(KERN_WARNING, h->sdev,
+			    "%s: sending start_stop_unit failed with %x\n",
+			    HP_SW_NAME, req->errors);
+		err = SCSI_DH_IO;
+		goto done;
+	}
+
+	if (req->sense_len > 0) {
+		err = start_done(h->sdev, h->sense);
+		if (err == SCSI_DH_RETRY) {
+			err = SCSI_DH_IO;
+			if (--h->retry_cnt) {
+				blk_put_request(req);
+				err = hp_sw_start_stop(h);
+				if (err == SCSI_DH_OK)
+					return;
+			}
+		}
+	}
+done:
+	blk_put_request(req);
+	if (h->callback_fn) {
+		h->callback_fn(h->callback_data, err);
+		h->callback_fn = h->callback_data = NULL;
+	}
+	return;
+
+}
+
 /*
  * hp_sw_start_stop - Send START STOP UNIT command
  * @sdev: sdev command should be sent to
  *
  * Sending START STOP UNIT activates the SP.
  */
-static int hp_sw_start_stop(struct scsi_device *sdev, struct hp_sw_dh_data *h)
+static int hp_sw_start_stop(struct hp_sw_dh_data *h)
 {
 	struct request *req;
-	int ret, retry;
 
-retry:
-	req = blk_get_request(sdev->request_queue, WRITE, GFP_NOIO);
+	req = blk_get_request(h->sdev->request_queue, WRITE, GFP_ATOMIC);
 	if (!req)
 		return SCSI_DH_RES_TEMP_UNAVAIL;
 
@@ -217,32 +257,10 @@ retry:
 	req->sense = h->sense;
 	memset(req->sense, 0, SCSI_SENSE_BUFFERSIZE);
 	req->sense_len = 0;
-	retry = h->retries;
-
-	ret = blk_execute_rq(req->q, NULL, req, 1);
-	if (ret == -EIO) {
-		if (req->sense_len > 0) {
-			ret = start_done(sdev, h->sense);
-		} else {
-			sdev_printk(KERN_WARNING, sdev,
-				    "%s: sending start_stop_unit failed with %x\n",
-				    HP_SW_NAME, req->errors);
-			ret = SCSI_DH_IO;
-		}
-	} else
-		ret = SCSI_DH_OK;
+	req->end_io_data = h;
 
-	if (ret == SCSI_DH_RETRY) {
-		if (--retry) {
-			blk_put_request(req);
-			goto retry;
-		}
-		ret = SCSI_DH_IO;
-	}
-
-	blk_put_request(req);
-
-	return ret;
+	blk_execute_rq_nowait(req->q, NULL, req, 1, start_stop_endio);
+	return SCSI_DH_OK;
 }
 
 static int hp_sw_prep_fn(struct scsi_device *sdev, struct request *req)
@@ -268,7 +286,8 @@ static int hp_sw_prep_fn(struct scsi_device *sdev, struct request *req)
  * activate the passive path (and deactivate the
  * previously active one).
  */
-static int hp_sw_activate(struct scsi_device *sdev)
+static int hp_sw_activate(struct scsi_device *sdev,
+				activate_complete fn, void *data)
 {
 	int ret = SCSI_DH_OK;
 	struct hp_sw_dh_data *h = get_hp_sw_data(sdev);
@@ -276,14 +295,18 @@ static int hp_sw_activate(struct scsi_device *sdev)
 	ret = hp_sw_tur(sdev, h);
 
 	if (ret == SCSI_DH_OK && h->path_state == HP_SW_PATH_PASSIVE) {
-		ret = hp_sw_start_stop(sdev, h);
+		h->retry_cnt = h->retries;
+		h->callback_fn = fn;
+		h->callback_data = data;
+		ret = hp_sw_start_stop(h);
 		if (ret == SCSI_DH_OK)
-			sdev_printk(KERN_INFO, sdev,
-				    "%s: activated path\n",
-				    HP_SW_NAME);
+			return 0;
+		h->callback_fn = h->callback_data = NULL;
 	}
 
-	return ret;
+	if (fn)
+		fn(data, ret);
+	return 0;
 }
 
 static const struct scsi_dh_devlist hp_sw_dh_data_list[] = {
@@ -326,6 +349,7 @@ static int hp_sw_bus_attach(struct scsi_device *sdev)
 	h = (struct hp_sw_dh_data *) scsi_dh_data->buf;
 	h->path_state = HP_SW_PATH_UNINITIALIZED;
 	h->retries = HP_SW_RETRIES;
+	h->sdev = sdev;
 
 	ret = hp_sw_tur(sdev, h);
 	if (ret != SCSI_DH_OK || h->path_state == HP_SW_PATH_UNINITIALIZED)
diff --git a/drivers/scsi/device_handler/scsi_dh_rdac.c b/drivers/scsi/device_handler/scsi_dh_rdac.c
index 268189d31d9c..1a660191a905 100644
--- a/drivers/scsi/device_handler/scsi_dh_rdac.c
+++ b/drivers/scsi/device_handler/scsi_dh_rdac.c
@@ -22,6 +22,7 @@
 #include <scsi/scsi.h>
 #include <scsi/scsi_eh.h>
 #include <scsi/scsi_dh.h>
+#include <linux/workqueue.h>
 
 #define RDAC_NAME "rdac"
 #define RDAC_RETRY_COUNT 5
@@ -138,7 +139,13 @@ struct rdac_controller {
 	} mode_select;
 	u8	index;
 	u8	array_name[ARRAY_LABEL_LEN];
+	spinlock_t		ms_lock;
+	int			ms_queued;
+	struct work_struct	ms_work;
+	struct scsi_device	*ms_sdev;
+	struct list_head	ms_head;
 };
+
 struct c8_inquiry {
 	u8	peripheral_info;
 	u8	page_code; /* 0xC8 */
@@ -198,8 +205,17 @@ static const char *lun_state[] =
 	"owned (AVT mode)",
 };
 
+struct rdac_queue_data {
+	struct list_head	entry;
+	struct rdac_dh_data	*h;
+	activate_complete	callback_fn;
+	void			*callback_data;
+};
+
 static LIST_HEAD(ctlr_list);
 static DEFINE_SPINLOCK(list_lock);
+static struct workqueue_struct *kmpath_rdacd;
+static void send_mode_select(struct work_struct *work);
 
 /*
  * module parameter to enable rdac debug logging.
@@ -281,7 +297,6 @@ static struct request *rdac_failover_get(struct scsi_device *sdev,
 		rdac_pg->subpage_code = 0x1;
 		rdac_pg->page_len[0] = 0x01;
 		rdac_pg->page_len[1] = 0x28;
-		rdac_pg->lun_table[h->lun] = 0x81;
 	} else {
 		struct rdac_pg_legacy *rdac_pg;
 
@@ -291,7 +306,6 @@ static struct request *rdac_failover_get(struct scsi_device *sdev,
 		common = &rdac_pg->common;
 		rdac_pg->page_code = RDAC_PAGE_CODE_REDUNDANT_CONTROLLER;
 		rdac_pg->page_len = 0x68;
-		rdac_pg->lun_table[h->lun] = 0x81;
 	}
 	common->rdac_mode[1] = RDAC_MODE_TRANSFER_SPECIFIED_LUNS;
 	common->quiescence_timeout = RDAC_QUIESCENCE_TIME;
@@ -325,6 +339,7 @@ static void release_controller(struct kref *kref)
 	struct rdac_controller *ctlr;
 	ctlr = container_of(kref, struct rdac_controller, kref);
 
+	flush_workqueue(kmpath_rdacd);
 	spin_lock(&list_lock);
 	list_del(&ctlr->node);
 	spin_unlock(&list_lock);
@@ -363,6 +378,11 @@ static struct rdac_controller *get_controller(u8 *subsys_id, u8 *slot_id,
 
 	kref_init(&ctlr->kref);
 	ctlr->use_ms10 = -1;
+	ctlr->ms_queued = 0;
+	ctlr->ms_sdev = NULL;
+	spin_lock_init(&ctlr->ms_lock);
+	INIT_WORK(&ctlr->ms_work, send_mode_select);
+	INIT_LIST_HEAD(&ctlr->ms_head);
 	list_add(&ctlr->node, &ctlr_list);
 done:
 	spin_unlock(&list_lock);
@@ -490,7 +510,7 @@ static int set_mode_select(struct scsi_device *sdev, struct rdac_dh_data *h)
 }
 
 static int mode_select_handle_sense(struct scsi_device *sdev,
-				    unsigned char *sensebuf)
+					unsigned char *sensebuf)
 {
 	struct scsi_sense_hdr sense_hdr;
 	int err = SCSI_DH_IO, ret;
@@ -533,11 +553,29 @@ done:
 	return err;
 }
 
-static int send_mode_select(struct scsi_device *sdev, struct rdac_dh_data *h)
+static void send_mode_select(struct work_struct *work)
 {
+	struct rdac_controller *ctlr =
+		container_of(work, struct rdac_controller, ms_work);
 	struct request *rq;
+	struct scsi_device *sdev = ctlr->ms_sdev;
+	struct rdac_dh_data *h = get_rdac_data(sdev);
 	struct request_queue *q = sdev->request_queue;
 	int err, retry_cnt = RDAC_RETRY_COUNT;
+	struct rdac_queue_data *tmp, *qdata;
+	LIST_HEAD(list);
+	u8 *lun_table;
+
+	spin_lock(&ctlr->ms_lock);
+	list_splice_init(&ctlr->ms_head, &list);
+	ctlr->ms_queued = 0;
+	ctlr->ms_sdev = NULL;
+	spin_unlock(&ctlr->ms_lock);
+
+	if (ctlr->use_ms10)
+		lun_table = ctlr->mode_select.expanded.lun_table;
+	else
+		lun_table = ctlr->mode_select.legacy.lun_table;
 
 retry:
 	err = SCSI_DH_RES_TEMP_UNAVAIL;
@@ -545,6 +583,10 @@ retry:
 	if (!rq)
 		goto done;
 
+	list_for_each_entry(qdata, &list, entry) {
+		lun_table[qdata->h->lun] = 0x81;
+	}
+
 	RDAC_LOG(RDAC_LOG_FAILOVER, sdev, "array %s, ctlr %d, "
 		"%s MODE_SELECT command",
 		(char *) h->ctlr->array_name, h->ctlr->index,
@@ -565,10 +607,45 @@ retry:
 	}
 
 done:
-	return err;
+	list_for_each_entry_safe(qdata, tmp, &list, entry) {
+		list_del(&qdata->entry);
+		if (err == SCSI_DH_OK)
+			qdata->h->state = RDAC_STATE_ACTIVE;
+		if (qdata->callback_fn)
+			qdata->callback_fn(qdata->callback_data, err);
+		kfree(qdata);
+	}
+	return;
+}
+
+static int queue_mode_select(struct scsi_device *sdev,
+				activate_complete fn, void *data)
+{
+	struct rdac_queue_data *qdata;
+	struct rdac_controller *ctlr;
+
+	qdata = kzalloc(sizeof(*qdata), GFP_KERNEL);
+	if (!qdata)
+		return SCSI_DH_RETRY;
+
+	qdata->h = get_rdac_data(sdev);
+	qdata->callback_fn = fn;
+	qdata->callback_data = data;
+
+	ctlr = qdata->h->ctlr;
+	spin_lock(&ctlr->ms_lock);
+	list_add_tail(&qdata->entry, &ctlr->ms_head);
+	if (!ctlr->ms_queued) {
+		ctlr->ms_queued = 1;
+		ctlr->ms_sdev = sdev;
+		queue_work(kmpath_rdacd, &ctlr->ms_work);
+	}
+	spin_unlock(&ctlr->ms_lock);
+	return SCSI_DH_OK;
 }
 
-static int rdac_activate(struct scsi_device *sdev)
+static int rdac_activate(struct scsi_device *sdev,
+			activate_complete fn, void *data)
 {
 	struct rdac_dh_data *h = get_rdac_data(sdev);
 	int err = SCSI_DH_OK;
@@ -577,10 +654,15 @@ static int rdac_activate(struct scsi_device *sdev)
 	if (err != SCSI_DH_OK)
 		goto done;
 
-	if (h->lun_state == RDAC_LUN_UNOWNED)
-		err = send_mode_select(sdev, h);
+	if (h->lun_state == RDAC_LUN_UNOWNED) {
+		err = queue_mode_select(sdev, fn, data);
+		if (err == SCSI_DH_OK)
+			return 0;
+	}
 done:
-	return err;
+	if (fn)
+		fn(data, err);
+	return 0;
 }
 
 static int rdac_prep_fn(struct scsi_device *sdev, struct request *req)
@@ -666,6 +748,8 @@ static const struct scsi_dh_devlist rdac_dev_list[] = {
 	{"IBM", "1724"},
 	{"IBM", "1726"},
 	{"IBM", "1742"},
+	{"IBM", "1745"},
+	{"IBM", "1746"},
 	{"IBM", "1814"},
 	{"IBM", "1815"},
 	{"IBM", "1818"},
@@ -790,13 +874,26 @@ static int __init rdac_init(void)
 	int r;
 
 	r = scsi_register_device_handler(&rdac_dh);
-	if (r != 0)
+	if (r != 0) {
 		printk(KERN_ERR "Failed to register scsi device handler.");
+		goto done;
+	}
+
+	/*
+	 * Create workqueue to handle mode selects for rdac
+	 */
+	kmpath_rdacd = create_singlethread_workqueue("kmpath_rdacd");
+	if (!kmpath_rdacd) {
+		scsi_unregister_device_handler(&rdac_dh);
+		printk(KERN_ERR "kmpath_rdacd creation failed.\n");
+	}
+done:
 	return r;
 }
 
 static void __exit rdac_exit(void)
 {
+	destroy_workqueue(kmpath_rdacd);
 	scsi_unregister_device_handler(&rdac_dh);
 }
 
diff --git a/drivers/scsi/dmx3191d.c b/drivers/scsi/dmx3191d.c
index fa738ec8692a..207352cc70cc 100644
--- a/drivers/scsi/dmx3191d.c
+++ b/drivers/scsi/dmx3191d.c
@@ -31,7 +31,7 @@
 #include <scsi/scsi_host.h>
 
 /*
- * Defintions for the generic 5380 driver.
+ * Definitions for the generic 5380 driver.
  */
 #define AUTOSENSE
 
diff --git a/drivers/scsi/fcoe/fcoe.c b/drivers/scsi/fcoe/fcoe.c
index 704b8e034946..10be9f36a4cc 100644
--- a/drivers/scsi/fcoe/fcoe.c
+++ b/drivers/scsi/fcoe/fcoe.c
@@ -66,14 +66,14 @@ LIST_HEAD(fcoe_hostlist);
 DEFINE_PER_CPU(struct fcoe_percpu_s, fcoe_percpu);
 
 /* Function Prototypes */
-static int fcoe_reset(struct Scsi_Host *shost);
+static int fcoe_reset(struct Scsi_Host *);
 static int fcoe_xmit(struct fc_lport *, struct fc_frame *);
 static int fcoe_rcv(struct sk_buff *, struct net_device *,
 		    struct packet_type *, struct net_device *);
-static int fcoe_percpu_receive_thread(void *arg);
-static void fcoe_clean_pending_queue(struct fc_lport *lp);
-static void fcoe_percpu_clean(struct fc_lport *lp);
-static int fcoe_link_ok(struct fc_lport *lp);
+static int fcoe_percpu_receive_thread(void *);
+static void fcoe_clean_pending_queue(struct fc_lport *);
+static void fcoe_percpu_clean(struct fc_lport *);
+static int fcoe_link_ok(struct fc_lport *);
 
 static struct fc_lport *fcoe_hostlist_lookup(const struct net_device *);
 static int fcoe_hostlist_add(const struct fc_lport *);
@@ -82,15 +82,77 @@ static void fcoe_check_wait_queue(struct fc_lport *, struct sk_buff *);
 static int fcoe_device_notification(struct notifier_block *, ulong, void *);
 static void fcoe_dev_setup(void);
 static void fcoe_dev_cleanup(void);
-static struct fcoe_interface *
-	fcoe_hostlist_lookup_port(const struct net_device *dev);
+static struct fcoe_interface
+*fcoe_hostlist_lookup_port(const struct net_device *);
+
+static int fcoe_fip_recv(struct sk_buff *, struct net_device *,
+			 struct packet_type *, struct net_device *);
+
+static void fcoe_fip_send(struct fcoe_ctlr *, struct sk_buff *);
+static void fcoe_update_src_mac(struct fc_lport *, u8 *);
+static u8 *fcoe_get_src_mac(struct fc_lport *);
+static void fcoe_destroy_work(struct work_struct *);
+
+static int fcoe_ddp_setup(struct fc_lport *, u16, struct scatterlist *,
+			  unsigned int);
+static int fcoe_ddp_done(struct fc_lport *, u16);
+
+static int fcoe_cpu_callback(struct notifier_block *, unsigned long, void *);
+
+static int fcoe_create(const char *, struct kernel_param *);
+static int fcoe_destroy(const char *, struct kernel_param *);
+static int fcoe_enable(const char *, struct kernel_param *);
+static int fcoe_disable(const char *, struct kernel_param *);
+
+static struct fc_seq *fcoe_elsct_send(struct fc_lport *,
+				      u32 did, struct fc_frame *,
+				      unsigned int op,
+				      void (*resp)(struct fc_seq *,
+						   struct fc_frame *,
+						   void *),
+				      void *, u32 timeout);
+static void fcoe_recv_frame(struct sk_buff *skb);
 
-/* notification function from net device */
+static void fcoe_get_lesb(struct fc_lport *, struct fc_els_lesb *);
+
+module_param_call(create, fcoe_create, NULL, NULL, S_IWUSR);
+__MODULE_PARM_TYPE(create, "string");
+MODULE_PARM_DESC(create, " Creates fcoe instance on a ethernet interface");
+module_param_call(destroy, fcoe_destroy, NULL, NULL, S_IWUSR);
+__MODULE_PARM_TYPE(destroy, "string");
+MODULE_PARM_DESC(destroy, " Destroys fcoe instance on a ethernet interface");
+module_param_call(enable, fcoe_enable, NULL, NULL, S_IWUSR);
+__MODULE_PARM_TYPE(enable, "string");
+MODULE_PARM_DESC(enable, " Enables fcoe on a ethernet interface.");
+module_param_call(disable, fcoe_disable, NULL, NULL, S_IWUSR);
+__MODULE_PARM_TYPE(disable, "string");
+MODULE_PARM_DESC(disable, " Disables fcoe on a ethernet interface.");
+
+/* notification function for packets from net device */
 static struct notifier_block fcoe_notifier = {
 	.notifier_call = fcoe_device_notification,
 };
 
-static struct scsi_transport_template *scsi_transport_fcoe_sw;
+/* notification function for CPU hotplug events */
+static struct notifier_block fcoe_cpu_notifier = {
+	.notifier_call = fcoe_cpu_callback,
+};
+
+static struct scsi_transport_template *fcoe_transport_template;
+static struct scsi_transport_template *fcoe_vport_transport_template;
+
+static int fcoe_vport_destroy(struct fc_vport *);
+static int fcoe_vport_create(struct fc_vport *, bool disabled);
+static int fcoe_vport_disable(struct fc_vport *, bool disable);
+static void fcoe_set_vport_symbolic_name(struct fc_vport *);
+
+static struct libfc_function_template fcoe_libfc_fcn_templ = {
+	.frame_send = fcoe_xmit,
+	.ddp_setup = fcoe_ddp_setup,
+	.ddp_done = fcoe_ddp_done,
+	.elsct_send = fcoe_elsct_send,
+	.get_lesb = fcoe_get_lesb,
+};
 
 struct fc_function_template fcoe_transport_function = {
 	.show_host_node_name = 1,
@@ -123,6 +185,48 @@ struct fc_function_template fcoe_transport_function = {
 	.issue_fc_host_lip = fcoe_reset,
 
 	.terminate_rport_io = fc_rport_terminate_io,
+
+	.vport_create = fcoe_vport_create,
+	.vport_delete = fcoe_vport_destroy,
+	.vport_disable = fcoe_vport_disable,
+	.set_vport_symbolic_name = fcoe_set_vport_symbolic_name,
+
+	.bsg_request = fc_lport_bsg_request,
+};
+
+struct fc_function_template fcoe_vport_transport_function = {
+	.show_host_node_name = 1,
+	.show_host_port_name = 1,
+	.show_host_supported_classes = 1,
+	.show_host_supported_fc4s = 1,
+	.show_host_active_fc4s = 1,
+	.show_host_maxframe_size = 1,
+
+	.show_host_port_id = 1,
+	.show_host_supported_speeds = 1,
+	.get_host_speed = fc_get_host_speed,
+	.show_host_speed = 1,
+	.show_host_port_type = 1,
+	.get_host_port_state = fc_get_host_port_state,
+	.show_host_port_state = 1,
+	.show_host_symbolic_name = 1,
+
+	.dd_fcrport_size = sizeof(struct fc_rport_libfc_priv),
+	.show_rport_maxframe_size = 1,
+	.show_rport_supported_classes = 1,
+
+	.show_host_fabric_name = 1,
+	.show_starget_node_name = 1,
+	.show_starget_port_name = 1,
+	.show_starget_port_id = 1,
+	.set_rport_dev_loss_tmo = fc_set_rport_loss_tmo,
+	.show_rport_dev_loss_tmo = 1,
+	.get_fc_host_stats = fc_get_host_stats,
+	.issue_fc_host_lip = fcoe_reset,
+
+	.terminate_rport_io = fc_rport_terminate_io,
+
+	.bsg_request = fc_lport_bsg_request,
 };
 
 static struct scsi_host_template fcoe_shost_template = {
@@ -137,20 +241,17 @@ static struct scsi_host_template fcoe_shost_template = {
 	.change_queue_depth = fc_change_queue_depth,
 	.change_queue_type = fc_change_queue_type,
 	.this_id = -1,
-	.cmd_per_lun = 32,
+	.cmd_per_lun = 3,
 	.can_queue = FCOE_MAX_OUTSTANDING_COMMANDS,
 	.use_clustering = ENABLE_CLUSTERING,
 	.sg_tablesize = SG_ALL,
 	.max_sectors = 0xffff,
 };
 
-static int fcoe_fip_recv(struct sk_buff *skb, struct net_device *dev,
-			 struct packet_type *ptype,
-			 struct net_device *orig_dev);
 /**
- * fcoe_interface_setup()
- * @fcoe: new fcoe_interface
- * @netdev : ptr to the associated netdevice struct
+ * fcoe_interface_setup() - Setup a FCoE interface
+ * @fcoe:   The new FCoE interface
+ * @netdev: The net device that the fcoe interface is on
  *
  * Returns : 0 for success
  * Locking: must be called with the RTNL mutex held
@@ -160,23 +261,36 @@ static int fcoe_interface_setup(struct fcoe_interface *fcoe,
 {
 	struct fcoe_ctlr *fip = &fcoe->ctlr;
 	struct netdev_hw_addr *ha;
+	struct net_device *real_dev;
 	u8 flogi_maddr[ETH_ALEN];
+	const struct net_device_ops *ops;
 
 	fcoe->netdev = netdev;
 
+	/* Let LLD initialize for FCoE */
+	ops = netdev->netdev_ops;
+	if (ops->ndo_fcoe_enable) {
+		if (ops->ndo_fcoe_enable(netdev))
+			FCOE_NETDEV_DBG(netdev, "Failed to enable FCoE"
+					" specific feature for LLD.\n");
+	}
+
 	/* Do not support for bonding device */
 	if ((netdev->priv_flags & IFF_MASTER_ALB) ||
 	    (netdev->priv_flags & IFF_SLAVE_INACTIVE) ||
 	    (netdev->priv_flags & IFF_MASTER_8023AD)) {
+		FCOE_NETDEV_DBG(netdev, "Bonded interfaces not supported\n");
 		return -EOPNOTSUPP;
 	}
 
 	/* look for SAN MAC address, if multiple SAN MACs exist, only
 	 * use the first one for SPMA */
+	real_dev = (netdev->priv_flags & IFF_802_1Q_VLAN) ?
+		vlan_dev_real_dev(netdev) : netdev;
 	rcu_read_lock();
-	for_each_dev_addr(netdev, ha) {
+	for_each_dev_addr(real_dev, ha) {
 		if ((ha->type == NETDEV_HW_ADDR_T_SAN) &&
-		    (is_valid_ether_addr(fip->ctl_src_addr))) {
+		    (is_valid_ether_addr(ha->addr))) {
 			memcpy(fip->ctl_src_addr, ha->addr, ETH_ALEN);
 			fip->spma = 1;
 			break;
@@ -216,19 +330,16 @@ static int fcoe_interface_setup(struct fcoe_interface *fcoe,
 	return 0;
 }
 
-static void fcoe_fip_send(struct fcoe_ctlr *fip, struct sk_buff *skb);
-static void fcoe_update_src_mac(struct fcoe_ctlr *fip, u8 *old, u8 *new);
-static void fcoe_destroy_work(struct work_struct *work);
-
 /**
- * fcoe_interface_create()
- * @netdev: network interface
+ * fcoe_interface_create() - Create a FCoE interface on a net device
+ * @netdev: The net device to create the FCoE interface on
  *
  * Returns: pointer to a struct fcoe_interface or NULL on error
  */
 static struct fcoe_interface *fcoe_interface_create(struct net_device *netdev)
 {
 	struct fcoe_interface *fcoe;
+	int err;
 
 	fcoe = kzalloc(sizeof(*fcoe), GFP_KERNEL);
 	if (!fcoe) {
@@ -245,15 +356,22 @@ static struct fcoe_interface *fcoe_interface_create(struct net_device *netdev)
 	fcoe_ctlr_init(&fcoe->ctlr);
 	fcoe->ctlr.send = fcoe_fip_send;
 	fcoe->ctlr.update_mac = fcoe_update_src_mac;
+	fcoe->ctlr.get_src_addr = fcoe_get_src_mac;
 
-	fcoe_interface_setup(fcoe, netdev);
+	err = fcoe_interface_setup(fcoe, netdev);
+	if (err) {
+		fcoe_ctlr_destroy(&fcoe->ctlr);
+		kfree(fcoe);
+		dev_put(netdev);
+		return NULL;
+	}
 
 	return fcoe;
 }
 
 /**
- * fcoe_interface_cleanup() - clean up netdev configurations
- * @fcoe:
+ * fcoe_interface_cleanup() - Clean up a FCoE interface
+ * @fcoe: The FCoE interface to be cleaned up
  *
  * Caller must be holding the RTNL mutex
  */
@@ -262,6 +380,7 @@ void fcoe_interface_cleanup(struct fcoe_interface *fcoe)
 	struct net_device *netdev = fcoe->netdev;
 	struct fcoe_ctlr *fip = &fcoe->ctlr;
 	u8 flogi_maddr[ETH_ALEN];
+	const struct net_device_ops *ops;
 
 	/*
 	 * Don't listen for Ethernet packets anymore.
@@ -276,16 +395,22 @@ void fcoe_interface_cleanup(struct fcoe_interface *fcoe)
 	/* Delete secondary MAC addresses */
 	memcpy(flogi_maddr, (u8[6]) FC_FCOE_FLOGI_MAC, ETH_ALEN);
 	dev_unicast_delete(netdev, flogi_maddr);
-	if (!is_zero_ether_addr(fip->data_src_addr))
-		dev_unicast_delete(netdev, fip->data_src_addr);
 	if (fip->spma)
 		dev_unicast_delete(netdev, fip->ctl_src_addr);
 	dev_mc_delete(netdev, FIP_ALL_ENODE_MACS, ETH_ALEN, 0);
+
+	/* Tell the LLD we are done w/ FCoE */
+	ops = netdev->netdev_ops;
+	if (ops->ndo_fcoe_disable) {
+		if (ops->ndo_fcoe_disable(netdev))
+			FCOE_NETDEV_DBG(netdev, "Failed to disable FCoE"
+					" specific feature for LLD.\n");
+	}
 }
 
 /**
  * fcoe_interface_release() - fcoe_port kref release function
- * @kref: embedded reference count in an fcoe_interface struct
+ * @kref: Embedded reference count in an fcoe_interface struct
  */
 static void fcoe_interface_release(struct kref *kref)
 {
@@ -301,8 +426,8 @@ static void fcoe_interface_release(struct kref *kref)
 }
 
 /**
- * fcoe_interface_get()
- * @fcoe:
+ * fcoe_interface_get() - Get a reference to a FCoE interface
+ * @fcoe: The FCoE interface to be held
  */
 static inline void fcoe_interface_get(struct fcoe_interface *fcoe)
 {
@@ -310,8 +435,8 @@ static inline void fcoe_interface_get(struct fcoe_interface *fcoe)
 }
 
 /**
- * fcoe_interface_put()
- * @fcoe:
+ * fcoe_interface_put() - Put a reference to a FCoE interface
+ * @fcoe: The FCoE interface to be released
  */
 static inline void fcoe_interface_put(struct fcoe_interface *fcoe)
 {
@@ -319,15 +444,16 @@ static inline void fcoe_interface_put(struct fcoe_interface *fcoe)
 }
 
 /**
- * fcoe_fip_recv - handle a received FIP frame.
- * @skb: the receive skb
- * @dev: associated &net_device
- * @ptype: the &packet_type structure which was used to register this handler.
- * @orig_dev: original receive &net_device, in case @dev is a bond.
+ * fcoe_fip_recv() - Handler for received FIP frames
+ * @skb:      The receive skb
+ * @netdev:   The associated net device
+ * @ptype:    The packet_type structure which was used to register this handler
+ * @orig_dev: The original net_device the the skb was received on.
+ *	      (in case dev is a bond)
  *
  * Returns: 0 for success
  */
-static int fcoe_fip_recv(struct sk_buff *skb, struct net_device *dev,
+static int fcoe_fip_recv(struct sk_buff *skb, struct net_device *netdev,
 			 struct packet_type *ptype,
 			 struct net_device *orig_dev)
 {
@@ -339,9 +465,9 @@ static int fcoe_fip_recv(struct sk_buff *skb, struct net_device *dev,
 }
 
 /**
- * fcoe_fip_send() - send an Ethernet-encapsulated FIP frame.
- * @fip: FCoE controller.
- * @skb: FIP Packet.
+ * fcoe_fip_send() - Send an Ethernet-encapsulated FIP frame
+ * @fip: The FCoE controller
+ * @skb: The FIP packet to be sent
  */
 static void fcoe_fip_send(struct fcoe_ctlr *fip, struct sk_buff *skb)
 {
@@ -350,88 +476,118 @@ static void fcoe_fip_send(struct fcoe_ctlr *fip, struct sk_buff *skb)
 }
 
 /**
- * fcoe_update_src_mac() - Update Ethernet MAC filters.
- * @fip: FCoE controller.
- * @old: Unicast MAC address to delete if the MAC is non-zero.
- * @new: Unicast MAC address to add.
+ * fcoe_update_src_mac() - Update the Ethernet MAC filters
+ * @lport: The local port to update the source MAC on
+ * @addr:  Unicast MAC address to add
  *
  * Remove any previously-set unicast MAC filter.
  * Add secondary FCoE MAC address filter for our OUI.
  */
-static void fcoe_update_src_mac(struct fcoe_ctlr *fip, u8 *old, u8 *new)
+static void fcoe_update_src_mac(struct fc_lport *lport, u8 *addr)
 {
-	struct fcoe_interface *fcoe;
+	struct fcoe_port *port = lport_priv(lport);
+	struct fcoe_interface *fcoe = port->fcoe;
 
-	fcoe = fcoe_from_ctlr(fip);
 	rtnl_lock();
-	if (!is_zero_ether_addr(old))
-		dev_unicast_delete(fcoe->netdev, old);
-	dev_unicast_add(fcoe->netdev, new);
+	if (!is_zero_ether_addr(port->data_src_addr))
+		dev_unicast_delete(fcoe->netdev, port->data_src_addr);
+	if (!is_zero_ether_addr(addr))
+		dev_unicast_add(fcoe->netdev, addr);
+	memcpy(port->data_src_addr, addr, ETH_ALEN);
 	rtnl_unlock();
 }
 
 /**
- * fcoe_lport_config() - sets up the fc_lport
- * @lp: ptr to the fc_lport
+ * fcoe_get_src_mac() - return the Ethernet source address for an lport
+ * @lport: libfc lport
+ */
+static u8 *fcoe_get_src_mac(struct fc_lport *lport)
+{
+	struct fcoe_port *port = lport_priv(lport);
+
+	return port->data_src_addr;
+}
+
+/**
+ * fcoe_lport_config() - Set up a local port
+ * @lport: The local port to be setup
  *
  * Returns: 0 for success
  */
-static int fcoe_lport_config(struct fc_lport *lp)
+static int fcoe_lport_config(struct fc_lport *lport)
 {
-	lp->link_up = 0;
-	lp->qfull = 0;
-	lp->max_retry_count = 3;
-	lp->max_rport_retry_count = 3;
-	lp->e_d_tov = 2 * 1000;	/* FC-FS default */
-	lp->r_a_tov = 2 * 2 * 1000;
-	lp->service_params = (FCP_SPPF_INIT_FCN | FCP_SPPF_RD_XRDY_DIS |
-			      FCP_SPPF_RETRY | FCP_SPPF_CONF_COMPL);
-
-	fc_lport_init_stats(lp);
+	lport->link_up = 0;
+	lport->qfull = 0;
+	lport->max_retry_count = 3;
+	lport->max_rport_retry_count = 3;
+	lport->e_d_tov = 2 * 1000;	/* FC-FS default */
+	lport->r_a_tov = 2 * 2 * 1000;
+	lport->service_params = (FCP_SPPF_INIT_FCN | FCP_SPPF_RD_XRDY_DIS |
+				 FCP_SPPF_RETRY | FCP_SPPF_CONF_COMPL);
+	lport->does_npiv = 1;
+
+	fc_lport_init_stats(lport);
 
 	/* lport fc_lport related configuration */
-	fc_lport_config(lp);
+	fc_lport_config(lport);
 
 	/* offload related configuration */
-	lp->crc_offload = 0;
-	lp->seq_offload = 0;
-	lp->lro_enabled = 0;
-	lp->lro_xid = 0;
-	lp->lso_max = 0;
+	lport->crc_offload = 0;
+	lport->seq_offload = 0;
+	lport->lro_enabled = 0;
+	lport->lro_xid = 0;
+	lport->lso_max = 0;
 
 	return 0;
 }
 
 /**
- * fcoe_queue_timer() - fcoe queue timer
- * @lp: the fc_lport pointer
+ * fcoe_queue_timer() - The fcoe queue timer
+ * @lport: The local port
  *
  * Calls fcoe_check_wait_queue on timeout
+ */
+static void fcoe_queue_timer(ulong lport)
+{
+	fcoe_check_wait_queue((struct fc_lport *)lport, NULL);
+}
+
+/**
+ * fcoe_get_wwn() - Get the world wide name from LLD if it supports it
+ * @netdev: the associated net device
+ * @wwn: the output WWN
+ * @type: the type of WWN (WWPN or WWNN)
  *
+ * Returns: 0 for success
  */
-static void fcoe_queue_timer(ulong lp)
+static int fcoe_get_wwn(struct net_device *netdev, u64 *wwn, int type)
 {
-	fcoe_check_wait_queue((struct fc_lport *)lp, NULL);
+	const struct net_device_ops *ops = netdev->netdev_ops;
+
+	if (ops->ndo_fcoe_get_wwn)
+		return ops->ndo_fcoe_get_wwn(netdev, wwn, type);
+	return -EINVAL;
 }
 
 /**
- * fcoe_netdev_config() - Set up netdev for SW FCoE
- * @lp : ptr to the fc_lport
- * @netdev : ptr to the associated netdevice struct
+ * fcoe_netdev_config() - Set up net devive for SW FCoE
+ * @lport:  The local port that is associated with the net device
+ * @netdev: The associated net device
  *
- * Must be called after fcoe_lport_config() as it will use lport mutex
+ * Must be called after fcoe_lport_config() as it will use local port mutex
  *
- * Returns : 0 for success
+ * Returns: 0 for success
  */
-static int fcoe_netdev_config(struct fc_lport *lp, struct net_device *netdev)
+static int fcoe_netdev_config(struct fc_lport *lport, struct net_device *netdev)
 {
 	u32 mfs;
 	u64 wwnn, wwpn;
 	struct fcoe_interface *fcoe;
 	struct fcoe_port *port;
+	int vid = 0;
 
 	/* Setup lport private data to point to fcoe softc */
-	port = lport_priv(lp);
+	port = lport_priv(lport);
 	fcoe = port->fcoe;
 
 	/*
@@ -439,86 +595,116 @@ static int fcoe_netdev_config(struct fc_lport *lp, struct net_device *netdev)
 	 * user-configured limit.  If the MFS is too low, fcoe_link_ok()
 	 * will return 0, so do this first.
 	 */
-	mfs = netdev->mtu - (sizeof(struct fcoe_hdr) +
-			     sizeof(struct fcoe_crc_eof));
-	if (fc_set_mfs(lp, mfs))
+	mfs = netdev->mtu;
+	if (netdev->features & NETIF_F_FCOE_MTU) {
+		mfs = FCOE_MTU;
+		FCOE_NETDEV_DBG(netdev, "Supports FCOE_MTU of %d bytes\n", mfs);
+	}
+	mfs -= (sizeof(struct fcoe_hdr) + sizeof(struct fcoe_crc_eof));
+	if (fc_set_mfs(lport, mfs))
 		return -EINVAL;
 
 	/* offload features support */
 	if (netdev->features & NETIF_F_SG)
-		lp->sg_supp = 1;
+		lport->sg_supp = 1;
 
 	if (netdev->features & NETIF_F_FCOE_CRC) {
-		lp->crc_offload = 1;
+		lport->crc_offload = 1;
 		FCOE_NETDEV_DBG(netdev, "Supports FCCRC offload\n");
 	}
 	if (netdev->features & NETIF_F_FSO) {
-		lp->seq_offload = 1;
-		lp->lso_max = netdev->gso_max_size;
+		lport->seq_offload = 1;
+		lport->lso_max = netdev->gso_max_size;
 		FCOE_NETDEV_DBG(netdev, "Supports LSO for max len 0x%x\n",
-				lp->lso_max);
+				lport->lso_max);
 	}
 	if (netdev->fcoe_ddp_xid) {
-		lp->lro_enabled = 1;
-		lp->lro_xid = netdev->fcoe_ddp_xid;
+		lport->lro_enabled = 1;
+		lport->lro_xid = netdev->fcoe_ddp_xid;
 		FCOE_NETDEV_DBG(netdev, "Supports LRO for max xid 0x%x\n",
-				lp->lro_xid);
+				lport->lro_xid);
 	}
 	skb_queue_head_init(&port->fcoe_pending_queue);
 	port->fcoe_pending_queue_active = 0;
-	setup_timer(&port->timer, fcoe_queue_timer, (unsigned long)lp);
+	setup_timer(&port->timer, fcoe_queue_timer, (unsigned long)lport);
 
-	wwnn = fcoe_wwn_from_mac(netdev->dev_addr, 1, 0);
-	fc_set_wwnn(lp, wwnn);
-	/* XXX - 3rd arg needs to be vlan id */
-	wwpn = fcoe_wwn_from_mac(netdev->dev_addr, 2, 0);
-	fc_set_wwpn(lp, wwpn);
+	if (!lport->vport) {
+		/*
+		 * Use NAA 1&2 (FC-FS Rev. 2.0, Sec. 15) to generate WWNN/WWPN:
+		 * For WWNN, we use NAA 1 w/ bit 27-16 of word 0 as 0.
+		 * For WWPN, we use NAA 2 w/ bit 27-16 of word 0 from VLAN ID
+		 */
+		if (netdev->priv_flags & IFF_802_1Q_VLAN)
+			vid = vlan_dev_vlan_id(netdev);
+
+		if (fcoe_get_wwn(netdev, &wwnn, NETDEV_FCOE_WWNN))
+			wwnn = fcoe_wwn_from_mac(fcoe->ctlr.ctl_src_addr, 1, 0);
+		fc_set_wwnn(lport, wwnn);
+		if (fcoe_get_wwn(netdev, &wwpn, NETDEV_FCOE_WWPN))
+			wwpn = fcoe_wwn_from_mac(fcoe->ctlr.ctl_src_addr,
+						 2, vid);
+		fc_set_wwpn(lport, wwpn);
+	}
 
 	return 0;
 }
 
 /**
- * fcoe_shost_config() - Sets up fc_lport->host
- * @lp : ptr to the fc_lport
- * @shost : ptr to the associated scsi host
- * @dev : device associated to scsi host
+ * fcoe_shost_config() - Set up the SCSI host associated with a local port
+ * @lport: The local port
+ * @shost: The SCSI host to associate with the local port
+ * @dev:   The device associated with the SCSI host
  *
  * Must be called after fcoe_lport_config() and fcoe_netdev_config()
  *
- * Returns : 0 for success
+ * Returns: 0 for success
  */
-static int fcoe_shost_config(struct fc_lport *lp, struct Scsi_Host *shost,
-				struct device *dev)
+static int fcoe_shost_config(struct fc_lport *lport, struct Scsi_Host *shost,
+			     struct device *dev)
 {
 	int rc = 0;
 
 	/* lport scsi host config */
-	lp->host = shost;
-
-	lp->host->max_lun = FCOE_MAX_LUN;
-	lp->host->max_id = FCOE_MAX_FCP_TARGET;
-	lp->host->max_channel = 0;
-	lp->host->transportt = scsi_transport_fcoe_sw;
+	lport->host->max_lun = FCOE_MAX_LUN;
+	lport->host->max_id = FCOE_MAX_FCP_TARGET;
+	lport->host->max_channel = 0;
+	if (lport->vport)
+		lport->host->transportt = fcoe_vport_transport_template;
+	else
+		lport->host->transportt = fcoe_transport_template;
 
 	/* add the new host to the SCSI-ml */
-	rc = scsi_add_host(lp->host, dev);
+	rc = scsi_add_host(lport->host, dev);
 	if (rc) {
-		FCOE_NETDEV_DBG(fcoe_netdev(lp), "fcoe_shost_config: "
+		FCOE_NETDEV_DBG(fcoe_netdev(lport), "fcoe_shost_config: "
 				"error on scsi_add_host\n");
 		return rc;
 	}
-	sprintf(fc_host_symbolic_name(lp->host), "%s v%s over %s",
-		FCOE_NAME, FCOE_VERSION,
-		fcoe_netdev(lp)->name);
+
+	if (!lport->vport)
+		fc_host_max_npiv_vports(lport->host) = USHORT_MAX;
+
+	snprintf(fc_host_symbolic_name(lport->host), FC_SYMBOLIC_NAME_SIZE,
+		 "%s v%s over %s", FCOE_NAME, FCOE_VERSION,
+		 fcoe_netdev(lport)->name);
 
 	return 0;
 }
 
-/*
- * fcoe_oem_match() - match for read types IO
- * @fp: the fc_frame for new IO.
+/**
+ * fcoe_oem_match() - The match routine for the offloaded exchange manager
+ * @fp: The I/O frame
  *
- * Returns : true for read types IO, otherwise returns false.
+ * This routine will be associated with an exchange manager (EM). When
+ * the libfc exchange handling code is looking for an EM to use it will
+ * call this routine and pass it the frame that it wishes to send. This
+ * routine will return True if the associated EM is to be used and False
+ * if the echange code should continue looking for an EM.
+ *
+ * The offload EM that this routine is associated with will handle any
+ * packets that are for SCSI read requests.
+ *
+ * Returns: True for read types I/O, otherwise returns false.
  */
 bool fcoe_oem_match(struct fc_frame *fp)
 {
@@ -527,14 +713,14 @@ bool fcoe_oem_match(struct fc_frame *fp)
 }
 
 /**
- * fcoe_em_config() - allocates em for this lport
- * @lp: the fcoe that em is to allocated for
+ * fcoe_em_config() - Allocate and configure an exchange manager
+ * @lport: The local port that the new EM will be associated with
  *
- * Returns : 0 on success
+ * Returns: 0 on success
  */
-static inline int fcoe_em_config(struct fc_lport *lp)
+static inline int fcoe_em_config(struct fc_lport *lport)
 {
-	struct fcoe_port *port = lport_priv(lp);
+	struct fcoe_port *port = lport_priv(lport);
 	struct fcoe_interface *fcoe = port->fcoe;
 	struct fcoe_interface *oldfcoe = NULL;
 	struct net_device *old_real_dev, *cur_real_dev;
@@ -545,8 +731,9 @@ static inline int fcoe_em_config(struct fc_lport *lp)
 	 * Check if need to allocate an em instance for
 	 * offload exchange ids to be shared across all VN_PORTs/lport.
 	 */
-	if (!lp->lro_enabled || !lp->lro_xid || (lp->lro_xid >= max_xid)) {
-		lp->lro_xid = 0;
+	if (!lport->lro_enabled || !lport->lro_xid ||
+	    (lport->lro_xid >= max_xid)) {
+		lport->lro_xid = 0;
 		goto skip_oem;
 	}
 
@@ -572,16 +759,16 @@ static inline int fcoe_em_config(struct fc_lport *lp)
 	}
 
 	if (fcoe->oem) {
-		if (!fc_exch_mgr_add(lp, fcoe->oem, fcoe_oem_match)) {
+		if (!fc_exch_mgr_add(lport, fcoe->oem, fcoe_oem_match)) {
 			printk(KERN_ERR "fcoe_em_config: failed to add "
 			       "offload em:%p on interface:%s\n",
 			       fcoe->oem, fcoe->netdev->name);
 			return -ENOMEM;
 		}
 	} else {
-		fcoe->oem = fc_exch_mgr_alloc(lp, FC_CLASS_3,
-					    FCOE_MIN_XID, lp->lro_xid,
-					    fcoe_oem_match);
+		fcoe->oem = fc_exch_mgr_alloc(lport, FC_CLASS_3,
+					      FCOE_MIN_XID, lport->lro_xid,
+					      fcoe_oem_match);
 		if (!fcoe->oem) {
 			printk(KERN_ERR "fcoe_em_config: failed to allocate "
 			       "em for offload exches on interface:%s\n",
@@ -593,10 +780,10 @@ static inline int fcoe_em_config(struct fc_lport *lp)
 	/*
 	 * Exclude offload EM xid range from next EM xid range.
 	 */
-	min_xid += lp->lro_xid + 1;
+	min_xid += lport->lro_xid + 1;
 
 skip_oem:
-	if (!fc_exch_mgr_alloc(lp, FC_CLASS_3, min_xid, max_xid, NULL)) {
+	if (!fc_exch_mgr_alloc(lport, FC_CLASS_3, min_xid, max_xid, NULL)) {
 		printk(KERN_ERR "fcoe_em_config: failed to "
 		       "allocate em on interface %s\n", fcoe->netdev->name);
 		return -ENOMEM;
@@ -606,8 +793,8 @@ skip_oem:
 }
 
 /**
- * fcoe_if_destroy() - FCoE software HBA tear-down function
- * @lport: fc_lport to destroy
+ * fcoe_if_destroy() - Tear down a SW FCoE instance
+ * @lport: The local port to be destroyed
  */
 static void fcoe_if_destroy(struct fc_lport *lport)
 {
@@ -630,6 +817,11 @@ static void fcoe_if_destroy(struct fc_lport *lport)
 	/* Free existing transmit skbs */
 	fcoe_clean_pending_queue(lport);
 
+	rtnl_lock();
+	if (!is_zero_ether_addr(port->data_src_addr))
+		dev_unicast_delete(netdev, port->data_src_addr);
+	rtnl_unlock();
+
 	/* receives may not be stopped until after this */
 	fcoe_interface_put(fcoe);
 
@@ -650,82 +842,89 @@ static void fcoe_if_destroy(struct fc_lport *lport)
 	scsi_host_put(lport->host);
 }
 
-/*
- * fcoe_ddp_setup - calls LLD's ddp_setup through net_device
- * @lp:	the corresponding fc_lport
- * @xid: the exchange id for this ddp transfer
- * @sgl: the scatterlist describing this transfer
- * @sgc: number of sg items
+/**
+ * fcoe_ddp_setup() - Call a LLD's ddp_setup through the net device
+ * @lport: The local port to setup DDP for
+ * @xid:   The exchange ID for this DDP transfer
+ * @sgl:   The scatterlist describing this transfer
+ * @sgc:   The number of sg items
  *
- * Returns : 0 no ddp
+ * Returns: 0 if the DDP context was not configured
  */
-static int fcoe_ddp_setup(struct fc_lport *lp, u16 xid,
-			     struct scatterlist *sgl, unsigned int sgc)
+static int fcoe_ddp_setup(struct fc_lport *lport, u16 xid,
+			  struct scatterlist *sgl, unsigned int sgc)
 {
-	struct net_device *n = fcoe_netdev(lp);
+	struct net_device *netdev = fcoe_netdev(lport);
 
-	if (n->netdev_ops && n->netdev_ops->ndo_fcoe_ddp_setup)
-		return n->netdev_ops->ndo_fcoe_ddp_setup(n, xid, sgl, sgc);
+	if (netdev->netdev_ops->ndo_fcoe_ddp_setup)
+		return netdev->netdev_ops->ndo_fcoe_ddp_setup(netdev,
+							      xid, sgl,
+							      sgc);
 
 	return 0;
 }
 
-/*
- * fcoe_ddp_done - calls LLD's ddp_done through net_device
- * @lp:	the corresponding fc_lport
- * @xid: the exchange id for this ddp transfer
+/**
+ * fcoe_ddp_done() - Call a LLD's ddp_done through the net device
+ * @lport: The local port to complete DDP on
+ * @xid:   The exchange ID for this DDP transfer
  *
- * Returns : the length of data that have been completed by ddp
+ * Returns: the length of data that have been completed by DDP
  */
-static int fcoe_ddp_done(struct fc_lport *lp, u16 xid)
+static int fcoe_ddp_done(struct fc_lport *lport, u16 xid)
 {
-	struct net_device *n = fcoe_netdev(lp);
+	struct net_device *netdev = fcoe_netdev(lport);
 
-	if (n->netdev_ops && n->netdev_ops->ndo_fcoe_ddp_done)
-		return n->netdev_ops->ndo_fcoe_ddp_done(n, xid);
+	if (netdev->netdev_ops->ndo_fcoe_ddp_done)
+		return netdev->netdev_ops->ndo_fcoe_ddp_done(netdev, xid);
 	return 0;
 }
 
-static struct libfc_function_template fcoe_libfc_fcn_templ = {
-	.frame_send = fcoe_xmit,
-	.ddp_setup = fcoe_ddp_setup,
-	.ddp_done = fcoe_ddp_done,
-};
-
 /**
- * fcoe_if_create() - this function creates the fcoe port
- * @fcoe: fcoe_interface structure to create an fc_lport instance on
- * @parent: device pointer to be the parent in sysfs for the SCSI host
+ * fcoe_if_create() - Create a FCoE instance on an interface
+ * @fcoe:   The FCoE interface to create a local port on
+ * @parent: The device pointer to be the parent in sysfs for the SCSI host
+ * @npiv:   Indicates if the port is a vport or not
  *
- * Creates fc_lport struct and scsi_host for lport, configures lport.
+ * Creates a fc_lport instance and a Scsi_Host instance and configure them.
  *
- * Returns : The allocated fc_lport or an error pointer
+ * Returns: The allocated fc_lport or an error pointer
  */
 static struct fc_lport *fcoe_if_create(struct fcoe_interface *fcoe,
-				       struct device *parent)
+				       struct device *parent, int npiv)
 {
-	int rc;
+	struct net_device *netdev = fcoe->netdev;
 	struct fc_lport *lport = NULL;
 	struct fcoe_port *port;
 	struct Scsi_Host *shost;
-	struct net_device *netdev = fcoe->netdev;
+	int rc;
+	/*
+	 * parent is only a vport if npiv is 1,
+	 * but we'll only use vport in that case so go ahead and set it
+	 */
+	struct fc_vport *vport = dev_to_vport(parent);
 
 	FCOE_NETDEV_DBG(netdev, "Create Interface\n");
 
-	shost = libfc_host_alloc(&fcoe_shost_template,
-				 sizeof(struct fcoe_port));
-	if (!shost) {
+	if (!npiv) {
+		lport = libfc_host_alloc(&fcoe_shost_template,
+					 sizeof(struct fcoe_port));
+	} else	{
+		lport = libfc_vport_create(vport,
+					   sizeof(struct fcoe_port));
+	}
+	if (!lport) {
 		FCOE_NETDEV_DBG(netdev, "Could not allocate host structure\n");
 		rc = -ENOMEM;
 		goto out;
 	}
-	lport = shost_priv(shost);
+	shost = lport->host;
 	port = lport_priv(lport);
 	port->lport = lport;
 	port->fcoe = fcoe;
 	INIT_WORK(&port->destroy_work, fcoe_destroy_work);
 
-	/* configure fc_lport, e.g., em */
+	/* configure a fc_lport including the exchange manager */
 	rc = fcoe_lport_config(lport);
 	if (rc) {
 		FCOE_NETDEV_DBG(netdev, "Could not configure lport for the "
@@ -733,6 +932,13 @@ static struct fc_lport *fcoe_if_create(struct fcoe_interface *fcoe,
 		goto out_host_put;
 	}
 
+	if (npiv) {
+		FCOE_NETDEV_DBG(netdev, "Setting vport names, 0x%llX 0x%llX\n",
+				vport->node_name, vport->port_name);
+		fc_set_wwnn(lport, vport->node_name);
+		fc_set_wwpn(lport, vport->port_name);
+	}
+
 	/* configure lport network properties */
 	rc = fcoe_netdev_config(lport, netdev);
 	if (rc) {
@@ -757,21 +963,24 @@ static struct fc_lport *fcoe_if_create(struct fcoe_interface *fcoe,
 		goto out_lp_destroy;
 	}
 
-	/*
-	 * fcoe_em_alloc() and fcoe_hostlist_add() both
-	 * need to be atomic with respect to other changes to the hostlist
-	 * since fcoe_em_alloc() looks for an existing EM
-	 * instance on host list updated by fcoe_hostlist_add().
-	 *
-	 * This is currently handled through the fcoe_config_mutex begin held.
-	 */
+	if (!npiv) {
+		/*
+		 * fcoe_em_alloc() and fcoe_hostlist_add() both
+		 * need to be atomic with respect to other changes to the
+		 * hostlist since fcoe_em_alloc() looks for an existing EM
+		 * instance on host list updated by fcoe_hostlist_add().
+		 *
+		 * This is currently handled through the fcoe_config_mutex
+		 * begin held.
+		 */
 
-	/* lport exch manager allocation */
-	rc = fcoe_em_config(lport);
-	if (rc) {
-		FCOE_NETDEV_DBG(netdev, "Could not configure the EM for the "
-				"interface\n");
-		goto out_lp_destroy;
+		/* lport exch manager allocation */
+		rc = fcoe_em_config(lport);
+		if (rc) {
+			FCOE_NETDEV_DBG(netdev, "Could not configure the EM "
+					"for the interface\n");
+			goto out_lp_destroy;
+		}
 	}
 
 	fcoe_interface_get(fcoe);
@@ -786,17 +995,20 @@ out:
 }
 
 /**
- * fcoe_if_init() - attach to scsi transport
+ * fcoe_if_init() - Initialization routine for fcoe.ko
+ *
+ * Attaches the SW FCoE transport to the FC transport
  *
- * Returns : 0 on success
+ * Returns: 0 on success
  */
 static int __init fcoe_if_init(void)
 {
 	/* attach to scsi transport */
-	scsi_transport_fcoe_sw =
-		fc_attach_transport(&fcoe_transport_function);
+	fcoe_transport_template = fc_attach_transport(&fcoe_transport_function);
+	fcoe_vport_transport_template =
+		fc_attach_transport(&fcoe_vport_transport_function);
 
-	if (!scsi_transport_fcoe_sw) {
+	if (!fcoe_transport_template) {
 		printk(KERN_ERR "fcoe: Failed to attach to the FC transport\n");
 		return -ENODEV;
 	}
@@ -805,20 +1017,24 @@ static int __init fcoe_if_init(void)
 }
 
 /**
- * fcoe_if_exit() - detach from scsi transport
+ * fcoe_if_exit() - Tear down fcoe.ko
+ *
+ * Detaches the SW FCoE transport from the FC transport
  *
- * Returns : 0 on success
+ * Returns: 0 on success
  */
 int __exit fcoe_if_exit(void)
 {
-	fc_release_transport(scsi_transport_fcoe_sw);
-	scsi_transport_fcoe_sw = NULL;
+	fc_release_transport(fcoe_transport_template);
+	fc_release_transport(fcoe_vport_transport_template);
+	fcoe_transport_template = NULL;
+	fcoe_vport_transport_template = NULL;
 	return 0;
 }
 
 /**
- * fcoe_percpu_thread_create() - Create a receive thread for an online cpu
- * @cpu: cpu index for the online cpu
+ * fcoe_percpu_thread_create() - Create a receive thread for an online CPU
+ * @cpu: The CPU index of the CPU to create a receive thread for
  */
 static void fcoe_percpu_thread_create(unsigned int cpu)
 {
@@ -841,8 +1057,8 @@ static void fcoe_percpu_thread_create(unsigned int cpu)
 }
 
 /**
- * fcoe_percpu_thread_destroy() - removes the rx thread for the given cpu
- * @cpu: cpu index the rx thread is to be removed
+ * fcoe_percpu_thread_destroy() - Remove the receive thread of a CPU
+ * @cpu: The CPU index of the CPU whose receive thread is to be destroyed
  *
  * Destroys a per-CPU Rx thread. Any pending skbs are moved to the
  * current CPU's Rx thread. If the thread being destroyed is bound to
@@ -890,7 +1106,7 @@ static void fcoe_percpu_thread_destroy(unsigned int cpu)
 		} else {
 			/*
 			 * The targeted CPU is not initialized and cannot accept
-			 * new  skbs. Unlock the targeted CPU and drop the skbs
+			 * new	skbs. Unlock the targeted CPU and drop the skbs
 			 * on the CPU that is going offline.
 			 */
 			while ((skb = __skb_dequeue(&p->fcoe_rx_list)) != NULL)
@@ -931,12 +1147,12 @@ static void fcoe_percpu_thread_destroy(unsigned int cpu)
 }
 
 /**
- * fcoe_cpu_callback() - fcoe cpu hotplug event callback
- * @nfb: callback data block
- * @action: event triggering the callback
- * @hcpu: index for the cpu of this event
+ * fcoe_cpu_callback() - Handler for CPU hotplug events
+ * @nfb:    The callback data block
+ * @action: The event triggering the callback
+ * @hcpu:   The index of the CPU that the event is for
  *
- * This creates or destroys per cpu data for fcoe
+ * This creates or destroys per-CPU data for fcoe
  *
  * Returns NOTIFY_OK always.
  */
@@ -962,25 +1178,22 @@ static int fcoe_cpu_callback(struct notifier_block *nfb,
 	return NOTIFY_OK;
 }
 
-static struct notifier_block fcoe_cpu_notifier = {
-	.notifier_call = fcoe_cpu_callback,
-};
-
 /**
- * fcoe_rcv() - this is the fcoe receive function called by NET_RX_SOFTIRQ
- * @skb: the receive skb
- * @dev: associated net device
- * @ptype: context
- * @olddev: last device
+ * fcoe_rcv() - Receive packets from a net device
+ * @skb:    The received packet
+ * @netdev: The net device that the packet was received on
+ * @ptype:  The packet type context
+ * @olddev: The last device net device
  *
- * this function will receive the packet and build fc frame and pass it up
+ * This routine is called by NET_RX_SOFTIRQ. It receives a packet, builds a
+ * FC frame and passes the frame to libfc.
  *
  * Returns: 0 for success
  */
-int fcoe_rcv(struct sk_buff *skb, struct net_device *dev,
+int fcoe_rcv(struct sk_buff *skb, struct net_device *netdev,
 	     struct packet_type *ptype, struct net_device *olddev)
 {
-	struct fc_lport *lp;
+	struct fc_lport *lport;
 	struct fcoe_rcv_info *fr;
 	struct fcoe_interface *fcoe;
 	struct fc_frame_header *fh;
@@ -988,15 +1201,15 @@ int fcoe_rcv(struct sk_buff *skb, struct net_device *dev,
 	unsigned int cpu;
 
 	fcoe = container_of(ptype, struct fcoe_interface, fcoe_packet_type);
-	lp = fcoe->ctlr.lp;
-	if (unlikely(lp == NULL)) {
-		FCOE_NETDEV_DBG(dev, "Cannot find hba structure");
+	lport = fcoe->ctlr.lp;
+	if (unlikely(!lport)) {
+		FCOE_NETDEV_DBG(netdev, "Cannot find hba structure");
 		goto err2;
 	}
-	if (!lp->link_up)
+	if (!lport->link_up)
 		goto err2;
 
-	FCOE_NETDEV_DBG(dev, "skb_info: len:%d data_len:%d head:%p "
+	FCOE_NETDEV_DBG(netdev, "skb_info: len:%d data_len:%d head:%p "
 			"data:%p tail:%p end:%p sum:%d dev:%s",
 			skb->len, skb->data_len, skb->head, skb->data,
 			skb_tail_pointer(skb), skb_end_pointer(skb),
@@ -1004,7 +1217,7 @@ int fcoe_rcv(struct sk_buff *skb, struct net_device *dev,
 
 	/* check for FCOE packet type */
 	if (unlikely(eth_hdr(skb)->h_proto != htons(ETH_P_FCOE))) {
-		FCOE_NETDEV_DBG(dev, "Wrong FC type frame");
+		FCOE_NETDEV_DBG(netdev, "Wrong FC type frame");
 		goto err;
 	}
 
@@ -1013,14 +1226,14 @@ int fcoe_rcv(struct sk_buff *skb, struct net_device *dev,
 	 * and FC headers are pulled into the linear data area.
 	 */
 	if (unlikely((skb->len < FCOE_MIN_FRAME) ||
-	    !pskb_may_pull(skb, FCOE_HEADER_LEN)))
+		     !pskb_may_pull(skb, FCOE_HEADER_LEN)))
 		goto err;
 
 	skb_set_transport_header(skb, sizeof(struct fcoe_hdr));
 	fh = (struct fc_frame_header *) skb_transport_header(skb);
 
 	fr = fcoe_dev_from_skb(skb);
-	fr->fr_dev = lp;
+	fr->fr_dev = lport;
 	fr->ptype = ptype;
 
 	/*
@@ -1042,12 +1255,12 @@ int fcoe_rcv(struct sk_buff *skb, struct net_device *dev,
 		 * the first CPU now. For non-SMP systems this
 		 * will check the same CPU twice.
 		 */
-		FCOE_NETDEV_DBG(dev, "CPU is online, but no receive thread "
+		FCOE_NETDEV_DBG(netdev, "CPU is online, but no receive thread "
 				"ready for incoming skb- using first online "
 				"CPU.\n");
 
 		spin_unlock_bh(&fps->fcoe_rx_list.lock);
-		cpu = first_cpu(cpu_online_map);
+		cpu = cpumask_first(cpu_online_mask);
 		fps = &per_cpu(fcoe_percpu, cpu);
 		spin_lock_bh(&fps->fcoe_rx_list.lock);
 		if (!fps->thread) {
@@ -1061,15 +1274,29 @@ int fcoe_rcv(struct sk_buff *skb, struct net_device *dev,
 	 * this skb. We also have this receive thread locked,
 	 * so we're free to queue skbs into it's queue.
 	 */
-	__skb_queue_tail(&fps->fcoe_rx_list, skb);
-	if (fps->fcoe_rx_list.qlen == 1)
-		wake_up_process(fps->thread);
 
-	spin_unlock_bh(&fps->fcoe_rx_list.lock);
+	/* If this is a SCSI-FCP frame, and this is already executing on the
+	 * correct CPU, and the queue for this CPU is empty, then go ahead
+	 * and process the frame directly in the softirq context.
+	 * This lets us process completions without context switching from the
+	 * NET_RX softirq, to our receive processing thread, and then back to
+	 * BLOCK softirq context.
+	 */
+	if (fh->fh_type == FC_TYPE_FCP &&
+	    cpu == smp_processor_id() &&
+	    skb_queue_empty(&fps->fcoe_rx_list)) {
+		spin_unlock_bh(&fps->fcoe_rx_list.lock);
+		fcoe_recv_frame(skb);
+	} else {
+		__skb_queue_tail(&fps->fcoe_rx_list, skb);
+		if (fps->fcoe_rx_list.qlen == 1)
+			wake_up_process(fps->thread);
+		spin_unlock_bh(&fps->fcoe_rx_list.lock);
+	}
 
 	return 0;
 err:
-	fc_lport_get_stats(lp)->ErrorFrames++;
+	fc_lport_get_stats(lport)->ErrorFrames++;
 
 err2:
 	kfree_skb(skb);
@@ -1077,17 +1304,21 @@ err2:
 }
 
 /**
- * fcoe_start_io() - pass to netdev to start xmit for fcoe
- * @skb: the skb to be xmitted
+ * fcoe_start_io() - Start FCoE I/O
+ * @skb: The packet to be transmitted
+ *
+ * This routine is called from the net device to start transmitting
+ * FCoE packets.
  *
  * Returns: 0 for success
  */
 static inline int fcoe_start_io(struct sk_buff *skb)
 {
+	struct sk_buff *nskb;
 	int rc;
 
-	skb_get(skb);
-	rc = dev_queue_xmit(skb);
+	nskb = skb_clone(skb, GFP_ATOMIC);
+	rc = dev_queue_xmit(nskb);
 	if (rc != 0)
 		return rc;
 	kfree_skb(skb);
@@ -1095,9 +1326,15 @@ static inline int fcoe_start_io(struct sk_buff *skb)
 }
 
 /**
- * fcoe_get_paged_crc_eof() - in case we need to alloc a page for crc_eof
- * @skb: the skb to be xmitted
- * @tlen: total len
+ * fcoe_get_paged_crc_eof() - Allocate a page to be used for the trailer CRC
+ * @skb:  The packet to be transmitted
+ * @tlen: The total length of the trailer
+ *
+ * This routine allocates a page for frame trailers. The page is re-used if
+ * there is enough room left on it for the current trailer. If there isn't
+ * enough buffer left a new page is allocated for the trailer. Reference to
+ * the page from this function as well as the skbs using the page fragments
+ * ensure that the page is freed at the appropriate time.
  *
  * Returns: 0 for success
  */
@@ -1136,11 +1373,12 @@ static int fcoe_get_paged_crc_eof(struct sk_buff *skb, int tlen)
 }
 
 /**
- * fcoe_fc_crc() - calculates FC CRC in this fcoe skb
- * @fp: the fc_frame containing data to be checksummed
+ * fcoe_fc_crc() - Calculates the CRC for a given frame
+ * @fp: The frame to be checksumed
+ *
+ * This uses crc32() routine to calculate the CRC for a frame
  *
- * This uses crc32() to calculate the crc for port frame
- * Return   : 32 bit crc
+ * Return: The 32 bit CRC value
  */
 u32 fcoe_fc_crc(struct fc_frame *fp)
 {
@@ -1171,13 +1409,13 @@ u32 fcoe_fc_crc(struct fc_frame *fp)
 }
 
 /**
- * fcoe_xmit() - FCoE frame transmit function
- * @lp:	the associated local fcoe
- * @fp: the fc_frame to be transmitted
+ * fcoe_xmit() - Transmit a FCoE frame
+ * @lport: The local port that the frame is to be transmitted for
+ * @fp:	   The frame to be transmitted
  *
- * Return   : 0 for success
+ * Return: 0 for success
  */
-int fcoe_xmit(struct fc_lport *lp, struct fc_frame *fp)
+int fcoe_xmit(struct fc_lport *lport, struct fc_frame *fp)
 {
 	int wlen;
 	u32 crc;
@@ -1189,7 +1427,7 @@ int fcoe_xmit(struct fc_lport *lp, struct fc_frame *fp)
 	unsigned int hlen;		/* header length implies the version */
 	unsigned int tlen;		/* trailer length */
 	unsigned int elen;		/* eth header, may include vlan */
-	struct fcoe_port *port = lport_priv(lp);
+	struct fcoe_port *port = lport_priv(lport);
 	struct fcoe_interface *fcoe = port->fcoe;
 	u8 sof, eof;
 	struct fcoe_hdr *hp;
@@ -1200,13 +1438,13 @@ int fcoe_xmit(struct fc_lport *lp, struct fc_frame *fp)
 	skb = fp_skb(fp);
 	wlen = skb->len / FCOE_WORD_TO_BYTE;
 
-	if (!lp->link_up) {
+	if (!lport->link_up) {
 		kfree_skb(skb);
 		return 0;
 	}
 
 	if (unlikely(fh->fh_r_ctl == FC_RCTL_ELS_REQ) &&
-	    fcoe_ctlr_els_send(&fcoe->ctlr, skb))
+	    fcoe_ctlr_els_send(&fcoe->ctlr, lport, skb))
 		return 0;
 
 	sof = fr_sof(fp);
@@ -1218,7 +1456,7 @@ int fcoe_xmit(struct fc_lport *lp, struct fc_frame *fp)
 	wlen = (skb->len - tlen + sizeof(crc)) / FCOE_WORD_TO_BYTE;
 
 	/* crc offload */
-	if (likely(lp->crc_offload)) {
+	if (likely(lport->crc_offload)) {
 		skb->ip_summed = CHECKSUM_PARTIAL;
 		skb->csum_start = skb_headroom(skb);
 		skb->csum_offset = skb->len;
@@ -1271,7 +1509,7 @@ int fcoe_xmit(struct fc_lport *lp, struct fc_frame *fp)
 	if (unlikely(fcoe->ctlr.flogi_oxid != FC_XID_UNKNOWN))
 		memcpy(eh->h_source, fcoe->ctlr.ctl_src_addr, ETH_ALEN);
 	else
-		memcpy(eh->h_source, fcoe->ctlr.data_src_addr, ETH_ALEN);
+		memcpy(eh->h_source, port->data_src_addr, ETH_ALEN);
 
 	hp = (struct fcoe_hdr *)(eh + 1);
 	memset(hp, 0, sizeof(*hp));
@@ -1280,7 +1518,7 @@ int fcoe_xmit(struct fc_lport *lp, struct fc_frame *fp)
 	hp->fcoe_sof = sof;
 
 	/* fcoe lso, mss is in max_payload which is non-zero for FCP data */
-	if (lp->seq_offload && fr_max_payload(fp)) {
+	if (lport->seq_offload && fr_max_payload(fp)) {
 		skb_shinfo(skb)->gso_type = SKB_GSO_FCOE;
 		skb_shinfo(skb)->gso_size = fr_max_payload(fp);
 	} else {
@@ -1288,23 +1526,23 @@ int fcoe_xmit(struct fc_lport *lp, struct fc_frame *fp)
 		skb_shinfo(skb)->gso_size = 0;
 	}
 	/* update tx stats: regardless if LLD fails */
-	stats = fc_lport_get_stats(lp);
+	stats = fc_lport_get_stats(lport);
 	stats->TxFrames++;
 	stats->TxWords += wlen;
 
 	/* send down to lld */
-	fr_dev(fp) = lp;
+	fr_dev(fp) = lport;
 	if (port->fcoe_pending_queue.qlen)
-		fcoe_check_wait_queue(lp, skb);
+		fcoe_check_wait_queue(lport, skb);
 	else if (fcoe_start_io(skb))
-		fcoe_check_wait_queue(lp, skb);
+		fcoe_check_wait_queue(lport, skb);
 
 	return 0;
 }
 
 /**
- * fcoe_percpu_flush_done() - Indicate percpu queue flush completion.
- * @skb: the skb being completed.
+ * fcoe_percpu_flush_done() - Indicate per-CPU queue flush completion
+ * @skb: The completed skb (argument required by destructor)
  */
 static void fcoe_percpu_flush_done(struct sk_buff *skb)
 {
@@ -1312,26 +1550,134 @@ static void fcoe_percpu_flush_done(struct sk_buff *skb)
 }
 
 /**
- * fcoe_percpu_receive_thread() - recv thread per cpu
- * @arg: ptr to the fcoe per cpu struct
- *
- * Return: 0 for success
+ * fcoe_recv_frame() - process a single received frame
+ * @skb: frame to process
  */
-int fcoe_percpu_receive_thread(void *arg)
+static void fcoe_recv_frame(struct sk_buff *skb)
 {
-	struct fcoe_percpu_s *p = arg;
 	u32 fr_len;
-	struct fc_lport *lp;
+	struct fc_lport *lport;
 	struct fcoe_rcv_info *fr;
 	struct fcoe_dev_stats *stats;
 	struct fc_frame_header *fh;
-	struct sk_buff *skb;
 	struct fcoe_crc_eof crc_eof;
 	struct fc_frame *fp;
 	u8 *mac = NULL;
 	struct fcoe_port *port;
 	struct fcoe_hdr *hp;
 
+	fr = fcoe_dev_from_skb(skb);
+	lport = fr->fr_dev;
+	if (unlikely(!lport)) {
+		if (skb->destructor != fcoe_percpu_flush_done)
+			FCOE_NETDEV_DBG(skb->dev, "NULL lport in skb");
+		kfree_skb(skb);
+		return;
+	}
+
+	FCOE_NETDEV_DBG(skb->dev, "skb_info: len:%d data_len:%d "
+			"head:%p data:%p tail:%p end:%p sum:%d dev:%s",
+			skb->len, skb->data_len,
+			skb->head, skb->data, skb_tail_pointer(skb),
+			skb_end_pointer(skb), skb->csum,
+			skb->dev ? skb->dev->name : "<NULL>");
+
+	/*
+	 * Save source MAC address before discarding header.
+	 */
+	port = lport_priv(lport);
+	if (skb_is_nonlinear(skb))
+		skb_linearize(skb);	/* not ideal */
+	mac = eth_hdr(skb)->h_source;
+
+	/*
+	 * Frame length checks and setting up the header pointers
+	 * was done in fcoe_rcv already.
+	 */
+	hp = (struct fcoe_hdr *) skb_network_header(skb);
+	fh = (struct fc_frame_header *) skb_transport_header(skb);
+
+	stats = fc_lport_get_stats(lport);
+	if (unlikely(FC_FCOE_DECAPS_VER(hp) != FC_FCOE_VER)) {
+		if (stats->ErrorFrames < 5)
+			printk(KERN_WARNING "fcoe: FCoE version "
+			       "mismatch: The frame has "
+			       "version %x, but the "
+			       "initiator supports version "
+			       "%x\n", FC_FCOE_DECAPS_VER(hp),
+			       FC_FCOE_VER);
+		stats->ErrorFrames++;
+		kfree_skb(skb);
+		return;
+	}
+
+	skb_pull(skb, sizeof(struct fcoe_hdr));
+	fr_len = skb->len - sizeof(struct fcoe_crc_eof);
+
+	stats->RxFrames++;
+	stats->RxWords += fr_len / FCOE_WORD_TO_BYTE;
+
+	fp = (struct fc_frame *)skb;
+	fc_frame_init(fp);
+	fr_dev(fp) = lport;
+	fr_sof(fp) = hp->fcoe_sof;
+
+	/* Copy out the CRC and EOF trailer for access */
+	if (skb_copy_bits(skb, fr_len, &crc_eof, sizeof(crc_eof))) {
+		kfree_skb(skb);
+		return;
+	}
+	fr_eof(fp) = crc_eof.fcoe_eof;
+	fr_crc(fp) = crc_eof.fcoe_crc32;
+	if (pskb_trim(skb, fr_len)) {
+		kfree_skb(skb);
+		return;
+	}
+
+	/*
+	 * We only check CRC if no offload is available and if it is
+	 * it's solicited data, in which case, the FCP layer would
+	 * check it during the copy.
+	 */
+	if (lport->crc_offload &&
+	    skb->ip_summed == CHECKSUM_UNNECESSARY)
+		fr_flags(fp) &= ~FCPHF_CRC_UNCHECKED;
+	else
+		fr_flags(fp) |= FCPHF_CRC_UNCHECKED;
+
+	fh = fc_frame_header_get(fp);
+	if (fh->fh_r_ctl == FC_RCTL_DD_SOL_DATA &&
+	    fh->fh_type == FC_TYPE_FCP) {
+		fc_exch_recv(lport, fp);
+		return;
+	}
+	if (fr_flags(fp) & FCPHF_CRC_UNCHECKED) {
+		if (le32_to_cpu(fr_crc(fp)) !=
+		    ~crc32(~0, skb->data, fr_len)) {
+			if (stats->InvalidCRCCount < 5)
+				printk(KERN_WARNING "fcoe: dropping "
+				       "frame with CRC error\n");
+			stats->InvalidCRCCount++;
+			stats->ErrorFrames++;
+			fc_frame_free(fp);
+			return;
+		}
+		fr_flags(fp) &= ~FCPHF_CRC_UNCHECKED;
+	}
+	fc_exch_recv(lport, fp);
+}
+
+/**
+ * fcoe_percpu_receive_thread() - The per-CPU packet receive thread
+ * @arg: The per-CPU context
+ *
+ * Return: 0 for success
+ */
+int fcoe_percpu_receive_thread(void *arg)
+{
+	struct fcoe_percpu_s *p = arg;
+	struct sk_buff *skb;
+
 	set_user_nice(current, -20);
 
 	while (!kthread_should_stop()) {
@@ -1347,129 +1693,27 @@ int fcoe_percpu_receive_thread(void *arg)
 			spin_lock_bh(&p->fcoe_rx_list.lock);
 		}
 		spin_unlock_bh(&p->fcoe_rx_list.lock);
-		fr = fcoe_dev_from_skb(skb);
-		lp = fr->fr_dev;
-		if (unlikely(lp == NULL)) {
-			if (skb->destructor != fcoe_percpu_flush_done)
-				FCOE_NETDEV_DBG(skb->dev, "NULL lport in skb");
-			kfree_skb(skb);
-			continue;
-		}
-
-		FCOE_NETDEV_DBG(skb->dev, "skb_info: len:%d data_len:%d "
-				"head:%p data:%p tail:%p end:%p sum:%d dev:%s",
-				skb->len, skb->data_len,
-				skb->head, skb->data, skb_tail_pointer(skb),
-				skb_end_pointer(skb), skb->csum,
-				skb->dev ? skb->dev->name : "<NULL>");
-
-		/*
-		 * Save source MAC address before discarding header.
-		 */
-		port = lport_priv(lp);
-		if (skb_is_nonlinear(skb))
-			skb_linearize(skb);	/* not ideal */
-		mac = eth_hdr(skb)->h_source;
-
-		/*
-		 * Frame length checks and setting up the header pointers
-		 * was done in fcoe_rcv already.
-		 */
-		hp = (struct fcoe_hdr *) skb_network_header(skb);
-		fh = (struct fc_frame_header *) skb_transport_header(skb);
-
-		stats = fc_lport_get_stats(lp);
-		if (unlikely(FC_FCOE_DECAPS_VER(hp) != FC_FCOE_VER)) {
-			if (stats->ErrorFrames < 5)
-				printk(KERN_WARNING "fcoe: FCoE version "
-				       "mismatch: The frame has "
-				       "version %x, but the "
-				       "initiator supports version "
-				       "%x\n", FC_FCOE_DECAPS_VER(hp),
-				       FC_FCOE_VER);
-			stats->ErrorFrames++;
-			kfree_skb(skb);
-			continue;
-		}
-
-		skb_pull(skb, sizeof(struct fcoe_hdr));
-		fr_len = skb->len - sizeof(struct fcoe_crc_eof);
-
-		stats->RxFrames++;
-		stats->RxWords += fr_len / FCOE_WORD_TO_BYTE;
-
-		fp = (struct fc_frame *)skb;
-		fc_frame_init(fp);
-		fr_dev(fp) = lp;
-		fr_sof(fp) = hp->fcoe_sof;
-
-		/* Copy out the CRC and EOF trailer for access */
-		if (skb_copy_bits(skb, fr_len, &crc_eof, sizeof(crc_eof))) {
-			kfree_skb(skb);
-			continue;
-		}
-		fr_eof(fp) = crc_eof.fcoe_eof;
-		fr_crc(fp) = crc_eof.fcoe_crc32;
-		if (pskb_trim(skb, fr_len)) {
-			kfree_skb(skb);
-			continue;
-		}
-
-		/*
-		 * We only check CRC if no offload is available and if it is
-		 * it's solicited data, in which case, the FCP layer would
-		 * check it during the copy.
-		 */
-		if (lp->crc_offload && skb->ip_summed == CHECKSUM_UNNECESSARY)
-			fr_flags(fp) &= ~FCPHF_CRC_UNCHECKED;
-		else
-			fr_flags(fp) |= FCPHF_CRC_UNCHECKED;
-
-		fh = fc_frame_header_get(fp);
-		if (fh->fh_r_ctl == FC_RCTL_DD_SOL_DATA &&
-		    fh->fh_type == FC_TYPE_FCP) {
-			fc_exch_recv(lp, fp);
-			continue;
-		}
-		if (fr_flags(fp) & FCPHF_CRC_UNCHECKED) {
-			if (le32_to_cpu(fr_crc(fp)) !=
-			    ~crc32(~0, skb->data, fr_len)) {
-				if (stats->InvalidCRCCount < 5)
-					printk(KERN_WARNING "fcoe: dropping "
-					       "frame with CRC error\n");
-				stats->InvalidCRCCount++;
-				stats->ErrorFrames++;
-				fc_frame_free(fp);
-				continue;
-			}
-			fr_flags(fp) &= ~FCPHF_CRC_UNCHECKED;
-		}
-		if (unlikely(port->fcoe->ctlr.flogi_oxid != FC_XID_UNKNOWN) &&
-		    fcoe_ctlr_recv_flogi(&port->fcoe->ctlr, fp, mac)) {
-			fc_frame_free(fp);
-			continue;
-		}
-		fc_exch_recv(lp, fp);
+		fcoe_recv_frame(skb);
 	}
 	return 0;
 }
 
 /**
- * fcoe_check_wait_queue() - attempt to clear the transmit backlog
- * @lp: the fc_lport
+ * fcoe_check_wait_queue() - Attempt to clear the transmit backlog
+ * @lport: The local port whose backlog is to be cleared
  *
- * This empties the wait_queue, dequeue the head of the wait_queue queue
- * and calls fcoe_start_io() for each packet, if all skb have been
- * transmitted, return qlen or -1 if a error occurs, then restore
- * wait_queue and try again later.
+ * This empties the wait_queue, dequeues the head of the wait_queue queue
+ * and calls fcoe_start_io() for each packet. If all skb have been
+ * transmitted it returns the qlen. If an error occurs it restores
+ * wait_queue (to try again later) and returns -1.
  *
- * The wait_queue is used when the skb transmit fails. skb will go
- * in the wait_queue which will be emptied by the timer function or
+ * The wait_queue is used when the skb transmit fails. The failed skb
+ * will go in the wait_queue which will be emptied by the timer function or
  * by the next skb transmit.
  */
-static void fcoe_check_wait_queue(struct fc_lport *lp, struct sk_buff *skb)
+static void fcoe_check_wait_queue(struct fc_lport *lport, struct sk_buff *skb)
 {
-	struct fcoe_port *port = lport_priv(lp);
+	struct fcoe_port *port = lport_priv(lport);
 	int rc;
 
 	spin_lock_bh(&port->fcoe_pending_queue.lock);
@@ -1501,19 +1745,19 @@ static void fcoe_check_wait_queue(struct fc_lport *lp, struct sk_buff *skb)
 	}
 
 	if (port->fcoe_pending_queue.qlen < FCOE_LOW_QUEUE_DEPTH)
-		lp->qfull = 0;
+		lport->qfull = 0;
 	if (port->fcoe_pending_queue.qlen && !timer_pending(&port->timer))
 		mod_timer(&port->timer, jiffies + 2);
 	port->fcoe_pending_queue_active = 0;
 out:
 	if (port->fcoe_pending_queue.qlen > FCOE_MAX_QUEUE_DEPTH)
-		lp->qfull = 1;
+		lport->qfull = 1;
 	spin_unlock_bh(&port->fcoe_pending_queue.lock);
 	return;
 }
 
 /**
- * fcoe_dev_setup() - setup link change notification interface
+ * fcoe_dev_setup() - Setup the link change notification interface
  */
 static void fcoe_dev_setup(void)
 {
@@ -1521,7 +1765,7 @@ static void fcoe_dev_setup(void)
 }
 
 /**
- * fcoe_dev_cleanup() - cleanup link change notification interface
+ * fcoe_dev_cleanup() - Cleanup the link change notification interface
  */
 static void fcoe_dev_cleanup(void)
 {
@@ -1529,19 +1773,19 @@ static void fcoe_dev_cleanup(void)
 }
 
 /**
- * fcoe_device_notification() - netdev event notification callback
- * @notifier: context of the notification
- * @event: type of event
- * @ptr: fixed array for output parsed ifname
+ * fcoe_device_notification() - Handler for net device events
+ * @notifier: The context of the notification
+ * @event:    The type of event
+ * @ptr:      The net device that the event was on
  *
- * This function is called by the ethernet driver in case of link change event
+ * This function is called by the Ethernet driver in case of link change event.
  *
  * Returns: 0 for success
  */
 static int fcoe_device_notification(struct notifier_block *notifier,
 				    ulong event, void *ptr)
 {
-	struct fc_lport *lp = NULL;
+	struct fc_lport *lport = NULL;
 	struct net_device *netdev = ptr;
 	struct fcoe_interface *fcoe;
 	struct fcoe_port *port;
@@ -1552,11 +1796,11 @@ static int fcoe_device_notification(struct notifier_block *notifier,
 
 	list_for_each_entry(fcoe, &fcoe_hostlist, list) {
 		if (fcoe->netdev == netdev) {
-			lp = fcoe->ctlr.lp;
+			lport = fcoe->ctlr.lp;
 			break;
 		}
 	}
-	if (lp == NULL) {
+	if (!lport) {
 		rc = NOTIFY_DONE;
 		goto out;
 	}
@@ -1570,10 +1814,12 @@ static int fcoe_device_notification(struct notifier_block *notifier,
 	case NETDEV_CHANGE:
 		break;
 	case NETDEV_CHANGEMTU:
+		if (netdev->features & NETIF_F_FCOE_MTU)
+			break;
 		mfs = netdev->mtu - (sizeof(struct fcoe_hdr) +
 				     sizeof(struct fcoe_crc_eof));
 		if (mfs >= FC_MIN_MAX_FRAME)
-			fc_set_mfs(lp, mfs);
+			fc_set_mfs(lport, mfs);
 		break;
 	case NETDEV_REGISTER:
 		break;
@@ -1588,22 +1834,22 @@ static int fcoe_device_notification(struct notifier_block *notifier,
 		FCOE_NETDEV_DBG(netdev, "Unknown event %ld "
 				"from netdev netlink\n", event);
 	}
-	if (link_possible && !fcoe_link_ok(lp))
+	if (link_possible && !fcoe_link_ok(lport))
 		fcoe_ctlr_link_up(&fcoe->ctlr);
 	else if (fcoe_ctlr_link_down(&fcoe->ctlr)) {
-		stats = fc_lport_get_stats(lp);
+		stats = fc_lport_get_stats(lport);
 		stats->LinkFailureCount++;
-		fcoe_clean_pending_queue(lp);
+		fcoe_clean_pending_queue(lport);
 	}
 out:
 	return rc;
 }
 
 /**
- * fcoe_if_to_netdev() - parse a name buffer to get netdev
- * @buffer: incoming buffer to be copied
+ * fcoe_if_to_netdev() - Parse a name buffer to get a net device
+ * @buffer: The name of the net device
  *
- * Returns: NULL or ptr to net_device
+ * Returns: NULL or a ptr to net_device
  */
 static struct net_device *fcoe_if_to_netdev(const char *buffer)
 {
@@ -1621,9 +1867,109 @@ static struct net_device *fcoe_if_to_netdev(const char *buffer)
 }
 
 /**
- * fcoe_destroy() - handles the destroy from sysfs
- * @buffer: expected to be an eth if name
- * @kp: associated kernel param
+ * fcoe_disable() - Disables a FCoE interface
+ * @buffer: The name of the Ethernet interface to be disabled
+ * @kp:	    The associated kernel parameter
+ *
+ * Called from sysfs.
+ *
+ * Returns: 0 for success
+ */
+static int fcoe_disable(const char *buffer, struct kernel_param *kp)
+{
+	struct fcoe_interface *fcoe;
+	struct net_device *netdev;
+	int rc = 0;
+
+	mutex_lock(&fcoe_config_mutex);
+#ifdef CONFIG_FCOE_MODULE
+	/*
+	 * Make sure the module has been initialized, and is not about to be
+	 * removed.  Module paramter sysfs files are writable before the
+	 * module_init function is called and after module_exit.
+	 */
+	if (THIS_MODULE->state != MODULE_STATE_LIVE) {
+		rc = -ENODEV;
+		goto out_nodev;
+	}
+#endif
+
+	netdev = fcoe_if_to_netdev(buffer);
+	if (!netdev) {
+		rc = -ENODEV;
+		goto out_nodev;
+	}
+
+	rtnl_lock();
+	fcoe = fcoe_hostlist_lookup_port(netdev);
+	rtnl_unlock();
+
+	if (fcoe)
+		fc_fabric_logoff(fcoe->ctlr.lp);
+	else
+		rc = -ENODEV;
+
+	dev_put(netdev);
+out_nodev:
+	mutex_unlock(&fcoe_config_mutex);
+	return rc;
+}
+
+/**
+ * fcoe_enable() - Enables a FCoE interface
+ * @buffer: The name of the Ethernet interface to be enabled
+ * @kp:     The associated kernel parameter
+ *
+ * Called from sysfs.
+ *
+ * Returns: 0 for success
+ */
+static int fcoe_enable(const char *buffer, struct kernel_param *kp)
+{
+	struct fcoe_interface *fcoe;
+	struct net_device *netdev;
+	int rc = 0;
+
+	mutex_lock(&fcoe_config_mutex);
+#ifdef CONFIG_FCOE_MODULE
+	/*
+	 * Make sure the module has been initialized, and is not about to be
+	 * removed.  Module paramter sysfs files are writable before the
+	 * module_init function is called and after module_exit.
+	 */
+	if (THIS_MODULE->state != MODULE_STATE_LIVE) {
+		rc = -ENODEV;
+		goto out_nodev;
+	}
+#endif
+
+	netdev = fcoe_if_to_netdev(buffer);
+	if (!netdev) {
+		rc = -ENODEV;
+		goto out_nodev;
+	}
+
+	rtnl_lock();
+	fcoe = fcoe_hostlist_lookup_port(netdev);
+	rtnl_unlock();
+
+	if (fcoe)
+		rc = fc_fabric_login(fcoe->ctlr.lp);
+	else
+		rc = -ENODEV;
+
+	dev_put(netdev);
+out_nodev:
+	mutex_unlock(&fcoe_config_mutex);
+	return rc;
+}
+
+/**
+ * fcoe_destroy() - Destroy a FCoE interface
+ * @buffer: The name of the Ethernet interface to be destroyed
+ * @kp:	    The associated kernel parameter
+ *
+ * Called from sysfs.
  *
  * Returns: 0 for success
  */
@@ -1631,7 +1977,7 @@ static int fcoe_destroy(const char *buffer, struct kernel_param *kp)
 {
 	struct fcoe_interface *fcoe;
 	struct net_device *netdev;
-	int rc;
+	int rc = 0;
 
 	mutex_lock(&fcoe_config_mutex);
 #ifdef CONFIG_FCOE_MODULE
@@ -1670,6 +2016,10 @@ out_nodev:
 	return rc;
 }
 
+/**
+ * fcoe_destroy_work() - Destroy a FCoE port in a deferred work context
+ * @work: Handle to the FCoE port to be destroyed
+ */
 static void fcoe_destroy_work(struct work_struct *work)
 {
 	struct fcoe_port *port;
@@ -1681,9 +2031,11 @@ static void fcoe_destroy_work(struct work_struct *work)
 }
 
 /**
- * fcoe_create() - Handles the create call from sysfs
- * @buffer: expected to be an eth if name
- * @kp: associated kernel param
+ * fcoe_create() - Create a fcoe interface
+ * @buffer: The name of the Ethernet interface to create on
+ * @kp:	    The associated kernel param
+ *
+ * Called from sysfs.
  *
  * Returns: 0 for success
  */
@@ -1726,7 +2078,7 @@ static int fcoe_create(const char *buffer, struct kernel_param *kp)
 		goto out_putdev;
 	}
 
-	lport = fcoe_if_create(fcoe, &netdev->dev);
+	lport = fcoe_if_create(fcoe, &netdev->dev, 0);
 	if (IS_ERR(lport)) {
 		printk(KERN_ERR "fcoe: Failed to create interface (%s)\n",
 		       netdev->name);
@@ -1762,16 +2114,9 @@ out_nodev:
 	return rc;
 }
 
-module_param_call(create, fcoe_create, NULL, NULL, S_IWUSR);
-__MODULE_PARM_TYPE(create, "string");
-MODULE_PARM_DESC(create, "Create fcoe fcoe using net device passed in.");
-module_param_call(destroy, fcoe_destroy, NULL, NULL, S_IWUSR);
-__MODULE_PARM_TYPE(destroy, "string");
-MODULE_PARM_DESC(destroy, "Destroy fcoe fcoe");
-
 /**
- * fcoe_link_ok() - Check if link is ok for the fc_lport
- * @lp: ptr to the fc_lport
+ * fcoe_link_ok() - Check if the link is OK for a local port
+ * @lport: The local port to check link on
  *
  * Any permanently-disqualifying conditions have been previously checked.
  * This also updates the speed setting, which may change with link for 100/1000.
@@ -1783,26 +2128,26 @@ MODULE_PARM_DESC(destroy, "Destroy fcoe fcoe");
  * Returns: 0 if link is OK for use by FCoE.
  *
  */
-int fcoe_link_ok(struct fc_lport *lp)
+int fcoe_link_ok(struct fc_lport *lport)
 {
-	struct fcoe_port *port = lport_priv(lp);
-	struct net_device *dev = port->fcoe->netdev;
+	struct fcoe_port *port = lport_priv(lport);
+	struct net_device *netdev = port->fcoe->netdev;
 	struct ethtool_cmd ecmd = { ETHTOOL_GSET };
 
-	if ((dev->flags & IFF_UP) && netif_carrier_ok(dev) &&
-	    (!dev_ethtool_get_settings(dev, &ecmd))) {
-		lp->link_supported_speeds &=
+	if ((netdev->flags & IFF_UP) && netif_carrier_ok(netdev) &&
+	    (!dev_ethtool_get_settings(netdev, &ecmd))) {
+		lport->link_supported_speeds &=
 			~(FC_PORTSPEED_1GBIT | FC_PORTSPEED_10GBIT);
 		if (ecmd.supported & (SUPPORTED_1000baseT_Half |
 				      SUPPORTED_1000baseT_Full))
-			lp->link_supported_speeds |= FC_PORTSPEED_1GBIT;
+			lport->link_supported_speeds |= FC_PORTSPEED_1GBIT;
 		if (ecmd.supported & SUPPORTED_10000baseT_Full)
-			lp->link_supported_speeds |=
+			lport->link_supported_speeds |=
 				FC_PORTSPEED_10GBIT;
 		if (ecmd.speed == SPEED_1000)
-			lp->link_speed = FC_PORTSPEED_1GBIT;
+			lport->link_speed = FC_PORTSPEED_1GBIT;
 		if (ecmd.speed == SPEED_10000)
-			lp->link_speed = FC_PORTSPEED_10GBIT;
+			lport->link_speed = FC_PORTSPEED_10GBIT;
 
 		return 0;
 	}
@@ -1810,8 +2155,8 @@ int fcoe_link_ok(struct fc_lport *lp)
 }
 
 /**
- * fcoe_percpu_clean() - Clear the pending skbs for an lport
- * @lp: the fc_lport
+ * fcoe_percpu_clean() - Clear all pending skbs for an local port
+ * @lport: The local port whose skbs are to be cleared
  *
  * Must be called with fcoe_create_mutex held to single-thread completion.
  *
@@ -1820,7 +2165,7 @@ int fcoe_link_ok(struct fc_lport *lp)
  * there no packets that will be handled by the lport, but also that any
  * threads already handling packet have returned.
  */
-void fcoe_percpu_clean(struct fc_lport *lp)
+void fcoe_percpu_clean(struct fc_lport *lport)
 {
 	struct fcoe_percpu_s *pp;
 	struct fcoe_rcv_info *fr;
@@ -1838,7 +2183,7 @@ void fcoe_percpu_clean(struct fc_lport *lp)
 		     skb = next) {
 			next = skb->next;
 			fr = fcoe_dev_from_skb(skb);
-			if (fr->fr_dev == lp) {
+			if (fr->fr_dev == lport) {
 				__skb_unlink(skb, list);
 				kfree_skb(skb);
 			}
@@ -1867,13 +2212,11 @@ void fcoe_percpu_clean(struct fc_lport *lp)
 
 /**
  * fcoe_clean_pending_queue() - Dequeue a skb and free it
- * @lp: the corresponding fc_lport
- *
- * Returns: none
+ * @lport: The local port to dequeue a skb on
  */
-void fcoe_clean_pending_queue(struct fc_lport *lp)
+void fcoe_clean_pending_queue(struct fc_lport *lport)
 {
-	struct fcoe_port  *port = lport_priv(lp);
+	struct fcoe_port  *port = lport_priv(lport);
 	struct sk_buff *skb;
 
 	spin_lock_bh(&port->fcoe_pending_queue.lock);
@@ -1886,10 +2229,10 @@ void fcoe_clean_pending_queue(struct fc_lport *lp)
 }
 
 /**
- * fcoe_reset() - Resets the fcoe
- * @shost: shost the reset is from
+ * fcoe_reset() - Reset a local port
+ * @shost: The SCSI host associated with the local port to be reset
  *
- * Returns: always 0
+ * Returns: Always 0 (return value required by FC transport template)
  */
 int fcoe_reset(struct Scsi_Host *shost)
 {
@@ -1899,30 +2242,33 @@ int fcoe_reset(struct Scsi_Host *shost)
 }
 
 /**
- * fcoe_hostlist_lookup_port() - find the corresponding lport by a given device
- * @dev: this is currently ptr to net_device
+ * fcoe_hostlist_lookup_port() - Find the FCoE interface associated with a net device
+ * @netdev: The net device used as a key
+ *
+ * Locking: Must be called with the RNL mutex held.
  *
- * Returns: NULL or the located fcoe_port
- * Locking: must be called with the RNL mutex held
+ * Returns: NULL or the FCoE interface
  */
 static struct fcoe_interface *
-fcoe_hostlist_lookup_port(const struct net_device *dev)
+fcoe_hostlist_lookup_port(const struct net_device *netdev)
 {
 	struct fcoe_interface *fcoe;
 
 	list_for_each_entry(fcoe, &fcoe_hostlist, list) {
-		if (fcoe->netdev == dev)
+		if (fcoe->netdev == netdev)
 			return fcoe;
 	}
 	return NULL;
 }
 
 /**
- * fcoe_hostlist_lookup() - Find the corresponding lport by netdev
- * @netdev: ptr to net_device
+ * fcoe_hostlist_lookup() - Find the local port associated with a
+ *			    given net device
+ * @netdev: The netdevice used as a key
  *
- * Returns: 0 for success
- * Locking: must be called with the RTNL mutex held
+ * Locking: Must be called with the RTNL mutex held
+ *
+ * Returns: NULL or the local port
  */
 static struct fc_lport *fcoe_hostlist_lookup(const struct net_device *netdev)
 {
@@ -1933,11 +2279,13 @@ static struct fc_lport *fcoe_hostlist_lookup(const struct net_device *netdev)
 }
 
 /**
- * fcoe_hostlist_add() - Add a lport to lports list
- * @lp: ptr to the fc_lport to be added
+ * fcoe_hostlist_add() - Add the FCoE interface identified by a local
+ *			 port to the hostlist
+ * @lport: The local port that identifies the FCoE interface to be added
  *
- * Returns: 0 for success
  * Locking: must be called with the RTNL mutex held
+ *
+ * Returns: 0 for success
  */
 static int fcoe_hostlist_add(const struct fc_lport *lport)
 {
@@ -1954,15 +2302,15 @@ static int fcoe_hostlist_add(const struct fc_lport *lport)
 }
 
 /**
- * fcoe_init() - fcoe module loading initialization
+ * fcoe_init() - Initialize fcoe.ko
  *
- * Returns 0 on success, negative on failure
+ * Returns: 0 on success, or a negative value on failure
  */
 static int __init fcoe_init(void)
 {
+	struct fcoe_percpu_s *p;
 	unsigned int cpu;
 	int rc = 0;
-	struct fcoe_percpu_s *p;
 
 	mutex_lock(&fcoe_config_mutex);
 
@@ -1999,15 +2347,15 @@ out_free:
 module_init(fcoe_init);
 
 /**
- * fcoe_exit() - fcoe module unloading cleanup
+ * fcoe_exit() - Clean up fcoe.ko
  *
- * Returns 0 on success, negative on failure
+ * Returns: 0 on success or a  negative value on failure
  */
 static void __exit fcoe_exit(void)
 {
-	unsigned int cpu;
 	struct fcoe_interface *fcoe, *tmp;
 	struct fcoe_port *port;
+	unsigned int cpu;
 
 	mutex_lock(&fcoe_config_mutex);
 
@@ -2033,9 +2381,238 @@ static void __exit fcoe_exit(void)
 	/* flush any asyncronous interface destroys,
 	 * this should happen after the netdev notifier is unregistered */
 	flush_scheduled_work();
+	/* That will flush out all the N_Ports on the hostlist, but now we
+	 * may have NPIV VN_Ports scheduled for destruction */
+	flush_scheduled_work();
 
 	/* detach from scsi transport
 	 * must happen after all destroys are done, therefor after the flush */
 	fcoe_if_exit();
 }
 module_exit(fcoe_exit);
+
+/**
+ * fcoe_flogi_resp() - FCoE specific FLOGI and FDISC response handler
+ * @seq: active sequence in the FLOGI or FDISC exchange
+ * @fp: response frame, or error encoded in a pointer (timeout)
+ * @arg: pointer the the fcoe_ctlr structure
+ *
+ * This handles MAC address managment for FCoE, then passes control on to
+ * the libfc FLOGI response handler.
+ */
+static void fcoe_flogi_resp(struct fc_seq *seq, struct fc_frame *fp, void *arg)
+{
+	struct fcoe_ctlr *fip = arg;
+	struct fc_exch *exch = fc_seq_exch(seq);
+	struct fc_lport *lport = exch->lp;
+	u8 *mac;
+
+	if (IS_ERR(fp))
+		goto done;
+
+	mac = fr_cb(fp)->granted_mac;
+	if (is_zero_ether_addr(mac)) {
+		/* pre-FIP */
+		if (fcoe_ctlr_recv_flogi(fip, lport, fp)) {
+			fc_frame_free(fp);
+			return;
+		}
+	}
+	fcoe_update_src_mac(lport, mac);
+done:
+	fc_lport_flogi_resp(seq, fp, lport);
+}
+
+/**
+ * fcoe_logo_resp() - FCoE specific LOGO response handler
+ * @seq: active sequence in the LOGO exchange
+ * @fp: response frame, or error encoded in a pointer (timeout)
+ * @arg: pointer the the fcoe_ctlr structure
+ *
+ * This handles MAC address managment for FCoE, then passes control on to
+ * the libfc LOGO response handler.
+ */
+static void fcoe_logo_resp(struct fc_seq *seq, struct fc_frame *fp, void *arg)
+{
+	struct fc_lport *lport = arg;
+	static u8 zero_mac[ETH_ALEN] = { 0 };
+
+	if (!IS_ERR(fp))
+		fcoe_update_src_mac(lport, zero_mac);
+	fc_lport_logo_resp(seq, fp, lport);
+}
+
+/**
+ * fcoe_elsct_send - FCoE specific ELS handler
+ *
+ * This does special case handling of FIP encapsualted ELS exchanges for FCoE,
+ * using FCoE specific response handlers and passing the FIP controller as
+ * the argument (the lport is still available from the exchange).
+ *
+ * Most of the work here is just handed off to the libfc routine.
+ */
+static struct fc_seq *fcoe_elsct_send(struct fc_lport *lport, u32 did,
+				      struct fc_frame *fp, unsigned int op,
+				      void (*resp)(struct fc_seq *,
+						   struct fc_frame *,
+						   void *),
+				      void *arg, u32 timeout)
+{
+	struct fcoe_port *port = lport_priv(lport);
+	struct fcoe_interface *fcoe = port->fcoe;
+	struct fcoe_ctlr *fip = &fcoe->ctlr;
+	struct fc_frame_header *fh = fc_frame_header_get(fp);
+
+	switch (op) {
+	case ELS_FLOGI:
+	case ELS_FDISC:
+		return fc_elsct_send(lport, did, fp, op, fcoe_flogi_resp,
+				     fip, timeout);
+	case ELS_LOGO:
+		/* only hook onto fabric logouts, not port logouts */
+		if (ntoh24(fh->fh_d_id) != FC_FID_FLOGI)
+			break;
+		return fc_elsct_send(lport, did, fp, op, fcoe_logo_resp,
+				     lport, timeout);
+	}
+	return fc_elsct_send(lport, did, fp, op, resp, arg, timeout);
+}
+
+/**
+ * fcoe_vport_create() - create an fc_host/scsi_host for a vport
+ * @vport: fc_vport object to create a new fc_host for
+ * @disabled: start the new fc_host in a disabled state by default?
+ *
+ * Returns: 0 for success
+ */
+static int fcoe_vport_create(struct fc_vport *vport, bool disabled)
+{
+	struct Scsi_Host *shost = vport_to_shost(vport);
+	struct fc_lport *n_port = shost_priv(shost);
+	struct fcoe_port *port = lport_priv(n_port);
+	struct fcoe_interface *fcoe = port->fcoe;
+	struct net_device *netdev = fcoe->netdev;
+	struct fc_lport *vn_port;
+
+	mutex_lock(&fcoe_config_mutex);
+	vn_port = fcoe_if_create(fcoe, &vport->dev, 1);
+	mutex_unlock(&fcoe_config_mutex);
+
+	if (IS_ERR(vn_port)) {
+		printk(KERN_ERR "fcoe: fcoe_vport_create(%s) failed\n",
+		       netdev->name);
+		return -EIO;
+	}
+
+	if (disabled) {
+		fc_vport_set_state(vport, FC_VPORT_DISABLED);
+	} else {
+		vn_port->boot_time = jiffies;
+		fc_fabric_login(vn_port);
+		fc_vport_setlink(vn_port);
+	}
+	return 0;
+}
+
+/**
+ * fcoe_vport_destroy() - destroy the fc_host/scsi_host for a vport
+ * @vport: fc_vport object that is being destroyed
+ *
+ * Returns: 0 for success
+ */
+static int fcoe_vport_destroy(struct fc_vport *vport)
+{
+	struct Scsi_Host *shost = vport_to_shost(vport);
+	struct fc_lport *n_port = shost_priv(shost);
+	struct fc_lport *vn_port = vport->dd_data;
+	struct fcoe_port *port = lport_priv(vn_port);
+
+	mutex_lock(&n_port->lp_mutex);
+	list_del(&vn_port->list);
+	mutex_unlock(&n_port->lp_mutex);
+	schedule_work(&port->destroy_work);
+	return 0;
+}
+
+/**
+ * fcoe_vport_disable() - change vport state
+ * @vport: vport to bring online/offline
+ * @disable: should the vport be disabled?
+ */
+static int fcoe_vport_disable(struct fc_vport *vport, bool disable)
+{
+	struct fc_lport *lport = vport->dd_data;
+
+	if (disable) {
+		fc_vport_set_state(vport, FC_VPORT_DISABLED);
+		fc_fabric_logoff(lport);
+	} else {
+		lport->boot_time = jiffies;
+		fc_fabric_login(lport);
+		fc_vport_setlink(lport);
+	}
+
+	return 0;
+}
+
+/**
+ * fcoe_vport_set_symbolic_name() - append vport string to symbolic name
+ * @vport: fc_vport with a new symbolic name string
+ *
+ * After generating a new symbolic name string, a new RSPN_ID request is
+ * sent to the name server.  There is no response handler, so if it fails
+ * for some reason it will not be retried.
+ */
+static void fcoe_set_vport_symbolic_name(struct fc_vport *vport)
+{
+	struct fc_lport *lport = vport->dd_data;
+	struct fc_frame *fp;
+	size_t len;
+
+	snprintf(fc_host_symbolic_name(lport->host), FC_SYMBOLIC_NAME_SIZE,
+		 "%s v%s over %s : %s", FCOE_NAME, FCOE_VERSION,
+		 fcoe_netdev(lport)->name, vport->symbolic_name);
+
+	if (lport->state != LPORT_ST_READY)
+		return;
+
+	len = strnlen(fc_host_symbolic_name(lport->host), 255);
+	fp = fc_frame_alloc(lport,
+			    sizeof(struct fc_ct_hdr) +
+			    sizeof(struct fc_ns_rspn) + len);
+	if (!fp)
+		return;
+	lport->tt.elsct_send(lport, FC_FID_DIR_SERV, fp, FC_NS_RSPN_ID,
+			     NULL, NULL, 3 * lport->r_a_tov);
+}
+
+/**
+ * fcoe_get_lesb() - Fill the FCoE Link Error Status Block
+ * @lport: the local port
+ * @fc_lesb: the link error status block
+ */
+static void fcoe_get_lesb(struct fc_lport *lport,
+			 struct fc_els_lesb *fc_lesb)
+{
+	unsigned int cpu;
+	u32 lfc, vlfc, mdac;
+	struct fcoe_dev_stats *devst;
+	struct fcoe_fc_els_lesb *lesb;
+	struct net_device *netdev = fcoe_netdev(lport);
+
+	lfc = 0;
+	vlfc = 0;
+	mdac = 0;
+	lesb = (struct fcoe_fc_els_lesb *)fc_lesb;
+	memset(lesb, 0, sizeof(*lesb));
+	for_each_possible_cpu(cpu) {
+		devst = per_cpu_ptr(lport->dev_stats, cpu);
+		lfc += devst->LinkFailureCount;
+		vlfc += devst->VLinkFailureCount;
+		mdac += devst->MissDiscAdvCount;
+	}
+	lesb->lesb_link_fail = htonl(lfc);
+	lesb->lesb_vlink_fail = htonl(vlfc);
+	lesb->lesb_miss_fka = htonl(mdac);
+	lesb->lesb_fcs_error = htonl(dev_get_stats(netdev)->rx_crc_errors);
+}
diff --git a/drivers/scsi/fcoe/fcoe.h b/drivers/scsi/fcoe/fcoe.h
index ce7f60fb1bc0..c69b2c56c2d1 100644
--- a/drivers/scsi/fcoe/fcoe.h
+++ b/drivers/scsi/fcoe/fcoe.h
@@ -32,7 +32,7 @@
 #define FCOE_NAME	"fcoe"
 #define FCOE_VENDOR	"Open-FCoE.org"
 
-#define FCOE_MAX_LUN		255
+#define FCOE_MAX_LUN		0xFFFF
 #define FCOE_MAX_FCP_TARGET	256
 
 #define FCOE_MAX_OUTSTANDING_COMMANDS	1024
@@ -40,11 +40,17 @@
 #define FCOE_MIN_XID		0x0000	/* the min xid supported by fcoe_sw */
 #define FCOE_MAX_XID		0x0FFF	/* the max xid supported by fcoe_sw */
 
+/*
+ * Max MTU for FCoE: 14 (FCoE header) + 24 (FC header) + 2112 (max FC payload)
+ * + 4 (FC CRC) + 4 (FCoE trailer) =  2158 bytes
+ */
+#define FCOE_MTU	2158
+
 unsigned int fcoe_debug_logging;
 module_param_named(debug_logging, fcoe_debug_logging, int, S_IRUGO|S_IWUSR);
 MODULE_PARM_DESC(debug_logging, "a bit mask of logging levels");
 
-#define FCOE_LOGGING        0x01 /* General logging, not categorized */
+#define FCOE_LOGGING	    0x01 /* General logging, not categorized */
 #define FCOE_NETDEV_LOGGING 0x02 /* Netdevice logging */
 
 #define FCOE_CHECK_LOGGING(LEVEL, CMD)					\
@@ -64,8 +70,13 @@ do {                                                            	\
 			   printk(KERN_INFO "fcoe: %s: " fmt,	\
 				  netdev->name, ##args);)
 
-/*
- * this percpu struct for fcoe
+/**
+ * struct fcoe_percpu_s - The per-CPU context for FCoE receive threads
+ * @thread:	    The thread context
+ * @fcoe_rx_list:   The queue of pending packets to process
+ * @page:	    The memory page for calculating frame trailer CRCs
+ * @crc_eof_offset: The offset into the CRC page pointing to available
+ *		    memory for a new trailer
  */
 struct fcoe_percpu_s {
 	struct task_struct *thread;
@@ -74,37 +85,62 @@ struct fcoe_percpu_s {
 	int crc_eof_offset;
 };
 
-/*
- * an FCoE interface, 1:1 with netdev
+/**
+ * struct fcoe_interface - A FCoE interface
+ * @list:	      Handle for a list of FCoE interfaces
+ * @netdev:	      The associated net device
+ * @fcoe_packet_type: FCoE packet type
+ * @fip_packet_type:  FIP packet type
+ * @ctlr:	      The FCoE controller (for FIP)
+ * @oem:	      The offload exchange manager for all local port
+ *		      instances associated with this port
+ * @kref:	      The kernel reference
+ *
+ * This structure is 1:1 with a net devive.
  */
 struct fcoe_interface {
-	struct list_head list;
-	struct net_device *netdev;
-	struct packet_type  fcoe_packet_type;
-	struct packet_type  fip_packet_type;
-	struct fcoe_ctlr ctlr;
-	struct fc_exch_mgr *oem;		/* offload exchange manager */
-	struct kref kref;
+	struct list_head   list;
+	struct net_device  *netdev;
+	struct packet_type fcoe_packet_type;
+	struct packet_type fip_packet_type;
+	struct fcoe_ctlr   ctlr;
+	struct fc_exch_mgr *oem;
+	struct kref	   kref;
 };
 
-/*
- * the FCoE private structure that's allocated along with the
- * Scsi_Host and libfc fc_lport structures
+/**
+ * struct fcoe_port - The FCoE private structure
+ * @fcoe:		       The associated fcoe interface
+ * @lport:		       The associated local port
+ * @fcoe_pending_queue:	       The pending Rx queue of skbs
+ * @fcoe_pending_queue_active: Indicates if the pending queue is active
+ * @timer:		       The queue timer
+ * @destroy_work:	       Handle for work context
+ *			       (to prevent RTNL deadlocks)
+ * @data_srt_addr:	       Source address for data
+ *
+ * An instance of this structure is to be allocated along with the
+ * Scsi_Host and libfc fc_lport structures.
  */
 struct fcoe_port {
 	struct fcoe_interface *fcoe;
-	struct fc_lport *lport;
-	struct sk_buff_head fcoe_pending_queue;
-	u8	fcoe_pending_queue_active;
-	struct timer_list timer;		/* queue timer */
-	struct work_struct destroy_work;	/* to prevent rtnl deadlocks */
+	struct fc_lport	      *lport;
+	struct sk_buff_head   fcoe_pending_queue;
+	u8		      fcoe_pending_queue_active;
+	struct timer_list     timer;
+	struct work_struct    destroy_work;
+	u8		      data_src_addr[ETH_ALEN];
 };
 
 #define fcoe_from_ctlr(fip) container_of(fip, struct fcoe_interface, ctlr)
 
-static inline struct net_device *fcoe_netdev(const struct fc_lport *lp)
+/**
+ * fcoe_netdev() - Return the net device associated with a local port
+ * @lport: The local port to get the net device from
+ */
+static inline struct net_device *fcoe_netdev(const struct fc_lport *lport)
 {
-	return ((struct fcoe_port *)lport_priv(lp))->fcoe->netdev;
+	return ((struct fcoe_port *)lport_priv(lport))->fcoe->netdev;
 }
 
 #endif /* _FCOE_H_ */
diff --git a/drivers/scsi/fcoe/libfcoe.c b/drivers/scsi/fcoe/libfcoe.c
index 11ae5c94608b..9823291395ad 100644
--- a/drivers/scsi/fcoe/libfcoe.c
+++ b/drivers/scsi/fcoe/libfcoe.c
@@ -59,26 +59,30 @@ unsigned int libfcoe_debug_logging;
 module_param_named(debug_logging, libfcoe_debug_logging, int, S_IRUGO|S_IWUSR);
 MODULE_PARM_DESC(debug_logging, "a bit mask of logging levels");
 
-#define LIBFCOE_LOGGING     0x01 /* General logging, not categorized */
+#define LIBFCOE_LOGGING	    0x01 /* General logging, not categorized */
 #define LIBFCOE_FIP_LOGGING 0x02 /* FIP logging */
 
-#define LIBFCOE_CHECK_LOGGING(LEVEL, CMD)				\
-do {                                                            	\
-	if (unlikely(libfcoe_debug_logging & LEVEL))			\
-		do {							\
-			CMD;						\
-		} while (0);						\
+#define LIBFCOE_CHECK_LOGGING(LEVEL, CMD)		\
+do {							\
+	if (unlikely(libfcoe_debug_logging & LEVEL))	\
+		do {					\
+			CMD;				\
+		} while (0);				\
 } while (0)
 
 #define LIBFCOE_DBG(fmt, args...)					\
 	LIBFCOE_CHECK_LOGGING(LIBFCOE_LOGGING,				\
 			      printk(KERN_INFO "libfcoe: " fmt, ##args);)
 
-#define LIBFCOE_FIP_DBG(fmt, args...)					\
+#define LIBFCOE_FIP_DBG(fip, fmt, args...)				\
 	LIBFCOE_CHECK_LOGGING(LIBFCOE_FIP_LOGGING,			\
-			      printk(KERN_INFO "fip: " fmt, ##args);)
+			      printk(KERN_INFO "host%d: fip: " fmt, 	\
+				     (fip)->lp->host->host_no, ##args);)
 
-/*
+/**
+ * fcoe_ctlr_mtu_valid() - Check if a FCF's MTU is valid
+ * @fcf: The FCF to check
+ *
  * Return non-zero if FCF fcoe_size has been validated.
  */
 static inline int fcoe_ctlr_mtu_valid(const struct fcoe_fcf *fcf)
@@ -86,7 +90,10 @@ static inline int fcoe_ctlr_mtu_valid(const struct fcoe_fcf *fcf)
 	return (fcf->flags & FIP_FL_SOL) != 0;
 }
 
-/*
+/**
+ * fcoe_ctlr_fcf_usable() - Check if a FCF is usable
+ * @fcf: The FCF to check
+ *
  * Return non-zero if the FCF is usable.
  */
 static inline int fcoe_ctlr_fcf_usable(struct fcoe_fcf *fcf)
@@ -97,12 +104,13 @@ static inline int fcoe_ctlr_fcf_usable(struct fcoe_fcf *fcf)
 }
 
 /**
- * fcoe_ctlr_init() - Initialize the FCoE Controller instance.
- * @fip:	FCoE controller.
+ * fcoe_ctlr_init() - Initialize the FCoE Controller instance
+ * @fip: The FCoE controller to initialize
  */
 void fcoe_ctlr_init(struct fcoe_ctlr *fip)
 {
 	fip->state = FIP_ST_LINK_WAIT;
+	fip->mode = FIP_ST_AUTO;
 	INIT_LIST_HEAD(&fip->fcfs);
 	spin_lock_init(&fip->lock);
 	fip->flogi_oxid = FC_XID_UNKNOWN;
@@ -114,8 +122,8 @@ void fcoe_ctlr_init(struct fcoe_ctlr *fip)
 EXPORT_SYMBOL(fcoe_ctlr_init);
 
 /**
- * fcoe_ctlr_reset_fcfs() - Reset and free all FCFs for a controller.
- * @fip:	FCoE controller.
+ * fcoe_ctlr_reset_fcfs() - Reset and free all FCFs for a controller
+ * @fip: The FCoE controller whose FCFs are to be reset
  *
  * Called with &fcoe_ctlr lock held.
  */
@@ -134,8 +142,8 @@ static void fcoe_ctlr_reset_fcfs(struct fcoe_ctlr *fip)
 }
 
 /**
- * fcoe_ctlr_destroy() - Disable and tear-down the FCoE controller.
- * @fip:	FCoE controller.
+ * fcoe_ctlr_destroy() - Disable and tear down a FCoE controller
+ * @fip: The FCoE controller to tear down
  *
  * This is called by FCoE drivers before freeing the &fcoe_ctlr.
  *
@@ -148,9 +156,7 @@ static void fcoe_ctlr_reset_fcfs(struct fcoe_ctlr *fip)
 void fcoe_ctlr_destroy(struct fcoe_ctlr *fip)
 {
 	cancel_work_sync(&fip->recv_work);
-	spin_lock_bh(&fip->fip_recv_list.lock);
-	__skb_queue_purge(&fip->fip_recv_list);
-	spin_unlock_bh(&fip->fip_recv_list.lock);
+	skb_queue_purge(&fip->fip_recv_list);
 
 	spin_lock_bh(&fip->lock);
 	fip->state = FIP_ST_DISABLED;
@@ -162,8 +168,8 @@ void fcoe_ctlr_destroy(struct fcoe_ctlr *fip)
 EXPORT_SYMBOL(fcoe_ctlr_destroy);
 
 /**
- * fcoe_ctlr_fcoe_size() - Return the maximum FCoE size required for VN_Port.
- * @fip:	FCoE controller.
+ * fcoe_ctlr_fcoe_size() - Return the maximum FCoE size required for VN_Port
+ * @fip: The FCoE controller to get the maximum FCoE size from
  *
  * Returns the maximum packet size including the FCoE header and trailer,
  * but not including any Ethernet or VLAN headers.
@@ -180,9 +186,9 @@ static inline u32 fcoe_ctlr_fcoe_size(struct fcoe_ctlr *fip)
 }
 
 /**
- * fcoe_ctlr_solicit() - Send a solicitation.
- * @fip:	FCoE controller.
- * @fcf:	Destination FCF.  If NULL, a multicast solicitation is sent.
+ * fcoe_ctlr_solicit() - Send a FIP solicitation
+ * @fip: The FCoE controller to send the solicitation on
+ * @fcf: The destination FCF (if NULL, a multicast solicitation is sent)
  */
 static void fcoe_ctlr_solicit(struct fcoe_ctlr *fip, struct fcoe_fcf *fcf)
 {
@@ -241,8 +247,8 @@ static void fcoe_ctlr_solicit(struct fcoe_ctlr *fip, struct fcoe_fcf *fcf)
 }
 
 /**
- * fcoe_ctlr_link_up() - Start FCoE controller.
- * @fip:	FCoE controller.
+ * fcoe_ctlr_link_up() - Start FCoE controller
+ * @fip: The FCoE controller to start
  *
  * Called from the LLD when the network link is ready.
  */
@@ -255,11 +261,12 @@ void fcoe_ctlr_link_up(struct fcoe_ctlr *fip)
 		spin_unlock_bh(&fip->lock);
 		fc_linkup(fip->lp);
 	} else if (fip->state == FIP_ST_LINK_WAIT) {
-		fip->state = FIP_ST_AUTO;
+		fip->state = fip->mode;
 		fip->last_link = 1;
 		fip->link = 1;
 		spin_unlock_bh(&fip->lock);
-		LIBFCOE_FIP_DBG("%s", "setting AUTO mode.\n");
+		if (fip->state == FIP_ST_AUTO)
+			LIBFCOE_FIP_DBG(fip, "%s", "setting AUTO mode.\n");
 		fc_linkup(fip->lp);
 		fcoe_ctlr_solicit(fip, NULL);
 	} else
@@ -268,45 +275,23 @@ void fcoe_ctlr_link_up(struct fcoe_ctlr *fip)
 EXPORT_SYMBOL(fcoe_ctlr_link_up);
 
 /**
- * fcoe_ctlr_reset() - Reset FIP.
- * @fip:	FCoE controller.
- * @new_state:	FIP state to be entered.
- *
- * Returns non-zero if the link was up and now isn't.
+ * fcoe_ctlr_reset() - Reset a FCoE controller
+ * @fip:       The FCoE controller to reset
  */
-static int fcoe_ctlr_reset(struct fcoe_ctlr *fip, enum fip_state new_state)
+static void fcoe_ctlr_reset(struct fcoe_ctlr *fip)
 {
-	struct fc_lport *lp = fip->lp;
-	int link_dropped;
-
-	spin_lock_bh(&fip->lock);
 	fcoe_ctlr_reset_fcfs(fip);
 	del_timer(&fip->timer);
-	fip->state = new_state;
 	fip->ctlr_ka_time = 0;
 	fip->port_ka_time = 0;
 	fip->sol_time = 0;
 	fip->flogi_oxid = FC_XID_UNKNOWN;
 	fip->map_dest = 0;
-	fip->last_link = 0;
-	link_dropped = fip->link;
-	fip->link = 0;
-	spin_unlock_bh(&fip->lock);
-
-	if (link_dropped)
-		fc_linkdown(lp);
-
-	if (new_state == FIP_ST_ENABLED) {
-		fcoe_ctlr_solicit(fip, NULL);
-		fc_linkup(lp);
-		link_dropped = 0;
-	}
-	return link_dropped;
 }
 
 /**
- * fcoe_ctlr_link_down() - Stop FCoE controller.
- * @fip:	FCoE controller.
+ * fcoe_ctlr_link_down() - Stop a FCoE controller
+ * @fip: The FCoE controller to be stopped
  *
  * Returns non-zero if the link was up and now isn't.
  *
@@ -315,15 +300,29 @@ static int fcoe_ctlr_reset(struct fcoe_ctlr *fip, enum fip_state new_state)
  */
 int fcoe_ctlr_link_down(struct fcoe_ctlr *fip)
 {
-	return fcoe_ctlr_reset(fip, FIP_ST_LINK_WAIT);
+	int link_dropped;
+
+	LIBFCOE_FIP_DBG(fip, "link down.\n");
+	spin_lock_bh(&fip->lock);
+	fcoe_ctlr_reset(fip);
+	link_dropped = fip->link;
+	fip->link = 0;
+	fip->last_link = 0;
+	fip->state = FIP_ST_LINK_WAIT;
+	spin_unlock_bh(&fip->lock);
+
+	if (link_dropped)
+		fc_linkdown(fip->lp);
+	return link_dropped;
 }
 EXPORT_SYMBOL(fcoe_ctlr_link_down);
 
 /**
- * fcoe_ctlr_send_keep_alive() - Send a keep-alive to the selected FCF.
- * @fip:	FCoE controller.
- * @ports:	0 for controller keep-alive, 1 for port keep-alive.
- * @sa:		source MAC address.
+ * fcoe_ctlr_send_keep_alive() - Send a keep-alive to the selected FCF
+ * @fip:   The FCoE controller to send the FKA on
+ * @lport: libfc fc_lport to send from
+ * @ports: 0 for controller keep-alive, 1 for port keep-alive
+ * @sa:	   The source MAC address
  *
  * A controller keep-alive is sent every fka_period (typically 8 seconds).
  * The source MAC is the native MAC address.
@@ -332,7 +331,9 @@ EXPORT_SYMBOL(fcoe_ctlr_link_down);
  * The source MAC is the assigned mapped source address.
  * The destination is the FCF's F-port.
  */
-static void fcoe_ctlr_send_keep_alive(struct fcoe_ctlr *fip, int ports, u8 *sa)
+static void fcoe_ctlr_send_keep_alive(struct fcoe_ctlr *fip,
+				      struct fc_lport *lport,
+				      int ports, u8 *sa)
 {
 	struct sk_buff *skb;
 	struct fip_kal {
@@ -350,8 +351,7 @@ static void fcoe_ctlr_send_keep_alive(struct fcoe_ctlr *fip, int ports, u8 *sa)
 	if (!fcf || !fc_host_port_id(lp->host))
 		return;
 
-	len = fcoe_ctlr_fcoe_size(fip) + sizeof(struct ethhdr);
-	BUG_ON(len < sizeof(*kal) + sizeof(*vn));
+	len = sizeof(*kal) + ports * sizeof(*vn);
 	skb = dev_alloc_skb(len);
 	if (!skb)
 		return;
@@ -366,7 +366,7 @@ static void fcoe_ctlr_send_keep_alive(struct fcoe_ctlr *fip, int ports, u8 *sa)
 	kal->fip.fip_op = htons(FIP_OP_CTRL);
 	kal->fip.fip_subcode = FIP_SC_KEEP_ALIVE;
 	kal->fip.fip_dl_len = htons((sizeof(kal->mac) +
-				    ports * sizeof(*vn)) / FIP_BPW);
+				     ports * sizeof(*vn)) / FIP_BPW);
 	kal->fip.fip_flags = htons(FIP_FL_FPMA);
 	if (fip->spma)
 		kal->fip.fip_flags |= htons(FIP_FL_SPMA);
@@ -374,16 +374,14 @@ static void fcoe_ctlr_send_keep_alive(struct fcoe_ctlr *fip, int ports, u8 *sa)
 	kal->mac.fd_desc.fip_dtype = FIP_DT_MAC;
 	kal->mac.fd_desc.fip_dlen = sizeof(kal->mac) / FIP_BPW;
 	memcpy(kal->mac.fd_mac, fip->ctl_src_addr, ETH_ALEN);
-
 	if (ports) {
 		vn = (struct fip_vn_desc *)(kal + 1);
 		vn->fd_desc.fip_dtype = FIP_DT_VN_ID;
 		vn->fd_desc.fip_dlen = sizeof(*vn) / FIP_BPW;
-		memcpy(vn->fd_mac, fip->data_src_addr, ETH_ALEN);
+		memcpy(vn->fd_mac, fip->get_src_addr(lport), ETH_ALEN);
 		hton24(vn->fd_fc_id, fc_host_port_id(lp->host));
 		put_unaligned_be64(lp->wwpn, &vn->fd_wwpn);
 	}
-
 	skb_put(skb, len);
 	skb->protocol = htons(ETH_P_FIP);
 	skb_reset_mac_header(skb);
@@ -392,10 +390,10 @@ static void fcoe_ctlr_send_keep_alive(struct fcoe_ctlr *fip, int ports, u8 *sa)
 }
 
 /**
- * fcoe_ctlr_encaps() - Encapsulate an ELS frame for FIP, without sending it.
- * @fip:	FCoE controller.
- * @dtype:	FIP descriptor type for the frame.
- * @skb:	FCoE ELS frame including FC header but no FCoE headers.
+ * fcoe_ctlr_encaps() - Encapsulate an ELS frame for FIP, without sending it
+ * @fip:   The FCoE controller for the ELS frame
+ * @dtype: The FIP descriptor type for the frame
+ * @skb:   The FCoE ELS frame including FC header but no FCoE headers
  *
  * Returns non-zero error code on failure.
  *
@@ -405,7 +403,7 @@ static void fcoe_ctlr_send_keep_alive(struct fcoe_ctlr *fip, int ports, u8 *sa)
  * Headroom includes the FIP encapsulation description, FIP header, and
  * Ethernet header.  The tailroom is for the FIP MAC descriptor.
  */
-static int fcoe_ctlr_encaps(struct fcoe_ctlr *fip,
+static int fcoe_ctlr_encaps(struct fcoe_ctlr *fip, struct fc_lport *lport,
 			    u8 dtype, struct sk_buff *skb)
 {
 	struct fip_encaps_head {
@@ -449,8 +447,8 @@ static int fcoe_ctlr_encaps(struct fcoe_ctlr *fip,
 	memset(mac, 0, sizeof(mac));
 	mac->fd_desc.fip_dtype = FIP_DT_MAC;
 	mac->fd_desc.fip_dlen = sizeof(*mac) / FIP_BPW;
-	if (dtype != FIP_DT_FLOGI)
-		memcpy(mac->fd_mac, fip->data_src_addr, ETH_ALEN);
+	if (dtype != FIP_DT_FLOGI && dtype != FIP_DT_FDISC)
+		memcpy(mac->fd_mac, fip->get_src_addr(lport), ETH_ALEN);
 	else if (fip->spma)
 		memcpy(mac->fd_mac, fip->ctl_src_addr, ETH_ALEN);
 
@@ -463,6 +461,7 @@ static int fcoe_ctlr_encaps(struct fcoe_ctlr *fip,
 /**
  * fcoe_ctlr_els_send() - Send an ELS frame encapsulated by FIP if appropriate.
  * @fip:	FCoE controller.
+ * @lport:	libfc fc_lport to send from
  * @skb:	FCoE ELS frame including FC header but no FCoE headers.
  *
  * Returns a non-zero error code if the frame should not be sent.
@@ -471,11 +470,13 @@ static int fcoe_ctlr_encaps(struct fcoe_ctlr *fip,
  * The caller must check that the length is a multiple of 4.
  * The SKB must have enough headroom (28 bytes) and tailroom (8 bytes).
  */
-int fcoe_ctlr_els_send(struct fcoe_ctlr *fip, struct sk_buff *skb)
+int fcoe_ctlr_els_send(struct fcoe_ctlr *fip, struct fc_lport *lport,
+		       struct sk_buff *skb)
 {
 	struct fc_frame_header *fh;
 	u16 old_xid;
 	u8 op;
+	u8 mac[ETH_ALEN];
 
 	fh = (struct fc_frame_header *)skb->data;
 	op = *(u8 *)(fh + 1);
@@ -498,6 +499,8 @@ int fcoe_ctlr_els_send(struct fcoe_ctlr *fip, struct sk_buff *skb)
 
 	if (fip->state == FIP_ST_NON_FIP)
 		return 0;
+	if (!fip->sel_fcf)
+		goto drop;
 
 	switch (op) {
 	case ELS_FLOGI:
@@ -530,14 +533,15 @@ int fcoe_ctlr_els_send(struct fcoe_ctlr *fip, struct sk_buff *skb)
 		 * FLOGI.
 		 */
 		fip->flogi_oxid = FC_XID_UNKNOWN;
-		fc_fcoe_set_mac(fip->data_src_addr, fh->fh_s_id);
+		fc_fcoe_set_mac(mac, fh->fh_d_id);
+		fip->update_mac(lport, mac);
 		return 0;
 	default:
 		if (fip->state != FIP_ST_ENABLED)
 			goto drop;
 		return 0;
 	}
-	if (fcoe_ctlr_encaps(fip, op, skb))
+	if (fcoe_ctlr_encaps(fip, lport, op, skb))
 		goto drop;
 	fip->send(fip, skb);
 	return -EINPROGRESS;
@@ -547,9 +551,9 @@ drop:
 }
 EXPORT_SYMBOL(fcoe_ctlr_els_send);
 
-/*
- * fcoe_ctlr_age_fcfs() - Reset and free all old FCFs for a controller.
- * @fip:	FCoE controller.
+/**
+ * fcoe_ctlr_age_fcfs() - Reset and free all old FCFs for a controller
+ * @fip: The FCoE controller to free FCFs on
  *
  * Called with lock held.
  *
@@ -558,14 +562,28 @@ EXPORT_SYMBOL(fcoe_ctlr_els_send);
  * times its keep-alive period including fuzz.
  *
  * In addition, determine the time when an FCF selection can occur.
+ *
+ * Also, increment the MissDiscAdvCount when no advertisement is received
+ * for the corresponding FCF for 1.5 * FKA_ADV_PERIOD (FC-BB-5 LESB).
  */
 static void fcoe_ctlr_age_fcfs(struct fcoe_ctlr *fip)
 {
 	struct fcoe_fcf *fcf;
 	struct fcoe_fcf *next;
 	unsigned long sel_time = 0;
+	unsigned long mda_time = 0;
 
 	list_for_each_entry_safe(fcf, next, &fip->fcfs, list) {
+		mda_time = fcf->fka_period + (fcf->fka_period >> 1);
+		if ((fip->sel_fcf == fcf) &&
+		    (time_after(jiffies, fcf->time + mda_time))) {
+			mod_timer(&fip->timer, jiffies + mda_time);
+			fc_lport_get_stats(fip->lp)->MissDiscAdvCount++;
+			printk(KERN_INFO "libfcoe: host%d: Missing Discovery "
+			       "Advertisement for fab %llx count %lld\n",
+			       fip->lp->host->host_no, fcf->fabric_name,
+			       fc_lport_get_stats(fip->lp)->MissDiscAdvCount);
+		}
 		if (time_after(jiffies, fcf->time + fcf->fka_period * 3 +
 			       msecs_to_jiffies(FIP_FCF_FUZZ * 3))) {
 			if (fip->sel_fcf == fcf)
@@ -574,6 +592,7 @@ static void fcoe_ctlr_age_fcfs(struct fcoe_ctlr *fip)
 			WARN_ON(!fip->fcf_count);
 			fip->fcf_count--;
 			kfree(fcf);
+			fc_lport_get_stats(fip->lp)->VLinkFailureCount++;
 		} else if (fcoe_ctlr_mtu_valid(fcf) &&
 			   (!sel_time || time_before(sel_time, fcf->time))) {
 			sel_time = fcf->time;
@@ -590,14 +609,16 @@ static void fcoe_ctlr_age_fcfs(struct fcoe_ctlr *fip)
 }
 
 /**
- * fcoe_ctlr_parse_adv() - Decode a FIP advertisement into a new FCF entry.
- * @skb:	received FIP advertisement frame
- * @fcf:	resulting FCF entry.
+ * fcoe_ctlr_parse_adv() - Decode a FIP advertisement into a new FCF entry
+ * @fip: The FCoE controller receiving the advertisement
+ * @skb: The received FIP advertisement frame
+ * @fcf: The resulting FCF entry
  *
  * Returns zero on a valid parsed advertisement,
  * otherwise returns non zero value.
  */
-static int fcoe_ctlr_parse_adv(struct sk_buff *skb, struct fcoe_fcf *fcf)
+static int fcoe_ctlr_parse_adv(struct fcoe_ctlr *fip,
+			       struct sk_buff *skb, struct fcoe_fcf *fcf)
 {
 	struct fip_header *fiph;
 	struct fip_desc *desc = NULL;
@@ -636,7 +657,7 @@ static int fcoe_ctlr_parse_adv(struct sk_buff *skb, struct fcoe_fcf *fcf)
 			       ((struct fip_mac_desc *)desc)->fd_mac,
 			       ETH_ALEN);
 			if (!is_valid_ether_addr(fcf->fcf_mac)) {
-				LIBFCOE_FIP_DBG("Invalid MAC address "
+				LIBFCOE_FIP_DBG(fip, "Invalid MAC address "
 						"in FIP adv\n");
 				return -EINVAL;
 			}
@@ -659,6 +680,8 @@ static int fcoe_ctlr_parse_adv(struct sk_buff *skb, struct fcoe_fcf *fcf)
 			if (dlen != sizeof(struct fip_fka_desc))
 				goto len_err;
 			fka = (struct fip_fka_desc *)desc;
+			if (fka->fd_flags & FIP_FKA_ADV_D)
+				fcf->fd_flags = 1;
 			t = ntohl(fka->fd_fka_period);
 			if (t >= FCOE_CTLR_MIN_FKA)
 				fcf->fka_period = msecs_to_jiffies(t);
@@ -670,7 +693,7 @@ static int fcoe_ctlr_parse_adv(struct sk_buff *skb, struct fcoe_fcf *fcf)
 		case FIP_DT_LOGO:
 		case FIP_DT_ELP:
 		default:
-			LIBFCOE_FIP_DBG("unexpected descriptor type %x "
+			LIBFCOE_FIP_DBG(fip, "unexpected descriptor type %x "
 					"in FIP adv\n", desc->fip_dtype);
 			/* standard says ignore unknown descriptors >= 128 */
 			if (desc->fip_dtype < FIP_DT_VENDOR_BASE)
@@ -687,15 +710,15 @@ static int fcoe_ctlr_parse_adv(struct sk_buff *skb, struct fcoe_fcf *fcf)
 	return 0;
 
 len_err:
-	LIBFCOE_FIP_DBG("FIP length error in descriptor type %x len %zu\n",
+	LIBFCOE_FIP_DBG(fip, "FIP length error in descriptor type %x len %zu\n",
 			desc->fip_dtype, dlen);
 	return -EINVAL;
 }
 
 /**
- * fcoe_ctlr_recv_adv() - Handle an incoming advertisement.
- * @fip:	FCoE controller.
- * @skb:	Received FIP packet.
+ * fcoe_ctlr_recv_adv() - Handle an incoming advertisement
+ * @fip: The FCoE controller receiving the advertisement
+ * @skb: The received FIP packet
  */
 static void fcoe_ctlr_recv_adv(struct fcoe_ctlr *fip, struct sk_buff *skb)
 {
@@ -706,7 +729,7 @@ static void fcoe_ctlr_recv_adv(struct fcoe_ctlr *fip, struct sk_buff *skb)
 	int first = 0;
 	int mtu_valid;
 
-	if (fcoe_ctlr_parse_adv(skb, &new))
+	if (fcoe_ctlr_parse_adv(fip, skb, &new))
 		return;
 
 	spin_lock_bh(&fip->lock);
@@ -752,7 +775,7 @@ static void fcoe_ctlr_recv_adv(struct fcoe_ctlr *fip, struct sk_buff *skb)
 	mtu_valid = fcoe_ctlr_mtu_valid(fcf);
 	fcf->time = jiffies;
 	if (!found) {
-		LIBFCOE_FIP_DBG("New FCF for fab %llx map %x val %d\n",
+		LIBFCOE_FIP_DBG(fip, "New FCF for fab %llx map %x val %d\n",
 				fcf->fabric_name, fcf->fc_map, mtu_valid);
 	}
 
@@ -778,7 +801,7 @@ static void fcoe_ctlr_recv_adv(struct fcoe_ctlr *fip, struct sk_buff *skb)
 	 */
 	if (mtu_valid && !fip->sel_time && fcoe_ctlr_fcf_usable(fcf)) {
 		fip->sel_time = jiffies +
-				msecs_to_jiffies(FCOE_CTLR_START_DELAY);
+			msecs_to_jiffies(FCOE_CTLR_START_DELAY);
 		if (!timer_pending(&fip->timer) ||
 		    time_before(fip->sel_time, fip->timer.expires))
 			mod_timer(&fip->timer, fip->sel_time);
@@ -788,15 +811,15 @@ out:
 }
 
 /**
- * fcoe_ctlr_recv_els() - Handle an incoming FIP-encapsulated ELS frame.
- * @fip:	FCoE controller.
- * @skb:	Received FIP packet.
+ * fcoe_ctlr_recv_els() - Handle an incoming FIP encapsulated ELS frame
+ * @fip: The FCoE controller which received the packet
+ * @skb: The received FIP packet
  */
 static void fcoe_ctlr_recv_els(struct fcoe_ctlr *fip, struct sk_buff *skb)
 {
-	struct fc_lport *lp = fip->lp;
+	struct fc_lport *lport = fip->lp;
 	struct fip_header *fiph;
-	struct fc_frame *fp;
+	struct fc_frame *fp = (struct fc_frame *)skb;
 	struct fc_frame_header *fh = NULL;
 	struct fip_desc *desc;
 	struct fip_encaps *els;
@@ -831,10 +854,11 @@ static void fcoe_ctlr_recv_els(struct fcoe_ctlr *fip, struct sk_buff *skb)
 			       ((struct fip_mac_desc *)desc)->fd_mac,
 			       ETH_ALEN);
 			if (!is_valid_ether_addr(granted_mac)) {
-				LIBFCOE_FIP_DBG("Invalid MAC address "
+				LIBFCOE_FIP_DBG(fip, "Invalid MAC address "
 						"in FIP ELS\n");
 				goto drop;
 			}
+			memcpy(fr_cb(fp)->granted_mac, granted_mac, ETH_ALEN);
 			break;
 		case FIP_DT_FLOGI:
 		case FIP_DT_FDISC:
@@ -850,7 +874,7 @@ static void fcoe_ctlr_recv_els(struct fcoe_ctlr *fip, struct sk_buff *skb)
 			els_dtype = desc->fip_dtype;
 			break;
 		default:
-			LIBFCOE_FIP_DBG("unexpected descriptor type %x "
+			LIBFCOE_FIP_DBG(fip, "unexpected descriptor type %x "
 					"in FIP adv\n", desc->fip_dtype);
 			/* standard says ignore unknown descriptors >= 128 */
 			if (desc->fip_dtype < FIP_DT_VENDOR_BASE)
@@ -867,11 +891,8 @@ static void fcoe_ctlr_recv_els(struct fcoe_ctlr *fip, struct sk_buff *skb)
 
 	if (els_dtype == FIP_DT_FLOGI && sub == FIP_SC_REP &&
 	    fip->flogi_oxid == ntohs(fh->fh_ox_id) &&
-	    els_op == ELS_LS_ACC && is_valid_ether_addr(granted_mac)) {
+	    els_op == ELS_LS_ACC && is_valid_ether_addr(granted_mac))
 		fip->flogi_oxid = FC_XID_UNKNOWN;
-		fip->update_mac(fip, fip->data_src_addr, granted_mac);
-		memcpy(fip->data_src_addr, granted_mac, ETH_ALEN);
-	}
 
 	/*
 	 * Convert skb into an fc_frame containing only the ELS.
@@ -882,32 +903,32 @@ static void fcoe_ctlr_recv_els(struct fcoe_ctlr *fip, struct sk_buff *skb)
 	fc_frame_init(fp);
 	fr_sof(fp) = FC_SOF_I3;
 	fr_eof(fp) = FC_EOF_T;
-	fr_dev(fp) = lp;
+	fr_dev(fp) = lport;
 
-	stats = fc_lport_get_stats(lp);
+	stats = fc_lport_get_stats(lport);
 	stats->RxFrames++;
 	stats->RxWords += skb->len / FIP_BPW;
 
-	fc_exch_recv(lp, fp);
+	fc_exch_recv(lport, fp);
 	return;
 
 len_err:
-	LIBFCOE_FIP_DBG("FIP length error in descriptor type %x len %zu\n",
+	LIBFCOE_FIP_DBG(fip, "FIP length error in descriptor type %x len %zu\n",
 			desc->fip_dtype, dlen);
 drop:
 	kfree_skb(skb);
 }
 
 /**
- * fcoe_ctlr_recv_els() - Handle an incoming link reset frame.
- * @fip:	FCoE controller.
- * @fh:		Received FIP header.
+ * fcoe_ctlr_recv_els() - Handle an incoming link reset frame
+ * @fip: The FCoE controller that received the frame
+ * @fh:	 The received FIP header
  *
  * There may be multiple VN_Port descriptors.
  * The overall length has already been checked.
  */
 static void fcoe_ctlr_recv_clr_vlink(struct fcoe_ctlr *fip,
-				      struct fip_header *fh)
+				     struct fip_header *fh)
 {
 	struct fip_desc *desc;
 	struct fip_mac_desc *mp;
@@ -916,13 +937,13 @@ static void fcoe_ctlr_recv_clr_vlink(struct fcoe_ctlr *fip,
 	size_t rlen;
 	size_t dlen;
 	struct fcoe_fcf *fcf = fip->sel_fcf;
-	struct fc_lport *lp = fip->lp;
+	struct fc_lport *lport = fip->lp;
 	u32	desc_mask;
 
-	LIBFCOE_FIP_DBG("Clear Virtual Link received\n");
+	LIBFCOE_FIP_DBG(fip, "Clear Virtual Link received\n");
 	if (!fcf)
 		return;
-	if (!fcf || !fc_host_port_id(lp->host))
+	if (!fcf || !fc_host_port_id(lport->host))
 		return;
 
 	/*
@@ -958,9 +979,10 @@ static void fcoe_ctlr_recv_clr_vlink(struct fcoe_ctlr *fip,
 			if (dlen < sizeof(*vp))
 				return;
 			if (compare_ether_addr(vp->fd_mac,
-			    fip->data_src_addr) == 0 &&
-			    get_unaligned_be64(&vp->fd_wwpn) == lp->wwpn &&
-			    ntoh24(vp->fd_fc_id) == fc_host_port_id(lp->host))
+					       fip->get_src_addr(lport)) == 0 &&
+			    get_unaligned_be64(&vp->fd_wwpn) == lport->wwpn &&
+			    ntoh24(vp->fd_fc_id) ==
+			    fc_host_port_id(lport->host))
 				desc_mask &= ~BIT(FIP_DT_VN_ID);
 			break;
 		default:
@@ -977,33 +999,39 @@ static void fcoe_ctlr_recv_clr_vlink(struct fcoe_ctlr *fip,
 	 * reset only if all required descriptors were present and valid.
 	 */
 	if (desc_mask) {
-		LIBFCOE_FIP_DBG("missing descriptors mask %x\n", desc_mask);
+		LIBFCOE_FIP_DBG(fip, "missing descriptors mask %x\n",
+				desc_mask);
 	} else {
-		LIBFCOE_FIP_DBG("performing Clear Virtual Link\n");
-		fcoe_ctlr_reset(fip, FIP_ST_ENABLED);
+		LIBFCOE_FIP_DBG(fip, "performing Clear Virtual Link\n");
+
+		spin_lock_bh(&fip->lock);
+		fc_lport_get_stats(lport)->VLinkFailureCount++;
+		fcoe_ctlr_reset(fip);
+		spin_unlock_bh(&fip->lock);
+
+		fc_lport_reset(fip->lp);
+		fcoe_ctlr_solicit(fip, NULL);
 	}
 }
 
 /**
- * fcoe_ctlr_recv() - Receive a FIP frame.
- * @fip:	FCoE controller.
- * @skb:	Received FIP packet.
+ * fcoe_ctlr_recv() - Receive a FIP packet
+ * @fip: The FCoE controller that received the packet
+ * @skb: The received FIP packet
  *
- * This is called from NET_RX_SOFTIRQ.
+ * This may be called from either NET_RX_SOFTIRQ or IRQ.
  */
 void fcoe_ctlr_recv(struct fcoe_ctlr *fip, struct sk_buff *skb)
 {
-	spin_lock_bh(&fip->fip_recv_list.lock);
-	__skb_queue_tail(&fip->fip_recv_list, skb);
-	spin_unlock_bh(&fip->fip_recv_list.lock);
+	skb_queue_tail(&fip->fip_recv_list, skb);
 	schedule_work(&fip->recv_work);
 }
 EXPORT_SYMBOL(fcoe_ctlr_recv);
 
 /**
- * fcoe_ctlr_recv_handler() - Receive a FIP frame.
- * @fip:	FCoE controller.
- * @skb:	Received FIP packet.
+ * fcoe_ctlr_recv_handler() - Receive a FIP frame
+ * @fip: The FCoE controller that received the frame
+ * @skb: The received FIP frame
  *
  * Returns non-zero if the frame is dropped.
  */
@@ -1038,7 +1066,7 @@ static int fcoe_ctlr_recv_handler(struct fcoe_ctlr *fip, struct sk_buff *skb)
 		fip->map_dest = 0;
 		fip->state = FIP_ST_ENABLED;
 		state = FIP_ST_ENABLED;
-		LIBFCOE_FIP_DBG("Using FIP mode\n");
+		LIBFCOE_FIP_DBG(fip, "Using FIP mode\n");
 	}
 	spin_unlock_bh(&fip->lock);
 	if (state != FIP_ST_ENABLED)
@@ -1060,8 +1088,8 @@ drop:
 }
 
 /**
- * fcoe_ctlr_select() - Select the best FCF, if possible.
- * @fip:	FCoE controller.
+ * fcoe_ctlr_select() - Select the best FCF (if possible)
+ * @fip: The FCoE controller
  *
  * If there are conflicting advertisements, no FCF can be chosen.
  *
@@ -1073,11 +1101,11 @@ static void fcoe_ctlr_select(struct fcoe_ctlr *fip)
 	struct fcoe_fcf *best = NULL;
 
 	list_for_each_entry(fcf, &fip->fcfs, list) {
-		LIBFCOE_FIP_DBG("consider FCF for fab %llx VFID %d map %x "
+		LIBFCOE_FIP_DBG(fip, "consider FCF for fab %llx VFID %d map %x "
 				"val %d\n", fcf->fabric_name, fcf->vfid,
 				fcf->fc_map, fcoe_ctlr_mtu_valid(fcf));
 		if (!fcoe_ctlr_fcf_usable(fcf)) {
-			LIBFCOE_FIP_DBG("FCF for fab %llx map %x %svalid "
+			LIBFCOE_FIP_DBG(fip, "FCF for fab %llx map %x %svalid "
 					"%savailable\n", fcf->fabric_name,
 					fcf->fc_map, (fcf->flags & FIP_FL_SOL)
 					? "" : "in", (fcf->flags & FIP_FL_AVAIL)
@@ -1091,7 +1119,7 @@ static void fcoe_ctlr_select(struct fcoe_ctlr *fip)
 		if (fcf->fabric_name != best->fabric_name ||
 		    fcf->vfid != best->vfid ||
 		    fcf->fc_map != best->fc_map) {
-			LIBFCOE_FIP_DBG("Conflicting fabric, VFID, "
+			LIBFCOE_FIP_DBG(fip, "Conflicting fabric, VFID, "
 					"or FC-MAP\n");
 			return;
 		}
@@ -1102,8 +1130,8 @@ static void fcoe_ctlr_select(struct fcoe_ctlr *fip)
 }
 
 /**
- * fcoe_ctlr_timeout() - FIP timer function.
- * @arg:	&fcoe_ctlr pointer.
+ * fcoe_ctlr_timeout() - FIP timeout handler
+ * @arg: The FCoE controller that timed out
  *
  * Ages FCFs.  Triggers FCF selection if possible.  Sends keep-alives.
  */
@@ -1113,8 +1141,6 @@ static void fcoe_ctlr_timeout(unsigned long arg)
 	struct fcoe_fcf *sel;
 	struct fcoe_fcf *fcf;
 	unsigned long next_timer = jiffies + msecs_to_jiffies(FIP_VN_KA_PERIOD);
-	u8 send_ctlr_ka;
-	u8 send_port_ka;
 
 	spin_lock_bh(&fip->lock);
 	if (fip->state == FIP_ST_DISABLED) {
@@ -1140,53 +1166,47 @@ static void fcoe_ctlr_timeout(unsigned long arg)
 			       fip->lp->host->host_no, sel->fcf_mac);
 			memcpy(fip->dest_addr, sel->fcf_mac, ETH_ALEN);
 			fip->port_ka_time = jiffies +
-					    msecs_to_jiffies(FIP_VN_KA_PERIOD);
+				msecs_to_jiffies(FIP_VN_KA_PERIOD);
 			fip->ctlr_ka_time = jiffies + sel->fka_period;
-			fip->link = 1;
 		} else {
 			printk(KERN_NOTICE "libfcoe: host%d: "
-			       "FIP Fibre-Channel Forwarder timed out.  "
+			       "FIP Fibre-Channel Forwarder timed out.	"
 			       "Starting FCF discovery.\n",
 			       fip->lp->host->host_no);
-			fip->link = 0;
+			fip->reset_req = 1;
+			schedule_work(&fip->link_work);
 		}
-		schedule_work(&fip->link_work);
 	}
 
-	send_ctlr_ka = 0;
-	send_port_ka = 0;
-	if (sel) {
+	if (sel && !sel->fd_flags) {
 		if (time_after_eq(jiffies, fip->ctlr_ka_time)) {
 			fip->ctlr_ka_time = jiffies + sel->fka_period;
-			send_ctlr_ka = 1;
+			fip->send_ctlr_ka = 1;
 		}
 		if (time_after(next_timer, fip->ctlr_ka_time))
 			next_timer = fip->ctlr_ka_time;
 
 		if (time_after_eq(jiffies, fip->port_ka_time)) {
 			fip->port_ka_time += jiffies +
-					msecs_to_jiffies(FIP_VN_KA_PERIOD);
-			send_port_ka = 1;
+				msecs_to_jiffies(FIP_VN_KA_PERIOD);
+			fip->send_port_ka = 1;
 		}
 		if (time_after(next_timer, fip->port_ka_time))
 			next_timer = fip->port_ka_time;
 		mod_timer(&fip->timer, next_timer);
 	} else if (fip->sel_time) {
 		next_timer = fip->sel_time +
-				msecs_to_jiffies(FCOE_CTLR_START_DELAY);
+			msecs_to_jiffies(FCOE_CTLR_START_DELAY);
 		mod_timer(&fip->timer, next_timer);
 	}
+	if (fip->send_ctlr_ka || fip->send_port_ka)
+		schedule_work(&fip->link_work);
 	spin_unlock_bh(&fip->lock);
-
-	if (send_ctlr_ka)
-		fcoe_ctlr_send_keep_alive(fip, 0, fip->ctl_src_addr);
-	if (send_port_ka)
-		fcoe_ctlr_send_keep_alive(fip, 1, fip->data_src_addr);
 }
 
 /**
- * fcoe_ctlr_link_work() - worker thread function for link changes.
- * @work:	pointer to link_work member inside &fcoe_ctlr.
+ * fcoe_ctlr_link_work() - Worker thread function for link changes
+ * @work: Handle to a FCoE controller
  *
  * See if the link status has changed and if so, report it.
  *
@@ -1196,27 +1216,49 @@ static void fcoe_ctlr_timeout(unsigned long arg)
 static void fcoe_ctlr_link_work(struct work_struct *work)
 {
 	struct fcoe_ctlr *fip;
+	struct fc_lport *vport;
+	u8 *mac;
 	int link;
 	int last_link;
+	int reset;
 
 	fip = container_of(work, struct fcoe_ctlr, link_work);
 	spin_lock_bh(&fip->lock);
 	last_link = fip->last_link;
 	link = fip->link;
 	fip->last_link = link;
+	reset = fip->reset_req;
+	fip->reset_req = 0;
 	spin_unlock_bh(&fip->lock);
 
 	if (last_link != link) {
 		if (link)
 			fc_linkup(fip->lp);
 		else
-			fcoe_ctlr_reset(fip, FIP_ST_LINK_WAIT);
+			fc_linkdown(fip->lp);
+	} else if (reset && link)
+		fc_lport_reset(fip->lp);
+
+	if (fip->send_ctlr_ka) {
+		fip->send_ctlr_ka = 0;
+		fcoe_ctlr_send_keep_alive(fip, NULL, 0, fip->ctl_src_addr);
+	}
+	if (fip->send_port_ka) {
+		fip->send_port_ka = 0;
+		mutex_lock(&fip->lp->lp_mutex);
+		mac = fip->get_src_addr(fip->lp);
+		fcoe_ctlr_send_keep_alive(fip, fip->lp, 1, mac);
+		list_for_each_entry(vport, &fip->lp->vports, list) {
+			mac = fip->get_src_addr(vport);
+			fcoe_ctlr_send_keep_alive(fip, vport, 1, mac);
+		}
+		mutex_unlock(&fip->lp->lp_mutex);
 	}
 }
 
 /**
- * fcoe_ctlr_recv_work() - Worker thread function for receiving FIP frames.
- * @recv_work:	pointer to recv_work member inside &fcoe_ctlr.
+ * fcoe_ctlr_recv_work() - Worker thread function for receiving FIP frames
+ * @recv_work: Handle to a FCoE controller
  */
 static void fcoe_ctlr_recv_work(struct work_struct *recv_work)
 {
@@ -1224,20 +1266,14 @@ static void fcoe_ctlr_recv_work(struct work_struct *recv_work)
 	struct sk_buff *skb;
 
 	fip = container_of(recv_work, struct fcoe_ctlr, recv_work);
-	spin_lock_bh(&fip->fip_recv_list.lock);
-	while ((skb = __skb_dequeue(&fip->fip_recv_list))) {
-		spin_unlock_bh(&fip->fip_recv_list.lock);
+	while ((skb = skb_dequeue(&fip->fip_recv_list)))
 		fcoe_ctlr_recv_handler(fip, skb);
-		spin_lock_bh(&fip->fip_recv_list.lock);
-	}
-	spin_unlock_bh(&fip->fip_recv_list.lock);
 }
 
 /**
- * fcoe_ctlr_recv_flogi() - snoop Pre-FIP receipt of FLOGI response or request.
- * @fip:	FCoE controller.
- * @fp:		FC frame.
- * @sa:		Ethernet source MAC address from received FCoE frame.
+ * fcoe_ctlr_recv_flogi() - Snoop pre-FIP receipt of FLOGI response
+ * @fip: The FCoE controller
+ * @fp:	 The FC frame to snoop
  *
  * Snoop potential response to FLOGI or even incoming FLOGI.
  *
@@ -1245,15 +1281,18 @@ static void fcoe_ctlr_recv_work(struct work_struct *recv_work)
  * by fip->flogi_oxid != FC_XID_UNKNOWN.
  *
  * The caller is responsible for freeing the frame.
+ * Fill in the granted_mac address.
  *
  * Return non-zero if the frame should not be delivered to libfc.
  */
-int fcoe_ctlr_recv_flogi(struct fcoe_ctlr *fip, struct fc_frame *fp, u8 *sa)
+int fcoe_ctlr_recv_flogi(struct fcoe_ctlr *fip, struct fc_lport *lport,
+			 struct fc_frame *fp)
 {
 	struct fc_frame_header *fh;
 	u8 op;
-	u8 mac[ETH_ALEN];
+	u8 *sa;
 
+	sa = eth_hdr(&fp->skb)->h_source;
 	fh = fc_frame_header_get(fp);
 	if (fh->fh_type != FC_TYPE_ELS)
 		return 0;
@@ -1268,7 +1307,8 @@ int fcoe_ctlr_recv_flogi(struct fcoe_ctlr *fip, struct fc_frame *fp, u8 *sa)
 			return -EINVAL;
 		}
 		fip->state = FIP_ST_NON_FIP;
-		LIBFCOE_FIP_DBG("received FLOGI LS_ACC using non-FIP mode\n");
+		LIBFCOE_FIP_DBG(fip,
+				"received FLOGI LS_ACC using non-FIP mode\n");
 
 		/*
 		 * FLOGI accepted.
@@ -1283,11 +1323,8 @@ int fcoe_ctlr_recv_flogi(struct fcoe_ctlr *fip, struct fc_frame *fp, u8 *sa)
 			fip->map_dest = 0;
 		}
 		fip->flogi_oxid = FC_XID_UNKNOWN;
-		memcpy(mac, fip->data_src_addr, ETH_ALEN);
-		fc_fcoe_set_mac(fip->data_src_addr, fh->fh_d_id);
 		spin_unlock_bh(&fip->lock);
-
-		fip->update_mac(fip, mac, fip->data_src_addr);
+		fc_fcoe_set_mac(fr_cb(fp)->granted_mac, fh->fh_d_id);
 	} else if (op == ELS_FLOGI && fh->fh_r_ctl == FC_RCTL_ELS_REQ && sa) {
 		/*
 		 * Save source MAC for point-to-point responses.
@@ -1297,7 +1334,7 @@ int fcoe_ctlr_recv_flogi(struct fcoe_ctlr *fip, struct fc_frame *fp, u8 *sa)
 			memcpy(fip->dest_addr, sa, ETH_ALEN);
 			fip->map_dest = 0;
 			if (fip->state == FIP_ST_NON_FIP)
-				LIBFCOE_FIP_DBG("received FLOGI REQ, "
+				LIBFCOE_FIP_DBG(fip, "received FLOGI REQ, "
 						"using non-FIP mode\n");
 			fip->state = FIP_ST_NON_FIP;
 		}
@@ -1308,10 +1345,10 @@ int fcoe_ctlr_recv_flogi(struct fcoe_ctlr *fip, struct fc_frame *fp, u8 *sa)
 EXPORT_SYMBOL(fcoe_ctlr_recv_flogi);
 
 /**
- * fcoe_wwn_from_mac() - Converts 48-bit IEEE MAC address to 64-bit FC WWN.
- * @mac: mac address
- * @scheme: check port
- * @port: port indicator for converting
+ * fcoe_wwn_from_mac() - Converts a 48-bit IEEE MAC address to a 64-bit FC WWN
+ * @mac:    The MAC address to convert
+ * @scheme: The scheme to use when converting
+ * @port:   The port indicator for converting
  *
  * Returns: u64 fc world wide name
  */
@@ -1349,24 +1386,26 @@ u64 fcoe_wwn_from_mac(unsigned char mac[MAX_ADDR_LEN],
 EXPORT_SYMBOL_GPL(fcoe_wwn_from_mac);
 
 /**
- * fcoe_libfc_config() - sets up libfc related properties for lport
- * @lp: ptr to the fc_lport
- * @tt: libfc function template
+ * fcoe_libfc_config() - Sets up libfc related properties for local port
+ * @lp: The local port to configure libfc for
+ * @tt: The libfc function template
  *
  * Returns : 0 for success
  */
-int fcoe_libfc_config(struct fc_lport *lp, struct libfc_function_template *tt)
+int fcoe_libfc_config(struct fc_lport *lport,
+		      struct libfc_function_template *tt)
 {
 	/* Set the function pointers set by the LLDD */
-	memcpy(&lp->tt, tt, sizeof(*tt));
-	if (fc_fcp_init(lp))
+	memcpy(&lport->tt, tt, sizeof(*tt));
+	if (fc_fcp_init(lport))
 		return -ENOMEM;
-	fc_exch_init(lp);
-	fc_elsct_init(lp);
-	fc_lport_init(lp);
-	fc_rport_init(lp);
-	fc_disc_init(lp);
+	fc_exch_init(lport);
+	fc_elsct_init(lport);
+	fc_lport_init(lport);
+	fc_rport_init(lport);
+	fc_disc_init(lport);
 
 	return 0;
 }
 EXPORT_SYMBOL_GPL(fcoe_libfc_config);
+
diff --git a/drivers/scsi/fnic/fnic.h b/drivers/scsi/fnic/fnic.h
index e4c0a3d7d87b..bb208a6091e7 100644
--- a/drivers/scsi/fnic/fnic.h
+++ b/drivers/scsi/fnic/fnic.h
@@ -22,6 +22,7 @@
 #include <linux/netdevice.h>
 #include <linux/workqueue.h>
 #include <scsi/libfc.h>
+#include <scsi/libfcoe.h>
 #include "fnic_io.h"
 #include "fnic_res.h"
 #include "vnic_dev.h"
@@ -44,7 +45,7 @@
 #define	FNIC_IO_LOCKS		64 /* IO locks: power of 2 */
 #define FNIC_DFLT_QUEUE_DEPTH	32
 #define	FNIC_STATS_RATE_LIMIT	4 /* limit rate at which stats are pulled up */
-
+#define FNIC_MAX_CMD_LEN        16 /* Supported CDB length */
 /*
  * Tag bits used for special requests.
  */
@@ -145,6 +146,7 @@ struct mempool;
 /* Per-instance private data structure */
 struct fnic {
 	struct fc_lport *lport;
+	struct fcoe_ctlr ctlr;		/* FIP FCoE controller structure */
 	struct vnic_dev_bar bar0;
 
 	struct msix_entry msix_entry[FNIC_MSIX_INTR_MAX];
@@ -162,23 +164,16 @@ struct fnic {
 	unsigned int wq_count;
 	unsigned int cq_count;
 
-	u32 fcoui_mode:1;		/* use fcoui address*/
 	u32 vlan_hw_insert:1;	        /* let hw insert the tag */
 	u32 in_remove:1;                /* fnic device in removal */
 	u32 stop_rx_link_events:1;      /* stop proc. rx frames, link events */
 
 	struct completion *remove_wait; /* device remove thread blocks */
 
-	struct fc_frame *flogi;
-	struct fc_frame *flogi_resp;
-	u16 flogi_oxid;
-	unsigned long s_id;
 	enum fnic_state state;
 	spinlock_t fnic_lock;
 
 	u16 vlan_id;	                /* VLAN tag including priority */
-	u8 mac_addr[ETH_ALEN];
-	u8 dest_addr[ETH_ALEN];
 	u8 data_src_addr[ETH_ALEN];
 	u64 fcp_input_bytes;		/* internal statistic */
 	u64 fcp_output_bytes;		/* internal statistic */
@@ -205,6 +200,7 @@ struct fnic {
 	struct work_struct link_work;
 	struct work_struct frame_work;
 	struct sk_buff_head frame_queue;
+	struct sk_buff_head tx_queue;
 
 	/* copy work queue cache line section */
 	____cacheline_aligned struct vnic_wq_copy wq_copy[FNIC_WQ_COPY_MAX];
@@ -224,6 +220,11 @@ struct fnic {
 	____cacheline_aligned struct vnic_intr intr[FNIC_MSIX_INTR_MAX];
 };
 
+static inline struct fnic *fnic_from_ctlr(struct fcoe_ctlr *fip)
+{
+	return container_of(fip, struct fnic, ctlr);
+}
+
 extern struct workqueue_struct *fnic_event_queue;
 extern struct device_attribute *fnic_attrs[];
 
@@ -239,7 +240,11 @@ void fnic_handle_link(struct work_struct *work);
 int fnic_rq_cmpl_handler(struct fnic *fnic, int);
 int fnic_alloc_rq_frame(struct vnic_rq *rq);
 void fnic_free_rq_buf(struct vnic_rq *rq, struct vnic_rq_buf *buf);
-int fnic_send_frame(struct fnic *fnic, struct fc_frame *fp);
+void fnic_flush_tx(struct fnic *);
+void fnic_eth_send(struct fcoe_ctlr *, struct sk_buff *skb);
+void fnic_set_port_id(struct fc_lport *, u32, struct fc_frame *);
+void fnic_update_mac(struct fc_lport *, u8 *new);
+void fnic_update_mac_locked(struct fnic *, u8 *new);
 
 int fnic_queuecommand(struct scsi_cmnd *, void (*done)(struct scsi_cmnd *));
 int fnic_abort_cmd(struct scsi_cmnd *);
@@ -252,7 +257,7 @@ void fnic_empty_scsi_cleanup(struct fc_lport *);
 void fnic_exch_mgr_reset(struct fc_lport *, u32, u32);
 int fnic_wq_copy_cmpl_handler(struct fnic *fnic, int);
 int fnic_wq_cmpl_handler(struct fnic *fnic, int);
-int fnic_flogi_reg_handler(struct fnic *fnic);
+int fnic_flogi_reg_handler(struct fnic *fnic, u32);
 void fnic_wq_copy_cleanup_handler(struct vnic_wq_copy *wq,
 				  struct fcpio_host_req *desc);
 int fnic_fw_reset_handler(struct fnic *fnic);
diff --git a/drivers/scsi/fnic/fnic_fcs.c b/drivers/scsi/fnic/fnic_fcs.c
index 50db3e36a619..54f8d0e5407f 100644
--- a/drivers/scsi/fnic/fnic_fcs.c
+++ b/drivers/scsi/fnic/fnic_fcs.c
@@ -23,6 +23,7 @@
 #include <linux/if_ether.h>
 #include <linux/if_vlan.h>
 #include <linux/workqueue.h>
+#include <scsi/fc/fc_fip.h>
 #include <scsi/fc/fc_els.h>
 #include <scsi/fc/fc_fcoe.h>
 #include <scsi/fc_frame.h>
@@ -34,6 +35,8 @@
 
 struct workqueue_struct *fnic_event_queue;
 
+static void fnic_set_eth_mode(struct fnic *);
+
 void fnic_handle_link(struct work_struct *work)
 {
 	struct fnic *fnic = container_of(work, struct fnic, link_work);
@@ -64,10 +67,10 @@ void fnic_handle_link(struct work_struct *work)
 				spin_unlock_irqrestore(&fnic->fnic_lock, flags);
 				FNIC_FCS_DBG(KERN_DEBUG, fnic->lport->host,
 					     "link down\n");
-				fc_linkdown(fnic->lport);
+				fcoe_ctlr_link_down(&fnic->ctlr);
 				FNIC_FCS_DBG(KERN_DEBUG, fnic->lport->host,
 					     "link up\n");
-				fc_linkup(fnic->lport);
+				fcoe_ctlr_link_up(&fnic->ctlr);
 			} else
 				/* UP -> UP */
 				spin_unlock_irqrestore(&fnic->fnic_lock, flags);
@@ -76,13 +79,13 @@ void fnic_handle_link(struct work_struct *work)
 		/* DOWN -> UP */
 		spin_unlock_irqrestore(&fnic->fnic_lock, flags);
 		FNIC_FCS_DBG(KERN_DEBUG, fnic->lport->host, "link up\n");
-		fc_linkup(fnic->lport);
+		fcoe_ctlr_link_up(&fnic->ctlr);
 	} else {
 		/* UP -> DOWN */
 		fnic->lport->host_stats.link_failure_count++;
 		spin_unlock_irqrestore(&fnic->fnic_lock, flags);
 		FNIC_FCS_DBG(KERN_DEBUG, fnic->lport->host, "link down\n");
-		fc_linkdown(fnic->lport);
+		fcoe_ctlr_link_down(&fnic->ctlr);
 	}
 
 }
@@ -107,197 +110,179 @@ void fnic_handle_frame(struct work_struct *work)
 			return;
 		}
 		fp = (struct fc_frame *)skb;
-		/* if Flogi resp frame, register the address */
-		if (fr_flags(fp)) {
-			vnic_dev_add_addr(fnic->vdev,
-					  fnic->data_src_addr);
-			fr_flags(fp) = 0;
+
+		/*
+		 * If we're in a transitional state, just re-queue and return.
+		 * The queue will be serviced when we get to a stable state.
+		 */
+		if (fnic->state != FNIC_IN_FC_MODE &&
+		    fnic->state != FNIC_IN_ETH_MODE) {
+			skb_queue_head(&fnic->frame_queue, skb);
+			spin_unlock_irqrestore(&fnic->fnic_lock, flags);
+			return;
 		}
 		spin_unlock_irqrestore(&fnic->fnic_lock, flags);
 
 		fc_exch_recv(lp, fp);
 	}
-
-}
-
-static inline void fnic_import_rq_fc_frame(struct sk_buff *skb,
-					   u32 len, u8 sof, u8 eof)
-{
-	struct fc_frame *fp = (struct fc_frame *)skb;
-
-	skb_trim(skb, len);
-	fr_eof(fp) = eof;
-	fr_sof(fp) = sof;
 }
 
-
-static inline int fnic_import_rq_eth_pkt(struct sk_buff *skb, u32 len)
+/**
+ * fnic_import_rq_eth_pkt() - handle received FCoE or FIP frame.
+ * @fnic:	fnic instance.
+ * @skb:	Ethernet Frame.
+ */
+static inline int fnic_import_rq_eth_pkt(struct fnic *fnic, struct sk_buff *skb)
 {
 	struct fc_frame *fp;
 	struct ethhdr *eh;
-	struct vlan_ethhdr *vh;
 	struct fcoe_hdr *fcoe_hdr;
 	struct fcoe_crc_eof *ft;
-	u32    transport_len = 0;
 
+	/*
+	 * Undo VLAN encapsulation if present.
+	 */
 	eh = (struct ethhdr *)skb->data;
-	vh = (struct vlan_ethhdr *)skb->data;
-	if (vh->h_vlan_proto == htons(ETH_P_8021Q) &&
-	    vh->h_vlan_encapsulated_proto == htons(ETH_P_FCOE)) {
-		skb_pull(skb, sizeof(struct vlan_ethhdr));
-		transport_len += sizeof(struct vlan_ethhdr);
-	} else if (eh->h_proto == htons(ETH_P_FCOE)) {
-		transport_len += sizeof(struct ethhdr);
-		skb_pull(skb, sizeof(struct ethhdr));
-	} else
-		return -1;
+	if (eh->h_proto == htons(ETH_P_8021Q)) {
+		memmove((u8 *)eh + VLAN_HLEN, eh, ETH_ALEN * 2);
+		eh = (struct ethhdr *)skb_pull(skb, VLAN_HLEN);
+		skb_reset_mac_header(skb);
+	}
+	if (eh->h_proto == htons(ETH_P_FIP)) {
+		skb_pull(skb, sizeof(*eh));
+		fcoe_ctlr_recv(&fnic->ctlr, skb);
+		return 1;		/* let caller know packet was used */
+	}
+	if (eh->h_proto != htons(ETH_P_FCOE))
+		goto drop;
+	skb_set_network_header(skb, sizeof(*eh));
+	skb_pull(skb, sizeof(*eh));
 
 	fcoe_hdr = (struct fcoe_hdr *)skb->data;
 	if (FC_FCOE_DECAPS_VER(fcoe_hdr) != FC_FCOE_VER)
-		return -1;
+		goto drop;
 
 	fp = (struct fc_frame *)skb;
 	fc_frame_init(fp);
 	fr_sof(fp) = fcoe_hdr->fcoe_sof;
 	skb_pull(skb, sizeof(struct fcoe_hdr));
-	transport_len += sizeof(struct fcoe_hdr);
+	skb_reset_transport_header(skb);
 
-	ft = (struct fcoe_crc_eof *)(skb->data + len -
-				     transport_len - sizeof(*ft));
+	ft = (struct fcoe_crc_eof *)(skb->data + skb->len - sizeof(*ft));
 	fr_eof(fp) = ft->fcoe_eof;
-	skb_trim(skb, len - transport_len - sizeof(*ft));
+	skb_trim(skb, skb->len - sizeof(*ft));
 	return 0;
+drop:
+	dev_kfree_skb_irq(skb);
+	return -1;
 }
 
-static inline int fnic_handle_flogi_resp(struct fnic *fnic,
-					 struct fc_frame *fp)
+/**
+ * fnic_update_mac_locked() - set data MAC address and filters.
+ * @fnic:	fnic instance.
+ * @new:	newly-assigned FCoE MAC address.
+ *
+ * Called with the fnic lock held.
+ */
+void fnic_update_mac_locked(struct fnic *fnic, u8 *new)
 {
-	u8 mac[ETH_ALEN] = FC_FCOE_FLOGI_MAC;
-	struct ethhdr *eth_hdr;
-	struct fc_frame_header *fh;
-	int ret = 0;
-	unsigned long flags;
-	struct fc_frame *old_flogi_resp = NULL;
+	u8 *ctl = fnic->ctlr.ctl_src_addr;
+	u8 *data = fnic->data_src_addr;
 
-	fh = (struct fc_frame_header *)fr_hdr(fp);
+	if (is_zero_ether_addr(new))
+		new = ctl;
+	if (!compare_ether_addr(data, new))
+		return;
+	FNIC_FCS_DBG(KERN_DEBUG, fnic->lport->host, "update_mac %pM\n", new);
+	if (!is_zero_ether_addr(data) && compare_ether_addr(data, ctl))
+		vnic_dev_del_addr(fnic->vdev, data);
+	memcpy(data, new, ETH_ALEN);
+	if (compare_ether_addr(new, ctl))
+		vnic_dev_add_addr(fnic->vdev, new);
+}
 
-	spin_lock_irqsave(&fnic->fnic_lock, flags);
+/**
+ * fnic_update_mac() - set data MAC address and filters.
+ * @lport:	local port.
+ * @new:	newly-assigned FCoE MAC address.
+ */
+void fnic_update_mac(struct fc_lport *lport, u8 *new)
+{
+	struct fnic *fnic = lport_priv(lport);
 
-	if (fnic->state == FNIC_IN_ETH_MODE) {
+	spin_lock_irq(&fnic->fnic_lock);
+	fnic_update_mac_locked(fnic, new);
+	spin_unlock_irq(&fnic->fnic_lock);
+}
 
-		/*
-		 * Check if oxid matches on taking the lock. A new Flogi
-		 * issued by libFC might have changed the fnic cached oxid
-		 */
-		if (fnic->flogi_oxid != ntohs(fh->fh_ox_id)) {
-			FNIC_FCS_DBG(KERN_DEBUG, fnic->lport->host,
-				     "Flogi response oxid not"
-				     " matching cached oxid, dropping frame"
-				     "\n");
-			ret = -1;
-			spin_unlock_irqrestore(&fnic->fnic_lock, flags);
-			dev_kfree_skb_irq(fp_skb(fp));
-			goto handle_flogi_resp_end;
-		}
+/**
+ * fnic_set_port_id() - set the port_ID after successful FLOGI.
+ * @lport:	local port.
+ * @port_id:	assigned FC_ID.
+ * @fp:		received frame containing the FLOGI accept or NULL.
+ *
+ * This is called from libfc when a new FC_ID has been assigned.
+ * This causes us to reset the firmware to FC_MODE and setup the new MAC
+ * address and FC_ID.
+ *
+ * It is also called with FC_ID 0 when we're logged off.
+ *
+ * If the FC_ID is due to point-to-point, fp may be NULL.
+ */
+void fnic_set_port_id(struct fc_lport *lport, u32 port_id, struct fc_frame *fp)
+{
+	struct fnic *fnic = lport_priv(lport);
+	u8 *mac;
+	int ret;
 
-		/* Drop older cached flogi response frame, cache this frame */
-		old_flogi_resp = fnic->flogi_resp;
-		fnic->flogi_resp = fp;
-		fnic->flogi_oxid = FC_XID_UNKNOWN;
+	FNIC_FCS_DBG(KERN_DEBUG, lport->host, "set port_id %x fp %p\n",
+		     port_id, fp);
 
-		/*
-		 * this frame is part of flogi get the src mac addr from this
-		 * frame if the src mac is fcoui based then we mark the
-		 * address mode flag to use fcoui base for dst mac addr
-		 * otherwise we have to store the fcoe gateway addr
-		 */
-		eth_hdr = (struct ethhdr *)skb_mac_header(fp_skb(fp));
-		memcpy(mac, eth_hdr->h_source, ETH_ALEN);
+	/*
+	 * If we're clearing the FC_ID, change to use the ctl_src_addr.
+	 * Set ethernet mode to send FLOGI.
+	 */
+	if (!port_id) {
+		fnic_update_mac(lport, fnic->ctlr.ctl_src_addr);
+		fnic_set_eth_mode(fnic);
+		return;
+	}
 
-		if (ntoh24(mac) == FC_FCOE_OUI)
-			fnic->fcoui_mode = 1;
-		else {
-			fnic->fcoui_mode = 0;
-			memcpy(fnic->dest_addr, mac, ETH_ALEN);
+	if (fp) {
+		mac = fr_cb(fp)->granted_mac;
+		if (is_zero_ether_addr(mac)) {
+			/* non-FIP - FLOGI already accepted - ignore return */
+			fcoe_ctlr_recv_flogi(&fnic->ctlr, lport, fp);
 		}
+		fnic_update_mac(lport, mac);
+	}
 
-		/*
-		 * Except for Flogi frame, all outbound frames from us have the
-		 * Eth Src address as FC_FCOE_OUI"our_sid". Flogi frame uses
-		 * the vnic MAC address as the Eth Src address
-		 */
-		fc_fcoe_set_mac(fnic->data_src_addr, fh->fh_d_id);
-
-		/* We get our s_id from the d_id of the flogi resp frame */
-		fnic->s_id = ntoh24(fh->fh_d_id);
-
-		/* Change state to reflect transition from Eth to FC mode */
+	/* Change state to reflect transition to FC mode */
+	spin_lock_irq(&fnic->fnic_lock);
+	if (fnic->state == FNIC_IN_ETH_MODE || fnic->state == FNIC_IN_FC_MODE)
 		fnic->state = FNIC_IN_ETH_TRANS_FC_MODE;
-
-	} else {
+	else {
 		FNIC_FCS_DBG(KERN_DEBUG, fnic->lport->host,
 			     "Unexpected fnic state %s while"
 			     " processing flogi resp\n",
 			     fnic_state_to_str(fnic->state));
-		ret = -1;
-		spin_unlock_irqrestore(&fnic->fnic_lock, flags);
-		dev_kfree_skb_irq(fp_skb(fp));
-		goto handle_flogi_resp_end;
+		spin_unlock_irq(&fnic->fnic_lock);
+		return;
 	}
-
-	spin_unlock_irqrestore(&fnic->fnic_lock, flags);
-
-	/* Drop older cached frame */
-	if (old_flogi_resp)
-		dev_kfree_skb_irq(fp_skb(old_flogi_resp));
+	spin_unlock_irq(&fnic->fnic_lock);
 
 	/*
-	 * send flogi reg request to firmware, this will put the fnic in
-	 * in FC mode
+	 * Send FLOGI registration to firmware to set up FC mode.
+	 * The new address will be set up when registration completes.
 	 */
-	ret = fnic_flogi_reg_handler(fnic);
+	ret = fnic_flogi_reg_handler(fnic, port_id);
 
 	if (ret < 0) {
-		int free_fp = 1;
-		spin_lock_irqsave(&fnic->fnic_lock, flags);
-		/*
-		 * free the frame is some other thread is not
-		 * pointing to it
-		 */
-		if (fnic->flogi_resp != fp)
-			free_fp = 0;
-		else
-			fnic->flogi_resp = NULL;
-
+		spin_lock_irq(&fnic->fnic_lock);
 		if (fnic->state == FNIC_IN_ETH_TRANS_FC_MODE)
 			fnic->state = FNIC_IN_ETH_MODE;
-		spin_unlock_irqrestore(&fnic->fnic_lock, flags);
-		if (free_fp)
-			dev_kfree_skb_irq(fp_skb(fp));
+		spin_unlock_irq(&fnic->fnic_lock);
 	}
-
- handle_flogi_resp_end:
-	return ret;
-}
-
-/* Returns 1 for a response that matches cached flogi oxid */
-static inline int is_matching_flogi_resp_frame(struct fnic *fnic,
-					       struct fc_frame *fp)
-{
-	struct fc_frame_header *fh;
-	int ret = 0;
-	u32 f_ctl;
-
-	fh = fc_frame_header_get(fp);
-	f_ctl = ntoh24(fh->fh_f_ctl);
-
-	if (fnic->flogi_oxid == ntohs(fh->fh_ox_id) &&
-	    fh->fh_r_ctl == FC_RCTL_ELS_REP &&
-	    (f_ctl & (FC_FC_EX_CTX | FC_FC_SEQ_CTX)) == FC_FC_EX_CTX &&
-	    fh->fh_type == FC_TYPE_ELS)
-		ret = 1;
-
-	return ret;
 }
 
 static void fnic_rq_cmpl_frame_recv(struct vnic_rq *rq, struct cq_desc
@@ -326,6 +311,7 @@ static void fnic_rq_cmpl_frame_recv(struct vnic_rq *rq, struct cq_desc
 	pci_unmap_single(fnic->pdev, buf->dma_addr, buf->len,
 			 PCI_DMA_FROMDEVICE);
 	skb = buf->os_buf;
+	fp = (struct fc_frame *)skb;
 	buf->os_buf = NULL;
 
 	cq_desc_dec(cq_desc, &type, &color, &q_number, &completed_index);
@@ -338,6 +324,9 @@ static void fnic_rq_cmpl_frame_recv(struct vnic_rq *rq, struct cq_desc
 				   &fcoe_enc_error, &fcs_ok, &vlan_stripped,
 				   &vlan);
 		eth_hdrs_stripped = 1;
+		skb_trim(skb, fcp_bytes_written);
+		fr_sof(fp) = sof;
+		fr_eof(fp) = eof;
 
 	} else if (type == CQ_DESC_TYPE_RQ_ENET) {
 		cq_enet_rq_desc_dec((struct cq_enet_rq_desc *)cq_desc,
@@ -352,6 +341,14 @@ static void fnic_rq_cmpl_frame_recv(struct vnic_rq *rq, struct cq_desc
 				    &ipv4_csum_ok, &ipv6, &ipv4,
 				    &ipv4_fragment, &fcs_ok);
 		eth_hdrs_stripped = 0;
+		skb_trim(skb, bytes_written);
+		if (!fcs_ok) {
+			FNIC_FCS_DBG(KERN_DEBUG, fnic->lport->host,
+				     "fcs error.  dropping packet.\n");
+			goto drop;
+		}
+		if (fnic_import_rq_eth_pkt(fnic, skb))
+			return;
 
 	} else {
 		/* wrong CQ type*/
@@ -370,43 +367,11 @@ static void fnic_rq_cmpl_frame_recv(struct vnic_rq *rq, struct cq_desc
 		goto drop;
 	}
 
-	if (eth_hdrs_stripped)
-		fnic_import_rq_fc_frame(skb, fcp_bytes_written, sof, eof);
-	else if (fnic_import_rq_eth_pkt(skb, bytes_written))
-		goto drop;
-
-	fp = (struct fc_frame *)skb;
-
-	/*
-	 * If frame is an ELS response that matches the cached FLOGI OX_ID,
-	 * and is accept, issue flogi_reg_request copy wq request to firmware
-	 * to register the S_ID and determine whether FC_OUI mode or GW mode.
-	 */
-	if (is_matching_flogi_resp_frame(fnic, fp)) {
-		if (!eth_hdrs_stripped) {
-			if (fc_frame_payload_op(fp) == ELS_LS_ACC) {
-				fnic_handle_flogi_resp(fnic, fp);
-				return;
-			}
-			/*
-			 * Recd. Flogi reject. No point registering
-			 * with fw, but forward to libFC
-			 */
-			goto forward;
-		}
-		goto drop;
-	}
-	if (!eth_hdrs_stripped)
-		goto drop;
-
-forward:
 	spin_lock_irqsave(&fnic->fnic_lock, flags);
 	if (fnic->stop_rx_link_events) {
 		spin_unlock_irqrestore(&fnic->fnic_lock, flags);
 		goto drop;
 	}
-	/* Use fr_flags to indicate whether succ. flogi resp or not */
-	fr_flags(fp) = 0;
 	fr_dev(fp) = fnic->lport;
 	spin_unlock_irqrestore(&fnic->fnic_lock, flags);
 
@@ -494,12 +459,49 @@ void fnic_free_rq_buf(struct vnic_rq *rq, struct vnic_rq_buf *buf)
 	buf->os_buf = NULL;
 }
 
-static inline int is_flogi_frame(struct fc_frame_header *fh)
+/**
+ * fnic_eth_send() - Send Ethernet frame.
+ * @fip:	fcoe_ctlr instance.
+ * @skb:	Ethernet Frame, FIP, without VLAN encapsulation.
+ */
+void fnic_eth_send(struct fcoe_ctlr *fip, struct sk_buff *skb)
 {
-	return fh->fh_r_ctl == FC_RCTL_ELS_REQ && *(u8 *)(fh + 1) == ELS_FLOGI;
+	struct fnic *fnic = fnic_from_ctlr(fip);
+	struct vnic_wq *wq = &fnic->wq[0];
+	dma_addr_t pa;
+	struct ethhdr *eth_hdr;
+	struct vlan_ethhdr *vlan_hdr;
+	unsigned long flags;
+
+	if (!fnic->vlan_hw_insert) {
+		eth_hdr = (struct ethhdr *)skb_mac_header(skb);
+		vlan_hdr = (struct vlan_ethhdr *)skb_push(skb,
+				sizeof(*vlan_hdr) - sizeof(*eth_hdr));
+		memcpy(vlan_hdr, eth_hdr, 2 * ETH_ALEN);
+		vlan_hdr->h_vlan_proto = htons(ETH_P_8021Q);
+		vlan_hdr->h_vlan_encapsulated_proto = eth_hdr->h_proto;
+		vlan_hdr->h_vlan_TCI = htons(fnic->vlan_id);
+	}
+
+	pa = pci_map_single(fnic->pdev, skb->data, skb->len, PCI_DMA_TODEVICE);
+
+	spin_lock_irqsave(&fnic->wq_lock[0], flags);
+	if (!vnic_wq_desc_avail(wq)) {
+		pci_unmap_single(fnic->pdev, pa, skb->len, PCI_DMA_TODEVICE);
+		spin_unlock_irqrestore(&fnic->wq_lock[0], flags);
+		kfree_skb(skb);
+		return;
+	}
+
+	fnic_queue_wq_eth_desc(wq, skb, pa, skb->len,
+			       fnic->vlan_hw_insert, fnic->vlan_id, 1);
+	spin_unlock_irqrestore(&fnic->wq_lock[0], flags);
 }
 
-int fnic_send_frame(struct fnic *fnic, struct fc_frame *fp)
+/*
+ * Send FC frame.
+ */
+static int fnic_send_frame(struct fnic *fnic, struct fc_frame *fp)
 {
 	struct vnic_wq *wq = &fnic->wq[0];
 	struct sk_buff *skb;
@@ -515,6 +517,10 @@ int fnic_send_frame(struct fnic *fnic, struct fc_frame *fp)
 	fh = fc_frame_header_get(fp);
 	skb = fp_skb(fp);
 
+	if (unlikely(fh->fh_r_ctl == FC_RCTL_ELS_REQ) &&
+	    fcoe_ctlr_els_send(&fnic->ctlr, fnic->lport, skb))
+		return 0;
+
 	if (!fnic->vlan_hw_insert) {
 		eth_hdr_len = sizeof(*vlan_hdr) + sizeof(*fcoe_hdr);
 		vlan_hdr = (struct vlan_ethhdr *)skb_push(skb, eth_hdr_len);
@@ -530,16 +536,11 @@ int fnic_send_frame(struct fnic *fnic, struct fc_frame *fp)
 		fcoe_hdr = (struct fcoe_hdr *)(eth_hdr + 1);
 	}
 
-	if (is_flogi_frame(fh)) {
+	if (fnic->ctlr.map_dest)
 		fc_fcoe_set_mac(eth_hdr->h_dest, fh->fh_d_id);
-		memcpy(eth_hdr->h_source, fnic->mac_addr, ETH_ALEN);
-	} else {
-		if (fnic->fcoui_mode)
-			fc_fcoe_set_mac(eth_hdr->h_dest, fh->fh_d_id);
-		else
-			memcpy(eth_hdr->h_dest, fnic->dest_addr, ETH_ALEN);
-		memcpy(eth_hdr->h_source, fnic->data_src_addr, ETH_ALEN);
-	}
+	else
+		memcpy(eth_hdr->h_dest, fnic->ctlr.dest_addr, ETH_ALEN);
+	memcpy(eth_hdr->h_source, fnic->data_src_addr, ETH_ALEN);
 
 	tot_len = skb->len;
 	BUG_ON(tot_len % 4);
@@ -578,109 +579,85 @@ fnic_send_frame_end:
 int fnic_send(struct fc_lport *lp, struct fc_frame *fp)
 {
 	struct fnic *fnic = lport_priv(lp);
-	struct fc_frame_header *fh;
-	int ret = 0;
-	enum fnic_state old_state;
 	unsigned long flags;
-	struct fc_frame *old_flogi = NULL;
-	struct fc_frame *old_flogi_resp = NULL;
 
 	if (fnic->in_remove) {
 		dev_kfree_skb(fp_skb(fp));
-		ret = -1;
-		goto fnic_send_end;
+		return -1;
 	}
 
-	fh = fc_frame_header_get(fp);
-	/* if not an Flogi frame, send it out, this is the common case */
-	if (!is_flogi_frame(fh))
-		return fnic_send_frame(fnic, fp);
+	/*
+	 * Queue frame if in a transitional state.
+	 * This occurs while registering the Port_ID / MAC address after FLOGI.
+	 */
+	spin_lock_irqsave(&fnic->fnic_lock, flags);
+	if (fnic->state != FNIC_IN_FC_MODE && fnic->state != FNIC_IN_ETH_MODE) {
+		skb_queue_tail(&fnic->tx_queue, fp_skb(fp));
+		spin_unlock_irqrestore(&fnic->fnic_lock, flags);
+		return 0;
+	}
+	spin_unlock_irqrestore(&fnic->fnic_lock, flags);
 
-	/* Flogi frame, now enter the state machine */
+	return fnic_send_frame(fnic, fp);
+}
 
-	spin_lock_irqsave(&fnic->fnic_lock, flags);
-again:
-	/* Get any old cached frames, free them after dropping lock */
-	old_flogi = fnic->flogi;
-	fnic->flogi = NULL;
-	old_flogi_resp = fnic->flogi_resp;
-	fnic->flogi_resp = NULL;
+/**
+ * fnic_flush_tx() - send queued frames.
+ * @fnic: fnic device
+ *
+ * Send frames that were waiting to go out in FC or Ethernet mode.
+ * Whenever changing modes we purge queued frames, so these frames should
+ * be queued for the stable mode that we're in, either FC or Ethernet.
+ *
+ * Called without fnic_lock held.
+ */
+void fnic_flush_tx(struct fnic *fnic)
+{
+	struct sk_buff *skb;
+	struct fc_frame *fp;
 
-	fnic->flogi_oxid = FC_XID_UNKNOWN;
+	while ((skb = skb_dequeue(&fnic->frame_queue))) {
+		fp = (struct fc_frame *)skb;
+		fnic_send_frame(fnic, fp);
+	}
+}
 
+/**
+ * fnic_set_eth_mode() - put fnic into ethernet mode.
+ * @fnic: fnic device
+ *
+ * Called without fnic lock held.
+ */
+static void fnic_set_eth_mode(struct fnic *fnic)
+{
+	unsigned long flags;
+	enum fnic_state old_state;
+	int ret;
+
+	spin_lock_irqsave(&fnic->fnic_lock, flags);
+again:
 	old_state = fnic->state;
 	switch (old_state) {
 	case FNIC_IN_FC_MODE:
 	case FNIC_IN_ETH_TRANS_FC_MODE:
 	default:
 		fnic->state = FNIC_IN_FC_TRANS_ETH_MODE;
-		vnic_dev_del_addr(fnic->vdev, fnic->data_src_addr);
 		spin_unlock_irqrestore(&fnic->fnic_lock, flags);
 
-		if (old_flogi) {
-			dev_kfree_skb(fp_skb(old_flogi));
-			old_flogi = NULL;
-		}
-		if (old_flogi_resp) {
-			dev_kfree_skb(fp_skb(old_flogi_resp));
-			old_flogi_resp = NULL;
-		}
-
 		ret = fnic_fw_reset_handler(fnic);
 
 		spin_lock_irqsave(&fnic->fnic_lock, flags);
 		if (fnic->state != FNIC_IN_FC_TRANS_ETH_MODE)
 			goto again;
-		if (ret) {
+		if (ret)
 			fnic->state = old_state;
-			spin_unlock_irqrestore(&fnic->fnic_lock, flags);
-			dev_kfree_skb(fp_skb(fp));
-			goto fnic_send_end;
-		}
-		old_flogi = fnic->flogi;
-		fnic->flogi = fp;
-		fnic->flogi_oxid = ntohs(fh->fh_ox_id);
-		old_flogi_resp = fnic->flogi_resp;
-		fnic->flogi_resp = NULL;
-		spin_unlock_irqrestore(&fnic->fnic_lock, flags);
 		break;
 
 	case FNIC_IN_FC_TRANS_ETH_MODE:
-		/*
-		 * A reset is pending with the firmware. Store the flogi
-		 * and its oxid. The transition out of this state happens
-		 * only when Firmware completes the reset, either with
-		 * success or failed. If success, transition to
-		 * FNIC_IN_ETH_MODE, if fail, then transition to
-		 * FNIC_IN_FC_MODE
-		 */
-		fnic->flogi = fp;
-		fnic->flogi_oxid = ntohs(fh->fh_ox_id);
-		spin_unlock_irqrestore(&fnic->fnic_lock, flags);
-		break;
-
 	case FNIC_IN_ETH_MODE:
-		/*
-		 * The fw/hw is already in eth mode. Store the oxid,
-		 * and send the flogi frame out. The transition out of this
-		 * state happens only we receive flogi response from the
-		 * network, and the oxid matches the cached oxid when the
-		 * flogi frame was sent out. If they match, then we issue
-		 * a flogi_reg request and transition to state
-		 * FNIC_IN_ETH_TRANS_FC_MODE
-		 */
-		fnic->flogi_oxid = ntohs(fh->fh_ox_id);
-		spin_unlock_irqrestore(&fnic->fnic_lock, flags);
-		ret = fnic_send_frame(fnic, fp);
 		break;
 	}
-
-fnic_send_end:
-	if (old_flogi)
-		dev_kfree_skb(fp_skb(old_flogi));
-	if (old_flogi_resp)
-		dev_kfree_skb(fp_skb(old_flogi_resp));
-	return ret;
+	spin_unlock_irqrestore(&fnic->fnic_lock, flags);
 }
 
 static void fnic_wq_complete_frame_send(struct vnic_wq *wq,
diff --git a/drivers/scsi/fnic/fnic_isr.c b/drivers/scsi/fnic/fnic_isr.c
index 2b3064828aea..5c1f223cabce 100644
--- a/drivers/scsi/fnic/fnic_isr.c
+++ b/drivers/scsi/fnic/fnic_isr.c
@@ -48,9 +48,9 @@ static irqreturn_t fnic_isr_legacy(int irq, void *data)
 	}
 
 	if (pba & (1 << FNIC_INTX_WQ_RQ_COPYWQ)) {
-		work_done += fnic_wq_copy_cmpl_handler(fnic, 8);
-		work_done += fnic_wq_cmpl_handler(fnic, 4);
-		work_done += fnic_rq_cmpl_handler(fnic, 4);
+		work_done += fnic_wq_copy_cmpl_handler(fnic, -1);
+		work_done += fnic_wq_cmpl_handler(fnic, -1);
+		work_done += fnic_rq_cmpl_handler(fnic, -1);
 
 		vnic_intr_return_credits(&fnic->intr[FNIC_INTX_WQ_RQ_COPYWQ],
 					 work_done,
@@ -66,9 +66,9 @@ static irqreturn_t fnic_isr_msi(int irq, void *data)
 	struct fnic *fnic = data;
 	unsigned long work_done = 0;
 
-	work_done += fnic_wq_copy_cmpl_handler(fnic, 8);
-	work_done += fnic_wq_cmpl_handler(fnic, 4);
-	work_done += fnic_rq_cmpl_handler(fnic, 4);
+	work_done += fnic_wq_copy_cmpl_handler(fnic, -1);
+	work_done += fnic_wq_cmpl_handler(fnic, -1);
+	work_done += fnic_rq_cmpl_handler(fnic, -1);
 
 	vnic_intr_return_credits(&fnic->intr[0],
 				 work_done,
@@ -83,7 +83,7 @@ static irqreturn_t fnic_isr_msix_rq(int irq, void *data)
 	struct fnic *fnic = data;
 	unsigned long rq_work_done = 0;
 
-	rq_work_done = fnic_rq_cmpl_handler(fnic, 4);
+	rq_work_done = fnic_rq_cmpl_handler(fnic, -1);
 	vnic_intr_return_credits(&fnic->intr[FNIC_MSIX_RQ],
 				 rq_work_done,
 				 1 /* unmask intr */,
@@ -97,7 +97,7 @@ static irqreturn_t fnic_isr_msix_wq(int irq, void *data)
 	struct fnic *fnic = data;
 	unsigned long wq_work_done = 0;
 
-	wq_work_done = fnic_wq_cmpl_handler(fnic, 4);
+	wq_work_done = fnic_wq_cmpl_handler(fnic, -1);
 	vnic_intr_return_credits(&fnic->intr[FNIC_MSIX_WQ],
 				 wq_work_done,
 				 1 /* unmask intr */,
@@ -110,7 +110,7 @@ static irqreturn_t fnic_isr_msix_wq_copy(int irq, void *data)
 	struct fnic *fnic = data;
 	unsigned long wq_copy_work_done = 0;
 
-	wq_copy_work_done = fnic_wq_copy_cmpl_handler(fnic, 8);
+	wq_copy_work_done = fnic_wq_copy_cmpl_handler(fnic, -1);
 	vnic_intr_return_credits(&fnic->intr[FNIC_MSIX_WQ_COPY],
 				 wq_copy_work_done,
 				 1 /* unmask intr */,
diff --git a/drivers/scsi/fnic/fnic_main.c b/drivers/scsi/fnic/fnic_main.c
index 71c7bbe26d05..fe1b1031f7ab 100644
--- a/drivers/scsi/fnic/fnic_main.c
+++ b/drivers/scsi/fnic/fnic_main.c
@@ -25,6 +25,8 @@
 #include <linux/interrupt.h>
 #include <linux/spinlock.h>
 #include <linux/workqueue.h>
+#include <linux/if_ether.h>
+#include <scsi/fc/fc_fip.h>
 #include <scsi/scsi_host.h>
 #include <scsi/scsi_transport.h>
 #include <scsi/scsi_transport_fc.h>
@@ -68,6 +70,7 @@ MODULE_PARM_DESC(fnic_log_level, "bit mask of fnic logging levels");
 
 static struct libfc_function_template fnic_transport_template = {
 	.frame_send = fnic_send,
+	.lport_set_port_id = fnic_set_port_id,
 	.fcp_abort_io = fnic_empty_scsi_cleanup,
 	.fcp_cleanup = fnic_empty_scsi_cleanup,
 	.exch_mgr_reset = fnic_exch_mgr_reset
@@ -140,6 +143,7 @@ static struct fc_function_template fnic_fc_functions = {
 	.get_fc_host_stats = fnic_get_stats,
 	.dd_fcrport_size = sizeof(struct fc_rport_libfc_priv),
 	.terminate_rport_io = fnic_terminate_rport_io,
+	.bsg_request = fc_lport_bsg_request,
 };
 
 static void fnic_get_host_speed(struct Scsi_Host *shost)
@@ -324,9 +328,6 @@ static int fnic_cleanup(struct fnic *fnic)
 {
 	unsigned int i;
 	int err;
-	unsigned long flags;
-	struct fc_frame *flogi = NULL;
-	struct fc_frame *flogi_resp = NULL;
 
 	vnic_dev_disable(fnic->vdev);
 	for (i = 0; i < fnic->intr_count; i++)
@@ -367,24 +368,6 @@ static int fnic_cleanup(struct fnic *fnic)
 	for (i = 0; i < fnic->intr_count; i++)
 		vnic_intr_clean(&fnic->intr[i]);
 
-	/*
-	 * Remove cached flogi and flogi resp frames if any
-	 * These frames are not in any queue, and therefore queue
-	 * cleanup does not clean them. So clean them explicitly
-	 */
-	spin_lock_irqsave(&fnic->fnic_lock, flags);
-	flogi = fnic->flogi;
-	fnic->flogi = NULL;
-	flogi_resp = fnic->flogi_resp;
-	fnic->flogi_resp = NULL;
-	spin_unlock_irqrestore(&fnic->fnic_lock, flags);
-
-	if (flogi)
-		dev_kfree_skb(fp_skb(flogi));
-
-	if (flogi_resp)
-		dev_kfree_skb(fp_skb(flogi_resp));
-
 	mempool_destroy(fnic->io_req_pool);
 	for (i = 0; i < FNIC_SGL_NUM_CACHES; i++)
 		mempool_destroy(fnic->io_sgl_pool[i]);
@@ -409,6 +392,17 @@ static void *fnic_alloc_slab_dma(gfp_t gfp_mask, void *pool_data)
 	return kmem_cache_alloc(mem, gfp_mask | GFP_ATOMIC | GFP_DMA);
 }
 
+/**
+ * fnic_get_mac() - get assigned data MAC address for FIP code.
+ * @lport: 	local port.
+ */
+static u8 *fnic_get_mac(struct fc_lport *lport)
+{
+	struct fnic *fnic = lport_priv(lport);
+
+	return fnic->data_src_addr;
+}
+
 static int __devinit fnic_probe(struct pci_dev *pdev,
 				const struct pci_device_id *ent)
 {
@@ -424,17 +418,16 @@ static int __devinit fnic_probe(struct pci_dev *pdev,
 	 * Allocate SCSI Host and set up association between host,
 	 * local port, and fnic
 	 */
-	host = scsi_host_alloc(&fnic_host_template,
-			       sizeof(struct fc_lport) + sizeof(struct fnic));
-	if (!host) {
-		printk(KERN_ERR PFX "Unable to alloc SCSI host\n");
+	lp = libfc_host_alloc(&fnic_host_template, sizeof(struct fnic));
+	if (!lp) {
+		printk(KERN_ERR PFX "Unable to alloc libfc local port\n");
 		err = -ENOMEM;
 		goto err_out;
 	}
-	lp = shost_priv(host);
-	lp->host = host;
+	host = lp->host;
 	fnic = lport_priv(lp);
 	fnic->lport = lp;
+	fnic->ctlr.lp = lp;
 
 	snprintf(fnic->name, sizeof(fnic->name) - 1, "%s%d", DRV_NAME,
 		 host->host_no);
@@ -543,12 +536,14 @@ static int __devinit fnic_probe(struct pci_dev *pdev,
 		goto err_out_dev_close;
 	}
 
-	err = vnic_dev_mac_addr(fnic->vdev, fnic->mac_addr);
+	err = vnic_dev_mac_addr(fnic->vdev, fnic->ctlr.ctl_src_addr);
 	if (err) {
 		shost_printk(KERN_ERR, fnic->lport->host,
 			     "vNIC get MAC addr failed \n");
 		goto err_out_dev_close;
 	}
+	/* set data_src for point-to-point mode and to keep it non-zero */
+	memcpy(fnic->data_src_addr, fnic->ctlr.ctl_src_addr, ETH_ALEN);
 
 	/* Get vNIC configuration */
 	err = fnic_get_vnic_config(fnic);
@@ -560,6 +555,7 @@ static int __devinit fnic_probe(struct pci_dev *pdev,
 	}
 	host->max_lun = fnic->config.luns_per_tgt;
 	host->max_id = FNIC_MAX_FCP_TARGET;
+	host->max_cmd_len = FNIC_MAX_CMD_LEN;
 
 	fnic_get_res_counts(fnic);
 
@@ -571,19 +567,12 @@ static int __devinit fnic_probe(struct pci_dev *pdev,
 		goto err_out_dev_close;
 	}
 
-	err = fnic_request_intr(fnic);
-	if (err) {
-		shost_printk(KERN_ERR, fnic->lport->host,
-			     "Unable to request irq.\n");
-		goto err_out_clear_intr;
-	}
-
 	err = fnic_alloc_vnic_resources(fnic);
 	if (err) {
 		shost_printk(KERN_ERR, fnic->lport->host,
 			     "Failed to alloc vNIC resources, "
 			     "aborting.\n");
-		goto err_out_free_intr;
+		goto err_out_clear_intr;
 	}
 
 
@@ -623,9 +612,21 @@ static int __devinit fnic_probe(struct pci_dev *pdev,
 	fnic->vlan_hw_insert = 1;
 	fnic->vlan_id = 0;
 
-	fnic->flogi_oxid = FC_XID_UNKNOWN;
-	fnic->flogi = NULL;
-	fnic->flogi_resp = NULL;
+	/* Initialize the FIP fcoe_ctrl struct */
+	fnic->ctlr.send = fnic_eth_send;
+	fnic->ctlr.update_mac = fnic_update_mac;
+	fnic->ctlr.get_src_addr = fnic_get_mac;
+	fcoe_ctlr_init(&fnic->ctlr);
+	if (fnic->config.flags & VFCF_FIP_CAPABLE) {
+		shost_printk(KERN_INFO, fnic->lport->host,
+			     "firmware supports FIP\n");
+		vnic_dev_add_addr(fnic->vdev, FIP_ALL_ENODE_MACS);
+		vnic_dev_add_addr(fnic->vdev, fnic->ctlr.ctl_src_addr);
+	} else {
+		shost_printk(KERN_INFO, fnic->lport->host,
+			     "firmware uses non-FIP mode\n");
+		fnic->ctlr.mode = FIP_ST_NON_FIP;
+	}
 	fnic->state = FNIC_IN_FC_MODE;
 
 	/* Enable hardware stripping of vlan header on ingress */
@@ -716,6 +717,7 @@ static int __devinit fnic_probe(struct pci_dev *pdev,
 	INIT_WORK(&fnic->link_work, fnic_handle_link);
 	INIT_WORK(&fnic->frame_work, fnic_handle_frame);
 	skb_queue_head_init(&fnic->frame_queue);
+	skb_queue_head_init(&fnic->tx_queue);
 
 	/* Enable all queues */
 	for (i = 0; i < fnic->raw_wq_count; i++)
@@ -728,6 +730,14 @@ static int __devinit fnic_probe(struct pci_dev *pdev,
 	fc_fabric_login(lp);
 
 	vnic_dev_enable(fnic->vdev);
+
+	err = fnic_request_intr(fnic);
+	if (err) {
+		shost_printk(KERN_ERR, fnic->lport->host,
+			     "Unable to request irq.\n");
+		goto err_out_free_exch_mgr;
+	}
+
 	for (i = 0; i < fnic->intr_count; i++)
 		vnic_intr_unmask(&fnic->intr[i]);
 
@@ -738,8 +748,8 @@ static int __devinit fnic_probe(struct pci_dev *pdev,
 err_out_free_exch_mgr:
 	fc_exch_mgr_free(lp);
 err_out_remove_scsi_host:
-	fc_remove_host(fnic->lport->host);
-	scsi_remove_host(fnic->lport->host);
+	fc_remove_host(lp->host);
+	scsi_remove_host(lp->host);
 err_out_free_rq_buf:
 	for (i = 0; i < fnic->rq_count; i++)
 		vnic_rq_clean(&fnic->rq[i], fnic_free_rq_buf);
@@ -752,8 +762,6 @@ err_out_free_ioreq_pool:
 	mempool_destroy(fnic->io_req_pool);
 err_out_free_resources:
 	fnic_free_vnic_resources(fnic);
-err_out_free_intr:
-	fnic_free_intr(fnic);
 err_out_clear_intr:
 	fnic_clear_intr_mode(fnic);
 err_out_dev_close:
@@ -775,6 +783,7 @@ err_out:
 static void __devexit fnic_remove(struct pci_dev *pdev)
 {
 	struct fnic *fnic = pci_get_drvdata(pdev);
+	struct fc_lport *lp = fnic->lport;
 	unsigned long flags;
 
 	/*
@@ -796,6 +805,7 @@ static void __devexit fnic_remove(struct pci_dev *pdev)
 	 */
 	flush_workqueue(fnic_event_queue);
 	skb_queue_purge(&fnic->frame_queue);
+	skb_queue_purge(&fnic->tx_queue);
 
 	/*
 	 * Log off the fabric. This stops all remote ports, dns port,
@@ -808,7 +818,8 @@ static void __devexit fnic_remove(struct pci_dev *pdev)
 	fnic->in_remove = 1;
 	spin_unlock_irqrestore(&fnic->fnic_lock, flags);
 
-	fc_lport_destroy(fnic->lport);
+	fcoe_ctlr_destroy(&fnic->ctlr);
+	fc_lport_destroy(lp);
 
 	/*
 	 * This stops the fnic device, masks all interrupts. Completed
@@ -818,6 +829,7 @@ static void __devexit fnic_remove(struct pci_dev *pdev)
 	fnic_cleanup(fnic);
 
 	BUG_ON(!skb_queue_empty(&fnic->frame_queue));
+	BUG_ON(!skb_queue_empty(&fnic->tx_queue));
 
 	spin_lock_irqsave(&fnic_list_lock, flags);
 	list_del(&fnic->list);
@@ -827,8 +839,8 @@ static void __devexit fnic_remove(struct pci_dev *pdev)
 	scsi_remove_host(fnic->lport->host);
 	fc_exch_mgr_free(fnic->lport);
 	vnic_dev_notify_unset(fnic->vdev);
-	fnic_free_vnic_resources(fnic);
 	fnic_free_intr(fnic);
+	fnic_free_vnic_resources(fnic);
 	fnic_clear_intr_mode(fnic);
 	vnic_dev_close(fnic->vdev);
 	vnic_dev_unregister(fnic->vdev);
@@ -836,7 +848,7 @@ static void __devexit fnic_remove(struct pci_dev *pdev)
 	pci_release_regions(pdev);
 	pci_disable_device(pdev);
 	pci_set_drvdata(pdev, NULL);
-	scsi_host_put(fnic->lport->host);
+	scsi_host_put(lp->host);
 }
 
 static struct pci_driver fnic_driver = {
diff --git a/drivers/scsi/fnic/fnic_res.c b/drivers/scsi/fnic/fnic_res.c
index 7ba61ec715d2..50488f8e169d 100644
--- a/drivers/scsi/fnic/fnic_res.c
+++ b/drivers/scsi/fnic/fnic_res.c
@@ -144,10 +144,9 @@ int fnic_get_vnic_config(struct fnic *fnic)
 	c->intr_timer_type = c->intr_timer_type;
 
 	shost_printk(KERN_INFO, fnic->lport->host,
-		     "vNIC MAC addr %02x:%02x:%02x:%02x:%02x:%02x "
+		     "vNIC MAC addr %pM "
 		     "wq/wq_copy/rq %d/%d/%d\n",
-		     fnic->mac_addr[0], fnic->mac_addr[1], fnic->mac_addr[2],
-		     fnic->mac_addr[3], fnic->mac_addr[4], fnic->mac_addr[5],
+		     fnic->ctlr.ctl_src_addr,
 		     c->wq_enet_desc_count, c->wq_copy_desc_count,
 		     c->rq_desc_count);
 	shost_printk(KERN_INFO, fnic->lport->host,
diff --git a/drivers/scsi/fnic/fnic_res.h b/drivers/scsi/fnic/fnic_res.h
index b6f310262534..ef8aaf2156dd 100644
--- a/drivers/scsi/fnic/fnic_res.h
+++ b/drivers/scsi/fnic/fnic_res.h
@@ -51,6 +51,31 @@ static inline void fnic_queue_wq_desc(struct vnic_wq *wq,
 	vnic_wq_post(wq, os_buf, dma_addr, len, sop, eop);
 }
 
+static inline void fnic_queue_wq_eth_desc(struct vnic_wq *wq,
+				      void *os_buf, dma_addr_t dma_addr,
+				      unsigned int len,
+				      int vlan_tag_insert,
+				      unsigned int vlan_tag,
+				      int cq_entry)
+{
+	struct wq_enet_desc *desc = vnic_wq_next_desc(wq);
+
+	wq_enet_desc_enc(desc,
+			 (u64)dma_addr | VNIC_PADDR_TARGET,
+			 (u16)len,
+			 0, /* mss_or_csum_offset */
+			 0, /* fc_eof */
+			 0, /* offload_mode */
+			 1, /* eop */
+			 (u8)cq_entry,
+			 0, /* fcoe_encap */
+			 (u8)vlan_tag_insert,
+			 (u16)vlan_tag,
+			 0 /* loopback */);
+
+	vnic_wq_post(wq, os_buf, dma_addr, len, 1, 1);
+}
+
 static inline void fnic_queue_wq_copy_desc_icmnd_16(struct vnic_wq_copy *wq,
 						    u32 req_id,
 						    u32 lunmap_id, u8 spl_flags,
@@ -58,6 +83,7 @@ static inline void fnic_queue_wq_copy_desc_icmnd_16(struct vnic_wq_copy *wq,
 						    u64 sgl_addr, u64 sns_addr,
 						    u8 crn, u8 pri_ta,
 						    u8 flags, u8 *scsi_cdb,
+						    u8 cdb_len,
 						    u32 data_len, u8 *lun,
 						    u32 d_id, u16 mss,
 						    u32 ratov, u32 edtov)
@@ -82,7 +108,8 @@ static inline void fnic_queue_wq_copy_desc_icmnd_16(struct vnic_wq_copy *wq,
 	desc->u.icmnd_16.pri_ta = pri_ta; 	/* SCSI Pri & Task attribute */
 	desc->u.icmnd_16._resvd1 = 0;           /* reserved: should be 0 */
 	desc->u.icmnd_16.flags = flags;         /* command flags */
-	memcpy(desc->u.icmnd_16.scsi_cdb, scsi_cdb, CDB_16);    /* SCSI CDB */
+	memset(desc->u.icmnd_16.scsi_cdb, 0, CDB_16);
+	memcpy(desc->u.icmnd_16.scsi_cdb, scsi_cdb, cdb_len);    /* SCSI CDB */
 	desc->u.icmnd_16.data_len = data_len;   /* length of data expected */
 	memcpy(desc->u.icmnd_16.lun, lun, LUN_ADDRESS);  /* LUN address */
 	desc->u.icmnd_16._resvd2 = 0;          	/* reserved */
@@ -132,12 +159,37 @@ static inline void fnic_queue_wq_copy_desc_flogi_reg(struct vnic_wq_copy *wq,
 	desc->hdr.tag.u.req_id = req_id;      /* id for this request */
 
 	desc->u.flogi_reg.format = format;
+	desc->u.flogi_reg._resvd = 0;
 	hton24(desc->u.flogi_reg.s_id, s_id);
 	memcpy(desc->u.flogi_reg.gateway_mac, gw_mac, ETH_ALEN);
 
 	vnic_wq_copy_post(wq);
 }
 
+static inline void fnic_queue_wq_copy_desc_fip_reg(struct vnic_wq_copy *wq,
+						   u32 req_id, u32 s_id,
+						   u8 *fcf_mac, u8 *ha_mac,
+						   u32 r_a_tov, u32 e_d_tov)
+{
+	struct fcpio_host_req *desc = vnic_wq_copy_next_desc(wq);
+
+	desc->hdr.type = FCPIO_FLOGI_FIP_REG; /* enum fcpio_type */
+	desc->hdr.status = 0;                 /* header status entry */
+	desc->hdr._resvd = 0;                 /* reserved */
+	desc->hdr.tag.u.req_id = req_id;      /* id for this request */
+
+	desc->u.flogi_fip_reg._resvd0 = 0;
+	hton24(desc->u.flogi_fip_reg.s_id, s_id);
+	memcpy(desc->u.flogi_fip_reg.fcf_mac, fcf_mac, ETH_ALEN);
+	desc->u.flogi_fip_reg._resvd1 = 0;
+	desc->u.flogi_fip_reg.r_a_tov = r_a_tov;
+	desc->u.flogi_fip_reg.e_d_tov = e_d_tov;
+	memcpy(desc->u.flogi_fip_reg.ha_mac, ha_mac, ETH_ALEN);
+	desc->u.flogi_fip_reg._resvd2 = 0;
+
+	vnic_wq_copy_post(wq);
+}
+
 static inline void fnic_queue_wq_copy_desc_fw_reset(struct vnic_wq_copy *wq,
 						    u32 req_id)
 {
diff --git a/drivers/scsi/fnic/fnic_scsi.c b/drivers/scsi/fnic/fnic_scsi.c
index bfc996971b81..65a39b0f6dc2 100644
--- a/drivers/scsi/fnic/fnic_scsi.c
+++ b/drivers/scsi/fnic/fnic_scsi.c
@@ -174,6 +174,9 @@ int fnic_fw_reset_handler(struct fnic *fnic)
 	int ret = 0;
 	unsigned long flags;
 
+	skb_queue_purge(&fnic->frame_queue);
+	skb_queue_purge(&fnic->tx_queue);
+
 	spin_lock_irqsave(&fnic->wq_copy_lock[0], flags);
 
 	if (vnic_wq_copy_desc_avail(wq) <= fnic->wq_copy_desc_low[0])
@@ -200,9 +203,11 @@ int fnic_fw_reset_handler(struct fnic *fnic)
  * fnic_flogi_reg_handler
  * Routine to send flogi register msg to fw
  */
-int fnic_flogi_reg_handler(struct fnic *fnic)
+int fnic_flogi_reg_handler(struct fnic *fnic, u32 fc_id)
 {
 	struct vnic_wq_copy *wq = &fnic->wq_copy[0];
+	enum fcpio_flogi_reg_format_type format;
+	struct fc_lport *lp = fnic->lport;
 	u8 gw_mac[ETH_ALEN];
 	int ret = 0;
 	unsigned long flags;
@@ -217,23 +222,32 @@ int fnic_flogi_reg_handler(struct fnic *fnic)
 		goto flogi_reg_ioreq_end;
 	}
 
-	if (fnic->fcoui_mode)
+	if (fnic->ctlr.map_dest) {
 		memset(gw_mac, 0xff, ETH_ALEN);
-	else
-		memcpy(gw_mac, fnic->dest_addr, ETH_ALEN);
+		format = FCPIO_FLOGI_REG_DEF_DEST;
+	} else {
+		memcpy(gw_mac, fnic->ctlr.dest_addr, ETH_ALEN);
+		format = FCPIO_FLOGI_REG_GW_DEST;
+	}
 
-	fnic_queue_wq_copy_desc_flogi_reg(wq, SCSI_NO_TAG,
-					  FCPIO_FLOGI_REG_GW_DEST,
-					  fnic->s_id,
-					  gw_mac);
+	if ((fnic->config.flags & VFCF_FIP_CAPABLE) && !fnic->ctlr.map_dest) {
+		fnic_queue_wq_copy_desc_fip_reg(wq, SCSI_NO_TAG,
+						fc_id, gw_mac,
+						fnic->data_src_addr,
+						lp->r_a_tov, lp->e_d_tov);
+		FNIC_SCSI_DBG(KERN_DEBUG, fnic->lport->host,
+			      "FLOGI FIP reg issued fcid %x src %pM dest %pM\n",
+			      fc_id, fnic->data_src_addr, gw_mac);
+	} else {
+		fnic_queue_wq_copy_desc_flogi_reg(wq, SCSI_NO_TAG,
+						  format, fc_id, gw_mac);
+		FNIC_SCSI_DBG(KERN_DEBUG, fnic->lport->host,
+			      "FLOGI reg issued fcid %x map %d dest %pM\n",
+			      fc_id, fnic->ctlr.map_dest, gw_mac);
+	}
 
 flogi_reg_ioreq_end:
 	spin_unlock_irqrestore(&fnic->wq_copy_lock[0], flags);
-
-	if (!ret)
-		FNIC_SCSI_DBG(KERN_DEBUG, fnic->lport->host,
-			      "flog reg issued\n");
-
 	return ret;
 }
 
@@ -319,7 +333,8 @@ static inline int fnic_queue_wq_copy_desc(struct fnic *fnic,
 					 0, /* scsi cmd ref, always 0 */
 					 pri_tag, /* scsi pri and tag */
 					 flags,	/* command flags */
-					 sc->cmnd, scsi_bufflen(sc),
+					 sc->cmnd, sc->cmd_len,
+					 scsi_bufflen(sc),
 					 fc_lun.scsi_lun, io_req->port_id,
 					 rport->maxframe_size, rp->r_a_tov,
 					 rp->e_d_tov);
@@ -452,7 +467,6 @@ static int fnic_fcpio_fw_reset_cmpl_handler(struct fnic *fnic,
 	u8 hdr_status;
 	struct fcpio_tag tag;
 	int ret = 0;
-	struct fc_frame *flogi;
 	unsigned long flags;
 
 	fcpio_header_dec(&desc->hdr, &type, &hdr_status, &tag);
@@ -462,9 +476,6 @@ static int fnic_fcpio_fw_reset_cmpl_handler(struct fnic *fnic,
 
 	spin_lock_irqsave(&fnic->fnic_lock, flags);
 
-	flogi = fnic->flogi;
-	fnic->flogi = NULL;
-
 	/* fnic should be in FC_TRANS_ETH_MODE */
 	if (fnic->state == FNIC_IN_FC_TRANS_ETH_MODE) {
 		/* Check status of reset completion */
@@ -505,17 +516,14 @@ static int fnic_fcpio_fw_reset_cmpl_handler(struct fnic *fnic,
 	 * free the flogi frame. Else, send it out
 	 */
 	if (fnic->remove_wait || ret) {
-		fnic->flogi_oxid = FC_XID_UNKNOWN;
 		spin_unlock_irqrestore(&fnic->fnic_lock, flags);
-		if (flogi)
-			dev_kfree_skb_irq(fp_skb(flogi));
+		skb_queue_purge(&fnic->tx_queue);
 		goto reset_cmpl_handler_end;
 	}
 
 	spin_unlock_irqrestore(&fnic->fnic_lock, flags);
 
-	if (flogi)
-		ret = fnic_send_frame(fnic, flogi);
+	fnic_flush_tx(fnic);
 
  reset_cmpl_handler_end:
 	return ret;
@@ -532,18 +540,13 @@ static int fnic_fcpio_flogi_reg_cmpl_handler(struct fnic *fnic,
 	u8 hdr_status;
 	struct fcpio_tag tag;
 	int ret = 0;
-	struct fc_frame *flogi_resp = NULL;
 	unsigned long flags;
-	struct sk_buff *skb;
 
 	fcpio_header_dec(&desc->hdr, &type, &hdr_status, &tag);
 
 	/* Update fnic state based on status of flogi reg completion */
 	spin_lock_irqsave(&fnic->fnic_lock, flags);
 
-	flogi_resp = fnic->flogi_resp;
-	fnic->flogi_resp = NULL;
-
 	if (fnic->state == FNIC_IN_ETH_TRANS_FC_MODE) {
 
 		/* Check flogi registration completion status */
@@ -567,25 +570,17 @@ static int fnic_fcpio_flogi_reg_cmpl_handler(struct fnic *fnic,
 		ret = -1;
 	}
 
-	/* Successful flogi reg cmpl, pass frame to LibFC */
-	if (!ret && flogi_resp) {
+	if (!ret) {
 		if (fnic->stop_rx_link_events) {
 			spin_unlock_irqrestore(&fnic->fnic_lock, flags);
 			goto reg_cmpl_handler_end;
 		}
-		skb = (struct sk_buff *)flogi_resp;
-		/* Use fr_flags to indicate whether flogi resp or not */
-		fr_flags(flogi_resp) = 1;
-		fr_dev(flogi_resp) = fnic->lport;
 		spin_unlock_irqrestore(&fnic->fnic_lock, flags);
 
-		skb_queue_tail(&fnic->frame_queue, skb);
+		fnic_flush_tx(fnic);
 		queue_work(fnic_event_queue, &fnic->frame_work);
-
 	} else {
 		spin_unlock_irqrestore(&fnic->fnic_lock, flags);
-		if (flogi_resp)
-			dev_kfree_skb_irq(fp_skb(flogi_resp));
 	}
 
 reg_cmpl_handler_end:
@@ -907,6 +902,7 @@ static int fnic_fcpio_cmpl_handler(struct vnic_dev *vdev,
 		break;
 
 	case FCPIO_FLOGI_REG_CMPL: /* fw completed flogi_reg */
+	case FCPIO_FLOGI_FIP_REG_CMPL: /* fw completed flogi_fip_reg */
 		ret = fnic_fcpio_flogi_reg_cmpl_handler(fnic, desc);
 		break;
 
@@ -1224,22 +1220,6 @@ void fnic_terminate_rport_io(struct fc_rport *rport)
 
 }
 
-static void fnic_block_error_handler(struct scsi_cmnd *sc)
-{
-	struct Scsi_Host *shost = sc->device->host;
-	struct fc_rport *rport = starget_to_rport(scsi_target(sc->device));
-	unsigned long flags;
-
-	spin_lock_irqsave(shost->host_lock, flags);
-	while (rport->port_state == FC_PORTSTATE_BLOCKED) {
-		spin_unlock_irqrestore(shost->host_lock, flags);
-		msleep(1000);
-		spin_lock_irqsave(shost->host_lock, flags);
-	}
-	spin_unlock_irqrestore(shost->host_lock, flags);
-
-}
-
 /*
  * This function is exported to SCSI for sending abort cmnds.
  * A SCSI IO is represented by a io_req in the driver.
@@ -1259,7 +1239,7 @@ int fnic_abort_cmd(struct scsi_cmnd *sc)
 	DECLARE_COMPLETION_ONSTACK(tm_done);
 
 	/* Wait for rport to unblock */
-	fnic_block_error_handler(sc);
+	fc_block_scsi_eh(sc);
 
 	/* Get local-port, check ready and link up */
 	lp = shost_priv(sc->device->host);
@@ -1541,7 +1521,7 @@ int fnic_device_reset(struct scsi_cmnd *sc)
 	DECLARE_COMPLETION_ONSTACK(tm_done);
 
 	/* Wait for rport to unblock */
-	fnic_block_error_handler(sc);
+	fc_block_scsi_eh(sc);
 
 	/* Get local-port, check ready and link up */
 	lp = shost_priv(sc->device->host);
@@ -1762,7 +1742,7 @@ void fnic_scsi_abort_io(struct fc_lport *lp)
 	fnic->remove_wait = &remove_wait;
 	old_state = fnic->state;
 	fnic->state = FNIC_IN_FC_TRANS_ETH_MODE;
-	vnic_dev_del_addr(fnic->vdev, fnic->data_src_addr);
+	fnic_update_mac_locked(fnic, fnic->ctlr.ctl_src_addr);
 	spin_unlock_irqrestore(&fnic->fnic_lock, flags);
 
 	err = fnic_fw_reset_handler(fnic);
@@ -1802,7 +1782,7 @@ void fnic_scsi_cleanup(struct fc_lport *lp)
 	spin_lock_irqsave(&fnic->fnic_lock, flags);
 	old_state = fnic->state;
 	fnic->state = FNIC_IN_FC_TRANS_ETH_MODE;
-	vnic_dev_del_addr(fnic->vdev, fnic->data_src_addr);
+	fnic_update_mac_locked(fnic, fnic->ctlr.ctl_src_addr);
 	spin_unlock_irqrestore(&fnic->fnic_lock, flags);
 
 	if (fnic_fw_reset_handler(fnic)) {
diff --git a/drivers/scsi/fnic/vnic_scsi.h b/drivers/scsi/fnic/vnic_scsi.h
index 46baa5254001..fbb55364e272 100644
--- a/drivers/scsi/fnic/vnic_scsi.h
+++ b/drivers/scsi/fnic/vnic_scsi.h
@@ -95,5 +95,6 @@ struct vnic_fc_config {
 
 #define VFCF_FCP_SEQ_LVL_ERR	0x1	/* Enable FCP-2 Error Recovery */
 #define VFCF_PERBI		0x2	/* persistent binding info available */
+#define VFCF_FIP_CAPABLE	0x4	/* firmware can handle FIP */
 
 #endif /* _VNIC_SCSI_H_ */
diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
index c968cc31cd86..554626e18062 100644
--- a/drivers/scsi/hosts.c
+++ b/drivers/scsi/hosts.c
@@ -180,14 +180,20 @@ void scsi_remove_host(struct Scsi_Host *shost)
 EXPORT_SYMBOL(scsi_remove_host);
 
 /**
- * scsi_add_host - add a scsi host
+ * scsi_add_host_with_dma - add a scsi host with dma device
  * @shost:	scsi host pointer to add
  * @dev:	a struct device of type scsi class
+ * @dma_dev:	dma device for the host
+ *
+ * Note: You rarely need to worry about this unless you're in a
+ * virtualised host environments, so use the simpler scsi_add_host()
+ * function instead.
  *
  * Return value: 
  * 	0 on success / != 0 for error
  **/
-int scsi_add_host(struct Scsi_Host *shost, struct device *dev)
+int scsi_add_host_with_dma(struct Scsi_Host *shost, struct device *dev,
+			   struct device *dma_dev)
 {
 	struct scsi_host_template *sht = shost->hostt;
 	int error = -EINVAL;
@@ -207,6 +213,7 @@ int scsi_add_host(struct Scsi_Host *shost, struct device *dev)
 
 	if (!shost->shost_gendev.parent)
 		shost->shost_gendev.parent = dev ? dev : &platform_bus;
+	shost->dma_dev = dma_dev;
 
 	error = device_add(&shost->shost_gendev);
 	if (error)
@@ -262,7 +269,7 @@ int scsi_add_host(struct Scsi_Host *shost, struct device *dev)
  fail:
 	return error;
 }
-EXPORT_SYMBOL(scsi_add_host);
+EXPORT_SYMBOL(scsi_add_host_with_dma);
 
 static void scsi_host_dev_release(struct device *dev)
 {
diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
new file mode 100644
index 000000000000..bb96fdd58e23
--- /dev/null
+++ b/drivers/scsi/hpsa.c
@@ -0,0 +1,3531 @@
+/*
+ *    Disk Array driver for HP Smart Array SAS controllers
+ *    Copyright 2000, 2009 Hewlett-Packard Development Company, L.P.
+ *
+ *    This program is free software; you can redistribute it and/or modify
+ *    it under the terms of the GNU General Public License as published by
+ *    the Free Software Foundation; version 2 of the License.
+ *
+ *    This program is distributed in the hope that it will be useful,
+ *    but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *    MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ *    NON INFRINGEMENT.  See the GNU General Public License for more details.
+ *
+ *    You should have received a copy of the GNU General Public License
+ *    along with this program; if not, write to the Free Software
+ *    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ *
+ *    Questions/Comments/Bugfixes to iss_storagedev@hp.com
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/interrupt.h>
+#include <linux/types.h>
+#include <linux/pci.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/delay.h>
+#include <linux/fs.h>
+#include <linux/timer.h>
+#include <linux/seq_file.h>
+#include <linux/init.h>
+#include <linux/spinlock.h>
+#include <linux/smp_lock.h>
+#include <linux/compat.h>
+#include <linux/blktrace_api.h>
+#include <linux/uaccess.h>
+#include <linux/io.h>
+#include <linux/dma-mapping.h>
+#include <linux/completion.h>
+#include <linux/moduleparam.h>
+#include <scsi/scsi.h>
+#include <scsi/scsi_cmnd.h>
+#include <scsi/scsi_device.h>
+#include <scsi/scsi_host.h>
+#include <linux/cciss_ioctl.h>
+#include <linux/string.h>
+#include <linux/bitmap.h>
+#include <asm/atomic.h>
+#include <linux/kthread.h>
+#include "hpsa_cmd.h"
+#include "hpsa.h"
+
+/* HPSA_DRIVER_VERSION must be 3 byte values (0-255) separated by '.' */
+#define HPSA_DRIVER_VERSION "1.0.0"
+#define DRIVER_NAME "HP HPSA Driver (v " HPSA_DRIVER_VERSION ")"
+
+/* How long to wait (in milliseconds) for board to go into simple mode */
+#define MAX_CONFIG_WAIT 30000
+#define MAX_IOCTL_CONFIG_WAIT 1000
+
+/*define how many times we will try a command because of bus resets */
+#define MAX_CMD_RETRIES 3
+
+/* Embedded module documentation macros - see modules.h */
+MODULE_AUTHOR("Hewlett-Packard Company");
+MODULE_DESCRIPTION("Driver for HP Smart Array Controller version " \
+	HPSA_DRIVER_VERSION);
+MODULE_SUPPORTED_DEVICE("HP Smart Array Controllers");
+MODULE_VERSION(HPSA_DRIVER_VERSION);
+MODULE_LICENSE("GPL");
+
+static int hpsa_allow_any;
+module_param(hpsa_allow_any, int, S_IRUGO|S_IWUSR);
+MODULE_PARM_DESC(hpsa_allow_any,
+		"Allow hpsa driver to access unknown HP Smart Array hardware");
+
+/* define the PCI info for the cards we can control */
+static const struct pci_device_id hpsa_pci_device_id[] = {
+	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSC,     0x103C, 0x3223},
+	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSC,     0x103C, 0x3234},
+	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSC,     0x103C, 0x323D},
+	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x3241},
+	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x3243},
+	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x3245},
+	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x3247},
+	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x3249},
+	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x324a},
+	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x324b},
+	{PCI_VENDOR_ID_HP,     PCI_ANY_ID,             PCI_ANY_ID, PCI_ANY_ID,
+		PCI_CLASS_STORAGE_RAID << 8, 0xffff << 8, 0},
+	{0,}
+};
+
+MODULE_DEVICE_TABLE(pci, hpsa_pci_device_id);
+
+/*  board_id = Subsystem Device ID & Vendor ID
+ *  product = Marketing Name for the board
+ *  access = Address of the struct of function pointers
+ */
+static struct board_type products[] = {
+	{0x3223103C, "Smart Array P800", &SA5_access},
+	{0x3234103C, "Smart Array P400", &SA5_access},
+	{0x323d103c, "Smart Array P700M", &SA5_access},
+	{0x3241103C, "Smart Array P212", &SA5_access},
+	{0x3243103C, "Smart Array P410", &SA5_access},
+	{0x3245103C, "Smart Array P410i", &SA5_access},
+	{0x3247103C, "Smart Array P411", &SA5_access},
+	{0x3249103C, "Smart Array P812", &SA5_access},
+	{0x324a103C, "Smart Array P712m", &SA5_access},
+	{0x324b103C, "Smart Array P711m", &SA5_access},
+	{0xFFFF103C, "Unknown Smart Array", &SA5_access},
+};
+
+static int number_of_controllers;
+
+static irqreturn_t do_hpsa_intr(int irq, void *dev_id);
+static int hpsa_ioctl(struct scsi_device *dev, int cmd, void *arg);
+static void start_io(struct ctlr_info *h);
+
+#ifdef CONFIG_COMPAT
+static int hpsa_compat_ioctl(struct scsi_device *dev, int cmd, void *arg);
+#endif
+
+static void cmd_free(struct ctlr_info *h, struct CommandList *c);
+static void cmd_special_free(struct ctlr_info *h, struct CommandList *c);
+static struct CommandList *cmd_alloc(struct ctlr_info *h);
+static struct CommandList *cmd_special_alloc(struct ctlr_info *h);
+static void fill_cmd(struct CommandList *c, __u8 cmd, struct ctlr_info *h,
+	void *buff, size_t size, __u8 page_code, unsigned char *scsi3addr,
+	int cmd_type);
+
+static int hpsa_scsi_queue_command(struct scsi_cmnd *cmd,
+		void (*done)(struct scsi_cmnd *));
+
+static int hpsa_eh_device_reset_handler(struct scsi_cmnd *scsicmd);
+static int hpsa_slave_alloc(struct scsi_device *sdev);
+static void hpsa_slave_destroy(struct scsi_device *sdev);
+
+static ssize_t raid_level_show(struct device *dev,
+	struct device_attribute *attr, char *buf);
+static ssize_t lunid_show(struct device *dev,
+	struct device_attribute *attr, char *buf);
+static ssize_t unique_id_show(struct device *dev,
+	struct device_attribute *attr, char *buf);
+static void hpsa_update_scsi_devices(struct ctlr_info *h, int hostno);
+static ssize_t host_store_rescan(struct device *dev,
+	 struct device_attribute *attr, const char *buf, size_t count);
+static int check_for_unit_attention(struct ctlr_info *h,
+	struct CommandList *c);
+static void check_ioctl_unit_attention(struct ctlr_info *h,
+	struct CommandList *c);
+
+static DEVICE_ATTR(raid_level, S_IRUGO, raid_level_show, NULL);
+static DEVICE_ATTR(lunid, S_IRUGO, lunid_show, NULL);
+static DEVICE_ATTR(unique_id, S_IRUGO, unique_id_show, NULL);
+static DEVICE_ATTR(rescan, S_IWUSR, NULL, host_store_rescan);
+
+static struct device_attribute *hpsa_sdev_attrs[] = {
+	&dev_attr_raid_level,
+	&dev_attr_lunid,
+	&dev_attr_unique_id,
+	NULL,
+};
+
+static struct device_attribute *hpsa_shost_attrs[] = {
+	&dev_attr_rescan,
+	NULL,
+};
+
+static struct scsi_host_template hpsa_driver_template = {
+	.module			= THIS_MODULE,
+	.name			= "hpsa",
+	.proc_name		= "hpsa",
+	.queuecommand		= hpsa_scsi_queue_command,
+	.can_queue		= 512,
+	.this_id		= -1,
+	.sg_tablesize		= MAXSGENTRIES,
+	.cmd_per_lun		= 512,
+	.use_clustering		= ENABLE_CLUSTERING,
+	.eh_device_reset_handler = hpsa_eh_device_reset_handler,
+	.ioctl			= hpsa_ioctl,
+	.slave_alloc		= hpsa_slave_alloc,
+	.slave_destroy		= hpsa_slave_destroy,
+#ifdef CONFIG_COMPAT
+	.compat_ioctl		= hpsa_compat_ioctl,
+#endif
+	.sdev_attrs = hpsa_sdev_attrs,
+	.shost_attrs = hpsa_shost_attrs,
+};
+
+static inline struct ctlr_info *sdev_to_hba(struct scsi_device *sdev)
+{
+	unsigned long *priv = shost_priv(sdev->host);
+	return (struct ctlr_info *) *priv;
+}
+
+static struct task_struct *hpsa_scan_thread;
+static DEFINE_MUTEX(hpsa_scan_mutex);
+static LIST_HEAD(hpsa_scan_q);
+static int hpsa_scan_func(void *data);
+
+/**
+ * add_to_scan_list() - add controller to rescan queue
+ * @h:		      Pointer to the controller.
+ *
+ * Adds the controller to the rescan queue if not already on the queue.
+ *
+ * returns 1 if added to the queue, 0 if skipped (could be on the
+ * queue already, or the controller could be initializing or shutting
+ * down).
+ **/
+static int add_to_scan_list(struct ctlr_info *h)
+{
+	struct ctlr_info *test_h;
+	int found = 0;
+	int ret = 0;
+
+	if (h->busy_initializing)
+		return 0;
+
+	/*
+	 * If we don't get the lock, it means the driver is unloading
+	 * and there's no point in scheduling a new scan.
+	 */
+	if (!mutex_trylock(&h->busy_shutting_down))
+		return 0;
+
+	mutex_lock(&hpsa_scan_mutex);
+	list_for_each_entry(test_h, &hpsa_scan_q, scan_list) {
+		if (test_h == h) {
+			found = 1;
+			break;
+		}
+	}
+	if (!found && !h->busy_scanning) {
+		INIT_COMPLETION(h->scan_wait);
+		list_add_tail(&h->scan_list, &hpsa_scan_q);
+		ret = 1;
+	}
+	mutex_unlock(&hpsa_scan_mutex);
+	mutex_unlock(&h->busy_shutting_down);
+
+	return ret;
+}
+
+/**
+ * remove_from_scan_list() - remove controller from rescan queue
+ * @h:			   Pointer to the controller.
+ *
+ * Removes the controller from the rescan queue if present. Blocks if
+ * the controller is currently conducting a rescan.  The controller
+ * can be in one of three states:
+ * 1. Doesn't need a scan
+ * 2. On the scan list, but not scanning yet (we remove it)
+ * 3. Busy scanning (and not on the list). In this case we want to wait for
+ *    the scan to complete to make sure the scanning thread for this
+ *    controller is completely idle.
+ **/
+static void remove_from_scan_list(struct ctlr_info *h)
+{
+	struct ctlr_info *test_h, *tmp_h;
+
+	mutex_lock(&hpsa_scan_mutex);
+	list_for_each_entry_safe(test_h, tmp_h, &hpsa_scan_q, scan_list) {
+		if (test_h == h) { /* state 2. */
+			list_del(&h->scan_list);
+			complete_all(&h->scan_wait);
+			mutex_unlock(&hpsa_scan_mutex);
+			return;
+		}
+	}
+	if (h->busy_scanning) { /* state 3. */
+		mutex_unlock(&hpsa_scan_mutex);
+		wait_for_completion(&h->scan_wait);
+	} else { /* state 1, nothing to do. */
+		mutex_unlock(&hpsa_scan_mutex);
+	}
+}
+
+/* hpsa_scan_func() - kernel thread used to rescan controllers
+ * @data:	 Ignored.
+ *
+ * A kernel thread used scan for drive topology changes on
+ * controllers. The thread processes only one controller at a time
+ * using a queue.  Controllers are added to the queue using
+ * add_to_scan_list() and removed from the queue either after done
+ * processing or using remove_from_scan_list().
+ *
+ * returns 0.
+ **/
+static int hpsa_scan_func(__attribute__((unused)) void *data)
+{
+	struct ctlr_info *h;
+	int host_no;
+
+	while (1) {
+		set_current_state(TASK_INTERRUPTIBLE);
+		schedule();
+		if (kthread_should_stop())
+			break;
+
+		while (1) {
+			mutex_lock(&hpsa_scan_mutex);
+			if (list_empty(&hpsa_scan_q)) {
+				mutex_unlock(&hpsa_scan_mutex);
+				break;
+			}
+			h = list_entry(hpsa_scan_q.next, struct ctlr_info,
+					scan_list);
+			list_del(&h->scan_list);
+			h->busy_scanning = 1;
+			mutex_unlock(&hpsa_scan_mutex);
+			host_no = h->scsi_host ?  h->scsi_host->host_no : -1;
+			hpsa_update_scsi_devices(h, host_no);
+			complete_all(&h->scan_wait);
+			mutex_lock(&hpsa_scan_mutex);
+			h->busy_scanning = 0;
+			mutex_unlock(&hpsa_scan_mutex);
+		}
+	}
+	return 0;
+}
+
+static int check_for_unit_attention(struct ctlr_info *h,
+	struct CommandList *c)
+{
+	if (c->err_info->SenseInfo[2] != UNIT_ATTENTION)
+		return 0;
+
+	switch (c->err_info->SenseInfo[12]) {
+	case STATE_CHANGED:
+		dev_warn(&h->pdev->dev, "hpsa%d: a state change "
+			"detected, command retried\n", h->ctlr);
+		break;
+	case LUN_FAILED:
+		dev_warn(&h->pdev->dev, "hpsa%d: LUN failure "
+			"detected, action required\n", h->ctlr);
+		break;
+	case REPORT_LUNS_CHANGED:
+		dev_warn(&h->pdev->dev, "hpsa%d: report LUN data "
+			"changed\n", h->ctlr);
+	/*
+	 * Here, we could call add_to_scan_list and wake up the scan thread,
+	 * except that it's quite likely that we will get more than one
+	 * REPORT_LUNS_CHANGED condition in quick succession, which means
+	 * that those which occur after the first one will likely happen
+	 * *during* the hpsa_scan_thread's rescan.  And the rescan code is not
+	 * robust enough to restart in the middle, undoing what it has already
+	 * done, and it's not clear that it's even possible to do this, since
+	 * part of what it does is notify the SCSI mid layer, which starts
+	 * doing it's own i/o to read partition tables and so on, and the
+	 * driver doesn't have visibility to know what might need undoing.
+	 * In any event, if possible, it is horribly complicated to get right
+	 * so we just don't do it for now.
+	 *
+	 * Note: this REPORT_LUNS_CHANGED condition only occurs on the MSA2012.
+	 */
+		break;
+	case POWER_OR_RESET:
+		dev_warn(&h->pdev->dev, "hpsa%d: a power on "
+			"or device reset detected\n", h->ctlr);
+		break;
+	case UNIT_ATTENTION_CLEARED:
+		dev_warn(&h->pdev->dev, "hpsa%d: unit attention "
+		    "cleared by another initiator\n", h->ctlr);
+		break;
+	default:
+		dev_warn(&h->pdev->dev, "hpsa%d: unknown "
+			"unit attention detected\n", h->ctlr);
+		break;
+	}
+	return 1;
+}
+
+static ssize_t host_store_rescan(struct device *dev,
+				 struct device_attribute *attr,
+				 const char *buf, size_t count)
+{
+	struct ctlr_info *h;
+	struct Scsi_Host *shost = class_to_shost(dev);
+	unsigned long *priv = shost_priv(shost);
+	h = (struct ctlr_info *) *priv;
+	if (add_to_scan_list(h)) {
+		wake_up_process(hpsa_scan_thread);
+		wait_for_completion_interruptible(&h->scan_wait);
+	}
+	return count;
+}
+
+/* Enqueuing and dequeuing functions for cmdlists. */
+static inline void addQ(struct hlist_head *list, struct CommandList *c)
+{
+	hlist_add_head(&c->list, list);
+}
+
+static void enqueue_cmd_and_start_io(struct ctlr_info *h,
+	struct CommandList *c)
+{
+	unsigned long flags;
+	spin_lock_irqsave(&h->lock, flags);
+	addQ(&h->reqQ, c);
+	h->Qdepth++;
+	start_io(h);
+	spin_unlock_irqrestore(&h->lock, flags);
+}
+
+static inline void removeQ(struct CommandList *c)
+{
+	if (WARN_ON(hlist_unhashed(&c->list)))
+		return;
+	hlist_del_init(&c->list);
+}
+
+static inline int is_hba_lunid(unsigned char scsi3addr[])
+{
+	return memcmp(scsi3addr, RAID_CTLR_LUNID, 8) == 0;
+}
+
+static inline int is_logical_dev_addr_mode(unsigned char scsi3addr[])
+{
+	return (scsi3addr[3] & 0xC0) == 0x40;
+}
+
+static const char *raid_label[] = { "0", "4", "1(1+0)", "5", "5+1", "ADG",
+	"UNKNOWN"
+};
+#define RAID_UNKNOWN (ARRAY_SIZE(raid_label) - 1)
+
+static ssize_t raid_level_show(struct device *dev,
+	     struct device_attribute *attr, char *buf)
+{
+	ssize_t l = 0;
+	int rlevel;
+	struct ctlr_info *h;
+	struct scsi_device *sdev;
+	struct hpsa_scsi_dev_t *hdev;
+	unsigned long flags;
+
+	sdev = to_scsi_device(dev);
+	h = sdev_to_hba(sdev);
+	spin_lock_irqsave(&h->lock, flags);
+	hdev = sdev->hostdata;
+	if (!hdev) {
+		spin_unlock_irqrestore(&h->lock, flags);
+		return -ENODEV;
+	}
+
+	/* Is this even a logical drive? */
+	if (!is_logical_dev_addr_mode(hdev->scsi3addr)) {
+		spin_unlock_irqrestore(&h->lock, flags);
+		l = snprintf(buf, PAGE_SIZE, "N/A\n");
+		return l;
+	}
+
+	rlevel = hdev->raid_level;
+	spin_unlock_irqrestore(&h->lock, flags);
+	if (rlevel < 0 || rlevel > RAID_UNKNOWN)
+		rlevel = RAID_UNKNOWN;
+	l = snprintf(buf, PAGE_SIZE, "RAID %s\n", raid_label[rlevel]);
+	return l;
+}
+
+static ssize_t lunid_show(struct device *dev,
+	     struct device_attribute *attr, char *buf)
+{
+	struct ctlr_info *h;
+	struct scsi_device *sdev;
+	struct hpsa_scsi_dev_t *hdev;
+	unsigned long flags;
+	unsigned char lunid[8];
+
+	sdev = to_scsi_device(dev);
+	h = sdev_to_hba(sdev);
+	spin_lock_irqsave(&h->lock, flags);
+	hdev = sdev->hostdata;
+	if (!hdev) {
+		spin_unlock_irqrestore(&h->lock, flags);
+		return -ENODEV;
+	}
+	memcpy(lunid, hdev->scsi3addr, sizeof(lunid));
+	spin_unlock_irqrestore(&h->lock, flags);
+	return snprintf(buf, 20, "0x%02x%02x%02x%02x%02x%02x%02x%02x\n",
+		lunid[0], lunid[1], lunid[2], lunid[3],
+		lunid[4], lunid[5], lunid[6], lunid[7]);
+}
+
+static ssize_t unique_id_show(struct device *dev,
+	     struct device_attribute *attr, char *buf)
+{
+	struct ctlr_info *h;
+	struct scsi_device *sdev;
+	struct hpsa_scsi_dev_t *hdev;
+	unsigned long flags;
+	unsigned char sn[16];
+
+	sdev = to_scsi_device(dev);
+	h = sdev_to_hba(sdev);
+	spin_lock_irqsave(&h->lock, flags);
+	hdev = sdev->hostdata;
+	if (!hdev) {
+		spin_unlock_irqrestore(&h->lock, flags);
+		return -ENODEV;
+	}
+	memcpy(sn, hdev->device_id, sizeof(sn));
+	spin_unlock_irqrestore(&h->lock, flags);
+	return snprintf(buf, 16 * 2 + 2,
+			"%02X%02X%02X%02X%02X%02X%02X%02X"
+			"%02X%02X%02X%02X%02X%02X%02X%02X\n",
+			sn[0], sn[1], sn[2], sn[3],
+			sn[4], sn[5], sn[6], sn[7],
+			sn[8], sn[9], sn[10], sn[11],
+			sn[12], sn[13], sn[14], sn[15]);
+}
+
+static int hpsa_find_target_lun(struct ctlr_info *h,
+	unsigned char scsi3addr[], int bus, int *target, int *lun)
+{
+	/* finds an unused bus, target, lun for a new physical device
+	 * assumes h->devlock is held
+	 */
+	int i, found = 0;
+	DECLARE_BITMAP(lun_taken, HPSA_MAX_SCSI_DEVS_PER_HBA);
+
+	memset(&lun_taken[0], 0, HPSA_MAX_SCSI_DEVS_PER_HBA >> 3);
+
+	for (i = 0; i < h->ndevices; i++) {
+		if (h->dev[i]->bus == bus && h->dev[i]->target != -1)
+			set_bit(h->dev[i]->target, lun_taken);
+	}
+
+	for (i = 0; i < HPSA_MAX_SCSI_DEVS_PER_HBA; i++) {
+		if (!test_bit(i, lun_taken)) {
+			/* *bus = 1; */
+			*target = i;
+			*lun = 0;
+			found = 1;
+			break;
+		}
+	}
+	return !found;
+}
+
+/* Add an entry into h->dev[] array. */
+static int hpsa_scsi_add_entry(struct ctlr_info *h, int hostno,
+		struct hpsa_scsi_dev_t *device,
+		struct hpsa_scsi_dev_t *added[], int *nadded)
+{
+	/* assumes h->devlock is held */
+	int n = h->ndevices;
+	int i;
+	unsigned char addr1[8], addr2[8];
+	struct hpsa_scsi_dev_t *sd;
+
+	if (n >= HPSA_MAX_SCSI_DEVS_PER_HBA) {
+		dev_err(&h->pdev->dev, "too many devices, some will be "
+			"inaccessible.\n");
+		return -1;
+	}
+
+	/* physical devices do not have lun or target assigned until now. */
+	if (device->lun != -1)
+		/* Logical device, lun is already assigned. */
+		goto lun_assigned;
+
+	/* If this device a non-zero lun of a multi-lun device
+	 * byte 4 of the 8-byte LUN addr will contain the logical
+	 * unit no, zero otherise.
+	 */
+	if (device->scsi3addr[4] == 0) {
+		/* This is not a non-zero lun of a multi-lun device */
+		if (hpsa_find_target_lun(h, device->scsi3addr,
+			device->bus, &device->target, &device->lun) != 0)
+			return -1;
+		goto lun_assigned;
+	}
+
+	/* This is a non-zero lun of a multi-lun device.
+	 * Search through our list and find the device which
+	 * has the same 8 byte LUN address, excepting byte 4.
+	 * Assign the same bus and target for this new LUN.
+	 * Use the logical unit number from the firmware.
+	 */
+	memcpy(addr1, device->scsi3addr, 8);
+	addr1[4] = 0;
+	for (i = 0; i < n; i++) {
+		sd = h->dev[i];
+		memcpy(addr2, sd->scsi3addr, 8);
+		addr2[4] = 0;
+		/* differ only in byte 4? */
+		if (memcmp(addr1, addr2, 8) == 0) {
+			device->bus = sd->bus;
+			device->target = sd->target;
+			device->lun = device->scsi3addr[4];
+			break;
+		}
+	}
+	if (device->lun == -1) {
+		dev_warn(&h->pdev->dev, "physical device with no LUN=0,"
+			" suspect firmware bug or unsupported hardware "
+			"configuration.\n");
+			return -1;
+	}
+
+lun_assigned:
+
+	h->dev[n] = device;
+	h->ndevices++;
+	added[*nadded] = device;
+	(*nadded)++;
+
+	/* initially, (before registering with scsi layer) we don't
+	 * know our hostno and we don't want to print anything first
+	 * time anyway (the scsi layer's inquiries will show that info)
+	 */
+	/* if (hostno != -1) */
+		dev_info(&h->pdev->dev, "%s device c%db%dt%dl%d added.\n",
+			scsi_device_type(device->devtype), hostno,
+			device->bus, device->target, device->lun);
+	return 0;
+}
+
+/* Remove an entry from h->dev[] array. */
+static void hpsa_scsi_remove_entry(struct ctlr_info *h, int hostno, int entry,
+	struct hpsa_scsi_dev_t *removed[], int *nremoved)
+{
+	/* assumes h->devlock is held */
+	int i;
+	struct hpsa_scsi_dev_t *sd;
+
+	if (entry < 0 || entry >= HPSA_MAX_SCSI_DEVS_PER_HBA)
+		BUG();
+
+	sd = h->dev[entry];
+	removed[*nremoved] = h->dev[entry];
+	(*nremoved)++;
+
+	for (i = entry; i < h->ndevices-1; i++)
+		h->dev[i] = h->dev[i+1];
+	h->ndevices--;
+	dev_info(&h->pdev->dev, "%s device c%db%dt%dl%d removed.\n",
+		scsi_device_type(sd->devtype), hostno, sd->bus, sd->target,
+		sd->lun);
+}
+
+#define SCSI3ADDR_EQ(a, b) ( \
+	(a)[7] == (b)[7] && \
+	(a)[6] == (b)[6] && \
+	(a)[5] == (b)[5] && \
+	(a)[4] == (b)[4] && \
+	(a)[3] == (b)[3] && \
+	(a)[2] == (b)[2] && \
+	(a)[1] == (b)[1] && \
+	(a)[0] == (b)[0])
+
+static void fixup_botched_add(struct ctlr_info *h,
+	struct hpsa_scsi_dev_t *added)
+{
+	/* called when scsi_add_device fails in order to re-adjust
+	 * h->dev[] to match the mid layer's view.
+	 */
+	unsigned long flags;
+	int i, j;
+
+	spin_lock_irqsave(&h->lock, flags);
+	for (i = 0; i < h->ndevices; i++) {
+		if (h->dev[i] == added) {
+			for (j = i; j < h->ndevices-1; j++)
+				h->dev[j] = h->dev[j+1];
+			h->ndevices--;
+			break;
+		}
+	}
+	spin_unlock_irqrestore(&h->lock, flags);
+	kfree(added);
+}
+
+static inline int device_is_the_same(struct hpsa_scsi_dev_t *dev1,
+	struct hpsa_scsi_dev_t *dev2)
+{
+	if ((is_logical_dev_addr_mode(dev1->scsi3addr) ||
+		(dev1->lun != -1 && dev2->lun != -1)) &&
+		dev1->devtype != 0x0C)
+		return (memcmp(dev1, dev2, sizeof(*dev1)) == 0);
+
+	/* we compare everything except lun and target as these
+	 * are not yet assigned.  Compare parts likely
+	 * to differ first
+	 */
+	if (memcmp(dev1->scsi3addr, dev2->scsi3addr,
+		sizeof(dev1->scsi3addr)) != 0)
+		return 0;
+	if (memcmp(dev1->device_id, dev2->device_id,
+		sizeof(dev1->device_id)) != 0)
+		return 0;
+	if (memcmp(dev1->model, dev2->model, sizeof(dev1->model)) != 0)
+		return 0;
+	if (memcmp(dev1->vendor, dev2->vendor, sizeof(dev1->vendor)) != 0)
+		return 0;
+	if (memcmp(dev1->revision, dev2->revision, sizeof(dev1->revision)) != 0)
+		return 0;
+	if (dev1->devtype != dev2->devtype)
+		return 0;
+	if (dev1->raid_level != dev2->raid_level)
+		return 0;
+	if (dev1->bus != dev2->bus)
+		return 0;
+	return 1;
+}
+
+/* Find needle in haystack.  If exact match found, return DEVICE_SAME,
+ * and return needle location in *index.  If scsi3addr matches, but not
+ * vendor, model, serial num, etc. return DEVICE_CHANGED, and return needle
+ * location in *index.  If needle not found, return DEVICE_NOT_FOUND.
+ */
+static int hpsa_scsi_find_entry(struct hpsa_scsi_dev_t *needle,
+	struct hpsa_scsi_dev_t *haystack[], int haystack_size,
+	int *index)
+{
+	int i;
+#define DEVICE_NOT_FOUND 0
+#define DEVICE_CHANGED 1
+#define DEVICE_SAME 2
+	for (i = 0; i < haystack_size; i++) {
+		if (SCSI3ADDR_EQ(needle->scsi3addr, haystack[i]->scsi3addr)) {
+			*index = i;
+			if (device_is_the_same(needle, haystack[i]))
+				return DEVICE_SAME;
+			else
+				return DEVICE_CHANGED;
+		}
+	}
+	*index = -1;
+	return DEVICE_NOT_FOUND;
+}
+
+static int adjust_hpsa_scsi_table(struct ctlr_info *h, int hostno,
+	struct hpsa_scsi_dev_t *sd[], int nsds)
+{
+	/* sd contains scsi3 addresses and devtypes, and inquiry
+	 * data.  This function takes what's in sd to be the current
+	 * reality and updates h->dev[] to reflect that reality.
+	 */
+	int i, entry, device_change, changes = 0;
+	struct hpsa_scsi_dev_t *csd;
+	unsigned long flags;
+	struct hpsa_scsi_dev_t **added, **removed;
+	int nadded, nremoved;
+	struct Scsi_Host *sh = NULL;
+
+	added = kzalloc(sizeof(*added) * HPSA_MAX_SCSI_DEVS_PER_HBA,
+		GFP_KERNEL);
+	removed = kzalloc(sizeof(*removed) * HPSA_MAX_SCSI_DEVS_PER_HBA,
+		GFP_KERNEL);
+
+	if (!added || !removed) {
+		dev_warn(&h->pdev->dev, "out of memory in "
+			"adjust_hpsa_scsi_table\n");
+		goto free_and_out;
+	}
+
+	spin_lock_irqsave(&h->devlock, flags);
+
+	/* find any devices in h->dev[] that are not in
+	 * sd[] and remove them from h->dev[], and for any
+	 * devices which have changed, remove the old device
+	 * info and add the new device info.
+	 */
+	i = 0;
+	nremoved = 0;
+	nadded = 0;
+	while (i < h->ndevices) {
+		csd = h->dev[i];
+		device_change = hpsa_scsi_find_entry(csd, sd, nsds, &entry);
+		if (device_change == DEVICE_NOT_FOUND) {
+			changes++;
+			hpsa_scsi_remove_entry(h, hostno, i,
+				removed, &nremoved);
+			continue; /* remove ^^^, hence i not incremented */
+		} else if (device_change == DEVICE_CHANGED) {
+			changes++;
+			hpsa_scsi_remove_entry(h, hostno, i,
+				removed, &nremoved);
+			(void) hpsa_scsi_add_entry(h, hostno, sd[entry],
+				added, &nadded);
+			/* add can't fail, we just removed one. */
+			sd[entry] = NULL; /* prevent it from being freed */
+		}
+		i++;
+	}
+
+	/* Now, make sure every device listed in sd[] is also
+	 * listed in h->dev[], adding them if they aren't found
+	 */
+
+	for (i = 0; i < nsds; i++) {
+		if (!sd[i]) /* if already added above. */
+			continue;
+		device_change = hpsa_scsi_find_entry(sd[i], h->dev,
+					h->ndevices, &entry);
+		if (device_change == DEVICE_NOT_FOUND) {
+			changes++;
+			if (hpsa_scsi_add_entry(h, hostno, sd[i],
+				added, &nadded) != 0)
+				break;
+			sd[i] = NULL; /* prevent from being freed later. */
+		} else if (device_change == DEVICE_CHANGED) {
+			/* should never happen... */
+			changes++;
+			dev_warn(&h->pdev->dev,
+				"device unexpectedly changed.\n");
+			/* but if it does happen, we just ignore that device */
+		}
+	}
+	spin_unlock_irqrestore(&h->devlock, flags);
+
+	/* Don't notify scsi mid layer of any changes the first time through
+	 * (or if there are no changes) scsi_scan_host will do it later the
+	 * first time through.
+	 */
+	if (hostno == -1 || !changes)
+		goto free_and_out;
+
+	sh = h->scsi_host;
+	/* Notify scsi mid layer of any removed devices */
+	for (i = 0; i < nremoved; i++) {
+		struct scsi_device *sdev =
+			scsi_device_lookup(sh, removed[i]->bus,
+				removed[i]->target, removed[i]->lun);
+		if (sdev != NULL) {
+			scsi_remove_device(sdev);
+			scsi_device_put(sdev);
+		} else {
+			/* We don't expect to get here.
+			 * future cmds to this device will get selection
+			 * timeout as if the device was gone.
+			 */
+			dev_warn(&h->pdev->dev, "didn't find c%db%dt%dl%d "
+				" for removal.", hostno, removed[i]->bus,
+				removed[i]->target, removed[i]->lun);
+		}
+		kfree(removed[i]);
+		removed[i] = NULL;
+	}
+
+	/* Notify scsi mid layer of any added devices */
+	for (i = 0; i < nadded; i++) {
+		if (scsi_add_device(sh, added[i]->bus,
+			added[i]->target, added[i]->lun) == 0)
+			continue;
+		dev_warn(&h->pdev->dev, "scsi_add_device c%db%dt%dl%d failed, "
+			"device not added.\n", hostno, added[i]->bus,
+			added[i]->target, added[i]->lun);
+		/* now we have to remove it from h->dev,
+		 * since it didn't get added to scsi mid layer
+		 */
+		fixup_botched_add(h, added[i]);
+	}
+
+free_and_out:
+	kfree(added);
+	kfree(removed);
+	return 0;
+}
+
+/*
+ * Lookup bus/target/lun and retrun corresponding struct hpsa_scsi_dev_t *
+ * Assume's h->devlock is held.
+ */
+static struct hpsa_scsi_dev_t *lookup_hpsa_scsi_dev(struct ctlr_info *h,
+	int bus, int target, int lun)
+{
+	int i;
+	struct hpsa_scsi_dev_t *sd;
+
+	for (i = 0; i < h->ndevices; i++) {
+		sd = h->dev[i];
+		if (sd->bus == bus && sd->target == target && sd->lun == lun)
+			return sd;
+	}
+	return NULL;
+}
+
+/* link sdev->hostdata to our per-device structure. */
+static int hpsa_slave_alloc(struct scsi_device *sdev)
+{
+	struct hpsa_scsi_dev_t *sd;
+	unsigned long flags;
+	struct ctlr_info *h;
+
+	h = sdev_to_hba(sdev);
+	spin_lock_irqsave(&h->devlock, flags);
+	sd = lookup_hpsa_scsi_dev(h, sdev_channel(sdev),
+		sdev_id(sdev), sdev->lun);
+	if (sd != NULL)
+		sdev->hostdata = sd;
+	spin_unlock_irqrestore(&h->devlock, flags);
+	return 0;
+}
+
+static void hpsa_slave_destroy(struct scsi_device *sdev)
+{
+	return; /* nothing to do. */
+}
+
+static void hpsa_scsi_setup(struct ctlr_info *h)
+{
+	h->ndevices = 0;
+	h->scsi_host = NULL;
+	spin_lock_init(&h->devlock);
+	return;
+}
+
+static void complete_scsi_command(struct CommandList *cp,
+	int timeout, __u32 tag)
+{
+	struct scsi_cmnd *cmd;
+	struct ctlr_info *h;
+	struct ErrorInfo *ei;
+
+	unsigned char sense_key;
+	unsigned char asc;      /* additional sense code */
+	unsigned char ascq;     /* additional sense code qualifier */
+
+	ei = cp->err_info;
+	cmd = (struct scsi_cmnd *) cp->scsi_cmd;
+	h = cp->h;
+
+	scsi_dma_unmap(cmd); /* undo the DMA mappings */
+
+	cmd->result = (DID_OK << 16); 		/* host byte */
+	cmd->result |= (COMMAND_COMPLETE << 8);	/* msg byte */
+	cmd->result |= (ei->ScsiStatus << 1);
+
+	/* copy the sense data whether we need to or not. */
+	memcpy(cmd->sense_buffer, ei->SenseInfo,
+		ei->SenseLen > SCSI_SENSE_BUFFERSIZE ?
+			SCSI_SENSE_BUFFERSIZE :
+			ei->SenseLen);
+	scsi_set_resid(cmd, ei->ResidualCnt);
+
+	if (ei->CommandStatus == 0) {
+		cmd->scsi_done(cmd);
+		cmd_free(h, cp);
+		return;
+	}
+
+	/* an error has occurred */
+	switch (ei->CommandStatus) {
+
+	case CMD_TARGET_STATUS:
+		if (ei->ScsiStatus) {
+			/* Get sense key */
+			sense_key = 0xf & ei->SenseInfo[2];
+			/* Get additional sense code */
+			asc = ei->SenseInfo[12];
+			/* Get addition sense code qualifier */
+			ascq = ei->SenseInfo[13];
+		}
+
+		if (ei->ScsiStatus == SAM_STAT_CHECK_CONDITION) {
+			if (check_for_unit_attention(h, cp)) {
+				cmd->result = DID_SOFT_ERROR << 16;
+				break;
+			}
+			if (sense_key == ILLEGAL_REQUEST) {
+				/*
+				 * SCSI REPORT_LUNS is commonly unsupported on
+				 * Smart Array.  Suppress noisy complaint.
+				 */
+				if (cp->Request.CDB[0] == REPORT_LUNS)
+					break;
+
+				/* If ASC/ASCQ indicate Logical Unit
+				 * Not Supported condition,
+				 */
+				if ((asc == 0x25) && (ascq == 0x0)) {
+					dev_warn(&h->pdev->dev, "cp %p "
+						"has check condition\n", cp);
+					break;
+				}
+			}
+
+			if (sense_key == NOT_READY) {
+				/* If Sense is Not Ready, Logical Unit
+				 * Not ready, Manual Intervention
+				 * required
+				 */
+				if ((asc == 0x04) && (ascq == 0x03)) {
+					cmd->result = DID_NO_CONNECT << 16;
+					dev_warn(&h->pdev->dev, "cp %p "
+						"has check condition: unit "
+						"not ready, manual "
+						"intervention required\n", cp);
+					break;
+				}
+			}
+
+
+			/* Must be some other type of check condition */
+			dev_warn(&h->pdev->dev, "cp %p has check condition: "
+					"unknown type: "
+					"Sense: 0x%x, ASC: 0x%x, ASCQ: 0x%x, "
+					"Returning result: 0x%x, "
+					"cmd=[%02x %02x %02x %02x %02x "
+					"%02x %02x %02x %02x %02x]\n",
+					cp, sense_key, asc, ascq,
+					cmd->result,
+					cmd->cmnd[0], cmd->cmnd[1],
+					cmd->cmnd[2], cmd->cmnd[3],
+					cmd->cmnd[4], cmd->cmnd[5],
+					cmd->cmnd[6], cmd->cmnd[7],
+					cmd->cmnd[8], cmd->cmnd[9]);
+			break;
+		}
+
+
+		/* Problem was not a check condition
+		 * Pass it up to the upper layers...
+		 */
+		if (ei->ScsiStatus) {
+			dev_warn(&h->pdev->dev, "cp %p has status 0x%x "
+				"Sense: 0x%x, ASC: 0x%x, ASCQ: 0x%x, "
+				"Returning result: 0x%x\n",
+				cp, ei->ScsiStatus,
+				sense_key, asc, ascq,
+				cmd->result);
+		} else {  /* scsi status is zero??? How??? */
+			dev_warn(&h->pdev->dev, "cp %p SCSI status was 0. "
+				"Returning no connection.\n", cp),
+
+			/* Ordinarily, this case should never happen,
+			 * but there is a bug in some released firmware
+			 * revisions that allows it to happen if, for
+			 * example, a 4100 backplane loses power and
+			 * the tape drive is in it.  We assume that
+			 * it's a fatal error of some kind because we
+			 * can't show that it wasn't. We will make it
+			 * look like selection timeout since that is
+			 * the most common reason for this to occur,
+			 * and it's severe enough.
+			 */
+
+			cmd->result = DID_NO_CONNECT << 16;
+		}
+		break;
+
+	case CMD_DATA_UNDERRUN: /* let mid layer handle it. */
+		break;
+	case CMD_DATA_OVERRUN:
+		dev_warn(&h->pdev->dev, "cp %p has"
+			" completed with data overrun "
+			"reported\n", cp);
+		break;
+	case CMD_INVALID: {
+		/* print_bytes(cp, sizeof(*cp), 1, 0);
+		print_cmd(cp); */
+		/* We get CMD_INVALID if you address a non-existent device
+		 * instead of a selection timeout (no response).  You will
+		 * see this if you yank out a drive, then try to access it.
+		 * This is kind of a shame because it means that any other
+		 * CMD_INVALID (e.g. driver bug) will get interpreted as a
+		 * missing target. */
+		cmd->result = DID_NO_CONNECT << 16;
+	}
+		break;
+	case CMD_PROTOCOL_ERR:
+		dev_warn(&h->pdev->dev, "cp %p has "
+			"protocol error \n", cp);
+		break;
+	case CMD_HARDWARE_ERR:
+		cmd->result = DID_ERROR << 16;
+		dev_warn(&h->pdev->dev, "cp %p had  hardware error\n", cp);
+		break;
+	case CMD_CONNECTION_LOST:
+		cmd->result = DID_ERROR << 16;
+		dev_warn(&h->pdev->dev, "cp %p had connection lost\n", cp);
+		break;
+	case CMD_ABORTED:
+		cmd->result = DID_ABORT << 16;
+		dev_warn(&h->pdev->dev, "cp %p was aborted with status 0x%x\n",
+				cp, ei->ScsiStatus);
+		break;
+	case CMD_ABORT_FAILED:
+		cmd->result = DID_ERROR << 16;
+		dev_warn(&h->pdev->dev, "cp %p reports abort failed\n", cp);
+		break;
+	case CMD_UNSOLICITED_ABORT:
+		cmd->result = DID_ABORT << 16;
+		dev_warn(&h->pdev->dev, "cp %p aborted do to an unsolicited "
+			"abort\n", cp);
+		break;
+	case CMD_TIMEOUT:
+		cmd->result = DID_TIME_OUT << 16;
+		dev_warn(&h->pdev->dev, "cp %p timedout\n", cp);
+		break;
+	default:
+		cmd->result = DID_ERROR << 16;
+		dev_warn(&h->pdev->dev, "cp %p returned unknown status %x\n",
+				cp, ei->CommandStatus);
+	}
+	cmd->scsi_done(cmd);
+	cmd_free(h, cp);
+}
+
+static int hpsa_scsi_detect(struct ctlr_info *h)
+{
+	struct Scsi_Host *sh;
+	int error;
+
+	sh = scsi_host_alloc(&hpsa_driver_template, sizeof(h));
+	if (sh == NULL)
+		goto fail;
+
+	sh->io_port = 0;
+	sh->n_io_port = 0;
+	sh->this_id = -1;
+	sh->max_channel = 3;
+	sh->max_cmd_len = MAX_COMMAND_SIZE;
+	sh->max_lun = HPSA_MAX_LUN;
+	sh->max_id = HPSA_MAX_LUN;
+	h->scsi_host = sh;
+	sh->hostdata[0] = (unsigned long) h;
+	sh->irq = h->intr[SIMPLE_MODE_INT];
+	sh->unique_id = sh->irq;
+	error = scsi_add_host(sh, &h->pdev->dev);
+	if (error)
+		goto fail_host_put;
+	scsi_scan_host(sh);
+	return 0;
+
+ fail_host_put:
+	dev_err(&h->pdev->dev, "hpsa_scsi_detect: scsi_add_host"
+		" failed for controller %d\n", h->ctlr);
+	scsi_host_put(sh);
+	return -1;
+ fail:
+	dev_err(&h->pdev->dev, "hpsa_scsi_detect: scsi_host_alloc"
+		" failed for controller %d\n", h->ctlr);
+	return -1;
+}
+
+static void hpsa_pci_unmap(struct pci_dev *pdev,
+	struct CommandList *c, int sg_used, int data_direction)
+{
+	int i;
+	union u64bit addr64;
+
+	for (i = 0; i < sg_used; i++) {
+		addr64.val32.lower = c->SG[i].Addr.lower;
+		addr64.val32.upper = c->SG[i].Addr.upper;
+		pci_unmap_single(pdev, (dma_addr_t) addr64.val, c->SG[i].Len,
+			data_direction);
+	}
+}
+
+static void hpsa_map_one(struct pci_dev *pdev,
+		struct CommandList *cp,
+		unsigned char *buf,
+		size_t buflen,
+		int data_direction)
+{
+	__u64 addr64;
+
+	if (buflen == 0 || data_direction == PCI_DMA_NONE) {
+		cp->Header.SGList = 0;
+		cp->Header.SGTotal = 0;
+		return;
+	}
+
+	addr64 = (__u64) pci_map_single(pdev, buf, buflen, data_direction);
+	cp->SG[0].Addr.lower =
+	  (__u32) (addr64 & (__u64) 0x00000000FFFFFFFF);
+	cp->SG[0].Addr.upper =
+	  (__u32) ((addr64 >> 32) & (__u64) 0x00000000FFFFFFFF);
+	cp->SG[0].Len = buflen;
+	cp->Header.SGList = (__u8) 1;   /* no. SGs contig in this cmd */
+	cp->Header.SGTotal = (__u16) 1; /* total sgs in this cmd list */
+}
+
+static inline void hpsa_scsi_do_simple_cmd_core(struct ctlr_info *h,
+	struct CommandList *c)
+{
+	DECLARE_COMPLETION_ONSTACK(wait);
+
+	c->waiting = &wait;
+	enqueue_cmd_and_start_io(h, c);
+	wait_for_completion(&wait);
+}
+
+static void hpsa_scsi_do_simple_cmd_with_retry(struct ctlr_info *h,
+	struct CommandList *c, int data_direction)
+{
+	int retry_count = 0;
+
+	do {
+		memset(c->err_info, 0, sizeof(c->err_info));
+		hpsa_scsi_do_simple_cmd_core(h, c);
+		retry_count++;
+	} while (check_for_unit_attention(h, c) && retry_count <= 3);
+	hpsa_pci_unmap(h->pdev, c, 1, data_direction);
+}
+
+static void hpsa_scsi_interpret_error(struct CommandList *cp)
+{
+	struct ErrorInfo *ei;
+	struct device *d = &cp->h->pdev->dev;
+
+	ei = cp->err_info;
+	switch (ei->CommandStatus) {
+	case CMD_TARGET_STATUS:
+		dev_warn(d, "cmd %p has completed with errors\n", cp);
+		dev_warn(d, "cmd %p has SCSI Status = %x\n", cp,
+				ei->ScsiStatus);
+		if (ei->ScsiStatus == 0)
+			dev_warn(d, "SCSI status is abnormally zero.  "
+			"(probably indicates selection timeout "
+			"reported incorrectly due to a known "
+			"firmware bug, circa July, 2001.)\n");
+		break;
+	case CMD_DATA_UNDERRUN: /* let mid layer handle it. */
+			dev_info(d, "UNDERRUN\n");
+		break;
+	case CMD_DATA_OVERRUN:
+		dev_warn(d, "cp %p has completed with data overrun\n", cp);
+		break;
+	case CMD_INVALID: {
+		/* controller unfortunately reports SCSI passthru's
+		 * to non-existent targets as invalid commands.
+		 */
+		dev_warn(d, "cp %p is reported invalid (probably means "
+			"target device no longer present)\n", cp);
+		/* print_bytes((unsigned char *) cp, sizeof(*cp), 1, 0);
+		print_cmd(cp);  */
+		}
+		break;
+	case CMD_PROTOCOL_ERR:
+		dev_warn(d, "cp %p has protocol error \n", cp);
+		break;
+	case CMD_HARDWARE_ERR:
+		/* cmd->result = DID_ERROR << 16; */
+		dev_warn(d, "cp %p had hardware error\n", cp);
+		break;
+	case CMD_CONNECTION_LOST:
+		dev_warn(d, "cp %p had connection lost\n", cp);
+		break;
+	case CMD_ABORTED:
+		dev_warn(d, "cp %p was aborted\n", cp);
+		break;
+	case CMD_ABORT_FAILED:
+		dev_warn(d, "cp %p reports abort failed\n", cp);
+		break;
+	case CMD_UNSOLICITED_ABORT:
+		dev_warn(d, "cp %p aborted due to an unsolicited abort\n", cp);
+		break;
+	case CMD_TIMEOUT:
+		dev_warn(d, "cp %p timed out\n", cp);
+		break;
+	default:
+		dev_warn(d, "cp %p returned unknown status %x\n", cp,
+				ei->CommandStatus);
+	}
+}
+
+static int hpsa_scsi_do_inquiry(struct ctlr_info *h, unsigned char *scsi3addr,
+			unsigned char page, unsigned char *buf,
+			unsigned char bufsize)
+{
+	int rc = IO_OK;
+	struct CommandList *c;
+	struct ErrorInfo *ei;
+
+	c = cmd_special_alloc(h);
+
+	if (c == NULL) {			/* trouble... */
+		dev_warn(&h->pdev->dev, "cmd_special_alloc returned NULL!\n");
+		return -1;
+	}
+
+	fill_cmd(c, HPSA_INQUIRY, h, buf, bufsize, page, scsi3addr, TYPE_CMD);
+	hpsa_scsi_do_simple_cmd_with_retry(h, c, PCI_DMA_FROMDEVICE);
+	ei = c->err_info;
+	if (ei->CommandStatus != 0 && ei->CommandStatus != CMD_DATA_UNDERRUN) {
+		hpsa_scsi_interpret_error(c);
+		rc = -1;
+	}
+	cmd_special_free(h, c);
+	return rc;
+}
+
+static int hpsa_send_reset(struct ctlr_info *h, unsigned char *scsi3addr)
+{
+	int rc = IO_OK;
+	struct CommandList *c;
+	struct ErrorInfo *ei;
+
+	c = cmd_special_alloc(h);
+
+	if (c == NULL) {			/* trouble... */
+		dev_warn(&h->pdev->dev, "cmd_special_alloc returned NULL!\n");
+		return -1;
+	}
+
+	fill_cmd(c, HPSA_DEVICE_RESET_MSG, h, NULL, 0, 0, scsi3addr, TYPE_MSG);
+	hpsa_scsi_do_simple_cmd_core(h, c);
+	/* no unmap needed here because no data xfer. */
+
+	ei = c->err_info;
+	if (ei->CommandStatus != 0) {
+		hpsa_scsi_interpret_error(c);
+		rc = -1;
+	}
+	cmd_special_free(h, c);
+	return rc;
+}
+
+static void hpsa_get_raid_level(struct ctlr_info *h,
+	unsigned char *scsi3addr, unsigned char *raid_level)
+{
+	int rc;
+	unsigned char *buf;
+
+	*raid_level = RAID_UNKNOWN;
+	buf = kzalloc(64, GFP_KERNEL);
+	if (!buf)
+		return;
+	rc = hpsa_scsi_do_inquiry(h, scsi3addr, 0xC1, buf, 64);
+	if (rc == 0)
+		*raid_level = buf[8];
+	if (*raid_level > RAID_UNKNOWN)
+		*raid_level = RAID_UNKNOWN;
+	kfree(buf);
+	return;
+}
+
+/* Get the device id from inquiry page 0x83 */
+static int hpsa_get_device_id(struct ctlr_info *h, unsigned char *scsi3addr,
+	unsigned char *device_id, int buflen)
+{
+	int rc;
+	unsigned char *buf;
+
+	if (buflen > 16)
+		buflen = 16;
+	buf = kzalloc(64, GFP_KERNEL);
+	if (!buf)
+		return -1;
+	rc = hpsa_scsi_do_inquiry(h, scsi3addr, 0x83, buf, 64);
+	if (rc == 0)
+		memcpy(device_id, &buf[8], buflen);
+	kfree(buf);
+	return rc != 0;
+}
+
+static int hpsa_scsi_do_report_luns(struct ctlr_info *h, int logical,
+		struct ReportLUNdata *buf, int bufsize,
+		int extended_response)
+{
+	int rc = IO_OK;
+	struct CommandList *c;
+	unsigned char scsi3addr[8];
+	struct ErrorInfo *ei;
+
+	c = cmd_special_alloc(h);
+	if (c == NULL) {			/* trouble... */
+		dev_err(&h->pdev->dev, "cmd_special_alloc returned NULL!\n");
+		return -1;
+	}
+
+	memset(&scsi3addr[0], 0, 8); /* address the controller */
+
+	fill_cmd(c, logical ? HPSA_REPORT_LOG : HPSA_REPORT_PHYS, h,
+		buf, bufsize, 0, scsi3addr, TYPE_CMD);
+	if (extended_response)
+		c->Request.CDB[1] = extended_response;
+	hpsa_scsi_do_simple_cmd_with_retry(h, c, PCI_DMA_FROMDEVICE);
+	ei = c->err_info;
+	if (ei->CommandStatus != 0 &&
+	    ei->CommandStatus != CMD_DATA_UNDERRUN) {
+		hpsa_scsi_interpret_error(c);
+		rc = -1;
+	}
+	cmd_special_free(h, c);
+	return rc;
+}
+
+static inline int hpsa_scsi_do_report_phys_luns(struct ctlr_info *h,
+		struct ReportLUNdata *buf,
+		int bufsize, int extended_response)
+{
+	return hpsa_scsi_do_report_luns(h, 0, buf, bufsize, extended_response);
+}
+
+static inline int hpsa_scsi_do_report_log_luns(struct ctlr_info *h,
+		struct ReportLUNdata *buf, int bufsize)
+{
+	return hpsa_scsi_do_report_luns(h, 1, buf, bufsize, 0);
+}
+
+static inline void hpsa_set_bus_target_lun(struct hpsa_scsi_dev_t *device,
+	int bus, int target, int lun)
+{
+	device->bus = bus;
+	device->target = target;
+	device->lun = lun;
+}
+
+static int hpsa_update_device_info(struct ctlr_info *h,
+	unsigned char scsi3addr[], struct hpsa_scsi_dev_t *this_device)
+{
+#define OBDR_TAPE_INQ_SIZE 49
+	unsigned char *inq_buff = NULL;
+
+	inq_buff = kmalloc(OBDR_TAPE_INQ_SIZE, GFP_KERNEL);
+	if (!inq_buff)
+		goto bail_out;
+
+	memset(inq_buff, 0, OBDR_TAPE_INQ_SIZE);
+	/* Do an inquiry to the device to see what it is. */
+	if (hpsa_scsi_do_inquiry(h, scsi3addr, 0, inq_buff,
+		(unsigned char) OBDR_TAPE_INQ_SIZE) != 0) {
+		/* Inquiry failed (msg printed already) */
+		dev_err(&h->pdev->dev,
+			"hpsa_update_device_info: inquiry failed\n");
+		goto bail_out;
+	}
+
+	/* As a side effect, record the firmware version number
+	 * if we happen to be talking to the RAID controller.
+	 */
+	if (is_hba_lunid(scsi3addr))
+		memcpy(h->firm_ver, &inq_buff[32], 4);
+
+	this_device->devtype = (inq_buff[0] & 0x1f);
+	memcpy(this_device->scsi3addr, scsi3addr, 8);
+	memcpy(this_device->vendor, &inq_buff[8],
+		sizeof(this_device->vendor));
+	memcpy(this_device->model, &inq_buff[16],
+		sizeof(this_device->model));
+	memcpy(this_device->revision, &inq_buff[32],
+		sizeof(this_device->revision));
+	memset(this_device->device_id, 0,
+		sizeof(this_device->device_id));
+	hpsa_get_device_id(h, scsi3addr, this_device->device_id,
+		sizeof(this_device->device_id));
+
+	if (this_device->devtype == TYPE_DISK &&
+		is_logical_dev_addr_mode(scsi3addr))
+		hpsa_get_raid_level(h, scsi3addr, &this_device->raid_level);
+	else
+		this_device->raid_level = RAID_UNKNOWN;
+
+	kfree(inq_buff);
+	return 0;
+
+bail_out:
+	kfree(inq_buff);
+	return 1;
+}
+
+static unsigned char *msa2xxx_model[] = {
+	"MSA2012",
+	"MSA2024",
+	"MSA2312",
+	"MSA2324",
+	NULL,
+};
+
+static int is_msa2xxx(struct ctlr_info *h, struct hpsa_scsi_dev_t *device)
+{
+	int i;
+
+	for (i = 0; msa2xxx_model[i]; i++)
+		if (strncmp(device->model, msa2xxx_model[i],
+			strlen(msa2xxx_model[i])) == 0)
+			return 1;
+	return 0;
+}
+
+/* Helper function to assign bus, target, lun mapping of devices.
+ * Puts non-msa2xxx logical volumes on bus 0, msa2xxx logical
+ * volumes on bus 1, physical devices on bus 2. and the hba on bus 3.
+ * Logical drive target and lun are assigned at this time, but
+ * physical device lun and target assignment are deferred (assigned
+ * in hpsa_find_target_lun, called by hpsa_scsi_add_entry.)
+ */
+static void figure_bus_target_lun(struct ctlr_info *h,
+	__u8 *lunaddrbytes, int *bus, int *target, int *lun,
+	struct hpsa_scsi_dev_t *device)
+{
+
+	__u32 lunid;
+
+	if (is_logical_dev_addr_mode(lunaddrbytes)) {
+		/* logical device */
+		memcpy(&lunid, lunaddrbytes, sizeof(lunid));
+		lunid = le32_to_cpu(lunid);
+
+		if (is_msa2xxx(h, device)) {
+			*bus = 1;
+			*target = (lunid >> 16) & 0x3fff;
+			*lun = lunid & 0x00ff;
+		} else {
+			*bus = 0;
+			*lun = 0;
+			*target = lunid & 0x3fff;
+		}
+	} else {
+		/* physical device */
+		if (is_hba_lunid(lunaddrbytes))
+			*bus = 3;
+		else
+			*bus = 2;
+		*target = -1;
+		*lun = -1; /* we will fill these in later. */
+	}
+}
+
+/*
+ * If there is no lun 0 on a target, linux won't find any devices.
+ * For the MSA2xxx boxes, we have to manually detect the enclosure
+ * which is at lun zero, as CCISS_REPORT_PHYSICAL_LUNS doesn't report
+ * it for some reason.  *tmpdevice is the target we're adding,
+ * this_device is a pointer into the current element of currentsd[]
+ * that we're building up in update_scsi_devices(), below.
+ * lunzerobits is a bitmap that tracks which targets already have a
+ * lun 0 assigned.
+ * Returns 1 if an enclosure was added, 0 if not.
+ */
+static int add_msa2xxx_enclosure_device(struct ctlr_info *h,
+	struct hpsa_scsi_dev_t *tmpdevice,
+	struct hpsa_scsi_dev_t *this_device, __u8 *lunaddrbytes,
+	int bus, int target, int lun, unsigned long lunzerobits[],
+	int *nmsa2xxx_enclosures)
+{
+	unsigned char scsi3addr[8];
+
+	if (test_bit(target, lunzerobits))
+		return 0; /* There is already a lun 0 on this target. */
+
+	if (!is_logical_dev_addr_mode(lunaddrbytes))
+		return 0; /* It's the logical targets that may lack lun 0. */
+
+	if (!is_msa2xxx(h, tmpdevice))
+		return 0; /* It's only the MSA2xxx that have this problem. */
+
+	if (lun == 0) /* if lun is 0, then obviously we have a lun 0. */
+		return 0;
+
+	if (is_hba_lunid(scsi3addr))
+		return 0; /* Don't add the RAID controller here. */
+
+#define MAX_MSA2XXX_ENCLOSURES 32
+	if (*nmsa2xxx_enclosures >= MAX_MSA2XXX_ENCLOSURES) {
+		dev_warn(&h->pdev->dev, "Maximum number of MSA2XXX "
+			"enclosures exceeded.  Check your hardware "
+			"configuration.");
+		return 0;
+	}
+
+	memset(scsi3addr, 0, 8);
+	scsi3addr[3] = target;
+	if (hpsa_update_device_info(h, scsi3addr, this_device))
+		return 0;
+	(*nmsa2xxx_enclosures)++;
+	hpsa_set_bus_target_lun(this_device, bus, target, 0);
+	set_bit(target, lunzerobits);
+	return 1;
+}
+
+/*
+ * Do CISS_REPORT_PHYS and CISS_REPORT_LOG.  Data is returned in physdev,
+ * logdev.  The number of luns in physdev and logdev are returned in
+ * *nphysicals and *nlogicals, respectively.
+ * Returns 0 on success, -1 otherwise.
+ */
+static int hpsa_gather_lun_info(struct ctlr_info *h,
+	int reportlunsize,
+	struct ReportLUNdata *physdev, __u32 *nphysicals,
+	struct ReportLUNdata *logdev, __u32 *nlogicals)
+{
+	if (hpsa_scsi_do_report_phys_luns(h, physdev, reportlunsize, 0)) {
+		dev_err(&h->pdev->dev, "report physical LUNs failed.\n");
+		return -1;
+	}
+	memcpy(nphysicals, &physdev->LUNListLength[0], sizeof(*nphysicals));
+	*nphysicals = be32_to_cpu(*nphysicals) / 8;
+#ifdef DEBUG
+	dev_info(&h->pdev->dev, "number of physical luns is %d\n", *nphysicals);
+#endif
+	if (*nphysicals > HPSA_MAX_PHYS_LUN) {
+		dev_warn(&h->pdev->dev, "maximum physical LUNs (%d) exceeded."
+			"  %d LUNs ignored.\n", HPSA_MAX_PHYS_LUN,
+			*nphysicals - HPSA_MAX_PHYS_LUN);
+		*nphysicals = HPSA_MAX_PHYS_LUN;
+	}
+	if (hpsa_scsi_do_report_log_luns(h, logdev, reportlunsize)) {
+		dev_err(&h->pdev->dev, "report logical LUNs failed.\n");
+		return -1;
+	}
+	memcpy(nlogicals, &logdev->LUNListLength[0], sizeof(*nlogicals));
+	*nlogicals = be32_to_cpu(*nlogicals) / 8;
+#ifdef DEBUG
+	dev_info(&h->pdev->dev, "number of logical luns is %d\n", *nlogicals);
+#endif
+	/* Reject Logicals in excess of our max capability. */
+	if (*nlogicals > HPSA_MAX_LUN) {
+		dev_warn(&h->pdev->dev,
+			"maximum logical LUNs (%d) exceeded.  "
+			"%d LUNs ignored.\n", HPSA_MAX_LUN,
+			*nlogicals - HPSA_MAX_LUN);
+			*nlogicals = HPSA_MAX_LUN;
+	}
+	if (*nlogicals + *nphysicals > HPSA_MAX_PHYS_LUN) {
+		dev_warn(&h->pdev->dev,
+			"maximum logical + physical LUNs (%d) exceeded. "
+			"%d LUNs ignored.\n", HPSA_MAX_PHYS_LUN,
+			*nphysicals + *nlogicals - HPSA_MAX_PHYS_LUN);
+		*nlogicals = HPSA_MAX_PHYS_LUN - *nphysicals;
+	}
+	return 0;
+}
+
+static void hpsa_update_scsi_devices(struct ctlr_info *h, int hostno)
+{
+	/* the idea here is we could get notified
+	 * that some devices have changed, so we do a report
+	 * physical luns and report logical luns cmd, and adjust
+	 * our list of devices accordingly.
+	 *
+	 * The scsi3addr's of devices won't change so long as the
+	 * adapter is not reset.  That means we can rescan and
+	 * tell which devices we already know about, vs. new
+	 * devices, vs.  disappearing devices.
+	 */
+	struct ReportLUNdata *physdev_list = NULL;
+	struct ReportLUNdata *logdev_list = NULL;
+	unsigned char *inq_buff = NULL;
+	__u32 nphysicals = 0;
+	__u32 nlogicals = 0;
+	__u32 ndev_allocated = 0;
+	struct hpsa_scsi_dev_t **currentsd, *this_device, *tmpdevice;
+	int ncurrent = 0;
+	int reportlunsize = sizeof(*physdev_list) + HPSA_MAX_PHYS_LUN * 8;
+	int i, nmsa2xxx_enclosures, ndevs_to_allocate;
+	int bus, target, lun;
+	DECLARE_BITMAP(lunzerobits, HPSA_MAX_TARGETS_PER_CTLR);
+
+	currentsd = kzalloc(sizeof(*currentsd) * HPSA_MAX_SCSI_DEVS_PER_HBA,
+		GFP_KERNEL);
+	physdev_list = kzalloc(reportlunsize, GFP_KERNEL);
+	logdev_list = kzalloc(reportlunsize, GFP_KERNEL);
+	inq_buff = kmalloc(OBDR_TAPE_INQ_SIZE, GFP_KERNEL);
+	tmpdevice = kzalloc(sizeof(*tmpdevice), GFP_KERNEL);
+
+	if (!currentsd || !physdev_list || !logdev_list ||
+		!inq_buff || !tmpdevice) {
+		dev_err(&h->pdev->dev, "out of memory\n");
+		goto out;
+	}
+	memset(lunzerobits, 0, sizeof(lunzerobits));
+
+	if (hpsa_gather_lun_info(h, reportlunsize, physdev_list, &nphysicals,
+			logdev_list, &nlogicals))
+		goto out;
+
+	/* We might see up to 32 MSA2xxx enclosures, actually 8 of them
+	 * but each of them 4 times through different paths.  The plus 1
+	 * is for the RAID controller.
+	 */
+	ndevs_to_allocate = nphysicals + nlogicals + MAX_MSA2XXX_ENCLOSURES + 1;
+
+	/* Allocate the per device structures */
+	for (i = 0; i < ndevs_to_allocate; i++) {
+		currentsd[i] = kzalloc(sizeof(*currentsd[i]), GFP_KERNEL);
+		if (!currentsd[i]) {
+			dev_warn(&h->pdev->dev, "out of memory at %s:%d\n",
+				__FILE__, __LINE__);
+			goto out;
+		}
+		ndev_allocated++;
+	}
+
+	/* adjust our table of devices */
+	nmsa2xxx_enclosures = 0;
+	for (i = 0; i < nphysicals + nlogicals + 1; i++) {
+		__u8 *lunaddrbytes;
+
+		/* Figure out where the LUN ID info is coming from */
+		if (i < nphysicals)
+			lunaddrbytes = &physdev_list->LUN[i][0];
+		else
+			if (i < nphysicals + nlogicals)
+				lunaddrbytes =
+					&logdev_list->LUN[i-nphysicals][0];
+			else /* jam in the RAID controller at the end */
+				lunaddrbytes = RAID_CTLR_LUNID;
+
+		/* skip masked physical devices. */
+		if (lunaddrbytes[3] & 0xC0 && i < nphysicals)
+			continue;
+
+		/* Get device type, vendor, model, device id */
+		if (hpsa_update_device_info(h, lunaddrbytes, tmpdevice))
+			continue; /* skip it if we can't talk to it. */
+		figure_bus_target_lun(h, lunaddrbytes, &bus, &target, &lun,
+			tmpdevice);
+		this_device = currentsd[ncurrent];
+
+		/*
+		 * For the msa2xxx boxes, we have to insert a LUN 0 which
+		 * doesn't show up in CCISS_REPORT_PHYSICAL data, but there
+		 * is nonetheless an enclosure device there.  We have to
+		 * present that otherwise linux won't find anything if
+		 * there is no lun 0.
+		 */
+		if (add_msa2xxx_enclosure_device(h, tmpdevice, this_device,
+				lunaddrbytes, bus, target, lun, lunzerobits,
+				&nmsa2xxx_enclosures)) {
+			ncurrent++;
+			this_device = currentsd[ncurrent];
+		}
+
+		*this_device = *tmpdevice;
+		hpsa_set_bus_target_lun(this_device, bus, target, lun);
+
+		switch (this_device->devtype) {
+		case TYPE_ROM: {
+			/* We don't *really* support actual CD-ROM devices,
+			 * just "One Button Disaster Recovery" tape drive
+			 * which temporarily pretends to be a CD-ROM drive.
+			 * So we check that the device is really an OBDR tape
+			 * device by checking for "$DR-10" in bytes 43-48 of
+			 * the inquiry data.
+			 */
+				char obdr_sig[7];
+#define OBDR_TAPE_SIG "$DR-10"
+				strncpy(obdr_sig, &inq_buff[43], 6);
+				obdr_sig[6] = '\0';
+				if (strncmp(obdr_sig, OBDR_TAPE_SIG, 6) != 0)
+					/* Not OBDR device, ignore it. */
+					break;
+			}
+			ncurrent++;
+			break;
+		case TYPE_DISK:
+			if (i < nphysicals)
+				break;
+			ncurrent++;
+			break;
+		case TYPE_TAPE:
+		case TYPE_MEDIUM_CHANGER:
+			ncurrent++;
+			break;
+		case TYPE_RAID:
+			/* Only present the Smartarray HBA as a RAID controller.
+			 * If it's a RAID controller other than the HBA itself
+			 * (an external RAID controller, MSA500 or similar)
+			 * don't present it.
+			 */
+			if (!is_hba_lunid(lunaddrbytes))
+				break;
+			ncurrent++;
+			break;
+		default:
+			break;
+		}
+		if (ncurrent >= HPSA_MAX_SCSI_DEVS_PER_HBA)
+			break;
+	}
+	adjust_hpsa_scsi_table(h, hostno, currentsd, ncurrent);
+out:
+	kfree(tmpdevice);
+	for (i = 0; i < ndev_allocated; i++)
+		kfree(currentsd[i]);
+	kfree(currentsd);
+	kfree(inq_buff);
+	kfree(physdev_list);
+	kfree(logdev_list);
+	return;
+}
+
+/* hpsa_scatter_gather takes a struct scsi_cmnd, (cmd), and does the pci
+ * dma mapping  and fills in the scatter gather entries of the
+ * hpsa command, cp.
+ */
+static int hpsa_scatter_gather(struct pci_dev *pdev,
+		struct CommandList *cp,
+		struct scsi_cmnd *cmd)
+{
+	unsigned int len;
+	struct scatterlist *sg;
+	__u64 addr64;
+	int use_sg, i;
+
+	BUG_ON(scsi_sg_count(cmd) > MAXSGENTRIES);
+
+	use_sg = scsi_dma_map(cmd);
+	if (use_sg < 0)
+		return use_sg;
+
+	if (!use_sg)
+		goto sglist_finished;
+
+	scsi_for_each_sg(cmd, sg, use_sg, i) {
+		addr64 = (__u64) sg_dma_address(sg);
+		len  = sg_dma_len(sg);
+		cp->SG[i].Addr.lower =
+			(__u32) (addr64 & (__u64) 0x00000000FFFFFFFF);
+		cp->SG[i].Addr.upper =
+			(__u32) ((addr64 >> 32) & (__u64) 0x00000000FFFFFFFF);
+		cp->SG[i].Len = len;
+		cp->SG[i].Ext = 0;  /* we are not chaining */
+	}
+
+sglist_finished:
+
+	cp->Header.SGList = (__u8) use_sg;   /* no. SGs contig in this cmd */
+	cp->Header.SGTotal = (__u16) use_sg; /* total sgs in this cmd list */
+	return 0;
+}
+
+
+static int hpsa_scsi_queue_command(struct scsi_cmnd *cmd,
+	void (*done)(struct scsi_cmnd *))
+{
+	struct ctlr_info *h;
+	struct hpsa_scsi_dev_t *dev;
+	unsigned char scsi3addr[8];
+	struct CommandList *c;
+	unsigned long flags;
+
+	/* Get the ptr to our adapter structure out of cmd->host. */
+	h = sdev_to_hba(cmd->device);
+	dev = cmd->device->hostdata;
+	if (!dev) {
+		cmd->result = DID_NO_CONNECT << 16;
+		done(cmd);
+		return 0;
+	}
+	memcpy(scsi3addr, dev->scsi3addr, sizeof(scsi3addr));
+
+	/* Need a lock as this is being allocated from the pool */
+	spin_lock_irqsave(&h->lock, flags);
+	c = cmd_alloc(h);
+	spin_unlock_irqrestore(&h->lock, flags);
+	if (c == NULL) {			/* trouble... */
+		dev_err(&h->pdev->dev, "cmd_alloc returned NULL!\n");
+		return SCSI_MLQUEUE_HOST_BUSY;
+	}
+
+	/* Fill in the command list header */
+
+	cmd->scsi_done = done;    /* save this for use by completion code */
+
+	/* save c in case we have to abort it  */
+	cmd->host_scribble = (unsigned char *) c;
+
+	c->cmd_type = CMD_SCSI;
+	c->scsi_cmd = cmd;
+	c->Header.ReplyQueue = 0;  /* unused in simple mode */
+	memcpy(&c->Header.LUN.LunAddrBytes[0], &scsi3addr[0], 8);
+	c->Header.Tag.lower = c->busaddr;  /* Use k. address of cmd as tag */
+
+	/* Fill in the request block... */
+
+	c->Request.Timeout = 0;
+	memset(c->Request.CDB, 0, sizeof(c->Request.CDB));
+	BUG_ON(cmd->cmd_len > sizeof(c->Request.CDB));
+	c->Request.CDBLen = cmd->cmd_len;
+	memcpy(c->Request.CDB, cmd->cmnd, cmd->cmd_len);
+	c->Request.Type.Type = TYPE_CMD;
+	c->Request.Type.Attribute = ATTR_SIMPLE;
+	switch (cmd->sc_data_direction) {
+	case DMA_TO_DEVICE:
+		c->Request.Type.Direction = XFER_WRITE;
+		break;
+	case DMA_FROM_DEVICE:
+		c->Request.Type.Direction = XFER_READ;
+		break;
+	case DMA_NONE:
+		c->Request.Type.Direction = XFER_NONE;
+		break;
+	case DMA_BIDIRECTIONAL:
+		/* This can happen if a buggy application does a scsi passthru
+		 * and sets both inlen and outlen to non-zero. ( see
+		 * ../scsi/scsi_ioctl.c:scsi_ioctl_send_command() )
+		 */
+
+		c->Request.Type.Direction = XFER_RSVD;
+		/* This is technically wrong, and hpsa controllers should
+		 * reject it with CMD_INVALID, which is the most correct
+		 * response, but non-fibre backends appear to let it
+		 * slide by, and give the same results as if this field
+		 * were set correctly.  Either way is acceptable for
+		 * our purposes here.
+		 */
+
+		break;
+
+	default:
+		dev_err(&h->pdev->dev, "unknown data direction: %d\n",
+			cmd->sc_data_direction);
+		BUG();
+		break;
+	}
+
+	if (hpsa_scatter_gather(h->pdev, c, cmd) < 0) { /* Fill SG list */
+		cmd_free(h, c);
+		return SCSI_MLQUEUE_HOST_BUSY;
+	}
+	enqueue_cmd_and_start_io(h, c);
+	/* the cmd'll come back via intr handler in complete_scsi_command()  */
+	return 0;
+}
+
+static void hpsa_unregister_scsi(struct ctlr_info *h)
+{
+	/* we are being forcibly unloaded, and may not refuse. */
+	scsi_remove_host(h->scsi_host);
+	scsi_host_put(h->scsi_host);
+	h->scsi_host = NULL;
+}
+
+static int hpsa_register_scsi(struct ctlr_info *h)
+{
+	int rc;
+
+	hpsa_update_scsi_devices(h, -1);
+	rc = hpsa_scsi_detect(h);
+	if (rc != 0)
+		dev_err(&h->pdev->dev, "hpsa_register_scsi: failed"
+			" hpsa_scsi_detect(), rc is %d\n", rc);
+	return rc;
+}
+
+static int wait_for_device_to_become_ready(struct ctlr_info *h,
+	unsigned char lunaddr[])
+{
+	int rc = 0;
+	int count = 0;
+	int waittime = 1; /* seconds */
+	struct CommandList *c;
+
+	c = cmd_special_alloc(h);
+	if (!c) {
+		dev_warn(&h->pdev->dev, "out of memory in "
+			"wait_for_device_to_become_ready.\n");
+		return IO_ERROR;
+	}
+
+	/* Send test unit ready until device ready, or give up. */
+	while (count < HPSA_TUR_RETRY_LIMIT) {
+
+		/* Wait for a bit.  do this first, because if we send
+		 * the TUR right away, the reset will just abort it.
+		 */
+		msleep(1000 * waittime);
+		count++;
+
+		/* Increase wait time with each try, up to a point. */
+		if (waittime < HPSA_MAX_WAIT_INTERVAL_SECS)
+			waittime = waittime * 2;
+
+		/* Send the Test Unit Ready */
+		fill_cmd(c, TEST_UNIT_READY, h, NULL, 0, 0, lunaddr, TYPE_CMD);
+		hpsa_scsi_do_simple_cmd_core(h, c);
+		/* no unmap needed here because no data xfer. */
+
+		if (c->err_info->CommandStatus == CMD_SUCCESS)
+			break;
+
+		if (c->err_info->CommandStatus == CMD_TARGET_STATUS &&
+			c->err_info->ScsiStatus == SAM_STAT_CHECK_CONDITION &&
+			(c->err_info->SenseInfo[2] == NO_SENSE ||
+			c->err_info->SenseInfo[2] == UNIT_ATTENTION))
+			break;
+
+		dev_warn(&h->pdev->dev, "waiting %d secs "
+			"for device to become ready.\n", waittime);
+		rc = 1; /* device not ready. */
+	}
+
+	if (rc)
+		dev_warn(&h->pdev->dev, "giving up on device.\n");
+	else
+		dev_warn(&h->pdev->dev, "device is ready.\n");
+
+	cmd_special_free(h, c);
+	return rc;
+}
+
+/* Need at least one of these error handlers to keep ../scsi/hosts.c from
+ * complaining.  Doing a host- or bus-reset can't do anything good here.
+ */
+static int hpsa_eh_device_reset_handler(struct scsi_cmnd *scsicmd)
+{
+	int rc;
+	struct ctlr_info *h;
+	struct hpsa_scsi_dev_t *dev;
+
+	/* find the controller to which the command to be aborted was sent */
+	h = sdev_to_hba(scsicmd->device);
+	if (h == NULL) /* paranoia */
+		return FAILED;
+	dev_warn(&h->pdev->dev, "resetting drive\n");
+
+	dev = scsicmd->device->hostdata;
+	if (!dev) {
+		dev_err(&h->pdev->dev, "hpsa_eh_device_reset_handler: "
+			"device lookup failed.\n");
+		return FAILED;
+	}
+	/* send a reset to the SCSI LUN which the command was sent to */
+	rc = hpsa_send_reset(h, dev->scsi3addr);
+	if (rc == 0 && wait_for_device_to_become_ready(h, dev->scsi3addr) == 0)
+		return SUCCESS;
+
+	dev_warn(&h->pdev->dev, "resetting device failed.\n");
+	return FAILED;
+}
+
+/*
+ * For operations that cannot sleep, a command block is allocated at init,
+ * and managed by cmd_alloc() and cmd_free() using a simple bitmap to track
+ * which ones are free or in use.  Lock must be held when calling this.
+ * cmd_free() is the complement.
+ */
+static struct CommandList *cmd_alloc(struct ctlr_info *h)
+{
+	struct CommandList *c;
+	int i;
+	union u64bit temp64;
+	dma_addr_t cmd_dma_handle, err_dma_handle;
+
+	do {
+		i = find_first_zero_bit(h->cmd_pool_bits, h->nr_cmds);
+		if (i == h->nr_cmds)
+			return NULL;
+	} while (test_and_set_bit
+		 (i & (BITS_PER_LONG - 1),
+		  h->cmd_pool_bits + (i / BITS_PER_LONG)) != 0);
+	c = h->cmd_pool + i;
+	memset(c, 0, sizeof(*c));
+	cmd_dma_handle = h->cmd_pool_dhandle
+	    + i * sizeof(*c);
+	c->err_info = h->errinfo_pool + i;
+	memset(c->err_info, 0, sizeof(*c->err_info));
+	err_dma_handle = h->errinfo_pool_dhandle
+	    + i * sizeof(*c->err_info);
+	h->nr_allocs++;
+
+	c->cmdindex = i;
+
+	INIT_HLIST_NODE(&c->list);
+	c->busaddr = (__u32) cmd_dma_handle;
+	temp64.val = (__u64) err_dma_handle;
+	c->ErrDesc.Addr.lower = temp64.val32.lower;
+	c->ErrDesc.Addr.upper = temp64.val32.upper;
+	c->ErrDesc.Len = sizeof(*c->err_info);
+
+	c->h = h;
+	return c;
+}
+
+/* For operations that can wait for kmalloc to possibly sleep,
+ * this routine can be called. Lock need not be held to call
+ * cmd_special_alloc. cmd_special_free() is the complement.
+ */
+static struct CommandList *cmd_special_alloc(struct ctlr_info *h)
+{
+	struct CommandList *c;
+	union u64bit temp64;
+	dma_addr_t cmd_dma_handle, err_dma_handle;
+
+	c = pci_alloc_consistent(h->pdev, sizeof(*c), &cmd_dma_handle);
+	if (c == NULL)
+		return NULL;
+	memset(c, 0, sizeof(*c));
+
+	c->cmdindex = -1;
+
+	c->err_info = pci_alloc_consistent(h->pdev, sizeof(*c->err_info),
+		    &err_dma_handle);
+
+	if (c->err_info == NULL) {
+		pci_free_consistent(h->pdev,
+			sizeof(*c), c, cmd_dma_handle);
+		return NULL;
+	}
+	memset(c->err_info, 0, sizeof(*c->err_info));
+
+	INIT_HLIST_NODE(&c->list);
+	c->busaddr = (__u32) cmd_dma_handle;
+	temp64.val = (__u64) err_dma_handle;
+	c->ErrDesc.Addr.lower = temp64.val32.lower;
+	c->ErrDesc.Addr.upper = temp64.val32.upper;
+	c->ErrDesc.Len = sizeof(*c->err_info);
+
+	c->h = h;
+	return c;
+}
+
+static void cmd_free(struct ctlr_info *h, struct CommandList *c)
+{
+	int i;
+
+	i = c - h->cmd_pool;
+	clear_bit(i & (BITS_PER_LONG - 1),
+		  h->cmd_pool_bits + (i / BITS_PER_LONG));
+	h->nr_frees++;
+}
+
+static void cmd_special_free(struct ctlr_info *h, struct CommandList *c)
+{
+	union u64bit temp64;
+
+	temp64.val32.lower = c->ErrDesc.Addr.lower;
+	temp64.val32.upper = c->ErrDesc.Addr.upper;
+	pci_free_consistent(h->pdev, sizeof(*c->err_info),
+			    c->err_info, (dma_addr_t) temp64.val);
+	pci_free_consistent(h->pdev, sizeof(*c),
+			    c, (dma_addr_t) c->busaddr);
+}
+
+#ifdef CONFIG_COMPAT
+
+static int do_ioctl(struct scsi_device *dev, int cmd, void *arg)
+{
+	int ret;
+
+	lock_kernel();
+	ret = hpsa_ioctl(dev, cmd, arg);
+	unlock_kernel();
+	return ret;
+}
+
+static int hpsa_ioctl32_passthru(struct scsi_device *dev, int cmd, void *arg);
+static int hpsa_ioctl32_big_passthru(struct scsi_device *dev,
+	int cmd, void *arg);
+
+static int hpsa_compat_ioctl(struct scsi_device *dev, int cmd, void *arg)
+{
+	switch (cmd) {
+	case CCISS_GETPCIINFO:
+	case CCISS_GETINTINFO:
+	case CCISS_SETINTINFO:
+	case CCISS_GETNODENAME:
+	case CCISS_SETNODENAME:
+	case CCISS_GETHEARTBEAT:
+	case CCISS_GETBUSTYPES:
+	case CCISS_GETFIRMVER:
+	case CCISS_GETDRIVVER:
+	case CCISS_REVALIDVOLS:
+	case CCISS_DEREGDISK:
+	case CCISS_REGNEWDISK:
+	case CCISS_REGNEWD:
+	case CCISS_RESCANDISK:
+	case CCISS_GETLUNINFO:
+		return do_ioctl(dev, cmd, arg);
+
+	case CCISS_PASSTHRU32:
+		return hpsa_ioctl32_passthru(dev, cmd, arg);
+	case CCISS_BIG_PASSTHRU32:
+		return hpsa_ioctl32_big_passthru(dev, cmd, arg);
+
+	default:
+		return -ENOIOCTLCMD;
+	}
+}
+
+static int hpsa_ioctl32_passthru(struct scsi_device *dev, int cmd, void *arg)
+{
+	IOCTL32_Command_struct __user *arg32 =
+	    (IOCTL32_Command_struct __user *) arg;
+	IOCTL_Command_struct arg64;
+	IOCTL_Command_struct __user *p = compat_alloc_user_space(sizeof(arg64));
+	int err;
+	u32 cp;
+
+	err = 0;
+	err |= copy_from_user(&arg64.LUN_info, &arg32->LUN_info,
+			   sizeof(arg64.LUN_info));
+	err |= copy_from_user(&arg64.Request, &arg32->Request,
+			   sizeof(arg64.Request));
+	err |= copy_from_user(&arg64.error_info, &arg32->error_info,
+			   sizeof(arg64.error_info));
+	err |= get_user(arg64.buf_size, &arg32->buf_size);
+	err |= get_user(cp, &arg32->buf);
+	arg64.buf = compat_ptr(cp);
+	err |= copy_to_user(p, &arg64, sizeof(arg64));
+
+	if (err)
+		return -EFAULT;
+
+	err = do_ioctl(dev, CCISS_PASSTHRU, (void *)p);
+	if (err)
+		return err;
+	err |= copy_in_user(&arg32->error_info, &p->error_info,
+			 sizeof(arg32->error_info));
+	if (err)
+		return -EFAULT;
+	return err;
+}
+
+static int hpsa_ioctl32_big_passthru(struct scsi_device *dev,
+	int cmd, void *arg)
+{
+	BIG_IOCTL32_Command_struct __user *arg32 =
+	    (BIG_IOCTL32_Command_struct __user *) arg;
+	BIG_IOCTL_Command_struct arg64;
+	BIG_IOCTL_Command_struct __user *p =
+	    compat_alloc_user_space(sizeof(arg64));
+	int err;
+	u32 cp;
+
+	err = 0;
+	err |= copy_from_user(&arg64.LUN_info, &arg32->LUN_info,
+			   sizeof(arg64.LUN_info));
+	err |= copy_from_user(&arg64.Request, &arg32->Request,
+			   sizeof(arg64.Request));
+	err |= copy_from_user(&arg64.error_info, &arg32->error_info,
+			   sizeof(arg64.error_info));
+	err |= get_user(arg64.buf_size, &arg32->buf_size);
+	err |= get_user(arg64.malloc_size, &arg32->malloc_size);
+	err |= get_user(cp, &arg32->buf);
+	arg64.buf = compat_ptr(cp);
+	err |= copy_to_user(p, &arg64, sizeof(arg64));
+
+	if (err)
+		return -EFAULT;
+
+	err = do_ioctl(dev, CCISS_BIG_PASSTHRU, (void *)p);
+	if (err)
+		return err;
+	err |= copy_in_user(&arg32->error_info, &p->error_info,
+			 sizeof(arg32->error_info));
+	if (err)
+		return -EFAULT;
+	return err;
+}
+#endif
+
+static int hpsa_getpciinfo_ioctl(struct ctlr_info *h, void __user *argp)
+{
+	struct hpsa_pci_info pciinfo;
+
+	if (!argp)
+		return -EINVAL;
+	pciinfo.domain = pci_domain_nr(h->pdev->bus);
+	pciinfo.bus = h->pdev->bus->number;
+	pciinfo.dev_fn = h->pdev->devfn;
+	pciinfo.board_id = h->board_id;
+	if (copy_to_user(argp, &pciinfo, sizeof(pciinfo)))
+		return -EFAULT;
+	return 0;
+}
+
+static int hpsa_getdrivver_ioctl(struct ctlr_info *h, void __user *argp)
+{
+	DriverVer_type DriverVer;
+	unsigned char vmaj, vmin, vsubmin;
+	int rc;
+
+	rc = sscanf(HPSA_DRIVER_VERSION, "%hhu.%hhu.%hhu",
+		&vmaj, &vmin, &vsubmin);
+	if (rc != 3) {
+		dev_info(&h->pdev->dev, "driver version string '%s' "
+			"unrecognized.", HPSA_DRIVER_VERSION);
+		vmaj = 0;
+		vmin = 0;
+		vsubmin = 0;
+	}
+	DriverVer = (vmaj << 16) | (vmin << 8) | vsubmin;
+	if (!argp)
+		return -EINVAL;
+	if (copy_to_user(argp, &DriverVer, sizeof(DriverVer_type)))
+		return -EFAULT;
+	return 0;
+}
+
+static int hpsa_passthru_ioctl(struct ctlr_info *h, void __user *argp)
+{
+	IOCTL_Command_struct iocommand;
+	struct CommandList *c;
+	char *buff = NULL;
+	union u64bit temp64;
+
+	if (!argp)
+		return -EINVAL;
+	if (!capable(CAP_SYS_RAWIO))
+		return -EPERM;
+	if (copy_from_user(&iocommand, argp, sizeof(iocommand)))
+		return -EFAULT;
+	if ((iocommand.buf_size < 1) &&
+	    (iocommand.Request.Type.Direction != XFER_NONE)) {
+		return -EINVAL;
+	}
+	if (iocommand.buf_size > 0) {
+		buff = kmalloc(iocommand.buf_size, GFP_KERNEL);
+		if (buff == NULL)
+			return -EFAULT;
+	}
+	if (iocommand.Request.Type.Direction == XFER_WRITE) {
+		/* Copy the data into the buffer we created */
+		if (copy_from_user(buff, iocommand.buf, iocommand.buf_size)) {
+			kfree(buff);
+			return -EFAULT;
+		}
+	} else
+		memset(buff, 0, iocommand.buf_size);
+	c = cmd_special_alloc(h);
+	if (c == NULL) {
+		kfree(buff);
+		return -ENOMEM;
+	}
+	/* Fill in the command type */
+	c->cmd_type = CMD_IOCTL_PEND;
+	/* Fill in Command Header */
+	c->Header.ReplyQueue = 0; /* unused in simple mode */
+	if (iocommand.buf_size > 0) {	/* buffer to fill */
+		c->Header.SGList = 1;
+		c->Header.SGTotal = 1;
+	} else	{ /* no buffers to fill */
+		c->Header.SGList = 0;
+		c->Header.SGTotal = 0;
+	}
+	memcpy(&c->Header.LUN, &iocommand.LUN_info, sizeof(c->Header.LUN));
+	/* use the kernel address the cmd block for tag */
+	c->Header.Tag.lower = c->busaddr;
+
+	/* Fill in Request block */
+	memcpy(&c->Request, &iocommand.Request,
+		sizeof(c->Request));
+
+	/* Fill in the scatter gather information */
+	if (iocommand.buf_size > 0) {
+		temp64.val = pci_map_single(h->pdev, buff,
+			iocommand.buf_size, PCI_DMA_BIDIRECTIONAL);
+		c->SG[0].Addr.lower = temp64.val32.lower;
+		c->SG[0].Addr.upper = temp64.val32.upper;
+		c->SG[0].Len = iocommand.buf_size;
+		c->SG[0].Ext = 0; /* we are not chaining*/
+	}
+	hpsa_scsi_do_simple_cmd_core(h, c);
+	hpsa_pci_unmap(h->pdev, c, 1, PCI_DMA_BIDIRECTIONAL);
+	check_ioctl_unit_attention(h, c);
+
+	/* Copy the error information out */
+	memcpy(&iocommand.error_info, c->err_info,
+		sizeof(iocommand.error_info));
+	if (copy_to_user(argp, &iocommand, sizeof(iocommand))) {
+		kfree(buff);
+		cmd_special_free(h, c);
+		return -EFAULT;
+	}
+
+	if (iocommand.Request.Type.Direction == XFER_READ) {
+		/* Copy the data out of the buffer we created */
+		if (copy_to_user(iocommand.buf, buff, iocommand.buf_size)) {
+			kfree(buff);
+			cmd_special_free(h, c);
+			return -EFAULT;
+		}
+	}
+	kfree(buff);
+	cmd_special_free(h, c);
+	return 0;
+}
+
+static int hpsa_big_passthru_ioctl(struct ctlr_info *h, void __user *argp)
+{
+	BIG_IOCTL_Command_struct *ioc;
+	struct CommandList *c;
+	unsigned char **buff = NULL;
+	int *buff_size = NULL;
+	union u64bit temp64;
+	BYTE sg_used = 0;
+	int status = 0;
+	int i;
+	__u32 left;
+	__u32 sz;
+	BYTE __user *data_ptr;
+
+	if (!argp)
+		return -EINVAL;
+	if (!capable(CAP_SYS_RAWIO))
+		return -EPERM;
+	ioc = (BIG_IOCTL_Command_struct *)
+	    kmalloc(sizeof(*ioc), GFP_KERNEL);
+	if (!ioc) {
+		status = -ENOMEM;
+		goto cleanup1;
+	}
+	if (copy_from_user(ioc, argp, sizeof(*ioc))) {
+		status = -EFAULT;
+		goto cleanup1;
+	}
+	if ((ioc->buf_size < 1) &&
+	    (ioc->Request.Type.Direction != XFER_NONE)) {
+		status = -EINVAL;
+		goto cleanup1;
+	}
+	/* Check kmalloc limits  using all SGs */
+	if (ioc->malloc_size > MAX_KMALLOC_SIZE) {
+		status = -EINVAL;
+		goto cleanup1;
+	}
+	if (ioc->buf_size > ioc->malloc_size * MAXSGENTRIES) {
+		status = -EINVAL;
+		goto cleanup1;
+	}
+	buff = kzalloc(MAXSGENTRIES * sizeof(char *), GFP_KERNEL);
+	if (!buff) {
+		status = -ENOMEM;
+		goto cleanup1;
+	}
+	buff_size = kmalloc(MAXSGENTRIES * sizeof(int), GFP_KERNEL);
+	if (!buff_size) {
+		status = -ENOMEM;
+		goto cleanup1;
+	}
+	left = ioc->buf_size;
+	data_ptr = ioc->buf;
+	while (left) {
+		sz = (left > ioc->malloc_size) ? ioc->malloc_size : left;
+		buff_size[sg_used] = sz;
+		buff[sg_used] = kmalloc(sz, GFP_KERNEL);
+		if (buff[sg_used] == NULL) {
+			status = -ENOMEM;
+			goto cleanup1;
+		}
+		if (ioc->Request.Type.Direction == XFER_WRITE) {
+			if (copy_from_user(buff[sg_used], data_ptr, sz)) {
+				status = -ENOMEM;
+				goto cleanup1;
+			}
+		} else
+			memset(buff[sg_used], 0, sz);
+		left -= sz;
+		data_ptr += sz;
+		sg_used++;
+	}
+	c = cmd_special_alloc(h);
+	if (c == NULL) {
+		status = -ENOMEM;
+		goto cleanup1;
+	}
+	c->cmd_type = CMD_IOCTL_PEND;
+	c->Header.ReplyQueue = 0;
+
+	if (ioc->buf_size > 0) {
+		c->Header.SGList = sg_used;
+		c->Header.SGTotal = sg_used;
+	} else {
+		c->Header.SGList = 0;
+		c->Header.SGTotal = 0;
+	}
+	memcpy(&c->Header.LUN, &ioc->LUN_info, sizeof(c->Header.LUN));
+	c->Header.Tag.lower = c->busaddr;
+	memcpy(&c->Request, &ioc->Request, sizeof(c->Request));
+	if (ioc->buf_size > 0) {
+		int i;
+		for (i = 0; i < sg_used; i++) {
+			temp64.val = pci_map_single(h->pdev, buff[i],
+				    buff_size[i], PCI_DMA_BIDIRECTIONAL);
+			c->SG[i].Addr.lower = temp64.val32.lower;
+			c->SG[i].Addr.upper = temp64.val32.upper;
+			c->SG[i].Len = buff_size[i];
+			/* we are not chaining */
+			c->SG[i].Ext = 0;
+		}
+	}
+	hpsa_scsi_do_simple_cmd_core(h, c);
+	hpsa_pci_unmap(h->pdev, c, sg_used, PCI_DMA_BIDIRECTIONAL);
+	check_ioctl_unit_attention(h, c);
+	/* Copy the error information out */
+	memcpy(&ioc->error_info, c->err_info, sizeof(ioc->error_info));
+	if (copy_to_user(argp, ioc, sizeof(*ioc))) {
+		cmd_special_free(h, c);
+		status = -EFAULT;
+		goto cleanup1;
+	}
+	if (ioc->Request.Type.Direction == XFER_READ) {
+		/* Copy the data out of the buffer we created */
+		BYTE __user *ptr = ioc->buf;
+		for (i = 0; i < sg_used; i++) {
+			if (copy_to_user(ptr, buff[i], buff_size[i])) {
+				cmd_special_free(h, c);
+				status = -EFAULT;
+				goto cleanup1;
+			}
+			ptr += buff_size[i];
+		}
+	}
+	cmd_special_free(h, c);
+	status = 0;
+cleanup1:
+	if (buff) {
+		for (i = 0; i < sg_used; i++)
+			kfree(buff[i]);
+		kfree(buff);
+	}
+	kfree(buff_size);
+	kfree(ioc);
+	return status;
+}
+
+static void check_ioctl_unit_attention(struct ctlr_info *h,
+	struct CommandList *c)
+{
+	if (c->err_info->CommandStatus == CMD_TARGET_STATUS &&
+			c->err_info->ScsiStatus != SAM_STAT_CHECK_CONDITION)
+		(void) check_for_unit_attention(h, c);
+}
+/*
+ * ioctl
+ */
+static int hpsa_ioctl(struct scsi_device *dev, int cmd, void *arg)
+{
+	struct ctlr_info *h;
+	void __user *argp = (void __user *)arg;
+
+	h = sdev_to_hba(dev);
+
+	switch (cmd) {
+	case CCISS_DEREGDISK:
+	case CCISS_REGNEWDISK:
+	case CCISS_REGNEWD:
+		hpsa_update_scsi_devices(h, dev->host->host_no);
+		return 0;
+	case CCISS_GETPCIINFO:
+		return hpsa_getpciinfo_ioctl(h, argp);
+	case CCISS_GETDRIVVER:
+		return hpsa_getdrivver_ioctl(h, argp);
+	case CCISS_PASSTHRU:
+		return hpsa_passthru_ioctl(h, argp);
+	case CCISS_BIG_PASSTHRU:
+		return hpsa_big_passthru_ioctl(h, argp);
+	default:
+		return -ENOTTY;
+	}
+}
+
+static void fill_cmd(struct CommandList *c, __u8 cmd, struct ctlr_info *h,
+	void *buff, size_t size, __u8 page_code, unsigned char *scsi3addr,
+	int cmd_type)
+{
+	int pci_dir = XFER_NONE;
+
+	c->cmd_type = CMD_IOCTL_PEND;
+	c->Header.ReplyQueue = 0;
+	if (buff != NULL && size > 0) {
+		c->Header.SGList = 1;
+		c->Header.SGTotal = 1;
+	} else {
+		c->Header.SGList = 0;
+		c->Header.SGTotal = 0;
+	}
+	c->Header.Tag.lower = c->busaddr;
+	memcpy(c->Header.LUN.LunAddrBytes, scsi3addr, 8);
+
+	c->Request.Type.Type = cmd_type;
+	if (cmd_type == TYPE_CMD) {
+		switch (cmd) {
+		case HPSA_INQUIRY:
+			/* are we trying to read a vital product page */
+			if (page_code != 0) {
+				c->Request.CDB[1] = 0x01;
+				c->Request.CDB[2] = page_code;
+			}
+			c->Request.CDBLen = 6;
+			c->Request.Type.Attribute = ATTR_SIMPLE;
+			c->Request.Type.Direction = XFER_READ;
+			c->Request.Timeout = 0;
+			c->Request.CDB[0] = HPSA_INQUIRY;
+			c->Request.CDB[4] = size & 0xFF;
+			break;
+		case HPSA_REPORT_LOG:
+		case HPSA_REPORT_PHYS:
+			/* Talking to controller so It's a physical command
+			   mode = 00 target = 0.  Nothing to write.
+			 */
+			c->Request.CDBLen = 12;
+			c->Request.Type.Attribute = ATTR_SIMPLE;
+			c->Request.Type.Direction = XFER_READ;
+			c->Request.Timeout = 0;
+			c->Request.CDB[0] = cmd;
+			c->Request.CDB[6] = (size >> 24) & 0xFF; /* MSB */
+			c->Request.CDB[7] = (size >> 16) & 0xFF;
+			c->Request.CDB[8] = (size >> 8) & 0xFF;
+			c->Request.CDB[9] = size & 0xFF;
+			break;
+
+		case HPSA_READ_CAPACITY:
+			c->Request.CDBLen = 10;
+			c->Request.Type.Attribute = ATTR_SIMPLE;
+			c->Request.Type.Direction = XFER_READ;
+			c->Request.Timeout = 0;
+			c->Request.CDB[0] = cmd;
+			break;
+		case HPSA_CACHE_FLUSH:
+			c->Request.CDBLen = 12;
+			c->Request.Type.Attribute = ATTR_SIMPLE;
+			c->Request.Type.Direction = XFER_WRITE;
+			c->Request.Timeout = 0;
+			c->Request.CDB[0] = BMIC_WRITE;
+			c->Request.CDB[6] = BMIC_CACHE_FLUSH;
+			break;
+		case TEST_UNIT_READY:
+			c->Request.CDBLen = 6;
+			c->Request.Type.Attribute = ATTR_SIMPLE;
+			c->Request.Type.Direction = XFER_NONE;
+			c->Request.Timeout = 0;
+			break;
+		default:
+			dev_warn(&h->pdev->dev, "unknown command 0x%c\n", cmd);
+			BUG();
+			return;
+		}
+	} else if (cmd_type == TYPE_MSG) {
+		switch (cmd) {
+
+		case  HPSA_DEVICE_RESET_MSG:
+			c->Request.CDBLen = 16;
+			c->Request.Type.Type =  1; /* It is a MSG not a CMD */
+			c->Request.Type.Attribute = ATTR_SIMPLE;
+			c->Request.Type.Direction = XFER_NONE;
+			c->Request.Timeout = 0; /* Don't time out */
+			c->Request.CDB[0] =  0x01; /* RESET_MSG is 0x01 */
+			c->Request.CDB[1] = 0x03;  /* Reset target above */
+			/* If bytes 4-7 are zero, it means reset the */
+			/* LunID device */
+			c->Request.CDB[4] = 0x00;
+			c->Request.CDB[5] = 0x00;
+			c->Request.CDB[6] = 0x00;
+			c->Request.CDB[7] = 0x00;
+		break;
+
+		default:
+			dev_warn(&h->pdev->dev, "unknown message type %d\n",
+				cmd);
+			BUG();
+		}
+	} else {
+		dev_warn(&h->pdev->dev, "unknown command type %d\n", cmd_type);
+		BUG();
+	}
+
+	switch (c->Request.Type.Direction) {
+	case XFER_READ:
+		pci_dir = PCI_DMA_FROMDEVICE;
+		break;
+	case XFER_WRITE:
+		pci_dir = PCI_DMA_TODEVICE;
+		break;
+	case XFER_NONE:
+		pci_dir = PCI_DMA_NONE;
+		break;
+	default:
+		pci_dir = PCI_DMA_BIDIRECTIONAL;
+	}
+
+	hpsa_map_one(h->pdev, c, buff, size, pci_dir);
+
+	return;
+}
+
+/*
+ * Map (physical) PCI mem into (virtual) kernel space
+ */
+static void __iomem *remap_pci_mem(ulong base, ulong size)
+{
+	ulong page_base = ((ulong) base) & PAGE_MASK;
+	ulong page_offs = ((ulong) base) - page_base;
+	void __iomem *page_remapped = ioremap(page_base, page_offs + size);
+
+	return page_remapped ? (page_remapped + page_offs) : NULL;
+}
+
+/* Takes cmds off the submission queue and sends them to the hardware,
+ * then puts them on the queue of cmds waiting for completion.
+ */
+static void start_io(struct ctlr_info *h)
+{
+	struct CommandList *c;
+
+	while (!hlist_empty(&h->reqQ)) {
+		c = hlist_entry(h->reqQ.first, struct CommandList, list);
+		/* can't do anything if fifo is full */
+		if ((h->access.fifo_full(h))) {
+			dev_warn(&h->pdev->dev, "fifo full\n");
+			break;
+		}
+
+		/* Get the first entry from the Request Q */
+		removeQ(c);
+		h->Qdepth--;
+
+		/* Tell the controller execute command */
+		h->access.submit_command(h, c);
+
+		/* Put job onto the completed Q */
+		addQ(&h->cmpQ, c);
+	}
+}
+
+static inline unsigned long get_next_completion(struct ctlr_info *h)
+{
+	return h->access.command_completed(h);
+}
+
+static inline int interrupt_pending(struct ctlr_info *h)
+{
+	return h->access.intr_pending(h);
+}
+
+static inline long interrupt_not_for_us(struct ctlr_info *h)
+{
+	return ((h->access.intr_pending(h) == 0) ||
+		 (h->interrupts_enabled == 0));
+}
+
+static inline int bad_tag(struct ctlr_info *h, __u32 tag_index,
+	__u32 raw_tag)
+{
+	if (unlikely(tag_index >= h->nr_cmds)) {
+		dev_warn(&h->pdev->dev, "bad tag 0x%08x ignored.\n", raw_tag);
+		return 1;
+	}
+	return 0;
+}
+
+static inline void finish_cmd(struct CommandList *c, __u32 raw_tag)
+{
+	removeQ(c);
+	if (likely(c->cmd_type == CMD_SCSI))
+		complete_scsi_command(c, 0, raw_tag);
+	else if (c->cmd_type == CMD_IOCTL_PEND)
+		complete(c->waiting);
+}
+
+static irqreturn_t do_hpsa_intr(int irq, void *dev_id)
+{
+	struct ctlr_info *h = dev_id;
+	struct CommandList *c;
+	unsigned long flags;
+	__u32 raw_tag, tag, tag_index;
+	struct hlist_node *tmp;
+
+	if (interrupt_not_for_us(h))
+		return IRQ_NONE;
+	spin_lock_irqsave(&h->lock, flags);
+	while (interrupt_pending(h)) {
+		while ((raw_tag = get_next_completion(h)) != FIFO_EMPTY) {
+			if (likely(HPSA_TAG_CONTAINS_INDEX(raw_tag))) {
+				tag_index = HPSA_TAG_TO_INDEX(raw_tag);
+				if (bad_tag(h, tag_index, raw_tag))
+					return IRQ_HANDLED;
+				c = h->cmd_pool + tag_index;
+				finish_cmd(c, raw_tag);
+				continue;
+			}
+			tag = HPSA_TAG_DISCARD_ERROR_BITS(raw_tag);
+			c = NULL;
+			hlist_for_each_entry(c, tmp, &h->cmpQ, list) {
+				if (c->busaddr == tag) {
+					finish_cmd(c, raw_tag);
+					break;
+				}
+			}
+		}
+	}
+	spin_unlock_irqrestore(&h->lock, flags);
+	return IRQ_HANDLED;
+}
+
+/* Send a message CDB to the firmware. */
+static __devinit int hpsa_message(struct pci_dev *pdev, unsigned char opcode,
+						unsigned char type)
+{
+	struct Command {
+		struct CommandListHeader CommandHeader;
+		struct RequestBlock Request;
+		struct ErrDescriptor ErrorDescriptor;
+	};
+	struct Command *cmd;
+	static const size_t cmd_sz = sizeof(*cmd) +
+					sizeof(cmd->ErrorDescriptor);
+	dma_addr_t paddr64;
+	uint32_t paddr32, tag;
+	void __iomem *vaddr;
+	int i, err;
+
+	vaddr = pci_ioremap_bar(pdev, 0);
+	if (vaddr == NULL)
+		return -ENOMEM;
+
+	/* The Inbound Post Queue only accepts 32-bit physical addresses for the
+	 * CCISS commands, so they must be allocated from the lower 4GiB of
+	 * memory.
+	 */
+	err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32));
+	if (err) {
+		iounmap(vaddr);
+		return -ENOMEM;
+	}
+
+	cmd = pci_alloc_consistent(pdev, cmd_sz, &paddr64);
+	if (cmd == NULL) {
+		iounmap(vaddr);
+		return -ENOMEM;
+	}
+
+	/* This must fit, because of the 32-bit consistent DMA mask.  Also,
+	 * although there's no guarantee, we assume that the address is at
+	 * least 4-byte aligned (most likely, it's page-aligned).
+	 */
+	paddr32 = paddr64;
+
+	cmd->CommandHeader.ReplyQueue = 0;
+	cmd->CommandHeader.SGList = 0;
+	cmd->CommandHeader.SGTotal = 0;
+	cmd->CommandHeader.Tag.lower = paddr32;
+	cmd->CommandHeader.Tag.upper = 0;
+	memset(&cmd->CommandHeader.LUN.LunAddrBytes, 0, 8);
+
+	cmd->Request.CDBLen = 16;
+	cmd->Request.Type.Type = TYPE_MSG;
+	cmd->Request.Type.Attribute = ATTR_HEADOFQUEUE;
+	cmd->Request.Type.Direction = XFER_NONE;
+	cmd->Request.Timeout = 0; /* Don't time out */
+	cmd->Request.CDB[0] = opcode;
+	cmd->Request.CDB[1] = type;
+	memset(&cmd->Request.CDB[2], 0, 14); /* rest of the CDB is reserved */
+	cmd->ErrorDescriptor.Addr.lower = paddr32 + sizeof(*cmd);
+	cmd->ErrorDescriptor.Addr.upper = 0;
+	cmd->ErrorDescriptor.Len = sizeof(struct ErrorInfo);
+
+	writel(paddr32, vaddr + SA5_REQUEST_PORT_OFFSET);
+
+	for (i = 0; i < HPSA_MSG_SEND_RETRY_LIMIT; i++) {
+		tag = readl(vaddr + SA5_REPLY_PORT_OFFSET);
+		if (HPSA_TAG_DISCARD_ERROR_BITS(tag) == paddr32)
+			break;
+		msleep(HPSA_MSG_SEND_RETRY_INTERVAL_MSECS);
+	}
+
+	iounmap(vaddr);
+
+	/* we leak the DMA buffer here ... no choice since the controller could
+	 *  still complete the command.
+	 */
+	if (i == HPSA_MSG_SEND_RETRY_LIMIT) {
+		dev_err(&pdev->dev, "controller message %02x:%02x timed out\n",
+			opcode, type);
+		return -ETIMEDOUT;
+	}
+
+	pci_free_consistent(pdev, cmd_sz, cmd, paddr64);
+
+	if (tag & HPSA_ERROR_BIT) {
+		dev_err(&pdev->dev, "controller message %02x:%02x failed\n",
+			opcode, type);
+		return -EIO;
+	}
+
+	dev_info(&pdev->dev, "controller message %02x:%02x succeeded\n",
+		opcode, type);
+	return 0;
+}
+
+#define hpsa_soft_reset_controller(p) hpsa_message(p, 1, 0)
+#define hpsa_noop(p) hpsa_message(p, 3, 0)
+
+static __devinit int hpsa_reset_msi(struct pci_dev *pdev)
+{
+/* the #defines are stolen from drivers/pci/msi.h. */
+#define msi_control_reg(base)		(base + PCI_MSI_FLAGS)
+#define PCI_MSIX_FLAGS_ENABLE		(1 << 15)
+
+	int pos;
+	u16 control = 0;
+
+	pos = pci_find_capability(pdev, PCI_CAP_ID_MSI);
+	if (pos) {
+		pci_read_config_word(pdev, msi_control_reg(pos), &control);
+		if (control & PCI_MSI_FLAGS_ENABLE) {
+			dev_info(&pdev->dev, "resetting MSI\n");
+			pci_write_config_word(pdev, msi_control_reg(pos),
+					control & ~PCI_MSI_FLAGS_ENABLE);
+		}
+	}
+
+	pos = pci_find_capability(pdev, PCI_CAP_ID_MSIX);
+	if (pos) {
+		pci_read_config_word(pdev, msi_control_reg(pos), &control);
+		if (control & PCI_MSIX_FLAGS_ENABLE) {
+			dev_info(&pdev->dev, "resetting MSI-X\n");
+			pci_write_config_word(pdev, msi_control_reg(pos),
+					control & ~PCI_MSIX_FLAGS_ENABLE);
+		}
+	}
+
+	return 0;
+}
+
+/* This does a hard reset of the controller using PCI power management
+ * states.
+ */
+static __devinit int hpsa_hard_reset_controller(struct pci_dev *pdev)
+{
+	u16 pmcsr, saved_config_space[32];
+	int i, pos;
+
+	dev_info(&pdev->dev, "using PCI PM to reset controller\n");
+
+	/* This is very nearly the same thing as
+	 *
+	 * pci_save_state(pci_dev);
+	 * pci_set_power_state(pci_dev, PCI_D3hot);
+	 * pci_set_power_state(pci_dev, PCI_D0);
+	 * pci_restore_state(pci_dev);
+	 *
+	 * but we can't use these nice canned kernel routines on
+	 * kexec, because they also check the MSI/MSI-X state in PCI
+	 * configuration space and do the wrong thing when it is
+	 * set/cleared.  Also, the pci_save/restore_state functions
+	 * violate the ordering requirements for restoring the
+	 * configuration space from the CCISS document (see the
+	 * comment below).  So we roll our own ....
+	 */
+
+	for (i = 0; i < 32; i++)
+		pci_read_config_word(pdev, 2*i, &saved_config_space[i]);
+
+	pos = pci_find_capability(pdev, PCI_CAP_ID_PM);
+	if (pos == 0) {
+		dev_err(&pdev->dev,
+			"hpsa_reset_controller: PCI PM not supported\n");
+		return -ENODEV;
+	}
+
+	/* Quoting from the Open CISS Specification: "The Power
+	 * Management Control/Status Register (CSR) controls the power
+	 * state of the device.  The normal operating state is D0,
+	 * CSR=00h.  The software off state is D3, CSR=03h.  To reset
+	 * the controller, place the interface device in D3 then to
+	 * D0, this causes a secondary PCI reset which will reset the
+	 * controller."
+	 */
+
+	/* enter the D3hot power management state */
+	pci_read_config_word(pdev, pos + PCI_PM_CTRL, &pmcsr);
+	pmcsr &= ~PCI_PM_CTRL_STATE_MASK;
+	pmcsr |= PCI_D3hot;
+	pci_write_config_word(pdev, pos + PCI_PM_CTRL, pmcsr);
+
+	msleep(500);
+
+	/* enter the D0 power management state */
+	pmcsr &= ~PCI_PM_CTRL_STATE_MASK;
+	pmcsr |= PCI_D0;
+	pci_write_config_word(pdev, pos + PCI_PM_CTRL, pmcsr);
+
+	msleep(500);
+
+	/* Restore the PCI configuration space.  The Open CISS
+	 * Specification says, "Restore the PCI Configuration
+	 * Registers, offsets 00h through 60h. It is important to
+	 * restore the command register, 16-bits at offset 04h,
+	 * last. Do not restore the configuration status register,
+	 * 16-bits at offset 06h."  Note that the offset is 2*i.
+	 */
+	for (i = 0; i < 32; i++) {
+		if (i == 2 || i == 3)
+			continue;
+		pci_write_config_word(pdev, 2*i, saved_config_space[i]);
+	}
+	wmb();
+	pci_write_config_word(pdev, 4, saved_config_space[2]);
+
+	return 0;
+}
+
+/*
+ *  We cannot read the structure directly, for portability we must use
+ *   the io functions.
+ *   This is for debug only.
+ */
+#ifdef HPSA_DEBUG
+static void print_cfg_table(struct device *dev, struct CfgTable *tb)
+{
+	int i;
+	char temp_name[17];
+
+	dev_info(dev, "Controller Configuration information\n");
+	dev_info(dev, "------------------------------------\n");
+	for (i = 0; i < 4; i++)
+		temp_name[i] = readb(&(tb->Signature[i]));
+	temp_name[4] = '\0';
+	dev_info(dev, "   Signature = %s\n", temp_name);
+	dev_info(dev, "   Spec Number = %d\n", readl(&(tb->SpecValence)));
+	dev_info(dev, "   Transport methods supported = 0x%x\n",
+	       readl(&(tb->TransportSupport)));
+	dev_info(dev, "   Transport methods active = 0x%x\n",
+	       readl(&(tb->TransportActive)));
+	dev_info(dev, "   Requested transport Method = 0x%x\n",
+	       readl(&(tb->HostWrite.TransportRequest)));
+	dev_info(dev, "   Coalesce Interrupt Delay = 0x%x\n",
+	       readl(&(tb->HostWrite.CoalIntDelay)));
+	dev_info(dev, "   Coalesce Interrupt Count = 0x%x\n",
+	       readl(&(tb->HostWrite.CoalIntCount)));
+	dev_info(dev, "   Max outstanding commands = 0x%d\n",
+	       readl(&(tb->CmdsOutMax)));
+	dev_info(dev, "   Bus Types = 0x%x\n", readl(&(tb->BusTypes)));
+	for (i = 0; i < 16; i++)
+		temp_name[i] = readb(&(tb->ServerName[i]));
+	temp_name[16] = '\0';
+	dev_info(dev, "   Server Name = %s\n", temp_name);
+	dev_info(dev, "   Heartbeat Counter = 0x%x\n\n\n",
+		readl(&(tb->HeartBeat)));
+}
+#endif				/* HPSA_DEBUG */
+
+static int find_PCI_BAR_index(struct pci_dev *pdev, unsigned long pci_bar_addr)
+{
+	int i, offset, mem_type, bar_type;
+
+	if (pci_bar_addr == PCI_BASE_ADDRESS_0)	/* looking for BAR zero? */
+		return 0;
+	offset = 0;
+	for (i = 0; i < DEVICE_COUNT_RESOURCE; i++) {
+		bar_type = pci_resource_flags(pdev, i) & PCI_BASE_ADDRESS_SPACE;
+		if (bar_type == PCI_BASE_ADDRESS_SPACE_IO)
+			offset += 4;
+		else {
+			mem_type = pci_resource_flags(pdev, i) &
+			    PCI_BASE_ADDRESS_MEM_TYPE_MASK;
+			switch (mem_type) {
+			case PCI_BASE_ADDRESS_MEM_TYPE_32:
+			case PCI_BASE_ADDRESS_MEM_TYPE_1M:
+				offset += 4;	/* 32 bit */
+				break;
+			case PCI_BASE_ADDRESS_MEM_TYPE_64:
+				offset += 8;
+				break;
+			default:	/* reserved in PCI 2.2 */
+				dev_warn(&pdev->dev,
+				       "base address is invalid\n");
+				return -1;
+				break;
+			}
+		}
+		if (offset == pci_bar_addr - PCI_BASE_ADDRESS_0)
+			return i + 1;
+	}
+	return -1;
+}
+
+/* If MSI/MSI-X is supported by the kernel we will try to enable it on
+ * controllers that are capable. If not, we use IO-APIC mode.
+ */
+
+static void __devinit hpsa_interrupt_mode(struct ctlr_info *h,
+					   struct pci_dev *pdev, __u32 board_id)
+{
+#ifdef CONFIG_PCI_MSI
+	int err;
+	struct msix_entry hpsa_msix_entries[4] = { {0, 0}, {0, 1},
+	{0, 2}, {0, 3}
+	};
+
+	/* Some boards advertise MSI but don't really support it */
+	if ((board_id == 0x40700E11) ||
+	    (board_id == 0x40800E11) ||
+	    (board_id == 0x40820E11) || (board_id == 0x40830E11))
+		goto default_int_mode;
+	if (pci_find_capability(pdev, PCI_CAP_ID_MSIX)) {
+		dev_info(&pdev->dev, "MSIX\n");
+		err = pci_enable_msix(pdev, hpsa_msix_entries, 4);
+		if (!err) {
+			h->intr[0] = hpsa_msix_entries[0].vector;
+			h->intr[1] = hpsa_msix_entries[1].vector;
+			h->intr[2] = hpsa_msix_entries[2].vector;
+			h->intr[3] = hpsa_msix_entries[3].vector;
+			h->msix_vector = 1;
+			return;
+		}
+		if (err > 0) {
+			dev_warn(&pdev->dev, "only %d MSI-X vectors "
+			       "available\n", err);
+			goto default_int_mode;
+		} else {
+			dev_warn(&pdev->dev, "MSI-X init failed %d\n",
+			       err);
+			goto default_int_mode;
+		}
+	}
+	if (pci_find_capability(pdev, PCI_CAP_ID_MSI)) {
+		dev_info(&pdev->dev, "MSI\n");
+		if (!pci_enable_msi(pdev))
+			h->msi_vector = 1;
+		else
+			dev_warn(&pdev->dev, "MSI init failed\n");
+	}
+default_int_mode:
+#endif				/* CONFIG_PCI_MSI */
+	/* if we get here we're going to use the default interrupt mode */
+	h->intr[SIMPLE_MODE_INT] = pdev->irq;
+	return;
+}
+
+static int hpsa_pci_init(struct ctlr_info *h, struct pci_dev *pdev)
+{
+	ushort subsystem_vendor_id, subsystem_device_id, command;
+	__u32 board_id, scratchpad = 0;
+	__u64 cfg_offset;
+	__u32 cfg_base_addr;
+	__u64 cfg_base_addr_index;
+	int i, prod_index, err;
+
+	subsystem_vendor_id = pdev->subsystem_vendor;
+	subsystem_device_id = pdev->subsystem_device;
+	board_id = (((__u32) (subsystem_device_id << 16) & 0xffff0000) |
+		    subsystem_vendor_id);
+
+	for (i = 0; i < ARRAY_SIZE(products); i++)
+		if (board_id == products[i].board_id)
+			break;
+
+	prod_index = i;
+
+	if (prod_index == ARRAY_SIZE(products)) {
+		prod_index--;
+		if (subsystem_vendor_id != PCI_VENDOR_ID_HP ||
+				!hpsa_allow_any) {
+			dev_warn(&pdev->dev, "unrecognized board ID:"
+				" 0x%08lx, ignoring.\n",
+				(unsigned long) board_id);
+			return -ENODEV;
+		}
+	}
+	/* check to see if controller has been disabled
+	 * BEFORE trying to enable it
+	 */
+	(void)pci_read_config_word(pdev, PCI_COMMAND, &command);
+	if (!(command & 0x02)) {
+		dev_warn(&pdev->dev, "controller appears to be disabled\n");
+		return -ENODEV;
+	}
+
+	err = pci_enable_device(pdev);
+	if (err) {
+		dev_warn(&pdev->dev, "unable to enable PCI device\n");
+		return err;
+	}
+
+	err = pci_request_regions(pdev, "hpsa");
+	if (err) {
+		dev_err(&pdev->dev, "cannot obtain PCI resources, aborting\n");
+		return err;
+	}
+
+	/* If the kernel supports MSI/MSI-X we will try to enable that,
+	 * else we use the IO-APIC interrupt assigned to us by system ROM.
+	 */
+	hpsa_interrupt_mode(h, pdev, board_id);
+
+	/* find the memory BAR */
+	for (i = 0; i < DEVICE_COUNT_RESOURCE; i++) {
+		if (pci_resource_flags(pdev, i) & IORESOURCE_MEM)
+			break;
+	}
+	if (i == DEVICE_COUNT_RESOURCE) {
+		dev_warn(&pdev->dev, "no memory BAR found\n");
+		err = -ENODEV;
+		goto err_out_free_res;
+	}
+
+	h->paddr = pci_resource_start(pdev, i); /* addressing mode bits
+						 * already removed
+						 */
+
+	h->vaddr = remap_pci_mem(h->paddr, 0x250);
+
+	/* Wait for the board to become ready.  */
+	for (i = 0; i < HPSA_BOARD_READY_ITERATIONS; i++) {
+		scratchpad = readl(h->vaddr + SA5_SCRATCHPAD_OFFSET);
+		if (scratchpad == HPSA_FIRMWARE_READY)
+			break;
+		msleep(HPSA_BOARD_READY_POLL_INTERVAL_MSECS);
+	}
+	if (scratchpad != HPSA_FIRMWARE_READY) {
+		dev_warn(&pdev->dev, "board not ready, timed out.\n");
+		err = -ENODEV;
+		goto err_out_free_res;
+	}
+
+	/* get the address index number */
+	cfg_base_addr = readl(h->vaddr + SA5_CTCFG_OFFSET);
+	cfg_base_addr &= (__u32) 0x0000ffff;
+	cfg_base_addr_index = find_PCI_BAR_index(pdev, cfg_base_addr);
+	if (cfg_base_addr_index == -1) {
+		dev_warn(&pdev->dev, "cannot find cfg_base_addr_index\n");
+		err = -ENODEV;
+		goto err_out_free_res;
+	}
+
+	cfg_offset = readl(h->vaddr + SA5_CTMEM_OFFSET);
+	h->cfgtable = remap_pci_mem(pci_resource_start(pdev,
+			       cfg_base_addr_index) + cfg_offset,
+				sizeof(h->cfgtable));
+	h->board_id = board_id;
+
+	/* Query controller for max supported commands: */
+	h->max_commands = readl(&(h->cfgtable->CmdsOutMax));
+
+	h->product_name = products[prod_index].product_name;
+	h->access = *(products[prod_index].access);
+	/* Allow room for some ioctls */
+	h->nr_cmds = h->max_commands - 4;
+
+	if ((readb(&h->cfgtable->Signature[0]) != 'C') ||
+	    (readb(&h->cfgtable->Signature[1]) != 'I') ||
+	    (readb(&h->cfgtable->Signature[2]) != 'S') ||
+	    (readb(&h->cfgtable->Signature[3]) != 'S')) {
+		dev_warn(&pdev->dev, "not a valid CISS config table\n");
+		err = -ENODEV;
+		goto err_out_free_res;
+	}
+#ifdef CONFIG_X86
+	{
+		/* Need to enable prefetch in the SCSI core for 6400 in x86 */
+		__u32 prefetch;
+		prefetch = readl(&(h->cfgtable->SCSI_Prefetch));
+		prefetch |= 0x100;
+		writel(prefetch, &(h->cfgtable->SCSI_Prefetch));
+	}
+#endif
+
+	/* Disabling DMA prefetch for the P600
+	 * An ASIC bug may result in a prefetch beyond
+	 * physical memory.
+	 */
+	if (board_id == 0x3225103C) {
+		__u32 dma_prefetch;
+		dma_prefetch = readl(h->vaddr + I2O_DMA1_CFG);
+		dma_prefetch |= 0x8000;
+		writel(dma_prefetch, h->vaddr + I2O_DMA1_CFG);
+	}
+
+	h->max_commands = readl(&(h->cfgtable->CmdsOutMax));
+	/* Update the field, and then ring the doorbell */
+	writel(CFGTBL_Trans_Simple, &(h->cfgtable->HostWrite.TransportRequest));
+	writel(CFGTBL_ChangeReq, h->vaddr + SA5_DOORBELL);
+
+	/* under certain very rare conditions, this can take awhile.
+	 * (e.g.: hot replace a failed 144GB drive in a RAID 5 set right
+	 * as we enter this code.)
+	 */
+	for (i = 0; i < MAX_CONFIG_WAIT; i++) {
+		if (!(readl(h->vaddr + SA5_DOORBELL) & CFGTBL_ChangeReq))
+			break;
+		/* delay and try again */
+		msleep(10);
+	}
+
+#ifdef HPSA_DEBUG
+	print_cfg_table(&pdev->dev, h->cfgtable);
+#endif				/* HPSA_DEBUG */
+
+	if (!(readl(&(h->cfgtable->TransportActive)) & CFGTBL_Trans_Simple)) {
+		dev_warn(&pdev->dev, "unable to get board into simple mode\n");
+		err = -ENODEV;
+		goto err_out_free_res;
+	}
+	return 0;
+
+err_out_free_res:
+	/*
+	 * Deliberately omit pci_disable_device(): it does something nasty to
+	 * Smart Array controllers that pci_enable_device does not undo
+	 */
+	pci_release_regions(pdev);
+	return err;
+}
+
+static int __devinit hpsa_init_one(struct pci_dev *pdev,
+				    const struct pci_device_id *ent)
+{
+	int i;
+	int dac;
+	struct ctlr_info *h;
+
+	if (number_of_controllers == 0)
+		printk(KERN_INFO DRIVER_NAME "\n");
+	if (reset_devices) {
+		/* Reset the controller with a PCI power-cycle */
+		if (hpsa_hard_reset_controller(pdev) || hpsa_reset_msi(pdev))
+			return -ENODEV;
+
+		/* Some devices (notably the HP Smart Array 5i Controller)
+		   need a little pause here */
+		msleep(HPSA_POST_RESET_PAUSE_MSECS);
+
+		/* Now try to get the controller to respond to a no-op */
+		for (i = 0; i < HPSA_POST_RESET_NOOP_RETRIES; i++) {
+			if (hpsa_noop(pdev) == 0)
+				break;
+			else
+				dev_warn(&pdev->dev, "no-op failed%s\n",
+						(i < 11 ? "; re-trying" : ""));
+		}
+	}
+
+	BUILD_BUG_ON(sizeof(struct CommandList) % 8);
+	h = kzalloc(sizeof(*h), GFP_KERNEL);
+	if (!h)
+		return -1;
+
+	h->busy_initializing = 1;
+	INIT_HLIST_HEAD(&h->cmpQ);
+	INIT_HLIST_HEAD(&h->reqQ);
+	mutex_init(&h->busy_shutting_down);
+	init_completion(&h->scan_wait);
+	if (hpsa_pci_init(h, pdev) != 0)
+		goto clean1;
+
+	sprintf(h->devname, "hpsa%d", number_of_controllers);
+	h->ctlr = number_of_controllers;
+	number_of_controllers++;
+	h->pdev = pdev;
+
+	/* configure PCI DMA stuff */
+	if (!pci_set_dma_mask(pdev, DMA_BIT_MASK(64)))
+		dac = 1;
+	else if (!pci_set_dma_mask(pdev, DMA_BIT_MASK(32)))
+		dac = 0;
+	else {
+		dev_err(&pdev->dev, "no suitable DMA available\n");
+		goto clean1;
+	}
+
+	/* make sure the board interrupts are off */
+	h->access.set_intr_mask(h, HPSA_INTR_OFF);
+	if (request_irq(h->intr[SIMPLE_MODE_INT], do_hpsa_intr,
+			IRQF_DISABLED | IRQF_SHARED, h->devname, h)) {
+		dev_err(&pdev->dev, "unable to get irq %d for %s\n",
+		       h->intr[SIMPLE_MODE_INT], h->devname);
+		goto clean2;
+	}
+
+	dev_info(&pdev->dev, "%s: <0x%x> at PCI %s IRQ %d%s using DAC\n",
+	       h->devname, pdev->device, pci_name(pdev),
+	       h->intr[SIMPLE_MODE_INT], dac ? "" : " not");
+
+	h->cmd_pool_bits =
+	    kmalloc(((h->nr_cmds + BITS_PER_LONG -
+		      1) / BITS_PER_LONG) * sizeof(unsigned long), GFP_KERNEL);
+	h->cmd_pool = pci_alloc_consistent(h->pdev,
+		    h->nr_cmds * sizeof(*h->cmd_pool),
+		    &(h->cmd_pool_dhandle));
+	h->errinfo_pool = pci_alloc_consistent(h->pdev,
+		    h->nr_cmds * sizeof(*h->errinfo_pool),
+		    &(h->errinfo_pool_dhandle));
+	if ((h->cmd_pool_bits == NULL)
+	    || (h->cmd_pool == NULL)
+	    || (h->errinfo_pool == NULL)) {
+		dev_err(&pdev->dev, "out of memory");
+		goto clean4;
+	}
+	spin_lock_init(&h->lock);
+
+	pci_set_drvdata(pdev, h);
+	memset(h->cmd_pool_bits, 0,
+	       ((h->nr_cmds + BITS_PER_LONG -
+		 1) / BITS_PER_LONG) * sizeof(unsigned long));
+
+	hpsa_scsi_setup(h);
+
+	/* Turn the interrupts on so we can service requests */
+	h->access.set_intr_mask(h, HPSA_INTR_ON);
+
+	hpsa_register_scsi(h);	/* hook ourselves into SCSI subsystem */
+	h->busy_initializing = 0;
+	return 1;
+
+clean4:
+	kfree(h->cmd_pool_bits);
+	if (h->cmd_pool)
+		pci_free_consistent(h->pdev,
+			    h->nr_cmds * sizeof(struct CommandList),
+			    h->cmd_pool, h->cmd_pool_dhandle);
+	if (h->errinfo_pool)
+		pci_free_consistent(h->pdev,
+			    h->nr_cmds * sizeof(struct ErrorInfo),
+			    h->errinfo_pool,
+			    h->errinfo_pool_dhandle);
+	free_irq(h->intr[SIMPLE_MODE_INT], h);
+clean2:
+clean1:
+	h->busy_initializing = 0;
+	kfree(h);
+	return -1;
+}
+
+static void hpsa_flush_cache(struct ctlr_info *h)
+{
+	char *flush_buf;
+	struct CommandList *c;
+
+	flush_buf = kzalloc(4, GFP_KERNEL);
+	if (!flush_buf)
+		return;
+
+	c = cmd_special_alloc(h);
+	if (!c) {
+		dev_warn(&h->pdev->dev, "cmd_special_alloc returned NULL!\n");
+		goto out_of_memory;
+	}
+	fill_cmd(c, HPSA_CACHE_FLUSH, h, flush_buf, 4, 0,
+		RAID_CTLR_LUNID, TYPE_CMD);
+	hpsa_scsi_do_simple_cmd_with_retry(h, c, PCI_DMA_TODEVICE);
+	if (c->err_info->CommandStatus != 0)
+		dev_warn(&h->pdev->dev,
+			"error flushing cache on controller\n");
+	cmd_special_free(h, c);
+out_of_memory:
+	kfree(flush_buf);
+}
+
+static void hpsa_shutdown(struct pci_dev *pdev)
+{
+	struct ctlr_info *h;
+
+	h = pci_get_drvdata(pdev);
+	/* Turn board interrupts off  and send the flush cache command
+	 * sendcmd will turn off interrupt, and send the flush...
+	 * To write all data in the battery backed cache to disks
+	 */
+	hpsa_flush_cache(h);
+	h->access.set_intr_mask(h, HPSA_INTR_OFF);
+	free_irq(h->intr[2], h);
+#ifdef CONFIG_PCI_MSI
+	if (h->msix_vector)
+		pci_disable_msix(h->pdev);
+	else if (h->msi_vector)
+		pci_disable_msi(h->pdev);
+#endif				/* CONFIG_PCI_MSI */
+}
+
+static void __devexit hpsa_remove_one(struct pci_dev *pdev)
+{
+	struct ctlr_info *h;
+
+	if (pci_get_drvdata(pdev) == NULL) {
+		dev_err(&pdev->dev, "unable to remove device \n");
+		return;
+	}
+	h = pci_get_drvdata(pdev);
+	mutex_lock(&h->busy_shutting_down);
+	remove_from_scan_list(h);
+	hpsa_unregister_scsi(h);	/* unhook from SCSI subsystem */
+	hpsa_shutdown(pdev);
+	iounmap(h->vaddr);
+	pci_free_consistent(h->pdev,
+		h->nr_cmds * sizeof(struct CommandList),
+		h->cmd_pool, h->cmd_pool_dhandle);
+	pci_free_consistent(h->pdev,
+		h->nr_cmds * sizeof(struct ErrorInfo),
+		h->errinfo_pool, h->errinfo_pool_dhandle);
+	kfree(h->cmd_pool_bits);
+	/*
+	 * Deliberately omit pci_disable_device(): it does something nasty to
+	 * Smart Array controllers that pci_enable_device does not undo
+	 */
+	pci_release_regions(pdev);
+	pci_set_drvdata(pdev, NULL);
+	mutex_unlock(&h->busy_shutting_down);
+	kfree(h);
+}
+
+static int hpsa_suspend(__attribute__((unused)) struct pci_dev *pdev,
+	__attribute__((unused)) pm_message_t state)
+{
+	return -ENOSYS;
+}
+
+static int hpsa_resume(__attribute__((unused)) struct pci_dev *pdev)
+{
+	return -ENOSYS;
+}
+
+static struct pci_driver hpsa_pci_driver = {
+	.name = "hpsa",
+	.probe = hpsa_init_one,
+	.remove = __devexit_p(hpsa_remove_one),
+	.id_table = hpsa_pci_device_id,	/* id_table */
+	.shutdown = hpsa_shutdown,
+	.suspend = hpsa_suspend,
+	.resume = hpsa_resume,
+};
+
+/*
+ *  This is it.  Register the PCI driver information for the cards we control
+ *  the OS will call our registered routines when it finds one of our cards.
+ */
+static int __init hpsa_init(void)
+{
+	int err;
+	/* Start the scan thread */
+	hpsa_scan_thread = kthread_run(hpsa_scan_func, NULL, "hpsa_scan");
+	if (IS_ERR(hpsa_scan_thread)) {
+		err = PTR_ERR(hpsa_scan_thread);
+		return -ENODEV;
+	}
+	err = pci_register_driver(&hpsa_pci_driver);
+	if (err)
+		kthread_stop(hpsa_scan_thread);
+	return err;
+}
+
+static void __exit hpsa_cleanup(void)
+{
+	pci_unregister_driver(&hpsa_pci_driver);
+	kthread_stop(hpsa_scan_thread);
+}
+
+module_init(hpsa_init);
+module_exit(hpsa_cleanup);
diff --git a/drivers/scsi/hpsa.h b/drivers/scsi/hpsa.h
new file mode 100644
index 000000000000..6bd1949144b5
--- /dev/null
+++ b/drivers/scsi/hpsa.h
@@ -0,0 +1,273 @@
+/*
+ *    Disk Array driver for HP Smart Array SAS controllers
+ *    Copyright 2000, 2009 Hewlett-Packard Development Company, L.P.
+ *
+ *    This program is free software; you can redistribute it and/or modify
+ *    it under the terms of the GNU General Public License as published by
+ *    the Free Software Foundation; version 2 of the License.
+ *
+ *    This program is distributed in the hope that it will be useful,
+ *    but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *    MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ *    NON INFRINGEMENT.  See the GNU General Public License for more details.
+ *
+ *    You should have received a copy of the GNU General Public License
+ *    along with this program; if not, write to the Free Software
+ *    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ *
+ *    Questions/Comments/Bugfixes to iss_storagedev@hp.com
+ *
+ */
+#ifndef HPSA_H
+#define HPSA_H
+
+#include <scsi/scsicam.h>
+
+#define IO_OK		0
+#define IO_ERROR	1
+
+struct ctlr_info;
+
+struct access_method {
+	void (*submit_command)(struct ctlr_info *h,
+		struct CommandList *c);
+	void (*set_intr_mask)(struct ctlr_info *h, unsigned long val);
+	unsigned long (*fifo_full)(struct ctlr_info *h);
+	unsigned long (*intr_pending)(struct ctlr_info *h);
+	unsigned long (*command_completed)(struct ctlr_info *h);
+};
+
+struct hpsa_scsi_dev_t {
+	int devtype;
+	int bus, target, lun;		/* as presented to the OS */
+	unsigned char scsi3addr[8];	/* as presented to the HW */
+#define RAID_CTLR_LUNID "\0\0\0\0\0\0\0\0"
+	unsigned char device_id[16];    /* from inquiry pg. 0x83 */
+	unsigned char vendor[8];        /* bytes 8-15 of inquiry data */
+	unsigned char model[16];        /* bytes 16-31 of inquiry data */
+	unsigned char revision[4];      /* bytes 32-35 of inquiry data */
+	unsigned char raid_level;	/* from inquiry page 0xC1 */
+};
+
+struct ctlr_info {
+	int	ctlr;
+	char	devname[8];
+	char    *product_name;
+	char	firm_ver[4]; /* Firmware version */
+	struct pci_dev *pdev;
+	__u32	board_id;
+	void __iomem *vaddr;
+	unsigned long paddr;
+	int 	nr_cmds; /* Number of commands allowed on this controller */
+	struct CfgTable __iomem *cfgtable;
+	int	interrupts_enabled;
+	int	major;
+	int 	max_commands;
+	int	commands_outstanding;
+	int 	max_outstanding; /* Debug */
+	int	usage_count;  /* number of opens all all minor devices */
+#	define DOORBELL_INT	0
+#	define PERF_MODE_INT	1
+#	define SIMPLE_MODE_INT	2
+#	define MEMQ_MODE_INT	3
+	unsigned int intr[4];
+	unsigned int msix_vector;
+	unsigned int msi_vector;
+	struct access_method access;
+
+	/* queue and queue Info */
+	struct hlist_head reqQ;
+	struct hlist_head cmpQ;
+	unsigned int Qdepth;
+	unsigned int maxQsinceinit;
+	unsigned int maxSG;
+	spinlock_t lock;
+
+	/* pointers to command and error info pool */
+	struct CommandList 	*cmd_pool;
+	dma_addr_t		cmd_pool_dhandle;
+	struct ErrorInfo 	*errinfo_pool;
+	dma_addr_t		errinfo_pool_dhandle;
+	unsigned long  		*cmd_pool_bits;
+	int			nr_allocs;
+	int			nr_frees;
+	int			busy_initializing;
+	int			busy_scanning;
+	struct mutex		busy_shutting_down;
+	struct list_head	scan_list;
+	struct completion	scan_wait;
+
+	struct Scsi_Host *scsi_host;
+	spinlock_t devlock; /* to protect hba[ctlr]->dev[];  */
+	int ndevices; /* number of used elements in .dev[] array. */
+#define HPSA_MAX_SCSI_DEVS_PER_HBA 256
+	struct hpsa_scsi_dev_t *dev[HPSA_MAX_SCSI_DEVS_PER_HBA];
+};
+#define HPSA_ABORT_MSG 0
+#define HPSA_DEVICE_RESET_MSG 1
+#define HPSA_BUS_RESET_MSG 2
+#define HPSA_HOST_RESET_MSG 3
+#define HPSA_MSG_SEND_RETRY_LIMIT 10
+#define HPSA_MSG_SEND_RETRY_INTERVAL_MSECS 1000
+
+/* Maximum time in seconds driver will wait for command completions
+ * when polling before giving up.
+ */
+#define HPSA_MAX_POLL_TIME_SECS (20)
+
+/* During SCSI error recovery, HPSA_TUR_RETRY_LIMIT defines
+ * how many times to retry TEST UNIT READY on a device
+ * while waiting for it to become ready before giving up.
+ * HPSA_MAX_WAIT_INTERVAL_SECS is the max wait interval
+ * between sending TURs while waiting for a device
+ * to become ready.
+ */
+#define HPSA_TUR_RETRY_LIMIT (20)
+#define HPSA_MAX_WAIT_INTERVAL_SECS (30)
+
+/* HPSA_BOARD_READY_WAIT_SECS is how long to wait for a board
+ * to become ready, in seconds, before giving up on it.
+ * HPSA_BOARD_READY_POLL_INTERVAL_MSECS * is how long to wait
+ * between polling the board to see if it is ready, in
+ * milliseconds.  HPSA_BOARD_READY_POLL_INTERVAL and
+ * HPSA_BOARD_READY_ITERATIONS are derived from those.
+ */
+#define HPSA_BOARD_READY_WAIT_SECS (120)
+#define HPSA_BOARD_READY_POLL_INTERVAL_MSECS (100)
+#define HPSA_BOARD_READY_POLL_INTERVAL \
+	((HPSA_BOARD_READY_POLL_INTERVAL_MSECS * HZ) / 1000)
+#define HPSA_BOARD_READY_ITERATIONS \
+	((HPSA_BOARD_READY_WAIT_SECS * 1000) / \
+		HPSA_BOARD_READY_POLL_INTERVAL_MSECS)
+#define HPSA_POST_RESET_PAUSE_MSECS (3000)
+#define HPSA_POST_RESET_NOOP_RETRIES (12)
+
+/*  Defining the diffent access_menthods */
+/*
+ * Memory mapped FIFO interface (SMART 53xx cards)
+ */
+#define SA5_DOORBELL	0x20
+#define SA5_REQUEST_PORT_OFFSET	0x40
+#define SA5_REPLY_INTR_MASK_OFFSET	0x34
+#define SA5_REPLY_PORT_OFFSET		0x44
+#define SA5_INTR_STATUS		0x30
+#define SA5_SCRATCHPAD_OFFSET	0xB0
+
+#define SA5_CTCFG_OFFSET	0xB4
+#define SA5_CTMEM_OFFSET	0xB8
+
+#define SA5_INTR_OFF		0x08
+#define SA5B_INTR_OFF		0x04
+#define SA5_INTR_PENDING	0x08
+#define SA5B_INTR_PENDING	0x04
+#define FIFO_EMPTY		0xffffffff
+#define HPSA_FIRMWARE_READY	0xffff0000 /* value in scratchpad register */
+
+#define HPSA_ERROR_BIT		0x02
+#define HPSA_TAG_CONTAINS_INDEX(tag) ((tag) & 0x04)
+#define HPSA_TAG_TO_INDEX(tag) ((tag) >> 3)
+#define HPSA_TAG_DISCARD_ERROR_BITS(tag) ((tag) & ~3)
+
+#define HPSA_INTR_ON 	1
+#define HPSA_INTR_OFF	0
+/*
+	Send the command to the hardware
+*/
+static void SA5_submit_command(struct ctlr_info *h,
+	struct CommandList *c)
+{
+#ifdef HPSA_DEBUG
+	 printk(KERN_WARNING "hpsa: Sending %x - down to controller\n",
+		c->busaddr);
+#endif /* HPSA_DEBUG */
+	writel(c->busaddr, h->vaddr + SA5_REQUEST_PORT_OFFSET);
+	h->commands_outstanding++;
+	if (h->commands_outstanding > h->max_outstanding)
+		h->max_outstanding = h->commands_outstanding;
+}
+
+/*
+ *  This card is the opposite of the other cards.
+ *   0 turns interrupts on...
+ *   0x08 turns them off...
+ */
+static void SA5_intr_mask(struct ctlr_info *h, unsigned long val)
+{
+	if (val) { /* Turn interrupts on */
+		h->interrupts_enabled = 1;
+		writel(0, h->vaddr + SA5_REPLY_INTR_MASK_OFFSET);
+	} else { /* Turn them off */
+		h->interrupts_enabled = 0;
+		writel(SA5_INTR_OFF,
+			h->vaddr + SA5_REPLY_INTR_MASK_OFFSET);
+	}
+}
+/*
+ *  Returns true if fifo is full.
+ *
+ */
+static unsigned long SA5_fifo_full(struct ctlr_info *h)
+{
+	if (h->commands_outstanding >= h->max_commands)
+		return 1;
+	else
+		return 0;
+
+}
+/*
+ *   returns value read from hardware.
+ *     returns FIFO_EMPTY if there is nothing to read
+ */
+static unsigned long SA5_completed(struct ctlr_info *h)
+{
+	unsigned long register_value
+		= readl(h->vaddr + SA5_REPLY_PORT_OFFSET);
+
+	if (register_value != FIFO_EMPTY)
+		h->commands_outstanding--;
+
+#ifdef HPSA_DEBUG
+	if (register_value != FIFO_EMPTY)
+		printk(KERN_INFO "hpsa:  Read %lx back from board\n",
+			register_value);
+	else
+		printk(KERN_INFO "hpsa:  FIFO Empty read\n");
+#endif
+
+	return register_value;
+}
+/*
+ *	Returns true if an interrupt is pending..
+ */
+static unsigned long SA5_intr_pending(struct ctlr_info *h)
+{
+	unsigned long register_value  =
+		readl(h->vaddr + SA5_INTR_STATUS);
+#ifdef HPSA_DEBUG
+	printk(KERN_INFO "hpsa: intr_pending %lx\n", register_value);
+#endif  /* HPSA_DEBUG */
+	if (register_value &  SA5_INTR_PENDING)
+		return  1;
+	return 0 ;
+}
+
+
+static struct access_method SA5_access = {
+	SA5_submit_command,
+	SA5_intr_mask,
+	SA5_fifo_full,
+	SA5_intr_pending,
+	SA5_completed,
+};
+
+struct board_type {
+	__u32	board_id;
+	char	*product_name;
+	struct access_method *access;
+};
+
+
+/* end of old hpsa_scsi.h file */
+
+#endif /* HPSA_H */
+
diff --git a/drivers/scsi/hpsa_cmd.h b/drivers/scsi/hpsa_cmd.h
new file mode 100644
index 000000000000..12d71387ed9a
--- /dev/null
+++ b/drivers/scsi/hpsa_cmd.h
@@ -0,0 +1,326 @@
+/*
+ *    Disk Array driver for HP Smart Array SAS controllers
+ *    Copyright 2000, 2009 Hewlett-Packard Development Company, L.P.
+ *
+ *    This program is free software; you can redistribute it and/or modify
+ *    it under the terms of the GNU General Public License as published by
+ *    the Free Software Foundation; version 2 of the License.
+ *
+ *    This program is distributed in the hope that it will be useful,
+ *    but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *    MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ *    NON INFRINGEMENT.  See the GNU General Public License for more details.
+ *
+ *    You should have received a copy of the GNU General Public License
+ *    along with this program; if not, write to the Free Software
+ *    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ *
+ *    Questions/Comments/Bugfixes to iss_storagedev@hp.com
+ *
+ */
+#ifndef HPSA_CMD_H
+#define HPSA_CMD_H
+
+/* general boundary defintions */
+#define SENSEINFOBYTES          32 /* may vary between hbas */
+#define MAXSGENTRIES            31
+#define MAXREPLYQS              256
+
+/* Command Status value */
+#define CMD_SUCCESS             0x0000
+#define CMD_TARGET_STATUS       0x0001
+#define CMD_DATA_UNDERRUN       0x0002
+#define CMD_DATA_OVERRUN        0x0003
+#define CMD_INVALID             0x0004
+#define CMD_PROTOCOL_ERR        0x0005
+#define CMD_HARDWARE_ERR        0x0006
+#define CMD_CONNECTION_LOST     0x0007
+#define CMD_ABORTED             0x0008
+#define CMD_ABORT_FAILED        0x0009
+#define CMD_UNSOLICITED_ABORT   0x000A
+#define CMD_TIMEOUT             0x000B
+#define CMD_UNABORTABLE		0x000C
+
+/* Unit Attentions ASC's as defined for the MSA2012sa */
+#define POWER_OR_RESET			0x29
+#define STATE_CHANGED			0x2a
+#define UNIT_ATTENTION_CLEARED		0x2f
+#define LUN_FAILED			0x3e
+#define REPORT_LUNS_CHANGED		0x3f
+
+/* Unit Attentions ASCQ's as defined for the MSA2012sa */
+
+	/* These ASCQ's defined for ASC = POWER_OR_RESET */
+#define POWER_ON_RESET			0x00
+#define POWER_ON_REBOOT			0x01
+#define SCSI_BUS_RESET			0x02
+#define MSA_TARGET_RESET		0x03
+#define CONTROLLER_FAILOVER		0x04
+#define TRANSCEIVER_SE			0x05
+#define TRANSCEIVER_LVD			0x06
+
+	/* These ASCQ's defined for ASC = STATE_CHANGED */
+#define RESERVATION_PREEMPTED		0x03
+#define ASYM_ACCESS_CHANGED		0x06
+#define LUN_CAPACITY_CHANGED		0x09
+
+/* transfer direction */
+#define XFER_NONE               0x00
+#define XFER_WRITE              0x01
+#define XFER_READ               0x02
+#define XFER_RSVD               0x03
+
+/* task attribute */
+#define ATTR_UNTAGGED           0x00
+#define ATTR_SIMPLE             0x04
+#define ATTR_HEADOFQUEUE        0x05
+#define ATTR_ORDERED            0x06
+#define ATTR_ACA                0x07
+
+/* cdb type */
+#define TYPE_CMD				0x00
+#define TYPE_MSG				0x01
+
+/* config space register offsets */
+#define CFG_VENDORID            0x00
+#define CFG_DEVICEID            0x02
+#define CFG_I2OBAR              0x10
+#define CFG_MEM1BAR             0x14
+
+/* i2o space register offsets */
+#define I2O_IBDB_SET            0x20
+#define I2O_IBDB_CLEAR          0x70
+#define I2O_INT_STATUS          0x30
+#define I2O_INT_MASK            0x34
+#define I2O_IBPOST_Q            0x40
+#define I2O_OBPOST_Q            0x44
+#define I2O_DMA1_CFG		0x214
+
+/* Configuration Table */
+#define CFGTBL_ChangeReq        0x00000001l
+#define CFGTBL_AccCmds          0x00000001l
+
+#define CFGTBL_Trans_Simple     0x00000002l
+
+#define CFGTBL_BusType_Ultra2   0x00000001l
+#define CFGTBL_BusType_Ultra3   0x00000002l
+#define CFGTBL_BusType_Fibre1G  0x00000100l
+#define CFGTBL_BusType_Fibre2G  0x00000200l
+struct vals32 {
+	__u32   lower;
+	__u32   upper;
+};
+
+union u64bit {
+	struct vals32 val32;
+	__u64 val;
+};
+
+/* FIXME this is a per controller value (barf!) */
+#define HPSA_MAX_TARGETS_PER_CTLR 16
+#define HPSA_MAX_LUN 256
+#define HPSA_MAX_PHYS_LUN 1024
+
+/* SCSI-3 Commands */
+#pragma pack(1)
+
+#define HPSA_INQUIRY 0x12
+struct InquiryData {
+	__u8 data_byte[36];
+};
+
+#define HPSA_REPORT_LOG 0xc2    /* Report Logical LUNs */
+#define HPSA_REPORT_PHYS 0xc3   /* Report Physical LUNs */
+struct ReportLUNdata {
+	__u8 LUNListLength[4];
+	__u32 reserved;
+	__u8 LUN[HPSA_MAX_LUN][8];
+};
+
+struct ReportExtendedLUNdata {
+	__u8 LUNListLength[4];
+	__u8 extended_response_flag;
+	__u8 reserved[3];
+	__u8 LUN[HPSA_MAX_LUN][24];
+};
+
+struct SenseSubsystem_info {
+	__u8 reserved[36];
+	__u8 portname[8];
+	__u8 reserved1[1108];
+};
+
+#define HPSA_READ_CAPACITY 0x25 /* Read Capacity */
+struct ReadCapdata {
+	__u8 total_size[4];	/* Total size in blocks */
+	__u8 block_size[4];	/* Size of blocks in bytes */
+};
+
+#if 0
+/* 12 byte commands not implemented in firmware yet. */
+#define HPSA_READ 	0xa8
+#define HPSA_WRITE	0xaa
+#endif
+
+#define HPSA_READ   0x28    /* Read(10) */
+#define HPSA_WRITE  0x2a    /* Write(10) */
+
+/* BMIC commands */
+#define BMIC_READ 0x26
+#define BMIC_WRITE 0x27
+#define BMIC_CACHE_FLUSH 0xc2
+#define HPSA_CACHE_FLUSH 0x01	/* C2 was already being used by HPSA */
+
+/* Command List Structure */
+union SCSI3Addr {
+	struct {
+		__u8 Dev;
+		__u8 Bus:6;
+		__u8 Mode:2;        /* b00 */
+	} PeripDev;
+	struct {
+		__u8 DevLSB;
+		__u8 DevMSB:6;
+		__u8 Mode:2;        /* b01 */
+	} LogDev;
+	struct {
+		__u8 Dev:5;
+		__u8 Bus:3;
+		__u8 Targ:6;
+		__u8 Mode:2;        /* b10 */
+	} LogUnit;
+};
+
+struct PhysDevAddr {
+	__u32             TargetId:24;
+	__u32             Bus:6;
+	__u32             Mode:2;
+	/* 2 level target device addr */
+	union SCSI3Addr  Target[2];
+};
+
+struct LogDevAddr {
+	__u32            VolId:30;
+	__u32            Mode:2;
+	__u8             reserved[4];
+};
+
+union LUNAddr {
+	__u8               LunAddrBytes[8];
+	union SCSI3Addr    SCSI3Lun[4];
+	struct PhysDevAddr PhysDev;
+	struct LogDevAddr  LogDev;
+};
+
+struct CommandListHeader {
+	__u8              ReplyQueue;
+	__u8              SGList;
+	__u16             SGTotal;
+	struct vals32     Tag;
+	union LUNAddr     LUN;
+};
+
+struct RequestBlock {
+	__u8   CDBLen;
+	struct {
+		__u8 Type:3;
+		__u8 Attribute:3;
+		__u8 Direction:2;
+	} Type;
+	__u16  Timeout;
+	__u8   CDB[16];
+};
+
+struct ErrDescriptor {
+	struct vals32 Addr;
+	__u32  Len;
+};
+
+struct SGDescriptor {
+	struct vals32 Addr;
+	__u32  Len;
+	__u32  Ext;
+};
+
+union MoreErrInfo {
+	struct {
+		__u8  Reserved[3];
+		__u8  Type;
+		__u32 ErrorInfo;
+	} Common_Info;
+	struct {
+		__u8  Reserved[2];
+		__u8  offense_size; /* size of offending entry */
+		__u8  offense_num;  /* byte # of offense 0-base */
+		__u32 offense_value;
+	} Invalid_Cmd;
+};
+struct ErrorInfo {
+	__u8               ScsiStatus;
+	__u8               SenseLen;
+	__u16              CommandStatus;
+	__u32              ResidualCnt;
+	union MoreErrInfo  MoreErrInfo;
+	__u8               SenseInfo[SENSEINFOBYTES];
+};
+/* Command types */
+#define CMD_IOCTL_PEND  0x01
+#define CMD_SCSI	0x03
+
+struct ctlr_info; /* defined in hpsa.h */
+/* The size of this structure needs to be divisible by 8
+ * od on all architectures, because the controller uses 2
+ * lower bits of the address, and the driver uses 1 lower
+ * bit (3 bits total.)
+ */
+struct CommandList {
+	struct CommandListHeader Header;
+	struct RequestBlock      Request;
+	struct ErrDescriptor     ErrDesc;
+	struct SGDescriptor      SG[MAXSGENTRIES];
+	/* information associated with the command */
+	__u32			   busaddr; /* physical addr of this record */
+	struct ErrorInfo *err_info; /* pointer to the allocated mem */
+	struct ctlr_info	   *h;
+	int			   cmd_type;
+	long			   cmdindex;
+	struct hlist_node list;
+	struct CommandList *prev;
+	struct CommandList *next;
+	struct request *rq;
+	struct completion *waiting;
+	int	 retry_count;
+	void   *scsi_cmd;
+};
+
+/* Configuration Table Structure */
+struct HostWrite {
+	__u32 TransportRequest;
+	__u32 Reserved;
+	__u32 CoalIntDelay;
+	__u32 CoalIntCount;
+};
+
+struct CfgTable {
+	__u8             Signature[4];
+	__u32            SpecValence;
+	__u32            TransportSupport;
+	__u32            TransportActive;
+	struct HostWrite HostWrite;
+	__u32            CmdsOutMax;
+	__u32            BusTypes;
+	__u32            Reserved;
+	__u8             ServerName[16];
+	__u32            HeartBeat;
+	__u32            SCSI_Prefetch;
+};
+
+struct hpsa_pci_info {
+	unsigned char	bus;
+	unsigned char	dev_fn;
+	unsigned short	domain;
+	__u32		board_id;
+};
+
+#pragma pack()
+#endif /* HPSA_CMD_H */
diff --git a/drivers/scsi/hptiop.c b/drivers/scsi/hptiop.c
index a0e7e711ff9d..4f0556571f80 100644
--- a/drivers/scsi/hptiop.c
+++ b/drivers/scsi/hptiop.c
@@ -834,7 +834,7 @@ static int hptiop_reset_hba(struct hptiop_hba *hba)
 			atomic_read(&hba->resetting) == 0, 60 * HZ);
 
 	if (atomic_read(&hba->resetting)) {
-		/* IOP is in unkown state, abort reset */
+		/* IOP is in unknown state, abort reset */
 		printk(KERN_ERR "scsi%d: reset failed\n", hba->host->host_no);
 		return -1;
 	}
@@ -861,10 +861,13 @@ static int hptiop_reset(struct scsi_cmnd *scp)
 }
 
 static int hptiop_adjust_disk_queue_depth(struct scsi_device *sdev,
-						int queue_depth)
+					  int queue_depth, int reason)
 {
 	struct hptiop_hba *hba = (struct hptiop_hba *)sdev->host->hostdata;
 
+	if (reason != SCSI_QDEPTH_DEFAULT)
+		return -EOPNOTSUPP;
+
 	if (queue_depth > hba->max_requests)
 		queue_depth = hba->max_requests;
 	scsi_adjust_queue_depth(sdev, MSG_ORDERED_TAG, queue_depth);
diff --git a/drivers/scsi/ibmvscsi/ibmvfc.c b/drivers/scsi/ibmvscsi/ibmvfc.c
index bb2c696c006a..87b536a97cb4 100644
--- a/drivers/scsi/ibmvscsi/ibmvfc.c
+++ b/drivers/scsi/ibmvscsi/ibmvfc.c
@@ -39,6 +39,7 @@
 #include <scsi/scsi_device.h>
 #include <scsi/scsi_tcq.h>
 #include <scsi/scsi_transport_fc.h>
+#include <scsi/scsi_bsg_fc.h>
 #include "ibmvfc.h"
 
 static unsigned int init_timeout = IBMVFC_INIT_TIMEOUT;
@@ -558,12 +559,11 @@ static void ibmvfc_link_down(struct ibmvfc_host *vhost,
 /**
  * ibmvfc_init_host - Start host initialization
  * @vhost:		ibmvfc host struct
- * @relogin:	is this a re-login?
  *
  * Return value:
  *	nothing
  **/
-static void ibmvfc_init_host(struct ibmvfc_host *vhost, int relogin)
+static void ibmvfc_init_host(struct ibmvfc_host *vhost)
 {
 	struct ibmvfc_target *tgt;
 
@@ -577,10 +577,8 @@ static void ibmvfc_init_host(struct ibmvfc_host *vhost, int relogin)
 	}
 
 	if (!ibmvfc_set_host_state(vhost, IBMVFC_INITIALIZING)) {
-		if (!relogin) {
-			memset(vhost->async_crq.msgs, 0, PAGE_SIZE);
-			vhost->async_crq.cur = 0;
-		}
+		memset(vhost->async_crq.msgs, 0, PAGE_SIZE);
+		vhost->async_crq.cur = 0;
 
 		list_for_each_entry(tgt, &vhost->targets, queue)
 			ibmvfc_set_tgt_action(tgt, IBMVFC_TGT_ACTION_DEL_RPORT);
@@ -1678,6 +1676,276 @@ static void ibmvfc_sync_completion(struct ibmvfc_event *evt)
 }
 
 /**
+ * ibmvfc_bsg_timeout_done - Completion handler for cancelling BSG commands
+ * @evt:	struct ibmvfc_event
+ *
+ **/
+static void ibmvfc_bsg_timeout_done(struct ibmvfc_event *evt)
+{
+	struct ibmvfc_host *vhost = evt->vhost;
+
+	ibmvfc_free_event(evt);
+	vhost->aborting_passthru = 0;
+	dev_info(vhost->dev, "Passthru command cancelled\n");
+}
+
+/**
+ * ibmvfc_bsg_timeout - Handle a BSG timeout
+ * @job:	struct fc_bsg_job that timed out
+ *
+ * Returns:
+ *	0 on success / other on failure
+ **/
+static int ibmvfc_bsg_timeout(struct fc_bsg_job *job)
+{
+	struct ibmvfc_host *vhost = shost_priv(job->shost);
+	unsigned long port_id = (unsigned long)job->dd_data;
+	struct ibmvfc_event *evt;
+	struct ibmvfc_tmf *tmf;
+	unsigned long flags;
+	int rc;
+
+	ENTER;
+	spin_lock_irqsave(vhost->host->host_lock, flags);
+	if (vhost->aborting_passthru || vhost->state != IBMVFC_ACTIVE) {
+		__ibmvfc_reset_host(vhost);
+		spin_unlock_irqrestore(vhost->host->host_lock, flags);
+		return 0;
+	}
+
+	vhost->aborting_passthru = 1;
+	evt = ibmvfc_get_event(vhost);
+	ibmvfc_init_event(evt, ibmvfc_bsg_timeout_done, IBMVFC_MAD_FORMAT);
+
+	tmf = &evt->iu.tmf;
+	memset(tmf, 0, sizeof(*tmf));
+	tmf->common.version = 1;
+	tmf->common.opcode = IBMVFC_TMF_MAD;
+	tmf->common.length = sizeof(*tmf);
+	tmf->scsi_id = port_id;
+	tmf->cancel_key = IBMVFC_PASSTHRU_CANCEL_KEY;
+	tmf->my_cancel_key = IBMVFC_INTERNAL_CANCEL_KEY;
+	rc = ibmvfc_send_event(evt, vhost, default_timeout);
+
+	if (rc != 0) {
+		vhost->aborting_passthru = 0;
+		dev_err(vhost->dev, "Failed to send cancel event. rc=%d\n", rc);
+		rc = -EIO;
+	} else
+		dev_info(vhost->dev, "Cancelling passthru command to port id 0x%lx\n",
+			 port_id);
+
+	spin_unlock_irqrestore(vhost->host->host_lock, flags);
+
+	LEAVE;
+	return rc;
+}
+
+/**
+ * ibmvfc_bsg_plogi - PLOGI into a target to handle a BSG command
+ * @vhost:		struct ibmvfc_host to send command
+ * @port_id:	port ID to send command
+ *
+ * Returns:
+ *	0 on success / other on failure
+ **/
+static int ibmvfc_bsg_plogi(struct ibmvfc_host *vhost, unsigned int port_id)
+{
+	struct ibmvfc_port_login *plogi;
+	struct ibmvfc_target *tgt;
+	struct ibmvfc_event *evt;
+	union ibmvfc_iu rsp_iu;
+	unsigned long flags;
+	int rc = 0, issue_login = 1;
+
+	ENTER;
+	spin_lock_irqsave(vhost->host->host_lock, flags);
+	list_for_each_entry(tgt, &vhost->targets, queue) {
+		if (tgt->scsi_id == port_id) {
+			issue_login = 0;
+			break;
+		}
+	}
+
+	if (!issue_login)
+		goto unlock_out;
+	if (unlikely((rc = ibmvfc_host_chkready(vhost))))
+		goto unlock_out;
+
+	evt = ibmvfc_get_event(vhost);
+	ibmvfc_init_event(evt, ibmvfc_sync_completion, IBMVFC_MAD_FORMAT);
+	plogi = &evt->iu.plogi;
+	memset(plogi, 0, sizeof(*plogi));
+	plogi->common.version = 1;
+	plogi->common.opcode = IBMVFC_PORT_LOGIN;
+	plogi->common.length = sizeof(*plogi);
+	plogi->scsi_id = port_id;
+	evt->sync_iu = &rsp_iu;
+	init_completion(&evt->comp);
+
+	rc = ibmvfc_send_event(evt, vhost, default_timeout);
+	spin_unlock_irqrestore(vhost->host->host_lock, flags);
+
+	if (rc)
+		return -EIO;
+
+	wait_for_completion(&evt->comp);
+
+	if (rsp_iu.plogi.common.status)
+		rc = -EIO;
+
+	spin_lock_irqsave(vhost->host->host_lock, flags);
+	ibmvfc_free_event(evt);
+unlock_out:
+	spin_unlock_irqrestore(vhost->host->host_lock, flags);
+	LEAVE;
+	return rc;
+}
+
+/**
+ * ibmvfc_bsg_request - Handle a BSG request
+ * @job:	struct fc_bsg_job to be executed
+ *
+ * Returns:
+ *	0 on success / other on failure
+ **/
+static int ibmvfc_bsg_request(struct fc_bsg_job *job)
+{
+	struct ibmvfc_host *vhost = shost_priv(job->shost);
+	struct fc_rport *rport = job->rport;
+	struct ibmvfc_passthru_mad *mad;
+	struct ibmvfc_event *evt;
+	union ibmvfc_iu rsp_iu;
+	unsigned long flags, port_id = -1;
+	unsigned int code = job->request->msgcode;
+	int rc = 0, req_seg, rsp_seg, issue_login = 0;
+	u32 fc_flags, rsp_len;
+
+	ENTER;
+	job->reply->reply_payload_rcv_len = 0;
+	if (rport)
+		port_id = rport->port_id;
+
+	switch (code) {
+	case FC_BSG_HST_ELS_NOLOGIN:
+		port_id = (job->request->rqst_data.h_els.port_id[0] << 16) |
+			(job->request->rqst_data.h_els.port_id[1] << 8) |
+			job->request->rqst_data.h_els.port_id[2];
+	case FC_BSG_RPT_ELS:
+		fc_flags = IBMVFC_FC_ELS;
+		break;
+	case FC_BSG_HST_CT:
+		issue_login = 1;
+		port_id = (job->request->rqst_data.h_ct.port_id[0] << 16) |
+			(job->request->rqst_data.h_ct.port_id[1] << 8) |
+			job->request->rqst_data.h_ct.port_id[2];
+	case FC_BSG_RPT_CT:
+		fc_flags = IBMVFC_FC_CT_IU;
+		break;
+	default:
+		return -ENOTSUPP;
+	};
+
+	if (port_id == -1)
+		return -EINVAL;
+	if (!mutex_trylock(&vhost->passthru_mutex))
+		return -EBUSY;
+
+	job->dd_data = (void *)port_id;
+	req_seg = dma_map_sg(vhost->dev, job->request_payload.sg_list,
+			     job->request_payload.sg_cnt, DMA_TO_DEVICE);
+
+	if (!req_seg) {
+		mutex_unlock(&vhost->passthru_mutex);
+		return -ENOMEM;
+	}
+
+	rsp_seg = dma_map_sg(vhost->dev, job->reply_payload.sg_list,
+			     job->reply_payload.sg_cnt, DMA_FROM_DEVICE);
+
+	if (!rsp_seg) {
+		dma_unmap_sg(vhost->dev, job->request_payload.sg_list,
+			     job->request_payload.sg_cnt, DMA_TO_DEVICE);
+		mutex_unlock(&vhost->passthru_mutex);
+		return -ENOMEM;
+	}
+
+	if (req_seg > 1 || rsp_seg > 1) {
+		rc = -EINVAL;
+		goto out;
+	}
+
+	if (issue_login)
+		rc = ibmvfc_bsg_plogi(vhost, port_id);
+
+	spin_lock_irqsave(vhost->host->host_lock, flags);
+
+	if (unlikely(rc || (rport && (rc = fc_remote_port_chkready(rport)))) ||
+	    unlikely((rc = ibmvfc_host_chkready(vhost)))) {
+		spin_unlock_irqrestore(vhost->host->host_lock, flags);
+		goto out;
+	}
+
+	evt = ibmvfc_get_event(vhost);
+	ibmvfc_init_event(evt, ibmvfc_sync_completion, IBMVFC_MAD_FORMAT);
+	mad = &evt->iu.passthru;
+
+	memset(mad, 0, sizeof(*mad));
+	mad->common.version = 1;
+	mad->common.opcode = IBMVFC_PASSTHRU;
+	mad->common.length = sizeof(*mad) - sizeof(mad->fc_iu) - sizeof(mad->iu);
+
+	mad->cmd_ioba.va = (u64)evt->crq.ioba +
+		offsetof(struct ibmvfc_passthru_mad, iu);
+	mad->cmd_ioba.len = sizeof(mad->iu);
+
+	mad->iu.cmd_len = job->request_payload.payload_len;
+	mad->iu.rsp_len = job->reply_payload.payload_len;
+	mad->iu.flags = fc_flags;
+	mad->iu.cancel_key = IBMVFC_PASSTHRU_CANCEL_KEY;
+
+	mad->iu.cmd.va = sg_dma_address(job->request_payload.sg_list);
+	mad->iu.cmd.len = sg_dma_len(job->request_payload.sg_list);
+	mad->iu.rsp.va = sg_dma_address(job->reply_payload.sg_list);
+	mad->iu.rsp.len = sg_dma_len(job->reply_payload.sg_list);
+	mad->iu.scsi_id = port_id;
+	mad->iu.tag = (u64)evt;
+	rsp_len = mad->iu.rsp.len;
+
+	evt->sync_iu = &rsp_iu;
+	init_completion(&evt->comp);
+	rc = ibmvfc_send_event(evt, vhost, 0);
+	spin_unlock_irqrestore(vhost->host->host_lock, flags);
+
+	if (rc) {
+		rc = -EIO;
+		goto out;
+	}
+
+	wait_for_completion(&evt->comp);
+
+	if (rsp_iu.passthru.common.status)
+		rc = -EIO;
+	else
+		job->reply->reply_payload_rcv_len = rsp_len;
+
+	spin_lock_irqsave(vhost->host->host_lock, flags);
+	ibmvfc_free_event(evt);
+	spin_unlock_irqrestore(vhost->host->host_lock, flags);
+	job->reply->result = rc;
+	job->job_done(job);
+	rc = 0;
+out:
+	dma_unmap_sg(vhost->dev, job->request_payload.sg_list,
+		     job->request_payload.sg_cnt, DMA_TO_DEVICE);
+	dma_unmap_sg(vhost->dev, job->reply_payload.sg_list,
+		     job->reply_payload.sg_cnt, DMA_FROM_DEVICE);
+	mutex_unlock(&vhost->passthru_mutex);
+	LEAVE;
+	return rc;
+}
+
+/**
  * ibmvfc_reset_device - Reset the device with the specified reset type
  * @sdev:	scsi device to reset
  * @type:	reset type
@@ -1731,7 +1999,10 @@ static int ibmvfc_reset_device(struct scsi_device *sdev, int type, char *desc)
 	sdev_printk(KERN_INFO, sdev, "Resetting %s\n", desc);
 	wait_for_completion(&evt->comp);
 
-	if (rsp_iu.cmd.status) {
+	if (rsp_iu.cmd.status)
+		rsp_code = ibmvfc_get_err_result(&rsp_iu.cmd);
+
+	if (rsp_code) {
 		if (fc_rsp->flags & FCP_RSP_LEN_VALID)
 			rsp_code = fc_rsp->data.info.rsp_code;
 
@@ -1820,7 +2091,10 @@ static int ibmvfc_abort_task_set(struct scsi_device *sdev)
 	sdev_printk(KERN_INFO, sdev, "Aborting outstanding commands\n");
 	wait_for_completion(&evt->comp);
 
-	if (rsp_iu.cmd.status) {
+	if (rsp_iu.cmd.status)
+		rsp_code = ibmvfc_get_err_result(&rsp_iu.cmd);
+
+	if (rsp_code) {
 		if (fc_rsp->flags & FCP_RSP_LEN_VALID)
 			rsp_code = fc_rsp->data.info.rsp_code;
 
@@ -2061,12 +2335,24 @@ static int ibmvfc_eh_device_reset_handler(struct scsi_cmnd *cmd)
 }
 
 /**
- * ibmvfc_dev_cancel_all - Device iterated cancel all function
+ * ibmvfc_dev_cancel_all_abts - Device iterated cancel all function
  * @sdev:	scsi device struct
  * @data:	return code
  *
  **/
-static void ibmvfc_dev_cancel_all(struct scsi_device *sdev, void *data)
+static void ibmvfc_dev_cancel_all_abts(struct scsi_device *sdev, void *data)
+{
+	unsigned long *rc = data;
+	*rc |= ibmvfc_cancel_all(sdev, IBMVFC_TMF_ABORT_TASK_SET);
+}
+
+/**
+ * ibmvfc_dev_cancel_all_reset - Device iterated cancel all function
+ * @sdev:	scsi device struct
+ * @data:	return code
+ *
+ **/
+static void ibmvfc_dev_cancel_all_reset(struct scsi_device *sdev, void *data)
 {
 	unsigned long *rc = data;
 	*rc |= ibmvfc_cancel_all(sdev, IBMVFC_TMF_TGT_RESET);
@@ -2102,7 +2388,7 @@ static int ibmvfc_eh_target_reset_handler(struct scsi_cmnd *cmd)
 
 	ENTER;
 	ibmvfc_wait_while_resetting(vhost);
-	starget_for_each_device(starget, &cancel_rc, ibmvfc_dev_cancel_all);
+	starget_for_each_device(starget, &cancel_rc, ibmvfc_dev_cancel_all_reset);
 	reset_rc = ibmvfc_reset_device(sdev, IBMVFC_TARGET_RESET, "target");
 
 	if (!cancel_rc && !reset_rc)
@@ -2144,7 +2430,7 @@ static void ibmvfc_terminate_rport_io(struct fc_rport *rport)
 	int rc = FAILED;
 
 	ENTER;
-	starget_for_each_device(starget, &cancel_rc, ibmvfc_dev_cancel_all);
+	starget_for_each_device(starget, &cancel_rc, ibmvfc_dev_cancel_all_abts);
 	starget_for_each_device(starget, &abort_rc, ibmvfc_dev_abort_all);
 
 	if (!cancel_rc && !abort_rc)
@@ -2297,13 +2583,13 @@ static void ibmvfc_handle_crq(struct ibmvfc_crq *crq, struct ibmvfc_host *vhost)
 			/* Send back a response */
 			rc = ibmvfc_send_crq_init_complete(vhost);
 			if (rc == 0)
-				ibmvfc_init_host(vhost, 0);
+				ibmvfc_init_host(vhost);
 			else
 				dev_err(vhost->dev, "Unable to send init rsp. rc=%ld\n", rc);
 			break;
 		case IBMVFC_CRQ_INIT_COMPLETE:
 			dev_info(vhost->dev, "Partner initialization complete\n");
-			ibmvfc_init_host(vhost, 0);
+			ibmvfc_init_host(vhost);
 			break;
 		default:
 			dev_err(vhost->dev, "Unknown crq message type: %d\n", crq->format);
@@ -2478,12 +2764,17 @@ static int ibmvfc_slave_configure(struct scsi_device *sdev)
  * ibmvfc_change_queue_depth - Change the device's queue depth
  * @sdev:	scsi device struct
  * @qdepth:	depth to set
+ * @reason:	calling context
  *
  * Return value:
  * 	actual depth set
  **/
-static int ibmvfc_change_queue_depth(struct scsi_device *sdev, int qdepth)
+static int ibmvfc_change_queue_depth(struct scsi_device *sdev, int qdepth,
+				     int reason)
 {
+	if (reason != SCSI_QDEPTH_DEFAULT)
+		return -EOPNOTSUPP;
+
 	if (qdepth > IBMVFC_MAX_CMDS_PER_LUN)
 		qdepth = IBMVFC_MAX_CMDS_PER_LUN;
 
@@ -3725,7 +4016,7 @@ static void ibmvfc_npiv_logout_done(struct ibmvfc_event *evt)
 	case IBMVFC_MAD_SUCCESS:
 		if (list_empty(&vhost->sent) &&
 		    vhost->action == IBMVFC_HOST_ACTION_LOGO_WAIT) {
-			ibmvfc_init_host(vhost, 0);
+			ibmvfc_init_host(vhost);
 			return;
 		}
 		break;
@@ -3903,6 +4194,8 @@ static void ibmvfc_tgt_add_rport(struct ibmvfc_target *tgt)
 			rport->supported_classes |= FC_COS_CLASS2;
 		if (tgt->service_parms.class3_parms[0] & 0x80000000)
 			rport->supported_classes |= FC_COS_CLASS3;
+		if (rport->rqst_q)
+			blk_queue_max_hw_segments(rport->rqst_q, 1);
 	} else
 		tgt_dbg(tgt, "rport add failed\n");
 	spin_unlock_irqrestore(vhost->host->host_lock, flags);
@@ -4342,6 +4635,7 @@ static int ibmvfc_probe(struct vio_dev *vdev, const struct vio_device_id *id)
 	init_waitqueue_head(&vhost->work_wait_q);
 	init_waitqueue_head(&vhost->init_wait_q);
 	INIT_WORK(&vhost->rport_add_work_q, ibmvfc_rport_add_thread);
+	mutex_init(&vhost->passthru_mutex);
 
 	if ((rc = ibmvfc_alloc_mem(vhost)))
 		goto free_scsi_host;
@@ -4374,6 +4668,8 @@ static int ibmvfc_probe(struct vio_dev *vdev, const struct vio_device_id *id)
 		goto remove_shost;
 	}
 
+	if (shost_to_fc_host(shost)->rqst_q)
+		blk_queue_max_hw_segments(shost_to_fc_host(shost)->rqst_q, 1);
 	dev_set_drvdata(dev, vhost);
 	spin_lock(&ibmvfc_driver_lock);
 	list_add_tail(&vhost->queue, &ibmvfc_head);
@@ -4414,7 +4710,11 @@ static int ibmvfc_remove(struct vio_dev *vdev)
 
 	ENTER;
 	ibmvfc_remove_trace_file(&vhost->host->shost_dev.kobj, &ibmvfc_trace_attr);
+
+	spin_lock_irqsave(vhost->host->host_lock, flags);
 	ibmvfc_link_down(vhost, IBMVFC_HOST_OFFLINE);
+	spin_unlock_irqrestore(vhost->host->host_lock, flags);
+
 	ibmvfc_wait_while_resetting(vhost);
 	ibmvfc_release_crq_queue(vhost);
 	kthread_stop(vhost->work_thread);
@@ -4498,6 +4798,9 @@ static struct fc_function_template ibmvfc_transport_functions = {
 
 	.get_starget_port_id = ibmvfc_get_starget_port_id,
 	.show_starget_port_id = 1,
+
+	.bsg_request = ibmvfc_bsg_request,
+	.bsg_timeout = ibmvfc_bsg_timeout,
 };
 
 /**
diff --git a/drivers/scsi/ibmvscsi/ibmvfc.h b/drivers/scsi/ibmvscsi/ibmvfc.h
index 007fa1c9ef14..d25106a958d7 100644
--- a/drivers/scsi/ibmvscsi/ibmvfc.h
+++ b/drivers/scsi/ibmvscsi/ibmvfc.h
@@ -29,8 +29,8 @@
 #include "viosrp.h"
 
 #define IBMVFC_NAME	"ibmvfc"
-#define IBMVFC_DRIVER_VERSION		"1.0.6"
-#define IBMVFC_DRIVER_DATE		"(May 28, 2009)"
+#define IBMVFC_DRIVER_VERSION		"1.0.7"
+#define IBMVFC_DRIVER_DATE		"(October 16, 2009)"
 
 #define IBMVFC_DEFAULT_TIMEOUT	60
 #define IBMVFC_ADISC_CANCEL_TIMEOUT	45
@@ -58,9 +58,10 @@
  * 1 for ERP
  * 1 for initialization
  * 1 for NPIV Logout
+ * 2 for BSG passthru
  * 2 for each discovery thread
  */
-#define IBMVFC_NUM_INTERNAL_REQ	(1 + 1 + 1 + (disc_threads * 2))
+#define IBMVFC_NUM_INTERNAL_REQ	(1 + 1 + 1 + 2 + (disc_threads * 2))
 
 #define IBMVFC_MAD_SUCCESS		0x00
 #define IBMVFC_MAD_NOT_SUPPORTED	0xF1
@@ -466,7 +467,10 @@ struct ibmvfc_passthru_iu {
 	u16 error;
 	u32 flags;
 #define IBMVFC_FC_ELS		0x01
+#define IBMVFC_FC_CT_IU		0x02
 	u32 cancel_key;
+#define IBMVFC_PASSTHRU_CANCEL_KEY	0x80000000
+#define IBMVFC_INTERNAL_CANCEL_KEY	0x80000001
 	u32 reserved;
 	struct srp_direct_buf cmd;
 	struct srp_direct_buf rsp;
@@ -693,6 +697,7 @@ struct ibmvfc_host {
 	int disc_buf_sz;
 	int log_level;
 	struct ibmvfc_discover_targets_buf *disc_buf;
+	struct mutex passthru_mutex;
 	int task_set;
 	int init_retries;
 	int discovery_threads;
@@ -702,6 +707,7 @@ struct ibmvfc_host {
 	int delay_init;
 	int scan_complete;
 	int logged_in;
+	int aborting_passthru;
 	int events_to_log;
 #define IBMVFC_AE_LINKUP	0x0001
 #define IBMVFC_AE_LINKDOWN	0x0002
diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c
index d9b0e9d31983..e475b7957c2d 100644
--- a/drivers/scsi/ibmvscsi/ibmvscsi.c
+++ b/drivers/scsi/ibmvscsi/ibmvscsi.c
@@ -1637,12 +1637,17 @@ static int ibmvscsi_slave_configure(struct scsi_device *sdev)
  * ibmvscsi_change_queue_depth - Change the device's queue depth
  * @sdev:	scsi device struct
  * @qdepth:	depth to set
+ * @reason:	calling context
  *
  * Return value:
  * 	actual depth set
  **/
-static int ibmvscsi_change_queue_depth(struct scsi_device *sdev, int qdepth)
+static int ibmvscsi_change_queue_depth(struct scsi_device *sdev, int qdepth,
+				       int reason)
 {
+	if (reason != SCSI_QDEPTH_DEFAULT)
+		return -EOPNOTSUPP;
+
 	if (qdepth > IBMVSCSI_MAX_CMDS_PER_LUN)
 		qdepth = IBMVSCSI_MAX_CMDS_PER_LUN;
 
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index 76d294fc7846..9e52d16c7c39 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -1333,7 +1333,7 @@ static void ipr_log_enhanced_dual_ioa_error(struct ipr_ioa_cfg *ioa_cfg,
 
 	error = &hostrcb->hcam.u.error.u.type_17_error;
 	error->failure_reason[sizeof(error->failure_reason) - 1] = '\0';
-	strstrip(error->failure_reason);
+	strim(error->failure_reason);
 
 	ipr_hcam_err(hostrcb, "%s [PRC: %08X]\n", error->failure_reason,
 		     be32_to_cpu(hostrcb->hcam.u.error.prc));
@@ -1359,7 +1359,7 @@ static void ipr_log_dual_ioa_error(struct ipr_ioa_cfg *ioa_cfg,
 
 	error = &hostrcb->hcam.u.error.u.type_07_error;
 	error->failure_reason[sizeof(error->failure_reason) - 1] = '\0';
-	strstrip(error->failure_reason);
+	strim(error->failure_reason);
 
 	ipr_hcam_err(hostrcb, "%s [PRC: %08X]\n", error->failure_reason,
 		     be32_to_cpu(hostrcb->hcam.u.error.prc));
@@ -3367,16 +3367,21 @@ static int ipr_free_dump(struct ipr_ioa_cfg *ioa_cfg) { return 0; };
  * ipr_change_queue_depth - Change the device's queue depth
  * @sdev:	scsi device struct
  * @qdepth:	depth to set
+ * @reason:	calling context
  *
  * Return value:
  * 	actual depth set
  **/
-static int ipr_change_queue_depth(struct scsi_device *sdev, int qdepth)
+static int ipr_change_queue_depth(struct scsi_device *sdev, int qdepth,
+				  int reason)
 {
 	struct ipr_ioa_cfg *ioa_cfg = (struct ipr_ioa_cfg *)sdev->host->hostdata;
 	struct ipr_resource_entry *res;
 	unsigned long lock_flags = 0;
 
+	if (reason != SCSI_QDEPTH_DEFAULT)
+		return -EOPNOTSUPP;
+
 	spin_lock_irqsave(ioa_cfg->host->host_lock, lock_flags);
 	res = (struct ipr_resource_entry *)sdev->hostdata;
 
@@ -6516,6 +6521,7 @@ static int ipr_reset_restore_cfg_space(struct ipr_cmnd *ipr_cmd)
 	int rc;
 
 	ENTER;
+	ioa_cfg->pdev->state_saved = true;
 	rc = pci_restore_state(ioa_cfg->pdev);
 
 	if (rc != PCIBIOS_SUCCESSFUL) {
diff --git a/drivers/scsi/iscsi_tcp.c b/drivers/scsi/iscsi_tcp.c
index edc49ca49cea..517da3fd89d3 100644
--- a/drivers/scsi/iscsi_tcp.c
+++ b/drivers/scsi/iscsi_tcp.c
@@ -903,7 +903,7 @@ static struct iscsi_transport iscsi_sw_tcp_transport = {
 				  ISCSI_USERNAME | ISCSI_PASSWORD |
 				  ISCSI_USERNAME_IN | ISCSI_PASSWORD_IN |
 				  ISCSI_FAST_ABORT | ISCSI_ABORT_TMO |
-				  ISCSI_LU_RESET_TMO |
+				  ISCSI_LU_RESET_TMO | ISCSI_TGT_RESET_TMO |
 				  ISCSI_PING_TMO | ISCSI_RECV_TMO |
 				  ISCSI_IFACE_NAME | ISCSI_INITIATOR_NAME,
 	.host_param_mask	= ISCSI_HOST_HWADDRESS | ISCSI_HOST_IPADDRESS |
diff --git a/drivers/scsi/libfc/Makefile b/drivers/scsi/libfc/Makefile
index 55f982de3a9a..4bb23ac86a5c 100644
--- a/drivers/scsi/libfc/Makefile
+++ b/drivers/scsi/libfc/Makefile
@@ -3,10 +3,12 @@
 obj-$(CONFIG_LIBFC) += libfc.o
 
 libfc-objs := \
+	fc_libfc.o \
 	fc_disc.o \
 	fc_exch.o \
 	fc_elsct.o \
 	fc_frame.o \
 	fc_lport.o \
 	fc_rport.o \
-	fc_fcp.o
+	fc_fcp.o \
+	fc_npiv.o
diff --git a/drivers/scsi/libfc/fc_disc.c b/drivers/scsi/libfc/fc_disc.c
index c48799e9dd8e..9b0a5192a965 100644
--- a/drivers/scsi/libfc/fc_disc.c
+++ b/drivers/scsi/libfc/fc_disc.c
@@ -40,6 +40,8 @@
 
 #include <scsi/libfc.h>
 
+#include "fc_libfc.h"
+
 #define FC_DISC_RETRY_LIMIT	3	/* max retries */
 #define FC_DISC_RETRY_DELAY	500UL	/* (msecs) delay */
 
@@ -51,8 +53,8 @@ static int fc_disc_single(struct fc_lport *, struct fc_disc_port *);
 static void fc_disc_restart(struct fc_disc *);
 
 /**
- * fc_disc_stop_rports() - delete all the remote ports associated with the lport
- * @disc: The discovery job to stop rports on
+ * fc_disc_stop_rports() - Delete all the remote ports associated with the lport
+ * @disc: The discovery job to stop remote ports on
  *
  * Locking Note: This function expects that the lport mutex is locked before
  * calling it.
@@ -72,9 +74,9 @@ void fc_disc_stop_rports(struct fc_disc *disc)
 
 /**
  * fc_disc_recv_rscn_req() - Handle Registered State Change Notification (RSCN)
- * @sp: Current sequence of the RSCN exchange
- * @fp: RSCN Frame
- * @lport: Fibre Channel host port instance
+ * @sp:	   The sequence of the RSCN exchange
+ * @fp:	   The RSCN frame
+ * @lport: The local port that the request will be sent on
  *
  * Locking Note: This function expects that the disc_mutex is locked
  *		 before it is called.
@@ -183,9 +185,9 @@ reject:
 
 /**
  * fc_disc_recv_req() - Handle incoming requests
- * @sp: Current sequence of the request exchange
- * @fp: The frame
- * @lport: The FC local port
+ * @sp:	   The sequence of the request exchange
+ * @fp:	   The request frame
+ * @lport: The local port receiving the request
  *
  * Locking Note: This function is called from the EM and will lock
  *		 the disc_mutex before calling the handler for the
@@ -213,7 +215,7 @@ static void fc_disc_recv_req(struct fc_seq *sp, struct fc_frame *fp,
 
 /**
  * fc_disc_restart() - Restart discovery
- * @lport: FC discovery context
+ * @disc: The discovery object to be restarted
  *
  * Locking Note: This function expects that the disc mutex
  *		 is already locked.
@@ -240,9 +242,9 @@ static void fc_disc_restart(struct fc_disc *disc)
 }
 
 /**
- * fc_disc_start() - Fibre Channel Target discovery
- * @lport: FC local port
- * @disc_callback: function to be called when discovery is complete
+ * fc_disc_start() - Start discovery on a local port
+ * @lport:	   The local port to have discovery started on
+ * @disc_callback: Callback function to be called when discovery is complete
  */
 static void fc_disc_start(void (*disc_callback)(struct fc_lport *,
 						enum fc_disc_event),
@@ -263,8 +265,8 @@ static void fc_disc_start(void (*disc_callback)(struct fc_lport *,
 
 /**
  * fc_disc_done() - Discovery has been completed
- * @disc: FC discovery context
- * @event: discovery completion status
+ * @disc:  The discovery context
+ * @event: The discovery completion status
  *
  * Locking Note: This function expects that the disc mutex is locked before
  * it is called. The discovery callback is then made with the lock released,
@@ -284,8 +286,8 @@ static void fc_disc_done(struct fc_disc *disc, enum fc_disc_event event)
 	}
 
 	/*
-	 * Go through all remote ports.  If they were found in the latest
-	 * discovery, reverify or log them in.  Otherwise, log them out.
+	 * Go through all remote ports.	 If they were found in the latest
+	 * discovery, reverify or log them in.	Otherwise, log them out.
 	 * Skip ports which were never discovered.  These are the dNS port
 	 * and ports which were created by PLOGI.
 	 */
@@ -305,8 +307,8 @@ static void fc_disc_done(struct fc_disc *disc, enum fc_disc_event event)
 
 /**
  * fc_disc_error() - Handle error on dNS request
- * @disc: FC discovery context
- * @fp: The frame pointer
+ * @disc: The discovery context
+ * @fp:	  The error code encoded as a frame pointer
  */
 static void fc_disc_error(struct fc_disc *disc, struct fc_frame *fp)
 {
@@ -342,7 +344,7 @@ static void fc_disc_error(struct fc_disc *disc, struct fc_frame *fp)
 
 /**
  * fc_disc_gpn_ft_req() - Send Get Port Names by FC-4 type (GPN_FT) request
- * @lport: FC discovery context
+ * @lport: The discovery context
  *
  * Locking Note: This function expects that the disc_mutex is locked
  *		 before it is called.
@@ -368,17 +370,17 @@ static void fc_disc_gpn_ft_req(struct fc_disc *disc)
 	if (lport->tt.elsct_send(lport, 0, fp,
 				 FC_NS_GPN_FT,
 				 fc_disc_gpn_ft_resp,
-				 disc, lport->e_d_tov))
+				 disc, 3 * lport->r_a_tov))
 		return;
 err:
-	fc_disc_error(disc, fp);
+	fc_disc_error(disc, NULL);
 }
 
 /**
  * fc_disc_gpn_ft_parse() - Parse the body of the dNS GPN_FT response.
- * @lport: Fibre Channel host port instance
- * @buf: GPN_FT response buffer
- * @len: size of response buffer
+ * @lport: The local port the GPN_FT was received on
+ * @buf:   The GPN_FT response buffer
+ * @len:   The size of response buffer
  *
  * Goes through the list of IDs and names resulting from a request.
  */
@@ -477,10 +479,8 @@ static int fc_disc_gpn_ft_parse(struct fc_disc *disc, void *buf, size_t len)
 }
 
 /**
- * fc_disc_timeout() - Retry handler for the disc component
- * @work: Structure holding disc obj that needs retry discovery
- *
- * Handle retry of memory allocation for remote ports.
+ * fc_disc_timeout() - Handler for discovery timeouts
+ * @work: Structure holding discovery context that needs to retry discovery
  */
 static void fc_disc_timeout(struct work_struct *work)
 {
@@ -494,9 +494,9 @@ static void fc_disc_timeout(struct work_struct *work)
 
 /**
  * fc_disc_gpn_ft_resp() - Handle a response frame from Get Port Names (GPN_FT)
- * @sp: Current sequence of GPN_FT exchange
- * @fp: response frame
- * @lp_arg: Fibre Channel host port instance
+ * @sp:	    The sequence that the GPN_FT response was received on
+ * @fp:	    The GPN_FT response frame
+ * @lp_arg: The discovery context
  *
  * Locking Note: This function is called without disc mutex held, and
  *		 should do all its processing with the mutex held
@@ -567,9 +567,9 @@ static void fc_disc_gpn_ft_resp(struct fc_seq *sp, struct fc_frame *fp,
 
 /**
  * fc_disc_gpn_id_resp() - Handle a response frame from Get Port Names (GPN_ID)
- * @sp: exchange sequence
- * @fp: response frame
- * @rdata_arg: remote port private data
+ * @sp:	       The sequence the GPN_ID is on
+ * @fp:	       The response frame
+ * @rdata_arg: The remote port that sent the GPN_ID response
  *
  * Locking Note: This function is called without disc mutex held.
  */
@@ -637,7 +637,7 @@ out:
 
 /**
  * fc_disc_gpn_id_req() - Send Get Port Names by ID (GPN_ID) request
- * @lport: local port
+ * @lport: The local port to initiate discovery on
  * @rdata: remote port private data
  *
  * Locking Note: This function expects that the disc_mutex is locked
@@ -654,7 +654,8 @@ static int fc_disc_gpn_id_req(struct fc_lport *lport,
 	if (!fp)
 		return -ENOMEM;
 	if (!lport->tt.elsct_send(lport, rdata->ids.port_id, fp, FC_NS_GPN_ID,
-				 fc_disc_gpn_id_resp, rdata, lport->e_d_tov))
+				  fc_disc_gpn_id_resp, rdata,
+				  3 * lport->r_a_tov))
 		return -ENOMEM;
 	kref_get(&rdata->kref);
 	return 0;
@@ -662,8 +663,8 @@ static int fc_disc_gpn_id_req(struct fc_lport *lport,
 
 /**
  * fc_disc_single() - Discover the directory information for a single target
- * @lport: local port
- * @dp: The port to rediscover
+ * @lport: The local port the remote port is associated with
+ * @dp:	   The port to rediscover
  *
  * Locking Note: This function expects that the disc_mutex is locked
  *		 before it is called.
@@ -681,7 +682,7 @@ static int fc_disc_single(struct fc_lport *lport, struct fc_disc_port *dp)
 
 /**
  * fc_disc_stop() - Stop discovery for a given lport
- * @lport: The lport that discovery should stop for
+ * @lport: The local port that discovery should stop on
  */
 void fc_disc_stop(struct fc_lport *lport)
 {
@@ -695,7 +696,7 @@ void fc_disc_stop(struct fc_lport *lport)
 
 /**
  * fc_disc_stop_final() - Stop discovery for a given lport
- * @lport: The lport that discovery should stop for
+ * @lport: The lport that discovery should stop on
  *
  * This function will block until discovery has been
  * completely stopped and all rports have been deleted.
@@ -707,8 +708,8 @@ void fc_disc_stop_final(struct fc_lport *lport)
 }
 
 /**
- * fc_disc_init() - Initialize the discovery block
- * @lport: FC local port
+ * fc_disc_init() - Initialize the discovery layer for a local port
+ * @lport: The local port that needs the discovery layer to be initialized
  */
 int fc_disc_init(struct fc_lport *lport)
 {
diff --git a/drivers/scsi/libfc/fc_elsct.c b/drivers/scsi/libfc/fc_elsct.c
index 5cfa68732e9d..53748724f2c5 100644
--- a/drivers/scsi/libfc/fc_elsct.c
+++ b/drivers/scsi/libfc/fc_elsct.c
@@ -28,17 +28,22 @@
 #include <scsi/libfc.h>
 #include <scsi/fc_encode.h>
 
-/*
- * fc_elsct_send - sends ELS/CT frame
+/**
+ * fc_elsct_send() - Send an ELS or CT frame
+ * @lport:	The local port to send the frame on
+ * @did:	The destination ID for the frame
+ * @fp:		The frame to be sent
+ * @op:		The operational code
+ * @resp:	The callback routine when the response is received
+ * @arg:	The argument to pass to the response callback routine
+ * @timer_msec: The timeout period for the frame (in msecs)
  */
-static struct fc_seq *fc_elsct_send(struct fc_lport *lport,
-				    u32 did,
-				    struct fc_frame *fp,
-				    unsigned int op,
-				    void (*resp)(struct fc_seq *,
-						 struct fc_frame *fp,
-						 void *arg),
-				    void *arg, u32 timer_msec)
+struct fc_seq *fc_elsct_send(struct fc_lport *lport, u32 did,
+			     struct fc_frame *fp, unsigned int op,
+			     void (*resp)(struct fc_seq *,
+					  struct fc_frame *,
+					  void *),
+			     void *arg, u32 timer_msec)
 {
 	enum fc_rctl r_ctl;
 	enum fc_fh_type fh_type;
@@ -53,15 +58,22 @@ static struct fc_seq *fc_elsct_send(struct fc_lport *lport,
 		did = FC_FID_DIR_SERV;
 	}
 
-	if (rc)
+	if (rc) {
+		fc_frame_free(fp);
 		return NULL;
+	}
 
 	fc_fill_fc_hdr(fp, r_ctl, did, fc_host_port_id(lport->host), fh_type,
 		       FC_FC_FIRST_SEQ | FC_FC_END_SEQ | FC_FC_SEQ_INIT, 0);
 
 	return lport->tt.exch_seq_send(lport, fp, resp, NULL, arg, timer_msec);
 }
+EXPORT_SYMBOL(fc_elsct_send);
 
+/**
+ * fc_elsct_init() - Initialize the ELS/CT layer
+ * @lport: The local port to initialize the ELS/CT layer for
+ */
 int fc_elsct_init(struct fc_lport *lport)
 {
 	if (!lport->tt.elsct_send)
@@ -72,12 +84,15 @@ int fc_elsct_init(struct fc_lport *lport)
 EXPORT_SYMBOL(fc_elsct_init);
 
 /**
- * fc_els_resp_type() - return string describing ELS response for debug.
- * @fp: frame pointer with possible error code.
+ * fc_els_resp_type() - Return a string describing the ELS response
+ * @fp: The frame pointer or possible error code
  */
 const char *fc_els_resp_type(struct fc_frame *fp)
 {
 	const char *msg;
+	struct fc_frame_header *fh;
+	struct fc_ct_hdr *ct;
+
 	if (IS_ERR(fp)) {
 		switch (-PTR_ERR(fp)) {
 		case FC_NO_ERR:
@@ -94,15 +109,41 @@ const char *fc_els_resp_type(struct fc_frame *fp)
 			break;
 		}
 	} else {
-		switch (fc_frame_payload_op(fp)) {
-		case ELS_LS_ACC:
-			msg = "accept";
+		fh = fc_frame_header_get(fp);
+		switch (fh->fh_type) {
+		case FC_TYPE_ELS:
+			switch (fc_frame_payload_op(fp)) {
+			case ELS_LS_ACC:
+				msg = "accept";
+				break;
+			case ELS_LS_RJT:
+				msg = "reject";
+				break;
+			default:
+				msg = "response unknown ELS";
+				break;
+			}
 			break;
-		case ELS_LS_RJT:
-			msg = "reject";
+		case FC_TYPE_CT:
+			ct = fc_frame_payload_get(fp, sizeof(*ct));
+			if (ct) {
+				switch (ntohs(ct->ct_cmd)) {
+				case FC_FS_ACC:
+					msg = "CT accept";
+					break;
+				case FC_FS_RJT:
+					msg = "CT reject";
+					break;
+				default:
+					msg = "response unknown CT";
+					break;
+				}
+			} else {
+				msg = "short CT response";
+			}
 			break;
 		default:
-			msg = "response unknown ELS";
+			msg = "response not ELS or CT";
 			break;
 		}
 	}
diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c
index c1c15748220c..19d711cb938c 100644
--- a/drivers/scsi/libfc/fc_exch.c
+++ b/drivers/scsi/libfc/fc_exch.c
@@ -32,10 +32,13 @@
 #include <scsi/libfc.h>
 #include <scsi/fc_encode.h>
 
+#include "fc_libfc.h"
+
 u16	fc_cpu_mask;		/* cpu mask for possible cpus */
 EXPORT_SYMBOL(fc_cpu_mask);
 static u16	fc_cpu_order;	/* 2's power to represent total possible cpus */
-static struct kmem_cache *fc_em_cachep;        /* cache for exchanges */
+static struct kmem_cache *fc_em_cachep;	       /* cache for exchanges */
+struct workqueue_struct *fc_exch_workqueue;
 
 /*
  * Structure and function definitions for managing Fibre Channel Exchanges
@@ -50,35 +53,46 @@ static struct kmem_cache *fc_em_cachep;        /* cache for exchanges */
  * fc_seq holds the state for an individual sequence.
  */
 
-/*
- * Per cpu exchange pool
+/**
+ * struct fc_exch_pool - Per cpu exchange pool
+ * @next_index:	  Next possible free exchange index
+ * @total_exches: Total allocated exchanges
+ * @lock:	  Exch pool lock
+ * @ex_list:	  List of exchanges
  *
  * This structure manages per cpu exchanges in array of exchange pointers.
  * This array is allocated followed by struct fc_exch_pool memory for
  * assigned range of exchanges to per cpu pool.
  */
 struct fc_exch_pool {
-	u16		next_index;	/* next possible free exchange index */
-	u16		total_exches;	/* total allocated exchanges */
-	spinlock_t	lock;		/* exch pool lock */
-	struct list_head	ex_list;	/* allocated exchanges list */
+	u16		 next_index;
+	u16		 total_exches;
+	spinlock_t	 lock;
+	struct list_head ex_list;
 };
 
-/*
- * Exchange manager.
+/**
+ * struct fc_exch_mgr - The Exchange Manager (EM).
+ * @class:	    Default class for new sequences
+ * @kref:	    Reference counter
+ * @min_xid:	    Minimum exchange ID
+ * @max_xid:	    Maximum exchange ID
+ * @ep_pool:	    Reserved exchange pointers
+ * @pool_max_index: Max exch array index in exch pool
+ * @pool:	    Per cpu exch pool
+ * @stats:	    Statistics structure
  *
  * This structure is the center for creating exchanges and sequences.
  * It manages the allocation of exchange IDs.
  */
 struct fc_exch_mgr {
-	enum fc_class	class;		/* default class for sequences */
-	struct kref	kref;		/* exchange mgr reference count */
-	u16		min_xid;	/* min exchange ID */
-	u16		max_xid;	/* max exchange ID */
-	struct list_head	ex_list;	/* allocated exchanges list */
-	mempool_t	*ep_pool;	/* reserve ep's */
-	u16		pool_max_index;	/* max exch array index in exch pool */
-	struct fc_exch_pool *pool;	/* per cpu exch pool */
+	enum fc_class	class;
+	struct kref	kref;
+	u16		min_xid;
+	u16		max_xid;
+	mempool_t	*ep_pool;
+	u16		pool_max_index;
+	struct fc_exch_pool *pool;
 
 	/*
 	 * currently exchange mgr stats are updated but not used.
@@ -96,6 +110,18 @@ struct fc_exch_mgr {
 };
 #define	fc_seq_exch(sp) container_of(sp, struct fc_exch, seq)
 
+/**
+ * struct fc_exch_mgr_anchor - primary structure for list of EMs
+ * @ema_list: Exchange Manager Anchor list
+ * @mp:	      Exchange Manager associated with this anchor
+ * @match:    Routine to determine if this anchor's EM should be used
+ *
+ * When walking the list of anchors the match routine will be called
+ * for each anchor to determine if that EM should be used. The last
+ * anchor in the list will always match to handle any exchanges not
+ * handled by other EMs. The non-default EMs would be added to the
+ * anchor list by HW that provides FCoE offloads.
+ */
 struct fc_exch_mgr_anchor {
 	struct list_head ema_list;
 	struct fc_exch_mgr *mp;
@@ -108,7 +134,6 @@ static void fc_seq_ls_rjt(struct fc_seq *, enum fc_els_rjt_reason,
 			  enum fc_els_rjt_explan);
 static void fc_exch_els_rec(struct fc_seq *, struct fc_frame *);
 static void fc_exch_els_rrq(struct fc_seq *, struct fc_frame *);
-static struct fc_seq *fc_seq_start_next_locked(struct fc_seq *sp);
 
 /*
  * Internal implementation notes.
@@ -196,6 +221,15 @@ static char *fc_exch_rctl_names[] = FC_RCTL_NAMES_INIT;
 
 #define FC_TABLE_SIZE(x)   (sizeof(x) / sizeof(x[0]))
 
+/**
+ * fc_exch_name_lookup() - Lookup name by opcode
+ * @op:	       Opcode to be looked up
+ * @table:     Opcode/name table
+ * @max_index: Index not to be exceeded
+ *
+ * This routine is used to determine a human-readable string identifying
+ * a R_CTL opcode.
+ */
 static inline const char *fc_exch_name_lookup(unsigned int op, char **table,
 					      unsigned int max_index)
 {
@@ -208,25 +242,34 @@ static inline const char *fc_exch_name_lookup(unsigned int op, char **table,
 	return name;
 }
 
+/**
+ * fc_exch_rctl_name() - Wrapper routine for fc_exch_name_lookup()
+ * @op: The opcode to be looked up
+ */
 static const char *fc_exch_rctl_name(unsigned int op)
 {
 	return fc_exch_name_lookup(op, fc_exch_rctl_names,
 				   FC_TABLE_SIZE(fc_exch_rctl_names));
 }
 
-/*
- * Hold an exchange - keep it from being freed.
+/**
+ * fc_exch_hold() - Increment an exchange's reference count
+ * @ep: Echange to be held
  */
-static void fc_exch_hold(struct fc_exch *ep)
+static inline void fc_exch_hold(struct fc_exch *ep)
 {
 	atomic_inc(&ep->ex_refcnt);
 }
 
-/*
- * setup fc hdr by initializing few more FC header fields and sof/eof.
- * Initialized fields by this func:
- *	- fh_ox_id, fh_rx_id, fh_seq_id, fh_seq_cnt
- *	- sof and eof
+/**
+ * fc_exch_setup_hdr() - Initialize a FC header by initializing some fields
+ *			 and determine SOF and EOF.
+ * @ep:	   The exchange to that will use the header
+ * @fp:	   The frame whose header is to be modified
+ * @f_ctl: F_CTL bits that will be used for the frame header
+ *
+ * The fields initialized by this routine are: fh_ox_id, fh_rx_id,
+ * fh_seq_id, fh_seq_cnt and the SOF and EOF.
  */
 static void fc_exch_setup_hdr(struct fc_exch *ep, struct fc_frame *fp,
 			      u32 f_ctl)
@@ -243,7 +286,7 @@ static void fc_exch_setup_hdr(struct fc_exch *ep, struct fc_frame *fp,
 		if (fc_sof_needs_ack(ep->class))
 			fr_eof(fp) = FC_EOF_N;
 		/*
-		 * Form f_ctl.
+		 * From F_CTL.
 		 * The number of fill bytes to make the length a 4-byte
 		 * multiple is the low order 2-bits of the f_ctl.
 		 * The fill itself will have been cleared by the frame
@@ -273,10 +316,12 @@ static void fc_exch_setup_hdr(struct fc_exch *ep, struct fc_frame *fp,
 	fh->fh_seq_cnt = htons(ep->seq.cnt);
 }
 
-
-/*
- * Release a reference to an exchange.
- * If the refcnt goes to zero and the exchange is complete, it is freed.
+/**
+ * fc_exch_release() - Decrement an exchange's reference count
+ * @ep: Exchange to be released
+ *
+ * If the reference count reaches zero and the exchange is complete,
+ * it is freed.
  */
 static void fc_exch_release(struct fc_exch *ep)
 {
@@ -291,6 +336,10 @@ static void fc_exch_release(struct fc_exch *ep)
 	}
 }
 
+/**
+ * fc_exch_done_locked() - Complete an exchange with the exchange lock held
+ * @ep: The exchange that is complete
+ */
 static int fc_exch_done_locked(struct fc_exch *ep)
 {
 	int rc = 1;
@@ -315,6 +364,15 @@ static int fc_exch_done_locked(struct fc_exch *ep)
 	return rc;
 }
 
+/**
+ * fc_exch_ptr_get() - Return an exchange from an exchange pool
+ * @pool:  Exchange Pool to get an exchange from
+ * @index: Index of the exchange within the pool
+ *
+ * Use the index to get an exchange from within an exchange pool. exches
+ * will point to an array of exchange pointers. The index will select
+ * the exchange within the array.
+ */
 static inline struct fc_exch *fc_exch_ptr_get(struct fc_exch_pool *pool,
 					      u16 index)
 {
@@ -322,12 +380,22 @@ static inline struct fc_exch *fc_exch_ptr_get(struct fc_exch_pool *pool,
 	return exches[index];
 }
 
+/**
+ * fc_exch_ptr_set() - Assign an exchange to a slot in an exchange pool
+ * @pool:  The pool to assign the exchange to
+ * @index: The index in the pool where the exchange will be assigned
+ * @ep:	   The exchange to assign to the pool
+ */
 static inline void fc_exch_ptr_set(struct fc_exch_pool *pool, u16 index,
 				   struct fc_exch *ep)
 {
 	((struct fc_exch **)(pool + 1))[index] = ep;
 }
 
+/**
+ * fc_exch_delete() - Delete an exchange
+ * @ep: The exchange to be deleted
+ */
 static void fc_exch_delete(struct fc_exch *ep)
 {
 	struct fc_exch_pool *pool;
@@ -343,8 +411,14 @@ static void fc_exch_delete(struct fc_exch *ep)
 	fc_exch_release(ep);	/* drop hold for exch in mp */
 }
 
-/*
- * Internal version of fc_exch_timer_set - used with lock held.
+/**
+ * fc_exch_timer_set_locked() - Start a timer for an exchange w/ the
+ *				the exchange lock held
+ * @ep:		The exchange whose timer will start
+ * @timer_msec: The timeout period
+ *
+ * Used for upper level protocols to time out the exchange.
+ * The timer is cancelled when it fires or when the exchange completes.
  */
 static inline void fc_exch_timer_set_locked(struct fc_exch *ep,
 					    unsigned int timer_msec)
@@ -354,17 +428,15 @@ static inline void fc_exch_timer_set_locked(struct fc_exch *ep,
 
 	FC_EXCH_DBG(ep, "Exchange timer armed\n");
 
-	if (schedule_delayed_work(&ep->timeout_work,
-				  msecs_to_jiffies(timer_msec)))
+	if (queue_delayed_work(fc_exch_workqueue, &ep->timeout_work,
+			       msecs_to_jiffies(timer_msec)))
 		fc_exch_hold(ep);		/* hold for timer */
 }
 
-/*
- * Set timer for an exchange.
- * The time is a minimum delay in milliseconds until the timer fires.
- * Used for upper level protocols to time out the exchange.
- * The timer is cancelled when it fires or when the exchange completes.
- * Returns non-zero if a timer couldn't be allocated.
+/**
+ * fc_exch_timer_set() - Lock the exchange and set the timer
+ * @ep:		The exchange whose timer will start
+ * @timer_msec: The timeout period
  */
 static void fc_exch_timer_set(struct fc_exch *ep, unsigned int timer_msec)
 {
@@ -373,7 +445,115 @@ static void fc_exch_timer_set(struct fc_exch *ep, unsigned int timer_msec)
 	spin_unlock_bh(&ep->ex_lock);
 }
 
-int fc_seq_exch_abort(const struct fc_seq *req_sp, unsigned int timer_msec)
+/**
+ * fc_seq_send() - Send a frame using existing sequence/exchange pair
+ * @lport: The local port that the exchange will be sent on
+ * @sp:	   The sequence to be sent
+ * @fp:	   The frame to be sent on the exchange
+ */
+static int fc_seq_send(struct fc_lport *lport, struct fc_seq *sp,
+		       struct fc_frame *fp)
+{
+	struct fc_exch *ep;
+	struct fc_frame_header *fh = fc_frame_header_get(fp);
+	int error;
+	u32 f_ctl;
+
+	ep = fc_seq_exch(sp);
+	WARN_ON((ep->esb_stat & ESB_ST_SEQ_INIT) != ESB_ST_SEQ_INIT);
+
+	f_ctl = ntoh24(fh->fh_f_ctl);
+	fc_exch_setup_hdr(ep, fp, f_ctl);
+
+	/*
+	 * update sequence count if this frame is carrying
+	 * multiple FC frames when sequence offload is enabled
+	 * by LLD.
+	 */
+	if (fr_max_payload(fp))
+		sp->cnt += DIV_ROUND_UP((fr_len(fp) - sizeof(*fh)),
+					fr_max_payload(fp));
+	else
+		sp->cnt++;
+
+	/*
+	 * Send the frame.
+	 */
+	error = lport->tt.frame_send(lport, fp);
+
+	/*
+	 * Update the exchange and sequence flags,
+	 * assuming all frames for the sequence have been sent.
+	 * We can only be called to send once for each sequence.
+	 */
+	spin_lock_bh(&ep->ex_lock);
+	ep->f_ctl = f_ctl & ~FC_FC_FIRST_SEQ;	/* not first seq */
+	if (f_ctl & (FC_FC_END_SEQ | FC_FC_SEQ_INIT))
+		ep->esb_stat &= ~ESB_ST_SEQ_INIT;
+	spin_unlock_bh(&ep->ex_lock);
+	return error;
+}
+
+/**
+ * fc_seq_alloc() - Allocate a sequence for a given exchange
+ * @ep:	    The exchange to allocate a new sequence for
+ * @seq_id: The sequence ID to be used
+ *
+ * We don't support multiple originated sequences on the same exchange.
+ * By implication, any previously originated sequence on this exchange
+ * is complete, and we reallocate the same sequence.
+ */
+static struct fc_seq *fc_seq_alloc(struct fc_exch *ep, u8 seq_id)
+{
+	struct fc_seq *sp;
+
+	sp = &ep->seq;
+	sp->ssb_stat = 0;
+	sp->cnt = 0;
+	sp->id = seq_id;
+	return sp;
+}
+
+/**
+ * fc_seq_start_next_locked() - Allocate a new sequence on the same
+ *				exchange as the supplied sequence
+ * @sp: The sequence/exchange to get a new sequence for
+ */
+static struct fc_seq *fc_seq_start_next_locked(struct fc_seq *sp)
+{
+	struct fc_exch *ep = fc_seq_exch(sp);
+
+	sp = fc_seq_alloc(ep, ep->seq_id++);
+	FC_EXCH_DBG(ep, "f_ctl %6x seq %2x\n",
+		    ep->f_ctl, sp->id);
+	return sp;
+}
+
+/**
+ * fc_seq_start_next() - Lock the exchange and get a new sequence
+ *			 for a given sequence/exchange pair
+ * @sp: The sequence/exchange to get a new exchange for
+ */
+static struct fc_seq *fc_seq_start_next(struct fc_seq *sp)
+{
+	struct fc_exch *ep = fc_seq_exch(sp);
+
+	spin_lock_bh(&ep->ex_lock);
+	sp = fc_seq_start_next_locked(sp);
+	spin_unlock_bh(&ep->ex_lock);
+
+	return sp;
+}
+
+/**
+ * fc_seq_exch_abort() - Abort an exchange and sequence
+ * @req_sp:	The sequence to be aborted
+ * @timer_msec: The period of time to wait before aborting
+ *
+ * Generally called because of a timeout or an abort from the upper layer.
+ */
+static int fc_seq_exch_abort(const struct fc_seq *req_sp,
+			     unsigned int timer_msec)
 {
 	struct fc_seq *sp;
 	struct fc_exch *ep;
@@ -422,11 +602,10 @@ int fc_seq_exch_abort(const struct fc_seq *req_sp, unsigned int timer_msec)
 		error = -ENOBUFS;
 	return error;
 }
-EXPORT_SYMBOL(fc_seq_exch_abort);
 
-/*
- * Exchange timeout - handle exchange timer expiration.
- * The timer will have been cancelled before this is called.
+/**
+ * fc_exch_timeout() - Handle exchange timer expiration
+ * @work: The work_struct identifying the exchange that timed out
  */
 static void fc_exch_timeout(struct work_struct *work)
 {
@@ -474,28 +653,10 @@ done:
 	fc_exch_release(ep);
 }
 
-/*
- * Allocate a sequence.
- *
- * We don't support multiple originated sequences on the same exchange.
- * By implication, any previously originated sequence on this exchange
- * is complete, and we reallocate the same sequence.
- */
-static struct fc_seq *fc_seq_alloc(struct fc_exch *ep, u8 seq_id)
-{
-	struct fc_seq *sp;
-
-	sp = &ep->seq;
-	sp->ssb_stat = 0;
-	sp->cnt = 0;
-	sp->id = seq_id;
-	return sp;
-}
-
 /**
- * fc_exch_em_alloc() - allocate an exchange from a specified EM.
- * @lport:	ptr to the local port
- * @mp:		ptr to the exchange manager
+ * fc_exch_em_alloc() - Allocate an exchange from a specified EM.
+ * @lport: The local port that the exchange is for
+ * @mp:	   The exchange manager that will allocate the exchange
  *
  * Returns pointer to allocated fc_exch with exch lock held.
  */
@@ -563,16 +724,18 @@ err:
 }
 
 /**
- * fc_exch_alloc() - allocate an exchange.
- * @lport:	ptr to the local port
- * @fp:		ptr to the FC frame
+ * fc_exch_alloc() - Allocate an exchange from an EM on a
+ *		     local port's list of EMs.
+ * @lport: The local port that will own the exchange
+ * @fp:	   The FC frame that the exchange will be for
  *
- * This function walks the list of the exchange manager(EM)
- * anchors to select a EM for new exchange allocation. The
- * EM is selected having either a NULL match function pointer
- * or call to match function returning true.
+ * This function walks the list of exchange manager(EM)
+ * anchors to select an EM for a new exchange allocation. The
+ * EM is selected when a NULL match function pointer is encountered
+ * or when a call to a match function returns true.
  */
-struct fc_exch *fc_exch_alloc(struct fc_lport *lport, struct fc_frame *fp)
+static struct fc_exch *fc_exch_alloc(struct fc_lport *lport,
+				     struct fc_frame *fp)
 {
 	struct fc_exch_mgr_anchor *ema;
 	struct fc_exch *ep;
@@ -586,10 +749,11 @@ struct fc_exch *fc_exch_alloc(struct fc_lport *lport, struct fc_frame *fp)
 	}
 	return NULL;
 }
-EXPORT_SYMBOL(fc_exch_alloc);
 
-/*
- * Lookup and hold an exchange.
+/**
+ * fc_exch_find() - Lookup and hold an exchange
+ * @mp:	 The exchange manager to lookup the exchange from
+ * @xid: The XID of the exchange to look up
  */
 static struct fc_exch *fc_exch_find(struct fc_exch_mgr *mp, u16 xid)
 {
@@ -609,7 +773,13 @@ static struct fc_exch *fc_exch_find(struct fc_exch_mgr *mp, u16 xid)
 	return ep;
 }
 
-void fc_exch_done(struct fc_seq *sp)
+
+/**
+ * fc_exch_done() - Indicate that an exchange/sequence tuple is complete and
+ *		    the memory allocated for the related objects may be freed.
+ * @sp: The sequence that has completed
+ */
+static void fc_exch_done(struct fc_seq *sp)
 {
 	struct fc_exch *ep = fc_seq_exch(sp);
 	int rc;
@@ -620,10 +790,13 @@ void fc_exch_done(struct fc_seq *sp)
 	if (!rc)
 		fc_exch_delete(ep);
 }
-EXPORT_SYMBOL(fc_exch_done);
 
-/*
- * Allocate a new exchange as responder.
+/**
+ * fc_exch_resp() - Allocate a new exchange for a response frame
+ * @lport: The local port that the exchange was for
+ * @mp:	   The exchange manager to allocate the exchange from
+ * @fp:	   The response frame
+ *
  * Sets the responder ID in the frame header.
  */
 static struct fc_exch *fc_exch_resp(struct fc_lport *lport,
@@ -664,8 +837,13 @@ static struct fc_exch *fc_exch_resp(struct fc_lport *lport,
 	return ep;
 }
 
-/*
- * Find a sequence for receive where the other end is originating the sequence.
+/**
+ * fc_seq_lookup_recip() - Find a sequence where the other end
+ *			   originated the sequence
+ * @lport: The local port that the frame was sent to
+ * @mp:	   The Exchange Manager to lookup the exchange from
+ * @fp:	   The frame associated with the sequence we're looking for
+ *
  * If fc_pf_rjt_reason is FC_RJT_NONE then this function will have a hold
  * on the ep that should be released by the caller.
  */
@@ -771,10 +949,12 @@ rel:
 	return reject;
 }
 
-/*
- * Find the sequence for a frame being received.
- * We originated the sequence, so it should be found.
- * We may or may not have originated the exchange.
+/**
+ * fc_seq_lookup_orig() - Find a sequence where this end
+ *			  originated the sequence
+ * @mp:	   The Exchange Manager to lookup the exchange from
+ * @fp:	   The frame associated with the sequence we're looking for
+ *
  * Does not hold the sequence for the caller.
  */
 static struct fc_seq *fc_seq_lookup_orig(struct fc_exch_mgr *mp,
@@ -806,8 +986,12 @@ static struct fc_seq *fc_seq_lookup_orig(struct fc_exch_mgr *mp,
 	return sp;
 }
 
-/*
- * Set addresses for an exchange.
+/**
+ * fc_exch_set_addr() - Set the source and destination IDs for an exchange
+ * @ep:	     The exchange to set the addresses for
+ * @orig_id: The originator's ID
+ * @resp_id: The responder's ID
+ *
  * Note this must be done before the first sequence of the exchange is sent.
  */
 static void fc_exch_set_addr(struct fc_exch *ep,
@@ -823,76 +1007,15 @@ static void fc_exch_set_addr(struct fc_exch *ep,
 	}
 }
 
-static struct fc_seq *fc_seq_start_next_locked(struct fc_seq *sp)
-{
-	struct fc_exch *ep = fc_seq_exch(sp);
-
-	sp = fc_seq_alloc(ep, ep->seq_id++);
-	FC_EXCH_DBG(ep, "f_ctl %6x seq %2x\n",
-		    ep->f_ctl, sp->id);
-	return sp;
-}
-/*
- * Allocate a new sequence on the same exchange as the supplied sequence.
- * This will never return NULL.
+/**
+ * fc_seq_els_rsp_send() - Send an ELS response using infomation from
+ *			   the existing sequence/exchange.
+ * @sp:	      The sequence/exchange to get information from
+ * @els_cmd:  The ELS command to be sent
+ * @els_data: The ELS data to be sent
  */
-struct fc_seq *fc_seq_start_next(struct fc_seq *sp)
-{
-	struct fc_exch *ep = fc_seq_exch(sp);
-
-	spin_lock_bh(&ep->ex_lock);
-	sp = fc_seq_start_next_locked(sp);
-	spin_unlock_bh(&ep->ex_lock);
-
-	return sp;
-}
-EXPORT_SYMBOL(fc_seq_start_next);
-
-int fc_seq_send(struct fc_lport *lp, struct fc_seq *sp, struct fc_frame *fp)
-{
-	struct fc_exch *ep;
-	struct fc_frame_header *fh = fc_frame_header_get(fp);
-	int error;
-	u32	f_ctl;
-
-	ep = fc_seq_exch(sp);
-	WARN_ON((ep->esb_stat & ESB_ST_SEQ_INIT) != ESB_ST_SEQ_INIT);
-
-	f_ctl = ntoh24(fh->fh_f_ctl);
-	fc_exch_setup_hdr(ep, fp, f_ctl);
-
-	/*
-	 * update sequence count if this frame is carrying
-	 * multiple FC frames when sequence offload is enabled
-	 * by LLD.
-	 */
-	if (fr_max_payload(fp))
-		sp->cnt += DIV_ROUND_UP((fr_len(fp) - sizeof(*fh)),
-					fr_max_payload(fp));
-	else
-		sp->cnt++;
-
-	/*
-	 * Send the frame.
-	 */
-	error = lp->tt.frame_send(lp, fp);
-
-	/*
-	 * Update the exchange and sequence flags,
-	 * assuming all frames for the sequence have been sent.
-	 * We can only be called to send once for each sequence.
-	 */
-	spin_lock_bh(&ep->ex_lock);
-	ep->f_ctl = f_ctl & ~FC_FC_FIRST_SEQ;	/* not first seq */
-	if (f_ctl & (FC_FC_END_SEQ | FC_FC_SEQ_INIT))
-		ep->esb_stat &= ~ESB_ST_SEQ_INIT;
-	spin_unlock_bh(&ep->ex_lock);
-	return error;
-}
-EXPORT_SYMBOL(fc_seq_send);
-
-void fc_seq_els_rsp_send(struct fc_seq *sp, enum fc_els_cmd els_cmd,
-			 struct fc_seq_els_data *els_data)
+static void fc_seq_els_rsp_send(struct fc_seq *sp, enum fc_els_cmd els_cmd,
+				struct fc_seq_els_data *els_data)
 {
 	switch (els_cmd) {
 	case ELS_LS_RJT:
@@ -911,10 +1034,13 @@ void fc_seq_els_rsp_send(struct fc_seq *sp, enum fc_els_cmd els_cmd,
 		FC_EXCH_DBG(fc_seq_exch(sp), "Invalid ELS CMD:%x\n", els_cmd);
 	}
 }
-EXPORT_SYMBOL(fc_seq_els_rsp_send);
 
-/*
- * Send a sequence, which is also the last sequence in the exchange.
+/**
+ * fc_seq_send_last() - Send a sequence that is the last in the exchange
+ * @sp:	     The sequence that is to be sent
+ * @fp:	     The frame that will be sent on the sequence
+ * @rctl:    The R_CTL information to be sent
+ * @fh_type: The frame header type
  */
 static void fc_seq_send_last(struct fc_seq *sp, struct fc_frame *fp,
 			     enum fc_rctl rctl, enum fc_fh_type fh_type)
@@ -928,9 +1054,12 @@ static void fc_seq_send_last(struct fc_seq *sp, struct fc_frame *fp,
 	fc_seq_send(ep->lp, sp, fp);
 }
 
-/*
+/**
+ * fc_seq_send_ack() - Send an acknowledgement that we've received a frame
+ * @sp:	   The sequence to send the ACK on
+ * @rx_fp: The received frame that is being acknoledged
+ *
  * Send ACK_1 (or equiv.) indicating we received something.
- * The frame we're acking is supplied.
  */
 static void fc_seq_send_ack(struct fc_seq *sp, const struct fc_frame *rx_fp)
 {
@@ -938,14 +1067,14 @@ static void fc_seq_send_ack(struct fc_seq *sp, const struct fc_frame *rx_fp)
 	struct fc_frame_header *rx_fh;
 	struct fc_frame_header *fh;
 	struct fc_exch *ep = fc_seq_exch(sp);
-	struct fc_lport *lp = ep->lp;
+	struct fc_lport *lport = ep->lp;
 	unsigned int f_ctl;
 
 	/*
 	 * Don't send ACKs for class 3.
 	 */
 	if (fc_sof_needs_ack(fr_sof(rx_fp))) {
-		fp = fc_frame_alloc(lp, 0);
+		fp = fc_frame_alloc(lport, 0);
 		if (!fp)
 			return;
 
@@ -980,12 +1109,16 @@ static void fc_seq_send_ack(struct fc_seq *sp, const struct fc_frame *rx_fp)
 		else
 			fr_eof(fp) = FC_EOF_N;
 
-		(void) lp->tt.frame_send(lp, fp);
+		lport->tt.frame_send(lport, fp);
 	}
 }
 
-/*
- * Send BLS Reject.
+/**
+ * fc_exch_send_ba_rjt() - Send BLS Reject
+ * @rx_fp:  The frame being rejected
+ * @reason: The reason the frame is being rejected
+ * @explan: The explaination for the rejection
+ *
  * This is for rejecting BA_ABTS only.
  */
 static void fc_exch_send_ba_rjt(struct fc_frame *rx_fp,
@@ -996,11 +1129,11 @@ static void fc_exch_send_ba_rjt(struct fc_frame *rx_fp,
 	struct fc_frame_header *rx_fh;
 	struct fc_frame_header *fh;
 	struct fc_ba_rjt *rp;
-	struct fc_lport *lp;
+	struct fc_lport *lport;
 	unsigned int f_ctl;
 
-	lp = fr_dev(rx_fp);
-	fp = fc_frame_alloc(lp, sizeof(*rp));
+	lport = fr_dev(rx_fp);
+	fp = fc_frame_alloc(lport, sizeof(*rp));
 	if (!fp)
 		return;
 	fh = fc_frame_header_get(fp);
@@ -1045,13 +1178,17 @@ static void fc_exch_send_ba_rjt(struct fc_frame *rx_fp,
 	if (fc_sof_needs_ack(fr_sof(fp)))
 		fr_eof(fp) = FC_EOF_N;
 
-	(void) lp->tt.frame_send(lp, fp);
+	lport->tt.frame_send(lport, fp);
 }
 
-/*
- * Handle an incoming ABTS.  This would be for target mode usually,
- * but could be due to lost FCP transfer ready, confirm or RRQ.
- * We always handle this as an exchange abort, ignoring the parameter.
+/**
+ * fc_exch_recv_abts() - Handle an incoming ABTS
+ * @ep:	   The exchange the abort was on
+ * @rx_fp: The ABTS frame
+ *
+ * This would be for target mode usually, but could be due to lost
+ * FCP transfer ready, confirm or RRQ. We always handle this as an
+ * exchange abort, ignoring the parameter.
  */
 static void fc_exch_recv_abts(struct fc_exch *ep, struct fc_frame *rx_fp)
 {
@@ -1100,10 +1237,14 @@ free:
 	fc_frame_free(rx_fp);
 }
 
-/*
- * Handle receive where the other end is originating the sequence.
+/**
+ * fc_exch_recv_req() - Handler for an incoming request where is other
+ *			end is originating the sequence
+ * @lport: The local port that received the request
+ * @mp:	   The EM that the exchange is on
+ * @fp:	   The request frame
  */
-static void fc_exch_recv_req(struct fc_lport *lp, struct fc_exch_mgr *mp,
+static void fc_exch_recv_req(struct fc_lport *lport, struct fc_exch_mgr *mp,
 			     struct fc_frame *fp)
 {
 	struct fc_frame_header *fh = fc_frame_header_get(fp);
@@ -1114,8 +1255,17 @@ static void fc_exch_recv_req(struct fc_lport *lp, struct fc_exch_mgr *mp,
 	u32 f_ctl;
 	enum fc_pf_rjt_reason reject;
 
+	/* We can have the wrong fc_lport at this point with NPIV, which is a
+	 * problem now that we know a new exchange needs to be allocated
+	 */
+	lport = fc_vport_id_lookup(lport, ntoh24(fh->fh_d_id));
+	if (!lport) {
+		fc_frame_free(fp);
+		return;
+	}
+
 	fr_seq(fp) = NULL;
-	reject = fc_seq_lookup_recip(lp, mp, fp);
+	reject = fc_seq_lookup_recip(lport, mp, fp);
 	if (reject == FC_RJT_NONE) {
 		sp = fr_seq(fp);	/* sequence will be held */
 		ep = fc_seq_exch(sp);
@@ -1138,17 +1288,21 @@ static void fc_exch_recv_req(struct fc_lport *lp, struct fc_exch_mgr *mp,
 		if (ep->resp)
 			ep->resp(sp, fp, ep->arg);
 		else
-			lp->tt.lport_recv(lp, sp, fp);
+			lport->tt.lport_recv(lport, sp, fp);
 		fc_exch_release(ep);	/* release from lookup */
 	} else {
-		FC_LPORT_DBG(lp, "exch/seq lookup failed: reject %x\n", reject);
+		FC_LPORT_DBG(lport, "exch/seq lookup failed: reject %x\n",
+			     reject);
 		fc_frame_free(fp);
 	}
 }
 
-/*
- * Handle receive where the other end is originating the sequence in
- * response to our exchange.
+/**
+ * fc_exch_recv_seq_resp() - Handler for an incoming response where the other
+ *			     end is the originator of the sequence that is a
+ *			     response to our initial exchange
+ * @mp: The EM that the exchange is on
+ * @fp: The response frame
  */
 static void fc_exch_recv_seq_resp(struct fc_exch_mgr *mp, struct fc_frame *fp)
 {
@@ -1239,8 +1393,11 @@ out:
 	fc_frame_free(fp);
 }
 
-/*
- * Handle receive for a sequence where other end is responding to our sequence.
+/**
+ * fc_exch_recv_resp() - Handler for a sequence where other end is
+ *			 responding to our sequence
+ * @mp: The EM that the exchange is on
+ * @fp: The response frame
  */
 static void fc_exch_recv_resp(struct fc_exch_mgr *mp, struct fc_frame *fp)
 {
@@ -1256,9 +1413,13 @@ static void fc_exch_recv_resp(struct fc_exch_mgr *mp, struct fc_frame *fp)
 	fc_frame_free(fp);
 }
 
-/*
- * Handle the response to an ABTS for exchange or sequence.
- * This can be BA_ACC or BA_RJT.
+/**
+ * fc_exch_abts_resp() - Handler for a response to an ABT
+ * @ep: The exchange that the frame is on
+ * @fp: The response frame
+ *
+ * This response would be to an ABTS cancelling an exchange or sequence.
+ * The response can be either BA_ACC or BA_RJT
  */
 static void fc_exch_abts_resp(struct fc_exch *ep, struct fc_frame *fp)
 {
@@ -1333,9 +1494,12 @@ static void fc_exch_abts_resp(struct fc_exch *ep, struct fc_frame *fp)
 
 }
 
-/*
- * Receive BLS sequence.
- * This is always a sequence initiated by the remote side.
+/**
+ * fc_exch_recv_bls() - Handler for a BLS sequence
+ * @mp: The EM that the exchange is on
+ * @fp: The request frame
+ *
+ * The BLS frame is always a sequence initiated by the remote side.
  * We may be either the originator or recipient of the exchange.
  */
 static void fc_exch_recv_bls(struct fc_exch_mgr *mp, struct fc_frame *fp)
@@ -1392,8 +1556,10 @@ static void fc_exch_recv_bls(struct fc_exch_mgr *mp, struct fc_frame *fp)
 		fc_exch_release(ep);	/* release hold taken by fc_exch_find */
 }
 
-/*
- * Accept sequence with LS_ACC.
+/**
+ * fc_seq_ls_acc() - Accept sequence with LS_ACC
+ * @req_sp: The request sequence
+ *
  * If this fails due to allocation or transmit congestion, assume the
  * originator will repeat the sequence.
  */
@@ -1413,8 +1579,12 @@ static void fc_seq_ls_acc(struct fc_seq *req_sp)
 	}
 }
 
-/*
- * Reject sequence with ELS LS_RJT.
+/**
+ * fc_seq_ls_rjt() - Reject a sequence with ELS LS_RJT
+ * @req_sp: The request sequence
+ * @reason: The reason the sequence is being rejected
+ * @explan: The explaination for the rejection
+ *
  * If this fails due to allocation or transmit congestion, assume the
  * originator will repeat the sequence.
  */
@@ -1437,6 +1607,10 @@ static void fc_seq_ls_rjt(struct fc_seq *req_sp, enum fc_els_rjt_reason reason,
 	}
 }
 
+/**
+ * fc_exch_reset() - Reset an exchange
+ * @ep: The exchange to be reset
+ */
 static void fc_exch_reset(struct fc_exch *ep)
 {
 	struct fc_seq *sp;
@@ -1446,12 +1620,6 @@ static void fc_exch_reset(struct fc_exch *ep)
 
 	spin_lock_bh(&ep->ex_lock);
 	ep->state |= FC_EX_RST_CLEANUP;
-	/*
-	 * we really want to call del_timer_sync, but cannot due
-	 * to the lport calling with the lport lock held (some resp
-	 * functions can also grab the lport lock which could cause
-	 * a deadlock).
-	 */
 	if (cancel_delayed_work(&ep->timeout_work))
 		atomic_dec(&ep->ex_refcnt);	/* drop hold for timer */
 	resp = ep->resp;
@@ -1471,16 +1639,16 @@ static void fc_exch_reset(struct fc_exch *ep)
 }
 
 /**
- * fc_exch_pool_reset() - Resets an per cpu exches pool.
- * @lport:	ptr to the local port
- * @pool:	ptr to the per cpu exches pool
- * @sid:	source FC ID
- * @did:	destination FC ID
+ * fc_exch_pool_reset() - Reset a per cpu exchange pool
+ * @lport: The local port that the exchange pool is on
+ * @pool:  The exchange pool to be reset
+ * @sid:   The source ID
+ * @did:   The destination ID
  *
- * Resets an per cpu exches pool, releasing its all sequences
- * and exchanges. If sid is non-zero, then reset only exchanges
- * we sourced from that FID. If did is non-zero, reset only
- * exchanges destined to that FID.
+ * Resets a per cpu exches pool, releasing all of its sequences
+ * and exchanges. If sid is non-zero then reset only exchanges
+ * we sourced from the local port's FID. If did is non-zero then
+ * only reset exchanges destined for the local port's FID.
  */
 static void fc_exch_pool_reset(struct fc_lport *lport,
 			       struct fc_exch_pool *pool,
@@ -1514,15 +1682,15 @@ restart:
 }
 
 /**
- * fc_exch_mgr_reset() - Resets all EMs of a lport
- * @lport:	ptr to the local port
- * @sid:	source FC ID
- * @did:	destination FC ID
+ * fc_exch_mgr_reset() - Reset all EMs of a local port
+ * @lport: The local port whose EMs are to be reset
+ * @sid:   The source ID
+ * @did:   The destination ID
  *
- * Reset all EMs of a lport, releasing its all sequences and
- * exchanges. If sid is non-zero, then reset only exchanges
- * we sourced from that FID. If did is non-zero, reset only
- * exchanges destined to that FID.
+ * Reset all EMs associated with a given local port. Release all
+ * sequences and exchanges. If sid is non-zero then reset only the
+ * exchanges sent from the local port's FID. If did is non-zero then
+ * reset only exchanges destined for the local port's FID.
  */
 void fc_exch_mgr_reset(struct fc_lport *lport, u32 sid, u32 did)
 {
@@ -1538,8 +1706,11 @@ void fc_exch_mgr_reset(struct fc_lport *lport, u32 sid, u32 did)
 }
 EXPORT_SYMBOL(fc_exch_mgr_reset);
 
-/*
- * Handle incoming ELS REC - Read Exchange Concise.
+/**
+ * fc_exch_els_rec() - Handler for ELS REC (Read Exchange Concise) requests
+ * @sp:	 The sequence the REC is on
+ * @rfp: The REC frame
+ *
  * Note that the requesting port may be different than the S_ID in the request.
  */
 static void fc_exch_els_rec(struct fc_seq *sp, struct fc_frame *rfp)
@@ -1621,10 +1792,11 @@ reject:
 	fc_frame_free(rfp);
 }
 
-/*
- * Handle response from RRQ.
- * Not much to do here, really.
- * Should report errors.
+/**
+ * fc_exch_rrq_resp() - Handler for RRQ responses
+ * @sp:	 The sequence that the RRQ is on
+ * @fp:	 The RRQ frame
+ * @arg: The exchange that the RRQ is on
  *
  * TODO: fix error handler.
  */
@@ -1664,21 +1836,99 @@ cleanup:
 	fc_exch_release(aborted_ep);
 }
 
-/*
- * Send ELS RRQ - Reinstate Recovery Qualifier.
+
+/**
+ * fc_exch_seq_send() - Send a frame using a new exchange and sequence
+ * @lport:	The local port to send the frame on
+ * @fp:		The frame to be sent
+ * @resp:	The response handler for this request
+ * @destructor: The destructor for the exchange
+ * @arg:	The argument to be passed to the response handler
+ * @timer_msec: The timeout period for the exchange
+ *
+ * The frame pointer with some of the header's fields must be
+ * filled before calling this routine, those fields are:
+ *
+ * - routing control
+ * - FC port did
+ * - FC port sid
+ * - FC header type
+ * - frame control
+ * - parameter or relative offset
+ */
+static struct fc_seq *fc_exch_seq_send(struct fc_lport *lport,
+				       struct fc_frame *fp,
+				       void (*resp)(struct fc_seq *,
+						    struct fc_frame *fp,
+						    void *arg),
+				       void (*destructor)(struct fc_seq *,
+							  void *),
+				       void *arg, u32 timer_msec)
+{
+	struct fc_exch *ep;
+	struct fc_seq *sp = NULL;
+	struct fc_frame_header *fh;
+	int rc = 1;
+
+	ep = fc_exch_alloc(lport, fp);
+	if (!ep) {
+		fc_frame_free(fp);
+		return NULL;
+	}
+	ep->esb_stat |= ESB_ST_SEQ_INIT;
+	fh = fc_frame_header_get(fp);
+	fc_exch_set_addr(ep, ntoh24(fh->fh_s_id), ntoh24(fh->fh_d_id));
+	ep->resp = resp;
+	ep->destructor = destructor;
+	ep->arg = arg;
+	ep->r_a_tov = FC_DEF_R_A_TOV;
+	ep->lp = lport;
+	sp = &ep->seq;
+
+	ep->fh_type = fh->fh_type; /* save for possbile timeout handling */
+	ep->f_ctl = ntoh24(fh->fh_f_ctl);
+	fc_exch_setup_hdr(ep, fp, ep->f_ctl);
+	sp->cnt++;
+
+	if (ep->xid <= lport->lro_xid)
+		fc_fcp_ddp_setup(fr_fsp(fp), ep->xid);
+
+	if (unlikely(lport->tt.frame_send(lport, fp)))
+		goto err;
+
+	if (timer_msec)
+		fc_exch_timer_set_locked(ep, timer_msec);
+	ep->f_ctl &= ~FC_FC_FIRST_SEQ;	/* not first seq */
+
+	if (ep->f_ctl & FC_FC_SEQ_INIT)
+		ep->esb_stat &= ~ESB_ST_SEQ_INIT;
+	spin_unlock_bh(&ep->ex_lock);
+	return sp;
+err:
+	rc = fc_exch_done_locked(ep);
+	spin_unlock_bh(&ep->ex_lock);
+	if (!rc)
+		fc_exch_delete(ep);
+	return NULL;
+}
+
+/**
+ * fc_exch_rrq() - Send an ELS RRQ (Reinstate Recovery Qualifier) command
+ * @ep: The exchange to send the RRQ on
+ *
  * This tells the remote port to stop blocking the use of
  * the exchange and the seq_cnt range.
  */
 static void fc_exch_rrq(struct fc_exch *ep)
 {
-	struct fc_lport *lp;
+	struct fc_lport *lport;
 	struct fc_els_rrq *rrq;
 	struct fc_frame *fp;
 	u32 did;
 
-	lp = ep->lp;
+	lport = ep->lp;
 
-	fp = fc_frame_alloc(lp, sizeof(*rrq));
+	fp = fc_frame_alloc(lport, sizeof(*rrq));
 	if (!fp)
 		goto retry;
 
@@ -1694,10 +1944,11 @@ static void fc_exch_rrq(struct fc_exch *ep)
 		did = ep->sid;
 
 	fc_fill_fc_hdr(fp, FC_RCTL_ELS_REQ, did,
-		       fc_host_port_id(lp->host), FC_TYPE_ELS,
+		       fc_host_port_id(lport->host), FC_TYPE_ELS,
 		       FC_FC_FIRST_SEQ | FC_FC_END_SEQ | FC_FC_SEQ_INIT, 0);
 
-	if (fc_exch_seq_send(lp, fp, fc_exch_rrq_resp, NULL, ep, lp->e_d_tov))
+	if (fc_exch_seq_send(lport, fp, fc_exch_rrq_resp, NULL, ep,
+			     lport->e_d_tov))
 		return;
 
 retry:
@@ -1714,12 +1965,14 @@ retry:
 }
 
 
-/*
- * Handle incoming ELS RRQ - Reset Recovery Qualifier.
+/**
+ * fc_exch_els_rrq() - Handler for ELS RRQ (Reset Recovery Qualifier) requests
+ * @sp: The sequence that the RRQ is on
+ * @fp: The RRQ frame
  */
 static void fc_exch_els_rrq(struct fc_seq *sp, struct fc_frame *fp)
 {
-	struct fc_exch *ep;		/* request or subject exchange */
+	struct fc_exch *ep = NULL;	/* request or subject exchange */
 	struct fc_els_rrq *rp;
 	u32 sid;
 	u16 xid;
@@ -1769,17 +2022,24 @@ static void fc_exch_els_rrq(struct fc_seq *sp, struct fc_frame *fp)
 	 * Send LS_ACC.
 	 */
 	fc_seq_ls_acc(sp);
-	fc_frame_free(fp);
-	return;
+	goto out;
 
 unlock_reject:
 	spin_unlock_bh(&ep->ex_lock);
-	fc_exch_release(ep);	/* drop hold from fc_exch_find */
 reject:
 	fc_seq_ls_rjt(sp, ELS_RJT_LOGIC, explan);
+out:
 	fc_frame_free(fp);
+	if (ep)
+		fc_exch_release(ep);	/* drop hold from fc_exch_find */
 }
 
+/**
+ * fc_exch_mgr_add() - Add an exchange manager to a local port's list of EMs
+ * @lport: The local port to add the exchange manager to
+ * @mp:	   The exchange manager to be added to the local port
+ * @match: The match routine that indicates when this EM should be used
+ */
 struct fc_exch_mgr_anchor *fc_exch_mgr_add(struct fc_lport *lport,
 					   struct fc_exch_mgr *mp,
 					   bool (*match)(struct fc_frame *))
@@ -1799,6 +2059,10 @@ struct fc_exch_mgr_anchor *fc_exch_mgr_add(struct fc_lport *lport,
 }
 EXPORT_SYMBOL(fc_exch_mgr_add);
 
+/**
+ * fc_exch_mgr_destroy() - Destroy an exchange manager
+ * @kref: The reference to the EM to be destroyed
+ */
 static void fc_exch_mgr_destroy(struct kref *kref)
 {
 	struct fc_exch_mgr *mp = container_of(kref, struct fc_exch_mgr, kref);
@@ -1808,6 +2072,10 @@ static void fc_exch_mgr_destroy(struct kref *kref)
 	kfree(mp);
 }
 
+/**
+ * fc_exch_mgr_del() - Delete an EM from a local port's list
+ * @ema: The exchange manager anchor identifying the EM to be deleted
+ */
 void fc_exch_mgr_del(struct fc_exch_mgr_anchor *ema)
 {
 	/* remove EM anchor from EM anchors list */
@@ -1817,7 +2085,35 @@ void fc_exch_mgr_del(struct fc_exch_mgr_anchor *ema)
 }
 EXPORT_SYMBOL(fc_exch_mgr_del);
 
-struct fc_exch_mgr *fc_exch_mgr_alloc(struct fc_lport *lp,
+/**
+ * fc_exch_mgr_list_clone() - Share all exchange manager objects
+ * @src: Source lport to clone exchange managers from
+ * @dst: New lport that takes references to all the exchange managers
+ */
+int fc_exch_mgr_list_clone(struct fc_lport *src, struct fc_lport *dst)
+{
+	struct fc_exch_mgr_anchor *ema, *tmp;
+
+	list_for_each_entry(ema, &src->ema_list, ema_list) {
+		if (!fc_exch_mgr_add(dst, ema->mp, ema->match))
+			goto err;
+	}
+	return 0;
+err:
+	list_for_each_entry_safe(ema, tmp, &dst->ema_list, ema_list)
+		fc_exch_mgr_del(ema);
+	return -ENOMEM;
+}
+
+/**
+ * fc_exch_mgr_alloc() - Allocate an exchange manager
+ * @lport:   The local port that the new EM will be associated with
+ * @class:   The default FC class for new exchanges
+ * @min_xid: The minimum XID for exchanges from the new EM
+ * @max_xid: The maximum XID for exchanges from the new EM
+ * @match:   The match routine for the new EM
+ */
+struct fc_exch_mgr *fc_exch_mgr_alloc(struct fc_lport *lport,
 				      enum fc_class class,
 				      u16 min_xid, u16 max_xid,
 				      bool (*match)(struct fc_frame *))
@@ -1830,7 +2126,7 @@ struct fc_exch_mgr *fc_exch_mgr_alloc(struct fc_lport *lp,
 
 	if (max_xid <= min_xid || max_xid == FC_XID_UNKNOWN ||
 	    (min_xid & fc_cpu_mask) != 0) {
-		FC_LPORT_DBG(lp, "Invalid min_xid 0x:%x and max_xid 0x:%x\n",
+		FC_LPORT_DBG(lport, "Invalid min_xid 0x:%x and max_xid 0x:%x\n",
 			     min_xid, max_xid);
 		return NULL;
 	}
@@ -1873,7 +2169,7 @@ struct fc_exch_mgr *fc_exch_mgr_alloc(struct fc_lport *lp,
 	}
 
 	kref_init(&mp->kref);
-	if (!fc_exch_mgr_add(lp, mp, match)) {
+	if (!fc_exch_mgr_add(lport, mp, match)) {
 		free_percpu(mp->pool);
 		goto free_mempool;
 	}
@@ -1894,76 +2190,26 @@ free_mp:
 }
 EXPORT_SYMBOL(fc_exch_mgr_alloc);
 
+/**
+ * fc_exch_mgr_free() - Free all exchange managers on a local port
+ * @lport: The local port whose EMs are to be freed
+ */
 void fc_exch_mgr_free(struct fc_lport *lport)
 {
 	struct fc_exch_mgr_anchor *ema, *next;
 
+	flush_workqueue(fc_exch_workqueue);
 	list_for_each_entry_safe(ema, next, &lport->ema_list, ema_list)
 		fc_exch_mgr_del(ema);
 }
 EXPORT_SYMBOL(fc_exch_mgr_free);
 
-
-struct fc_seq *fc_exch_seq_send(struct fc_lport *lp,
-				struct fc_frame *fp,
-				void (*resp)(struct fc_seq *,
-					     struct fc_frame *fp,
-					     void *arg),
-				void (*destructor)(struct fc_seq *, void *),
-				void *arg, u32 timer_msec)
-{
-	struct fc_exch *ep;
-	struct fc_seq *sp = NULL;
-	struct fc_frame_header *fh;
-	int rc = 1;
-
-	ep = fc_exch_alloc(lp, fp);
-	if (!ep) {
-		fc_frame_free(fp);
-		return NULL;
-	}
-	ep->esb_stat |= ESB_ST_SEQ_INIT;
-	fh = fc_frame_header_get(fp);
-	fc_exch_set_addr(ep, ntoh24(fh->fh_s_id), ntoh24(fh->fh_d_id));
-	ep->resp = resp;
-	ep->destructor = destructor;
-	ep->arg = arg;
-	ep->r_a_tov = FC_DEF_R_A_TOV;
-	ep->lp = lp;
-	sp = &ep->seq;
-
-	ep->fh_type = fh->fh_type; /* save for possbile timeout handling */
-	ep->f_ctl = ntoh24(fh->fh_f_ctl);
-	fc_exch_setup_hdr(ep, fp, ep->f_ctl);
-	sp->cnt++;
-
-	if (ep->xid <= lp->lro_xid)
-		fc_fcp_ddp_setup(fr_fsp(fp), ep->xid);
-
-	if (unlikely(lp->tt.frame_send(lp, fp)))
-		goto err;
-
-	if (timer_msec)
-		fc_exch_timer_set_locked(ep, timer_msec);
-	ep->f_ctl &= ~FC_FC_FIRST_SEQ;	/* not first seq */
-
-	if (ep->f_ctl & FC_FC_SEQ_INIT)
-		ep->esb_stat &= ~ESB_ST_SEQ_INIT;
-	spin_unlock_bh(&ep->ex_lock);
-	return sp;
-err:
-	rc = fc_exch_done_locked(ep);
-	spin_unlock_bh(&ep->ex_lock);
-	if (!rc)
-		fc_exch_delete(ep);
-	return NULL;
-}
-EXPORT_SYMBOL(fc_exch_seq_send);
-
-/*
- * Receive a frame
+/**
+ * fc_exch_recv() - Handler for received frames
+ * @lport: The local port the frame was received on
+ * @fp:	   The received frame
  */
-void fc_exch_recv(struct fc_lport *lp, struct fc_frame *fp)
+void fc_exch_recv(struct fc_lport *lport, struct fc_frame *fp)
 {
 	struct fc_frame_header *fh = fc_frame_header_get(fp);
 	struct fc_exch_mgr_anchor *ema;
@@ -1971,8 +2217,8 @@ void fc_exch_recv(struct fc_lport *lp, struct fc_frame *fp)
 	u16 oxid;
 
 	/* lport lock ? */
-	if (!lp || lp->state == LPORT_ST_DISABLED) {
-		FC_LPORT_DBG(lp, "Receiving frames for an lport that "
+	if (!lport || lport->state == LPORT_ST_DISABLED) {
+		FC_LPORT_DBG(lport, "Receiving frames for an lport that "
 			     "has not been initialized correctly\n");
 		fc_frame_free(fp);
 		return;
@@ -1981,7 +2227,7 @@ void fc_exch_recv(struct fc_lport *lp, struct fc_frame *fp)
 	f_ctl = ntoh24(fh->fh_f_ctl);
 	oxid = ntohs(fh->fh_ox_id);
 	if (f_ctl & FC_FC_EX_CTX) {
-		list_for_each_entry(ema, &lp->ema_list, ema_list) {
+		list_for_each_entry(ema, &lport->ema_list, ema_list) {
 			if ((oxid >= ema->mp->min_xid) &&
 			    (oxid <= ema->mp->max_xid)) {
 				found = 1;
@@ -1990,13 +2236,13 @@ void fc_exch_recv(struct fc_lport *lp, struct fc_frame *fp)
 		}
 
 		if (!found) {
-			FC_LPORT_DBG(lp, "Received response for out "
+			FC_LPORT_DBG(lport, "Received response for out "
 				     "of range oxid:%hx\n", oxid);
 			fc_frame_free(fp);
 			return;
 		}
 	} else
-		ema = list_entry(lp->ema_list.prev, typeof(*ema), ema_list);
+		ema = list_entry(lport->ema_list.prev, typeof(*ema), ema_list);
 
 	/*
 	 * If frame is marked invalid, just drop it.
@@ -2015,37 +2261,56 @@ void fc_exch_recv(struct fc_lport *lp, struct fc_frame *fp)
 		else if (f_ctl & FC_FC_SEQ_CTX)
 			fc_exch_recv_resp(ema->mp, fp);
 		else
-			fc_exch_recv_req(lp, ema->mp, fp);
+			fc_exch_recv_req(lport, ema->mp, fp);
 		break;
 	default:
-		FC_LPORT_DBG(lp, "dropping invalid frame (eof %x)", fr_eof(fp));
+		FC_LPORT_DBG(lport, "dropping invalid frame (eof %x)",
+			     fr_eof(fp));
 		fc_frame_free(fp);
 	}
 }
 EXPORT_SYMBOL(fc_exch_recv);
 
-int fc_exch_init(struct fc_lport *lp)
+/**
+ * fc_exch_init() - Initialize the exchange layer for a local port
+ * @lport: The local port to initialize the exchange layer for
+ */
+int fc_exch_init(struct fc_lport *lport)
 {
-	if (!lp->tt.seq_start_next)
-		lp->tt.seq_start_next = fc_seq_start_next;
+	if (!lport->tt.seq_start_next)
+		lport->tt.seq_start_next = fc_seq_start_next;
 
-	if (!lp->tt.exch_seq_send)
-		lp->tt.exch_seq_send = fc_exch_seq_send;
+	if (!lport->tt.exch_seq_send)
+		lport->tt.exch_seq_send = fc_exch_seq_send;
 
-	if (!lp->tt.seq_send)
-		lp->tt.seq_send = fc_seq_send;
+	if (!lport->tt.seq_send)
+		lport->tt.seq_send = fc_seq_send;
 
-	if (!lp->tt.seq_els_rsp_send)
-		lp->tt.seq_els_rsp_send = fc_seq_els_rsp_send;
+	if (!lport->tt.seq_els_rsp_send)
+		lport->tt.seq_els_rsp_send = fc_seq_els_rsp_send;
 
-	if (!lp->tt.exch_done)
-		lp->tt.exch_done = fc_exch_done;
+	if (!lport->tt.exch_done)
+		lport->tt.exch_done = fc_exch_done;
 
-	if (!lp->tt.exch_mgr_reset)
-		lp->tt.exch_mgr_reset = fc_exch_mgr_reset;
+	if (!lport->tt.exch_mgr_reset)
+		lport->tt.exch_mgr_reset = fc_exch_mgr_reset;
 
-	if (!lp->tt.seq_exch_abort)
-		lp->tt.seq_exch_abort = fc_seq_exch_abort;
+	if (!lport->tt.seq_exch_abort)
+		lport->tt.seq_exch_abort = fc_seq_exch_abort;
+
+	return 0;
+}
+EXPORT_SYMBOL(fc_exch_init);
+
+/**
+ * fc_setup_exch_mgr() - Setup an exchange manager
+ */
+int fc_setup_exch_mgr()
+{
+	fc_em_cachep = kmem_cache_create("libfc_em", sizeof(struct fc_exch),
+					 0, SLAB_HWCACHE_ALIGN, NULL);
+	if (!fc_em_cachep)
+		return -ENOMEM;
 
 	/*
 	 * Initialize fc_cpu_mask and fc_cpu_order. The
@@ -2069,20 +2334,17 @@ int fc_exch_init(struct fc_lport *lp)
 	}
 	fc_cpu_mask--;
 
-	return 0;
-}
-EXPORT_SYMBOL(fc_exch_init);
-
-int fc_setup_exch_mgr(void)
-{
-	fc_em_cachep = kmem_cache_create("libfc_em", sizeof(struct fc_exch),
-					 0, SLAB_HWCACHE_ALIGN, NULL);
-	if (!fc_em_cachep)
+	fc_exch_workqueue = create_singlethread_workqueue("fc_exch_workqueue");
+	if (!fc_exch_workqueue)
 		return -ENOMEM;
 	return 0;
 }
 
-void fc_destroy_exch_mgr(void)
+/**
+ * fc_destroy_exch_mgr() - Destroy an exchange manager
+ */
+void fc_destroy_exch_mgr()
 {
+	destroy_workqueue(fc_exch_workqueue);
 	kmem_cache_destroy(fc_em_cachep);
 }
diff --git a/drivers/scsi/libfc/fc_fcp.c b/drivers/scsi/libfc/fc_fcp.c
index 59a4408b27b5..881d5dfe8c74 100644
--- a/drivers/scsi/libfc/fc_fcp.c
+++ b/drivers/scsi/libfc/fc_fcp.c
@@ -39,15 +39,9 @@
 #include <scsi/libfc.h>
 #include <scsi/fc_encode.h>
 
-MODULE_AUTHOR("Open-FCoE.org");
-MODULE_DESCRIPTION("libfc");
-MODULE_LICENSE("GPL v2");
+#include "fc_libfc.h"
 
-unsigned int fc_debug_logging;
-module_param_named(debug_logging, fc_debug_logging, int, S_IRUGO|S_IWUSR);
-MODULE_PARM_DESC(debug_logging, "a bit mask of logging levels");
-
-static struct kmem_cache *scsi_pkt_cachep;
+struct kmem_cache *scsi_pkt_cachep;
 
 /* SRB state definitions */
 #define FC_SRB_FREE		0		/* cmd is free */
@@ -58,7 +52,6 @@ static struct kmem_cache *scsi_pkt_cachep;
 #define FC_SRB_DISCONTIG	(1 << 4)	/* non-sequential data recvd */
 #define FC_SRB_COMPL		(1 << 5)	/* fc_io_compl has been run */
 #define FC_SRB_FCP_PROCESSING_TMO (1 << 6)	/* timer function processing */
-#define FC_SRB_NOMEM		(1 << 7)	/* dropped to out of mem */
 
 #define FC_SRB_READ		(1 << 1)
 #define FC_SRB_WRITE		(1 << 0)
@@ -73,10 +66,22 @@ static struct kmem_cache *scsi_pkt_cachep;
 #define CMD_SCSI_STATUS(Cmnd)	    ((Cmnd)->SCp.Status)
 #define CMD_RESID_LEN(Cmnd)	    ((Cmnd)->SCp.buffers_residual)
 
+/**
+ * struct fc_fcp_internal - FCP layer internal data
+ * @scsi_pkt_pool: Memory pool to draw FCP packets from
+ * @scsi_queue_lock: Protects the scsi_pkt_queue
+ * @scsi_pkt_queue: Current FCP packets
+ * @last_can_queue_ramp_down_time: ramp down time
+ * @last_can_queue_ramp_up_time: ramp up time
+ * @max_can_queue: max can_queue size
+ */
 struct fc_fcp_internal {
-	mempool_t	*scsi_pkt_pool;
-	struct list_head scsi_pkt_queue;
-	u8		throttled;
+	mempool_t		*scsi_pkt_pool;
+	spinlock_t		scsi_queue_lock;
+	struct list_head	scsi_pkt_queue;
+	unsigned long		last_can_queue_ramp_down_time;
+	unsigned long		last_can_queue_ramp_up_time;
+	int			max_can_queue;
 };
 
 #define fc_get_scsi_internal(x)	((struct fc_fcp_internal *)(x)->scsi_priv)
@@ -90,9 +95,9 @@ static void fc_fcp_recv(struct fc_seq *, struct fc_frame *, void *);
 static void fc_fcp_resp(struct fc_fcp_pkt *, struct fc_frame *);
 static void fc_fcp_complete_locked(struct fc_fcp_pkt *);
 static void fc_tm_done(struct fc_seq *, struct fc_frame *, void *);
-static void fc_fcp_error(struct fc_fcp_pkt *fsp, struct fc_frame *fp);
+static void fc_fcp_error(struct fc_fcp_pkt *, struct fc_frame *);
 static void fc_timeout_error(struct fc_fcp_pkt *);
-static void fc_fcp_timeout(unsigned long data);
+static void fc_fcp_timeout(unsigned long);
 static void fc_fcp_rec(struct fc_fcp_pkt *);
 static void fc_fcp_rec_error(struct fc_fcp_pkt *, struct fc_frame *);
 static void fc_fcp_rec_resp(struct fc_seq *, struct fc_frame *, void *);
@@ -124,6 +129,7 @@ static void fc_fcp_srr_error(struct fc_fcp_pkt *, struct fc_frame *);
 #define FC_SCSI_TM_TOV		(10 * HZ)
 #define FC_SCSI_REC_TOV		(2 * HZ)
 #define FC_HOST_RESET_TIMEOUT	(30 * HZ)
+#define FC_CAN_QUEUE_PERIOD	(60 * HZ)
 
 #define FC_MAX_ERROR_CNT	5
 #define FC_MAX_RECOV_RETRY	3
@@ -131,23 +137,22 @@ static void fc_fcp_srr_error(struct fc_fcp_pkt *, struct fc_frame *);
 #define FC_FCP_DFLT_QUEUE_DEPTH 32
 
 /**
- * fc_fcp_pkt_alloc - allocation routine for scsi_pkt packet
- * @lp:		fc lport struct
- * @gfp:	gfp flags for allocation
+ * fc_fcp_pkt_alloc() - Allocate a fcp_pkt
+ * @lport: The local port that the FCP packet is for
+ * @gfp:   GFP flags for allocation
  *
- * This is used by upper layer scsi driver.
- * Return Value : scsi_pkt structure or null on allocation failure.
- * Context	: call from process context. no locking required.
+ * Return value: fcp_pkt structure or null on allocation failure.
+ * Context:	 Can be called from process context, no lock is required.
  */
-static struct fc_fcp_pkt *fc_fcp_pkt_alloc(struct fc_lport *lp, gfp_t gfp)
+static struct fc_fcp_pkt *fc_fcp_pkt_alloc(struct fc_lport *lport, gfp_t gfp)
 {
-	struct fc_fcp_internal *si = fc_get_scsi_internal(lp);
+	struct fc_fcp_internal *si = fc_get_scsi_internal(lport);
 	struct fc_fcp_pkt *fsp;
 
 	fsp = mempool_alloc(si->scsi_pkt_pool, gfp);
 	if (fsp) {
 		memset(fsp, 0, sizeof(*fsp));
-		fsp->lp = lp;
+		fsp->lp = lport;
 		atomic_set(&fsp->ref_cnt, 1);
 		init_timer(&fsp->timer);
 		INIT_LIST_HEAD(&fsp->list);
@@ -157,12 +162,11 @@ static struct fc_fcp_pkt *fc_fcp_pkt_alloc(struct fc_lport *lp, gfp_t gfp)
 }
 
 /**
- * fc_fcp_pkt_release() - release hold on scsi_pkt packet
- * @fsp:	fcp packet struct
+ * fc_fcp_pkt_release() - Release hold on a fcp_pkt
+ * @fsp: The FCP packet to be released
  *
- * This is used by upper layer scsi driver.
- * Context	: call from process  and interrupt context.
- *		  no locking required
+ * Context: Can be called from process or interrupt context,
+ *	    no lock is required.
  */
 static void fc_fcp_pkt_release(struct fc_fcp_pkt *fsp)
 {
@@ -173,20 +177,25 @@ static void fc_fcp_pkt_release(struct fc_fcp_pkt *fsp)
 	}
 }
 
+/**
+ * fc_fcp_pkt_hold() - Hold a fcp_pkt
+ * @fsp: The FCP packet to be held
+ */
 static void fc_fcp_pkt_hold(struct fc_fcp_pkt *fsp)
 {
 	atomic_inc(&fsp->ref_cnt);
 }
 
 /**
- * fc_fcp_pkt_destory() - release hold on scsi_pkt packet
- * @seq:		exchange sequence
- * @fsp:	fcp packet struct
+ * fc_fcp_pkt_destory() - Release hold on a fcp_pkt
+ * @seq: The sequence that the FCP packet is on (required by destructor API)
+ * @fsp: The FCP packet to be released
+ *
+ * This routine is called by a destructor callback in the exch_seq_send()
+ * routine of the libfc Transport Template. The 'struct fc_seq' is a required
+ * argument even though it is not used by this routine.
  *
- * Release hold on scsi_pkt packet set to keep scsi_pkt
- * till EM layer exch resource is not freed.
- * Context	: called from from EM layer.
- *		  no locking required
+ * Context: No locking required.
  */
 static void fc_fcp_pkt_destroy(struct fc_seq *seq, void *fsp)
 {
@@ -194,10 +203,10 @@ static void fc_fcp_pkt_destroy(struct fc_seq *seq, void *fsp)
 }
 
 /**
- * fc_fcp_lock_pkt() - lock a packet and get a ref to it.
- * @fsp:	fcp packet
+ * fc_fcp_lock_pkt() - Lock a fcp_pkt and increase its reference count
+ * @fsp: The FCP packet to be locked and incremented
  *
- * We should only return error if we return a command to scsi-ml before
+ * We should only return error if we return a command to SCSI-ml before
  * getting a response. This can happen in cases where we send a abort, but
  * do not wait for the response and the abort and command can be passing
  * each other on the wire/network-layer.
@@ -222,18 +231,33 @@ static inline int fc_fcp_lock_pkt(struct fc_fcp_pkt *fsp)
 	return 0;
 }
 
+/**
+ * fc_fcp_unlock_pkt() - Release a fcp_pkt's lock and decrement its
+ *			 reference count
+ * @fsp: The FCP packet to be unlocked and decremented
+ */
 static inline void fc_fcp_unlock_pkt(struct fc_fcp_pkt *fsp)
 {
 	spin_unlock_bh(&fsp->scsi_pkt_lock);
 	fc_fcp_pkt_release(fsp);
 }
 
+/**
+ * fc_fcp_timer_set() - Start a timer for a fcp_pkt
+ * @fsp:   The FCP packet to start a timer for
+ * @delay: The timeout period for the timer
+ */
 static void fc_fcp_timer_set(struct fc_fcp_pkt *fsp, unsigned long delay)
 {
 	if (!(fsp->state & FC_SRB_COMPL))
 		mod_timer(&fsp->timer, jiffies + delay);
 }
 
+/**
+ * fc_fcp_send_abort() - Send an abort for exchanges associated with a
+ *			 fcp_pkt
+ * @fsp: The FCP packet to abort exchanges on
+ */
 static int fc_fcp_send_abort(struct fc_fcp_pkt *fsp)
 {
 	if (!fsp->seq_ptr)
@@ -243,9 +267,14 @@ static int fc_fcp_send_abort(struct fc_fcp_pkt *fsp)
 	return fsp->lp->tt.seq_exch_abort(fsp->seq_ptr, 0);
 }
 
-/*
- * Retry command.
- * An abort isn't needed.
+/**
+ * fc_fcp_retry_cmd() - Retry a fcp_pkt
+ * @fsp: The FCP packet to be retried
+ *
+ * Sets the status code to be FC_ERROR and then calls
+ * fc_fcp_complete_locked() which in turn calls fc_io_compl().
+ * fc_io_compl() will notify the SCSI-ml that the I/O is done.
+ * The SCSI-ml will retry the command.
  */
 static void fc_fcp_retry_cmd(struct fc_fcp_pkt *fsp)
 {
@@ -260,64 +289,148 @@ static void fc_fcp_retry_cmd(struct fc_fcp_pkt *fsp)
 	fc_fcp_complete_locked(fsp);
 }
 
-/*
- * fc_fcp_ddp_setup - calls to LLD's ddp_setup to set up DDP
- * transfer for a read I/O indicated by the fc_fcp_pkt.
- * @fsp: ptr to the fc_fcp_pkt
- *
- * This is called in exch_seq_send() when we have a newly allocated
- * exchange with a valid exchange id to setup ddp.
- *
- * returns: none
+/**
+ * fc_fcp_ddp_setup() - Calls a LLD's ddp_setup routine to set up DDP context
+ * @fsp: The FCP packet that will manage the DDP frames
+ * @xid: The XID that will be used for the DDP exchange
  */
 void fc_fcp_ddp_setup(struct fc_fcp_pkt *fsp, u16 xid)
 {
-	struct fc_lport *lp;
+	struct fc_lport *lport;
 
 	if (!fsp)
 		return;
 
-	lp = fsp->lp;
+	lport = fsp->lp;
 	if ((fsp->req_flags & FC_SRB_READ) &&
-	    (lp->lro_enabled) && (lp->tt.ddp_setup)) {
-		if (lp->tt.ddp_setup(lp, xid, scsi_sglist(fsp->cmd),
-				     scsi_sg_count(fsp->cmd)))
+	    (lport->lro_enabled) && (lport->tt.ddp_setup)) {
+		if (lport->tt.ddp_setup(lport, xid, scsi_sglist(fsp->cmd),
+					scsi_sg_count(fsp->cmd)))
 			fsp->xfer_ddp = xid;
 	}
 }
-EXPORT_SYMBOL(fc_fcp_ddp_setup);
 
-/*
- * fc_fcp_ddp_done - calls to LLD's ddp_done to release any
- * DDP related resources for this I/O if it is initialized
- * as a ddp transfer
- * @fsp: ptr to the fc_fcp_pkt
- *
- * returns: none
+/**
+ * fc_fcp_ddp_done() - Calls a LLD's ddp_done routine to release any
+ *		       DDP related resources for a fcp_pkt
+ * @fsp: The FCP packet that DDP had been used on
  */
 static void fc_fcp_ddp_done(struct fc_fcp_pkt *fsp)
 {
-	struct fc_lport *lp;
+	struct fc_lport *lport;
 
 	if (!fsp)
 		return;
 
-	lp = fsp->lp;
-	if (fsp->xfer_ddp && lp->tt.ddp_done) {
-		fsp->xfer_len = lp->tt.ddp_done(lp, fsp->xfer_ddp);
-		fsp->xfer_ddp = 0;
+	if (fsp->xfer_ddp == FC_XID_UNKNOWN)
+		return;
+
+	lport = fsp->lp;
+	if (lport->tt.ddp_done) {
+		fsp->xfer_len = lport->tt.ddp_done(lport, fsp->xfer_ddp);
+		fsp->xfer_ddp = FC_XID_UNKNOWN;
 	}
 }
 
+/**
+ * fc_fcp_can_queue_ramp_up() - increases can_queue
+ * @lport: lport to ramp up can_queue
+ *
+ * Locking notes: Called with Scsi_Host lock held
+ */
+static void fc_fcp_can_queue_ramp_up(struct fc_lport *lport)
+{
+	struct fc_fcp_internal *si = fc_get_scsi_internal(lport);
+	int can_queue;
+
+	if (si->last_can_queue_ramp_up_time &&
+	    (time_before(jiffies, si->last_can_queue_ramp_up_time +
+			 FC_CAN_QUEUE_PERIOD)))
+		return;
+
+	if (time_before(jiffies, si->last_can_queue_ramp_down_time +
+			FC_CAN_QUEUE_PERIOD))
+		return;
+
+	si->last_can_queue_ramp_up_time = jiffies;
+
+	can_queue = lport->host->can_queue << 1;
+	if (can_queue >= si->max_can_queue) {
+		can_queue = si->max_can_queue;
+		si->last_can_queue_ramp_down_time = 0;
+	}
+	lport->host->can_queue = can_queue;
+	shost_printk(KERN_ERR, lport->host, "libfc: increased "
+		     "can_queue to %d.\n", can_queue);
+}
+
+/**
+ * fc_fcp_can_queue_ramp_down() - reduces can_queue
+ * @lport: lport to reduce can_queue
+ *
+ * If we are getting memory allocation failures, then we may
+ * be trying to execute too many commands. We let the running
+ * commands complete or timeout, then try again with a reduced
+ * can_queue. Eventually we will hit the point where we run
+ * on all reserved structs.
+ *
+ * Locking notes: Called with Scsi_Host lock held
+ */
+static void fc_fcp_can_queue_ramp_down(struct fc_lport *lport)
+{
+	struct fc_fcp_internal *si = fc_get_scsi_internal(lport);
+	int can_queue;
+
+	if (si->last_can_queue_ramp_down_time &&
+	    (time_before(jiffies, si->last_can_queue_ramp_down_time +
+			 FC_CAN_QUEUE_PERIOD)))
+		return;
+
+	si->last_can_queue_ramp_down_time = jiffies;
+
+	can_queue = lport->host->can_queue;
+	can_queue >>= 1;
+	if (!can_queue)
+		can_queue = 1;
+	lport->host->can_queue = can_queue;
+	shost_printk(KERN_ERR, lport->host, "libfc: Could not allocate frame.\n"
+		     "Reducing can_queue to %d.\n", can_queue);
+}
 
 /*
- * Receive SCSI data from target.
- * Called after receiving solicited data.
+ * fc_fcp_frame_alloc() -  Allocates fc_frame structure and buffer.
+ * @lport:	fc lport struct
+ * @len:	payload length
+ *
+ * Allocates fc_frame structure and buffer but if fails to allocate
+ * then reduce can_queue.
+ */
+static inline struct fc_frame *fc_fcp_frame_alloc(struct fc_lport *lport,
+						  size_t len)
+{
+	struct fc_frame *fp;
+	unsigned long flags;
+
+	fp = fc_frame_alloc(lport, len);
+	if (likely(fp))
+		return fp;
+
+	/* error case */
+	spin_lock_irqsave(lport->host->host_lock, flags);
+	fc_fcp_can_queue_ramp_down(lport);
+	spin_unlock_irqrestore(lport->host->host_lock, flags);
+	return NULL;
+}
+
+/**
+ * fc_fcp_recv_data() - Handler for receiving SCSI-FCP data from a target
+ * @fsp: The FCP packet the data is on
+ * @fp:	 The data frame
  */
 static void fc_fcp_recv_data(struct fc_fcp_pkt *fsp, struct fc_frame *fp)
 {
 	struct scsi_cmnd *sc = fsp->cmd;
-	struct fc_lport *lp = fsp->lp;
+	struct fc_lport *lport = fsp->lp;
 	struct fcoe_dev_stats *stats;
 	struct fc_frame_header *fh;
 	size_t start_offset;
@@ -327,7 +440,7 @@ static void fc_fcp_recv_data(struct fc_fcp_pkt *fsp, struct fc_frame *fp)
 	size_t len;
 	void *buf;
 	struct scatterlist *sg;
-	size_t remaining;
+	u32 nents;
 
 	fh = fc_frame_header_get(fp);
 	offset = ntohl(fh->fh_parm_offset);
@@ -351,65 +464,29 @@ static void fc_fcp_recv_data(struct fc_fcp_pkt *fsp, struct fc_frame *fp)
 	if (offset != fsp->xfer_len)
 		fsp->state |= FC_SRB_DISCONTIG;
 
-	crc = 0;
-	if (fr_flags(fp) & FCPHF_CRC_UNCHECKED)
-		crc = crc32(~0, (u8 *) fh, sizeof(*fh));
-
 	sg = scsi_sglist(sc);
-	remaining = len;
-
-	while (remaining > 0 && sg) {
-		size_t off;
-		void *page_addr;
-		size_t sg_bytes;
-
-		if (offset >= sg->length) {
-			offset -= sg->length;
-			sg = sg_next(sg);
-			continue;
-		}
-		sg_bytes = min(remaining, sg->length - offset);
-
-		/*
-		 * The scatterlist item may be bigger than PAGE_SIZE,
-		 * but we are limited to mapping PAGE_SIZE at a time.
-		 */
-		off = offset + sg->offset;
-		sg_bytes = min(sg_bytes, (size_t)
-			       (PAGE_SIZE - (off & ~PAGE_MASK)));
-		page_addr = kmap_atomic(sg_page(sg) + (off >> PAGE_SHIFT),
-					KM_SOFTIRQ0);
-		if (!page_addr)
-			break;		/* XXX panic? */
-
-		if (fr_flags(fp) & FCPHF_CRC_UNCHECKED)
-			crc = crc32(crc, buf, sg_bytes);
-		memcpy((char *)page_addr + (off & ~PAGE_MASK), buf,
-		       sg_bytes);
-
-		kunmap_atomic(page_addr, KM_SOFTIRQ0);
-		buf += sg_bytes;
-		offset += sg_bytes;
-		remaining -= sg_bytes;
-		copy_len += sg_bytes;
-	}
+	nents = scsi_sg_count(sc);
 
-	if (fr_flags(fp) & FCPHF_CRC_UNCHECKED) {
+	if (!(fr_flags(fp) & FCPHF_CRC_UNCHECKED)) {
+		copy_len = fc_copy_buffer_to_sglist(buf, len, sg, &nents,
+						    &offset, KM_SOFTIRQ0, NULL);
+	} else {
+		crc = crc32(~0, (u8 *) fh, sizeof(*fh));
+		copy_len = fc_copy_buffer_to_sglist(buf, len, sg, &nents,
+						    &offset, KM_SOFTIRQ0, &crc);
 		buf = fc_frame_payload_get(fp, 0);
-		if (len % 4) {
+		if (len % 4)
 			crc = crc32(crc, buf + len, 4 - (len % 4));
-			len += 4 - (len % 4);
-		}
 
 		if (~crc != le32_to_cpu(fr_crc(fp))) {
 crc_err:
-			stats = fc_lport_get_stats(lp);
+			stats = fc_lport_get_stats(lport);
 			stats->ErrorFrames++;
 			/* FIXME - per cpu count, not total count! */
 			if (stats->InvalidCRCCount++ < 5)
 				printk(KERN_WARNING "libfc: CRC error on data "
 				       "frame for port (%6x)\n",
-				       fc_host_port_id(lp->host));
+				       fc_host_port_id(lport->host));
 			/*
 			 * Assume the frame is total garbage.
 			 * We may have copied it over the good part
@@ -437,18 +514,17 @@ crc_err:
 }
 
 /**
- * fc_fcp_send_data() -  Send SCSI data to target.
- * @fsp: ptr to fc_fcp_pkt
- * @sp: ptr to this sequence
- * @offset: starting offset for this data request
- * @seq_blen: the burst length for this data request
+ * fc_fcp_send_data() - Send SCSI data to a target
+ * @fsp:      The FCP packet the data is on
+ * @sp:	      The sequence the data is to be sent on
+ * @offset:   The starting offset for this data request
+ * @seq_blen: The burst length for this data request
  *
  * Called after receiving a Transfer Ready data descriptor.
- * if LLD is capable of seq offload then send down seq_blen
- * size of data in single frame, otherwise send multiple FC
- * frames of max FC frame payload supported by target port.
- *
- * Returns : 0 for success.
+ * If the LLD is capable of sequence offload then send down the
+ * seq_blen ammount of data in single frame, otherwise send
+ * multiple frames of the maximum frame payload supported by
+ * the target port.
  */
 static int fc_fcp_send_data(struct fc_fcp_pkt *fsp, struct fc_seq *seq,
 			    size_t offset, size_t seq_blen)
@@ -457,16 +533,18 @@ static int fc_fcp_send_data(struct fc_fcp_pkt *fsp, struct fc_seq *seq,
 	struct scsi_cmnd *sc;
 	struct scatterlist *sg;
 	struct fc_frame *fp = NULL;
-	struct fc_lport *lp = fsp->lp;
+	struct fc_lport *lport = fsp->lp;
+	struct page *page;
 	size_t remaining;
 	size_t t_blen;
 	size_t tlen;
 	size_t sg_bytes;
 	size_t frame_offset, fh_parm_offset;
+	size_t off;
 	int error;
 	void *data = NULL;
 	void *page_addr;
-	int using_sg = lp->sg_supp;
+	int using_sg = lport->sg_supp;
 	u32 f_ctl;
 
 	WARN_ON(seq_blen <= 0);
@@ -488,10 +566,10 @@ static int fc_fcp_send_data(struct fc_fcp_pkt *fsp, struct fc_seq *seq,
 	 * to max FC frame payload previously set in fsp->max_payload.
 	 */
 	t_blen = fsp->max_payload;
-	if (lp->seq_offload) {
-		t_blen = min(seq_blen, (size_t)lp->lso_max);
+	if (lport->seq_offload) {
+		t_blen = min(seq_blen, (size_t)lport->lso_max);
 		FC_FCP_DBG(fsp, "fsp=%p:lso:blen=%zx lso_max=0x%x t_blen=%zx\n",
-			   fsp, seq_blen, lp->lso_max, t_blen);
+			   fsp, seq_blen, lport->lso_max, t_blen);
 	}
 
 	WARN_ON(t_blen < FC_MIN_MAX_PAYLOAD);
@@ -503,7 +581,7 @@ static int fc_fcp_send_data(struct fc_fcp_pkt *fsp, struct fc_seq *seq,
 	remaining = seq_blen;
 	fh_parm_offset = frame_offset = offset;
 	tlen = 0;
-	seq = lp->tt.seq_start_next(seq);
+	seq = lport->tt.seq_start_next(seq);
 	f_ctl = FC_FC_REL_OFF;
 	WARN_ON(!seq);
 
@@ -525,43 +603,34 @@ static int fc_fcp_send_data(struct fc_fcp_pkt *fsp, struct fc_seq *seq,
 			 */
 			if (tlen % 4)
 				using_sg = 0;
-			if (using_sg) {
-				fp = _fc_frame_alloc(lp, 0);
-				if (!fp)
-					return -ENOMEM;
-			} else {
-				fp = fc_frame_alloc(lp, tlen);
-				if (!fp)
-					return -ENOMEM;
+			fp = fc_frame_alloc(lport, using_sg ? 0 : tlen);
+			if (!fp)
+				return -ENOMEM;
 
-				data = (void *)(fr_hdr(fp)) +
-					sizeof(struct fc_frame_header);
-			}
+			data = fc_frame_header_get(fp) + 1;
 			fh_parm_offset = frame_offset;
 			fr_max_payload(fp) = fsp->max_payload;
 		}
+
+		off = offset + sg->offset;
 		sg_bytes = min(tlen, sg->length - offset);
+		sg_bytes = min(sg_bytes,
+			       (size_t) (PAGE_SIZE - (off & ~PAGE_MASK)));
+		page = sg_page(sg) + (off >> PAGE_SHIFT);
 		if (using_sg) {
-			get_page(sg_page(sg));
+			get_page(page);
 			skb_fill_page_desc(fp_skb(fp),
 					   skb_shinfo(fp_skb(fp))->nr_frags,
-					   sg_page(sg), sg->offset + offset,
-					   sg_bytes);
+					   page, off & ~PAGE_MASK, sg_bytes);
 			fp_skb(fp)->data_len += sg_bytes;
 			fr_len(fp) += sg_bytes;
 			fp_skb(fp)->truesize += PAGE_SIZE;
 		} else {
-			size_t off = offset + sg->offset;
-
 			/*
 			 * The scatterlist item may be bigger than PAGE_SIZE,
 			 * but we must not cross pages inside the kmap.
 			 */
-			sg_bytes = min(sg_bytes, (size_t) (PAGE_SIZE -
-							   (off & ~PAGE_MASK)));
-			page_addr = kmap_atomic(sg_page(sg) +
-						(off >> PAGE_SHIFT),
-						KM_SOFTIRQ0);
+			page_addr = kmap_atomic(page, KM_SOFTIRQ0);
 			memcpy(data, (char *)page_addr + (off & ~PAGE_MASK),
 			       sg_bytes);
 			kunmap_atomic(page_addr, KM_SOFTIRQ0);
@@ -572,7 +641,8 @@ static int fc_fcp_send_data(struct fc_fcp_pkt *fsp, struct fc_seq *seq,
 		tlen -= sg_bytes;
 		remaining -= sg_bytes;
 
-		if (tlen)
+		if ((skb_shinfo(fp_skb(fp))->nr_frags < FC_FRAME_SG_LEN) &&
+		    (tlen))
 			continue;
 
 		/*
@@ -589,7 +659,7 @@ static int fc_fcp_send_data(struct fc_fcp_pkt *fsp, struct fc_seq *seq,
 		/*
 		 * send fragment using for a sequence.
 		 */
-		error = lp->tt.seq_send(lp, seq, fp);
+		error = lport->tt.seq_send(lport, seq, fp);
 		if (error) {
 			WARN_ON(1);		/* send error should be rare */
 			fc_fcp_retry_cmd(fsp);
@@ -601,6 +671,11 @@ static int fc_fcp_send_data(struct fc_fcp_pkt *fsp, struct fc_seq *seq,
 	return 0;
 }
 
+/**
+ * fc_fcp_abts_resp() - Send an ABTS response
+ * @fsp: The FCP packet that is being aborted
+ * @fp:	 The response frame
+ */
 static void fc_fcp_abts_resp(struct fc_fcp_pkt *fsp, struct fc_frame *fp)
 {
 	int ba_done = 1;
@@ -637,46 +712,13 @@ static void fc_fcp_abts_resp(struct fc_fcp_pkt *fsp, struct fc_frame *fp)
 }
 
 /**
- * fc_fcp_reduce_can_queue() - drop can_queue
- * @lp: lport to drop queueing for
- *
- * If we are getting memory allocation failures, then we may
- * be trying to execute too many commands. We let the running
- * commands complete or timeout, then try again with a reduced
- * can_queue. Eventually we will hit the point where we run
- * on all reserved structs.
- */
-static void fc_fcp_reduce_can_queue(struct fc_lport *lp)
-{
-	struct fc_fcp_internal *si = fc_get_scsi_internal(lp);
-	unsigned long flags;
-	int can_queue;
-
-	spin_lock_irqsave(lp->host->host_lock, flags);
-	if (si->throttled)
-		goto done;
-	si->throttled = 1;
-
-	can_queue = lp->host->can_queue;
-	can_queue >>= 1;
-	if (!can_queue)
-		can_queue = 1;
-	lp->host->can_queue = can_queue;
-	shost_printk(KERN_ERR, lp->host, "libfc: Could not allocate frame.\n"
-		     "Reducing can_queue to %d.\n", can_queue);
-done:
-	spin_unlock_irqrestore(lp->host->host_lock, flags);
-}
-
-/**
- * fc_fcp_recv() - Reveive FCP frames
+ * fc_fcp_recv() - Reveive an FCP frame
  * @seq: The sequence the frame is on
- * @fp: The FC frame
+ * @fp:	 The received frame
  * @arg: The related FCP packet
  *
- * Return   : None
- * Context  : called from Soft IRQ context
- *	      can not called holding list lock
+ * Context: Called from Soft IRQ context. Can not be called
+ *	    holding the FCP packet list lock.
  */
 static void fc_fcp_recv(struct fc_seq *seq, struct fc_frame *fp, void *arg)
 {
@@ -687,8 +729,10 @@ static void fc_fcp_recv(struct fc_seq *seq, struct fc_frame *fp, void *arg)
 	u8 r_ctl;
 	int rc = 0;
 
-	if (IS_ERR(fp))
-		goto errout;
+	if (IS_ERR(fp)) {
+		fc_fcp_error(fsp, fp);
+		return;
+	}
 
 	fh = fc_frame_header_get(fp);
 	r_ctl = fh->fh_r_ctl;
@@ -721,8 +765,6 @@ static void fc_fcp_recv(struct fc_seq *seq, struct fc_frame *fp, void *arg)
 				      (size_t) ntohl(dd->ft_burst_len));
 		if (!rc)
 			seq->rec_data = fsp->xfer_len;
-		else if (rc == -ENOMEM)
-			fsp->state |= FC_SRB_NOMEM;
 	} else if (r_ctl == FC_RCTL_DD_SOL_DATA) {
 		/*
 		 * received a DATA frame
@@ -742,13 +784,13 @@ unlock:
 	fc_fcp_unlock_pkt(fsp);
 out:
 	fc_frame_free(fp);
-errout:
-	if (IS_ERR(fp))
-		fc_fcp_error(fsp, fp);
-	else if (rc == -ENOMEM)
-		fc_fcp_reduce_can_queue(lport);
 }
 
+/**
+ * fc_fcp_resp() - Handler for FCP responses
+ * @fsp: The FCP packet the response is for
+ * @fp:	 The response frame
+ */
 static void fc_fcp_resp(struct fc_fcp_pkt *fsp, struct fc_frame *fp)
 {
 	struct fc_frame_header *fh;
@@ -862,15 +904,16 @@ err:
 }
 
 /**
- * fc_fcp_complete_locked() - complete processing of a fcp packet
- * @fsp:	fcp packet
+ * fc_fcp_complete_locked() - Complete processing of a fcp_pkt with the
+ *			      fcp_pkt lock held
+ * @fsp: The FCP packet to be completed
  *
  * This function may sleep if a timer is pending. The packet lock must be
  * held, and the host lock must not be held.
  */
 static void fc_fcp_complete_locked(struct fc_fcp_pkt *fsp)
 {
-	struct fc_lport *lp = fsp->lp;
+	struct fc_lport *lport = fsp->lp;
 	struct fc_seq *seq;
 	struct fc_exch *ep;
 	u32 f_ctl;
@@ -901,8 +944,8 @@ static void fc_fcp_complete_locked(struct fc_fcp_pkt *fsp)
 			struct fc_frame *conf_frame;
 			struct fc_seq *csp;
 
-			csp = lp->tt.seq_start_next(seq);
-			conf_frame = fc_frame_alloc(fsp->lp, 0);
+			csp = lport->tt.seq_start_next(seq);
+			conf_frame = fc_fcp_frame_alloc(fsp->lp, 0);
 			if (conf_frame) {
 				f_ctl = FC_FC_SEQ_INIT;
 				f_ctl |= FC_FC_LAST_SEQ | FC_FC_END_SEQ;
@@ -910,43 +953,48 @@ static void fc_fcp_complete_locked(struct fc_fcp_pkt *fsp)
 				fc_fill_fc_hdr(conf_frame, FC_RCTL_DD_SOL_CTL,
 					       ep->did, ep->sid,
 					       FC_TYPE_FCP, f_ctl, 0);
-				lp->tt.seq_send(lp, csp, conf_frame);
+				lport->tt.seq_send(lport, csp, conf_frame);
 			}
 		}
-		lp->tt.exch_done(seq);
+		lport->tt.exch_done(seq);
 	}
 	fc_io_compl(fsp);
 }
 
+/**
+ * fc_fcp_cleanup_cmd() - Cancel the active exchange on a fcp_pkt
+ * @fsp:   The FCP packet whose exchanges should be canceled
+ * @error: The reason for the cancellation
+ */
 static void fc_fcp_cleanup_cmd(struct fc_fcp_pkt *fsp, int error)
 {
-	struct fc_lport *lp = fsp->lp;
+	struct fc_lport *lport = fsp->lp;
 
 	if (fsp->seq_ptr) {
-		lp->tt.exch_done(fsp->seq_ptr);
+		lport->tt.exch_done(fsp->seq_ptr);
 		fsp->seq_ptr = NULL;
 	}
 	fsp->status_code = error;
 }
 
 /**
- * fc_fcp_cleanup_each_cmd() - Cleanup active commads
- * @lp:		logical port
- * @id:		target id
- * @lun:	lun
- * @error:	fsp status code
+ * fc_fcp_cleanup_each_cmd() - Cancel all exchanges on a local port
+ * @lport: The local port whose exchanges should be canceled
+ * @id:	   The target's ID
+ * @lun:   The LUN
+ * @error: The reason for cancellation
  *
  * If lun or id is -1, they are ignored.
  */
-static void fc_fcp_cleanup_each_cmd(struct fc_lport *lp, unsigned int id,
+static void fc_fcp_cleanup_each_cmd(struct fc_lport *lport, unsigned int id,
 				    unsigned int lun, int error)
 {
-	struct fc_fcp_internal *si = fc_get_scsi_internal(lp);
+	struct fc_fcp_internal *si = fc_get_scsi_internal(lport);
 	struct fc_fcp_pkt *fsp;
 	struct scsi_cmnd *sc_cmd;
 	unsigned long flags;
 
-	spin_lock_irqsave(lp->host->host_lock, flags);
+	spin_lock_irqsave(&si->scsi_queue_lock, flags);
 restart:
 	list_for_each_entry(fsp, &si->scsi_pkt_queue, list) {
 		sc_cmd = fsp->cmd;
@@ -957,7 +1005,7 @@ restart:
 			continue;
 
 		fc_fcp_pkt_hold(fsp);
-		spin_unlock_irqrestore(lp->host->host_lock, flags);
+		spin_unlock_irqrestore(&si->scsi_queue_lock, flags);
 
 		if (!fc_fcp_lock_pkt(fsp)) {
 			fc_fcp_cleanup_cmd(fsp, error);
@@ -966,35 +1014,37 @@ restart:
 		}
 
 		fc_fcp_pkt_release(fsp);
-		spin_lock_irqsave(lp->host->host_lock, flags);
+		spin_lock_irqsave(&si->scsi_queue_lock, flags);
 		/*
 		 * while we dropped the lock multiple pkts could
 		 * have been released, so we have to start over.
 		 */
 		goto restart;
 	}
-	spin_unlock_irqrestore(lp->host->host_lock, flags);
+	spin_unlock_irqrestore(&si->scsi_queue_lock, flags);
 }
 
-static void fc_fcp_abort_io(struct fc_lport *lp)
+/**
+ * fc_fcp_abort_io() - Abort all FCP-SCSI exchanges on a local port
+ * @lport: The local port whose exchanges are to be aborted
+ */
+static void fc_fcp_abort_io(struct fc_lport *lport)
 {
-	fc_fcp_cleanup_each_cmd(lp, -1, -1, FC_HRD_ERROR);
+	fc_fcp_cleanup_each_cmd(lport, -1, -1, FC_HRD_ERROR);
 }
 
 /**
- * fc_fcp_pkt_send() - send a fcp packet to the lower level.
- * @lp:		fc lport
- * @fsp:	fc packet.
+ * fc_fcp_pkt_send() - Send a fcp_pkt
+ * @lport: The local port to send the FCP packet on
+ * @fsp:   The FCP packet to send
  *
- * This is called by upper layer protocol.
- * Return   : zero for success and -1 for failure
- * Context  : called from queuecommand which can be called from process
- *	      or scsi soft irq.
- * Locks    : called with the host lock and irqs disabled.
+ * Return:  Zero for success and -1 for failure
+ * Locks:   Called without locks held
  */
-static int fc_fcp_pkt_send(struct fc_lport *lp, struct fc_fcp_pkt *fsp)
+static int fc_fcp_pkt_send(struct fc_lport *lport, struct fc_fcp_pkt *fsp)
 {
-	struct fc_fcp_internal *si = fc_get_scsi_internal(lp);
+	struct fc_fcp_internal *si = fc_get_scsi_internal(lport);
+	unsigned long flags;
 	int rc;
 
 	fsp->cmd->SCp.ptr = (char *)fsp;
@@ -1004,18 +1054,27 @@ static int fc_fcp_pkt_send(struct fc_lport *lp, struct fc_fcp_pkt *fsp)
 	int_to_scsilun(fsp->cmd->device->lun,
 		       (struct scsi_lun *)fsp->cdb_cmd.fc_lun);
 	memcpy(fsp->cdb_cmd.fc_cdb, fsp->cmd->cmnd, fsp->cmd->cmd_len);
-	list_add_tail(&fsp->list, &si->scsi_pkt_queue);
 
-	spin_unlock_irq(lp->host->host_lock);
-	rc = lp->tt.fcp_cmd_send(lp, fsp, fc_fcp_recv);
-	spin_lock_irq(lp->host->host_lock);
-	if (rc)
+	spin_lock_irqsave(&si->scsi_queue_lock, flags);
+	list_add_tail(&fsp->list, &si->scsi_pkt_queue);
+	spin_unlock_irqrestore(&si->scsi_queue_lock, flags);
+	rc = lport->tt.fcp_cmd_send(lport, fsp, fc_fcp_recv);
+	if (unlikely(rc)) {
+		spin_lock_irqsave(&si->scsi_queue_lock, flags);
 		list_del(&fsp->list);
+		spin_unlock_irqrestore(&si->scsi_queue_lock, flags);
+	}
 
 	return rc;
 }
 
-static int fc_fcp_cmd_send(struct fc_lport *lp, struct fc_fcp_pkt *fsp,
+/**
+ * fc_fcp_cmd_send() - Send a FCP command
+ * @lport: The local port to send the command on
+ * @fsp:   The FCP packet the command is on
+ * @resp:  The handler for the response
+ */
+static int fc_fcp_cmd_send(struct fc_lport *lport, struct fc_fcp_pkt *fsp,
 			   void (*resp)(struct fc_seq *,
 					struct fc_frame *fp,
 					void *arg))
@@ -1023,14 +1082,14 @@ static int fc_fcp_cmd_send(struct fc_lport *lp, struct fc_fcp_pkt *fsp,
 	struct fc_frame *fp;
 	struct fc_seq *seq;
 	struct fc_rport *rport;
-	struct fc_rport_libfc_priv *rp;
+	struct fc_rport_libfc_priv *rpriv;
 	const size_t len = sizeof(fsp->cdb_cmd);
 	int rc = 0;
 
 	if (fc_fcp_lock_pkt(fsp))
 		return 0;
 
-	fp = fc_frame_alloc(lp, sizeof(fsp->cdb_cmd));
+	fp = fc_fcp_frame_alloc(lport, sizeof(fsp->cdb_cmd));
 	if (!fp) {
 		rc = -1;
 		goto unlock;
@@ -1040,15 +1099,15 @@ static int fc_fcp_cmd_send(struct fc_lport *lp, struct fc_fcp_pkt *fsp,
 	fr_fsp(fp) = fsp;
 	rport = fsp->rport;
 	fsp->max_payload = rport->maxframe_size;
-	rp = rport->dd_data;
+	rpriv = rport->dd_data;
 
 	fc_fill_fc_hdr(fp, FC_RCTL_DD_UNSOL_CMD, rport->port_id,
-		       fc_host_port_id(rp->local_port->host), FC_TYPE_FCP,
+		       fc_host_port_id(rpriv->local_port->host), FC_TYPE_FCP,
 		       FC_FC_FIRST_SEQ | FC_FC_END_SEQ | FC_FC_SEQ_INIT, 0);
 
-	seq = lp->tt.exch_seq_send(lp, fp, resp, fc_fcp_pkt_destroy, fsp, 0);
+	seq = lport->tt.exch_seq_send(lport, fp, resp, fc_fcp_pkt_destroy,
+				      fsp, 0);
 	if (!seq) {
-		fc_frame_free(fp);
 		rc = -1;
 		goto unlock;
 	}
@@ -1065,8 +1124,10 @@ unlock:
 	return rc;
 }
 
-/*
- * transport error handler
+/**
+ * fc_fcp_error() - Handler for FCP layer errors
+ * @fsp: The FCP packet the error is on
+ * @fp:	 The frame that has errored
  */
 static void fc_fcp_error(struct fc_fcp_pkt *fsp, struct fc_frame *fp)
 {
@@ -1091,11 +1152,13 @@ unlock:
 	fc_fcp_unlock_pkt(fsp);
 }
 
-/*
- * Scsi abort handler- calls to send an abort
- * and then wait for abort completion
+/**
+ * fc_fcp_pkt_abort() - Abort a fcp_pkt
+ * @fsp:   The FCP packet to abort on
+ *
+ * Called to send an abort and then wait for abort completion
  */
-static int fc_fcp_pkt_abort(struct fc_lport *lp, struct fc_fcp_pkt *fsp)
+static int fc_fcp_pkt_abort(struct fc_fcp_pkt *fsp)
 {
 	int rc = FAILED;
 
@@ -1122,14 +1185,15 @@ static int fc_fcp_pkt_abort(struct fc_lport *lp, struct fc_fcp_pkt *fsp)
 	return rc;
 }
 
-/*
- * Retry LUN reset after resource allocation failed.
+/**
+ * fc_lun_reset_send() - Send LUN reset command
+ * @data: The FCP packet that identifies the LUN to be reset
  */
 static void fc_lun_reset_send(unsigned long data)
 {
 	struct fc_fcp_pkt *fsp = (struct fc_fcp_pkt *)data;
-	struct fc_lport *lp = fsp->lp;
-	if (lp->tt.fcp_cmd_send(lp, fsp, fc_tm_done)) {
+	struct fc_lport *lport = fsp->lp;
+	if (lport->tt.fcp_cmd_send(lport, fsp, fc_tm_done)) {
 		if (fsp->recov_retry++ >= FC_MAX_RECOV_RETRY)
 			return;
 		if (fc_fcp_lock_pkt(fsp))
@@ -1140,11 +1204,15 @@ static void fc_lun_reset_send(unsigned long data)
 	}
 }
 
-/*
- * Scsi device reset handler- send a LUN RESET to the device
- * and wait for reset reply
+/**
+ * fc_lun_reset() - Send a LUN RESET command to a device
+ *		    and wait for the reply
+ * @lport: The local port to sent the comand on
+ * @fsp:   The FCP packet that identifies the LUN to be reset
+ * @id:	   The SCSI command ID
+ * @lun:   The LUN ID to be reset
  */
-static int fc_lun_reset(struct fc_lport *lp, struct fc_fcp_pkt *fsp,
+static int fc_lun_reset(struct fc_lport *lport, struct fc_fcp_pkt *fsp,
 			unsigned int id, unsigned int lun)
 {
 	int rc;
@@ -1172,14 +1240,14 @@ static int fc_lun_reset(struct fc_lport *lp, struct fc_fcp_pkt *fsp,
 
 	spin_lock_bh(&fsp->scsi_pkt_lock);
 	if (fsp->seq_ptr) {
-		lp->tt.exch_done(fsp->seq_ptr);
+		lport->tt.exch_done(fsp->seq_ptr);
 		fsp->seq_ptr = NULL;
 	}
 	fsp->wait_for_comp = 0;
 	spin_unlock_bh(&fsp->scsi_pkt_lock);
 
 	if (!rc) {
-		FC_SCSI_DBG(lp, "lun reset failed\n");
+		FC_SCSI_DBG(lport, "lun reset failed\n");
 		return FAILED;
 	}
 
@@ -1187,13 +1255,16 @@ static int fc_lun_reset(struct fc_lport *lp, struct fc_fcp_pkt *fsp,
 	if (fsp->cdb_status != FCP_TMF_CMPL)
 		return FAILED;
 
-	FC_SCSI_DBG(lp, "lun reset to lun %u completed\n", lun);
-	fc_fcp_cleanup_each_cmd(lp, id, lun, FC_CMD_ABORTED);
+	FC_SCSI_DBG(lport, "lun reset to lun %u completed\n", lun);
+	fc_fcp_cleanup_each_cmd(lport, id, lun, FC_CMD_ABORTED);
 	return SUCCESS;
 }
 
-/*
- * Task Managment response handler
+/**
+ * fc_tm_done() - Task Managment response handler
+ * @seq: The sequence that the response is on
+ * @fp:	 The response frame
+ * @arg: The FCP packet the response is for
  */
 static void fc_tm_done(struct fc_seq *seq, struct fc_frame *fp, void *arg)
 {
@@ -1230,34 +1301,31 @@ static void fc_tm_done(struct fc_seq *seq, struct fc_frame *fp, void *arg)
 	fc_fcp_unlock_pkt(fsp);
 }
 
-static void fc_fcp_cleanup(struct fc_lport *lp)
+/**
+ * fc_fcp_cleanup() - Cleanup all FCP exchanges on a local port
+ * @lport: The local port to be cleaned up
+ */
+static void fc_fcp_cleanup(struct fc_lport *lport)
 {
-	fc_fcp_cleanup_each_cmd(lp, -1, -1, FC_ERROR);
+	fc_fcp_cleanup_each_cmd(lport, -1, -1, FC_ERROR);
 }
 
-/*
- * fc_fcp_timeout: called by OS timer function.
- *
- * The timer has been inactivated and must be reactivated if desired
- * using fc_fcp_timer_set().
- *
- * Algorithm:
- *
- * If REC is supported, just issue it, and return.  The REC exchange will
- * complete or time out, and recovery can continue at that point.
- *
- * Otherwise, if the response has been received without all the data,
- * it has been ER_TIMEOUT since the response was received.
+/**
+ * fc_fcp_timeout() - Handler for fcp_pkt timeouts
+ * @data: The FCP packet that has timed out
  *
- * If the response has not been received,
- * we see if data was received recently.  If it has been, we continue waiting,
- * otherwise, we abort the command.
+ * If REC is supported then just issue it and return. The REC exchange will
+ * complete or time out and recovery can continue at that point. Otherwise,
+ * if the response has been received without all the data it has been
+ * ER_TIMEOUT since the response was received. If the response has not been
+ * received we see if data was received recently. If it has been then we
+ * continue waiting, otherwise, we abort the command.
  */
 static void fc_fcp_timeout(unsigned long data)
 {
 	struct fc_fcp_pkt *fsp = (struct fc_fcp_pkt *)data;
 	struct fc_rport *rport = fsp->rport;
-	struct fc_rport_libfc_priv *rp = rport->dd_data;
+	struct fc_rport_libfc_priv *rpriv = rport->dd_data;
 
 	if (fc_fcp_lock_pkt(fsp))
 		return;
@@ -1267,7 +1335,7 @@ static void fc_fcp_timeout(unsigned long data)
 
 	fsp->state |= FC_SRB_FCP_PROCESSING_TMO;
 
-	if (rp->flags & FC_RP_FLAGS_REC_SUPPORTED)
+	if (rpriv->flags & FC_RP_FLAGS_REC_SUPPORTED)
 		fc_fcp_rec(fsp);
 	else if (time_after_eq(fsp->last_pkt_time + (FC_SCSI_ER_TIMEOUT / 2),
 			       jiffies))
@@ -1281,39 +1349,40 @@ unlock:
 	fc_fcp_unlock_pkt(fsp);
 }
 
-/*
- * Send a REC ELS request
+/**
+ * fc_fcp_rec() - Send a REC ELS request
+ * @fsp: The FCP packet to send the REC request on
  */
 static void fc_fcp_rec(struct fc_fcp_pkt *fsp)
 {
-	struct fc_lport *lp;
+	struct fc_lport *lport;
 	struct fc_frame *fp;
 	struct fc_rport *rport;
-	struct fc_rport_libfc_priv *rp;
+	struct fc_rport_libfc_priv *rpriv;
 
-	lp = fsp->lp;
+	lport = fsp->lp;
 	rport = fsp->rport;
-	rp = rport->dd_data;
-	if (!fsp->seq_ptr || rp->rp_state != RPORT_ST_READY) {
+	rpriv = rport->dd_data;
+	if (!fsp->seq_ptr || rpriv->rp_state != RPORT_ST_READY) {
 		fsp->status_code = FC_HRD_ERROR;
 		fsp->io_status = 0;
 		fc_fcp_complete_locked(fsp);
 		return;
 	}
-	fp = fc_frame_alloc(lp, sizeof(struct fc_els_rec));
+	fp = fc_fcp_frame_alloc(lport, sizeof(struct fc_els_rec));
 	if (!fp)
 		goto retry;
 
 	fr_seq(fp) = fsp->seq_ptr;
 	fc_fill_fc_hdr(fp, FC_RCTL_ELS_REQ, rport->port_id,
-		       fc_host_port_id(rp->local_port->host), FC_TYPE_ELS,
+		       fc_host_port_id(rpriv->local_port->host), FC_TYPE_ELS,
 		       FC_FC_FIRST_SEQ | FC_FC_END_SEQ | FC_FC_SEQ_INIT, 0);
-	if (lp->tt.elsct_send(lp, rport->port_id, fp, ELS_REC, fc_fcp_rec_resp,
-			      fsp, jiffies_to_msecs(FC_SCSI_REC_TOV))) {
+	if (lport->tt.elsct_send(lport, rport->port_id, fp, ELS_REC,
+				 fc_fcp_rec_resp, fsp,
+				 jiffies_to_msecs(FC_SCSI_REC_TOV))) {
 		fc_fcp_pkt_hold(fsp);		/* hold while REC outstanding */
 		return;
 	}
-	fc_frame_free(fp);
 retry:
 	if (fsp->recov_retry++ < FC_MAX_RECOV_RETRY)
 		fc_fcp_timer_set(fsp, FC_SCSI_REC_TOV);
@@ -1321,12 +1390,16 @@ retry:
 		fc_timeout_error(fsp);
 }
 
-/*
- * Receive handler for REC ELS frame
- * if it is a reject then let the scsi layer to handle
- * the timeout. if it is a LS_ACC then if the io was not completed
- * then set the timeout and return otherwise complete the exchange
- * and tell the scsi layer to restart the I/O.
+/**
+ * fc_fcp_rec_resp() - Handler for REC ELS responses
+ * @seq: The sequence the response is on
+ * @fp:	 The response frame
+ * @arg: The FCP packet the response is on
+ *
+ * If the response is a reject then the scsi layer will handle
+ * the timeout. If the response is a LS_ACC then if the I/O was not completed
+ * set the timeout and return. If the I/O was completed then complete the
+ * exchange and tell the SCSI layer.
  */
 static void fc_fcp_rec_resp(struct fc_seq *seq, struct fc_frame *fp, void *arg)
 {
@@ -1338,7 +1411,7 @@ static void fc_fcp_rec_resp(struct fc_seq *seq, struct fc_frame *fp, void *arg)
 	u32 offset;
 	enum dma_data_direction data_dir;
 	enum fc_rctl r_ctl;
-	struct fc_rport_libfc_priv *rp;
+	struct fc_rport_libfc_priv *rpriv;
 
 	if (IS_ERR(fp)) {
 		fc_fcp_rec_error(fsp, fp);
@@ -1361,13 +1434,13 @@ static void fc_fcp_rec_resp(struct fc_seq *seq, struct fc_frame *fp, void *arg)
 			/* fall through */
 		case ELS_RJT_UNSUP:
 			FC_FCP_DBG(fsp, "device does not support REC\n");
-			rp = fsp->rport->dd_data;
+			rpriv = fsp->rport->dd_data;
 			/*
 			 * if we do not spport RECs or got some bogus
 			 * reason then resetup timer so we check for
 			 * making progress.
 			 */
-			rp->flags &= ~FC_RP_FLAGS_REC_SUPPORTED;
+			rpriv->flags &= ~FC_RP_FLAGS_REC_SUPPORTED;
 			fc_fcp_timer_set(fsp, FC_SCSI_ER_TIMEOUT);
 			break;
 		case ELS_RJT_LOGIC:
@@ -1464,8 +1537,10 @@ out:
 	fc_frame_free(fp);
 }
 
-/*
- * Handle error response or timeout for REC exchange.
+/**
+ * fc_fcp_rec_error() - Handler for REC errors
+ * @fsp: The FCP packet the error is on
+ * @fp:	 The REC frame
  */
 static void fc_fcp_rec_error(struct fc_fcp_pkt *fsp, struct fc_frame *fp)
 {
@@ -1504,10 +1579,9 @@ out:
 	fc_fcp_pkt_release(fsp);	/* drop hold for outstanding REC */
 }
 
-/*
- * Time out error routine:
- * abort's the I/O close the exchange and
- * send completion notification to scsi layer
+/**
+ * fc_timeout_error() - Handler for fcp_pkt timeouts
+ * @fsp: The FCP packt that has timed out
  */
 static void fc_timeout_error(struct fc_fcp_pkt *fsp)
 {
@@ -1521,16 +1595,18 @@ static void fc_timeout_error(struct fc_fcp_pkt *fsp)
 	fc_fcp_send_abort(fsp);
 }
 
-/*
- * Sequence retransmission request.
+/**
+ * fc_fcp_srr() - Send a SRR request (Sequence Retransmission Request)
+ * @fsp:   The FCP packet the SRR is to be sent on
+ * @r_ctl: The R_CTL field for the SRR request
  * This is called after receiving status but insufficient data, or
  * when expecting status but the request has timed out.
  */
 static void fc_fcp_srr(struct fc_fcp_pkt *fsp, enum fc_rctl r_ctl, u32 offset)
 {
-	struct fc_lport *lp = fsp->lp;
+	struct fc_lport *lport = fsp->lp;
 	struct fc_rport *rport;
-	struct fc_rport_libfc_priv *rp;
+	struct fc_rport_libfc_priv *rpriv;
 	struct fc_exch *ep = fc_seq_exch(fsp->seq_ptr);
 	struct fc_seq *seq;
 	struct fcp_srr *srr;
@@ -1538,12 +1614,13 @@ static void fc_fcp_srr(struct fc_fcp_pkt *fsp, enum fc_rctl r_ctl, u32 offset)
 	u8 cdb_op;
 
 	rport = fsp->rport;
-	rp = rport->dd_data;
+	rpriv = rport->dd_data;
 	cdb_op = fsp->cdb_cmd.fc_cdb[0];
 
-	if (!(rp->flags & FC_RP_FLAGS_RETRY) || rp->rp_state != RPORT_ST_READY)
+	if (!(rpriv->flags & FC_RP_FLAGS_RETRY) ||
+	    rpriv->rp_state != RPORT_ST_READY)
 		goto retry;			/* shouldn't happen */
-	fp = fc_frame_alloc(lp, sizeof(*srr));
+	fp = fc_fcp_frame_alloc(lport, sizeof(*srr));
 	if (!fp)
 		goto retry;
 
@@ -1556,15 +1633,14 @@ static void fc_fcp_srr(struct fc_fcp_pkt *fsp, enum fc_rctl r_ctl, u32 offset)
 	srr->srr_rel_off = htonl(offset);
 
 	fc_fill_fc_hdr(fp, FC_RCTL_ELS4_REQ, rport->port_id,
-		       fc_host_port_id(rp->local_port->host), FC_TYPE_FCP,
+		       fc_host_port_id(rpriv->local_port->host), FC_TYPE_FCP,
 		       FC_FC_FIRST_SEQ | FC_FC_END_SEQ | FC_FC_SEQ_INIT, 0);
 
-	seq = lp->tt.exch_seq_send(lp, fp, fc_fcp_srr_resp, NULL,
-				   fsp, jiffies_to_msecs(FC_SCSI_REC_TOV));
-	if (!seq) {
-		fc_frame_free(fp);
+	seq = lport->tt.exch_seq_send(lport, fp, fc_fcp_srr_resp, NULL,
+				      fsp, jiffies_to_msecs(FC_SCSI_REC_TOV));
+	if (!seq)
 		goto retry;
-	}
+
 	fsp->recov_seq = seq;
 	fsp->xfer_len = offset;
 	fsp->xfer_contig_end = offset;
@@ -1575,8 +1651,11 @@ retry:
 	fc_fcp_retry_cmd(fsp);
 }
 
-/*
- * Handle response from SRR.
+/**
+ * fc_fcp_srr_resp() - Handler for SRR response
+ * @seq: The sequence the SRR is on
+ * @fp:	 The SRR frame
+ * @arg: The FCP packet the SRR is on
  */
 static void fc_fcp_srr_resp(struct fc_seq *seq, struct fc_frame *fp, void *arg)
 {
@@ -1622,6 +1701,11 @@ out:
 	fc_fcp_pkt_release(fsp);	/* drop hold for outstanding SRR */
 }
 
+/**
+ * fc_fcp_srr_error() - Handler for SRR errors
+ * @fsp: The FCP packet that the SRR error is on
+ * @fp:	 The SRR frame
+ */
 static void fc_fcp_srr_error(struct fc_fcp_pkt *fsp, struct fc_frame *fp)
 {
 	if (fc_fcp_lock_pkt(fsp))
@@ -1646,31 +1730,37 @@ out:
 	fc_fcp_pkt_release(fsp);	/* drop hold for outstanding SRR */
 }
 
-static inline int fc_fcp_lport_queue_ready(struct fc_lport *lp)
+/**
+ * fc_fcp_lport_queue_ready() - Determine if the lport and it's queue is ready
+ * @lport: The local port to be checked
+ */
+static inline int fc_fcp_lport_queue_ready(struct fc_lport *lport)
 {
 	/* lock ? */
-	return (lp->state == LPORT_ST_READY) && lp->link_up && !lp->qfull;
+	return (lport->state == LPORT_ST_READY) &&
+		lport->link_up && !lport->qfull;
 }
 
 /**
- * fc_queuecommand - The queuecommand function of the scsi template
- * @cmd:	struct scsi_cmnd to be executed
- * @done:	Callback function to be called when cmd is completed
+ * fc_queuecommand() - The queuecommand function of the SCSI template
+ * @cmd:   The scsi_cmnd to be executed
+ * @done:  The callback function to be called when the scsi_cmnd is complete
  *
- * this is the i/o strategy routine, called by the scsi layer
- * this routine is called with holding the host_lock.
+ * This is the i/o strategy routine, called by the SCSI layer. This routine
+ * is called with the host_lock held.
  */
 int fc_queuecommand(struct scsi_cmnd *sc_cmd, void (*done)(struct scsi_cmnd *))
 {
-	struct fc_lport *lp;
+	struct fc_lport *lport;
 	struct fc_rport *rport = starget_to_rport(scsi_target(sc_cmd->device));
 	struct fc_fcp_pkt *fsp;
-	struct fc_rport_libfc_priv *rp;
+	struct fc_rport_libfc_priv *rpriv;
 	int rval;
 	int rc = 0;
 	struct fcoe_dev_stats *stats;
 
-	lp = shost_priv(sc_cmd->device->host);
+	lport = shost_priv(sc_cmd->device->host);
+	spin_unlock_irq(lport->host->host_lock);
 
 	rval = fc_remote_port_chkready(rport);
 	if (rval) {
@@ -1689,14 +1779,16 @@ int fc_queuecommand(struct scsi_cmnd *sc_cmd, void (*done)(struct scsi_cmnd *))
 		goto out;
 	}
 
-	rp = rport->dd_data;
+	rpriv = rport->dd_data;
 
-	if (!fc_fcp_lport_queue_ready(lp)) {
+	if (!fc_fcp_lport_queue_ready(lport)) {
+		if (lport->qfull)
+			fc_fcp_can_queue_ramp_down(lport);
 		rc = SCSI_MLQUEUE_HOST_BUSY;
 		goto out;
 	}
 
-	fsp = fc_fcp_pkt_alloc(lp, GFP_ATOMIC);
+	fsp = fc_fcp_pkt_alloc(lport, GFP_ATOMIC);
 	if (fsp == NULL) {
 		rc = SCSI_MLQUEUE_HOST_BUSY;
 		goto out;
@@ -1706,8 +1798,9 @@ int fc_queuecommand(struct scsi_cmnd *sc_cmd, void (*done)(struct scsi_cmnd *))
 	 * build the libfc request pkt
 	 */
 	fsp->cmd = sc_cmd;	/* save the cmd */
-	fsp->lp = lp;		/* save the softc ptr */
+	fsp->lp = lport;	/* save the softc ptr */
 	fsp->rport = rport;	/* set the remote port ptr */
+	fsp->xfer_ddp = FC_XID_UNKNOWN;
 	sc_cmd->scsi_done = done;
 
 	/*
@@ -1719,7 +1812,7 @@ int fc_queuecommand(struct scsi_cmnd *sc_cmd, void (*done)(struct scsi_cmnd *))
 	/*
 	 * setup the data direction
 	 */
-	stats = fc_lport_get_stats(lp);
+	stats = fc_lport_get_stats(lport);
 	if (sc_cmd->sc_data_direction == DMA_FROM_DEVICE) {
 		fsp->req_flags = FC_SRB_READ;
 		stats->InputRequests++;
@@ -1733,7 +1826,7 @@ int fc_queuecommand(struct scsi_cmnd *sc_cmd, void (*done)(struct scsi_cmnd *))
 		stats->ControlRequests++;
 	}
 
-	fsp->tgt_flags = rp->flags;
+	fsp->tgt_flags = rpriv->flags;
 
 	init_timer(&fsp->timer);
 	fsp->timer.data = (unsigned long)fsp;
@@ -1743,30 +1836,30 @@ int fc_queuecommand(struct scsi_cmnd *sc_cmd, void (*done)(struct scsi_cmnd *))
 	 * if we get -1 return then put the request in the pending
 	 * queue.
 	 */
-	rval = fc_fcp_pkt_send(lp, fsp);
+	rval = fc_fcp_pkt_send(lport, fsp);
 	if (rval != 0) {
 		fsp->state = FC_SRB_FREE;
 		fc_fcp_pkt_release(fsp);
 		rc = SCSI_MLQUEUE_HOST_BUSY;
 	}
 out:
+	spin_lock_irq(lport->host->host_lock);
 	return rc;
 }
 EXPORT_SYMBOL(fc_queuecommand);
 
 /**
- * fc_io_compl() -  Handle responses for completed commands
- * @fsp:	scsi packet
- *
- * Translates a error to a Linux SCSI error.
+ * fc_io_compl() - Handle responses for completed commands
+ * @fsp: The FCP packet that is complete
  *
+ * Translates fcp_pkt errors to a Linux SCSI errors.
  * The fcp packet lock must be held when calling.
  */
 static void fc_io_compl(struct fc_fcp_pkt *fsp)
 {
 	struct fc_fcp_internal *si;
 	struct scsi_cmnd *sc_cmd;
-	struct fc_lport *lp;
+	struct fc_lport *lport;
 	unsigned long flags;
 
 	/* release outstanding ddp context */
@@ -1779,30 +1872,23 @@ static void fc_io_compl(struct fc_fcp_pkt *fsp)
 		spin_lock_bh(&fsp->scsi_pkt_lock);
 	}
 
-	lp = fsp->lp;
-	si = fc_get_scsi_internal(lp);
-	spin_lock_irqsave(lp->host->host_lock, flags);
-	if (!fsp->cmd) {
-		spin_unlock_irqrestore(lp->host->host_lock, flags);
+	lport = fsp->lp;
+	si = fc_get_scsi_internal(lport);
+	if (!fsp->cmd)
 		return;
-	}
 
 	/*
-	 * if a command timed out while we had to try and throttle IO
-	 * and it is now getting cleaned up, then we are about to
-	 * try again so clear the throttled flag incase we get more
-	 * time outs.
+	 * if can_queue ramp down is done then try can_queue ramp up
+	 * since commands are completing now.
 	 */
-	if (si->throttled && fsp->state & FC_SRB_NOMEM)
-		si->throttled = 0;
+	if (si->last_can_queue_ramp_down_time)
+		fc_fcp_can_queue_ramp_up(lport);
 
 	sc_cmd = fsp->cmd;
 	fsp->cmd = NULL;
 
-	if (!sc_cmd->SCp.ptr) {
-		spin_unlock_irqrestore(lp->host->host_lock, flags);
+	if (!sc_cmd->SCp.ptr)
 		return;
-	}
 
 	CMD_SCSI_STATUS(sc_cmd) = fsp->cdb_status;
 	switch (fsp->status_code) {
@@ -1814,21 +1900,6 @@ static void fc_io_compl(struct fc_fcp_pkt *fsp)
 			sc_cmd->result = DID_OK << 16;
 			if (fsp->scsi_resid)
 				CMD_RESID_LEN(sc_cmd) = fsp->scsi_resid;
-		} else if (fsp->cdb_status == QUEUE_FULL) {
-			struct scsi_device *tmp_sdev;
-			struct scsi_device *sdev = sc_cmd->device;
-
-			shost_for_each_device(tmp_sdev, sdev->host) {
-				if (tmp_sdev->id != sdev->id)
-					continue;
-
-				if (tmp_sdev->queue_depth > 1) {
-					scsi_track_queue_full(tmp_sdev,
-							      tmp_sdev->
-							      queue_depth - 1);
-				}
-			}
-			sc_cmd->result = (DID_OK << 16) | fsp->cdb_status;
 		} else {
 			/*
 			 * transport level I/O was ok but scsi
@@ -1846,7 +1917,8 @@ static void fc_io_compl(struct fc_fcp_pkt *fsp)
 			 * scsi status is good but transport level
 			 * underrun.
 			 */
-			sc_cmd->result = DID_OK << 16;
+			sc_cmd->result = (fsp->state & FC_SRB_RCV_STATUS ?
+					  DID_OK : DID_ERROR) << 16;
 		} else {
 			/*
 			 * scsi got underrun, this is an error
@@ -1878,63 +1950,46 @@ static void fc_io_compl(struct fc_fcp_pkt *fsp)
 		break;
 	}
 
+	spin_lock_irqsave(&si->scsi_queue_lock, flags);
 	list_del(&fsp->list);
+	spin_unlock_irqrestore(&si->scsi_queue_lock, flags);
 	sc_cmd->SCp.ptr = NULL;
 	sc_cmd->scsi_done(sc_cmd);
-	spin_unlock_irqrestore(lp->host->host_lock, flags);
 
 	/* release ref from initial allocation in queue command */
 	fc_fcp_pkt_release(fsp);
 }
 
 /**
- * fc_fcp_complete() - complete processing of a fcp packet
- * @fsp:	fcp packet
- *
- * This function may sleep if a fsp timer is pending.
- * The host lock must not be held by caller.
- */
-void fc_fcp_complete(struct fc_fcp_pkt *fsp)
-{
-	if (fc_fcp_lock_pkt(fsp))
-		return;
-
-	fc_fcp_complete_locked(fsp);
-	fc_fcp_unlock_pkt(fsp);
-}
-EXPORT_SYMBOL(fc_fcp_complete);
-
-/**
  * fc_eh_abort() - Abort a command
- * @sc_cmd:	scsi command to abort
+ * @sc_cmd: The SCSI command to abort
  *
- * From scsi host template.
- * send ABTS to the target device  and wait for the response
- * sc_cmd is the pointer to the command to be aborted.
+ * From SCSI host template.
+ * Send an ABTS to the target device and wait for the response.
  */
 int fc_eh_abort(struct scsi_cmnd *sc_cmd)
 {
 	struct fc_fcp_pkt *fsp;
-	struct fc_lport *lp;
+	struct fc_lport *lport;
 	int rc = FAILED;
 	unsigned long flags;
 
-	lp = shost_priv(sc_cmd->device->host);
-	if (lp->state != LPORT_ST_READY)
+	lport = shost_priv(sc_cmd->device->host);
+	if (lport->state != LPORT_ST_READY)
 		return rc;
-	else if (!lp->link_up)
+	else if (!lport->link_up)
 		return rc;
 
-	spin_lock_irqsave(lp->host->host_lock, flags);
+	spin_lock_irqsave(lport->host->host_lock, flags);
 	fsp = CMD_SP(sc_cmd);
 	if (!fsp) {
 		/* command completed while scsi eh was setting up */
-		spin_unlock_irqrestore(lp->host->host_lock, flags);
+		spin_unlock_irqrestore(lport->host->host_lock, flags);
 		return SUCCESS;
 	}
 	/* grab a ref so the fsp and sc_cmd cannot be relased from under us */
 	fc_fcp_pkt_hold(fsp);
-	spin_unlock_irqrestore(lp->host->host_lock, flags);
+	spin_unlock_irqrestore(lport->host->host_lock, flags);
 
 	if (fc_fcp_lock_pkt(fsp)) {
 		/* completed while we were waiting for timer to be deleted */
@@ -1942,7 +1997,7 @@ int fc_eh_abort(struct scsi_cmnd *sc_cmd)
 		goto release_pkt;
 	}
 
-	rc = fc_fcp_pkt_abort(lp, fsp);
+	rc = fc_fcp_pkt_abort(fsp);
 	fc_fcp_unlock_pkt(fsp);
 
 release_pkt:
@@ -1952,37 +2007,34 @@ release_pkt:
 EXPORT_SYMBOL(fc_eh_abort);
 
 /**
- * fc_eh_device_reset() Reset a single LUN
- * @sc_cmd:	scsi command
+ * fc_eh_device_reset() - Reset a single LUN
+ * @sc_cmd: The SCSI command which identifies the device whose
+ *	    LUN is to be reset
  *
- * Set from scsi host template to send tm cmd to the target and wait for the
- * response.
+ * Set from SCSI host template.
  */
 int fc_eh_device_reset(struct scsi_cmnd *sc_cmd)
 {
-	struct fc_lport *lp;
+	struct fc_lport *lport;
 	struct fc_fcp_pkt *fsp;
 	struct fc_rport *rport = starget_to_rport(scsi_target(sc_cmd->device));
 	int rc = FAILED;
-	struct fc_rport_libfc_priv *rp;
 	int rval;
 
 	rval = fc_remote_port_chkready(rport);
 	if (rval)
 		goto out;
 
-	rp = rport->dd_data;
-	lp = shost_priv(sc_cmd->device->host);
+	lport = shost_priv(sc_cmd->device->host);
 
-	if (lp->state != LPORT_ST_READY)
+	if (lport->state != LPORT_ST_READY)
 		return rc;
 
-	FC_SCSI_DBG(lp, "Resetting rport (%6x)\n", rport->port_id);
+	FC_SCSI_DBG(lport, "Resetting rport (%6x)\n", rport->port_id);
 
-	fsp = fc_fcp_pkt_alloc(lp, GFP_NOIO);
+	fsp = fc_fcp_pkt_alloc(lport, GFP_NOIO);
 	if (fsp == NULL) {
 		printk(KERN_WARNING "libfc: could not allocate scsi_pkt\n");
-		sc_cmd->result = DID_NO_CONNECT << 16;
 		goto out;
 	}
 
@@ -1991,13 +2043,13 @@ int fc_eh_device_reset(struct scsi_cmnd *sc_cmd)
 	 * the sc passed in is not setup for execution like when sent
 	 * through the queuecommand callout.
 	 */
-	fsp->lp = lp;		/* save the softc ptr */
+	fsp->lp = lport;	/* save the softc ptr */
 	fsp->rport = rport;	/* set the remote port ptr */
 
 	/*
 	 * flush outstanding commands
 	 */
-	rc = fc_lun_reset(lp, fsp, scmd_id(sc_cmd), sc_cmd->device->lun);
+	rc = fc_lun_reset(lport, fsp, scmd_id(sc_cmd), sc_cmd->device->lun);
 	fsp->state = FC_SRB_FREE;
 	fc_fcp_pkt_release(fsp);
 
@@ -2007,38 +2059,39 @@ out:
 EXPORT_SYMBOL(fc_eh_device_reset);
 
 /**
- * fc_eh_host_reset() - The reset function will reset the ports on the host.
- * @sc_cmd:	scsi command
+ * fc_eh_host_reset() - Reset a Scsi_Host.
+ * @sc_cmd: The SCSI command that identifies the SCSI host to be reset
  */
 int fc_eh_host_reset(struct scsi_cmnd *sc_cmd)
 {
 	struct Scsi_Host *shost = sc_cmd->device->host;
-	struct fc_lport *lp = shost_priv(shost);
+	struct fc_lport *lport = shost_priv(shost);
 	unsigned long wait_tmo;
 
-	FC_SCSI_DBG(lp, "Resetting host\n");
+	FC_SCSI_DBG(lport, "Resetting host\n");
 
-	lp->tt.lport_reset(lp);
+	lport->tt.lport_reset(lport);
 	wait_tmo = jiffies + FC_HOST_RESET_TIMEOUT;
-	while (!fc_fcp_lport_queue_ready(lp) && time_before(jiffies, wait_tmo))
+	while (!fc_fcp_lport_queue_ready(lport) && time_before(jiffies,
+							       wait_tmo))
 		msleep(1000);
 
-	if (fc_fcp_lport_queue_ready(lp)) {
+	if (fc_fcp_lport_queue_ready(lport)) {
 		shost_printk(KERN_INFO, shost, "libfc: Host reset succeeded "
-			     "on port (%6x)\n", fc_host_port_id(lp->host));
+			     "on port (%6x)\n", fc_host_port_id(lport->host));
 		return SUCCESS;
 	} else {
 		shost_printk(KERN_INFO, shost, "libfc: Host reset failed, "
 			     "port (%6x) is not ready.\n",
-			     fc_host_port_id(lp->host));
+			     fc_host_port_id(lport->host));
 		return FAILED;
 	}
 }
 EXPORT_SYMBOL(fc_eh_host_reset);
 
 /**
- * fc_slave_alloc() - configure queue depth
- * @sdev:	scsi device
+ * fc_slave_alloc() - Configure the queue depth of a Scsi_Host
+ * @sdev: The SCSI device that identifies the SCSI host
  *
  * Configures queue depth based on host's cmd_per_len. If not set
  * then we use the libfc default.
@@ -2046,29 +2099,50 @@ EXPORT_SYMBOL(fc_eh_host_reset);
 int fc_slave_alloc(struct scsi_device *sdev)
 {
 	struct fc_rport *rport = starget_to_rport(scsi_target(sdev));
-	int queue_depth;
 
 	if (!rport || fc_remote_port_chkready(rport))
 		return -ENXIO;
 
-	if (sdev->tagged_supported) {
-		if (sdev->host->hostt->cmd_per_lun)
-			queue_depth = sdev->host->hostt->cmd_per_lun;
-		else
-			queue_depth = FC_FCP_DFLT_QUEUE_DEPTH;
-		scsi_activate_tcq(sdev, queue_depth);
-	}
+	if (sdev->tagged_supported)
+		scsi_activate_tcq(sdev, FC_FCP_DFLT_QUEUE_DEPTH);
+	else
+		scsi_adjust_queue_depth(sdev, scsi_get_tag_type(sdev),
+					FC_FCP_DFLT_QUEUE_DEPTH);
+
 	return 0;
 }
 EXPORT_SYMBOL(fc_slave_alloc);
 
-int fc_change_queue_depth(struct scsi_device *sdev, int qdepth)
+/**
+ * fc_change_queue_depth() - Change a device's queue depth
+ * @sdev:   The SCSI device whose queue depth is to change
+ * @qdepth: The new queue depth
+ * @reason: The resason for the change
+ */
+int fc_change_queue_depth(struct scsi_device *sdev, int qdepth, int reason)
 {
-	scsi_adjust_queue_depth(sdev, scsi_get_tag_type(sdev), qdepth);
+	switch (reason) {
+	case SCSI_QDEPTH_DEFAULT:
+		scsi_adjust_queue_depth(sdev, scsi_get_tag_type(sdev), qdepth);
+		break;
+	case SCSI_QDEPTH_QFULL:
+		scsi_track_queue_full(sdev, qdepth);
+		break;
+	case SCSI_QDEPTH_RAMP_UP:
+		scsi_adjust_queue_depth(sdev, scsi_get_tag_type(sdev), qdepth);
+		break;
+	default:
+		return -EOPNOTSUPP;
+	}
 	return sdev->queue_depth;
 }
 EXPORT_SYMBOL(fc_change_queue_depth);
 
+/**
+ * fc_change_queue_type() - Change a device's queue type
+ * @sdev:     The SCSI device whose queue depth is to change
+ * @tag_type: Identifier for queue type
+ */
 int fc_change_queue_type(struct scsi_device *sdev, int tag_type)
 {
 	if (sdev->tagged_supported) {
@@ -2084,39 +2158,71 @@ int fc_change_queue_type(struct scsi_device *sdev, int tag_type)
 }
 EXPORT_SYMBOL(fc_change_queue_type);
 
-void fc_fcp_destroy(struct fc_lport *lp)
+/**
+ * fc_fcp_destory() - Tear down the FCP layer for a given local port
+ * @lport: The local port that no longer needs the FCP layer
+ */
+void fc_fcp_destroy(struct fc_lport *lport)
 {
-	struct fc_fcp_internal *si = fc_get_scsi_internal(lp);
+	struct fc_fcp_internal *si = fc_get_scsi_internal(lport);
 
 	if (!list_empty(&si->scsi_pkt_queue))
 		printk(KERN_ERR "libfc: Leaked SCSI packets when destroying "
-		       "port (%6x)\n", fc_host_port_id(lp->host));
+		       "port (%6x)\n", fc_host_port_id(lport->host));
 
 	mempool_destroy(si->scsi_pkt_pool);
 	kfree(si);
-	lp->scsi_priv = NULL;
+	lport->scsi_priv = NULL;
 }
 EXPORT_SYMBOL(fc_fcp_destroy);
 
-int fc_fcp_init(struct fc_lport *lp)
+int fc_setup_fcp()
+{
+	int rc = 0;
+
+	scsi_pkt_cachep = kmem_cache_create("libfc_fcp_pkt",
+					    sizeof(struct fc_fcp_pkt),
+					    0, SLAB_HWCACHE_ALIGN, NULL);
+	if (!scsi_pkt_cachep) {
+		printk(KERN_ERR "libfc: Unable to allocate SRB cache, "
+		       "module load failed!");
+		rc = -ENOMEM;
+	}
+
+	return rc;
+}
+
+void fc_destroy_fcp()
+{
+	if (scsi_pkt_cachep)
+		kmem_cache_destroy(scsi_pkt_cachep);
+}
+
+/**
+ * fc_fcp_init() - Initialize the FCP layer for a local port
+ * @lport: The local port to initialize the exchange layer for
+ */
+int fc_fcp_init(struct fc_lport *lport)
 {
 	int rc;
 	struct fc_fcp_internal *si;
 
-	if (!lp->tt.fcp_cmd_send)
-		lp->tt.fcp_cmd_send = fc_fcp_cmd_send;
+	if (!lport->tt.fcp_cmd_send)
+		lport->tt.fcp_cmd_send = fc_fcp_cmd_send;
 
-	if (!lp->tt.fcp_cleanup)
-		lp->tt.fcp_cleanup = fc_fcp_cleanup;
+	if (!lport->tt.fcp_cleanup)
+		lport->tt.fcp_cleanup = fc_fcp_cleanup;
 
-	if (!lp->tt.fcp_abort_io)
-		lp->tt.fcp_abort_io = fc_fcp_abort_io;
+	if (!lport->tt.fcp_abort_io)
+		lport->tt.fcp_abort_io = fc_fcp_abort_io;
 
 	si = kzalloc(sizeof(struct fc_fcp_internal), GFP_KERNEL);
 	if (!si)
 		return -ENOMEM;
-	lp->scsi_priv = si;
+	lport->scsi_priv = si;
+	si->max_can_queue = lport->host->can_queue;
 	INIT_LIST_HEAD(&si->scsi_pkt_queue);
+	spin_lock_init(&si->scsi_queue_lock);
 
 	si->scsi_pkt_pool = mempool_create_slab_pool(2, scsi_pkt_cachep);
 	if (!si->scsi_pkt_pool) {
@@ -2130,42 +2236,3 @@ free_internal:
 	return rc;
 }
 EXPORT_SYMBOL(fc_fcp_init);
-
-static int __init libfc_init(void)
-{
-	int rc;
-
-	scsi_pkt_cachep = kmem_cache_create("libfc_fcp_pkt",
-					    sizeof(struct fc_fcp_pkt),
-					    0, SLAB_HWCACHE_ALIGN, NULL);
-	if (scsi_pkt_cachep == NULL) {
-		printk(KERN_ERR "libfc: Unable to allocate SRB cache, "
-		       "module load failed!");
-		return -ENOMEM;
-	}
-
-	rc = fc_setup_exch_mgr();
-	if (rc)
-		goto destroy_pkt_cache;
-
-	rc = fc_setup_rport();
-	if (rc)
-		goto destroy_em;
-
-	return rc;
-destroy_em:
-	fc_destroy_exch_mgr();
-destroy_pkt_cache:
-	kmem_cache_destroy(scsi_pkt_cachep);
-	return rc;
-}
-
-static void __exit libfc_exit(void)
-{
-	kmem_cache_destroy(scsi_pkt_cachep);
-	fc_destroy_exch_mgr();
-	fc_destroy_rport();
-}
-
-module_init(libfc_init);
-module_exit(libfc_exit);
diff --git a/drivers/scsi/libfc/fc_frame.c b/drivers/scsi/libfc/fc_frame.c
index 63fe00cfe667..6da01c616964 100644
--- a/drivers/scsi/libfc/fc_frame.c
+++ b/drivers/scsi/libfc/fc_frame.c
@@ -51,24 +51,24 @@ EXPORT_SYMBOL(fc_frame_crc_check);
  * Allocate a frame intended to be sent via fcoe_xmit.
  * Get an sk_buff for the frame and set the length.
  */
-struct fc_frame *__fc_frame_alloc(size_t len)
+struct fc_frame *_fc_frame_alloc(size_t len)
 {
 	struct fc_frame *fp;
 	struct sk_buff *skb;
 
 	WARN_ON((len % sizeof(u32)) != 0);
 	len += sizeof(struct fc_frame_header);
-	skb = dev_alloc_skb(len + FC_FRAME_HEADROOM + FC_FRAME_TAILROOM);
+	skb = alloc_skb_fclone(len + FC_FRAME_HEADROOM + FC_FRAME_TAILROOM +
+			       NET_SKB_PAD, GFP_ATOMIC);
 	if (!skb)
 		return NULL;
+	skb_reserve(skb, NET_SKB_PAD + FC_FRAME_HEADROOM);
 	fp = (struct fc_frame *) skb;
 	fc_frame_init(fp);
-	skb_reserve(skb, FC_FRAME_HEADROOM);
 	skb_put(skb, len);
 	return fp;
 }
-EXPORT_SYMBOL(__fc_frame_alloc);
-
+EXPORT_SYMBOL(_fc_frame_alloc);
 
 struct fc_frame *fc_frame_alloc_fill(struct fc_lport *lp, size_t payload_len)
 {
@@ -78,7 +78,7 @@ struct fc_frame *fc_frame_alloc_fill(struct fc_lport *lp, size_t payload_len)
 	fill = payload_len % 4;
 	if (fill != 0)
 		fill = 4 - fill;
-	fp = __fc_frame_alloc(payload_len + fill);
+	fp = _fc_frame_alloc(payload_len + fill);
 	if (fp) {
 		memset((char *) fr_hdr(fp) + payload_len, 0, fill);
 		/* trim is OK, we just allocated it so there are no fragments */
@@ -87,3 +87,4 @@ struct fc_frame *fc_frame_alloc_fill(struct fc_lport *lp, size_t payload_len)
 	}
 	return fp;
 }
+EXPORT_SYMBOL(fc_frame_alloc_fill);
diff --git a/drivers/scsi/libfc/fc_libfc.c b/drivers/scsi/libfc/fc_libfc.c
new file mode 100644
index 000000000000..39f4b6ab04b4
--- /dev/null
+++ b/drivers/scsi/libfc/fc_libfc.c
@@ -0,0 +1,134 @@
+/*
+ * Copyright(c) 2009 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Maintained at www.Open-FCoE.org
+ */
+
+#include <linux/kernel.h>
+#include <linux/types.h>
+#include <linux/scatterlist.h>
+#include <linux/crc32.h>
+
+#include <scsi/libfc.h>
+
+#include "fc_libfc.h"
+
+MODULE_AUTHOR("Open-FCoE.org");
+MODULE_DESCRIPTION("libfc");
+MODULE_LICENSE("GPL v2");
+
+unsigned int fc_debug_logging;
+module_param_named(debug_logging, fc_debug_logging, int, S_IRUGO|S_IWUSR);
+MODULE_PARM_DESC(debug_logging, "a bit mask of logging levels");
+
+/**
+ * libfc_init() - Initialize libfc.ko
+ */
+static int __init libfc_init(void)
+{
+	int rc = 0;
+
+	rc = fc_setup_fcp();
+	if (rc)
+		return rc;
+
+	rc = fc_setup_exch_mgr();
+	if (rc)
+		goto destroy_pkt_cache;
+
+	rc = fc_setup_rport();
+	if (rc)
+		goto destroy_em;
+
+	return rc;
+destroy_em:
+	fc_destroy_exch_mgr();
+destroy_pkt_cache:
+	fc_destroy_fcp();
+	return rc;
+}
+module_init(libfc_init);
+
+/**
+ * libfc_exit() - Tear down libfc.ko
+ */
+static void __exit libfc_exit(void)
+{
+	fc_destroy_fcp();
+	fc_destroy_exch_mgr();
+	fc_destroy_rport();
+}
+module_exit(libfc_exit);
+
+/**
+ * fc_copy_buffer_to_sglist() - This routine copies the data of a buffer
+ *				into a scatter-gather list (SG list).
+ *
+ * @buf: pointer to the data buffer.
+ * @len: the byte-length of the data buffer.
+ * @sg: pointer to the pointer of the SG list.
+ * @nents: pointer to the remaining number of entries in the SG list.
+ * @offset: pointer to the current offset in the SG list.
+ * @km_type: dedicated page table slot type for kmap_atomic.
+ * @crc: pointer to the 32-bit crc value.
+ *	 If crc is NULL, CRC is not calculated.
+ */
+u32 fc_copy_buffer_to_sglist(void *buf, size_t len,
+			     struct scatterlist *sg,
+			     u32 *nents, size_t *offset,
+			     enum km_type km_type, u32 *crc)
+{
+	size_t remaining = len;
+	u32 copy_len = 0;
+
+	while (remaining > 0 && sg) {
+		size_t off, sg_bytes;
+		void *page_addr;
+
+		if (*offset >= sg->length) {
+			/*
+			 * Check for end and drop resources
+			 * from the last iteration.
+			 */
+			if (!(*nents))
+				break;
+			--(*nents);
+			*offset -= sg->length;
+			sg = sg_next(sg);
+			continue;
+		}
+		sg_bytes = min(remaining, sg->length - *offset);
+
+		/*
+		 * The scatterlist item may be bigger than PAGE_SIZE,
+		 * but we are limited to mapping PAGE_SIZE at a time.
+		 */
+		off = *offset + sg->offset;
+		sg_bytes = min(sg_bytes,
+			       (size_t)(PAGE_SIZE - (off & ~PAGE_MASK)));
+		page_addr = kmap_atomic(sg_page(sg) + (off >> PAGE_SHIFT),
+					km_type);
+		if (crc)
+			*crc = crc32(*crc, buf, sg_bytes);
+		memcpy((char *)page_addr + (off & ~PAGE_MASK), buf, sg_bytes);
+		kunmap_atomic(page_addr, km_type);
+		buf += sg_bytes;
+		*offset += sg_bytes;
+		remaining -= sg_bytes;
+		copy_len += sg_bytes;
+	}
+	return copy_len;
+}
diff --git a/drivers/scsi/libfc/fc_libfc.h b/drivers/scsi/libfc/fc_libfc.h
new file mode 100644
index 000000000000..741fd5c72e13
--- /dev/null
+++ b/drivers/scsi/libfc/fc_libfc.h
@@ -0,0 +1,112 @@
+/*
+ * Copyright(c) 2009 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Maintained at www.Open-FCoE.org
+ */
+
+#ifndef _FC_LIBFC_H_
+#define _FC_LIBFC_H_
+
+#define FC_LIBFC_LOGGING 0x01 /* General logging, not categorized */
+#define FC_LPORT_LOGGING 0x02 /* lport layer logging */
+#define FC_DISC_LOGGING	 0x04 /* discovery layer logging */
+#define FC_RPORT_LOGGING 0x08 /* rport layer logging */
+#define FC_FCP_LOGGING	 0x10 /* I/O path logging */
+#define FC_EM_LOGGING	 0x20 /* Exchange Manager logging */
+#define FC_EXCH_LOGGING	 0x40 /* Exchange/Sequence logging */
+#define FC_SCSI_LOGGING	 0x80 /* SCSI logging (mostly error handling) */
+
+extern unsigned int fc_debug_logging;
+
+#define FC_CHECK_LOGGING(LEVEL, CMD)			\
+	do {						\
+		if (unlikely(fc_debug_logging & LEVEL))	\
+			do {				\
+				CMD;			\
+			} while (0);			\
+	} while (0)
+
+#define FC_LIBFC_DBG(fmt, args...)					\
+	FC_CHECK_LOGGING(FC_LIBFC_LOGGING,				\
+			 printk(KERN_INFO "libfc: " fmt, ##args))
+
+#define FC_LPORT_DBG(lport, fmt, args...)				\
+	FC_CHECK_LOGGING(FC_LPORT_LOGGING,				\
+			 printk(KERN_INFO "host%u: lport %6x: " fmt,	\
+				(lport)->host->host_no,			\
+				fc_host_port_id((lport)->host), ##args))
+
+#define FC_DISC_DBG(disc, fmt, args...)				\
+	FC_CHECK_LOGGING(FC_DISC_LOGGING,			\
+			 printk(KERN_INFO "host%u: disc: " fmt,	\
+				(disc)->lport->host->host_no,	\
+				##args))
+
+#define FC_RPORT_ID_DBG(lport, port_id, fmt, args...)			\
+	FC_CHECK_LOGGING(FC_RPORT_LOGGING,				\
+			 printk(KERN_INFO "host%u: rport %6x: " fmt,	\
+				(lport)->host->host_no,			\
+				(port_id), ##args))
+
+#define FC_RPORT_DBG(rdata, fmt, args...)				\
+	FC_RPORT_ID_DBG((rdata)->local_port, (rdata)->ids.port_id, fmt, ##args)
+
+#define FC_FCP_DBG(pkt, fmt, args...)					\
+	FC_CHECK_LOGGING(FC_FCP_LOGGING,				\
+			 printk(KERN_INFO "host%u: fcp: %6x: " fmt,	\
+				(pkt)->lp->host->host_no,		\
+				pkt->rport->port_id, ##args))
+
+#define FC_EXCH_DBG(exch, fmt, args...)					\
+	FC_CHECK_LOGGING(FC_EXCH_LOGGING,				\
+			 printk(KERN_INFO "host%u: xid %4x: " fmt,	\
+				(exch)->lp->host->host_no,		\
+				exch->xid, ##args))
+
+#define FC_SCSI_DBG(lport, fmt, args...)				\
+	FC_CHECK_LOGGING(FC_SCSI_LOGGING,				\
+			 printk(KERN_INFO "host%u: scsi: " fmt,		\
+				(lport)->host->host_no,	##args))
+
+/*
+ * Set up direct-data placement for this I/O request
+ */
+void fc_fcp_ddp_setup(struct fc_fcp_pkt *fsp, u16 xid);
+
+/*
+ * Module setup functions
+ */
+int fc_setup_exch_mgr(void);
+void fc_destroy_exch_mgr(void);
+int fc_setup_rport(void);
+void fc_destroy_rport(void);
+int fc_setup_fcp(void);
+void fc_destroy_fcp(void);
+
+/*
+ * Internal libfc functions
+ */
+const char *fc_els_resp_type(struct fc_frame *);
+
+/*
+ * Copies a buffer into an sg list
+ */
+u32 fc_copy_buffer_to_sglist(void *buf, size_t len,
+			     struct scatterlist *sg,
+			     u32 *nents, size_t *offset,
+			     enum km_type km_type, u32 *crc);
+
+#endif /* _FC_LIBFC_H_ */
diff --git a/drivers/scsi/libfc/fc_lport.c b/drivers/scsi/libfc/fc_lport.c
index bd2f77197447..0b165024a219 100644
--- a/drivers/scsi/libfc/fc_lport.c
+++ b/drivers/scsi/libfc/fc_lport.c
@@ -56,7 +56,7 @@
  * at the same time.
  *
  * When discovery succeeds or fails a callback is made to the lport as
- * notification. Currently, succesful discovery causes the lport to take no
+ * notification. Currently, successful discovery causes the lport to take no
  * action. A failure will cause the lport to reset. There is likely a circular
  * locking problem with this implementation.
  */
@@ -94,6 +94,9 @@
 
 #include <scsi/libfc.h>
 #include <scsi/fc_encode.h>
+#include <linux/scatterlist.h>
+
+#include "fc_libfc.h"
 
 /* Fabric IDs to use for point-to-point mode, chosen on whims. */
 #define FC_LOCAL_PTP_FID_LO   0x010101
@@ -106,8 +109,7 @@ static void fc_lport_error(struct fc_lport *, struct fc_frame *);
 static void fc_lport_enter_reset(struct fc_lport *);
 static void fc_lport_enter_flogi(struct fc_lport *);
 static void fc_lport_enter_dns(struct fc_lport *);
-static void fc_lport_enter_rpn_id(struct fc_lport *);
-static void fc_lport_enter_rft_id(struct fc_lport *);
+static void fc_lport_enter_ns(struct fc_lport *, enum fc_lport_state);
 static void fc_lport_enter_scr(struct fc_lport *);
 static void fc_lport_enter_ready(struct fc_lport *);
 static void fc_lport_enter_logo(struct fc_lport *);
@@ -116,14 +118,40 @@ static const char *fc_lport_state_names[] = {
 	[LPORT_ST_DISABLED] = "disabled",
 	[LPORT_ST_FLOGI] =    "FLOGI",
 	[LPORT_ST_DNS] =      "dNS",
-	[LPORT_ST_RPN_ID] =   "RPN_ID",
+	[LPORT_ST_RNN_ID] =   "RNN_ID",
+	[LPORT_ST_RSNN_NN] =  "RSNN_NN",
+	[LPORT_ST_RSPN_ID] =  "RSPN_ID",
 	[LPORT_ST_RFT_ID] =   "RFT_ID",
+	[LPORT_ST_RFF_ID] =   "RFF_ID",
 	[LPORT_ST_SCR] =      "SCR",
 	[LPORT_ST_READY] =    "Ready",
 	[LPORT_ST_LOGO] =     "LOGO",
 	[LPORT_ST_RESET] =    "reset",
 };
 
+/**
+ * struct fc_bsg_info - FC Passthrough managemet structure
+ * @job:      The passthrough job
+ * @lport:    The local port to pass through a command
+ * @rsp_code: The expected response code
+ * @sg:	      job->reply_payload.sg_list
+ * @nents:    job->reply_payload.sg_cnt
+ * @offset:   The offset into the response data
+ */
+struct fc_bsg_info {
+	struct fc_bsg_job *job;
+	struct fc_lport *lport;
+	u16 rsp_code;
+	struct scatterlist *sg;
+	u32 nents;
+	size_t offset;
+};
+
+/**
+ * fc_frame_drop() - Dummy frame handler
+ * @lport: The local port the frame was received on
+ * @fp:	   The received frame
+ */
 static int fc_frame_drop(struct fc_lport *lport, struct fc_frame *fp)
 {
 	fc_frame_free(fp);
@@ -150,8 +178,8 @@ static void fc_lport_rport_callback(struct fc_lport *lport,
 	switch (event) {
 	case RPORT_EV_READY:
 		if (lport->state == LPORT_ST_DNS) {
-			lport->dns_rp = rdata;
-			fc_lport_enter_rpn_id(lport);
+			lport->dns_rdata = rdata;
+			fc_lport_enter_ns(lport, LPORT_ST_RNN_ID);
 		} else {
 			FC_LPORT_DBG(lport, "Received an READY event "
 				     "on port (%6x) for the directory "
@@ -165,7 +193,7 @@ static void fc_lport_rport_callback(struct fc_lport *lport,
 	case RPORT_EV_LOGO:
 	case RPORT_EV_FAILED:
 	case RPORT_EV_STOP:
-		lport->dns_rp = NULL;
+		lport->dns_rdata = NULL;
 		break;
 	case RPORT_EV_NONE:
 		break;
@@ -189,8 +217,8 @@ static const char *fc_lport_state(struct fc_lport *lport)
 
 /**
  * fc_lport_ptp_setup() - Create an rport for point-to-point mode
- * @lport: The lport to attach the ptp rport to
- * @fid: The FID of the ptp rport
+ * @lport:	 The lport to attach the ptp rport to
+ * @remote_fid:	 The FID of the ptp rport
  * @remote_wwpn: The WWPN of the ptp rport
  * @remote_wwnn: The WWNN of the ptp rport
  */
@@ -199,18 +227,22 @@ static void fc_lport_ptp_setup(struct fc_lport *lport,
 			       u64 remote_wwnn)
 {
 	mutex_lock(&lport->disc.disc_mutex);
-	if (lport->ptp_rp)
-		lport->tt.rport_logoff(lport->ptp_rp);
-	lport->ptp_rp = lport->tt.rport_create(lport, remote_fid);
-	lport->ptp_rp->ids.port_name = remote_wwpn;
-	lport->ptp_rp->ids.node_name = remote_wwnn;
+	if (lport->ptp_rdata)
+		lport->tt.rport_logoff(lport->ptp_rdata);
+	lport->ptp_rdata = lport->tt.rport_create(lport, remote_fid);
+	lport->ptp_rdata->ids.port_name = remote_wwpn;
+	lport->ptp_rdata->ids.node_name = remote_wwnn;
 	mutex_unlock(&lport->disc.disc_mutex);
 
-	lport->tt.rport_login(lport->ptp_rp);
+	lport->tt.rport_login(lport->ptp_rdata);
 
 	fc_lport_enter_ready(lport);
 }
 
+/**
+ * fc_get_host_port_type() - Return the port type of the given Scsi_Host
+ * @shost: The SCSI host whose port type is to be determined
+ */
 void fc_get_host_port_type(struct Scsi_Host *shost)
 {
 	/* TODO - currently just NPORT */
@@ -218,17 +250,33 @@ void fc_get_host_port_type(struct Scsi_Host *shost)
 }
 EXPORT_SYMBOL(fc_get_host_port_type);
 
+/**
+ * fc_get_host_port_state() - Return the port state of the given Scsi_Host
+ * @shost:  The SCSI host whose port state is to be determined
+ */
 void fc_get_host_port_state(struct Scsi_Host *shost)
 {
-	struct fc_lport *lp = shost_priv(shost);
+	struct fc_lport *lport = shost_priv(shost);
 
-	if (lp->link_up)
-		fc_host_port_state(shost) = FC_PORTSTATE_ONLINE;
+	mutex_lock(&lport->lp_mutex);
+	if (!lport->link_up)
+		fc_host_port_state(shost) = FC_PORTSTATE_LINKDOWN;
 	else
-		fc_host_port_state(shost) = FC_PORTSTATE_OFFLINE;
+		switch (lport->state) {
+		case LPORT_ST_READY:
+			fc_host_port_state(shost) = FC_PORTSTATE_ONLINE;
+			break;
+		default:
+			fc_host_port_state(shost) = FC_PORTSTATE_OFFLINE;
+		}
+	mutex_unlock(&lport->lp_mutex);
 }
 EXPORT_SYMBOL(fc_get_host_port_state);
 
+/**
+ * fc_get_host_speed() - Return the speed of the given Scsi_Host
+ * @shost: The SCSI host whose port speed is to be determined
+ */
 void fc_get_host_speed(struct Scsi_Host *shost)
 {
 	struct fc_lport *lport = shost_priv(shost);
@@ -237,24 +285,28 @@ void fc_get_host_speed(struct Scsi_Host *shost)
 }
 EXPORT_SYMBOL(fc_get_host_speed);
 
+/**
+ * fc_get_host_stats() - Return the Scsi_Host's statistics
+ * @shost: The SCSI host whose statistics are to be returned
+ */
 struct fc_host_statistics *fc_get_host_stats(struct Scsi_Host *shost)
 {
 	struct fc_host_statistics *fcoe_stats;
-	struct fc_lport *lp = shost_priv(shost);
+	struct fc_lport *lport = shost_priv(shost);
 	struct timespec v0, v1;
 	unsigned int cpu;
 
-	fcoe_stats = &lp->host_stats;
+	fcoe_stats = &lport->host_stats;
 	memset(fcoe_stats, 0, sizeof(struct fc_host_statistics));
 
 	jiffies_to_timespec(jiffies, &v0);
-	jiffies_to_timespec(lp->boot_time, &v1);
+	jiffies_to_timespec(lport->boot_time, &v1);
 	fcoe_stats->seconds_since_last_reset = (v0.tv_sec - v1.tv_sec);
 
 	for_each_possible_cpu(cpu) {
 		struct fcoe_dev_stats *stats;
 
-		stats = per_cpu_ptr(lp->dev_stats, cpu);
+		stats = per_cpu_ptr(lport->dev_stats, cpu);
 
 		fcoe_stats->tx_frames += stats->TxFrames;
 		fcoe_stats->tx_words += stats->TxWords;
@@ -279,12 +331,15 @@ struct fc_host_statistics *fc_get_host_stats(struct Scsi_Host *shost)
 }
 EXPORT_SYMBOL(fc_get_host_stats);
 
-/*
- * Fill in FLOGI command for request.
+/**
+ * fc_lport_flogi_fill() - Fill in FLOGI command for request
+ * @lport: The local port the FLOGI is for
+ * @flogi: The FLOGI command
+ * @op:	   The opcode
  */
-static void
-fc_lport_flogi_fill(struct fc_lport *lport, struct fc_els_flogi *flogi,
-		    unsigned int op)
+static void fc_lport_flogi_fill(struct fc_lport *lport,
+				struct fc_els_flogi *flogi,
+				unsigned int op)
 {
 	struct fc_els_csp *sp;
 	struct fc_els_cssp *cp;
@@ -312,8 +367,10 @@ fc_lport_flogi_fill(struct fc_lport *lport, struct fc_els_flogi *flogi,
 	}
 }
 
-/*
- * Add a supported FC-4 type.
+/**
+ * fc_lport_add_fc4_type() - Add a supported FC-4 type to a local port
+ * @lport: The local port to add a new FC-4 type to
+ * @type:  The new FC-4 type
  */
 static void fc_lport_add_fc4_type(struct fc_lport *lport, enum fc_fh_type type)
 {
@@ -325,11 +382,11 @@ static void fc_lport_add_fc4_type(struct fc_lport *lport, enum fc_fh_type type)
 
 /**
  * fc_lport_recv_rlir_req() - Handle received Registered Link Incident Report.
+ * @sp:	   The sequence in the RLIR exchange
+ * @fp:	   The RLIR request frame
  * @lport: Fibre Channel local port recieving the RLIR
- * @sp: current sequence in the RLIR exchange
- * @fp: RLIR request frame
  *
- * Locking Note: The lport lock is exected to be held before calling
+ * Locking Note: The lport lock is expected to be held before calling
  * this function.
  */
 static void fc_lport_recv_rlir_req(struct fc_seq *sp, struct fc_frame *fp,
@@ -344,11 +401,11 @@ static void fc_lport_recv_rlir_req(struct fc_seq *sp, struct fc_frame *fp,
 
 /**
  * fc_lport_recv_echo_req() - Handle received ECHO request
- * @lport: Fibre Channel local port recieving the ECHO
- * @sp: current sequence in the ECHO exchange
- * @fp: ECHO request frame
+ * @sp:	   The sequence in the ECHO exchange
+ * @fp:	   ECHO request frame
+ * @lport: The local port recieving the ECHO
  *
- * Locking Note: The lport lock is exected to be held before calling
+ * Locking Note: The lport lock is expected to be held before calling
  * this function.
  */
 static void fc_lport_recv_echo_req(struct fc_seq *sp, struct fc_frame *in_fp,
@@ -361,7 +418,7 @@ static void fc_lport_recv_echo_req(struct fc_seq *sp, struct fc_frame *in_fp,
 	void *dp;
 	u32 f_ctl;
 
-	FC_LPORT_DBG(lport, "Received RLIR request while in state %s\n",
+	FC_LPORT_DBG(lport, "Received ECHO request while in state %s\n",
 		     fc_lport_state(lport));
 
 	len = fr_len(in_fp) - sizeof(struct fc_frame_header);
@@ -374,7 +431,7 @@ static void fc_lport_recv_echo_req(struct fc_seq *sp, struct fc_frame *in_fp,
 	if (fp) {
 		dp = fc_frame_payload_get(fp, len);
 		memcpy(dp, pp, len);
-		*((u32 *)dp) = htonl(ELS_LS_ACC << 24);
+		*((__be32 *)dp) = htonl(ELS_LS_ACC << 24);
 		sp = lport->tt.seq_start_next(sp);
 		f_ctl = FC_FC_EX_CTX | FC_FC_LAST_SEQ | FC_FC_END_SEQ;
 		fc_fill_fc_hdr(fp, FC_RCTL_ELS_REP, ep->did, ep->sid,
@@ -385,12 +442,12 @@ static void fc_lport_recv_echo_req(struct fc_seq *sp, struct fc_frame *in_fp,
 }
 
 /**
- * fc_lport_recv_echo_req() - Handle received Request Node ID data request
- * @lport: Fibre Channel local port recieving the RNID
- * @sp: current sequence in the RNID exchange
- * @fp: RNID request frame
+ * fc_lport_recv_rnid_req() - Handle received Request Node ID data request
+ * @sp:	   The sequence in the RNID exchange
+ * @fp:	   The RNID request frame
+ * @lport: The local port recieving the RNID
  *
- * Locking Note: The lport lock is exected to be held before calling
+ * Locking Note: The lport lock is expected to be held before calling
  * this function.
  */
 static void fc_lport_recv_rnid_req(struct fc_seq *sp, struct fc_frame *in_fp,
@@ -453,9 +510,9 @@ static void fc_lport_recv_rnid_req(struct fc_seq *sp, struct fc_frame *in_fp,
 
 /**
  * fc_lport_recv_logo_req() - Handle received fabric LOGO request
- * @lport: Fibre Channel local port recieving the LOGO
- * @sp: current sequence in the LOGO exchange
- * @fp: LOGO request frame
+ * @sp:	   The sequence in the LOGO exchange
+ * @fp:	   The LOGO request frame
+ * @lport: The local port recieving the LOGO
  *
  * Locking Note: The lport lock is exected to be held before calling
  * this function.
@@ -470,7 +527,7 @@ static void fc_lport_recv_logo_req(struct fc_seq *sp, struct fc_frame *fp,
 
 /**
  * fc_fabric_login() - Start the lport state machine
- * @lport: The lport that should log into the fabric
+ * @lport: The local port that should log into the fabric
  *
  * Locking Note: This function should not be called
  *		 with the lport lock held.
@@ -480,7 +537,9 @@ int fc_fabric_login(struct fc_lport *lport)
 	int rc = -1;
 
 	mutex_lock(&lport->lp_mutex);
-	if (lport->state == LPORT_ST_DISABLED) {
+	if (lport->state == LPORT_ST_DISABLED ||
+	    lport->state == LPORT_ST_LOGO) {
+		fc_lport_state_enter(lport, LPORT_ST_RESET);
 		fc_lport_enter_reset(lport);
 		rc = 0;
 	}
@@ -491,47 +550,69 @@ int fc_fabric_login(struct fc_lport *lport)
 EXPORT_SYMBOL(fc_fabric_login);
 
 /**
- * fc_linkup() - Handler for transport linkup events
+ * __fc_linkup() - Handler for transport linkup events
  * @lport: The lport whose link is up
+ *
+ * Locking: must be called with the lp_mutex held
  */
-void fc_linkup(struct fc_lport *lport)
+void __fc_linkup(struct fc_lport *lport)
 {
-	printk(KERN_INFO "libfc: Link up on port (%6x)\n",
-	       fc_host_port_id(lport->host));
-
-	mutex_lock(&lport->lp_mutex);
 	if (!lport->link_up) {
 		lport->link_up = 1;
 
 		if (lport->state == LPORT_ST_RESET)
 			fc_lport_enter_flogi(lport);
 	}
+}
+
+/**
+ * fc_linkup() - Handler for transport linkup events
+ * @lport: The local port whose link is up
+ */
+void fc_linkup(struct fc_lport *lport)
+{
+	printk(KERN_INFO "host%d: libfc: Link up on port (%6x)\n",
+	       lport->host->host_no, fc_host_port_id(lport->host));
+
+	mutex_lock(&lport->lp_mutex);
+	__fc_linkup(lport);
 	mutex_unlock(&lport->lp_mutex);
 }
 EXPORT_SYMBOL(fc_linkup);
 
 /**
- * fc_linkdown() - Handler for transport linkdown events
+ * __fc_linkdown() - Handler for transport linkdown events
  * @lport: The lport whose link is down
+ *
+ * Locking: must be called with the lp_mutex held
  */
-void fc_linkdown(struct fc_lport *lport)
+void __fc_linkdown(struct fc_lport *lport)
 {
-	mutex_lock(&lport->lp_mutex);
-	printk(KERN_INFO "libfc: Link down on port (%6x)\n",
-	       fc_host_port_id(lport->host));
-
 	if (lport->link_up) {
 		lport->link_up = 0;
 		fc_lport_enter_reset(lport);
 		lport->tt.fcp_cleanup(lport);
 	}
+}
+
+/**
+ * fc_linkdown() - Handler for transport linkdown events
+ * @lport: The local port whose link is down
+ */
+void fc_linkdown(struct fc_lport *lport)
+{
+	printk(KERN_INFO "host%d: libfc: Link down on port (%6x)\n",
+	       lport->host->host_no, fc_host_port_id(lport->host));
+
+	mutex_lock(&lport->lp_mutex);
+	__fc_linkdown(lport);
 	mutex_unlock(&lport->lp_mutex);
 }
 EXPORT_SYMBOL(fc_linkdown);
 
 /**
  * fc_fabric_logoff() - Logout of the fabric
- * @lport:	      fc_lport pointer to logoff the fabric
+ * @lport: The local port to logoff the fabric
  *
  * Return value:
  *	0 for success, -1 for failure
@@ -540,8 +621,8 @@ int fc_fabric_logoff(struct fc_lport *lport)
 {
 	lport->tt.disc_stop_final(lport);
 	mutex_lock(&lport->lp_mutex);
-	if (lport->dns_rp)
-		lport->tt.rport_logoff(lport->dns_rp);
+	if (lport->dns_rdata)
+		lport->tt.rport_logoff(lport->dns_rdata);
 	mutex_unlock(&lport->lp_mutex);
 	lport->tt.rport_flush_queue();
 	mutex_lock(&lport->lp_mutex);
@@ -553,11 +634,9 @@ int fc_fabric_logoff(struct fc_lport *lport)
 EXPORT_SYMBOL(fc_fabric_logoff);
 
 /**
- * fc_lport_destroy() - unregister a fc_lport
- * @lport:	      fc_lport pointer to unregister
+ * fc_lport_destroy() - Unregister a fc_lport
+ * @lport: The local port to unregister
  *
- * Return value:
- *	None
  * Note:
  * exit routine for fc_lport instance
  * clean-up all the allocated memory
@@ -580,13 +659,9 @@ int fc_lport_destroy(struct fc_lport *lport)
 EXPORT_SYMBOL(fc_lport_destroy);
 
 /**
- * fc_set_mfs() - sets up the mfs for the corresponding fc_lport
- * @lport: fc_lport pointer to unregister
- * @mfs: the new mfs for fc_lport
- *
- * Set mfs for the given fc_lport to the new mfs.
- *
- * Return: 0 for success
+ * fc_set_mfs() - Set the maximum frame size for a local port
+ * @lport: The local port to set the MFS for
+ * @mfs:   The new MFS
  */
 int fc_set_mfs(struct fc_lport *lport, u32 mfs)
 {
@@ -617,7 +692,7 @@ EXPORT_SYMBOL(fc_set_mfs);
 
 /**
  * fc_lport_disc_callback() - Callback for discovery events
- * @lport: FC local port
+ * @lport: The local port receiving the event
  * @event: The discovery event
  */
 void fc_lport_disc_callback(struct fc_lport *lport, enum fc_disc_event event)
@@ -627,8 +702,9 @@ void fc_lport_disc_callback(struct fc_lport *lport, enum fc_disc_event event)
 		FC_LPORT_DBG(lport, "Discovery succeeded\n");
 		break;
 	case DISC_EV_FAILED:
-		printk(KERN_ERR "libfc: Discovery failed for port (%6x)\n",
-		       fc_host_port_id(lport->host));
+		printk(KERN_ERR "host%d: libfc: "
+		       "Discovery failed for port (%6x)\n",
+		       lport->host->host_no, fc_host_port_id(lport->host));
 		mutex_lock(&lport->lp_mutex);
 		fc_lport_enter_reset(lport);
 		mutex_unlock(&lport->lp_mutex);
@@ -641,7 +717,7 @@ void fc_lport_disc_callback(struct fc_lport *lport, enum fc_disc_event event)
 
 /**
  * fc_rport_enter_ready() - Enter the ready state and start discovery
- * @lport: Fibre Channel local port that is ready
+ * @lport: The local port that is ready
  *
  * Locking Note: The lport lock is expected to be held before calling
  * this routine.
@@ -652,22 +728,46 @@ static void fc_lport_enter_ready(struct fc_lport *lport)
 		     fc_lport_state(lport));
 
 	fc_lport_state_enter(lport, LPORT_ST_READY);
+	if (lport->vport)
+		fc_vport_set_state(lport->vport, FC_VPORT_ACTIVE);
+	fc_vports_linkchange(lport);
 
-	if (!lport->ptp_rp)
+	if (!lport->ptp_rdata)
 		lport->tt.disc_start(fc_lport_disc_callback, lport);
 }
 
 /**
+ * fc_lport_set_port_id() - set the local port Port ID
+ * @lport: The local port which will have its Port ID set.
+ * @port_id: The new port ID.
+ * @fp: The frame containing the incoming request, or NULL.
+ *
+ * Locking Note: The lport lock is expected to be held before calling
+ * this function.
+ */
+static void fc_lport_set_port_id(struct fc_lport *lport, u32 port_id,
+				 struct fc_frame *fp)
+{
+	if (port_id)
+		printk(KERN_INFO "host%d: Assigned Port ID %6x\n",
+		       lport->host->host_no, port_id);
+
+	fc_host_port_id(lport->host) = port_id;
+	if (lport->tt.lport_set_port_id)
+		lport->tt.lport_set_port_id(lport, port_id, fp);
+}
+
+/**
  * fc_lport_recv_flogi_req() - Receive a FLOGI request
  * @sp_in: The sequence the FLOGI is on
- * @rx_fp: The frame the FLOGI is in
- * @lport: The lport that recieved the request
+ * @rx_fp: The FLOGI frame
+ * @lport: The local port that recieved the request
  *
  * A received FLOGI request indicates a point-to-point connection.
  * Accept it with the common service parameters indicating our N port.
  * Set up to do a PLOGI if we have the higher-number WWPN.
  *
- * Locking Note: The lport lock is exected to be held before calling
+ * Locking Note: The lport lock is expected to be held before calling
  * this function.
  */
 static void fc_lport_recv_flogi_req(struct fc_seq *sp_in,
@@ -695,8 +795,9 @@ static void fc_lport_recv_flogi_req(struct fc_seq *sp_in,
 		goto out;
 	remote_wwpn = get_unaligned_be64(&flp->fl_wwpn);
 	if (remote_wwpn == lport->wwpn) {
-		printk(KERN_WARNING "libfc: Received FLOGI from port "
-		       "with same WWPN %llx\n", remote_wwpn);
+		printk(KERN_WARNING "host%d: libfc: Received FLOGI from port "
+		       "with same WWPN %llx\n",
+		       lport->host->host_no, remote_wwpn);
 		goto out;
 	}
 	FC_LPORT_DBG(lport, "FLOGI from port WWPN %llx\n", remote_wwpn);
@@ -715,7 +816,7 @@ static void fc_lport_recv_flogi_req(struct fc_seq *sp_in,
 		remote_fid = FC_LOCAL_PTP_FID_HI;
 	}
 
-	fc_host_port_id(lport->host) = local_fid;
+	fc_lport_set_port_id(lport, local_fid, rx_fp);
 
 	fp = fc_frame_alloc(lport, sizeof(*flp));
 	if (fp) {
@@ -747,9 +848,9 @@ out:
 
 /**
  * fc_lport_recv_req() - The generic lport request handler
- * @lport: The lport that received the request
- * @sp: The sequence the request is on
- * @fp: The frame the request is in
+ * @lport: The local port that received the request
+ * @sp:	   The sequence the request is on
+ * @fp:	   The request frame
  *
  * This function will see if the lport handles the request or
  * if an rport should handle the request.
@@ -817,8 +918,8 @@ static void fc_lport_recv_req(struct fc_lport *lport, struct fc_seq *sp,
 }
 
 /**
- * fc_lport_reset() - Reset an lport
- * @lport: The lport which should be reset
+ * fc_lport_reset() - Reset a local port
+ * @lport: The local port which should be reset
  *
  * Locking Note: This functions should not be called with the
  *		 lport lock held.
@@ -834,29 +935,31 @@ int fc_lport_reset(struct fc_lport *lport)
 EXPORT_SYMBOL(fc_lport_reset);
 
 /**
- * fc_lport_reset_locked() - Reset the local port
- * @lport: Fibre Channel local port to be reset
+ * fc_lport_reset_locked() - Reset the local port w/ the lport lock held
+ * @lport: The local port to be reset
  *
  * Locking Note: The lport lock is expected to be held before calling
  * this routine.
  */
 static void fc_lport_reset_locked(struct fc_lport *lport)
 {
-	if (lport->dns_rp)
-		lport->tt.rport_logoff(lport->dns_rp);
+	if (lport->dns_rdata)
+		lport->tt.rport_logoff(lport->dns_rdata);
 
-	lport->ptp_rp = NULL;
+	lport->ptp_rdata = NULL;
 
 	lport->tt.disc_stop(lport);
 
 	lport->tt.exch_mgr_reset(lport, 0, 0);
 	fc_host_fabric_name(lport->host) = 0;
-	fc_host_port_id(lport->host) = 0;
+
+	if (fc_host_port_id(lport->host))
+		fc_lport_set_port_id(lport, 0, NULL);
 }
 
 /**
  * fc_lport_enter_reset() - Reset the local port
- * @lport: Fibre Channel local port to be reset
+ * @lport: The local port to be reset
  *
  * Locking Note: The lport lock is expected to be held before calling
  * this routine.
@@ -866,15 +969,25 @@ static void fc_lport_enter_reset(struct fc_lport *lport)
 	FC_LPORT_DBG(lport, "Entered RESET state from %s state\n",
 		     fc_lport_state(lport));
 
+	if (lport->state == LPORT_ST_DISABLED || lport->state == LPORT_ST_LOGO)
+		return;
+
+	if (lport->vport) {
+		if (lport->link_up)
+			fc_vport_set_state(lport->vport, FC_VPORT_INITIALIZING);
+		else
+			fc_vport_set_state(lport->vport, FC_VPORT_LINKDOWN);
+	}
 	fc_lport_state_enter(lport, LPORT_ST_RESET);
+	fc_vports_linkchange(lport);
 	fc_lport_reset_locked(lport);
 	if (lport->link_up)
 		fc_lport_enter_flogi(lport);
 }
 
 /**
- * fc_lport_enter_disabled() - disable the local port
- * @lport: Fibre Channel local port to be reset
+ * fc_lport_enter_disabled() - Disable the local port
+ * @lport: The local port to be reset
  *
  * Locking Note: The lport lock is expected to be held before calling
  * this routine.
@@ -885,13 +998,14 @@ static void fc_lport_enter_disabled(struct fc_lport *lport)
 		     fc_lport_state(lport));
 
 	fc_lport_state_enter(lport, LPORT_ST_DISABLED);
+	fc_vports_linkchange(lport);
 	fc_lport_reset_locked(lport);
 }
 
 /**
  * fc_lport_error() - Handler for any errors
- * @lport: The fc_lport object
- * @fp: The frame pointer
+ * @lport: The local port that the error was on
+ * @fp:	   The error code encoded in a frame pointer
  *
  * If the error was caused by a resource allocation failure
  * then wait for half a second and retry, otherwise retry
@@ -922,8 +1036,11 @@ static void fc_lport_error(struct fc_lport *lport, struct fc_frame *fp)
 			case LPORT_ST_DISABLED:
 			case LPORT_ST_READY:
 			case LPORT_ST_RESET:
-			case LPORT_ST_RPN_ID:
+			case LPORT_ST_RNN_ID:
+			case LPORT_ST_RSNN_NN:
+			case LPORT_ST_RSPN_ID:
 			case LPORT_ST_RFT_ID:
+			case LPORT_ST_RFF_ID:
 			case LPORT_ST_SCR:
 			case LPORT_ST_DNS:
 			case LPORT_ST_FLOGI:
@@ -936,33 +1053,33 @@ static void fc_lport_error(struct fc_lport *lport, struct fc_frame *fp)
 }
 
 /**
- * fc_lport_rft_id_resp() - Handle response to Register Fibre
- *			    Channel Types by ID (RPN_ID) request
- * @sp: current sequence in RPN_ID exchange
- * @fp: response frame
+ * fc_lport_ns_resp() - Handle response to a name server
+ *			registration exchange
+ * @sp:	    current sequence in exchange
+ * @fp:	    response frame
  * @lp_arg: Fibre Channel host port instance
  *
  * Locking Note: This function will be called without the lport lock
- * held, but it will lock, call an _enter_* function or fc_lport_error
+ * held, but it will lock, call an _enter_* function or fc_lport_error()
  * and then unlock the lport.
  */
-static void fc_lport_rft_id_resp(struct fc_seq *sp, struct fc_frame *fp,
-				 void *lp_arg)
+static void fc_lport_ns_resp(struct fc_seq *sp, struct fc_frame *fp,
+			     void *lp_arg)
 {
 	struct fc_lport *lport = lp_arg;
 	struct fc_frame_header *fh;
 	struct fc_ct_hdr *ct;
 
-	FC_LPORT_DBG(lport, "Received a RFT_ID %s\n", fc_els_resp_type(fp));
+	FC_LPORT_DBG(lport, "Received a ns %s\n", fc_els_resp_type(fp));
 
 	if (fp == ERR_PTR(-FC_EX_CLOSED))
 		return;
 
 	mutex_lock(&lport->lp_mutex);
 
-	if (lport->state != LPORT_ST_RFT_ID) {
-		FC_LPORT_DBG(lport, "Received a RFT_ID response, but in state "
-			     "%s\n", fc_lport_state(lport));
+	if (lport->state < LPORT_ST_RNN_ID || lport->state > LPORT_ST_RFF_ID) {
+		FC_LPORT_DBG(lport, "Received a name server response, "
+			     "but in state %s\n", fc_lport_state(lport));
 		if (IS_ERR(fp))
 			goto err;
 		goto out;
@@ -980,63 +1097,28 @@ static void fc_lport_rft_id_resp(struct fc_seq *sp, struct fc_frame *fp,
 	    ct->ct_fs_type == FC_FST_DIR &&
 	    ct->ct_fs_subtype == FC_NS_SUBTYPE &&
 	    ntohs(ct->ct_cmd) == FC_FS_ACC)
-		fc_lport_enter_scr(lport);
-	else
-		fc_lport_error(lport, fp);
-out:
-	fc_frame_free(fp);
-err:
-	mutex_unlock(&lport->lp_mutex);
-}
-
-/**
- * fc_lport_rpn_id_resp() - Handle response to Register Port
- *			    Name by ID (RPN_ID) request
- * @sp: current sequence in RPN_ID exchange
- * @fp: response frame
- * @lp_arg: Fibre Channel host port instance
- *
- * Locking Note: This function will be called without the lport lock
- * held, but it will lock, call an _enter_* function or fc_lport_error
- * and then unlock the lport.
- */
-static void fc_lport_rpn_id_resp(struct fc_seq *sp, struct fc_frame *fp,
-				 void *lp_arg)
-{
-	struct fc_lport *lport = lp_arg;
-	struct fc_frame_header *fh;
-	struct fc_ct_hdr *ct;
-
-	FC_LPORT_DBG(lport, "Received a RPN_ID %s\n", fc_els_resp_type(fp));
-
-	if (fp == ERR_PTR(-FC_EX_CLOSED))
-		return;
-
-	mutex_lock(&lport->lp_mutex);
-
-	if (lport->state != LPORT_ST_RPN_ID) {
-		FC_LPORT_DBG(lport, "Received a RPN_ID response, but in state "
-			     "%s\n", fc_lport_state(lport));
-		if (IS_ERR(fp))
-			goto err;
-		goto out;
-	}
-
-	if (IS_ERR(fp)) {
-		fc_lport_error(lport, fp);
-		goto err;
-	}
-
-	fh = fc_frame_header_get(fp);
-	ct = fc_frame_payload_get(fp, sizeof(*ct));
-	if (fh && ct && fh->fh_type == FC_TYPE_CT &&
-	    ct->ct_fs_type == FC_FST_DIR &&
-	    ct->ct_fs_subtype == FC_NS_SUBTYPE &&
-	    ntohs(ct->ct_cmd) == FC_FS_ACC)
-		fc_lport_enter_rft_id(lport);
+		switch (lport->state) {
+		case LPORT_ST_RNN_ID:
+			fc_lport_enter_ns(lport, LPORT_ST_RSNN_NN);
+			break;
+		case LPORT_ST_RSNN_NN:
+			fc_lport_enter_ns(lport, LPORT_ST_RSPN_ID);
+			break;
+		case LPORT_ST_RSPN_ID:
+			fc_lport_enter_ns(lport, LPORT_ST_RFT_ID);
+			break;
+		case LPORT_ST_RFT_ID:
+			fc_lport_enter_ns(lport, LPORT_ST_RFF_ID);
+			break;
+		case LPORT_ST_RFF_ID:
+			fc_lport_enter_scr(lport);
+			break;
+		default:
+			/* should have already been caught by state checks */
+			break;
+		}
 	else
 		fc_lport_error(lport, fp);
-
 out:
 	fc_frame_free(fp);
 err:
@@ -1045,8 +1127,8 @@ err:
 
 /**
  * fc_lport_scr_resp() - Handle response to State Change Register (SCR) request
- * @sp: current sequence in SCR exchange
- * @fp: response frame
+ * @sp:	    current sequence in SCR exchange
+ * @fp:	    response frame
  * @lp_arg: Fibre Channel lport port instance that sent the registration request
  *
  * Locking Note: This function will be called without the lport lock
@@ -1092,8 +1174,8 @@ err:
 }
 
 /**
- * fc_lport_enter_scr() - Send a State Change Register (SCR) request
- * @lport: Fibre Channel local port to register for state changes
+ * fc_lport_enter_scr() - Send a SCR (State Change Register) request
+ * @lport: The local port to register for state changes
  *
  * Locking Note: The lport lock is expected to be held before calling
  * this routine.
@@ -1114,78 +1196,74 @@ static void fc_lport_enter_scr(struct fc_lport *lport)
 	}
 
 	if (!lport->tt.elsct_send(lport, FC_FID_FCTRL, fp, ELS_SCR,
-				  fc_lport_scr_resp, lport, lport->e_d_tov))
-		fc_lport_error(lport, fp);
+				  fc_lport_scr_resp, lport,
+				  2 * lport->r_a_tov))
+		fc_lport_error(lport, NULL);
 }
 
 /**
- * fc_lport_enter_rft_id() - Register FC4-types with the name server
+ * fc_lport_enter_ns() - register some object with the name server
  * @lport: Fibre Channel local port to register
  *
  * Locking Note: The lport lock is expected to be held before calling
  * this routine.
  */
-static void fc_lport_enter_rft_id(struct fc_lport *lport)
+static void fc_lport_enter_ns(struct fc_lport *lport, enum fc_lport_state state)
 {
 	struct fc_frame *fp;
-	struct fc_ns_fts *lps;
-	int i;
+	enum fc_ns_req cmd;
+	int size = sizeof(struct fc_ct_hdr);
+	size_t len;
 
-	FC_LPORT_DBG(lport, "Entered RFT_ID state from %s state\n",
+	FC_LPORT_DBG(lport, "Entered %s state from %s state\n",
+		     fc_lport_state_names[state],
 		     fc_lport_state(lport));
 
-	fc_lport_state_enter(lport, LPORT_ST_RFT_ID);
+	fc_lport_state_enter(lport, state);
 
-	lps = &lport->fcts;
-	i = sizeof(lps->ff_type_map) / sizeof(lps->ff_type_map[0]);
-	while (--i >= 0)
-		if (ntohl(lps->ff_type_map[i]) != 0)
-			break;
-	if (i < 0) {
-		/* nothing to register, move on to SCR */
-		fc_lport_enter_scr(lport);
-		return;
-	}
-
-	fp = fc_frame_alloc(lport, sizeof(struct fc_ct_hdr) +
-			    sizeof(struct fc_ns_rft));
-	if (!fp) {
-		fc_lport_error(lport, fp);
+	switch (state) {
+	case LPORT_ST_RNN_ID:
+		cmd = FC_NS_RNN_ID;
+		size += sizeof(struct fc_ns_rn_id);
+		break;
+	case LPORT_ST_RSNN_NN:
+		len = strnlen(fc_host_symbolic_name(lport->host), 255);
+		/* if there is no symbolic name, skip to RFT_ID */
+		if (!len)
+			return fc_lport_enter_ns(lport, LPORT_ST_RFT_ID);
+		cmd = FC_NS_RSNN_NN;
+		size += sizeof(struct fc_ns_rsnn) + len;
+		break;
+	case LPORT_ST_RSPN_ID:
+		len = strnlen(fc_host_symbolic_name(lport->host), 255);
+		/* if there is no symbolic name, skip to RFT_ID */
+		if (!len)
+			return fc_lport_enter_ns(lport, LPORT_ST_RFT_ID);
+		cmd = FC_NS_RSPN_ID;
+		size += sizeof(struct fc_ns_rspn) + len;
+		break;
+	case LPORT_ST_RFT_ID:
+		cmd = FC_NS_RFT_ID;
+		size += sizeof(struct fc_ns_rft);
+		break;
+	case LPORT_ST_RFF_ID:
+		cmd = FC_NS_RFF_ID;
+		size += sizeof(struct fc_ns_rff_id);
+		break;
+	default:
+		fc_lport_error(lport, NULL);
 		return;
 	}
 
-	if (!lport->tt.elsct_send(lport, FC_FID_DIR_SERV, fp, FC_NS_RFT_ID,
-				  fc_lport_rft_id_resp,
-				  lport, lport->e_d_tov))
-		fc_lport_error(lport, fp);
-}
-
-/**
- * fc_rport_enter_rft_id() - Register port name with the name server
- * @lport: Fibre Channel local port to register
- *
- * Locking Note: The lport lock is expected to be held before calling
- * this routine.
- */
-static void fc_lport_enter_rpn_id(struct fc_lport *lport)
-{
-	struct fc_frame *fp;
-
-	FC_LPORT_DBG(lport, "Entered RPN_ID state from %s state\n",
-		     fc_lport_state(lport));
-
-	fc_lport_state_enter(lport, LPORT_ST_RPN_ID);
-
-	fp = fc_frame_alloc(lport, sizeof(struct fc_ct_hdr) +
-			    sizeof(struct fc_ns_rn_id));
+	fp = fc_frame_alloc(lport, size);
 	if (!fp) {
 		fc_lport_error(lport, fp);
 		return;
 	}
 
-	if (!lport->tt.elsct_send(lport, FC_FID_DIR_SERV, fp, FC_NS_RPN_ID,
-				  fc_lport_rpn_id_resp,
-				  lport, lport->e_d_tov))
+	if (!lport->tt.elsct_send(lport, FC_FID_DIR_SERV, fp, cmd,
+				  fc_lport_ns_resp,
+				  lport, 3 * lport->r_a_tov))
 		fc_lport_error(lport, fp);
 }
 
@@ -1194,8 +1272,8 @@ static struct fc_rport_operations fc_lport_rport_ops = {
 };
 
 /**
- * fc_rport_enter_dns() - Create a rport to the name server
- * @lport: Fibre Channel local port requesting a rport for the name server
+ * fc_rport_enter_dns() - Create a fc_rport for the name server
+ * @lport: The local port requesting a remote port for the name server
  *
  * Locking Note: The lport lock is expected to be held before calling
  * this routine.
@@ -1224,8 +1302,8 @@ err:
 }
 
 /**
- * fc_lport_timeout() - Handler for the retry_work timer.
- * @work: The work struct of the fc_lport
+ * fc_lport_timeout() - Handler for the retry_work timer
+ * @work: The work struct of the local port
  */
 static void fc_lport_timeout(struct work_struct *work)
 {
@@ -1237,21 +1315,25 @@ static void fc_lport_timeout(struct work_struct *work)
 
 	switch (lport->state) {
 	case LPORT_ST_DISABLED:
+		WARN_ON(1);
+		break;
 	case LPORT_ST_READY:
-	case LPORT_ST_RESET:
 		WARN_ON(1);
 		break;
+	case LPORT_ST_RESET:
+		break;
 	case LPORT_ST_FLOGI:
 		fc_lport_enter_flogi(lport);
 		break;
 	case LPORT_ST_DNS:
 		fc_lport_enter_dns(lport);
 		break;
-	case LPORT_ST_RPN_ID:
-		fc_lport_enter_rpn_id(lport);
-		break;
+	case LPORT_ST_RNN_ID:
+	case LPORT_ST_RSNN_NN:
+	case LPORT_ST_RSPN_ID:
 	case LPORT_ST_RFT_ID:
-		fc_lport_enter_rft_id(lport);
+	case LPORT_ST_RFF_ID:
+		fc_lport_enter_ns(lport, lport->state);
 		break;
 	case LPORT_ST_SCR:
 		fc_lport_enter_scr(lport);
@@ -1266,16 +1348,16 @@ static void fc_lport_timeout(struct work_struct *work)
 
 /**
  * fc_lport_logo_resp() - Handle response to LOGO request
- * @sp: current sequence in LOGO exchange
- * @fp: response frame
- * @lp_arg: Fibre Channel lport port instance that sent the LOGO request
+ * @sp:	    The sequence that the LOGO was on
+ * @fp:	    The LOGO frame
+ * @lp_arg: The lport port that received the LOGO request
  *
  * Locking Note: This function will be called without the lport lock
- * held, but it will lock, call an _enter_* function or fc_lport_error
+ * held, but it will lock, call an _enter_* function or fc_lport_error()
  * and then unlock the lport.
  */
-static void fc_lport_logo_resp(struct fc_seq *sp, struct fc_frame *fp,
-			       void *lp_arg)
+void fc_lport_logo_resp(struct fc_seq *sp, struct fc_frame *fp,
+			void *lp_arg)
 {
 	struct fc_lport *lport = lp_arg;
 	u8 op;
@@ -1311,10 +1393,11 @@ out:
 err:
 	mutex_unlock(&lport->lp_mutex);
 }
+EXPORT_SYMBOL(fc_lport_logo_resp);
 
 /**
  * fc_rport_enter_logo() - Logout of the fabric
- * @lport: Fibre Channel local port to be logged out
+ * @lport: The local port to be logged out
  *
  * Locking Note: The lport lock is expected to be held before calling
  * this routine.
@@ -1328,6 +1411,7 @@ static void fc_lport_enter_logo(struct fc_lport *lport)
 		     fc_lport_state(lport));
 
 	fc_lport_state_enter(lport, LPORT_ST_LOGO);
+	fc_vports_linkchange(lport);
 
 	fp = fc_frame_alloc(lport, sizeof(*logo));
 	if (!fp) {
@@ -1336,22 +1420,23 @@ static void fc_lport_enter_logo(struct fc_lport *lport)
 	}
 
 	if (!lport->tt.elsct_send(lport, FC_FID_FLOGI, fp, ELS_LOGO,
-				  fc_lport_logo_resp, lport, lport->e_d_tov))
-		fc_lport_error(lport, fp);
+				  fc_lport_logo_resp, lport,
+				  2 * lport->r_a_tov))
+		fc_lport_error(lport, NULL);
 }
 
 /**
  * fc_lport_flogi_resp() - Handle response to FLOGI request
- * @sp: current sequence in FLOGI exchange
- * @fp: response frame
- * @lp_arg: Fibre Channel lport port instance that sent the FLOGI request
+ * @sp:	    The sequence that the FLOGI was on
+ * @fp:	    The FLOGI response frame
+ * @lp_arg: The lport port that received the FLOGI response
  *
  * Locking Note: This function will be called without the lport lock
- * held, but it will lock, call an _enter_* function or fc_lport_error
+ * held, but it will lock, call an _enter_* function or fc_lport_error()
  * and then unlock the lport.
  */
-static void fc_lport_flogi_resp(struct fc_seq *sp, struct fc_frame *fp,
-				void *lp_arg)
+void fc_lport_flogi_resp(struct fc_seq *sp, struct fc_frame *fp,
+			 void *lp_arg)
 {
 	struct fc_lport *lport = lp_arg;
 	struct fc_frame_header *fh;
@@ -1385,11 +1470,6 @@ static void fc_lport_flogi_resp(struct fc_seq *sp, struct fc_frame *fp,
 	fh = fc_frame_header_get(fp);
 	did = ntoh24(fh->fh_d_id);
 	if (fc_frame_payload_op(fp) == ELS_LS_ACC && did != 0) {
-
-		printk(KERN_INFO "libfc: Assigned FID (%6x) in FLOGI response\n",
-		       did);
-		fc_host_port_id(lport->host) = did;
-
 		flp = fc_frame_payload_get(fp, sizeof(*flp));
 		if (flp) {
 			mfs = ntohs(flp->fl_csp.sp_bb_data) &
@@ -1402,12 +1482,18 @@ static void fc_lport_flogi_resp(struct fc_seq *sp, struct fc_frame *fp,
 			e_d_tov = ntohl(flp->fl_csp.sp_e_d_tov);
 			if (csp_flags & FC_SP_FT_EDTR)
 				e_d_tov /= 1000000;
+
+			lport->npiv_enabled = !!(csp_flags & FC_SP_FT_NPIV_ACC);
+
 			if ((csp_flags & FC_SP_FT_FPORT) == 0) {
 				if (e_d_tov > lport->e_d_tov)
 					lport->e_d_tov = e_d_tov;
 				lport->r_a_tov = 2 * e_d_tov;
-				printk(KERN_INFO "libfc: Port (%6x) entered "
-				       "point to point mode\n", did);
+				fc_lport_set_port_id(lport, did, fp);
+				printk(KERN_INFO "host%d: libfc: "
+				       "Port (%6x) entered "
+				       "point-to-point mode\n",
+				       lport->host->host_no, did);
 				fc_lport_ptp_setup(lport, ntoh24(fh->fh_s_id),
 						   get_unaligned_be64(
 							   &flp->fl_wwpn),
@@ -1418,6 +1504,7 @@ static void fc_lport_flogi_resp(struct fc_seq *sp, struct fc_frame *fp,
 				lport->r_a_tov = r_a_tov;
 				fc_host_fabric_name(lport->host) =
 					get_unaligned_be64(&flp->fl_wwnn);
+				fc_lport_set_port_id(lport, did, fp);
 				fc_lport_enter_dns(lport);
 			}
 		}
@@ -1430,6 +1517,7 @@ out:
 err:
 	mutex_unlock(&lport->lp_mutex);
 }
+EXPORT_SYMBOL(fc_lport_flogi_resp);
 
 /**
  * fc_rport_enter_flogi() - Send a FLOGI request to the fabric manager
@@ -1451,12 +1539,18 @@ void fc_lport_enter_flogi(struct fc_lport *lport)
 	if (!fp)
 		return fc_lport_error(lport, fp);
 
-	if (!lport->tt.elsct_send(lport, FC_FID_FLOGI, fp, ELS_FLOGI,
-				  fc_lport_flogi_resp, lport, lport->e_d_tov))
-		fc_lport_error(lport, fp);
+	if (!lport->tt.elsct_send(lport, FC_FID_FLOGI, fp,
+				  lport->vport ? ELS_FDISC : ELS_FLOGI,
+				  fc_lport_flogi_resp, lport,
+				  lport->vport ? 2 * lport->r_a_tov :
+				  lport->e_d_tov))
+		fc_lport_error(lport, NULL);
 }
 
-/* Configure a fc_lport */
+/**
+ * fc_lport_config() - Configure a fc_lport
+ * @lport: The local port to be configured
+ */
 int fc_lport_config(struct fc_lport *lport)
 {
 	INIT_DELAYED_WORK(&lport->retry_work, fc_lport_timeout);
@@ -1471,6 +1565,10 @@ int fc_lport_config(struct fc_lport *lport)
 }
 EXPORT_SYMBOL(fc_lport_config);
 
+/**
+ * fc_lport_init() - Initialize the lport layer for a local port
+ * @lport: The local port to initialize the exchange layer for
+ */
 int fc_lport_init(struct fc_lport *lport)
 {
 	if (!lport->tt.lport_recv)
@@ -1500,7 +1598,253 @@ int fc_lport_init(struct fc_lport *lport)
 	if (lport->link_supported_speeds & FC_PORTSPEED_10GBIT)
 		fc_host_supported_speeds(lport->host) |= FC_PORTSPEED_10GBIT;
 
-	INIT_LIST_HEAD(&lport->ema_list);
 	return 0;
 }
 EXPORT_SYMBOL(fc_lport_init);
+
+/**
+ * fc_lport_bsg_resp() - The common response handler for FC Passthrough requests
+ * @sp:	      The sequence for the FC Passthrough response
+ * @fp:	      The response frame
+ * @info_arg: The BSG info that the response is for
+ */
+static void fc_lport_bsg_resp(struct fc_seq *sp, struct fc_frame *fp,
+			      void *info_arg)
+{
+	struct fc_bsg_info *info = info_arg;
+	struct fc_bsg_job *job = info->job;
+	struct fc_lport *lport = info->lport;
+	struct fc_frame_header *fh;
+	size_t len;
+	void *buf;
+
+	if (IS_ERR(fp)) {
+		job->reply->result = (PTR_ERR(fp) == -FC_EX_CLOSED) ?
+			-ECONNABORTED : -ETIMEDOUT;
+		job->reply_len = sizeof(uint32_t);
+		job->state_flags |= FC_RQST_STATE_DONE;
+		job->job_done(job);
+		kfree(info);
+		return;
+	}
+
+	mutex_lock(&lport->lp_mutex);
+	fh = fc_frame_header_get(fp);
+	len = fr_len(fp) - sizeof(*fh);
+	buf = fc_frame_payload_get(fp, 0);
+
+	if (fr_sof(fp) == FC_SOF_I3 && !ntohs(fh->fh_seq_cnt)) {
+		/* Get the response code from the first frame payload */
+		unsigned short cmd = (info->rsp_code == FC_FS_ACC) ?
+			ntohs(((struct fc_ct_hdr *)buf)->ct_cmd) :
+			(unsigned short)fc_frame_payload_op(fp);
+
+		/* Save the reply status of the job */
+		job->reply->reply_data.ctels_reply.status =
+			(cmd == info->rsp_code) ?
+			FC_CTELS_STATUS_OK : FC_CTELS_STATUS_REJECT;
+	}
+
+	job->reply->reply_payload_rcv_len +=
+		fc_copy_buffer_to_sglist(buf, len, info->sg, &info->nents,
+					 &info->offset, KM_BIO_SRC_IRQ, NULL);
+
+	if (fr_eof(fp) == FC_EOF_T &&
+	    (ntoh24(fh->fh_f_ctl) & (FC_FC_LAST_SEQ | FC_FC_END_SEQ)) ==
+	    (FC_FC_LAST_SEQ | FC_FC_END_SEQ)) {
+		if (job->reply->reply_payload_rcv_len >
+		    job->reply_payload.payload_len)
+			job->reply->reply_payload_rcv_len =
+				job->reply_payload.payload_len;
+		job->reply->result = 0;
+		job->state_flags |= FC_RQST_STATE_DONE;
+		job->job_done(job);
+		kfree(info);
+	}
+	fc_frame_free(fp);
+	mutex_unlock(&lport->lp_mutex);
+}
+
+/**
+ * fc_lport_els_request() - Send ELS passthrough request
+ * @job:   The BSG Passthrough job
+ * @lport: The local port sending the request
+ * @did:   The destination port id
+ *
+ * Locking Note: The lport lock is expected to be held before calling
+ * this routine.
+ */
+static int fc_lport_els_request(struct fc_bsg_job *job,
+				struct fc_lport *lport,
+				u32 did, u32 tov)
+{
+	struct fc_bsg_info *info;
+	struct fc_frame *fp;
+	struct fc_frame_header *fh;
+	char *pp;
+	int len;
+
+	fp = fc_frame_alloc(lport, job->request_payload.payload_len);
+	if (!fp)
+		return -ENOMEM;
+
+	len = job->request_payload.payload_len;
+	pp = fc_frame_payload_get(fp, len);
+
+	sg_copy_to_buffer(job->request_payload.sg_list,
+			  job->request_payload.sg_cnt,
+			  pp, len);
+
+	fh = fc_frame_header_get(fp);
+	fh->fh_r_ctl = FC_RCTL_ELS_REQ;
+	hton24(fh->fh_d_id, did);
+	hton24(fh->fh_s_id, fc_host_port_id(lport->host));
+	fh->fh_type = FC_TYPE_ELS;
+	hton24(fh->fh_f_ctl, FC_FC_FIRST_SEQ |
+	       FC_FC_END_SEQ | FC_FC_SEQ_INIT);
+	fh->fh_cs_ctl = 0;
+	fh->fh_df_ctl = 0;
+	fh->fh_parm_offset = 0;
+
+	info = kzalloc(sizeof(struct fc_bsg_info), GFP_KERNEL);
+	if (!info) {
+		fc_frame_free(fp);
+		return -ENOMEM;
+	}
+
+	info->job = job;
+	info->lport = lport;
+	info->rsp_code = ELS_LS_ACC;
+	info->nents = job->reply_payload.sg_cnt;
+	info->sg = job->reply_payload.sg_list;
+
+	if (!lport->tt.exch_seq_send(lport, fp, fc_lport_bsg_resp,
+				     NULL, info, tov))
+		return -ECOMM;
+	return 0;
+}
+
+/**
+ * fc_lport_ct_request() - Send CT Passthrough request
+ * @job:   The BSG Passthrough job
+ * @lport: The local port sending the request
+ * @did:   The destination FC-ID
+ * @tov:   The timeout period to wait for the response
+ *
+ * Locking Note: The lport lock is expected to be held before calling
+ * this routine.
+ */
+static int fc_lport_ct_request(struct fc_bsg_job *job,
+			       struct fc_lport *lport, u32 did, u32 tov)
+{
+	struct fc_bsg_info *info;
+	struct fc_frame *fp;
+	struct fc_frame_header *fh;
+	struct fc_ct_req *ct;
+	size_t len;
+
+	fp = fc_frame_alloc(lport, sizeof(struct fc_ct_hdr) +
+			    job->request_payload.payload_len);
+	if (!fp)
+		return -ENOMEM;
+
+	len = job->request_payload.payload_len;
+	ct = fc_frame_payload_get(fp, len);
+
+	sg_copy_to_buffer(job->request_payload.sg_list,
+			  job->request_payload.sg_cnt,
+			  ct, len);
+
+	fh = fc_frame_header_get(fp);
+	fh->fh_r_ctl = FC_RCTL_DD_UNSOL_CTL;
+	hton24(fh->fh_d_id, did);
+	hton24(fh->fh_s_id, fc_host_port_id(lport->host));
+	fh->fh_type = FC_TYPE_CT;
+	hton24(fh->fh_f_ctl, FC_FC_FIRST_SEQ |
+	       FC_FC_END_SEQ | FC_FC_SEQ_INIT);
+	fh->fh_cs_ctl = 0;
+	fh->fh_df_ctl = 0;
+	fh->fh_parm_offset = 0;
+
+	info = kzalloc(sizeof(struct fc_bsg_info), GFP_KERNEL);
+	if (!info) {
+		fc_frame_free(fp);
+		return -ENOMEM;
+	}
+
+	info->job = job;
+	info->lport = lport;
+	info->rsp_code = FC_FS_ACC;
+	info->nents = job->reply_payload.sg_cnt;
+	info->sg = job->reply_payload.sg_list;
+
+	if (!lport->tt.exch_seq_send(lport, fp, fc_lport_bsg_resp,
+				     NULL, info, tov))
+		return -ECOMM;
+	return 0;
+}
+
+/**
+ * fc_lport_bsg_request() - The common entry point for sending
+ *			    FC Passthrough requests
+ * @job: The BSG passthrough job
+ */
+int fc_lport_bsg_request(struct fc_bsg_job *job)
+{
+	struct request *rsp = job->req->next_rq;
+	struct Scsi_Host *shost = job->shost;
+	struct fc_lport *lport = shost_priv(shost);
+	struct fc_rport *rport;
+	struct fc_rport_priv *rdata;
+	int rc = -EINVAL;
+	u32 did;
+
+	job->reply->reply_payload_rcv_len = 0;
+	rsp->resid_len = job->reply_payload.payload_len;
+
+	mutex_lock(&lport->lp_mutex);
+
+	switch (job->request->msgcode) {
+	case FC_BSG_RPT_ELS:
+		rport = job->rport;
+		if (!rport)
+			break;
+
+		rdata = rport->dd_data;
+		rc = fc_lport_els_request(job, lport, rport->port_id,
+					  rdata->e_d_tov);
+		break;
+
+	case FC_BSG_RPT_CT:
+		rport = job->rport;
+		if (!rport)
+			break;
+
+		rdata = rport->dd_data;
+		rc = fc_lport_ct_request(job, lport, rport->port_id,
+					 rdata->e_d_tov);
+		break;
+
+	case FC_BSG_HST_CT:
+		did = ntoh24(job->request->rqst_data.h_ct.port_id);
+		if (did == FC_FID_DIR_SERV)
+			rdata = lport->dns_rdata;
+		else
+			rdata = lport->tt.rport_lookup(lport, did);
+
+		if (!rdata)
+			break;
+
+		rc = fc_lport_ct_request(job, lport, did, rdata->e_d_tov);
+		break;
+
+	case FC_BSG_HST_ELS_NOLOGIN:
+		did = ntoh24(job->request->rqst_data.h_els.port_id);
+		rc = fc_lport_els_request(job, lport, did, lport->e_d_tov);
+		break;
+	}
+
+	mutex_unlock(&lport->lp_mutex);
+	return rc;
+}
+EXPORT_SYMBOL(fc_lport_bsg_request);
diff --git a/drivers/scsi/libfc/fc_npiv.c b/drivers/scsi/libfc/fc_npiv.c
new file mode 100644
index 000000000000..c68f6c7341c2
--- /dev/null
+++ b/drivers/scsi/libfc/fc_npiv.c
@@ -0,0 +1,161 @@
+/*
+ * Copyright(c) 2009 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Maintained at www.Open-FCoE.org
+ */
+
+/*
+ * NPIV VN_Port helper functions for libfc
+ */
+
+#include <scsi/libfc.h>
+
+/**
+ * fc_vport_create() - Create a new NPIV vport instance
+ * @vport: fc_vport structure from scsi_transport_fc
+ * @privsize: driver private data size to allocate along with the Scsi_Host
+ */
+
+struct fc_lport *libfc_vport_create(struct fc_vport *vport, int privsize)
+{
+	struct Scsi_Host *shost = vport_to_shost(vport);
+	struct fc_lport *n_port = shost_priv(shost);
+	struct fc_lport *vn_port;
+
+	vn_port = libfc_host_alloc(shost->hostt, privsize);
+	if (!vn_port)
+		goto err_out;
+	if (fc_exch_mgr_list_clone(n_port, vn_port))
+		goto err_put;
+
+	vn_port->vport = vport;
+	vport->dd_data = vn_port;
+
+	mutex_lock(&n_port->lp_mutex);
+	list_add_tail(&vn_port->list, &n_port->vports);
+	mutex_unlock(&n_port->lp_mutex);
+
+	return vn_port;
+
+err_put:
+	scsi_host_put(vn_port->host);
+err_out:
+	return NULL;
+}
+EXPORT_SYMBOL(libfc_vport_create);
+
+/**
+ * fc_vport_id_lookup() - find NPIV lport that matches a given fabric ID
+ * @n_port: Top level N_Port which may have multiple NPIV VN_Ports
+ * @port_id: Fabric ID to find a match for
+ *
+ * Returns: matching lport pointer or NULL if there is no match
+ */
+struct fc_lport *fc_vport_id_lookup(struct fc_lport *n_port, u32 port_id)
+{
+	struct fc_lport *lport = NULL;
+	struct fc_lport *vn_port;
+
+	if (fc_host_port_id(n_port->host) == port_id)
+		return n_port;
+
+	mutex_lock(&n_port->lp_mutex);
+	list_for_each_entry(vn_port, &n_port->vports, list) {
+		if (fc_host_port_id(vn_port->host) == port_id) {
+			lport = vn_port;
+			break;
+		}
+	}
+	mutex_unlock(&n_port->lp_mutex);
+
+	return lport;
+}
+
+/*
+ * When setting the link state of vports during an lport state change, it's
+ * necessary to hold the lp_mutex of both the N_Port and the VN_Port.
+ * This tells the lockdep engine to treat the nested locking of the VN_Port
+ * as a different lock class.
+ */
+enum libfc_lport_mutex_class {
+	LPORT_MUTEX_NORMAL = 0,
+	LPORT_MUTEX_VN_PORT = 1,
+};
+
+/**
+ * __fc_vport_setlink() - update link and status on a VN_Port
+ * @n_port: parent N_Port
+ * @vn_port: VN_Port to update
+ *
+ * Locking: must be called with both the N_Port and VN_Port lp_mutex held
+ */
+static void __fc_vport_setlink(struct fc_lport *n_port,
+			       struct fc_lport *vn_port)
+{
+	struct fc_vport *vport = vn_port->vport;
+
+	if (vn_port->state == LPORT_ST_DISABLED)
+		return;
+
+	if (n_port->state == LPORT_ST_READY) {
+		if (n_port->npiv_enabled) {
+			fc_vport_set_state(vport, FC_VPORT_INITIALIZING);
+			__fc_linkup(vn_port);
+		} else {
+			fc_vport_set_state(vport, FC_VPORT_NO_FABRIC_SUPP);
+			__fc_linkdown(vn_port);
+		}
+	} else {
+		fc_vport_set_state(vport, FC_VPORT_LINKDOWN);
+		__fc_linkdown(vn_port);
+	}
+}
+
+/**
+ * fc_vport_setlink() - update link and status on a VN_Port
+ * @vn_port: virtual port to update
+ */
+void fc_vport_setlink(struct fc_lport *vn_port)
+{
+	struct fc_vport *vport = vn_port->vport;
+	struct Scsi_Host *shost = vport_to_shost(vport);
+	struct fc_lport *n_port = shost_priv(shost);
+
+	mutex_lock(&n_port->lp_mutex);
+	mutex_lock_nested(&vn_port->lp_mutex, LPORT_MUTEX_VN_PORT);
+	__fc_vport_setlink(n_port, vn_port);
+	mutex_unlock(&vn_port->lp_mutex);
+	mutex_unlock(&n_port->lp_mutex);
+}
+EXPORT_SYMBOL(fc_vport_setlink);
+
+/**
+ * fc_vports_linkchange() - change the link state of all vports
+ * @n_port: Parent N_Port that has changed state
+ *
+ * Locking: called with the n_port lp_mutex held
+ */
+void fc_vports_linkchange(struct fc_lport *n_port)
+{
+	struct fc_lport *vn_port;
+
+	list_for_each_entry(vn_port, &n_port->vports, list) {
+		mutex_lock_nested(&vn_port->lp_mutex, LPORT_MUTEX_VN_PORT);
+		__fc_vport_setlink(n_port, vn_port);
+		mutex_unlock(&vn_port->lp_mutex);
+	}
+}
+
diff --git a/drivers/scsi/libfc/fc_rport.c b/drivers/scsi/libfc/fc_rport.c
index 03ea6748e7ee..02300523b234 100644
--- a/drivers/scsi/libfc/fc_rport.c
+++ b/drivers/scsi/libfc/fc_rport.c
@@ -55,6 +55,8 @@
 #include <scsi/libfc.h>
 #include <scsi/fc_encode.h>
 
+#include "fc_libfc.h"
+
 struct workqueue_struct *rport_event_queue;
 
 static void fc_rport_enter_plogi(struct fc_rport_priv *);
@@ -86,12 +88,13 @@ static const char *fc_rport_state_names[] = {
 	[RPORT_ST_LOGO] = "LOGO",
 	[RPORT_ST_ADISC] = "ADISC",
 	[RPORT_ST_DELETE] = "Delete",
+	[RPORT_ST_RESTART] = "Restart",
 };
 
 /**
- * fc_rport_lookup() - lookup a remote port by port_id
- * @lport: Fibre Channel host port instance
- * @port_id: remote port port_id to match
+ * fc_rport_lookup() - Lookup a remote port by port_id
+ * @lport:   The local port to lookup the remote port on
+ * @port_id: The remote port ID to look up
  */
 static struct fc_rport_priv *fc_rport_lookup(const struct fc_lport *lport,
 					     u32 port_id)
@@ -99,16 +102,17 @@ static struct fc_rport_priv *fc_rport_lookup(const struct fc_lport *lport,
 	struct fc_rport_priv *rdata;
 
 	list_for_each_entry(rdata, &lport->disc.rports, peers)
-		if (rdata->ids.port_id == port_id &&
-		    rdata->rp_state != RPORT_ST_DELETE)
+		if (rdata->ids.port_id == port_id)
 			return rdata;
 	return NULL;
 }
 
 /**
  * fc_rport_create() - Create a new remote port
- * @lport:   The local port that the new remote port is for
- * @port_id: The port ID for the new remote port
+ * @lport: The local port this remote port will be associated with
+ * @ids:   The identifiers for the new remote port
+ *
+ * The remote port will start in the INIT state.
  *
  * Locking note:  must be called with the disc_mutex held.
  */
@@ -147,8 +151,8 @@ static struct fc_rport_priv *fc_rport_create(struct fc_lport *lport,
 }
 
 /**
- * fc_rport_destroy() - free a remote port after last reference is released.
- * @kref: pointer to kref inside struct fc_rport_priv
+ * fc_rport_destroy() - Free a remote port after last reference is released
+ * @kref: The remote port's kref
  */
 static void fc_rport_destroy(struct kref *kref)
 {
@@ -159,8 +163,8 @@ static void fc_rport_destroy(struct kref *kref)
 }
 
 /**
- * fc_rport_state() - return a string for the state the rport is in
- * @rdata: remote port private data
+ * fc_rport_state() - Return a string identifying the remote port's state
+ * @rdata: The remote port
  */
 static const char *fc_rport_state(struct fc_rport_priv *rdata)
 {
@@ -173,9 +177,9 @@ static const char *fc_rport_state(struct fc_rport_priv *rdata)
 }
 
 /**
- * fc_set_rport_loss_tmo() - Set the remote port loss timeout in seconds.
- * @rport: Pointer to Fibre Channel remote port structure
- * @timeout: timeout in seconds
+ * fc_set_rport_loss_tmo() - Set the remote port loss timeout
+ * @rport:   The remote port that gets a new timeout value
+ * @timeout: The new timeout value (in seconds)
  */
 void fc_set_rport_loss_tmo(struct fc_rport *rport, u32 timeout)
 {
@@ -187,9 +191,11 @@ void fc_set_rport_loss_tmo(struct fc_rport *rport, u32 timeout)
 EXPORT_SYMBOL(fc_set_rport_loss_tmo);
 
 /**
- * fc_plogi_get_maxframe() - Get max payload from the common service parameters
- * @flp: FLOGI payload structure
- * @maxval: upper limit, may be less than what is in the service parameters
+ * fc_plogi_get_maxframe() - Get the maximum payload from the common service
+ *			     parameters in a FLOGI frame
+ * @flp:    The FLOGI payload
+ * @maxval: The maximum frame size upper limit; this may be less than what
+ *	    is in the service parameters
  */
 static unsigned int fc_plogi_get_maxframe(struct fc_els_flogi *flp,
 					  unsigned int maxval)
@@ -210,9 +216,9 @@ static unsigned int fc_plogi_get_maxframe(struct fc_els_flogi *flp,
 }
 
 /**
- * fc_rport_state_enter() - Change the rport's state
- * @rdata: The rport whose state should change
- * @new: The new state of the rport
+ * fc_rport_state_enter() - Change the state of a remote port
+ * @rdata: The remote port whose state should change
+ * @new:   The new state
  *
  * Locking Note: Called with the rport lock held
  */
@@ -224,17 +230,22 @@ static void fc_rport_state_enter(struct fc_rport_priv *rdata,
 	rdata->rp_state = new;
 }
 
+/**
+ * fc_rport_work() - Handler for remote port events in the rport_event_queue
+ * @work: Handle to the remote port being dequeued
+ */
 static void fc_rport_work(struct work_struct *work)
 {
 	u32 port_id;
 	struct fc_rport_priv *rdata =
 		container_of(work, struct fc_rport_priv, event_work);
-	struct fc_rport_libfc_priv *rp;
+	struct fc_rport_libfc_priv *rpriv;
 	enum fc_rport_event event;
 	struct fc_lport *lport = rdata->local_port;
 	struct fc_rport_operations *rport_ops;
 	struct fc_rport_identifiers ids;
 	struct fc_rport *rport;
+	int restart = 0;
 
 	mutex_lock(&rdata->rp_mutex);
 	event = rdata->event;
@@ -265,12 +276,12 @@ static void fc_rport_work(struct work_struct *work)
 		rport->maxframe_size = rdata->maxframe_size;
 		rport->supported_classes = rdata->supported_classes;
 
-		rp = rport->dd_data;
-		rp->local_port = lport;
-		rp->rp_state = rdata->rp_state;
-		rp->flags = rdata->flags;
-		rp->e_d_tov = rdata->e_d_tov;
-		rp->r_a_tov = rdata->r_a_tov;
+		rpriv = rport->dd_data;
+		rpriv->local_port = lport;
+		rpriv->rp_state = rdata->rp_state;
+		rpriv->flags = rdata->flags;
+		rpriv->e_d_tov = rdata->e_d_tov;
+		rpriv->r_a_tov = rdata->r_a_tov;
 		mutex_unlock(&rdata->rp_mutex);
 
 		if (rport_ops && rport_ops->event_callback) {
@@ -287,8 +298,20 @@ static void fc_rport_work(struct work_struct *work)
 		mutex_unlock(&rdata->rp_mutex);
 
 		if (port_id != FC_FID_DIR_SERV) {
+			/*
+			 * We must drop rp_mutex before taking disc_mutex.
+			 * Re-evaluate state to allow for restart.
+			 * A transition to RESTART state must only happen
+			 * while disc_mutex is held and rdata is on the list.
+			 */
 			mutex_lock(&lport->disc.disc_mutex);
-			list_del(&rdata->peers);
+			mutex_lock(&rdata->rp_mutex);
+			if (rdata->rp_state == RPORT_ST_RESTART)
+				restart = 1;
+			else
+				list_del(&rdata->peers);
+			rdata->event = RPORT_EV_NONE;
+			mutex_unlock(&rdata->rp_mutex);
 			mutex_unlock(&lport->disc.disc_mutex);
 		}
 
@@ -305,14 +328,20 @@ static void fc_rport_work(struct work_struct *work)
 		lport->tt.exch_mgr_reset(lport, port_id, 0);
 
 		if (rport) {
-			rp = rport->dd_data;
-			rp->rp_state = RPORT_ST_DELETE;
+			rpriv = rport->dd_data;
+			rpriv->rp_state = RPORT_ST_DELETE;
 			mutex_lock(&rdata->rp_mutex);
 			rdata->rport = NULL;
 			mutex_unlock(&rdata->rp_mutex);
 			fc_remote_port_delete(rport);
 		}
-		kref_put(&rdata->kref, lport->tt.rport_destroy);
+		if (restart) {
+			mutex_lock(&rdata->rp_mutex);
+			FC_RPORT_DBG(rdata, "work restart\n");
+			fc_rport_enter_plogi(rdata);
+			mutex_unlock(&rdata->rp_mutex);
+		} else
+			kref_put(&rdata->kref, lport->tt.rport_destroy);
 		break;
 
 	default:
@@ -323,7 +352,7 @@ static void fc_rport_work(struct work_struct *work)
 
 /**
  * fc_rport_login() - Start the remote port login state machine
- * @rdata: private remote port
+ * @rdata: The remote port to be logged in to
  *
  * Locking Note: Called without the rport lock held. This
  * function will hold the rport lock, call an _enter_*
@@ -342,6 +371,12 @@ int fc_rport_login(struct fc_rport_priv *rdata)
 		FC_RPORT_DBG(rdata, "ADISC port\n");
 		fc_rport_enter_adisc(rdata);
 		break;
+	case RPORT_ST_RESTART:
+		break;
+	case RPORT_ST_DELETE:
+		FC_RPORT_DBG(rdata, "Restart deleted port\n");
+		fc_rport_state_enter(rdata, RPORT_ST_RESTART);
+		break;
 	default:
 		FC_RPORT_DBG(rdata, "Login to port\n");
 		fc_rport_enter_plogi(rdata);
@@ -353,9 +388,9 @@ int fc_rport_login(struct fc_rport_priv *rdata)
 }
 
 /**
- * fc_rport_enter_delete() - schedule a remote port to be deleted.
- * @rdata: private remote port
- * @event: event to report as the reason for deletion
+ * fc_rport_enter_delete() - Schedule a remote port to be deleted
+ * @rdata: The remote port to be deleted
+ * @event: The event to report as the reason for deletion
  *
  * Locking Note: Called with the rport lock held.
  *
@@ -382,8 +417,8 @@ static void fc_rport_enter_delete(struct fc_rport_priv *rdata,
 }
 
 /**
- * fc_rport_logoff() - Logoff and remove an rport
- * @rdata: private remote port
+ * fc_rport_logoff() - Logoff and remove a remote port
+ * @rdata: The remote port to be logged off of
  *
  * Locking Note: Called without the rport lock held. This
  * function will hold the rport lock, call an _enter_*
@@ -397,26 +432,27 @@ int fc_rport_logoff(struct fc_rport_priv *rdata)
 
 	if (rdata->rp_state == RPORT_ST_DELETE) {
 		FC_RPORT_DBG(rdata, "Port in Delete state, not removing\n");
-		mutex_unlock(&rdata->rp_mutex);
 		goto out;
 	}
 
-	fc_rport_enter_logo(rdata);
+	if (rdata->rp_state == RPORT_ST_RESTART)
+		FC_RPORT_DBG(rdata, "Port in Restart state, deleting\n");
+	else
+		fc_rport_enter_logo(rdata);
 
 	/*
 	 * Change the state to Delete so that we discard
 	 * the response.
 	 */
 	fc_rport_enter_delete(rdata, RPORT_EV_STOP);
-	mutex_unlock(&rdata->rp_mutex);
-
 out:
+	mutex_unlock(&rdata->rp_mutex);
 	return 0;
 }
 
 /**
- * fc_rport_enter_ready() - The rport is ready
- * @rdata: private remote port
+ * fc_rport_enter_ready() - Transition to the RPORT_ST_READY state
+ * @rdata: The remote port that is ready
  *
  * Locking Note: The rport lock is expected to be held before calling
  * this routine.
@@ -433,8 +469,8 @@ static void fc_rport_enter_ready(struct fc_rport_priv *rdata)
 }
 
 /**
- * fc_rport_timeout() - Handler for the retry_work timer.
- * @work: The work struct of the fc_rport_priv
+ * fc_rport_timeout() - Handler for the retry_work timer
+ * @work: Handle to the remote port that has timed out
  *
  * Locking Note: Called without the rport lock held. This
  * function will hold the rport lock, call an _enter_*
@@ -466,6 +502,7 @@ static void fc_rport_timeout(struct work_struct *work)
 	case RPORT_ST_READY:
 	case RPORT_ST_INIT:
 	case RPORT_ST_DELETE:
+	case RPORT_ST_RESTART:
 		break;
 	}
 
@@ -474,8 +511,8 @@ static void fc_rport_timeout(struct work_struct *work)
 
 /**
  * fc_rport_error() - Error handler, called once retries have been exhausted
- * @rdata: private remote port
- * @fp: The frame pointer
+ * @rdata: The remote port the error is happened on
+ * @fp:	   The error code encapsulated in a frame pointer
  *
  * Locking Note: The rport lock is expected to be held before
  * calling this routine
@@ -499,6 +536,7 @@ static void fc_rport_error(struct fc_rport_priv *rdata, struct fc_frame *fp)
 		fc_rport_enter_logo(rdata);
 		break;
 	case RPORT_ST_DELETE:
+	case RPORT_ST_RESTART:
 	case RPORT_ST_READY:
 	case RPORT_ST_INIT:
 		break;
@@ -506,9 +544,9 @@ static void fc_rport_error(struct fc_rport_priv *rdata, struct fc_frame *fp)
 }
 
 /**
- * fc_rport_error_retry() - Error handler when retries are desired
- * @rdata: private remote port data
- * @fp: The frame pointer
+ * fc_rport_error_retry() - Handler for remote port state retries
+ * @rdata: The remote port whose state is to be retried
+ * @fp:	   The error code encapsulated in a frame pointer
  *
  * If the error was an exchange timeout retry immediately,
  * otherwise wait for E_D_TOV.
@@ -540,10 +578,10 @@ static void fc_rport_error_retry(struct fc_rport_priv *rdata,
 }
 
 /**
- * fc_rport_plogi_recv_resp() - Handle incoming ELS PLOGI response
- * @sp: current sequence in the PLOGI exchange
- * @fp: response frame
- * @rdata_arg: private remote port data
+ * fc_rport_plogi_recv_resp() - Handler for ELS PLOGI responses
+ * @sp:	       The sequence the PLOGI is on
+ * @fp:	       The PLOGI response frame
+ * @rdata_arg: The remote port that sent the PLOGI response
  *
  * Locking Note: This function will be called without the rport lock
  * held, but it will lock, call an _enter_* function or fc_rport_error
@@ -606,8 +644,8 @@ err:
 }
 
 /**
- * fc_rport_enter_plogi() - Send Port Login (PLOGI) request to peer
- * @rdata: private remote port data
+ * fc_rport_enter_plogi() - Send Port Login (PLOGI) request
+ * @rdata: The remote port to send a PLOGI to
  *
  * Locking Note: The rport lock is expected to be held before calling
  * this routine.
@@ -631,17 +669,18 @@ static void fc_rport_enter_plogi(struct fc_rport_priv *rdata)
 	rdata->e_d_tov = lport->e_d_tov;
 
 	if (!lport->tt.elsct_send(lport, rdata->ids.port_id, fp, ELS_PLOGI,
-				  fc_rport_plogi_resp, rdata, lport->e_d_tov))
-		fc_rport_error_retry(rdata, fp);
+				  fc_rport_plogi_resp, rdata,
+				  2 * lport->r_a_tov))
+		fc_rport_error_retry(rdata, NULL);
 	else
 		kref_get(&rdata->kref);
 }
 
 /**
  * fc_rport_prli_resp() - Process Login (PRLI) response handler
- * @sp: current sequence in the PRLI exchange
- * @fp: response frame
- * @rdata_arg: private remote port data
+ * @sp:	       The sequence the PRLI response was on
+ * @fp:	       The PRLI response frame
+ * @rdata_arg: The remote port that sent the PRLI response
  *
  * Locking Note: This function will be called without the rport lock
  * held, but it will lock, call an _enter_* function or fc_rport_error
@@ -710,10 +749,10 @@ err:
 }
 
 /**
- * fc_rport_logo_resp() - Logout (LOGO) response handler
- * @sp: current sequence in the LOGO exchange
- * @fp: response frame
- * @rdata_arg: private remote port data
+ * fc_rport_logo_resp() - Handler for logout (LOGO) responses
+ * @sp:	       The sequence the LOGO was on
+ * @fp:	       The LOGO response frame
+ * @rdata_arg: The remote port that sent the LOGO response
  *
  * Locking Note: This function will be called without the rport lock
  * held, but it will lock, call an _enter_* function or fc_rport_error
@@ -756,8 +795,8 @@ err:
 }
 
 /**
- * fc_rport_enter_prli() - Send Process Login (PRLI) request to peer
- * @rdata: private remote port data
+ * fc_rport_enter_prli() - Send Process Login (PRLI) request
+ * @rdata: The remote port to send the PRLI request to
  *
  * Locking Note: The rport lock is expected to be held before calling
  * this routine.
@@ -792,17 +831,18 @@ static void fc_rport_enter_prli(struct fc_rport_priv *rdata)
 	}
 
 	if (!lport->tt.elsct_send(lport, rdata->ids.port_id, fp, ELS_PRLI,
-				  fc_rport_prli_resp, rdata, lport->e_d_tov))
-		fc_rport_error_retry(rdata, fp);
+				  fc_rport_prli_resp, rdata,
+				  2 * lport->r_a_tov))
+		fc_rport_error_retry(rdata, NULL);
 	else
 		kref_get(&rdata->kref);
 }
 
 /**
- * fc_rport_els_rtv_resp() - Request Timeout Value response handler
- * @sp: current sequence in the RTV exchange
- * @fp: response frame
- * @rdata_arg: private remote port data
+ * fc_rport_els_rtv_resp() - Handler for Request Timeout Value (RTV) responses
+ * @sp:	       The sequence the RTV was on
+ * @fp:	       The RTV response frame
+ * @rdata_arg: The remote port that sent the RTV response
  *
  * Many targets don't seem to support this.
  *
@@ -865,8 +905,8 @@ err:
 }
 
 /**
- * fc_rport_enter_rtv() - Send Request Timeout Value (RTV) request to peer
- * @rdata: private remote port data
+ * fc_rport_enter_rtv() - Send Request Timeout Value (RTV) request
+ * @rdata: The remote port to send the RTV request to
  *
  * Locking Note: The rport lock is expected to be held before calling
  * this routine.
@@ -888,15 +928,16 @@ static void fc_rport_enter_rtv(struct fc_rport_priv *rdata)
 	}
 
 	if (!lport->tt.elsct_send(lport, rdata->ids.port_id, fp, ELS_RTV,
-				     fc_rport_rtv_resp, rdata, lport->e_d_tov))
-		fc_rport_error_retry(rdata, fp);
+				  fc_rport_rtv_resp, rdata,
+				  2 * lport->r_a_tov))
+		fc_rport_error_retry(rdata, NULL);
 	else
 		kref_get(&rdata->kref);
 }
 
 /**
- * fc_rport_enter_logo() - Send Logout (LOGO) request to peer
- * @rdata: private remote port data
+ * fc_rport_enter_logo() - Send a logout (LOGO) request
+ * @rdata: The remote port to send the LOGO request to
  *
  * Locking Note: The rport lock is expected to be held before calling
  * this routine.
@@ -918,24 +959,25 @@ static void fc_rport_enter_logo(struct fc_rport_priv *rdata)
 	}
 
 	if (!lport->tt.elsct_send(lport, rdata->ids.port_id, fp, ELS_LOGO,
-				  fc_rport_logo_resp, rdata, lport->e_d_tov))
-		fc_rport_error_retry(rdata, fp);
+				  fc_rport_logo_resp, rdata,
+				  2 * lport->r_a_tov))
+		fc_rport_error_retry(rdata, NULL);
 	else
 		kref_get(&rdata->kref);
 }
 
 /**
- * fc_rport_els_adisc_resp() - Address Discovery response handler
- * @sp: current sequence in the ADISC exchange
- * @fp: response frame
- * @rdata_arg: remote port private.
+ * fc_rport_els_adisc_resp() - Handler for Address Discovery (ADISC) responses
+ * @sp:	       The sequence the ADISC response was on
+ * @fp:	       The ADISC response frame
+ * @rdata_arg: The remote port that sent the ADISC response
  *
  * Locking Note: This function will be called without the rport lock
  * held, but it will lock, call an _enter_* function or fc_rport_error
  * and then unlock the rport.
  */
 static void fc_rport_adisc_resp(struct fc_seq *sp, struct fc_frame *fp,
-			      void *rdata_arg)
+				void *rdata_arg)
 {
 	struct fc_rport_priv *rdata = rdata_arg;
 	struct fc_els_adisc *adisc;
@@ -983,8 +1025,8 @@ err:
 }
 
 /**
- * fc_rport_enter_adisc() - Send Address Discover (ADISC) request to peer
- * @rdata: remote port private data
+ * fc_rport_enter_adisc() - Send Address Discover (ADISC) request
+ * @rdata: The remote port to send the ADISC request to
  *
  * Locking Note: The rport lock is expected to be held before calling
  * this routine.
@@ -1005,17 +1047,18 @@ static void fc_rport_enter_adisc(struct fc_rport_priv *rdata)
 		return;
 	}
 	if (!lport->tt.elsct_send(lport, rdata->ids.port_id, fp, ELS_ADISC,
-				  fc_rport_adisc_resp, rdata, lport->e_d_tov))
-		fc_rport_error_retry(rdata, fp);
+				  fc_rport_adisc_resp, rdata,
+				  2 * lport->r_a_tov))
+		fc_rport_error_retry(rdata, NULL);
 	else
 		kref_get(&rdata->kref);
 }
 
 /**
- * fc_rport_recv_adisc_req() - Handle incoming Address Discovery (ADISC) Request
- * @rdata: remote port private
- * @sp: current sequence in the ADISC exchange
- * @in_fp: ADISC request frame
+ * fc_rport_recv_adisc_req() - Handler for Address Discovery (ADISC) requests
+ * @rdata: The remote port that sent the ADISC request
+ * @sp:	   The sequence the ADISC request was on
+ * @in_fp: The ADISC request frame
  *
  * Locking Note:  Called with the lport and rport locks held.
  */
@@ -1056,10 +1099,82 @@ drop:
 }
 
 /**
- * fc_rport_recv_els_req() - handle a validated ELS request.
- * @lport: Fibre Channel local port
- * @sp: current sequence in the PLOGI exchange
- * @fp: response frame
+ * fc_rport_recv_rls_req() - Handle received Read Link Status request
+ * @rdata: The remote port that sent the RLS request
+ * @sp:	The sequence that the RLS was on
+ * @rx_fp: The PRLI request frame
+ *
+ * Locking Note: The rport lock is expected to be held before calling
+ * this function.
+ */
+static void fc_rport_recv_rls_req(struct fc_rport_priv *rdata,
+				  struct fc_seq *sp, struct fc_frame *rx_fp)
+
+{
+	struct fc_lport *lport = rdata->local_port;
+	struct fc_frame *fp;
+	struct fc_exch *ep = fc_seq_exch(sp);
+	struct fc_els_rls *rls;
+	struct fc_els_rls_resp *rsp;
+	struct fc_els_lesb *lesb;
+	struct fc_seq_els_data rjt_data;
+	struct fc_host_statistics *hst;
+	u32 f_ctl;
+
+	FC_RPORT_DBG(rdata, "Received RLS request while in state %s\n",
+		     fc_rport_state(rdata));
+
+	rls = fc_frame_payload_get(rx_fp, sizeof(*rls));
+	if (!rls) {
+		rjt_data.reason = ELS_RJT_PROT;
+		rjt_data.explan = ELS_EXPL_INV_LEN;
+		goto out_rjt;
+	}
+
+	fp = fc_frame_alloc(lport, sizeof(*rsp));
+	if (!fp) {
+		rjt_data.reason = ELS_RJT_UNAB;
+		rjt_data.explan = ELS_EXPL_INSUF_RES;
+		goto out_rjt;
+	}
+
+	rsp = fc_frame_payload_get(fp, sizeof(*rsp));
+	memset(rsp, 0, sizeof(*rsp));
+	rsp->rls_cmd = ELS_LS_ACC;
+	lesb = &rsp->rls_lesb;
+	if (lport->tt.get_lesb) {
+		/* get LESB from LLD if it supports it */
+		lport->tt.get_lesb(lport, lesb);
+	} else {
+		fc_get_host_stats(lport->host);
+		hst = &lport->host_stats;
+		lesb->lesb_link_fail = htonl(hst->link_failure_count);
+		lesb->lesb_sync_loss = htonl(hst->loss_of_sync_count);
+		lesb->lesb_sig_loss = htonl(hst->loss_of_signal_count);
+		lesb->lesb_prim_err = htonl(hst->prim_seq_protocol_err_count);
+		lesb->lesb_inv_word = htonl(hst->invalid_tx_word_count);
+		lesb->lesb_inv_crc = htonl(hst->invalid_crc_count);
+	}
+
+	sp = lport->tt.seq_start_next(sp);
+	f_ctl = FC_FC_EX_CTX | FC_FC_LAST_SEQ | FC_FC_END_SEQ;
+	fc_fill_fc_hdr(fp, FC_RCTL_ELS_REP, ep->did, ep->sid,
+		       FC_TYPE_ELS, f_ctl, 0);
+	lport->tt.seq_send(lport, sp, fp);
+	goto out;
+
+out_rjt:
+	rjt_data.fp = NULL;
+	lport->tt.seq_els_rsp_send(sp, ELS_LS_RJT, &rjt_data);
+out:
+	fc_frame_free(rx_fp);
+}
+
+/**
+ * fc_rport_recv_els_req() - Handler for validated ELS requests
+ * @lport: The local port that received the ELS request
+ * @sp:	   The sequence that the ELS request was on
+ * @fp:	   The ELS request frame
  *
  * Handle incoming ELS requests that require port login.
  * The ELS opcode has already been validated by the caller.
@@ -1117,6 +1232,9 @@ static void fc_rport_recv_els_req(struct fc_lport *lport,
 		els_data.fp = fp;
 		lport->tt.seq_els_rsp_send(sp, ELS_REC, &els_data);
 		break;
+	case ELS_RLS:
+		fc_rport_recv_rls_req(rdata, sp, fp);
+		break;
 	default:
 		fc_frame_free(fp);	/* can't happen */
 		break;
@@ -1131,10 +1249,10 @@ reject:
 }
 
 /**
- * fc_rport_recv_req() - Handle a received ELS request from a rport
- * @sp: current sequence in the PLOGI exchange
- * @fp: response frame
- * @lport: Fibre Channel local port
+ * fc_rport_recv_req() - Handler for requests
+ * @sp:	   The sequence the request was on
+ * @fp:	   The request frame
+ * @lport: The local port that received the request
  *
  * Locking Note: Called with the lport lock held.
  */
@@ -1161,6 +1279,7 @@ void fc_rport_recv_req(struct fc_seq *sp, struct fc_frame *fp,
 	case ELS_ADISC:
 	case ELS_RRQ:
 	case ELS_REC:
+	case ELS_RLS:
 		fc_rport_recv_els_req(lport, sp, fp);
 		break;
 	default:
@@ -1174,10 +1293,10 @@ void fc_rport_recv_req(struct fc_seq *sp, struct fc_frame *fp,
 }
 
 /**
- * fc_rport_recv_plogi_req() - Handle incoming Port Login (PLOGI) request
- * @lport: local port
- * @sp: current sequence in the PLOGI exchange
- * @fp: PLOGI request frame
+ * fc_rport_recv_plogi_req() - Handler for Port Login (PLOGI) requests
+ * @lport: The local port that received the PLOGI request
+ * @sp:	   The sequence that the PLOGI request was on
+ * @rx_fp: The PLOGI request frame
  *
  * Locking Note: The rport lock is held before calling this function.
  */
@@ -1248,6 +1367,7 @@ static void fc_rport_recv_plogi_req(struct fc_lport *lport,
 		}
 		break;
 	case RPORT_ST_PRLI:
+	case RPORT_ST_RTV:
 	case RPORT_ST_READY:
 	case RPORT_ST_ADISC:
 		FC_RPORT_DBG(rdata, "Received PLOGI in logged-in state %d "
@@ -1255,11 +1375,14 @@ static void fc_rport_recv_plogi_req(struct fc_lport *lport,
 		/* XXX TBD - should reset */
 		break;
 	case RPORT_ST_DELETE:
-	default:
-		FC_RPORT_DBG(rdata, "Received PLOGI in unexpected state %d\n",
-			     rdata->rp_state);
-		fc_frame_free(rx_fp);
-		goto out;
+	case RPORT_ST_LOGO:
+	case RPORT_ST_RESTART:
+		FC_RPORT_DBG(rdata, "Received PLOGI in state %s - send busy\n",
+			     fc_rport_state(rdata));
+		mutex_unlock(&rdata->rp_mutex);
+		rjt_data.reason = ELS_RJT_BUSY;
+		rjt_data.explan = ELS_EXPL_NONE;
+		goto reject;
 	}
 
 	/*
@@ -1295,10 +1418,10 @@ reject:
 }
 
 /**
- * fc_rport_recv_prli_req() - Handle incoming Process Login (PRLI) request
- * @rdata: private remote port data
- * @sp: current sequence in the PRLI exchange
- * @fp: PRLI request frame
+ * fc_rport_recv_prli_req() - Handler for process login (PRLI) requests
+ * @rdata: The remote port that sent the PRLI request
+ * @sp:	   The sequence that the PRLI was on
+ * @rx_fp: The PRLI request frame
  *
  * Locking Note: The rport lock is exected to be held before calling
  * this function.
@@ -1402,7 +1525,7 @@ static void fc_rport_recv_prli_req(struct fc_rport_priv *rdata,
 				break;
 			case FC_TYPE_FCP:
 				fcp_parm = ntohl(rspp->spp_params);
-				if (fcp_parm * FCP_SPPF_RETRY)
+				if (fcp_parm & FCP_SPPF_RETRY)
 					rdata->flags |= FC_RP_FLAGS_RETRY;
 				rdata->supported_classes = FC_COS_CLASS3;
 				if (fcp_parm & FCP_SPPF_INIT_FCN)
@@ -1452,10 +1575,10 @@ static void fc_rport_recv_prli_req(struct fc_rport_priv *rdata,
 }
 
 /**
- * fc_rport_recv_prlo_req() - Handle incoming Process Logout (PRLO) request
- * @rdata: private remote port data
- * @sp: current sequence in the PRLO exchange
- * @fp: PRLO request frame
+ * fc_rport_recv_prlo_req() - Handler for process logout (PRLO) requests
+ * @rdata: The remote port that sent the PRLO request
+ * @sp:	   The sequence that the PRLO was on
+ * @fp:	   The PRLO request frame
  *
  * Locking Note: The rport lock is exected to be held before calling
  * this function.
@@ -1482,10 +1605,10 @@ static void fc_rport_recv_prlo_req(struct fc_rport_priv *rdata,
 }
 
 /**
- * fc_rport_recv_logo_req() - Handle incoming Logout (LOGO) request
- * @lport: local port.
- * @sp: current sequence in the LOGO exchange
- * @fp: LOGO request frame
+ * fc_rport_recv_logo_req() - Handler for logout (LOGO) requests
+ * @lport: The local port that received the LOGO request
+ * @sp:	   The sequence that the LOGO request was on
+ * @fp:	   The LOGO request frame
  *
  * Locking Note: The rport lock is exected to be held before calling
  * this function.
@@ -1510,14 +1633,14 @@ static void fc_rport_recv_logo_req(struct fc_lport *lport,
 		FC_RPORT_DBG(rdata, "Received LOGO request while in state %s\n",
 			     fc_rport_state(rdata));
 
+		fc_rport_enter_delete(rdata, RPORT_EV_LOGO);
+
 		/*
-		 * If the remote port was created due to discovery,
-		 * log back in.  It may have seen a stale RSCN about us.
+		 * If the remote port was created due to discovery, set state
+		 * to log back in.  It may have seen a stale RSCN about us.
 		 */
-		if (rdata->rp_state != RPORT_ST_DELETE && rdata->disc_id)
-			fc_rport_enter_plogi(rdata);
-		else
-			fc_rport_enter_delete(rdata, RPORT_EV_LOGO);
+		if (rdata->disc_id)
+			fc_rport_state_enter(rdata, RPORT_ST_RESTART);
 		mutex_unlock(&rdata->rp_mutex);
 	} else
 		FC_RPORT_ID_DBG(lport, sid,
@@ -1526,11 +1649,18 @@ static void fc_rport_recv_logo_req(struct fc_lport *lport,
 	fc_frame_free(fp);
 }
 
+/**
+ * fc_rport_flush_queue() - Flush the rport_event_queue
+ */
 static void fc_rport_flush_queue(void)
 {
 	flush_workqueue(rport_event_queue);
 }
 
+/**
+ * fc_rport_init() - Initialize the remote port layer for a local port
+ * @lport: The local port to initialize the remote port layer for
+ */
 int fc_rport_init(struct fc_lport *lport)
 {
 	if (!lport->tt.rport_lookup)
@@ -1558,25 +1688,33 @@ int fc_rport_init(struct fc_lport *lport)
 }
 EXPORT_SYMBOL(fc_rport_init);
 
-int fc_setup_rport(void)
+/**
+ * fc_setup_rport() - Initialize the rport_event_queue
+ */
+int fc_setup_rport()
 {
 	rport_event_queue = create_singlethread_workqueue("fc_rport_eq");
 	if (!rport_event_queue)
 		return -ENOMEM;
 	return 0;
 }
-EXPORT_SYMBOL(fc_setup_rport);
 
-void fc_destroy_rport(void)
+/**
+ * fc_destroy_rport() - Destroy the rport_event_queue
+ */
+void fc_destroy_rport()
 {
 	destroy_workqueue(rport_event_queue);
 }
-EXPORT_SYMBOL(fc_destroy_rport);
 
+/**
+ * fc_rport_terminate_io() - Stop all outstanding I/O on a remote port
+ * @rport: The remote port whose I/O should be terminated
+ */
 void fc_rport_terminate_io(struct fc_rport *rport)
 {
-	struct fc_rport_libfc_priv *rp = rport->dd_data;
-	struct fc_lport *lport = rp->local_port;
+	struct fc_rport_libfc_priv *rpriv = rport->dd_data;
+	struct fc_lport *lport = rpriv->local_port;
 
 	lport->tt.exch_mgr_reset(lport, 0, rport->port_id);
 	lport->tt.exch_mgr_reset(lport, rport->port_id, 0);
diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index f1a4246f890c..c28a712fd4db 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -266,6 +266,88 @@ static int iscsi_prep_bidi_ahs(struct iscsi_task *task)
 }
 
 /**
+ * iscsi_check_tmf_restrictions - check if a task is affected by TMF
+ * @task: iscsi task
+ * @opcode: opcode to check for
+ *
+ * During TMF a task has to be checked if it's affected.
+ * All unrelated I/O can be passed through, but I/O to the
+ * affected LUN should be restricted.
+ * If 'fast_abort' is set we won't be sending any I/O to the
+ * affected LUN.
+ * Otherwise the target is waiting for all TTTs to be completed,
+ * so we have to send all outstanding Data-Out PDUs to the target.
+ */
+static int iscsi_check_tmf_restrictions(struct iscsi_task *task, int opcode)
+{
+	struct iscsi_conn *conn = task->conn;
+	struct iscsi_tm *tmf = &conn->tmhdr;
+	unsigned int hdr_lun;
+
+	if (conn->tmf_state == TMF_INITIAL)
+		return 0;
+
+	if ((tmf->opcode & ISCSI_OPCODE_MASK) != ISCSI_OP_SCSI_TMFUNC)
+		return 0;
+
+	switch (ISCSI_TM_FUNC_VALUE(tmf)) {
+	case ISCSI_TM_FUNC_LOGICAL_UNIT_RESET:
+		/*
+		 * Allow PDUs for unrelated LUNs
+		 */
+		hdr_lun = scsilun_to_int((struct scsi_lun *)tmf->lun);
+		if (hdr_lun != task->sc->device->lun)
+			return 0;
+		/* fall through */
+	case ISCSI_TM_FUNC_TARGET_WARM_RESET:
+		/*
+		 * Fail all SCSI cmd PDUs
+		 */
+		if (opcode != ISCSI_OP_SCSI_DATA_OUT) {
+			iscsi_conn_printk(KERN_INFO, conn,
+					  "task [op %x/%x itt "
+					  "0x%x/0x%x] "
+					  "rejected.\n",
+					  task->hdr->opcode, opcode,
+					  task->itt, task->hdr_itt);
+			return -EACCES;
+		}
+		/*
+		 * And also all data-out PDUs in response to R2T
+		 * if fast_abort is set.
+		 */
+		if (conn->session->fast_abort) {
+			iscsi_conn_printk(KERN_INFO, conn,
+					  "task [op %x/%x itt "
+					  "0x%x/0x%x] fast abort.\n",
+					  task->hdr->opcode, opcode,
+					  task->itt, task->hdr_itt);
+			return -EACCES;
+		}
+		break;
+	case ISCSI_TM_FUNC_ABORT_TASK:
+		/*
+		 * the caller has already checked if the task
+		 * they want to abort was in the pending queue so if
+		 * we are here the cmd pdu has gone out already, and
+		 * we will only hit this for data-outs
+		 */
+		if (opcode == ISCSI_OP_SCSI_DATA_OUT &&
+		    task->hdr_itt == tmf->rtt) {
+			ISCSI_DBG_SESSION(conn->session,
+					  "Preventing task %x/%x from sending "
+					  "data-out due to abort task in "
+					  "progress\n", task->itt,
+					  task->hdr_itt);
+			return -EACCES;
+		}
+		break;
+	}
+
+	return 0;
+}
+
+/**
  * iscsi_prep_scsi_cmd_pdu - prep iscsi scsi cmd pdu
  * @task: iscsi task
  *
@@ -282,6 +364,10 @@ static int iscsi_prep_scsi_cmd_pdu(struct iscsi_task *task)
 	itt_t itt;
 	int rc;
 
+	rc = iscsi_check_tmf_restrictions(task, ISCSI_OP_SCSI_CMD);
+	if (rc)
+		return rc;
+
 	if (conn->session->tt->alloc_pdu) {
 		rc = conn->session->tt->alloc_pdu(task, ISCSI_OP_SCSI_CMD);
 		if (rc)
@@ -431,7 +517,7 @@ static void iscsi_free_task(struct iscsi_task *task)
 	if (conn->login_task == task)
 		return;
 
-	__kfifo_put(session->cmdpool.queue, (void*)&task, sizeof(void*));
+	kfifo_in(&session->cmdpool.queue, (void*)&task, sizeof(void*));
 
 	if (sc) {
 		task->sc = NULL;
@@ -577,12 +663,12 @@ static int iscsi_prep_mgmt_task(struct iscsi_conn *conn,
 	struct iscsi_session *session = conn->session;
 	struct iscsi_hdr *hdr = task->hdr;
 	struct iscsi_nopout *nop = (struct iscsi_nopout *)hdr;
+	uint8_t opcode = hdr->opcode & ISCSI_OPCODE_MASK;
 
 	if (conn->session->state == ISCSI_STATE_LOGGING_OUT)
 		return -ENOTCONN;
 
-	if (hdr->opcode != (ISCSI_OP_LOGIN | ISCSI_OP_IMMEDIATE) &&
-	    hdr->opcode != (ISCSI_OP_TEXT | ISCSI_OP_IMMEDIATE))
+	if (opcode != ISCSI_OP_LOGIN && opcode != ISCSI_OP_TEXT)
 		nop->exp_statsn = cpu_to_be32(conn->exp_statsn);
 	/*
 	 * pre-format CmdSN for outgoing PDU.
@@ -590,9 +676,12 @@ static int iscsi_prep_mgmt_task(struct iscsi_conn *conn,
 	nop->cmdsn = cpu_to_be32(session->cmdsn);
 	if (hdr->itt != RESERVED_ITT) {
 		/*
-		 * TODO: We always use immediate, so we never hit this.
+		 * TODO: We always use immediate for normal session pdus.
 		 * If we start to send tmfs or nops as non-immediate then
 		 * we should start checking the cmdsn numbers for mgmt tasks.
+		 *
+		 * During discovery sessions iscsid sends TEXT as non immediate,
+		 * but we always only send one PDU at a time.
 		 */
 		if (conn->c_stage == ISCSI_CONN_STARTED &&
 		    !(hdr->opcode & ISCSI_OP_IMMEDIATE)) {
@@ -620,29 +709,35 @@ __iscsi_conn_send_pdu(struct iscsi_conn *conn, struct iscsi_hdr *hdr,
 {
 	struct iscsi_session *session = conn->session;
 	struct iscsi_host *ihost = shost_priv(session->host);
+	uint8_t opcode = hdr->opcode & ISCSI_OPCODE_MASK;
 	struct iscsi_task *task;
 	itt_t itt;
 
 	if (session->state == ISCSI_STATE_TERMINATE)
 		return NULL;
 
-	if (hdr->opcode == (ISCSI_OP_LOGIN | ISCSI_OP_IMMEDIATE) ||
-	    hdr->opcode == (ISCSI_OP_TEXT | ISCSI_OP_IMMEDIATE))
+	if (opcode == ISCSI_OP_LOGIN || opcode == ISCSI_OP_TEXT) {
 		/*
 		 * Login and Text are sent serially, in
 		 * request-followed-by-response sequence.
 		 * Same task can be used. Same ITT must be used.
 		 * Note that login_task is preallocated at conn_create().
 		 */
+		if (conn->login_task->state != ISCSI_TASK_FREE) {
+			iscsi_conn_printk(KERN_ERR, conn, "Login/Text in "
+					  "progress. Cannot start new task.\n");
+			return NULL;
+		}
+
 		task = conn->login_task;
-	else {
+	} else {
 		if (session->state != ISCSI_STATE_LOGGED_IN)
 			return NULL;
 
 		BUG_ON(conn->c_stage == ISCSI_CONN_INITIAL_STAGE);
 		BUG_ON(conn->c_stage == ISCSI_CONN_STOPPED);
 
-		if (!__kfifo_get(session->cmdpool.queue,
+		if (!kfifo_out(&session->cmdpool.queue,
 				 (void*)&task, sizeof(void*)))
 			return NULL;
 	}
@@ -1357,6 +1452,7 @@ EXPORT_SYMBOL_GPL(iscsi_requeue_task);
  **/
 static int iscsi_data_xmit(struct iscsi_conn *conn)
 {
+	struct iscsi_task *task;
 	int rc = 0;
 
 	spin_lock_bh(&conn->session->lock);
@@ -1394,11 +1490,8 @@ check_mgmt:
 
 	/* process pending command queue */
 	while (!list_empty(&conn->cmdqueue)) {
-		if (conn->tmf_state == TMF_QUEUED)
-			break;
-
-		conn->task = list_entry(conn->cmdqueue.next,
-					 struct iscsi_task, running);
+		conn->task = list_entry(conn->cmdqueue.next, struct iscsi_task,
+					running);
 		list_del_init(&conn->task->running);
 		if (conn->session->state == ISCSI_STATE_LOGGING_OUT) {
 			fail_scsi_task(conn->task, DID_IMM_RETRY);
@@ -1406,7 +1499,7 @@ check_mgmt:
 		}
 		rc = iscsi_prep_scsi_cmd_pdu(conn->task);
 		if (rc) {
-			if (rc == -ENOMEM) {
+			if (rc == -ENOMEM || rc == -EACCES) {
 				list_add_tail(&conn->task->running,
 					      &conn->cmdqueue);
 				conn->task = NULL;
@@ -1428,17 +1521,18 @@ check_mgmt:
 	}
 
 	while (!list_empty(&conn->requeue)) {
-		if (conn->session->fast_abort && conn->tmf_state != TMF_INITIAL)
-			break;
-
 		/*
 		 * we always do fastlogout - conn stop code will clean up.
 		 */
 		if (conn->session->state == ISCSI_STATE_LOGGING_OUT)
 			break;
 
-		conn->task = list_entry(conn->requeue.next,
-					 struct iscsi_task, running);
+		task = list_entry(conn->requeue.next, struct iscsi_task,
+				  running);
+		if (iscsi_check_tmf_restrictions(task, ISCSI_OP_SCSI_DATA_OUT))
+			break;
+
+		conn->task = task;
 		list_del_init(&conn->task->running);
 		conn->task->state = ISCSI_TASK_RUNNING;
 		rc = iscsi_xmit_task(conn);
@@ -1473,7 +1567,7 @@ static inline struct iscsi_task *iscsi_alloc_task(struct iscsi_conn *conn,
 {
 	struct iscsi_task *task;
 
-	if (!__kfifo_get(conn->session->cmdpool.queue,
+	if (!kfifo_out(&conn->session->cmdpool.queue,
 			 (void *) &task, sizeof(void *)))
 		return NULL;
 
@@ -1591,7 +1685,7 @@ int iscsi_queuecommand(struct scsi_cmnd *sc, void (*done)(struct scsi_cmnd *))
 	if (!ihost->workq) {
 		reason = iscsi_prep_scsi_cmd_pdu(task);
 		if (reason) {
-			if (reason == -ENOMEM) {
+			if (reason == -ENOMEM ||  reason == -EACCES) {
 				reason = FAILURE_OOM;
 				goto prepd_reject;
 			} else {
@@ -1643,9 +1737,21 @@ fault:
 }
 EXPORT_SYMBOL_GPL(iscsi_queuecommand);
 
-int iscsi_change_queue_depth(struct scsi_device *sdev, int depth)
+int iscsi_change_queue_depth(struct scsi_device *sdev, int depth, int reason)
 {
-	scsi_adjust_queue_depth(sdev, scsi_get_tag_type(sdev), depth);
+	switch (reason) {
+	case SCSI_QDEPTH_DEFAULT:
+		scsi_adjust_queue_depth(sdev, scsi_get_tag_type(sdev), depth);
+		break;
+	case SCSI_QDEPTH_QFULL:
+		scsi_track_queue_full(sdev, depth);
+		break;
+	case SCSI_QDEPTH_RAMP_UP:
+		scsi_adjust_queue_depth(sdev, scsi_get_tag_type(sdev), depth);
+		break;
+	default:
+		return -EOPNOTSUPP;
+	}
 	return sdev->queue_depth;
 }
 EXPORT_SYMBOL_GPL(iscsi_change_queue_depth);
@@ -1660,72 +1766,6 @@ int iscsi_target_alloc(struct scsi_target *starget)
 }
 EXPORT_SYMBOL_GPL(iscsi_target_alloc);
 
-void iscsi_session_recovery_timedout(struct iscsi_cls_session *cls_session)
-{
-	struct iscsi_session *session = cls_session->dd_data;
-
-	spin_lock_bh(&session->lock);
-	if (session->state != ISCSI_STATE_LOGGED_IN) {
-		session->state = ISCSI_STATE_RECOVERY_FAILED;
-		if (session->leadconn)
-			wake_up(&session->leadconn->ehwait);
-	}
-	spin_unlock_bh(&session->lock);
-}
-EXPORT_SYMBOL_GPL(iscsi_session_recovery_timedout);
-
-int iscsi_eh_target_reset(struct scsi_cmnd *sc)
-{
-	struct iscsi_cls_session *cls_session;
-	struct iscsi_session *session;
-	struct iscsi_conn *conn;
-
-	cls_session = starget_to_session(scsi_target(sc->device));
-	session = cls_session->dd_data;
-	conn = session->leadconn;
-
-	mutex_lock(&session->eh_mutex);
-	spin_lock_bh(&session->lock);
-	if (session->state == ISCSI_STATE_TERMINATE) {
-failed:
-		ISCSI_DBG_EH(session,
-			     "failing target reset: Could not log back into "
-			     "target [age %d]\n",
-			     session->age);
-		spin_unlock_bh(&session->lock);
-		mutex_unlock(&session->eh_mutex);
-		return FAILED;
-	}
-
-	spin_unlock_bh(&session->lock);
-	mutex_unlock(&session->eh_mutex);
-	/*
-	 * we drop the lock here but the leadconn cannot be destoyed while
-	 * we are in the scsi eh
-	 */
-	iscsi_conn_failure(conn, ISCSI_ERR_CONN_FAILED);
-
-	ISCSI_DBG_EH(session, "wait for relogin\n");
-	wait_event_interruptible(conn->ehwait,
-				 session->state == ISCSI_STATE_TERMINATE ||
-				 session->state == ISCSI_STATE_LOGGED_IN ||
-				 session->state == ISCSI_STATE_RECOVERY_FAILED);
-	if (signal_pending(current))
-		flush_signals(current);
-
-	mutex_lock(&session->eh_mutex);
-	spin_lock_bh(&session->lock);
-	if (session->state == ISCSI_STATE_LOGGED_IN) {
-		ISCSI_DBG_EH(session,
-			     "target reset succeeded\n");
-	} else
-		goto failed;
-	spin_unlock_bh(&session->lock);
-	mutex_unlock(&session->eh_mutex);
-	return SUCCESS;
-}
-EXPORT_SYMBOL_GPL(iscsi_eh_target_reset);
-
 static void iscsi_tmf_timedout(unsigned long data)
 {
 	struct iscsi_conn *conn = (struct iscsi_conn *)data;
@@ -2108,6 +2148,7 @@ int iscsi_eh_abort(struct scsi_cmnd *sc)
 		spin_lock_bh(&session->lock);
 		fail_scsi_task(task, DID_ABORT);
 		conn->tmf_state = TMF_INITIAL;
+		memset(hdr, 0, sizeof(*hdr));
 		spin_unlock_bh(&session->lock);
 		iscsi_start_tx(conn);
 		goto success_unlocked;
@@ -2118,6 +2159,7 @@ int iscsi_eh_abort(struct scsi_cmnd *sc)
 	case TMF_NOT_FOUND:
 		if (!sc->SCp.ptr) {
 			conn->tmf_state = TMF_INITIAL;
+			memset(hdr, 0, sizeof(*hdr));
 			/* task completed before tmf abort response */
 			ISCSI_DBG_EH(session, "sc completed while abort	in "
 					      "progress\n");
@@ -2212,6 +2254,7 @@ int iscsi_eh_device_reset(struct scsi_cmnd *sc)
 	iscsi_suspend_tx(conn);
 
 	spin_lock_bh(&session->lock);
+	memset(hdr, 0, sizeof(*hdr));
 	fail_scsi_tasks(conn, sc->device->lun, DID_ERROR);
 	conn->tmf_state = TMF_INITIAL;
 	spin_unlock_bh(&session->lock);
@@ -2229,6 +2272,172 @@ done:
 }
 EXPORT_SYMBOL_GPL(iscsi_eh_device_reset);
 
+void iscsi_session_recovery_timedout(struct iscsi_cls_session *cls_session)
+{
+	struct iscsi_session *session = cls_session->dd_data;
+
+	spin_lock_bh(&session->lock);
+	if (session->state != ISCSI_STATE_LOGGED_IN) {
+		session->state = ISCSI_STATE_RECOVERY_FAILED;
+		if (session->leadconn)
+			wake_up(&session->leadconn->ehwait);
+	}
+	spin_unlock_bh(&session->lock);
+}
+EXPORT_SYMBOL_GPL(iscsi_session_recovery_timedout);
+
+/**
+ * iscsi_eh_session_reset - drop session and attempt relogin
+ * @sc: scsi command
+ *
+ * This function will wait for a relogin, session termination from
+ * userspace, or a recovery/replacement timeout.
+ */
+static int iscsi_eh_session_reset(struct scsi_cmnd *sc)
+{
+	struct iscsi_cls_session *cls_session;
+	struct iscsi_session *session;
+	struct iscsi_conn *conn;
+
+	cls_session = starget_to_session(scsi_target(sc->device));
+	session = cls_session->dd_data;
+	conn = session->leadconn;
+
+	mutex_lock(&session->eh_mutex);
+	spin_lock_bh(&session->lock);
+	if (session->state == ISCSI_STATE_TERMINATE) {
+failed:
+		ISCSI_DBG_EH(session,
+			     "failing session reset: Could not log back into "
+			     "%s, %s [age %d]\n", session->targetname,
+			     conn->persistent_address, session->age);
+		spin_unlock_bh(&session->lock);
+		mutex_unlock(&session->eh_mutex);
+		return FAILED;
+	}
+
+	spin_unlock_bh(&session->lock);
+	mutex_unlock(&session->eh_mutex);
+	/*
+	 * we drop the lock here but the leadconn cannot be destoyed while
+	 * we are in the scsi eh
+	 */
+	iscsi_conn_failure(conn, ISCSI_ERR_CONN_FAILED);
+
+	ISCSI_DBG_EH(session, "wait for relogin\n");
+	wait_event_interruptible(conn->ehwait,
+				 session->state == ISCSI_STATE_TERMINATE ||
+				 session->state == ISCSI_STATE_LOGGED_IN ||
+				 session->state == ISCSI_STATE_RECOVERY_FAILED);
+	if (signal_pending(current))
+		flush_signals(current);
+
+	mutex_lock(&session->eh_mutex);
+	spin_lock_bh(&session->lock);
+	if (session->state == ISCSI_STATE_LOGGED_IN) {
+		ISCSI_DBG_EH(session,
+			     "session reset succeeded for %s,%s\n",
+			     session->targetname, conn->persistent_address);
+	} else
+		goto failed;
+	spin_unlock_bh(&session->lock);
+	mutex_unlock(&session->eh_mutex);
+	return SUCCESS;
+}
+
+static void iscsi_prep_tgt_reset_pdu(struct scsi_cmnd *sc, struct iscsi_tm *hdr)
+{
+	memset(hdr, 0, sizeof(*hdr));
+	hdr->opcode = ISCSI_OP_SCSI_TMFUNC | ISCSI_OP_IMMEDIATE;
+	hdr->flags = ISCSI_TM_FUNC_TARGET_WARM_RESET & ISCSI_FLAG_TM_FUNC_MASK;
+	hdr->flags |= ISCSI_FLAG_CMD_FINAL;
+	hdr->rtt = RESERVED_ITT;
+}
+
+/**
+ * iscsi_eh_target_reset - reset target
+ * @sc: scsi command
+ *
+ * This will attempt to send a warm target reset. If that fails
+ * then we will drop the session and attempt ERL0 recovery.
+ */
+int iscsi_eh_target_reset(struct scsi_cmnd *sc)
+{
+	struct iscsi_cls_session *cls_session;
+	struct iscsi_session *session;
+	struct iscsi_conn *conn;
+	struct iscsi_tm *hdr;
+	int rc = FAILED;
+
+	cls_session = starget_to_session(scsi_target(sc->device));
+	session = cls_session->dd_data;
+
+	ISCSI_DBG_EH(session, "tgt Reset [sc %p tgt %s]\n", sc,
+		     session->targetname);
+
+	mutex_lock(&session->eh_mutex);
+	spin_lock_bh(&session->lock);
+	/*
+	 * Just check if we are not logged in. We cannot check for
+	 * the phase because the reset could come from a ioctl.
+	 */
+	if (!session->leadconn || session->state != ISCSI_STATE_LOGGED_IN)
+		goto unlock;
+	conn = session->leadconn;
+
+	/* only have one tmf outstanding at a time */
+	if (conn->tmf_state != TMF_INITIAL)
+		goto unlock;
+	conn->tmf_state = TMF_QUEUED;
+
+	hdr = &conn->tmhdr;
+	iscsi_prep_tgt_reset_pdu(sc, hdr);
+
+	if (iscsi_exec_task_mgmt_fn(conn, hdr, session->age,
+				    session->tgt_reset_timeout)) {
+		rc = FAILED;
+		goto unlock;
+	}
+
+	switch (conn->tmf_state) {
+	case TMF_SUCCESS:
+		break;
+	case TMF_TIMEDOUT:
+		spin_unlock_bh(&session->lock);
+		iscsi_conn_failure(conn, ISCSI_ERR_CONN_FAILED);
+		goto done;
+	default:
+		conn->tmf_state = TMF_INITIAL;
+		goto unlock;
+	}
+
+	rc = SUCCESS;
+	spin_unlock_bh(&session->lock);
+
+	iscsi_suspend_tx(conn);
+
+	spin_lock_bh(&session->lock);
+	memset(hdr, 0, sizeof(*hdr));
+	fail_scsi_tasks(conn, -1, DID_ERROR);
+	conn->tmf_state = TMF_INITIAL;
+	spin_unlock_bh(&session->lock);
+
+	iscsi_start_tx(conn);
+	goto done;
+
+unlock:
+	spin_unlock_bh(&session->lock);
+done:
+	ISCSI_DBG_EH(session, "tgt %s reset result = %s\n", session->targetname,
+		     rc == SUCCESS ? "SUCCESS" : "FAILED");
+	mutex_unlock(&session->eh_mutex);
+
+	if (rc == FAILED)
+		rc = iscsi_eh_session_reset(sc);
+	return rc;
+}
+EXPORT_SYMBOL_GPL(iscsi_eh_target_reset);
+
 /*
  * Pre-allocate a pool of @max items of @item_size. By default, the pool
  * should be accessed via kfifo_{get,put} on q->queue.
@@ -2252,12 +2461,7 @@ iscsi_pool_init(struct iscsi_pool *q, int max, void ***items, int item_size)
 	if (q->pool == NULL)
 		return -ENOMEM;
 
-	q->queue = kfifo_init((void*)q->pool, max * sizeof(void*),
-			      GFP_KERNEL, NULL);
-	if (IS_ERR(q->queue)) {
-		q->queue = NULL;
-		goto enomem;
-	}
+	kfifo_init(&q->queue, (void*)q->pool, max * sizeof(void*));
 
 	for (i = 0; i < max; i++) {
 		q->pool[i] = kzalloc(item_size, GFP_KERNEL);
@@ -2265,7 +2469,7 @@ iscsi_pool_init(struct iscsi_pool *q, int max, void ***items, int item_size)
 			q->max = i;
 			goto enomem;
 		}
-		__kfifo_put(q->queue, (void*)&q->pool[i], sizeof(void*));
+		kfifo_in(&q->queue, (void*)&q->pool[i], sizeof(void*));
 	}
 
 	if (items) {
@@ -2288,7 +2492,6 @@ void iscsi_pool_free(struct iscsi_pool *q)
 	for (i = 0; i < q->max; i++)
 		kfree(q->pool[i]);
 	kfree(q->pool);
-	kfree(q->queue);
 }
 EXPORT_SYMBOL_GPL(iscsi_pool_free);
 
@@ -2495,6 +2698,7 @@ iscsi_session_setup(struct iscsi_transport *iscsit, struct Scsi_Host *shost,
 	session->host = shost;
 	session->state = ISCSI_STATE_FREE;
 	session->fast_abort = 1;
+	session->tgt_reset_timeout = 30;
 	session->lu_reset_timeout = 15;
 	session->abort_timeout = 10;
 	session->scsi_cmds_max = scsi_cmds;
@@ -2615,7 +2819,7 @@ iscsi_conn_setup(struct iscsi_cls_session *cls_session, int dd_size,
 
 	/* allocate login_task used for the login/text sequences */
 	spin_lock_bh(&session->lock);
-	if (!__kfifo_get(session->cmdpool.queue,
+	if (!kfifo_out(&session->cmdpool.queue,
                          (void*)&conn->login_task,
 			 sizeof(void*))) {
 		spin_unlock_bh(&session->lock);
@@ -2635,7 +2839,7 @@ iscsi_conn_setup(struct iscsi_cls_session *cls_session, int dd_size,
 	return cls_conn;
 
 login_task_data_alloc_fail:
-	__kfifo_put(session->cmdpool.queue, (void*)&conn->login_task,
+	kfifo_in(&session->cmdpool.queue, (void*)&conn->login_task,
 		    sizeof(void*));
 login_task_alloc_fail:
 	iscsi_destroy_conn(cls_conn);
@@ -2698,7 +2902,7 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn)
 	free_pages((unsigned long) conn->data,
 		   get_order(ISCSI_DEF_MAX_RECV_SEG_LEN));
 	kfree(conn->persistent_address);
-	__kfifo_put(session->cmdpool.queue, (void*)&conn->login_task,
+	kfifo_in(&session->cmdpool.queue, (void*)&conn->login_task,
 		    sizeof(void*));
 	if (session->leadconn == conn)
 		session->leadconn = NULL;
@@ -2856,6 +3060,7 @@ static void iscsi_start_session_recovery(struct iscsi_session *session,
 	spin_lock_bh(&session->lock);
 	fail_scsi_tasks(conn, -1, DID_TRANSPORT_DISRUPTED);
 	fail_mgmt_tasks(session, conn);
+	memset(&conn->tmhdr, 0, sizeof(conn->tmhdr));
 	spin_unlock_bh(&session->lock);
 	mutex_unlock(&session->eh_mutex);
 }
@@ -2932,6 +3137,9 @@ int iscsi_set_param(struct iscsi_cls_conn *cls_conn,
 	case ISCSI_PARAM_LU_RESET_TMO:
 		sscanf(buf, "%d", &session->lu_reset_timeout);
 		break;
+	case ISCSI_PARAM_TGT_RESET_TMO:
+		sscanf(buf, "%d", &session->tgt_reset_timeout);
+		break;
 	case ISCSI_PARAM_PING_TMO:
 		sscanf(buf, "%d", &conn->ping_timeout);
 		break;
@@ -3031,6 +3239,9 @@ int iscsi_session_get_param(struct iscsi_cls_session *cls_session,
 	case ISCSI_PARAM_LU_RESET_TMO:
 		len = sprintf(buf, "%d\n", session->lu_reset_timeout);
 		break;
+	case ISCSI_PARAM_TGT_RESET_TMO:
+		len = sprintf(buf, "%d\n", session->tgt_reset_timeout);
+		break;
 	case ISCSI_PARAM_INITIAL_R2T_EN:
 		len = sprintf(buf, "%d\n", session->initial_r2t_en);
 		break;
diff --git a/drivers/scsi/libiscsi_tcp.c b/drivers/scsi/libiscsi_tcp.c
index 2e0746d70303..db6856c138fc 100644
--- a/drivers/scsi/libiscsi_tcp.c
+++ b/drivers/scsi/libiscsi_tcp.c
@@ -445,15 +445,15 @@ void iscsi_tcp_cleanup_task(struct iscsi_task *task)
 		return;
 
 	/* flush task's r2t queues */
-	while (__kfifo_get(tcp_task->r2tqueue, (void*)&r2t, sizeof(void*))) {
-		__kfifo_put(tcp_task->r2tpool.queue, (void*)&r2t,
+	while (kfifo_out(&tcp_task->r2tqueue, (void*)&r2t, sizeof(void*))) {
+		kfifo_in(&tcp_task->r2tpool.queue, (void*)&r2t,
 			    sizeof(void*));
 		ISCSI_DBG_TCP(task->conn, "pending r2t dropped\n");
 	}
 
 	r2t = tcp_task->r2t;
 	if (r2t != NULL) {
-		__kfifo_put(tcp_task->r2tpool.queue, (void*)&r2t,
+		kfifo_in(&tcp_task->r2tpool.queue, (void*)&r2t,
 			    sizeof(void*));
 		tcp_task->r2t = NULL;
 	}
@@ -541,7 +541,7 @@ static int iscsi_tcp_r2t_rsp(struct iscsi_conn *conn, struct iscsi_task *task)
 		return 0;
 	}
 
-	rc = __kfifo_get(tcp_task->r2tpool.queue, (void*)&r2t, sizeof(void*));
+	rc = kfifo_out(&tcp_task->r2tpool.queue, (void*)&r2t, sizeof(void*));
 	if (!rc) {
 		iscsi_conn_printk(KERN_ERR, conn, "Could not allocate R2T. "
 				  "Target has sent more R2Ts than it "
@@ -554,7 +554,7 @@ static int iscsi_tcp_r2t_rsp(struct iscsi_conn *conn, struct iscsi_task *task)
 	if (r2t->data_length == 0) {
 		iscsi_conn_printk(KERN_ERR, conn,
 				  "invalid R2T with zero data len\n");
-		__kfifo_put(tcp_task->r2tpool.queue, (void*)&r2t,
+		kfifo_in(&tcp_task->r2tpool.queue, (void*)&r2t,
 			    sizeof(void*));
 		return ISCSI_ERR_DATALEN;
 	}
@@ -570,7 +570,7 @@ static int iscsi_tcp_r2t_rsp(struct iscsi_conn *conn, struct iscsi_task *task)
 				  "invalid R2T with data len %u at offset %u "
 				  "and total length %d\n", r2t->data_length,
 				  r2t->data_offset, scsi_out(task->sc)->length);
-		__kfifo_put(tcp_task->r2tpool.queue, (void*)&r2t,
+		kfifo_in(&tcp_task->r2tpool.queue, (void*)&r2t,
 			    sizeof(void*));
 		return ISCSI_ERR_DATALEN;
 	}
@@ -580,7 +580,7 @@ static int iscsi_tcp_r2t_rsp(struct iscsi_conn *conn, struct iscsi_task *task)
 	r2t->sent = 0;
 
 	tcp_task->exp_datasn = r2tsn + 1;
-	__kfifo_put(tcp_task->r2tqueue, (void*)&r2t, sizeof(void*));
+	kfifo_in(&tcp_task->r2tqueue, (void*)&r2t, sizeof(void*));
 	conn->r2t_pdus_cnt++;
 
 	iscsi_requeue_task(task);
@@ -951,7 +951,7 @@ int iscsi_tcp_task_init(struct iscsi_task *task)
 		return conn->session->tt->init_pdu(task, 0, task->data_count);
 	}
 
-	BUG_ON(__kfifo_len(tcp_task->r2tqueue));
+	BUG_ON(kfifo_len(&tcp_task->r2tqueue));
 	tcp_task->exp_datasn = 0;
 
 	/* Prepare PDU, optionally w/ immediate data */
@@ -982,7 +982,7 @@ static struct iscsi_r2t_info *iscsi_tcp_get_curr_r2t(struct iscsi_task *task)
 			if (r2t->data_length <= r2t->sent) {
 				ISCSI_DBG_TCP(task->conn,
 					      "  done with r2t %p\n", r2t);
-				__kfifo_put(tcp_task->r2tpool.queue,
+				kfifo_in(&tcp_task->r2tpool.queue,
 					    (void *)&tcp_task->r2t,
 					    sizeof(void *));
 				tcp_task->r2t = r2t = NULL;
@@ -990,8 +990,13 @@ static struct iscsi_r2t_info *iscsi_tcp_get_curr_r2t(struct iscsi_task *task)
 		}
 
 		if (r2t == NULL) {
-			__kfifo_get(tcp_task->r2tqueue,
-				    (void *)&tcp_task->r2t, sizeof(void *));
+			if (kfifo_out(&tcp_task->r2tqueue,
+			    (void *)&tcp_task->r2t, sizeof(void *)) !=
+			    sizeof(void *)) {
+				WARN_ONCE(1, "unexpected fifo state");
+				r2t = NULL;
+			}
+
 			r2t = tcp_task->r2t;
 		}
 		spin_unlock_bh(&session->lock);
@@ -1004,7 +1009,7 @@ static struct iscsi_r2t_info *iscsi_tcp_get_curr_r2t(struct iscsi_task *task)
  * iscsi_tcp_task_xmit - xmit normal PDU task
  * @task: iscsi command task
  *
- * We're expected to return 0 when everything was transmitted succesfully,
+ * We're expected to return 0 when everything was transmitted successfully,
  * -EAGAIN if there's still data in the queue, or != 0 for any other kind
  * of error.
  */
@@ -1127,9 +1132,8 @@ int iscsi_tcp_r2tpool_alloc(struct iscsi_session *session)
 		}
 
 		/* R2T xmit queue */
-		tcp_task->r2tqueue = kfifo_alloc(
-		      session->max_r2t * 4 * sizeof(void*), GFP_KERNEL, NULL);
-		if (tcp_task->r2tqueue == ERR_PTR(-ENOMEM)) {
+		if (kfifo_alloc(&tcp_task->r2tqueue,
+		      session->max_r2t * 4 * sizeof(void*), GFP_KERNEL)) {
 			iscsi_pool_free(&tcp_task->r2tpool);
 			goto r2t_alloc_fail;
 		}
@@ -1142,7 +1146,7 @@ r2t_alloc_fail:
 		struct iscsi_task *task = session->cmds[i];
 		struct iscsi_tcp_task *tcp_task = task->dd_data;
 
-		kfifo_free(tcp_task->r2tqueue);
+		kfifo_free(&tcp_task->r2tqueue);
 		iscsi_pool_free(&tcp_task->r2tpool);
 	}
 	return -ENOMEM;
@@ -1157,7 +1161,7 @@ void iscsi_tcp_r2tpool_free(struct iscsi_session *session)
 		struct iscsi_task *task = session->cmds[i];
 		struct iscsi_tcp_task *tcp_task = task->dd_data;
 
-		kfifo_free(tcp_task->r2tqueue);
+		kfifo_free(&tcp_task->r2tqueue);
 		iscsi_pool_free(&tcp_task->r2tpool);
 	}
 }
diff --git a/drivers/scsi/libsas/sas_scsi_host.c b/drivers/scsi/libsas/sas_scsi_host.c
index 1c558d3bce18..14b13196b22d 100644
--- a/drivers/scsi/libsas/sas_scsi_host.c
+++ b/drivers/scsi/libsas/sas_scsi_host.c
@@ -820,10 +820,14 @@ void sas_slave_destroy(struct scsi_device *scsi_dev)
 		ata_port_disable(dev->sata_dev.ap);
 }
 
-int sas_change_queue_depth(struct scsi_device *scsi_dev, int new_depth)
+int sas_change_queue_depth(struct scsi_device *scsi_dev, int new_depth,
+			   int reason)
 {
 	int res = min(new_depth, SAS_MAX_QD);
 
+	if (reason != SCSI_QDEPTH_DEFAULT)
+		return -EOPNOTSUPP;
+
 	if (scsi_dev->tagged_supported)
 		scsi_adjust_queue_depth(scsi_dev, scsi_get_tag_type(scsi_dev),
 					res);
diff --git a/drivers/scsi/libsrp.c b/drivers/scsi/libsrp.c
index 9ad38e81e343..ab19b3b4be52 100644
--- a/drivers/scsi/libsrp.c
+++ b/drivers/scsi/libsrp.c
@@ -58,19 +58,15 @@ static int srp_iu_pool_alloc(struct srp_queue *q, size_t max,
 		goto free_pool;
 
 	spin_lock_init(&q->lock);
-	q->queue = kfifo_init((void *) q->pool, max * sizeof(void *),
-			      GFP_KERNEL, &q->lock);
-	if (IS_ERR(q->queue))
-		goto free_item;
+	kfifo_init(&q->queue, (void *) q->pool, max * sizeof(void *));
 
 	for (i = 0, iue = q->items; i < max; i++) {
-		__kfifo_put(q->queue, (void *) &iue, sizeof(void *));
+		kfifo_in(&q->queue, (void *) &iue, sizeof(void *));
 		iue->sbuf = ring[i];
 		iue++;
 	}
 	return 0;
 
-free_item:
 	kfree(q->items);
 free_pool:
 	kfree(q->pool);
@@ -167,7 +163,11 @@ struct iu_entry *srp_iu_get(struct srp_target *target)
 {
 	struct iu_entry *iue = NULL;
 
-	kfifo_get(target->iu_queue.queue, (void *) &iue, sizeof(void *));
+	if (kfifo_out_locked(&target->iu_queue.queue, (void *) &iue,
+		sizeof(void *), &target->iu_queue.lock) != sizeof(void *)) {
+			WARN_ONCE(1, "unexpected fifo state");
+			return NULL;
+	}
 	if (!iue)
 		return iue;
 	iue->target = target;
@@ -179,7 +179,8 @@ EXPORT_SYMBOL_GPL(srp_iu_get);
 
 void srp_iu_put(struct iu_entry *iue)
 {
-	kfifo_put(iue->target->iu_queue.queue, (void *) &iue, sizeof(void *));
+	kfifo_in_locked(&iue->target->iu_queue.queue, (void *) &iue,
+			sizeof(void *), &iue->target->iu_queue.lock);
 }
 EXPORT_SYMBOL_GPL(srp_iu_put);
 
diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h
index aa10f7951634..1cc23a69db5e 100644
--- a/drivers/scsi/lpfc/lpfc.h
+++ b/drivers/scsi/lpfc/lpfc.h
@@ -109,7 +109,8 @@ struct hbq_dmabuf {
 	struct lpfc_dmabuf dbuf;
 	uint32_t size;
 	uint32_t tag;
-	struct lpfc_rcqe rcqe;
+	struct lpfc_cq_event cq_event;
+	unsigned long time_stamp;
 };
 
 /* Priority bit.  Set value to exceed low water mark in lpfc_mem. */
@@ -201,6 +202,7 @@ struct lpfc_stats {
 	uint32_t elsRcvLIRR;
 	uint32_t elsRcvRPS;
 	uint32_t elsRcvRPL;
+	uint32_t elsRcvRRQ;
 	uint32_t elsXmitFLOGI;
 	uint32_t elsXmitFDISC;
 	uint32_t elsXmitPLOGI;
@@ -289,8 +291,8 @@ struct lpfc_vport {
 
 	uint16_t vpi;
 	uint16_t vfi;
-	uint8_t vfi_state;
-#define LPFC_VFI_REGISTERED	0x1
+	uint8_t vpi_state;
+#define LPFC_VPI_REGISTERED	0x1
 
 	uint32_t fc_flag;	/* FC flags */
 /* Several of these flags are HBA centric and should be moved to
@@ -405,6 +407,7 @@ struct lpfc_vport {
 	uint8_t stat_data_enabled;
 	uint8_t stat_data_blocked;
 	struct list_head rcv_buffer_list;
+	unsigned long rcv_buffer_time_stamp;
 	uint32_t vport_flag;
 #define STATIC_VPORT	1
 };
@@ -527,13 +530,16 @@ struct lpfc_hba {
 #define HBA_ERATT_HANDLED	0x1 /* This flag is set when eratt handled */
 #define DEFER_ERATT		0x2 /* Deferred error attention in progress */
 #define HBA_FCOE_SUPPORT	0x4 /* HBA function supports FCOE */
-#define HBA_RECEIVE_BUFFER	0x8 /* Rcv buffer posted to worker thread */
+#define HBA_SP_QUEUE_EVT	0x8 /* Slow-path qevt posted to worker thread*/
 #define HBA_POST_RECEIVE_BUFFER 0x10 /* Rcv buffers need to be posted */
 #define FCP_XRI_ABORT_EVENT	0x20
 #define ELS_XRI_ABORT_EVENT	0x40
 #define ASYNC_EVENT		0x80
 #define LINK_DISABLED		0x100 /* Link disabled by user */
 #define FCF_DISC_INPROGRESS	0x200 /* FCF discovery in progress */
+#define HBA_FIP_SUPPORT		0x400 /* FIP support in HBA */
+#define HBA_AER_ENABLED		0x800 /* AER enabled with HBA */
+	uint32_t fcp_ring_in_use; /* When polling test if intr-hndlr active*/
 	struct lpfc_dmabuf slim2p;
 
 	MAILBOX_t *mbox;
@@ -551,6 +557,7 @@ struct lpfc_hba {
 	uint8_t fc_linkspeed;	/* Link speed after last READ_LA */
 
 	uint32_t fc_eventTag;	/* event tag for link attention */
+	uint32_t link_events;
 
 	/* These fields used to be binfo */
 	uint32_t fc_pref_DID;	/* preferred D_ID */
@@ -604,8 +611,8 @@ struct lpfc_hba {
 	uint32_t cfg_enable_hba_reset;
 	uint32_t cfg_enable_hba_heartbeat;
 	uint32_t cfg_enable_bg;
-	uint32_t cfg_enable_fip;
 	uint32_t cfg_log_verbose;
+	uint32_t cfg_aer_support;
 
 	lpfc_vpd_t vpd;		/* vital product data */
 
diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c
index e1a30a16a9fa..91542f786edf 100644
--- a/drivers/scsi/lpfc/lpfc_attr.c
+++ b/drivers/scsi/lpfc/lpfc_attr.c
@@ -23,12 +23,14 @@
 #include <linux/delay.h>
 #include <linux/pci.h>
 #include <linux/interrupt.h>
+#include <linux/aer.h>
 
 #include <scsi/scsi.h>
 #include <scsi/scsi_device.h>
 #include <scsi/scsi_host.h>
 #include <scsi/scsi_tcq.h>
 #include <scsi/scsi_transport_fc.h>
+#include <scsi/fc/fc_fs.h>
 
 #include "lpfc_hw4.h"
 #include "lpfc_hw.h"
@@ -98,6 +100,28 @@ lpfc_drvr_version_show(struct device *dev, struct device_attribute *attr,
 	return snprintf(buf, PAGE_SIZE, LPFC_MODULE_DESC "\n");
 }
 
+/**
+ * lpfc_enable_fip_show - Return the fip mode of the HBA
+ * @dev: class unused variable.
+ * @attr: device attribute, not used.
+ * @buf: on return contains the module description text.
+ *
+ * Returns: size of formatted string.
+ **/
+static ssize_t
+lpfc_enable_fip_show(struct device *dev, struct device_attribute *attr,
+		       char *buf)
+{
+	struct Scsi_Host *shost = class_to_shost(dev);
+	struct lpfc_vport *vport = (struct lpfc_vport *) shost->hostdata;
+	struct lpfc_hba   *phba = vport->phba;
+
+	if (phba->hba_flag & HBA_FIP_SUPPORT)
+		return snprintf(buf, PAGE_SIZE, "1\n");
+	else
+		return snprintf(buf, PAGE_SIZE, "0\n");
+}
+
 static ssize_t
 lpfc_bg_info_show(struct device *dev, struct device_attribute *attr,
 		  char *buf)
@@ -654,7 +678,7 @@ lpfc_selective_reset(struct lpfc_hba *phba)
  * Notes:
  * Assumes any error from lpfc_selective_reset() will be negative.
  * If lpfc_selective_reset() returns zero then the length of the buffer
- * is returned which indicates succcess
+ * is returned which indicates success
  *
  * Returns:
  * -EINVAL if the buffer does not contain the string "selective"
@@ -762,9 +786,15 @@ lpfc_board_mode_store(struct device *dev, struct device_attribute *attr,
 	} else if (strncmp(buf, "offline", sizeof("offline") - 1) == 0)
 		status = lpfc_do_offline(phba, LPFC_EVT_OFFLINE);
 	else if (strncmp(buf, "warm", sizeof("warm") - 1) == 0)
-		status = lpfc_do_offline(phba, LPFC_EVT_WARM_START);
+		if (phba->sli_rev == LPFC_SLI_REV4)
+			return -EINVAL;
+		else
+			status = lpfc_do_offline(phba, LPFC_EVT_WARM_START);
 	else if (strncmp(buf, "error", sizeof("error") - 1) == 0)
-		status = lpfc_do_offline(phba, LPFC_EVT_KILL);
+		if (phba->sli_rev == LPFC_SLI_REV4)
+			return -EINVAL;
+		else
+			status = lpfc_do_offline(phba, LPFC_EVT_KILL);
 	else
 		return -EINVAL;
 
@@ -1126,6 +1156,9 @@ lpfc_poll_store(struct device *dev, struct device_attribute *attr,
 	if ((val & 0x3) != val)
 		return -EINVAL;
 
+	if (phba->sli_rev == LPFC_SLI_REV4)
+		val = 0;
+
 	spin_lock_irq(&phba->hbalock);
 
 	old_val = phba->cfg_poll;
@@ -1589,6 +1622,7 @@ static DEVICE_ATTR(num_discovered_ports, S_IRUGO,
 static DEVICE_ATTR(menlo_mgmt_mode, S_IRUGO, lpfc_mlomgmt_show, NULL);
 static DEVICE_ATTR(nport_evt_cnt, S_IRUGO, lpfc_nport_evt_cnt_show, NULL);
 static DEVICE_ATTR(lpfc_drvr_version, S_IRUGO, lpfc_drvr_version_show, NULL);
+static DEVICE_ATTR(lpfc_enable_fip, S_IRUGO, lpfc_enable_fip_show, NULL);
 static DEVICE_ATTR(board_mode, S_IRUGO | S_IWUSR,
 		   lpfc_board_mode_show, lpfc_board_mode_store);
 static DEVICE_ATTR(issue_reset, S_IWUSR, NULL, lpfc_issue_reset);
@@ -2759,6 +2793,196 @@ static DEVICE_ATTR(lpfc_link_speed, S_IRUGO | S_IWUSR,
 		lpfc_link_speed_show, lpfc_link_speed_store);
 
 /*
+# lpfc_aer_support: Support PCIe device Advanced Error Reporting (AER)
+#       0  = aer disabled or not supported
+#       1  = aer supported and enabled (default)
+# Value range is [0,1]. Default value is 1.
+*/
+
+/**
+ * lpfc_aer_support_store - Set the adapter for aer support
+ *
+ * @dev: class device that is converted into a Scsi_host.
+ * @attr: device attribute, not used.
+ * @buf: containing the string "selective".
+ * @count: unused variable.
+ *
+ * Description:
+ * If the val is 1 and currently the device's AER capability was not
+ * enabled, invoke the kernel's enable AER helper routine, trying to
+ * enable the device's AER capability. If the helper routine enabling
+ * AER returns success, update the device's cfg_aer_support flag to
+ * indicate AER is supported by the device; otherwise, if the device
+ * AER capability is already enabled to support AER, then do nothing.
+ *
+ * If the val is 0 and currently the device's AER support was enabled,
+ * invoke the kernel's disable AER helper routine. After that, update
+ * the device's cfg_aer_support flag to indicate AER is not supported
+ * by the device; otherwise, if the device AER capability is already
+ * disabled from supporting AER, then do nothing.
+ *
+ * Returns:
+ * length of the buf on success if val is in range the intended mode
+ * is supported.
+ * -EINVAL if val out of range or intended mode is not supported.
+ **/
+static ssize_t
+lpfc_aer_support_store(struct device *dev, struct device_attribute *attr,
+		       const char *buf, size_t count)
+{
+	struct Scsi_Host *shost = class_to_shost(dev);
+	struct lpfc_vport *vport = (struct lpfc_vport *)shost->hostdata;
+	struct lpfc_hba *phba = vport->phba;
+	int val = 0, rc = -EINVAL;
+
+	/* AER not supported on OC devices yet */
+	if (phba->pci_dev_grp == LPFC_PCI_DEV_OC)
+		return -EPERM;
+	if (!isdigit(buf[0]))
+		return -EINVAL;
+	if (sscanf(buf, "%i", &val) != 1)
+		return -EINVAL;
+
+	switch (val) {
+	case 0:
+		if (phba->hba_flag & HBA_AER_ENABLED) {
+			rc = pci_disable_pcie_error_reporting(phba->pcidev);
+			if (!rc) {
+				spin_lock_irq(&phba->hbalock);
+				phba->hba_flag &= ~HBA_AER_ENABLED;
+				spin_unlock_irq(&phba->hbalock);
+				phba->cfg_aer_support = 0;
+				rc = strlen(buf);
+			} else
+				rc = -EPERM;
+		} else {
+			phba->cfg_aer_support = 0;
+			rc = strlen(buf);
+		}
+		break;
+	case 1:
+		if (!(phba->hba_flag & HBA_AER_ENABLED)) {
+			rc = pci_enable_pcie_error_reporting(phba->pcidev);
+			if (!rc) {
+				spin_lock_irq(&phba->hbalock);
+				phba->hba_flag |= HBA_AER_ENABLED;
+				spin_unlock_irq(&phba->hbalock);
+				phba->cfg_aer_support = 1;
+				rc = strlen(buf);
+			} else
+				 rc = -EPERM;
+		} else {
+			phba->cfg_aer_support = 1;
+			rc = strlen(buf);
+		}
+		break;
+	default:
+		rc = -EINVAL;
+		break;
+	}
+	return rc;
+}
+
+static int lpfc_aer_support = 1;
+module_param(lpfc_aer_support, int, 1);
+MODULE_PARM_DESC(lpfc_aer_support, "Enable PCIe device AER support");
+lpfc_param_show(aer_support)
+
+/**
+ * lpfc_aer_support_init - Set the initial adapters aer support flag
+ * @phba: lpfc_hba pointer.
+ * @val: link speed value.
+ *
+ * Description:
+ * If val is in a valid range [0,1], then set the adapter's initial
+ * cfg_aer_support field. It will be up to the driver's probe_one
+ * routine to determine whether the device's AER support can be set
+ * or not.
+ *
+ * Notes:
+ * If the value is not in range log a kernel error message, and
+ * choose the default value of setting AER support and return.
+ *
+ * Returns:
+ * zero if val saved.
+ * -EINVAL val out of range
+ **/
+static int
+lpfc_aer_support_init(struct lpfc_hba *phba, int val)
+{
+	/* AER not supported on OC devices yet */
+	if (phba->pci_dev_grp == LPFC_PCI_DEV_OC) {
+		phba->cfg_aer_support = 0;
+		return -EPERM;
+	}
+
+	if (val == 0 || val == 1) {
+		phba->cfg_aer_support = val;
+		return 0;
+	}
+	lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
+			"2712 lpfc_aer_support attribute value %d out "
+			"of range, allowed values are 0|1, setting it "
+			"to default value of 1\n", val);
+	/* By default, try to enable AER on a device */
+	phba->cfg_aer_support = 1;
+	return -EINVAL;
+}
+
+static DEVICE_ATTR(lpfc_aer_support, S_IRUGO | S_IWUSR,
+		   lpfc_aer_support_show, lpfc_aer_support_store);
+
+/**
+ * lpfc_aer_cleanup_state - Clean up aer state to the aer enabled device
+ * @dev: class device that is converted into a Scsi_host.
+ * @attr: device attribute, not used.
+ * @buf: containing the string "selective".
+ * @count: unused variable.
+ *
+ * Description:
+ * If the @buf contains 1 and the device currently has the AER support
+ * enabled, then invokes the kernel AER helper routine
+ * pci_cleanup_aer_uncorrect_error_status to clean up the uncorrectable
+ * error status register.
+ *
+ * Notes:
+ *
+ * Returns:
+ * -EINVAL if the buf does not contain the 1 or the device is not currently
+ * enabled with the AER support.
+ **/
+static ssize_t
+lpfc_aer_cleanup_state(struct device *dev, struct device_attribute *attr,
+		       const char *buf, size_t count)
+{
+	struct Scsi_Host  *shost = class_to_shost(dev);
+	struct lpfc_vport *vport = (struct lpfc_vport *) shost->hostdata;
+	struct lpfc_hba   *phba = vport->phba;
+	int val, rc = -1;
+
+	/* AER not supported on OC devices yet */
+	if (phba->pci_dev_grp == LPFC_PCI_DEV_OC)
+		return -EPERM;
+	if (!isdigit(buf[0]))
+		return -EINVAL;
+	if (sscanf(buf, "%i", &val) != 1)
+		return -EINVAL;
+	if (val != 1)
+		return -EINVAL;
+
+	if (phba->hba_flag & HBA_AER_ENABLED)
+		rc = pci_cleanup_aer_uncorrect_error_status(phba->pcidev);
+
+	if (rc == 0)
+		return strlen(buf);
+	else
+		return -EPERM;
+}
+
+static DEVICE_ATTR(lpfc_aer_state_cleanup, S_IWUSR, NULL,
+		   lpfc_aer_cleanup_state);
+
+/*
 # lpfc_fcp_class:  Determines FC class to use for the FCP protocol.
 # Value range is [2,3]. Default value is 3.
 */
@@ -2846,7 +3070,7 @@ LPFC_ATTR_R(multi_ring_support, 1, 1, 2, "Determines number of primary "
 # identifies what rctl value to configure the additional ring for.
 # Value range is [1,0xff]. Default value is 4 (Unsolicated Data).
 */
-LPFC_ATTR_R(multi_ring_rctl, FC_UNSOL_DATA, 1,
+LPFC_ATTR_R(multi_ring_rctl, FC_RCTL_DD_UNSOL_DATA, 1,
 	     255, "Identifies RCTL for additional ring configuration");
 
 /*
@@ -2854,7 +3078,7 @@ LPFC_ATTR_R(multi_ring_rctl, FC_UNSOL_DATA, 1,
 # identifies what type value to configure the additional ring for.
 # Value range is [1,0xff]. Default value is 5 (LLC/SNAP).
 */
-LPFC_ATTR_R(multi_ring_type, FC_LLC_SNAP, 1,
+LPFC_ATTR_R(multi_ring_type, FC_TYPE_IP, 1,
 	     255, "Identifies TYPE for additional ring configuration");
 
 /*
@@ -2947,15 +3171,6 @@ LPFC_ATTR_R(enable_hba_heartbeat, 1, 0, 1, "Enable HBA Heartbeat.");
 LPFC_ATTR_R(enable_bg, 0, 0, 1, "Enable BlockGuard Support");
 
 /*
-# lpfc_enable_fip: When set, FIP is required to start discovery. If not
-# set, the driver will add an FCF record manually if the port has no
-# FCF records available and start discovery.
-# Value range is [0,1]. Default value is 1 (enabled)
-*/
-LPFC_ATTR_RW(enable_fip, 0, 0, 1, "Enable FIP Discovery");
-
-
-/*
 # lpfc_prot_mask: i
 #	- Bit mask of host protection capabilities used to register with the
 #	  SCSI mid-layer
@@ -3013,6 +3228,7 @@ struct device_attribute *lpfc_hba_attrs[] = {
 	&dev_attr_num_discovered_ports,
 	&dev_attr_menlo_mgmt_mode,
 	&dev_attr_lpfc_drvr_version,
+	&dev_attr_lpfc_enable_fip,
 	&dev_attr_lpfc_temp_sensor,
 	&dev_attr_lpfc_log_verbose,
 	&dev_attr_lpfc_lun_queue_depth,
@@ -3020,7 +3236,6 @@ struct device_attribute *lpfc_hba_attrs[] = {
 	&dev_attr_lpfc_peer_port_login,
 	&dev_attr_lpfc_nodev_tmo,
 	&dev_attr_lpfc_devloss_tmo,
-	&dev_attr_lpfc_enable_fip,
 	&dev_attr_lpfc_fcp_class,
 	&dev_attr_lpfc_use_adisc,
 	&dev_attr_lpfc_ack0,
@@ -3061,6 +3276,8 @@ struct device_attribute *lpfc_hba_attrs[] = {
 	&dev_attr_lpfc_max_scsicmpl_time,
 	&dev_attr_lpfc_stat_data_ctrl,
 	&dev_attr_lpfc_prot_sg_seg_cnt,
+	&dev_attr_lpfc_aer_support,
+	&dev_attr_lpfc_aer_state_cleanup,
 	NULL,
 };
 
@@ -3073,7 +3290,6 @@ struct device_attribute *lpfc_vport_attrs[] = {
 	&dev_attr_lpfc_lun_queue_depth,
 	&dev_attr_lpfc_nodev_tmo,
 	&dev_attr_lpfc_devloss_tmo,
-	&dev_attr_lpfc_enable_fip,
 	&dev_attr_lpfc_hba_queue_depth,
 	&dev_attr_lpfc_peer_port_login,
 	&dev_attr_lpfc_restrict_login,
@@ -3147,7 +3363,7 @@ sysfs_ctlreg_write(struct kobject *kobj, struct bin_attribute *bin_attr,
  * sysfs_ctlreg_read - Read method for reading from ctlreg
  * @kobj: kernel kobject that contains the kernel class device.
  * @bin_attr: kernel attributes passed to us.
- * @buf: if succesful contains the data from the adapter IOREG space.
+ * @buf: if successful contains the data from the adapter IOREG space.
  * @off: offset into buffer to beginning of data.
  * @count: bytes to transfer.
  *
@@ -3815,7 +4031,11 @@ lpfc_get_stats(struct Scsi_Host *shost)
 	hs->invalid_crc_count -= lso->invalid_crc_count;
 	hs->error_frames -= lso->error_frames;
 
-	if (phba->fc_topology == TOPOLOGY_LOOP) {
+	if (phba->hba_flag & HBA_FCOE_SUPPORT) {
+		hs->lip_count = -1;
+		hs->nos_count = (phba->link_events >> 1);
+		hs->nos_count -= lso->link_events;
+	} else if (phba->fc_topology == TOPOLOGY_LOOP) {
 		hs->lip_count = (phba->fc_eventTag >> 1);
 		hs->lip_count -= lso->link_events;
 		hs->nos_count = -1;
@@ -3906,7 +4126,10 @@ lpfc_reset_stats(struct Scsi_Host *shost)
 	lso->invalid_tx_word_count = pmb->un.varRdLnk.invalidXmitWord;
 	lso->invalid_crc_count = pmb->un.varRdLnk.crcCnt;
 	lso->error_frames = pmb->un.varRdLnk.crcCnt;
-	lso->link_events = (phba->fc_eventTag >> 1);
+	if (phba->hba_flag & HBA_FCOE_SUPPORT)
+		lso->link_events = (phba->link_events >> 1);
+	else
+		lso->link_events = (phba->fc_eventTag >> 1);
 
 	psli->stats_start = get_seconds();
 
@@ -4222,14 +4445,17 @@ lpfc_get_cfgparam(struct lpfc_hba *phba)
 	lpfc_enable_hba_reset_init(phba, lpfc_enable_hba_reset);
 	lpfc_enable_hba_heartbeat_init(phba, lpfc_enable_hba_heartbeat);
 	lpfc_enable_bg_init(phba, lpfc_enable_bg);
+	if (phba->sli_rev == LPFC_SLI_REV4)
+		phba->cfg_poll = 0;
+	else
 	phba->cfg_poll = lpfc_poll;
 	phba->cfg_soft_wwnn = 0L;
 	phba->cfg_soft_wwpn = 0L;
 	lpfc_sg_seg_cnt_init(phba, lpfc_sg_seg_cnt);
 	lpfc_prot_sg_seg_cnt_init(phba, lpfc_prot_sg_seg_cnt);
 	lpfc_hba_queue_depth_init(phba, lpfc_hba_queue_depth);
-	lpfc_enable_fip_init(phba, lpfc_enable_fip);
 	lpfc_hba_log_verbose_init(phba, lpfc_log_verbose);
+	lpfc_aer_support_init(phba, lpfc_aer_support);
 
 	return;
 }
diff --git a/drivers/scsi/lpfc/lpfc_bsg.c b/drivers/scsi/lpfc/lpfc_bsg.c
index da6bf5aac9dd..a5d9048235d9 100644
--- a/drivers/scsi/lpfc/lpfc_bsg.c
+++ b/drivers/scsi/lpfc/lpfc_bsg.c
@@ -26,6 +26,7 @@
 #include <scsi/scsi_host.h>
 #include <scsi/scsi_transport_fc.h>
 #include <scsi/scsi_bsg_fc.h>
+#include <scsi/fc/fc_fs.h>
 
 #include "lpfc_hw4.h"
 #include "lpfc_hw.h"
@@ -148,8 +149,8 @@ lpfc_bsg_rport_ct(struct fc_bsg_job *job)
 	cmd->ulpCommand = CMD_GEN_REQUEST64_CR;
 	cmd->un.genreq64.w5.hcsw.Fctl = (SI | LA);
 	cmd->un.genreq64.w5.hcsw.Dfctl = 0;
-	cmd->un.genreq64.w5.hcsw.Rctl = FC_UNSOL_CTL;
-	cmd->un.genreq64.w5.hcsw.Type = FC_COMMON_TRANSPORT_ULP;
+	cmd->un.genreq64.w5.hcsw.Rctl = FC_RCTL_DD_UNSOL_CTL;
+	cmd->un.genreq64.w5.hcsw.Type = FC_TYPE_CT;
 	cmd->ulpBdeCount = 1;
 	cmd->ulpLe = 1;
 	cmd->ulpClass = CLASS3;
diff --git a/drivers/scsi/lpfc/lpfc_crtn.h b/drivers/scsi/lpfc/lpfc_crtn.h
index 0830f37409a3..650494d622c1 100644
--- a/drivers/scsi/lpfc/lpfc_crtn.h
+++ b/drivers/scsi/lpfc/lpfc_crtn.h
@@ -49,6 +49,8 @@ void lpfc_init_link(struct lpfc_hba *, LPFC_MBOXQ_t *, uint32_t, uint32_t);
 void lpfc_request_features(struct lpfc_hba *, struct lpfcMboxq *);
 
 struct lpfc_vport *lpfc_find_vport_by_did(struct lpfc_hba *, uint32_t);
+void lpfc_cleanup_rcv_buffers(struct lpfc_vport *);
+void lpfc_rcv_seq_check_edtov(struct lpfc_vport *);
 void lpfc_cleanup_rpis(struct lpfc_vport *, int);
 int lpfc_linkdown(struct lpfc_hba *);
 void lpfc_linkdown_port(struct lpfc_vport *);
@@ -144,6 +146,8 @@ void lpfc_hb_timeout_handler(struct lpfc_hba *);
 
 void lpfc_ct_unsol_event(struct lpfc_hba *, struct lpfc_sli_ring *,
 			 struct lpfc_iocbq *);
+void lpfc_sli4_ct_abort_unsol_event(struct lpfc_hba *, struct lpfc_sli_ring *,
+				    struct lpfc_iocbq *);
 int lpfc_ns_cmd(struct lpfc_vport *, int, uint8_t, uint32_t);
 int lpfc_fdmi_cmd(struct lpfc_vport *, struct lpfc_nodelist *, int);
 void lpfc_fdmi_tmo(unsigned long);
@@ -188,7 +192,7 @@ int lpfc_mbox_tmo_val(struct lpfc_hba *, int);
 void lpfc_init_vfi(struct lpfcMboxq *, struct lpfc_vport *);
 void lpfc_reg_vfi(struct lpfcMboxq *, struct lpfc_vport *, dma_addr_t);
 void lpfc_init_vpi(struct lpfc_hba *, struct lpfcMboxq *, uint16_t);
-void lpfc_unreg_vfi(struct lpfcMboxq *, uint16_t);
+void lpfc_unreg_vfi(struct lpfcMboxq *, struct lpfc_vport *);
 void lpfc_reg_fcfi(struct lpfc_hba *, struct lpfcMboxq *);
 void lpfc_unreg_fcfi(struct lpfcMboxq *, uint16_t);
 void lpfc_resume_rpi(struct lpfcMboxq *, struct lpfc_nodelist *);
@@ -212,7 +216,10 @@ void lpfc_stop_vport_timers(struct lpfc_vport *);
 void lpfc_poll_timeout(unsigned long ptr);
 void lpfc_poll_start_timer(struct lpfc_hba *);
 void lpfc_poll_eratt(unsigned long);
-void lpfc_sli_poll_fcp_ring(struct lpfc_hba *);
+int
+lpfc_sli_handle_fast_ring_event(struct lpfc_hba *,
+			struct lpfc_sli_ring *, uint32_t);
+
 struct lpfc_iocbq * lpfc_sli_get_iocbq(struct lpfc_hba *);
 void lpfc_sli_release_iocbq(struct lpfc_hba *, struct lpfc_iocbq *);
 uint16_t lpfc_sli_next_iotag(struct lpfc_hba *, struct lpfc_iocbq *);
@@ -235,7 +242,7 @@ void lpfc_sli_mbox_sys_shutdown(struct lpfc_hba *);
 int lpfc_sli_check_eratt(struct lpfc_hba *);
 void lpfc_sli_handle_slow_ring_event(struct lpfc_hba *,
 				    struct lpfc_sli_ring *, uint32_t);
-int lpfc_sli4_handle_received_buffer(struct lpfc_hba *);
+void lpfc_sli4_handle_received_buffer(struct lpfc_hba *, struct hbq_dmabuf *);
 void lpfc_sli_def_mbox_cmpl(struct lpfc_hba *, LPFC_MBOXQ_t *);
 int lpfc_sli_issue_iocb(struct lpfc_hba *, uint32_t,
 			struct lpfc_iocbq *, uint32_t);
@@ -361,6 +368,7 @@ void lpfc_stop_port(struct lpfc_hba *);
 void lpfc_parse_fcoe_conf(struct lpfc_hba *, uint8_t *, uint32_t);
 int lpfc_parse_vpd(struct lpfc_hba *, uint8_t *, int);
 void lpfc_start_fdiscs(struct lpfc_hba *phba);
+struct lpfc_vport *lpfc_find_vport_by_vpid(struct lpfc_hba *, uint16_t);
 
 #define ScsiResult(host_code, scsi_code) (((host_code) << 16) | scsi_code)
 #define HBA_EVENT_RSCN                   5
diff --git a/drivers/scsi/lpfc/lpfc_ct.c b/drivers/scsi/lpfc/lpfc_ct.c
index 9a1bd9534d74..0ebcd9baca79 100644
--- a/drivers/scsi/lpfc/lpfc_ct.c
+++ b/drivers/scsi/lpfc/lpfc_ct.c
@@ -31,6 +31,7 @@
 #include <scsi/scsi_device.h>
 #include <scsi/scsi_host.h>
 #include <scsi/scsi_transport_fc.h>
+#include <scsi/fc/fc_fs.h>
 
 #include "lpfc_hw4.h"
 #include "lpfc_hw.h"
@@ -87,7 +88,6 @@ void
 lpfc_ct_unsol_event(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
 		    struct lpfc_iocbq *piocbq)
 {
-
 	struct lpfc_dmabuf *mp = NULL;
 	IOCB_t *icmd = &piocbq->iocb;
 	int i;
@@ -160,6 +160,39 @@ lpfc_ct_unsol_event(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
 	}
 }
 
+/**
+ * lpfc_sli4_ct_abort_unsol_event - Default handle for sli4 unsol abort
+ * @phba: Pointer to HBA context object.
+ * @pring: Pointer to the driver internal I/O ring.
+ * @piocbq: Pointer to the IOCBQ.
+ *
+ * This function serves as the default handler for the sli4 unsolicited
+ * abort event. It shall be invoked when there is no application interface
+ * registered unsolicited abort handler. This handler does nothing but
+ * just simply releases the dma buffer used by the unsol abort event.
+ **/
+void
+lpfc_sli4_ct_abort_unsol_event(struct lpfc_hba *phba,
+			       struct lpfc_sli_ring *pring,
+			       struct lpfc_iocbq *piocbq)
+{
+	IOCB_t *icmd = &piocbq->iocb;
+	struct lpfc_dmabuf *bdeBuf;
+	uint32_t size;
+
+	/* Forward abort event to any process registered to receive ct event */
+	lpfc_bsg_ct_unsol_event(phba, pring, piocbq);
+
+	/* If there is no BDE associated with IOCB, there is nothing to do */
+	if (icmd->ulpBdeCount == 0)
+		return;
+	bdeBuf = piocbq->context2;
+	piocbq->context2 = NULL;
+	size  = icmd->un.cont64[0].tus.f.bdeSize;
+	lpfc_ct_unsol_buffer(phba, piocbq, bdeBuf, size);
+	lpfc_in_buf_free(phba, bdeBuf);
+}
+
 static void
 lpfc_free_ct_rsp(struct lpfc_hba *phba, struct lpfc_dmabuf *mlist)
 {
@@ -304,8 +337,8 @@ lpfc_gen_req(struct lpfc_vport *vport, struct lpfc_dmabuf *bmp,
 	/* Fill in rest of iocb */
 	icmd->un.genreq64.w5.hcsw.Fctl = (SI | LA);
 	icmd->un.genreq64.w5.hcsw.Dfctl = 0;
-	icmd->un.genreq64.w5.hcsw.Rctl = FC_UNSOL_CTL;
-	icmd->un.genreq64.w5.hcsw.Type = FC_COMMON_TRANSPORT_ULP;
+	icmd->un.genreq64.w5.hcsw.Rctl = FC_RCTL_DD_UNSOL_CTL;
+	icmd->un.genreq64.w5.hcsw.Type = FC_TYPE_CT;
 
 	if (!tmo) {
 		 /* FC spec states we need 3 * ratov for CT requests */
@@ -363,9 +396,14 @@ lpfc_ct_cmd(struct lpfc_vport *vport, struct lpfc_dmabuf *inmp,
 	outmp = lpfc_alloc_ct_rsp(phba, cmdcode, bpl, rsp_size, &cnt);
 	if (!outmp)
 		return -ENOMEM;
-
+	/*
+	 * Form the CT IOCB.  The total number of BDEs in this IOCB
+	 * is the single command plus response count from
+	 * lpfc_alloc_ct_rsp.
+	 */
+	cnt += 1;
 	status = lpfc_gen_req(vport, bmp, inmp, outmp, cmpl, ndlp, 0,
-			      cnt+1, 0, retry);
+			      cnt, 0, retry);
 	if (status) {
 		lpfc_free_ct_rsp(phba, outmp);
 		return -ENOMEM;
@@ -501,6 +539,9 @@ lpfc_ns_rsp(struct lpfc_vport *vport, struct lpfc_dmabuf *mp, uint32_t Size)
 							SLI_CTNS_GFF_ID,
 							0, Did) == 0)
 							vport->num_disc_nodes++;
+						else
+							lpfc_setup_disc_node
+								(vport, Did);
 					}
 					else {
 						lpfc_debugfs_disc_trc(vport,
@@ -1209,7 +1250,7 @@ lpfc_ns_cmd(struct lpfc_vport *vport, int cmdcode,
 		    be16_to_cpu(SLI_CTNS_RFF_ID);
 		CtReq->un.rff.PortId = cpu_to_be32(vport->fc_myDID);
 		CtReq->un.rff.fbits = FC4_FEATURE_INIT;
-		CtReq->un.rff.type_code = FC_FCP_DATA;
+		CtReq->un.rff.type_code = FC_TYPE_FCP;
 		cmpl = lpfc_cmpl_ct_cmd_rff_id;
 		break;
 	}
diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
index 8d0f0de76b63..391584183d81 100644
--- a/drivers/scsi/lpfc/lpfc_debugfs.c
+++ b/drivers/scsi/lpfc/lpfc_debugfs.c
@@ -926,7 +926,7 @@ lpfc_debugfs_dumpData_open(struct inode *inode, struct file *file)
 		goto out;
 
 	/* Round to page boundry */
-	printk(KERN_ERR "BLKGRD %s: _dump_buf_data=0x%p\n",
+	printk(KERN_ERR "9059 BLKGRD:  %s: _dump_buf_data=0x%p\n",
 			__func__, _dump_buf_data);
 	debug->buffer = _dump_buf_data;
 	if (!debug->buffer) {
@@ -956,8 +956,8 @@ lpfc_debugfs_dumpDif_open(struct inode *inode, struct file *file)
 		goto out;
 
 	/* Round to page boundry */
-	printk(KERN_ERR "BLKGRD %s: _dump_buf_dif=0x%p file=%s\n", __func__,
-	       _dump_buf_dif, file->f_dentry->d_name.name);
+	printk(KERN_ERR	"9060 BLKGRD: %s: _dump_buf_dif=0x%p file=%s\n",
+		__func__, _dump_buf_dif, file->f_dentry->d_name.name);
 	debug->buffer = _dump_buf_dif;
 	if (!debug->buffer) {
 		kfree(debug);
@@ -1377,7 +1377,7 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport)
 			debugfs_create_dir(name, phba->hba_debugfs_root);
 		if (!vport->vport_debugfs_root) {
 			lpfc_printf_vlog(vport, KERN_ERR, LOG_INIT,
-					 "0417 Cant create debugfs");
+					 "0417 Cant create debugfs\n");
 			goto debug_failed;
 		}
 		atomic_inc(&phba->debugfs_vport_count);
@@ -1430,7 +1430,7 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport)
 				 vport, &lpfc_debugfs_op_nodelist);
 	if (!vport->debug_nodelist) {
 		lpfc_printf_vlog(vport, KERN_ERR, LOG_INIT,
-				 "0409 Cant create debugfs nodelist");
+				 "0409 Cant create debugfs nodelist\n");
 		goto debug_failed;
 	}
 debug_failed:
diff --git a/drivers/scsi/lpfc/lpfc_disc.h b/drivers/scsi/lpfc/lpfc_disc.h
index 1142070e9484..2851d75ffc6f 100644
--- a/drivers/scsi/lpfc/lpfc_disc.h
+++ b/drivers/scsi/lpfc/lpfc_disc.h
@@ -19,7 +19,7 @@
  *******************************************************************/
 
 #define FC_MAX_HOLD_RSCN     32	      /* max number of deferred RSCNs */
-#define FC_MAX_NS_RSP        65536    /* max size NameServer rsp */
+#define FC_MAX_NS_RSP        64512    /* max size NameServer rsp */
 #define FC_MAXLOOP           126      /* max devices supported on a fc loop */
 #define LPFC_DISC_FLOGI_TMO  10	      /* Discovery FLOGI ratov */
 
@@ -105,8 +105,6 @@ struct lpfc_nodelist {
 	struct lpfc_vport *vport;
 	struct lpfc_work_evt els_retry_evt;
 	struct lpfc_work_evt dev_loss_evt;
-	unsigned long last_ramp_up_time;        /* jiffy of last ramp up */
-	unsigned long last_q_full_time;		/* jiffy of last queue full */
 	struct kref     kref;
 	atomic_t cmd_pending;
 	uint32_t cmd_qdepth;
diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
index 45337cd23feb..2cc39684ce97 100644
--- a/drivers/scsi/lpfc/lpfc_els.c
+++ b/drivers/scsi/lpfc/lpfc_els.c
@@ -173,13 +173,26 @@ lpfc_prep_els_iocb(struct lpfc_vport *vport, uint8_t expectRsp,
 	 * in FIP mode send FLOGI, FDISC and LOGO as FIP frames.
 	 */
 	if ((did == Fabric_DID) &&
-		bf_get(lpfc_fip_flag, &phba->sli4_hba.sli4_flags) &&
+		(phba->hba_flag & HBA_FIP_SUPPORT) &&
 		((elscmd == ELS_CMD_FLOGI) ||
 		 (elscmd == ELS_CMD_FDISC) ||
 		 (elscmd == ELS_CMD_LOGO)))
-		elsiocb->iocb_flag |= LPFC_FIP_ELS;
+		switch (elscmd) {
+		case ELS_CMD_FLOGI:
+		elsiocb->iocb_flag |= ((ELS_ID_FLOGI << LPFC_FIP_ELS_ID_SHIFT)
+					& LPFC_FIP_ELS_ID_MASK);
+		break;
+		case ELS_CMD_FDISC:
+		elsiocb->iocb_flag |= ((ELS_ID_FDISC << LPFC_FIP_ELS_ID_SHIFT)
+					& LPFC_FIP_ELS_ID_MASK);
+		break;
+		case ELS_CMD_LOGO:
+		elsiocb->iocb_flag |= ((ELS_ID_LOGO << LPFC_FIP_ELS_ID_SHIFT)
+					& LPFC_FIP_ELS_ID_MASK);
+		break;
+		}
 	else
-		elsiocb->iocb_flag &= ~LPFC_FIP_ELS;
+		elsiocb->iocb_flag &= ~LPFC_FIP_ELS_ID_MASK;
 
 	icmd = &elsiocb->iocb;
 
@@ -591,7 +604,7 @@ lpfc_cmpl_els_flogi_fabric(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
 	} else {
 		ndlp->nlp_type |= NLP_FABRIC;
 		lpfc_nlp_set_state(vport, ndlp, NLP_STE_UNMAPPED_NODE);
-		if (vport->vfi_state & LPFC_VFI_REGISTERED) {
+		if (vport->vpi_state & LPFC_VPI_REGISTERED) {
 			lpfc_start_fdiscs(phba);
 			lpfc_do_scr_ns_plogi(phba, vport);
 		} else
@@ -802,7 +815,7 @@ lpfc_cmpl_els_flogi(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
 
 	/* FLOGI completes successfully */
 	lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS,
-			 "0101 FLOGI completes sucessfully "
+			 "0101 FLOGI completes successfully "
 			 "Data: x%x x%x x%x x%x\n",
 			 irsp->un.ulpWord[4], sp->cmn.e_d_tov,
 			 sp->cmn.w2.r_a_tov, sp->cmn.edtovResolution);
@@ -2452,6 +2465,7 @@ lpfc_els_retry_delay_handler(struct lpfc_nodelist *ndlp)
 	 */
 	del_timer_sync(&ndlp->nlp_delayfunc);
 	retry = ndlp->nlp_retry;
+	ndlp->nlp_retry = 0;
 
 	switch (cmd) {
 	case ELS_CMD_FLOGI:
@@ -2711,12 +2725,16 @@ lpfc_els_retry(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
 	    !lpfc_error_lost_link(irsp)) {
 		/* FLOGI retry policy */
 		retry = 1;
-		maxretry = 48;
-		if (cmdiocb->retry >= 32)
+		/* retry forever */
+		maxretry = 0;
+		if (cmdiocb->retry >= 100)
+			delay = 5000;
+		else if (cmdiocb->retry >= 32)
 			delay = 1000;
 	}
 
-	if ((++cmdiocb->retry) >= maxretry) {
+	cmdiocb->retry++;
+	if (maxretry && (cmdiocb->retry >= maxretry)) {
 		phba->fc_stat.elsRetryExceeded++;
 		retry = 0;
 	}
@@ -4124,8 +4142,8 @@ lpfc_els_rcv_rscn(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb,
 	spin_lock_irq(shost->host_lock);
 	if (vport->fc_rscn_flush) {
 		/* Another thread is walking fc_rscn_id_list on this vport */
-		spin_unlock_irq(shost->host_lock);
 		vport->fc_flag |= FC_RSCN_DISCOVERY;
+		spin_unlock_irq(shost->host_lock);
 		/* Send back ACC */
 		lpfc_els_rsp_acc(vport, ELS_CMD_ACC, cmdiocb, ndlp, NULL);
 		return 0;
@@ -4133,7 +4151,7 @@ lpfc_els_rcv_rscn(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb,
 	/* Indicate we are walking fc_rscn_id_list on this vport */
 	vport->fc_rscn_flush = 1;
 	spin_unlock_irq(shost->host_lock);
-	/* Get the array count after sucessfully have the token */
+	/* Get the array count after successfully have the token */
 	rscn_cnt = vport->fc_rscn_id_cnt;
 	/* If we are already processing an RSCN, save the received
 	 * RSCN payload buffer, cmdiocb->context2 to process later.
@@ -4503,6 +4521,29 @@ lpfc_els_rcv_lirr(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb,
 }
 
 /**
+ * lpfc_els_rcv_rrq - Process an unsolicited rrq iocb
+ * @vport: pointer to a host virtual N_Port data structure.
+ * @cmdiocb: pointer to lpfc command iocb data structure.
+ * @ndlp: pointer to a node-list data structure.
+ *
+ * This routine processes a Reinstate Recovery Qualifier (RRQ) IOCB
+ * received as an ELS unsolicited event. A request to RRQ shall only
+ * be accepted if the Originator Nx_Port N_Port_ID or the Responder
+ * Nx_Port N_Port_ID of the target Exchange is the same as the
+ * N_Port_ID of the Nx_Port that makes the request. If the RRQ is
+ * not accepted, an LS_RJT with reason code "Unable to perform
+ * command request" and reason code explanation "Invalid Originator
+ * S_ID" shall be returned. For now, we just unconditionally accept
+ * RRQ from the target.
+ **/
+static void
+lpfc_els_rcv_rrq(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb,
+		 struct lpfc_nodelist *ndlp)
+{
+	lpfc_els_rsp_acc(vport, ELS_CMD_ACC, cmdiocb, ndlp, NULL);
+}
+
+/**
  * lpfc_els_rsp_rps_acc - Completion callbk func for MBX_READ_LNK_STAT mbox cmd
  * @phba: pointer to lpfc hba data structure.
  * @pmb: pointer to the driver internal queue element for mailbox command.
@@ -5396,7 +5437,7 @@ lpfc_els_unsol_buffer(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
 	if (lpfc_els_chk_latt(vport))
 		goto dropit;
 
-	/* Ignore traffic recevied during vport shutdown. */
+	/* Ignore traffic received during vport shutdown. */
 	if (vport->load_flag & FC_UNLOADING)
 		goto dropit;
 
@@ -5618,6 +5659,16 @@ lpfc_els_unsol_buffer(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
 		if (newnode)
 			lpfc_nlp_put(ndlp);
 		break;
+	case ELS_CMD_RRQ:
+		lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_ELS_UNSOL,
+			"RCV RRQ:         did:x%x/ste:x%x flg:x%x",
+			did, vport->port_state, ndlp->nlp_flag);
+
+		phba->fc_stat.elsRcvRRQ++;
+		lpfc_els_rcv_rrq(vport, elsiocb, ndlp);
+		if (newnode)
+			lpfc_nlp_put(ndlp);
+		break;
 	default:
 		lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_ELS_UNSOL,
 			"RCV ELS cmd:     cmd:x%x did:x%x/ste:x%x",
@@ -5670,7 +5721,7 @@ dropit:
  *    NULL - No vport with the matching @vpi found
  *    Otherwise - Address to the vport with the matching @vpi.
  **/
-static struct lpfc_vport *
+struct lpfc_vport *
 lpfc_find_vport_by_vpid(struct lpfc_hba *phba, uint16_t vpi)
 {
 	struct lpfc_vport *vport;
@@ -5897,8 +5948,8 @@ lpfc_cmpl_reg_new_vport(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb)
 				lpfc_initial_fdisc(vport);
 			break;
 		}
-
 	} else {
+		vport->vpi_state |= LPFC_VPI_REGISTERED;
 		if (vport == phba->pport)
 			if (phba->sli_rev < LPFC_SLI_REV4)
 				lpfc_issue_fabric_reglogin(vport);
@@ -6024,11 +6075,6 @@ lpfc_cmpl_els_fdisc(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
 				 irsp->ulpStatus, irsp->un.ulpWord[4]);
 		goto fdisc_failed;
 	}
-		if (vport->fc_vport->vport_state == FC_VPORT_INITIALIZING)
-			lpfc_vport_set_state(vport, FC_VPORT_FAILED);
-		lpfc_nlp_put(ndlp);
-		/* giving up on FDISC. Cancel discovery timer */
-		lpfc_can_disctmo(vport);
 	spin_lock_irq(shost->host_lock);
 	vport->fc_flag |= FC_FABRIC;
 	if (vport->phba->fc_topology == TOPOLOGY_LOOP)
@@ -6107,6 +6153,7 @@ lpfc_issue_els_fdisc(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
 	int did = ndlp->nlp_DID;
 	int rc;
 
+	vport->port_state = LPFC_FDISC;
 	cmdsize = (sizeof(uint32_t) + sizeof(struct serv_parm));
 	elsiocb = lpfc_prep_els_iocb(vport, 1, cmdsize, retry, ndlp, did,
 				     ELS_CMD_FDISC);
@@ -6172,7 +6219,6 @@ lpfc_issue_els_fdisc(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
 		return 1;
 	}
 	lpfc_vport_set_state(vport, FC_VPORT_INITIALIZING);
-	vport->port_state = LPFC_FDISC;
 	return 0;
 }
 
diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c
index e6a47e25b218..2445e399fd60 100644..100755
--- a/drivers/scsi/lpfc/lpfc_hbadisc.c
+++ b/drivers/scsi/lpfc/lpfc_hbadisc.c
@@ -525,8 +525,6 @@ lpfc_work_done(struct lpfc_hba *phba)
 			spin_unlock_irq(&phba->hbalock);
 			lpfc_sli_hbqbuf_add_hbqs(phba, LPFC_ELS_HBQ);
 		}
-		if (phba->hba_flag & HBA_RECEIVE_BUFFER)
-			lpfc_sli4_handle_received_buffer(phba);
 	}
 
 	vports = lpfc_create_vport_work_array(phba);
@@ -568,8 +566,9 @@ lpfc_work_done(struct lpfc_hba *phba)
 	pring = &phba->sli.ring[LPFC_ELS_RING];
 	status = (ha_copy & (HA_RXMASK  << (4*LPFC_ELS_RING)));
 	status >>= (4*LPFC_ELS_RING);
-	if ((status & HA_RXMASK)
-		|| (pring->flag & LPFC_DEFERRED_RING_EVENT)) {
+	if ((status & HA_RXMASK) ||
+	    (pring->flag & LPFC_DEFERRED_RING_EVENT) ||
+	    (phba->hba_flag & HBA_SP_QUEUE_EVT)) {
 		if (pring->flag & LPFC_STOP_IOCB_EVENT) {
 			pring->flag |= LPFC_DEFERRED_RING_EVENT;
 			/* Set the lpfc data pending flag */
@@ -688,7 +687,8 @@ lpfc_cleanup_rpis(struct lpfc_vport *vport, int remove)
 			lpfc_unreg_rpi(vport, ndlp);
 
 		/* Leave Fabric nodes alone on link down */
-		if (!remove && ndlp->nlp_type & NLP_FABRIC)
+		if ((phba->sli_rev < LPFC_SLI_REV4) &&
+		    (!remove && ndlp->nlp_type & NLP_FABRIC))
 			continue;
 		rc = lpfc_disc_state_machine(vport, ndlp, NULL,
 					     remove
@@ -706,6 +706,9 @@ lpfc_cleanup_rpis(struct lpfc_vport *vport, int remove)
 void
 lpfc_port_link_failure(struct lpfc_vport *vport)
 {
+	/* Cleanup any outstanding received buffers */
+	lpfc_cleanup_rcv_buffers(vport);
+
 	/* Cleanup any outstanding RSCN activity */
 	lpfc_els_flush_rscn(vport);
 
@@ -744,6 +747,10 @@ lpfc_linkdown(struct lpfc_hba *phba)
 
 	if (phba->link_state == LPFC_LINK_DOWN)
 		return 0;
+
+	/* Block all SCSI stack I/Os */
+	lpfc_scsi_dev_block(phba);
+
 	spin_lock_irq(&phba->hbalock);
 	phba->fcf.fcf_flag &= ~(FCF_AVAILABLE | FCF_DISCOVERED);
 	if (phba->link_state > LPFC_LINK_DOWN) {
@@ -1015,13 +1022,12 @@ lpfc_mbx_cmpl_reg_fcfi(struct lpfc_hba *phba, LPFC_MBOXQ_t *mboxq)
 		mempool_free(mboxq, phba->mbox_mem_pool);
 		return;
 	}
-	if (vport->port_state != LPFC_FLOGI) {
-		spin_lock_irqsave(&phba->hbalock, flags);
-		phba->fcf.fcf_flag |= (FCF_DISCOVERED | FCF_IN_USE);
-		phba->hba_flag &= ~FCF_DISC_INPROGRESS;
-		spin_unlock_irqrestore(&phba->hbalock, flags);
+	spin_lock_irqsave(&phba->hbalock, flags);
+	phba->fcf.fcf_flag |= (FCF_DISCOVERED | FCF_IN_USE);
+	phba->hba_flag &= ~FCF_DISC_INPROGRESS;
+	spin_unlock_irqrestore(&phba->hbalock, flags);
+	if (vport->port_state != LPFC_FLOGI)
 		lpfc_initial_flogi(vport);
-	}
 
 	mempool_free(mboxq, phba->mbox_mem_pool);
 	return;
@@ -1199,6 +1205,7 @@ lpfc_register_fcf(struct lpfc_hba *phba)
 
 	/* If the FCF is not availabe do nothing. */
 	if (!(phba->fcf.fcf_flag & FCF_AVAILABLE)) {
+		phba->hba_flag &= ~FCF_DISC_INPROGRESS;
 		spin_unlock_irqrestore(&phba->hbalock, flags);
 		return;
 	}
@@ -1216,15 +1223,23 @@ lpfc_register_fcf(struct lpfc_hba *phba)
 
 	fcf_mbxq = mempool_alloc(phba->mbox_mem_pool,
 		GFP_KERNEL);
-	if (!fcf_mbxq)
+	if (!fcf_mbxq) {
+		spin_lock_irqsave(&phba->hbalock, flags);
+		phba->hba_flag &= ~FCF_DISC_INPROGRESS;
+		spin_unlock_irqrestore(&phba->hbalock, flags);
 		return;
+	}
 
 	lpfc_reg_fcfi(phba, fcf_mbxq);
 	fcf_mbxq->vport = phba->pport;
 	fcf_mbxq->mbox_cmpl = lpfc_mbx_cmpl_reg_fcfi;
 	rc = lpfc_sli_issue_mbox(phba, fcf_mbxq, MBX_NOWAIT);
-	if (rc == MBX_NOT_FINISHED)
+	if (rc == MBX_NOT_FINISHED) {
+		spin_lock_irqsave(&phba->hbalock, flags);
+		phba->hba_flag &= ~FCF_DISC_INPROGRESS;
+		spin_unlock_irqrestore(&phba->hbalock, flags);
 		mempool_free(fcf_mbxq, phba->mbox_mem_pool);
+	}
 
 	return;
 }
@@ -1253,13 +1268,27 @@ lpfc_match_fcf_conn_list(struct lpfc_hba *phba,
 			uint16_t *vlan_id)
 {
 	struct lpfc_fcf_conn_entry *conn_entry;
+	int i, j, fcf_vlan_id = 0;
+
+	/* Find the lowest VLAN id in the FCF record */
+	for (i = 0; i < 512; i++) {
+		if (new_fcf_record->vlan_bitmap[i]) {
+			fcf_vlan_id = i * 8;
+			j = 0;
+			while (!((new_fcf_record->vlan_bitmap[i] >> j) & 1)) {
+				j++;
+				fcf_vlan_id++;
+			}
+			break;
+		}
+	}
 
 	/* If FCF not available return 0 */
 	if (!bf_get(lpfc_fcf_record_fcf_avail, new_fcf_record) ||
 		!bf_get(lpfc_fcf_record_fcf_valid, new_fcf_record))
 		return 0;
 
-	if (!phba->cfg_enable_fip) {
+	if (!(phba->hba_flag & HBA_FIP_SUPPORT)) {
 		*boot_flag = 0;
 		*addr_mode = bf_get(lpfc_fcf_record_mac_addr_prov,
 				new_fcf_record);
@@ -1286,7 +1315,11 @@ lpfc_match_fcf_conn_list(struct lpfc_hba *phba,
 		if (*addr_mode & LPFC_FCF_FPMA)
 			*addr_mode = LPFC_FCF_FPMA;
 
-		*vlan_id = 0xFFFF;
+		/* If FCF record report a vlan id use that vlan id */
+		if (fcf_vlan_id)
+			*vlan_id = fcf_vlan_id;
+		else
+			*vlan_id = 0xFFFF;
 		return 1;
 	}
 
@@ -1384,8 +1417,15 @@ lpfc_match_fcf_conn_list(struct lpfc_hba *phba,
 			(*addr_mode & LPFC_FCF_FPMA))
 				*addr_mode = LPFC_FCF_FPMA;
 
+		/* If matching connect list has a vlan id, use it */
 		if (conn_entry->conn_rec.flags & FCFCNCT_VLAN_VALID)
 			*vlan_id = conn_entry->conn_rec.vlan_tag;
+		/*
+		 * If no vlan id is specified in connect list, use the vlan id
+		 * in the FCF record
+		 */
+		else if (fcf_vlan_id)
+			*vlan_id = fcf_vlan_id;
 		else
 			*vlan_id = 0xFFFF;
 
@@ -1423,6 +1463,15 @@ lpfc_check_pending_fcoe_event(struct lpfc_hba *phba, uint8_t unreg_fcf)
 
 	if (phba->link_state >= LPFC_LINK_UP)
 		lpfc_sli4_read_fcf_record(phba, LPFC_FCOE_FCF_GET_FIRST);
+	else {
+		/*
+		 * Do not continue FCF discovery and clear FCF_DISC_INPROGRESS
+		 * flag
+		 */
+		spin_lock_irq(&phba->hbalock);
+		phba->hba_flag &= ~FCF_DISC_INPROGRESS;
+		spin_unlock_irq(&phba->hbalock);
+	}
 
 	if (unreg_fcf) {
 		spin_lock_irq(&phba->hbalock);
@@ -1510,10 +1559,16 @@ lpfc_mbx_cmpl_read_fcf_record(struct lpfc_hba *phba, LPFC_MBOXQ_t *mboxq)
 	 * to book keeping the FCFIs can be used.
 	 */
 	if (shdr_status || shdr_add_status) {
-		lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
-				"2521 READ_FCF_RECORD mailbox failed "
-				"with status x%x add_status x%x, mbx\n",
-				shdr_status, shdr_add_status);
+		if (shdr_status == STATUS_FCF_TABLE_EMPTY) {
+			lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
+					"2726 READ_FCF_RECORD Indicates empty "
+					"FCF table.\n");
+		} else {
+			lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
+					"2521 READ_FCF_RECORD mailbox failed "
+					"with status x%x add_status x%x, mbx\n",
+					shdr_status, shdr_add_status);
+		}
 		goto out;
 	}
 	/* Interpreting the returned information of FCF records */
@@ -1653,15 +1708,16 @@ lpfc_init_vpi_cmpl(struct lpfc_hba *phba, LPFC_MBOXQ_t *mboxq)
 		lpfc_vport_set_state(vport, FC_VPORT_FAILED);
 		return;
 	}
+	spin_lock_irq(&phba->hbalock);
 	vport->fc_flag &= ~FC_VPORT_NEEDS_INIT_VPI;
+	spin_unlock_irq(&phba->hbalock);
 
 	if (phba->link_flag & LS_NPIV_FAB_SUPPORTED)
 		lpfc_initial_fdisc(vport);
 	else {
 		lpfc_vport_set_state(vport, FC_VPORT_NO_FABRIC_SUPP);
-		lpfc_printf_vlog(vport, KERN_ERR,
-			LOG_ELS,
-			"2606 No NPIV Fabric support\n");
+		lpfc_printf_vlog(vport, KERN_ERR, LOG_ELS,
+				 "2606 No NPIV Fabric support\n");
 	}
 	return;
 }
@@ -1756,8 +1812,8 @@ lpfc_mbx_cmpl_reg_vfi(struct lpfc_hba *phba, LPFC_MBOXQ_t *mboxq)
 		lpfc_vport_set_state(vport, FC_VPORT_FAILED);
 		goto fail_free_mem;
 	}
-	/* Mark the vport has registered with its VFI */
-	vport->vfi_state |= LPFC_VFI_REGISTERED;
+	/* The VPI is implicitly registered when the VFI is registered */
+	vport->vpi_state |= LPFC_VPI_REGISTERED;
 
 	if (vport->port_state == LPFC_FABRIC_CFG_LINK) {
 		lpfc_start_fdiscs(phba);
@@ -1861,7 +1917,10 @@ lpfc_mbx_process_link_up(struct lpfc_hba *phba, READ_LA_VAR *la)
 	if (phba->fc_topology == TOPOLOGY_LOOP) {
 		phba->sli3_options &= ~LPFC_SLI3_NPIV_ENABLED;
 
-		if (phba->cfg_enable_npiv)
+		/* if npiv is enabled and this adapter supports npiv log
+		 * a message that npiv is not supported in this topology
+		 */
+		if (phba->cfg_enable_npiv && phba->max_vpi)
 			lpfc_printf_log(phba, KERN_ERR, LOG_LINK_EVENT,
 				"1309 Link Up Event npiv not supported in loop "
 				"topology\n");
@@ -1955,7 +2014,7 @@ lpfc_mbx_process_link_up(struct lpfc_hba *phba, READ_LA_VAR *la)
 		 * is phase 1 implementation that support FCF index 0 and driver
 		 * defaults.
 		 */
-		if (phba->cfg_enable_fip == 0) {
+		if (!(phba->hba_flag & HBA_FIP_SUPPORT)) {
 			fcf_record = kzalloc(sizeof(struct fcf_record),
 					GFP_KERNEL);
 			if (unlikely(!fcf_record)) {
@@ -2085,6 +2144,7 @@ lpfc_mbx_cmpl_read_la(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb)
 	else
 		phba->sli.sli_flag &= ~LPFC_MENLO_MAINT;
 
+	phba->link_events++;
 	if (la->attType == AT_LINK_UP && (!la->mm)) {
 		phba->fc_stat.LinkUp++;
 		if (phba->link_flag & LS_LOOPBACK_MODE) {
@@ -2211,13 +2271,17 @@ lpfc_mbx_cmpl_unreg_vpi(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb)
 				 mb->mbxStatus);
 		break;
 	}
+	spin_lock_irq(&phba->hbalock);
+	vport->vpi_state &= ~LPFC_VPI_REGISTERED;
+	vport->fc_flag |= FC_VPORT_NEEDS_REG_VPI;
+	spin_unlock_irq(&phba->hbalock);
 	vport->unreg_vpi_cmpl = VPORT_OK;
 	mempool_free(pmb, phba->mbox_mem_pool);
 	/*
 	 * This shost reference might have been taken at the beginning of
 	 * lpfc_vport_delete()
 	 */
-	if (vport->load_flag & FC_UNLOADING)
+	if ((vport->load_flag & FC_UNLOADING) && (vport != phba->pport))
 		scsi_host_put(shost);
 }
 
@@ -2268,6 +2332,7 @@ lpfc_mbx_cmpl_reg_vpi(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb)
 		goto out;
 	}
 
+	vport->vpi_state |= LPFC_VPI_REGISTERED;
 	vport->num_disc_nodes = 0;
 	/* go thru NPR list and issue ELS PLOGIs */
 	if (vport->fc_npr_cnt)
@@ -3077,7 +3142,7 @@ lpfc_no_rpi(struct lpfc_hba *phba, struct lpfc_nodelist *ndlp)
 	struct lpfc_sli *psli;
 	struct lpfc_sli_ring *pring;
 	struct lpfc_iocbq *iocb, *next_iocb;
-	uint32_t rpi, i;
+	uint32_t i;
 
 	lpfc_fabric_abort_nport(ndlp);
 
@@ -3086,7 +3151,6 @@ lpfc_no_rpi(struct lpfc_hba *phba, struct lpfc_nodelist *ndlp)
 	 * by firmware with a no rpi error.
 	 */
 	psli = &phba->sli;
-	rpi = ndlp->nlp_rpi;
 	if (ndlp->nlp_flag & NLP_RPI_VALID) {
 		/* Now process each ring */
 		for (i = 0; i < psli->num_rings; i++) {
@@ -4322,6 +4386,14 @@ lpfc_fcf_inuse(struct lpfc_hba *phba)
 				ret = 1;
 				spin_unlock_irq(shost->host_lock);
 				goto out;
+			} else {
+				lpfc_printf_log(phba, KERN_INFO, LOG_ELS,
+					"2624 RPI %x DID %x flg %x still "
+					"logged in\n",
+					ndlp->nlp_rpi, ndlp->nlp_DID,
+					ndlp->nlp_flag);
+				if (ndlp->nlp_flag & NLP_RPI_VALID)
+					ret = 1;
 			}
 		}
 		spin_unlock_irq(shost->host_lock);
@@ -4400,7 +4472,7 @@ lpfc_unregister_unused_fcf(struct lpfc_hba *phba)
 	 */
 	if (!(phba->hba_flag & HBA_FCOE_SUPPORT) ||
 		!(phba->fcf.fcf_flag & FCF_REGISTERED) ||
-		(phba->cfg_enable_fip == 0)) {
+		(!(phba->hba_flag & HBA_FIP_SUPPORT))) {
 		spin_unlock_irq(&phba->hbalock);
 		return;
 	}
@@ -4409,6 +4481,8 @@ lpfc_unregister_unused_fcf(struct lpfc_hba *phba)
 	if (lpfc_fcf_inuse(phba))
 		return;
 
+	/* At this point, all discovery is aborted */
+	phba->pport->port_state = LPFC_VPORT_UNKNOWN;
 
 	/* Unregister VPIs */
 	vports = lpfc_create_vport_work_array(phba);
@@ -4416,8 +4490,10 @@ lpfc_unregister_unused_fcf(struct lpfc_hba *phba)
 		(phba->sli3_options & LPFC_SLI3_NPIV_ENABLED))
 		for (i = 0; i <= phba->max_vports && vports[i] != NULL; i++) {
 			lpfc_mbx_unreg_vpi(vports[i]);
-			vports[i]->fc_flag |= FC_VPORT_NEEDS_REG_VPI;
-			vports[i]->vfi_state &= ~LPFC_VFI_REGISTERED;
+			spin_lock_irq(&phba->hbalock);
+			vports[i]->fc_flag |= FC_VPORT_NEEDS_INIT_VPI;
+			vports[i]->vpi_state &= ~LPFC_VPI_REGISTERED;
+			spin_unlock_irq(&phba->hbalock);
 		}
 	lpfc_destroy_vport_work_array(phba, vports);
 
@@ -4431,7 +4507,7 @@ lpfc_unregister_unused_fcf(struct lpfc_hba *phba)
 		return;
 	}
 
-	lpfc_unreg_vfi(mbox, phba->pport->vfi);
+	lpfc_unreg_vfi(mbox, phba->pport);
 	mbox->vport = phba->pport;
 	mbox->mbox_cmpl = lpfc_unregister_vfi_cmpl;
 
@@ -4512,8 +4588,10 @@ lpfc_read_fcf_conn_tbl(struct lpfc_hba *phba,
 
 	/* Free the current connect table */
 	list_for_each_entry_safe(conn_entry, next_conn_entry,
-		&phba->fcf_conn_rec_list, list)
+		&phba->fcf_conn_rec_list, list) {
+		list_del_init(&conn_entry->list);
 		kfree(conn_entry);
+	}
 
 	conn_hdr = (struct lpfc_fcf_conn_hdr *) buff;
 	record_count = conn_hdr->length * sizeof(uint32_t)/
@@ -4569,14 +4647,6 @@ lpfc_read_fcoe_param(struct lpfc_hba *phba,
 		(fcoe_param_hdr->length != FCOE_PARAM_LENGTH))
 		return;
 
-	if (bf_get(lpfc_fip_param_hdr_fipp_mode, fcoe_param_hdr) ==
-			FIPP_MODE_ON)
-		phba->cfg_enable_fip = 1;
-
-	if (bf_get(lpfc_fip_param_hdr_fipp_mode, fcoe_param_hdr) ==
-		FIPP_MODE_OFF)
-		phba->cfg_enable_fip = 0;
-
 	if (fcoe_param_hdr->parm_flags & FIPP_VLAN_VALID) {
 		phba->valid_vlan = 1;
 		phba->vlan_id = le16_to_cpu(fcoe_param->vlan_tag) &
diff --git a/drivers/scsi/lpfc/lpfc_hw.h b/drivers/scsi/lpfc/lpfc_hw.h
index ccb26724dc53..c9faa1d8c3c8 100644
--- a/drivers/scsi/lpfc/lpfc_hw.h
+++ b/drivers/scsi/lpfc/lpfc_hw.h
@@ -1124,21 +1124,6 @@ typedef struct {
 /* Number of 4-byte words in an IOCB. */
 #define IOCB_WORD_SZ    8
 
-/* defines for type field in fc header */
-#define FC_ELS_DATA     0x1
-#define FC_LLC_SNAP     0x5
-#define FC_FCP_DATA     0x8
-#define FC_COMMON_TRANSPORT_ULP 0x20
-
-/* defines for rctl field in fc header */
-#define FC_DEV_DATA     0x0
-#define FC_UNSOL_CTL    0x2
-#define FC_SOL_CTL      0x3
-#define FC_UNSOL_DATA   0x4
-#define FC_FCP_CMND     0x6
-#define FC_ELS_REQ      0x22
-#define FC_ELS_RSP      0x23
-
 /* network headers for Dfctl field */
 #define FC_NET_HDR      0x20
 
@@ -1183,6 +1168,8 @@ typedef struct {
 #define PCI_DEVICE_ID_ZEPHYR_DCSP   0xfe12
 #define PCI_VENDOR_ID_SERVERENGINE  0x19a2
 #define PCI_DEVICE_ID_TIGERSHARK    0x0704
+#define PCI_DEVICE_ID_TOMCAT        0x0714
+#define PCI_DEVICE_ID_FALCON        0xf180
 
 #define JEDEC_ID_ADDRESS            0x0080001c
 #define FIREFLY_JEDEC_ID            0x1ACC
@@ -1444,6 +1431,7 @@ typedef struct {		/* FireFly BIU registers */
 #define CMD_ABORT_MXRI64_CN     0x8C
 #define CMD_RCV_ELS_REQ64_CX    0x8D
 #define CMD_XMIT_ELS_RSP64_CX   0x95
+#define CMD_XMIT_BLS_RSP64_CX   0x97
 #define CMD_FCP_IWRITE64_CR     0x98
 #define CMD_FCP_IWRITE64_CX     0x99
 #define CMD_FCP_IREAD64_CR      0x9A
@@ -2306,8 +2294,7 @@ typedef struct {
 	uint32_t rsvd1;
 	uint32_t rsvd2:8;
 	uint32_t sid:24;
-	uint32_t rsvd3;
-	uint32_t rsvd4;
+	uint32_t wwn[2];
 	uint32_t rsvd5;
 	uint16_t vfi;
 	uint16_t vpi;
@@ -2315,8 +2302,7 @@ typedef struct {
 	uint32_t rsvd1;
 	uint32_t sid:24;
 	uint32_t rsvd2:8;
-	uint32_t rsvd3;
-	uint32_t rsvd4;
+	uint32_t wwn[2];
 	uint32_t rsvd5;
 	uint16_t vpi;
 	uint16_t vfi;
@@ -2326,7 +2312,13 @@ typedef struct {
 /* Structure for MB Command UNREG_VPI (0x97) */
 typedef struct {
 	uint32_t rsvd1;
-	uint32_t rsvd2;
+#ifdef __BIG_ENDIAN_BITFIELD
+	uint16_t rsvd2;
+	uint16_t sli4_vpi;
+#else	/*  __LITTLE_ENDIAN */
+	uint16_t sli4_vpi;
+	uint16_t rsvd2;
+#endif
 	uint32_t rsvd3;
 	uint32_t rsvd4;
 	uint32_t rsvd5;
@@ -3547,7 +3539,7 @@ typedef struct _IOCB {	/* IOCB structure */
 		ASYNCSTAT_FIELDS asyncstat; /* async_status iocb */
 		QUE_XRI64_CX_FIELDS quexri64cx; /* que_xri64_cx fields */
 		struct rcv_seq64 rcvseq64;	/* RCV_SEQ64 and RCV_CONT64 */
-
+		struct sli4_bls_acc bls_acc; /* UNSOL ABTS BLS_ACC params */
 		uint32_t ulpWord[IOCB_WORD_SZ - 2];	/* generic 6 'words' */
 	} un;
 	union {
diff --git a/drivers/scsi/lpfc/lpfc_hw4.h b/drivers/scsi/lpfc/lpfc_hw4.h
index 3689eee04535..8a2a1c5935c6 100644..100755
--- a/drivers/scsi/lpfc/lpfc_hw4.h
+++ b/drivers/scsi/lpfc/lpfc_hw4.h
@@ -194,6 +194,26 @@ struct lpfc_sli4_flags {
 #define lpfc_fip_flag_WORD word0
 };
 
+struct sli4_bls_acc {
+	uint32_t word0_rsvd;      /* Word0 must be reserved */
+	uint32_t word1;
+#define lpfc_abts_orig_SHIFT      0
+#define lpfc_abts_orig_MASK       0x00000001
+#define lpfc_abts_orig_WORD       word1
+#define LPFC_ABTS_UNSOL_RSP       1
+#define LPFC_ABTS_UNSOL_INT       0
+	uint32_t word2;
+#define lpfc_abts_rxid_SHIFT      0
+#define lpfc_abts_rxid_MASK       0x0000FFFF
+#define lpfc_abts_rxid_WORD       word2
+#define lpfc_abts_oxid_SHIFT      16
+#define lpfc_abts_oxid_MASK       0x0000FFFF
+#define lpfc_abts_oxid_WORD       word2
+	uint32_t word3;
+	uint32_t word4;
+	uint32_t word5_rsvd;	/* Word5 must be reserved */
+};
+
 /* event queue entry structure */
 struct lpfc_eqe {
 	uint32_t word0;
@@ -425,7 +445,7 @@ struct lpfc_wqe_generic{
 #define lpfc_wqe_gen_status_MASK	0x0000000F
 #define lpfc_wqe_gen_status_WORD	word7
 #define lpfc_wqe_gen_ct_SHIFT		2
-#define lpfc_wqe_gen_ct_MASK		0x00000007
+#define lpfc_wqe_gen_ct_MASK		0x00000003
 #define lpfc_wqe_gen_ct_WORD		word7
 	uint32_t abort_tag;
 	uint32_t word9;
@@ -453,6 +473,13 @@ struct lpfc_wqe_generic{
 #define lpfc_wqe_gen_wqec_SHIFT		7
 #define lpfc_wqe_gen_wqec_MASK		0x00000001
 #define lpfc_wqe_gen_wqec_WORD		word11
+#define ELS_ID_FLOGI 3
+#define ELS_ID_FDISC 2
+#define ELS_ID_LOGO  1
+#define ELS_ID_DEFAULT 0
+#define lpfc_wqe_gen_els_id_SHIFT	4
+#define lpfc_wqe_gen_els_id_MASK	0x00000003
+#define lpfc_wqe_gen_els_id_WORD	word11
 #define lpfc_wqe_gen_cmd_type_SHIFT	0
 #define lpfc_wqe_gen_cmd_type_MASK	0x0000000F
 #define lpfc_wqe_gen_cmd_type_WORD	word11
@@ -487,8 +514,8 @@ struct lpfc_register {
 
 #define LPFC_UERR_STATUS_HI		0x00A4
 #define LPFC_UERR_STATUS_LO		0x00A0
-#define LPFC_ONLINE0			0x00B0
-#define LPFC_ONLINE1			0x00B4
+#define LPFC_UE_MASK_HI			0x00AC
+#define LPFC_UE_MASK_LO			0x00A8
 #define LPFC_SCRATCHPAD			0x0058
 
 /* BAR0 Registers */
@@ -760,6 +787,7 @@ struct mbox_header {
 #define LPFC_MBOX_OPCODE_MQ_DESTROY		0x35
 #define LPFC_MBOX_OPCODE_CQ_DESTROY		0x36
 #define LPFC_MBOX_OPCODE_EQ_DESTROY		0x37
+#define LPFC_MBOX_OPCODE_QUERY_FW_CFG		0x3A
 #define LPFC_MBOX_OPCODE_FUNCTION_RESET		0x3D
 
 /* FCoE Opcodes */
@@ -985,7 +1013,7 @@ struct lpfc_mbx_wq_destroy {
 };
 
 #define LPFC_HDR_BUF_SIZE 128
-#define LPFC_DATA_BUF_SIZE 4096
+#define LPFC_DATA_BUF_SIZE 2048
 struct rq_context {
 	uint32_t word0;
 #define lpfc_rq_context_rq_size_SHIFT	16
@@ -1273,6 +1301,51 @@ struct lpfc_mbx_del_fcf_tbl_entry {
 #define lpfc_mbx_del_fcf_tbl_index_WORD		word10
 };
 
+struct lpfc_mbx_query_fw_cfg {
+	struct mbox_header header;
+	uint32_t config_number;
+	uint32_t asic_rev;
+	uint32_t phys_port;
+	uint32_t function_mode;
+/* firmware Function Mode */
+#define lpfc_function_mode_toe_SHIFT		0
+#define lpfc_function_mode_toe_MASK		0x00000001
+#define lpfc_function_mode_toe_WORD		function_mode
+#define lpfc_function_mode_nic_SHIFT		1
+#define lpfc_function_mode_nic_MASK		0x00000001
+#define lpfc_function_mode_nic_WORD		function_mode
+#define lpfc_function_mode_rdma_SHIFT		2
+#define lpfc_function_mode_rdma_MASK		0x00000001
+#define lpfc_function_mode_rdma_WORD		function_mode
+#define lpfc_function_mode_vm_SHIFT		3
+#define lpfc_function_mode_vm_MASK		0x00000001
+#define lpfc_function_mode_vm_WORD		function_mode
+#define lpfc_function_mode_iscsi_i_SHIFT	4
+#define lpfc_function_mode_iscsi_i_MASK		0x00000001
+#define lpfc_function_mode_iscsi_i_WORD		function_mode
+#define lpfc_function_mode_iscsi_t_SHIFT	5
+#define lpfc_function_mode_iscsi_t_MASK		0x00000001
+#define lpfc_function_mode_iscsi_t_WORD		function_mode
+#define lpfc_function_mode_fcoe_i_SHIFT		6
+#define lpfc_function_mode_fcoe_i_MASK		0x00000001
+#define lpfc_function_mode_fcoe_i_WORD		function_mode
+#define lpfc_function_mode_fcoe_t_SHIFT		7
+#define lpfc_function_mode_fcoe_t_MASK		0x00000001
+#define lpfc_function_mode_fcoe_t_WORD		function_mode
+#define lpfc_function_mode_dal_SHIFT		8
+#define lpfc_function_mode_dal_MASK		0x00000001
+#define lpfc_function_mode_dal_WORD		function_mode
+#define lpfc_function_mode_lro_SHIFT		9
+#define lpfc_function_mode_lro_MASK		0x00000001
+#define lpfc_function_mode_lro_WORD		function_mode9
+#define lpfc_function_mode_flex10_SHIFT		10
+#define lpfc_function_mode_flex10_MASK		0x00000001
+#define lpfc_function_mode_flex10_WORD		function_mode
+#define lpfc_function_mode_ncsi_SHIFT		11
+#define lpfc_function_mode_ncsi_MASK		0x00000001
+#define lpfc_function_mode_ncsi_WORD		function_mode
+};
+
 /* Status field for embedded SLI_CONFIG mailbox command */
 #define STATUS_SUCCESS					0x0
 #define STATUS_FAILED 					0x1
@@ -1298,6 +1371,7 @@ struct lpfc_mbx_del_fcf_tbl_entry {
 #define STATUS_ERROR_ACITMAIN				0x2a
 #define STATUS_REBOOT_REQUIRED				0x2c
 #define STATUS_FCF_IN_USE				0x3a
+#define STATUS_FCF_TABLE_EMPTY				0x43
 
 struct lpfc_mbx_sli4_config {
 	struct mbox_header header;
@@ -1349,8 +1423,7 @@ struct lpfc_mbx_reg_vfi {
 #define lpfc_reg_vfi_fcfi_SHIFT		0
 #define lpfc_reg_vfi_fcfi_MASK		0x0000FFFF
 #define lpfc_reg_vfi_fcfi_WORD		word2
-	uint32_t word3_rsvd;
-	uint32_t word4_rsvd;
+	uint32_t wwn[2];
 	struct ulp_bde64 bde;
 	uint32_t word8_rsvd;
 	uint32_t word9_rsvd;
@@ -1555,6 +1628,11 @@ struct lpfc_mbx_read_rev {
 #define lpfc_mbx_rd_rev_fcoe_SHIFT		20
 #define lpfc_mbx_rd_rev_fcoe_MASK		0x00000001
 #define lpfc_mbx_rd_rev_fcoe_WORD		word1
+#define lpfc_mbx_rd_rev_cee_ver_SHIFT		21
+#define lpfc_mbx_rd_rev_cee_ver_MASK		0x00000003
+#define lpfc_mbx_rd_rev_cee_ver_WORD		word1
+#define LPFC_PREDCBX_CEE_MODE	0
+#define LPFC_DCBX_CEE_MODE	1
 #define lpfc_mbx_rd_rev_vpd_SHIFT		29
 #define lpfc_mbx_rd_rev_vpd_MASK		0x00000001
 #define lpfc_mbx_rd_rev_vpd_WORD		word1
@@ -1804,6 +1882,7 @@ struct lpfc_mqe {
 		struct lpfc_mbx_read_config rd_config;
 		struct lpfc_mbx_request_features req_ftrs;
 		struct lpfc_mbx_post_hdr_tmpl hdr_tmpl;
+		struct lpfc_mbx_query_fw_cfg query_fw_cfg;
 		struct lpfc_mbx_nop nop;
 	} un;
 };
@@ -1885,7 +1964,7 @@ struct lpfc_acqe_link {
 };
 
 struct lpfc_acqe_fcoe {
-	uint32_t fcf_index;
+	uint32_t index;
 	uint32_t word1;
 #define lpfc_acqe_fcoe_fcf_count_SHIFT		0
 #define lpfc_acqe_fcoe_fcf_count_MASK		0x0000FFFF
@@ -1896,6 +1975,7 @@ struct lpfc_acqe_fcoe {
 #define LPFC_FCOE_EVENT_TYPE_NEW_FCF		0x1
 #define LPFC_FCOE_EVENT_TYPE_FCF_TABLE_FULL	0x2
 #define LPFC_FCOE_EVENT_TYPE_FCF_DEAD		0x3
+#define LPFC_FCOE_EVENT_TYPE_CVL		0x4
 	uint32_t event_tag;
 	uint32_t trailer;
 };
@@ -1921,12 +2001,13 @@ struct lpfc_bmbx_create {
 #define SGL_ALIGN_SZ 64
 #define SGL_PAGE_SIZE 4096
 /* align SGL addr on a size boundary - adjust address up */
-#define NO_XRI ((uint16_t)-1)
+#define NO_XRI  ((uint16_t)-1)
+
 struct wqe_common {
 	uint32_t word6;
-#define wqe_xri_SHIFT         0
-#define wqe_xri_MASK          0x0000FFFF
-#define wqe_xri_WORD          word6
+#define wqe_xri_tag_SHIFT     0
+#define wqe_xri_tag_MASK      0x0000FFFF
+#define wqe_xri_tag_WORD      word6
 #define wqe_ctxt_tag_SHIFT    16
 #define wqe_ctxt_tag_MASK     0x0000FFFF
 #define wqe_ctxt_tag_WORD     word6
@@ -1987,7 +2068,7 @@ struct wqe_common {
 #define wqe_wqec_MASK       0x00000001
 #define wqe_wqec_WORD       word11
 #define wqe_cqid_SHIFT      16
-#define wqe_cqid_MASK       0x000003ff
+#define wqe_cqid_MASK       0x0000ffff
 #define wqe_cqid_WORD       word11
 };
 
@@ -1996,6 +2077,9 @@ struct wqe_did {
 #define wqe_els_did_SHIFT         0
 #define wqe_els_did_MASK          0x00FFFFFF
 #define wqe_els_did_WORD          word5
+#define wqe_xmit_bls_pt_SHIFT         28
+#define wqe_xmit_bls_pt_MASK          0x00000003
+#define wqe_xmit_bls_pt_WORD          word5
 #define wqe_xmit_bls_ar_SHIFT         30
 #define wqe_xmit_bls_ar_MASK          0x00000001
 #define wqe_xmit_bls_ar_WORD          word5
@@ -2044,6 +2128,23 @@ struct xmit_els_rsp64_wqe {
 
 struct xmit_bls_rsp64_wqe {
 	uint32_t payload0;
+/* Payload0 for BA_ACC */
+#define xmit_bls_rsp64_acc_seq_id_SHIFT        16
+#define xmit_bls_rsp64_acc_seq_id_MASK         0x000000ff
+#define xmit_bls_rsp64_acc_seq_id_WORD         payload0
+#define xmit_bls_rsp64_acc_seq_id_vald_SHIFT   24
+#define xmit_bls_rsp64_acc_seq_id_vald_MASK    0x000000ff
+#define xmit_bls_rsp64_acc_seq_id_vald_WORD    payload0
+/* Payload0 for BA_RJT */
+#define xmit_bls_rsp64_rjt_vspec_SHIFT   0
+#define xmit_bls_rsp64_rjt_vspec_MASK    0x000000ff
+#define xmit_bls_rsp64_rjt_vspec_WORD    payload0
+#define xmit_bls_rsp64_rjt_expc_SHIFT    8
+#define xmit_bls_rsp64_rjt_expc_MASK     0x000000ff
+#define xmit_bls_rsp64_rjt_expc_WORD     payload0
+#define xmit_bls_rsp64_rjt_rsnc_SHIFT    16
+#define xmit_bls_rsp64_rjt_rsnc_MASK     0x000000ff
+#define xmit_bls_rsp64_rjt_rsnc_WORD     payload0
 	uint32_t word1;
 #define xmit_bls_rsp64_rxid_SHIFT  0
 #define xmit_bls_rsp64_rxid_MASK   0x0000ffff
@@ -2052,18 +2153,19 @@ struct xmit_bls_rsp64_wqe {
 #define xmit_bls_rsp64_oxid_MASK   0x0000ffff
 #define xmit_bls_rsp64_oxid_WORD   word1
 	uint32_t word2;
-#define xmit_bls_rsp64_seqcntlo_SHIFT  0
-#define xmit_bls_rsp64_seqcntlo_MASK   0x0000ffff
-#define xmit_bls_rsp64_seqcntlo_WORD   word2
-#define xmit_bls_rsp64_seqcnthi_SHIFT  16
+#define xmit_bls_rsp64_seqcnthi_SHIFT  0
 #define xmit_bls_rsp64_seqcnthi_MASK   0x0000ffff
 #define xmit_bls_rsp64_seqcnthi_WORD   word2
+#define xmit_bls_rsp64_seqcntlo_SHIFT  16
+#define xmit_bls_rsp64_seqcntlo_MASK   0x0000ffff
+#define xmit_bls_rsp64_seqcntlo_WORD   word2
 	uint32_t rsrvd3;
 	uint32_t rsrvd4;
 	struct wqe_did	wqe_dest;
 	struct wqe_common wqe_com; /* words 6-11 */
 	uint32_t rsvd_12_15[4];
 };
+
 struct wqe_rctl_dfctl {
 	uint32_t word5;
 #define wqe_si_SHIFT 2
diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index 562d8cee874b..b8eb1b6e5e77 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -28,6 +28,7 @@
 #include <linux/pci.h>
 #include <linux/spinlock.h>
 #include <linux/ctype.h>
+#include <linux/aer.h>
 
 #include <scsi/scsi.h>
 #include <scsi/scsi_device.h>
@@ -645,7 +646,7 @@ lpfc_hba_down_prep(struct lpfc_hba *phba)
  * down the SLI Layer.
  *
  * Return codes
- *   0 - sucess.
+ *   0 - success.
  *   Any other value - error.
  **/
 static int
@@ -700,7 +701,7 @@ lpfc_hba_down_post_s3(struct lpfc_hba *phba)
  * down the SLI Layer.
  *
  * Return codes
- *   0 - sucess.
+ *   0 - success.
  *   Any other value - error.
  **/
 static int
@@ -755,7 +756,7 @@ lpfc_hba_down_post_s4(struct lpfc_hba *phba)
  * uninitialization after the HBA is reset when bring down the SLI Layer.
  *
  * Return codes
- *   0 - sucess.
+ *   0 - success.
  *   Any other value - error.
  **/
 int
@@ -852,12 +853,19 @@ lpfc_hb_mbox_cmpl(struct lpfc_hba * phba, LPFC_MBOXQ_t * pmboxq)
 void
 lpfc_hb_timeout_handler(struct lpfc_hba *phba)
 {
+	struct lpfc_vport **vports;
 	LPFC_MBOXQ_t *pmboxq;
 	struct lpfc_dmabuf *buf_ptr;
-	int retval;
+	int retval, i;
 	struct lpfc_sli *psli = &phba->sli;
 	LIST_HEAD(completions);
 
+	vports = lpfc_create_vport_work_array(phba);
+	if (vports != NULL)
+		for (i = 0; i <= phba->max_vports && vports[i] != NULL; i++)
+			lpfc_rcv_seq_check_edtov(vports[i]);
+	lpfc_destroy_vport_work_array(phba, vports);
+
 	if ((phba->link_state == LPFC_HBA_ERROR) ||
 		(phba->pport->load_flag & FC_UNLOADING) ||
 		(phba->pport->fc_flag & FC_OFFLINE_MODE))
@@ -1254,7 +1262,7 @@ lpfc_handle_eratt_s4(struct lpfc_hba *phba)
  * routine from the API jump table function pointer from the lpfc_hba struct.
  *
  * Return codes
- *   0 - sucess.
+ *   0 - success.
  *   Any other value - error.
  **/
 void
@@ -1521,10 +1529,10 @@ lpfc_get_hba_model_desc(struct lpfc_hba *phba, uint8_t *mdp, uint8_t *descp)
 	int GE = 0;
 	int oneConnect = 0; /* default is not a oneConnect */
 	struct {
-		char * name;
-		int    max_speed;
-		char * bus;
-	} m = {"<Unknown>", 0, ""};
+		char *name;
+		char *bus;
+		char *function;
+	} m = {"<Unknown>", "", ""};
 
 	if (mdp && mdp[0] != '\0'
 		&& descp && descp[0] != '\0')
@@ -1545,132 +1553,155 @@ lpfc_get_hba_model_desc(struct lpfc_hba *phba, uint8_t *mdp, uint8_t *descp)
 
 	switch (dev_id) {
 	case PCI_DEVICE_ID_FIREFLY:
-		m = (typeof(m)){"LP6000", max_speed, "PCI"};
+		m = (typeof(m)){"LP6000", "PCI", "Fibre Channel Adapter"};
 		break;
 	case PCI_DEVICE_ID_SUPERFLY:
 		if (vp->rev.biuRev >= 1 && vp->rev.biuRev <= 3)
-			m = (typeof(m)){"LP7000", max_speed,  "PCI"};
+			m = (typeof(m)){"LP7000", "PCI",
+					"Fibre Channel Adapter"};
 		else
-			m = (typeof(m)){"LP7000E", max_speed, "PCI"};
+			m = (typeof(m)){"LP7000E", "PCI",
+					"Fibre Channel Adapter"};
 		break;
 	case PCI_DEVICE_ID_DRAGONFLY:
-		m = (typeof(m)){"LP8000", max_speed, "PCI"};
+		m = (typeof(m)){"LP8000", "PCI",
+				"Fibre Channel Adapter"};
 		break;
 	case PCI_DEVICE_ID_CENTAUR:
 		if (FC_JEDEC_ID(vp->rev.biuRev) == CENTAUR_2G_JEDEC_ID)
-			m = (typeof(m)){"LP9002", max_speed, "PCI"};
+			m = (typeof(m)){"LP9002", "PCI",
+					"Fibre Channel Adapter"};
 		else
-			m = (typeof(m)){"LP9000", max_speed, "PCI"};
+			m = (typeof(m)){"LP9000", "PCI",
+					"Fibre Channel Adapter"};
 		break;
 	case PCI_DEVICE_ID_RFLY:
-		m = (typeof(m)){"LP952", max_speed, "PCI"};
+		m = (typeof(m)){"LP952", "PCI",
+				"Fibre Channel Adapter"};
 		break;
 	case PCI_DEVICE_ID_PEGASUS:
-		m = (typeof(m)){"LP9802", max_speed, "PCI-X"};
+		m = (typeof(m)){"LP9802", "PCI-X",
+				"Fibre Channel Adapter"};
 		break;
 	case PCI_DEVICE_ID_THOR:
-		m = (typeof(m)){"LP10000", max_speed, "PCI-X"};
+		m = (typeof(m)){"LP10000", "PCI-X",
+				"Fibre Channel Adapter"};
 		break;
 	case PCI_DEVICE_ID_VIPER:
-		m = (typeof(m)){"LPX1000", max_speed,  "PCI-X"};
+		m = (typeof(m)){"LPX1000",  "PCI-X",
+				"Fibre Channel Adapter"};
 		break;
 	case PCI_DEVICE_ID_PFLY:
-		m = (typeof(m)){"LP982", max_speed, "PCI-X"};
+		m = (typeof(m)){"LP982", "PCI-X",
+				"Fibre Channel Adapter"};
 		break;
 	case PCI_DEVICE_ID_TFLY:
-		m = (typeof(m)){"LP1050", max_speed, "PCI-X"};
+		m = (typeof(m)){"LP1050", "PCI-X",
+				"Fibre Channel Adapter"};
 		break;
 	case PCI_DEVICE_ID_HELIOS:
-		m = (typeof(m)){"LP11000", max_speed, "PCI-X2"};
+		m = (typeof(m)){"LP11000", "PCI-X2",
+				"Fibre Channel Adapter"};
 		break;
 	case PCI_DEVICE_ID_HELIOS_SCSP:
-		m = (typeof(m)){"LP11000-SP", max_speed, "PCI-X2"};
+		m = (typeof(m)){"LP11000-SP", "PCI-X2",
+				"Fibre Channel Adapter"};
 		break;
 	case PCI_DEVICE_ID_HELIOS_DCSP:
-		m = (typeof(m)){"LP11002-SP", max_speed, "PCI-X2"};
+		m = (typeof(m)){"LP11002-SP",  "PCI-X2",
+				"Fibre Channel Adapter"};
 		break;
 	case PCI_DEVICE_ID_NEPTUNE:
-		m = (typeof(m)){"LPe1000", max_speed, "PCIe"};
+		m = (typeof(m)){"LPe1000", "PCIe", "Fibre Channel Adapter"};
 		break;
 	case PCI_DEVICE_ID_NEPTUNE_SCSP:
-		m = (typeof(m)){"LPe1000-SP", max_speed, "PCIe"};
+		m = (typeof(m)){"LPe1000-SP", "PCIe", "Fibre Channel Adapter"};
 		break;
 	case PCI_DEVICE_ID_NEPTUNE_DCSP:
-		m = (typeof(m)){"LPe1002-SP", max_speed, "PCIe"};
+		m = (typeof(m)){"LPe1002-SP", "PCIe", "Fibre Channel Adapter"};
 		break;
 	case PCI_DEVICE_ID_BMID:
-		m = (typeof(m)){"LP1150", max_speed, "PCI-X2"};
+		m = (typeof(m)){"LP1150", "PCI-X2", "Fibre Channel Adapter"};
 		break;
 	case PCI_DEVICE_ID_BSMB:
-		m = (typeof(m)){"LP111", max_speed, "PCI-X2"};
+		m = (typeof(m)){"LP111", "PCI-X2", "Fibre Channel Adapter"};
 		break;
 	case PCI_DEVICE_ID_ZEPHYR:
-		m = (typeof(m)){"LPe11000", max_speed, "PCIe"};
+		m = (typeof(m)){"LPe11000", "PCIe", "Fibre Channel Adapter"};
 		break;
 	case PCI_DEVICE_ID_ZEPHYR_SCSP:
-		m = (typeof(m)){"LPe11000", max_speed, "PCIe"};
+		m = (typeof(m)){"LPe11000", "PCIe", "Fibre Channel Adapter"};
 		break;
 	case PCI_DEVICE_ID_ZEPHYR_DCSP:
-		m = (typeof(m)){"LP2105", max_speed, "PCIe"};
+		m = (typeof(m)){"LP2105", "PCIe", "FCoE Adapter"};
 		GE = 1;
 		break;
 	case PCI_DEVICE_ID_ZMID:
-		m = (typeof(m)){"LPe1150", max_speed, "PCIe"};
+		m = (typeof(m)){"LPe1150", "PCIe", "Fibre Channel Adapter"};
 		break;
 	case PCI_DEVICE_ID_ZSMB:
-		m = (typeof(m)){"LPe111", max_speed, "PCIe"};
+		m = (typeof(m)){"LPe111", "PCIe", "Fibre Channel Adapter"};
 		break;
 	case PCI_DEVICE_ID_LP101:
-		m = (typeof(m)){"LP101", max_speed, "PCI-X"};
+		m = (typeof(m)){"LP101", "PCI-X", "Fibre Channel Adapter"};
 		break;
 	case PCI_DEVICE_ID_LP10000S:
-		m = (typeof(m)){"LP10000-S", max_speed, "PCI"};
+		m = (typeof(m)){"LP10000-S", "PCI", "Fibre Channel Adapter"};
 		break;
 	case PCI_DEVICE_ID_LP11000S:
-		m = (typeof(m)){"LP11000-S", max_speed,
-			"PCI-X2"};
+		m = (typeof(m)){"LP11000-S", "PCI-X2", "Fibre Channel Adapter"};
 		break;
 	case PCI_DEVICE_ID_LPE11000S:
-		m = (typeof(m)){"LPe11000-S", max_speed,
-			"PCIe"};
+		m = (typeof(m)){"LPe11000-S", "PCIe", "Fibre Channel Adapter"};
 		break;
 	case PCI_DEVICE_ID_SAT:
-		m = (typeof(m)){"LPe12000", max_speed, "PCIe"};
+		m = (typeof(m)){"LPe12000", "PCIe", "Fibre Channel Adapter"};
 		break;
 	case PCI_DEVICE_ID_SAT_MID:
-		m = (typeof(m)){"LPe1250", max_speed, "PCIe"};
+		m = (typeof(m)){"LPe1250", "PCIe", "Fibre Channel Adapter"};
 		break;
 	case PCI_DEVICE_ID_SAT_SMB:
-		m = (typeof(m)){"LPe121", max_speed, "PCIe"};
+		m = (typeof(m)){"LPe121", "PCIe", "Fibre Channel Adapter"};
 		break;
 	case PCI_DEVICE_ID_SAT_DCSP:
-		m = (typeof(m)){"LPe12002-SP", max_speed, "PCIe"};
+		m = (typeof(m)){"LPe12002-SP", "PCIe", "Fibre Channel Adapter"};
 		break;
 	case PCI_DEVICE_ID_SAT_SCSP:
-		m = (typeof(m)){"LPe12000-SP", max_speed, "PCIe"};
+		m = (typeof(m)){"LPe12000-SP", "PCIe", "Fibre Channel Adapter"};
 		break;
 	case PCI_DEVICE_ID_SAT_S:
-		m = (typeof(m)){"LPe12000-S", max_speed, "PCIe"};
+		m = (typeof(m)){"LPe12000-S", "PCIe", "Fibre Channel Adapter"};
 		break;
 	case PCI_DEVICE_ID_HORNET:
-		m = (typeof(m)){"LP21000", max_speed, "PCIe"};
+		m = (typeof(m)){"LP21000", "PCIe", "FCoE Adapter"};
 		GE = 1;
 		break;
 	case PCI_DEVICE_ID_PROTEUS_VF:
-		m = (typeof(m)) {"LPev12000", max_speed, "PCIe IOV"};
+		m = (typeof(m)){"LPev12000", "PCIe IOV",
+				"Fibre Channel Adapter"};
 		break;
 	case PCI_DEVICE_ID_PROTEUS_PF:
-		m = (typeof(m)) {"LPev12000", max_speed, "PCIe IOV"};
+		m = (typeof(m)){"LPev12000", "PCIe IOV",
+				"Fibre Channel Adapter"};
 		break;
 	case PCI_DEVICE_ID_PROTEUS_S:
-		m = (typeof(m)) {"LPemv12002-S", max_speed, "PCIe IOV"};
+		m = (typeof(m)){"LPemv12002-S", "PCIe IOV",
+				"Fibre Channel Adapter"};
 		break;
 	case PCI_DEVICE_ID_TIGERSHARK:
 		oneConnect = 1;
-		m = (typeof(m)) {"OCe10100-F", max_speed, "PCIe"};
+		m = (typeof(m)){"OCe10100", "PCIe", "FCoE"};
+		break;
+	case PCI_DEVICE_ID_TOMCAT:
+		oneConnect = 1;
+		m = (typeof(m)){"OCe11100", "PCIe", "FCoE"};
+		break;
+	case PCI_DEVICE_ID_FALCON:
+		m = (typeof(m)){"LPSe12002-ML1-E", "PCIe",
+				"EmulexSecure Fibre"};
 		break;
 	default:
-		m = (typeof(m)){ NULL };
+		m = (typeof(m)){"Unknown", "", ""};
 		break;
 	}
 
@@ -1682,17 +1713,14 @@ lpfc_get_hba_model_desc(struct lpfc_hba *phba, uint8_t *mdp, uint8_t *descp)
 	if (descp && descp[0] == '\0') {
 		if (oneConnect)
 			snprintf(descp, 255,
-				"Emulex OneConnect %s, FCoE Initiator, Port %s",
-				m.name,
+				"Emulex OneConnect %s, %s Initiator, Port %s",
+				m.name, m.function,
 				phba->Port);
 		else
 			snprintf(descp, 255,
 				"Emulex %s %d%s %s %s",
-				m.name, m.max_speed,
-				(GE) ? "GE" : "Gb",
-				m.bus,
-				(GE) ? "FCoE Adapter" :
-					"Fibre Channel Adapter");
+				m.name, max_speed, (GE) ? "GE" : "Gb",
+				m.bus, m.function);
 	}
 }
 
@@ -2217,7 +2245,7 @@ lpfc_offline_prep(struct lpfc_hba * phba)
 
 			if (vports[i]->load_flag & FC_UNLOADING)
 				continue;
-			vports[i]->vfi_state &= ~LPFC_VFI_REGISTERED;
+			vports[i]->vpi_state &= ~LPFC_VPI_REGISTERED;
 			shost =	lpfc_shost_from_vport(vports[i]);
 			list_for_each_entry_safe(ndlp, next_ndlp,
 						 &vports[i]->fc_nodes,
@@ -2308,6 +2336,7 @@ lpfc_scsi_free(struct lpfc_hba *phba)
 
 	spin_lock_irq(&phba->hbalock);
 	/* Release all the lpfc_scsi_bufs maintained by this host. */
+	spin_lock(&phba->scsi_buf_list_lock);
 	list_for_each_entry_safe(sb, sb_next, &phba->lpfc_scsi_buf_list, list) {
 		list_del(&sb->list);
 		pci_pool_free(phba->lpfc_scsi_dma_buf_pool, sb->data,
@@ -2315,6 +2344,7 @@ lpfc_scsi_free(struct lpfc_hba *phba)
 		kfree(sb);
 		phba->total_scsi_bufs--;
 	}
+	spin_unlock(&phba->scsi_buf_list_lock);
 
 	/* Release all the lpfc_iocbq entries maintained by this host. */
 	list_for_each_entry_safe(io, io_next, &phba->lpfc_iocb_list, list) {
@@ -2322,9 +2352,7 @@ lpfc_scsi_free(struct lpfc_hba *phba)
 		kfree(io);
 		phba->total_iocbq_bufs--;
 	}
-
 	spin_unlock_irq(&phba->hbalock);
-
 	return 0;
 }
 
@@ -2408,7 +2436,7 @@ lpfc_create_port(struct lpfc_hba *phba, int instance, struct device *dev)
 	vport->els_tmofunc.function = lpfc_els_timeout;
 	vport->els_tmofunc.data = (unsigned long)vport;
 
-	error = scsi_add_host(shost, dev);
+	error = scsi_add_host_with_dma(shost, dev, &phba->pcidev->dev);
 	if (error)
 		goto out_put_shost;
 
@@ -2699,6 +2727,63 @@ lpfc_sli_remove_dflt_fcf(struct lpfc_hba *phba)
 }
 
 /**
+ * lpfc_sli4_fw_cfg_check - Read the firmware config and verify FCoE support
+ * @phba: pointer to lpfc hba data structure.
+ *
+ * This function uses the QUERY_FW_CFG mailbox command to determine if the
+ * firmware loaded supports FCoE. A return of zero indicates that the mailbox
+ * was successful and the firmware supports FCoE. Any other return indicates
+ * a error. It is assumed that this function will be called before interrupts
+ * are enabled.
+ **/
+static int
+lpfc_sli4_fw_cfg_check(struct lpfc_hba *phba)
+{
+	int rc = 0;
+	LPFC_MBOXQ_t *mboxq;
+	struct lpfc_mbx_query_fw_cfg *query_fw_cfg;
+	uint32_t length;
+	uint32_t shdr_status, shdr_add_status;
+
+	mboxq = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
+	if (!mboxq) {
+		lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
+				"2621 Failed to allocate mbox for "
+				"query firmware config cmd\n");
+		return -ENOMEM;
+	}
+	query_fw_cfg = &mboxq->u.mqe.un.query_fw_cfg;
+	length = (sizeof(struct lpfc_mbx_query_fw_cfg) -
+		  sizeof(struct lpfc_sli4_cfg_mhdr));
+	lpfc_sli4_config(phba, mboxq, LPFC_MBOX_SUBSYSTEM_COMMON,
+			 LPFC_MBOX_OPCODE_QUERY_FW_CFG,
+			 length, LPFC_SLI4_MBX_EMBED);
+	rc = lpfc_sli_issue_mbox(phba, mboxq, MBX_POLL);
+	/* The IOCTL status is embedded in the mailbox subheader. */
+	shdr_status = bf_get(lpfc_mbox_hdr_status,
+			     &query_fw_cfg->header.cfg_shdr.response);
+	shdr_add_status = bf_get(lpfc_mbox_hdr_add_status,
+				 &query_fw_cfg->header.cfg_shdr.response);
+	if (shdr_status || shdr_add_status || rc != MBX_SUCCESS) {
+		lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
+				"2622 Query Firmware Config failed "
+				"mbx status x%x, status x%x add_status x%x\n",
+				rc, shdr_status, shdr_add_status);
+		return -EINVAL;
+	}
+	if (!bf_get(lpfc_function_mode_fcoe_i, query_fw_cfg)) {
+		lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
+				"2623 FCoE Function not supported by firmware. "
+				"Function mode = %08x\n",
+				query_fw_cfg->function_mode);
+		return -EINVAL;
+	}
+	if (rc != MBX_TIMEOUT)
+		mempool_free(mboxq, phba->mbox_mem_pool);
+	return 0;
+}
+
+/**
  * lpfc_sli4_parse_latt_fault - Parse sli4 link-attention link fault code
  * @phba: pointer to lpfc hba data structure.
  * @acqe_link: pointer to the async link completion queue entry.
@@ -2918,13 +3003,18 @@ lpfc_sli4_async_fcoe_evt(struct lpfc_hba *phba,
 {
 	uint8_t event_type = bf_get(lpfc_acqe_fcoe_event_type, acqe_fcoe);
 	int rc;
+	struct lpfc_vport *vport;
+	struct lpfc_nodelist *ndlp;
+	struct Scsi_Host  *shost;
+	uint32_t link_state;
 
+	phba->fc_eventTag = acqe_fcoe->event_tag;
 	phba->fcoe_eventtag = acqe_fcoe->event_tag;
 	switch (event_type) {
 	case LPFC_FCOE_EVENT_TYPE_NEW_FCF:
 		lpfc_printf_log(phba, KERN_ERR, LOG_DISCOVERY,
 			"2546 New FCF found index 0x%x tag 0x%x\n",
-			acqe_fcoe->fcf_index,
+			acqe_fcoe->index,
 			acqe_fcoe->event_tag);
 		/*
 		 * If the current FCF is in discovered state, or
@@ -2939,12 +3029,11 @@ lpfc_sli4_async_fcoe_evt(struct lpfc_hba *phba,
 		spin_unlock_irq(&phba->hbalock);
 
 		/* Read the FCF table and re-discover SAN. */
-		rc = lpfc_sli4_read_fcf_record(phba,
-			LPFC_FCOE_FCF_GET_FIRST);
+		rc = lpfc_sli4_read_fcf_record(phba, LPFC_FCOE_FCF_GET_FIRST);
 		if (rc)
 			lpfc_printf_log(phba, KERN_ERR, LOG_DISCOVERY,
-				"2547 Read FCF record failed 0x%x\n",
-				rc);
+					"2547 Read FCF record failed 0x%x\n",
+					rc);
 		break;
 
 	case LPFC_FCOE_EVENT_TYPE_FCF_TABLE_FULL:
@@ -2956,21 +3045,45 @@ lpfc_sli4_async_fcoe_evt(struct lpfc_hba *phba,
 
 	case LPFC_FCOE_EVENT_TYPE_FCF_DEAD:
 		lpfc_printf_log(phba, KERN_ERR, LOG_DISCOVERY,
-			"2549 FCF disconnected fron network index 0x%x"
-			" tag 0x%x\n", acqe_fcoe->fcf_index,
+			"2549 FCF disconnected from network index 0x%x"
+			" tag 0x%x\n", acqe_fcoe->index,
 			acqe_fcoe->event_tag);
 		/* If the event is not for currently used fcf do nothing */
-		if (phba->fcf.fcf_indx != acqe_fcoe->fcf_index)
+		if (phba->fcf.fcf_indx != acqe_fcoe->index)
 			break;
 		/*
 		 * Currently, driver support only one FCF - so treat this as
-		 * a link down.
+		 * a link down, but save the link state because we don't want
+		 * it to be changed to Link Down unless it is already down.
 		 */
+		link_state = phba->link_state;
 		lpfc_linkdown(phba);
+		phba->link_state = link_state;
 		/* Unregister FCF if no devices connected to it */
 		lpfc_unregister_unused_fcf(phba);
 		break;
-
+	case LPFC_FCOE_EVENT_TYPE_CVL:
+		lpfc_printf_log(phba, KERN_ERR, LOG_DISCOVERY,
+			"2718 Clear Virtual Link Received for VPI 0x%x"
+			" tag 0x%x\n", acqe_fcoe->index, acqe_fcoe->event_tag);
+		vport = lpfc_find_vport_by_vpid(phba,
+				acqe_fcoe->index - phba->vpi_base);
+		if (!vport)
+			break;
+		ndlp = lpfc_findnode_did(vport, Fabric_DID);
+		if (!ndlp)
+			break;
+		shost = lpfc_shost_from_vport(vport);
+		lpfc_linkdown_port(vport);
+		if (vport->port_type != LPFC_NPIV_PORT) {
+			mod_timer(&ndlp->nlp_delayfunc, jiffies + HZ);
+			spin_lock_irq(shost->host_lock);
+			ndlp->nlp_flag |= NLP_DELAY_TMO;
+			spin_unlock_irq(shost->host_lock);
+			ndlp->nlp_last_elscmd = ELS_CMD_FLOGI;
+			vport->port_state = LPFC_FLOGI;
+		}
+		break;
 	default:
 		lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
 			"0288 Unknown FCoE event type 0x%x event tag "
@@ -2990,6 +3103,7 @@ static void
 lpfc_sli4_async_dcbx_evt(struct lpfc_hba *phba,
 			 struct lpfc_acqe_dcbx *acqe_dcbx)
 {
+	phba->fc_eventTag = acqe_dcbx->event_tag;
 	lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
 			"0290 The SLI4 DCBX asynchronous event is not "
 			"handled yet\n");
@@ -3124,7 +3238,7 @@ static void lpfc_log_intr_mode(struct lpfc_hba *phba, uint32_t intr_mode)
  * PCI devices.
  *
  * Return codes
- * 	0 - sucessful
+ * 	0 - successful
  * 	other values - error
  **/
 static int
@@ -3220,7 +3334,7 @@ lpfc_reset_hba(struct lpfc_hba *phba)
  * support the SLI-3 HBA device it attached to.
  *
  * Return codes
- * 	0 - sucessful
+ * 	0 - successful
  * 	other values - error
  **/
 static int
@@ -3321,7 +3435,7 @@ lpfc_sli_driver_resource_unset(struct lpfc_hba *phba)
  * support the SLI-4 HBA device it attached to.
  *
  * Return codes
- * 	0 - sucessful
+ * 	0 - successful
  * 	other values - error
  **/
 static int
@@ -3432,7 +3546,7 @@ lpfc_sli4_driver_resource_setup(struct lpfc_hba *phba)
 	/* Driver internel slow-path CQ Event pool */
 	INIT_LIST_HEAD(&phba->sli4_hba.sp_cqe_event_pool);
 	/* Response IOCB work queue list */
-	INIT_LIST_HEAD(&phba->sli4_hba.sp_rspiocb_work_queue);
+	INIT_LIST_HEAD(&phba->sli4_hba.sp_queue_event);
 	/* Asynchronous event CQ Event work queue list */
 	INIT_LIST_HEAD(&phba->sli4_hba.sp_asynce_work_queue);
 	/* Fast-path XRI aborted CQ Event work queue list */
@@ -3461,6 +3575,10 @@ lpfc_sli4_driver_resource_setup(struct lpfc_hba *phba)
 	if (unlikely(rc))
 		goto out_free_bsmbx;
 
+	rc = lpfc_sli4_fw_cfg_check(phba);
+	if (unlikely(rc))
+		goto out_free_bsmbx;
+
 	/* Set up the hba's configuration parameters. */
 	rc = lpfc_sli4_read_config(phba);
 	if (unlikely(rc))
@@ -3594,8 +3712,10 @@ lpfc_sli4_driver_resource_unset(struct lpfc_hba *phba)
 
 	/* Free the current connect table */
 	list_for_each_entry_safe(conn_entry, next_conn_entry,
-		&phba->fcf_conn_rec_list, list)
+		&phba->fcf_conn_rec_list, list) {
+		list_del_init(&conn_entry->list);
 		kfree(conn_entry);
+	}
 
 	return;
 }
@@ -3642,7 +3762,7 @@ lpfc_init_api_table_setup(struct lpfc_hba *phba, uint8_t dev_grp)
  * device specific resource setup to support the HBA device it attached to.
  *
  * Return codes
- *	0 - sucessful
+ *	0 - successful
  *	other values - error
  **/
 static int
@@ -3688,7 +3808,7 @@ lpfc_setup_driver_resource_phase1(struct lpfc_hba *phba)
  * device specific resource setup to support the HBA device it attached to.
  *
  * Return codes
- * 	0 - sucessful
+ * 	0 - successful
  * 	other values - error
  **/
 static int
@@ -3753,7 +3873,7 @@ lpfc_free_iocb_list(struct lpfc_hba *phba)
  * list and set up the IOCB tag array accordingly.
  *
  * Return codes
- *	0 - sucessful
+ *	0 - successful
  *	other values - error
  **/
 static int
@@ -3824,7 +3944,7 @@ lpfc_free_sgl_list(struct lpfc_hba *phba)
 	rc = lpfc_sli4_remove_all_sgl_pages(phba);
 	if (rc) {
 		lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
-			"2005 Unable to deregister pages from HBA: %x", rc);
+			"2005 Unable to deregister pages from HBA: %x\n", rc);
 	}
 	kfree(phba->sli4_hba.lpfc_els_sgl_array);
 }
@@ -3872,7 +3992,7 @@ lpfc_free_active_sgl(struct lpfc_hba *phba)
  * list and set up the sgl xritag tag array accordingly.
  *
  * Return codes
- *	0 - sucessful
+ *	0 - successful
  *	other values - error
  **/
 static int
@@ -3986,7 +4106,7 @@ out_free_mem:
  * enabled and the driver is reinitializing the device.
  *
  * Return codes
- * 	0 - sucessful
+ * 	0 - successful
  * 	ENOMEM - No availble memory
  *      EIO - The mailbox failed to complete successfully.
  **/
@@ -4146,7 +4266,7 @@ lpfc_sli4_remove_rpi_hdrs(struct lpfc_hba *phba)
  * PCI device data structure is set.
  *
  * Return codes
- *      pointer to @phba - sucessful
+ *      pointer to @phba - successful
  *      NULL - error
  **/
 static struct lpfc_hba *
@@ -4202,7 +4322,7 @@ lpfc_hba_free(struct lpfc_hba *phba)
  * host with it.
  *
  * Return codes
- *      0 - sucessful
+ *      0 - successful
  *      other values - error
  **/
 static int
@@ -4273,7 +4393,8 @@ lpfc_setup_bg(struct lpfc_hba *phba, struct Scsi_Host *shost)
 			_dump_buf_data =
 				(char *) __get_free_pages(GFP_KERNEL, pagecnt);
 			if (_dump_buf_data) {
-				printk(KERN_ERR "BLKGRD allocated %d pages for "
+				lpfc_printf_log(phba, KERN_ERR, LOG_BG,
+					"9043 BLKGRD: allocated %d pages for "
 				       "_dump_buf_data at 0x%p\n",
 				       (1 << pagecnt), _dump_buf_data);
 				_dump_buf_data_order = pagecnt;
@@ -4284,17 +4405,20 @@ lpfc_setup_bg(struct lpfc_hba *phba, struct Scsi_Host *shost)
 				--pagecnt;
 		}
 		if (!_dump_buf_data_order)
-			printk(KERN_ERR "BLKGRD ERROR unable to allocate "
+			lpfc_printf_log(phba, KERN_ERR, LOG_BG,
+				"9044 BLKGRD: ERROR unable to allocate "
 			       "memory for hexdump\n");
 	} else
-		printk(KERN_ERR "BLKGRD already allocated _dump_buf_data=0x%p"
+		lpfc_printf_log(phba, KERN_ERR, LOG_BG,
+			"9045 BLKGRD: already allocated _dump_buf_data=0x%p"
 		       "\n", _dump_buf_data);
 	if (!_dump_buf_dif) {
 		while (pagecnt) {
 			_dump_buf_dif =
 				(char *) __get_free_pages(GFP_KERNEL, pagecnt);
 			if (_dump_buf_dif) {
-				printk(KERN_ERR "BLKGRD allocated %d pages for "
+				lpfc_printf_log(phba, KERN_ERR, LOG_BG,
+					"9046 BLKGRD: allocated %d pages for "
 				       "_dump_buf_dif at 0x%p\n",
 				       (1 << pagecnt), _dump_buf_dif);
 				_dump_buf_dif_order = pagecnt;
@@ -4305,10 +4429,12 @@ lpfc_setup_bg(struct lpfc_hba *phba, struct Scsi_Host *shost)
 				--pagecnt;
 		}
 		if (!_dump_buf_dif_order)
-			printk(KERN_ERR "BLKGRD ERROR unable to allocate "
+			lpfc_printf_log(phba, KERN_ERR, LOG_BG,
+			"9047 BLKGRD: ERROR unable to allocate "
 			       "memory for hexdump\n");
 	} else
-		printk(KERN_ERR "BLKGRD already allocated _dump_buf_dif=0x%p\n",
+		lpfc_printf_log(phba, KERN_ERR, LOG_BG,
+			"9048 BLKGRD: already allocated _dump_buf_dif=0x%p\n",
 		       _dump_buf_dif);
 }
 
@@ -4365,7 +4491,7 @@ lpfc_post_init_setup(struct lpfc_hba *phba)
  * with SLI-3 interface spec.
  *
  * Return codes
- * 	0 - sucessful
+ * 	0 - successful
  * 	other values - error
  **/
 static int
@@ -4384,9 +4510,13 @@ lpfc_sli_pci_mem_setup(struct lpfc_hba *phba)
 		pdev = phba->pcidev;
 
 	/* Set the device DMA mask size */
-	if (pci_set_dma_mask(pdev, DMA_BIT_MASK(64)) != 0)
-		if (pci_set_dma_mask(pdev, DMA_BIT_MASK(32)) != 0)
+	if (pci_set_dma_mask(pdev, DMA_BIT_MASK(64)) != 0
+	 || pci_set_consistent_dma_mask(pdev,DMA_BIT_MASK(64)) != 0) {
+		if (pci_set_dma_mask(pdev, DMA_BIT_MASK(32)) != 0
+		 || pci_set_consistent_dma_mask(pdev,DMA_BIT_MASK(32)) != 0) {
 			return error;
+		}
+	}
 
 	/* Get the bus address of Bar0 and Bar2 and the number of bytes
 	 * required by each mapping.
@@ -4512,7 +4642,6 @@ int
 lpfc_sli4_post_status_check(struct lpfc_hba *phba)
 {
 	struct lpfc_register sta_reg, uerrlo_reg, uerrhi_reg, scratchpad;
-	uint32_t onlnreg0, onlnreg1;
 	int i, port_error = -ENODEV;
 
 	if (!phba->sli4_hba.STAregaddr)
@@ -4556,21 +4685,20 @@ lpfc_sli4_post_status_check(struct lpfc_hba *phba)
 			bf_get(lpfc_scratchpad_slirev, &scratchpad),
 			bf_get(lpfc_scratchpad_featurelevel1, &scratchpad),
 			bf_get(lpfc_scratchpad_featurelevel2, &scratchpad));
-
+	phba->sli4_hba.ue_mask_lo = readl(phba->sli4_hba.UEMASKLOregaddr);
+	phba->sli4_hba.ue_mask_hi = readl(phba->sli4_hba.UEMASKHIregaddr);
 	/* With uncoverable error, log the error message and return error */
-	onlnreg0 = readl(phba->sli4_hba.ONLINE0regaddr);
-	onlnreg1 = readl(phba->sli4_hba.ONLINE1regaddr);
-	if ((onlnreg0 != LPFC_ONLINE_NERR) || (onlnreg1 != LPFC_ONLINE_NERR)) {
-		uerrlo_reg.word0 = readl(phba->sli4_hba.UERRLOregaddr);
-		uerrhi_reg.word0 = readl(phba->sli4_hba.UERRHIregaddr);
-		if (uerrlo_reg.word0 || uerrhi_reg.word0) {
-			lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
-					"1422 HBA Unrecoverable error: "
-					"uerr_lo_reg=0x%x, uerr_hi_reg=0x%x, "
-					"online0_reg=0x%x, online1_reg=0x%x\n",
-					uerrlo_reg.word0, uerrhi_reg.word0,
-					onlnreg0, onlnreg1);
-		}
+	uerrlo_reg.word0 = readl(phba->sli4_hba.UERRLOregaddr);
+	uerrhi_reg.word0 = readl(phba->sli4_hba.UERRHIregaddr);
+	if ((~phba->sli4_hba.ue_mask_lo & uerrlo_reg.word0) ||
+	    (~phba->sli4_hba.ue_mask_hi & uerrhi_reg.word0)) {
+		lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
+				"1422 HBA Unrecoverable error: "
+				"uerr_lo_reg=0x%x, uerr_hi_reg=0x%x, "
+				"ue_mask_lo_reg=0x%x, ue_mask_hi_reg=0x%x\n",
+				uerrlo_reg.word0, uerrhi_reg.word0,
+				phba->sli4_hba.ue_mask_lo,
+				phba->sli4_hba.ue_mask_hi);
 		return -ENODEV;
 	}
 
@@ -4591,10 +4719,10 @@ lpfc_sli4_bar0_register_memmap(struct lpfc_hba *phba)
 					LPFC_UERR_STATUS_LO;
 	phba->sli4_hba.UERRHIregaddr = phba->sli4_hba.conf_regs_memmap_p +
 					LPFC_UERR_STATUS_HI;
-	phba->sli4_hba.ONLINE0regaddr = phba->sli4_hba.conf_regs_memmap_p +
-					LPFC_ONLINE0;
-	phba->sli4_hba.ONLINE1regaddr = phba->sli4_hba.conf_regs_memmap_p +
-					LPFC_ONLINE1;
+	phba->sli4_hba.UEMASKLOregaddr = phba->sli4_hba.conf_regs_memmap_p +
+					LPFC_UE_MASK_LO;
+	phba->sli4_hba.UEMASKHIregaddr = phba->sli4_hba.conf_regs_memmap_p +
+					LPFC_UE_MASK_HI;
 	phba->sli4_hba.SCRATCHPADregaddr = phba->sli4_hba.conf_regs_memmap_p +
 					LPFC_SCRATCHPAD;
 }
@@ -4662,7 +4790,7 @@ lpfc_sli4_bar2_register_memmap(struct lpfc_hba *phba, uint32_t vf)
  * this routine.
  *
  * Return codes
- * 	0 - sucessful
+ * 	0 - successful
  * 	ENOMEM - could not allocated memory.
  **/
 static int
@@ -4761,7 +4889,7 @@ lpfc_destroy_bootstrap_mbox(struct lpfc_hba *phba)
  * allocation for the port.
  *
  * Return codes
- * 	0 - sucessful
+ * 	0 - successful
  * 	ENOMEM - No availble memory
  *      EIO - The mailbox failed to complete successfully.
  **/
@@ -4825,7 +4953,8 @@ lpfc_sli4_read_config(struct lpfc_hba *phba)
 		phba->vpi_base = phba->sli4_hba.max_cfg_param.vpi_base;
 		phba->vfi_base = phba->sli4_hba.max_cfg_param.vfi_base;
 		phba->sli4_hba.next_rpi = phba->sli4_hba.max_cfg_param.rpi_base;
-		phba->max_vpi = phba->sli4_hba.max_cfg_param.max_vpi;
+		phba->max_vpi = (phba->sli4_hba.max_cfg_param.max_vpi > 0) ?
+				(phba->sli4_hba.max_cfg_param.max_vpi - 1) : 0;
 		phba->max_vports = phba->max_vpi;
 		lpfc_printf_log(phba, KERN_INFO, LOG_SLI,
 				"2003 cfg params XRI(B:%d M:%d), "
@@ -4861,7 +4990,7 @@ lpfc_sli4_read_config(struct lpfc_hba *phba)
  * HBA consistent with the SLI-4 interface spec.
  *
  * Return codes
- * 	0 - sucessful
+ * 	0 - successful
  * 	ENOMEM - No availble memory
  *      EIO - The mailbox failed to complete successfully.
  **/
@@ -4910,7 +5039,7 @@ lpfc_setup_endian_order(struct lpfc_hba *phba)
  * we just use some constant number as place holder.
  *
  * Return codes
- *      0 - sucessful
+ *      0 - successful
  *      ENOMEM - No availble memory
  *      EIO - The mailbox failed to complete successfully.
  **/
@@ -4979,10 +5108,9 @@ lpfc_sli4_queue_create(struct lpfc_hba *phba)
 	/* It does not make sense to have more EQs than WQs */
 	if (cfg_fcp_eq_count > phba->cfg_fcp_wq_count) {
 		lpfc_printf_log(phba, KERN_WARNING, LOG_INIT,
-				"2593 The number of FCP EQs (%d) is more "
-				"than the number of FCP WQs (%d), take "
-				"the number of FCP EQs same as than of "
-				"WQs (%d)\n", cfg_fcp_eq_count,
+				"2593 The FCP EQ count(%d) cannot be greater "
+				"than the FCP WQ count(%d), limiting the "
+				"FCP EQ count to %d\n", cfg_fcp_eq_count,
 				phba->cfg_fcp_wq_count,
 				phba->cfg_fcp_wq_count);
 		cfg_fcp_eq_count = phba->cfg_fcp_wq_count;
@@ -5058,15 +5186,6 @@ lpfc_sli4_queue_create(struct lpfc_hba *phba)
 	}
 	phba->sli4_hba.els_cq = qdesc;
 
-	/* Create slow-path Unsolicited Receive Complete Queue */
-	qdesc = lpfc_sli4_queue_alloc(phba, phba->sli4_hba.cq_esize,
-				      phba->sli4_hba.cq_ecount);
-	if (!qdesc) {
-		lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
-				"0502 Failed allocate slow-path USOL RX CQ\n");
-		goto out_free_els_cq;
-	}
-	phba->sli4_hba.rxq_cq = qdesc;
 
 	/* Create fast-path FCP Completion Queue(s), one-to-one with EQs */
 	phba->sli4_hba.fcp_cq = kzalloc((sizeof(struct lpfc_queue *) *
@@ -5075,7 +5194,7 @@ lpfc_sli4_queue_create(struct lpfc_hba *phba)
 		lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
 				"2577 Failed allocate memory for fast-path "
 				"CQ record array\n");
-		goto out_free_rxq_cq;
+		goto out_free_els_cq;
 	}
 	for (fcp_cqidx = 0; fcp_cqidx < phba->cfg_fcp_eq_count; fcp_cqidx++) {
 		qdesc = lpfc_sli4_queue_alloc(phba, phba->sli4_hba.cq_esize,
@@ -5188,9 +5307,6 @@ out_free_fcp_cq:
 		phba->sli4_hba.fcp_cq[fcp_cqidx] = NULL;
 	}
 	kfree(phba->sli4_hba.fcp_cq);
-out_free_rxq_cq:
-	lpfc_sli4_queue_free(phba->sli4_hba.rxq_cq);
-	phba->sli4_hba.rxq_cq = NULL;
 out_free_els_cq:
 	lpfc_sli4_queue_free(phba->sli4_hba.els_cq);
 	phba->sli4_hba.els_cq = NULL;
@@ -5218,7 +5334,7 @@ out_error:
  * operation.
  *
  * Return codes
- *      0 - sucessful
+ *      0 - successful
  *      ENOMEM - No availble memory
  *      EIO - The mailbox failed to complete successfully.
  **/
@@ -5247,10 +5363,6 @@ lpfc_sli4_queue_destroy(struct lpfc_hba *phba)
 	lpfc_sli4_queue_free(phba->sli4_hba.dat_rq);
 	phba->sli4_hba.dat_rq = NULL;
 
-	/* Release unsolicited receive complete queue */
-	lpfc_sli4_queue_free(phba->sli4_hba.rxq_cq);
-	phba->sli4_hba.rxq_cq = NULL;
-
 	/* Release ELS complete queue */
 	lpfc_sli4_queue_free(phba->sli4_hba.els_cq);
 	phba->sli4_hba.els_cq = NULL;
@@ -5286,7 +5398,7 @@ lpfc_sli4_queue_destroy(struct lpfc_hba *phba)
  * operation.
  *
  * Return codes
- *      0 - sucessful
+ *      0 - successful
  *      ENOMEM - No availble memory
  *      EIO - The mailbox failed to complete successfully.
  **/
@@ -5383,25 +5495,6 @@ lpfc_sli4_queue_setup(struct lpfc_hba *phba)
 			phba->sli4_hba.els_cq->queue_id,
 			phba->sli4_hba.sp_eq->queue_id);
 
-	/* Set up slow-path Unsolicited Receive Complete Queue */
-	if (!phba->sli4_hba.rxq_cq) {
-		lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
-				"0532 USOL RX CQ not allocated\n");
-		goto out_destroy_els_cq;
-	}
-	rc = lpfc_cq_create(phba, phba->sli4_hba.rxq_cq, phba->sli4_hba.sp_eq,
-			    LPFC_RCQ, LPFC_USOL);
-	if (rc) {
-		lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
-				"0533 Failed setup of slow-path USOL RX CQ: "
-				"rc = 0x%x\n", rc);
-		goto out_destroy_els_cq;
-	}
-	lpfc_printf_log(phba, KERN_INFO, LOG_INIT,
-			"2587 USL CQ setup: cq-id=%d, parent eq-id=%d\n",
-			phba->sli4_hba.rxq_cq->queue_id,
-			phba->sli4_hba.sp_eq->queue_id);
-
 	/* Set up fast-path FCP Response Complete Queue */
 	for (fcp_cqidx = 0; fcp_cqidx < phba->cfg_fcp_eq_count; fcp_cqidx++) {
 		if (!phba->sli4_hba.fcp_cq[fcp_cqidx]) {
@@ -5507,7 +5600,7 @@ lpfc_sli4_queue_setup(struct lpfc_hba *phba)
 		goto out_destroy_fcp_wq;
 	}
 	rc = lpfc_rq_create(phba, phba->sli4_hba.hdr_rq, phba->sli4_hba.dat_rq,
-			    phba->sli4_hba.rxq_cq, LPFC_USOL);
+			    phba->sli4_hba.els_cq, LPFC_USOL);
 	if (rc) {
 		lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
 				"0541 Failed setup of Receive Queue: "
@@ -5519,7 +5612,7 @@ lpfc_sli4_queue_setup(struct lpfc_hba *phba)
 			"parent cq-id=%d\n",
 			phba->sli4_hba.hdr_rq->queue_id,
 			phba->sli4_hba.dat_rq->queue_id,
-			phba->sli4_hba.rxq_cq->queue_id);
+			phba->sli4_hba.els_cq->queue_id);
 	return 0;
 
 out_destroy_fcp_wq:
@@ -5531,8 +5624,6 @@ out_destroy_mbx_wq:
 out_destroy_fcp_cq:
 	for (--fcp_cqidx; fcp_cqidx >= 0; fcp_cqidx--)
 		lpfc_cq_destroy(phba, phba->sli4_hba.fcp_cq[fcp_cqidx]);
-	lpfc_cq_destroy(phba, phba->sli4_hba.rxq_cq);
-out_destroy_els_cq:
 	lpfc_cq_destroy(phba, phba->sli4_hba.els_cq);
 out_destroy_mbx_cq:
 	lpfc_cq_destroy(phba, phba->sli4_hba.mbx_cq);
@@ -5552,7 +5643,7 @@ out_error:
  * operation.
  *
  * Return codes
- *      0 - sucessful
+ *      0 - successful
  *      ENOMEM - No availble memory
  *      EIO - The mailbox failed to complete successfully.
  **/
@@ -5574,8 +5665,6 @@ lpfc_sli4_queue_unset(struct lpfc_hba *phba)
 	lpfc_cq_destroy(phba, phba->sli4_hba.mbx_cq);
 	/* Unset ELS complete queue */
 	lpfc_cq_destroy(phba, phba->sli4_hba.els_cq);
-	/* Unset unsolicited receive complete queue */
-	lpfc_cq_destroy(phba, phba->sli4_hba.rxq_cq);
 	/* Unset FCP response complete queue */
 	for (fcp_qidx = 0; fcp_qidx < phba->cfg_fcp_eq_count; fcp_qidx++)
 		lpfc_cq_destroy(phba, phba->sli4_hba.fcp_cq[fcp_qidx]);
@@ -5599,7 +5688,7 @@ lpfc_sli4_queue_unset(struct lpfc_hba *phba)
  * Later, this can be used for all the slow-path events.
  *
  * Return codes
- *      0 - sucessful
+ *      0 - successful
  *      -ENOMEM - No availble memory
  **/
 static int
@@ -5760,7 +5849,7 @@ lpfc_sli4_cq_event_release_all(struct lpfc_hba *phba)
  * all resources assigned to the PCI function which originates this request.
  *
  * Return codes
- *      0 - sucessful
+ *      0 - successful
  *      ENOMEM - No availble memory
  *      EIO - The mailbox failed to complete successfully.
  **/
@@ -5923,7 +6012,7 @@ lpfc_sli4_fcfi_unreg(struct lpfc_hba *phba, uint16_t fcfi)
  * with SLI-4 interface spec.
  *
  * Return codes
- * 	0 - sucessful
+ * 	0 - successful
  * 	other values - error
  **/
 static int
@@ -5940,9 +6029,13 @@ lpfc_sli4_pci_mem_setup(struct lpfc_hba *phba)
 		pdev = phba->pcidev;
 
 	/* Set the device DMA mask size */
-	if (pci_set_dma_mask(pdev, DMA_BIT_MASK(64)) != 0)
-		if (pci_set_dma_mask(pdev, DMA_BIT_MASK(32)) != 0)
+	if (pci_set_dma_mask(pdev, DMA_BIT_MASK(64)) != 0
+	 || pci_set_consistent_dma_mask(pdev,DMA_BIT_MASK(64)) != 0) {
+		if (pci_set_dma_mask(pdev, DMA_BIT_MASK(32)) != 0
+		 || pci_set_consistent_dma_mask(pdev,DMA_BIT_MASK(32)) != 0) {
 			return error;
+		}
+	}
 
 	/* Get the bus address of SLI4 device Bar0, Bar1, and Bar2 and the
 	 * number of bytes required by each mapping. They are actually
@@ -6052,7 +6145,7 @@ lpfc_sli4_pci_mem_unset(struct lpfc_hba *phba)
  * will be left with MSI-X enabled and leaks its vectors.
  *
  * Return codes
- *   0 - sucessful
+ *   0 - successful
  *   other values - error
  **/
 static int
@@ -6184,7 +6277,7 @@ lpfc_sli_disable_msix(struct lpfc_hba *phba)
  * is done in this function.
  *
  * Return codes
- * 	0 - sucessful
+ * 	0 - successful
  * 	other values - error
  */
 static int
@@ -6243,7 +6336,7 @@ lpfc_sli_disable_msi(struct lpfc_hba *phba)
  * MSI-X -> MSI -> IRQ.
  *
  * Return codes
- *   0 - sucessful
+ *   0 - successful
  *   other values - error
  **/
 static uint32_t
@@ -6333,7 +6426,7 @@ lpfc_sli_disable_intr(struct lpfc_hba *phba)
  * enabled and leaks its vectors.
  *
  * Return codes
- * 0 - sucessful
+ * 0 - successful
  * other values - error
  **/
 static int
@@ -6443,7 +6536,7 @@ lpfc_sli4_disable_msix(struct lpfc_hba *phba)
  * which is done in this function.
  *
  * Return codes
- * 	0 - sucessful
+ * 	0 - successful
  * 	other values - error
  **/
 static int
@@ -6508,7 +6601,7 @@ lpfc_sli4_disable_msi(struct lpfc_hba *phba)
  * MSI-X -> MSI -> IRQ.
  *
  * Return codes
- * 	0 - sucessful
+ * 	0 - successful
  * 	other values - error
  **/
 static uint32_t
@@ -6722,6 +6815,7 @@ lpfc_pci_probe_one_s3(struct pci_dev *pdev, const struct pci_device_id *pid)
 {
 	struct lpfc_hba   *phba;
 	struct lpfc_vport *vport = NULL;
+	struct Scsi_Host  *shost = NULL;
 	int error;
 	uint32_t cfg_mode, intr_mode;
 
@@ -6800,6 +6894,7 @@ lpfc_pci_probe_one_s3(struct pci_dev *pdev, const struct pci_device_id *pid)
 		goto out_destroy_shost;
 	}
 
+	shost = lpfc_shost_from_vport(vport); /* save shost for error cleanup */
 	/* Now, trying to enable interrupt and bring up the device */
 	cfg_mode = phba->cfg_use_msi;
 	while (true) {
@@ -6866,6 +6961,8 @@ out_unset_pci_mem_s3:
 	lpfc_sli_pci_mem_unset(phba);
 out_disable_pci_dev:
 	lpfc_disable_pci_dev(phba);
+	if (shost)
+		scsi_host_put(shost);
 out_free_phba:
 	lpfc_hba_free(phba);
 	return error;
@@ -7036,6 +7133,7 @@ lpfc_pci_resume_one_s3(struct pci_dev *pdev)
 	/* Restore device state from PCI config space */
 	pci_set_power_state(pdev, PCI_D0);
 	pci_restore_state(pdev);
+
 	if (pdev->is_busmaster)
 		pci_set_master(pdev);
 
@@ -7070,6 +7168,73 @@ lpfc_pci_resume_one_s3(struct pci_dev *pdev)
 }
 
 /**
+ * lpfc_sli_prep_dev_for_recover - Prepare SLI3 device for pci slot recover
+ * @phba: pointer to lpfc hba data structure.
+ *
+ * This routine is called to prepare the SLI3 device for PCI slot recover. It
+ * aborts and stops all the on-going I/Os on the pci device.
+ **/
+static void
+lpfc_sli_prep_dev_for_recover(struct lpfc_hba *phba)
+{
+	lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
+			"2723 PCI channel I/O abort preparing for recovery\n");
+	/* Prepare for bringing HBA offline */
+	lpfc_offline_prep(phba);
+	/* Clear sli active flag to prevent sysfs access to HBA */
+	spin_lock_irq(&phba->hbalock);
+	phba->sli.sli_flag &= ~LPFC_SLI_ACTIVE;
+	spin_unlock_irq(&phba->hbalock);
+	/* Stop and flush all I/Os and bring HBA offline */
+	lpfc_offline(phba);
+}
+
+/**
+ * lpfc_sli_prep_dev_for_reset - Prepare SLI3 device for pci slot reset
+ * @phba: pointer to lpfc hba data structure.
+ *
+ * This routine is called to prepare the SLI3 device for PCI slot reset. It
+ * disables the device interrupt and pci device, and aborts the internal FCP
+ * pending I/Os.
+ **/
+static void
+lpfc_sli_prep_dev_for_reset(struct lpfc_hba *phba)
+{
+	struct lpfc_sli *psli = &phba->sli;
+	struct lpfc_sli_ring  *pring;
+
+	lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
+			"2710 PCI channel disable preparing for reset\n");
+	/* Disable interrupt and pci device */
+	lpfc_sli_disable_intr(phba);
+	pci_disable_device(phba->pcidev);
+	/*
+	 * There may be I/Os dropped by the firmware.
+	 * Error iocb (I/O) on txcmplq and let the SCSI layer
+	 * retry it after re-establishing link.
+	 */
+	pring = &psli->ring[psli->fcp_ring];
+	lpfc_sli_abort_iocb_ring(phba, pring);
+}
+
+/**
+ * lpfc_sli_prep_dev_for_perm_failure - Prepare SLI3 dev for pci slot disable
+ * @phba: pointer to lpfc hba data structure.
+ *
+ * This routine is called to prepare the SLI3 device for PCI slot permanently
+ * disabling. It blocks the SCSI transport layer traffic and flushes the FCP
+ * pending I/Os.
+ **/
+static void
+lpfc_prep_dev_for_perm_failure(struct lpfc_hba *phba)
+{
+	lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
+			"2711 PCI channel permanent disable for failure\n");
+	/* Clean up all driver's outstanding SCSI I/Os */
+	lpfc_sli_flush_fcp_rings(phba);
+}
+
+/**
  * lpfc_io_error_detected_s3 - Method for handling SLI-3 device PCI I/O error
  * @pdev: pointer to PCI device.
  * @state: the current PCI connection state.
@@ -7083,6 +7248,7 @@ lpfc_pci_resume_one_s3(struct pci_dev *pdev)
  * as desired.
  *
  * Return codes
+ * 	PCI_ERS_RESULT_CAN_RECOVER - can be recovered with reset_link
  * 	PCI_ERS_RESULT_NEED_RESET - need to reset before recovery
  * 	PCI_ERS_RESULT_DISCONNECT - device could not be recovered
  **/
@@ -7091,33 +7257,30 @@ lpfc_io_error_detected_s3(struct pci_dev *pdev, pci_channel_state_t state)
 {
 	struct Scsi_Host *shost = pci_get_drvdata(pdev);
 	struct lpfc_hba *phba = ((struct lpfc_vport *)shost->hostdata)->phba;
-	struct lpfc_sli *psli = &phba->sli;
-	struct lpfc_sli_ring  *pring;
 
-	if (state == pci_channel_io_perm_failure) {
-		lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
-				"0472 PCI channel I/O permanent failure\n");
-		/* Block all SCSI devices' I/Os on the host */
-		lpfc_scsi_dev_block(phba);
-		/* Clean up all driver's outstanding SCSI I/Os */
-		lpfc_sli_flush_fcp_rings(phba);
+	/* Block all SCSI devices' I/Os on the host */
+	lpfc_scsi_dev_block(phba);
+
+	switch (state) {
+	case pci_channel_io_normal:
+		/* Non-fatal error, prepare for recovery */
+		lpfc_sli_prep_dev_for_recover(phba);
+		return PCI_ERS_RESULT_CAN_RECOVER;
+	case pci_channel_io_frozen:
+		/* Fatal error, prepare for slot reset */
+		lpfc_sli_prep_dev_for_reset(phba);
+		return PCI_ERS_RESULT_NEED_RESET;
+	case pci_channel_io_perm_failure:
+		/* Permanent failure, prepare for device down */
+		lpfc_prep_dev_for_perm_failure(phba);
 		return PCI_ERS_RESULT_DISCONNECT;
+	default:
+		/* Unknown state, prepare and request slot reset */
+		lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
+				"0472 Unknown PCI error state: x%x\n", state);
+		lpfc_sli_prep_dev_for_reset(phba);
+		return PCI_ERS_RESULT_NEED_RESET;
 	}
-
-	pci_disable_device(pdev);
-	/*
-	 * There may be I/Os dropped by the firmware.
-	 * Error iocb (I/O) on txcmplq and let the SCSI layer
-	 * retry it after re-establishing link.
-	 */
-	pring = &psli->ring[psli->fcp_ring];
-	lpfc_sli_abort_iocb_ring(phba, pring);
-
-	/* Disable interrupt */
-	lpfc_sli_disable_intr(phba);
-
-	/* Request a slot reset. */
-	return PCI_ERS_RESULT_NEED_RESET;
 }
 
 /**
@@ -7197,7 +7360,12 @@ lpfc_io_resume_s3(struct pci_dev *pdev)
 	struct Scsi_Host *shost = pci_get_drvdata(pdev);
 	struct lpfc_hba *phba = ((struct lpfc_vport *)shost->hostdata)->phba;
 
+	/* Bring the device online */
 	lpfc_online(phba);
+
+	/* Clean up Advanced Error Reporting (AER) if needed */
+	if (phba->hba_flag & HBA_AER_ENABLED)
+		pci_cleanup_aer_uncorrect_error_status(pdev);
 }
 
 /**
@@ -7213,15 +7381,15 @@ lpfc_sli4_get_els_iocb_cnt(struct lpfc_hba *phba)
 
 	if (phba->sli_rev == LPFC_SLI_REV4) {
 		if (max_xri <= 100)
-			return 4;
+			return 10;
 		else if (max_xri <= 256)
-			return 8;
+			return 25;
 		else if (max_xri <= 512)
-			return 16;
+			return 50;
 		else if (max_xri <= 1024)
-			return 32;
+			return 100;
 		else
-			return 48;
+			return 150;
 	} else
 		return 0;
 }
@@ -7249,6 +7417,7 @@ lpfc_pci_probe_one_s4(struct pci_dev *pdev, const struct pci_device_id *pid)
 {
 	struct lpfc_hba   *phba;
 	struct lpfc_vport *vport = NULL;
+	struct Scsi_Host  *shost = NULL;
 	int error;
 	uint32_t cfg_mode, intr_mode;
 	int mcnt;
@@ -7329,6 +7498,7 @@ lpfc_pci_probe_one_s4(struct pci_dev *pdev, const struct pci_device_id *pid)
 		goto out_destroy_shost;
 	}
 
+	shost = lpfc_shost_from_vport(vport); /* save shost for error cleanup */
 	/* Now, trying to enable interrupt and bring up the device */
 	cfg_mode = phba->cfg_use_msi;
 	while (true) {
@@ -7342,6 +7512,9 @@ lpfc_pci_probe_one_s4(struct pci_dev *pdev, const struct pci_device_id *pid)
 			error = -ENODEV;
 			goto out_free_sysfs_attr;
 		}
+		/* Default to single FCP EQ for non-MSI-X */
+		if (phba->intr_type != MSIX)
+			phba->cfg_fcp_eq_count = 1;
 		/* Set up SLI-4 HBA */
 		if (lpfc_sli4_hba_setup(phba)) {
 			lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
@@ -7397,6 +7570,8 @@ out_unset_pci_mem_s4:
 	lpfc_sli4_pci_mem_unset(phba);
 out_disable_pci_dev:
 	lpfc_disable_pci_dev(phba);
+	if (shost)
+		scsi_host_put(shost);
 out_free_phba:
 	lpfc_hba_free(phba);
 	return error;
@@ -7971,6 +8146,10 @@ static struct pci_device_id lpfc_id_table[] = {
 		PCI_ANY_ID, PCI_ANY_ID, },
 	{PCI_VENDOR_ID_SERVERENGINE, PCI_DEVICE_ID_TIGERSHARK,
 		PCI_ANY_ID, PCI_ANY_ID, },
+	{PCI_VENDOR_ID_SERVERENGINE, PCI_DEVICE_ID_TOMCAT,
+		PCI_ANY_ID, PCI_ANY_ID, },
+	{PCI_VENDOR_ID_EMULEX, PCI_DEVICE_ID_FALCON,
+		PCI_ANY_ID, PCI_ANY_ID, },
 	{ 0 }
 };
 
@@ -8053,15 +8232,15 @@ lpfc_exit(void)
 	if (lpfc_enable_npiv)
 		fc_release_transport(lpfc_vport_transport_template);
 	if (_dump_buf_data) {
-		printk(KERN_ERR "BLKGRD freeing %lu pages for _dump_buf_data "
-				"at 0x%p\n",
+		printk(KERN_ERR	"9062 BLKGRD: freeing %lu pages for "
+				"_dump_buf_data at 0x%p\n",
 				(1L << _dump_buf_data_order), _dump_buf_data);
 		free_pages((unsigned long)_dump_buf_data, _dump_buf_data_order);
 	}
 
 	if (_dump_buf_dif) {
-		printk(KERN_ERR "BLKGRD freeing %lu pages for _dump_buf_dif "
-				"at 0x%p\n",
+		printk(KERN_ERR	"9049 BLKGRD: freeing %lu pages for "
+				"_dump_buf_dif at 0x%p\n",
 				(1L << _dump_buf_dif_order), _dump_buf_dif);
 		free_pages((unsigned long)_dump_buf_dif, _dump_buf_dif_order);
 	}
diff --git a/drivers/scsi/lpfc/lpfc_mbox.c b/drivers/scsi/lpfc/lpfc_mbox.c
index 1ab405902a18..a9afd8b94b6a 100644
--- a/drivers/scsi/lpfc/lpfc_mbox.c
+++ b/drivers/scsi/lpfc/lpfc_mbox.c
@@ -25,8 +25,8 @@
 
 #include <scsi/scsi_device.h>
 #include <scsi/scsi_transport_fc.h>
-
 #include <scsi/scsi.h>
+#include <scsi/fc/fc_fs.h>
 
 #include "lpfc_hw4.h"
 #include "lpfc_hw.h"
@@ -820,6 +820,10 @@ lpfc_reg_vpi(struct lpfc_vport *vport, LPFC_MBOXQ_t *pmb)
 	mb->un.varRegVpi.vpi = vport->vpi + vport->phba->vpi_base;
 	mb->un.varRegVpi.sid = vport->fc_myDID;
 	mb->un.varRegVpi.vfi = vport->vfi + vport->phba->vfi_base;
+	memcpy(mb->un.varRegVpi.wwn, &vport->fc_portname,
+	       sizeof(struct lpfc_name));
+	mb->un.varRegVpi.wwn[0] = cpu_to_le32(mb->un.varRegVpi.wwn[0]);
+	mb->un.varRegVpi.wwn[1] = cpu_to_le32(mb->un.varRegVpi.wwn[1]);
 
 	mb->mbxCommand = MBX_REG_VPI;
 	mb->mbxOwner = OWN_HOST;
@@ -849,7 +853,10 @@ lpfc_unreg_vpi(struct lpfc_hba *phba, uint16_t vpi, LPFC_MBOXQ_t *pmb)
 	MAILBOX_t *mb = &pmb->u.mb;
 	memset(pmb, 0, sizeof (LPFC_MBOXQ_t));
 
-	mb->un.varUnregVpi.vpi = vpi + phba->vpi_base;
+	if (phba->sli_rev < LPFC_SLI_REV4)
+		mb->un.varUnregVpi.vpi = vpi + phba->vpi_base;
+	else
+		mb->un.varUnregVpi.sli4_vpi = vpi + phba->vpi_base;
 
 	mb->mbxCommand = MBX_UNREG_VPI;
 	mb->mbxOwner = OWN_HOST;
@@ -1132,7 +1139,7 @@ lpfc_config_ring(struct lpfc_hba * phba, int ring, LPFC_MBOXQ_t * pmb)
 	/* Otherwise we setup specific rctl / type masks for this ring */
 	for (i = 0; i < pring->num_mask; i++) {
 		mb->un.varCfgRing.rrRegs[i].rval = pring->prt[i].rctl;
-		if (mb->un.varCfgRing.rrRegs[i].rval != FC_ELS_REQ)
+		if (mb->un.varCfgRing.rrRegs[i].rval != FC_RCTL_ELS_REQ)
 			mb->un.varCfgRing.rrRegs[i].rmask = 0xff;
 		else
 			mb->un.varCfgRing.rrRegs[i].rmask = 0xfe;
@@ -1654,9 +1661,12 @@ lpfc_sli4_config(struct lpfc_hba *phba, struct lpfcMboxq *mbox,
 	/* Allocate record for keeping SGE virtual addresses */
 	mbox->sge_array = kmalloc(sizeof(struct lpfc_mbx_nembed_sge_virt),
 				  GFP_KERNEL);
-	if (!mbox->sge_array)
+	if (!mbox->sge_array) {
+		lpfc_printf_log(phba, KERN_ERR, LOG_MBOX,
+				"2527 Failed to allocate non-embedded SGE "
+				"array.\n");
 		return 0;
-
+	}
 	for (pagen = 0, alloc_len = 0; pagen < pcount; pagen++) {
 		/* The DMA memory is always allocated in the length of a
 		 * page even though the last SGE might not fill up to a
@@ -1753,11 +1763,6 @@ lpfc_request_features(struct lpfc_hba *phba, struct lpfcMboxq *mboxq)
 	/* Set up host requested features. */
 	bf_set(lpfc_mbx_rq_ftr_rq_fcpi, &mboxq->u.mqe.un.req_ftrs, 1);
 
-	if (phba->cfg_enable_fip)
-		bf_set(lpfc_mbx_rq_ftr_rq_ifip, &mboxq->u.mqe.un.req_ftrs, 0);
-	else
-		bf_set(lpfc_mbx_rq_ftr_rq_ifip, &mboxq->u.mqe.un.req_ftrs, 1);
-
 	/* Enable DIF (block guard) only if configured to do so. */
 	if (phba->cfg_enable_bg)
 		bf_set(lpfc_mbx_rq_ftr_rq_dif, &mboxq->u.mqe.un.req_ftrs, 1);
@@ -1817,6 +1822,9 @@ lpfc_reg_vfi(struct lpfcMboxq *mbox, struct lpfc_vport *vport, dma_addr_t phys)
 	bf_set(lpfc_reg_vfi_vfi, reg_vfi, vport->vfi + vport->phba->vfi_base);
 	bf_set(lpfc_reg_vfi_fcfi, reg_vfi, vport->phba->fcf.fcfi);
 	bf_set(lpfc_reg_vfi_vpi, reg_vfi, vport->vpi + vport->phba->vpi_base);
+	memcpy(reg_vfi->wwn, &vport->fc_portname, sizeof(struct lpfc_name));
+	reg_vfi->wwn[0] = cpu_to_le32(reg_vfi->wwn[0]);
+	reg_vfi->wwn[1] = cpu_to_le32(reg_vfi->wwn[1]);
 	reg_vfi->bde.addrHigh = putPaddrHigh(phys);
 	reg_vfi->bde.addrLow = putPaddrLow(phys);
 	reg_vfi->bde.tus.f.bdeSize = sizeof(vport->fc_sparam);
@@ -1850,7 +1858,7 @@ lpfc_init_vpi(struct lpfc_hba *phba, struct lpfcMboxq *mbox, uint16_t vpi)
 /**
  * lpfc_unreg_vfi - Initialize the UNREG_VFI mailbox command
  * @mbox: pointer to lpfc mbox command to initialize.
- * @vfi: VFI to be unregistered.
+ * @vport: vport associated with the VF.
  *
  * The UNREG_VFI mailbox command causes the SLI Host to put a virtual fabric
  * (logical NPort) into the inactive state. The SLI Host must have logged out
@@ -1859,11 +1867,12 @@ lpfc_init_vpi(struct lpfc_hba *phba, struct lpfcMboxq *mbox, uint16_t vpi)
  * fabric inactive.
  **/
 void
-lpfc_unreg_vfi(struct lpfcMboxq *mbox, uint16_t vfi)
+lpfc_unreg_vfi(struct lpfcMboxq *mbox, struct lpfc_vport *vport)
 {
 	memset(mbox, 0, sizeof(*mbox));
 	bf_set(lpfc_mqe_command, &mbox->u.mqe, MBX_UNREG_VFI);
-	bf_set(lpfc_unreg_vfi_vfi, &mbox->u.mqe.un.unreg_vfi, vfi);
+	bf_set(lpfc_unreg_vfi_vfi, &mbox->u.mqe.un.unreg_vfi,
+	       vport->vfi + vport->phba->vfi_base);
 }
 
 /**
diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c
index 3e74136f1ede..2ed6af194932 100644
--- a/drivers/scsi/lpfc/lpfc_nportdisc.c
+++ b/drivers/scsi/lpfc/lpfc_nportdisc.c
@@ -1223,6 +1223,12 @@ lpfc_rcv_logo_reglogin_issue(struct lpfc_vport *vport,
 	list_for_each_entry_safe(mb, nextmb, &phba->sli.mboxq, list) {
 		if ((mb->u.mb.mbxCommand == MBX_REG_LOGIN64) &&
 		   (ndlp == (struct lpfc_nodelist *) mb->context2)) {
+			if (phba->sli_rev == LPFC_SLI_REV4) {
+				spin_unlock_irq(&phba->hbalock);
+				lpfc_sli4_free_rpi(phba,
+					mb->u.mb.un.varRegLogin.rpi);
+				spin_lock_irq(&phba->hbalock);
+			}
 			mp = (struct lpfc_dmabuf *) (mb->context1);
 			if (mp) {
 				__lpfc_mbuf_free(phba, mp->virt, mp->phys);
@@ -1230,6 +1236,7 @@ lpfc_rcv_logo_reglogin_issue(struct lpfc_vport *vport,
 			}
 			lpfc_nlp_put(ndlp);
 			list_del(&mb->list);
+			phba->sli.mboxq_cnt--;
 			mempool_free(mb, phba->mbox_mem_pool);
 		}
 	}
diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
index c88f59f0ce30..a246410ce9df 100644
--- a/drivers/scsi/lpfc/lpfc_scsi.c
+++ b/drivers/scsi/lpfc/lpfc_scsi.c
@@ -59,22 +59,26 @@ static char *dif_op_str[] = {
 };
 static void
 lpfc_release_scsi_buf_s4(struct lpfc_hba *phba, struct lpfc_scsi_buf *psb);
+static void
+lpfc_release_scsi_buf_s3(struct lpfc_hba *phba, struct lpfc_scsi_buf *psb);
 
 static void
-lpfc_debug_save_data(struct scsi_cmnd *cmnd)
+lpfc_debug_save_data(struct lpfc_hba *phba, struct scsi_cmnd *cmnd)
 {
 	void *src, *dst;
 	struct scatterlist *sgde = scsi_sglist(cmnd);
 
 	if (!_dump_buf_data) {
-		printk(KERN_ERR "BLKGRD ERROR %s _dump_buf_data is NULL\n",
+		lpfc_printf_log(phba, KERN_ERR, LOG_BG,
+			"9050 BLKGRD: ERROR %s _dump_buf_data is NULL\n",
 				__func__);
 		return;
 	}
 
 
 	if (!sgde) {
-		printk(KERN_ERR "BLKGRD ERROR: data scatterlist is null\n");
+		lpfc_printf_log(phba, KERN_ERR, LOG_BG,
+			"9051 BLKGRD: ERROR: data scatterlist is null\n");
 		return;
 	}
 
@@ -88,19 +92,21 @@ lpfc_debug_save_data(struct scsi_cmnd *cmnd)
 }
 
 static void
-lpfc_debug_save_dif(struct scsi_cmnd *cmnd)
+lpfc_debug_save_dif(struct lpfc_hba *phba, struct scsi_cmnd *cmnd)
 {
 	void *src, *dst;
 	struct scatterlist *sgde = scsi_prot_sglist(cmnd);
 
 	if (!_dump_buf_dif) {
-		printk(KERN_ERR "BLKGRD ERROR %s _dump_buf_data is NULL\n",
+		lpfc_printf_log(phba, KERN_ERR, LOG_BG,
+			"9052 BLKGRD: ERROR %s _dump_buf_data is NULL\n",
 				__func__);
 		return;
 	}
 
 	if (!sgde) {
-		printk(KERN_ERR "BLKGRD ERROR: prot scatterlist is null\n");
+		lpfc_printf_log(phba, KERN_ERR, LOG_BG,
+			"9053 BLKGRD: ERROR: prot scatterlist is null\n");
 		return;
 	}
 
@@ -242,6 +248,36 @@ lpfc_send_sdev_queuedepth_change_event(struct lpfc_hba *phba,
 }
 
 /**
+ * lpfc_change_queue_depth - Alter scsi device queue depth
+ * @sdev: Pointer the scsi device on which to change the queue depth.
+ * @qdepth: New queue depth to set the sdev to.
+ * @reason: The reason for the queue depth change.
+ *
+ * This function is called by the midlayer and the LLD to alter the queue
+ * depth for a scsi device. This function sets the queue depth to the new
+ * value and sends an event out to log the queue depth change.
+ **/
+int
+lpfc_change_queue_depth(struct scsi_device *sdev, int qdepth, int reason)
+{
+	struct lpfc_vport *vport = (struct lpfc_vport *) sdev->host->hostdata;
+	struct lpfc_hba   *phba = vport->phba;
+	struct lpfc_rport_data *rdata;
+	unsigned long new_queue_depth, old_queue_depth;
+
+	old_queue_depth = sdev->queue_depth;
+	scsi_adjust_queue_depth(sdev, scsi_get_tag_type(sdev), qdepth);
+	new_queue_depth = sdev->queue_depth;
+	rdata = sdev->hostdata;
+	if (rdata)
+		lpfc_send_sdev_queuedepth_change_event(phba, vport,
+						       rdata->pnode, sdev->lun,
+						       old_queue_depth,
+						       new_queue_depth);
+	return sdev->queue_depth;
+}
+
+/**
  * lpfc_rampdown_queue_depth - Post RAMP_DOWN_QUEUE event to worker thread
  * @phba: The Hba for which this call is being executed.
  *
@@ -305,8 +341,10 @@ lpfc_rampup_queue_depth(struct lpfc_vport  *vport,
 	if (vport->cfg_lun_queue_depth <= queue_depth)
 		return;
 	spin_lock_irqsave(&phba->hbalock, flags);
-	if (((phba->last_ramp_up_time + QUEUE_RAMP_UP_INTERVAL) > jiffies) ||
-	 ((phba->last_rsrc_error_time + QUEUE_RAMP_UP_INTERVAL ) > jiffies)) {
+	if (time_before(jiffies,
+			phba->last_ramp_up_time + QUEUE_RAMP_UP_INTERVAL) ||
+	    time_before(jiffies,
+			phba->last_rsrc_error_time + QUEUE_RAMP_UP_INTERVAL)) {
 		spin_unlock_irqrestore(&phba->hbalock, flags);
 		return;
 	}
@@ -338,10 +376,9 @@ lpfc_ramp_down_queue_handler(struct lpfc_hba *phba)
 	struct lpfc_vport **vports;
 	struct Scsi_Host  *shost;
 	struct scsi_device *sdev;
-	unsigned long new_queue_depth, old_queue_depth;
+	unsigned long new_queue_depth;
 	unsigned long num_rsrc_err, num_cmd_success;
 	int i;
-	struct lpfc_rport_data *rdata;
 
 	num_rsrc_err = atomic_read(&phba->num_rsrc_err);
 	num_cmd_success = atomic_read(&phba->num_cmd_success);
@@ -359,22 +396,8 @@ lpfc_ramp_down_queue_handler(struct lpfc_hba *phba)
 				else
 					new_queue_depth = sdev->queue_depth -
 								new_queue_depth;
-				old_queue_depth = sdev->queue_depth;
-				if (sdev->ordered_tags)
-					scsi_adjust_queue_depth(sdev,
-							MSG_ORDERED_TAG,
-							new_queue_depth);
-				else
-					scsi_adjust_queue_depth(sdev,
-							MSG_SIMPLE_TAG,
-							new_queue_depth);
-				rdata = sdev->hostdata;
-				if (rdata)
-					lpfc_send_sdev_queuedepth_change_event(
-						phba, vports[i],
-						rdata->pnode,
-						sdev->lun, old_queue_depth,
-						new_queue_depth);
+				lpfc_change_queue_depth(sdev, new_queue_depth,
+							SCSI_QDEPTH_DEFAULT);
 			}
 		}
 	lpfc_destroy_vport_work_array(phba, vports);
@@ -398,7 +421,6 @@ lpfc_ramp_up_queue_handler(struct lpfc_hba *phba)
 	struct Scsi_Host  *shost;
 	struct scsi_device *sdev;
 	int i;
-	struct lpfc_rport_data *rdata;
 
 	vports = lpfc_create_vport_work_array(phba);
 	if (vports != NULL)
@@ -408,22 +430,9 @@ lpfc_ramp_up_queue_handler(struct lpfc_hba *phba)
 				if (vports[i]->cfg_lun_queue_depth <=
 				    sdev->queue_depth)
 					continue;
-				if (sdev->ordered_tags)
-					scsi_adjust_queue_depth(sdev,
-							MSG_ORDERED_TAG,
-							sdev->queue_depth+1);
-				else
-					scsi_adjust_queue_depth(sdev,
-							MSG_SIMPLE_TAG,
-							sdev->queue_depth+1);
-				rdata = sdev->hostdata;
-				if (rdata)
-					lpfc_send_sdev_queuedepth_change_event(
-						phba, vports[i],
-						rdata->pnode,
-						sdev->lun,
-						sdev->queue_depth - 1,
-						sdev->queue_depth);
+				lpfc_change_queue_depth(sdev,
+							sdev->queue_depth+1,
+							SCSI_QDEPTH_RAMP_UP);
 			}
 		}
 	lpfc_destroy_vport_work_array(phba, vports);
@@ -589,7 +598,7 @@ lpfc_new_scsi_buf_s3(struct lpfc_vport *vport, int num_to_alloc)
 		iocb->ulpClass = CLASS3;
 		psb->status = IOSTAT_SUCCESS;
 		/* Put it back into the SCSI buffer list */
-		lpfc_release_scsi_buf_s4(phba, psb);
+		lpfc_release_scsi_buf_s3(phba, psb);
 
 	}
 
@@ -1024,7 +1033,8 @@ lpfc_scsi_prep_dma_buf_s3(struct lpfc_hba *phba, struct lpfc_scsi_buf *lpfc_cmd)
 
 		lpfc_cmd->seg_cnt = nseg;
 		if (lpfc_cmd->seg_cnt > phba->cfg_sg_seg_cnt) {
-			printk(KERN_ERR "%s: Too many sg segments from "
+			lpfc_printf_log(phba, KERN_ERR, LOG_BG,
+				"9064 BLKGRD: %s: Too many sg segments from "
 			       "dma_map_sg.  Config %d, seg_cnt %d\n",
 			       __func__, phba->cfg_sg_seg_cnt,
 			       lpfc_cmd->seg_cnt);
@@ -1112,7 +1122,7 @@ lpfc_scsi_prep_dma_buf_s3(struct lpfc_hba *phba, struct lpfc_scsi_buf *lpfc_cmd)
  * with the cmd
  */
 static int
-lpfc_sc_to_sli_prof(struct scsi_cmnd *sc)
+lpfc_sc_to_sli_prof(struct lpfc_hba *phba, struct scsi_cmnd *sc)
 {
 	uint8_t guard_type = scsi_host_get_guard(sc->device->host);
 	uint8_t ret_prof = LPFC_PROF_INVALID;
@@ -1136,7 +1146,8 @@ lpfc_sc_to_sli_prof(struct scsi_cmnd *sc)
 
 		case SCSI_PROT_NORMAL:
 		default:
-			printk(KERN_ERR "Bad op/guard:%d/%d combination\n",
+			lpfc_printf_log(phba, KERN_ERR, LOG_BG,
+				"9063 BLKGRD:Bad op/guard:%d/%d combination\n",
 					scsi_get_prot_op(sc), guard_type);
 			break;
 
@@ -1157,7 +1168,8 @@ lpfc_sc_to_sli_prof(struct scsi_cmnd *sc)
 		case SCSI_PROT_WRITE_STRIP:
 		case SCSI_PROT_NORMAL:
 		default:
-			printk(KERN_ERR "Bad op/guard:%d/%d combination\n",
+			lpfc_printf_log(phba, KERN_ERR, LOG_BG,
+				"9075 BLKGRD: Bad op/guard:%d/%d combination\n",
 					scsi_get_prot_op(sc), guard_type);
 			break;
 		}
@@ -1259,7 +1271,7 @@ lpfc_bg_setup_bpl(struct lpfc_hba *phba, struct scsi_cmnd *sc,
 	uint16_t apptagmask, apptagval;
 
 	pde1 = (struct lpfc_pde *) bpl;
-	prof = lpfc_sc_to_sli_prof(sc);
+	prof = lpfc_sc_to_sli_prof(phba, sc);
 
 	if (prof == LPFC_PROF_INVALID)
 		goto out;
@@ -1359,7 +1371,7 @@ lpfc_bg_setup_bpl_prot(struct lpfc_hba *phba, struct scsi_cmnd *sc,
 		return 0;
 	}
 
-	prof = lpfc_sc_to_sli_prof(sc);
+	prof = lpfc_sc_to_sli_prof(phba, sc);
 	if (prof == LPFC_PROF_INVALID)
 		goto out;
 
@@ -1408,7 +1420,8 @@ lpfc_bg_setup_bpl_prot(struct lpfc_hba *phba, struct scsi_cmnd *sc,
 		subtotal = 0; /* total bytes processed for current prot grp */
 		while (!pgdone) {
 			if (!sgde) {
-				printk(KERN_ERR "%s Invalid data segment\n",
+				lpfc_printf_log(phba, KERN_ERR, LOG_BG,
+					"9065 BLKGRD:%s Invalid data segment\n",
 						__func__);
 				return 0;
 			}
@@ -1462,7 +1475,8 @@ lpfc_bg_setup_bpl_prot(struct lpfc_hba *phba, struct scsi_cmnd *sc,
 			reftag += protgrp_blks;
 		} else {
 			/* if we're here, we have a bug */
-			printk(KERN_ERR "BLKGRD: bug in %s\n", __func__);
+			lpfc_printf_log(phba, KERN_ERR, LOG_BG,
+				"9054 BLKGRD: bug in %s\n", __func__);
 		}
 
 	} while (!alldone);
@@ -1544,8 +1558,10 @@ lpfc_bg_scsi_prep_dma_buf(struct lpfc_hba *phba,
 
 		lpfc_cmd->seg_cnt = datasegcnt;
 		if (lpfc_cmd->seg_cnt > phba->cfg_sg_seg_cnt) {
-			printk(KERN_ERR "%s: Too many sg segments from "
-					"dma_map_sg.  Config %d, seg_cnt %d\n",
+			lpfc_printf_log(phba, KERN_ERR, LOG_BG,
+					"9067 BLKGRD: %s: Too many sg segments"
+					" from dma_map_sg.  Config %d, seg_cnt"
+					" %d\n",
 					__func__, phba->cfg_sg_seg_cnt,
 					lpfc_cmd->seg_cnt);
 			scsi_dma_unmap(scsi_cmnd);
@@ -1579,8 +1595,9 @@ lpfc_bg_scsi_prep_dma_buf(struct lpfc_hba *phba,
 			lpfc_cmd->prot_seg_cnt = protsegcnt;
 			if (lpfc_cmd->prot_seg_cnt
 			    > phba->cfg_prot_sg_seg_cnt) {
-				printk(KERN_ERR "%s: Too many prot sg segments "
-						"from dma_map_sg.  Config %d,"
+				lpfc_printf_log(phba, KERN_ERR, LOG_BG,
+					"9068 BLKGRD: %s: Too many prot sg "
+					"segments from dma_map_sg.  Config %d,"
 						"prot_seg_cnt %d\n", __func__,
 						phba->cfg_prot_sg_seg_cnt,
 						lpfc_cmd->prot_seg_cnt);
@@ -1671,23 +1688,26 @@ lpfc_parse_bg_err(struct lpfc_hba *phba, struct lpfc_scsi_buf *lpfc_cmd,
 	uint32_t bgstat = bgf->bgstat;
 	uint64_t failing_sector = 0;
 
-	printk(KERN_ERR "BG ERROR in cmd 0x%x lba 0x%llx blk cnt 0x%x "
+	lpfc_printf_log(phba, KERN_ERR, LOG_BG, "9069 BLKGRD: BG ERROR in cmd"
+			" 0x%x lba 0x%llx blk cnt 0x%x "
 			"bgstat=0x%x bghm=0x%x\n",
 			cmd->cmnd[0], (unsigned long long)scsi_get_lba(cmd),
 			blk_rq_sectors(cmd->request), bgstat, bghm);
 
 	spin_lock(&_dump_buf_lock);
 	if (!_dump_buf_done) {
-		printk(KERN_ERR "Saving Data for %u blocks to debugfs\n",
+		lpfc_printf_log(phba, KERN_ERR, LOG_BG,  "9070 BLKGRD: Saving"
+			" Data for %u blocks to debugfs\n",
 				(cmd->cmnd[7] << 8 | cmd->cmnd[8]));
-		lpfc_debug_save_data(cmd);
+		lpfc_debug_save_data(phba, cmd);
 
 		/* If we have a prot sgl, save the DIF buffer */
 		if (lpfc_prot_group_type(phba, cmd) ==
 				LPFC_PG_TYPE_DIF_BUF) {
-			printk(KERN_ERR "Saving DIF for %u blocks to debugfs\n",
-					(cmd->cmnd[7] << 8 | cmd->cmnd[8]));
-			lpfc_debug_save_dif(cmd);
+			lpfc_printf_log(phba, KERN_ERR, LOG_BG, "9071 BLKGRD: "
+				"Saving DIF for %u blocks to debugfs\n",
+				(cmd->cmnd[7] << 8 | cmd->cmnd[8]));
+			lpfc_debug_save_dif(phba, cmd);
 		}
 
 		_dump_buf_done = 1;
@@ -1696,15 +1716,17 @@ lpfc_parse_bg_err(struct lpfc_hba *phba, struct lpfc_scsi_buf *lpfc_cmd,
 
 	if (lpfc_bgs_get_invalid_prof(bgstat)) {
 		cmd->result = ScsiResult(DID_ERROR, 0);
-		printk(KERN_ERR "Invalid BlockGuard profile. bgstat:0x%x\n",
-				bgstat);
+		lpfc_printf_log(phba, KERN_ERR, LOG_BG, "9072 BLKGRD: Invalid"
+			" BlockGuard profile. bgstat:0x%x\n",
+			bgstat);
 		ret = (-1);
 		goto out;
 	}
 
 	if (lpfc_bgs_get_uninit_dif_block(bgstat)) {
 		cmd->result = ScsiResult(DID_ERROR, 0);
-		printk(KERN_ERR "Invalid BlockGuard DIF Block. bgstat:0x%x\n",
+		lpfc_printf_log(phba, KERN_ERR, LOG_BG, "9073 BLKGRD: "
+				"Invalid BlockGuard DIF Block. bgstat:0x%x\n",
 				bgstat);
 		ret = (-1);
 		goto out;
@@ -1718,7 +1740,8 @@ lpfc_parse_bg_err(struct lpfc_hba *phba, struct lpfc_scsi_buf *lpfc_cmd,
 		cmd->result = DRIVER_SENSE << 24
 			| ScsiResult(DID_ABORT, SAM_STAT_CHECK_CONDITION);
 		phba->bg_guard_err_cnt++;
-		printk(KERN_ERR "BLKGRD: guard_tag error\n");
+		lpfc_printf_log(phba, KERN_ERR, LOG_BG,
+			"9055 BLKGRD: guard_tag error\n");
 	}
 
 	if (lpfc_bgs_get_reftag_err(bgstat)) {
@@ -1730,7 +1753,8 @@ lpfc_parse_bg_err(struct lpfc_hba *phba, struct lpfc_scsi_buf *lpfc_cmd,
 			| ScsiResult(DID_ABORT, SAM_STAT_CHECK_CONDITION);
 
 		phba->bg_reftag_err_cnt++;
-		printk(KERN_ERR "BLKGRD: ref_tag error\n");
+		lpfc_printf_log(phba, KERN_ERR, LOG_BG,
+			"9056 BLKGRD: ref_tag error\n");
 	}
 
 	if (lpfc_bgs_get_apptag_err(bgstat)) {
@@ -1742,7 +1766,8 @@ lpfc_parse_bg_err(struct lpfc_hba *phba, struct lpfc_scsi_buf *lpfc_cmd,
 			| ScsiResult(DID_ABORT, SAM_STAT_CHECK_CONDITION);
 
 		phba->bg_apptag_err_cnt++;
-		printk(KERN_ERR "BLKGRD: app_tag error\n");
+		lpfc_printf_log(phba, KERN_ERR, LOG_BG,
+			"9061 BLKGRD: app_tag error\n");
 	}
 
 	if (lpfc_bgs_get_hi_water_mark_present(bgstat)) {
@@ -1763,7 +1788,8 @@ lpfc_parse_bg_err(struct lpfc_hba *phba, struct lpfc_scsi_buf *lpfc_cmd,
 	if (!ret) {
 		/* No error was reported - problem in FW? */
 		cmd->result = ScsiResult(DID_ERROR, 0);
-		printk(KERN_ERR "BLKGRD: no errors reported!\n");
+		lpfc_printf_log(phba, KERN_ERR, LOG_BG,
+			"9057 BLKGRD: no errors reported!\n");
 	}
 
 out:
@@ -1822,9 +1848,10 @@ lpfc_scsi_prep_dma_buf_s4(struct lpfc_hba *phba, struct lpfc_scsi_buf *lpfc_cmd)
 
 		lpfc_cmd->seg_cnt = nseg;
 		if (lpfc_cmd->seg_cnt > phba->cfg_sg_seg_cnt) {
-			printk(KERN_ERR "%s: Too many sg segments from "
-			       "dma_map_sg.  Config %d, seg_cnt %d\n",
-			       __func__, phba->cfg_sg_seg_cnt,
+			lpfc_printf_log(phba, KERN_ERR, LOG_BG, "9074 BLKGRD:"
+				" %s: Too many sg segments from "
+				"dma_map_sg.  Config %d, seg_cnt %d\n",
+				__func__, phba->cfg_sg_seg_cnt,
 			       lpfc_cmd->seg_cnt);
 			scsi_dma_unmap(scsi_cmnd);
 			return 1;
@@ -2050,6 +2077,21 @@ lpfc_handle_fcp_err(struct lpfc_vport *vport, struct lpfc_scsi_buf *lpfc_cmd,
 		goto out;
 	}
 
+	if (resp_info & RSP_LEN_VALID) {
+		rsplen = be32_to_cpu(fcprsp->rspRspLen);
+		if ((rsplen != 0 && rsplen != 4 && rsplen != 8) ||
+		    (fcprsp->rspInfo3 != RSP_NO_FAILURE)) {
+			lpfc_printf_vlog(vport, KERN_ERR, LOG_FCP,
+				 "2719 Invalid response length: "
+				 "tgt x%x lun x%x cmnd x%x rsplen x%x\n",
+				 cmnd->device->id,
+				 cmnd->device->lun, cmnd->cmnd[0],
+				 rsplen);
+			host_status = DID_ERROR;
+			goto out;
+		}
+	}
+
 	if ((resp_info & SNS_LEN_VALID) && fcprsp->rspSnsLen) {
 		uint32_t snslen = be32_to_cpu(fcprsp->rspSnsLen);
 		if (snslen > SCSI_SENSE_BUFFERSIZE)
@@ -2074,15 +2116,6 @@ lpfc_handle_fcp_err(struct lpfc_vport *vport, struct lpfc_scsi_buf *lpfc_cmd,
 			 be32_to_cpu(fcprsp->rspRspLen),
 			 fcprsp->rspInfo3);
 
-	if (resp_info & RSP_LEN_VALID) {
-		rsplen = be32_to_cpu(fcprsp->rspRspLen);
-		if ((rsplen != 0 && rsplen != 4 && rsplen != 8) ||
-		    (fcprsp->rspInfo3 != RSP_NO_FAILURE)) {
-			host_status = DID_ERROR;
-			goto out;
-		}
-	}
-
 	scsi_set_resid(cmnd, 0);
 	if (resp_info & RESID_UNDER) {
 		scsi_set_resid(cmnd, be32_to_cpu(fcprsp->rspResId));
@@ -2180,7 +2213,7 @@ lpfc_scsi_cmd_iocb_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *pIocbIn,
 	struct scsi_cmnd *cmd = lpfc_cmd->pCmd;
 	int result;
 	struct scsi_device *tmp_sdev;
-	int depth = 0;
+	int depth;
 	unsigned long flags;
 	struct lpfc_fast_path_event *fast_path_evt;
 	struct Scsi_Host *shost = cmd->device->host;
@@ -2264,7 +2297,7 @@ lpfc_scsi_cmd_iocb_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *pIocbIn,
 					lpfc_printf_vlog(vport, KERN_WARNING,
 							LOG_BG,
 							"9031 non-zero BGSTAT "
-							"on unprotected cmd");
+							"on unprotected cmd\n");
 				}
 			}
 
@@ -2347,67 +2380,29 @@ lpfc_scsi_cmd_iocb_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *pIocbIn,
 		return;
 	}
 
-
 	if (!result)
 		lpfc_rampup_queue_depth(vport, queue_depth);
 
-	if (!result && pnode && NLP_CHK_NODE_ACT(pnode) &&
-	   ((jiffies - pnode->last_ramp_up_time) >
-		LPFC_Q_RAMP_UP_INTERVAL * HZ) &&
-	   ((jiffies - pnode->last_q_full_time) >
-		LPFC_Q_RAMP_UP_INTERVAL * HZ) &&
-	   (vport->cfg_lun_queue_depth > queue_depth)) {
-		shost_for_each_device(tmp_sdev, shost) {
-			if (vport->cfg_lun_queue_depth > tmp_sdev->queue_depth){
-				if (tmp_sdev->id != scsi_id)
-					continue;
-				if (tmp_sdev->ordered_tags)
-					scsi_adjust_queue_depth(tmp_sdev,
-						MSG_ORDERED_TAG,
-						tmp_sdev->queue_depth+1);
-				else
-					scsi_adjust_queue_depth(tmp_sdev,
-						MSG_SIMPLE_TAG,
-						tmp_sdev->queue_depth+1);
-
-				pnode->last_ramp_up_time = jiffies;
-			}
-		}
-		lpfc_send_sdev_queuedepth_change_event(phba, vport, pnode,
-			0xFFFFFFFF,
-			queue_depth , queue_depth + 1);
-	}
-
 	/*
 	 * Check for queue full.  If the lun is reporting queue full, then
 	 * back off the lun queue depth to prevent target overloads.
 	 */
 	if (result == SAM_STAT_TASK_SET_FULL && pnode &&
 	    NLP_CHK_NODE_ACT(pnode)) {
-		pnode->last_q_full_time = jiffies;
-
 		shost_for_each_device(tmp_sdev, shost) {
 			if (tmp_sdev->id != scsi_id)
 				continue;
 			depth = scsi_track_queue_full(tmp_sdev,
-					tmp_sdev->queue_depth - 1);
-		}
-		/*
-		 * The queue depth cannot be lowered any more.
-		 * Modify the returned error code to store
-		 * the final depth value set by
-		 * scsi_track_queue_full.
-		 */
-		if (depth == -1)
-			depth = shost->cmd_per_lun;
-
-		if (depth) {
+						      tmp_sdev->queue_depth-1);
+			if (depth <= 0)
+				continue;
 			lpfc_printf_vlog(vport, KERN_WARNING, LOG_FCP,
 					 "0711 detected queue full - lun queue "
 					 "depth adjusted to %d.\n", depth);
 			lpfc_send_sdev_queuedepth_change_event(phba, vport,
-				pnode, 0xFFFFFFFF,
-				depth+1, depth);
+							       pnode,
+							       tmp_sdev->lun,
+							       depth+1, depth);
 		}
 	}
 
@@ -2745,7 +2740,9 @@ void lpfc_poll_timeout(unsigned long ptr)
 	struct lpfc_hba *phba = (struct lpfc_hba *) ptr;
 
 	if (phba->cfg_poll & ENABLE_FCP_RING_POLLING) {
-		lpfc_sli_poll_fcp_ring (phba);
+		lpfc_sli_handle_fast_ring_event(phba,
+			&phba->sli.ring[LPFC_FCP_RING], HA_R0RE_REQ);
+
 		if (phba->cfg_poll & DISABLE_FCP_RING_INT)
 			lpfc_poll_rearm_timer(phba);
 	}
@@ -2771,7 +2768,7 @@ lpfc_queuecommand(struct scsi_cmnd *cmnd, void (*done) (struct scsi_cmnd *))
 	struct lpfc_vport *vport = (struct lpfc_vport *) shost->hostdata;
 	struct lpfc_hba   *phba = vport->phba;
 	struct lpfc_rport_data *rdata = cmnd->device->hostdata;
-	struct lpfc_nodelist *ndlp = rdata->pnode;
+	struct lpfc_nodelist *ndlp;
 	struct lpfc_scsi_buf *lpfc_cmd;
 	struct fc_rport *rport = starget_to_rport(scsi_target(cmnd->device));
 	int err;
@@ -2781,13 +2778,15 @@ lpfc_queuecommand(struct scsi_cmnd *cmnd, void (*done) (struct scsi_cmnd *))
 		cmnd->result = err;
 		goto out_fail_command;
 	}
+	ndlp = rdata->pnode;
 
 	if (!(phba->sli3_options & LPFC_SLI3_BG_ENABLED) &&
 		scsi_get_prot_op(cmnd) != SCSI_PROT_NORMAL) {
 
-		printk(KERN_ERR "BLKGRD ERROR: rcvd protected cmd:%02x op:%02x "
-				"str=%s without registering for BlockGuard - "
-				"Rejecting command\n",
+		lpfc_printf_log(phba, KERN_ERR, LOG_BG,
+				"9058 BLKGRD: ERROR: rcvd protected cmd:%02x"
+				" op:%02x str=%s without registering for"
+				" BlockGuard - Rejecting command\n",
 				cmnd->cmnd[0], scsi_get_prot_op(cmnd),
 				dif_op_str[scsi_get_prot_op(cmnd)]);
 		goto out_fail_command;
@@ -2827,61 +2826,66 @@ lpfc_queuecommand(struct scsi_cmnd *cmnd, void (*done) (struct scsi_cmnd *))
 	cmnd->scsi_done = done;
 
 	if (scsi_get_prot_op(cmnd) != SCSI_PROT_NORMAL) {
-		lpfc_printf_vlog(vport, KERN_WARNING, LOG_BG,
+		if (vport->phba->cfg_enable_bg) {
+			lpfc_printf_vlog(vport, KERN_WARNING, LOG_BG,
 				"9033 BLKGRD: rcvd protected cmd:%02x op:%02x "
 				"str=%s\n",
 				cmnd->cmnd[0], scsi_get_prot_op(cmnd),
 				dif_op_str[scsi_get_prot_op(cmnd)]);
-		lpfc_printf_vlog(vport, KERN_WARNING, LOG_BG,
+			lpfc_printf_vlog(vport, KERN_WARNING, LOG_BG,
 				"9034 BLKGRD: CDB: %02x %02x %02x %02x %02x "
 				"%02x %02x %02x %02x %02x\n",
 				cmnd->cmnd[0], cmnd->cmnd[1], cmnd->cmnd[2],
 				cmnd->cmnd[3], cmnd->cmnd[4], cmnd->cmnd[5],
 				cmnd->cmnd[6], cmnd->cmnd[7], cmnd->cmnd[8],
 				cmnd->cmnd[9]);
-		if (cmnd->cmnd[0] == READ_10)
-			lpfc_printf_vlog(vport, KERN_WARNING, LOG_BG,
+			if (cmnd->cmnd[0] == READ_10)
+				lpfc_printf_vlog(vport, KERN_WARNING, LOG_BG,
 					"9035 BLKGRD: READ @ sector %llu, "
 					"count %u\n",
 					(unsigned long long)scsi_get_lba(cmnd),
 					blk_rq_sectors(cmnd->request));
-		else if (cmnd->cmnd[0] == WRITE_10)
-			lpfc_printf_vlog(vport, KERN_WARNING, LOG_BG,
+			else if (cmnd->cmnd[0] == WRITE_10)
+				lpfc_printf_vlog(vport, KERN_WARNING, LOG_BG,
 					"9036 BLKGRD: WRITE @ sector %llu, "
 					"count %u cmd=%p\n",
 					(unsigned long long)scsi_get_lba(cmnd),
 					blk_rq_sectors(cmnd->request),
 					cmnd);
+		}
 
 		err = lpfc_bg_scsi_prep_dma_buf(phba, lpfc_cmd);
 	} else {
-		lpfc_printf_vlog(vport, KERN_WARNING, LOG_BG,
-				"9038 BLKGRD: rcvd unprotected cmd:%02x op:%02x"
-				" str=%s\n",
-				cmnd->cmnd[0], scsi_get_prot_op(cmnd),
-				dif_op_str[scsi_get_prot_op(cmnd)]);
-		lpfc_printf_vlog(vport, KERN_WARNING, LOG_BG,
-				 "9039 BLKGRD: CDB: %02x %02x %02x %02x %02x "
-				 "%02x %02x %02x %02x %02x\n",
-				 cmnd->cmnd[0], cmnd->cmnd[1], cmnd->cmnd[2],
-				 cmnd->cmnd[3], cmnd->cmnd[4], cmnd->cmnd[5],
-				 cmnd->cmnd[6], cmnd->cmnd[7], cmnd->cmnd[8],
-				 cmnd->cmnd[9]);
-		if (cmnd->cmnd[0] == READ_10)
+		if (vport->phba->cfg_enable_bg) {
 			lpfc_printf_vlog(vport, KERN_WARNING, LOG_BG,
-					 "9040 dbg: READ @ sector %llu, "
-					 "count %u\n",
-					 (unsigned long long)scsi_get_lba(cmnd),
+					"9038 BLKGRD: rcvd unprotected cmd:"
+					"%02x op:%02x str=%s\n",
+					cmnd->cmnd[0], scsi_get_prot_op(cmnd),
+					dif_op_str[scsi_get_prot_op(cmnd)]);
+				lpfc_printf_vlog(vport, KERN_WARNING, LOG_BG,
+					"9039 BLKGRD: CDB: %02x %02x %02x "
+					"%02x %02x %02x %02x %02x %02x %02x\n",
+					cmnd->cmnd[0], cmnd->cmnd[1],
+					cmnd->cmnd[2], cmnd->cmnd[3],
+					cmnd->cmnd[4], cmnd->cmnd[5],
+					cmnd->cmnd[6], cmnd->cmnd[7],
+					cmnd->cmnd[8], cmnd->cmnd[9]);
+			if (cmnd->cmnd[0] == READ_10)
+				lpfc_printf_vlog(vport, KERN_WARNING, LOG_BG,
+					"9040 dbg: READ @ sector %llu, "
+					"count %u\n",
+					(unsigned long long)scsi_get_lba(cmnd),
 					 blk_rq_sectors(cmnd->request));
-		else if (cmnd->cmnd[0] == WRITE_10)
-			lpfc_printf_vlog(vport, KERN_WARNING, LOG_BG,
+			else if (cmnd->cmnd[0] == WRITE_10)
+				lpfc_printf_vlog(vport, KERN_WARNING, LOG_BG,
 					 "9041 dbg: WRITE @ sector %llu, "
 					 "count %u cmd=%p\n",
 					 (unsigned long long)scsi_get_lba(cmnd),
 					 blk_rq_sectors(cmnd->request), cmnd);
-		else
-			lpfc_printf_vlog(vport, KERN_WARNING, LOG_BG,
+			else
+				lpfc_printf_vlog(vport, KERN_WARNING, LOG_BG,
 					 "9042 dbg: parser not implemented\n");
+		}
 		err = lpfc_scsi_prep_dma_buf(phba, lpfc_cmd);
 	}
 
@@ -2898,7 +2902,11 @@ lpfc_queuecommand(struct scsi_cmnd *cmnd, void (*done) (struct scsi_cmnd *))
 		goto out_host_busy_free_buf;
 	}
 	if (phba->cfg_poll & ENABLE_FCP_RING_POLLING) {
-		lpfc_sli_poll_fcp_ring(phba);
+		spin_unlock(shost->host_lock);
+		lpfc_sli_handle_fast_ring_event(phba,
+			&phba->sli.ring[LPFC_FCP_RING], HA_R0RE_REQ);
+
+		spin_lock(shost->host_lock);
 		if (phba->cfg_poll & DISABLE_FCP_RING_INT)
 			lpfc_poll_rearm_timer(phba);
 	}
@@ -2917,28 +2925,6 @@ lpfc_queuecommand(struct scsi_cmnd *cmnd, void (*done) (struct scsi_cmnd *))
 }
 
 /**
- * lpfc_block_error_handler - Routine to block error  handler
- * @cmnd: Pointer to scsi_cmnd data structure.
- *
- *  This routine blocks execution till fc_rport state is not FC_PORSTAT_BLCOEKD.
- **/
-static void
-lpfc_block_error_handler(struct scsi_cmnd *cmnd)
-{
-	struct Scsi_Host *shost = cmnd->device->host;
-	struct fc_rport *rport = starget_to_rport(scsi_target(cmnd->device));
-
-	spin_lock_irq(shost->host_lock);
-	while (rport->port_state == FC_PORTSTATE_BLOCKED) {
-		spin_unlock_irq(shost->host_lock);
-		msleep(1000);
-		spin_lock_irq(shost->host_lock);
-	}
-	spin_unlock_irq(shost->host_lock);
-	return;
-}
-
-/**
  * lpfc_abort_handler - scsi_host_template eh_abort_handler entry point
  * @cmnd: Pointer to scsi_cmnd data structure.
  *
@@ -2961,7 +2947,7 @@ lpfc_abort_handler(struct scsi_cmnd *cmnd)
 	int ret = SUCCESS;
 	DECLARE_WAIT_QUEUE_HEAD_ONSTACK(waitq);
 
-	lpfc_block_error_handler(cmnd);
+	fc_block_scsi_eh(cmnd);
 	lpfc_cmd = (struct lpfc_scsi_buf *)cmnd->host_scribble;
 	BUG_ON(!lpfc_cmd);
 
@@ -3001,6 +2987,10 @@ lpfc_abort_handler(struct scsi_cmnd *cmnd)
 
 	icmd->ulpLe = 1;
 	icmd->ulpClass = cmd->ulpClass;
+
+	/* ABTS WQE must go to the same WQ as the WQE to be aborted */
+	abtsiocb->fcp_wqidx = iocb->fcp_wqidx;
+
 	if (lpfc_is_link_up(phba))
 		icmd->ulpCommand = CMD_ABORT_XRI_CN;
 	else
@@ -3016,7 +3006,8 @@ lpfc_abort_handler(struct scsi_cmnd *cmnd)
 	}
 
 	if (phba->cfg_poll & DISABLE_FCP_RING_INT)
-		lpfc_sli_poll_fcp_ring (phba);
+		lpfc_sli_handle_fast_ring_event(phba,
+			&phba->sli.ring[LPFC_FCP_RING], HA_R0RE_REQ);
 
 	lpfc_cmd->waitq = &waitq;
 	/* Wait for abort to complete */
@@ -3166,9 +3157,15 @@ static int
 lpfc_chk_tgt_mapped(struct lpfc_vport *vport, struct scsi_cmnd *cmnd)
 {
 	struct lpfc_rport_data *rdata = cmnd->device->hostdata;
-	struct lpfc_nodelist *pnode = rdata->pnode;
+	struct lpfc_nodelist *pnode;
 	unsigned long later;
 
+	if (!rdata) {
+		lpfc_printf_vlog(vport, KERN_INFO, LOG_FCP,
+			"0797 Tgt Map rport failure: rdata x%p\n", rdata);
+		return FAILED;
+	}
+	pnode = rdata->pnode;
 	/*
 	 * If target is not in a MAPPED state, delay until
 	 * target is rediscovered or devloss timeout expires.
@@ -3253,13 +3250,19 @@ lpfc_device_reset_handler(struct scsi_cmnd *cmnd)
 	struct Scsi_Host  *shost = cmnd->device->host;
 	struct lpfc_vport *vport = (struct lpfc_vport *) shost->hostdata;
 	struct lpfc_rport_data *rdata = cmnd->device->hostdata;
-	struct lpfc_nodelist *pnode = rdata->pnode;
+	struct lpfc_nodelist *pnode;
 	unsigned tgt_id = cmnd->device->id;
 	unsigned int lun_id = cmnd->device->lun;
 	struct lpfc_scsi_event_header scsi_event;
 	int status;
 
-	lpfc_block_error_handler(cmnd);
+	if (!rdata) {
+		lpfc_printf_vlog(vport, KERN_ERR, LOG_FCP,
+			"0798 Device Reset rport failure: rdata x%p\n", rdata);
+		return FAILED;
+	}
+	pnode = rdata->pnode;
+	fc_block_scsi_eh(cmnd);
 
 	status = lpfc_chk_tgt_mapped(vport, cmnd);
 	if (status == FAILED) {
@@ -3312,13 +3315,19 @@ lpfc_target_reset_handler(struct scsi_cmnd *cmnd)
 	struct Scsi_Host  *shost = cmnd->device->host;
 	struct lpfc_vport *vport = (struct lpfc_vport *) shost->hostdata;
 	struct lpfc_rport_data *rdata = cmnd->device->hostdata;
-	struct lpfc_nodelist *pnode = rdata->pnode;
+	struct lpfc_nodelist *pnode;
 	unsigned tgt_id = cmnd->device->id;
 	unsigned int lun_id = cmnd->device->lun;
 	struct lpfc_scsi_event_header scsi_event;
 	int status;
 
-	lpfc_block_error_handler(cmnd);
+	if (!rdata) {
+		lpfc_printf_vlog(vport, KERN_ERR, LOG_FCP,
+			"0799 Target Reset rport failure: rdata x%p\n", rdata);
+		return FAILED;
+	}
+	pnode = rdata->pnode;
+	fc_block_scsi_eh(cmnd);
 
 	status = lpfc_chk_tgt_mapped(vport, cmnd);
 	if (status == FAILED) {
@@ -3384,7 +3393,7 @@ lpfc_bus_reset_handler(struct scsi_cmnd *cmnd)
 	fc_host_post_vendor_event(shost, fc_get_event_number(),
 		sizeof(scsi_event), (char *)&scsi_event, LPFC_NL_VENDOR_ID);
 
-	lpfc_block_error_handler(cmnd);
+	fc_block_scsi_eh(cmnd);
 
 	/*
 	 * Since the driver manages a single bus device, reset all
@@ -3498,6 +3507,8 @@ lpfc_slave_alloc(struct scsi_device *sdev)
 				 "Allocated %d buffers.\n",
 				 num_to_alloc, num_allocated);
 	}
+	if (num_allocated > 0)
+		phba->total_scsi_bufs += num_allocated;
 	return 0;
 }
 
@@ -3534,7 +3545,8 @@ lpfc_slave_configure(struct scsi_device *sdev)
 	rport->dev_loss_tmo = vport->cfg_devloss_tmo;
 
 	if (phba->cfg_poll & ENABLE_FCP_RING_POLLING) {
-		lpfc_sli_poll_fcp_ring(phba);
+		lpfc_sli_handle_fast_ring_event(phba,
+			&phba->sli.ring[LPFC_FCP_RING], HA_R0RE_REQ);
 		if (phba->cfg_poll & DISABLE_FCP_RING_INT)
 			lpfc_poll_rearm_timer(phba);
 	}
@@ -3576,6 +3588,7 @@ struct scsi_host_template lpfc_template = {
 	.shost_attrs		= lpfc_hba_attrs,
 	.max_sectors		= 0xFFFF,
 	.vendor_id		= LPFC_NL_VENDOR_ID,
+	.change_queue_depth	= lpfc_change_queue_depth,
 };
 
 struct scsi_host_template lpfc_vport_template = {
@@ -3597,4 +3610,5 @@ struct scsi_host_template lpfc_vport_template = {
 	.use_clustering		= ENABLE_CLUSTERING,
 	.shost_attrs		= lpfc_vport_attrs,
 	.max_sectors		= 0xFFFF,
+	.change_queue_depth	= lpfc_change_queue_depth,
 };
diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index 43cbe336f1f8..589549b2bf0e 100644
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -30,6 +30,7 @@
 #include <scsi/scsi_host.h>
 #include <scsi/scsi_transport_fc.h>
 #include <scsi/fc/fc_fs.h>
+#include <linux/aer.h>
 
 #include "lpfc_hw4.h"
 #include "lpfc_hw.h"
@@ -58,8 +59,11 @@ typedef enum _lpfc_iocb_type {
 static int lpfc_sli_issue_mbox_s4(struct lpfc_hba *, LPFC_MBOXQ_t *,
 				  uint32_t);
 static int lpfc_sli4_read_rev(struct lpfc_hba *, LPFC_MBOXQ_t *,
-			    uint8_t *, uint32_t *);
-
+			      uint8_t *, uint32_t *);
+static struct lpfc_iocbq *lpfc_sli4_els_wcqe_to_rspiocbq(struct lpfc_hba *,
+							 struct lpfc_iocbq *);
+static void lpfc_sli4_send_seq_to_ulp(struct lpfc_vport *,
+				      struct hbq_dmabuf *);
 static IOCB_t *
 lpfc_get_iocb_from_iocbq(struct lpfc_iocbq *iocbq)
 {
@@ -259,6 +263,9 @@ lpfc_sli4_eq_release(struct lpfc_queue *q, bool arm)
 	bf_set(lpfc_eqcq_doorbell_qt, &doorbell, LPFC_QUEUE_TYPE_EVENT);
 	bf_set(lpfc_eqcq_doorbell_eqid, &doorbell, q->queue_id);
 	writel(doorbell.word0, q->phba->sli4_hba.EQCQDBregaddr);
+	/* PCI read to flush PCI pipeline on re-arming for INTx mode */
+	if ((q->phba->intr_type == INTx) && (arm == LPFC_QUEUE_REARM))
+		readl(q->phba->sli4_hba.EQCQDBregaddr);
 	return released;
 }
 
@@ -515,6 +522,8 @@ __lpfc_sli_get_sglq(struct lpfc_hba *phba)
 	struct lpfc_sglq *sglq = NULL;
 	uint16_t adj_xri;
 	list_remove_head(lpfc_sgl_list, sglq, struct lpfc_sglq, list);
+	if (!sglq)
+		return NULL;
 	adj_xri = sglq->sli4_xritag - phba->sli4_hba.max_cfg_param.xri_base;
 	phba->sli4_hba.lpfc_sglq_active_list[adj_xri] = sglq;
 	return sglq;
@@ -572,9 +581,9 @@ __lpfc_sli_release_iocbq_s4(struct lpfc_hba *phba, struct lpfc_iocbq *iocbq)
 		sglq = __lpfc_clear_active_sglq(phba, iocbq->sli4_xritag);
 	if (sglq)  {
 		if (iocbq->iocb_flag & LPFC_DRIVER_ABORTED
-			|| ((iocbq->iocb.ulpStatus == IOSTAT_LOCAL_REJECT)
+			&& ((iocbq->iocb.ulpStatus == IOSTAT_LOCAL_REJECT)
 			&& (iocbq->iocb.un.ulpWord[4]
-				== IOERR_SLI_ABORTED))) {
+				== IOERR_ABORT_REQUESTED))) {
 			spin_lock_irqsave(&phba->sli4_hba.abts_sgl_list_lock,
 					iflag);
 			list_add(&sglq->list,
@@ -767,6 +776,7 @@ lpfc_sli_iocb_cmd_type(uint8_t iocb_cmnd)
 	case CMD_CLOSE_XRI_CX:
 	case CMD_XRI_ABORTED_CX:
 	case CMD_ABORT_MXRI64_CN:
+	case CMD_XMIT_BLS_RSP64_CX:
 		type = LPFC_ABORT_IOCB;
 		break;
 	case CMD_RCV_SEQUENCE_CX:
@@ -1373,7 +1383,7 @@ lpfc_sli_hbq_to_firmware_s4(struct lpfc_hba *phba, uint32_t hbqno,
 /* HBQ for ELS and CT traffic. */
 static struct lpfc_hbq_init lpfc_els_hbq = {
 	.rn = 1,
-	.entry_count = 200,
+	.entry_count = 256,
 	.mask_count = 0,
 	.profile = 0,
 	.ring_mask = (1 << LPFC_ELS_RING),
@@ -1472,8 +1482,11 @@ err:
 int
 lpfc_sli_hbqbuf_add_hbqs(struct lpfc_hba *phba, uint32_t qno)
 {
-	return(lpfc_sli_hbqbuf_fill_hbqs(phba, qno,
-					 lpfc_hbq_defs[qno]->add_count));
+	if (phba->sli_rev == LPFC_SLI_REV4)
+		return 0;
+	else
+		return lpfc_sli_hbqbuf_fill_hbqs(phba, qno,
+					 lpfc_hbq_defs[qno]->add_count);
 }
 
 /**
@@ -1488,8 +1501,12 @@ lpfc_sli_hbqbuf_add_hbqs(struct lpfc_hba *phba, uint32_t qno)
 static int
 lpfc_sli_hbqbuf_init_hbqs(struct lpfc_hba *phba, uint32_t qno)
 {
-	return(lpfc_sli_hbqbuf_fill_hbqs(phba, qno,
-					 lpfc_hbq_defs[qno]->init_count));
+	if (phba->sli_rev == LPFC_SLI_REV4)
+		return lpfc_sli_hbqbuf_fill_hbqs(phba, qno,
+					 lpfc_hbq_defs[qno]->entry_count);
+	else
+		return lpfc_sli_hbqbuf_fill_hbqs(phba, qno,
+					 lpfc_hbq_defs[qno]->init_count);
 }
 
 /**
@@ -1794,7 +1811,7 @@ lpfc_sli_handle_mb_event(struct lpfc_hba *phba)
 		 */
 		if (lpfc_sli_chk_mbx_command(pmbox->mbxCommand) ==
 		    MBX_SHUTDOWN) {
-			/* Unknow mailbox command compl */
+			/* Unknown mailbox command compl */
 			lpfc_printf_log(phba, KERN_ERR, LOG_MBOX | LOG_SLI,
 					"(%d):0323 Unknown Mailbox command "
 					"x%x (x%x) Cmpl\n",
@@ -2068,8 +2085,8 @@ lpfc_sli_process_unsol_iocb(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
 	if ((irsp->ulpCommand == CMD_RCV_ELS_REQ64_CX) ||
 	    (irsp->ulpCommand == CMD_RCV_ELS_REQ_CX) ||
 	    (irsp->ulpCommand == CMD_IOCB_RCV_ELS64_CX)) {
-		Rctl = FC_ELS_REQ;
-		Type = FC_ELS_DATA;
+		Rctl = FC_RCTL_ELS_REQ;
+		Type = FC_TYPE_ELS;
 	} else {
 		w5p = (WORD5 *)&(saveq->iocb.un.ulpWord[5]);
 		Rctl = w5p->hcsw.Rctl;
@@ -2079,8 +2096,8 @@ lpfc_sli_process_unsol_iocb(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
 		if ((Rctl == 0) && (pring->ringno == LPFC_ELS_RING) &&
 			(irsp->ulpCommand == CMD_RCV_SEQUENCE64_CX ||
 			 irsp->ulpCommand == CMD_IOCB_RCV_SEQ64_CX)) {
-			Rctl = FC_ELS_REQ;
-			Type = FC_ELS_DATA;
+			Rctl = FC_RCTL_ELS_REQ;
+			Type = FC_TYPE_ELS;
 			w5p->hcsw.Rctl = Rctl;
 			w5p->hcsw.Type = Type;
 		}
@@ -2324,168 +2341,6 @@ void lpfc_poll_eratt(unsigned long ptr)
 	return;
 }
 
-/**
- * lpfc_sli_poll_fcp_ring - Handle FCP ring completion in polling mode
- * @phba: Pointer to HBA context object.
- *
- * This function is called from lpfc_queuecommand, lpfc_poll_timeout,
- * lpfc_abort_handler and lpfc_slave_configure when FCP_RING_POLLING
- * is enabled.
- *
- * The caller does not hold any lock.
- * The function processes each response iocb in the response ring until it
- * finds an iocb with LE bit set and chains all the iocbs upto the iocb with
- * LE bit set. The function will call the completion handler of the command iocb
- * if the response iocb indicates a completion for a command iocb or it is
- * an abort completion.
- **/
-void lpfc_sli_poll_fcp_ring(struct lpfc_hba *phba)
-{
-	struct lpfc_sli      *psli  = &phba->sli;
-	struct lpfc_sli_ring *pring = &psli->ring[LPFC_FCP_RING];
-	IOCB_t *irsp = NULL;
-	IOCB_t *entry = NULL;
-	struct lpfc_iocbq *cmdiocbq = NULL;
-	struct lpfc_iocbq rspiocbq;
-	struct lpfc_pgp *pgp = &phba->port_gp[pring->ringno];
-	uint32_t status;
-	uint32_t portRspPut, portRspMax;
-	int type;
-	uint32_t rsp_cmpl = 0;
-	uint32_t ha_copy;
-	unsigned long iflags;
-
-	pring->stats.iocb_event++;
-
-	/*
-	 * The next available response entry should never exceed the maximum
-	 * entries.  If it does, treat it as an adapter hardware error.
-	 */
-	portRspMax = pring->numRiocb;
-	portRspPut = le32_to_cpu(pgp->rspPutInx);
-	if (unlikely(portRspPut >= portRspMax)) {
-		lpfc_sli_rsp_pointers_error(phba, pring);
-		return;
-	}
-
-	rmb();
-	while (pring->rspidx != portRspPut) {
-		entry = lpfc_resp_iocb(phba, pring);
-		if (++pring->rspidx >= portRspMax)
-			pring->rspidx = 0;
-
-		lpfc_sli_pcimem_bcopy((uint32_t *) entry,
-				      (uint32_t *) &rspiocbq.iocb,
-				      phba->iocb_rsp_size);
-		irsp = &rspiocbq.iocb;
-		type = lpfc_sli_iocb_cmd_type(irsp->ulpCommand & CMD_IOCB_MASK);
-		pring->stats.iocb_rsp++;
-		rsp_cmpl++;
-
-		if (unlikely(irsp->ulpStatus)) {
-			/* Rsp ring <ringno> error: IOCB */
-			lpfc_printf_log(phba, KERN_WARNING, LOG_SLI,
-					"0326 Rsp Ring %d error: IOCB Data: "
-					"x%x x%x x%x x%x x%x x%x x%x x%x\n",
-					pring->ringno,
-					irsp->un.ulpWord[0],
-					irsp->un.ulpWord[1],
-					irsp->un.ulpWord[2],
-					irsp->un.ulpWord[3],
-					irsp->un.ulpWord[4],
-					irsp->un.ulpWord[5],
-					*(uint32_t *)&irsp->un1,
-					*((uint32_t *)&irsp->un1 + 1));
-		}
-
-		switch (type) {
-		case LPFC_ABORT_IOCB:
-		case LPFC_SOL_IOCB:
-			/*
-			 * Idle exchange closed via ABTS from port.  No iocb
-			 * resources need to be recovered.
-			 */
-			if (unlikely(irsp->ulpCommand == CMD_XRI_ABORTED_CX)) {
-				lpfc_printf_log(phba, KERN_INFO, LOG_SLI,
-						"0314 IOCB cmd 0x%x "
-						"processed. Skipping "
-						"completion",
-						irsp->ulpCommand);
-				break;
-			}
-
-			spin_lock_irqsave(&phba->hbalock, iflags);
-			cmdiocbq = lpfc_sli_iocbq_lookup(phba, pring,
-							 &rspiocbq);
-			spin_unlock_irqrestore(&phba->hbalock, iflags);
-			if ((cmdiocbq) && (cmdiocbq->iocb_cmpl)) {
-				(cmdiocbq->iocb_cmpl)(phba, cmdiocbq,
-						      &rspiocbq);
-			}
-			break;
-		default:
-			if (irsp->ulpCommand == CMD_ADAPTER_MSG) {
-				char adaptermsg[LPFC_MAX_ADPTMSG];
-				memset(adaptermsg, 0, LPFC_MAX_ADPTMSG);
-				memcpy(&adaptermsg[0], (uint8_t *) irsp,
-				       MAX_MSG_DATA);
-				dev_warn(&((phba->pcidev)->dev),
-					 "lpfc%d: %s\n",
-					 phba->brd_no, adaptermsg);
-			} else {
-				/* Unknown IOCB command */
-				lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
-						"0321 Unknown IOCB command "
-						"Data: x%x, x%x x%x x%x x%x\n",
-						type, irsp->ulpCommand,
-						irsp->ulpStatus,
-						irsp->ulpIoTag,
-						irsp->ulpContext);
-			}
-			break;
-		}
-
-		/*
-		 * The response IOCB has been processed.  Update the ring
-		 * pointer in SLIM.  If the port response put pointer has not
-		 * been updated, sync the pgp->rspPutInx and fetch the new port
-		 * response put pointer.
-		 */
-		writel(pring->rspidx, &phba->host_gp[pring->ringno].rspGetInx);
-
-		if (pring->rspidx == portRspPut)
-			portRspPut = le32_to_cpu(pgp->rspPutInx);
-	}
-
-	ha_copy = readl(phba->HAregaddr);
-	ha_copy >>= (LPFC_FCP_RING * 4);
-
-	if ((rsp_cmpl > 0) && (ha_copy & HA_R0RE_REQ)) {
-		spin_lock_irqsave(&phba->hbalock, iflags);
-		pring->stats.iocb_rsp_full++;
-		status = ((CA_R0ATT | CA_R0RE_RSP) << (LPFC_FCP_RING * 4));
-		writel(status, phba->CAregaddr);
-		readl(phba->CAregaddr);
-		spin_unlock_irqrestore(&phba->hbalock, iflags);
-	}
-	if ((ha_copy & HA_R0CE_RSP) &&
-	    (pring->flag & LPFC_CALL_RING_AVAILABLE)) {
-		spin_lock_irqsave(&phba->hbalock, iflags);
-		pring->flag &= ~LPFC_CALL_RING_AVAILABLE;
-		pring->stats.iocb_cmd_empty++;
-
-		/* Force update of the local copy of cmdGetInx */
-		pring->local_getidx = le32_to_cpu(pgp->cmdGetInx);
-		lpfc_sli_resume_iocb(phba, pring);
-
-		if ((pring->lpfc_sli_cmd_available))
-			(pring->lpfc_sli_cmd_available) (phba, pring);
-
-		spin_unlock_irqrestore(&phba->hbalock, iflags);
-	}
-
-	return;
-}
 
 /**
  * lpfc_sli_handle_fast_ring_event - Handle ring events on FCP ring
@@ -2502,9 +2357,9 @@ void lpfc_sli_poll_fcp_ring(struct lpfc_hba *phba)
  * an abort completion. The function will call lpfc_sli_process_unsol_iocb
  * function if this is an unsolicited iocb.
  * This routine presumes LPFC_FCP_RING handling and doesn't bother
- * to check it explicitly. This function always returns 1.
- **/
-static int
+ * to check it explicitly.
+ */
+int
 lpfc_sli_handle_fast_ring_event(struct lpfc_hba *phba,
 				struct lpfc_sli_ring *pring, uint32_t mask)
 {
@@ -2534,6 +2389,11 @@ lpfc_sli_handle_fast_ring_event(struct lpfc_hba *phba,
 		spin_unlock_irqrestore(&phba->hbalock, iflag);
 		return 1;
 	}
+	if (phba->fcp_ring_in_use) {
+		spin_unlock_irqrestore(&phba->hbalock, iflag);
+		return 1;
+	} else
+		phba->fcp_ring_in_use = 1;
 
 	rmb();
 	while (pring->rspidx != portRspPut) {
@@ -2604,10 +2464,6 @@ lpfc_sli_handle_fast_ring_event(struct lpfc_hba *phba,
 			cmdiocbq = lpfc_sli_iocbq_lookup(phba, pring,
 							 &rspiocbq);
 			if ((cmdiocbq) && (cmdiocbq->iocb_cmpl)) {
-				if (phba->cfg_poll & ENABLE_FCP_RING_POLLING) {
-					(cmdiocbq->iocb_cmpl)(phba, cmdiocbq,
-							      &rspiocbq);
-				} else {
 					spin_unlock_irqrestore(&phba->hbalock,
 							       iflag);
 					(cmdiocbq->iocb_cmpl)(phba, cmdiocbq,
@@ -2615,7 +2471,6 @@ lpfc_sli_handle_fast_ring_event(struct lpfc_hba *phba,
 					spin_lock_irqsave(&phba->hbalock,
 							  iflag);
 				}
-			}
 			break;
 		case LPFC_UNSOL_IOCB:
 			spin_unlock_irqrestore(&phba->hbalock, iflag);
@@ -2675,6 +2530,7 @@ lpfc_sli_handle_fast_ring_event(struct lpfc_hba *phba,
 
 	}
 
+	phba->fcp_ring_in_use = 0;
 	spin_unlock_irqrestore(&phba->hbalock, iflag);
 	return rc;
 }
@@ -3018,16 +2874,39 @@ lpfc_sli_handle_slow_ring_event_s4(struct lpfc_hba *phba,
 				   struct lpfc_sli_ring *pring, uint32_t mask)
 {
 	struct lpfc_iocbq *irspiocbq;
+	struct hbq_dmabuf *dmabuf;
+	struct lpfc_cq_event *cq_event;
 	unsigned long iflag;
 
-	while (!list_empty(&phba->sli4_hba.sp_rspiocb_work_queue)) {
+	spin_lock_irqsave(&phba->hbalock, iflag);
+	phba->hba_flag &= ~HBA_SP_QUEUE_EVT;
+	spin_unlock_irqrestore(&phba->hbalock, iflag);
+	while (!list_empty(&phba->sli4_hba.sp_queue_event)) {
 		/* Get the response iocb from the head of work queue */
 		spin_lock_irqsave(&phba->hbalock, iflag);
-		list_remove_head(&phba->sli4_hba.sp_rspiocb_work_queue,
-				 irspiocbq, struct lpfc_iocbq, list);
+		list_remove_head(&phba->sli4_hba.sp_queue_event,
+				 cq_event, struct lpfc_cq_event, list);
 		spin_unlock_irqrestore(&phba->hbalock, iflag);
-		/* Process the response iocb */
-		lpfc_sli_sp_handle_rspiocb(phba, pring, irspiocbq);
+
+		switch (bf_get(lpfc_wcqe_c_code, &cq_event->cqe.wcqe_cmpl)) {
+		case CQE_CODE_COMPL_WQE:
+			irspiocbq = container_of(cq_event, struct lpfc_iocbq,
+						 cq_event);
+			/* Translate ELS WCQE to response IOCBQ */
+			irspiocbq = lpfc_sli4_els_wcqe_to_rspiocbq(phba,
+								   irspiocbq);
+			if (irspiocbq)
+				lpfc_sli_sp_handle_rspiocb(phba, pring,
+							   irspiocbq);
+			break;
+		case CQE_CODE_RECEIVE:
+			dmabuf = container_of(cq_event, struct hbq_dmabuf,
+					      cq_event);
+			lpfc_sli4_handle_received_buffer(phba, dmabuf);
+			break;
+		default:
+			break;
+		}
 	}
 }
 
@@ -3416,6 +3295,7 @@ lpfc_sli_brdreset(struct lpfc_hba *phba)
 
 	/* perform board reset */
 	phba->fc_eventTag = 0;
+	phba->link_events = 0;
 	phba->pport->fc_myDID = 0;
 	phba->pport->fc_prevDID = 0;
 
@@ -3476,6 +3356,7 @@ lpfc_sli4_brdreset(struct lpfc_hba *phba)
 
 	/* perform board reset */
 	phba->fc_eventTag = 0;
+	phba->link_events = 0;
 	phba->pport->fc_myDID = 0;
 	phba->pport->fc_prevDID = 0;
 
@@ -3495,7 +3376,6 @@ lpfc_sli4_brdreset(struct lpfc_hba *phba)
 	list_del_init(&phba->sli4_hba.dat_rq->list);
 	list_del_init(&phba->sli4_hba.mbx_cq->list);
 	list_del_init(&phba->sli4_hba.els_cq->list);
-	list_del_init(&phba->sli4_hba.rxq_cq->list);
 	for (qindx = 0; qindx < phba->cfg_fcp_wq_count; qindx++)
 		list_del_init(&phba->sli4_hba.fcp_wq[qindx]->list);
 	for (qindx = 0; qindx < phba->cfg_fcp_eq_count; qindx++)
@@ -3531,9 +3411,13 @@ lpfc_sli_brdrestart_s3(struct lpfc_hba *phba)
 	struct lpfc_sli *psli;
 	volatile uint32_t word0;
 	void __iomem *to_slim;
+	uint32_t hba_aer_enabled;
 
 	spin_lock_irq(&phba->hbalock);
 
+	/* Take PCIe device Advanced Error Reporting (AER) state */
+	hba_aer_enabled = phba->hba_flag & HBA_AER_ENABLED;
+
 	psli = &phba->sli;
 
 	/* Restart HBA */
@@ -3573,6 +3457,10 @@ lpfc_sli_brdrestart_s3(struct lpfc_hba *phba)
 	/* Give the INITFF and Post time to settle. */
 	mdelay(100);
 
+	/* Reset HBA AER if it was enabled, note hba_flag was reset above */
+	if (hba_aer_enabled)
+		pci_disable_pcie_error_reporting(phba->pcidev);
+
 	lpfc_hba_down_post(phba);
 
 	return 0;
@@ -4042,6 +3930,24 @@ lpfc_sli_hba_setup(struct lpfc_hba *phba)
 	if (rc)
 		goto lpfc_sli_hba_setup_error;
 
+	/* Enable PCIe device Advanced Error Reporting (AER) if configured */
+	if (phba->cfg_aer_support == 1 && !(phba->hba_flag & HBA_AER_ENABLED)) {
+		rc = pci_enable_pcie_error_reporting(phba->pcidev);
+		if (!rc) {
+			lpfc_printf_log(phba, KERN_INFO, LOG_INIT,
+					"2709 This device supports "
+					"Advanced Error Reporting (AER)\n");
+			spin_lock_irq(&phba->hbalock);
+			phba->hba_flag |= HBA_AER_ENABLED;
+			spin_unlock_irq(&phba->hbalock);
+		} else {
+			lpfc_printf_log(phba, KERN_INFO, LOG_INIT,
+					"2708 This device does not support "
+					"Advanced Error Reporting (AER)\n");
+			phba->cfg_aer_support = 0;
+		}
+	}
+
 	if (phba->sli_rev == 3) {
 		phba->iocb_cmd_size = SLI3_IOCB_CMD_SIZE;
 		phba->iocb_rsp_size = SLI3_IOCB_RSP_SIZE;
@@ -4163,7 +4069,7 @@ lpfc_sli4_read_fcoe_params(struct lpfc_hba *phba,
  * addition, this routine gets the port vpd data.
  *
  * Return codes
- * 	0 - sucessful
+ * 	0 - successful
  * 	ENOMEM - could not allocated memory.
  **/
 static int
@@ -4211,6 +4117,7 @@ lpfc_sli4_read_rev(struct lpfc_hba *phba, LPFC_MBOXQ_t *mboxq,
 	if (rc) {
 		dma_free_coherent(&phba->pcidev->dev, dma_size,
 				  dmabuf->virt, dmabuf->phys);
+		kfree(dmabuf);
 		return -EIO;
 	}
 
@@ -4243,7 +4150,6 @@ lpfc_sli4_arm_cqeq_intr(struct lpfc_hba *phba)
 
 	lpfc_sli4_cq_release(phba->sli4_hba.mbx_cq, LPFC_QUEUE_REARM);
 	lpfc_sli4_cq_release(phba->sli4_hba.els_cq, LPFC_QUEUE_REARM);
-	lpfc_sli4_cq_release(phba->sli4_hba.rxq_cq, LPFC_QUEUE_REARM);
 	for (fcp_eqidx = 0; fcp_eqidx < phba->cfg_fcp_eq_count; fcp_eqidx++)
 		lpfc_sli4_cq_release(phba->sli4_hba.fcp_cq[fcp_eqidx],
 				     LPFC_QUEUE_REARM);
@@ -4322,6 +4228,13 @@ lpfc_sli4_hba_setup(struct lpfc_hba *phba)
 	phba->sli_rev = bf_get(lpfc_mbx_rd_rev_sli_lvl, &mqe->un.read_rev);
 	if (bf_get(lpfc_mbx_rd_rev_fcoe, &mqe->un.read_rev))
 		phba->hba_flag |= HBA_FCOE_SUPPORT;
+
+	if (bf_get(lpfc_mbx_rd_rev_cee_ver, &mqe->un.read_rev) ==
+		LPFC_DCBX_CEE_MODE)
+		phba->hba_flag |= HBA_FIP_SUPPORT;
+	else
+		phba->hba_flag &= ~HBA_FIP_SUPPORT;
+
 	if (phba->sli_rev != LPFC_SLI_REV4 ||
 	    !(phba->hba_flag & HBA_FCOE_SUPPORT)) {
 		lpfc_printf_log(phba, KERN_ERR, LOG_MBOX | LOG_SLI,
@@ -4468,7 +4381,8 @@ lpfc_sli4_hba_setup(struct lpfc_hba *phba)
 	rc = lpfc_sli4_post_sgl_list(phba);
 	if (unlikely(rc)) {
 		lpfc_printf_log(phba, KERN_ERR, LOG_MBOX | LOG_SLI,
-				"0582 Error %d during sgl post operation", rc);
+				"0582 Error %d during sgl post operation\n",
+					rc);
 		rc = -ENODEV;
 		goto out_free_vpd;
 	}
@@ -4477,8 +4391,8 @@ lpfc_sli4_hba_setup(struct lpfc_hba *phba)
 	rc = lpfc_sli4_repost_scsi_sgl_list(phba);
 	if (unlikely(rc)) {
 		lpfc_printf_log(phba, KERN_WARNING, LOG_MBOX | LOG_SLI,
-				"0383 Error %d during scsi sgl post opeation",
-				rc);
+				"0383 Error %d during scsi sgl post "
+				"operation\n", rc);
 		/* Some Scsi buffers were moved to the abort scsi list */
 		/* A pci function reset will repost them */
 		rc = -ENODEV;
@@ -4494,10 +4408,6 @@ lpfc_sli4_hba_setup(struct lpfc_hba *phba)
 		rc = -ENODEV;
 		goto out_free_vpd;
 	}
-	if (phba->cfg_enable_fip)
-		bf_set(lpfc_fip_flag, &phba->sli4_hba.sli4_flags, 1);
-	else
-		bf_set(lpfc_fip_flag, &phba->sli4_hba.sli4_flags, 0);
 
 	/* Set up all the queues to the device */
 	rc = lpfc_sli4_queue_setup(phba);
@@ -5669,7 +5579,7 @@ __lpfc_sli_issue_iocb_s3(struct lpfc_hba *phba, uint32_t ring_number,
 		case CMD_GEN_REQUEST64_CX:
 			if (!(phba->sli.sli_flag & LPFC_MENLO_MAINT) ||
 				(piocb->iocb.un.genreq64.w5.hcsw.Rctl !=
-					FC_FCP_CMND) ||
+					FC_RCTL_DD_UNSOL_CMD) ||
 				(piocb->iocb.un.genreq64.w5.hcsw.Type !=
 					MENLO_TRANSPORT_TYPE))
 
@@ -5849,7 +5759,7 @@ static int
 lpfc_sli4_iocb2wqe(struct lpfc_hba *phba, struct lpfc_iocbq *iocbq,
 		union lpfc_wqe *wqe)
 {
-	uint32_t payload_len = 0;
+	uint32_t xmit_len = 0, total_len = 0;
 	uint8_t ct = 0;
 	uint32_t fip;
 	uint32_t abort_tag;
@@ -5857,12 +5767,15 @@ lpfc_sli4_iocb2wqe(struct lpfc_hba *phba, struct lpfc_iocbq *iocbq,
 	uint8_t cmnd;
 	uint16_t xritag;
 	struct ulp_bde64 *bpl = NULL;
+	uint32_t els_id = ELS_ID_DEFAULT;
+	int numBdes, i;
+	struct ulp_bde64 bde;
 
-	fip = bf_get(lpfc_fip_flag, &phba->sli4_hba.sli4_flags);
+	fip = phba->hba_flag & HBA_FIP_SUPPORT;
 	/* The fcp commands will set command type */
 	if (iocbq->iocb_flag &  LPFC_IO_FCP)
 		command_type = FCP_COMMAND;
-	else if (fip && (iocbq->iocb_flag & LPFC_FIP_ELS))
+	else if (fip && (iocbq->iocb_flag & LPFC_FIP_ELS_ID_MASK))
 		command_type = ELS_COMMAND_FIP;
 	else
 		command_type = ELS_COMMAND_NON_FIP;
@@ -5874,6 +5787,8 @@ lpfc_sli4_iocb2wqe(struct lpfc_hba *phba, struct lpfc_iocbq *iocbq,
 	wqe->words[7] = 0; /* The ct field has moved so reset */
 	/* words0-2 bpl convert bde */
 	if (iocbq->iocb.un.genreq64.bdl.bdeFlags == BUFF_TYPE_BLP_64) {
+		numBdes = iocbq->iocb.un.genreq64.bdl.bdeSize /
+				sizeof(struct ulp_bde64);
 		bpl  = (struct ulp_bde64 *)
 			((struct lpfc_dmabuf *)iocbq->context3)->virt;
 		if (!bpl)
@@ -5886,9 +5801,14 @@ lpfc_sli4_iocb2wqe(struct lpfc_hba *phba, struct lpfc_iocbq *iocbq,
 		 * can assign it to the sgl.
 		 */
 		wqe->generic.bde.tus.w  = le32_to_cpu(bpl->tus.w);
-		payload_len = wqe->generic.bde.tus.f.bdeSize;
+		xmit_len = wqe->generic.bde.tus.f.bdeSize;
+		total_len = 0;
+		for (i = 0; i < numBdes; i++) {
+			bde.tus.w  = le32_to_cpu(bpl[i].tus.w);
+			total_len += bde.tus.f.bdeSize;
+		}
 	} else
-		payload_len = iocbq->iocb.un.fcpi64.bdl.bdeSize;
+		xmit_len = iocbq->iocb.un.fcpi64.bdl.bdeSize;
 
 	iocbq->iocb.ulpIoTag = iocbq->iotag;
 	cmnd = iocbq->iocb.ulpCommand;
@@ -5902,7 +5822,7 @@ lpfc_sli4_iocb2wqe(struct lpfc_hba *phba, struct lpfc_iocbq *iocbq,
 				iocbq->iocb.ulpCommand);
 			return IOCB_ERROR;
 		}
-		wqe->els_req.payload_len = payload_len;
+		wqe->els_req.payload_len = xmit_len;
 		/* Els_reguest64 has a TMO */
 		bf_set(wqe_tmo, &wqe->els_req.wqe_com,
 			iocbq->iocb.ulpTimeout);
@@ -5923,7 +5843,22 @@ lpfc_sli4_iocb2wqe(struct lpfc_hba *phba, struct lpfc_iocbq *iocbq,
 		bf_set(lpfc_wqe_gen_ct, &wqe->generic, ct);
 		bf_set(lpfc_wqe_gen_pu, &wqe->generic, 0);
 		/* CCP CCPE PV PRI in word10 were set in the memcpy */
+
+		if (command_type == ELS_COMMAND_FIP) {
+			els_id = ((iocbq->iocb_flag & LPFC_FIP_ELS_ID_MASK)
+					>> LPFC_FIP_ELS_ID_SHIFT);
+		}
+		bf_set(lpfc_wqe_gen_els_id, &wqe->generic, els_id);
+
 	break;
+	case CMD_XMIT_SEQUENCE64_CX:
+		bf_set(lpfc_wqe_gen_context, &wqe->generic,
+					iocbq->iocb.un.ulpWord[3]);
+		wqe->generic.word3 = 0;
+		bf_set(wqe_rcvoxid, &wqe->generic, iocbq->iocb.ulpContext);
+		/* The entire sequence is transmitted for this IOCB */
+		xmit_len = total_len;
+		cmnd = CMD_XMIT_SEQUENCE64_CR;
 	case CMD_XMIT_SEQUENCE64_CR:
 		/* word3 iocb=io_tag32 wqe=payload_offset */
 		/* payload offset used for multilpe outstanding
@@ -5933,7 +5868,8 @@ lpfc_sli4_iocb2wqe(struct lpfc_hba *phba, struct lpfc_iocbq *iocbq,
 		/* word4 relative_offset memcpy */
 		/* word5 r_ctl/df_ctl memcpy */
 		bf_set(lpfc_wqe_gen_pu, &wqe->generic, 0);
-		wqe->xmit_sequence.xmit_len = payload_len;
+		wqe->xmit_sequence.xmit_len = xmit_len;
+		command_type = OTHER_COMMAND;
 	break;
 	case CMD_XMIT_BCAST64_CN:
 		/* word3 iocb=iotag32 wqe=payload_len */
@@ -5962,7 +5898,7 @@ lpfc_sli4_iocb2wqe(struct lpfc_hba *phba, struct lpfc_iocbq *iocbq,
 	case CMD_FCP_IREAD64_CR:
 		/* FCP_CMD is always the 1st sgl entry */
 		wqe->fcp_iread.payload_len =
-			payload_len + sizeof(struct fcp_rsp);
+			xmit_len + sizeof(struct fcp_rsp);
 
 		/* word 4 (xfer length) should have been set on the memcpy */
 
@@ -5999,7 +5935,7 @@ lpfc_sli4_iocb2wqe(struct lpfc_hba *phba, struct lpfc_iocbq *iocbq,
 		 * sgl[1] = rsp.
 		 *
 		 */
-		wqe->gen_req.command_len = payload_len;
+		wqe->gen_req.command_len = xmit_len;
 		/* Word4 parameter  copied in the memcpy */
 		/* Word5 [rctl, type, df_ctl, la] copied in memcpy */
 		/* word6 context tag copied in memcpy */
@@ -6066,6 +6002,38 @@ lpfc_sli4_iocb2wqe(struct lpfc_hba *phba, struct lpfc_iocbq *iocbq,
 		command_type = OTHER_COMMAND;
 		xritag = 0;
 	break;
+	case CMD_XMIT_BLS_RSP64_CX:
+		/* As BLS ABTS-ACC WQE is very different from other WQEs,
+		 * we re-construct this WQE here based on information in
+		 * iocbq from scratch.
+		 */
+		memset(wqe, 0, sizeof(union lpfc_wqe));
+		/* OX_ID is invariable to who sent ABTS to CT exchange */
+		bf_set(xmit_bls_rsp64_oxid, &wqe->xmit_bls_rsp,
+		       bf_get(lpfc_abts_oxid, &iocbq->iocb.un.bls_acc));
+		if (bf_get(lpfc_abts_orig, &iocbq->iocb.un.bls_acc) ==
+		    LPFC_ABTS_UNSOL_INT) {
+			/* ABTS sent by initiator to CT exchange, the
+			 * RX_ID field will be filled with the newly
+			 * allocated responder XRI.
+			 */
+			bf_set(xmit_bls_rsp64_rxid, &wqe->xmit_bls_rsp,
+			       iocbq->sli4_xritag);
+		} else {
+			/* ABTS sent by responder to CT exchange, the
+			 * RX_ID field will be filled with the responder
+			 * RX_ID from ABTS.
+			 */
+			bf_set(xmit_bls_rsp64_rxid, &wqe->xmit_bls_rsp,
+			       bf_get(lpfc_abts_rxid, &iocbq->iocb.un.bls_acc));
+		}
+		bf_set(xmit_bls_rsp64_seqcnthi, &wqe->xmit_bls_rsp, 0xffff);
+		bf_set(wqe_xmit_bls_pt, &wqe->xmit_bls_rsp.wqe_dest, 0x1);
+		bf_set(wqe_ctxt_tag, &wqe->xmit_bls_rsp.wqe_com,
+		       iocbq->iocb.ulpContext);
+		/* Overwrite the pre-set comnd type with OTHER_COMMAND */
+		command_type = OTHER_COMMAND;
+	break;
 	case CMD_XRI_ABORTED_CX:
 	case CMD_CREATE_XRI_CR: /* Do we expect to use this? */
 		/* words0-2 are all 0's no bde */
@@ -6120,11 +6088,10 @@ __lpfc_sli_issue_iocb_s4(struct lpfc_hba *phba, uint32_t ring_number,
 	uint16_t xritag;
 	union lpfc_wqe wqe;
 	struct lpfc_sli_ring *pring = &phba->sli.ring[ring_number];
-	uint32_t fcp_wqidx;
 
 	if (piocb->sli4_xritag == NO_XRI) {
 		if (piocb->iocb.ulpCommand == CMD_ABORT_XRI_CN ||
-			piocb->iocb.ulpCommand == CMD_CLOSE_XRI_CN)
+		    piocb->iocb.ulpCommand == CMD_CLOSE_XRI_CN)
 			sglq = NULL;
 		else {
 			sglq = __lpfc_sli_get_sglq(phba);
@@ -6155,8 +6122,17 @@ __lpfc_sli_issue_iocb_s4(struct lpfc_hba *phba, uint32_t ring_number,
 		return IOCB_ERROR;
 
 	if (piocb->iocb_flag &  LPFC_IO_FCP) {
-		fcp_wqidx = lpfc_sli4_scmd_to_wqidx_distr(phba);
-		if (lpfc_sli4_wq_put(phba->sli4_hba.fcp_wq[fcp_wqidx], &wqe))
+		/*
+		 * For FCP command IOCB, get a new WQ index to distribute
+		 * WQE across the WQsr. On the other hand, for abort IOCB,
+		 * it carries the same WQ index to the original command
+		 * IOCB.
+		 */
+		if ((piocb->iocb.ulpCommand != CMD_ABORT_XRI_CN) &&
+		    (piocb->iocb.ulpCommand != CMD_CLOSE_XRI_CN))
+			piocb->fcp_wqidx = lpfc_sli4_scmd_to_wqidx_distr(phba);
+		if (lpfc_sli4_wq_put(phba->sli4_hba.fcp_wq[piocb->fcp_wqidx],
+				     &wqe))
 			return IOCB_ERROR;
 	} else {
 		if (lpfc_sli4_wq_put(phba->sli4_hba.els_wq, &wqe))
@@ -6449,31 +6425,37 @@ lpfc_sli_setup(struct lpfc_hba *phba)
 			pring->iotag_max = 4096;
 			pring->lpfc_sli_rcv_async_status =
 				lpfc_sli_async_event_handler;
-			pring->num_mask = 4;
+			pring->num_mask = LPFC_MAX_RING_MASK;
 			pring->prt[0].profile = 0;	/* Mask 0 */
-			pring->prt[0].rctl = FC_ELS_REQ;
-			pring->prt[0].type = FC_ELS_DATA;
+			pring->prt[0].rctl = FC_RCTL_ELS_REQ;
+			pring->prt[0].type = FC_TYPE_ELS;
 			pring->prt[0].lpfc_sli_rcv_unsol_event =
 			    lpfc_els_unsol_event;
 			pring->prt[1].profile = 0;	/* Mask 1 */
-			pring->prt[1].rctl = FC_ELS_RSP;
-			pring->prt[1].type = FC_ELS_DATA;
+			pring->prt[1].rctl = FC_RCTL_ELS_REP;
+			pring->prt[1].type = FC_TYPE_ELS;
 			pring->prt[1].lpfc_sli_rcv_unsol_event =
 			    lpfc_els_unsol_event;
 			pring->prt[2].profile = 0;	/* Mask 2 */
 			/* NameServer Inquiry */
-			pring->prt[2].rctl = FC_UNSOL_CTL;
+			pring->prt[2].rctl = FC_RCTL_DD_UNSOL_CTL;
 			/* NameServer */
-			pring->prt[2].type = FC_COMMON_TRANSPORT_ULP;
+			pring->prt[2].type = FC_TYPE_CT;
 			pring->prt[2].lpfc_sli_rcv_unsol_event =
 			    lpfc_ct_unsol_event;
 			pring->prt[3].profile = 0;	/* Mask 3 */
 			/* NameServer response */
-			pring->prt[3].rctl = FC_SOL_CTL;
+			pring->prt[3].rctl = FC_RCTL_DD_SOL_CTL;
 			/* NameServer */
-			pring->prt[3].type = FC_COMMON_TRANSPORT_ULP;
+			pring->prt[3].type = FC_TYPE_CT;
 			pring->prt[3].lpfc_sli_rcv_unsol_event =
 			    lpfc_ct_unsol_event;
+			/* abort unsolicited sequence */
+			pring->prt[4].profile = 0;	/* Mask 4 */
+			pring->prt[4].rctl = FC_RCTL_BA_ABTS;
+			pring->prt[4].type = FC_TYPE_BLS;
+			pring->prt[4].lpfc_sli_rcv_unsol_event =
+			    lpfc_sli4_ct_abort_unsol_event;
 			break;
 		}
 		totiocbsize += (pring->numCiocb * pring->sizeCiocb) +
@@ -6976,8 +6958,18 @@ lpfc_sli_abort_els_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
 		abort_iotag = cmdiocb->iocb.un.acxri.abortIoTag;
 
 		spin_lock_irq(&phba->hbalock);
-		if (abort_iotag != 0 && abort_iotag <= phba->sli.last_iotag)
-			abort_iocb = phba->sli.iocbq_lookup[abort_iotag];
+		if (phba->sli_rev < LPFC_SLI_REV4) {
+			if (abort_iotag != 0 &&
+				abort_iotag <= phba->sli.last_iotag)
+				abort_iocb =
+					phba->sli.iocbq_lookup[abort_iotag];
+		} else
+			/* For sli4 the abort_tag is the XRI,
+			 * so the abort routine puts the iotag  of the iocb
+			 * being aborted in the context field of the abort
+			 * IOCB.
+			 */
+			abort_iocb = phba->sli.iocbq_lookup[abort_context];
 
 		lpfc_printf_log(phba, KERN_INFO, LOG_ELS | LOG_SLI,
 				"0327 Cannot abort els iocb %p "
@@ -6991,9 +6983,18 @@ lpfc_sli_abort_els_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
 		 *  might have completed already. Do not free it again.
 		 */
 		if (irsp->ulpStatus == IOSTAT_LOCAL_REJECT) {
-			spin_unlock_irq(&phba->hbalock);
-			lpfc_sli_release_iocbq(phba, cmdiocb);
-			return;
+			if (irsp->un.ulpWord[4] != IOERR_NO_XRI) {
+				spin_unlock_irq(&phba->hbalock);
+				lpfc_sli_release_iocbq(phba, cmdiocb);
+				return;
+			}
+			/* For SLI4 the ulpContext field for abort IOCB
+			 * holds the iotag of the IOCB being aborted so
+			 * the local abort_context needs to be reset to
+			 * match the aborted IOCBs ulpContext.
+			 */
+			if (abort_iocb && phba->sli_rev == LPFC_SLI_REV4)
+				abort_context = abort_iocb->iocb.ulpContext;
 		}
 		/*
 		 * make sure we have the right iocbq before taking it
@@ -7112,13 +7113,18 @@ lpfc_sli_issue_abort_iotag(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
 	iabt = &abtsiocbp->iocb;
 	iabt->un.acxri.abortType = ABORT_TYPE_ABTS;
 	iabt->un.acxri.abortContextTag = icmd->ulpContext;
-	if (phba->sli_rev == LPFC_SLI_REV4)
+	if (phba->sli_rev == LPFC_SLI_REV4) {
 		iabt->un.acxri.abortIoTag = cmdiocb->sli4_xritag;
+		iabt->un.acxri.abortContextTag = cmdiocb->iotag;
+	}
 	else
 		iabt->un.acxri.abortIoTag = icmd->ulpIoTag;
 	iabt->ulpLe = 1;
 	iabt->ulpClass = icmd->ulpClass;
 
+	/* ABTS WQE must go to the same WQ as the WQE to be aborted */
+	abtsiocbp->fcp_wqidx = cmdiocb->fcp_wqidx;
+
 	if (phba->link_state >= LPFC_LINK_UP)
 		iabt->ulpCommand = CMD_ABORT_XRI_CN;
 	else
@@ -7322,6 +7328,9 @@ lpfc_sli_abort_iocb(struct lpfc_vport *vport, struct lpfc_sli_ring *pring,
 		abtsiocb->iocb.ulpClass = cmd->ulpClass;
 		abtsiocb->vport = phba->pport;
 
+		/* ABTS WQE must go to the same WQ as the WQE to be aborted */
+		abtsiocb->fcp_wqidx = iocbq->fcp_wqidx;
+
 		if (lpfc_is_link_up(phba))
 			abtsiocb->iocb.ulpCommand = CMD_ABORT_XRI_CN;
 		else
@@ -7687,31 +7696,28 @@ static int
 lpfc_sli4_eratt_read(struct lpfc_hba *phba)
 {
 	uint32_t uerr_sta_hi, uerr_sta_lo;
-	uint32_t onlnreg0, onlnreg1;
 
 	/* For now, use the SLI4 device internal unrecoverable error
 	 * registers for error attention. This can be changed later.
 	 */
-	onlnreg0 = readl(phba->sli4_hba.ONLINE0regaddr);
-	onlnreg1 = readl(phba->sli4_hba.ONLINE1regaddr);
-	if ((onlnreg0 != LPFC_ONLINE_NERR) || (onlnreg1 != LPFC_ONLINE_NERR)) {
-		uerr_sta_lo = readl(phba->sli4_hba.UERRLOregaddr);
-		uerr_sta_hi = readl(phba->sli4_hba.UERRHIregaddr);
-		if (uerr_sta_lo || uerr_sta_hi) {
-			lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
-					"1423 HBA Unrecoverable error: "
-					"uerr_lo_reg=0x%x, uerr_hi_reg=0x%x, "
-					"online0_reg=0x%x, online1_reg=0x%x\n",
-					uerr_sta_lo, uerr_sta_hi,
-					onlnreg0, onlnreg1);
-			phba->work_status[0] = uerr_sta_lo;
-			phba->work_status[1] = uerr_sta_hi;
-			/* Set the driver HA work bitmap */
-			phba->work_ha |= HA_ERATT;
-			/* Indicate polling handles this ERATT */
-			phba->hba_flag |= HBA_ERATT_HANDLED;
-			return 1;
-		}
+	uerr_sta_lo = readl(phba->sli4_hba.UERRLOregaddr);
+	uerr_sta_hi = readl(phba->sli4_hba.UERRHIregaddr);
+	if ((~phba->sli4_hba.ue_mask_lo & uerr_sta_lo) ||
+	    (~phba->sli4_hba.ue_mask_hi & uerr_sta_hi)) {
+		lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
+				"1423 HBA Unrecoverable error: "
+				"uerr_lo_reg=0x%x, uerr_hi_reg=0x%x, "
+				"ue_mask_lo_reg=0x%x, ue_mask_hi_reg=0x%x\n",
+				uerr_sta_lo, uerr_sta_hi,
+				phba->sli4_hba.ue_mask_lo,
+				phba->sli4_hba.ue_mask_hi);
+		phba->work_status[0] = uerr_sta_lo;
+		phba->work_status[1] = uerr_sta_hi;
+		/* Set the driver HA work bitmap */
+		phba->work_ha |= HA_ERATT;
+		/* Indicate polling handles this ERATT */
+		phba->hba_flag |= HBA_ERATT_HANDLED;
+		return 1;
 	}
 	return 0;
 }
@@ -7834,7 +7840,7 @@ irqreturn_t
 lpfc_sli_sp_intr_handler(int irq, void *dev_id)
 {
 	struct lpfc_hba  *phba;
-	uint32_t ha_copy;
+	uint32_t ha_copy, hc_copy;
 	uint32_t work_ha_copy;
 	unsigned long status;
 	unsigned long iflag;
@@ -7892,8 +7898,13 @@ lpfc_sli_sp_intr_handler(int irq, void *dev_id)
 		}
 
 		/* Clear up only attention source related to slow-path */
+		hc_copy = readl(phba->HCregaddr);
+		writel(hc_copy & ~(HC_MBINT_ENA | HC_R2INT_ENA |
+			HC_LAINT_ENA | HC_ERINT_ENA),
+			phba->HCregaddr);
 		writel((ha_copy & (HA_MBATT | HA_R2_CLR_MSK)),
 			phba->HAregaddr);
+		writel(hc_copy, phba->HCregaddr);
 		readl(phba->HAregaddr); /* flush */
 		spin_unlock_irqrestore(&phba->hbalock, iflag);
 	} else
@@ -8049,7 +8060,7 @@ lpfc_sli_sp_intr_handler(int irq, void *dev_id)
 							KERN_ERR,
 							LOG_MBOX | LOG_SLI,
 							"0350 rc should have"
-							"been MBX_BUSY");
+							"been MBX_BUSY\n");
 						if (rc != MBX_NOT_FINISHED)
 							goto send_current_mbox;
 					}
@@ -8078,7 +8089,7 @@ send_current_mbox:
 			if (rc != MBX_SUCCESS)
 				lpfc_printf_log(phba, KERN_ERR, LOG_MBOX |
 						LOG_SLI, "0349 rc should be "
-						"MBX_SUCCESS");
+						"MBX_SUCCESS\n");
 		}
 
 		spin_lock_irqsave(&phba->hbalock, iflag);
@@ -8203,6 +8214,7 @@ lpfc_sli_intr_handler(int irq, void *dev_id)
 	struct lpfc_hba  *phba;
 	irqreturn_t sp_irq_rc, fp_irq_rc;
 	unsigned long status1, status2;
+	uint32_t hc_copy;
 
 	/*
 	 * Get the driver's phba structure from the dev_id and
@@ -8240,7 +8252,12 @@ lpfc_sli_intr_handler(int irq, void *dev_id)
 	}
 
 	/* Clear attention sources except link and error attentions */
+	hc_copy = readl(phba->HCregaddr);
+	writel(hc_copy & ~(HC_MBINT_ENA | HC_R0INT_ENA | HC_R1INT_ENA
+		| HC_R2INT_ENA | HC_LAINT_ENA | HC_ERINT_ENA),
+		phba->HCregaddr);
 	writel((phba->ha_copy & ~(HA_LATT | HA_ERATT)), phba->HAregaddr);
+	writel(hc_copy, phba->HCregaddr);
 	readl(phba->HAregaddr); /* flush */
 	spin_unlock(&phba->hbalock);
 
@@ -8351,8 +8368,6 @@ lpfc_sli4_iocb_param_transfer(struct lpfc_iocbq *pIocbIn,
 
 	memcpy((char *)pIocbIn + offset, (char *)pIocbOut + offset,
 	       sizeof(struct lpfc_iocbq) - offset);
-	memset(&pIocbIn->sli4_info, 0,
-	       sizeof(struct lpfc_sli4_rspiocb_info));
 	/* Map WCQE parameters into irspiocb parameters */
 	pIocbIn->iocb.ulpStatus = bf_get(lpfc_wcqe_c_status, wcqe);
 	if (pIocbOut->iocb_flag & LPFC_IO_FCP)
@@ -8364,16 +8379,49 @@ lpfc_sli4_iocb_param_transfer(struct lpfc_iocbq *pIocbIn,
 			pIocbIn->iocb.un.ulpWord[4] = wcqe->parameter;
 	else
 		pIocbIn->iocb.un.ulpWord[4] = wcqe->parameter;
-	/* Load in additional WCQE parameters */
-	pIocbIn->sli4_info.hw_status = bf_get(lpfc_wcqe_c_hw_status, wcqe);
-	pIocbIn->sli4_info.bfield = 0;
-	if (bf_get(lpfc_wcqe_c_xb, wcqe))
-		pIocbIn->sli4_info.bfield |= LPFC_XB;
-	if (bf_get(lpfc_wcqe_c_pv, wcqe)) {
-		pIocbIn->sli4_info.bfield |= LPFC_PV;
-		pIocbIn->sli4_info.priority =
-					bf_get(lpfc_wcqe_c_priority, wcqe);
+}
+
+/**
+ * lpfc_sli4_els_wcqe_to_rspiocbq - Get response iocbq from els wcqe
+ * @phba: Pointer to HBA context object.
+ * @wcqe: Pointer to work-queue completion queue entry.
+ *
+ * This routine handles an ELS work-queue completion event and construct
+ * a pseudo response ELS IODBQ from the SLI4 ELS WCQE for the common
+ * discovery engine to handle.
+ *
+ * Return: Pointer to the receive IOCBQ, NULL otherwise.
+ **/
+static struct lpfc_iocbq *
+lpfc_sli4_els_wcqe_to_rspiocbq(struct lpfc_hba *phba,
+			       struct lpfc_iocbq *irspiocbq)
+{
+	struct lpfc_sli_ring *pring = &phba->sli.ring[LPFC_ELS_RING];
+	struct lpfc_iocbq *cmdiocbq;
+	struct lpfc_wcqe_complete *wcqe;
+	unsigned long iflags;
+
+	wcqe = &irspiocbq->cq_event.cqe.wcqe_cmpl;
+	spin_lock_irqsave(&phba->hbalock, iflags);
+	pring->stats.iocb_event++;
+	/* Look up the ELS command IOCB and create pseudo response IOCB */
+	cmdiocbq = lpfc_sli_iocbq_lookup_by_tag(phba, pring,
+				bf_get(lpfc_wcqe_c_request_tag, wcqe));
+	spin_unlock_irqrestore(&phba->hbalock, iflags);
+
+	if (unlikely(!cmdiocbq)) {
+		lpfc_printf_log(phba, KERN_WARNING, LOG_SLI,
+				"0386 ELS complete with no corresponding "
+				"cmdiocb: iotag (%d)\n",
+				bf_get(lpfc_wcqe_c_request_tag, wcqe));
+		lpfc_sli_release_iocbq(phba, irspiocbq);
+		return NULL;
 	}
+
+	/* Fake the irspiocbq and copy necessary response information */
+	lpfc_sli4_iocb_param_transfer(irspiocbq, cmdiocbq, wcqe);
+
+	return irspiocbq;
 }
 
 /**
@@ -8566,45 +8614,26 @@ static bool
 lpfc_sli4_sp_handle_els_wcqe(struct lpfc_hba *phba,
 			     struct lpfc_wcqe_complete *wcqe)
 {
-	struct lpfc_sli_ring *pring = &phba->sli.ring[LPFC_ELS_RING];
-	struct lpfc_iocbq *cmdiocbq;
 	struct lpfc_iocbq *irspiocbq;
 	unsigned long iflags;
-	bool workposted = false;
 
-	spin_lock_irqsave(&phba->hbalock, iflags);
-	pring->stats.iocb_event++;
-	/* Look up the ELS command IOCB and create pseudo response IOCB */
-	cmdiocbq = lpfc_sli_iocbq_lookup_by_tag(phba, pring,
-				bf_get(lpfc_wcqe_c_request_tag, wcqe));
-	spin_unlock_irqrestore(&phba->hbalock, iflags);
-
-	if (unlikely(!cmdiocbq)) {
-		lpfc_printf_log(phba, KERN_WARNING, LOG_SLI,
-				"0386 ELS complete with no corresponding "
-				"cmdiocb: iotag (%d)\n",
-				bf_get(lpfc_wcqe_c_request_tag, wcqe));
-		return workposted;
-	}
-
-	/* Fake the irspiocbq and copy necessary response information */
+	/* Get an irspiocbq for later ELS response processing use */
 	irspiocbq = lpfc_sli_get_iocbq(phba);
 	if (!irspiocbq) {
 		lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
 				"0387 Failed to allocate an iocbq\n");
-		return workposted;
+		return false;
 	}
-	lpfc_sli4_iocb_param_transfer(irspiocbq, cmdiocbq, wcqe);
 
-	/* Add the irspiocb to the response IOCB work list */
+	/* Save off the slow-path queue event for work thread to process */
+	memcpy(&irspiocbq->cq_event.cqe.wcqe_cmpl, wcqe, sizeof(*wcqe));
 	spin_lock_irqsave(&phba->hbalock, iflags);
-	list_add_tail(&irspiocbq->list, &phba->sli4_hba.sp_rspiocb_work_queue);
-	/* Indicate ELS ring attention */
-	phba->work_ha |= (HA_R0ATT << (4*LPFC_ELS_RING));
+	list_add_tail(&irspiocbq->cq_event.list,
+		      &phba->sli4_hba.sp_queue_event);
+	phba->hba_flag |= HBA_SP_QUEUE_EVT;
 	spin_unlock_irqrestore(&phba->hbalock, iflags);
-	workposted = true;
 
-	return workposted;
+	return true;
 }
 
 /**
@@ -8690,52 +8719,6 @@ lpfc_sli4_sp_handle_abort_xri_wcqe(struct lpfc_hba *phba,
 }
 
 /**
- * lpfc_sli4_sp_handle_wcqe - Process a work-queue completion queue entry
- * @phba: Pointer to HBA context object.
- * @cq: Pointer to the completion queue.
- * @wcqe: Pointer to a completion queue entry.
- *
- * This routine process a slow-path work-queue completion queue entry.
- *
- * Return: true if work posted to worker thread, otherwise false.
- **/
-static bool
-lpfc_sli4_sp_handle_wcqe(struct lpfc_hba *phba, struct lpfc_queue *cq,
-			 struct lpfc_cqe *cqe)
-{
-	struct lpfc_wcqe_complete wcqe;
-	bool workposted = false;
-
-	/* Copy the work queue CQE and convert endian order if needed */
-	lpfc_sli_pcimem_bcopy(cqe, &wcqe, sizeof(struct lpfc_cqe));
-
-	/* Check and process for different type of WCQE and dispatch */
-	switch (bf_get(lpfc_wcqe_c_code, &wcqe)) {
-	case CQE_CODE_COMPL_WQE:
-		/* Process the WQ complete event */
-		workposted = lpfc_sli4_sp_handle_els_wcqe(phba,
-					(struct lpfc_wcqe_complete *)&wcqe);
-		break;
-	case CQE_CODE_RELEASE_WQE:
-		/* Process the WQ release event */
-		lpfc_sli4_sp_handle_rel_wcqe(phba,
-					(struct lpfc_wcqe_release *)&wcqe);
-		break;
-	case CQE_CODE_XRI_ABORTED:
-		/* Process the WQ XRI abort event */
-		workposted = lpfc_sli4_sp_handle_abort_xri_wcqe(phba, cq,
-					(struct sli4_wcqe_xri_aborted *)&wcqe);
-		break;
-	default:
-		lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
-				"0388 Not a valid WCQE code: x%x\n",
-				bf_get(lpfc_wcqe_c_code, &wcqe));
-		break;
-	}
-	return workposted;
-}
-
-/**
  * lpfc_sli4_sp_handle_rcqe - Process a receive-queue completion queue entry
  * @phba: Pointer to HBA context object.
  * @rcqe: Pointer to receive-queue completion queue entry.
@@ -8745,9 +8728,8 @@ lpfc_sli4_sp_handle_wcqe(struct lpfc_hba *phba, struct lpfc_queue *cq,
  * Return: true if work posted to worker thread, otherwise false.
  **/
 static bool
-lpfc_sli4_sp_handle_rcqe(struct lpfc_hba *phba, struct lpfc_cqe *cqe)
+lpfc_sli4_sp_handle_rcqe(struct lpfc_hba *phba, struct lpfc_rcqe *rcqe)
 {
-	struct lpfc_rcqe rcqe;
 	bool workposted = false;
 	struct lpfc_queue *hrq = phba->sli4_hba.hdr_rq;
 	struct lpfc_queue *drq = phba->sli4_hba.dat_rq;
@@ -8755,31 +8737,28 @@ lpfc_sli4_sp_handle_rcqe(struct lpfc_hba *phba, struct lpfc_cqe *cqe)
 	uint32_t status;
 	unsigned long iflags;
 
-	/* Copy the receive queue CQE and convert endian order if needed */
-	lpfc_sli_pcimem_bcopy(cqe, &rcqe, sizeof(struct lpfc_rcqe));
-	lpfc_sli4_rq_release(hrq, drq);
-	if (bf_get(lpfc_rcqe_code, &rcqe) != CQE_CODE_RECEIVE)
-		goto out;
-	if (bf_get(lpfc_rcqe_rq_id, &rcqe) != hrq->queue_id)
+	if (bf_get(lpfc_rcqe_rq_id, rcqe) != hrq->queue_id)
 		goto out;
 
-	status = bf_get(lpfc_rcqe_status, &rcqe);
+	status = bf_get(lpfc_rcqe_status, rcqe);
 	switch (status) {
 	case FC_STATUS_RQ_BUF_LEN_EXCEEDED:
 		lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
 				"2537 Receive Frame Truncated!!\n");
 	case FC_STATUS_RQ_SUCCESS:
+		lpfc_sli4_rq_release(hrq, drq);
 		spin_lock_irqsave(&phba->hbalock, iflags);
 		dma_buf = lpfc_sli_hbqbuf_get(&phba->hbqs[0].hbq_buffer_list);
 		if (!dma_buf) {
 			spin_unlock_irqrestore(&phba->hbalock, iflags);
 			goto out;
 		}
-		memcpy(&dma_buf->rcqe, &rcqe, sizeof(rcqe));
+		memcpy(&dma_buf->cq_event.cqe.rcqe_cmpl, rcqe, sizeof(*rcqe));
 		/* save off the frame for the word thread to process */
-		list_add_tail(&dma_buf->dbuf.list, &phba->rb_pend_list);
+		list_add_tail(&dma_buf->cq_event.list,
+			      &phba->sli4_hba.sp_queue_event);
 		/* Frame received */
-		phba->hba_flag |= HBA_RECEIVE_BUFFER;
+		phba->hba_flag |= HBA_SP_QUEUE_EVT;
 		spin_unlock_irqrestore(&phba->hbalock, iflags);
 		workposted = true;
 		break;
@@ -8794,7 +8773,58 @@ lpfc_sli4_sp_handle_rcqe(struct lpfc_hba *phba, struct lpfc_cqe *cqe)
 	}
 out:
 	return workposted;
+}
+
+/**
+ * lpfc_sli4_sp_handle_cqe - Process a slow path completion queue entry
+ * @phba: Pointer to HBA context object.
+ * @cq: Pointer to the completion queue.
+ * @wcqe: Pointer to a completion queue entry.
+ *
+ * This routine process a slow-path work-queue or recieve queue completion queue
+ * entry.
+ *
+ * Return: true if work posted to worker thread, otherwise false.
+ **/
+static bool
+lpfc_sli4_sp_handle_cqe(struct lpfc_hba *phba, struct lpfc_queue *cq,
+			 struct lpfc_cqe *cqe)
+{
+	struct lpfc_cqe cqevt;
+	bool workposted = false;
 
+	/* Copy the work queue CQE and convert endian order if needed */
+	lpfc_sli_pcimem_bcopy(cqe, &cqevt, sizeof(struct lpfc_cqe));
+
+	/* Check and process for different type of WCQE and dispatch */
+	switch (bf_get(lpfc_cqe_code, &cqevt)) {
+	case CQE_CODE_COMPL_WQE:
+		/* Process the WQ/RQ complete event */
+		workposted = lpfc_sli4_sp_handle_els_wcqe(phba,
+				(struct lpfc_wcqe_complete *)&cqevt);
+		break;
+	case CQE_CODE_RELEASE_WQE:
+		/* Process the WQ release event */
+		lpfc_sli4_sp_handle_rel_wcqe(phba,
+				(struct lpfc_wcqe_release *)&cqevt);
+		break;
+	case CQE_CODE_XRI_ABORTED:
+		/* Process the WQ XRI abort event */
+		workposted = lpfc_sli4_sp_handle_abort_xri_wcqe(phba, cq,
+				(struct sli4_wcqe_xri_aborted *)&cqevt);
+		break;
+	case CQE_CODE_RECEIVE:
+		/* Process the RQ event */
+		workposted = lpfc_sli4_sp_handle_rcqe(phba,
+				(struct lpfc_rcqe *)&cqevt);
+		break;
+	default:
+		lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
+				"0388 Not a valid WCQE code: x%x\n",
+				bf_get(lpfc_cqe_code, &cqevt));
+		break;
+	}
+	return workposted;
 }
 
 /**
@@ -8858,14 +8888,7 @@ lpfc_sli4_sp_handle_eqe(struct lpfc_hba *phba, struct lpfc_eqe *eqe)
 		break;
 	case LPFC_WCQ:
 		while ((cqe = lpfc_sli4_cq_get(cq))) {
-			workposted |= lpfc_sli4_sp_handle_wcqe(phba, cq, cqe);
-			if (!(++ecount % LPFC_GET_QE_REL_INT))
-				lpfc_sli4_cq_release(cq, LPFC_QUEUE_NOARM);
-		}
-		break;
-	case LPFC_RCQ:
-		while ((cqe = lpfc_sli4_cq_get(cq))) {
-			workposted |= lpfc_sli4_sp_handle_rcqe(phba, cqe);
+			workposted |= lpfc_sli4_sp_handle_cqe(phba, cq, cqe);
 			if (!(++ecount % LPFC_GET_QE_REL_INT))
 				lpfc_sli4_cq_release(cq, LPFC_QUEUE_NOARM);
 		}
@@ -10427,8 +10450,7 @@ lpfc_sli4_next_xritag(struct lpfc_hba *phba)
 		return xritag;
 	}
 	spin_unlock_irq(&phba->hbalock);
-
-	lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
+	lpfc_printf_log(phba, KERN_WARNING, LOG_SLI,
 			"2004 Failed to allocate XRI.last XRITAG is %d"
 			" Max XRI is %d, Used XRI is %d\n",
 			phba->sli4_hba.next_xri,
@@ -10492,15 +10514,7 @@ lpfc_sli4_post_sgl_list(struct lpfc_hba *phba)
 		lpfc_sli4_mbox_cmd_free(phba, mbox);
 		return -ENOMEM;
 	}
-
 	/* Get the first SGE entry from the non-embedded DMA memory */
-	if (unlikely(!mbox->sge_array)) {
-		lpfc_printf_log(phba, KERN_ERR, LOG_MBOX,
-				"2525 Failed to get the non-embedded SGE "
-				"virtual address\n");
-		lpfc_sli4_mbox_cmd_free(phba, mbox);
-		return -ENOMEM;
-	}
 	viraddr = mbox->sge_array->addr[0];
 
 	/* Set up the SGL pages in the non-embedded DMA pages */
@@ -10524,8 +10538,7 @@ lpfc_sli4_post_sgl_list(struct lpfc_hba *phba)
 		sgl_pg_pairs++;
 	}
 	bf_set(lpfc_post_sgl_pages_xri, sgl, xritag_start);
-	pg_pairs = (pg_pairs > 0) ? (pg_pairs - 1) : pg_pairs;
-	bf_set(lpfc_post_sgl_pages_xricnt, sgl, pg_pairs);
+	bf_set(lpfc_post_sgl_pages_xricnt, sgl, els_xri_cnt);
 	/* Perform endian conversion if necessary */
 	sgl->word0 = cpu_to_le32(sgl->word0);
 
@@ -10607,15 +10620,7 @@ lpfc_sli4_post_scsi_sgl_block(struct lpfc_hba *phba, struct list_head *sblist,
 		lpfc_sli4_mbox_cmd_free(phba, mbox);
 		return -ENOMEM;
 	}
-
 	/* Get the first SGE entry from the non-embedded DMA memory */
-	if (unlikely(!mbox->sge_array)) {
-		lpfc_printf_log(phba, KERN_ERR, LOG_MBOX,
-				"2565 Failed to get the non-embedded SGE "
-				"virtual address\n");
-		lpfc_sli4_mbox_cmd_free(phba, mbox);
-		return -ENOMEM;
-	}
 	viraddr = mbox->sge_array->addr[0];
 
 	/* Set up the SGL pages in the non-embedded DMA pages */
@@ -10802,6 +10807,105 @@ lpfc_fc_frame_to_vport(struct lpfc_hba *phba, struct fc_frame_header *fc_hdr,
 }
 
 /**
+ * lpfc_update_rcv_time_stamp - Update vport's rcv seq time stamp
+ * @vport: The vport to work on.
+ *
+ * This function updates the receive sequence time stamp for this vport. The
+ * receive sequence time stamp indicates the time that the last frame of the
+ * the sequence that has been idle for the longest amount of time was received.
+ * the driver uses this time stamp to indicate if any received sequences have
+ * timed out.
+ **/
+void
+lpfc_update_rcv_time_stamp(struct lpfc_vport *vport)
+{
+	struct lpfc_dmabuf *h_buf;
+	struct hbq_dmabuf *dmabuf = NULL;
+
+	/* get the oldest sequence on the rcv list */
+	h_buf = list_get_first(&vport->rcv_buffer_list,
+			       struct lpfc_dmabuf, list);
+	if (!h_buf)
+		return;
+	dmabuf = container_of(h_buf, struct hbq_dmabuf, hbuf);
+	vport->rcv_buffer_time_stamp = dmabuf->time_stamp;
+}
+
+/**
+ * lpfc_cleanup_rcv_buffers - Cleans up all outstanding receive sequences.
+ * @vport: The vport that the received sequences were sent to.
+ *
+ * This function cleans up all outstanding received sequences. This is called
+ * by the driver when a link event or user action invalidates all the received
+ * sequences.
+ **/
+void
+lpfc_cleanup_rcv_buffers(struct lpfc_vport *vport)
+{
+	struct lpfc_dmabuf *h_buf, *hnext;
+	struct lpfc_dmabuf *d_buf, *dnext;
+	struct hbq_dmabuf *dmabuf = NULL;
+
+	/* start with the oldest sequence on the rcv list */
+	list_for_each_entry_safe(h_buf, hnext, &vport->rcv_buffer_list, list) {
+		dmabuf = container_of(h_buf, struct hbq_dmabuf, hbuf);
+		list_del_init(&dmabuf->hbuf.list);
+		list_for_each_entry_safe(d_buf, dnext,
+					 &dmabuf->dbuf.list, list) {
+			list_del_init(&d_buf->list);
+			lpfc_in_buf_free(vport->phba, d_buf);
+		}
+		lpfc_in_buf_free(vport->phba, &dmabuf->dbuf);
+	}
+}
+
+/**
+ * lpfc_rcv_seq_check_edtov - Cleans up timed out receive sequences.
+ * @vport: The vport that the received sequences were sent to.
+ *
+ * This function determines whether any received sequences have timed out by
+ * first checking the vport's rcv_buffer_time_stamp. If this time_stamp
+ * indicates that there is at least one timed out sequence this routine will
+ * go through the received sequences one at a time from most inactive to most
+ * active to determine which ones need to be cleaned up. Once it has determined
+ * that a sequence needs to be cleaned up it will simply free up the resources
+ * without sending an abort.
+ **/
+void
+lpfc_rcv_seq_check_edtov(struct lpfc_vport *vport)
+{
+	struct lpfc_dmabuf *h_buf, *hnext;
+	struct lpfc_dmabuf *d_buf, *dnext;
+	struct hbq_dmabuf *dmabuf = NULL;
+	unsigned long timeout;
+	int abort_count = 0;
+
+	timeout = (msecs_to_jiffies(vport->phba->fc_edtov) +
+		   vport->rcv_buffer_time_stamp);
+	if (list_empty(&vport->rcv_buffer_list) ||
+	    time_before(jiffies, timeout))
+		return;
+	/* start with the oldest sequence on the rcv list */
+	list_for_each_entry_safe(h_buf, hnext, &vport->rcv_buffer_list, list) {
+		dmabuf = container_of(h_buf, struct hbq_dmabuf, hbuf);
+		timeout = (msecs_to_jiffies(vport->phba->fc_edtov) +
+			   dmabuf->time_stamp);
+		if (time_before(jiffies, timeout))
+			break;
+		abort_count++;
+		list_del_init(&dmabuf->hbuf.list);
+		list_for_each_entry_safe(d_buf, dnext,
+					 &dmabuf->dbuf.list, list) {
+			list_del_init(&d_buf->list);
+			lpfc_in_buf_free(vport->phba, d_buf);
+		}
+		lpfc_in_buf_free(vport->phba, &dmabuf->dbuf);
+	}
+	if (abort_count)
+		lpfc_update_rcv_time_stamp(vport);
+}
+
+/**
  * lpfc_fc_frame_add - Adds a frame to the vport's list of received sequences
  * @dmabuf: pointer to a dmabuf that describes the hdr and data of the FC frame
  *
@@ -10823,6 +10927,8 @@ lpfc_fc_frame_add(struct lpfc_vport *vport, struct hbq_dmabuf *dmabuf)
 	struct hbq_dmabuf *seq_dmabuf = NULL;
 	struct hbq_dmabuf *temp_dmabuf = NULL;
 
+	INIT_LIST_HEAD(&dmabuf->dbuf.list);
+	dmabuf->time_stamp = jiffies;
 	new_hdr = (struct fc_frame_header *)dmabuf->hbuf.virt;
 	/* Use the hdr_buf to find the sequence that this frame belongs to */
 	list_for_each_entry(h_buf, &vport->rcv_buffer_list, list) {
@@ -10841,13 +10947,27 @@ lpfc_fc_frame_add(struct lpfc_vport *vport, struct hbq_dmabuf *dmabuf)
 		 * Queue the buffer on the vport's rcv_buffer_list.
 		 */
 		list_add_tail(&dmabuf->hbuf.list, &vport->rcv_buffer_list);
+		lpfc_update_rcv_time_stamp(vport);
 		return dmabuf;
 	}
 	temp_hdr = seq_dmabuf->hbuf.virt;
-	if (new_hdr->fh_seq_cnt < temp_hdr->fh_seq_cnt) {
-		list_add(&seq_dmabuf->dbuf.list, &dmabuf->dbuf.list);
+	if (be16_to_cpu(new_hdr->fh_seq_cnt) <
+		be16_to_cpu(temp_hdr->fh_seq_cnt)) {
+		list_del_init(&seq_dmabuf->hbuf.list);
+		list_add_tail(&dmabuf->hbuf.list, &vport->rcv_buffer_list);
+		list_add_tail(&dmabuf->dbuf.list, &seq_dmabuf->dbuf.list);
+		lpfc_update_rcv_time_stamp(vport);
 		return dmabuf;
 	}
+	/* move this sequence to the tail to indicate a young sequence */
+	list_move_tail(&seq_dmabuf->hbuf.list, &vport->rcv_buffer_list);
+	seq_dmabuf->time_stamp = jiffies;
+	lpfc_update_rcv_time_stamp(vport);
+	if (list_empty(&seq_dmabuf->dbuf.list)) {
+		temp_hdr = dmabuf->hbuf.virt;
+		list_add_tail(&dmabuf->dbuf.list, &seq_dmabuf->dbuf.list);
+		return seq_dmabuf;
+	}
 	/* find the correct place in the sequence to insert this frame */
 	list_for_each_entry_reverse(d_buf, &seq_dmabuf->dbuf.list, list) {
 		temp_dmabuf = container_of(d_buf, struct hbq_dmabuf, dbuf);
@@ -10856,7 +10976,8 @@ lpfc_fc_frame_add(struct lpfc_vport *vport, struct hbq_dmabuf *dmabuf)
 		 * If the frame's sequence count is greater than the frame on
 		 * the list then insert the frame right after this frame
 		 */
-		if (new_hdr->fh_seq_cnt > temp_hdr->fh_seq_cnt) {
+		if (be16_to_cpu(new_hdr->fh_seq_cnt) >
+			be16_to_cpu(temp_hdr->fh_seq_cnt)) {
 			list_add(&dmabuf->dbuf.list, &temp_dmabuf->dbuf.list);
 			return seq_dmabuf;
 		}
@@ -10865,6 +10986,210 @@ lpfc_fc_frame_add(struct lpfc_vport *vport, struct hbq_dmabuf *dmabuf)
 }
 
 /**
+ * lpfc_sli4_abort_partial_seq - Abort partially assembled unsol sequence
+ * @vport: pointer to a vitural port
+ * @dmabuf: pointer to a dmabuf that describes the FC sequence
+ *
+ * This function tries to abort from the partially assembed sequence, described
+ * by the information from basic abbort @dmabuf. It checks to see whether such
+ * partially assembled sequence held by the driver. If so, it shall free up all
+ * the frames from the partially assembled sequence.
+ *
+ * Return
+ * true  -- if there is matching partially assembled sequence present and all
+ *          the frames freed with the sequence;
+ * false -- if there is no matching partially assembled sequence present so
+ *          nothing got aborted in the lower layer driver
+ **/
+static bool
+lpfc_sli4_abort_partial_seq(struct lpfc_vport *vport,
+			    struct hbq_dmabuf *dmabuf)
+{
+	struct fc_frame_header *new_hdr;
+	struct fc_frame_header *temp_hdr;
+	struct lpfc_dmabuf *d_buf, *n_buf, *h_buf;
+	struct hbq_dmabuf *seq_dmabuf = NULL;
+
+	/* Use the hdr_buf to find the sequence that matches this frame */
+	INIT_LIST_HEAD(&dmabuf->dbuf.list);
+	INIT_LIST_HEAD(&dmabuf->hbuf.list);
+	new_hdr = (struct fc_frame_header *)dmabuf->hbuf.virt;
+	list_for_each_entry(h_buf, &vport->rcv_buffer_list, list) {
+		temp_hdr = (struct fc_frame_header *)h_buf->virt;
+		if ((temp_hdr->fh_seq_id != new_hdr->fh_seq_id) ||
+		    (temp_hdr->fh_ox_id != new_hdr->fh_ox_id) ||
+		    (memcmp(&temp_hdr->fh_s_id, &new_hdr->fh_s_id, 3)))
+			continue;
+		/* found a pending sequence that matches this frame */
+		seq_dmabuf = container_of(h_buf, struct hbq_dmabuf, hbuf);
+		break;
+	}
+
+	/* Free up all the frames from the partially assembled sequence */
+	if (seq_dmabuf) {
+		list_for_each_entry_safe(d_buf, n_buf,
+					 &seq_dmabuf->dbuf.list, list) {
+			list_del_init(&d_buf->list);
+			lpfc_in_buf_free(vport->phba, d_buf);
+		}
+		return true;
+	}
+	return false;
+}
+
+/**
+ * lpfc_sli4_seq_abort_acc_cmpl - Accept seq abort iocb complete handler
+ * @phba: Pointer to HBA context object.
+ * @cmd_iocbq: pointer to the command iocbq structure.
+ * @rsp_iocbq: pointer to the response iocbq structure.
+ *
+ * This function handles the sequence abort accept iocb command complete
+ * event. It properly releases the memory allocated to the sequence abort
+ * accept iocb.
+ **/
+static void
+lpfc_sli4_seq_abort_acc_cmpl(struct lpfc_hba *phba,
+			     struct lpfc_iocbq *cmd_iocbq,
+			     struct lpfc_iocbq *rsp_iocbq)
+{
+	if (cmd_iocbq)
+		lpfc_sli_release_iocbq(phba, cmd_iocbq);
+}
+
+/**
+ * lpfc_sli4_seq_abort_acc - Accept sequence abort
+ * @phba: Pointer to HBA context object.
+ * @fc_hdr: pointer to a FC frame header.
+ *
+ * This function sends a basic accept to a previous unsol sequence abort
+ * event after aborting the sequence handling.
+ **/
+static void
+lpfc_sli4_seq_abort_acc(struct lpfc_hba *phba,
+			struct fc_frame_header *fc_hdr)
+{
+	struct lpfc_iocbq *ctiocb = NULL;
+	struct lpfc_nodelist *ndlp;
+	uint16_t oxid, rxid;
+	uint32_t sid, fctl;
+	IOCB_t *icmd;
+
+	if (!lpfc_is_link_up(phba))
+		return;
+
+	sid = sli4_sid_from_fc_hdr(fc_hdr);
+	oxid = be16_to_cpu(fc_hdr->fh_ox_id);
+	rxid = be16_to_cpu(fc_hdr->fh_rx_id);
+
+	ndlp = lpfc_findnode_did(phba->pport, sid);
+	if (!ndlp) {
+		lpfc_printf_log(phba, KERN_WARNING, LOG_ELS,
+				"1268 Find ndlp returned NULL for oxid:x%x "
+				"SID:x%x\n", oxid, sid);
+		return;
+	}
+
+	/* Allocate buffer for acc iocb */
+	ctiocb = lpfc_sli_get_iocbq(phba);
+	if (!ctiocb)
+		return;
+
+	/* Extract the F_CTL field from FC_HDR */
+	fctl = sli4_fctl_from_fc_hdr(fc_hdr);
+
+	icmd = &ctiocb->iocb;
+	icmd->un.xseq64.bdl.bdeSize = 0;
+	icmd->un.xseq64.bdl.ulpIoTag32 = 0;
+	icmd->un.xseq64.w5.hcsw.Dfctl = 0;
+	icmd->un.xseq64.w5.hcsw.Rctl = FC_RCTL_BA_ACC;
+	icmd->un.xseq64.w5.hcsw.Type = FC_TYPE_BLS;
+
+	/* Fill in the rest of iocb fields */
+	icmd->ulpCommand = CMD_XMIT_BLS_RSP64_CX;
+	icmd->ulpBdeCount = 0;
+	icmd->ulpLe = 1;
+	icmd->ulpClass = CLASS3;
+	icmd->ulpContext = ndlp->nlp_rpi;
+
+	ctiocb->iocb_cmpl = NULL;
+	ctiocb->vport = phba->pport;
+	ctiocb->iocb_cmpl = lpfc_sli4_seq_abort_acc_cmpl;
+
+	if (fctl & FC_FC_EX_CTX) {
+		/* ABTS sent by responder to CT exchange, construction
+		 * of BA_ACC will use OX_ID from ABTS for the XRI_TAG
+		 * field and RX_ID from ABTS for RX_ID field.
+		 */
+		bf_set(lpfc_abts_orig, &icmd->un.bls_acc, LPFC_ABTS_UNSOL_RSP);
+		bf_set(lpfc_abts_rxid, &icmd->un.bls_acc, rxid);
+		ctiocb->sli4_xritag = oxid;
+	} else {
+		/* ABTS sent by initiator to CT exchange, construction
+		 * of BA_ACC will need to allocate a new XRI as for the
+		 * XRI_TAG and RX_ID fields.
+		 */
+		bf_set(lpfc_abts_orig, &icmd->un.bls_acc, LPFC_ABTS_UNSOL_INT);
+		bf_set(lpfc_abts_rxid, &icmd->un.bls_acc, NO_XRI);
+		ctiocb->sli4_xritag = NO_XRI;
+	}
+	bf_set(lpfc_abts_oxid, &icmd->un.bls_acc, oxid);
+
+	/* Xmit CT abts accept on exchange <xid> */
+	lpfc_printf_log(phba, KERN_INFO, LOG_ELS,
+			"1200 Xmit CT ABTS ACC on exchange x%x Data: x%x\n",
+			CMD_XMIT_BLS_RSP64_CX, phba->link_state);
+	lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, ctiocb, 0);
+}
+
+/**
+ * lpfc_sli4_handle_unsol_abort - Handle sli-4 unsolicited abort event
+ * @vport: Pointer to the vport on which this sequence was received
+ * @dmabuf: pointer to a dmabuf that describes the FC sequence
+ *
+ * This function handles an SLI-4 unsolicited abort event. If the unsolicited
+ * receive sequence is only partially assembed by the driver, it shall abort
+ * the partially assembled frames for the sequence. Otherwise, if the
+ * unsolicited receive sequence has been completely assembled and passed to
+ * the Upper Layer Protocol (UPL), it then mark the per oxid status for the
+ * unsolicited sequence has been aborted. After that, it will issue a basic
+ * accept to accept the abort.
+ **/
+void
+lpfc_sli4_handle_unsol_abort(struct lpfc_vport *vport,
+			     struct hbq_dmabuf *dmabuf)
+{
+	struct lpfc_hba *phba = vport->phba;
+	struct fc_frame_header fc_hdr;
+	uint32_t fctl;
+	bool abts_par;
+
+	/* Make a copy of fc_hdr before the dmabuf being released */
+	memcpy(&fc_hdr, dmabuf->hbuf.virt, sizeof(struct fc_frame_header));
+	fctl = sli4_fctl_from_fc_hdr(&fc_hdr);
+
+	if (fctl & FC_FC_EX_CTX) {
+		/*
+		 * ABTS sent by responder to exchange, just free the buffer
+		 */
+		lpfc_in_buf_free(phba, &dmabuf->dbuf);
+	} else {
+		/*
+		 * ABTS sent by initiator to exchange, need to do cleanup
+		 */
+		/* Try to abort partially assembled seq */
+		abts_par = lpfc_sli4_abort_partial_seq(vport, dmabuf);
+
+		/* Send abort to ULP if partially seq abort failed */
+		if (abts_par == false)
+			lpfc_sli4_send_seq_to_ulp(vport, dmabuf);
+		else
+			lpfc_in_buf_free(phba, &dmabuf->dbuf);
+	}
+	/* Send basic accept (BA_ACC) to the abort requester */
+	lpfc_sli4_seq_abort_acc(phba, &fc_hdr);
+}
+
+/**
  * lpfc_seq_complete - Indicates if a sequence is complete
  * @dmabuf: pointer to a dmabuf that describes the FC sequence
  *
@@ -10899,7 +11224,7 @@ lpfc_seq_complete(struct hbq_dmabuf *dmabuf)
 		seq_dmabuf = container_of(d_buf, struct hbq_dmabuf, dbuf);
 		hdr = (struct fc_frame_header *)seq_dmabuf->hbuf.virt;
 		/* If there is a hole in the sequence count then fail. */
-		if (++seq_count != hdr->fh_seq_cnt)
+		if (++seq_count != be16_to_cpu(hdr->fh_seq_cnt))
 			return 0;
 		fctl = (hdr->fh_f_ctl[0] << 16 |
 			hdr->fh_f_ctl[1] << 8 |
@@ -10931,14 +11256,14 @@ lpfc_prep_seq(struct lpfc_vport *vport, struct hbq_dmabuf *seq_dmabuf)
 	struct lpfc_iocbq *first_iocbq, *iocbq;
 	struct fc_frame_header *fc_hdr;
 	uint32_t sid;
+	struct ulp_bde64 *pbde;
 
 	fc_hdr = (struct fc_frame_header *)seq_dmabuf->hbuf.virt;
 	/* remove from receive buffer list */
 	list_del_init(&seq_dmabuf->hbuf.list);
+	lpfc_update_rcv_time_stamp(vport);
 	/* get the Remote Port's SID */
-	sid = (fc_hdr->fh_s_id[0] << 16 |
-	       fc_hdr->fh_s_id[1] << 8 |
-	       fc_hdr->fh_s_id[2]);
+	sid = sli4_sid_from_fc_hdr(fc_hdr);
 	/* Get an iocbq struct to fill in. */
 	first_iocbq = lpfc_sli_get_iocbq(vport->phba);
 	if (first_iocbq) {
@@ -10957,7 +11282,8 @@ lpfc_prep_seq(struct lpfc_vport *vport, struct hbq_dmabuf *seq_dmabuf)
 							LPFC_DATA_BUF_SIZE;
 		first_iocbq->iocb.un.rcvels.remoteID = sid;
 		first_iocbq->iocb.unsli3.rcvsli3.acc_len +=
-				bf_get(lpfc_rcqe_length, &seq_dmabuf->rcqe);
+				bf_get(lpfc_rcqe_length,
+				       &seq_dmabuf->cq_event.cqe.rcqe_cmpl);
 	}
 	iocbq = first_iocbq;
 	/*
@@ -10972,10 +11298,12 @@ lpfc_prep_seq(struct lpfc_vport *vport, struct hbq_dmabuf *seq_dmabuf)
 		if (!iocbq->context3) {
 			iocbq->context3 = d_buf;
 			iocbq->iocb.ulpBdeCount++;
-			iocbq->iocb.unsli3.rcvsli3.bde2.tus.f.bdeSize =
-							LPFC_DATA_BUF_SIZE;
+			pbde = (struct ulp_bde64 *)
+					&iocbq->iocb.unsli3.sli3Words[4];
+			pbde->tus.f.bdeSize = LPFC_DATA_BUF_SIZE;
 			first_iocbq->iocb.unsli3.rcvsli3.acc_len +=
-				bf_get(lpfc_rcqe_length, &seq_dmabuf->rcqe);
+				bf_get(lpfc_rcqe_length,
+				       &seq_dmabuf->cq_event.cqe.rcqe_cmpl);
 		} else {
 			iocbq = lpfc_sli_get_iocbq(vport->phba);
 			if (!iocbq) {
@@ -10994,7 +11322,8 @@ lpfc_prep_seq(struct lpfc_vport *vport, struct hbq_dmabuf *seq_dmabuf)
 			iocbq->iocb.un.cont64[0].tus.f.bdeSize =
 							LPFC_DATA_BUF_SIZE;
 			first_iocbq->iocb.unsli3.rcvsli3.acc_len +=
-				bf_get(lpfc_rcqe_length, &seq_dmabuf->rcqe);
+				bf_get(lpfc_rcqe_length,
+				       &seq_dmabuf->cq_event.cqe.rcqe_cmpl);
 			iocbq->iocb.un.rcvels.remoteID = sid;
 			list_add_tail(&iocbq->list, &first_iocbq->list);
 		}
@@ -11002,6 +11331,43 @@ lpfc_prep_seq(struct lpfc_vport *vport, struct hbq_dmabuf *seq_dmabuf)
 	return first_iocbq;
 }
 
+static void
+lpfc_sli4_send_seq_to_ulp(struct lpfc_vport *vport,
+			  struct hbq_dmabuf *seq_dmabuf)
+{
+	struct fc_frame_header *fc_hdr;
+	struct lpfc_iocbq *iocbq, *curr_iocb, *next_iocb;
+	struct lpfc_hba *phba = vport->phba;
+
+	fc_hdr = (struct fc_frame_header *)seq_dmabuf->hbuf.virt;
+	iocbq = lpfc_prep_seq(vport, seq_dmabuf);
+	if (!iocbq) {
+		lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
+				"2707 Ring %d handler: Failed to allocate "
+				"iocb Rctl x%x Type x%x received\n",
+				LPFC_ELS_RING,
+				fc_hdr->fh_r_ctl, fc_hdr->fh_type);
+		return;
+	}
+	if (!lpfc_complete_unsol_iocb(phba,
+				      &phba->sli.ring[LPFC_ELS_RING],
+				      iocbq, fc_hdr->fh_r_ctl,
+				      fc_hdr->fh_type))
+		lpfc_printf_log(phba, KERN_WARNING, LOG_SLI,
+				"2540 Ring %d handler: unexpected Rctl "
+				"x%x Type x%x received\n",
+				LPFC_ELS_RING,
+				fc_hdr->fh_r_ctl, fc_hdr->fh_type);
+
+	/* Free iocb created in lpfc_prep_seq */
+	list_for_each_entry_safe(curr_iocb, next_iocb,
+		&iocbq->list, list) {
+		list_del_init(&curr_iocb->list);
+		lpfc_sli_release_iocbq(phba, curr_iocb);
+	}
+	lpfc_sli_release_iocbq(phba, iocbq);
+}
+
 /**
  * lpfc_sli4_handle_received_buffer - Handle received buffers from firmware
  * @phba: Pointer to HBA context object.
@@ -11014,67 +11380,48 @@ lpfc_prep_seq(struct lpfc_vport *vport, struct hbq_dmabuf *seq_dmabuf)
  * Worker thread calls lpfc_sli4_handle_received_buffer, which will call the
  * appropriate receive function when the final frame in a sequence is received.
  **/
-int
-lpfc_sli4_handle_received_buffer(struct lpfc_hba *phba)
+void
+lpfc_sli4_handle_received_buffer(struct lpfc_hba *phba,
+				 struct hbq_dmabuf *dmabuf)
 {
-	LIST_HEAD(cmplq);
-	struct hbq_dmabuf *dmabuf, *seq_dmabuf;
+	struct hbq_dmabuf *seq_dmabuf;
 	struct fc_frame_header *fc_hdr;
 	struct lpfc_vport *vport;
 	uint32_t fcfi;
-	struct lpfc_iocbq *iocbq;
-
-	/* Clear hba flag and get all received buffers into the cmplq */
-	spin_lock_irq(&phba->hbalock);
-	phba->hba_flag &= ~HBA_RECEIVE_BUFFER;
-	list_splice_init(&phba->rb_pend_list, &cmplq);
-	spin_unlock_irq(&phba->hbalock);
 
 	/* Process each received buffer */
-	while ((dmabuf = lpfc_sli_hbqbuf_get(&cmplq)) != NULL) {
-		fc_hdr = (struct fc_frame_header *)dmabuf->hbuf.virt;
-		/* check to see if this a valid type of frame */
-		if (lpfc_fc_frame_check(phba, fc_hdr)) {
-			lpfc_in_buf_free(phba, &dmabuf->dbuf);
-			continue;
-		}
-		fcfi = bf_get(lpfc_rcqe_fcf_id, &dmabuf->rcqe);
-		vport = lpfc_fc_frame_to_vport(phba, fc_hdr, fcfi);
-		if (!vport) {
-			/* throw out the frame */
-			lpfc_in_buf_free(phba, &dmabuf->dbuf);
-			continue;
-		}
-		/* Link this frame */
-		seq_dmabuf = lpfc_fc_frame_add(vport, dmabuf);
-		if (!seq_dmabuf) {
-			/* unable to add frame to vport - throw it out */
-			lpfc_in_buf_free(phba, &dmabuf->dbuf);
-			continue;
-		}
-		/* If not last frame in sequence continue processing frames. */
-		if (!lpfc_seq_complete(seq_dmabuf)) {
-			/*
-			 * When saving off frames post a new one and mark this
-			 * frame to be freed when it is finished.
-			 **/
-			lpfc_sli_hbqbuf_fill_hbqs(phba, LPFC_ELS_HBQ, 1);
-			dmabuf->tag = -1;
-			continue;
-		}
-		fc_hdr = (struct fc_frame_header *)seq_dmabuf->hbuf.virt;
-		iocbq = lpfc_prep_seq(vport, seq_dmabuf);
-		if (!lpfc_complete_unsol_iocb(phba,
-					      &phba->sli.ring[LPFC_ELS_RING],
-					      iocbq, fc_hdr->fh_r_ctl,
-					      fc_hdr->fh_type))
-			lpfc_printf_log(phba, KERN_WARNING, LOG_SLI,
-					"2540 Ring %d handler: unexpected Rctl "
-					"x%x Type x%x received\n",
-					LPFC_ELS_RING,
-					fc_hdr->fh_r_ctl, fc_hdr->fh_type);
-	};
-	return 0;
+	fc_hdr = (struct fc_frame_header *)dmabuf->hbuf.virt;
+	/* check to see if this a valid type of frame */
+	if (lpfc_fc_frame_check(phba, fc_hdr)) {
+		lpfc_in_buf_free(phba, &dmabuf->dbuf);
+		return;
+	}
+	fcfi = bf_get(lpfc_rcqe_fcf_id, &dmabuf->cq_event.cqe.rcqe_cmpl);
+	vport = lpfc_fc_frame_to_vport(phba, fc_hdr, fcfi);
+	if (!vport || !(vport->vpi_state & LPFC_VPI_REGISTERED)) {
+		/* throw out the frame */
+		lpfc_in_buf_free(phba, &dmabuf->dbuf);
+		return;
+	}
+	/* Handle the basic abort sequence (BA_ABTS) event */
+	if (fc_hdr->fh_r_ctl == FC_RCTL_BA_ABTS) {
+		lpfc_sli4_handle_unsol_abort(vport, dmabuf);
+		return;
+	}
+
+	/* Link this frame */
+	seq_dmabuf = lpfc_fc_frame_add(vport, dmabuf);
+	if (!seq_dmabuf) {
+		/* unable to add frame to vport - throw it out */
+		lpfc_in_buf_free(phba, &dmabuf->dbuf);
+		return;
+	}
+	/* If not last frame in sequence continue processing frames. */
+	if (!lpfc_seq_complete(seq_dmabuf))
+		return;
+
+	/* Send the complete sequence to the upper layer protocol */
+	lpfc_sli4_send_seq_to_ulp(vport, seq_dmabuf);
 }
 
 /**
@@ -11091,7 +11438,7 @@ lpfc_sli4_handle_received_buffer(struct lpfc_hba *phba)
  * sequential.
  *
  * Return codes
- * 	0 - sucessful
+ * 	0 - successful
  *      EIO - The mailbox failed to complete successfully.
  * 	When this error occurs, the driver is not guaranteed
  *	to have any rpi regions posted to the device and
@@ -11129,7 +11476,7 @@ lpfc_sli4_post_all_rpi_hdrs(struct lpfc_hba *phba)
  * maps up to 64 rpi context regions.
  *
  * Return codes
- * 	0 - sucessful
+ * 	0 - successful
  * 	ENOMEM - No available memory
  *      EIO - The mailbox failed to complete successfully.
  **/
@@ -11191,7 +11538,7 @@ lpfc_sli4_post_rpi_hdr(struct lpfc_hba *phba, struct lpfc_rpi_hdr *rpi_page)
  * PAGE_SIZE modulo 64 rpi context headers.
  *
  * Returns
- * 	A nonzero rpi defined as rpi_base <= rpi < max_rpi if sucessful
+ * 	A nonzero rpi defined as rpi_base <= rpi < max_rpi if successful
  * 	LPFC_RPI_ALLOC_ERROR if no rpis are available.
  **/
 int
@@ -11334,6 +11681,7 @@ lpfc_sli4_init_vpi(struct lpfc_hba *phba, uint16_t vpi)
 {
 	LPFC_MBOXQ_t *mboxq;
 	int rc = 0;
+	int retval = MBX_SUCCESS;
 	uint32_t mbox_tmo;
 
 	if (vpi == 0)
@@ -11344,16 +11692,17 @@ lpfc_sli4_init_vpi(struct lpfc_hba *phba, uint16_t vpi)
 	lpfc_init_vpi(phba, mboxq, vpi);
 	mbox_tmo = lpfc_mbox_tmo_val(phba, MBX_INIT_VPI);
 	rc = lpfc_sli_issue_mbox_wait(phba, mboxq, mbox_tmo);
-	if (rc != MBX_TIMEOUT)
-		mempool_free(mboxq, phba->mbox_mem_pool);
 	if (rc != MBX_SUCCESS) {
 		lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
 				"2022 INIT VPI Mailbox failed "
 				"status %d, mbxStatus x%x\n", rc,
 				bf_get(lpfc_mqe_status, &mboxq->u.mqe));
-		rc = -EIO;
+		retval = -EIO;
 	}
-	return rc;
+	if (rc != MBX_TIMEOUT)
+		mempool_free(mboxq, phba->mbox_mem_pool);
+
+	return retval;
 }
 
 /**
@@ -11438,13 +11787,6 @@ lpfc_sli4_add_fcf_record(struct lpfc_hba *phba, struct fcf_record *fcf_record)
 	 */
 	lpfc_sli4_mbx_sge_get(mboxq, 0, &sge);
 	phys_addr = getPaddr(sge.pa_hi, sge.pa_lo);
-	if (unlikely(!mboxq->sge_array)) {
-		lpfc_printf_log(phba, KERN_ERR, LOG_MBOX,
-				"2526 Failed to get the non-embedded SGE "
-				"virtual address\n");
-		lpfc_sli4_mbox_cmd_free(phba, mboxq);
-		return -ENOMEM;
-	}
 	virt_addr = mboxq->sge_array->addr[0];
 	/*
 	 * Configure the FCF record for FCFI 0.  This is the driver's
@@ -11542,7 +11884,8 @@ lpfc_sli4_read_fcf_record(struct lpfc_hba *phba, uint16_t fcf_index)
 		lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
 				"2000 Failed to allocate mbox for "
 				"READ_FCF cmd\n");
-		return -ENOMEM;
+		error = -ENOMEM;
+		goto fail_fcfscan;
 	}
 
 	req_len = sizeof(struct fcf_record) +
@@ -11558,8 +11901,8 @@ lpfc_sli4_read_fcf_record(struct lpfc_hba *phba, uint16_t fcf_index)
 				"0291 Allocated DMA memory size (x%x) is "
 				"less than the requested DMA memory "
 				"size (x%x)\n", alloc_len, req_len);
-		lpfc_sli4_mbox_cmd_free(phba, mboxq);
-		return -ENOMEM;
+		error = -ENOMEM;
+		goto fail_fcfscan;
 	}
 
 	/* Get the first SGE entry from the non-embedded DMA memory. This
@@ -11567,13 +11910,6 @@ lpfc_sli4_read_fcf_record(struct lpfc_hba *phba, uint16_t fcf_index)
 	 */
 	lpfc_sli4_mbx_sge_get(mboxq, 0, &sge);
 	phys_addr = getPaddr(sge.pa_hi, sge.pa_lo);
-	if (unlikely(!mboxq->sge_array)) {
-		lpfc_printf_log(phba, KERN_ERR, LOG_MBOX,
-				"2527 Failed to get the non-embedded SGE "
-				"virtual address\n");
-		lpfc_sli4_mbox_cmd_free(phba, mboxq);
-		return -ENOMEM;
-	}
 	virt_addr = mboxq->sge_array->addr[0];
 	read_fcf = (struct lpfc_mbx_read_fcf_tbl *)virt_addr;
 
@@ -11586,7 +11922,6 @@ lpfc_sli4_read_fcf_record(struct lpfc_hba *phba, uint16_t fcf_index)
 	mboxq->mbox_cmpl = lpfc_mbx_cmpl_read_fcf_record;
 	rc = lpfc_sli_issue_mbox(phba, mboxq, MBX_NOWAIT);
 	if (rc == MBX_NOT_FINISHED) {
-		lpfc_sli4_mbox_cmd_free(phba, mboxq);
 		error = -EIO;
 	} else {
 		spin_lock_irq(&phba->hbalock);
@@ -11594,6 +11929,15 @@ lpfc_sli4_read_fcf_record(struct lpfc_hba *phba, uint16_t fcf_index)
 		spin_unlock_irq(&phba->hbalock);
 		error = 0;
 	}
+fail_fcfscan:
+	if (error) {
+		if (mboxq)
+			lpfc_sli4_mbox_cmd_free(phba, mboxq);
+		/* FCF scan failed, clear FCF_DISC_INPROGRESS flag */
+		spin_lock_irq(&phba->hbalock);
+		phba->hba_flag &= ~FCF_DISC_INPROGRESS;
+		spin_unlock_irq(&phba->hbalock);
+	}
 	return error;
 }
 
diff --git a/drivers/scsi/lpfc/lpfc_sli.h b/drivers/scsi/lpfc/lpfc_sli.h
index 3c53316cf6d0..ba38de3c28f1 100644
--- a/drivers/scsi/lpfc/lpfc_sli.h
+++ b/drivers/scsi/lpfc/lpfc_sli.h
@@ -29,14 +29,17 @@ typedef enum _lpfc_ctx_cmd {
 	LPFC_CTX_HOST
 } lpfc_ctx_cmd;
 
-/* This structure is used to carry the needed response IOCB states */
-struct lpfc_sli4_rspiocb_info {
-	uint8_t hw_status;
-	uint8_t bfield;
-#define LPFC_XB	0x1
-#define LPFC_PV	0x2
-	uint8_t priority;
-	uint8_t reserved;
+struct lpfc_cq_event {
+	struct list_head list;
+	union {
+		struct lpfc_mcqe		mcqe_cmpl;
+		struct lpfc_acqe_link		acqe_link;
+		struct lpfc_acqe_fcoe		acqe_fcoe;
+		struct lpfc_acqe_dcbx		acqe_dcbx;
+		struct lpfc_rcqe		rcqe_cmpl;
+		struct sli4_wcqe_xri_aborted	wcqe_axri;
+		struct lpfc_wcqe_complete	wcqe_cmpl;
+	} cqe;
 };
 
 /* This structure is used to handle IOCB requests / responses */
@@ -46,6 +49,7 @@ struct lpfc_iocbq {
 	struct list_head clist;
 	uint16_t iotag;         /* pre-assigned IO tag */
 	uint16_t sli4_xritag;   /* pre-assigned XRI, (OXID) tag. */
+	struct lpfc_cq_event cq_event;
 
 	IOCB_t iocb;		/* IOCB cmd */
 	uint8_t retry;		/* retry counter for IOCB cmd - if needed */
@@ -56,11 +60,13 @@ struct lpfc_iocbq {
 #define LPFC_DRIVER_ABORTED	8	/* driver aborted this request */
 #define LPFC_IO_FABRIC		0x10	/* Iocb send using fabric scheduler */
 #define LPFC_DELAY_MEM_FREE	0x20    /* Defer free'ing of FC data */
-#define LPFC_FIP_ELS		0x40
+#define LPFC_FIP_ELS_ID_MASK	0xc0	/* ELS_ID range 0-3 */
+#define LPFC_FIP_ELS_ID_SHIFT	6
 
 	uint8_t abort_count;
 	uint8_t rsvd2;
 	uint32_t drvrTimeout;	/* driver timeout in seconds */
+	uint32_t fcp_wqidx;	/* index to FCP work queue */
 	struct lpfc_vport *vport;/* virtual port pointer */
 	void *context1;		/* caller context information */
 	void *context2;		/* caller context information */
@@ -76,7 +82,6 @@ struct lpfc_iocbq {
 			   struct lpfc_iocbq *);
 	void (*iocb_cmpl) (struct lpfc_hba *, struct lpfc_iocbq *,
 			   struct lpfc_iocbq *);
-	struct lpfc_sli4_rspiocb_info sli4_info;
 };
 
 #define SLI_IOCB_RET_IOCB      1	/* Return IOCB if cmd ring full */
@@ -110,7 +115,7 @@ typedef struct lpfcMboxq {
 				   return */
 #define MBX_NOWAIT      2	/* issue command then return immediately */
 
-#define LPFC_MAX_RING_MASK  4	/* max num of rctl/type masks allowed per
+#define LPFC_MAX_RING_MASK  5	/* max num of rctl/type masks allowed per
 				   ring */
 #define LPFC_MAX_RING       4	/* max num of SLI rings used by driver */
 
diff --git a/drivers/scsi/lpfc/lpfc_sli4.h b/drivers/scsi/lpfc/lpfc_sli4.h
index b5f4ba1a5c27..44e5f574236b 100644
--- a/drivers/scsi/lpfc/lpfc_sli4.h
+++ b/drivers/scsi/lpfc/lpfc_sli4.h
@@ -28,7 +28,7 @@
 /* Multi-queue arrangement for fast-path FCP work queues */
 #define LPFC_FN_EQN_MAX       8
 #define LPFC_SP_EQN_DEF       1
-#define LPFC_FP_EQN_DEF       1
+#define LPFC_FP_EQN_DEF       4
 #define LPFC_FP_EQN_MIN       1
 #define LPFC_FP_EQN_MAX       (LPFC_FN_EQN_MAX - LPFC_SP_EQN_DEF)
 
@@ -58,6 +58,16 @@
 #define LPFC_FCOE_FKA_ADV_PER	0
 #define LPFC_FCOE_FIP_PRIORITY	0x80
 
+#define sli4_sid_from_fc_hdr(fc_hdr)  \
+	((fc_hdr)->fh_s_id[0] << 16 | \
+	 (fc_hdr)->fh_s_id[1] <<  8 | \
+	 (fc_hdr)->fh_s_id[2])
+
+#define sli4_fctl_from_fc_hdr(fc_hdr)  \
+	((fc_hdr)->fh_f_ctl[0] << 16 | \
+	 (fc_hdr)->fh_f_ctl[1] <<  8 | \
+	 (fc_hdr)->fh_f_ctl[2])
+
 enum lpfc_sli4_queue_type {
 	LPFC_EQ,
 	LPFC_GCQ,
@@ -110,18 +120,6 @@ struct lpfc_queue {
 	union sli4_qe qe[1];	/* array to index entries (must be last) */
 };
 
-struct lpfc_cq_event {
-	struct list_head list;
-	union {
-		struct lpfc_mcqe		mcqe_cmpl;
-		struct lpfc_acqe_link		acqe_link;
-		struct lpfc_acqe_fcoe		acqe_fcoe;
-		struct lpfc_acqe_dcbx		acqe_dcbx;
-		struct lpfc_rcqe		rcqe_cmpl;
-		struct sli4_wcqe_xri_aborted	wcqe_axri;
-	} cqe;
-};
-
 struct lpfc_sli4_link {
 	uint8_t speed;
 	uint8_t duplex;
@@ -166,7 +164,7 @@ struct lpfc_fip_param_hdr {
 #define	lpfc_fip_param_hdr_fipp_mode_SHIFT	6
 #define	lpfc_fip_param_hdr_fipp_mode_MASK	0x3
 #define lpfc_fip_param_hdr_fipp_mode_WORD	parm_flags
-#define	FIPP_MODE_ON				0x2
+#define	FIPP_MODE_ON				0x1
 #define	FIPP_MODE_OFF				0x0
 #define FIPP_VLAN_VALID				0x1
 };
@@ -295,9 +293,8 @@ struct lpfc_sli4_hba {
 	/* BAR0 PCI config space register memory map */
 	void __iomem *UERRLOregaddr; /* Address to UERR_STATUS_LO register */
 	void __iomem *UERRHIregaddr; /* Address to UERR_STATUS_HI register */
-	void __iomem *ONLINE0regaddr; /* Address to components of internal UE */
-	void __iomem *ONLINE1regaddr; /* Address to components of internal UE */
-#define LPFC_ONLINE_NERR	0xFFFFFFFF
+	void __iomem *UEMASKLOregaddr; /* Address to UE_MASK_LO register */
+	void __iomem *UEMASKHIregaddr; /* Address to UE_MASK_HI register */
 	void __iomem *SCRATCHPADregaddr; /* Address to scratchpad register */
 	/* BAR1 FCoE function CSR register memory map */
 	void __iomem *STAregaddr;    /* Address to HST_STATE register */
@@ -311,6 +308,8 @@ struct lpfc_sli4_hba {
 	void __iomem *MQDBregaddr;   /* Address to MQ_DOORBELL register */
 	void __iomem *BMBXregaddr;   /* Address to BootStrap MBX register */
 
+	uint32_t ue_mask_lo;
+	uint32_t ue_mask_hi;
 	struct msix_entry *msix_entries;
 	uint32_t cfg_eqn;
 	struct lpfc_fcp_eq_hdl *fcp_eq_hdl; /* FCP per-WQ handle */
@@ -325,7 +324,6 @@ struct lpfc_sli4_hba {
 	struct lpfc_queue **fcp_cq;/* Fast-path FCP compl queue */
 	struct lpfc_queue *mbx_cq; /* Slow-path mailbox complete queue */
 	struct lpfc_queue *els_cq; /* Slow-path ELS response complete queue */
-	struct lpfc_queue *rxq_cq; /* Slow-path unsolicited complete queue */
 
 	/* Setup information for various queue parameters */
 	int eq_esize;
@@ -360,7 +358,7 @@ struct lpfc_sli4_hba {
 	unsigned long *rpi_bmask;
 	uint16_t rpi_count;
 	struct lpfc_sli4_flags sli4_flags;
-	struct list_head sp_rspiocb_work_queue;
+	struct list_head sp_queue_event;
 	struct list_head sp_cqe_event_pool;
 	struct list_head sp_asynce_work_queue;
 	struct list_head sp_fcp_xri_aborted_work_queue;
diff --git a/drivers/scsi/lpfc/lpfc_version.h b/drivers/scsi/lpfc/lpfc_version.h
index 9ae20af4bdb7..792f72263f1a 100644
--- a/drivers/scsi/lpfc/lpfc_version.h
+++ b/drivers/scsi/lpfc/lpfc_version.h
@@ -18,8 +18,7 @@
  * included with this package.                                     *
  *******************************************************************/
 
-#define LPFC_DRIVER_VERSION "8.3.4"
-
+#define LPFC_DRIVER_VERSION "8.3.7"
 #define LPFC_DRIVER_NAME		"lpfc"
 #define LPFC_SP_DRIVER_HANDLER_NAME	"lpfc:sp"
 #define LPFC_FP_DRIVER_HANDLER_NAME	"lpfc:fp"
diff --git a/drivers/scsi/lpfc/lpfc_vport.c b/drivers/scsi/lpfc/lpfc_vport.c
index 606efa767548..e3c7fa642306 100644
--- a/drivers/scsi/lpfc/lpfc_vport.c
+++ b/drivers/scsi/lpfc/lpfc_vport.c
@@ -389,7 +389,7 @@ lpfc_vport_create(struct fc_vport *fc_vport, bool disable)
 	 * by the port.
 	 */
 	if ((phba->sli_rev == LPFC_SLI_REV4) &&
-		(pport->vfi_state & LPFC_VFI_REGISTERED)) {
+	    (pport->vpi_state & LPFC_VPI_REGISTERED)) {
 		rc = lpfc_sli4_init_vpi(phba, vpi);
 		if (rc) {
 			lpfc_printf_log(phba, KERN_ERR, LOG_VPORT,
@@ -512,8 +512,10 @@ enable_vport(struct fc_vport *fc_vport)
 		return VPORT_OK;
 	}
 
+	spin_lock_irq(&phba->hbalock);
 	vport->load_flag |= FC_LOADING;
 	vport->fc_flag |= FC_VPORT_NEEDS_REG_VPI;
+	spin_unlock_irq(&phba->hbalock);
 
 	/* Use the Physical nodes Fabric NDLP to determine if the link is
 	 * up and ready to FDISC.
@@ -700,6 +702,8 @@ lpfc_vport_delete(struct fc_vport *fc_vport)
 			}
 			spin_unlock_irq(&phba->ndlp_lock);
 		}
+		if (!(vport->vpi_state & LPFC_VPI_REGISTERED))
+			goto skip_logo;
 		vport->unreg_vpi_cmpl = VPORT_INVAL;
 		timeout = msecs_to_jiffies(phba->fc_ratov * 2000);
 		if (!lpfc_issue_els_npiv_logo(vport, ndlp))
diff --git a/drivers/scsi/megaraid.h b/drivers/scsi/megaraid.h
index 512c2cc1a33f..d310f49d077e 100644
--- a/drivers/scsi/megaraid.h
+++ b/drivers/scsi/megaraid.h
@@ -381,7 +381,7 @@ typedef struct {
 	u8	battery_status;	/*
 				 * BIT 0: battery module missing
 				 * BIT 1: VBAD
-				 * BIT 2: temprature high
+				 * BIT 2: temperature high
 				 * BIT 3: battery pack missing
 				 * BIT 4,5:
 				 *   00 - charge complete
diff --git a/drivers/scsi/megaraid/mbox_defs.h b/drivers/scsi/megaraid/mbox_defs.h
index b25b74764ec3..ce2487a888ed 100644
--- a/drivers/scsi/megaraid/mbox_defs.h
+++ b/drivers/scsi/megaraid/mbox_defs.h
@@ -497,7 +497,7 @@ typedef struct {
  * @inserted_drive		: channel:Id of inserted drive
  * @battery_status		: bit 0: battery module missing
  *				bit 1: VBAD
- *				bit 2: temprature high
+ *				bit 2: temperature high
  *				bit 3: battery pack missing
  *				bit 4,5:
  *					00 - charge complete
diff --git a/drivers/scsi/megaraid/megaraid_mbox.c b/drivers/scsi/megaraid/megaraid_mbox.c
index 234f0b7eb21c..7f977967b884 100644
--- a/drivers/scsi/megaraid/megaraid_mbox.c
+++ b/drivers/scsi/megaraid/megaraid_mbox.c
@@ -335,12 +335,17 @@ static struct device_attribute *megaraid_sdev_attrs[] = {
  * megaraid_change_queue_depth - Change the device's queue depth
  * @sdev:	scsi device struct
  * @qdepth:	depth to set
+ * @reason:	calling context
  *
  * Return value:
  * 	actual depth set
  */
-static int megaraid_change_queue_depth(struct scsi_device *sdev, int qdepth)
+static int megaraid_change_queue_depth(struct scsi_device *sdev, int qdepth,
+				       int reason)
 {
+	if (reason != SCSI_QDEPTH_DEFAULT)
+		return -EOPNOTSUPP;
+
 	if (qdepth > MBOX_MAX_SCSI_CMDS)
 		qdepth = MBOX_MAX_SCSI_CMDS;
 	scsi_adjust_queue_depth(sdev, 0, qdepth);
@@ -2704,7 +2709,7 @@ megaraid_reset_handler(struct scsi_cmnd *scp)
 	}
 	else {
 		con_log(CL_ANN, (KERN_NOTICE
-		"megaraid mbox: reset sequence completed sucessfully\n"));
+		"megaraid mbox: reset sequence completed successfully\n"));
 	}
 
 
diff --git a/drivers/scsi/megaraid/megaraid_sas.c b/drivers/scsi/megaraid/megaraid_sas.c
index a39addc3a596..708ea3157b60 100644
--- a/drivers/scsi/megaraid/megaraid_sas.c
+++ b/drivers/scsi/megaraid/megaraid_sas.c
@@ -10,7 +10,7 @@
  *	   2 of the License, or (at your option) any later version.
  *
  * FILE		: megaraid_sas.c
- * Version     : v00.00.04.01-rc1
+ * Version     : v00.00.04.12-rc1
  *
  * Authors:
  *	(email-id : megaraidlinux@lsi.com)
@@ -40,6 +40,7 @@
 #include <linux/compat.h>
 #include <linux/blkdev.h>
 #include <linux/mutex.h>
+#include <linux/poll.h>
 
 #include <scsi/scsi.h>
 #include <scsi/scsi_cmnd.h>
@@ -75,6 +76,10 @@ static struct pci_device_id megasas_pci_table[] = {
 	/* gen2*/
 	{PCI_DEVICE(PCI_VENDOR_ID_LSI_LOGIC, PCI_DEVICE_ID_LSI_SAS0079GEN2)},
 	/* gen2*/
+	{PCI_DEVICE(PCI_VENDOR_ID_LSI_LOGIC, PCI_DEVICE_ID_LSI_SAS0073SKINNY)},
+	/* skinny*/
+	{PCI_DEVICE(PCI_VENDOR_ID_LSI_LOGIC, PCI_DEVICE_ID_LSI_SAS0071SKINNY)},
+	/* skinny*/
 	{PCI_DEVICE(PCI_VENDOR_ID_LSI_LOGIC, PCI_DEVICE_ID_LSI_VERDE_ZCR)},
 	/* xscale IOP, vega */
 	{PCI_DEVICE(PCI_VENDOR_ID_DELL, PCI_DEVICE_ID_DELL_PERC5)},
@@ -89,8 +94,14 @@ static struct megasas_mgmt_info megasas_mgmt_info;
 static struct fasync_struct *megasas_async_queue;
 static DEFINE_MUTEX(megasas_async_queue_mutex);
 
+static int megasas_poll_wait_aen;
+static DECLARE_WAIT_QUEUE_HEAD(megasas_poll_wait);
+static u32 support_poll_for_event;
 static u32 megasas_dbg_lvl;
 
+/* define lock for aen poll */
+spinlock_t poll_aen_lock;
+
 static void
 megasas_complete_cmd(struct megasas_instance *instance, struct megasas_cmd *cmd,
 		     u8 alt_status);
@@ -215,7 +226,10 @@ megasas_clear_intr_xscale(struct megasas_register_set __iomem * regs)
  * @regs :			MFI register set
  */
 static inline void 
-megasas_fire_cmd_xscale(dma_addr_t frame_phys_addr,u32 frame_count, struct megasas_register_set __iomem *regs)
+megasas_fire_cmd_xscale(struct megasas_instance *instance,
+		dma_addr_t frame_phys_addr,
+		u32 frame_count,
+		struct megasas_register_set __iomem *regs)
 {
 	writel((frame_phys_addr >> 3)|(frame_count),
 	       &(regs)->inbound_queue_port);
@@ -312,7 +326,10 @@ megasas_clear_intr_ppc(struct megasas_register_set __iomem * regs)
  * @regs :			MFI register set
  */
 static inline void 
-megasas_fire_cmd_ppc(dma_addr_t frame_phys_addr, u32 frame_count, struct megasas_register_set __iomem *regs)
+megasas_fire_cmd_ppc(struct megasas_instance *instance,
+		dma_addr_t frame_phys_addr,
+		u32 frame_count,
+		struct megasas_register_set __iomem *regs)
 {
 	writel((frame_phys_addr | (frame_count<<1))|1, 
 			&(regs)->inbound_queue_port);
@@ -328,6 +345,104 @@ static struct megasas_instance_template megasas_instance_template_ppc = {
 };
 
 /**
+ * megasas_enable_intr_skinny -	Enables interrupts
+ * @regs:			MFI register set
+ */
+static inline void
+megasas_enable_intr_skinny(struct megasas_register_set __iomem *regs)
+{
+	writel(0xFFFFFFFF, &(regs)->outbound_intr_mask);
+
+	writel(~MFI_SKINNY_ENABLE_INTERRUPT_MASK, &(regs)->outbound_intr_mask);
+
+	/* Dummy readl to force pci flush */
+	readl(&regs->outbound_intr_mask);
+}
+
+/**
+ * megasas_disable_intr_skinny -	Disables interrupt
+ * @regs:			MFI register set
+ */
+static inline void
+megasas_disable_intr_skinny(struct megasas_register_set __iomem *regs)
+{
+	u32 mask = 0xFFFFFFFF;
+	writel(mask, &regs->outbound_intr_mask);
+	/* Dummy readl to force pci flush */
+	readl(&regs->outbound_intr_mask);
+}
+
+/**
+ * megasas_read_fw_status_reg_skinny - returns the current FW status value
+ * @regs:			MFI register set
+ */
+static u32
+megasas_read_fw_status_reg_skinny(struct megasas_register_set __iomem *regs)
+{
+	return readl(&(regs)->outbound_scratch_pad);
+}
+
+/**
+ * megasas_clear_interrupt_skinny -	Check & clear interrupt
+ * @regs:				MFI register set
+ */
+static int
+megasas_clear_intr_skinny(struct megasas_register_set __iomem *regs)
+{
+	u32 status;
+	/*
+	 * Check if it is our interrupt
+	 */
+	status = readl(&regs->outbound_intr_status);
+
+	if (!(status & MFI_SKINNY_ENABLE_INTERRUPT_MASK)) {
+		return 1;
+	}
+
+	/*
+	 * Clear the interrupt by writing back the same value
+	 */
+	writel(status, &regs->outbound_intr_status);
+
+	/*
+	* dummy read to flush PCI
+	*/
+	readl(&regs->outbound_intr_status);
+
+	return 0;
+}
+
+/**
+ * megasas_fire_cmd_skinny -	Sends command to the FW
+ * @frame_phys_addr :		Physical address of cmd
+ * @frame_count :		Number of frames for the command
+ * @regs :			MFI register set
+ */
+static inline void
+megasas_fire_cmd_skinny(struct megasas_instance *instance,
+			dma_addr_t frame_phys_addr,
+			u32 frame_count,
+			struct megasas_register_set __iomem *regs)
+{
+	unsigned long flags;
+	spin_lock_irqsave(&instance->fire_lock, flags);
+	writel(0, &(regs)->inbound_high_queue_port);
+	writel((frame_phys_addr | (frame_count<<1))|1,
+		&(regs)->inbound_low_queue_port);
+	spin_unlock_irqrestore(&instance->fire_lock, flags);
+}
+
+static struct megasas_instance_template megasas_instance_template_skinny = {
+
+	.fire_cmd = megasas_fire_cmd_skinny,
+	.enable_intr = megasas_enable_intr_skinny,
+	.disable_intr = megasas_disable_intr_skinny,
+	.clear_intr = megasas_clear_intr_skinny,
+	.read_fw_status_reg = megasas_read_fw_status_reg_skinny,
+};
+
+
+/**
 *	The following functions are defined for gen2 (deviceid : 0x78 0x79)
 *	controllers
 */
@@ -404,7 +519,9 @@ megasas_clear_intr_gen2(struct megasas_register_set __iomem *regs)
  * @regs :                     MFI register set
  */
 static inline void
-megasas_fire_cmd_gen2(dma_addr_t frame_phys_addr, u32 frame_count,
+megasas_fire_cmd_gen2(struct megasas_instance *instance,
+			dma_addr_t frame_phys_addr,
+			u32 frame_count,
 			struct megasas_register_set __iomem *regs)
 {
 	writel((frame_phys_addr | (frame_count<<1))|1,
@@ -446,7 +563,8 @@ megasas_issue_polled(struct megasas_instance *instance, struct megasas_cmd *cmd)
 	/*
 	 * Issue the frame using inbound queue port
 	 */
-	instance->instancet->fire_cmd(cmd->frame_phys_addr ,0,instance->reg_set);
+	instance->instancet->fire_cmd(instance,
+			cmd->frame_phys_addr, 0, instance->reg_set);
 
 	/*
 	 * Wait for cmd_status to change
@@ -477,7 +595,8 @@ megasas_issue_blocked_cmd(struct megasas_instance *instance,
 {
 	cmd->cmd_status = ENODATA;
 
-	instance->instancet->fire_cmd(cmd->frame_phys_addr ,0,instance->reg_set);
+	instance->instancet->fire_cmd(instance,
+			cmd->frame_phys_addr, 0, instance->reg_set);
 
 	wait_event_timeout(instance->int_cmd_wait_q, (cmd->cmd_status != ENODATA),
 		MEGASAS_INTERNAL_CMD_WAIT_TIME*HZ);
@@ -522,7 +641,8 @@ megasas_issue_blocked_abort_cmd(struct megasas_instance *instance,
 	cmd->sync_cmd = 1;
 	cmd->cmd_status = 0xFF;
 
-	instance->instancet->fire_cmd(cmd->frame_phys_addr ,0,instance->reg_set);
+	instance->instancet->fire_cmd(instance,
+			cmd->frame_phys_addr, 0, instance->reg_set);
 
 	/*
 	 * Wait for this cmd to complete
@@ -592,6 +712,35 @@ megasas_make_sgl64(struct megasas_instance *instance, struct scsi_cmnd *scp,
 	return sge_count;
 }
 
+/**
+ * megasas_make_sgl_skinny - Prepares IEEE SGL
+ * @instance:           Adapter soft state
+ * @scp:                SCSI command from the mid-layer
+ * @mfi_sgl:            SGL to be filled in
+ *
+ * If successful, this function returns the number of SG elements. Otherwise,
+ * it returnes -1.
+ */
+static int
+megasas_make_sgl_skinny(struct megasas_instance *instance,
+		struct scsi_cmnd *scp, union megasas_sgl *mfi_sgl)
+{
+	int i;
+	int sge_count;
+	struct scatterlist *os_sgl;
+
+	sge_count = scsi_dma_map(scp);
+
+	if (sge_count) {
+		scsi_for_each_sg(scp, os_sgl, sge_count, i) {
+			mfi_sgl->sge_skinny[i].length = sg_dma_len(os_sgl);
+			mfi_sgl->sge_skinny[i].phys_addr =
+						sg_dma_address(os_sgl);
+		}
+	}
+	return sge_count;
+}
+
  /**
  * megasas_get_frame_count - Computes the number of frames
  * @frame_type		: type of frame- io or pthru frame
@@ -600,7 +749,8 @@ megasas_make_sgl64(struct megasas_instance *instance, struct scsi_cmnd *scp,
  * Returns the number of frames required for numnber of sge's (sge_count)
  */
 
-static u32 megasas_get_frame_count(u8 sge_count, u8 frame_type)
+static u32 megasas_get_frame_count(struct megasas_instance *instance,
+			u8 sge_count, u8 frame_type)
 {
 	int num_cnt;
 	int sge_bytes;
@@ -610,6 +760,10 @@ static u32 megasas_get_frame_count(u8 sge_count, u8 frame_type)
 	sge_sz = (IS_DMA64) ? sizeof(struct megasas_sge64) :
 	    sizeof(struct megasas_sge32);
 
+	if (instance->flag_ieee) {
+		sge_sz = sizeof(struct megasas_sge_skinny);
+	}
+
 	/*
 	 * Main frame can contain 2 SGEs for 64-bit SGLs and
 	 * 3 SGEs for 32-bit SGLs for ldio &
@@ -617,12 +771,16 @@ static u32 megasas_get_frame_count(u8 sge_count, u8 frame_type)
 	 * 2 SGEs for 32-bit SGLs for pthru frame
 	 */
 	if (unlikely(frame_type == PTHRU_FRAME)) {
-		if (IS_DMA64)
+		if (instance->flag_ieee == 1) {
+			num_cnt = sge_count - 1;
+		} else if (IS_DMA64)
 			num_cnt = sge_count - 1;
 		else
 			num_cnt = sge_count - 2;
 	} else {
-		if (IS_DMA64)
+		if (instance->flag_ieee == 1) {
+			num_cnt = sge_count - 1;
+		} else if (IS_DMA64)
 			num_cnt = sge_count - 2;
 		else
 			num_cnt = sge_count - 3;
@@ -671,6 +829,10 @@ megasas_build_dcdb(struct megasas_instance *instance, struct scsi_cmnd *scp,
 	else if (scp->sc_data_direction == PCI_DMA_NONE)
 		flags = MFI_FRAME_DIR_NONE;
 
+	if (instance->flag_ieee == 1) {
+		flags |= MFI_FRAME_IEEE;
+	}
+
 	/*
 	 * Prepare the DCDB frame
 	 */
@@ -687,9 +849,24 @@ megasas_build_dcdb(struct megasas_instance *instance, struct scsi_cmnd *scp,
 	memcpy(pthru->cdb, scp->cmnd, scp->cmd_len);
 
 	/*
+	* If the command is for the tape device, set the
+	* pthru timeout to the os layer timeout value.
+	*/
+	if (scp->device->type == TYPE_TAPE) {
+		if ((scp->request->timeout / HZ) > 0xFFFF)
+			pthru->timeout = 0xFFFF;
+		else
+			pthru->timeout = scp->request->timeout / HZ;
+	}
+
+	/*
 	 * Construct SGL
 	 */
-	if (IS_DMA64) {
+	if (instance->flag_ieee == 1) {
+		pthru->flags |= MFI_FRAME_SGL64;
+		pthru->sge_count = megasas_make_sgl_skinny(instance, scp,
+						      &pthru->sgl);
+	} else if (IS_DMA64) {
 		pthru->flags |= MFI_FRAME_SGL64;
 		pthru->sge_count = megasas_make_sgl64(instance, scp,
 						      &pthru->sgl);
@@ -708,7 +885,7 @@ megasas_build_dcdb(struct megasas_instance *instance, struct scsi_cmnd *scp,
 	 * Compute the total number of frames this command consumes. FW uses
 	 * this number to pull sufficient number of frames from host memory.
 	 */
-	cmd->frame_count = megasas_get_frame_count(pthru->sge_count,
+	cmd->frame_count = megasas_get_frame_count(instance, pthru->sge_count,
 							PTHRU_FRAME);
 
 	return cmd->frame_count;
@@ -739,6 +916,10 @@ megasas_build_ldio(struct megasas_instance *instance, struct scsi_cmnd *scp,
 	else if (scp->sc_data_direction == PCI_DMA_FROMDEVICE)
 		flags = MFI_FRAME_DIR_READ;
 
+	if (instance->flag_ieee == 1) {
+		flags |= MFI_FRAME_IEEE;
+	}
+
 	/*
 	 * Prepare the Logical IO frame: 2nd bit is zero for all read cmds
 	 */
@@ -809,7 +990,11 @@ megasas_build_ldio(struct megasas_instance *instance, struct scsi_cmnd *scp,
 	/*
 	 * Construct SGL
 	 */
-	if (IS_DMA64) {
+	if (instance->flag_ieee) {
+		ldio->flags |= MFI_FRAME_SGL64;
+		ldio->sge_count = megasas_make_sgl_skinny(instance, scp,
+					      &ldio->sgl);
+	} else if (IS_DMA64) {
 		ldio->flags |= MFI_FRAME_SGL64;
 		ldio->sge_count = megasas_make_sgl64(instance, scp, &ldio->sgl);
 	} else
@@ -826,7 +1011,8 @@ megasas_build_ldio(struct megasas_instance *instance, struct scsi_cmnd *scp,
 	 * Compute the total number of frames this command consumes. FW uses
 	 * this number to pull sufficient number of frames from host memory.
 	 */
-	cmd->frame_count = megasas_get_frame_count(ldio->sge_count, IO_FRAME);
+	cmd->frame_count = megasas_get_frame_count(instance,
+			ldio->sge_count, IO_FRAME);
 
 	return cmd->frame_count;
 }
@@ -983,7 +1169,8 @@ megasas_queue_command(struct scsi_cmnd *scmd, void (*done) (struct scsi_cmnd *))
 	 */
 	atomic_inc(&instance->fw_outstanding);
 
-	instance->instancet->fire_cmd(cmd->frame_phys_addr ,cmd->frame_count-1,instance->reg_set);
+	instance->instancet->fire_cmd(instance, cmd->frame_phys_addr,
+				cmd->frame_count-1, instance->reg_set);
 	/*
 	 * Check if we have pend cmds to be completed
 	 */
@@ -1000,24 +1187,76 @@ megasas_queue_command(struct scsi_cmnd *scmd, void (*done) (struct scsi_cmnd *))
 	return 0;
 }
 
+static struct megasas_instance *megasas_lookup_instance(u16 host_no)
+{
+	int i;
+
+	for (i = 0; i < megasas_mgmt_info.max_index; i++) {
+
+		if ((megasas_mgmt_info.instance[i]) &&
+		    (megasas_mgmt_info.instance[i]->host->host_no == host_no))
+			return megasas_mgmt_info.instance[i];
+	}
+
+	return NULL;
+}
+
 static int megasas_slave_configure(struct scsi_device *sdev)
 {
+	u16             pd_index = 0;
+	struct  megasas_instance *instance ;
+
+	instance = megasas_lookup_instance(sdev->host->host_no);
+
 	/*
-	 * Don't export physical disk devices to the disk driver.
-	 *
-	 * FIXME: Currently we don't export them to the midlayer at all.
-	 * 	  That will be fixed once LSI engineers have audited the
-	 * 	  firmware for possible issues.
-	 */
-	if (sdev->channel < MEGASAS_MAX_PD_CHANNELS && sdev->type == TYPE_DISK)
+	* Don't export physical disk devices to the disk driver.
+	*
+	* FIXME: Currently we don't export them to the midlayer at all.
+	*        That will be fixed once LSI engineers have audited the
+	*        firmware for possible issues.
+	*/
+	if (sdev->channel < MEGASAS_MAX_PD_CHANNELS &&
+				sdev->type == TYPE_DISK) {
+		pd_index = (sdev->channel * MEGASAS_MAX_DEV_PER_CHANNEL) +
+								sdev->id;
+		if (instance->pd_list[pd_index].driveState ==
+						MR_PD_STATE_SYSTEM) {
+			blk_queue_rq_timeout(sdev->request_queue,
+				MEGASAS_DEFAULT_CMD_TIMEOUT * HZ);
+			return 0;
+		}
 		return -ENXIO;
+	}
 
 	/*
-	 * The RAID firmware may require extended timeouts.
-	 */
-	if (sdev->channel >= MEGASAS_MAX_PD_CHANNELS)
-		blk_queue_rq_timeout(sdev->request_queue,
-				     MEGASAS_DEFAULT_CMD_TIMEOUT * HZ);
+	* The RAID firmware may require extended timeouts.
+	*/
+	blk_queue_rq_timeout(sdev->request_queue,
+		MEGASAS_DEFAULT_CMD_TIMEOUT * HZ);
+	return 0;
+}
+
+static int megasas_slave_alloc(struct scsi_device *sdev)
+{
+	u16             pd_index = 0;
+	struct megasas_instance *instance ;
+	instance = megasas_lookup_instance(sdev->host->host_no);
+	if ((sdev->channel < MEGASAS_MAX_PD_CHANNELS) &&
+				(sdev->type == TYPE_DISK)) {
+		/*
+		 * Open the OS scan to the SYSTEM PD
+		 */
+		pd_index =
+			(sdev->channel * MEGASAS_MAX_DEV_PER_CHANNEL) +
+			sdev->id;
+		if ((instance->pd_list[pd_index].driveState ==
+					MR_PD_STATE_SYSTEM) &&
+			(instance->pd_list[pd_index].driveType ==
+						TYPE_DISK)) {
+			return 0;
+		}
+		return -ENXIO;
+	}
 	return 0;
 }
 
@@ -1072,7 +1311,14 @@ static void megasas_complete_cmd_dpc(unsigned long instance_addr)
 
 		spin_lock_irqsave(instance->host->host_lock, flags);
 		instance->flag &= ~MEGASAS_FW_BUSY;
-		instance->host->can_queue =
+		if ((instance->pdev->device ==
+			PCI_DEVICE_ID_LSI_SAS0073SKINNY) ||
+			(instance->pdev->device ==
+			PCI_DEVICE_ID_LSI_SAS0071SKINNY)) {
+			instance->host->can_queue =
+				instance->max_fw_cmds - MEGASAS_SKINNY_INT_CMDS;
+		} else
+			instance->host->can_queue =
 				instance->max_fw_cmds - MEGASAS_INT_CMDS;
 
 		spin_unlock_irqrestore(instance->host->host_lock, flags);
@@ -1117,8 +1363,16 @@ static int megasas_wait_for_outstanding(struct megasas_instance *instance)
 		* Send signal to FW to stop processing any pending cmds.
 		* The controller will be taken offline by the OS now.
 		*/
-		writel(MFI_STOP_ADP,
+		if ((instance->pdev->device ==
+			PCI_DEVICE_ID_LSI_SAS0073SKINNY) ||
+			(instance->pdev->device ==
+			PCI_DEVICE_ID_LSI_SAS0071SKINNY)) {
+			writel(MFI_STOP_ADP,
+				&instance->reg_set->reserved_0[0]);
+		} else {
+			writel(MFI_STOP_ADP,
 				&instance->reg_set->inbound_doorbell);
+		}
 		megasas_dump_pending_frames(instance);
 		instance->hw_crit_error = 1;
 		return FAILED;
@@ -1266,6 +1520,8 @@ megasas_bios_param(struct scsi_device *sdev, struct block_device *bdev,
 	return 0;
 }
 
+static void megasas_aen_polling(struct work_struct *work);
+
 /**
  * megasas_service_aen -	Processes an event notification
  * @instance:			Adapter soft state
@@ -1281,16 +1537,36 @@ megasas_bios_param(struct scsi_device *sdev, struct block_device *bdev,
 static void
 megasas_service_aen(struct megasas_instance *instance, struct megasas_cmd *cmd)
 {
+	unsigned long flags;
 	/*
 	 * Don't signal app if it is just an aborted previously registered aen
 	 */
-	if (!cmd->abort_aen)
+	if ((!cmd->abort_aen) && (instance->unload == 0)) {
+		spin_lock_irqsave(&poll_aen_lock, flags);
+		megasas_poll_wait_aen = 1;
+		spin_unlock_irqrestore(&poll_aen_lock, flags);
+		wake_up(&megasas_poll_wait);
 		kill_fasync(&megasas_async_queue, SIGIO, POLL_IN);
+	}
 	else
 		cmd->abort_aen = 0;
 
 	instance->aen_cmd = NULL;
 	megasas_return_cmd(instance, cmd);
+
+	if (instance->unload == 0) {
+		struct megasas_aen_event *ev;
+		ev = kzalloc(sizeof(*ev), GFP_ATOMIC);
+		if (!ev) {
+			printk(KERN_ERR "megasas_service_aen: out of memory\n");
+		} else {
+			ev->instance = instance;
+			instance->ev = ev;
+			INIT_WORK(&ev->hotplug_work, megasas_aen_polling);
+			schedule_delayed_work(
+				(struct delayed_work *)&ev->hotplug_work, 0);
+		}
+	}
 }
 
 /*
@@ -1302,6 +1578,7 @@ static struct scsi_host_template megasas_template = {
 	.name = "LSI SAS based MegaRAID driver",
 	.proc_name = "megaraid_sas",
 	.slave_configure = megasas_slave_configure,
+	.slave_alloc = megasas_slave_alloc,
 	.queuecommand = megasas_queue_command,
 	.eh_device_reset_handler = megasas_reset_device,
 	.eh_bus_reset_handler = megasas_reset_bus_host,
@@ -1370,6 +1647,7 @@ megasas_complete_cmd(struct megasas_instance *instance, struct megasas_cmd *cmd,
 {
 	int exception = 0;
 	struct megasas_header *hdr = &cmd->frame->hdr;
+	unsigned long flags;
 
 	if (cmd->scmd)
 		cmd->scmd->SCp.ptr = NULL;
@@ -1459,6 +1737,12 @@ megasas_complete_cmd(struct megasas_instance *instance, struct megasas_cmd *cmd,
 	case MFI_CMD_SMP:
 	case MFI_CMD_STP:
 	case MFI_CMD_DCMD:
+		if (cmd->frame->dcmd.opcode == MR_DCMD_CTRL_EVENT_GET_INFO ||
+			cmd->frame->dcmd.opcode == MR_DCMD_CTRL_EVENT_GET) {
+			spin_lock_irqsave(&poll_aen_lock, flags);
+			megasas_poll_wait_aen = 0;
+			spin_unlock_irqrestore(&poll_aen_lock, flags);
+		}
 
 		/*
 		 * See if got an event notification
@@ -1536,6 +1820,7 @@ megasas_transition_to_ready(struct megasas_instance* instance)
 	u8 max_wait;
 	u32 fw_state;
 	u32 cur_state;
+	u32 abs_state, curr_abs_state;
 
 	fw_state = instance->instancet->read_fw_status_reg(instance->reg_set) & MFI_STATE_MASK;
 
@@ -1545,6 +1830,9 @@ megasas_transition_to_ready(struct megasas_instance* instance)
 
 	while (fw_state != MFI_STATE_READY) {
 
+		abs_state =
+		instance->instancet->read_fw_status_reg(instance->reg_set);
+
 		switch (fw_state) {
 
 		case MFI_STATE_FAULT:
@@ -1556,18 +1844,36 @@ megasas_transition_to_ready(struct megasas_instance* instance)
 			/*
 			 * Set the CLR bit in inbound doorbell
 			 */
-			writel(MFI_INIT_CLEAR_HANDSHAKE|MFI_INIT_HOTPLUG,
-				&instance->reg_set->inbound_doorbell);
+			if ((instance->pdev->device ==
+				PCI_DEVICE_ID_LSI_SAS0073SKINNY) ||
+				(instance->pdev->device ==
+				PCI_DEVICE_ID_LSI_SAS0071SKINNY)) {
+
+				writel(
+				  MFI_INIT_CLEAR_HANDSHAKE|MFI_INIT_HOTPLUG,
+				  &instance->reg_set->reserved_0[0]);
+			} else {
+				writel(
+				    MFI_INIT_CLEAR_HANDSHAKE|MFI_INIT_HOTPLUG,
+					&instance->reg_set->inbound_doorbell);
+			}
 
-			max_wait = 2;
+			max_wait = MEGASAS_RESET_WAIT_TIME;
 			cur_state = MFI_STATE_WAIT_HANDSHAKE;
 			break;
 
 		case MFI_STATE_BOOT_MESSAGE_PENDING:
-			writel(MFI_INIT_HOTPLUG,
-				&instance->reg_set->inbound_doorbell);
+			if ((instance->pdev->device ==
+				PCI_DEVICE_ID_LSI_SAS0073SKINNY) ||
+			(instance->pdev->device ==
+				PCI_DEVICE_ID_LSI_SAS0071SKINNY)) {
+				writel(MFI_INIT_HOTPLUG,
+				&instance->reg_set->reserved_0[0]);
+			} else
+				writel(MFI_INIT_HOTPLUG,
+					&instance->reg_set->inbound_doorbell);
 
-			max_wait = 10;
+			max_wait = MEGASAS_RESET_WAIT_TIME;
 			cur_state = MFI_STATE_BOOT_MESSAGE_PENDING;
 			break;
 
@@ -1576,9 +1882,17 @@ megasas_transition_to_ready(struct megasas_instance* instance)
 			 * Bring it to READY state; assuming max wait 10 secs
 			 */
 			instance->instancet->disable_intr(instance->reg_set);
-			writel(MFI_RESET_FLAGS, &instance->reg_set->inbound_doorbell);
+			if ((instance->pdev->device ==
+				PCI_DEVICE_ID_LSI_SAS0073SKINNY) ||
+				(instance->pdev->device ==
+				PCI_DEVICE_ID_LSI_SAS0071SKINNY)) {
+				writel(MFI_RESET_FLAGS,
+					&instance->reg_set->reserved_0[0]);
+			} else
+				writel(MFI_RESET_FLAGS,
+					&instance->reg_set->inbound_doorbell);
 
-			max_wait = 60;
+			max_wait = MEGASAS_RESET_WAIT_TIME;
 			cur_state = MFI_STATE_OPERATIONAL;
 			break;
 
@@ -1586,32 +1900,32 @@ megasas_transition_to_ready(struct megasas_instance* instance)
 			/*
 			 * This state should not last for more than 2 seconds
 			 */
-			max_wait = 2;
+			max_wait = MEGASAS_RESET_WAIT_TIME;
 			cur_state = MFI_STATE_UNDEFINED;
 			break;
 
 		case MFI_STATE_BB_INIT:
-			max_wait = 2;
+			max_wait = MEGASAS_RESET_WAIT_TIME;
 			cur_state = MFI_STATE_BB_INIT;
 			break;
 
 		case MFI_STATE_FW_INIT:
-			max_wait = 20;
+			max_wait = MEGASAS_RESET_WAIT_TIME;
 			cur_state = MFI_STATE_FW_INIT;
 			break;
 
 		case MFI_STATE_FW_INIT_2:
-			max_wait = 20;
+			max_wait = MEGASAS_RESET_WAIT_TIME;
 			cur_state = MFI_STATE_FW_INIT_2;
 			break;
 
 		case MFI_STATE_DEVICE_SCAN:
-			max_wait = 20;
+			max_wait = MEGASAS_RESET_WAIT_TIME;
 			cur_state = MFI_STATE_DEVICE_SCAN;
 			break;
 
 		case MFI_STATE_FLUSH_CACHE:
-			max_wait = 20;
+			max_wait = MEGASAS_RESET_WAIT_TIME;
 			cur_state = MFI_STATE_FLUSH_CACHE;
 			break;
 
@@ -1627,8 +1941,10 @@ megasas_transition_to_ready(struct megasas_instance* instance)
 		for (i = 0; i < (max_wait * 1000); i++) {
 			fw_state = instance->instancet->read_fw_status_reg(instance->reg_set) &  
 					MFI_STATE_MASK ;
+		curr_abs_state =
+		instance->instancet->read_fw_status_reg(instance->reg_set);
 
-			if (fw_state == cur_state) {
+			if (abs_state == curr_abs_state) {
 				msleep(1);
 			} else
 				break;
@@ -1637,7 +1953,7 @@ megasas_transition_to_ready(struct megasas_instance* instance)
 		/*
 		 * Return error if fw_state hasn't changed after max_wait
 		 */
-		if (fw_state == cur_state) {
+		if (curr_abs_state == abs_state) {
 			printk(KERN_DEBUG "FW state [%d] hasn't changed "
 			       "in %d secs\n", fw_state, max_wait);
 			return -ENODEV;
@@ -1715,6 +2031,10 @@ static int megasas_create_frame_pool(struct megasas_instance *instance)
 	sge_sz = (IS_DMA64) ? sizeof(struct megasas_sge64) :
 	    sizeof(struct megasas_sge32);
 
+	if (instance->flag_ieee) {
+		sge_sz = sizeof(struct megasas_sge_skinny);
+	}
+
 	/*
 	 * Calculated the number of 64byte frames required for SGL
 	 */
@@ -1777,6 +2097,7 @@ static int megasas_create_frame_pool(struct megasas_instance *instance)
 		}
 
 		cmd->frame->io.context = cmd->index;
+		cmd->frame->io.pad_0 = 0;
 	}
 
 	return 0;
@@ -1882,6 +2203,97 @@ static int megasas_alloc_cmds(struct megasas_instance *instance)
 	return 0;
 }
 
+/*
+ * megasas_get_pd_list_info -	Returns FW's pd_list structure
+ * @instance:				Adapter soft state
+ * @pd_list:				pd_list structure
+ *
+ * Issues an internal command (DCMD) to get the FW's controller PD
+ * list structure.  This information is mainly used to find out SYSTEM
+ * supported by the FW.
+ */
+static int
+megasas_get_pd_list(struct megasas_instance *instance)
+{
+	int ret = 0, pd_index = 0;
+	struct megasas_cmd *cmd;
+	struct megasas_dcmd_frame *dcmd;
+	struct MR_PD_LIST *ci;
+	struct MR_PD_ADDRESS *pd_addr;
+	dma_addr_t ci_h = 0;
+
+	cmd = megasas_get_cmd(instance);
+
+	if (!cmd) {
+		printk(KERN_DEBUG "megasas (get_pd_list): Failed to get cmd\n");
+		return -ENOMEM;
+	}
+
+	dcmd = &cmd->frame->dcmd;
+
+	ci = pci_alloc_consistent(instance->pdev,
+		  MEGASAS_MAX_PD * sizeof(struct MR_PD_LIST), &ci_h);
+
+	if (!ci) {
+		printk(KERN_DEBUG "Failed to alloc mem for pd_list\n");
+		megasas_return_cmd(instance, cmd);
+		return -ENOMEM;
+	}
+
+	memset(ci, 0, sizeof(*ci));
+	memset(dcmd->mbox.b, 0, MFI_MBOX_SIZE);
+
+	dcmd->mbox.b[0] = MR_PD_QUERY_TYPE_EXPOSED_TO_HOST;
+	dcmd->mbox.b[1] = 0;
+	dcmd->cmd = MFI_CMD_DCMD;
+	dcmd->cmd_status = 0xFF;
+	dcmd->sge_count = 1;
+	dcmd->flags = MFI_FRAME_DIR_READ;
+	dcmd->timeout = 0;
+	dcmd->data_xfer_len = MEGASAS_MAX_PD * sizeof(struct MR_PD_LIST);
+	dcmd->opcode = MR_DCMD_PD_LIST_QUERY;
+	dcmd->sgl.sge32[0].phys_addr = ci_h;
+	dcmd->sgl.sge32[0].length = MEGASAS_MAX_PD * sizeof(struct MR_PD_LIST);
+
+	if (!megasas_issue_polled(instance, cmd)) {
+		ret = 0;
+	} else {
+		ret = -1;
+	}
+
+	/*
+	* the following function will get the instance PD LIST.
+	*/
+
+	pd_addr = ci->addr;
+
+	if ( ret == 0 &&
+		(ci->count <
+		  (MEGASAS_MAX_PD_CHANNELS * MEGASAS_MAX_DEV_PER_CHANNEL))) {
+
+		memset(instance->pd_list, 0,
+			MEGASAS_MAX_PD * sizeof(struct megasas_pd_list));
+
+		for (pd_index = 0; pd_index < ci->count; pd_index++) {
+
+			instance->pd_list[pd_addr->deviceId].tid	=
+							pd_addr->deviceId;
+			instance->pd_list[pd_addr->deviceId].driveType	=
+							pd_addr->scsiDevType;
+			instance->pd_list[pd_addr->deviceId].driveState	=
+							MR_PD_STATE_SYSTEM;
+			pd_addr++;
+		}
+	}
+
+	pci_free_consistent(instance->pdev,
+				MEGASAS_MAX_PD * sizeof(struct MR_PD_LIST),
+				ci, ci_h);
+	megasas_return_cmd(instance, cmd);
+
+	return ret;
+}
+
 /**
  * megasas_get_controller_info -	Returns FW's controller structure
  * @instance:				Adapter soft state
@@ -2081,13 +2493,17 @@ static int megasas_init_mfi(struct megasas_instance *instance)
 	 * Map the message registers
 	 */
 	if ((instance->pdev->device == PCI_DEVICE_ID_LSI_SAS1078GEN2) ||
+		(instance->pdev->device == PCI_DEVICE_ID_LSI_SAS0071SKINNY) ||
+		(instance->pdev->device == PCI_DEVICE_ID_LSI_SAS0073SKINNY) ||
 		(instance->pdev->device == PCI_DEVICE_ID_LSI_SAS0079GEN2)) {
 		instance->base_addr = pci_resource_start(instance->pdev, 1);
 	} else {
 		instance->base_addr = pci_resource_start(instance->pdev, 0);
 	}
 
-	if (pci_request_regions(instance->pdev, "megasas: LSI")) {
+	if (pci_request_selected_regions(instance->pdev,
+		pci_select_bars(instance->pdev, IORESOURCE_MEM),
+		"megasas: LSI")) {
 		printk(KERN_DEBUG "megasas: IO memory region busy!\n");
 		return -EBUSY;
 	}
@@ -2111,6 +2527,10 @@ static int megasas_init_mfi(struct megasas_instance *instance)
 		case PCI_DEVICE_ID_LSI_SAS0079GEN2:
 			instance->instancet = &megasas_instance_template_gen2;
 			break;
+		case PCI_DEVICE_ID_LSI_SAS0073SKINNY:
+		case PCI_DEVICE_ID_LSI_SAS0071SKINNY:
+			instance->instancet = &megasas_instance_template_skinny;
+			break;
 		case PCI_DEVICE_ID_LSI_SAS1064R:
 		case PCI_DEVICE_ID_DELL_PERC5:
 		default:
@@ -2166,6 +2586,10 @@ static int megasas_init_mfi(struct megasas_instance *instance)
 	if (megasas_issue_init_mfi(instance))
 		goto fail_fw_init;
 
+	memset(instance->pd_list, 0 ,
+		(MEGASAS_MAX_PD * sizeof(struct megasas_pd_list)));
+	megasas_get_pd_list(instance);
+
 	ctrl_info = kmalloc(sizeof(struct megasas_ctrl_info), GFP_KERNEL);
 
 	/*
@@ -2220,7 +2644,8 @@ static int megasas_init_mfi(struct megasas_instance *instance)
 	iounmap(instance->reg_set);
 
       fail_ioremap:
-	pci_release_regions(instance->pdev);
+	pci_release_selected_regions(instance->pdev,
+		pci_select_bars(instance->pdev, IORESOURCE_MEM));
 
 	return -EINVAL;
 }
@@ -2240,7 +2665,8 @@ static void megasas_release_mfi(struct megasas_instance *instance)
 
 	iounmap(instance->reg_set);
 
-	pci_release_regions(instance->pdev);
+	pci_release_selected_regions(instance->pdev,
+		pci_select_bars(instance->pdev, IORESOURCE_MEM));
 }
 
 /**
@@ -2409,6 +2835,11 @@ megasas_register_aen(struct megasas_instance *instance, u32 seq_num,
 	dcmd->sgl.sge32[0].phys_addr = (u32) instance->evt_detail_h;
 	dcmd->sgl.sge32[0].length = sizeof(struct megasas_evt_detail);
 
+	if (instance->aen_cmd != NULL) {
+		megasas_return_cmd(instance, cmd);
+		return 0;
+	}
+
 	/*
 	 * Store reference to the cmd used to register for AEN. When an
 	 * application wants us to register for AEN, we have to abort this
@@ -2419,7 +2850,8 @@ megasas_register_aen(struct megasas_instance *instance, u32 seq_num,
 	/*
 	 * Issue the aen registration frame
 	 */
-	instance->instancet->fire_cmd(cmd->frame_phys_addr ,0,instance->reg_set);
+	instance->instancet->fire_cmd(instance,
+			cmd->frame_phys_addr, 0, instance->reg_set);
 
 	return 0;
 }
@@ -2465,7 +2897,13 @@ static int megasas_io_attach(struct megasas_instance *instance)
 	 */
 	host->irq = instance->pdev->irq;
 	host->unique_id = instance->unique_id;
-	host->can_queue = instance->max_fw_cmds - MEGASAS_INT_CMDS;
+	if ((instance->pdev->device == PCI_DEVICE_ID_LSI_SAS0073SKINNY) ||
+		(instance->pdev->device == PCI_DEVICE_ID_LSI_SAS0071SKINNY)) {
+		host->can_queue =
+			instance->max_fw_cmds - MEGASAS_SKINNY_INT_CMDS;
+	} else
+		host->can_queue =
+			instance->max_fw_cmds - MEGASAS_INT_CMDS;
 	host->this_id = instance->init_id;
 	host->sg_tablesize = instance->max_num_sge;
 	host->max_sectors = instance->max_sectors_per_req;
@@ -2537,7 +2975,7 @@ megasas_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
 	/*
 	 * PCI prepping: enable device set bus mastering and dma mask
 	 */
-	rval = pci_enable_device(pdev);
+	rval = pci_enable_device_mem(pdev);
 
 	if (rval) {
 		return rval;
@@ -2572,6 +3010,9 @@ megasas_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
 
 	*instance->producer = 0;
 	*instance->consumer = 0;
+	megasas_poll_wait_aen = 0;
+	instance->flag_ieee = 0;
+	instance->ev = NULL;
 
 	instance->evt_detail = pci_alloc_consistent(pdev,
 						    sizeof(struct
@@ -2595,10 +3036,11 @@ megasas_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
 	init_waitqueue_head(&instance->abort_cmd_wait_q);
 
 	spin_lock_init(&instance->cmd_pool_lock);
+	spin_lock_init(&instance->fire_lock);
 	spin_lock_init(&instance->completion_lock);
+	spin_lock_init(&poll_aen_lock);
 
 	mutex_init(&instance->aen_mutex);
-	sema_init(&instance->ioctl_sem, MEGASAS_INT_CMDS);
 
 	/*
 	 * Initialize PCI related and misc parameters
@@ -2608,8 +3050,16 @@ megasas_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
 	instance->unique_id = pdev->bus->number << 8 | pdev->devfn;
 	instance->init_id = MEGASAS_DEFAULT_INIT_ID;
 
+	if ((instance->pdev->device == PCI_DEVICE_ID_LSI_SAS0073SKINNY) ||
+		(instance->pdev->device == PCI_DEVICE_ID_LSI_SAS0071SKINNY)) {
+		instance->flag_ieee = 1;
+		sema_init(&instance->ioctl_sem, MEGASAS_SKINNY_INT_CMDS);
+	} else
+		sema_init(&instance->ioctl_sem, MEGASAS_INT_CMDS);
+
 	megasas_dbg_lvl = 0;
 	instance->flag = 0;
+	instance->unload = 1;
 	instance->last_time = 0;
 
 	/*
@@ -2655,6 +3105,7 @@ megasas_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
 	if (megasas_io_attach(instance))
 		goto fail_io_attach;
 
+	instance->unload = 0;
 	return 0;
 
       fail_start_aen:
@@ -2778,12 +3229,23 @@ megasas_suspend(struct pci_dev *pdev, pm_message_t state)
 
 	instance = pci_get_drvdata(pdev);
 	host = instance->host;
+	instance->unload = 1;
 
 	if (poll_mode_io)
 		del_timer_sync(&instance->io_completion_timer);
 
 	megasas_flush_cache(instance);
 	megasas_shutdown_controller(instance, MR_DCMD_HIBERNATE_SHUTDOWN);
+
+	/* cancel the delayed work if this work still in queue */
+	if (instance->ev != NULL) {
+		struct megasas_aen_event *ev = instance->ev;
+		cancel_delayed_work(
+			(struct delayed_work *)&ev->hotplug_work);
+		flush_scheduled_work();
+		instance->ev = NULL;
+	}
+
 	tasklet_kill(&instance->isr_tasklet);
 
 	pci_set_drvdata(instance->pdev, instance);
@@ -2818,7 +3280,7 @@ megasas_resume(struct pci_dev *pdev)
 	/*
 	 * PCI prepping: enable device set bus mastering and dma mask
 	 */
-	rval = pci_enable_device(pdev);
+	rval = pci_enable_device_mem(pdev);
 
 	if (rval) {
 		printk(KERN_ERR "megasas: Enable device failed\n");
@@ -2873,6 +3335,8 @@ megasas_resume(struct pci_dev *pdev)
 		megasas_start_timer(instance, &instance->io_completion_timer,
 				megasas_io_completion_timer,
 				MEGASAS_COMPLETION_TIMER_INTERVAL);
+	instance->unload = 0;
+
 	return 0;
 
 fail_irq:
@@ -2913,6 +3377,7 @@ static void __devexit megasas_detach_one(struct pci_dev *pdev)
 	struct megasas_instance *instance;
 
 	instance = pci_get_drvdata(pdev);
+	instance->unload = 1;
 	host = instance->host;
 
 	if (poll_mode_io)
@@ -2921,6 +3386,16 @@ static void __devexit megasas_detach_one(struct pci_dev *pdev)
 	scsi_remove_host(instance->host);
 	megasas_flush_cache(instance);
 	megasas_shutdown_controller(instance, MR_DCMD_CTRL_SHUTDOWN);
+
+	/* cancel the delayed work if this work still in queue*/
+	if (instance->ev != NULL) {
+		struct megasas_aen_event *ev = instance->ev;
+		cancel_delayed_work(
+			(struct delayed_work *)&ev->hotplug_work);
+		flush_scheduled_work();
+		instance->ev = NULL;
+	}
+
 	tasklet_kill(&instance->isr_tasklet);
 
 	/*
@@ -2969,6 +3444,7 @@ static void __devexit megasas_detach_one(struct pci_dev *pdev)
 static void megasas_shutdown(struct pci_dev *pdev)
 {
 	struct megasas_instance *instance = pci_get_drvdata(pdev);
+	instance->unload = 1;
 	megasas_flush_cache(instance);
 	megasas_shutdown_controller(instance, MR_DCMD_CTRL_SHUTDOWN);
 }
@@ -3016,6 +3492,23 @@ static int megasas_mgmt_fasync(int fd, struct file *filep, int mode)
 }
 
 /**
+ * megasas_mgmt_poll -  char node "poll" entry point
+ * */
+static unsigned int megasas_mgmt_poll(struct file *file, poll_table *wait)
+{
+	unsigned int mask;
+	unsigned long flags;
+	poll_wait(file, &megasas_poll_wait, wait);
+	spin_lock_irqsave(&poll_aen_lock, flags);
+	if (megasas_poll_wait_aen)
+		mask =   (POLLIN | POLLRDNORM);
+	else
+		mask = 0;
+	spin_unlock_irqrestore(&poll_aen_lock, flags);
+	return mask;
+}
+
+/**
  * megasas_mgmt_fw_ioctl -	Issues management ioctls to FW
  * @instance:			Adapter soft state
  * @argp:			User's ioctl packet
@@ -3032,7 +3525,7 @@ megasas_mgmt_fw_ioctl(struct megasas_instance *instance,
 	int error = 0, i;
 	void *sense = NULL;
 	dma_addr_t sense_handle;
-	u32 *sense_ptr;
+	unsigned long *sense_ptr;
 
 	memset(kbuff_arr, 0, sizeof(kbuff_arr));
 
@@ -3056,6 +3549,7 @@ megasas_mgmt_fw_ioctl(struct megasas_instance *instance,
 	 */
 	memcpy(cmd->frame, ioc->frame.raw, 2 * MEGAMFI_FRAME_SIZE);
 	cmd->frame->hdr.context = cmd->index;
+	cmd->frame->hdr.pad_0 = 0;
 
 	/*
 	 * The management interface between applications and the fw uses
@@ -3109,7 +3603,7 @@ megasas_mgmt_fw_ioctl(struct megasas_instance *instance,
 		}
 
 		sense_ptr =
-		    (u32 *) ((unsigned long)cmd->frame + ioc->sense_off);
+		(unsigned long *) ((unsigned long)cmd->frame + ioc->sense_off);
 		*sense_ptr = sense_handle;
 	}
 
@@ -3140,8 +3634,8 @@ megasas_mgmt_fw_ioctl(struct megasas_instance *instance,
 		 * sense_ptr points to the location that has the user
 		 * sense buffer address
 		 */
-		sense_ptr = (u32 *) ((unsigned long)ioc->frame.raw +
-				     ioc->sense_off);
+		sense_ptr = (unsigned long *) ((unsigned long)ioc->frame.raw +
+				ioc->sense_off);
 
 		if (copy_to_user((void __user *)((unsigned long)(*sense_ptr)),
 				 sense, ioc->sense_len)) {
@@ -3177,20 +3671,6 @@ megasas_mgmt_fw_ioctl(struct megasas_instance *instance,
 	return error;
 }
 
-static struct megasas_instance *megasas_lookup_instance(u16 host_no)
-{
-	int i;
-
-	for (i = 0; i < megasas_mgmt_info.max_index; i++) {
-
-		if ((megasas_mgmt_info.instance[i]) &&
-		    (megasas_mgmt_info.instance[i]->host->host_no == host_no))
-			return megasas_mgmt_info.instance[i];
-	}
-
-	return NULL;
-}
-
 static int megasas_mgmt_ioctl_fw(struct file *file, unsigned long arg)
 {
 	struct megasas_iocpacket __user *user_ioc =
@@ -3214,6 +3694,17 @@ static int megasas_mgmt_ioctl_fw(struct file *file, unsigned long arg)
 		goto out_kfree_ioc;
 	}
 
+	if (instance->hw_crit_error == 1) {
+		printk(KERN_DEBUG "Controller in Crit ERROR\n");
+		error = -ENODEV;
+		goto out_kfree_ioc;
+	}
+
+	if (instance->unload == 1) {
+		error = -ENODEV;
+		goto out_kfree_ioc;
+	}
+
 	/*
 	 * We will allow only MEGASAS_INT_CMDS number of parallel ioctl cmds
 	 */
@@ -3249,6 +3740,14 @@ static int megasas_mgmt_ioctl_aen(struct file *file, unsigned long arg)
 	if (!instance)
 		return -ENODEV;
 
+	if (instance->hw_crit_error == 1) {
+		error = -ENODEV;
+	}
+
+	if (instance->unload == 1) {
+		return -ENODEV;
+	}
+
 	mutex_lock(&instance->aen_mutex);
 	error = megasas_register_aen(instance, aen.seq_num,
 				     aen.class_locale_word);
@@ -3337,6 +3836,7 @@ static const struct file_operations megasas_mgmt_fops = {
 	.open = megasas_mgmt_open,
 	.fasync = megasas_mgmt_fasync,
 	.unlocked_ioctl = megasas_mgmt_ioctl,
+	.poll = megasas_mgmt_poll,
 #ifdef CONFIG_COMPAT
 	.compat_ioctl = megasas_mgmt_compat_ioctl,
 #endif
@@ -3378,6 +3878,15 @@ static DRIVER_ATTR(release_date, S_IRUGO, megasas_sysfs_show_release_date,
 		   NULL);
 
 static ssize_t
+megasas_sysfs_show_support_poll_for_event(struct device_driver *dd, char *buf)
+{
+	return sprintf(buf, "%u\n", support_poll_for_event);
+}
+
+static DRIVER_ATTR(support_poll_for_event, S_IRUGO,
+			megasas_sysfs_show_support_poll_for_event, NULL);
+
+static ssize_t
 megasas_sysfs_show_dbg_lvl(struct device_driver *dd, char *buf)
 {
 	return sprintf(buf, "%u\n", megasas_dbg_lvl);
@@ -3451,7 +3960,93 @@ out:
 	return retval;
 }
 
-static DRIVER_ATTR(poll_mode_io, S_IRUGO|S_IWUGO,
+static void
+megasas_aen_polling(struct work_struct *work)
+{
+	struct megasas_aen_event *ev =
+		container_of(work, struct megasas_aen_event, hotplug_work);
+	struct megasas_instance *instance = ev->instance;
+	union megasas_evt_class_locale class_locale;
+	struct  Scsi_Host *host;
+	struct  scsi_device *sdev1;
+	u16     pd_index = 0;
+	int     i, j, doscan = 0;
+	u32 seq_num;
+	int error;
+
+	if (!instance) {
+		printk(KERN_ERR "invalid instance!\n");
+		kfree(ev);
+		return;
+	}
+	instance->ev = NULL;
+	host = instance->host;
+	if (instance->evt_detail) {
+
+		switch (instance->evt_detail->code) {
+		case MR_EVT_PD_INSERTED:
+		case MR_EVT_PD_REMOVED:
+		case MR_EVT_CTRL_HOST_BUS_SCAN_REQUESTED:
+			doscan = 1;
+			break;
+		default:
+			doscan = 0;
+			break;
+		}
+	} else {
+		printk(KERN_ERR "invalid evt_detail!\n");
+		kfree(ev);
+		return;
+	}
+
+	if (doscan) {
+		printk(KERN_INFO "scanning ...\n");
+		megasas_get_pd_list(instance);
+		for (i = 0; i < MEGASAS_MAX_PD_CHANNELS; i++) {
+			for (j = 0; j < MEGASAS_MAX_DEV_PER_CHANNEL; j++) {
+				pd_index = i*MEGASAS_MAX_DEV_PER_CHANNEL + j;
+				sdev1 = scsi_device_lookup(host, i, j, 0);
+				if (instance->pd_list[pd_index].driveState ==
+							MR_PD_STATE_SYSTEM) {
+					if (!sdev1) {
+						scsi_add_device(host, i, j, 0);
+					}
+					if (sdev1)
+						scsi_device_put(sdev1);
+				} else {
+					if (sdev1) {
+						scsi_remove_device(sdev1);
+						scsi_device_put(sdev1);
+					}
+				}
+			}
+		}
+	}
+
+	if ( instance->aen_cmd != NULL ) {
+		kfree(ev);
+		return ;
+	}
+
+	seq_num = instance->evt_detail->seq_num + 1;
+
+	/* Register AEN with FW for latest sequence number plus 1 */
+	class_locale.members.reserved = 0;
+	class_locale.members.locale = MR_EVT_LOCALE_ALL;
+	class_locale.members.class = MR_EVT_CLASS_DEBUG;
+	mutex_lock(&instance->aen_mutex);
+	error = megasas_register_aen(instance, seq_num,
+					class_locale.word);
+	mutex_unlock(&instance->aen_mutex);
+
+	if (error)
+		printk(KERN_ERR "register aen failed error %x\n", error);
+
+	kfree(ev);
+}
+
+
+static DRIVER_ATTR(poll_mode_io, S_IRUGO|S_IWUSR,
 		megasas_sysfs_show_poll_mode_io,
 		megasas_sysfs_set_poll_mode_io);
 
@@ -3468,6 +4063,8 @@ static int __init megasas_init(void)
 	printk(KERN_INFO "megasas: %s %s\n", MEGASAS_VERSION,
 	       MEGASAS_EXT_VERSION);
 
+	support_poll_for_event = 2;
+
 	memset(&megasas_mgmt_info, 0, sizeof(megasas_mgmt_info));
 
 	/*
@@ -3500,6 +4097,12 @@ static int __init megasas_init(void)
 				  &driver_attr_release_date);
 	if (rval)
 		goto err_dcf_rel_date;
+
+	rval = driver_create_file(&megasas_pci_driver.driver,
+				&driver_attr_support_poll_for_event);
+	if (rval)
+		goto err_dcf_support_poll_for_event;
+
 	rval = driver_create_file(&megasas_pci_driver.driver,
 				  &driver_attr_dbg_lvl);
 	if (rval)
@@ -3516,7 +4119,12 @@ err_dcf_poll_mode_io:
 			   &driver_attr_dbg_lvl);
 err_dcf_dbg_lvl:
 	driver_remove_file(&megasas_pci_driver.driver,
+			&driver_attr_support_poll_for_event);
+
+err_dcf_support_poll_for_event:
+	driver_remove_file(&megasas_pci_driver.driver,
 			   &driver_attr_release_date);
+
 err_dcf_rel_date:
 	driver_remove_file(&megasas_pci_driver.driver, &driver_attr_version);
 err_dcf_attr_ver:
diff --git a/drivers/scsi/megaraid/megaraid_sas.h b/drivers/scsi/megaraid/megaraid_sas.h
index 0d033248fdf1..72b28e436e32 100644
--- a/drivers/scsi/megaraid/megaraid_sas.h
+++ b/drivers/scsi/megaraid/megaraid_sas.h
@@ -18,9 +18,9 @@
 /*
  * MegaRAID SAS Driver meta data
  */
-#define MEGASAS_VERSION				"00.00.04.01"
-#define MEGASAS_RELDATE				"July 24, 2008"
-#define MEGASAS_EXT_VERSION			"Thu July 24 11:41:51 PST 2008"
+#define MEGASAS_VERSION				"00.00.04.12-rc1"
+#define MEGASAS_RELDATE				"Sep. 17, 2009"
+#define MEGASAS_EXT_VERSION			"Thu Sep. 17 11:41:51 PST 2009"
 
 /*
  * Device IDs
@@ -30,6 +30,8 @@
 #define	PCI_DEVICE_ID_LSI_VERDE_ZCR		0x0413
 #define	PCI_DEVICE_ID_LSI_SAS1078GEN2		0x0078
 #define	PCI_DEVICE_ID_LSI_SAS0079GEN2		0x0079
+#define	PCI_DEVICE_ID_LSI_SAS0073SKINNY		0x0073
+#define	PCI_DEVICE_ID_LSI_SAS0071SKINNY		0x0071
 
 /*
  * =====================================
@@ -94,6 +96,7 @@
 #define MFI_FRAME_DIR_WRITE			0x0008
 #define MFI_FRAME_DIR_READ			0x0010
 #define MFI_FRAME_DIR_BOTH			0x0018
+#define MFI_FRAME_IEEE                          0x0020
 
 /*
  * Definition for cmd_status
@@ -131,6 +134,7 @@
 #define MR_DCMD_CLUSTER				0x08000000
 #define MR_DCMD_CLUSTER_RESET_ALL		0x08010100
 #define MR_DCMD_CLUSTER_RESET_LD		0x08010200
+#define MR_DCMD_PD_LIST_QUERY                   0x02010100
 
 /*
  * MFI command completion codes
@@ -251,9 +255,100 @@ enum MR_EVT_ARGS {
 	MR_EVT_ARGS_STR,
 	MR_EVT_ARGS_TIME,
 	MR_EVT_ARGS_ECC,
+	MR_EVT_ARGS_LD_PROP,
+	MR_EVT_ARGS_PD_SPARE,
+	MR_EVT_ARGS_PD_INDEX,
+	MR_EVT_ARGS_DIAG_PASS,
+	MR_EVT_ARGS_DIAG_FAIL,
+	MR_EVT_ARGS_PD_LBA_LBA,
+	MR_EVT_ARGS_PORT_PHY,
+	MR_EVT_ARGS_PD_MISSING,
+	MR_EVT_ARGS_PD_ADDRESS,
+	MR_EVT_ARGS_BITMAP,
+	MR_EVT_ARGS_CONNECTOR,
+	MR_EVT_ARGS_PD_PD,
+	MR_EVT_ARGS_PD_FRU,
+	MR_EVT_ARGS_PD_PATHINFO,
+	MR_EVT_ARGS_PD_POWER_STATE,
+	MR_EVT_ARGS_GENERIC,
+};
 
+/*
+ * define constants for device list query options
+ */
+enum MR_PD_QUERY_TYPE {
+	MR_PD_QUERY_TYPE_ALL                = 0,
+	MR_PD_QUERY_TYPE_STATE              = 1,
+	MR_PD_QUERY_TYPE_POWER_STATE        = 2,
+	MR_PD_QUERY_TYPE_MEDIA_TYPE         = 3,
+	MR_PD_QUERY_TYPE_SPEED              = 4,
+	MR_PD_QUERY_TYPE_EXPOSED_TO_HOST    = 5,
 };
 
+#define MR_EVT_CFG_CLEARED                              0x0004
+#define MR_EVT_LD_STATE_CHANGE                          0x0051
+#define MR_EVT_PD_INSERTED                              0x005b
+#define MR_EVT_PD_REMOVED                               0x0070
+#define MR_EVT_LD_CREATED                               0x008a
+#define MR_EVT_LD_DELETED                               0x008b
+#define MR_EVT_FOREIGN_CFG_IMPORTED                     0x00db
+#define MR_EVT_LD_OFFLINE                               0x00fc
+#define MR_EVT_CTRL_HOST_BUS_SCAN_REQUESTED             0x0152
+#define MAX_LOGICAL_DRIVES				64
+
+enum MR_PD_STATE {
+	MR_PD_STATE_UNCONFIGURED_GOOD   = 0x00,
+	MR_PD_STATE_UNCONFIGURED_BAD    = 0x01,
+	MR_PD_STATE_HOT_SPARE           = 0x02,
+	MR_PD_STATE_OFFLINE             = 0x10,
+	MR_PD_STATE_FAILED              = 0x11,
+	MR_PD_STATE_REBUILD             = 0x14,
+	MR_PD_STATE_ONLINE              = 0x18,
+	MR_PD_STATE_COPYBACK            = 0x20,
+	MR_PD_STATE_SYSTEM              = 0x40,
+ };
+
+
+ /*
+ * defines the physical drive address structure
+ */
+struct MR_PD_ADDRESS {
+	u16     deviceId;
+	u16     enclDeviceId;
+
+	union {
+		struct {
+			u8  enclIndex;
+			u8  slotNumber;
+		} mrPdAddress;
+		struct {
+			u8  enclPosition;
+			u8  enclConnectorIndex;
+		} mrEnclAddress;
+	};
+	u8      scsiDevType;
+	union {
+		u8      connectedPortBitmap;
+		u8      connectedPortNumbers;
+	};
+	u64     sasAddr[2];
+} __packed;
+
+/*
+ * defines the physical drive list structure
+ */
+struct MR_PD_LIST {
+	u32             size;
+	u32             count;
+	struct MR_PD_ADDRESS   addr[1];
+} __packed;
+
+struct megasas_pd_list {
+	u16             tid;
+	u8             driveType;
+	u8             driveState;
+} __packed;
+
 /*
  * SAS controller properties
  */
@@ -282,7 +377,7 @@ struct megasas_ctrl_prop {
 	u8 expose_encl_devices;
 	u8 reserved[38];
 
-} __attribute__ ((packed));
+} __packed;
 
 /*
  * SAS controller information
@@ -525,7 +620,7 @@ struct megasas_ctrl_info {
 
 	u8 pad[0x800 - 0x6a0];
 
-} __attribute__ ((packed));
+} __packed;
 
 /*
  * ===============================
@@ -540,6 +635,8 @@ struct megasas_ctrl_info {
 #define MEGASAS_DEFAULT_INIT_ID			-1
 #define MEGASAS_MAX_LUN				8
 #define MEGASAS_MAX_LD				64
+#define MEGASAS_MAX_PD                          (MEGASAS_MAX_PD_CHANNELS * \
+						MEGASAS_MAX_DEV_PER_CHANNEL)
 
 #define MEGASAS_DBG_LVL				1
 
@@ -570,6 +667,7 @@ struct megasas_ctrl_info {
  * is shown below
  */
 #define MEGASAS_INT_CMDS			32
+#define MEGASAS_SKINNY_INT_CMDS			5
 
 /*
  * FW can accept both 32 and 64 bit SGLs. We want to allocate 32/64 bit
@@ -584,6 +682,8 @@ struct megasas_ctrl_info {
 #define MFI_REPLY_1078_MESSAGE_INTERRUPT	0x80000000
 #define MFI_REPLY_GEN2_MESSAGE_INTERRUPT	0x00000001
 #define MFI_GEN2_ENABLE_INTERRUPT_MASK		(0x00000001 | 0x00000004)
+#define MFI_REPLY_SKINNY_MESSAGE_INTERRUPT	0x40000000
+#define MFI_SKINNY_ENABLE_INTERRUPT_MASK	(0x00000001)
 
 /*
 * register set for both 1068 and 1078 controllers
@@ -644,10 +744,17 @@ struct megasas_sge64 {
 
 } __attribute__ ((packed));
 
+struct megasas_sge_skinny {
+	u64 phys_addr;
+	u32 length;
+	u32 flag;
+} __packed;
+
 union megasas_sgl {
 
 	struct megasas_sge32 sge32[1];
 	struct megasas_sge64 sge64[1];
+	struct megasas_sge_skinny sge_skinny[1];
 
 } __attribute__ ((packed));
 
@@ -1061,16 +1168,10 @@ struct megasas_evt_detail {
 
 } __attribute__ ((packed));
 
- struct megasas_instance_template {
-	void (*fire_cmd)(dma_addr_t ,u32 ,struct megasas_register_set __iomem *);
-
-	void (*enable_intr)(struct megasas_register_set __iomem *) ;
-	void (*disable_intr)(struct megasas_register_set __iomem *);
-
-	int (*clear_intr)(struct megasas_register_set __iomem *);
-
-	u32 (*read_fw_status_reg)(struct megasas_register_set __iomem *);
- };
+struct megasas_aen_event {
+	struct work_struct hotplug_work;
+	struct megasas_instance *instance;
+};
 
 struct megasas_instance {
 
@@ -1085,17 +1186,21 @@ struct megasas_instance {
 	unsigned long base_addr;
 	struct megasas_register_set __iomem *reg_set;
 
+	struct megasas_pd_list          pd_list[MEGASAS_MAX_PD];
 	s8 init_id;
 
 	u16 max_num_sge;
 	u16 max_fw_cmds;
 	u32 max_sectors_per_req;
+	struct megasas_aen_event *ev;
 
 	struct megasas_cmd **cmd_list;
 	struct list_head cmd_pool;
 	spinlock_t cmd_pool_lock;
 	/* used to synch producer, consumer ptrs in dpc */
 	spinlock_t completion_lock;
+	/* used to sync fire the cmd to fw */
+	spinlock_t fire_lock;
 	struct dma_pool *frame_dma_pool;
 	struct dma_pool *sense_dma_pool;
 
@@ -1120,11 +1225,25 @@ struct megasas_instance {
 	struct tasklet_struct isr_tasklet;
 
 	u8 flag;
+	u8 unload;
+	u8 flag_ieee;
 	unsigned long last_time;
 
 	struct timer_list io_completion_timer;
 };
 
+struct megasas_instance_template {
+	void (*fire_cmd)(struct megasas_instance *, dma_addr_t, \
+		u32, struct megasas_register_set __iomem *);
+
+	void (*enable_intr)(struct megasas_register_set __iomem *) ;
+	void (*disable_intr)(struct megasas_register_set __iomem *);
+
+	int (*clear_intr)(struct megasas_register_set __iomem *);
+
+	u32 (*read_fw_status_reg)(struct megasas_register_set __iomem *);
+};
+
 #define MEGASAS_IS_LOGICAL(scp)						\
 	(scp->device->channel < MEGASAS_MAX_PD_CHANNELS) ? 0 : 1
 
diff --git a/drivers/scsi/mpt2sas/mpi/mpi2.h b/drivers/scsi/mpt2sas/mpi/mpi2.h
index f9f6c0839276..914168105297 100644
--- a/drivers/scsi/mpt2sas/mpi/mpi2.h
+++ b/drivers/scsi/mpt2sas/mpi/mpi2.h
@@ -8,7 +8,7 @@
  *                  scatter/gather formats.
  *  Creation Date:  June 21, 2006
  *
- *  mpi2.h Version:  02.00.12
+ *  mpi2.h Version:  02.00.13
  *
  *  Version History
  *  ---------------
@@ -52,6 +52,7 @@
  *                      MPI2_SCSI_IO_SUCCESS_REPLY_DESCRIPTOR and made those
  *                      bytes reserved.
  *                      Added RAID Accelerator functionality.
+ *  07-30-09  02.00.13  Bumped MPI2_HEADER_VERSION_UNIT.
  *  --------------------------------------------------------------------------
  */
 
@@ -77,7 +78,7 @@
 #define MPI2_VERSION_02_00                  (0x0200)
 
 /* versioning for this MPI header set */
-#define MPI2_HEADER_VERSION_UNIT            (0x0C)
+#define MPI2_HEADER_VERSION_UNIT            (0x0D)
 #define MPI2_HEADER_VERSION_DEV             (0x00)
 #define MPI2_HEADER_VERSION_UNIT_MASK       (0xFF00)
 #define MPI2_HEADER_VERSION_UNIT_SHIFT      (8)
diff --git a/drivers/scsi/mpt2sas/mpi/mpi2_cnfg.h b/drivers/scsi/mpt2sas/mpi/mpi2_cnfg.h
index ab47c4679640..1611c57a6fdf 100644
--- a/drivers/scsi/mpt2sas/mpi/mpi2_cnfg.h
+++ b/drivers/scsi/mpt2sas/mpi/mpi2_cnfg.h
@@ -6,7 +6,7 @@
  *          Title:  MPI Configuration messages and pages
  *  Creation Date:  November 10, 2006
  *
- *    mpi2_cnfg.h Version:  02.00.11
+ *    mpi2_cnfg.h Version:  02.00.12
  *
  *  Version History
  *  ---------------
@@ -100,6 +100,13 @@
  *                      Added expander reduced functionality data to SAS
  *                      Expander Page 0.
  *                      Added SAS PHY Page 2 and SAS PHY Page 3.
+ *  07-30-09  02.00.12  Added IO Unit Page 7.
+ *                      Added new device ids.
+ *                      Added SAS IO Unit Page 5.
+ *                      Added partial and slumber power management capable flags
+ *                      to SAS Device Page 0 Flags field.
+ *                      Added PhyInfo defines for power condition.
+ *                      Added Ethernet configuration pages.
  *  --------------------------------------------------------------------------
  */
 
@@ -182,6 +189,7 @@ typedef union _MPI2_CONFIG_EXT_PAGE_HEADER_UNION
 #define MPI2_CONFIG_EXTPAGETYPE_RAID_CONFIG         (0x16)
 #define MPI2_CONFIG_EXTPAGETYPE_DRIVER_MAPPING      (0x17)
 #define MPI2_CONFIG_EXTPAGETYPE_SAS_PORT            (0x18)
+#define MPI2_CONFIG_EXTPAGETYPE_ETHERNET            (0x19)
 
 
 /*****************************************************************************
@@ -268,6 +276,14 @@ typedef union _MPI2_CONFIG_EXT_PAGE_HEADER_UNION
 #define MPI2_DPM_PGAD_START_ENTRY_MASK              (0x0000FFFF)
 
 
+/* Ethernet PageAddress format */
+#define MPI2_ETHERNET_PGAD_FORM_MASK                (0xF0000000)
+#define MPI2_ETHERNET_PGAD_FORM_IF_NUM              (0x00000000)
+
+#define MPI2_ETHERNET_PGAD_IF_NUMBER_MASK           (0x000000FF)
+
+
+
 /****************************************************************************
 *   Configuration messages
 ****************************************************************************/
@@ -349,6 +365,15 @@ typedef struct _MPI2_CONFIG_REPLY
 #define MPI2_MFGPAGE_DEVID_SAS2116_1                (0x0064)
 #define MPI2_MFGPAGE_DEVID_SAS2116_2                (0x0065)
 
+#define MPI2_MFGPAGE_DEVID_SAS2208_1                (0x0080)
+#define MPI2_MFGPAGE_DEVID_SAS2208_2                (0x0081)
+#define MPI2_MFGPAGE_DEVID_SAS2208_3                (0x0082)
+#define MPI2_MFGPAGE_DEVID_SAS2208_4                (0x0083)
+#define MPI2_MFGPAGE_DEVID_SAS2208_5                (0x0084)
+#define MPI2_MFGPAGE_DEVID_SAS2208_6                (0x0085)
+#define MPI2_MFGPAGE_DEVID_SAS2208_7                (0x0086)
+#define MPI2_MFGPAGE_DEVID_SAS2208_8                (0x0087)
+
 
 /* Manufacturing Page 0 */
 
@@ -787,6 +812,56 @@ typedef struct _MPI2_CONFIG_PAGE_IO_UNIT_6 {
 #define MPI2_IOUNITPAGE6_FLAGS_ENABLE_RAID_ACCELERATOR  (0x0001)
 
 
+/* IO Unit Page 7 */
+
+typedef struct _MPI2_CONFIG_PAGE_IO_UNIT_7 {
+    MPI2_CONFIG_PAGE_HEADER Header;                                 /* 0x00 */
+    U16                     Reserved1;                              /* 0x04 */
+    U8                      PCIeWidth;                              /* 0x06 */
+    U8                      PCIeSpeed;                              /* 0x07 */
+    U32                     ProcessorState;                         /* 0x08 */
+    U32                     Reserved2;                              /* 0x0C */
+    U16                     IOCTemperature;                         /* 0x10 */
+    U8                      IOCTemperatureUnits;                    /* 0x12 */
+    U8                      IOCSpeed;                               /* 0x13 */
+    U32                     Reserved3;                              /* 0x14 */
+} MPI2_CONFIG_PAGE_IO_UNIT_7, MPI2_POINTER PTR_MPI2_CONFIG_PAGE_IO_UNIT_7,
+  Mpi2IOUnitPage7_t, MPI2_POINTER pMpi2IOUnitPage7_t;
+
+#define MPI2_IOUNITPAGE7_PAGEVERSION                    (0x00)
+
+/* defines for IO Unit Page 7 PCIeWidth field */
+#define MPI2_IOUNITPAGE7_PCIE_WIDTH_X1              (0x01)
+#define MPI2_IOUNITPAGE7_PCIE_WIDTH_X2              (0x02)
+#define MPI2_IOUNITPAGE7_PCIE_WIDTH_X4              (0x04)
+#define MPI2_IOUNITPAGE7_PCIE_WIDTH_X8              (0x08)
+
+/* defines for IO Unit Page 7 PCIeSpeed field */
+#define MPI2_IOUNITPAGE7_PCIE_SPEED_2_5_GBPS        (0x00)
+#define MPI2_IOUNITPAGE7_PCIE_SPEED_5_0_GBPS        (0x01)
+#define MPI2_IOUNITPAGE7_PCIE_SPEED_8_0_GBPS        (0x02)
+
+/* defines for IO Unit Page 7 ProcessorState field */
+#define MPI2_IOUNITPAGE7_PSTATE_MASK_SECOND         (0x0000000F)
+#define MPI2_IOUNITPAGE7_PSTATE_SHIFT_SECOND        (0)
+
+#define MPI2_IOUNITPAGE7_PSTATE_NOT_PRESENT         (0x00)
+#define MPI2_IOUNITPAGE7_PSTATE_DISABLED            (0x01)
+#define MPI2_IOUNITPAGE7_PSTATE_ENABLED             (0x02)
+
+/* defines for IO Unit Page 7 IOCTemperatureUnits field */
+#define MPI2_IOUNITPAGE7_IOC_TEMP_NOT_PRESENT       (0x00)
+#define MPI2_IOUNITPAGE7_IOC_TEMP_FAHRENHEIT        (0x01)
+#define MPI2_IOUNITPAGE7_IOC_TEMP_CELSIUS           (0x02)
+
+/* defines for IO Unit Page 7 IOCSpeed field */
+#define MPI2_IOUNITPAGE7_IOC_SPEED_FULL             (0x01)
+#define MPI2_IOUNITPAGE7_IOC_SPEED_HALF             (0x02)
+#define MPI2_IOUNITPAGE7_IOC_SPEED_QUARTER          (0x04)
+#define MPI2_IOUNITPAGE7_IOC_SPEED_EIGHTH           (0x08)
+
+
+
 /****************************************************************************
 *   IOC Config Pages
 ****************************************************************************/
@@ -1470,6 +1545,12 @@ typedef struct _MPI2_CONFIG_PAGE_RD_PDISK_1
 
 /* values for PhyInfo fields */
 #define MPI2_SAS_PHYINFO_PHY_VACANT                     (0x80000000)
+
+#define MPI2_SAS_PHYINFO_PHY_POWER_CONDITION_MASK       (0x18000000)
+#define MPI2_SAS_PHYINFO_PHY_POWER_ACTIVE               (0x00000000)
+#define MPI2_SAS_PHYINFO_PHY_POWER_PARTIAL              (0x08000000)
+#define MPI2_SAS_PHYINFO_PHY_POWER_SLUMBER              (0x10000000)
+
 #define MPI2_SAS_PHYINFO_CHANGED_REQ_INSIDE_ZPSDS       (0x04000000)
 #define MPI2_SAS_PHYINFO_INSIDE_ZPSDS_PERSISTENT        (0x02000000)
 #define MPI2_SAS_PHYINFO_REQ_INSIDE_ZPSDS               (0x01000000)
@@ -1682,11 +1763,11 @@ typedef struct _MPI2_CONFIG_PAGE_SASIOUNIT_1
 /* values for SAS IO Unit Page 1 PortFlags */
 #define MPI2_SASIOUNIT1_PORT_FLAGS_AUTO_PORT_CONFIG                 (0x01)
 
-/* values for SAS IO Unit Page 2 PhyFlags */
+/* values for SAS IO Unit Page 1 PhyFlags */
 #define MPI2_SASIOUNIT1_PHYFLAGS_ZONING_ENABLE                      (0x10)
 #define MPI2_SASIOUNIT1_PHYFLAGS_PHY_DISABLE                        (0x08)
 
-/* values for SAS IO Unit Page 0 MaxMinLinkRate */
+/* values for SAS IO Unit Page 1 MaxMinLinkRate */
 #define MPI2_SASIOUNIT1_MAX_RATE_MASK                               (0xF0)
 #define MPI2_SASIOUNIT1_MAX_RATE_1_5                                (0x80)
 #define MPI2_SASIOUNIT1_MAX_RATE_3_0                                (0x90)
@@ -1745,6 +1826,74 @@ typedef struct _MPI2_CONFIG_PAGE_SASIOUNIT_4
 #define MPI2_SASIOUNIT4_PHY_SPINUP_GROUP_MASK               (0x03)
 
 
+/* SAS IO Unit Page 5 */
+
+typedef struct _MPI2_SAS_IO_UNIT5_PHY_PM_SETTINGS {
+    U8          ControlFlags;               /* 0x00 */
+    U8          Reserved1;                  /* 0x01 */
+    U16         InactivityTimerExponent;    /* 0x02 */
+    U8          SATAPartialTimeout;         /* 0x04 */
+    U8          Reserved2;                  /* 0x05 */
+    U8          SATASlumberTimeout;         /* 0x06 */
+    U8          Reserved3;                  /* 0x07 */
+    U8          SASPartialTimeout;          /* 0x08 */
+    U8          Reserved4;                  /* 0x09 */
+    U8          SASSlumberTimeout;          /* 0x0A */
+    U8          Reserved5;                  /* 0x0B */
+} MPI2_SAS_IO_UNIT5_PHY_PM_SETTINGS,
+  MPI2_POINTER PTR_MPI2_SAS_IO_UNIT5_PHY_PM_SETTINGS,
+  Mpi2SasIOUnit5PhyPmSettings_t, MPI2_POINTER pMpi2SasIOUnit5PhyPmSettings_t;
+
+/* defines for ControlFlags field */
+#define MPI2_SASIOUNIT5_CONTROL_SAS_SLUMBER_ENABLE      (0x08)
+#define MPI2_SASIOUNIT5_CONTROL_SAS_PARTIAL_ENABLE      (0x04)
+#define MPI2_SASIOUNIT5_CONTROL_SATA_SLUMBER_ENABLE     (0x02)
+#define MPI2_SASIOUNIT5_CONTROL_SATA_PARTIAL_ENABLE     (0x01)
+
+/* defines for InactivityTimerExponent field */
+#define MPI2_SASIOUNIT5_ITE_MASK_SAS_SLUMBER            (0x7000)
+#define MPI2_SASIOUNIT5_ITE_SHIFT_SAS_SLUMBER           (12)
+#define MPI2_SASIOUNIT5_ITE_MASK_SAS_PARTIAL            (0x0700)
+#define MPI2_SASIOUNIT5_ITE_SHIFT_SAS_PARTIAL           (8)
+#define MPI2_SASIOUNIT5_ITE_MASK_SATA_SLUMBER           (0x0070)
+#define MPI2_SASIOUNIT5_ITE_SHIFT_SATA_SLUMBER          (4)
+#define MPI2_SASIOUNIT5_ITE_MASK_SATA_PARTIAL           (0x0007)
+#define MPI2_SASIOUNIT5_ITE_SHIFT_SATA_PARTIAL          (0)
+
+#define MPI2_SASIOUNIT5_ITE_TEN_SECONDS                 (7)
+#define MPI2_SASIOUNIT5_ITE_ONE_SECOND                  (6)
+#define MPI2_SASIOUNIT5_ITE_HUNDRED_MILLISECONDS        (5)
+#define MPI2_SASIOUNIT5_ITE_TEN_MILLISECONDS            (4)
+#define MPI2_SASIOUNIT5_ITE_ONE_MILLISECOND             (3)
+#define MPI2_SASIOUNIT5_ITE_HUNDRED_MICROSECONDS        (2)
+#define MPI2_SASIOUNIT5_ITE_TEN_MICROSECONDS            (1)
+#define MPI2_SASIOUNIT5_ITE_ONE_MICROSECOND             (0)
+
+/*
+ * Host code (drivers, BIOS, utilities, etc.) should leave this define set to
+ * one and check Header.ExtPageLength or NumPhys at runtime.
+ */
+#ifndef MPI2_SAS_IOUNIT5_PHY_MAX
+#define MPI2_SAS_IOUNIT5_PHY_MAX        (1)
+#endif
+
+typedef struct _MPI2_CONFIG_PAGE_SASIOUNIT_5 {
+    MPI2_CONFIG_EXTENDED_PAGE_HEADER    Header;		/* 0x00 */
+    U8                                  NumPhys;	/* 0x08 */
+    U8                                  Reserved1;	/* 0x09 */
+    U16                                 Reserved2;	/* 0x0A */
+    U32                                 Reserved3;	/* 0x0C */
+    MPI2_SAS_IO_UNIT5_PHY_PM_SETTINGS   SASPhyPowerManagementSettings
+					[MPI2_SAS_IOUNIT5_PHY_MAX];  /* 0x10 */
+} MPI2_CONFIG_PAGE_SASIOUNIT_5,
+  MPI2_POINTER PTR_MPI2_CONFIG_PAGE_SASIOUNIT_5,
+  Mpi2SasIOUnitPage5_t, MPI2_POINTER pMpi2SasIOUnitPage5_t;
+
+#define MPI2_SASIOUNITPAGE5_PAGEVERSION     (0x00)
+
+
+
+
 /****************************************************************************
 *   SAS Expander Config Pages
 ****************************************************************************/
@@ -1927,6 +2076,8 @@ typedef struct _MPI2_CONFIG_PAGE_SAS_DEV_0
 /* see mpi2_sas.h for values for SAS Device Page 0 DeviceInfo values */
 
 /* values for SAS Device Page 0 Flags field */
+#define MPI2_SAS_DEVICE0_FLAGS_SLUMBER_PM_CAPABLE           (0x1000)
+#define MPI2_SAS_DEVICE0_FLAGS_PARTIAL_PM_CAPABLE           (0x0800)
 #define MPI2_SAS_DEVICE0_FLAGS_SATA_ASYNCHRONOUS_NOTIFY     (0x0400)
 #define MPI2_SAS_DEVICE0_FLAGS_SATA_SW_PRESERVE             (0x0200)
 #define MPI2_SAS_DEVICE0_FLAGS_UNSUPPORTED_DEVICE           (0x0100)
@@ -2343,5 +2494,122 @@ typedef struct _MPI2_CONFIG_PAGE_DRIVER_MAPPING_0
 #define MPI2_DRVMAP0_MAPINFO_MISSING_MASK           (0x000F)
 
 
+/****************************************************************************
+*   Ethernet Config Pages
+****************************************************************************/
+
+/* Ethernet Page 0 */
+
+/* IP address (union of IPv4 and IPv6) */
+typedef union _MPI2_ETHERNET_IP_ADDR {
+    U32     IPv4Addr;
+    U32     IPv6Addr[4];
+} MPI2_ETHERNET_IP_ADDR, MPI2_POINTER PTR_MPI2_ETHERNET_IP_ADDR,
+  Mpi2EthernetIpAddr_t, MPI2_POINTER pMpi2EthernetIpAddr_t;
+
+#define MPI2_ETHERNET_HOST_NAME_LENGTH          (32)
+
+typedef struct _MPI2_CONFIG_PAGE_ETHERNET_0 {
+    MPI2_CONFIG_EXTENDED_PAGE_HEADER    Header;                 /* 0x00 */
+    U8                                  NumInterfaces;          /* 0x08 */
+    U8                                  Reserved0;              /* 0x09 */
+    U16                                 Reserved1;              /* 0x0A */
+    U32                                 Status;                 /* 0x0C */
+    U8                                  MediaState;             /* 0x10 */
+    U8                                  Reserved2;              /* 0x11 */
+    U16                                 Reserved3;              /* 0x12 */
+    U8                                  MacAddress[6];          /* 0x14 */
+    U8                                  Reserved4;              /* 0x1A */
+    U8                                  Reserved5;              /* 0x1B */
+    MPI2_ETHERNET_IP_ADDR               IpAddress;              /* 0x1C */
+    MPI2_ETHERNET_IP_ADDR               SubnetMask;             /* 0x2C */
+    MPI2_ETHERNET_IP_ADDR               GatewayIpAddress;       /* 0x3C */
+    MPI2_ETHERNET_IP_ADDR               DNS1IpAddress;          /* 0x4C */
+    MPI2_ETHERNET_IP_ADDR               DNS2IpAddress;          /* 0x5C */
+    MPI2_ETHERNET_IP_ADDR               DhcpIpAddress;          /* 0x6C */
+    U8                                  HostName
+				[MPI2_ETHERNET_HOST_NAME_LENGTH];/* 0x7C */
+} MPI2_CONFIG_PAGE_ETHERNET_0, MPI2_POINTER PTR_MPI2_CONFIG_PAGE_ETHERNET_0,
+  Mpi2EthernetPage0_t, MPI2_POINTER pMpi2EthernetPage0_t;
+
+#define MPI2_ETHERNETPAGE0_PAGEVERSION   (0x00)
+
+/* values for Ethernet Page 0 Status field */
+#define MPI2_ETHPG0_STATUS_IPV6_CAPABLE             (0x80000000)
+#define MPI2_ETHPG0_STATUS_IPV4_CAPABLE             (0x40000000)
+#define MPI2_ETHPG0_STATUS_CONSOLE_CONNECTED        (0x20000000)
+#define MPI2_ETHPG0_STATUS_DEFAULT_IF               (0x00000100)
+#define MPI2_ETHPG0_STATUS_FW_DWNLD_ENABLED         (0x00000080)
+#define MPI2_ETHPG0_STATUS_TELNET_ENABLED           (0x00000040)
+#define MPI2_ETHPG0_STATUS_SSH2_ENABLED             (0x00000020)
+#define MPI2_ETHPG0_STATUS_DHCP_CLIENT_ENABLED      (0x00000010)
+#define MPI2_ETHPG0_STATUS_IPV6_ENABLED             (0x00000008)
+#define MPI2_ETHPG0_STATUS_IPV4_ENABLED             (0x00000004)
+#define MPI2_ETHPG0_STATUS_IPV6_ADDRESSES           (0x00000002)
+#define MPI2_ETHPG0_STATUS_ETH_IF_ENABLED           (0x00000001)
+
+/* values for Ethernet Page 0 MediaState field */
+#define MPI2_ETHPG0_MS_DUPLEX_MASK                  (0x80)
+#define MPI2_ETHPG0_MS_HALF_DUPLEX                  (0x00)
+#define MPI2_ETHPG0_MS_FULL_DUPLEX                  (0x80)
+
+#define MPI2_ETHPG0_MS_CONNECT_SPEED_MASK           (0x07)
+#define MPI2_ETHPG0_MS_NOT_CONNECTED                (0x00)
+#define MPI2_ETHPG0_MS_10MBIT                       (0x01)
+#define MPI2_ETHPG0_MS_100MBIT                      (0x02)
+#define MPI2_ETHPG0_MS_1GBIT                        (0x03)
+
+
+/* Ethernet Page 1 */
+
+typedef struct _MPI2_CONFIG_PAGE_ETHERNET_1 {
+    MPI2_CONFIG_EXTENDED_PAGE_HEADER    Header;                 /* 0x00 */
+    U32                                 Reserved0;              /* 0x08 */
+    U32                                 Flags;                  /* 0x0C */
+    U8                                  MediaState;             /* 0x10 */
+    U8                                  Reserved1;              /* 0x11 */
+    U16                                 Reserved2;              /* 0x12 */
+    U8                                  MacAddress[6];          /* 0x14 */
+    U8                                  Reserved3;              /* 0x1A */
+    U8                                  Reserved4;              /* 0x1B */
+    MPI2_ETHERNET_IP_ADDR               StaticIpAddress;        /* 0x1C */
+    MPI2_ETHERNET_IP_ADDR               StaticSubnetMask;       /* 0x2C */
+    MPI2_ETHERNET_IP_ADDR               StaticGatewayIpAddress; /* 0x3C */
+    MPI2_ETHERNET_IP_ADDR               StaticDNS1IpAddress;    /* 0x4C */
+    MPI2_ETHERNET_IP_ADDR               StaticDNS2IpAddress;    /* 0x5C */
+    U32                                 Reserved5;              /* 0x6C */
+    U32                                 Reserved6;              /* 0x70 */
+    U32                                 Reserved7;              /* 0x74 */
+    U32                                 Reserved8;              /* 0x78 */
+    U8                                  HostName
+				[MPI2_ETHERNET_HOST_NAME_LENGTH];/* 0x7C */
+} MPI2_CONFIG_PAGE_ETHERNET_1, MPI2_POINTER PTR_MPI2_CONFIG_PAGE_ETHERNET_1,
+  Mpi2EthernetPage1_t, MPI2_POINTER pMpi2EthernetPage1_t;
+
+#define MPI2_ETHERNETPAGE1_PAGEVERSION   (0x00)
+
+/* values for Ethernet Page 1 Flags field */
+#define MPI2_ETHPG1_FLAG_SET_DEFAULT_IF             (0x00000100)
+#define MPI2_ETHPG1_FLAG_ENABLE_FW_DOWNLOAD         (0x00000080)
+#define MPI2_ETHPG1_FLAG_ENABLE_TELNET              (0x00000040)
+#define MPI2_ETHPG1_FLAG_ENABLE_SSH2                (0x00000020)
+#define MPI2_ETHPG1_FLAG_ENABLE_DHCP_CLIENT         (0x00000010)
+#define MPI2_ETHPG1_FLAG_ENABLE_IPV6                (0x00000008)
+#define MPI2_ETHPG1_FLAG_ENABLE_IPV4                (0x00000004)
+#define MPI2_ETHPG1_FLAG_USE_IPV6_ADDRESSES         (0x00000002)
+#define MPI2_ETHPG1_FLAG_ENABLE_ETH_IF              (0x00000001)
+
+/* values for Ethernet Page 1 MediaState field */
+#define MPI2_ETHPG1_MS_DUPLEX_MASK                  (0x80)
+#define MPI2_ETHPG1_MS_HALF_DUPLEX                  (0x00)
+#define MPI2_ETHPG1_MS_FULL_DUPLEX                  (0x80)
+
+#define MPI2_ETHPG1_MS_DATA_RATE_MASK               (0x07)
+#define MPI2_ETHPG1_MS_DATA_RATE_AUTO               (0x00)
+#define MPI2_ETHPG1_MS_DATA_RATE_10MBIT             (0x01)
+#define MPI2_ETHPG1_MS_DATA_RATE_100MBIT            (0x02)
+#define MPI2_ETHPG1_MS_DATA_RATE_1GBIT              (0x03)
+
+
 #endif
 
diff --git a/drivers/scsi/mpt2sas/mpi/mpi2_ioc.h b/drivers/scsi/mpt2sas/mpi/mpi2_ioc.h
index c294128bdeb4..ea51ce868690 100644
--- a/drivers/scsi/mpt2sas/mpi/mpi2_ioc.h
+++ b/drivers/scsi/mpt2sas/mpi/mpi2_ioc.h
@@ -6,7 +6,7 @@
  *          Title:  MPI IOC, Port, Event, FW Download, and FW Upload messages
  *  Creation Date:  October 11, 2006
  *
- *  mpi2_ioc.h Version:  02.00.11
+ *  mpi2_ioc.h Version:  02.00.12
  *
  *  Version History
  *  ---------------
@@ -84,6 +84,9 @@
  *                      Added two new reason codes for SAS Device Status Change
  *                      Event.
  *                      Added new event: SAS PHY Counter.
+ *  07-30-09  02.00.12  Added GPIO Interrupt event define and structure.
+ *                      Added MPI2_IOCFACTS_CAPABILITY_EXTENDED_BUFFER define.
+ *                      Added new product id family for 2208.
  *  --------------------------------------------------------------------------
  */
 
@@ -274,6 +277,7 @@ typedef struct _MPI2_IOC_FACTS_REPLY
 #define MPI2_IOCFACTS_CAPABILITY_MULTICAST              (0x00000100)
 #define MPI2_IOCFACTS_CAPABILITY_BIDIRECTIONAL_TARGET   (0x00000080)
 #define MPI2_IOCFACTS_CAPABILITY_EEDP                   (0x00000040)
+#define MPI2_IOCFACTS_CAPABILITY_EXTENDED_BUFFER        (0x00000020)
 #define MPI2_IOCFACTS_CAPABILITY_SNAPSHOT_BUFFER        (0x00000010)
 #define MPI2_IOCFACTS_CAPABILITY_DIAG_TRACE_BUFFER      (0x00000008)
 #define MPI2_IOCFACTS_CAPABILITY_TASK_SET_FULL_HANDLING (0x00000004)
@@ -448,6 +452,7 @@ typedef struct _MPI2_EVENT_NOTIFICATION_REPLY
 #define MPI2_EVENT_IR_CONFIGURATION_CHANGE_LIST     (0x0020)
 #define MPI2_EVENT_LOG_ENTRY_ADDED                  (0x0021)
 #define MPI2_EVENT_SAS_PHY_COUNTER                  (0x0022)
+#define MPI2_EVENT_GPIO_INTERRUPT                   (0x0023)
 
 
 /* Log Entry Added Event data */
@@ -469,6 +474,16 @@ typedef struct _MPI2_EVENT_DATA_LOG_ENTRY_ADDED
   MPI2_POINTER PTR_MPI2_EVENT_DATA_LOG_ENTRY_ADDED,
   Mpi2EventDataLogEntryAdded_t, MPI2_POINTER pMpi2EventDataLogEntryAdded_t;
 
+/* GPIO Interrupt Event data */
+
+typedef struct _MPI2_EVENT_DATA_GPIO_INTERRUPT {
+    U8          GPIONum;                            /* 0x00 */
+    U8          Reserved1;                          /* 0x01 */
+    U16         Reserved2;                          /* 0x02 */
+} MPI2_EVENT_DATA_GPIO_INTERRUPT,
+  MPI2_POINTER PTR_MPI2_EVENT_DATA_GPIO_INTERRUPT,
+  Mpi2EventDataGpioInterrupt_t, MPI2_POINTER pMpi2EventDataGpioInterrupt_t;
+
 /* Hard Reset Received Event data */
 
 typedef struct _MPI2_EVENT_DATA_HARD_RESET_RECEIVED
@@ -1117,6 +1132,7 @@ typedef struct _MPI2_FW_IMAGE_HEADER
 #define MPI2_FW_HEADER_PID_FAMILY_MASK          (0x00FF)
 /* SAS */
 #define MPI2_FW_HEADER_PID_FAMILY_2108_SAS      (0x0010)
+#define MPI2_FW_HEADER_PID_FAMILY_2208_SAS      (0x0011)
 
 /* use MPI2_IOCFACTS_PROTOCOL_ defines for ProtocolFlags field */
 
diff --git a/drivers/scsi/mpt2sas/mpi/mpi2_raid.h b/drivers/scsi/mpt2sas/mpi/mpi2_raid.h
index 7134816d9046..5160c33d2a00 100644
--- a/drivers/scsi/mpt2sas/mpi/mpi2_raid.h
+++ b/drivers/scsi/mpt2sas/mpi/mpi2_raid.h
@@ -6,7 +6,7 @@
  *          Title:  MPI Integrated RAID messages and structures
  *  Creation Date:  April 26, 2007
  *
- *    mpi2_raid.h Version:  02.00.03
+ *    mpi2_raid.h Version:  02.00.04
  *
  *  Version History
  *  ---------------
@@ -20,6 +20,8 @@
  *  05-21-08  02.00.03  Added MPI2_RAID_VOL_CREATION_NUM_PHYSDISKS so that
  *                      the PhysDisk array in MPI2_RAID_VOLUME_CREATION_STRUCT
  *                      can be sized by the build environment.
+ *  07-30-09  02.00.04  Added proper define for the Use Default Settings bit of
+ *                      VolumeCreationFlags and marked the old one as obsolete.
  *  --------------------------------------------------------------------------
  */
 
@@ -217,10 +219,14 @@ typedef struct _MPI2_RAID_VOLUME_CREATION_STRUCT
 /* use MPI2_RAID_VOL_TYPE_ defines from mpi2_cnfg.h for VolumeType */
 
 /* defines for the VolumeCreationFlags field */
+#define MPI2_RAID_VOL_CREATION_DEFAULT_SETTINGS     (0x80000000)
+#define MPI2_RAID_VOL_CREATION_BACKGROUND_INIT      (0x00000004)
+#define MPI2_RAID_VOL_CREATION_LOW_LEVEL_INIT       (0x00000002)
+#define MPI2_RAID_VOL_CREATION_MIGRATE_DATA         (0x00000001)
+/* The following is an obsolete define.
+ * It must be shifted left 24 bits in order to set the proper bit.
+ */
 #define MPI2_RAID_VOL_CREATION_USE_DEFAULT_SETTINGS (0x80)
-#define MPI2_RAID_VOL_CREATION_BACKGROUND_INIT      (0x04)
-#define MPI2_RAID_VOL_CREATION_LOW_LEVEL_INIT       (0x02)
-#define MPI2_RAID_VOL_CREATION_MIGRATE_DATA         (0x01)
 
 
 /* RAID Online Capacity Expansion Structure */
diff --git a/drivers/scsi/mpt2sas/mpi/mpi2_tool.h b/drivers/scsi/mpt2sas/mpi/mpi2_tool.h
index 007e950f7bfa..73fcdbf92632 100644
--- a/drivers/scsi/mpt2sas/mpi/mpi2_tool.h
+++ b/drivers/scsi/mpt2sas/mpi/mpi2_tool.h
@@ -6,7 +6,7 @@
  *          Title:  MPI diagnostic tool structures and definitions
  *  Creation Date:  March 26, 2007
  *
- *    mpi2_tool.h Version:  02.00.03
+ *    mpi2_tool.h Version:  02.00.04
  *
  *  Version History
  *  ---------------
@@ -18,6 +18,10 @@
  *                      structures and defines.
  *  02-29-08  02.00.02  Modified various names to make them 32-character unique.
  *  05-06-09  02.00.03  Added ISTWI Read Write Tool and Diagnostic CLI Tool.
+ *  07-30-09  02.00.04  Added ExtendedType field to DiagnosticBufferPost request
+ *                      and reply messages.
+ *                      Added MPI2_DIAG_BUF_TYPE_EXTENDED.
+ *                      Incremented MPI2_DIAG_BUF_TYPE_COUNT.
  *  --------------------------------------------------------------------------
  */
 
@@ -282,7 +286,7 @@ typedef struct _MPI2_TOOLBOX_DIAGNOSTIC_CLI_REPLY {
 
 typedef struct _MPI2_DIAG_BUFFER_POST_REQUEST
 {
-    U8                      Reserved1;                  /* 0x00 */
+    U8                      ExtendedType;               /* 0x00 */
     U8                      BufferType;                 /* 0x01 */
     U8                      ChainOffset;                /* 0x02 */
     U8                      Function;                   /* 0x03 */
@@ -301,11 +305,15 @@ typedef struct _MPI2_DIAG_BUFFER_POST_REQUEST
 } MPI2_DIAG_BUFFER_POST_REQUEST, MPI2_POINTER PTR_MPI2_DIAG_BUFFER_POST_REQUEST,
   Mpi2DiagBufferPostRequest_t, MPI2_POINTER pMpi2DiagBufferPostRequest_t;
 
+/* values for the ExtendedType field */
+#define MPI2_DIAG_EXTENDED_TYPE_UTILIZATION         (0x02)
+
 /* values for the BufferType field */
 #define MPI2_DIAG_BUF_TYPE_TRACE                    (0x00)
 #define MPI2_DIAG_BUF_TYPE_SNAPSHOT                 (0x01)
+#define MPI2_DIAG_BUF_TYPE_EXTENDED                 (0x02)
 /* count of the number of buffer types */
-#define MPI2_DIAG_BUF_TYPE_COUNT                    (0x02)
+#define MPI2_DIAG_BUF_TYPE_COUNT                    (0x03)
 
 
 /****************************************************************************
@@ -314,7 +322,7 @@ typedef struct _MPI2_DIAG_BUFFER_POST_REQUEST
 
 typedef struct _MPI2_DIAG_BUFFER_POST_REPLY
 {
-    U8                      Reserved1;                  /* 0x00 */
+    U8                      ExtendedType;               /* 0x00 */
     U8                      BufferType;                 /* 0x01 */
     U8                      MsgLength;                  /* 0x02 */
     U8                      Function;                   /* 0x03 */
diff --git a/drivers/scsi/mpt2sas/mpt2sas_base.c b/drivers/scsi/mpt2sas/mpt2sas_base.c
index 670241efa4b5..89d02401b9ec 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_base.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_base.c
@@ -57,6 +57,7 @@
 #include <linux/dma-mapping.h>
 #include <linux/sort.h>
 #include <linux/io.h>
+#include <linux/time.h>
 
 #include "mpt2sas_base.h"
 
@@ -77,6 +78,44 @@ static int msix_disable = -1;
 module_param(msix_disable, int, 0);
 MODULE_PARM_DESC(msix_disable, " disable msix routed interrupts (default=0)");
 
+/* diag_buffer_enable is bitwise
+ * bit 0 set = TRACE
+ * bit 1 set = SNAPSHOT
+ * bit 2 set = EXTENDED
+ *
+ * Either bit can be set, or both
+ */
+static int diag_buffer_enable;
+module_param(diag_buffer_enable, int, 0);
+MODULE_PARM_DESC(diag_buffer_enable, " post diag buffers "
+    "(TRACE=1/SNAPSHOT=2/EXTENDED=4/default=0)");
+
+int mpt2sas_fwfault_debug;
+MODULE_PARM_DESC(mpt2sas_fwfault_debug, " enable detection of firmware fault "
+    "and halt firmware - (default=0)");
+
+/**
+ * _scsih_set_fwfault_debug - global setting of ioc->fwfault_debug.
+ *
+ */
+static int
+_scsih_set_fwfault_debug(const char *val, struct kernel_param *kp)
+{
+	int ret = param_set_int(val, kp);
+	struct MPT2SAS_ADAPTER *ioc;
+
+	if (ret)
+		return ret;
+
+	printk(KERN_INFO "setting logging_level(0x%08x)\n",
+				mpt2sas_fwfault_debug);
+	list_for_each_entry(ioc, &mpt2sas_ioc_list, list)
+		ioc->fwfault_debug = mpt2sas_fwfault_debug;
+	return 0;
+}
+module_param_call(mpt2sas_fwfault_debug, _scsih_set_fwfault_debug,
+    param_get_int, &mpt2sas_fwfault_debug, 0644);
+
 /**
  * _base_fault_reset_work - workq handling ioc fault conditions
  * @work: input argument, used to derive ioc
@@ -121,7 +160,7 @@ _base_fault_reset_work(struct work_struct *work)
 
 /**
  * mpt2sas_base_start_watchdog - start the fault_reset_work_q
- * @ioc: pointer to scsi command object
+ * @ioc: per adapter object
  * Context: sleep.
  *
  * Return nothing.
@@ -155,7 +194,7 @@ mpt2sas_base_start_watchdog(struct MPT2SAS_ADAPTER *ioc)
 
 /**
  * mpt2sas_base_stop_watchdog - stop the fault_reset_work_q
- * @ioc: pointer to scsi command object
+ * @ioc: per adapter object
  * Context: sleep.
  *
  * Return nothing.
@@ -177,10 +216,55 @@ mpt2sas_base_stop_watchdog(struct MPT2SAS_ADAPTER *ioc)
 	}
 }
 
+/**
+ * mpt2sas_base_fault_info - verbose translation of firmware FAULT code
+ * @ioc: per adapter object
+ * @fault_code: fault code
+ *
+ * Return nothing.
+ */
+void
+mpt2sas_base_fault_info(struct MPT2SAS_ADAPTER *ioc , u16 fault_code)
+{
+	printk(MPT2SAS_ERR_FMT "fault_state(0x%04x)!\n",
+	    ioc->name, fault_code);
+}
+
+/**
+ * mpt2sas_halt_firmware - halt's mpt controller firmware
+ * @ioc: per adapter object
+ *
+ * For debugging timeout related issues.  Writing 0xCOFFEE00
+ * to the doorbell register will halt controller firmware. With
+ * the purpose to stop both driver and firmware, the enduser can
+ * obtain a ring buffer from controller UART.
+ */
+void
+mpt2sas_halt_firmware(struct MPT2SAS_ADAPTER *ioc)
+{
+	u32 doorbell;
+
+	if (!ioc->fwfault_debug)
+		return;
+
+	dump_stack();
+
+	doorbell = readl(&ioc->chip->Doorbell);
+	if ((doorbell & MPI2_IOC_STATE_MASK) == MPI2_IOC_STATE_FAULT)
+		mpt2sas_base_fault_info(ioc , doorbell);
+	else {
+		writel(0xC0FFEE00, &ioc->chip->Doorbell);
+		printk(MPT2SAS_ERR_FMT "Firmware is halted due to command "
+		    "timeout\n", ioc->name);
+	}
+
+	panic("panic in %s\n", __func__);
+}
+
 #ifdef CONFIG_SCSI_MPT2SAS_LOGGING
 /**
  * _base_sas_ioc_info - verbose translation of the ioc status
- * @ioc: pointer to scsi command object
+ * @ioc: per adapter object
  * @mpi_reply: reply mf payload returned from firmware
  * @request_hdr: request mf
  *
@@ -394,7 +478,7 @@ _base_sas_ioc_info(struct MPT2SAS_ADAPTER *ioc, MPI2DefaultReply_t *mpi_reply,
 
 /**
  * _base_display_event_data - verbose translation of firmware asyn events
- * @ioc: pointer to scsi command object
+ * @ioc: per adapter object
  * @mpi_reply: reply mf payload returned from firmware
  *
  * Return nothing.
@@ -474,7 +558,7 @@ _base_display_event_data(struct MPT2SAS_ADAPTER *ioc,
 
 /**
  * _base_sas_log_info - verbose translation of firmware log info
- * @ioc: pointer to scsi command object
+ * @ioc: per adapter object
  * @log_info: log info
  *
  * Return nothing.
@@ -526,22 +610,8 @@ _base_sas_log_info(struct MPT2SAS_ADAPTER *ioc , u32 log_info)
 }
 
 /**
- * mpt2sas_base_fault_info - verbose translation of firmware FAULT code
- * @ioc: pointer to scsi command object
- * @fault_code: fault code
- *
- * Return nothing.
- */
-void
-mpt2sas_base_fault_info(struct MPT2SAS_ADAPTER *ioc , u16 fault_code)
-{
-	printk(MPT2SAS_ERR_FMT "fault_state(0x%04x)!\n",
-	    ioc->name, fault_code);
-}
-
-/**
  * _base_display_reply_info -
- * @ioc: pointer to scsi command object
+ * @ioc: per adapter object
  * @smid: system request message index
  * @msix_index: MSIX table index supplied by the OS
  * @reply: reply message frame(lower 32bit addr)
@@ -570,7 +640,7 @@ _base_display_reply_info(struct MPT2SAS_ADAPTER *ioc, u16 smid, u8 msix_index,
 
 /**
  * mpt2sas_base_done - base internal command completion routine
- * @ioc: pointer to scsi command object
+ * @ioc: per adapter object
  * @smid: system request message index
  * @msix_index: MSIX table index supplied by the OS
  * @reply: reply message frame(lower 32bit addr)
@@ -603,7 +673,7 @@ mpt2sas_base_done(struct MPT2SAS_ADAPTER *ioc, u16 smid, u8 msix_index,
 
 /**
  * _base_async_event - main callback handler for firmware asyn events
- * @ioc: pointer to scsi command object
+ * @ioc: per adapter object
  * @msix_index: MSIX table index supplied by the OS
  * @reply: reply message frame(lower 32bit addr)
  *
@@ -684,7 +754,7 @@ _base_get_cb_idx(struct MPT2SAS_ADAPTER *ioc, u16 smid)
 
 /**
  * _base_mask_interrupts - disable interrupts
- * @ioc: pointer to scsi command object
+ * @ioc: per adapter object
  *
  * Disabling ResetIRQ, Reply and Doorbell Interrupts
  *
@@ -704,7 +774,7 @@ _base_mask_interrupts(struct MPT2SAS_ADAPTER *ioc)
 
 /**
  * _base_unmask_interrupts - enable interrupts
- * @ioc: pointer to scsi command object
+ * @ioc: per adapter object
  *
  * Enabling only Reply Interrupts
  *
@@ -1258,12 +1328,13 @@ mpt2sas_base_get_sense_buffer(struct MPT2SAS_ADAPTER *ioc, u16 smid)
  * @ioc: per adapter object
  * @smid: system request message index
  *
- * Returns phys pointer to sense buffer.
+ * Returns phys pointer to the low 32bit address of the sense buffer.
  */
-dma_addr_t
+__le32
 mpt2sas_base_get_sense_buffer_dma(struct MPT2SAS_ADAPTER *ioc, u16 smid)
 {
-	return ioc->sense_dma + ((smid - 1) * SCSI_SENSE_BUFFERSIZE);
+	return cpu_to_le32(ioc->sense_dma +
+			((smid - 1) * SCSI_SENSE_BUFFERSIZE));
 }
 
 /**
@@ -1697,6 +1768,12 @@ _base_display_ioc_capabilities(struct MPT2SAS_ADAPTER *ioc)
 	}
 
 	if (ioc->facts.IOCCapabilities &
+	    MPI2_IOCFACTS_CAPABILITY_EXTENDED_BUFFER) {
+		printk(KERN_INFO "%sDiag Extended Buffer", i ? "," : "");
+		i++;
+	}
+
+	if (ioc->facts.IOCCapabilities &
 	    MPI2_IOCFACTS_CAPABILITY_TASK_SET_FULL_HANDLING) {
 		printk("%sTask Set Full", i ? "," : "");
 		i++;
@@ -2871,6 +2948,8 @@ _base_send_ioc_init(struct MPT2SAS_ADAPTER *ioc, int sleep_flag)
 	Mpi2IOCInitRequest_t mpi_request;
 	Mpi2IOCInitReply_t mpi_reply;
 	int r;
+	struct timeval current_time;
+	u16 ioc_status;
 
 	dinitprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s\n", ioc->name,
 	    __func__));
@@ -2921,6 +3000,13 @@ _base_send_ioc_init(struct MPT2SAS_ADAPTER *ioc, int sleep_flag)
 	    cpu_to_le32(ioc->reply_post_free_dma);
 #endif
 
+	/* This time stamp specifies number of milliseconds
+	 * since epoch ~ midnight January 1, 1970.
+	 */
+	do_gettimeofday(&current_time);
+	mpi_request.TimeStamp = (current_time.tv_sec * 1000) +
+	    (current_time.tv_usec >> 3);
+
 	if (ioc->logging_level & MPT_DEBUG_INIT) {
 		u32 *mfp;
 		int i;
@@ -2943,7 +3029,8 @@ _base_send_ioc_init(struct MPT2SAS_ADAPTER *ioc, int sleep_flag)
 		return r;
 	}
 
-	if (mpi_reply.IOCStatus != MPI2_IOCSTATUS_SUCCESS ||
+	ioc_status = le16_to_cpu(mpi_reply.IOCStatus) & MPI2_IOCSTATUS_MASK;
+	if (ioc_status != MPI2_IOCSTATUS_SUCCESS ||
 	    mpi_reply.IOCLogInfo) {
 		printk(MPT2SAS_ERR_FMT "%s: failed\n", ioc->name, __func__);
 		r = -EIO;
@@ -3461,11 +3548,11 @@ mpt2sas_base_attach(struct MPT2SAS_ADAPTER *ioc)
 		return r;
 
 	pci_set_drvdata(ioc->pdev, ioc->shost);
-	r = _base_make_ioc_ready(ioc, CAN_SLEEP, SOFT_RESET);
+	r = _base_get_ioc_facts(ioc, CAN_SLEEP);
 	if (r)
 		goto out_free_resources;
 
-	r = _base_get_ioc_facts(ioc, CAN_SLEEP);
+	r = _base_make_ioc_ready(ioc, CAN_SLEEP, SOFT_RESET);
 	if (r)
 		goto out_free_resources;
 
@@ -3496,6 +3583,11 @@ mpt2sas_base_attach(struct MPT2SAS_ADAPTER *ioc)
 	ioc->transport_cmds.status = MPT2_CMD_NOT_USED;
 	mutex_init(&ioc->transport_cmds.mutex);
 
+	/* scsih internal command bits */
+	ioc->scsih_cmds.reply = kzalloc(ioc->reply_sz, GFP_KERNEL);
+	ioc->scsih_cmds.status = MPT2_CMD_NOT_USED;
+	mutex_init(&ioc->scsih_cmds.mutex);
+
 	/* task management internal command bits */
 	ioc->tm_cmds.reply = kzalloc(ioc->reply_sz, GFP_KERNEL);
 	ioc->tm_cmds.status = MPT2_CMD_NOT_USED;
@@ -3531,6 +3623,8 @@ mpt2sas_base_attach(struct MPT2SAS_ADAPTER *ioc)
 		goto out_free_resources;
 
 	mpt2sas_base_start_watchdog(ioc);
+	if (diag_buffer_enable != 0)
+		mpt2sas_enable_diag_buffer(ioc, diag_buffer_enable);
 	return 0;
 
  out_free_resources:
@@ -3684,6 +3778,9 @@ mpt2sas_base_hard_reset_handler(struct MPT2SAS_ADAPTER *ioc, int sleep_flag,
 	dtmprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s: enter\n", ioc->name,
 	    __func__));
 
+	if (mpt2sas_fwfault_debug)
+		mpt2sas_halt_firmware(ioc);
+
 	spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags);
 	if (ioc->shost_recovery) {
 		spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
diff --git a/drivers/scsi/mpt2sas/mpt2sas_base.h b/drivers/scsi/mpt2sas/mpt2sas_base.h
index 0cf6bc236e4d..bb4f14656afa 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_base.h
+++ b/drivers/scsi/mpt2sas/mpt2sas_base.h
@@ -69,8 +69,8 @@
 #define MPT2SAS_DRIVER_NAME		"mpt2sas"
 #define MPT2SAS_AUTHOR	"LSI Corporation <DL-MPTFusionLinux@lsi.com>"
 #define MPT2SAS_DESCRIPTION	"LSI MPT Fusion SAS 2.0 Device Driver"
-#define MPT2SAS_DRIVER_VERSION		"02.100.03.00"
-#define MPT2SAS_MAJOR_VERSION		02
+#define MPT2SAS_DRIVER_VERSION		"03.100.03.00"
+#define MPT2SAS_MAJOR_VERSION		03
 #define MPT2SAS_MINOR_VERSION		100
 #define MPT2SAS_BUILD_VERSION		03
 #define MPT2SAS_RELEASE_VERSION		00
@@ -278,7 +278,7 @@ struct _internal_cmd {
  * @sas_address: device sas address
  * @device_name: retrieved from the SAS IDENTIFY frame.
  * @handle: device handle
- * @parent_handle: handle to parent device
+ * @sas_address_parent: sas address of parent expander or sas host
  * @enclosure_handle: enclosure handle
  * @enclosure_logical_id: enclosure logical identifier
  * @volume_handle: volume handle (valid when hidden raid member)
@@ -296,7 +296,7 @@ struct _sas_device {
 	u64	sas_address;
 	u64	device_name;
 	u16	handle;
-	u16	parent_handle;
+	u64	sas_address_parent;
 	u16	enclosure_handle;
 	u64	enclosure_logical_id;
 	u16	volume_handle;
@@ -352,8 +352,6 @@ struct _boot_device {
 /**
  * struct _sas_port - wide/narrow sas port information
  * @port_list: list of ports belonging to expander
- * @handle: device handle for this port
- * @sas_address: sas address of this port
  * @num_phys: number of phys belonging to this port
  * @remote_identify: attached device identification
  * @rphy: sas transport rphy object
@@ -362,8 +360,6 @@ struct _boot_device {
  */
 struct _sas_port {
 	struct list_head port_list;
-	u16	handle;
-	u64	sas_address;
 	u8	num_phys;
 	struct sas_identify remote_identify;
 	struct sas_rphy *rphy;
@@ -398,7 +394,7 @@ struct _sas_phy {
  * @num_phys: number phys belonging to this sas_host/expander
  * @sas_address: sas address of this sas_host/expander
  * @handle: handle for this sas_host/expander
- * @parent_handle: parent handle
+ * @sas_address_parent: sas address of parent expander or sas host
  * @enclosure_handle: handle for this a member of an enclosure
  * @device_info: bitwise defining capabilities of this sas_host/expander
  * @responding: used in _scsih_expander_device_mark_responding
@@ -411,7 +407,7 @@ struct _sas_node {
 	u8	num_phys;
 	u64	sas_address;
 	u16	handle;
-	u16	parent_handle;
+	u64	sas_address_parent;
 	u16	enclosure_handle;
 	u64	enclosure_logical_id;
 	u8	responding;
@@ -470,6 +466,7 @@ typedef void (*MPT_ADD_SGE)(void *paddr, u32 flags_length, dma_addr_t dma_addr);
  * @chip_phys: physical addrss prior to mapping
  * @pio_chip: I/O mapped register space
  * @logging_level: see mpt2sas_debug.h
+ * @fwfault_debug: debuging FW timeouts
  * @ir_firmware: IR firmware present
  * @bars: bitmask of BAR's that must be configured
  * @mask_interrupts: ignore interrupt
@@ -495,12 +492,14 @@ typedef void (*MPT_ADD_SGE)(void *paddr, u32 flags_length, dma_addr_t dma_addr);
  * @msix_table_backup: backup msix table
  * @scsi_io_cb_idx: shost generated commands
  * @tm_cb_idx: task management commands
+ * @scsih_cb_idx: scsih internal commands
  * @transport_cb_idx: transport internal commands
  * @ctl_cb_idx: clt internal commands
  * @base_cb_idx: base internal commands
  * @config_cb_idx: base internal commands
  * @base_cmds:
  * @transport_cmds:
+ * @scsih_cmds:
  * @tm_cmds:
  * @ctl_cmds:
  * @config_cmds:
@@ -591,6 +590,7 @@ struct MPT2SAS_ADAPTER {
 	unsigned long	chip_phys;
 	unsigned long	pio_chip;
 	int		logging_level;
+	int		fwfault_debug;
 	u8		ir_firmware;
 	int		bars;
 	u8		mask_interrupts;
@@ -626,6 +626,7 @@ struct MPT2SAS_ADAPTER {
 	u8		scsi_io_cb_idx;
 	u8		tm_cb_idx;
 	u8		transport_cb_idx;
+	u8		scsih_cb_idx;
 	u8		ctl_cb_idx;
 	u8		base_cb_idx;
 	u8		config_cb_idx;
@@ -633,6 +634,7 @@ struct MPT2SAS_ADAPTER {
 	u8		tm_sas_control_cb_idx;
 	struct _internal_cmd base_cmds;
 	struct _internal_cmd transport_cmds;
+	struct _internal_cmd scsih_cmds;
 	struct _internal_cmd tm_cmds;
 	struct _internal_cmd ctl_cmds;
 	struct _internal_cmd config_cmds;
@@ -773,7 +775,7 @@ int mpt2sas_base_hard_reset_handler(struct MPT2SAS_ADAPTER *ioc, int sleep_flag,
 void *mpt2sas_base_get_msg_frame(struct MPT2SAS_ADAPTER *ioc, u16 smid);
 void *mpt2sas_base_get_sense_buffer(struct MPT2SAS_ADAPTER *ioc, u16 smid);
 void mpt2sas_base_build_zero_len_sge(struct MPT2SAS_ADAPTER *ioc, void *paddr);
-dma_addr_t mpt2sas_base_get_sense_buffer_dma(struct MPT2SAS_ADAPTER *ioc,
+__le32 mpt2sas_base_get_sense_buffer_dma(struct MPT2SAS_ADAPTER *ioc,
     u16 smid);
 
 /* hi-priority queue */
@@ -807,6 +809,8 @@ int mpt2sas_base_scsi_enclosure_processor(struct MPT2SAS_ADAPTER *ioc,
     Mpi2SepReply_t *mpi_reply, Mpi2SepRequest_t *mpi_request);
 void mpt2sas_base_validate_event_type(struct MPT2SAS_ADAPTER *ioc, u32 *event_type);
 
+void mpt2sas_halt_firmware(struct MPT2SAS_ADAPTER *ioc);
+
 /* scsih shared API */
 u8 mpt2sas_scsih_event_callback(struct MPT2SAS_ADAPTER *ioc, u8 msix_index,
     u32 reply);
@@ -886,19 +890,22 @@ u8 mpt2sas_ctl_event_callback(struct MPT2SAS_ADAPTER *ioc, u8 msix_index,
 void mpt2sas_ctl_add_to_event_log(struct MPT2SAS_ADAPTER *ioc,
     Mpi2EventNotificationReply_t *mpi_reply);
 
+void mpt2sas_enable_diag_buffer(struct MPT2SAS_ADAPTER *ioc,
+	u8 bits_to_regsiter);
+
 /* transport shared API */
 u8 mpt2sas_transport_done(struct MPT2SAS_ADAPTER *ioc, u16 smid, u8 msix_index,
     u32 reply);
 struct _sas_port *mpt2sas_transport_port_add(struct MPT2SAS_ADAPTER *ioc,
-    u16 handle, u16 parent_handle);
+     u16 handle, u64 sas_address);
 void mpt2sas_transport_port_remove(struct MPT2SAS_ADAPTER *ioc, u64 sas_address,
-    u16 parent_handle);
+     u64 sas_address_parent);
 int mpt2sas_transport_add_host_phy(struct MPT2SAS_ADAPTER *ioc, struct _sas_phy
     *mpt2sas_phy, Mpi2SasPhyPage0_t phy_pg0, struct device *parent_dev);
 int mpt2sas_transport_add_expander_phy(struct MPT2SAS_ADAPTER *ioc, struct _sas_phy
     *mpt2sas_phy, Mpi2ExpanderPage1_t expander_pg1, struct device *parent_dev);
-void mpt2sas_transport_update_links(struct MPT2SAS_ADAPTER *ioc, u16 handle,
-   u16 attached_handle, u8 phy_number, u8 link_rate);
+void mpt2sas_transport_update_links(struct MPT2SAS_ADAPTER *ioc,
+     u64 sas_address, u16 handle, u8 phy_number, u8 link_rate);
 extern struct sas_function_template mpt2sas_transport_functions;
 extern struct scsi_transport_template *mpt2sas_transport_template;
 extern int scsi_internal_device_block(struct scsi_device *sdev);
diff --git a/drivers/scsi/mpt2sas/mpt2sas_ctl.c b/drivers/scsi/mpt2sas/mpt2sas_ctl.c
index 57d724633906..84a124f8e21f 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_ctl.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_ctl.c
@@ -740,7 +740,7 @@ _ctl_do_mpt_command(struct MPT2SAS_ADAPTER *ioc,
 		Mpi2SCSIIORequest_t *scsiio_request =
 		    (Mpi2SCSIIORequest_t *)mpi_request;
 		scsiio_request->SenseBufferLowAddress =
-		    (u32)mpt2sas_base_get_sense_buffer_dma(ioc, smid);
+		    mpt2sas_base_get_sense_buffer_dma(ioc, smid);
 		priv_sense = mpt2sas_base_get_sense_buffer(ioc, smid);
 		memset(priv_sense, 0, SCSI_SENSE_BUFFERSIZE);
 		mpt2sas_base_put_smid_scsi_io(ioc, smid,
@@ -848,8 +848,9 @@ _ctl_do_mpt_command(struct MPT2SAS_ADAPTER *ioc,
 		printk(MPT2SAS_DEBUG_FMT "TASK_MGMT: "
 		    "IOCStatus(0x%04x), IOCLogInfo(0x%08x), "
 		    "TerminationCount(0x%08x)\n", ioc->name,
-		    tm_reply->IOCStatus, tm_reply->IOCLogInfo,
-		    tm_reply->TerminationCount);
+		    le16_to_cpu(tm_reply->IOCStatus),
+		    le32_to_cpu(tm_reply->IOCLogInfo),
+		    le32_to_cpu(tm_reply->TerminationCount));
 	}
 #endif
 	/* copy out xdata to user */
@@ -896,6 +897,7 @@ _ctl_do_mpt_command(struct MPT2SAS_ADAPTER *ioc,
 			printk(MPT2SAS_INFO_FMT "issue target reset: handle "
 			    "= (0x%04x)\n", ioc->name,
 			    mpi_request->FunctionDependent1);
+			mpt2sas_halt_firmware(ioc);
 			mutex_lock(&ioc->tm_cmds.mutex);
 			mpt2sas_scsih_issue_tm(ioc,
 			    mpi_request->FunctionDependent1, 0,
@@ -1229,7 +1231,7 @@ _ctl_btdh_mapping(void __user *arg)
 /**
  * _ctl_diag_capability - return diag buffer capability
  * @ioc: per adapter object
- * @buffer_type: specifies either TRACE or SNAPSHOT
+ * @buffer_type: specifies either TRACE, SNAPSHOT, or EXTENDED
  *
  * returns 1 when diag buffer support is enabled in firmware
  */
@@ -1249,24 +1251,25 @@ _ctl_diag_capability(struct MPT2SAS_ADAPTER *ioc, u8 buffer_type)
 		    MPI2_IOCFACTS_CAPABILITY_SNAPSHOT_BUFFER)
 			rc = 1;
 		break;
+	case MPI2_DIAG_BUF_TYPE_EXTENDED:
+		if (ioc->facts.IOCCapabilities &
+		    MPI2_IOCFACTS_CAPABILITY_EXTENDED_BUFFER)
+			rc = 1;
 	}
 
 	return rc;
 }
 
 /**
- * _ctl_diag_register - application register with driver
- * @arg - user space buffer containing ioctl content
- * @state - NON_BLOCKING or BLOCKING
+ * _ctl_diag_register_2 - wrapper for registering diag buffer support
+ * @ioc: per adapter object
+ * @diag_register: the diag_register struct passed in from user space
  *
- * This will allow the driver to setup any required buffers that will be
- * needed by firmware to communicate with the driver.
  */
 static long
-_ctl_diag_register(void __user *arg, enum block_state state)
+_ctl_diag_register_2(struct MPT2SAS_ADAPTER *ioc,
+    struct mpt2_diag_register *diag_register)
 {
-	struct mpt2_diag_register karg;
-	struct MPT2SAS_ADAPTER *ioc;
 	int rc, i;
 	void *request_data = NULL;
 	dma_addr_t request_data_dma;
@@ -1279,18 +1282,17 @@ _ctl_diag_register(void __user *arg, enum block_state state)
 	u16 ioc_status;
 	u8 issue_reset = 0;
 
-	if (copy_from_user(&karg, arg, sizeof(karg))) {
-		printk(KERN_ERR "failure at %s:%d/%s()!\n",
-		    __FILE__, __LINE__, __func__);
-		return -EFAULT;
-	}
-	if (_ctl_verify_adapter(karg.hdr.ioc_number, &ioc) == -1 || !ioc)
-		return -ENODEV;
-
 	dctlprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s\n", ioc->name,
 	    __func__));
 
-	buffer_type = karg.buffer_type;
+	if (ioc->ctl_cmds.status != MPT2_CMD_NOT_USED) {
+		printk(MPT2SAS_ERR_FMT "%s: ctl_cmd in use\n",
+		    ioc->name, __func__);
+		rc = -EAGAIN;
+		goto out;
+	}
+
+	buffer_type = diag_register->buffer_type;
 	if (!_ctl_diag_capability(ioc, buffer_type)) {
 		printk(MPT2SAS_ERR_FMT "%s: doesn't have capability for "
 		    "buffer_type(0x%02x)\n", ioc->name, __func__, buffer_type);
@@ -1305,24 +1307,12 @@ _ctl_diag_register(void __user *arg, enum block_state state)
 		return -EINVAL;
 	}
 
-	if (karg.requested_buffer_size % 4)  {
+	if (diag_register->requested_buffer_size % 4)  {
 		printk(MPT2SAS_ERR_FMT "%s: the requested_buffer_size "
 		    "is not 4 byte aligned\n", ioc->name, __func__);
 		return -EINVAL;
 	}
 
-	if (state == NON_BLOCKING && !mutex_trylock(&ioc->ctl_cmds.mutex))
-		return -EAGAIN;
-	else if (mutex_lock_interruptible(&ioc->ctl_cmds.mutex))
-		return -ERESTARTSYS;
-
-	if (ioc->ctl_cmds.status != MPT2_CMD_NOT_USED) {
-		printk(MPT2SAS_ERR_FMT "%s: ctl_cmd in use\n",
-		    ioc->name, __func__);
-		rc = -EAGAIN;
-		goto out;
-	}
-
 	smid = mpt2sas_base_get_smid(ioc, ioc->ctl_cb_idx);
 	if (!smid) {
 		printk(MPT2SAS_ERR_FMT "%s: failed obtaining a smid\n",
@@ -1338,12 +1328,12 @@ _ctl_diag_register(void __user *arg, enum block_state state)
 	ioc->ctl_cmds.smid = smid;
 
 	request_data = ioc->diag_buffer[buffer_type];
-	request_data_sz = karg.requested_buffer_size;
-	ioc->unique_id[buffer_type] = karg.unique_id;
+	request_data_sz = diag_register->requested_buffer_size;
+	ioc->unique_id[buffer_type] = diag_register->unique_id;
 	ioc->diag_buffer_status[buffer_type] = 0;
-	memcpy(ioc->product_specific[buffer_type], karg.product_specific,
-	    MPT2_PRODUCT_SPECIFIC_DWORDS);
-	ioc->diagnostic_flags[buffer_type] = karg.diagnostic_flags;
+	memcpy(ioc->product_specific[buffer_type],
+	    diag_register->product_specific, MPT2_PRODUCT_SPECIFIC_DWORDS);
+	ioc->diagnostic_flags[buffer_type] = diag_register->diagnostic_flags;
 
 	if (request_data) {
 		request_data_dma = ioc->diag_buffer_dma[buffer_type];
@@ -1373,8 +1363,8 @@ _ctl_diag_register(void __user *arg, enum block_state state)
 	}
 
 	mpi_request->Function = MPI2_FUNCTION_DIAG_BUFFER_POST;
-	mpi_request->BufferType = karg.buffer_type;
-	mpi_request->Flags = cpu_to_le32(karg.diagnostic_flags);
+	mpi_request->BufferType = diag_register->buffer_type;
+	mpi_request->Flags = cpu_to_le32(diag_register->diagnostic_flags);
 	mpi_request->BufferAddress = cpu_to_le64(request_data_dma);
 	mpi_request->BufferLength = cpu_to_le32(request_data_sz);
 	mpi_request->VF_ID = 0; /* TODO */
@@ -1422,7 +1412,7 @@ _ctl_diag_register(void __user *arg, enum block_state state)
 	} else {
 		printk(MPT2SAS_DEBUG_FMT "%s: ioc_status(0x%04x) "
 		    "log_info(0x%08x)\n", ioc->name, __func__,
-		    ioc_status, mpi_reply->IOCLogInfo);
+		    ioc_status, le32_to_cpu(mpi_reply->IOCLogInfo));
 		rc = -EFAULT;
 	}
 
@@ -1438,6 +1428,83 @@ _ctl_diag_register(void __user *arg, enum block_state state)
 		    request_data, request_data_dma);
 
 	ioc->ctl_cmds.status = MPT2_CMD_NOT_USED;
+	return rc;
+}
+
+/**
+ * mpt2sas_enable_diag_buffer - enabling diag_buffers support driver load time
+ * @ioc: per adapter object
+ * @bits_to_register: bitwise field where trace is bit 0, and snapshot is bit 1
+ *
+ * This is called when command line option diag_buffer_enable is enabled
+ * at driver load time.
+ */
+void
+mpt2sas_enable_diag_buffer(struct MPT2SAS_ADAPTER *ioc, u8 bits_to_register)
+{
+	struct mpt2_diag_register diag_register;
+
+	memset(&diag_register, 0, sizeof(struct mpt2_diag_register));
+
+	if (bits_to_register & 1) {
+		printk(MPT2SAS_INFO_FMT "registering trace buffer support\n",
+		    ioc->name);
+		diag_register.buffer_type = MPI2_DIAG_BUF_TYPE_TRACE;
+		/* register for 1MB buffers  */
+		diag_register.requested_buffer_size = (1024 * 1024);
+		diag_register.unique_id = 0x7075900;
+		_ctl_diag_register_2(ioc,  &diag_register);
+	}
+
+	if (bits_to_register & 2) {
+		printk(MPT2SAS_INFO_FMT "registering snapshot buffer support\n",
+		    ioc->name);
+		diag_register.buffer_type = MPI2_DIAG_BUF_TYPE_SNAPSHOT;
+		/* register for 2MB buffers  */
+		diag_register.requested_buffer_size = 2 * (1024 * 1024);
+		diag_register.unique_id = 0x7075901;
+		_ctl_diag_register_2(ioc,  &diag_register);
+	}
+
+	if (bits_to_register & 4) {
+		printk(MPT2SAS_INFO_FMT "registering extended buffer support\n",
+		    ioc->name);
+		diag_register.buffer_type = MPI2_DIAG_BUF_TYPE_EXTENDED;
+		/* register for 2MB buffers  */
+		diag_register.requested_buffer_size = 2 * (1024 * 1024);
+		diag_register.unique_id = 0x7075901;
+		_ctl_diag_register_2(ioc,  &diag_register);
+	}
+}
+
+/**
+ * _ctl_diag_register - application register with driver
+ * @arg - user space buffer containing ioctl content
+ * @state - NON_BLOCKING or BLOCKING
+ *
+ * This will allow the driver to setup any required buffers that will be
+ * needed by firmware to communicate with the driver.
+ */
+static long
+_ctl_diag_register(void __user *arg, enum block_state state)
+{
+	struct mpt2_diag_register karg;
+	struct MPT2SAS_ADAPTER *ioc;
+	long rc;
+
+	if (copy_from_user(&karg, arg, sizeof(karg))) {
+		printk(KERN_ERR "failure at %s:%d/%s()!\n",
+		    __FILE__, __LINE__, __func__);
+		return -EFAULT;
+	}
+	if (_ctl_verify_adapter(karg.hdr.ioc_number, &ioc) == -1 || !ioc)
+		return -ENODEV;
+
+	if (state == NON_BLOCKING && !mutex_trylock(&ioc->ctl_cmds.mutex))
+		return -EAGAIN;
+	else if (mutex_lock_interruptible(&ioc->ctl_cmds.mutex))
+		return -ERESTARTSYS;
+	rc = _ctl_diag_register_2(ioc, &karg);
 	mutex_unlock(&ioc->ctl_cmds.mutex);
 	return rc;
 }
@@ -1600,7 +1667,7 @@ _ctl_diag_query(void __user *arg)
 /**
  * _ctl_send_release - Diag Release Message
  * @ioc: per adapter object
- * @buffer_type - specifies either TRACE or SNAPSHOT
+ * @buffer_type - specifies either TRACE, SNAPSHOT, or EXTENDED
  * @issue_reset - specifies whether host reset is required.
  *
  */
@@ -1690,7 +1757,7 @@ _ctl_send_release(struct MPT2SAS_ADAPTER *ioc, u8 buffer_type, u8 *issue_reset)
 	} else {
 		printk(MPT2SAS_DEBUG_FMT "%s: ioc_status(0x%04x) "
 		    "log_info(0x%08x)\n", ioc->name, __func__,
-		    ioc_status, mpi_reply->IOCLogInfo);
+		    ioc_status, le32_to_cpu(mpi_reply->IOCLogInfo));
 		rc = -EFAULT;
 	}
 
@@ -1951,7 +2018,7 @@ _ctl_diag_read_buffer(void __user *arg, enum block_state state)
 	} else {
 		printk(MPT2SAS_DEBUG_FMT "%s: ioc_status(0x%04x) "
 		    "log_info(0x%08x)\n", ioc->name, __func__,
-		    ioc_status, mpi_reply->IOCLogInfo);
+		    ioc_status, le32_to_cpu(mpi_reply->IOCLogInfo));
 		rc = -EFAULT;
 	}
 
@@ -2474,6 +2541,43 @@ _ctl_logging_level_store(struct device *cdev, struct device_attribute *attr,
 static DEVICE_ATTR(logging_level, S_IRUGO | S_IWUSR,
     _ctl_logging_level_show, _ctl_logging_level_store);
 
+/* device attributes */
+/*
+ * _ctl_fwfault_debug_show - show/store fwfault_debug
+ * @cdev - pointer to embedded class device
+ * @buf - the buffer returned
+ *
+ * mpt2sas_fwfault_debug is command line option
+ * A sysfs 'read/write' shost attribute.
+ */
+static ssize_t
+_ctl_fwfault_debug_show(struct device *cdev,
+    struct device_attribute *attr, char *buf)
+{
+	struct Scsi_Host *shost = class_to_shost(cdev);
+	struct MPT2SAS_ADAPTER *ioc = shost_priv(shost);
+
+	return snprintf(buf, PAGE_SIZE, "%d\n", ioc->fwfault_debug);
+}
+static ssize_t
+_ctl_fwfault_debug_store(struct device *cdev,
+    struct device_attribute *attr, const char *buf, size_t count)
+{
+	struct Scsi_Host *shost = class_to_shost(cdev);
+	struct MPT2SAS_ADAPTER *ioc = shost_priv(shost);
+	int val = 0;
+
+	if (sscanf(buf, "%d", &val) != 1)
+		return -EINVAL;
+
+	ioc->fwfault_debug = val;
+	printk(MPT2SAS_INFO_FMT "fwfault_debug=%d\n", ioc->name,
+	    ioc->fwfault_debug);
+	return strlen(buf);
+}
+static DEVICE_ATTR(fwfault_debug, S_IRUGO | S_IWUSR,
+    _ctl_fwfault_debug_show, _ctl_fwfault_debug_store);
+
 struct device_attribute *mpt2sas_host_attrs[] = {
 	&dev_attr_version_fw,
 	&dev_attr_version_bios,
@@ -2487,13 +2591,12 @@ struct device_attribute *mpt2sas_host_attrs[] = {
 	&dev_attr_io_delay,
 	&dev_attr_device_delay,
 	&dev_attr_logging_level,
+	&dev_attr_fwfault_debug,
 	&dev_attr_fw_queue_depth,
 	&dev_attr_host_sas_address,
 	NULL,
 };
 
-/* device attributes */
-
 /**
  * _ctl_device_sas_address_show - sas address
  * @cdev - pointer to embedded class device
diff --git a/drivers/scsi/mpt2sas/mpt2sas_ctl.h b/drivers/scsi/mpt2sas/mpt2sas_ctl.h
index 211f296dd191..8a5eeb1a5c84 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_ctl.h
+++ b/drivers/scsi/mpt2sas/mpt2sas_ctl.h
@@ -313,7 +313,7 @@ struct mpt2_ioctl_btdh_mapping {
  * struct mpt2_diag_register - application register with driver
  * @hdr - generic header
  * @reserved -
- * @buffer_type - specifies either TRACE or SNAPSHOT
+ * @buffer_type - specifies either TRACE, SNAPSHOT, or EXTENDED
  * @application_flags - misc flags
  * @diagnostic_flags - specifies flags affecting command processing
  * @product_specific - product specific information
@@ -352,7 +352,7 @@ struct mpt2_diag_unregister {
  * struct mpt2_diag_query - query relevant info associated with diag buffers
  * @hdr - generic header
  * @reserved -
- * @buffer_type - specifies either TRACE or SNAPSHOT
+ * @buffer_type - specifies either TRACE, SNAPSHOT, or EXTENDED
  * @application_flags - misc flags
  * @diagnostic_flags - specifies flags affecting command processing
  * @product_specific - product specific information
diff --git a/drivers/scsi/mpt2sas/mpt2sas_scsih.c b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
index 86ab32d7ab15..efabea1a3ce4 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
@@ -76,6 +76,7 @@ static u8 tm_cb_idx = -1;
 static u8 ctl_cb_idx = -1;
 static u8 base_cb_idx = -1;
 static u8 transport_cb_idx = -1;
+static u8 scsih_cb_idx = -1;
 static u8 config_cb_idx = -1;
 static int mpt_ids;
 
@@ -196,10 +197,28 @@ static struct pci_device_id scsih_pci_table[] = {
 		PCI_ANY_ID, PCI_ANY_ID },
 	{ MPI2_MFGPAGE_VENDORID_LSI, MPI2_MFGPAGE_DEVID_SAS2108_3,
 		PCI_ANY_ID, PCI_ANY_ID },
+	/* Meteor ~ 2116 */
 	{ MPI2_MFGPAGE_VENDORID_LSI, MPI2_MFGPAGE_DEVID_SAS2116_1,
 		PCI_ANY_ID, PCI_ANY_ID },
 	{ MPI2_MFGPAGE_VENDORID_LSI, MPI2_MFGPAGE_DEVID_SAS2116_2,
 		PCI_ANY_ID, PCI_ANY_ID },
+	/* Thunderbolt ~ 2208 */
+	{ MPI2_MFGPAGE_VENDORID_LSI, MPI2_MFGPAGE_DEVID_SAS2208_1,
+		PCI_ANY_ID, PCI_ANY_ID },
+	{ MPI2_MFGPAGE_VENDORID_LSI, MPI2_MFGPAGE_DEVID_SAS2208_2,
+		PCI_ANY_ID, PCI_ANY_ID },
+	{ MPI2_MFGPAGE_VENDORID_LSI, MPI2_MFGPAGE_DEVID_SAS2208_3,
+		PCI_ANY_ID, PCI_ANY_ID },
+	{ MPI2_MFGPAGE_VENDORID_LSI, MPI2_MFGPAGE_DEVID_SAS2208_4,
+		PCI_ANY_ID, PCI_ANY_ID },
+	{ MPI2_MFGPAGE_VENDORID_LSI, MPI2_MFGPAGE_DEVID_SAS2208_5,
+		PCI_ANY_ID, PCI_ANY_ID },
+	{ MPI2_MFGPAGE_VENDORID_LSI, MPI2_MFGPAGE_DEVID_SAS2208_6,
+		PCI_ANY_ID, PCI_ANY_ID },
+	{ MPI2_MFGPAGE_VENDORID_LSI, MPI2_MFGPAGE_DEVID_SAS2208_7,
+		PCI_ANY_ID, PCI_ANY_ID },
+	{ MPI2_MFGPAGE_VENDORID_LSI, MPI2_MFGPAGE_DEVID_SAS2208_8,
+		PCI_ANY_ID, PCI_ANY_ID },
 	{0}	/* Terminating entry */
 };
 MODULE_DEVICE_TABLE(pci, scsih_pci_table);
@@ -317,6 +336,47 @@ _scsih_is_boot_device(u64 sas_address, u64 device_name,
 }
 
 /**
+ * _scsih_get_sas_address - set the sas_address for given device handle
+ * @handle: device handle
+ * @sas_address: sas address
+ *
+ * Returns 0 success, non-zero when failure
+ */
+static int
+_scsih_get_sas_address(struct MPT2SAS_ADAPTER *ioc, u16 handle,
+    u64 *sas_address)
+{
+	Mpi2SasDevicePage0_t sas_device_pg0;
+	Mpi2ConfigReply_t mpi_reply;
+	u32 ioc_status;
+
+	if (handle <= ioc->sas_hba.num_phys) {
+		*sas_address = ioc->sas_hba.sas_address;
+		return 0;
+	} else
+		*sas_address = 0;
+
+	if ((mpt2sas_config_get_sas_device_pg0(ioc, &mpi_reply, &sas_device_pg0,
+	    MPI2_SAS_DEVICE_PGAD_FORM_HANDLE, handle))) {
+		printk(MPT2SAS_ERR_FMT "failure at %s:%d/%s()!\n",
+		    ioc->name, __FILE__, __LINE__, __func__);
+		return -ENXIO;
+	}
+
+	ioc_status = le16_to_cpu(mpi_reply.IOCStatus) &
+	    MPI2_IOCSTATUS_MASK;
+	if (ioc_status != MPI2_IOCSTATUS_SUCCESS) {
+		printk(MPT2SAS_ERR_FMT "handle(0x%04x), ioc_status(0x%04x)"
+		    "\nfailure at %s:%d/%s()!\n", ioc->name, handle, ioc_status,
+		     __FILE__, __LINE__, __func__);
+		return -EIO;
+	}
+
+	*sas_address = le64_to_cpu(sas_device_pg0.SASAddress);
+	return 0;
+}
+
+/**
  * _scsih_determine_boot_device - determine boot device.
  * @ioc: per adapter object
  * @device: either sas_device or raid_device object
@@ -510,8 +570,6 @@ _scsih_sas_device_add(struct MPT2SAS_ADAPTER *ioc,
     struct _sas_device *sas_device)
 {
 	unsigned long flags;
-	u16 handle, parent_handle;
-	u64 sas_address;
 
 	dewtprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s: handle"
 	    "(0x%04x), sas_addr(0x%016llx)\n", ioc->name, __func__,
@@ -521,10 +579,8 @@ _scsih_sas_device_add(struct MPT2SAS_ADAPTER *ioc,
 	list_add_tail(&sas_device->list, &ioc->sas_device_list);
 	spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
 
-	handle = sas_device->handle;
-	parent_handle = sas_device->parent_handle;
-	sas_address = sas_device->sas_address;
-	if (!mpt2sas_transport_port_add(ioc, handle, parent_handle))
+	if (!mpt2sas_transport_port_add(ioc, sas_device->handle,
+	     sas_device->sas_address_parent))
 		_scsih_sas_device_remove(ioc, sas_device);
 }
 
@@ -553,31 +609,6 @@ _scsih_sas_device_init_add(struct MPT2SAS_ADAPTER *ioc,
 }
 
 /**
- * mpt2sas_scsih_expander_find_by_handle - expander device search
- * @ioc: per adapter object
- * @handle: expander handle (assigned by firmware)
- * Context: Calling function should acquire ioc->sas_device_lock
- *
- * This searches for expander device based on handle, then returns the
- * sas_node object.
- */
-struct _sas_node *
-mpt2sas_scsih_expander_find_by_handle(struct MPT2SAS_ADAPTER *ioc, u16 handle)
-{
-	struct _sas_node *sas_expander, *r;
-
-	r = NULL;
-	list_for_each_entry(sas_expander, &ioc->sas_expander_list, list) {
-		if (sas_expander->handle != handle)
-			continue;
-		r = sas_expander;
-		goto out;
-	}
- out:
-	return r;
-}
-
-/**
  * _scsih_raid_device_find_by_id - raid device search
  * @ioc: per adapter object
  * @id: sas device target id
@@ -699,6 +730,31 @@ _scsih_raid_device_remove(struct MPT2SAS_ADAPTER *ioc,
 }
 
 /**
+ * mpt2sas_scsih_expander_find_by_handle - expander device search
+ * @ioc: per adapter object
+ * @handle: expander handle (assigned by firmware)
+ * Context: Calling function should acquire ioc->sas_device_lock
+ *
+ * This searches for expander device based on handle, then returns the
+ * sas_node object.
+ */
+struct _sas_node *
+mpt2sas_scsih_expander_find_by_handle(struct MPT2SAS_ADAPTER *ioc, u16 handle)
+{
+	struct _sas_node *sas_expander, *r;
+
+	r = NULL;
+	list_for_each_entry(sas_expander, &ioc->sas_expander_list, list) {
+		if (sas_expander->handle != handle)
+			continue;
+		r = sas_expander;
+		goto out;
+	}
+ out:
+	return r;
+}
+
+/**
  * mpt2sas_scsih_expander_find_by_sas_address - expander device search
  * @ioc: per adapter object
  * @sas_address: sas address
@@ -1043,17 +1099,46 @@ _scsih_build_scatter_gather(struct MPT2SAS_ADAPTER *ioc,
  * _scsih_change_queue_depth - setting device queue depth
  * @sdev: scsi device struct
  * @qdepth: requested queue depth
+ * @reason: calling context
  *
  * Returns queue depth.
  */
 static int
-_scsih_change_queue_depth(struct scsi_device *sdev, int qdepth)
+_scsih_change_queue_depth(struct scsi_device *sdev, int qdepth, int reason)
 {
 	struct Scsi_Host *shost = sdev->host;
 	int max_depth;
 	int tag_type;
+	struct MPT2SAS_ADAPTER *ioc = shost_priv(shost);
+	struct MPT2SAS_DEVICE *sas_device_priv_data;
+	struct MPT2SAS_TARGET *sas_target_priv_data;
+	struct _sas_device *sas_device;
+	unsigned long flags;
+
+	if (reason != SCSI_QDEPTH_DEFAULT)
+		return -EOPNOTSUPP;
 
 	max_depth = shost->can_queue;
+
+	/* limit max device queue for SATA to 32 */
+	sas_device_priv_data = sdev->hostdata;
+	if (!sas_device_priv_data)
+		goto not_sata;
+	sas_target_priv_data = sas_device_priv_data->sas_target;
+	if (!sas_target_priv_data)
+		goto not_sata;
+	if ((sas_target_priv_data->flags & MPT_TARGET_FLAGS_VOLUME))
+		goto not_sata;
+	spin_lock_irqsave(&ioc->sas_device_lock, flags);
+	sas_device = mpt2sas_scsih_sas_device_find_by_sas_address(ioc,
+	   sas_device_priv_data->sas_target->sas_address);
+	spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
+	if (sas_device && sas_device->device_info &
+	    MPI2_SAS_DEVICE_INFO_SATA_DEVICE)
+		max_depth = MPT2SAS_SATA_QUEUE_DEPTH;
+
+ not_sata:
+
 	if (!sdev->tagged_supported)
 		max_depth = 1;
 	if (qdepth > max_depth)
@@ -1488,7 +1573,7 @@ _scsih_slave_configure(struct scsi_device *sdev)
 		    r_level, raid_device->handle,
 		    (unsigned long long)raid_device->wwid,
 		    raid_device->num_pds, ds);
-		_scsih_change_queue_depth(sdev, qdepth);
+		_scsih_change_queue_depth(sdev, qdepth, SCSI_QDEPTH_DEFAULT);
 		return 0;
 	}
 
@@ -1534,7 +1619,7 @@ _scsih_slave_configure(struct scsi_device *sdev)
 			_scsih_display_sata_capabilities(ioc, sas_device, sdev);
 	}
 
-	_scsih_change_queue_depth(sdev, qdepth);
+	_scsih_change_queue_depth(sdev, qdepth, SCSI_QDEPTH_DEFAULT);
 
 	if (ssp_target)
 		sas_read_port_mode_page(sdev);
@@ -1874,6 +1959,8 @@ _scsih_abort(struct scsi_cmnd *scmd)
 		goto out;
 	}
 
+	mpt2sas_halt_firmware(ioc);
+
 	mutex_lock(&ioc->tm_cmds.mutex);
 	handle = sas_device_priv_data->sas_target->handle;
 	mpt2sas_scsih_issue_tm(ioc, handle, sas_device_priv_data->lun,
@@ -2297,7 +2384,6 @@ _scsih_block_io_to_children_attached_directly(struct MPT2SAS_ADAPTER *ioc,
 	u16 handle;
 	u16 reason_code;
 	u8 phy_number;
-	u8 link_rate;
 
 	for (i = 0; i < event_data->NumEntries; i++) {
 		handle = le16_to_cpu(event_data->PHY[i].AttachedDevHandle);
@@ -2308,11 +2394,6 @@ _scsih_block_io_to_children_attached_directly(struct MPT2SAS_ADAPTER *ioc,
 		    MPI2_EVENT_SAS_TOPO_RC_MASK;
 		if (reason_code == MPI2_EVENT_SAS_TOPO_RC_DELAY_NOT_RESPONDING)
 			_scsih_block_io_device(ioc, handle);
-		if (reason_code == MPI2_EVENT_SAS_TOPO_RC_PHY_CHANGED) {
-			link_rate = event_data->PHY[i].LinkRate >> 4;
-			if (link_rate >= MPI2_SAS_NEG_LINK_RATE_1_5)
-				_scsih_ublock_io_device(ioc, handle);
-		}
 	}
 }
 
@@ -2349,16 +2430,10 @@ _scsih_tm_tr_send(struct MPT2SAS_ADAPTER *ioc, u16 handle)
 
 	spin_lock_irqsave(&ioc->sas_device_lock, flags);
 	sas_device = _scsih_sas_device_find_by_handle(ioc, handle);
-	if (!sas_device) {
-		spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
-		printk(MPT2SAS_ERR_FMT "%s: failed finding sas_device\n",
-		    ioc->name, __func__);
-		return;
-	}
 	spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
 
 	/* skip is hidden raid component */
-	if (sas_device->hidden_raid_component)
+	if (sas_device && sas_device->hidden_raid_component)
 		return;
 
 	smid = mpt2sas_base_get_smid_hpr(ioc, ioc->tm_tr_cb_idx);
@@ -2371,18 +2446,31 @@ _scsih_tm_tr_send(struct MPT2SAS_ADAPTER *ioc, u16 handle)
 		delayed_tr->state = MPT2SAS_REQ_SAS_CNTRL;
 		list_add_tail(&delayed_tr->list,
 		    &ioc->delayed_tr_list);
-		if (sas_device->starget)
+		if (sas_device && sas_device->starget) {
 			dewtprintk(ioc, starget_printk(KERN_INFO,
 			    sas_device->starget, "DELAYED:tr:handle(0x%04x), "
-			    "(open)\n", sas_device->handle));
+			    "(open)\n", handle));
+		} else {
+			dewtprintk(ioc, printk(MPT2SAS_INFO_FMT
+			    "DELAYED:tr:handle(0x%04x), (open)\n",
+			    ioc->name, handle));
+		}
 		return;
 	}
 
-	if (sas_device->starget && sas_device->starget->hostdata) {
-		sas_target_priv_data = sas_device->starget->hostdata;
-		sas_target_priv_data->tm_busy = 1;
-		dewtprintk(ioc, starget_printk(KERN_INFO, sas_device->starget,
-		    "tr:handle(0x%04x), (open)\n", sas_device->handle));
+	if (sas_device) {
+		sas_device->state |= MPTSAS_STATE_TR_SEND;
+		sas_device->state |= MPT2SAS_REQ_SAS_CNTRL;
+		if (sas_device->starget && sas_device->starget->hostdata) {
+			sas_target_priv_data = sas_device->starget->hostdata;
+			sas_target_priv_data->tm_busy = 1;
+			dewtprintk(ioc, starget_printk(KERN_INFO,
+			    sas_device->starget, "tr:handle(0x%04x), (open)\n",
+			    handle));
+		}
+	} else {
+		dewtprintk(ioc, printk(MPT2SAS_INFO_FMT
+		    "tr:handle(0x%04x), (open)\n", ioc->name, handle));
 	}
 
 	mpi_request = mpt2sas_base_get_msg_frame(ioc, smid);
@@ -2390,8 +2478,6 @@ _scsih_tm_tr_send(struct MPT2SAS_ADAPTER *ioc, u16 handle)
 	mpi_request->Function = MPI2_FUNCTION_SCSI_TASK_MGMT;
 	mpi_request->DevHandle = cpu_to_le16(handle);
 	mpi_request->TaskType = MPI2_SCSITASKMGMT_TASKTYPE_TARGET_RESET;
-	sas_device->state |= MPTSAS_STATE_TR_SEND;
-	sas_device->state |= MPT2SAS_REQ_SAS_CNTRL;
 	mpt2sas_base_put_smid_hi_priority(ioc, smid);
 }
 
@@ -2426,21 +2512,25 @@ _scsih_sas_control_complete(struct MPT2SAS_ADAPTER *ioc, u16 smid,
 
 	spin_lock_irqsave(&ioc->sas_device_lock, flags);
 	sas_device = _scsih_sas_device_find_by_handle(ioc, handle);
-	if (!sas_device) {
-		spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
-		printk(MPT2SAS_ERR_FMT "%s: failed finding sas_device\n",
-		    ioc->name, __func__);
-		return 1;
-	}
-	sas_device->state |= MPTSAS_STATE_CNTRL_COMPLETE;
 	spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
 
-	if (sas_device->starget)
-		dewtprintk(ioc, starget_printk(KERN_INFO, sas_device->starget,
+	if (sas_device) {
+		sas_device->state |= MPTSAS_STATE_CNTRL_COMPLETE;
+		if (sas_device->starget)
+			dewtprintk(ioc, starget_printk(KERN_INFO,
+			    sas_device->starget,
+			    "sc_complete:handle(0x%04x), "
+			    "ioc_status(0x%04x), loginfo(0x%08x)\n",
+			    handle, le16_to_cpu(mpi_reply->IOCStatus),
+			    le32_to_cpu(mpi_reply->IOCLogInfo)));
+	} else {
+		dewtprintk(ioc, printk(MPT2SAS_INFO_FMT
 		    "sc_complete:handle(0x%04x), "
 		    "ioc_status(0x%04x), loginfo(0x%08x)\n",
-		    handle, le16_to_cpu(mpi_reply->IOCStatus),
+		    ioc->name, handle, le16_to_cpu(mpi_reply->IOCStatus),
 		    le32_to_cpu(mpi_reply->IOCLogInfo)));
+	}
+
 	return 1;
 }
 
@@ -2478,28 +2568,33 @@ _scsih_tm_tr_complete(struct MPT2SAS_ADAPTER *ioc, u16 smid, u8 msix_index,
 	handle = le16_to_cpu(mpi_reply->DevHandle);
 	spin_lock_irqsave(&ioc->sas_device_lock, flags);
 	sas_device = _scsih_sas_device_find_by_handle(ioc, handle);
-	if (!sas_device) {
-		spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
-		printk(MPT2SAS_ERR_FMT "%s: failed finding sas_device\n",
-		    ioc->name, __func__);
-		return 1;
-	}
-	sas_device->state |= MPTSAS_STATE_TR_COMPLETE;
 	spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
 
-	if (sas_device->starget)
-		dewtprintk(ioc, starget_printk(KERN_INFO, sas_device->starget,
-		    "tr_complete:handle(0x%04x), (%s) ioc_status(0x%04x), "
-		    "loginfo(0x%08x), completed(%d)\n",
-		    sas_device->handle, (sas_device->state &
-		    MPT2SAS_REQ_SAS_CNTRL) ? "open" : "active",
-		    le16_to_cpu(mpi_reply->IOCStatus),
+	if (sas_device) {
+		sas_device->state |= MPTSAS_STATE_TR_COMPLETE;
+		if (sas_device->starget) {
+			dewtprintk(ioc, starget_printk(KERN_INFO,
+			    sas_device->starget, "tr_complete:handle(0x%04x), "
+			    "(%s) ioc_status(0x%04x), loginfo(0x%08x), "
+			    "completed(%d)\n", sas_device->handle,
+			    (sas_device->state & MPT2SAS_REQ_SAS_CNTRL) ?
+			    "open" : "active",
+			    le16_to_cpu(mpi_reply->IOCStatus),
+			    le32_to_cpu(mpi_reply->IOCLogInfo),
+			    le32_to_cpu(mpi_reply->TerminationCount)));
+			if (sas_device->starget->hostdata) {
+				sas_target_priv_data =
+				    sas_device->starget->hostdata;
+				sas_target_priv_data->tm_busy = 0;
+			}
+		}
+	} else {
+		dewtprintk(ioc, printk(MPT2SAS_INFO_FMT
+		    "tr_complete:handle(0x%04x), (open) ioc_status(0x%04x), "
+		    "loginfo(0x%08x), completed(%d)\n", ioc->name,
+		    handle, le16_to_cpu(mpi_reply->IOCStatus),
 		    le32_to_cpu(mpi_reply->IOCLogInfo),
 		    le32_to_cpu(mpi_reply->TerminationCount)));
-
-	if (sas_device->starget && sas_device->starget->hostdata) {
-		sas_target_priv_data = sas_device->starget->hostdata;
-		sas_target_priv_data->tm_busy = 0;
 	}
 
 	if (!list_empty(&ioc->delayed_tr_list)) {
@@ -2514,8 +2609,7 @@ _scsih_tm_tr_complete(struct MPT2SAS_ADAPTER *ioc, u16 smid, u8 msix_index,
 	} else
 		rc = 1;
 
-
-	if (!(sas_device->state & MPT2SAS_REQ_SAS_CNTRL))
+	if (sas_device && !(sas_device->state & MPT2SAS_REQ_SAS_CNTRL))
 		return rc;
 
 	if (ioc->shost_recovery) {
@@ -2531,12 +2625,14 @@ _scsih_tm_tr_complete(struct MPT2SAS_ADAPTER *ioc, u16 smid, u8 msix_index,
 		return rc;
 	}
 
+	if (sas_device)
+		sas_device->state |= MPTSAS_STATE_CNTRL_SEND;
+
 	mpi_request = mpt2sas_base_get_msg_frame(ioc, smid_sas_ctrl);
 	memset(mpi_request, 0, sizeof(Mpi2SasIoUnitControlRequest_t));
 	mpi_request->Function = MPI2_FUNCTION_SAS_IO_UNIT_CONTROL;
 	mpi_request->Operation = MPI2_SAS_OP_REMOVE_DEVICE;
 	mpi_request->DevHandle = mpi_reply->DevHandle;
-	sas_device->state |= MPTSAS_STATE_CNTRL_SEND;
 	mpt2sas_base_put_smid_default(ioc, smid_sas_ctrl);
 	return rc;
 }
@@ -2678,8 +2774,6 @@ _scsih_setup_eedp(struct scsi_cmnd *scmd, Mpi2SCSIIORequest_t *mpi_request)
 	else
 		return;
 
-	mpi_request->EEDPBlockSize = scmd->device->sector_size;
-
 	switch (prot_type) {
 	case SCSI_PROT_DIF_TYPE1:
 
@@ -2687,8 +2781,7 @@ _scsih_setup_eedp(struct scsi_cmnd *scmd, Mpi2SCSIIORequest_t *mpi_request)
 		* enable ref/guard checking
 		* auto increment ref tag
 		*/
-		mpi_request->EEDPFlags = eedp_flags |
-		    MPI2_SCSIIO_EEDPFLAGS_INC_PRI_REFTAG |
+		eedp_flags |= MPI2_SCSIIO_EEDPFLAGS_INC_PRI_REFTAG |
 		    MPI2_SCSIIO_EEDPFLAGS_CHECK_REFTAG |
 		    MPI2_SCSIIO_EEDPFLAGS_CHECK_GUARD;
 		mpi_request->CDB.EEDP32.PrimaryReferenceTag =
@@ -2701,11 +2794,11 @@ _scsih_setup_eedp(struct scsi_cmnd *scmd, Mpi2SCSIIORequest_t *mpi_request)
 		/*
 		* enable guard checking
 		*/
-		mpi_request->EEDPFlags = eedp_flags |
-		    MPI2_SCSIIO_EEDPFLAGS_CHECK_GUARD;
-
+		eedp_flags |= MPI2_SCSIIO_EEDPFLAGS_CHECK_GUARD;
 		break;
 	}
+	mpi_request->EEDPBlockSize = cpu_to_le32(scmd->device->sector_size);
+	mpi_request->EEDPFlags = cpu_to_le16(eedp_flags);
 }
 
 /**
@@ -2788,7 +2881,7 @@ _scsih_qcmd(struct scsi_cmnd *scmd, void (*done)(struct scsi_cmnd *))
 	}
 
 	/* see if we are busy with task managment stuff */
-	if (sas_target_priv_data->tm_busy)
+	if (sas_device_priv_data->block || sas_target_priv_data->tm_busy)
 		return SCSI_MLQUEUE_DEVICE_BUSY;
 	else if (ioc->shost_recovery || ioc->ioc_link_reset_in_progress)
 		return SCSI_MLQUEUE_HOST_BUSY;
@@ -2842,7 +2935,7 @@ _scsih_qcmd(struct scsi_cmnd *scmd, void (*done)(struct scsi_cmnd *))
 	mpi_request->MsgFlags = MPI2_SCSIIO_MSGFLAGS_SYSTEM_SENSE_ADDR;
 	mpi_request->SenseBufferLength = SCSI_SENSE_BUFFERSIZE;
 	mpi_request->SenseBufferLowAddress =
-	    (u32)mpt2sas_base_get_sense_buffer_dma(ioc, smid);
+	    mpt2sas_base_get_sense_buffer_dma(ioc, smid);
 	mpi_request->SGLOffset0 = offsetof(Mpi2SCSIIORequest_t, SGL) / 4;
 	mpi_request->SGLFlags = cpu_to_le16(MPI2_SCSIIO_SGLFLAGS_TYPE_MPI +
 	    MPI2_SCSIIO_SGLFLAGS_SYSTEM_ADDR);
@@ -2894,7 +2987,7 @@ _scsih_normalize_sense(char *sense_buffer, struct sense_info *data)
 
 #ifdef CONFIG_SCSI_MPT2SAS_LOGGING
 /**
- * _scsih_scsi_ioc_info - translated non-succesfull SCSI_IO request
+ * _scsih_scsi_ioc_info - translated non-successfull SCSI_IO request
  * @ioc: per adapter object
  * @scmd: pointer to scsi command object
  * @mpi_reply: reply mf payload returned from firmware
@@ -3059,7 +3152,7 @@ _scsih_scsi_ioc_info(struct MPT2SAS_ADAPTER *ioc, struct scsi_cmnd *scmd,
 	if (scsi_state & MPI2_SCSI_STATE_RESPONSE_INFO_VALID) {
 		response_info = le32_to_cpu(mpi_reply->ResponseInfo);
 		response_bytes = (u8 *)&response_info;
-		_scsih_response_code(ioc, response_bytes[3]);
+		_scsih_response_code(ioc, response_bytes[0]);
 	}
 }
 #endif
@@ -3177,7 +3270,7 @@ _scsih_io_done(struct MPT2SAS_ADAPTER *ioc, u16 smid, u8 msix_index, u32 reply)
 	u8 scsi_status;
 	u32 log_info;
 	struct MPT2SAS_DEVICE *sas_device_priv_data;
-	u32 response_code;
+	u32 response_code = 0;
 
 	mpi_reply = mpt2sas_base_get_reply_virt_addr(ioc, reply);
 	scmd = _scsih_scsi_lookup_get(ioc, smid);
@@ -3199,16 +3292,16 @@ _scsih_io_done(struct MPT2SAS_ADAPTER *ioc, u16 smid, u8 msix_index, u32 reply)
 	}
 
 	/* turning off TLR */
+	scsi_state = mpi_reply->SCSIState;
+	if (scsi_state & MPI2_SCSI_STATE_RESPONSE_INFO_VALID)
+		response_code =
+		    le32_to_cpu(mpi_reply->ResponseInfo) & 0xFF;
 	if (!sas_device_priv_data->tlr_snoop_check) {
 		sas_device_priv_data->tlr_snoop_check++;
-		if (sas_device_priv_data->flags & MPT_DEVICE_TLR_ON) {
-			response_code = (le32_to_cpu(mpi_reply->ResponseInfo)
-			    >> 24);
-			if (response_code ==
-			    MPI2_SCSITASKMGMT_RSP_INVALID_FRAME)
-				sas_device_priv_data->flags &=
-				    ~MPT_DEVICE_TLR_ON;
-		}
+		if ((sas_device_priv_data->flags & MPT_DEVICE_TLR_ON) &&
+		    response_code == MPI2_SCSITASKMGMT_RSP_INVALID_FRAME)
+			sas_device_priv_data->flags &=
+			    ~MPT_DEVICE_TLR_ON;
 	}
 
 	xfer_cnt = le32_to_cpu(mpi_reply->TransferCount);
@@ -3219,7 +3312,6 @@ _scsih_io_done(struct MPT2SAS_ADAPTER *ioc, u16 smid, u8 msix_index, u32 reply)
 	else
 		log_info = 0;
 	ioc_status &= MPI2_IOCSTATUS_MASK;
-	scsi_state = mpi_reply->SCSIState;
 	scsi_status = mpi_reply->SCSIStatus;
 
 	if (ioc_status == MPI2_IOCSTATUS_SCSI_DATA_UNDERRUN && xfer_cnt == 0 &&
@@ -3255,10 +3347,9 @@ _scsih_io_done(struct MPT2SAS_ADAPTER *ioc, u16 smid, u8 msix_index, u32 reply)
 
 	case MPI2_IOCSTATUS_SCSI_IOC_TERMINATED:
 		if (sas_device_priv_data->block) {
-			scmd->result = (DID_BUS_BUSY << 16);
-			break;
+			scmd->result = DID_TRANSPORT_DISRUPTED << 16;
+			goto out;
 		}
-
 	case MPI2_IOCSTATUS_SCSI_TASK_TERMINATED:
 	case MPI2_IOCSTATUS_SCSI_EXT_TERMINATED:
 		scmd->result = DID_RESET << 16;
@@ -3304,8 +3395,10 @@ _scsih_io_done(struct MPT2SAS_ADAPTER *ioc, u16 smid, u8 msix_index, u32 reply)
 	case MPI2_IOCSTATUS_SCSI_RECOVERED_ERROR:
 	case MPI2_IOCSTATUS_SUCCESS:
 		scmd->result = (DID_OK << 16) | scsi_status;
-		if (scsi_state & (MPI2_SCSI_STATE_AUTOSENSE_FAILED |
-		     MPI2_SCSI_STATE_NO_SCSI_STATUS))
+		if (response_code ==
+		    MPI2_SCSITASKMGMT_RSP_INVALID_FRAME ||
+		    (scsi_state & (MPI2_SCSI_STATE_AUTOSENSE_FAILED |
+		     MPI2_SCSI_STATE_NO_SCSI_STATUS)))
 			scmd->result = DID_SOFT_ERROR << 16;
 		else if (scsi_state & MPI2_SCSI_STATE_TERMINATED)
 			scmd->result = DID_RESET << 16;
@@ -3344,7 +3437,6 @@ _scsih_io_done(struct MPT2SAS_ADAPTER *ioc, u16 smid, u8 msix_index, u32 reply)
 /**
  * _scsih_sas_host_refresh - refreshing sas host object contents
  * @ioc: per adapter object
- * @update: update link information
  * Context: user
  *
  * During port enable, fw will send topology events for every device. Its
@@ -3354,13 +3446,14 @@ _scsih_io_done(struct MPT2SAS_ADAPTER *ioc, u16 smid, u8 msix_index, u32 reply)
  * Return nothing.
  */
 static void
-_scsih_sas_host_refresh(struct MPT2SAS_ADAPTER *ioc, u8 update)
+_scsih_sas_host_refresh(struct MPT2SAS_ADAPTER *ioc)
 {
 	u16 sz;
 	u16 ioc_status;
 	int i;
 	Mpi2ConfigReply_t mpi_reply;
 	Mpi2SasIOUnitPage0_t *sas_iounit_pg0 = NULL;
+	u16 attached_handle;
 
 	dtmprintk(ioc, printk(MPT2SAS_INFO_FMT
 	    "updating handles for sas_host(0x%016llx)\n",
@@ -3374,27 +3467,24 @@ _scsih_sas_host_refresh(struct MPT2SAS_ADAPTER *ioc, u8 update)
 		    ioc->name, __FILE__, __LINE__, __func__);
 		return;
 	}
-	if (!(mpt2sas_config_get_sas_iounit_pg0(ioc, &mpi_reply,
-	    sas_iounit_pg0, sz))) {
-		ioc_status = le16_to_cpu(mpi_reply.IOCStatus) &
-		    MPI2_IOCSTATUS_MASK;
-		if (ioc_status != MPI2_IOCSTATUS_SUCCESS)
-			goto out;
-		for (i = 0; i < ioc->sas_hba.num_phys ; i++) {
-			ioc->sas_hba.phy[i].handle =
-			    le16_to_cpu(sas_iounit_pg0->PhyData[i].
-				ControllerDevHandle);
-			if (update)
-				mpt2sas_transport_update_links(
-				    ioc,
-				    ioc->sas_hba.phy[i].handle,
-				    le16_to_cpu(sas_iounit_pg0->PhyData[i].
-				    AttachedDevHandle), i,
-				    sas_iounit_pg0->PhyData[i].
-				    NegotiatedLinkRate >> 4);
-		}
-	}
 
+	if ((mpt2sas_config_get_sas_iounit_pg0(ioc, &mpi_reply,
+	    sas_iounit_pg0, sz)) != 0)
+		goto out;
+	ioc_status = le16_to_cpu(mpi_reply.IOCStatus) & MPI2_IOCSTATUS_MASK;
+	if (ioc_status != MPI2_IOCSTATUS_SUCCESS)
+		goto out;
+	for (i = 0; i < ioc->sas_hba.num_phys ; i++) {
+		if (i == 0)
+			ioc->sas_hba.handle = le16_to_cpu(sas_iounit_pg0->
+			    PhyData[0].ControllerDevHandle);
+		ioc->sas_hba.phy[i].handle = ioc->sas_hba.handle;
+		attached_handle = le16_to_cpu(sas_iounit_pg0->PhyData[i].
+		    AttachedDevHandle);
+		mpt2sas_transport_update_links(ioc, ioc->sas_hba.sas_address,
+		    attached_handle, i, sas_iounit_pg0->PhyData[i].
+		    NegotiatedLinkRate >> 4);
+	}
  out:
 	kfree(sas_iounit_pg0);
 }
@@ -3507,19 +3597,21 @@ _scsih_sas_host_add(struct MPT2SAS_ADAPTER *ioc)
 			    ioc->name, __FILE__, __LINE__, __func__);
 			goto out;
 		}
-		ioc->sas_hba.phy[i].handle =
-		    le16_to_cpu(sas_iounit_pg0->PhyData[i].ControllerDevHandle);
+
+		if (i == 0)
+			ioc->sas_hba.handle = le16_to_cpu(sas_iounit_pg0->
+			    PhyData[0].ControllerDevHandle);
+		ioc->sas_hba.phy[i].handle = ioc->sas_hba.handle;
 		ioc->sas_hba.phy[i].phy_id = i;
 		mpt2sas_transport_add_host_phy(ioc, &ioc->sas_hba.phy[i],
 		    phy_pg0, ioc->sas_hba.parent_dev);
 	}
 	if ((mpt2sas_config_get_sas_device_pg0(ioc, &mpi_reply, &sas_device_pg0,
-	    MPI2_SAS_DEVICE_PGAD_FORM_HANDLE, ioc->sas_hba.phy[0].handle))) {
+	    MPI2_SAS_DEVICE_PGAD_FORM_HANDLE, ioc->sas_hba.handle))) {
 		printk(MPT2SAS_ERR_FMT "failure at %s:%d/%s()!\n",
 		    ioc->name, __FILE__, __LINE__, __func__);
 		goto out;
 	}
-	ioc->sas_hba.handle = le16_to_cpu(sas_device_pg0.DevHandle);
 	ioc->sas_hba.enclosure_handle =
 	    le16_to_cpu(sas_device_pg0.EnclosureHandle);
 	ioc->sas_hba.sas_address = le64_to_cpu(sas_device_pg0.SASAddress);
@@ -3562,7 +3654,7 @@ _scsih_expander_add(struct MPT2SAS_ADAPTER *ioc, u16 handle)
 	Mpi2SasEnclosurePage0_t enclosure_pg0;
 	u32 ioc_status;
 	u16 parent_handle;
-	__le64 sas_address;
+	__le64 sas_address, sas_address_parent = 0;
 	int i;
 	unsigned long flags;
 	struct _sas_port *mpt2sas_port = NULL;
@@ -3591,10 +3683,16 @@ _scsih_expander_add(struct MPT2SAS_ADAPTER *ioc, u16 handle)
 
 	/* handle out of order topology events */
 	parent_handle = le16_to_cpu(expander_pg0.ParentDevHandle);
-	if (parent_handle >= ioc->sas_hba.num_phys) {
+	if (_scsih_get_sas_address(ioc, parent_handle, &sas_address_parent)
+	    != 0) {
+		printk(MPT2SAS_ERR_FMT "failure at %s:%d/%s()!\n",
+		    ioc->name, __FILE__, __LINE__, __func__);
+		return -1;
+	}
+	if (sas_address_parent != ioc->sas_hba.sas_address) {
 		spin_lock_irqsave(&ioc->sas_node_lock, flags);
-		sas_expander = mpt2sas_scsih_expander_find_by_handle(ioc,
-		    parent_handle);
+		sas_expander = mpt2sas_scsih_expander_find_by_sas_address(ioc,
+		    sas_address_parent);
 		spin_unlock_irqrestore(&ioc->sas_node_lock, flags);
 		if (!sas_expander) {
 			rc = _scsih_expander_add(ioc, parent_handle);
@@ -3622,14 +3720,12 @@ _scsih_expander_add(struct MPT2SAS_ADAPTER *ioc, u16 handle)
 
 	sas_expander->handle = handle;
 	sas_expander->num_phys = expander_pg0.NumPhys;
-	sas_expander->parent_handle = parent_handle;
-	sas_expander->enclosure_handle =
-	    le16_to_cpu(expander_pg0.EnclosureHandle);
+	sas_expander->sas_address_parent = sas_address_parent;
 	sas_expander->sas_address = sas_address;
 
 	printk(MPT2SAS_INFO_FMT "expander_add: handle(0x%04x),"
 	    " parent(0x%04x), sas_addr(0x%016llx), phys(%d)\n", ioc->name,
-	    handle, sas_expander->parent_handle, (unsigned long long)
+	    handle, parent_handle, (unsigned long long)
 	    sas_expander->sas_address, sas_expander->num_phys);
 
 	if (!sas_expander->num_phys)
@@ -3645,7 +3741,7 @@ _scsih_expander_add(struct MPT2SAS_ADAPTER *ioc, u16 handle)
 
 	INIT_LIST_HEAD(&sas_expander->sas_port_list);
 	mpt2sas_port = mpt2sas_transport_port_add(ioc, handle,
-	    sas_expander->parent_handle);
+	    sas_address_parent);
 	if (!mpt2sas_port) {
 		printk(MPT2SAS_ERR_FMT "failure at %s:%d/%s()!\n",
 		    ioc->name, __FILE__, __LINE__, __func__);
@@ -3691,20 +3787,54 @@ _scsih_expander_add(struct MPT2SAS_ADAPTER *ioc, u16 handle)
 
 	if (mpt2sas_port)
 		mpt2sas_transport_port_remove(ioc, sas_expander->sas_address,
-		    sas_expander->parent_handle);
+		    sas_address_parent);
 	kfree(sas_expander);
 	return rc;
 }
 
 /**
+ * _scsih_done -  scsih callback handler.
+ * @ioc: per adapter object
+ * @smid: system request message index
+ * @msix_index: MSIX table index supplied by the OS
+ * @reply: reply message frame(lower 32bit addr)
+ *
+ * Callback handler when sending internal generated message frames.
+ * The callback index passed is `ioc->scsih_cb_idx`
+ *
+ * Return 1 meaning mf should be freed from _base_interrupt
+ *        0 means the mf is freed from this function.
+ */
+static u8
+_scsih_done(struct MPT2SAS_ADAPTER *ioc, u16 smid, u8 msix_index, u32 reply)
+{
+	MPI2DefaultReply_t *mpi_reply;
+
+	mpi_reply =  mpt2sas_base_get_reply_virt_addr(ioc, reply);
+	if (ioc->scsih_cmds.status == MPT2_CMD_NOT_USED)
+		return 1;
+	if (ioc->scsih_cmds.smid != smid)
+		return 1;
+	ioc->scsih_cmds.status |= MPT2_CMD_COMPLETE;
+	if (mpi_reply) {
+		memcpy(ioc->scsih_cmds.reply, mpi_reply,
+		    mpi_reply->MsgLength*4);
+		ioc->scsih_cmds.status |= MPT2_CMD_REPLY_VALID;
+	}
+	ioc->scsih_cmds.status &= ~MPT2_CMD_PENDING;
+	complete(&ioc->scsih_cmds.done);
+	return 1;
+}
+
+/**
  * _scsih_expander_remove - removing expander object
  * @ioc: per adapter object
- * @handle: expander handle
+ * @sas_address: expander sas_address
  *
  * Return nothing.
  */
 static void
-_scsih_expander_remove(struct MPT2SAS_ADAPTER *ioc, u16 handle)
+_scsih_expander_remove(struct MPT2SAS_ADAPTER *ioc, u64 sas_address)
 {
 	struct _sas_node *sas_expander;
 	unsigned long flags;
@@ -3713,7 +3843,8 @@ _scsih_expander_remove(struct MPT2SAS_ADAPTER *ioc, u16 handle)
 		return;
 
 	spin_lock_irqsave(&ioc->sas_node_lock, flags);
-	sas_expander = mpt2sas_scsih_expander_find_by_handle(ioc, handle);
+	sas_expander = mpt2sas_scsih_expander_find_by_sas_address(ioc,
+	    sas_address);
 	spin_unlock_irqrestore(&ioc->sas_node_lock, flags);
 	_scsih_expander_node_remove(ioc, sas_expander);
 }
@@ -3805,8 +3936,11 @@ _scsih_add_device(struct MPT2SAS_ADAPTER *ioc, u16 handle, u8 phy_num, u8 is_pd)
 	}
 
 	sas_device->handle = handle;
-	sas_device->parent_handle =
-	    le16_to_cpu(sas_device_pg0.ParentDevHandle);
+	if (_scsih_get_sas_address(ioc, le16_to_cpu
+		(sas_device_pg0.ParentDevHandle),
+		&sas_device->sas_address_parent) != 0)
+		printk(MPT2SAS_ERR_FMT "failure at %s:%d/%s()!\n",
+		    ioc->name, __FILE__, __LINE__, __func__);
 	sas_device->enclosure_handle =
 	    le16_to_cpu(sas_device_pg0.EnclosureHandle);
 	sas_device->slot =
@@ -3836,43 +3970,39 @@ _scsih_add_device(struct MPT2SAS_ADAPTER *ioc, u16 handle, u8 phy_num, u8 is_pd)
 /**
  * _scsih_remove_device -  removing sas device object
  * @ioc: per adapter object
- * @handle: sas device handle
+ * @sas_device: the sas_device object
  *
  * Return nothing.
  */
 static void
-_scsih_remove_device(struct MPT2SAS_ADAPTER *ioc, u16 handle)
+_scsih_remove_device(struct MPT2SAS_ADAPTER *ioc, struct _sas_device
+    *sas_device)
 {
 	struct MPT2SAS_TARGET *sas_target_priv_data;
-	struct _sas_device *sas_device;
-	unsigned long flags;
 	Mpi2SasIoUnitControlReply_t mpi_reply;
 	Mpi2SasIoUnitControlRequest_t mpi_request;
-	u16 device_handle;
+	u16 device_handle, handle;
 
-	/* lookup sas_device */
-	spin_lock_irqsave(&ioc->sas_device_lock, flags);
-	sas_device = _scsih_sas_device_find_by_handle(ioc, handle);
-	if (!sas_device) {
-		spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
+	if (!sas_device)
 		return;
-	}
 
-	dewtprintk(ioc, printk(MPT2SAS_INFO_FMT "%s: enter: handle"
-	    "(0x%04x)\n", ioc->name, __func__, handle));
+	handle = sas_device->handle;
+	dewtprintk(ioc, printk(MPT2SAS_INFO_FMT "%s: enter: handle(0x%04x),"
+	    " sas_addr(0x%016llx)\n", ioc->name, __func__, handle,
+	    (unsigned long long) sas_device->sas_address));
 
 	if (sas_device->starget && sas_device->starget->hostdata) {
 		sas_target_priv_data = sas_device->starget->hostdata;
 		sas_target_priv_data->deleted = 1;
 	}
-	spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
 
-	if (ioc->remove_host)
+	if (ioc->remove_host || ioc->shost_recovery || !handle)
 		goto out;
 
 	if ((sas_device->state & MPTSAS_STATE_TR_COMPLETE)) {
 		dewtprintk(ioc, printk(MPT2SAS_INFO_FMT "\tskip "
-		   "target_reset handle(0x%04x)\n", ioc->name, handle));
+		   "target_reset handle(0x%04x)\n", ioc->name,
+		   handle));
 		goto skip_tr;
 	}
 
@@ -3925,10 +4055,10 @@ _scsih_remove_device(struct MPT2SAS_ADAPTER *ioc, u16 handle)
 	_scsih_ublock_io_device(ioc, handle);
 
 	mpt2sas_transport_port_remove(ioc, sas_device->sas_address,
-	    sas_device->parent_handle);
+	    sas_device->sas_address_parent);
 
 	printk(MPT2SAS_INFO_FMT "removing handle(0x%04x), sas_addr"
-	    "(0x%016llx)\n", ioc->name, sas_device->handle,
+	    "(0x%016llx)\n", ioc->name, handle,
 	    (unsigned long long) sas_device->sas_address);
 	_scsih_sas_device_remove(ioc, sas_device);
 
@@ -3952,7 +4082,7 @@ _scsih_sas_topology_change_event_debug(struct MPT2SAS_ADAPTER *ioc,
 	u16 reason_code;
 	u8 phy_number;
 	char *status_str = NULL;
-	char link_rate[25];
+	u8 link_rate, prev_link_rate;
 
 	switch (event_data->ExpStatus) {
 	case MPI2_EVENT_SAS_TOPO_ES_ADDED:
@@ -3962,6 +4092,7 @@ _scsih_sas_topology_change_event_debug(struct MPT2SAS_ADAPTER *ioc,
 		status_str = "remove";
 		break;
 	case MPI2_EVENT_SAS_TOPO_ES_RESPONDING:
+	case 0:
 		status_str =  "responding";
 		break;
 	case MPI2_EVENT_SAS_TOPO_ES_DELAY_NOT_RESPONDING:
@@ -3987,30 +4118,30 @@ _scsih_sas_topology_change_event_debug(struct MPT2SAS_ADAPTER *ioc,
 		    MPI2_EVENT_SAS_TOPO_RC_MASK;
 		switch (reason_code) {
 		case MPI2_EVENT_SAS_TOPO_RC_TARG_ADDED:
-			snprintf(link_rate, 25, ": add, link(0x%02x)",
-			    (event_data->PHY[i].LinkRate >> 4));
-			status_str = link_rate;
+			status_str = "target add";
 			break;
 		case MPI2_EVENT_SAS_TOPO_RC_TARG_NOT_RESPONDING:
-			status_str = ": remove";
+			status_str = "target remove";
 			break;
 		case MPI2_EVENT_SAS_TOPO_RC_DELAY_NOT_RESPONDING:
-			status_str = ": remove_delay";
+			status_str = "delay target remove";
 			break;
 		case MPI2_EVENT_SAS_TOPO_RC_PHY_CHANGED:
-			snprintf(link_rate, 25, ": link(0x%02x)",
-			    (event_data->PHY[i].LinkRate >> 4));
-			status_str = link_rate;
+			status_str = "link rate change";
 			break;
 		case MPI2_EVENT_SAS_TOPO_RC_NO_CHANGE:
-			status_str = ": responding";
+			status_str = "target responding";
 			break;
 		default:
-			status_str = ": unknown";
+			status_str = "unknown";
 			break;
 		}
-		printk(KERN_DEBUG "\tphy(%02d), attached_handle(0x%04x)%s\n",
-		    phy_number, handle, status_str);
+		link_rate = event_data->PHY[i].LinkRate >> 4;
+		prev_link_rate = event_data->PHY[i].LinkRate & 0xF;
+		printk(KERN_DEBUG "\tphy(%02d), attached_handle(0x%04x): %s:"
+		    " link rate: new(0x%02x), old(0x%02x)\n", phy_number,
+		    handle, status_str, link_rate, prev_link_rate);
+
 	}
 }
 #endif
@@ -4031,8 +4162,10 @@ _scsih_sas_topology_change_event(struct MPT2SAS_ADAPTER *ioc,
 	u16 reason_code;
 	u8 phy_number;
 	struct _sas_node *sas_expander;
+	struct _sas_device *sas_device;
+	u64 sas_address;
 	unsigned long flags;
-	u8 link_rate_;
+	u8 link_rate, prev_link_rate;
 	Mpi2EventDataSasTopologyChangeList_t *event_data = fw_event->event_data;
 
 #ifdef CONFIG_SCSI_MPT2SAS_LOGGING
@@ -4040,10 +4173,13 @@ _scsih_sas_topology_change_event(struct MPT2SAS_ADAPTER *ioc,
 		_scsih_sas_topology_change_event_debug(ioc, event_data);
 #endif
 
+	if (ioc->shost_recovery)
+		return;
+
 	if (!ioc->sas_hba.num_phys)
 		_scsih_sas_host_add(ioc);
 	else
-		_scsih_sas_host_refresh(ioc, 0);
+		_scsih_sas_host_refresh(ioc);
 
 	if (fw_event->ignore) {
 		dewtprintk(ioc, printk(MPT2SAS_DEBUG_FMT "ignoring expander "
@@ -4058,6 +4194,17 @@ _scsih_sas_topology_change_event(struct MPT2SAS_ADAPTER *ioc,
 		if (_scsih_expander_add(ioc, parent_handle) != 0)
 			return;
 
+	spin_lock_irqsave(&ioc->sas_node_lock, flags);
+	sas_expander = mpt2sas_scsih_expander_find_by_handle(ioc,
+	    parent_handle);
+	spin_unlock_irqrestore(&ioc->sas_node_lock, flags);
+	if (sas_expander)
+		sas_address = sas_expander->sas_address;
+	else if (parent_handle < ioc->sas_hba.num_phys)
+		sas_address = ioc->sas_hba.sas_address;
+	else
+		return;
+
 	/* handle siblings events */
 	for (i = 0; i < event_data->NumEntries; i++) {
 		if (fw_event->ignore) {
@@ -4077,48 +4224,47 @@ _scsih_sas_topology_change_event(struct MPT2SAS_ADAPTER *ioc,
 		handle = le16_to_cpu(event_data->PHY[i].AttachedDevHandle);
 		if (!handle)
 			continue;
-		link_rate_ = event_data->PHY[i].LinkRate >> 4;
+		link_rate = event_data->PHY[i].LinkRate >> 4;
+		prev_link_rate = event_data->PHY[i].LinkRate & 0xF;
 		switch (reason_code) {
 		case MPI2_EVENT_SAS_TOPO_RC_PHY_CHANGED:
+
+			if (link_rate == prev_link_rate)
+				break;
+
+			mpt2sas_transport_update_links(ioc, sas_address,
+			    handle, phy_number, link_rate);
+
+			if (link_rate >= MPI2_SAS_NEG_LINK_RATE_1_5)
+				_scsih_ublock_io_device(ioc, handle);
+			break;
 		case MPI2_EVENT_SAS_TOPO_RC_TARG_ADDED:
-			if (!parent_handle) {
-				if (phy_number < ioc->sas_hba.num_phys)
-					mpt2sas_transport_update_links(
-					ioc,
-					ioc->sas_hba.phy[phy_number].handle,
-					handle, phy_number, link_rate_);
-			} else {
-				spin_lock_irqsave(&ioc->sas_node_lock, flags);
-				sas_expander =
-				    mpt2sas_scsih_expander_find_by_handle(ioc,
-					parent_handle);
-				spin_unlock_irqrestore(&ioc->sas_node_lock,
-				    flags);
-				if (sas_expander) {
-					if (phy_number < sas_expander->num_phys)
-						mpt2sas_transport_update_links(
-						ioc,
-						sas_expander->
-						phy[phy_number].handle,
-						handle, phy_number,
-						link_rate_);
-				}
-			}
-			if (reason_code == MPI2_EVENT_SAS_TOPO_RC_TARG_ADDED) {
-				if (link_rate_ < MPI2_SAS_NEG_LINK_RATE_1_5)
-					break;
-				_scsih_add_device(ioc, handle, phy_number, 0);
-			}
+
+			mpt2sas_transport_update_links(ioc, sas_address,
+			    handle, phy_number, link_rate);
+
+			_scsih_add_device(ioc, handle, phy_number, 0);
 			break;
 		case MPI2_EVENT_SAS_TOPO_RC_TARG_NOT_RESPONDING:
-			_scsih_remove_device(ioc, handle);
+
+			spin_lock_irqsave(&ioc->sas_device_lock, flags);
+			sas_device = _scsih_sas_device_find_by_handle(ioc,
+			    handle);
+			if (!sas_device) {
+				spin_unlock_irqrestore(&ioc->sas_device_lock,
+				    flags);
+				break;
+			}
+			spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
+			_scsih_remove_device(ioc, sas_device);
 			break;
 		}
 	}
 
 	/* handle expander removal */
-	if (event_data->ExpStatus == MPI2_EVENT_SAS_TOPO_ES_NOT_RESPONDING)
-		_scsih_expander_remove(ioc, parent_handle);
+	if (event_data->ExpStatus == MPI2_EVENT_SAS_TOPO_ES_NOT_RESPONDING &&
+	    sas_expander)
+		_scsih_expander_remove(ioc, sas_address);
 
 }
 
@@ -4170,6 +4316,12 @@ _scsih_sas_device_status_change_event_debug(struct MPT2SAS_ADAPTER *ioc,
 	case MPI2_EVENT_SAS_DEV_STAT_RC_ASYNC_NOTIFICATION:
 		reason_str = "internal async notification";
 		break;
+	case MPI2_EVENT_SAS_DEV_STAT_RC_EXPANDER_REDUCED_FUNCTIONALITY:
+		reason_str = "expander reduced functionality";
+		break;
+	case MPI2_EVENT_SAS_DEV_STAT_RC_CMP_EXPANDER_REDUCED_FUNCTIONALITY:
+		reason_str = "expander reduced functionality complete";
+		break;
 	default:
 		reason_str = "unknown reason";
 		break;
@@ -4197,11 +4349,43 @@ static void
 _scsih_sas_device_status_change_event(struct MPT2SAS_ADAPTER *ioc,
     struct fw_event_work *fw_event)
 {
+	struct MPT2SAS_TARGET *target_priv_data;
+	struct _sas_device *sas_device;
+	__le64 sas_address;
+	unsigned long flags;
+	Mpi2EventDataSasDeviceStatusChange_t *event_data =
+	    fw_event->event_data;
+
 #ifdef CONFIG_SCSI_MPT2SAS_LOGGING
 	if (ioc->logging_level & MPT_DEBUG_EVENT_WORK_TASK)
 		_scsih_sas_device_status_change_event_debug(ioc,
-		     fw_event->event_data);
+		     event_data);
 #endif
+
+	if (!(event_data->ReasonCode ==
+	    MPI2_EVENT_SAS_DEV_STAT_RC_INTERNAL_DEVICE_RESET &&
+	   event_data->ReasonCode ==
+	    MPI2_EVENT_SAS_DEV_STAT_RC_CMP_INTERNAL_DEV_RESET))
+		return;
+
+	spin_lock_irqsave(&ioc->sas_device_lock, flags);
+	sas_address = le64_to_cpu(event_data->SASAddress);
+	sas_device = mpt2sas_scsih_sas_device_find_by_sas_address(ioc,
+	    sas_address);
+	spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
+
+	if (!sas_device || !sas_device->starget)
+		return;
+
+	target_priv_data = sas_device->starget->hostdata;
+	if (!target_priv_data)
+		return;
+
+	if (event_data->ReasonCode ==
+	    MPI2_EVENT_SAS_DEV_STAT_RC_INTERNAL_DEVICE_RESET)
+		target_priv_data->tm_busy = 1;
+	else
+		target_priv_data->tm_busy = 0;
 }
 
 #ifdef CONFIG_SCSI_MPT2SAS_LOGGING
@@ -4281,6 +4465,7 @@ _scsih_sas_broadcast_primative_event(struct MPT2SAS_ADAPTER *ioc,
 #ifdef CONFIG_SCSI_MPT2SAS_LOGGING
 	Mpi2EventDataSasBroadcastPrimitive_t *event_data = fw_event->event_data;
 #endif
+	u16 ioc_status;
 	dewtprintk(ioc, printk(MPT2SAS_DEBUG_FMT "broadcast primative: "
 	    "phy number(%d), width(%d)\n", ioc->name, event_data->PhyNum,
 	    event_data->PortWidth));
@@ -4314,8 +4499,9 @@ _scsih_sas_broadcast_primative_event(struct MPT2SAS_ADAPTER *ioc,
 		mpt2sas_scsih_issue_tm(ioc, handle, lun,
 		    MPI2_SCSITASKMGMT_TASKTYPE_QUERY_TASK, smid, 30);
 		ioc->tm_cmds.status = MPT2_CMD_NOT_USED;
-
-		if ((mpi_reply->IOCStatus == MPI2_IOCSTATUS_SUCCESS) &&
+		ioc_status = le16_to_cpu(mpi_reply->IOCStatus)
+		    & MPI2_IOCSTATUS_MASK;
+		if ((ioc_status == MPI2_IOCSTATUS_SUCCESS) &&
 		    (mpi_reply->ResponseCode ==
 		     MPI2_SCSITASKMGMT_RSP_TM_SUCCEEDED ||
 		     mpi_reply->ResponseCode ==
@@ -4570,7 +4756,7 @@ _scsih_sas_pd_delete(struct MPT2SAS_ADAPTER *ioc,
 	spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
 	if (!sas_device)
 		return;
-	_scsih_remove_device(ioc, handle);
+	_scsih_remove_device(ioc, sas_device);
 }
 
 /**
@@ -4591,6 +4777,8 @@ _scsih_sas_pd_add(struct MPT2SAS_ADAPTER *ioc,
 	Mpi2ConfigReply_t mpi_reply;
 	Mpi2SasDevicePage0_t sas_device_pg0;
 	u32 ioc_status;
+	u64 sas_address;
+	u16 parent_handle;
 
 	spin_lock_irqsave(&ioc->sas_device_lock, flags);
 	sas_device = _scsih_sas_device_find_by_handle(ioc, handle);
@@ -4615,9 +4803,10 @@ _scsih_sas_pd_add(struct MPT2SAS_ADAPTER *ioc,
 		return;
 	}
 
-	mpt2sas_transport_update_links(ioc,
-	    le16_to_cpu(sas_device_pg0.ParentDevHandle),
-	    handle, sas_device_pg0.PhyNum, MPI2_SAS_NEG_LINK_RATE_1_5);
+	parent_handle = le16_to_cpu(sas_device_pg0.ParentDevHandle);
+	if (!_scsih_get_sas_address(ioc, parent_handle, &sas_address))
+		mpt2sas_transport_update_links(ioc, sas_address, handle,
+		    sas_device_pg0.PhyNum, MPI2_SAS_NEG_LINK_RATE_1_5);
 
 	_scsih_add_device(ioc, handle, 0, 1);
 }
@@ -4857,7 +5046,7 @@ static void
 _scsih_sas_ir_physical_disk_event(struct MPT2SAS_ADAPTER *ioc,
     struct fw_event_work *fw_event)
 {
-	u16 handle;
+	u16 handle, parent_handle;
 	u32 state;
 	struct _sas_device *sas_device;
 	unsigned long flags;
@@ -4865,6 +5054,7 @@ _scsih_sas_ir_physical_disk_event(struct MPT2SAS_ADAPTER *ioc,
 	Mpi2SasDevicePage0_t sas_device_pg0;
 	u32 ioc_status;
 	Mpi2EventDataIrPhysicalDisk_t *event_data = fw_event->event_data;
+	u64 sas_address;
 
 	if (event_data->ReasonCode != MPI2_EVENT_IR_PHYSDISK_RC_STATE_CHANGED)
 		return;
@@ -4906,9 +5096,10 @@ _scsih_sas_ir_physical_disk_event(struct MPT2SAS_ADAPTER *ioc,
 			return;
 		}
 
-		mpt2sas_transport_update_links(ioc,
-		    le16_to_cpu(sas_device_pg0.ParentDevHandle),
-		    handle, sas_device_pg0.PhyNum, MPI2_SAS_NEG_LINK_RATE_1_5);
+		parent_handle = le16_to_cpu(sas_device_pg0.ParentDevHandle);
+		if (!_scsih_get_sas_address(ioc, parent_handle, &sas_address))
+			mpt2sas_transport_update_links(ioc, sas_address, handle,
+			    sas_device_pg0.PhyNum, MPI2_SAS_NEG_LINK_RATE_1_5);
 
 		_scsih_add_device(ioc, handle, 0, 1);
 
@@ -4948,11 +5139,17 @@ _scsih_sas_ir_operation_status_event_debug(struct MPT2SAS_ADAPTER *ioc,
 	case MPI2_EVENT_IR_RAIDOP_CONSISTENCY_CHECK:
 		reason_str = "consistency check";
 		break;
-	default:
-		reason_str = "unknown reason";
+	case MPI2_EVENT_IR_RAIDOP_BACKGROUND_INIT:
+		reason_str = "background init";
+		break;
+	case MPI2_EVENT_IR_RAIDOP_MAKE_DATA_CONSISTENT:
+		reason_str = "make data consistent";
 		break;
 	}
 
+	if (!reason_str)
+		return;
+
 	printk(MPT2SAS_INFO_FMT "raid operational status: (%s)"
 	    "\thandle(0x%04x), percent complete(%d)\n",
 	    ioc->name, reason_str,
@@ -5252,18 +5449,23 @@ _scsih_mark_responding_expander(struct MPT2SAS_ADAPTER *ioc, u64 sas_address,
 {
 	struct _sas_node *sas_expander;
 	unsigned long flags;
+	int i;
 
 	spin_lock_irqsave(&ioc->sas_node_lock, flags);
 	list_for_each_entry(sas_expander, &ioc->sas_expander_list, list) {
-		if (sas_expander->sas_address == sas_address) {
-			sas_expander->responding = 1;
-			if (sas_expander->handle != handle) {
-				printk(KERN_INFO "old handle(0x%04x)\n",
-				    sas_expander->handle);
-				sas_expander->handle = handle;
-			}
+		if (sas_expander->sas_address != sas_address)
+			continue;
+		sas_expander->responding = 1;
+		if (sas_expander->handle == handle)
 			goto out;
-		}
+		printk(KERN_INFO "\texpander(0x%016llx): handle changed"
+		    " from(0x%04x) to (0x%04x)!!!\n",
+		    (unsigned long long)sas_expander->sas_address,
+		    sas_expander->handle, handle);
+		sas_expander->handle = handle;
+		for (i = 0 ; i < sas_expander->num_phys ; i++)
+			sas_expander->phy[i].handle = handle;
+		goto out;
 	}
  out:
 	spin_unlock_irqrestore(&ioc->sas_node_lock, flags);
@@ -5340,7 +5542,9 @@ _scsih_remove_unresponding_devices(struct MPT2SAS_ADAPTER *ioc)
 			    (unsigned long long)
 			    sas_device->enclosure_logical_id,
 			    sas_device->slot);
-		_scsih_remove_device(ioc, sas_device->handle);
+		/* invalidate the device handle */
+		sas_device->handle = 0;
+		_scsih_remove_device(ioc, sas_device);
 	}
 
 	list_for_each_entry_safe(raid_device, raid_device_next,
@@ -5366,7 +5570,7 @@ _scsih_remove_unresponding_devices(struct MPT2SAS_ADAPTER *ioc)
 			sas_expander->responding = 0;
 			continue;
 		}
-		_scsih_expander_remove(ioc, sas_expander->handle);
+		_scsih_expander_remove(ioc, sas_expander->sas_address);
 		goto retry_expander_search;
 	}
 }
@@ -5406,7 +5610,7 @@ mpt2sas_scsih_reset_handler(struct MPT2SAS_ADAPTER *ioc, int reset_phase)
 	case MPT2_IOC_DONE_RESET:
 		dtmprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s: "
 		    "MPT2_IOC_DONE_RESET\n", ioc->name, __func__));
-		_scsih_sas_host_refresh(ioc, 0);
+		_scsih_sas_host_refresh(ioc);
 		_scsih_search_responding_sas_devices(ioc);
 		_scsih_search_responding_raid_devices(ioc);
 		_scsih_search_responding_expanders(ioc);
@@ -5646,7 +5850,7 @@ _scsih_expander_node_remove(struct MPT2SAS_ADAPTER *ioc,
 			spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
 			if (!sas_device)
 				continue;
-			_scsih_remove_device(ioc, sas_device->handle);
+			_scsih_remove_device(ioc, sas_device);
 			if (ioc->shost_recovery)
 				return;
 			goto retry_device_search;
@@ -5669,7 +5873,8 @@ _scsih_expander_node_remove(struct MPT2SAS_ADAPTER *ioc,
 			spin_unlock_irqrestore(&ioc->sas_node_lock, flags);
 			if (!expander_sibling)
 				continue;
-			_scsih_expander_remove(ioc, expander_sibling->handle);
+			_scsih_expander_remove(ioc,
+			    expander_sibling->sas_address);
 			if (ioc->shost_recovery)
 				return;
 			goto retry_expander_search;
@@ -5677,7 +5882,7 @@ _scsih_expander_node_remove(struct MPT2SAS_ADAPTER *ioc,
 	}
 
 	mpt2sas_transport_port_remove(ioc, sas_expander->sas_address,
-	    sas_expander->parent_handle);
+	    sas_expander->sas_address_parent);
 
 	printk(MPT2SAS_INFO_FMT "expander_remove: handle"
 	   "(0x%04x), sas_addr(0x%016llx)\n", ioc->name,
@@ -5690,9 +5895,99 @@ _scsih_expander_node_remove(struct MPT2SAS_ADAPTER *ioc,
 }
 
 /**
+ * _scsih_ir_shutdown - IR shutdown notification
+ * @ioc: per adapter object
+ *
+ * Sending RAID Action to alert the Integrated RAID subsystem of the IOC that
+ * the host system is shutting down.
+ *
+ * Return nothing.
+ */
+static void
+_scsih_ir_shutdown(struct MPT2SAS_ADAPTER *ioc)
+{
+	Mpi2RaidActionRequest_t *mpi_request;
+	Mpi2RaidActionReply_t *mpi_reply;
+	u16 smid;
+
+	/* is IR firmware build loaded ? */
+	if (!ioc->ir_firmware)
+		return;
+
+	/* are there any volumes ? */
+	if (list_empty(&ioc->raid_device_list))
+		return;
+
+	mutex_lock(&ioc->scsih_cmds.mutex);
+
+	if (ioc->scsih_cmds.status != MPT2_CMD_NOT_USED) {
+		printk(MPT2SAS_ERR_FMT "%s: scsih_cmd in use\n",
+		    ioc->name, __func__);
+		goto out;
+	}
+	ioc->scsih_cmds.status = MPT2_CMD_PENDING;
+
+	smid = mpt2sas_base_get_smid(ioc, ioc->scsih_cb_idx);
+	if (!smid) {
+		printk(MPT2SAS_ERR_FMT "%s: failed obtaining a smid\n",
+		    ioc->name, __func__);
+		ioc->scsih_cmds.status = MPT2_CMD_NOT_USED;
+		goto out;
+	}
+
+	mpi_request = mpt2sas_base_get_msg_frame(ioc, smid);
+	ioc->scsih_cmds.smid = smid;
+	memset(mpi_request, 0, sizeof(Mpi2RaidActionRequest_t));
+
+	mpi_request->Function = MPI2_FUNCTION_RAID_ACTION;
+	mpi_request->Action = MPI2_RAID_ACTION_SYSTEM_SHUTDOWN_INITIATED;
+
+	printk(MPT2SAS_INFO_FMT "IR shutdown (sending)\n", ioc->name);
+	init_completion(&ioc->scsih_cmds.done);
+	mpt2sas_base_put_smid_default(ioc, smid);
+	wait_for_completion_timeout(&ioc->scsih_cmds.done, 10*HZ);
+
+	if (!(ioc->scsih_cmds.status & MPT2_CMD_COMPLETE)) {
+		printk(MPT2SAS_ERR_FMT "%s: timeout\n",
+		    ioc->name, __func__);
+		goto out;
+	}
+
+	if (ioc->scsih_cmds.status & MPT2_CMD_REPLY_VALID) {
+		mpi_reply = ioc->scsih_cmds.reply;
+
+		printk(MPT2SAS_INFO_FMT "IR shutdown (complete): "
+		    "ioc_status(0x%04x), loginfo(0x%08x)\n",
+		    ioc->name, le16_to_cpu(mpi_reply->IOCStatus),
+		    le32_to_cpu(mpi_reply->IOCLogInfo));
+	}
+
+ out:
+	ioc->scsih_cmds.status = MPT2_CMD_NOT_USED;
+	mutex_unlock(&ioc->scsih_cmds.mutex);
+}
+
+/**
+ * _scsih_shutdown - routine call during system shutdown
+ * @pdev: PCI device struct
+ *
+ * Return nothing.
+ */
+static void
+_scsih_shutdown(struct pci_dev *pdev)
+{
+	struct Scsi_Host *shost = pci_get_drvdata(pdev);
+	struct MPT2SAS_ADAPTER *ioc = shost_priv(shost);
+
+	_scsih_ir_shutdown(ioc);
+	mpt2sas_base_detach(ioc);
+}
+
+/**
  * _scsih_remove - detach and remove add host
  * @pdev: PCI device struct
  *
+ * Routine called when unloading the driver.
  * Return nothing.
  */
 static void __devexit
@@ -5726,7 +6021,7 @@ _scsih_remove(struct pci_dev *pdev)
 			    mpt2sas_scsih_sas_device_find_by_sas_address(ioc,
 			   mpt2sas_port->remote_identify.sas_address);
 			if (sas_device) {
-				_scsih_remove_device(ioc, sas_device->handle);
+				_scsih_remove_device(ioc, sas_device);
 				goto retry_again;
 			}
 		} else {
@@ -5735,7 +6030,7 @@ _scsih_remove(struct pci_dev *pdev)
 			    mpt2sas_port->remote_identify.sas_address);
 			if (expander_sibling) {
 				_scsih_expander_remove(ioc,
-				    expander_sibling->handle);
+				    expander_sibling->sas_address);
 				goto retry_again;
 			}
 		}
@@ -5749,7 +6044,7 @@ _scsih_remove(struct pci_dev *pdev)
 	}
 
 	sas_remove_host(shost);
-	mpt2sas_base_detach(ioc);
+	_scsih_shutdown(pdev);
 	list_del(&ioc->list);
 	scsi_remove_host(shost);
 	scsi_host_put(shost);
@@ -5770,7 +6065,8 @@ _scsih_probe_boot_devices(struct MPT2SAS_ADAPTER *ioc)
 	void *device;
 	struct _sas_device *sas_device;
 	struct _raid_device *raid_device;
-	u16 handle, parent_handle;
+	u16 handle;
+	u64 sas_address_parent;
 	u64 sas_address;
 	unsigned long flags;
 	int rc;
@@ -5799,17 +6095,17 @@ _scsih_probe_boot_devices(struct MPT2SAS_ADAPTER *ioc)
 	} else {
 		sas_device = device;
 		handle = sas_device->handle;
-		parent_handle = sas_device->parent_handle;
+		sas_address_parent = sas_device->sas_address_parent;
 		sas_address = sas_device->sas_address;
 		spin_lock_irqsave(&ioc->sas_device_lock, flags);
 		list_move_tail(&sas_device->list, &ioc->sas_device_list);
 		spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
 		if (!mpt2sas_transport_port_add(ioc, sas_device->handle,
-		    sas_device->parent_handle)) {
+		    sas_device->sas_address_parent)) {
 			_scsih_sas_device_remove(ioc, sas_device);
 		} else if (!sas_device->starget) {
 			mpt2sas_transport_port_remove(ioc, sas_address,
-			    parent_handle);
+			    sas_address_parent);
 			_scsih_sas_device_remove(ioc, sas_device);
 		}
 	}
@@ -5849,8 +6145,6 @@ _scsih_probe_sas(struct MPT2SAS_ADAPTER *ioc)
 {
 	struct _sas_device *sas_device, *next;
 	unsigned long flags;
-	u16 handle, parent_handle;
-	u64 sas_address;
 
 	/* SAS Device List */
 	list_for_each_entry_safe(sas_device, next, &ioc->sas_device_init_list,
@@ -5859,14 +6153,13 @@ _scsih_probe_sas(struct MPT2SAS_ADAPTER *ioc)
 		list_move_tail(&sas_device->list, &ioc->sas_device_list);
 		spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
 
-		handle = sas_device->handle;
-		parent_handle = sas_device->parent_handle;
-		sas_address = sas_device->sas_address;
-		if (!mpt2sas_transport_port_add(ioc, handle, parent_handle)) {
+		if (!mpt2sas_transport_port_add(ioc, sas_device->handle,
+		    sas_device->sas_address_parent)) {
 			_scsih_sas_device_remove(ioc, sas_device);
 		} else if (!sas_device->starget) {
-			mpt2sas_transport_port_remove(ioc, sas_address,
-			    parent_handle);
+			mpt2sas_transport_port_remove(ioc,
+			    sas_device->sas_address,
+			    sas_device->sas_address_parent);
 			_scsih_sas_device_remove(ioc, sas_device);
 		}
 	}
@@ -5935,6 +6228,7 @@ _scsih_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 	ioc->ctl_cb_idx = ctl_cb_idx;
 	ioc->base_cb_idx = base_cb_idx;
 	ioc->transport_cb_idx = transport_cb_idx;
+	ioc->scsih_cb_idx = scsih_cb_idx;
 	ioc->config_cb_idx = config_cb_idx;
 	ioc->tm_tr_cb_idx = tm_tr_cb_idx;
 	ioc->tm_sas_control_cb_idx = tm_sas_control_cb_idx;
@@ -6072,6 +6366,7 @@ static struct pci_driver scsih_driver = {
 	.id_table	= scsih_pci_table,
 	.probe		= _scsih_probe,
 	.remove		= __devexit_p(_scsih_remove),
+	.shutdown	= _scsih_shutdown,
 #ifdef CONFIG_PM
 	.suspend	= _scsih_suspend,
 	.resume		= _scsih_resume,
@@ -6113,6 +6408,9 @@ _scsih_init(void)
 	transport_cb_idx = mpt2sas_base_register_callback_handler(
 	    mpt2sas_transport_done);
 
+	/* scsih internal commands callback handler */
+	scsih_cb_idx = mpt2sas_base_register_callback_handler(_scsih_done);
+
 	/* configuration page API internal commands callback handler */
 	config_cb_idx = mpt2sas_base_register_callback_handler(
 	    mpt2sas_config_done);
@@ -6152,6 +6450,7 @@ _scsih_exit(void)
 	mpt2sas_base_release_callback_handler(tm_cb_idx);
 	mpt2sas_base_release_callback_handler(base_cb_idx);
 	mpt2sas_base_release_callback_handler(transport_cb_idx);
+	mpt2sas_base_release_callback_handler(scsih_cb_idx);
 	mpt2sas_base_release_callback_handler(config_cb_idx);
 	mpt2sas_base_release_callback_handler(ctl_cb_idx);
 
diff --git a/drivers/scsi/mpt2sas/mpt2sas_transport.c b/drivers/scsi/mpt2sas/mpt2sas_transport.c
index eb98188c7f3f..3a82872bad44 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_transport.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_transport.c
@@ -59,24 +59,23 @@
 
 #include "mpt2sas_base.h"
 /**
- * _transport_sas_node_find_by_handle - sas node search
+ * _transport_sas_node_find_by_sas_address - sas node search
  * @ioc: per adapter object
- * @handle: expander or hba handle (assigned by firmware)
+ * @sas_address: sas address of expander or sas host
  * Context: Calling function should acquire ioc->sas_node_lock.
  *
  * Search for either hba phys or expander device based on handle, then returns
  * the sas_node object.
  */
 static struct _sas_node *
-_transport_sas_node_find_by_handle(struct MPT2SAS_ADAPTER *ioc, u16 handle)
+_transport_sas_node_find_by_sas_address(struct MPT2SAS_ADAPTER *ioc,
+    u64 sas_address)
 {
-	int i;
-
-	for (i = 0; i < ioc->sas_hba.num_phys; i++)
-		if (ioc->sas_hba.phy[i].handle == handle)
-			return &ioc->sas_hba;
-
-	return mpt2sas_scsih_expander_find_by_handle(ioc, handle);
+	if (ioc->sas_hba.sas_address == sas_address)
+		return &ioc->sas_hba;
+	else
+		return mpt2sas_scsih_expander_find_by_sas_address(ioc,
+		    sas_address);
 }
 
 /**
@@ -259,8 +258,7 @@ struct rep_manu_reply{
 	u8 response_length;
 	u16 expander_change_count;
 	u8 reserved0[2];
-	u8 sas_format:1;
-	u8 reserved1:7;
+	u8 sas_format;
 	u8 reserved2[3];
 	u8 vendor_id[SAS_EXPANDER_VENDOR_ID_LEN];
 	u8 product_id[SAS_EXPANDER_PRODUCT_ID_LEN];
@@ -375,7 +373,8 @@ _transport_expander_report_manufacture(struct MPT2SAS_ADAPTER *ioc,
 	mpi_request->VP_ID = 0;
 	sas_address_le = (u64 *)&mpi_request->SASAddress;
 	*sas_address_le = cpu_to_le64(sas_address);
-	mpi_request->RequestDataLength = sizeof(struct rep_manu_request);
+	mpi_request->RequestDataLength =
+	    cpu_to_le16(sizeof(struct rep_manu_request));
 	psge = &mpi_request->SGL;
 
 	/* WRITE sgel first */
@@ -438,8 +437,8 @@ _transport_expander_report_manufacture(struct MPT2SAS_ADAPTER *ioc,
 		     SAS_EXPANDER_PRODUCT_ID_LEN);
 		strncpy(edev->product_rev, manufacture_reply->product_rev,
 		     SAS_EXPANDER_PRODUCT_REV_LEN);
-		edev->level = manufacture_reply->sas_format;
-		if (manufacture_reply->sas_format) {
+		edev->level = manufacture_reply->sas_format & 1;
+		if (edev->level) {
 			strncpy(edev->component_vendor_id,
 			    manufacture_reply->component_vendor_id,
 			     SAS_EXPANDER_COMPONENT_VENDOR_ID_LEN);
@@ -469,7 +468,7 @@ _transport_expander_report_manufacture(struct MPT2SAS_ADAPTER *ioc,
  * mpt2sas_transport_port_add - insert port to the list
  * @ioc: per adapter object
  * @handle: handle of attached device
- * @parent_handle: parent handle(either hba or expander)
+ * @sas_address: sas address of parent expander or sas host
  * Context: This function will acquire ioc->sas_node_lock.
  *
  * Adding new port object to the sas_node->sas_port_list.
@@ -478,7 +477,7 @@ _transport_expander_report_manufacture(struct MPT2SAS_ADAPTER *ioc,
  */
 struct _sas_port *
 mpt2sas_transport_port_add(struct MPT2SAS_ADAPTER *ioc, u16 handle,
-    u16 parent_handle)
+    u64 sas_address)
 {
 	struct _sas_phy *mpt2sas_phy, *next;
 	struct _sas_port *mpt2sas_port;
@@ -488,9 +487,6 @@ mpt2sas_transport_port_add(struct MPT2SAS_ADAPTER *ioc, u16 handle,
 	int i;
 	struct sas_port *port;
 
-	if (!parent_handle)
-		return NULL;
-
 	mpt2sas_port = kzalloc(sizeof(struct _sas_port),
 	    GFP_KERNEL);
 	if (!mpt2sas_port) {
@@ -502,17 +498,16 @@ mpt2sas_transport_port_add(struct MPT2SAS_ADAPTER *ioc, u16 handle,
 	INIT_LIST_HEAD(&mpt2sas_port->port_list);
 	INIT_LIST_HEAD(&mpt2sas_port->phy_list);
 	spin_lock_irqsave(&ioc->sas_node_lock, flags);
-	sas_node = _transport_sas_node_find_by_handle(ioc, parent_handle);
+	sas_node = _transport_sas_node_find_by_sas_address(ioc, sas_address);
 	spin_unlock_irqrestore(&ioc->sas_node_lock, flags);
 
 	if (!sas_node) {
-		printk(MPT2SAS_ERR_FMT "%s: Could not find parent(0x%04x)!\n",
-		    ioc->name, __func__, parent_handle);
+		printk(MPT2SAS_ERR_FMT "%s: Could not find "
+		    "parent sas_address(0x%016llx)!\n", ioc->name,
+		    __func__, (unsigned long long)sas_address);
 		goto out_fail;
 	}
 
-	mpt2sas_port->handle = parent_handle;
-	mpt2sas_port->sas_address = sas_node->sas_address;
 	if ((_transport_set_identify(ioc, handle,
 	    &mpt2sas_port->remote_identify))) {
 		printk(MPT2SAS_ERR_FMT "failure at %s:%d/%s()!\n",
@@ -604,7 +599,7 @@ mpt2sas_transport_port_add(struct MPT2SAS_ADAPTER *ioc, u16 handle,
  * mpt2sas_transport_port_remove - remove port from the list
  * @ioc: per adapter object
  * @sas_address: sas address of attached device
- * @parent_handle: handle to the upstream parent(either hba or expander)
+ * @sas_address_parent: sas address of parent expander or sas host
  * Context: This function will acquire ioc->sas_node_lock.
  *
  * Removing object and freeing associated memory from the
@@ -614,7 +609,7 @@ mpt2sas_transport_port_add(struct MPT2SAS_ADAPTER *ioc, u16 handle,
  */
 void
 mpt2sas_transport_port_remove(struct MPT2SAS_ADAPTER *ioc, u64 sas_address,
-    u16 parent_handle)
+    u64 sas_address_parent)
 {
 	int i;
 	unsigned long flags;
@@ -624,7 +619,8 @@ mpt2sas_transport_port_remove(struct MPT2SAS_ADAPTER *ioc, u64 sas_address,
 	struct _sas_phy *mpt2sas_phy, *next_phy;
 
 	spin_lock_irqsave(&ioc->sas_node_lock, flags);
-	sas_node = _transport_sas_node_find_by_handle(ioc, parent_handle);
+	sas_node = _transport_sas_node_find_by_sas_address(ioc,
+	    sas_address_parent);
 	spin_unlock_irqrestore(&ioc->sas_node_lock, flags);
 	if (!sas_node)
 		return;
@@ -650,8 +646,7 @@ mpt2sas_transport_port_remove(struct MPT2SAS_ADAPTER *ioc, u64 sas_address,
 	    &mpt2sas_port->phy_list, port_siblings) {
 		if ((ioc->logging_level & MPT_DEBUG_TRANSPORT))
 			dev_printk(KERN_INFO, &mpt2sas_port->port->dev,
-			    "remove: parent_handle(0x%04x), "
-			    "sas_addr(0x%016llx), phy(%d)\n", parent_handle,
+			    "remove: sas_addr(0x%016llx), phy(%d)\n",
 			    (unsigned long long)
 			    mpt2sas_port->remote_identify.sas_address,
 			    mpt2sas_phy->phy_id);
@@ -799,8 +794,8 @@ mpt2sas_transport_add_expander_phy(struct MPT2SAS_ADAPTER *ioc, struct _sas_phy
 /**
  * mpt2sas_transport_update_links - refreshing phy link changes
  * @ioc: per adapter object
- * @handle: handle to sas_host or expander
- * @attached_handle: attached device handle
+ * @sas_address: sas address of parent expander or sas host
+ * @handle: attached device handle
  * @phy_numberv: phy number
  * @link_rate: new link rate
  *
@@ -808,28 +803,25 @@ mpt2sas_transport_add_expander_phy(struct MPT2SAS_ADAPTER *ioc, struct _sas_phy
  */
 void
 mpt2sas_transport_update_links(struct MPT2SAS_ADAPTER *ioc,
-    u16 handle, u16 attached_handle, u8 phy_number, u8 link_rate)
+     u64 sas_address, u16 handle, u8 phy_number, u8 link_rate)
 {
 	unsigned long flags;
 	struct _sas_node *sas_node;
 	struct _sas_phy *mpt2sas_phy;
 
-	if (ioc->shost_recovery) {
-		printk(MPT2SAS_INFO_FMT "%s: host reset in progress!\n",
-			__func__, ioc->name);
+	if (ioc->shost_recovery)
 		return;
-	}
 
 	spin_lock_irqsave(&ioc->sas_node_lock, flags);
-	sas_node = _transport_sas_node_find_by_handle(ioc, handle);
+	sas_node = _transport_sas_node_find_by_sas_address(ioc, sas_address);
 	spin_unlock_irqrestore(&ioc->sas_node_lock, flags);
 	if (!sas_node)
 		return;
 
 	mpt2sas_phy = &sas_node->phy[phy_number];
-	mpt2sas_phy->attached_handle = attached_handle;
-	if (attached_handle && (link_rate >= MPI2_SAS_NEG_LINK_RATE_1_5))
-		_transport_set_identify(ioc, mpt2sas_phy->attached_handle,
+	mpt2sas_phy->attached_handle = handle;
+	if (handle && (link_rate >= MPI2_SAS_NEG_LINK_RATE_1_5))
+		_transport_set_identify(ioc, handle,
 		    &mpt2sas_phy->remote_identify);
 	else
 		memset(&mpt2sas_phy->remote_identify, 0 , sizeof(struct
@@ -841,13 +833,11 @@ mpt2sas_transport_update_links(struct MPT2SAS_ADAPTER *ioc,
 
 	if ((ioc->logging_level & MPT_DEBUG_TRANSPORT))
 		dev_printk(KERN_INFO, &mpt2sas_phy->phy->dev,
-		    "refresh: handle(0x%04x), sas_addr(0x%016llx),\n"
+		    "refresh: parent sas_addr(0x%016llx),\n"
 		    "\tlink_rate(0x%02x), phy(%d)\n"
 		    "\tattached_handle(0x%04x), sas_addr(0x%016llx)\n",
-		    handle, (unsigned long long)
-		    mpt2sas_phy->identify.sas_address, link_rate,
-		    phy_number, attached_handle,
-		    (unsigned long long)
+		    (unsigned long long)sas_address,
+		    link_rate, phy_number, handle, (unsigned long long)
 		    mpt2sas_phy->remote_identify.sas_address);
 }
 
@@ -1126,7 +1116,7 @@ _transport_smp_handler(struct Scsi_Host *shost, struct sas_rphy *rphy,
 	dma_addr_out = pci_map_single(ioc->pdev, bio_data(req->bio),
 		blk_rq_bytes(req), PCI_DMA_BIDIRECTIONAL);
 	if (!dma_addr_out) {
-		mpt2sas_base_free_smid(ioc, le16_to_cpu(smid));
+		mpt2sas_base_free_smid(ioc, smid);
 		goto unmap;
 	}
 
@@ -1144,7 +1134,7 @@ _transport_smp_handler(struct Scsi_Host *shost, struct sas_rphy *rphy,
 	dma_addr_in = pci_map_single(ioc->pdev, bio_data(rsp->bio),
 				     blk_rq_bytes(rsp), PCI_DMA_BIDIRECTIONAL);
 	if (!dma_addr_in) {
-		mpt2sas_base_free_smid(ioc, le16_to_cpu(smid));
+		mpt2sas_base_free_smid(ioc, smid);
 		goto unmap;
 	}
 
diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c
index c790d45876c4..cae6b2cf492f 100644
--- a/drivers/scsi/mvsas/mv_init.c
+++ b/drivers/scsi/mvsas/mv_init.c
@@ -657,6 +657,7 @@ static struct pci_device_id __devinitdata mvs_pci_table[] = {
 	{ PCI_VDEVICE(MARVELL, 0x9180), chip_9180 },
 	{ PCI_VDEVICE(ARECA, PCI_DEVICE_ID_ARECA_1300), chip_1300 },
 	{ PCI_VDEVICE(ARECA, PCI_DEVICE_ID_ARECA_1320), chip_1320 },
+	{ PCI_VDEVICE(ADAPTEC2, 0x0450), chip_6440 },
 
 	{ }	/* terminate list */
 };
diff --git a/drivers/scsi/ncr53c8xx.c b/drivers/scsi/ncr53c8xx.c
index e3c482aa87b5..a2d569828308 100644
--- a/drivers/scsi/ncr53c8xx.c
+++ b/drivers/scsi/ncr53c8xx.c
@@ -6495,7 +6495,7 @@ static void ncr_int_ma (struct ncb *np)
 	**	we force a SIR_NEGO_PROTO interrupt (it is a hack that avoids 
 	**	bloat for such a should_not_happen situation).
 	**	In all other situation, we reset the BUS.
-	**	Are these assumptions reasonnable ? (Wait and see ...)
+	**	Are these assumptions reasonable ? (Wait and see ...)
 	*/
 unexpected_phase:
 	dsp -= 8;
diff --git a/drivers/scsi/nsp32.c b/drivers/scsi/nsp32.c
index 2be7d5b018d2..2c98a6ee973b 100644
--- a/drivers/scsi/nsp32.c
+++ b/drivers/scsi/nsp32.c
@@ -1419,7 +1419,7 @@ static irqreturn_t do_nsp32_isr(int irq, void *dev_id)
 		nsp32_msg(KERN_ERR, "Received unexpected BMCNTERR IRQ! ");
 		/*
 		 * TODO: To be implemented improving bus master
-		 * transfer reliablity when BMCNTERR is occurred in
+		 * transfer reliability when BMCNTERR is occurred in
 		 * AutoSCSI phase described in specification.
 		 */
 	}
diff --git a/drivers/scsi/osd/osd_initiator.c b/drivers/scsi/osd/osd_initiator.c
index 7a117c18114c..24223473f573 100644
--- a/drivers/scsi/osd/osd_initiator.c
+++ b/drivers/scsi/osd/osd_initiator.c
@@ -73,7 +73,8 @@ static const char *_osd_ver_desc(struct osd_request *or)
 
 #define ATTR_DEF_RI(id, len) ATTR_DEF(OSD_APAGE_ROOT_INFORMATION, id, len)
 
-static int _osd_print_system_info(struct osd_dev *od, void *caps)
+static int _osd_get_print_system_info(struct osd_dev *od,
+	void *caps, struct osd_dev_info *odi)
 {
 	struct osd_request *or;
 	struct osd_attr get_attrs[] = {
@@ -137,8 +138,12 @@ static int _osd_print_system_info(struct osd_dev *od, void *caps)
 	OSD_INFO("PRODUCT_SERIAL_NUMBER  [%s]\n",
 		(char *)pFirst);
 
-	pFirst = get_attrs[a].val_ptr;
-	OSD_INFO("OSD_NAME               [%s]\n", (char *)pFirst);
+	odi->osdname_len = get_attrs[a].len;
+	/* Avoid NULL for memcmp optimization 0-length is good enough */
+	odi->osdname = kzalloc(odi->osdname_len + 1, GFP_KERNEL);
+	if (odi->osdname_len)
+		memcpy(odi->osdname, get_attrs[a].val_ptr, odi->osdname_len);
+	OSD_INFO("OSD_NAME               [%s]\n", odi->osdname);
 	a++;
 
 	pFirst = get_attrs[a++].val_ptr;
@@ -171,6 +176,14 @@ static int _osd_print_system_info(struct osd_dev *od, void *caps)
 				   sid_dump, sizeof(sid_dump), true);
 		OSD_INFO("OSD_SYSTEM_ID(%d)\n"
 			 "        [%s]\n", len, sid_dump);
+
+		if (unlikely(len > sizeof(odi->systemid))) {
+			OSD_ERR("OSD Target error: OSD_SYSTEM_ID too long(%d). "
+				"device idetification might not work\n", len);
+			len = sizeof(odi->systemid);
+		}
+		odi->systemid_len = len;
+		memcpy(odi->systemid, get_attrs[a].val_ptr, len);
 		a++;
 	}
 out:
@@ -178,16 +191,17 @@ out:
 	return ret;
 }
 
-int osd_auto_detect_ver(struct osd_dev *od, void *caps)
+int osd_auto_detect_ver(struct osd_dev *od,
+	void *caps, struct osd_dev_info *odi)
 {
 	int ret;
 
 	/* Auto-detect the osd version */
-	ret = _osd_print_system_info(od, caps);
+	ret = _osd_get_print_system_info(od, caps, odi);
 	if (ret) {
 		osd_dev_set_ver(od, OSD_VER1);
 		OSD_DEBUG("converting to OSD1\n");
-		ret = _osd_print_system_info(od, caps);
+		ret = _osd_get_print_system_info(od, caps, odi);
 	}
 
 	return ret;
@@ -418,30 +432,23 @@ static void _osd_free_seg(struct osd_request *or __unused,
 	seg->alloc_size = 0;
 }
 
-static void _put_request(struct request *rq , bool is_async)
+static void _put_request(struct request *rq)
 {
-	if (is_async) {
-		WARN_ON(rq->bio);
-		__blk_put_request(rq->q, rq);
-	} else {
-		/*
-		 * If osd_finalize_request() was called but the request was not
-		 * executed through the block layer, then we must release BIOs.
-		 * TODO: Keep error code in or->async_error. Need to audit all
-		 *       code paths.
-		 */
-		if (unlikely(rq->bio))
-			blk_end_request(rq, -ENOMEM, blk_rq_bytes(rq));
-		else
-			blk_put_request(rq);
-	}
+	/*
+	 * If osd_finalize_request() was called but the request was not
+	 * executed through the block layer, then we must release BIOs.
+	 * TODO: Keep error code in or->async_error. Need to audit all
+	 *       code paths.
+	 */
+	if (unlikely(rq->bio))
+		blk_end_request(rq, -ENOMEM, blk_rq_bytes(rq));
+	else
+		blk_put_request(rq);
 }
 
 void osd_end_request(struct osd_request *or)
 {
 	struct request *rq = or->request;
-	/* IMPORTANT: make sure this agrees with osd_execute_request_async */
-	bool is_async = (or->request->end_io_data == or);
 
 	_osd_free_seg(or, &or->set_attr);
 	_osd_free_seg(or, &or->enc_get_attr);
@@ -449,19 +456,34 @@ void osd_end_request(struct osd_request *or)
 
 	if (rq) {
 		if (rq->next_rq) {
-			_put_request(rq->next_rq, is_async);
+			_put_request(rq->next_rq);
 			rq->next_rq = NULL;
 		}
 
-		_put_request(rq, is_async);
+		_put_request(rq);
 	}
 	_osd_request_free(or);
 }
 EXPORT_SYMBOL(osd_end_request);
 
+static void _set_error_resid(struct osd_request *or, struct request *req,
+			     int error)
+{
+	or->async_error = error;
+	or->req_errors = req->errors ? : error;
+	or->sense_len = req->sense_len;
+	if (or->out.req)
+		or->out.residual = or->out.req->resid_len;
+	if (or->in.req)
+		or->in.residual = or->in.req->resid_len;
+}
+
 int osd_execute_request(struct osd_request *or)
 {
-	return blk_execute_rq(or->request->q, NULL, or->request, 0);
+	int error = blk_execute_rq(or->request->q, NULL, or->request, 0);
+
+	_set_error_resid(or, or->request, error);
+	return error;
 }
 EXPORT_SYMBOL(osd_execute_request);
 
@@ -469,10 +491,16 @@ static void osd_request_async_done(struct request *req, int error)
 {
 	struct osd_request *or = req->end_io_data;
 
-	or->async_error = error;
+	_set_error_resid(or, req, error);
+	if (req->next_rq) {
+		__blk_put_request(req->q, req->next_rq);
+		req->next_rq = NULL;
+	}
 
-	if (error)
-		OSD_DEBUG("osd_request_async_done error recieved %d\n", error);
+	__blk_put_request(req->q, req);
+	or->request = NULL;
+	or->in.req = NULL;
+	or->out.req = NULL;
 
 	if (or->async_done)
 		or->async_done(or, or->async_private);
@@ -1153,6 +1181,7 @@ int osd_req_decode_get_attr_list(struct osd_request *or,
 				"c=%d r=%d n=%d\n",
 				cur_bytes, returned_bytes, n);
 			oa->val_ptr = NULL;
+			cur_bytes = returned_bytes; /* break the caller loop */
 			break;
 		}
 
@@ -1436,6 +1465,15 @@ int osd_finalize_request(struct osd_request *or,
 }
 EXPORT_SYMBOL(osd_finalize_request);
 
+static bool _is_osd_security_code(int code)
+{
+	return	(code == osd_security_audit_value_frozen) ||
+		(code == osd_security_working_key_frozen) ||
+		(code == osd_nonce_not_unique) ||
+		(code == osd_nonce_timestamp_out_of_range) ||
+		(code == osd_invalid_dataout_buffer_integrity_check_value);
+}
+
 #define OSD_SENSE_PRINT1(fmt, a...) \
 	do { \
 		if (__cur_sense_need_output) \
@@ -1458,27 +1496,29 @@ int osd_req_decode_sense_full(struct osd_request *or,
 #else
 	bool __cur_sense_need_output = !silent;
 #endif
+	int ret;
 
-	if (!or->request->errors)
+	if (likely(!or->req_errors))
 		return 0;
 
-	ssdb = or->request->sense;
-	sense_len = or->request->sense_len;
+	osi = osi ? : &local_osi;
+	memset(osi, 0, sizeof(*osi));
+
+	ssdb = (typeof(ssdb))or->sense;
+	sense_len = or->sense_len;
 	if ((sense_len < (int)sizeof(*ssdb) || !ssdb->sense_key)) {
 		OSD_ERR("Block-layer returned error(0x%x) but "
 			"sense_len(%u) || key(%d) is empty\n",
-			or->request->errors, sense_len, ssdb->sense_key);
-		return -EIO;
+			or->req_errors, sense_len, ssdb->sense_key);
+		goto analyze;
 	}
 
 	if ((ssdb->response_code != 0x72) && (ssdb->response_code != 0x73)) {
 		OSD_ERR("Unrecognized scsi sense: rcode=%x length=%d\n",
 			ssdb->response_code, sense_len);
-		return -EIO;
+		goto analyze;
 	}
 
-	osi = osi ? : &local_osi;
-	memset(osi, 0, sizeof(*osi));
 	osi->key = ssdb->sense_key;
 	osi->additional_code = be16_to_cpu(ssdb->additional_sense_code);
 	original_sense_len = ssdb->additional_sense_length + 8;
@@ -1488,9 +1528,10 @@ int osd_req_decode_sense_full(struct osd_request *or,
 		__cur_sense_need_output = (osi->key > scsi_sk_recovered_error);
 #endif
 	OSD_SENSE_PRINT1("Main Sense information key=0x%x length(%d, %d) "
-			"additional_code=0x%x\n",
+			"additional_code=0x%x async_error=%d errors=0x%x\n",
 			osi->key, original_sense_len, sense_len,
-			osi->additional_code);
+			osi->additional_code, or->async_error,
+			or->req_errors);
 
 	if (original_sense_len < sense_len)
 		sense_len = original_sense_len;
@@ -1569,15 +1610,14 @@ int osd_req_decode_sense_full(struct osd_request *or,
 		{
 			struct osd_sense_attributes_data_descriptor
 				*osadd = cur_descriptor;
-			int len = min(cur_len, sense_len);
-			int i = 0;
+			unsigned len = min(cur_len, sense_len);
 			struct osd_sense_attr *pattr = osadd->sense_attrs;
 
-			while (len < 0) {
+			while (len >= sizeof(*pattr)) {
 				u32 attr_page = be32_to_cpu(pattr->attr_page);
 				u32 attr_id = be32_to_cpu(pattr->attr_id);
 
-				if (i++ == 0) {
+				if (!osi->attr.attr_page) {
 					osi->attr.attr_page = attr_page;
 					osi->attr.attr_id = attr_id;
 				}
@@ -1588,6 +1628,8 @@ int osd_req_decode_sense_full(struct osd_request *or,
 					bad_attr_list++;
 					max_attr--;
 				}
+
+				len -= sizeof(*pattr);
 				OSD_SENSE_PRINT2(
 					"osd_sense_attribute_identification"
 					"attr_page=0x%x attr_id=0x%x\n",
@@ -1621,7 +1663,50 @@ int osd_req_decode_sense_full(struct osd_request *or,
 		cur_descriptor += cur_len;
 	}
 
-	return (osi->key > scsi_sk_recovered_error) ? -EIO : 0;
+analyze:
+	if (!osi->key) {
+		/* scsi sense is Empty, the request was never issued to target
+		 * linux return code might tell us what happened.
+		 */
+		if (or->async_error == -ENOMEM)
+			osi->osd_err_pri = OSD_ERR_PRI_RESOURCE;
+		else
+			osi->osd_err_pri = OSD_ERR_PRI_UNREACHABLE;
+		ret = or->async_error;
+	} else if (osi->key <= scsi_sk_recovered_error) {
+		osi->osd_err_pri = 0;
+		ret = 0;
+	} else if (osi->additional_code == scsi_invalid_field_in_cdb) {
+		if (osi->cdb_field_offset == OSD_CFO_STARTING_BYTE) {
+			osi->osd_err_pri = OSD_ERR_PRI_CLEAR_PAGES;
+			ret = -EFAULT; /* caller should recover from this */
+		} else if (osi->cdb_field_offset == OSD_CFO_OBJECT_ID) {
+			osi->osd_err_pri = OSD_ERR_PRI_NOT_FOUND;
+			ret = -ENOENT;
+		} else if (osi->cdb_field_offset == OSD_CFO_PERMISSIONS) {
+			osi->osd_err_pri = OSD_ERR_PRI_NO_ACCESS;
+			ret = -EACCES;
+		} else {
+			osi->osd_err_pri = OSD_ERR_PRI_BAD_CRED;
+			ret = -EINVAL;
+		}
+	} else if (osi->additional_code == osd_quota_error) {
+		osi->osd_err_pri = OSD_ERR_PRI_NO_SPACE;
+		ret = -ENOSPC;
+	} else if (_is_osd_security_code(osi->additional_code)) {
+		osi->osd_err_pri = OSD_ERR_PRI_BAD_CRED;
+		ret = -EINVAL;
+	} else {
+		osi->osd_err_pri = OSD_ERR_PRI_EIO;
+		ret = -EIO;
+	}
+
+	if (!or->out.residual)
+		or->out.residual = or->out.total_bytes;
+	if (!or->in.residual)
+		or->in.residual = or->in.total_bytes;
+
+	return ret;
 }
 EXPORT_SYMBOL(osd_req_decode_sense_full);
 
diff --git a/drivers/scsi/osd/osd_uld.c b/drivers/scsi/osd/osd_uld.c
index 0bdef3390902..0a90702b3d71 100644
--- a/drivers/scsi/osd/osd_uld.c
+++ b/drivers/scsi/osd/osd_uld.c
@@ -71,8 +71,7 @@
 #define SCSI_OSD_MAX_MINOR 64
 
 static const char osd_name[] = "osd";
-static const char *osd_version_string = "open-osd 0.1.0";
-const char osd_symlink[] = "scsi_osd";
+static const char *osd_version_string = "open-osd 0.2.0";
 
 MODULE_AUTHOR("Boaz Harrosh <bharrosh@panasas.com>");
 MODULE_DESCRIPTION("open-osd Upper-Layer-Driver osd.ko");
@@ -82,15 +81,25 @@ MODULE_ALIAS_SCSI_DEVICE(TYPE_OSD);
 
 struct osd_uld_device {
 	int minor;
-	struct kref kref;
+	struct device class_dev;
 	struct cdev cdev;
 	struct osd_dev od;
+	struct osd_dev_info odi;
 	struct gendisk *disk;
-	struct device *class_member;
 };
 
-static void __uld_get(struct osd_uld_device *oud);
-static void __uld_put(struct osd_uld_device *oud);
+struct osd_dev_handle {
+	struct osd_dev od;
+	struct file *file;
+	struct osd_uld_device *oud;
+} ;
+
+static DEFINE_IDA(osd_minor_ida);
+
+static struct class osd_uld_class = {
+	.owner		= THIS_MODULE,
+	.name		= "scsi_osd",
+};
 
 /*
  * Char Device operations
@@ -101,7 +110,7 @@ static int osd_uld_open(struct inode *inode, struct file *file)
 	struct osd_uld_device *oud = container_of(inode->i_cdev,
 					struct osd_uld_device, cdev);
 
-	__uld_get(oud);
+	get_device(&oud->class_dev);
 	/* cache osd_uld_device on file handle */
 	file->private_data = oud;
 	OSD_DEBUG("osd_uld_open %p\n", oud);
@@ -114,7 +123,7 @@ static int osd_uld_release(struct inode *inode, struct file *file)
 
 	OSD_DEBUG("osd_uld_release %p\n", file->private_data);
 	file->private_data = NULL;
-	__uld_put(oud);
+	put_device(&oud->class_dev);
 	return 0;
 }
 
@@ -177,7 +186,7 @@ static const struct file_operations osd_fops = {
 struct osd_dev *osduld_path_lookup(const char *name)
 {
 	struct osd_uld_device *oud;
-	struct osd_dev *od;
+	struct osd_dev_handle *odh;
 	struct file *file;
 	int error;
 
@@ -186,8 +195,8 @@ struct osd_dev *osduld_path_lookup(const char *name)
 		return ERR_PTR(-EINVAL);
 	}
 
-	od = kzalloc(sizeof(*od), GFP_KERNEL);
-	if (!od)
+	odh = kzalloc(sizeof(*odh), GFP_KERNEL);
+	if (unlikely(!odh))
 		return ERR_PTR(-ENOMEM);
 
 	file = filp_open(name, O_RDWR, 0);
@@ -203,33 +212,134 @@ struct osd_dev *osduld_path_lookup(const char *name)
 
 	oud = file->private_data;
 
-	*od = oud->od;
-	od->file = file;
+	odh->od = oud->od;
+	odh->file = file;
+	odh->oud = oud;
 
-	return od;
+	return &odh->od;
 
 close_file:
 	fput(file);
 free_od:
-	kfree(od);
+	kfree(odh);
 	return ERR_PTR(error);
 }
 EXPORT_SYMBOL(osduld_path_lookup);
 
-void osduld_put_device(struct osd_dev *od)
+static inline bool _the_same_or_null(const u8 *a1, unsigned a1_len,
+				     const u8 *a2, unsigned a2_len)
 {
+	if (!a2_len) /* User string is Empty means don't care */
+		return true;
+
+	if (a1_len != a2_len)
+		return false;
+
+	return 0 == memcmp(a1, a2, a1_len);
+}
+
+struct find_oud_t {
+	const struct osd_dev_info *odi;
+	struct device *dev;
+	struct osd_uld_device *oud;
+} ;
+
+int _mach_odi(struct device *dev, void *find_data)
+{
+	struct osd_uld_device *oud = container_of(dev, struct osd_uld_device,
+						  class_dev);
+	struct find_oud_t *fot = find_data;
+	const struct osd_dev_info *odi = fot->odi;
+
+	if (_the_same_or_null(oud->odi.systemid, oud->odi.systemid_len,
+			      odi->systemid, odi->systemid_len) &&
+	    _the_same_or_null(oud->odi.osdname, oud->odi.osdname_len,
+			      odi->osdname, odi->osdname_len)) {
+		OSD_DEBUG("found device sysid_len=%d osdname=%d\n",
+			  odi->systemid_len, odi->osdname_len);
+		fot->oud = oud;
+		return 1;
+	} else {
+		return 0;
+	}
+}
+
+/* osduld_info_lookup - Loop through all devices, return the requested osd_dev.
+ *
+ * if @odi->systemid_len and/or @odi->osdname_len are zero, they act as a don't
+ * care. .e.g if they're both zero /dev/osd0 is returned.
+ */
+struct osd_dev *osduld_info_lookup(const struct osd_dev_info *odi)
+{
+	struct find_oud_t find = {.odi = odi};
+
+	find.dev = class_find_device(&osd_uld_class, NULL, &find, _mach_odi);
+	if (likely(find.dev)) {
+		struct osd_dev_handle *odh = kzalloc(sizeof(*odh), GFP_KERNEL);
+
+		if (unlikely(!odh)) {
+			put_device(find.dev);
+			return ERR_PTR(-ENOMEM);
+		}
 
+		odh->od = find.oud->od;
+		odh->oud = find.oud;
+
+		return &odh->od;
+	}
+
+	return ERR_PTR(-ENODEV);
+}
+EXPORT_SYMBOL(osduld_info_lookup);
+
+void osduld_put_device(struct osd_dev *od)
+{
 	if (od && !IS_ERR(od)) {
-		struct osd_uld_device *oud = od->file->private_data;
+		struct osd_dev_handle *odh =
+				container_of(od, struct osd_dev_handle, od);
+		struct osd_uld_device *oud = odh->oud;
 
 		BUG_ON(od->scsi_device != oud->od.scsi_device);
 
-		fput(od->file);
-		kfree(od);
+		/* If scsi has released the device (logout), and exofs has last
+		 * reference on oud it will be freed by above osd_uld_release
+		 * within fput below. But this will oops in cdev_release which
+		 * is called after the fops->release. A get_/put_ pair makes
+		 * sure we have a cdev for the duration of fput
+		 */
+		if (odh->file) {
+			get_device(&oud->class_dev);
+			fput(odh->file);
+		}
+		put_device(&oud->class_dev);
+		kfree(odh);
 	}
 }
 EXPORT_SYMBOL(osduld_put_device);
 
+const struct osd_dev_info *osduld_device_info(struct osd_dev *od)
+{
+	struct osd_dev_handle *odh =
+				container_of(od, struct osd_dev_handle, od);
+	return &odh->oud->odi;
+}
+EXPORT_SYMBOL(osduld_device_info);
+
+bool osduld_device_same(struct osd_dev *od, const struct osd_dev_info *odi)
+{
+	struct osd_dev_handle *odh =
+				container_of(od, struct osd_dev_handle, od);
+	struct osd_uld_device *oud = odh->oud;
+
+	return (oud->odi.systemid_len == odi->systemid_len) &&
+		_the_same_or_null(oud->odi.systemid, oud->odi.systemid_len,
+				 odi->systemid, odi->systemid_len) &&
+		(oud->odi.osdname_len == odi->osdname_len) &&
+		_the_same_or_null(oud->odi.osdname, oud->odi.osdname_len,
+				  odi->osdname, odi->osdname_len);
+}
+EXPORT_SYMBOL(osduld_device_same);
+
 /*
  * Scsi Device operations
  */
@@ -250,14 +360,35 @@ static int __detect_osd(struct osd_uld_device *oud)
 		OSD_ERR("warning: scsi_test_unit_ready failed\n");
 
 	osd_sec_init_nosec_doall_caps(caps, &osd_root_object, false, true);
-	if (osd_auto_detect_ver(&oud->od, caps))
+	if (osd_auto_detect_ver(&oud->od, caps, &oud->odi))
 		return -ENODEV;
 
 	return 0;
 }
 
-static struct class *osd_sysfs_class;
-static DEFINE_IDA(osd_minor_ida);
+static void __remove(struct device *dev)
+{
+	struct osd_uld_device *oud = container_of(dev, struct osd_uld_device,
+						  class_dev);
+	struct scsi_device *scsi_device = oud->od.scsi_device;
+
+	kfree(oud->odi.osdname);
+
+	if (oud->cdev.owner)
+		cdev_del(&oud->cdev);
+
+	osd_dev_fini(&oud->od);
+	scsi_device_put(scsi_device);
+
+	OSD_INFO("osd_remove %s\n",
+		 oud->disk ? oud->disk->disk_name : NULL);
+
+	if (oud->disk)
+		put_disk(oud->disk);
+	ida_remove(&osd_minor_ida, oud->minor);
+
+	kfree(oud);
+}
 
 static int osd_probe(struct device *dev)
 {
@@ -289,7 +420,6 @@ static int osd_probe(struct device *dev)
 	if (NULL == oud)
 		goto err_retract_minor;
 
-	kref_init(&oud->kref);
 	dev_set_drvdata(dev, oud);
 	oud->minor = minor;
 
@@ -327,18 +457,25 @@ static int osd_probe(struct device *dev)
 		OSD_ERR("cdev_add failed\n");
 		goto err_put_disk;
 	}
-	kobject_get(&oud->cdev.kobj); /* 2nd ref see osd_remove() */
-
-	/* class_member */
-	oud->class_member = device_create(osd_sysfs_class, dev,
-		MKDEV(SCSI_OSD_MAJOR, oud->minor), "%s", disk->disk_name);
-	if (IS_ERR(oud->class_member)) {
-		OSD_ERR("class_device_create failed\n");
-		error = PTR_ERR(oud->class_member);
+
+	/* class device member */
+	oud->class_dev.devt = oud->cdev.dev;
+	oud->class_dev.class = &osd_uld_class;
+	oud->class_dev.parent = dev;
+	oud->class_dev.release = __remove;
+	error = dev_set_name(&oud->class_dev, disk->disk_name);
+	if (error) {
+		OSD_ERR("dev_set_name failed => %d\n", error);
+		goto err_put_cdev;
+	}
+
+	error = device_register(&oud->class_dev);
+	if (error) {
+		OSD_ERR("device_register failed => %d\n", error);
 		goto err_put_cdev;
 	}
 
-	dev_set_drvdata(oud->class_member, oud);
+	get_device(&oud->class_dev);
 
 	OSD_INFO("osd_probe %s\n", disk->disk_name);
 	return 0;
@@ -367,54 +504,12 @@ static int osd_remove(struct device *dev)
 			scsi_device);
 	}
 
-	if (oud->class_member)
-		device_destroy(osd_sysfs_class,
-			       MKDEV(SCSI_OSD_MAJOR, oud->minor));
+	device_unregister(&oud->class_dev);
 
-	/* We have 2 references to the cdev. One is released here
-	 * and also takes down the /dev/osdX mapping. The second
-	 * Will be released in __remove() after all users have released
-	 * the osd_uld_device.
-	 */
-	if (oud->cdev.owner)
-		cdev_del(&oud->cdev);
-
-	__uld_put(oud);
+	put_device(&oud->class_dev);
 	return 0;
 }
 
-static void __remove(struct kref *kref)
-{
-	struct osd_uld_device *oud = container_of(kref,
-					struct osd_uld_device, kref);
-	struct scsi_device *scsi_device = oud->od.scsi_device;
-
-	/* now let delete the char_dev */
-	kobject_put(&oud->cdev.kobj);
-
-	osd_dev_fini(&oud->od);
-	scsi_device_put(scsi_device);
-
-	OSD_INFO("osd_remove %s\n",
-		 oud->disk ? oud->disk->disk_name : NULL);
-
-	if (oud->disk)
-		put_disk(oud->disk);
-
-	ida_remove(&osd_minor_ida, oud->minor);
-	kfree(oud);
-}
-
-static void __uld_get(struct osd_uld_device *oud)
-{
-	kref_get(&oud->kref);
-}
-
-static void __uld_put(struct osd_uld_device *oud)
-{
-	kref_put(&oud->kref, __remove);
-}
-
 /*
  * Global driver and scsi registration
  */
@@ -432,11 +527,10 @@ static int __init osd_uld_init(void)
 {
 	int err;
 
-	osd_sysfs_class = class_create(THIS_MODULE, osd_symlink);
-	if (IS_ERR(osd_sysfs_class)) {
-		OSD_ERR("Unable to register sysfs class => %ld\n",
-			PTR_ERR(osd_sysfs_class));
-		return PTR_ERR(osd_sysfs_class);
+	err = class_register(&osd_uld_class);
+	if (err) {
+		OSD_ERR("Unable to register sysfs class => %d\n", err);
+		return err;
 	}
 
 	err = register_chrdev_region(MKDEV(SCSI_OSD_MAJOR, 0),
@@ -459,7 +553,7 @@ static int __init osd_uld_init(void)
 err_out_chrdev:
 	unregister_chrdev_region(MKDEV(SCSI_OSD_MAJOR, 0), SCSI_OSD_MAX_MINOR);
 err_out:
-	class_destroy(osd_sysfs_class);
+	class_unregister(&osd_uld_class);
 	return err;
 }
 
@@ -467,7 +561,7 @@ static void __exit osd_uld_exit(void)
 {
 	scsi_unregister_driver(&osd_driver.gendrv);
 	unregister_chrdev_region(MKDEV(SCSI_OSD_MAJOR, 0), SCSI_OSD_MAX_MINOR);
-	class_destroy(osd_sysfs_class);
+	class_unregister(&osd_uld_class);
 	OSD_INFO("UNLOADED %s\n", osd_version_string);
 }
 
diff --git a/drivers/scsi/pm8001/Makefile b/drivers/scsi/pm8001/Makefile
new file mode 100644
index 000000000000..52f04296171c
--- /dev/null
+++ b/drivers/scsi/pm8001/Makefile
@@ -0,0 +1,12 @@
+#
+# Kernel configuration file for the PM8001 SAS/SATA 8x6G based HBA driver
+#
+# Copyright (C) 2008-2009  USI Co., Ltd.
+
+
+obj-$(CONFIG_SCSI_PM8001) += pm8001.o
+pm8001-y += pm8001_init.o \
+		pm8001_sas.o  \
+		pm8001_ctl.o  \
+		pm8001_hwi.o
+
diff --git a/drivers/scsi/pm8001/pm8001_chips.h b/drivers/scsi/pm8001/pm8001_chips.h
new file mode 100644
index 000000000000..4efa4d0950e5
--- /dev/null
+++ b/drivers/scsi/pm8001/pm8001_chips.h
@@ -0,0 +1,89 @@
+/*
+ * PMC-Sierra SPC 8001 SAS/SATA based host adapters driver
+ *
+ * Copyright (c) 2008-2009 USI Co., Ltd.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ *
+ */
+
+#ifndef _PM8001_CHIPS_H_
+#define _PM8001_CHIPS_H_
+
+static inline u32 pm8001_read_32(void *virt_addr)
+{
+	return *((u32 *)virt_addr);
+}
+
+static inline void pm8001_write_32(void *addr, u32 offset, u32 val)
+{
+	*((u32 *)(addr + offset)) = val;
+}
+
+static inline u32 pm8001_cr32(struct pm8001_hba_info *pm8001_ha, u32 bar,
+		u32 offset)
+{
+	return readl(pm8001_ha->io_mem[bar].memvirtaddr + offset);
+}
+
+static inline void pm8001_cw32(struct pm8001_hba_info *pm8001_ha, u32 bar,
+		u32 addr, u32 val)
+{
+	writel(val, pm8001_ha->io_mem[bar].memvirtaddr + addr);
+}
+static inline u32 pm8001_mr32(void __iomem *addr, u32 offset)
+{
+	return readl(addr + offset);
+}
+static inline void pm8001_mw32(void __iomem *addr, u32 offset, u32 val)
+{
+	writel(val, addr + offset);
+}
+static inline u32 get_pci_bar_index(u32 pcibar)
+{
+		switch (pcibar) {
+		case 0x18:
+		case 0x1C:
+			return 1;
+		case 0x20:
+			return 2;
+		case 0x24:
+			return 3;
+		default:
+			return 0;
+	}
+}
+
+#endif  /* _PM8001_CHIPS_H_ */
+
diff --git a/drivers/scsi/pm8001/pm8001_ctl.c b/drivers/scsi/pm8001/pm8001_ctl.c
new file mode 100644
index 000000000000..14b13acae6dd
--- /dev/null
+++ b/drivers/scsi/pm8001/pm8001_ctl.c
@@ -0,0 +1,573 @@
+/*
+ * PMC-Sierra SPC 8001 SAS/SATA based host adapters driver
+ *
+ * Copyright (c) 2008-2009 USI Co., Ltd.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ *
+ */
+#include <linux/firmware.h>
+#include "pm8001_sas.h"
+#include "pm8001_ctl.h"
+
+/* scsi host attributes */
+
+/**
+ * pm8001_ctl_mpi_interface_rev_show - MPI interface revision number
+ * @cdev: pointer to embedded class device
+ * @buf: the buffer returned
+ *
+ * A sysfs 'read-only' shost attribute.
+ */
+static ssize_t pm8001_ctl_mpi_interface_rev_show(struct device *cdev,
+	struct device_attribute *attr, char *buf)
+{
+	struct Scsi_Host *shost = class_to_shost(cdev);
+	struct sas_ha_struct *sha = SHOST_TO_SAS_HA(shost);
+	struct pm8001_hba_info *pm8001_ha = sha->lldd_ha;
+
+	return snprintf(buf, PAGE_SIZE, "%d\n",
+		pm8001_ha->main_cfg_tbl.interface_rev);
+}
+static
+DEVICE_ATTR(interface_rev, S_IRUGO, pm8001_ctl_mpi_interface_rev_show, NULL);
+
+/**
+ * pm8001_ctl_fw_version_show - firmware version
+ * @cdev: pointer to embedded class device
+ * @buf: the buffer returned
+ *
+ * A sysfs 'read-only' shost attribute.
+ */
+static ssize_t pm8001_ctl_fw_version_show(struct device *cdev,
+	struct device_attribute *attr, char *buf)
+{
+	struct Scsi_Host *shost = class_to_shost(cdev);
+	struct sas_ha_struct *sha = SHOST_TO_SAS_HA(shost);
+	struct pm8001_hba_info *pm8001_ha = sha->lldd_ha;
+
+	return snprintf(buf, PAGE_SIZE, "%02x.%02x.%02x.%02x\n",
+		       (u8)(pm8001_ha->main_cfg_tbl.firmware_rev >> 24),
+		       (u8)(pm8001_ha->main_cfg_tbl.firmware_rev >> 16),
+		       (u8)(pm8001_ha->main_cfg_tbl.firmware_rev >> 8),
+		       (u8)(pm8001_ha->main_cfg_tbl.firmware_rev));
+}
+static DEVICE_ATTR(fw_version, S_IRUGO, pm8001_ctl_fw_version_show, NULL);
+/**
+ * pm8001_ctl_max_out_io_show - max outstanding io supported
+ * @cdev: pointer to embedded class device
+ * @buf: the buffer returned
+ *
+ * A sysfs 'read-only' shost attribute.
+ */
+static ssize_t pm8001_ctl_max_out_io_show(struct device *cdev,
+	struct device_attribute *attr, char *buf)
+{
+	struct Scsi_Host *shost = class_to_shost(cdev);
+	struct sas_ha_struct *sha = SHOST_TO_SAS_HA(shost);
+	struct pm8001_hba_info *pm8001_ha = sha->lldd_ha;
+
+	return snprintf(buf, PAGE_SIZE, "%d\n",
+			pm8001_ha->main_cfg_tbl.max_out_io);
+}
+static DEVICE_ATTR(max_out_io, S_IRUGO, pm8001_ctl_max_out_io_show, NULL);
+/**
+ * pm8001_ctl_max_devices_show - max devices support
+ * @cdev: pointer to embedded class device
+ * @buf: the buffer returned
+ *
+ * A sysfs 'read-only' shost attribute.
+ */
+static ssize_t pm8001_ctl_max_devices_show(struct device *cdev,
+	struct device_attribute *attr, char *buf)
+{
+	struct Scsi_Host *shost = class_to_shost(cdev);
+	struct sas_ha_struct *sha = SHOST_TO_SAS_HA(shost);
+	struct pm8001_hba_info *pm8001_ha = sha->lldd_ha;
+
+	return snprintf(buf, PAGE_SIZE, "%04d\n",
+			(u16)(pm8001_ha->main_cfg_tbl.max_sgl >> 16));
+}
+static DEVICE_ATTR(max_devices, S_IRUGO, pm8001_ctl_max_devices_show, NULL);
+/**
+ * pm8001_ctl_max_sg_list_show - max sg list supported iff not 0.0 for no
+ * hardware limitation
+ * @cdev: pointer to embedded class device
+ * @buf: the buffer returned
+ *
+ * A sysfs 'read-only' shost attribute.
+ */
+static ssize_t pm8001_ctl_max_sg_list_show(struct device *cdev,
+	struct device_attribute *attr, char *buf)
+{
+	struct Scsi_Host *shost = class_to_shost(cdev);
+	struct sas_ha_struct *sha = SHOST_TO_SAS_HA(shost);
+	struct pm8001_hba_info *pm8001_ha = sha->lldd_ha;
+
+	return snprintf(buf, PAGE_SIZE, "%04d\n",
+			pm8001_ha->main_cfg_tbl.max_sgl & 0x0000FFFF);
+}
+static DEVICE_ATTR(max_sg_list, S_IRUGO, pm8001_ctl_max_sg_list_show, NULL);
+
+#define SAS_1_0 0x1
+#define SAS_1_1 0x2
+#define SAS_2_0 0x4
+
+static ssize_t
+show_sas_spec_support_status(unsigned int mode, char *buf)
+{
+	ssize_t len = 0;
+
+	if (mode & SAS_1_1)
+		len = sprintf(buf, "%s", "SAS1.1");
+	if (mode & SAS_2_0)
+		len += sprintf(buf + len, "%s%s", len ? ", " : "", "SAS2.0");
+	len += sprintf(buf + len, "\n");
+
+	return len;
+}
+
+/**
+ * pm8001_ctl_sas_spec_support_show - sas spec supported
+ * @cdev: pointer to embedded class device
+ * @buf: the buffer returned
+ *
+ * A sysfs 'read-only' shost attribute.
+ */
+static ssize_t pm8001_ctl_sas_spec_support_show(struct device *cdev,
+	struct device_attribute *attr, char *buf)
+{
+	unsigned int mode;
+	struct Scsi_Host *shost = class_to_shost(cdev);
+	struct sas_ha_struct *sha = SHOST_TO_SAS_HA(shost);
+	struct pm8001_hba_info *pm8001_ha = sha->lldd_ha;
+	mode = (pm8001_ha->main_cfg_tbl.ctrl_cap_flag & 0xfe000000)>>25;
+	return show_sas_spec_support_status(mode, buf);
+}
+static DEVICE_ATTR(sas_spec_support, S_IRUGO,
+		   pm8001_ctl_sas_spec_support_show, NULL);
+
+/**
+ * pm8001_ctl_sas_address_show - sas address
+ * @cdev: pointer to embedded class device
+ * @buf: the buffer returned
+ *
+ * This is the controller sas address
+ *
+ * A sysfs 'read-only' shost attribute.
+ */
+static ssize_t pm8001_ctl_host_sas_address_show(struct device *cdev,
+	struct device_attribute *attr, char *buf)
+{
+	struct Scsi_Host *shost = class_to_shost(cdev);
+	struct sas_ha_struct *sha = SHOST_TO_SAS_HA(shost);
+	struct pm8001_hba_info *pm8001_ha = sha->lldd_ha;
+	return snprintf(buf, PAGE_SIZE, "0x%016llx\n",
+			be64_to_cpu(*(__be64 *)pm8001_ha->sas_addr));
+}
+static DEVICE_ATTR(host_sas_address, S_IRUGO,
+		   pm8001_ctl_host_sas_address_show, NULL);
+
+/**
+ * pm8001_ctl_logging_level_show - logging level
+ * @cdev: pointer to embedded class device
+ * @buf: the buffer returned
+ *
+ * A sysfs 'read/write' shost attribute.
+ */
+static ssize_t pm8001_ctl_logging_level_show(struct device *cdev,
+	struct device_attribute *attr, char *buf)
+{
+	struct Scsi_Host *shost = class_to_shost(cdev);
+	struct sas_ha_struct *sha = SHOST_TO_SAS_HA(shost);
+	struct pm8001_hba_info *pm8001_ha = sha->lldd_ha;
+
+	return snprintf(buf, PAGE_SIZE, "%08xh\n", pm8001_ha->logging_level);
+}
+static ssize_t pm8001_ctl_logging_level_store(struct device *cdev,
+	struct device_attribute *attr, const char *buf, size_t count)
+{
+	struct Scsi_Host *shost = class_to_shost(cdev);
+	struct sas_ha_struct *sha = SHOST_TO_SAS_HA(shost);
+	struct pm8001_hba_info *pm8001_ha = sha->lldd_ha;
+	int val = 0;
+
+	if (sscanf(buf, "%x", &val) != 1)
+		return -EINVAL;
+
+	pm8001_ha->logging_level = val;
+	return strlen(buf);
+}
+
+static DEVICE_ATTR(logging_level, S_IRUGO | S_IWUSR,
+	pm8001_ctl_logging_level_show, pm8001_ctl_logging_level_store);
+/**
+ * pm8001_ctl_aap_log_show - aap1 event log
+ * @cdev: pointer to embedded class device
+ * @buf: the buffer returned
+ *
+ * A sysfs 'read-only' shost attribute.
+ */
+static ssize_t pm8001_ctl_aap_log_show(struct device *cdev,
+	struct device_attribute *attr, char *buf)
+{
+	struct Scsi_Host *shost = class_to_shost(cdev);
+	struct sas_ha_struct *sha = SHOST_TO_SAS_HA(shost);
+	struct pm8001_hba_info *pm8001_ha = sha->lldd_ha;
+	int i;
+#define AAP1_MEMMAP(r, c) \
+	(*(u32 *)((u8*)pm8001_ha->memoryMap.region[AAP1].virt_ptr + (r) * 32 \
+	+ (c)))
+
+	char *str = buf;
+	int max = 2;
+	for (i = 0; i < max; i++) {
+		str += sprintf(str, "0x%08x 0x%08x 0x%08x 0x%08x 0x%08x 0x%08x"
+			       "0x%08x 0x%08x\n",
+			       AAP1_MEMMAP(i, 0),
+			       AAP1_MEMMAP(i, 4),
+			       AAP1_MEMMAP(i, 8),
+			       AAP1_MEMMAP(i, 12),
+			       AAP1_MEMMAP(i, 16),
+			       AAP1_MEMMAP(i, 20),
+			       AAP1_MEMMAP(i, 24),
+			       AAP1_MEMMAP(i, 28));
+	}
+
+	return str - buf;
+}
+static DEVICE_ATTR(aap_log, S_IRUGO, pm8001_ctl_aap_log_show, NULL);
+/**
+ * pm8001_ctl_aap_log_show - IOP event log
+ * @cdev: pointer to embedded class device
+ * @buf: the buffer returned
+ *
+ * A sysfs 'read-only' shost attribute.
+ */
+static ssize_t pm8001_ctl_iop_log_show(struct device *cdev,
+	struct device_attribute *attr, char *buf)
+{
+	struct Scsi_Host *shost = class_to_shost(cdev);
+	struct sas_ha_struct *sha = SHOST_TO_SAS_HA(shost);
+	struct pm8001_hba_info *pm8001_ha = sha->lldd_ha;
+#define IOP_MEMMAP(r, c) \
+	(*(u32 *)((u8*)pm8001_ha->memoryMap.region[IOP].virt_ptr + (r) * 32 \
+	+ (c)))
+	int i;
+	char *str = buf;
+	int max = 2;
+	for (i = 0; i < max; i++) {
+		str += sprintf(str, "0x%08x 0x%08x 0x%08x 0x%08x 0x%08x 0x%08x"
+			       "0x%08x 0x%08x\n",
+			       IOP_MEMMAP(i, 0),
+			       IOP_MEMMAP(i, 4),
+			       IOP_MEMMAP(i, 8),
+			       IOP_MEMMAP(i, 12),
+			       IOP_MEMMAP(i, 16),
+			       IOP_MEMMAP(i, 20),
+			       IOP_MEMMAP(i, 24),
+			       IOP_MEMMAP(i, 28));
+	}
+
+	return str - buf;
+}
+static DEVICE_ATTR(iop_log, S_IRUGO, pm8001_ctl_iop_log_show, NULL);
+
+#define FLASH_CMD_NONE      0x00
+#define FLASH_CMD_UPDATE    0x01
+#define FLASH_CMD_SET_NVMD    0x02
+
+struct flash_command {
+     u8      command[8];
+     int     code;
+};
+
+static struct flash_command flash_command_table[] =
+{
+     {"set_nvmd",    FLASH_CMD_SET_NVMD},
+     {"update",      FLASH_CMD_UPDATE},
+     {"",            FLASH_CMD_NONE} /* Last entry should be NULL. */
+};
+
+struct error_fw {
+     char    *reason;
+     int     err_code;
+};
+
+static struct error_fw flash_error_table[] =
+{
+     {"Failed to open fw image file",	FAIL_OPEN_BIOS_FILE},
+     {"image header mismatch",		FLASH_UPDATE_HDR_ERR},
+     {"image offset mismatch",		FLASH_UPDATE_OFFSET_ERR},
+     {"image CRC Error",		FLASH_UPDATE_CRC_ERR},
+     {"image length Error.",		FLASH_UPDATE_LENGTH_ERR},
+     {"Failed to program flash chip",	FLASH_UPDATE_HW_ERR},
+     {"Flash chip not supported.",	FLASH_UPDATE_DNLD_NOT_SUPPORTED},
+     {"Flash update disabled.",		FLASH_UPDATE_DISABLED},
+     {"Flash in progress",		FLASH_IN_PROGRESS},
+     {"Image file size Error",		FAIL_FILE_SIZE},
+     {"Input parameter error",		FAIL_PARAMETERS},
+     {"Out of memory",			FAIL_OUT_MEMORY},
+     {"OK", 0}	/* Last entry err_code = 0. */
+};
+
+static int pm8001_set_nvmd(struct pm8001_hba_info *pm8001_ha)
+{
+	struct pm8001_ioctl_payload	*payload;
+	DECLARE_COMPLETION_ONSTACK(completion);
+	u8		*ioctlbuffer = NULL;
+	u32		length = 0;
+	u32		ret = 0;
+
+	length = 1024 * 5 + sizeof(*payload) - 1;
+	ioctlbuffer = kzalloc(length, GFP_KERNEL);
+	if (!ioctlbuffer)
+		return -ENOMEM;
+	if ((pm8001_ha->fw_image->size <= 0) ||
+	    (pm8001_ha->fw_image->size > 4096)) {
+		ret = FAIL_FILE_SIZE;
+		goto out;
+	}
+	payload = (struct pm8001_ioctl_payload *)ioctlbuffer;
+	memcpy((u8 *)payload->func_specific, (u8 *)pm8001_ha->fw_image->data,
+				pm8001_ha->fw_image->size);
+	payload->length = pm8001_ha->fw_image->size;
+	payload->id = 0;
+	pm8001_ha->nvmd_completion = &completion;
+	ret = PM8001_CHIP_DISP->set_nvmd_req(pm8001_ha, payload);
+	wait_for_completion(&completion);
+out:
+	kfree(ioctlbuffer);
+	return ret;
+}
+
+static int pm8001_update_flash(struct pm8001_hba_info *pm8001_ha)
+{
+	struct pm8001_ioctl_payload	*payload;
+	DECLARE_COMPLETION_ONSTACK(completion);
+	u8		*ioctlbuffer = NULL;
+	u32		length = 0;
+	struct fw_control_info	*fwControl;
+	u32		loopNumber, loopcount = 0;
+	u32		sizeRead = 0;
+	u32		partitionSize, partitionSizeTmp;
+	u32		ret = 0;
+	u32		partitionNumber = 0;
+	struct pm8001_fw_image_header *image_hdr;
+
+	length = 1024 * 16 + sizeof(*payload) - 1;
+	ioctlbuffer = kzalloc(length, GFP_KERNEL);
+	image_hdr = (struct pm8001_fw_image_header *)pm8001_ha->fw_image->data;
+	if (!ioctlbuffer)
+		return -ENOMEM;
+	if (pm8001_ha->fw_image->size < 28) {
+		ret = FAIL_FILE_SIZE;
+		goto out;
+	}
+
+	while (sizeRead < pm8001_ha->fw_image->size) {
+		partitionSizeTmp =
+			*(u32 *)((u8 *)&image_hdr->image_length + sizeRead);
+		partitionSize = be32_to_cpu(partitionSizeTmp);
+		loopcount = (partitionSize + HEADER_LEN)/IOCTL_BUF_SIZE;
+		if (loopcount % IOCTL_BUF_SIZE)
+			loopcount++;
+		if (loopcount == 0)
+			loopcount++;
+		for (loopNumber = 0; loopNumber < loopcount; loopNumber++) {
+			payload = (struct pm8001_ioctl_payload *)ioctlbuffer;
+			payload->length = 1024*16;
+			payload->id = 0;
+			fwControl =
+			      (struct fw_control_info *)payload->func_specific;
+			fwControl->len = IOCTL_BUF_SIZE;   /* IN */
+			fwControl->size = partitionSize + HEADER_LEN;/* IN */
+			fwControl->retcode = 0;/* OUT */
+			fwControl->offset = loopNumber * IOCTL_BUF_SIZE;/*OUT */
+
+		/* for the last chunk of data in case file size is not even with
+		4k, load only the rest*/
+		if (((loopcount-loopNumber) == 1) &&
+			((partitionSize + HEADER_LEN) % IOCTL_BUF_SIZE)) {
+			fwControl->len =
+				(partitionSize + HEADER_LEN) % IOCTL_BUF_SIZE;
+			memcpy((u8 *)fwControl->buffer,
+				(u8 *)pm8001_ha->fw_image->data + sizeRead,
+				(partitionSize + HEADER_LEN) % IOCTL_BUF_SIZE);
+			sizeRead +=
+				(partitionSize + HEADER_LEN) % IOCTL_BUF_SIZE;
+		} else {
+			memcpy((u8 *)fwControl->buffer,
+				(u8 *)pm8001_ha->fw_image->data + sizeRead,
+				IOCTL_BUF_SIZE);
+			sizeRead += IOCTL_BUF_SIZE;
+		}
+
+		pm8001_ha->nvmd_completion = &completion;
+		ret = PM8001_CHIP_DISP->fw_flash_update_req(pm8001_ha, payload);
+		wait_for_completion(&completion);
+		if (ret || (fwControl->retcode > FLASH_UPDATE_IN_PROGRESS)) {
+			ret = fwControl->retcode;
+			kfree(ioctlbuffer);
+			ioctlbuffer = NULL;
+			break;
+		}
+	}
+	if (ret)
+		break;
+	partitionNumber++;
+}
+out:
+	kfree(ioctlbuffer);
+	return ret;
+}
+static ssize_t pm8001_store_update_fw(struct device *cdev,
+				      struct device_attribute *attr,
+				      const char *buf, size_t count)
+{
+	struct Scsi_Host *shost = class_to_shost(cdev);
+	struct sas_ha_struct *sha = SHOST_TO_SAS_HA(shost);
+	struct pm8001_hba_info *pm8001_ha = sha->lldd_ha;
+	char *cmd_ptr, *filename_ptr;
+	int res, i;
+	int flash_command = FLASH_CMD_NONE;
+	int err = 0;
+	if (!capable(CAP_SYS_ADMIN))
+		return -EACCES;
+
+	cmd_ptr = kzalloc(count*2, GFP_KERNEL);
+
+	if (!cmd_ptr) {
+		err = FAIL_OUT_MEMORY;
+		goto out;
+	}
+
+	filename_ptr = cmd_ptr + count;
+	res = sscanf(buf, "%s %s", cmd_ptr, filename_ptr);
+	if (res != 2) {
+		err = FAIL_PARAMETERS;
+		goto out1;
+	}
+
+	for (i = 0; flash_command_table[i].code != FLASH_CMD_NONE; i++) {
+		if (!memcmp(flash_command_table[i].command,
+				 cmd_ptr, strlen(cmd_ptr))) {
+			flash_command = flash_command_table[i].code;
+			break;
+		}
+	}
+	if (flash_command == FLASH_CMD_NONE) {
+		err = FAIL_PARAMETERS;
+		goto out1;
+	}
+
+	if (pm8001_ha->fw_status == FLASH_IN_PROGRESS) {
+		err = FLASH_IN_PROGRESS;
+		goto out1;
+	}
+	err = request_firmware(&pm8001_ha->fw_image,
+			       filename_ptr,
+			       pm8001_ha->dev);
+
+	if (err) {
+		PM8001_FAIL_DBG(pm8001_ha,
+			pm8001_printk("Failed to load firmware image file %s,"
+			" error %d\n", filename_ptr, err));
+		err = FAIL_OPEN_BIOS_FILE;
+		goto out1;
+	}
+
+	switch (flash_command) {
+	case FLASH_CMD_UPDATE:
+		pm8001_ha->fw_status = FLASH_IN_PROGRESS;
+		err = pm8001_update_flash(pm8001_ha);
+		break;
+	case FLASH_CMD_SET_NVMD:
+		pm8001_ha->fw_status = FLASH_IN_PROGRESS;
+		err = pm8001_set_nvmd(pm8001_ha);
+		break;
+	default:
+		pm8001_ha->fw_status = FAIL_PARAMETERS;
+		err = FAIL_PARAMETERS;
+		break;
+	}
+	release_firmware(pm8001_ha->fw_image);
+out1:
+	kfree(cmd_ptr);
+out:
+	pm8001_ha->fw_status = err;
+
+	if (!err)
+		return count;
+	else
+		return -err;
+}
+
+static ssize_t pm8001_show_update_fw(struct device *cdev,
+				     struct device_attribute *attr, char *buf)
+{
+	int i;
+	struct Scsi_Host *shost = class_to_shost(cdev);
+	struct sas_ha_struct *sha = SHOST_TO_SAS_HA(shost);
+	struct pm8001_hba_info *pm8001_ha = sha->lldd_ha;
+
+	for (i = 0; flash_error_table[i].err_code != 0; i++) {
+		if (flash_error_table[i].err_code == pm8001_ha->fw_status)
+			break;
+	}
+	if (pm8001_ha->fw_status != FLASH_IN_PROGRESS)
+		pm8001_ha->fw_status = FLASH_OK;
+
+	return snprintf(buf, PAGE_SIZE, "status=%x %s\n",
+			flash_error_table[i].err_code,
+			flash_error_table[i].reason);
+}
+
+static DEVICE_ATTR(update_fw, S_IRUGO|S_IWUGO,
+	pm8001_show_update_fw, pm8001_store_update_fw);
+struct device_attribute *pm8001_host_attrs[] = {
+	&dev_attr_interface_rev,
+	&dev_attr_fw_version,
+	&dev_attr_update_fw,
+	&dev_attr_aap_log,
+	&dev_attr_iop_log,
+	&dev_attr_max_out_io,
+	&dev_attr_max_devices,
+	&dev_attr_max_sg_list,
+	&dev_attr_sas_spec_support,
+	&dev_attr_logging_level,
+	&dev_attr_host_sas_address,
+	NULL,
+};
+
diff --git a/drivers/scsi/pm8001/pm8001_ctl.h b/drivers/scsi/pm8001/pm8001_ctl.h
new file mode 100644
index 000000000000..63ad4aa0c422
--- /dev/null
+++ b/drivers/scsi/pm8001/pm8001_ctl.h
@@ -0,0 +1,57 @@
+ /*
+  * PMC-Sierra SPC 8001 SAS/SATA based host adapters driver
+  *
+  * Copyright (c) 2008-2009 USI Co., Ltd.
+  * All rights reserved.
+  *
+  * Redistribution and use in source and binary forms, with or without
+  * modification, are permitted provided that the following conditions
+  * are met:
+  * 1. Redistributions of source code must retain the above copyright
+  *    notice, this list of conditions, and the following disclaimer,
+  *    without modification.
+  * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+  *    substantially similar to the "NO WARRANTY" disclaimer below
+  *    ("Disclaimer") and any redistribution must be conditioned upon
+  *    including a substantially similar Disclaimer requirement for further
+  *    binary redistribution.
+  * 3. Neither the names of the above-listed copyright holders nor the names
+  *    of any contributors may be used to endorse or promote products derived
+  *    from this software without specific prior written permission.
+  *
+  * Alternatively, this software may be distributed under the terms of the
+  * GNU General Public License ("GPL") version 2 as published by the Free
+  * Software Foundation.
+  *
+  * NO WARRANTY
+  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+  * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+  * POSSIBILITY OF SUCH DAMAGES.
+  *
+  */
+
+#ifndef PM8001_CTL_H_INCLUDED
+#define PM8001_CTL_H_INCLUDED
+
+#define IOCTL_BUF_SIZE		4096
+#define HEADER_LEN			28
+#define SIZE_OFFSET			16
+
+
+#define FLASH_OK                        0x000000
+#define FAIL_OPEN_BIOS_FILE             0x000100
+#define FAIL_FILE_SIZE                  0x000a00
+#define FAIL_PARAMETERS                 0x000b00
+#define FAIL_OUT_MEMORY                 0x000c00
+#define FLASH_IN_PROGRESS               0x001000
+
+#endif /* PM8001_CTL_H_INCLUDED */
+
diff --git a/drivers/scsi/pm8001/pm8001_defs.h b/drivers/scsi/pm8001/pm8001_defs.h
new file mode 100644
index 000000000000..944afada61ee
--- /dev/null
+++ b/drivers/scsi/pm8001/pm8001_defs.h
@@ -0,0 +1,112 @@
+/*
+ * PMC-Sierra SPC 8001 SAS/SATA based host adapters driver
+ *
+ * Copyright (c) 2008-2009 USI Co., Ltd.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ *
+ */
+
+#ifndef _PM8001_DEFS_H_
+#define _PM8001_DEFS_H_
+
+enum chip_flavors {
+	chip_8001,
+};
+#define USI_MAX_MEMCNT			9
+#define PM8001_MAX_DMA_SG		SG_ALL
+enum phy_speed {
+	PHY_SPEED_15 = 0x01,
+	PHY_SPEED_30 = 0x02,
+	PHY_SPEED_60 = 0x04,
+};
+
+enum data_direction {
+	DATA_DIR_NONE = 0x0,	/* NO TRANSFER */
+	DATA_DIR_IN = 0x01,	/* INBOUND */
+	DATA_DIR_OUT = 0x02,	/* OUTBOUND */
+	DATA_DIR_BYRECIPIENT = 0x04, /* UNSPECIFIED */
+};
+
+enum port_type {
+	PORT_TYPE_SAS = (1L << 1),
+	PORT_TYPE_SATA = (1L << 0),
+};
+
+/* driver compile-time configuration */
+#define	PM8001_MAX_CCB		 512	/* max ccbs supported */
+#define	PM8001_MAX_INB_NUM	 1
+#define	PM8001_MAX_OUTB_NUM	 1
+#define	PM8001_CAN_QUEUE	 128	/* SCSI Queue depth */
+
+/* unchangeable hardware details */
+#define	PM8001_MAX_PHYS		 8	/* max. possible phys */
+#define	PM8001_MAX_PORTS	 8	/* max. possible ports */
+#define	PM8001_MAX_DEVICES	 1024	/* max supported device */
+
+enum memory_region_num {
+	AAP1 = 0x0, /* application acceleration processor */
+	IOP,	    /* IO processor */
+	CI,	    /* consumer index */
+	PI,	    /* producer index */
+	IB,	    /* inbound queue */
+	OB,	    /* outbound queue */
+	NVMD,	    /* NVM device */
+	DEV_MEM,    /* memory for devices */
+	CCB_MEM,    /* memory for command control block */
+};
+#define	PM8001_EVENT_LOG_SIZE	 (128 * 1024)
+
+/*error code*/
+enum mpi_err {
+	MPI_IO_STATUS_SUCCESS = 0x0,
+	MPI_IO_STATUS_BUSY = 0x01,
+	MPI_IO_STATUS_FAIL = 0x02,
+};
+
+/**
+ * Phy Control constants
+ */
+enum phy_control_type {
+	PHY_LINK_RESET = 0x01,
+	PHY_HARD_RESET = 0x02,
+	PHY_NOTIFY_ENABLE_SPINUP = 0x10,
+};
+
+enum pm8001_hba_info_flags {
+	PM8001F_INIT_TIME	= (1U << 0),
+	PM8001F_RUN_TIME	= (1U << 1),
+};
+
+#endif
diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c
new file mode 100644
index 000000000000..9b44c6f1b10e
--- /dev/null
+++ b/drivers/scsi/pm8001/pm8001_hwi.c
@@ -0,0 +1,4493 @@
+/*
+ * PMC-Sierra SPC 8001 SAS/SATA based host adapters driver
+ *
+ * Copyright (c) 2008-2009 USI Co., Ltd.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ *
+ */
+ #include "pm8001_sas.h"
+ #include "pm8001_hwi.h"
+ #include "pm8001_chips.h"
+ #include "pm8001_ctl.h"
+
+/**
+ * read_main_config_table - read the configure table and save it.
+ * @pm8001_ha: our hba card information
+ */
+static void __devinit read_main_config_table(struct pm8001_hba_info *pm8001_ha)
+{
+	void __iomem *address = pm8001_ha->main_cfg_tbl_addr;
+	pm8001_ha->main_cfg_tbl.signature	= pm8001_mr32(address, 0x00);
+	pm8001_ha->main_cfg_tbl.interface_rev	= pm8001_mr32(address, 0x04);
+	pm8001_ha->main_cfg_tbl.firmware_rev	= pm8001_mr32(address, 0x08);
+	pm8001_ha->main_cfg_tbl.max_out_io	= pm8001_mr32(address, 0x0C);
+	pm8001_ha->main_cfg_tbl.max_sgl		= pm8001_mr32(address, 0x10);
+	pm8001_ha->main_cfg_tbl.ctrl_cap_flag	= pm8001_mr32(address, 0x14);
+	pm8001_ha->main_cfg_tbl.gst_offset	= pm8001_mr32(address, 0x18);
+	pm8001_ha->main_cfg_tbl.inbound_queue_offset =
+		pm8001_mr32(address, MAIN_IBQ_OFFSET);
+	pm8001_ha->main_cfg_tbl.outbound_queue_offset =
+		pm8001_mr32(address, MAIN_OBQ_OFFSET);
+	pm8001_ha->main_cfg_tbl.hda_mode_flag	=
+		pm8001_mr32(address, MAIN_HDA_FLAGS_OFFSET);
+
+	/* read analog Setting offset from the configuration table */
+	pm8001_ha->main_cfg_tbl.anolog_setup_table_offset =
+		pm8001_mr32(address, MAIN_ANALOG_SETUP_OFFSET);
+
+	/* read Error Dump Offset and Length */
+	pm8001_ha->main_cfg_tbl.fatal_err_dump_offset0 =
+		pm8001_mr32(address, MAIN_FATAL_ERROR_RDUMP0_OFFSET);
+	pm8001_ha->main_cfg_tbl.fatal_err_dump_length0 =
+		pm8001_mr32(address, MAIN_FATAL_ERROR_RDUMP0_LENGTH);
+	pm8001_ha->main_cfg_tbl.fatal_err_dump_offset1 =
+		pm8001_mr32(address, MAIN_FATAL_ERROR_RDUMP1_OFFSET);
+	pm8001_ha->main_cfg_tbl.fatal_err_dump_length1 =
+		pm8001_mr32(address, MAIN_FATAL_ERROR_RDUMP1_LENGTH);
+}
+
+/**
+ * read_general_status_table - read the general status table and save it.
+ * @pm8001_ha: our hba card information
+ */
+static void __devinit
+read_general_status_table(struct pm8001_hba_info *pm8001_ha)
+{
+	void __iomem *address = pm8001_ha->general_stat_tbl_addr;
+	pm8001_ha->gs_tbl.gst_len_mpistate	= pm8001_mr32(address, 0x00);
+	pm8001_ha->gs_tbl.iq_freeze_state0	= pm8001_mr32(address, 0x04);
+	pm8001_ha->gs_tbl.iq_freeze_state1	= pm8001_mr32(address, 0x08);
+	pm8001_ha->gs_tbl.msgu_tcnt		= pm8001_mr32(address, 0x0C);
+	pm8001_ha->gs_tbl.iop_tcnt		= pm8001_mr32(address, 0x10);
+	pm8001_ha->gs_tbl.reserved		= pm8001_mr32(address, 0x14);
+	pm8001_ha->gs_tbl.phy_state[0]	= pm8001_mr32(address, 0x18);
+	pm8001_ha->gs_tbl.phy_state[1]	= pm8001_mr32(address, 0x1C);
+	pm8001_ha->gs_tbl.phy_state[2]	= pm8001_mr32(address, 0x20);
+	pm8001_ha->gs_tbl.phy_state[3]	= pm8001_mr32(address, 0x24);
+	pm8001_ha->gs_tbl.phy_state[4]	= pm8001_mr32(address, 0x28);
+	pm8001_ha->gs_tbl.phy_state[5]	= pm8001_mr32(address, 0x2C);
+	pm8001_ha->gs_tbl.phy_state[6]	= pm8001_mr32(address, 0x30);
+	pm8001_ha->gs_tbl.phy_state[7]	= pm8001_mr32(address, 0x34);
+	pm8001_ha->gs_tbl.reserved1		= pm8001_mr32(address, 0x38);
+	pm8001_ha->gs_tbl.reserved2		= pm8001_mr32(address, 0x3C);
+	pm8001_ha->gs_tbl.reserved3		= pm8001_mr32(address, 0x40);
+	pm8001_ha->gs_tbl.recover_err_info[0]	= pm8001_mr32(address, 0x44);
+	pm8001_ha->gs_tbl.recover_err_info[1]	= pm8001_mr32(address, 0x48);
+	pm8001_ha->gs_tbl.recover_err_info[2]	= pm8001_mr32(address, 0x4C);
+	pm8001_ha->gs_tbl.recover_err_info[3]	= pm8001_mr32(address, 0x50);
+	pm8001_ha->gs_tbl.recover_err_info[4]	= pm8001_mr32(address, 0x54);
+	pm8001_ha->gs_tbl.recover_err_info[5]	= pm8001_mr32(address, 0x58);
+	pm8001_ha->gs_tbl.recover_err_info[6]	= pm8001_mr32(address, 0x5C);
+	pm8001_ha->gs_tbl.recover_err_info[7]	= pm8001_mr32(address, 0x60);
+}
+
+/**
+ * read_inbnd_queue_table - read the inbound queue table and save it.
+ * @pm8001_ha: our hba card information
+ */
+static void __devinit
+read_inbnd_queue_table(struct pm8001_hba_info *pm8001_ha)
+{
+	int inbQ_num = 1;
+	int i;
+	void __iomem *address = pm8001_ha->inbnd_q_tbl_addr;
+	for (i = 0; i < inbQ_num; i++) {
+		u32 offset = i * 0x20;
+		pm8001_ha->inbnd_q_tbl[i].pi_pci_bar =
+		      get_pci_bar_index(pm8001_mr32(address, (offset + 0x14)));
+		pm8001_ha->inbnd_q_tbl[i].pi_offset =
+			pm8001_mr32(address, (offset + 0x18));
+	}
+}
+
+/**
+ * read_outbnd_queue_table - read the outbound queue table and save it.
+ * @pm8001_ha: our hba card information
+ */
+static void __devinit
+read_outbnd_queue_table(struct pm8001_hba_info *pm8001_ha)
+{
+	int outbQ_num = 1;
+	int i;
+	void __iomem *address = pm8001_ha->outbnd_q_tbl_addr;
+	for (i = 0; i < outbQ_num; i++) {
+		u32 offset = i * 0x24;
+		pm8001_ha->outbnd_q_tbl[i].ci_pci_bar =
+		      get_pci_bar_index(pm8001_mr32(address, (offset + 0x14)));
+		pm8001_ha->outbnd_q_tbl[i].ci_offset =
+			pm8001_mr32(address, (offset + 0x18));
+	}
+}
+
+/**
+ * init_default_table_values - init the default table.
+ * @pm8001_ha: our hba card information
+ */
+static void __devinit
+init_default_table_values(struct pm8001_hba_info *pm8001_ha)
+{
+	int qn = 1;
+	int i;
+	u32 offsetib, offsetob;
+	void __iomem *addressib = pm8001_ha->inbnd_q_tbl_addr;
+	void __iomem *addressob = pm8001_ha->outbnd_q_tbl_addr;
+
+	pm8001_ha->main_cfg_tbl.inbound_q_nppd_hppd			= 0;
+	pm8001_ha->main_cfg_tbl.outbound_hw_event_pid0_3 		= 0;
+	pm8001_ha->main_cfg_tbl.outbound_hw_event_pid4_7		= 0;
+	pm8001_ha->main_cfg_tbl.outbound_ncq_event_pid0_3		= 0;
+	pm8001_ha->main_cfg_tbl.outbound_ncq_event_pid4_7		= 0;
+	pm8001_ha->main_cfg_tbl.outbound_tgt_ITNexus_event_pid0_3	= 0;
+	pm8001_ha->main_cfg_tbl.outbound_tgt_ITNexus_event_pid4_7	= 0;
+	pm8001_ha->main_cfg_tbl.outbound_tgt_ssp_event_pid0_3	= 0;
+	pm8001_ha->main_cfg_tbl.outbound_tgt_ssp_event_pid4_7	= 0;
+	pm8001_ha->main_cfg_tbl.outbound_tgt_smp_event_pid0_3	= 0;
+	pm8001_ha->main_cfg_tbl.outbound_tgt_smp_event_pid4_7	= 0;
+
+	pm8001_ha->main_cfg_tbl.upper_event_log_addr		=
+		pm8001_ha->memoryMap.region[AAP1].phys_addr_hi;
+	pm8001_ha->main_cfg_tbl.lower_event_log_addr		=
+		pm8001_ha->memoryMap.region[AAP1].phys_addr_lo;
+	pm8001_ha->main_cfg_tbl.event_log_size	= PM8001_EVENT_LOG_SIZE;
+	pm8001_ha->main_cfg_tbl.event_log_option		= 0x01;
+	pm8001_ha->main_cfg_tbl.upper_iop_event_log_addr	=
+		pm8001_ha->memoryMap.region[IOP].phys_addr_hi;
+	pm8001_ha->main_cfg_tbl.lower_iop_event_log_addr	=
+		pm8001_ha->memoryMap.region[IOP].phys_addr_lo;
+	pm8001_ha->main_cfg_tbl.iop_event_log_size	= PM8001_EVENT_LOG_SIZE;
+	pm8001_ha->main_cfg_tbl.iop_event_log_option		= 0x01;
+	pm8001_ha->main_cfg_tbl.fatal_err_interrupt		= 0x01;
+	for (i = 0; i < qn; i++) {
+		pm8001_ha->inbnd_q_tbl[i].element_pri_size_cnt	=
+			0x00000100 | (0x00000040 << 16) | (0x00<<30);
+		pm8001_ha->inbnd_q_tbl[i].upper_base_addr	=
+			pm8001_ha->memoryMap.region[IB].phys_addr_hi;
+		pm8001_ha->inbnd_q_tbl[i].lower_base_addr	=
+		pm8001_ha->memoryMap.region[IB].phys_addr_lo;
+		pm8001_ha->inbnd_q_tbl[i].base_virt		=
+			(u8 *)pm8001_ha->memoryMap.region[IB].virt_ptr;
+		pm8001_ha->inbnd_q_tbl[i].total_length		=
+			pm8001_ha->memoryMap.region[IB].total_len;
+		pm8001_ha->inbnd_q_tbl[i].ci_upper_base_addr	=
+			pm8001_ha->memoryMap.region[CI].phys_addr_hi;
+		pm8001_ha->inbnd_q_tbl[i].ci_lower_base_addr	=
+			pm8001_ha->memoryMap.region[CI].phys_addr_lo;
+		pm8001_ha->inbnd_q_tbl[i].ci_virt		=
+			pm8001_ha->memoryMap.region[CI].virt_ptr;
+		offsetib = i * 0x20;
+		pm8001_ha->inbnd_q_tbl[i].pi_pci_bar		=
+			get_pci_bar_index(pm8001_mr32(addressib,
+				(offsetib + 0x14)));
+		pm8001_ha->inbnd_q_tbl[i].pi_offset		=
+			pm8001_mr32(addressib, (offsetib + 0x18));
+		pm8001_ha->inbnd_q_tbl[i].producer_idx		= 0;
+		pm8001_ha->inbnd_q_tbl[i].consumer_index	= 0;
+	}
+	for (i = 0; i < qn; i++) {
+		pm8001_ha->outbnd_q_tbl[i].element_size_cnt	=
+			256 | (64 << 16) | (1<<30);
+		pm8001_ha->outbnd_q_tbl[i].upper_base_addr	=
+			pm8001_ha->memoryMap.region[OB].phys_addr_hi;
+		pm8001_ha->outbnd_q_tbl[i].lower_base_addr	=
+			pm8001_ha->memoryMap.region[OB].phys_addr_lo;
+		pm8001_ha->outbnd_q_tbl[i].base_virt		=
+			(u8 *)pm8001_ha->memoryMap.region[OB].virt_ptr;
+		pm8001_ha->outbnd_q_tbl[i].total_length		=
+			pm8001_ha->memoryMap.region[OB].total_len;
+		pm8001_ha->outbnd_q_tbl[i].pi_upper_base_addr	=
+			pm8001_ha->memoryMap.region[PI].phys_addr_hi;
+		pm8001_ha->outbnd_q_tbl[i].pi_lower_base_addr	=
+			pm8001_ha->memoryMap.region[PI].phys_addr_lo;
+		pm8001_ha->outbnd_q_tbl[i].interrup_vec_cnt_delay	=
+			0 | (10 << 16) | (0 << 24);
+		pm8001_ha->outbnd_q_tbl[i].pi_virt		=
+			pm8001_ha->memoryMap.region[PI].virt_ptr;
+		offsetob = i * 0x24;
+		pm8001_ha->outbnd_q_tbl[i].ci_pci_bar		=
+			get_pci_bar_index(pm8001_mr32(addressob,
+			offsetob + 0x14));
+		pm8001_ha->outbnd_q_tbl[i].ci_offset		=
+			pm8001_mr32(addressob, (offsetob + 0x18));
+		pm8001_ha->outbnd_q_tbl[i].consumer_idx		= 0;
+		pm8001_ha->outbnd_q_tbl[i].producer_index	= 0;
+	}
+}
+
+/**
+ * update_main_config_table - update the main default table to the HBA.
+ * @pm8001_ha: our hba card information
+ */
+static void __devinit
+update_main_config_table(struct pm8001_hba_info *pm8001_ha)
+{
+	void __iomem *address = pm8001_ha->main_cfg_tbl_addr;
+	pm8001_mw32(address, 0x24,
+		pm8001_ha->main_cfg_tbl.inbound_q_nppd_hppd);
+	pm8001_mw32(address, 0x28,
+		pm8001_ha->main_cfg_tbl.outbound_hw_event_pid0_3);
+	pm8001_mw32(address, 0x2C,
+		pm8001_ha->main_cfg_tbl.outbound_hw_event_pid4_7);
+	pm8001_mw32(address, 0x30,
+		pm8001_ha->main_cfg_tbl.outbound_ncq_event_pid0_3);
+	pm8001_mw32(address, 0x34,
+		pm8001_ha->main_cfg_tbl.outbound_ncq_event_pid4_7);
+	pm8001_mw32(address, 0x38,
+		pm8001_ha->main_cfg_tbl.outbound_tgt_ITNexus_event_pid0_3);
+	pm8001_mw32(address, 0x3C,
+		pm8001_ha->main_cfg_tbl.outbound_tgt_ITNexus_event_pid4_7);
+	pm8001_mw32(address, 0x40,
+		pm8001_ha->main_cfg_tbl.outbound_tgt_ssp_event_pid0_3);
+	pm8001_mw32(address, 0x44,
+		pm8001_ha->main_cfg_tbl.outbound_tgt_ssp_event_pid4_7);
+	pm8001_mw32(address, 0x48,
+		pm8001_ha->main_cfg_tbl.outbound_tgt_smp_event_pid0_3);
+	pm8001_mw32(address, 0x4C,
+		pm8001_ha->main_cfg_tbl.outbound_tgt_smp_event_pid4_7);
+	pm8001_mw32(address, 0x50,
+		pm8001_ha->main_cfg_tbl.upper_event_log_addr);
+	pm8001_mw32(address, 0x54,
+		pm8001_ha->main_cfg_tbl.lower_event_log_addr);
+	pm8001_mw32(address, 0x58, pm8001_ha->main_cfg_tbl.event_log_size);
+	pm8001_mw32(address, 0x5C, pm8001_ha->main_cfg_tbl.event_log_option);
+	pm8001_mw32(address, 0x60,
+		pm8001_ha->main_cfg_tbl.upper_iop_event_log_addr);
+	pm8001_mw32(address, 0x64,
+		pm8001_ha->main_cfg_tbl.lower_iop_event_log_addr);
+	pm8001_mw32(address, 0x68, pm8001_ha->main_cfg_tbl.iop_event_log_size);
+	pm8001_mw32(address, 0x6C,
+		pm8001_ha->main_cfg_tbl.iop_event_log_option);
+	pm8001_mw32(address, 0x70,
+		pm8001_ha->main_cfg_tbl.fatal_err_interrupt);
+}
+
+/**
+ * update_inbnd_queue_table - update the inbound queue table to the HBA.
+ * @pm8001_ha: our hba card information
+ */
+static void __devinit
+update_inbnd_queue_table(struct pm8001_hba_info *pm8001_ha, int number)
+{
+	void __iomem *address = pm8001_ha->inbnd_q_tbl_addr;
+	u16 offset = number * 0x20;
+	pm8001_mw32(address, offset + 0x00,
+		pm8001_ha->inbnd_q_tbl[number].element_pri_size_cnt);
+	pm8001_mw32(address, offset + 0x04,
+		pm8001_ha->inbnd_q_tbl[number].upper_base_addr);
+	pm8001_mw32(address, offset + 0x08,
+		pm8001_ha->inbnd_q_tbl[number].lower_base_addr);
+	pm8001_mw32(address, offset + 0x0C,
+		pm8001_ha->inbnd_q_tbl[number].ci_upper_base_addr);
+	pm8001_mw32(address, offset + 0x10,
+		pm8001_ha->inbnd_q_tbl[number].ci_lower_base_addr);
+}
+
+/**
+ * update_outbnd_queue_table - update the outbound queue table to the HBA.
+ * @pm8001_ha: our hba card information
+ */
+static void __devinit
+update_outbnd_queue_table(struct pm8001_hba_info *pm8001_ha, int number)
+{
+	void __iomem *address = pm8001_ha->outbnd_q_tbl_addr;
+	u16 offset = number * 0x24;
+	pm8001_mw32(address, offset + 0x00,
+		pm8001_ha->outbnd_q_tbl[number].element_size_cnt);
+	pm8001_mw32(address, offset + 0x04,
+		pm8001_ha->outbnd_q_tbl[number].upper_base_addr);
+	pm8001_mw32(address, offset + 0x08,
+		pm8001_ha->outbnd_q_tbl[number].lower_base_addr);
+	pm8001_mw32(address, offset + 0x0C,
+		pm8001_ha->outbnd_q_tbl[number].pi_upper_base_addr);
+	pm8001_mw32(address, offset + 0x10,
+		pm8001_ha->outbnd_q_tbl[number].pi_lower_base_addr);
+	pm8001_mw32(address, offset + 0x1C,
+		pm8001_ha->outbnd_q_tbl[number].interrup_vec_cnt_delay);
+}
+
+/**
+ * bar4_shift - function is called to shift BAR base address
+ * @pm8001_ha : our hba card infomation
+ * @shiftValue : shifting value in memory bar.
+ */
+static int bar4_shift(struct pm8001_hba_info *pm8001_ha, u32 shiftValue)
+{
+	u32 regVal;
+	u32 max_wait_count;
+
+	/* program the inbound AXI translation Lower Address */
+	pm8001_cw32(pm8001_ha, 1, SPC_IBW_AXI_TRANSLATION_LOW, shiftValue);
+
+	/* confirm the setting is written */
+	max_wait_count = 1 * 1000 * 1000;  /* 1 sec */
+	do {
+		udelay(1);
+		regVal = pm8001_cr32(pm8001_ha, 1, SPC_IBW_AXI_TRANSLATION_LOW);
+	} while ((regVal != shiftValue) && (--max_wait_count));
+
+	if (!max_wait_count) {
+		PM8001_INIT_DBG(pm8001_ha,
+			pm8001_printk("TIMEOUT:SPC_IBW_AXI_TRANSLATION_LOW"
+			" = 0x%x\n", regVal));
+		return -1;
+	}
+	return 0;
+}
+
+/**
+ * mpi_set_phys_g3_with_ssc
+ * @pm8001_ha: our hba card information
+ * @SSCbit: set SSCbit to 0 to disable all phys ssc; 1 to enable all phys ssc.
+ */
+static void __devinit
+mpi_set_phys_g3_with_ssc(struct pm8001_hba_info *pm8001_ha, u32 SSCbit)
+{
+	u32 value, offset, i;
+
+#define SAS2_SETTINGS_LOCAL_PHY_0_3_SHIFT_ADDR 0x00030000
+#define SAS2_SETTINGS_LOCAL_PHY_4_7_SHIFT_ADDR 0x00040000
+#define SAS2_SETTINGS_LOCAL_PHY_0_3_OFFSET 0x1074
+#define SAS2_SETTINGS_LOCAL_PHY_4_7_OFFSET 0x1074
+#define PHY_G3_WITHOUT_SSC_BIT_SHIFT 12
+#define PHY_G3_WITH_SSC_BIT_SHIFT 13
+#define SNW3_PHY_CAPABILITIES_PARITY 31
+
+   /*
+    * Using shifted destination address 0x3_0000:0x1074 + 0x4000*N (N=0:3)
+    * Using shifted destination address 0x4_0000:0x1074 + 0x4000*(N-4) (N=4:7)
+    */
+	if (-1 == bar4_shift(pm8001_ha, SAS2_SETTINGS_LOCAL_PHY_0_3_SHIFT_ADDR))
+		return;
+
+	for (i = 0; i < 4; i++) {
+		offset = SAS2_SETTINGS_LOCAL_PHY_0_3_OFFSET + 0x4000 * i;
+		pm8001_cw32(pm8001_ha, 2, offset, 0x80001501);
+	}
+	/* shift membase 3 for SAS2_SETTINGS_LOCAL_PHY 4 - 7 */
+	if (-1 == bar4_shift(pm8001_ha, SAS2_SETTINGS_LOCAL_PHY_4_7_SHIFT_ADDR))
+		return;
+	for (i = 4; i < 8; i++) {
+		offset = SAS2_SETTINGS_LOCAL_PHY_4_7_OFFSET + 0x4000 * (i-4);
+		pm8001_cw32(pm8001_ha, 2, offset, 0x80001501);
+	}
+	/*************************************************************
+	Change the SSC upspreading value to 0x0 so that upspreading is disabled.
+	Device MABC SMOD0 Controls
+	Address: (via MEMBASE-III):
+	Using shifted destination address 0x0_0000: with Offset 0xD8
+
+	31:28 R/W Reserved Do not change
+	27:24 R/W SAS_SMOD_SPRDUP 0000
+	23:20 R/W SAS_SMOD_SPRDDN 0000
+	19:0  R/W  Reserved Do not change
+	Upon power-up this register will read as 0x8990c016,
+	and I would like you to change the SAS_SMOD_SPRDUP bits to 0b0000
+	so that the written value will be 0x8090c016.
+	This will ensure only down-spreading SSC is enabled on the SPC.
+	*************************************************************/
+	value = pm8001_cr32(pm8001_ha, 2, 0xd8);
+	pm8001_cw32(pm8001_ha, 2, 0xd8, 0x8000C016);
+
+	/*set the shifted destination address to 0x0 to avoid error operation */
+	bar4_shift(pm8001_ha, 0x0);
+	return;
+}
+
+/**
+ * mpi_set_open_retry_interval_reg
+ * @pm8001_ha: our hba card information
+ * @interval - interval time for each OPEN_REJECT (RETRY). The units are in 1us.
+ */
+static void __devinit
+mpi_set_open_retry_interval_reg(struct pm8001_hba_info *pm8001_ha,
+				u32 interval)
+{
+	u32 offset;
+	u32 value;
+	u32 i;
+
+#define OPEN_RETRY_INTERVAL_PHY_0_3_SHIFT_ADDR 0x00030000
+#define OPEN_RETRY_INTERVAL_PHY_4_7_SHIFT_ADDR 0x00040000
+#define OPEN_RETRY_INTERVAL_PHY_0_3_OFFSET 0x30B4
+#define OPEN_RETRY_INTERVAL_PHY_4_7_OFFSET 0x30B4
+#define OPEN_RETRY_INTERVAL_REG_MASK 0x0000FFFF
+
+	value = interval & OPEN_RETRY_INTERVAL_REG_MASK;
+	/* shift bar and set the OPEN_REJECT(RETRY) interval time of PHY 0 -3.*/
+	if (-1 == bar4_shift(pm8001_ha,
+			     OPEN_RETRY_INTERVAL_PHY_0_3_SHIFT_ADDR))
+		return;
+	for (i = 0; i < 4; i++) {
+		offset = OPEN_RETRY_INTERVAL_PHY_0_3_OFFSET + 0x4000 * i;
+		pm8001_cw32(pm8001_ha, 2, offset, value);
+	}
+
+	if (-1 == bar4_shift(pm8001_ha,
+			     OPEN_RETRY_INTERVAL_PHY_4_7_SHIFT_ADDR))
+		return;
+	for (i = 4; i < 8; i++) {
+		offset = OPEN_RETRY_INTERVAL_PHY_4_7_OFFSET + 0x4000 * (i-4);
+		pm8001_cw32(pm8001_ha, 2, offset, value);
+	}
+	/*set the shifted destination address to 0x0 to avoid error operation */
+	bar4_shift(pm8001_ha, 0x0);
+	return;
+}
+
+/**
+ * mpi_init_check - check firmware initialization status.
+ * @pm8001_ha: our hba card information
+ */
+static int mpi_init_check(struct pm8001_hba_info *pm8001_ha)
+{
+	u32 max_wait_count;
+	u32 value;
+	u32 gst_len_mpistate;
+	/* Write bit0=1 to Inbound DoorBell Register to tell the SPC FW the
+	table is updated */
+	pm8001_cw32(pm8001_ha, 0, MSGU_IBDB_SET, SPC_MSGU_CFG_TABLE_UPDATE);
+	/* wait until Inbound DoorBell Clear Register toggled */
+	max_wait_count = 1 * 1000 * 1000;/* 1 sec */
+	do {
+		udelay(1);
+		value = pm8001_cr32(pm8001_ha, 0, MSGU_IBDB_SET);
+		value &= SPC_MSGU_CFG_TABLE_UPDATE;
+	} while ((value != 0) && (--max_wait_count));
+
+	if (!max_wait_count)
+		return -1;
+	/* check the MPI-State for initialization */
+	gst_len_mpistate =
+		pm8001_mr32(pm8001_ha->general_stat_tbl_addr,
+		GST_GSTLEN_MPIS_OFFSET);
+	if (GST_MPI_STATE_INIT != (gst_len_mpistate & GST_MPI_STATE_MASK))
+		return -1;
+	/* check MPI Initialization error */
+	gst_len_mpistate = gst_len_mpistate >> 16;
+	if (0x0000 != gst_len_mpistate)
+		return -1;
+	return 0;
+}
+
+/**
+ * check_fw_ready - The LLDD check if the FW is ready, if not, return error.
+ * @pm8001_ha: our hba card information
+ */
+static int check_fw_ready(struct pm8001_hba_info *pm8001_ha)
+{
+	u32 value, value1;
+	u32 max_wait_count;
+	/* check error state */
+	value = pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_1);
+	value1 = pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_2);
+	/* check AAP error */
+	if (SCRATCH_PAD1_ERR == (value & SCRATCH_PAD_STATE_MASK)) {
+		/* error state */
+		value = pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_0);
+		return -1;
+	}
+
+	/* check IOP error */
+	if (SCRATCH_PAD2_ERR == (value1 & SCRATCH_PAD_STATE_MASK)) {
+		/* error state */
+		value1 = pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_3);
+		return -1;
+	}
+
+	/* bit 4-31 of scratch pad1 should be zeros if it is not
+	in error state*/
+	if (value & SCRATCH_PAD1_STATE_MASK) {
+		/* error case */
+		pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_0);
+		return -1;
+	}
+
+	/* bit 2, 4-31 of scratch pad2 should be zeros if it is not
+	in error state */
+	if (value1 & SCRATCH_PAD2_STATE_MASK) {
+		/* error case */
+		return -1;
+	}
+
+	max_wait_count = 1 * 1000 * 1000;/* 1 sec timeout */
+
+	/* wait until scratch pad 1 and 2 registers in ready state  */
+	do {
+		udelay(1);
+		value = pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_1)
+			& SCRATCH_PAD1_RDY;
+		value1 = pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_2)
+			& SCRATCH_PAD2_RDY;
+		if ((--max_wait_count) == 0)
+			return -1;
+	} while ((value != SCRATCH_PAD1_RDY) || (value1 != SCRATCH_PAD2_RDY));
+	return 0;
+}
+
+static void init_pci_device_addresses(struct pm8001_hba_info *pm8001_ha)
+{
+	void __iomem *base_addr;
+	u32	value;
+	u32	offset;
+	u32	pcibar;
+	u32	pcilogic;
+
+	value = pm8001_cr32(pm8001_ha, 0, 0x44);
+	offset = value & 0x03FFFFFF;
+	PM8001_INIT_DBG(pm8001_ha,
+		pm8001_printk("Scratchpad 0 Offset: %x \n", offset));
+	pcilogic = (value & 0xFC000000) >> 26;
+	pcibar = get_pci_bar_index(pcilogic);
+	PM8001_INIT_DBG(pm8001_ha,
+		pm8001_printk("Scratchpad 0 PCI BAR: %d \n", pcibar));
+	pm8001_ha->main_cfg_tbl_addr = base_addr =
+		pm8001_ha->io_mem[pcibar].memvirtaddr + offset;
+	pm8001_ha->general_stat_tbl_addr =
+		base_addr + pm8001_cr32(pm8001_ha, pcibar, offset + 0x18);
+	pm8001_ha->inbnd_q_tbl_addr =
+		base_addr + pm8001_cr32(pm8001_ha, pcibar, offset + 0x1C);
+	pm8001_ha->outbnd_q_tbl_addr =
+		base_addr + pm8001_cr32(pm8001_ha, pcibar, offset + 0x20);
+}
+
+/**
+ * pm8001_chip_init - the main init function that initialize whole PM8001 chip.
+ * @pm8001_ha: our hba card information
+ */
+static int __devinit pm8001_chip_init(struct pm8001_hba_info *pm8001_ha)
+{
+	/* check the firmware status */
+	if (-1 == check_fw_ready(pm8001_ha)) {
+		PM8001_FAIL_DBG(pm8001_ha,
+			pm8001_printk("Firmware is not ready!\n"));
+		return -EBUSY;
+	}
+
+	/* Initialize pci space address eg: mpi offset */
+	init_pci_device_addresses(pm8001_ha);
+	init_default_table_values(pm8001_ha);
+	read_main_config_table(pm8001_ha);
+	read_general_status_table(pm8001_ha);
+	read_inbnd_queue_table(pm8001_ha);
+	read_outbnd_queue_table(pm8001_ha);
+	/* update main config table ,inbound table and outbound table */
+	update_main_config_table(pm8001_ha);
+	update_inbnd_queue_table(pm8001_ha, 0);
+	update_outbnd_queue_table(pm8001_ha, 0);
+	mpi_set_phys_g3_with_ssc(pm8001_ha, 0);
+	mpi_set_open_retry_interval_reg(pm8001_ha, 7);
+	/* notify firmware update finished and check initialization status */
+	if (0 == mpi_init_check(pm8001_ha)) {
+		PM8001_INIT_DBG(pm8001_ha,
+			pm8001_printk("MPI initialize successful!\n"));
+	} else
+		return -EBUSY;
+	/*This register is a 16-bit timer with a resolution of 1us. This is the
+	timer used for interrupt delay/coalescing in the PCIe Application Layer.
+	Zero is not a valid value. A value of 1 in the register will cause the
+	interrupts to be normal. A value greater than 1 will cause coalescing
+	delays.*/
+	pm8001_cw32(pm8001_ha, 1, 0x0033c0, 0x1);
+	pm8001_cw32(pm8001_ha, 1, 0x0033c4, 0x0);
+	return 0;
+}
+
+static int mpi_uninit_check(struct pm8001_hba_info *pm8001_ha)
+{
+	u32 max_wait_count;
+	u32 value;
+	u32 gst_len_mpistate;
+	init_pci_device_addresses(pm8001_ha);
+	/* Write bit1=1 to Inbound DoorBell Register to tell the SPC FW the
+	table is stop */
+	pm8001_cw32(pm8001_ha, 0, MSGU_IBDB_SET, SPC_MSGU_CFG_TABLE_RESET);
+
+	/* wait until Inbound DoorBell Clear Register toggled */
+	max_wait_count = 1 * 1000 * 1000;/* 1 sec */
+	do {
+		udelay(1);
+		value = pm8001_cr32(pm8001_ha, 0, MSGU_IBDB_SET);
+		value &= SPC_MSGU_CFG_TABLE_RESET;
+	} while ((value != 0) && (--max_wait_count));
+
+	if (!max_wait_count) {
+		PM8001_FAIL_DBG(pm8001_ha,
+			pm8001_printk("TIMEOUT:IBDB value/=0x%x\n", value));
+		return -1;
+	}
+
+	/* check the MPI-State for termination in progress */
+	/* wait until Inbound DoorBell Clear Register toggled */
+	max_wait_count = 1 * 1000 * 1000;  /* 1 sec */
+	do {
+		udelay(1);
+		gst_len_mpistate =
+			pm8001_mr32(pm8001_ha->general_stat_tbl_addr,
+			GST_GSTLEN_MPIS_OFFSET);
+		if (GST_MPI_STATE_UNINIT ==
+			(gst_len_mpistate & GST_MPI_STATE_MASK))
+			break;
+	} while (--max_wait_count);
+	if (!max_wait_count) {
+		PM8001_FAIL_DBG(pm8001_ha,
+			pm8001_printk(" TIME OUT MPI State = 0x%x\n",
+				gst_len_mpistate & GST_MPI_STATE_MASK));
+		return -1;
+	}
+	return 0;
+}
+
+/**
+ * soft_reset_ready_check - Function to check FW is ready for soft reset.
+ * @pm8001_ha: our hba card information
+ */
+static u32 soft_reset_ready_check(struct pm8001_hba_info *pm8001_ha)
+{
+	u32 regVal, regVal1, regVal2;
+	if (mpi_uninit_check(pm8001_ha) != 0) {
+		PM8001_FAIL_DBG(pm8001_ha,
+			pm8001_printk("MPI state is not ready\n"));
+		return -1;
+	}
+	/* read the scratch pad 2 register bit 2 */
+	regVal = pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_2)
+		& SCRATCH_PAD2_FWRDY_RST;
+	if (regVal == SCRATCH_PAD2_FWRDY_RST) {
+		PM8001_INIT_DBG(pm8001_ha,
+			pm8001_printk("Firmware is ready for reset .\n"));
+	} else {
+	/* Trigger NMI twice via RB6 */
+		if (-1 == bar4_shift(pm8001_ha, RB6_ACCESS_REG)) {
+			PM8001_FAIL_DBG(pm8001_ha,
+				pm8001_printk("Shift Bar4 to 0x%x failed\n",
+					RB6_ACCESS_REG));
+			return -1;
+		}
+		pm8001_cw32(pm8001_ha, 2, SPC_RB6_OFFSET,
+			RB6_MAGIC_NUMBER_RST);
+		pm8001_cw32(pm8001_ha, 2, SPC_RB6_OFFSET, RB6_MAGIC_NUMBER_RST);
+		/* wait for 100 ms */
+		mdelay(100);
+		regVal = pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_2) &
+			SCRATCH_PAD2_FWRDY_RST;
+		if (regVal != SCRATCH_PAD2_FWRDY_RST) {
+			regVal1 = pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_1);
+			regVal2 = pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_2);
+			PM8001_FAIL_DBG(pm8001_ha,
+				pm8001_printk("TIMEOUT:MSGU_SCRATCH_PAD1"
+				"=0x%x, MSGU_SCRATCH_PAD2=0x%x\n",
+				regVal1, regVal2));
+			PM8001_FAIL_DBG(pm8001_ha,
+				pm8001_printk("SCRATCH_PAD0 value = 0x%x\n",
+				pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_0)));
+			PM8001_FAIL_DBG(pm8001_ha,
+				pm8001_printk("SCRATCH_PAD3 value = 0x%x\n",
+				pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_3)));
+			return -1;
+		}
+	}
+	return 0;
+}
+
+/**
+ * pm8001_chip_soft_rst - soft reset the PM8001 chip, so that the clear all
+ * the FW register status to the originated status.
+ * @pm8001_ha: our hba card information
+ * @signature: signature in host scratch pad0 register.
+ */
+static int
+pm8001_chip_soft_rst(struct pm8001_hba_info *pm8001_ha, u32 signature)
+{
+	u32	regVal, toggleVal;
+	u32	max_wait_count;
+	u32	regVal1, regVal2, regVal3;
+
+	/* step1: Check FW is ready for soft reset */
+	if (soft_reset_ready_check(pm8001_ha) != 0) {
+		PM8001_FAIL_DBG(pm8001_ha, pm8001_printk("FW is not ready\n"));
+		return -1;
+	}
+
+	/* step 2: clear NMI status register on AAP1 and IOP, write the same
+	value to clear */
+	/* map 0x60000 to BAR4(0x20), BAR2(win) */
+	if (-1 == bar4_shift(pm8001_ha, MBIC_AAP1_ADDR_BASE)) {
+		PM8001_FAIL_DBG(pm8001_ha,
+			pm8001_printk("Shift Bar4 to 0x%x failed\n",
+			MBIC_AAP1_ADDR_BASE));
+		return -1;
+	}
+	regVal = pm8001_cr32(pm8001_ha, 2, MBIC_NMI_ENABLE_VPE0_IOP);
+	PM8001_INIT_DBG(pm8001_ha,
+		pm8001_printk("MBIC - NMI Enable VPE0 (IOP)= 0x%x\n", regVal));
+	pm8001_cw32(pm8001_ha, 2, MBIC_NMI_ENABLE_VPE0_IOP, 0x0);
+	/* map 0x70000 to BAR4(0x20), BAR2(win) */
+	if (-1 == bar4_shift(pm8001_ha, MBIC_IOP_ADDR_BASE)) {
+		PM8001_FAIL_DBG(pm8001_ha,
+			pm8001_printk("Shift Bar4 to 0x%x failed\n",
+			MBIC_IOP_ADDR_BASE));
+		return -1;
+	}
+	regVal = pm8001_cr32(pm8001_ha, 2, MBIC_NMI_ENABLE_VPE0_AAP1);
+	PM8001_INIT_DBG(pm8001_ha,
+		pm8001_printk("MBIC - NMI Enable VPE0 (AAP1)= 0x%x\n", regVal));
+	pm8001_cw32(pm8001_ha, 2, MBIC_NMI_ENABLE_VPE0_AAP1, 0x0);
+
+	regVal = pm8001_cr32(pm8001_ha, 1, PCIE_EVENT_INTERRUPT_ENABLE);
+	PM8001_INIT_DBG(pm8001_ha,
+		pm8001_printk("PCIE -Event Interrupt Enable = 0x%x\n", regVal));
+	pm8001_cw32(pm8001_ha, 1, PCIE_EVENT_INTERRUPT_ENABLE, 0x0);
+
+	regVal = pm8001_cr32(pm8001_ha, 1, PCIE_EVENT_INTERRUPT);
+	PM8001_INIT_DBG(pm8001_ha,
+		pm8001_printk("PCIE - Event Interrupt  = 0x%x\n", regVal));
+	pm8001_cw32(pm8001_ha, 1, PCIE_EVENT_INTERRUPT, regVal);
+
+	regVal = pm8001_cr32(pm8001_ha, 1, PCIE_ERROR_INTERRUPT_ENABLE);
+	PM8001_INIT_DBG(pm8001_ha,
+		pm8001_printk("PCIE -Error Interrupt Enable = 0x%x\n", regVal));
+	pm8001_cw32(pm8001_ha, 1, PCIE_ERROR_INTERRUPT_ENABLE, 0x0);
+
+	regVal = pm8001_cr32(pm8001_ha, 1, PCIE_ERROR_INTERRUPT);
+	PM8001_INIT_DBG(pm8001_ha,
+		pm8001_printk("PCIE - Error Interrupt = 0x%x\n", regVal));
+	pm8001_cw32(pm8001_ha, 1, PCIE_ERROR_INTERRUPT, regVal);
+
+	/* read the scratch pad 1 register bit 2 */
+	regVal = pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_1)
+		& SCRATCH_PAD1_RST;
+	toggleVal = regVal ^ SCRATCH_PAD1_RST;
+
+	/* set signature in host scratch pad0 register to tell SPC that the
+	host performs the soft reset */
+	pm8001_cw32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_0, signature);
+
+	/* read required registers for confirmming */
+	/* map 0x0700000 to BAR4(0x20), BAR2(win) */
+	if (-1 == bar4_shift(pm8001_ha, GSM_ADDR_BASE)) {
+		PM8001_FAIL_DBG(pm8001_ha,
+			pm8001_printk("Shift Bar4 to 0x%x failed\n",
+			GSM_ADDR_BASE));
+		return -1;
+	}
+	PM8001_INIT_DBG(pm8001_ha,
+		pm8001_printk("GSM 0x0(0x00007b88)-GSM Configuration and"
+		" Reset = 0x%x\n",
+		pm8001_cr32(pm8001_ha, 2, GSM_CONFIG_RESET)));
+
+	/* step 3: host read GSM Configuration and Reset register */
+	regVal = pm8001_cr32(pm8001_ha, 2, GSM_CONFIG_RESET);
+	/* Put those bits to low */
+	/* GSM XCBI offset = 0x70 0000
+	0x00 Bit 13 COM_SLV_SW_RSTB 1
+	0x00 Bit 12 QSSP_SW_RSTB 1
+	0x00 Bit 11 RAAE_SW_RSTB 1
+	0x00 Bit 9 RB_1_SW_RSTB 1
+	0x00 Bit 8 SM_SW_RSTB 1
+	*/
+	regVal &= ~(0x00003b00);
+	/* host write GSM Configuration and Reset register */
+	pm8001_cw32(pm8001_ha, 2, GSM_CONFIG_RESET, regVal);
+	PM8001_INIT_DBG(pm8001_ha,
+		pm8001_printk("GSM 0x0 (0x00007b88 ==> 0x00004088) - GSM "
+		"Configuration and Reset is set to = 0x%x\n",
+		pm8001_cr32(pm8001_ha, 2, GSM_CONFIG_RESET)));
+
+	/* step 4: */
+	/* disable GSM - Read Address Parity Check */
+	regVal1 = pm8001_cr32(pm8001_ha, 2, GSM_READ_ADDR_PARITY_CHECK);
+	PM8001_INIT_DBG(pm8001_ha,
+		pm8001_printk("GSM 0x700038 - Read Address Parity Check "
+		"Enable = 0x%x\n", regVal1));
+	pm8001_cw32(pm8001_ha, 2, GSM_READ_ADDR_PARITY_CHECK, 0x0);
+	PM8001_INIT_DBG(pm8001_ha,
+		pm8001_printk("GSM 0x700038 - Read Address Parity Check Enable"
+		"is set to = 0x%x\n",
+		pm8001_cr32(pm8001_ha, 2, GSM_READ_ADDR_PARITY_CHECK)));
+
+	/* disable GSM - Write Address Parity Check */
+	regVal2 = pm8001_cr32(pm8001_ha, 2, GSM_WRITE_ADDR_PARITY_CHECK);
+	PM8001_INIT_DBG(pm8001_ha,
+		pm8001_printk("GSM 0x700040 - Write Address Parity Check"
+		" Enable = 0x%x\n", regVal2));
+	pm8001_cw32(pm8001_ha, 2, GSM_WRITE_ADDR_PARITY_CHECK, 0x0);
+	PM8001_INIT_DBG(pm8001_ha,
+		pm8001_printk("GSM 0x700040 - Write Address Parity Check "
+		"Enable is set to = 0x%x\n",
+		pm8001_cr32(pm8001_ha, 2, GSM_WRITE_ADDR_PARITY_CHECK)));
+
+	/* disable GSM - Write Data Parity Check */
+	regVal3 = pm8001_cr32(pm8001_ha, 2, GSM_WRITE_DATA_PARITY_CHECK);
+	PM8001_INIT_DBG(pm8001_ha,
+		pm8001_printk("GSM 0x300048 - Write Data Parity Check"
+		" Enable = 0x%x\n", regVal3));
+	pm8001_cw32(pm8001_ha, 2, GSM_WRITE_DATA_PARITY_CHECK, 0x0);
+	PM8001_INIT_DBG(pm8001_ha,
+		pm8001_printk("GSM 0x300048 - Write Data Parity Check Enable"
+		"is set to = 0x%x\n",
+	pm8001_cr32(pm8001_ha, 2, GSM_WRITE_DATA_PARITY_CHECK)));
+
+	/* step 5: delay 10 usec */
+	udelay(10);
+	/* step 5-b: set GPIO-0 output control to tristate anyway */
+	if (-1 == bar4_shift(pm8001_ha, GPIO_ADDR_BASE)) {
+		PM8001_INIT_DBG(pm8001_ha,
+				pm8001_printk("Shift Bar4 to 0x%x failed\n",
+				GPIO_ADDR_BASE));
+		return -1;
+	}
+	regVal = pm8001_cr32(pm8001_ha, 2, GPIO_GPIO_0_0UTPUT_CTL_OFFSET);
+		PM8001_INIT_DBG(pm8001_ha,
+				pm8001_printk("GPIO Output Control Register:"
+				" = 0x%x\n", regVal));
+	/* set GPIO-0 output control to tri-state */
+	regVal &= 0xFFFFFFFC;
+	pm8001_cw32(pm8001_ha, 2, GPIO_GPIO_0_0UTPUT_CTL_OFFSET, regVal);
+
+	/* Step 6: Reset the IOP and AAP1 */
+	/* map 0x00000 to BAR4(0x20), BAR2(win) */
+	if (-1 == bar4_shift(pm8001_ha, SPC_TOP_LEVEL_ADDR_BASE)) {
+		PM8001_FAIL_DBG(pm8001_ha,
+			pm8001_printk("SPC Shift Bar4 to 0x%x failed\n",
+			SPC_TOP_LEVEL_ADDR_BASE));
+		return -1;
+	}
+	regVal = pm8001_cr32(pm8001_ha, 2, SPC_REG_RESET);
+	PM8001_INIT_DBG(pm8001_ha,
+		pm8001_printk("Top Register before resetting IOP/AAP1"
+		":= 0x%x\n", regVal));
+	regVal &= ~(SPC_REG_RESET_PCS_IOP_SS | SPC_REG_RESET_PCS_AAP1_SS);
+	pm8001_cw32(pm8001_ha, 2, SPC_REG_RESET, regVal);
+
+	/* step 7: Reset the BDMA/OSSP */
+	regVal = pm8001_cr32(pm8001_ha, 2, SPC_REG_RESET);
+	PM8001_INIT_DBG(pm8001_ha,
+		pm8001_printk("Top Register before resetting BDMA/OSSP"
+		": = 0x%x\n", regVal));
+	regVal &= ~(SPC_REG_RESET_BDMA_CORE | SPC_REG_RESET_OSSP);
+	pm8001_cw32(pm8001_ha, 2, SPC_REG_RESET, regVal);
+
+	/* step 8: delay 10 usec */
+	udelay(10);
+
+	/* step 9: bring the BDMA and OSSP out of reset */
+	regVal = pm8001_cr32(pm8001_ha, 2, SPC_REG_RESET);
+	PM8001_INIT_DBG(pm8001_ha,
+		pm8001_printk("Top Register before bringing up BDMA/OSSP"
+		":= 0x%x\n", regVal));
+	regVal |= (SPC_REG_RESET_BDMA_CORE | SPC_REG_RESET_OSSP);
+	pm8001_cw32(pm8001_ha, 2, SPC_REG_RESET, regVal);
+
+	/* step 10: delay 10 usec */
+	udelay(10);
+
+	/* step 11: reads and sets the GSM Configuration and Reset Register */
+	/* map 0x0700000 to BAR4(0x20), BAR2(win) */
+	if (-1 == bar4_shift(pm8001_ha, GSM_ADDR_BASE)) {
+		PM8001_FAIL_DBG(pm8001_ha,
+			pm8001_printk("SPC Shift Bar4 to 0x%x failed\n",
+			GSM_ADDR_BASE));
+		return -1;
+	}
+	PM8001_INIT_DBG(pm8001_ha,
+		pm8001_printk("GSM 0x0 (0x00007b88)-GSM Configuration and "
+		"Reset = 0x%x\n", pm8001_cr32(pm8001_ha, 2, GSM_CONFIG_RESET)));
+	regVal = pm8001_cr32(pm8001_ha, 2, GSM_CONFIG_RESET);
+	/* Put those bits to high */
+	/* GSM XCBI offset = 0x70 0000
+	0x00 Bit 13 COM_SLV_SW_RSTB 1
+	0x00 Bit 12 QSSP_SW_RSTB 1
+	0x00 Bit 11 RAAE_SW_RSTB 1
+	0x00 Bit 9   RB_1_SW_RSTB 1
+	0x00 Bit 8   SM_SW_RSTB 1
+	*/
+	regVal |= (GSM_CONFIG_RESET_VALUE);
+	pm8001_cw32(pm8001_ha, 2, GSM_CONFIG_RESET, regVal);
+	PM8001_INIT_DBG(pm8001_ha,
+		pm8001_printk("GSM (0x00004088 ==> 0x00007b88) - GSM"
+		" Configuration and Reset is set to = 0x%x\n",
+		pm8001_cr32(pm8001_ha, 2, GSM_CONFIG_RESET)));
+
+	/* step 12: Restore GSM - Read Address Parity Check */
+	regVal = pm8001_cr32(pm8001_ha, 2, GSM_READ_ADDR_PARITY_CHECK);
+	/* just for debugging */
+	PM8001_INIT_DBG(pm8001_ha,
+		pm8001_printk("GSM 0x700038 - Read Address Parity Check Enable"
+		" = 0x%x\n", regVal));
+	pm8001_cw32(pm8001_ha, 2, GSM_READ_ADDR_PARITY_CHECK, regVal1);
+	PM8001_INIT_DBG(pm8001_ha,
+		pm8001_printk("GSM 0x700038 - Read Address Parity"
+		" Check Enable is set to = 0x%x\n",
+		pm8001_cr32(pm8001_ha, 2, GSM_READ_ADDR_PARITY_CHECK)));
+	/* Restore GSM - Write Address Parity Check */
+	regVal = pm8001_cr32(pm8001_ha, 2, GSM_WRITE_ADDR_PARITY_CHECK);
+	pm8001_cw32(pm8001_ha, 2, GSM_WRITE_ADDR_PARITY_CHECK, regVal2);
+	PM8001_INIT_DBG(pm8001_ha,
+		pm8001_printk("GSM 0x700040 - Write Address Parity Check"
+		" Enable is set to = 0x%x\n",
+		pm8001_cr32(pm8001_ha, 2, GSM_WRITE_ADDR_PARITY_CHECK)));
+	/* Restore GSM - Write Data Parity Check */
+	regVal = pm8001_cr32(pm8001_ha, 2, GSM_WRITE_DATA_PARITY_CHECK);
+	pm8001_cw32(pm8001_ha, 2, GSM_WRITE_DATA_PARITY_CHECK, regVal3);
+	PM8001_INIT_DBG(pm8001_ha,
+		pm8001_printk("GSM 0x700048 - Write Data Parity Check Enable"
+		"is set to = 0x%x\n",
+		pm8001_cr32(pm8001_ha, 2, GSM_WRITE_DATA_PARITY_CHECK)));
+
+	/* step 13: bring the IOP and AAP1 out of reset */
+	/* map 0x00000 to BAR4(0x20), BAR2(win) */
+	if (-1 == bar4_shift(pm8001_ha, SPC_TOP_LEVEL_ADDR_BASE)) {
+		PM8001_FAIL_DBG(pm8001_ha,
+			pm8001_printk("Shift Bar4 to 0x%x failed\n",
+			SPC_TOP_LEVEL_ADDR_BASE));
+		return -1;
+	}
+	regVal = pm8001_cr32(pm8001_ha, 2, SPC_REG_RESET);
+	regVal |= (SPC_REG_RESET_PCS_IOP_SS | SPC_REG_RESET_PCS_AAP1_SS);
+	pm8001_cw32(pm8001_ha, 2, SPC_REG_RESET, regVal);
+
+	/* step 14: delay 10 usec - Normal Mode */
+	udelay(10);
+	/* check Soft Reset Normal mode or Soft Reset HDA mode */
+	if (signature == SPC_SOFT_RESET_SIGNATURE) {
+		/* step 15 (Normal Mode): wait until scratch pad1 register
+		bit 2 toggled */
+		max_wait_count = 2 * 1000 * 1000;/* 2 sec */
+		do {
+			udelay(1);
+			regVal = pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_1) &
+				SCRATCH_PAD1_RST;
+		} while ((regVal != toggleVal) && (--max_wait_count));
+
+		if (!max_wait_count) {
+			regVal = pm8001_cr32(pm8001_ha, 0,
+				MSGU_SCRATCH_PAD_1);
+			PM8001_FAIL_DBG(pm8001_ha,
+				pm8001_printk("TIMEOUT : ToggleVal 0x%x,"
+				"MSGU_SCRATCH_PAD1 = 0x%x\n",
+				toggleVal, regVal));
+			PM8001_FAIL_DBG(pm8001_ha,
+				pm8001_printk("SCRATCH_PAD0 value = 0x%x\n",
+				pm8001_cr32(pm8001_ha, 0,
+				MSGU_SCRATCH_PAD_0)));
+			PM8001_FAIL_DBG(pm8001_ha,
+				pm8001_printk("SCRATCH_PAD2 value = 0x%x\n",
+				pm8001_cr32(pm8001_ha, 0,
+				MSGU_SCRATCH_PAD_2)));
+			PM8001_FAIL_DBG(pm8001_ha,
+				pm8001_printk("SCRATCH_PAD3 value = 0x%x\n",
+				pm8001_cr32(pm8001_ha, 0,
+				MSGU_SCRATCH_PAD_3)));
+			return -1;
+		}
+
+		/* step 16 (Normal) - Clear ODMR and ODCR */
+		pm8001_cw32(pm8001_ha, 0, MSGU_ODCR, ODCR_CLEAR_ALL);
+		pm8001_cw32(pm8001_ha, 0, MSGU_ODMR, ODMR_CLEAR_ALL);
+
+		/* step 17 (Normal Mode): wait for the FW and IOP to get
+		ready - 1 sec timeout */
+		/* Wait for the SPC Configuration Table to be ready */
+		if (check_fw_ready(pm8001_ha) == -1) {
+			regVal = pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_1);
+			/* return error if MPI Configuration Table not ready */
+			PM8001_INIT_DBG(pm8001_ha,
+				pm8001_printk("FW not ready SCRATCH_PAD1"
+				" = 0x%x\n", regVal));
+			regVal = pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_2);
+			/* return error if MPI Configuration Table not ready */
+			PM8001_INIT_DBG(pm8001_ha,
+				pm8001_printk("FW not ready SCRATCH_PAD2"
+				" = 0x%x\n", regVal));
+			PM8001_INIT_DBG(pm8001_ha,
+				pm8001_printk("SCRATCH_PAD0 value = 0x%x\n",
+				pm8001_cr32(pm8001_ha, 0,
+				MSGU_SCRATCH_PAD_0)));
+			PM8001_INIT_DBG(pm8001_ha,
+				pm8001_printk("SCRATCH_PAD3 value = 0x%x\n",
+				pm8001_cr32(pm8001_ha, 0,
+				MSGU_SCRATCH_PAD_3)));
+			return -1;
+		}
+	}
+
+	PM8001_INIT_DBG(pm8001_ha,
+		pm8001_printk("SPC soft reset Complete\n"));
+	return 0;
+}
+
+static void pm8001_hw_chip_rst(struct pm8001_hba_info *pm8001_ha)
+{
+	u32 i;
+	u32 regVal;
+	PM8001_INIT_DBG(pm8001_ha,
+		pm8001_printk("chip reset start\n"));
+
+	/* do SPC chip reset. */
+	regVal = pm8001_cr32(pm8001_ha, 1, SPC_REG_RESET);
+	regVal &= ~(SPC_REG_RESET_DEVICE);
+	pm8001_cw32(pm8001_ha, 1, SPC_REG_RESET, regVal);
+
+	/* delay 10 usec */
+	udelay(10);
+
+	/* bring chip reset out of reset */
+	regVal = pm8001_cr32(pm8001_ha, 1, SPC_REG_RESET);
+	regVal |= SPC_REG_RESET_DEVICE;
+	pm8001_cw32(pm8001_ha, 1, SPC_REG_RESET, regVal);
+
+	/* delay 10 usec */
+	udelay(10);
+
+	/* wait for 20 msec until the firmware gets reloaded */
+	i = 20;
+	do {
+		mdelay(1);
+	} while ((--i) != 0);
+
+	PM8001_INIT_DBG(pm8001_ha,
+		pm8001_printk("chip reset finished\n"));
+}
+
+/**
+ * pm8001_chip_iounmap - which maped when initilized.
+ * @pm8001_ha: our hba card information
+ */
+static void pm8001_chip_iounmap(struct pm8001_hba_info *pm8001_ha)
+{
+	s8 bar, logical = 0;
+	for (bar = 0; bar < 6; bar++) {
+		/*
+		** logical BARs for SPC:
+		** bar 0 and 1 - logical BAR0
+		** bar 2 and 3 - logical BAR1
+		** bar4 - logical BAR2
+		** bar5 - logical BAR3
+		** Skip the appropriate assignments:
+		*/
+		if ((bar == 1) || (bar == 3))
+			continue;
+		if (pm8001_ha->io_mem[logical].memvirtaddr) {
+			iounmap(pm8001_ha->io_mem[logical].memvirtaddr);
+			logical++;
+		}
+	}
+}
+
+/**
+ * pm8001_chip_interrupt_enable - enable PM8001 chip interrupt
+ * @pm8001_ha: our hba card information
+ */
+static void
+pm8001_chip_intx_interrupt_enable(struct pm8001_hba_info *pm8001_ha)
+{
+	pm8001_cw32(pm8001_ha, 0, MSGU_ODMR, ODMR_CLEAR_ALL);
+	pm8001_cw32(pm8001_ha, 0, MSGU_ODCR, ODCR_CLEAR_ALL);
+}
+
+ /**
+  * pm8001_chip_intx_interrupt_disable- disable PM8001 chip interrupt
+  * @pm8001_ha: our hba card information
+  */
+static void
+pm8001_chip_intx_interrupt_disable(struct pm8001_hba_info *pm8001_ha)
+{
+	pm8001_cw32(pm8001_ha, 0, MSGU_ODMR, ODMR_MASK_ALL);
+}
+
+/**
+ * pm8001_chip_msix_interrupt_enable - enable PM8001 chip interrupt
+ * @pm8001_ha: our hba card information
+ */
+static void
+pm8001_chip_msix_interrupt_enable(struct pm8001_hba_info *pm8001_ha,
+	u32 int_vec_idx)
+{
+	u32 msi_index;
+	u32 value;
+	msi_index = int_vec_idx * MSIX_TABLE_ELEMENT_SIZE;
+	msi_index += MSIX_TABLE_BASE;
+	pm8001_cw32(pm8001_ha, 0, msi_index, MSIX_INTERRUPT_ENABLE);
+	value = (1 << int_vec_idx);
+	pm8001_cw32(pm8001_ha, 0,  MSGU_ODCR, value);
+
+}
+
+/**
+ * pm8001_chip_msix_interrupt_disable - disable PM8001 chip interrupt
+ * @pm8001_ha: our hba card information
+ */
+static void
+pm8001_chip_msix_interrupt_disable(struct pm8001_hba_info *pm8001_ha,
+	u32 int_vec_idx)
+{
+	u32 msi_index;
+	msi_index = int_vec_idx * MSIX_TABLE_ELEMENT_SIZE;
+	msi_index += MSIX_TABLE_BASE;
+	pm8001_cw32(pm8001_ha, 0,  msi_index, MSIX_INTERRUPT_DISABLE);
+
+}
+/**
+ * pm8001_chip_interrupt_enable - enable PM8001 chip interrupt
+ * @pm8001_ha: our hba card information
+ */
+static void
+pm8001_chip_interrupt_enable(struct pm8001_hba_info *pm8001_ha)
+{
+#ifdef PM8001_USE_MSIX
+	pm8001_chip_msix_interrupt_enable(pm8001_ha, 0);
+	return;
+#endif
+	pm8001_chip_intx_interrupt_enable(pm8001_ha);
+
+}
+
+/**
+ * pm8001_chip_intx_interrupt_disable- disable PM8001 chip interrupt
+ * @pm8001_ha: our hba card information
+ */
+static void
+pm8001_chip_interrupt_disable(struct pm8001_hba_info *pm8001_ha)
+{
+#ifdef PM8001_USE_MSIX
+	pm8001_chip_msix_interrupt_disable(pm8001_ha, 0);
+	return;
+#endif
+	pm8001_chip_intx_interrupt_disable(pm8001_ha);
+
+}
+
+/**
+ * mpi_msg_free_get- get the free message buffer for transfer inbound queue.
+ * @circularQ: the inbound queue  we want to transfer to HBA.
+ * @messageSize: the message size of this transfer, normally it is 64 bytes
+ * @messagePtr: the pointer to message.
+ */
+static int mpi_msg_free_get(struct inbound_queue_table *circularQ,
+			    u16 messageSize, void **messagePtr)
+{
+	u32 offset, consumer_index;
+	struct mpi_msg_hdr *msgHeader;
+	u8 bcCount = 1; /* only support single buffer */
+
+	/* Checks is the requested message size can be allocated in this queue*/
+	if (messageSize > 64) {
+		*messagePtr = NULL;
+		return -1;
+	}
+
+	/* Stores the new consumer index */
+	consumer_index = pm8001_read_32(circularQ->ci_virt);
+	circularQ->consumer_index = cpu_to_le32(consumer_index);
+	if (((circularQ->producer_idx + bcCount) % 256) ==
+		circularQ->consumer_index) {
+		*messagePtr = NULL;
+		return -1;
+	}
+	/* get memory IOMB buffer address */
+	offset = circularQ->producer_idx * 64;
+	/* increment to next bcCount element */
+	circularQ->producer_idx = (circularQ->producer_idx + bcCount) % 256;
+	/* Adds that distance to the base of the region virtual address plus
+	the message header size*/
+	msgHeader = (struct mpi_msg_hdr *)(circularQ->base_virt	+ offset);
+	*messagePtr = ((void *)msgHeader) + sizeof(struct mpi_msg_hdr);
+	return 0;
+}
+
+/**
+ * mpi_build_cmd- build the message queue for transfer, update the PI to FW
+ * to tell the fw to get this message from IOMB.
+ * @pm8001_ha: our hba card information
+ * @circularQ: the inbound queue we want to transfer to HBA.
+ * @opCode: the operation code represents commands which LLDD and fw recognized.
+ * @payload: the command payload of each operation command.
+ */
+static int mpi_build_cmd(struct pm8001_hba_info *pm8001_ha,
+			 struct inbound_queue_table *circularQ,
+			 u32 opCode, void *payload)
+{
+	u32 Header = 0, hpriority = 0, bc = 1, category = 0x02;
+	u32 responseQueue = 0;
+	void *pMessage;
+
+	if (mpi_msg_free_get(circularQ, 64, &pMessage) < 0) {
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("No free mpi buffer \n"));
+		return -1;
+	}
+	BUG_ON(!payload);
+	/*Copy to the payload*/
+	memcpy(pMessage, payload, (64 - sizeof(struct mpi_msg_hdr)));
+
+	/*Build the header*/
+	Header = ((1 << 31) | (hpriority << 30) | ((bc & 0x1f) << 24)
+		| ((responseQueue & 0x3F) << 16)
+		| ((category & 0xF) << 12) | (opCode & 0xFFF));
+
+	pm8001_write_32((pMessage - 4), 0, cpu_to_le32(Header));
+	/*Update the PI to the firmware*/
+	pm8001_cw32(pm8001_ha, circularQ->pi_pci_bar,
+		circularQ->pi_offset, circularQ->producer_idx);
+	PM8001_IO_DBG(pm8001_ha,
+		pm8001_printk("after PI= %d CI= %d \n", circularQ->producer_idx,
+		circularQ->consumer_index));
+	return 0;
+}
+
+static u32 mpi_msg_free_set(struct pm8001_hba_info *pm8001_ha, void *pMsg,
+			    struct outbound_queue_table *circularQ, u8 bc)
+{
+	u32 producer_index;
+	struct mpi_msg_hdr *msgHeader;
+	struct mpi_msg_hdr *pOutBoundMsgHeader;
+
+	msgHeader = (struct mpi_msg_hdr *)(pMsg - sizeof(struct mpi_msg_hdr));
+	pOutBoundMsgHeader = (struct mpi_msg_hdr *)(circularQ->base_virt +
+				circularQ->consumer_idx * 64);
+	if (pOutBoundMsgHeader != msgHeader) {
+		PM8001_FAIL_DBG(pm8001_ha,
+			pm8001_printk("consumer_idx = %d msgHeader = %p\n",
+			circularQ->consumer_idx, msgHeader));
+
+		/* Update the producer index from SPC */
+		producer_index = pm8001_read_32(circularQ->pi_virt);
+		circularQ->producer_index = cpu_to_le32(producer_index);
+		PM8001_FAIL_DBG(pm8001_ha,
+			pm8001_printk("consumer_idx = %d producer_index = %d"
+			"msgHeader = %p\n", circularQ->consumer_idx,
+			circularQ->producer_index, msgHeader));
+		return 0;
+	}
+	/* free the circular queue buffer elements associated with the message*/
+	circularQ->consumer_idx = (circularQ->consumer_idx + bc) % 256;
+	/* update the CI of outbound queue */
+	pm8001_cw32(pm8001_ha, circularQ->ci_pci_bar, circularQ->ci_offset,
+		circularQ->consumer_idx);
+	/* Update the producer index from SPC*/
+	producer_index = pm8001_read_32(circularQ->pi_virt);
+	circularQ->producer_index = cpu_to_le32(producer_index);
+	PM8001_IO_DBG(pm8001_ha,
+		pm8001_printk(" CI=%d PI=%d\n", circularQ->consumer_idx,
+		circularQ->producer_index));
+	return 0;
+}
+
+/**
+ * mpi_msg_consume- get the MPI message from  outbound queue message table.
+ * @pm8001_ha: our hba card information
+ * @circularQ: the outbound queue  table.
+ * @messagePtr1: the message contents of this outbound message.
+ * @pBC: the message size.
+ */
+static u32 mpi_msg_consume(struct pm8001_hba_info *pm8001_ha,
+			   struct outbound_queue_table *circularQ,
+			   void **messagePtr1, u8 *pBC)
+{
+	struct mpi_msg_hdr	*msgHeader;
+	__le32	msgHeader_tmp;
+	u32 header_tmp;
+	do {
+		/* If there are not-yet-delivered messages ... */
+		if (circularQ->producer_index != circularQ->consumer_idx) {
+			/*Get the pointer to the circular queue buffer element*/
+			msgHeader = (struct mpi_msg_hdr *)
+				(circularQ->base_virt +
+				circularQ->consumer_idx * 64);
+			/* read header */
+			header_tmp = pm8001_read_32(msgHeader);
+			msgHeader_tmp = cpu_to_le32(header_tmp);
+			if (0 != (msgHeader_tmp & 0x80000000)) {
+				if (OPC_OUB_SKIP_ENTRY !=
+					(msgHeader_tmp & 0xfff)) {
+					*messagePtr1 =
+						((u8 *)msgHeader) +
+						sizeof(struct mpi_msg_hdr);
+					*pBC = (u8)((msgHeader_tmp >> 24) &
+						0x1f);
+					PM8001_IO_DBG(pm8001_ha,
+						pm8001_printk(": CI=%d PI=%d "
+						"msgHeader=%x\n",
+						circularQ->consumer_idx,
+						circularQ->producer_index,
+						msgHeader_tmp));
+					return MPI_IO_STATUS_SUCCESS;
+				} else {
+					circularQ->consumer_idx =
+						(circularQ->consumer_idx +
+						((msgHeader_tmp >> 24) & 0x1f))
+						% 256;
+					msgHeader_tmp = 0;
+					pm8001_write_32(msgHeader, 0, 0);
+					/* update the CI of outbound queue */
+					pm8001_cw32(pm8001_ha,
+						circularQ->ci_pci_bar,
+						circularQ->ci_offset,
+						circularQ->consumer_idx);
+				}
+			} else {
+				circularQ->consumer_idx =
+					(circularQ->consumer_idx +
+					((msgHeader_tmp >> 24) & 0x1f)) % 256;
+				msgHeader_tmp = 0;
+				pm8001_write_32(msgHeader, 0, 0);
+				/* update the CI of outbound queue */
+				pm8001_cw32(pm8001_ha, circularQ->ci_pci_bar,
+					circularQ->ci_offset,
+					circularQ->consumer_idx);
+				return MPI_IO_STATUS_FAIL;
+			}
+		} else {
+			u32 producer_index;
+			void *pi_virt = circularQ->pi_virt;
+			/* Update the producer index from SPC */
+			producer_index = pm8001_read_32(pi_virt);
+			circularQ->producer_index = cpu_to_le32(producer_index);
+		}
+	} while (circularQ->producer_index != circularQ->consumer_idx);
+	/* while we don't have any more not-yet-delivered message */
+	/* report empty */
+	return MPI_IO_STATUS_BUSY;
+}
+
+static void pm8001_work_queue(struct work_struct *work)
+{
+	struct delayed_work *dw = container_of(work, struct delayed_work, work);
+	struct pm8001_wq *wq = container_of(dw, struct pm8001_wq, work_q);
+	struct pm8001_device *pm8001_dev;
+	struct domain_device	*dev;
+
+	switch (wq->handler) {
+	case IO_OPEN_CNX_ERROR_IT_NEXUS_LOSS:
+		pm8001_dev = wq->data;
+		dev = pm8001_dev->sas_device;
+		pm8001_I_T_nexus_reset(dev);
+		break;
+	case IO_OPEN_CNX_ERROR_STP_RESOURCES_BUSY:
+		pm8001_dev = wq->data;
+		dev = pm8001_dev->sas_device;
+		pm8001_I_T_nexus_reset(dev);
+		break;
+	case IO_DS_IN_ERROR:
+		pm8001_dev = wq->data;
+		dev = pm8001_dev->sas_device;
+		pm8001_I_T_nexus_reset(dev);
+		break;
+	case IO_DS_NON_OPERATIONAL:
+		pm8001_dev = wq->data;
+		dev = pm8001_dev->sas_device;
+		pm8001_I_T_nexus_reset(dev);
+		break;
+	}
+	list_del(&wq->entry);
+	kfree(wq);
+}
+
+static int pm8001_handle_event(struct pm8001_hba_info *pm8001_ha, void *data,
+			       int handler)
+{
+	struct pm8001_wq *wq;
+	int ret = 0;
+
+	wq = kmalloc(sizeof(struct pm8001_wq), GFP_ATOMIC);
+	if (wq) {
+		wq->pm8001_ha = pm8001_ha;
+		wq->data = data;
+		wq->handler = handler;
+		INIT_DELAYED_WORK(&wq->work_q, pm8001_work_queue);
+		list_add_tail(&wq->entry, &pm8001_ha->wq_list);
+		schedule_delayed_work(&wq->work_q, 0);
+	} else
+		ret = -ENOMEM;
+
+	return ret;
+}
+
+/**
+ * mpi_ssp_completion- process the event that FW response to the SSP request.
+ * @pm8001_ha: our hba card information
+ * @piomb: the message contents of this outbound message.
+ *
+ * When FW has completed a ssp request for example a IO request, after it has
+ * filled the SG data with the data, it will trigger this event represent
+ * that he has finished the job,please check the coresponding buffer.
+ * So we will tell the caller who maybe waiting the result to tell upper layer
+ * that the task has been finished.
+ */
+static void
+mpi_ssp_completion(struct pm8001_hba_info *pm8001_ha , void *piomb)
+{
+	struct sas_task *t;
+	struct pm8001_ccb_info *ccb;
+	unsigned long flags;
+	u32 status;
+	u32 param;
+	u32 tag;
+	struct ssp_completion_resp *psspPayload;
+	struct task_status_struct *ts;
+	struct ssp_response_iu *iu;
+	struct pm8001_device *pm8001_dev;
+	psspPayload = (struct ssp_completion_resp *)(piomb + 4);
+	status = le32_to_cpu(psspPayload->status);
+	tag = le32_to_cpu(psspPayload->tag);
+	ccb = &pm8001_ha->ccb_info[tag];
+	pm8001_dev = ccb->device;
+	param = le32_to_cpu(psspPayload->param);
+
+	t = ccb->task;
+
+	if (status && status != IO_UNDERFLOW)
+		PM8001_FAIL_DBG(pm8001_ha,
+			pm8001_printk("sas IO status 0x%x\n", status));
+	if (unlikely(!t || !t->lldd_task || !t->dev))
+		return;
+	ts = &t->task_status;
+	switch (status) {
+	case IO_SUCCESS:
+		PM8001_IO_DBG(pm8001_ha, pm8001_printk("IO_SUCCESS"
+			",param = %d \n", param));
+		if (param == 0) {
+			ts->resp = SAS_TASK_COMPLETE;
+			ts->stat = SAM_GOOD;
+		} else {
+			ts->resp = SAS_TASK_COMPLETE;
+			ts->stat = SAS_PROTO_RESPONSE;
+			ts->residual = param;
+			iu = &psspPayload->ssp_resp_iu;
+			sas_ssp_task_response(pm8001_ha->dev, t, iu);
+		}
+		if (pm8001_dev)
+			pm8001_dev->running_req--;
+		break;
+	case IO_ABORTED:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_ABORTED IOMB Tag \n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_ABORTED_TASK;
+		break;
+	case IO_UNDERFLOW:
+		/* SSP Completion with error */
+		PM8001_IO_DBG(pm8001_ha, pm8001_printk("IO_UNDERFLOW"
+			",param = %d \n", param));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_DATA_UNDERRUN;
+		ts->residual = param;
+		if (pm8001_dev)
+			pm8001_dev->running_req--;
+		break;
+	case IO_NO_DEVICE:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_NO_DEVICE\n"));
+		ts->resp = SAS_TASK_UNDELIVERED;
+		ts->stat = SAS_PHY_DOWN;
+		break;
+	case IO_XFER_ERROR_BREAK:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_XFER_ERROR_BREAK\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		break;
+	case IO_XFER_ERROR_PHY_NOT_READY:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_XFER_ERROR_PHY_NOT_READY\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		ts->open_rej_reason = SAS_OREJ_RSVD_RETRY;
+		break;
+	case IO_OPEN_CNX_ERROR_PROTOCOL_NOT_SUPPORTED:
+		PM8001_IO_DBG(pm8001_ha,
+		pm8001_printk("IO_OPEN_CNX_ERROR_PROTOCOL_NOT_SUPPORTED\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		ts->open_rej_reason = SAS_OREJ_EPROTO;
+		break;
+	case IO_OPEN_CNX_ERROR_ZONE_VIOLATION:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_OPEN_CNX_ERROR_ZONE_VIOLATION\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		ts->open_rej_reason = SAS_OREJ_UNKNOWN;
+		break;
+	case IO_OPEN_CNX_ERROR_BREAK:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_OPEN_CNX_ERROR_BREAK\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		ts->open_rej_reason = SAS_OREJ_RSVD_RETRY;
+		break;
+	case IO_OPEN_CNX_ERROR_IT_NEXUS_LOSS:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_OPEN_CNX_ERROR_IT_NEXUS_LOSS\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		ts->open_rej_reason = SAS_OREJ_UNKNOWN;
+		if (!t->uldd_task)
+			pm8001_handle_event(pm8001_ha,
+				pm8001_dev,
+				IO_OPEN_CNX_ERROR_IT_NEXUS_LOSS);
+		break;
+	case IO_OPEN_CNX_ERROR_BAD_DESTINATION:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_OPEN_CNX_ERROR_BAD_DESTINATION\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		ts->open_rej_reason = SAS_OREJ_BAD_DEST;
+		break;
+	case IO_OPEN_CNX_ERROR_CONNECTION_RATE_NOT_SUPPORTED:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_OPEN_CNX_ERROR_CONNECTION_RATE_"
+			"NOT_SUPPORTED\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		ts->open_rej_reason = SAS_OREJ_CONN_RATE;
+		break;
+	case IO_OPEN_CNX_ERROR_WRONG_DESTINATION:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_OPEN_CNX_ERROR_WRONG_DESTINATION\n"));
+		ts->resp = SAS_TASK_UNDELIVERED;
+		ts->stat = SAS_OPEN_REJECT;
+		ts->open_rej_reason = SAS_OREJ_WRONG_DEST;
+		break;
+	case IO_XFER_ERROR_NAK_RECEIVED:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_XFER_ERROR_NAK_RECEIVED\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		ts->open_rej_reason = SAS_OREJ_RSVD_RETRY;
+		break;
+	case IO_XFER_ERROR_ACK_NAK_TIMEOUT:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_XFER_ERROR_ACK_NAK_TIMEOUT\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_NAK_R_ERR;
+		break;
+	case IO_XFER_ERROR_DMA:
+		PM8001_IO_DBG(pm8001_ha,
+		pm8001_printk("IO_XFER_ERROR_DMA\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		break;
+	case IO_XFER_OPEN_RETRY_TIMEOUT:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_XFER_OPEN_RETRY_TIMEOUT\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		ts->open_rej_reason = SAS_OREJ_RSVD_RETRY;
+		break;
+	case IO_XFER_ERROR_OFFSET_MISMATCH:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_XFER_ERROR_OFFSET_MISMATCH\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		break;
+	case IO_PORT_IN_RESET:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_PORT_IN_RESET\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		break;
+	case IO_DS_NON_OPERATIONAL:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_DS_NON_OPERATIONAL\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		if (!t->uldd_task)
+			pm8001_handle_event(pm8001_ha,
+				pm8001_dev,
+				IO_DS_NON_OPERATIONAL);
+		break;
+	case IO_DS_IN_RECOVERY:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_DS_IN_RECOVERY\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		break;
+	case IO_TM_TAG_NOT_FOUND:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_TM_TAG_NOT_FOUND\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		break;
+	case IO_SSP_EXT_IU_ZERO_LEN_ERROR:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_SSP_EXT_IU_ZERO_LEN_ERROR\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		break;
+	case IO_OPEN_CNX_ERROR_HW_RESOURCE_BUSY:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_OPEN_CNX_ERROR_HW_RESOURCE_BUSY\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		ts->open_rej_reason = SAS_OREJ_RSVD_RETRY;
+	default:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("Unknown status 0x%x\n", status));
+		/* not allowed case. Therefore, return failed status */
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		break;
+	}
+	PM8001_IO_DBG(pm8001_ha,
+		pm8001_printk("scsi_status = %x \n ",
+		psspPayload->ssp_resp_iu.status));
+	spin_lock_irqsave(&t->task_state_lock, flags);
+	t->task_state_flags &= ~SAS_TASK_STATE_PENDING;
+	t->task_state_flags &= ~SAS_TASK_AT_INITIATOR;
+	t->task_state_flags |= SAS_TASK_STATE_DONE;
+	if (unlikely((t->task_state_flags & SAS_TASK_STATE_ABORTED))) {
+		spin_unlock_irqrestore(&t->task_state_lock, flags);
+		PM8001_FAIL_DBG(pm8001_ha, pm8001_printk("task 0x%p done with"
+			" io_status 0x%x resp 0x%x "
+			"stat 0x%x but aborted by upper layer!\n",
+			t, status, ts->resp, ts->stat));
+		pm8001_ccb_task_free(pm8001_ha, t, ccb, tag);
+	} else {
+		spin_unlock_irqrestore(&t->task_state_lock, flags);
+		pm8001_ccb_task_free(pm8001_ha, t, ccb, tag);
+		mb();/* in order to force CPU ordering */
+		t->task_done(t);
+	}
+}
+
+/*See the comments for mpi_ssp_completion */
+static void mpi_ssp_event(struct pm8001_hba_info *pm8001_ha , void *piomb)
+{
+	struct sas_task *t;
+	unsigned long flags;
+	struct task_status_struct *ts;
+	struct pm8001_ccb_info *ccb;
+	struct pm8001_device *pm8001_dev;
+	struct ssp_event_resp *psspPayload =
+		(struct ssp_event_resp *)(piomb + 4);
+	u32 event = le32_to_cpu(psspPayload->event);
+	u32 tag = le32_to_cpu(psspPayload->tag);
+	u32 port_id = le32_to_cpu(psspPayload->port_id);
+	u32 dev_id = le32_to_cpu(psspPayload->device_id);
+
+	ccb = &pm8001_ha->ccb_info[tag];
+	t = ccb->task;
+	pm8001_dev = ccb->device;
+	if (event)
+		PM8001_FAIL_DBG(pm8001_ha,
+			pm8001_printk("sas IO status 0x%x\n", event));
+	if (unlikely(!t || !t->lldd_task || !t->dev))
+		return;
+	ts = &t->task_status;
+	PM8001_IO_DBG(pm8001_ha,
+		pm8001_printk("port_id = %x,device_id = %x\n",
+		port_id, dev_id));
+	switch (event) {
+	case IO_OVERFLOW:
+		PM8001_IO_DBG(pm8001_ha, pm8001_printk("IO_UNDERFLOW\n");)
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_DATA_OVERRUN;
+		ts->residual = 0;
+		if (pm8001_dev)
+			pm8001_dev->running_req--;
+		break;
+	case IO_XFER_ERROR_BREAK:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_XFER_ERROR_BREAK\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_INTERRUPTED;
+		break;
+	case IO_XFER_ERROR_PHY_NOT_READY:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_XFER_ERROR_PHY_NOT_READY\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		ts->open_rej_reason = SAS_OREJ_RSVD_RETRY;
+		break;
+	case IO_OPEN_CNX_ERROR_PROTOCOL_NOT_SUPPORTED:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_OPEN_CNX_ERROR_PROTOCOL_NOT"
+			"_SUPPORTED\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		ts->open_rej_reason = SAS_OREJ_EPROTO;
+		break;
+	case IO_OPEN_CNX_ERROR_ZONE_VIOLATION:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_OPEN_CNX_ERROR_ZONE_VIOLATION\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		ts->open_rej_reason = SAS_OREJ_UNKNOWN;
+		break;
+	case IO_OPEN_CNX_ERROR_BREAK:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_OPEN_CNX_ERROR_BREAK\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		ts->open_rej_reason = SAS_OREJ_RSVD_RETRY;
+		break;
+	case IO_OPEN_CNX_ERROR_IT_NEXUS_LOSS:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_OPEN_CNX_ERROR_IT_NEXUS_LOSS\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		ts->open_rej_reason = SAS_OREJ_UNKNOWN;
+		if (!t->uldd_task)
+			pm8001_handle_event(pm8001_ha,
+				pm8001_dev,
+				IO_OPEN_CNX_ERROR_IT_NEXUS_LOSS);
+		break;
+	case IO_OPEN_CNX_ERROR_BAD_DESTINATION:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_OPEN_CNX_ERROR_BAD_DESTINATION\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		ts->open_rej_reason = SAS_OREJ_BAD_DEST;
+		break;
+	case IO_OPEN_CNX_ERROR_CONNECTION_RATE_NOT_SUPPORTED:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_OPEN_CNX_ERROR_CONNECTION_RATE_"
+			"NOT_SUPPORTED\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		ts->open_rej_reason = SAS_OREJ_CONN_RATE;
+		break;
+	case IO_OPEN_CNX_ERROR_WRONG_DESTINATION:
+		PM8001_IO_DBG(pm8001_ha,
+		       pm8001_printk("IO_OPEN_CNX_ERROR_WRONG_DESTINATION\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		ts->open_rej_reason = SAS_OREJ_WRONG_DEST;
+		break;
+	case IO_XFER_ERROR_NAK_RECEIVED:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_XFER_ERROR_NAK_RECEIVED\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		ts->open_rej_reason = SAS_OREJ_RSVD_RETRY;
+		break;
+	case IO_XFER_ERROR_ACK_NAK_TIMEOUT:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_XFER_ERROR_ACK_NAK_TIMEOUT\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_NAK_R_ERR;
+		break;
+	case IO_XFER_OPEN_RETRY_TIMEOUT:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_XFER_OPEN_RETRY_TIMEOUT\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		ts->open_rej_reason = SAS_OREJ_RSVD_RETRY;
+		break;
+	case IO_XFER_ERROR_UNEXPECTED_PHASE:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_XFER_ERROR_UNEXPECTED_PHASE\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_DATA_OVERRUN;
+		break;
+	case IO_XFER_ERROR_XFER_RDY_OVERRUN:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_XFER_ERROR_XFER_RDY_OVERRUN\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_DATA_OVERRUN;
+		break;
+	case IO_XFER_ERROR_XFER_RDY_NOT_EXPECTED:
+		PM8001_IO_DBG(pm8001_ha,
+		       pm8001_printk("IO_XFER_ERROR_XFER_RDY_NOT_EXPECTED\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_DATA_OVERRUN;
+		break;
+	case IO_XFER_ERROR_CMD_ISSUE_ACK_NAK_TIMEOUT:
+		PM8001_IO_DBG(pm8001_ha,
+		pm8001_printk("IO_XFER_ERROR_CMD_ISSUE_ACK_NAK_TIMEOUT\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_DATA_OVERRUN;
+		break;
+	case IO_XFER_ERROR_OFFSET_MISMATCH:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_XFER_ERROR_OFFSET_MISMATCH\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_DATA_OVERRUN;
+		break;
+	case IO_XFER_ERROR_XFER_ZERO_DATA_LEN:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_XFER_ERROR_XFER_ZERO_DATA_LEN\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_DATA_OVERRUN;
+		break;
+	case IO_XFER_CMD_FRAME_ISSUED:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("  IO_XFER_CMD_FRAME_ISSUED\n"));
+		return;
+	default:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("Unknown status 0x%x\n", event));
+		/* not allowed case. Therefore, return failed status */
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_DATA_OVERRUN;
+		break;
+	}
+	spin_lock_irqsave(&t->task_state_lock, flags);
+	t->task_state_flags &= ~SAS_TASK_STATE_PENDING;
+	t->task_state_flags &= ~SAS_TASK_AT_INITIATOR;
+	t->task_state_flags |= SAS_TASK_STATE_DONE;
+	if (unlikely((t->task_state_flags & SAS_TASK_STATE_ABORTED))) {
+		spin_unlock_irqrestore(&t->task_state_lock, flags);
+		PM8001_FAIL_DBG(pm8001_ha, pm8001_printk("task 0x%p done with"
+			" event 0x%x resp 0x%x "
+			"stat 0x%x but aborted by upper layer!\n",
+			t, event, ts->resp, ts->stat));
+		pm8001_ccb_task_free(pm8001_ha, t, ccb, tag);
+	} else {
+		spin_unlock_irqrestore(&t->task_state_lock, flags);
+		pm8001_ccb_task_free(pm8001_ha, t, ccb, tag);
+		mb();/* in order to force CPU ordering */
+		t->task_done(t);
+	}
+}
+
+/*See the comments for mpi_ssp_completion */
+static void
+mpi_sata_completion(struct pm8001_hba_info *pm8001_ha, void *piomb)
+{
+	struct sas_task *t;
+	struct pm8001_ccb_info *ccb;
+	unsigned long flags = 0;
+	u32 param;
+	u32 status;
+	u32 tag;
+	struct sata_completion_resp *psataPayload;
+	struct task_status_struct *ts;
+	struct ata_task_resp *resp ;
+	u32 *sata_resp;
+	struct pm8001_device *pm8001_dev;
+
+	psataPayload = (struct sata_completion_resp *)(piomb + 4);
+	status = le32_to_cpu(psataPayload->status);
+	tag = le32_to_cpu(psataPayload->tag);
+
+	ccb = &pm8001_ha->ccb_info[tag];
+	param = le32_to_cpu(psataPayload->param);
+	t = ccb->task;
+	ts = &t->task_status;
+	pm8001_dev = ccb->device;
+	if (status)
+		PM8001_FAIL_DBG(pm8001_ha,
+			pm8001_printk("sata IO status 0x%x\n", status));
+	if (unlikely(!t || !t->lldd_task || !t->dev))
+		return;
+
+	switch (status) {
+	case IO_SUCCESS:
+		PM8001_IO_DBG(pm8001_ha, pm8001_printk("IO_SUCCESS\n"));
+		if (param == 0) {
+			ts->resp = SAS_TASK_COMPLETE;
+			ts->stat = SAM_GOOD;
+		} else {
+			u8 len;
+			ts->resp = SAS_TASK_COMPLETE;
+			ts->stat = SAS_PROTO_RESPONSE;
+			ts->residual = param;
+			PM8001_IO_DBG(pm8001_ha,
+				pm8001_printk("SAS_PROTO_RESPONSE len = %d\n",
+				param));
+			sata_resp = &psataPayload->sata_resp[0];
+			resp = (struct ata_task_resp *)ts->buf;
+			if (t->ata_task.dma_xfer == 0 &&
+			t->data_dir == PCI_DMA_FROMDEVICE) {
+				len = sizeof(struct pio_setup_fis);
+				PM8001_IO_DBG(pm8001_ha,
+				pm8001_printk("PIO read len = %d\n", len));
+			} else if (t->ata_task.use_ncq) {
+				len = sizeof(struct set_dev_bits_fis);
+				PM8001_IO_DBG(pm8001_ha,
+					pm8001_printk("FPDMA len = %d\n", len));
+			} else {
+				len = sizeof(struct dev_to_host_fis);
+				PM8001_IO_DBG(pm8001_ha,
+				pm8001_printk("other len = %d\n", len));
+			}
+			if (SAS_STATUS_BUF_SIZE >= sizeof(*resp)) {
+				resp->frame_len = len;
+				memcpy(&resp->ending_fis[0], sata_resp, len);
+				ts->buf_valid_size = sizeof(*resp);
+			} else
+				PM8001_IO_DBG(pm8001_ha,
+					pm8001_printk("response to large \n"));
+		}
+		if (pm8001_dev)
+			pm8001_dev->running_req--;
+		break;
+	case IO_ABORTED:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_ABORTED IOMB Tag \n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_ABORTED_TASK;
+		if (pm8001_dev)
+			pm8001_dev->running_req--;
+		break;
+		/* following cases are to do cases */
+	case IO_UNDERFLOW:
+		/* SATA Completion with error */
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_UNDERFLOW param = %d\n", param));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_DATA_UNDERRUN;
+		ts->residual =  param;
+		if (pm8001_dev)
+			pm8001_dev->running_req--;
+		break;
+	case IO_NO_DEVICE:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_NO_DEVICE\n"));
+		ts->resp = SAS_TASK_UNDELIVERED;
+		ts->stat = SAS_PHY_DOWN;
+		break;
+	case IO_XFER_ERROR_BREAK:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_XFER_ERROR_BREAK\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_INTERRUPTED;
+		break;
+	case IO_XFER_ERROR_PHY_NOT_READY:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_XFER_ERROR_PHY_NOT_READY\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		ts->open_rej_reason = SAS_OREJ_RSVD_RETRY;
+		break;
+	case IO_OPEN_CNX_ERROR_PROTOCOL_NOT_SUPPORTED:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_OPEN_CNX_ERROR_PROTOCOL_NOT"
+			"_SUPPORTED\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		ts->open_rej_reason = SAS_OREJ_EPROTO;
+		break;
+	case IO_OPEN_CNX_ERROR_ZONE_VIOLATION:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_OPEN_CNX_ERROR_ZONE_VIOLATION\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		ts->open_rej_reason = SAS_OREJ_UNKNOWN;
+		break;
+	case IO_OPEN_CNX_ERROR_BREAK:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_OPEN_CNX_ERROR_BREAK\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		ts->open_rej_reason = SAS_OREJ_RSVD_CONT0;
+		break;
+	case IO_OPEN_CNX_ERROR_IT_NEXUS_LOSS:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_OPEN_CNX_ERROR_IT_NEXUS_LOSS\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_DEV_NO_RESPONSE;
+		if (!t->uldd_task) {
+			pm8001_handle_event(pm8001_ha,
+				pm8001_dev,
+				IO_OPEN_CNX_ERROR_IT_NEXUS_LOSS);
+			ts->resp = SAS_TASK_UNDELIVERED;
+			ts->stat = SAS_QUEUE_FULL;
+			pm8001_ccb_task_free(pm8001_ha, t, ccb, tag);
+			mb();/*in order to force CPU ordering*/
+			spin_unlock_irqrestore(&pm8001_ha->lock, flags);
+			t->task_done(t);
+			spin_lock_irqsave(&pm8001_ha->lock, flags);
+			return;
+		}
+		break;
+	case IO_OPEN_CNX_ERROR_BAD_DESTINATION:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_OPEN_CNX_ERROR_BAD_DESTINATION\n"));
+		ts->resp = SAS_TASK_UNDELIVERED;
+		ts->stat = SAS_OPEN_REJECT;
+		ts->open_rej_reason = SAS_OREJ_BAD_DEST;
+		if (!t->uldd_task) {
+			pm8001_handle_event(pm8001_ha,
+				pm8001_dev,
+				IO_OPEN_CNX_ERROR_IT_NEXUS_LOSS);
+			ts->resp = SAS_TASK_UNDELIVERED;
+			ts->stat = SAS_QUEUE_FULL;
+			pm8001_ccb_task_free(pm8001_ha, t, ccb, tag);
+			mb();/*ditto*/
+			spin_unlock_irqrestore(&pm8001_ha->lock, flags);
+			t->task_done(t);
+			spin_lock_irqsave(&pm8001_ha->lock, flags);
+			return;
+		}
+		break;
+	case IO_OPEN_CNX_ERROR_CONNECTION_RATE_NOT_SUPPORTED:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_OPEN_CNX_ERROR_CONNECTION_RATE_"
+			"NOT_SUPPORTED\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		ts->open_rej_reason = SAS_OREJ_CONN_RATE;
+		break;
+	case IO_OPEN_CNX_ERROR_STP_RESOURCES_BUSY:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_OPEN_CNX_ERROR_STP_RESOURCES"
+			"_BUSY\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_DEV_NO_RESPONSE;
+		if (!t->uldd_task) {
+			pm8001_handle_event(pm8001_ha,
+				pm8001_dev,
+				IO_OPEN_CNX_ERROR_STP_RESOURCES_BUSY);
+			ts->resp = SAS_TASK_UNDELIVERED;
+			ts->stat = SAS_QUEUE_FULL;
+			pm8001_ccb_task_free(pm8001_ha, t, ccb, tag);
+			mb();/* ditto*/
+			spin_unlock_irqrestore(&pm8001_ha->lock, flags);
+			t->task_done(t);
+			spin_lock_irqsave(&pm8001_ha->lock, flags);
+			return;
+		}
+		break;
+	case IO_OPEN_CNX_ERROR_WRONG_DESTINATION:
+		PM8001_IO_DBG(pm8001_ha,
+		       pm8001_printk("IO_OPEN_CNX_ERROR_WRONG_DESTINATION\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		ts->open_rej_reason = SAS_OREJ_WRONG_DEST;
+		break;
+	case IO_XFER_ERROR_NAK_RECEIVED:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_XFER_ERROR_NAK_RECEIVED\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_NAK_R_ERR;
+		break;
+	case IO_XFER_ERROR_ACK_NAK_TIMEOUT:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_XFER_ERROR_ACK_NAK_TIMEOUT\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_NAK_R_ERR;
+		break;
+	case IO_XFER_ERROR_DMA:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_XFER_ERROR_DMA\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_ABORTED_TASK;
+		break;
+	case IO_XFER_ERROR_SATA_LINK_TIMEOUT:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_XFER_ERROR_SATA_LINK_TIMEOUT\n"));
+		ts->resp = SAS_TASK_UNDELIVERED;
+		ts->stat = SAS_DEV_NO_RESPONSE;
+		break;
+	case IO_XFER_ERROR_REJECTED_NCQ_MODE:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_XFER_ERROR_REJECTED_NCQ_MODE\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_DATA_UNDERRUN;
+		break;
+	case IO_XFER_OPEN_RETRY_TIMEOUT:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_XFER_OPEN_RETRY_TIMEOUT\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_TO;
+		break;
+	case IO_PORT_IN_RESET:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_PORT_IN_RESET\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_DEV_NO_RESPONSE;
+		break;
+	case IO_DS_NON_OPERATIONAL:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_DS_NON_OPERATIONAL\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_DEV_NO_RESPONSE;
+		if (!t->uldd_task) {
+			pm8001_handle_event(pm8001_ha, pm8001_dev,
+				    IO_DS_NON_OPERATIONAL);
+			ts->resp = SAS_TASK_UNDELIVERED;
+			ts->stat = SAS_QUEUE_FULL;
+			pm8001_ccb_task_free(pm8001_ha, t, ccb, tag);
+			mb();/*ditto*/
+			spin_unlock_irqrestore(&pm8001_ha->lock, flags);
+			t->task_done(t);
+			spin_lock_irqsave(&pm8001_ha->lock, flags);
+			return;
+		}
+		break;
+	case IO_DS_IN_RECOVERY:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("  IO_DS_IN_RECOVERY\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_DEV_NO_RESPONSE;
+		break;
+	case IO_DS_IN_ERROR:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_DS_IN_ERROR\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_DEV_NO_RESPONSE;
+		if (!t->uldd_task) {
+			pm8001_handle_event(pm8001_ha, pm8001_dev,
+				    IO_DS_IN_ERROR);
+			ts->resp = SAS_TASK_UNDELIVERED;
+			ts->stat = SAS_QUEUE_FULL;
+			pm8001_ccb_task_free(pm8001_ha, t, ccb, tag);
+			mb();/*ditto*/
+			spin_unlock_irqrestore(&pm8001_ha->lock, flags);
+			t->task_done(t);
+			spin_lock_irqsave(&pm8001_ha->lock, flags);
+			return;
+		}
+		break;
+	case IO_OPEN_CNX_ERROR_HW_RESOURCE_BUSY:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_OPEN_CNX_ERROR_HW_RESOURCE_BUSY\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		ts->open_rej_reason = SAS_OREJ_RSVD_RETRY;
+	default:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("Unknown status 0x%x\n", status));
+		/* not allowed case. Therefore, return failed status */
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_DEV_NO_RESPONSE;
+		break;
+	}
+	spin_lock_irqsave(&t->task_state_lock, flags);
+	t->task_state_flags &= ~SAS_TASK_STATE_PENDING;
+	t->task_state_flags &= ~SAS_TASK_AT_INITIATOR;
+	t->task_state_flags |= SAS_TASK_STATE_DONE;
+	if (unlikely((t->task_state_flags & SAS_TASK_STATE_ABORTED))) {
+		spin_unlock_irqrestore(&t->task_state_lock, flags);
+		PM8001_FAIL_DBG(pm8001_ha,
+			pm8001_printk("task 0x%p done with io_status 0x%x"
+			" resp 0x%x stat 0x%x but aborted by upper layer!\n",
+			t, status, ts->resp, ts->stat));
+		pm8001_ccb_task_free(pm8001_ha, t, ccb, tag);
+	} else if (t->uldd_task) {
+		spin_unlock_irqrestore(&t->task_state_lock, flags);
+		pm8001_ccb_task_free(pm8001_ha, t, ccb, tag);
+		mb();/* ditto */
+		spin_unlock_irqrestore(&pm8001_ha->lock, flags);
+		t->task_done(t);
+		spin_lock_irqsave(&pm8001_ha->lock, flags);
+	} else if (!t->uldd_task) {
+		spin_unlock_irqrestore(&t->task_state_lock, flags);
+		pm8001_ccb_task_free(pm8001_ha, t, ccb, tag);
+		mb();/*ditto*/
+		spin_unlock_irqrestore(&pm8001_ha->lock, flags);
+		t->task_done(t);
+		spin_lock_irqsave(&pm8001_ha->lock, flags);
+	}
+}
+
+/*See the comments for mpi_ssp_completion */
+static void mpi_sata_event(struct pm8001_hba_info *pm8001_ha , void *piomb)
+{
+	struct sas_task *t;
+	unsigned long flags = 0;
+	struct task_status_struct *ts;
+	struct pm8001_ccb_info *ccb;
+	struct pm8001_device *pm8001_dev;
+	struct sata_event_resp *psataPayload =
+		(struct sata_event_resp *)(piomb + 4);
+	u32 event = le32_to_cpu(psataPayload->event);
+	u32 tag = le32_to_cpu(psataPayload->tag);
+	u32 port_id = le32_to_cpu(psataPayload->port_id);
+	u32 dev_id = le32_to_cpu(psataPayload->device_id);
+
+	ccb = &pm8001_ha->ccb_info[tag];
+	t = ccb->task;
+	pm8001_dev = ccb->device;
+	if (event)
+		PM8001_FAIL_DBG(pm8001_ha,
+			pm8001_printk("sata IO status 0x%x\n", event));
+	if (unlikely(!t || !t->lldd_task || !t->dev))
+		return;
+	ts = &t->task_status;
+	PM8001_IO_DBG(pm8001_ha,
+		pm8001_printk("port_id = %x,device_id = %x\n",
+		port_id, dev_id));
+	switch (event) {
+	case IO_OVERFLOW:
+		PM8001_IO_DBG(pm8001_ha, pm8001_printk("IO_UNDERFLOW\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_DATA_OVERRUN;
+		ts->residual = 0;
+		if (pm8001_dev)
+			pm8001_dev->running_req--;
+		break;
+	case IO_XFER_ERROR_BREAK:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_XFER_ERROR_BREAK\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_INTERRUPTED;
+		break;
+	case IO_XFER_ERROR_PHY_NOT_READY:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_XFER_ERROR_PHY_NOT_READY\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		ts->open_rej_reason = SAS_OREJ_RSVD_RETRY;
+		break;
+	case IO_OPEN_CNX_ERROR_PROTOCOL_NOT_SUPPORTED:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_OPEN_CNX_ERROR_PROTOCOL_NOT"
+			"_SUPPORTED\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		ts->open_rej_reason = SAS_OREJ_EPROTO;
+		break;
+	case IO_OPEN_CNX_ERROR_ZONE_VIOLATION:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_OPEN_CNX_ERROR_ZONE_VIOLATION\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		ts->open_rej_reason = SAS_OREJ_UNKNOWN;
+		break;
+	case IO_OPEN_CNX_ERROR_BREAK:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_OPEN_CNX_ERROR_BREAK\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		ts->open_rej_reason = SAS_OREJ_RSVD_CONT0;
+		break;
+	case IO_OPEN_CNX_ERROR_IT_NEXUS_LOSS:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_OPEN_CNX_ERROR_IT_NEXUS_LOSS\n"));
+		ts->resp = SAS_TASK_UNDELIVERED;
+		ts->stat = SAS_DEV_NO_RESPONSE;
+		if (!t->uldd_task) {
+			pm8001_handle_event(pm8001_ha,
+				pm8001_dev,
+				IO_OPEN_CNX_ERROR_IT_NEXUS_LOSS);
+			ts->resp = SAS_TASK_COMPLETE;
+			ts->stat = SAS_QUEUE_FULL;
+			pm8001_ccb_task_free(pm8001_ha, t, ccb, tag);
+			mb();/*ditto*/
+			spin_unlock_irqrestore(&pm8001_ha->lock, flags);
+			t->task_done(t);
+			spin_lock_irqsave(&pm8001_ha->lock, flags);
+			return;
+		}
+		break;
+	case IO_OPEN_CNX_ERROR_BAD_DESTINATION:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_OPEN_CNX_ERROR_BAD_DESTINATION\n"));
+		ts->resp = SAS_TASK_UNDELIVERED;
+		ts->stat = SAS_OPEN_REJECT;
+		ts->open_rej_reason = SAS_OREJ_BAD_DEST;
+		break;
+	case IO_OPEN_CNX_ERROR_CONNECTION_RATE_NOT_SUPPORTED:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_OPEN_CNX_ERROR_CONNECTION_RATE_"
+			"NOT_SUPPORTED\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		ts->open_rej_reason = SAS_OREJ_CONN_RATE;
+		break;
+	case IO_OPEN_CNX_ERROR_WRONG_DESTINATION:
+		PM8001_IO_DBG(pm8001_ha,
+		       pm8001_printk("IO_OPEN_CNX_ERROR_WRONG_DESTINATION\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		ts->open_rej_reason = SAS_OREJ_WRONG_DEST;
+		break;
+	case IO_XFER_ERROR_NAK_RECEIVED:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_XFER_ERROR_NAK_RECEIVED\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_NAK_R_ERR;
+		break;
+	case IO_XFER_ERROR_PEER_ABORTED:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_XFER_ERROR_PEER_ABORTED\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_NAK_R_ERR;
+		break;
+	case IO_XFER_ERROR_REJECTED_NCQ_MODE:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_XFER_ERROR_REJECTED_NCQ_MODE\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_DATA_UNDERRUN;
+		break;
+	case IO_XFER_OPEN_RETRY_TIMEOUT:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_XFER_OPEN_RETRY_TIMEOUT\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_TO;
+		break;
+	case IO_XFER_ERROR_UNEXPECTED_PHASE:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_XFER_ERROR_UNEXPECTED_PHASE\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_TO;
+		break;
+	case IO_XFER_ERROR_XFER_RDY_OVERRUN:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_XFER_ERROR_XFER_RDY_OVERRUN\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_TO;
+		break;
+	case IO_XFER_ERROR_XFER_RDY_NOT_EXPECTED:
+		PM8001_IO_DBG(pm8001_ha,
+		       pm8001_printk("IO_XFER_ERROR_XFER_RDY_NOT_EXPECTED\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_TO;
+		break;
+	case IO_XFER_ERROR_OFFSET_MISMATCH:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_XFER_ERROR_OFFSET_MISMATCH\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_TO;
+		break;
+	case IO_XFER_ERROR_XFER_ZERO_DATA_LEN:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_XFER_ERROR_XFER_ZERO_DATA_LEN\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_TO;
+		break;
+	case IO_XFER_CMD_FRAME_ISSUED:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_XFER_CMD_FRAME_ISSUED\n"));
+		break;
+	case IO_XFER_PIO_SETUP_ERROR:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_XFER_PIO_SETUP_ERROR\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_TO;
+		break;
+	default:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("Unknown status 0x%x\n", event));
+		/* not allowed case. Therefore, return failed status */
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_TO;
+		break;
+	}
+	spin_lock_irqsave(&t->task_state_lock, flags);
+	t->task_state_flags &= ~SAS_TASK_STATE_PENDING;
+	t->task_state_flags &= ~SAS_TASK_AT_INITIATOR;
+	t->task_state_flags |= SAS_TASK_STATE_DONE;
+	if (unlikely((t->task_state_flags & SAS_TASK_STATE_ABORTED))) {
+		spin_unlock_irqrestore(&t->task_state_lock, flags);
+		PM8001_FAIL_DBG(pm8001_ha,
+			pm8001_printk("task 0x%p done with io_status 0x%x"
+			" resp 0x%x stat 0x%x but aborted by upper layer!\n",
+			t, event, ts->resp, ts->stat));
+		pm8001_ccb_task_free(pm8001_ha, t, ccb, tag);
+	} else if (t->uldd_task) {
+		spin_unlock_irqrestore(&t->task_state_lock, flags);
+		pm8001_ccb_task_free(pm8001_ha, t, ccb, tag);
+		mb();/* ditto */
+		spin_unlock_irqrestore(&pm8001_ha->lock, flags);
+		t->task_done(t);
+		spin_lock_irqsave(&pm8001_ha->lock, flags);
+	} else if (!t->uldd_task) {
+		spin_unlock_irqrestore(&t->task_state_lock, flags);
+		pm8001_ccb_task_free(pm8001_ha, t, ccb, tag);
+		mb();/*ditto*/
+		spin_unlock_irqrestore(&pm8001_ha->lock, flags);
+		t->task_done(t);
+		spin_lock_irqsave(&pm8001_ha->lock, flags);
+	}
+}
+
+/*See the comments for mpi_ssp_completion */
+static void
+mpi_smp_completion(struct pm8001_hba_info *pm8001_ha, void *piomb)
+{
+	u32 param;
+	struct sas_task *t;
+	struct pm8001_ccb_info *ccb;
+	unsigned long flags;
+	u32 status;
+	u32 tag;
+	struct smp_completion_resp *psmpPayload;
+	struct task_status_struct *ts;
+	struct pm8001_device *pm8001_dev;
+
+	psmpPayload = (struct smp_completion_resp *)(piomb + 4);
+	status = le32_to_cpu(psmpPayload->status);
+	tag = le32_to_cpu(psmpPayload->tag);
+
+	ccb = &pm8001_ha->ccb_info[tag];
+	param = le32_to_cpu(psmpPayload->param);
+	t = ccb->task;
+	ts = &t->task_status;
+	pm8001_dev = ccb->device;
+	if (status)
+		PM8001_FAIL_DBG(pm8001_ha,
+			pm8001_printk("smp IO status 0x%x\n", status));
+	if (unlikely(!t || !t->lldd_task || !t->dev))
+		return;
+
+	switch (status) {
+	case IO_SUCCESS:
+		PM8001_IO_DBG(pm8001_ha, pm8001_printk("IO_SUCCESS\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAM_GOOD;
+	if (pm8001_dev)
+			pm8001_dev->running_req--;
+		break;
+	case IO_ABORTED:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_ABORTED IOMB\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_ABORTED_TASK;
+		if (pm8001_dev)
+			pm8001_dev->running_req--;
+		break;
+	case IO_OVERFLOW:
+		PM8001_IO_DBG(pm8001_ha, pm8001_printk("IO_UNDERFLOW\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_DATA_OVERRUN;
+		ts->residual = 0;
+		if (pm8001_dev)
+			pm8001_dev->running_req--;
+		break;
+	case IO_NO_DEVICE:
+		PM8001_IO_DBG(pm8001_ha, pm8001_printk("IO_NO_DEVICE\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_PHY_DOWN;
+		break;
+	case IO_ERROR_HW_TIMEOUT:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_ERROR_HW_TIMEOUT\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAM_BUSY;
+		break;
+	case IO_XFER_ERROR_BREAK:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_XFER_ERROR_BREAK\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAM_BUSY;
+		break;
+	case IO_XFER_ERROR_PHY_NOT_READY:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_XFER_ERROR_PHY_NOT_READY\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAM_BUSY;
+		break;
+	case IO_OPEN_CNX_ERROR_PROTOCOL_NOT_SUPPORTED:
+		PM8001_IO_DBG(pm8001_ha,
+		pm8001_printk("IO_OPEN_CNX_ERROR_PROTOCOL_NOT_SUPPORTED\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		ts->open_rej_reason = SAS_OREJ_UNKNOWN;
+		break;
+	case IO_OPEN_CNX_ERROR_ZONE_VIOLATION:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_OPEN_CNX_ERROR_ZONE_VIOLATION\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		ts->open_rej_reason = SAS_OREJ_UNKNOWN;
+		break;
+	case IO_OPEN_CNX_ERROR_BREAK:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_OPEN_CNX_ERROR_BREAK\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		ts->open_rej_reason = SAS_OREJ_RSVD_CONT0;
+		break;
+	case IO_OPEN_CNX_ERROR_IT_NEXUS_LOSS:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_OPEN_CNX_ERROR_IT_NEXUS_LOSS\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		ts->open_rej_reason = SAS_OREJ_UNKNOWN;
+		pm8001_handle_event(pm8001_ha,
+				pm8001_dev,
+				IO_OPEN_CNX_ERROR_IT_NEXUS_LOSS);
+		break;
+	case IO_OPEN_CNX_ERROR_BAD_DESTINATION:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_OPEN_CNX_ERROR_BAD_DESTINATION\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		ts->open_rej_reason = SAS_OREJ_BAD_DEST;
+		break;
+	case IO_OPEN_CNX_ERROR_CONNECTION_RATE_NOT_SUPPORTED:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_OPEN_CNX_ERROR_CONNECTION_RATE_"
+			"NOT_SUPPORTED\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		ts->open_rej_reason = SAS_OREJ_CONN_RATE;
+		break;
+	case IO_OPEN_CNX_ERROR_WRONG_DESTINATION:
+		PM8001_IO_DBG(pm8001_ha,
+		       pm8001_printk("IO_OPEN_CNX_ERROR_WRONG_DESTINATION\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		ts->open_rej_reason = SAS_OREJ_WRONG_DEST;
+		break;
+	case IO_XFER_ERROR_RX_FRAME:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_XFER_ERROR_RX_FRAME\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_DEV_NO_RESPONSE;
+		break;
+	case IO_XFER_OPEN_RETRY_TIMEOUT:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_XFER_OPEN_RETRY_TIMEOUT\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		ts->open_rej_reason = SAS_OREJ_RSVD_RETRY;
+		break;
+	case IO_ERROR_INTERNAL_SMP_RESOURCE:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_ERROR_INTERNAL_SMP_RESOURCE\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_QUEUE_FULL;
+		break;
+	case IO_PORT_IN_RESET:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_PORT_IN_RESET\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		ts->open_rej_reason = SAS_OREJ_RSVD_RETRY;
+		break;
+	case IO_DS_NON_OPERATIONAL:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_DS_NON_OPERATIONAL\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_DEV_NO_RESPONSE;
+		break;
+	case IO_DS_IN_RECOVERY:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_DS_IN_RECOVERY\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		ts->open_rej_reason = SAS_OREJ_RSVD_RETRY;
+		break;
+	case IO_OPEN_CNX_ERROR_HW_RESOURCE_BUSY:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("IO_OPEN_CNX_ERROR_HW_RESOURCE_BUSY\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_OPEN_REJECT;
+		ts->open_rej_reason = SAS_OREJ_RSVD_RETRY;
+		break;
+	default:
+		PM8001_IO_DBG(pm8001_ha,
+			pm8001_printk("Unknown status 0x%x\n", status));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAS_DEV_NO_RESPONSE;
+		/* not allowed case. Therefore, return failed status */
+		break;
+	}
+	spin_lock_irqsave(&t->task_state_lock, flags);
+	t->task_state_flags &= ~SAS_TASK_STATE_PENDING;
+	t->task_state_flags &= ~SAS_TASK_AT_INITIATOR;
+	t->task_state_flags |= SAS_TASK_STATE_DONE;
+	if (unlikely((t->task_state_flags & SAS_TASK_STATE_ABORTED))) {
+		spin_unlock_irqrestore(&t->task_state_lock, flags);
+		PM8001_FAIL_DBG(pm8001_ha, pm8001_printk("task 0x%p done with"
+			" io_status 0x%x resp 0x%x "
+			"stat 0x%x but aborted by upper layer!\n",
+			t, status, ts->resp, ts->stat));
+		pm8001_ccb_task_free(pm8001_ha, t, ccb, tag);
+	} else {
+		spin_unlock_irqrestore(&t->task_state_lock, flags);
+		pm8001_ccb_task_free(pm8001_ha, t, ccb, tag);
+		mb();/* in order to force CPU ordering */
+		t->task_done(t);
+	}
+}
+
+static void
+mpi_set_dev_state_resp(struct pm8001_hba_info *pm8001_ha, void *piomb)
+{
+	struct set_dev_state_resp *pPayload =
+		(struct set_dev_state_resp *)(piomb + 4);
+	u32 tag = le32_to_cpu(pPayload->tag);
+	struct pm8001_ccb_info *ccb = &pm8001_ha->ccb_info[tag];
+	struct pm8001_device *pm8001_dev = ccb->device;
+	u32 status = le32_to_cpu(pPayload->status);
+	u32 device_id = le32_to_cpu(pPayload->device_id);
+	u8 pds = le32_to_cpu(pPayload->pds_nds) | PDS_BITS;
+	u8 nds = le32_to_cpu(pPayload->pds_nds) | NDS_BITS;
+	PM8001_MSG_DBG(pm8001_ha, pm8001_printk("Set device id = 0x%x state "
+		"from 0x%x to 0x%x status = 0x%x!\n",
+		device_id, pds, nds, status));
+	complete(pm8001_dev->setds_completion);
+	ccb->task = NULL;
+	ccb->ccb_tag = 0xFFFFFFFF;
+	pm8001_ccb_free(pm8001_ha, tag);
+}
+
+static void
+mpi_set_nvmd_resp(struct pm8001_hba_info *pm8001_ha, void *piomb)
+{
+	struct get_nvm_data_resp *pPayload =
+		(struct get_nvm_data_resp *)(piomb + 4);
+	u32 tag = le32_to_cpu(pPayload->tag);
+	struct pm8001_ccb_info *ccb = &pm8001_ha->ccb_info[tag];
+	u32 dlen_status = le32_to_cpu(pPayload->dlen_status);
+	complete(pm8001_ha->nvmd_completion);
+	PM8001_MSG_DBG(pm8001_ha, pm8001_printk("Set nvm data complete!\n"));
+	if ((dlen_status & NVMD_STAT) != 0) {
+		PM8001_FAIL_DBG(pm8001_ha,
+			pm8001_printk("Set nvm data error!\n"));
+		return;
+	}
+	ccb->task = NULL;
+	ccb->ccb_tag = 0xFFFFFFFF;
+	pm8001_ccb_free(pm8001_ha, tag);
+}
+
+static void
+mpi_get_nvmd_resp(struct pm8001_hba_info *pm8001_ha, void *piomb)
+{
+	struct fw_control_ex	*fw_control_context;
+	struct get_nvm_data_resp *pPayload =
+		(struct get_nvm_data_resp *)(piomb + 4);
+	u32 tag = le32_to_cpu(pPayload->tag);
+	struct pm8001_ccb_info *ccb = &pm8001_ha->ccb_info[tag];
+	u32 dlen_status = le32_to_cpu(pPayload->dlen_status);
+	u32 ir_tds_bn_dps_das_nvm =
+		le32_to_cpu(pPayload->ir_tda_bn_dps_das_nvm);
+	void *virt_addr = pm8001_ha->memoryMap.region[NVMD].virt_ptr;
+	fw_control_context = ccb->fw_control_context;
+
+	PM8001_MSG_DBG(pm8001_ha, pm8001_printk("Get nvm data complete!\n"));
+	if ((dlen_status & NVMD_STAT) != 0) {
+		PM8001_FAIL_DBG(pm8001_ha,
+			pm8001_printk("Get nvm data error!\n"));
+		complete(pm8001_ha->nvmd_completion);
+		return;
+	}
+
+	if (ir_tds_bn_dps_das_nvm & IPMode) {
+		/* indirect mode - IR bit set */
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("Get NVMD success, IR=1\n"));
+		if ((ir_tds_bn_dps_das_nvm & NVMD_TYPE) == TWI_DEVICE) {
+			if (ir_tds_bn_dps_das_nvm == 0x80a80200) {
+				memcpy(pm8001_ha->sas_addr,
+				      ((u8 *)virt_addr + 4),
+				       SAS_ADDR_SIZE);
+				PM8001_MSG_DBG(pm8001_ha,
+					pm8001_printk("Get SAS address"
+					" from VPD successfully!\n"));
+			}
+		} else if (((ir_tds_bn_dps_das_nvm & NVMD_TYPE) == C_SEEPROM)
+			|| ((ir_tds_bn_dps_das_nvm & NVMD_TYPE) == VPD_FLASH) ||
+			((ir_tds_bn_dps_das_nvm & NVMD_TYPE) == EXPAN_ROM)) {
+				;
+		} else if (((ir_tds_bn_dps_das_nvm & NVMD_TYPE) == AAP1_RDUMP)
+			|| ((ir_tds_bn_dps_das_nvm & NVMD_TYPE) == IOP_RDUMP)) {
+			;
+		} else {
+			/* Should not be happened*/
+			PM8001_MSG_DBG(pm8001_ha,
+				pm8001_printk("(IR=1)Wrong Device type 0x%x\n",
+				ir_tds_bn_dps_das_nvm));
+		}
+	} else /* direct mode */{
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("Get NVMD success, IR=0, dataLen=%d\n",
+			(dlen_status & NVMD_LEN) >> 24));
+	}
+	memcpy(fw_control_context->usrAddr,
+		pm8001_ha->memoryMap.region[NVMD].virt_ptr,
+		fw_control_context->len);
+	complete(pm8001_ha->nvmd_completion);
+	ccb->task = NULL;
+	ccb->ccb_tag = 0xFFFFFFFF;
+	pm8001_ccb_free(pm8001_ha, tag);
+}
+
+static int mpi_local_phy_ctl(struct pm8001_hba_info *pm8001_ha, void *piomb)
+{
+	struct local_phy_ctl_resp *pPayload =
+		(struct local_phy_ctl_resp *)(piomb + 4);
+	u32 status = le32_to_cpu(pPayload->status);
+	u32 phy_id = le32_to_cpu(pPayload->phyop_phyid) & ID_BITS;
+	u32 phy_op = le32_to_cpu(pPayload->phyop_phyid) & OP_BITS;
+	if (status != 0) {
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("%x phy execute %x phy op failed! \n",
+			phy_id, phy_op));
+	} else
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("%x phy execute %x phy op success! \n",
+			phy_id, phy_op));
+	return 0;
+}
+
+/**
+ * pm8001_bytes_dmaed - one of the interface function communication with libsas
+ * @pm8001_ha: our hba card information
+ * @i: which phy that received the event.
+ *
+ * when HBA driver received the identify done event or initiate FIS received
+ * event(for SATA), it will invoke this function to notify the sas layer that
+ * the sas toplogy has formed, please discover the the whole sas domain,
+ * while receive a broadcast(change) primitive just tell the sas
+ * layer to discover the changed domain rather than the whole domain.
+ */
+static void pm8001_bytes_dmaed(struct pm8001_hba_info *pm8001_ha, int i)
+{
+	struct pm8001_phy *phy = &pm8001_ha->phy[i];
+	struct asd_sas_phy *sas_phy = &phy->sas_phy;
+	struct sas_ha_struct *sas_ha;
+	if (!phy->phy_attached)
+		return;
+
+	sas_ha = pm8001_ha->sas;
+	if (sas_phy->phy) {
+		struct sas_phy *sphy = sas_phy->phy;
+		sphy->negotiated_linkrate = sas_phy->linkrate;
+		sphy->minimum_linkrate = phy->minimum_linkrate;
+		sphy->minimum_linkrate_hw = SAS_LINK_RATE_1_5_GBPS;
+		sphy->maximum_linkrate = phy->maximum_linkrate;
+		sphy->maximum_linkrate_hw = phy->maximum_linkrate;
+	}
+
+	if (phy->phy_type & PORT_TYPE_SAS) {
+		struct sas_identify_frame *id;
+		id = (struct sas_identify_frame *)phy->frame_rcvd;
+		id->dev_type = phy->identify.device_type;
+		id->initiator_bits = SAS_PROTOCOL_ALL;
+		id->target_bits = phy->identify.target_port_protocols;
+	} else if (phy->phy_type & PORT_TYPE_SATA) {
+		/*Nothing*/
+	}
+	PM8001_MSG_DBG(pm8001_ha, pm8001_printk("phy %d byte dmaded.\n", i));
+
+	sas_phy->frame_rcvd_size = phy->frame_rcvd_size;
+	pm8001_ha->sas->notify_port_event(sas_phy, PORTE_BYTES_DMAED);
+}
+
+/* Get the link rate speed  */
+static void get_lrate_mode(struct pm8001_phy *phy, u8 link_rate)
+{
+	struct sas_phy *sas_phy = phy->sas_phy.phy;
+
+	switch (link_rate) {
+	case PHY_SPEED_60:
+		phy->sas_phy.linkrate = SAS_LINK_RATE_6_0_GBPS;
+		phy->sas_phy.phy->negotiated_linkrate = SAS_LINK_RATE_6_0_GBPS;
+		break;
+	case PHY_SPEED_30:
+		phy->sas_phy.linkrate = SAS_LINK_RATE_3_0_GBPS;
+		phy->sas_phy.phy->negotiated_linkrate = SAS_LINK_RATE_3_0_GBPS;
+		break;
+	case PHY_SPEED_15:
+		phy->sas_phy.linkrate = SAS_LINK_RATE_1_5_GBPS;
+		phy->sas_phy.phy->negotiated_linkrate = SAS_LINK_RATE_1_5_GBPS;
+		break;
+	}
+	sas_phy->negotiated_linkrate = phy->sas_phy.linkrate;
+	sas_phy->maximum_linkrate_hw = SAS_LINK_RATE_6_0_GBPS;
+	sas_phy->minimum_linkrate_hw = SAS_LINK_RATE_1_5_GBPS;
+	sas_phy->maximum_linkrate = SAS_LINK_RATE_6_0_GBPS;
+	sas_phy->minimum_linkrate = SAS_LINK_RATE_1_5_GBPS;
+}
+
+/**
+ * asd_get_attached_sas_addr -- extract/generate attached SAS address
+ * @phy: pointer to asd_phy
+ * @sas_addr: pointer to buffer where the SAS address is to be written
+ *
+ * This function extracts the SAS address from an IDENTIFY frame
+ * received.  If OOB is SATA, then a SAS address is generated from the
+ * HA tables.
+ *
+ * LOCKING: the frame_rcvd_lock needs to be held since this parses the frame
+ * buffer.
+ */
+static void pm8001_get_attached_sas_addr(struct pm8001_phy *phy,
+	u8 *sas_addr)
+{
+	if (phy->sas_phy.frame_rcvd[0] == 0x34
+		&& phy->sas_phy.oob_mode == SATA_OOB_MODE) {
+		struct pm8001_hba_info *pm8001_ha = phy->sas_phy.ha->lldd_ha;
+		/* FIS device-to-host */
+		u64 addr = be64_to_cpu(*(__be64 *)pm8001_ha->sas_addr);
+		addr += phy->sas_phy.id;
+		*(__be64 *)sas_addr = cpu_to_be64(addr);
+	} else {
+		struct sas_identify_frame *idframe =
+			(void *) phy->sas_phy.frame_rcvd;
+		memcpy(sas_addr, idframe->sas_addr, SAS_ADDR_SIZE);
+	}
+}
+
+/**
+ * pm8001_hw_event_ack_req- For PM8001,some events need to acknowage to FW.
+ * @pm8001_ha: our hba card information
+ * @Qnum: the outbound queue message number.
+ * @SEA: source of event to ack
+ * @port_id: port id.
+ * @phyId: phy id.
+ * @param0: parameter 0.
+ * @param1: parameter 1.
+ */
+static void pm8001_hw_event_ack_req(struct pm8001_hba_info *pm8001_ha,
+	u32 Qnum, u32 SEA, u32 port_id, u32 phyId, u32 param0, u32 param1)
+{
+	struct hw_event_ack_req	 payload;
+	u32 opc = OPC_INB_SAS_HW_EVENT_ACK;
+
+	struct inbound_queue_table *circularQ;
+
+	memset((u8 *)&payload, 0, sizeof(payload));
+	circularQ = &pm8001_ha->inbnd_q_tbl[Qnum];
+	payload.tag = 1;
+	payload.sea_phyid_portid = cpu_to_le32(((SEA & 0xFFFF) << 8) |
+		((phyId & 0x0F) << 4) | (port_id & 0x0F));
+	payload.param0 = cpu_to_le32(param0);
+	payload.param1 = cpu_to_le32(param1);
+	mpi_build_cmd(pm8001_ha, circularQ, opc, &payload);
+}
+
+static int pm8001_chip_phy_ctl_req(struct pm8001_hba_info *pm8001_ha,
+	u32 phyId, u32 phy_op);
+
+/**
+ * hw_event_sas_phy_up -FW tells me a SAS phy up event.
+ * @pm8001_ha: our hba card information
+ * @piomb: IO message buffer
+ */
+static void
+hw_event_sas_phy_up(struct pm8001_hba_info *pm8001_ha, void *piomb)
+{
+	struct hw_event_resp *pPayload =
+		(struct hw_event_resp *)(piomb + 4);
+	u32 lr_evt_status_phyid_portid =
+		le32_to_cpu(pPayload->lr_evt_status_phyid_portid);
+	u8 link_rate =
+		(u8)((lr_evt_status_phyid_portid & 0xF0000000) >> 28);
+	u8 port_id = (u8)(lr_evt_status_phyid_portid & 0x0000000F);
+	u8 phy_id =
+		(u8)((lr_evt_status_phyid_portid & 0x000000F0) >> 4);
+	u32 npip_portstate = le32_to_cpu(pPayload->npip_portstate);
+	u8 portstate = (u8)(npip_portstate & 0x0000000F);
+	struct pm8001_port *port = &pm8001_ha->port[port_id];
+	struct sas_ha_struct *sas_ha = pm8001_ha->sas;
+	struct pm8001_phy *phy = &pm8001_ha->phy[phy_id];
+	unsigned long flags;
+	u8 deviceType = pPayload->sas_identify.dev_type;
+	port->port_state =  portstate;
+	PM8001_MSG_DBG(pm8001_ha,
+		pm8001_printk("HW_EVENT_SAS_PHY_UP port id = %d, phy id = %d\n",
+		port_id, phy_id));
+
+	switch (deviceType) {
+	case SAS_PHY_UNUSED:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("device type no device.\n"));
+		break;
+	case SAS_END_DEVICE:
+		PM8001_MSG_DBG(pm8001_ha, pm8001_printk("end device.\n"));
+		pm8001_chip_phy_ctl_req(pm8001_ha, phy_id,
+			PHY_NOTIFY_ENABLE_SPINUP);
+		port->port_attached = 1;
+		get_lrate_mode(phy, link_rate);
+		break;
+	case SAS_EDGE_EXPANDER_DEVICE:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("expander device.\n"));
+		port->port_attached = 1;
+		get_lrate_mode(phy, link_rate);
+		break;
+	case SAS_FANOUT_EXPANDER_DEVICE:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("fanout expander device.\n"));
+		port->port_attached = 1;
+		get_lrate_mode(phy, link_rate);
+		break;
+	default:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("unkown device type(%x)\n", deviceType));
+		break;
+	}
+	phy->phy_type |= PORT_TYPE_SAS;
+	phy->identify.device_type = deviceType;
+	phy->phy_attached = 1;
+	if (phy->identify.device_type == SAS_END_DEV)
+		phy->identify.target_port_protocols = SAS_PROTOCOL_SSP;
+	else if (phy->identify.device_type != NO_DEVICE)
+		phy->identify.target_port_protocols = SAS_PROTOCOL_SMP;
+	phy->sas_phy.oob_mode = SAS_OOB_MODE;
+	sas_ha->notify_phy_event(&phy->sas_phy, PHYE_OOB_DONE);
+	spin_lock_irqsave(&phy->sas_phy.frame_rcvd_lock, flags);
+	memcpy(phy->frame_rcvd, &pPayload->sas_identify,
+		sizeof(struct sas_identify_frame)-4);
+	phy->frame_rcvd_size = sizeof(struct sas_identify_frame) - 4;
+	pm8001_get_attached_sas_addr(phy, phy->sas_phy.attached_sas_addr);
+	spin_unlock_irqrestore(&phy->sas_phy.frame_rcvd_lock, flags);
+	if (pm8001_ha->flags == PM8001F_RUN_TIME)
+		mdelay(200);/*delay a moment to wait disk to spinup*/
+	pm8001_bytes_dmaed(pm8001_ha, phy_id);
+}
+
+/**
+ * hw_event_sata_phy_up -FW tells me a SATA phy up event.
+ * @pm8001_ha: our hba card information
+ * @piomb: IO message buffer
+ */
+static void
+hw_event_sata_phy_up(struct pm8001_hba_info *pm8001_ha, void *piomb)
+{
+	struct hw_event_resp *pPayload =
+		(struct hw_event_resp *)(piomb + 4);
+	u32 lr_evt_status_phyid_portid =
+		le32_to_cpu(pPayload->lr_evt_status_phyid_portid);
+	u8 link_rate =
+		(u8)((lr_evt_status_phyid_portid & 0xF0000000) >> 28);
+	u8 port_id = (u8)(lr_evt_status_phyid_portid & 0x0000000F);
+	u8 phy_id =
+		(u8)((lr_evt_status_phyid_portid & 0x000000F0) >> 4);
+	u32 npip_portstate = le32_to_cpu(pPayload->npip_portstate);
+	u8 portstate = (u8)(npip_portstate & 0x0000000F);
+	struct pm8001_port *port = &pm8001_ha->port[port_id];
+	struct sas_ha_struct *sas_ha = pm8001_ha->sas;
+	struct pm8001_phy *phy = &pm8001_ha->phy[phy_id];
+	unsigned long flags;
+	PM8001_MSG_DBG(pm8001_ha,
+		pm8001_printk("HW_EVENT_SATA_PHY_UP port id = %d,"
+		" phy id = %d\n", port_id, phy_id));
+	port->port_state =  portstate;
+	port->port_attached = 1;
+	get_lrate_mode(phy, link_rate);
+	phy->phy_type |= PORT_TYPE_SATA;
+	phy->phy_attached = 1;
+	phy->sas_phy.oob_mode = SATA_OOB_MODE;
+	sas_ha->notify_phy_event(&phy->sas_phy, PHYE_OOB_DONE);
+	spin_lock_irqsave(&phy->sas_phy.frame_rcvd_lock, flags);
+	memcpy(phy->frame_rcvd, ((u8 *)&pPayload->sata_fis - 4),
+		sizeof(struct dev_to_host_fis));
+	phy->frame_rcvd_size = sizeof(struct dev_to_host_fis);
+	phy->identify.target_port_protocols = SAS_PROTOCOL_SATA;
+	phy->identify.device_type = SATA_DEV;
+	pm8001_get_attached_sas_addr(phy, phy->sas_phy.attached_sas_addr);
+	spin_unlock_irqrestore(&phy->sas_phy.frame_rcvd_lock, flags);
+	pm8001_bytes_dmaed(pm8001_ha, phy_id);
+}
+
+/**
+ * hw_event_phy_down -we should notify the libsas the phy is down.
+ * @pm8001_ha: our hba card information
+ * @piomb: IO message buffer
+ */
+static void
+hw_event_phy_down(struct pm8001_hba_info *pm8001_ha, void *piomb)
+{
+	struct hw_event_resp *pPayload =
+		(struct hw_event_resp *)(piomb + 4);
+	u32 lr_evt_status_phyid_portid =
+		le32_to_cpu(pPayload->lr_evt_status_phyid_portid);
+	u8 port_id = (u8)(lr_evt_status_phyid_portid & 0x0000000F);
+	u8 phy_id =
+		(u8)((lr_evt_status_phyid_portid & 0x000000F0) >> 4);
+	u32 npip_portstate = le32_to_cpu(pPayload->npip_portstate);
+	u8 portstate = (u8)(npip_portstate & 0x0000000F);
+	struct pm8001_port *port = &pm8001_ha->port[port_id];
+	struct pm8001_phy *phy = &pm8001_ha->phy[phy_id];
+	port->port_state =  portstate;
+	phy->phy_type = 0;
+	phy->identify.device_type = 0;
+	phy->phy_attached = 0;
+	memset(&phy->dev_sas_addr, 0, SAS_ADDR_SIZE);
+	switch (portstate) {
+	case PORT_VALID:
+		break;
+	case PORT_INVALID:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk(" PortInvalid portID %d \n", port_id));
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk(" Last phy Down and port invalid\n"));
+		port->port_attached = 0;
+		pm8001_hw_event_ack_req(pm8001_ha, 0, HW_EVENT_PHY_DOWN,
+			port_id, phy_id, 0, 0);
+		break;
+	case PORT_IN_RESET:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk(" Port In Reset portID %d \n", port_id));
+		break;
+	case PORT_NOT_ESTABLISHED:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk(" phy Down and PORT_NOT_ESTABLISHED\n"));
+		port->port_attached = 0;
+		break;
+	case PORT_LOSTCOMM:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk(" phy Down and PORT_LOSTCOMM\n"));
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk(" Last phy Down and port invalid\n"));
+		port->port_attached = 0;
+		pm8001_hw_event_ack_req(pm8001_ha, 0, HW_EVENT_PHY_DOWN,
+			port_id, phy_id, 0, 0);
+		break;
+	default:
+		port->port_attached = 0;
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk(" phy Down and(default) = %x\n",
+			portstate));
+		break;
+
+	}
+}
+
+/**
+ * mpi_reg_resp -process register device ID response.
+ * @pm8001_ha: our hba card information
+ * @piomb: IO message buffer
+ *
+ * when sas layer find a device it will notify LLDD, then the driver register
+ * the domain device to FW, this event is the return device ID which the FW
+ * has assigned, from now,inter-communication with FW is no longer using the
+ * SAS address, use device ID which FW assigned.
+ */
+static int mpi_reg_resp(struct pm8001_hba_info *pm8001_ha, void *piomb)
+{
+	u32 status;
+	u32 device_id;
+	u32 htag;
+	struct pm8001_ccb_info *ccb;
+	struct pm8001_device *pm8001_dev;
+	struct dev_reg_resp *registerRespPayload =
+		(struct dev_reg_resp *)(piomb + 4);
+
+	htag = le32_to_cpu(registerRespPayload->tag);
+	ccb = &pm8001_ha->ccb_info[registerRespPayload->tag];
+	pm8001_dev = ccb->device;
+	status = le32_to_cpu(registerRespPayload->status);
+	device_id = le32_to_cpu(registerRespPayload->device_id);
+	PM8001_MSG_DBG(pm8001_ha,
+		pm8001_printk(" register device is status = %d\n", status));
+	switch (status) {
+	case DEVREG_SUCCESS:
+		PM8001_MSG_DBG(pm8001_ha, pm8001_printk("DEVREG_SUCCESS\n"));
+		pm8001_dev->device_id = device_id;
+		break;
+	case DEVREG_FAILURE_OUT_OF_RESOURCE:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("DEVREG_FAILURE_OUT_OF_RESOURCE\n"));
+		break;
+	case DEVREG_FAILURE_DEVICE_ALREADY_REGISTERED:
+		PM8001_MSG_DBG(pm8001_ha,
+		   pm8001_printk("DEVREG_FAILURE_DEVICE_ALREADY_REGISTERED\n"));
+		break;
+	case DEVREG_FAILURE_INVALID_PHY_ID:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("DEVREG_FAILURE_INVALID_PHY_ID\n"));
+		break;
+	case DEVREG_FAILURE_PHY_ID_ALREADY_REGISTERED:
+		PM8001_MSG_DBG(pm8001_ha,
+		   pm8001_printk("DEVREG_FAILURE_PHY_ID_ALREADY_REGISTERED\n"));
+		break;
+	case DEVREG_FAILURE_PORT_ID_OUT_OF_RANGE:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("DEVREG_FAILURE_PORT_ID_OUT_OF_RANGE\n"));
+		break;
+	case DEVREG_FAILURE_PORT_NOT_VALID_STATE:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("DEVREG_FAILURE_PORT_NOT_VALID_STATE\n"));
+		break;
+	case DEVREG_FAILURE_DEVICE_TYPE_NOT_VALID:
+		PM8001_MSG_DBG(pm8001_ha,
+		       pm8001_printk("DEVREG_FAILURE_DEVICE_TYPE_NOT_VALID\n"));
+		break;
+	default:
+		PM8001_MSG_DBG(pm8001_ha,
+		 pm8001_printk("DEVREG_FAILURE_DEVICE_TYPE_NOT_UNSORPORTED\n"));
+		break;
+	}
+	complete(pm8001_dev->dcompletion);
+	ccb->task = NULL;
+	ccb->ccb_tag = 0xFFFFFFFF;
+	pm8001_ccb_free(pm8001_ha, htag);
+	return 0;
+}
+
+static int mpi_dereg_resp(struct pm8001_hba_info *pm8001_ha, void *piomb)
+{
+	u32 status;
+	u32 device_id;
+	struct dev_reg_resp *registerRespPayload =
+		(struct dev_reg_resp *)(piomb + 4);
+
+	status = le32_to_cpu(registerRespPayload->status);
+	device_id = le32_to_cpu(registerRespPayload->device_id);
+	if (status != 0)
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk(" deregister device failed ,status = %x"
+			", device_id = %x\n", status, device_id));
+	return 0;
+}
+
+static int
+mpi_fw_flash_update_resp(struct pm8001_hba_info *pm8001_ha, void *piomb)
+{
+	u32 status;
+	struct fw_control_ex	fw_control_context;
+	struct fw_flash_Update_resp *ppayload =
+		(struct fw_flash_Update_resp *)(piomb + 4);
+	u32 tag = le32_to_cpu(ppayload->tag);
+	struct pm8001_ccb_info *ccb = &pm8001_ha->ccb_info[tag];
+	status = le32_to_cpu(ppayload->status);
+	memcpy(&fw_control_context,
+		ccb->fw_control_context,
+		sizeof(fw_control_context));
+	switch (status) {
+	case FLASH_UPDATE_COMPLETE_PENDING_REBOOT:
+		PM8001_MSG_DBG(pm8001_ha,
+		pm8001_printk(": FLASH_UPDATE_COMPLETE_PENDING_REBOOT\n"));
+		break;
+	case FLASH_UPDATE_IN_PROGRESS:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk(": FLASH_UPDATE_IN_PROGRESS\n"));
+		break;
+	case FLASH_UPDATE_HDR_ERR:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk(": FLASH_UPDATE_HDR_ERR\n"));
+		break;
+	case FLASH_UPDATE_OFFSET_ERR:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk(": FLASH_UPDATE_OFFSET_ERR\n"));
+		break;
+	case FLASH_UPDATE_CRC_ERR:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk(": FLASH_UPDATE_CRC_ERR\n"));
+		break;
+	case FLASH_UPDATE_LENGTH_ERR:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk(": FLASH_UPDATE_LENGTH_ERR\n"));
+		break;
+	case FLASH_UPDATE_HW_ERR:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk(": FLASH_UPDATE_HW_ERR\n"));
+		break;
+	case FLASH_UPDATE_DNLD_NOT_SUPPORTED:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk(": FLASH_UPDATE_DNLD_NOT_SUPPORTED\n"));
+		break;
+	case FLASH_UPDATE_DISABLED:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk(": FLASH_UPDATE_DISABLED\n"));
+		break;
+	default:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("No matched status = %d\n", status));
+		break;
+	}
+	ccb->fw_control_context->fw_control->retcode = status;
+	pci_free_consistent(pm8001_ha->pdev,
+			fw_control_context.len,
+			fw_control_context.virtAddr,
+			fw_control_context.phys_addr);
+	complete(pm8001_ha->nvmd_completion);
+	ccb->task = NULL;
+	ccb->ccb_tag = 0xFFFFFFFF;
+	pm8001_ccb_free(pm8001_ha, tag);
+	return 0;
+}
+
+static int
+mpi_general_event(struct pm8001_hba_info *pm8001_ha , void *piomb)
+{
+	u32 status;
+	int i;
+	struct general_event_resp *pPayload =
+		(struct general_event_resp *)(piomb + 4);
+	status = le32_to_cpu(pPayload->status);
+	PM8001_MSG_DBG(pm8001_ha,
+		pm8001_printk(" status = 0x%x\n", status));
+	for (i = 0; i < GENERAL_EVENT_PAYLOAD; i++)
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("inb_IOMB_payload[0x%x] 0x%x, \n", i,
+			pPayload->inb_IOMB_payload[i]));
+	return 0;
+}
+
+static int
+mpi_task_abort_resp(struct pm8001_hba_info *pm8001_ha, void *piomb)
+{
+	struct sas_task *t;
+	struct pm8001_ccb_info *ccb;
+	unsigned long flags;
+	u32 status ;
+	u32 tag, scp;
+	struct task_status_struct *ts;
+
+	struct task_abort_resp *pPayload =
+		(struct task_abort_resp *)(piomb + 4);
+	ccb = &pm8001_ha->ccb_info[pPayload->tag];
+	t = ccb->task;
+
+
+	status = le32_to_cpu(pPayload->status);
+	tag = le32_to_cpu(pPayload->tag);
+	scp = le32_to_cpu(pPayload->scp);
+	PM8001_IO_DBG(pm8001_ha,
+		pm8001_printk(" status = 0x%x\n", status));
+	if (t == NULL)
+		return -1;
+	ts = &t->task_status;
+	if (status != 0)
+		PM8001_FAIL_DBG(pm8001_ha,
+			pm8001_printk("task abort failed status 0x%x ,"
+			"tag = 0x%x, scp= 0x%x\n", status, tag, scp));
+	switch (status) {
+	case IO_SUCCESS:
+		PM8001_EH_DBG(pm8001_ha, pm8001_printk("IO_SUCCESS\n"));
+		ts->resp = SAS_TASK_COMPLETE;
+		ts->stat = SAM_GOOD;
+		break;
+	case IO_NOT_VALID:
+		PM8001_EH_DBG(pm8001_ha, pm8001_printk("IO_NOT_VALID\n"));
+		ts->resp = TMF_RESP_FUNC_FAILED;
+		break;
+	}
+	spin_lock_irqsave(&t->task_state_lock, flags);
+	t->task_state_flags &= ~SAS_TASK_STATE_PENDING;
+	t->task_state_flags &= ~SAS_TASK_AT_INITIATOR;
+	t->task_state_flags |= SAS_TASK_STATE_DONE;
+	spin_unlock_irqrestore(&t->task_state_lock, flags);
+	pm8001_ccb_task_free(pm8001_ha, t, ccb, pPayload->tag);
+	mb();
+	t->task_done(t);
+	return 0;
+}
+
+/**
+ * mpi_hw_event -The hw event has come.
+ * @pm8001_ha: our hba card information
+ * @piomb: IO message buffer
+ */
+static int mpi_hw_event(struct pm8001_hba_info *pm8001_ha, void* piomb)
+{
+	unsigned long flags;
+	struct hw_event_resp *pPayload =
+		(struct hw_event_resp *)(piomb + 4);
+	u32 lr_evt_status_phyid_portid =
+		le32_to_cpu(pPayload->lr_evt_status_phyid_portid);
+	u8 port_id = (u8)(lr_evt_status_phyid_portid & 0x0000000F);
+	u8 phy_id =
+		(u8)((lr_evt_status_phyid_portid & 0x000000F0) >> 4);
+	u16 eventType =
+		(u16)((lr_evt_status_phyid_portid & 0x00FFFF00) >> 8);
+	u8 status =
+		(u8)((lr_evt_status_phyid_portid & 0x0F000000) >> 24);
+	struct sas_ha_struct *sas_ha = pm8001_ha->sas;
+	struct pm8001_phy *phy = &pm8001_ha->phy[phy_id];
+	struct asd_sas_phy *sas_phy = sas_ha->sas_phy[phy_id];
+	PM8001_MSG_DBG(pm8001_ha,
+		pm8001_printk("outbound queue HW event & event type : "));
+	switch (eventType) {
+	case HW_EVENT_PHY_START_STATUS:
+		PM8001_MSG_DBG(pm8001_ha,
+		pm8001_printk("HW_EVENT_PHY_START_STATUS"
+			" status = %x\n", status));
+		if (status == 0) {
+			phy->phy_state = 1;
+			if (pm8001_ha->flags == PM8001F_RUN_TIME)
+				complete(phy->enable_completion);
+		}
+		break;
+	case HW_EVENT_SAS_PHY_UP:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("HW_EVENT_PHY_START_STATUS \n"));
+		hw_event_sas_phy_up(pm8001_ha, piomb);
+		break;
+	case HW_EVENT_SATA_PHY_UP:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("HW_EVENT_SATA_PHY_UP \n"));
+		hw_event_sata_phy_up(pm8001_ha, piomb);
+		break;
+	case HW_EVENT_PHY_STOP_STATUS:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("HW_EVENT_PHY_STOP_STATUS "
+			"status = %x\n", status));
+		if (status == 0)
+			phy->phy_state = 0;
+		break;
+	case HW_EVENT_SATA_SPINUP_HOLD:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("HW_EVENT_SATA_SPINUP_HOLD \n"));
+		sas_ha->notify_phy_event(&phy->sas_phy, PHYE_SPINUP_HOLD);
+		break;
+	case HW_EVENT_PHY_DOWN:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("HW_EVENT_PHY_DOWN \n"));
+		sas_ha->notify_phy_event(&phy->sas_phy, PHYE_LOSS_OF_SIGNAL);
+		phy->phy_attached = 0;
+		phy->phy_state = 0;
+		hw_event_phy_down(pm8001_ha, piomb);
+		break;
+	case HW_EVENT_PORT_INVALID:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("HW_EVENT_PORT_INVALID\n"));
+		sas_phy_disconnected(sas_phy);
+		phy->phy_attached = 0;
+		sas_ha->notify_port_event(sas_phy, PORTE_LINK_RESET_ERR);
+		break;
+	/* the broadcast change primitive received, tell the LIBSAS this event
+	to revalidate the sas domain*/
+	case HW_EVENT_BROADCAST_CHANGE:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("HW_EVENT_BROADCAST_CHANGE\n"));
+		pm8001_hw_event_ack_req(pm8001_ha, 0, HW_EVENT_BROADCAST_CHANGE,
+			port_id, phy_id, 1, 0);
+		spin_lock_irqsave(&sas_phy->sas_prim_lock, flags);
+		sas_phy->sas_prim = HW_EVENT_BROADCAST_CHANGE;
+		spin_unlock_irqrestore(&sas_phy->sas_prim_lock, flags);
+		sas_ha->notify_port_event(sas_phy, PORTE_BROADCAST_RCVD);
+		break;
+	case HW_EVENT_PHY_ERROR:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("HW_EVENT_PHY_ERROR\n"));
+		sas_phy_disconnected(&phy->sas_phy);
+		phy->phy_attached = 0;
+		sas_ha->notify_phy_event(&phy->sas_phy, PHYE_OOB_ERROR);
+		break;
+	case HW_EVENT_BROADCAST_EXP:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("HW_EVENT_BROADCAST_EXP\n"));
+		spin_lock_irqsave(&sas_phy->sas_prim_lock, flags);
+		sas_phy->sas_prim = HW_EVENT_BROADCAST_EXP;
+		spin_unlock_irqrestore(&sas_phy->sas_prim_lock, flags);
+		sas_ha->notify_port_event(sas_phy, PORTE_BROADCAST_RCVD);
+		break;
+	case HW_EVENT_LINK_ERR_INVALID_DWORD:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("HW_EVENT_LINK_ERR_INVALID_DWORD\n"));
+		pm8001_hw_event_ack_req(pm8001_ha, 0,
+			HW_EVENT_LINK_ERR_INVALID_DWORD, port_id, phy_id, 0, 0);
+		sas_phy_disconnected(sas_phy);
+		phy->phy_attached = 0;
+		sas_ha->notify_port_event(sas_phy, PORTE_LINK_RESET_ERR);
+		break;
+	case HW_EVENT_LINK_ERR_DISPARITY_ERROR:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("HW_EVENT_LINK_ERR_DISPARITY_ERROR\n"));
+		pm8001_hw_event_ack_req(pm8001_ha, 0,
+			HW_EVENT_LINK_ERR_DISPARITY_ERROR,
+			port_id, phy_id, 0, 0);
+		sas_phy_disconnected(sas_phy);
+		phy->phy_attached = 0;
+		sas_ha->notify_port_event(sas_phy, PORTE_LINK_RESET_ERR);
+		break;
+	case HW_EVENT_LINK_ERR_CODE_VIOLATION:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("HW_EVENT_LINK_ERR_CODE_VIOLATION\n"));
+		pm8001_hw_event_ack_req(pm8001_ha, 0,
+			HW_EVENT_LINK_ERR_CODE_VIOLATION,
+			port_id, phy_id, 0, 0);
+		sas_phy_disconnected(sas_phy);
+		phy->phy_attached = 0;
+		sas_ha->notify_port_event(sas_phy, PORTE_LINK_RESET_ERR);
+		break;
+	case HW_EVENT_LINK_ERR_LOSS_OF_DWORD_SYNCH:
+		PM8001_MSG_DBG(pm8001_ha,
+		      pm8001_printk("HW_EVENT_LINK_ERR_LOSS_OF_DWORD_SYNCH\n"));
+		pm8001_hw_event_ack_req(pm8001_ha, 0,
+			HW_EVENT_LINK_ERR_LOSS_OF_DWORD_SYNCH,
+			port_id, phy_id, 0, 0);
+		sas_phy_disconnected(sas_phy);
+		phy->phy_attached = 0;
+		sas_ha->notify_port_event(sas_phy, PORTE_LINK_RESET_ERR);
+		break;
+	case HW_EVENT_MALFUNCTION:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("HW_EVENT_MALFUNCTION\n"));
+		break;
+	case HW_EVENT_BROADCAST_SES:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("HW_EVENT_BROADCAST_SES\n"));
+		spin_lock_irqsave(&sas_phy->sas_prim_lock, flags);
+		sas_phy->sas_prim = HW_EVENT_BROADCAST_SES;
+		spin_unlock_irqrestore(&sas_phy->sas_prim_lock, flags);
+		sas_ha->notify_port_event(sas_phy, PORTE_BROADCAST_RCVD);
+		break;
+	case HW_EVENT_INBOUND_CRC_ERROR:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("HW_EVENT_INBOUND_CRC_ERROR\n"));
+		pm8001_hw_event_ack_req(pm8001_ha, 0,
+			HW_EVENT_INBOUND_CRC_ERROR,
+			port_id, phy_id, 0, 0);
+		break;
+	case HW_EVENT_HARD_RESET_RECEIVED:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("HW_EVENT_HARD_RESET_RECEIVED\n"));
+		sas_ha->notify_port_event(sas_phy, PORTE_HARD_RESET);
+		break;
+	case HW_EVENT_ID_FRAME_TIMEOUT:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("HW_EVENT_ID_FRAME_TIMEOUT\n"));
+		sas_phy_disconnected(sas_phy);
+		phy->phy_attached = 0;
+		sas_ha->notify_port_event(sas_phy, PORTE_LINK_RESET_ERR);
+		break;
+	case HW_EVENT_LINK_ERR_PHY_RESET_FAILED:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("HW_EVENT_LINK_ERR_PHY_RESET_FAILED \n"));
+		pm8001_hw_event_ack_req(pm8001_ha, 0,
+			HW_EVENT_LINK_ERR_PHY_RESET_FAILED,
+			port_id, phy_id, 0, 0);
+		sas_phy_disconnected(sas_phy);
+		phy->phy_attached = 0;
+		sas_ha->notify_port_event(sas_phy, PORTE_LINK_RESET_ERR);
+		break;
+	case HW_EVENT_PORT_RESET_TIMER_TMO:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("HW_EVENT_PORT_RESET_TIMER_TMO \n"));
+		sas_phy_disconnected(sas_phy);
+		phy->phy_attached = 0;
+		sas_ha->notify_port_event(sas_phy, PORTE_LINK_RESET_ERR);
+		break;
+	case HW_EVENT_PORT_RECOVERY_TIMER_TMO:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("HW_EVENT_PORT_RECOVERY_TIMER_TMO \n"));
+		sas_phy_disconnected(sas_phy);
+		phy->phy_attached = 0;
+		sas_ha->notify_port_event(sas_phy, PORTE_LINK_RESET_ERR);
+		break;
+	case HW_EVENT_PORT_RECOVER:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("HW_EVENT_PORT_RECOVER \n"));
+		break;
+	case HW_EVENT_PORT_RESET_COMPLETE:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("HW_EVENT_PORT_RESET_COMPLETE \n"));
+		break;
+	case EVENT_BROADCAST_ASYNCH_EVENT:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("EVENT_BROADCAST_ASYNCH_EVENT\n"));
+		break;
+	default:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("Unknown event type = %x\n", eventType));
+		break;
+	}
+	return 0;
+}
+
+/**
+ * process_one_iomb - process one outbound Queue memory block
+ * @pm8001_ha: our hba card information
+ * @piomb: IO message buffer
+ */
+static void process_one_iomb(struct pm8001_hba_info *pm8001_ha, void *piomb)
+{
+	u32 pHeader = (u32)*(u32 *)piomb;
+	u8 opc = (u8)((le32_to_cpu(pHeader)) & 0xFFF);
+
+	PM8001_MSG_DBG(pm8001_ha, pm8001_printk("process_one_iomb:"));
+
+	switch (opc) {
+	case OPC_OUB_ECHO:
+		PM8001_MSG_DBG(pm8001_ha, pm8001_printk("OPC_OUB_ECHO \n"));
+		break;
+	case OPC_OUB_HW_EVENT:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("OPC_OUB_HW_EVENT \n"));
+		mpi_hw_event(pm8001_ha, piomb);
+		break;
+	case OPC_OUB_SSP_COMP:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("OPC_OUB_SSP_COMP \n"));
+		mpi_ssp_completion(pm8001_ha, piomb);
+		break;
+	case OPC_OUB_SMP_COMP:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("OPC_OUB_SMP_COMP \n"));
+		mpi_smp_completion(pm8001_ha, piomb);
+		break;
+	case OPC_OUB_LOCAL_PHY_CNTRL:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("OPC_OUB_LOCAL_PHY_CNTRL\n"));
+		mpi_local_phy_ctl(pm8001_ha, piomb);
+		break;
+	case OPC_OUB_DEV_REGIST:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("OPC_OUB_DEV_REGIST \n"));
+		mpi_reg_resp(pm8001_ha, piomb);
+		break;
+	case OPC_OUB_DEREG_DEV:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("unresgister the deviece \n"));
+		mpi_dereg_resp(pm8001_ha, piomb);
+		break;
+	case OPC_OUB_GET_DEV_HANDLE:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("OPC_OUB_GET_DEV_HANDLE \n"));
+		break;
+	case OPC_OUB_SATA_COMP:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("OPC_OUB_SATA_COMP \n"));
+		mpi_sata_completion(pm8001_ha, piomb);
+		break;
+	case OPC_OUB_SATA_EVENT:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("OPC_OUB_SATA_EVENT \n"));
+		mpi_sata_event(pm8001_ha, piomb);
+		break;
+	case OPC_OUB_SSP_EVENT:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("OPC_OUB_SSP_EVENT\n"));
+		mpi_ssp_event(pm8001_ha, piomb);
+		break;
+	case OPC_OUB_DEV_HANDLE_ARRIV:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("OPC_OUB_DEV_HANDLE_ARRIV\n"));
+		/*This is for target*/
+		break;
+	case OPC_OUB_SSP_RECV_EVENT:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("OPC_OUB_SSP_RECV_EVENT\n"));
+		/*This is for target*/
+		break;
+	case OPC_OUB_DEV_INFO:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("OPC_OUB_DEV_INFO\n"));
+		break;
+	case OPC_OUB_FW_FLASH_UPDATE:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("OPC_OUB_FW_FLASH_UPDATE\n"));
+		mpi_fw_flash_update_resp(pm8001_ha, piomb);
+		break;
+	case OPC_OUB_GPIO_RESPONSE:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("OPC_OUB_GPIO_RESPONSE\n"));
+		break;
+	case OPC_OUB_GPIO_EVENT:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("OPC_OUB_GPIO_EVENT\n"));
+		break;
+	case OPC_OUB_GENERAL_EVENT:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("OPC_OUB_GENERAL_EVENT\n"));
+		mpi_general_event(pm8001_ha, piomb);
+		break;
+	case OPC_OUB_SSP_ABORT_RSP:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("OPC_OUB_SSP_ABORT_RSP\n"));
+		mpi_task_abort_resp(pm8001_ha, piomb);
+		break;
+	case OPC_OUB_SATA_ABORT_RSP:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("OPC_OUB_SATA_ABORT_RSP\n"));
+		mpi_task_abort_resp(pm8001_ha, piomb);
+		break;
+	case OPC_OUB_SAS_DIAG_MODE_START_END:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("OPC_OUB_SAS_DIAG_MODE_START_END\n"));
+		break;
+	case OPC_OUB_SAS_DIAG_EXECUTE:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("OPC_OUB_SAS_DIAG_EXECUTE\n"));
+		break;
+	case OPC_OUB_GET_TIME_STAMP:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("OPC_OUB_GET_TIME_STAMP\n"));
+		break;
+	case OPC_OUB_SAS_HW_EVENT_ACK:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("OPC_OUB_SAS_HW_EVENT_ACK\n"));
+		break;
+	case OPC_OUB_PORT_CONTROL:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("OPC_OUB_PORT_CONTROL\n"));
+		break;
+	case OPC_OUB_SMP_ABORT_RSP:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("OPC_OUB_SMP_ABORT_RSP\n"));
+		mpi_task_abort_resp(pm8001_ha, piomb);
+		break;
+	case OPC_OUB_GET_NVMD_DATA:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("OPC_OUB_GET_NVMD_DATA\n"));
+		mpi_get_nvmd_resp(pm8001_ha, piomb);
+		break;
+	case OPC_OUB_SET_NVMD_DATA:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("OPC_OUB_SET_NVMD_DATA\n"));
+		mpi_set_nvmd_resp(pm8001_ha, piomb);
+		break;
+	case OPC_OUB_DEVICE_HANDLE_REMOVAL:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("OPC_OUB_DEVICE_HANDLE_REMOVAL\n"));
+		break;
+	case OPC_OUB_SET_DEVICE_STATE:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("OPC_OUB_SET_DEVICE_STATE\n"));
+		mpi_set_dev_state_resp(pm8001_ha, piomb);
+		break;
+	case OPC_OUB_GET_DEVICE_STATE:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("OPC_OUB_GET_DEVICE_STATE\n"));
+		break;
+	case OPC_OUB_SET_DEV_INFO:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("OPC_OUB_SET_DEV_INFO\n"));
+		break;
+	case OPC_OUB_SAS_RE_INITIALIZE:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("OPC_OUB_SAS_RE_INITIALIZE\n"));
+		break;
+	default:
+		PM8001_MSG_DBG(pm8001_ha,
+			pm8001_printk("Unknown outbound Queue IOMB OPC = %x\n",
+			opc));
+		break;
+	}
+}
+
+static int process_oq(struct pm8001_hba_info *pm8001_ha)
+{
+	struct outbound_queue_table *circularQ;
+	void *pMsg1 = NULL;
+	u8 bc = 0;
+	u32 ret = MPI_IO_STATUS_FAIL;
+
+	circularQ = &pm8001_ha->outbnd_q_tbl[0];
+	do {
+		ret = mpi_msg_consume(pm8001_ha, circularQ, &pMsg1, &bc);
+		if (MPI_IO_STATUS_SUCCESS == ret) {
+			/* process the outbound message */
+			process_one_iomb(pm8001_ha, (void *)(pMsg1 - 4));
+			/* free the message from the outbound circular buffer */
+			mpi_msg_free_set(pm8001_ha, pMsg1, circularQ, bc);
+		}
+		if (MPI_IO_STATUS_BUSY == ret) {
+			u32 producer_idx;
+			/* Update the producer index from SPC */
+			producer_idx = pm8001_read_32(circularQ->pi_virt);
+			circularQ->producer_index = cpu_to_le32(producer_idx);
+			if (circularQ->producer_index ==
+				circularQ->consumer_idx)
+				/* OQ is empty */
+				break;
+		}
+	} while (1);
+	return ret;
+}
+
+/* PCI_DMA_... to our direction translation. */
+static const u8 data_dir_flags[] = {
+	[PCI_DMA_BIDIRECTIONAL] = DATA_DIR_BYRECIPIENT,/* UNSPECIFIED */
+	[PCI_DMA_TODEVICE]	= DATA_DIR_OUT,/* OUTBOUND */
+	[PCI_DMA_FROMDEVICE]	= DATA_DIR_IN,/* INBOUND */
+	[PCI_DMA_NONE]		= DATA_DIR_NONE,/* NO TRANSFER */
+};
+static void
+pm8001_chip_make_sg(struct scatterlist *scatter, int nr, void *prd)
+{
+	int i;
+	struct scatterlist *sg;
+	struct pm8001_prd *buf_prd = prd;
+
+	for_each_sg(scatter, sg, nr, i) {
+		buf_prd->addr = cpu_to_le64(sg_dma_address(sg));
+		buf_prd->im_len.len = cpu_to_le32(sg_dma_len(sg));
+		buf_prd->im_len.e = 0;
+		buf_prd++;
+	}
+}
+
+static void build_smp_cmd(u32 deviceID, u32 hTag, struct smp_req *psmp_cmd)
+{
+	psmp_cmd->tag = cpu_to_le32(hTag);
+	psmp_cmd->device_id = cpu_to_le32(deviceID);
+	psmp_cmd->len_ip_ir = cpu_to_le32(1|(1 << 1));
+}
+
+/**
+ * pm8001_chip_smp_req - send a SMP task to FW
+ * @pm8001_ha: our hba card information.
+ * @ccb: the ccb information this request used.
+ */
+static int pm8001_chip_smp_req(struct pm8001_hba_info *pm8001_ha,
+	struct pm8001_ccb_info *ccb)
+{
+	int elem, rc;
+	struct sas_task *task = ccb->task;
+	struct domain_device *dev = task->dev;
+	struct pm8001_device *pm8001_dev = dev->lldd_dev;
+	struct scatterlist *sg_req, *sg_resp;
+	u32 req_len, resp_len;
+	struct smp_req smp_cmd;
+	u32 opc;
+	struct inbound_queue_table *circularQ;
+
+	memset(&smp_cmd, 0, sizeof(smp_cmd));
+	/*
+	 * DMA-map SMP request, response buffers
+	 */
+	sg_req = &task->smp_task.smp_req;
+	elem = dma_map_sg(pm8001_ha->dev, sg_req, 1, PCI_DMA_TODEVICE);
+	if (!elem)
+		return -ENOMEM;
+	req_len = sg_dma_len(sg_req);
+
+	sg_resp = &task->smp_task.smp_resp;
+	elem = dma_map_sg(pm8001_ha->dev, sg_resp, 1, PCI_DMA_FROMDEVICE);
+	if (!elem) {
+		rc = -ENOMEM;
+		goto err_out;
+	}
+	resp_len = sg_dma_len(sg_resp);
+	/* must be in dwords */
+	if ((req_len & 0x3) || (resp_len & 0x3)) {
+		rc = -EINVAL;
+		goto err_out_2;
+	}
+
+	opc = OPC_INB_SMP_REQUEST;
+	circularQ = &pm8001_ha->inbnd_q_tbl[0];
+	smp_cmd.tag = cpu_to_le32(ccb->ccb_tag);
+	smp_cmd.long_smp_req.long_req_addr =
+		cpu_to_le64((u64)sg_dma_address(&task->smp_task.smp_req));
+	smp_cmd.long_smp_req.long_req_size =
+		cpu_to_le32((u32)sg_dma_len(&task->smp_task.smp_req)-4);
+	smp_cmd.long_smp_req.long_resp_addr =
+		cpu_to_le64((u64)sg_dma_address(&task->smp_task.smp_resp));
+	smp_cmd.long_smp_req.long_resp_size =
+		cpu_to_le32((u32)sg_dma_len(&task->smp_task.smp_resp)-4);
+	build_smp_cmd(pm8001_dev->device_id, smp_cmd.tag, &smp_cmd);
+	mpi_build_cmd(pm8001_ha, circularQ, opc, (u32 *)&smp_cmd);
+	return 0;
+
+err_out_2:
+	dma_unmap_sg(pm8001_ha->dev, &ccb->task->smp_task.smp_resp, 1,
+			PCI_DMA_FROMDEVICE);
+err_out:
+	dma_unmap_sg(pm8001_ha->dev, &ccb->task->smp_task.smp_req, 1,
+			PCI_DMA_TODEVICE);
+	return rc;
+}
+
+/**
+ * pm8001_chip_ssp_io_req - send a SSP task to FW
+ * @pm8001_ha: our hba card information.
+ * @ccb: the ccb information this request used.
+ */
+static int pm8001_chip_ssp_io_req(struct pm8001_hba_info *pm8001_ha,
+	struct pm8001_ccb_info *ccb)
+{
+	struct sas_task *task = ccb->task;
+	struct domain_device *dev = task->dev;
+	struct pm8001_device *pm8001_dev = dev->lldd_dev;
+	struct ssp_ini_io_start_req ssp_cmd;
+	u32 tag = ccb->ccb_tag;
+	int ret;
+	__le64 phys_addr;
+	struct inbound_queue_table *circularQ;
+	u32 opc = OPC_INB_SSPINIIOSTART;
+	memset(&ssp_cmd, 0, sizeof(ssp_cmd));
+	memcpy(ssp_cmd.ssp_iu.lun, task->ssp_task.LUN, 8);
+	ssp_cmd.dir_m_tlr =
+		cpu_to_le32(data_dir_flags[task->data_dir] << 8 | 0x0);/*0 for
+	SAS 1.1 compatible TLR*/
+	ssp_cmd.data_len = cpu_to_le32(task->total_xfer_len);
+	ssp_cmd.device_id = cpu_to_le32(pm8001_dev->device_id);
+	ssp_cmd.tag = cpu_to_le32(tag);
+	if (task->ssp_task.enable_first_burst)
+		ssp_cmd.ssp_iu.efb_prio_attr |= 0x80;
+	ssp_cmd.ssp_iu.efb_prio_attr |= (task->ssp_task.task_prio << 3);
+	ssp_cmd.ssp_iu.efb_prio_attr |= (task->ssp_task.task_attr & 7);
+	memcpy(ssp_cmd.ssp_iu.cdb, task->ssp_task.cdb, 16);
+	circularQ = &pm8001_ha->inbnd_q_tbl[0];
+
+	/* fill in PRD (scatter/gather) table, if any */
+	if (task->num_scatter > 1) {
+		pm8001_chip_make_sg(task->scatter, ccb->n_elem, ccb->buf_prd);
+		phys_addr = cpu_to_le64(ccb->ccb_dma_handle +
+				offsetof(struct pm8001_ccb_info, buf_prd[0]));
+		ssp_cmd.addr_low = lower_32_bits(phys_addr);
+		ssp_cmd.addr_high = upper_32_bits(phys_addr);
+		ssp_cmd.esgl = cpu_to_le32(1<<31);
+	} else if (task->num_scatter == 1) {
+		__le64 dma_addr = cpu_to_le64(sg_dma_address(task->scatter));
+		ssp_cmd.addr_low = lower_32_bits(dma_addr);
+		ssp_cmd.addr_high = upper_32_bits(dma_addr);
+		ssp_cmd.len = cpu_to_le32(task->total_xfer_len);
+		ssp_cmd.esgl = 0;
+	} else if (task->num_scatter == 0) {
+		ssp_cmd.addr_low = 0;
+		ssp_cmd.addr_high = 0;
+		ssp_cmd.len = cpu_to_le32(task->total_xfer_len);
+		ssp_cmd.esgl = 0;
+	}
+	ret = mpi_build_cmd(pm8001_ha, circularQ, opc, &ssp_cmd);
+	return ret;
+}
+
+static int pm8001_chip_sata_req(struct pm8001_hba_info *pm8001_ha,
+	struct pm8001_ccb_info *ccb)
+{
+	struct sas_task *task = ccb->task;
+	struct domain_device *dev = task->dev;
+	struct pm8001_device *pm8001_ha_dev = dev->lldd_dev;
+	u32 tag = ccb->ccb_tag;
+	int ret;
+	struct sata_start_req sata_cmd;
+	u32 hdr_tag, ncg_tag = 0;
+	__le64 phys_addr;
+	u32 ATAP = 0x0;
+	u32 dir;
+	struct inbound_queue_table *circularQ;
+	u32  opc = OPC_INB_SATA_HOST_OPSTART;
+	memset(&sata_cmd, 0, sizeof(sata_cmd));
+	circularQ = &pm8001_ha->inbnd_q_tbl[0];
+	if (task->data_dir == PCI_DMA_NONE) {
+		ATAP = 0x04;  /* no data*/
+		PM8001_IO_DBG(pm8001_ha, pm8001_printk("no data \n"));
+	} else if (likely(!task->ata_task.device_control_reg_update)) {
+		if (task->ata_task.dma_xfer) {
+			ATAP = 0x06; /* DMA */
+			PM8001_IO_DBG(pm8001_ha, pm8001_printk("DMA \n"));
+		} else {
+			ATAP = 0x05; /* PIO*/
+			PM8001_IO_DBG(pm8001_ha, pm8001_printk("PIO \n"));
+		}
+		if (task->ata_task.use_ncq &&
+			dev->sata_dev.command_set != ATAPI_COMMAND_SET) {
+			ATAP = 0x07; /* FPDMA */
+			PM8001_IO_DBG(pm8001_ha, pm8001_printk("FPDMA \n"));
+		}
+	}
+	if (task->ata_task.use_ncq && pm8001_get_ncq_tag(task, &hdr_tag))
+		ncg_tag = hdr_tag;
+	dir = data_dir_flags[task->data_dir] << 8;
+	sata_cmd.tag = cpu_to_le32(tag);
+	sata_cmd.device_id = cpu_to_le32(pm8001_ha_dev->device_id);
+	sata_cmd.data_len = cpu_to_le32(task->total_xfer_len);
+	sata_cmd.ncqtag_atap_dir_m =
+		cpu_to_le32(((ncg_tag & 0xff)<<16)|((ATAP & 0x3f) << 10) | dir);
+	sata_cmd.sata_fis = task->ata_task.fis;
+	if (likely(!task->ata_task.device_control_reg_update))
+		sata_cmd.sata_fis.flags |= 0x80;/* C=1: update ATA cmd reg */
+	sata_cmd.sata_fis.flags &= 0xF0;/* PM_PORT field shall be 0 */
+	/* fill in PRD (scatter/gather) table, if any */
+	if (task->num_scatter > 1) {
+		pm8001_chip_make_sg(task->scatter, ccb->n_elem, ccb->buf_prd);
+		phys_addr = cpu_to_le64(ccb->ccb_dma_handle +
+				offsetof(struct pm8001_ccb_info, buf_prd[0]));
+		sata_cmd.addr_low = lower_32_bits(phys_addr);
+		sata_cmd.addr_high = upper_32_bits(phys_addr);
+		sata_cmd.esgl = cpu_to_le32(1 << 31);
+	} else if (task->num_scatter == 1) {
+		__le64 dma_addr = cpu_to_le64(sg_dma_address(task->scatter));
+		sata_cmd.addr_low = lower_32_bits(dma_addr);
+		sata_cmd.addr_high = upper_32_bits(dma_addr);
+		sata_cmd.len = cpu_to_le32(task->total_xfer_len);
+		sata_cmd.esgl = 0;
+	} else if (task->num_scatter == 0) {
+		sata_cmd.addr_low = 0;
+		sata_cmd.addr_high = 0;
+		sata_cmd.len = cpu_to_le32(task->total_xfer_len);
+		sata_cmd.esgl = 0;
+	}
+	ret = mpi_build_cmd(pm8001_ha, circularQ, opc, &sata_cmd);
+	return ret;
+}
+
+/**
+ * pm8001_chip_phy_start_req - start phy via PHY_START COMMAND
+ * @pm8001_ha: our hba card information.
+ * @num: the inbound queue number
+ * @phy_id: the phy id which we wanted to start up.
+ */
+static int
+pm8001_chip_phy_start_req(struct pm8001_hba_info *pm8001_ha, u8 phy_id)
+{
+	struct phy_start_req payload;
+	struct inbound_queue_table *circularQ;
+	int ret;
+	u32 tag = 0x01;
+	u32 opcode = OPC_INB_PHYSTART;
+	circularQ = &pm8001_ha->inbnd_q_tbl[0];
+	memset(&payload, 0, sizeof(payload));
+	payload.tag = cpu_to_le32(tag);
+	/*
+	 ** [0:7]   PHY Identifier
+	 ** [8:11]  link rate 1.5G, 3G, 6G
+	 ** [12:13] link mode 01b SAS mode; 10b SATA mode; 11b both
+	 ** [14]    0b disable spin up hold; 1b enable spin up hold
+	 */
+	payload.ase_sh_lm_slr_phyid = cpu_to_le32(SPINHOLD_DISABLE |
+		LINKMODE_AUTO |	LINKRATE_15 |
+		LINKRATE_30 | LINKRATE_60 | phy_id);
+	payload.sas_identify.dev_type = SAS_END_DEV;
+	payload.sas_identify.initiator_bits = SAS_PROTOCOL_ALL;
+	memcpy(payload.sas_identify.sas_addr,
+		pm8001_ha->sas_addr, SAS_ADDR_SIZE);
+	payload.sas_identify.phy_id = phy_id;
+	ret = mpi_build_cmd(pm8001_ha, circularQ, opcode, &payload);
+	return ret;
+}
+
+/**
+ * pm8001_chip_phy_stop_req - start phy via PHY_STOP COMMAND
+ * @pm8001_ha: our hba card information.
+ * @num: the inbound queue number
+ * @phy_id: the phy id which we wanted to start up.
+ */
+static int pm8001_chip_phy_stop_req(struct pm8001_hba_info *pm8001_ha,
+	u8 phy_id)
+{
+	struct phy_stop_req payload;
+	struct inbound_queue_table *circularQ;
+	int ret;
+	u32 tag = 0x01;
+	u32 opcode = OPC_INB_PHYSTOP;
+	circularQ = &pm8001_ha->inbnd_q_tbl[0];
+	memset(&payload, 0, sizeof(payload));
+	payload.tag = cpu_to_le32(tag);
+	payload.phy_id = cpu_to_le32(phy_id);
+	ret = mpi_build_cmd(pm8001_ha, circularQ, opcode, &payload);
+	return ret;
+}
+
+/**
+ * see comments on mpi_reg_resp.
+ */
+static int pm8001_chip_reg_dev_req(struct pm8001_hba_info *pm8001_ha,
+	struct pm8001_device *pm8001_dev, u32 flag)
+{
+	struct reg_dev_req payload;
+	u32	opc;
+	u32 stp_sspsmp_sata = 0x4;
+	struct inbound_queue_table *circularQ;
+	u32 linkrate, phy_id;
+	int rc, tag = 0xdeadbeef;
+	struct pm8001_ccb_info *ccb;
+	u8 retryFlag = 0x1;
+	u16 firstBurstSize = 0;
+	u16 ITNT = 2000;
+	struct domain_device *dev = pm8001_dev->sas_device;
+	struct domain_device *parent_dev = dev->parent;
+	circularQ = &pm8001_ha->inbnd_q_tbl[0];
+
+	memset(&payload, 0, sizeof(payload));
+	rc = pm8001_tag_alloc(pm8001_ha, &tag);
+	if (rc)
+		return rc;
+	ccb = &pm8001_ha->ccb_info[tag];
+	ccb->device = pm8001_dev;
+	ccb->ccb_tag = tag;
+	payload.tag = cpu_to_le32(tag);
+	if (flag == 1)
+		stp_sspsmp_sata = 0x02; /*direct attached sata */
+	else {
+		if (pm8001_dev->dev_type == SATA_DEV)
+			stp_sspsmp_sata = 0x00; /* stp*/
+		else if (pm8001_dev->dev_type == SAS_END_DEV ||
+			pm8001_dev->dev_type == EDGE_DEV ||
+			pm8001_dev->dev_type == FANOUT_DEV)
+			stp_sspsmp_sata = 0x01; /*ssp or smp*/
+	}
+	if (parent_dev && DEV_IS_EXPANDER(parent_dev->dev_type))
+		phy_id = parent_dev->ex_dev.ex_phy->phy_id;
+	else
+		phy_id = pm8001_dev->attached_phy;
+	opc = OPC_INB_REG_DEV;
+	linkrate = (pm8001_dev->sas_device->linkrate < dev->port->linkrate) ?
+			pm8001_dev->sas_device->linkrate : dev->port->linkrate;
+	payload.phyid_portid =
+		cpu_to_le32(((pm8001_dev->sas_device->port->id) & 0x0F) |
+		((phy_id & 0x0F) << 4));
+	payload.dtype_dlr_retry = cpu_to_le32((retryFlag & 0x01) |
+		((linkrate & 0x0F) * 0x1000000) |
+		((stp_sspsmp_sata & 0x03) * 0x10000000));
+	payload.firstburstsize_ITNexustimeout =
+		cpu_to_le32(ITNT | (firstBurstSize * 0x10000));
+	memcpy(payload.sas_addr, pm8001_dev->sas_device->sas_addr,
+		SAS_ADDR_SIZE);
+	rc = mpi_build_cmd(pm8001_ha, circularQ, opc, &payload);
+	return rc;
+}
+
+/**
+ * see comments on mpi_reg_resp.
+ */
+static int pm8001_chip_dereg_dev_req(struct pm8001_hba_info *pm8001_ha,
+	u32 device_id)
+{
+	struct dereg_dev_req payload;
+	u32 opc = OPC_INB_DEREG_DEV_HANDLE;
+	int ret;
+	struct inbound_queue_table *circularQ;
+
+	circularQ = &pm8001_ha->inbnd_q_tbl[0];
+	memset(&payload, 0, sizeof(payload));
+	payload.tag = 1;
+	payload.device_id = cpu_to_le32(device_id);
+	PM8001_MSG_DBG(pm8001_ha,
+		pm8001_printk("unregister device device_id = %d\n", device_id));
+	ret = mpi_build_cmd(pm8001_ha, circularQ, opc, &payload);
+	return ret;
+}
+
+/**
+ * pm8001_chip_phy_ctl_req - support the local phy operation
+ * @pm8001_ha: our hba card information.
+ * @num: the inbound queue number
+ * @phy_id: the phy id which we wanted to operate
+ * @phy_op:
+ */
+static int pm8001_chip_phy_ctl_req(struct pm8001_hba_info *pm8001_ha,
+	u32 phyId, u32 phy_op)
+{
+	struct local_phy_ctl_req payload;
+	struct inbound_queue_table *circularQ;
+	int ret;
+	u32 opc = OPC_INB_LOCAL_PHY_CONTROL;
+	memset(&payload, 0, sizeof(payload));
+	circularQ = &pm8001_ha->inbnd_q_tbl[0];
+	payload.tag = 1;
+	payload.phyop_phyid =
+		cpu_to_le32(((phy_op & 0xff) << 8) | (phyId & 0x0F));
+	ret = mpi_build_cmd(pm8001_ha, circularQ, opc, &payload);
+	return ret;
+}
+
+static u32 pm8001_chip_is_our_interupt(struct pm8001_hba_info *pm8001_ha)
+{
+	u32 value;
+#ifdef PM8001_USE_MSIX
+	return 1;
+#endif
+	value = pm8001_cr32(pm8001_ha, 0, MSGU_ODR);
+	if (value)
+		return 1;
+	return 0;
+
+}
+
+/**
+ * pm8001_chip_isr - PM8001 isr handler.
+ * @pm8001_ha: our hba card information.
+ * @irq: irq number.
+ * @stat: stat.
+ */
+static irqreturn_t
+pm8001_chip_isr(struct pm8001_hba_info *pm8001_ha)
+{
+	unsigned long flags;
+	spin_lock_irqsave(&pm8001_ha->lock, flags);
+	pm8001_chip_interrupt_disable(pm8001_ha);
+	process_oq(pm8001_ha);
+	pm8001_chip_interrupt_enable(pm8001_ha);
+	spin_unlock_irqrestore(&pm8001_ha->lock, flags);
+	return IRQ_HANDLED;
+}
+
+static int send_task_abort(struct pm8001_hba_info *pm8001_ha, u32 opc,
+	u32 dev_id, u8 flag, u32 task_tag, u32 cmd_tag)
+{
+	struct task_abort_req task_abort;
+	struct inbound_queue_table *circularQ;
+	int ret;
+	circularQ = &pm8001_ha->inbnd_q_tbl[0];
+	memset(&task_abort, 0, sizeof(task_abort));
+	if (ABORT_SINGLE == (flag & ABORT_MASK)) {
+		task_abort.abort_all = 0;
+		task_abort.device_id = cpu_to_le32(dev_id);
+		task_abort.tag_to_abort = cpu_to_le32(task_tag);
+		task_abort.tag = cpu_to_le32(cmd_tag);
+	} else if (ABORT_ALL == (flag & ABORT_MASK)) {
+		task_abort.abort_all = cpu_to_le32(1);
+		task_abort.device_id = cpu_to_le32(dev_id);
+		task_abort.tag = cpu_to_le32(cmd_tag);
+	}
+	ret = mpi_build_cmd(pm8001_ha, circularQ, opc, &task_abort);
+	return ret;
+}
+
+/**
+ * pm8001_chip_abort_task - SAS abort task when error or exception happened.
+ * @task: the task we wanted to aborted.
+ * @flag: the abort flag.
+ */
+static int pm8001_chip_abort_task(struct pm8001_hba_info *pm8001_ha,
+	struct pm8001_device *pm8001_dev, u8 flag, u32 task_tag, u32 cmd_tag)
+{
+	u32 opc, device_id;
+	int rc = TMF_RESP_FUNC_FAILED;
+	PM8001_EH_DBG(pm8001_ha, pm8001_printk("cmd_tag = %x, abort task tag"
+		" = %x", cmd_tag, task_tag));
+	if (pm8001_dev->dev_type == SAS_END_DEV)
+		opc = OPC_INB_SSP_ABORT;
+	else if (pm8001_dev->dev_type == SATA_DEV)
+		opc = OPC_INB_SATA_ABORT;
+	else
+		opc = OPC_INB_SMP_ABORT;/* SMP */
+	device_id = pm8001_dev->device_id;
+	rc = send_task_abort(pm8001_ha, opc, device_id, flag,
+		task_tag, cmd_tag);
+	if (rc != TMF_RESP_FUNC_COMPLETE)
+		PM8001_EH_DBG(pm8001_ha, pm8001_printk("rc= %d\n", rc));
+	return rc;
+}
+
+/**
+ * pm8001_chip_ssp_tm_req - built the task managment command.
+ * @pm8001_ha: our hba card information.
+ * @ccb: the ccb information.
+ * @tmf: task management function.
+ */
+static int pm8001_chip_ssp_tm_req(struct pm8001_hba_info *pm8001_ha,
+	struct pm8001_ccb_info *ccb, struct pm8001_tmf_task *tmf)
+{
+	struct sas_task *task = ccb->task;
+	struct domain_device *dev = task->dev;
+	struct pm8001_device *pm8001_dev = dev->lldd_dev;
+	u32 opc = OPC_INB_SSPINITMSTART;
+	struct inbound_queue_table *circularQ;
+	struct ssp_ini_tm_start_req sspTMCmd;
+	int ret;
+
+	memset(&sspTMCmd, 0, sizeof(sspTMCmd));
+	sspTMCmd.device_id = cpu_to_le32(pm8001_dev->device_id);
+	sspTMCmd.relate_tag = cpu_to_le32(tmf->tag_of_task_to_be_managed);
+	sspTMCmd.tmf = cpu_to_le32(tmf->tmf);
+	memcpy(sspTMCmd.lun, task->ssp_task.LUN, 8);
+	sspTMCmd.tag = cpu_to_le32(ccb->ccb_tag);
+	circularQ = &pm8001_ha->inbnd_q_tbl[0];
+	ret = mpi_build_cmd(pm8001_ha, circularQ, opc, &sspTMCmd);
+	return ret;
+}
+
+static int pm8001_chip_get_nvmd_req(struct pm8001_hba_info *pm8001_ha,
+	void *payload)
+{
+	u32 opc = OPC_INB_GET_NVMD_DATA;
+	u32 nvmd_type;
+	int rc;
+	u32 tag;
+	struct pm8001_ccb_info *ccb;
+	struct inbound_queue_table *circularQ;
+	struct get_nvm_data_req nvmd_req;
+	struct fw_control_ex *fw_control_context;
+	struct pm8001_ioctl_payload *ioctl_payload = payload;
+
+	nvmd_type = ioctl_payload->minor_function;
+	fw_control_context = kzalloc(sizeof(struct fw_control_ex), GFP_KERNEL);
+	fw_control_context->usrAddr = (u8 *)&ioctl_payload->func_specific[0];
+	fw_control_context->len = ioctl_payload->length;
+	circularQ = &pm8001_ha->inbnd_q_tbl[0];
+	memset(&nvmd_req, 0, sizeof(nvmd_req));
+	rc = pm8001_tag_alloc(pm8001_ha, &tag);
+	if (rc)
+		return rc;
+	ccb = &pm8001_ha->ccb_info[tag];
+	ccb->ccb_tag = tag;
+	ccb->fw_control_context = fw_control_context;
+	nvmd_req.tag = cpu_to_le32(tag);
+
+	switch (nvmd_type) {
+	case TWI_DEVICE: {
+		u32 twi_addr, twi_page_size;
+		twi_addr = 0xa8;
+		twi_page_size = 2;
+
+		nvmd_req.len_ir_vpdd = cpu_to_le32(IPMode | twi_addr << 16 |
+			twi_page_size << 8 | TWI_DEVICE);
+		nvmd_req.resp_len = cpu_to_le32(ioctl_payload->length);
+		nvmd_req.resp_addr_hi =
+		    cpu_to_le32(pm8001_ha->memoryMap.region[NVMD].phys_addr_hi);
+		nvmd_req.resp_addr_lo =
+		    cpu_to_le32(pm8001_ha->memoryMap.region[NVMD].phys_addr_lo);
+		break;
+	}
+	case C_SEEPROM: {
+		nvmd_req.len_ir_vpdd = cpu_to_le32(IPMode | C_SEEPROM);
+		nvmd_req.resp_len = cpu_to_le32(ioctl_payload->length);
+		nvmd_req.resp_addr_hi =
+		    cpu_to_le32(pm8001_ha->memoryMap.region[NVMD].phys_addr_hi);
+		nvmd_req.resp_addr_lo =
+		    cpu_to_le32(pm8001_ha->memoryMap.region[NVMD].phys_addr_lo);
+		break;
+	}
+	case VPD_FLASH: {
+		nvmd_req.len_ir_vpdd = cpu_to_le32(IPMode | VPD_FLASH);
+		nvmd_req.resp_len = cpu_to_le32(ioctl_payload->length);
+		nvmd_req.resp_addr_hi =
+		    cpu_to_le32(pm8001_ha->memoryMap.region[NVMD].phys_addr_hi);
+		nvmd_req.resp_addr_lo =
+		    cpu_to_le32(pm8001_ha->memoryMap.region[NVMD].phys_addr_lo);
+		break;
+	}
+	case EXPAN_ROM: {
+		nvmd_req.len_ir_vpdd = cpu_to_le32(IPMode | EXPAN_ROM);
+		nvmd_req.resp_len = cpu_to_le32(ioctl_payload->length);
+		nvmd_req.resp_addr_hi =
+		    cpu_to_le32(pm8001_ha->memoryMap.region[NVMD].phys_addr_hi);
+		nvmd_req.resp_addr_lo =
+		    cpu_to_le32(pm8001_ha->memoryMap.region[NVMD].phys_addr_lo);
+		break;
+	}
+	default:
+		break;
+	}
+	rc = mpi_build_cmd(pm8001_ha, circularQ, opc, &nvmd_req);
+	return rc;
+}
+
+static int pm8001_chip_set_nvmd_req(struct pm8001_hba_info *pm8001_ha,
+	void *payload)
+{
+	u32 opc = OPC_INB_SET_NVMD_DATA;
+	u32 nvmd_type;
+	int rc;
+	u32 tag;
+	struct pm8001_ccb_info *ccb;
+	struct inbound_queue_table *circularQ;
+	struct set_nvm_data_req nvmd_req;
+	struct fw_control_ex *fw_control_context;
+	struct pm8001_ioctl_payload *ioctl_payload = payload;
+
+	nvmd_type = ioctl_payload->minor_function;
+	fw_control_context = kzalloc(sizeof(struct fw_control_ex), GFP_KERNEL);
+	circularQ = &pm8001_ha->inbnd_q_tbl[0];
+	memcpy(pm8001_ha->memoryMap.region[NVMD].virt_ptr,
+		ioctl_payload->func_specific,
+		ioctl_payload->length);
+	memset(&nvmd_req, 0, sizeof(nvmd_req));
+	rc = pm8001_tag_alloc(pm8001_ha, &tag);
+	if (rc)
+		return rc;
+	ccb = &pm8001_ha->ccb_info[tag];
+	ccb->fw_control_context = fw_control_context;
+	ccb->ccb_tag = tag;
+	nvmd_req.tag = cpu_to_le32(tag);
+	switch (nvmd_type) {
+	case TWI_DEVICE: {
+		u32 twi_addr, twi_page_size;
+		twi_addr = 0xa8;
+		twi_page_size = 2;
+		nvmd_req.reserved[0] = cpu_to_le32(0xFEDCBA98);
+		nvmd_req.len_ir_vpdd = cpu_to_le32(IPMode | twi_addr << 16 |
+			twi_page_size << 8 | TWI_DEVICE);
+		nvmd_req.resp_len = cpu_to_le32(ioctl_payload->length);
+		nvmd_req.resp_addr_hi =
+		    cpu_to_le32(pm8001_ha->memoryMap.region[NVMD].phys_addr_hi);
+		nvmd_req.resp_addr_lo =
+		    cpu_to_le32(pm8001_ha->memoryMap.region[NVMD].phys_addr_lo);
+		break;
+	}
+	case C_SEEPROM:
+		nvmd_req.len_ir_vpdd = cpu_to_le32(IPMode | C_SEEPROM);
+		nvmd_req.resp_len = cpu_to_le32(ioctl_payload->length);
+		nvmd_req.reserved[0] = cpu_to_le32(0xFEDCBA98);
+		nvmd_req.resp_addr_hi =
+		    cpu_to_le32(pm8001_ha->memoryMap.region[NVMD].phys_addr_hi);
+		nvmd_req.resp_addr_lo =
+		    cpu_to_le32(pm8001_ha->memoryMap.region[NVMD].phys_addr_lo);
+		break;
+	case VPD_FLASH:
+		nvmd_req.len_ir_vpdd = cpu_to_le32(IPMode | VPD_FLASH);
+		nvmd_req.resp_len = cpu_to_le32(ioctl_payload->length);
+		nvmd_req.reserved[0] = cpu_to_le32(0xFEDCBA98);
+		nvmd_req.resp_addr_hi =
+		    cpu_to_le32(pm8001_ha->memoryMap.region[NVMD].phys_addr_hi);
+		nvmd_req.resp_addr_lo =
+		    cpu_to_le32(pm8001_ha->memoryMap.region[NVMD].phys_addr_lo);
+		break;
+	case EXPAN_ROM:
+		nvmd_req.len_ir_vpdd = cpu_to_le32(IPMode | EXPAN_ROM);
+		nvmd_req.resp_len = cpu_to_le32(ioctl_payload->length);
+		nvmd_req.reserved[0] = cpu_to_le32(0xFEDCBA98);
+		nvmd_req.resp_addr_hi =
+		    cpu_to_le32(pm8001_ha->memoryMap.region[NVMD].phys_addr_hi);
+		nvmd_req.resp_addr_lo =
+		    cpu_to_le32(pm8001_ha->memoryMap.region[NVMD].phys_addr_lo);
+		break;
+	default:
+		break;
+	}
+	rc = mpi_build_cmd(pm8001_ha, circularQ, opc, &nvmd_req);
+	return rc;
+}
+
+/**
+ * pm8001_chip_fw_flash_update_build - support the firmware update operation
+ * @pm8001_ha: our hba card information.
+ * @fw_flash_updata_info: firmware flash update param
+ */
+static int
+pm8001_chip_fw_flash_update_build(struct pm8001_hba_info *pm8001_ha,
+	void *fw_flash_updata_info, u32 tag)
+{
+	struct fw_flash_Update_req payload;
+	struct fw_flash_updata_info *info;
+	struct inbound_queue_table *circularQ;
+	int ret;
+	u32 opc = OPC_INB_FW_FLASH_UPDATE;
+
+	memset(&payload, 0, sizeof(struct fw_flash_Update_req));
+	circularQ = &pm8001_ha->inbnd_q_tbl[0];
+	info = fw_flash_updata_info;
+	payload.tag = cpu_to_le32(tag);
+	payload.cur_image_len = cpu_to_le32(info->cur_image_len);
+	payload.cur_image_offset = cpu_to_le32(info->cur_image_offset);
+	payload.total_image_len = cpu_to_le32(info->total_image_len);
+	payload.len = info->sgl.im_len.len ;
+	payload.sgl_addr_lo = lower_32_bits(info->sgl.addr);
+	payload.sgl_addr_hi = upper_32_bits(info->sgl.addr);
+	ret = mpi_build_cmd(pm8001_ha, circularQ, opc, &payload);
+	return ret;
+}
+
+static int
+pm8001_chip_fw_flash_update_req(struct pm8001_hba_info *pm8001_ha,
+	void *payload)
+{
+	struct fw_flash_updata_info flash_update_info;
+	struct fw_control_info *fw_control;
+	struct fw_control_ex *fw_control_context;
+	int rc;
+	u32 tag;
+	struct pm8001_ccb_info *ccb;
+	void *buffer = NULL;
+	dma_addr_t phys_addr;
+	u32 phys_addr_hi;
+	u32 phys_addr_lo;
+	struct pm8001_ioctl_payload *ioctl_payload = payload;
+
+	fw_control_context = kzalloc(sizeof(struct fw_control_ex), GFP_KERNEL);
+	fw_control = (struct fw_control_info *)&ioctl_payload->func_specific[0];
+	if (fw_control->len != 0) {
+		if (pm8001_mem_alloc(pm8001_ha->pdev,
+			(void **)&buffer,
+			&phys_addr,
+			&phys_addr_hi,
+			&phys_addr_lo,
+			fw_control->len, 0) != 0) {
+				PM8001_FAIL_DBG(pm8001_ha,
+					pm8001_printk("Mem alloc failure\n"));
+				return -ENOMEM;
+		}
+	}
+	memset(buffer, 0, fw_control->len);
+	memcpy(buffer, fw_control->buffer, fw_control->len);
+	flash_update_info.sgl.addr = cpu_to_le64(phys_addr);
+	flash_update_info.sgl.im_len.len = cpu_to_le32(fw_control->len);
+	flash_update_info.sgl.im_len.e = 0;
+	flash_update_info.cur_image_offset = fw_control->offset;
+	flash_update_info.cur_image_len = fw_control->len;
+	flash_update_info.total_image_len = fw_control->size;
+	fw_control_context->fw_control = fw_control;
+	fw_control_context->virtAddr = buffer;
+	fw_control_context->len = fw_control->len;
+	rc = pm8001_tag_alloc(pm8001_ha, &tag);
+	if (rc)
+		return rc;
+	ccb = &pm8001_ha->ccb_info[tag];
+	ccb->fw_control_context = fw_control_context;
+	ccb->ccb_tag = tag;
+	rc = pm8001_chip_fw_flash_update_build(pm8001_ha, &flash_update_info,
+		tag);
+	return rc;
+}
+
+static int
+pm8001_chip_set_dev_state_req(struct pm8001_hba_info *pm8001_ha,
+	struct pm8001_device *pm8001_dev, u32 state)
+{
+	struct set_dev_state_req payload;
+	struct inbound_queue_table *circularQ;
+	struct pm8001_ccb_info *ccb;
+	int rc;
+	u32 tag;
+	u32 opc = OPC_INB_SET_DEVICE_STATE;
+	memset(&payload, 0, sizeof(payload));
+	rc = pm8001_tag_alloc(pm8001_ha, &tag);
+	if (rc)
+		return -1;
+	ccb = &pm8001_ha->ccb_info[tag];
+	ccb->ccb_tag = tag;
+	ccb->device = pm8001_dev;
+	circularQ = &pm8001_ha->inbnd_q_tbl[0];
+	payload.tag = cpu_to_le32(tag);
+	payload.device_id = cpu_to_le32(pm8001_dev->device_id);
+	payload.nds = cpu_to_le32(state);
+	rc = mpi_build_cmd(pm8001_ha, circularQ, opc, &payload);
+	return rc;
+
+}
+
+static int
+pm8001_chip_sas_re_initialization(struct pm8001_hba_info *pm8001_ha)
+{
+	struct sas_re_initialization_req payload;
+	struct inbound_queue_table *circularQ;
+	struct pm8001_ccb_info *ccb;
+	int rc;
+	u32 tag;
+	u32 opc = OPC_INB_SAS_RE_INITIALIZE;
+	memset(&payload, 0, sizeof(payload));
+	rc = pm8001_tag_alloc(pm8001_ha, &tag);
+	if (rc)
+		return -1;
+	ccb = &pm8001_ha->ccb_info[tag];
+	ccb->ccb_tag = tag;
+	circularQ = &pm8001_ha->inbnd_q_tbl[0];
+	payload.tag = cpu_to_le32(tag);
+	payload.SSAHOLT = cpu_to_le32(0xd << 25);
+	payload.sata_hol_tmo = cpu_to_le32(80);
+	payload.open_reject_cmdretries_data_retries = cpu_to_le32(0xff00ff);
+	rc = mpi_build_cmd(pm8001_ha, circularQ, opc, &payload);
+	return rc;
+
+}
+
+const struct pm8001_dispatch pm8001_8001_dispatch = {
+	.name			= "pmc8001",
+	.chip_init		= pm8001_chip_init,
+	.chip_soft_rst		= pm8001_chip_soft_rst,
+	.chip_rst		= pm8001_hw_chip_rst,
+	.chip_iounmap		= pm8001_chip_iounmap,
+	.isr			= pm8001_chip_isr,
+	.is_our_interupt	= pm8001_chip_is_our_interupt,
+	.isr_process_oq		= process_oq,
+	.interrupt_enable 	= pm8001_chip_interrupt_enable,
+	.interrupt_disable	= pm8001_chip_interrupt_disable,
+	.make_prd		= pm8001_chip_make_sg,
+	.smp_req		= pm8001_chip_smp_req,
+	.ssp_io_req		= pm8001_chip_ssp_io_req,
+	.sata_req		= pm8001_chip_sata_req,
+	.phy_start_req		= pm8001_chip_phy_start_req,
+	.phy_stop_req		= pm8001_chip_phy_stop_req,
+	.reg_dev_req		= pm8001_chip_reg_dev_req,
+	.dereg_dev_req		= pm8001_chip_dereg_dev_req,
+	.phy_ctl_req		= pm8001_chip_phy_ctl_req,
+	.task_abort		= pm8001_chip_abort_task,
+	.ssp_tm_req		= pm8001_chip_ssp_tm_req,
+	.get_nvmd_req		= pm8001_chip_get_nvmd_req,
+	.set_nvmd_req		= pm8001_chip_set_nvmd_req,
+	.fw_flash_update_req	= pm8001_chip_fw_flash_update_req,
+	.set_dev_state_req	= pm8001_chip_set_dev_state_req,
+	.sas_re_init_req	= pm8001_chip_sas_re_initialization,
+};
+
diff --git a/drivers/scsi/pm8001/pm8001_hwi.h b/drivers/scsi/pm8001/pm8001_hwi.h
new file mode 100644
index 000000000000..833a5201eda4
--- /dev/null
+++ b/drivers/scsi/pm8001/pm8001_hwi.h
@@ -0,0 +1,1029 @@
+/*
+ * PMC-Sierra SPC 8001 SAS/SATA based host adapters driver
+ *
+ * Copyright (c) 2008-2009 USI Co., Ltd.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ *
+ */
+#ifndef _PMC8001_REG_H_
+#define _PMC8001_REG_H_
+
+#include <linux/types.h>
+#include <scsi/libsas.h>
+
+
+/* for Request Opcode of IOMB */
+#define OPC_INB_ECHO				1	/* 0x000 */
+#define OPC_INB_PHYSTART			4	/* 0x004 */
+#define OPC_INB_PHYSTOP				5	/* 0x005 */
+#define OPC_INB_SSPINIIOSTART			6	/* 0x006 */
+#define OPC_INB_SSPINITMSTART			7	/* 0x007 */
+#define OPC_INB_SSPINIEXTIOSTART		8	/* 0x008 */
+#define OPC_INB_DEV_HANDLE_ACCEPT		9	/* 0x009 */
+#define OPC_INB_SSPTGTIOSTART			10	/* 0x00A */
+#define OPC_INB_SSPTGTRSPSTART			11	/* 0x00B */
+#define OPC_INB_SSPINIEDCIOSTART		12	/* 0x00C */
+#define OPC_INB_SSPINIEXTEDCIOSTART		13	/* 0x00D */
+#define OPC_INB_SSPTGTEDCIOSTART		14	/* 0x00E */
+#define OPC_INB_SSP_ABORT			15	/* 0x00F */
+#define OPC_INB_DEREG_DEV_HANDLE		16	/* 0x010 */
+#define OPC_INB_GET_DEV_HANDLE			17	/* 0x011 */
+#define OPC_INB_SMP_REQUEST			18	/* 0x012 */
+/* SMP_RESPONSE is removed */
+#define OPC_INB_SMP_RESPONSE			19	/* 0x013 */
+#define OPC_INB_SMP_ABORT			20	/* 0x014 */
+#define OPC_INB_REG_DEV				22	/* 0x016 */
+#define OPC_INB_SATA_HOST_OPSTART		23	/* 0x017 */
+#define OPC_INB_SATA_ABORT			24	/* 0x018 */
+#define OPC_INB_LOCAL_PHY_CONTROL		25	/* 0x019 */
+#define OPC_INB_GET_DEV_INFO			26	/* 0x01A */
+#define OPC_INB_FW_FLASH_UPDATE			32	/* 0x020 */
+#define OPC_INB_GPIO				34	/* 0x022 */
+#define OPC_INB_SAS_DIAG_MODE_START_END		35	/* 0x023 */
+#define OPC_INB_SAS_DIAG_EXECUTE		36	/* 0x024 */
+#define OPC_INB_SAS_HW_EVENT_ACK		37	/* 0x025 */
+#define OPC_INB_GET_TIME_STAMP			38	/* 0x026 */
+#define OPC_INB_PORT_CONTROL			39	/* 0x027 */
+#define OPC_INB_GET_NVMD_DATA			40	/* 0x028 */
+#define OPC_INB_SET_NVMD_DATA			41	/* 0x029 */
+#define OPC_INB_SET_DEVICE_STATE		42	/* 0x02A */
+#define OPC_INB_GET_DEVICE_STATE		43	/* 0x02B */
+#define OPC_INB_SET_DEV_INFO			44	/* 0x02C */
+#define OPC_INB_SAS_RE_INITIALIZE		45	/* 0x02D */
+
+/* for Response Opcode of IOMB */
+#define OPC_OUB_ECHO				1	/* 0x001 */
+#define OPC_OUB_HW_EVENT			4	/* 0x004 */
+#define OPC_OUB_SSP_COMP			5	/* 0x005 */
+#define OPC_OUB_SMP_COMP			6	/* 0x006 */
+#define OPC_OUB_LOCAL_PHY_CNTRL			7	/* 0x007 */
+#define OPC_OUB_DEV_REGIST			10	/* 0x00A */
+#define OPC_OUB_DEREG_DEV			11	/* 0x00B */
+#define OPC_OUB_GET_DEV_HANDLE			12	/* 0x00C */
+#define OPC_OUB_SATA_COMP			13	/* 0x00D */
+#define OPC_OUB_SATA_EVENT			14	/* 0x00E */
+#define OPC_OUB_SSP_EVENT			15	/* 0x00F */
+#define OPC_OUB_DEV_HANDLE_ARRIV		16	/* 0x010 */
+/* SMP_RECEIVED Notification is removed */
+#define OPC_OUB_SMP_RECV_EVENT			17	/* 0x011 */
+#define OPC_OUB_SSP_RECV_EVENT			18	/* 0x012 */
+#define OPC_OUB_DEV_INFO			19	/* 0x013 */
+#define OPC_OUB_FW_FLASH_UPDATE			20	/* 0x014 */
+#define OPC_OUB_GPIO_RESPONSE			22	/* 0x016 */
+#define OPC_OUB_GPIO_EVENT			23	/* 0x017 */
+#define OPC_OUB_GENERAL_EVENT			24	/* 0x018 */
+#define OPC_OUB_SSP_ABORT_RSP			26	/* 0x01A */
+#define OPC_OUB_SATA_ABORT_RSP			27	/* 0x01B */
+#define OPC_OUB_SAS_DIAG_MODE_START_END		28	/* 0x01C */
+#define OPC_OUB_SAS_DIAG_EXECUTE		29	/* 0x01D */
+#define OPC_OUB_GET_TIME_STAMP			30	/* 0x01E */
+#define OPC_OUB_SAS_HW_EVENT_ACK		31	/* 0x01F */
+#define OPC_OUB_PORT_CONTROL			32	/* 0x020 */
+#define OPC_OUB_SKIP_ENTRY			33	/* 0x021 */
+#define OPC_OUB_SMP_ABORT_RSP			34	/* 0x022 */
+#define OPC_OUB_GET_NVMD_DATA			35	/* 0x023 */
+#define OPC_OUB_SET_NVMD_DATA			36	/* 0x024 */
+#define OPC_OUB_DEVICE_HANDLE_REMOVAL		37	/* 0x025 */
+#define OPC_OUB_SET_DEVICE_STATE		38	/* 0x026 */
+#define OPC_OUB_GET_DEVICE_STATE		39	/* 0x027 */
+#define OPC_OUB_SET_DEV_INFO			40	/* 0x028 */
+#define OPC_OUB_SAS_RE_INITIALIZE		41	/* 0x029 */
+
+/* for phy start*/
+#define SPINHOLD_DISABLE		(0x00 << 14)
+#define SPINHOLD_ENABLE			(0x01 << 14)
+#define LINKMODE_SAS			(0x01 << 12)
+#define LINKMODE_DSATA			(0x02 << 12)
+#define LINKMODE_AUTO			(0x03 << 12)
+#define LINKRATE_15			(0x01 << 8)
+#define LINKRATE_30			(0x02 << 8)
+#define LINKRATE_60			(0x04 << 8)
+
+struct mpi_msg_hdr{
+	__le32	header;	/* Bits [11:0]  - Message operation code */
+	/* Bits [15:12] - Message Category */
+	/* Bits [21:16] - Outboundqueue ID for the
+	operation completion message */
+	/* Bits [23:22] - Reserved */
+	/* Bits [28:24] - Buffer Count, indicates how
+	many buffer are allocated for the massage */
+	/* Bits [30:29] - Reserved */
+	/* Bits [31] - Message Valid bit */
+} __attribute__((packed, aligned(4)));
+
+
+/*
+ * brief the data structure of PHY Start Command
+ * use to describe enable the phy (64 bytes)
+ */
+struct phy_start_req {
+	__le32	tag;
+	__le32	ase_sh_lm_slr_phyid;
+	struct sas_identify_frame sas_identify;
+	u32	reserved[5];
+} __attribute__((packed, aligned(4)));
+
+
+/*
+ * brief the data structure of PHY Start Command
+ * use to disable the phy (64 bytes)
+ */
+struct phy_stop_req {
+	__le32	tag;
+	__le32	phy_id;
+	u32	reserved[13];
+} __attribute__((packed, aligned(4)));
+
+
+/* set device bits fis - device to host */
+struct  set_dev_bits_fis {
+	u8	fis_type;	/* 0xA1*/
+	u8	n_i_pmport;
+	/* b7 : n Bit. Notification bit. If set device needs attention. */
+	/* b6 : i Bit. Interrupt Bit */
+	/* b5-b4: reserved2 */
+	/* b3-b0: PM Port */
+	u8 	status;
+	u8	error;
+	u32	_r_a;
+} __attribute__ ((packed));
+/* PIO setup FIS - device to host */
+struct  pio_setup_fis {
+	u8	fis_type;	/* 0x5f */
+	u8	i_d_pmPort;
+	/* b7 : reserved */
+	/* b6 : i bit. Interrupt bit */
+	/* b5 : d bit. data transfer direction. set to 1 for device to host
+	xfer */
+	/* b4 : reserved */
+	/* b3-b0: PM Port */
+	u8	status;
+	u8	error;
+	u8	lbal;
+	u8	lbam;
+	u8	lbah;
+	u8	device;
+	u8	lbal_exp;
+	u8	lbam_exp;
+	u8	lbah_exp;
+	u8	_r_a;
+	u8	sector_count;
+	u8	sector_count_exp;
+	u8	_r_b;
+	u8	e_status;
+	u8	_r_c[2];
+	u8	transfer_count;
+} __attribute__ ((packed));
+
+/*
+ * brief the data structure of SATA Completion Response
+ * use to discribe the sata task response (64 bytes)
+ */
+struct sata_completion_resp {
+	__le32	tag;
+	__le32	status;
+	__le32	param;
+	u32	sata_resp[12];
+} __attribute__((packed, aligned(4)));
+
+
+/*
+ * brief the data structure of SAS HW Event Notification
+ * use to alert the host about the hardware event(64 bytes)
+ */
+struct hw_event_resp {
+	__le32	lr_evt_status_phyid_portid;
+	__le32	evt_param;
+	__le32	npip_portstate;
+	struct sas_identify_frame	sas_identify;
+	struct dev_to_host_fis	sata_fis;
+} __attribute__((packed, aligned(4)));
+
+
+/*
+ * brief the data structure of  REGISTER DEVICE Command
+ * use to describe MPI REGISTER DEVICE Command (64 bytes)
+ */
+
+struct reg_dev_req {
+	__le32	tag;
+	__le32	phyid_portid;
+	__le32	dtype_dlr_retry;
+	__le32	firstburstsize_ITNexustimeout;
+	u8	sas_addr[SAS_ADDR_SIZE];
+	__le32	upper_device_id;
+	u32	reserved[8];
+} __attribute__((packed, aligned(4)));
+
+
+/*
+ * brief the data structure of  DEREGISTER DEVICE Command
+ * use to request spc to remove all internal resources associated
+ * with the device id (64 bytes)
+ */
+
+struct dereg_dev_req {
+	__le32	tag;
+	__le32	device_id;
+	u32	reserved[13];
+} __attribute__((packed, aligned(4)));
+
+
+/*
+ * brief the data structure of DEVICE_REGISTRATION Response
+ * use to notify the completion of the device registration  (64 bytes)
+ */
+
+struct dev_reg_resp {
+	__le32	tag;
+	__le32	status;
+	__le32	device_id;
+	u32	reserved[12];
+} __attribute__((packed, aligned(4)));
+
+
+/*
+ * brief the data structure of Local PHY Control Command
+ * use to issue PHY CONTROL to local phy (64 bytes)
+ */
+struct local_phy_ctl_req {
+	__le32	tag;
+	__le32	phyop_phyid;
+	u32	reserved1[13];
+} __attribute__((packed, aligned(4)));
+
+
+/**
+ * brief the data structure of Local Phy Control Response
+ * use to describe MPI Local Phy Control Response (64 bytes)
+ */
+struct local_phy_ctl_resp {
+	__le32	tag;
+	__le32	phyop_phyid;
+	__le32	status;
+	u32	reserved[12];
+} __attribute__((packed, aligned(4)));
+
+
+#define OP_BITS 0x0000FF00
+#define ID_BITS 0x0000000F
+
+/*
+ * brief the data structure of PORT Control Command
+ * use to control port properties (64 bytes)
+ */
+
+struct port_ctl_req {
+	__le32	tag;
+	__le32	portop_portid;
+	__le32	param0;
+	__le32	param1;
+	u32	reserved1[11];
+} __attribute__((packed, aligned(4)));
+
+
+/*
+ * brief the data structure of HW Event Ack Command
+ * use to acknowledge receive HW event (64 bytes)
+ */
+
+struct hw_event_ack_req {
+	__le32	tag;
+	__le32	sea_phyid_portid;
+	__le32	param0;
+	__le32	param1;
+	u32	reserved1[11];
+} __attribute__((packed, aligned(4)));
+
+
+/*
+ * brief the data structure of SSP Completion Response
+ * use to indicate a SSP Completion  (n bytes)
+ */
+struct ssp_completion_resp {
+	__le32	tag;
+	__le32	status;
+	__le32	param;
+	__le32	ssptag_rescv_rescpad;
+	struct ssp_response_iu  ssp_resp_iu;
+	__le32	residual_count;
+} __attribute__((packed, aligned(4)));
+
+
+#define SSP_RESCV_BIT	0x00010000
+
+/*
+ * brief the data structure of SATA EVNET esponse
+ * use to indicate a SATA Completion  (64 bytes)
+ */
+
+struct sata_event_resp {
+	__le32	tag;
+	__le32	event;
+	__le32	port_id;
+	__le32	device_id;
+	u32	reserved[11];
+} __attribute__((packed, aligned(4)));
+
+/*
+ * brief the data structure of SSP EVNET esponse
+ * use to indicate a SSP Completion  (64 bytes)
+ */
+
+struct ssp_event_resp {
+	__le32	tag;
+	__le32	event;
+	__le32	port_id;
+	__le32	device_id;
+	u32	reserved[11];
+} __attribute__((packed, aligned(4)));
+
+/**
+ * brief the data structure of General Event Notification Response
+ * use to describe MPI General Event Notification Response (64 bytes)
+ */
+struct general_event_resp {
+	__le32	status;
+	__le32	inb_IOMB_payload[14];
+} __attribute__((packed, aligned(4)));
+
+
+#define GENERAL_EVENT_PAYLOAD	14
+#define OPCODE_BITS	0x00000fff
+
+/*
+ * brief the data structure of SMP Request Command
+ * use to describe MPI SMP REQUEST Command (64 bytes)
+ */
+struct smp_req {
+	__le32	tag;
+	__le32	device_id;
+	__le32	len_ip_ir;
+	/* Bits [0]  - Indirect response */
+	/* Bits [1] - Indirect Payload */
+	/* Bits [15:2] - Reserved */
+	/* Bits [23:16] - direct payload Len */
+	/* Bits [31:24] - Reserved */
+	u8	smp_req16[16];
+	union {
+		u8	smp_req[32];
+		struct {
+			__le64 long_req_addr;/* sg dma address, LE */
+			__le32 long_req_size;/* LE */
+			u32	_r_a;
+			__le64 long_resp_addr;/* sg dma address, LE */
+			__le32 long_resp_size;/* LE */
+			u32	_r_b;
+			} long_smp_req;/* sequencer extension */
+	};
+} __attribute__((packed, aligned(4)));
+/*
+ * brief the data structure of SMP Completion Response
+ * use to describe MPI SMP Completion Response (64 bytes)
+ */
+struct smp_completion_resp {
+	__le32	tag;
+	__le32	status;
+	__le32	param;
+	__le32	_r_a[12];
+} __attribute__((packed, aligned(4)));
+
+/*
+ *brief the data structure of SSP SMP SATA Abort Command
+ * use to describe MPI SSP SMP & SATA Abort Command (64 bytes)
+ */
+struct task_abort_req {
+	__le32	tag;
+	__le32	device_id;
+	__le32	tag_to_abort;
+	__le32	abort_all;
+	u32	reserved[11];
+} __attribute__((packed, aligned(4)));
+
+/* These flags used for SSP SMP & SATA Abort */
+#define ABORT_MASK		0x3
+#define ABORT_SINGLE		0x0
+#define ABORT_ALL		0x1
+
+/**
+ * brief the data structure of SSP SATA SMP Abort Response
+ * use to describe SSP SMP & SATA Abort Response ( 64 bytes)
+ */
+struct task_abort_resp {
+	__le32	tag;
+	__le32	status;
+	__le32	scp;
+	u32	reserved[12];
+} __attribute__((packed, aligned(4)));
+
+
+/**
+ * brief the data structure of SAS Diagnostic Start/End Command
+ * use to describe MPI SAS Diagnostic Start/End Command (64 bytes)
+ */
+struct sas_diag_start_end_req {
+	__le32	tag;
+	__le32	operation_phyid;
+	u32	reserved[13];
+} __attribute__((packed, aligned(4)));
+
+
+/**
+ * brief the data structure of SAS Diagnostic Execute Command
+ * use to describe MPI SAS Diagnostic Execute Command (64 bytes)
+ */
+struct sas_diag_execute_req{
+	__le32	tag;
+	__le32	cmdtype_cmddesc_phyid;
+	__le32	pat1_pat2;
+	__le32	threshold;
+	__le32	codepat_errmsk;
+	__le32	pmon;
+	__le32	pERF1CTL;
+	u32	reserved[8];
+} __attribute__((packed, aligned(4)));
+
+
+#define SAS_DIAG_PARAM_BYTES 24
+
+/*
+ * brief the data structure of Set Device State Command
+ * use to describe MPI Set Device State Command (64 bytes)
+ */
+struct set_dev_state_req {
+	__le32	tag;
+	__le32	device_id;
+	__le32	nds;
+	u32	reserved[12];
+} __attribute__((packed, aligned(4)));
+
+/*
+ * brief the data structure of sas_re_initialization
+ */
+struct sas_re_initialization_req {
+
+	__le32	tag;
+	__le32	SSAHOLT;/* bit29-set max port;
+			** bit28-set open reject cmd retries.
+			** bit27-set open reject data retries.
+			** bit26-set open reject option, remap:1 or not:0.
+			** bit25-set sata head of line time out.
+			*/
+	__le32 reserved_maxPorts;
+	__le32 open_reject_cmdretries_data_retries;/* cmd retries: 31-bit16;
+						    * data retries: bit15-bit0.
+						    */
+	__le32	sata_hol_tmo;
+	u32	reserved1[10];
+} __attribute__((packed, aligned(4)));
+
+/*
+ * brief the data structure of SATA Start Command
+ * use to describe MPI SATA IO Start Command (64 bytes)
+ */
+
+struct sata_start_req {
+	__le32	tag;
+	__le32	device_id;
+	__le32	data_len;
+	__le32	ncqtag_atap_dir_m;
+	struct host_to_dev_fis	sata_fis;
+	u32	reserved1;
+	u32	reserved2;
+	u32	addr_low;
+	u32	addr_high;
+	__le32	len;
+	__le32	esgl;
+} __attribute__((packed, aligned(4)));
+
+/**
+ * brief the data structure of SSP INI TM Start Command
+ * use to describe MPI SSP INI TM Start Command (64 bytes)
+ */
+struct ssp_ini_tm_start_req {
+	__le32	tag;
+	__le32	device_id;
+	__le32	relate_tag;
+	__le32	tmf;
+	u8	lun[8];
+	__le32	ds_ads_m;
+	u32	reserved[8];
+} __attribute__((packed, aligned(4)));
+
+
+struct ssp_info_unit {
+	u8	lun[8];/* SCSI Logical Unit Number */
+	u8	reserved1;/* reserved */
+	u8	efb_prio_attr;
+	/* B7   : enabledFirstBurst */
+	/* B6-3 : taskPriority */
+	/* B2-0 : taskAttribute */
+	u8	reserved2;	/* reserved */
+	u8	additional_cdb_len;
+	/* B7-2 : additional_cdb_len */
+	/* B1-0 : reserved */
+	u8	cdb[16];/* The SCSI CDB up to 16 bytes length */
+} __attribute__((packed, aligned(4)));
+
+
+/**
+ * brief the data structure of SSP INI IO Start Command
+ * use to describe MPI SSP INI IO Start Command (64 bytes)
+ */
+struct ssp_ini_io_start_req {
+	__le32	tag;
+	__le32	device_id;
+	__le32	data_len;
+	__le32	dir_m_tlr;
+	struct ssp_info_unit	ssp_iu;
+	__le32	addr_low;
+	__le32	addr_high;
+	__le32	len;
+	__le32	esgl;
+} __attribute__((packed, aligned(4)));
+
+
+/**
+ * brief the data structure of Firmware download
+ * use to describe MPI FW DOWNLOAD Command (64 bytes)
+ */
+struct fw_flash_Update_req {
+	__le32	tag;
+	__le32	cur_image_offset;
+	__le32	cur_image_len;
+	__le32	total_image_len;
+	u32	reserved0[7];
+	__le32	sgl_addr_lo;
+	__le32	sgl_addr_hi;
+	__le32	len;
+	__le32	ext_reserved;
+} __attribute__((packed, aligned(4)));
+
+
+#define FWFLASH_IOMB_RESERVED_LEN 0x07
+/**
+ * brief the data structure of FW_FLASH_UPDATE Response
+ * use to describe MPI FW_FLASH_UPDATE Response (64 bytes)
+ *
+ */
+struct fw_flash_Update_resp {
+	dma_addr_t	tag;
+	__le32	status;
+	u32	reserved[13];
+} __attribute__((packed, aligned(4)));
+
+
+/**
+ * brief the data structure of Get NVM Data Command
+ * use to get data from NVM in HBA(64 bytes)
+ */
+struct get_nvm_data_req {
+	__le32	tag;
+	__le32	len_ir_vpdd;
+	__le32	vpd_offset;
+	u32	reserved[8];
+	__le32	resp_addr_lo;
+	__le32	resp_addr_hi;
+	__le32	resp_len;
+	u32	reserved1;
+} __attribute__((packed, aligned(4)));
+
+
+struct set_nvm_data_req {
+	__le32	tag;
+	__le32	len_ir_vpdd;
+	__le32	vpd_offset;
+	u32	reserved[8];
+	__le32	resp_addr_lo;
+	__le32	resp_addr_hi;
+	__le32	resp_len;
+	u32	reserved1;
+} __attribute__((packed, aligned(4)));
+
+
+#define TWI_DEVICE	0x0
+#define C_SEEPROM	0x1
+#define VPD_FLASH	0x4
+#define AAP1_RDUMP	0x5
+#define IOP_RDUMP	0x6
+#define EXPAN_ROM	0x7
+
+#define IPMode		0x80000000
+#define NVMD_TYPE	0x0000000F
+#define NVMD_STAT	0x0000FFFF
+#define NVMD_LEN	0xFF000000
+/**
+ * brief the data structure of Get NVMD Data Response
+ * use to describe MPI Get NVMD Data Response (64 bytes)
+ */
+struct get_nvm_data_resp {
+	__le32		tag;
+	__le32		ir_tda_bn_dps_das_nvm;
+	__le32		dlen_status;
+	__le32		nvm_data[12];
+} __attribute__((packed, aligned(4)));
+
+
+/**
+ * brief the data structure of SAS Diagnostic Start/End Response
+ * use to describe MPI SAS Diagnostic Start/End Response (64 bytes)
+ *
+ */
+struct sas_diag_start_end_resp {
+	__le32		tag;
+	__le32		status;
+	u32		reserved[13];
+} __attribute__((packed, aligned(4)));
+
+
+/**
+ * brief the data structure of SAS Diagnostic Execute Response
+ * use to describe MPI SAS Diagnostic Execute Response (64 bytes)
+ *
+ */
+struct sas_diag_execute_resp {
+	__le32		tag;
+	__le32		cmdtype_cmddesc_phyid;
+	__le32		Status;
+	__le32		ReportData;
+	u32		reserved[11];
+} __attribute__((packed, aligned(4)));
+
+
+/**
+ * brief the data structure of Set Device State Response
+ * use to describe MPI Set Device State Response (64 bytes)
+ *
+ */
+struct set_dev_state_resp {
+	__le32		tag;
+	__le32		status;
+	__le32		device_id;
+	__le32		pds_nds;
+	u32		reserved[11];
+} __attribute__((packed, aligned(4)));
+
+
+#define NDS_BITS 0x0F
+#define PDS_BITS 0xF0
+
+/*
+ * HW Events type
+ */
+
+#define HW_EVENT_RESET_START			0x01
+#define HW_EVENT_CHIP_RESET_COMPLETE		0x02
+#define HW_EVENT_PHY_STOP_STATUS		0x03
+#define HW_EVENT_SAS_PHY_UP			0x04
+#define HW_EVENT_SATA_PHY_UP			0x05
+#define HW_EVENT_SATA_SPINUP_HOLD		0x06
+#define HW_EVENT_PHY_DOWN			0x07
+#define HW_EVENT_PORT_INVALID			0x08
+#define HW_EVENT_BROADCAST_CHANGE		0x09
+#define HW_EVENT_PHY_ERROR			0x0A
+#define HW_EVENT_BROADCAST_SES			0x0B
+#define HW_EVENT_INBOUND_CRC_ERROR		0x0C
+#define HW_EVENT_HARD_RESET_RECEIVED		0x0D
+#define HW_EVENT_MALFUNCTION			0x0E
+#define HW_EVENT_ID_FRAME_TIMEOUT		0x0F
+#define HW_EVENT_BROADCAST_EXP			0x10
+#define HW_EVENT_PHY_START_STATUS		0x11
+#define HW_EVENT_LINK_ERR_INVALID_DWORD		0x12
+#define HW_EVENT_LINK_ERR_DISPARITY_ERROR	0x13
+#define HW_EVENT_LINK_ERR_CODE_VIOLATION	0x14
+#define HW_EVENT_LINK_ERR_LOSS_OF_DWORD_SYNCH	0x15
+#define HW_EVENT_LINK_ERR_PHY_RESET_FAILED	0x16
+#define HW_EVENT_PORT_RECOVERY_TIMER_TMO	0x17
+#define HW_EVENT_PORT_RECOVER			0x18
+#define HW_EVENT_PORT_RESET_TIMER_TMO		0x19
+#define HW_EVENT_PORT_RESET_COMPLETE		0x20
+#define EVENT_BROADCAST_ASYNCH_EVENT		0x21
+
+/* port state */
+#define PORT_NOT_ESTABLISHED			0x00
+#define PORT_VALID				0x01
+#define PORT_LOSTCOMM				0x02
+#define PORT_IN_RESET				0x04
+#define PORT_INVALID				0x08
+
+/*
+ * SSP/SMP/SATA IO Completion Status values
+ */
+
+#define IO_SUCCESS				0x00
+#define IO_ABORTED				0x01
+#define IO_OVERFLOW				0x02
+#define IO_UNDERFLOW				0x03
+#define IO_FAILED				0x04
+#define IO_ABORT_RESET				0x05
+#define IO_NOT_VALID				0x06
+#define IO_NO_DEVICE				0x07
+#define IO_ILLEGAL_PARAMETER			0x08
+#define IO_LINK_FAILURE				0x09
+#define IO_PROG_ERROR				0x0A
+#define IO_EDC_IN_ERROR				0x0B
+#define IO_EDC_OUT_ERROR			0x0C
+#define IO_ERROR_HW_TIMEOUT			0x0D
+#define IO_XFER_ERROR_BREAK			0x0E
+#define IO_XFER_ERROR_PHY_NOT_READY		0x0F
+#define IO_OPEN_CNX_ERROR_PROTOCOL_NOT_SUPPORTED	0x10
+#define IO_OPEN_CNX_ERROR_ZONE_VIOLATION		0x11
+#define IO_OPEN_CNX_ERROR_BREAK				0x12
+#define IO_OPEN_CNX_ERROR_IT_NEXUS_LOSS			0x13
+#define IO_OPEN_CNX_ERROR_BAD_DESTINATION		0x14
+#define IO_OPEN_CNX_ERROR_CONNECTION_RATE_NOT_SUPPORTED	0x15
+#define IO_OPEN_CNX_ERROR_STP_RESOURCES_BUSY		0x16
+#define IO_OPEN_CNX_ERROR_WRONG_DESTINATION		0x17
+#define IO_OPEN_CNX_ERROR_UNKNOWN_ERROR			0x18
+#define IO_XFER_ERROR_NAK_RECEIVED			0x19
+#define IO_XFER_ERROR_ACK_NAK_TIMEOUT			0x1A
+#define IO_XFER_ERROR_PEER_ABORTED			0x1B
+#define IO_XFER_ERROR_RX_FRAME				0x1C
+#define IO_XFER_ERROR_DMA				0x1D
+#define IO_XFER_ERROR_CREDIT_TIMEOUT			0x1E
+#define IO_XFER_ERROR_SATA_LINK_TIMEOUT			0x1F
+#define IO_XFER_ERROR_SATA				0x20
+#define IO_XFER_ERROR_ABORTED_DUE_TO_SRST		0x22
+#define IO_XFER_ERROR_REJECTED_NCQ_MODE			0x21
+#define IO_XFER_ERROR_ABORTED_NCQ_MODE			0x23
+#define IO_XFER_OPEN_RETRY_TIMEOUT			0x24
+#define IO_XFER_SMP_RESP_CONNECTION_ERROR		0x25
+#define IO_XFER_ERROR_UNEXPECTED_PHASE			0x26
+#define IO_XFER_ERROR_XFER_RDY_OVERRUN			0x27
+#define IO_XFER_ERROR_XFER_RDY_NOT_EXPECTED		0x28
+
+#define IO_XFER_ERROR_CMD_ISSUE_ACK_NAK_TIMEOUT		0x30
+#define IO_XFER_ERROR_CMD_ISSUE_BREAK_BEFORE_ACK_NAK	0x31
+#define IO_XFER_ERROR_CMD_ISSUE_PHY_DOWN_BEFORE_ACK_NAK	0x32
+
+#define IO_XFER_ERROR_OFFSET_MISMATCH			0x34
+#define IO_XFER_ERROR_XFER_ZERO_DATA_LEN		0x35
+#define IO_XFER_CMD_FRAME_ISSUED			0x36
+#define IO_ERROR_INTERNAL_SMP_RESOURCE			0x37
+#define IO_PORT_IN_RESET				0x38
+#define IO_DS_NON_OPERATIONAL				0x39
+#define IO_DS_IN_RECOVERY				0x3A
+#define IO_TM_TAG_NOT_FOUND				0x3B
+#define IO_XFER_PIO_SETUP_ERROR				0x3C
+#define IO_SSP_EXT_IU_ZERO_LEN_ERROR			0x3D
+#define IO_DS_IN_ERROR					0x3E
+#define IO_OPEN_CNX_ERROR_HW_RESOURCE_BUSY		0x3F
+#define IO_ABORT_IN_PROGRESS				0x40
+#define IO_ABORT_DELAYED				0x41
+#define IO_INVALID_LENGTH				0x42
+
+/* WARNING: This error code must always be the last number.
+ * If you add error code, modify this code also
+ * It is used as an index
+ */
+#define IO_ERROR_UNKNOWN_GENERIC			0x43
+
+/* MSGU CONFIGURATION  TABLE*/
+
+#define SPC_MSGU_CFG_TABLE_UPDATE		0x01/* Inbound doorbell bit0 */
+#define SPC_MSGU_CFG_TABLE_RESET		0x02/* Inbound doorbell bit1 */
+#define SPC_MSGU_CFG_TABLE_FREEZE		0x04/* Inbound doorbell bit2 */
+#define SPC_MSGU_CFG_TABLE_UNFREEZE		0x08/* Inbound doorbell bit4 */
+#define MSGU_IBDB_SET				0x04
+#define MSGU_HOST_INT_STATUS			0x08
+#define MSGU_HOST_INT_MASK			0x0C
+#define MSGU_IOPIB_INT_STATUS			0x18
+#define MSGU_IOPIB_INT_MASK			0x1C
+#define MSGU_IBDB_CLEAR				0x20/* RevB - Host not use */
+#define MSGU_MSGU_CONTROL			0x24
+#define MSGU_ODR				0x3C/* RevB */
+#define MSGU_ODCR				0x40/* RevB */
+#define MSGU_SCRATCH_PAD_0			0x44
+#define MSGU_SCRATCH_PAD_1			0x48
+#define MSGU_SCRATCH_PAD_2			0x4C
+#define MSGU_SCRATCH_PAD_3			0x50
+#define MSGU_HOST_SCRATCH_PAD_0			0x54
+#define MSGU_HOST_SCRATCH_PAD_1			0x58
+#define MSGU_HOST_SCRATCH_PAD_2			0x5C
+#define MSGU_HOST_SCRATCH_PAD_3			0x60
+#define MSGU_HOST_SCRATCH_PAD_4			0x64
+#define MSGU_HOST_SCRATCH_PAD_5			0x68
+#define MSGU_HOST_SCRATCH_PAD_6			0x6C
+#define MSGU_HOST_SCRATCH_PAD_7			0x70
+#define MSGU_ODMR				0x74/* RevB */
+
+/* bit definition for ODMR register */
+#define ODMR_MASK_ALL				0xFFFFFFFF/* mask all
+					interrupt vector */
+#define ODMR_CLEAR_ALL				0/* clear all
+					interrupt vector */
+/* bit definition for ODCR register */
+#define ODCR_CLEAR_ALL		0xFFFFFFFF   /* mask all
+					interrupt vector*/
+/* MSIX Interupts */
+#define MSIX_TABLE_OFFSET		0x2000
+#define MSIX_TABLE_ELEMENT_SIZE		0x10
+#define MSIX_INTERRUPT_CONTROL_OFFSET	0xC
+#define MSIX_TABLE_BASE	  (MSIX_TABLE_OFFSET + MSIX_INTERRUPT_CONTROL_OFFSET)
+#define MSIX_INTERRUPT_DISABLE		0x1
+#define MSIX_INTERRUPT_ENABLE		0x0
+
+
+/* state definition for Scratch Pad1 register */
+#define SCRATCH_PAD1_POR		0x00  /* power on reset state */
+#define SCRATCH_PAD1_SFR		0x01  /* soft reset state */
+#define SCRATCH_PAD1_ERR		0x02  /* error state */
+#define SCRATCH_PAD1_RDY		0x03  /* ready state */
+#define SCRATCH_PAD1_RST		0x04  /* soft reset toggle flag */
+#define SCRATCH_PAD1_AAP1RDY_RST	0x08  /* AAP1 ready for soft reset */
+#define SCRATCH_PAD1_STATE_MASK		0xFFFFFFF0   /* ScratchPad1
+ Mask, bit1-0 State, bit2 Soft Reset, bit3 FW RDY for Soft Reset */
+#define SCRATCH_PAD1_RESERVED		0x000003F8   /* Scratch Pad1
+ Reserved bit 3 to 9 */
+
+ /* state definition for Scratch Pad2 register */
+#define SCRATCH_PAD2_POR		0x00  /* power on state */
+#define SCRATCH_PAD2_SFR		0x01  /* soft reset state */
+#define SCRATCH_PAD2_ERR		0x02  /* error state */
+#define SCRATCH_PAD2_RDY		0x03  /* ready state */
+#define SCRATCH_PAD2_FWRDY_RST		0x04  /* FW ready for soft reset flag*/
+#define SCRATCH_PAD2_IOPRDY_RST		0x08  /* IOP ready for soft reset */
+#define SCRATCH_PAD2_STATE_MASK		0xFFFFFFF4 /* ScratchPad 2
+ Mask, bit1-0 State */
+#define SCRATCH_PAD2_RESERVED		0x000003FC   /* Scratch Pad1
+ Reserved bit 2 to 9 */
+
+#define SCRATCH_PAD_ERROR_MASK		0xFFFFFC00   /* Error mask bits */
+#define SCRATCH_PAD_STATE_MASK		0x00000003   /* State Mask bits */
+
+/* main configuration offset - byte offset */
+#define MAIN_SIGNATURE_OFFSET		0x00/* DWORD 0x00 */
+#define MAIN_INTERFACE_REVISION		0x04/* DWORD 0x01 */
+#define MAIN_FW_REVISION		0x08/* DWORD 0x02 */
+#define MAIN_MAX_OUTSTANDING_IO_OFFSET	0x0C/* DWORD 0x03 */
+#define MAIN_MAX_SGL_OFFSET		0x10/* DWORD 0x04 */
+#define MAIN_CNTRL_CAP_OFFSET		0x14/* DWORD 0x05 */
+#define MAIN_GST_OFFSET			0x18/* DWORD 0x06 */
+#define MAIN_IBQ_OFFSET			0x1C/* DWORD 0x07 */
+#define MAIN_OBQ_OFFSET			0x20/* DWORD 0x08 */
+#define MAIN_IQNPPD_HPPD_OFFSET		0x24/* DWORD 0x09 */
+#define MAIN_OB_HW_EVENT_PID03_OFFSET	0x28/* DWORD 0x0A */
+#define MAIN_OB_HW_EVENT_PID47_OFFSET	0x2C/* DWORD 0x0B */
+#define MAIN_OB_NCQ_EVENT_PID03_OFFSET	0x30/* DWORD 0x0C */
+#define MAIN_OB_NCQ_EVENT_PID47_OFFSET	0x34/* DWORD 0x0D */
+#define MAIN_TITNX_EVENT_PID03_OFFSET	0x38/* DWORD 0x0E */
+#define MAIN_TITNX_EVENT_PID47_OFFSET	0x3C/* DWORD 0x0F */
+#define MAIN_OB_SSP_EVENT_PID03_OFFSET	0x40/* DWORD 0x10 */
+#define MAIN_OB_SSP_EVENT_PID47_OFFSET	0x44/* DWORD 0x11 */
+#define MAIN_OB_SMP_EVENT_PID03_OFFSET	0x48/* DWORD 0x12 */
+#define MAIN_OB_SMP_EVENT_PID47_OFFSET	0x4C/* DWORD 0x13 */
+#define MAIN_EVENT_LOG_ADDR_HI		0x50/* DWORD 0x14 */
+#define MAIN_EVENT_LOG_ADDR_LO		0x54/* DWORD 0x15 */
+#define MAIN_EVENT_LOG_BUFF_SIZE	0x58/* DWORD 0x16 */
+#define MAIN_EVENT_LOG_OPTION		0x5C/* DWORD 0x17 */
+#define MAIN_IOP_EVENT_LOG_ADDR_HI	0x60/* DWORD 0x18 */
+#define MAIN_IOP_EVENT_LOG_ADDR_LO	0x64/* DWORD 0x19 */
+#define MAIN_IOP_EVENT_LOG_BUFF_SIZE	0x68/* DWORD 0x1A */
+#define MAIN_IOP_EVENT_LOG_OPTION	0x6C/* DWORD 0x1B */
+#define MAIN_FATAL_ERROR_INTERRUPT	0x70/* DWORD 0x1C */
+#define MAIN_FATAL_ERROR_RDUMP0_OFFSET	0x74/* DWORD 0x1D */
+#define MAIN_FATAL_ERROR_RDUMP0_LENGTH	0x78/* DWORD 0x1E */
+#define MAIN_FATAL_ERROR_RDUMP1_OFFSET	0x7C/* DWORD 0x1F */
+#define MAIN_FATAL_ERROR_RDUMP1_LENGTH	0x80/* DWORD 0x20 */
+#define MAIN_HDA_FLAGS_OFFSET		0x84/* DWORD 0x21 */
+#define MAIN_ANALOG_SETUP_OFFSET	0x88/* DWORD 0x22 */
+
+/* Gereral Status Table offset - byte offset */
+#define GST_GSTLEN_MPIS_OFFSET		0x00
+#define GST_IQ_FREEZE_STATE0_OFFSET	0x04
+#define GST_IQ_FREEZE_STATE1_OFFSET	0x08
+#define GST_MSGUTCNT_OFFSET		0x0C
+#define GST_IOPTCNT_OFFSET		0x10
+#define GST_PHYSTATE_OFFSET		0x18
+#define GST_PHYSTATE0_OFFSET		0x18
+#define GST_PHYSTATE1_OFFSET		0x1C
+#define GST_PHYSTATE2_OFFSET		0x20
+#define GST_PHYSTATE3_OFFSET		0x24
+#define GST_PHYSTATE4_OFFSET		0x28
+#define GST_PHYSTATE5_OFFSET		0x2C
+#define GST_PHYSTATE6_OFFSET		0x30
+#define GST_PHYSTATE7_OFFSET		0x34
+#define GST_RERRINFO_OFFSET		0x44
+
+/* General Status Table - MPI state */
+#define GST_MPI_STATE_UNINIT		0x00
+#define GST_MPI_STATE_INIT		0x01
+#define GST_MPI_STATE_TERMINATION	0x02
+#define GST_MPI_STATE_ERROR		0x03
+#define GST_MPI_STATE_MASK		0x07
+
+#define MBIC_NMI_ENABLE_VPE0_IOP	0x000418
+#define MBIC_NMI_ENABLE_VPE0_AAP1	0x000418
+/* PCIE registers - BAR2(0x18), BAR1(win) 0x010000 */
+#define PCIE_EVENT_INTERRUPT_ENABLE	0x003040
+#define PCIE_EVENT_INTERRUPT		0x003044
+#define PCIE_ERROR_INTERRUPT_ENABLE	0x003048
+#define PCIE_ERROR_INTERRUPT		0x00304C
+/* signature defintion for host scratch pad0 register */
+#define SPC_SOFT_RESET_SIGNATURE	0x252acbcd
+/* Signature for Soft Reset */
+
+/* SPC Reset register - BAR4(0x20), BAR2(win) (need dynamic mapping) */
+#define SPC_REG_RESET			0x000000/* reset register */
+
+/* bit difination for SPC_RESET register */
+#define   SPC_REG_RESET_OSSP		0x00000001
+#define   SPC_REG_RESET_RAAE		0x00000002
+#define   SPC_REG_RESET_PCS_SPBC	0x00000004
+#define   SPC_REG_RESET_PCS_IOP_SS	0x00000008
+#define   SPC_REG_RESET_PCS_AAP1_SS	0x00000010
+#define   SPC_REG_RESET_PCS_AAP2_SS	0x00000020
+#define   SPC_REG_RESET_PCS_LM		0x00000040
+#define   SPC_REG_RESET_PCS		0x00000080
+#define   SPC_REG_RESET_GSM		0x00000100
+#define   SPC_REG_RESET_DDR2		0x00010000
+#define   SPC_REG_RESET_BDMA_CORE	0x00020000
+#define   SPC_REG_RESET_BDMA_SXCBI	0x00040000
+#define   SPC_REG_RESET_PCIE_AL_SXCBI	0x00080000
+#define   SPC_REG_RESET_PCIE_PWR	0x00100000
+#define   SPC_REG_RESET_PCIE_SFT	0x00200000
+#define   SPC_REG_RESET_PCS_SXCBI	0x00400000
+#define   SPC_REG_RESET_LMS_SXCBI	0x00800000
+#define   SPC_REG_RESET_PMIC_SXCBI	0x01000000
+#define   SPC_REG_RESET_PMIC_CORE	0x02000000
+#define   SPC_REG_RESET_PCIE_PC_SXCBI	0x04000000
+#define   SPC_REG_RESET_DEVICE		0x80000000
+
+/* registers for BAR Shifting - BAR2(0x18), BAR1(win) */
+#define SPC_IBW_AXI_TRANSLATION_LOW	0x003258
+
+#define MBIC_AAP1_ADDR_BASE		0x060000
+#define MBIC_IOP_ADDR_BASE		0x070000
+#define GSM_ADDR_BASE			0x0700000
+/* Dynamic map through Bar4 - 0x00700000 */
+#define GSM_CONFIG_RESET		0x00000000
+#define RAM_ECC_DB_ERR			0x00000018
+#define GSM_READ_ADDR_PARITY_INDIC	0x00000058
+#define GSM_WRITE_ADDR_PARITY_INDIC	0x00000060
+#define GSM_WRITE_DATA_PARITY_INDIC	0x00000068
+#define GSM_READ_ADDR_PARITY_CHECK	0x00000038
+#define GSM_WRITE_ADDR_PARITY_CHECK	0x00000040
+#define GSM_WRITE_DATA_PARITY_CHECK	0x00000048
+
+#define RB6_ACCESS_REG			0x6A0000
+#define HDAC_EXEC_CMD			0x0002
+#define HDA_C_PA			0xcb
+#define HDA_SEQ_ID_BITS			0x00ff0000
+#define HDA_GSM_OFFSET_BITS		0x00FFFFFF
+#define MBIC_AAP1_ADDR_BASE		0x060000
+#define MBIC_IOP_ADDR_BASE		0x070000
+#define GSM_ADDR_BASE			0x0700000
+#define SPC_TOP_LEVEL_ADDR_BASE		0x000000
+#define GSM_CONFIG_RESET_VALUE          0x00003b00
+#define GPIO_ADDR_BASE                  0x00090000
+#define GPIO_GPIO_0_0UTPUT_CTL_OFFSET   0x0000010c
+
+/* RB6 offset */
+#define SPC_RB6_OFFSET			0x80C0
+/* Magic number of  soft reset for RB6 */
+#define RB6_MAGIC_NUMBER_RST		0x1234
+
+/* Device Register status */
+#define DEVREG_SUCCESS					0x00
+#define DEVREG_FAILURE_OUT_OF_RESOURCE			0x01
+#define DEVREG_FAILURE_DEVICE_ALREADY_REGISTERED	0x02
+#define DEVREG_FAILURE_INVALID_PHY_ID			0x03
+#define DEVREG_FAILURE_PHY_ID_ALREADY_REGISTERED	0x04
+#define DEVREG_FAILURE_PORT_ID_OUT_OF_RANGE		0x05
+#define DEVREG_FAILURE_PORT_NOT_VALID_STATE		0x06
+#define DEVREG_FAILURE_DEVICE_TYPE_NOT_VALID		0x07
+
+#endif
+
diff --git a/drivers/scsi/pm8001/pm8001_init.c b/drivers/scsi/pm8001/pm8001_init.c
new file mode 100644
index 000000000000..c2f1032496cb
--- /dev/null
+++ b/drivers/scsi/pm8001/pm8001_init.c
@@ -0,0 +1,900 @@
+/*
+ * PMC-Sierra SPC 8001 SAS/SATA based host adapters driver
+ *
+ * Copyright (c) 2008-2009 USI Co., Ltd.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ *
+ */
+
+#include "pm8001_sas.h"
+#include "pm8001_chips.h"
+
+static struct scsi_transport_template *pm8001_stt;
+
+static const struct pm8001_chip_info pm8001_chips[] = {
+	[chip_8001] = {  8, &pm8001_8001_dispatch,},
+};
+static int pm8001_id;
+
+LIST_HEAD(hba_list);
+
+/**
+ * The main structure which LLDD must register for scsi core.
+ */
+static struct scsi_host_template pm8001_sht = {
+	.module			= THIS_MODULE,
+	.name			= DRV_NAME,
+	.queuecommand		= sas_queuecommand,
+	.target_alloc		= sas_target_alloc,
+	.slave_configure	= pm8001_slave_configure,
+	.slave_destroy		= sas_slave_destroy,
+	.scan_finished		= pm8001_scan_finished,
+	.scan_start		= pm8001_scan_start,
+	.change_queue_depth	= sas_change_queue_depth,
+	.change_queue_type	= sas_change_queue_type,
+	.bios_param		= sas_bios_param,
+	.can_queue		= 1,
+	.cmd_per_lun		= 1,
+	.this_id		= -1,
+	.sg_tablesize		= SG_ALL,
+	.max_sectors		= SCSI_DEFAULT_MAX_SECTORS,
+	.use_clustering		= ENABLE_CLUSTERING,
+	.eh_device_reset_handler = sas_eh_device_reset_handler,
+	.eh_bus_reset_handler	= sas_eh_bus_reset_handler,
+	.slave_alloc		= pm8001_slave_alloc,
+	.target_destroy		= sas_target_destroy,
+	.ioctl			= sas_ioctl,
+	.shost_attrs		= pm8001_host_attrs,
+};
+
+/**
+ * Sas layer call this function to execute specific task.
+ */
+static struct sas_domain_function_template pm8001_transport_ops = {
+	.lldd_dev_found		= pm8001_dev_found,
+	.lldd_dev_gone		= pm8001_dev_gone,
+
+	.lldd_execute_task	= pm8001_queue_command,
+	.lldd_control_phy	= pm8001_phy_control,
+
+	.lldd_abort_task	= pm8001_abort_task,
+	.lldd_abort_task_set	= pm8001_abort_task_set,
+	.lldd_clear_aca		= pm8001_clear_aca,
+	.lldd_clear_task_set	= pm8001_clear_task_set,
+	.lldd_I_T_nexus_reset   = pm8001_I_T_nexus_reset,
+	.lldd_lu_reset		= pm8001_lu_reset,
+	.lldd_query_task	= pm8001_query_task,
+};
+
+/**
+ *pm8001_phy_init - initiate our adapter phys
+ *@pm8001_ha: our hba structure.
+ *@phy_id: phy id.
+ */
+static void __devinit pm8001_phy_init(struct pm8001_hba_info *pm8001_ha,
+	int phy_id)
+{
+	struct pm8001_phy *phy = &pm8001_ha->phy[phy_id];
+	struct asd_sas_phy *sas_phy = &phy->sas_phy;
+	phy->phy_state = 0;
+	phy->pm8001_ha = pm8001_ha;
+	sas_phy->enabled = (phy_id < pm8001_ha->chip->n_phy) ? 1 : 0;
+	sas_phy->class = SAS;
+	sas_phy->iproto = SAS_PROTOCOL_ALL;
+	sas_phy->tproto = 0;
+	sas_phy->type = PHY_TYPE_PHYSICAL;
+	sas_phy->role = PHY_ROLE_INITIATOR;
+	sas_phy->oob_mode = OOB_NOT_CONNECTED;
+	sas_phy->linkrate = SAS_LINK_RATE_UNKNOWN;
+	sas_phy->id = phy_id;
+	sas_phy->sas_addr = &pm8001_ha->sas_addr[0];
+	sas_phy->frame_rcvd = &phy->frame_rcvd[0];
+	sas_phy->ha = (struct sas_ha_struct *)pm8001_ha->shost->hostdata;
+	sas_phy->lldd_phy = phy;
+}
+
+/**
+ *pm8001_free - free hba
+ *@pm8001_ha:	our hba structure.
+ *
+ */
+static void pm8001_free(struct pm8001_hba_info *pm8001_ha)
+{
+	int i;
+	struct pm8001_wq *wq;
+
+	if (!pm8001_ha)
+		return;
+
+	for (i = 0; i < USI_MAX_MEMCNT; i++) {
+		if (pm8001_ha->memoryMap.region[i].virt_ptr != NULL) {
+			pci_free_consistent(pm8001_ha->pdev,
+				pm8001_ha->memoryMap.region[i].element_size,
+				pm8001_ha->memoryMap.region[i].virt_ptr,
+				pm8001_ha->memoryMap.region[i].phys_addr);
+			}
+	}
+	PM8001_CHIP_DISP->chip_iounmap(pm8001_ha);
+	if (pm8001_ha->shost)
+		scsi_host_put(pm8001_ha->shost);
+	list_for_each_entry(wq, &pm8001_ha->wq_list, entry)
+		cancel_delayed_work(&wq->work_q);
+	kfree(pm8001_ha->tags);
+	kfree(pm8001_ha);
+}
+
+#ifdef PM8001_USE_TASKLET
+static void pm8001_tasklet(unsigned long opaque)
+{
+	struct pm8001_hba_info *pm8001_ha;
+	pm8001_ha = (struct pm8001_hba_info *)opaque;;
+	if (unlikely(!pm8001_ha))
+		BUG_ON(1);
+	PM8001_CHIP_DISP->isr(pm8001_ha);
+}
+#endif
+
+
+ /**
+  * pm8001_interrupt - when HBA originate a interrupt,we should invoke this
+  * dispatcher to handle each case.
+  * @irq: irq number.
+  * @opaque: the passed general host adapter struct
+  */
+static irqreturn_t pm8001_interrupt(int irq, void *opaque)
+{
+	struct pm8001_hba_info *pm8001_ha;
+	irqreturn_t ret = IRQ_HANDLED;
+	struct sas_ha_struct *sha = opaque;
+	pm8001_ha = sha->lldd_ha;
+	if (unlikely(!pm8001_ha))
+		return IRQ_NONE;
+	if (!PM8001_CHIP_DISP->is_our_interupt(pm8001_ha))
+		return IRQ_NONE;
+#ifdef PM8001_USE_TASKLET
+	tasklet_schedule(&pm8001_ha->tasklet);
+#else
+	ret = PM8001_CHIP_DISP->isr(pm8001_ha);
+#endif
+	return ret;
+}
+
+/**
+ * pm8001_alloc - initiate our hba structure and 6 DMAs area.
+ * @pm8001_ha:our hba structure.
+ *
+ */
+static int __devinit pm8001_alloc(struct pm8001_hba_info *pm8001_ha)
+{
+	int i;
+	spin_lock_init(&pm8001_ha->lock);
+	for (i = 0; i < pm8001_ha->chip->n_phy; i++) {
+		pm8001_phy_init(pm8001_ha, i);
+		pm8001_ha->port[i].wide_port_phymap = 0;
+		pm8001_ha->port[i].port_attached = 0;
+		pm8001_ha->port[i].port_state = 0;
+		INIT_LIST_HEAD(&pm8001_ha->port[i].list);
+	}
+
+	pm8001_ha->tags = kzalloc(PM8001_MAX_CCB, GFP_KERNEL);
+	if (!pm8001_ha->tags)
+		goto err_out;
+	/* MPI Memory region 1 for AAP Event Log for fw */
+	pm8001_ha->memoryMap.region[AAP1].num_elements = 1;
+	pm8001_ha->memoryMap.region[AAP1].element_size = PM8001_EVENT_LOG_SIZE;
+	pm8001_ha->memoryMap.region[AAP1].total_len = PM8001_EVENT_LOG_SIZE;
+	pm8001_ha->memoryMap.region[AAP1].alignment = 32;
+
+	/* MPI Memory region 2 for IOP Event Log for fw */
+	pm8001_ha->memoryMap.region[IOP].num_elements = 1;
+	pm8001_ha->memoryMap.region[IOP].element_size = PM8001_EVENT_LOG_SIZE;
+	pm8001_ha->memoryMap.region[IOP].total_len = PM8001_EVENT_LOG_SIZE;
+	pm8001_ha->memoryMap.region[IOP].alignment = 32;
+
+	/* MPI Memory region 3 for consumer Index of inbound queues */
+	pm8001_ha->memoryMap.region[CI].num_elements = 1;
+	pm8001_ha->memoryMap.region[CI].element_size = 4;
+	pm8001_ha->memoryMap.region[CI].total_len = 4;
+	pm8001_ha->memoryMap.region[CI].alignment = 4;
+
+	/* MPI Memory region 4 for producer Index of outbound queues */
+	pm8001_ha->memoryMap.region[PI].num_elements = 1;
+	pm8001_ha->memoryMap.region[PI].element_size = 4;
+	pm8001_ha->memoryMap.region[PI].total_len = 4;
+	pm8001_ha->memoryMap.region[PI].alignment = 4;
+
+	/* MPI Memory region 5 inbound queues */
+	pm8001_ha->memoryMap.region[IB].num_elements = 256;
+	pm8001_ha->memoryMap.region[IB].element_size = 64;
+	pm8001_ha->memoryMap.region[IB].total_len = 256 * 64;
+	pm8001_ha->memoryMap.region[IB].alignment = 64;
+
+	/* MPI Memory region 6 inbound queues */
+	pm8001_ha->memoryMap.region[OB].num_elements = 256;
+	pm8001_ha->memoryMap.region[OB].element_size = 64;
+	pm8001_ha->memoryMap.region[OB].total_len = 256 * 64;
+	pm8001_ha->memoryMap.region[OB].alignment = 64;
+
+	/* Memory region write DMA*/
+	pm8001_ha->memoryMap.region[NVMD].num_elements = 1;
+	pm8001_ha->memoryMap.region[NVMD].element_size = 4096;
+	pm8001_ha->memoryMap.region[NVMD].total_len = 4096;
+	/* Memory region for devices*/
+	pm8001_ha->memoryMap.region[DEV_MEM].num_elements = 1;
+	pm8001_ha->memoryMap.region[DEV_MEM].element_size = PM8001_MAX_DEVICES *
+		sizeof(struct pm8001_device);
+	pm8001_ha->memoryMap.region[DEV_MEM].total_len = PM8001_MAX_DEVICES *
+		sizeof(struct pm8001_device);
+
+	/* Memory region for ccb_info*/
+	pm8001_ha->memoryMap.region[CCB_MEM].num_elements = 1;
+	pm8001_ha->memoryMap.region[CCB_MEM].element_size = PM8001_MAX_CCB *
+		sizeof(struct pm8001_ccb_info);
+	pm8001_ha->memoryMap.region[CCB_MEM].total_len = PM8001_MAX_CCB *
+		sizeof(struct pm8001_ccb_info);
+
+	for (i = 0; i < USI_MAX_MEMCNT; i++) {
+		if (pm8001_mem_alloc(pm8001_ha->pdev,
+			&pm8001_ha->memoryMap.region[i].virt_ptr,
+			&pm8001_ha->memoryMap.region[i].phys_addr,
+			&pm8001_ha->memoryMap.region[i].phys_addr_hi,
+			&pm8001_ha->memoryMap.region[i].phys_addr_lo,
+			pm8001_ha->memoryMap.region[i].total_len,
+			pm8001_ha->memoryMap.region[i].alignment) != 0) {
+				PM8001_FAIL_DBG(pm8001_ha,
+					pm8001_printk("Mem%d alloc failed\n",
+					i));
+				goto err_out;
+		}
+	}
+
+	pm8001_ha->devices = pm8001_ha->memoryMap.region[DEV_MEM].virt_ptr;
+	for (i = 0; i < PM8001_MAX_DEVICES; i++) {
+		pm8001_ha->devices[i].dev_type = NO_DEVICE;
+		pm8001_ha->devices[i].id = i;
+		pm8001_ha->devices[i].device_id = PM8001_MAX_DEVICES;
+		pm8001_ha->devices[i].running_req = 0;
+	}
+	pm8001_ha->ccb_info = pm8001_ha->memoryMap.region[CCB_MEM].virt_ptr;
+	for (i = 0; i < PM8001_MAX_CCB; i++) {
+		pm8001_ha->ccb_info[i].ccb_dma_handle =
+			pm8001_ha->memoryMap.region[CCB_MEM].phys_addr +
+			i * sizeof(struct pm8001_ccb_info);
+		pm8001_ha->ccb_info[i].task = NULL;
+		pm8001_ha->ccb_info[i].ccb_tag = 0xffffffff;
+		pm8001_ha->ccb_info[i].device = NULL;
+		++pm8001_ha->tags_num;
+	}
+	pm8001_ha->flags = PM8001F_INIT_TIME;
+	/* Initialize tags */
+	pm8001_tag_init(pm8001_ha);
+	return 0;
+err_out:
+	return 1;
+}
+
+/**
+ * pm8001_ioremap - remap the pci high physical address to kernal virtual
+ * address so that we can access them.
+ * @pm8001_ha:our hba structure.
+ */
+static int pm8001_ioremap(struct pm8001_hba_info *pm8001_ha)
+{
+	u32 bar;
+	u32 logicalBar = 0;
+	struct pci_dev *pdev;
+
+	pdev = pm8001_ha->pdev;
+	/* map pci mem (PMC pci base 0-3)*/
+	for (bar = 0; bar < 6; bar++) {
+		/*
+		** logical BARs for SPC:
+		** bar 0 and 1 - logical BAR0
+		** bar 2 and 3 - logical BAR1
+		** bar4 - logical BAR2
+		** bar5 - logical BAR3
+		** Skip the appropriate assignments:
+		*/
+		if ((bar == 1) || (bar == 3))
+			continue;
+		if (pci_resource_flags(pdev, bar) & IORESOURCE_MEM) {
+			pm8001_ha->io_mem[logicalBar].membase =
+				pci_resource_start(pdev, bar);
+			pm8001_ha->io_mem[logicalBar].membase &=
+				(u32)PCI_BASE_ADDRESS_MEM_MASK;
+			pm8001_ha->io_mem[logicalBar].memsize =
+				pci_resource_len(pdev, bar);
+			pm8001_ha->io_mem[logicalBar].memvirtaddr =
+				ioremap(pm8001_ha->io_mem[logicalBar].membase,
+				pm8001_ha->io_mem[logicalBar].memsize);
+			PM8001_INIT_DBG(pm8001_ha,
+				pm8001_printk("PCI: bar %d, logicalBar %d "
+				"virt_addr=%lx,len=%d\n", bar, logicalBar,
+				(unsigned long)
+				pm8001_ha->io_mem[logicalBar].memvirtaddr,
+				pm8001_ha->io_mem[logicalBar].memsize));
+		} else {
+			pm8001_ha->io_mem[logicalBar].membase	= 0;
+			pm8001_ha->io_mem[logicalBar].memsize	= 0;
+			pm8001_ha->io_mem[logicalBar].memvirtaddr = 0;
+		}
+		logicalBar++;
+	}
+	return 0;
+}
+
+/**
+ * pm8001_pci_alloc - initialize our ha card structure
+ * @pdev: pci device.
+ * @ent: ent
+ * @shost: scsi host struct which has been initialized before.
+ */
+static struct pm8001_hba_info *__devinit
+pm8001_pci_alloc(struct pci_dev *pdev, u32 chip_id, struct Scsi_Host *shost)
+{
+	struct pm8001_hba_info *pm8001_ha;
+	struct sas_ha_struct *sha = SHOST_TO_SAS_HA(shost);
+
+
+	pm8001_ha = sha->lldd_ha;
+	if (!pm8001_ha)
+		return NULL;
+
+	pm8001_ha->pdev = pdev;
+	pm8001_ha->dev = &pdev->dev;
+	pm8001_ha->chip_id = chip_id;
+	pm8001_ha->chip = &pm8001_chips[pm8001_ha->chip_id];
+	pm8001_ha->irq = pdev->irq;
+	pm8001_ha->sas = sha;
+	pm8001_ha->shost = shost;
+	pm8001_ha->id = pm8001_id++;
+	INIT_LIST_HEAD(&pm8001_ha->wq_list);
+	pm8001_ha->logging_level = 0x01;
+	sprintf(pm8001_ha->name, "%s%d", DRV_NAME, pm8001_ha->id);
+#ifdef PM8001_USE_TASKLET
+	tasklet_init(&pm8001_ha->tasklet, pm8001_tasklet,
+		(unsigned long)pm8001_ha);
+#endif
+	pm8001_ioremap(pm8001_ha);
+	if (!pm8001_alloc(pm8001_ha))
+		return pm8001_ha;
+	pm8001_free(pm8001_ha);
+	return NULL;
+}
+
+/**
+ * pci_go_44 - pm8001 specified, its DMA is 44 bit rather than 64 bit
+ * @pdev: pci device.
+ */
+static int pci_go_44(struct pci_dev *pdev)
+{
+	int rc;
+
+	if (!pci_set_dma_mask(pdev, DMA_BIT_MASK(44))) {
+		rc = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(44));
+		if (rc) {
+			rc = pci_set_consistent_dma_mask(pdev,
+				DMA_BIT_MASK(32));
+			if (rc) {
+				dev_printk(KERN_ERR, &pdev->dev,
+					"44-bit DMA enable failed\n");
+				return rc;
+			}
+		}
+	} else {
+		rc = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
+		if (rc) {
+			dev_printk(KERN_ERR, &pdev->dev,
+				"32-bit DMA enable failed\n");
+			return rc;
+		}
+		rc = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32));
+		if (rc) {
+			dev_printk(KERN_ERR, &pdev->dev,
+				"32-bit consistent DMA enable failed\n");
+			return rc;
+		}
+	}
+	return rc;
+}
+
+/**
+ * pm8001_prep_sas_ha_init - allocate memory in general hba struct && init them.
+ * @shost: scsi host which has been allocated outside.
+ * @chip_info: our ha struct.
+ */
+static int __devinit pm8001_prep_sas_ha_init(struct Scsi_Host * shost,
+	const struct pm8001_chip_info *chip_info)
+{
+	int phy_nr, port_nr;
+	struct asd_sas_phy **arr_phy;
+	struct asd_sas_port **arr_port;
+	struct sas_ha_struct *sha = SHOST_TO_SAS_HA(shost);
+
+	phy_nr = chip_info->n_phy;
+	port_nr = phy_nr;
+	memset(sha, 0x00, sizeof(*sha));
+	arr_phy = kcalloc(phy_nr, sizeof(void *), GFP_KERNEL);
+	if (!arr_phy)
+		goto exit;
+	arr_port = kcalloc(port_nr, sizeof(void *), GFP_KERNEL);
+	if (!arr_port)
+		goto exit_free2;
+
+	sha->sas_phy = arr_phy;
+	sha->sas_port = arr_port;
+	sha->lldd_ha = kzalloc(sizeof(struct pm8001_hba_info), GFP_KERNEL);
+	if (!sha->lldd_ha)
+		goto exit_free1;
+
+	shost->transportt = pm8001_stt;
+	shost->max_id = PM8001_MAX_DEVICES;
+	shost->max_lun = 8;
+	shost->max_channel = 0;
+	shost->unique_id = pm8001_id;
+	shost->max_cmd_len = 16;
+	shost->can_queue = PM8001_CAN_QUEUE;
+	shost->cmd_per_lun = 32;
+	return 0;
+exit_free1:
+	kfree(arr_port);
+exit_free2:
+	kfree(arr_phy);
+exit:
+	return -1;
+}
+
+/**
+ * pm8001_post_sas_ha_init - initialize general hba struct defined in libsas
+ * @shost: scsi host which has been allocated outside
+ * @chip_info: our ha struct.
+ */
+static void  __devinit pm8001_post_sas_ha_init(struct Scsi_Host *shost,
+	const struct pm8001_chip_info *chip_info)
+{
+	int i = 0;
+	struct pm8001_hba_info *pm8001_ha;
+	struct sas_ha_struct *sha = SHOST_TO_SAS_HA(shost);
+
+	pm8001_ha = sha->lldd_ha;
+	for (i = 0; i < chip_info->n_phy; i++) {
+		sha->sas_phy[i] = &pm8001_ha->phy[i].sas_phy;
+		sha->sas_port[i] = &pm8001_ha->port[i].sas_port;
+	}
+	sha->sas_ha_name = DRV_NAME;
+	sha->dev = pm8001_ha->dev;
+
+	sha->lldd_module = THIS_MODULE;
+	sha->sas_addr = &pm8001_ha->sas_addr[0];
+	sha->num_phys = chip_info->n_phy;
+	sha->lldd_max_execute_num = 1;
+	sha->lldd_queue_size = PM8001_CAN_QUEUE;
+	sha->core.shost = shost;
+}
+
+/**
+ * pm8001_init_sas_add - initialize sas address
+ * @chip_info: our ha struct.
+ *
+ * Currently we just set the fixed SAS address to our HBA,for manufacture,
+ * it should read from the EEPROM
+ */
+static void pm8001_init_sas_add(struct pm8001_hba_info *pm8001_ha)
+{
+	u8 i;
+#ifdef PM8001_READ_VPD
+	DECLARE_COMPLETION_ONSTACK(completion);
+	struct pm8001_ioctl_payload payload;
+	pm8001_ha->nvmd_completion = &completion;
+	payload.minor_function = 0;
+	payload.length = 128;
+	payload.func_specific = kzalloc(128, GFP_KERNEL);
+	PM8001_CHIP_DISP->get_nvmd_req(pm8001_ha, &payload);
+	wait_for_completion(&completion);
+	for (i = 0; i < pm8001_ha->chip->n_phy; i++) {
+		memcpy(&pm8001_ha->phy[i].dev_sas_addr, pm8001_ha->sas_addr,
+			SAS_ADDR_SIZE);
+		PM8001_INIT_DBG(pm8001_ha,
+			pm8001_printk("phy %d sas_addr = %016llx \n", i,
+			pm8001_ha->phy[i].dev_sas_addr));
+	}
+#else
+	for (i = 0; i < pm8001_ha->chip->n_phy; i++) {
+		pm8001_ha->phy[i].dev_sas_addr = 0x50010c600047f9d0ULL;
+		pm8001_ha->phy[i].dev_sas_addr =
+			cpu_to_be64((u64)
+				(*(u64 *)&pm8001_ha->phy[i].dev_sas_addr));
+	}
+	memcpy(pm8001_ha->sas_addr, &pm8001_ha->phy[0].dev_sas_addr,
+		SAS_ADDR_SIZE);
+#endif
+}
+
+#ifdef PM8001_USE_MSIX
+/**
+ * pm8001_setup_msix - enable MSI-X interrupt
+ * @chip_info: our ha struct.
+ * @irq_handler: irq_handler
+ */
+static u32 pm8001_setup_msix(struct pm8001_hba_info *pm8001_ha,
+	irq_handler_t irq_handler)
+{
+	u32 i = 0, j = 0;
+	u32 number_of_intr = 1;
+	int flag = 0;
+	u32 max_entry;
+	int rc;
+	max_entry = sizeof(pm8001_ha->msix_entries) /
+		sizeof(pm8001_ha->msix_entries[0]);
+	flag |= IRQF_DISABLED;
+	for (i = 0; i < max_entry ; i++)
+		pm8001_ha->msix_entries[i].entry = i;
+	rc = pci_enable_msix(pm8001_ha->pdev, pm8001_ha->msix_entries,
+		number_of_intr);
+	pm8001_ha->number_of_intr = number_of_intr;
+	if (!rc) {
+		for (i = 0; i < number_of_intr; i++) {
+			if (request_irq(pm8001_ha->msix_entries[i].vector,
+				irq_handler, flag, DRV_NAME,
+				SHOST_TO_SAS_HA(pm8001_ha->shost))) {
+				for (j = 0; j < i; j++)
+					free_irq(
+					pm8001_ha->msix_entries[j].vector,
+					SHOST_TO_SAS_HA(pm8001_ha->shost));
+				pci_disable_msix(pm8001_ha->pdev);
+				break;
+			}
+		}
+	}
+	return rc;
+}
+#endif
+
+/**
+ * pm8001_request_irq - register interrupt
+ * @chip_info: our ha struct.
+ */
+static u32 pm8001_request_irq(struct pm8001_hba_info *pm8001_ha)
+{
+	struct pci_dev *pdev;
+	irq_handler_t irq_handler = pm8001_interrupt;
+	int rc;
+
+	pdev = pm8001_ha->pdev;
+
+#ifdef PM8001_USE_MSIX
+	if (pci_find_capability(pdev, PCI_CAP_ID_MSIX))
+		return pm8001_setup_msix(pm8001_ha, irq_handler);
+	else
+		goto intx;
+#endif
+
+intx:
+	/* intialize the INT-X interrupt */
+	rc = request_irq(pdev->irq, irq_handler, IRQF_SHARED, DRV_NAME,
+		SHOST_TO_SAS_HA(pm8001_ha->shost));
+	return rc;
+}
+
+/**
+ * pm8001_pci_probe - probe supported device
+ * @pdev: pci device which kernel has been prepared for.
+ * @ent: pci device id
+ *
+ * This function is the main initialization function, when register a new
+ * pci driver it is invoked, all struct an hardware initilization should be done
+ * here, also, register interrupt
+ */
+static int __devinit pm8001_pci_probe(struct pci_dev *pdev,
+	const struct pci_device_id *ent)
+{
+	unsigned int rc;
+	u32	pci_reg;
+	struct pm8001_hba_info *pm8001_ha;
+	struct Scsi_Host *shost = NULL;
+	const struct pm8001_chip_info *chip;
+
+	dev_printk(KERN_INFO, &pdev->dev,
+		"pm8001: driver version %s\n", DRV_VERSION);
+	rc = pci_enable_device(pdev);
+	if (rc)
+		goto err_out_enable;
+	pci_set_master(pdev);
+	/*
+	 * Enable pci slot busmaster by setting pci command register.
+	 * This is required by FW for Cyclone card.
+	 */
+
+	pci_read_config_dword(pdev, PCI_COMMAND, &pci_reg);
+	pci_reg |= 0x157;
+	pci_write_config_dword(pdev, PCI_COMMAND, pci_reg);
+	rc = pci_request_regions(pdev, DRV_NAME);
+	if (rc)
+		goto err_out_disable;
+	rc = pci_go_44(pdev);
+	if (rc)
+		goto err_out_regions;
+
+	shost = scsi_host_alloc(&pm8001_sht, sizeof(void *));
+	if (!shost) {
+		rc = -ENOMEM;
+		goto err_out_regions;
+	}
+	chip = &pm8001_chips[ent->driver_data];
+	SHOST_TO_SAS_HA(shost) =
+		kcalloc(1, sizeof(struct sas_ha_struct), GFP_KERNEL);
+	if (!SHOST_TO_SAS_HA(shost)) {
+		rc = -ENOMEM;
+		goto err_out_free_host;
+	}
+
+	rc = pm8001_prep_sas_ha_init(shost, chip);
+	if (rc) {
+		rc = -ENOMEM;
+		goto err_out_free;
+	}
+	pci_set_drvdata(pdev, SHOST_TO_SAS_HA(shost));
+	pm8001_ha = pm8001_pci_alloc(pdev, chip_8001, shost);
+	if (!pm8001_ha) {
+		rc = -ENOMEM;
+		goto err_out_free;
+	}
+	list_add_tail(&pm8001_ha->list, &hba_list);
+	PM8001_CHIP_DISP->chip_soft_rst(pm8001_ha, 0x252acbcd);
+	rc = PM8001_CHIP_DISP->chip_init(pm8001_ha);
+	if (rc)
+		goto err_out_ha_free;
+
+	rc = scsi_add_host(shost, &pdev->dev);
+	if (rc)
+		goto err_out_ha_free;
+	rc = pm8001_request_irq(pm8001_ha);
+	if (rc)
+		goto err_out_shost;
+
+	PM8001_CHIP_DISP->interrupt_enable(pm8001_ha);
+	pm8001_init_sas_add(pm8001_ha);
+	pm8001_post_sas_ha_init(shost, chip);
+	rc = sas_register_ha(SHOST_TO_SAS_HA(shost));
+	if (rc)
+		goto err_out_shost;
+	scsi_scan_host(pm8001_ha->shost);
+	return 0;
+
+err_out_shost:
+	scsi_remove_host(pm8001_ha->shost);
+err_out_ha_free:
+	pm8001_free(pm8001_ha);
+err_out_free:
+	kfree(SHOST_TO_SAS_HA(shost));
+err_out_free_host:
+	kfree(shost);
+err_out_regions:
+	pci_release_regions(pdev);
+err_out_disable:
+	pci_disable_device(pdev);
+err_out_enable:
+	return rc;
+}
+
+static void __devexit pm8001_pci_remove(struct pci_dev *pdev)
+{
+	struct sas_ha_struct *sha = pci_get_drvdata(pdev);
+	struct pm8001_hba_info *pm8001_ha;
+	int i;
+	pm8001_ha = sha->lldd_ha;
+	pci_set_drvdata(pdev, NULL);
+	sas_unregister_ha(sha);
+	sas_remove_host(pm8001_ha->shost);
+	list_del(&pm8001_ha->list);
+	scsi_remove_host(pm8001_ha->shost);
+	PM8001_CHIP_DISP->interrupt_disable(pm8001_ha);
+	PM8001_CHIP_DISP->chip_soft_rst(pm8001_ha, 0x252acbcd);
+
+#ifdef PM8001_USE_MSIX
+	for (i = 0; i < pm8001_ha->number_of_intr; i++)
+		synchronize_irq(pm8001_ha->msix_entries[i].vector);
+	for (i = 0; i < pm8001_ha->number_of_intr; i++)
+		free_irq(pm8001_ha->msix_entries[i].vector, sha);
+	pci_disable_msix(pdev);
+#else
+	free_irq(pm8001_ha->irq, sha);
+#endif
+#ifdef PM8001_USE_TASKLET
+	tasklet_kill(&pm8001_ha->tasklet);
+#endif
+	pm8001_free(pm8001_ha);
+	kfree(sha->sas_phy);
+	kfree(sha->sas_port);
+	kfree(sha);
+	pci_release_regions(pdev);
+	pci_disable_device(pdev);
+}
+
+/**
+ * pm8001_pci_suspend - power management suspend main entry point
+ * @pdev: PCI device struct
+ * @state: PM state change to (usually PCI_D3)
+ *
+ * Returns 0 success, anything else error.
+ */
+static int pm8001_pci_suspend(struct pci_dev *pdev, pm_message_t state)
+{
+	struct sas_ha_struct *sha = pci_get_drvdata(pdev);
+	struct pm8001_hba_info *pm8001_ha;
+	int i , pos;
+	u32 device_state;
+	pm8001_ha = sha->lldd_ha;
+	flush_scheduled_work();
+	scsi_block_requests(pm8001_ha->shost);
+	pos = pci_find_capability(pdev, PCI_CAP_ID_PM);
+	if (pos == 0) {
+		printk(KERN_ERR " PCI PM not supported\n");
+		return -ENODEV;
+	}
+	PM8001_CHIP_DISP->interrupt_disable(pm8001_ha);
+	PM8001_CHIP_DISP->chip_soft_rst(pm8001_ha, 0x252acbcd);
+#ifdef PM8001_USE_MSIX
+	for (i = 0; i < pm8001_ha->number_of_intr; i++)
+		synchronize_irq(pm8001_ha->msix_entries[i].vector);
+	for (i = 0; i < pm8001_ha->number_of_intr; i++)
+		free_irq(pm8001_ha->msix_entries[i].vector, sha);
+	pci_disable_msix(pdev);
+#else
+	free_irq(pm8001_ha->irq, sha);
+#endif
+#ifdef PM8001_USE_TASKLET
+	tasklet_kill(&pm8001_ha->tasklet);
+#endif
+	device_state = pci_choose_state(pdev, state);
+	pm8001_printk("pdev=0x%p, slot=%s, entering "
+		      "operating state [D%d]\n", pdev,
+		      pm8001_ha->name, device_state);
+	pci_save_state(pdev);
+	pci_disable_device(pdev);
+	pci_set_power_state(pdev, device_state);
+	return 0;
+}
+
+/**
+ * pm8001_pci_resume - power management resume main entry point
+ * @pdev: PCI device struct
+ *
+ * Returns 0 success, anything else error.
+ */
+static int pm8001_pci_resume(struct pci_dev *pdev)
+{
+	struct sas_ha_struct *sha = pci_get_drvdata(pdev);
+	struct pm8001_hba_info *pm8001_ha;
+	int rc;
+	u32 device_state;
+	pm8001_ha = sha->lldd_ha;
+	device_state = pdev->current_state;
+
+	pm8001_printk("pdev=0x%p, slot=%s, resuming from previous "
+		"operating state [D%d]\n", pdev, pm8001_ha->name, device_state);
+
+	pci_set_power_state(pdev, PCI_D0);
+	pci_enable_wake(pdev, PCI_D0, 0);
+	pci_restore_state(pdev);
+	rc = pci_enable_device(pdev);
+	if (rc) {
+		pm8001_printk("slot=%s Enable device failed during resume\n",
+			      pm8001_ha->name);
+		goto err_out_enable;
+	}
+
+	pci_set_master(pdev);
+	rc = pci_go_44(pdev);
+	if (rc)
+		goto err_out_disable;
+
+	PM8001_CHIP_DISP->chip_soft_rst(pm8001_ha, 0x252acbcd);
+	rc = PM8001_CHIP_DISP->chip_init(pm8001_ha);
+	if (rc)
+		goto err_out_disable;
+	PM8001_CHIP_DISP->interrupt_disable(pm8001_ha);
+	rc = pm8001_request_irq(pm8001_ha);
+	if (rc)
+		goto err_out_disable;
+	#ifdef PM8001_USE_TASKLET
+	tasklet_init(&pm8001_ha->tasklet, pm8001_tasklet,
+		    (unsigned long)pm8001_ha);
+	#endif
+	PM8001_CHIP_DISP->interrupt_enable(pm8001_ha);
+	scsi_unblock_requests(pm8001_ha->shost);
+	return 0;
+
+err_out_disable:
+	scsi_remove_host(pm8001_ha->shost);
+	pci_disable_device(pdev);
+err_out_enable:
+	return rc;
+}
+
+static struct pci_device_id __devinitdata pm8001_pci_table[] = {
+	{
+		PCI_VDEVICE(PMC_Sierra, 0x8001), chip_8001
+	},
+	{
+		PCI_DEVICE(0x117c, 0x0042),
+		.driver_data = chip_8001
+	},
+	{} /* terminate list */
+};
+
+static struct pci_driver pm8001_pci_driver = {
+	.name		= DRV_NAME,
+	.id_table	= pm8001_pci_table,
+	.probe		= pm8001_pci_probe,
+	.remove		= __devexit_p(pm8001_pci_remove),
+	.suspend	= pm8001_pci_suspend,
+	.resume		= pm8001_pci_resume,
+};
+
+/**
+ *	pm8001_init - initialize scsi transport template
+ */
+static int __init pm8001_init(void)
+{
+	int rc;
+	pm8001_id = 0;
+	pm8001_stt = sas_domain_attach_transport(&pm8001_transport_ops);
+	if (!pm8001_stt)
+		return -ENOMEM;
+	rc = pci_register_driver(&pm8001_pci_driver);
+	if (rc)
+		goto err_out;
+	return 0;
+err_out:
+	sas_release_transport(pm8001_stt);
+	return rc;
+}
+
+static void __exit pm8001_exit(void)
+{
+	pci_unregister_driver(&pm8001_pci_driver);
+	sas_release_transport(pm8001_stt);
+}
+
+module_init(pm8001_init);
+module_exit(pm8001_exit);
+
+MODULE_AUTHOR("Jack Wang <jack_wang@usish.com>");
+MODULE_DESCRIPTION("PMC-Sierra PM8001 SAS/SATA controller driver");
+MODULE_VERSION(DRV_VERSION);
+MODULE_LICENSE("GPL");
+MODULE_DEVICE_TABLE(pci, pm8001_pci_table);
+
diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
new file mode 100644
index 000000000000..7f9c83a76390
--- /dev/null
+++ b/drivers/scsi/pm8001/pm8001_sas.c
@@ -0,0 +1,1152 @@
+/*
+ * PMC-Sierra SPC 8001 SAS/SATA based host adapters driver
+ *
+ * Copyright (c) 2008-2009 USI Co., Ltd.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ *
+ */
+
+#include "pm8001_sas.h"
+
+/**
+ * pm8001_find_tag - from sas task to find out  tag that belongs to this task
+ * @task: the task sent to the LLDD
+ * @tag: the found tag associated with the task
+ */
+static int pm8001_find_tag(struct sas_task *task, u32 *tag)
+{
+	if (task->lldd_task) {
+		struct pm8001_ccb_info *ccb;
+		ccb = task->lldd_task;
+		*tag = ccb->ccb_tag;
+		return 1;
+	}
+	return 0;
+}
+
+/**
+  * pm8001_tag_clear - clear the tags bitmap
+  * @pm8001_ha: our hba struct
+  * @tag: the found tag associated with the task
+  */
+static void pm8001_tag_clear(struct pm8001_hba_info *pm8001_ha, u32 tag)
+{
+	void *bitmap = pm8001_ha->tags;
+	clear_bit(tag, bitmap);
+}
+
+static void pm8001_tag_free(struct pm8001_hba_info *pm8001_ha, u32 tag)
+{
+	pm8001_tag_clear(pm8001_ha, tag);
+}
+
+static void pm8001_tag_set(struct pm8001_hba_info *pm8001_ha, u32 tag)
+{
+	void *bitmap = pm8001_ha->tags;
+	set_bit(tag, bitmap);
+}
+
+/**
+  * pm8001_tag_alloc - allocate a empty tag for task used.
+  * @pm8001_ha: our hba struct
+  * @tag_out: the found empty tag .
+  */
+inline int pm8001_tag_alloc(struct pm8001_hba_info *pm8001_ha, u32 *tag_out)
+{
+	unsigned int index, tag;
+	void *bitmap = pm8001_ha->tags;
+
+	index = find_first_zero_bit(bitmap, pm8001_ha->tags_num);
+	tag = index;
+	if (tag >= pm8001_ha->tags_num)
+		return -SAS_QUEUE_FULL;
+	pm8001_tag_set(pm8001_ha, tag);
+	*tag_out = tag;
+	return 0;
+}
+
+void pm8001_tag_init(struct pm8001_hba_info *pm8001_ha)
+{
+	int i;
+	for (i = 0; i < pm8001_ha->tags_num; ++i)
+		pm8001_tag_clear(pm8001_ha, i);
+}
+
+ /**
+  * pm8001_mem_alloc - allocate memory for pm8001.
+  * @pdev: pci device.
+  * @virt_addr: the allocated virtual address
+  * @pphys_addr_hi: the physical address high byte address.
+  * @pphys_addr_lo: the physical address low byte address.
+  * @mem_size: memory size.
+  */
+int pm8001_mem_alloc(struct pci_dev *pdev, void **virt_addr,
+	dma_addr_t *pphys_addr, u32 *pphys_addr_hi,
+	u32 *pphys_addr_lo, u32 mem_size, u32 align)
+{
+	caddr_t mem_virt_alloc;
+	dma_addr_t mem_dma_handle;
+	u64 phys_align;
+	u64 align_offset = 0;
+	if (align)
+		align_offset = (dma_addr_t)align - 1;
+	mem_virt_alloc =
+		pci_alloc_consistent(pdev, mem_size + align, &mem_dma_handle);
+	if (!mem_virt_alloc) {
+		pm8001_printk("memory allocation error\n");
+		return -1;
+	}
+	memset((void *)mem_virt_alloc, 0, mem_size+align);
+	*pphys_addr = mem_dma_handle;
+	phys_align = (*pphys_addr + align_offset) & ~align_offset;
+	*virt_addr = (void *)mem_virt_alloc + phys_align - *pphys_addr;
+	*pphys_addr_hi = upper_32_bits(phys_align);
+	*pphys_addr_lo = lower_32_bits(phys_align);
+	return 0;
+}
+/**
+  * pm8001_find_ha_by_dev - from domain device which come from sas layer to
+  * find out our hba struct.
+  * @dev: the domain device which from sas layer.
+  */
+static
+struct pm8001_hba_info *pm8001_find_ha_by_dev(struct domain_device *dev)
+{
+	struct sas_ha_struct *sha = dev->port->ha;
+	struct pm8001_hba_info *pm8001_ha = sha->lldd_ha;
+	return pm8001_ha;
+}
+
+/**
+  * pm8001_phy_control - this function should be registered to
+  * sas_domain_function_template to provide libsas used, note: this is just
+  * control the HBA phy rather than other expander phy if you want control
+  * other phy, you should use SMP command.
+  * @sas_phy: which phy in HBA phys.
+  * @func: the operation.
+  * @funcdata: always NULL.
+  */
+int pm8001_phy_control(struct asd_sas_phy *sas_phy, enum phy_func func,
+	void *funcdata)
+{
+	int rc = 0, phy_id = sas_phy->id;
+	struct pm8001_hba_info *pm8001_ha = NULL;
+	struct sas_phy_linkrates *rates;
+	DECLARE_COMPLETION_ONSTACK(completion);
+	pm8001_ha = sas_phy->ha->lldd_ha;
+	pm8001_ha->phy[phy_id].enable_completion = &completion;
+	switch (func) {
+	case PHY_FUNC_SET_LINK_RATE:
+		rates = funcdata;
+		if (rates->minimum_linkrate) {
+			pm8001_ha->phy[phy_id].minimum_linkrate =
+				rates->minimum_linkrate;
+		}
+		if (rates->maximum_linkrate) {
+			pm8001_ha->phy[phy_id].maximum_linkrate =
+				rates->maximum_linkrate;
+		}
+		if (pm8001_ha->phy[phy_id].phy_state == 0) {
+			PM8001_CHIP_DISP->phy_start_req(pm8001_ha, phy_id);
+			wait_for_completion(&completion);
+		}
+		PM8001_CHIP_DISP->phy_ctl_req(pm8001_ha, phy_id,
+					      PHY_LINK_RESET);
+		break;
+	case PHY_FUNC_HARD_RESET:
+		if (pm8001_ha->phy[phy_id].phy_state == 0) {
+			PM8001_CHIP_DISP->phy_start_req(pm8001_ha, phy_id);
+			wait_for_completion(&completion);
+		}
+		PM8001_CHIP_DISP->phy_ctl_req(pm8001_ha, phy_id,
+					      PHY_HARD_RESET);
+		break;
+	case PHY_FUNC_LINK_RESET:
+		if (pm8001_ha->phy[phy_id].phy_state == 0) {
+			PM8001_CHIP_DISP->phy_start_req(pm8001_ha, phy_id);
+			wait_for_completion(&completion);
+		}
+		PM8001_CHIP_DISP->phy_ctl_req(pm8001_ha, phy_id,
+					      PHY_LINK_RESET);
+		break;
+	case PHY_FUNC_RELEASE_SPINUP_HOLD:
+		PM8001_CHIP_DISP->phy_ctl_req(pm8001_ha, phy_id,
+					      PHY_LINK_RESET);
+		break;
+	case PHY_FUNC_DISABLE:
+		PM8001_CHIP_DISP->phy_stop_req(pm8001_ha, phy_id);
+		break;
+	default:
+		rc = -EOPNOTSUPP;
+	}
+	msleep(300);
+	return rc;
+}
+
+int pm8001_slave_alloc(struct scsi_device *scsi_dev)
+{
+	struct domain_device *dev = sdev_to_domain_dev(scsi_dev);
+	if (dev_is_sata(dev)) {
+		/* We don't need to rescan targets
+		* if REPORT_LUNS request is failed
+		*/
+		if (scsi_dev->lun > 0)
+			return -ENXIO;
+		scsi_dev->tagged_supported = 1;
+	}
+	return sas_slave_alloc(scsi_dev);
+}
+
+/**
+  * pm8001_scan_start - we should enable all HBA phys by sending the phy_start
+  * command to HBA.
+  * @shost: the scsi host data.
+  */
+void pm8001_scan_start(struct Scsi_Host *shost)
+{
+	int i;
+	struct pm8001_hba_info *pm8001_ha;
+	struct sas_ha_struct *sha = SHOST_TO_SAS_HA(shost);
+	pm8001_ha = sha->lldd_ha;
+	PM8001_CHIP_DISP->sas_re_init_req(pm8001_ha);
+	for (i = 0; i < pm8001_ha->chip->n_phy; ++i)
+		PM8001_CHIP_DISP->phy_start_req(pm8001_ha, i);
+}
+
+int pm8001_scan_finished(struct Scsi_Host *shost, unsigned long time)
+{
+	/* give the phy enabling interrupt event time to come in (1s
+	* is empirically about all it takes) */
+	if (time < HZ)
+		return 0;
+	/* Wait for discovery to finish */
+	scsi_flush_work(shost);
+	return 1;
+}
+
+/**
+  * pm8001_task_prep_smp - the dispatcher function, prepare data for smp task
+  * @pm8001_ha: our hba card information
+  * @ccb: the ccb which attached to smp task
+  */
+static int pm8001_task_prep_smp(struct pm8001_hba_info *pm8001_ha,
+	struct pm8001_ccb_info *ccb)
+{
+	return PM8001_CHIP_DISP->smp_req(pm8001_ha, ccb);
+}
+
+u32 pm8001_get_ncq_tag(struct sas_task *task, u32 *tag)
+{
+	struct ata_queued_cmd *qc = task->uldd_task;
+	if (qc) {
+		if (qc->tf.command == ATA_CMD_FPDMA_WRITE ||
+			qc->tf.command == ATA_CMD_FPDMA_READ) {
+			*tag = qc->tag;
+			return 1;
+		}
+	}
+	return 0;
+}
+
+/**
+  * pm8001_task_prep_ata - the dispatcher function, prepare data for sata task
+  * @pm8001_ha: our hba card information
+  * @ccb: the ccb which attached to sata task
+  */
+static int pm8001_task_prep_ata(struct pm8001_hba_info *pm8001_ha,
+	struct pm8001_ccb_info *ccb)
+{
+	return PM8001_CHIP_DISP->sata_req(pm8001_ha, ccb);
+}
+
+/**
+  * pm8001_task_prep_ssp_tm - the dispatcher function, prepare task management data
+  * @pm8001_ha: our hba card information
+  * @ccb: the ccb which attached to TM
+  * @tmf: the task management IU
+  */
+static int pm8001_task_prep_ssp_tm(struct pm8001_hba_info *pm8001_ha,
+	struct pm8001_ccb_info *ccb, struct pm8001_tmf_task *tmf)
+{
+	return PM8001_CHIP_DISP->ssp_tm_req(pm8001_ha, ccb, tmf);
+}
+
+/**
+  * pm8001_task_prep_ssp - the dispatcher function,prepare ssp data for ssp task
+  * @pm8001_ha: our hba card information
+  * @ccb: the ccb which attached to ssp task
+  */
+static int pm8001_task_prep_ssp(struct pm8001_hba_info *pm8001_ha,
+	struct pm8001_ccb_info *ccb)
+{
+	return PM8001_CHIP_DISP->ssp_io_req(pm8001_ha, ccb);
+}
+int pm8001_slave_configure(struct scsi_device *sdev)
+{
+	struct domain_device *dev = sdev_to_domain_dev(sdev);
+	int ret = sas_slave_configure(sdev);
+	if (ret)
+		return ret;
+	if (dev_is_sata(dev)) {
+	#ifdef PM8001_DISABLE_NCQ
+		struct ata_port *ap = dev->sata_dev.ap;
+		struct ata_device *adev = ap->link.device;
+		adev->flags |= ATA_DFLAG_NCQ_OFF;
+		scsi_adjust_queue_depth(sdev, MSG_SIMPLE_TAG, 1);
+	#endif
+	}
+	return 0;
+}
+ /* Find the local port id that's attached to this device */
+static int sas_find_local_port_id(struct domain_device *dev)
+{
+	struct domain_device *pdev = dev->parent;
+
+	/* Directly attached device */
+	if (!pdev)
+		return dev->port->id;
+	while (pdev) {
+		struct domain_device *pdev_p = pdev->parent;
+		if (!pdev_p)
+			return pdev->port->id;
+		pdev = pdev->parent;
+	}
+	return 0;
+}
+
+/**
+  * pm8001_task_exec - queue the task(ssp, smp && ata) to the hardware.
+  * @task: the task to be execute.
+  * @num: if can_queue great than 1, the task can be queued up. for SMP task,
+  * we always execute one one time.
+  * @gfp_flags: gfp_flags.
+  * @is_tmf: if it is task management task.
+  * @tmf: the task management IU
+  */
+#define DEV_IS_GONE(pm8001_dev)	\
+	((!pm8001_dev || (pm8001_dev->dev_type == NO_DEVICE)))
+static int pm8001_task_exec(struct sas_task *task, const int num,
+	gfp_t gfp_flags, int is_tmf, struct pm8001_tmf_task *tmf)
+{
+	struct domain_device *dev = task->dev;
+	struct pm8001_hba_info *pm8001_ha;
+	struct pm8001_device *pm8001_dev;
+	struct pm8001_port *port = NULL;
+	struct sas_task *t = task;
+	struct pm8001_ccb_info *ccb;
+	u32 tag = 0xdeadbeef, rc, n_elem = 0;
+	u32 n = num;
+	unsigned long flags = 0, flags_libsas = 0;
+
+	if (!dev->port) {
+		struct task_status_struct *tsm = &t->task_status;
+		tsm->resp = SAS_TASK_UNDELIVERED;
+		tsm->stat = SAS_PHY_DOWN;
+		if (dev->dev_type != SATA_DEV)
+			t->task_done(t);
+		return 0;
+	}
+	pm8001_ha = pm8001_find_ha_by_dev(task->dev);
+	PM8001_IO_DBG(pm8001_ha, pm8001_printk("pm8001_task_exec device \n "));
+	spin_lock_irqsave(&pm8001_ha->lock, flags);
+	do {
+		dev = t->dev;
+		pm8001_dev = dev->lldd_dev;
+		if (DEV_IS_GONE(pm8001_dev)) {
+			if (pm8001_dev) {
+				PM8001_IO_DBG(pm8001_ha,
+					pm8001_printk("device %d not ready.\n",
+					pm8001_dev->device_id));
+			} else {
+				PM8001_IO_DBG(pm8001_ha,
+					pm8001_printk("device %016llx not "
+					"ready.\n", SAS_ADDR(dev->sas_addr)));
+			}
+			rc = SAS_PHY_DOWN;
+			goto out_done;
+		}
+		port = &pm8001_ha->port[sas_find_local_port_id(dev)];
+		if (!port->port_attached) {
+			if (sas_protocol_ata(t->task_proto)) {
+				struct task_status_struct *ts = &t->task_status;
+				ts->resp = SAS_TASK_UNDELIVERED;
+				ts->stat = SAS_PHY_DOWN;
+
+				spin_unlock_irqrestore(&pm8001_ha->lock, flags);
+				spin_unlock_irqrestore(dev->sata_dev.ap->lock,
+						flags_libsas);
+				t->task_done(t);
+				spin_lock_irqsave(dev->sata_dev.ap->lock,
+					flags_libsas);
+				spin_lock_irqsave(&pm8001_ha->lock, flags);
+				if (n > 1)
+					t = list_entry(t->list.next,
+							struct sas_task, list);
+				continue;
+			} else {
+				struct task_status_struct *ts = &t->task_status;
+				ts->resp = SAS_TASK_UNDELIVERED;
+				ts->stat = SAS_PHY_DOWN;
+				t->task_done(t);
+				if (n > 1)
+					t = list_entry(t->list.next,
+							struct sas_task, list);
+				continue;
+			}
+		}
+		rc = pm8001_tag_alloc(pm8001_ha, &tag);
+		if (rc)
+			goto err_out;
+		ccb = &pm8001_ha->ccb_info[tag];
+
+		if (!sas_protocol_ata(t->task_proto)) {
+			if (t->num_scatter) {
+				n_elem = dma_map_sg(pm8001_ha->dev,
+					t->scatter,
+					t->num_scatter,
+					t->data_dir);
+				if (!n_elem) {
+					rc = -ENOMEM;
+					goto err_out_tag;
+				}
+			}
+		} else {
+			n_elem = t->num_scatter;
+		}
+
+		t->lldd_task = ccb;
+		ccb->n_elem = n_elem;
+		ccb->ccb_tag = tag;
+		ccb->task = t;
+		switch (t->task_proto) {
+		case SAS_PROTOCOL_SMP:
+			rc = pm8001_task_prep_smp(pm8001_ha, ccb);
+			break;
+		case SAS_PROTOCOL_SSP:
+			if (is_tmf)
+				rc = pm8001_task_prep_ssp_tm(pm8001_ha,
+					ccb, tmf);
+			else
+				rc = pm8001_task_prep_ssp(pm8001_ha, ccb);
+			break;
+		case SAS_PROTOCOL_SATA:
+		case SAS_PROTOCOL_STP:
+		case SAS_PROTOCOL_SATA | SAS_PROTOCOL_STP:
+			rc = pm8001_task_prep_ata(pm8001_ha, ccb);
+			break;
+		default:
+			dev_printk(KERN_ERR, pm8001_ha->dev,
+				"unknown sas_task proto: 0x%x\n",
+				t->task_proto);
+			rc = -EINVAL;
+			break;
+		}
+
+		if (rc) {
+			PM8001_IO_DBG(pm8001_ha,
+				pm8001_printk("rc is %x\n", rc));
+			goto err_out_tag;
+		}
+		/* TODO: select normal or high priority */
+		spin_lock(&t->task_state_lock);
+		t->task_state_flags |= SAS_TASK_AT_INITIATOR;
+		spin_unlock(&t->task_state_lock);
+		pm8001_dev->running_req++;
+		if (n > 1)
+			t = list_entry(t->list.next, struct sas_task, list);
+	} while (--n);
+	rc = 0;
+	goto out_done;
+
+err_out_tag:
+	pm8001_tag_free(pm8001_ha, tag);
+err_out:
+	dev_printk(KERN_ERR, pm8001_ha->dev, "pm8001 exec failed[%d]!\n", rc);
+	if (!sas_protocol_ata(t->task_proto))
+		if (n_elem)
+			dma_unmap_sg(pm8001_ha->dev, t->scatter, n_elem,
+				t->data_dir);
+out_done:
+	spin_unlock_irqrestore(&pm8001_ha->lock, flags);
+	return rc;
+}
+
+/**
+  * pm8001_queue_command - register for upper layer used, all IO commands sent
+  * to HBA are from this interface.
+  * @task: the task to be execute.
+  * @num: if can_queue great than 1, the task can be queued up. for SMP task,
+  * we always execute one one time
+  * @gfp_flags: gfp_flags
+  */
+int pm8001_queue_command(struct sas_task *task, const int num,
+		gfp_t gfp_flags)
+{
+	return pm8001_task_exec(task, num, gfp_flags, 0, NULL);
+}
+
+void pm8001_ccb_free(struct pm8001_hba_info *pm8001_ha, u32 ccb_idx)
+{
+	pm8001_tag_clear(pm8001_ha, ccb_idx);
+}
+
+/**
+  * pm8001_ccb_task_free - free the sg for ssp and smp command, free the ccb.
+  * @pm8001_ha: our hba card information
+  * @ccb: the ccb which attached to ssp task
+  * @task: the task to be free.
+  * @ccb_idx: ccb index.
+  */
+void pm8001_ccb_task_free(struct pm8001_hba_info *pm8001_ha,
+	struct sas_task *task, struct pm8001_ccb_info *ccb, u32 ccb_idx)
+{
+	if (!ccb->task)
+		return;
+	if (!sas_protocol_ata(task->task_proto))
+		if (ccb->n_elem)
+			dma_unmap_sg(pm8001_ha->dev, task->scatter,
+				task->num_scatter, task->data_dir);
+
+	switch (task->task_proto) {
+	case SAS_PROTOCOL_SMP:
+		dma_unmap_sg(pm8001_ha->dev, &task->smp_task.smp_resp, 1,
+			PCI_DMA_FROMDEVICE);
+		dma_unmap_sg(pm8001_ha->dev, &task->smp_task.smp_req, 1,
+			PCI_DMA_TODEVICE);
+		break;
+
+	case SAS_PROTOCOL_SATA:
+	case SAS_PROTOCOL_STP:
+	case SAS_PROTOCOL_SSP:
+	default:
+		/* do nothing */
+		break;
+	}
+	task->lldd_task = NULL;
+	ccb->task = NULL;
+	ccb->ccb_tag = 0xFFFFFFFF;
+	pm8001_ccb_free(pm8001_ha, ccb_idx);
+}
+
+ /**
+  * pm8001_alloc_dev - find a empty pm8001_device
+  * @pm8001_ha: our hba card information
+  */
+struct pm8001_device *pm8001_alloc_dev(struct pm8001_hba_info *pm8001_ha)
+{
+	u32 dev;
+	for (dev = 0; dev < PM8001_MAX_DEVICES; dev++) {
+		if (pm8001_ha->devices[dev].dev_type == NO_DEVICE) {
+			pm8001_ha->devices[dev].id = dev;
+			return &pm8001_ha->devices[dev];
+		}
+	}
+	if (dev == PM8001_MAX_DEVICES) {
+		PM8001_FAIL_DBG(pm8001_ha,
+			pm8001_printk("max support %d devices, ignore ..\n",
+			PM8001_MAX_DEVICES));
+	}
+	return NULL;
+}
+
+static void pm8001_free_dev(struct pm8001_device *pm8001_dev)
+{
+	u32 id = pm8001_dev->id;
+	memset(pm8001_dev, 0, sizeof(*pm8001_dev));
+	pm8001_dev->id = id;
+	pm8001_dev->dev_type = NO_DEVICE;
+	pm8001_dev->device_id = PM8001_MAX_DEVICES;
+	pm8001_dev->sas_device = NULL;
+}
+
+/**
+  * pm8001_dev_found_notify - libsas notify a device is found.
+  * @dev: the device structure which sas layer used.
+  *
+  * when libsas find a sas domain device, it should tell the LLDD that
+  * device is found, and then LLDD register this device to HBA firmware
+  * by the command "OPC_INB_REG_DEV", after that the HBA will assign a
+  * device ID(according to device's sas address) and returned it to LLDD. From
+  * now on, we communicate with HBA FW with the device ID which HBA assigned
+  * rather than sas address. it is the neccessary step for our HBA but it is
+  * the optional for other HBA driver.
+  */
+static int pm8001_dev_found_notify(struct domain_device *dev)
+{
+	unsigned long flags = 0;
+	int res = 0;
+	struct pm8001_hba_info *pm8001_ha = NULL;
+	struct domain_device *parent_dev = dev->parent;
+	struct pm8001_device *pm8001_device;
+	DECLARE_COMPLETION_ONSTACK(completion);
+	u32 flag = 0;
+	pm8001_ha = pm8001_find_ha_by_dev(dev);
+	spin_lock_irqsave(&pm8001_ha->lock, flags);
+
+	pm8001_device = pm8001_alloc_dev(pm8001_ha);
+	if (!pm8001_device) {
+		res = -1;
+		goto found_out;
+	}
+	pm8001_device->sas_device = dev;
+	dev->lldd_dev = pm8001_device;
+	pm8001_device->dev_type = dev->dev_type;
+	pm8001_device->dcompletion = &completion;
+	if (parent_dev && DEV_IS_EXPANDER(parent_dev->dev_type)) {
+		int phy_id;
+		struct ex_phy *phy;
+		for (phy_id = 0; phy_id < parent_dev->ex_dev.num_phys;
+		phy_id++) {
+			phy = &parent_dev->ex_dev.ex_phy[phy_id];
+			if (SAS_ADDR(phy->attached_sas_addr)
+				== SAS_ADDR(dev->sas_addr)) {
+				pm8001_device->attached_phy = phy_id;
+				break;
+			}
+		}
+		if (phy_id == parent_dev->ex_dev.num_phys) {
+			PM8001_FAIL_DBG(pm8001_ha,
+			pm8001_printk("Error: no attached dev:%016llx"
+			" at ex:%016llx.\n", SAS_ADDR(dev->sas_addr),
+				SAS_ADDR(parent_dev->sas_addr)));
+			res = -1;
+		}
+	} else {
+		if (dev->dev_type == SATA_DEV) {
+			pm8001_device->attached_phy =
+				dev->rphy->identify.phy_identifier;
+				flag = 1; /* directly sata*/
+		}
+	} /*register this device to HBA*/
+	PM8001_DISC_DBG(pm8001_ha, pm8001_printk("Found device \n"));
+	PM8001_CHIP_DISP->reg_dev_req(pm8001_ha, pm8001_device, flag);
+	spin_unlock_irqrestore(&pm8001_ha->lock, flags);
+	wait_for_completion(&completion);
+	if (dev->dev_type == SAS_END_DEV)
+		msleep(50);
+	pm8001_ha->flags |= PM8001F_RUN_TIME ;
+	return 0;
+found_out:
+	spin_unlock_irqrestore(&pm8001_ha->lock, flags);
+	return res;
+}
+
+int pm8001_dev_found(struct domain_device *dev)
+{
+	return pm8001_dev_found_notify(dev);
+}
+
+/**
+  * pm8001_alloc_task - allocate a task structure for TMF
+  */
+static struct sas_task *pm8001_alloc_task(void)
+{
+	struct sas_task *task = kzalloc(sizeof(*task), GFP_KERNEL);
+	if (task) {
+		INIT_LIST_HEAD(&task->list);
+		spin_lock_init(&task->task_state_lock);
+		task->task_state_flags = SAS_TASK_STATE_PENDING;
+		init_timer(&task->timer);
+		init_completion(&task->completion);
+	}
+	return task;
+}
+
+static void pm8001_free_task(struct sas_task *task)
+{
+	if (task) {
+		BUG_ON(!list_empty(&task->list));
+		kfree(task);
+	}
+}
+
+static void pm8001_task_done(struct sas_task *task)
+{
+	if (!del_timer(&task->timer))
+		return;
+	complete(&task->completion);
+}
+
+static void pm8001_tmf_timedout(unsigned long data)
+{
+	struct sas_task *task = (struct sas_task *)data;
+
+	task->task_state_flags |= SAS_TASK_STATE_ABORTED;
+	complete(&task->completion);
+}
+
+#define PM8001_TASK_TIMEOUT 20
+/**
+  * pm8001_exec_internal_tmf_task - execute some task management commands.
+  * @dev: the wanted device.
+  * @tmf: which task management wanted to be take.
+  * @para_len: para_len.
+  * @parameter: ssp task parameter.
+  *
+  * when errors or exception happened, we may want to do something, for example
+  * abort the issued task which result in this execption, it is done by calling
+  * this function, note it is also with the task execute interface.
+  */
+static int pm8001_exec_internal_tmf_task(struct domain_device *dev,
+	void *parameter, u32 para_len, struct pm8001_tmf_task *tmf)
+{
+	int res, retry;
+	struct sas_task *task = NULL;
+	struct pm8001_hba_info *pm8001_ha = pm8001_find_ha_by_dev(dev);
+
+	for (retry = 0; retry < 3; retry++) {
+		task = pm8001_alloc_task();
+		if (!task)
+			return -ENOMEM;
+
+		task->dev = dev;
+		task->task_proto = dev->tproto;
+		memcpy(&task->ssp_task, parameter, para_len);
+		task->task_done = pm8001_task_done;
+		task->timer.data = (unsigned long)task;
+		task->timer.function = pm8001_tmf_timedout;
+		task->timer.expires = jiffies + PM8001_TASK_TIMEOUT*HZ;
+		add_timer(&task->timer);
+
+		res = pm8001_task_exec(task, 1, GFP_KERNEL, 1, tmf);
+
+		if (res) {
+			del_timer(&task->timer);
+			PM8001_FAIL_DBG(pm8001_ha,
+				pm8001_printk("Executing internal task "
+				"failed\n"));
+			goto ex_err;
+		}
+		wait_for_completion(&task->completion);
+		res = -TMF_RESP_FUNC_FAILED;
+		/* Even TMF timed out, return direct. */
+		if ((task->task_state_flags & SAS_TASK_STATE_ABORTED)) {
+			if (!(task->task_state_flags & SAS_TASK_STATE_DONE)) {
+				PM8001_FAIL_DBG(pm8001_ha,
+					pm8001_printk("TMF task[%x]timeout.\n",
+					tmf->tmf));
+				goto ex_err;
+			}
+		}
+
+		if (task->task_status.resp == SAS_TASK_COMPLETE &&
+			task->task_status.stat == SAM_GOOD) {
+			res = TMF_RESP_FUNC_COMPLETE;
+			break;
+		}
+
+		if (task->task_status.resp == SAS_TASK_COMPLETE &&
+		task->task_status.stat == SAS_DATA_UNDERRUN) {
+			/* no error, but return the number of bytes of
+			* underrun */
+			res = task->task_status.residual;
+			break;
+		}
+
+		if (task->task_status.resp == SAS_TASK_COMPLETE &&
+			task->task_status.stat == SAS_DATA_OVERRUN) {
+			PM8001_FAIL_DBG(pm8001_ha,
+				pm8001_printk("Blocked task error.\n"));
+			res = -EMSGSIZE;
+			break;
+		} else {
+			PM8001_EH_DBG(pm8001_ha,
+				pm8001_printk(" Task to dev %016llx response:"
+				"0x%x status 0x%x\n",
+				SAS_ADDR(dev->sas_addr),
+				task->task_status.resp,
+				task->task_status.stat));
+			pm8001_free_task(task);
+			task = NULL;
+		}
+	}
+ex_err:
+	BUG_ON(retry == 3 && task != NULL);
+	if (task != NULL)
+		pm8001_free_task(task);
+	return res;
+}
+
+static int
+pm8001_exec_internal_task_abort(struct pm8001_hba_info *pm8001_ha,
+	struct pm8001_device *pm8001_dev, struct domain_device *dev, u32 flag,
+	u32 task_tag)
+{
+	int res, retry;
+	u32 ccb_tag;
+	struct pm8001_ccb_info *ccb;
+	struct sas_task *task = NULL;
+
+	for (retry = 0; retry < 3; retry++) {
+		task = pm8001_alloc_task();
+		if (!task)
+			return -ENOMEM;
+
+		task->dev = dev;
+		task->task_proto = dev->tproto;
+		task->task_done = pm8001_task_done;
+		task->timer.data = (unsigned long)task;
+		task->timer.function = pm8001_tmf_timedout;
+		task->timer.expires = jiffies + PM8001_TASK_TIMEOUT * HZ;
+		add_timer(&task->timer);
+
+		res = pm8001_tag_alloc(pm8001_ha, &ccb_tag);
+		if (res)
+			return res;
+		ccb = &pm8001_ha->ccb_info[ccb_tag];
+		ccb->device = pm8001_dev;
+		ccb->ccb_tag = ccb_tag;
+		ccb->task = task;
+
+		res = PM8001_CHIP_DISP->task_abort(pm8001_ha,
+			pm8001_dev, flag, task_tag, ccb_tag);
+
+		if (res) {
+			del_timer(&task->timer);
+			PM8001_FAIL_DBG(pm8001_ha,
+				pm8001_printk("Executing internal task "
+				"failed\n"));
+			goto ex_err;
+		}
+		wait_for_completion(&task->completion);
+		res = TMF_RESP_FUNC_FAILED;
+		/* Even TMF timed out, return direct. */
+		if ((task->task_state_flags & SAS_TASK_STATE_ABORTED)) {
+			if (!(task->task_state_flags & SAS_TASK_STATE_DONE)) {
+				PM8001_FAIL_DBG(pm8001_ha,
+					pm8001_printk("TMF task timeout.\n"));
+				goto ex_err;
+			}
+		}
+
+		if (task->task_status.resp == SAS_TASK_COMPLETE &&
+			task->task_status.stat == SAM_GOOD) {
+			res = TMF_RESP_FUNC_COMPLETE;
+			break;
+
+		} else {
+			PM8001_EH_DBG(pm8001_ha,
+				pm8001_printk(" Task to dev %016llx response: "
+					"0x%x status 0x%x\n",
+				SAS_ADDR(dev->sas_addr),
+				task->task_status.resp,
+				task->task_status.stat));
+			pm8001_free_task(task);
+			task = NULL;
+		}
+	}
+ex_err:
+	BUG_ON(retry == 3 && task != NULL);
+	if (task != NULL)
+		pm8001_free_task(task);
+	return res;
+}
+
+/**
+  * pm8001_dev_gone_notify - see the comments for "pm8001_dev_found_notify"
+  * @dev: the device structure which sas layer used.
+  */
+static void pm8001_dev_gone_notify(struct domain_device *dev)
+{
+	unsigned long flags = 0;
+	u32 tag;
+	struct pm8001_hba_info *pm8001_ha;
+	struct pm8001_device *pm8001_dev = dev->lldd_dev;
+	u32 device_id = pm8001_dev->device_id;
+	pm8001_ha = pm8001_find_ha_by_dev(dev);
+	spin_lock_irqsave(&pm8001_ha->lock, flags);
+	pm8001_tag_alloc(pm8001_ha, &tag);
+	if (pm8001_dev) {
+		PM8001_DISC_DBG(pm8001_ha,
+			pm8001_printk("found dev[%d:%x] is gone.\n",
+			pm8001_dev->device_id, pm8001_dev->dev_type));
+		if (pm8001_dev->running_req) {
+			spin_unlock_irqrestore(&pm8001_ha->lock, flags);
+			pm8001_exec_internal_task_abort(pm8001_ha, pm8001_dev ,
+				dev, 1, 0);
+			spin_lock_irqsave(&pm8001_ha->lock, flags);
+		}
+		PM8001_CHIP_DISP->dereg_dev_req(pm8001_ha, device_id);
+		pm8001_free_dev(pm8001_dev);
+	} else {
+		PM8001_DISC_DBG(pm8001_ha,
+			pm8001_printk("Found dev has gone.\n"));
+	}
+	dev->lldd_dev = NULL;
+	spin_unlock_irqrestore(&pm8001_ha->lock, flags);
+}
+
+void pm8001_dev_gone(struct domain_device *dev)
+{
+	pm8001_dev_gone_notify(dev);
+}
+
+static int pm8001_issue_ssp_tmf(struct domain_device *dev,
+	u8 *lun, struct pm8001_tmf_task *tmf)
+{
+	struct sas_ssp_task ssp_task;
+	if (!(dev->tproto & SAS_PROTOCOL_SSP))
+		return TMF_RESP_FUNC_ESUPP;
+
+	strncpy((u8 *)&ssp_task.LUN, lun, 8);
+	return pm8001_exec_internal_tmf_task(dev, &ssp_task, sizeof(ssp_task),
+		tmf);
+}
+
+/**
+  * Standard mandates link reset for ATA  (type 0) and hard reset for
+  * SSP (type 1) , only for RECOVERY
+  */
+int pm8001_I_T_nexus_reset(struct domain_device *dev)
+{
+	int rc = TMF_RESP_FUNC_FAILED;
+	struct pm8001_device *pm8001_dev;
+	struct pm8001_hba_info *pm8001_ha;
+	struct sas_phy *phy;
+	if (!dev || !dev->lldd_dev)
+		return -1;
+
+	pm8001_dev = dev->lldd_dev;
+	pm8001_ha = pm8001_find_ha_by_dev(dev);
+	phy = sas_find_local_phy(dev);
+
+	if (dev_is_sata(dev)) {
+		DECLARE_COMPLETION_ONSTACK(completion_setstate);
+		if (scsi_is_sas_phy_local(phy))
+			return 0;
+		rc = sas_phy_reset(phy, 1);
+		msleep(2000);
+		rc = pm8001_exec_internal_task_abort(pm8001_ha, pm8001_dev ,
+			dev, 1, 0);
+		pm8001_dev->setds_completion = &completion_setstate;
+		rc = PM8001_CHIP_DISP->set_dev_state_req(pm8001_ha,
+			pm8001_dev, 0x01);
+		wait_for_completion(&completion_setstate);
+	} else{
+	rc = sas_phy_reset(phy, 1);
+	msleep(2000);
+	}
+	PM8001_EH_DBG(pm8001_ha, pm8001_printk(" for device[%x]:rc=%d\n",
+		pm8001_dev->device_id, rc));
+	return rc;
+}
+
+/* mandatory SAM-3, the task reset the specified LUN*/
+int pm8001_lu_reset(struct domain_device *dev, u8 *lun)
+{
+	int rc = TMF_RESP_FUNC_FAILED;
+	struct pm8001_tmf_task tmf_task;
+	struct pm8001_device *pm8001_dev = dev->lldd_dev;
+	struct pm8001_hba_info *pm8001_ha = pm8001_find_ha_by_dev(dev);
+	if (dev_is_sata(dev)) {
+		struct sas_phy *phy = sas_find_local_phy(dev);
+		rc = pm8001_exec_internal_task_abort(pm8001_ha, pm8001_dev ,
+			dev, 1, 0);
+		rc = sas_phy_reset(phy, 1);
+		rc = PM8001_CHIP_DISP->set_dev_state_req(pm8001_ha,
+			pm8001_dev, 0x01);
+		msleep(2000);
+	} else {
+		tmf_task.tmf = TMF_LU_RESET;
+		rc = pm8001_issue_ssp_tmf(dev, lun, &tmf_task);
+	}
+	/* If failed, fall-through I_T_Nexus reset */
+	PM8001_EH_DBG(pm8001_ha, pm8001_printk("for device[%x]:rc=%d\n",
+		pm8001_dev->device_id, rc));
+	return rc;
+}
+
+/* optional SAM-3 */
+int pm8001_query_task(struct sas_task *task)
+{
+	u32 tag = 0xdeadbeef;
+	int i = 0;
+	struct scsi_lun lun;
+	struct pm8001_tmf_task tmf_task;
+	int rc = TMF_RESP_FUNC_FAILED;
+	if (unlikely(!task || !task->lldd_task || !task->dev))
+		return rc;
+
+	if (task->task_proto & SAS_PROTOCOL_SSP) {
+		struct scsi_cmnd *cmnd = task->uldd_task;
+		struct domain_device *dev = task->dev;
+		struct pm8001_hba_info *pm8001_ha =
+			pm8001_find_ha_by_dev(dev);
+
+		int_to_scsilun(cmnd->device->lun, &lun);
+		rc = pm8001_find_tag(task, &tag);
+		if (rc == 0) {
+			rc = TMF_RESP_FUNC_FAILED;
+			return rc;
+		}
+		PM8001_EH_DBG(pm8001_ha, pm8001_printk("Query:["));
+		for (i = 0; i < 16; i++)
+			printk(KERN_INFO "%02x ", cmnd->cmnd[i]);
+		printk(KERN_INFO "]\n");
+		tmf_task.tmf = 	TMF_QUERY_TASK;
+		tmf_task.tag_of_task_to_be_managed = tag;
+
+		rc = pm8001_issue_ssp_tmf(dev, lun.scsi_lun, &tmf_task);
+		switch (rc) {
+		/* The task is still in Lun, release it then */
+		case TMF_RESP_FUNC_SUCC:
+			PM8001_EH_DBG(pm8001_ha,
+				pm8001_printk("The task is still in Lun \n"));
+		/* The task is not in Lun or failed, reset the phy */
+		case TMF_RESP_FUNC_FAILED:
+		case TMF_RESP_FUNC_COMPLETE:
+			PM8001_EH_DBG(pm8001_ha,
+			pm8001_printk("The task is not in Lun or failed,"
+			" reset the phy \n"));
+			break;
+		}
+	}
+	pm8001_printk(":rc= %d\n", rc);
+	return rc;
+}
+
+/*  mandatory SAM-3, still need free task/ccb info, abord the specified task */
+int pm8001_abort_task(struct sas_task *task)
+{
+	unsigned long flags;
+	u32 tag = 0xdeadbeef;
+	u32 device_id;
+	struct domain_device *dev ;
+	struct pm8001_hba_info *pm8001_ha = NULL;
+	struct pm8001_ccb_info *ccb;
+	struct scsi_lun lun;
+	struct pm8001_device *pm8001_dev;
+	struct pm8001_tmf_task tmf_task;
+	int rc = TMF_RESP_FUNC_FAILED;
+	if (unlikely(!task || !task->lldd_task || !task->dev))
+		return rc;
+	spin_lock_irqsave(&task->task_state_lock, flags);
+	if (task->task_state_flags & SAS_TASK_STATE_DONE) {
+		spin_unlock_irqrestore(&task->task_state_lock, flags);
+		rc = TMF_RESP_FUNC_COMPLETE;
+		goto out;
+	}
+	spin_unlock_irqrestore(&task->task_state_lock, flags);
+	if (task->task_proto & SAS_PROTOCOL_SSP) {
+		struct scsi_cmnd *cmnd = task->uldd_task;
+		dev = task->dev;
+		ccb = task->lldd_task;
+		pm8001_dev = dev->lldd_dev;
+		pm8001_ha = pm8001_find_ha_by_dev(dev);
+		int_to_scsilun(cmnd->device->lun, &lun);
+		rc = pm8001_find_tag(task, &tag);
+		if (rc == 0) {
+			printk(KERN_INFO "No such tag in %s\n", __func__);
+			rc = TMF_RESP_FUNC_FAILED;
+			return rc;
+		}
+		device_id = pm8001_dev->device_id;
+		PM8001_EH_DBG(pm8001_ha,
+			pm8001_printk("abort io to deviceid= %d\n", device_id));
+		tmf_task.tmf = TMF_ABORT_TASK;
+		tmf_task.tag_of_task_to_be_managed = tag;
+		rc = pm8001_issue_ssp_tmf(dev, lun.scsi_lun, &tmf_task);
+		pm8001_exec_internal_task_abort(pm8001_ha, pm8001_dev,
+			pm8001_dev->sas_device, 0, tag);
+	} else if (task->task_proto & SAS_PROTOCOL_SATA ||
+		task->task_proto & SAS_PROTOCOL_STP) {
+		dev = task->dev;
+		pm8001_dev = dev->lldd_dev;
+		pm8001_ha = pm8001_find_ha_by_dev(dev);
+		rc = pm8001_find_tag(task, &tag);
+		if (rc == 0) {
+			printk(KERN_INFO "No such tag in %s\n", __func__);
+			rc = TMF_RESP_FUNC_FAILED;
+			return rc;
+		}
+		rc = pm8001_exec_internal_task_abort(pm8001_ha, pm8001_dev,
+			pm8001_dev->sas_device, 0, tag);
+	} else if (task->task_proto & SAS_PROTOCOL_SMP) {
+		/* SMP */
+		dev = task->dev;
+		pm8001_dev = dev->lldd_dev;
+		pm8001_ha = pm8001_find_ha_by_dev(dev);
+		rc = pm8001_find_tag(task, &tag);
+		if (rc == 0) {
+			printk(KERN_INFO "No such tag in %s\n", __func__);
+			rc = TMF_RESP_FUNC_FAILED;
+			return rc;
+		}
+		rc = pm8001_exec_internal_task_abort(pm8001_ha, pm8001_dev,
+			pm8001_dev->sas_device, 0, tag);
+
+	}
+out:
+	if (rc != TMF_RESP_FUNC_COMPLETE)
+		pm8001_printk("rc= %d\n", rc);
+	return rc;
+}
+
+int pm8001_abort_task_set(struct domain_device *dev, u8 *lun)
+{
+	int rc = TMF_RESP_FUNC_FAILED;
+	struct pm8001_tmf_task tmf_task;
+
+	tmf_task.tmf = TMF_ABORT_TASK_SET;
+	rc = pm8001_issue_ssp_tmf(dev, lun, &tmf_task);
+	return rc;
+}
+
+int pm8001_clear_aca(struct domain_device *dev, u8 *lun)
+{
+	int rc = TMF_RESP_FUNC_FAILED;
+	struct pm8001_tmf_task tmf_task;
+
+	tmf_task.tmf = TMF_CLEAR_ACA;
+	rc = pm8001_issue_ssp_tmf(dev, lun, &tmf_task);
+
+	return rc;
+}
+
+int pm8001_clear_task_set(struct domain_device *dev, u8 *lun)
+{
+	int rc = TMF_RESP_FUNC_FAILED;
+	struct pm8001_tmf_task tmf_task;
+	struct pm8001_device *pm8001_dev = dev->lldd_dev;
+	struct pm8001_hba_info *pm8001_ha = pm8001_find_ha_by_dev(dev);
+
+	PM8001_EH_DBG(pm8001_ha,
+		pm8001_printk("I_T_L_Q clear task set[%x]\n",
+		pm8001_dev->device_id));
+	tmf_task.tmf = TMF_CLEAR_TASK_SET;
+	rc = pm8001_issue_ssp_tmf(dev, lun, &tmf_task);
+	return rc;
+}
+
diff --git a/drivers/scsi/pm8001/pm8001_sas.h b/drivers/scsi/pm8001/pm8001_sas.h
new file mode 100644
index 000000000000..8e38ca8cd101
--- /dev/null
+++ b/drivers/scsi/pm8001/pm8001_sas.h
@@ -0,0 +1,497 @@
+/*
+ * PMC-Sierra SPC 8001 SAS/SATA based host adapters driver
+ *
+ * Copyright (c) 2008-2009 USI Co., Ltd.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    substantially similar to the "NO WARRANTY" disclaimer below
+ *    ("Disclaimer") and any redistribution must be conditioned upon
+ *    including a substantially similar Disclaimer requirement for further
+ *    binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+ * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGES.
+ *
+ */
+
+#ifndef _PM8001_SAS_H_
+#define _PM8001_SAS_H_
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/spinlock.h>
+#include <linux/delay.h>
+#include <linux/types.h>
+#include <linux/ctype.h>
+#include <linux/dma-mapping.h>
+#include <linux/pci.h>
+#include <linux/interrupt.h>
+#include <linux/smp_lock.h>
+#include <scsi/libsas.h>
+#include <scsi/scsi_tcq.h>
+#include <scsi/sas_ata.h>
+#include <asm/atomic.h>
+#include "pm8001_defs.h"
+
+#define DRV_NAME		"pm8001"
+#define DRV_VERSION		"0.1.36"
+#define PM8001_FAIL_LOGGING	0x01 /* Error message logging */
+#define PM8001_INIT_LOGGING	0x02 /* driver init logging */
+#define PM8001_DISC_LOGGING	0x04 /* discovery layer logging */
+#define PM8001_IO_LOGGING	0x08 /* I/O path logging */
+#define PM8001_EH_LOGGING	0x10 /* libsas EH function logging*/
+#define PM8001_IOCTL_LOGGING	0x20 /* IOCTL message logging */
+#define PM8001_MSG_LOGGING	0x40 /* misc message logging */
+#define pm8001_printk(format, arg...)	printk(KERN_INFO "%s %d:" format,\
+				__func__, __LINE__, ## arg)
+#define PM8001_CHECK_LOGGING(HBA, LEVEL, CMD)	\
+do {						\
+	if (unlikely(HBA->logging_level & LEVEL))	\
+		do {					\
+			CMD;				\
+		} while (0);				\
+} while (0);
+
+#define PM8001_EH_DBG(HBA, CMD)			\
+	PM8001_CHECK_LOGGING(HBA, PM8001_EH_LOGGING, CMD)
+
+#define PM8001_INIT_DBG(HBA, CMD)		\
+	PM8001_CHECK_LOGGING(HBA, PM8001_INIT_LOGGING, CMD)
+
+#define PM8001_DISC_DBG(HBA, CMD)		\
+	PM8001_CHECK_LOGGING(HBA, PM8001_DISC_LOGGING, CMD)
+
+#define PM8001_IO_DBG(HBA, CMD)		\
+	PM8001_CHECK_LOGGING(HBA, PM8001_IO_LOGGING, CMD)
+
+#define PM8001_FAIL_DBG(HBA, CMD)		\
+	PM8001_CHECK_LOGGING(HBA, PM8001_FAIL_LOGGING, CMD)
+
+#define PM8001_IOCTL_DBG(HBA, CMD)		\
+	PM8001_CHECK_LOGGING(HBA, PM8001_IOCTL_LOGGING, CMD)
+
+#define PM8001_MSG_DBG(HBA, CMD)		\
+	PM8001_CHECK_LOGGING(HBA, PM8001_MSG_LOGGING, CMD)
+
+
+#define PM8001_USE_TASKLET
+#define PM8001_USE_MSIX
+#define PM8001_READ_VPD
+
+
+#define DEV_IS_EXPANDER(type)	((type == EDGE_DEV) || (type == FANOUT_DEV))
+
+#define PM8001_NAME_LENGTH		32/* generic length of strings */
+extern struct list_head hba_list;
+extern const struct pm8001_dispatch pm8001_8001_dispatch;
+
+struct pm8001_hba_info;
+struct pm8001_ccb_info;
+struct pm8001_device;
+/* define task management IU */
+struct pm8001_tmf_task {
+	u8	tmf;
+	u32	tag_of_task_to_be_managed;
+};
+struct pm8001_ioctl_payload {
+	u32	signature;
+	u16	major_function;
+	u16	minor_function;
+	u16	length;
+	u16	status;
+	u16	offset;
+	u16	id;
+	u8	*func_specific;
+};
+
+struct pm8001_dispatch {
+	char *name;
+	int (*chip_init)(struct pm8001_hba_info *pm8001_ha);
+	int (*chip_soft_rst)(struct pm8001_hba_info *pm8001_ha, u32 signature);
+	void (*chip_rst)(struct pm8001_hba_info *pm8001_ha);
+	int (*chip_ioremap)(struct pm8001_hba_info *pm8001_ha);
+	void (*chip_iounmap)(struct pm8001_hba_info *pm8001_ha);
+	irqreturn_t (*isr)(struct pm8001_hba_info *pm8001_ha);
+	u32 (*is_our_interupt)(struct pm8001_hba_info *pm8001_ha);
+	int (*isr_process_oq)(struct pm8001_hba_info *pm8001_ha);
+	void (*interrupt_enable)(struct pm8001_hba_info *pm8001_ha);
+	void (*interrupt_disable)(struct pm8001_hba_info *pm8001_ha);
+	void (*make_prd)(struct scatterlist *scatter, int nr, void *prd);
+	int (*smp_req)(struct pm8001_hba_info *pm8001_ha,
+		struct pm8001_ccb_info *ccb);
+	int (*ssp_io_req)(struct pm8001_hba_info *pm8001_ha,
+		struct pm8001_ccb_info *ccb);
+	int (*sata_req)(struct pm8001_hba_info *pm8001_ha,
+		struct pm8001_ccb_info *ccb);
+	int (*phy_start_req)(struct pm8001_hba_info *pm8001_ha,	u8 phy_id);
+	int (*phy_stop_req)(struct pm8001_hba_info *pm8001_ha, u8 phy_id);
+	int (*reg_dev_req)(struct pm8001_hba_info *pm8001_ha,
+		struct pm8001_device *pm8001_dev, u32 flag);
+	int (*dereg_dev_req)(struct pm8001_hba_info *pm8001_ha, u32 device_id);
+	int (*phy_ctl_req)(struct pm8001_hba_info *pm8001_ha,
+		u32 phy_id, u32 phy_op);
+	int (*task_abort)(struct pm8001_hba_info *pm8001_ha,
+		struct pm8001_device *pm8001_dev, u8 flag, u32 task_tag,
+		u32 cmd_tag);
+	int (*ssp_tm_req)(struct pm8001_hba_info *pm8001_ha,
+		struct pm8001_ccb_info *ccb, struct pm8001_tmf_task *tmf);
+	int (*get_nvmd_req)(struct pm8001_hba_info *pm8001_ha, void *payload);
+	int (*set_nvmd_req)(struct pm8001_hba_info *pm8001_ha, void *payload);
+	int (*fw_flash_update_req)(struct pm8001_hba_info *pm8001_ha,
+		void *payload);
+	int (*set_dev_state_req)(struct pm8001_hba_info *pm8001_ha,
+		struct pm8001_device *pm8001_dev, u32 state);
+	int (*sas_diag_start_end_req)(struct pm8001_hba_info *pm8001_ha,
+		u32 state);
+	int (*sas_diag_execute_req)(struct pm8001_hba_info *pm8001_ha,
+		u32 state);
+	int (*sas_re_init_req)(struct pm8001_hba_info *pm8001_ha);
+};
+
+struct pm8001_chip_info {
+	u32	n_phy;
+	const struct pm8001_dispatch	*dispatch;
+};
+#define PM8001_CHIP_DISP	(pm8001_ha->chip->dispatch)
+
+struct pm8001_port {
+	struct asd_sas_port	sas_port;
+	u8			port_attached;
+	u8			wide_port_phymap;
+	u8			port_state;
+	struct list_head	list;
+};
+
+struct pm8001_phy {
+	struct pm8001_hba_info	*pm8001_ha;
+	struct pm8001_port	*port;
+	struct asd_sas_phy	sas_phy;
+	struct sas_identify	identify;
+	struct scsi_device	*sdev;
+	u64			dev_sas_addr;
+	u32			phy_type;
+	struct completion	*enable_completion;
+	u32			frame_rcvd_size;
+	u8			frame_rcvd[32];
+	u8			phy_attached;
+	u8			phy_state;
+	enum sas_linkrate	minimum_linkrate;
+	enum sas_linkrate	maximum_linkrate;
+};
+
+struct pm8001_device {
+	enum sas_dev_type	dev_type;
+	struct domain_device	*sas_device;
+	u32			attached_phy;
+	u32			id;
+	struct completion	*dcompletion;
+	struct completion	*setds_completion;
+	u32			device_id;
+	u32			running_req;
+};
+
+struct pm8001_prd_imt {
+	__le32			len;
+	__le32			e;
+};
+
+struct pm8001_prd {
+	__le64			addr;		/* 64-bit buffer address */
+	struct pm8001_prd_imt	im_len;		/* 64-bit length */
+} __attribute__ ((packed));
+/*
+ * CCB(Command Control Block)
+ */
+struct pm8001_ccb_info {
+	struct list_head	entry;
+	struct sas_task		*task;
+	u32			n_elem;
+	u32			ccb_tag;
+	dma_addr_t		ccb_dma_handle;
+	struct pm8001_device	*device;
+	struct pm8001_prd	buf_prd[PM8001_MAX_DMA_SG];
+	struct fw_control_ex	*fw_control_context;
+};
+
+struct mpi_mem {
+	void			*virt_ptr;
+	dma_addr_t		phys_addr;
+	u32			phys_addr_hi;
+	u32			phys_addr_lo;
+	u32			total_len;
+	u32			num_elements;
+	u32			element_size;
+	u32			alignment;
+};
+
+struct mpi_mem_req {
+	/* The number of element in the  mpiMemory array */
+	u32			count;
+	/* The array of structures that define memroy regions*/
+	struct mpi_mem		region[USI_MAX_MEMCNT];
+};
+
+struct main_cfg_table {
+	u32			signature;
+	u32			interface_rev;
+	u32			firmware_rev;
+	u32			max_out_io;
+	u32			max_sgl;
+	u32			ctrl_cap_flag;
+	u32			gst_offset;
+	u32			inbound_queue_offset;
+	u32			outbound_queue_offset;
+	u32			inbound_q_nppd_hppd;
+	u32			outbound_hw_event_pid0_3;
+	u32			outbound_hw_event_pid4_7;
+	u32			outbound_ncq_event_pid0_3;
+	u32			outbound_ncq_event_pid4_7;
+	u32			outbound_tgt_ITNexus_event_pid0_3;
+	u32			outbound_tgt_ITNexus_event_pid4_7;
+	u32			outbound_tgt_ssp_event_pid0_3;
+	u32			outbound_tgt_ssp_event_pid4_7;
+	u32			outbound_tgt_smp_event_pid0_3;
+	u32			outbound_tgt_smp_event_pid4_7;
+	u32			upper_event_log_addr;
+	u32			lower_event_log_addr;
+	u32			event_log_size;
+	u32			event_log_option;
+	u32			upper_iop_event_log_addr;
+	u32			lower_iop_event_log_addr;
+	u32			iop_event_log_size;
+	u32			iop_event_log_option;
+	u32			fatal_err_interrupt;
+	u32			fatal_err_dump_offset0;
+	u32			fatal_err_dump_length0;
+	u32			fatal_err_dump_offset1;
+	u32			fatal_err_dump_length1;
+	u32			hda_mode_flag;
+	u32			anolog_setup_table_offset;
+};
+struct general_status_table {
+	u32			gst_len_mpistate;
+	u32			iq_freeze_state0;
+	u32			iq_freeze_state1;
+	u32			msgu_tcnt;
+	u32			iop_tcnt;
+	u32			reserved;
+	u32			phy_state[8];
+	u32			reserved1;
+	u32			reserved2;
+	u32			reserved3;
+	u32			recover_err_info[8];
+};
+struct inbound_queue_table {
+	u32			element_pri_size_cnt;
+	u32			upper_base_addr;
+	u32			lower_base_addr;
+	u32			ci_upper_base_addr;
+	u32			ci_lower_base_addr;
+	u32			pi_pci_bar;
+	u32			pi_offset;
+	u32			total_length;
+	void			*base_virt;
+	void			*ci_virt;
+	u32			reserved;
+	__le32			consumer_index;
+	u32			producer_idx;
+};
+struct outbound_queue_table {
+	u32			element_size_cnt;
+	u32			upper_base_addr;
+	u32			lower_base_addr;
+	void			*base_virt;
+	u32			pi_upper_base_addr;
+	u32			pi_lower_base_addr;
+	u32			ci_pci_bar;
+	u32			ci_offset;
+	u32			total_length;
+	void			*pi_virt;
+	u32			interrup_vec_cnt_delay;
+	u32			dinterrup_to_pci_offset;
+	__le32			producer_index;
+	u32			consumer_idx;
+};
+struct pm8001_hba_memspace {
+	void __iomem  		*memvirtaddr;
+	u64			membase;
+	u32			memsize;
+};
+struct pm8001_hba_info {
+	char			name[PM8001_NAME_LENGTH];
+	struct list_head	list;
+	unsigned long		flags;
+	spinlock_t		lock;/* host-wide lock */
+	struct pci_dev		*pdev;/* our device */
+	struct device		*dev;
+	struct pm8001_hba_memspace io_mem[6];
+	struct mpi_mem_req	memoryMap;
+	void __iomem	*msg_unit_tbl_addr;/*Message Unit Table Addr*/
+	void __iomem	*main_cfg_tbl_addr;/*Main Config Table Addr*/
+	void __iomem	*general_stat_tbl_addr;/*General Status Table Addr*/
+	void __iomem	*inbnd_q_tbl_addr;/*Inbound Queue Config Table Addr*/
+	void __iomem	*outbnd_q_tbl_addr;/*Outbound Queue Config Table Addr*/
+	struct main_cfg_table	main_cfg_tbl;
+	struct general_status_table	gs_tbl;
+	struct inbound_queue_table	inbnd_q_tbl[PM8001_MAX_INB_NUM];
+	struct outbound_queue_table	outbnd_q_tbl[PM8001_MAX_OUTB_NUM];
+	u8			sas_addr[SAS_ADDR_SIZE];
+	struct sas_ha_struct	*sas;/* SCSI/SAS glue */
+	struct Scsi_Host	*shost;
+	u32			chip_id;
+	const struct pm8001_chip_info	*chip;
+	struct completion	*nvmd_completion;
+	int			tags_num;
+	unsigned long		*tags;
+	struct pm8001_phy	phy[PM8001_MAX_PHYS];
+	struct pm8001_port	port[PM8001_MAX_PHYS];
+	u32			id;
+	u32			irq;
+	struct pm8001_device	*devices;
+	struct pm8001_ccb_info	*ccb_info;
+#ifdef PM8001_USE_MSIX
+	struct msix_entry	msix_entries[16];/*for msi-x interrupt*/
+	int			number_of_intr;/*will be used in remove()*/
+#endif
+#ifdef PM8001_USE_TASKLET
+	struct tasklet_struct	tasklet;
+#endif
+	struct list_head 	wq_list;
+	u32			logging_level;
+	u32			fw_status;
+	const struct firmware 	*fw_image;
+};
+
+struct pm8001_wq {
+	struct delayed_work work_q;
+	struct pm8001_hba_info *pm8001_ha;
+	void *data;
+	int handler;
+	struct list_head entry;
+};
+
+struct pm8001_fw_image_header {
+	u8 vender_id[8];
+	u8 product_id;
+	u8 hardware_rev;
+	u8 dest_partition;
+	u8 reserved;
+	u8 fw_rev[4];
+	__be32  image_length;
+	__be32 image_crc;
+	__be32 startup_entry;
+} __attribute__((packed, aligned(4)));
+
+
+/**
+ * FW Flash Update status values
+ */
+#define FLASH_UPDATE_COMPLETE_PENDING_REBOOT	0x00
+#define FLASH_UPDATE_IN_PROGRESS		0x01
+#define FLASH_UPDATE_HDR_ERR			0x02
+#define FLASH_UPDATE_OFFSET_ERR			0x03
+#define FLASH_UPDATE_CRC_ERR			0x04
+#define FLASH_UPDATE_LENGTH_ERR			0x05
+#define FLASH_UPDATE_HW_ERR			0x06
+#define FLASH_UPDATE_DNLD_NOT_SUPPORTED		0x10
+#define FLASH_UPDATE_DISABLED			0x11
+
+/**
+ * brief param structure for firmware flash update.
+ */
+struct fw_flash_updata_info {
+	u32			cur_image_offset;
+	u32			cur_image_len;
+	u32			total_image_len;
+	struct pm8001_prd	sgl;
+};
+
+struct fw_control_info {
+	u32			retcode;/*ret code (status)*/
+	u32			phase;/*ret code phase*/
+	u32			phaseCmplt;/*percent complete for the current
+	update phase */
+	u32			version;/*Hex encoded firmware version number*/
+	u32			offset;/*Used for downloading firmware	*/
+	u32			len; /*len of buffer*/
+	u32			size;/* Used in OS VPD and Trace get size
+	operations.*/
+	u32			reserved;/* padding required for 64 bit
+	alignment */
+	u8			buffer[1];/* Start of buffer */
+};
+struct fw_control_ex {
+	struct fw_control_info *fw_control;
+	void			*buffer;/* keep buffer pointer to be
+	freed when the responce comes*/
+	void			*virtAddr;/* keep virtual address of the data */
+	void			*usrAddr;/* keep virtual address of the
+	user data */
+	dma_addr_t		phys_addr;
+	u32			len; /* len of buffer  */
+	void			*payload; /* pointer to IOCTL Payload */
+	u8			inProgress;/*if 1 - the IOCTL request is in
+	progress */
+	void			*param1;
+	void			*param2;
+	void			*param3;
+};
+
+/******************** function prototype *********************/
+int pm8001_tag_alloc(struct pm8001_hba_info *pm8001_ha, u32 *tag_out);
+void pm8001_tag_init(struct pm8001_hba_info *pm8001_ha);
+u32 pm8001_get_ncq_tag(struct sas_task *task, u32 *tag);
+void pm8001_ccb_free(struct pm8001_hba_info *pm8001_ha, u32 ccb_idx);
+void pm8001_ccb_task_free(struct pm8001_hba_info *pm8001_ha,
+	struct sas_task *task, struct pm8001_ccb_info *ccb, u32 ccb_idx);
+int pm8001_phy_control(struct asd_sas_phy *sas_phy, enum phy_func func,
+	void *funcdata);
+int pm8001_slave_alloc(struct scsi_device *scsi_dev);
+int pm8001_slave_configure(struct scsi_device *sdev);
+void pm8001_scan_start(struct Scsi_Host *shost);
+int pm8001_scan_finished(struct Scsi_Host *shost, unsigned long time);
+int pm8001_queue_command(struct sas_task *task, const int num,
+	gfp_t gfp_flags);
+int pm8001_abort_task(struct sas_task *task);
+int pm8001_abort_task_set(struct domain_device *dev, u8 *lun);
+int pm8001_clear_aca(struct domain_device *dev, u8 *lun);
+int pm8001_clear_task_set(struct domain_device *dev, u8 *lun);
+int pm8001_dev_found(struct domain_device *dev);
+void pm8001_dev_gone(struct domain_device *dev);
+int pm8001_lu_reset(struct domain_device *dev, u8 *lun);
+int pm8001_I_T_nexus_reset(struct domain_device *dev);
+int pm8001_query_task(struct sas_task *task);
+int pm8001_mem_alloc(struct pci_dev *pdev, void **virt_addr,
+	dma_addr_t *pphys_addr, u32 *pphys_addr_hi, u32 *pphys_addr_lo,
+	u32 mem_size, u32 align);
+
+
+/* ctl shared API */
+extern struct device_attribute *pm8001_host_attrs[];
+
+#endif
+
diff --git a/drivers/scsi/pmcraid.c b/drivers/scsi/pmcraid.c
index 0a97bc9074bb..b6f1ef954af1 100644
--- a/drivers/scsi/pmcraid.c
+++ b/drivers/scsi/pmcraid.c
@@ -1,7 +1,8 @@
 /*
  * pmcraid.c -- driver for PMC Sierra MaxRAID controller adapters
  *
- * Written By: PMC Sierra Corporation
+ * Written By: Anil Ravindranath<anil_ravindranath@pmc-sierra.com>
+ *             PMC-Sierra Inc
  *
  * Copyright (C) 2008, 2009 PMC Sierra Inc
  *
@@ -79,7 +80,7 @@ DECLARE_BITMAP(pmcraid_minor, PMCRAID_MAX_ADAPTERS);
 /*
  * Module parameters
  */
-MODULE_AUTHOR("PMC Sierra Corporation, anil_ravindranath@pmc-sierra.com");
+MODULE_AUTHOR("Anil Ravindranath<anil_ravindranath@pmc-sierra.com>");
 MODULE_DESCRIPTION("PMC Sierra MaxRAID Controller Driver");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(PMCRAID_DRIVER_VERSION);
@@ -162,10 +163,10 @@ static int pmcraid_slave_alloc(struct scsi_device *scsi_dev)
 	spin_lock_irqsave(&pinstance->resource_lock, lock_flags);
 	list_for_each_entry(temp, &pinstance->used_res_q, queue) {
 
-		/* do not expose VSETs with order-ids >= 240 */
+		/* do not expose VSETs with order-ids > MAX_VSET_TARGETS */
 		if (RES_IS_VSET(temp->cfg_entry)) {
 			target = temp->cfg_entry.unique_flags1;
-			if (target >= PMCRAID_MAX_VSET_TARGETS)
+			if (target > PMCRAID_MAX_VSET_TARGETS)
 				continue;
 			bus = PMCRAID_VSET_BUS_ID;
 			lun = 0;
@@ -278,12 +279,17 @@ static void pmcraid_slave_destroy(struct scsi_device *scsi_dev)
  * pmcraid_change_queue_depth - Change the device's queue depth
  * @scsi_dev: scsi device struct
  * @depth: depth to set
+ * @reason: calling context
  *
  * Return value
  * 	actual depth set
  */
-static int pmcraid_change_queue_depth(struct scsi_device *scsi_dev, int depth)
+static int pmcraid_change_queue_depth(struct scsi_device *scsi_dev, int depth,
+				      int reason)
 {
+	if (reason != SCSI_QDEPTH_DEFAULT)
+		return -EOPNOTSUPP;
+
 	if (depth > PMCRAID_MAX_CMD_PER_LUN)
 		depth = PMCRAID_MAX_CMD_PER_LUN;
 
@@ -1205,7 +1211,7 @@ static int pmcraid_expose_resource(struct pmcraid_config_table_entry *cfgte)
 	int retval = 0;
 
 	if (cfgte->resource_type == RES_TYPE_VSET)
-		retval = ((cfgte->unique_flags1 & 0xFF) < 0xFE);
+		retval = ((cfgte->unique_flags1 & 0x80) == 0);
 	else if (cfgte->resource_type == RES_TYPE_GSCSI)
 		retval = (RES_BUS(cfgte->resource_address) !=
 				PMCRAID_VIRTUAL_ENCL_BUS_ID);
@@ -1356,6 +1362,7 @@ static int pmcraid_notify_aen(struct pmcraid_instance *pinstance, u8 type)
  * Return value:
  *  none
  */
+
 static void pmcraid_handle_config_change(struct pmcraid_instance *pinstance)
 {
 	struct pmcraid_config_table_entry *cfg_entry;
@@ -1363,9 +1370,10 @@ static void pmcraid_handle_config_change(struct pmcraid_instance *pinstance)
 	struct pmcraid_cmd *cmd;
 	struct pmcraid_cmd *cfgcmd;
 	struct pmcraid_resource_entry *res = NULL;
-	u32 new_entry = 1;
 	unsigned long lock_flags;
 	unsigned long host_lock_flags;
+	u32 new_entry = 1;
+	u32 hidden_entry = 0;
 	int rc;
 
 	ccn_hcam = (struct pmcraid_hcam_ccn *)pinstance->ccn.hcam;
@@ -1401,9 +1409,15 @@ static void pmcraid_handle_config_change(struct pmcraid_instance *pinstance)
 	}
 
 	/* If this resource is not going to be added to mid-layer, just notify
-	 * applications and return
+	 * applications and return. If this notification is about hiding a VSET
+	 * resource, check if it was exposed already.
 	 */
-	if (!pmcraid_expose_resource(cfg_entry))
+	if (pinstance->ccn.hcam->notification_type ==
+	    NOTIFICATION_TYPE_ENTRY_CHANGED &&
+	    cfg_entry->resource_type == RES_TYPE_VSET &&
+	    cfg_entry->unique_flags1 & 0x80) {
+		hidden_entry = 1;
+	} else if (!pmcraid_expose_resource(cfg_entry))
 		goto out_notify_apps;
 
 	spin_lock_irqsave(&pinstance->resource_lock, lock_flags);
@@ -1419,6 +1433,12 @@ static void pmcraid_handle_config_change(struct pmcraid_instance *pinstance)
 
 	if (new_entry) {
 
+		if (hidden_entry) {
+			spin_unlock_irqrestore(&pinstance->resource_lock,
+						lock_flags);
+			goto out_notify_apps;
+		}
+
 		/* If there are more number of resources than what driver can
 		 * manage, do not notify the applications about the CCN. Just
 		 * ignore this notifications and re-register the same HCAM
@@ -1449,8 +1469,9 @@ static void pmcraid_handle_config_change(struct pmcraid_instance *pinstance)
 		sizeof(struct pmcraid_config_table_entry));
 
 	if (pinstance->ccn.hcam->notification_type ==
-	    NOTIFICATION_TYPE_ENTRY_DELETED) {
+	    NOTIFICATION_TYPE_ENTRY_DELETED || hidden_entry) {
 		if (res->scsi_dev) {
+			res->cfg_entry.unique_flags1 &= 0x7F;
 			res->change_detected = RES_CHANGE_DEL;
 			res->cfg_entry.resource_handle =
 				PMCRAID_INVALID_RES_HANDLE;
@@ -2462,14 +2483,12 @@ static int pmcraid_error_handler(struct pmcraid_cmd *cmd)
 			sense_copied = 1;
 		}
 
-		if (RES_IS_GSCSI(res->cfg_entry)) {
+		if (RES_IS_GSCSI(res->cfg_entry))
 			pmcraid_cancel_all(cmd, sense_copied);
-		} else if (sense_copied) {
+		else if (sense_copied)
 			pmcraid_erp_done(cmd);
-			return 0;
-		} else  {
+		else
 			pmcraid_request_sense(cmd);
-		}
 
 		return 1;
 
@@ -3342,7 +3361,7 @@ static int pmcraid_chr_fasync(int fd, struct file *filep, int mode)
  * @direction : data transfer direction
  *
  * Return value
- *  0 on sucess, non-zero error code on failure
+ *  0 on success, non-zero error code on failure
  */
 static int pmcraid_build_passthrough_ioadls(
 	struct pmcraid_cmd *cmd,
@@ -3401,7 +3420,7 @@ static int pmcraid_build_passthrough_ioadls(
  * @direction: data transfer direction
  *
  * Return value
- *  0 on sucess, non-zero error code on failure
+ *  0 on success, non-zero error code on failure
  */
 static void pmcraid_release_passthrough_ioadls(
 	struct pmcraid_cmd *cmd,
@@ -3429,7 +3448,7 @@ static void pmcraid_release_passthrough_ioadls(
  * @arg: pointer to pmcraid_passthrough_buffer user buffer
  *
  * Return value
- *  0 on sucess, non-zero error code on failure
+ *  0 on success, non-zero error code on failure
  */
 static long pmcraid_ioctl_passthrough(
 	struct pmcraid_instance *pinstance,
diff --git a/drivers/scsi/pmcraid.h b/drivers/scsi/pmcraid.h
index 3441b3f90827..92f89d50850c 100644
--- a/drivers/scsi/pmcraid.h
+++ b/drivers/scsi/pmcraid.h
@@ -1,6 +1,9 @@
 /*
  * pmcraid.h -- PMC Sierra MaxRAID controller driver header file
  *
+ * Written By: Anil Ravindranath<anil_ravindranath@pmc-sierra.com>
+ *             PMC-Sierra Inc
+ *
  * Copyright (C) 2008, 2009 PMC Sierra Inc.
  *
  * This program is free software; you can redistribute it and/or modify
@@ -106,7 +109,7 @@
 #define PMCRAID_VSET_LUN_ID                      0x0
 #define PMCRAID_PHYS_BUS_ID                      0x0
 #define PMCRAID_VIRTUAL_ENCL_BUS_ID              0x8
-#define PMCRAID_MAX_VSET_TARGETS                 240
+#define PMCRAID_MAX_VSET_TARGETS                 0x7F
 #define PMCRAID_MAX_VSET_LUNS_PER_TARGET         8
 
 #define PMCRAID_IOA_MAX_SECTORS                  32767
@@ -771,11 +774,11 @@ static struct pmcraid_ioasc_error pmcraid_ioasc_error_table[] = {
 	{0x01180600, IOASC_LOG_LEVEL_MUST,
 	 "Recovered Error, soft media error, sector reassignment suggested"},
 	{0x015D0000, IOASC_LOG_LEVEL_MUST,
-	 "Recovered Error, failure prediction thresold exceeded"},
+	 "Recovered Error, failure prediction threshold exceeded"},
 	{0x015D9200, IOASC_LOG_LEVEL_MUST,
-	 "Recovered Error, soft Cache Card Battery error thresold"},
+	 "Recovered Error, soft Cache Card Battery error threshold"},
 	{0x015D9200, IOASC_LOG_LEVEL_MUST,
-	 "Recovered Error, soft Cache Card Battery error thresold"},
+	 "Recovered Error, soft Cache Card Battery error threshold"},
 	{0x02048000, IOASC_LOG_LEVEL_MUST,
 	 "Not Ready, IOA Reset Required"},
 	{0x02408500, IOASC_LOG_LEVEL_MUST,
diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
index fbcb82a2f7f4..3a9f5b288aee 100644
--- a/drivers/scsi/qla2xxx/qla_attr.c
+++ b/drivers/scsi/qla2xxx/qla_attr.c
@@ -232,6 +232,9 @@ qla2x00_sysfs_write_optrom_ctl(struct kobject *kobj,
 	if (off)
 		return 0;
 
+	if (unlikely(pci_channel_offline(ha->pdev)))
+		return 0;
+
 	if (sscanf(buf, "%d:%x:%x", &val, &start, &size) < 1)
 		return -EINVAL;
 	if (start > ha->optrom_size)
@@ -379,6 +382,9 @@ qla2x00_sysfs_read_vpd(struct kobject *kobj,
 	    struct device, kobj)));
 	struct qla_hw_data *ha = vha->hw;
 
+	if (unlikely(pci_channel_offline(ha->pdev)))
+		return 0;
+
 	if (!capable(CAP_SYS_ADMIN))
 		return 0;
 
@@ -398,6 +404,9 @@ qla2x00_sysfs_write_vpd(struct kobject *kobj,
 	struct qla_hw_data *ha = vha->hw;
 	uint8_t *tmp_data;
 
+	if (unlikely(pci_channel_offline(ha->pdev)))
+		return 0;
+
 	if (!capable(CAP_SYS_ADMIN) || off != 0 || count != ha->vpd_size ||
 	    !ha->isp_ops->write_nvram)
 		return 0;
@@ -1238,10 +1247,11 @@ qla2x00_fw_state_show(struct device *dev, struct device_attribute *attr,
     char *buf)
 {
 	scsi_qla_host_t *vha = shost_priv(class_to_shost(dev));
-	int rval;
+	int rval = QLA_FUNCTION_FAILED;
 	uint16_t state[5];
 
-	rval = qla2x00_get_firmware_state(vha, state);
+	if (!vha->hw->flags.eeh_busy)
+		rval = qla2x00_get_firmware_state(vha, state);
 	if (rval != QLA_SUCCESS)
 		memset(state, -1, sizeof(state));
 
@@ -1452,10 +1462,13 @@ qla2x00_dev_loss_tmo_callbk(struct fc_rport *rport)
 	if (!fcport)
 		return;
 
-	if (unlikely(pci_channel_offline(fcport->vha->hw->pdev)))
+	if (test_bit(ABORT_ISP_ACTIVE, &fcport->vha->dpc_flags))
+		return;
+
+	if (unlikely(pci_channel_offline(fcport->vha->hw->pdev))) {
 		qla2x00_abort_all_cmds(fcport->vha, DID_NO_CONNECT << 16);
-	else
-		qla2x00_abort_fcport_cmds(fcport);
+		return;
+	}
 
 	/*
 	 * Transport has effectively 'deleted' the rport, clear
@@ -1475,6 +1488,9 @@ qla2x00_terminate_rport_io(struct fc_rport *rport)
 	if (!fcport)
 		return;
 
+	if (test_bit(ABORT_ISP_ACTIVE, &fcport->vha->dpc_flags))
+		return;
+
 	if (unlikely(pci_channel_offline(fcport->vha->hw->pdev))) {
 		qla2x00_abort_all_cmds(fcport->vha, DID_NO_CONNECT << 16);
 		return;
@@ -1515,6 +1531,12 @@ qla2x00_get_fc_host_stats(struct Scsi_Host *shost)
 	pfc_host_stat = &ha->fc_host_stat;
 	memset(pfc_host_stat, -1, sizeof(struct fc_host_statistics));
 
+	if (test_bit(UNLOADING, &vha->dpc_flags))
+		goto done;
+
+	if (unlikely(pci_channel_offline(ha->pdev)))
+		goto done;
+
 	stats = dma_pool_alloc(ha->s_dma_pool, GFP_KERNEL, &stats_dma);
 	if (stats == NULL) {
 		DEBUG2_3_11(printk("%s(%ld): Failed to allocate memory.\n",
@@ -1654,7 +1676,8 @@ qla24xx_vport_create(struct fc_vport *fc_vport, bool disable)
 			fc_vport_set_state(fc_vport, FC_VPORT_LINKDOWN);
 	}
 
-	if (scsi_add_host(vha->host, &fc_vport->dev)) {
+	if (scsi_add_host_with_dma(vha->host, &fc_vport->dev,
+				   &ha->pdev->dev)) {
 		DEBUG15(printk("scsi(%ld): scsi_add_host failure for VP[%d].\n",
 			vha->host_no, vha->vp_idx));
 		goto vport_create_failed_2;
diff --git a/drivers/scsi/qla2xxx/qla_dbg.c b/drivers/scsi/qla2xxx/qla_dbg.c
index cca8e4ab0372..cb2eca4c26d8 100644
--- a/drivers/scsi/qla2xxx/qla_dbg.c
+++ b/drivers/scsi/qla2xxx/qla_dbg.c
@@ -377,6 +377,24 @@ qla25xx_copy_mq(struct qla_hw_data *ha, void *ptr, uint32_t **last_chain)
 	return ptr + sizeof(struct qla2xxx_mq_chain);
 }
 
+static void
+qla2xxx_dump_post_process(scsi_qla_host_t *vha, int rval)
+{
+	struct qla_hw_data *ha = vha->hw;
+
+	if (rval != QLA_SUCCESS) {
+		qla_printk(KERN_WARNING, ha,
+		    "Failed to dump firmware (%x)!!!\n", rval);
+		ha->fw_dumped = 0;
+	} else {
+		qla_printk(KERN_INFO, ha,
+		    "Firmware dump saved to temp buffer (%ld/%p).\n",
+		    vha->host_no, ha->fw_dump);
+		ha->fw_dumped = 1;
+		qla2x00_post_uevent_work(vha, QLA_UEVENT_CODE_FW_DUMP);
+	}
+}
+
 /**
  * qla2300_fw_dump() - Dumps binary data from the 2300 firmware.
  * @ha: HA context
@@ -530,17 +548,7 @@ qla2300_fw_dump(scsi_qla_host_t *vha, int hardware_locked)
 	if (rval == QLA_SUCCESS)
 		qla2xxx_copy_queues(ha, nxt);
 
-	if (rval != QLA_SUCCESS) {
-		qla_printk(KERN_WARNING, ha,
-		    "Failed to dump firmware (%x)!!!\n", rval);
-		ha->fw_dumped = 0;
-
-	} else {
-		qla_printk(KERN_INFO, ha,
-		    "Firmware dump saved to temp buffer (%ld/%p).\n",
-		    base_vha->host_no, ha->fw_dump);
-		ha->fw_dumped = 1;
-	}
+	qla2xxx_dump_post_process(base_vha, rval);
 
 qla2300_fw_dump_failed:
 	if (!hardware_locked)
@@ -737,17 +745,7 @@ qla2100_fw_dump(scsi_qla_host_t *vha, int hardware_locked)
 	if (rval == QLA_SUCCESS)
 		qla2xxx_copy_queues(ha, &fw->risc_ram[cnt]);
 
-	if (rval != QLA_SUCCESS) {
-		qla_printk(KERN_WARNING, ha,
-		    "Failed to dump firmware (%x)!!!\n", rval);
-		ha->fw_dumped = 0;
-
-	} else {
-		qla_printk(KERN_INFO, ha,
-		    "Firmware dump saved to temp buffer (%ld/%p).\n",
-		    base_vha->host_no, ha->fw_dump);
-		ha->fw_dumped = 1;
-	}
+	qla2xxx_dump_post_process(base_vha, rval);
 
 qla2100_fw_dump_failed:
 	if (!hardware_locked)
@@ -984,17 +982,7 @@ qla24xx_fw_dump(scsi_qla_host_t *vha, int hardware_locked)
 	qla24xx_copy_eft(ha, nxt);
 
 qla24xx_fw_dump_failed_0:
-	if (rval != QLA_SUCCESS) {
-		qla_printk(KERN_WARNING, ha,
-		    "Failed to dump firmware (%x)!!!\n", rval);
-		ha->fw_dumped = 0;
-
-	} else {
-		qla_printk(KERN_INFO, ha,
-		    "Firmware dump saved to temp buffer (%ld/%p).\n",
-		    base_vha->host_no, ha->fw_dump);
-		ha->fw_dumped = 1;
-	}
+	qla2xxx_dump_post_process(base_vha, rval);
 
 qla24xx_fw_dump_failed:
 	if (!hardware_locked)
@@ -1305,17 +1293,7 @@ qla25xx_fw_dump(scsi_qla_host_t *vha, int hardware_locked)
 	}
 
 qla25xx_fw_dump_failed_0:
-	if (rval != QLA_SUCCESS) {
-		qla_printk(KERN_WARNING, ha,
-		    "Failed to dump firmware (%x)!!!\n", rval);
-		ha->fw_dumped = 0;
-
-	} else {
-		qla_printk(KERN_INFO, ha,
-		    "Firmware dump saved to temp buffer (%ld/%p).\n",
-		    base_vha->host_no, ha->fw_dump);
-		ha->fw_dumped = 1;
-	}
+	qla2xxx_dump_post_process(base_vha, rval);
 
 qla25xx_fw_dump_failed:
 	if (!hardware_locked)
@@ -1628,17 +1606,7 @@ qla81xx_fw_dump(scsi_qla_host_t *vha, int hardware_locked)
 	}
 
 qla81xx_fw_dump_failed_0:
-	if (rval != QLA_SUCCESS) {
-		qla_printk(KERN_WARNING, ha,
-		    "Failed to dump firmware (%x)!!!\n", rval);
-		ha->fw_dumped = 0;
-
-	} else {
-		qla_printk(KERN_INFO, ha,
-		    "Firmware dump saved to temp buffer (%ld/%p).\n",
-		    base_vha->host_no, ha->fw_dump);
-		ha->fw_dumped = 1;
-	}
+	qla2xxx_dump_post_process(base_vha, rval);
 
 qla81xx_fw_dump_failed:
 	if (!hardware_locked)
diff --git a/drivers/scsi/qla2xxx/qla_dbg.h b/drivers/scsi/qla2xxx/qla_dbg.h
index f660dd70b72e..d6d9c86cb058 100644
--- a/drivers/scsi/qla2xxx/qla_dbg.h
+++ b/drivers/scsi/qla2xxx/qla_dbg.h
@@ -26,7 +26,7 @@
 /* #define QL_DEBUG_LEVEL_14 */ /* Output RSCN trace msgs */
 /* #define QL_DEBUG_LEVEL_15 */ /* Output NPIV trace msgs */
 /* #define QL_DEBUG_LEVEL_16 */ /* Output ISP84XX trace msgs */
-/* #define QL_DEBUG_LEVEL_17 */ /* Output MULTI-Q trace messages */
+/* #define QL_DEBUG_LEVEL_17 */ /* Output EEH trace messages */
 
 /*
 * Macros use for debugging the driver.
@@ -132,6 +132,13 @@
 #else
 #define DEBUG16(x)	do {} while (0)
 #endif
+
+#if defined(QL_DEBUG_LEVEL_17)
+#define DEBUG17(x)	do {x;} while (0)
+#else
+#define DEBUG17(x)	do {} while (0)
+#endif
+
 /*
  * Firmware Dump structure definition
  */
diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
index 215061861794..608e675f68c8 100644
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -1570,9 +1570,6 @@ typedef struct fc_port {
 	struct fc_rport *rport, *drport;
 	u32 supported_classes;
 
-	unsigned long last_queue_full;
-	unsigned long last_ramp_up;
-
 	uint16_t vp_idx;
 } fc_port_t;
 
@@ -2123,6 +2120,7 @@ enum qla_work_type {
 	QLA_EVT_ASYNC_LOGIN_DONE,
 	QLA_EVT_ASYNC_LOGOUT,
 	QLA_EVT_ASYNC_LOGOUT_DONE,
+	QLA_EVT_UEVENT,
 };
 
 
@@ -2146,6 +2144,10 @@ struct qla_work_evt {
 #define QLA_LOGIO_LOGIN_RETRIED	BIT_0
 			u16 data[2];
 		} logio;
+		struct {
+			u32 code;
+#define QLA_UEVENT_CODE_FW_DUMP	0
+		} uevent;
 	} u;
 };
 
@@ -2254,12 +2256,15 @@ struct qla_hw_data {
 		uint32_t	disable_serdes		:1;
 		uint32_t	gpsc_supported		:1;
 		uint32_t	npiv_supported		:1;
+		uint32_t	pci_channel_io_perm_failure	:1;
 		uint32_t	fce_enabled		:1;
 		uint32_t	fac_supported		:1;
 		uint32_t	chip_reset_done		:1;
 		uint32_t	port0			:1;
 		uint32_t	running_gold_fw		:1;
+		uint32_t	eeh_busy		:1;
 		uint32_t	cpu_affinity_enabled	:1;
+		uint32_t	disable_msix_handshake	:1;
 	} flags;
 
 	/* This spinlock is used to protect "io transactions", you must
@@ -2382,6 +2387,7 @@ struct qla_hw_data {
 #define IS_QLA81XX(ha)		(IS_QLA8001(ha))
 #define IS_QLA2XXX_MIDTYPE(ha)	(IS_QLA24XX(ha) || IS_QLA84XX(ha) || \
 				IS_QLA25XX(ha) || IS_QLA81XX(ha))
+#define IS_MSIX_NACK_CAPABLE(ha) (IS_QLA81XX(ha))
 #define IS_NOPOLLING_TYPE(ha)	((IS_QLA25XX(ha) || IS_QLA81XX(ha)) && \
 				(ha)->flags.msix_enabled)
 #define IS_FAC_REQUIRED(ha)	(IS_QLA81XX(ha))
@@ -2435,11 +2441,11 @@ struct qla_hw_data {
 	dma_addr_t	edc_data_dma;
 	uint16_t	edc_data_len;
 
-#define XGMAC_DATA_SIZE	PAGE_SIZE
+#define XGMAC_DATA_SIZE	4096
 	void		*xgmac_data;
 	dma_addr_t	xgmac_data_dma;
 
-#define DCBX_TLV_DATA_SIZE PAGE_SIZE
+#define DCBX_TLV_DATA_SIZE 4096
 	void		*dcbx_tlv;
 	dma_addr_t	dcbx_tlv_dma;
 
diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h
index f3d1d1afa95b..f61fb8d01330 100644
--- a/drivers/scsi/qla2xxx/qla_gbl.h
+++ b/drivers/scsi/qla2xxx/qla_gbl.h
@@ -72,8 +72,6 @@ extern int ql2xloginretrycount;
 extern int ql2xfdmienable;
 extern int ql2xallocfwdump;
 extern int ql2xextended_error_logging;
-extern int ql2xqfullrampup;
-extern int ql2xqfulltracking;
 extern int ql2xiidmaenable;
 extern int ql2xmaxqueues;
 extern int ql2xmultique_tag;
@@ -92,6 +90,7 @@ extern int qla2x00_post_async_logout_work(struct scsi_qla_host *, fc_port_t *,
     uint16_t *);
 extern int qla2x00_post_async_logout_done_work(struct scsi_qla_host *,
     fc_port_t *, uint16_t *);
+extern int qla2x00_post_uevent_work(struct scsi_qla_host *, u32);
 
 extern int qla81xx_restart_mpi_firmware(scsi_qla_host_t *);
 
@@ -246,7 +245,7 @@ qla2x00_get_id_list(scsi_qla_host_t *, void *, dma_addr_t, uint16_t *);
 
 extern int
 qla2x00_get_resource_cnts(scsi_qla_host_t *, uint16_t *, uint16_t *,
-    uint16_t *, uint16_t *, uint16_t *);
+    uint16_t *, uint16_t *, uint16_t *, uint16_t *);
 
 extern int
 qla2x00_get_fcal_position_map(scsi_qla_host_t *ha, char *pos_map);
@@ -325,6 +324,7 @@ qla2x00_read_ram_word(scsi_qla_host_t *, uint32_t, uint32_t *);
 extern int
 qla2x00_write_ram_word(scsi_qla_host_t *, uint32_t, uint32_t);
 
+extern int qla2x00_get_data_rate(scsi_qla_host_t *);
 /*
  * Global Function Prototypes in qla_isr.c source file.
  */
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 9e3eaac25596..b4a0eac8f96d 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -269,6 +269,8 @@ qla2x00_initialize_adapter(scsi_qla_host_t *vha)
 	vha->flags.online = 0;
 	ha->flags.chip_reset_done = 0;
 	vha->flags.reset_active = 0;
+	ha->flags.pci_channel_io_perm_failure = 0;
+	ha->flags.eeh_busy = 0;
 	atomic_set(&vha->loop_down_timer, LOOP_DOWN_TIME);
 	atomic_set(&vha->loop_state, LOOP_DOWN);
 	vha->device_flags = DFLG_NO_CABLE;
@@ -277,7 +279,6 @@ qla2x00_initialize_adapter(scsi_qla_host_t *vha)
 	vha->marker_needed = 0;
 	ha->isp_abort_cnt = 0;
 	ha->beacon_blink_led = 0;
-	set_bit(REGISTER_FDMI_NEEDED, &vha->dpc_flags);
 
 	set_bit(0, ha->req_qid_map);
 	set_bit(0, ha->rsp_qid_map);
@@ -582,6 +583,9 @@ qla2x00_reset_chip(scsi_qla_host_t *vha)
 	uint32_t	cnt;
 	uint16_t	cmd;
 
+	if (unlikely(pci_channel_offline(ha->pdev)))
+		return;
+
 	ha->isp_ops->disable_intrs(ha);
 
 	spin_lock_irqsave(&ha->hardware_lock, flags);
@@ -787,6 +791,12 @@ void
 qla24xx_reset_chip(scsi_qla_host_t *vha)
 {
 	struct qla_hw_data *ha = vha->hw;
+
+	if (pci_channel_offline(ha->pdev) &&
+	    ha->flags.pci_channel_io_perm_failure) {
+		return;
+	}
+
 	ha->isp_ops->disable_intrs(ha);
 
 	/* Perform RISC reset. */
@@ -1203,7 +1213,7 @@ qla2x00_setup_chip(scsi_qla_host_t *vha)
 				}
 				qla2x00_get_resource_cnts(vha, NULL,
 				    &ha->fw_xcb_count, NULL, NULL,
-				    &ha->max_npiv_vports);
+				    &ha->max_npiv_vports, NULL);
 
 				if (!fw_major_version && ql2xallocfwdump)
 					qla2x00_alloc_fw_dump(vha);
@@ -1443,7 +1453,17 @@ qla24xx_config_rings(struct scsi_qla_host *vha)
 			icb->firmware_options_2 |=
 				__constant_cpu_to_le32(BIT_18);
 
-		icb->firmware_options_2 &= __constant_cpu_to_le32(~BIT_22);
+		/* Use Disable MSIX Handshake mode for capable adapters */
+		if (IS_MSIX_NACK_CAPABLE(ha)) {
+			icb->firmware_options_2 &=
+				__constant_cpu_to_le32(~BIT_22);
+			ha->flags.disable_msix_handshake = 1;
+			qla_printk(KERN_INFO, ha,
+				"MSIX Handshake Disable Mode turned on\n");
+		} else {
+			icb->firmware_options_2 |=
+				__constant_cpu_to_le32(BIT_22);
+		}
 		icb->firmware_options_2 |= __constant_cpu_to_le32(BIT_23);
 
 		WRT_REG_DWORD(&reg->isp25mq.req_q_in, 0);
@@ -2257,6 +2277,8 @@ qla2x00_configure_loop(scsi_qla_host_t *vha)
 	clear_bit(LOCAL_LOOP_UPDATE, &vha->dpc_flags);
 	clear_bit(RSCN_UPDATE, &vha->dpc_flags);
 
+	qla2x00_get_data_rate(vha);
+
 	/* Determine what we need to do */
 	if (ha->current_topology == ISP_CFG_FL &&
 	    (test_bit(LOCAL_LOOP_UPDATE, &flags))) {
@@ -3551,6 +3573,13 @@ qla2x00_abort_isp(scsi_qla_host_t *vha)
 		/* Requeue all commands in outstanding command list. */
 		qla2x00_abort_all_cmds(vha, DID_RESET << 16);
 
+		if (unlikely(pci_channel_offline(ha->pdev) &&
+		    ha->flags.pci_channel_io_perm_failure)) {
+			clear_bit(ISP_ABORT_RETRY, &vha->dpc_flags);
+			status = 0;
+			return status;
+		}
+
 		ha->isp_ops->get_flash_version(vha, req->ring);
 
 		ha->isp_ops->nvram_config(vha);
@@ -3573,6 +3602,15 @@ qla2x00_abort_isp(scsi_qla_host_t *vha)
 			ha->isp_abort_cnt = 0;
 			clear_bit(ISP_ABORT_RETRY, &vha->dpc_flags);
 
+			if (IS_QLA81XX(ha))
+				qla2x00_get_fw_version(vha,
+				    &ha->fw_major_version,
+				    &ha->fw_minor_version,
+				    &ha->fw_subminor_version,
+				    &ha->fw_attributes, &ha->fw_memory_size,
+				    ha->mpi_version, &ha->mpi_capabilities,
+				    ha->phy_version);
+
 			if (ha->fce) {
 				ha->flags.fce_enabled = 1;
 				memset(ha->fce, 0,
@@ -4440,6 +4478,8 @@ qla2x00_try_to_stop_firmware(scsi_qla_host_t *vha)
 	int ret, retries;
 	struct qla_hw_data *ha = vha->hw;
 
+	if (ha->flags.pci_channel_io_perm_failure)
+		return;
 	if (!IS_FWI2_CAPABLE(ha))
 		return;
 	if (!ha->fw_major_version)
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index b20a7169aac2..ffd0efdff40e 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -152,7 +152,7 @@ qla2300_intr_handler(int irq, void *dev_id)
 	for (iter = 50; iter--; ) {
 		stat = RD_REG_DWORD(&reg->u.isp2300.host_status);
 		if (stat & HSR_RISC_PAUSED) {
-			if (pci_channel_offline(ha->pdev))
+			if (unlikely(pci_channel_offline(ha->pdev)))
 				break;
 
 			hccr = RD_REG_WORD(&reg->hccr);
@@ -313,10 +313,11 @@ qla2x00_async_event(scsi_qla_host_t *vha, struct rsp_que *rsp, uint16_t *mb)
 	static char	*link_speeds[] = { "1", "2", "?", "4", "8", "10" };
 	char		*link_speed;
 	uint16_t	handle_cnt;
-	uint16_t	cnt;
+	uint16_t	cnt, mbx;
 	uint32_t	handles[5];
 	struct qla_hw_data *ha = vha->hw;
 	struct device_reg_2xxx __iomem *reg = &ha->iobase->isp;
+	struct device_reg_24xx __iomem *reg24 = &ha->iobase->isp24;
 	uint32_t	rscn_entry, host_pid;
 	uint8_t		rscn_queue_index;
 	unsigned long	flags;
@@ -395,9 +396,10 @@ skip_rio:
 		break;
 
 	case MBA_SYSTEM_ERR:		/* System Error */
+		mbx = IS_QLA81XX(ha) ? RD_REG_WORD(&reg24->mailbox7) : 0;
 		qla_printk(KERN_INFO, ha,
-		    "ISP System Error - mbx1=%xh mbx2=%xh mbx3=%xh.\n",
-		    mb[1], mb[2], mb[3]);
+		    "ISP System Error - mbx1=%xh mbx2=%xh mbx3=%xh "
+		    "mbx7=%xh.\n", mb[1], mb[2], mb[3], mbx);
 
 		ha->isp_ops->fw_dump(vha, 1);
 
@@ -419,9 +421,10 @@ skip_rio:
 		break;
 
 	case MBA_REQ_TRANSFER_ERR:	/* Request Transfer Error */
-		DEBUG2(printk("scsi(%ld): ISP Request Transfer Error.\n",
-		    vha->host_no));
-		qla_printk(KERN_WARNING, ha, "ISP Request Transfer Error.\n");
+		DEBUG2(printk("scsi(%ld): ISP Request Transfer Error (%x).\n",
+		    vha->host_no, mb[1]));
+		qla_printk(KERN_WARNING, ha,
+		    "ISP Request Transfer Error (%x).\n", mb[1]);
 
 		set_bit(ISP_ABORT_NEEDED, &vha->dpc_flags);
 		break;
@@ -485,10 +488,13 @@ skip_rio:
 		break;
 
 	case MBA_LOOP_DOWN:		/* Loop Down Event */
+		mbx = IS_QLA81XX(ha) ? RD_REG_WORD(&reg24->mailbox4) : 0;
 		DEBUG2(printk("scsi(%ld): Asynchronous LOOP DOWN "
-		    "(%x %x %x).\n", vha->host_no, mb[1], mb[2], mb[3]));
-		qla_printk(KERN_INFO, ha, "LOOP DOWN detected (%x %x %x).\n",
-		    mb[1], mb[2], mb[3]);
+		    "(%x %x %x %x).\n", vha->host_no, mb[1], mb[2], mb[3],
+		    mbx));
+		qla_printk(KERN_INFO, ha,
+		    "LOOP DOWN detected (%x %x %x %x).\n", mb[1], mb[2], mb[3],
+		    mbx);
 
 		if (atomic_read(&vha->loop_state) != LOOP_DOWN) {
 			atomic_set(&vha->loop_state, LOOP_DOWN);
@@ -805,78 +811,6 @@ skip_rio:
 		qla2x00_alert_all_vps(rsp, mb);
 }
 
-static void
-qla2x00_adjust_sdev_qdepth_up(struct scsi_device *sdev, void *data)
-{
-	fc_port_t *fcport = data;
-	struct scsi_qla_host *vha = fcport->vha;
-	struct qla_hw_data *ha = vha->hw;
-	struct req_que *req = NULL;
-
-	if (!ql2xqfulltracking)
-		return;
-
-	req = vha->req;
-	if (!req)
-		return;
-	if (req->max_q_depth <= sdev->queue_depth)
-		return;
-
-	if (sdev->ordered_tags)
-		scsi_adjust_queue_depth(sdev, MSG_ORDERED_TAG,
-		    sdev->queue_depth + 1);
-	else
-		scsi_adjust_queue_depth(sdev, MSG_SIMPLE_TAG,
-		    sdev->queue_depth + 1);
-
-	fcport->last_ramp_up = jiffies;
-
-	DEBUG2(qla_printk(KERN_INFO, ha,
-	    "scsi(%ld:%d:%d:%d): Queue depth adjusted-up to %d.\n",
-	    fcport->vha->host_no, sdev->channel, sdev->id, sdev->lun,
-	    sdev->queue_depth));
-}
-
-static void
-qla2x00_adjust_sdev_qdepth_down(struct scsi_device *sdev, void *data)
-{
-	fc_port_t *fcport = data;
-
-	if (!scsi_track_queue_full(sdev, sdev->queue_depth - 1))
-		return;
-
-	DEBUG2(qla_printk(KERN_INFO, fcport->vha->hw,
-	    "scsi(%ld:%d:%d:%d): Queue depth adjusted-down to %d.\n",
-	    fcport->vha->host_no, sdev->channel, sdev->id, sdev->lun,
-	    sdev->queue_depth));
-}
-
-static inline void
-qla2x00_ramp_up_queue_depth(scsi_qla_host_t *vha, struct req_que *req,
-								srb_t *sp)
-{
-	fc_port_t *fcport;
-	struct scsi_device *sdev;
-
-	if (!ql2xqfulltracking)
-		return;
-
-	sdev = sp->cmd->device;
-	if (sdev->queue_depth >= req->max_q_depth)
-		return;
-
-	fcport = sp->fcport;
-	if (time_before(jiffies,
-	    fcport->last_ramp_up + ql2xqfullrampup * HZ))
-		return;
-	if (time_before(jiffies,
-	    fcport->last_queue_full + ql2xqfullrampup * HZ))
-		return;
-
-	starget_for_each_device(sdev->sdev_target, fcport,
-	    qla2x00_adjust_sdev_qdepth_up);
-}
-
 /**
  * qla2x00_process_completed_request() - Process a Fast Post response.
  * @ha: SCSI driver HA context
@@ -907,8 +841,6 @@ qla2x00_process_completed_request(struct scsi_qla_host *vha,
 
 		/* Save ISP completion status */
 		sp->cmd->result = DID_OK << 16;
-
-		qla2x00_ramp_up_queue_depth(vha, req, sp);
 		qla2x00_sp_compl(ha, sp);
 	} else {
 		DEBUG2(printk("scsi(%ld) Req:%d: Invalid ISP SCSI completion"
@@ -1347,16 +1279,22 @@ qla2x00_status_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, void *pkt)
 
 	sense_len = rsp_info_len = resid_len = fw_resid_len = 0;
 	if (IS_FWI2_CAPABLE(ha)) {
-		sense_len = le32_to_cpu(sts24->sense_len);
-		rsp_info_len = le32_to_cpu(sts24->rsp_data_len);
-		resid_len = le32_to_cpu(sts24->rsp_residual_count);
-		fw_resid_len = le32_to_cpu(sts24->residual_len);
+		if (scsi_status & SS_SENSE_LEN_VALID)
+			sense_len = le32_to_cpu(sts24->sense_len);
+		if (scsi_status & SS_RESPONSE_INFO_LEN_VALID)
+			rsp_info_len = le32_to_cpu(sts24->rsp_data_len);
+		if (scsi_status & (SS_RESIDUAL_UNDER | SS_RESIDUAL_OVER))
+			resid_len = le32_to_cpu(sts24->rsp_residual_count);
+		if (comp_status == CS_DATA_UNDERRUN)
+			fw_resid_len = le32_to_cpu(sts24->residual_len);
 		rsp_info = sts24->data;
 		sense_data = sts24->data;
 		host_to_fcp_swap(sts24->data, sizeof(sts24->data));
 	} else {
-		sense_len = le16_to_cpu(sts->req_sense_length);
-		rsp_info_len = le16_to_cpu(sts->rsp_info_len);
+		if (scsi_status & SS_SENSE_LEN_VALID)
+			sense_len = le16_to_cpu(sts->req_sense_length);
+		if (scsi_status & SS_RESPONSE_INFO_LEN_VALID)
+			rsp_info_len = le16_to_cpu(sts->rsp_info_len);
 		resid_len = le32_to_cpu(sts->residual_length);
 		rsp_info = sts->rsp_info;
 		sense_data = sts->req_sense_data;
@@ -1423,13 +1361,6 @@ qla2x00_status_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, void *pkt)
 			    "scsi(%ld): QUEUE FULL status detected "
 			    "0x%x-0x%x.\n", vha->host_no, comp_status,
 			    scsi_status));
-
-			/* Adjust queue depth for all luns on the port. */
-			if (!ql2xqfulltracking)
-				break;
-			fcport->last_queue_full = jiffies;
-			starget_for_each_device(cp->device->sdev_target,
-			    fcport, qla2x00_adjust_sdev_qdepth_down);
 			break;
 		}
 		if (lscsi_status != SS_CHECK_CONDITION)
@@ -1443,54 +1374,67 @@ qla2x00_status_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, void *pkt)
 		break;
 
 	case CS_DATA_UNDERRUN:
-		resid = resid_len;
+		DEBUG2(printk(KERN_INFO
+		    "scsi(%ld:%d:%d) UNDERRUN status detected 0x%x-0x%x. "
+		    "resid=0x%x fw_resid=0x%x cdb=0x%x os_underflow=0x%x\n",
+		    vha->host_no, cp->device->id, cp->device->lun, comp_status,
+		    scsi_status, resid_len, fw_resid_len, cp->cmnd[0],
+		    cp->underflow));
+
 		/* Use F/W calculated residual length. */
-		if (IS_FWI2_CAPABLE(ha)) {
-			if (!(scsi_status & SS_RESIDUAL_UNDER)) {
-				lscsi_status = 0;
-			} else if (resid != fw_resid_len) {
-				scsi_status &= ~SS_RESIDUAL_UNDER;
-				lscsi_status = 0;
+		resid = IS_FWI2_CAPABLE(ha) ? fw_resid_len : resid_len;
+		scsi_set_resid(cp, resid);
+		if (scsi_status & SS_RESIDUAL_UNDER) {
+			if (IS_FWI2_CAPABLE(ha) && fw_resid_len != resid_len) {
+				DEBUG2(printk(
+				    "scsi(%ld:%d:%d:%d) Dropped frame(s) "
+				    "detected (%x of %x bytes)...residual "
+				    "length mismatch...retrying command.\n",
+				    vha->host_no, cp->device->channel,
+				    cp->device->id, cp->device->lun, resid,
+				    scsi_bufflen(cp)));
+
+				cp->result = DID_ERROR << 16 | lscsi_status;
+				break;
 			}
-			resid = fw_resid_len;
-		}
 
-		if (scsi_status & SS_RESIDUAL_UNDER) {
-			scsi_set_resid(cp, resid);
-		} else {
-			DEBUG2(printk(KERN_INFO
-			    "scsi(%ld:%d:%d) UNDERRUN status detected "
-			    "0x%x-0x%x. resid=0x%x fw_resid=0x%x cdb=0x%x "
-			    "os_underflow=0x%x\n", vha->host_no,
-			    cp->device->id, cp->device->lun, comp_status,
-			    scsi_status, resid_len, resid, cp->cmnd[0],
-			    cp->underflow));
+			if (!lscsi_status &&
+			    ((unsigned)(scsi_bufflen(cp) - resid) <
+			    cp->underflow)) {
+				qla_printk(KERN_INFO, ha,
+				    "scsi(%ld:%d:%d:%d): Mid-layer underflow "
+				    "detected (%x of %x bytes)...returning "
+				    "error status.\n", vha->host_no,
+				    cp->device->channel, cp->device->id,
+				    cp->device->lun, resid, scsi_bufflen(cp));
+
+				cp->result = DID_ERROR << 16;
+				break;
+			}
+		} else if (!lscsi_status) {
+			DEBUG2(printk(
+			    "scsi(%ld:%d:%d:%d) Dropped frame(s) detected "
+			    "(%x of %x bytes)...firmware reported underrun..."
+			    "retrying command.\n", vha->host_no,
+			    cp->device->channel, cp->device->id,
+			    cp->device->lun, resid, scsi_bufflen(cp)));
 
+			cp->result = DID_ERROR << 16;
+			break;
 		}
 
+		cp->result = DID_OK << 16 | lscsi_status;
+
 		/*
 		 * Check to see if SCSI Status is non zero. If so report SCSI
 		 * Status.
 		 */
 		if (lscsi_status != 0) {
-			cp->result = DID_OK << 16 | lscsi_status;
-
 			if (lscsi_status == SAM_STAT_TASK_SET_FULL) {
 				DEBUG2(printk(KERN_INFO
 				    "scsi(%ld): QUEUE FULL status detected "
 				    "0x%x-0x%x.\n", vha->host_no, comp_status,
 				    scsi_status));
-
-				/*
-				 * Adjust queue depth for all luns on the
-				 * port.
-				 */
-				if (!ql2xqfulltracking)
-					break;
-				fcport->last_queue_full = jiffies;
-				starget_for_each_device(
-				    cp->device->sdev_target, fcport,
-				    qla2x00_adjust_sdev_qdepth_down);
 				break;
 			}
 			if (lscsi_status != SS_CHECK_CONDITION)
@@ -1501,42 +1445,6 @@ qla2x00_status_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, void *pkt)
 				break;
 
 			qla2x00_handle_sense(sp, sense_data, sense_len, rsp);
-		} else {
-			/*
-			 * If RISC reports underrun and target does not report
-			 * it then we must have a lost frame, so tell upper
-			 * layer to retry it by reporting an error.
-			 */
-			if (!(scsi_status & SS_RESIDUAL_UNDER)) {
-				DEBUG2(printk("scsi(%ld:%d:%d:%d) Dropped "
-					      "frame(s) detected (%x of %x bytes)..."
-					      "retrying command.\n",
-					vha->host_no, cp->device->channel,
-					cp->device->id, cp->device->lun, resid,
-					scsi_bufflen(cp)));
-
-				scsi_set_resid(cp, resid);
-				cp->result = DID_ERROR << 16;
-				break;
-			}
-
-			/* Handle mid-layer underflow */
-			if ((unsigned)(scsi_bufflen(cp) - resid) <
-			    cp->underflow) {
-				qla_printk(KERN_INFO, ha,
-					   "scsi(%ld:%d:%d:%d): Mid-layer underflow "
-					   "detected (%x of %x bytes)...returning "
-					   "error status.\n", vha->host_no,
-					   cp->device->channel, cp->device->id,
-					   cp->device->lun, resid,
-					   scsi_bufflen(cp));
-
-				cp->result = DID_ERROR << 16;
-				break;
-			}
-
-			/* Everybody online, looking good... */
-			cp->result = DID_OK << 16;
 		}
 		break;
 
@@ -1938,12 +1846,15 @@ qla24xx_intr_handler(int irq, void *dev_id)
 	reg = &ha->iobase->isp24;
 	status = 0;
 
+	if (unlikely(pci_channel_offline(ha->pdev)))
+		return IRQ_HANDLED;
+
 	spin_lock_irqsave(&ha->hardware_lock, flags);
 	vha = pci_get_drvdata(ha->pdev);
 	for (iter = 50; iter--; ) {
 		stat = RD_REG_DWORD(&reg->host_status);
 		if (stat & HSRX_RISC_PAUSED) {
-			if (pci_channel_offline(ha->pdev))
+			if (unlikely(pci_channel_offline(ha->pdev)))
 				break;
 
 			hccr = RD_REG_DWORD(&reg->hccr);
@@ -2020,7 +1931,7 @@ qla24xx_msix_rsp_q(int irq, void *dev_id)
 
 	vha = qla25xx_get_host(rsp);
 	qla24xx_process_response_queue(vha, rsp);
-	if (!ha->mqenable) {
+	if (!ha->flags.disable_msix_handshake) {
 		WRT_REG_DWORD(&reg->hccr, HCCRX_CLR_RISC_INT);
 		RD_REG_DWORD_RELAXED(&reg->hccr);
 	}
@@ -2034,6 +1945,7 @@ qla25xx_msix_rsp_q(int irq, void *dev_id)
 {
 	struct qla_hw_data *ha;
 	struct rsp_que *rsp;
+	struct device_reg_24xx __iomem *reg;
 
 	rsp = (struct rsp_que *) dev_id;
 	if (!rsp) {
@@ -2043,6 +1955,14 @@ qla25xx_msix_rsp_q(int irq, void *dev_id)
 	}
 	ha = rsp->hw;
 
+	/* Clear the interrupt, if enabled, for this response queue */
+	if (rsp->options & ~BIT_6) {
+		reg = &ha->iobase->isp24;
+		spin_lock_irq(&ha->hardware_lock);
+		WRT_REG_DWORD(&reg->hccr, HCCRX_CLR_RISC_INT);
+		RD_REG_DWORD_RELAXED(&reg->hccr);
+		spin_unlock_irq(&ha->hardware_lock);
+	}
 	queue_work_on((int) (rsp->id - 1), ha->wq, &rsp->q_work);
 
 	return IRQ_HANDLED;
@@ -2075,7 +1995,7 @@ qla24xx_msix_default(int irq, void *dev_id)
 	do {
 		stat = RD_REG_DWORD(&reg->host_status);
 		if (stat & HSRX_RISC_PAUSED) {
-			if (pci_channel_offline(ha->pdev))
+			if (unlikely(pci_channel_offline(ha->pdev)))
 				break;
 
 			hccr = RD_REG_DWORD(&reg->hccr);
diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
index b6202fe118ac..056e4d4505f3 100644
--- a/drivers/scsi/qla2xxx/qla_mbx.c
+++ b/drivers/scsi/qla2xxx/qla_mbx.c
@@ -56,6 +56,12 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp)
 
 	DEBUG11(printk("%s(%ld): entered.\n", __func__, base_vha->host_no));
 
+	if (ha->flags.pci_channel_io_perm_failure) {
+		DEBUG(printk("%s(%ld): Perm failure on EEH, timeout MBX "
+			     "Exiting.\n", __func__, vha->host_no));
+		return QLA_FUNCTION_TIMEOUT;
+	}
+
 	/*
 	 * Wait for active mailbox commands to finish by waiting at most tov
 	 * seconds. This is to serialize actual issuing of mailbox cmds during
@@ -154,10 +160,14 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp)
 			/* Check for pending interrupts. */
 			qla2x00_poll(ha->rsp_q_map[0]);
 
-			if (command != MBC_LOAD_RISC_RAM_EXTENDED &&
-			    !ha->flags.mbox_int)
+			if (!ha->flags.mbox_int &&
+			    !(IS_QLA2200(ha) &&
+			    command == MBC_LOAD_RISC_RAM_EXTENDED))
 				msleep(10);
 		} /* while */
+		DEBUG17(qla_printk(KERN_WARNING, ha,
+			"Waited %d sec\n",
+			(uint)((jiffies - (wait_time - (mcp->tov * HZ)))/HZ)));
 	}
 
 	/* Check whether we timed out */
@@ -227,7 +237,8 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp)
 
 	if (rval == QLA_FUNCTION_TIMEOUT &&
 	    mcp->mb[0] != MBC_GEN_SYSTEM_ERROR) {
-		if (!io_lock_on || (mcp->flags & IOCTL_CMD)) {
+		if (!io_lock_on || (mcp->flags & IOCTL_CMD) ||
+		    ha->flags.eeh_busy) {
 			/* not in dpc. schedule it for dpc to take over. */
 			DEBUG(printk("%s(%ld): timeout schedule "
 			"isp_abort_needed.\n", __func__,
@@ -237,7 +248,7 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp)
 			base_vha->host_no));
 			qla_printk(KERN_WARNING, ha,
 			    "Mailbox command timeout occurred. Scheduling ISP "
-			    "abort.\n");
+			    "abort. eeh_busy: 0x%x\n", ha->flags.eeh_busy);
 			set_bit(ISP_ABORT_NEEDED, &base_vha->dpc_flags);
 			qla2xxx_wake_dpc(vha);
 		} else if (!abort_active) {
@@ -2006,7 +2017,7 @@ qla2x00_get_id_list(scsi_qla_host_t *vha, void *id_list, dma_addr_t id_list_dma,
 int
 qla2x00_get_resource_cnts(scsi_qla_host_t *vha, uint16_t *cur_xchg_cnt,
     uint16_t *orig_xchg_cnt, uint16_t *cur_iocb_cnt,
-    uint16_t *orig_iocb_cnt, uint16_t *max_npiv_vports)
+    uint16_t *orig_iocb_cnt, uint16_t *max_npiv_vports, uint16_t *max_fcfs)
 {
 	int rval;
 	mbx_cmd_t mc;
@@ -2017,6 +2028,8 @@ qla2x00_get_resource_cnts(scsi_qla_host_t *vha, uint16_t *cur_xchg_cnt,
 	mcp->mb[0] = MBC_GET_RESOURCE_COUNTS;
 	mcp->out_mb = MBX_0;
 	mcp->in_mb = MBX_11|MBX_10|MBX_7|MBX_6|MBX_3|MBX_2|MBX_1|MBX_0;
+	if (IS_QLA81XX(vha->hw))
+		mcp->in_mb |= MBX_12;
 	mcp->tov = MBX_TOV_SECONDS;
 	mcp->flags = 0;
 	rval = qla2x00_mailbox_command(vha, mcp);
@@ -2027,9 +2040,10 @@ qla2x00_get_resource_cnts(scsi_qla_host_t *vha, uint16_t *cur_xchg_cnt,
 		    vha->host_no, mcp->mb[0]));
 	} else {
 		DEBUG11(printk("%s(%ld): done. mb1=%x mb2=%x mb3=%x mb6=%x "
-		    "mb7=%x mb10=%x mb11=%x.\n", __func__, vha->host_no,
-		    mcp->mb[1], mcp->mb[2], mcp->mb[3], mcp->mb[6], mcp->mb[7],
-		    mcp->mb[10], mcp->mb[11]));
+		    "mb7=%x mb10=%x mb11=%x mb12=%x.\n", __func__,
+		    vha->host_no, mcp->mb[1], mcp->mb[2], mcp->mb[3],
+		    mcp->mb[6], mcp->mb[7], mcp->mb[10], mcp->mb[11],
+		    mcp->mb[12]));
 
 		if (cur_xchg_cnt)
 			*cur_xchg_cnt = mcp->mb[3];
@@ -2041,6 +2055,8 @@ qla2x00_get_resource_cnts(scsi_qla_host_t *vha, uint16_t *cur_xchg_cnt,
 			*orig_iocb_cnt = mcp->mb[10];
 		if (vha->hw->flags.npiv_supported && max_npiv_vports)
 			*max_npiv_vports = mcp->mb[11];
+		if (IS_QLA81XX(vha->hw) && max_fcfs)
+			*max_fcfs = mcp->mb[12];
 	}
 
 	return (rval);
@@ -2313,6 +2329,7 @@ __qla24xx_issue_tmf(char *name, uint32_t type, struct fc_port *fcport,
 {
 	int		rval, rval2;
 	struct tsk_mgmt_cmd *tsk;
+	struct sts_entry_24xx *sts;
 	dma_addr_t	tsk_dma;
 	scsi_qla_host_t *vha;
 	struct qla_hw_data *ha;
@@ -2352,20 +2369,37 @@ __qla24xx_issue_tmf(char *name, uint32_t type, struct fc_port *fcport,
 		    sizeof(tsk->p.tsk.lun));
 	}
 
+	sts = &tsk->p.sts;
 	rval = qla2x00_issue_iocb(vha, tsk, tsk_dma, 0);
 	if (rval != QLA_SUCCESS) {
 		DEBUG2_3_11(printk("%s(%ld): failed to issue %s Reset IOCB "
 		    "(%x).\n", __func__, vha->host_no, name, rval));
-	} else if (tsk->p.sts.entry_status != 0) {
+	} else if (sts->entry_status != 0) {
 		DEBUG2_3_11(printk("%s(%ld): failed to complete IOCB "
 		    "-- error status (%x).\n", __func__, vha->host_no,
-		    tsk->p.sts.entry_status));
+		    sts->entry_status));
 		rval = QLA_FUNCTION_FAILED;
-	} else if (tsk->p.sts.comp_status !=
+	} else if (sts->comp_status !=
 	    __constant_cpu_to_le16(CS_COMPLETE)) {
 		DEBUG2_3_11(printk("%s(%ld): failed to complete IOCB "
 		    "-- completion status (%x).\n", __func__,
-		    vha->host_no, le16_to_cpu(tsk->p.sts.comp_status)));
+		    vha->host_no, le16_to_cpu(sts->comp_status)));
+		rval = QLA_FUNCTION_FAILED;
+	} else if (!(le16_to_cpu(sts->scsi_status) &
+	    SS_RESPONSE_INFO_LEN_VALID)) {
+		DEBUG2_3_11(printk("%s(%ld): failed to complete IOCB "
+		    "-- no response info (%x).\n", __func__, vha->host_no,
+		    le16_to_cpu(sts->scsi_status)));
+		rval = QLA_FUNCTION_FAILED;
+	} else if (le32_to_cpu(sts->rsp_data_len) < 4) {
+		DEBUG2_3_11(printk("%s(%ld): failed to complete IOCB "
+		    "-- not enough response info (%d).\n", __func__,
+		    vha->host_no, le32_to_cpu(sts->rsp_data_len)));
+		rval = QLA_FUNCTION_FAILED;
+	} else if (sts->data[3]) {
+		DEBUG2_3_11(printk("%s(%ld): failed to complete IOCB "
+		    "-- response (%x).\n", __func__,
+		    vha->host_no, sts->data[3]));
 		rval = QLA_FUNCTION_FAILED;
 	}
 
@@ -2507,6 +2541,9 @@ qla2x00_enable_eft_trace(scsi_qla_host_t *vha, dma_addr_t eft_dma,
 	if (!IS_FWI2_CAPABLE(vha->hw))
 		return QLA_FUNCTION_FAILED;
 
+	if (unlikely(pci_channel_offline(vha->hw->pdev)))
+		return QLA_FUNCTION_FAILED;
+
 	DEBUG11(printk("%s(%ld): entered.\n", __func__, vha->host_no));
 
 	mcp->mb[0] = MBC_TRACE_CONTROL;
@@ -2542,6 +2579,9 @@ qla2x00_disable_eft_trace(scsi_qla_host_t *vha)
 	if (!IS_FWI2_CAPABLE(vha->hw))
 		return QLA_FUNCTION_FAILED;
 
+	if (unlikely(pci_channel_offline(vha->hw->pdev)))
+		return QLA_FUNCTION_FAILED;
+
 	DEBUG11(printk("%s(%ld): entered.\n", __func__, vha->host_no));
 
 	mcp->mb[0] = MBC_TRACE_CONTROL;
@@ -2572,6 +2612,9 @@ qla2x00_enable_fce_trace(scsi_qla_host_t *vha, dma_addr_t fce_dma,
 	if (!IS_QLA25XX(vha->hw) && !IS_QLA81XX(vha->hw))
 		return QLA_FUNCTION_FAILED;
 
+	if (unlikely(pci_channel_offline(vha->hw->pdev)))
+		return QLA_FUNCTION_FAILED;
+
 	DEBUG11(printk("%s(%ld): entered.\n", __func__, vha->host_no));
 
 	mcp->mb[0] = MBC_TRACE_CONTROL;
@@ -2616,6 +2659,9 @@ qla2x00_disable_fce_trace(scsi_qla_host_t *vha, uint64_t *wr, uint64_t *rd)
 	if (!IS_FWI2_CAPABLE(vha->hw))
 		return QLA_FUNCTION_FAILED;
 
+	if (unlikely(pci_channel_offline(vha->hw->pdev)))
+		return QLA_FUNCTION_FAILED;
+
 	DEBUG11(printk("%s(%ld): entered.\n", __func__, vha->host_no));
 
 	mcp->mb[0] = MBC_TRACE_CONTROL;
@@ -2759,8 +2805,10 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha,
 		    vp_idx, MSB(stat),
 		    rptid_entry->port_id[2], rptid_entry->port_id[1],
 		    rptid_entry->port_id[0]));
-		if (vp_idx == 0)
-			return;
+
+		vp = vha;
+		if (vp_idx == 0 && (MSB(stat) != 1))
+			goto reg_needed;
 
 		if (MSB(stat) == 1) {
 			DEBUG2(printk("scsi(%ld): Could not acquire ID for "
@@ -2783,8 +2831,11 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha,
 		 * response queue. Handle it in dpc context.
 		 */
 		set_bit(VP_IDX_ACQUIRED, &vp->vp_flags);
-		set_bit(VP_DPC_NEEDED, &vha->dpc_flags);
 
+reg_needed:
+		set_bit(REGISTER_FC4_NEEDED, &vp->dpc_flags);
+		set_bit(REGISTER_FDMI_NEEDED, &vp->dpc_flags);
+		set_bit(VP_DPC_NEEDED, &vha->dpc_flags);
 		qla2xxx_wake_dpc(vha);
 	}
 }
@@ -3615,3 +3666,36 @@ qla2x00_write_ram_word(scsi_qla_host_t *vha, uint32_t risc_addr, uint32_t data)
 
 	return rval;
 }
+
+int
+qla2x00_get_data_rate(scsi_qla_host_t *vha)
+{
+	int rval;
+	mbx_cmd_t mc;
+	mbx_cmd_t *mcp = &mc;
+	struct qla_hw_data *ha = vha->hw;
+
+	if (!IS_FWI2_CAPABLE(ha))
+		return QLA_FUNCTION_FAILED;
+
+	DEBUG11(printk(KERN_INFO "%s(%ld): entered.\n", __func__, vha->host_no));
+
+	mcp->mb[0] = MBC_DATA_RATE;
+	mcp->mb[1] = 0;
+	mcp->out_mb = MBX_1|MBX_0;
+	mcp->in_mb = MBX_2|MBX_1|MBX_0;
+	mcp->tov = MBX_TOV_SECONDS;
+	mcp->flags = 0;
+	rval = qla2x00_mailbox_command(vha, mcp);
+	if (rval != QLA_SUCCESS) {
+		DEBUG2_3_11(printk(KERN_INFO "%s(%ld): failed=%x mb[0]=%x.\n",
+		    __func__, vha->host_no, rval, mcp->mb[0]));
+	} else {
+		DEBUG11(printk(KERN_INFO
+		    "%s(%ld): done.\n", __func__, vha->host_no));
+		if (mcp->mb[1] != 0x7)
+			ha->link_data_rate = mcp->mb[1];
+	}
+
+	return rval;
+}
diff --git a/drivers/scsi/qla2xxx/qla_mid.c b/drivers/scsi/qla2xxx/qla_mid.c
index e07b3617f019..b901aa267e7d 100644
--- a/drivers/scsi/qla2xxx/qla_mid.c
+++ b/drivers/scsi/qla2xxx/qla_mid.c
@@ -382,8 +382,6 @@ qla24xx_create_vhost(struct fc_vport *fc_vport)
 	vha->mgmt_svr_loop_id = 10 + vha->vp_idx;
 
 	vha->dpc_flags = 0L;
-	set_bit(REGISTER_FDMI_NEEDED, &vha->dpc_flags);
-	set_bit(REGISTER_FC4_NEEDED, &vha->dpc_flags);
 
 	/*
 	 * To fix the issue of processing a parent's RSCN for the vport before
@@ -641,8 +639,10 @@ static void qla_do_work(struct work_struct *work)
 	struct rsp_que *rsp = container_of(work, struct rsp_que, q_work);
 	struct scsi_qla_host *vha;
 
+	spin_lock_irq(&rsp->hw->hardware_lock);
 	vha = qla25xx_get_host(rsp);
 	qla24xx_process_response_queue(vha, rsp);
+	spin_unlock_irq(&rsp->hw->hardware_lock);
 }
 
 /* create response queue */
@@ -698,6 +698,10 @@ qla25xx_create_rsp_que(struct qla_hw_data *ha, uint16_t options,
 	/* Use alternate PCI devfn */
 	if (LSB(rsp->rid))
 		options |= BIT_5;
+	/* Enable MSIX handshake mode on for uncapable adapters */
+	if (!IS_MSIX_NACK_CAPABLE(ha))
+		options |= BIT_6;
+
 	rsp->options = options;
 	rsp->id = que_id;
 	reg = ISP_QUE_REG(ha, que_id);
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index b79fca7d461b..209f50e788a1 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -11,6 +11,7 @@
 #include <linux/delay.h>
 #include <linux/kthread.h>
 #include <linux/mutex.h>
+#include <linux/kobject.h>
 
 #include <scsi/scsi_tcq.h>
 #include <scsi/scsicam.h>
@@ -77,21 +78,6 @@ module_param(ql2xmaxqdepth, int, S_IRUGO|S_IWUSR);
 MODULE_PARM_DESC(ql2xmaxqdepth,
 		"Maximum queue depth to report for target devices.");
 
-int ql2xqfulltracking = 1;
-module_param(ql2xqfulltracking, int, S_IRUGO|S_IWUSR);
-MODULE_PARM_DESC(ql2xqfulltracking,
-		"Controls whether the driver tracks queue full status "
-		"returns and dynamically adjusts a scsi device's queue "
-		"depth.  Default is 1, perform tracking.  Set to 0 to "
-		"disable dynamic tracking and adjustment of queue depth.");
-
-int ql2xqfullrampup = 120;
-module_param(ql2xqfullrampup, int, S_IRUGO|S_IWUSR);
-MODULE_PARM_DESC(ql2xqfullrampup,
-		"Number of seconds to wait to begin to ramp-up the queue "
-		"depth for a device after a queue-full condition has been "
-		"detected.  Default is 120 seconds.");
-
 int ql2xiidmaenable=1;
 module_param(ql2xiidmaenable, int, S_IRUGO|S_IRUSR);
 MODULE_PARM_DESC(ql2xiidmaenable,
@@ -137,7 +123,7 @@ static int qla2xxx_eh_target_reset(struct scsi_cmnd *);
 static int qla2xxx_eh_bus_reset(struct scsi_cmnd *);
 static int qla2xxx_eh_host_reset(struct scsi_cmnd *);
 
-static int qla2x00_change_queue_depth(struct scsi_device *, int);
+static int qla2x00_change_queue_depth(struct scsi_device *, int, int);
 static int qla2x00_change_queue_type(struct scsi_device *, int);
 
 struct scsi_host_template qla2xxx_driver_template = {
@@ -489,11 +475,11 @@ qla2xxx_queuecommand(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd *))
 	srb_t *sp;
 	int rval;
 
-	if (unlikely(pci_channel_offline(ha->pdev))) {
-		if (ha->pdev->error_state == pci_channel_io_frozen)
-			cmd->result = DID_REQUEUE << 16;
-		else
+	if (ha->flags.eeh_busy) {
+		if (ha->flags.pci_channel_io_perm_failure)
 			cmd->result = DID_NO_CONNECT << 16;
+		else
+			cmd->result = DID_REQUEUE << 16;
 		goto qc24_fail_command;
 	}
 
@@ -566,8 +552,15 @@ qla2x00_eh_wait_on_command(struct scsi_cmnd *cmd)
 #define ABORT_POLLING_PERIOD	1000
 #define ABORT_WAIT_ITER		((10 * 1000) / (ABORT_POLLING_PERIOD))
 	unsigned long wait_iter = ABORT_WAIT_ITER;
+	scsi_qla_host_t *vha = shost_priv(cmd->device->host);
+	struct qla_hw_data *ha = vha->hw;
 	int ret = QLA_SUCCESS;
 
+	if (unlikely(pci_channel_offline(ha->pdev)) || ha->flags.eeh_busy) {
+		DEBUG17(qla_printk(KERN_WARNING, ha, "return:eh_wait\n"));
+		return ret;
+	}
+
 	while (CMD_SP(cmd) && wait_iter--) {
 		msleep(ABORT_POLLING_PERIOD);
 	}
@@ -727,23 +720,6 @@ qla2x00_abort_fcport_cmds(fc_port_t *fcport)
 	spin_unlock_irqrestore(&ha->hardware_lock, flags);
 }
 
-static void
-qla2x00_block_error_handler(struct scsi_cmnd *cmnd)
-{
-	struct Scsi_Host *shost = cmnd->device->host;
-	struct fc_rport *rport = starget_to_rport(scsi_target(cmnd->device));
-	unsigned long flags;
-
-	spin_lock_irqsave(shost->host_lock, flags);
-	while (rport->port_state == FC_PORTSTATE_BLOCKED) {
-		spin_unlock_irqrestore(shost->host_lock, flags);
-		msleep(1000);
-		spin_lock_irqsave(shost->host_lock, flags);
-	}
-	spin_unlock_irqrestore(shost->host_lock, flags);
-	return;
-}
-
 /**************************************************************************
 * qla2xxx_eh_abort
 *
@@ -773,7 +749,7 @@ qla2xxx_eh_abort(struct scsi_cmnd *cmd)
 	struct req_que *req = vha->req;
 	srb_t *spt;
 
-	qla2x00_block_error_handler(cmd);
+	fc_block_scsi_eh(cmd);
 
 	if (!CMD_SP(cmd))
 		return SUCCESS;
@@ -904,7 +880,7 @@ __qla2xxx_eh_generic_reset(char *name, enum nexus_wait_type type,
 	fc_port_t *fcport = (struct fc_port *) cmd->device->hostdata;
 	int err;
 
-	qla2x00_block_error_handler(cmd);
+	fc_block_scsi_eh(cmd);
 
 	if (!fcport)
 		return FAILED;
@@ -984,7 +960,7 @@ qla2xxx_eh_bus_reset(struct scsi_cmnd *cmd)
 	unsigned long serial;
 	srb_t *sp = (srb_t *) CMD_SP(cmd);
 
-	qla2x00_block_error_handler(cmd);
+	fc_block_scsi_eh(cmd);
 
 	id = cmd->device->id;
 	lun = cmd->device->lun;
@@ -1047,7 +1023,7 @@ qla2xxx_eh_host_reset(struct scsi_cmnd *cmd)
 	srb_t *sp = (srb_t *) CMD_SP(cmd);
 	scsi_qla_host_t *base_vha = pci_get_drvdata(ha->pdev);
 
-	qla2x00_block_error_handler(cmd);
+	fc_block_scsi_eh(cmd);
 
 	id = cmd->device->id;
 	lun = cmd->device->lun;
@@ -1233,10 +1209,61 @@ qla2xxx_slave_destroy(struct scsi_device *sdev)
 	sdev->hostdata = NULL;
 }
 
+static void qla2x00_handle_queue_full(struct scsi_device *sdev, int qdepth)
+{
+	fc_port_t *fcport = (struct fc_port *) sdev->hostdata;
+
+	if (!scsi_track_queue_full(sdev, qdepth))
+		return;
+
+	DEBUG2(qla_printk(KERN_INFO, fcport->vha->hw,
+		"scsi(%ld:%d:%d:%d): Queue depth adjusted-down to %d.\n",
+		fcport->vha->host_no, sdev->channel, sdev->id, sdev->lun,
+		sdev->queue_depth));
+}
+
+static void qla2x00_adjust_sdev_qdepth_up(struct scsi_device *sdev, int qdepth)
+{
+	fc_port_t *fcport = sdev->hostdata;
+	struct scsi_qla_host *vha = fcport->vha;
+	struct qla_hw_data *ha = vha->hw;
+	struct req_que *req = NULL;
+
+	req = vha->req;
+	if (!req)
+		return;
+
+	if (req->max_q_depth <= sdev->queue_depth || req->max_q_depth < qdepth)
+		return;
+
+	if (sdev->ordered_tags)
+		scsi_adjust_queue_depth(sdev, MSG_ORDERED_TAG, qdepth);
+	else
+		scsi_adjust_queue_depth(sdev, MSG_SIMPLE_TAG, qdepth);
+
+	DEBUG2(qla_printk(KERN_INFO, ha,
+	       "scsi(%ld:%d:%d:%d): Queue depth adjusted-up to %d.\n",
+	       fcport->vha->host_no, sdev->channel, sdev->id, sdev->lun,
+	       sdev->queue_depth));
+}
+
 static int
-qla2x00_change_queue_depth(struct scsi_device *sdev, int qdepth)
+qla2x00_change_queue_depth(struct scsi_device *sdev, int qdepth, int reason)
 {
-	scsi_adjust_queue_depth(sdev, scsi_get_tag_type(sdev), qdepth);
+	switch (reason) {
+	case SCSI_QDEPTH_DEFAULT:
+		scsi_adjust_queue_depth(sdev, scsi_get_tag_type(sdev), qdepth);
+		break;
+	case SCSI_QDEPTH_QFULL:
+		qla2x00_handle_queue_full(sdev, qdepth);
+		break;
+	case SCSI_QDEPTH_RAMP_UP:
+		qla2x00_adjust_sdev_qdepth_up(sdev, qdepth);
+		break;
+	default:
+		return EOPNOTSUPP;
+	}
+
 	return sdev->queue_depth;
 }
 
@@ -1790,6 +1817,13 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
 
 	/* Set ISP-type information. */
 	qla2x00_set_isp_flags(ha);
+
+	/* Set EEH reset type to fundamental if required by hba */
+	if ( IS_QLA24XX(ha) || IS_QLA25XX(ha) || IS_QLA81XX(ha)) {
+		pdev->needs_freset = 1;
+		pci_save_state(pdev);
+	}
+
 	/* Configure PCI I/O space */
 	ret = qla2x00_iospace_config(ha);
 	if (ret)
@@ -2016,13 +2050,13 @@ skip_dpc:
 	DEBUG2(printk("DEBUG: detect hba %ld at address = %p\n",
 	    base_vha->host_no, ha));
 
-	base_vha->flags.init_done = 1;
-	base_vha->flags.online = 1;
-
 	ret = scsi_add_host(host, &pdev->dev);
 	if (ret)
 		goto probe_failed;
 
+	base_vha->flags.init_done = 1;
+	base_vha->flags.online = 1;
+
 	ha->isp_ops->enable_intrs(ha);
 
 	scsi_scan_host(host);
@@ -2154,6 +2188,24 @@ qla2x00_free_device(scsi_qla_host_t *vha)
 {
 	struct qla_hw_data *ha = vha->hw;
 
+	qla2x00_abort_all_cmds(vha, DID_NO_CONNECT << 16);
+
+	/* Disable timer */
+	if (vha->timer_active)
+		qla2x00_stop_timer(vha);
+
+	/* Kill the kernel thread for this host */
+	if (ha->dpc_thread) {
+		struct task_struct *t = ha->dpc_thread;
+
+		/*
+		 * qla2xxx_wake_dpc checks for ->dpc_thread
+		 * so we need to zero it out.
+		 */
+		ha->dpc_thread = NULL;
+		kthread_stop(t);
+	}
+
 	qla25xx_delete_queues(vha);
 
 	if (ha->flags.fce_enabled)
@@ -2165,6 +2217,8 @@ qla2x00_free_device(scsi_qla_host_t *vha)
 	/* Stop currently executing firmware. */
 	qla2x00_try_to_stop_firmware(vha);
 
+	vha->flags.online = 0;
+
 	/* turn-off interrupts on the card */
 	if (ha->interrupts_on)
 		ha->isp_ops->disable_intrs(ha);
@@ -2653,6 +2707,37 @@ qla2x00_post_async_work(login_done, QLA_EVT_ASYNC_LOGIN_DONE);
 qla2x00_post_async_work(logout, QLA_EVT_ASYNC_LOGOUT);
 qla2x00_post_async_work(logout_done, QLA_EVT_ASYNC_LOGOUT_DONE);
 
+int
+qla2x00_post_uevent_work(struct scsi_qla_host *vha, u32 code)
+{
+	struct qla_work_evt *e;
+
+	e = qla2x00_alloc_work(vha, QLA_EVT_UEVENT);
+	if (!e)
+		return QLA_FUNCTION_FAILED;
+
+	e->u.uevent.code = code;
+	return qla2x00_post_work(vha, e);
+}
+
+static void
+qla2x00_uevent_emit(struct scsi_qla_host *vha, u32 code)
+{
+	char event_string[40];
+	char *envp[] = { event_string, NULL };
+
+	switch (code) {
+	case QLA_UEVENT_CODE_FW_DUMP:
+		snprintf(event_string, sizeof(event_string), "FW_DUMP=%ld",
+		    vha->host_no);
+		break;
+	default:
+		/* do nothing */
+		break;
+	}
+	kobject_uevent_env(&vha->hw->pdev->dev.kobj, KOBJ_CHANGE, envp);
+}
+
 void
 qla2x00_do_work(struct scsi_qla_host *vha)
 {
@@ -2690,6 +2775,9 @@ qla2x00_do_work(struct scsi_qla_host *vha)
 			qla2x00_async_logout_done(vha, e->u.logio.fcport,
 			    e->u.logio.data);
 			break;
+		case QLA_EVT_UEVENT:
+			qla2x00_uevent_emit(vha, e->u.uevent.code);
+			break;
 		}
 		if (e->flags & QLA_EVT_FLAG_FREE)
 			kfree(e);
@@ -2805,6 +2893,13 @@ qla2x00_do_dpc(void *data)
 		if (!base_vha->flags.init_done)
 			continue;
 
+		if (ha->flags.eeh_busy) {
+			DEBUG17(qla_printk(KERN_WARNING, ha,
+			    "qla2x00_do_dpc: dpc_flags: %lx\n",
+			    base_vha->dpc_flags));
+			continue;
+		}
+
 		DEBUG3(printk("scsi(%ld): DPC handler\n", base_vha->host_no));
 
 		ha->dpc_active = 1;
@@ -2995,8 +3090,13 @@ qla2x00_timer(scsi_qla_host_t *vha)
 	int		index;
 	srb_t		*sp;
 	int		t;
+	uint16_t        w;
 	struct qla_hw_data *ha = vha->hw;
 	struct req_que *req;
+
+	/* Hardware read to raise pending EEH errors during mailbox waits. */
+	if (!pci_channel_offline(ha->pdev))
+		pci_read_config_word(ha->pdev, PCI_VENDOR_ID, &w);
 	/*
 	 * Ports - Port down timer.
 	 *
@@ -3198,16 +3298,23 @@ qla2x00_release_firmware(void)
 static pci_ers_result_t
 qla2xxx_pci_error_detected(struct pci_dev *pdev, pci_channel_state_t state)
 {
-	scsi_qla_host_t *base_vha = pci_get_drvdata(pdev);
+	scsi_qla_host_t *vha = pci_get_drvdata(pdev);
+	struct qla_hw_data *ha = vha->hw;
+
+	DEBUG2(qla_printk(KERN_WARNING, ha, "error_detected:state %x\n",
+	    state));
 
 	switch (state) {
 	case pci_channel_io_normal:
+		ha->flags.eeh_busy = 0;
 		return PCI_ERS_RESULT_CAN_RECOVER;
 	case pci_channel_io_frozen:
+		ha->flags.eeh_busy = 1;
 		pci_disable_device(pdev);
 		return PCI_ERS_RESULT_NEED_RESET;
 	case pci_channel_io_perm_failure:
-		qla2x00_abort_all_cmds(base_vha, DID_NO_CONNECT << 16);
+		ha->flags.pci_channel_io_perm_failure = 1;
+		qla2x00_abort_all_cmds(vha, DID_NO_CONNECT << 16);
 		return PCI_ERS_RESULT_DISCONNECT;
 	}
 	return PCI_ERS_RESULT_NEED_RESET;
@@ -3258,6 +3365,8 @@ qla2xxx_pci_slot_reset(struct pci_dev *pdev)
 	struct qla_hw_data *ha = base_vha->hw;
 	int rc;
 
+	DEBUG17(qla_printk(KERN_WARNING, ha, "slot_reset\n"));
+
 	if (ha->mem_only)
 		rc = pci_enable_device_mem(pdev);
 	else
@@ -3266,19 +3375,33 @@ qla2xxx_pci_slot_reset(struct pci_dev *pdev)
 	if (rc) {
 		qla_printk(KERN_WARNING, ha,
 		    "Can't re-enable PCI device after reset.\n");
-
 		return ret;
 	}
-	pci_set_master(pdev);
 
 	if (ha->isp_ops->pci_config(base_vha))
 		return ret;
 
+#ifdef QL_DEBUG_LEVEL_17
+	{
+		uint8_t b;
+		uint32_t i;
+
+		printk("slot_reset_1: ");
+		for (i = 0; i < 256; i++) {
+			pci_read_config_byte(ha->pdev, i, &b);
+			printk("%s%02x", (i%16) ? " " : "\n", b);
+		}
+		printk("\n");
+	}
+#endif
 	set_bit(ABORT_ISP_ACTIVE, &base_vha->dpc_flags);
 	if (qla2x00_abort_isp(base_vha) == QLA_SUCCESS)
 		ret =  PCI_ERS_RESULT_RECOVERED;
 	clear_bit(ABORT_ISP_ACTIVE, &base_vha->dpc_flags);
 
+	DEBUG17(qla_printk(KERN_WARNING, ha,
+	    "slot_reset-return:ret=%x\n", ret));
+
 	return ret;
 }
 
@@ -3289,12 +3412,17 @@ qla2xxx_pci_resume(struct pci_dev *pdev)
 	struct qla_hw_data *ha = base_vha->hw;
 	int ret;
 
+	DEBUG17(qla_printk(KERN_WARNING, ha, "pci_resume\n"));
+
 	ret = qla2x00_wait_for_hba_online(base_vha);
 	if (ret != QLA_SUCCESS) {
 		qla_printk(KERN_ERR, ha,
 		    "the device failed to resume I/O "
 		    "from slot/link_reset");
 	}
+
+	ha->flags.eeh_busy = 0;
+
 	pci_cleanup_aer_uncorrect_error_status(pdev);
 }
 
diff --git a/drivers/scsi/qla2xxx/qla_version.h b/drivers/scsi/qla2xxx/qla_version.h
index ac107a2c34a4..a65dd95507c6 100644
--- a/drivers/scsi/qla2xxx/qla_version.h
+++ b/drivers/scsi/qla2xxx/qla_version.h
@@ -7,7 +7,7 @@
 /*
  * Driver version
  */
-#define QLA2XXX_VERSION      "8.03.01-k6"
+#define QLA2XXX_VERSION      "8.03.01-k9"
 
 #define QLA_DRIVER_MAJOR_VER	8
 #define QLA_DRIVER_MINOR_VER	3
diff --git a/drivers/scsi/qlogicpti.h b/drivers/scsi/qlogicpti.h
index 9c053bbaa877..e3c74d1ee2db 100644
--- a/drivers/scsi/qlogicpti.h
+++ b/drivers/scsi/qlogicpti.h
@@ -43,7 +43,7 @@
  * determined for each queue request anew.
  */
 #define QLOGICPTI_REQ_QUEUE_LEN	255	/* must be power of two - 1 */
-#define QLOGICPTI_MAX_SG(ql)	(4 + ((ql) > 0) ? 7*((ql) - 1) : 0)
+#define QLOGICPTI_MAX_SG(ql)	(4 + (((ql) > 0) ? 7*((ql) - 1) : 0))
 
 /* mailbox command complete status codes */
 #define MBOX_COMMAND_COMPLETE		0x4000
diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
index dd098cad337b..a60da5555577 100644
--- a/drivers/scsi/scsi.c
+++ b/drivers/scsi/scsi.c
@@ -940,10 +940,16 @@ EXPORT_SYMBOL(scsi_adjust_queue_depth);
  */
 int scsi_track_queue_full(struct scsi_device *sdev, int depth)
 {
-	if ((jiffies >> 4) == sdev->last_queue_full_time)
+
+	/*
+	 * Don't let QUEUE_FULLs on the same
+	 * jiffies count, they could all be from
+	 * same event.
+	 */
+	if ((jiffies >> 4) == (sdev->last_queue_full_time >> 4))
 		return 0;
 
-	sdev->last_queue_full_time = (jiffies >> 4);
+	sdev->last_queue_full_time = jiffies;
 	if (sdev->last_queue_full_depth != depth) {
 		sdev->last_queue_full_count = 1;
 		sdev->last_queue_full_depth = depth;
diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
index c4103bef41b5..0b575c871007 100644
--- a/drivers/scsi/scsi_debug.c
+++ b/drivers/scsi/scsi_debug.c
@@ -44,6 +44,8 @@
 
 #include <net/checksum.h>
 
+#include <asm/unaligned.h>
+
 #include <scsi/scsi.h>
 #include <scsi/scsi_cmnd.h>
 #include <scsi/scsi_device.h>
@@ -105,6 +107,10 @@ static const char * scsi_debug_version_date = "20070104";
 #define DEF_ATO 1
 #define DEF_PHYSBLK_EXP 0
 #define DEF_LOWEST_ALIGNED 0
+#define DEF_UNMAP_MAX_BLOCKS 0
+#define DEF_UNMAP_MAX_DESC 0
+#define DEF_UNMAP_GRANULARITY 0
+#define DEF_UNMAP_ALIGNMENT 0
 
 /* bit mask values for scsi_debug_opts */
 #define SCSI_DEBUG_OPT_NOISE   1
@@ -162,6 +168,10 @@ static int scsi_debug_guard = DEF_GUARD;
 static int scsi_debug_ato = DEF_ATO;
 static int scsi_debug_physblk_exp = DEF_PHYSBLK_EXP;
 static int scsi_debug_lowest_aligned = DEF_LOWEST_ALIGNED;
+static int scsi_debug_unmap_max_desc = DEF_UNMAP_MAX_DESC;
+static int scsi_debug_unmap_max_blocks = DEF_UNMAP_MAX_BLOCKS;
+static int scsi_debug_unmap_granularity = DEF_UNMAP_GRANULARITY;
+static int scsi_debug_unmap_alignment = DEF_UNMAP_ALIGNMENT;
 
 static int scsi_debug_cmnd_count = 0;
 
@@ -223,7 +233,9 @@ static struct sdebug_queued_cmd queued_arr[SCSI_DEBUG_CANQUEUE];
 
 static unsigned char * fake_storep;	/* ramdisk storage */
 static unsigned char *dif_storep;	/* protection info */
+static void *map_storep;		/* provisioning map */
 
+static unsigned long map_size;
 static int num_aborts = 0;
 static int num_dev_resets = 0;
 static int num_bus_resets = 0;
@@ -317,6 +329,7 @@ static void get_data_transfer_info(unsigned char *cmd,
 			(u32)cmd[28] << 24;
 		break;
 
+	case WRITE_SAME_16:
 	case WRITE_16:
 	case READ_16:
 		*lba = (u64)cmd[9] | (u64)cmd[8] << 8 |
@@ -335,6 +348,7 @@ static void get_data_transfer_info(unsigned char *cmd,
 		*num = (u32)cmd[9] | (u32)cmd[8] << 8 | (u32)cmd[7] << 16 |
 			(u32)cmd[6] << 24;
 		break;
+	case WRITE_SAME:
 	case WRITE_10:
 	case READ_10:
 	case XDWRITEREAD_10:
@@ -671,10 +685,12 @@ static int inquiry_evpd_89(unsigned char * arr)
 }
 
 
+/* Block limits VPD page (SBC-3) */
 static unsigned char vpdb0_data[] = {
-	/* from 4th byte */ 0,0,0,4,
-	0,0,0x4,0,
-	0,0,0,64,
+	/* from 4th byte */ 0,0,0,4, 0,0,0x4,0, 0,0,0,64,
+	0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
+	0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
+	0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
 };
 
 static int inquiry_evpd_b0(unsigned char * arr)
@@ -691,14 +707,40 @@ static int inquiry_evpd_b0(unsigned char * arr)
 		arr[6] = (sdebug_store_sectors >> 8) & 0xff;
 		arr[7] = sdebug_store_sectors & 0xff;
 	}
+
+	if (scsi_debug_unmap_max_desc) {
+		unsigned int blocks;
+
+		if (scsi_debug_unmap_max_blocks)
+			blocks = scsi_debug_unmap_max_blocks;
+		else
+			blocks = 0xffffffff;
+
+		put_unaligned_be32(blocks, &arr[16]);
+		put_unaligned_be32(scsi_debug_unmap_max_desc, &arr[20]);
+	}
+
+	if (scsi_debug_unmap_alignment) {
+		put_unaligned_be32(scsi_debug_unmap_alignment, &arr[28]);
+		arr[28] |= 0x80; /* UGAVALID */
+	}
+
+	if (scsi_debug_unmap_granularity) {
+		put_unaligned_be32(scsi_debug_unmap_granularity, &arr[24]);
+		return 0x3c; /* Mandatory page length for thin provisioning */
+	}
+
 	return sizeof(vpdb0_data);
 }
 
+/* Block device characteristics VPD page (SBC-3) */
 static int inquiry_evpd_b1(unsigned char *arr)
 {
 	memset(arr, 0, 0x3c);
 	arr[0] = 0;
-	arr[1] = 1;
+	arr[1] = 1;	/* non rotating medium (e.g. solid state) */
+	arr[2] = 0;
+	arr[3] = 5;	/* less than 1.8" */
 
 	return 0x3c;
 }
@@ -974,6 +1016,10 @@ static int resp_readcap16(struct scsi_cmnd * scp,
 	arr[11] = scsi_debug_sector_size & 0xff;
 	arr[13] = scsi_debug_physblk_exp & 0xf;
 	arr[14] = (scsi_debug_lowest_aligned >> 8) & 0x3f;
+
+	if (scsi_debug_unmap_granularity)
+		arr[14] |= 0x80; /* TPE */
+
 	arr[15] = scsi_debug_lowest_aligned & 0xff;
 
 	if (scsi_debug_dif) {
@@ -1887,6 +1933,70 @@ out:
 	return ret;
 }
 
+static unsigned int map_state(sector_t lba, unsigned int *num)
+{
+	unsigned int granularity, alignment, mapped;
+	sector_t block, next, end;
+
+	granularity = scsi_debug_unmap_granularity;
+	alignment = granularity - scsi_debug_unmap_alignment;
+	block = lba + alignment;
+	do_div(block, granularity);
+
+	mapped = test_bit(block, map_storep);
+
+	if (mapped)
+		next = find_next_zero_bit(map_storep, map_size, block);
+	else
+		next = find_next_bit(map_storep, map_size, block);
+
+	end = next * granularity - scsi_debug_unmap_alignment;
+	*num = end - lba;
+
+	return mapped;
+}
+
+static void map_region(sector_t lba, unsigned int len)
+{
+	unsigned int granularity, alignment;
+	sector_t end = lba + len;
+
+	granularity = scsi_debug_unmap_granularity;
+	alignment = granularity - scsi_debug_unmap_alignment;
+
+	while (lba < end) {
+		sector_t block, rem;
+
+		block = lba + alignment;
+		rem = do_div(block, granularity);
+
+		set_bit(block, map_storep);
+
+		lba += granularity - rem;
+	}
+}
+
+static void unmap_region(sector_t lba, unsigned int len)
+{
+	unsigned int granularity, alignment;
+	sector_t end = lba + len;
+
+	granularity = scsi_debug_unmap_granularity;
+	alignment = granularity - scsi_debug_unmap_alignment;
+
+	while (lba < end) {
+		sector_t block, rem;
+
+		block = lba + alignment;
+		rem = do_div(block, granularity);
+
+		if (rem == 0 && lba + granularity <= end)
+			clear_bit(block, map_storep);
+
+		lba += granularity - rem;
+	}
+}
+
 static int resp_write(struct scsi_cmnd *SCpnt, unsigned long long lba,
 		      unsigned int num, struct sdebug_dev_info *devip,
 		      u32 ei_lba)
@@ -1910,6 +2020,8 @@ static int resp_write(struct scsi_cmnd *SCpnt, unsigned long long lba,
 
 	write_lock_irqsave(&atomic_rw, iflags);
 	ret = do_device_access(SCpnt, devip, lba, num, 1);
+	if (scsi_debug_unmap_granularity)
+		map_region(lba, num);
 	write_unlock_irqrestore(&atomic_rw, iflags);
 	if (-1 == ret)
 		return (DID_ERROR << 16);
@@ -1917,9 +2029,143 @@ static int resp_write(struct scsi_cmnd *SCpnt, unsigned long long lba,
 		 (SCSI_DEBUG_OPT_NOISE & scsi_debug_opts))
 		printk(KERN_INFO "scsi_debug: write: cdb indicated=%u, "
 		       " IO sent=%d bytes\n", num * scsi_debug_sector_size, ret);
+
+	return 0;
+}
+
+static int resp_write_same(struct scsi_cmnd *scmd, unsigned long long lba,
+		      unsigned int num, struct sdebug_dev_info *devip,
+			   u32 ei_lba, unsigned int unmap)
+{
+	unsigned long iflags;
+	unsigned long long i;
+	int ret;
+
+	ret = check_device_access_params(devip, lba, num);
+	if (ret)
+		return ret;
+
+	write_lock_irqsave(&atomic_rw, iflags);
+
+	if (unmap && scsi_debug_unmap_granularity) {
+		unmap_region(lba, num);
+		goto out;
+	}
+
+	/* Else fetch one logical block */
+	ret = fetch_to_dev_buffer(scmd,
+				  fake_storep + (lba * scsi_debug_sector_size),
+				  scsi_debug_sector_size);
+
+	if (-1 == ret) {
+		write_unlock_irqrestore(&atomic_rw, iflags);
+		return (DID_ERROR << 16);
+	} else if ((ret < (num * scsi_debug_sector_size)) &&
+		 (SCSI_DEBUG_OPT_NOISE & scsi_debug_opts))
+		printk(KERN_INFO "scsi_debug: write same: cdb indicated=%u, "
+		       " IO sent=%d bytes\n", num * scsi_debug_sector_size, ret);
+
+	/* Copy first sector to remaining blocks */
+	for (i = 1 ; i < num ; i++)
+		memcpy(fake_storep + ((lba + i) * scsi_debug_sector_size),
+		       fake_storep + (lba * scsi_debug_sector_size),
+		       scsi_debug_sector_size);
+
+	if (scsi_debug_unmap_granularity)
+		map_region(lba, num);
+out:
+	write_unlock_irqrestore(&atomic_rw, iflags);
+
 	return 0;
 }
 
+struct unmap_block_desc {
+	__be64	lba;
+	__be32	blocks;
+	__be32	__reserved;
+};
+
+static int resp_unmap(struct scsi_cmnd * scmd, struct sdebug_dev_info * devip)
+{
+	unsigned char *buf;
+	struct unmap_block_desc *desc;
+	unsigned int i, payload_len, descriptors;
+	int ret;
+
+	ret = check_readiness(scmd, 1, devip);
+	if (ret)
+		return ret;
+
+	payload_len = get_unaligned_be16(&scmd->cmnd[7]);
+	BUG_ON(scsi_bufflen(scmd) != payload_len);
+
+	descriptors = (payload_len - 8) / 16;
+
+	buf = kmalloc(scsi_bufflen(scmd), GFP_ATOMIC);
+	if (!buf)
+		return check_condition_result;
+
+	scsi_sg_copy_to_buffer(scmd, buf, scsi_bufflen(scmd));
+
+	BUG_ON(get_unaligned_be16(&buf[0]) != payload_len - 2);
+	BUG_ON(get_unaligned_be16(&buf[2]) != descriptors * 16);
+
+	desc = (void *)&buf[8];
+
+	for (i = 0 ; i < descriptors ; i++) {
+		unsigned long long lba = get_unaligned_be64(&desc[i].lba);
+		unsigned int num = get_unaligned_be32(&desc[i].blocks);
+
+		ret = check_device_access_params(devip, lba, num);
+		if (ret)
+			goto out;
+
+		unmap_region(lba, num);
+	}
+
+	ret = 0;
+
+out:
+	kfree(buf);
+
+	return ret;
+}
+
+#define SDEBUG_GET_LBA_STATUS_LEN 32
+
+static int resp_get_lba_status(struct scsi_cmnd * scmd,
+			       struct sdebug_dev_info * devip)
+{
+	unsigned long long lba;
+	unsigned int alloc_len, mapped, num;
+	unsigned char arr[SDEBUG_GET_LBA_STATUS_LEN];
+	int ret;
+
+	ret = check_readiness(scmd, 1, devip);
+	if (ret)
+		return ret;
+
+	lba = get_unaligned_be64(&scmd->cmnd[2]);
+	alloc_len = get_unaligned_be32(&scmd->cmnd[10]);
+
+	if (alloc_len < 24)
+		return 0;
+
+	ret = check_device_access_params(devip, lba, 1);
+	if (ret)
+		return ret;
+
+	mapped = map_state(lba, &num);
+
+	memset(arr, 0, SDEBUG_GET_LBA_STATUS_LEN);
+	put_unaligned_be32(16, &arr[0]);	/* Parameter Data Length */
+	put_unaligned_be64(lba, &arr[8]);	/* LBA */
+	put_unaligned_be32(num, &arr[16]);	/* Number of blocks */
+	arr[20] = !mapped;			/* mapped = 0, unmapped = 1 */
+
+	return fill_from_dev_buffer(scmd, arr, SDEBUG_GET_LBA_STATUS_LEN);
+}
+
 #define SDEBUG_RLUN_ARR_SZ 256
 
 static int resp_report_luns(struct scsi_cmnd * scp,
@@ -2430,6 +2676,10 @@ module_param_named(guard, scsi_debug_guard, int, S_IRUGO);
 module_param_named(ato, scsi_debug_ato, int, S_IRUGO);
 module_param_named(physblk_exp, scsi_debug_physblk_exp, int, S_IRUGO);
 module_param_named(lowest_aligned, scsi_debug_lowest_aligned, int, S_IRUGO);
+module_param_named(unmap_max_blocks, scsi_debug_unmap_max_blocks, int, S_IRUGO);
+module_param_named(unmap_max_desc, scsi_debug_unmap_max_desc, int, S_IRUGO);
+module_param_named(unmap_granularity, scsi_debug_unmap_granularity, int, S_IRUGO);
+module_param_named(unmap_alignment, scsi_debug_unmap_alignment, int, S_IRUGO);
 
 MODULE_AUTHOR("Eric Youngdale + Douglas Gilbert");
 MODULE_DESCRIPTION("SCSI debug adapter driver");
@@ -2458,6 +2708,10 @@ MODULE_PARM_DESC(dix, "data integrity extensions mask (def=0)");
 MODULE_PARM_DESC(dif, "data integrity field type: 0-3 (def=0)");
 MODULE_PARM_DESC(guard, "protection checksum: 0=crc, 1=ip (def=0)");
 MODULE_PARM_DESC(ato, "application tag ownership: 0=disk 1=host (def=1)");
+MODULE_PARM_DESC(unmap_max_blocks, "max # of blocks can be unmapped in one cmd (def=0)");
+MODULE_PARM_DESC(unmap_max_desc, "max # of ranges that can be unmapped in one cmd (def=0)");
+MODULE_PARM_DESC(unmap_granularity, "thin provisioning granularity in blocks (def=0)");
+MODULE_PARM_DESC(unmap_alignment, "lowest aligned thin provisioning lba (def=0)");
 
 static char sdebug_info[256];
 
@@ -2816,6 +3070,23 @@ static ssize_t sdebug_ato_show(struct device_driver *ddp, char *buf)
 }
 DRIVER_ATTR(ato, S_IRUGO, sdebug_ato_show, NULL);
 
+static ssize_t sdebug_map_show(struct device_driver *ddp, char *buf)
+{
+	ssize_t count;
+
+	if (scsi_debug_unmap_granularity == 0)
+		return scnprintf(buf, PAGE_SIZE, "0-%u\n",
+				 sdebug_store_sectors);
+
+	count = bitmap_scnlistprintf(buf, PAGE_SIZE, map_storep, map_size);
+
+	buf[count++] = '\n';
+	buf[count++] = 0;
+
+	return count;
+}
+DRIVER_ATTR(map, S_IRUGO, sdebug_map_show, NULL);
+
 
 /* Note: The following function creates attribute files in the
    /sys/bus/pseudo/drivers/scsi_debug directory. The advantage of these
@@ -2847,11 +3118,13 @@ static int do_create_driverfs_files(void)
 	ret |= driver_create_file(&sdebug_driverfs_driver, &driver_attr_dif);
 	ret |= driver_create_file(&sdebug_driverfs_driver, &driver_attr_guard);
 	ret |= driver_create_file(&sdebug_driverfs_driver, &driver_attr_ato);
+	ret |= driver_create_file(&sdebug_driverfs_driver, &driver_attr_map);
 	return ret;
 }
 
 static void do_remove_driverfs_files(void)
 {
+	driver_remove_file(&sdebug_driverfs_driver, &driver_attr_map);
 	driver_remove_file(&sdebug_driverfs_driver, &driver_attr_ato);
 	driver_remove_file(&sdebug_driverfs_driver, &driver_attr_guard);
 	driver_remove_file(&sdebug_driverfs_driver, &driver_attr_dif);
@@ -2989,6 +3262,36 @@ static int __init scsi_debug_init(void)
 		memset(dif_storep, 0xff, dif_size);
 	}
 
+	if (scsi_debug_unmap_granularity) {
+		unsigned int map_bytes;
+
+		if (scsi_debug_unmap_granularity < scsi_debug_unmap_alignment) {
+			printk(KERN_ERR
+			       "%s: ERR: unmap_granularity < unmap_alignment\n",
+			       __func__);
+			return -EINVAL;
+		}
+
+		map_size = (sdebug_store_sectors / scsi_debug_unmap_granularity);
+		map_bytes = map_size >> 3;
+		map_storep = vmalloc(map_bytes);
+
+		printk(KERN_INFO "scsi_debug_init: %lu provisioning blocks\n",
+		       map_size);
+
+		if (map_storep == NULL) {
+			printk(KERN_ERR "scsi_debug_init: out of mem. (MAP)\n");
+			ret = -ENOMEM;
+			goto free_vm;
+		}
+
+		memset(map_storep, 0x0, map_bytes);
+
+		/* Map first 1KB for partition table */
+		if (scsi_debug_num_parts)
+			map_region(0, 2);
+	}
+
 	ret = device_register(&pseudo_primary);
 	if (ret < 0) {
 		printk(KERN_WARNING "scsi_debug: device_register error: %d\n",
@@ -3041,6 +3344,8 @@ bus_unreg:
 dev_unreg:
 	device_unregister(&pseudo_primary);
 free_vm:
+	if (map_storep)
+		vfree(map_storep);
 	if (dif_storep)
 		vfree(dif_storep);
 	vfree(fake_storep);
@@ -3167,6 +3472,7 @@ int scsi_debug_queuecommand(struct scsi_cmnd *SCpnt, done_funct_t done)
 	int inj_dif = 0;
 	int inj_dix = 0;
 	int delay_override = 0;
+	int unmap = 0;
 
 	scsi_set_resid(SCpnt, 0);
 	if ((SCSI_DEBUG_OPT_NOISE & scsi_debug_opts) && cmd) {
@@ -3272,13 +3578,21 @@ int scsi_debug_queuecommand(struct scsi_cmnd *SCpnt, done_funct_t done)
 		errsts = resp_readcap(SCpnt, devip);
 		break;
 	case SERVICE_ACTION_IN:
-		if (SAI_READ_CAPACITY_16 != cmd[1]) {
+		if (cmd[1] == SAI_READ_CAPACITY_16)
+			errsts = resp_readcap16(SCpnt, devip);
+		else if (cmd[1] == SAI_GET_LBA_STATUS) {
+
+			if (scsi_debug_unmap_max_desc == 0) {
+				mk_sense_buffer(devip, ILLEGAL_REQUEST,
+						INVALID_COMMAND_OPCODE, 0);
+				errsts = check_condition_result;
+			} else
+				errsts = resp_get_lba_status(SCpnt, devip);
+		} else {
 			mk_sense_buffer(devip, ILLEGAL_REQUEST,
 					INVALID_OPCODE, 0);
 			errsts = check_condition_result;
-			break;
 		}
-		errsts = resp_readcap16(SCpnt, devip);
 		break;
 	case MAINTENANCE_IN:
 		if (MI_REPORT_TARGET_PGS != cmd[1]) {
@@ -3378,6 +3692,29 @@ write:
 			errsts = illegal_condition_result;
 		}
 		break;
+	case WRITE_SAME_16:
+		if (cmd[1] & 0x8)
+			unmap = 1;
+		/* fall through */
+	case WRITE_SAME:
+		errsts = check_readiness(SCpnt, 0, devip);
+		if (errsts)
+			break;
+		get_data_transfer_info(cmd, &lba, &num, &ei_lba);
+		errsts = resp_write_same(SCpnt, lba, num, devip, ei_lba, unmap);
+		break;
+	case UNMAP:
+		errsts = check_readiness(SCpnt, 0, devip);
+		if (errsts)
+			break;
+
+		if (scsi_debug_unmap_max_desc == 0) {
+			mk_sense_buffer(devip, ILLEGAL_REQUEST,
+					INVALID_COMMAND_OPCODE, 0);
+			errsts = check_condition_result;
+		} else
+			errsts = resp_unmap(SCpnt, devip);
+		break;
 	case MODE_SENSE:
 	case MODE_SENSE_10:
 		errsts = resp_mode_sense(SCpnt, target, devip);
diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
index 93c2622cb969..37af178b2d17 100644
--- a/drivers/scsi/scsi_devinfo.c
+++ b/drivers/scsi/scsi_devinfo.c
@@ -168,11 +168,10 @@ static struct {
 	{"Generic", "USB SD Reader", "1.00", BLIST_FORCELUN | BLIST_INQUIRY_36},
 	{"Generic", "USB Storage-SMC", "0180", BLIST_FORCELUN | BLIST_INQUIRY_36},
 	{"Generic", "USB Storage-SMC", "0207", BLIST_FORCELUN | BLIST_INQUIRY_36},
-	{"HITACHI", "DF400", "*", BLIST_SPARSELUN},
-	{"HITACHI", "DF500", "*", BLIST_SPARSELUN},
-	{"HITACHI", "DF600", "*", BLIST_SPARSELUN},
-	{"HITACHI", "DISK-SUBSYSTEM", "*", BLIST_ATTACH_PQ3 | BLIST_SPARSELUN | BLIST_LARGELUN},
-	{"HITACHI", "OPEN-E", "*", BLIST_ATTACH_PQ3 | BLIST_SPARSELUN | BLIST_LARGELUN},
+	{"HITACHI", "DF400", "*", BLIST_REPORTLUN2},
+	{"HITACHI", "DF500", "*", BLIST_REPORTLUN2},
+	{"HITACHI", "DISK-SUBSYSTEM", "*", BLIST_REPORTLUN2},
+	{"HITACHI", "OPEN-", "*", BLIST_REPORTLUN2},
 	{"HITACHI", "OP-C-", "*", BLIST_SPARSELUN | BLIST_LARGELUN},
 	{"HITACHI", "3380-", "*", BLIST_SPARSELUN | BLIST_LARGELUN},
 	{"HITACHI", "3390-", "*", BLIST_SPARSELUN | BLIST_LARGELUN},
@@ -454,7 +453,7 @@ int scsi_get_device_flags(struct scsi_device *sdev,
 
 
 /**
- * get_device_flags_keyed - get device specific flags from the dynamic device list.
+ * scsi_get_device_flags_keyed - get device specific flags from the dynamic device list
  * @sdev:       &scsi_device to get flags for
  * @vendor:	vendor name
  * @model:	model name
@@ -685,7 +684,7 @@ MODULE_PARM_DESC(default_dev_flags,
 		 "scsi default device flag integer value");
 
 /**
- * scsi_dev_info_list_delete - called from scsi.c:exit_scsi to remove the scsi_dev_info_list.
+ * scsi_exit_devinfo - remove /proc/scsi/device_info & the scsi_dev_info_list
  **/
 void scsi_exit_devinfo(void)
 {
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index 1b0060b791e8..08ed506e6059 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -331,6 +331,64 @@ static int scsi_check_sense(struct scsi_cmnd *scmd)
 	}
 }
 
+static void scsi_handle_queue_ramp_up(struct scsi_device *sdev)
+{
+	struct scsi_host_template *sht = sdev->host->hostt;
+	struct scsi_device *tmp_sdev;
+
+	if (!sht->change_queue_depth ||
+	    sdev->queue_depth >= sdev->max_queue_depth)
+		return;
+
+	if (time_before(jiffies,
+	    sdev->last_queue_ramp_up + sdev->queue_ramp_up_period))
+		return;
+
+	if (time_before(jiffies,
+	    sdev->last_queue_full_time + sdev->queue_ramp_up_period))
+		return;
+
+	/*
+	 * Walk all devices of a target and do
+	 * ramp up on them.
+	 */
+	shost_for_each_device(tmp_sdev, sdev->host) {
+		if (tmp_sdev->channel != sdev->channel ||
+		    tmp_sdev->id != sdev->id ||
+		    tmp_sdev->queue_depth == sdev->max_queue_depth)
+			continue;
+		/*
+		 * call back into LLD to increase queue_depth by one
+		 * with ramp up reason code.
+		 */
+		sht->change_queue_depth(tmp_sdev, tmp_sdev->queue_depth + 1,
+					SCSI_QDEPTH_RAMP_UP);
+		sdev->last_queue_ramp_up = jiffies;
+	}
+}
+
+static void scsi_handle_queue_full(struct scsi_device *sdev)
+{
+	struct scsi_host_template *sht = sdev->host->hostt;
+	struct scsi_device *tmp_sdev;
+
+	if (!sht->change_queue_depth)
+		return;
+
+	shost_for_each_device(tmp_sdev, sdev->host) {
+		if (tmp_sdev->channel != sdev->channel ||
+		    tmp_sdev->id != sdev->id)
+			continue;
+		/*
+		 * We do not know the number of commands that were at
+		 * the device when we got the queue full so we start
+		 * from the highest possible value and work our way down.
+		 */
+		sht->change_queue_depth(tmp_sdev, tmp_sdev->queue_depth - 1,
+					SCSI_QDEPTH_QFULL);
+	}
+}
+
 /**
  * scsi_eh_completed_normally - Disposition a eh cmd on return from LLD.
  * @scmd:	SCSI cmd to examine.
@@ -371,6 +429,7 @@ static int scsi_eh_completed_normally(struct scsi_cmnd *scmd)
 	 */
 	switch (status_byte(scmd->result)) {
 	case GOOD:
+		scsi_handle_queue_ramp_up(scmd->device);
 	case COMMAND_TERMINATED:
 		return SUCCESS;
 	case CHECK_CONDITION:
@@ -387,8 +446,10 @@ static int scsi_eh_completed_normally(struct scsi_cmnd *scmd)
 		 * let issuer deal with this, it could be just fine
 		 */
 		return SUCCESS;
-	case BUSY:
 	case QUEUE_FULL:
+		scsi_handle_queue_full(scmd->device);
+		/* fall through */
+	case BUSY:
 	default:
 		return FAILED;
 	}
@@ -1387,6 +1448,7 @@ int scsi_decide_disposition(struct scsi_cmnd *scmd)
 	 */
 	switch (status_byte(scmd->result)) {
 	case QUEUE_FULL:
+		scsi_handle_queue_full(scmd->device);
 		/*
 		 * the case of trying to send too many commands to a
 		 * tagged queueing device.
@@ -1400,6 +1462,7 @@ int scsi_decide_disposition(struct scsi_cmnd *scmd)
 		 */
 		return ADD_TO_MLQUEUE;
 	case GOOD:
+		scsi_handle_queue_ramp_up(scmd->device);
 	case COMMAND_TERMINATED:
 		return SUCCESS;
 	case TASK_ABORTED:
diff --git a/drivers/scsi/scsi_ioctl.c b/drivers/scsi/scsi_ioctl.c
index b98f763931c5..d9564fb04f62 100644
--- a/drivers/scsi/scsi_ioctl.c
+++ b/drivers/scsi/scsi_ioctl.c
@@ -308,6 +308,9 @@ int scsi_nonblockable_ioctl(struct scsi_device *sdev, int cmd,
 		case SG_SCSI_RESET_DEVICE:
 			val = SCSI_TRY_RESET_DEVICE;
 			break;
+		case SG_SCSI_RESET_TARGET:
+			val = SCSI_TRY_RESET_TARGET;
+			break;
 		case SG_SCSI_RESET_BUS:
 			val = SCSI_TRY_RESET_BUS;
 			break;
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 5987da857103..d8927681ec88 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -859,6 +859,7 @@ void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes)
 				case 0x07: /* operation in progress */
 				case 0x08: /* Long write in progress */
 				case 0x09: /* self test in progress */
+				case 0x14: /* space allocation in progress */
 					action = ACTION_DELAYED_RETRY;
 					break;
 				default:
@@ -898,7 +899,7 @@ void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes)
 				scsi_print_sense("", cmd);
 			scsi_print_command(cmd);
 		}
-		if (blk_end_request_err(req, -EIO))
+		if (blk_end_request_err(req, error))
 			scsi_requeue_command(q, cmd);
 		else
 			scsi_next_command(cmd);
@@ -1359,9 +1360,9 @@ static int scsi_lld_busy(struct request_queue *q)
 static void scsi_kill_request(struct request *req, struct request_queue *q)
 {
 	struct scsi_cmnd *cmd = req->special;
-	struct scsi_device *sdev = cmd->device;
-	struct scsi_target *starget = scsi_target(sdev);
-	struct Scsi_Host *shost = sdev->host;
+	struct scsi_device *sdev;
+	struct scsi_target *starget;
+	struct Scsi_Host *shost;
 
 	blk_start_request(req);
 
@@ -1371,6 +1372,9 @@ static void scsi_kill_request(struct request *req, struct request_queue *q)
 		BUG();
 	}
 
+	sdev = cmd->device;
+	starget = scsi_target(sdev);
+	shost = sdev->host;
 	scsi_init_cmd_errh(cmd);
 	cmd->result = DID_NO_CONNECT << 16;
 	atomic_inc(&cmd->device->iorequest_cnt);
diff --git a/drivers/scsi/scsi_lib_dma.c b/drivers/scsi/scsi_lib_dma.c
index ac6855cd2657..dcd128583b89 100644
--- a/drivers/scsi/scsi_lib_dma.c
+++ b/drivers/scsi/scsi_lib_dma.c
@@ -23,7 +23,7 @@ int scsi_dma_map(struct scsi_cmnd *cmd)
 	int nseg = 0;
 
 	if (scsi_sg_count(cmd)) {
-		struct device *dev = cmd->device->host->shost_gendev.parent;
+		struct device *dev = cmd->device->host->dma_dev;
 
 		nseg = dma_map_sg(dev, scsi_sglist(cmd), scsi_sg_count(cmd),
 				  cmd->sc_data_direction);
@@ -41,7 +41,7 @@ EXPORT_SYMBOL(scsi_dma_map);
 void scsi_dma_unmap(struct scsi_cmnd *cmd)
 {
 	if (scsi_sg_count(cmd)) {
-		struct device *dev = cmd->device->host->shost_gendev.parent;
+		struct device *dev = cmd->device->host->dma_dev;
 
 		dma_unmap_sg(dev, scsi_sglist(cmd), scsi_sg_count(cmd),
 			     cmd->sc_data_direction);
diff --git a/drivers/scsi/scsi_netlink.c b/drivers/scsi/scsi_netlink.c
index 723fdecd91bd..0fd6ae6911ad 100644
--- a/drivers/scsi/scsi_netlink.c
+++ b/drivers/scsi/scsi_netlink.c
@@ -613,7 +613,7 @@ EXPORT_SYMBOL_GPL(scsi_nl_send_transport_msg);
  * @data_buf:		pointer to vendor unique data buffer
  *
  * Returns:
- *   0 on succesful return
+ *   0 on successful return
  *   otherwise, failing error code
  *
  * Notes:
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index 47291bcff0d5..012f73a96880 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -251,6 +251,7 @@ static struct scsi_device *scsi_alloc_sdev(struct scsi_target *starget,
 	sdev->model = scsi_null_device_strs;
 	sdev->rev = scsi_null_device_strs;
 	sdev->host = shost;
+	sdev->queue_ramp_up_period = SCSI_DEFAULT_RAMP_UP_PERIOD;
 	sdev->id = starget->id;
 	sdev->lun = lun;
 	sdev->channel = starget->channel;
@@ -941,6 +942,8 @@ static int scsi_add_lun(struct scsi_device *sdev, unsigned char *inq_result,
 		}
 	}
 
+	sdev->max_queue_depth = sdev->queue_depth;
+
 	/*
 	 * Ok, the device is now all set up, we can
 	 * register it and tell the rest of the kernel
diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
index 392d8db33905..5a065055e68a 100644
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -766,10 +766,13 @@ sdev_store_queue_depth_rw(struct device *dev, struct device_attribute *attr,
 	if (depth < 1)
 		return -EINVAL;
 
-	retval = sht->change_queue_depth(sdev, depth);
+	retval = sht->change_queue_depth(sdev, depth,
+					 SCSI_QDEPTH_DEFAULT);
 	if (retval < 0)
 		return retval;
 
+	sdev->max_queue_depth = sdev->queue_depth;
+
 	return count;
 }
 
@@ -778,6 +781,37 @@ static struct device_attribute sdev_attr_queue_depth_rw =
 	       sdev_store_queue_depth_rw);
 
 static ssize_t
+sdev_show_queue_ramp_up_period(struct device *dev,
+			       struct device_attribute *attr,
+			       char *buf)
+{
+	struct scsi_device *sdev;
+	sdev = to_scsi_device(dev);
+	return snprintf(buf, 20, "%u\n",
+			jiffies_to_msecs(sdev->queue_ramp_up_period));
+}
+
+static ssize_t
+sdev_store_queue_ramp_up_period(struct device *dev,
+				struct device_attribute *attr,
+				const char *buf, size_t count)
+{
+	struct scsi_device *sdev = to_scsi_device(dev);
+	unsigned long period;
+
+	if (strict_strtoul(buf, 10, &period))
+		return -EINVAL;
+
+	sdev->queue_ramp_up_period = msecs_to_jiffies(period);
+	return period;
+}
+
+static struct device_attribute sdev_attr_queue_ramp_up_period =
+	__ATTR(queue_ramp_up_period, S_IRUGO | S_IWUSR,
+	       sdev_show_queue_ramp_up_period,
+	       sdev_store_queue_ramp_up_period);
+
+static ssize_t
 sdev_store_queue_type_rw(struct device *dev, struct device_attribute *attr,
 			 const char *buf, size_t count)
 {
@@ -867,8 +901,12 @@ int scsi_sysfs_add_sdev(struct scsi_device *sdev)
 	sdev->is_visible = 1;
 
 	/* create queue files, which may be writable, depending on the host */
-	if (sdev->host->hostt->change_queue_depth)
-		error = device_create_file(&sdev->sdev_gendev, &sdev_attr_queue_depth_rw);
+	if (sdev->host->hostt->change_queue_depth) {
+		error = device_create_file(&sdev->sdev_gendev,
+					   &sdev_attr_queue_depth_rw);
+		error = device_create_file(&sdev->sdev_gendev,
+					   &sdev_attr_queue_ramp_up_period);
+	}
 	else
 		error = device_create_file(&sdev->sdev_gendev, &dev_attr_queue_depth);
 	if (error)
diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
index c6f70dae9b2e..ddfcecd5099f 100644
--- a/drivers/scsi/scsi_transport_fc.c
+++ b/drivers/scsi/scsi_transport_fc.c
@@ -27,6 +27,7 @@
  */
 #include <linux/module.h>
 #include <linux/init.h>
+#include <linux/delay.h>
 #include <scsi/scsi_device.h>
 #include <scsi/scsi_host.h>
 #include <scsi/scsi_transport.h>
@@ -648,11 +649,22 @@ static __init int fc_transport_init(void)
 		return error;
 	error = transport_class_register(&fc_vport_class);
 	if (error)
-		return error;
+		goto unreg_host_class;
 	error = transport_class_register(&fc_rport_class);
 	if (error)
-		return error;
-	return transport_class_register(&fc_transport_class);
+		goto unreg_vport_class;
+	error = transport_class_register(&fc_transport_class);
+	if (error)
+		goto unreg_rport_class;
+	return 0;
+
+unreg_rport_class:
+	transport_class_unregister(&fc_rport_class);
+unreg_vport_class:
+	transport_class_unregister(&fc_vport_class);
+unreg_host_class:
+	transport_class_unregister(&fc_host_class);
+	return error;
 }
 
 static void __exit fc_transport_exit(void)
@@ -2384,6 +2396,7 @@ fc_rport_final_delete(struct work_struct *work)
 	struct Scsi_Host *shost = rport_to_shost(rport);
 	struct fc_internal *i = to_fc_internal(shost->transportt);
 	unsigned long flags;
+	int do_callback = 0;
 
 	/*
 	 * if a scan is pending, flush the SCSI Host work_q so that
@@ -2422,8 +2435,15 @@ fc_rport_final_delete(struct work_struct *work)
 	 * Avoid this call if we already called it when we preserved the
 	 * rport for the binding.
 	 */
+	spin_lock_irqsave(shost->host_lock, flags);
 	if (!(rport->flags & FC_RPORT_DEVLOSS_CALLBK_DONE) &&
-	    (i->f->dev_loss_tmo_callbk))
+	    (i->f->dev_loss_tmo_callbk)) {
+		rport->flags |= FC_RPORT_DEVLOSS_CALLBK_DONE;
+		do_callback = 1;
+	}
+	spin_unlock_irqrestore(shost->host_lock, flags);
+
+	if (do_callback)
 		i->f->dev_loss_tmo_callbk(rport);
 
 	fc_bsg_remove(rport->rqst_q);
@@ -2970,6 +2990,7 @@ fc_timeout_deleted_rport(struct work_struct *work)
 	struct fc_internal *i = to_fc_internal(shost->transportt);
 	struct fc_host_attrs *fc_host = shost_to_fc_host(shost);
 	unsigned long flags;
+	int do_callback = 0;
 
 	spin_lock_irqsave(shost->host_lock, flags);
 
@@ -3035,7 +3056,6 @@ fc_timeout_deleted_rport(struct work_struct *work)
 	rport->roles = FC_PORT_ROLE_UNKNOWN;
 	rport->port_state = FC_PORTSTATE_NOTPRESENT;
 	rport->flags &= ~FC_RPORT_FAST_FAIL_TIMEDOUT;
-	rport->flags |= FC_RPORT_DEVLOSS_CALLBK_DONE;
 
 	/*
 	 * Pre-emptively kill I/O rather than waiting for the work queue
@@ -3045,32 +3065,40 @@ fc_timeout_deleted_rport(struct work_struct *work)
 	spin_unlock_irqrestore(shost->host_lock, flags);
 	fc_terminate_rport_io(rport);
 
-	BUG_ON(rport->port_state != FC_PORTSTATE_NOTPRESENT);
+	spin_lock_irqsave(shost->host_lock, flags);
 
-	/* remove the identifiers that aren't used in the consisting binding */
-	switch (fc_host->tgtid_bind_type) {
-	case FC_TGTID_BIND_BY_WWPN:
-		rport->node_name = -1;
-		rport->port_id = -1;
-		break;
-	case FC_TGTID_BIND_BY_WWNN:
-		rport->port_name = -1;
-		rport->port_id = -1;
-		break;
-	case FC_TGTID_BIND_BY_ID:
-		rport->node_name = -1;
-		rport->port_name = -1;
-		break;
-	case FC_TGTID_BIND_NONE:	/* to keep compiler happy */
-		break;
+	if (rport->port_state == FC_PORTSTATE_NOTPRESENT) {	/* still missing */
+
+		/* remove the identifiers that aren't used in the consisting binding */
+		switch (fc_host->tgtid_bind_type) {
+		case FC_TGTID_BIND_BY_WWPN:
+			rport->node_name = -1;
+			rport->port_id = -1;
+			break;
+		case FC_TGTID_BIND_BY_WWNN:
+			rport->port_name = -1;
+			rport->port_id = -1;
+			break;
+		case FC_TGTID_BIND_BY_ID:
+			rport->node_name = -1;
+			rport->port_name = -1;
+			break;
+		case FC_TGTID_BIND_NONE:	/* to keep compiler happy */
+			break;
+		}
+
+		/*
+		 * As this only occurs if the remote port (scsi target)
+		 * went away and didn't come back - we'll remove
+		 * all attached scsi devices.
+		 */
+		rport->flags |= FC_RPORT_DEVLOSS_CALLBK_DONE;
+		fc_queue_work(shost, &rport->stgt_delete_work);
+
+		do_callback = 1;
 	}
 
-	/*
-	 * As this only occurs if the remote port (scsi target)
-	 * went away and didn't come back - we'll remove
-	 * all attached scsi devices.
-	 */
-	fc_queue_work(shost, &rport->stgt_delete_work);
+	spin_unlock_irqrestore(shost->host_lock, flags);
 
 	/*
 	 * Notify the driver that the rport is now dead. The LLDD will
@@ -3078,7 +3106,7 @@ fc_timeout_deleted_rport(struct work_struct *work)
 	 *
 	 * Note: we set the CALLBK_DONE flag above to correspond
 	 */
-	if (i->f->dev_loss_tmo_callbk)
+	if (do_callback && i->f->dev_loss_tmo_callbk)
 		i->f->dev_loss_tmo_callbk(rport);
 }
 
@@ -3128,6 +3156,31 @@ fc_scsi_scan_rport(struct work_struct *work)
 	spin_unlock_irqrestore(shost->host_lock, flags);
 }
 
+/**
+ * fc_block_scsi_eh - Block SCSI eh thread for blocked fc_rport
+ * @cmnd: SCSI command that scsi_eh is trying to recover
+ *
+ * This routine can be called from a FC LLD scsi_eh callback. It
+ * blocks the scsi_eh thread until the fc_rport leaves the
+ * FC_PORTSTATE_BLOCKED. This is necessary to avoid the scsi_eh
+ * failing recovery actions for blocked rports which would lead to
+ * offlined SCSI devices.
+ */
+void fc_block_scsi_eh(struct scsi_cmnd *cmnd)
+{
+	struct Scsi_Host *shost = cmnd->device->host;
+	struct fc_rport *rport = starget_to_rport(scsi_target(cmnd->device));
+	unsigned long flags;
+
+	spin_lock_irqsave(shost->host_lock, flags);
+	while (rport->port_state == FC_PORTSTATE_BLOCKED) {
+		spin_unlock_irqrestore(shost->host_lock, flags);
+		msleep(1000);
+		spin_lock_irqsave(shost->host_lock, flags);
+	}
+	spin_unlock_irqrestore(shost->host_lock, flags);
+}
+EXPORT_SYMBOL(fc_block_scsi_eh);
 
 /**
  * fc_vport_setup - allocates and creates a FC virtual port.
@@ -3769,8 +3822,9 @@ fc_bsg_request_handler(struct request_queue *q, struct Scsi_Host *shost,
 		return;
 
 	while (!blk_queue_plugged(q)) {
-		if (rport && (rport->port_state == FC_PORTSTATE_BLOCKED))
-				break;
+		if (rport && (rport->port_state == FC_PORTSTATE_BLOCKED) &&
+		    !(rport->flags & FC_RPORT_FAST_FAIL_TIMEDOUT))
+			break;
 
 		req = blk_fetch_request(q);
 		if (!req)
diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
index ad897df36615..ea3892e7e0f7 100644
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -30,7 +30,7 @@
 #include <scsi/scsi_transport_iscsi.h>
 #include <scsi/iscsi_if.h>
 
-#define ISCSI_SESSION_ATTRS 21
+#define ISCSI_SESSION_ATTRS 22
 #define ISCSI_CONN_ATTRS 13
 #define ISCSI_HOST_ATTRS 4
 
@@ -627,8 +627,10 @@ static void __iscsi_block_session(struct work_struct *work)
 	spin_unlock_irqrestore(&session->lock, flags);
 	scsi_target_block(&session->dev);
 	ISCSI_DBG_TRANS_SESSION(session, "Completed SCSI target blocking\n");
-	queue_delayed_work(iscsi_eh_timer_workq, &session->recovery_work,
-			   session->recovery_tmo * HZ);
+	if (session->recovery_tmo >= 0)
+		queue_delayed_work(iscsi_eh_timer_workq,
+				   &session->recovery_work,
+				   session->recovery_tmo * HZ);
 }
 
 void iscsi_block_session(struct iscsi_cls_session *session)
@@ -1348,8 +1350,7 @@ iscsi_set_param(struct iscsi_transport *transport, struct iscsi_uevent *ev)
 	switch (ev->u.set_param.param) {
 	case ISCSI_PARAM_SESS_RECOVERY_TMO:
 		sscanf(data, "%d", &value);
-		if (value != 0)
-			session->recovery_tmo = value;
+		session->recovery_tmo = value;
 		break;
 	default:
 		err = transport->set_param(conn, ev->u.set_param.param,
@@ -1759,6 +1760,7 @@ iscsi_session_attr(password_in, ISCSI_PARAM_PASSWORD_IN, 1);
 iscsi_session_attr(fast_abort, ISCSI_PARAM_FAST_ABORT, 0);
 iscsi_session_attr(abort_tmo, ISCSI_PARAM_ABORT_TMO, 0);
 iscsi_session_attr(lu_reset_tmo, ISCSI_PARAM_LU_RESET_TMO, 0);
+iscsi_session_attr(tgt_reset_tmo, ISCSI_PARAM_TGT_RESET_TMO, 0);
 iscsi_session_attr(ifacename, ISCSI_PARAM_IFACE_NAME, 0);
 iscsi_session_attr(initiatorname, ISCSI_PARAM_INITIATOR_NAME, 0)
 
@@ -2000,6 +2002,7 @@ iscsi_register_transport(struct iscsi_transport *tt)
 	SETUP_SESSION_RD_ATTR(fast_abort, ISCSI_FAST_ABORT);
 	SETUP_SESSION_RD_ATTR(abort_tmo, ISCSI_ABORT_TMO);
 	SETUP_SESSION_RD_ATTR(lu_reset_tmo,ISCSI_LU_RESET_TMO);
+	SETUP_SESSION_RD_ATTR(tgt_reset_tmo,ISCSI_TGT_RESET_TMO);
 	SETUP_SESSION_RD_ATTR(ifacename, ISCSI_IFACE_NAME);
 	SETUP_SESSION_RD_ATTR(initiatorname, ISCSI_INITIATOR_NAME);
 	SETUP_PRIV_SESSION_RD_ATTR(recovery_tmo);
diff --git a/drivers/scsi/scsi_transport_sas.c b/drivers/scsi/scsi_transport_sas.c
index fd47cb1bee1b..f27e52d963d3 100644
--- a/drivers/scsi/scsi_transport_sas.c
+++ b/drivers/scsi/scsi_transport_sas.c
@@ -666,7 +666,7 @@ EXPORT_SYMBOL(sas_phy_add);
  *
  * Note:
  *   This function must only be called on a PHY that has not
- *   sucessfully been added using sas_phy_add().
+ *   successfully been added using sas_phy_add().
  */
 void sas_phy_free(struct sas_phy *phy)
 {
@@ -896,7 +896,7 @@ EXPORT_SYMBOL(sas_port_add);
  *
  * Note:
  *   This function must only be called on a PORT that has not
- *   sucessfully been added using sas_port_add().
+ *   successfully been added using sas_port_add().
  */
 void sas_port_free(struct sas_port *port)
 {
@@ -1476,7 +1476,7 @@ EXPORT_SYMBOL(sas_rphy_add);
  *
  * Note:
  *   This function must only be called on a remote
- *   PHY that has not sucessfully been added using
+ *   PHY that has not successfully been added using
  *   sas_rphy_add() (or has been sas_rphy_remove()'d)
  */
 void sas_rphy_free(struct sas_rphy *rphy)
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index 9093c7261f33..255da53e5a01 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -264,6 +264,15 @@ sd_show_app_tag_own(struct device *dev, struct device_attribute *attr,
 	return snprintf(buf, 20, "%u\n", sdkp->ATO);
 }
 
+static ssize_t
+sd_show_thin_provisioning(struct device *dev, struct device_attribute *attr,
+			  char *buf)
+{
+	struct scsi_disk *sdkp = to_scsi_disk(dev);
+
+	return snprintf(buf, 20, "%u\n", sdkp->thin_provisioning);
+}
+
 static struct device_attribute sd_disk_attrs[] = {
 	__ATTR(cache_type, S_IRUGO|S_IWUSR, sd_show_cache_type,
 	       sd_store_cache_type),
@@ -274,6 +283,7 @@ static struct device_attribute sd_disk_attrs[] = {
 	       sd_store_manage_start_stop),
 	__ATTR(protection_type, S_IRUGO, sd_show_protection_type, NULL),
 	__ATTR(app_tag_own, S_IRUGO, sd_show_app_tag_own, NULL),
+	__ATTR(thin_provisioning, S_IRUGO, sd_show_thin_provisioning, NULL),
 	__ATTR_NULL,
 };
 
@@ -399,6 +409,57 @@ static void sd_prot_op(struct scsi_cmnd *scmd, unsigned int dif)
 }
 
 /**
+ * sd_prepare_discard - unmap blocks on thinly provisioned device
+ * @rq: Request to prepare
+ *
+ * Will issue either UNMAP or WRITE SAME(16) depending on preference
+ * indicated by target device.
+ **/
+static int sd_prepare_discard(struct request *rq)
+{
+	struct scsi_disk *sdkp = scsi_disk(rq->rq_disk);
+	struct bio *bio = rq->bio;
+	sector_t sector = bio->bi_sector;
+	unsigned int num = bio_sectors(bio);
+
+	if (sdkp->device->sector_size == 4096) {
+		sector >>= 3;
+		num >>= 3;
+	}
+
+	rq->cmd_type = REQ_TYPE_BLOCK_PC;
+	rq->timeout = SD_TIMEOUT;
+
+	memset(rq->cmd, 0, rq->cmd_len);
+
+	if (sdkp->unmap) {
+		char *buf = kmap_atomic(bio_page(bio), KM_USER0);
+
+		rq->cmd[0] = UNMAP;
+		rq->cmd[8] = 24;
+		rq->cmd_len = 10;
+
+		/* Ensure that data length matches payload */
+		rq->__data_len = bio->bi_size = bio->bi_io_vec->bv_len = 24;
+
+		put_unaligned_be16(6 + 16, &buf[0]);
+		put_unaligned_be16(16, &buf[2]);
+		put_unaligned_be64(sector, &buf[8]);
+		put_unaligned_be32(num, &buf[16]);
+
+		kunmap_atomic(buf, KM_USER0);
+	} else {
+		rq->cmd[0] = WRITE_SAME_16;
+		rq->cmd[1] = 0x8; /* UNMAP */
+		put_unaligned_be64(sector, &rq->cmd[2]);
+		put_unaligned_be32(num, &rq->cmd[10]);
+		rq->cmd_len = 16;
+	}
+
+	return BLKPREP_OK;
+}
+
+/**
  *	sd_init_command - build a scsi (read or write) command from
  *	information in the request structure.
  *	@SCpnt: pointer to mid-level's per scsi command structure that
@@ -418,6 +479,13 @@ static int sd_prep_fn(struct request_queue *q, struct request *rq)
 	int ret, host_dif;
 	unsigned char protect;
 
+	/*
+	 * Discard request come in as REQ_TYPE_FS but we turn them into
+	 * block PC requests to make life easier.
+	 */
+	if (blk_discard_rq(rq))
+		ret = sd_prepare_discard(rq);
+
 	if (rq->cmd_type == REQ_TYPE_BLOCK_PC) {
 		ret = scsi_setup_blk_pc_cmnd(sdp, rq);
 		goto out;
@@ -1432,6 +1500,19 @@ static int read_capacity_16(struct scsi_disk *sdkp, struct scsi_device *sdp,
 		sd_printk(KERN_NOTICE, sdkp,
 			  "physical block alignment offset: %u\n", alignment);
 
+	if (buffer[14] & 0x80) { /* TPE */
+		struct request_queue *q = sdp->request_queue;
+
+		sdkp->thin_provisioning = 1;
+		q->limits.discard_granularity = sdkp->hw_sector_size;
+		q->limits.max_discard_sectors = 0xffffffff;
+
+		if (buffer[14] & 0x40) /* TPRZ */
+			q->limits.discard_zeroes_data = 1;
+
+		queue_flag_set_unlocked(QUEUE_FLAG_DISCARD, q);
+	}
+
 	sdkp->capacity = lba + 1;
 	return sector_size;
 }
@@ -1863,6 +1944,7 @@ void sd_read_app_tag_own(struct scsi_disk *sdkp, unsigned char *buffer)
  */
 static void sd_read_block_limits(struct scsi_disk *sdkp)
 {
+	struct request_queue *q = sdkp->disk->queue;
 	unsigned int sector_sz = sdkp->device->sector_size;
 	char *buffer;
 
@@ -1877,6 +1959,31 @@ static void sd_read_block_limits(struct scsi_disk *sdkp)
 	blk_queue_io_opt(sdkp->disk->queue,
 			 get_unaligned_be32(&buffer[12]) * sector_sz);
 
+	/* Thin provisioning enabled and page length indicates TP support */
+	if (sdkp->thin_provisioning && buffer[3] == 0x3c) {
+		unsigned int lba_count, desc_count, granularity;
+
+		lba_count = get_unaligned_be32(&buffer[20]);
+		desc_count = get_unaligned_be32(&buffer[24]);
+
+		if (lba_count) {
+			q->limits.max_discard_sectors =
+				lba_count * sector_sz >> 9;
+
+			if (desc_count)
+				sdkp->unmap = 1;
+		}
+
+		granularity = get_unaligned_be32(&buffer[28]);
+
+		if (granularity)
+			q->limits.discard_granularity = granularity * sector_sz;
+
+		if (buffer[32] & 0x80)
+			q->limits.discard_alignment =
+				get_unaligned_be32(&buffer[32]) & ~(1 << 31);
+	}
+
 	kfree(buffer);
 }
 
diff --git a/drivers/scsi/sd.h b/drivers/scsi/sd.h
index e374804d26fb..43d3caf268ef 100644
--- a/drivers/scsi/sd.h
+++ b/drivers/scsi/sd.h
@@ -60,6 +60,8 @@ struct scsi_disk {
 	unsigned	RCD : 1;	/* state of disk RCD bit, unused */
 	unsigned	DPOFUA : 1;	/* state of disk DPOFUA bit */
 	unsigned	first_scan : 1;
+	unsigned	thin_provisioning : 1;
+	unsigned	unmap : 1;
 };
 #define to_scsi_disk(obj) container_of(obj,struct scsi_disk,dev)
 
diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
index 12d58a7ed6bc..d04ea9a6f673 100644
--- a/drivers/scsi/st.c
+++ b/drivers/scsi/st.c
@@ -552,13 +552,15 @@ st_do_scsi(struct st_request * SRpnt, struct scsi_tape * STp, unsigned char *cmd
 	SRpnt->waiting = waiting;
 
 	if (STp->buffer->do_dio) {
+		mdata->page_order = 0;
 		mdata->nr_entries = STp->buffer->sg_segs;
 		mdata->pages = STp->buffer->mapped_pages;
 	} else {
+		mdata->page_order = STp->buffer->reserved_page_order;
 		mdata->nr_entries =
 			DIV_ROUND_UP(bytes, PAGE_SIZE << mdata->page_order);
-		STp->buffer->map_data.pages = STp->buffer->reserved_pages;
-		STp->buffer->map_data.offset = 0;
+		mdata->pages = STp->buffer->reserved_pages;
+		mdata->offset = 0;
 	}
 
 	memcpy(SRpnt->cmd, cmd, sizeof(SRpnt->cmd));
@@ -2280,7 +2282,8 @@ static int st_set_options(struct scsi_tape *STp, long options)
 	} else if (code == MT_ST_SET_CLN) {
 		value = (options & ~MT_ST_OPTIONS) & 0xff;
 		if (value != 0 &&
-		    value < EXTENDED_SENSE_START && value >= SCSI_SENSE_BUFFERSIZE)
+			(value < EXTENDED_SENSE_START ||
+				value >= SCSI_SENSE_BUFFERSIZE))
 			return (-EINVAL);
 		STp->cln_mode = value;
 		STp->cln_sense_mask = (options >> 8) & 0xff;
@@ -3718,7 +3721,7 @@ static int enlarge_buffer(struct st_buffer * STbuffer, int new_size, int need_dm
 		priority |= __GFP_ZERO;
 
 	if (STbuffer->frp_segs) {
-		order = STbuffer->map_data.page_order;
+		order = STbuffer->reserved_page_order;
 		b_size = PAGE_SIZE << order;
 	} else {
 		for (b_size = PAGE_SIZE, order = 0;
@@ -3751,7 +3754,7 @@ static int enlarge_buffer(struct st_buffer * STbuffer, int new_size, int need_dm
 		segs++;
 	}
 	STbuffer->b_data = page_address(STbuffer->reserved_pages[0]);
-	STbuffer->map_data.page_order = order;
+	STbuffer->reserved_page_order = order;
 
 	return 1;
 }
@@ -3764,7 +3767,7 @@ static void clear_buffer(struct st_buffer * st_bp)
 
 	for (i=0; i < st_bp->frp_segs; i++)
 		memset(page_address(st_bp->reserved_pages[i]), 0,
-		       PAGE_SIZE << st_bp->map_data.page_order);
+		       PAGE_SIZE << st_bp->reserved_page_order);
 	st_bp->cleared = 1;
 }
 
@@ -3772,7 +3775,7 @@ static void clear_buffer(struct st_buffer * st_bp)
 /* Release the extra buffer */
 static void normalize_buffer(struct st_buffer * STbuffer)
 {
-	int i, order = STbuffer->map_data.page_order;
+	int i, order = STbuffer->reserved_page_order;
 
 	for (i = 0; i < STbuffer->frp_segs; i++) {
 		__free_pages(STbuffer->reserved_pages[i], order);
@@ -3780,7 +3783,7 @@ static void normalize_buffer(struct st_buffer * STbuffer)
 	}
 	STbuffer->frp_segs = 0;
 	STbuffer->sg_segs = 0;
-	STbuffer->map_data.page_order = 0;
+	STbuffer->reserved_page_order = 0;
 	STbuffer->map_data.offset = 0;
 }
 
@@ -3790,7 +3793,7 @@ static void normalize_buffer(struct st_buffer * STbuffer)
 static int append_to_buffer(const char __user *ubp, struct st_buffer * st_bp, int do_count)
 {
 	int i, cnt, res, offset;
-	int length = PAGE_SIZE << st_bp->map_data.page_order;
+	int length = PAGE_SIZE << st_bp->reserved_page_order;
 
 	for (i = 0, offset = st_bp->buffer_bytes;
 	     i < st_bp->frp_segs && offset >= length; i++)
@@ -3822,7 +3825,7 @@ static int append_to_buffer(const char __user *ubp, struct st_buffer * st_bp, in
 static int from_buffer(struct st_buffer * st_bp, char __user *ubp, int do_count)
 {
 	int i, cnt, res, offset;
-	int length = PAGE_SIZE << st_bp->map_data.page_order;
+	int length = PAGE_SIZE << st_bp->reserved_page_order;
 
 	for (i = 0, offset = st_bp->read_pointer;
 	     i < st_bp->frp_segs && offset >= length; i++)
@@ -3855,7 +3858,7 @@ static void move_buffer_data(struct st_buffer * st_bp, int offset)
 {
 	int src_seg, dst_seg, src_offset = 0, dst_offset;
 	int count, total;
-	int length = PAGE_SIZE << st_bp->map_data.page_order;
+	int length = PAGE_SIZE << st_bp->reserved_page_order;
 
 	if (offset == 0)
 		return;
@@ -4577,7 +4580,6 @@ static int sgl_map_user_pages(struct st_buffer *STbp,
         }
 
 	mdata->offset = uaddr & ~PAGE_MASK;
-	mdata->page_order = 0;
 	STbp->mapped_pages = pages;
 
 	return nr_pages;
diff --git a/drivers/scsi/st.h b/drivers/scsi/st.h
index 544dc6b1f548..f91a67c6d968 100644
--- a/drivers/scsi/st.h
+++ b/drivers/scsi/st.h
@@ -46,6 +46,7 @@ struct st_buffer {
 	struct st_request *last_SRpnt;
 	struct st_cmdstatus cmdstat;
 	struct page **reserved_pages;
+	int reserved_page_order;
 	struct page **mapped_pages;
 	struct rq_map_data map_data;
 	unsigned char *b_data;
diff --git a/drivers/scsi/stex.c b/drivers/scsi/stex.c
index 09fa8861fc58..fd7b15be7640 100644
--- a/drivers/scsi/stex.c
+++ b/drivers/scsi/stex.c
@@ -36,11 +36,11 @@
 #include <scsi/scsi_eh.h>
 
 #define DRV_NAME "stex"
-#define ST_DRIVER_VERSION "4.6.0000.3"
+#define ST_DRIVER_VERSION "4.6.0000.4"
 #define ST_VER_MAJOR		4
 #define ST_VER_MINOR		6
 #define ST_OEM			0
-#define ST_BUILD_VER		3
+#define ST_BUILD_VER		4
 
 enum {
 	/* MU register offset */
@@ -64,24 +64,24 @@ enum {
 	YH2I_REQ_HI				= 0xc4,
 
 	/* MU register value */
-	MU_INBOUND_DOORBELL_HANDSHAKE		= 1,
-	MU_INBOUND_DOORBELL_REQHEADCHANGED	= 2,
-	MU_INBOUND_DOORBELL_STATUSTAILCHANGED	= 4,
-	MU_INBOUND_DOORBELL_HMUSTOPPED		= 8,
-	MU_INBOUND_DOORBELL_RESET		= 16,
-
-	MU_OUTBOUND_DOORBELL_HANDSHAKE		= 1,
-	MU_OUTBOUND_DOORBELL_REQUESTTAILCHANGED	= 2,
-	MU_OUTBOUND_DOORBELL_STATUSHEADCHANGED	= 4,
-	MU_OUTBOUND_DOORBELL_BUSCHANGE		= 8,
-	MU_OUTBOUND_DOORBELL_HASEVENT		= 16,
+	MU_INBOUND_DOORBELL_HANDSHAKE		= (1 << 0),
+	MU_INBOUND_DOORBELL_REQHEADCHANGED	= (1 << 1),
+	MU_INBOUND_DOORBELL_STATUSTAILCHANGED	= (1 << 2),
+	MU_INBOUND_DOORBELL_HMUSTOPPED		= (1 << 3),
+	MU_INBOUND_DOORBELL_RESET		= (1 << 4),
+
+	MU_OUTBOUND_DOORBELL_HANDSHAKE		= (1 << 0),
+	MU_OUTBOUND_DOORBELL_REQUESTTAILCHANGED	= (1 << 1),
+	MU_OUTBOUND_DOORBELL_STATUSHEADCHANGED	= (1 << 2),
+	MU_OUTBOUND_DOORBELL_BUSCHANGE		= (1 << 3),
+	MU_OUTBOUND_DOORBELL_HASEVENT		= (1 << 4),
+	MU_OUTBOUND_DOORBELL_REQUEST_RESET	= (1 << 27),
 
 	/* MU status code */
 	MU_STATE_STARTING			= 1,
-	MU_STATE_FMU_READY_FOR_HANDSHAKE	= 2,
-	MU_STATE_SEND_HANDSHAKE_FRAME		= 3,
-	MU_STATE_STARTED			= 4,
-	MU_STATE_RESETTING			= 5,
+	MU_STATE_STARTED			= 2,
+	MU_STATE_RESETTING			= 3,
+	MU_STATE_FAILED				= 4,
 
 	MU_MAX_DELAY				= 120,
 	MU_HANDSHAKE_SIGNATURE			= 0x55aaaa55,
@@ -111,6 +111,8 @@ enum {
 
 	SS_H2I_INT_RESET			= 0x100,
 
+	SS_I2H_REQUEST_RESET			= 0x2000,
+
 	SS_MU_OPERATIONAL			= 0x80000000,
 
 	STEX_CDB_LENGTH				= 16,
@@ -160,6 +162,7 @@ enum {
 	INQUIRY_EVPD				= 0x01,
 
 	ST_ADDITIONAL_MEM			= 0x200000,
+	ST_ADDITIONAL_MEM_MIN			= 0x80000,
 };
 
 struct st_sgitem {
@@ -311,6 +314,10 @@ struct st_hba {
 	struct st_ccb *wait_ccb;
 	__le32 *scratch;
 
+	char work_q_name[20];
+	struct workqueue_struct *work_q;
+	struct work_struct reset_work;
+	wait_queue_head_t reset_waitq;
 	unsigned int mu_status;
 	unsigned int cardtype;
 	int msi_enabled;
@@ -577,6 +584,9 @@ stex_queuecommand(struct scsi_cmnd *cmd, void (* done)(struct scsi_cmnd *))
 	lun = cmd->device->lun;
 	hba = (struct st_hba *) &host->hostdata[0];
 
+	if (unlikely(hba->mu_status == MU_STATE_RESETTING))
+		return SCSI_MLQUEUE_HOST_BUSY;
+
 	switch (cmd->cmnd[0]) {
 	case MODE_SENSE_10:
 	{
@@ -613,6 +623,11 @@ stex_queuecommand(struct scsi_cmnd *cmd, void (* done)(struct scsi_cmnd *))
 		}
 		break;
 	case INQUIRY:
+		if (lun >= host->max_lun) {
+			cmd->result = DID_NO_CONNECT << 16;
+			done(cmd);
+			return 0;
+		}
 		if (id != host->max_id - 1)
 			break;
 		if (!lun && !cmd->device->channel &&
@@ -841,7 +856,6 @@ static irqreturn_t stex_intr(int irq, void *__hba)
 	void __iomem *base = hba->mmio_base;
 	u32 data;
 	unsigned long flags;
-	int handled = 0;
 
 	spin_lock_irqsave(hba->host->host_lock, flags);
 
@@ -852,12 +866,16 @@ static irqreturn_t stex_intr(int irq, void *__hba)
 		writel(data, base + ODBL);
 		readl(base + ODBL); /* flush */
 		stex_mu_intr(hba, data);
-		handled = 1;
+		spin_unlock_irqrestore(hba->host->host_lock, flags);
+		if (unlikely(data & MU_OUTBOUND_DOORBELL_REQUEST_RESET &&
+			hba->cardtype == st_shasta))
+			queue_work(hba->work_q, &hba->reset_work);
+		return IRQ_HANDLED;
 	}
 
 	spin_unlock_irqrestore(hba->host->host_lock, flags);
 
-	return IRQ_RETVAL(handled);
+	return IRQ_NONE;
 }
 
 static void stex_ss_mu_intr(struct st_hba *hba)
@@ -939,7 +957,6 @@ static irqreturn_t stex_ss_intr(int irq, void *__hba)
 	void __iomem *base = hba->mmio_base;
 	u32 data;
 	unsigned long flags;
-	int handled = 0;
 
 	spin_lock_irqsave(hba->host->host_lock, flags);
 
@@ -948,12 +965,15 @@ static irqreturn_t stex_ss_intr(int irq, void *__hba)
 		/* clear the interrupt */
 		writel(data, base + YI2H_INT_C);
 		stex_ss_mu_intr(hba);
-		handled = 1;
+		spin_unlock_irqrestore(hba->host->host_lock, flags);
+		if (unlikely(data & SS_I2H_REQUEST_RESET))
+			queue_work(hba->work_q, &hba->reset_work);
+		return IRQ_HANDLED;
 	}
 
 	spin_unlock_irqrestore(hba->host->host_lock, flags);
 
-	return IRQ_RETVAL(handled);
+	return IRQ_NONE;
 }
 
 static int stex_common_handshake(struct st_hba *hba)
@@ -1001,7 +1021,7 @@ static int stex_common_handshake(struct st_hba *hba)
 	h->partner_type = HMU_PARTNER_TYPE;
 	if (hba->extra_offset) {
 		h->extra_offset = cpu_to_le32(hba->extra_offset);
-		h->extra_size = cpu_to_le32(ST_ADDITIONAL_MEM);
+		h->extra_size = cpu_to_le32(hba->dma_size - hba->extra_offset);
 	} else
 		h->extra_offset = h->extra_size = 0;
 
@@ -1046,7 +1066,7 @@ static int stex_ss_handshake(struct st_hba *hba)
 	struct st_msg_header *msg_h;
 	struct handshake_frame *h;
 	__le32 *scratch;
-	u32 data;
+	u32 data, scratch_size;
 	unsigned long before;
 	int ret = 0;
 
@@ -1074,13 +1094,16 @@ static int stex_ss_handshake(struct st_hba *hba)
 	stex_gettime(&h->hosttime);
 	h->partner_type = HMU_PARTNER_TYPE;
 	h->extra_offset = h->extra_size = 0;
-	h->scratch_size = cpu_to_le32((hba->sts_count+1)*sizeof(u32));
+	scratch_size = (hba->sts_count+1)*sizeof(u32);
+	h->scratch_size = cpu_to_le32(scratch_size);
 
 	data = readl(base + YINT_EN);
 	data &= ~4;
 	writel(data, base + YINT_EN);
 	writel((hba->dma_handle >> 16) >> 16, base + YH2I_REQ_HI);
+	readl(base + YH2I_REQ_HI);
 	writel(hba->dma_handle, base + YH2I_REQ);
+	readl(base + YH2I_REQ); /* flush */
 
 	scratch = hba->scratch;
 	before = jiffies;
@@ -1096,7 +1119,7 @@ static int stex_ss_handshake(struct st_hba *hba)
 		msleep(1);
 	}
 
-	*scratch = 0;
+	memset(scratch, 0, scratch_size);
 	msg_h->flag = 0;
 	return ret;
 }
@@ -1105,19 +1128,24 @@ static int stex_handshake(struct st_hba *hba)
 {
 	int err;
 	unsigned long flags;
+	unsigned int mu_status;
 
 	err = (hba->cardtype == st_yel) ?
 		stex_ss_handshake(hba) : stex_common_handshake(hba);
+	spin_lock_irqsave(hba->host->host_lock, flags);
+	mu_status = hba->mu_status;
 	if (err == 0) {
-		spin_lock_irqsave(hba->host->host_lock, flags);
 		hba->req_head = 0;
 		hba->req_tail = 0;
 		hba->status_head = 0;
 		hba->status_tail = 0;
 		hba->out_req_cnt = 0;
 		hba->mu_status = MU_STATE_STARTED;
-		spin_unlock_irqrestore(hba->host->host_lock, flags);
-	}
+	} else
+		hba->mu_status = MU_STATE_FAILED;
+	if (mu_status == MU_STATE_RESETTING)
+		wake_up_all(&hba->reset_waitq);
+	spin_unlock_irqrestore(hba->host->host_lock, flags);
 	return err;
 }
 
@@ -1137,17 +1165,11 @@ static int stex_abort(struct scsi_cmnd *cmd)
 
 	base = hba->mmio_base;
 	spin_lock_irqsave(host->host_lock, flags);
-	if (tag < host->can_queue && hba->ccb[tag].cmd == cmd)
+	if (tag < host->can_queue &&
+		hba->ccb[tag].req && hba->ccb[tag].cmd == cmd)
 		hba->wait_ccb = &hba->ccb[tag];
-	else {
-		for (tag = 0; tag < host->can_queue; tag++)
-			if (hba->ccb[tag].cmd == cmd) {
-				hba->wait_ccb = &hba->ccb[tag];
-				break;
-			}
-		if (tag >= host->can_queue)
-			goto out;
-	}
+	else
+		goto out;
 
 	if (hba->cardtype == st_yel) {
 		data = readl(base + YI2H_INT);
@@ -1221,6 +1243,37 @@ static void stex_hard_reset(struct st_hba *hba)
 			hba->pdev->saved_config_space[i]);
 }
 
+static int stex_yos_reset(struct st_hba *hba)
+{
+	void __iomem *base;
+	unsigned long flags, before;
+	int ret = 0;
+
+	base = hba->mmio_base;
+	writel(MU_INBOUND_DOORBELL_RESET, base + IDBL);
+	readl(base + IDBL); /* flush */
+	before = jiffies;
+	while (hba->out_req_cnt > 0) {
+		if (time_after(jiffies, before + ST_INTERNAL_TIMEOUT * HZ)) {
+			printk(KERN_WARNING DRV_NAME
+				"(%s): reset timeout\n", pci_name(hba->pdev));
+			ret = -1;
+			break;
+		}
+		msleep(1);
+	}
+
+	spin_lock_irqsave(hba->host->host_lock, flags);
+	if (ret == -1)
+		hba->mu_status = MU_STATE_FAILED;
+	else
+		hba->mu_status = MU_STATE_STARTED;
+	wake_up_all(&hba->reset_waitq);
+	spin_unlock_irqrestore(hba->host->host_lock, flags);
+
+	return ret;
+}
+
 static void stex_ss_reset(struct st_hba *hba)
 {
 	writel(SS_H2I_INT_RESET, hba->mmio_base + YH2I_INT);
@@ -1228,66 +1281,86 @@ static void stex_ss_reset(struct st_hba *hba)
 	ssleep(5);
 }
 
-static int stex_reset(struct scsi_cmnd *cmd)
+static int stex_do_reset(struct st_hba *hba)
 {
-	struct st_hba *hba;
-	void __iomem *base;
-	unsigned long flags, before;
+	struct st_ccb *ccb;
+	unsigned long flags;
+	unsigned int mu_status = MU_STATE_RESETTING;
+	u16 tag;
 
-	hba = (struct st_hba *) &cmd->device->host->hostdata[0];
+	spin_lock_irqsave(hba->host->host_lock, flags);
+	if (hba->mu_status == MU_STATE_STARTING) {
+		spin_unlock_irqrestore(hba->host->host_lock, flags);
+		printk(KERN_INFO DRV_NAME "(%s): request reset during init\n",
+			pci_name(hba->pdev));
+		return 0;
+	}
+	while (hba->mu_status == MU_STATE_RESETTING) {
+		spin_unlock_irqrestore(hba->host->host_lock, flags);
+		wait_event_timeout(hba->reset_waitq,
+				   hba->mu_status != MU_STATE_RESETTING,
+				   MU_MAX_DELAY * HZ);
+		spin_lock_irqsave(hba->host->host_lock, flags);
+		mu_status = hba->mu_status;
+	}
 
-	printk(KERN_INFO DRV_NAME
-		"(%s): resetting host\n", pci_name(hba->pdev));
-	scsi_print_command(cmd);
+	if (mu_status != MU_STATE_RESETTING) {
+		spin_unlock_irqrestore(hba->host->host_lock, flags);
+		return (mu_status == MU_STATE_STARTED) ? 0 : -1;
+	}
 
 	hba->mu_status = MU_STATE_RESETTING;
+	spin_unlock_irqrestore(hba->host->host_lock, flags);
+
+	if (hba->cardtype == st_yosemite)
+		return stex_yos_reset(hba);
 
 	if (hba->cardtype == st_shasta)
 		stex_hard_reset(hba);
 	else if (hba->cardtype == st_yel)
 		stex_ss_reset(hba);
 
-	if (hba->cardtype != st_yosemite) {
-		if (stex_handshake(hba)) {
-			printk(KERN_WARNING DRV_NAME
-				"(%s): resetting: handshake failed\n",
-				pci_name(hba->pdev));
-			return FAILED;
+	spin_lock_irqsave(hba->host->host_lock, flags);
+	for (tag = 0; tag < hba->host->can_queue; tag++) {
+		ccb = &hba->ccb[tag];
+		if (ccb->req == NULL)
+			continue;
+		ccb->req = NULL;
+		if (ccb->cmd) {
+			scsi_dma_unmap(ccb->cmd);
+			ccb->cmd->result = DID_RESET << 16;
+			ccb->cmd->scsi_done(ccb->cmd);
+			ccb->cmd = NULL;
 		}
-		return SUCCESS;
 	}
+	spin_unlock_irqrestore(hba->host->host_lock, flags);
 
-	/* st_yosemite */
-	writel(MU_INBOUND_DOORBELL_RESET, hba->mmio_base + IDBL);
-	readl(hba->mmio_base + IDBL); /* flush */
-	before = jiffies;
-	while (hba->out_req_cnt > 0) {
-		if (time_after(jiffies, before + ST_INTERNAL_TIMEOUT * HZ)) {
-			printk(KERN_WARNING DRV_NAME
-				"(%s): reset timeout\n", pci_name(hba->pdev));
-			return FAILED;
-		}
-		msleep(1);
-	}
+	if (stex_handshake(hba) == 0)
+		return 0;
 
-	base = hba->mmio_base;
-	writel(0, base + IMR0);
-	readl(base + IMR0);
-	writel(0, base + OMR0);
-	readl(base + OMR0);
-	writel(0, base + IMR1);
-	readl(base + IMR1);
-	writel(0, base + OMR1);
-	readl(base + OMR1); /* flush */
-	spin_lock_irqsave(hba->host->host_lock, flags);
-	hba->req_head = 0;
-	hba->req_tail = 0;
-	hba->status_head = 0;
-	hba->status_tail = 0;
-	hba->out_req_cnt = 0;
-	hba->mu_status = MU_STATE_STARTED;
-	spin_unlock_irqrestore(hba->host->host_lock, flags);
-	return SUCCESS;
+	printk(KERN_WARNING DRV_NAME "(%s): resetting: handshake failed\n",
+		pci_name(hba->pdev));
+	return -1;
+}
+
+static int stex_reset(struct scsi_cmnd *cmd)
+{
+	struct st_hba *hba;
+
+	hba = (struct st_hba *) &cmd->device->host->hostdata[0];
+
+	printk(KERN_INFO DRV_NAME
+		"(%s): resetting host\n", pci_name(hba->pdev));
+	scsi_print_command(cmd);
+
+	return stex_do_reset(hba) ? FAILED : SUCCESS;
+}
+
+static void stex_reset_work(struct work_struct *work)
+{
+	struct st_hba *hba = container_of(work, struct st_hba, reset_work);
+
+	stex_do_reset(hba);
 }
 
 static int stex_biosparam(struct scsi_device *sdev,
@@ -1420,8 +1493,8 @@ static int stex_set_dma_mask(struct pci_dev * pdev)
 {
 	int ret;
 
-	if (!pci_set_dma_mask(pdev,  DMA_BIT_MASK(64))
-		&& !pci_set_consistent_dma_mask(pdev,  DMA_BIT_MASK(64)))
+	if (!pci_set_dma_mask(pdev, DMA_BIT_MASK(64))
+		&& !pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64)))
 		return 0;
 	ret = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
 	if (!ret)
@@ -1528,10 +1601,24 @@ stex_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 	hba->dma_mem = dma_alloc_coherent(&pdev->dev,
 		hba->dma_size, &hba->dma_handle, GFP_KERNEL);
 	if (!hba->dma_mem) {
-		err = -ENOMEM;
-		printk(KERN_ERR DRV_NAME "(%s): dma mem alloc failed\n",
-			pci_name(pdev));
-		goto out_iounmap;
+		/* Retry minimum coherent mapping for st_seq and st_vsc */
+		if (hba->cardtype == st_seq ||
+		    (hba->cardtype == st_vsc && (pdev->subsystem_device & 1))) {
+			printk(KERN_WARNING DRV_NAME
+				"(%s): allocating min buffer for controller\n",
+				pci_name(pdev));
+			hba->dma_size = hba->extra_offset
+				+ ST_ADDITIONAL_MEM_MIN;
+			hba->dma_mem = dma_alloc_coherent(&pdev->dev,
+				hba->dma_size, &hba->dma_handle, GFP_KERNEL);
+		}
+
+		if (!hba->dma_mem) {
+			err = -ENOMEM;
+			printk(KERN_ERR DRV_NAME "(%s): dma mem alloc failed\n",
+				pci_name(pdev));
+			goto out_iounmap;
+		}
 	}
 
 	hba->ccb = kcalloc(ci->rq_count, sizeof(struct st_ccb), GFP_KERNEL);
@@ -1568,12 +1655,24 @@ stex_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 
 	hba->host = host;
 	hba->pdev = pdev;
+	init_waitqueue_head(&hba->reset_waitq);
+
+	snprintf(hba->work_q_name, sizeof(hba->work_q_name),
+		 "stex_wq_%d", host->host_no);
+	hba->work_q = create_singlethread_workqueue(hba->work_q_name);
+	if (!hba->work_q) {
+		printk(KERN_ERR DRV_NAME "(%s): create workqueue failed\n",
+			pci_name(pdev));
+		err = -ENOMEM;
+		goto out_ccb_free;
+	}
+	INIT_WORK(&hba->reset_work, stex_reset_work);
 
 	err = stex_request_irq(hba);
 	if (err) {
 		printk(KERN_ERR DRV_NAME "(%s): request irq failed\n",
 			pci_name(pdev));
-		goto out_ccb_free;
+		goto out_free_wq;
 	}
 
 	err = stex_handshake(hba);
@@ -1602,6 +1701,8 @@ stex_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 
 out_free_irq:
 	stex_free_irq(hba);
+out_free_wq:
+	destroy_workqueue(hba->work_q);
 out_ccb_free:
 	kfree(hba->ccb);
 out_pci_free:
@@ -1669,6 +1770,8 @@ static void stex_hba_free(struct st_hba *hba)
 {
 	stex_free_irq(hba);
 
+	destroy_workqueue(hba->work_q);
+
 	iounmap(hba->mmio_base);
 
 	pci_release_regions(hba->pdev);
diff --git a/drivers/scsi/sym53c8xx_2/sym_glue.c b/drivers/scsi/sym53c8xx_2/sym_glue.c
index 45374d66d26a..8b955b534a36 100644
--- a/drivers/scsi/sym53c8xx_2/sym_glue.c
+++ b/drivers/scsi/sym53c8xx_2/sym_glue.c
@@ -984,7 +984,7 @@ static void sym_exec_user_command (struct sym_hcb *np, struct sym_usrcmd *uc)
 	}
 }
 
-static int skip_spaces(char *ptr, int len)
+static int sym_skip_spaces(char *ptr, int len)
 {
 	int cnt, c;
 
@@ -1012,7 +1012,7 @@ static int is_keyword(char *ptr, int len, char *verb)
 }
 
 #define SKIP_SPACES(ptr, len)						\
-	if ((arg_len = skip_spaces(ptr, len)) < 1)			\
+	if ((arg_len = sym_skip_spaces(ptr, len)) < 1)			\
 		return -EINVAL;						\
 	ptr += arg_len; len -= arg_len;
 
@@ -1864,7 +1864,7 @@ static pci_ers_result_t sym2_io_slot_dump(struct pci_dev *pdev)
  *
  * This routine is similar to sym_set_workarounds(), except
  * that, at this point, we already know that the device was
- * succesfully intialized at least once before, and so most
+ * successfully intialized at least once before, and so most
  * of the steps taken there are un-needed here.
  */
 static void sym2_reset_workarounds(struct pci_dev *pdev)
diff --git a/drivers/scsi/sym53c8xx_2/sym_hipd.c b/drivers/scsi/sym53c8xx_2/sym_hipd.c
index 297deb817a5d..a7bc8b7b09ac 100644
--- a/drivers/scsi/sym53c8xx_2/sym_hipd.c
+++ b/drivers/scsi/sym53c8xx_2/sym_hipd.c
@@ -2692,7 +2692,7 @@ static void sym_int_ma (struct sym_hcb *np)
 	 *  we force a SIR_NEGO_PROTO interrupt (it is a hack that avoids 
 	 *  bloat for such a should_not_happen situation).
 	 *  In all other situation, we reset the BUS.
-	 *  Are these assumptions reasonnable ? (Wait and see ...)
+	 *  Are these assumptions reasonable ? (Wait and see ...)
 	 */
 unexpected_phase:
 	dsp -= 8;
diff --git a/drivers/scsi/sym53c8xx_2/sym_hipd.h b/drivers/scsi/sym53c8xx_2/sym_hipd.h
index 053e63c86822..5a80cbac3f92 100644
--- a/drivers/scsi/sym53c8xx_2/sym_hipd.h
+++ b/drivers/scsi/sym53c8xx_2/sym_hipd.h
@@ -54,7 +54,7 @@
  *
  *    SYM_OPT_LIMIT_COMMAND_REORDERING
  *        When this option is set, the driver tries to limit tagged 
- *        command reordering to some reasonnable value.
+ *        command reordering to some reasonable value.
  *        (set for Linux)
  */
 #if 0
diff --git a/drivers/scsi/vmw_pvscsi.c b/drivers/scsi/vmw_pvscsi.c
new file mode 100644
index 000000000000..d2604c813a20
--- /dev/null
+++ b/drivers/scsi/vmw_pvscsi.c
@@ -0,0 +1,1407 @@
+/*
+ * Linux driver for VMware's para-virtualized SCSI HBA.
+ *
+ * Copyright (C) 2008-2009, VMware, Inc. All Rights Reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License and no later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ * NON INFRINGEMENT.  See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Maintained by: Alok N Kataria <akataria@vmware.com>
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/interrupt.h>
+#include <linux/workqueue.h>
+#include <linux/pci.h>
+
+#include <scsi/scsi.h>
+#include <scsi/scsi_host.h>
+#include <scsi/scsi_cmnd.h>
+#include <scsi/scsi_device.h>
+
+#include "vmw_pvscsi.h"
+
+#define PVSCSI_LINUX_DRIVER_DESC "VMware PVSCSI driver"
+
+MODULE_DESCRIPTION(PVSCSI_LINUX_DRIVER_DESC);
+MODULE_AUTHOR("VMware, Inc.");
+MODULE_LICENSE("GPL");
+MODULE_VERSION(PVSCSI_DRIVER_VERSION_STRING);
+
+#define PVSCSI_DEFAULT_NUM_PAGES_PER_RING	8
+#define PVSCSI_DEFAULT_NUM_PAGES_MSG_RING	1
+#define PVSCSI_DEFAULT_QUEUE_DEPTH		64
+#define SGL_SIZE				PAGE_SIZE
+
+struct pvscsi_sg_list {
+	struct PVSCSISGElement sge[PVSCSI_MAX_NUM_SG_ENTRIES_PER_SEGMENT];
+};
+
+struct pvscsi_ctx {
+	/*
+	 * The index of the context in cmd_map serves as the context ID for a
+	 * 1-to-1 mapping completions back to requests.
+	 */
+	struct scsi_cmnd	*cmd;
+	struct pvscsi_sg_list	*sgl;
+	struct list_head	list;
+	dma_addr_t		dataPA;
+	dma_addr_t		sensePA;
+	dma_addr_t		sglPA;
+};
+
+struct pvscsi_adapter {
+	char				*mmioBase;
+	unsigned int			irq;
+	u8				rev;
+	bool				use_msi;
+	bool				use_msix;
+	bool				use_msg;
+
+	spinlock_t			hw_lock;
+
+	struct workqueue_struct		*workqueue;
+	struct work_struct		work;
+
+	struct PVSCSIRingReqDesc	*req_ring;
+	unsigned			req_pages;
+	unsigned			req_depth;
+	dma_addr_t			reqRingPA;
+
+	struct PVSCSIRingCmpDesc	*cmp_ring;
+	unsigned			cmp_pages;
+	dma_addr_t			cmpRingPA;
+
+	struct PVSCSIRingMsgDesc	*msg_ring;
+	unsigned			msg_pages;
+	dma_addr_t			msgRingPA;
+
+	struct PVSCSIRingsState		*rings_state;
+	dma_addr_t			ringStatePA;
+
+	struct pci_dev			*dev;
+	struct Scsi_Host		*host;
+
+	struct list_head		cmd_pool;
+	struct pvscsi_ctx		*cmd_map;
+};
+
+
+/* Command line parameters */
+static int pvscsi_ring_pages     = PVSCSI_DEFAULT_NUM_PAGES_PER_RING;
+static int pvscsi_msg_ring_pages = PVSCSI_DEFAULT_NUM_PAGES_MSG_RING;
+static int pvscsi_cmd_per_lun    = PVSCSI_DEFAULT_QUEUE_DEPTH;
+static bool pvscsi_disable_msi;
+static bool pvscsi_disable_msix;
+static bool pvscsi_use_msg       = true;
+
+#define PVSCSI_RW (S_IRUSR | S_IWUSR)
+
+module_param_named(ring_pages, pvscsi_ring_pages, int, PVSCSI_RW);
+MODULE_PARM_DESC(ring_pages, "Number of pages per req/cmp ring - (default="
+		 __stringify(PVSCSI_DEFAULT_NUM_PAGES_PER_RING) ")");
+
+module_param_named(msg_ring_pages, pvscsi_msg_ring_pages, int, PVSCSI_RW);
+MODULE_PARM_DESC(msg_ring_pages, "Number of pages for the msg ring - (default="
+		 __stringify(PVSCSI_DEFAULT_NUM_PAGES_MSG_RING) ")");
+
+module_param_named(cmd_per_lun, pvscsi_cmd_per_lun, int, PVSCSI_RW);
+MODULE_PARM_DESC(cmd_per_lun, "Maximum commands per lun - (default="
+		 __stringify(PVSCSI_MAX_REQ_QUEUE_DEPTH) ")");
+
+module_param_named(disable_msi, pvscsi_disable_msi, bool, PVSCSI_RW);
+MODULE_PARM_DESC(disable_msi, "Disable MSI use in driver - (default=0)");
+
+module_param_named(disable_msix, pvscsi_disable_msix, bool, PVSCSI_RW);
+MODULE_PARM_DESC(disable_msix, "Disable MSI-X use in driver - (default=0)");
+
+module_param_named(use_msg, pvscsi_use_msg, bool, PVSCSI_RW);
+MODULE_PARM_DESC(use_msg, "Use msg ring when available - (default=1)");
+
+static const struct pci_device_id pvscsi_pci_tbl[] = {
+	{ PCI_VDEVICE(VMWARE, PCI_DEVICE_ID_VMWARE_PVSCSI) },
+	{ 0 }
+};
+
+MODULE_DEVICE_TABLE(pci, pvscsi_pci_tbl);
+
+static struct device *
+pvscsi_dev(const struct pvscsi_adapter *adapter)
+{
+	return &(adapter->dev->dev);
+}
+
+static struct pvscsi_ctx *
+pvscsi_find_context(const struct pvscsi_adapter *adapter, struct scsi_cmnd *cmd)
+{
+	struct pvscsi_ctx *ctx, *end;
+
+	end = &adapter->cmd_map[adapter->req_depth];
+	for (ctx = adapter->cmd_map; ctx < end; ctx++)
+		if (ctx->cmd == cmd)
+			return ctx;
+
+	return NULL;
+}
+
+static struct pvscsi_ctx *
+pvscsi_acquire_context(struct pvscsi_adapter *adapter, struct scsi_cmnd *cmd)
+{
+	struct pvscsi_ctx *ctx;
+
+	if (list_empty(&adapter->cmd_pool))
+		return NULL;
+
+	ctx = list_first_entry(&adapter->cmd_pool, struct pvscsi_ctx, list);
+	ctx->cmd = cmd;
+	list_del(&ctx->list);
+
+	return ctx;
+}
+
+static void pvscsi_release_context(struct pvscsi_adapter *adapter,
+				   struct pvscsi_ctx *ctx)
+{
+	ctx->cmd = NULL;
+	list_add(&ctx->list, &adapter->cmd_pool);
+}
+
+/*
+ * Map a pvscsi_ctx struct to a context ID field value; we map to a simple
+ * non-zero integer. ctx always points to an entry in cmd_map array, hence
+ * the return value is always >=1.
+ */
+static u64 pvscsi_map_context(const struct pvscsi_adapter *adapter,
+			      const struct pvscsi_ctx *ctx)
+{
+	return ctx - adapter->cmd_map + 1;
+}
+
+static struct pvscsi_ctx *
+pvscsi_get_context(const struct pvscsi_adapter *adapter, u64 context)
+{
+	return &adapter->cmd_map[context - 1];
+}
+
+static void pvscsi_reg_write(const struct pvscsi_adapter *adapter,
+			     u32 offset, u32 val)
+{
+	writel(val, adapter->mmioBase + offset);
+}
+
+static u32 pvscsi_reg_read(const struct pvscsi_adapter *adapter, u32 offset)
+{
+	return readl(adapter->mmioBase + offset);
+}
+
+static u32 pvscsi_read_intr_status(const struct pvscsi_adapter *adapter)
+{
+	return pvscsi_reg_read(adapter, PVSCSI_REG_OFFSET_INTR_STATUS);
+}
+
+static void pvscsi_write_intr_status(const struct pvscsi_adapter *adapter,
+				     u32 val)
+{
+	pvscsi_reg_write(adapter, PVSCSI_REG_OFFSET_INTR_STATUS, val);
+}
+
+static void pvscsi_unmask_intr(const struct pvscsi_adapter *adapter)
+{
+	u32 intr_bits;
+
+	intr_bits = PVSCSI_INTR_CMPL_MASK;
+	if (adapter->use_msg)
+		intr_bits |= PVSCSI_INTR_MSG_MASK;
+
+	pvscsi_reg_write(adapter, PVSCSI_REG_OFFSET_INTR_MASK, intr_bits);
+}
+
+static void pvscsi_mask_intr(const struct pvscsi_adapter *adapter)
+{
+	pvscsi_reg_write(adapter, PVSCSI_REG_OFFSET_INTR_MASK, 0);
+}
+
+static void pvscsi_write_cmd_desc(const struct pvscsi_adapter *adapter,
+				  u32 cmd, const void *desc, size_t len)
+{
+	const u32 *ptr = desc;
+	size_t i;
+
+	len /= sizeof(*ptr);
+	pvscsi_reg_write(adapter, PVSCSI_REG_OFFSET_COMMAND, cmd);
+	for (i = 0; i < len; i++)
+		pvscsi_reg_write(adapter,
+				 PVSCSI_REG_OFFSET_COMMAND_DATA, ptr[i]);
+}
+
+static void pvscsi_abort_cmd(const struct pvscsi_adapter *adapter,
+			     const struct pvscsi_ctx *ctx)
+{
+	struct PVSCSICmdDescAbortCmd cmd = { 0 };
+
+	cmd.target = ctx->cmd->device->id;
+	cmd.context = pvscsi_map_context(adapter, ctx);
+
+	pvscsi_write_cmd_desc(adapter, PVSCSI_CMD_ABORT_CMD, &cmd, sizeof(cmd));
+}
+
+static void pvscsi_kick_rw_io(const struct pvscsi_adapter *adapter)
+{
+	pvscsi_reg_write(adapter, PVSCSI_REG_OFFSET_KICK_RW_IO, 0);
+}
+
+static void pvscsi_process_request_ring(const struct pvscsi_adapter *adapter)
+{
+	pvscsi_reg_write(adapter, PVSCSI_REG_OFFSET_KICK_NON_RW_IO, 0);
+}
+
+static int scsi_is_rw(unsigned char op)
+{
+	return op == READ_6  || op == WRITE_6 ||
+	       op == READ_10 || op == WRITE_10 ||
+	       op == READ_12 || op == WRITE_12 ||
+	       op == READ_16 || op == WRITE_16;
+}
+
+static void pvscsi_kick_io(const struct pvscsi_adapter *adapter,
+			   unsigned char op)
+{
+	if (scsi_is_rw(op))
+		pvscsi_kick_rw_io(adapter);
+	else
+		pvscsi_process_request_ring(adapter);
+}
+
+static void ll_adapter_reset(const struct pvscsi_adapter *adapter)
+{
+	dev_dbg(pvscsi_dev(adapter), "Adapter Reset on %p\n", adapter);
+
+	pvscsi_write_cmd_desc(adapter, PVSCSI_CMD_ADAPTER_RESET, NULL, 0);
+}
+
+static void ll_bus_reset(const struct pvscsi_adapter *adapter)
+{
+	dev_dbg(pvscsi_dev(adapter), "Reseting bus on %p\n", adapter);
+
+	pvscsi_write_cmd_desc(adapter, PVSCSI_CMD_RESET_BUS, NULL, 0);
+}
+
+static void ll_device_reset(const struct pvscsi_adapter *adapter, u32 target)
+{
+	struct PVSCSICmdDescResetDevice cmd = { 0 };
+
+	dev_dbg(pvscsi_dev(adapter), "Reseting device: target=%u\n", target);
+
+	cmd.target = target;
+
+	pvscsi_write_cmd_desc(adapter, PVSCSI_CMD_RESET_DEVICE,
+			      &cmd, sizeof(cmd));
+}
+
+static void pvscsi_create_sg(struct pvscsi_ctx *ctx,
+			     struct scatterlist *sg, unsigned count)
+{
+	unsigned i;
+	struct PVSCSISGElement *sge;
+
+	BUG_ON(count > PVSCSI_MAX_NUM_SG_ENTRIES_PER_SEGMENT);
+
+	sge = &ctx->sgl->sge[0];
+	for (i = 0; i < count; i++, sg++) {
+		sge[i].addr   = sg_dma_address(sg);
+		sge[i].length = sg_dma_len(sg);
+		sge[i].flags  = 0;
+	}
+}
+
+/*
+ * Map all data buffers for a command into PCI space and
+ * setup the scatter/gather list if needed.
+ */
+static void pvscsi_map_buffers(struct pvscsi_adapter *adapter,
+			       struct pvscsi_ctx *ctx, struct scsi_cmnd *cmd,
+			       struct PVSCSIRingReqDesc *e)
+{
+	unsigned count;
+	unsigned bufflen = scsi_bufflen(cmd);
+	struct scatterlist *sg;
+
+	e->dataLen = bufflen;
+	e->dataAddr = 0;
+	if (bufflen == 0)
+		return;
+
+	sg = scsi_sglist(cmd);
+	count = scsi_sg_count(cmd);
+	if (count != 0) {
+		int segs = scsi_dma_map(cmd);
+		if (segs > 1) {
+			pvscsi_create_sg(ctx, sg, segs);
+
+			e->flags |= PVSCSI_FLAG_CMD_WITH_SG_LIST;
+			ctx->sglPA = pci_map_single(adapter->dev, ctx->sgl,
+						    SGL_SIZE, PCI_DMA_TODEVICE);
+			e->dataAddr = ctx->sglPA;
+		} else
+			e->dataAddr = sg_dma_address(sg);
+	} else {
+		/*
+		 * In case there is no S/G list, scsi_sglist points
+		 * directly to the buffer.
+		 */
+		ctx->dataPA = pci_map_single(adapter->dev, sg, bufflen,
+					     cmd->sc_data_direction);
+		e->dataAddr = ctx->dataPA;
+	}
+}
+
+static void pvscsi_unmap_buffers(const struct pvscsi_adapter *adapter,
+				 struct pvscsi_ctx *ctx)
+{
+	struct scsi_cmnd *cmd;
+	unsigned bufflen;
+
+	cmd = ctx->cmd;
+	bufflen = scsi_bufflen(cmd);
+
+	if (bufflen != 0) {
+		unsigned count = scsi_sg_count(cmd);
+
+		if (count != 0) {
+			scsi_dma_unmap(cmd);
+			if (ctx->sglPA) {
+				pci_unmap_single(adapter->dev, ctx->sglPA,
+						 SGL_SIZE, PCI_DMA_TODEVICE);
+				ctx->sglPA = 0;
+			}
+		} else
+			pci_unmap_single(adapter->dev, ctx->dataPA, bufflen,
+					 cmd->sc_data_direction);
+	}
+	if (cmd->sense_buffer)
+		pci_unmap_single(adapter->dev, ctx->sensePA,
+				 SCSI_SENSE_BUFFERSIZE, PCI_DMA_FROMDEVICE);
+}
+
+static int __devinit pvscsi_allocate_rings(struct pvscsi_adapter *adapter)
+{
+	adapter->rings_state = pci_alloc_consistent(adapter->dev, PAGE_SIZE,
+						    &adapter->ringStatePA);
+	if (!adapter->rings_state)
+		return -ENOMEM;
+
+	adapter->req_pages = min(PVSCSI_MAX_NUM_PAGES_REQ_RING,
+				 pvscsi_ring_pages);
+	adapter->req_depth = adapter->req_pages
+					* PVSCSI_MAX_NUM_REQ_ENTRIES_PER_PAGE;
+	adapter->req_ring = pci_alloc_consistent(adapter->dev,
+						 adapter->req_pages * PAGE_SIZE,
+						 &adapter->reqRingPA);
+	if (!adapter->req_ring)
+		return -ENOMEM;
+
+	adapter->cmp_pages = min(PVSCSI_MAX_NUM_PAGES_CMP_RING,
+				 pvscsi_ring_pages);
+	adapter->cmp_ring = pci_alloc_consistent(adapter->dev,
+						 adapter->cmp_pages * PAGE_SIZE,
+						 &adapter->cmpRingPA);
+	if (!adapter->cmp_ring)
+		return -ENOMEM;
+
+	BUG_ON(!IS_ALIGNED(adapter->ringStatePA, PAGE_SIZE));
+	BUG_ON(!IS_ALIGNED(adapter->reqRingPA, PAGE_SIZE));
+	BUG_ON(!IS_ALIGNED(adapter->cmpRingPA, PAGE_SIZE));
+
+	if (!adapter->use_msg)
+		return 0;
+
+	adapter->msg_pages = min(PVSCSI_MAX_NUM_PAGES_MSG_RING,
+				 pvscsi_msg_ring_pages);
+	adapter->msg_ring = pci_alloc_consistent(adapter->dev,
+						 adapter->msg_pages * PAGE_SIZE,
+						 &adapter->msgRingPA);
+	if (!adapter->msg_ring)
+		return -ENOMEM;
+	BUG_ON(!IS_ALIGNED(adapter->msgRingPA, PAGE_SIZE));
+
+	return 0;
+}
+
+static void pvscsi_setup_all_rings(const struct pvscsi_adapter *adapter)
+{
+	struct PVSCSICmdDescSetupRings cmd = { 0 };
+	dma_addr_t base;
+	unsigned i;
+
+	cmd.ringsStatePPN   = adapter->ringStatePA >> PAGE_SHIFT;
+	cmd.reqRingNumPages = adapter->req_pages;
+	cmd.cmpRingNumPages = adapter->cmp_pages;
+
+	base = adapter->reqRingPA;
+	for (i = 0; i < adapter->req_pages; i++) {
+		cmd.reqRingPPNs[i] = base >> PAGE_SHIFT;
+		base += PAGE_SIZE;
+	}
+
+	base = adapter->cmpRingPA;
+	for (i = 0; i < adapter->cmp_pages; i++) {
+		cmd.cmpRingPPNs[i] = base >> PAGE_SHIFT;
+		base += PAGE_SIZE;
+	}
+
+	memset(adapter->rings_state, 0, PAGE_SIZE);
+	memset(adapter->req_ring, 0, adapter->req_pages * PAGE_SIZE);
+	memset(adapter->cmp_ring, 0, adapter->cmp_pages * PAGE_SIZE);
+
+	pvscsi_write_cmd_desc(adapter, PVSCSI_CMD_SETUP_RINGS,
+			      &cmd, sizeof(cmd));
+
+	if (adapter->use_msg) {
+		struct PVSCSICmdDescSetupMsgRing cmd_msg = { 0 };
+
+		cmd_msg.numPages = adapter->msg_pages;
+
+		base = adapter->msgRingPA;
+		for (i = 0; i < adapter->msg_pages; i++) {
+			cmd_msg.ringPPNs[i] = base >> PAGE_SHIFT;
+			base += PAGE_SIZE;
+		}
+		memset(adapter->msg_ring, 0, adapter->msg_pages * PAGE_SIZE);
+
+		pvscsi_write_cmd_desc(adapter, PVSCSI_CMD_SETUP_MSG_RING,
+				      &cmd_msg, sizeof(cmd_msg));
+	}
+}
+
+/*
+ * Pull a completion descriptor off and pass the completion back
+ * to the SCSI mid layer.
+ */
+static void pvscsi_complete_request(struct pvscsi_adapter *adapter,
+				    const struct PVSCSIRingCmpDesc *e)
+{
+	struct pvscsi_ctx *ctx;
+	struct scsi_cmnd *cmd;
+	u32 btstat = e->hostStatus;
+	u32 sdstat = e->scsiStatus;
+
+	ctx = pvscsi_get_context(adapter, e->context);
+	cmd = ctx->cmd;
+	pvscsi_unmap_buffers(adapter, ctx);
+	pvscsi_release_context(adapter, ctx);
+	cmd->result = 0;
+
+	if (sdstat != SAM_STAT_GOOD &&
+	    (btstat == BTSTAT_SUCCESS ||
+	     btstat == BTSTAT_LINKED_COMMAND_COMPLETED ||
+	     btstat == BTSTAT_LINKED_COMMAND_COMPLETED_WITH_FLAG)) {
+		cmd->result = (DID_OK << 16) | sdstat;
+		if (sdstat == SAM_STAT_CHECK_CONDITION && cmd->sense_buffer)
+			cmd->result |= (DRIVER_SENSE << 24);
+	} else
+		switch (btstat) {
+		case BTSTAT_SUCCESS:
+		case BTSTAT_LINKED_COMMAND_COMPLETED:
+		case BTSTAT_LINKED_COMMAND_COMPLETED_WITH_FLAG:
+			/* If everything went fine, let's move on..  */
+			cmd->result = (DID_OK << 16);
+			break;
+
+		case BTSTAT_DATARUN:
+		case BTSTAT_DATA_UNDERRUN:
+			/* Report residual data in underruns */
+			scsi_set_resid(cmd, scsi_bufflen(cmd) - e->dataLen);
+			cmd->result = (DID_ERROR << 16);
+			break;
+
+		case BTSTAT_SELTIMEO:
+			/* Our emulation returns this for non-connected devs */
+			cmd->result = (DID_BAD_TARGET << 16);
+			break;
+
+		case BTSTAT_LUNMISMATCH:
+		case BTSTAT_TAGREJECT:
+		case BTSTAT_BADMSG:
+			cmd->result = (DRIVER_INVALID << 24);
+			/* fall through */
+
+		case BTSTAT_HAHARDWARE:
+		case BTSTAT_INVPHASE:
+		case BTSTAT_HATIMEOUT:
+		case BTSTAT_NORESPONSE:
+		case BTSTAT_DISCONNECT:
+		case BTSTAT_HASOFTWARE:
+		case BTSTAT_BUSFREE:
+		case BTSTAT_SENSFAILED:
+			cmd->result |= (DID_ERROR << 16);
+			break;
+
+		case BTSTAT_SENTRST:
+		case BTSTAT_RECVRST:
+		case BTSTAT_BUSRESET:
+			cmd->result = (DID_RESET << 16);
+			break;
+
+		case BTSTAT_ABORTQUEUE:
+			cmd->result = (DID_ABORT << 16);
+			break;
+
+		case BTSTAT_SCSIPARITY:
+			cmd->result = (DID_PARITY << 16);
+			break;
+
+		default:
+			cmd->result = (DID_ERROR << 16);
+			scmd_printk(KERN_DEBUG, cmd,
+				    "Unknown completion status: 0x%x\n",
+				    btstat);
+	}
+
+	dev_dbg(&cmd->device->sdev_gendev,
+		"cmd=%p %x ctx=%p result=0x%x status=0x%x,%x\n",
+		cmd, cmd->cmnd[0], ctx, cmd->result, btstat, sdstat);
+
+	cmd->scsi_done(cmd);
+}
+
+/*
+ * barrier usage : Since the PVSCSI device is emulated, there could be cases
+ * where we may want to serialize some accesses between the driver and the
+ * emulation layer. We use compiler barriers instead of the more expensive
+ * memory barriers because PVSCSI is only supported on X86 which has strong
+ * memory access ordering.
+ */
+static void pvscsi_process_completion_ring(struct pvscsi_adapter *adapter)
+{
+	struct PVSCSIRingsState *s = adapter->rings_state;
+	struct PVSCSIRingCmpDesc *ring = adapter->cmp_ring;
+	u32 cmp_entries = s->cmpNumEntriesLog2;
+
+	while (s->cmpConsIdx != s->cmpProdIdx) {
+		struct PVSCSIRingCmpDesc *e = ring + (s->cmpConsIdx &
+						      MASK(cmp_entries));
+		/*
+		 * This barrier() ensures that *e is not dereferenced while
+		 * the device emulation still writes data into the slot.
+		 * Since the device emulation advances s->cmpProdIdx only after
+		 * updating the slot we want to check it first.
+		 */
+		barrier();
+		pvscsi_complete_request(adapter, e);
+		/*
+		 * This barrier() ensures that compiler doesn't reorder write
+		 * to s->cmpConsIdx before the read of (*e) inside
+		 * pvscsi_complete_request. Otherwise, device emulation may
+		 * overwrite *e before we had a chance to read it.
+		 */
+		barrier();
+		s->cmpConsIdx++;
+	}
+}
+
+/*
+ * Translate a Linux SCSI request into a request ring entry.
+ */
+static int pvscsi_queue_ring(struct pvscsi_adapter *adapter,
+			     struct pvscsi_ctx *ctx, struct scsi_cmnd *cmd)
+{
+	struct PVSCSIRingsState *s;
+	struct PVSCSIRingReqDesc *e;
+	struct scsi_device *sdev;
+	u32 req_entries;
+
+	s = adapter->rings_state;
+	sdev = cmd->device;
+	req_entries = s->reqNumEntriesLog2;
+
+	/*
+	 * If this condition holds, we might have room on the request ring, but
+	 * we might not have room on the completion ring for the response.
+	 * However, we have already ruled out this possibility - we would not
+	 * have successfully allocated a context if it were true, since we only
+	 * have one context per request entry.  Check for it anyway, since it
+	 * would be a serious bug.
+	 */
+	if (s->reqProdIdx - s->cmpConsIdx >= 1 << req_entries) {
+		scmd_printk(KERN_ERR, cmd, "vmw_pvscsi: "
+			    "ring full: reqProdIdx=%d cmpConsIdx=%d\n",
+			    s->reqProdIdx, s->cmpConsIdx);
+		return -1;
+	}
+
+	e = adapter->req_ring + (s->reqProdIdx & MASK(req_entries));
+
+	e->bus    = sdev->channel;
+	e->target = sdev->id;
+	memset(e->lun, 0, sizeof(e->lun));
+	e->lun[1] = sdev->lun;
+
+	if (cmd->sense_buffer) {
+		ctx->sensePA = pci_map_single(adapter->dev, cmd->sense_buffer,
+					      SCSI_SENSE_BUFFERSIZE,
+					      PCI_DMA_FROMDEVICE);
+		e->senseAddr = ctx->sensePA;
+		e->senseLen = SCSI_SENSE_BUFFERSIZE;
+	} else {
+		e->senseLen  = 0;
+		e->senseAddr = 0;
+	}
+	e->cdbLen   = cmd->cmd_len;
+	e->vcpuHint = smp_processor_id();
+	memcpy(e->cdb, cmd->cmnd, e->cdbLen);
+
+	e->tag = SIMPLE_QUEUE_TAG;
+	if (sdev->tagged_supported &&
+	    (cmd->tag == HEAD_OF_QUEUE_TAG ||
+	     cmd->tag == ORDERED_QUEUE_TAG))
+		e->tag = cmd->tag;
+
+	if (cmd->sc_data_direction == DMA_FROM_DEVICE)
+		e->flags = PVSCSI_FLAG_CMD_DIR_TOHOST;
+	else if (cmd->sc_data_direction == DMA_TO_DEVICE)
+		e->flags = PVSCSI_FLAG_CMD_DIR_TODEVICE;
+	else if (cmd->sc_data_direction == DMA_NONE)
+		e->flags = PVSCSI_FLAG_CMD_DIR_NONE;
+	else
+		e->flags = 0;
+
+	pvscsi_map_buffers(adapter, ctx, cmd, e);
+
+	e->context = pvscsi_map_context(adapter, ctx);
+
+	barrier();
+
+	s->reqProdIdx++;
+
+	return 0;
+}
+
+static int pvscsi_queue(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd *))
+{
+	struct Scsi_Host *host = cmd->device->host;
+	struct pvscsi_adapter *adapter = shost_priv(host);
+	struct pvscsi_ctx *ctx;
+	unsigned long flags;
+
+	spin_lock_irqsave(&adapter->hw_lock, flags);
+
+	ctx = pvscsi_acquire_context(adapter, cmd);
+	if (!ctx || pvscsi_queue_ring(adapter, ctx, cmd) != 0) {
+		if (ctx)
+			pvscsi_release_context(adapter, ctx);
+		spin_unlock_irqrestore(&adapter->hw_lock, flags);
+		return SCSI_MLQUEUE_HOST_BUSY;
+	}
+
+	cmd->scsi_done = done;
+
+	dev_dbg(&cmd->device->sdev_gendev,
+		"queued cmd %p, ctx %p, op=%x\n", cmd, ctx, cmd->cmnd[0]);
+
+	spin_unlock_irqrestore(&adapter->hw_lock, flags);
+
+	pvscsi_kick_io(adapter, cmd->cmnd[0]);
+
+	return 0;
+}
+
+static int pvscsi_abort(struct scsi_cmnd *cmd)
+{
+	struct pvscsi_adapter *adapter = shost_priv(cmd->device->host);
+	struct pvscsi_ctx *ctx;
+	unsigned long flags;
+
+	scmd_printk(KERN_DEBUG, cmd, "task abort on host %u, %p\n",
+		    adapter->host->host_no, cmd);
+
+	spin_lock_irqsave(&adapter->hw_lock, flags);
+
+	/*
+	 * Poll the completion ring first - we might be trying to abort
+	 * a command that is waiting to be dispatched in the completion ring.
+	 */
+	pvscsi_process_completion_ring(adapter);
+
+	/*
+	 * If there is no context for the command, it either already succeeded
+	 * or else was never properly issued.  Not our problem.
+	 */
+	ctx = pvscsi_find_context(adapter, cmd);
+	if (!ctx) {
+		scmd_printk(KERN_DEBUG, cmd, "Failed to abort cmd %p\n", cmd);
+		goto out;
+	}
+
+	pvscsi_abort_cmd(adapter, ctx);
+
+	pvscsi_process_completion_ring(adapter);
+
+out:
+	spin_unlock_irqrestore(&adapter->hw_lock, flags);
+	return SUCCESS;
+}
+
+/*
+ * Abort all outstanding requests.  This is only safe to use if the completion
+ * ring will never be walked again or the device has been reset, because it
+ * destroys the 1-1 mapping between context field passed to emulation and our
+ * request structure.
+ */
+static void pvscsi_reset_all(struct pvscsi_adapter *adapter)
+{
+	unsigned i;
+
+	for (i = 0; i < adapter->req_depth; i++) {
+		struct pvscsi_ctx *ctx = &adapter->cmd_map[i];
+		struct scsi_cmnd *cmd = ctx->cmd;
+		if (cmd) {
+			scmd_printk(KERN_ERR, cmd,
+				    "Forced reset on cmd %p\n", cmd);
+			pvscsi_unmap_buffers(adapter, ctx);
+			pvscsi_release_context(adapter, ctx);
+			cmd->result = (DID_RESET << 16);
+			cmd->scsi_done(cmd);
+		}
+	}
+}
+
+static int pvscsi_host_reset(struct scsi_cmnd *cmd)
+{
+	struct Scsi_Host *host = cmd->device->host;
+	struct pvscsi_adapter *adapter = shost_priv(host);
+	unsigned long flags;
+	bool use_msg;
+
+	scmd_printk(KERN_INFO, cmd, "SCSI Host reset\n");
+
+	spin_lock_irqsave(&adapter->hw_lock, flags);
+
+	use_msg = adapter->use_msg;
+
+	if (use_msg) {
+		adapter->use_msg = 0;
+		spin_unlock_irqrestore(&adapter->hw_lock, flags);
+
+		/*
+		 * Now that we know that the ISR won't add more work on the
+		 * workqueue we can safely flush any outstanding work.
+		 */
+		flush_workqueue(adapter->workqueue);
+		spin_lock_irqsave(&adapter->hw_lock, flags);
+	}
+
+	/*
+	 * We're going to tear down the entire ring structure and set it back
+	 * up, so stalling new requests until all completions are flushed and
+	 * the rings are back in place.
+	 */
+
+	pvscsi_process_request_ring(adapter);
+
+	ll_adapter_reset(adapter);
+
+	/*
+	 * Now process any completions.  Note we do this AFTER adapter reset,
+	 * which is strange, but stops races where completions get posted
+	 * between processing the ring and issuing the reset.  The backend will
+	 * not touch the ring memory after reset, so the immediately pre-reset
+	 * completion ring state is still valid.
+	 */
+	pvscsi_process_completion_ring(adapter);
+
+	pvscsi_reset_all(adapter);
+	adapter->use_msg = use_msg;
+	pvscsi_setup_all_rings(adapter);
+	pvscsi_unmask_intr(adapter);
+
+	spin_unlock_irqrestore(&adapter->hw_lock, flags);
+
+	return SUCCESS;
+}
+
+static int pvscsi_bus_reset(struct scsi_cmnd *cmd)
+{
+	struct Scsi_Host *host = cmd->device->host;
+	struct pvscsi_adapter *adapter = shost_priv(host);
+	unsigned long flags;
+
+	scmd_printk(KERN_INFO, cmd, "SCSI Bus reset\n");
+
+	/*
+	 * We don't want to queue new requests for this bus after
+	 * flushing all pending requests to emulation, since new
+	 * requests could then sneak in during this bus reset phase,
+	 * so take the lock now.
+	 */
+	spin_lock_irqsave(&adapter->hw_lock, flags);
+
+	pvscsi_process_request_ring(adapter);
+	ll_bus_reset(adapter);
+	pvscsi_process_completion_ring(adapter);
+
+	spin_unlock_irqrestore(&adapter->hw_lock, flags);
+
+	return SUCCESS;
+}
+
+static int pvscsi_device_reset(struct scsi_cmnd *cmd)
+{
+	struct Scsi_Host *host = cmd->device->host;
+	struct pvscsi_adapter *adapter = shost_priv(host);
+	unsigned long flags;
+
+	scmd_printk(KERN_INFO, cmd, "SCSI device reset on scsi%u:%u\n",
+		    host->host_no, cmd->device->id);
+
+	/*
+	 * We don't want to queue new requests for this device after flushing
+	 * all pending requests to emulation, since new requests could then
+	 * sneak in during this device reset phase, so take the lock now.
+	 */
+	spin_lock_irqsave(&adapter->hw_lock, flags);
+
+	pvscsi_process_request_ring(adapter);
+	ll_device_reset(adapter, cmd->device->id);
+	pvscsi_process_completion_ring(adapter);
+
+	spin_unlock_irqrestore(&adapter->hw_lock, flags);
+
+	return SUCCESS;
+}
+
+static struct scsi_host_template pvscsi_template;
+
+static const char *pvscsi_info(struct Scsi_Host *host)
+{
+	struct pvscsi_adapter *adapter = shost_priv(host);
+	static char buf[256];
+
+	sprintf(buf, "VMware PVSCSI storage adapter rev %d, req/cmp/msg rings: "
+		"%u/%u/%u pages, cmd_per_lun=%u", adapter->rev,
+		adapter->req_pages, adapter->cmp_pages, adapter->msg_pages,
+		pvscsi_template.cmd_per_lun);
+
+	return buf;
+}
+
+static struct scsi_host_template pvscsi_template = {
+	.module				= THIS_MODULE,
+	.name				= "VMware PVSCSI Host Adapter",
+	.proc_name			= "vmw_pvscsi",
+	.info				= pvscsi_info,
+	.queuecommand			= pvscsi_queue,
+	.this_id			= -1,
+	.sg_tablesize			= PVSCSI_MAX_NUM_SG_ENTRIES_PER_SEGMENT,
+	.dma_boundary			= UINT_MAX,
+	.max_sectors			= 0xffff,
+	.use_clustering			= ENABLE_CLUSTERING,
+	.eh_abort_handler		= pvscsi_abort,
+	.eh_device_reset_handler	= pvscsi_device_reset,
+	.eh_bus_reset_handler		= pvscsi_bus_reset,
+	.eh_host_reset_handler		= pvscsi_host_reset,
+};
+
+static void pvscsi_process_msg(const struct pvscsi_adapter *adapter,
+			       const struct PVSCSIRingMsgDesc *e)
+{
+	struct PVSCSIRingsState *s = adapter->rings_state;
+	struct Scsi_Host *host = adapter->host;
+	struct scsi_device *sdev;
+
+	printk(KERN_INFO "vmw_pvscsi: msg type: 0x%x - MSG RING: %u/%u (%u) \n",
+	       e->type, s->msgProdIdx, s->msgConsIdx, s->msgNumEntriesLog2);
+
+	BUILD_BUG_ON(PVSCSI_MSG_LAST != 2);
+
+	if (e->type == PVSCSI_MSG_DEV_ADDED) {
+		struct PVSCSIMsgDescDevStatusChanged *desc;
+		desc = (struct PVSCSIMsgDescDevStatusChanged *)e;
+
+		printk(KERN_INFO
+		       "vmw_pvscsi: msg: device added at scsi%u:%u:%u\n",
+		       desc->bus, desc->target, desc->lun[1]);
+
+		if (!scsi_host_get(host))
+			return;
+
+		sdev = scsi_device_lookup(host, desc->bus, desc->target,
+					  desc->lun[1]);
+		if (sdev) {
+			printk(KERN_INFO "vmw_pvscsi: device already exists\n");
+			scsi_device_put(sdev);
+		} else
+			scsi_add_device(adapter->host, desc->bus,
+					desc->target, desc->lun[1]);
+
+		scsi_host_put(host);
+	} else if (e->type == PVSCSI_MSG_DEV_REMOVED) {
+		struct PVSCSIMsgDescDevStatusChanged *desc;
+		desc = (struct PVSCSIMsgDescDevStatusChanged *)e;
+
+		printk(KERN_INFO
+		       "vmw_pvscsi: msg: device removed at scsi%u:%u:%u\n",
+		       desc->bus, desc->target, desc->lun[1]);
+
+		if (!scsi_host_get(host))
+			return;
+
+		sdev = scsi_device_lookup(host, desc->bus, desc->target,
+					  desc->lun[1]);
+		if (sdev) {
+			scsi_remove_device(sdev);
+			scsi_device_put(sdev);
+		} else
+			printk(KERN_INFO
+			       "vmw_pvscsi: failed to lookup scsi%u:%u:%u\n",
+			       desc->bus, desc->target, desc->lun[1]);
+
+		scsi_host_put(host);
+	}
+}
+
+static int pvscsi_msg_pending(const struct pvscsi_adapter *adapter)
+{
+	struct PVSCSIRingsState *s = adapter->rings_state;
+
+	return s->msgProdIdx != s->msgConsIdx;
+}
+
+static void pvscsi_process_msg_ring(const struct pvscsi_adapter *adapter)
+{
+	struct PVSCSIRingsState *s = adapter->rings_state;
+	struct PVSCSIRingMsgDesc *ring = adapter->msg_ring;
+	u32 msg_entries = s->msgNumEntriesLog2;
+
+	while (pvscsi_msg_pending(adapter)) {
+		struct PVSCSIRingMsgDesc *e = ring + (s->msgConsIdx &
+						      MASK(msg_entries));
+
+		barrier();
+		pvscsi_process_msg(adapter, e);
+		barrier();
+		s->msgConsIdx++;
+	}
+}
+
+static void pvscsi_msg_workqueue_handler(struct work_struct *data)
+{
+	struct pvscsi_adapter *adapter;
+
+	adapter = container_of(data, struct pvscsi_adapter, work);
+
+	pvscsi_process_msg_ring(adapter);
+}
+
+static int pvscsi_setup_msg_workqueue(struct pvscsi_adapter *adapter)
+{
+	char name[32];
+
+	if (!pvscsi_use_msg)
+		return 0;
+
+	pvscsi_reg_write(adapter, PVSCSI_REG_OFFSET_COMMAND,
+			 PVSCSI_CMD_SETUP_MSG_RING);
+
+	if (pvscsi_reg_read(adapter, PVSCSI_REG_OFFSET_COMMAND_STATUS) == -1)
+		return 0;
+
+	snprintf(name, sizeof(name),
+		 "vmw_pvscsi_wq_%u", adapter->host->host_no);
+
+	adapter->workqueue = create_singlethread_workqueue(name);
+	if (!adapter->workqueue) {
+		printk(KERN_ERR "vmw_pvscsi: failed to create work queue\n");
+		return 0;
+	}
+	INIT_WORK(&adapter->work, pvscsi_msg_workqueue_handler);
+
+	return 1;
+}
+
+static irqreturn_t pvscsi_isr(int irq, void *devp)
+{
+	struct pvscsi_adapter *adapter = devp;
+	int handled;
+
+	if (adapter->use_msi || adapter->use_msix)
+		handled = true;
+	else {
+		u32 val = pvscsi_read_intr_status(adapter);
+		handled = (val & PVSCSI_INTR_ALL_SUPPORTED) != 0;
+		if (handled)
+			pvscsi_write_intr_status(devp, val);
+	}
+
+	if (handled) {
+		unsigned long flags;
+
+		spin_lock_irqsave(&adapter->hw_lock, flags);
+
+		pvscsi_process_completion_ring(adapter);
+		if (adapter->use_msg && pvscsi_msg_pending(adapter))
+			queue_work(adapter->workqueue, &adapter->work);
+
+		spin_unlock_irqrestore(&adapter->hw_lock, flags);
+	}
+
+	return IRQ_RETVAL(handled);
+}
+
+static void pvscsi_free_sgls(const struct pvscsi_adapter *adapter)
+{
+	struct pvscsi_ctx *ctx = adapter->cmd_map;
+	unsigned i;
+
+	for (i = 0; i < adapter->req_depth; ++i, ++ctx)
+		free_pages((unsigned long)ctx->sgl, get_order(SGL_SIZE));
+}
+
+static int pvscsi_setup_msix(const struct pvscsi_adapter *adapter, int *irq)
+{
+	struct msix_entry entry = { 0, PVSCSI_VECTOR_COMPLETION };
+	int ret;
+
+	ret = pci_enable_msix(adapter->dev, &entry, 1);
+	if (ret)
+		return ret;
+
+	*irq = entry.vector;
+
+	return 0;
+}
+
+static void pvscsi_shutdown_intr(struct pvscsi_adapter *adapter)
+{
+	if (adapter->irq) {
+		free_irq(adapter->irq, adapter);
+		adapter->irq = 0;
+	}
+	if (adapter->use_msi) {
+		pci_disable_msi(adapter->dev);
+		adapter->use_msi = 0;
+	} else if (adapter->use_msix) {
+		pci_disable_msix(adapter->dev);
+		adapter->use_msix = 0;
+	}
+}
+
+static void pvscsi_release_resources(struct pvscsi_adapter *adapter)
+{
+	pvscsi_shutdown_intr(adapter);
+
+	if (adapter->workqueue)
+		destroy_workqueue(adapter->workqueue);
+
+	if (adapter->mmioBase)
+		pci_iounmap(adapter->dev, adapter->mmioBase);
+
+	pci_release_regions(adapter->dev);
+
+	if (adapter->cmd_map) {
+		pvscsi_free_sgls(adapter);
+		kfree(adapter->cmd_map);
+	}
+
+	if (adapter->rings_state)
+		pci_free_consistent(adapter->dev, PAGE_SIZE,
+				    adapter->rings_state, adapter->ringStatePA);
+
+	if (adapter->req_ring)
+		pci_free_consistent(adapter->dev,
+				    adapter->req_pages * PAGE_SIZE,
+				    adapter->req_ring, adapter->reqRingPA);
+
+	if (adapter->cmp_ring)
+		pci_free_consistent(adapter->dev,
+				    adapter->cmp_pages * PAGE_SIZE,
+				    adapter->cmp_ring, adapter->cmpRingPA);
+
+	if (adapter->msg_ring)
+		pci_free_consistent(adapter->dev,
+				    adapter->msg_pages * PAGE_SIZE,
+				    adapter->msg_ring, adapter->msgRingPA);
+}
+
+/*
+ * Allocate scatter gather lists.
+ *
+ * These are statically allocated.  Trying to be clever was not worth it.
+ *
+ * Dynamic allocation can fail, and we can't go deeep into the memory
+ * allocator, since we're a SCSI driver, and trying too hard to allocate
+ * memory might generate disk I/O.  We also don't want to fail disk I/O
+ * in that case because we can't get an allocation - the I/O could be
+ * trying to swap out data to free memory.  Since that is pathological,
+ * just use a statically allocated scatter list.
+ *
+ */
+static int __devinit pvscsi_allocate_sg(struct pvscsi_adapter *adapter)
+{
+	struct pvscsi_ctx *ctx;
+	int i;
+
+	ctx = adapter->cmd_map;
+	BUILD_BUG_ON(sizeof(struct pvscsi_sg_list) > SGL_SIZE);
+
+	for (i = 0; i < adapter->req_depth; ++i, ++ctx) {
+		ctx->sgl = (void *)__get_free_pages(GFP_KERNEL,
+						    get_order(SGL_SIZE));
+		ctx->sglPA = 0;
+		BUG_ON(!IS_ALIGNED(((unsigned long)ctx->sgl), PAGE_SIZE));
+		if (!ctx->sgl) {
+			for (; i >= 0; --i, --ctx) {
+				free_pages((unsigned long)ctx->sgl,
+					   get_order(SGL_SIZE));
+				ctx->sgl = NULL;
+			}
+			return -ENOMEM;
+		}
+	}
+
+	return 0;
+}
+
+static int __devinit pvscsi_probe(struct pci_dev *pdev,
+				  const struct pci_device_id *id)
+{
+	struct pvscsi_adapter *adapter;
+	struct Scsi_Host *host;
+	unsigned int i;
+	unsigned long flags = 0;
+	int error;
+
+	error = -ENODEV;
+
+	if (pci_enable_device(pdev))
+		return error;
+
+	if (pci_set_dma_mask(pdev, DMA_BIT_MASK(64)) == 0 &&
+	    pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64)) == 0) {
+		printk(KERN_INFO "vmw_pvscsi: using 64bit dma\n");
+	} else if (pci_set_dma_mask(pdev, DMA_BIT_MASK(32)) == 0 &&
+		   pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32)) == 0) {
+		printk(KERN_INFO "vmw_pvscsi: using 32bit dma\n");
+	} else {
+		printk(KERN_ERR "vmw_pvscsi: failed to set DMA mask\n");
+		goto out_disable_device;
+	}
+
+	pvscsi_template.can_queue =
+		min(PVSCSI_MAX_NUM_PAGES_REQ_RING, pvscsi_ring_pages) *
+		PVSCSI_MAX_NUM_REQ_ENTRIES_PER_PAGE;
+	pvscsi_template.cmd_per_lun =
+		min(pvscsi_template.can_queue, pvscsi_cmd_per_lun);
+	host = scsi_host_alloc(&pvscsi_template, sizeof(struct pvscsi_adapter));
+	if (!host) {
+		printk(KERN_ERR "vmw_pvscsi: failed to allocate host\n");
+		goto out_disable_device;
+	}
+
+	adapter = shost_priv(host);
+	memset(adapter, 0, sizeof(*adapter));
+	adapter->dev  = pdev;
+	adapter->host = host;
+
+	spin_lock_init(&adapter->hw_lock);
+
+	host->max_channel = 0;
+	host->max_id      = 16;
+	host->max_lun     = 1;
+	host->max_cmd_len = 16;
+
+	adapter->rev = pdev->revision;
+
+	if (pci_request_regions(pdev, "vmw_pvscsi")) {
+		printk(KERN_ERR "vmw_pvscsi: pci memory selection failed\n");
+		goto out_free_host;
+	}
+
+	for (i = 0; i < DEVICE_COUNT_RESOURCE; i++) {
+		if ((pci_resource_flags(pdev, i) & PCI_BASE_ADDRESS_SPACE_IO))
+			continue;
+
+		if (pci_resource_len(pdev, i) < PVSCSI_MEM_SPACE_SIZE)
+			continue;
+
+		break;
+	}
+
+	if (i == DEVICE_COUNT_RESOURCE) {
+		printk(KERN_ERR
+		       "vmw_pvscsi: adapter has no suitable MMIO region\n");
+		goto out_release_resources;
+	}
+
+	adapter->mmioBase = pci_iomap(pdev, i, PVSCSI_MEM_SPACE_SIZE);
+
+	if (!adapter->mmioBase) {
+		printk(KERN_ERR
+		       "vmw_pvscsi: can't iomap for BAR %d memsize %lu\n",
+		       i, PVSCSI_MEM_SPACE_SIZE);
+		goto out_release_resources;
+	}
+
+	pci_set_master(pdev);
+	pci_set_drvdata(pdev, host);
+
+	ll_adapter_reset(adapter);
+
+	adapter->use_msg = pvscsi_setup_msg_workqueue(adapter);
+
+	error = pvscsi_allocate_rings(adapter);
+	if (error) {
+		printk(KERN_ERR "vmw_pvscsi: unable to allocate ring memory\n");
+		goto out_release_resources;
+	}
+
+	/*
+	 * From this point on we should reset the adapter if anything goes
+	 * wrong.
+	 */
+	pvscsi_setup_all_rings(adapter);
+
+	adapter->cmd_map = kcalloc(adapter->req_depth,
+				   sizeof(struct pvscsi_ctx), GFP_KERNEL);
+	if (!adapter->cmd_map) {
+		printk(KERN_ERR "vmw_pvscsi: failed to allocate memory.\n");
+		error = -ENOMEM;
+		goto out_reset_adapter;
+	}
+
+	INIT_LIST_HEAD(&adapter->cmd_pool);
+	for (i = 0; i < adapter->req_depth; i++) {
+		struct pvscsi_ctx *ctx = adapter->cmd_map + i;
+		list_add(&ctx->list, &adapter->cmd_pool);
+	}
+
+	error = pvscsi_allocate_sg(adapter);
+	if (error) {
+		printk(KERN_ERR "vmw_pvscsi: unable to allocate s/g table\n");
+		goto out_reset_adapter;
+	}
+
+	if (!pvscsi_disable_msix &&
+	    pvscsi_setup_msix(adapter, &adapter->irq) == 0) {
+		printk(KERN_INFO "vmw_pvscsi: using MSI-X\n");
+		adapter->use_msix = 1;
+	} else if (!pvscsi_disable_msi && pci_enable_msi(pdev) == 0) {
+		printk(KERN_INFO "vmw_pvscsi: using MSI\n");
+		adapter->use_msi = 1;
+		adapter->irq = pdev->irq;
+	} else {
+		printk(KERN_INFO "vmw_pvscsi: using INTx\n");
+		adapter->irq = pdev->irq;
+		flags = IRQF_SHARED;
+	}
+
+	error = request_irq(adapter->irq, pvscsi_isr, flags,
+			    "vmw_pvscsi", adapter);
+	if (error) {
+		printk(KERN_ERR
+		       "vmw_pvscsi: unable to request IRQ: %d\n", error);
+		adapter->irq = 0;
+		goto out_reset_adapter;
+	}
+
+	error = scsi_add_host(host, &pdev->dev);
+	if (error) {
+		printk(KERN_ERR
+		       "vmw_pvscsi: scsi_add_host failed: %d\n", error);
+		goto out_reset_adapter;
+	}
+
+	dev_info(&pdev->dev, "VMware PVSCSI rev %d host #%u\n",
+		 adapter->rev, host->host_no);
+
+	pvscsi_unmask_intr(adapter);
+
+	scsi_scan_host(host);
+
+	return 0;
+
+out_reset_adapter:
+	ll_adapter_reset(adapter);
+out_release_resources:
+	pvscsi_release_resources(adapter);
+out_free_host:
+	scsi_host_put(host);
+out_disable_device:
+	pci_set_drvdata(pdev, NULL);
+	pci_disable_device(pdev);
+
+	return error;
+}
+
+static void __pvscsi_shutdown(struct pvscsi_adapter *adapter)
+{
+	pvscsi_mask_intr(adapter);
+
+	if (adapter->workqueue)
+		flush_workqueue(adapter->workqueue);
+
+	pvscsi_shutdown_intr(adapter);
+
+	pvscsi_process_request_ring(adapter);
+	pvscsi_process_completion_ring(adapter);
+	ll_adapter_reset(adapter);
+}
+
+static void pvscsi_shutdown(struct pci_dev *dev)
+{
+	struct Scsi_Host *host = pci_get_drvdata(dev);
+	struct pvscsi_adapter *adapter = shost_priv(host);
+
+	__pvscsi_shutdown(adapter);
+}
+
+static void pvscsi_remove(struct pci_dev *pdev)
+{
+	struct Scsi_Host *host = pci_get_drvdata(pdev);
+	struct pvscsi_adapter *adapter = shost_priv(host);
+
+	scsi_remove_host(host);
+
+	__pvscsi_shutdown(adapter);
+	pvscsi_release_resources(adapter);
+
+	scsi_host_put(host);
+
+	pci_set_drvdata(pdev, NULL);
+	pci_disable_device(pdev);
+}
+
+static struct pci_driver pvscsi_pci_driver = {
+	.name		= "vmw_pvscsi",
+	.id_table	= pvscsi_pci_tbl,
+	.probe		= pvscsi_probe,
+	.remove		= __devexit_p(pvscsi_remove),
+	.shutdown       = pvscsi_shutdown,
+};
+
+static int __init pvscsi_init(void)
+{
+	pr_info("%s - version %s\n",
+		PVSCSI_LINUX_DRIVER_DESC, PVSCSI_DRIVER_VERSION_STRING);
+	return pci_register_driver(&pvscsi_pci_driver);
+}
+
+static void __exit pvscsi_exit(void)
+{
+	pci_unregister_driver(&pvscsi_pci_driver);
+}
+
+module_init(pvscsi_init);
+module_exit(pvscsi_exit);
diff --git a/drivers/scsi/vmw_pvscsi.h b/drivers/scsi/vmw_pvscsi.h
new file mode 100644
index 000000000000..62e36e75715e
--- /dev/null
+++ b/drivers/scsi/vmw_pvscsi.h
@@ -0,0 +1,397 @@
+/*
+ * VMware PVSCSI header file
+ *
+ * Copyright (C) 2008-2009, VMware, Inc. All Rights Reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License and no later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ * NON INFRINGEMENT.  See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Maintained by: Alok N Kataria <akataria@vmware.com>
+ *
+ */
+
+#ifndef _VMW_PVSCSI_H_
+#define _VMW_PVSCSI_H_
+
+#include <linux/types.h>
+
+#define PVSCSI_DRIVER_VERSION_STRING   "1.0.1.0-k"
+
+#define PVSCSI_MAX_NUM_SG_ENTRIES_PER_SEGMENT 128
+
+#define MASK(n)        ((1 << (n)) - 1)        /* make an n-bit mask */
+
+#define PCI_VENDOR_ID_VMWARE		0x15AD
+#define PCI_DEVICE_ID_VMWARE_PVSCSI	0x07C0
+
+/*
+ * host adapter status/error codes
+ */
+enum HostBusAdapterStatus {
+   BTSTAT_SUCCESS       = 0x00,  /* CCB complete normally with no errors */
+   BTSTAT_LINKED_COMMAND_COMPLETED           = 0x0a,
+   BTSTAT_LINKED_COMMAND_COMPLETED_WITH_FLAG = 0x0b,
+   BTSTAT_DATA_UNDERRUN = 0x0c,
+   BTSTAT_SELTIMEO      = 0x11,  /* SCSI selection timeout */
+   BTSTAT_DATARUN       = 0x12,  /* data overrun/underrun */
+   BTSTAT_BUSFREE       = 0x13,  /* unexpected bus free */
+   BTSTAT_INVPHASE      = 0x14,  /* invalid bus phase or sequence requested by target */
+   BTSTAT_LUNMISMATCH   = 0x17,  /* linked CCB has different LUN from first CCB */
+   BTSTAT_SENSFAILED    = 0x1b,  /* auto request sense failed */
+   BTSTAT_TAGREJECT     = 0x1c,  /* SCSI II tagged queueing message rejected by target */
+   BTSTAT_BADMSG        = 0x1d,  /* unsupported message received by the host adapter */
+   BTSTAT_HAHARDWARE    = 0x20,  /* host adapter hardware failed */
+   BTSTAT_NORESPONSE    = 0x21,  /* target did not respond to SCSI ATN, sent a SCSI RST */
+   BTSTAT_SENTRST       = 0x22,  /* host adapter asserted a SCSI RST */
+   BTSTAT_RECVRST       = 0x23,  /* other SCSI devices asserted a SCSI RST */
+   BTSTAT_DISCONNECT    = 0x24,  /* target device reconnected improperly (w/o tag) */
+   BTSTAT_BUSRESET      = 0x25,  /* host adapter issued BUS device reset */
+   BTSTAT_ABORTQUEUE    = 0x26,  /* abort queue generated */
+   BTSTAT_HASOFTWARE    = 0x27,  /* host adapter software error */
+   BTSTAT_HATIMEOUT     = 0x30,  /* host adapter hardware timeout error */
+   BTSTAT_SCSIPARITY    = 0x34,  /* SCSI parity error detected */
+};
+
+/*
+ * Register offsets.
+ *
+ * These registers are accessible both via i/o space and mm i/o.
+ */
+
+enum PVSCSIRegOffset {
+	PVSCSI_REG_OFFSET_COMMAND        =    0x0,
+	PVSCSI_REG_OFFSET_COMMAND_DATA   =    0x4,
+	PVSCSI_REG_OFFSET_COMMAND_STATUS =    0x8,
+	PVSCSI_REG_OFFSET_LAST_STS_0     =  0x100,
+	PVSCSI_REG_OFFSET_LAST_STS_1     =  0x104,
+	PVSCSI_REG_OFFSET_LAST_STS_2     =  0x108,
+	PVSCSI_REG_OFFSET_LAST_STS_3     =  0x10c,
+	PVSCSI_REG_OFFSET_INTR_STATUS    = 0x100c,
+	PVSCSI_REG_OFFSET_INTR_MASK      = 0x2010,
+	PVSCSI_REG_OFFSET_KICK_NON_RW_IO = 0x3014,
+	PVSCSI_REG_OFFSET_DEBUG          = 0x3018,
+	PVSCSI_REG_OFFSET_KICK_RW_IO     = 0x4018,
+};
+
+/*
+ * Virtual h/w commands.
+ */
+
+enum PVSCSICommands {
+	PVSCSI_CMD_FIRST             = 0, /* has to be first */
+
+	PVSCSI_CMD_ADAPTER_RESET     = 1,
+	PVSCSI_CMD_ISSUE_SCSI        = 2,
+	PVSCSI_CMD_SETUP_RINGS       = 3,
+	PVSCSI_CMD_RESET_BUS         = 4,
+	PVSCSI_CMD_RESET_DEVICE      = 5,
+	PVSCSI_CMD_ABORT_CMD         = 6,
+	PVSCSI_CMD_CONFIG            = 7,
+	PVSCSI_CMD_SETUP_MSG_RING    = 8,
+	PVSCSI_CMD_DEVICE_UNPLUG     = 9,
+
+	PVSCSI_CMD_LAST              = 10  /* has to be last */
+};
+
+/*
+ * Command descriptor for PVSCSI_CMD_RESET_DEVICE --
+ */
+
+struct PVSCSICmdDescResetDevice {
+	u32	target;
+	u8	lun[8];
+} __packed;
+
+/*
+ * Command descriptor for PVSCSI_CMD_ABORT_CMD --
+ *
+ * - currently does not support specifying the LUN.
+ * - _pad should be 0.
+ */
+
+struct PVSCSICmdDescAbortCmd {
+	u64	context;
+	u32	target;
+	u32	_pad;
+} __packed;
+
+/*
+ * Command descriptor for PVSCSI_CMD_SETUP_RINGS --
+ *
+ * Notes:
+ * - reqRingNumPages and cmpRingNumPages need to be power of two.
+ * - reqRingNumPages and cmpRingNumPages need to be different from 0,
+ * - reqRingNumPages and cmpRingNumPages need to be inferior to
+ *   PVSCSI_SETUP_RINGS_MAX_NUM_PAGES.
+ */
+
+#define PVSCSI_SETUP_RINGS_MAX_NUM_PAGES        32
+struct PVSCSICmdDescSetupRings {
+	u32	reqRingNumPages;
+	u32	cmpRingNumPages;
+	u64	ringsStatePPN;
+	u64	reqRingPPNs[PVSCSI_SETUP_RINGS_MAX_NUM_PAGES];
+	u64	cmpRingPPNs[PVSCSI_SETUP_RINGS_MAX_NUM_PAGES];
+} __packed;
+
+/*
+ * Command descriptor for PVSCSI_CMD_SETUP_MSG_RING --
+ *
+ * Notes:
+ * - this command was not supported in the initial revision of the h/w
+ *   interface. Before using it, you need to check that it is supported by
+ *   writing PVSCSI_CMD_SETUP_MSG_RING to the 'command' register, then
+ *   immediately after read the 'command status' register:
+ *       * a value of -1 means that the cmd is NOT supported,
+ *       * a value != -1 means that the cmd IS supported.
+ *   If it's supported the 'command status' register should return:
+ *      sizeof(PVSCSICmdDescSetupMsgRing) / sizeof(u32).
+ * - this command should be issued _after_ the usual SETUP_RINGS so that the
+ *   RingsState page is already setup. If not, the command is a nop.
+ * - numPages needs to be a power of two,
+ * - numPages needs to be different from 0,
+ * - _pad should be zero.
+ */
+
+#define PVSCSI_SETUP_MSG_RING_MAX_NUM_PAGES  16
+
+struct PVSCSICmdDescSetupMsgRing {
+	u32	numPages;
+	u32	_pad;
+	u64	ringPPNs[PVSCSI_SETUP_MSG_RING_MAX_NUM_PAGES];
+} __packed;
+
+enum PVSCSIMsgType {
+	PVSCSI_MSG_DEV_ADDED          = 0,
+	PVSCSI_MSG_DEV_REMOVED        = 1,
+	PVSCSI_MSG_LAST               = 2,
+};
+
+/*
+ * Msg descriptor.
+ *
+ * sizeof(struct PVSCSIRingMsgDesc) == 128.
+ *
+ * - type is of type enum PVSCSIMsgType.
+ * - the content of args depend on the type of event being delivered.
+ */
+
+struct PVSCSIRingMsgDesc {
+	u32	type;
+	u32	args[31];
+} __packed;
+
+struct PVSCSIMsgDescDevStatusChanged {
+	u32	type;  /* PVSCSI_MSG_DEV _ADDED / _REMOVED */
+	u32	bus;
+	u32	target;
+	u8	lun[8];
+	u32	pad[27];
+} __packed;
+
+/*
+ * Rings state.
+ *
+ * - the fields:
+ *    . msgProdIdx,
+ *    . msgConsIdx,
+ *    . msgNumEntriesLog2,
+ *   .. are only used once the SETUP_MSG_RING cmd has been issued.
+ * - '_pad' helps to ensure that the msg related fields are on their own
+ *   cache-line.
+ */
+
+struct PVSCSIRingsState {
+	u32	reqProdIdx;
+	u32	reqConsIdx;
+	u32	reqNumEntriesLog2;
+
+	u32	cmpProdIdx;
+	u32	cmpConsIdx;
+	u32	cmpNumEntriesLog2;
+
+	u8	_pad[104];
+
+	u32	msgProdIdx;
+	u32	msgConsIdx;
+	u32	msgNumEntriesLog2;
+} __packed;
+
+/*
+ * Request descriptor.
+ *
+ * sizeof(RingReqDesc) = 128
+ *
+ * - context: is a unique identifier of a command. It could normally be any
+ *   64bit value, however we currently store it in the serialNumber variable
+ *   of struct SCSI_Command, so we have the following restrictions due to the
+ *   way this field is handled in the vmkernel storage stack:
+ *    * this value can't be 0,
+ *    * the upper 32bit need to be 0 since serialNumber is as a u32.
+ *   Currently tracked as PR 292060.
+ * - dataLen: contains the total number of bytes that need to be transferred.
+ * - dataAddr:
+ *   * if PVSCSI_FLAG_CMD_WITH_SG_LIST is set: dataAddr is the PA of the first
+ *     s/g table segment, each s/g segment is entirely contained on a single
+ *     page of physical memory,
+ *   * if PVSCSI_FLAG_CMD_WITH_SG_LIST is NOT set, then dataAddr is the PA of
+ *     the buffer used for the DMA transfer,
+ * - flags:
+ *   * PVSCSI_FLAG_CMD_WITH_SG_LIST: see dataAddr above,
+ *   * PVSCSI_FLAG_CMD_DIR_NONE: no DMA involved,
+ *   * PVSCSI_FLAG_CMD_DIR_TOHOST: transfer from device to main memory,
+ *   * PVSCSI_FLAG_CMD_DIR_TODEVICE: transfer from main memory to device,
+ *   * PVSCSI_FLAG_CMD_OUT_OF_BAND_CDB: reserved to handle CDBs larger than
+ *     16bytes. To be specified.
+ * - vcpuHint: vcpuId of the processor that will be most likely waiting for the
+ *   completion of the i/o. For guest OSes that use lowest priority message
+ *   delivery mode (such as windows), we use this "hint" to deliver the
+ *   completion action to the proper vcpu. For now, we can use the vcpuId of
+ *   the processor that initiated the i/o as a likely candidate for the vcpu
+ *   that will be waiting for the completion..
+ * - bus should be 0: we currently only support bus 0 for now.
+ * - unused should be zero'd.
+ */
+
+#define PVSCSI_FLAG_CMD_WITH_SG_LIST        (1 << 0)
+#define PVSCSI_FLAG_CMD_OUT_OF_BAND_CDB     (1 << 1)
+#define PVSCSI_FLAG_CMD_DIR_NONE            (1 << 2)
+#define PVSCSI_FLAG_CMD_DIR_TOHOST          (1 << 3)
+#define PVSCSI_FLAG_CMD_DIR_TODEVICE        (1 << 4)
+
+struct PVSCSIRingReqDesc {
+	u64	context;
+	u64	dataAddr;
+	u64	dataLen;
+	u64	senseAddr;
+	u32	senseLen;
+	u32	flags;
+	u8	cdb[16];
+	u8	cdbLen;
+	u8	lun[8];
+	u8	tag;
+	u8	bus;
+	u8	target;
+	u8	vcpuHint;
+	u8	unused[59];
+} __packed;
+
+/*
+ * Scatter-gather list management.
+ *
+ * As described above, when PVSCSI_FLAG_CMD_WITH_SG_LIST is set in the
+ * RingReqDesc.flags, then RingReqDesc.dataAddr is the PA of the first s/g
+ * table segment.
+ *
+ * - each segment of the s/g table contain a succession of struct
+ *   PVSCSISGElement.
+ * - each segment is entirely contained on a single physical page of memory.
+ * - a "chain" s/g element has the flag PVSCSI_SGE_FLAG_CHAIN_ELEMENT set in
+ *   PVSCSISGElement.flags and in this case:
+ *     * addr is the PA of the next s/g segment,
+ *     * length is undefined, assumed to be 0.
+ */
+
+struct PVSCSISGElement {
+	u64	addr;
+	u32	length;
+	u32	flags;
+} __packed;
+
+/*
+ * Completion descriptor.
+ *
+ * sizeof(RingCmpDesc) = 32
+ *
+ * - context: identifier of the command. The same thing that was specified
+ *   under "context" as part of struct RingReqDesc at initiation time,
+ * - dataLen: number of bytes transferred for the actual i/o operation,
+ * - senseLen: number of bytes written into the sense buffer,
+ * - hostStatus: adapter status,
+ * - scsiStatus: device status,
+ * - _pad should be zero.
+ */
+
+struct PVSCSIRingCmpDesc {
+	u64	context;
+	u64	dataLen;
+	u32	senseLen;
+	u16	hostStatus;
+	u16	scsiStatus;
+	u32	_pad[2];
+} __packed;
+
+/*
+ * Interrupt status / IRQ bits.
+ */
+
+#define PVSCSI_INTR_CMPL_0                 (1 << 0)
+#define PVSCSI_INTR_CMPL_1                 (1 << 1)
+#define PVSCSI_INTR_CMPL_MASK              MASK(2)
+
+#define PVSCSI_INTR_MSG_0                  (1 << 2)
+#define PVSCSI_INTR_MSG_1                  (1 << 3)
+#define PVSCSI_INTR_MSG_MASK               (MASK(2) << 2)
+
+#define PVSCSI_INTR_ALL_SUPPORTED          MASK(4)
+
+/*
+ * Number of MSI-X vectors supported.
+ */
+#define PVSCSI_MAX_INTRS        24
+
+/*
+ * Enumeration of supported MSI-X vectors
+ */
+#define PVSCSI_VECTOR_COMPLETION   0
+
+/*
+ * Misc constants for the rings.
+ */
+
+#define PVSCSI_MAX_NUM_PAGES_REQ_RING   PVSCSI_SETUP_RINGS_MAX_NUM_PAGES
+#define PVSCSI_MAX_NUM_PAGES_CMP_RING   PVSCSI_SETUP_RINGS_MAX_NUM_PAGES
+#define PVSCSI_MAX_NUM_PAGES_MSG_RING   PVSCSI_SETUP_MSG_RING_MAX_NUM_PAGES
+
+#define PVSCSI_MAX_NUM_REQ_ENTRIES_PER_PAGE \
+				(PAGE_SIZE / sizeof(struct PVSCSIRingReqDesc))
+
+#define PVSCSI_MAX_REQ_QUEUE_DEPTH \
+	(PVSCSI_MAX_NUM_PAGES_REQ_RING * PVSCSI_MAX_NUM_REQ_ENTRIES_PER_PAGE)
+
+#define PVSCSI_MEM_SPACE_COMMAND_NUM_PAGES     1
+#define PVSCSI_MEM_SPACE_INTR_STATUS_NUM_PAGES 1
+#define PVSCSI_MEM_SPACE_MISC_NUM_PAGES        2
+#define PVSCSI_MEM_SPACE_KICK_IO_NUM_PAGES     2
+#define PVSCSI_MEM_SPACE_MSIX_NUM_PAGES        2
+
+enum PVSCSIMemSpace {
+	PVSCSI_MEM_SPACE_COMMAND_PAGE		= 0,
+	PVSCSI_MEM_SPACE_INTR_STATUS_PAGE	= 1,
+	PVSCSI_MEM_SPACE_MISC_PAGE		= 2,
+	PVSCSI_MEM_SPACE_KICK_IO_PAGE		= 4,
+	PVSCSI_MEM_SPACE_MSIX_TABLE_PAGE	= 6,
+	PVSCSI_MEM_SPACE_MSIX_PBA_PAGE		= 7,
+};
+
+#define PVSCSI_MEM_SPACE_NUM_PAGES \
+	(PVSCSI_MEM_SPACE_COMMAND_NUM_PAGES +       \
+	 PVSCSI_MEM_SPACE_INTR_STATUS_NUM_PAGES +   \
+	 PVSCSI_MEM_SPACE_MISC_NUM_PAGES +          \
+	 PVSCSI_MEM_SPACE_KICK_IO_NUM_PAGES +       \
+	 PVSCSI_MEM_SPACE_MSIX_NUM_PAGES)
+
+#define PVSCSI_MEM_SPACE_SIZE        (PVSCSI_MEM_SPACE_NUM_PAGES * PAGE_SIZE)
+
+#endif /* _VMW_PVSCSI_H_ */
diff --git a/drivers/scsi/wd7000.c b/drivers/scsi/wd7000.c
index 093610bcfcce..2f6e9d8eaf71 100644
--- a/drivers/scsi/wd7000.c
+++ b/drivers/scsi/wd7000.c
@@ -161,7 +161,7 @@
  *
  * 2003/02/12 - Christoph Hellwig <hch@infradead.org>
  *
- * Cleaned up host template defintion
+ * Cleaned up host template definition
  * Removed now obsolete wd7000.h
  */
 
diff --git a/drivers/serial/21285.c b/drivers/serial/21285.c
index 1e3d19397a59..8681f1345056 100644
--- a/drivers/serial/21285.c
+++ b/drivers/serial/21285.c
@@ -58,7 +58,7 @@ static const char serial21285_name[] = "Footbridge UART";
 static void serial21285_stop_tx(struct uart_port *port)
 {
 	if (tx_enabled(port)) {
-		disable_irq(IRQ_CONTX);
+		disable_irq_nosync(IRQ_CONTX);
 		tx_enabled(port) = 0;
 	}
 }
@@ -74,7 +74,7 @@ static void serial21285_start_tx(struct uart_port *port)
 static void serial21285_stop_rx(struct uart_port *port)
 {
 	if (rx_enabled(port)) {
-		disable_irq(IRQ_CONRX);
+		disable_irq_nosync(IRQ_CONRX);
 		rx_enabled(port) = 0;
 	}
 }
diff --git a/drivers/serial/8250.c b/drivers/serial/8250.c
index 737b4c960971..c3e37c8e7e26 100644
--- a/drivers/serial/8250.c
+++ b/drivers/serial/8250.c
@@ -1339,14 +1339,12 @@ static void serial8250_start_tx(struct uart_port *port)
 		serial_out(up, UART_IER, up->ier);
 
 		if (up->bugs & UART_BUG_TXEN) {
-			unsigned char lsr, iir;
+			unsigned char lsr;
 			lsr = serial_in(up, UART_LSR);
 			up->lsr_saved_flags |= lsr & LSR_SAVE_FLAGS;
-			iir = serial_in(up, UART_IIR) & 0x0f;
 			if ((up->port.type == PORT_RM9000) ?
-				(lsr & UART_LSR_THRE &&
-				(iir == UART_IIR_NO_INT || iir == UART_IIR_THRI)) :
-				(lsr & UART_LSR_TEMT && iir & UART_IIR_NO_INT))
+				(lsr & UART_LSR_THRE) :
+				(lsr & UART_LSR_TEMT))
 				transmit_chars(up);
 		}
 	}
@@ -2646,7 +2644,7 @@ static void __init serial8250_isa_init_ports(void)
 {
 	struct uart_8250_port *up;
 	static int first = 1;
-	int i;
+	int i, irqflag = 0;
 
 	if (!first)
 		return;
@@ -2670,6 +2668,9 @@ static void __init serial8250_isa_init_ports(void)
 		up->port.ops = &serial8250_pops;
 	}
 
+	if (share_irqs)
+		irqflag = IRQF_SHARED;
+
 	for (i = 0, up = serial8250_ports;
 	     i < ARRAY_SIZE(old_serial_port) && i < nr_uarts;
 	     i++, up++) {
@@ -2683,8 +2684,7 @@ static void __init serial8250_isa_init_ports(void)
 		up->port.iotype   = old_serial_port[i].io_type;
 		up->port.regshift = old_serial_port[i].iomem_reg_shift;
 		set_io_from_upio(&up->port);
-		if (share_irqs)
-			up->port.irqflags |= IRQF_SHARED;
+		up->port.irqflags |= irqflag;
 	}
 }
 
@@ -2940,10 +2940,13 @@ static int __devinit serial8250_probe(struct platform_device *dev)
 {
 	struct plat_serial8250_port *p = dev->dev.platform_data;
 	struct uart_port port;
-	int ret, i;
+	int ret, i, irqflag = 0;
 
 	memset(&port, 0, sizeof(struct uart_port));
 
+	if (share_irqs)
+		irqflag = IRQF_SHARED;
+
 	for (i = 0; p && p->flags != 0; p++, i++) {
 		port.iobase		= p->iobase;
 		port.membase		= p->membase;
@@ -2960,8 +2963,7 @@ static int __devinit serial8250_probe(struct platform_device *dev)
 		port.serial_in		= p->serial_in;
 		port.serial_out		= p->serial_out;
 		port.dev		= &dev->dev;
-		if (share_irqs)
-			port.irqflags |= IRQF_SHARED;
+		port.irqflags		|= irqflag;
 		ret = serial8250_register_port(&port);
 		if (ret < 0) {
 			dev_err(&dev->dev, "unable to register port at index %d "
diff --git a/drivers/serial/8250_pnp.c b/drivers/serial/8250_pnp.c
index d71dfe398940..24485cc62ff8 100644
--- a/drivers/serial/8250_pnp.c
+++ b/drivers/serial/8250_pnp.c
@@ -328,15 +328,7 @@ static const struct pnp_device_id pnp_dev_table[] = {
 	/* U.S. Robotics 56K Voice INT PnP*/
 	{	"USR9190",		0	},
 	/* Wacom tablets */
-	{	"WACF004",		0	},
-	{	"WACF005",		0	},
-	{       "WACF006",              0       },
-	{       "WACF007",              0       },
-	{       "WACF008",              0       },
-	{       "WACF009",              0       },
-	{       "WACF00A",              0       },
-	{       "WACF00B",              0       },
-	{       "WACF00C",              0       },
+	{	"WACFXXX",		0	},
 	/* Compaq touchscreen */
 	{       "FPI2002",              0 },
 	/* Fujitsu Stylistic touchscreens */
@@ -354,6 +346,8 @@ static const struct pnp_device_id pnp_dev_table[] = {
 	{	"FUJ02E5",		0	},
 	/* Fujitsu P-series tablet PC device */
 	{	"FUJ02E6",		0	},
+	/* Fujitsu Wacom 2FGT Tablet PC device */
+	{	"FUJ02E7",		0	},
 	/*
 	 * LG C1 EXPRESS DUAL (C1-PB11A3) touch screen (actually a FUJ02E6 in
 	 * disguise)
@@ -361,9 +355,9 @@ static const struct pnp_device_id pnp_dev_table[] = {
 	{	"LTS0001",		0       },
 	/* Rockwell's (PORALiNK) 33600 INT PNP */
 	{	"WCI0003",		0	},
-	/* Unkown PnP modems */
+	/* Unknown PnP modems */
 	{	"PNPCXXX",		UNKNOWN_DEV	},
-	/* More unkown PnP modems */
+	/* More unknown PnP modems */
 	{	"PNPDXXX",		UNKNOWN_DEV	},
 	{	"",			0	}
 };
diff --git a/drivers/serial/Kconfig b/drivers/serial/Kconfig
index 50943ff78f4b..9ff47db0b2ce 100644
--- a/drivers/serial/Kconfig
+++ b/drivers/serial/Kconfig
@@ -996,7 +996,7 @@ config SERIAL_IP22_ZILOG_CONSOLE
 
 config SERIAL_SH_SCI
 	tristate "SuperH SCI(F) serial port support"
-	depends on SUPERH || H8300
+	depends on HAVE_CLK && (SUPERH || H8300)
 	select SERIAL_CORE
 
 config SERIAL_SH_SCI_NR_UARTS
diff --git a/drivers/serial/imx.c b/drivers/serial/imx.c
index 18130f11238e..60d665a17a88 100644
--- a/drivers/serial/imx.c
+++ b/drivers/serial/imx.c
@@ -1088,7 +1088,7 @@ imx_console_get_options(struct imx_port *sport, int *baud,
 			   int *parity, int *bits)
 {
 
-	if ( readl(sport->port.membase + UCR1) | UCR1_UARTEN ) {
+	if (readl(sport->port.membase + UCR1) & UCR1_UARTEN) {
 		/* ok, the port was enabled */
 		unsigned int ucr2, ubir,ubmr, uartclk;
 		unsigned int baud_raw;
diff --git a/drivers/serial/ioc3_serial.c b/drivers/serial/ioc3_serial.c
index d8983dd5c4b2..85dc0410ac1a 100644
--- a/drivers/serial/ioc3_serial.c
+++ b/drivers/serial/ioc3_serial.c
@@ -2162,7 +2162,7 @@ static struct ioc3_submodule ioc3uart_ops = {
 /**
  * ioc3_detect - module init called,
  */
-static int __devinit ioc3uart_init(void)
+static int __init ioc3uart_init(void)
 {
 	int ret;
 
@@ -2179,7 +2179,7 @@ static int __devinit ioc3uart_init(void)
 	return ret;
 }
 
-static void __devexit ioc3uart_exit(void)
+static void __exit ioc3uart_exit(void)
 {
 	ioc3_unregister_submodule(&ioc3uart_ops);
 	uart_unregister_driver(&ioc3_uart);
diff --git a/drivers/serial/ioc4_serial.c b/drivers/serial/ioc4_serial.c
index 2e02c3026d24..836d9ab4f729 100644
--- a/drivers/serial/ioc4_serial.c
+++ b/drivers/serial/ioc4_serial.c
@@ -2904,7 +2904,7 @@ static struct ioc4_submodule ioc4_serial_submodule = {
 /**
  * ioc4_serial_init - module init
  */
-int ioc4_serial_init(void)
+static int __init ioc4_serial_init(void)
 {
 	int ret;
 
@@ -2913,20 +2913,30 @@ int ioc4_serial_init(void)
 		printk(KERN_WARNING
 			"%s: Couldn't register rs232 IOC4 serial driver\n",
 			__func__);
-		return ret;
+		goto out;
 	}
 	if ((ret = uart_register_driver(&ioc4_uart_rs422)) < 0) {
 		printk(KERN_WARNING
 			"%s: Couldn't register rs422 IOC4 serial driver\n",
 			__func__);
-		return ret;
+		goto out_uart_rs232;
 	}
 
 	/* register with IOC4 main module */
-	return ioc4_register_submodule(&ioc4_serial_submodule);
+	ret = ioc4_register_submodule(&ioc4_serial_submodule);
+	if (ret)
+		goto out_uart_rs422;
+	return 0;
+
+out_uart_rs422:
+	uart_unregister_driver(&ioc4_uart_rs422);
+out_uart_rs232:
+	uart_unregister_driver(&ioc4_uart_rs232);
+out:
+	return ret;
 }
 
-static void __devexit ioc4_serial_exit(void)
+static void __exit ioc4_serial_exit(void)
 {
 	ioc4_unregister_submodule(&ioc4_serial_submodule);
 	uart_unregister_driver(&ioc4_uart_rs232);
diff --git a/drivers/serial/jsm/jsm.h b/drivers/serial/jsm/jsm.h
index 4e5f3bde0461..38a509c684cd 100644
--- a/drivers/serial/jsm/jsm.h
+++ b/drivers/serial/jsm/jsm.h
@@ -138,7 +138,6 @@ struct jsm_board
 	u32		nasync;		/* Number of ports on card */
 
 	u32		irq;		/* Interrupt request number */
-	u64		intr_count;	/* Count of interrupts */
 
 	u64		membase;	/* Start of base memory of the card */
 	u64		membase_end;	/* End of base memory of the card */
@@ -206,8 +205,6 @@ struct jsm_channel {
 
 	u64		ch_close_delay;	/* How long we should drop RTS/DTR for */
 
-	u64		ch_cpstime;	/* Time for CPS calculations	*/
-
 	tcflag_t	ch_c_iflag;	/* channel iflags		*/
 	tcflag_t	ch_c_cflag;	/* channel cflags		*/
 	tcflag_t	ch_c_oflag;	/* channel oflags		*/
@@ -215,11 +212,6 @@ struct jsm_channel {
 	u8		ch_stopc;	/* Stop character		*/
 	u8		ch_startc;	/* Start character		*/
 
-	u32		ch_old_baud;	/* Cache of the current baud */
-	u32		ch_custom_speed;/* Custom baud, if set */
-
-	u32		ch_wopen;	/* Waiting for open process cnt */
-
 	u8		ch_mostat;	/* FEP output modem status	*/
 	u8		ch_mistat;	/* FEP input modem status	*/
 
diff --git a/drivers/serial/jsm/jsm_driver.c b/drivers/serial/jsm/jsm_driver.c
index b3604aa322a4..108c3e0471fd 100644
--- a/drivers/serial/jsm/jsm_driver.c
+++ b/drivers/serial/jsm/jsm_driver.c
@@ -48,6 +48,17 @@ struct uart_driver jsm_uart_driver = {
 	.nr		= NR_PORTS,
 };
 
+static pci_ers_result_t jsm_io_error_detected(struct pci_dev *pdev,
+                                       pci_channel_state_t state);
+static pci_ers_result_t jsm_io_slot_reset(struct pci_dev *pdev);
+static void jsm_io_resume(struct pci_dev *pdev);
+
+static struct pci_error_handlers jsm_err_handler = {
+	.error_detected = jsm_io_error_detected,
+	.slot_reset = jsm_io_slot_reset,
+	.resume = jsm_io_resume,
+};
+
 int jsm_debug;
 module_param(jsm_debug, int, 0);
 MODULE_PARM_DESC(jsm_debug, "Driver debugging level");
@@ -123,7 +134,7 @@ static int __devinit jsm_probe_one(struct pci_dev *pdev, const struct pci_device
 	}
 
 	rc = request_irq(brd->irq, brd->bd_ops->intr,
-			IRQF_DISABLED|IRQF_SHARED, "JSM", brd);
+			IRQF_SHARED, "JSM", brd);
 	if (rc) {
 		printk(KERN_WARNING "Failed to hook IRQ %d\n",brd->irq);
 		goto out_iounmap;
@@ -164,6 +175,7 @@ static int __devinit jsm_probe_one(struct pci_dev *pdev, const struct pci_device
 	}
 
 	pci_set_drvdata(pdev, brd);
+	pci_save_state(pdev);
 
 	return 0;
  out_free_irq:
@@ -222,8 +234,42 @@ static struct pci_driver jsm_driver = {
 	.id_table	= jsm_pci_tbl,
 	.probe		= jsm_probe_one,
 	.remove		= __devexit_p(jsm_remove_one),
+	.err_handler    = &jsm_err_handler,
 };
 
+static pci_ers_result_t jsm_io_error_detected(struct pci_dev *pdev,
+					pci_channel_state_t state)
+{
+	struct jsm_board *brd = pci_get_drvdata(pdev);
+
+	jsm_remove_uart_port(brd);
+
+	return PCI_ERS_RESULT_NEED_RESET;
+}
+
+static pci_ers_result_t jsm_io_slot_reset(struct pci_dev *pdev)
+{
+	int rc;
+
+	rc = pci_enable_device(pdev);
+
+	if (rc)
+		return PCI_ERS_RESULT_DISCONNECT;
+
+	pci_set_master(pdev);
+
+	return PCI_ERS_RESULT_RECOVERED;
+}
+
+static void jsm_io_resume(struct pci_dev *pdev)
+{
+	struct jsm_board *brd = pci_get_drvdata(pdev);
+
+	pci_restore_state(pdev);
+
+	jsm_uart_port_init(brd);
+}
+
 static int __init jsm_init_module(void)
 {
 	int rc;
diff --git a/drivers/serial/jsm/jsm_neo.c b/drivers/serial/jsm/jsm_neo.c
index b4b124e4828f..7960d9633c15 100644
--- a/drivers/serial/jsm/jsm_neo.c
+++ b/drivers/serial/jsm/jsm_neo.c
@@ -954,13 +954,8 @@ static void neo_param(struct jsm_channel *ch)
 		ch->ch_flags |= (CH_BAUD0);
 		ch->ch_mostat &= ~(UART_MCR_RTS | UART_MCR_DTR);
 		neo_assert_modem_signals(ch);
-		ch->ch_old_baud = 0;
 		return;
 
-	} else if (ch->ch_custom_speed) {
-			baud = ch->ch_custom_speed;
-			if (ch->ch_flags & CH_BAUD0)
-				ch->ch_flags &= ~(CH_BAUD0);
 	} else {
 		int i;
 		unsigned int cflag;
@@ -1045,7 +1040,6 @@ static void neo_param(struct jsm_channel *ch)
 	quot = ch->ch_bd->bd_dividend / baud;
 
 	if (quot != 0) {
-		ch->ch_old_baud = baud;
 		writeb(UART_LCR_DLAB, &ch->ch_neo_uart->lcr);
 		writeb((quot & 0xff), &ch->ch_neo_uart->txrx);
 		writeb((quot >> 8), &ch->ch_neo_uart->ier);
@@ -1123,8 +1117,6 @@ static irqreturn_t neo_intr(int irq, void *voidbrd)
 	unsigned long lock_flags2;
 	int outofloop_count = 0;
 
-	brd->intr_count++;
-
 	/* Lock out the slow poller from running on this board. */
 	spin_lock_irqsave(&brd->bd_intr_lock, lock_flags);
 
diff --git a/drivers/serial/jsm/jsm_tty.c b/drivers/serial/jsm/jsm_tty.c
index 7439c0373620..cd95e215550d 100644
--- a/drivers/serial/jsm/jsm_tty.c
+++ b/drivers/serial/jsm/jsm_tty.c
@@ -296,8 +296,6 @@ static void jsm_tty_close(struct uart_port *port)
 		bd->bd_ops->assert_modem_signals(channel);
 	}
 
-	channel->ch_old_baud = 0;
-
 	/* Turn off UART interrupts for this port */
 	channel->ch_bd->bd_ops->uart_off(channel);
 
@@ -432,7 +430,7 @@ int __devinit jsm_tty_init(struct jsm_board *brd)
 	return 0;
 }
 
-int __devinit jsm_uart_port_init(struct jsm_board *brd)
+int jsm_uart_port_init(struct jsm_board *brd)
 {
 	int i;
 	unsigned int line;
@@ -472,7 +470,7 @@ int __devinit jsm_uart_port_init(struct jsm_board *brd)
 		if (uart_add_one_port (&jsm_uart_driver, &brd->channels[i]->uart_port))
 			printk(KERN_INFO "jsm: add device failed\n");
 		else
-			printk(KERN_INFO "Added device \n");
+			printk(KERN_INFO "jsm: Port %d added\n", i);
 	}
 
 	jsm_printk(INIT, INFO, &brd->pci_dev, "finish\n");
diff --git a/drivers/serial/mcf.c b/drivers/serial/mcf.c
index b44382442bf1..7bb5fee639e3 100644
--- a/drivers/serial/mcf.c
+++ b/drivers/serial/mcf.c
@@ -602,7 +602,7 @@ static int __devinit mcf_probe(struct platform_device *pdev)
 
 /****************************************************************************/
 
-static int mcf_remove(struct platform_device *pdev)
+static int __devexit mcf_remove(struct platform_device *pdev)
 {
 	struct uart_port *port;
 	int i;
diff --git a/drivers/serial/pmac_zilog.c b/drivers/serial/pmac_zilog.c
index 0700cd10b97c..683e66f18e8c 100644
--- a/drivers/serial/pmac_zilog.c
+++ b/drivers/serial/pmac_zilog.c
@@ -411,6 +411,17 @@ static void pmz_transmit_chars(struct uart_pmac_port *uap)
 		goto ack_tx_int;
 	}
 
+	/* Under some circumstances, we see interrupts reported for
+	 * a closed channel. The interrupt mask in R1 is clear, but
+	 * R3 still signals the interrupts and we see them when taking
+	 * an interrupt for the other channel (this could be a qemu
+	 * bug but since the ESCC doc doesn't specify precsiely whether
+	 * R3 interrup status bits are masked by R1 interrupt enable
+	 * bits, better safe than sorry). --BenH.
+	 */
+	if (!ZS_IS_OPEN(uap))
+		goto ack_tx_int;
+
 	if (uap->port.x_char) {
 		uap->flags |= PMACZILOG_FLAG_TX_ACTIVE;
 		write_zsdata(uap, uap->port.x_char);
diff --git a/drivers/serial/pmac_zilog.h b/drivers/serial/pmac_zilog.h
index 570b0d925e83..f6e77f12acd5 100644
--- a/drivers/serial/pmac_zilog.h
+++ b/drivers/serial/pmac_zilog.h
@@ -73,7 +73,7 @@ static inline struct uart_pmac_port *pmz_get_port_A(struct uart_pmac_port *uap)
 }
 
 /*
- * Register acessors. Note that we don't need to enforce a recovery
+ * Register accessors. Note that we don't need to enforce a recovery
  * delay on PCI PowerMac hardware, it's dealt in HW by the MacIO chip,
  * though if we try to use this driver on older machines, we might have
  * to add it back
diff --git a/drivers/serial/pxa.c b/drivers/serial/pxa.c
index b8629d74f6a2..56ee082157aa 100644
--- a/drivers/serial/pxa.c
+++ b/drivers/serial/pxa.c
@@ -438,6 +438,7 @@ serial_pxa_set_termios(struct uart_port *port, struct ktermios *termios,
 	unsigned char cval, fcr = 0;
 	unsigned long flags;
 	unsigned int baud, quot;
+	unsigned int dll;
 
 	switch (termios->c_cflag & CSIZE) {
 	case CS5:
@@ -534,10 +535,18 @@ serial_pxa_set_termios(struct uart_port *port, struct ktermios *termios,
 	else
 		up->mcr &= ~UART_MCR_AFE;
 
-	serial_out(up, UART_LCR, cval | UART_LCR_DLAB);/* set DLAB */
+	serial_out(up, UART_LCR, cval | UART_LCR_DLAB);	/* set DLAB */
 	serial_out(up, UART_DLL, quot & 0xff);		/* LS of divisor */
+
+	/*
+	 * work around Errata #75 according to Intel(R) PXA27x Processor Family
+	 * Specification Update (Nov 2005)
+	 */
+	dll = serial_in(up, UART_DLL);
+	WARN_ON(dll != (quot & 0xff));
+
 	serial_out(up, UART_DLM, quot >> 8);		/* MS of divisor */
-	serial_out(up, UART_LCR, cval);		/* reset DLAB */
+	serial_out(up, UART_LCR, cval);			/* reset DLAB */
 	up->lcr = cval;					/* Save LCR */
 	serial_pxa_set_mctrl(&up->port, up->port.mctrl);
 	serial_out(up, UART_FCR, fcr);
@@ -747,7 +756,7 @@ static int serial_pxa_resume(struct device *dev)
         return 0;
 }
 
-static struct dev_pm_ops serial_pxa_pm_ops = {
+static const struct dev_pm_ops serial_pxa_pm_ops = {
 	.suspend	= serial_pxa_suspend,
 	.resume		= serial_pxa_resume,
 };
diff --git a/drivers/serial/serial_core.c b/drivers/serial/serial_core.c
index dcc72444e8e7..7f2830709512 100644
--- a/drivers/serial/serial_core.c
+++ b/drivers/serial/serial_core.c
@@ -342,11 +342,11 @@ uart_get_baud_rate(struct uart_port *port, struct ktermios *termios,
 
 	if (flags == UPF_SPD_HI)
 		altbaud = 57600;
-	if (flags == UPF_SPD_VHI)
+	else if (flags == UPF_SPD_VHI)
 		altbaud = 115200;
-	if (flags == UPF_SPD_SHI)
+	else if (flags == UPF_SPD_SHI)
 		altbaud = 230400;
-	if (flags == UPF_SPD_WARP)
+	else if (flags == UPF_SPD_WARP)
 		altbaud = 460800;
 
 	for (try = 0; try < 2; try++) {
@@ -385,13 +385,20 @@ uart_get_baud_rate(struct uart_port *port, struct ktermios *termios,
 		}
 
 		/*
-		 * As a last resort, if the quotient is zero,
-		 * default to 9600 bps
+		 * As a last resort, if the range cannot be met then clip to
+		 * the nearest chip supported rate.
 		 */
-		if (!hung_up)
-			tty_termios_encode_baud_rate(termios, 9600, 9600);
+		if (!hung_up) {
+			if (baud <= min)
+				tty_termios_encode_baud_rate(termios,
+							min + 1, min + 1);
+			else
+				tty_termios_encode_baud_rate(termios,
+							max - 1, max - 1);
+		}
 	}
-
+	/* Should never happen */
+	WARN_ON(1);
 	return 0;
 }
 
@@ -1217,9 +1224,8 @@ static void uart_set_termios(struct tty_struct *tty,
 	/* Handle transition to B0 status */
 	if ((old_termios->c_cflag & CBAUD) && !(cflag & CBAUD))
 		uart_clear_mctrl(state->uart_port, TIOCM_RTS | TIOCM_DTR);
-
 	/* Handle transition away from B0 status */
-	if (!(old_termios->c_cflag & CBAUD) && (cflag & CBAUD)) {
+	else if (!(old_termios->c_cflag & CBAUD) && (cflag & CBAUD)) {
 		unsigned int mask = TIOCM_DTR;
 		if (!(cflag & CRTSCTS) ||
 		    !test_bit(TTY_THROTTLED, &tty->flags))
@@ -1234,9 +1240,8 @@ static void uart_set_termios(struct tty_struct *tty,
 		__uart_start(tty);
 		spin_unlock_irqrestore(&state->uart_port->lock, flags);
 	}
-
 	/* Handle turning on CRTSCTS */
-	if (!(old_termios->c_cflag & CRTSCTS) && (cflag & CRTSCTS)) {
+	else if (!(old_termios->c_cflag & CRTSCTS) && (cflag & CRTSCTS)) {
 		spin_lock_irqsave(&state->uart_port->lock, flags);
 		if (!(state->uart_port->ops->get_mctrl(state->uart_port) & TIOCM_CTS)) {
 			tty->hw_stopped = 1;
@@ -2008,12 +2013,6 @@ int uart_suspend_port(struct uart_driver *drv, struct uart_port *uport)
 
 	mutex_lock(&port->mutex);
 
-	if (!console_suspend_enabled && uart_console(uport)) {
-		/* we're going to avoid suspending serial console */
-		mutex_unlock(&port->mutex);
-		return 0;
-	}
-
 	tty_dev = device_find_child(uport->dev, &match, serial_match_port);
 	if (device_may_wakeup(tty_dev)) {
 		enable_irq_wake(uport->irq);
@@ -2021,20 +2020,23 @@ int uart_suspend_port(struct uart_driver *drv, struct uart_port *uport)
 		mutex_unlock(&port->mutex);
 		return 0;
 	}
-	uport->suspended = 1;
+	if (console_suspend_enabled || !uart_console(uport))
+		uport->suspended = 1;
 
 	if (port->flags & ASYNC_INITIALIZED) {
 		const struct uart_ops *ops = uport->ops;
 		int tries;
 
-		set_bit(ASYNCB_SUSPENDED, &port->flags);
-		clear_bit(ASYNCB_INITIALIZED, &port->flags);
+		if (console_suspend_enabled || !uart_console(uport)) {
+			set_bit(ASYNCB_SUSPENDED, &port->flags);
+			clear_bit(ASYNCB_INITIALIZED, &port->flags);
 
-		spin_lock_irq(&uport->lock);
-		ops->stop_tx(uport);
-		ops->set_mctrl(uport, 0);
-		ops->stop_rx(uport);
-		spin_unlock_irq(&uport->lock);
+			spin_lock_irq(&uport->lock);
+			ops->stop_tx(uport);
+			ops->set_mctrl(uport, 0);
+			ops->stop_rx(uport);
+			spin_unlock_irq(&uport->lock);
+		}
 
 		/*
 		 * Wait for the transmitter to empty.
@@ -2049,16 +2051,18 @@ int uart_suspend_port(struct uart_driver *drv, struct uart_port *uport)
 			       drv->dev_name,
 			       drv->tty_driver->name_base + uport->line);
 
-		ops->shutdown(uport);
+		if (console_suspend_enabled || !uart_console(uport))
+			ops->shutdown(uport);
 	}
 
 	/*
 	 * Disable the console device before suspending.
 	 */
-	if (uart_console(uport))
+	if (console_suspend_enabled && uart_console(uport))
 		console_stop(uport->cons);
 
-	uart_change_pm(state, 3);
+	if (console_suspend_enabled || !uart_console(uport))
+		uart_change_pm(state, 3);
 
 	mutex_unlock(&port->mutex);
 
@@ -2075,29 +2079,6 @@ int uart_resume_port(struct uart_driver *drv, struct uart_port *uport)
 
 	mutex_lock(&port->mutex);
 
-	if (!console_suspend_enabled && uart_console(uport)) {
-		/* no need to resume serial console, it wasn't suspended */
-		/*
-		 * First try to use the console cflag setting.
-		 */
-		memset(&termios, 0, sizeof(struct ktermios));
-		termios.c_cflag = uport->cons->cflag;
-		/*
-		 * If that's unset, use the tty termios setting.
-		 */
-		if (termios.c_cflag == 0)
-			termios = *state->port.tty->termios;
-		else {
-			termios.c_ispeed = termios.c_ospeed =
-				tty_termios_input_baud_rate(&termios);
-			termios.c_ispeed = termios.c_ospeed =
-				tty_termios_baud_rate(&termios);
-		}
-		uport->ops->set_termios(uport, &termios, NULL);
-		mutex_unlock(&port->mutex);
-		return 0;
-	}
-
 	tty_dev = device_find_child(uport->dev, &match, serial_match_port);
 	if (!uport->suspended && device_may_wakeup(tty_dev)) {
 		disable_irq_wake(uport->irq);
@@ -2123,21 +2104,23 @@ int uart_resume_port(struct uart_driver *drv, struct uart_port *uport)
 		spin_lock_irq(&uport->lock);
 		ops->set_mctrl(uport, 0);
 		spin_unlock_irq(&uport->lock);
-		ret = ops->startup(uport);
-		if (ret == 0) {
-			uart_change_speed(state, NULL);
-			spin_lock_irq(&uport->lock);
-			ops->set_mctrl(uport, uport->mctrl);
-			ops->start_tx(uport);
-			spin_unlock_irq(&uport->lock);
-			set_bit(ASYNCB_INITIALIZED, &port->flags);
-		} else {
-			/*
-			 * Failed to resume - maybe hardware went away?
-			 * Clear the "initialized" flag so we won't try
-			 * to call the low level drivers shutdown method.
-			 */
-			uart_shutdown(state);
+		if (console_suspend_enabled || !uart_console(uport)) {
+			ret = ops->startup(uport);
+			if (ret == 0) {
+				uart_change_speed(state, NULL);
+				spin_lock_irq(&uport->lock);
+				ops->set_mctrl(uport, uport->mctrl);
+				ops->start_tx(uport);
+				spin_unlock_irq(&uport->lock);
+				set_bit(ASYNCB_INITIALIZED, &port->flags);
+			} else {
+				/*
+				 * Failed to resume - maybe hardware went away?
+				 * Clear the "initialized" flag so we won't try
+				 * to call the low level drivers shutdown method.
+				 */
+				uart_shutdown(state);
+			}
 		}
 
 		clear_bit(ASYNCB_SUSPENDED, &port->flags);
@@ -2344,7 +2327,7 @@ static const struct tty_operations uart_ops = {
  */
 int uart_register_driver(struct uart_driver *drv)
 {
-	struct tty_driver *normal = NULL;
+	struct tty_driver *normal;
 	int i, retval;
 
 	BUG_ON(drv->state);
@@ -2354,13 +2337,12 @@ int uart_register_driver(struct uart_driver *drv)
 	 * we have a large number of ports to handle.
 	 */
 	drv->state = kzalloc(sizeof(struct uart_state) * drv->nr, GFP_KERNEL);
-	retval = -ENOMEM;
 	if (!drv->state)
 		goto out;
 
-	normal  = alloc_tty_driver(drv->nr);
+	normal = alloc_tty_driver(drv->nr);
 	if (!normal)
-		goto out;
+		goto out_kfree;
 
 	drv->tty_driver = normal;
 
@@ -2393,12 +2375,14 @@ int uart_register_driver(struct uart_driver *drv)
 	}
 
 	retval = tty_register_driver(normal);
- out:
-	if (retval < 0) {
-		put_tty_driver(normal);
-		kfree(drv->state);
-	}
-	return retval;
+	if (retval >= 0)
+		return retval;
+
+	put_tty_driver(normal);
+out_kfree:
+	kfree(drv->state);
+out:
+	return -ENOMEM;
 }
 
 /**
diff --git a/drivers/serial/serial_cs.c b/drivers/serial/serial_cs.c
index fc413f0f8dd2..95421fa3b304 100644
--- a/drivers/serial/serial_cs.c
+++ b/drivers/serial/serial_cs.c
@@ -146,7 +146,8 @@ static void quirk_wakeup_oxsemi(struct pcmcia_device *link)
 {
 	struct serial_info *info = link->priv;
 
-	outb(12, info->c950ctrl + 1);
+	if (info->c950ctrl)
+		outb(12, info->c950ctrl + 1);
 }
 
 /* request_region? oxsemi branch does no request_region too... */
@@ -757,6 +758,7 @@ static struct pcmcia_device_id serial_ids[] = {
 	PCMCIA_PFC_DEVICE_PROD_ID12(1, "PCMCIAs", "LanModem", 0xdcfe12d3, 0xc67c648f),
 	PCMCIA_PFC_DEVICE_PROD_ID12(1, "TDK", "GlobalNetworker 3410/3412", 0x1eae9475, 0xd9a93bed),
 	PCMCIA_PFC_DEVICE_PROD_ID12(1, "Xircom", "CreditCard Ethernet+Modem II", 0x2e3ee845, 0xeca401bf),
+	PCMCIA_PFC_DEVICE_MANF_CARD(1, 0x0032, 0x0e01),
 	PCMCIA_PFC_DEVICE_MANF_CARD(1, 0x0032, 0x0a05),
 	PCMCIA_PFC_DEVICE_MANF_CARD(1, 0x0032, 0x1101),
 	PCMCIA_MFC_DEVICE_MANF_CARD(0, 0x0104, 0x0070),
@@ -819,6 +821,7 @@ static struct pcmcia_device_id serial_ids[] = {
 	PCMCIA_MFC_DEVICE_CIS_MANF_CARD(1, 0x0101, 0x0035, "cis/3CXEM556.cis"),
 	PCMCIA_MFC_DEVICE_CIS_MANF_CARD(1, 0x0101, 0x003d, "cis/3CXEM556.cis"),
 	PCMCIA_DEVICE_CIS_PROD_ID12("Sierra Wireless", "AC850", 0xd85f6206, 0x42a2c018, "cis/SW_8xx_SER.cis"), /* Sierra Wireless AC850 3G Network Adapter R1 */
+	PCMCIA_DEVICE_CIS_PROD_ID12("Sierra Wireless", "AC860", 0xd85f6206, 0x698f93db, "cis/SW_8xx_SER.cis"), /* Sierra Wireless AC860 3G Network Adapter R1 */
 	PCMCIA_DEVICE_CIS_PROD_ID12("Sierra Wireless", "AC710/AC750", 0xd85f6206, 0x761b11e0, "cis/SW_7xx_SER.cis"),  /* Sierra Wireless AC710/AC750 GPRS Network Adapter R1 */
 	PCMCIA_DEVICE_CIS_MANF_CARD(0x0192, 0xa555, "cis/SW_555_SER.cis"),  /* Sierra Aircard 555 CDMA 1xrtt Modem -- pre update */
 	PCMCIA_DEVICE_CIS_MANF_CARD(0x013f, 0xa555, "cis/SW_555_SER.cis"),  /* Sierra Aircard 555 CDMA 1xrtt Modem -- post update */
@@ -827,7 +830,7 @@ static struct pcmcia_device_id serial_ids[] = {
 	PCMCIA_DEVICE_CIS_PROD_ID12("ADVANTECH", "COMpad-32/85B-4", 0x96913a85, 0xcec8f102, "cis/COMpad4.cis"),
 	PCMCIA_DEVICE_CIS_PROD_ID123("ADVANTECH", "COMpad-32/85", "1.0", 0x96913a85, 0x8fbe92ae, 0x0877b627, "cis/COMpad2.cis"),
 	PCMCIA_DEVICE_CIS_PROD_ID2("RS-COM 2P", 0xad20b156, "cis/RS-COM-2P.cis"),
-	PCMCIA_DEVICE_CIS_MANF_CARD(0x0013, 0x0000, "GLOBETROTTER.cis"),
+	PCMCIA_DEVICE_CIS_MANF_CARD(0x0013, 0x0000, "cis/GLOBETROTTER.cis"),
 	PCMCIA_DEVICE_PROD_ID12("ELAN DIGITAL SYSTEMS LTD, c1997.","SERIAL CARD: SL100  1.00.",0x19ca78af,0xf964f42b),
 	PCMCIA_DEVICE_PROD_ID12("ELAN DIGITAL SYSTEMS LTD, c1997.","SERIAL CARD: SL100",0x19ca78af,0x71d98e83),
 	PCMCIA_DEVICE_PROD_ID12("ELAN DIGITAL SYSTEMS LTD, c1997.","SERIAL CARD: SL232  1.00.",0x19ca78af,0x69fb7490),
@@ -861,6 +864,18 @@ static struct pcmcia_device_id serial_ids[] = {
 };
 MODULE_DEVICE_TABLE(pcmcia, serial_ids);
 
+MODULE_FIRMWARE("cis/PCMLM28.cis");
+MODULE_FIRMWARE("cis/DP83903.cis");
+MODULE_FIRMWARE("cis/3CCFEM556.cis");
+MODULE_FIRMWARE("cis/3CXEM556.cis");
+MODULE_FIRMWARE("cis/SW_8xx_SER.cis");
+MODULE_FIRMWARE("cis/SW_7xx_SER.cis");
+MODULE_FIRMWARE("cis/SW_555_SER.cis");
+MODULE_FIRMWARE("cis/MT5634ZLX.cis");
+MODULE_FIRMWARE("cis/COMpad2.cis");
+MODULE_FIRMWARE("cis/COMpad4.cis");
+MODULE_FIRMWARE("cis/RS-COM-2P.cis");
+
 static struct pcmcia_driver serial_cs_driver = {
 	.owner		= THIS_MODULE,
 	.drv		= {
diff --git a/drivers/serial/sh-sci.c b/drivers/serial/sh-sci.c
index 6498bd1fb6dd..42f3333c4ad0 100644
--- a/drivers/serial/sh-sci.c
+++ b/drivers/serial/sh-sci.c
@@ -50,7 +50,6 @@
 #include <linux/list.h>
 
 #ifdef CONFIG_SUPERH
-#include <asm/clock.h>
 #include <asm/sh_bios.h>
 #endif
 
@@ -79,22 +78,18 @@ struct sci_port {
 	struct timer_list	break_timer;
 	int			break_flag;
 
-#ifdef CONFIG_HAVE_CLK
 	/* Interface clock */
 	struct clk		*iclk;
 	/* Data clock */
 	struct clk		*dclk;
-#endif
+
 	struct list_head	node;
 };
 
 struct sh_sci_priv {
 	spinlock_t lock;
 	struct list_head ports;
-
-#ifdef CONFIG_HAVE_CLK
 	struct notifier_block clk_nb;
-#endif
 };
 
 /* Function prototypes */
@@ -156,32 +151,6 @@ static void sci_poll_put_char(struct uart_port *port, unsigned char c)
 }
 #endif /* CONFIG_CONSOLE_POLL || CONFIG_SERIAL_SH_SCI_CONSOLE */
 
-#if defined(__H8300S__)
-enum { sci_disable, sci_enable };
-
-static void h8300_sci_config(struct uart_port *port, unsigned int ctrl)
-{
-	volatile unsigned char *mstpcrl = (volatile unsigned char *)MSTPCRL;
-	int ch = (port->mapbase  - SMR0) >> 3;
-	unsigned char mask = 1 << (ch+1);
-
-	if (ctrl == sci_disable)
-		*mstpcrl |= mask;
-	else
-		*mstpcrl &= ~mask;
-}
-
-static void h8300_sci_enable(struct uart_port *port)
-{
-	h8300_sci_config(port, sci_enable);
-}
-
-static void h8300_sci_disable(struct uart_port *port)
-{
-	h8300_sci_config(port, sci_disable);
-}
-#endif
-
 #if defined(__H8300H__) || defined(__H8300S__)
 static void sci_init_pins(struct uart_port *port, unsigned int cflag)
 {
@@ -253,9 +222,9 @@ static inline void sci_init_pins(struct uart_port *port, unsigned int cflag)
 		   Set SCP6MD1,0 = {01} (output)  */
 		__raw_writew((data & 0x0fcf) | 0x1000, SCPCR);
 
-		data = ctrl_inb(SCPDR);
+		data = __raw_readb(SCPDR);
 		/* Set /RTS2 (bit6) = 0 */
-		ctrl_outb(data & 0xbf, SCPDR);
+		__raw_writeb(data & 0xbf, SCPDR);
 	}
 }
 #elif defined(CONFIG_CPU_SUBTYPE_SH7722)
@@ -733,7 +702,6 @@ static irqreturn_t sci_mpxed_interrupt(int irq, void *ptr)
 	return ret;
 }
 
-#ifdef CONFIG_HAVE_CLK
 /*
  * Here we define a transistion notifier so that we can update all of our
  * ports' baud rate when the peripheral clock changes.
@@ -751,7 +719,6 @@ static int sci_notifier(struct notifier_block *self,
 		spin_lock_irqsave(&priv->lock, flags);
 		list_for_each_entry(sci_port, &priv->ports, node)
 			sci_port->port.uartclk = clk_get_rate(sci_port->dclk);
-
 		spin_unlock_irqrestore(&priv->lock, flags);
 	}
 
@@ -778,7 +745,6 @@ static void sci_clk_disable(struct uart_port *port)
 
 	clk_disable(sci_port->dclk);
 }
-#endif
 
 static int sci_request_irq(struct sci_port *port)
 {
@@ -833,8 +799,8 @@ static void sci_free_irq(struct sci_port *port)
 
 static unsigned int sci_tx_empty(struct uart_port *port)
 {
-	/* Can't detect */
-	return TIOCSER_TEMT;
+	unsigned short status = sci_in(port, SCxSR);
+	return status & SCxSR_TEND(port) ? TIOCSER_TEMT : 0;
 }
 
 static void sci_set_mctrl(struct uart_port *port, unsigned int mctrl)
@@ -931,11 +897,21 @@ static void sci_shutdown(struct uart_port *port)
 static void sci_set_termios(struct uart_port *port, struct ktermios *termios,
 			    struct ktermios *old)
 {
-	unsigned int status, baud, smr_val;
+	unsigned int status, baud, smr_val, max_baud;
 	int t = -1;
 
-	baud = uart_get_baud_rate(port, termios, old, 0, port->uartclk/16);
-	if (likely(baud))
+	/*
+	 * earlyprintk comes here early on with port->uartclk set to zero.
+	 * the clock framework is not up and running at this point so here
+	 * we assume that 115200 is the maximum baud rate. please note that
+	 * the baud rate is not programmed during earlyprintk - it is assumed
+	 * that the previous boot loader has enabled required clocks and
+	 * setup the baud rate generator hardware for us already.
+	 */
+	max_baud = port->uartclk ? port->uartclk / 16 : 115200;
+
+	baud = uart_get_baud_rate(port, termios, old, 0, max_baud);
+	if (likely(baud && port->uartclk))
 		t = SCBRR_VALUE(baud, port->uartclk);
 
 	do {
@@ -1076,22 +1052,26 @@ static void __devinit sci_init_single(struct platform_device *dev,
 	sci_port->port.ops	= &sci_uart_ops;
 	sci_port->port.iotype	= UPIO_MEM;
 	sci_port->port.line	= index;
-	sci_port->port.fifosize	= 1;
 
-#if defined(__H8300H__) || defined(__H8300S__)
-#ifdef __H8300S__
-	sci_port->enable	= h8300_sci_enable;
-	sci_port->disable	= h8300_sci_disable;
-#endif
-	sci_port->port.uartclk	= CONFIG_CPU_CLOCK;
-#elif defined(CONFIG_HAVE_CLK)
-	sci_port->iclk		= p->clk ? clk_get(&dev->dev, p->clk) : NULL;
-	sci_port->dclk		= clk_get(&dev->dev, "peripheral_clk");
-	sci_port->enable	= sci_clk_enable;
-	sci_port->disable	= sci_clk_disable;
-#else
-#error "Need a valid uartclk"
-#endif
+	switch (p->type) {
+	case PORT_SCIFA:
+		sci_port->port.fifosize = 64;
+		break;
+	case PORT_SCIF:
+		sci_port->port.fifosize = 16;
+		break;
+	default:
+		sci_port->port.fifosize = 1;
+		break;
+	}
+
+	if (dev) {
+		sci_port->iclk = p->clk ? clk_get(&dev->dev, p->clk) : NULL;
+		sci_port->dclk = clk_get(&dev->dev, "peripheral_clk");
+		sci_port->enable = sci_clk_enable;
+		sci_port->disable = sci_clk_disable;
+		sci_port->port.dev = &dev->dev;
+	}
 
 	sci_port->break_timer.data = (unsigned long)sci_port;
 	sci_port->break_timer.function = sci_break_timer;
@@ -1102,11 +1082,9 @@ static void __devinit sci_init_single(struct platform_device *dev,
 
 	sci_port->port.irq	= p->irqs[SCIx_TXI_IRQ];
 	sci_port->port.flags	= p->flags;
-	sci_port->port.dev	= &dev->dev;
 	sci_port->type		= sci_port->port.type = p->type;
 
 	memcpy(&sci_port->irqs, &p->irqs, sizeof(p->irqs));
-
 }
 
 #ifdef CONFIG_SERIAL_SH_SCI_CONSOLE
@@ -1147,7 +1125,7 @@ static void serial_console_write(struct console *co, const char *s,
 		sci_port->disable(port);
 }
 
-static int __init serial_console_setup(struct console *co, char *options)
+static int __devinit serial_console_setup(struct console *co, char *options)
 {
 	struct sci_port *sci_port;
 	struct uart_port *port;
@@ -1165,9 +1143,14 @@ static int __init serial_console_setup(struct console *co, char *options)
 	if (co->index >= SCI_NPORTS)
 		co->index = 0;
 
-	sci_port = &sci_ports[co->index];
-	port = &sci_port->port;
-	co->data = port;
+	if (co->data) {
+		port = co->data;
+		sci_port = to_sci_port(port);
+	} else {
+		sci_port = &sci_ports[co->index];
+		port = &sci_port->port;
+		co->data = port;
+	}
 
 	/*
 	 * Also need to check port->type, we don't actually have any
@@ -1211,6 +1194,15 @@ static int __init sci_console_init(void)
 	return 0;
 }
 console_initcall(sci_console_init);
+
+static struct sci_port early_serial_port;
+static struct console early_serial_console = {
+	.name           = "early_ttySC",
+	.write          = serial_console_write,
+	.flags          = CON_PRINTBUFFER,
+};
+static char early_serial_buf[32];
+
 #endif /* CONFIG_SERIAL_SH_SCI_CONSOLE */
 
 #if defined(CONFIG_SERIAL_SH_SCI_CONSOLE)
@@ -1239,14 +1231,11 @@ static int sci_remove(struct platform_device *dev)
 	struct sci_port *p;
 	unsigned long flags;
 
-#ifdef CONFIG_HAVE_CLK
 	cpufreq_unregister_notifier(&priv->clk_nb, CPUFREQ_TRANSITION_NOTIFIER);
-#endif
 
 	spin_lock_irqsave(&priv->lock, flags);
 	list_for_each_entry(p, &priv->ports, node)
 		uart_remove_one_port(&sci_uart_driver, &p->port);
-
 	spin_unlock_irqrestore(&priv->lock, flags);
 
 	kfree(priv);
@@ -1299,6 +1288,21 @@ static int __devinit sci_probe(struct platform_device *dev)
 	struct sh_sci_priv *priv;
 	int i, ret = -EINVAL;
 
+#ifdef CONFIG_SERIAL_SH_SCI_CONSOLE
+	if (is_early_platform_device(dev)) {
+		if (dev->id == -1)
+			return -ENOTSUPP;
+		early_serial_console.index = dev->id;
+		early_serial_console.data = &early_serial_port.port;
+		sci_init_single(NULL, &early_serial_port, dev->id, p);
+		serial_console_setup(&early_serial_console, early_serial_buf);
+		if (!strstr(early_serial_buf, "keep"))
+			early_serial_console.flags |= CON_BOOT;
+		register_console(&early_serial_console);
+		return 0;
+	}
+#endif
+
 	priv = kzalloc(sizeof(*priv), GFP_KERNEL);
 	if (!priv)
 		return -ENOMEM;
@@ -1307,10 +1311,8 @@ static int __devinit sci_probe(struct platform_device *dev)
 	spin_lock_init(&priv->lock);
 	platform_set_drvdata(dev, priv);
 
-#ifdef CONFIG_HAVE_CLK
 	priv->clk_nb.notifier_call = sci_notifier;
 	cpufreq_register_notifier(&priv->clk_nb, CPUFREQ_TRANSITION_NOTIFIER);
-#endif
 
 	if (dev->id != -1) {
 		ret = sci_probe_single(dev, dev->id, p, &sci_ports[dev->id]);
@@ -1363,14 +1365,14 @@ static int sci_resume(struct device *dev)
 	return 0;
 }
 
-static struct dev_pm_ops sci_dev_pm_ops = {
+static const struct dev_pm_ops sci_dev_pm_ops = {
 	.suspend	= sci_suspend,
 	.resume		= sci_resume,
 };
 
 static struct platform_driver sci_driver = {
 	.probe		= sci_probe,
-	.remove		= __devexit_p(sci_remove),
+	.remove		= sci_remove,
 	.driver		= {
 		.name	= "sh-sci",
 		.owner	= THIS_MODULE,
@@ -1400,6 +1402,10 @@ static void __exit sci_exit(void)
 	uart_unregister_driver(&sci_uart_driver);
 }
 
+#ifdef CONFIG_SERIAL_SH_SCI_CONSOLE
+early_platform_init_buffer("earlyprintk", &sci_driver,
+			   early_serial_buf, ARRAY_SIZE(early_serial_buf));
+#endif
 module_init(sci_init);
 module_exit(sci_exit);
 
diff --git a/drivers/serial/sh-sci.h b/drivers/serial/sh-sci.h
index 3e2fcf93b42e..0efcded59ae6 100644
--- a/drivers/serial/sh-sci.h
+++ b/drivers/serial/sh-sci.h
@@ -1,5 +1,5 @@
 #include <linux/serial_core.h>
-#include <asm/io.h>
+#include <linux/io.h>
 #include <linux/gpio.h>
 
 #if defined(CONFIG_H83007) || defined(CONFIG_H83068)
@@ -517,20 +517,20 @@ static const struct __attribute__((packed)) {
 static inline int sci_rxd_in(struct uart_port *port)
 {
 	if (port->mapbase == 0xfffffe80)
-		return ctrl_inb(SCPDR)&0x01 ? 1 : 0; /* SCI */
+		return __raw_readb(SCPDR)&0x01 ? 1 : 0; /* SCI */
 	if (port->mapbase == 0xa4000150)
-		return ctrl_inb(SCPDR)&0x10 ? 1 : 0; /* SCIF */
+		return __raw_readb(SCPDR)&0x10 ? 1 : 0; /* SCIF */
 	if (port->mapbase == 0xa4000140)
-		return ctrl_inb(SCPDR)&0x04 ? 1 : 0; /* IRDA */
+		return __raw_readb(SCPDR)&0x04 ? 1 : 0; /* IRDA */
 	return 1;
 }
 #elif defined(CONFIG_CPU_SUBTYPE_SH7705)
 static inline int sci_rxd_in(struct uart_port *port)
 {
 	if (port->mapbase == SCIF0)
-		return ctrl_inb(SCPDR)&0x04 ? 1 : 0; /* IRDA */
+		return __raw_readb(SCPDR)&0x04 ? 1 : 0; /* IRDA */
 	if (port->mapbase == SCIF2)
-		return ctrl_inb(SCPDR)&0x10 ? 1 : 0; /* SCIF */
+		return __raw_readb(SCPDR)&0x10 ? 1 : 0; /* SCIF */
 	return 1;
 }
 #elif defined(CONFIG_CPU_SUBTYPE_SH7710) || defined(CONFIG_CPU_SUBTYPE_SH7712)
@@ -557,68 +557,68 @@ static inline int sci_rxd_in(struct uart_port *port)
 static inline int sci_rxd_in(struct uart_port *port)
 {
 	if (port->mapbase == 0xffe00000)
-		return ctrl_inb(SCSPTR1)&0x01 ? 1 : 0; /* SCI */
+		return __raw_readb(SCSPTR1)&0x01 ? 1 : 0; /* SCI */
 	if (port->mapbase == 0xffe80000)
-		return ctrl_inw(SCSPTR2)&0x0001 ? 1 : 0; /* SCIF */
+		return __raw_readw(SCSPTR2)&0x0001 ? 1 : 0; /* SCIF */
 	return 1;
 }
 #elif defined(CONFIG_CPU_SUBTYPE_SH4_202)
 static inline int sci_rxd_in(struct uart_port *port)
 {
 	if (port->mapbase == 0xffe80000)
-		return ctrl_inw(SCSPTR2)&0x0001 ? 1 : 0; /* SCIF */
+		return __raw_readw(SCSPTR2)&0x0001 ? 1 : 0; /* SCIF */
 	return 1;
 }
 #elif defined(CONFIG_CPU_SUBTYPE_SH7757)
 static inline int sci_rxd_in(struct uart_port *port)
 {
 	if (port->mapbase == 0xfe4b0000)
-		return ctrl_inw(SCSPTR0) & 0x0001 ? 1 : 0;
+		return __raw_readw(SCSPTR0) & 0x0001 ? 1 : 0;
 	if (port->mapbase == 0xfe4c0000)
-		return ctrl_inw(SCSPTR1) & 0x0001 ? 1 : 0;
+		return __raw_readw(SCSPTR1) & 0x0001 ? 1 : 0;
 	if (port->mapbase == 0xfe4d0000)
-		return ctrl_inw(SCSPTR2) & 0x0001 ? 1 : 0;
+		return __raw_readw(SCSPTR2) & 0x0001 ? 1 : 0;
 }
 #elif defined(CONFIG_CPU_SUBTYPE_SH7760)
 static inline int sci_rxd_in(struct uart_port *port)
 {
 	if (port->mapbase == 0xfe600000)
-		return ctrl_inw(SCSPTR0) & 0x0001 ? 1 : 0; /* SCIF */
+		return __raw_readw(SCSPTR0) & 0x0001 ? 1 : 0; /* SCIF */
 	if (port->mapbase == 0xfe610000)
-		return ctrl_inw(SCSPTR1) & 0x0001 ? 1 : 0; /* SCIF */
+		return __raw_readw(SCSPTR1) & 0x0001 ? 1 : 0; /* SCIF */
 	if (port->mapbase == 0xfe620000)
-		return ctrl_inw(SCSPTR2) & 0x0001 ? 1 : 0; /* SCIF */
+		return __raw_readw(SCSPTR2) & 0x0001 ? 1 : 0; /* SCIF */
 	return 1;
 }
 #elif defined(CONFIG_CPU_SUBTYPE_SH7343)
 static inline int sci_rxd_in(struct uart_port *port)
 {
 	if (port->mapbase == 0xffe00000)
-		return ctrl_inw(SCSPTR0) & 0x0001 ? 1 : 0; /* SCIF */
+		return __raw_readw(SCSPTR0) & 0x0001 ? 1 : 0; /* SCIF */
 	if (port->mapbase == 0xffe10000)
-		return ctrl_inw(SCSPTR1) & 0x0001 ? 1 : 0; /* SCIF */
+		return __raw_readw(SCSPTR1) & 0x0001 ? 1 : 0; /* SCIF */
 	if (port->mapbase == 0xffe20000)
-		return ctrl_inw(SCSPTR2) & 0x0001 ? 1 : 0; /* SCIF */
+		return __raw_readw(SCSPTR2) & 0x0001 ? 1 : 0; /* SCIF */
 	if (port->mapbase == 0xffe30000)
-		return ctrl_inw(SCSPTR3) & 0x0001 ? 1 : 0; /* SCIF */
+		return __raw_readw(SCSPTR3) & 0x0001 ? 1 : 0; /* SCIF */
 	return 1;
 }
 #elif defined(CONFIG_CPU_SUBTYPE_SH7366)
 static inline int sci_rxd_in(struct uart_port *port)
 {
 	if (port->mapbase == 0xffe00000)
-		return ctrl_inb(SCPDR0) & 0x0001 ? 1 : 0; /* SCIF0 */
+		return __raw_readb(SCPDR0) & 0x0001 ? 1 : 0; /* SCIF0 */
 	return 1;
 }
 #elif defined(CONFIG_CPU_SUBTYPE_SH7722)
 static inline int sci_rxd_in(struct uart_port *port)
 {
 	if (port->mapbase == 0xffe00000)
-		return ctrl_inb(PSDR) & 0x02 ? 1 : 0; /* SCIF0 */
+		return __raw_readb(PSDR) & 0x02 ? 1 : 0; /* SCIF0 */
 	if (port->mapbase == 0xffe10000)
-		return ctrl_inb(PADR) & 0x40 ? 1 : 0; /* SCIF1 */
+		return __raw_readb(PADR) & 0x40 ? 1 : 0; /* SCIF1 */
 	if (port->mapbase == 0xffe20000)
-		return ctrl_inb(PWDR) & 0x04 ? 1 : 0; /* SCIF2 */
+		return __raw_readb(PWDR) & 0x04 ? 1 : 0; /* SCIF2 */
 
 	return 1;
 }
@@ -626,17 +626,17 @@ static inline int sci_rxd_in(struct uart_port *port)
 static inline int sci_rxd_in(struct uart_port *port)
 {
         if (port->mapbase == 0xffe00000)
-                return ctrl_inb(SCSPTR0) & 0x0008 ? 1 : 0; /* SCIF0 */
+                return __raw_readb(SCSPTR0) & 0x0008 ? 1 : 0; /* SCIF0 */
         if (port->mapbase == 0xffe10000)
-                return ctrl_inb(SCSPTR1) & 0x0020 ? 1 : 0; /* SCIF1 */
+                return __raw_readb(SCSPTR1) & 0x0020 ? 1 : 0; /* SCIF1 */
         if (port->mapbase == 0xffe20000)
-                return ctrl_inb(SCSPTR2) & 0x0001 ? 1 : 0; /* SCIF2 */
+                return __raw_readb(SCSPTR2) & 0x0001 ? 1 : 0; /* SCIF2 */
         if (port->mapbase == 0xa4e30000)
-                return ctrl_inb(SCSPTR3) & 0x0001 ? 1 : 0; /* SCIF3 */
+                return __raw_readb(SCSPTR3) & 0x0001 ? 1 : 0; /* SCIF3 */
         if (port->mapbase == 0xa4e40000)
-                return ctrl_inb(SCSPTR4) & 0x0001 ? 1 : 0; /* SCIF4 */
+                return __raw_readb(SCSPTR4) & 0x0001 ? 1 : 0; /* SCIF4 */
         if (port->mapbase == 0xa4e50000)
-                return ctrl_inb(SCSPTR5) & 0x0008 ? 1 : 0; /* SCIF5 */
+                return __raw_readb(SCSPTR5) & 0x0008 ? 1 : 0; /* SCIF5 */
         return 1;
 }
 #elif defined(CONFIG_CPU_SUBTYPE_SH7724)
@@ -645,9 +645,9 @@ static inline int sci_rxd_in(struct uart_port *port)
 static inline int sci_rxd_in(struct uart_port *port)
 {
 	if (port->type == PORT_SCIF)
-		return ctrl_inw((port->mapbase + SCFSR))  & SCIF_BRK ? 1 : 0;
+		return __raw_readw((port->mapbase + SCFSR))  & SCIF_BRK ? 1 : 0;
 	if (port->type == PORT_SCIFA)
-		return ctrl_inw((port->mapbase + SCASSR)) & SCIF_BRK ? 1 : 0;
+		return __raw_readw((port->mapbase + SCASSR)) & SCIF_BRK ? 1 : 0;
 	return 1;
 }
 #elif defined(CONFIG_CPU_SUBTYPE_SH5_101) || defined(CONFIG_CPU_SUBTYPE_SH5_103)
@@ -665,11 +665,11 @@ static inline int sci_rxd_in(struct uart_port *port)
 static inline int sci_rxd_in(struct uart_port *port)
 {
 	if (port->mapbase == 0xffe00000)
-		return ctrl_inw(SCSPTR0) & 0x0001 ? 1 : 0; /* SCIF */
+		return __raw_readw(SCSPTR0) & 0x0001 ? 1 : 0; /* SCIF */
 	if (port->mapbase == 0xffe08000)
-		return ctrl_inw(SCSPTR1) & 0x0001 ? 1 : 0; /* SCIF */
+		return __raw_readw(SCSPTR1) & 0x0001 ? 1 : 0; /* SCIF */
 	if (port->mapbase == 0xffe10000)
-		return ctrl_inw(SCSPTR2) & 0x0001 ? 1 : 0; /* SCIF/IRDA */
+		return __raw_readw(SCSPTR2) & 0x0001 ? 1 : 0; /* SCIF/IRDA */
 
 	return 1;
 }
@@ -677,20 +677,20 @@ static inline int sci_rxd_in(struct uart_port *port)
 static inline int sci_rxd_in(struct uart_port *port)
 {
 	if (port->mapbase == 0xff923000)
-		return ctrl_inw(SCSPTR0) & 0x0001 ? 1 : 0; /* SCIF */
+		return __raw_readw(SCSPTR0) & 0x0001 ? 1 : 0; /* SCIF */
 	if (port->mapbase == 0xff924000)
-		return ctrl_inw(SCSPTR1) & 0x0001 ? 1 : 0; /* SCIF */
+		return __raw_readw(SCSPTR1) & 0x0001 ? 1 : 0; /* SCIF */
 	if (port->mapbase == 0xff925000)
-		return ctrl_inw(SCSPTR2) & 0x0001 ? 1 : 0; /* SCIF */
+		return __raw_readw(SCSPTR2) & 0x0001 ? 1 : 0; /* SCIF */
 	return 1;
 }
 #elif defined(CONFIG_CPU_SUBTYPE_SH7780)
 static inline int sci_rxd_in(struct uart_port *port)
 {
 	if (port->mapbase == 0xffe00000)
-		return ctrl_inw(SCSPTR0) & 0x0001 ? 1 : 0; /* SCIF */
+		return __raw_readw(SCSPTR0) & 0x0001 ? 1 : 0; /* SCIF */
 	if (port->mapbase == 0xffe10000)
-		return ctrl_inw(SCSPTR1) & 0x0001 ? 1 : 0; /* SCIF */
+		return __raw_readw(SCSPTR1) & 0x0001 ? 1 : 0; /* SCIF */
 	return 1;
 }
 #elif defined(CONFIG_CPU_SUBTYPE_SH7785) || \
@@ -698,17 +698,17 @@ static inline int sci_rxd_in(struct uart_port *port)
 static inline int sci_rxd_in(struct uart_port *port)
 {
 	if (port->mapbase == 0xffea0000)
-		return ctrl_inw(SCSPTR0) & 0x0001 ? 1 : 0; /* SCIF */
+		return __raw_readw(SCSPTR0) & 0x0001 ? 1 : 0; /* SCIF */
 	if (port->mapbase == 0xffeb0000)
-		return ctrl_inw(SCSPTR1) & 0x0001 ? 1 : 0; /* SCIF */
+		return __raw_readw(SCSPTR1) & 0x0001 ? 1 : 0; /* SCIF */
 	if (port->mapbase == 0xffec0000)
-		return ctrl_inw(SCSPTR2) & 0x0001 ? 1 : 0; /* SCIF */
+		return __raw_readw(SCSPTR2) & 0x0001 ? 1 : 0; /* SCIF */
 	if (port->mapbase == 0xffed0000)
-		return ctrl_inw(SCSPTR3) & 0x0001 ? 1 : 0; /* SCIF */
+		return __raw_readw(SCSPTR3) & 0x0001 ? 1 : 0; /* SCIF */
 	if (port->mapbase == 0xffee0000)
-		return ctrl_inw(SCSPTR4) & 0x0001 ? 1 : 0; /* SCIF */
+		return __raw_readw(SCSPTR4) & 0x0001 ? 1 : 0; /* SCIF */
 	if (port->mapbase == 0xffef0000)
-		return ctrl_inw(SCSPTR5) & 0x0001 ? 1 : 0; /* SCIF */
+		return __raw_readw(SCSPTR5) & 0x0001 ? 1 : 0; /* SCIF */
 	return 1;
 }
 #elif defined(CONFIG_CPU_SUBTYPE_SH7201) || \
@@ -718,22 +718,22 @@ static inline int sci_rxd_in(struct uart_port *port)
 static inline int sci_rxd_in(struct uart_port *port)
 {
 	if (port->mapbase == 0xfffe8000)
-		return ctrl_inw(SCSPTR0) & 0x0001 ? 1 : 0; /* SCIF */
+		return __raw_readw(SCSPTR0) & 0x0001 ? 1 : 0; /* SCIF */
 	if (port->mapbase == 0xfffe8800)
-		return ctrl_inw(SCSPTR1) & 0x0001 ? 1 : 0; /* SCIF */
+		return __raw_readw(SCSPTR1) & 0x0001 ? 1 : 0; /* SCIF */
 	if (port->mapbase == 0xfffe9000)
-		return ctrl_inw(SCSPTR2) & 0x0001 ? 1 : 0; /* SCIF */
+		return __raw_readw(SCSPTR2) & 0x0001 ? 1 : 0; /* SCIF */
 	if (port->mapbase == 0xfffe9800)
-		return ctrl_inw(SCSPTR3) & 0x0001 ? 1 : 0; /* SCIF */
+		return __raw_readw(SCSPTR3) & 0x0001 ? 1 : 0; /* SCIF */
 #if defined(CONFIG_CPU_SUBTYPE_SH7201)
 	if (port->mapbase == 0xfffeA000)
-		return ctrl_inw(SCSPTR0) & 0x0001 ? 1 : 0; /* SCIF */
+		return __raw_readw(SCSPTR0) & 0x0001 ? 1 : 0; /* SCIF */
 	if (port->mapbase == 0xfffeA800)
-		return ctrl_inw(SCSPTR1) & 0x0001 ? 1 : 0; /* SCIF */
+		return __raw_readw(SCSPTR1) & 0x0001 ? 1 : 0; /* SCIF */
 	if (port->mapbase == 0xfffeB000)
-		return ctrl_inw(SCSPTR2) & 0x0001 ? 1 : 0; /* SCIF */
+		return __raw_readw(SCSPTR2) & 0x0001 ? 1 : 0; /* SCIF */
 	if (port->mapbase == 0xfffeB800)
-		return ctrl_inw(SCSPTR3) & 0x0001 ? 1 : 0; /* SCIF */
+		return __raw_readw(SCSPTR3) & 0x0001 ? 1 : 0; /* SCIF */
 #endif
 	return 1;
 }
@@ -741,24 +741,24 @@ static inline int sci_rxd_in(struct uart_port *port)
 static inline int sci_rxd_in(struct uart_port *port)
 {
 	if (port->mapbase == 0xf8400000)
-		return ctrl_inw(SCSPTR0) & 0x0001 ? 1 : 0; /* SCIF */
+		return __raw_readw(SCSPTR0) & 0x0001 ? 1 : 0; /* SCIF */
 	if (port->mapbase == 0xf8410000)
-		return ctrl_inw(SCSPTR1) & 0x0001 ? 1 : 0; /* SCIF */
+		return __raw_readw(SCSPTR1) & 0x0001 ? 1 : 0; /* SCIF */
 	if (port->mapbase == 0xf8420000)
-		return ctrl_inw(SCSPTR2) & 0x0001 ? 1 : 0; /* SCIF */
+		return __raw_readw(SCSPTR2) & 0x0001 ? 1 : 0; /* SCIF */
 	return 1;
 }
 #elif defined(CONFIG_CPU_SUBTYPE_SHX3)
 static inline int sci_rxd_in(struct uart_port *port)
 {
 	if (port->mapbase == 0xffc30000)
-		return ctrl_inw(SCSPTR0) & 0x0001 ? 1 : 0; /* SCIF */
+		return __raw_readw(SCSPTR0) & 0x0001 ? 1 : 0; /* SCIF */
 	if (port->mapbase == 0xffc40000)
-		return ctrl_inw(SCSPTR1) & 0x0001 ? 1 : 0; /* SCIF */
+		return __raw_readw(SCSPTR1) & 0x0001 ? 1 : 0; /* SCIF */
 	if (port->mapbase == 0xffc50000)
-		return ctrl_inw(SCSPTR2) & 0x0001 ? 1 : 0; /* SCIF */
+		return __raw_readw(SCSPTR2) & 0x0001 ? 1 : 0; /* SCIF */
 	if (port->mapbase == 0xffc60000)
-		return ctrl_inw(SCSPTR3) & 0x0001 ? 1 : 0; /* SCIF */
+		return __raw_readw(SCSPTR3) & 0x0001 ? 1 : 0; /* SCIF */
 	return 1;
 }
 #endif
diff --git a/drivers/serial/ucc_uart.c b/drivers/serial/ucc_uart.c
index 0c08f286a2ef..465f2fae1025 100644
--- a/drivers/serial/ucc_uart.c
+++ b/drivers/serial/ucc_uart.c
@@ -313,7 +313,7 @@ static void qe_uart_stop_tx(struct uart_port *port)
  * This function will attempt to stuff of all the characters from the
  * kernel's transmit buffer into TX BDs.
  *
- * A return value of non-zero indicates that it sucessfully stuffed all
+ * A return value of non-zero indicates that it successfully stuffed all
  * characters from the kernel buffer.
  *
  * A return value of zero indicates that there are still characters in the
@@ -1179,16 +1179,18 @@ static void uart_firmware_cont(const struct firmware *fw, void *context)
 
 	if (firmware->header.length != fw->size) {
 		dev_err(dev, "invalid firmware\n");
-		return;
+		goto out;
 	}
 
 	ret = qe_upload_firmware(firmware);
 	if (ret) {
 		dev_err(dev, "could not load firmware\n");
-		return;
+		goto out;
 	}
 
 	firmware_loaded = 1;
+ out:
+	release_firmware(fw);
 }
 
 static int ucc_uart_probe(struct of_device *ofdev,
@@ -1247,7 +1249,7 @@ static int ucc_uart_probe(struct of_device *ofdev,
 			 */
 			ret = request_firmware_nowait(THIS_MODULE,
 				FW_ACTION_HOTPLUG, filename, &ofdev->dev,
-				&ofdev->dev, uart_firmware_cont);
+				GFP_KERNEL, &ofdev->dev, uart_firmware_cont);
 			if (ret) {
 				dev_err(&ofdev->dev,
 					"could not load firmware %s\n",
diff --git a/drivers/sh/Makefile b/drivers/sh/Makefile
index 6a025cefe6dc..4956bf1f2134 100644
--- a/drivers/sh/Makefile
+++ b/drivers/sh/Makefile
@@ -3,4 +3,5 @@
 #
 obj-$(CONFIG_SUPERHYWAY)	+= superhyway/
 obj-$(CONFIG_MAPLE)		+= maple/
+obj-$(CONFIG_GENERIC_GPIO)	+= pfc.o
 obj-y				+= intc.o
diff --git a/drivers/sh/intc.c b/drivers/sh/intc.c
index 559b5fe9dc0f..d5d7f23c19a5 100644
--- a/drivers/sh/intc.c
+++ b/drivers/sh/intc.c
@@ -2,6 +2,7 @@
  * Shared interrupt handling code for IPR and INTC2 types of IRQs.
  *
  * Copyright (C) 2007, 2008 Magnus Damm
+ * Copyright (C) 2009 Paul Mundt
  *
  * Based on intc2.c and ipr.c
  *
@@ -24,6 +25,7 @@
 #include <linux/sysdev.h>
 #include <linux/list.h>
 #include <linux/topology.h>
+#include <linux/bitmap.h>
 
 #define _INTC_MK(fn, mode, addr_e, addr_d, width, shift) \
 	((shift) | ((width) << 5) | ((fn) << 9) | ((mode) << 13) | \
@@ -59,6 +61,20 @@ struct intc_desc_int {
 
 static LIST_HEAD(intc_list);
 
+/*
+ * The intc_irq_map provides a global map of bound IRQ vectors for a
+ * given platform. Allocation of IRQs are either static through the CPU
+ * vector map, or dynamic in the case of board mux vectors or MSI.
+ *
+ * As this is a central point for all IRQ controllers on the system,
+ * each of the available sources are mapped out here. This combined with
+ * sparseirq makes it quite trivial to keep the vector map tightly packed
+ * when dynamically creating IRQs, as well as tying in to otherwise
+ * unused irq_desc positions in the sparse array.
+ */
+static DECLARE_BITMAP(intc_irq_map, NR_IRQS);
+static DEFINE_SPINLOCK(vector_lock);
+
 #ifdef CONFIG_SMP
 #define IS_SMP(x) x.smp
 #define INTC_REG(d, x, c) (d->reg[(x)] + ((d->smp[(x)] & 0xff) * c))
@@ -70,9 +86,7 @@ static LIST_HEAD(intc_list);
 #endif
 
 static unsigned int intc_prio_level[NR_IRQS]; /* for now */
-#if defined(CONFIG_CPU_SH3) || defined(CONFIG_CPU_SH4A)
 static unsigned long ack_handle[NR_IRQS];
-#endif
 
 static inline struct intc_desc_int *get_intc_desc(unsigned int irq)
 {
@@ -250,7 +264,6 @@ static int intc_set_wake(unsigned int irq, unsigned int on)
 	return 0; /* allow wakeup, but setup hardware in intc_suspend() */
 }
 
-#if defined(CONFIG_CPU_SH3) || defined(CONFIG_CPU_SH4A)
 static void intc_mask_ack(unsigned int irq)
 {
 	struct intc_desc_int *d = get_intc_desc(irq);
@@ -282,7 +295,6 @@ static void intc_mask_ack(unsigned int irq)
 		}
 	}
 }
-#endif
 
 static struct intc_handle_int *intc_find_irq(struct intc_handle_int *hp,
 					     unsigned int nr_hp,
@@ -501,7 +513,6 @@ static unsigned int __init intc_prio_data(struct intc_desc *desc,
 	return 0;
 }
 
-#if defined(CONFIG_CPU_SH3) || defined(CONFIG_CPU_SH4A)
 static unsigned int __init intc_ack_data(struct intc_desc *desc,
 					  struct intc_desc_int *d,
 					  intc_enum enum_id)
@@ -533,7 +544,6 @@ static unsigned int __init intc_ack_data(struct intc_desc *desc,
 
 	return 0;
 }
-#endif
 
 static unsigned int __init intc_sense_data(struct intc_desc *desc,
 					   struct intc_desc_int *d,
@@ -572,6 +582,11 @@ static void __init intc_register_irq(struct intc_desc *desc,
 	struct intc_handle_int *hp;
 	unsigned int data[2], primary;
 
+	/*
+	 * Register the IRQ position with the global IRQ map
+	 */
+	set_bit(irq, intc_irq_map);
+
 	/* Prefer single interrupt source bitmap over other combinations:
 	 * 1. bitmap, single interrupt source
 	 * 2. priority, single interrupt source
@@ -641,10 +656,8 @@ static void __init intc_register_irq(struct intc_desc *desc,
 	/* irq should be disabled by default */
 	d->chip.mask(irq);
 
-#if defined(CONFIG_CPU_SH3) || defined(CONFIG_CPU_SH4A)
 	if (desc->ack_regs)
 		ack_handle[irq] = intc_ack_data(desc, d, enum_id);
-#endif
 }
 
 static unsigned int __init save_reg(struct intc_desc_int *d,
@@ -681,10 +694,8 @@ void __init register_intc_controller(struct intc_desc *desc)
 	d->nr_reg = desc->mask_regs ? desc->nr_mask_regs * 2 : 0;
 	d->nr_reg += desc->prio_regs ? desc->nr_prio_regs * 2 : 0;
 	d->nr_reg += desc->sense_regs ? desc->nr_sense_regs : 0;
-
-#if defined(CONFIG_CPU_SH3) || defined(CONFIG_CPU_SH4A)
 	d->nr_reg += desc->ack_regs ? desc->nr_ack_regs : 0;
-#endif
+
 	d->reg = kzalloc(d->nr_reg * sizeof(*d->reg), GFP_NOWAIT);
 #ifdef CONFIG_SMP
 	d->smp = kzalloc(d->nr_reg * sizeof(*d->smp), GFP_NOWAIT);
@@ -727,14 +738,12 @@ void __init register_intc_controller(struct intc_desc *desc)
 	d->chip.set_type = intc_set_sense;
 	d->chip.set_wake = intc_set_wake;
 
-#if defined(CONFIG_CPU_SH3) || defined(CONFIG_CPU_SH4A)
 	if (desc->ack_regs) {
 		for (i = 0; i < desc->nr_ack_regs; i++)
 			k += save_reg(d, k, desc->ack_regs[i].set_reg, 0);
 
 		d->chip.mask_ack = intc_mask_ack;
 	}
-#endif
 
 	BUG_ON(k > 256); /* _INTC_ADDR_E() and _INTC_ADDR_D() are 8 bits */
 
@@ -797,6 +806,8 @@ static int intc_suspend(struct sys_device *dev, pm_message_t state)
 		if (d->state.event != PM_EVENT_FREEZE)
 			break;
 		for_each_irq_desc(irq, desc) {
+			if (desc->handle_irq == intc_redirect_irq)
+				continue;
 			if (desc->chip != &d->chip)
 				continue;
 			if (desc->status & IRQ_DISABLED)
@@ -856,5 +867,91 @@ static int __init register_intc_sysdevs(void)
 
 	return error;
 }
-
 device_initcall(register_intc_sysdevs);
+
+/*
+ * Dynamic IRQ allocation and deallocation
+ */
+static unsigned int create_irq_on_node(unsigned int irq_want, int node)
+{
+	unsigned int irq = 0, new;
+	unsigned long flags;
+	struct irq_desc *desc;
+
+	spin_lock_irqsave(&vector_lock, flags);
+
+	/*
+	 * First try the wanted IRQ, then scan.
+	 */
+	if (test_and_set_bit(irq_want, intc_irq_map)) {
+		new = find_first_zero_bit(intc_irq_map, nr_irqs);
+		if (unlikely(new == nr_irqs))
+			goto out_unlock;
+
+		desc = irq_to_desc_alloc_node(new, node);
+		if (unlikely(!desc)) {
+			pr_info("can't get irq_desc for %d\n", new);
+			goto out_unlock;
+		}
+
+		desc = move_irq_desc(desc, node);
+		__set_bit(new, intc_irq_map);
+		irq = new;
+	}
+
+out_unlock:
+	spin_unlock_irqrestore(&vector_lock, flags);
+
+	if (irq > 0)
+		dynamic_irq_init(irq);
+
+	return irq;
+}
+
+int create_irq(void)
+{
+	int nid = cpu_to_node(smp_processor_id());
+	int irq;
+
+	irq = create_irq_on_node(NR_IRQS_LEGACY, nid);
+	if (irq == 0)
+		irq = -1;
+
+	return irq;
+}
+
+void destroy_irq(unsigned int irq)
+{
+	unsigned long flags;
+
+	dynamic_irq_cleanup(irq);
+
+	spin_lock_irqsave(&vector_lock, flags);
+	__clear_bit(irq, intc_irq_map);
+	spin_unlock_irqrestore(&vector_lock, flags);
+}
+
+int reserve_irq_vector(unsigned int irq)
+{
+	unsigned long flags;
+	int ret = 0;
+
+	spin_lock_irqsave(&vector_lock, flags);
+	if (test_and_set_bit(irq, intc_irq_map))
+		ret = -EBUSY;
+	spin_unlock_irqrestore(&vector_lock, flags);
+
+	return ret;
+}
+
+void reserve_irq_legacy(void)
+{
+	unsigned long flags;
+	int i, j;
+
+	spin_lock_irqsave(&vector_lock, flags);
+	j = find_first_bit(intc_irq_map, nr_irqs);
+	for (i = 0; i < j; i++)
+		__set_bit(i, intc_irq_map);
+	spin_unlock_irqrestore(&vector_lock, flags);
+}
diff --git a/drivers/sh/maple/maple.c b/drivers/sh/maple/maple.c
index 93c20e135ee1..4e8f57d4131f 100644
--- a/drivers/sh/maple/maple.c
+++ b/drivers/sh/maple/maple.c
@@ -106,7 +106,7 @@ static void maple_dma_reset(void)
 	* max delay is 11
 	*/
 	ctrl_outl(MAPLE_2MBPS | MAPLE_TIMEOUT(0xFFFF), MAPLE_SPEED);
-	ctrl_outl(PHYSADDR(maple_sendbuf), MAPLE_DMAADDR);
+	ctrl_outl(virt_to_phys(maple_sendbuf), MAPLE_DMAADDR);
 	ctrl_outl(1, MAPLE_ENABLE);
 }
 
@@ -258,7 +258,7 @@ static void maple_build_block(struct mapleq *mq)
 	maple_lastptr = maple_sendptr;
 
 	*maple_sendptr++ = (port << 16) | len | 0x80000000;
-	*maple_sendptr++ = PHYSADDR(mq->recvbuf->buf);
+	*maple_sendptr++ = virt_to_phys(mq->recvbuf->buf);
 	*maple_sendptr++ =
 	    mq->command | (to << 8) | (from << 16) | (len << 24);
 	while (len-- > 0)
diff --git a/drivers/sh/pfc.c b/drivers/sh/pfc.c
new file mode 100644
index 000000000000..082604edc4c2
--- /dev/null
+++ b/drivers/sh/pfc.c
@@ -0,0 +1,577 @@
+/*
+ * Pinmuxed GPIO support for SuperH.
+ *
+ * Copyright (C) 2008 Magnus Damm
+ *
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ */
+#include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/list.h>
+#include <linux/module.h>
+#include <linux/clk.h>
+#include <linux/err.h>
+#include <linux/io.h>
+#include <linux/irq.h>
+#include <linux/bitops.h>
+#include <linux/gpio.h>
+
+static int enum_in_range(pinmux_enum_t enum_id, struct pinmux_range *r)
+{
+	if (enum_id < r->begin)
+		return 0;
+
+	if (enum_id > r->end)
+		return 0;
+
+	return 1;
+}
+
+static unsigned long gpio_read_raw_reg(unsigned long reg,
+				       unsigned long reg_width)
+{
+	switch (reg_width) {
+	case 8:
+		return __raw_readb(reg);
+	case 16:
+		return __raw_readw(reg);
+	case 32:
+		return __raw_readl(reg);
+	}
+
+	BUG();
+	return 0;
+}
+
+static void gpio_write_raw_reg(unsigned long reg,
+			       unsigned long reg_width,
+			       unsigned long data)
+{
+	switch (reg_width) {
+	case 8:
+		__raw_writeb(data, reg);
+		return;
+	case 16:
+		__raw_writew(data, reg);
+		return;
+	case 32:
+		__raw_writel(data, reg);
+		return;
+	}
+
+	BUG();
+}
+
+static void gpio_write_bit(struct pinmux_data_reg *dr,
+			   unsigned long in_pos, unsigned long value)
+{
+	unsigned long pos;
+
+	pos = dr->reg_width - (in_pos + 1);
+
+	pr_debug("write_bit addr = %lx, value = %d, pos = %ld, "
+		 "r_width = %ld\n",
+		 dr->reg, !!value, pos, dr->reg_width);
+
+	if (value)
+		set_bit(pos, &dr->reg_shadow);
+	else
+		clear_bit(pos, &dr->reg_shadow);
+
+	gpio_write_raw_reg(dr->reg, dr->reg_width, dr->reg_shadow);
+}
+
+static int gpio_read_reg(unsigned long reg, unsigned long reg_width,
+			 unsigned long field_width, unsigned long in_pos)
+{
+	unsigned long data, mask, pos;
+
+	data = 0;
+	mask = (1 << field_width) - 1;
+	pos = reg_width - ((in_pos + 1) * field_width);
+
+	pr_debug("read_reg: addr = %lx, pos = %ld, "
+		 "r_width = %ld, f_width = %ld\n",
+		 reg, pos, reg_width, field_width);
+
+	data = gpio_read_raw_reg(reg, reg_width);
+	return (data >> pos) & mask;
+}
+
+static void gpio_write_reg(unsigned long reg, unsigned long reg_width,
+			   unsigned long field_width, unsigned long in_pos,
+			   unsigned long value)
+{
+	unsigned long mask, pos;
+
+	mask = (1 << field_width) - 1;
+	pos = reg_width - ((in_pos + 1) * field_width);
+
+	pr_debug("write_reg addr = %lx, value = %ld, pos = %ld, "
+		 "r_width = %ld, f_width = %ld\n",
+		 reg, value, pos, reg_width, field_width);
+
+	mask = ~(mask << pos);
+	value = value << pos;
+
+	switch (reg_width) {
+	case 8:
+		__raw_writeb((__raw_readb(reg) & mask) | value, reg);
+		break;
+	case 16:
+		__raw_writew((__raw_readw(reg) & mask) | value, reg);
+		break;
+	case 32:
+		__raw_writel((__raw_readl(reg) & mask) | value, reg);
+		break;
+	}
+}
+
+static int setup_data_reg(struct pinmux_info *gpioc, unsigned gpio)
+{
+	struct pinmux_gpio *gpiop = &gpioc->gpios[gpio];
+	struct pinmux_data_reg *data_reg;
+	int k, n;
+
+	if (!enum_in_range(gpiop->enum_id, &gpioc->data))
+		return -1;
+
+	k = 0;
+	while (1) {
+		data_reg = gpioc->data_regs + k;
+
+		if (!data_reg->reg_width)
+			break;
+
+		for (n = 0; n < data_reg->reg_width; n++) {
+			if (data_reg->enum_ids[n] == gpiop->enum_id) {
+				gpiop->flags &= ~PINMUX_FLAG_DREG;
+				gpiop->flags |= (k << PINMUX_FLAG_DREG_SHIFT);
+				gpiop->flags &= ~PINMUX_FLAG_DBIT;
+				gpiop->flags |= (n << PINMUX_FLAG_DBIT_SHIFT);
+				return 0;
+			}
+		}
+		k++;
+	}
+
+	BUG();
+
+	return -1;
+}
+
+static void setup_data_regs(struct pinmux_info *gpioc)
+{
+	struct pinmux_data_reg *drp;
+	int k;
+
+	for (k = gpioc->first_gpio; k <= gpioc->last_gpio; k++)
+		setup_data_reg(gpioc, k);
+
+	k = 0;
+	while (1) {
+		drp = gpioc->data_regs + k;
+
+		if (!drp->reg_width)
+			break;
+
+		drp->reg_shadow = gpio_read_raw_reg(drp->reg, drp->reg_width);
+		k++;
+	}
+}
+
+static int get_data_reg(struct pinmux_info *gpioc, unsigned gpio,
+			struct pinmux_data_reg **drp, int *bitp)
+{
+	struct pinmux_gpio *gpiop = &gpioc->gpios[gpio];
+	int k, n;
+
+	if (!enum_in_range(gpiop->enum_id, &gpioc->data))
+		return -1;
+
+	k = (gpiop->flags & PINMUX_FLAG_DREG) >> PINMUX_FLAG_DREG_SHIFT;
+	n = (gpiop->flags & PINMUX_FLAG_DBIT) >> PINMUX_FLAG_DBIT_SHIFT;
+	*drp = gpioc->data_regs + k;
+	*bitp = n;
+	return 0;
+}
+
+static int get_config_reg(struct pinmux_info *gpioc, pinmux_enum_t enum_id,
+			  struct pinmux_cfg_reg **crp, int *indexp,
+			  unsigned long **cntp)
+{
+	struct pinmux_cfg_reg *config_reg;
+	unsigned long r_width, f_width;
+	int k, n;
+
+	k = 0;
+	while (1) {
+		config_reg = gpioc->cfg_regs + k;
+
+		r_width = config_reg->reg_width;
+		f_width = config_reg->field_width;
+
+		if (!r_width)
+			break;
+		for (n = 0; n < (r_width / f_width) * 1 << f_width; n++) {
+			if (config_reg->enum_ids[n] == enum_id) {
+				*crp = config_reg;
+				*indexp = n;
+				*cntp = &config_reg->cnt[n / (1 << f_width)];
+				return 0;
+			}
+		}
+		k++;
+	}
+
+	return -1;
+}
+
+static int get_gpio_enum_id(struct pinmux_info *gpioc, unsigned gpio,
+			    int pos, pinmux_enum_t *enum_idp)
+{
+	pinmux_enum_t enum_id = gpioc->gpios[gpio].enum_id;
+	pinmux_enum_t *data = gpioc->gpio_data;
+	int k;
+
+	if (!enum_in_range(enum_id, &gpioc->data)) {
+		if (!enum_in_range(enum_id, &gpioc->mark)) {
+			pr_err("non data/mark enum_id for gpio %d\n", gpio);
+			return -1;
+		}
+	}
+
+	if (pos) {
+		*enum_idp = data[pos + 1];
+		return pos + 1;
+	}
+
+	for (k = 0; k < gpioc->gpio_data_size; k++) {
+		if (data[k] == enum_id) {
+			*enum_idp = data[k + 1];
+			return k + 1;
+		}
+	}
+
+	pr_err("cannot locate data/mark enum_id for gpio %d\n", gpio);
+	return -1;
+}
+
+static void write_config_reg(struct pinmux_info *gpioc,
+			     struct pinmux_cfg_reg *crp,
+			     int index)
+{
+	unsigned long ncomb, pos, value;
+
+	ncomb = 1 << crp->field_width;
+	pos = index / ncomb;
+	value = index % ncomb;
+
+	gpio_write_reg(crp->reg, crp->reg_width, crp->field_width, pos, value);
+}
+
+static int check_config_reg(struct pinmux_info *gpioc,
+			    struct pinmux_cfg_reg *crp,
+			    int index)
+{
+	unsigned long ncomb, pos, value;
+
+	ncomb = 1 << crp->field_width;
+	pos = index / ncomb;
+	value = index % ncomb;
+
+	if (gpio_read_reg(crp->reg, crp->reg_width,
+			  crp->field_width, pos) == value)
+		return 0;
+
+	return -1;
+}
+
+enum { GPIO_CFG_DRYRUN, GPIO_CFG_REQ, GPIO_CFG_FREE };
+
+static int pinmux_config_gpio(struct pinmux_info *gpioc, unsigned gpio,
+			      int pinmux_type, int cfg_mode)
+{
+	struct pinmux_cfg_reg *cr = NULL;
+	pinmux_enum_t enum_id;
+	struct pinmux_range *range;
+	int in_range, pos, index;
+	unsigned long *cntp;
+
+	switch (pinmux_type) {
+
+	case PINMUX_TYPE_FUNCTION:
+		range = NULL;
+		break;
+
+	case PINMUX_TYPE_OUTPUT:
+		range = &gpioc->output;
+		break;
+
+	case PINMUX_TYPE_INPUT:
+		range = &gpioc->input;
+		break;
+
+	case PINMUX_TYPE_INPUT_PULLUP:
+		range = &gpioc->input_pu;
+		break;
+
+	case PINMUX_TYPE_INPUT_PULLDOWN:
+		range = &gpioc->input_pd;
+		break;
+
+	default:
+		goto out_err;
+	}
+
+	pos = 0;
+	enum_id = 0;
+	index = 0;
+	while (1) {
+		pos = get_gpio_enum_id(gpioc, gpio, pos, &enum_id);
+		if (pos <= 0)
+			goto out_err;
+
+		if (!enum_id)
+			break;
+
+		in_range = enum_in_range(enum_id, &gpioc->function);
+		if (!in_range && range) {
+			in_range = enum_in_range(enum_id, range);
+
+			if (in_range && enum_id == range->force)
+				continue;
+		}
+
+		if (!in_range)
+			continue;
+
+		if (get_config_reg(gpioc, enum_id, &cr, &index, &cntp) != 0)
+			goto out_err;
+
+		switch (cfg_mode) {
+		case GPIO_CFG_DRYRUN:
+			if (!*cntp || !check_config_reg(gpioc, cr, index))
+				continue;
+			break;
+
+		case GPIO_CFG_REQ:
+			write_config_reg(gpioc, cr, index);
+			*cntp = *cntp + 1;
+			break;
+
+		case GPIO_CFG_FREE:
+			*cntp = *cntp - 1;
+			break;
+		}
+	}
+
+	return 0;
+ out_err:
+	return -1;
+}
+
+static DEFINE_SPINLOCK(gpio_lock);
+
+static struct pinmux_info *chip_to_pinmux(struct gpio_chip *chip)
+{
+	return container_of(chip, struct pinmux_info, chip);
+}
+
+static int sh_gpio_request(struct gpio_chip *chip, unsigned offset)
+{
+	struct pinmux_info *gpioc = chip_to_pinmux(chip);
+	struct pinmux_data_reg *dummy;
+	unsigned long flags;
+	int i, ret, pinmux_type;
+
+	ret = -EINVAL;
+
+	if (!gpioc)
+		goto err_out;
+
+	spin_lock_irqsave(&gpio_lock, flags);
+
+	if ((gpioc->gpios[offset].flags & PINMUX_FLAG_TYPE) != PINMUX_TYPE_NONE)
+		goto err_unlock;
+
+	/* setup pin function here if no data is associated with pin */
+
+	if (get_data_reg(gpioc, offset, &dummy, &i) != 0)
+		pinmux_type = PINMUX_TYPE_FUNCTION;
+	else
+		pinmux_type = PINMUX_TYPE_GPIO;
+
+	if (pinmux_type == PINMUX_TYPE_FUNCTION) {
+		if (pinmux_config_gpio(gpioc, offset,
+				       pinmux_type,
+				       GPIO_CFG_DRYRUN) != 0)
+			goto err_unlock;
+
+		if (pinmux_config_gpio(gpioc, offset,
+				       pinmux_type,
+				       GPIO_CFG_REQ) != 0)
+			BUG();
+	}
+
+	gpioc->gpios[offset].flags &= ~PINMUX_FLAG_TYPE;
+	gpioc->gpios[offset].flags |= pinmux_type;
+
+	ret = 0;
+ err_unlock:
+	spin_unlock_irqrestore(&gpio_lock, flags);
+ err_out:
+	return ret;
+}
+
+static void sh_gpio_free(struct gpio_chip *chip, unsigned offset)
+{
+	struct pinmux_info *gpioc = chip_to_pinmux(chip);
+	unsigned long flags;
+	int pinmux_type;
+
+	if (!gpioc)
+		return;
+
+	spin_lock_irqsave(&gpio_lock, flags);
+
+	pinmux_type = gpioc->gpios[offset].flags & PINMUX_FLAG_TYPE;
+	pinmux_config_gpio(gpioc, offset, pinmux_type, GPIO_CFG_FREE);
+	gpioc->gpios[offset].flags &= ~PINMUX_FLAG_TYPE;
+	gpioc->gpios[offset].flags |= PINMUX_TYPE_NONE;
+
+	spin_unlock_irqrestore(&gpio_lock, flags);
+}
+
+static int pinmux_direction(struct pinmux_info *gpioc,
+			    unsigned gpio, int new_pinmux_type)
+{
+	int pinmux_type;
+	int ret = -EINVAL;
+
+	if (!gpioc)
+		goto err_out;
+
+	pinmux_type = gpioc->gpios[gpio].flags & PINMUX_FLAG_TYPE;
+
+	switch (pinmux_type) {
+	case PINMUX_TYPE_GPIO:
+		break;
+	case PINMUX_TYPE_OUTPUT:
+	case PINMUX_TYPE_INPUT:
+	case PINMUX_TYPE_INPUT_PULLUP:
+	case PINMUX_TYPE_INPUT_PULLDOWN:
+		pinmux_config_gpio(gpioc, gpio, pinmux_type, GPIO_CFG_FREE);
+		break;
+	default:
+		goto err_out;
+	}
+
+	if (pinmux_config_gpio(gpioc, gpio,
+			       new_pinmux_type,
+			       GPIO_CFG_DRYRUN) != 0)
+		goto err_out;
+
+	if (pinmux_config_gpio(gpioc, gpio,
+			       new_pinmux_type,
+			       GPIO_CFG_REQ) != 0)
+		BUG();
+
+	gpioc->gpios[gpio].flags &= ~PINMUX_FLAG_TYPE;
+	gpioc->gpios[gpio].flags |= new_pinmux_type;
+
+	ret = 0;
+ err_out:
+	return ret;
+}
+
+static int sh_gpio_direction_input(struct gpio_chip *chip, unsigned offset)
+{
+	struct pinmux_info *gpioc = chip_to_pinmux(chip);
+	unsigned long flags;
+	int ret;
+
+	spin_lock_irqsave(&gpio_lock, flags);
+	ret = pinmux_direction(gpioc, offset, PINMUX_TYPE_INPUT);
+	spin_unlock_irqrestore(&gpio_lock, flags);
+
+	return ret;
+}
+
+static void sh_gpio_set_value(struct pinmux_info *gpioc,
+			     unsigned gpio, int value)
+{
+	struct pinmux_data_reg *dr = NULL;
+	int bit = 0;
+
+	if (!gpioc || get_data_reg(gpioc, gpio, &dr, &bit) != 0)
+		BUG();
+	else
+		gpio_write_bit(dr, bit, value);
+}
+
+static int sh_gpio_direction_output(struct gpio_chip *chip, unsigned offset,
+				    int value)
+{
+	struct pinmux_info *gpioc = chip_to_pinmux(chip);
+	unsigned long flags;
+	int ret;
+
+	sh_gpio_set_value(gpioc, offset, value);
+	spin_lock_irqsave(&gpio_lock, flags);
+	ret = pinmux_direction(gpioc, offset, PINMUX_TYPE_OUTPUT);
+	spin_unlock_irqrestore(&gpio_lock, flags);
+
+	return ret;
+}
+
+static int sh_gpio_get_value(struct pinmux_info *gpioc, unsigned gpio)
+{
+	struct pinmux_data_reg *dr = NULL;
+	int bit = 0;
+
+	if (!gpioc || get_data_reg(gpioc, gpio, &dr, &bit) != 0) {
+		BUG();
+		return 0;
+	}
+
+	return gpio_read_reg(dr->reg, dr->reg_width, 1, bit);
+}
+
+static int sh_gpio_get(struct gpio_chip *chip, unsigned offset)
+{
+	return sh_gpio_get_value(chip_to_pinmux(chip), offset);
+}
+
+static void sh_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
+{
+	sh_gpio_set_value(chip_to_pinmux(chip), offset, value);
+}
+
+int register_pinmux(struct pinmux_info *pip)
+{
+	struct gpio_chip *chip = &pip->chip;
+
+	pr_info("sh pinmux: %s handling gpio %d -> %d\n",
+		pip->name, pip->first_gpio, pip->last_gpio);
+
+	setup_data_regs(pip);
+
+	chip->request = sh_gpio_request;
+	chip->free = sh_gpio_free;
+	chip->direction_input = sh_gpio_direction_input;
+	chip->get = sh_gpio_get;
+	chip->direction_output = sh_gpio_direction_output;
+	chip->set = sh_gpio_set;
+
+	WARN_ON(pip->first_gpio != 0); /* needs testing */
+
+	chip->label = pip->name;
+	chip->owner = THIS_MODULE;
+	chip->base = pip->first_gpio;
+	chip->ngpio = (pip->last_gpio - pip->first_gpio) + 1;
+
+	return gpiochip_add(chip);
+}
diff --git a/drivers/sn/ioc3.c b/drivers/sn/ioc3.c
index 816d4c592a3c..66802a4390cc 100644
--- a/drivers/sn/ioc3.c
+++ b/drivers/sn/ioc3.c
@@ -574,11 +574,11 @@ void ioc3_unregister_submodule(struct ioc3_submodule *is)
  * Device management *
  *********************/
 
-static char *
+static char * __devinitdata
 ioc3_class_names[]={"unknown", "IP27 BaseIO", "IP30 system", "MENET 1/2/3",
 			"MENET 4", "CADduo", "Altix Serial"};
 
-static int ioc3_class(struct ioc3_driver_data *idd)
+static int __devinit ioc3_class(struct ioc3_driver_data *idd)
 {
 	int res = IOC3_CLASS_NONE;
 	/* NIC-based logic */
@@ -601,7 +601,8 @@ static int ioc3_class(struct ioc3_driver_data *idd)
 	return res;
 }
 /* Adds a new instance of an IOC3 card */
-static int ioc3_probe(struct pci_dev *pdev, const struct pci_device_id *pci_id)
+static int __devinit
+ioc3_probe(struct pci_dev *pdev, const struct pci_device_id *pci_id)
 {
 	struct ioc3_driver_data *idd;
 	uint32_t pcmd;
@@ -753,7 +754,7 @@ out:
 }
 
 /* Removes a particular instance of an IOC3 card. */
-static void ioc3_remove(struct pci_dev *pdev)
+static void __devexit ioc3_remove(struct pci_dev *pdev)
 {
 	int id;
 	struct ioc3_driver_data *idd;
@@ -805,7 +806,7 @@ static struct pci_driver ioc3_driver = {
 	.name = "IOC3",
 	.id_table = ioc3_id_table,
 	.probe = ioc3_probe,
-	.remove = ioc3_remove,
+	.remove = __devexit_p(ioc3_remove),
 };
 
 MODULE_DEVICE_TABLE(pci, ioc3_id_table);
@@ -815,15 +816,15 @@ MODULE_DEVICE_TABLE(pci, ioc3_id_table);
  *********************/
 
 /* Module load */
-static int __devinit ioc3_init(void)
+static int __init ioc3_init(void)
 {
 	if (ia64_platform_is("sn2"))
 		return pci_register_driver(&ioc3_driver);
-	return 0;
+	return -ENODEV;
 }
 
 /* Module unload */
-static void __devexit ioc3_exit(void)
+static void __exit ioc3_exit(void)
 {
 	pci_unregister_driver(&ioc3_driver);
 }
diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig
index 4b6f7cba3b3d..f55eb0107336 100644
--- a/drivers/spi/Kconfig
+++ b/drivers/spi/Kconfig
@@ -133,6 +133,14 @@ config SPI_LM70_LLP
 	  which interfaces to an LM70 temperature sensor using
 	  a parallel port.
 
+config SPI_MPC52xx
+	tristate "Freescale MPC52xx SPI (non-PSC) controller support"
+	depends on PPC_MPC52xx && SPI
+	select SPI_MASTER_OF
+	help
+	  This drivers supports the MPC52xx SPI controller in master SPI
+	  mode.
+
 config SPI_MPC52xx_PSC
 	tristate "Freescale MPC52xx PSC SPI controller"
 	depends on PPC_MPC52xx && EXPERIMENTAL
@@ -147,9 +155,6 @@ config SPI_MPC8xxx
 	  This enables using the Freescale MPC8xxx SPI controllers in master
 	  mode.
 
-	  This driver uses a simple set of shift registers for data (opposed
-	  to the CPM based descriptor model).
-
 config SPI_OMAP_UWIRE
 	tristate "OMAP1 MicroWire"
 	depends on ARCH_OMAP1
@@ -164,6 +169,12 @@ config SPI_OMAP24XX
 	  SPI master controller for OMAP24xx/OMAP34xx Multichannel SPI
 	  (McSPI) modules.
 
+config SPI_OMAP_100K
+	tristate "OMAP SPI 100K"
+	depends on SPI_MASTER && (ARCH_OMAP850 || ARCH_OMAP730)
+	help
+	  OMAP SPI 100K master controller for omap7xx boards.
+
 config SPI_ORION
 	tristate "Orion SPI master (EXPERIMENTAL)"
 	depends on PLAT_ORION && EXPERIMENTAL
@@ -205,6 +216,17 @@ config SPI_S3C24XX
 	help
 	  SPI driver for Samsung S3C24XX series ARM SoCs
 
+config SPI_S3C24XX_FIQ
+	bool "S3C24XX driver with FIQ pseudo-DMA"
+	depends on SPI_S3C24XX
+	select FIQ
+	help
+	  Enable FIQ support for the S3C24XX SPI driver to provide pseudo
+	  DMA by using the fast-interrupt request framework, This allows
+	  the driver to get DMA-like performance when there are either
+	  no free DMA channels, or when doing transfers that required both
+	  TX and RX data paths.
+
 config SPI_S3C24XX_GPIO
 	tristate "Samsung S3C24XX series SPI by GPIO"
 	depends on ARCH_S3C2410 && EXPERIMENTAL
@@ -215,6 +237,20 @@ config SPI_S3C24XX_GPIO
 	  the inbuilt hardware cannot provide the transfer mode, or
 	  where the board is using non hardware connected pins.
 
+config SPI_S3C64XX
+	tristate "Samsung S3C64XX series type SPI"
+	depends on ARCH_S3C64XX && EXPERIMENTAL
+	select S3C64XX_DMA
+	help
+	  SPI driver for Samsung S3C64XX and newer SoCs.
+
+config SPI_SH_MSIOF
+	tristate "SuperH MSIOF SPI controller"
+	depends on SUPERH && HAVE_CLK
+	select SPI_BITBANG
+	help
+	  SPI driver for SuperH MSIOF blocks.
+
 config SPI_SH_SCI
 	tristate "SuperH SCI SPI controller"
 	depends on SUPERH
@@ -235,19 +271,52 @@ config SPI_TXX9
 	  SPI driver for Toshiba TXx9 MIPS SoCs
 
 config SPI_XILINX
-	tristate "Xilinx SPI controller"
-	depends on (XILINX_VIRTEX || MICROBLAZE) && EXPERIMENTAL
+	tristate "Xilinx SPI controller common module"
+	depends on HAS_IOMEM && EXPERIMENTAL
 	select SPI_BITBANG
+	select SPI_XILINX_OF if (XILINX_VIRTEX || MICROBLAZE)
 	help
 	  This exposes the SPI controller IP from the Xilinx EDK.
 
 	  See the "OPB Serial Peripheral Interface (SPI) (v1.00e)"
 	  Product Specification document (DS464) for hardware details.
 
+	  Or for the DS570, see "XPS Serial Peripheral Interface (SPI) (v2.00b)"
+
+config SPI_XILINX_OF
+	tristate "Xilinx SPI controller OF device"
+	depends on SPI_XILINX && (XILINX_VIRTEX || MICROBLAZE)
+	help
+	  This is the OF driver for the SPI controller IP from the Xilinx EDK.
+
+config SPI_XILINX_PLTFM
+	tristate "Xilinx SPI controller platform device"
+	depends on SPI_XILINX
+	help
+	  This is the platform driver for the SPI controller IP
+	  from the Xilinx EDK.
+
+config SPI_NUC900
+	tristate "Nuvoton NUC900 series SPI"
+	depends on ARCH_W90X900 && EXPERIMENTAL
+	select SPI_BITBANG
+	help
+	  SPI driver for Nuvoton NUC900 series ARM SoCs
+
 #
 # Add new SPI master controllers in alphabetical order above this line
 #
 
+config SPI_DESIGNWARE
+	bool "DesignWare SPI controller core support"
+	depends on SPI_MASTER
+	help
+	  general driver for SPI controller core from DesignWare
+
+config SPI_DW_PCI
+	tristate "PCI interface driver for DW SPI core"
+	depends on SPI_DESIGNWARE && PCI
+
 #
 # There are lots of SPI device types, with sensors and memory
 # being probably the most widely used ones.
diff --git a/drivers/spi/Makefile b/drivers/spi/Makefile
index 21a118269cac..f3d2810ba11c 100644
--- a/drivers/spi/Makefile
+++ b/drivers/spi/Makefile
@@ -16,23 +16,37 @@ obj-$(CONFIG_SPI_BFIN)			+= spi_bfin5xx.o
 obj-$(CONFIG_SPI_BITBANG)		+= spi_bitbang.o
 obj-$(CONFIG_SPI_AU1550)		+= au1550_spi.o
 obj-$(CONFIG_SPI_BUTTERFLY)		+= spi_butterfly.o
+obj-$(CONFIG_SPI_DESIGNWARE)		+= dw_spi.o
+obj-$(CONFIG_SPI_DW_PCI)		+= dw_spi_pci.o
 obj-$(CONFIG_SPI_GPIO)			+= spi_gpio.o
 obj-$(CONFIG_SPI_IMX)			+= spi_imx.o
 obj-$(CONFIG_SPI_LM70_LLP)		+= spi_lm70llp.o
 obj-$(CONFIG_SPI_PXA2XX)		+= pxa2xx_spi.o
 obj-$(CONFIG_SPI_OMAP_UWIRE)		+= omap_uwire.o
 obj-$(CONFIG_SPI_OMAP24XX)		+= omap2_mcspi.o
+obj-$(CONFIG_SPI_OMAP_100K)		+= omap_spi_100k.o
 obj-$(CONFIG_SPI_ORION)			+= orion_spi.o
 obj-$(CONFIG_SPI_PL022)			+= amba-pl022.o
 obj-$(CONFIG_SPI_MPC52xx_PSC)		+= mpc52xx_psc_spi.o
+obj-$(CONFIG_SPI_MPC52xx)		+= mpc52xx_spi.o
 obj-$(CONFIG_SPI_MPC8xxx)		+= spi_mpc8xxx.o
 obj-$(CONFIG_SPI_PPC4xx)		+= spi_ppc4xx.o
 obj-$(CONFIG_SPI_S3C24XX_GPIO)		+= spi_s3c24xx_gpio.o
-obj-$(CONFIG_SPI_S3C24XX)		+= spi_s3c24xx.o
+obj-$(CONFIG_SPI_S3C24XX)		+= spi_s3c24xx_hw.o
+obj-$(CONFIG_SPI_S3C64XX)		+= spi_s3c64xx.o
 obj-$(CONFIG_SPI_TXX9)			+= spi_txx9.o
 obj-$(CONFIG_SPI_XILINX)		+= xilinx_spi.o
+obj-$(CONFIG_SPI_XILINX_OF)		+= xilinx_spi_of.o
+obj-$(CONFIG_SPI_XILINX_PLTFM)		+= xilinx_spi_pltfm.o
 obj-$(CONFIG_SPI_SH_SCI)		+= spi_sh_sci.o
+obj-$(CONFIG_SPI_SH_MSIOF)		+= spi_sh_msiof.o
 obj-$(CONFIG_SPI_STMP3XXX)		+= spi_stmp.o
+obj-$(CONFIG_SPI_NUC900)		+= spi_nuc900.o
+
+# special build for s3c24xx spi driver with fiq support
+spi_s3c24xx_hw-y			:= spi_s3c24xx.o
+spi_s3c24xx_hw-$(CONFIG_SPI_S3C24XX_FIQ) += spi_s3c24xx_fiq.o
+
 # 	... add above this line ...
 
 # SPI protocol drivers (device/link on bus)
diff --git a/drivers/spi/atmel_spi.c b/drivers/spi/atmel_spi.c
index f5b3fdbb1e27..d21c24eaf0a9 100644
--- a/drivers/spi/atmel_spi.c
+++ b/drivers/spi/atmel_spi.c
@@ -189,14 +189,14 @@ static void atmel_spi_next_xfer_data(struct spi_master *master,
 
 	/* use scratch buffer only when rx or tx data is unspecified */
 	if (xfer->rx_buf)
-		*rx_dma = xfer->rx_dma + xfer->len - len;
+		*rx_dma = xfer->rx_dma + xfer->len - *plen;
 	else {
 		*rx_dma = as->buffer_dma;
 		if (len > BUFFER_SIZE)
 			len = BUFFER_SIZE;
 	}
 	if (xfer->tx_buf)
-		*tx_dma = xfer->tx_dma + xfer->len - len;
+		*tx_dma = xfer->tx_dma + xfer->len - *plen;
 	else {
 		*tx_dma = as->buffer_dma;
 		if (len > BUFFER_SIZE)
@@ -788,7 +788,7 @@ static int __init atmel_spi_probe(struct platform_device *pdev)
 	spin_lock_init(&as->lock);
 	INIT_LIST_HEAD(&as->queue);
 	as->pdev = pdev;
-	as->regs = ioremap(regs->start, (regs->end - regs->start) + 1);
+	as->regs = ioremap(regs->start, resource_size(regs));
 	if (!as->regs)
 		goto out_free_buffer;
 	as->irq = irq;
diff --git a/drivers/spi/au1550_spi.c b/drivers/spi/au1550_spi.c
index 76cbc1a66598..cfd5ff9508fa 100644
--- a/drivers/spi/au1550_spi.c
+++ b/drivers/spi/au1550_spi.c
@@ -237,8 +237,14 @@ static int au1550_spi_setupxfer(struct spi_device *spi, struct spi_transfer *t)
 	unsigned bpw, hz;
 	u32 cfg, stat;
 
-	bpw = t ? t->bits_per_word : spi->bits_per_word;
-	hz = t ? t->speed_hz : spi->max_speed_hz;
+	bpw = spi->bits_per_word;
+	hz = spi->max_speed_hz;
+	if (t) {
+		if (t->bits_per_word)
+			bpw = t->bits_per_word;
+		if (t->speed_hz)
+			hz = t->speed_hz;
+	}
 
 	if (bpw < 4 || bpw > 24) {
 		dev_err(&spi->dev, "setupxfer: invalid bits_per_word=%d\n",
diff --git a/drivers/spi/dw_spi.c b/drivers/spi/dw_spi.c
new file mode 100644
index 000000000000..31620fae77be
--- /dev/null
+++ b/drivers/spi/dw_spi.c
@@ -0,0 +1,944 @@
+/*
+ * dw_spi.c - Designware SPI core controller driver (refer pxa2xx_spi.c)
+ *
+ * Copyright (c) 2009, Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#include <linux/dma-mapping.h>
+#include <linux/interrupt.h>
+#include <linux/highmem.h>
+#include <linux/delay.h>
+
+#include <linux/spi/dw_spi.h>
+#include <linux/spi/spi.h>
+
+#ifdef CONFIG_DEBUG_FS
+#include <linux/debugfs.h>
+#endif
+
+#define START_STATE	((void *)0)
+#define RUNNING_STATE	((void *)1)
+#define DONE_STATE	((void *)2)
+#define ERROR_STATE	((void *)-1)
+
+#define QUEUE_RUNNING	0
+#define QUEUE_STOPPED	1
+
+#define MRST_SPI_DEASSERT	0
+#define MRST_SPI_ASSERT		1
+
+/* Slave spi_dev related */
+struct chip_data {
+	u16 cr0;
+	u8 cs;			/* chip select pin */
+	u8 n_bytes;		/* current is a 1/2/4 byte op */
+	u8 tmode;		/* TR/TO/RO/EEPROM */
+	u8 type;		/* SPI/SSP/MicroWire */
+
+	u8 poll_mode;		/* 1 means use poll mode */
+
+	u32 dma_width;
+	u32 rx_threshold;
+	u32 tx_threshold;
+	u8 enable_dma;
+	u8 bits_per_word;
+	u16 clk_div;		/* baud rate divider */
+	u32 speed_hz;		/* baud rate */
+	int (*write)(struct dw_spi *dws);
+	int (*read)(struct dw_spi *dws);
+	void (*cs_control)(u32 command);
+};
+
+#ifdef CONFIG_DEBUG_FS
+static int spi_show_regs_open(struct inode *inode, struct file *file)
+{
+	file->private_data = inode->i_private;
+	return 0;
+}
+
+#define SPI_REGS_BUFSIZE	1024
+static ssize_t  spi_show_regs(struct file *file, char __user *user_buf,
+				size_t count, loff_t *ppos)
+{
+	struct dw_spi *dws;
+	char *buf;
+	u32 len = 0;
+	ssize_t ret;
+
+	dws = file->private_data;
+
+	buf = kzalloc(SPI_REGS_BUFSIZE, GFP_KERNEL);
+	if (!buf)
+		return 0;
+
+	len += snprintf(buf + len, SPI_REGS_BUFSIZE - len,
+			"MRST SPI0 registers:\n");
+	len += snprintf(buf + len, SPI_REGS_BUFSIZE - len,
+			"=================================\n");
+	len += snprintf(buf + len, SPI_REGS_BUFSIZE - len,
+			"CTRL0: \t\t0x%08x\n", dw_readl(dws, ctrl0));
+	len += snprintf(buf + len, SPI_REGS_BUFSIZE - len,
+			"CTRL1: \t\t0x%08x\n", dw_readl(dws, ctrl1));
+	len += snprintf(buf + len, SPI_REGS_BUFSIZE - len,
+			"SSIENR: \t0x%08x\n", dw_readl(dws, ssienr));
+	len += snprintf(buf + len, SPI_REGS_BUFSIZE - len,
+			"SER: \t\t0x%08x\n", dw_readl(dws, ser));
+	len += snprintf(buf + len, SPI_REGS_BUFSIZE - len,
+			"BAUDR: \t\t0x%08x\n", dw_readl(dws, baudr));
+	len += snprintf(buf + len, SPI_REGS_BUFSIZE - len,
+			"TXFTLR: \t0x%08x\n", dw_readl(dws, txfltr));
+	len += snprintf(buf + len, SPI_REGS_BUFSIZE - len,
+			"RXFTLR: \t0x%08x\n", dw_readl(dws, rxfltr));
+	len += snprintf(buf + len, SPI_REGS_BUFSIZE - len,
+			"TXFLR: \t\t0x%08x\n", dw_readl(dws, txflr));
+	len += snprintf(buf + len, SPI_REGS_BUFSIZE - len,
+			"RXFLR: \t\t0x%08x\n", dw_readl(dws, rxflr));
+	len += snprintf(buf + len, SPI_REGS_BUFSIZE - len,
+			"SR: \t\t0x%08x\n", dw_readl(dws, sr));
+	len += snprintf(buf + len, SPI_REGS_BUFSIZE - len,
+			"IMR: \t\t0x%08x\n", dw_readl(dws, imr));
+	len += snprintf(buf + len, SPI_REGS_BUFSIZE - len,
+			"ISR: \t\t0x%08x\n", dw_readl(dws, isr));
+	len += snprintf(buf + len, SPI_REGS_BUFSIZE - len,
+			"DMACR: \t\t0x%08x\n", dw_readl(dws, dmacr));
+	len += snprintf(buf + len, SPI_REGS_BUFSIZE - len,
+			"DMATDLR: \t0x%08x\n", dw_readl(dws, dmatdlr));
+	len += snprintf(buf + len, SPI_REGS_BUFSIZE - len,
+			"DMARDLR: \t0x%08x\n", dw_readl(dws, dmardlr));
+	len += snprintf(buf + len, SPI_REGS_BUFSIZE - len,
+			"=================================\n");
+
+	ret =  simple_read_from_buffer(user_buf, count, ppos, buf, len);
+	kfree(buf);
+	return ret;
+}
+
+static const struct file_operations mrst_spi_regs_ops = {
+	.owner		= THIS_MODULE,
+	.open		= spi_show_regs_open,
+	.read		= spi_show_regs,
+};
+
+static int mrst_spi_debugfs_init(struct dw_spi *dws)
+{
+	dws->debugfs = debugfs_create_dir("mrst_spi", NULL);
+	if (!dws->debugfs)
+		return -ENOMEM;
+
+	debugfs_create_file("registers", S_IFREG | S_IRUGO,
+		dws->debugfs, (void *)dws, &mrst_spi_regs_ops);
+	return 0;
+}
+
+static void mrst_spi_debugfs_remove(struct dw_spi *dws)
+{
+	if (dws->debugfs)
+		debugfs_remove_recursive(dws->debugfs);
+}
+
+#else
+static inline int mrst_spi_debugfs_init(struct dw_spi *dws)
+{
+}
+
+static inline void mrst_spi_debugfs_remove(struct dw_spi *dws)
+{
+}
+#endif /* CONFIG_DEBUG_FS */
+
+static void wait_till_not_busy(struct dw_spi *dws)
+{
+	unsigned long end = jiffies + usecs_to_jiffies(1000);
+
+	while (time_before(jiffies, end)) {
+		if (!(dw_readw(dws, sr) & SR_BUSY))
+			return;
+	}
+	dev_err(&dws->master->dev,
+		"DW SPI: Stutus keeps busy for 1000us after a read/write!\n");
+}
+
+static void flush(struct dw_spi *dws)
+{
+	while (dw_readw(dws, sr) & SR_RF_NOT_EMPT)
+		dw_readw(dws, dr);
+
+	wait_till_not_busy(dws);
+}
+
+static void null_cs_control(u32 command)
+{
+}
+
+static int null_writer(struct dw_spi *dws)
+{
+	u8 n_bytes = dws->n_bytes;
+
+	if (!(dw_readw(dws, sr) & SR_TF_NOT_FULL)
+		|| (dws->tx == dws->tx_end))
+		return 0;
+	dw_writew(dws, dr, 0);
+	dws->tx += n_bytes;
+
+	wait_till_not_busy(dws);
+	return 1;
+}
+
+static int null_reader(struct dw_spi *dws)
+{
+	u8 n_bytes = dws->n_bytes;
+
+	while ((dw_readw(dws, sr) & SR_RF_NOT_EMPT)
+		&& (dws->rx < dws->rx_end)) {
+		dw_readw(dws, dr);
+		dws->rx += n_bytes;
+	}
+	wait_till_not_busy(dws);
+	return dws->rx == dws->rx_end;
+}
+
+static int u8_writer(struct dw_spi *dws)
+{
+	if (!(dw_readw(dws, sr) & SR_TF_NOT_FULL)
+		|| (dws->tx == dws->tx_end))
+		return 0;
+
+	dw_writew(dws, dr, *(u8 *)(dws->tx));
+	++dws->tx;
+
+	wait_till_not_busy(dws);
+	return 1;
+}
+
+static int u8_reader(struct dw_spi *dws)
+{
+	while ((dw_readw(dws, sr) & SR_RF_NOT_EMPT)
+		&& (dws->rx < dws->rx_end)) {
+		*(u8 *)(dws->rx) = dw_readw(dws, dr);
+		++dws->rx;
+	}
+
+	wait_till_not_busy(dws);
+	return dws->rx == dws->rx_end;
+}
+
+static int u16_writer(struct dw_spi *dws)
+{
+	if (!(dw_readw(dws, sr) & SR_TF_NOT_FULL)
+		|| (dws->tx == dws->tx_end))
+		return 0;
+
+	dw_writew(dws, dr, *(u16 *)(dws->tx));
+	dws->tx += 2;
+
+	wait_till_not_busy(dws);
+	return 1;
+}
+
+static int u16_reader(struct dw_spi *dws)
+{
+	u16 temp;
+
+	while ((dw_readw(dws, sr) & SR_RF_NOT_EMPT)
+		&& (dws->rx < dws->rx_end)) {
+		temp = dw_readw(dws, dr);
+		*(u16 *)(dws->rx) = temp;
+		dws->rx += 2;
+	}
+
+	wait_till_not_busy(dws);
+	return dws->rx == dws->rx_end;
+}
+
+static void *next_transfer(struct dw_spi *dws)
+{
+	struct spi_message *msg = dws->cur_msg;
+	struct spi_transfer *trans = dws->cur_transfer;
+
+	/* Move to next transfer */
+	if (trans->transfer_list.next != &msg->transfers) {
+		dws->cur_transfer =
+			list_entry(trans->transfer_list.next,
+					struct spi_transfer,
+					transfer_list);
+		return RUNNING_STATE;
+	} else
+		return DONE_STATE;
+}
+
+/*
+ * Note: first step is the protocol driver prepares
+ * a dma-capable memory, and this func just need translate
+ * the virt addr to physical
+ */
+static int map_dma_buffers(struct dw_spi *dws)
+{
+	if (!dws->cur_msg->is_dma_mapped || !dws->dma_inited
+		|| !dws->cur_chip->enable_dma)
+		return 0;
+
+	if (dws->cur_transfer->tx_dma)
+		dws->tx_dma = dws->cur_transfer->tx_dma;
+
+	if (dws->cur_transfer->rx_dma)
+		dws->rx_dma = dws->cur_transfer->rx_dma;
+
+	return 1;
+}
+
+/* Caller already set message->status; dma and pio irqs are blocked */
+static void giveback(struct dw_spi *dws)
+{
+	struct spi_transfer *last_transfer;
+	unsigned long flags;
+	struct spi_message *msg;
+
+	spin_lock_irqsave(&dws->lock, flags);
+	msg = dws->cur_msg;
+	dws->cur_msg = NULL;
+	dws->cur_transfer = NULL;
+	dws->prev_chip = dws->cur_chip;
+	dws->cur_chip = NULL;
+	dws->dma_mapped = 0;
+	queue_work(dws->workqueue, &dws->pump_messages);
+	spin_unlock_irqrestore(&dws->lock, flags);
+
+	last_transfer = list_entry(msg->transfers.prev,
+					struct spi_transfer,
+					transfer_list);
+
+	if (!last_transfer->cs_change)
+		dws->cs_control(MRST_SPI_DEASSERT);
+
+	msg->state = NULL;
+	if (msg->complete)
+		msg->complete(msg->context);
+}
+
+static void int_error_stop(struct dw_spi *dws, const char *msg)
+{
+	/* Stop and reset hw */
+	flush(dws);
+	spi_enable_chip(dws, 0);
+
+	dev_err(&dws->master->dev, "%s\n", msg);
+	dws->cur_msg->state = ERROR_STATE;
+	tasklet_schedule(&dws->pump_transfers);
+}
+
+static void transfer_complete(struct dw_spi *dws)
+{
+	/* Update total byte transfered return count actual bytes read */
+	dws->cur_msg->actual_length += dws->len;
+
+	/* Move to next transfer */
+	dws->cur_msg->state = next_transfer(dws);
+
+	/* Handle end of message */
+	if (dws->cur_msg->state == DONE_STATE) {
+		dws->cur_msg->status = 0;
+		giveback(dws);
+	} else
+		tasklet_schedule(&dws->pump_transfers);
+}
+
+static irqreturn_t interrupt_transfer(struct dw_spi *dws)
+{
+	u16 irq_status, irq_mask = 0x3f;
+
+	irq_status = dw_readw(dws, isr) & irq_mask;
+	/* Error handling */
+	if (irq_status & (SPI_INT_TXOI | SPI_INT_RXOI | SPI_INT_RXUI)) {
+		dw_readw(dws, txoicr);
+		dw_readw(dws, rxoicr);
+		dw_readw(dws, rxuicr);
+		int_error_stop(dws, "interrupt_transfer: fifo overrun");
+		return IRQ_HANDLED;
+	}
+
+	/* INT comes from tx */
+	if (dws->tx && (irq_status & SPI_INT_TXEI)) {
+		while (dws->tx < dws->tx_end)
+			dws->write(dws);
+
+		if (dws->tx == dws->tx_end) {
+			spi_mask_intr(dws, SPI_INT_TXEI);
+			transfer_complete(dws);
+		}
+	}
+
+	/* INT comes from rx */
+	if (dws->rx && (irq_status & SPI_INT_RXFI)) {
+		if (dws->read(dws))
+			transfer_complete(dws);
+	}
+	return IRQ_HANDLED;
+}
+
+static irqreturn_t dw_spi_irq(int irq, void *dev_id)
+{
+	struct dw_spi *dws = dev_id;
+
+	if (!dws->cur_msg) {
+		spi_mask_intr(dws, SPI_INT_TXEI);
+		/* Never fail */
+		return IRQ_HANDLED;
+	}
+
+	return dws->transfer_handler(dws);
+}
+
+/* Must be called inside pump_transfers() */
+static void poll_transfer(struct dw_spi *dws)
+{
+	if (dws->tx) {
+		while (dws->write(dws))
+			dws->read(dws);
+	}
+
+	dws->read(dws);
+	transfer_complete(dws);
+}
+
+static void dma_transfer(struct dw_spi *dws, int cs_change)
+{
+}
+
+static void pump_transfers(unsigned long data)
+{
+	struct dw_spi *dws = (struct dw_spi *)data;
+	struct spi_message *message = NULL;
+	struct spi_transfer *transfer = NULL;
+	struct spi_transfer *previous = NULL;
+	struct spi_device *spi = NULL;
+	struct chip_data *chip = NULL;
+	u8 bits = 0;
+	u8 imask = 0;
+	u8 cs_change = 0;
+	u16 clk_div = 0;
+	u32 speed = 0;
+	u32 cr0 = 0;
+
+	/* Get current state information */
+	message = dws->cur_msg;
+	transfer = dws->cur_transfer;
+	chip = dws->cur_chip;
+	spi = message->spi;
+
+	if (message->state == ERROR_STATE) {
+		message->status = -EIO;
+		goto early_exit;
+	}
+
+	/* Handle end of message */
+	if (message->state == DONE_STATE) {
+		message->status = 0;
+		goto early_exit;
+	}
+
+	/* Delay if requested at end of transfer*/
+	if (message->state == RUNNING_STATE) {
+		previous = list_entry(transfer->transfer_list.prev,
+					struct spi_transfer,
+					transfer_list);
+		if (previous->delay_usecs)
+			udelay(previous->delay_usecs);
+	}
+
+	dws->n_bytes = chip->n_bytes;
+	dws->dma_width = chip->dma_width;
+	dws->cs_control = chip->cs_control;
+
+	dws->rx_dma = transfer->rx_dma;
+	dws->tx_dma = transfer->tx_dma;
+	dws->tx = (void *)transfer->tx_buf;
+	dws->tx_end = dws->tx + transfer->len;
+	dws->rx = transfer->rx_buf;
+	dws->rx_end = dws->rx + transfer->len;
+	dws->write = dws->tx ? chip->write : null_writer;
+	dws->read = dws->rx ? chip->read : null_reader;
+	dws->cs_change = transfer->cs_change;
+	dws->len = dws->cur_transfer->len;
+	if (chip != dws->prev_chip)
+		cs_change = 1;
+
+	cr0 = chip->cr0;
+
+	/* Handle per transfer options for bpw and speed */
+	if (transfer->speed_hz) {
+		speed = chip->speed_hz;
+
+		if (transfer->speed_hz != speed) {
+			speed = transfer->speed_hz;
+			if (speed > dws->max_freq) {
+				printk(KERN_ERR "MRST SPI0: unsupported"
+					"freq: %dHz\n", speed);
+				message->status = -EIO;
+				goto early_exit;
+			}
+
+			/* clk_div doesn't support odd number */
+			clk_div = dws->max_freq / speed;
+			clk_div = (clk_div >> 1) << 1;
+
+			chip->speed_hz = speed;
+			chip->clk_div = clk_div;
+		}
+	}
+	if (transfer->bits_per_word) {
+		bits = transfer->bits_per_word;
+
+		switch (bits) {
+		case 8:
+			dws->n_bytes = 1;
+			dws->dma_width = 1;
+			dws->read = (dws->read != null_reader) ?
+					u8_reader : null_reader;
+			dws->write = (dws->write != null_writer) ?
+					u8_writer : null_writer;
+			break;
+		case 16:
+			dws->n_bytes = 2;
+			dws->dma_width = 2;
+			dws->read = (dws->read != null_reader) ?
+					u16_reader : null_reader;
+			dws->write = (dws->write != null_writer) ?
+					u16_writer : null_writer;
+			break;
+		default:
+			printk(KERN_ERR "MRST SPI0: unsupported bits:"
+				"%db\n", bits);
+			message->status = -EIO;
+			goto early_exit;
+		}
+
+		cr0 = (bits - 1)
+			| (chip->type << SPI_FRF_OFFSET)
+			| (spi->mode << SPI_MODE_OFFSET)
+			| (chip->tmode << SPI_TMOD_OFFSET);
+	}
+	message->state = RUNNING_STATE;
+
+	/* Check if current transfer is a DMA transaction */
+	dws->dma_mapped = map_dma_buffers(dws);
+
+	if (!dws->dma_mapped && !chip->poll_mode) {
+		if (dws->rx)
+			imask |= SPI_INT_RXFI;
+		if (dws->tx)
+			imask |= SPI_INT_TXEI;
+		dws->transfer_handler = interrupt_transfer;
+	}
+
+	/*
+	 * Reprogram registers only if
+	 *	1. chip select changes
+	 *	2. clk_div is changed
+	 *	3. control value changes
+	 */
+	if (dw_readw(dws, ctrl0) != cr0 || cs_change || clk_div) {
+		spi_enable_chip(dws, 0);
+
+		if (dw_readw(dws, ctrl0) != cr0)
+			dw_writew(dws, ctrl0, cr0);
+
+		/* Set the interrupt mask, for poll mode just diable all int */
+		spi_mask_intr(dws, 0xff);
+		if (!chip->poll_mode)
+			spi_umask_intr(dws, imask);
+
+		spi_set_clk(dws, clk_div ? clk_div : chip->clk_div);
+		spi_chip_sel(dws, spi->chip_select);
+		spi_enable_chip(dws, 1);
+
+		if (cs_change)
+			dws->prev_chip = chip;
+	}
+
+	if (dws->dma_mapped)
+		dma_transfer(dws, cs_change);
+
+	if (chip->poll_mode)
+		poll_transfer(dws);
+
+	return;
+
+early_exit:
+	giveback(dws);
+	return;
+}
+
+static void pump_messages(struct work_struct *work)
+{
+	struct dw_spi *dws =
+		container_of(work, struct dw_spi, pump_messages);
+	unsigned long flags;
+
+	/* Lock queue and check for queue work */
+	spin_lock_irqsave(&dws->lock, flags);
+	if (list_empty(&dws->queue) || dws->run == QUEUE_STOPPED) {
+		dws->busy = 0;
+		spin_unlock_irqrestore(&dws->lock, flags);
+		return;
+	}
+
+	/* Make sure we are not already running a message */
+	if (dws->cur_msg) {
+		spin_unlock_irqrestore(&dws->lock, flags);
+		return;
+	}
+
+	/* Extract head of queue */
+	dws->cur_msg = list_entry(dws->queue.next, struct spi_message, queue);
+	list_del_init(&dws->cur_msg->queue);
+
+	/* Initial message state*/
+	dws->cur_msg->state = START_STATE;
+	dws->cur_transfer = list_entry(dws->cur_msg->transfers.next,
+						struct spi_transfer,
+						transfer_list);
+	dws->cur_chip = spi_get_ctldata(dws->cur_msg->spi);
+
+	/* Mark as busy and launch transfers */
+	tasklet_schedule(&dws->pump_transfers);
+
+	dws->busy = 1;
+	spin_unlock_irqrestore(&dws->lock, flags);
+}
+
+/* spi_device use this to queue in their spi_msg */
+static int dw_spi_transfer(struct spi_device *spi, struct spi_message *msg)
+{
+	struct dw_spi *dws = spi_master_get_devdata(spi->master);
+	unsigned long flags;
+
+	spin_lock_irqsave(&dws->lock, flags);
+
+	if (dws->run == QUEUE_STOPPED) {
+		spin_unlock_irqrestore(&dws->lock, flags);
+		return -ESHUTDOWN;
+	}
+
+	msg->actual_length = 0;
+	msg->status = -EINPROGRESS;
+	msg->state = START_STATE;
+
+	list_add_tail(&msg->queue, &dws->queue);
+
+	if (dws->run == QUEUE_RUNNING && !dws->busy) {
+
+		if (dws->cur_transfer || dws->cur_msg)
+			queue_work(dws->workqueue,
+					&dws->pump_messages);
+		else {
+			/* If no other data transaction in air, just go */
+			spin_unlock_irqrestore(&dws->lock, flags);
+			pump_messages(&dws->pump_messages);
+			return 0;
+		}
+	}
+
+	spin_unlock_irqrestore(&dws->lock, flags);
+	return 0;
+}
+
+/* This may be called twice for each spi dev */
+static int dw_spi_setup(struct spi_device *spi)
+{
+	struct dw_spi_chip *chip_info = NULL;
+	struct chip_data *chip;
+
+	if (spi->bits_per_word != 8 && spi->bits_per_word != 16)
+		return -EINVAL;
+
+	/* Only alloc on first setup */
+	chip = spi_get_ctldata(spi);
+	if (!chip) {
+		chip = kzalloc(sizeof(struct chip_data), GFP_KERNEL);
+		if (!chip)
+			return -ENOMEM;
+
+		chip->cs_control = null_cs_control;
+		chip->enable_dma = 0;
+	}
+
+	/*
+	 * Protocol drivers may change the chip settings, so...
+	 * if chip_info exists, use it
+	 */
+	chip_info = spi->controller_data;
+
+	/* chip_info doesn't always exist */
+	if (chip_info) {
+		if (chip_info->cs_control)
+			chip->cs_control = chip_info->cs_control;
+
+		chip->poll_mode = chip_info->poll_mode;
+		chip->type = chip_info->type;
+
+		chip->rx_threshold = 0;
+		chip->tx_threshold = 0;
+
+		chip->enable_dma = chip_info->enable_dma;
+	}
+
+	if (spi->bits_per_word <= 8) {
+		chip->n_bytes = 1;
+		chip->dma_width = 1;
+		chip->read = u8_reader;
+		chip->write = u8_writer;
+	} else if (spi->bits_per_word <= 16) {
+		chip->n_bytes = 2;
+		chip->dma_width = 2;
+		chip->read = u16_reader;
+		chip->write = u16_writer;
+	} else {
+		/* Never take >16b case for MRST SPIC */
+		dev_err(&spi->dev, "invalid wordsize\n");
+		return -EINVAL;
+	}
+	chip->bits_per_word = spi->bits_per_word;
+
+	chip->speed_hz = spi->max_speed_hz;
+	if (chip->speed_hz)
+		chip->clk_div = 25000000 / chip->speed_hz;
+	else
+		chip->clk_div = 8;	/* default value */
+
+	chip->tmode = 0; /* Tx & Rx */
+	/* Default SPI mode is SCPOL = 0, SCPH = 0 */
+	chip->cr0 = (chip->bits_per_word - 1)
+			| (chip->type << SPI_FRF_OFFSET)
+			| (spi->mode  << SPI_MODE_OFFSET)
+			| (chip->tmode << SPI_TMOD_OFFSET);
+
+	spi_set_ctldata(spi, chip);
+	return 0;
+}
+
+static void dw_spi_cleanup(struct spi_device *spi)
+{
+	struct chip_data *chip = spi_get_ctldata(spi);
+	kfree(chip);
+}
+
+static int __init init_queue(struct dw_spi *dws)
+{
+	INIT_LIST_HEAD(&dws->queue);
+	spin_lock_init(&dws->lock);
+
+	dws->run = QUEUE_STOPPED;
+	dws->busy = 0;
+
+	tasklet_init(&dws->pump_transfers,
+			pump_transfers,	(unsigned long)dws);
+
+	INIT_WORK(&dws->pump_messages, pump_messages);
+	dws->workqueue = create_singlethread_workqueue(
+					dev_name(dws->master->dev.parent));
+	if (dws->workqueue == NULL)
+		return -EBUSY;
+
+	return 0;
+}
+
+static int start_queue(struct dw_spi *dws)
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(&dws->lock, flags);
+
+	if (dws->run == QUEUE_RUNNING || dws->busy) {
+		spin_unlock_irqrestore(&dws->lock, flags);
+		return -EBUSY;
+	}
+
+	dws->run = QUEUE_RUNNING;
+	dws->cur_msg = NULL;
+	dws->cur_transfer = NULL;
+	dws->cur_chip = NULL;
+	dws->prev_chip = NULL;
+	spin_unlock_irqrestore(&dws->lock, flags);
+
+	queue_work(dws->workqueue, &dws->pump_messages);
+
+	return 0;
+}
+
+static int stop_queue(struct dw_spi *dws)
+{
+	unsigned long flags;
+	unsigned limit = 50;
+	int status = 0;
+
+	spin_lock_irqsave(&dws->lock, flags);
+	dws->run = QUEUE_STOPPED;
+	while (!list_empty(&dws->queue) && dws->busy && limit--) {
+		spin_unlock_irqrestore(&dws->lock, flags);
+		msleep(10);
+		spin_lock_irqsave(&dws->lock, flags);
+	}
+
+	if (!list_empty(&dws->queue) || dws->busy)
+		status = -EBUSY;
+	spin_unlock_irqrestore(&dws->lock, flags);
+
+	return status;
+}
+
+static int destroy_queue(struct dw_spi *dws)
+{
+	int status;
+
+	status = stop_queue(dws);
+	if (status != 0)
+		return status;
+	destroy_workqueue(dws->workqueue);
+	return 0;
+}
+
+/* Restart the controller, disable all interrupts, clean rx fifo */
+static void spi_hw_init(struct dw_spi *dws)
+{
+	spi_enable_chip(dws, 0);
+	spi_mask_intr(dws, 0xff);
+	spi_enable_chip(dws, 1);
+	flush(dws);
+}
+
+int __devinit dw_spi_add_host(struct dw_spi *dws)
+{
+	struct spi_master *master;
+	int ret;
+
+	BUG_ON(dws == NULL);
+
+	master = spi_alloc_master(dws->parent_dev, 0);
+	if (!master) {
+		ret = -ENOMEM;
+		goto exit;
+	}
+
+	dws->master = master;
+	dws->type = SSI_MOTO_SPI;
+	dws->prev_chip = NULL;
+	dws->dma_inited = 0;
+	dws->dma_addr = (dma_addr_t)(dws->paddr + 0x60);
+
+	ret = request_irq(dws->irq, dw_spi_irq, 0,
+			"dw_spi", dws);
+	if (ret < 0) {
+		dev_err(&master->dev, "can not get IRQ\n");
+		goto err_free_master;
+	}
+
+	master->mode_bits = SPI_CPOL | SPI_CPHA;
+	master->bus_num = dws->bus_num;
+	master->num_chipselect = dws->num_cs;
+	master->cleanup = dw_spi_cleanup;
+	master->setup = dw_spi_setup;
+	master->transfer = dw_spi_transfer;
+
+	dws->dma_inited = 0;
+
+	/* Basic HW init */
+	spi_hw_init(dws);
+
+	/* Initial and start queue */
+	ret = init_queue(dws);
+	if (ret) {
+		dev_err(&master->dev, "problem initializing queue\n");
+		goto err_diable_hw;
+	}
+	ret = start_queue(dws);
+	if (ret) {
+		dev_err(&master->dev, "problem starting queue\n");
+		goto err_diable_hw;
+	}
+
+	spi_master_set_devdata(master, dws);
+	ret = spi_register_master(master);
+	if (ret) {
+		dev_err(&master->dev, "problem registering spi master\n");
+		goto err_queue_alloc;
+	}
+
+	mrst_spi_debugfs_init(dws);
+	return 0;
+
+err_queue_alloc:
+	destroy_queue(dws);
+err_diable_hw:
+	spi_enable_chip(dws, 0);
+	free_irq(dws->irq, dws);
+err_free_master:
+	spi_master_put(master);
+exit:
+	return ret;
+}
+EXPORT_SYMBOL(dw_spi_add_host);
+
+void __devexit dw_spi_remove_host(struct dw_spi *dws)
+{
+	int status = 0;
+
+	if (!dws)
+		return;
+	mrst_spi_debugfs_remove(dws);
+
+	/* Remove the queue */
+	status = destroy_queue(dws);
+	if (status != 0)
+		dev_err(&dws->master->dev, "dw_spi_remove: workqueue will not "
+			"complete, message memory not freed\n");
+
+	spi_enable_chip(dws, 0);
+	/* Disable clk */
+	spi_set_clk(dws, 0);
+	free_irq(dws->irq, dws);
+
+	/* Disconnect from the SPI framework */
+	spi_unregister_master(dws->master);
+}
+
+int dw_spi_suspend_host(struct dw_spi *dws)
+{
+	int ret = 0;
+
+	ret = stop_queue(dws);
+	if (ret)
+		return ret;
+	spi_enable_chip(dws, 0);
+	spi_set_clk(dws, 0);
+	return ret;
+}
+EXPORT_SYMBOL(dw_spi_suspend_host);
+
+int dw_spi_resume_host(struct dw_spi *dws)
+{
+	int ret;
+
+	spi_hw_init(dws);
+	ret = start_queue(dws);
+	if (ret)
+		dev_err(&dws->master->dev, "fail to start queue (%d)\n", ret);
+	return ret;
+}
+EXPORT_SYMBOL(dw_spi_resume_host);
+
+MODULE_AUTHOR("Feng Tang <feng.tang@intel.com>");
+MODULE_DESCRIPTION("Driver for DesignWare SPI controller core");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/spi/dw_spi_pci.c b/drivers/spi/dw_spi_pci.c
new file mode 100644
index 000000000000..34ba69161734
--- /dev/null
+++ b/drivers/spi/dw_spi_pci.c
@@ -0,0 +1,169 @@
+/*
+ * mrst_spi_pci.c - PCI interface driver for DW SPI Core
+ *
+ * Copyright (c) 2009, Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#include <linux/interrupt.h>
+#include <linux/pci.h>
+#include <linux/spi/dw_spi.h>
+#include <linux/spi/spi.h>
+
+#define DRIVER_NAME "dw_spi_pci"
+
+struct dw_spi_pci {
+	struct pci_dev		*pdev;
+	struct dw_spi		dws;
+};
+
+static int __devinit spi_pci_probe(struct pci_dev *pdev,
+	const struct pci_device_id *ent)
+{
+	struct dw_spi_pci *dwpci;
+	struct dw_spi *dws;
+	int pci_bar = 0;
+	int ret;
+
+	printk(KERN_INFO "DW: found PCI SPI controller(ID: %04x:%04x)\n",
+		pdev->vendor, pdev->device);
+
+	ret = pci_enable_device(pdev);
+	if (ret)
+		return ret;
+
+	dwpci = kzalloc(sizeof(struct dw_spi_pci), GFP_KERNEL);
+	if (!dwpci) {
+		ret = -ENOMEM;
+		goto err_disable;
+	}
+
+	dwpci->pdev = pdev;
+	dws = &dwpci->dws;
+
+	/* Get basic io resource and map it */
+	dws->paddr = pci_resource_start(pdev, pci_bar);
+	dws->iolen = pci_resource_len(pdev, pci_bar);
+
+	ret = pci_request_region(pdev, pci_bar, dev_name(&pdev->dev));
+	if (ret)
+		goto err_kfree;
+
+	dws->regs = ioremap_nocache((unsigned long)dws->paddr,
+				pci_resource_len(pdev, pci_bar));
+	if (!dws->regs) {
+		ret = -ENOMEM;
+		goto err_release_reg;
+	}
+
+	dws->parent_dev = &pdev->dev;
+	dws->bus_num = 0;
+	dws->num_cs = 4;
+	dws->max_freq = 25000000;	/* for Moorestwon */
+	dws->irq = pdev->irq;
+
+	ret = dw_spi_add_host(dws);
+	if (ret)
+		goto err_unmap;
+
+	/* PCI hook and SPI hook use the same drv data */
+	pci_set_drvdata(pdev, dwpci);
+	return 0;
+
+err_unmap:
+	iounmap(dws->regs);
+err_release_reg:
+	pci_release_region(pdev, pci_bar);
+err_kfree:
+	kfree(dwpci);
+err_disable:
+	pci_disable_device(pdev);
+	return ret;
+}
+
+static void __devexit spi_pci_remove(struct pci_dev *pdev)
+{
+	struct dw_spi_pci *dwpci = pci_get_drvdata(pdev);
+
+	pci_set_drvdata(pdev, NULL);
+	iounmap(dwpci->dws.regs);
+	pci_release_region(pdev, 0);
+	kfree(dwpci);
+	pci_disable_device(pdev);
+}
+
+#ifdef CONFIG_PM
+static int spi_suspend(struct pci_dev *pdev, pm_message_t state)
+{
+	struct dw_spi_pci *dwpci = pci_get_drvdata(pdev);
+	int ret;
+
+	ret = dw_spi_suspend_host(&dwpci->dws);
+	if (ret)
+		return ret;
+	pci_save_state(pdev);
+	pci_disable_device(pdev);
+	pci_set_power_state(pdev, pci_choose_state(pdev, state));
+	return ret;
+}
+
+static int spi_resume(struct pci_dev *pdev)
+{
+	struct dw_spi_pci *dwpci = pci_get_drvdata(pdev);
+	int ret;
+
+	pci_set_power_state(pdev, PCI_D0);
+	pci_restore_state(pdev);
+	ret = pci_enable_device(pdev);
+	if (ret)
+		return ret;
+	return dw_spi_resume_host(&dwpci->dws);
+}
+#else
+#define spi_suspend	NULL
+#define spi_resume	NULL
+#endif
+
+static const struct pci_device_id pci_ids[] __devinitdata = {
+	/* Intel Moorestown platform SPI controller 0 */
+	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x0800) },
+	{},
+};
+
+static struct pci_driver dw_spi_driver = {
+	.name =		DRIVER_NAME,
+	.id_table =	pci_ids,
+	.probe =	spi_pci_probe,
+	.remove =	__devexit_p(spi_pci_remove),
+	.suspend =	spi_suspend,
+	.resume	=	spi_resume,
+};
+
+static int __init mrst_spi_init(void)
+{
+	return pci_register_driver(&dw_spi_driver);
+}
+
+static void __exit mrst_spi_exit(void)
+{
+	pci_unregister_driver(&dw_spi_driver);
+}
+
+module_init(mrst_spi_init);
+module_exit(mrst_spi_exit);
+
+MODULE_AUTHOR("Feng Tang <feng.tang@intel.com>");
+MODULE_DESCRIPTION("PCI interface driver for DW SPI Core");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/spi/mpc52xx_psc_spi.c b/drivers/spi/mpc52xx_psc_spi.c
index 1b74d5ca03f3..f50c81df336a 100644
--- a/drivers/spi/mpc52xx_psc_spi.c
+++ b/drivers/spi/mpc52xx_psc_spi.c
@@ -17,6 +17,7 @@
 #include <linux/errno.h>
 #include <linux/interrupt.h>
 #include <linux/of_platform.h>
+#include <linux/of_spi.h>
 #include <linux/workqueue.h>
 #include <linux/completion.h>
 #include <linux/io.h>
@@ -313,11 +314,13 @@ static int mpc52xx_psc_spi_port_config(int psc_id, struct mpc52xx_psc_spi *mps)
 	struct mpc52xx_psc __iomem *psc = mps->psc;
 	struct mpc52xx_psc_fifo __iomem *fifo = mps->fifo;
 	u32 mclken_div;
-	int ret = 0;
+	int ret;
 
 	/* default sysclk is 512MHz */
 	mclken_div = (mps->sysclk ? mps->sysclk : 512000000) / MCLK;
-	mpc52xx_set_psc_clkdiv(psc_id, mclken_div);
+	ret = mpc52xx_set_psc_clkdiv(psc_id, mclken_div);
+	if (ret)
+		return ret;
 
 	/* Reset the PSC into a known state */
 	out_8(&psc->command, MPC52xx_PSC_RST_RX);
@@ -341,7 +344,7 @@ static int mpc52xx_psc_spi_port_config(int psc_id, struct mpc52xx_psc_spi *mps)
 
 	mps->bits_per_word = 8;
 
-	return ret;
+	return 0;
 }
 
 static irqreturn_t mpc52xx_psc_spi_isr(int irq, void *dev_id)
@@ -410,8 +413,10 @@ static int __init mpc52xx_psc_spi_do_probe(struct device *dev, u32 regaddr,
 		goto free_master;
 
 	ret = mpc52xx_psc_spi_port_config(master->bus_num, mps);
-	if (ret < 0)
+	if (ret < 0) {
+		dev_err(dev, "can't configure PSC! Is it capable of SPI?\n");
 		goto free_irq;
+	}
 
 	spin_lock_init(&mps->lock);
 	init_completion(&mps->done);
@@ -464,10 +469,11 @@ static int __init mpc52xx_psc_spi_of_probe(struct of_device *op,
 	const u32 *regaddr_p;
 	u64 regaddr64, size64;
 	s16 id = -1;
+	int rc;
 
 	regaddr_p = of_get_address(op->node, 0, &size64, NULL);
 	if (!regaddr_p) {
-		printk(KERN_ERR "Invalid PSC address\n");
+		dev_err(&op->dev, "Invalid PSC address\n");
 		return -EINVAL;
 	}
 	regaddr64 = of_translate_address(op->node, regaddr_p);
@@ -478,15 +484,18 @@ static int __init mpc52xx_psc_spi_of_probe(struct of_device *op,
 
 		psc_nump = of_get_property(op->node, "cell-index", NULL);
 		if (!psc_nump || *psc_nump > 5) {
-			printk(KERN_ERR "mpc52xx_psc_spi: Device node %s has invalid "
-					"cell-index property\n", op->node->full_name);
+			dev_err(&op->dev, "Invalid cell-index property\n");
 			return -EINVAL;
 		}
 		id = *psc_nump + 1;
 	}
 
-	return mpc52xx_psc_spi_do_probe(&op->dev, (u32)regaddr64, (u32)size64,
+	rc = mpc52xx_psc_spi_do_probe(&op->dev, (u32)regaddr64, (u32)size64,
 					irq_of_parse_and_map(op->node, 0), id);
+	if (rc == 0)
+		of_register_spi_devices(dev_get_drvdata(&op->dev), op->node);
+
+	return rc;
 }
 
 static int __exit mpc52xx_psc_spi_of_remove(struct of_device *op)
diff --git a/drivers/spi/mpc52xx_spi.c b/drivers/spi/mpc52xx_spi.c
new file mode 100644
index 000000000000..45bfe6458173
--- /dev/null
+++ b/drivers/spi/mpc52xx_spi.c
@@ -0,0 +1,578 @@
+/*
+ * MPC52xx SPI bus driver.
+ *
+ * Copyright (C) 2008 Secret Lab Technologies Ltd.
+ *
+ * This file is released under the GPLv2
+ *
+ * This is the driver for the MPC5200's dedicated SPI controller.
+ *
+ * Note: this driver does not support the MPC5200 PSC in SPI mode.  For
+ * that driver see drivers/spi/mpc52xx_psc_spi.c
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/errno.h>
+#include <linux/of_platform.h>
+#include <linux/interrupt.h>
+#include <linux/delay.h>
+#include <linux/spi/spi.h>
+#include <linux/of_spi.h>
+#include <linux/io.h>
+#include <linux/of_gpio.h>
+#include <asm/time.h>
+#include <asm/mpc52xx.h>
+
+MODULE_AUTHOR("Grant Likely <grant.likely@secretlab.ca>");
+MODULE_DESCRIPTION("MPC52xx SPI (non-PSC) Driver");
+MODULE_LICENSE("GPL");
+
+/* Register offsets */
+#define SPI_CTRL1	0x00
+#define SPI_CTRL1_SPIE		(1 << 7)
+#define SPI_CTRL1_SPE		(1 << 6)
+#define SPI_CTRL1_MSTR		(1 << 4)
+#define SPI_CTRL1_CPOL		(1 << 3)
+#define SPI_CTRL1_CPHA		(1 << 2)
+#define SPI_CTRL1_SSOE		(1 << 1)
+#define SPI_CTRL1_LSBFE		(1 << 0)
+
+#define SPI_CTRL2	0x01
+#define SPI_BRR		0x04
+
+#define SPI_STATUS	0x05
+#define SPI_STATUS_SPIF		(1 << 7)
+#define SPI_STATUS_WCOL		(1 << 6)
+#define SPI_STATUS_MODF		(1 << 4)
+
+#define SPI_DATA	0x09
+#define SPI_PORTDATA	0x0d
+#define SPI_DATADIR	0x10
+
+/* FSM state return values */
+#define FSM_STOP	0	/* Nothing more for the state machine to */
+				/* do.  If something interesting happens */
+				/* then an IRQ will be received */
+#define FSM_POLL	1	/* need to poll for completion, an IRQ is */
+				/* not expected */
+#define FSM_CONTINUE	2	/* Keep iterating the state machine */
+
+/* Driver internal data */
+struct mpc52xx_spi {
+	struct spi_master *master;
+	void __iomem *regs;
+	int irq0;	/* MODF irq */
+	int irq1;	/* SPIF irq */
+	unsigned int ipb_freq;
+
+	/* Statistics; not used now, but will be reintroduced for debugfs */
+	int msg_count;
+	int wcol_count;
+	int wcol_ticks;
+	u32 wcol_tx_timestamp;
+	int modf_count;
+	int byte_count;
+
+	struct list_head queue;		/* queue of pending messages */
+	spinlock_t lock;
+	struct work_struct work;
+
+	/* Details of current transfer (length, and buffer pointers) */
+	struct spi_message *message;	/* current message */
+	struct spi_transfer *transfer;	/* current transfer */
+	int (*state)(int irq, struct mpc52xx_spi *ms, u8 status, u8 data);
+	int len;
+	int timestamp;
+	u8 *rx_buf;
+	const u8 *tx_buf;
+	int cs_change;
+	int gpio_cs_count;
+	unsigned int *gpio_cs;
+};
+
+/*
+ * CS control function
+ */
+static void mpc52xx_spi_chipsel(struct mpc52xx_spi *ms, int value)
+{
+	int cs;
+
+	if (ms->gpio_cs_count > 0) {
+		cs = ms->message->spi->chip_select;
+		gpio_set_value(ms->gpio_cs[cs], value ? 0 : 1);
+	} else
+		out_8(ms->regs + SPI_PORTDATA, value ? 0 : 0x08);
+}
+
+/*
+ * Start a new transfer.  This is called both by the idle state
+ * for the first transfer in a message, and by the wait state when the
+ * previous transfer in a message is complete.
+ */
+static void mpc52xx_spi_start_transfer(struct mpc52xx_spi *ms)
+{
+	ms->rx_buf = ms->transfer->rx_buf;
+	ms->tx_buf = ms->transfer->tx_buf;
+	ms->len = ms->transfer->len;
+
+	/* Activate the chip select */
+	if (ms->cs_change)
+		mpc52xx_spi_chipsel(ms, 1);
+	ms->cs_change = ms->transfer->cs_change;
+
+	/* Write out the first byte */
+	ms->wcol_tx_timestamp = get_tbl();
+	if (ms->tx_buf)
+		out_8(ms->regs + SPI_DATA, *ms->tx_buf++);
+	else
+		out_8(ms->regs + SPI_DATA, 0);
+}
+
+/* Forward declaration of state handlers */
+static int mpc52xx_spi_fsmstate_transfer(int irq, struct mpc52xx_spi *ms,
+					 u8 status, u8 data);
+static int mpc52xx_spi_fsmstate_wait(int irq, struct mpc52xx_spi *ms,
+				     u8 status, u8 data);
+
+/*
+ * IDLE state
+ *
+ * No transfers are in progress; if another transfer is pending then retrieve
+ * it and kick it off.  Otherwise, stop processing the state machine
+ */
+static int
+mpc52xx_spi_fsmstate_idle(int irq, struct mpc52xx_spi *ms, u8 status, u8 data)
+{
+	struct spi_device *spi;
+	int spr, sppr;
+	u8 ctrl1;
+
+	if (status && (irq != NO_IRQ))
+		dev_err(&ms->master->dev, "spurious irq, status=0x%.2x\n",
+			status);
+
+	/* Check if there is another transfer waiting. */
+	if (list_empty(&ms->queue))
+		return FSM_STOP;
+
+	/* get the head of the queue */
+	ms->message = list_first_entry(&ms->queue, struct spi_message, queue);
+	list_del_init(&ms->message->queue);
+
+	/* Setup the controller parameters */
+	ctrl1 = SPI_CTRL1_SPIE | SPI_CTRL1_SPE | SPI_CTRL1_MSTR;
+	spi = ms->message->spi;
+	if (spi->mode & SPI_CPHA)
+		ctrl1 |= SPI_CTRL1_CPHA;
+	if (spi->mode & SPI_CPOL)
+		ctrl1 |= SPI_CTRL1_CPOL;
+	if (spi->mode & SPI_LSB_FIRST)
+		ctrl1 |= SPI_CTRL1_LSBFE;
+	out_8(ms->regs + SPI_CTRL1, ctrl1);
+
+	/* Setup the controller speed */
+	/* minimum divider is '2'.  Also, add '1' to force rounding the
+	 * divider up. */
+	sppr = ((ms->ipb_freq / ms->message->spi->max_speed_hz) + 1) >> 1;
+	spr = 0;
+	if (sppr < 1)
+		sppr = 1;
+	while (((sppr - 1) & ~0x7) != 0) {
+		sppr = (sppr + 1) >> 1; /* add '1' to force rounding up */
+		spr++;
+	}
+	sppr--;		/* sppr quantity in register is offset by 1 */
+	if (spr > 7) {
+		/* Don't overrun limits of SPI baudrate register */
+		spr = 7;
+		sppr = 7;
+	}
+	out_8(ms->regs + SPI_BRR, sppr << 4 | spr); /* Set speed */
+
+	ms->cs_change = 1;
+	ms->transfer = container_of(ms->message->transfers.next,
+				    struct spi_transfer, transfer_list);
+
+	mpc52xx_spi_start_transfer(ms);
+	ms->state = mpc52xx_spi_fsmstate_transfer;
+
+	return FSM_CONTINUE;
+}
+
+/*
+ * TRANSFER state
+ *
+ * In the middle of a transfer.  If the SPI core has completed processing
+ * a byte, then read out the received data and write out the next byte
+ * (unless this transfer is finished; in which case go on to the wait
+ * state)
+ */
+static int mpc52xx_spi_fsmstate_transfer(int irq, struct mpc52xx_spi *ms,
+					 u8 status, u8 data)
+{
+	if (!status)
+		return ms->irq0 ? FSM_STOP : FSM_POLL;
+
+	if (status & SPI_STATUS_WCOL) {
+		/* The SPI controller is stoopid.  At slower speeds, it may
+		 * raise the SPIF flag before the state machine is actually
+		 * finished, which causes a collision (internal to the state
+		 * machine only).  The manual recommends inserting a delay
+		 * between receiving the interrupt and sending the next byte,
+		 * but it can also be worked around simply by retrying the
+		 * transfer which is what we do here. */
+		ms->wcol_count++;
+		ms->wcol_ticks += get_tbl() - ms->wcol_tx_timestamp;
+		ms->wcol_tx_timestamp = get_tbl();
+		data = 0;
+		if (ms->tx_buf)
+			data = *(ms->tx_buf - 1);
+		out_8(ms->regs + SPI_DATA, data); /* try again */
+		return FSM_CONTINUE;
+	} else if (status & SPI_STATUS_MODF) {
+		ms->modf_count++;
+		dev_err(&ms->master->dev, "mode fault\n");
+		mpc52xx_spi_chipsel(ms, 0);
+		ms->message->status = -EIO;
+		ms->message->complete(ms->message->context);
+		ms->state = mpc52xx_spi_fsmstate_idle;
+		return FSM_CONTINUE;
+	}
+
+	/* Read data out of the spi device */
+	ms->byte_count++;
+	if (ms->rx_buf)
+		*ms->rx_buf++ = data;
+
+	/* Is the transfer complete? */
+	ms->len--;
+	if (ms->len == 0) {
+		ms->timestamp = get_tbl();
+		ms->timestamp += ms->transfer->delay_usecs * tb_ticks_per_usec;
+		ms->state = mpc52xx_spi_fsmstate_wait;
+		return FSM_CONTINUE;
+	}
+
+	/* Write out the next byte */
+	ms->wcol_tx_timestamp = get_tbl();
+	if (ms->tx_buf)
+		out_8(ms->regs + SPI_DATA, *ms->tx_buf++);
+	else
+		out_8(ms->regs + SPI_DATA, 0);
+
+	return FSM_CONTINUE;
+}
+
+/*
+ * WAIT state
+ *
+ * A transfer has completed; need to wait for the delay period to complete
+ * before starting the next transfer
+ */
+static int
+mpc52xx_spi_fsmstate_wait(int irq, struct mpc52xx_spi *ms, u8 status, u8 data)
+{
+	if (status && irq)
+		dev_err(&ms->master->dev, "spurious irq, status=0x%.2x\n",
+			status);
+
+	if (((int)get_tbl()) - ms->timestamp < 0)
+		return FSM_POLL;
+
+	ms->message->actual_length += ms->transfer->len;
+
+	/* Check if there is another transfer in this message.  If there
+	 * aren't then deactivate CS, notify sender, and drop back to idle
+	 * to start the next message. */
+	if (ms->transfer->transfer_list.next == &ms->message->transfers) {
+		ms->msg_count++;
+		mpc52xx_spi_chipsel(ms, 0);
+		ms->message->status = 0;
+		ms->message->complete(ms->message->context);
+		ms->state = mpc52xx_spi_fsmstate_idle;
+		return FSM_CONTINUE;
+	}
+
+	/* There is another transfer; kick it off */
+
+	if (ms->cs_change)
+		mpc52xx_spi_chipsel(ms, 0);
+
+	ms->transfer = container_of(ms->transfer->transfer_list.next,
+				    struct spi_transfer, transfer_list);
+	mpc52xx_spi_start_transfer(ms);
+	ms->state = mpc52xx_spi_fsmstate_transfer;
+	return FSM_CONTINUE;
+}
+
+/**
+ * mpc52xx_spi_fsm_process - Finite State Machine iteration function
+ * @irq: irq number that triggered the FSM or 0 for polling
+ * @ms: pointer to mpc52xx_spi driver data
+ */
+static void mpc52xx_spi_fsm_process(int irq, struct mpc52xx_spi *ms)
+{
+	int rc = FSM_CONTINUE;
+	u8 status, data;
+
+	while (rc == FSM_CONTINUE) {
+		/* Interrupt cleared by read of STATUS followed by
+		 * read of DATA registers */
+		status = in_8(ms->regs + SPI_STATUS);
+		data = in_8(ms->regs + SPI_DATA);
+		rc = ms->state(irq, ms, status, data);
+	}
+
+	if (rc == FSM_POLL)
+		schedule_work(&ms->work);
+}
+
+/**
+ * mpc52xx_spi_irq - IRQ handler
+ */
+static irqreturn_t mpc52xx_spi_irq(int irq, void *_ms)
+{
+	struct mpc52xx_spi *ms = _ms;
+	spin_lock(&ms->lock);
+	mpc52xx_spi_fsm_process(irq, ms);
+	spin_unlock(&ms->lock);
+	return IRQ_HANDLED;
+}
+
+/**
+ * mpc52xx_spi_wq - Workqueue function for polling the state machine
+ */
+static void mpc52xx_spi_wq(struct work_struct *work)
+{
+	struct mpc52xx_spi *ms = container_of(work, struct mpc52xx_spi, work);
+	unsigned long flags;
+
+	spin_lock_irqsave(&ms->lock, flags);
+	mpc52xx_spi_fsm_process(0, ms);
+	spin_unlock_irqrestore(&ms->lock, flags);
+}
+
+/*
+ * spi_master ops
+ */
+
+static int mpc52xx_spi_setup(struct spi_device *spi)
+{
+	if (spi->bits_per_word % 8)
+		return -EINVAL;
+
+	if (spi->mode & ~(SPI_CPOL | SPI_CPHA | SPI_LSB_FIRST))
+		return -EINVAL;
+
+	if (spi->chip_select >= spi->master->num_chipselect)
+		return -EINVAL;
+
+	return 0;
+}
+
+static int mpc52xx_spi_transfer(struct spi_device *spi, struct spi_message *m)
+{
+	struct mpc52xx_spi *ms = spi_master_get_devdata(spi->master);
+	unsigned long flags;
+
+	m->actual_length = 0;
+	m->status = -EINPROGRESS;
+
+	spin_lock_irqsave(&ms->lock, flags);
+	list_add_tail(&m->queue, &ms->queue);
+	spin_unlock_irqrestore(&ms->lock, flags);
+	schedule_work(&ms->work);
+
+	return 0;
+}
+
+/*
+ * OF Platform Bus Binding
+ */
+static int __devinit mpc52xx_spi_probe(struct of_device *op,
+				       const struct of_device_id *match)
+{
+	struct spi_master *master;
+	struct mpc52xx_spi *ms;
+	void __iomem *regs;
+	u8 ctrl1;
+	int rc, i = 0;
+	int gpio_cs;
+
+	/* MMIO registers */
+	dev_dbg(&op->dev, "probing mpc5200 SPI device\n");
+	regs = of_iomap(op->node, 0);
+	if (!regs)
+		return -ENODEV;
+
+	/* initialize the device */
+	ctrl1 = SPI_CTRL1_SPIE | SPI_CTRL1_SPE | SPI_CTRL1_MSTR;
+	out_8(regs + SPI_CTRL1, ctrl1);
+	out_8(regs + SPI_CTRL2, 0x0);
+	out_8(regs + SPI_DATADIR, 0xe);	/* Set output pins */
+	out_8(regs + SPI_PORTDATA, 0x8);	/* Deassert /SS signal */
+
+	/* Clear the status register and re-read it to check for a MODF
+	 * failure.  This driver cannot currently handle multiple masters
+	 * on the SPI bus.  This fault will also occur if the SPI signals
+	 * are not connected to any pins (port_config setting) */
+	in_8(regs + SPI_STATUS);
+	out_8(regs + SPI_CTRL1, ctrl1);
+
+	in_8(regs + SPI_DATA);
+	if (in_8(regs + SPI_STATUS) & SPI_STATUS_MODF) {
+		dev_err(&op->dev, "mode fault; is port_config correct?\n");
+		rc = -EIO;
+		goto err_init;
+	}
+
+	dev_dbg(&op->dev, "allocating spi_master struct\n");
+	master = spi_alloc_master(&op->dev, sizeof *ms);
+	if (!master) {
+		rc = -ENOMEM;
+		goto err_alloc;
+	}
+
+	master->bus_num = -1;
+	master->setup = mpc52xx_spi_setup;
+	master->transfer = mpc52xx_spi_transfer;
+	master->mode_bits = SPI_CPOL | SPI_CPHA | SPI_LSB_FIRST;
+
+	dev_set_drvdata(&op->dev, master);
+
+	ms = spi_master_get_devdata(master);
+	ms->master = master;
+	ms->regs = regs;
+	ms->irq0 = irq_of_parse_and_map(op->node, 0);
+	ms->irq1 = irq_of_parse_and_map(op->node, 1);
+	ms->state = mpc52xx_spi_fsmstate_idle;
+	ms->ipb_freq = mpc5xxx_get_bus_frequency(op->node);
+	ms->gpio_cs_count = of_gpio_count(op->node);
+	if (ms->gpio_cs_count > 0) {
+		master->num_chipselect = ms->gpio_cs_count;
+		ms->gpio_cs = kmalloc(ms->gpio_cs_count * sizeof(unsigned int),
+				GFP_KERNEL);
+		if (!ms->gpio_cs) {
+			rc = -ENOMEM;
+			goto err_alloc;
+		}
+
+		for (i = 0; i < ms->gpio_cs_count; i++) {
+			gpio_cs = of_get_gpio(op->node, i);
+			if (gpio_cs < 0) {
+				dev_err(&op->dev,
+					"could not parse the gpio field "
+					"in oftree\n");
+				rc = -ENODEV;
+				goto err_gpio;
+			}
+
+			rc = gpio_request(gpio_cs, dev_name(&op->dev));
+			if (rc) {
+				dev_err(&op->dev,
+					"can't request spi cs gpio #%d "
+					"on gpio line %d\n", i, gpio_cs);
+				goto err_gpio;
+			}
+
+			gpio_direction_output(gpio_cs, 1);
+			ms->gpio_cs[i] = gpio_cs;
+		}
+	} else {
+		master->num_chipselect = 1;
+	}
+
+	spin_lock_init(&ms->lock);
+	INIT_LIST_HEAD(&ms->queue);
+	INIT_WORK(&ms->work, mpc52xx_spi_wq);
+
+	/* Decide if interrupts can be used */
+	if (ms->irq0 && ms->irq1) {
+		rc = request_irq(ms->irq0, mpc52xx_spi_irq, 0,
+				  "mpc5200-spi-modf", ms);
+		rc |= request_irq(ms->irq1, mpc52xx_spi_irq, 0,
+				  "mpc5200-spi-spif", ms);
+		if (rc) {
+			free_irq(ms->irq0, ms);
+			free_irq(ms->irq1, ms);
+			ms->irq0 = ms->irq1 = 0;
+		}
+	} else {
+		/* operate in polled mode */
+		ms->irq0 = ms->irq1 = 0;
+	}
+
+	if (!ms->irq0)
+		dev_info(&op->dev, "using polled mode\n");
+
+	dev_dbg(&op->dev, "registering spi_master struct\n");
+	rc = spi_register_master(master);
+	if (rc)
+		goto err_register;
+
+	of_register_spi_devices(master, op->node);
+	dev_info(&ms->master->dev, "registered MPC5200 SPI bus\n");
+
+	return rc;
+
+ err_register:
+	dev_err(&ms->master->dev, "initialization failed\n");
+	spi_master_put(master);
+ err_gpio:
+	while (i-- > 0)
+		gpio_free(ms->gpio_cs[i]);
+
+	kfree(ms->gpio_cs);
+ err_alloc:
+ err_init:
+	iounmap(regs);
+	return rc;
+}
+
+static int __devexit mpc52xx_spi_remove(struct of_device *op)
+{
+	struct spi_master *master = dev_get_drvdata(&op->dev);
+	struct mpc52xx_spi *ms = spi_master_get_devdata(master);
+	int i;
+
+	free_irq(ms->irq0, ms);
+	free_irq(ms->irq1, ms);
+
+	for (i = 0; i < ms->gpio_cs_count; i++)
+		gpio_free(ms->gpio_cs[i]);
+
+	kfree(ms->gpio_cs);
+	spi_unregister_master(master);
+	spi_master_put(master);
+	iounmap(ms->regs);
+
+	return 0;
+}
+
+static struct of_device_id mpc52xx_spi_match[] __devinitdata = {
+	{ .compatible = "fsl,mpc5200-spi", },
+	{}
+};
+MODULE_DEVICE_TABLE(of, mpc52xx_spi_match);
+
+static struct of_platform_driver mpc52xx_spi_of_driver = {
+	.owner = THIS_MODULE,
+	.name = "mpc52xx-spi",
+	.match_table = mpc52xx_spi_match,
+	.probe = mpc52xx_spi_probe,
+	.remove = __exit_p(mpc52xx_spi_remove),
+};
+
+static int __init mpc52xx_spi_init(void)
+{
+	return of_register_platform_driver(&mpc52xx_spi_of_driver);
+}
+module_init(mpc52xx_spi_init);
+
+static void __exit mpc52xx_spi_exit(void)
+{
+	of_unregister_platform_driver(&mpc52xx_spi_of_driver);
+}
+module_exit(mpc52xx_spi_exit);
+
diff --git a/drivers/spi/omap_spi_100k.c b/drivers/spi/omap_spi_100k.c
new file mode 100644
index 000000000000..5355d90d1bee
--- /dev/null
+++ b/drivers/spi/omap_spi_100k.c
@@ -0,0 +1,635 @@
+/*
+ * OMAP7xx SPI 100k controller driver
+ * Author: Fabrice Crohas <fcrohas@gmail.com>
+ * from original omap1_mcspi driver
+ *
+ * Copyright (C) 2005, 2006 Nokia Corporation
+ * Author:      Samuel Ortiz <samuel.ortiz@nokia.com> and
+ *              Juha Yrj�l� <juha.yrjola@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ *
+ */
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/interrupt.h>
+#include <linux/module.h>
+#include <linux/device.h>
+#include <linux/delay.h>
+#include <linux/platform_device.h>
+#include <linux/err.h>
+#include <linux/clk.h>
+#include <linux/io.h>
+#include <linux/gpio.h>
+
+#include <linux/spi/spi.h>
+
+#include <plat/clock.h>
+
+#define OMAP1_SPI100K_MAX_FREQ          48000000
+
+#define ICR_SPITAS      (OMAP7XX_ICR_BASE + 0x12)
+
+#define SPI_SETUP1      0x00
+#define SPI_SETUP2      0x02
+#define SPI_CTRL        0x04
+#define SPI_STATUS      0x06
+#define SPI_TX_LSB      0x08
+#define SPI_TX_MSB      0x0a
+#define SPI_RX_LSB      0x0c
+#define SPI_RX_MSB      0x0e
+
+#define SPI_SETUP1_INT_READ_ENABLE      (1UL << 5)
+#define SPI_SETUP1_INT_WRITE_ENABLE     (1UL << 4)
+#define SPI_SETUP1_CLOCK_DIVISOR(x)     ((x) << 1)
+#define SPI_SETUP1_CLOCK_ENABLE         (1UL << 0)
+
+#define SPI_SETUP2_ACTIVE_EDGE_FALLING  (0UL << 0)
+#define SPI_SETUP2_ACTIVE_EDGE_RISING   (1UL << 0)
+#define SPI_SETUP2_NEGATIVE_LEVEL       (0UL << 5)
+#define SPI_SETUP2_POSITIVE_LEVEL       (1UL << 5)
+#define SPI_SETUP2_LEVEL_TRIGGER        (0UL << 10)
+#define SPI_SETUP2_EDGE_TRIGGER         (1UL << 10)
+
+#define SPI_CTRL_SEN(x)                 ((x) << 7)
+#define SPI_CTRL_WORD_SIZE(x)           (((x) - 1) << 2)
+#define SPI_CTRL_WR                     (1UL << 1)
+#define SPI_CTRL_RD                     (1UL << 0)
+
+#define SPI_STATUS_WE                   (1UL << 1)
+#define SPI_STATUS_RD                   (1UL << 0)
+
+#define WRITE 0
+#define READ  1
+
+
+/* use PIO for small transfers, avoiding DMA setup/teardown overhead and
+ * cache operations; better heuristics consider wordsize and bitrate.
+ */
+#define DMA_MIN_BYTES                   8
+
+#define SPI_RUNNING	0
+#define SPI_SHUTDOWN	1
+
+struct omap1_spi100k {
+	struct work_struct      work;
+
+	/* lock protects queue and registers */
+	spinlock_t              lock;
+	struct list_head        msg_queue;
+	struct spi_master       *master;
+	struct clk              *ick;
+	struct clk              *fck;
+
+	/* Virtual base address of the controller */
+	void __iomem            *base;
+
+	/* State of the SPI */
+	unsigned int		state;
+};
+
+struct omap1_spi100k_cs {
+	void __iomem            *base;
+	int                     word_len;
+};
+
+static struct workqueue_struct *omap1_spi100k_wq;
+
+#define MOD_REG_BIT(val, mask, set) do { \
+	if (set) \
+		val |= mask; \
+	else \
+		val &= ~mask; \
+} while (0)
+
+static void spi100k_enable_clock(struct spi_master *master)
+{
+	unsigned int val;
+	struct omap1_spi100k *spi100k = spi_master_get_devdata(master);
+
+	/* enable SPI */
+	val = readw(spi100k->base + SPI_SETUP1);
+	val |= SPI_SETUP1_CLOCK_ENABLE;
+	writew(val, spi100k->base + SPI_SETUP1);
+}
+
+static void spi100k_disable_clock(struct spi_master *master)
+{
+	unsigned int val;
+	struct omap1_spi100k *spi100k = spi_master_get_devdata(master);
+
+	/* disable SPI */
+	val = readw(spi100k->base + SPI_SETUP1);
+	val &= ~SPI_SETUP1_CLOCK_ENABLE;
+	writew(val, spi100k->base + SPI_SETUP1);
+}
+
+static void spi100k_write_data(struct spi_master *master, int len, int data)
+{
+	struct omap1_spi100k *spi100k = spi_master_get_devdata(master);
+
+	/* write 16-bit word */
+	spi100k_enable_clock(master);
+	writew( data , spi100k->base + SPI_TX_MSB);
+
+	writew(SPI_CTRL_SEN(0) |
+	       SPI_CTRL_WORD_SIZE(len) |
+	       SPI_CTRL_WR,
+	       spi100k->base + SPI_CTRL);
+
+	/* Wait for bit ack send change */
+	while((readw(spi100k->base + SPI_STATUS) & SPI_STATUS_WE) != SPI_STATUS_WE);
+	udelay(1000);
+
+	spi100k_disable_clock(master);
+}
+
+static int spi100k_read_data(struct spi_master *master, int len)
+{
+	int dataH,dataL;
+	struct omap1_spi100k *spi100k = spi_master_get_devdata(master);
+
+	spi100k_enable_clock(master);
+	writew(SPI_CTRL_SEN(0) |
+	       SPI_CTRL_WORD_SIZE(len) |
+	       SPI_CTRL_RD,
+	       spi100k->base + SPI_CTRL);
+
+	while((readw(spi100k->base + SPI_STATUS) & SPI_STATUS_RD) != SPI_STATUS_RD);
+	udelay(1000);
+
+	dataL = readw(spi100k->base + SPI_RX_LSB);
+	dataH = readw(spi100k->base + SPI_RX_MSB);
+	spi100k_disable_clock(master);
+
+	return dataL;
+}
+
+static void spi100k_open(struct spi_master *master)
+{
+	/* get control of SPI */
+	struct omap1_spi100k *spi100k = spi_master_get_devdata(master);
+
+	writew(SPI_SETUP1_INT_READ_ENABLE |
+	       SPI_SETUP1_INT_WRITE_ENABLE |
+	       SPI_SETUP1_CLOCK_DIVISOR(0), spi100k->base + SPI_SETUP1);
+
+	/* configure clock and interrupts */
+	writew(SPI_SETUP2_ACTIVE_EDGE_FALLING |
+	       SPI_SETUP2_NEGATIVE_LEVEL |
+	       SPI_SETUP2_LEVEL_TRIGGER, spi100k->base + SPI_SETUP2);
+}
+
+static void omap1_spi100k_force_cs(struct omap1_spi100k *spi100k, int enable)
+{
+	if (enable)
+		writew(0x05fc, spi100k->base + SPI_CTRL);
+	else
+		writew(0x05fd, spi100k->base + SPI_CTRL);
+}
+
+static unsigned
+omap1_spi100k_txrx_pio(struct spi_device *spi, struct spi_transfer *xfer)
+{
+	struct omap1_spi100k    *spi100k;
+	struct omap1_spi100k_cs *cs = spi->controller_state;
+	unsigned int            count, c;
+	int                     word_len;
+
+	spi100k = spi_master_get_devdata(spi->master);
+	count = xfer->len;
+	c = count;
+	word_len = cs->word_len;
+
+	/* RX_ONLY mode needs dummy data in TX reg */
+	if (xfer->tx_buf == NULL)
+		spi100k_write_data(spi->master,word_len, 0);
+
+	if (word_len <= 8) {
+		u8              *rx;
+		const u8        *tx;
+
+		rx = xfer->rx_buf;
+		tx = xfer->tx_buf;
+		do {
+			c-=1;
+			if (xfer->tx_buf != NULL)
+				spi100k_write_data(spi->master,word_len, *tx);
+			if (xfer->rx_buf != NULL)
+				*rx = spi100k_read_data(spi->master,word_len);
+		} while(c);
+	} else if (word_len <= 16) {
+		u16             *rx;
+		const u16       *tx;
+
+		rx = xfer->rx_buf;
+		tx = xfer->tx_buf;
+		do {
+			c-=2;
+			if (xfer->tx_buf != NULL)
+				spi100k_write_data(spi->master,word_len, *tx++);
+			if (xfer->rx_buf != NULL)
+				*rx++ = spi100k_read_data(spi->master,word_len);
+		} while(c);
+	} else if (word_len <= 32) {
+		u32             *rx;
+		const u32       *tx;
+
+		rx = xfer->rx_buf;
+		tx = xfer->tx_buf;
+		do {
+			c-=4;
+			if (xfer->tx_buf != NULL)
+				spi100k_write_data(spi->master,word_len, *tx);
+			if (xfer->rx_buf != NULL)
+				*rx = spi100k_read_data(spi->master,word_len);
+		} while(c);
+	}
+	return count - c;
+}
+
+/* called only when no transfer is active to this device */
+static int omap1_spi100k_setup_transfer(struct spi_device *spi,
+		struct spi_transfer *t)
+{
+	struct omap1_spi100k *spi100k = spi_master_get_devdata(spi->master);
+	struct omap1_spi100k_cs *cs = spi->controller_state;
+	u8 word_len = spi->bits_per_word;
+
+	if (t != NULL && t->bits_per_word)
+		word_len = t->bits_per_word;
+	if (!word_len)
+		word_len = 8;
+
+	if (spi->bits_per_word > 32)
+		return -EINVAL;
+	cs->word_len = word_len;
+
+	/* SPI init before transfer */
+	writew(0x3e , spi100k->base + SPI_SETUP1);
+	writew(0x00 , spi100k->base + SPI_STATUS);
+	writew(0x3e , spi100k->base + SPI_CTRL);
+
+	return 0;
+}
+
+/* the spi->mode bits understood by this driver: */
+#define MODEBITS (SPI_CPOL | SPI_CPHA | SPI_CS_HIGH)
+
+static int omap1_spi100k_setup(struct spi_device *spi)
+{
+	int                     ret;
+	struct omap1_spi100k    *spi100k;
+	struct omap1_spi100k_cs *cs = spi->controller_state;
+
+	if (spi->bits_per_word < 4 || spi->bits_per_word > 32) {
+		 dev_dbg(&spi->dev, "setup: unsupported %d bit words\n",
+			spi->bits_per_word);
+		 return -EINVAL;
+	}
+
+	spi100k = spi_master_get_devdata(spi->master);
+
+	if (!cs) {
+		cs = kzalloc(sizeof *cs, GFP_KERNEL);
+		if (!cs)
+			return -ENOMEM;
+		cs->base = spi100k->base + spi->chip_select * 0x14;
+		spi->controller_state = cs;
+	}
+
+	spi100k_open(spi->master);
+
+	clk_enable(spi100k->ick);
+	clk_enable(spi100k->fck);
+
+	ret = omap1_spi100k_setup_transfer(spi, NULL);
+
+	clk_disable(spi100k->ick);
+	clk_disable(spi100k->fck);
+
+	return ret;
+}
+
+static void omap1_spi100k_work(struct work_struct *work)
+{
+	struct omap1_spi100k    *spi100k;
+	int status = 0;
+
+	spi100k = container_of(work, struct omap1_spi100k, work);
+	spin_lock_irq(&spi100k->lock);
+
+	clk_enable(spi100k->ick);
+	clk_enable(spi100k->fck);
+
+	/* We only enable one channel at a time -- the one whose message is
+	 * at the head of the queue -- although this controller would gladly
+	 * arbitrate among multiple channels.  This corresponds to "single
+	 * channel" master mode.  As a side effect, we need to manage the
+	 * chipselect with the FORCE bit ... CS != channel enable.
+	 */
+	 while (!list_empty(&spi100k->msg_queue)) {
+		struct spi_message              *m;
+		struct spi_device               *spi;
+		struct spi_transfer             *t = NULL;
+		int                             cs_active = 0;
+		struct omap1_spi100k_cs         *cs;
+		int                             par_override = 0;
+
+		m = container_of(spi100k->msg_queue.next, struct spi_message,
+				 queue);
+
+		list_del_init(&m->queue);
+		spin_unlock_irq(&spi100k->lock);
+
+		spi = m->spi;
+		cs = spi->controller_state;
+
+		list_for_each_entry(t, &m->transfers, transfer_list) {
+			if (t->tx_buf == NULL && t->rx_buf == NULL && t->len) {
+				status = -EINVAL;
+				break;
+			}
+			if (par_override || t->speed_hz || t->bits_per_word) {
+				par_override = 1;
+				status = omap1_spi100k_setup_transfer(spi, t);
+				if (status < 0)
+					break;
+				if (!t->speed_hz && !t->bits_per_word)
+					par_override = 0;
+			}
+
+			if (!cs_active) {
+				omap1_spi100k_force_cs(spi100k, 1);
+				cs_active = 1;
+			}
+
+			if (t->len) {
+				unsigned count;
+
+				/* RX_ONLY mode needs dummy data in TX reg */
+				if (t->tx_buf == NULL)
+					spi100k_write_data(spi->master, 8, 0);
+
+				count = omap1_spi100k_txrx_pio(spi, t);
+				m->actual_length += count;
+
+				if (count != t->len) {
+					status = -EIO;
+					break;
+				}
+			}
+
+			if (t->delay_usecs)
+				udelay(t->delay_usecs);
+
+			/* ignore the "leave it on after last xfer" hint */
+
+			if (t->cs_change) {
+				omap1_spi100k_force_cs(spi100k, 0);
+				cs_active = 0;
+			}
+		}
+
+		/* Restore defaults if they were overriden */
+		if (par_override) {
+			par_override = 0;
+			status = omap1_spi100k_setup_transfer(spi, NULL);
+		}
+
+		if (cs_active)
+			omap1_spi100k_force_cs(spi100k, 0);
+
+		m->status = status;
+		m->complete(m->context);
+
+		spin_lock_irq(&spi100k->lock);
+	}
+
+	clk_disable(spi100k->ick);
+	clk_disable(spi100k->fck);
+	spin_unlock_irq(&spi100k->lock);
+
+	if (status < 0)
+		printk(KERN_WARNING "spi transfer failed with %d\n", status);
+}
+
+static int omap1_spi100k_transfer(struct spi_device *spi, struct spi_message *m)
+{
+	struct omap1_spi100k    *spi100k;
+	unsigned long           flags;
+	struct spi_transfer     *t;
+
+	m->actual_length = 0;
+	m->status = -EINPROGRESS;
+
+	spi100k = spi_master_get_devdata(spi->master);
+
+	/* Don't accept new work if we're shutting down */
+	if (spi100k->state == SPI_SHUTDOWN)
+		return -ESHUTDOWN;
+
+	/* reject invalid messages and transfers */
+	if (list_empty(&m->transfers) || !m->complete)
+		return -EINVAL;
+
+	list_for_each_entry(t, &m->transfers, transfer_list) {
+		const void      *tx_buf = t->tx_buf;
+		void            *rx_buf = t->rx_buf;
+		unsigned        len = t->len;
+
+		if (t->speed_hz > OMAP1_SPI100K_MAX_FREQ
+				|| (len && !(rx_buf || tx_buf))
+				|| (t->bits_per_word &&
+					(  t->bits_per_word < 4
+					|| t->bits_per_word > 32))) {
+			dev_dbg(&spi->dev, "transfer: %d Hz, %d %s%s, %d bpw\n",
+					t->speed_hz,
+					len,
+					tx_buf ? "tx" : "",
+					rx_buf ? "rx" : "",
+					t->bits_per_word);
+			return -EINVAL;
+		}
+
+		if (t->speed_hz && t->speed_hz < OMAP1_SPI100K_MAX_FREQ/(1<<16)) {
+			dev_dbg(&spi->dev, "%d Hz max exceeds %d\n",
+					t->speed_hz,
+					OMAP1_SPI100K_MAX_FREQ/(1<<16));
+			return -EINVAL;
+		}
+
+	}
+
+	spin_lock_irqsave(&spi100k->lock, flags);
+	list_add_tail(&m->queue, &spi100k->msg_queue);
+	queue_work(omap1_spi100k_wq, &spi100k->work);
+	spin_unlock_irqrestore(&spi100k->lock, flags);
+
+	return 0;
+}
+
+static int __init omap1_spi100k_reset(struct omap1_spi100k *spi100k)
+{
+	return 0;
+}
+
+static int __devinit omap1_spi100k_probe(struct platform_device *pdev)
+{
+	struct spi_master       *master;
+	struct omap1_spi100k    *spi100k;
+	int                     status = 0;
+
+	if (!pdev->id)
+		return -EINVAL;
+
+	master = spi_alloc_master(&pdev->dev, sizeof *spi100k);
+	if (master == NULL) {
+		dev_dbg(&pdev->dev, "master allocation failed\n");
+		return -ENOMEM;
+	}
+
+	if (pdev->id != -1)
+	       master->bus_num = pdev->id;
+
+	master->setup = omap1_spi100k_setup;
+	master->transfer = omap1_spi100k_transfer;
+	master->cleanup = NULL;
+	master->num_chipselect = 2;
+	master->mode_bits = MODEBITS;
+
+	dev_set_drvdata(&pdev->dev, master);
+
+	spi100k = spi_master_get_devdata(master);
+	spi100k->master = master;
+
+	/*
+	 * The memory region base address is taken as the platform_data.
+	 * You should allocate this with ioremap() before initializing
+	 * the SPI.
+	 */
+	spi100k->base = (void __iomem *) pdev->dev.platform_data;
+
+	INIT_WORK(&spi100k->work, omap1_spi100k_work);
+
+	spin_lock_init(&spi100k->lock);
+	INIT_LIST_HEAD(&spi100k->msg_queue);
+	spi100k->ick = clk_get(&pdev->dev, "ick");
+	if (IS_ERR(spi100k->ick)) {
+		dev_dbg(&pdev->dev, "can't get spi100k_ick\n");
+		status = PTR_ERR(spi100k->ick);
+		goto err1;
+	}
+
+	spi100k->fck = clk_get(&pdev->dev, "fck");
+	if (IS_ERR(spi100k->fck)) {
+		dev_dbg(&pdev->dev, "can't get spi100k_fck\n");
+		status = PTR_ERR(spi100k->fck);
+		goto err2;
+	}
+
+	if (omap1_spi100k_reset(spi100k) < 0)
+		goto err3;
+
+	status = spi_register_master(master);
+	if (status < 0)
+		goto err3;
+
+	spi100k->state = SPI_RUNNING;
+
+	return status;
+
+err3:
+	clk_put(spi100k->fck);
+err2:
+	clk_put(spi100k->ick);
+err1:
+	spi_master_put(master);
+	return status;
+}
+
+static int __exit omap1_spi100k_remove(struct platform_device *pdev)
+{
+	struct spi_master       *master;
+	struct omap1_spi100k    *spi100k;
+	struct resource         *r;
+	unsigned		limit = 500;
+	unsigned long		flags;
+	int			status = 0;
+
+	master = dev_get_drvdata(&pdev->dev);
+	spi100k = spi_master_get_devdata(master);
+
+	spin_lock_irqsave(&spi100k->lock, flags);
+
+	spi100k->state = SPI_SHUTDOWN;
+	while (!list_empty(&spi100k->msg_queue) && limit--) {
+		spin_unlock_irqrestore(&spi100k->lock, flags);
+		msleep(10);
+		spin_lock_irqsave(&spi100k->lock, flags);
+	}
+
+	if (!list_empty(&spi100k->msg_queue))
+		status = -EBUSY;
+
+	spin_unlock_irqrestore(&spi100k->lock, flags);
+
+	if (status != 0)
+		return status;
+
+	clk_put(spi100k->fck);
+	clk_put(spi100k->ick);
+
+	r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+
+	spi_unregister_master(master);
+
+	return 0;
+}
+
+static struct platform_driver omap1_spi100k_driver = {
+	.driver = {
+		.name		= "omap1_spi100k",
+		.owner		= THIS_MODULE,
+	},
+	.remove		= __exit_p(omap1_spi100k_remove),
+};
+
+
+static int __init omap1_spi100k_init(void)
+{
+	omap1_spi100k_wq = create_singlethread_workqueue(
+			omap1_spi100k_driver.driver.name);
+
+	if (omap1_spi100k_wq == NULL)
+		return -1;
+
+	return platform_driver_probe(&omap1_spi100k_driver, omap1_spi100k_probe);
+}
+
+static void __exit omap1_spi100k_exit(void)
+{
+	platform_driver_unregister(&omap1_spi100k_driver);
+
+	destroy_workqueue(omap1_spi100k_wq);
+}
+
+module_init(omap1_spi100k_init);
+module_exit(omap1_spi100k_exit);
+
+MODULE_DESCRIPTION("OMAP7xx SPI 100k controller driver");
+MODULE_AUTHOR("Fabrice Crohas <fcrohas@gmail.com>");
+MODULE_LICENSE("GPL");
+
diff --git a/drivers/spi/pxa2xx_spi.c b/drivers/spi/pxa2xx_spi.c
index c8c2b693ffac..c2f707e5ce74 100644
--- a/drivers/spi/pxa2xx_spi.c
+++ b/drivers/spi/pxa2xx_spi.c
@@ -1709,7 +1709,7 @@ static int pxa2xx_spi_resume(struct device *dev)
 	return 0;
 }
 
-static struct dev_pm_ops pxa2xx_spi_pm_ops = {
+static const struct dev_pm_ops pxa2xx_spi_pm_ops = {
 	.suspend	= pxa2xx_spi_suspend,
 	.resume		= pxa2xx_spi_resume,
 };
diff --git a/drivers/spi/spi_bfin5xx.c b/drivers/spi/spi_bfin5xx.c
index 73e24ef5a2f9..1d41058bbab2 100644
--- a/drivers/spi/spi_bfin5xx.c
+++ b/drivers/spi/spi_bfin5xx.c
@@ -1294,7 +1294,7 @@ static int __init bfin_spi_probe(struct platform_device *pdev)
 		goto out_error_get_res;
 	}
 
-	drv_data->regs_base = ioremap(res->start, (res->end - res->start + 1));
+	drv_data->regs_base = ioremap(res->start, resource_size(res));
 	if (drv_data->regs_base == NULL) {
 		dev_err(dev, "Cannot map IO\n");
 		status = -ENXIO;
diff --git a/drivers/spi/spi_imx.c b/drivers/spi/spi_imx.c
index 89c22efedfb0..1893f1e96dc4 100644
--- a/drivers/spi/spi_imx.c
+++ b/drivers/spi/spi_imx.c
@@ -44,6 +44,9 @@
 #define MXC_CSPIINT		0x0c
 #define MXC_RESET		0x1c
 
+#define MX3_CSPISTAT		0x14
+#define MX3_CSPISTAT_RR		(1 << 3)
+
 /* generic defines to abstract from the different register layouts */
 #define MXC_INT_RR	(1 << 0) /* Receive data ready interrupt */
 #define MXC_INT_TE	(1 << 1) /* Transmit FIFO empty interrupt */
@@ -205,7 +208,7 @@ static int mx31_config(struct spi_imx_data *spi_imx,
 
 	if (cpu_is_mx31())
 		reg |= (config->bpw - 1) << MX31_CSPICTRL_BC_SHIFT;
-	else if (cpu_is_mx35()) {
+	else if (cpu_is_mx25() || cpu_is_mx35()) {
 		reg |= (config->bpw - 1) << MX35_CSPICTRL_BL_SHIFT;
 		reg |= MX31_CSPICTRL_SSCTL;
 	}
@@ -219,7 +222,7 @@ static int mx31_config(struct spi_imx_data *spi_imx,
 	if (config->cs < 0) {
 		if (cpu_is_mx31())
 			reg |= (config->cs + 32) << MX31_CSPICTRL_CS_SHIFT;
-		else if (cpu_is_mx35())
+		else if (cpu_is_mx25() || cpu_is_mx35())
 			reg |= (config->cs + 32) << MX35_CSPICTRL_CS_SHIFT;
 	}
 
@@ -481,7 +484,7 @@ static void spi_imx_cleanup(struct spi_device *spi)
 {
 }
 
-static int __init spi_imx_probe(struct platform_device *pdev)
+static int __devinit spi_imx_probe(struct platform_device *pdev)
 {
 	struct spi_imx_master *mxc_platform_info;
 	struct spi_master *master;
@@ -489,7 +492,7 @@ static int __init spi_imx_probe(struct platform_device *pdev)
 	struct resource *res;
 	int i, ret;
 
-	mxc_platform_info = (struct spi_imx_master *)pdev->dev.platform_data;
+	mxc_platform_info = dev_get_platdata(&pdev->dev);
 	if (!mxc_platform_info) {
 		dev_err(&pdev->dev, "can't get the platform data\n");
 		return -EINVAL;
@@ -513,11 +516,12 @@ static int __init spi_imx_probe(struct platform_device *pdev)
 			continue;
 		ret = gpio_request(spi_imx->chipselect[i], DRIVER_NAME);
 		if (ret) {
-			i--;
-			while (i > 0)
+			while (i > 0) {
+				i--;
 				if (spi_imx->chipselect[i] >= 0)
-					gpio_free(spi_imx->chipselect[i--]);
-			dev_err(&pdev->dev, "can't get cs gpios");
+					gpio_free(spi_imx->chipselect[i]);
+			}
+			dev_err(&pdev->dev, "can't get cs gpios\n");
 			goto out_master_put;
 		}
 	}
@@ -551,7 +555,7 @@ static int __init spi_imx_probe(struct platform_device *pdev)
 	}
 
 	spi_imx->irq = platform_get_irq(pdev, 0);
-	if (!spi_imx->irq) {
+	if (spi_imx->irq <= 0) {
 		ret = -EINVAL;
 		goto out_iounmap;
 	}
@@ -562,7 +566,7 @@ static int __init spi_imx_probe(struct platform_device *pdev)
 		goto out_iounmap;
 	}
 
-	if (cpu_is_mx31() || cpu_is_mx35()) {
+	if (cpu_is_mx25() || cpu_is_mx31() || cpu_is_mx35()) {
 		spi_imx->intctrl = mx31_intctrl;
 		spi_imx->config = mx31_config;
 		spi_imx->trigger = mx31_trigger;
@@ -590,9 +594,14 @@ static int __init spi_imx_probe(struct platform_device *pdev)
 	clk_enable(spi_imx->clk);
 	spi_imx->spi_clk = clk_get_rate(spi_imx->clk);
 
-	if (!cpu_is_mx31() || !cpu_is_mx35())
+	if (cpu_is_mx1() || cpu_is_mx21() || cpu_is_mx27())
 		writel(1, spi_imx->base + MXC_RESET);
 
+	/* drain receive buffer */
+	if (cpu_is_mx25() || cpu_is_mx31() || cpu_is_mx35())
+		while (readl(spi_imx->base + MX3_CSPISTAT) & MX3_CSPISTAT_RR)
+			readl(spi_imx->base + MXC_CSPIRXDATA);
+
 	spi_imx->intctrl(spi_imx, 0);
 
 	ret = spi_bitbang_start(&spi_imx->bitbang);
@@ -625,7 +634,7 @@ out_master_put:
 	return ret;
 }
 
-static int __exit spi_imx_remove(struct platform_device *pdev)
+static int __devexit spi_imx_remove(struct platform_device *pdev)
 {
 	struct spi_master *master = platform_get_drvdata(pdev);
 	struct resource *res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
@@ -659,7 +668,7 @@ static struct platform_driver spi_imx_driver = {
 		   .owner = THIS_MODULE,
 		   },
 	.probe = spi_imx_probe,
-	.remove = __exit_p(spi_imx_remove),
+	.remove = __devexit_p(spi_imx_remove),
 };
 
 static int __init spi_imx_init(void)
diff --git a/drivers/spi/spi_mpc8xxx.c b/drivers/spi/spi_mpc8xxx.c
index 0fd0ec4d3a7d..1fb2a6ea328c 100644
--- a/drivers/spi/spi_mpc8xxx.c
+++ b/drivers/spi/spi_mpc8xxx.c
@@ -5,6 +5,10 @@
  *
  * Copyright (C) 2006 Polycom, Inc.
  *
+ * CPM SPI and QE buffer descriptors mode support:
+ * Copyright (c) 2009  MontaVista Software, Inc.
+ * Author: Anton Vorontsov <avorontsov@ru.mvista.com>
+ *
  * This program is free software; you can redistribute  it and/or modify it
  * under  the terms of  the GNU General  Public License as published by the
  * Free Software Foundation;  either version 2 of the  License, or (at your
@@ -27,6 +31,9 @@
 #include <linux/spi/spi_bitbang.h>
 #include <linux/platform_device.h>
 #include <linux/fsl_devices.h>
+#include <linux/dma-mapping.h>
+#include <linux/mm.h>
+#include <linux/mutex.h>
 #include <linux/of.h>
 #include <linux/of_platform.h>
 #include <linux/gpio.h>
@@ -34,8 +41,19 @@
 #include <linux/of_spi.h>
 
 #include <sysdev/fsl_soc.h>
+#include <asm/cpm.h>
+#include <asm/qe.h>
 #include <asm/irq.h>
 
+/* CPM1 and CPM2 are mutually exclusive. */
+#ifdef CONFIG_CPM1
+#include <asm/cpm1.h>
+#define CPM_SPI_CMD mk_cr_cmd(CPM_CR_CH_SPI, 0)
+#else
+#include <asm/cpm2.h>
+#define CPM_SPI_CMD mk_cr_cmd(CPM_CR_SPI_PAGE, CPM_CR_SPI_SBLOCK, 0, 0)
+#endif
+
 /* SPI Controller registers */
 struct mpc8xxx_spi_reg {
 	u8 res1[0x20];
@@ -47,6 +65,28 @@ struct mpc8xxx_spi_reg {
 	__be32 receive;
 };
 
+/* SPI Parameter RAM */
+struct spi_pram {
+	__be16	rbase;	/* Rx Buffer descriptor base address */
+	__be16	tbase;	/* Tx Buffer descriptor base address */
+	u8	rfcr;	/* Rx function code */
+	u8	tfcr;	/* Tx function code */
+	__be16	mrblr;	/* Max receive buffer length */
+	__be32	rstate;	/* Internal */
+	__be32	rdp;	/* Internal */
+	__be16	rbptr;	/* Internal */
+	__be16	rbc;	/* Internal */
+	__be32	rxtmp;	/* Internal */
+	__be32	tstate;	/* Internal */
+	__be32	tdp;	/* Internal */
+	__be16	tbptr;	/* Internal */
+	__be16	tbc;	/* Internal */
+	__be32	txtmp;	/* Internal */
+	__be32	res;	/* Tx temp. */
+	__be16  rpbase;	/* Relocation pointer (CPM1 only) */
+	__be16	res1;	/* Reserved */
+};
+
 /* SPI Controller mode register definitions */
 #define	SPMODE_LOOP		(1 << 30)
 #define	SPMODE_CI_INACTIVEHIGH	(1 << 29)
@@ -75,14 +115,40 @@ struct mpc8xxx_spi_reg {
 #define	SPIM_NE		0x00000200	/* Not empty */
 #define	SPIM_NF		0x00000100	/* Not full */
 
+#define	SPIE_TXB	0x00000200	/* Last char is written to tx fifo */
+#define	SPIE_RXB	0x00000100	/* Last char is written to rx buf */
+
+/* SPCOM register values */
+#define	SPCOM_STR	(1 << 23)	/* Start transmit */
+
+#define	SPI_PRAM_SIZE	0x100
+#define	SPI_MRBLR	((unsigned int)PAGE_SIZE)
+
 /* SPI Controller driver's private data. */
 struct mpc8xxx_spi {
+	struct device *dev;
 	struct mpc8xxx_spi_reg __iomem *base;
 
 	/* rx & tx bufs from the spi_transfer */
 	const void *tx;
 	void *rx;
 
+	int subblock;
+	struct spi_pram __iomem *pram;
+	struct cpm_buf_desc __iomem *tx_bd;
+	struct cpm_buf_desc __iomem *rx_bd;
+
+	struct spi_transfer *xfer_in_progress;
+
+	/* dma addresses for CPM transfers */
+	dma_addr_t tx_dma;
+	dma_addr_t rx_dma;
+	bool map_tx_dma;
+	bool map_rx_dma;
+
+	dma_addr_t dma_dummy_tx;
+	dma_addr_t dma_dummy_rx;
+
 	/* functions to deal with different sized buffers */
 	void (*get_rx) (u32 rx_data, struct mpc8xxx_spi *);
 	u32(*get_tx) (struct mpc8xxx_spi *);
@@ -96,7 +162,7 @@ struct mpc8xxx_spi {
 	u32 rx_shift;		/* RX data reg shift when in qe mode */
 	u32 tx_shift;		/* TX data reg shift when in qe mode */
 
-	bool qe_mode;
+	unsigned int flags;
 
 	struct workqueue_struct *workqueue;
 	struct work_struct work;
@@ -107,6 +173,10 @@ struct mpc8xxx_spi {
 	struct completion done;
 };
 
+static void *mpc8xxx_dummy_rx;
+static DEFINE_MUTEX(mpc8xxx_dummy_rx_lock);
+static int mpc8xxx_dummy_rx_refcnt;
+
 struct spi_mpc8xxx_cs {
 	/* functions to deal with different sized buffers */
 	void (*get_rx) (u32 rx_data, struct mpc8xxx_spi *);
@@ -155,6 +225,42 @@ MPC83XX_SPI_TX_BUF(u8)
 MPC83XX_SPI_TX_BUF(u16)
 MPC83XX_SPI_TX_BUF(u32)
 
+static void mpc8xxx_spi_change_mode(struct spi_device *spi)
+{
+	struct mpc8xxx_spi *mspi = spi_master_get_devdata(spi->master);
+	struct spi_mpc8xxx_cs *cs = spi->controller_state;
+	__be32 __iomem *mode = &mspi->base->mode;
+	unsigned long flags;
+
+	if (cs->hw_mode == mpc8xxx_spi_read_reg(mode))
+		return;
+
+	/* Turn off IRQs locally to minimize time that SPI is disabled. */
+	local_irq_save(flags);
+
+	/* Turn off SPI unit prior changing mode */
+	mpc8xxx_spi_write_reg(mode, cs->hw_mode & ~SPMODE_ENABLE);
+	mpc8xxx_spi_write_reg(mode, cs->hw_mode);
+
+	/* When in CPM mode, we need to reinit tx and rx. */
+	if (mspi->flags & SPI_CPM_MODE) {
+		if (mspi->flags & SPI_QE) {
+			qe_issue_cmd(QE_INIT_TX_RX, mspi->subblock,
+				     QE_CR_PROTOCOL_UNSPECIFIED, 0);
+		} else {
+			cpm_command(CPM_SPI_CMD, CPM_CR_INIT_TRX);
+			if (mspi->flags & SPI_CPM1) {
+				out_be16(&mspi->pram->rbptr,
+					 in_be16(&mspi->pram->rbase));
+				out_be16(&mspi->pram->tbptr,
+					 in_be16(&mspi->pram->tbase));
+			}
+		}
+	}
+
+	local_irq_restore(flags);
+}
+
 static void mpc8xxx_spi_chipselect(struct spi_device *spi, int value)
 {
 	struct mpc8xxx_spi *mpc8xxx_spi = spi_master_get_devdata(spi->master);
@@ -168,27 +274,13 @@ static void mpc8xxx_spi_chipselect(struct spi_device *spi, int value)
 	}
 
 	if (value == BITBANG_CS_ACTIVE) {
-		u32 regval = mpc8xxx_spi_read_reg(&mpc8xxx_spi->base->mode);
-
 		mpc8xxx_spi->rx_shift = cs->rx_shift;
 		mpc8xxx_spi->tx_shift = cs->tx_shift;
 		mpc8xxx_spi->get_rx = cs->get_rx;
 		mpc8xxx_spi->get_tx = cs->get_tx;
 
-		if (cs->hw_mode != regval) {
-			unsigned long flags;
-			__be32 __iomem *mode = &mpc8xxx_spi->base->mode;
-
-			regval = cs->hw_mode;
-			/* Turn off IRQs locally to minimize time that
-			 * SPI is disabled
-			 */
-			local_irq_save(flags);
-			/* Turn off SPI unit prior changing mode */
-			mpc8xxx_spi_write_reg(mode, regval & ~SPMODE_ENABLE);
-			mpc8xxx_spi_write_reg(mode, regval);
-			local_irq_restore(flags);
-		}
+		mpc8xxx_spi_change_mode(spi);
+
 		if (pdata->cs_control)
 			pdata->cs_control(spi, pol);
 	}
@@ -198,7 +290,6 @@ static
 int mpc8xxx_spi_setup_transfer(struct spi_device *spi, struct spi_transfer *t)
 {
 	struct mpc8xxx_spi *mpc8xxx_spi;
-	u32 regval;
 	u8 bits_per_word, pm;
 	u32 hz;
 	struct spi_mpc8xxx_cs	*cs = spi->controller_state;
@@ -230,14 +321,14 @@ int mpc8xxx_spi_setup_transfer(struct spi_device *spi, struct spi_transfer *t)
 	if (bits_per_word <= 8) {
 		cs->get_rx = mpc8xxx_spi_rx_buf_u8;
 		cs->get_tx = mpc8xxx_spi_tx_buf_u8;
-		if (mpc8xxx_spi->qe_mode) {
+		if (mpc8xxx_spi->flags & SPI_QE_CPU_MODE) {
 			cs->rx_shift = 16;
 			cs->tx_shift = 24;
 		}
 	} else if (bits_per_word <= 16) {
 		cs->get_rx = mpc8xxx_spi_rx_buf_u16;
 		cs->get_tx = mpc8xxx_spi_tx_buf_u16;
-		if (mpc8xxx_spi->qe_mode) {
+		if (mpc8xxx_spi->flags & SPI_QE_CPU_MODE) {
 			cs->rx_shift = 16;
 			cs->tx_shift = 16;
 		}
@@ -247,7 +338,8 @@ int mpc8xxx_spi_setup_transfer(struct spi_device *spi, struct spi_transfer *t)
 	} else
 		return -EINVAL;
 
-	if (mpc8xxx_spi->qe_mode && spi->mode & SPI_LSB_FIRST) {
+	if (mpc8xxx_spi->flags & SPI_QE_CPU_MODE &&
+			spi->mode & SPI_LSB_FIRST) {
 		cs->tx_shift = 0;
 		if (bits_per_word <= 8)
 			cs->rx_shift = 8;
@@ -286,37 +378,138 @@ int mpc8xxx_spi_setup_transfer(struct spi_device *spi, struct spi_transfer *t)
 		pm--;
 
 	cs->hw_mode |= SPMODE_PM(pm);
-	regval =  mpc8xxx_spi_read_reg(&mpc8xxx_spi->base->mode);
-	if (cs->hw_mode != regval) {
-		unsigned long flags;
-		__be32 __iomem *mode = &mpc8xxx_spi->base->mode;
-
-		regval = cs->hw_mode;
-		/* Turn off IRQs locally to minimize time
-		 * that SPI is disabled
-		 */
-		local_irq_save(flags);
-		/* Turn off SPI unit prior changing mode */
-		mpc8xxx_spi_write_reg(mode, regval & ~SPMODE_ENABLE);
-		mpc8xxx_spi_write_reg(mode, regval);
-		local_irq_restore(flags);
+
+	mpc8xxx_spi_change_mode(spi);
+	return 0;
+}
+
+static void mpc8xxx_spi_cpm_bufs_start(struct mpc8xxx_spi *mspi)
+{
+	struct cpm_buf_desc __iomem *tx_bd = mspi->tx_bd;
+	struct cpm_buf_desc __iomem *rx_bd = mspi->rx_bd;
+	unsigned int xfer_len = min(mspi->count, SPI_MRBLR);
+	unsigned int xfer_ofs;
+
+	xfer_ofs = mspi->xfer_in_progress->len - mspi->count;
+
+	out_be32(&rx_bd->cbd_bufaddr, mspi->rx_dma + xfer_ofs);
+	out_be16(&rx_bd->cbd_datlen, 0);
+	out_be16(&rx_bd->cbd_sc, BD_SC_EMPTY | BD_SC_INTRPT | BD_SC_WRAP);
+
+	out_be32(&tx_bd->cbd_bufaddr, mspi->tx_dma + xfer_ofs);
+	out_be16(&tx_bd->cbd_datlen, xfer_len);
+	out_be16(&tx_bd->cbd_sc, BD_SC_READY | BD_SC_INTRPT | BD_SC_WRAP |
+				 BD_SC_LAST);
+
+	/* start transfer */
+	mpc8xxx_spi_write_reg(&mspi->base->command, SPCOM_STR);
+}
+
+static int mpc8xxx_spi_cpm_bufs(struct mpc8xxx_spi *mspi,
+				struct spi_transfer *t, bool is_dma_mapped)
+{
+	struct device *dev = mspi->dev;
+
+	if (is_dma_mapped) {
+		mspi->map_tx_dma = 0;
+		mspi->map_rx_dma = 0;
+	} else {
+		mspi->map_tx_dma = 1;
+		mspi->map_rx_dma = 1;
+	}
+
+	if (!t->tx_buf) {
+		mspi->tx_dma = mspi->dma_dummy_tx;
+		mspi->map_tx_dma = 0;
+	}
+
+	if (!t->rx_buf) {
+		mspi->rx_dma = mspi->dma_dummy_rx;
+		mspi->map_rx_dma = 0;
 	}
+
+	if (mspi->map_tx_dma) {
+		void *nonconst_tx = (void *)mspi->tx; /* shut up gcc */
+
+		mspi->tx_dma = dma_map_single(dev, nonconst_tx, t->len,
+					      DMA_TO_DEVICE);
+		if (dma_mapping_error(dev, mspi->tx_dma)) {
+			dev_err(dev, "unable to map tx dma\n");
+			return -ENOMEM;
+		}
+	} else {
+		mspi->tx_dma = t->tx_dma;
+	}
+
+	if (mspi->map_rx_dma) {
+		mspi->rx_dma = dma_map_single(dev, mspi->rx, t->len,
+					      DMA_FROM_DEVICE);
+		if (dma_mapping_error(dev, mspi->rx_dma)) {
+			dev_err(dev, "unable to map rx dma\n");
+			goto err_rx_dma;
+		}
+	} else {
+		mspi->rx_dma = t->rx_dma;
+	}
+
+	/* enable rx ints */
+	mpc8xxx_spi_write_reg(&mspi->base->mask, SPIE_RXB);
+
+	mspi->xfer_in_progress = t;
+	mspi->count = t->len;
+
+	/* start CPM transfers */
+	mpc8xxx_spi_cpm_bufs_start(mspi);
+
 	return 0;
+
+err_rx_dma:
+	if (mspi->map_tx_dma)
+		dma_unmap_single(dev, mspi->tx_dma, t->len, DMA_TO_DEVICE);
+	return -ENOMEM;
 }
 
-static int mpc8xxx_spi_bufs(struct spi_device *spi, struct spi_transfer *t)
+static void mpc8xxx_spi_cpm_bufs_complete(struct mpc8xxx_spi *mspi)
 {
-	struct mpc8xxx_spi *mpc8xxx_spi;
-	u32 word, len, bits_per_word;
+	struct device *dev = mspi->dev;
+	struct spi_transfer *t = mspi->xfer_in_progress;
+
+	if (mspi->map_tx_dma)
+		dma_unmap_single(dev, mspi->tx_dma, t->len, DMA_TO_DEVICE);
+	if (mspi->map_tx_dma)
+		dma_unmap_single(dev, mspi->rx_dma, t->len, DMA_FROM_DEVICE);
+	mspi->xfer_in_progress = NULL;
+}
 
-	mpc8xxx_spi = spi_master_get_devdata(spi->master);
+static int mpc8xxx_spi_cpu_bufs(struct mpc8xxx_spi *mspi,
+				struct spi_transfer *t, unsigned int len)
+{
+	u32 word;
+
+	mspi->count = len;
+
+	/* enable rx ints */
+	mpc8xxx_spi_write_reg(&mspi->base->mask, SPIM_NE);
+
+	/* transmit word */
+	word = mspi->get_tx(mspi);
+	mpc8xxx_spi_write_reg(&mspi->base->transmit, word);
+
+	return 0;
+}
+
+static int mpc8xxx_spi_bufs(struct spi_device *spi, struct spi_transfer *t,
+			    bool is_dma_mapped)
+{
+	struct mpc8xxx_spi *mpc8xxx_spi = spi_master_get_devdata(spi->master);
+	unsigned int len = t->len;
+	u8 bits_per_word;
+	int ret;
 
-	mpc8xxx_spi->tx = t->tx_buf;
-	mpc8xxx_spi->rx = t->rx_buf;
 	bits_per_word = spi->bits_per_word;
 	if (t->bits_per_word)
 		bits_per_word = t->bits_per_word;
-	len = t->len;
+
 	if (bits_per_word > 8) {
 		/* invalid length? */
 		if (len & 1)
@@ -329,22 +522,27 @@ static int mpc8xxx_spi_bufs(struct spi_device *spi, struct spi_transfer *t)
 			return -EINVAL;
 		len /= 2;
 	}
-	mpc8xxx_spi->count = len;
 
-	INIT_COMPLETION(mpc8xxx_spi->done);
+	mpc8xxx_spi->tx = t->tx_buf;
+	mpc8xxx_spi->rx = t->rx_buf;
 
-	/* enable rx ints */
-	mpc8xxx_spi_write_reg(&mpc8xxx_spi->base->mask, SPIM_NE);
+	INIT_COMPLETION(mpc8xxx_spi->done);
 
-	/* transmit word */
-	word = mpc8xxx_spi->get_tx(mpc8xxx_spi);
-	mpc8xxx_spi_write_reg(&mpc8xxx_spi->base->transmit, word);
+	if (mpc8xxx_spi->flags & SPI_CPM_MODE)
+		ret = mpc8xxx_spi_cpm_bufs(mpc8xxx_spi, t, is_dma_mapped);
+	else
+		ret = mpc8xxx_spi_cpu_bufs(mpc8xxx_spi, t, len);
+	if (ret)
+		return ret;
 
 	wait_for_completion(&mpc8xxx_spi->done);
 
 	/* disable rx ints */
 	mpc8xxx_spi_write_reg(&mpc8xxx_spi->base->mask, 0);
 
+	if (mpc8xxx_spi->flags & SPI_CPM_MODE)
+		mpc8xxx_spi_cpm_bufs_complete(mpc8xxx_spi);
+
 	return mpc8xxx_spi->count;
 }
 
@@ -375,7 +573,7 @@ static void mpc8xxx_spi_do_one_msg(struct spi_message *m)
 		}
 		cs_change = t->cs_change;
 		if (t->len)
-			status = mpc8xxx_spi_bufs(spi, t);
+			status = mpc8xxx_spi_bufs(spi, t, m->is_dma_mapped);
 		if (status) {
 			status = -EMSGSIZE;
 			break;
@@ -464,45 +662,80 @@ static int mpc8xxx_spi_setup(struct spi_device *spi)
 	return 0;
 }
 
-static irqreturn_t mpc8xxx_spi_irq(s32 irq, void *context_data)
+static void mpc8xxx_spi_cpm_irq(struct mpc8xxx_spi *mspi, u32 events)
 {
-	struct mpc8xxx_spi *mpc8xxx_spi = context_data;
-	u32 event;
-	irqreturn_t ret = IRQ_NONE;
+	u16 len;
 
-	/* Get interrupt events(tx/rx) */
-	event = mpc8xxx_spi_read_reg(&mpc8xxx_spi->base->event);
+	dev_dbg(mspi->dev, "%s: bd datlen %d, count %d\n", __func__,
+		in_be16(&mspi->rx_bd->cbd_datlen), mspi->count);
 
-	/* We need handle RX first */
-	if (event & SPIE_NE) {
-		u32 rx_data = mpc8xxx_spi_read_reg(&mpc8xxx_spi->base->receive);
+	len = in_be16(&mspi->rx_bd->cbd_datlen);
+	if (len > mspi->count) {
+		WARN_ON(1);
+		len = mspi->count;
+	}
 
-		if (mpc8xxx_spi->rx)
-			mpc8xxx_spi->get_rx(rx_data, mpc8xxx_spi);
+	/* Clear the events */
+	mpc8xxx_spi_write_reg(&mspi->base->event, events);
 
-		ret = IRQ_HANDLED;
+	mspi->count -= len;
+	if (mspi->count)
+		mpc8xxx_spi_cpm_bufs_start(mspi);
+	else
+		complete(&mspi->done);
+}
+
+static void mpc8xxx_spi_cpu_irq(struct mpc8xxx_spi *mspi, u32 events)
+{
+	/* We need handle RX first */
+	if (events & SPIE_NE) {
+		u32 rx_data = mpc8xxx_spi_read_reg(&mspi->base->receive);
+
+		if (mspi->rx)
+			mspi->get_rx(rx_data, mspi);
 	}
 
-	if ((event & SPIE_NF) == 0)
+	if ((events & SPIE_NF) == 0)
 		/* spin until TX is done */
-		while (((event =
-			 mpc8xxx_spi_read_reg(&mpc8xxx_spi->base->event)) &
+		while (((events =
+			mpc8xxx_spi_read_reg(&mspi->base->event)) &
 						SPIE_NF) == 0)
 			cpu_relax();
 
-	mpc8xxx_spi->count -= 1;
-	if (mpc8xxx_spi->count) {
-		u32 word = mpc8xxx_spi->get_tx(mpc8xxx_spi);
-		mpc8xxx_spi_write_reg(&mpc8xxx_spi->base->transmit, word);
+	/* Clear the events */
+	mpc8xxx_spi_write_reg(&mspi->base->event, events);
+
+	mspi->count -= 1;
+	if (mspi->count) {
+		u32 word = mspi->get_tx(mspi);
+
+		mpc8xxx_spi_write_reg(&mspi->base->transmit, word);
 	} else {
-		complete(&mpc8xxx_spi->done);
+		complete(&mspi->done);
 	}
+}
 
-	/* Clear the events */
-	mpc8xxx_spi_write_reg(&mpc8xxx_spi->base->event, event);
+static irqreturn_t mpc8xxx_spi_irq(s32 irq, void *context_data)
+{
+	struct mpc8xxx_spi *mspi = context_data;
+	irqreturn_t ret = IRQ_NONE;
+	u32 events;
+
+	/* Get interrupt events(tx/rx) */
+	events = mpc8xxx_spi_read_reg(&mspi->base->event);
+	if (events)
+		ret = IRQ_HANDLED;
+
+	dev_dbg(mspi->dev, "%s: events %x\n", __func__, events);
+
+	if (mspi->flags & SPI_CPM_MODE)
+		mpc8xxx_spi_cpm_irq(mspi, events);
+	else
+		mpc8xxx_spi_cpu_irq(mspi, events);
 
 	return ret;
 }
+
 static int mpc8xxx_spi_transfer(struct spi_device *spi,
 				struct spi_message *m)
 {
@@ -526,6 +759,215 @@ static void mpc8xxx_spi_cleanup(struct spi_device *spi)
 	kfree(spi->controller_state);
 }
 
+static void *mpc8xxx_spi_alloc_dummy_rx(void)
+{
+	mutex_lock(&mpc8xxx_dummy_rx_lock);
+
+	if (!mpc8xxx_dummy_rx)
+		mpc8xxx_dummy_rx = kmalloc(SPI_MRBLR, GFP_KERNEL);
+	if (mpc8xxx_dummy_rx)
+		mpc8xxx_dummy_rx_refcnt++;
+
+	mutex_unlock(&mpc8xxx_dummy_rx_lock);
+
+	return mpc8xxx_dummy_rx;
+}
+
+static void mpc8xxx_spi_free_dummy_rx(void)
+{
+	mutex_lock(&mpc8xxx_dummy_rx_lock);
+
+	switch (mpc8xxx_dummy_rx_refcnt) {
+	case 0:
+		WARN_ON(1);
+		break;
+	case 1:
+		kfree(mpc8xxx_dummy_rx);
+		mpc8xxx_dummy_rx = NULL;
+		/* fall through */
+	default:
+		mpc8xxx_dummy_rx_refcnt--;
+		break;
+	}
+
+	mutex_unlock(&mpc8xxx_dummy_rx_lock);
+}
+
+static unsigned long mpc8xxx_spi_cpm_get_pram(struct mpc8xxx_spi *mspi)
+{
+	struct device *dev = mspi->dev;
+	struct device_node *np = dev_archdata_get_node(&dev->archdata);
+	const u32 *iprop;
+	int size;
+	unsigned long spi_base_ofs;
+	unsigned long pram_ofs = -ENOMEM;
+
+	/* Can't use of_address_to_resource(), QE muram isn't at 0. */
+	iprop = of_get_property(np, "reg", &size);
+
+	/* QE with a fixed pram location? */
+	if (mspi->flags & SPI_QE && iprop && size == sizeof(*iprop) * 4)
+		return cpm_muram_alloc_fixed(iprop[2], SPI_PRAM_SIZE);
+
+	/* QE but with a dynamic pram location? */
+	if (mspi->flags & SPI_QE) {
+		pram_ofs = cpm_muram_alloc(SPI_PRAM_SIZE, 64);
+		qe_issue_cmd(QE_ASSIGN_PAGE_TO_DEVICE, mspi->subblock,
+				QE_CR_PROTOCOL_UNSPECIFIED, pram_ofs);
+		return pram_ofs;
+	}
+
+	/* CPM1 and CPM2 pram must be at a fixed addr. */
+	if (!iprop || size != sizeof(*iprop) * 4)
+		return -ENOMEM;
+
+	spi_base_ofs = cpm_muram_alloc_fixed(iprop[2], 2);
+	if (IS_ERR_VALUE(spi_base_ofs))
+		return -ENOMEM;
+
+	if (mspi->flags & SPI_CPM2) {
+		pram_ofs = cpm_muram_alloc(SPI_PRAM_SIZE, 64);
+		if (!IS_ERR_VALUE(pram_ofs)) {
+			u16 __iomem *spi_base = cpm_muram_addr(spi_base_ofs);
+
+			out_be16(spi_base, pram_ofs);
+		}
+	} else {
+		struct spi_pram __iomem *pram = cpm_muram_addr(spi_base_ofs);
+		u16 rpbase = in_be16(&pram->rpbase);
+
+		/* Microcode relocation patch applied? */
+		if (rpbase)
+			pram_ofs = rpbase;
+		else
+			return spi_base_ofs;
+	}
+
+	cpm_muram_free(spi_base_ofs);
+	return pram_ofs;
+}
+
+static int mpc8xxx_spi_cpm_init(struct mpc8xxx_spi *mspi)
+{
+	struct device *dev = mspi->dev;
+	struct device_node *np = dev_archdata_get_node(&dev->archdata);
+	const u32 *iprop;
+	int size;
+	unsigned long pram_ofs;
+	unsigned long bds_ofs;
+
+	if (!(mspi->flags & SPI_CPM_MODE))
+		return 0;
+
+	if (!mpc8xxx_spi_alloc_dummy_rx())
+		return -ENOMEM;
+
+	if (mspi->flags & SPI_QE) {
+		iprop = of_get_property(np, "cell-index", &size);
+		if (iprop && size == sizeof(*iprop))
+			mspi->subblock = *iprop;
+
+		switch (mspi->subblock) {
+		default:
+			dev_warn(dev, "cell-index unspecified, assuming SPI1");
+			/* fall through */
+		case 0:
+			mspi->subblock = QE_CR_SUBBLOCK_SPI1;
+			break;
+		case 1:
+			mspi->subblock = QE_CR_SUBBLOCK_SPI2;
+			break;
+		}
+	}
+
+	pram_ofs = mpc8xxx_spi_cpm_get_pram(mspi);
+	if (IS_ERR_VALUE(pram_ofs)) {
+		dev_err(dev, "can't allocate spi parameter ram\n");
+		goto err_pram;
+	}
+
+	bds_ofs = cpm_muram_alloc(sizeof(*mspi->tx_bd) +
+				  sizeof(*mspi->rx_bd), 8);
+	if (IS_ERR_VALUE(bds_ofs)) {
+		dev_err(dev, "can't allocate bds\n");
+		goto err_bds;
+	}
+
+	mspi->dma_dummy_tx = dma_map_single(dev, empty_zero_page, PAGE_SIZE,
+					    DMA_TO_DEVICE);
+	if (dma_mapping_error(dev, mspi->dma_dummy_tx)) {
+		dev_err(dev, "unable to map dummy tx buffer\n");
+		goto err_dummy_tx;
+	}
+
+	mspi->dma_dummy_rx = dma_map_single(dev, mpc8xxx_dummy_rx, SPI_MRBLR,
+					    DMA_FROM_DEVICE);
+	if (dma_mapping_error(dev, mspi->dma_dummy_rx)) {
+		dev_err(dev, "unable to map dummy rx buffer\n");
+		goto err_dummy_rx;
+	}
+
+	mspi->pram = cpm_muram_addr(pram_ofs);
+
+	mspi->tx_bd = cpm_muram_addr(bds_ofs);
+	mspi->rx_bd = cpm_muram_addr(bds_ofs + sizeof(*mspi->tx_bd));
+
+	/* Initialize parameter ram. */
+	out_be16(&mspi->pram->tbase, cpm_muram_offset(mspi->tx_bd));
+	out_be16(&mspi->pram->rbase, cpm_muram_offset(mspi->rx_bd));
+	out_8(&mspi->pram->tfcr, CPMFCR_EB | CPMFCR_GBL);
+	out_8(&mspi->pram->rfcr, CPMFCR_EB | CPMFCR_GBL);
+	out_be16(&mspi->pram->mrblr, SPI_MRBLR);
+	out_be32(&mspi->pram->rstate, 0);
+	out_be32(&mspi->pram->rdp, 0);
+	out_be16(&mspi->pram->rbptr, 0);
+	out_be16(&mspi->pram->rbc, 0);
+	out_be32(&mspi->pram->rxtmp, 0);
+	out_be32(&mspi->pram->tstate, 0);
+	out_be32(&mspi->pram->tdp, 0);
+	out_be16(&mspi->pram->tbptr, 0);
+	out_be16(&mspi->pram->tbc, 0);
+	out_be32(&mspi->pram->txtmp, 0);
+
+	return 0;
+
+err_dummy_rx:
+	dma_unmap_single(dev, mspi->dma_dummy_tx, PAGE_SIZE, DMA_TO_DEVICE);
+err_dummy_tx:
+	cpm_muram_free(bds_ofs);
+err_bds:
+	cpm_muram_free(pram_ofs);
+err_pram:
+	mpc8xxx_spi_free_dummy_rx();
+	return -ENOMEM;
+}
+
+static void mpc8xxx_spi_cpm_free(struct mpc8xxx_spi *mspi)
+{
+	struct device *dev = mspi->dev;
+
+	dma_unmap_single(dev, mspi->dma_dummy_rx, SPI_MRBLR, DMA_FROM_DEVICE);
+	dma_unmap_single(dev, mspi->dma_dummy_tx, PAGE_SIZE, DMA_TO_DEVICE);
+	cpm_muram_free(cpm_muram_offset(mspi->tx_bd));
+	cpm_muram_free(cpm_muram_offset(mspi->pram));
+	mpc8xxx_spi_free_dummy_rx();
+}
+
+static const char *mpc8xxx_spi_strmode(unsigned int flags)
+{
+	if (flags & SPI_QE_CPU_MODE) {
+		return "QE CPU";
+	} else if (flags & SPI_CPM_MODE) {
+		if (flags & SPI_QE)
+			return "QE";
+		else if (flags & SPI_CPM2)
+			return "CPM2";
+		else
+			return "CPM1";
+	}
+	return "CPU";
+}
+
 static struct spi_master * __devinit
 mpc8xxx_spi_probe(struct device *dev, struct resource *mem, unsigned int irq)
 {
@@ -552,24 +994,29 @@ mpc8xxx_spi_probe(struct device *dev, struct resource *mem, unsigned int irq)
 	master->cleanup = mpc8xxx_spi_cleanup;
 
 	mpc8xxx_spi = spi_master_get_devdata(master);
-	mpc8xxx_spi->qe_mode = pdata->qe_mode;
+	mpc8xxx_spi->dev = dev;
 	mpc8xxx_spi->get_rx = mpc8xxx_spi_rx_buf_u8;
 	mpc8xxx_spi->get_tx = mpc8xxx_spi_tx_buf_u8;
+	mpc8xxx_spi->flags = pdata->flags;
 	mpc8xxx_spi->spibrg = pdata->sysclk;
 
+	ret = mpc8xxx_spi_cpm_init(mpc8xxx_spi);
+	if (ret)
+		goto err_cpm_init;
+
 	mpc8xxx_spi->rx_shift = 0;
 	mpc8xxx_spi->tx_shift = 0;
-	if (mpc8xxx_spi->qe_mode) {
+	if (mpc8xxx_spi->flags & SPI_QE_CPU_MODE) {
 		mpc8xxx_spi->rx_shift = 16;
 		mpc8xxx_spi->tx_shift = 24;
 	}
 
 	init_completion(&mpc8xxx_spi->done);
 
-	mpc8xxx_spi->base = ioremap(mem->start, mem->end - mem->start + 1);
+	mpc8xxx_spi->base = ioremap(mem->start, resource_size(mem));
 	if (mpc8xxx_spi->base == NULL) {
 		ret = -ENOMEM;
-		goto put_master;
+		goto err_ioremap;
 	}
 
 	mpc8xxx_spi->irq = irq;
@@ -592,7 +1039,7 @@ mpc8xxx_spi_probe(struct device *dev, struct resource *mem, unsigned int irq)
 
 	/* Enable SPI interface */
 	regval = pdata->initial_spmode | SPMODE_INIT_VAL | SPMODE_ENABLE;
-	if (pdata->qe_mode)
+	if (mpc8xxx_spi->flags & SPI_QE_CPU_MODE)
 		regval |= SPMODE_OP;
 
 	mpc8xxx_spi_write_reg(&mpc8xxx_spi->base->mode, regval);
@@ -612,9 +1059,8 @@ mpc8xxx_spi_probe(struct device *dev, struct resource *mem, unsigned int irq)
 	if (ret < 0)
 		goto unreg_master;
 
-	printk(KERN_INFO
-	       "%s: MPC8xxx SPI Controller driver at 0x%p (irq = %d)\n",
-	       dev_name(dev), mpc8xxx_spi->base, mpc8xxx_spi->irq);
+	dev_info(dev, "at 0x%p (irq = %d), %s mode\n", mpc8xxx_spi->base,
+		 mpc8xxx_spi->irq, mpc8xxx_spi_strmode(mpc8xxx_spi->flags));
 
 	return master;
 
@@ -624,7 +1070,9 @@ free_irq:
 	free_irq(mpc8xxx_spi->irq, mpc8xxx_spi);
 unmap_io:
 	iounmap(mpc8xxx_spi->base);
-put_master:
+err_ioremap:
+	mpc8xxx_spi_cpm_free(mpc8xxx_spi);
+err_cpm_init:
 	spi_master_put(master);
 err:
 	return ERR_PTR(ret);
@@ -644,6 +1092,7 @@ static int __devexit mpc8xxx_spi_remove(struct device *dev)
 
 	free_irq(mpc8xxx_spi->irq, mpc8xxx_spi);
 	iounmap(mpc8xxx_spi->base);
+	mpc8xxx_spi_cpm_free(mpc8xxx_spi);
 
 	return 0;
 }
@@ -709,6 +1158,7 @@ static int of_mpc8xxx_spi_get_chipselects(struct device *dev)
 		gpio = of_get_gpio_flags(np, i, &flags);
 		if (!gpio_is_valid(gpio)) {
 			dev_err(dev, "invalid gpio #%d: %d\n", i, gpio);
+			ret = gpio;
 			goto err_loop;
 		}
 
@@ -804,7 +1254,13 @@ static int __devinit of_mpc8xxx_spi_probe(struct of_device *ofdev,
 
 	prop = of_get_property(np, "mode", NULL);
 	if (prop && !strcmp(prop, "cpu-qe"))
-		pdata->qe_mode = 1;
+		pdata->flags = SPI_QE_CPU_MODE;
+	else if (prop && !strcmp(prop, "qe"))
+		pdata->flags = SPI_CPM_MODE | SPI_QE;
+	else if (of_device_is_compatible(np, "fsl,cpm2-spi"))
+		pdata->flags = SPI_CPM_MODE | SPI_CPM2;
+	else if (of_device_is_compatible(np, "fsl,cpm1-spi"))
+		pdata->flags = SPI_CPM_MODE | SPI_CPM1;
 
 	ret = of_mpc8xxx_spi_get_chipselects(dev);
 	if (ret)
@@ -900,7 +1356,7 @@ static int __devexit plat_mpc8xxx_spi_remove(struct platform_device *pdev)
 MODULE_ALIAS("platform:mpc8xxx_spi");
 static struct platform_driver mpc8xxx_spi_driver = {
 	.probe = plat_mpc8xxx_spi_probe,
-	.remove = __exit_p(plat_mpc8xxx_spi_remove),
+	.remove = __devexit_p(plat_mpc8xxx_spi_remove),
 	.driver = {
 		.name = "mpc8xxx_spi",
 		.owner = THIS_MODULE,
diff --git a/drivers/spi/spi_nuc900.c b/drivers/spi/spi_nuc900.c
new file mode 100644
index 000000000000..b319f9bf9b9b
--- /dev/null
+++ b/drivers/spi/spi_nuc900.c
@@ -0,0 +1,504 @@
+/* linux/drivers/spi/spi_nuc900.c
+ *
+ * Copyright (c) 2009 Nuvoton technology.
+ * Wan ZongShun <mcuos.com@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+*/
+
+#include <linux/init.h>
+#include <linux/spinlock.h>
+#include <linux/workqueue.h>
+#include <linux/interrupt.h>
+#include <linux/delay.h>
+#include <linux/errno.h>
+#include <linux/err.h>
+#include <linux/clk.h>
+#include <linux/device.h>
+#include <linux/platform_device.h>
+#include <linux/gpio.h>
+#include <linux/io.h>
+
+#include <linux/spi/spi.h>
+#include <linux/spi/spi_bitbang.h>
+
+#include <mach/nuc900_spi.h>
+
+/* usi registers offset */
+#define USI_CNT		0x00
+#define USI_DIV		0x04
+#define USI_SSR		0x08
+#define USI_RX0		0x10
+#define USI_TX0		0x10
+
+/* usi register bit */
+#define ENINT		(0x01 << 17)
+#define ENFLG		(0x01 << 16)
+#define TXNUM		(0x03 << 8)
+#define TXNEG		(0x01 << 2)
+#define RXNEG		(0x01 << 1)
+#define LSB		(0x01 << 10)
+#define SELECTLEV	(0x01 << 2)
+#define SELECTPOL	(0x01 << 31)
+#define SELECTSLAVE	0x01
+#define GOBUSY		0x01
+
+struct nuc900_spi {
+	struct spi_bitbang	 bitbang;
+	struct completion	 done;
+	void __iomem		*regs;
+	int			 irq;
+	int			 len;
+	int			 count;
+	const unsigned char	*tx;
+	unsigned char		*rx;
+	struct clk		*clk;
+	struct resource		*ioarea;
+	struct spi_master	*master;
+	struct spi_device	*curdev;
+	struct device		*dev;
+	struct nuc900_spi_info *pdata;
+	spinlock_t		lock;
+	struct resource		*res;
+};
+
+static inline struct nuc900_spi *to_hw(struct spi_device *sdev)
+{
+	return spi_master_get_devdata(sdev->master);
+}
+
+static void nuc900_slave_select(struct spi_device *spi, unsigned int ssr)
+{
+	struct nuc900_spi *hw = to_hw(spi);
+	unsigned int val;
+	unsigned int cs = spi->mode & SPI_CS_HIGH ? 1 : 0;
+	unsigned int cpol = spi->mode & SPI_CPOL ? 1 : 0;
+	unsigned long flags;
+
+	spin_lock_irqsave(&hw->lock, flags);
+
+	val = __raw_readl(hw->regs + USI_SSR);
+
+	if (!cs)
+		val &= ~SELECTLEV;
+	else
+		val |= SELECTLEV;
+
+	if (!ssr)
+		val &= ~SELECTSLAVE;
+	else
+		val |= SELECTSLAVE;
+
+	__raw_writel(val, hw->regs + USI_SSR);
+
+	val = __raw_readl(hw->regs + USI_CNT);
+
+	if (!cpol)
+		val &= ~SELECTPOL;
+	else
+		val |= SELECTPOL;
+
+	__raw_writel(val, hw->regs + USI_CNT);
+
+	spin_unlock_irqrestore(&hw->lock, flags);
+}
+
+static void nuc900_spi_chipsel(struct spi_device *spi, int value)
+{
+	switch (value) {
+	case BITBANG_CS_INACTIVE:
+		nuc900_slave_select(spi, 0);
+		break;
+
+	case BITBANG_CS_ACTIVE:
+		nuc900_slave_select(spi, 1);
+		break;
+	}
+}
+
+static void nuc900_spi_setup_txnum(struct nuc900_spi *hw,
+							unsigned int txnum)
+{
+	unsigned int val;
+	unsigned long flags;
+
+	spin_lock_irqsave(&hw->lock, flags);
+
+	val = __raw_readl(hw->regs + USI_CNT);
+
+	if (!txnum)
+		val &= ~TXNUM;
+	else
+		val |= txnum << 0x08;
+
+	__raw_writel(val, hw->regs + USI_CNT);
+
+	spin_unlock_irqrestore(&hw->lock, flags);
+
+}
+
+static void nuc900_spi_setup_txbitlen(struct nuc900_spi *hw,
+							unsigned int txbitlen)
+{
+	unsigned int val;
+	unsigned long flags;
+
+	spin_lock_irqsave(&hw->lock, flags);
+
+	val = __raw_readl(hw->regs + USI_CNT);
+
+	val |= (txbitlen << 0x03);
+
+	__raw_writel(val, hw->regs + USI_CNT);
+
+	spin_unlock_irqrestore(&hw->lock, flags);
+}
+
+static void nuc900_spi_gobusy(struct nuc900_spi *hw)
+{
+	unsigned int val;
+	unsigned long flags;
+
+	spin_lock_irqsave(&hw->lock, flags);
+
+	val = __raw_readl(hw->regs + USI_CNT);
+
+	val |= GOBUSY;
+
+	__raw_writel(val, hw->regs + USI_CNT);
+
+	spin_unlock_irqrestore(&hw->lock, flags);
+}
+
+static int nuc900_spi_setupxfer(struct spi_device *spi,
+				 struct spi_transfer *t)
+{
+	return 0;
+}
+
+static int nuc900_spi_setup(struct spi_device *spi)
+{
+	return 0;
+}
+
+static inline unsigned int hw_txbyte(struct nuc900_spi *hw, int count)
+{
+	return hw->tx ? hw->tx[count] : 0;
+}
+
+static int nuc900_spi_txrx(struct spi_device *spi, struct spi_transfer *t)
+{
+	struct nuc900_spi *hw = to_hw(spi);
+
+	hw->tx = t->tx_buf;
+	hw->rx = t->rx_buf;
+	hw->len = t->len;
+	hw->count = 0;
+
+	__raw_writel(hw_txbyte(hw, 0x0), hw->regs + USI_TX0);
+
+	nuc900_spi_gobusy(hw);
+
+	wait_for_completion(&hw->done);
+
+	return hw->count;
+}
+
+static irqreturn_t nuc900_spi_irq(int irq, void *dev)
+{
+	struct nuc900_spi *hw = dev;
+	unsigned int status;
+	unsigned int count = hw->count;
+
+	status = __raw_readl(hw->regs + USI_CNT);
+	__raw_writel(status, hw->regs + USI_CNT);
+
+	if (status & ENFLG) {
+		hw->count++;
+
+		if (hw->rx)
+			hw->rx[count] = __raw_readl(hw->regs + USI_RX0);
+		count++;
+
+		if (count < hw->len) {
+			__raw_writel(hw_txbyte(hw, count), hw->regs + USI_TX0);
+			nuc900_spi_gobusy(hw);
+		} else {
+			complete(&hw->done);
+		}
+
+		return IRQ_HANDLED;
+	}
+
+	complete(&hw->done);
+	return IRQ_HANDLED;
+}
+
+static void nuc900_tx_edge(struct nuc900_spi *hw, unsigned int edge)
+{
+	unsigned int val;
+	unsigned long flags;
+
+	spin_lock_irqsave(&hw->lock, flags);
+
+	val = __raw_readl(hw->regs + USI_CNT);
+
+	if (edge)
+		val |= TXNEG;
+	else
+		val &= ~TXNEG;
+	__raw_writel(val, hw->regs + USI_CNT);
+
+	spin_unlock_irqrestore(&hw->lock, flags);
+}
+
+static void nuc900_rx_edge(struct nuc900_spi *hw, unsigned int edge)
+{
+	unsigned int val;
+	unsigned long flags;
+
+	spin_lock_irqsave(&hw->lock, flags);
+
+	val = __raw_readl(hw->regs + USI_CNT);
+
+	if (edge)
+		val |= RXNEG;
+	else
+		val &= ~RXNEG;
+	__raw_writel(val, hw->regs + USI_CNT);
+
+	spin_unlock_irqrestore(&hw->lock, flags);
+}
+
+static void nuc900_send_first(struct nuc900_spi *hw, unsigned int lsb)
+{
+	unsigned int val;
+	unsigned long flags;
+
+	spin_lock_irqsave(&hw->lock, flags);
+
+	val = __raw_readl(hw->regs + USI_CNT);
+
+	if (lsb)
+		val |= LSB;
+	else
+		val &= ~LSB;
+	__raw_writel(val, hw->regs + USI_CNT);
+
+	spin_unlock_irqrestore(&hw->lock, flags);
+}
+
+static void nuc900_set_sleep(struct nuc900_spi *hw, unsigned int sleep)
+{
+	unsigned int val;
+	unsigned long flags;
+
+	spin_lock_irqsave(&hw->lock, flags);
+
+	val = __raw_readl(hw->regs + USI_CNT);
+
+	if (sleep)
+		val |= (sleep << 12);
+	else
+		val &= ~(0x0f << 12);
+	__raw_writel(val, hw->regs + USI_CNT);
+
+	spin_unlock_irqrestore(&hw->lock, flags);
+}
+
+static void nuc900_enable_int(struct nuc900_spi *hw)
+{
+	unsigned int val;
+	unsigned long flags;
+
+	spin_lock_irqsave(&hw->lock, flags);
+
+	val = __raw_readl(hw->regs + USI_CNT);
+
+	val |= ENINT;
+
+	__raw_writel(val, hw->regs + USI_CNT);
+
+	spin_unlock_irqrestore(&hw->lock, flags);
+}
+
+static void nuc900_set_divider(struct nuc900_spi *hw)
+{
+	__raw_writel(hw->pdata->divider, hw->regs + USI_DIV);
+}
+
+static void nuc900_init_spi(struct nuc900_spi *hw)
+{
+	clk_enable(hw->clk);
+	spin_lock_init(&hw->lock);
+
+	nuc900_tx_edge(hw, hw->pdata->txneg);
+	nuc900_rx_edge(hw, hw->pdata->rxneg);
+	nuc900_send_first(hw, hw->pdata->lsb);
+	nuc900_set_sleep(hw, hw->pdata->sleep);
+	nuc900_spi_setup_txbitlen(hw, hw->pdata->txbitlen);
+	nuc900_spi_setup_txnum(hw, hw->pdata->txnum);
+	nuc900_set_divider(hw);
+	nuc900_enable_int(hw);
+}
+
+static int __devinit nuc900_spi_probe(struct platform_device *pdev)
+{
+	struct nuc900_spi *hw;
+	struct spi_master *master;
+	int err = 0;
+
+	master = spi_alloc_master(&pdev->dev, sizeof(struct nuc900_spi));
+	if (master == NULL) {
+		dev_err(&pdev->dev, "No memory for spi_master\n");
+		err = -ENOMEM;
+		goto err_nomem;
+	}
+
+	hw = spi_master_get_devdata(master);
+	memset(hw, 0, sizeof(struct nuc900_spi));
+
+	hw->master = spi_master_get(master);
+	hw->pdata  = pdev->dev.platform_data;
+	hw->dev = &pdev->dev;
+
+	if (hw->pdata == NULL) {
+		dev_err(&pdev->dev, "No platform data supplied\n");
+		err = -ENOENT;
+		goto err_pdata;
+	}
+
+	platform_set_drvdata(pdev, hw);
+	init_completion(&hw->done);
+
+	master->mode_bits          = SPI_MODE_0;
+	master->num_chipselect     = hw->pdata->num_cs;
+	master->bus_num            = hw->pdata->bus_num;
+	hw->bitbang.master         = hw->master;
+	hw->bitbang.setup_transfer = nuc900_spi_setupxfer;
+	hw->bitbang.chipselect     = nuc900_spi_chipsel;
+	hw->bitbang.txrx_bufs      = nuc900_spi_txrx;
+	hw->bitbang.master->setup  = nuc900_spi_setup;
+
+	hw->res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	if (hw->res == NULL) {
+		dev_err(&pdev->dev, "Cannot get IORESOURCE_MEM\n");
+		err = -ENOENT;
+		goto err_pdata;
+	}
+
+	hw->ioarea = request_mem_region(hw->res->start,
+					resource_size(hw->res), pdev->name);
+
+	if (hw->ioarea == NULL) {
+		dev_err(&pdev->dev, "Cannot reserve region\n");
+		err = -ENXIO;
+		goto err_pdata;
+	}
+
+	hw->regs = ioremap(hw->res->start, resource_size(hw->res));
+	if (hw->regs == NULL) {
+		dev_err(&pdev->dev, "Cannot map IO\n");
+		err = -ENXIO;
+		goto err_iomap;
+	}
+
+	hw->irq = platform_get_irq(pdev, 0);
+	if (hw->irq < 0) {
+		dev_err(&pdev->dev, "No IRQ specified\n");
+		err = -ENOENT;
+		goto err_irq;
+	}
+
+	err = request_irq(hw->irq, nuc900_spi_irq, 0, pdev->name, hw);
+	if (err) {
+		dev_err(&pdev->dev, "Cannot claim IRQ\n");
+		goto err_irq;
+	}
+
+	hw->clk = clk_get(&pdev->dev, "spi");
+	if (IS_ERR(hw->clk)) {
+		dev_err(&pdev->dev, "No clock for device\n");
+		err = PTR_ERR(hw->clk);
+		goto err_clk;
+	}
+
+	mfp_set_groupg(&pdev->dev);
+	nuc900_init_spi(hw);
+
+	err = spi_bitbang_start(&hw->bitbang);
+	if (err) {
+		dev_err(&pdev->dev, "Failed to register SPI master\n");
+		goto err_register;
+	}
+
+	return 0;
+
+err_register:
+	clk_disable(hw->clk);
+	clk_put(hw->clk);
+err_clk:
+	free_irq(hw->irq, hw);
+err_irq:
+	iounmap(hw->regs);
+err_iomap:
+	release_mem_region(hw->res->start, resource_size(hw->res));
+	kfree(hw->ioarea);
+err_pdata:
+	spi_master_put(hw->master);;
+
+err_nomem:
+	return err;
+}
+
+static int __devexit nuc900_spi_remove(struct platform_device *dev)
+{
+	struct nuc900_spi *hw = platform_get_drvdata(dev);
+
+	free_irq(hw->irq, hw);
+
+	platform_set_drvdata(dev, NULL);
+
+	spi_unregister_master(hw->master);
+
+	clk_disable(hw->clk);
+	clk_put(hw->clk);
+
+	iounmap(hw->regs);
+
+	release_mem_region(hw->res->start, resource_size(hw->res));
+	kfree(hw->ioarea);
+
+	spi_master_put(hw->master);
+	return 0;
+}
+
+static struct platform_driver nuc900_spi_driver = {
+	.probe		= nuc900_spi_probe,
+	.remove		= __devexit_p(nuc900_spi_remove),
+	.driver		= {
+		.name	= "nuc900-spi",
+		.owner	= THIS_MODULE,
+	},
+};
+
+static int __init nuc900_spi_init(void)
+{
+	return platform_driver_register(&nuc900_spi_driver);
+}
+
+static void __exit nuc900_spi_exit(void)
+{
+	platform_driver_unregister(&nuc900_spi_driver);
+}
+
+module_init(nuc900_spi_init);
+module_exit(nuc900_spi_exit);
+
+MODULE_AUTHOR("Wan ZongShun <mcuos.com@gmail.com>");
+MODULE_DESCRIPTION("nuc900 spi driver!");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:nuc900-spi");
diff --git a/drivers/spi/spi_s3c24xx.c b/drivers/spi/spi_s3c24xx.c
index 33d94f76b9ef..c010733877ae 100644
--- a/drivers/spi/spi_s3c24xx.c
+++ b/drivers/spi/spi_s3c24xx.c
@@ -1,7 +1,7 @@
 /* linux/drivers/spi/spi_s3c24xx.c
  *
  * Copyright (c) 2006 Ben Dooks
- * Copyright (c) 2006 Simtec Electronics
+ * Copyright 2006-2009 Simtec Electronics
  *	Ben Dooks <ben@simtec.co.uk>
  *
  * This program is free software; you can redistribute it and/or modify
@@ -28,6 +28,11 @@
 #include <plat/regs-spi.h>
 #include <mach/spi.h>
 
+#include <plat/fiq.h>
+#include <asm/fiq.h>
+
+#include "spi_s3c24xx_fiq.h"
+
 /**
  * s3c24xx_spi_devstate - per device data
  * @hz: Last frequency calculated for @sppre field.
@@ -42,6 +47,13 @@ struct s3c24xx_spi_devstate {
 	u8		sppre;
 };
 
+enum spi_fiq_mode {
+	FIQ_MODE_NONE	= 0,
+	FIQ_MODE_TX	= 1,
+	FIQ_MODE_RX	= 2,
+	FIQ_MODE_TXRX	= 3,
+};
+
 struct s3c24xx_spi {
 	/* bitbang has to be first */
 	struct spi_bitbang	 bitbang;
@@ -52,6 +64,11 @@ struct s3c24xx_spi {
 	int			 len;
 	int			 count;
 
+	struct fiq_handler	 fiq_handler;
+	enum spi_fiq_mode	 fiq_mode;
+	unsigned char		 fiq_inuse;
+	unsigned char		 fiq_claimed;
+
 	void			(*set_cs)(struct s3c2410_spi_info *spi,
 					  int cs, int pol);
 
@@ -67,6 +84,7 @@ struct s3c24xx_spi {
 	struct s3c2410_spi_info *pdata;
 };
 
+
 #define SPCON_DEFAULT (S3C2410_SPCON_MSTR | S3C2410_SPCON_SMOD_INT)
 #define SPPIN_DEFAULT (S3C2410_SPPIN_KEEP)
 
@@ -127,7 +145,7 @@ static int s3c24xx_spi_update_state(struct spi_device *spi,
 	}
 
 	if (spi->mode != cs->mode) {
-		u8 spcon = SPCON_DEFAULT;
+		u8 spcon = SPCON_DEFAULT | S3C2410_SPCON_ENSCK;
 
 		if (spi->mode & SPI_CPHA)
 			spcon |= S3C2410_SPCON_CPHA_FMTB;
@@ -214,13 +232,196 @@ static inline unsigned int hw_txbyte(struct s3c24xx_spi *hw, int count)
 	return hw->tx ? hw->tx[count] : 0;
 }
 
+#ifdef CONFIG_SPI_S3C24XX_FIQ
+/* Support for FIQ based pseudo-DMA to improve the transfer speed.
+ *
+ * This code uses the assembly helper in spi_s3c24xx_spi.S which is
+ * used by the FIQ core to move data between main memory and the peripheral
+ * block. Since this is code running on the processor, there is no problem
+ * with cache coherency of the buffers, so we can use any buffer we like.
+ */
+
+/**
+ * struct spi_fiq_code - FIQ code and header
+ * @length: The length of the code fragment, excluding this header.
+ * @ack_offset: The offset from @data to the word to place the IRQ ACK bit at.
+ * @data: The code itself to install as a FIQ handler.
+ */
+struct spi_fiq_code {
+	u32	length;
+	u32	ack_offset;
+	u8	data[0];
+};
+
+extern struct spi_fiq_code s3c24xx_spi_fiq_txrx;
+extern struct spi_fiq_code s3c24xx_spi_fiq_tx;
+extern struct spi_fiq_code s3c24xx_spi_fiq_rx;
+
+/**
+ * ack_bit - turn IRQ into IRQ acknowledgement bit
+ * @irq: The interrupt number
+ *
+ * Returns the bit to write to the interrupt acknowledge register.
+ */
+static inline u32 ack_bit(unsigned int irq)
+{
+	return 1 << (irq - IRQ_EINT0);
+}
+
+/**
+ * s3c24xx_spi_tryfiq - attempt to claim and setup FIQ for transfer
+ * @hw: The hardware state.
+ *
+ * Claim the FIQ handler (only one can be active at any one time) and
+ * then setup the correct transfer code for this transfer.
+ *
+ * This call updates all the necessary state information if sucessful,
+ * so the caller does not need to do anything more than start the transfer
+ * as normal, since the IRQ will have been re-routed to the FIQ handler.
+*/
+void s3c24xx_spi_tryfiq(struct s3c24xx_spi *hw)
+{
+	struct pt_regs regs;
+	enum spi_fiq_mode mode;
+	struct spi_fiq_code *code;
+	int ret;
+
+	if (!hw->fiq_claimed) {
+		/* try and claim fiq if we haven't got it, and if not
+		 * then return and simply use another transfer method */
+
+		ret = claim_fiq(&hw->fiq_handler);
+		if (ret)
+			return;
+	}
+
+	if (hw->tx && !hw->rx)
+		mode = FIQ_MODE_TX;
+	else if (hw->rx && !hw->tx)
+		mode = FIQ_MODE_RX;
+	else
+		mode = FIQ_MODE_TXRX;
+
+	regs.uregs[fiq_rspi] = (long)hw->regs;
+	regs.uregs[fiq_rrx]  = (long)hw->rx;
+	regs.uregs[fiq_rtx]  = (long)hw->tx + 1;
+	regs.uregs[fiq_rcount] = hw->len - 1;
+	regs.uregs[fiq_rirq] = (long)S3C24XX_VA_IRQ;
+
+	set_fiq_regs(&regs);
+
+	if (hw->fiq_mode != mode) {
+		u32 *ack_ptr;
+
+		hw->fiq_mode = mode;
+
+		switch (mode) {
+		case FIQ_MODE_TX:
+			code = &s3c24xx_spi_fiq_tx;
+			break;
+		case FIQ_MODE_RX:
+			code = &s3c24xx_spi_fiq_rx;
+			break;
+		case FIQ_MODE_TXRX:
+			code = &s3c24xx_spi_fiq_txrx;
+			break;
+		default:
+			code = NULL;
+		}
+
+		BUG_ON(!code);
+
+		ack_ptr = (u32 *)&code->data[code->ack_offset];
+		*ack_ptr = ack_bit(hw->irq);
+
+		set_fiq_handler(&code->data, code->length);
+	}
+
+	s3c24xx_set_fiq(hw->irq, true);
+
+	hw->fiq_mode = mode;
+	hw->fiq_inuse = 1;
+}
+
+/**
+ * s3c24xx_spi_fiqop - FIQ core code callback
+ * @pw: Data registered with the handler
+ * @release: Whether this is a release or a return.
+ *
+ * Called by the FIQ code when another module wants to use the FIQ, so
+ * return whether we are currently using this or not and then update our
+ * internal state.
+ */
+static int s3c24xx_spi_fiqop(void *pw, int release)
+{
+	struct s3c24xx_spi *hw = pw;
+	int ret = 0;
+
+	if (release) {
+		if (hw->fiq_inuse)
+			ret = -EBUSY;
+
+		/* note, we do not need to unroute the FIQ, as the FIQ
+		 * vector code de-routes it to signal the end of transfer */
+
+		hw->fiq_mode = FIQ_MODE_NONE;
+		hw->fiq_claimed = 0;
+	} else {
+		hw->fiq_claimed = 1;
+	}
+
+	return ret;
+}
+
+/**
+ * s3c24xx_spi_initfiq - setup the information for the FIQ core
+ * @hw: The hardware state.
+ *
+ * Setup the fiq_handler block to pass to the FIQ core.
+ */
+static inline void s3c24xx_spi_initfiq(struct s3c24xx_spi *hw)
+{
+	hw->fiq_handler.dev_id = hw;
+	hw->fiq_handler.name = dev_name(hw->dev);
+	hw->fiq_handler.fiq_op = s3c24xx_spi_fiqop;
+}
+
+/**
+ * s3c24xx_spi_usefiq - return if we should be using FIQ.
+ * @hw: The hardware state.
+ *
+ * Return true if the platform data specifies whether this channel is
+ * allowed to use the FIQ.
+ */
+static inline bool s3c24xx_spi_usefiq(struct s3c24xx_spi *hw)
+{
+	return hw->pdata->use_fiq;
+}
+
+/**
+ * s3c24xx_spi_usingfiq - return if channel is using FIQ
+ * @spi: The hardware state.
+ *
+ * Return whether the channel is currently using the FIQ (separate from
+ * whether the FIQ is claimed).
+ */
+static inline bool s3c24xx_spi_usingfiq(struct s3c24xx_spi *spi)
+{
+	return spi->fiq_inuse;
+}
+#else
+
+static inline void s3c24xx_spi_initfiq(struct s3c24xx_spi *s) { }
+static inline void s3c24xx_spi_tryfiq(struct s3c24xx_spi *s) { }
+static inline bool s3c24xx_spi_usefiq(struct s3c24xx_spi *s) { return false; }
+static inline bool s3c24xx_spi_usingfiq(struct s3c24xx_spi *s) { return false; }
+
+#endif /* CONFIG_SPI_S3C24XX_FIQ */
+
 static int s3c24xx_spi_txrx(struct spi_device *spi, struct spi_transfer *t)
 {
 	struct s3c24xx_spi *hw = to_hw(spi);
 
-	dev_dbg(&spi->dev, "txrx: tx %p, rx %p, len %d\n",
-		t->tx_buf, t->rx_buf, t->len);
-
 	hw->tx = t->tx_buf;
 	hw->rx = t->rx_buf;
 	hw->len = t->len;
@@ -228,11 +429,14 @@ static int s3c24xx_spi_txrx(struct spi_device *spi, struct spi_transfer *t)
 
 	init_completion(&hw->done);
 
+	hw->fiq_inuse = 0;
+	if (s3c24xx_spi_usefiq(hw) && t->len >= 3)
+		s3c24xx_spi_tryfiq(hw);
+
 	/* send the first byte */
 	writeb(hw_txbyte(hw, 0), hw->regs + S3C2410_SPTDAT);
 
 	wait_for_completion(&hw->done);
-
 	return hw->count;
 }
 
@@ -254,17 +458,27 @@ static irqreturn_t s3c24xx_spi_irq(int irq, void *dev)
 		goto irq_done;
 	}
 
-	hw->count++;
+	if (!s3c24xx_spi_usingfiq(hw)) {
+		hw->count++;
 
-	if (hw->rx)
-		hw->rx[count] = readb(hw->regs + S3C2410_SPRDAT);
+		if (hw->rx)
+			hw->rx[count] = readb(hw->regs + S3C2410_SPRDAT);
 
-	count++;
+		count++;
+
+		if (count < hw->len)
+			writeb(hw_txbyte(hw, count), hw->regs + S3C2410_SPTDAT);
+		else
+			complete(&hw->done);
+	} else {
+		hw->count = hw->len;
+		hw->fiq_inuse = 0;
+
+		if (hw->rx)
+			hw->rx[hw->len-1] = readb(hw->regs + S3C2410_SPRDAT);
 
-	if (count < hw->len)
-		writeb(hw_txbyte(hw, count), hw->regs + S3C2410_SPTDAT);
-	else
 		complete(&hw->done);
+	}
 
  irq_done:
 	return IRQ_HANDLED;
@@ -322,6 +536,10 @@ static int __init s3c24xx_spi_probe(struct platform_device *pdev)
 	platform_set_drvdata(pdev, hw);
 	init_completion(&hw->done);
 
+	/* initialise fiq handler */
+
+	s3c24xx_spi_initfiq(hw);
+
 	/* setup the master state. */
 
 	/* the spi->mode bits understood by this driver: */
@@ -489,7 +707,7 @@ static int s3c24xx_spi_resume(struct device *dev)
 	return 0;
 }
 
-static struct dev_pm_ops s3c24xx_spi_pmops = {
+static const struct dev_pm_ops s3c24xx_spi_pmops = {
 	.suspend	= s3c24xx_spi_suspend,
 	.resume		= s3c24xx_spi_resume,
 };
diff --git a/drivers/spi/spi_s3c24xx_fiq.S b/drivers/spi/spi_s3c24xx_fiq.S
new file mode 100644
index 000000000000..3793cae361db
--- /dev/null
+++ b/drivers/spi/spi_s3c24xx_fiq.S
@@ -0,0 +1,116 @@
+/* linux/drivers/spi/spi_s3c24xx_fiq.S
+ *
+ * Copyright 2009 Simtec Electronics
+ *	Ben Dooks <ben@simtec.co.uk>
+ *
+ * S3C24XX SPI - FIQ pseudo-DMA transfer code
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+*/
+
+#include <linux/linkage.h>
+#include <asm/assembler.h>
+
+#include <mach/map.h>
+#include <mach/regs-irq.h>
+#include <plat/regs-spi.h>
+
+#include "spi_s3c24xx_fiq.h"
+
+	.text
+
+	@ entry to these routines is as follows, with the register names
+	@ defined in fiq.h so that they can be shared with the C files which
+	@ setup the calling registers.
+	@
+	@ fiq_rirq	The base of the IRQ registers to find S3C2410_SRCPND
+	@ fiq_rtmp	Temporary register to hold tx/rx data
+	@ fiq_rspi	The base of the SPI register block
+	@ fiq_rtx	The tx buffer pointer
+	@ fiq_rrx	The rx buffer pointer
+	@ fiq_rcount	The number of bytes to move
+
+	@ each entry starts with a word entry of how long it is
+	@ and an offset to the irq acknowledgment word
+
+ENTRY(s3c24xx_spi_fiq_rx)
+s3c24xx_spi_fix_rx:
+	.word	fiq_rx_end - fiq_rx_start
+	.word	fiq_rx_irq_ack - fiq_rx_start
+fiq_rx_start:
+	ldr	fiq_rtmp, fiq_rx_irq_ack
+	str	fiq_rtmp, [ fiq_rirq, # S3C2410_SRCPND - S3C24XX_VA_IRQ ]
+
+	ldrb	fiq_rtmp, [ fiq_rspi, #  S3C2410_SPRDAT ]
+	strb	fiq_rtmp, [ fiq_rrx ], #1
+
+	mov	fiq_rtmp, #0xff
+	strb	fiq_rtmp, [ fiq_rspi, # S3C2410_SPTDAT ]
+
+	subs	fiq_rcount, fiq_rcount, #1
+	subnes	pc, lr, #4		@@ return, still have work to do
+
+	@@ set IRQ controller so that next op will trigger IRQ
+	mov	fiq_rtmp, #0
+	str	fiq_rtmp, [ fiq_rirq, # S3C2410_INTMOD  - S3C24XX_VA_IRQ ]
+	subs	pc, lr, #4
+
+fiq_rx_irq_ack:
+	.word	0
+fiq_rx_end:
+
+ENTRY(s3c24xx_spi_fiq_txrx)
+s3c24xx_spi_fiq_txrx:
+	.word	fiq_txrx_end - fiq_txrx_start
+	.word	fiq_txrx_irq_ack - fiq_txrx_start
+fiq_txrx_start:
+
+	ldrb	fiq_rtmp, [ fiq_rspi, #  S3C2410_SPRDAT ]
+	strb	fiq_rtmp, [ fiq_rrx ], #1
+
+	ldr	fiq_rtmp, fiq_txrx_irq_ack
+	str	fiq_rtmp, [ fiq_rirq, # S3C2410_SRCPND - S3C24XX_VA_IRQ ]
+
+	ldrb	fiq_rtmp, [ fiq_rtx ], #1
+	strb	fiq_rtmp, [ fiq_rspi, # S3C2410_SPTDAT ]
+
+	subs	fiq_rcount, fiq_rcount, #1
+	subnes	pc, lr, #4		@@ return, still have work to do
+
+	mov	fiq_rtmp, #0
+	str	fiq_rtmp, [ fiq_rirq, # S3C2410_INTMOD  - S3C24XX_VA_IRQ ]
+	subs	pc, lr, #4
+
+fiq_txrx_irq_ack:
+	.word	0
+
+fiq_txrx_end:
+
+ENTRY(s3c24xx_spi_fiq_tx)
+s3c24xx_spi_fix_tx:
+	.word	fiq_tx_end - fiq_tx_start
+	.word	fiq_tx_irq_ack - fiq_tx_start
+fiq_tx_start:
+	ldrb	fiq_rtmp, [ fiq_rspi, #  S3C2410_SPRDAT ]
+
+	ldr	fiq_rtmp, fiq_tx_irq_ack
+	str	fiq_rtmp, [ fiq_rirq, # S3C2410_SRCPND - S3C24XX_VA_IRQ ]
+
+	ldrb	fiq_rtmp, [ fiq_rtx ], #1
+	strb	fiq_rtmp, [ fiq_rspi, # S3C2410_SPTDAT ]
+
+	subs	fiq_rcount, fiq_rcount, #1
+	subnes	pc, lr, #4		@@ return, still have work to do
+
+	mov	fiq_rtmp, #0
+	str	fiq_rtmp, [ fiq_rirq, # S3C2410_INTMOD  - S3C24XX_VA_IRQ ]
+	subs	pc, lr, #4
+
+fiq_tx_irq_ack:
+	.word	0
+
+fiq_tx_end:
+
+	.end
diff --git a/drivers/spi/spi_s3c24xx_fiq.h b/drivers/spi/spi_s3c24xx_fiq.h
new file mode 100644
index 000000000000..a5950bb25b51
--- /dev/null
+++ b/drivers/spi/spi_s3c24xx_fiq.h
@@ -0,0 +1,26 @@
+/* linux/drivers/spi/spi_s3c24xx_fiq.h
+ *
+ * Copyright 2009 Simtec Electronics
+ *	Ben Dooks <ben@simtec.co.uk>
+ *
+ * S3C24XX SPI - FIQ pseudo-DMA transfer support
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+*/
+
+/* We have R8 through R13 to play with */
+
+#ifdef __ASSEMBLY__
+#define __REG_NR(x)     r##x
+#else
+#define __REG_NR(x)     (x)
+#endif
+
+#define fiq_rspi	__REG_NR(8)
+#define fiq_rtmp	__REG_NR(9)
+#define fiq_rrx		__REG_NR(10)
+#define fiq_rtx		__REG_NR(11)
+#define fiq_rcount	__REG_NR(12)
+#define fiq_rirq	__REG_NR(13)
diff --git a/drivers/spi/spi_s3c64xx.c b/drivers/spi/spi_s3c64xx.c
new file mode 100644
index 000000000000..88a456dba967
--- /dev/null
+++ b/drivers/spi/spi_s3c64xx.c
@@ -0,0 +1,1196 @@
+/* linux/drivers/spi/spi_s3c64xx.c
+ *
+ * Copyright (C) 2009 Samsung Electronics Ltd.
+ *	Jaswinder Singh <jassi.brar@samsung.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/workqueue.h>
+#include <linux/delay.h>
+#include <linux/clk.h>
+#include <linux/dma-mapping.h>
+#include <linux/platform_device.h>
+#include <linux/spi/spi.h>
+
+#include <mach/dma.h>
+#include <plat/spi.h>
+
+/* Registers and bit-fields */
+
+#define S3C64XX_SPI_CH_CFG		0x00
+#define S3C64XX_SPI_CLK_CFG		0x04
+#define S3C64XX_SPI_MODE_CFG	0x08
+#define S3C64XX_SPI_SLAVE_SEL	0x0C
+#define S3C64XX_SPI_INT_EN		0x10
+#define S3C64XX_SPI_STATUS		0x14
+#define S3C64XX_SPI_TX_DATA		0x18
+#define S3C64XX_SPI_RX_DATA		0x1C
+#define S3C64XX_SPI_PACKET_CNT	0x20
+#define S3C64XX_SPI_PENDING_CLR	0x24
+#define S3C64XX_SPI_SWAP_CFG	0x28
+#define S3C64XX_SPI_FB_CLK		0x2C
+
+#define S3C64XX_SPI_CH_HS_EN		(1<<6)	/* High Speed Enable */
+#define S3C64XX_SPI_CH_SW_RST		(1<<5)
+#define S3C64XX_SPI_CH_SLAVE		(1<<4)
+#define S3C64XX_SPI_CPOL_L		(1<<3)
+#define S3C64XX_SPI_CPHA_B		(1<<2)
+#define S3C64XX_SPI_CH_RXCH_ON		(1<<1)
+#define S3C64XX_SPI_CH_TXCH_ON		(1<<0)
+
+#define S3C64XX_SPI_CLKSEL_SRCMSK	(3<<9)
+#define S3C64XX_SPI_CLKSEL_SRCSHFT	9
+#define S3C64XX_SPI_ENCLK_ENABLE	(1<<8)
+#define S3C64XX_SPI_PSR_MASK 		0xff
+
+#define S3C64XX_SPI_MODE_CH_TSZ_BYTE		(0<<29)
+#define S3C64XX_SPI_MODE_CH_TSZ_HALFWORD	(1<<29)
+#define S3C64XX_SPI_MODE_CH_TSZ_WORD		(2<<29)
+#define S3C64XX_SPI_MODE_CH_TSZ_MASK		(3<<29)
+#define S3C64XX_SPI_MODE_BUS_TSZ_BYTE		(0<<17)
+#define S3C64XX_SPI_MODE_BUS_TSZ_HALFWORD	(1<<17)
+#define S3C64XX_SPI_MODE_BUS_TSZ_WORD		(2<<17)
+#define S3C64XX_SPI_MODE_BUS_TSZ_MASK		(3<<17)
+#define S3C64XX_SPI_MODE_RXDMA_ON		(1<<2)
+#define S3C64XX_SPI_MODE_TXDMA_ON		(1<<1)
+#define S3C64XX_SPI_MODE_4BURST			(1<<0)
+
+#define S3C64XX_SPI_SLAVE_AUTO			(1<<1)
+#define S3C64XX_SPI_SLAVE_SIG_INACT		(1<<0)
+
+#define S3C64XX_SPI_ACT(c) writel(0, (c)->regs + S3C64XX_SPI_SLAVE_SEL)
+
+#define S3C64XX_SPI_DEACT(c) writel(S3C64XX_SPI_SLAVE_SIG_INACT, \
+					(c)->regs + S3C64XX_SPI_SLAVE_SEL)
+
+#define S3C64XX_SPI_INT_TRAILING_EN		(1<<6)
+#define S3C64XX_SPI_INT_RX_OVERRUN_EN		(1<<5)
+#define S3C64XX_SPI_INT_RX_UNDERRUN_EN		(1<<4)
+#define S3C64XX_SPI_INT_TX_OVERRUN_EN		(1<<3)
+#define S3C64XX_SPI_INT_TX_UNDERRUN_EN		(1<<2)
+#define S3C64XX_SPI_INT_RX_FIFORDY_EN		(1<<1)
+#define S3C64XX_SPI_INT_TX_FIFORDY_EN		(1<<0)
+
+#define S3C64XX_SPI_ST_RX_OVERRUN_ERR		(1<<5)
+#define S3C64XX_SPI_ST_RX_UNDERRUN_ERR	(1<<4)
+#define S3C64XX_SPI_ST_TX_OVERRUN_ERR		(1<<3)
+#define S3C64XX_SPI_ST_TX_UNDERRUN_ERR	(1<<2)
+#define S3C64XX_SPI_ST_RX_FIFORDY		(1<<1)
+#define S3C64XX_SPI_ST_TX_FIFORDY		(1<<0)
+
+#define S3C64XX_SPI_PACKET_CNT_EN		(1<<16)
+
+#define S3C64XX_SPI_PND_TX_UNDERRUN_CLR		(1<<4)
+#define S3C64XX_SPI_PND_TX_OVERRUN_CLR		(1<<3)
+#define S3C64XX_SPI_PND_RX_UNDERRUN_CLR		(1<<2)
+#define S3C64XX_SPI_PND_RX_OVERRUN_CLR		(1<<1)
+#define S3C64XX_SPI_PND_TRAILING_CLR		(1<<0)
+
+#define S3C64XX_SPI_SWAP_RX_HALF_WORD		(1<<7)
+#define S3C64XX_SPI_SWAP_RX_BYTE		(1<<6)
+#define S3C64XX_SPI_SWAP_RX_BIT			(1<<5)
+#define S3C64XX_SPI_SWAP_RX_EN			(1<<4)
+#define S3C64XX_SPI_SWAP_TX_HALF_WORD		(1<<3)
+#define S3C64XX_SPI_SWAP_TX_BYTE		(1<<2)
+#define S3C64XX_SPI_SWAP_TX_BIT			(1<<1)
+#define S3C64XX_SPI_SWAP_TX_EN			(1<<0)
+
+#define S3C64XX_SPI_FBCLK_MSK		(3<<0)
+
+#define S3C64XX_SPI_ST_TRLCNTZ(v, i) ((((v) >> (i)->rx_lvl_offset) & \
+					(((i)->fifo_lvl_mask + 1))) \
+					? 1 : 0)
+
+#define S3C64XX_SPI_ST_TX_DONE(v, i) ((((v) >> (i)->rx_lvl_offset) & \
+					(((i)->fifo_lvl_mask + 1) << 1)) \
+					? 1 : 0)
+#define TX_FIFO_LVL(v, i) (((v) >> 6) & (i)->fifo_lvl_mask)
+#define RX_FIFO_LVL(v, i) (((v) >> (i)->rx_lvl_offset) & (i)->fifo_lvl_mask)
+
+#define S3C64XX_SPI_MAX_TRAILCNT	0x3ff
+#define S3C64XX_SPI_TRAILCNT_OFF	19
+
+#define S3C64XX_SPI_TRAILCNT		S3C64XX_SPI_MAX_TRAILCNT
+
+#define msecs_to_loops(t) (loops_per_jiffy / 1000 * HZ * t)
+
+#define SUSPND    (1<<0)
+#define SPIBUSY   (1<<1)
+#define RXBUSY    (1<<2)
+#define TXBUSY    (1<<3)
+
+/**
+ * struct s3c64xx_spi_driver_data - Runtime info holder for SPI driver.
+ * @clk: Pointer to the spi clock.
+ * @master: Pointer to the SPI Protocol master.
+ * @workqueue: Work queue for the SPI xfer requests.
+ * @cntrlr_info: Platform specific data for the controller this driver manages.
+ * @tgl_spi: Pointer to the last CS left untoggled by the cs_change hint.
+ * @work: Work
+ * @queue: To log SPI xfer requests.
+ * @lock: Controller specific lock.
+ * @state: Set of FLAGS to indicate status.
+ * @rx_dmach: Controller's DMA channel for Rx.
+ * @tx_dmach: Controller's DMA channel for Tx.
+ * @sfr_start: BUS address of SPI controller regs.
+ * @regs: Pointer to ioremap'ed controller registers.
+ * @xfer_completion: To indicate completion of xfer task.
+ * @cur_mode: Stores the active configuration of the controller.
+ * @cur_bpw: Stores the active bits per word settings.
+ * @cur_speed: Stores the active xfer clock speed.
+ */
+struct s3c64xx_spi_driver_data {
+	void __iomem                    *regs;
+	struct clk                      *clk;
+	struct platform_device          *pdev;
+	struct spi_master               *master;
+	struct workqueue_struct	        *workqueue;
+	struct s3c64xx_spi_cntrlr_info  *cntrlr_info;
+	struct spi_device               *tgl_spi;
+	struct work_struct              work;
+	struct list_head                queue;
+	spinlock_t                      lock;
+	enum dma_ch                     rx_dmach;
+	enum dma_ch                     tx_dmach;
+	unsigned long                   sfr_start;
+	struct completion               xfer_completion;
+	unsigned                        state;
+	unsigned                        cur_mode, cur_bpw;
+	unsigned                        cur_speed;
+};
+
+static struct s3c2410_dma_client s3c64xx_spi_dma_client = {
+	.name = "samsung-spi-dma",
+};
+
+static void flush_fifo(struct s3c64xx_spi_driver_data *sdd)
+{
+	struct s3c64xx_spi_cntrlr_info *sci = sdd->cntrlr_info;
+	void __iomem *regs = sdd->regs;
+	unsigned long loops;
+	u32 val;
+
+	writel(0, regs + S3C64XX_SPI_PACKET_CNT);
+
+	val = readl(regs + S3C64XX_SPI_CH_CFG);
+	val |= S3C64XX_SPI_CH_SW_RST;
+	val &= ~S3C64XX_SPI_CH_HS_EN;
+	writel(val, regs + S3C64XX_SPI_CH_CFG);
+
+	/* Flush TxFIFO*/
+	loops = msecs_to_loops(1);
+	do {
+		val = readl(regs + S3C64XX_SPI_STATUS);
+	} while (TX_FIFO_LVL(val, sci) && loops--);
+
+	/* Flush RxFIFO*/
+	loops = msecs_to_loops(1);
+	do {
+		val = readl(regs + S3C64XX_SPI_STATUS);
+		if (RX_FIFO_LVL(val, sci))
+			readl(regs + S3C64XX_SPI_RX_DATA);
+		else
+			break;
+	} while (loops--);
+
+	val = readl(regs + S3C64XX_SPI_CH_CFG);
+	val &= ~S3C64XX_SPI_CH_SW_RST;
+	writel(val, regs + S3C64XX_SPI_CH_CFG);
+
+	val = readl(regs + S3C64XX_SPI_MODE_CFG);
+	val &= ~(S3C64XX_SPI_MODE_TXDMA_ON | S3C64XX_SPI_MODE_RXDMA_ON);
+	writel(val, regs + S3C64XX_SPI_MODE_CFG);
+
+	val = readl(regs + S3C64XX_SPI_CH_CFG);
+	val &= ~(S3C64XX_SPI_CH_RXCH_ON | S3C64XX_SPI_CH_TXCH_ON);
+	writel(val, regs + S3C64XX_SPI_CH_CFG);
+}
+
+static void enable_datapath(struct s3c64xx_spi_driver_data *sdd,
+				struct spi_device *spi,
+				struct spi_transfer *xfer, int dma_mode)
+{
+	struct s3c64xx_spi_cntrlr_info *sci = sdd->cntrlr_info;
+	void __iomem *regs = sdd->regs;
+	u32 modecfg, chcfg;
+
+	modecfg = readl(regs + S3C64XX_SPI_MODE_CFG);
+	modecfg &= ~(S3C64XX_SPI_MODE_TXDMA_ON | S3C64XX_SPI_MODE_RXDMA_ON);
+
+	chcfg = readl(regs + S3C64XX_SPI_CH_CFG);
+	chcfg &= ~S3C64XX_SPI_CH_TXCH_ON;
+
+	if (dma_mode) {
+		chcfg &= ~S3C64XX_SPI_CH_RXCH_ON;
+	} else {
+		/* Always shift in data in FIFO, even if xfer is Tx only,
+		 * this helps setting PCKT_CNT value for generating clocks
+		 * as exactly needed.
+		 */
+		chcfg |= S3C64XX_SPI_CH_RXCH_ON;
+		writel(((xfer->len * 8 / sdd->cur_bpw) & 0xffff)
+					| S3C64XX_SPI_PACKET_CNT_EN,
+					regs + S3C64XX_SPI_PACKET_CNT);
+	}
+
+	if (xfer->tx_buf != NULL) {
+		sdd->state |= TXBUSY;
+		chcfg |= S3C64XX_SPI_CH_TXCH_ON;
+		if (dma_mode) {
+			modecfg |= S3C64XX_SPI_MODE_TXDMA_ON;
+			s3c2410_dma_config(sdd->tx_dmach, 1);
+			s3c2410_dma_enqueue(sdd->tx_dmach, (void *)sdd,
+						xfer->tx_dma, xfer->len);
+			s3c2410_dma_ctrl(sdd->tx_dmach, S3C2410_DMAOP_START);
+		} else {
+			unsigned char *buf = (unsigned char *) xfer->tx_buf;
+			int i = 0;
+			while (i < xfer->len)
+				writeb(buf[i++], regs + S3C64XX_SPI_TX_DATA);
+		}
+	}
+
+	if (xfer->rx_buf != NULL) {
+		sdd->state |= RXBUSY;
+
+		if (sci->high_speed && sdd->cur_speed >= 30000000UL
+					&& !(sdd->cur_mode & SPI_CPHA))
+			chcfg |= S3C64XX_SPI_CH_HS_EN;
+
+		if (dma_mode) {
+			modecfg |= S3C64XX_SPI_MODE_RXDMA_ON;
+			chcfg |= S3C64XX_SPI_CH_RXCH_ON;
+			writel(((xfer->len * 8 / sdd->cur_bpw) & 0xffff)
+					| S3C64XX_SPI_PACKET_CNT_EN,
+					regs + S3C64XX_SPI_PACKET_CNT);
+			s3c2410_dma_config(sdd->rx_dmach, 1);
+			s3c2410_dma_enqueue(sdd->rx_dmach, (void *)sdd,
+						xfer->rx_dma, xfer->len);
+			s3c2410_dma_ctrl(sdd->rx_dmach, S3C2410_DMAOP_START);
+		}
+	}
+
+	writel(modecfg, regs + S3C64XX_SPI_MODE_CFG);
+	writel(chcfg, regs + S3C64XX_SPI_CH_CFG);
+}
+
+static inline void enable_cs(struct s3c64xx_spi_driver_data *sdd,
+						struct spi_device *spi)
+{
+	struct s3c64xx_spi_csinfo *cs;
+
+	if (sdd->tgl_spi != NULL) { /* If last device toggled after mssg */
+		if (sdd->tgl_spi != spi) { /* if last mssg on diff device */
+			/* Deselect the last toggled device */
+			cs = sdd->tgl_spi->controller_data;
+			cs->set_level(spi->mode & SPI_CS_HIGH ? 0 : 1);
+		}
+		sdd->tgl_spi = NULL;
+	}
+
+	cs = spi->controller_data;
+	cs->set_level(spi->mode & SPI_CS_HIGH ? 1 : 0);
+}
+
+static int wait_for_xfer(struct s3c64xx_spi_driver_data *sdd,
+				struct spi_transfer *xfer, int dma_mode)
+{
+	struct s3c64xx_spi_cntrlr_info *sci = sdd->cntrlr_info;
+	void __iomem *regs = sdd->regs;
+	unsigned long val;
+	int ms;
+
+	/* millisecs to xfer 'len' bytes @ 'cur_speed' */
+	ms = xfer->len * 8 * 1000 / sdd->cur_speed;
+	ms += 5; /* some tolerance */
+
+	if (dma_mode) {
+		val = msecs_to_jiffies(ms) + 10;
+		val = wait_for_completion_timeout(&sdd->xfer_completion, val);
+	} else {
+		val = msecs_to_loops(ms);
+		do {
+			val = readl(regs + S3C64XX_SPI_STATUS);
+		} while (RX_FIFO_LVL(val, sci) < xfer->len && --val);
+	}
+
+	if (!val)
+		return -EIO;
+
+	if (dma_mode) {
+		u32 status;
+
+		/*
+		 * DmaTx returns after simply writing data in the FIFO,
+		 * w/o waiting for real transmission on the bus to finish.
+		 * DmaRx returns only after Dma read data from FIFO which
+		 * needs bus transmission to finish, so we don't worry if
+		 * Xfer involved Rx(with or without Tx).
+		 */
+		if (xfer->rx_buf == NULL) {
+			val = msecs_to_loops(10);
+			status = readl(regs + S3C64XX_SPI_STATUS);
+			while ((TX_FIFO_LVL(status, sci)
+				|| !S3C64XX_SPI_ST_TX_DONE(status, sci))
+					&& --val) {
+				cpu_relax();
+				status = readl(regs + S3C64XX_SPI_STATUS);
+			}
+
+			if (!val)
+				return -EIO;
+		}
+	} else {
+		unsigned char *buf;
+		int i;
+
+		/* If it was only Tx */
+		if (xfer->rx_buf == NULL) {
+			sdd->state &= ~TXBUSY;
+			return 0;
+		}
+
+		i = 0;
+		buf = xfer->rx_buf;
+		while (i < xfer->len)
+			buf[i++] = readb(regs + S3C64XX_SPI_RX_DATA);
+
+		sdd->state &= ~RXBUSY;
+	}
+
+	return 0;
+}
+
+static inline void disable_cs(struct s3c64xx_spi_driver_data *sdd,
+						struct spi_device *spi)
+{
+	struct s3c64xx_spi_csinfo *cs = spi->controller_data;
+
+	if (sdd->tgl_spi == spi)
+		sdd->tgl_spi = NULL;
+
+	cs->set_level(spi->mode & SPI_CS_HIGH ? 0 : 1);
+}
+
+static void s3c64xx_spi_config(struct s3c64xx_spi_driver_data *sdd)
+{
+	struct s3c64xx_spi_cntrlr_info *sci = sdd->cntrlr_info;
+	void __iomem *regs = sdd->regs;
+	u32 val;
+
+	/* Disable Clock */
+	val = readl(regs + S3C64XX_SPI_CLK_CFG);
+	val &= ~S3C64XX_SPI_ENCLK_ENABLE;
+	writel(val, regs + S3C64XX_SPI_CLK_CFG);
+
+	/* Set Polarity and Phase */
+	val = readl(regs + S3C64XX_SPI_CH_CFG);
+	val &= ~(S3C64XX_SPI_CH_SLAVE |
+			S3C64XX_SPI_CPOL_L |
+			S3C64XX_SPI_CPHA_B);
+
+	if (sdd->cur_mode & SPI_CPOL)
+		val |= S3C64XX_SPI_CPOL_L;
+
+	if (sdd->cur_mode & SPI_CPHA)
+		val |= S3C64XX_SPI_CPHA_B;
+
+	writel(val, regs + S3C64XX_SPI_CH_CFG);
+
+	/* Set Channel & DMA Mode */
+	val = readl(regs + S3C64XX_SPI_MODE_CFG);
+	val &= ~(S3C64XX_SPI_MODE_BUS_TSZ_MASK
+			| S3C64XX_SPI_MODE_CH_TSZ_MASK);
+
+	switch (sdd->cur_bpw) {
+	case 32:
+		val |= S3C64XX_SPI_MODE_BUS_TSZ_WORD;
+		break;
+	case 16:
+		val |= S3C64XX_SPI_MODE_BUS_TSZ_HALFWORD;
+		break;
+	default:
+		val |= S3C64XX_SPI_MODE_BUS_TSZ_BYTE;
+		break;
+	}
+	val |= S3C64XX_SPI_MODE_CH_TSZ_BYTE; /* Always 8bits wide */
+
+	writel(val, regs + S3C64XX_SPI_MODE_CFG);
+
+	/* Configure Clock */
+	val = readl(regs + S3C64XX_SPI_CLK_CFG);
+	val &= ~S3C64XX_SPI_PSR_MASK;
+	val |= ((clk_get_rate(sci->src_clk) / sdd->cur_speed / 2 - 1)
+			& S3C64XX_SPI_PSR_MASK);
+	writel(val, regs + S3C64XX_SPI_CLK_CFG);
+
+	/* Enable Clock */
+	val = readl(regs + S3C64XX_SPI_CLK_CFG);
+	val |= S3C64XX_SPI_ENCLK_ENABLE;
+	writel(val, regs + S3C64XX_SPI_CLK_CFG);
+}
+
+void s3c64xx_spi_dma_rxcb(struct s3c2410_dma_chan *chan, void *buf_id,
+				int size, enum s3c2410_dma_buffresult res)
+{
+	struct s3c64xx_spi_driver_data *sdd = buf_id;
+	unsigned long flags;
+
+	spin_lock_irqsave(&sdd->lock, flags);
+
+	if (res == S3C2410_RES_OK)
+		sdd->state &= ~RXBUSY;
+	else
+		dev_err(&sdd->pdev->dev, "DmaAbrtRx-%d\n", size);
+
+	/* If the other done */
+	if (!(sdd->state & TXBUSY))
+		complete(&sdd->xfer_completion);
+
+	spin_unlock_irqrestore(&sdd->lock, flags);
+}
+
+void s3c64xx_spi_dma_txcb(struct s3c2410_dma_chan *chan, void *buf_id,
+				int size, enum s3c2410_dma_buffresult res)
+{
+	struct s3c64xx_spi_driver_data *sdd = buf_id;
+	unsigned long flags;
+
+	spin_lock_irqsave(&sdd->lock, flags);
+
+	if (res == S3C2410_RES_OK)
+		sdd->state &= ~TXBUSY;
+	else
+		dev_err(&sdd->pdev->dev, "DmaAbrtTx-%d \n", size);
+
+	/* If the other done */
+	if (!(sdd->state & RXBUSY))
+		complete(&sdd->xfer_completion);
+
+	spin_unlock_irqrestore(&sdd->lock, flags);
+}
+
+#define XFER_DMAADDR_INVALID DMA_BIT_MASK(32)
+
+static int s3c64xx_spi_map_mssg(struct s3c64xx_spi_driver_data *sdd,
+						struct spi_message *msg)
+{
+	struct device *dev = &sdd->pdev->dev;
+	struct spi_transfer *xfer;
+
+	if (msg->is_dma_mapped)
+		return 0;
+
+	/* First mark all xfer unmapped */
+	list_for_each_entry(xfer, &msg->transfers, transfer_list) {
+		xfer->rx_dma = XFER_DMAADDR_INVALID;
+		xfer->tx_dma = XFER_DMAADDR_INVALID;
+	}
+
+	/* Map until end or first fail */
+	list_for_each_entry(xfer, &msg->transfers, transfer_list) {
+
+		if (xfer->tx_buf != NULL) {
+			xfer->tx_dma = dma_map_single(dev, xfer->tx_buf,
+						xfer->len, DMA_TO_DEVICE);
+			if (dma_mapping_error(dev, xfer->tx_dma)) {
+				dev_err(dev, "dma_map_single Tx failed\n");
+				xfer->tx_dma = XFER_DMAADDR_INVALID;
+				return -ENOMEM;
+			}
+		}
+
+		if (xfer->rx_buf != NULL) {
+			xfer->rx_dma = dma_map_single(dev, xfer->rx_buf,
+						xfer->len, DMA_FROM_DEVICE);
+			if (dma_mapping_error(dev, xfer->rx_dma)) {
+				dev_err(dev, "dma_map_single Rx failed\n");
+				dma_unmap_single(dev, xfer->tx_dma,
+						xfer->len, DMA_TO_DEVICE);
+				xfer->tx_dma = XFER_DMAADDR_INVALID;
+				xfer->rx_dma = XFER_DMAADDR_INVALID;
+				return -ENOMEM;
+			}
+		}
+	}
+
+	return 0;
+}
+
+static void s3c64xx_spi_unmap_mssg(struct s3c64xx_spi_driver_data *sdd,
+						struct spi_message *msg)
+{
+	struct device *dev = &sdd->pdev->dev;
+	struct spi_transfer *xfer;
+
+	if (msg->is_dma_mapped)
+		return;
+
+	list_for_each_entry(xfer, &msg->transfers, transfer_list) {
+
+		if (xfer->rx_buf != NULL
+				&& xfer->rx_dma != XFER_DMAADDR_INVALID)
+			dma_unmap_single(dev, xfer->rx_dma,
+						xfer->len, DMA_FROM_DEVICE);
+
+		if (xfer->tx_buf != NULL
+				&& xfer->tx_dma != XFER_DMAADDR_INVALID)
+			dma_unmap_single(dev, xfer->tx_dma,
+						xfer->len, DMA_TO_DEVICE);
+	}
+}
+
+static void handle_msg(struct s3c64xx_spi_driver_data *sdd,
+					struct spi_message *msg)
+{
+	struct s3c64xx_spi_cntrlr_info *sci = sdd->cntrlr_info;
+	struct spi_device *spi = msg->spi;
+	struct s3c64xx_spi_csinfo *cs = spi->controller_data;
+	struct spi_transfer *xfer;
+	int status = 0, cs_toggle = 0;
+	u32 speed;
+	u8 bpw;
+
+	/* If Master's(controller) state differs from that needed by Slave */
+	if (sdd->cur_speed != spi->max_speed_hz
+			|| sdd->cur_mode != spi->mode
+			|| sdd->cur_bpw != spi->bits_per_word) {
+		sdd->cur_bpw = spi->bits_per_word;
+		sdd->cur_speed = spi->max_speed_hz;
+		sdd->cur_mode = spi->mode;
+		s3c64xx_spi_config(sdd);
+	}
+
+	/* Map all the transfers if needed */
+	if (s3c64xx_spi_map_mssg(sdd, msg)) {
+		dev_err(&spi->dev,
+			"Xfer: Unable to map message buffers!\n");
+		status = -ENOMEM;
+		goto out;
+	}
+
+	/* Configure feedback delay */
+	writel(cs->fb_delay & 0x3, sdd->regs + S3C64XX_SPI_FB_CLK);
+
+	list_for_each_entry(xfer, &msg->transfers, transfer_list) {
+
+		unsigned long flags;
+		int use_dma;
+
+		INIT_COMPLETION(sdd->xfer_completion);
+
+		/* Only BPW and Speed may change across transfers */
+		bpw = xfer->bits_per_word ? : spi->bits_per_word;
+		speed = xfer->speed_hz ? : spi->max_speed_hz;
+
+		if (bpw != sdd->cur_bpw || speed != sdd->cur_speed) {
+			sdd->cur_bpw = bpw;
+			sdd->cur_speed = speed;
+			s3c64xx_spi_config(sdd);
+		}
+
+		/* Polling method for xfers not bigger than FIFO capacity */
+		if (xfer->len <= ((sci->fifo_lvl_mask >> 1) + 1))
+			use_dma = 0;
+		else
+			use_dma = 1;
+
+		spin_lock_irqsave(&sdd->lock, flags);
+
+		/* Pending only which is to be done */
+		sdd->state &= ~RXBUSY;
+		sdd->state &= ~TXBUSY;
+
+		enable_datapath(sdd, spi, xfer, use_dma);
+
+		/* Slave Select */
+		enable_cs(sdd, spi);
+
+		/* Start the signals */
+		S3C64XX_SPI_ACT(sdd);
+
+		spin_unlock_irqrestore(&sdd->lock, flags);
+
+		status = wait_for_xfer(sdd, xfer, use_dma);
+
+		/* Quiese the signals */
+		S3C64XX_SPI_DEACT(sdd);
+
+		if (status) {
+			dev_err(&spi->dev, "I/O Error: \
+				rx-%d tx-%d res:rx-%c tx-%c len-%d\n",
+				xfer->rx_buf ? 1 : 0, xfer->tx_buf ? 1 : 0,
+				(sdd->state & RXBUSY) ? 'f' : 'p',
+				(sdd->state & TXBUSY) ? 'f' : 'p',
+				xfer->len);
+
+			if (use_dma) {
+				if (xfer->tx_buf != NULL
+						&& (sdd->state & TXBUSY))
+					s3c2410_dma_ctrl(sdd->tx_dmach,
+							S3C2410_DMAOP_FLUSH);
+				if (xfer->rx_buf != NULL
+						&& (sdd->state & RXBUSY))
+					s3c2410_dma_ctrl(sdd->rx_dmach,
+							S3C2410_DMAOP_FLUSH);
+			}
+
+			goto out;
+		}
+
+		if (xfer->delay_usecs)
+			udelay(xfer->delay_usecs);
+
+		if (xfer->cs_change) {
+			/* Hint that the next mssg is gonna be
+			   for the same device */
+			if (list_is_last(&xfer->transfer_list,
+						&msg->transfers))
+				cs_toggle = 1;
+			else
+				disable_cs(sdd, spi);
+		}
+
+		msg->actual_length += xfer->len;
+
+		flush_fifo(sdd);
+	}
+
+out:
+	if (!cs_toggle || status)
+		disable_cs(sdd, spi);
+	else
+		sdd->tgl_spi = spi;
+
+	s3c64xx_spi_unmap_mssg(sdd, msg);
+
+	msg->status = status;
+
+	if (msg->complete)
+		msg->complete(msg->context);
+}
+
+static int acquire_dma(struct s3c64xx_spi_driver_data *sdd)
+{
+	if (s3c2410_dma_request(sdd->rx_dmach,
+					&s3c64xx_spi_dma_client, NULL) < 0) {
+		dev_err(&sdd->pdev->dev, "cannot get RxDMA\n");
+		return 0;
+	}
+	s3c2410_dma_set_buffdone_fn(sdd->rx_dmach, s3c64xx_spi_dma_rxcb);
+	s3c2410_dma_devconfig(sdd->rx_dmach, S3C2410_DMASRC_HW,
+					sdd->sfr_start + S3C64XX_SPI_RX_DATA);
+
+	if (s3c2410_dma_request(sdd->tx_dmach,
+					&s3c64xx_spi_dma_client, NULL) < 0) {
+		dev_err(&sdd->pdev->dev, "cannot get TxDMA\n");
+		s3c2410_dma_free(sdd->rx_dmach, &s3c64xx_spi_dma_client);
+		return 0;
+	}
+	s3c2410_dma_set_buffdone_fn(sdd->tx_dmach, s3c64xx_spi_dma_txcb);
+	s3c2410_dma_devconfig(sdd->tx_dmach, S3C2410_DMASRC_MEM,
+					sdd->sfr_start + S3C64XX_SPI_TX_DATA);
+
+	return 1;
+}
+
+static void s3c64xx_spi_work(struct work_struct *work)
+{
+	struct s3c64xx_spi_driver_data *sdd = container_of(work,
+					struct s3c64xx_spi_driver_data, work);
+	unsigned long flags;
+
+	/* Acquire DMA channels */
+	while (!acquire_dma(sdd))
+		msleep(10);
+
+	spin_lock_irqsave(&sdd->lock, flags);
+
+	while (!list_empty(&sdd->queue)
+				&& !(sdd->state & SUSPND)) {
+
+		struct spi_message *msg;
+
+		msg = container_of(sdd->queue.next, struct spi_message, queue);
+
+		list_del_init(&msg->queue);
+
+		/* Set Xfer busy flag */
+		sdd->state |= SPIBUSY;
+
+		spin_unlock_irqrestore(&sdd->lock, flags);
+
+		handle_msg(sdd, msg);
+
+		spin_lock_irqsave(&sdd->lock, flags);
+
+		sdd->state &= ~SPIBUSY;
+	}
+
+	spin_unlock_irqrestore(&sdd->lock, flags);
+
+	/* Free DMA channels */
+	s3c2410_dma_free(sdd->tx_dmach, &s3c64xx_spi_dma_client);
+	s3c2410_dma_free(sdd->rx_dmach, &s3c64xx_spi_dma_client);
+}
+
+static int s3c64xx_spi_transfer(struct spi_device *spi,
+						struct spi_message *msg)
+{
+	struct s3c64xx_spi_driver_data *sdd;
+	unsigned long flags;
+
+	sdd = spi_master_get_devdata(spi->master);
+
+	spin_lock_irqsave(&sdd->lock, flags);
+
+	if (sdd->state & SUSPND) {
+		spin_unlock_irqrestore(&sdd->lock, flags);
+		return -ESHUTDOWN;
+	}
+
+	msg->status = -EINPROGRESS;
+	msg->actual_length = 0;
+
+	list_add_tail(&msg->queue, &sdd->queue);
+
+	queue_work(sdd->workqueue, &sdd->work);
+
+	spin_unlock_irqrestore(&sdd->lock, flags);
+
+	return 0;
+}
+
+/*
+ * Here we only check the validity of requested configuration
+ * and save the configuration in a local data-structure.
+ * The controller is actually configured only just before we
+ * get a message to transfer.
+ */
+static int s3c64xx_spi_setup(struct spi_device *spi)
+{
+	struct s3c64xx_spi_csinfo *cs = spi->controller_data;
+	struct s3c64xx_spi_driver_data *sdd;
+	struct s3c64xx_spi_cntrlr_info *sci;
+	struct spi_message *msg;
+	u32 psr, speed;
+	unsigned long flags;
+	int err = 0;
+
+	if (cs == NULL || cs->set_level == NULL) {
+		dev_err(&spi->dev, "No CS for SPI(%d)\n", spi->chip_select);
+		return -ENODEV;
+	}
+
+	sdd = spi_master_get_devdata(spi->master);
+	sci = sdd->cntrlr_info;
+
+	spin_lock_irqsave(&sdd->lock, flags);
+
+	list_for_each_entry(msg, &sdd->queue, queue) {
+		/* Is some mssg is already queued for this device */
+		if (msg->spi == spi) {
+			dev_err(&spi->dev,
+				"setup: attempt while mssg in queue!\n");
+			spin_unlock_irqrestore(&sdd->lock, flags);
+			return -EBUSY;
+		}
+	}
+
+	if (sdd->state & SUSPND) {
+		spin_unlock_irqrestore(&sdd->lock, flags);
+		dev_err(&spi->dev,
+			"setup: SPI-%d not active!\n", spi->master->bus_num);
+		return -ESHUTDOWN;
+	}
+
+	spin_unlock_irqrestore(&sdd->lock, flags);
+
+	if (spi->bits_per_word != 8
+			&& spi->bits_per_word != 16
+			&& spi->bits_per_word != 32) {
+		dev_err(&spi->dev, "setup: %dbits/wrd not supported!\n",
+							spi->bits_per_word);
+		err = -EINVAL;
+		goto setup_exit;
+	}
+
+	/* Check if we can provide the requested rate */
+	speed = clk_get_rate(sci->src_clk) / 2 / (0 + 1); /* Max possible */
+
+	if (spi->max_speed_hz > speed)
+		spi->max_speed_hz = speed;
+
+	psr = clk_get_rate(sci->src_clk) / 2 / spi->max_speed_hz - 1;
+	psr &= S3C64XX_SPI_PSR_MASK;
+	if (psr == S3C64XX_SPI_PSR_MASK)
+		psr--;
+
+	speed = clk_get_rate(sci->src_clk) / 2 / (psr + 1);
+	if (spi->max_speed_hz < speed) {
+		if (psr+1 < S3C64XX_SPI_PSR_MASK) {
+			psr++;
+		} else {
+			err = -EINVAL;
+			goto setup_exit;
+		}
+	}
+
+	speed = clk_get_rate(sci->src_clk) / 2 / (psr + 1);
+	if (spi->max_speed_hz >= speed)
+		spi->max_speed_hz = speed;
+	else
+		err = -EINVAL;
+
+setup_exit:
+
+	/* setup() returns with device de-selected */
+	disable_cs(sdd, spi);
+
+	return err;
+}
+
+static void s3c64xx_spi_hwinit(struct s3c64xx_spi_driver_data *sdd, int channel)
+{
+	struct s3c64xx_spi_cntrlr_info *sci = sdd->cntrlr_info;
+	void __iomem *regs = sdd->regs;
+	unsigned int val;
+
+	sdd->cur_speed = 0;
+
+	S3C64XX_SPI_DEACT(sdd);
+
+	/* Disable Interrupts - we use Polling if not DMA mode */
+	writel(0, regs + S3C64XX_SPI_INT_EN);
+
+	writel(sci->src_clk_nr << S3C64XX_SPI_CLKSEL_SRCSHFT,
+				regs + S3C64XX_SPI_CLK_CFG);
+	writel(0, regs + S3C64XX_SPI_MODE_CFG);
+	writel(0, regs + S3C64XX_SPI_PACKET_CNT);
+
+	/* Clear any irq pending bits */
+	writel(readl(regs + S3C64XX_SPI_PENDING_CLR),
+				regs + S3C64XX_SPI_PENDING_CLR);
+
+	writel(0, regs + S3C64XX_SPI_SWAP_CFG);
+
+	val = readl(regs + S3C64XX_SPI_MODE_CFG);
+	val &= ~S3C64XX_SPI_MODE_4BURST;
+	val &= ~(S3C64XX_SPI_MAX_TRAILCNT << S3C64XX_SPI_TRAILCNT_OFF);
+	val |= (S3C64XX_SPI_TRAILCNT << S3C64XX_SPI_TRAILCNT_OFF);
+	writel(val, regs + S3C64XX_SPI_MODE_CFG);
+
+	flush_fifo(sdd);
+}
+
+static int __init s3c64xx_spi_probe(struct platform_device *pdev)
+{
+	struct resource	*mem_res, *dmatx_res, *dmarx_res;
+	struct s3c64xx_spi_driver_data *sdd;
+	struct s3c64xx_spi_cntrlr_info *sci;
+	struct spi_master *master;
+	int ret;
+
+	if (pdev->id < 0) {
+		dev_err(&pdev->dev,
+				"Invalid platform device id-%d\n", pdev->id);
+		return -ENODEV;
+	}
+
+	if (pdev->dev.platform_data == NULL) {
+		dev_err(&pdev->dev, "platform_data missing!\n");
+		return -ENODEV;
+	}
+
+	/* Check for availability of necessary resource */
+
+	dmatx_res = platform_get_resource(pdev, IORESOURCE_DMA, 0);
+	if (dmatx_res == NULL) {
+		dev_err(&pdev->dev, "Unable to get SPI-Tx dma resource\n");
+		return -ENXIO;
+	}
+
+	dmarx_res = platform_get_resource(pdev, IORESOURCE_DMA, 1);
+	if (dmarx_res == NULL) {
+		dev_err(&pdev->dev, "Unable to get SPI-Rx dma resource\n");
+		return -ENXIO;
+	}
+
+	mem_res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	if (mem_res == NULL) {
+		dev_err(&pdev->dev, "Unable to get SPI MEM resource\n");
+		return -ENXIO;
+	}
+
+	master = spi_alloc_master(&pdev->dev,
+				sizeof(struct s3c64xx_spi_driver_data));
+	if (master == NULL) {
+		dev_err(&pdev->dev, "Unable to allocate SPI Master\n");
+		return -ENOMEM;
+	}
+
+	sci = pdev->dev.platform_data;
+
+	platform_set_drvdata(pdev, master);
+
+	sdd = spi_master_get_devdata(master);
+	sdd->master = master;
+	sdd->cntrlr_info = sci;
+	sdd->pdev = pdev;
+	sdd->sfr_start = mem_res->start;
+	sdd->tx_dmach = dmatx_res->start;
+	sdd->rx_dmach = dmarx_res->start;
+
+	sdd->cur_bpw = 8;
+
+	master->bus_num = pdev->id;
+	master->setup = s3c64xx_spi_setup;
+	master->transfer = s3c64xx_spi_transfer;
+	master->num_chipselect = sci->num_cs;
+	master->dma_alignment = 8;
+	/* the spi->mode bits understood by this driver: */
+	master->mode_bits = SPI_CPOL | SPI_CPHA | SPI_CS_HIGH;
+
+	if (request_mem_region(mem_res->start,
+			resource_size(mem_res), pdev->name) == NULL) {
+		dev_err(&pdev->dev, "Req mem region failed\n");
+		ret = -ENXIO;
+		goto err0;
+	}
+
+	sdd->regs = ioremap(mem_res->start, resource_size(mem_res));
+	if (sdd->regs == NULL) {
+		dev_err(&pdev->dev, "Unable to remap IO\n");
+		ret = -ENXIO;
+		goto err1;
+	}
+
+	if (sci->cfg_gpio == NULL || sci->cfg_gpio(pdev)) {
+		dev_err(&pdev->dev, "Unable to config gpio\n");
+		ret = -EBUSY;
+		goto err2;
+	}
+
+	/* Setup clocks */
+	sdd->clk = clk_get(&pdev->dev, "spi");
+	if (IS_ERR(sdd->clk)) {
+		dev_err(&pdev->dev, "Unable to acquire clock 'spi'\n");
+		ret = PTR_ERR(sdd->clk);
+		goto err3;
+	}
+
+	if (clk_enable(sdd->clk)) {
+		dev_err(&pdev->dev, "Couldn't enable clock 'spi'\n");
+		ret = -EBUSY;
+		goto err4;
+	}
+
+	if (sci->src_clk_nr == S3C64XX_SPI_SRCCLK_PCLK)
+		sci->src_clk = sdd->clk;
+	else
+		sci->src_clk = clk_get(&pdev->dev, sci->src_clk_name);
+	if (IS_ERR(sci->src_clk)) {
+		dev_err(&pdev->dev,
+			"Unable to acquire clock '%s'\n", sci->src_clk_name);
+		ret = PTR_ERR(sci->src_clk);
+		goto err5;
+	}
+
+	if (sci->src_clk != sdd->clk && clk_enable(sci->src_clk)) {
+		dev_err(&pdev->dev, "Couldn't enable clock '%s'\n",
+							sci->src_clk_name);
+		ret = -EBUSY;
+		goto err6;
+	}
+
+	sdd->workqueue = create_singlethread_workqueue(
+						dev_name(master->dev.parent));
+	if (sdd->workqueue == NULL) {
+		dev_err(&pdev->dev, "Unable to create workqueue\n");
+		ret = -ENOMEM;
+		goto err7;
+	}
+
+	/* Setup Deufult Mode */
+	s3c64xx_spi_hwinit(sdd, pdev->id);
+
+	spin_lock_init(&sdd->lock);
+	init_completion(&sdd->xfer_completion);
+	INIT_WORK(&sdd->work, s3c64xx_spi_work);
+	INIT_LIST_HEAD(&sdd->queue);
+
+	if (spi_register_master(master)) {
+		dev_err(&pdev->dev, "cannot register SPI master\n");
+		ret = -EBUSY;
+		goto err8;
+	}
+
+	dev_dbg(&pdev->dev, "Samsung SoC SPI Driver loaded for Bus SPI-%d \
+					with %d Slaves attached\n",
+					pdev->id, master->num_chipselect);
+	dev_dbg(&pdev->dev, "\tIOmem=[0x%x-0x%x]\
+					\tDMA=[Rx-%d, Tx-%d]\n",
+					mem_res->end, mem_res->start,
+					sdd->rx_dmach, sdd->tx_dmach);
+
+	return 0;
+
+err8:
+	destroy_workqueue(sdd->workqueue);
+err7:
+	if (sci->src_clk != sdd->clk)
+		clk_disable(sci->src_clk);
+err6:
+	if (sci->src_clk != sdd->clk)
+		clk_put(sci->src_clk);
+err5:
+	clk_disable(sdd->clk);
+err4:
+	clk_put(sdd->clk);
+err3:
+err2:
+	iounmap((void *) sdd->regs);
+err1:
+	release_mem_region(mem_res->start, resource_size(mem_res));
+err0:
+	platform_set_drvdata(pdev, NULL);
+	spi_master_put(master);
+
+	return ret;
+}
+
+static int s3c64xx_spi_remove(struct platform_device *pdev)
+{
+	struct spi_master *master = spi_master_get(platform_get_drvdata(pdev));
+	struct s3c64xx_spi_driver_data *sdd = spi_master_get_devdata(master);
+	struct s3c64xx_spi_cntrlr_info *sci = sdd->cntrlr_info;
+	struct resource	*mem_res;
+	unsigned long flags;
+
+	spin_lock_irqsave(&sdd->lock, flags);
+	sdd->state |= SUSPND;
+	spin_unlock_irqrestore(&sdd->lock, flags);
+
+	while (sdd->state & SPIBUSY)
+		msleep(10);
+
+	spi_unregister_master(master);
+
+	destroy_workqueue(sdd->workqueue);
+
+	if (sci->src_clk != sdd->clk)
+		clk_disable(sci->src_clk);
+
+	if (sci->src_clk != sdd->clk)
+		clk_put(sci->src_clk);
+
+	clk_disable(sdd->clk);
+	clk_put(sdd->clk);
+
+	iounmap((void *) sdd->regs);
+
+	mem_res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	release_mem_region(mem_res->start, resource_size(mem_res));
+
+	platform_set_drvdata(pdev, NULL);
+	spi_master_put(master);
+
+	return 0;
+}
+
+#ifdef CONFIG_PM
+static int s3c64xx_spi_suspend(struct platform_device *pdev, pm_message_t state)
+{
+	struct spi_master *master = spi_master_get(platform_get_drvdata(pdev));
+	struct s3c64xx_spi_driver_data *sdd = spi_master_get_devdata(master);
+	struct s3c64xx_spi_cntrlr_info *sci = sdd->cntrlr_info;
+	struct s3c64xx_spi_csinfo *cs;
+	unsigned long flags;
+
+	spin_lock_irqsave(&sdd->lock, flags);
+	sdd->state |= SUSPND;
+	spin_unlock_irqrestore(&sdd->lock, flags);
+
+	while (sdd->state & SPIBUSY)
+		msleep(10);
+
+	/* Disable the clock */
+	if (sci->src_clk != sdd->clk)
+		clk_disable(sci->src_clk);
+
+	clk_disable(sdd->clk);
+
+	sdd->cur_speed = 0; /* Output Clock is stopped */
+
+	return 0;
+}
+
+static int s3c64xx_spi_resume(struct platform_device *pdev)
+{
+	struct spi_master *master = spi_master_get(platform_get_drvdata(pdev));
+	struct s3c64xx_spi_driver_data *sdd = spi_master_get_devdata(master);
+	struct s3c64xx_spi_cntrlr_info *sci = sdd->cntrlr_info;
+	unsigned long flags;
+
+	sci->cfg_gpio(pdev);
+
+	/* Enable the clock */
+	if (sci->src_clk != sdd->clk)
+		clk_enable(sci->src_clk);
+
+	clk_enable(sdd->clk);
+
+	s3c64xx_spi_hwinit(sdd, pdev->id);
+
+	spin_lock_irqsave(&sdd->lock, flags);
+	sdd->state &= ~SUSPND;
+	spin_unlock_irqrestore(&sdd->lock, flags);
+
+	return 0;
+}
+#else
+#define s3c64xx_spi_suspend	NULL
+#define s3c64xx_spi_resume	NULL
+#endif /* CONFIG_PM */
+
+static struct platform_driver s3c64xx_spi_driver = {
+	.driver = {
+		.name	= "s3c64xx-spi",
+		.owner = THIS_MODULE,
+	},
+	.remove = s3c64xx_spi_remove,
+	.suspend = s3c64xx_spi_suspend,
+	.resume = s3c64xx_spi_resume,
+};
+MODULE_ALIAS("platform:s3c64xx-spi");
+
+static int __init s3c64xx_spi_init(void)
+{
+	return platform_driver_probe(&s3c64xx_spi_driver, s3c64xx_spi_probe);
+}
+module_init(s3c64xx_spi_init);
+
+static void __exit s3c64xx_spi_exit(void)
+{
+	platform_driver_unregister(&s3c64xx_spi_driver);
+}
+module_exit(s3c64xx_spi_exit);
+
+MODULE_AUTHOR("Jaswinder Singh <jassi.brar@samsung.com>");
+MODULE_DESCRIPTION("S3C64XX SPI Controller Driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/spi/spi_sh_msiof.c b/drivers/spi/spi_sh_msiof.c
new file mode 100644
index 000000000000..51e5e1dfa6e5
--- /dev/null
+++ b/drivers/spi/spi_sh_msiof.c
@@ -0,0 +1,691 @@
+/*
+ * SuperH MSIOF SPI Master Interface
+ *
+ * Copyright (c) 2009 Magnus Damm
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/delay.h>
+#include <linux/interrupt.h>
+#include <linux/platform_device.h>
+#include <linux/completion.h>
+#include <linux/pm_runtime.h>
+#include <linux/gpio.h>
+#include <linux/bitmap.h>
+#include <linux/clk.h>
+#include <linux/io.h>
+
+#include <linux/spi/spi.h>
+#include <linux/spi/spi_bitbang.h>
+#include <linux/spi/sh_msiof.h>
+
+#include <asm/spi.h>
+#include <asm/unaligned.h>
+
+struct sh_msiof_spi_priv {
+	struct spi_bitbang bitbang; /* must be first for spi_bitbang.c */
+	void __iomem *mapbase;
+	struct clk *clk;
+	struct platform_device *pdev;
+	struct sh_msiof_spi_info *info;
+	struct completion done;
+	unsigned long flags;
+	int tx_fifo_size;
+	int rx_fifo_size;
+};
+
+#define TMDR1	0x00
+#define TMDR2	0x04
+#define TMDR3	0x08
+#define RMDR1	0x10
+#define RMDR2	0x14
+#define RMDR3	0x18
+#define TSCR	0x20
+#define RSCR	0x22
+#define CTR	0x28
+#define FCTR	0x30
+#define STR	0x40
+#define IER	0x44
+#define TDR1	0x48
+#define TDR2	0x4c
+#define TFDR	0x50
+#define RDR1	0x58
+#define RDR2	0x5c
+#define RFDR	0x60
+
+#define CTR_TSCKE (1 << 15)
+#define CTR_TFSE  (1 << 14)
+#define CTR_TXE   (1 << 9)
+#define CTR_RXE   (1 << 8)
+
+#define STR_TEOF  (1 << 23)
+#define STR_REOF  (1 << 7)
+
+static unsigned long sh_msiof_read(struct sh_msiof_spi_priv *p, int reg_offs)
+{
+	switch (reg_offs) {
+	case TSCR:
+	case RSCR:
+		return ioread16(p->mapbase + reg_offs);
+	default:
+		return ioread32(p->mapbase + reg_offs);
+	}
+}
+
+static void sh_msiof_write(struct sh_msiof_spi_priv *p, int reg_offs,
+			   unsigned long value)
+{
+	switch (reg_offs) {
+	case TSCR:
+	case RSCR:
+		iowrite16(value, p->mapbase + reg_offs);
+		break;
+	default:
+		iowrite32(value, p->mapbase + reg_offs);
+		break;
+	}
+}
+
+static int sh_msiof_modify_ctr_wait(struct sh_msiof_spi_priv *p,
+				    unsigned long clr, unsigned long set)
+{
+	unsigned long mask = clr | set;
+	unsigned long data;
+	int k;
+
+	data = sh_msiof_read(p, CTR);
+	data &= ~clr;
+	data |= set;
+	sh_msiof_write(p, CTR, data);
+
+	for (k = 100; k > 0; k--) {
+		if ((sh_msiof_read(p, CTR) & mask) == set)
+			break;
+
+		udelay(10);
+	}
+
+	return k > 0 ? 0 : -ETIMEDOUT;
+}
+
+static irqreturn_t sh_msiof_spi_irq(int irq, void *data)
+{
+	struct sh_msiof_spi_priv *p = data;
+
+	/* just disable the interrupt and wake up */
+	sh_msiof_write(p, IER, 0);
+	complete(&p->done);
+
+	return IRQ_HANDLED;
+}
+
+static struct {
+	unsigned short div;
+	unsigned short scr;
+} const sh_msiof_spi_clk_table[] = {
+	{ 1, 0x0007 },
+	{ 2, 0x0000 },
+	{ 4, 0x0001 },
+	{ 8, 0x0002 },
+	{ 16, 0x0003 },
+	{ 32, 0x0004 },
+	{ 64, 0x1f00 },
+	{ 128, 0x1f01 },
+	{ 256, 0x1f02 },
+	{ 512, 0x1f03 },
+	{ 1024, 0x1f04 },
+};
+
+static void sh_msiof_spi_set_clk_regs(struct sh_msiof_spi_priv *p,
+				      unsigned long parent_rate,
+				      unsigned long spi_hz)
+{
+	unsigned long div = 1024;
+	size_t k;
+
+	if (!WARN_ON(!spi_hz || !parent_rate))
+		div = parent_rate / spi_hz;
+
+	/* TODO: make more fine grained */
+
+	for (k = 0; k < ARRAY_SIZE(sh_msiof_spi_clk_table); k++) {
+		if (sh_msiof_spi_clk_table[k].div >= div)
+			break;
+	}
+
+	k = min_t(int, k, ARRAY_SIZE(sh_msiof_spi_clk_table) - 1);
+
+	sh_msiof_write(p, TSCR, sh_msiof_spi_clk_table[k].scr);
+	sh_msiof_write(p, RSCR, sh_msiof_spi_clk_table[k].scr);
+}
+
+static void sh_msiof_spi_set_pin_regs(struct sh_msiof_spi_priv *p,
+				      int cpol, int cpha,
+				      int tx_hi_z, int lsb_first)
+{
+	unsigned long tmp;
+	int edge;
+
+	/*
+	 * CPOL CPHA     TSCKIZ RSCKIZ TEDG REDG(!)
+	 *    0    0         10     10    1    0
+	 *    0    1         10     10    0    1
+	 *    1    0         11     11    0    1
+	 *    1    1         11     11    1    0
+	 *
+	 * (!) Note: REDG is inverted recommended data sheet setting
+	 */
+
+	sh_msiof_write(p, FCTR, 0);
+	sh_msiof_write(p, TMDR1, 0xe2000005 | (lsb_first << 24));
+	sh_msiof_write(p, RMDR1, 0x22000005 | (lsb_first << 24));
+
+	tmp = 0xa0000000;
+	tmp |= cpol << 30; /* TSCKIZ */
+	tmp |= cpol << 28; /* RSCKIZ */
+
+	edge = cpol ? cpha : !cpha;
+
+	tmp |= edge << 27; /* TEDG */
+	tmp |= !edge << 26; /* REDG */
+	tmp |= (tx_hi_z ? 2 : 0) << 22; /* TXDIZ */
+	sh_msiof_write(p, CTR, tmp);
+}
+
+static void sh_msiof_spi_set_mode_regs(struct sh_msiof_spi_priv *p,
+				       const void *tx_buf, void *rx_buf,
+				       int bits, int words)
+{
+	unsigned long dr2;
+
+	dr2 = ((bits - 1) << 24) | ((words - 1) << 16);
+
+	if (tx_buf)
+		sh_msiof_write(p, TMDR2, dr2);
+	else
+		sh_msiof_write(p, TMDR2, dr2 | 1);
+
+	if (rx_buf)
+		sh_msiof_write(p, RMDR2, dr2);
+
+	sh_msiof_write(p, IER, STR_TEOF | STR_REOF);
+}
+
+static void sh_msiof_reset_str(struct sh_msiof_spi_priv *p)
+{
+	sh_msiof_write(p, STR, sh_msiof_read(p, STR));
+}
+
+static void sh_msiof_spi_write_fifo_8(struct sh_msiof_spi_priv *p,
+				      const void *tx_buf, int words, int fs)
+{
+	const unsigned char *buf_8 = tx_buf;
+	int k;
+
+	for (k = 0; k < words; k++)
+		sh_msiof_write(p, TFDR, buf_8[k] << fs);
+}
+
+static void sh_msiof_spi_write_fifo_16(struct sh_msiof_spi_priv *p,
+				       const void *tx_buf, int words, int fs)
+{
+	const unsigned short *buf_16 = tx_buf;
+	int k;
+
+	for (k = 0; k < words; k++)
+		sh_msiof_write(p, TFDR, buf_16[k] << fs);
+}
+
+static void sh_msiof_spi_write_fifo_16u(struct sh_msiof_spi_priv *p,
+					const void *tx_buf, int words, int fs)
+{
+	const unsigned short *buf_16 = tx_buf;
+	int k;
+
+	for (k = 0; k < words; k++)
+		sh_msiof_write(p, TFDR, get_unaligned(&buf_16[k]) << fs);
+}
+
+static void sh_msiof_spi_write_fifo_32(struct sh_msiof_spi_priv *p,
+				       const void *tx_buf, int words, int fs)
+{
+	const unsigned int *buf_32 = tx_buf;
+	int k;
+
+	for (k = 0; k < words; k++)
+		sh_msiof_write(p, TFDR, buf_32[k] << fs);
+}
+
+static void sh_msiof_spi_write_fifo_32u(struct sh_msiof_spi_priv *p,
+					const void *tx_buf, int words, int fs)
+{
+	const unsigned int *buf_32 = tx_buf;
+	int k;
+
+	for (k = 0; k < words; k++)
+		sh_msiof_write(p, TFDR, get_unaligned(&buf_32[k]) << fs);
+}
+
+static void sh_msiof_spi_read_fifo_8(struct sh_msiof_spi_priv *p,
+				     void *rx_buf, int words, int fs)
+{
+	unsigned char *buf_8 = rx_buf;
+	int k;
+
+	for (k = 0; k < words; k++)
+		buf_8[k] = sh_msiof_read(p, RFDR) >> fs;
+}
+
+static void sh_msiof_spi_read_fifo_16(struct sh_msiof_spi_priv *p,
+				      void *rx_buf, int words, int fs)
+{
+	unsigned short *buf_16 = rx_buf;
+	int k;
+
+	for (k = 0; k < words; k++)
+		buf_16[k] = sh_msiof_read(p, RFDR) >> fs;
+}
+
+static void sh_msiof_spi_read_fifo_16u(struct sh_msiof_spi_priv *p,
+				       void *rx_buf, int words, int fs)
+{
+	unsigned short *buf_16 = rx_buf;
+	int k;
+
+	for (k = 0; k < words; k++)
+		put_unaligned(sh_msiof_read(p, RFDR) >> fs, &buf_16[k]);
+}
+
+static void sh_msiof_spi_read_fifo_32(struct sh_msiof_spi_priv *p,
+				      void *rx_buf, int words, int fs)
+{
+	unsigned int *buf_32 = rx_buf;
+	int k;
+
+	for (k = 0; k < words; k++)
+		buf_32[k] = sh_msiof_read(p, RFDR) >> fs;
+}
+
+static void sh_msiof_spi_read_fifo_32u(struct sh_msiof_spi_priv *p,
+				       void *rx_buf, int words, int fs)
+{
+	unsigned int *buf_32 = rx_buf;
+	int k;
+
+	for (k = 0; k < words; k++)
+		put_unaligned(sh_msiof_read(p, RFDR) >> fs, &buf_32[k]);
+}
+
+static int sh_msiof_spi_bits(struct spi_device *spi, struct spi_transfer *t)
+{
+	int bits;
+
+	bits = t ? t->bits_per_word : 0;
+	bits = bits ? bits : spi->bits_per_word;
+	return bits;
+}
+
+static unsigned long sh_msiof_spi_hz(struct spi_device *spi,
+				     struct spi_transfer *t)
+{
+	unsigned long hz;
+
+	hz = t ? t->speed_hz : 0;
+	hz = hz ? hz : spi->max_speed_hz;
+	return hz;
+}
+
+static int sh_msiof_spi_setup_transfer(struct spi_device *spi,
+				       struct spi_transfer *t)
+{
+	int bits;
+
+	/* noting to check hz values against since parent clock is disabled */
+
+	bits = sh_msiof_spi_bits(spi, t);
+	if (bits < 8)
+		return -EINVAL;
+	if (bits > 32)
+		return -EINVAL;
+
+	return spi_bitbang_setup_transfer(spi, t);
+}
+
+static void sh_msiof_spi_chipselect(struct spi_device *spi, int is_on)
+{
+	struct sh_msiof_spi_priv *p = spi_master_get_devdata(spi->master);
+	int value;
+
+	/* chip select is active low unless SPI_CS_HIGH is set */
+	if (spi->mode & SPI_CS_HIGH)
+		value = (is_on == BITBANG_CS_ACTIVE) ? 1 : 0;
+	else
+		value = (is_on == BITBANG_CS_ACTIVE) ? 0 : 1;
+
+	if (is_on == BITBANG_CS_ACTIVE) {
+		if (!test_and_set_bit(0, &p->flags)) {
+			pm_runtime_get_sync(&p->pdev->dev);
+			clk_enable(p->clk);
+		}
+
+		/* Configure pins before asserting CS */
+		sh_msiof_spi_set_pin_regs(p, !!(spi->mode & SPI_CPOL),
+					  !!(spi->mode & SPI_CPHA),
+					  !!(spi->mode & SPI_3WIRE),
+					  !!(spi->mode & SPI_LSB_FIRST));
+	}
+
+	/* use spi->controller data for CS (same strategy as spi_gpio) */
+	gpio_set_value((unsigned)spi->controller_data, value);
+
+	if (is_on == BITBANG_CS_INACTIVE) {
+		if (test_and_clear_bit(0, &p->flags)) {
+			clk_disable(p->clk);
+			pm_runtime_put(&p->pdev->dev);
+		}
+	}
+}
+
+static int sh_msiof_spi_txrx_once(struct sh_msiof_spi_priv *p,
+				  void (*tx_fifo)(struct sh_msiof_spi_priv *,
+						  const void *, int, int),
+				  void (*rx_fifo)(struct sh_msiof_spi_priv *,
+						  void *, int, int),
+				  const void *tx_buf, void *rx_buf,
+				  int words, int bits)
+{
+	int fifo_shift;
+	int ret;
+
+	/* limit maximum word transfer to rx/tx fifo size */
+	if (tx_buf)
+		words = min_t(int, words, p->tx_fifo_size);
+	if (rx_buf)
+		words = min_t(int, words, p->rx_fifo_size);
+
+	/* the fifo contents need shifting */
+	fifo_shift = 32 - bits;
+
+	/* setup msiof transfer mode registers */
+	sh_msiof_spi_set_mode_regs(p, tx_buf, rx_buf, bits, words);
+
+	/* write tx fifo */
+	if (tx_buf)
+		tx_fifo(p, tx_buf, words, fifo_shift);
+
+	/* setup clock and rx/tx signals */
+	ret = sh_msiof_modify_ctr_wait(p, 0, CTR_TSCKE);
+	if (rx_buf)
+		ret = ret ? ret : sh_msiof_modify_ctr_wait(p, 0, CTR_RXE);
+	ret = ret ? ret : sh_msiof_modify_ctr_wait(p, 0, CTR_TXE);
+
+	/* start by setting frame bit */
+	INIT_COMPLETION(p->done);
+	ret = ret ? ret : sh_msiof_modify_ctr_wait(p, 0, CTR_TFSE);
+	if (ret) {
+		dev_err(&p->pdev->dev, "failed to start hardware\n");
+		goto err;
+	}
+
+	/* wait for tx fifo to be emptied / rx fifo to be filled */
+	wait_for_completion(&p->done);
+
+	/* read rx fifo */
+	if (rx_buf)
+		rx_fifo(p, rx_buf, words, fifo_shift);
+
+	/* clear status bits */
+	sh_msiof_reset_str(p);
+
+	/* shut down frame, tx/tx and clock signals */
+	ret = sh_msiof_modify_ctr_wait(p, CTR_TFSE, 0);
+	ret = ret ? ret : sh_msiof_modify_ctr_wait(p, CTR_TXE, 0);
+	if (rx_buf)
+		ret = ret ? ret : sh_msiof_modify_ctr_wait(p, CTR_RXE, 0);
+	ret = ret ? ret : sh_msiof_modify_ctr_wait(p, CTR_TSCKE, 0);
+	if (ret) {
+		dev_err(&p->pdev->dev, "failed to shut down hardware\n");
+		goto err;
+	}
+
+	return words;
+
+ err:
+	sh_msiof_write(p, IER, 0);
+	return ret;
+}
+
+static int sh_msiof_spi_txrx(struct spi_device *spi, struct spi_transfer *t)
+{
+	struct sh_msiof_spi_priv *p = spi_master_get_devdata(spi->master);
+	void (*tx_fifo)(struct sh_msiof_spi_priv *, const void *, int, int);
+	void (*rx_fifo)(struct sh_msiof_spi_priv *, void *, int, int);
+	int bits;
+	int bytes_per_word;
+	int bytes_done;
+	int words;
+	int n;
+
+	bits = sh_msiof_spi_bits(spi, t);
+
+	/* setup bytes per word and fifo read/write functions */
+	if (bits <= 8) {
+		bytes_per_word = 1;
+		tx_fifo = sh_msiof_spi_write_fifo_8;
+		rx_fifo = sh_msiof_spi_read_fifo_8;
+	} else if (bits <= 16) {
+		bytes_per_word = 2;
+		if ((unsigned long)t->tx_buf & 0x01)
+			tx_fifo = sh_msiof_spi_write_fifo_16u;
+		else
+			tx_fifo = sh_msiof_spi_write_fifo_16;
+
+		if ((unsigned long)t->rx_buf & 0x01)
+			rx_fifo = sh_msiof_spi_read_fifo_16u;
+		else
+			rx_fifo = sh_msiof_spi_read_fifo_16;
+	} else {
+		bytes_per_word = 4;
+		if ((unsigned long)t->tx_buf & 0x03)
+			tx_fifo = sh_msiof_spi_write_fifo_32u;
+		else
+			tx_fifo = sh_msiof_spi_write_fifo_32;
+
+		if ((unsigned long)t->rx_buf & 0x03)
+			rx_fifo = sh_msiof_spi_read_fifo_32u;
+		else
+			rx_fifo = sh_msiof_spi_read_fifo_32;
+	}
+
+	/* setup clocks (clock already enabled in chipselect()) */
+	sh_msiof_spi_set_clk_regs(p, clk_get_rate(p->clk),
+				  sh_msiof_spi_hz(spi, t));
+
+	/* transfer in fifo sized chunks */
+	words = t->len / bytes_per_word;
+	bytes_done = 0;
+
+	while (bytes_done < t->len) {
+		n = sh_msiof_spi_txrx_once(p, tx_fifo, rx_fifo,
+					   t->tx_buf + bytes_done,
+					   t->rx_buf + bytes_done,
+					   words, bits);
+		if (n < 0)
+			break;
+
+		bytes_done += n * bytes_per_word;
+		words -= n;
+	}
+
+	return bytes_done;
+}
+
+static u32 sh_msiof_spi_txrx_word(struct spi_device *spi, unsigned nsecs,
+				  u32 word, u8 bits)
+{
+	BUG(); /* unused but needed by bitbang code */
+	return 0;
+}
+
+static int sh_msiof_spi_probe(struct platform_device *pdev)
+{
+	struct resource	*r;
+	struct spi_master *master;
+	struct sh_msiof_spi_priv *p;
+	char clk_name[16];
+	int i;
+	int ret;
+
+	master = spi_alloc_master(&pdev->dev, sizeof(struct sh_msiof_spi_priv));
+	if (master == NULL) {
+		dev_err(&pdev->dev, "failed to allocate spi master\n");
+		ret = -ENOMEM;
+		goto err0;
+	}
+
+	p = spi_master_get_devdata(master);
+
+	platform_set_drvdata(pdev, p);
+	p->info = pdev->dev.platform_data;
+	init_completion(&p->done);
+
+	snprintf(clk_name, sizeof(clk_name), "msiof%d", pdev->id);
+	p->clk = clk_get(&pdev->dev, clk_name);
+	if (IS_ERR(p->clk)) {
+		dev_err(&pdev->dev, "cannot get clock \"%s\"\n", clk_name);
+		ret = PTR_ERR(p->clk);
+		goto err1;
+	}
+
+	r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	i = platform_get_irq(pdev, 0);
+	if (!r || i < 0) {
+		dev_err(&pdev->dev, "cannot get platform resources\n");
+		ret = -ENOENT;
+		goto err2;
+	}
+	p->mapbase = ioremap_nocache(r->start, resource_size(r));
+	if (!p->mapbase) {
+		dev_err(&pdev->dev, "unable to ioremap\n");
+		ret = -ENXIO;
+		goto err2;
+	}
+
+	ret = request_irq(i, sh_msiof_spi_irq, IRQF_DISABLED,
+			  dev_name(&pdev->dev), p);
+	if (ret) {
+		dev_err(&pdev->dev, "unable to request irq\n");
+		goto err3;
+	}
+
+	p->pdev = pdev;
+	pm_runtime_enable(&pdev->dev);
+
+	/* The standard version of MSIOF use 64 word FIFOs */
+	p->tx_fifo_size = 64;
+	p->rx_fifo_size = 64;
+
+	/* Platform data may override FIFO sizes */
+	if (p->info->tx_fifo_override)
+		p->tx_fifo_size = p->info->tx_fifo_override;
+	if (p->info->rx_fifo_override)
+		p->rx_fifo_size = p->info->rx_fifo_override;
+
+	/* init master and bitbang code */
+	master->mode_bits = SPI_CPOL | SPI_CPHA | SPI_CS_HIGH;
+	master->mode_bits |= SPI_LSB_FIRST | SPI_3WIRE;
+	master->flags = 0;
+	master->bus_num = pdev->id;
+	master->num_chipselect = p->info->num_chipselect;
+	master->setup = spi_bitbang_setup;
+	master->cleanup = spi_bitbang_cleanup;
+
+	p->bitbang.master = master;
+	p->bitbang.chipselect = sh_msiof_spi_chipselect;
+	p->bitbang.setup_transfer = sh_msiof_spi_setup_transfer;
+	p->bitbang.txrx_bufs = sh_msiof_spi_txrx;
+	p->bitbang.txrx_word[SPI_MODE_0] = sh_msiof_spi_txrx_word;
+	p->bitbang.txrx_word[SPI_MODE_1] = sh_msiof_spi_txrx_word;
+	p->bitbang.txrx_word[SPI_MODE_2] = sh_msiof_spi_txrx_word;
+	p->bitbang.txrx_word[SPI_MODE_3] = sh_msiof_spi_txrx_word;
+
+	ret = spi_bitbang_start(&p->bitbang);
+	if (ret == 0)
+		return 0;
+
+	pm_runtime_disable(&pdev->dev);
+ err3:
+	iounmap(p->mapbase);
+ err2:
+	clk_put(p->clk);
+ err1:
+	spi_master_put(master);
+ err0:
+	return ret;
+}
+
+static int sh_msiof_spi_remove(struct platform_device *pdev)
+{
+	struct sh_msiof_spi_priv *p = platform_get_drvdata(pdev);
+	int ret;
+
+	ret = spi_bitbang_stop(&p->bitbang);
+	if (!ret) {
+		pm_runtime_disable(&pdev->dev);
+		free_irq(platform_get_irq(pdev, 0), sh_msiof_spi_irq);
+		iounmap(p->mapbase);
+		clk_put(p->clk);
+		spi_master_put(p->bitbang.master);
+	}
+	return ret;
+}
+
+static int sh_msiof_spi_runtime_nop(struct device *dev)
+{
+	/* Runtime PM callback shared between ->runtime_suspend()
+	 * and ->runtime_resume(). Simply returns success.
+	 *
+	 * This driver re-initializes all registers after
+	 * pm_runtime_get_sync() anyway so there is no need
+	 * to save and restore registers here.
+	 */
+	return 0;
+}
+
+static struct dev_pm_ops sh_msiof_spi_dev_pm_ops = {
+	.runtime_suspend = sh_msiof_spi_runtime_nop,
+	.runtime_resume = sh_msiof_spi_runtime_nop,
+};
+
+static struct platform_driver sh_msiof_spi_drv = {
+	.probe		= sh_msiof_spi_probe,
+	.remove		= sh_msiof_spi_remove,
+	.driver		= {
+		.name		= "spi_sh_msiof",
+		.owner		= THIS_MODULE,
+		.pm		= &sh_msiof_spi_dev_pm_ops,
+	},
+};
+
+static int __init sh_msiof_spi_init(void)
+{
+	return platform_driver_register(&sh_msiof_spi_drv);
+}
+module_init(sh_msiof_spi_init);
+
+static void __exit sh_msiof_spi_exit(void)
+{
+	platform_driver_unregister(&sh_msiof_spi_drv);
+}
+module_exit(sh_msiof_spi_exit);
+
+MODULE_DESCRIPTION("SuperH MSIOF SPI Master Interface Driver");
+MODULE_AUTHOR("Magnus Damm");
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:spi_sh_msiof");
diff --git a/drivers/spi/spi_sh_sci.c b/drivers/spi/spi_sh_sci.c
index 7d36720eb982..a65c12ffa733 100644
--- a/drivers/spi/spi_sh_sci.c
+++ b/drivers/spi/spi_sh_sci.c
@@ -148,7 +148,7 @@ static int sh_sci_spi_probe(struct platform_device *dev)
 		ret = -ENOENT;
 		goto err1;
 	}
-	sp->membase = ioremap(r->start, r->end - r->start + 1);
+	sp->membase = ioremap(r->start, resource_size(r));
 	if (!sp->membase) {
 		ret = -ENXIO;
 		goto err1;
diff --git a/drivers/spi/spi_txx9.c b/drivers/spi/spi_txx9.c
index 19f75627c3de..dfa024b633e1 100644
--- a/drivers/spi/spi_txx9.c
+++ b/drivers/spi/spi_txx9.c
@@ -375,12 +375,10 @@ static int __init txx9spi_probe(struct platform_device *dev)
 	res = platform_get_resource(dev, IORESOURCE_MEM, 0);
 	if (!res)
 		goto exit_busy;
-	if (!devm_request_mem_region(&dev->dev,
-				     res->start, res->end - res->start + 1,
+	if (!devm_request_mem_region(&dev->dev, res->start, resource_size(res),
 				     "spi_txx9"))
 		goto exit_busy;
-	c->membase = devm_ioremap(&dev->dev,
-				  res->start, res->end - res->start + 1);
+	c->membase = devm_ioremap(&dev->dev, res->start, resource_size(res));
 	if (!c->membase)
 		goto exit_busy;
 
diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c
index 5d23983f02fc..ea1bec3c9a13 100644
--- a/drivers/spi/spidev.c
+++ b/drivers/spi/spidev.c
@@ -30,7 +30,6 @@
 #include <linux/errno.h>
 #include <linux/mutex.h>
 #include <linux/slab.h>
-#include <linux/smp_lock.h>
 
 #include <linux/spi/spi.h>
 #include <linux/spi/spidev.h>
@@ -42,7 +41,7 @@
  * This supports acccess to SPI devices using normal userspace I/O calls.
  * Note that while traditional UNIX/POSIX I/O semantics are half duplex,
  * and often mask message boundaries, full SPI support requires full duplex
- * transfers.  There are several kinds of of internal message boundaries to
+ * transfers.  There are several kinds of internal message boundaries to
  * handle chipselect management and other protocol options.
  *
  * SPI has a character major number assigned.  We allocate minor numbers
@@ -54,7 +53,7 @@
 #define SPIDEV_MAJOR			153	/* assigned */
 #define N_SPI_MINORS			32	/* ... up to 256 */
 
-static unsigned long	minors[N_SPI_MINORS / BITS_PER_LONG];
+static DECLARE_BITMAP(minors, N_SPI_MINORS);
 
 
 /* Bit masks for spi_device.mode management.  Note that incorrect
@@ -267,15 +266,15 @@ static int spidev_message(struct spidev_data *spidev,
 		k_tmp->delay_usecs = u_tmp->delay_usecs;
 		k_tmp->speed_hz = u_tmp->speed_hz;
 #ifdef VERBOSE
-		dev_dbg(&spi->dev,
+		dev_dbg(&spidev->spi->dev,
 			"  xfer len %zd %s%s%s%dbits %u usec %uHz\n",
 			u_tmp->len,
 			u_tmp->rx_buf ? "rx " : "",
 			u_tmp->tx_buf ? "tx " : "",
 			u_tmp->cs_change ? "cs " : "",
-			u_tmp->bits_per_word ? : spi->bits_per_word,
+			u_tmp->bits_per_word ? : spidev->spi->bits_per_word,
 			u_tmp->delay_usecs,
-			u_tmp->speed_hz ? : spi->max_speed_hz);
+			u_tmp->speed_hz ? : spidev->spi->max_speed_hz);
 #endif
 		spi_message_add_tail(k_tmp, &msg);
 	}
@@ -477,7 +476,6 @@ static int spidev_open(struct inode *inode, struct file *filp)
 	struct spidev_data	*spidev;
 	int			status = -ENXIO;
 
-	lock_kernel();
 	mutex_lock(&device_list_lock);
 
 	list_for_each_entry(spidev, &device_list, device_entry) {
@@ -503,7 +501,6 @@ static int spidev_open(struct inode *inode, struct file *filp)
 		pr_debug("spidev: nothing for minor %d\n", iminor(inode));
 
 	mutex_unlock(&device_list_lock);
-	unlock_kernel();
 	return status;
 }
 
@@ -561,7 +558,7 @@ static struct class *spidev_class;
 
 /*-------------------------------------------------------------------------*/
 
-static int spidev_probe(struct spi_device *spi)
+static int __devinit spidev_probe(struct spi_device *spi)
 {
 	struct spidev_data	*spidev;
 	int			status;
@@ -610,7 +607,7 @@ static int spidev_probe(struct spi_device *spi)
 	return status;
 }
 
-static int spidev_remove(struct spi_device *spi)
+static int __devexit spidev_remove(struct spi_device *spi)
 {
 	struct spidev_data	*spidev = spi_get_drvdata(spi);
 
@@ -632,7 +629,7 @@ static int spidev_remove(struct spi_device *spi)
 	return 0;
 }
 
-static struct spi_driver spidev_spi = {
+static struct spi_driver spidev_spi_driver = {
 	.driver = {
 		.name =		"spidev",
 		.owner =	THIS_MODULE,
@@ -664,14 +661,14 @@ static int __init spidev_init(void)
 
 	spidev_class = class_create(THIS_MODULE, "spidev");
 	if (IS_ERR(spidev_class)) {
-		unregister_chrdev(SPIDEV_MAJOR, spidev_spi.driver.name);
+		unregister_chrdev(SPIDEV_MAJOR, spidev_spi_driver.driver.name);
 		return PTR_ERR(spidev_class);
 	}
 
-	status = spi_register_driver(&spidev_spi);
+	status = spi_register_driver(&spidev_spi_driver);
 	if (status < 0) {
 		class_destroy(spidev_class);
-		unregister_chrdev(SPIDEV_MAJOR, spidev_spi.driver.name);
+		unregister_chrdev(SPIDEV_MAJOR, spidev_spi_driver.driver.name);
 	}
 	return status;
 }
@@ -679,9 +676,9 @@ module_init(spidev_init);
 
 static void __exit spidev_exit(void)
 {
-	spi_unregister_driver(&spidev_spi);
+	spi_unregister_driver(&spidev_spi_driver);
 	class_destroy(spidev_class);
-	unregister_chrdev(SPIDEV_MAJOR, spidev_spi.driver.name);
+	unregister_chrdev(SPIDEV_MAJOR, spidev_spi_driver.driver.name);
 }
 module_exit(spidev_exit);
 
diff --git a/drivers/spi/xilinx_spi.c b/drivers/spi/xilinx_spi.c
index 46b8c5c2f45e..9f386379c169 100644
--- a/drivers/spi/xilinx_spi.c
+++ b/drivers/spi/xilinx_spi.c
@@ -14,22 +14,20 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/interrupt.h>
-#include <linux/platform_device.h>
-
-#include <linux/of_platform.h>
-#include <linux/of_device.h>
-#include <linux/of_spi.h>
 
 #include <linux/spi/spi.h>
 #include <linux/spi/spi_bitbang.h>
 #include <linux/io.h>
 
+#include "xilinx_spi.h"
+#include <linux/spi/xilinx_spi.h>
+
 #define XILINX_SPI_NAME "xilinx_spi"
 
 /* Register definitions as per "OPB Serial Peripheral Interface (SPI) (v1.00e)
  * Product Specification", DS464
  */
-#define XSPI_CR_OFFSET		0x62	/* 16-bit Control Register */
+#define XSPI_CR_OFFSET		0x60	/* Control Register */
 
 #define XSPI_CR_ENABLE		0x02
 #define XSPI_CR_MASTER_MODE	0x04
@@ -40,8 +38,9 @@
 #define XSPI_CR_RXFIFO_RESET	0x40
 #define XSPI_CR_MANUAL_SSELECT	0x80
 #define XSPI_CR_TRANS_INHIBIT	0x100
+#define XSPI_CR_LSB_FIRST	0x200
 
-#define XSPI_SR_OFFSET		0x67	/* 8-bit Status Register */
+#define XSPI_SR_OFFSET		0x64	/* Status Register */
 
 #define XSPI_SR_RX_EMPTY_MASK	0x01	/* Receive FIFO is empty */
 #define XSPI_SR_RX_FULL_MASK	0x02	/* Receive FIFO is full */
@@ -49,8 +48,8 @@
 #define XSPI_SR_TX_FULL_MASK	0x08	/* Transmit FIFO is full */
 #define XSPI_SR_MODE_FAULT_MASK	0x10	/* Mode fault error */
 
-#define XSPI_TXD_OFFSET		0x6b	/* 8-bit Data Transmit Register */
-#define XSPI_RXD_OFFSET		0x6f	/* 8-bit Data Receive Register */
+#define XSPI_TXD_OFFSET		0x68	/* Data Transmit Register */
+#define XSPI_RXD_OFFSET		0x6c	/* Data Receive Register */
 
 #define XSPI_SSR_OFFSET		0x70	/* 32-bit Slave Select Register */
 
@@ -70,6 +69,7 @@
 #define XSPI_INTR_TX_UNDERRUN		0x08	/* TxFIFO was underrun */
 #define XSPI_INTR_RX_FULL		0x10	/* RxFIFO is full */
 #define XSPI_INTR_RX_OVERRUN		0x20	/* RxFIFO was overrun */
+#define XSPI_INTR_TX_HALF_EMPTY		0x40	/* TxFIFO is half empty */
 
 #define XIPIF_V123B_RESETR_OFFSET	0x40	/* IPIF reset register */
 #define XIPIF_V123B_RESET_MASK		0x0a	/* the value to write */
@@ -78,35 +78,85 @@ struct xilinx_spi {
 	/* bitbang has to be first */
 	struct spi_bitbang bitbang;
 	struct completion done;
-
+	struct resource mem; /* phys mem */
 	void __iomem	*regs;	/* virt. address of the control registers */
 
 	u32		irq;
 
-	u32		speed_hz; /* SCK has a fixed frequency of speed_hz Hz */
-
 	u8 *rx_ptr;		/* pointer in the Tx buffer */
 	const u8 *tx_ptr;	/* pointer in the Rx buffer */
 	int remaining_bytes;	/* the number of bytes left to transfer */
+	u8 bits_per_word;
+	unsigned int (*read_fn) (void __iomem *);
+	void (*write_fn) (u32, void __iomem *);
+	void (*tx_fn) (struct xilinx_spi *);
+	void (*rx_fn) (struct xilinx_spi *);
 };
 
-static void xspi_init_hw(void __iomem *regs_base)
+static void xspi_tx8(struct xilinx_spi *xspi)
+{
+	xspi->write_fn(*xspi->tx_ptr, xspi->regs + XSPI_TXD_OFFSET);
+	xspi->tx_ptr++;
+}
+
+static void xspi_tx16(struct xilinx_spi *xspi)
+{
+	xspi->write_fn(*(u16 *)(xspi->tx_ptr), xspi->regs + XSPI_TXD_OFFSET);
+	xspi->tx_ptr += 2;
+}
+
+static void xspi_tx32(struct xilinx_spi *xspi)
+{
+	xspi->write_fn(*(u32 *)(xspi->tx_ptr), xspi->regs + XSPI_TXD_OFFSET);
+	xspi->tx_ptr += 4;
+}
+
+static void xspi_rx8(struct xilinx_spi *xspi)
+{
+	u32 data = xspi->read_fn(xspi->regs + XSPI_RXD_OFFSET);
+	if (xspi->rx_ptr) {
+		*xspi->rx_ptr = data & 0xff;
+		xspi->rx_ptr++;
+	}
+}
+
+static void xspi_rx16(struct xilinx_spi *xspi)
 {
+	u32 data = xspi->read_fn(xspi->regs + XSPI_RXD_OFFSET);
+	if (xspi->rx_ptr) {
+		*(u16 *)(xspi->rx_ptr) = data & 0xffff;
+		xspi->rx_ptr += 2;
+	}
+}
+
+static void xspi_rx32(struct xilinx_spi *xspi)
+{
+	u32 data = xspi->read_fn(xspi->regs + XSPI_RXD_OFFSET);
+	if (xspi->rx_ptr) {
+		*(u32 *)(xspi->rx_ptr) = data;
+		xspi->rx_ptr += 4;
+	}
+}
+
+static void xspi_init_hw(struct xilinx_spi *xspi)
+{
+	void __iomem *regs_base = xspi->regs;
+
 	/* Reset the SPI device */
-	out_be32(regs_base + XIPIF_V123B_RESETR_OFFSET,
-		 XIPIF_V123B_RESET_MASK);
+	xspi->write_fn(XIPIF_V123B_RESET_MASK,
+		regs_base + XIPIF_V123B_RESETR_OFFSET);
 	/* Disable all the interrupts just in case */
-	out_be32(regs_base + XIPIF_V123B_IIER_OFFSET, 0);
+	xspi->write_fn(0, regs_base + XIPIF_V123B_IIER_OFFSET);
 	/* Enable the global IPIF interrupt */
-	out_be32(regs_base + XIPIF_V123B_DGIER_OFFSET,
-		 XIPIF_V123B_GINTR_ENABLE);
+	xspi->write_fn(XIPIF_V123B_GINTR_ENABLE,
+		regs_base + XIPIF_V123B_DGIER_OFFSET);
 	/* Deselect the slave on the SPI bus */
-	out_be32(regs_base + XSPI_SSR_OFFSET, 0xffff);
+	xspi->write_fn(0xffff, regs_base + XSPI_SSR_OFFSET);
 	/* Disable the transmitter, enable Manual Slave Select Assertion,
 	 * put SPI controller into master mode, and enable it */
-	out_be16(regs_base + XSPI_CR_OFFSET,
-		 XSPI_CR_TRANS_INHIBIT | XSPI_CR_MANUAL_SSELECT
-		 | XSPI_CR_MASTER_MODE | XSPI_CR_ENABLE);
+	xspi->write_fn(XSPI_CR_TRANS_INHIBIT | XSPI_CR_MANUAL_SSELECT |
+		XSPI_CR_MASTER_MODE | XSPI_CR_ENABLE | XSPI_CR_TXFIFO_RESET |
+		XSPI_CR_RXFIFO_RESET, regs_base + XSPI_CR_OFFSET);
 }
 
 static void xilinx_spi_chipselect(struct spi_device *spi, int is_on)
@@ -115,16 +165,16 @@ static void xilinx_spi_chipselect(struct spi_device *spi, int is_on)
 
 	if (is_on == BITBANG_CS_INACTIVE) {
 		/* Deselect the slave on the SPI bus */
-		out_be32(xspi->regs + XSPI_SSR_OFFSET, 0xffff);
+		xspi->write_fn(0xffff, xspi->regs + XSPI_SSR_OFFSET);
 	} else if (is_on == BITBANG_CS_ACTIVE) {
 		/* Set the SPI clock phase and polarity */
-		u16 cr = in_be16(xspi->regs + XSPI_CR_OFFSET)
+		u16 cr = xspi->read_fn(xspi->regs + XSPI_CR_OFFSET)
 			 & ~XSPI_CR_MODE_MASK;
 		if (spi->mode & SPI_CPHA)
 			cr |= XSPI_CR_CPHA;
 		if (spi->mode & SPI_CPOL)
 			cr |= XSPI_CR_CPOL;
-		out_be16(xspi->regs + XSPI_CR_OFFSET, cr);
+		xspi->write_fn(cr, xspi->regs + XSPI_CR_OFFSET);
 
 		/* We do not check spi->max_speed_hz here as the SPI clock
 		 * frequency is not software programmable (the IP block design
@@ -132,24 +182,27 @@ static void xilinx_spi_chipselect(struct spi_device *spi, int is_on)
 		 */
 
 		/* Activate the chip select */
-		out_be32(xspi->regs + XSPI_SSR_OFFSET,
-			 ~(0x0001 << spi->chip_select));
+		xspi->write_fn(~(0x0001 << spi->chip_select),
+			xspi->regs + XSPI_SSR_OFFSET);
 	}
 }
 
 /* spi_bitbang requires custom setup_transfer() to be defined if there is a
  * custom txrx_bufs(). We have nothing to setup here as the SPI IP block
- * supports just 8 bits per word, and SPI clock can't be changed in software.
- * Check for 8 bits per word. Chip select delay calculations could be
+ * supports 8 or 16 bits per word which cannot be changed in software.
+ * SPI clock can't be changed in software either.
+ * Check for correct bits per word. Chip select delay calculations could be
  * added here as soon as bitbang_work() can be made aware of the delay value.
  */
 static int xilinx_spi_setup_transfer(struct spi_device *spi,
 		struct spi_transfer *t)
 {
+	struct xilinx_spi *xspi = spi_master_get_devdata(spi->master);
 	u8 bits_per_word;
 
-	bits_per_word = (t) ? t->bits_per_word : spi->bits_per_word;
-	if (bits_per_word != 8) {
+	bits_per_word = (t && t->bits_per_word)
+			 ? t->bits_per_word : spi->bits_per_word;
+	if (bits_per_word != xspi->bits_per_word) {
 		dev_err(&spi->dev, "%s, unsupported bits_per_word=%d\n",
 			__func__, bits_per_word);
 		return -EINVAL;
@@ -160,17 +213,16 @@ static int xilinx_spi_setup_transfer(struct spi_device *spi,
 
 static int xilinx_spi_setup(struct spi_device *spi)
 {
-	struct spi_bitbang *bitbang;
-	struct xilinx_spi *xspi;
-	int retval;
-
-	xspi = spi_master_get_devdata(spi->master);
-	bitbang = &xspi->bitbang;
-
-	retval = xilinx_spi_setup_transfer(spi, NULL);
-	if (retval < 0)
-		return retval;
-
+	/* always return 0, we can not check the number of bits.
+	 * There are cases when SPI setup is called before any driver is
+	 * there, in that case the SPI core defaults to 8 bits, which we
+	 * do not support in some cases. But if we return an error, the
+	 * SPI device would not be registered and no driver can get hold of it
+	 * When the driver is there, it will call SPI setup again with the
+	 * correct number of bits per transfer.
+	 * If a driver setups with the wrong bit number, it will fail when
+	 * it tries to do a transfer
+	 */
 	return 0;
 }
 
@@ -179,15 +231,14 @@ static void xilinx_spi_fill_tx_fifo(struct xilinx_spi *xspi)
 	u8 sr;
 
 	/* Fill the Tx FIFO with as many bytes as possible */
-	sr = in_8(xspi->regs + XSPI_SR_OFFSET);
+	sr = xspi->read_fn(xspi->regs + XSPI_SR_OFFSET);
 	while ((sr & XSPI_SR_TX_FULL_MASK) == 0 && xspi->remaining_bytes > 0) {
-		if (xspi->tx_ptr) {
-			out_8(xspi->regs + XSPI_TXD_OFFSET, *xspi->tx_ptr++);
-		} else {
-			out_8(xspi->regs + XSPI_TXD_OFFSET, 0);
-		}
-		xspi->remaining_bytes--;
-		sr = in_8(xspi->regs + XSPI_SR_OFFSET);
+		if (xspi->tx_ptr)
+			xspi->tx_fn(xspi);
+		else
+			xspi->write_fn(0, xspi->regs + XSPI_TXD_OFFSET);
+		xspi->remaining_bytes -= xspi->bits_per_word / 8;
+		sr = xspi->read_fn(xspi->regs + XSPI_SR_OFFSET);
 	}
 }
 
@@ -209,18 +260,19 @@ static int xilinx_spi_txrx_bufs(struct spi_device *spi, struct spi_transfer *t)
 	/* Enable the transmit empty interrupt, which we use to determine
 	 * progress on the transmission.
 	 */
-	ipif_ier = in_be32(xspi->regs + XIPIF_V123B_IIER_OFFSET);
-	out_be32(xspi->regs + XIPIF_V123B_IIER_OFFSET,
-		 ipif_ier | XSPI_INTR_TX_EMPTY);
+	ipif_ier = xspi->read_fn(xspi->regs + XIPIF_V123B_IIER_OFFSET);
+	xspi->write_fn(ipif_ier | XSPI_INTR_TX_EMPTY,
+		xspi->regs + XIPIF_V123B_IIER_OFFSET);
 
 	/* Start the transfer by not inhibiting the transmitter any longer */
-	cr = in_be16(xspi->regs + XSPI_CR_OFFSET) & ~XSPI_CR_TRANS_INHIBIT;
-	out_be16(xspi->regs + XSPI_CR_OFFSET, cr);
+	cr = xspi->read_fn(xspi->regs + XSPI_CR_OFFSET) &
+		~XSPI_CR_TRANS_INHIBIT;
+	xspi->write_fn(cr, xspi->regs + XSPI_CR_OFFSET);
 
 	wait_for_completion(&xspi->done);
 
 	/* Disable the transmit empty interrupt */
-	out_be32(xspi->regs + XIPIF_V123B_IIER_OFFSET, ipif_ier);
+	xspi->write_fn(ipif_ier, xspi->regs + XIPIF_V123B_IIER_OFFSET);
 
 	return t->len - xspi->remaining_bytes;
 }
@@ -237,8 +289,8 @@ static irqreturn_t xilinx_spi_irq(int irq, void *dev_id)
 	u32 ipif_isr;
 
 	/* Get the IPIF interrupts, and clear them immediately */
-	ipif_isr = in_be32(xspi->regs + XIPIF_V123B_IISR_OFFSET);
-	out_be32(xspi->regs + XIPIF_V123B_IISR_OFFSET, ipif_isr);
+	ipif_isr = xspi->read_fn(xspi->regs + XIPIF_V123B_IISR_OFFSET);
+	xspi->write_fn(ipif_isr, xspi->regs + XIPIF_V123B_IISR_OFFSET);
 
 	if (ipif_isr & XSPI_INTR_TX_EMPTY) {	/* Transmission completed */
 		u16 cr;
@@ -249,20 +301,15 @@ static irqreturn_t xilinx_spi_irq(int irq, void *dev_id)
 		 * transmitter while the Isr refills the transmit register/FIFO,
 		 * or make sure it is stopped if we're done.
 		 */
-		cr = in_be16(xspi->regs + XSPI_CR_OFFSET);
-		out_be16(xspi->regs + XSPI_CR_OFFSET,
-			 cr | XSPI_CR_TRANS_INHIBIT);
+		cr = xspi->read_fn(xspi->regs + XSPI_CR_OFFSET);
+		xspi->write_fn(cr | XSPI_CR_TRANS_INHIBIT,
+			xspi->regs + XSPI_CR_OFFSET);
 
 		/* Read out all the data from the Rx FIFO */
-		sr = in_8(xspi->regs + XSPI_SR_OFFSET);
+		sr = xspi->read_fn(xspi->regs + XSPI_SR_OFFSET);
 		while ((sr & XSPI_SR_RX_EMPTY_MASK) == 0) {
-			u8 data;
-
-			data = in_8(xspi->regs + XSPI_RXD_OFFSET);
-			if (xspi->rx_ptr) {
-				*xspi->rx_ptr++ = data;
-			}
-			sr = in_8(xspi->regs + XSPI_SR_OFFSET);
+			xspi->rx_fn(xspi);
+			sr = xspi->read_fn(xspi->regs + XSPI_SR_OFFSET);
 		}
 
 		/* See if there is more data to send */
@@ -271,7 +318,7 @@ static irqreturn_t xilinx_spi_irq(int irq, void *dev_id)
 			/* Start the transfer by not inhibiting the
 			 * transmitter any longer
 			 */
-			out_be16(xspi->regs + XSPI_CR_OFFSET, cr);
+			xspi->write_fn(cr, xspi->regs + XSPI_CR_OFFSET);
 		} else {
 			/* No more data to send.
 			 * Indicate the transfer is completed.
@@ -283,40 +330,22 @@ static irqreturn_t xilinx_spi_irq(int irq, void *dev_id)
 	return IRQ_HANDLED;
 }
 
-static int __init xilinx_spi_of_probe(struct of_device *ofdev,
-					const struct of_device_id *match)
+struct spi_master *xilinx_spi_init(struct device *dev, struct resource *mem,
+	u32 irq, s16 bus_num)
 {
 	struct spi_master *master;
 	struct xilinx_spi *xspi;
-	struct resource r_irq_struct;
-	struct resource r_mem_struct;
-
-	struct resource *r_irq = &r_irq_struct;
-	struct resource *r_mem = &r_mem_struct;
-	int rc = 0;
-	const u32 *prop;
-	int len;
-
-	/* Get resources(memory, IRQ) associated with the device */
-	master = spi_alloc_master(&ofdev->dev, sizeof(struct xilinx_spi));
+	struct xspi_platform_data *pdata = dev->platform_data;
+	int ret;
 
-	if (master == NULL) {
-		return -ENOMEM;
+	if (!pdata) {
+		dev_err(dev, "No platform data attached\n");
+		return NULL;
 	}
 
-	dev_set_drvdata(&ofdev->dev, master);
-
-	rc = of_address_to_resource(ofdev->node, 0, r_mem);
-	if (rc) {
-		dev_warn(&ofdev->dev, "invalid address\n");
-		goto put_master;
-	}
-
-	rc = of_irq_to_resource(ofdev->node, 0, r_irq);
-	if (rc == NO_IRQ) {
-		dev_warn(&ofdev->dev, "no IRQ found\n");
-		goto put_master;
-	}
+	master = spi_alloc_master(dev, sizeof(struct xilinx_spi));
+	if (!master)
+		return NULL;
 
 	/* the spi->mode bits understood by this driver: */
 	master->mode_bits = SPI_CPOL | SPI_CPHA;
@@ -329,128 +358,87 @@ static int __init xilinx_spi_of_probe(struct of_device *ofdev,
 	xspi->bitbang.master->setup = xilinx_spi_setup;
 	init_completion(&xspi->done);
 
-	xspi->irq = r_irq->start;
-
-	if (!request_mem_region(r_mem->start,
-			r_mem->end - r_mem->start + 1, XILINX_SPI_NAME)) {
-		rc = -ENXIO;
-		dev_warn(&ofdev->dev, "memory request failure\n");
+	if (!request_mem_region(mem->start, resource_size(mem),
+		XILINX_SPI_NAME))
 		goto put_master;
-	}
 
-	xspi->regs = ioremap(r_mem->start, r_mem->end - r_mem->start + 1);
+	xspi->regs = ioremap(mem->start, resource_size(mem));
 	if (xspi->regs == NULL) {
-		rc = -ENOMEM;
-		dev_warn(&ofdev->dev, "ioremap failure\n");
-		goto release_mem;
+		dev_warn(dev, "ioremap failure\n");
+		goto map_failed;
 	}
-	xspi->irq = r_irq->start;
-
-	/* dynamic bus assignment */
-	master->bus_num = -1;
 
-	/* number of slave select bits is required */
-	prop = of_get_property(ofdev->node, "xlnx,num-ss-bits", &len);
-	if (!prop || len < sizeof(*prop)) {
-		dev_warn(&ofdev->dev, "no 'xlnx,num-ss-bits' property\n");
-		goto unmap_io;
+	master->bus_num = bus_num;
+	master->num_chipselect = pdata->num_chipselect;
+
+	xspi->mem = *mem;
+	xspi->irq = irq;
+	if (pdata->little_endian) {
+		xspi->read_fn = ioread32;
+		xspi->write_fn = iowrite32;
+	} else {
+		xspi->read_fn = ioread32be;
+		xspi->write_fn = iowrite32be;
 	}
-	master->num_chipselect = *prop;
+	xspi->bits_per_word = pdata->bits_per_word;
+	if (xspi->bits_per_word == 8) {
+		xspi->tx_fn = xspi_tx8;
+		xspi->rx_fn = xspi_rx8;
+	} else if (xspi->bits_per_word == 16) {
+		xspi->tx_fn = xspi_tx16;
+		xspi->rx_fn = xspi_rx16;
+	} else if (xspi->bits_per_word == 32) {
+		xspi->tx_fn = xspi_tx32;
+		xspi->rx_fn = xspi_rx32;
+	} else
+		goto unmap_io;
+
 
 	/* SPI controller initializations */
-	xspi_init_hw(xspi->regs);
+	xspi_init_hw(xspi);
 
 	/* Register for SPI Interrupt */
-	rc = request_irq(xspi->irq, xilinx_spi_irq, 0, XILINX_SPI_NAME, xspi);
-	if (rc != 0) {
-		dev_warn(&ofdev->dev, "irq request failure: %d\n", xspi->irq);
+	ret = request_irq(xspi->irq, xilinx_spi_irq, 0, XILINX_SPI_NAME, xspi);
+	if (ret)
 		goto unmap_io;
-	}
 
-	rc = spi_bitbang_start(&xspi->bitbang);
-	if (rc != 0) {
-		dev_err(&ofdev->dev, "spi_bitbang_start FAILED\n");
+	ret = spi_bitbang_start(&xspi->bitbang);
+	if (ret) {
+		dev_err(dev, "spi_bitbang_start FAILED\n");
 		goto free_irq;
 	}
 
-	dev_info(&ofdev->dev, "at 0x%08X mapped to 0x%08X, irq=%d\n",
-			(unsigned int)r_mem->start, (u32)xspi->regs, xspi->irq);
-
-	/* Add any subnodes on the SPI bus */
-	of_register_spi_devices(master, ofdev->node);
-
-	return rc;
+	dev_info(dev, "at 0x%08llX mapped to 0x%p, irq=%d\n",
+		(unsigned long long)mem->start, xspi->regs, xspi->irq);
+	return master;
 
 free_irq:
 	free_irq(xspi->irq, xspi);
 unmap_io:
 	iounmap(xspi->regs);
-release_mem:
-	release_mem_region(r_mem->start, resource_size(r_mem));
+map_failed:
+	release_mem_region(mem->start, resource_size(mem));
 put_master:
 	spi_master_put(master);
-	return rc;
+	return NULL;
 }
+EXPORT_SYMBOL(xilinx_spi_init);
 
-static int __devexit xilinx_spi_remove(struct of_device *ofdev)
+void xilinx_spi_deinit(struct spi_master *master)
 {
 	struct xilinx_spi *xspi;
-	struct spi_master *master;
-	struct resource r_mem;
 
-	master = platform_get_drvdata(ofdev);
 	xspi = spi_master_get_devdata(master);
 
 	spi_bitbang_stop(&xspi->bitbang);
 	free_irq(xspi->irq, xspi);
 	iounmap(xspi->regs);
-	if (!of_address_to_resource(ofdev->node, 0, &r_mem))
-		release_mem_region(r_mem.start, resource_size(&r_mem));
-	dev_set_drvdata(&ofdev->dev, 0);
-	spi_master_put(xspi->bitbang.master);
-
-	return 0;
-}
-
-/* work with hotplug and coldplug */
-MODULE_ALIAS("platform:" XILINX_SPI_NAME);
-
-static int __exit xilinx_spi_of_remove(struct of_device *op)
-{
-	return xilinx_spi_remove(op);
-}
 
-static struct of_device_id xilinx_spi_of_match[] = {
-	{ .compatible = "xlnx,xps-spi-2.00.a", },
-	{ .compatible = "xlnx,xps-spi-2.00.b", },
-	{}
-};
-
-MODULE_DEVICE_TABLE(of, xilinx_spi_of_match);
-
-static struct of_platform_driver xilinx_spi_of_driver = {
-	.owner = THIS_MODULE,
-	.name = "xilinx-xps-spi",
-	.match_table = xilinx_spi_of_match,
-	.probe = xilinx_spi_of_probe,
-	.remove = __exit_p(xilinx_spi_of_remove),
-	.driver = {
-		.name = "xilinx-xps-spi",
-		.owner = THIS_MODULE,
-	},
-};
-
-static int __init xilinx_spi_init(void)
-{
-	return of_register_platform_driver(&xilinx_spi_of_driver);
+	release_mem_region(xspi->mem.start, resource_size(&xspi->mem));
+	spi_master_put(xspi->bitbang.master);
 }
-module_init(xilinx_spi_init);
+EXPORT_SYMBOL(xilinx_spi_deinit);
 
-static void __exit xilinx_spi_exit(void)
-{
-	of_unregister_platform_driver(&xilinx_spi_of_driver);
-}
-module_exit(xilinx_spi_exit);
 MODULE_AUTHOR("MontaVista Software, Inc. <source@mvista.com>");
 MODULE_DESCRIPTION("Xilinx SPI driver");
 MODULE_LICENSE("GPL");
diff --git a/drivers/spi/xilinx_spi.h b/drivers/spi/xilinx_spi.h
new file mode 100644
index 000000000000..d211accf68d2
--- /dev/null
+++ b/drivers/spi/xilinx_spi.h
@@ -0,0 +1,32 @@
+/*
+ * Xilinx SPI device driver API and platform data header file
+ *
+ * Copyright (c) 2009 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#ifndef _XILINX_SPI_H_
+#define _XILINX_SPI_H_
+
+#include <linux/spi/spi.h>
+#include <linux/spi/spi_bitbang.h>
+
+#define XILINX_SPI_NAME "xilinx_spi"
+
+struct spi_master *xilinx_spi_init(struct device *dev, struct resource *mem,
+	u32 irq, s16 bus_num);
+
+void xilinx_spi_deinit(struct spi_master *master);
+#endif
diff --git a/drivers/spi/xilinx_spi_of.c b/drivers/spi/xilinx_spi_of.c
new file mode 100644
index 000000000000..71dc3adc0495
--- /dev/null
+++ b/drivers/spi/xilinx_spi_of.c
@@ -0,0 +1,134 @@
+/*
+ * Xilinx SPI OF device driver
+ *
+ * Copyright (c) 2009 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+/* Supports:
+ * Xilinx SPI devices as OF devices
+ *
+ * Inspired by xilinx_spi.c, 2002-2007 (c) MontaVista Software, Inc.
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/interrupt.h>
+#include <linux/io.h>
+
+#include <linux/of_platform.h>
+#include <linux/of_device.h>
+#include <linux/of_spi.h>
+
+#include <linux/spi/xilinx_spi.h>
+#include "xilinx_spi.h"
+
+
+static int __devinit xilinx_spi_of_probe(struct of_device *ofdev,
+	const struct of_device_id *match)
+{
+	struct spi_master *master;
+	struct xspi_platform_data *pdata;
+	struct resource r_mem;
+	struct resource r_irq;
+	int rc = 0;
+	const u32 *prop;
+	int len;
+
+	rc = of_address_to_resource(ofdev->node, 0, &r_mem);
+	if (rc) {
+		dev_warn(&ofdev->dev, "invalid address\n");
+		return rc;
+	}
+
+	rc = of_irq_to_resource(ofdev->node, 0, &r_irq);
+	if (rc == NO_IRQ) {
+		dev_warn(&ofdev->dev, "no IRQ found\n");
+		return -ENODEV;
+	}
+
+	ofdev->dev.platform_data =
+		kzalloc(sizeof(struct xspi_platform_data), GFP_KERNEL);
+	pdata = ofdev->dev.platform_data;
+	if (!pdata)
+		return -ENOMEM;
+
+	/* number of slave select bits is required */
+	prop = of_get_property(ofdev->node, "xlnx,num-ss-bits", &len);
+	if (!prop || len < sizeof(*prop)) {
+		dev_warn(&ofdev->dev, "no 'xlnx,num-ss-bits' property\n");
+		return -EINVAL;
+	}
+	pdata->num_chipselect = *prop;
+	pdata->bits_per_word = 8;
+	master = xilinx_spi_init(&ofdev->dev, &r_mem, r_irq.start, -1);
+	if (!master)
+		return -ENODEV;
+
+	dev_set_drvdata(&ofdev->dev, master);
+
+	/* Add any subnodes on the SPI bus */
+	of_register_spi_devices(master, ofdev->node);
+
+	return 0;
+}
+
+static int __devexit xilinx_spi_remove(struct of_device *ofdev)
+{
+	xilinx_spi_deinit(dev_get_drvdata(&ofdev->dev));
+	dev_set_drvdata(&ofdev->dev, 0);
+	kfree(ofdev->dev.platform_data);
+	ofdev->dev.platform_data = NULL;
+	return 0;
+}
+
+static int __exit xilinx_spi_of_remove(struct of_device *op)
+{
+	return xilinx_spi_remove(op);
+}
+
+static struct of_device_id xilinx_spi_of_match[] = {
+	{ .compatible = "xlnx,xps-spi-2.00.a", },
+	{ .compatible = "xlnx,xps-spi-2.00.b", },
+	{}
+};
+
+MODULE_DEVICE_TABLE(of, xilinx_spi_of_match);
+
+static struct of_platform_driver xilinx_spi_of_driver = {
+	.match_table = xilinx_spi_of_match,
+	.probe = xilinx_spi_of_probe,
+	.remove = __exit_p(xilinx_spi_of_remove),
+	.driver = {
+		.name = "xilinx-xps-spi",
+		.owner = THIS_MODULE,
+	},
+};
+
+static int __init xilinx_spi_of_init(void)
+{
+	return of_register_platform_driver(&xilinx_spi_of_driver);
+}
+module_init(xilinx_spi_of_init);
+
+static void __exit xilinx_spi_of_exit(void)
+{
+	of_unregister_platform_driver(&xilinx_spi_of_driver);
+}
+module_exit(xilinx_spi_of_exit);
+
+MODULE_AUTHOR("Mocean Laboratories <info@mocean-labs.com>");
+MODULE_DESCRIPTION("Xilinx SPI platform driver");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/spi/xilinx_spi_pltfm.c b/drivers/spi/xilinx_spi_pltfm.c
new file mode 100644
index 000000000000..24debac646a9
--- /dev/null
+++ b/drivers/spi/xilinx_spi_pltfm.c
@@ -0,0 +1,102 @@
+/*
+ * Support for Xilinx SPI platform devices
+ * Copyright (c) 2009 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+/* Supports:
+ * Xilinx SPI devices as platform devices
+ *
+ * Inspired by xilinx_spi.c, 2002-2007 (c) MontaVista Software, Inc.
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/interrupt.h>
+#include <linux/io.h>
+#include <linux/platform_device.h>
+
+#include <linux/spi/spi.h>
+#include <linux/spi/spi_bitbang.h>
+#include <linux/spi/xilinx_spi.h>
+
+#include "xilinx_spi.h"
+
+static int __devinit xilinx_spi_probe(struct platform_device *dev)
+{
+	struct xspi_platform_data *pdata;
+	struct resource *r;
+	int irq;
+	struct spi_master *master;
+	u8 i;
+
+	pdata = dev->dev.platform_data;
+	if (!pdata)
+		return -ENODEV;
+
+	r = platform_get_resource(dev, IORESOURCE_MEM, 0);
+	if (!r)
+		return -ENODEV;
+
+	irq = platform_get_irq(dev, 0);
+	if (irq < 0)
+		return -ENXIO;
+
+	master = xilinx_spi_init(&dev->dev, r, irq, dev->id);
+	if (!master)
+		return -ENODEV;
+
+	for (i = 0; i < pdata->num_devices; i++)
+		spi_new_device(master, pdata->devices + i);
+
+	platform_set_drvdata(dev, master);
+	return 0;
+}
+
+static int __devexit xilinx_spi_remove(struct platform_device *dev)
+{
+	xilinx_spi_deinit(platform_get_drvdata(dev));
+	platform_set_drvdata(dev, 0);
+
+	return 0;
+}
+
+/* work with hotplug and coldplug */
+MODULE_ALIAS("platform:" XILINX_SPI_NAME);
+
+static struct platform_driver xilinx_spi_driver = {
+	.probe	= xilinx_spi_probe,
+	.remove	= __devexit_p(xilinx_spi_remove),
+	.driver = {
+		.name = XILINX_SPI_NAME,
+		.owner = THIS_MODULE,
+	},
+};
+
+static int __init xilinx_spi_pltfm_init(void)
+{
+	return platform_driver_register(&xilinx_spi_driver);
+}
+module_init(xilinx_spi_pltfm_init);
+
+static void __exit xilinx_spi_pltfm_exit(void)
+{
+	platform_driver_unregister(&xilinx_spi_driver);
+}
+module_exit(xilinx_spi_pltfm_exit);
+
+MODULE_AUTHOR("Mocean Laboratories <info@mocean-labs.com>");
+MODULE_DESCRIPTION("Xilinx SPI platform driver");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/staging/Kconfig b/drivers/staging/Kconfig
index dfcd75cf4907..94eb86319ff3 100644
--- a/drivers/staging/Kconfig
+++ b/drivers/staging/Kconfig
@@ -65,8 +65,6 @@ source "drivers/staging/rt2860/Kconfig"
 
 source "drivers/staging/rt2870/Kconfig"
 
-source "drivers/staging/rt3090/Kconfig"
-
 source "drivers/staging/comedi/Kconfig"
 
 source "drivers/staging/asus_oled/Kconfig"
@@ -79,18 +77,16 @@ source "drivers/staging/rtl8187se/Kconfig"
 
 source "drivers/staging/rtl8192su/Kconfig"
 
+source "drivers/staging/rtl8192u/Kconfig"
+
 source "drivers/staging/rtl8192e/Kconfig"
 
 source "drivers/staging/mimio/Kconfig"
 
 source "drivers/staging/frontier/Kconfig"
 
-source "drivers/staging/android/Kconfig"
-
 source "drivers/staging/dream/Kconfig"
 
-source "drivers/staging/dst/Kconfig"
-
 source "drivers/staging/pohmelfs/Kconfig"
 
 source "drivers/staging/b3dfg/Kconfig"
@@ -101,8 +97,12 @@ source "drivers/staging/p9auth/Kconfig"
 
 source "drivers/staging/line6/Kconfig"
 
+source "drivers/gpu/drm/vmwgfx/Kconfig"
+
 source "drivers/gpu/drm/radeon/Kconfig"
 
+source "drivers/gpu/drm/nouveau/Kconfig"
+
 source "drivers/staging/octeon/Kconfig"
 
 source "drivers/staging/serqt_usb2/Kconfig"
@@ -125,6 +125,16 @@ source "drivers/staging/sep/Kconfig"
 
 source "drivers/staging/iio/Kconfig"
 
+source "drivers/staging/ramzswap/Kconfig"
+
+source "drivers/staging/wlags49_h2/Kconfig"
+
+source "drivers/staging/wlags49_h25/Kconfig"
+
+source "drivers/staging/batman-adv/Kconfig"
+
+source "drivers/staging/samsung-laptop/Kconfig"
+
 source "drivers/staging/strip/Kconfig"
 
 source "drivers/staging/arlan/Kconfig"
@@ -133,5 +143,7 @@ source "drivers/staging/wavelan/Kconfig"
 
 source "drivers/staging/netwave/Kconfig"
 
+source "drivers/staging/sm7xx/Kconfig"
+
 endif # !STAGING_EXCLUDE_BUILD
 endif # STAGING
diff --git a/drivers/staging/Makefile b/drivers/staging/Makefile
index 7719d04a4a86..b5e67b889f60 100644
--- a/drivers/staging/Makefile
+++ b/drivers/staging/Makefile
@@ -15,19 +15,17 @@ obj-$(CONFIG_POCH)		+= poch/
 obj-$(CONFIG_OTUS)		+= otus/
 obj-$(CONFIG_RT2860)		+= rt2860/
 obj-$(CONFIG_RT2870)		+= rt2870/
-obj-$(CONFIG_RT3090)		+= rt3090/
 obj-$(CONFIG_COMEDI)		+= comedi/
 obj-$(CONFIG_ASUS_OLED)		+= asus_oled/
 obj-$(CONFIG_PANEL)		+= panel/
 obj-$(CONFIG_ALTERA_PCIE_CHDMA)	+= altpciechdma/
-obj-$(CONFIG_RTL8187SE)		+= rtl8187se/
+obj-$(CONFIG_R8187SE)		+= rtl8187se/
 obj-$(CONFIG_RTL8192SU)		+= rtl8192su/
+obj-$(CONFIG_RTL8192U)		+= rtl8192u/
 obj-$(CONFIG_RTL8192E)		+= rtl8192e/
 obj-$(CONFIG_INPUT_MIMIO)	+= mimio/
 obj-$(CONFIG_TRANZPORT)		+= frontier/
-obj-$(CONFIG_ANDROID)		+= android/
-obj-$(CONFIG_ANDROID)		+= dream/
-obj-$(CONFIG_DST)		+= dst/
+obj-$(CONFIG_DREAM)		+= dream/
 obj-$(CONFIG_POHMELFS)		+= pohmelfs/
 obj-$(CONFIG_B3DFG)		+= b3dfg/
 obj-$(CONFIG_IDE_PHISON)	+= phison/
@@ -44,8 +42,14 @@ obj-$(CONFIG_VME_BUS)		+= vme/
 obj-$(CONFIG_RAR_REGISTER)	+= rar/
 obj-$(CONFIG_DX_SEP)		+= sep/
 obj-$(CONFIG_IIO)		+= iio/
+obj-$(CONFIG_RAMZSWAP)		+= ramzswap/
+obj-$(CONFIG_WLAGS49_H2)	+= wlags49_h2/
+obj-$(CONFIG_WLAGS49_H25)	+= wlags49_h25/
+obj-$(CONFIG_BATMAN_ADV)	+= batman-adv/
+obj-$(CONFIG_SAMSUNG_LAPTOP)	+= samsung-laptop/
 obj-$(CONFIG_STRIP)		+= strip/
 obj-$(CONFIG_ARLAN)		+= arlan/
 obj-$(CONFIG_WAVELAN)		+= wavelan/
 obj-$(CONFIG_PCMCIA_WAVELAN)	+= wavelan/
 obj-$(CONFIG_PCMCIA_NETWAVE)	+= netwave/
+obj-$(CONFIG_FB_SM7XX)		+= sm7xx/
diff --git a/drivers/staging/altpciechdma/altpciechdma.c b/drivers/staging/altpciechdma/altpciechdma.c
index e0c5ba4b4c29..2f07dd4563ac 100644
--- a/drivers/staging/altpciechdma/altpciechdma.c
+++ b/drivers/staging/altpciechdma/altpciechdma.c
@@ -212,7 +212,7 @@ struct ape_dev {
 	int msi_enabled;
 	/* whether this driver could obtain the regions */
 	int got_regions;
-	/* irq line succesfully requested by this driver, -1 otherwise */
+	/* irq line successfully requested by this driver, -1 otherwise */
 	int irq_line;
 	/* board revision */
 	u8 revision;
@@ -336,7 +336,7 @@ static int __devinit map_bars(struct ape_dev *ape, struct pci_dev *dev)
 		printk(KERN_DEBUG "BAR[%d] mapped at 0x%p with length %lu(/%lu).\n", i,
 		ape->bar[i], bar_min_len[i], bar_length);
 	}
-	/* succesfully mapped all required BAR regions */
+	/* successfully mapped all required BAR regions */
 	rc = 0;
 	goto success;
 fail:
@@ -911,7 +911,7 @@ static int __devinit probe(struct pci_dev *dev, const struct pci_device_id *id)
 	/* perform DMA engines loop back test */
 	rc = dma_test(ape, dev);
 	(void)rc;
-	/* succesfully took the device */
+	/* successfully took the device */
 	rc = 0;
 	printk(KERN_DEBUG "probe() successful.\n");
 	goto end;
diff --git a/drivers/staging/android/Kconfig b/drivers/staging/android/Kconfig
deleted file mode 100644
index eb675635ae60..000000000000
--- a/drivers/staging/android/Kconfig
+++ /dev/null
@@ -1,96 +0,0 @@
-menu "Android"
-
-config ANDROID
-	bool "Android Drivers"
-	depends on BROKEN
-	default N
-	---help---
-	  Enable support for various drivers needed on the Android platform
-
-if ANDROID
-
-config ANDROID_BINDER_IPC
-	bool "Android Binder IPC Driver"
-	default n
-
-config ANDROID_LOGGER
-	tristate "Android log driver"
-	default n
-
-config ANDROID_RAM_CONSOLE
-	bool "Android RAM buffer console"
-	default n
-
-config ANDROID_RAM_CONSOLE_ENABLE_VERBOSE
-	bool "Enable verbose console messages on Android RAM console"
-	default y
-	depends on ANDROID_RAM_CONSOLE
-
-menuconfig ANDROID_RAM_CONSOLE_ERROR_CORRECTION
-	bool "Android RAM Console Enable error correction"
-	default n
-	depends on ANDROID_RAM_CONSOLE
-	depends on !ANDROID_RAM_CONSOLE_EARLY_INIT
-	select REED_SOLOMON
-	select REED_SOLOMON_ENC8
-	select REED_SOLOMON_DEC8
-
-if ANDROID_RAM_CONSOLE_ERROR_CORRECTION
-
-config ANDROID_RAM_CONSOLE_ERROR_CORRECTION_DATA_SIZE
-	int "Android RAM Console Data data size"
-	default 128
-	help
-	  Must be a power of 2.
-
-config ANDROID_RAM_CONSOLE_ERROR_CORRECTION_ECC_SIZE
-	int "Android RAM Console ECC size"
-	default 16
-
-config ANDROID_RAM_CONSOLE_ERROR_CORRECTION_SYMBOL_SIZE
-	int "Android RAM Console Symbol size"
-	default 8
-
-config ANDROID_RAM_CONSOLE_ERROR_CORRECTION_POLYNOMIAL
-	hex "Android RAM Console Polynomial"
-	default 0x19 if (ANDROID_RAM_CONSOLE_ERROR_CORRECTION_SYMBOL_SIZE = 4)
-	default 0x29 if (ANDROID_RAM_CONSOLE_ERROR_CORRECTION_SYMBOL_SIZE = 5)
-	default 0x61 if (ANDROID_RAM_CONSOLE_ERROR_CORRECTION_SYMBOL_SIZE = 6)
-	default 0x89 if (ANDROID_RAM_CONSOLE_ERROR_CORRECTION_SYMBOL_SIZE = 7)
-	default 0x11d if (ANDROID_RAM_CONSOLE_ERROR_CORRECTION_SYMBOL_SIZE = 8)
-
-endif # ANDROID_RAM_CONSOLE_ERROR_CORRECTION
-
-config ANDROID_RAM_CONSOLE_EARLY_INIT
-	bool "Start Android RAM console early"
-	default n
-	depends on ANDROID_RAM_CONSOLE
-
-config ANDROID_RAM_CONSOLE_EARLY_ADDR
-	hex "Android RAM console virtual address"
-	default 0
-	depends on ANDROID_RAM_CONSOLE_EARLY_INIT
-
-config ANDROID_RAM_CONSOLE_EARLY_SIZE
-	hex "Android RAM console buffer size"
-	default 0
-	depends on ANDROID_RAM_CONSOLE_EARLY_INIT
-
-config ANDROID_TIMED_OUTPUT
-	bool "Timed output class driver"
-	default y
-
-config ANDROID_TIMED_GPIO
-	tristate "Android timed gpio driver"
-	depends on GENERIC_GPIO && ANDROID_TIMED_OUTPUT
-	default n
-
-config ANDROID_LOW_MEMORY_KILLER
-	bool "Android Low Memory Killer"
-	default N
-	---help---
-	  Register processes to be killed when memory is low
-
-endif # if ANDROID
-
-endmenu
diff --git a/drivers/staging/android/Makefile b/drivers/staging/android/Makefile
deleted file mode 100644
index 8e057e626d11..000000000000
--- a/drivers/staging/android/Makefile
+++ /dev/null
@@ -1,6 +0,0 @@
-obj-$(CONFIG_ANDROID_BINDER_IPC)	+= binder.o
-obj-$(CONFIG_ANDROID_LOGGER)		+= logger.o
-obj-$(CONFIG_ANDROID_RAM_CONSOLE)	+= ram_console.o
-obj-$(CONFIG_ANDROID_TIMED_OUTPUT)	+= timed_output.o
-obj-$(CONFIG_ANDROID_TIMED_GPIO)	+= timed_gpio.o
-obj-$(CONFIG_ANDROID_LOW_MEMORY_KILLER)	+= lowmemorykiller.o
diff --git a/drivers/staging/android/TODO b/drivers/staging/android/TODO
deleted file mode 100644
index e59c5be4be2b..000000000000
--- a/drivers/staging/android/TODO
+++ /dev/null
@@ -1,10 +0,0 @@
-TODO:
-	- checkpatch.pl cleanups
-	- sparse fixes
-	- rename files to be not so "generic"
-	- make sure things build as modules properly
-	- add proper arch dependancies as needed
-	- audit userspace interfaces to make sure they are sane
-
-Please send patches to Greg Kroah-Hartman <greg@kroah.com> and Cc:
-Brian Swetland <swetland@google.com>
diff --git a/drivers/staging/android/binder.c b/drivers/staging/android/binder.c
deleted file mode 100644
index 99010d4b3044..000000000000
--- a/drivers/staging/android/binder.c
+++ /dev/null
@@ -1,3767 +0,0 @@
-/* binder.c
- *
- * Android IPC Subsystem
- *
- * Copyright (C) 2007-2008 Google, Inc.
- *
- * This software is licensed under the terms of the GNU General Public
- * License version 2, as published by the Free Software Foundation, and
- * may be copied, distributed, and modified under those terms.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- */
-
-#include <asm/cacheflush.h>
-#include <linux/fdtable.h>
-#include <linux/file.h>
-#include <linux/fs.h>
-#include <linux/list.h>
-#include <linux/miscdevice.h>
-#include <linux/mm.h>
-#include <linux/module.h>
-#include <linux/mutex.h>
-#include <linux/nsproxy.h>
-#include <linux/poll.h>
-#include <linux/proc_fs.h>
-#include <linux/rbtree.h>
-#include <linux/sched.h>
-#include <linux/uaccess.h>
-#include <linux/vmalloc.h>
-
-#include "binder.h"
-
-static DEFINE_MUTEX(binder_lock);
-static DEFINE_MUTEX(binder_deferred_lock);
-
-static HLIST_HEAD(binder_procs);
-static HLIST_HEAD(binder_deferred_list);
-static HLIST_HEAD(binder_dead_nodes);
-
-static struct proc_dir_entry *binder_proc_dir_entry_root;
-static struct proc_dir_entry *binder_proc_dir_entry_proc;
-static struct binder_node *binder_context_mgr_node;
-static uid_t binder_context_mgr_uid = -1;
-static int binder_last_id;
-
-static int binder_read_proc_proc(char *page, char **start, off_t off,
-				 int count, int *eof, void *data);
-
-/* This is only defined in include/asm-arm/sizes.h */
-#ifndef SZ_1K
-#define SZ_1K                               0x400
-#endif
-
-#ifndef SZ_4M
-#define SZ_4M                               0x400000
-#endif
-
-#define FORBIDDEN_MMAP_FLAGS                (VM_WRITE)
-
-#define BINDER_SMALL_BUF_SIZE (PAGE_SIZE * 64)
-
-enum {
-	BINDER_DEBUG_USER_ERROR             = 1U << 0,
-	BINDER_DEBUG_FAILED_TRANSACTION     = 1U << 1,
-	BINDER_DEBUG_DEAD_TRANSACTION       = 1U << 2,
-	BINDER_DEBUG_OPEN_CLOSE             = 1U << 3,
-	BINDER_DEBUG_DEAD_BINDER            = 1U << 4,
-	BINDER_DEBUG_DEATH_NOTIFICATION     = 1U << 5,
-	BINDER_DEBUG_READ_WRITE             = 1U << 6,
-	BINDER_DEBUG_USER_REFS              = 1U << 7,
-	BINDER_DEBUG_THREADS                = 1U << 8,
-	BINDER_DEBUG_TRANSACTION            = 1U << 9,
-	BINDER_DEBUG_TRANSACTION_COMPLETE   = 1U << 10,
-	BINDER_DEBUG_FREE_BUFFER            = 1U << 11,
-	BINDER_DEBUG_INTERNAL_REFS          = 1U << 12,
-	BINDER_DEBUG_BUFFER_ALLOC           = 1U << 13,
-	BINDER_DEBUG_PRIORITY_CAP           = 1U << 14,
-	BINDER_DEBUG_BUFFER_ALLOC_ASYNC     = 1U << 15,
-};
-static uint32_t binder_debug_mask = BINDER_DEBUG_USER_ERROR |
-	BINDER_DEBUG_FAILED_TRANSACTION | BINDER_DEBUG_DEAD_TRANSACTION;
-module_param_named(debug_mask, binder_debug_mask, uint, S_IWUSR | S_IRUGO);
-
-static int binder_debug_no_lock;
-module_param_named(proc_no_lock, binder_debug_no_lock, bool, S_IWUSR | S_IRUGO);
-
-static DECLARE_WAIT_QUEUE_HEAD(binder_user_error_wait);
-static int binder_stop_on_user_error;
-
-static int binder_set_stop_on_user_error(const char *val,
-					 struct kernel_param *kp)
-{
-	int ret;
-	ret = param_set_int(val, kp);
-	if (binder_stop_on_user_error < 2)
-		wake_up(&binder_user_error_wait);
-	return ret;
-}
-module_param_call(stop_on_user_error, binder_set_stop_on_user_error,
-	param_get_int, &binder_stop_on_user_error, S_IWUSR | S_IRUGO);
-
-#define binder_debug(mask, x...) \
-	do { \
-		if (binder_debug_mask & mask) \
-			printk(KERN_INFO x); \
-	} while (0)
-
-#define binder_user_error(x...) \
-	do { \
-		if (binder_debug_mask & BINDER_DEBUG_USER_ERROR) \
-			printk(KERN_INFO x); \
-		if (binder_stop_on_user_error) \
-			binder_stop_on_user_error = 2; \
-	} while (0)
-
-enum binder_stat_types {
-	BINDER_STAT_PROC,
-	BINDER_STAT_THREAD,
-	BINDER_STAT_NODE,
-	BINDER_STAT_REF,
-	BINDER_STAT_DEATH,
-	BINDER_STAT_TRANSACTION,
-	BINDER_STAT_TRANSACTION_COMPLETE,
-	BINDER_STAT_COUNT
-};
-
-struct binder_stats {
-	int br[_IOC_NR(BR_FAILED_REPLY) + 1];
-	int bc[_IOC_NR(BC_DEAD_BINDER_DONE) + 1];
-	int obj_created[BINDER_STAT_COUNT];
-	int obj_deleted[BINDER_STAT_COUNT];
-};
-
-static struct binder_stats binder_stats;
-
-static inline void binder_stats_deleted(enum binder_stat_types type)
-{
-	binder_stats.obj_deleted[type]++;
-}
-
-static inline void binder_stats_created(enum binder_stat_types type)
-{
-	binder_stats.obj_created[type]++;
-}
-
-struct binder_transaction_log_entry {
-	int debug_id;
-	int call_type;
-	int from_proc;
-	int from_thread;
-	int target_handle;
-	int to_proc;
-	int to_thread;
-	int to_node;
-	int data_size;
-	int offsets_size;
-};
-struct binder_transaction_log {
-	int next;
-	int full;
-	struct binder_transaction_log_entry entry[32];
-};
-static struct binder_transaction_log binder_transaction_log;
-static struct binder_transaction_log binder_transaction_log_failed;
-
-static struct binder_transaction_log_entry *binder_transaction_log_add(
-	struct binder_transaction_log *log)
-{
-	struct binder_transaction_log_entry *e;
-	e = &log->entry[log->next];
-	memset(e, 0, sizeof(*e));
-	log->next++;
-	if (log->next == ARRAY_SIZE(log->entry)) {
-		log->next = 0;
-		log->full = 1;
-	}
-	return e;
-}
-
-struct binder_work {
-	struct list_head entry;
-	enum {
-		BINDER_WORK_TRANSACTION = 1,
-		BINDER_WORK_TRANSACTION_COMPLETE,
-		BINDER_WORK_NODE,
-		BINDER_WORK_DEAD_BINDER,
-		BINDER_WORK_DEAD_BINDER_AND_CLEAR,
-		BINDER_WORK_CLEAR_DEATH_NOTIFICATION,
-	} type;
-};
-
-struct binder_node {
-	int debug_id;
-	struct binder_work work;
-	union {
-		struct rb_node rb_node;
-		struct hlist_node dead_node;
-	};
-	struct binder_proc *proc;
-	struct hlist_head refs;
-	int internal_strong_refs;
-	int local_weak_refs;
-	int local_strong_refs;
-	void __user *ptr;
-	void __user *cookie;
-	unsigned has_strong_ref:1;
-	unsigned pending_strong_ref:1;
-	unsigned has_weak_ref:1;
-	unsigned pending_weak_ref:1;
-	unsigned has_async_transaction:1;
-	unsigned accept_fds:1;
-	unsigned min_priority:8;
-	struct list_head async_todo;
-};
-
-struct binder_ref_death {
-	struct binder_work work;
-	void __user *cookie;
-};
-
-struct binder_ref {
-	/* Lookups needed: */
-	/*   node + proc => ref (transaction) */
-	/*   desc + proc => ref (transaction, inc/dec ref) */
-	/*   node => refs + procs (proc exit) */
-	int debug_id;
-	struct rb_node rb_node_desc;
-	struct rb_node rb_node_node;
-	struct hlist_node node_entry;
-	struct binder_proc *proc;
-	struct binder_node *node;
-	uint32_t desc;
-	int strong;
-	int weak;
-	struct binder_ref_death *death;
-};
-
-struct binder_buffer {
-	struct list_head entry; /* free and allocated entries by addesss */
-	struct rb_node rb_node; /* free entry by size or allocated entry */
-				/* by address */
-	unsigned free:1;
-	unsigned allow_user_free:1;
-	unsigned async_transaction:1;
-	unsigned debug_id:29;
-
-	struct binder_transaction *transaction;
-
-	struct binder_node *target_node;
-	size_t data_size;
-	size_t offsets_size;
-	uint8_t data[0];
-};
-
-enum binder_deferred_state {
-	BINDER_DEFERRED_PUT_FILES    = 0x01,
-	BINDER_DEFERRED_FLUSH        = 0x02,
-	BINDER_DEFERRED_RELEASE      = 0x04,
-};
-
-struct binder_proc {
-	struct hlist_node proc_node;
-	struct rb_root threads;
-	struct rb_root nodes;
-	struct rb_root refs_by_desc;
-	struct rb_root refs_by_node;
-	int pid;
-	struct vm_area_struct *vma;
-	struct task_struct *tsk;
-	struct files_struct *files;
-	struct hlist_node deferred_work_node;
-	int deferred_work;
-	void *buffer;
-	ptrdiff_t user_buffer_offset;
-
-	struct list_head buffers;
-	struct rb_root free_buffers;
-	struct rb_root allocated_buffers;
-	size_t free_async_space;
-
-	struct page **pages;
-	size_t buffer_size;
-	uint32_t buffer_free;
-	struct list_head todo;
-	wait_queue_head_t wait;
-	struct binder_stats stats;
-	struct list_head delivered_death;
-	int max_threads;
-	int requested_threads;
-	int requested_threads_started;
-	int ready_threads;
-	long default_priority;
-};
-
-enum {
-	BINDER_LOOPER_STATE_REGISTERED  = 0x01,
-	BINDER_LOOPER_STATE_ENTERED     = 0x02,
-	BINDER_LOOPER_STATE_EXITED      = 0x04,
-	BINDER_LOOPER_STATE_INVALID     = 0x08,
-	BINDER_LOOPER_STATE_WAITING     = 0x10,
-	BINDER_LOOPER_STATE_NEED_RETURN = 0x20
-};
-
-struct binder_thread {
-	struct binder_proc *proc;
-	struct rb_node rb_node;
-	int pid;
-	int looper;
-	struct binder_transaction *transaction_stack;
-	struct list_head todo;
-	uint32_t return_error; /* Write failed, return error code in read buf */
-	uint32_t return_error2; /* Write failed, return error code in read */
-		/* buffer. Used when sending a reply to a dead process that */
-		/* we are also waiting on */
-	wait_queue_head_t wait;
-	struct binder_stats stats;
-};
-
-struct binder_transaction {
-	int debug_id;
-	struct binder_work work;
-	struct binder_thread *from;
-	struct binder_transaction *from_parent;
-	struct binder_proc *to_proc;
-	struct binder_thread *to_thread;
-	struct binder_transaction *to_parent;
-	unsigned need_reply:1;
-	/* unsigned is_dead:1; */	/* not used at the moment */
-
-	struct binder_buffer *buffer;
-	unsigned int	code;
-	unsigned int	flags;
-	long	priority;
-	long	saved_priority;
-	uid_t	sender_euid;
-};
-
-static void
-binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer);
-
-/*
- * copied from get_unused_fd_flags
- */
-int task_get_unused_fd_flags(struct binder_proc *proc, int flags)
-{
-	struct files_struct *files = proc->files;
-	int fd, error;
-	struct fdtable *fdt;
-	unsigned long rlim_cur;
-	unsigned long irqs;
-
-	if (files == NULL)
-		return -ESRCH;
-
-	error = -EMFILE;
-	spin_lock(&files->file_lock);
-
-repeat:
-	fdt = files_fdtable(files);
-	fd = find_next_zero_bit(fdt->open_fds->fds_bits, fdt->max_fds,
-				files->next_fd);
-
-	/*
-	 * N.B. For clone tasks sharing a files structure, this test
-	 * will limit the total number of files that can be opened.
-	 */
-	rlim_cur = 0;
-	if (lock_task_sighand(proc->tsk, &irqs)) {
-		rlim_cur = proc->tsk->signal->rlim[RLIMIT_NOFILE].rlim_cur;
-		unlock_task_sighand(proc->tsk, &irqs);
-	}
-	if (fd >= rlim_cur)
-		goto out;
-
-	/* Do we need to expand the fd array or fd set?  */
-	error = expand_files(files, fd);
-	if (error < 0)
-		goto out;
-
-	if (error) {
-		/*
-		 * If we needed to expand the fs array we
-		 * might have blocked - try again.
-		 */
-		error = -EMFILE;
-		goto repeat;
-	}
-
-	FD_SET(fd, fdt->open_fds);
-	if (flags & O_CLOEXEC)
-		FD_SET(fd, fdt->close_on_exec);
-	else
-		FD_CLR(fd, fdt->close_on_exec);
-	files->next_fd = fd + 1;
-#if 1
-	/* Sanity check */
-	if (fdt->fd[fd] != NULL) {
-		printk(KERN_WARNING "get_unused_fd: slot %d not NULL!\n", fd);
-		fdt->fd[fd] = NULL;
-	}
-#endif
-	error = fd;
-
-out:
-	spin_unlock(&files->file_lock);
-	return error;
-}
-
-/*
- * copied from fd_install
- */
-static void task_fd_install(
-	struct binder_proc *proc, unsigned int fd, struct file *file)
-{
-	struct files_struct *files = proc->files;
-	struct fdtable *fdt;
-
-	if (files == NULL)
-		return;
-
-	spin_lock(&files->file_lock);
-	fdt = files_fdtable(files);
-	BUG_ON(fdt->fd[fd] != NULL);
-	rcu_assign_pointer(fdt->fd[fd], file);
-	spin_unlock(&files->file_lock);
-}
-
-/*
- * copied from __put_unused_fd in open.c
- */
-static void __put_unused_fd(struct files_struct *files, unsigned int fd)
-{
-	struct fdtable *fdt = files_fdtable(files);
-	__FD_CLR(fd, fdt->open_fds);
-	if (fd < files->next_fd)
-		files->next_fd = fd;
-}
-
-/*
- * copied from sys_close
- */
-static long task_close_fd(struct binder_proc *proc, unsigned int fd)
-{
-	struct file *filp;
-	struct files_struct *files = proc->files;
-	struct fdtable *fdt;
-	int retval;
-
-	if (files == NULL)
-		return -ESRCH;
-
-	spin_lock(&files->file_lock);
-	fdt = files_fdtable(files);
-	if (fd >= fdt->max_fds)
-		goto out_unlock;
-	filp = fdt->fd[fd];
-	if (!filp)
-		goto out_unlock;
-	rcu_assign_pointer(fdt->fd[fd], NULL);
-	FD_CLR(fd, fdt->close_on_exec);
-	__put_unused_fd(files, fd);
-	spin_unlock(&files->file_lock);
-	retval = filp_close(filp, files);
-
-	/* can't restart close syscall because file table entry was cleared */
-	if (unlikely(retval == -ERESTARTSYS ||
-		     retval == -ERESTARTNOINTR ||
-		     retval == -ERESTARTNOHAND ||
-		     retval == -ERESTART_RESTARTBLOCK))
-		retval = -EINTR;
-
-	return retval;
-
-out_unlock:
-	spin_unlock(&files->file_lock);
-	return -EBADF;
-}
-
-static void binder_set_nice(long nice)
-{
-	long min_nice;
-	if (can_nice(current, nice)) {
-		set_user_nice(current, nice);
-		return;
-	}
-	min_nice = 20 - current->signal->rlim[RLIMIT_NICE].rlim_cur;
-	binder_debug(BINDER_DEBUG_PRIORITY_CAP,
-		     "binder: %d: nice value %ld not allowed use "
-		     "%ld instead\n", current->pid, nice, min_nice);
-	set_user_nice(current, min_nice);
-	if (min_nice < 20)
-		return;
-	binder_user_error("binder: %d RLIMIT_NICE not set\n", current->pid);
-}
-
-static size_t binder_buffer_size(struct binder_proc *proc,
-				 struct binder_buffer *buffer)
-{
-	if (list_is_last(&buffer->entry, &proc->buffers))
-		return proc->buffer + proc->buffer_size - (void *)buffer->data;
-	else
-		return (size_t)list_entry(buffer->entry.next,
-			struct binder_buffer, entry) - (size_t)buffer->data;
-}
-
-static void binder_insert_free_buffer(struct binder_proc *proc,
-				      struct binder_buffer *new_buffer)
-{
-	struct rb_node **p = &proc->free_buffers.rb_node;
-	struct rb_node *parent = NULL;
-	struct binder_buffer *buffer;
-	size_t buffer_size;
-	size_t new_buffer_size;
-
-	BUG_ON(!new_buffer->free);
-
-	new_buffer_size = binder_buffer_size(proc, new_buffer);
-
-	binder_debug(BINDER_DEBUG_BUFFER_ALLOC,
-		     "binder: %d: add free buffer, size %zd, "
-		     "at %p\n", proc->pid, new_buffer_size, new_buffer);
-
-	while (*p) {
-		parent = *p;
-		buffer = rb_entry(parent, struct binder_buffer, rb_node);
-		BUG_ON(!buffer->free);
-
-		buffer_size = binder_buffer_size(proc, buffer);
-
-		if (new_buffer_size < buffer_size)
-			p = &parent->rb_left;
-		else
-			p = &parent->rb_right;
-	}
-	rb_link_node(&new_buffer->rb_node, parent, p);
-	rb_insert_color(&new_buffer->rb_node, &proc->free_buffers);
-}
-
-static void binder_insert_allocated_buffer(struct binder_proc *proc,
-					   struct binder_buffer *new_buffer)
-{
-	struct rb_node **p = &proc->allocated_buffers.rb_node;
-	struct rb_node *parent = NULL;
-	struct binder_buffer *buffer;
-
-	BUG_ON(new_buffer->free);
-
-	while (*p) {
-		parent = *p;
-		buffer = rb_entry(parent, struct binder_buffer, rb_node);
-		BUG_ON(buffer->free);
-
-		if (new_buffer < buffer)
-			p = &parent->rb_left;
-		else if (new_buffer > buffer)
-			p = &parent->rb_right;
-		else
-			BUG();
-	}
-	rb_link_node(&new_buffer->rb_node, parent, p);
-	rb_insert_color(&new_buffer->rb_node, &proc->allocated_buffers);
-}
-
-static struct binder_buffer *binder_buffer_lookup(struct binder_proc *proc,
-						  void __user *user_ptr)
-{
-	struct rb_node *n = proc->allocated_buffers.rb_node;
-	struct binder_buffer *buffer;
-	struct binder_buffer *kern_ptr;
-
-	kern_ptr = user_ptr - proc->user_buffer_offset
-		- offsetof(struct binder_buffer, data);
-
-	while (n) {
-		buffer = rb_entry(n, struct binder_buffer, rb_node);
-		BUG_ON(buffer->free);
-
-		if (kern_ptr < buffer)
-			n = n->rb_left;
-		else if (kern_ptr > buffer)
-			n = n->rb_right;
-		else
-			return buffer;
-	}
-	return NULL;
-}
-
-static int binder_update_page_range(struct binder_proc *proc, int allocate,
-				    void *start, void *end,
-				    struct vm_area_struct *vma)
-{
-	void *page_addr;
-	unsigned long user_page_addr;
-	struct vm_struct tmp_area;
-	struct page **page;
-	struct mm_struct *mm;
-
-	binder_debug(BINDER_DEBUG_BUFFER_ALLOC,
-		     "binder: %d: %s pages %p-%p\n", proc->pid,
-		     allocate ? "allocate" : "free", start, end);
-
-	if (end <= start)
-		return 0;
-
-	if (vma)
-		mm = NULL;
-	else
-		mm = get_task_mm(proc->tsk);
-
-	if (mm) {
-		down_write(&mm->mmap_sem);
-		vma = proc->vma;
-	}
-
-	if (allocate == 0)
-		goto free_range;
-
-	if (vma == NULL) {
-		printk(KERN_ERR "binder: %d: binder_alloc_buf failed to "
-		       "map pages in userspace, no vma\n", proc->pid);
-		goto err_no_vma;
-	}
-
-	for (page_addr = start; page_addr < end; page_addr += PAGE_SIZE) {
-		int ret;
-		struct page **page_array_ptr;
-		page = &proc->pages[(page_addr - proc->buffer) / PAGE_SIZE];
-
-		BUG_ON(*page);
-		*page = alloc_page(GFP_KERNEL | __GFP_ZERO);
-		if (*page == NULL) {
-			printk(KERN_ERR "binder: %d: binder_alloc_buf failed "
-			       "for page at %p\n", proc->pid, page_addr);
-			goto err_alloc_page_failed;
-		}
-		tmp_area.addr = page_addr;
-		tmp_area.size = PAGE_SIZE + PAGE_SIZE /* guard page? */;
-		page_array_ptr = page;
-		ret = map_vm_area(&tmp_area, PAGE_KERNEL, &page_array_ptr);
-		if (ret) {
-			printk(KERN_ERR "binder: %d: binder_alloc_buf failed "
-			       "to map page at %p in kernel\n",
-			       proc->pid, page_addr);
-			goto err_map_kernel_failed;
-		}
-		user_page_addr =
-			(uintptr_t)page_addr + proc->user_buffer_offset;
-		ret = vm_insert_page(vma, user_page_addr, page[0]);
-		if (ret) {
-			printk(KERN_ERR "binder: %d: binder_alloc_buf failed "
-			       "to map page at %lx in userspace\n",
-			       proc->pid, user_page_addr);
-			goto err_vm_insert_page_failed;
-		}
-		/* vm_insert_page does not seem to increment the refcount */
-	}
-	if (mm) {
-		up_write(&mm->mmap_sem);
-		mmput(mm);
-	}
-	return 0;
-
-free_range:
-	for (page_addr = end - PAGE_SIZE; page_addr >= start;
-	     page_addr -= PAGE_SIZE) {
-		page = &proc->pages[(page_addr - proc->buffer) / PAGE_SIZE];
-		if (vma)
-			zap_page_range(vma, (uintptr_t)page_addr +
-				proc->user_buffer_offset, PAGE_SIZE, NULL);
-err_vm_insert_page_failed:
-		unmap_kernel_range((unsigned long)page_addr, PAGE_SIZE);
-err_map_kernel_failed:
-		__free_page(*page);
-		*page = NULL;
-err_alloc_page_failed:
-		;
-	}
-err_no_vma:
-	if (mm) {
-		up_write(&mm->mmap_sem);
-		mmput(mm);
-	}
-	return -ENOMEM;
-}
-
-static struct binder_buffer *binder_alloc_buf(struct binder_proc *proc,
-					      size_t data_size,
-					      size_t offsets_size, int is_async)
-{
-	struct rb_node *n = proc->free_buffers.rb_node;
-	struct binder_buffer *buffer;
-	size_t buffer_size;
-	struct rb_node *best_fit = NULL;
-	void *has_page_addr;
-	void *end_page_addr;
-	size_t size;
-
-	if (proc->vma == NULL) {
-		printk(KERN_ERR "binder: %d: binder_alloc_buf, no vma\n",
-		       proc->pid);
-		return NULL;
-	}
-
-	size = ALIGN(data_size, sizeof(void *)) +
-		ALIGN(offsets_size, sizeof(void *));
-
-	if (size < data_size || size < offsets_size) {
-		binder_user_error("binder: %d: got transaction with invalid "
-			"size %zd-%zd\n", proc->pid, data_size, offsets_size);
-		return NULL;
-	}
-
-	if (is_async &&
-	    proc->free_async_space < size + sizeof(struct binder_buffer)) {
-		binder_debug(BINDER_DEBUG_BUFFER_ALLOC,
-			     "binder: %d: binder_alloc_buf size %zd"
-			     "failed, no async space left\n", proc->pid, size);
-		return NULL;
-	}
-
-	while (n) {
-		buffer = rb_entry(n, struct binder_buffer, rb_node);
-		BUG_ON(!buffer->free);
-		buffer_size = binder_buffer_size(proc, buffer);
-
-		if (size < buffer_size) {
-			best_fit = n;
-			n = n->rb_left;
-		} else if (size > buffer_size)
-			n = n->rb_right;
-		else {
-			best_fit = n;
-			break;
-		}
-	}
-	if (best_fit == NULL) {
-		printk(KERN_ERR "binder: %d: binder_alloc_buf size %zd failed, "
-		       "no address space\n", proc->pid, size);
-		return NULL;
-	}
-	if (n == NULL) {
-		buffer = rb_entry(best_fit, struct binder_buffer, rb_node);
-		buffer_size = binder_buffer_size(proc, buffer);
-	}
-
-	binder_debug(BINDER_DEBUG_BUFFER_ALLOC,
-		     "binder: %d: binder_alloc_buf size %zd got buff"
-		     "er %p size %zd\n", proc->pid, size, buffer, buffer_size);
-
-	has_page_addr =
-		(void *)(((uintptr_t)buffer->data + buffer_size) & PAGE_MASK);
-	if (n == NULL) {
-		if (size + sizeof(struct binder_buffer) + 4 >= buffer_size)
-			buffer_size = size; /* no room for other buffers */
-		else
-			buffer_size = size + sizeof(struct binder_buffer);
-	}
-	end_page_addr =
-		(void *)PAGE_ALIGN((uintptr_t)buffer->data + buffer_size);
-	if (end_page_addr > has_page_addr)
-		end_page_addr = has_page_addr;
-	if (binder_update_page_range(proc, 1,
-	    (void *)PAGE_ALIGN((uintptr_t)buffer->data), end_page_addr, NULL))
-		return NULL;
-
-	rb_erase(best_fit, &proc->free_buffers);
-	buffer->free = 0;
-	binder_insert_allocated_buffer(proc, buffer);
-	if (buffer_size != size) {
-		struct binder_buffer *new_buffer = (void *)buffer->data + size;
-		list_add(&new_buffer->entry, &buffer->entry);
-		new_buffer->free = 1;
-		binder_insert_free_buffer(proc, new_buffer);
-	}
-	binder_debug(BINDER_DEBUG_BUFFER_ALLOC,
-		     "binder: %d: binder_alloc_buf size %zd got "
-		     "%p\n", proc->pid, size, buffer);
-	buffer->data_size = data_size;
-	buffer->offsets_size = offsets_size;
-	buffer->async_transaction = is_async;
-	if (is_async) {
-		proc->free_async_space -= size + sizeof(struct binder_buffer);
-		binder_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC,
-			     "binder: %d: binder_alloc_buf size %zd "
-			     "async free %zd\n", proc->pid, size,
-			     proc->free_async_space);
-	}
-
-	return buffer;
-}
-
-static void *buffer_start_page(struct binder_buffer *buffer)
-{
-	return (void *)((uintptr_t)buffer & PAGE_MASK);
-}
-
-static void *buffer_end_page(struct binder_buffer *buffer)
-{
-	return (void *)(((uintptr_t)(buffer + 1) - 1) & PAGE_MASK);
-}
-
-static void binder_delete_free_buffer(struct binder_proc *proc,
-				      struct binder_buffer *buffer)
-{
-	struct binder_buffer *prev, *next = NULL;
-	int free_page_end = 1;
-	int free_page_start = 1;
-
-	BUG_ON(proc->buffers.next == &buffer->entry);
-	prev = list_entry(buffer->entry.prev, struct binder_buffer, entry);
-	BUG_ON(!prev->free);
-	if (buffer_end_page(prev) == buffer_start_page(buffer)) {
-		free_page_start = 0;
-		if (buffer_end_page(prev) == buffer_end_page(buffer))
-			free_page_end = 0;
-		binder_debug(BINDER_DEBUG_BUFFER_ALLOC,
-			     "binder: %d: merge free, buffer %p "
-			     "share page with %p\n", proc->pid, buffer, prev);
-	}
-
-	if (!list_is_last(&buffer->entry, &proc->buffers)) {
-		next = list_entry(buffer->entry.next,
-				  struct binder_buffer, entry);
-		if (buffer_start_page(next) == buffer_end_page(buffer)) {
-			free_page_end = 0;
-			if (buffer_start_page(next) ==
-			    buffer_start_page(buffer))
-				free_page_start = 0;
-			binder_debug(BINDER_DEBUG_BUFFER_ALLOC,
-				     "binder: %d: merge free, buffer"
-				     " %p share page with %p\n", proc->pid,
-				     buffer, prev);
-		}
-	}
-	list_del(&buffer->entry);
-	if (free_page_start || free_page_end) {
-		binder_debug(BINDER_DEBUG_BUFFER_ALLOC,
-			     "binder: %d: merge free, buffer %p do "
-			     "not share page%s%s with with %p or %p\n",
-			     proc->pid, buffer, free_page_start ? "" : " end",
-			     free_page_end ? "" : " start", prev, next);
-		binder_update_page_range(proc, 0, free_page_start ?
-			buffer_start_page(buffer) : buffer_end_page(buffer),
-			(free_page_end ? buffer_end_page(buffer) :
-			buffer_start_page(buffer)) + PAGE_SIZE, NULL);
-	}
-}
-
-static void binder_free_buf(struct binder_proc *proc,
-			    struct binder_buffer *buffer)
-{
-	size_t size, buffer_size;
-
-	buffer_size = binder_buffer_size(proc, buffer);
-
-	size = ALIGN(buffer->data_size, sizeof(void *)) +
-		ALIGN(buffer->offsets_size, sizeof(void *));
-
-	binder_debug(BINDER_DEBUG_BUFFER_ALLOC,
-		     "binder: %d: binder_free_buf %p size %zd buffer"
-		     "_size %zd\n", proc->pid, buffer, size, buffer_size);
-
-	BUG_ON(buffer->free);
-	BUG_ON(size > buffer_size);
-	BUG_ON(buffer->transaction != NULL);
-	BUG_ON((void *)buffer < proc->buffer);
-	BUG_ON((void *)buffer > proc->buffer + proc->buffer_size);
-
-	if (buffer->async_transaction) {
-		proc->free_async_space += size + sizeof(struct binder_buffer);
-
-		binder_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC,
-			     "binder: %d: binder_free_buf size %zd "
-			     "async free %zd\n", proc->pid, size,
-			     proc->free_async_space);
-	}
-
-	binder_update_page_range(proc, 0,
-		(void *)PAGE_ALIGN((uintptr_t)buffer->data),
-		(void *)(((uintptr_t)buffer->data + buffer_size) & PAGE_MASK),
-		NULL);
-	rb_erase(&buffer->rb_node, &proc->allocated_buffers);
-	buffer->free = 1;
-	if (!list_is_last(&buffer->entry, &proc->buffers)) {
-		struct binder_buffer *next = list_entry(buffer->entry.next,
-						struct binder_buffer, entry);
-		if (next->free) {
-			rb_erase(&next->rb_node, &proc->free_buffers);
-			binder_delete_free_buffer(proc, next);
-		}
-	}
-	if (proc->buffers.next != &buffer->entry) {
-		struct binder_buffer *prev = list_entry(buffer->entry.prev,
-						struct binder_buffer, entry);
-		if (prev->free) {
-			binder_delete_free_buffer(proc, buffer);
-			rb_erase(&prev->rb_node, &proc->free_buffers);
-			buffer = prev;
-		}
-	}
-	binder_insert_free_buffer(proc, buffer);
-}
-
-static struct binder_node *binder_get_node(struct binder_proc *proc,
-					   void __user *ptr)
-{
-	struct rb_node *n = proc->nodes.rb_node;
-	struct binder_node *node;
-
-	while (n) {
-		node = rb_entry(n, struct binder_node, rb_node);
-
-		if (ptr < node->ptr)
-			n = n->rb_left;
-		else if (ptr > node->ptr)
-			n = n->rb_right;
-		else
-			return node;
-	}
-	return NULL;
-}
-
-static struct binder_node *binder_new_node(struct binder_proc *proc,
-					   void __user *ptr,
-					   void __user *cookie)
-{
-	struct rb_node **p = &proc->nodes.rb_node;
-	struct rb_node *parent = NULL;
-	struct binder_node *node;
-
-	while (*p) {
-		parent = *p;
-		node = rb_entry(parent, struct binder_node, rb_node);
-
-		if (ptr < node->ptr)
-			p = &(*p)->rb_left;
-		else if (ptr > node->ptr)
-			p = &(*p)->rb_right;
-		else
-			return NULL;
-	}
-
-	node = kzalloc(sizeof(*node), GFP_KERNEL);
-	if (node == NULL)
-		return NULL;
-	binder_stats_created(BINDER_STAT_NODE);
-	rb_link_node(&node->rb_node, parent, p);
-	rb_insert_color(&node->rb_node, &proc->nodes);
-	node->debug_id = ++binder_last_id;
-	node->proc = proc;
-	node->ptr = ptr;
-	node->cookie = cookie;
-	node->work.type = BINDER_WORK_NODE;
-	INIT_LIST_HEAD(&node->work.entry);
-	INIT_LIST_HEAD(&node->async_todo);
-	binder_debug(BINDER_DEBUG_INTERNAL_REFS,
-		     "binder: %d:%d node %d u%p c%p created\n",
-		     proc->pid, current->pid, node->debug_id,
-		     node->ptr, node->cookie);
-	return node;
-}
-
-static int binder_inc_node(struct binder_node *node, int strong, int internal,
-			   struct list_head *target_list)
-{
-	if (strong) {
-		if (internal) {
-			if (target_list == NULL &&
-			    node->internal_strong_refs == 0 &&
-			    !(node == binder_context_mgr_node &&
-			    node->has_strong_ref)) {
-				printk(KERN_ERR "binder: invalid inc strong "
-					"node for %d\n", node->debug_id);
-				return -EINVAL;
-			}
-			node->internal_strong_refs++;
-		} else
-			node->local_strong_refs++;
-		if (!node->has_strong_ref && target_list) {
-			list_del_init(&node->work.entry);
-			list_add_tail(&node->work.entry, target_list);
-		}
-	} else {
-		if (!internal)
-			node->local_weak_refs++;
-		if (!node->has_weak_ref && list_empty(&node->work.entry)) {
-			if (target_list == NULL) {
-				printk(KERN_ERR "binder: invalid inc weak node "
-					"for %d\n", node->debug_id);
-				return -EINVAL;
-			}
-			list_add_tail(&node->work.entry, target_list);
-		}
-	}
-	return 0;
-}
-
-static int binder_dec_node(struct binder_node *node, int strong, int internal)
-{
-	if (strong) {
-		if (internal)
-			node->internal_strong_refs--;
-		else
-			node->local_strong_refs--;
-		if (node->local_strong_refs || node->internal_strong_refs)
-			return 0;
-	} else {
-		if (!internal)
-			node->local_weak_refs--;
-		if (node->local_weak_refs || !hlist_empty(&node->refs))
-			return 0;
-	}
-	if (node->proc && (node->has_strong_ref || node->has_weak_ref)) {
-		if (list_empty(&node->work.entry)) {
-			list_add_tail(&node->work.entry, &node->proc->todo);
-			wake_up_interruptible(&node->proc->wait);
-		}
-	} else {
-		if (hlist_empty(&node->refs) && !node->local_strong_refs &&
-		    !node->local_weak_refs) {
-			list_del_init(&node->work.entry);
-			if (node->proc) {
-				rb_erase(&node->rb_node, &node->proc->nodes);
-				binder_debug(BINDER_DEBUG_INTERNAL_REFS,
-					     "binder: refless node %d deleted\n",
-					     node->debug_id);
-			} else {
-				hlist_del(&node->dead_node);
-				binder_debug(BINDER_DEBUG_INTERNAL_REFS,
-					     "binder: dead node %d deleted\n",
-					     node->debug_id);
-			}
-			kfree(node);
-			binder_stats_deleted(BINDER_STAT_NODE);
-		}
-	}
-
-	return 0;
-}
-
-
-static struct binder_ref *binder_get_ref(struct binder_proc *proc,
-					 uint32_t desc)
-{
-	struct rb_node *n = proc->refs_by_desc.rb_node;
-	struct binder_ref *ref;
-
-	while (n) {
-		ref = rb_entry(n, struct binder_ref, rb_node_desc);
-
-		if (desc < ref->desc)
-			n = n->rb_left;
-		else if (desc > ref->desc)
-			n = n->rb_right;
-		else
-			return ref;
-	}
-	return NULL;
-}
-
-static struct binder_ref *binder_get_ref_for_node(struct binder_proc *proc,
-						  struct binder_node *node)
-{
-	struct rb_node *n;
-	struct rb_node **p = &proc->refs_by_node.rb_node;
-	struct rb_node *parent = NULL;
-	struct binder_ref *ref, *new_ref;
-
-	while (*p) {
-		parent = *p;
-		ref = rb_entry(parent, struct binder_ref, rb_node_node);
-
-		if (node < ref->node)
-			p = &(*p)->rb_left;
-		else if (node > ref->node)
-			p = &(*p)->rb_right;
-		else
-			return ref;
-	}
-	new_ref = kzalloc(sizeof(*ref), GFP_KERNEL);
-	if (new_ref == NULL)
-		return NULL;
-	binder_stats_created(BINDER_STAT_REF);
-	new_ref->debug_id = ++binder_last_id;
-	new_ref->proc = proc;
-	new_ref->node = node;
-	rb_link_node(&new_ref->rb_node_node, parent, p);
-	rb_insert_color(&new_ref->rb_node_node, &proc->refs_by_node);
-
-	new_ref->desc = (node == binder_context_mgr_node) ? 0 : 1;
-	for (n = rb_first(&proc->refs_by_desc); n != NULL; n = rb_next(n)) {
-		ref = rb_entry(n, struct binder_ref, rb_node_desc);
-		if (ref->desc > new_ref->desc)
-			break;
-		new_ref->desc = ref->desc + 1;
-	}
-
-	p = &proc->refs_by_desc.rb_node;
-	while (*p) {
-		parent = *p;
-		ref = rb_entry(parent, struct binder_ref, rb_node_desc);
-
-		if (new_ref->desc < ref->desc)
-			p = &(*p)->rb_left;
-		else if (new_ref->desc > ref->desc)
-			p = &(*p)->rb_right;
-		else
-			BUG();
-	}
-	rb_link_node(&new_ref->rb_node_desc, parent, p);
-	rb_insert_color(&new_ref->rb_node_desc, &proc->refs_by_desc);
-	if (node) {
-		hlist_add_head(&new_ref->node_entry, &node->refs);
-
-		binder_debug(BINDER_DEBUG_INTERNAL_REFS,
-			     "binder: %d new ref %d desc %d for "
-			     "node %d\n", proc->pid, new_ref->debug_id,
-			     new_ref->desc, node->debug_id);
-	} else {
-		binder_debug(BINDER_DEBUG_INTERNAL_REFS,
-			     "binder: %d new ref %d desc %d for "
-			     "dead node\n", proc->pid, new_ref->debug_id,
-			      new_ref->desc);
-	}
-	return new_ref;
-}
-
-static void binder_delete_ref(struct binder_ref *ref)
-{
-	binder_debug(BINDER_DEBUG_INTERNAL_REFS,
-		     "binder: %d delete ref %d desc %d for "
-		     "node %d\n", ref->proc->pid, ref->debug_id,
-		     ref->desc, ref->node->debug_id);
-
-	rb_erase(&ref->rb_node_desc, &ref->proc->refs_by_desc);
-	rb_erase(&ref->rb_node_node, &ref->proc->refs_by_node);
-	if (ref->strong)
-		binder_dec_node(ref->node, 1, 1);
-	hlist_del(&ref->node_entry);
-	binder_dec_node(ref->node, 0, 1);
-	if (ref->death) {
-		binder_debug(BINDER_DEBUG_DEAD_BINDER,
-			     "binder: %d delete ref %d desc %d "
-			     "has death notification\n", ref->proc->pid,
-			     ref->debug_id, ref->desc);
-		list_del(&ref->death->work.entry);
-		kfree(ref->death);
-		binder_stats_deleted(BINDER_STAT_DEATH);
-	}
-	kfree(ref);
-	binder_stats_deleted(BINDER_STAT_REF);
-}
-
-static int binder_inc_ref(struct binder_ref *ref, int strong,
-			  struct list_head *target_list)
-{
-	int ret;
-	if (strong) {
-		if (ref->strong == 0) {
-			ret = binder_inc_node(ref->node, 1, 1, target_list);
-			if (ret)
-				return ret;
-		}
-		ref->strong++;
-	} else {
-		if (ref->weak == 0) {
-			ret = binder_inc_node(ref->node, 0, 1, target_list);
-			if (ret)
-				return ret;
-		}
-		ref->weak++;
-	}
-	return 0;
-}
-
-
-static int binder_dec_ref(struct binder_ref *ref, int strong)
-{
-	if (strong) {
-		if (ref->strong == 0) {
-			binder_user_error("binder: %d invalid dec strong, "
-					  "ref %d desc %d s %d w %d\n",
-					  ref->proc->pid, ref->debug_id,
-					  ref->desc, ref->strong, ref->weak);
-			return -EINVAL;
-		}
-		ref->strong--;
-		if (ref->strong == 0) {
-			int ret;
-			ret = binder_dec_node(ref->node, strong, 1);
-			if (ret)
-				return ret;
-		}
-	} else {
-		if (ref->weak == 0) {
-			binder_user_error("binder: %d invalid dec weak, "
-					  "ref %d desc %d s %d w %d\n",
-					  ref->proc->pid, ref->debug_id,
-					  ref->desc, ref->strong, ref->weak);
-			return -EINVAL;
-		}
-		ref->weak--;
-	}
-	if (ref->strong == 0 && ref->weak == 0)
-		binder_delete_ref(ref);
-	return 0;
-}
-
-static void binder_pop_transaction(struct binder_thread *target_thread,
-				   struct binder_transaction *t)
-{
-	if (target_thread) {
-		BUG_ON(target_thread->transaction_stack != t);
-		BUG_ON(target_thread->transaction_stack->from != target_thread);
-		target_thread->transaction_stack =
-			target_thread->transaction_stack->from_parent;
-		t->from = NULL;
-	}
-	t->need_reply = 0;
-	if (t->buffer)
-		t->buffer->transaction = NULL;
-	kfree(t);
-	binder_stats_deleted(BINDER_STAT_TRANSACTION);
-}
-
-static void binder_send_failed_reply(struct binder_transaction *t,
-				     uint32_t error_code)
-{
-	struct binder_thread *target_thread;
-	BUG_ON(t->flags & TF_ONE_WAY);
-	while (1) {
-		target_thread = t->from;
-		if (target_thread) {
-			if (target_thread->return_error != BR_OK &&
-			   target_thread->return_error2 == BR_OK) {
-				target_thread->return_error2 =
-					target_thread->return_error;
-				target_thread->return_error = BR_OK;
-			}
-			if (target_thread->return_error == BR_OK) {
-				binder_debug(BINDER_DEBUG_FAILED_TRANSACTION,
-					     "binder: send failed reply for "
-					     "transaction %d to %d:%d\n",
-					      t->debug_id, target_thread->proc->pid,
-					      target_thread->pid);
-
-				binder_pop_transaction(target_thread, t);
-				target_thread->return_error = error_code;
-				wake_up_interruptible(&target_thread->wait);
-			} else {
-				printk(KERN_ERR "binder: reply failed, target "
-					"thread, %d:%d, has error code %d "
-					"already\n", target_thread->proc->pid,
-					target_thread->pid,
-					target_thread->return_error);
-			}
-			return;
-		} else {
-			struct binder_transaction *next = t->from_parent;
-
-			binder_debug(BINDER_DEBUG_FAILED_TRANSACTION,
-				     "binder: send failed reply "
-				     "for transaction %d, target dead\n",
-				     t->debug_id);
-
-			binder_pop_transaction(target_thread, t);
-			if (next == NULL) {
-				binder_debug(BINDER_DEBUG_DEAD_BINDER,
-					     "binder: reply failed,"
-					     " no target thread at root\n");
-				return;
-			}
-			t = next;
-			binder_debug(BINDER_DEBUG_DEAD_BINDER,
-				     "binder: reply failed, no target "
-				     "thread -- retry %d\n", t->debug_id);
-		}
-	}
-}
-
-static void binder_transaction_buffer_release(struct binder_proc *proc,
-					      struct binder_buffer *buffer,
-					      size_t *failed_at)
-{
-	size_t *offp, *off_end;
-	int debug_id = buffer->debug_id;
-
-	binder_debug(BINDER_DEBUG_TRANSACTION,
-		     "binder: %d buffer release %d, size %zd-%zd, failed at %p\n",
-		     proc->pid, buffer->debug_id,
-		     buffer->data_size, buffer->offsets_size, failed_at);
-
-	if (buffer->target_node)
-		binder_dec_node(buffer->target_node, 1, 0);
-
-	offp = (size_t *)(buffer->data + ALIGN(buffer->data_size, sizeof(void *)));
-	if (failed_at)
-		off_end = failed_at;
-	else
-		off_end = (void *)offp + buffer->offsets_size;
-	for (; offp < off_end; offp++) {
-		struct flat_binder_object *fp;
-		if (*offp > buffer->data_size - sizeof(*fp) ||
-		    buffer->data_size < sizeof(*fp) ||
-		    !IS_ALIGNED(*offp, sizeof(void *))) {
-			printk(KERN_ERR "binder: transaction release %d bad"
-					"offset %zd, size %zd\n", debug_id,
-					*offp, buffer->data_size);
-			continue;
-		}
-		fp = (struct flat_binder_object *)(buffer->data + *offp);
-		switch (fp->type) {
-		case BINDER_TYPE_BINDER:
-		case BINDER_TYPE_WEAK_BINDER: {
-			struct binder_node *node = binder_get_node(proc, fp->binder);
-			if (node == NULL) {
-				printk(KERN_ERR "binder: transaction release %d"
-				       " bad node %p\n", debug_id, fp->binder);
-				break;
-			}
-			binder_debug(BINDER_DEBUG_TRANSACTION,
-				     "        node %d u%p\n",
-				     node->debug_id, node->ptr);
-			binder_dec_node(node, fp->type == BINDER_TYPE_BINDER, 0);
-		} break;
-		case BINDER_TYPE_HANDLE:
-		case BINDER_TYPE_WEAK_HANDLE: {
-			struct binder_ref *ref = binder_get_ref(proc, fp->handle);
-			if (ref == NULL) {
-				printk(KERN_ERR "binder: transaction release %d"
-				       " bad handle %ld\n", debug_id,
-				       fp->handle);
-				break;
-			}
-			binder_debug(BINDER_DEBUG_TRANSACTION,
-				     "        ref %d desc %d (node %d)\n",
-				     ref->debug_id, ref->desc, ref->node->debug_id);
-			binder_dec_ref(ref, fp->type == BINDER_TYPE_HANDLE);
-		} break;
-
-		case BINDER_TYPE_FD:
-			binder_debug(BINDER_DEBUG_TRANSACTION,
-				     "        fd %ld\n", fp->handle);
-			if (failed_at)
-				task_close_fd(proc, fp->handle);
-			break;
-
-		default:
-			printk(KERN_ERR "binder: transaction release %d bad "
-			       "object type %lx\n", debug_id, fp->type);
-			break;
-		}
-	}
-}
-
-static void binder_transaction(struct binder_proc *proc,
-			       struct binder_thread *thread,
-			       struct binder_transaction_data *tr, int reply)
-{
-	struct binder_transaction *t;
-	struct binder_work *tcomplete;
-	size_t *offp, *off_end;
-	struct binder_proc *target_proc;
-	struct binder_thread *target_thread = NULL;
-	struct binder_node *target_node = NULL;
-	struct list_head *target_list;
-	wait_queue_head_t *target_wait;
-	struct binder_transaction *in_reply_to = NULL;
-	struct binder_transaction_log_entry *e;
-	uint32_t return_error;
-
-	e = binder_transaction_log_add(&binder_transaction_log);
-	e->call_type = reply ? 2 : !!(tr->flags & TF_ONE_WAY);
-	e->from_proc = proc->pid;
-	e->from_thread = thread->pid;
-	e->target_handle = tr->target.handle;
-	e->data_size = tr->data_size;
-	e->offsets_size = tr->offsets_size;
-
-	if (reply) {
-		in_reply_to = thread->transaction_stack;
-		if (in_reply_to == NULL) {
-			binder_user_error("binder: %d:%d got reply transaction "
-					  "with no transaction stack\n",
-					  proc->pid, thread->pid);
-			return_error = BR_FAILED_REPLY;
-			goto err_empty_call_stack;
-		}
-		binder_set_nice(in_reply_to->saved_priority);
-		if (in_reply_to->to_thread != thread) {
-			binder_user_error("binder: %d:%d got reply transaction "
-				"with bad transaction stack,"
-				" transaction %d has target %d:%d\n",
-				proc->pid, thread->pid, in_reply_to->debug_id,
-				in_reply_to->to_proc ?
-				in_reply_to->to_proc->pid : 0,
-				in_reply_to->to_thread ?
-				in_reply_to->to_thread->pid : 0);
-			return_error = BR_FAILED_REPLY;
-			in_reply_to = NULL;
-			goto err_bad_call_stack;
-		}
-		thread->transaction_stack = in_reply_to->to_parent;
-		target_thread = in_reply_to->from;
-		if (target_thread == NULL) {
-			return_error = BR_DEAD_REPLY;
-			goto err_dead_binder;
-		}
-		if (target_thread->transaction_stack != in_reply_to) {
-			binder_user_error("binder: %d:%d got reply transaction "
-				"with bad target transaction stack %d, "
-				"expected %d\n",
-				proc->pid, thread->pid,
-				target_thread->transaction_stack ?
-				target_thread->transaction_stack->debug_id : 0,
-				in_reply_to->debug_id);
-			return_error = BR_FAILED_REPLY;
-			in_reply_to = NULL;
-			target_thread = NULL;
-			goto err_dead_binder;
-		}
-		target_proc = target_thread->proc;
-	} else {
-		if (tr->target.handle) {
-			struct binder_ref *ref;
-			ref = binder_get_ref(proc, tr->target.handle);
-			if (ref == NULL) {
-				binder_user_error("binder: %d:%d got "
-					"transaction to invalid handle\n",
-					proc->pid, thread->pid);
-				return_error = BR_FAILED_REPLY;
-				goto err_invalid_target_handle;
-			}
-			target_node = ref->node;
-		} else {
-			target_node = binder_context_mgr_node;
-			if (target_node == NULL) {
-				return_error = BR_DEAD_REPLY;
-				goto err_no_context_mgr_node;
-			}
-		}
-		e->to_node = target_node->debug_id;
-		target_proc = target_node->proc;
-		if (target_proc == NULL) {
-			return_error = BR_DEAD_REPLY;
-			goto err_dead_binder;
-		}
-		if (!(tr->flags & TF_ONE_WAY) && thread->transaction_stack) {
-			struct binder_transaction *tmp;
-			tmp = thread->transaction_stack;
-			if (tmp->to_thread != thread) {
-				binder_user_error("binder: %d:%d got new "
-					"transaction with bad transaction stack"
-					", transaction %d has target %d:%d\n",
-					proc->pid, thread->pid, tmp->debug_id,
-					tmp->to_proc ? tmp->to_proc->pid : 0,
-					tmp->to_thread ?
-					tmp->to_thread->pid : 0);
-				return_error = BR_FAILED_REPLY;
-				goto err_bad_call_stack;
-			}
-			while (tmp) {
-				if (tmp->from && tmp->from->proc == target_proc)
-					target_thread = tmp->from;
-				tmp = tmp->from_parent;
-			}
-		}
-	}
-	if (target_thread) {
-		e->to_thread = target_thread->pid;
-		target_list = &target_thread->todo;
-		target_wait = &target_thread->wait;
-	} else {
-		target_list = &target_proc->todo;
-		target_wait = &target_proc->wait;
-	}
-	e->to_proc = target_proc->pid;
-
-	/* TODO: reuse incoming transaction for reply */
-	t = kzalloc(sizeof(*t), GFP_KERNEL);
-	if (t == NULL) {
-		return_error = BR_FAILED_REPLY;
-		goto err_alloc_t_failed;
-	}
-	binder_stats_created(BINDER_STAT_TRANSACTION);
-
-	tcomplete = kzalloc(sizeof(*tcomplete), GFP_KERNEL);
-	if (tcomplete == NULL) {
-		return_error = BR_FAILED_REPLY;
-		goto err_alloc_tcomplete_failed;
-	}
-	binder_stats_created(BINDER_STAT_TRANSACTION_COMPLETE);
-
-	t->debug_id = ++binder_last_id;
-	e->debug_id = t->debug_id;
-
-	if (reply)
-		binder_debug(BINDER_DEBUG_TRANSACTION,
-			     "binder: %d:%d BC_REPLY %d -> %d:%d, "
-			     "data %p-%p size %zd-%zd\n",
-			     proc->pid, thread->pid, t->debug_id,
-			     target_proc->pid, target_thread->pid,
-			     tr->data.ptr.buffer, tr->data.ptr.offsets,
-			     tr->data_size, tr->offsets_size);
-	else
-		binder_debug(BINDER_DEBUG_TRANSACTION,
-			     "binder: %d:%d BC_TRANSACTION %d -> "
-			     "%d - node %d, data %p-%p size %zd-%zd\n",
-			     proc->pid, thread->pid, t->debug_id,
-			     target_proc->pid, target_node->debug_id,
-			     tr->data.ptr.buffer, tr->data.ptr.offsets,
-			     tr->data_size, tr->offsets_size);
-
-	if (!reply && !(tr->flags & TF_ONE_WAY))
-		t->from = thread;
-	else
-		t->from = NULL;
-	t->sender_euid = proc->tsk->cred->euid;
-	t->to_proc = target_proc;
-	t->to_thread = target_thread;
-	t->code = tr->code;
-	t->flags = tr->flags;
-	t->priority = task_nice(current);
-	t->buffer = binder_alloc_buf(target_proc, tr->data_size,
-		tr->offsets_size, !reply && (t->flags & TF_ONE_WAY));
-	if (t->buffer == NULL) {
-		return_error = BR_FAILED_REPLY;
-		goto err_binder_alloc_buf_failed;
-	}
-	t->buffer->allow_user_free = 0;
-	t->buffer->debug_id = t->debug_id;
-	t->buffer->transaction = t;
-	t->buffer->target_node = target_node;
-	if (target_node)
-		binder_inc_node(target_node, 1, 0, NULL);
-
-	offp = (size_t *)(t->buffer->data + ALIGN(tr->data_size, sizeof(void *)));
-
-	if (copy_from_user(t->buffer->data, tr->data.ptr.buffer, tr->data_size)) {
-		binder_user_error("binder: %d:%d got transaction with invalid "
-			"data ptr\n", proc->pid, thread->pid);
-		return_error = BR_FAILED_REPLY;
-		goto err_copy_data_failed;
-	}
-	if (copy_from_user(offp, tr->data.ptr.offsets, tr->offsets_size)) {
-		binder_user_error("binder: %d:%d got transaction with invalid "
-			"offsets ptr\n", proc->pid, thread->pid);
-		return_error = BR_FAILED_REPLY;
-		goto err_copy_data_failed;
-	}
-	if (!IS_ALIGNED(tr->offsets_size, sizeof(size_t))) {
-		binder_user_error("binder: %d:%d got transaction with "
-			"invalid offsets size, %zd\n",
-			proc->pid, thread->pid, tr->offsets_size);
-		return_error = BR_FAILED_REPLY;
-		goto err_bad_offset;
-	}
-	off_end = (void *)offp + tr->offsets_size;
-	for (; offp < off_end; offp++) {
-		struct flat_binder_object *fp;
-		if (*offp > t->buffer->data_size - sizeof(*fp) ||
-		    t->buffer->data_size < sizeof(*fp) ||
-		    !IS_ALIGNED(*offp, sizeof(void *))) {
-			binder_user_error("binder: %d:%d got transaction with "
-				"invalid offset, %zd\n",
-				proc->pid, thread->pid, *offp);
-			return_error = BR_FAILED_REPLY;
-			goto err_bad_offset;
-		}
-		fp = (struct flat_binder_object *)(t->buffer->data + *offp);
-		switch (fp->type) {
-		case BINDER_TYPE_BINDER:
-		case BINDER_TYPE_WEAK_BINDER: {
-			struct binder_ref *ref;
-			struct binder_node *node = binder_get_node(proc, fp->binder);
-			if (node == NULL) {
-				node = binder_new_node(proc, fp->binder, fp->cookie);
-				if (node == NULL) {
-					return_error = BR_FAILED_REPLY;
-					goto err_binder_new_node_failed;
-				}
-				node->min_priority = fp->flags & FLAT_BINDER_FLAG_PRIORITY_MASK;
-				node->accept_fds = !!(fp->flags & FLAT_BINDER_FLAG_ACCEPTS_FDS);
-			}
-			if (fp->cookie != node->cookie) {
-				binder_user_error("binder: %d:%d sending u%p "
-					"node %d, cookie mismatch %p != %p\n",
-					proc->pid, thread->pid,
-					fp->binder, node->debug_id,
-					fp->cookie, node->cookie);
-				goto err_binder_get_ref_for_node_failed;
-			}
-			ref = binder_get_ref_for_node(target_proc, node);
-			if (ref == NULL) {
-				return_error = BR_FAILED_REPLY;
-				goto err_binder_get_ref_for_node_failed;
-			}
-			if (fp->type == BINDER_TYPE_BINDER)
-				fp->type = BINDER_TYPE_HANDLE;
-			else
-				fp->type = BINDER_TYPE_WEAK_HANDLE;
-			fp->handle = ref->desc;
-			binder_inc_ref(ref, fp->type == BINDER_TYPE_HANDLE,
-				       &thread->todo);
-
-			binder_debug(BINDER_DEBUG_TRANSACTION,
-				     "        node %d u%p -> ref %d desc %d\n",
-				     node->debug_id, node->ptr, ref->debug_id,
-				     ref->desc);
-		} break;
-		case BINDER_TYPE_HANDLE:
-		case BINDER_TYPE_WEAK_HANDLE: {
-			struct binder_ref *ref = binder_get_ref(proc, fp->handle);
-			if (ref == NULL) {
-				binder_user_error("binder: %d:%d got "
-					"transaction with invalid "
-					"handle, %ld\n", proc->pid,
-					thread->pid, fp->handle);
-				return_error = BR_FAILED_REPLY;
-				goto err_binder_get_ref_failed;
-			}
-			if (ref->node->proc == target_proc) {
-				if (fp->type == BINDER_TYPE_HANDLE)
-					fp->type = BINDER_TYPE_BINDER;
-				else
-					fp->type = BINDER_TYPE_WEAK_BINDER;
-				fp->binder = ref->node->ptr;
-				fp->cookie = ref->node->cookie;
-				binder_inc_node(ref->node, fp->type == BINDER_TYPE_BINDER, 0, NULL);
-				binder_debug(BINDER_DEBUG_TRANSACTION,
-					     "        ref %d desc %d -> node %d u%p\n",
-					     ref->debug_id, ref->desc, ref->node->debug_id,
-					     ref->node->ptr);
-			} else {
-				struct binder_ref *new_ref;
-				new_ref = binder_get_ref_for_node(target_proc, ref->node);
-				if (new_ref == NULL) {
-					return_error = BR_FAILED_REPLY;
-					goto err_binder_get_ref_for_node_failed;
-				}
-				fp->handle = new_ref->desc;
-				binder_inc_ref(new_ref, fp->type == BINDER_TYPE_HANDLE, NULL);
-				binder_debug(BINDER_DEBUG_TRANSACTION,
-					     "        ref %d desc %d -> ref %d desc %d (node %d)\n",
-					     ref->debug_id, ref->desc, new_ref->debug_id,
-					     new_ref->desc, ref->node->debug_id);
-			}
-		} break;
-
-		case BINDER_TYPE_FD: {
-			int target_fd;
-			struct file *file;
-
-			if (reply) {
-				if (!(in_reply_to->flags & TF_ACCEPT_FDS)) {
-					binder_user_error("binder: %d:%d got reply with fd, %ld, but target does not allow fds\n",
-						proc->pid, thread->pid, fp->handle);
-					return_error = BR_FAILED_REPLY;
-					goto err_fd_not_allowed;
-				}
-			} else if (!target_node->accept_fds) {
-				binder_user_error("binder: %d:%d got transaction with fd, %ld, but target does not allow fds\n",
-					proc->pid, thread->pid, fp->handle);
-				return_error = BR_FAILED_REPLY;
-				goto err_fd_not_allowed;
-			}
-
-			file = fget(fp->handle);
-			if (file == NULL) {
-				binder_user_error("binder: %d:%d got transaction with invalid fd, %ld\n",
-					proc->pid, thread->pid, fp->handle);
-				return_error = BR_FAILED_REPLY;
-				goto err_fget_failed;
-			}
-			target_fd = task_get_unused_fd_flags(target_proc, O_CLOEXEC);
-			if (target_fd < 0) {
-				fput(file);
-				return_error = BR_FAILED_REPLY;
-				goto err_get_unused_fd_failed;
-			}
-			task_fd_install(target_proc, target_fd, file);
-			binder_debug(BINDER_DEBUG_TRANSACTION,
-				     "        fd %ld -> %d\n", fp->handle, target_fd);
-			/* TODO: fput? */
-			fp->handle = target_fd;
-		} break;
-
-		default:
-			binder_user_error("binder: %d:%d got transactio"
-				"n with invalid object type, %lx\n",
-				proc->pid, thread->pid, fp->type);
-			return_error = BR_FAILED_REPLY;
-			goto err_bad_object_type;
-		}
-	}
-	if (reply) {
-		BUG_ON(t->buffer->async_transaction != 0);
-		binder_pop_transaction(target_thread, in_reply_to);
-	} else if (!(t->flags & TF_ONE_WAY)) {
-		BUG_ON(t->buffer->async_transaction != 0);
-		t->need_reply = 1;
-		t->from_parent = thread->transaction_stack;
-		thread->transaction_stack = t;
-	} else {
-		BUG_ON(target_node == NULL);
-		BUG_ON(t->buffer->async_transaction != 1);
-		if (target_node->has_async_transaction) {
-			target_list = &target_node->async_todo;
-			target_wait = NULL;
-		} else
-			target_node->has_async_transaction = 1;
-	}
-	t->work.type = BINDER_WORK_TRANSACTION;
-	list_add_tail(&t->work.entry, target_list);
-	tcomplete->type = BINDER_WORK_TRANSACTION_COMPLETE;
-	list_add_tail(&tcomplete->entry, &thread->todo);
-	if (target_wait)
-		wake_up_interruptible(target_wait);
-	return;
-
-err_get_unused_fd_failed:
-err_fget_failed:
-err_fd_not_allowed:
-err_binder_get_ref_for_node_failed:
-err_binder_get_ref_failed:
-err_binder_new_node_failed:
-err_bad_object_type:
-err_bad_offset:
-err_copy_data_failed:
-	binder_transaction_buffer_release(target_proc, t->buffer, offp);
-	t->buffer->transaction = NULL;
-	binder_free_buf(target_proc, t->buffer);
-err_binder_alloc_buf_failed:
-	kfree(tcomplete);
-	binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE);
-err_alloc_tcomplete_failed:
-	kfree(t);
-	binder_stats_deleted(BINDER_STAT_TRANSACTION);
-err_alloc_t_failed:
-err_bad_call_stack:
-err_empty_call_stack:
-err_dead_binder:
-err_invalid_target_handle:
-err_no_context_mgr_node:
-	binder_debug(BINDER_DEBUG_FAILED_TRANSACTION,
-		     "binder: %d:%d transaction failed %d, size %zd-%zd\n",
-		     proc->pid, thread->pid, return_error,
-		     tr->data_size, tr->offsets_size);
-
-	{
-		struct binder_transaction_log_entry *fe;
-		fe = binder_transaction_log_add(&binder_transaction_log_failed);
-		*fe = *e;
-	}
-
-	BUG_ON(thread->return_error != BR_OK);
-	if (in_reply_to) {
-		thread->return_error = BR_TRANSACTION_COMPLETE;
-		binder_send_failed_reply(in_reply_to, return_error);
-	} else
-		thread->return_error = return_error;
-}
-
-int binder_thread_write(struct binder_proc *proc, struct binder_thread *thread,
-			void __user *buffer, int size, signed long *consumed)
-{
-	uint32_t cmd;
-	void __user *ptr = buffer + *consumed;
-	void __user *end = buffer + size;
-
-	while (ptr < end && thread->return_error == BR_OK) {
-		if (get_user(cmd, (uint32_t __user *)ptr))
-			return -EFAULT;
-		ptr += sizeof(uint32_t);
-		if (_IOC_NR(cmd) < ARRAY_SIZE(binder_stats.bc)) {
-			binder_stats.bc[_IOC_NR(cmd)]++;
-			proc->stats.bc[_IOC_NR(cmd)]++;
-			thread->stats.bc[_IOC_NR(cmd)]++;
-		}
-		switch (cmd) {
-		case BC_INCREFS:
-		case BC_ACQUIRE:
-		case BC_RELEASE:
-		case BC_DECREFS: {
-			uint32_t target;
-			struct binder_ref *ref;
-			const char *debug_string;
-
-			if (get_user(target, (uint32_t __user *)ptr))
-				return -EFAULT;
-			ptr += sizeof(uint32_t);
-			if (target == 0 && binder_context_mgr_node &&
-			    (cmd == BC_INCREFS || cmd == BC_ACQUIRE)) {
-				ref = binder_get_ref_for_node(proc,
-					       binder_context_mgr_node);
-				if (ref->desc != target) {
-					binder_user_error("binder: %d:"
-						"%d tried to acquire "
-						"reference to desc 0, "
-						"got %d instead\n",
-						proc->pid, thread->pid,
-						ref->desc);
-				}
-			} else
-				ref = binder_get_ref(proc, target);
-			if (ref == NULL) {
-				binder_user_error("binder: %d:%d refcou"
-					"nt change on invalid ref %d\n",
-					proc->pid, thread->pid, target);
-				break;
-			}
-			switch (cmd) {
-			case BC_INCREFS:
-				debug_string = "IncRefs";
-				binder_inc_ref(ref, 0, NULL);
-				break;
-			case BC_ACQUIRE:
-				debug_string = "Acquire";
-				binder_inc_ref(ref, 1, NULL);
-				break;
-			case BC_RELEASE:
-				debug_string = "Release";
-				binder_dec_ref(ref, 1);
-				break;
-			case BC_DECREFS:
-			default:
-				debug_string = "DecRefs";
-				binder_dec_ref(ref, 0);
-				break;
-			}
-			binder_debug(BINDER_DEBUG_USER_REFS,
-				     "binder: %d:%d %s ref %d desc %d s %d w %d for node %d\n",
-				     proc->pid, thread->pid, debug_string, ref->debug_id,
-				     ref->desc, ref->strong, ref->weak, ref->node->debug_id);
-			break;
-		}
-		case BC_INCREFS_DONE:
-		case BC_ACQUIRE_DONE: {
-			void __user *node_ptr;
-			void *cookie;
-			struct binder_node *node;
-
-			if (get_user(node_ptr, (void * __user *)ptr))
-				return -EFAULT;
-			ptr += sizeof(void *);
-			if (get_user(cookie, (void * __user *)ptr))
-				return -EFAULT;
-			ptr += sizeof(void *);
-			node = binder_get_node(proc, node_ptr);
-			if (node == NULL) {
-				binder_user_error("binder: %d:%d "
-					"%s u%p no match\n",
-					proc->pid, thread->pid,
-					cmd == BC_INCREFS_DONE ?
-					"BC_INCREFS_DONE" :
-					"BC_ACQUIRE_DONE",
-					node_ptr);
-				break;
-			}
-			if (cookie != node->cookie) {
-				binder_user_error("binder: %d:%d %s u%p node %d"
-					" cookie mismatch %p != %p\n",
-					proc->pid, thread->pid,
-					cmd == BC_INCREFS_DONE ?
-					"BC_INCREFS_DONE" : "BC_ACQUIRE_DONE",
-					node_ptr, node->debug_id,
-					cookie, node->cookie);
-				break;
-			}
-			if (cmd == BC_ACQUIRE_DONE) {
-				if (node->pending_strong_ref == 0) {
-					binder_user_error("binder: %d:%d "
-						"BC_ACQUIRE_DONE node %d has "
-						"no pending acquire request\n",
-						proc->pid, thread->pid,
-						node->debug_id);
-					break;
-				}
-				node->pending_strong_ref = 0;
-			} else {
-				if (node->pending_weak_ref == 0) {
-					binder_user_error("binder: %d:%d "
-						"BC_INCREFS_DONE node %d has "
-						"no pending increfs request\n",
-						proc->pid, thread->pid,
-						node->debug_id);
-					break;
-				}
-				node->pending_weak_ref = 0;
-			}
-			binder_dec_node(node, cmd == BC_ACQUIRE_DONE, 0);
-			binder_debug(BINDER_DEBUG_USER_REFS,
-				     "binder: %d:%d %s node %d ls %d lw %d\n",
-				     proc->pid, thread->pid,
-				     cmd == BC_INCREFS_DONE ? "BC_INCREFS_DONE" : "BC_ACQUIRE_DONE",
-				     node->debug_id, node->local_strong_refs, node->local_weak_refs);
-			break;
-		}
-		case BC_ATTEMPT_ACQUIRE:
-			printk(KERN_ERR "binder: BC_ATTEMPT_ACQUIRE not supported\n");
-			return -EINVAL;
-		case BC_ACQUIRE_RESULT:
-			printk(KERN_ERR "binder: BC_ACQUIRE_RESULT not supported\n");
-			return -EINVAL;
-
-		case BC_FREE_BUFFER: {
-			void __user *data_ptr;
-			struct binder_buffer *buffer;
-
-			if (get_user(data_ptr, (void * __user *)ptr))
-				return -EFAULT;
-			ptr += sizeof(void *);
-
-			buffer = binder_buffer_lookup(proc, data_ptr);
-			if (buffer == NULL) {
-				binder_user_error("binder: %d:%d "
-					"BC_FREE_BUFFER u%p no match\n",
-					proc->pid, thread->pid, data_ptr);
-				break;
-			}
-			if (!buffer->allow_user_free) {
-				binder_user_error("binder: %d:%d "
-					"BC_FREE_BUFFER u%p matched "
-					"unreturned buffer\n",
-					proc->pid, thread->pid, data_ptr);
-				break;
-			}
-			binder_debug(BINDER_DEBUG_FREE_BUFFER,
-				     "binder: %d:%d BC_FREE_BUFFER u%p found buffer %d for %s transaction\n",
-				     proc->pid, thread->pid, data_ptr, buffer->debug_id,
-				     buffer->transaction ? "active" : "finished");
-
-			if (buffer->transaction) {
-				buffer->transaction->buffer = NULL;
-				buffer->transaction = NULL;
-			}
-			if (buffer->async_transaction && buffer->target_node) {
-				BUG_ON(!buffer->target_node->has_async_transaction);
-				if (list_empty(&buffer->target_node->async_todo))
-					buffer->target_node->has_async_transaction = 0;
-				else
-					list_move_tail(buffer->target_node->async_todo.next, &thread->todo);
-			}
-			binder_transaction_buffer_release(proc, buffer, NULL);
-			binder_free_buf(proc, buffer);
-			break;
-		}
-
-		case BC_TRANSACTION:
-		case BC_REPLY: {
-			struct binder_transaction_data tr;
-
-			if (copy_from_user(&tr, ptr, sizeof(tr)))
-				return -EFAULT;
-			ptr += sizeof(tr);
-			binder_transaction(proc, thread, &tr, cmd == BC_REPLY);
-			break;
-		}
-
-		case BC_REGISTER_LOOPER:
-			binder_debug(BINDER_DEBUG_THREADS,
-				     "binder: %d:%d BC_REGISTER_LOOPER\n",
-				     proc->pid, thread->pid);
-			if (thread->looper & BINDER_LOOPER_STATE_ENTERED) {
-				thread->looper |= BINDER_LOOPER_STATE_INVALID;
-				binder_user_error("binder: %d:%d ERROR:"
-					" BC_REGISTER_LOOPER called "
-					"after BC_ENTER_LOOPER\n",
-					proc->pid, thread->pid);
-			} else if (proc->requested_threads == 0) {
-				thread->looper |= BINDER_LOOPER_STATE_INVALID;
-				binder_user_error("binder: %d:%d ERROR:"
-					" BC_REGISTER_LOOPER called "
-					"without request\n",
-					proc->pid, thread->pid);
-			} else {
-				proc->requested_threads--;
-				proc->requested_threads_started++;
-			}
-			thread->looper |= BINDER_LOOPER_STATE_REGISTERED;
-			break;
-		case BC_ENTER_LOOPER:
-			binder_debug(BINDER_DEBUG_THREADS,
-				     "binder: %d:%d BC_ENTER_LOOPER\n",
-				     proc->pid, thread->pid);
-			if (thread->looper & BINDER_LOOPER_STATE_REGISTERED) {
-				thread->looper |= BINDER_LOOPER_STATE_INVALID;
-				binder_user_error("binder: %d:%d ERROR:"
-					" BC_ENTER_LOOPER called after "
-					"BC_REGISTER_LOOPER\n",
-					proc->pid, thread->pid);
-			}
-			thread->looper |= BINDER_LOOPER_STATE_ENTERED;
-			break;
-		case BC_EXIT_LOOPER:
-			binder_debug(BINDER_DEBUG_THREADS,
-				     "binder: %d:%d BC_EXIT_LOOPER\n",
-				     proc->pid, thread->pid);
-			thread->looper |= BINDER_LOOPER_STATE_EXITED;
-			break;
-
-		case BC_REQUEST_DEATH_NOTIFICATION:
-		case BC_CLEAR_DEATH_NOTIFICATION: {
-			uint32_t target;
-			void __user *cookie;
-			struct binder_ref *ref;
-			struct binder_ref_death *death;
-
-			if (get_user(target, (uint32_t __user *)ptr))
-				return -EFAULT;
-			ptr += sizeof(uint32_t);
-			if (get_user(cookie, (void __user * __user *)ptr))
-				return -EFAULT;
-			ptr += sizeof(void *);
-			ref = binder_get_ref(proc, target);
-			if (ref == NULL) {
-				binder_user_error("binder: %d:%d %s "
-					"invalid ref %d\n",
-					proc->pid, thread->pid,
-					cmd == BC_REQUEST_DEATH_NOTIFICATION ?
-					"BC_REQUEST_DEATH_NOTIFICATION" :
-					"BC_CLEAR_DEATH_NOTIFICATION",
-					target);
-				break;
-			}
-
-			binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION,
-				     "binder: %d:%d %s %p ref %d desc %d s %d w %d for node %d\n",
-				     proc->pid, thread->pid,
-				     cmd == BC_REQUEST_DEATH_NOTIFICATION ?
-				     "BC_REQUEST_DEATH_NOTIFICATION" :
-				     "BC_CLEAR_DEATH_NOTIFICATION",
-				     cookie, ref->debug_id, ref->desc,
-				     ref->strong, ref->weak, ref->node->debug_id);
-
-			if (cmd == BC_REQUEST_DEATH_NOTIFICATION) {
-				if (ref->death) {
-					binder_user_error("binder: %d:%"
-						"d BC_REQUEST_DEATH_NOTI"
-						"FICATION death notific"
-						"ation already set\n",
-						proc->pid, thread->pid);
-					break;
-				}
-				death = kzalloc(sizeof(*death), GFP_KERNEL);
-				if (death == NULL) {
-					thread->return_error = BR_ERROR;
-					binder_debug(BINDER_DEBUG_FAILED_TRANSACTION,
-						     "binder: %d:%d "
-						     "BC_REQUEST_DEATH_NOTIFICATION failed\n",
-						     proc->pid, thread->pid);
-					break;
-				}
-				binder_stats_created(BINDER_STAT_DEATH);
-				INIT_LIST_HEAD(&death->work.entry);
-				death->cookie = cookie;
-				ref->death = death;
-				if (ref->node->proc == NULL) {
-					ref->death->work.type = BINDER_WORK_DEAD_BINDER;
-					if (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | BINDER_LOOPER_STATE_ENTERED)) {
-						list_add_tail(&ref->death->work.entry, &thread->todo);
-					} else {
-						list_add_tail(&ref->death->work.entry, &proc->todo);
-						wake_up_interruptible(&proc->wait);
-					}
-				}
-			} else {
-				if (ref->death == NULL) {
-					binder_user_error("binder: %d:%"
-						"d BC_CLEAR_DEATH_NOTIFI"
-						"CATION death notificat"
-						"ion not active\n",
-						proc->pid, thread->pid);
-					break;
-				}
-				death = ref->death;
-				if (death->cookie != cookie) {
-					binder_user_error("binder: %d:%"
-						"d BC_CLEAR_DEATH_NOTIFI"
-						"CATION death notificat"
-						"ion cookie mismatch "
-						"%p != %p\n",
-						proc->pid, thread->pid,
-						death->cookie, cookie);
-					break;
-				}
-				ref->death = NULL;
-				if (list_empty(&death->work.entry)) {
-					death->work.type = BINDER_WORK_CLEAR_DEATH_NOTIFICATION;
-					if (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | BINDER_LOOPER_STATE_ENTERED)) {
-						list_add_tail(&death->work.entry, &thread->todo);
-					} else {
-						list_add_tail(&death->work.entry, &proc->todo);
-						wake_up_interruptible(&proc->wait);
-					}
-				} else {
-					BUG_ON(death->work.type != BINDER_WORK_DEAD_BINDER);
-					death->work.type = BINDER_WORK_DEAD_BINDER_AND_CLEAR;
-				}
-			}
-		} break;
-		case BC_DEAD_BINDER_DONE: {
-			struct binder_work *w;
-			void __user *cookie;
-			struct binder_ref_death *death = NULL;
-			if (get_user(cookie, (void __user * __user *)ptr))
-				return -EFAULT;
-
-			ptr += sizeof(void *);
-			list_for_each_entry(w, &proc->delivered_death, entry) {
-				struct binder_ref_death *tmp_death = container_of(w, struct binder_ref_death, work);
-				if (tmp_death->cookie == cookie) {
-					death = tmp_death;
-					break;
-				}
-			}
-			binder_debug(BINDER_DEBUG_DEAD_BINDER,
-				     "binder: %d:%d BC_DEAD_BINDER_DONE %p found %p\n",
-				     proc->pid, thread->pid, cookie, death);
-			if (death == NULL) {
-				binder_user_error("binder: %d:%d BC_DEAD"
-					"_BINDER_DONE %p not found\n",
-					proc->pid, thread->pid, cookie);
-				break;
-			}
-
-			list_del_init(&death->work.entry);
-			if (death->work.type == BINDER_WORK_DEAD_BINDER_AND_CLEAR) {
-				death->work.type = BINDER_WORK_CLEAR_DEATH_NOTIFICATION;
-				if (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | BINDER_LOOPER_STATE_ENTERED)) {
-					list_add_tail(&death->work.entry, &thread->todo);
-				} else {
-					list_add_tail(&death->work.entry, &proc->todo);
-					wake_up_interruptible(&proc->wait);
-				}
-			}
-		} break;
-
-		default:
-			printk(KERN_ERR "binder: %d:%d unknown command %d\n",
-			       proc->pid, thread->pid, cmd);
-			return -EINVAL;
-		}
-		*consumed = ptr - buffer;
-	}
-	return 0;
-}
-
-void binder_stat_br(struct binder_proc *proc, struct binder_thread *thread,
-		    uint32_t cmd)
-{
-	if (_IOC_NR(cmd) < ARRAY_SIZE(binder_stats.br)) {
-		binder_stats.br[_IOC_NR(cmd)]++;
-		proc->stats.br[_IOC_NR(cmd)]++;
-		thread->stats.br[_IOC_NR(cmd)]++;
-	}
-}
-
-static int binder_has_proc_work(struct binder_proc *proc,
-				struct binder_thread *thread)
-{
-	return !list_empty(&proc->todo) ||
-		(thread->looper & BINDER_LOOPER_STATE_NEED_RETURN);
-}
-
-static int binder_has_thread_work(struct binder_thread *thread)
-{
-	return !list_empty(&thread->todo) || thread->return_error != BR_OK ||
-		(thread->looper & BINDER_LOOPER_STATE_NEED_RETURN);
-}
-
-static int binder_thread_read(struct binder_proc *proc,
-			      struct binder_thread *thread,
-			      void  __user *buffer, int size,
-			      signed long *consumed, int non_block)
-{
-	void __user *ptr = buffer + *consumed;
-	void __user *end = buffer + size;
-
-	int ret = 0;
-	int wait_for_proc_work;
-
-	if (*consumed == 0) {
-		if (put_user(BR_NOOP, (uint32_t __user *)ptr))
-			return -EFAULT;
-		ptr += sizeof(uint32_t);
-	}
-
-retry:
-	wait_for_proc_work = thread->transaction_stack == NULL &&
-				list_empty(&thread->todo);
-
-	if (thread->return_error != BR_OK && ptr < end) {
-		if (thread->return_error2 != BR_OK) {
-			if (put_user(thread->return_error2, (uint32_t __user *)ptr))
-				return -EFAULT;
-			ptr += sizeof(uint32_t);
-			if (ptr == end)
-				goto done;
-			thread->return_error2 = BR_OK;
-		}
-		if (put_user(thread->return_error, (uint32_t __user *)ptr))
-			return -EFAULT;
-		ptr += sizeof(uint32_t);
-		thread->return_error = BR_OK;
-		goto done;
-	}
-
-
-	thread->looper |= BINDER_LOOPER_STATE_WAITING;
-	if (wait_for_proc_work)
-		proc->ready_threads++;
-	mutex_unlock(&binder_lock);
-	if (wait_for_proc_work) {
-		if (!(thread->looper & (BINDER_LOOPER_STATE_REGISTERED |
-					BINDER_LOOPER_STATE_ENTERED))) {
-			binder_user_error("binder: %d:%d ERROR: Thread waiting "
-				"for process work before calling BC_REGISTER_"
-				"LOOPER or BC_ENTER_LOOPER (state %x)\n",
-				proc->pid, thread->pid, thread->looper);
-			wait_event_interruptible(binder_user_error_wait,
-						 binder_stop_on_user_error < 2);
-		}
-		binder_set_nice(proc->default_priority);
-		if (non_block) {
-			if (!binder_has_proc_work(proc, thread))
-				ret = -EAGAIN;
-		} else
-			ret = wait_event_interruptible_exclusive(proc->wait, binder_has_proc_work(proc, thread));
-	} else {
-		if (non_block) {
-			if (!binder_has_thread_work(thread))
-				ret = -EAGAIN;
-		} else
-			ret = wait_event_interruptible(thread->wait, binder_has_thread_work(thread));
-	}
-	mutex_lock(&binder_lock);
-	if (wait_for_proc_work)
-		proc->ready_threads--;
-	thread->looper &= ~BINDER_LOOPER_STATE_WAITING;
-
-	if (ret)
-		return ret;
-
-	while (1) {
-		uint32_t cmd;
-		struct binder_transaction_data tr;
-		struct binder_work *w;
-		struct binder_transaction *t = NULL;
-
-		if (!list_empty(&thread->todo))
-			w = list_first_entry(&thread->todo, struct binder_work, entry);
-		else if (!list_empty(&proc->todo) && wait_for_proc_work)
-			w = list_first_entry(&proc->todo, struct binder_work, entry);
-		else {
-			if (ptr - buffer == 4 && !(thread->looper & BINDER_LOOPER_STATE_NEED_RETURN)) /* no data added */
-				goto retry;
-			break;
-		}
-
-		if (end - ptr < sizeof(tr) + 4)
-			break;
-
-		switch (w->type) {
-		case BINDER_WORK_TRANSACTION: {
-			t = container_of(w, struct binder_transaction, work);
-		} break;
-		case BINDER_WORK_TRANSACTION_COMPLETE: {
-			cmd = BR_TRANSACTION_COMPLETE;
-			if (put_user(cmd, (uint32_t __user *)ptr))
-				return -EFAULT;
-			ptr += sizeof(uint32_t);
-
-			binder_stat_br(proc, thread, cmd);
-			binder_debug(BINDER_DEBUG_TRANSACTION_COMPLETE,
-				     "binder: %d:%d BR_TRANSACTION_COMPLETE\n",
-				     proc->pid, thread->pid);
-
-			list_del(&w->entry);
-			kfree(w);
-			binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE);
-		} break;
-		case BINDER_WORK_NODE: {
-			struct binder_node *node = container_of(w, struct binder_node, work);
-			uint32_t cmd = BR_NOOP;
-			const char *cmd_name;
-			int strong = node->internal_strong_refs || node->local_strong_refs;
-			int weak = !hlist_empty(&node->refs) || node->local_weak_refs || strong;
-			if (weak && !node->has_weak_ref) {
-				cmd = BR_INCREFS;
-				cmd_name = "BR_INCREFS";
-				node->has_weak_ref = 1;
-				node->pending_weak_ref = 1;
-				node->local_weak_refs++;
-			} else if (strong && !node->has_strong_ref) {
-				cmd = BR_ACQUIRE;
-				cmd_name = "BR_ACQUIRE";
-				node->has_strong_ref = 1;
-				node->pending_strong_ref = 1;
-				node->local_strong_refs++;
-			} else if (!strong && node->has_strong_ref) {
-				cmd = BR_RELEASE;
-				cmd_name = "BR_RELEASE";
-				node->has_strong_ref = 0;
-			} else if (!weak && node->has_weak_ref) {
-				cmd = BR_DECREFS;
-				cmd_name = "BR_DECREFS";
-				node->has_weak_ref = 0;
-			}
-			if (cmd != BR_NOOP) {
-				if (put_user(cmd, (uint32_t __user *)ptr))
-					return -EFAULT;
-				ptr += sizeof(uint32_t);
-				if (put_user(node->ptr, (void * __user *)ptr))
-					return -EFAULT;
-				ptr += sizeof(void *);
-				if (put_user(node->cookie, (void * __user *)ptr))
-					return -EFAULT;
-				ptr += sizeof(void *);
-
-				binder_stat_br(proc, thread, cmd);
-				binder_debug(BINDER_DEBUG_USER_REFS,
-					     "binder: %d:%d %s %d u%p c%p\n",
-					     proc->pid, thread->pid, cmd_name, node->debug_id, node->ptr, node->cookie);
-			} else {
-				list_del_init(&w->entry);
-				if (!weak && !strong) {
-					binder_debug(BINDER_DEBUG_INTERNAL_REFS,
-						     "binder: %d:%d node %d u%p c%p deleted\n",
-						     proc->pid, thread->pid, node->debug_id,
-						     node->ptr, node->cookie);
-					rb_erase(&node->rb_node, &proc->nodes);
-					kfree(node);
-					binder_stats_deleted(BINDER_STAT_NODE);
-				} else {
-					binder_debug(BINDER_DEBUG_INTERNAL_REFS,
-						     "binder: %d:%d node %d u%p c%p state unchanged\n",
-						     proc->pid, thread->pid, node->debug_id, node->ptr,
-						     node->cookie);
-				}
-			}
-		} break;
-		case BINDER_WORK_DEAD_BINDER:
-		case BINDER_WORK_DEAD_BINDER_AND_CLEAR:
-		case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: {
-			struct binder_ref_death *death;
-			uint32_t cmd;
-
-			death = container_of(w, struct binder_ref_death, work);
-			if (w->type == BINDER_WORK_CLEAR_DEATH_NOTIFICATION)
-				cmd = BR_CLEAR_DEATH_NOTIFICATION_DONE;
-			else
-				cmd = BR_DEAD_BINDER;
-			if (put_user(cmd, (uint32_t __user *)ptr))
-				return -EFAULT;
-			ptr += sizeof(uint32_t);
-			if (put_user(death->cookie, (void * __user *)ptr))
-				return -EFAULT;
-			ptr += sizeof(void *);
-			binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION,
-				     "binder: %d:%d %s %p\n",
-				      proc->pid, thread->pid,
-				      cmd == BR_DEAD_BINDER ?
-				      "BR_DEAD_BINDER" :
-				      "BR_CLEAR_DEATH_NOTIFICATION_DONE",
-				      death->cookie);
-
-			if (w->type == BINDER_WORK_CLEAR_DEATH_NOTIFICATION) {
-				list_del(&w->entry);
-				kfree(death);
-				binder_stats_deleted(BINDER_STAT_DEATH);
-			} else
-				list_move(&w->entry, &proc->delivered_death);
-			if (cmd == BR_DEAD_BINDER)
-				goto done; /* DEAD_BINDER notifications can cause transactions */
-		} break;
-		}
-
-		if (!t)
-			continue;
-
-		BUG_ON(t->buffer == NULL);
-		if (t->buffer->target_node) {
-			struct binder_node *target_node = t->buffer->target_node;
-			tr.target.ptr = target_node->ptr;
-			tr.cookie =  target_node->cookie;
-			t->saved_priority = task_nice(current);
-			if (t->priority < target_node->min_priority &&
-			    !(t->flags & TF_ONE_WAY))
-				binder_set_nice(t->priority);
-			else if (!(t->flags & TF_ONE_WAY) ||
-				 t->saved_priority > target_node->min_priority)
-				binder_set_nice(target_node->min_priority);
-			cmd = BR_TRANSACTION;
-		} else {
-			tr.target.ptr = NULL;
-			tr.cookie = NULL;
-			cmd = BR_REPLY;
-		}
-		tr.code = t->code;
-		tr.flags = t->flags;
-		tr.sender_euid = t->sender_euid;
-
-		if (t->from) {
-			struct task_struct *sender = t->from->proc->tsk;
-			tr.sender_pid = task_tgid_nr_ns(sender,
-							current->nsproxy->pid_ns);
-		} else {
-			tr.sender_pid = 0;
-		}
-
-		tr.data_size = t->buffer->data_size;
-		tr.offsets_size = t->buffer->offsets_size;
-		tr.data.ptr.buffer = (void *)t->buffer->data +
-					proc->user_buffer_offset;
-		tr.data.ptr.offsets = tr.data.ptr.buffer +
-					ALIGN(t->buffer->data_size,
-					    sizeof(void *));
-
-		if (put_user(cmd, (uint32_t __user *)ptr))
-			return -EFAULT;
-		ptr += sizeof(uint32_t);
-		if (copy_to_user(ptr, &tr, sizeof(tr)))
-			return -EFAULT;
-		ptr += sizeof(tr);
-
-		binder_stat_br(proc, thread, cmd);
-		binder_debug(BINDER_DEBUG_TRANSACTION,
-			     "binder: %d:%d %s %d %d:%d, cmd %d"
-			     "size %zd-%zd ptr %p-%p\n",
-			     proc->pid, thread->pid,
-			     (cmd == BR_TRANSACTION) ? "BR_TRANSACTION" :
-			     "BR_REPLY",
-			     t->debug_id, t->from ? t->from->proc->pid : 0,
-			     t->from ? t->from->pid : 0, cmd,
-			     t->buffer->data_size, t->buffer->offsets_size,
-			     tr.data.ptr.buffer, tr.data.ptr.offsets);
-
-		list_del(&t->work.entry);
-		t->buffer->allow_user_free = 1;
-		if (cmd == BR_TRANSACTION && !(t->flags & TF_ONE_WAY)) {
-			t->to_parent = thread->transaction_stack;
-			t->to_thread = thread;
-			thread->transaction_stack = t;
-		} else {
-			t->buffer->transaction = NULL;
-			kfree(t);
-			binder_stats_deleted(BINDER_STAT_TRANSACTION);
-		}
-		break;
-	}
-
-done:
-
-	*consumed = ptr - buffer;
-	if (proc->requested_threads + proc->ready_threads == 0 &&
-	    proc->requested_threads_started < proc->max_threads &&
-	    (thread->looper & (BINDER_LOOPER_STATE_REGISTERED |
-	     BINDER_LOOPER_STATE_ENTERED)) /* the user-space code fails to */
-	     /*spawn a new thread if we leave this out */) {
-		proc->requested_threads++;
-		binder_debug(BINDER_DEBUG_THREADS,
-			     "binder: %d:%d BR_SPAWN_LOOPER\n",
-			     proc->pid, thread->pid);
-		if (put_user(BR_SPAWN_LOOPER, (uint32_t __user *)buffer))
-			return -EFAULT;
-	}
-	return 0;
-}
-
-static void binder_release_work(struct list_head *list)
-{
-	struct binder_work *w;
-	while (!list_empty(list)) {
-		w = list_first_entry(list, struct binder_work, entry);
-		list_del_init(&w->entry);
-		switch (w->type) {
-		case BINDER_WORK_TRANSACTION: {
-			struct binder_transaction *t;
-
-			t = container_of(w, struct binder_transaction, work);
-			if (t->buffer->target_node && !(t->flags & TF_ONE_WAY))
-				binder_send_failed_reply(t, BR_DEAD_REPLY);
-		} break;
-		case BINDER_WORK_TRANSACTION_COMPLETE: {
-			kfree(w);
-			binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE);
-		} break;
-		default:
-			break;
-		}
-	}
-
-}
-
-static struct binder_thread *binder_get_thread(struct binder_proc *proc)
-{
-	struct binder_thread *thread = NULL;
-	struct rb_node *parent = NULL;
-	struct rb_node **p = &proc->threads.rb_node;
-
-	while (*p) {
-		parent = *p;
-		thread = rb_entry(parent, struct binder_thread, rb_node);
-
-		if (current->pid < thread->pid)
-			p = &(*p)->rb_left;
-		else if (current->pid > thread->pid)
-			p = &(*p)->rb_right;
-		else
-			break;
-	}
-	if (*p == NULL) {
-		thread = kzalloc(sizeof(*thread), GFP_KERNEL);
-		if (thread == NULL)
-			return NULL;
-		binder_stats_created(BINDER_STAT_THREAD);
-		thread->proc = proc;
-		thread->pid = current->pid;
-		init_waitqueue_head(&thread->wait);
-		INIT_LIST_HEAD(&thread->todo);
-		rb_link_node(&thread->rb_node, parent, p);
-		rb_insert_color(&thread->rb_node, &proc->threads);
-		thread->looper |= BINDER_LOOPER_STATE_NEED_RETURN;
-		thread->return_error = BR_OK;
-		thread->return_error2 = BR_OK;
-	}
-	return thread;
-}
-
-static int binder_free_thread(struct binder_proc *proc,
-			      struct binder_thread *thread)
-{
-	struct binder_transaction *t;
-	struct binder_transaction *send_reply = NULL;
-	int active_transactions = 0;
-
-	rb_erase(&thread->rb_node, &proc->threads);
-	t = thread->transaction_stack;
-	if (t && t->to_thread == thread)
-		send_reply = t;
-	while (t) {
-		active_transactions++;
-		binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
-			     "binder: release %d:%d transaction %d "
-			     "%s, still active\n", proc->pid, thread->pid,
-			     t->debug_id,
-			     (t->to_thread == thread) ? "in" : "out");
-
-		if (t->to_thread == thread) {
-			t->to_proc = NULL;
-			t->to_thread = NULL;
-			if (t->buffer) {
-				t->buffer->transaction = NULL;
-				t->buffer = NULL;
-			}
-			t = t->to_parent;
-		} else if (t->from == thread) {
-			t->from = NULL;
-			t = t->from_parent;
-		} else
-			BUG();
-	}
-	if (send_reply)
-		binder_send_failed_reply(send_reply, BR_DEAD_REPLY);
-	binder_release_work(&thread->todo);
-	kfree(thread);
-	binder_stats_deleted(BINDER_STAT_THREAD);
-	return active_transactions;
-}
-
-static unsigned int binder_poll(struct file *filp,
-				struct poll_table_struct *wait)
-{
-	struct binder_proc *proc = filp->private_data;
-	struct binder_thread *thread = NULL;
-	int wait_for_proc_work;
-
-	mutex_lock(&binder_lock);
-	thread = binder_get_thread(proc);
-
-	wait_for_proc_work = thread->transaction_stack == NULL &&
-		list_empty(&thread->todo) && thread->return_error == BR_OK;
-	mutex_unlock(&binder_lock);
-
-	if (wait_for_proc_work) {
-		if (binder_has_proc_work(proc, thread))
-			return POLLIN;
-		poll_wait(filp, &proc->wait, wait);
-		if (binder_has_proc_work(proc, thread))
-			return POLLIN;
-	} else {
-		if (binder_has_thread_work(thread))
-			return POLLIN;
-		poll_wait(filp, &thread->wait, wait);
-		if (binder_has_thread_work(thread))
-			return POLLIN;
-	}
-	return 0;
-}
-
-static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
-{
-	int ret;
-	struct binder_proc *proc = filp->private_data;
-	struct binder_thread *thread;
-	unsigned int size = _IOC_SIZE(cmd);
-	void __user *ubuf = (void __user *)arg;
-
-	/*printk(KERN_INFO "binder_ioctl: %d:%d %x %lx\n", proc->pid, current->pid, cmd, arg);*/
-
-	ret = wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2);
-	if (ret)
-		return ret;
-
-	mutex_lock(&binder_lock);
-	thread = binder_get_thread(proc);
-	if (thread == NULL) {
-		ret = -ENOMEM;
-		goto err;
-	}
-
-	switch (cmd) {
-	case BINDER_WRITE_READ: {
-		struct binder_write_read bwr;
-		if (size != sizeof(struct binder_write_read)) {
-			ret = -EINVAL;
-			goto err;
-		}
-		if (copy_from_user(&bwr, ubuf, sizeof(bwr))) {
-			ret = -EFAULT;
-			goto err;
-		}
-		binder_debug(BINDER_DEBUG_READ_WRITE,
-			     "binder: %d:%d write %ld at %08lx, read %ld at %08lx\n",
-			     proc->pid, thread->pid, bwr.write_size, bwr.write_buffer,
-			     bwr.read_size, bwr.read_buffer);
-
-		if (bwr.write_size > 0) {
-			ret = binder_thread_write(proc, thread, (void __user *)bwr.write_buffer, bwr.write_size, &bwr.write_consumed);
-			if (ret < 0) {
-				bwr.read_consumed = 0;
-				if (copy_to_user(ubuf, &bwr, sizeof(bwr)))
-					ret = -EFAULT;
-				goto err;
-			}
-		}
-		if (bwr.read_size > 0) {
-			ret = binder_thread_read(proc, thread, (void __user *)bwr.read_buffer, bwr.read_size, &bwr.read_consumed, filp->f_flags & O_NONBLOCK);
-			if (!list_empty(&proc->todo))
-				wake_up_interruptible(&proc->wait);
-			if (ret < 0) {
-				if (copy_to_user(ubuf, &bwr, sizeof(bwr)))
-					ret = -EFAULT;
-				goto err;
-			}
-		}
-		binder_debug(BINDER_DEBUG_READ_WRITE,
-			     "binder: %d:%d wrote %ld of %ld, read return %ld of %ld\n",
-			     proc->pid, thread->pid, bwr.write_consumed, bwr.write_size,
-			     bwr.read_consumed, bwr.read_size);
-		if (copy_to_user(ubuf, &bwr, sizeof(bwr))) {
-			ret = -EFAULT;
-			goto err;
-		}
-		break;
-	}
-	case BINDER_SET_MAX_THREADS:
-		if (copy_from_user(&proc->max_threads, ubuf, sizeof(proc->max_threads))) {
-			ret = -EINVAL;
-			goto err;
-		}
-		break;
-	case BINDER_SET_CONTEXT_MGR:
-		if (binder_context_mgr_node != NULL) {
-			printk(KERN_ERR "binder: BINDER_SET_CONTEXT_MGR already set\n");
-			ret = -EBUSY;
-			goto err;
-		}
-		if (binder_context_mgr_uid != -1) {
-			if (binder_context_mgr_uid != current->cred->euid) {
-				printk(KERN_ERR "binder: BINDER_SET_"
-				       "CONTEXT_MGR bad uid %d != %d\n",
-				       current->cred->euid,
-				       binder_context_mgr_uid);
-				ret = -EPERM;
-				goto err;
-			}
-		} else
-			binder_context_mgr_uid = current->cred->euid;
-		binder_context_mgr_node = binder_new_node(proc, NULL, NULL);
-		if (binder_context_mgr_node == NULL) {
-			ret = -ENOMEM;
-			goto err;
-		}
-		binder_context_mgr_node->local_weak_refs++;
-		binder_context_mgr_node->local_strong_refs++;
-		binder_context_mgr_node->has_strong_ref = 1;
-		binder_context_mgr_node->has_weak_ref = 1;
-		break;
-	case BINDER_THREAD_EXIT:
-		binder_debug(BINDER_DEBUG_THREADS, "binder: %d:%d exit\n",
-			     proc->pid, thread->pid);
-		binder_free_thread(proc, thread);
-		thread = NULL;
-		break;
-	case BINDER_VERSION:
-		if (size != sizeof(struct binder_version)) {
-			ret = -EINVAL;
-			goto err;
-		}
-		if (put_user(BINDER_CURRENT_PROTOCOL_VERSION, &((struct binder_version *)ubuf)->protocol_version)) {
-			ret = -EINVAL;
-			goto err;
-		}
-		break;
-	default:
-		ret = -EINVAL;
-		goto err;
-	}
-	ret = 0;
-err:
-	if (thread)
-		thread->looper &= ~BINDER_LOOPER_STATE_NEED_RETURN;
-	mutex_unlock(&binder_lock);
-	wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2);
-	if (ret && ret != -ERESTARTSYS)
-		printk(KERN_INFO "binder: %d:%d ioctl %x %lx returned %d\n", proc->pid, current->pid, cmd, arg, ret);
-	return ret;
-}
-
-static void binder_vma_open(struct vm_area_struct *vma)
-{
-	struct binder_proc *proc = vma->vm_private_data;
-	binder_debug(BINDER_DEBUG_OPEN_CLOSE,
-		     "binder: %d open vm area %lx-%lx (%ld K) vma %lx pagep %lx\n",
-		     proc->pid, vma->vm_start, vma->vm_end,
-		     (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags,
-		     (unsigned long)pgprot_val(vma->vm_page_prot));
-	dump_stack();
-}
-
-static void binder_vma_close(struct vm_area_struct *vma)
-{
-	struct binder_proc *proc = vma->vm_private_data;
-	binder_debug(BINDER_DEBUG_OPEN_CLOSE,
-		     "binder: %d close vm area %lx-%lx (%ld K) vma %lx pagep %lx\n",
-		     proc->pid, vma->vm_start, vma->vm_end,
-		     (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags,
-		     (unsigned long)pgprot_val(vma->vm_page_prot));
-	proc->vma = NULL;
-	binder_defer_work(proc, BINDER_DEFERRED_PUT_FILES);
-}
-
-static struct vm_operations_struct binder_vm_ops = {
-	.open = binder_vma_open,
-	.close = binder_vma_close,
-};
-
-static int binder_mmap(struct file *filp, struct vm_area_struct *vma)
-{
-	int ret;
-	struct vm_struct *area;
-	struct binder_proc *proc = filp->private_data;
-	const char *failure_string;
-	struct binder_buffer *buffer;
-
-	if ((vma->vm_end - vma->vm_start) > SZ_4M)
-		vma->vm_end = vma->vm_start + SZ_4M;
-
-	binder_debug(BINDER_DEBUG_OPEN_CLOSE,
-		     "binder_mmap: %d %lx-%lx (%ld K) vma %lx pagep %lx\n",
-		     proc->pid, vma->vm_start, vma->vm_end,
-		     (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags,
-		     (unsigned long)pgprot_val(vma->vm_page_prot));
-
-	if (vma->vm_flags & FORBIDDEN_MMAP_FLAGS) {
-		ret = -EPERM;
-		failure_string = "bad vm_flags";
-		goto err_bad_arg;
-	}
-	vma->vm_flags = (vma->vm_flags | VM_DONTCOPY) & ~VM_MAYWRITE;
-
-	if (proc->buffer) {
-		ret = -EBUSY;
-		failure_string = "already mapped";
-		goto err_already_mapped;
-	}
-
-	area = get_vm_area(vma->vm_end - vma->vm_start, VM_IOREMAP);
-	if (area == NULL) {
-		ret = -ENOMEM;
-		failure_string = "get_vm_area";
-		goto err_get_vm_area_failed;
-	}
-	proc->buffer = area->addr;
-	proc->user_buffer_offset = vma->vm_start - (uintptr_t)proc->buffer;
-
-#ifdef CONFIG_CPU_CACHE_VIPT
-	if (cache_is_vipt_aliasing()) {
-		while (CACHE_COLOUR((vma->vm_start ^ (uint32_t)proc->buffer))) {
-			printk(KERN_INFO "binder_mmap: %d %lx-%lx maps %p bad alignment\n", proc->pid, vma->vm_start, vma->vm_end, proc->buffer);
-			vma->vm_start += PAGE_SIZE;
-		}
-	}
-#endif
-	proc->pages = kzalloc(sizeof(proc->pages[0]) * ((vma->vm_end - vma->vm_start) / PAGE_SIZE), GFP_KERNEL);
-	if (proc->pages == NULL) {
-		ret = -ENOMEM;
-		failure_string = "alloc page array";
-		goto err_alloc_pages_failed;
-	}
-	proc->buffer_size = vma->vm_end - vma->vm_start;
-
-	vma->vm_ops = &binder_vm_ops;
-	vma->vm_private_data = proc;
-
-	if (binder_update_page_range(proc, 1, proc->buffer, proc->buffer + PAGE_SIZE, vma)) {
-		ret = -ENOMEM;
-		failure_string = "alloc small buf";
-		goto err_alloc_small_buf_failed;
-	}
-	buffer = proc->buffer;
-	INIT_LIST_HEAD(&proc->buffers);
-	list_add(&buffer->entry, &proc->buffers);
-	buffer->free = 1;
-	binder_insert_free_buffer(proc, buffer);
-	proc->free_async_space = proc->buffer_size / 2;
-	barrier();
-	proc->files = get_files_struct(current);
-	proc->vma = vma;
-
-	/*printk(KERN_INFO "binder_mmap: %d %lx-%lx maps %p\n",
-		 proc->pid, vma->vm_start, vma->vm_end, proc->buffer);*/
-	return 0;
-
-err_alloc_small_buf_failed:
-	kfree(proc->pages);
-	proc->pages = NULL;
-err_alloc_pages_failed:
-	vfree(proc->buffer);
-	proc->buffer = NULL;
-err_get_vm_area_failed:
-err_already_mapped:
-err_bad_arg:
-	printk(KERN_ERR "binder_mmap: %d %lx-%lx %s failed %d\n",
-	       proc->pid, vma->vm_start, vma->vm_end, failure_string, ret);
-	return ret;
-}
-
-static int binder_open(struct inode *nodp, struct file *filp)
-{
-	struct binder_proc *proc;
-
-	binder_debug(BINDER_DEBUG_OPEN_CLOSE, "binder_open: %d:%d\n",
-		     current->group_leader->pid, current->pid);
-
-	proc = kzalloc(sizeof(*proc), GFP_KERNEL);
-	if (proc == NULL)
-		return -ENOMEM;
-	get_task_struct(current);
-	proc->tsk = current;
-	INIT_LIST_HEAD(&proc->todo);
-	init_waitqueue_head(&proc->wait);
-	proc->default_priority = task_nice(current);
-	mutex_lock(&binder_lock);
-	binder_stats_created(BINDER_STAT_PROC);
-	hlist_add_head(&proc->proc_node, &binder_procs);
-	proc->pid = current->group_leader->pid;
-	INIT_LIST_HEAD(&proc->delivered_death);
-	filp->private_data = proc;
-	mutex_unlock(&binder_lock);
-
-	if (binder_proc_dir_entry_proc) {
-		char strbuf[11];
-		snprintf(strbuf, sizeof(strbuf), "%u", proc->pid);
-		remove_proc_entry(strbuf, binder_proc_dir_entry_proc);
-		create_proc_read_entry(strbuf, S_IRUGO,
-				       binder_proc_dir_entry_proc,
-				       binder_read_proc_proc, proc);
-	}
-
-	return 0;
-}
-
-static int binder_flush(struct file *filp, fl_owner_t id)
-{
-	struct binder_proc *proc = filp->private_data;
-
-	binder_defer_work(proc, BINDER_DEFERRED_FLUSH);
-
-	return 0;
-}
-
-static void binder_deferred_flush(struct binder_proc *proc)
-{
-	struct rb_node *n;
-	int wake_count = 0;
-	for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) {
-		struct binder_thread *thread = rb_entry(n, struct binder_thread, rb_node);
-		thread->looper |= BINDER_LOOPER_STATE_NEED_RETURN;
-		if (thread->looper & BINDER_LOOPER_STATE_WAITING) {
-			wake_up_interruptible(&thread->wait);
-			wake_count++;
-		}
-	}
-	wake_up_interruptible_all(&proc->wait);
-
-	binder_debug(BINDER_DEBUG_OPEN_CLOSE,
-		     "binder_flush: %d woke %d threads\n", proc->pid,
-		     wake_count);
-}
-
-static int binder_release(struct inode *nodp, struct file *filp)
-{
-	struct binder_proc *proc = filp->private_data;
-	if (binder_proc_dir_entry_proc) {
-		char strbuf[11];
-		snprintf(strbuf, sizeof(strbuf), "%u", proc->pid);
-		remove_proc_entry(strbuf, binder_proc_dir_entry_proc);
-	}
-
-	binder_defer_work(proc, BINDER_DEFERRED_RELEASE);
-
-	return 0;
-}
-
-static void binder_deferred_release(struct binder_proc *proc)
-{
-	struct hlist_node *pos;
-	struct binder_transaction *t;
-	struct rb_node *n;
-	int threads, nodes, incoming_refs, outgoing_refs, buffers, active_transactions, page_count;
-
-	BUG_ON(proc->vma);
-	BUG_ON(proc->files);
-
-	hlist_del(&proc->proc_node);
-	if (binder_context_mgr_node && binder_context_mgr_node->proc == proc) {
-		binder_debug(BINDER_DEBUG_DEAD_BINDER,
-			     "binder_release: %d context_mgr_node gone\n",
-			     proc->pid);
-		binder_context_mgr_node = NULL;
-	}
-
-	threads = 0;
-	active_transactions = 0;
-	while ((n = rb_first(&proc->threads))) {
-		struct binder_thread *thread = rb_entry(n, struct binder_thread, rb_node);
-		threads++;
-		active_transactions += binder_free_thread(proc, thread);
-	}
-	nodes = 0;
-	incoming_refs = 0;
-	while ((n = rb_first(&proc->nodes))) {
-		struct binder_node *node = rb_entry(n, struct binder_node, rb_node);
-
-		nodes++;
-		rb_erase(&node->rb_node, &proc->nodes);
-		list_del_init(&node->work.entry);
-		if (hlist_empty(&node->refs)) {
-			kfree(node);
-			binder_stats_deleted(BINDER_STAT_NODE);
-		} else {
-			struct binder_ref *ref;
-			int death = 0;
-
-			node->proc = NULL;
-			node->local_strong_refs = 0;
-			node->local_weak_refs = 0;
-			hlist_add_head(&node->dead_node, &binder_dead_nodes);
-
-			hlist_for_each_entry(ref, pos, &node->refs, node_entry) {
-				incoming_refs++;
-				if (ref->death) {
-					death++;
-					if (list_empty(&ref->death->work.entry)) {
-						ref->death->work.type = BINDER_WORK_DEAD_BINDER;
-						list_add_tail(&ref->death->work.entry, &ref->proc->todo);
-						wake_up_interruptible(&ref->proc->wait);
-					} else
-						BUG();
-				}
-			}
-			binder_debug(BINDER_DEBUG_DEAD_BINDER,
-				     "binder: node %d now dead, "
-				     "refs %d, death %d\n", node->debug_id,
-				     incoming_refs, death);
-		}
-	}
-	outgoing_refs = 0;
-	while ((n = rb_first(&proc->refs_by_desc))) {
-		struct binder_ref *ref = rb_entry(n, struct binder_ref,
-						  rb_node_desc);
-		outgoing_refs++;
-		binder_delete_ref(ref);
-	}
-	binder_release_work(&proc->todo);
-	buffers = 0;
-
-	while ((n = rb_first(&proc->allocated_buffers))) {
-		struct binder_buffer *buffer = rb_entry(n, struct binder_buffer,
-							rb_node);
-		t = buffer->transaction;
-		if (t) {
-			t->buffer = NULL;
-			buffer->transaction = NULL;
-			printk(KERN_ERR "binder: release proc %d, "
-			       "transaction %d, not freed\n",
-			       proc->pid, t->debug_id);
-			/*BUG();*/
-		}
-		binder_free_buf(proc, buffer);
-		buffers++;
-	}
-
-	binder_stats_deleted(BINDER_STAT_PROC);
-
-	page_count = 0;
-	if (proc->pages) {
-		int i;
-		for (i = 0; i < proc->buffer_size / PAGE_SIZE; i++) {
-			if (proc->pages[i]) {
-				binder_debug(BINDER_DEBUG_BUFFER_ALLOC,
-					     "binder_release: %d: "
-					     "page %d at %p not freed\n",
-					     proc->pid, i,
-					     proc->buffer + i * PAGE_SIZE);
-				__free_page(proc->pages[i]);
-				page_count++;
-			}
-		}
-		kfree(proc->pages);
-		vfree(proc->buffer);
-	}
-
-	put_task_struct(proc->tsk);
-
-	binder_debug(BINDER_DEBUG_OPEN_CLOSE,
-		     "binder_release: %d threads %d, nodes %d (ref %d), "
-		     "refs %d, active transactions %d, buffers %d, "
-		     "pages %d\n",
-		     proc->pid, threads, nodes, incoming_refs, outgoing_refs,
-		     active_transactions, buffers, page_count);
-
-	kfree(proc);
-}
-
-static void binder_deferred_func(struct work_struct *work)
-{
-	struct binder_proc *proc;
-	struct files_struct *files;
-
-	int defer;
-	do {
-		mutex_lock(&binder_lock);
-		mutex_lock(&binder_deferred_lock);
-		if (!hlist_empty(&binder_deferred_list)) {
-			proc = hlist_entry(binder_deferred_list.first,
-					struct binder_proc, deferred_work_node);
-			hlist_del_init(&proc->deferred_work_node);
-			defer = proc->deferred_work;
-			proc->deferred_work = 0;
-		} else {
-			proc = NULL;
-			defer = 0;
-		}
-		mutex_unlock(&binder_deferred_lock);
-
-		files = NULL;
-		if (defer & BINDER_DEFERRED_PUT_FILES) {
-			files = proc->files;
-			if (files)
-				proc->files = NULL;
-		}
-
-		if (defer & BINDER_DEFERRED_FLUSH)
-			binder_deferred_flush(proc);
-
-		if (defer & BINDER_DEFERRED_RELEASE)
-			binder_deferred_release(proc); /* frees proc */
-
-		mutex_unlock(&binder_lock);
-		if (files)
-			put_files_struct(files);
-	} while (proc);
-}
-static DECLARE_WORK(binder_deferred_work, binder_deferred_func);
-
-static void
-binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer)
-{
-	mutex_lock(&binder_deferred_lock);
-	proc->deferred_work |= defer;
-	if (hlist_unhashed(&proc->deferred_work_node)) {
-		hlist_add_head(&proc->deferred_work_node,
-				&binder_deferred_list);
-		schedule_work(&binder_deferred_work);
-	}
-	mutex_unlock(&binder_deferred_lock);
-}
-
-static char *print_binder_transaction(char *buf, char *end, const char *prefix,
-				      struct binder_transaction *t)
-{
-	buf += snprintf(buf, end - buf,
-			"%s %d: %p from %d:%d to %d:%d code %x "
-			"flags %x pri %ld r%d",
-			prefix, t->debug_id, t,
-			t->from ? t->from->proc->pid : 0,
-			t->from ? t->from->pid : 0,
-			t->to_proc ? t->to_proc->pid : 0,
-			t->to_thread ? t->to_thread->pid : 0,
-			t->code, t->flags, t->priority, t->need_reply);
-	if (buf >= end)
-		return buf;
-	if (t->buffer == NULL) {
-		buf += snprintf(buf, end - buf, " buffer free\n");
-		return buf;
-	}
-	if (t->buffer->target_node) {
-		buf += snprintf(buf, end - buf, " node %d",
-				t->buffer->target_node->debug_id);
-		if (buf >= end)
-			return buf;
-	}
-	buf += snprintf(buf, end - buf, " size %zd:%zd data %p\n",
-			t->buffer->data_size, t->buffer->offsets_size,
-			t->buffer->data);
-	return buf;
-}
-
-static char *print_binder_buffer(char *buf, char *end, const char *prefix,
-				 struct binder_buffer *buffer)
-{
-	buf += snprintf(buf, end - buf, "%s %d: %p size %zd:%zd %s\n",
-			prefix, buffer->debug_id, buffer->data,
-			buffer->data_size, buffer->offsets_size,
-			buffer->transaction ? "active" : "delivered");
-	return buf;
-}
-
-static char *print_binder_work(char *buf, char *end, const char *prefix,
-			       const char *transaction_prefix,
-			       struct binder_work *w)
-{
-	struct binder_node *node;
-	struct binder_transaction *t;
-
-	switch (w->type) {
-	case BINDER_WORK_TRANSACTION:
-		t = container_of(w, struct binder_transaction, work);
-		buf = print_binder_transaction(buf, end, transaction_prefix, t);
-		break;
-	case BINDER_WORK_TRANSACTION_COMPLETE:
-		buf += snprintf(buf, end - buf,
-				"%stransaction complete\n", prefix);
-		break;
-	case BINDER_WORK_NODE:
-		node = container_of(w, struct binder_node, work);
-		buf += snprintf(buf, end - buf, "%snode work %d: u%p c%p\n",
-				prefix, node->debug_id, node->ptr,
-				node->cookie);
-		break;
-	case BINDER_WORK_DEAD_BINDER:
-		buf += snprintf(buf, end - buf, "%shas dead binder\n", prefix);
-		break;
-	case BINDER_WORK_DEAD_BINDER_AND_CLEAR:
-		buf += snprintf(buf, end - buf,
-				"%shas cleared dead binder\n", prefix);
-		break;
-	case BINDER_WORK_CLEAR_DEATH_NOTIFICATION:
-		buf += snprintf(buf, end - buf,
-				"%shas cleared death notification\n", prefix);
-		break;
-	default:
-		buf += snprintf(buf, end - buf, "%sunknown work: type %d\n",
-				prefix, w->type);
-		break;
-	}
-	return buf;
-}
-
-static char *print_binder_thread(char *buf, char *end,
-				 struct binder_thread *thread,
-				 int print_always)
-{
-	struct binder_transaction *t;
-	struct binder_work *w;
-	char *start_buf = buf;
-	char *header_buf;
-
-	buf += snprintf(buf, end - buf, "  thread %d: l %02x\n",
-			thread->pid, thread->looper);
-	header_buf = buf;
-	t = thread->transaction_stack;
-	while (t) {
-		if (buf >= end)
-			break;
-		if (t->from == thread) {
-			buf = print_binder_transaction(buf, end,
-						"    outgoing transaction", t);
-			t = t->from_parent;
-		} else if (t->to_thread == thread) {
-			buf = print_binder_transaction(buf, end,
-						"    incoming transaction", t);
-			t = t->to_parent;
-		} else {
-			buf = print_binder_transaction(buf, end,
-						"    bad transaction", t);
-			t = NULL;
-		}
-	}
-	list_for_each_entry(w, &thread->todo, entry) {
-		if (buf >= end)
-			break;
-		buf = print_binder_work(buf, end, "    ",
-					"    pending transaction", w);
-	}
-	if (!print_always && buf == header_buf)
-		buf = start_buf;
-	return buf;
-}
-
-static char *print_binder_node(char *buf, char *end, struct binder_node *node)
-{
-	struct binder_ref *ref;
-	struct hlist_node *pos;
-	struct binder_work *w;
-	int count;
-
-	count = 0;
-	hlist_for_each_entry(ref, pos, &node->refs, node_entry)
-		count++;
-
-	buf += snprintf(buf, end - buf,
-			"  node %d: u%p c%p hs %d hw %d ls %d lw %d "
-			"is %d iw %d",
-			node->debug_id, node->ptr, node->cookie,
-			node->has_strong_ref, node->has_weak_ref,
-			node->local_strong_refs, node->local_weak_refs,
-			node->internal_strong_refs, count);
-	if (buf >= end)
-		return buf;
-	if (count) {
-		buf += snprintf(buf, end - buf, " proc");
-		if (buf >= end)
-			return buf;
-		hlist_for_each_entry(ref, pos, &node->refs, node_entry) {
-			buf += snprintf(buf, end - buf, " %d", ref->proc->pid);
-			if (buf >= end)
-				return buf;
-		}
-	}
-	buf += snprintf(buf, end - buf, "\n");
-	list_for_each_entry(w, &node->async_todo, entry) {
-		if (buf >= end)
-			break;
-		buf = print_binder_work(buf, end, "    ",
-					"    pending async transaction", w);
-	}
-	return buf;
-}
-
-static char *print_binder_ref(char *buf, char *end, struct binder_ref *ref)
-{
-	buf += snprintf(buf, end - buf,
-			"  ref %d: desc %d %snode %d s %d w %d d %p\n",
-			ref->debug_id, ref->desc,
-			ref->node->proc ? "" : "dead ", ref->node->debug_id,
-			ref->strong, ref->weak, ref->death);
-	return buf;
-}
-
-static char *print_binder_proc(char *buf, char *end,
-			       struct binder_proc *proc, int print_all)
-{
-	struct binder_work *w;
-	struct rb_node *n;
-	char *start_buf = buf;
-	char *header_buf;
-
-	buf += snprintf(buf, end - buf, "proc %d\n", proc->pid);
-	header_buf = buf;
-
-	for (n = rb_first(&proc->threads);
-	     n != NULL && buf < end;
-	     n = rb_next(n))
-		buf = print_binder_thread(buf, end,
-					  rb_entry(n, struct binder_thread,
-						   rb_node), print_all);
-	for (n = rb_first(&proc->nodes);
-	     n != NULL && buf < end;
-	     n = rb_next(n)) {
-		struct binder_node *node = rb_entry(n, struct binder_node,
-						    rb_node);
-		if (print_all || node->has_async_transaction)
-			buf = print_binder_node(buf, end, node);
-	}
-	if (print_all) {
-		for (n = rb_first(&proc->refs_by_desc);
-		     n != NULL && buf < end;
-		     n = rb_next(n))
-			buf = print_binder_ref(buf, end,
-					       rb_entry(n, struct binder_ref,
-							rb_node_desc));
-	}
-	for (n = rb_first(&proc->allocated_buffers);
-	     n != NULL && buf < end;
-	     n = rb_next(n))
-		buf = print_binder_buffer(buf, end, "  buffer",
-					  rb_entry(n, struct binder_buffer,
-						   rb_node));
-	list_for_each_entry(w, &proc->todo, entry) {
-		if (buf >= end)
-			break;
-		buf = print_binder_work(buf, end, "  ",
-					"  pending transaction", w);
-	}
-	list_for_each_entry(w, &proc->delivered_death, entry) {
-		if (buf >= end)
-			break;
-		buf += snprintf(buf, end - buf,
-				"  has delivered dead binder\n");
-		break;
-	}
-	if (!print_all && buf == header_buf)
-		buf = start_buf;
-	return buf;
-}
-
-static const char *binder_return_strings[] = {
-	"BR_ERROR",
-	"BR_OK",
-	"BR_TRANSACTION",
-	"BR_REPLY",
-	"BR_ACQUIRE_RESULT",
-	"BR_DEAD_REPLY",
-	"BR_TRANSACTION_COMPLETE",
-	"BR_INCREFS",
-	"BR_ACQUIRE",
-	"BR_RELEASE",
-	"BR_DECREFS",
-	"BR_ATTEMPT_ACQUIRE",
-	"BR_NOOP",
-	"BR_SPAWN_LOOPER",
-	"BR_FINISHED",
-	"BR_DEAD_BINDER",
-	"BR_CLEAR_DEATH_NOTIFICATION_DONE",
-	"BR_FAILED_REPLY"
-};
-
-static const char *binder_command_strings[] = {
-	"BC_TRANSACTION",
-	"BC_REPLY",
-	"BC_ACQUIRE_RESULT",
-	"BC_FREE_BUFFER",
-	"BC_INCREFS",
-	"BC_ACQUIRE",
-	"BC_RELEASE",
-	"BC_DECREFS",
-	"BC_INCREFS_DONE",
-	"BC_ACQUIRE_DONE",
-	"BC_ATTEMPT_ACQUIRE",
-	"BC_REGISTER_LOOPER",
-	"BC_ENTER_LOOPER",
-	"BC_EXIT_LOOPER",
-	"BC_REQUEST_DEATH_NOTIFICATION",
-	"BC_CLEAR_DEATH_NOTIFICATION",
-	"BC_DEAD_BINDER_DONE"
-};
-
-static const char *binder_objstat_strings[] = {
-	"proc",
-	"thread",
-	"node",
-	"ref",
-	"death",
-	"transaction",
-	"transaction_complete"
-};
-
-static char *print_binder_stats(char *buf, char *end, const char *prefix,
-				struct binder_stats *stats)
-{
-	int i;
-
-	BUILD_BUG_ON(ARRAY_SIZE(stats->bc) !=
-			ARRAY_SIZE(binder_command_strings));
-	for (i = 0; i < ARRAY_SIZE(stats->bc); i++) {
-		if (stats->bc[i])
-			buf += snprintf(buf, end - buf, "%s%s: %d\n", prefix,
-					binder_command_strings[i],
-					stats->bc[i]);
-		if (buf >= end)
-			return buf;
-	}
-
-	BUILD_BUG_ON(ARRAY_SIZE(stats->br) !=
-			ARRAY_SIZE(binder_return_strings));
-	for (i = 0; i < ARRAY_SIZE(stats->br); i++) {
-		if (stats->br[i])
-			buf += snprintf(buf, end - buf, "%s%s: %d\n", prefix,
-					binder_return_strings[i], stats->br[i]);
-		if (buf >= end)
-			return buf;
-	}
-
-	BUILD_BUG_ON(ARRAY_SIZE(stats->obj_created) !=
-			ARRAY_SIZE(binder_objstat_strings));
-	BUILD_BUG_ON(ARRAY_SIZE(stats->obj_created) !=
-			ARRAY_SIZE(stats->obj_deleted));
-	for (i = 0; i < ARRAY_SIZE(stats->obj_created); i++) {
-		if (stats->obj_created[i] || stats->obj_deleted[i])
-			buf += snprintf(buf, end - buf,
-					"%s%s: active %d total %d\n", prefix,
-					binder_objstat_strings[i],
-					stats->obj_created[i] -
-						stats->obj_deleted[i],
-					stats->obj_created[i]);
-		if (buf >= end)
-			return buf;
-	}
-	return buf;
-}
-
-static char *print_binder_proc_stats(char *buf, char *end,
-				     struct binder_proc *proc)
-{
-	struct binder_work *w;
-	struct rb_node *n;
-	int count, strong, weak;
-
-	buf += snprintf(buf, end - buf, "proc %d\n", proc->pid);
-	if (buf >= end)
-		return buf;
-	count = 0;
-	for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n))
-		count++;
-	buf += snprintf(buf, end - buf, "  threads: %d\n", count);
-	if (buf >= end)
-		return buf;
-	buf += snprintf(buf, end - buf, "  requested threads: %d+%d/%d\n"
-			"  ready threads %d\n"
-			"  free async space %zd\n", proc->requested_threads,
-			proc->requested_threads_started, proc->max_threads,
-			proc->ready_threads, proc->free_async_space);
-	if (buf >= end)
-		return buf;
-	count = 0;
-	for (n = rb_first(&proc->nodes); n != NULL; n = rb_next(n))
-		count++;
-	buf += snprintf(buf, end - buf, "  nodes: %d\n", count);
-	if (buf >= end)
-		return buf;
-	count = 0;
-	strong = 0;
-	weak = 0;
-	for (n = rb_first(&proc->refs_by_desc); n != NULL; n = rb_next(n)) {
-		struct binder_ref *ref = rb_entry(n, struct binder_ref,
-						  rb_node_desc);
-		count++;
-		strong += ref->strong;
-		weak += ref->weak;
-	}
-	buf += snprintf(buf, end - buf, "  refs: %d s %d w %d\n",
-			count, strong, weak);
-	if (buf >= end)
-		return buf;
-
-	count = 0;
-	for (n = rb_first(&proc->allocated_buffers); n != NULL; n = rb_next(n))
-		count++;
-	buf += snprintf(buf, end - buf, "  buffers: %d\n", count);
-	if (buf >= end)
-		return buf;
-
-	count = 0;
-	list_for_each_entry(w, &proc->todo, entry) {
-		switch (w->type) {
-		case BINDER_WORK_TRANSACTION:
-			count++;
-			break;
-		default:
-			break;
-		}
-	}
-	buf += snprintf(buf, end - buf, "  pending transactions: %d\n", count);
-	if (buf >= end)
-		return buf;
-
-	buf = print_binder_stats(buf, end, "  ", &proc->stats);
-
-	return buf;
-}
-
-
-static int binder_read_proc_state(char *page, char **start, off_t off,
-				  int count, int *eof, void *data)
-{
-	struct binder_proc *proc;
-	struct hlist_node *pos;
-	struct binder_node *node;
-	int len = 0;
-	char *buf = page;
-	char *end = page + PAGE_SIZE;
-	int do_lock = !binder_debug_no_lock;
-
-	if (off)
-		return 0;
-
-	if (do_lock)
-		mutex_lock(&binder_lock);
-
-	buf += snprintf(buf, end - buf, "binder state:\n");
-
-	if (!hlist_empty(&binder_dead_nodes))
-		buf += snprintf(buf, end - buf, "dead nodes:\n");
-	hlist_for_each_entry(node, pos, &binder_dead_nodes, dead_node) {
-		if (buf >= end)
-			break;
-		buf = print_binder_node(buf, end, node);
-	}
-
-	hlist_for_each_entry(proc, pos, &binder_procs, proc_node) {
-		if (buf >= end)
-			break;
-		buf = print_binder_proc(buf, end, proc, 1);
-	}
-	if (do_lock)
-		mutex_unlock(&binder_lock);
-	if (buf > page + PAGE_SIZE)
-		buf = page + PAGE_SIZE;
-
-	*start = page + off;
-
-	len = buf - page;
-	if (len > off)
-		len -= off;
-	else
-		len = 0;
-
-	return len < count ? len  : count;
-}
-
-static int binder_read_proc_stats(char *page, char **start, off_t off,
-				  int count, int *eof, void *data)
-{
-	struct binder_proc *proc;
-	struct hlist_node *pos;
-	int len = 0;
-	char *p = page;
-	int do_lock = !binder_debug_no_lock;
-
-	if (off)
-		return 0;
-
-	if (do_lock)
-		mutex_lock(&binder_lock);
-
-	p += snprintf(p, PAGE_SIZE, "binder stats:\n");
-
-	p = print_binder_stats(p, page + PAGE_SIZE, "", &binder_stats);
-
-	hlist_for_each_entry(proc, pos, &binder_procs, proc_node) {
-		if (p >= page + PAGE_SIZE)
-			break;
-		p = print_binder_proc_stats(p, page + PAGE_SIZE, proc);
-	}
-	if (do_lock)
-		mutex_unlock(&binder_lock);
-	if (p > page + PAGE_SIZE)
-		p = page + PAGE_SIZE;
-
-	*start = page + off;
-
-	len = p - page;
-	if (len > off)
-		len -= off;
-	else
-		len = 0;
-
-	return len < count ? len  : count;
-}
-
-static int binder_read_proc_transactions(char *page, char **start, off_t off,
-					 int count, int *eof, void *data)
-{
-	struct binder_proc *proc;
-	struct hlist_node *pos;
-	int len = 0;
-	char *buf = page;
-	char *end = page + PAGE_SIZE;
-	int do_lock = !binder_debug_no_lock;
-
-	if (off)
-		return 0;
-
-	if (do_lock)
-		mutex_lock(&binder_lock);
-
-	buf += snprintf(buf, end - buf, "binder transactions:\n");
-	hlist_for_each_entry(proc, pos, &binder_procs, proc_node) {
-		if (buf >= end)
-			break;
-		buf = print_binder_proc(buf, end, proc, 0);
-	}
-	if (do_lock)
-		mutex_unlock(&binder_lock);
-	if (buf > page + PAGE_SIZE)
-		buf = page + PAGE_SIZE;
-
-	*start = page + off;
-
-	len = buf - page;
-	if (len > off)
-		len -= off;
-	else
-		len = 0;
-
-	return len < count ? len  : count;
-}
-
-static int binder_read_proc_proc(char *page, char **start, off_t off,
-				 int count, int *eof, void *data)
-{
-	struct binder_proc *proc = data;
-	int len = 0;
-	char *p = page;
-	int do_lock = !binder_debug_no_lock;
-
-	if (off)
-		return 0;
-
-	if (do_lock)
-		mutex_lock(&binder_lock);
-	p += snprintf(p, PAGE_SIZE, "binder proc state:\n");
-	p = print_binder_proc(p, page + PAGE_SIZE, proc, 1);
-	if (do_lock)
-		mutex_unlock(&binder_lock);
-
-	if (p > page + PAGE_SIZE)
-		p = page + PAGE_SIZE;
-	*start = page + off;
-
-	len = p - page;
-	if (len > off)
-		len -= off;
-	else
-		len = 0;
-
-	return len < count ? len  : count;
-}
-
-static char *print_binder_transaction_log_entry(char *buf, char *end,
-					struct binder_transaction_log_entry *e)
-{
-	buf += snprintf(buf, end - buf,
-			"%d: %s from %d:%d to %d:%d node %d handle %d "
-			"size %d:%d\n",
-			e->debug_id, (e->call_type == 2) ? "reply" :
-			((e->call_type == 1) ? "async" : "call "), e->from_proc,
-			e->from_thread, e->to_proc, e->to_thread, e->to_node,
-			e->target_handle, e->data_size, e->offsets_size);
-	return buf;
-}
-
-static int binder_read_proc_transaction_log(
-	char *page, char **start, off_t off, int count, int *eof, void *data)
-{
-	struct binder_transaction_log *log = data;
-	int len = 0;
-	int i;
-	char *buf = page;
-	char *end = page + PAGE_SIZE;
-
-	if (off)
-		return 0;
-
-	if (log->full) {
-		for (i = log->next; i < ARRAY_SIZE(log->entry); i++) {
-			if (buf >= end)
-				break;
-			buf = print_binder_transaction_log_entry(buf, end,
-								&log->entry[i]);
-		}
-	}
-	for (i = 0; i < log->next; i++) {
-		if (buf >= end)
-			break;
-		buf = print_binder_transaction_log_entry(buf, end,
-							 &log->entry[i]);
-	}
-
-	*start = page + off;
-
-	len = buf - page;
-	if (len > off)
-		len -= off;
-	else
-		len = 0;
-
-	return len < count ? len  : count;
-}
-
-static const struct file_operations binder_fops = {
-	.owner = THIS_MODULE,
-	.poll = binder_poll,
-	.unlocked_ioctl = binder_ioctl,
-	.mmap = binder_mmap,
-	.open = binder_open,
-	.flush = binder_flush,
-	.release = binder_release,
-};
-
-static struct miscdevice binder_miscdev = {
-	.minor = MISC_DYNAMIC_MINOR,
-	.name = "binder",
-	.fops = &binder_fops
-};
-
-static int __init binder_init(void)
-{
-	int ret;
-
-	binder_proc_dir_entry_root = proc_mkdir("binder", NULL);
-	if (binder_proc_dir_entry_root)
-		binder_proc_dir_entry_proc = proc_mkdir("proc",
-						binder_proc_dir_entry_root);
-	ret = misc_register(&binder_miscdev);
-	if (binder_proc_dir_entry_root) {
-		create_proc_read_entry("state",
-				       S_IRUGO,
-				       binder_proc_dir_entry_root,
-				       binder_read_proc_state,
-				       NULL);
-		create_proc_read_entry("stats",
-				       S_IRUGO,
-				       binder_proc_dir_entry_root,
-				       binder_read_proc_stats,
-				       NULL);
-		create_proc_read_entry("transactions",
-				       S_IRUGO,
-				       binder_proc_dir_entry_root,
-				       binder_read_proc_transactions,
-				       NULL);
-		create_proc_read_entry("transaction_log",
-				       S_IRUGO,
-				       binder_proc_dir_entry_root,
-				       binder_read_proc_transaction_log,
-				       &binder_transaction_log);
-		create_proc_read_entry("failed_transaction_log",
-				       S_IRUGO,
-				       binder_proc_dir_entry_root,
-				       binder_read_proc_transaction_log,
-				       &binder_transaction_log_failed);
-	}
-	return ret;
-}
-
-device_initcall(binder_init);
-
-MODULE_LICENSE("GPL v2");
diff --git a/drivers/staging/android/binder.h b/drivers/staging/android/binder.h
deleted file mode 100644
index 863ae1ad5d55..000000000000
--- a/drivers/staging/android/binder.h
+++ /dev/null
@@ -1,330 +0,0 @@
-/*
- * Copyright (C) 2008 Google, Inc.
- *
- * Based on, but no longer compatible with, the original
- * OpenBinder.org binder driver interface, which is:
- *
- * Copyright (c) 2005 Palmsource, Inc.
- *
- * This software is licensed under the terms of the GNU General Public
- * License version 2, as published by the Free Software Foundation, and
- * may be copied, distributed, and modified under those terms.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- */
-
-#ifndef _LINUX_BINDER_H
-#define _LINUX_BINDER_H
-
-#include <linux/ioctl.h>
-
-#define B_PACK_CHARS(c1, c2, c3, c4) \
-	((((c1)<<24)) | (((c2)<<16)) | (((c3)<<8)) | (c4))
-#define B_TYPE_LARGE 0x85
-
-enum {
-	BINDER_TYPE_BINDER	= B_PACK_CHARS('s', 'b', '*', B_TYPE_LARGE),
-	BINDER_TYPE_WEAK_BINDER	= B_PACK_CHARS('w', 'b', '*', B_TYPE_LARGE),
-	BINDER_TYPE_HANDLE	= B_PACK_CHARS('s', 'h', '*', B_TYPE_LARGE),
-	BINDER_TYPE_WEAK_HANDLE	= B_PACK_CHARS('w', 'h', '*', B_TYPE_LARGE),
-	BINDER_TYPE_FD		= B_PACK_CHARS('f', 'd', '*', B_TYPE_LARGE),
-};
-
-enum {
-	FLAT_BINDER_FLAG_PRIORITY_MASK = 0xff,
-	FLAT_BINDER_FLAG_ACCEPTS_FDS = 0x100,
-};
-
-/*
- * This is the flattened representation of a Binder object for transfer
- * between processes.  The 'offsets' supplied as part of a binder transaction
- * contains offsets into the data where these structures occur.  The Binder
- * driver takes care of re-writing the structure type and data as it moves
- * between processes.
- */
-struct flat_binder_object {
-	/* 8 bytes for large_flat_header. */
-	unsigned long		type;
-	unsigned long		flags;
-
-	/* 8 bytes of data. */
-	union {
-		void		*binder;	/* local object */
-		signed long	handle;		/* remote object */
-	};
-
-	/* extra data associated with local object */
-	void			*cookie;
-};
-
-/*
- * On 64-bit platforms where user code may run in 32-bits the driver must
- * translate the buffer (and local binder) addresses apropriately.
- */
-
-struct binder_write_read {
-	signed long	write_size;	/* bytes to write */
-	signed long	write_consumed;	/* bytes consumed by driver */
-	unsigned long	write_buffer;
-	signed long	read_size;	/* bytes to read */
-	signed long	read_consumed;	/* bytes consumed by driver */
-	unsigned long	read_buffer;
-};
-
-/* Use with BINDER_VERSION, driver fills in fields. */
-struct binder_version {
-	/* driver protocol version -- increment with incompatible change */
-	signed long	protocol_version;
-};
-
-/* This is the current protocol version. */
-#define BINDER_CURRENT_PROTOCOL_VERSION 7
-
-#define BINDER_WRITE_READ   		_IOWR('b', 1, struct binder_write_read)
-#define	BINDER_SET_IDLE_TIMEOUT		_IOW('b', 3, int64_t)
-#define	BINDER_SET_MAX_THREADS		_IOW('b', 5, size_t)
-#define	BINDER_SET_IDLE_PRIORITY	_IOW('b', 6, int)
-#define	BINDER_SET_CONTEXT_MGR		_IOW('b', 7, int)
-#define	BINDER_THREAD_EXIT		_IOW('b', 8, int)
-#define BINDER_VERSION			_IOWR('b', 9, struct binder_version)
-
-/*
- * NOTE: Two special error codes you should check for when calling
- * in to the driver are:
- *
- * EINTR -- The operation has been interupted.  This should be
- * handled by retrying the ioctl() until a different error code
- * is returned.
- *
- * ECONNREFUSED -- The driver is no longer accepting operations
- * from your process.  That is, the process is being destroyed.
- * You should handle this by exiting from your process.  Note
- * that once this error code is returned, all further calls to
- * the driver from any thread will return this same code.
- */
-
-enum transaction_flags {
-	TF_ONE_WAY	= 0x01,	/* this is a one-way call: async, no return */
-	TF_ROOT_OBJECT	= 0x04,	/* contents are the component's root object */
-	TF_STATUS_CODE	= 0x08,	/* contents are a 32-bit status code */
-	TF_ACCEPT_FDS	= 0x10,	/* allow replies with file descriptors */
-};
-
-struct binder_transaction_data {
-	/* The first two are only used for bcTRANSACTION and brTRANSACTION,
-	 * identifying the target and contents of the transaction.
-	 */
-	union {
-		size_t	handle;	/* target descriptor of command transaction */
-		void	*ptr;	/* target descriptor of return transaction */
-	} target;
-	void		*cookie;	/* target object cookie */
-	unsigned int	code;		/* transaction command */
-
-	/* General information about the transaction. */
-	unsigned int	flags;
-	pid_t		sender_pid;
-	uid_t		sender_euid;
-	size_t		data_size;	/* number of bytes of data */
-	size_t		offsets_size;	/* number of bytes of offsets */
-
-	/* If this transaction is inline, the data immediately
-	 * follows here; otherwise, it ends with a pointer to
-	 * the data buffer.
-	 */
-	union {
-		struct {
-			/* transaction data */
-			const void	*buffer;
-			/* offsets from buffer to flat_binder_object structs */
-			const void	*offsets;
-		} ptr;
-		uint8_t	buf[8];
-	} data;
-};
-
-struct binder_ptr_cookie {
-	void *ptr;
-	void *cookie;
-};
-
-struct binder_pri_desc {
-	int priority;
-	int desc;
-};
-
-struct binder_pri_ptr_cookie {
-	int priority;
-	void *ptr;
-	void *cookie;
-};
-
-enum BinderDriverReturnProtocol {
-	BR_ERROR = _IOR('r', 0, int),
-	/*
-	 * int: error code
-	 */
-
-	BR_OK = _IO('r', 1),
-	/* No parameters! */
-
-	BR_TRANSACTION = _IOR('r', 2, struct binder_transaction_data),
-	BR_REPLY = _IOR('r', 3, struct binder_transaction_data),
-	/*
-	 * binder_transaction_data: the received command.
-	 */
-
-	BR_ACQUIRE_RESULT = _IOR('r', 4, int),
-	/*
-	 * not currently supported
-	 * int: 0 if the last bcATTEMPT_ACQUIRE was not successful.
-	 * Else the remote object has acquired a primary reference.
-	 */
-
-	BR_DEAD_REPLY = _IO('r', 5),
-	/*
-	 * The target of the last transaction (either a bcTRANSACTION or
-	 * a bcATTEMPT_ACQUIRE) is no longer with us.  No parameters.
-	 */
-
-	BR_TRANSACTION_COMPLETE = _IO('r', 6),
-	/*
-	 * No parameters... always refers to the last transaction requested
-	 * (including replies).  Note that this will be sent even for
-	 * asynchronous transactions.
-	 */
-
-	BR_INCREFS = _IOR('r', 7, struct binder_ptr_cookie),
-	BR_ACQUIRE = _IOR('r', 8, struct binder_ptr_cookie),
-	BR_RELEASE = _IOR('r', 9, struct binder_ptr_cookie),
-	BR_DECREFS = _IOR('r', 10, struct binder_ptr_cookie),
-	/*
-	 * void *:	ptr to binder
-	 * void *: cookie for binder
-	 */
-
-	BR_ATTEMPT_ACQUIRE = _IOR('r', 11, struct binder_pri_ptr_cookie),
-	/*
-	 * not currently supported
-	 * int:	priority
-	 * void *: ptr to binder
-	 * void *: cookie for binder
-	 */
-
-	BR_NOOP = _IO('r', 12),
-	/*
-	 * No parameters.  Do nothing and examine the next command.  It exists
-	 * primarily so that we can replace it with a BR_SPAWN_LOOPER command.
-	 */
-
-	BR_SPAWN_LOOPER = _IO('r', 13),
-	/*
-	 * No parameters.  The driver has determined that a process has no
-	 * threads waiting to service incomming transactions.  When a process
-	 * receives this command, it must spawn a new service thread and
-	 * register it via bcENTER_LOOPER.
-	 */
-
-	BR_FINISHED = _IO('r', 14),
-	/*
-	 * not currently supported
-	 * stop threadpool thread
-	 */
-
-	BR_DEAD_BINDER = _IOR('r', 15, void *),
-	/*
-	 * void *: cookie
-	 */
-	BR_CLEAR_DEATH_NOTIFICATION_DONE = _IOR('r', 16, void *),
-	/*
-	 * void *: cookie
-	 */
-
-	BR_FAILED_REPLY = _IO('r', 17),
-	/*
-	 * The the last transaction (either a bcTRANSACTION or
-	 * a bcATTEMPT_ACQUIRE) failed (e.g. out of memory).  No parameters.
-	 */
-};
-
-enum BinderDriverCommandProtocol {
-	BC_TRANSACTION = _IOW('c', 0, struct binder_transaction_data),
-	BC_REPLY = _IOW('c', 1, struct binder_transaction_data),
-	/*
-	 * binder_transaction_data: the sent command.
-	 */
-
-	BC_ACQUIRE_RESULT = _IOW('c', 2, int),
-	/*
-	 * not currently supported
-	 * int:  0 if the last BR_ATTEMPT_ACQUIRE was not successful.
-	 * Else you have acquired a primary reference on the object.
-	 */
-
-	BC_FREE_BUFFER = _IOW('c', 3, int),
-	/*
-	 * void *: ptr to transaction data received on a read
-	 */
-
-	BC_INCREFS = _IOW('c', 4, int),
-	BC_ACQUIRE = _IOW('c', 5, int),
-	BC_RELEASE = _IOW('c', 6, int),
-	BC_DECREFS = _IOW('c', 7, int),
-	/*
-	 * int:	descriptor
-	 */
-
-	BC_INCREFS_DONE = _IOW('c', 8, struct binder_ptr_cookie),
-	BC_ACQUIRE_DONE = _IOW('c', 9, struct binder_ptr_cookie),
-	/*
-	 * void *: ptr to binder
-	 * void *: cookie for binder
-	 */
-
-	BC_ATTEMPT_ACQUIRE = _IOW('c', 10, struct binder_pri_desc),
-	/*
-	 * not currently supported
-	 * int: priority
-	 * int: descriptor
-	 */
-
-	BC_REGISTER_LOOPER = _IO('c', 11),
-	/*
-	 * No parameters.
-	 * Register a spawned looper thread with the device.
-	 */
-
-	BC_ENTER_LOOPER = _IO('c', 12),
-	BC_EXIT_LOOPER = _IO('c', 13),
-	/*
-	 * No parameters.
-	 * These two commands are sent as an application-level thread
-	 * enters and exits the binder loop, respectively.  They are
-	 * used so the binder can have an accurate count of the number
-	 * of looping threads it has available.
-	 */
-
-	BC_REQUEST_DEATH_NOTIFICATION = _IOW('c', 14, struct binder_ptr_cookie),
-	/*
-	 * void *: ptr to binder
-	 * void *: cookie
-	 */
-
-	BC_CLEAR_DEATH_NOTIFICATION = _IOW('c', 15, struct binder_ptr_cookie),
-	/*
-	 * void *: ptr to binder
-	 * void *: cookie
-	 */
-
-	BC_DEAD_BINDER_DONE = _IOW('c', 16, void *),
-	/*
-	 * void *: cookie
-	 */
-};
-
-#endif /* _LINUX_BINDER_H */
-
diff --git a/drivers/staging/android/logger.c b/drivers/staging/android/logger.c
deleted file mode 100644
index 6c10b456c6cc..000000000000
--- a/drivers/staging/android/logger.c
+++ /dev/null
@@ -1,607 +0,0 @@
-/*
- * drivers/misc/logger.c
- *
- * A Logging Subsystem
- *
- * Copyright (C) 2007-2008 Google, Inc.
- *
- * Robert Love <rlove@google.com>
- *
- * This software is licensed under the terms of the GNU General Public
- * License version 2, as published by the Free Software Foundation, and
- * may be copied, distributed, and modified under those terms.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- */
-
-#include <linux/module.h>
-#include <linux/fs.h>
-#include <linux/miscdevice.h>
-#include <linux/uaccess.h>
-#include <linux/poll.h>
-#include <linux/time.h>
-#include "logger.h"
-
-#include <asm/ioctls.h>
-
-/*
- * struct logger_log - represents a specific log, such as 'main' or 'radio'
- *
- * This structure lives from module insertion until module removal, so it does
- * not need additional reference counting. The structure is protected by the
- * mutex 'mutex'.
- */
-struct logger_log {
-	unsigned char 		*buffer;/* the ring buffer itself */
-	struct miscdevice	misc;	/* misc device representing the log */
-	wait_queue_head_t	wq;	/* wait queue for readers */
-	struct list_head	readers; /* this log's readers */
-	struct mutex		mutex;	/* mutex protecting buffer */
-	size_t			w_off;	/* current write head offset */
-	size_t			head;	/* new readers start here */
-	size_t			size;	/* size of the log */
-};
-
-/*
- * struct logger_reader - a logging device open for reading
- *
- * This object lives from open to release, so we don't need additional
- * reference counting. The structure is protected by log->mutex.
- */
-struct logger_reader {
-	struct logger_log	*log;	/* associated log */
-	struct list_head	list;	/* entry in logger_log's list */
-	size_t			r_off;	/* current read head offset */
-};
-
-/* logger_offset - returns index 'n' into the log via (optimized) modulus */
-#define logger_offset(n)	((n) & (log->size - 1))
-
-/*
- * file_get_log - Given a file structure, return the associated log
- *
- * This isn't aesthetic. We have several goals:
- *
- * 	1) Need to quickly obtain the associated log during an I/O operation
- * 	2) Readers need to maintain state (logger_reader)
- * 	3) Writers need to be very fast (open() should be a near no-op)
- *
- * In the reader case, we can trivially go file->logger_reader->logger_log.
- * For a writer, we don't want to maintain a logger_reader, so we just go
- * file->logger_log. Thus what file->private_data points at depends on whether
- * or not the file was opened for reading. This function hides that dirtiness.
- */
-static inline struct logger_log *file_get_log(struct file *file)
-{
-	if (file->f_mode & FMODE_READ) {
-		struct logger_reader *reader = file->private_data;
-		return reader->log;
-	} else
-		return file->private_data;
-}
-
-/*
- * get_entry_len - Grabs the length of the payload of the next entry starting
- * from 'off'.
- *
- * Caller needs to hold log->mutex.
- */
-static __u32 get_entry_len(struct logger_log *log, size_t off)
-{
-	__u16 val;
-
-	switch (log->size - off) {
-	case 1:
-		memcpy(&val, log->buffer + off, 1);
-		memcpy(((char *) &val) + 1, log->buffer, 1);
-		break;
-	default:
-		memcpy(&val, log->buffer + off, 2);
-	}
-
-	return sizeof(struct logger_entry) + val;
-}
-
-/*
- * do_read_log_to_user - reads exactly 'count' bytes from 'log' into the
- * user-space buffer 'buf'. Returns 'count' on success.
- *
- * Caller must hold log->mutex.
- */
-static ssize_t do_read_log_to_user(struct logger_log *log,
-				   struct logger_reader *reader,
-				   char __user *buf,
-				   size_t count)
-{
-	size_t len;
-
-	/*
-	 * We read from the log in two disjoint operations. First, we read from
-	 * the current read head offset up to 'count' bytes or to the end of
-	 * the log, whichever comes first.
-	 */
-	len = min(count, log->size - reader->r_off);
-	if (copy_to_user(buf, log->buffer + reader->r_off, len))
-		return -EFAULT;
-
-	/*
-	 * Second, we read any remaining bytes, starting back at the head of
-	 * the log.
-	 */
-	if (count != len)
-		if (copy_to_user(buf + len, log->buffer, count - len))
-			return -EFAULT;
-
-	reader->r_off = logger_offset(reader->r_off + count);
-
-	return count;
-}
-
-/*
- * logger_read - our log's read() method
- *
- * Behavior:
- *
- * 	- O_NONBLOCK works
- * 	- If there are no log entries to read, blocks until log is written to
- * 	- Atomically reads exactly one log entry
- *
- * Optimal read size is LOGGER_ENTRY_MAX_LEN. Will set errno to EINVAL if read
- * buffer is insufficient to hold next entry.
- */
-static ssize_t logger_read(struct file *file, char __user *buf,
-			   size_t count, loff_t *pos)
-{
-	struct logger_reader *reader = file->private_data;
-	struct logger_log *log = reader->log;
-	ssize_t ret;
-	DEFINE_WAIT(wait);
-
-start:
-	while (1) {
-		prepare_to_wait(&log->wq, &wait, TASK_INTERRUPTIBLE);
-
-		mutex_lock(&log->mutex);
-		ret = (log->w_off == reader->r_off);
-		mutex_unlock(&log->mutex);
-		if (!ret)
-			break;
-
-		if (file->f_flags & O_NONBLOCK) {
-			ret = -EAGAIN;
-			break;
-		}
-
-		if (signal_pending(current)) {
-			ret = -EINTR;
-			break;
-		}
-
-		schedule();
-	}
-
-	finish_wait(&log->wq, &wait);
-	if (ret)
-		return ret;
-
-	mutex_lock(&log->mutex);
-
-	/* is there still something to read or did we race? */
-	if (unlikely(log->w_off == reader->r_off)) {
-		mutex_unlock(&log->mutex);
-		goto start;
-	}
-
-	/* get the size of the next entry */
-	ret = get_entry_len(log, reader->r_off);
-	if (count < ret) {
-		ret = -EINVAL;
-		goto out;
-	}
-
-	/* get exactly one entry from the log */
-	ret = do_read_log_to_user(log, reader, buf, ret);
-
-out:
-	mutex_unlock(&log->mutex);
-
-	return ret;
-}
-
-/*
- * get_next_entry - return the offset of the first valid entry at least 'len'
- * bytes after 'off'.
- *
- * Caller must hold log->mutex.
- */
-static size_t get_next_entry(struct logger_log *log, size_t off, size_t len)
-{
-	size_t count = 0;
-
-	do {
-		size_t nr = get_entry_len(log, off);
-		off = logger_offset(off + nr);
-		count += nr;
-	} while (count < len);
-
-	return off;
-}
-
-/*
- * clock_interval - is a < c < b in mod-space? Put another way, does the line
- * from a to b cross c?
- */
-static inline int clock_interval(size_t a, size_t b, size_t c)
-{
-	if (b < a) {
-		if (a < c || b >= c)
-			return 1;
-	} else {
-		if (a < c && b >= c)
-			return 1;
-	}
-
-	return 0;
-}
-
-/*
- * fix_up_readers - walk the list of all readers and "fix up" any who were
- * lapped by the writer; also do the same for the default "start head".
- * We do this by "pulling forward" the readers and start head to the first
- * entry after the new write head.
- *
- * The caller needs to hold log->mutex.
- */
-static void fix_up_readers(struct logger_log *log, size_t len)
-{
-	size_t old = log->w_off;
-	size_t new = logger_offset(old + len);
-	struct logger_reader *reader;
-
-	if (clock_interval(old, new, log->head))
-		log->head = get_next_entry(log, log->head, len);
-
-	list_for_each_entry(reader, &log->readers, list)
-		if (clock_interval(old, new, reader->r_off))
-			reader->r_off = get_next_entry(log, reader->r_off, len);
-}
-
-/*
- * do_write_log - writes 'len' bytes from 'buf' to 'log'
- *
- * The caller needs to hold log->mutex.
- */
-static void do_write_log(struct logger_log *log, const void *buf, size_t count)
-{
-	size_t len;
-
-	len = min(count, log->size - log->w_off);
-	memcpy(log->buffer + log->w_off, buf, len);
-
-	if (count != len)
-		memcpy(log->buffer, buf + len, count - len);
-
-	log->w_off = logger_offset(log->w_off + count);
-
-}
-
-/*
- * do_write_log_user - writes 'len' bytes from the user-space buffer 'buf' to
- * the log 'log'
- *
- * The caller needs to hold log->mutex.
- *
- * Returns 'count' on success, negative error code on failure.
- */
-static ssize_t do_write_log_from_user(struct logger_log *log,
-				      const void __user *buf, size_t count)
-{
-	size_t len;
-
-	len = min(count, log->size - log->w_off);
-	if (len && copy_from_user(log->buffer + log->w_off, buf, len))
-		return -EFAULT;
-
-	if (count != len)
-		if (copy_from_user(log->buffer, buf + len, count - len))
-			return -EFAULT;
-
-	log->w_off = logger_offset(log->w_off + count);
-
-	return count;
-}
-
-/*
- * logger_aio_write - our write method, implementing support for write(),
- * writev(), and aio_write(). Writes are our fast path, and we try to optimize
- * them above all else.
- */
-ssize_t logger_aio_write(struct kiocb *iocb, const struct iovec *iov,
-			 unsigned long nr_segs, loff_t ppos)
-{
-	struct logger_log *log = file_get_log(iocb->ki_filp);
-	size_t orig = log->w_off;
-	struct logger_entry header;
-	struct timespec now;
-	ssize_t ret = 0;
-
-	now = current_kernel_time();
-
-	header.pid = current->tgid;
-	header.tid = current->pid;
-	header.sec = now.tv_sec;
-	header.nsec = now.tv_nsec;
-	header.len = min_t(size_t, iocb->ki_left, LOGGER_ENTRY_MAX_PAYLOAD);
-
-	/* null writes succeed, return zero */
-	if (unlikely(!header.len))
-		return 0;
-
-	mutex_lock(&log->mutex);
-
-	/*
-	 * Fix up any readers, pulling them forward to the first readable
-	 * entry after (what will be) the new write offset. We do this now
-	 * because if we partially fail, we can end up with clobbered log
-	 * entries that encroach on readable buffer.
-	 */
-	fix_up_readers(log, sizeof(struct logger_entry) + header.len);
-
-	do_write_log(log, &header, sizeof(struct logger_entry));
-
-	while (nr_segs-- > 0) {
-		size_t len;
-		ssize_t nr;
-
-		/* figure out how much of this vector we can keep */
-		len = min_t(size_t, iov->iov_len, header.len - ret);
-
-		/* write out this segment's payload */
-		nr = do_write_log_from_user(log, iov->iov_base, len);
-		if (unlikely(nr < 0)) {
-			log->w_off = orig;
-			mutex_unlock(&log->mutex);
-			return nr;
-		}
-
-		iov++;
-		ret += nr;
-	}
-
-	mutex_unlock(&log->mutex);
-
-	/* wake up any blocked readers */
-	wake_up_interruptible(&log->wq);
-
-	return ret;
-}
-
-static struct logger_log *get_log_from_minor(int);
-
-/*
- * logger_open - the log's open() file operation
- *
- * Note how near a no-op this is in the write-only case. Keep it that way!
- */
-static int logger_open(struct inode *inode, struct file *file)
-{
-	struct logger_log *log;
-	int ret;
-
-	ret = nonseekable_open(inode, file);
-	if (ret)
-		return ret;
-
-	log = get_log_from_minor(MINOR(inode->i_rdev));
-	if (!log)
-		return -ENODEV;
-
-	if (file->f_mode & FMODE_READ) {
-		struct logger_reader *reader;
-
-		reader = kmalloc(sizeof(struct logger_reader), GFP_KERNEL);
-		if (!reader)
-			return -ENOMEM;
-
-		reader->log = log;
-		INIT_LIST_HEAD(&reader->list);
-
-		mutex_lock(&log->mutex);
-		reader->r_off = log->head;
-		list_add_tail(&reader->list, &log->readers);
-		mutex_unlock(&log->mutex);
-
-		file->private_data = reader;
-	} else
-		file->private_data = log;
-
-	return 0;
-}
-
-/*
- * logger_release - the log's release file operation
- *
- * Note this is a total no-op in the write-only case. Keep it that way!
- */
-static int logger_release(struct inode *ignored, struct file *file)
-{
-	if (file->f_mode & FMODE_READ) {
-		struct logger_reader *reader = file->private_data;
-		list_del(&reader->list);
-		kfree(reader);
-	}
-
-	return 0;
-}
-
-/*
- * logger_poll - the log's poll file operation, for poll/select/epoll
- *
- * Note we always return POLLOUT, because you can always write() to the log.
- * Note also that, strictly speaking, a return value of POLLIN does not
- * guarantee that the log is readable without blocking, as there is a small
- * chance that the writer can lap the reader in the interim between poll()
- * returning and the read() request.
- */
-static unsigned int logger_poll(struct file *file, poll_table *wait)
-{
-	struct logger_reader *reader;
-	struct logger_log *log;
-	unsigned int ret = POLLOUT | POLLWRNORM;
-
-	if (!(file->f_mode & FMODE_READ))
-		return ret;
-
-	reader = file->private_data;
-	log = reader->log;
-
-	poll_wait(file, &log->wq, wait);
-
-	mutex_lock(&log->mutex);
-	if (log->w_off != reader->r_off)
-		ret |= POLLIN | POLLRDNORM;
-	mutex_unlock(&log->mutex);
-
-	return ret;
-}
-
-static long logger_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
-{
-	struct logger_log *log = file_get_log(file);
-	struct logger_reader *reader;
-	long ret = -ENOTTY;
-
-	mutex_lock(&log->mutex);
-
-	switch (cmd) {
-	case LOGGER_GET_LOG_BUF_SIZE:
-		ret = log->size;
-		break;
-	case LOGGER_GET_LOG_LEN:
-		if (!(file->f_mode & FMODE_READ)) {
-			ret = -EBADF;
-			break;
-		}
-		reader = file->private_data;
-		if (log->w_off >= reader->r_off)
-			ret = log->w_off - reader->r_off;
-		else
-			ret = (log->size - reader->r_off) + log->w_off;
-		break;
-	case LOGGER_GET_NEXT_ENTRY_LEN:
-		if (!(file->f_mode & FMODE_READ)) {
-			ret = -EBADF;
-			break;
-		}
-		reader = file->private_data;
-		if (log->w_off != reader->r_off)
-			ret = get_entry_len(log, reader->r_off);
-		else
-			ret = 0;
-		break;
-	case LOGGER_FLUSH_LOG:
-		if (!(file->f_mode & FMODE_WRITE)) {
-			ret = -EBADF;
-			break;
-		}
-		list_for_each_entry(reader, &log->readers, list)
-			reader->r_off = log->w_off;
-		log->head = log->w_off;
-		ret = 0;
-		break;
-	}
-
-	mutex_unlock(&log->mutex);
-
-	return ret;
-}
-
-static const struct file_operations logger_fops = {
-	.owner = THIS_MODULE,
-	.read = logger_read,
-	.aio_write = logger_aio_write,
-	.poll = logger_poll,
-	.unlocked_ioctl = logger_ioctl,
-	.compat_ioctl = logger_ioctl,
-	.open = logger_open,
-	.release = logger_release,
-};
-
-/*
- * Defines a log structure with name 'NAME' and a size of 'SIZE' bytes, which
- * must be a power of two, greater than LOGGER_ENTRY_MAX_LEN, and less than
- * LONG_MAX minus LOGGER_ENTRY_MAX_LEN.
- */
-#define DEFINE_LOGGER_DEVICE(VAR, NAME, SIZE) \
-static unsigned char _buf_ ## VAR[SIZE]; \
-static struct logger_log VAR = { \
-	.buffer = _buf_ ## VAR, \
-	.misc = { \
-		.minor = MISC_DYNAMIC_MINOR, \
-		.name = NAME, \
-		.fops = &logger_fops, \
-		.parent = NULL, \
-	}, \
-	.wq = __WAIT_QUEUE_HEAD_INITIALIZER(VAR .wq), \
-	.readers = LIST_HEAD_INIT(VAR .readers), \
-	.mutex = __MUTEX_INITIALIZER(VAR .mutex), \
-	.w_off = 0, \
-	.head = 0, \
-	.size = SIZE, \
-};
-
-DEFINE_LOGGER_DEVICE(log_main, LOGGER_LOG_MAIN, 64*1024)
-DEFINE_LOGGER_DEVICE(log_events, LOGGER_LOG_EVENTS, 256*1024)
-DEFINE_LOGGER_DEVICE(log_radio, LOGGER_LOG_RADIO, 64*1024)
-
-static struct logger_log *get_log_from_minor(int minor)
-{
-	if (log_main.misc.minor == minor)
-		return &log_main;
-	if (log_events.misc.minor == minor)
-		return &log_events;
-	if (log_radio.misc.minor == minor)
-		return &log_radio;
-	return NULL;
-}
-
-static int __init init_log(struct logger_log *log)
-{
-	int ret;
-
-	ret = misc_register(&log->misc);
-	if (unlikely(ret)) {
-		printk(KERN_ERR "logger: failed to register misc "
-		       "device for log '%s'!\n", log->misc.name);
-		return ret;
-	}
-
-	printk(KERN_INFO "logger: created %luK log '%s'\n",
-	       (unsigned long) log->size >> 10, log->misc.name);
-
-	return 0;
-}
-
-static int __init logger_init(void)
-{
-	int ret;
-
-	ret = init_log(&log_main);
-	if (unlikely(ret))
-		goto out;
-
-	ret = init_log(&log_events);
-	if (unlikely(ret))
-		goto out;
-
-	ret = init_log(&log_radio);
-	if (unlikely(ret))
-		goto out;
-
-out:
-	return ret;
-}
-device_initcall(logger_init);
diff --git a/drivers/staging/android/logger.h b/drivers/staging/android/logger.h
deleted file mode 100644
index a562434d7419..000000000000
--- a/drivers/staging/android/logger.h
+++ /dev/null
@@ -1,48 +0,0 @@
-/* include/linux/logger.h
- *
- * Copyright (C) 2007-2008 Google, Inc.
- * Author: Robert Love <rlove@android.com>
- *
- * This software is licensed under the terms of the GNU General Public
- * License version 2, as published by the Free Software Foundation, and
- * may be copied, distributed, and modified under those terms.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- */
-
-#ifndef _LINUX_LOGGER_H
-#define _LINUX_LOGGER_H
-
-#include <linux/types.h>
-#include <linux/ioctl.h>
-
-struct logger_entry {
-	__u16		len;	/* length of the payload */
-	__u16		__pad;	/* no matter what, we get 2 bytes of padding */
-	__s32		pid;	/* generating process's pid */
-	__s32		tid;	/* generating process's tid */
-	__s32		sec;	/* seconds since Epoch */
-	__s32		nsec;	/* nanoseconds */
-	char		msg[0];	/* the entry's payload */
-};
-
-#define LOGGER_LOG_RADIO	"log_radio"	/* radio-related messages */
-#define LOGGER_LOG_EVENTS	"log_events"	/* system/hardware events */
-#define LOGGER_LOG_MAIN		"log_main"	/* everything else */
-
-#define LOGGER_ENTRY_MAX_LEN		(4*1024)
-#define LOGGER_ENTRY_MAX_PAYLOAD	\
-	(LOGGER_ENTRY_MAX_LEN - sizeof(struct logger_entry))
-
-#define __LOGGERIO	0xAE
-
-#define LOGGER_GET_LOG_BUF_SIZE		_IO(__LOGGERIO, 1) /* size of log */
-#define LOGGER_GET_LOG_LEN		_IO(__LOGGERIO, 2) /* used log len */
-#define LOGGER_GET_NEXT_ENTRY_LEN	_IO(__LOGGERIO, 3) /* next entry len */
-#define LOGGER_FLUSH_LOG		_IO(__LOGGERIO, 4) /* flush log */
-
-#endif /* _LINUX_LOGGER_H */
diff --git a/drivers/staging/android/lowmemorykiller.c b/drivers/staging/android/lowmemorykiller.c
deleted file mode 100644
index 935d281a201a..000000000000
--- a/drivers/staging/android/lowmemorykiller.c
+++ /dev/null
@@ -1,173 +0,0 @@
-/* drivers/misc/lowmemorykiller.c
- *
- * The lowmemorykiller driver lets user-space specify a set of memory thresholds
- * where processes with a range of oom_adj values will get killed. Specify the
- * minimum oom_adj values in /sys/module/lowmemorykiller/parameters/adj and the
- * number of free pages in /sys/module/lowmemorykiller/parameters/minfree. Both
- * files take a comma separated list of numbers in ascending order.
- *
- * For example, write "0,8" to /sys/module/lowmemorykiller/parameters/adj and
- * "1024,4096" to /sys/module/lowmemorykiller/parameters/minfree to kill processes
- * with a oom_adj value of 8 or higher when the free memory drops below 4096 pages
- * and kill processes with a oom_adj value of 0 or higher when the free memory
- * drops below 1024 pages.
- *
- * The driver considers memory used for caches to be free, but if a large
- * percentage of the cached memory is locked this can be very inaccurate
- * and processes may not get killed until the normal oom killer is triggered.
- *
- * Copyright (C) 2007-2008 Google, Inc.
- *
- * This software is licensed under the terms of the GNU General Public
- * License version 2, as published by the Free Software Foundation, and
- * may be copied, distributed, and modified under those terms.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- */
-
-#include <linux/module.h>
-#include <linux/kernel.h>
-#include <linux/mm.h>
-#include <linux/oom.h>
-#include <linux/sched.h>
-
-static uint32_t lowmem_debug_level = 2;
-static int lowmem_adj[6] = {
-	0,
-	1,
-	6,
-	12,
-};
-static int lowmem_adj_size = 4;
-static size_t lowmem_minfree[6] = {
-	3 * 512,	/* 6MB */
-	2 * 1024,	/* 8MB */
-	4 * 1024,	/* 16MB */
-	16 * 1024,	/* 64MB */
-};
-static int lowmem_minfree_size = 4;
-
-#define lowmem_print(level, x...)			\
-	do {						\
-		if (lowmem_debug_level >= (level))	\
-			printk(x);			\
-	} while (0)
-
-static int lowmem_shrink(int nr_to_scan, gfp_t gfp_mask)
-{
-	struct task_struct *p;
-	struct task_struct *selected = NULL;
-	int rem = 0;
-	int tasksize;
-	int i;
-	int min_adj = OOM_ADJUST_MAX + 1;
-	int selected_tasksize = 0;
-	int selected_oom_adj;
-	int array_size = ARRAY_SIZE(lowmem_adj);
-	int other_free = global_page_state(NR_FREE_PAGES);
-	int other_file = global_page_state(NR_FILE_PAGES);
-
-	if (lowmem_adj_size < array_size)
-		array_size = lowmem_adj_size;
-	if (lowmem_minfree_size < array_size)
-		array_size = lowmem_minfree_size;
-	for (i = 0; i < array_size; i++) {
-		if (other_free < lowmem_minfree[i] &&
-		    other_file < lowmem_minfree[i]) {
-			min_adj = lowmem_adj[i];
-			break;
-		}
-	}
-	if (nr_to_scan > 0)
-		lowmem_print(3, "lowmem_shrink %d, %x, ofree %d %d, ma %d\n",
-			     nr_to_scan, gfp_mask, other_free, other_file,
-			     min_adj);
-	rem = global_page_state(NR_ACTIVE_ANON) +
-		global_page_state(NR_ACTIVE_FILE) +
-		global_page_state(NR_INACTIVE_ANON) +
-		global_page_state(NR_INACTIVE_FILE);
-	if (nr_to_scan <= 0 || min_adj == OOM_ADJUST_MAX + 1) {
-		lowmem_print(5, "lowmem_shrink %d, %x, return %d\n",
-			     nr_to_scan, gfp_mask, rem);
-		return rem;
-	}
-	selected_oom_adj = min_adj;
-
-	read_lock(&tasklist_lock);
-	for_each_process(p) {
-		struct mm_struct *mm;
-		int oom_adj;
-
-		task_lock(p);
-		mm = p->mm;
-		if (!mm) {
-			task_unlock(p);
-			continue;
-		}
-		oom_adj = mm->oom_adj;
-		if (oom_adj < min_adj) {
-			task_unlock(p);
-			continue;
-		}
-		tasksize = get_mm_rss(mm);
-		task_unlock(p);
-		if (tasksize <= 0)
-			continue;
-		if (selected) {
-			if (oom_adj < selected_oom_adj)
-				continue;
-			if (oom_adj == selected_oom_adj &&
-			    tasksize <= selected_tasksize)
-				continue;
-		}
-		selected = p;
-		selected_tasksize = tasksize;
-		selected_oom_adj = oom_adj;
-		lowmem_print(2, "select %d (%s), adj %d, size %d, to kill\n",
-			     p->pid, p->comm, oom_adj, tasksize);
-	}
-	if (selected) {
-		lowmem_print(1, "send sigkill to %d (%s), adj %d, size %d\n",
-			     selected->pid, selected->comm,
-			     selected_oom_adj, selected_tasksize);
-		force_sig(SIGKILL, selected);
-		rem -= selected_tasksize;
-	}
-	lowmem_print(4, "lowmem_shrink %d, %x, return %d\n",
-		     nr_to_scan, gfp_mask, rem);
-	read_unlock(&tasklist_lock);
-	return rem;
-}
-
-static struct shrinker lowmem_shrinker = {
-	.shrink = lowmem_shrink,
-	.seeks = DEFAULT_SEEKS * 16
-};
-
-static int __init lowmem_init(void)
-{
-	register_shrinker(&lowmem_shrinker);
-	return 0;
-}
-
-static void __exit lowmem_exit(void)
-{
-	unregister_shrinker(&lowmem_shrinker);
-}
-
-module_param_named(cost, lowmem_shrinker.seeks, int, S_IRUGO | S_IWUSR);
-module_param_array_named(adj, lowmem_adj, int, &lowmem_adj_size,
-			 S_IRUGO | S_IWUSR);
-module_param_array_named(minfree, lowmem_minfree, uint, &lowmem_minfree_size,
-			 S_IRUGO | S_IWUSR);
-module_param_named(debug_level, lowmem_debug_level, uint, S_IRUGO | S_IWUSR);
-
-module_init(lowmem_init);
-module_exit(lowmem_exit);
-
-MODULE_LICENSE("GPL");
-
diff --git a/drivers/staging/android/ram_console.c b/drivers/staging/android/ram_console.c
deleted file mode 100644
index 8f18a59744cd..000000000000
--- a/drivers/staging/android/ram_console.c
+++ /dev/null
@@ -1,410 +0,0 @@
-/* drivers/android/ram_console.c
- *
- * Copyright (C) 2007-2008 Google, Inc.
- *
- * This software is licensed under the terms of the GNU General Public
- * License version 2, as published by the Free Software Foundation, and
- * may be copied, distributed, and modified under those terms.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- */
-
-#include <linux/console.h>
-#include <linux/init.h>
-#include <linux/module.h>
-#include <linux/platform_device.h>
-#include <linux/proc_fs.h>
-#include <linux/string.h>
-#include <linux/uaccess.h>
-#include <linux/io.h>
-
-#ifdef CONFIG_ANDROID_RAM_CONSOLE_ERROR_CORRECTION
-#include <linux/rslib.h>
-#endif
-
-struct ram_console_buffer {
-	uint32_t    sig;
-	uint32_t    start;
-	uint32_t    size;
-	uint8_t     data[0];
-};
-
-#define RAM_CONSOLE_SIG (0x43474244) /* DBGC */
-
-#ifdef CONFIG_ANDROID_RAM_CONSOLE_EARLY_INIT
-static char __initdata
-	ram_console_old_log_init_buffer[CONFIG_ANDROID_RAM_CONSOLE_EARLY_SIZE];
-#endif
-static char *ram_console_old_log;
-static size_t ram_console_old_log_size;
-
-static struct ram_console_buffer *ram_console_buffer;
-static size_t ram_console_buffer_size;
-#ifdef CONFIG_ANDROID_RAM_CONSOLE_ERROR_CORRECTION
-static char *ram_console_par_buffer;
-static struct rs_control *ram_console_rs_decoder;
-static int ram_console_corrected_bytes;
-static int ram_console_bad_blocks;
-#define ECC_BLOCK_SIZE CONFIG_ANDROID_RAM_CONSOLE_ERROR_CORRECTION_DATA_SIZE
-#define ECC_SIZE CONFIG_ANDROID_RAM_CONSOLE_ERROR_CORRECTION_ECC_SIZE
-#define ECC_SYMSIZE CONFIG_ANDROID_RAM_CONSOLE_ERROR_CORRECTION_SYMBOL_SIZE
-#define ECC_POLY CONFIG_ANDROID_RAM_CONSOLE_ERROR_CORRECTION_POLYNOMIAL
-#endif
-
-#ifdef CONFIG_ANDROID_RAM_CONSOLE_ERROR_CORRECTION
-static void ram_console_encode_rs8(uint8_t *data, size_t len, uint8_t *ecc)
-{
-	int i;
-	uint16_t par[ECC_SIZE];
-	/* Initialize the parity buffer */
-	memset(par, 0, sizeof(par));
-	encode_rs8(ram_console_rs_decoder, data, len, par, 0);
-	for (i = 0; i < ECC_SIZE; i++)
-		ecc[i] = par[i];
-}
-
-static int ram_console_decode_rs8(void *data, size_t len, uint8_t *ecc)
-{
-	int i;
-	uint16_t par[ECC_SIZE];
-	for (i = 0; i < ECC_SIZE; i++)
-		par[i] = ecc[i];
-	return decode_rs8(ram_console_rs_decoder, data, par, len,
-				NULL, 0, NULL, 0, NULL);
-}
-#endif
-
-static void ram_console_update(const char *s, unsigned int count)
-{
-	struct ram_console_buffer *buffer = ram_console_buffer;
-#ifdef CONFIG_ANDROID_RAM_CONSOLE_ERROR_CORRECTION
-	uint8_t *buffer_end = buffer->data + ram_console_buffer_size;
-	uint8_t *block;
-	uint8_t *par;
-	int size = ECC_BLOCK_SIZE;
-#endif
-	memcpy(buffer->data + buffer->start, s, count);
-#ifdef CONFIG_ANDROID_RAM_CONSOLE_ERROR_CORRECTION
-	block = buffer->data + (buffer->start & ~(ECC_BLOCK_SIZE - 1));
-	par = ram_console_par_buffer +
-	      (buffer->start / ECC_BLOCK_SIZE) * ECC_SIZE;
-	do {
-		if (block + ECC_BLOCK_SIZE > buffer_end)
-			size = buffer_end - block;
-		ram_console_encode_rs8(block, size, par);
-		block += ECC_BLOCK_SIZE;
-		par += ECC_SIZE;
-	} while (block < buffer->data + buffer->start + count);
-#endif
-}
-
-static void ram_console_update_header(void)
-{
-#ifdef CONFIG_ANDROID_RAM_CONSOLE_ERROR_CORRECTION
-	struct ram_console_buffer *buffer = ram_console_buffer;
-	uint8_t *par;
-	par = ram_console_par_buffer +
-	      DIV_ROUND_UP(ram_console_buffer_size, ECC_BLOCK_SIZE) * ECC_SIZE;
-	ram_console_encode_rs8((uint8_t *)buffer, sizeof(*buffer), par);
-#endif
-}
-
-static void
-ram_console_write(struct console *console, const char *s, unsigned int count)
-{
-	int rem;
-	struct ram_console_buffer *buffer = ram_console_buffer;
-
-	if (count > ram_console_buffer_size) {
-		s += count - ram_console_buffer_size;
-		count = ram_console_buffer_size;
-	}
-	rem = ram_console_buffer_size - buffer->start;
-	if (rem < count) {
-		ram_console_update(s, rem);
-		s += rem;
-		count -= rem;
-		buffer->start = 0;
-		buffer->size = ram_console_buffer_size;
-	}
-	ram_console_update(s, count);
-
-	buffer->start += count;
-	if (buffer->size < ram_console_buffer_size)
-		buffer->size += count;
-	ram_console_update_header();
-}
-
-static struct console ram_console = {
-	.name	= "ram",
-	.write	= ram_console_write,
-	.flags	= CON_PRINTBUFFER | CON_ENABLED,
-	.index	= -1,
-};
-
-static void __init
-ram_console_save_old(struct ram_console_buffer *buffer, char *dest)
-{
-	size_t old_log_size = buffer->size;
-#ifdef CONFIG_ANDROID_RAM_CONSOLE_ERROR_CORRECTION
-	uint8_t *block;
-	uint8_t *par;
-	char strbuf[80];
-	int strbuf_len;
-
-	block = buffer->data;
-	par = ram_console_par_buffer;
-	while (block < buffer->data + buffer->size) {
-		int numerr;
-		int size = ECC_BLOCK_SIZE;
-		if (block + size > buffer->data + ram_console_buffer_size)
-			size = buffer->data + ram_console_buffer_size - block;
-		numerr = ram_console_decode_rs8(block, size, par);
-		if (numerr > 0) {
-#if 0
-			printk(KERN_INFO "ram_console: error in block %p, %d\n",
-			       block, numerr);
-#endif
-			ram_console_corrected_bytes += numerr;
-		} else if (numerr < 0) {
-#if 0
-			printk(KERN_INFO "ram_console: uncorrectable error in "
-			       "block %p\n", block);
-#endif
-			ram_console_bad_blocks++;
-		}
-		block += ECC_BLOCK_SIZE;
-		par += ECC_SIZE;
-	}
-	if (ram_console_corrected_bytes || ram_console_bad_blocks)
-		strbuf_len = snprintf(strbuf, sizeof(strbuf),
-			"\n%d Corrected bytes, %d unrecoverable blocks\n",
-			ram_console_corrected_bytes, ram_console_bad_blocks);
-	else
-		strbuf_len = snprintf(strbuf, sizeof(strbuf),
-				      "\nNo errors detected\n");
-	if (strbuf_len >= sizeof(strbuf))
-		strbuf_len = sizeof(strbuf) - 1;
-	old_log_size += strbuf_len;
-#endif
-
-	if (dest == NULL) {
-		dest = kmalloc(old_log_size, GFP_KERNEL);
-		if (dest == NULL) {
-			printk(KERN_ERR
-			       "ram_console: failed to allocate buffer\n");
-			return;
-		}
-	}
-
-	ram_console_old_log = dest;
-	ram_console_old_log_size = old_log_size;
-	memcpy(ram_console_old_log,
-	       &buffer->data[buffer->start], buffer->size - buffer->start);
-	memcpy(ram_console_old_log + buffer->size - buffer->start,
-	       &buffer->data[0], buffer->start);
-#ifdef CONFIG_ANDROID_RAM_CONSOLE_ERROR_CORRECTION
-	memcpy(ram_console_old_log + old_log_size - strbuf_len,
-	       strbuf, strbuf_len);
-#endif
-}
-
-static int __init ram_console_init(struct ram_console_buffer *buffer,
-				   size_t buffer_size, char *old_buf)
-{
-#ifdef CONFIG_ANDROID_RAM_CONSOLE_ERROR_CORRECTION
-	int numerr;
-	uint8_t *par;
-#endif
-	ram_console_buffer = buffer;
-	ram_console_buffer_size =
-		buffer_size - sizeof(struct ram_console_buffer);
-
-	if (ram_console_buffer_size > buffer_size) {
-		pr_err("ram_console: buffer %p, invalid size %zu, "
-		       "datasize %zu\n", buffer, buffer_size,
-		       ram_console_buffer_size);
-		return 0;
-	}
-
-#ifdef CONFIG_ANDROID_RAM_CONSOLE_ERROR_CORRECTION
-	ram_console_buffer_size -= (DIV_ROUND_UP(ram_console_buffer_size,
-						ECC_BLOCK_SIZE) + 1) * ECC_SIZE;
-
-	if (ram_console_buffer_size > buffer_size) {
-		pr_err("ram_console: buffer %p, invalid size %zu, "
-		       "non-ecc datasize %zu\n",
-		       buffer, buffer_size, ram_console_buffer_size);
-		return 0;
-	}
-
-	ram_console_par_buffer = buffer->data + ram_console_buffer_size;
-
-
-	/* first consecutive root is 0
-	 * primitive element to generate roots = 1
-	 */
-	ram_console_rs_decoder = init_rs(ECC_SYMSIZE, ECC_POLY, 0, 1, ECC_SIZE);
-	if (ram_console_rs_decoder == NULL) {
-		printk(KERN_INFO "ram_console: init_rs failed\n");
-		return 0;
-	}
-
-	ram_console_corrected_bytes = 0;
-	ram_console_bad_blocks = 0;
-
-	par = ram_console_par_buffer +
-	      DIV_ROUND_UP(ram_console_buffer_size, ECC_BLOCK_SIZE) * ECC_SIZE;
-
-	numerr = ram_console_decode_rs8(buffer, sizeof(*buffer), par);
-	if (numerr > 0) {
-		printk(KERN_INFO "ram_console: error in header, %d\n", numerr);
-		ram_console_corrected_bytes += numerr;
-	} else if (numerr < 0) {
-		printk(KERN_INFO
-		       "ram_console: uncorrectable error in header\n");
-		ram_console_bad_blocks++;
-	}
-#endif
-
-	if (buffer->sig == RAM_CONSOLE_SIG) {
-		if (buffer->size > ram_console_buffer_size
-		    || buffer->start > buffer->size)
-			printk(KERN_INFO "ram_console: found existing invalid "
-			       "buffer, size %d, start %d\n",
-			       buffer->size, buffer->start);
-		else {
-			printk(KERN_INFO "ram_console: found existing buffer, "
-			       "size %d, start %d\n",
-			       buffer->size, buffer->start);
-			ram_console_save_old(buffer, old_buf);
-		}
-	} else {
-		printk(KERN_INFO "ram_console: no valid data in buffer "
-		       "(sig = 0x%08x)\n", buffer->sig);
-	}
-
-	buffer->sig = RAM_CONSOLE_SIG;
-	buffer->start = 0;
-	buffer->size = 0;
-
-	register_console(&ram_console);
-#ifdef CONFIG_ANDROID_RAM_CONSOLE_ENABLE_VERBOSE
-	console_verbose();
-#endif
-	return 0;
-}
-
-#ifdef CONFIG_ANDROID_RAM_CONSOLE_EARLY_INIT
-static int __init ram_console_early_init(void)
-{
-	return ram_console_init((struct ram_console_buffer *)
-		CONFIG_ANDROID_RAM_CONSOLE_EARLY_ADDR,
-		CONFIG_ANDROID_RAM_CONSOLE_EARLY_SIZE,
-		ram_console_old_log_init_buffer);
-}
-#else
-static int ram_console_driver_probe(struct platform_device *pdev)
-{
-	struct resource *res = pdev->resource;
-	size_t start;
-	size_t buffer_size;
-	void *buffer;
-
-	if (res == NULL || pdev->num_resources != 1 ||
-	    !(res->flags & IORESOURCE_MEM)) {
-		printk(KERN_ERR "ram_console: invalid resource, %p %d flags "
-		       "%lx\n", res, pdev->num_resources, res ? res->flags : 0);
-		return -ENXIO;
-	}
-	buffer_size = res->end - res->start + 1;
-	start = res->start;
-	printk(KERN_INFO "ram_console: got buffer at %zx, size %zx\n",
-	       start, buffer_size);
-	buffer = ioremap(res->start, buffer_size);
-	if (buffer == NULL) {
-		printk(KERN_ERR "ram_console: failed to map memory\n");
-		return -ENOMEM;
-	}
-
-	return ram_console_init(buffer, buffer_size, NULL/* allocate */);
-}
-
-static struct platform_driver ram_console_driver = {
-	.probe = ram_console_driver_probe,
-	.driver		= {
-		.name	= "ram_console",
-	},
-};
-
-static int __init ram_console_module_init(void)
-{
-	int err;
-	err = platform_driver_register(&ram_console_driver);
-	return err;
-}
-#endif
-
-static ssize_t ram_console_read_old(struct file *file, char __user *buf,
-				    size_t len, loff_t *offset)
-{
-	loff_t pos = *offset;
-	ssize_t count;
-
-	if (pos >= ram_console_old_log_size)
-		return 0;
-
-	count = min(len, (size_t)(ram_console_old_log_size - pos));
-	if (copy_to_user(buf, ram_console_old_log + pos, count))
-		return -EFAULT;
-
-	*offset += count;
-	return count;
-}
-
-static const struct file_operations ram_console_file_ops = {
-	.owner = THIS_MODULE,
-	.read = ram_console_read_old,
-};
-
-static int __init ram_console_late_init(void)
-{
-	struct proc_dir_entry *entry;
-
-	if (ram_console_old_log == NULL)
-		return 0;
-#ifdef CONFIG_ANDROID_RAM_CONSOLE_EARLY_INIT
-	ram_console_old_log = kmalloc(ram_console_old_log_size, GFP_KERNEL);
-	if (ram_console_old_log == NULL) {
-		printk(KERN_ERR
-		       "ram_console: failed to allocate buffer for old log\n");
-		ram_console_old_log_size = 0;
-		return 0;
-	}
-	memcpy(ram_console_old_log,
-	       ram_console_old_log_init_buffer, ram_console_old_log_size);
-#endif
-	entry = create_proc_entry("last_kmsg", S_IFREG | S_IRUGO, NULL);
-	if (!entry) {
-		printk(KERN_ERR "ram_console: failed to create proc entry\n");
-		kfree(ram_console_old_log);
-		ram_console_old_log = NULL;
-		return 0;
-	}
-
-	entry->proc_fops = &ram_console_file_ops;
-	entry->size = ram_console_old_log_size;
-	return 0;
-}
-
-#ifdef CONFIG_ANDROID_RAM_CONSOLE_EARLY_INIT
-console_initcall(ram_console_early_init);
-#else
-module_init(ram_console_module_init);
-#endif
-late_initcall(ram_console_late_init);
-
diff --git a/drivers/staging/android/timed_gpio.c b/drivers/staging/android/timed_gpio.c
deleted file mode 100644
index be7cdaa783ae..000000000000
--- a/drivers/staging/android/timed_gpio.c
+++ /dev/null
@@ -1,166 +0,0 @@
-/* drivers/misc/timed_gpio.c
- *
- * Copyright (C) 2008 Google, Inc.
- * Author: Mike Lockwood <lockwood@android.com>
- *
- * This software is licensed under the terms of the GNU General Public
- * License version 2, as published by the Free Software Foundation, and
- * may be copied, distributed, and modified under those terms.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- */
-
-#include <linux/module.h>
-#include <linux/platform_device.h>
-#include <linux/hrtimer.h>
-#include <linux/err.h>
-#include <linux/gpio.h>
-
-#include "timed_output.h"
-#include "timed_gpio.h"
-
-
-struct timed_gpio_data {
-	struct timed_output_dev dev;
-	struct hrtimer timer;
-	spinlock_t lock;
-	unsigned 	gpio;
-	int 		max_timeout;
-	u8 		active_low;
-};
-
-static enum hrtimer_restart gpio_timer_func(struct hrtimer *timer)
-{
-	struct timed_gpio_data *data =
-		container_of(timer, struct timed_gpio_data, timer);
-
-	gpio_direction_output(data->gpio, data->active_low ? 1 : 0);
-	return HRTIMER_NORESTART;
-}
-
-static int gpio_get_time(struct timed_output_dev *dev)
-{
-	struct timed_gpio_data	*data =
-		container_of(dev, struct timed_gpio_data, dev);
-
-	if (hrtimer_active(&data->timer)) {
-		ktime_t r = hrtimer_get_remaining(&data->timer);
-		struct timeval t = ktime_to_timeval(r);
-		return t.tv_sec * 1000 + t.tv_usec / 1000;
-	} else
-		return 0;
-}
-
-static void gpio_enable(struct timed_output_dev *dev, int value)
-{
-	struct timed_gpio_data	*data =
-		container_of(dev, struct timed_gpio_data, dev);
-	unsigned long	flags;
-
-	spin_lock_irqsave(&data->lock, flags);
-
-	/* cancel previous timer and set GPIO according to value */
-	hrtimer_cancel(&data->timer);
-	gpio_direction_output(data->gpio, data->active_low ? !value : !!value);
-
-	if (value > 0) {
-		if (value > data->max_timeout)
-			value = data->max_timeout;
-
-		hrtimer_start(&data->timer,
-			ktime_set(value / 1000, (value % 1000) * 1000000),
-			HRTIMER_MODE_REL);
-	}
-
-	spin_unlock_irqrestore(&data->lock, flags);
-}
-
-static int timed_gpio_probe(struct platform_device *pdev)
-{
-	struct timed_gpio_platform_data *pdata = pdev->dev.platform_data;
-	struct timed_gpio *cur_gpio;
-	struct timed_gpio_data *gpio_data, *gpio_dat;
-	int i, j, ret = 0;
-
-	if (!pdata)
-		return -EBUSY;
-
-	gpio_data = kzalloc(sizeof(struct timed_gpio_data) * pdata->num_gpios,
-			GFP_KERNEL);
-	if (!gpio_data)
-		return -ENOMEM;
-
-	for (i = 0; i < pdata->num_gpios; i++) {
-		cur_gpio = &pdata->gpios[i];
-		gpio_dat = &gpio_data[i];
-
-		hrtimer_init(&gpio_dat->timer, CLOCK_MONOTONIC,
-				HRTIMER_MODE_REL);
-		gpio_dat->timer.function = gpio_timer_func;
-		spin_lock_init(&gpio_dat->lock);
-
-		gpio_dat->dev.name = cur_gpio->name;
-		gpio_dat->dev.get_time = gpio_get_time;
-		gpio_dat->dev.enable = gpio_enable;
-		ret = timed_output_dev_register(&gpio_dat->dev);
-		if (ret < 0) {
-			for (j = 0; j < i; j++)
-				timed_output_dev_unregister(&gpio_data[i].dev);
-			kfree(gpio_data);
-			return ret;
-		}
-
-		gpio_dat->gpio = cur_gpio->gpio;
-		gpio_dat->max_timeout = cur_gpio->max_timeout;
-		gpio_dat->active_low = cur_gpio->active_low;
-		gpio_direction_output(gpio_dat->gpio, gpio_dat->active_low);
-	}
-
-	platform_set_drvdata(pdev, gpio_data);
-
-	return 0;
-}
-
-static int timed_gpio_remove(struct platform_device *pdev)
-{
-	struct timed_gpio_platform_data *pdata = pdev->dev.platform_data;
-	struct timed_gpio_data *gpio_data = platform_get_drvdata(pdev);
-	int i;
-
-	for (i = 0; i < pdata->num_gpios; i++)
-		timed_output_dev_unregister(&gpio_data[i].dev);
-
-	kfree(gpio_data);
-
-	return 0;
-}
-
-static struct platform_driver timed_gpio_driver = {
-	.probe		= timed_gpio_probe,
-	.remove		= timed_gpio_remove,
-	.driver		= {
-		.name		= TIMED_GPIO_NAME,
-		.owner		= THIS_MODULE,
-	},
-};
-
-static int __init timed_gpio_init(void)
-{
-	return platform_driver_register(&timed_gpio_driver);
-}
-
-static void __exit timed_gpio_exit(void)
-{
-	platform_driver_unregister(&timed_gpio_driver);
-}
-
-module_init(timed_gpio_init);
-module_exit(timed_gpio_exit);
-
-MODULE_AUTHOR("Mike Lockwood <lockwood@android.com>");
-MODULE_DESCRIPTION("timed gpio driver");
-MODULE_LICENSE("GPL");
diff --git a/drivers/staging/android/timed_gpio.h b/drivers/staging/android/timed_gpio.h
deleted file mode 100644
index a0e15f8be3f7..000000000000
--- a/drivers/staging/android/timed_gpio.h
+++ /dev/null
@@ -1,33 +0,0 @@
-/* include/linux/timed_gpio.h
- *
- * Copyright (C) 2008 Google, Inc.
- *
- * This software is licensed under the terms of the GNU General Public
- * License version 2, as published by the Free Software Foundation, and
- * may be copied, distributed, and modified under those terms.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
-*/
-
-#ifndef _LINUX_TIMED_GPIO_H
-#define _LINUX_TIMED_GPIO_H
-
-#define TIMED_GPIO_NAME "timed-gpio"
-
-struct timed_gpio {
-	const char *name;
-	unsigned 	gpio;
-	int		max_timeout;
-	u8 		active_low;
-};
-
-struct timed_gpio_platform_data {
-	int 		num_gpios;
-	struct timed_gpio *gpios;
-};
-
-#endif
diff --git a/drivers/staging/android/timed_output.c b/drivers/staging/android/timed_output.c
deleted file mode 100644
index 62e79180421b..000000000000
--- a/drivers/staging/android/timed_output.c
+++ /dev/null
@@ -1,121 +0,0 @@
-/* drivers/misc/timed_output.c
- *
- * Copyright (C) 2009 Google, Inc.
- * Author: Mike Lockwood <lockwood@android.com>
- *
- * This software is licensed under the terms of the GNU General Public
- * License version 2, as published by the Free Software Foundation, and
- * may be copied, distributed, and modified under those terms.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- */
-
-#include <linux/module.h>
-#include <linux/types.h>
-#include <linux/device.h>
-#include <linux/fs.h>
-#include <linux/err.h>
-
-#include "timed_output.h"
-
-static struct class *timed_output_class;
-static atomic_t device_count;
-
-static ssize_t enable_show(struct device *dev, struct device_attribute *attr,
-		char *buf)
-{
-	struct timed_output_dev *tdev = dev_get_drvdata(dev);
-	int remaining = tdev->get_time(tdev);
-
-	return sprintf(buf, "%d\n", remaining);
-}
-
-static ssize_t enable_store(
-		struct device *dev, struct device_attribute *attr,
-		const char *buf, size_t size)
-{
-	struct timed_output_dev *tdev = dev_get_drvdata(dev);
-	int value;
-
-	sscanf(buf, "%d", &value);
-	tdev->enable(tdev, value);
-
-	return size;
-}
-
-static DEVICE_ATTR(enable, S_IRUGO | S_IWUSR, enable_show, enable_store);
-
-static int create_timed_output_class(void)
-{
-	if (!timed_output_class) {
-		timed_output_class = class_create(THIS_MODULE, "timed_output");
-		if (IS_ERR(timed_output_class))
-			return PTR_ERR(timed_output_class);
-		atomic_set(&device_count, 0);
-	}
-
-	return 0;
-}
-
-int timed_output_dev_register(struct timed_output_dev *tdev)
-{
-	int ret;
-
-	if (!tdev || !tdev->name || !tdev->enable || !tdev->get_time)
-		return -EINVAL;
-
-	ret = create_timed_output_class();
-	if (ret < 0)
-		return ret;
-
-	tdev->index = atomic_inc_return(&device_count);
-	tdev->dev = device_create(timed_output_class, NULL,
-		MKDEV(0, tdev->index), NULL, tdev->name);
-	if (IS_ERR(tdev->dev))
-		return PTR_ERR(tdev->dev);
-
-	ret = device_create_file(tdev->dev, &dev_attr_enable);
-	if (ret < 0)
-		goto err_create_file;
-
-	dev_set_drvdata(tdev->dev, tdev);
-	tdev->state = 0;
-	return 0;
-
-err_create_file:
-	device_destroy(timed_output_class, MKDEV(0, tdev->index));
-	printk(KERN_ERR "timed_output: Failed to register driver %s\n",
-			tdev->name);
-
-	return ret;
-}
-EXPORT_SYMBOL_GPL(timed_output_dev_register);
-
-void timed_output_dev_unregister(struct timed_output_dev *tdev)
-{
-	device_remove_file(tdev->dev, &dev_attr_enable);
-	device_destroy(timed_output_class, MKDEV(0, tdev->index));
-	dev_set_drvdata(tdev->dev, NULL);
-}
-EXPORT_SYMBOL_GPL(timed_output_dev_unregister);
-
-static int __init timed_output_init(void)
-{
-	return create_timed_output_class();
-}
-
-static void __exit timed_output_exit(void)
-{
-	class_destroy(timed_output_class);
-}
-
-module_init(timed_output_init);
-module_exit(timed_output_exit);
-
-MODULE_AUTHOR("Mike Lockwood <lockwood@android.com>");
-MODULE_DESCRIPTION("timed output class driver");
-MODULE_LICENSE("GPL");
diff --git a/drivers/staging/android/timed_output.h b/drivers/staging/android/timed_output.h
deleted file mode 100644
index ec907ab2ff54..000000000000
--- a/drivers/staging/android/timed_output.h
+++ /dev/null
@@ -1,37 +0,0 @@
-/* include/linux/timed_output.h
- *
- * Copyright (C) 2008 Google, Inc.
- *
- * This software is licensed under the terms of the GNU General Public
- * License version 2, as published by the Free Software Foundation, and
- * may be copied, distributed, and modified under those terms.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
-*/
-
-#ifndef _LINUX_TIMED_OUTPUT_H
-#define _LINUX_TIMED_OUTPUT_H
-
-struct timed_output_dev {
-	const char	*name;
-
-	/* enable the output and set the timer */
-	void	(*enable)(struct timed_output_dev *sdev, int timeout);
-
-	/* returns the current number of milliseconds remaining on the timer */
-	int		(*get_time)(struct timed_output_dev *sdev);
-
-	/* private data */
-	struct device	*dev;
-	int		index;
-	int		state;
-};
-
-extern int timed_output_dev_register(struct timed_output_dev *dev);
-extern void timed_output_dev_unregister(struct timed_output_dev *dev);
-
-#endif
diff --git a/drivers/staging/asus_oled/asus_oled.c b/drivers/staging/asus_oled/asus_oled.c
index f4c26572c7df..43c57b7688ab 100644
--- a/drivers/staging/asus_oled/asus_oled.c
+++ b/drivers/staging/asus_oled/asus_oled.c
@@ -194,9 +194,11 @@ static ssize_t set_enabled(struct device *dev, struct device_attribute *attr,
 {
 	struct usb_interface *intf = to_usb_interface(dev);
 	struct asus_oled_dev *odev = usb_get_intfdata(intf);
-	int temp = strict_strtoul(buf, 10, NULL);
+	unsigned long value;
+	if (strict_strtoul(buf, 10, &value))
+		return -EINVAL;
 
-	enable_oled(odev, temp);
+	enable_oled(odev, value);
 
 	return count;
 }
@@ -207,10 +209,12 @@ static ssize_t class_set_enabled(struct device *device,
 {
 	struct asus_oled_dev *odev =
 		(struct asus_oled_dev *) dev_get_drvdata(device);
+	unsigned long value;
 
-	int temp = strict_strtoul(buf, 10, NULL);
+	if (strict_strtoul(buf, 10, &value))
+		return -EINVAL;
 
-	enable_oled(odev, temp);
+	enable_oled(odev, value);
 
 	return count;
 }
diff --git a/drivers/staging/b3dfg/b3dfg.c b/drivers/staging/b3dfg/b3dfg.c
index cda26bb493b3..4a43c51c172a 100644
--- a/drivers/staging/b3dfg/b3dfg.c
+++ b/drivers/staging/b3dfg/b3dfg.c
@@ -468,7 +468,6 @@ static int get_wand_status(struct b3dfg_dev *fgdev, int __user *arg)
 
 static int enable_transmission(struct b3dfg_dev *fgdev)
 {
-	u16 command;
 	unsigned long flags;
 	struct device *dev = &fgdev->pdev->dev;
 
@@ -480,17 +479,6 @@ static int enable_transmission(struct b3dfg_dev *fgdev)
 		return -EINVAL;
 	}
 
-	/*
-	 * Check we're a bus master.
-	 * TODO: I think we can remove this having added the pci_set_master call
-	 */
-	pci_read_config_word(fgdev->pdev, PCI_COMMAND, &command);
-	if (!(command & PCI_COMMAND_MASTER)) {
-		dev_err(dev, "not a bus master, force-enabling\n");
-		pci_write_config_word(fgdev->pdev, PCI_COMMAND,
-			command | PCI_COMMAND_MASTER);
-	}
-
 	spin_lock_irqsave(&fgdev->buffer_lock, flags);
 
 	/* Handle racing enable_transmission calls. */
diff --git a/drivers/staging/batman-adv/CHANGELOG b/drivers/staging/batman-adv/CHANGELOG
new file mode 100644
index 000000000000..8a181639ceaa
--- /dev/null
+++ b/drivers/staging/batman-adv/CHANGELOG
@@ -0,0 +1,37 @@
+batman-adv 0.2:
+
+* support latest kernels (2.6.20 - 2.6.31)
+* temporary routing loops / TTL code bug / ghost entries in originator table fixed
+* internal packet queue for packet aggregation & transmission retry (ARQ)
+  for payload broadcasts added
+* interface detection converted to event based handling to avoid timers
+* major linux coding style adjustments applied
+* all kernel version compatibility functions has been moved to compat.h
+* use random ethernet address generator from the kernel
+* /sys/module/batman_adv/version to export kernel module version
+* vis: secondary interface export for dot draw format + JSON output format added
+* many bugs (alignment issues, race conditions, deadlocks, etc) squashed
+
+ -- Sat, 07 Nov 2009 15:44:31 +0100
+
+batman-adv 0.1:
+
+* support latest kernels (2.6.20 - 2.6.28)
+* LOTS of cleanup: locking, stack usage, memory leaks
+* Change Ethertype from 0x0842 to 0x4305
+  unregistered at IEEE, if you want to sponsor an official Ethertype ($2500)
+  please contact us
+
+ -- Sun, 28 Dec 2008 00:44:31 +0100
+
+batman-adv 0.1-beta:
+
+* layer 2 meshing based on BATMAN TQ algorithm in kernelland
+* operates on any ethernet like interface
+* supports IPv4, IPv6, DHCP, etc
+* is controlled via /proc/net/batman-adv/
+* bridging via brctl is supported
+* interface watchdog (interfaces can be (de)activated dynamically)
+* offers integrated vis server which meshes/syncs with other vis servers in range
+
+ -- Mon, 05 May 2008 14:10:04 +0200
diff --git a/drivers/staging/batman-adv/Kconfig b/drivers/staging/batman-adv/Kconfig
new file mode 100644
index 000000000000..1d74dabf9511
--- /dev/null
+++ b/drivers/staging/batman-adv/Kconfig
@@ -0,0 +1,26 @@
+#
+# B.A.T.M.A.N meshing protocol
+#
+
+config BATMAN_ADV
+	tristate "B.A.T.M.A.N. Advanced Meshing Protocol"
+	depends on PROC_FS && PACKET
+        default n
+	---help---
+
+        B.A.T.M.A.N. (better approach to mobile ad-hoc networking) is
+        a routing protocol for multi-hop ad-hoc mesh networks. The
+        networks may be wired or wireless. See
+        http://www.open-mesh.org/ for more information and user space
+        tools.
+
+config BATMAN_DEBUG
+	bool "B.A.T.M.A.N. debugging"
+	depends on BATMAN_ADV != n
+	help
+
+	  This is an option for use by developers; most people should
+	  say N here. This enables compilation of support for
+	  outputting debugging information to the kernel log. The
+	  output is controlled via the module parameter debug.
+
diff --git a/drivers/staging/batman-adv/Makefile b/drivers/staging/batman-adv/Makefile
new file mode 100644
index 000000000000..02da87134fce
--- /dev/null
+++ b/drivers/staging/batman-adv/Makefile
@@ -0,0 +1,22 @@
+#
+# Copyright (C) 2007-2009 B.A.T.M.A.N. contributors:
+#
+# Marek Lindner, Simon Wunderlich
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of version 2 of the GNU General Public
+# License as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+# General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+# 02110-1301, USA
+#
+
+obj-m += batman-adv.o
+batman-adv-objs := main.o proc.o send.o routing.o soft-interface.o device.o translation-table.o bitarray.o hash.o ring_buffer.o vis.o hard-interface.o aggregation.o log.o
diff --git a/drivers/staging/batman-adv/README b/drivers/staging/batman-adv/README
new file mode 100644
index 000000000000..3aaf393ebaa7
--- /dev/null
+++ b/drivers/staging/batman-adv/README
@@ -0,0 +1,125 @@
+[state: 07-11-2009]
+
+BATMAN-ADV
+----------
+
+Batman-advanced is a new approach to wireless networking which does no longer
+operate on the IP basis. Unlike B.A.T.M.A.N, which exchanges information
+using UDP packets and sets routing tables, batman-advanced operates on ISO/OSI
+Layer 2 only and uses and routes (or better: bridges) Ethernet Frames. It
+emulates a virtual network switch of all nodes participating. Therefore all
+nodes appear to be link local, thus all higher operating protocols won't be
+affected by any changes within the network. You can run almost any protocol
+above B.A.T.M.A.N. Advanced, prominent examples are: IPv4, IPv6, DHCP, IPX.
+
+This is batman-advanced implemented as Linux kernel driver. It does not depend
+on any network (other) driver, and can be used on wifi as well as ethernet,
+vpn, etc ... (anything with ethernet-style layer 2).
+It compiles against and should work with Linux 2.6.20 - 2.6.31. Supporting older
+versions is not planned, but it's probably easy to backport it. If you work on a
+backport, feel free to contact us.  :-)
+
+COMPILE
+-------
+To compile against your currently installed kernel, just type:
+
+# make
+
+if you want to compile against some other kernel, use:
+
+# make KERNELPATH=/path/to/kernel
+
+USAGE
+-----
+
+insmod the batman-adv.ko in your kernel:
+
+# insmod batman-adv.ko
+
+the module is now waiting for activation. You must add some interfaces
+on which batman can operate. Each interface must be added separately:
+
+# echo wlan0 > /proc/net/batman-adv/interfaces
+
+( # echo wlan1 > /proc/net/batman-adv/interfaces )
+( # echo eth0 > /proc/net/batman-adv/interfaces )
+( ... )
+
+Now batman starts broadcasting on this interface.
+You can now view the table of originators (mesh participants) with:
+
+# cat /proc/net/batman-adv/originators
+
+The module will create a new interface "bat0", which can be used as a
+regular interface:
+
+# ifconfig bat0 inet 192.168.0.1 up
+# ping 192.168.0.2
+...
+
+If you want topology visualization, your meshnode must be configured
+as VIS-server:
+
+# echo "server" > /proc/net/batman-adv/vis
+
+Each node is either configured as "server" or as "client" (default:
+"client"). Clients send their topology data to the server next to them,
+and server synchronize with other servers. If there is no server
+configured (default) within the mesh, no topology information will be
+transmitted. With these "synchronizing servers", there can be 1 or
+more vis servers sharing the same (or at least very similar) data.
+
+When configured as server, you can get a topology snapshot of your mesh:
+
+# cat /proc/net/batman-adv/vis
+
+This output format is a graphviz formatted text file which can be
+processed with graphviz-tools like dot.
+The labels are similar/compatible to the ETX metric, 1.0 means perfect
+connection (100%), 2.0 means 50%, 3.0 means 33% and so on.
+
+Alternatively, a JSON output format is available. The format can be set
+using by writing either "dot_draw" or "json" into the vis_format file.
+"dot_draw" is selected by default.
+
+echo "json" > /proc/net/batman-adv/vis_format
+
+In very mobile scenarios, you might want to adjust the originator
+interval to a lower value. This will make the mesh more responsive to
+topology changes, but will also increase the overhead. Please make sure
+that all nodes in your mesh use the same interval. The default value
+is 1000 ms (1 second).
+
+# echo 1000 > /proc/net/batman-adv/orig_interval
+
+To deactivate batman, do:
+
+# echo "" > /proc/net/batman-adv/interfaces
+
+BATCTL
+------
+
+B.A.T.M.A.N.  advanced  operates on layer 2 and thus all hosts partici-
+pating in the virtual switch are completely transparent for all  proto-
+cols above layer 2. Therefore the common diagnosis tools do not work as
+expected. To overcome these problems batctl was created. At the  moment
+the  batctl contains ping, traceroute, tcpdump and interfaces to the
+kernel module settings.
+
+For more information, please see the manpage (man batctl).
+
+batctl is available on http://www.open-mesh.net/
+
+CONTACT
+-------
+
+Please send us comments, experiences, questions, anything :)
+
+IRC:             #batman on irc.freenode.org
+Mailing-list:    b.a.t.m.a.n@open-mesh.net
+(subscription at https://list.open-mesh.net/mm/listinfo/b.a.t.m.a.n )
+
+You can also contact the Authors:
+
+Marek Lindner <lindner_marek@yahoo.de>
+Simon Wunderlich <siwu@hrz.tu-chemnitz.de>
diff --git a/drivers/staging/batman-adv/TODO b/drivers/staging/batman-adv/TODO
new file mode 100644
index 000000000000..ea6dcf94d661
--- /dev/null
+++ b/drivers/staging/batman-adv/TODO
@@ -0,0 +1,51 @@
+=> proc interface
+* implement new interface to add/delete interfaces and setting options
+* /proc/sys/net/batman-adv/ as main folder
+* in interfaces/ list every available interface of the host
+* each interfaces/$iface/ contains the following files:
+-> enable (def: 0) [add/remove this interface to batman-adv]
+-> ogm_interval (def: 1000) [ogm interval of that interface]
+-> context (def: bat0) [later we want to support multiple mesh instances via
+-> bat0/bat1/bat2/..]
+-> status (read-only) [outputs the interface status from batman's
+-> perspective]
+* in mesh/batX/ list every available mesh subnet
+-> vis_server (def: 0) [enable/disable vis server for that mesh]
+-> vis_data (read-only) [outputs the vis data in a raw format]
+-> aggregate_ogm (def: 1) [enable/disable ogm aggregation for that mesh]
+-> originators (read-only) [outputs the originator table]
+-> transtable_global (read-only) [outputs the global translation table]
+-> transtable_local (read-only) [outputs the local translation table]
+
+=> vis "raw" data output
+* the raw format shall replace dot draw / json to offer a neutral that can
+* be converted
+* the format (comma seperated entries):
+-> "mac" -> mac address of an originator (each line begins with it)
+-> "TQ mac value" -> src mac's link quality towards mac address
+-> "HNA mac" -> HNA announced by source mac
+-> "PRIMARY" -> this is a primary interface
+-> "SEC mac" -> secondary mac address of source (requires preceeding
+-> PRIMARY)
+
+=> logging
+* the log level LOG_TYPE_CRIT, LOG_TYPE_WARN & LOG_TYPE_NOTICE will be
+* unified to use printk
+* LOG_TYPE_BATMAN & LOG_TYPE_ROUTES will also use printk but only after the
+* internal debug level has been raised
+* the internal debug level can be modified using a module parameter (debug)
+* or at run time via /sys/module/batman-adv/parameters/debug
+* make use of printk %pM support instead of converting mac addresses
+* manually
+
+=> strip out all backward compatibility support to older kernels
+   (only found in compat.h)
+
+=> fix checkpatch.pl errors
+
+Please send all patches to:
+	Marek Lindner <lindner_marek@yahoo.de>
+	Simon Wunderlich <siwu@hrz.tu-chemnitz.de>
+	Andrew Lunn <andrew@lunn.ch>
+	b.a.t.m.a.n@lists.open-mesh.net
+	Greg Kroah-Hartman <gregkh@suse.de>
diff --git a/drivers/staging/batman-adv/aggregation.c b/drivers/staging/batman-adv/aggregation.c
new file mode 100644
index 000000000000..9c6e681f6fb6
--- /dev/null
+++ b/drivers/staging/batman-adv/aggregation.c
@@ -0,0 +1,232 @@
+/*
+ * Copyright (C) 2007-2009 B.A.T.M.A.N. contributors:
+ *
+ * Marek Lindner, Simon Wunderlich
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA
+ *
+ */
+
+#include "main.h"
+#include "aggregation.h"
+#include "send.h"
+#include "routing.h"
+
+/* calculate the size of the hna information for a given packet */
+static int hna_len(struct batman_packet *batman_packet)
+{
+	return batman_packet->num_hna * ETH_ALEN;
+}
+
+/* return true if new_packet can be aggregated with forw_packet */
+static bool can_aggregate_with(struct batman_packet *new_batman_packet,
+			       int packet_len,
+			       unsigned long send_time,
+			       bool directlink,
+			       struct batman_if *if_incoming,
+			       struct forw_packet *forw_packet)
+{
+	struct batman_packet *batman_packet =
+		(struct batman_packet *)forw_packet->packet_buff;
+	int aggregated_bytes = forw_packet->packet_len + packet_len;
+
+	/**
+	 * we can aggregate the current packet to this aggregated packet
+	 * if:
+	 *
+	 * - the send time is within our MAX_AGGREGATION_MS time
+	 * - the resulting packet wont be bigger than
+	 *   MAX_AGGREGATION_BYTES
+	 */
+
+	if (time_before(send_time, forw_packet->send_time) &&
+	    (aggregated_bytes <= MAX_AGGREGATION_BYTES)) {
+
+		/**
+		 * check aggregation compatibility
+		 * -> direct link packets are broadcasted on
+		 *    their interface only
+		 * -> aggregate packet if the current packet is
+		 *    a "global" packet as well as the base
+		 *    packet
+		 */
+
+		/* packets without direct link flag and high TTL
+		 * are flooded through the net  */
+		if ((!directlink) &&
+		    (!(batman_packet->flags & DIRECTLINK)) &&
+		    (batman_packet->ttl != 1) &&
+
+		    /* own packets originating non-primary
+		     * interfaces leave only that interface */
+		    ((!forw_packet->own) ||
+		     (forw_packet->if_incoming->if_num == 0)))
+			return true;
+
+		/* if the incoming packet is sent via this one
+		 * interface only - we still can aggregate */
+		if ((directlink) &&
+		    (new_batman_packet->ttl == 1) &&
+		    (forw_packet->if_incoming == if_incoming))
+			return true;
+
+	}
+
+	return false;
+}
+
+/* create a new aggregated packet and add this packet to it */
+static void new_aggregated_packet(unsigned char *packet_buff,
+			   int packet_len,
+			   unsigned long send_time,
+			   bool direct_link,
+			   struct batman_if *if_incoming,
+			   int own_packet)
+{
+	struct forw_packet *forw_packet_aggr;
+
+	forw_packet_aggr = kmalloc(sizeof(struct forw_packet), GFP_ATOMIC);
+	if (!forw_packet_aggr)
+		return;
+
+	forw_packet_aggr->packet_buff = kmalloc(MAX_AGGREGATION_BYTES,
+						GFP_ATOMIC);
+	if (!forw_packet_aggr->packet_buff) {
+		kfree(forw_packet_aggr);
+		return;
+	}
+
+	INIT_HLIST_NODE(&forw_packet_aggr->list);
+
+	forw_packet_aggr->packet_len = packet_len;
+	memcpy(forw_packet_aggr->packet_buff,
+	       packet_buff,
+	       forw_packet_aggr->packet_len);
+
+	forw_packet_aggr->own = own_packet;
+	forw_packet_aggr->if_incoming = if_incoming;
+	forw_packet_aggr->num_packets = 0;
+	forw_packet_aggr->direct_link_flags = 0;
+	forw_packet_aggr->send_time = send_time;
+
+	/* save packet direct link flag status */
+	if (direct_link)
+		forw_packet_aggr->direct_link_flags |= 1;
+
+	/* add new packet to packet list */
+	spin_lock(&forw_bat_list_lock);
+	hlist_add_head(&forw_packet_aggr->list, &forw_bat_list);
+	spin_unlock(&forw_bat_list_lock);
+
+	/* start timer for this packet */
+	INIT_DELAYED_WORK(&forw_packet_aggr->delayed_work,
+			  send_outstanding_bat_packet);
+	queue_delayed_work(bat_event_workqueue,
+			   &forw_packet_aggr->delayed_work,
+			   send_time - jiffies);
+}
+
+/* aggregate a new packet into the existing aggregation */
+static void aggregate(struct forw_packet *forw_packet_aggr,
+		      unsigned char *packet_buff,
+		      int packet_len,
+		      bool direct_link)
+{
+	memcpy((forw_packet_aggr->packet_buff + forw_packet_aggr->packet_len),
+	       packet_buff, packet_len);
+	forw_packet_aggr->packet_len += packet_len;
+	forw_packet_aggr->num_packets++;
+
+	/* save packet direct link flag status */
+	if (direct_link)
+		forw_packet_aggr->direct_link_flags |=
+			(1 << forw_packet_aggr->num_packets);
+}
+
+void add_bat_packet_to_list(unsigned char *packet_buff, int packet_len,
+			    struct batman_if *if_incoming, char own_packet,
+			    unsigned long send_time)
+{
+	/**
+	 * _aggr -> pointer to the packet we want to aggregate with
+	 * _pos -> pointer to the position in the queue
+	 */
+	struct forw_packet *forw_packet_aggr = NULL, *forw_packet_pos = NULL;
+	struct hlist_node *tmp_node;
+	struct batman_packet *batman_packet =
+		(struct batman_packet *)packet_buff;
+	bool direct_link = batman_packet->flags & DIRECTLINK ? 1 : 0;
+
+	/* find position for the packet in the forward queue */
+	spin_lock(&forw_bat_list_lock);
+	/* own packets are not to be aggregated */
+	if ((atomic_read(&aggregation_enabled)) && (!own_packet)) {
+		hlist_for_each_entry(forw_packet_pos, tmp_node, &forw_bat_list,
+				     list) {
+			if (can_aggregate_with(batman_packet,
+					       packet_len,
+					       send_time,
+					       direct_link,
+					       if_incoming,
+					       forw_packet_pos)) {
+				forw_packet_aggr = forw_packet_pos;
+				break;
+			}
+		}
+	}
+
+	/* nothing to aggregate with - either aggregation disabled or no
+	 * suitable aggregation packet found */
+	if (forw_packet_aggr == NULL) {
+		/* the following section can run without the lock */
+		spin_unlock(&forw_bat_list_lock);
+		new_aggregated_packet(packet_buff, packet_len,
+				      send_time, direct_link,
+				      if_incoming, own_packet);
+	} else {
+		aggregate(forw_packet_aggr,
+			  packet_buff, packet_len,
+			  direct_link);
+		spin_unlock(&forw_bat_list_lock);
+	}
+}
+
+/* unpack the aggregated packets and process them one by one */
+void receive_aggr_bat_packet(struct ethhdr *ethhdr, unsigned char *packet_buff,
+			     int packet_len, struct batman_if *if_incoming)
+{
+	struct batman_packet *batman_packet;
+	int buff_pos = 0;
+	unsigned char *hna_buff;
+
+	batman_packet = (struct batman_packet *)packet_buff;
+
+	while (aggregated_packet(buff_pos, packet_len,
+				 batman_packet->num_hna)) {
+
+		/* network to host order for our 16bit seqno, and the
+		   orig_interval. */
+		batman_packet->seqno = ntohs(batman_packet->seqno);
+
+		hna_buff = packet_buff + buff_pos + BAT_PACKET_LEN;
+		receive_bat_packet(ethhdr, batman_packet,
+				   hna_buff, hna_len(batman_packet),
+				   if_incoming);
+
+		buff_pos += BAT_PACKET_LEN + hna_len(batman_packet);
+		batman_packet = (struct batman_packet *)
+			(packet_buff + buff_pos);
+	}
+}
diff --git a/drivers/staging/batman-adv/aggregation.h b/drivers/staging/batman-adv/aggregation.h
new file mode 100644
index 000000000000..6da8df9f99b7
--- /dev/null
+++ b/drivers/staging/batman-adv/aggregation.h
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2007-2009 B.A.T.M.A.N. contributors:
+ *
+ * Marek Lindner, Simon Wunderlich
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA
+ *
+ */
+
+#include "main.h"
+
+/* is there another aggregated packet here? */
+static inline int aggregated_packet(int buff_pos, int packet_len, int num_hna)
+{
+	int next_buff_pos = buff_pos + BAT_PACKET_LEN + (num_hna * ETH_ALEN);
+
+	return (next_buff_pos <= packet_len) &&
+		(next_buff_pos <= MAX_AGGREGATION_BYTES);
+}
+
+void add_bat_packet_to_list(unsigned char *packet_buff, int packet_len,
+			    struct batman_if *if_outgoing, char own_packet,
+			    unsigned long send_time);
+void receive_aggr_bat_packet(struct ethhdr *ethhdr, unsigned char *packet_buff,
+			     int packet_len, struct batman_if *if_incoming);
diff --git a/drivers/staging/batman-adv/bitarray.c b/drivers/staging/batman-adv/bitarray.c
new file mode 100644
index 000000000000..3c67f5f42b2b
--- /dev/null
+++ b/drivers/staging/batman-adv/bitarray.c
@@ -0,0 +1,177 @@
+/*
+ * Copyright (C) 2006-2009 B.A.T.M.A.N. contributors:
+ *
+ * Simon Wunderlich, Marek Lindner
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA
+ *
+ */
+
+#include "main.h"
+#include "bitarray.h"
+#include "log.h"
+
+/* returns true if the corresponding bit in the given seq_bits indicates true
+ * and curr_seqno is within range of last_seqno */
+uint8_t get_bit_status(TYPE_OF_WORD *seq_bits, uint16_t last_seqno,
+		       uint16_t curr_seqno)
+{
+	int16_t diff, word_offset, word_num;
+
+	diff = last_seqno - curr_seqno;
+	if (diff < 0 || diff >= TQ_LOCAL_WINDOW_SIZE) {
+		return 0;
+	} else {
+		/* which word */
+		word_num = (last_seqno - curr_seqno) / WORD_BIT_SIZE;
+		/* which position in the selected word */
+		word_offset = (last_seqno - curr_seqno) % WORD_BIT_SIZE;
+
+		if (seq_bits[word_num] & 1 << word_offset)
+			return 1;
+		else
+			return 0;
+	}
+}
+
+/* turn corresponding bit on, so we can remember that we got the packet */
+void bit_mark(TYPE_OF_WORD *seq_bits, int32_t n)
+{
+	int32_t word_offset, word_num;
+
+	/* if too old, just drop it */
+	if (n < 0 || n >= TQ_LOCAL_WINDOW_SIZE)
+		return;
+
+	/* which word */
+	word_num = n / WORD_BIT_SIZE;
+	/* which position in the selected word */
+	word_offset = n % WORD_BIT_SIZE;
+
+	seq_bits[word_num] |= 1 << word_offset;	/* turn the position on */
+}
+
+/* shift the packet array by n places. */
+void bit_shift(TYPE_OF_WORD *seq_bits, int32_t n)
+{
+	int32_t word_offset, word_num;
+	int32_t i;
+
+	if (n <= 0)
+		return;
+
+	word_offset = n % WORD_BIT_SIZE;/* shift how much inside each word */
+	word_num = n / WORD_BIT_SIZE;	/* shift over how much (full) words */
+
+	for (i = NUM_WORDS - 1; i > word_num; i--) {
+		/* going from old to new, so we don't overwrite the data we copy
+		 * from.
+		 *
+		 * left is high, right is low: FEDC BA98 7654 3210
+		 *	                                  ^^ ^^
+		 *                             vvvv
+		 * ^^^^ = from, vvvvv =to, we'd have word_num==1 and
+		 * word_offset==WORD_BIT_SIZE/2 ????? in this example.
+		 * (=24 bits)
+		 *
+		 * our desired output would be: 9876 5432 1000 0000
+		 * */
+
+		seq_bits[i] =
+			(seq_bits[i - word_num] << word_offset) +
+			/* take the lower port from the left half, shift it left
+			 * to its final position */
+			(seq_bits[i - word_num - 1] >>
+			 (WORD_BIT_SIZE-word_offset));
+		/* and the upper part of the right half and shift it left to
+		 * it's position */
+		/* for our example that would be: word[0] = 9800 + 0076 =
+		 * 9876 */
+	}
+	/* now for our last word, i==word_num, we only have the it's "left"
+	 * half. that's the 1000 word in our example.*/
+
+	seq_bits[i] = (seq_bits[i - word_num] << word_offset);
+
+	/* pad the rest with 0, if there is anything */
+	i--;
+
+	for (; i >= 0; i--)
+		seq_bits[i] = 0;
+}
+
+
+/* receive and process one packet, returns 1 if received seq_num is considered
+ * new, 0 if old  */
+char bit_get_packet(TYPE_OF_WORD *seq_bits, int16_t seq_num_diff,
+		    int8_t set_mark)
+{
+	int i;
+
+	/* we already got a sequence number higher than this one, so we just
+	 * mark it. this should wrap around the integer just fine */
+	if ((seq_num_diff < 0) && (seq_num_diff >= -TQ_LOCAL_WINDOW_SIZE)) {
+		if (set_mark)
+			bit_mark(seq_bits, -seq_num_diff);
+		return 0;
+	}
+
+	/* it seems we missed a lot of packets or the other host restarted */
+	if ((seq_num_diff > TQ_LOCAL_WINDOW_SIZE) ||
+	    (seq_num_diff < -TQ_LOCAL_WINDOW_SIZE)) {
+
+		if (seq_num_diff > TQ_LOCAL_WINDOW_SIZE)
+			debug_log(LOG_TYPE_BATMAN,
+				  "We missed a lot of packets (%i) !\n",
+				  seq_num_diff-1);
+
+		if (-seq_num_diff > TQ_LOCAL_WINDOW_SIZE)
+			debug_log(LOG_TYPE_BATMAN,
+				  "Other host probably restarted !\n");
+
+		for (i = 0; i < NUM_WORDS; i++)
+			seq_bits[i] = 0;
+
+		if (set_mark)
+			seq_bits[0] = 1;  /* we only have the latest packet */
+	} else {
+		bit_shift(seq_bits, seq_num_diff);
+
+		if (set_mark)
+			bit_mark(seq_bits, 0);
+	}
+
+	return 1;
+}
+
+/* count the hamming weight, how many good packets did we receive? just count
+ * the 1's. The inner loop uses the Kernighan algorithm, see
+ * http://graphics.stanford.edu/~seander/bithacks.html#CountBitsSetKernighan
+ */
+int bit_packet_count(TYPE_OF_WORD *seq_bits)
+{
+	int i, hamming = 0;
+	TYPE_OF_WORD word;
+
+	for (i = 0; i < NUM_WORDS; i++) {
+		word = seq_bits[i];
+
+		while (word) {
+			word &= word-1;
+			hamming++;
+		}
+	}
+	return hamming;
+}
diff --git a/drivers/staging/batman-adv/bitarray.h b/drivers/staging/batman-adv/bitarray.h
new file mode 100644
index 000000000000..ec72dd784362
--- /dev/null
+++ b/drivers/staging/batman-adv/bitarray.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2006-2009 B.A.T.M.A.N. contributors:
+ *
+ * Simon Wunderlich, Marek Lindner
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA
+ *
+ */
+
+
+/* you should choose something big, if you don't want to waste cpu */
+#define TYPE_OF_WORD unsigned long
+#define WORD_BIT_SIZE (sizeof(TYPE_OF_WORD) * 8)
+
+/* returns true if the corresponding bit in the given seq_bits indicates true
+ * and curr_seqno is within range of last_seqno */
+uint8_t get_bit_status(TYPE_OF_WORD *seq_bits, uint16_t last_seqno,
+					   uint16_t curr_seqno);
+
+/* turn corresponding bit on, so we can remember that we got the packet */
+void bit_mark(TYPE_OF_WORD *seq_bits, int32_t n);
+
+/* shift the packet array by n places. */
+void bit_shift(TYPE_OF_WORD *seq_bits, int32_t n);
+
+
+/* receive and process one packet, returns 1 if received seq_num is considered
+ * new, 0 if old  */
+char bit_get_packet(TYPE_OF_WORD *seq_bits, int16_t seq_num_diff,
+					int8_t set_mark);
+
+/* count the hamming weight, how many good packets did we receive? */
+int  bit_packet_count(TYPE_OF_WORD *seq_bits);
diff --git a/drivers/staging/batman-adv/compat.h b/drivers/staging/batman-adv/compat.h
new file mode 100644
index 000000000000..f4e0a4564ba7
--- /dev/null
+++ b/drivers/staging/batman-adv/compat.h
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2007-2009 B.A.T.M.A.N. contributors:
+ *
+ * Marek Lindner, Simon Wunderlich
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA
+ *
+ *
+ * This file contains macros for maintaining compatibility with older versions
+ * of the Linux kernel.
+ */
+
+#include <linux/version.h>	/* LINUX_VERSION_CODE */
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 22)
+
+#define skb_set_network_header(_skb, _offset) \
+	do { (_skb)->nh.raw = (_skb)->data + (_offset); } while (0)
+
+#define skb_reset_mac_header(_skb) \
+	do { (_skb)->mac.raw = (_skb)->data; } while (0)
+
+#define list_first_entry(ptr, type, member) \
+	list_entry((ptr)->next, type, member)
+
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 22) */
+
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 26)
+
+#define device_create(_cls, _parent, _devt, _device, _fmt) \
+	class_device_create(_cls, _parent, _devt, _device, _fmt)
+
+#define device_destroy(_cls, _device) \
+	class_device_destroy(_cls, _device)
+
+#else
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 27)
+
+#define device_create(_cls, _parent, _devt, _device, _fmt) \
+	device_create_drvdata(_cls, _parent, _devt, _device, _fmt)
+
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 27) */
+
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 26) */
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 23)
+
+#define cancel_delayed_work_sync(wq) cancel_rearming_delayed_work(wq)
+
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 23) */
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 25)
+#define strict_strtoul(cp, base, res) \
+	({ \
+	int ret = 0; \
+	char *endp; \
+	*res = simple_strtoul(cp, &endp, base); \
+	if (cp == endp) \
+		ret = -EINVAL; \
+	ret; \
+})
+#endif /* LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 25) */
diff --git a/drivers/staging/batman-adv/device.c b/drivers/staging/batman-adv/device.c
new file mode 100644
index 000000000000..1e7d1f88674f
--- /dev/null
+++ b/drivers/staging/batman-adv/device.c
@@ -0,0 +1,337 @@
+/*
+ * Copyright (C) 2007-2009 B.A.T.M.A.N. contributors:
+ *
+ * Marek Lindner
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA
+ *
+ */
+
+#include "main.h"
+#include "device.h"
+#include "log.h"
+#include "send.h"
+#include "types.h"
+#include "hash.h"
+
+#include "compat.h"
+
+static struct class *batman_class;
+
+static int Major;	/* Major number assigned to our device driver */
+
+static const struct file_operations fops = {
+	.open = bat_device_open,
+	.release = bat_device_release,
+	.read = bat_device_read,
+	.write = bat_device_write,
+	.poll = bat_device_poll,
+};
+
+static struct device_client *device_client_hash[256];
+
+void bat_device_init(void)
+{
+	int i;
+
+	for (i = 0; i < 256; i++)
+		device_client_hash[i] = NULL;
+}
+
+int bat_device_setup(void)
+{
+	int tmp_major;
+
+	if (Major)
+		return 1;
+
+	/* register our device - kernel assigns a free major number */
+	tmp_major = register_chrdev(0, DRIVER_DEVICE, &fops);
+	if (tmp_major < 0) {
+		debug_log(LOG_TYPE_WARN, "Registering the character device failed with %d\n",
+			  tmp_major);
+		return 0;
+	}
+
+	batman_class = class_create(THIS_MODULE, "batman-adv");
+
+	if (IS_ERR(batman_class)) {
+		debug_log(LOG_TYPE_WARN, "Could not register class 'batman-adv' \n");
+		return 0;
+	}
+
+	device_create(batman_class, NULL, MKDEV(tmp_major, 0), NULL,
+		      "batman-adv");
+
+	Major = tmp_major;
+	return 1;
+}
+
+void bat_device_destroy(void)
+{
+	if (!Major)
+		return;
+
+	device_destroy(batman_class, MKDEV(Major, 0));
+	class_destroy(batman_class);
+
+	/* Unregister the device */
+	unregister_chrdev(Major, DRIVER_DEVICE);
+
+	Major = 0;
+}
+
+int bat_device_open(struct inode *inode, struct file *file)
+{
+	unsigned int i;
+	struct device_client *device_client;
+
+	device_client = kmalloc(sizeof(struct device_client), GFP_KERNEL);
+
+	if (!device_client)
+		return -ENOMEM;
+
+	for (i = 0; i < 256; i++) {
+		if (!device_client_hash[i]) {
+			device_client_hash[i] = device_client;
+			break;
+		}
+	}
+
+	if (device_client_hash[i] != device_client) {
+		debug_log(LOG_TYPE_WARN, "Error - can't add another packet client: maximum number of clients reached \n");
+		kfree(device_client);
+		return -EXFULL;
+	}
+
+	INIT_LIST_HEAD(&device_client->queue_list);
+	device_client->queue_len = 0;
+	device_client->index = i;
+	device_client->lock = __SPIN_LOCK_UNLOCKED(device_client->lock);
+	init_waitqueue_head(&device_client->queue_wait);
+
+	file->private_data = device_client;
+
+	inc_module_count();
+	return 0;
+}
+
+int bat_device_release(struct inode *inode, struct file *file)
+{
+	struct device_client *device_client =
+		(struct device_client *)file->private_data;
+	struct device_packet *device_packet;
+	struct list_head *list_pos, *list_pos_tmp;
+
+	spin_lock(&device_client->lock);
+
+	/* for all packets in the queue ... */
+	list_for_each_safe(list_pos, list_pos_tmp, &device_client->queue_list) {
+		device_packet = list_entry(list_pos,
+					   struct device_packet, list);
+
+		list_del(list_pos);
+		kfree(device_packet);
+	}
+
+	device_client_hash[device_client->index] = NULL;
+	spin_unlock(&device_client->lock);
+
+	kfree(device_client);
+	dec_module_count();
+
+	return 0;
+}
+
+ssize_t bat_device_read(struct file *file, char __user *buf, size_t count,
+			loff_t *ppos)
+{
+	struct device_client *device_client =
+		(struct device_client *)file->private_data;
+	struct device_packet *device_packet;
+	int error;
+
+	if ((file->f_flags & O_NONBLOCK) && (device_client->queue_len == 0))
+		return -EAGAIN;
+
+	if ((!buf) || (count < sizeof(struct icmp_packet)))
+		return -EINVAL;
+
+	if (!access_ok(VERIFY_WRITE, buf, count))
+		return -EFAULT;
+
+	error = wait_event_interruptible(device_client->queue_wait,
+					 device_client->queue_len);
+
+	if (error)
+		return error;
+
+	spin_lock(&device_client->lock);
+
+	device_packet = list_first_entry(&device_client->queue_list,
+					 struct device_packet, list);
+	list_del(&device_packet->list);
+	device_client->queue_len--;
+
+	spin_unlock(&device_client->lock);
+
+	error = __copy_to_user(buf, &device_packet->icmp_packet,
+			       sizeof(struct icmp_packet));
+
+	kfree(device_packet);
+
+	if (error)
+		return error;
+
+	return sizeof(struct icmp_packet);
+}
+
+ssize_t bat_device_write(struct file *file, const char __user *buff,
+			 size_t len, loff_t *off)
+{
+	struct device_client *device_client =
+		(struct device_client *)file->private_data;
+	struct icmp_packet icmp_packet;
+	struct orig_node *orig_node;
+	struct batman_if *batman_if;
+
+	if (len < sizeof(struct icmp_packet)) {
+		debug_log(LOG_TYPE_NOTICE, "Error - can't send packet from char device: invalid packet size\n");
+		return -EINVAL;
+	}
+
+	if (!access_ok(VERIFY_READ, buff, sizeof(struct icmp_packet)))
+		return -EFAULT;
+
+	if (__copy_from_user(&icmp_packet, buff, sizeof(icmp_packet)))
+		return -EFAULT;
+
+	if (icmp_packet.packet_type != BAT_ICMP) {
+		debug_log(LOG_TYPE_NOTICE, "Error - can't send packet from char device: got bogus packet type (expected: BAT_ICMP)\n");
+		return -EINVAL;
+	}
+
+	if (icmp_packet.msg_type != ECHO_REQUEST) {
+		debug_log(LOG_TYPE_NOTICE, "Error - can't send packet from char device: got bogus message type (expected: ECHO_REQUEST)\n");
+		return -EINVAL;
+	}
+
+	icmp_packet.uid = device_client->index;
+
+	if (icmp_packet.version != COMPAT_VERSION) {
+		icmp_packet.msg_type = PARAMETER_PROBLEM;
+		icmp_packet.ttl = COMPAT_VERSION;
+		bat_device_add_packet(device_client, &icmp_packet);
+		goto out;
+	}
+
+	if (atomic_read(&module_state) != MODULE_ACTIVE)
+		goto dst_unreach;
+
+	spin_lock(&orig_hash_lock);
+	orig_node = ((struct orig_node *)hash_find(orig_hash, icmp_packet.dst));
+
+	if (!orig_node)
+		goto unlock;
+
+	if (!orig_node->router)
+		goto unlock;
+
+	batman_if = orig_node->batman_if;
+
+	if (!batman_if)
+		goto unlock;
+
+	memcpy(icmp_packet.orig,
+	       batman_if->net_dev->dev_addr,
+	       ETH_ALEN);
+
+	send_raw_packet((unsigned char *)&icmp_packet,
+			sizeof(struct icmp_packet),
+			batman_if, orig_node->router->addr);
+
+	spin_unlock(&orig_hash_lock);
+	goto out;
+
+unlock:
+	spin_unlock(&orig_hash_lock);
+dst_unreach:
+	icmp_packet.msg_type = DESTINATION_UNREACHABLE;
+	bat_device_add_packet(device_client, &icmp_packet);
+out:
+	return len;
+}
+
+unsigned int bat_device_poll(struct file *file, poll_table *wait)
+{
+	struct device_client *device_client =
+		(struct device_client *)file->private_data;
+
+	poll_wait(file, &device_client->queue_wait, wait);
+
+	if (device_client->queue_len > 0)
+		return POLLIN | POLLRDNORM;
+
+	return 0;
+}
+
+void bat_device_add_packet(struct device_client *device_client,
+			   struct icmp_packet *icmp_packet)
+{
+	struct device_packet *device_packet;
+
+	device_packet = kmalloc(sizeof(struct device_packet), GFP_KERNEL);
+
+	if (!device_packet)
+		return;
+
+	INIT_LIST_HEAD(&device_packet->list);
+	memcpy(&device_packet->icmp_packet, icmp_packet,
+	       sizeof(struct icmp_packet));
+
+	spin_lock(&device_client->lock);
+
+	/* while waiting for the lock the device_client could have been
+	 * deleted */
+	if (!device_client_hash[icmp_packet->uid]) {
+		spin_unlock(&device_client->lock);
+		kfree(device_packet);
+		return;
+	}
+
+	list_add_tail(&device_packet->list, &device_client->queue_list);
+	device_client->queue_len++;
+
+	if (device_client->queue_len > 100) {
+		device_packet = list_first_entry(&device_client->queue_list,
+						 struct device_packet, list);
+
+		list_del(&device_packet->list);
+		kfree(device_packet);
+		device_client->queue_len--;
+	}
+
+	spin_unlock(&device_client->lock);
+
+	wake_up(&device_client->queue_wait);
+}
+
+void bat_device_receive_packet(struct icmp_packet *icmp_packet)
+{
+	struct device_client *hash = device_client_hash[icmp_packet->uid];
+
+	if (hash)
+		bat_device_add_packet(hash, icmp_packet);
+}
diff --git a/drivers/staging/batman-adv/device.h b/drivers/staging/batman-adv/device.h
new file mode 100644
index 000000000000..46c0f4496527
--- /dev/null
+++ b/drivers/staging/batman-adv/device.h
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2007-2009 B.A.T.M.A.N. contributors:
+ *
+ * Marek Lindner
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA
+ *
+ */
+
+#include "types.h"
+
+void bat_device_init(void);
+int bat_device_setup(void);
+void bat_device_destroy(void);
+int bat_device_open(struct inode *inode, struct file *file);
+int bat_device_release(struct inode *inode, struct file *file);
+ssize_t bat_device_read(struct file *file, char __user *buf, size_t count,
+			loff_t *ppos);
+ssize_t bat_device_write(struct file *file, const char __user *buff,
+			 size_t len, loff_t *off);
+unsigned int bat_device_poll(struct file *file, poll_table *wait);
+void bat_device_add_packet(struct device_client *device_client,
+			   struct icmp_packet *icmp_packet);
+void bat_device_receive_packet(struct icmp_packet *icmp_packet);
diff --git a/drivers/staging/batman-adv/hard-interface.c b/drivers/staging/batman-adv/hard-interface.c
new file mode 100644
index 000000000000..5ea35da5ee7a
--- /dev/null
+++ b/drivers/staging/batman-adv/hard-interface.c
@@ -0,0 +1,451 @@
+/*
+ * Copyright (C) 2007-2009 B.A.T.M.A.N. contributors:
+ *
+ * Marek Lindner, Simon Wunderlich
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA
+ *
+ */
+
+#include "main.h"
+#include "hard-interface.h"
+#include "log.h"
+#include "soft-interface.h"
+#include "send.h"
+#include "translation-table.h"
+#include "routing.h"
+#include "hash.h"
+#include "compat.h"
+
+#define MIN(x, y) ((x) < (y) ? (x) : (y))
+
+static char avail_ifs;
+static char active_ifs;
+
+static void hardif_free_interface(struct rcu_head *rcu);
+
+static struct batman_if *get_batman_if_by_name(char *name)
+{
+	struct batman_if *batman_if;
+
+	rcu_read_lock();
+	list_for_each_entry_rcu(batman_if, &if_list, list) {
+		if (strncmp(batman_if->dev, name, IFNAMSIZ) == 0)
+			goto out;
+	}
+
+	batman_if = NULL;
+
+out:
+	rcu_read_unlock();
+	return batman_if;
+}
+
+int hardif_min_mtu(void)
+{
+	struct batman_if *batman_if;
+	/* allow big frames if all devices are capable to do so
+	 * (have MTU > 1500 + BAT_HEADER_LEN) */
+	int min_mtu = ETH_DATA_LEN;
+
+	rcu_read_lock();
+	list_for_each_entry_rcu(batman_if, &if_list, list) {
+		if ((batman_if->if_active == IF_ACTIVE) ||
+		    (batman_if->if_active == IF_TO_BE_ACTIVATED))
+			min_mtu = MIN(batman_if->net_dev->mtu - BAT_HEADER_LEN,
+				      min_mtu);
+	}
+	rcu_read_unlock();
+
+	return min_mtu;
+}
+
+static void check_known_mac_addr(uint8_t *addr)
+{
+	struct batman_if *batman_if;
+	char mac_string[ETH_STR_LEN];
+
+	rcu_read_lock();
+	list_for_each_entry_rcu(batman_if, &if_list, list) {
+		if ((batman_if->if_active != IF_ACTIVE) &&
+		    (batman_if->if_active != IF_TO_BE_ACTIVATED))
+			continue;
+
+		if (!compare_orig(batman_if->net_dev->dev_addr, addr))
+			continue;
+
+		addr_to_string(mac_string, addr);
+		debug_log(LOG_TYPE_WARN, "The newly added mac address (%s) already exists on: %s\n",
+		          mac_string, batman_if->dev);
+		debug_log(LOG_TYPE_WARN, "It is strongly recommended to keep mac addresses unique to avoid problems!\n");
+	}
+	rcu_read_unlock();
+}
+
+/* adjusts the MTU if a new interface with a smaller MTU appeared. */
+void update_min_mtu(void)
+{
+	int min_mtu;
+
+	min_mtu = hardif_min_mtu();
+	if (soft_device->mtu != min_mtu)
+		soft_device->mtu = min_mtu;
+}
+
+/* checks if the interface is up. (returns 1 if it is) */
+static int hardif_is_interface_up(char *dev)
+{
+	struct net_device *net_dev;
+
+	/**
+	 * if we already have an interface in our interface list and
+	 * the current interface is not the primary interface and
+	 * the primary interface is not up and
+	 * the primary interface has never been up - don't activate any
+	 * secondary interface !
+	 */
+
+	rcu_read_lock();
+	if ((!list_empty(&if_list)) &&
+	    strncmp(((struct batman_if *)if_list.next)->dev, dev, IFNAMSIZ) &&
+	    !(((struct batman_if *)if_list.next)->if_active == IF_ACTIVE) &&
+	    !(((struct batman_if *)if_list.next)->if_active == IF_TO_BE_ACTIVATED) &&
+	    (!main_if_was_up())) {
+		rcu_read_unlock();
+		goto end;
+	}
+	rcu_read_unlock();
+
+#ifdef __NET_NET_NAMESPACE_H
+	net_dev = dev_get_by_name(&init_net, dev);
+#else
+	net_dev = dev_get_by_name(dev);
+#endif
+	if (!net_dev)
+		goto end;
+
+	if (!(net_dev->flags & IFF_UP))
+		goto failure;
+
+	dev_put(net_dev);
+	return 1;
+
+failure:
+	dev_put(net_dev);
+end:
+	return 0;
+}
+
+/* deactivates the interface. */
+void hardif_deactivate_interface(struct batman_if *batman_if)
+{
+	if (batman_if->if_active != IF_ACTIVE)
+		return;
+
+	if (batman_if->raw_sock)
+		sock_release(batman_if->raw_sock);
+
+	/**
+	 * batman_if->net_dev has been acquired by dev_get_by_name() in
+	 * proc_interfaces_write() and has to be unreferenced.
+	 */
+
+	if (batman_if->net_dev)
+		dev_put(batman_if->net_dev);
+
+	batman_if->raw_sock = NULL;
+	batman_if->net_dev = NULL;
+
+	batman_if->if_active = IF_INACTIVE;
+	active_ifs--;
+
+	debug_log(LOG_TYPE_NOTICE, "Interface deactivated: %s\n",
+	          batman_if->dev);
+}
+
+/* (re)activate given interface. */
+static void hardif_activate_interface(struct batman_if *batman_if)
+{
+	struct sockaddr_ll bind_addr;
+	int retval;
+
+	if (batman_if->if_active != IF_INACTIVE)
+		return;
+
+#ifdef __NET_NET_NAMESPACE_H
+	batman_if->net_dev = dev_get_by_name(&init_net, batman_if->dev);
+#else
+	batman_if->net_dev = dev_get_by_name(batman_if->dev);
+#endif
+	if (!batman_if->net_dev)
+		goto dev_err;
+
+	retval = sock_create_kern(PF_PACKET, SOCK_RAW,
+				  __constant_htons(ETH_P_BATMAN),
+				  &batman_if->raw_sock);
+
+	if (retval < 0) {
+		debug_log(LOG_TYPE_WARN, "Can't create raw socket: %i\n",
+			  retval);
+		goto sock_err;
+	}
+
+	bind_addr.sll_family = AF_PACKET;
+	bind_addr.sll_ifindex = batman_if->net_dev->ifindex;
+	bind_addr.sll_protocol = 0;	/* is set by the kernel */
+
+	retval = kernel_bind(batman_if->raw_sock,
+			     (struct sockaddr *)&bind_addr, sizeof(bind_addr));
+
+	if (retval < 0) {
+		debug_log(LOG_TYPE_WARN, "Can't create bind raw socket: %i\n",
+			  retval);
+		goto bind_err;
+	}
+
+	check_known_mac_addr(batman_if->net_dev->dev_addr);
+
+	batman_if->raw_sock->sk->sk_user_data =
+		batman_if->raw_sock->sk->sk_data_ready;
+	batman_if->raw_sock->sk->sk_data_ready = batman_data_ready;
+
+	addr_to_string(batman_if->addr_str, batman_if->net_dev->dev_addr);
+
+	memcpy(((struct batman_packet *)(batman_if->packet_buff))->orig,
+	       batman_if->net_dev->dev_addr, ETH_ALEN);
+	memcpy(((struct batman_packet *)(batman_if->packet_buff))->prev_sender,
+	       batman_if->net_dev->dev_addr, ETH_ALEN);
+
+	batman_if->if_active = IF_TO_BE_ACTIVATED;
+	active_ifs++;
+
+	/* save the mac address if it is our primary interface */
+	if (batman_if->if_num == 0)
+		set_main_if_addr(batman_if->net_dev->dev_addr);
+
+	debug_log(LOG_TYPE_NOTICE, "Interface activated: %s\n",
+	          batman_if->dev);
+
+	return;
+
+bind_err:
+	sock_release(batman_if->raw_sock);
+sock_err:
+	dev_put(batman_if->net_dev);
+dev_err:
+	batman_if->raw_sock = NULL;
+	batman_if->net_dev = NULL;
+}
+
+static void hardif_free_interface(struct rcu_head *rcu)
+{
+	struct batman_if *batman_if = container_of(rcu, struct batman_if, rcu);
+
+	kfree(batman_if->packet_buff);
+	kfree(batman_if->dev);
+	kfree(batman_if);
+}
+
+/**
+ * called by
+ *  - echo '' > /proc/.../interfaces
+ *  - modprobe -r batman-adv-core
+ */
+/* removes and frees all interfaces */
+void hardif_remove_interfaces(void)
+{
+	struct batman_if *batman_if = NULL;
+
+	avail_ifs = 0;
+
+	/* no lock needed - we don't delete somewhere else */
+	list_for_each_entry(batman_if, &if_list, list) {
+
+		list_del_rcu(&batman_if->list);
+
+		/* first deactivate interface */
+		if (batman_if->if_active != IF_INACTIVE)
+			hardif_deactivate_interface(batman_if);
+
+		call_rcu(&batman_if->rcu, hardif_free_interface);
+	}
+}
+
+static int resize_orig(struct orig_node *orig_node, int if_num)
+{
+	void *data_ptr;
+
+	data_ptr = kmalloc((if_num + 1) * sizeof(TYPE_OF_WORD) * NUM_WORDS,
+			   GFP_ATOMIC);
+	if (!data_ptr) {
+		debug_log(LOG_TYPE_WARN, "Can't resize orig: out of memory\n");
+		return -1;
+	}
+
+	memcpy(data_ptr, orig_node->bcast_own,
+	       if_num * sizeof(TYPE_OF_WORD) * NUM_WORDS);
+	kfree(orig_node->bcast_own);
+	orig_node->bcast_own = data_ptr;
+
+	data_ptr = kmalloc((if_num + 1) * sizeof(uint8_t), GFP_ATOMIC);
+	if (!data_ptr) {
+		debug_log(LOG_TYPE_WARN, "Can't resize orig: out of memory\n");
+		return -1;
+	}
+
+	memcpy(data_ptr, orig_node->bcast_own_sum, if_num * sizeof(uint8_t));
+	kfree(orig_node->bcast_own_sum);
+	orig_node->bcast_own_sum = data_ptr;
+
+	return 0;
+}
+
+
+/* adds an interface the interface list and activate it, if possible */
+int hardif_add_interface(char *dev, int if_num)
+{
+	struct batman_if *batman_if;
+	struct batman_packet *batman_packet;
+	struct orig_node *orig_node;
+	struct hash_it_t *hashit = NULL;
+
+	batman_if = kmalloc(sizeof(struct batman_if), GFP_KERNEL);
+
+	if (!batman_if) {
+		debug_log(LOG_TYPE_WARN, "Can't add interface (%s): out of memory\n", dev);
+		return -1;
+	}
+
+	batman_if->raw_sock = NULL;
+	batman_if->net_dev = NULL;
+
+	if ((if_num == 0) && (num_hna > 0))
+		batman_if->packet_len = BAT_PACKET_LEN + num_hna * ETH_ALEN;
+	else
+		batman_if->packet_len = BAT_PACKET_LEN;
+
+	batman_if->packet_buff = kmalloc(batman_if->packet_len, GFP_KERNEL);
+
+	if (!batman_if->packet_buff) {
+		debug_log(LOG_TYPE_WARN, "Can't add interface packet (%s): out of memory\n", dev);
+		goto out;
+	}
+
+	batman_if->if_num = if_num;
+	batman_if->dev = dev;
+	batman_if->if_active = IF_INACTIVE;
+	INIT_RCU_HEAD(&batman_if->rcu);
+
+	debug_log(LOG_TYPE_NOTICE, "Adding interface: %s\n", dev);
+	avail_ifs++;
+
+	INIT_LIST_HEAD(&batman_if->list);
+
+	batman_packet = (struct batman_packet *)(batman_if->packet_buff);
+	batman_packet->packet_type = BAT_PACKET;
+	batman_packet->version = COMPAT_VERSION;
+	batman_packet->flags = 0x00;
+	batman_packet->ttl = (batman_if->if_num > 0 ? 2 : TTL);
+	batman_packet->flags = 0;
+	batman_packet->tq = TQ_MAX_VALUE;
+	batman_packet->num_hna = 0;
+
+	if (batman_if->packet_len != BAT_PACKET_LEN) {
+		unsigned char *hna_buff;
+		int hna_len;
+
+		hna_buff = batman_if->packet_buff + BAT_PACKET_LEN;
+		hna_len = batman_if->packet_len - BAT_PACKET_LEN;
+		batman_packet->num_hna = hna_local_fill_buffer(hna_buff,
+							       hna_len);
+	}
+
+	atomic_set(&batman_if->seqno, 1);
+
+	/* resize all orig nodes because orig_node->bcast_own(_sum) depend on
+	 * if_num */
+	spin_lock(&orig_hash_lock);
+
+	while (NULL != (hashit = hash_iterate(orig_hash, hashit))) {
+		orig_node = hashit->bucket->data;
+		if (resize_orig(orig_node, if_num) == -1) {
+			spin_unlock(&orig_hash_lock);
+			goto out;
+		}
+	}
+
+	spin_unlock(&orig_hash_lock);
+
+	if (!hardif_is_interface_up(batman_if->dev))
+		debug_log(LOG_TYPE_WARN, "Not using interface %s (retrying later): interface not active\n", batman_if->dev);
+	else
+		hardif_activate_interface(batman_if);
+
+	list_add_tail_rcu(&batman_if->list, &if_list);
+
+	/* begin sending originator messages on that interface */
+	schedule_own_packet(batman_if);
+	return 1;
+
+out:
+	if (batman_if->packet_buff)
+		kfree(batman_if->packet_buff);
+	kfree(batman_if);
+	kfree(dev);
+	return -1;
+}
+
+char hardif_get_active_if_num(void)
+{
+	return active_ifs;
+}
+
+static int hard_if_event(struct notifier_block *this,
+                            unsigned long event, void *ptr)
+{
+	struct net_device *dev = (struct net_device *)ptr;
+	struct batman_if *batman_if = get_batman_if_by_name(dev->name);
+
+	if (!batman_if)
+		goto out;
+
+	switch (event) {
+	case NETDEV_GOING_DOWN:
+	case NETDEV_DOWN:
+	case NETDEV_UNREGISTER:
+		hardif_deactivate_interface(batman_if);
+		break;
+	case NETDEV_UP:
+		hardif_activate_interface(batman_if);
+		if ((atomic_read(&module_state) == MODULE_INACTIVE) &&
+		    (hardif_get_active_if_num() > 0)) {
+			activate_module();
+		}
+		break;
+	/* NETDEV_CHANGEADDR - mac address change - what are we doing here ? */
+	default:
+		/* debug_log(LOG_TYPE_CRIT, "hard_if_event: %s %i\n", dev->name, event); */
+		break;
+	};
+
+	update_min_mtu();
+
+out:
+	return NOTIFY_DONE;
+}
+
+struct notifier_block hard_if_notifier = {
+        .notifier_call = hard_if_event,
+};
diff --git a/drivers/staging/batman-adv/hard-interface.h b/drivers/staging/batman-adv/hard-interface.h
new file mode 100644
index 000000000000..742358c00c0e
--- /dev/null
+++ b/drivers/staging/batman-adv/hard-interface.h
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2007-2009 B.A.T.M.A.N. contributors:
+ *
+ * Marek Lindner, Simon Wunderlich
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA
+ *
+ */
+
+#define IF_INACTIVE 0
+#define IF_ACTIVE 1
+/* #define IF_TO_BE_DEACTIVATED 2 - not needed anymore */
+#define IF_TO_BE_ACTIVATED 3
+
+extern struct notifier_block hard_if_notifier;
+
+void hardif_remove_interfaces(void);
+int hardif_add_interface(char *dev, int if_num);
+void hardif_deactivate_interface(struct batman_if *batman_if);
+char hardif_get_active_if_num(void);
+void hardif_check_interfaces_status(void);
+void hardif_check_interfaces_status_wq(struct work_struct *work);
+int hardif_min_mtu(void);
+void update_min_mtu(void);
diff --git a/drivers/staging/batman-adv/hash.c b/drivers/staging/batman-adv/hash.c
new file mode 100644
index 000000000000..61cb4a20ebca
--- /dev/null
+++ b/drivers/staging/batman-adv/hash.c
@@ -0,0 +1,313 @@
+/*
+ * Copyright (C) 2006-2009 B.A.T.M.A.N. contributors:
+ *
+ * Simon Wunderlich, Marek Lindner
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA
+ *
+ */
+
+#include "main.h"
+#include "hash.h"
+
+/* clears the hash */
+void hash_init(struct hashtable_t *hash)
+{
+	int i;
+
+	hash->elements = 0;
+
+	for (i = 0 ; i < hash->size; i++)
+		hash->table[i] = NULL;
+}
+
+/* remove the hash structure. if hashdata_free_cb != NULL, this function will be
+ * called to remove the elements inside of the hash.  if you don't remove the
+ * elements, memory might be leaked. */
+void hash_delete(struct hashtable_t *hash, hashdata_free_cb free_cb)
+{
+	struct element_t *bucket, *last_bucket;
+	int i;
+
+	for (i = 0; i < hash->size; i++) {
+		bucket = hash->table[i];
+
+		while (bucket != NULL) {
+			if (free_cb != NULL)
+				free_cb(bucket->data);
+
+			last_bucket = bucket;
+			bucket = bucket->next;
+			kfree(last_bucket);
+		}
+	}
+
+	hash_destroy(hash);
+}
+
+/* free only the hashtable and the hash itself. */
+void hash_destroy(struct hashtable_t *hash)
+{
+	kfree(hash->table);
+	kfree(hash);
+}
+
+/* iterate though the hash. first element is selected with iter_in NULL.  use
+ * the returned iterator to access the elements until hash_it_t returns NULL. */
+struct hash_it_t *hash_iterate(struct hashtable_t *hash,
+			       struct hash_it_t *iter_in)
+{
+	struct hash_it_t *iter;
+
+	if (!hash)
+		return NULL;
+
+	if (iter_in == NULL) {
+		iter = kmalloc(sizeof(struct hash_it_t), GFP_ATOMIC);
+		iter->index = -1;
+		iter->bucket = NULL;
+		iter->prev_bucket = NULL;
+	} else {
+		iter = iter_in;
+	}
+
+	/* sanity checks first (if our bucket got deleted in the last
+	 * iteration): */
+	if (iter->bucket != NULL) {
+		if (iter->first_bucket != NULL) {
+			/* we're on the first element and it got removed after
+			 * the last iteration. */
+			if ((*iter->first_bucket) != iter->bucket) {
+				/* there are still other elements in the list */
+				if ((*iter->first_bucket) != NULL) {
+					iter->prev_bucket = NULL;
+					iter->bucket = (*iter->first_bucket);
+					iter->first_bucket =
+						&hash->table[iter->index];
+					return iter;
+				} else {
+					iter->bucket = NULL;
+				}
+			}
+		} else if (iter->prev_bucket != NULL) {
+			/*
+			* we're not on the first element, and the bucket got
+			* removed after the last iteration.  the last bucket's
+			* next pointer is not pointing to our actual bucket
+			* anymore.  select the next.
+			*/
+			if (iter->prev_bucket->next != iter->bucket)
+				iter->bucket = iter->prev_bucket;
+		}
+	}
+
+	/* now as we are sane, select the next one if there is some */
+	if (iter->bucket != NULL) {
+		if (iter->bucket->next != NULL) {
+			iter->prev_bucket = iter->bucket;
+			iter->bucket = iter->bucket->next;
+			iter->first_bucket = NULL;
+			return iter;
+		}
+	}
+
+	/* if not returned yet, we've reached the last one on the index and have
+	 * to search forward */
+	iter->index++;
+	/* go through the entries of the hash table */
+	while (iter->index < hash->size) {
+		if ((hash->table[iter->index]) != NULL) {
+			iter->prev_bucket = NULL;
+			iter->bucket = hash->table[iter->index];
+			iter->first_bucket = &hash->table[iter->index];
+			return iter;
+		} else {
+			iter->index++;
+		}
+	}
+
+	/* nothing to iterate over anymore */
+	kfree(iter);
+	return NULL;
+}
+
+/* allocates and clears the hash */
+struct hashtable_t *hash_new(int size, hashdata_compare_cb compare,
+			     hashdata_choose_cb choose)
+{
+	struct hashtable_t *hash;
+
+	hash = kmalloc(sizeof(struct hashtable_t) , GFP_ATOMIC);
+
+	if (hash == NULL)
+		return NULL;
+
+	hash->size = size;
+	hash->table = kmalloc(sizeof(struct element_t *) * size, GFP_ATOMIC);
+
+	if (hash->table == NULL) {
+		kfree(hash);
+		return NULL;
+	}
+
+	hash_init(hash);
+
+	hash->compare = compare;
+	hash->choose = choose;
+
+	return hash;
+}
+
+/* adds data to the hashtable. returns 0 on success, -1 on error */
+int hash_add(struct hashtable_t *hash, void *data)
+{
+	int index;
+	struct element_t *bucket, *prev_bucket = NULL;
+
+	if (!hash)
+		return -1;
+
+	index = hash->choose(data, hash->size);
+	bucket = hash->table[index];
+
+	while (bucket != NULL) {
+		if (hash->compare(bucket->data, data))
+			return -1;
+
+		prev_bucket = bucket;
+		bucket = bucket->next;
+	}
+
+	/* found the tail of the list, add new element */
+	bucket = kmalloc(sizeof(struct element_t), GFP_ATOMIC);
+
+	if (bucket == NULL)
+		return -1;
+
+	bucket->data = data;
+	bucket->next = NULL;
+
+	/* and link it */
+	if (prev_bucket == NULL)
+		hash->table[index] = bucket;
+	else
+		prev_bucket->next = bucket;
+
+	hash->elements++;
+	return 0;
+}
+
+/* finds data, based on the key in keydata. returns the found data on success,
+ * or NULL on error */
+void *hash_find(struct hashtable_t *hash, void *keydata)
+{
+	int index;
+	struct element_t *bucket;
+
+	if (!hash)
+		return NULL;
+
+	index = hash->choose(keydata , hash->size);
+	bucket = hash->table[index];
+
+	while (bucket != NULL) {
+		if (hash->compare(bucket->data, keydata))
+			return bucket->data;
+
+		bucket = bucket->next;
+	}
+
+	return NULL;
+}
+
+/* remove bucket (this might be used in hash_iterate() if you already found the
+ * bucket you want to delete and don't need the overhead to find it again with
+ * hash_remove(). But usually, you don't want to use this function, as it
+ * fiddles with hash-internals. */
+void *hash_remove_bucket(struct hashtable_t *hash, struct hash_it_t *hash_it_t)
+{
+	void *data_save;
+
+	data_save = hash_it_t->bucket->data;
+
+	if (hash_it_t->prev_bucket != NULL)
+		hash_it_t->prev_bucket->next = hash_it_t->bucket->next;
+	else if (hash_it_t->first_bucket != NULL)
+		(*hash_it_t->first_bucket) = hash_it_t->bucket->next;
+
+	kfree(hash_it_t->bucket);
+	hash->elements--;
+
+	return data_save;
+}
+
+/* removes data from hash, if found. returns pointer do data on success, so you
+ * can remove the used structure yourself, or NULL on error .  data could be the
+ * structure you use with just the key filled, we just need the key for
+ * comparing. */
+void *hash_remove(struct hashtable_t *hash, void *data)
+{
+	struct hash_it_t hash_it_t;
+
+	hash_it_t.index = hash->choose(data, hash->size);
+	hash_it_t.bucket = hash->table[hash_it_t.index];
+	hash_it_t.prev_bucket = NULL;
+
+	while (hash_it_t.bucket != NULL) {
+		if (hash->compare(hash_it_t.bucket->data, data)) {
+			hash_it_t.first_bucket =
+				(hash_it_t.bucket ==
+				 hash->table[hash_it_t.index] ?
+				 &hash->table[hash_it_t.index] : NULL);
+			return hash_remove_bucket(hash, &hash_it_t);
+		}
+
+		hash_it_t.prev_bucket = hash_it_t.bucket;
+		hash_it_t.bucket = hash_it_t.bucket->next;
+	}
+
+	return NULL;
+}
+
+/* resize the hash, returns the pointer to the new hash or NULL on
+ * error. removes the old hash on success. */
+struct hashtable_t *hash_resize(struct hashtable_t *hash, int size)
+{
+	struct hashtable_t *new_hash;
+	struct element_t *bucket;
+	int i;
+
+	/* initialize a new hash with the new size */
+	new_hash = hash_new(size, hash->compare, hash->choose);
+
+	if (new_hash == NULL)
+		return NULL;
+
+	/* copy the elements */
+	for (i = 0; i < hash->size; i++) {
+		bucket = hash->table[i];
+
+		while (bucket != NULL) {
+			hash_add(new_hash, bucket->data);
+			bucket = bucket->next;
+		}
+	}
+
+	/* remove hash and eventual overflow buckets but not the content
+	 * itself. */
+	hash_delete(hash, NULL);
+
+	return new_hash;
+}
diff --git a/drivers/staging/batman-adv/hash.h b/drivers/staging/batman-adv/hash.h
new file mode 100644
index 000000000000..bb60f082be6a
--- /dev/null
+++ b/drivers/staging/batman-adv/hash.h
@@ -0,0 +1,99 @@
+/*
+ * Copyright (C) 2006-2009 B.A.T.M.A.N. contributors:
+ *
+ * Simon Wunderlich, Marek Lindner
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA
+ *
+ */
+
+#ifndef _BATMAN_HASH_H
+#define _BATMAN_HASH_H
+
+typedef int (*hashdata_compare_cb)(void *, void *);
+typedef int (*hashdata_choose_cb)(void *, int);
+typedef void (*hashdata_free_cb)(void *);
+
+struct element_t {
+	void *data;		/* pointer to the data */
+	struct element_t *next;	/* overflow bucket pointer */
+};
+
+struct hash_it_t {
+	int index;
+	struct element_t *bucket;
+	struct element_t *prev_bucket;
+	struct element_t **first_bucket;
+};
+
+struct hashtable_t {
+	struct element_t **table;   /* the hashtable itself, with the buckets */
+	int elements;		    /* number of elements registered */
+	int size;		    /* size of hashtable */
+	hashdata_compare_cb compare;/* callback to a compare function.  should
+				     * compare 2 element datas for their keys,
+				     * return 0 if same and not 0 if not
+				     * same */
+	hashdata_choose_cb choose;  /* the hashfunction, should return an index
+				     * based on the key in the data of the first
+				     * argument and the size the second */
+};
+
+/* clears the hash */
+void hash_init(struct hashtable_t *hash);
+
+/* allocates and clears the hash */
+struct hashtable_t *hash_new(int size, hashdata_compare_cb compare,
+			     hashdata_choose_cb choose);
+
+/* remove bucket (this might be used in hash_iterate() if you already found the
+ * bucket you want to delete and don't need the overhead to find it again with
+ * hash_remove().  But usually, you don't want to use this function, as it
+ * fiddles with hash-internals. */
+void *hash_remove_bucket(struct hashtable_t *hash, struct hash_it_t *hash_it_t);
+
+/* remove the hash structure. if hashdata_free_cb != NULL, this function will be
+ * called to remove the elements inside of the hash.  if you don't remove the
+ * elements, memory might be leaked. */
+void hash_delete(struct hashtable_t *hash, hashdata_free_cb free_cb);
+
+/* free only the hashtable and the hash itself. */
+void hash_destroy(struct hashtable_t *hash);
+
+/* adds data to the hashtable. returns 0 on success, -1 on error */
+int hash_add(struct hashtable_t *hash, void *data);
+
+/* removes data from hash, if found. returns pointer do data on success, so you
+ * can remove the used structure yourself, or NULL on error .  data could be the
+ * structure you use with just the key filled, we just need the key for
+ * comparing. */
+void *hash_remove(struct hashtable_t *hash, void *data);
+
+/* finds data, based on the key in keydata. returns the found data on success,
+ * or NULL on error */
+void *hash_find(struct hashtable_t *hash, void *keydata);
+
+/* resize the hash, returns the pointer to the new hash or NULL on
+ * error. removes the old hash on success */
+struct hashtable_t *hash_resize(struct hashtable_t *hash, int size);
+
+/* iterate though the hash. first element is selected with iter_in NULL.  use
+ * the returned iterator to access the elements until hash_it_t returns NULL. */
+struct hash_it_t *hash_iterate(struct hashtable_t *hash,
+			       struct hash_it_t *iter_in);
+
+/* print the hash table for debugging */
+void hash_debug(struct hashtable_t *hash);
+#endif
diff --git a/drivers/staging/batman-adv/log.c b/drivers/staging/batman-adv/log.c
new file mode 100644
index 000000000000..f37c7f01a9f5
--- /dev/null
+++ b/drivers/staging/batman-adv/log.c
@@ -0,0 +1,179 @@
+/*
+ * Copyright (C) 2007-2009 B.A.T.M.A.N. contributors:
+ *
+ * Marek Lindner, Simon Wunderlich
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA
+ *
+ */
+
+#include "main.h"
+#include "log.h"
+
+#define LOG_BUF_MASK (log_buf_len-1)
+#define LOG_BUF(idx) (log_buf[(idx) & LOG_BUF_MASK])
+
+static char log_buf[LOG_BUF_LEN];
+static int log_buf_len = LOG_BUF_LEN;
+static unsigned long log_start;
+static unsigned long log_end;
+uint8_t log_level;
+
+static DEFINE_SPINLOCK(logbuf_lock);
+
+const struct file_operations proc_log_operations = {
+	.open           = log_open,
+	.release        = log_release,
+	.read           = log_read,
+	.write          = log_write,
+	.poll           = log_poll,
+};
+
+static DECLARE_WAIT_QUEUE_HEAD(log_wait);
+
+static void emit_log_char(char c)
+{
+	LOG_BUF(log_end) = c;
+	log_end++;
+
+	if (log_end - log_start > log_buf_len)
+		log_start = log_end - log_buf_len;
+}
+
+static int fdebug_log(char *fmt, ...)
+{
+	int printed_len;
+	char *p;
+	va_list args;
+	static char debug_log_buf[256];
+	unsigned long flags;
+
+	spin_lock_irqsave(&logbuf_lock, flags);
+	va_start(args, fmt);
+	printed_len = vscnprintf(debug_log_buf, sizeof(debug_log_buf), fmt,
+				 args);
+	va_end(args);
+
+	for (p = debug_log_buf; *p != 0; p++)
+		emit_log_char(*p);
+
+	spin_unlock_irqrestore(&logbuf_lock, flags);
+
+	wake_up(&log_wait);
+
+	return 0;
+}
+
+int debug_log(int type, char *fmt, ...)
+{
+	va_list args;
+	int retval = 0;
+	char tmp_log_buf[256];
+
+	/* only critical information get into the official kernel log */
+	if (type == LOG_TYPE_CRIT) {
+		va_start(args, fmt);
+		vscnprintf(tmp_log_buf, sizeof(tmp_log_buf), fmt, args);
+		printk(KERN_ERR "batman-adv: %s", tmp_log_buf);
+		va_end(args);
+	}
+
+	if ((type == LOG_TYPE_CRIT) || (log_level & type)) {
+		va_start(args, fmt);
+		vscnprintf(tmp_log_buf, sizeof(tmp_log_buf), fmt, args);
+		fdebug_log("[%10u] %s", (jiffies / HZ), tmp_log_buf);
+		va_end(args);
+	}
+
+	return retval;
+}
+
+int log_open(struct inode *inode, struct file *file)
+{
+	inc_module_count();
+	return 0;
+}
+
+int log_release(struct inode *inode, struct file *file)
+{
+	dec_module_count();
+	return 0;
+}
+
+ssize_t log_read(struct file *file, char __user *buf, size_t count,
+		 loff_t *ppos)
+{
+	int error, i = 0;
+	char c;
+	unsigned long flags;
+
+	if ((file->f_flags & O_NONBLOCK) && !(log_end - log_start))
+		return -EAGAIN;
+
+	if ((!buf) || (count < 0))
+		return -EINVAL;
+
+	if (count == 0)
+		return 0;
+
+	if (!access_ok(VERIFY_WRITE, buf, count))
+		return -EFAULT;
+
+	error = wait_event_interruptible(log_wait, (log_start - log_end));
+
+	if (error)
+		return error;
+
+	spin_lock_irqsave(&logbuf_lock, flags);
+
+	while ((!error) && (log_start != log_end) && (i < count)) {
+		c = LOG_BUF(log_start);
+
+		log_start++;
+
+		spin_unlock_irqrestore(&logbuf_lock, flags);
+
+		error = __put_user(c, buf);
+
+		spin_lock_irqsave(&logbuf_lock, flags);
+
+		buf++;
+		i++;
+
+	}
+
+	spin_unlock_irqrestore(&logbuf_lock, flags);
+
+	if (!error)
+		return i;
+
+	return error;
+}
+
+ssize_t log_write(struct file *file, const char __user *buf, size_t count,
+		  loff_t *ppos)
+{
+	return count;
+}
+
+unsigned int log_poll(struct file *file, poll_table *wait)
+{
+	poll_wait(file, &log_wait, wait);
+
+	if (log_end - log_start)
+		return POLLIN | POLLRDNORM;
+
+	return 0;
+}
diff --git a/drivers/staging/batman-adv/log.h b/drivers/staging/batman-adv/log.h
new file mode 100644
index 000000000000..780e3abb48f9
--- /dev/null
+++ b/drivers/staging/batman-adv/log.h
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) 2007-2009 B.A.T.M.A.N. contributors:
+ *
+ * Marek Lindner, Simon Wunderlich
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA
+ *
+ */
+
+extern const struct file_operations proc_log_operations;
+extern uint8_t log_level;
+
+int debug_log(int type, char *fmt, ...);
+int log_open(struct inode *inode, struct file *file);
+int log_release(struct inode *inode, struct file *file);
+ssize_t log_read(struct file *file, char __user *buf, size_t count,
+		 loff_t *ppos);
+ssize_t log_write(struct file *file, const char __user *buf, size_t count,
+		  loff_t *ppos);
+unsigned int log_poll(struct file *file, poll_table *wait);
diff --git a/drivers/staging/batman-adv/main.c b/drivers/staging/batman-adv/main.c
new file mode 100644
index 000000000000..bb89bfc5dda6
--- /dev/null
+++ b/drivers/staging/batman-adv/main.c
@@ -0,0 +1,286 @@
+/*
+ * Copyright (C) 2007-2009 B.A.T.M.A.N. contributors:
+ *
+ * Marek Lindner, Simon Wunderlich
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA
+ *
+ */
+
+#include "main.h"
+#include "proc.h"
+#include "log.h"
+#include "routing.h"
+#include "send.h"
+#include "soft-interface.h"
+#include "device.h"
+#include "translation-table.h"
+#include "hard-interface.h"
+#include "types.h"
+#include "vis.h"
+#include "hash.h"
+#include "compat.h"
+
+struct list_head if_list;
+struct hlist_head forw_bat_list;
+struct hlist_head forw_bcast_list;
+struct hashtable_t *orig_hash;
+
+DEFINE_SPINLOCK(orig_hash_lock);
+DEFINE_SPINLOCK(forw_bat_list_lock);
+DEFINE_SPINLOCK(forw_bcast_list_lock);
+
+atomic_t originator_interval;
+atomic_t vis_interval;
+atomic_t aggregation_enabled;
+int16_t num_hna;
+int16_t num_ifs;
+
+struct net_device *soft_device;
+
+static struct task_struct *kthread_task;
+
+unsigned char broadcastAddr[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+atomic_t module_state;
+
+struct workqueue_struct *bat_event_workqueue;
+
+int init_module(void)
+{
+	int retval;
+
+	INIT_LIST_HEAD(&if_list);
+	INIT_HLIST_HEAD(&forw_bat_list);
+	INIT_HLIST_HEAD(&forw_bcast_list);
+
+	atomic_set(&module_state, MODULE_INACTIVE);
+
+	atomic_set(&originator_interval, 1000);
+	atomic_set(&vis_interval, 1000);/* TODO: raise this later, this is only
+					 * for debugging now. */
+	atomic_set(&aggregation_enabled, 1);
+
+	/* the name should not be longer than 10 chars - see
+	 * http://lwn.net/Articles/23634/ */
+	bat_event_workqueue = create_singlethread_workqueue("bat_events");
+
+	if (!bat_event_workqueue)
+		return -ENOMEM;
+
+	retval = setup_procfs();
+	if (retval < 0)
+		return retval;
+
+	bat_device_init();
+
+	/* initialize layer 2 interface */
+	soft_device = alloc_netdev(sizeof(struct bat_priv) , "bat%d",
+				   interface_setup);
+
+	if (!soft_device) {
+		debug_log(LOG_TYPE_CRIT, "Unable to allocate the batman interface\n");
+		goto end;
+	}
+
+	retval = register_netdev(soft_device);
+
+	if (retval < 0) {
+		debug_log(LOG_TYPE_CRIT, "Unable to register the batman interface: %i\n", retval);
+		goto free_soft_device;
+	}
+
+	register_netdevice_notifier(&hard_if_notifier);
+
+	debug_log(LOG_TYPE_CRIT, "B.A.T.M.A.N. advanced %s%s (compatibility version %i) loaded \n",
+	          SOURCE_VERSION, REVISION_VERSION_STR, COMPAT_VERSION);
+
+	return 0;
+
+free_soft_device:
+	free_netdev(soft_device);
+	soft_device = NULL;
+end:
+	return -ENOMEM;
+}
+
+void cleanup_module(void)
+{
+	shutdown_module();
+
+	if (soft_device) {
+		unregister_netdev(soft_device);
+		soft_device = NULL;
+	}
+
+	unregister_netdevice_notifier(&hard_if_notifier);
+	cleanup_procfs();
+
+	destroy_workqueue(bat_event_workqueue);
+	bat_event_workqueue = NULL;
+}
+
+/* activates the module, creates bat device, starts timer ... */
+void activate_module(void)
+{
+	if (originator_init() < 1)
+		goto err;
+
+	if (hna_local_init() < 1)
+		goto err;
+
+	if (hna_global_init() < 1)
+		goto err;
+
+	hna_local_add(soft_device->dev_addr);
+
+	if (bat_device_setup() < 1)
+		goto end;
+
+	if (vis_init() < 1)
+		goto err;
+
+	/* (re)start kernel thread for packet processing */
+	if (!kthread_task) {
+		kthread_task = kthread_run(packet_recv_thread, NULL, "batman-adv");
+
+		if (IS_ERR(kthread_task)) {
+			debug_log(LOG_TYPE_CRIT, "Unable to start packet receive thread\n");
+			kthread_task = NULL;
+		}
+	}
+
+	update_min_mtu();
+	atomic_set(&module_state, MODULE_ACTIVE);
+	goto end;
+
+err:
+	debug_log(LOG_TYPE_CRIT, "Unable to allocate memory for mesh information structures: out of mem ?\n");
+	shutdown_module();
+end:
+	return;
+}
+
+/* shuts down the whole module.*/
+void shutdown_module(void)
+{
+	atomic_set(&module_state, MODULE_DEACTIVATING);
+
+	purge_outstanding_packets();
+	flush_workqueue(bat_event_workqueue);
+
+	vis_quit();
+
+	/* deactivate kernel thread for packet processing (if running) */
+	if (kthread_task) {
+		atomic_set(&exit_cond, 1);
+		wake_up_interruptible(&thread_wait);
+		kthread_stop(kthread_task);
+
+		kthread_task = NULL;
+	}
+
+	originator_free();
+
+	hna_local_free();
+	hna_global_free();
+
+	synchronize_net();
+	bat_device_destroy();
+
+	hardif_remove_interfaces();
+	synchronize_rcu();
+	atomic_set(&module_state, MODULE_INACTIVE);
+}
+
+void inc_module_count(void)
+{
+	try_module_get(THIS_MODULE);
+}
+
+void dec_module_count(void)
+{
+	module_put(THIS_MODULE);
+}
+
+int addr_to_string(char *buff, uint8_t *addr)
+{
+	return sprintf(buff, "%02x:%02x:%02x:%02x:%02x:%02x",
+		       addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]);
+}
+
+/* returns 1 if they are the same originator */
+
+int compare_orig(void *data1, void *data2)
+{
+	return (memcmp(data1, data2, ETH_ALEN) == 0 ? 1 : 0);
+}
+
+/* hashfunction to choose an entry in a hash table of given size */
+/* hash algorithm from http://en.wikipedia.org/wiki/Hash_table */
+int choose_orig(void *data, int32_t size)
+{
+	unsigned char *key = data;
+	uint32_t hash = 0;
+	size_t i;
+
+	for (i = 0; i < 6; i++) {
+		hash += key[i];
+		hash += (hash << 10);
+		hash ^= (hash >> 6);
+	}
+
+	hash += (hash << 3);
+	hash ^= (hash >> 11);
+	hash += (hash << 15);
+
+	return hash % size;
+}
+
+int is_my_mac(uint8_t *addr)
+{
+	struct batman_if *batman_if;
+	rcu_read_lock();
+	list_for_each_entry_rcu(batman_if, &if_list, list) {
+		if ((batman_if->net_dev) &&
+		    (compare_orig(batman_if->net_dev->dev_addr, addr))) {
+			rcu_read_unlock();
+			return 1;
+		}
+	}
+	rcu_read_unlock();
+	return 0;
+
+}
+
+int is_bcast(uint8_t *addr)
+{
+	return (addr[0] == (uint8_t)0xff) && (addr[1] == (uint8_t)0xff);
+}
+
+int is_mcast(uint8_t *addr)
+{
+	return *addr & 0x01;
+}
+
+MODULE_LICENSE("GPL");
+
+MODULE_AUTHOR(DRIVER_AUTHOR);
+MODULE_DESCRIPTION(DRIVER_DESC);
+MODULE_SUPPORTED_DEVICE(DRIVER_DEVICE);
+#ifdef REVISION_VERSION
+MODULE_VERSION(SOURCE_VERSION "-" REVISION_VERSION);
+#else
+MODULE_VERSION(SOURCE_VERSION);
+#endif
diff --git a/drivers/staging/batman-adv/main.h b/drivers/staging/batman-adv/main.h
new file mode 100644
index 000000000000..facb6b79ee52
--- /dev/null
+++ b/drivers/staging/batman-adv/main.h
@@ -0,0 +1,151 @@
+/*
+ * Copyright (C) 2007-2009 B.A.T.M.A.N. contributors:
+ *
+ * Marek Lindner, Simon Wunderlich
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA
+ *
+ */
+
+/* Kernel Programming */
+#define LINUX
+
+#define DRIVER_AUTHOR "Marek Lindner <lindner_marek@yahoo.de>, Simon Wunderlich <siwu@hrz.tu-chemnitz.de>"
+#define DRIVER_DESC   "B.A.T.M.A.N. advanced"
+#define DRIVER_DEVICE "batman-adv"
+
+#define SOURCE_VERSION "0.2.1-beta"
+
+
+/* B.A.T.M.A.N. parameters */
+
+#define TQ_MAX_VALUE 255
+#define JITTER 20
+#define TTL 50		          /* Time To Live of broadcast messages */
+#define MAX_ADDR 16	          /* number of interfaces which can be added to
+				   * batman. */
+
+#define PURGE_TIMEOUT 200000      /* purge originators after time in ms if no
+				   * valid packet comes in -> TODO: check
+				   * influence on TQ_LOCAL_WINDOW_SIZE */
+#define LOCAL_HNA_TIMEOUT 3600000
+
+#define TQ_LOCAL_WINDOW_SIZE 64   /* sliding packet range of received originator
+				   * messages in squence numbers (should be a
+				   * multiple of our word size) */
+#define TQ_GLOBAL_WINDOW_SIZE 5
+#define TQ_LOCAL_BIDRECT_SEND_MINIMUM 1
+#define TQ_LOCAL_BIDRECT_RECV_MINIMUM 1
+#define TQ_TOTAL_BIDRECT_LIMIT 1
+
+#define TQ_HOP_PENALTY 10
+
+#define NUM_WORDS (TQ_LOCAL_WINDOW_SIZE / WORD_BIT_SIZE)
+
+#define PACKBUFF_SIZE 2000
+#define LOG_BUF_LEN 8192	  /* has to be a power of 2 */
+#define ETH_STR_LEN 20
+
+#define MAX_AGGREGATION_BYTES 512 /* should not be bigger than 512 bytes or
+				   * change the size of
+				   * forw_packet->direct_link_flags */
+#define MAX_AGGREGATION_MS 100
+
+#define MODULE_INACTIVE 0
+#define MODULE_ACTIVE 1
+#define MODULE_DEACTIVATING 2
+
+
+/*
+ * Logging
+ */
+
+#define LOG_TYPE_CRIT 0		/* highest priority for fatal errors such as
+				 * blocked sockets / failed packet delivery /
+				 * programming errors */
+#define LOG_TYPE_WARN 1		/* warnings for small errors like wrong user
+				 * input / damaged packets / etc */
+#define LOG_TYPE_NOTICE 2	/* notice information for new interfaces /
+				 * changed settings / new originators / etc */
+#define LOG_TYPE_BATMAN 4	/* all messages related to routing / flooding /
+				 * broadcasting / etc */
+#define LOG_TYPE_ROUTES 8	/* route or hna added / changed / deleted */
+#define LOG_TYPE_CRIT_NAME	"critical"
+#define LOG_TYPE_WARN_NAME	"warnings"
+#define LOG_TYPE_NOTICE_NAME	"notices"
+#define LOG_TYPE_BATMAN_NAME	"batman"
+#define LOG_TYPE_ROUTES_NAME	"routes"
+
+/*
+ *  Vis
+ */
+
+/* #define VIS_SUBCLUSTERS_DISABLED */
+
+/*
+ * Kernel headers
+ */
+
+#include <linux/mutex.h>	/* mutex */
+#include <linux/module.h>	/* needed by all modules */
+#include <linux/netdevice.h>	/* netdevice */
+#include <linux/if_ether.h>	/* ethernet header */
+#include <linux/poll.h>		/* poll_table */
+#include <linux/kthread.h>	/* kernel threads */
+#include <linux/pkt_sched.h>	/* schedule types */
+#include <linux/workqueue.h>	/* workqueue */
+#include <net/sock.h>		/* struct sock */
+#include <linux/jiffies.h>
+#include "types.h"
+
+#ifndef REVISION_VERSION
+#define REVISION_VERSION_STR ""
+#else
+#define REVISION_VERSION_STR " "REVISION_VERSION
+#endif
+
+extern struct list_head if_list;
+extern struct hlist_head forw_bat_list;
+extern struct hlist_head forw_bcast_list;
+extern struct hashtable_t *orig_hash;
+
+extern spinlock_t orig_hash_lock;
+extern spinlock_t forw_bat_list_lock;
+extern spinlock_t forw_bcast_list_lock;
+
+extern atomic_t originator_interval;
+extern atomic_t vis_interval;
+extern atomic_t aggregation_enabled;
+extern int16_t num_hna;
+extern int16_t num_ifs;
+
+extern struct net_device *soft_device;
+
+extern unsigned char broadcastAddr[];
+extern atomic_t module_state;
+extern struct workqueue_struct *bat_event_workqueue;
+
+void activate_module(void);
+void shutdown_module(void);
+void inc_module_count(void);
+void dec_module_count(void);
+int addr_to_string(char *buff, uint8_t *addr);
+int compare_orig(void *data1, void *data2);
+int choose_orig(void *data, int32_t size);
+int is_my_mac(uint8_t *addr);
+int is_bcast(uint8_t *addr);
+int is_mcast(uint8_t *addr);
+
+
diff --git a/drivers/staging/batman-adv/packet.h b/drivers/staging/batman-adv/packet.h
new file mode 100644
index 000000000000..5627ca326018
--- /dev/null
+++ b/drivers/staging/batman-adv/packet.h
@@ -0,0 +1,96 @@
+/*
+ * Copyright (C) 2007-2009 B.A.T.M.A.N. contributors:
+ *
+ * Marek Lindner, Simon Wunderlich
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA
+ *
+ */
+
+#define ETH_P_BATMAN  0x4305	/* unofficial/not registered Ethertype */
+
+#define BAT_PACKET    0x01
+#define BAT_ICMP      0x02
+#define BAT_UNICAST   0x03
+#define BAT_BCAST     0x04
+#define BAT_VIS       0x05
+
+/* this file is included by batctl which needs these defines */
+#define COMPAT_VERSION 8
+#define DIRECTLINK 0x40
+#define VIS_SERVER 0x20
+
+/* ICMP message types */
+#define ECHO_REPLY 0
+#define DESTINATION_UNREACHABLE 3
+#define ECHO_REQUEST 8
+#define TTL_EXCEEDED 11
+#define PARAMETER_PROBLEM 12
+
+/* vis defines */
+#define VIS_TYPE_SERVER_SYNC		0
+#define VIS_TYPE_CLIENT_UPDATE		1
+
+struct batman_packet {
+	uint8_t  packet_type;
+	uint8_t  version;  /* batman version field */
+	uint8_t  flags;    /* 0x40: DIRECTLINK flag, 0x20 VIS_SERVER flag... */
+	uint8_t  tq;
+	uint16_t seqno;
+	uint8_t  orig[6];
+	uint8_t  prev_sender[6];
+	uint8_t  ttl;
+	uint8_t  num_hna;
+} __attribute__((packed));
+
+#define BAT_PACKET_LEN sizeof(struct batman_packet)
+
+struct icmp_packet {
+	uint8_t  packet_type;
+	uint8_t  version;  /* batman version field */
+	uint8_t  msg_type; /* see ICMP message types above */
+	uint8_t  ttl;
+	uint8_t  dst[6];
+	uint8_t  orig[6];
+	uint16_t seqno;
+	uint8_t  uid;
+} __attribute__((packed));
+
+struct unicast_packet {
+	uint8_t  packet_type;
+	uint8_t  version;  /* batman version field */
+	uint8_t  dest[6];
+	uint8_t  ttl;
+} __attribute__((packed));
+
+struct bcast_packet {
+	uint8_t  packet_type;
+	uint8_t  version;  /* batman version field */
+	uint8_t  orig[6];
+	uint16_t seqno;
+} __attribute__((packed));
+
+struct vis_packet {
+	uint8_t  packet_type;
+	uint8_t  version;        /* batman version field */
+	uint8_t  vis_type;	 /* which type of vis-participant sent this? */
+	uint8_t  seqno;		 /* sequence number */
+	uint8_t  entries;	 /* number of entries behind this struct */
+	uint8_t  ttl;		 /* TTL */
+	uint8_t  vis_orig[6];	 /* originator that informs about its
+				  * neighbours */
+	uint8_t  target_orig[6]; /* who should receive this packet */
+	uint8_t  sender_orig[6]; /* who sent or rebroadcasted this packet */
+} __attribute__((packed));
diff --git a/drivers/staging/batman-adv/proc.c b/drivers/staging/batman-adv/proc.c
new file mode 100644
index 000000000000..aac3df7f13fb
--- /dev/null
+++ b/drivers/staging/batman-adv/proc.c
@@ -0,0 +1,950 @@
+/*
+ * Copyright (C) 2007-2009 B.A.T.M.A.N. contributors:
+ *
+ * Marek Lindner, Simon Wunderlich
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA
+ *
+ */
+
+#include "main.h"
+#include "proc.h"
+#include "log.h"
+#include "routing.h"
+#include "translation-table.h"
+#include "hard-interface.h"
+#include "types.h"
+#include "hash.h"
+#include "vis.h"
+#include "compat.h"
+
+static uint8_t vis_format = DOT_DRAW;
+
+static struct proc_dir_entry *proc_batman_dir, *proc_interface_file;
+static struct proc_dir_entry *proc_orig_interval_file, *proc_originators_file;
+static struct proc_dir_entry *proc_log_file, *proc_log_level_file;
+static struct proc_dir_entry *proc_transt_local_file;
+static struct proc_dir_entry *proc_transt_global_file;
+static struct proc_dir_entry *proc_vis_file, *proc_vis_format_file;
+static struct proc_dir_entry *proc_aggr_file;
+
+static int proc_interfaces_read(struct seq_file *seq, void *offset)
+{
+	struct batman_if *batman_if;
+
+	rcu_read_lock();
+	list_for_each_entry_rcu(batman_if, &if_list, list) {
+		seq_printf(seq, "[%8s] %s %s \n",
+			   (batman_if->if_active == IF_ACTIVE ?
+			    "active" : "inactive"),
+			   batman_if->dev,
+			   (batman_if->if_active == IF_ACTIVE ?
+			    batman_if->addr_str : " "));
+	}
+	rcu_read_unlock();
+
+	return 0;
+}
+
+static int proc_interfaces_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, proc_interfaces_read, NULL);
+}
+
+static ssize_t proc_interfaces_write(struct file *instance,
+				     const char __user *userbuffer,
+				     size_t count, loff_t *data)
+{
+	char *if_string, *colon_ptr = NULL, *cr_ptr = NULL;
+	int not_copied = 0, if_num = 0;
+	struct batman_if *batman_if = NULL;
+
+	if_string = kmalloc(count, GFP_KERNEL);
+
+	if (!if_string)
+		return -ENOMEM;
+
+	if (count > IFNAMSIZ - 1) {
+		debug_log(LOG_TYPE_WARN,
+			  "Can't add interface: device name is too long\n");
+		goto end;
+	}
+
+	not_copied = copy_from_user(if_string, userbuffer, count);
+	if_string[count - not_copied - 1] = 0;
+
+	colon_ptr = strchr(if_string, ':');
+	if (colon_ptr)
+		*colon_ptr = 0;
+
+	if (!colon_ptr) {
+		cr_ptr = strchr(if_string, '\n');
+		if (cr_ptr)
+			*cr_ptr = 0;
+	}
+
+	if (strlen(if_string) == 0) {
+		shutdown_module();
+		num_ifs = 0;
+		goto end;
+	}
+
+	/* add interface */
+	rcu_read_lock();
+	list_for_each_entry_rcu(batman_if, &if_list, list) {
+		if (strncmp(batman_if->dev, if_string, count) == 0) {
+			debug_log(LOG_TYPE_WARN, "Given interface is already active: %s\n", if_string);
+			rcu_read_unlock();
+			goto end;
+
+		}
+
+		if_num++;
+	}
+	rcu_read_unlock();
+
+	hardif_add_interface(if_string, if_num);
+
+	if ((atomic_read(&module_state) == MODULE_INACTIVE) &&
+	    (hardif_get_active_if_num() > 0))
+		activate_module();
+
+	rcu_read_lock();
+	if (list_empty(&if_list)) {
+		rcu_read_unlock();
+		goto end;
+	}
+	rcu_read_unlock();
+
+	num_ifs = if_num + 1;
+	return count;
+
+end:
+	kfree(if_string);
+	return count;
+}
+
+static int proc_orig_interval_read(struct seq_file *seq, void *offset)
+{
+	seq_printf(seq, "%i\n", atomic_read(&originator_interval));
+
+	return 0;
+}
+
+static ssize_t proc_orig_interval_write(struct file *file,
+					const char __user *buffer,
+					size_t count, loff_t *ppos)
+{
+	char *interval_string;
+	int not_copied = 0;
+	unsigned long originator_interval_tmp;
+	int retval;
+
+	interval_string = kmalloc(count, GFP_KERNEL);
+
+	if (!interval_string)
+		return -ENOMEM;
+
+	not_copied = copy_from_user(interval_string, buffer, count);
+	interval_string[count - not_copied - 1] = 0;
+
+	retval = strict_strtoul(interval_string, 10, &originator_interval_tmp);
+	if (retval) {
+		debug_log(LOG_TYPE_WARN, "New originator interval invalid\n");
+		goto end;
+	}
+
+	if (originator_interval_tmp <= JITTER * 2) {
+		debug_log(LOG_TYPE_WARN,
+			  "New originator interval too small: %i (min: %i)\n",
+			  originator_interval_tmp, JITTER * 2);
+		goto end;
+	}
+
+	debug_log(LOG_TYPE_NOTICE,
+		  "Changing originator interval from: %i to: %i\n",
+		  atomic_read(&originator_interval), originator_interval_tmp);
+
+	atomic_set(&originator_interval, originator_interval_tmp);
+
+end:
+	kfree(interval_string);
+	return count;
+}
+
+static int proc_orig_interval_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, proc_orig_interval_read, NULL);
+}
+
+static int proc_originators_read(struct seq_file *seq, void *offset)
+{
+	struct hash_it_t *hashit = NULL;
+	struct orig_node *orig_node;
+	struct neigh_node *neigh_node;
+	int batman_count = 0;
+	char orig_str[ETH_STR_LEN], router_str[ETH_STR_LEN];
+
+	rcu_read_lock();
+	if (list_empty(&if_list)) {
+		rcu_read_unlock();
+		seq_printf(seq, "BATMAN disabled - please specify interfaces to enable it \n");
+		goto end;
+	}
+
+	if (((struct batman_if *)if_list.next)->if_active != IF_ACTIVE) {
+		rcu_read_unlock();
+		seq_printf(seq, "BATMAN disabled - primary interface not active \n");
+		goto end;
+	}
+
+	seq_printf(seq,
+		   "  %-14s (%s/%i) %17s [%10s]: %20s ... [B.A.T.M.A.N. adv %s%s, MainIF/MAC: %s/%s] \n",
+		   "Originator", "#", TQ_MAX_VALUE, "Nexthop", "outgoingIF",
+		   "Potential nexthops", SOURCE_VERSION, REVISION_VERSION_STR,
+		   ((struct batman_if *)if_list.next)->dev,
+		   ((struct batman_if *)if_list.next)->addr_str);
+
+	rcu_read_unlock();
+	spin_lock(&orig_hash_lock);
+
+	while (NULL != (hashit = hash_iterate(orig_hash, hashit))) {
+
+		orig_node = hashit->bucket->data;
+
+		if (!orig_node->router)
+			continue;
+
+		if (orig_node->router->tq_avg == 0)
+			continue;
+
+		batman_count++;
+
+		addr_to_string(orig_str, orig_node->orig);
+		addr_to_string(router_str, orig_node->router->addr);
+
+		seq_printf(seq, "%-17s  (%3i) %17s [%10s]:",
+			   orig_str, orig_node->router->tq_avg,
+			   router_str, orig_node->router->if_incoming->dev);
+
+		list_for_each_entry(neigh_node, &orig_node->neigh_list, list) {
+			addr_to_string(orig_str, neigh_node->addr);
+			seq_printf(seq, " %17s (%3i)",
+				   orig_str, neigh_node->tq_avg);
+		}
+
+		seq_printf(seq, "\n");
+
+	}
+
+	spin_unlock(&orig_hash_lock);
+
+	if (batman_count == 0)
+		seq_printf(seq, "No batman nodes in range ... \n");
+
+end:
+	return 0;
+}
+
+static int proc_originators_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, proc_originators_read, NULL);
+}
+
+static int proc_log_level_read(struct seq_file *seq, void *offset)
+{
+
+	seq_printf(seq, "[x] %s (%d)\n", LOG_TYPE_CRIT_NAME, LOG_TYPE_CRIT);
+	seq_printf(seq, "[%c] %s (%d)\n",
+		   (LOG_TYPE_WARN & log_level) ? 'x' : ' ',
+		   LOG_TYPE_WARN_NAME, LOG_TYPE_WARN);
+	seq_printf(seq, "[%c] %s (%d)\n",
+		   (LOG_TYPE_NOTICE & log_level) ? 'x' : ' ',
+		   LOG_TYPE_NOTICE_NAME, LOG_TYPE_NOTICE);
+	seq_printf(seq, "[%c] %s (%d)\n",
+		   (LOG_TYPE_BATMAN & log_level) ? 'x' : ' ',
+		   LOG_TYPE_BATMAN_NAME, LOG_TYPE_BATMAN);
+	seq_printf(seq, "[%c] %s (%d)\n",
+		   (LOG_TYPE_ROUTES & log_level) ? 'x' : ' ',
+		   LOG_TYPE_ROUTES_NAME, LOG_TYPE_ROUTES);
+	return 0;
+}
+
+static int proc_log_level_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, proc_log_level_read, NULL);
+}
+
+static ssize_t proc_log_level_write(struct file *instance,
+				    const char __user *userbuffer,
+				    size_t count, loff_t *data)
+{
+	char *log_level_string, *tokptr, *cp;
+	int finished, not_copied = 0;
+	unsigned long log_level_tmp = 0;
+
+	log_level_string = kmalloc(count, GFP_KERNEL);
+
+	if (!log_level_string)
+		return -ENOMEM;
+
+	not_copied = copy_from_user(log_level_string, userbuffer, count);
+	log_level_string[count - not_copied - 1] = 0;
+
+	if (strict_strtoul(log_level_string, 10, &log_level_tmp) < 0) {
+		/* was not a number, doing textual parsing */
+		log_level_tmp = 0;
+		tokptr = log_level_string;
+
+		for (cp = log_level_string, finished = 0; !finished; cp++) {
+			switch (*cp) {
+			case 0:
+				finished = 1;
+			case ' ':
+			case '\n':
+			case '\t':
+				*cp = 0;
+				/* compare */
+				if (strcmp(tokptr, LOG_TYPE_WARN_NAME) == 0)
+					log_level_tmp |= LOG_TYPE_WARN;
+				if (strcmp(tokptr, LOG_TYPE_NOTICE_NAME) == 0)
+					log_level_tmp |= LOG_TYPE_NOTICE;
+				if (strcmp(tokptr, LOG_TYPE_BATMAN_NAME) == 0)
+					log_level_tmp |= LOG_TYPE_BATMAN;
+				if (strcmp(tokptr, LOG_TYPE_ROUTES_NAME) == 0)
+					log_level_tmp |= LOG_TYPE_ROUTES;
+				tokptr = cp + 1;
+				break;
+			default:
+				;
+			}
+		}
+	}
+
+	debug_log(LOG_TYPE_CRIT, "Changing log_level from: %i to: %i\n",
+		  log_level, log_level_tmp);
+	log_level = log_level_tmp;
+
+	kfree(log_level_string);
+	return count;
+}
+
+static int proc_transt_local_read(struct seq_file *seq, void *offset)
+{
+	char *buf;
+
+	buf = kmalloc(4096, GFP_KERNEL);
+	if (!buf)
+		return 0;
+
+	rcu_read_lock();
+	if (list_empty(&if_list)) {
+		rcu_read_unlock();
+		seq_printf(seq, "BATMAN disabled - please specify interfaces to enable it \n");
+		goto end;
+	}
+
+	rcu_read_unlock();
+
+	seq_printf(seq, "Locally retrieved addresses (from %s) announced via HNA:\n", soft_device->name);
+
+	hna_local_fill_buffer_text(buf, 4096);
+	seq_printf(seq, "%s", buf);
+
+end:
+	kfree(buf);
+	return 0;
+}
+
+static int proc_transt_local_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, proc_transt_local_read, NULL);
+}
+
+static int proc_transt_global_read(struct seq_file *seq, void *offset)
+{
+	char *buf;
+
+	buf = kmalloc(4096, GFP_KERNEL);
+	if (!buf)
+		return 0;
+
+	rcu_read_lock();
+	if (list_empty(&if_list)) {
+		rcu_read_unlock();
+		seq_printf(seq, "BATMAN disabled - please specify interfaces to enable it \n");
+		goto end;
+	}
+	rcu_read_unlock();
+
+
+	seq_printf(seq, "Globally announced HNAs received via the mesh (translation table):\n");
+
+	hna_global_fill_buffer_text(buf, 4096);
+	seq_printf(seq, "%s", buf);
+
+end:
+	kfree(buf);
+	return 0;
+}
+
+static int proc_transt_global_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, proc_transt_global_read, NULL);
+}
+
+/* insert interface to the list of interfaces of one originator */
+
+static void proc_vis_insert_interface(const uint8_t *interface,
+				      struct vis_if_list **if_entry,
+				      bool primary)
+{
+	/* Did we get an empty list? (then insert imediately) */
+	if(*if_entry == NULL) {
+		*if_entry = kmalloc(sizeof(struct vis_if_list), GFP_KERNEL);
+		if (*if_entry == NULL)
+			return;
+
+		(*if_entry)->primary = primary;
+		(*if_entry)->next = NULL;
+		memcpy((*if_entry)->addr, interface, ETH_ALEN);
+	} else {
+		struct vis_if_list *head_if_entry = *if_entry;
+		/* Do we already have this interface in our list? */
+		while (!compare_orig((*if_entry)->addr, (void *)interface)) {
+
+			/* Or did we reach the end (then append the interface) */
+			if ((*if_entry)->next == NULL) {
+				(*if_entry)->next = kmalloc(sizeof(struct vis_if_list), GFP_KERNEL);
+				if ((*if_entry)->next == NULL)
+					return;
+
+				memcpy((*if_entry)->next->addr, interface, ETH_ALEN);
+				(*if_entry)->next->primary = primary;
+				(*if_entry)->next->next = NULL;
+				break;
+			}
+			*if_entry = (*if_entry)->next;
+		}
+		/* Rewind the list to its head */
+		*if_entry = head_if_entry;
+	}
+}
+/* read an entry  */
+
+static void proc_vis_read_entry(struct seq_file *seq,
+				struct vis_info_entry *entry,
+				struct vis_if_list **if_entry,
+				uint8_t *vis_orig,
+				uint8_t current_format,
+				uint8_t first_line)
+{
+	char from[40];
+	char to[40];
+	int int_part, frac_part;
+
+	addr_to_string(to, entry->dest);
+	if (entry->quality == 0) {
+#ifndef VIS_SUBCLUSTERS_DISABLED
+		proc_vis_insert_interface(vis_orig, if_entry, true);
+#endif /* VIS_SUBCLUSTERS_DISABLED */
+		addr_to_string(from, vis_orig);
+		if (current_format == DOT_DRAW) {
+			seq_printf(seq, "\t\"%s\" -> \"%s\" [label=\"HNA\"]\n",
+				   from, to);
+		} else {
+			seq_printf(seq,
+				   "%s\t{ router : \"%s\", gateway   : \"%s\", label : \"HNA\" }",
+				   (first_line ? "" : ",\n"), from, to);
+		}
+	} else {
+#ifndef VIS_SUBCLUSTERS_DISABLED
+		proc_vis_insert_interface(entry->src, if_entry, compare_orig(entry->src, vis_orig));
+#endif /* VIS_SUBCLUSTERS_DISABLED */
+		addr_to_string(from, entry->src);
+
+		/* kernel has no printf-support for %f? it'd be better to return
+		 * this in float. */
+
+		int_part = TQ_MAX_VALUE / entry->quality;
+		frac_part = 1000 * TQ_MAX_VALUE / entry->quality - int_part * 1000;
+
+		if (current_format == DOT_DRAW) {
+			seq_printf(seq,
+				   "\t\"%s\" -> \"%s\" [label=\"%d.%d\"]\n",
+				   from, to, int_part, frac_part);
+		} else {
+			seq_printf(seq,
+				   "%s\t{ router : \"%s\", neighbour : \"%s\", label : %d.%d }",
+				   (first_line ? "" : ",\n"), from, to, int_part, frac_part);
+		}
+	}
+}
+
+
+static int proc_vis_read(struct seq_file *seq, void *offset)
+{
+	struct hash_it_t *hashit = NULL;
+	struct vis_info *info;
+	struct vis_info_entry *entries;
+	struct vis_if_list *if_entries = NULL;
+	int i;
+	uint8_t current_format, first_line = 1;
+#ifndef VIS_SUBCLUSTERS_DISABLED
+	char tmp_addr_str[ETH_STR_LEN];
+	struct vis_if_list *tmp_if_next;
+#endif /* VIS_SUBCLUSTERS_DISABLED */
+
+	current_format = vis_format;
+
+	rcu_read_lock();
+	if (list_empty(&if_list) || (!is_vis_server())) {
+		rcu_read_unlock();
+		if (current_format == DOT_DRAW)
+			seq_printf(seq, "digraph {\n}\n");
+		goto end;
+	}
+
+	rcu_read_unlock();
+
+	if (current_format == DOT_DRAW)
+		seq_printf(seq, "digraph {\n");
+
+	spin_lock(&vis_hash_lock);
+	while (NULL != (hashit = hash_iterate(vis_hash, hashit))) {
+		info = hashit->bucket->data;
+		entries = (struct vis_info_entry *)
+			((char *)info + sizeof(struct vis_info));
+
+		for (i = 0; i < info->packet.entries; i++) {
+			proc_vis_read_entry(seq, &entries[i], &if_entries,
+					    info->packet.vis_orig,
+					    current_format, first_line);
+			if (first_line)
+				first_line = 0;
+		}
+
+#ifndef VIS_SUBCLUSTERS_DISABLED
+		/* Generate subgraphs from the collected items */
+		if (current_format == DOT_DRAW) {
+
+			addr_to_string(tmp_addr_str, info->packet.vis_orig);
+			seq_printf(seq, "\tsubgraph \"cluster_%s\" {\n", tmp_addr_str);
+			while (if_entries != NULL) {
+
+				addr_to_string(tmp_addr_str, if_entries->addr);
+				if (if_entries->primary)
+					seq_printf(seq, "\t\t\"%s\" [peripheries=2]\n", tmp_addr_str);
+				else
+					seq_printf(seq, "\t\t\"%s\"\n", tmp_addr_str);
+
+				/* ... and empty the list while doing this */
+				tmp_if_next = if_entries->next;
+				kfree(if_entries);
+				if_entries = tmp_if_next;
+			}
+			seq_printf(seq, "\t}\n");
+		}
+#endif /* VIS_SUBCLUSTERS_DISABLED */
+	}
+	spin_unlock(&vis_hash_lock);
+
+	if (current_format == DOT_DRAW)
+		seq_printf(seq, "}\n");
+	else
+		seq_printf(seq, "\n");
+end:
+	return 0;
+}
+
+/* setting the mode of the vis server by the user */
+static ssize_t proc_vis_write(struct file *file, const char __user * buffer,
+			      size_t count, loff_t *ppos)
+{
+	char *vis_mode_string;
+	int not_copied = 0;
+
+	vis_mode_string = kmalloc(count, GFP_KERNEL);
+
+	if (!vis_mode_string)
+		return -ENOMEM;
+
+	not_copied = copy_from_user(vis_mode_string, buffer, count);
+	vis_mode_string[count - not_copied - 1] = 0;
+
+	if (strcmp(vis_mode_string, "client") == 0) {
+		debug_log(LOG_TYPE_NOTICE, "Setting VIS mode to client\n");
+		vis_set_mode(VIS_TYPE_CLIENT_UPDATE);
+	} else if (strcmp(vis_mode_string, "server") == 0) {
+		debug_log(LOG_TYPE_NOTICE, "Setting VIS mode to server\n");
+		vis_set_mode(VIS_TYPE_SERVER_SYNC);
+	} else
+		debug_log(LOG_TYPE_WARN, "Unknown VIS mode: %s\n",
+			  vis_mode_string);
+
+	kfree(vis_mode_string);
+	return count;
+}
+
+static int proc_vis_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, proc_vis_read, NULL);
+}
+
+static int proc_vis_format_read(struct seq_file *seq, void *offset)
+{
+	uint8_t current_format = vis_format;
+
+	seq_printf(seq, "[%c] %s\n",
+		   (current_format == DOT_DRAW) ? 'x' : ' ',
+		   VIS_FORMAT_DD_NAME);
+	seq_printf(seq, "[%c] %s\n",
+		   (current_format == JSON) ? 'x' : ' ',
+		   VIS_FORMAT_JSON_NAME);
+	return 0;
+}
+
+static int proc_vis_format_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, proc_vis_format_read, NULL);
+}
+
+static ssize_t proc_vis_format_write(struct file *file,
+				     const char __user *buffer,
+				     size_t count, loff_t *ppos)
+{
+	char *vis_format_string;
+	int not_copied = 0;
+
+	vis_format_string = kmalloc(count, GFP_KERNEL);
+
+	if (!vis_format_string)
+		return -ENOMEM;
+
+	not_copied = copy_from_user(vis_format_string, buffer, count);
+	vis_format_string[count - not_copied - 1] = 0;
+
+	if (strcmp(vis_format_string, VIS_FORMAT_DD_NAME) == 0) {
+		debug_log(LOG_TYPE_NOTICE, "Setting VIS output format to: %s\n",
+			  VIS_FORMAT_DD_NAME);
+		vis_format = DOT_DRAW;
+	} else if (strcmp(vis_format_string, VIS_FORMAT_JSON_NAME) == 0) {
+		debug_log(LOG_TYPE_NOTICE, "Setting VIS output format to: %s\n",
+			  VIS_FORMAT_JSON_NAME);
+		vis_format = JSON;
+	} else
+		debug_log(LOG_TYPE_WARN, "Unknown VIS output format: %s\n",
+			  vis_format_string);
+
+	kfree(vis_format_string);
+	return count;
+}
+
+static int proc_aggr_read(struct seq_file *seq, void *offset)
+{
+	seq_printf(seq, "%i\n", atomic_read(&aggregation_enabled));
+
+	return 0;
+}
+
+static ssize_t proc_aggr_write(struct file *file, const char __user *buffer,
+			       size_t count, loff_t *ppos)
+{
+	char *aggr_string;
+	int not_copied = 0;
+	unsigned long aggregation_enabled_tmp;
+
+	aggr_string = kmalloc(count, GFP_KERNEL);
+
+	if (!aggr_string)
+		return -ENOMEM;
+
+	not_copied = copy_from_user(aggr_string, buffer, count);
+	aggr_string[count - not_copied - 1] = 0;
+
+	strict_strtoul(aggr_string, 10, &aggregation_enabled_tmp);
+
+	if ((aggregation_enabled_tmp != 0) && (aggregation_enabled_tmp != 1)) {
+		debug_log(LOG_TYPE_WARN, "Aggregation can only be enabled (1) or disabled (0), given value: %li\n", aggregation_enabled_tmp);
+		goto end;
+	}
+
+	debug_log(LOG_TYPE_NOTICE, "Changing aggregation from: %s (%i) to: %s (%li)\n",
+		  (atomic_read(&aggregation_enabled) == 1 ?
+		   "enabled" : "disabled"),
+		  atomic_read(&aggregation_enabled),
+		  (aggregation_enabled_tmp == 1 ? "enabled" : "disabled"),
+		  aggregation_enabled_tmp);
+
+	atomic_set(&aggregation_enabled, (unsigned)aggregation_enabled_tmp);
+end:
+	kfree(aggr_string);
+	return count;
+}
+
+static int proc_aggr_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, proc_aggr_read, NULL);
+}
+
+/* satisfying different prototypes ... */
+static ssize_t proc_dummy_write(struct file *file, const char __user *buffer,
+				size_t count, loff_t *ppos)
+{
+	return count;
+}
+
+static const struct file_operations proc_aggr_fops = {
+	.owner		= THIS_MODULE,
+	.open		= proc_aggr_open,
+	.read		= seq_read,
+	.write		= proc_aggr_write,
+	.llseek		= seq_lseek,
+	.release	= single_release,
+};
+
+static const struct file_operations proc_vis_format_fops = {
+	.owner		= THIS_MODULE,
+	.open		= proc_vis_format_open,
+	.read		= seq_read,
+	.write		= proc_vis_format_write,
+	.llseek		= seq_lseek,
+	.release	= single_release,
+};
+
+static const struct file_operations proc_vis_fops = {
+	.owner		= THIS_MODULE,
+	.open		= proc_vis_open,
+	.read		= seq_read,
+	.write		= proc_vis_write,
+	.llseek		= seq_lseek,
+	.release	= single_release,
+};
+
+static const struct file_operations proc_originators_fops = {
+	.owner		= THIS_MODULE,
+	.open		= proc_originators_open,
+	.read		= seq_read,
+	.write		= proc_dummy_write,
+	.llseek		= seq_lseek,
+	.release	= single_release,
+};
+
+static const struct file_operations proc_transt_local_fops = {
+	.owner		= THIS_MODULE,
+	.open		= proc_transt_local_open,
+	.read		= seq_read,
+	.write		= proc_dummy_write,
+	.llseek		= seq_lseek,
+	.release	= single_release,
+};
+
+static const struct file_operations proc_transt_global_fops = {
+	.owner		= THIS_MODULE,
+	.open		= proc_transt_global_open,
+	.read		= seq_read,
+	.write		= proc_dummy_write,
+	.llseek		= seq_lseek,
+	.release	= single_release,
+};
+
+static const struct file_operations proc_log_level_fops = {
+	.owner		= THIS_MODULE,
+	.open		= proc_log_level_open,
+	.read		= seq_read,
+	.write		= proc_log_level_write,
+	.llseek		= seq_lseek,
+	.release	= single_release,
+};
+
+static const struct file_operations proc_interfaces_fops = {
+	.owner		= THIS_MODULE,
+	.open		= proc_interfaces_open,
+	.read		= seq_read,
+	.write		= proc_interfaces_write,
+	.llseek		= seq_lseek,
+	.release	= single_release,
+};
+
+static const struct file_operations proc_orig_interval_fops = {
+	.owner		= THIS_MODULE,
+	.open		= proc_orig_interval_open,
+	.read		= seq_read,
+	.write		= proc_orig_interval_write,
+	.llseek		= seq_lseek,
+	.release	= single_release,
+};
+
+void cleanup_procfs(void)
+{
+	if (proc_transt_global_file)
+		remove_proc_entry(PROC_FILE_TRANST_GLOBAL, proc_batman_dir);
+
+	if (proc_transt_local_file)
+		remove_proc_entry(PROC_FILE_TRANST_LOCAL, proc_batman_dir);
+
+	if (proc_log_file)
+		remove_proc_entry(PROC_FILE_LOG, proc_batman_dir);
+
+	if (proc_log_level_file)
+		remove_proc_entry(PROC_FILE_LOG_LEVEL, proc_batman_dir);
+
+	if (proc_originators_file)
+		remove_proc_entry(PROC_FILE_ORIGINATORS, proc_batman_dir);
+
+	if (proc_orig_interval_file)
+		remove_proc_entry(PROC_FILE_ORIG_INTERVAL, proc_batman_dir);
+
+	if (proc_interface_file)
+		remove_proc_entry(PROC_FILE_INTERFACES, proc_batman_dir);
+
+	if (proc_vis_file)
+		remove_proc_entry(PROC_FILE_VIS, proc_batman_dir);
+
+	if (proc_vis_format_file)
+		remove_proc_entry(PROC_FILE_VIS_FORMAT, proc_batman_dir);
+
+	if (proc_aggr_file)
+		remove_proc_entry(PROC_FILE_AGGR, proc_batman_dir);
+
+	if (proc_batman_dir)
+#ifdef __NET_NET_NAMESPACE_H
+		remove_proc_entry(PROC_ROOT_DIR, init_net.proc_net);
+#else
+		remove_proc_entry(PROC_ROOT_DIR, proc_net);
+#endif
+}
+
+int setup_procfs(void)
+{
+#ifdef __NET_NET_NAMESPACE_H
+	proc_batman_dir = proc_mkdir(PROC_ROOT_DIR, init_net.proc_net);
+#else
+	proc_batman_dir = proc_mkdir(PROC_ROOT_DIR, proc_net);
+#endif
+
+	if (!proc_batman_dir) {
+		printk(KERN_ERR "batman-adv: Registering the '/proc/net/%s' folder failed\n", PROC_ROOT_DIR);
+		return -EFAULT;
+	}
+
+	proc_interface_file = create_proc_entry(PROC_FILE_INTERFACES,
+						S_IWUSR | S_IRUGO,
+						proc_batman_dir);
+	if (proc_interface_file) {
+		proc_interface_file->proc_fops = &proc_interfaces_fops;
+	} else {
+		printk(KERN_ERR "batman-adv: Registering the '/proc/net/%s/%s' file failed\n", PROC_ROOT_DIR, PROC_FILE_INTERFACES);
+		cleanup_procfs();
+		return -EFAULT;
+	}
+
+	proc_orig_interval_file = create_proc_entry(PROC_FILE_ORIG_INTERVAL,
+						    S_IWUSR | S_IRUGO,
+						    proc_batman_dir);
+	if (proc_orig_interval_file) {
+		proc_orig_interval_file->proc_fops = &proc_orig_interval_fops;
+	} else {
+		printk(KERN_ERR "batman-adv: Registering the '/proc/net/%s/%s' file failed\n", PROC_ROOT_DIR, PROC_FILE_ORIG_INTERVAL);
+		cleanup_procfs();
+		return -EFAULT;
+	}
+
+	proc_log_level_file = create_proc_entry(PROC_FILE_LOG_LEVEL,
+						S_IWUSR | S_IRUGO,
+						proc_batman_dir);
+	if (proc_log_level_file) {
+		proc_log_level_file->proc_fops = &proc_log_level_fops;
+	} else {
+		printk(KERN_ERR "batman-adv: Registering the '/proc/net/%s/%s' file failed\n", PROC_ROOT_DIR, PROC_FILE_LOG_LEVEL);
+		cleanup_procfs();
+		return -EFAULT;
+	}
+
+	proc_originators_file = create_proc_entry(PROC_FILE_ORIGINATORS,
+						  S_IRUGO, proc_batman_dir);
+	if (proc_originators_file) {
+		proc_originators_file->proc_fops = &proc_originators_fops;
+	} else {
+		printk(KERN_ERR "batman-adv: Registering the '/proc/net/%s/%s' file failed\n", PROC_ROOT_DIR, PROC_FILE_ORIGINATORS);
+		cleanup_procfs();
+		return -EFAULT;
+	}
+
+	proc_log_file = create_proc_entry(PROC_FILE_LOG,
+					  S_IRUGO, proc_batman_dir);
+	if (proc_log_file) {
+		proc_log_file->proc_fops = &proc_log_operations;
+	} else {
+		printk(KERN_ERR "batman-adv: Registering the '/proc/net/%s/%s' file failed\n", PROC_FILE_LOG, PROC_FILE_GATEWAYS);
+		cleanup_procfs();
+		return -EFAULT;
+	}
+
+	proc_transt_local_file = create_proc_entry(PROC_FILE_TRANST_LOCAL,
+						   S_IRUGO, proc_batman_dir);
+	if (proc_transt_local_file) {
+		proc_transt_local_file->proc_fops = &proc_transt_local_fops;
+	} else {
+		printk(KERN_ERR "batman-adv: Registering the '/proc/net/%s/%s' file failed\n", PROC_ROOT_DIR, PROC_FILE_TRANST_LOCAL);
+		cleanup_procfs();
+		return -EFAULT;
+	}
+
+	proc_transt_global_file = create_proc_entry(PROC_FILE_TRANST_GLOBAL,
+						    S_IRUGO, proc_batman_dir);
+	if (proc_transt_global_file) {
+		proc_transt_global_file->proc_fops = &proc_transt_global_fops;
+	} else {
+		printk(KERN_ERR "batman-adv: Registering the '/proc/net/%s/%s' file failed\n", PROC_ROOT_DIR, PROC_FILE_TRANST_GLOBAL);
+		cleanup_procfs();
+		return -EFAULT;
+	}
+
+	proc_vis_file = create_proc_entry(PROC_FILE_VIS, S_IWUSR | S_IRUGO,
+					  proc_batman_dir);
+	if (proc_vis_file) {
+		proc_vis_file->proc_fops = &proc_vis_fops;
+	} else {
+		printk(KERN_ERR "batman-adv: Registering the '/proc/net/%s/%s' file failed\n", PROC_ROOT_DIR, PROC_FILE_VIS);
+		cleanup_procfs();
+		return -EFAULT;
+	}
+
+	proc_vis_format_file = create_proc_entry(PROC_FILE_VIS_FORMAT,
+						 S_IWUSR | S_IRUGO,
+						 proc_batman_dir);
+	if (proc_vis_format_file) {
+		proc_vis_format_file->proc_fops = &proc_vis_format_fops;
+	} else {
+		printk(KERN_ERR "batman-adv: Registering the '/proc/net/%s/%s' file failed\n", PROC_ROOT_DIR, PROC_FILE_VIS_FORMAT);
+		cleanup_procfs();
+		return -EFAULT;
+	}
+
+	proc_aggr_file = create_proc_entry(PROC_FILE_AGGR, S_IWUSR | S_IRUGO,
+					   proc_batman_dir);
+	if (proc_aggr_file) {
+		proc_aggr_file->proc_fops = &proc_aggr_fops;
+	} else {
+		printk(KERN_ERR "batman-adv: Registering the '/proc/net/%s/%s' file failed\n", PROC_ROOT_DIR, PROC_FILE_AGGR);
+		cleanup_procfs();
+		return -EFAULT;
+	}
+
+	return 0;
+}
+
+
diff --git a/drivers/staging/batman-adv/proc.h b/drivers/staging/batman-adv/proc.h
new file mode 100644
index 000000000000..16d3efdebe52
--- /dev/null
+++ b/drivers/staging/batman-adv/proc.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2007-2009 B.A.T.M.A.N. contributors:
+ *
+ * Marek Lindner, Simon Wunderlich
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA
+ *
+ */
+
+#include <linux/proc_fs.h>
+#include <linux/seq_file.h>
+
+#define PROC_ROOT_DIR "batman-adv"
+#define PROC_FILE_INTERFACES "interfaces"
+#define PROC_FILE_ORIG_INTERVAL "orig_interval"
+#define PROC_FILE_ORIGINATORS "originators"
+#define PROC_FILE_GATEWAYS "gateways"
+#define PROC_FILE_LOG "log"
+#define PROC_FILE_LOG_LEVEL "log_level"
+#define PROC_FILE_TRANST_LOCAL "transtable_local"
+#define PROC_FILE_TRANST_GLOBAL "transtable_global"
+#define PROC_FILE_VIS "vis"
+#define PROC_FILE_VIS_FORMAT "vis_format"
+#define PROC_FILE_AGGR "aggregate_ogm"
+
+void cleanup_procfs(void);
+int setup_procfs(void);
+
+/* While scanning for vis-entries of a particular vis-originator
+ * this list collects its interfaces to create a subgraph/cluster
+ * out of them later
+ */
+struct vis_if_list {
+	uint8_t addr[ETH_ALEN];
+	bool primary;
+	struct vis_if_list *next;
+};
diff --git a/drivers/staging/batman-adv/ring_buffer.c b/drivers/staging/batman-adv/ring_buffer.c
new file mode 100644
index 000000000000..751c899f54c5
--- /dev/null
+++ b/drivers/staging/batman-adv/ring_buffer.c
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2007-2009 B.A.T.M.A.N. contributors:
+ *
+ * Marek Lindner
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA
+ *
+ */
+
+#include "main.h"
+#include "ring_buffer.h"
+
+void ring_buffer_set(uint8_t lq_recv[], uint8_t *lq_index, uint8_t value)
+{
+	lq_recv[*lq_index] = value;
+	*lq_index = (*lq_index + 1) % TQ_GLOBAL_WINDOW_SIZE;
+}
+
+uint8_t ring_buffer_avg(uint8_t lq_recv[])
+{
+	uint8_t *ptr;
+	uint16_t count = 0, i = 0, sum = 0;
+
+	ptr = lq_recv;
+
+	while (i < TQ_GLOBAL_WINDOW_SIZE) {
+		if (*ptr != 0) {
+			count++;
+			sum += *ptr;
+		}
+
+		i++;
+		ptr++;
+	}
+
+	if (count == 0)
+		return 0;
+
+	return (uint8_t)(sum / count);
+}
diff --git a/drivers/staging/batman-adv/ring_buffer.h b/drivers/staging/batman-adv/ring_buffer.h
new file mode 100644
index 000000000000..6839ba97eeb3
--- /dev/null
+++ b/drivers/staging/batman-adv/ring_buffer.h
@@ -0,0 +1,23 @@
+/*
+ * Copyright (C) 2007-2009 B.A.T.M.A.N. contributors:
+ *
+ * Marek Lindner
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA
+ *
+ */
+
+void ring_buffer_set(uint8_t lq_recv[], uint8_t *lq_index, uint8_t value);
+uint8_t ring_buffer_avg(uint8_t lq_recv[]);
diff --git a/drivers/staging/batman-adv/routing.c b/drivers/staging/batman-adv/routing.c
new file mode 100644
index 000000000000..4a14c363ac2b
--- /dev/null
+++ b/drivers/staging/batman-adv/routing.c
@@ -0,0 +1,1010 @@
+/*
+ * Copyright (C) 2007-2009 B.A.T.M.A.N. contributors:
+ *
+ * Marek Lindner, Simon Wunderlich
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA
+ *
+ */
+
+
+
+
+
+#include "main.h"
+#include "routing.h"
+#include "log.h"
+#include "send.h"
+#include "soft-interface.h"
+#include "hard-interface.h"
+#include "device.h"
+#include "translation-table.h"
+#include "types.h"
+#include "hash.h"
+#include "ring_buffer.h"
+#include "vis.h"
+#include "aggregation.h"
+#include "compat.h"
+
+
+
+DECLARE_WAIT_QUEUE_HEAD(thread_wait);
+static DECLARE_DELAYED_WORK(purge_orig_wq, purge_orig);
+
+static atomic_t data_ready_cond;
+atomic_t exit_cond;
+
+static void start_purge_timer(void)
+{
+	queue_delayed_work(bat_event_workqueue, &purge_orig_wq, 1 * HZ);
+}
+
+int originator_init(void)
+{
+	if (orig_hash)
+		return 1;
+
+	spin_lock(&orig_hash_lock);
+	orig_hash = hash_new(128, compare_orig, choose_orig);
+
+	if (!orig_hash)
+		goto err;
+
+	spin_unlock(&orig_hash_lock);
+	start_purge_timer();
+	return 1;
+
+err:
+	spin_unlock(&orig_hash_lock);
+	return 0;
+}
+
+void originator_free(void)
+{
+	if (!orig_hash)
+		return;
+
+	cancel_delayed_work_sync(&purge_orig_wq);
+
+	spin_lock(&orig_hash_lock);
+	hash_delete(orig_hash, free_orig_node);
+	orig_hash = NULL;
+	spin_unlock(&orig_hash_lock);
+}
+
+static struct neigh_node *create_neighbor(struct orig_node *orig_node, struct orig_node *orig_neigh_node, uint8_t *neigh, struct batman_if *if_incoming)
+{
+	struct neigh_node *neigh_node;
+
+	debug_log(LOG_TYPE_BATMAN, "Creating new last-hop neighbour of originator\n");
+
+	neigh_node = kmalloc(sizeof(struct neigh_node), GFP_ATOMIC);
+	memset(neigh_node, 0, sizeof(struct neigh_node));
+	INIT_LIST_HEAD(&neigh_node->list);
+
+	memcpy(neigh_node->addr, neigh, ETH_ALEN);
+	neigh_node->orig_node = orig_neigh_node;
+	neigh_node->if_incoming = if_incoming;
+
+	list_add_tail(&neigh_node->list, &orig_node->neigh_list);
+	return neigh_node;
+}
+
+void free_orig_node(void *data)
+{
+	struct list_head *list_pos, *list_pos_tmp;
+	struct neigh_node *neigh_node;
+	struct orig_node *orig_node = (struct orig_node *)data;
+
+	/* for all neighbours towards this originator ... */
+	list_for_each_safe(list_pos, list_pos_tmp, &orig_node->neigh_list) {
+		neigh_node = list_entry(list_pos, struct neigh_node, list);
+
+		list_del(list_pos);
+		kfree(neigh_node);
+	}
+
+	hna_global_del_orig(orig_node, "originator timed out");
+
+	kfree(orig_node->bcast_own);
+	kfree(orig_node->bcast_own_sum);
+	kfree(orig_node);
+}
+
+/* this function finds or creates an originator entry for the given address if it does not exits */
+static struct orig_node *get_orig_node(uint8_t *addr)
+{
+	struct orig_node *orig_node;
+	struct hashtable_t *swaphash;
+	char orig_str[ETH_STR_LEN];
+
+	orig_node = ((struct orig_node *)hash_find(orig_hash, addr));
+
+	if (orig_node != NULL)
+		return orig_node;
+
+	addr_to_string(orig_str, addr);
+	debug_log(LOG_TYPE_BATMAN, "Creating new originator: %s \n", orig_str);
+
+	orig_node = kmalloc(sizeof(struct orig_node), GFP_ATOMIC);
+	memset(orig_node, 0, sizeof(struct orig_node));
+	INIT_LIST_HEAD(&orig_node->neigh_list);
+
+	memcpy(orig_node->orig, addr, ETH_ALEN);
+	orig_node->router = NULL;
+	orig_node->batman_if = NULL;
+	orig_node->hna_buff = NULL;
+
+	orig_node->bcast_own = kmalloc(num_ifs * sizeof(TYPE_OF_WORD) * NUM_WORDS, GFP_ATOMIC);
+	memset(orig_node->bcast_own, 0, num_ifs * sizeof(TYPE_OF_WORD) * NUM_WORDS);
+
+	orig_node->bcast_own_sum = kmalloc(num_ifs * sizeof(uint8_t), GFP_ATOMIC);
+	memset(orig_node->bcast_own_sum, 0, num_ifs * sizeof(uint8_t));
+
+	hash_add(orig_hash, orig_node);
+
+	if (orig_hash->elements * 4 > orig_hash->size) {
+		swaphash = hash_resize(orig_hash, orig_hash->size * 2);
+
+		if (swaphash == NULL)
+			debug_log(LOG_TYPE_CRIT, "Couldn't resize orig hash table \n");
+		else
+			orig_hash = swaphash;
+	}
+
+	return orig_node;
+}
+
+void slide_own_bcast_window(struct batman_if *batman_if)
+{
+	struct hash_it_t *hashit = NULL;
+	struct orig_node *orig_node;
+
+	spin_lock(&orig_hash_lock);
+
+	while (NULL != (hashit = hash_iterate(orig_hash, hashit))) {
+		orig_node = hashit->bucket->data;
+
+		bit_get_packet((TYPE_OF_WORD *)&(orig_node->bcast_own[batman_if->if_num * NUM_WORDS]), 1, 0);
+		orig_node->bcast_own_sum[batman_if->if_num] = bit_packet_count((TYPE_OF_WORD *)&(orig_node->bcast_own[batman_if->if_num * NUM_WORDS]));
+	}
+
+	spin_unlock(&orig_hash_lock);
+}
+
+static void update_routes(struct orig_node *orig_node, struct neigh_node *neigh_node, unsigned char *hna_buff, int hna_buff_len)
+{
+	char orig_str[ETH_STR_LEN], neigh_str[ETH_STR_LEN], router_str[ETH_STR_LEN];
+
+	if (orig_node == NULL)
+		return;
+
+	if (orig_node->router != neigh_node) {
+		addr_to_string(orig_str, orig_node->orig);
+
+		/* route deleted */
+		if ((orig_node->router != NULL) && (neigh_node == NULL)) {
+
+			debug_log(LOG_TYPE_ROUTES, "Deleting route towards: %s\n", orig_str);
+			hna_global_del_orig(orig_node, "originator timed out");
+
+		/* route added */
+		} else if ((orig_node->router == NULL) && (neigh_node != NULL)) {
+
+			addr_to_string(neigh_str, neigh_node->addr);
+			debug_log(LOG_TYPE_ROUTES, "Adding route towards: %s (via %s)\n", orig_str, neigh_str);
+			hna_global_add_orig(orig_node, hna_buff, hna_buff_len);
+
+		/* route changed */
+		} else {
+
+			addr_to_string(neigh_str, neigh_node->addr);
+			addr_to_string(router_str, orig_node->router->addr);
+			debug_log(LOG_TYPE_ROUTES, "Changing route towards: %s (now via %s - was via %s)\n", orig_str, neigh_str, router_str);
+
+		}
+
+		if (neigh_node != NULL)
+			orig_node->batman_if = neigh_node->if_incoming;
+		else
+			orig_node->batman_if = NULL;
+
+		orig_node->router = neigh_node;
+
+	/* may be just HNA changed */
+	} else {
+
+		if ((hna_buff_len != orig_node->hna_buff_len) || ((hna_buff_len > 0) && (orig_node->hna_buff_len > 0) && (memcmp(orig_node->hna_buff, hna_buff, hna_buff_len) != 0))) {
+
+			if (orig_node->hna_buff_len > 0)
+				hna_global_del_orig(orig_node, "originator changed hna");
+
+			if ((hna_buff_len > 0) && (hna_buff != NULL))
+				hna_global_add_orig(orig_node, hna_buff, hna_buff_len);
+
+		}
+
+	}
+}
+
+static int isBidirectionalNeigh(struct orig_node *orig_node, struct orig_node *orig_neigh_node, struct batman_packet *batman_packet, struct batman_if *if_incoming)
+{
+	struct neigh_node *neigh_node = NULL, *tmp_neigh_node = NULL;
+	char orig_str[ETH_STR_LEN], neigh_str[ETH_STR_LEN];
+	unsigned char total_count;
+
+	addr_to_string(orig_str, orig_node->orig);
+	addr_to_string(neigh_str, orig_neigh_node->orig);
+
+	if (orig_node == orig_neigh_node) {
+		list_for_each_entry(tmp_neigh_node, &orig_node->neigh_list, list) {
+
+			if (compare_orig(tmp_neigh_node->addr, orig_neigh_node->orig) && (tmp_neigh_node->if_incoming == if_incoming))
+				neigh_node = tmp_neigh_node;
+		}
+
+		if (neigh_node == NULL)
+			neigh_node = create_neighbor(orig_node, orig_neigh_node, orig_neigh_node->orig, if_incoming);
+
+		neigh_node->last_valid = jiffies;
+	} else {
+		/* find packet count of corresponding one hop neighbor */
+		list_for_each_entry(tmp_neigh_node, &orig_neigh_node->neigh_list, list) {
+
+			if (compare_orig(tmp_neigh_node->addr, orig_neigh_node->orig) && (tmp_neigh_node->if_incoming == if_incoming))
+				neigh_node = tmp_neigh_node;
+		}
+
+		if (neigh_node == NULL)
+			neigh_node = create_neighbor(orig_neigh_node, orig_neigh_node, orig_neigh_node->orig, if_incoming);
+	}
+
+	orig_node->last_valid = jiffies;
+
+	/* pay attention to not get a value bigger than 100 % */
+	total_count = (orig_neigh_node->bcast_own_sum[if_incoming->if_num] > neigh_node->real_packet_count ? neigh_node->real_packet_count : orig_neigh_node->bcast_own_sum[if_incoming->if_num]);
+
+	/* if we have too few packets (too less data) we set tq_own to zero */
+	/* if we receive too few packets it is not considered bidirectional */
+	if ((total_count < TQ_LOCAL_BIDRECT_SEND_MINIMUM) || (neigh_node->real_packet_count < TQ_LOCAL_BIDRECT_RECV_MINIMUM))
+		orig_neigh_node->tq_own = 0;
+	else
+		/* neigh_node->real_packet_count is never zero as we only purge old information when getting new information */
+		orig_neigh_node->tq_own = (TQ_MAX_VALUE * total_count) / neigh_node->real_packet_count;
+
+	/*
+	 * 1 - ((1-x) ** 3), normalized to TQ_MAX_VALUE
+	 * this does affect the nearly-symmetric links only a little,
+	 * but punishes asymmetric links more.
+	 * this will give a value between 0 and TQ_MAX_VALUE
+	 */
+	orig_neigh_node->tq_asym_penalty = TQ_MAX_VALUE - (TQ_MAX_VALUE *
+			(TQ_LOCAL_WINDOW_SIZE - neigh_node->real_packet_count) *
+			(TQ_LOCAL_WINDOW_SIZE - neigh_node->real_packet_count) *
+			(TQ_LOCAL_WINDOW_SIZE - neigh_node->real_packet_count)) /
+			(TQ_LOCAL_WINDOW_SIZE * TQ_LOCAL_WINDOW_SIZE * TQ_LOCAL_WINDOW_SIZE);
+
+	batman_packet->tq = ((batman_packet->tq * orig_neigh_node->tq_own * orig_neigh_node->tq_asym_penalty) / (TQ_MAX_VALUE *  TQ_MAX_VALUE));
+
+	debug_log(LOG_TYPE_BATMAN, "bidirectional: orig = %-15s neigh = %-15s => own_bcast = %2i, real recv = %2i, local tq: %3i, asym_penalty: %3i, total tq: %3i \n",
+		  orig_str, neigh_str, total_count, neigh_node->real_packet_count, orig_neigh_node->tq_own, orig_neigh_node->tq_asym_penalty, batman_packet->tq);
+
+	/* if link has the minimum required transmission quality consider it bidirectional */
+	if (batman_packet->tq >= TQ_TOTAL_BIDRECT_LIMIT)
+		return 1;
+
+	return 0;
+}
+
+static void update_orig(struct orig_node *orig_node, struct ethhdr *ethhdr, struct batman_packet *batman_packet, struct batman_if *if_incoming, unsigned char *hna_buff, int hna_buff_len, char is_duplicate)
+{
+	struct neigh_node *neigh_node = NULL, *tmp_neigh_node = NULL;
+	int tmp_hna_buff_len;
+
+	debug_log(LOG_TYPE_BATMAN, "update_originator(): Searching and updating originator entry of received packet \n");
+
+	list_for_each_entry(tmp_neigh_node, &orig_node->neigh_list, list) {
+		if (compare_orig(tmp_neigh_node->addr, ethhdr->h_source) && (tmp_neigh_node->if_incoming == if_incoming)) {
+			neigh_node = tmp_neigh_node;
+			continue;
+		}
+
+		if (is_duplicate)
+			continue;
+
+		ring_buffer_set(tmp_neigh_node->tq_recv, &tmp_neigh_node->tq_index, 0);
+		tmp_neigh_node->tq_avg = ring_buffer_avg(tmp_neigh_node->tq_recv);
+	}
+
+	if (neigh_node == NULL)
+		neigh_node = create_neighbor(orig_node, get_orig_node(ethhdr->h_source), ethhdr->h_source, if_incoming);
+	else
+		debug_log(LOG_TYPE_BATMAN, "Updating existing last-hop neighbour of originator\n");
+
+	orig_node->flags = batman_packet->flags;
+	neigh_node->last_valid = jiffies;
+
+	ring_buffer_set(neigh_node->tq_recv, &neigh_node->tq_index, batman_packet->tq);
+	neigh_node->tq_avg = ring_buffer_avg(neigh_node->tq_recv);
+
+	if (!is_duplicate) {
+		orig_node->last_ttl = batman_packet->ttl;
+		neigh_node->last_ttl = batman_packet->ttl;
+	}
+
+	tmp_hna_buff_len = (hna_buff_len > batman_packet->num_hna * ETH_ALEN ? batman_packet->num_hna * ETH_ALEN : hna_buff_len);
+
+	/* if this neighbor already is our next hop there is nothing to change */
+	if (orig_node->router == neigh_node)
+		goto update_hna;
+
+	/* if this neighbor does not offer a better TQ we won't consider it */
+	if ((orig_node->router) &&
+	    (orig_node->router->tq_avg > neigh_node->tq_avg))
+		goto update_hna;
+
+	/* if the TQ is the same and the link not more symetric we won't consider it either */
+	if ((orig_node->router) &&
+	     ((neigh_node->tq_avg == orig_node->router->tq_avg) &&
+	     (orig_node->router->orig_node->bcast_own_sum[if_incoming->if_num] >=
+	      neigh_node->orig_node->bcast_own_sum[if_incoming->if_num])))
+		goto update_hna;
+
+	update_routes(orig_node, neigh_node, hna_buff, tmp_hna_buff_len);
+	return;
+
+update_hna:
+	update_routes(orig_node, orig_node->router, hna_buff, tmp_hna_buff_len);
+	return;
+}
+
+static char count_real_packets(struct ethhdr *ethhdr, struct batman_packet *batman_packet, struct batman_if *if_incoming)
+{
+	struct orig_node *orig_node;
+	struct neigh_node *tmp_neigh_node;
+	char is_duplicate = 0;
+
+
+	orig_node = get_orig_node(batman_packet->orig);
+	if (orig_node == NULL)
+		return 0;
+
+
+	list_for_each_entry(tmp_neigh_node, &orig_node->neigh_list, list) {
+
+		if (!is_duplicate)
+			is_duplicate = get_bit_status(tmp_neigh_node->real_bits, orig_node->last_real_seqno, batman_packet->seqno);
+
+		if (compare_orig(tmp_neigh_node->addr, ethhdr->h_source) && (tmp_neigh_node->if_incoming == if_incoming))
+			bit_get_packet(tmp_neigh_node->real_bits, batman_packet->seqno - orig_node->last_real_seqno, 1);
+		else
+			bit_get_packet(tmp_neigh_node->real_bits, batman_packet->seqno - orig_node->last_real_seqno, 0);
+
+		tmp_neigh_node->real_packet_count = bit_packet_count(tmp_neigh_node->real_bits);
+	}
+
+	if (!is_duplicate) {
+		debug_log(LOG_TYPE_BATMAN, "updating last_seqno: old %d, new %d \n", orig_node->last_real_seqno, batman_packet->seqno);
+		orig_node->last_real_seqno = batman_packet->seqno;
+	}
+
+	return is_duplicate;
+}
+
+void receive_bat_packet(struct ethhdr *ethhdr, struct batman_packet *batman_packet, unsigned char *hna_buff, int hna_buff_len, struct batman_if *if_incoming)
+{
+	struct batman_if *batman_if;
+	struct orig_node *orig_neigh_node, *orig_node;
+	char orig_str[ETH_STR_LEN], prev_sender_str[ETH_STR_LEN], neigh_str[ETH_STR_LEN];
+	char has_directlink_flag;
+	char is_my_addr = 0, is_my_orig = 0, is_my_oldorig = 0, is_broadcast = 0, is_bidirectional, is_single_hop_neigh, is_duplicate;
+	unsigned short if_incoming_seqno;
+
+	/* Silently drop when the batman packet is actually not a correct packet.
+	 *
+	 * This might happen if a packet is padded (e.g. Ethernet has a
+	 * minimum frame length of 64 byte) and the aggregation interprets
+	 * it as an additional length.
+	 *
+	 * TODO: A more sane solution would be to have a bit in the batman_packet
+	 * to detect whether the packet is the last packet in an aggregation.
+	 * Here we expect that the padding is always zero (or not 0x01)
+	 */
+	if (batman_packet->packet_type != BAT_PACKET)
+		return;
+
+	/* could be changed by schedule_own_packet() */
+	if_incoming_seqno = atomic_read(&if_incoming->seqno);
+
+	addr_to_string(orig_str, batman_packet->orig);
+	addr_to_string(prev_sender_str, batman_packet->prev_sender);
+	addr_to_string(neigh_str, ethhdr->h_source);
+
+	has_directlink_flag = (batman_packet->flags & DIRECTLINK ? 1 : 0);
+
+	is_single_hop_neigh = (compare_orig(ethhdr->h_source, batman_packet->orig) ? 1 : 0);
+
+	debug_log(LOG_TYPE_BATMAN, "Received BATMAN packet via NB: %s, IF: %s [%s] (from OG: %s, via prev OG: %s, seqno %d, tq %d, TTL %d, V %d, IDF %d) \n", neigh_str, if_incoming->dev, if_incoming->addr_str, orig_str, prev_sender_str, batman_packet->seqno, batman_packet->tq, batman_packet->ttl, batman_packet->version, has_directlink_flag);
+
+	list_for_each_entry_rcu(batman_if, &if_list, list) {
+		if (batman_if->if_active != IF_ACTIVE)
+			continue;
+
+		if (compare_orig(ethhdr->h_source, batman_if->net_dev->dev_addr))
+			is_my_addr = 1;
+
+		if (compare_orig(batman_packet->orig, batman_if->net_dev->dev_addr))
+			is_my_orig = 1;
+
+		if (compare_orig(batman_packet->prev_sender, batman_if->net_dev->dev_addr))
+			is_my_oldorig = 1;
+
+		if (compare_orig(ethhdr->h_source, broadcastAddr))
+			is_broadcast = 1;
+	}
+
+	if (batman_packet->version != COMPAT_VERSION) {
+		debug_log(LOG_TYPE_BATMAN, "Drop packet: incompatible batman version (%i) \n", batman_packet->version);
+		return;
+	}
+
+	if (is_my_addr) {
+		debug_log(LOG_TYPE_BATMAN, "Drop packet: received my own broadcast (sender: %s) \n", neigh_str);
+		return;
+	}
+
+	if (is_broadcast) {
+		debug_log(LOG_TYPE_BATMAN, "Drop packet: ignoring all packets with broadcast source addr (sender: %s) \n", neigh_str);
+		return;
+	}
+
+	if (is_my_orig) {
+		orig_neigh_node = get_orig_node(ethhdr->h_source);
+
+		/* neighbour has to indicate direct link and it has to come via the corresponding interface */
+		/* if received seqno equals last send seqno save new seqno for bidirectional check */
+		if (has_directlink_flag && compare_orig(if_incoming->net_dev->dev_addr, batman_packet->orig) &&
+				  (batman_packet->seqno - if_incoming_seqno + 2 == 0)) {
+			bit_mark((TYPE_OF_WORD *)&(orig_neigh_node->bcast_own[if_incoming->if_num * NUM_WORDS]), 0);
+			orig_neigh_node->bcast_own_sum[if_incoming->if_num] = bit_packet_count((TYPE_OF_WORD *)&(orig_neigh_node->bcast_own[if_incoming->if_num * NUM_WORDS]));
+		}
+
+		debug_log(LOG_TYPE_BATMAN, "Drop packet: originator packet from myself (via neighbour) \n");
+		return;
+	}
+
+	if (batman_packet->tq == 0) {
+		count_real_packets(ethhdr, batman_packet, if_incoming);
+
+		debug_log(LOG_TYPE_BATMAN, "Drop packet: originator packet with tq equal 0 \n");
+		return;
+	}
+
+	if (is_my_oldorig) {
+		debug_log(LOG_TYPE_BATMAN, "Drop packet: ignoring all rebroadcast echos (sender: %s) \n", neigh_str);
+		return;
+	}
+
+	is_duplicate = count_real_packets(ethhdr, batman_packet, if_incoming);
+
+	orig_node = get_orig_node(batman_packet->orig);
+	if (orig_node == NULL)
+		return;
+
+	/* avoid temporary routing loops */
+	if ((orig_node->router) && (orig_node->router->orig_node->router) &&
+	    (compare_orig(orig_node->router->addr, batman_packet->prev_sender)) &&
+	    !(compare_orig(batman_packet->orig, batman_packet->prev_sender)) &&
+	    (compare_orig(orig_node->router->addr, orig_node->router->orig_node->router->addr))) {
+		debug_log(LOG_TYPE_BATMAN, "Drop packet: ignoring all rebroadcast packets that may make me loop (sender: %s) \n", neigh_str);
+		return;
+	}
+
+	/* if sender is a direct neighbor the sender mac equals originator mac */
+	orig_neigh_node = (is_single_hop_neigh ? orig_node : get_orig_node(ethhdr->h_source));
+	if (orig_neigh_node == NULL)
+		return;
+
+	/* drop packet if sender is not a direct neighbor and if we don't route towards it */
+	if (!is_single_hop_neigh && (orig_neigh_node->router == NULL)) {
+		debug_log(LOG_TYPE_BATMAN, "Drop packet: OGM via unknown neighbor! \n");
+		return;
+	}
+
+	is_bidirectional = isBidirectionalNeigh(orig_node, orig_neigh_node, batman_packet, if_incoming);
+
+	/* update ranking if it is not a duplicate or has the same seqno and similar ttl as the non-duplicate */
+	if (is_bidirectional && (!is_duplicate ||
+		((orig_node->last_real_seqno == batman_packet->seqno) &&
+			(orig_node->last_ttl - 3 <= batman_packet->ttl))))
+		update_orig(orig_node, ethhdr, batman_packet, if_incoming, hna_buff, hna_buff_len, is_duplicate);
+
+	/* is single hop (direct) neighbour */
+	if (is_single_hop_neigh) {
+
+		/* mark direct link on incoming interface */
+		schedule_forward_packet(orig_node, ethhdr, batman_packet, 1, hna_buff_len, if_incoming);
+
+		debug_log(LOG_TYPE_BATMAN, "Forwarding packet: rebroadcast neighbour packet with direct link flag \n");
+		return;
+	}
+
+	/* multihop originator */
+	if (!is_bidirectional) {
+		debug_log(LOG_TYPE_BATMAN, "Drop packet: not received via bidirectional link\n");
+		return;
+	}
+
+	if (is_duplicate) {
+		debug_log(LOG_TYPE_BATMAN, "Drop packet: duplicate packet received\n");
+		return;
+	}
+
+	debug_log(LOG_TYPE_BATMAN, "Forwarding packet: rebroadcast originator packet \n");
+	schedule_forward_packet(orig_node, ethhdr, batman_packet, 0, hna_buff_len, if_incoming);
+}
+
+void purge_orig(struct work_struct *work)
+{
+	struct list_head *list_pos, *list_pos_tmp;
+	struct hash_it_t *hashit = NULL;
+	struct orig_node *orig_node;
+	struct neigh_node *neigh_node, *best_neigh_node;
+	char orig_str[ETH_STR_LEN], neigh_str[ETH_STR_LEN], neigh_purged;
+
+	spin_lock(&orig_hash_lock);
+
+	/* for all origins... */
+	while (NULL != (hashit = hash_iterate(orig_hash, hashit))) {
+
+		orig_node = hashit->bucket->data;
+		addr_to_string(orig_str, orig_node->orig);
+
+		if (time_after(jiffies, orig_node->last_valid + ((2 * PURGE_TIMEOUT * HZ) / 1000))) {
+
+			debug_log(LOG_TYPE_BATMAN, "Originator timeout: originator %s, last_valid %u \n", orig_str, (orig_node->last_valid / HZ));
+
+			hash_remove_bucket(orig_hash, hashit);
+			free_orig_node(orig_node);
+
+		} else {
+
+			best_neigh_node = NULL;
+			neigh_purged = 0;
+
+			/* for all neighbours towards this originator ... */
+			list_for_each_safe(list_pos, list_pos_tmp, &orig_node->neigh_list) {
+				neigh_node = list_entry(list_pos, struct neigh_node, list);
+
+				if (time_after(jiffies, neigh_node->last_valid + ((PURGE_TIMEOUT * HZ) / 1000))) {
+
+					addr_to_string(neigh_str, neigh_node->addr);
+					debug_log(LOG_TYPE_BATMAN, "Neighbour timeout: originator %s, neighbour: %s, last_valid %u \n", orig_str, neigh_str, (neigh_node->last_valid / HZ));
+
+					neigh_purged = 1;
+					list_del(list_pos);
+					kfree(neigh_node);
+
+				} else {
+
+					if ((best_neigh_node == NULL) || (neigh_node->tq_avg > best_neigh_node->tq_avg))
+						best_neigh_node = neigh_node;
+
+				}
+
+			}
+
+			if (neigh_purged)
+				update_routes(orig_node, best_neigh_node, orig_node->hna_buff, orig_node->hna_buff_len);
+
+		}
+
+	}
+
+	spin_unlock(&orig_hash_lock);
+
+	start_purge_timer();
+}
+
+static int receive_raw_packet(struct socket *raw_sock, unsigned char *packet_buff, int packet_buff_len)
+{
+	struct kvec iov;
+	struct msghdr msg;
+
+	iov.iov_base = packet_buff;
+	iov.iov_len = packet_buff_len;
+
+	msg.msg_flags = MSG_DONTWAIT;	/* non-blocking */
+	msg.msg_name = NULL;
+	msg.msg_namelen = 0;
+	msg.msg_control = NULL;
+
+	return kernel_recvmsg(raw_sock, &msg, &iov, 1, packet_buff_len, MSG_DONTWAIT);
+}
+
+int packet_recv_thread(void *data)
+{
+	struct batman_if *batman_if;
+	struct ethhdr *ethhdr;
+	struct batman_packet *batman_packet;
+	struct unicast_packet *unicast_packet;
+	struct bcast_packet *bcast_packet;
+	struct icmp_packet *icmp_packet;
+	struct vis_packet *vis_packet;
+	struct orig_node *orig_node;
+	unsigned char *packet_buff, src_str[ETH_STR_LEN], dst_str[ETH_STR_LEN];
+	int vis_info_len;
+	int result;
+
+	atomic_set(&data_ready_cond, 0);
+	atomic_set(&exit_cond, 0);
+	packet_buff = kmalloc(PACKBUFF_SIZE, GFP_KERNEL);
+	if (!packet_buff) {
+		debug_log(LOG_TYPE_CRIT, "Could allocate memory for the packet buffer. :(\n");
+		return -1;
+	}
+
+	while ((!kthread_should_stop()) && (!atomic_read(&exit_cond))) {
+
+		wait_event_interruptible(thread_wait, (atomic_read(&data_ready_cond) || atomic_read(&exit_cond)));
+
+		atomic_set(&data_ready_cond, 0);
+
+		if (kthread_should_stop() || atomic_read(&exit_cond))
+			break;
+
+		/* we only want to safely traverse the list, hard-interfaces
+		 * won't be deleted anyway as long as this thread runs. */
+
+		rcu_read_lock();
+		list_for_each_entry_rcu(batman_if, &if_list, list) {
+			rcu_read_unlock();
+
+			result = -1;
+
+			while (1) {
+				if (batman_if->if_active != IF_ACTIVE) {
+					if (batman_if->if_active != IF_TO_BE_ACTIVATED)
+						debug_log(LOG_TYPE_NOTICE,
+						          "Could not read from deactivated interface %s!\n",
+						          batman_if->dev);
+
+					if (batman_if->raw_sock)
+						receive_raw_packet(batman_if->raw_sock, packet_buff, PACKBUFF_SIZE);
+					result = 0;
+					break;
+				}
+
+				result = receive_raw_packet(batman_if->raw_sock, packet_buff, PACKBUFF_SIZE);
+				if (result <= 0)
+					break;
+
+				if (result < sizeof(struct ethhdr) + 2)
+					continue;
+
+				ethhdr = (struct ethhdr *)packet_buff;
+				batman_packet = (struct batman_packet *)(packet_buff + sizeof(struct ethhdr));
+
+				if (batman_packet->version != COMPAT_VERSION) {
+					debug_log(LOG_TYPE_BATMAN, "Drop packet: incompatible batman version (%i) \n", batman_packet->version);
+					continue;
+				}
+
+				switch (batman_packet->packet_type) {
+				/* batman originator packet */
+				case BAT_PACKET:
+					/* packet with broadcast indication but unicast recipient */
+					if (!is_bcast(ethhdr->h_dest))
+						continue;
+
+					/* packet with broadcast sender address */
+					if (is_bcast(ethhdr->h_source))
+						continue;
+
+					/* drop packet if it has not at least one batman packet as payload */
+					if (result < sizeof(struct ethhdr) + sizeof(struct batman_packet))
+						continue;
+
+					spin_lock(&orig_hash_lock);
+					receive_aggr_bat_packet(ethhdr,
+					                        packet_buff + sizeof(struct ethhdr),
+					                        result - sizeof(struct ethhdr),
+					                        batman_if);
+					spin_unlock(&orig_hash_lock);
+
+					break;
+
+				/* batman icmp packet */
+				case BAT_ICMP:
+					/* packet with unicast indication but broadcast recipient */
+					if (is_bcast(ethhdr->h_dest))
+						continue;
+
+					/* packet with broadcast sender address */
+					if (is_bcast(ethhdr->h_source))
+						continue;
+
+					/* not for me */
+					if (!is_my_mac(ethhdr->h_dest))
+						continue;
+
+					/* drop packet if it has not necessary minimum size */
+					if (result < sizeof(struct ethhdr) + sizeof(struct icmp_packet))
+						continue;
+
+					icmp_packet = (struct icmp_packet *)(packet_buff + sizeof(struct ethhdr));
+
+					/* packet for me */
+					if (is_my_mac(icmp_packet->dst)) {
+
+						/* add data to device queue */
+						if (icmp_packet->msg_type != ECHO_REQUEST) {
+							bat_device_receive_packet(icmp_packet);
+							continue;
+						}
+
+						/* answer echo request (ping) */
+						/* get routing information */
+						spin_lock(&orig_hash_lock);
+						orig_node = ((struct orig_node *)hash_find(orig_hash, icmp_packet->orig));
+
+						if ((orig_node != NULL) && (orig_node->batman_if != NULL) && (orig_node->router != NULL)) {
+
+							memcpy(icmp_packet->dst, icmp_packet->orig, ETH_ALEN);
+							memcpy(icmp_packet->orig, ethhdr->h_dest, ETH_ALEN);
+							icmp_packet->msg_type = ECHO_REPLY;
+							icmp_packet->ttl = TTL;
+
+							send_raw_packet(packet_buff + sizeof(struct ethhdr),
+							                result - sizeof(struct ethhdr),
+							                orig_node->batman_if,
+							                orig_node->router->addr);
+
+						}
+
+						spin_unlock(&orig_hash_lock);
+						continue;
+
+					}
+
+					/* TTL exceeded */
+					if (icmp_packet->ttl < 2) {
+
+						addr_to_string(src_str, icmp_packet->orig);
+						addr_to_string(dst_str, icmp_packet->dst);
+
+						debug_log(LOG_TYPE_NOTICE, "Error - can't send packet from %s to %s: ttl exceeded\n", src_str, dst_str);
+
+						/* send TTL exceeded if packet is an echo request (traceroute) */
+						if (icmp_packet->msg_type != ECHO_REQUEST)
+							continue;
+
+						/* get routing information */
+						spin_lock(&orig_hash_lock);
+						orig_node = ((struct orig_node *)hash_find(orig_hash, icmp_packet->orig));
+
+						if ((orig_node != NULL) && (orig_node->batman_if != NULL) && (orig_node->router != NULL)) {
+
+							memcpy(icmp_packet->dst, icmp_packet->orig, ETH_ALEN);
+							memcpy(icmp_packet->orig, ethhdr->h_dest, ETH_ALEN);
+							icmp_packet->msg_type = TTL_EXCEEDED;
+							icmp_packet->ttl = TTL;
+
+							send_raw_packet(packet_buff + sizeof(struct ethhdr),
+							                result - sizeof(struct ethhdr),
+							                orig_node->batman_if,
+							                orig_node->router->addr);
+
+						}
+
+						spin_unlock(&orig_hash_lock);
+						continue;
+
+					}
+
+					/* get routing information */
+					spin_lock(&orig_hash_lock);
+					orig_node = ((struct orig_node *)hash_find(orig_hash, icmp_packet->dst));
+
+					if ((orig_node != NULL) && (orig_node->batman_if != NULL) && (orig_node->router != NULL)) {
+
+						/* decrement ttl */
+						icmp_packet->ttl--;
+
+						/* route it */
+						send_raw_packet(packet_buff + sizeof(struct ethhdr),
+						                result - sizeof(struct ethhdr),
+						                orig_node->batman_if,
+						                orig_node->router->addr);
+					}
+
+					spin_unlock(&orig_hash_lock);
+					break;
+
+				/* unicast packet */
+				case BAT_UNICAST:
+					/* packet with unicast indication but broadcast recipient */
+					if (is_bcast(ethhdr->h_dest))
+						continue;
+
+					/* packet with broadcast sender address */
+					if (is_bcast(ethhdr->h_source))
+						continue;
+
+					/* not for me */
+					if (!is_my_mac(ethhdr->h_dest))
+						continue;
+
+					/* drop packet if it has not necessary minimum size */
+					if (result < sizeof(struct ethhdr) + sizeof(struct unicast_packet))
+						continue;
+
+					unicast_packet = (struct unicast_packet *)(packet_buff + sizeof(struct ethhdr));
+
+					/* packet for me */
+					if (is_my_mac(unicast_packet->dest)) {
+
+						interface_rx(soft_device, packet_buff + sizeof(struct ethhdr) + sizeof(struct unicast_packet), result - sizeof(struct ethhdr) - sizeof(struct unicast_packet));
+						continue;
+
+					}
+
+					/* TTL exceeded */
+					if (unicast_packet->ttl < 2) {
+						addr_to_string(src_str, ((struct ethhdr *)(unicast_packet + 1))->h_source);
+						addr_to_string(dst_str, unicast_packet->dest);
+
+						debug_log(LOG_TYPE_NOTICE, "Error - can't send packet from %s to %s: ttl exceeded\n", src_str, dst_str);
+						continue;
+					}
+
+					/* get routing information */
+					spin_lock(&orig_hash_lock);
+					orig_node = ((struct orig_node *)hash_find(orig_hash, unicast_packet->dest));
+
+					if ((orig_node != NULL) && (orig_node->batman_if != NULL) && (orig_node->router != NULL)) {
+						/* decrement ttl */
+						unicast_packet->ttl--;
+
+						/* route it */
+						send_raw_packet(packet_buff + sizeof(struct ethhdr),
+						                result - sizeof(struct ethhdr),
+						                orig_node->batman_if,
+						                orig_node->router->addr);
+					}
+
+					spin_unlock(&orig_hash_lock);
+					break;
+
+				/* broadcast packet */
+				case BAT_BCAST:
+					/* packet with broadcast indication but unicast recipient */
+					if (!is_bcast(ethhdr->h_dest))
+						continue;
+
+					/* packet with broadcast sender address */
+					if (is_bcast(ethhdr->h_source))
+						continue;
+
+					/* drop packet if it has not necessary minimum size */
+					if (result < sizeof(struct ethhdr) + sizeof(struct bcast_packet))
+						continue;
+
+					/* ignore broadcasts sent by myself */
+					if (is_my_mac(ethhdr->h_source))
+						continue;
+
+					bcast_packet = (struct bcast_packet *)(packet_buff + sizeof(struct ethhdr));
+
+					/* ignore broadcasts originated by myself */
+					if (is_my_mac(bcast_packet->orig))
+						continue;
+
+					spin_lock(&orig_hash_lock);
+					orig_node = ((struct orig_node *)hash_find(orig_hash, bcast_packet->orig));
+
+					if (orig_node == NULL) {
+						spin_unlock(&orig_hash_lock);
+						continue;
+					}
+
+					/* check flood history */
+					if (get_bit_status(orig_node->bcast_bits, orig_node->last_bcast_seqno, ntohs(bcast_packet->seqno))) {
+						spin_unlock(&orig_hash_lock);
+						continue;
+					}
+
+					/* mark broadcast in flood history */
+					if (bit_get_packet(orig_node->bcast_bits, ntohs(bcast_packet->seqno) - orig_node->last_bcast_seqno, 1))
+						orig_node->last_bcast_seqno = ntohs(bcast_packet->seqno);
+
+					spin_unlock(&orig_hash_lock);
+
+					/* broadcast for me */
+					interface_rx(soft_device, packet_buff + sizeof(struct ethhdr) + sizeof(struct bcast_packet), result - sizeof(struct ethhdr) - sizeof(struct bcast_packet));
+
+					/* rebroadcast packet */
+					add_bcast_packet_to_list(packet_buff + sizeof(struct ethhdr),
+									result - sizeof(struct ethhdr));
+
+					break;
+
+				/* vis packet */
+				case BAT_VIS:
+					/* drop if too short. */
+					if (result < sizeof(struct ethhdr) + sizeof(struct vis_packet))
+						continue;
+
+					/* not for me */
+					if (!is_my_mac(ethhdr->h_dest))
+						continue;
+
+					vis_packet = (struct vis_packet *)(packet_buff + sizeof(struct ethhdr));
+					vis_info_len = result  - sizeof(struct ethhdr) - sizeof(struct vis_packet);
+
+					/* ignore own packets */
+					if (is_my_mac(vis_packet->vis_orig))
+						continue;
+
+					if (is_my_mac(vis_packet->sender_orig))
+						continue;
+
+					switch (vis_packet->vis_type) {
+					case VIS_TYPE_SERVER_SYNC:
+						receive_server_sync_packet(vis_packet, vis_info_len);
+						break;
+
+					case VIS_TYPE_CLIENT_UPDATE:
+						receive_client_update_packet(vis_packet, vis_info_len);
+						break;
+
+					default:	/* ignore unknown packet */
+						break;
+					}
+
+					break;
+				}
+
+			}
+
+			if ((result < 0) && (result != -EAGAIN))
+				debug_log(LOG_TYPE_CRIT, "Could not receive packet from interface %s: %i\n", batman_if->dev, result);
+
+			/* lock for the next iteration */
+			rcu_read_lock();
+		}
+		rcu_read_unlock();
+
+	}
+	kfree(packet_buff);
+
+	/* do not exit until kthread_stop() is actually called, otherwise it will wait for us
+	 * forever. */
+	while (!kthread_should_stop())
+		schedule();
+
+	return 0;
+}
+
+void batman_data_ready(struct sock *sk, int len)
+{
+	void (*data_ready)(struct sock *, int) = sk->sk_user_data;
+
+	data_ready(sk, len);
+
+	atomic_set(&data_ready_cond, 1);
+	wake_up_interruptible(&thread_wait);
+}
+
diff --git a/drivers/staging/batman-adv/routing.h b/drivers/staging/batman-adv/routing.h
new file mode 100644
index 000000000000..0123ea86debb
--- /dev/null
+++ b/drivers/staging/batman-adv/routing.h
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2007-2009 B.A.T.M.A.N. contributors:
+ *
+ * Marek Lindner, Simon Wunderlich
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA
+ *
+ */
+
+#include "types.h"
+
+extern wait_queue_head_t thread_wait;
+extern atomic_t exit_cond;
+
+int originator_init(void);
+void free_orig_node(void *data);
+void originator_free(void);
+void slide_own_bcast_window(struct batman_if *batman_if);
+void batman_data_ready(struct sock *sk, int len);
+void purge_orig(struct work_struct *work);
+int packet_recv_thread(void *data);
+void receive_bat_packet(struct ethhdr *ethhdr, struct batman_packet *batman_packet, unsigned char *hna_buff, int hna_buff_len, struct batman_if *if_incoming);
diff --git a/drivers/staging/batman-adv/send.c b/drivers/staging/batman-adv/send.c
new file mode 100644
index 000000000000..eb617508cca4
--- /dev/null
+++ b/drivers/staging/batman-adv/send.c
@@ -0,0 +1,475 @@
+/*
+ * Copyright (C) 2007-2009 B.A.T.M.A.N. contributors:
+ *
+ * Marek Lindner, Simon Wunderlich
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA
+ *
+ */
+
+#include "main.h"
+#include "send.h"
+#include "log.h"
+#include "routing.h"
+#include "translation-table.h"
+#include "hard-interface.h"
+#include "types.h"
+#include "vis.h"
+#include "aggregation.h"
+
+#include "compat.h"
+
+/* apply hop penalty for a normal link */
+static uint8_t hop_penalty(const uint8_t tq)
+{
+	return (tq * (TQ_MAX_VALUE - TQ_HOP_PENALTY)) / (TQ_MAX_VALUE);
+}
+
+/* when do we schedule our own packet to be sent */
+static unsigned long own_send_time(void)
+{
+	return jiffies +
+		(((atomic_read(&originator_interval) - JITTER +
+		   (random32() % 2*JITTER)) * HZ) / 1000);
+}
+
+/* when do we schedule a forwarded packet to be sent */
+static unsigned long forward_send_time(void)
+{
+	unsigned long send_time = jiffies; /* Starting now plus... */
+
+	if (atomic_read(&aggregation_enabled))
+		send_time += (((MAX_AGGREGATION_MS - (JITTER/2) +
+				(random32() % JITTER)) * HZ) / 1000);
+	else
+		send_time += (((random32() % (JITTER/2)) * HZ) / 1000);
+
+	return send_time;
+}
+
+/* sends a raw packet. */
+void send_raw_packet(unsigned char *pack_buff, int pack_buff_len,
+		     struct batman_if *batman_if, uint8_t *dst_addr)
+{
+	struct ethhdr *ethhdr;
+	struct sk_buff *skb;
+	int retval;
+	char *data;
+
+	if (batman_if->if_active != IF_ACTIVE)
+		return;
+
+	if (!(batman_if->net_dev->flags & IFF_UP)) {
+		debug_log(LOG_TYPE_WARN,
+		         "Interface %s is not up - can't send packet via that interface (IF_TO_BE_DEACTIVATED was here) !\n",
+		          batman_if->dev);
+		return;
+	}
+
+	skb = dev_alloc_skb(pack_buff_len + sizeof(struct ethhdr));
+	if (!skb)
+		return;
+	data = skb_put(skb, pack_buff_len + sizeof(struct ethhdr));
+
+	memcpy(data + sizeof(struct ethhdr), pack_buff, pack_buff_len);
+
+	ethhdr = (struct ethhdr *) data;
+	memcpy(ethhdr->h_source, batman_if->net_dev->dev_addr, ETH_ALEN);
+	memcpy(ethhdr->h_dest, dst_addr, ETH_ALEN);
+	ethhdr->h_proto = __constant_htons(ETH_P_BATMAN);
+
+	skb_reset_mac_header(skb);
+	skb_set_network_header(skb, ETH_HLEN);
+	skb->priority = TC_PRIO_CONTROL;
+	skb->protocol = __constant_htons(ETH_P_BATMAN);
+	skb->dev = batman_if->net_dev;
+
+	/* dev_queue_xmit() returns a negative result on error.	 However on
+	 * congestion and traffic shaping, it drops and returns NET_XMIT_DROP
+	 * (which is > 0). This will not be treated as an error. */
+	retval = dev_queue_xmit(skb);
+	if (retval < 0)
+		debug_log(LOG_TYPE_CRIT,
+		          "Can't write to raw socket (IF_TO_BE_DEACTIVATED was here): %i\n",
+		          retval);
+}
+
+/* Send a packet to a given interface */
+static void send_packet_to_if(struct forw_packet *forw_packet,
+			      struct batman_if *batman_if)
+{
+	char *fwd_str;
+	uint8_t packet_num;
+	int16_t buff_pos;
+	struct batman_packet *batman_packet;
+	char orig_str[ETH_STR_LEN];
+
+	if (batman_if->if_active != IF_ACTIVE)
+		return;
+
+	packet_num = buff_pos = 0;
+	batman_packet = (struct batman_packet *)
+		(forw_packet->packet_buff);
+
+	/* adjust all flags and log packets */
+	while (aggregated_packet(buff_pos,
+				 forw_packet->packet_len,
+				 batman_packet->num_hna)) {
+
+		/* we might have aggregated direct link packets with an
+		 * ordinary base packet */
+		if ((forw_packet->direct_link_flags & (1 << packet_num)) &&
+		    (forw_packet->if_incoming == batman_if))
+			batman_packet->flags |= DIRECTLINK;
+		else
+			batman_packet->flags &= ~DIRECTLINK;
+
+		addr_to_string(orig_str, batman_packet->orig);
+		fwd_str = (packet_num > 0 ? "Forwarding" : (forw_packet->own ?
+							    "Sending own" :
+							    "Forwarding"));
+		debug_log(LOG_TYPE_BATMAN,
+			  "%s %spacket (originator %s, seqno %d, TQ %d, TTL %d, IDF %s) on interface %s [%s]\n",
+			  fwd_str,
+			  (packet_num > 0 ? "aggregated " : ""),
+			  orig_str, ntohs(batman_packet->seqno),
+			  batman_packet->tq, batman_packet->ttl,
+			  (batman_packet->flags & DIRECTLINK ?
+			   "on" : "off"),
+			  batman_if->dev, batman_if->addr_str);
+
+		buff_pos += sizeof(struct batman_packet) +
+			(batman_packet->num_hna * ETH_ALEN);
+		packet_num++;
+		batman_packet = (struct batman_packet *)
+			(forw_packet->packet_buff + buff_pos);
+	}
+
+	send_raw_packet(forw_packet->packet_buff,
+			forw_packet->packet_len,
+			batman_if, broadcastAddr);
+}
+
+/* send a batman packet */
+static void send_packet(struct forw_packet *forw_packet)
+{
+	struct batman_if *batman_if;
+	struct batman_packet *batman_packet =
+		(struct batman_packet *)(forw_packet->packet_buff);
+	char orig_str[ETH_STR_LEN];
+	unsigned char directlink = (batman_packet->flags & DIRECTLINK ? 1 : 0);
+
+	if (!forw_packet->if_incoming) {
+		debug_log(LOG_TYPE_CRIT,
+			  "Error - can't forward packet: incoming iface not specified\n");
+		return;
+	}
+
+	if (forw_packet->if_incoming->if_active != IF_ACTIVE)
+		return;
+
+	addr_to_string(orig_str, batman_packet->orig);
+
+	/* multihomed peer assumed */
+	/* non-primary OGMs are only broadcasted on their interface */
+	if ((directlink && (batman_packet->ttl == 1)) ||
+	    (forw_packet->own && (forw_packet->if_incoming->if_num > 0))) {
+
+		/* FIXME: what about aggregated packets ? */
+		debug_log(LOG_TYPE_BATMAN,
+			  "%s packet (originator %s, seqno %d, TTL %d) on interface %s [%s]\n",
+			  (forw_packet->own ? "Sending own" : "Forwarding"),
+			  orig_str, ntohs(batman_packet->seqno),
+			  batman_packet->ttl, forw_packet->if_incoming->dev,
+			  forw_packet->if_incoming->addr_str);
+
+		send_raw_packet(forw_packet->packet_buff,
+				forw_packet->packet_len,
+				forw_packet->if_incoming,
+				broadcastAddr);
+		return;
+	}
+
+	/* broadcast on every interface */
+	rcu_read_lock();
+	list_for_each_entry_rcu(batman_if, &if_list, list)
+		send_packet_to_if(forw_packet, batman_if);
+	rcu_read_unlock();
+}
+
+static void rebuild_batman_packet(struct batman_if *batman_if)
+{
+	int new_len;
+	unsigned char *new_buff;
+	struct batman_packet *batman_packet;
+
+	new_len = sizeof(struct batman_packet) + (num_hna * ETH_ALEN);
+	new_buff = kmalloc(new_len, GFP_ATOMIC);
+
+	/* keep old buffer if kmalloc should fail */
+	if (new_buff) {
+		memcpy(new_buff, batman_if->packet_buff,
+		       sizeof(struct batman_packet));
+		batman_packet = (struct batman_packet *)new_buff;
+
+		batman_packet->num_hna = hna_local_fill_buffer(
+			new_buff + sizeof(struct batman_packet),
+			new_len - sizeof(struct batman_packet));
+
+		kfree(batman_if->packet_buff);
+		batman_if->packet_buff = new_buff;
+		batman_if->packet_len = new_len;
+	}
+}
+
+void schedule_own_packet(struct batman_if *batman_if)
+{
+	unsigned long send_time;
+	struct batman_packet *batman_packet;
+
+	/**
+	 * the interface gets activated here to avoid race conditions between
+	 * the moment of activating the interface in
+	 * hardif_activate_interface() where the originator mac is set and
+	 * outdated packets (especially uninitialized mac addresses) in the
+	 * packet queue
+	 */
+	if (batman_if->if_active == IF_TO_BE_ACTIVATED)
+		batman_if->if_active = IF_ACTIVE;
+
+	/* if local hna has changed and interface is a primary interface */
+	if ((atomic_read(&hna_local_changed)) && (batman_if->if_num == 0))
+		rebuild_batman_packet(batman_if);
+
+	/**
+	 * NOTE: packet_buff might just have been re-allocated in
+	 * rebuild_batman_packet()
+	 */
+	batman_packet = (struct batman_packet *)batman_if->packet_buff;
+
+	/* change sequence number to network order */
+	batman_packet->seqno = htons((uint16_t)atomic_read(&batman_if->seqno));
+
+	if (is_vis_server())
+		batman_packet->flags = VIS_SERVER;
+	else
+		batman_packet->flags = 0;
+
+	/* could be read by receive_bat_packet() */
+	atomic_inc(&batman_if->seqno);
+
+	slide_own_bcast_window(batman_if);
+	send_time = own_send_time();
+	add_bat_packet_to_list(batman_if->packet_buff,
+			       batman_if->packet_len, batman_if, 1, send_time);
+}
+
+void schedule_forward_packet(struct orig_node *orig_node,
+			     struct ethhdr *ethhdr,
+			     struct batman_packet *batman_packet,
+			     uint8_t directlink, int hna_buff_len,
+			     struct batman_if *if_incoming)
+{
+	unsigned char in_tq, in_ttl, tq_avg = 0;
+	unsigned long send_time;
+
+	if (batman_packet->ttl <= 1) {
+		debug_log(LOG_TYPE_BATMAN, "ttl exceeded \n");
+		return;
+	}
+
+	in_tq = batman_packet->tq;
+	in_ttl = batman_packet->ttl;
+
+	batman_packet->ttl--;
+	memcpy(batman_packet->prev_sender, ethhdr->h_source, ETH_ALEN);
+
+	/* rebroadcast tq of our best ranking neighbor to ensure the rebroadcast
+	 * of our best tq value */
+	if ((orig_node->router) && (orig_node->router->tq_avg != 0)) {
+
+		/* rebroadcast ogm of best ranking neighbor as is */
+		if (!compare_orig(orig_node->router->addr, ethhdr->h_source)) {
+			batman_packet->tq = orig_node->router->tq_avg;
+
+			if (orig_node->router->last_ttl)
+				batman_packet->ttl = orig_node->router->last_ttl - 1;
+		}
+
+		tq_avg = orig_node->router->tq_avg;
+	}
+
+	/* apply hop penalty */
+	batman_packet->tq = hop_penalty(batman_packet->tq);
+
+	debug_log(LOG_TYPE_BATMAN, "Forwarding packet: tq_orig: %i, tq_avg: %i, tq_forw: %i, ttl_orig: %i, ttl_forw: %i \n",
+		  in_tq, tq_avg, batman_packet->tq, in_ttl - 1,
+		  batman_packet->ttl);
+
+	batman_packet->seqno = htons(batman_packet->seqno);
+
+	if (directlink)
+		batman_packet->flags |= DIRECTLINK;
+	else
+		batman_packet->flags &= ~DIRECTLINK;
+
+	send_time = forward_send_time();
+	add_bat_packet_to_list((unsigned char *)batman_packet,
+			       sizeof(struct batman_packet) + hna_buff_len,
+			       if_incoming, 0, send_time);
+}
+
+static void forw_packet_free(struct forw_packet *forw_packet)
+{
+	kfree(forw_packet->packet_buff);
+	kfree(forw_packet);
+}
+
+static void _add_bcast_packet_to_list(struct forw_packet *forw_packet,
+				      unsigned long send_time)
+{
+	INIT_HLIST_NODE(&forw_packet->list);
+
+	/* add new packet to packet list */
+	spin_lock(&forw_bcast_list_lock);
+	hlist_add_head(&forw_packet->list, &forw_bcast_list);
+	spin_unlock(&forw_bcast_list_lock);
+
+	/* start timer for this packet */
+	INIT_DELAYED_WORK(&forw_packet->delayed_work,
+			  send_outstanding_bcast_packet);
+	queue_delayed_work(bat_event_workqueue, &forw_packet->delayed_work,
+			   send_time);
+}
+
+void add_bcast_packet_to_list(unsigned char *packet_buff, int packet_len)
+{
+	struct forw_packet *forw_packet;
+
+	forw_packet = kmalloc(sizeof(struct forw_packet), GFP_ATOMIC);
+	if (!forw_packet)
+		return;
+
+	forw_packet->packet_buff = kmalloc(packet_len, GFP_ATOMIC);
+	if (!forw_packet->packet_buff) {
+		kfree(forw_packet);
+		return;
+	}
+
+	forw_packet->packet_len = packet_len;
+	memcpy(forw_packet->packet_buff, packet_buff, forw_packet->packet_len);
+
+	/* how often did we send the bcast packet ? */
+	forw_packet->num_packets = 0;
+
+	_add_bcast_packet_to_list(forw_packet, 1);
+}
+
+void send_outstanding_bcast_packet(struct work_struct *work)
+{
+	struct batman_if *batman_if;
+	struct delayed_work *delayed_work =
+		container_of(work, struct delayed_work, work);
+	struct forw_packet *forw_packet =
+		container_of(delayed_work, struct forw_packet, delayed_work);
+
+	spin_lock(&forw_bcast_list_lock);
+	hlist_del(&forw_packet->list);
+	spin_unlock(&forw_bcast_list_lock);
+
+	/* rebroadcast packet */
+	rcu_read_lock();
+	list_for_each_entry_rcu(batman_if, &if_list, list) {
+		send_raw_packet(forw_packet->packet_buff,
+				forw_packet->packet_len,
+				batman_if, broadcastAddr);
+	}
+	rcu_read_unlock();
+
+	forw_packet->num_packets++;
+
+	/* if we still have some more bcasts to send and we are not shutting
+	 * down */
+	if ((forw_packet->num_packets < 3) &&
+	    (atomic_read(&module_state) != MODULE_DEACTIVATING))
+		_add_bcast_packet_to_list(forw_packet, ((5 * HZ) / 1000));
+	else
+		forw_packet_free(forw_packet);
+}
+
+void send_outstanding_bat_packet(struct work_struct *work)
+{
+	struct delayed_work *delayed_work =
+		container_of(work, struct delayed_work, work);
+	struct forw_packet *forw_packet =
+		container_of(delayed_work, struct forw_packet, delayed_work);
+
+	spin_lock(&forw_bat_list_lock);
+	hlist_del(&forw_packet->list);
+	spin_unlock(&forw_bat_list_lock);
+
+	send_packet(forw_packet);
+
+	/**
+	 * we have to have at least one packet in the queue
+	 * to determine the queues wake up time unless we are
+	 * shutting down
+	 */
+	if ((forw_packet->own) &&
+	    (atomic_read(&module_state) != MODULE_DEACTIVATING))
+		schedule_own_packet(forw_packet->if_incoming);
+
+	forw_packet_free(forw_packet);
+}
+
+void purge_outstanding_packets(void)
+{
+	struct forw_packet *forw_packet;
+	struct hlist_node *tmp_node, *safe_tmp_node;
+
+	debug_log(LOG_TYPE_BATMAN, "purge_outstanding_packets()\n");
+
+	/* free bcast list */
+	spin_lock(&forw_bcast_list_lock);
+	hlist_for_each_entry_safe(forw_packet, tmp_node, safe_tmp_node,
+				  &forw_bcast_list, list) {
+
+		spin_unlock(&forw_bcast_list_lock);
+
+		/**
+		 * send_outstanding_bcast_packet() will lock the list to
+		 * delete the item from the list
+		 */
+		cancel_delayed_work_sync(&forw_packet->delayed_work);
+		spin_lock(&forw_bcast_list_lock);
+	}
+	spin_unlock(&forw_bcast_list_lock);
+
+	/* free batman packet list */
+	spin_lock(&forw_bat_list_lock);
+	hlist_for_each_entry_safe(forw_packet, tmp_node, safe_tmp_node,
+				  &forw_bat_list, list) {
+
+		spin_unlock(&forw_bat_list_lock);
+
+		/**
+		 * send_outstanding_bat_packet() will lock the list to
+		 * delete the item from the list
+		 */
+		cancel_delayed_work_sync(&forw_packet->delayed_work);
+		spin_lock(&forw_bat_list_lock);
+	}
+	spin_unlock(&forw_bat_list_lock);
+}
diff --git a/drivers/staging/batman-adv/send.h b/drivers/staging/batman-adv/send.h
new file mode 100644
index 000000000000..59d500917a35
--- /dev/null
+++ b/drivers/staging/batman-adv/send.h
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2007-2009 B.A.T.M.A.N. contributors:
+ *
+ * Marek Lindner, Simon Wunderlich
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA
+ *
+ */
+
+#include "types.h"
+
+void send_own_packet_work(struct work_struct *work);
+void send_raw_packet(unsigned char *pack_buff, int pack_buff_len,
+		     struct batman_if *batman_if, uint8_t *dst_addr);
+void schedule_own_packet(struct batman_if *batman_if);
+void schedule_forward_packet(struct orig_node *orig_node,
+			     struct ethhdr *ethhdr,
+			     struct batman_packet *batman_packet,
+			     uint8_t directlink, int hna_buff_len,
+			     struct batman_if *if_outgoing);
+void add_bcast_packet_to_list(unsigned char *packet_buff, int packet_len);
+void send_outstanding_bcast_packet(struct work_struct *work);
+void send_outstanding_bat_packet(struct work_struct *work);
+void purge_outstanding_packets(void);
diff --git a/drivers/staging/batman-adv/soft-interface.c b/drivers/staging/batman-adv/soft-interface.c
new file mode 100644
index 000000000000..d543f50b647f
--- /dev/null
+++ b/drivers/staging/batman-adv/soft-interface.c
@@ -0,0 +1,349 @@
+/*
+ * Copyright (C) 2007-2009 B.A.T.M.A.N. contributors:
+ *
+ * Marek Lindner, Simon Wunderlich
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA
+ *
+ */
+
+#include "main.h"
+#include "soft-interface.h"
+#include "hard-interface.h"
+#include "send.h"
+#include "translation-table.h"
+#include "log.h"
+#include "types.h"
+#include "hash.h"
+#include <linux/ethtool.h>
+#include <linux/etherdevice.h>
+#include "compat.h"
+
+static uint16_t bcast_seqno = 1; /* give own bcast messages seq numbers to avoid
+				  * broadcast storms */
+static int32_t skb_packets;
+static int32_t skb_bad_packets;
+static int32_t lock_dropped;
+
+unsigned char mainIfAddr[ETH_ALEN];
+static unsigned char mainIfAddr_default[ETH_ALEN];
+static int bat_get_settings(struct net_device *dev, struct ethtool_cmd *cmd);
+static void bat_get_drvinfo(struct net_device *dev,
+			    struct ethtool_drvinfo *info);
+static u32 bat_get_msglevel(struct net_device *dev);
+static void bat_set_msglevel(struct net_device *dev, u32 value);
+static u32 bat_get_link(struct net_device *dev);
+static u32 bat_get_rx_csum(struct net_device *dev);
+static int bat_set_rx_csum(struct net_device *dev, u32 data);
+
+static const struct ethtool_ops bat_ethtool_ops = {
+	.get_settings = bat_get_settings,
+	.get_drvinfo = bat_get_drvinfo,
+	.get_msglevel = bat_get_msglevel,
+	.set_msglevel = bat_set_msglevel,
+	.get_link = bat_get_link,
+	.get_rx_csum = bat_get_rx_csum,
+	.set_rx_csum = bat_set_rx_csum
+};
+
+void set_main_if_addr(uint8_t *addr)
+{
+	memcpy(mainIfAddr, addr, ETH_ALEN);
+}
+
+int main_if_was_up(void)
+{
+	return (memcmp(mainIfAddr, mainIfAddr_default, ETH_ALEN) != 0 ? 1 : 0);
+}
+
+static int my_skb_push(struct sk_buff *skb, unsigned int len)
+{
+	int result = 0;
+
+	skb_packets++;
+	if (skb->data - len < skb->head) {
+		skb_bad_packets++;
+		result = pskb_expand_head(skb, len, 0, GFP_ATOMIC);
+
+		if (result < 0)
+			return result;
+	}
+
+	skb_push(skb, len);
+	return 0;
+}
+
+#ifdef HAVE_NET_DEVICE_OPS
+static const struct net_device_ops bat_netdev_ops = {
+	.ndo_open = interface_open,
+	.ndo_stop = interface_release,
+	.ndo_get_stats = interface_stats,
+	.ndo_set_mac_address = interface_set_mac_addr,
+	.ndo_change_mtu = interface_change_mtu,
+	.ndo_start_xmit = interface_tx,
+	.ndo_validate_addr = eth_validate_addr
+};
+#endif
+
+void interface_setup(struct net_device *dev)
+{
+	struct bat_priv *priv = netdev_priv(dev);
+	char dev_addr[ETH_ALEN];
+
+	ether_setup(dev);
+
+#ifdef HAVE_NET_DEVICE_OPS
+	dev->netdev_ops = &bat_netdev_ops;
+#else
+	dev->open = interface_open;
+	dev->stop = interface_release;
+	dev->get_stats = interface_stats;
+	dev->set_mac_address = interface_set_mac_addr;
+	dev->change_mtu = interface_change_mtu;
+	dev->hard_start_xmit = interface_tx;
+#endif
+	dev->destructor = free_netdev;
+
+	dev->mtu = hardif_min_mtu();
+	dev->hard_header_len = BAT_HEADER_LEN; /* reserve more space in the
+						* skbuff for our header */
+
+	/* generate random address */
+	random_ether_addr(dev_addr);
+	memcpy(dev->dev_addr, dev_addr, sizeof(dev->dev_addr));
+
+	SET_ETHTOOL_OPS(dev, &bat_ethtool_ops);
+
+	memset(priv, 0, sizeof(struct bat_priv));
+}
+
+int interface_open(struct net_device *dev)
+{
+	netif_start_queue(dev);
+	return 0;
+}
+
+int interface_release(struct net_device *dev)
+{
+	netif_stop_queue(dev);
+	return 0;
+}
+
+struct net_device_stats *interface_stats(struct net_device *dev)
+{
+	struct bat_priv *priv = netdev_priv(dev);
+	return &priv->stats;
+}
+
+int interface_set_mac_addr(struct net_device *dev, void *addr)
+{
+	return -EBUSY;
+}
+
+int interface_change_mtu(struct net_device *dev, int new_mtu)
+{
+	/* check ranges */
+	if ((new_mtu < 68) || (new_mtu > hardif_min_mtu()))
+		return -EINVAL;
+
+	dev->mtu = new_mtu;
+
+	return 0;
+}
+
+int interface_tx(struct sk_buff *skb, struct net_device *dev)
+{
+	struct unicast_packet *unicast_packet;
+	struct bcast_packet *bcast_packet;
+	struct orig_node *orig_node;
+	struct ethhdr *ethhdr = (struct ethhdr *)skb->data;
+	struct bat_priv *priv = netdev_priv(dev);
+	int data_len = skb->len;
+
+	if (atomic_read(&module_state) != MODULE_ACTIVE)
+		goto dropped;
+
+	dev->trans_start = jiffies;
+	/* TODO: check this for locks */
+	hna_local_add(ethhdr->h_source);
+
+	/* ethernet packet should be broadcasted */
+	if (is_bcast(ethhdr->h_dest) || is_mcast(ethhdr->h_dest)) {
+
+		if (my_skb_push(skb, sizeof(struct bcast_packet)) < 0)
+			goto dropped;
+
+		bcast_packet = (struct bcast_packet *)skb->data;
+
+		bcast_packet->version = COMPAT_VERSION;
+
+		/* batman packet type: broadcast */
+		bcast_packet->packet_type = BAT_BCAST;
+
+		/* hw address of first interface is the orig mac because only
+		 * this mac is known throughout the mesh */
+		memcpy(bcast_packet->orig, mainIfAddr, ETH_ALEN);
+		/* set broadcast sequence number */
+		bcast_packet->seqno = htons(bcast_seqno);
+
+		bcast_seqno++;
+
+		/* broadcast packet */
+		add_bcast_packet_to_list(skb->data, skb->len);
+
+	/* unicast packet */
+	} else {
+
+		/* simply spin_lock()ing can deadlock when the lock is already
+		 * hold. */
+		/* TODO: defer the work in a working queue instead of
+		 * dropping */
+		if (!spin_trylock(&orig_hash_lock)) {
+			lock_dropped++;
+			debug_log(LOG_TYPE_NOTICE, "%d packets dropped because lock was hold\n", lock_dropped);
+			goto dropped;
+		}
+
+		/* get routing information */
+		orig_node = ((struct orig_node *)hash_find(orig_hash,
+							   ethhdr->h_dest));
+
+		/* check for hna host */
+		if (!orig_node)
+			orig_node = transtable_search(ethhdr->h_dest);
+
+		if ((orig_node) &&
+		    (orig_node->batman_if) &&
+		    (orig_node->router)) {
+			if (my_skb_push(skb, sizeof(struct unicast_packet)) < 0)
+				goto unlock;
+
+			unicast_packet = (struct unicast_packet *)skb->data;
+
+			unicast_packet->version = COMPAT_VERSION;
+			/* batman packet type: unicast */
+			unicast_packet->packet_type = BAT_UNICAST;
+			/* set unicast ttl */
+			unicast_packet->ttl = TTL;
+			/* copy the destination for faster routing */
+			memcpy(unicast_packet->dest, orig_node->orig, ETH_ALEN);
+
+			/* net_dev won't be available when not active */
+			if (orig_node->batman_if->if_active != IF_ACTIVE)
+				goto unlock;
+
+			send_raw_packet(skb->data, skb->len,
+					orig_node->batman_if,
+					orig_node->router->addr);
+		} else {
+			goto unlock;
+		}
+
+		spin_unlock(&orig_hash_lock);
+	}
+
+	priv->stats.tx_packets++;
+	priv->stats.tx_bytes += data_len;
+	goto end;
+
+unlock:
+	spin_unlock(&orig_hash_lock);
+dropped:
+	priv->stats.tx_dropped++;
+end:
+	kfree_skb(skb);
+	return 0;
+}
+
+void interface_rx(struct net_device *dev, void *packet, int packet_len)
+{
+	struct sk_buff *skb;
+	struct bat_priv *priv = netdev_priv(dev);
+
+	skb = dev_alloc_skb(packet_len);
+
+	if (!skb) {
+		priv->stats.rx_dropped++;
+		goto out;
+	}
+
+	memcpy(skb_put(skb, packet_len), packet, packet_len);
+
+	/* Write metadata, and then pass to the receive level */
+	skb->dev = dev;
+	skb->protocol = eth_type_trans(skb, dev);
+	skb->ip_summed = CHECKSUM_UNNECESSARY;
+
+	priv->stats.rx_packets++;
+	priv->stats.rx_bytes += packet_len;
+
+	dev->last_rx = jiffies;
+
+	netif_rx(skb);
+
+out:
+	return;
+}
+
+/* ethtool */
+static int bat_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
+{
+	cmd->supported = 0;
+	cmd->advertising = 0;
+	cmd->speed = SPEED_10;
+	cmd->duplex = DUPLEX_FULL;
+	cmd->port = PORT_TP;
+	cmd->phy_address = 0;
+	cmd->transceiver = XCVR_INTERNAL;
+	cmd->autoneg = AUTONEG_DISABLE;
+	cmd->maxtxpkt = 0;
+	cmd->maxrxpkt = 0;
+
+	return 0;
+}
+
+static void bat_get_drvinfo(struct net_device *dev,
+			    struct ethtool_drvinfo *info)
+{
+	strcpy(info->driver, "B.A.T.M.A.N. advanced");
+	strcpy(info->version, SOURCE_VERSION);
+	strcpy(info->fw_version, "N/A");
+	strcpy(info->bus_info, "batman");
+}
+
+static u32 bat_get_msglevel(struct net_device *dev)
+{
+	return -EOPNOTSUPP;
+}
+
+static void bat_set_msglevel(struct net_device *dev, u32 value)
+{
+	return;
+}
+
+static u32 bat_get_link(struct net_device *dev)
+{
+	return 1;
+}
+
+static u32 bat_get_rx_csum(struct net_device *dev)
+{
+	return 0;
+}
+
+static int bat_set_rx_csum(struct net_device *dev, u32 data)
+{
+	return -EOPNOTSUPP;
+}
diff --git a/drivers/staging/batman-adv/soft-interface.h b/drivers/staging/batman-adv/soft-interface.h
new file mode 100644
index 000000000000..515e276ef53d
--- /dev/null
+++ b/drivers/staging/batman-adv/soft-interface.h
@@ -0,0 +1,33 @@
+/*
+ * Copyright (C) 2007-2009 B.A.T.M.A.N. contributors:
+ *
+ * Marek Lindner
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA
+ *
+ */
+
+void set_main_if_addr(uint8_t *addr);
+int main_if_was_up(void);
+void interface_setup(struct net_device *dev);
+int interface_open(struct net_device *dev);
+int interface_release(struct net_device *dev);
+struct net_device_stats *interface_stats(struct net_device *dev);
+int interface_set_mac_addr(struct net_device *dev, void *addr);
+int interface_change_mtu(struct net_device *dev, int new_mtu);
+int interface_tx(struct sk_buff *skb, struct net_device *dev);
+void interface_rx(struct net_device *dev, void *packet, int packet_len);
+
+extern unsigned char mainIfAddr[];
diff --git a/drivers/staging/batman-adv/translation-table.c b/drivers/staging/batman-adv/translation-table.c
new file mode 100644
index 000000000000..c2190e177c56
--- /dev/null
+++ b/drivers/staging/batman-adv/translation-table.c
@@ -0,0 +1,454 @@
+/*
+ * Copyright (C) 2007-2009 B.A.T.M.A.N. contributors:
+ *
+ * Marek Lindner, Simon Wunderlich
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA
+ *
+ */
+
+#include "main.h"
+#include "translation-table.h"
+#include "log.h"
+#include "soft-interface.h"
+#include "types.h"
+#include "hash.h"
+#include "compat.h"
+
+struct hashtable_t *hna_local_hash;
+static struct hashtable_t *hna_global_hash;
+atomic_t hna_local_changed;
+
+DEFINE_SPINLOCK(hna_local_hash_lock);
+static DEFINE_SPINLOCK(hna_global_hash_lock);
+
+static DECLARE_DELAYED_WORK(hna_local_purge_wq, hna_local_purge);
+
+static void hna_local_start_timer(void)
+{
+	queue_delayed_work(bat_event_workqueue, &hna_local_purge_wq, 10 * HZ);
+}
+
+int hna_local_init(void)
+{
+	if (hna_local_hash)
+		return 1;
+
+	hna_local_hash = hash_new(128, compare_orig, choose_orig);
+
+	if (!hna_local_hash)
+		return 0;
+
+	atomic_set(&hna_local_changed, 0);
+	hna_local_start_timer();
+
+	return 1;
+}
+
+void hna_local_add(uint8_t *addr)
+{
+	struct hna_local_entry *hna_local_entry;
+	struct hna_global_entry *hna_global_entry;
+	struct hashtable_t *swaphash;
+	char hna_str[ETH_STR_LEN];
+	unsigned long flags;
+
+	spin_lock_irqsave(&hna_local_hash_lock, flags);
+	hna_local_entry =
+		((struct hna_local_entry *)hash_find(hna_local_hash, addr));
+	spin_unlock_irqrestore(&hna_local_hash_lock, flags);
+
+	if (hna_local_entry != NULL) {
+		hna_local_entry->last_seen = jiffies;
+		return;
+	}
+
+	addr_to_string(hna_str, addr);
+
+	/* only announce as many hosts as possible in the batman-packet and
+	   space in batman_packet->num_hna That also should give a limit to
+	   MAC-flooding. */
+	if ((num_hna + 1 > (ETH_DATA_LEN - BAT_PACKET_LEN) / ETH_ALEN) ||
+	    (num_hna + 1 > 255)) {
+		debug_log(LOG_TYPE_ROUTES, "Can't add new local hna entry (%s): number of local hna entries exceeds packet size \n", hna_str);
+		return;
+	}
+
+	debug_log(LOG_TYPE_ROUTES, "Creating new local hna entry: %s \n",
+		  hna_str);
+
+	hna_local_entry = kmalloc(sizeof(struct hna_local_entry), GFP_ATOMIC);
+	if (!hna_local_entry)
+		return;
+
+	memcpy(hna_local_entry->addr, addr, ETH_ALEN);
+	hna_local_entry->last_seen = jiffies;
+
+	/* the batman interface mac address should never be purged */
+	if (compare_orig(addr, soft_device->dev_addr))
+		hna_local_entry->never_purge = 1;
+	else
+		hna_local_entry->never_purge = 0;
+
+	spin_lock_irqsave(&hna_local_hash_lock, flags);
+
+	hash_add(hna_local_hash, hna_local_entry);
+	num_hna++;
+	atomic_set(&hna_local_changed, 1);
+
+	if (hna_local_hash->elements * 4 > hna_local_hash->size) {
+		swaphash = hash_resize(hna_local_hash,
+				       hna_local_hash->size * 2);
+
+		if (swaphash == NULL)
+			debug_log(LOG_TYPE_CRIT, "Couldn't resize local hna hash table \n");
+		else
+			hna_local_hash = swaphash;
+	}
+
+	spin_unlock_irqrestore(&hna_local_hash_lock, flags);
+
+	/* remove address from global hash if present */
+	spin_lock_irqsave(&hna_global_hash_lock, flags);
+
+	hna_global_entry =
+		((struct hna_global_entry *)hash_find(hna_global_hash, addr));
+
+	if (hna_global_entry != NULL)
+		_hna_global_del_orig(hna_global_entry, "local hna received");
+
+	spin_unlock_irqrestore(&hna_global_hash_lock, flags);
+}
+
+int hna_local_fill_buffer(unsigned char *buff, int buff_len)
+{
+	struct hna_local_entry *hna_local_entry;
+	struct hash_it_t *hashit = NULL;
+	int i = 0;
+	unsigned long flags;
+
+	spin_lock_irqsave(&hna_local_hash_lock, flags);
+
+	while (NULL != (hashit = hash_iterate(hna_local_hash, hashit))) {
+
+		if (buff_len < (i + 1) * ETH_ALEN)
+			break;
+
+		hna_local_entry = hashit->bucket->data;
+		memcpy(buff + (i * ETH_ALEN), hna_local_entry->addr, ETH_ALEN);
+
+		i++;
+	}
+
+	/* if we did not get all new local hnas see you next time  ;-) */
+	if (i == num_hna)
+		atomic_set(&hna_local_changed, 0);
+
+	spin_unlock_irqrestore(&hna_local_hash_lock, flags);
+
+	return i;
+}
+
+int hna_local_fill_buffer_text(unsigned char *buff, int buff_len)
+{
+	struct hna_local_entry *hna_local_entry;
+	struct hash_it_t *hashit = NULL;
+	int bytes_written = 0;
+	unsigned long flags;
+
+	spin_lock_irqsave(&hna_local_hash_lock, flags);
+
+	while (NULL != (hashit = hash_iterate(hna_local_hash, hashit))) {
+
+		if (buff_len < bytes_written + ETH_STR_LEN + 4)
+			break;
+
+		hna_local_entry = hashit->bucket->data;
+
+		bytes_written += snprintf(buff + bytes_written, ETH_STR_LEN + 4,
+					  " * %02x:%02x:%02x:%02x:%02x:%02x\n",
+					  hna_local_entry->addr[0],
+					  hna_local_entry->addr[1],
+					  hna_local_entry->addr[2],
+					  hna_local_entry->addr[3],
+					  hna_local_entry->addr[4],
+					  hna_local_entry->addr[5]);
+	}
+
+	spin_unlock_irqrestore(&hna_local_hash_lock, flags);
+
+	return bytes_written;
+}
+
+static void _hna_local_del(void *data)
+{
+	kfree(data);
+	num_hna--;
+	atomic_set(&hna_local_changed, 1);
+}
+
+static void hna_local_del(struct hna_local_entry *hna_local_entry,
+			  char *message)
+{
+	char hna_str[ETH_STR_LEN];
+
+	addr_to_string(hna_str, hna_local_entry->addr);
+	debug_log(LOG_TYPE_ROUTES, "Deleting local hna entry (%s): %s \n",
+		  hna_str, message);
+
+	hash_remove(hna_local_hash, hna_local_entry->addr);
+	_hna_local_del(hna_local_entry);
+}
+
+void hna_local_purge(struct work_struct *work)
+{
+	struct hna_local_entry *hna_local_entry;
+	struct hash_it_t *hashit = NULL;
+	unsigned long flags;
+	unsigned long timeout;
+
+	spin_lock_irqsave(&hna_local_hash_lock, flags);
+
+	while (NULL != (hashit = hash_iterate(hna_local_hash, hashit))) {
+		hna_local_entry = hashit->bucket->data;
+
+		timeout = hna_local_entry->last_seen +
+			((LOCAL_HNA_TIMEOUT / 1000) * HZ);
+		if ((!hna_local_entry->never_purge) &&
+		    time_after(jiffies, timeout))
+			hna_local_del(hna_local_entry, "address timed out");
+	}
+
+	spin_unlock_irqrestore(&hna_local_hash_lock, flags);
+	hna_local_start_timer();
+}
+
+void hna_local_free(void)
+{
+	if (!hna_local_hash)
+		return;
+
+	cancel_delayed_work_sync(&hna_local_purge_wq);
+	hash_delete(hna_local_hash, _hna_local_del);
+	hna_local_hash = NULL;
+}
+
+int hna_global_init(void)
+{
+	if (hna_global_hash)
+		return 1;
+
+	hna_global_hash = hash_new(128, compare_orig, choose_orig);
+
+	if (!hna_global_hash)
+		return 0;
+
+	return 1;
+}
+
+void hna_global_add_orig(struct orig_node *orig_node,
+			 unsigned char *hna_buff, int hna_buff_len)
+{
+	struct hna_global_entry *hna_global_entry;
+	struct hna_local_entry *hna_local_entry;
+	struct hashtable_t *swaphash;
+	char hna_str[ETH_STR_LEN], orig_str[ETH_STR_LEN];
+	int hna_buff_count = 0;
+	unsigned long flags;
+	unsigned char *hna_ptr;
+
+	addr_to_string(orig_str, orig_node->orig);
+
+	while ((hna_buff_count + 1) * ETH_ALEN <= hna_buff_len) {
+		spin_lock_irqsave(&hna_global_hash_lock, flags);
+
+		hna_ptr = hna_buff + (hna_buff_count * ETH_ALEN);
+		hna_global_entry = (struct hna_global_entry *)
+			hash_find(hna_global_hash, hna_ptr);
+
+		if (hna_global_entry == NULL) {
+			spin_unlock_irqrestore(&hna_global_hash_lock, flags);
+
+			hna_global_entry =
+				kmalloc(sizeof(struct hna_global_entry),
+					GFP_ATOMIC);
+
+			if (!hna_global_entry)
+				break;
+
+			memcpy(hna_global_entry->addr, hna_ptr, ETH_ALEN);
+
+			addr_to_string(hna_str, hna_global_entry->addr);
+			debug_log(LOG_TYPE_ROUTES, "Creating new global hna entry: %s (via %s)\n", hna_str, orig_str);
+
+			spin_lock_irqsave(&hna_global_hash_lock, flags);
+			hash_add(hna_global_hash, hna_global_entry);
+
+		}
+
+		hna_global_entry->orig_node = orig_node;
+		spin_unlock_irqrestore(&hna_global_hash_lock, flags);
+
+		/* remove address from local hash if present */
+		spin_lock_irqsave(&hna_local_hash_lock, flags);
+
+		hna_ptr = hna_buff + (hna_buff_count * ETH_ALEN);
+		hna_local_entry = (struct hna_local_entry *)
+			hash_find(hna_local_hash, hna_ptr);
+
+		if (hna_local_entry != NULL)
+			hna_local_del(hna_local_entry, "global hna received");
+
+		spin_unlock_irqrestore(&hna_local_hash_lock, flags);
+
+		hna_buff_count++;
+	}
+
+	orig_node->hna_buff_len = hna_buff_len;
+
+	if (orig_node->hna_buff_len > 0) {
+		orig_node->hna_buff = kmalloc(orig_node->hna_buff_len,
+					      GFP_ATOMIC);
+		memcpy(orig_node->hna_buff, hna_buff, orig_node->hna_buff_len);
+	} else {
+		orig_node->hna_buff = NULL;
+	}
+
+	spin_lock_irqsave(&hna_global_hash_lock, flags);
+
+	if (hna_global_hash->elements * 4 > hna_global_hash->size) {
+		swaphash = hash_resize(hna_global_hash,
+				       hna_global_hash->size * 2);
+
+		if (swaphash == NULL)
+			debug_log(LOG_TYPE_CRIT, "Couldn't resize global hna hash table \n");
+		else
+			hna_global_hash = swaphash;
+	}
+
+	spin_unlock_irqrestore(&hna_global_hash_lock, flags);
+}
+
+int hna_global_fill_buffer_text(unsigned char *buff, int buff_len)
+{
+	struct hna_global_entry *hna_global_entry;
+	struct hash_it_t *hashit = NULL;
+	int bytes_written = 0;
+	unsigned long flags;
+
+	spin_lock_irqsave(&hna_global_hash_lock, flags);
+
+	while (NULL != (hashit = hash_iterate(hna_global_hash, hashit))) {
+		if (buff_len < bytes_written + (2 * ETH_STR_LEN) + 10)
+			break;
+
+		hna_global_entry = hashit->bucket->data;
+
+		bytes_written += snprintf(buff + bytes_written,
+					  (2 * ETH_STR_LEN) + 10,
+					  " * %02x:%02x:%02x:%02x:%02x:%02x via %02x:%02x:%02x:%02x:%02x:%02x \n",
+					  hna_global_entry->addr[0],
+					  hna_global_entry->addr[1],
+					  hna_global_entry->addr[2],
+					  hna_global_entry->addr[3],
+					  hna_global_entry->addr[4],
+					  hna_global_entry->addr[5],
+					  hna_global_entry->orig_node->orig[0],
+					  hna_global_entry->orig_node->orig[1],
+					  hna_global_entry->orig_node->orig[2],
+					  hna_global_entry->orig_node->orig[3],
+					  hna_global_entry->orig_node->orig[4],
+					  hna_global_entry->orig_node->orig[5]);
+	}
+
+	spin_unlock_irqrestore(&hna_global_hash_lock, flags);
+
+	return bytes_written;
+}
+
+void _hna_global_del_orig(struct hna_global_entry *hna_global_entry,
+			  char *message)
+{
+	char hna_str[ETH_STR_LEN], orig_str[ETH_STR_LEN];
+
+	addr_to_string(orig_str, hna_global_entry->orig_node->orig);
+	addr_to_string(hna_str, hna_global_entry->addr);
+
+	debug_log(LOG_TYPE_ROUTES, "Deleting global hna entry %s (via %s): %s \n", hna_str, orig_str, message);
+
+	hash_remove(hna_global_hash, hna_global_entry->addr);
+	kfree(hna_global_entry);
+}
+
+void hna_global_del_orig(struct orig_node *orig_node, char *message)
+{
+	struct hna_global_entry *hna_global_entry;
+	int hna_buff_count = 0;
+	unsigned long flags;
+	unsigned char *hna_ptr;
+
+	if (orig_node->hna_buff_len == 0)
+		return;
+
+	spin_lock_irqsave(&hna_global_hash_lock, flags);
+
+	while ((hna_buff_count + 1) * ETH_ALEN <= orig_node->hna_buff_len) {
+		hna_ptr = orig_node->hna_buff + (hna_buff_count * ETH_ALEN);
+		hna_global_entry = (struct hna_global_entry *)
+			hash_find(hna_global_hash, hna_ptr);
+
+		if ((hna_global_entry != NULL) &&
+		    (hna_global_entry->orig_node == orig_node))
+			_hna_global_del_orig(hna_global_entry, message);
+
+		hna_buff_count++;
+	}
+
+	spin_unlock_irqrestore(&hna_global_hash_lock, flags);
+
+	orig_node->hna_buff_len = 0;
+	kfree(orig_node->hna_buff);
+	orig_node->hna_buff = NULL;
+}
+
+static void hna_global_del(void *data)
+{
+	kfree(data);
+}
+
+void hna_global_free(void)
+{
+	if (!hna_global_hash)
+		return;
+
+	hash_delete(hna_global_hash, hna_global_del);
+	hna_global_hash = NULL;
+}
+
+struct orig_node *transtable_search(uint8_t *addr)
+{
+	struct hna_global_entry *hna_global_entry;
+	unsigned long flags;
+
+	spin_lock_irqsave(&hna_global_hash_lock, flags);
+	hna_global_entry = (struct hna_global_entry *)
+		hash_find(hna_global_hash, addr);
+	spin_unlock_irqrestore(&hna_global_hash_lock, flags);
+
+	if (hna_global_entry == NULL)
+		return NULL;
+
+	return hna_global_entry->orig_node;
+}
diff --git a/drivers/staging/batman-adv/translation-table.h b/drivers/staging/batman-adv/translation-table.h
new file mode 100644
index 000000000000..f7da81129318
--- /dev/null
+++ b/drivers/staging/batman-adv/translation-table.h
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2007-2009 B.A.T.M.A.N. contributors:
+ *
+ * Marek Lindner, Simon Wunderlich
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA
+ *
+ */
+
+#include "types.h"
+
+int hna_local_init(void);
+void hna_local_add(uint8_t *addr);
+int hna_local_fill_buffer(unsigned char *buff, int buff_len);
+int hna_local_fill_buffer_text(unsigned char *buff, int buff_len);
+void hna_local_purge(struct work_struct *work);
+void hna_local_free(void);
+int hna_global_init(void);
+void hna_global_add_orig(struct orig_node *orig_node, unsigned char *hna_buff,
+			 int hna_buff_len);
+int hna_global_fill_buffer_text(unsigned char *buff, int buff_len);
+void _hna_global_del_orig(struct hna_global_entry *hna_global_entry,
+			  char *orig_str);
+void hna_global_del_orig(struct orig_node *orig_node, char *message);
+void hna_global_free(void);
+struct orig_node *transtable_search(uint8_t *addr);
+
+extern spinlock_t hna_local_hash_lock;
+extern struct hashtable_t *hna_local_hash;
+extern atomic_t hna_local_changed;
diff --git a/drivers/staging/batman-adv/types.h b/drivers/staging/batman-adv/types.h
new file mode 100644
index 000000000000..3a0ef0c38c93
--- /dev/null
+++ b/drivers/staging/batman-adv/types.h
@@ -0,0 +1,124 @@
+/*
+ * Copyright (C) 2007-2009 B.A.T.M.A.N. contributors:
+ *
+ * Marek Lindner, Simon Wunderlich
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA
+ *
+ */
+
+
+
+
+
+#ifndef TYPES_H
+#define TYPES_H
+
+#include "packet.h"
+#include "bitarray.h"
+
+#define BAT_HEADER_LEN (sizeof(struct ethhdr) + ((sizeof(struct unicast_packet) > sizeof(struct bcast_packet) ? sizeof(struct unicast_packet) : sizeof(struct bcast_packet))))
+
+
+struct batman_if {
+	struct list_head list;
+	int16_t if_num;
+	char *dev;
+	char if_active;
+	char addr_str[ETH_STR_LEN];
+	struct net_device *net_dev;
+	struct socket *raw_sock;
+	atomic_t seqno;
+	unsigned char *packet_buff;
+	int packet_len;
+	struct rcu_head rcu;
+
+};
+
+struct orig_node {               /* structure for orig_list maintaining nodes of mesh */
+	uint8_t orig[ETH_ALEN];
+	struct neigh_node *router;
+	struct batman_if *batman_if;
+	TYPE_OF_WORD *bcast_own;
+	uint8_t *bcast_own_sum;
+	uint8_t tq_own;
+	int tq_asym_penalty;
+	unsigned long last_valid;        /* when last packet from this node was received */
+/*	uint8_t  gwflags;      * flags related to gateway functions: gateway class */
+	uint8_t  flags;    		/* for now only VIS_SERVER flag. */
+	unsigned char *hna_buff;
+	int16_t  hna_buff_len;
+	uint16_t last_real_seqno;   /* last and best known squence number */
+	uint8_t last_ttl;         /* ttl of last received packet */
+	TYPE_OF_WORD bcast_bits[NUM_WORDS];
+	uint16_t last_bcast_seqno;  /* last broadcast sequence number received by this host */
+	struct list_head neigh_list;
+};
+
+struct neigh_node {
+	struct list_head list;
+	uint8_t addr[ETH_ALEN];
+	uint8_t real_packet_count;
+	uint8_t tq_recv[TQ_GLOBAL_WINDOW_SIZE];
+	uint8_t tq_index;
+	uint8_t tq_avg;
+	uint8_t last_ttl;
+	unsigned long last_valid;            /* when last packet via this neighbour was received */
+	TYPE_OF_WORD real_bits[NUM_WORDS];
+	struct orig_node *orig_node;
+	struct batman_if *if_incoming;
+};
+
+struct bat_priv {
+	struct net_device_stats stats;
+};
+
+struct device_client {
+	struct list_head queue_list;
+	unsigned int queue_len;
+	unsigned char index;
+	spinlock_t lock;
+	wait_queue_head_t queue_wait;
+};
+
+struct device_packet {
+	struct list_head list;
+	struct icmp_packet icmp_packet;
+};
+
+struct hna_local_entry {
+	uint8_t addr[ETH_ALEN];
+	unsigned long last_seen;
+	char never_purge;
+};
+
+struct hna_global_entry {
+	uint8_t addr[ETH_ALEN];
+	struct orig_node *orig_node;
+};
+
+struct forw_packet {               /* structure for forw_list maintaining packets to be send/forwarded */
+	struct hlist_node list;
+	unsigned long send_time;
+	uint8_t own;
+	unsigned char *packet_buff;
+	uint16_t packet_len;
+	uint32_t direct_link_flags;
+	uint8_t num_packets;
+	struct delayed_work delayed_work;
+	struct batman_if *if_incoming;
+};
+
+#endif
diff --git a/drivers/staging/batman-adv/vis.c b/drivers/staging/batman-adv/vis.c
new file mode 100644
index 000000000000..f6c9acb289ed
--- /dev/null
+++ b/drivers/staging/batman-adv/vis.c
@@ -0,0 +1,564 @@
+/*
+ * Copyright (C) 2008-2009 B.A.T.M.A.N. contributors:
+ *
+ * Simon Wunderlich
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA
+ *
+ */
+
+#include "main.h"
+#include "send.h"
+#include "translation-table.h"
+#include "vis.h"
+#include "log.h"
+#include "soft-interface.h"
+#include "hard-interface.h"
+#include "hash.h"
+#include "compat.h"
+
+struct hashtable_t *vis_hash;
+DEFINE_SPINLOCK(vis_hash_lock);
+static struct vis_info *my_vis_info;
+static struct list_head send_list;	/* always locked with vis_hash_lock */
+
+static void start_vis_timer(void);
+
+/* free the info */
+static void free_info(void *data)
+{
+	struct vis_info *info = data;
+	struct recvlist_node *entry, *tmp;
+
+	list_del_init(&info->send_list);
+	list_for_each_entry_safe(entry, tmp, &info->recv_list, list) {
+		list_del(&entry->list);
+		kfree(entry);
+	}
+	kfree(info);
+}
+
+/* set the mode of the visualization to client or server */
+void vis_set_mode(int mode)
+{
+	spin_lock(&vis_hash_lock);
+
+	if (my_vis_info != NULL)
+		my_vis_info->packet.vis_type = mode;
+
+	spin_unlock(&vis_hash_lock);
+}
+
+/* is_vis_server(), locked outside */
+static int is_vis_server_locked(void)
+{
+	if (my_vis_info != NULL)
+		if (my_vis_info->packet.vis_type == VIS_TYPE_SERVER_SYNC)
+			return 1;
+
+	return 0;
+}
+
+/* get the current set mode */
+int is_vis_server(void)
+{
+	int ret = 0;
+
+	spin_lock(&vis_hash_lock);
+	ret = is_vis_server_locked();
+	spin_unlock(&vis_hash_lock);
+
+	return ret;
+}
+
+/* Compare two vis packets, used by the hashing algorithm */
+static int vis_info_cmp(void *data1, void *data2)
+{
+	struct vis_info *d1, *d2;
+	d1 = data1;
+	d2 = data2;
+	return compare_orig(d1->packet.vis_orig, d2->packet.vis_orig);
+}
+
+/* hash function to choose an entry in a hash table of given size */
+/* hash algorithm from http://en.wikipedia.org/wiki/Hash_table */
+static int vis_info_choose(void *data, int size)
+{
+	struct vis_info *vis_info = data;
+	unsigned char *key;
+	uint32_t hash = 0;
+	size_t i;
+
+	key = vis_info->packet.vis_orig;
+	for (i = 0; i < ETH_ALEN; i++) {
+		hash += key[i];
+		hash += (hash << 10);
+		hash ^= (hash >> 6);
+	}
+
+	hash += (hash << 3);
+	hash ^= (hash >> 11);
+	hash += (hash << 15);
+
+	return hash % size;
+}
+
+/* tries to add one entry to the receive list. */
+static void recv_list_add(struct list_head *recv_list, char *mac)
+{
+	struct recvlist_node *entry;
+	entry = kmalloc(sizeof(struct recvlist_node), GFP_ATOMIC);
+	if (!entry)
+		return;
+
+	memcpy(entry->mac, mac, ETH_ALEN);
+	list_add_tail(&entry->list, recv_list);
+}
+
+/* returns 1 if this mac is in the recv_list */
+static int recv_list_is_in(struct list_head *recv_list, char *mac)
+{
+	struct recvlist_node *entry;
+
+	list_for_each_entry(entry, recv_list, list) {
+		if (memcmp(entry->mac, mac, ETH_ALEN) == 0)
+			return 1;
+	}
+
+	return 0;
+}
+
+/* try to add the packet to the vis_hash. return NULL if invalid (e.g. too old,
+ * broken.. ).  vis hash must be locked outside.  is_new is set when the packet
+ * is newer than old entries in the hash. */
+static struct vis_info *add_packet(struct vis_packet *vis_packet,
+				   int vis_info_len, int *is_new)
+{
+	struct vis_info *info, *old_info;
+	struct vis_info search_elem;
+
+	*is_new = 0;
+	/* sanity check */
+	if (vis_hash == NULL)
+		return NULL;
+
+	/* see if the packet is already in vis_hash */
+	memcpy(search_elem.packet.vis_orig, vis_packet->vis_orig, ETH_ALEN);
+	old_info = hash_find(vis_hash, &search_elem);
+
+	if (old_info != NULL) {
+		if (vis_packet->seqno - old_info->packet.seqno <= 0) {
+			if (old_info->packet.seqno == vis_packet->seqno) {
+				recv_list_add(&old_info->recv_list,
+					      vis_packet->sender_orig);
+				return old_info;
+			} else {
+				/* newer packet is already in hash. */
+				return NULL;
+			}
+		}
+		/* remove old entry */
+		hash_remove(vis_hash, old_info);
+		free_info(old_info);
+	}
+
+	info = kmalloc(sizeof(struct vis_info) + vis_info_len, GFP_ATOMIC);
+	if (info == NULL)
+		return NULL;
+
+	INIT_LIST_HEAD(&info->send_list);
+	INIT_LIST_HEAD(&info->recv_list);
+	info->first_seen = jiffies;
+	memcpy(&info->packet, vis_packet,
+	       sizeof(struct vis_packet) + vis_info_len);
+
+	/* initialize and add new packet. */
+	*is_new = 1;
+
+	/* repair if entries is longer than packet. */
+	if (info->packet.entries * sizeof(struct vis_info_entry) > vis_info_len)
+		info->packet.entries = vis_info_len / sizeof(struct vis_info_entry);
+
+	recv_list_add(&info->recv_list, info->packet.sender_orig);
+
+	/* try to add it */
+	if (hash_add(vis_hash, info) < 0) {
+		/* did not work (for some reason) */
+		free_info(info);
+		info = NULL;
+	}
+
+	return info;
+}
+
+/* handle the server sync packet, forward if needed. */
+void receive_server_sync_packet(struct vis_packet *vis_packet, int vis_info_len)
+{
+	struct vis_info *info;
+	int is_new;
+
+	spin_lock(&vis_hash_lock);
+	info = add_packet(vis_packet, vis_info_len, &is_new);
+	if (info == NULL)
+		goto end;
+
+	/* only if we are server ourselves and packet is newer than the one in
+	 * hash.*/
+	if (is_vis_server_locked() && is_new) {
+		memcpy(info->packet.target_orig, broadcastAddr, ETH_ALEN);
+		if (list_empty(&info->send_list))
+			list_add_tail(&info->send_list, &send_list);
+	}
+end:
+	spin_unlock(&vis_hash_lock);
+}
+
+/* handle an incoming client update packet and schedule forward if needed. */
+void receive_client_update_packet(struct vis_packet *vis_packet,
+				  int vis_info_len)
+{
+	struct vis_info *info;
+	int is_new;
+
+	/* clients shall not broadcast. */
+	if (is_bcast(vis_packet->target_orig))
+		return;
+
+	spin_lock(&vis_hash_lock);
+	info = add_packet(vis_packet, vis_info_len, &is_new);
+	if (info == NULL)
+		goto end;
+	/* note that outdated packets will be dropped at this point. */
+
+
+	/* send only if we're the target server or ... */
+	if (is_vis_server_locked() &&
+	    is_my_mac(info->packet.target_orig) &&
+	    is_new) {
+		info->packet.vis_type = VIS_TYPE_SERVER_SYNC;	/* upgrade! */
+		memcpy(info->packet.target_orig, broadcastAddr, ETH_ALEN);
+		if (list_empty(&info->send_list))
+			list_add_tail(&info->send_list, &send_list);
+
+		/* ... we're not the recipient (and thus need to forward). */
+	} else if (!is_my_mac(info->packet.target_orig)) {
+		if (list_empty(&info->send_list))
+			list_add_tail(&info->send_list, &send_list);
+	}
+end:
+	spin_unlock(&vis_hash_lock);
+}
+
+/* Walk the originators and find the VIS server with the best tq. Set the packet
+ * address to its address and return the best_tq.
+ *
+ * Must be called with the originator hash locked */
+static int find_best_vis_server(struct vis_info *info)
+{
+	struct hash_it_t *hashit = NULL;
+	struct orig_node *orig_node;
+	int best_tq = -1;
+
+	while (NULL != (hashit = hash_iterate(orig_hash, hashit))) {
+		orig_node = hashit->bucket->data;
+		if ((orig_node != NULL) &&
+		    (orig_node->router != NULL) &&
+		    (orig_node->flags & VIS_SERVER) &&
+		    (orig_node->router->tq_avg > best_tq)) {
+			best_tq = orig_node->router->tq_avg;
+			memcpy(info->packet.target_orig, orig_node->orig,
+			       ETH_ALEN);
+		}
+	}
+	return best_tq;
+}
+
+/* Return true if the vis packet is full. */
+static bool vis_packet_full(struct vis_info *info)
+{
+	if (info->packet.entries + 1 >
+	    (1000 - sizeof(struct vis_info)) / sizeof(struct vis_info_entry))
+		return true;
+	return false;
+}
+
+/* generates a packet of own vis data,
+ * returns 0 on success, -1 if no packet could be generated */
+static int generate_vis_packet(void)
+{
+	struct hash_it_t *hashit = NULL;
+	struct orig_node *orig_node;
+	struct vis_info *info = (struct vis_info *)my_vis_info;
+	struct vis_info_entry *entry, *entry_array;
+	struct hna_local_entry *hna_local_entry;
+	int best_tq = -1;
+	unsigned long flags;
+
+	info->first_seen = jiffies;
+
+	spin_lock(&orig_hash_lock);
+	memcpy(info->packet.target_orig, broadcastAddr, ETH_ALEN);
+	info->packet.ttl = TTL;
+	info->packet.seqno++;
+	info->packet.entries = 0;
+
+	if (!is_vis_server_locked()) {
+		best_tq = find_best_vis_server(info);
+		if (best_tq < 0) {
+			spin_unlock(&orig_hash_lock);
+			return -1;
+		}
+	}
+	hashit = NULL;
+
+	entry_array = (struct vis_info_entry *)
+		((char *)info + sizeof(struct vis_info));
+
+	while (NULL != (hashit = hash_iterate(orig_hash, hashit))) {
+		orig_node = hashit->bucket->data;
+		if (orig_node->router != NULL
+			&& compare_orig(orig_node->router->addr, orig_node->orig)
+			&& orig_node->batman_if
+			&& (orig_node->batman_if->if_active == IF_ACTIVE)
+		    && orig_node->router->tq_avg > 0) {
+
+			/* fill one entry into buffer. */
+			entry = &entry_array[info->packet.entries];
+			memcpy(entry->src, orig_node->batman_if->net_dev->dev_addr, ETH_ALEN);
+			memcpy(entry->dest, orig_node->orig, ETH_ALEN);
+			entry->quality = orig_node->router->tq_avg;
+			info->packet.entries++;
+
+			if (vis_packet_full(info)) {
+				spin_unlock(&orig_hash_lock);
+				return 0;
+			}
+		}
+	}
+
+	spin_unlock(&orig_hash_lock);
+
+	hashit = NULL;
+	spin_lock_irqsave(&hna_local_hash_lock, flags);
+	while (NULL != (hashit = hash_iterate(hna_local_hash, hashit))) {
+		hna_local_entry = hashit->bucket->data;
+		entry = &entry_array[info->packet.entries];
+		memset(entry->src, 0, ETH_ALEN);
+		memcpy(entry->dest, hna_local_entry->addr, ETH_ALEN);
+		entry->quality = 0; /* 0 means HNA */
+		info->packet.entries++;
+
+		if (vis_packet_full(info)) {
+			spin_unlock_irqrestore(&hna_local_hash_lock, flags);
+			return 0;
+		}
+	}
+	spin_unlock_irqrestore(&hna_local_hash_lock, flags);
+	return 0;
+}
+
+static void purge_vis_packets(void)
+{
+	struct hash_it_t *hashit = NULL;
+	struct vis_info *info;
+
+	while (NULL != (hashit = hash_iterate(vis_hash, hashit))) {
+		info = hashit->bucket->data;
+		if (info == my_vis_info)	/* never purge own data. */
+			continue;
+		if (time_after(jiffies,
+			       info->first_seen + (VIS_TIMEOUT/1000)*HZ)) {
+			hash_remove_bucket(vis_hash, hashit);
+			free_info(info);
+		}
+	}
+}
+
+static void broadcast_vis_packet(struct vis_info *info, int packet_length)
+{
+	struct hash_it_t *hashit = NULL;
+	struct orig_node *orig_node;
+
+	spin_lock(&orig_hash_lock);
+
+	/* send to all routers in range. */
+	while (NULL != (hashit = hash_iterate(orig_hash, hashit))) {
+		orig_node = hashit->bucket->data;
+
+		/* if it's a vis server and reachable, send it. */
+		if (orig_node &&
+		    (orig_node->flags & VIS_SERVER) &&
+		    orig_node->batman_if &&
+		    orig_node->router) {
+
+			/* don't send it if we already received the packet from
+			 * this node. */
+			if (recv_list_is_in(&info->recv_list, orig_node->orig))
+				continue;
+
+			memcpy(info->packet.target_orig,
+			       orig_node->orig, ETH_ALEN);
+
+			send_raw_packet((unsigned char *) &info->packet,
+					packet_length,
+					orig_node->batman_if,
+					orig_node->router->addr);
+		}
+	}
+	memcpy(info->packet.target_orig, broadcastAddr, ETH_ALEN);
+	spin_unlock(&orig_hash_lock);
+}
+
+static void unicast_vis_packet(struct vis_info *info, int packet_length)
+{
+	struct orig_node *orig_node;
+
+	spin_lock(&orig_hash_lock);
+	orig_node = ((struct orig_node *)
+		     hash_find(orig_hash, info->packet.target_orig));
+
+	if ((orig_node != NULL) &&
+	    (orig_node->batman_if != NULL) &&
+	    (orig_node->router != NULL)) {
+		send_raw_packet((unsigned char *) &info->packet, packet_length,
+				orig_node->batman_if,
+				orig_node->router->addr);
+	}
+	spin_unlock(&orig_hash_lock);
+}
+
+/* only send one vis packet. called from send_vis_packets() */
+static void send_vis_packet(struct vis_info *info)
+{
+	int packet_length;
+
+	if (info->packet.ttl < 2) {
+		debug_log(LOG_TYPE_NOTICE,
+			  "Error - can't send vis packet: ttl exceeded\n");
+		return;
+	}
+
+	memcpy(info->packet.sender_orig, mainIfAddr, ETH_ALEN);
+	info->packet.ttl--;
+
+	packet_length = sizeof(struct vis_packet) +
+		info->packet.entries * sizeof(struct vis_info_entry);
+
+	if (is_bcast(info->packet.target_orig))
+		broadcast_vis_packet(info, packet_length);
+	else
+		unicast_vis_packet(info, packet_length);
+	info->packet.ttl++; /* restore TTL */
+}
+
+/* called from timer; send (and maybe generate) vis packet. */
+static void send_vis_packets(struct work_struct *work)
+{
+	struct vis_info *info, *temp;
+
+	spin_lock(&vis_hash_lock);
+	purge_vis_packets();
+
+	if (generate_vis_packet() == 0)
+		/* schedule if generation was successful */
+		list_add_tail(&my_vis_info->send_list, &send_list);
+
+	list_for_each_entry_safe(info, temp, &send_list, send_list) {
+		list_del_init(&info->send_list);
+		send_vis_packet(info);
+	}
+	spin_unlock(&vis_hash_lock);
+	start_vis_timer();
+}
+static DECLARE_DELAYED_WORK(vis_timer_wq, send_vis_packets);
+
+/* init the vis server. this may only be called when if_list is already
+ * initialized (e.g. bat0 is initialized, interfaces have been added) */
+int vis_init(void)
+{
+	if (vis_hash)
+		return 1;
+
+	spin_lock(&vis_hash_lock);
+
+	vis_hash = hash_new(256, vis_info_cmp, vis_info_choose);
+	if (!vis_hash) {
+		debug_log(LOG_TYPE_CRIT, "Can't initialize vis_hash\n");
+		goto err;
+	}
+
+	my_vis_info = kmalloc(1000, GFP_ATOMIC);
+	if (!my_vis_info) {
+		debug_log(LOG_TYPE_CRIT, "Can't initialize vis packet\n");
+		goto err;
+	}
+
+	/* prefill the vis info */
+	my_vis_info->first_seen = jiffies - atomic_read(&vis_interval);
+	INIT_LIST_HEAD(&my_vis_info->recv_list);
+	INIT_LIST_HEAD(&my_vis_info->send_list);
+	my_vis_info->packet.version = COMPAT_VERSION;
+	my_vis_info->packet.packet_type = BAT_VIS;
+	my_vis_info->packet.vis_type = VIS_TYPE_CLIENT_UPDATE;
+	my_vis_info->packet.ttl = TTL;
+	my_vis_info->packet.seqno = 0;
+	my_vis_info->packet.entries = 0;
+
+	INIT_LIST_HEAD(&send_list);
+
+	memcpy(my_vis_info->packet.vis_orig, mainIfAddr, ETH_ALEN);
+	memcpy(my_vis_info->packet.sender_orig, mainIfAddr, ETH_ALEN);
+
+	if (hash_add(vis_hash, my_vis_info) < 0) {
+		debug_log(LOG_TYPE_CRIT,
+			  "Can't add own vis packet into hash\n");
+		free_info(my_vis_info);	/* not in hash, need to remove it
+					 * manually. */
+		goto err;
+	}
+
+	spin_unlock(&vis_hash_lock);
+	start_vis_timer();
+	return 1;
+
+err:
+	spin_unlock(&vis_hash_lock);
+	vis_quit();
+	return 0;
+}
+
+/* shutdown vis-server */
+void vis_quit(void)
+{
+	if (!vis_hash)
+		return;
+
+	cancel_delayed_work_sync(&vis_timer_wq);
+
+	spin_lock(&vis_hash_lock);
+	/* properly remove, kill timers ... */
+	hash_delete(vis_hash, free_info);
+	vis_hash = NULL;
+	my_vis_info = NULL;
+	spin_unlock(&vis_hash_lock);
+}
+
+/* schedule packets for (re)transmission */
+static void start_vis_timer(void)
+{
+	queue_delayed_work(bat_event_workqueue, &vis_timer_wq,
+			   (atomic_read(&vis_interval)/1000) * HZ);
+}
+
diff --git a/drivers/staging/batman-adv/vis.h b/drivers/staging/batman-adv/vis.h
new file mode 100644
index 000000000000..276fabab4e88
--- /dev/null
+++ b/drivers/staging/batman-adv/vis.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2008-2009 B.A.T.M.A.N. contributors:
+ *
+ * Simon Wunderlich, Marek Lindner
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA
+ *
+ */
+
+#define VIS_TIMEOUT		200000
+#define VIS_FORMAT_DD_NAME	"dot_draw"
+#define VIS_FORMAT_JSON_NAME	"json"
+
+struct vis_info {
+	unsigned long       first_seen;
+	struct list_head    recv_list;
+			    /* list of server-neighbors we received a vis-packet
+			     * from.  we should not reply to them. */
+	struct list_head send_list;
+	/* this packet might be part of the vis send queue. */
+	struct vis_packet packet;
+	/* vis_info may follow here*/
+} __attribute__((packed));
+
+struct vis_info_entry {
+	uint8_t  src[ETH_ALEN];
+	uint8_t  dest[ETH_ALEN];
+	uint8_t  quality;	/* quality = 0 means HNA */
+} __attribute__((packed));
+
+struct recvlist_node {
+	struct list_head list;
+	uint8_t mac[ETH_ALEN];
+};
+
+enum vis_formats {
+	DOT_DRAW,
+	JSON,
+};
+
+extern struct hashtable_t *vis_hash;
+extern spinlock_t vis_hash_lock;
+
+void vis_set_mode(int mode);
+int is_vis_server(void);
+void receive_server_sync_packet(struct vis_packet *vis_packet,
+				int vis_info_len);
+void receive_client_update_packet(struct vis_packet *vis_packet,
+				  int vis_info_len);
+int vis_init(void);
+void vis_quit(void);
diff --git a/drivers/staging/comedi/comedi.h b/drivers/staging/comedi/comedi.h
index 957b6405dfa7..b559a9c2f857 100644
--- a/drivers/staging/comedi/comedi.h
+++ b/drivers/staging/comedi/comedi.h
@@ -24,10 +24,6 @@
 #ifndef _COMEDI_H
 #define _COMEDI_H
 
-#ifdef __cplusplus
-extern "C" {
-#endif
-
 #define COMEDI_MAJORVERSION	0
 #define COMEDI_MINORVERSION	7
 #define COMEDI_MICROVERSION	76
@@ -455,7 +451,7 @@ extern "C" {
 
 #define COMEDI_CB_EOS		1	/* end of scan */
 #define COMEDI_CB_EOA		2	/* end of acquisition */
-#define COMEDI_CB_BLOCK		4	/* DEPRECATED: convenient block size */
+#define COMEDI_CB_BLOCK		4	/* data has arrived: wakes up read() / write() */
 #define COMEDI_CB_EOBUF		8	/* DEPRECATED: end of buffer */
 #define COMEDI_CB_ERROR		16	/* card error during acquisition */
 #define COMEDI_CB_OVERFLOW	32	/* buffer overflow/underflow */
@@ -871,8 +867,4 @@ INSN_CONFIG_ARM */
 		AMPLC_DIO_GAT_RESERVED7
 	};
 
-#ifdef __cplusplus
-}
-#endif
-
 #endif /* _COMEDI_H */
diff --git a/drivers/staging/comedi/comedi_compat32.c b/drivers/staging/comedi/comedi_compat32.c
index 9810e37845c7..a9fdcda5db7a 100644
--- a/drivers/staging/comedi/comedi_compat32.c
+++ b/drivers/staging/comedi/comedi_compat32.c
@@ -27,16 +27,12 @@
 #define __NO_VERSION__
 #include "comedi.h"
 #include <linux/smp_lock.h>
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
 
 #include "comedi_compat32.h"
 
 #ifdef CONFIG_COMPAT
 
-#ifndef HAVE_COMPAT_IOCTL
-#include <linux/ioctl32.h>	/* for (un)register_ioctl32_conversion */
-#endif
-
 #define COMEDI32_CHANINFO _IOR(CIO, 3, struct comedi32_chaninfo_struct)
 #define COMEDI32_RANGEINFO _IOR(CIO, 8, struct comedi32_rangeinfo_struct)
 /* N.B. COMEDI32_CMD and COMEDI_CMD ought to use _IOWR, not _IOR.
@@ -101,22 +97,9 @@ static int translated_ioctl(struct file *file, unsigned int cmd,
 	if (!file->f_op)
 		return -ENOTTY;
 
-#ifdef HAVE_UNLOCKED_IOCTL
-	if (file->f_op->unlocked_ioctl) {
-		int rc = (int)(*file->f_op->unlocked_ioctl) (file, cmd, arg);
-		if (rc == -ENOIOCTLCMD)
-			rc = -ENOTTY;
-		return rc;
-	}
-#endif
-	if (file->f_op->ioctl) {
-		int rc;
-		lock_kernel();
-		rc = (*file->f_op->ioctl) (file->f_dentry->d_inode,
-					   file, cmd, arg);
-		unlock_kernel();
-		return rc;
-	}
+	if (file->f_op->unlocked_ioctl)
+		return file->f_op->unlocked_ioctl(file, cmd, arg);
+
 	return -ENOTTY;
 }
 
@@ -186,8 +169,8 @@ static int compat_rangeinfo(struct file *file, unsigned long arg)
 }
 
 /* Copy 32-bit cmd structure to native cmd structure. */
-static int get_compat_cmd(struct comedi_cmd __user * cmd,
-			  struct comedi32_cmd_struct __user * cmd32)
+static int get_compat_cmd(struct comedi_cmd __user *cmd,
+			  struct comedi32_cmd_struct __user *cmd32)
 {
 	int err;
 	union {
@@ -237,8 +220,8 @@ static int get_compat_cmd(struct comedi_cmd __user * cmd,
 }
 
 /* Copy native cmd structure to 32-bit cmd structure. */
-static int put_compat_cmd(struct comedi32_cmd_struct __user * cmd32,
-			  struct comedi_cmd __user * cmd)
+static int put_compat_cmd(struct comedi32_cmd_struct __user *cmd32,
+			  struct comedi_cmd __user *cmd)
 {
 	int err;
 	unsigned int temp;
@@ -328,8 +311,8 @@ static int compat_cmdtest(struct file *file, unsigned long arg)
 }
 
 /* Copy 32-bit insn structure to native insn structure. */
-static int get_compat_insn(struct comedi_insn __user * insn,
-			   struct comedi32_insn_struct __user * insn32)
+static int get_compat_insn(struct comedi_insn __user *insn,
+			   struct comedi32_insn_struct __user *insn32)
 {
 	int err;
 	union {
@@ -372,9 +355,9 @@ static int compat_insnlist(struct file *file, unsigned long arg)
 	insnlist32 = compat_ptr(arg);
 
 	/* Get 32-bit insnlist structure.  */
-	if (!access_ok(VERIFY_READ, insnlist32, sizeof(*insnlist32))) {
+	if (!access_ok(VERIFY_READ, insnlist32, sizeof(*insnlist32)))
 		return -EFAULT;
-	}
+
 	err = 0;
 	err |= __get_user(n_insns, &insnlist32->n_insns);
 	err |= __get_user(uptr, &insnlist32->insns);
@@ -387,9 +370,9 @@ static int compat_insnlist(struct file *file, unsigned long arg)
 					     insn[n_insns]));
 
 	/* Set native insnlist structure. */
-	if (!access_ok(VERIFY_WRITE, &s->insnlist, sizeof(s->insnlist))) {
+	if (!access_ok(VERIFY_WRITE, &s->insnlist, sizeof(s->insnlist)))
 		return -EFAULT;
-	}
+
 	err |= __put_user(n_insns, &s->insnlist.n_insns);
 	err |= __put_user(&s->insn[0], &s->insnlist.insns);
 	if (err)
@@ -472,8 +455,6 @@ static inline int raw_ioctl(struct file *file, unsigned int cmd,
 	return rc;
 }
 
-#ifdef HAVE_COMPAT_IOCTL	/* defined in <linux/fs.h> 2.6.11 onwards */
-
 /* compat_ioctl file operation. */
 /* Returns -ENOIOCTLCMD for unrecognised ioctl codes. */
 long comedi_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
@@ -481,106 +462,4 @@ long comedi_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 	return raw_ioctl(file, cmd, arg);
 }
 
-#else /* HAVE_COMPAT_IOCTL */
-
-/*
- * Brain-dead ioctl compatibility for 2.6.10 and earlier.
- *
- * It's brain-dead because cmd numbers need to be unique system-wide!
- * The comedi driver could end up attempting to execute ioctls for non-Comedi
- * devices because it registered the system-wide cmd code first.  Similarly,
- * another driver could end up attempting to execute ioctls for a Comedi
- * device because it registered the cmd code first.  Chaos ensues.
- */
-
-/* Handler for all 32-bit ioctl codes registered by this driver. */
-static int mapped_ioctl(unsigned int fd, unsigned int cmd, unsigned long arg,
-			struct file *file)
-{
-	int rc;
-
-	/* Make sure we are dealing with a Comedi device. */
-	if (imajor(file->f_dentry->d_inode) != COMEDI_MAJOR)
-		return -ENOTTY;
-
-	rc = raw_ioctl(file, cmd, arg);
-	/* Do not return -ENOIOCTLCMD. */
-	if (rc == -ENOIOCTLCMD)
-		rc = -ENOTTY;
-
-	return rc;
-}
-
-struct ioctl32_map {
-	unsigned int cmd;
-	int (*handler) (unsigned int, unsigned int, unsigned long,
-			struct file *);
-	int registered;
-};
-
-static struct ioctl32_map comedi_ioctl32_map[] = {
-	{COMEDI_DEVCONFIG, mapped_ioctl, 0},
-	{COMEDI_DEVINFO, mapped_ioctl, 0},
-	{COMEDI_SUBDINFO, mapped_ioctl, 0},
-	{COMEDI_BUFCONFIG, mapped_ioctl, 0},
-	{COMEDI_BUFINFO, mapped_ioctl, 0},
-	{COMEDI_LOCK, mapped_ioctl, 0},
-	{COMEDI_UNLOCK, mapped_ioctl, 0},
-	{COMEDI_CANCEL, mapped_ioctl, 0},
-	{COMEDI_POLL, mapped_ioctl, 0},
-	{COMEDI32_CHANINFO, mapped_ioctl, 0},
-	{COMEDI32_RANGEINFO, mapped_ioctl, 0},
-	{COMEDI32_CMD, mapped_ioctl, 0},
-	{COMEDI32_CMDTEST, mapped_ioctl, 0},
-	{COMEDI32_INSNLIST, mapped_ioctl, 0},
-	{COMEDI32_INSN, mapped_ioctl, 0},
-};
-
-#define NUM_IOCTL32_MAPS ARRAY_SIZE(comedi_ioctl32_map)
-
-/* Register system-wide 32-bit ioctl handlers. */
-void comedi_register_ioctl32(void)
-{
-	int n, rc;
-
-	for (n = 0; n < NUM_IOCTL32_MAPS; n++) {
-		rc = register_ioctl32_conversion(comedi_ioctl32_map[n].cmd,
-						 comedi_ioctl32_map[n].handler);
-		if (rc) {
-			printk(KERN_WARNING
-			       "comedi: failed to register 32-bit "
-			       "compatible ioctl handler for 0x%X - "
-			       "expect bad things to happen!\n",
-			       comedi_ioctl32_map[n].cmd);
-		}
-		comedi_ioctl32_map[n].registered = !rc;
-	}
-}
-
-/* Unregister system-wide 32-bit ioctl translations. */
-void comedi_unregister_ioctl32(void)
-{
-	int n, rc;
-
-	for (n = 0; n < NUM_IOCTL32_MAPS; n++) {
-		if (comedi_ioctl32_map[n].registered) {
-			rc = unregister_ioctl32_conversion(comedi_ioctl32_map
-							   [n].cmd,
-							   comedi_ioctl32_map
-							   [n].handler);
-			if (rc) {
-				printk(KERN_ERR
-				       "comedi: failed to unregister 32-bit "
-				       "compatible ioctl handler for 0x%X - "
-				       "expect kernel Oops!\n",
-				       comedi_ioctl32_map[n].cmd);
-			} else {
-				comedi_ioctl32_map[n].registered = 0;
-			}
-		}
-	}
-}
-
-#endif /* HAVE_COMPAT_IOCTL */
-
 #endif /* CONFIG_COMPAT */
diff --git a/drivers/staging/comedi/comedi_compat32.h b/drivers/staging/comedi/comedi_compat32.h
index fd0f8a3125a1..0340a8949c6b 100644
--- a/drivers/staging/comedi/comedi_compat32.h
+++ b/drivers/staging/comedi/comedi_compat32.h
@@ -28,30 +28,16 @@
 #define _COMEDI_COMPAT32_H
 
 #include <linux/compat.h>
-#include <linux/fs.h>		/* For HAVE_COMPAT_IOCTL and HAVE_UNLOCKED_IOCTL */
+#include <linux/fs.h>
 
 #ifdef CONFIG_COMPAT
 
-#ifdef HAVE_COMPAT_IOCTL
-
 extern long comedi_compat_ioctl(struct file *file, unsigned int cmd,
 				unsigned long arg);
-#define comedi_register_ioctl32() do {} while (0)
-#define comedi_unregister_ioctl32() do {} while (0)
-
-#else /* HAVE_COMPAT_IOCTL */
-
-#define comedi_compat_ioctl 0	/* NULL */
-extern void comedi_register_ioctl32(void);
-extern void comedi_unregister_ioctl32(void);
-
-#endif /* HAVE_COMPAT_IOCTL */
 
 #else /* CONFIG_COMPAT */
 
 #define comedi_compat_ioctl 0	/* NULL */
-#define comedi_register_ioctl32() do {} while (0)
-#define comedi_unregister_ioctl32() do {} while (0)
 
 #endif /* CONFIG_COMPAT */
 
diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c
index aaad76e0a76a..8117748ad5a5 100644
--- a/drivers/staging/comedi/comedi_fops.c
+++ b/drivers/staging/comedi/comedi_fops.c
@@ -110,13 +110,8 @@ static struct device_attribute dev_attr_read_buffer_kb;
 static struct device_attribute dev_attr_max_write_buffer_kb;
 static struct device_attribute dev_attr_write_buffer_kb;
 
-#ifdef HAVE_UNLOCKED_IOCTL
 static long comedi_unlocked_ioctl(struct file *file, unsigned int cmd,
 				  unsigned long arg)
-#else
-static int comedi_ioctl(struct inode *inode, struct file *file,
-			unsigned int cmd, unsigned long arg)
-#endif
 {
 	const unsigned minor = iminor(file->f_dentry->d_inode);
 	struct comedi_device_file_info *dev_file_info =
@@ -1867,14 +1862,8 @@ static int comedi_fasync(int fd, struct file *file, int on)
 
 const struct file_operations comedi_fops = {
 	.owner = THIS_MODULE,
-#ifdef HAVE_UNLOCKED_IOCTL
 	.unlocked_ioctl = comedi_unlocked_ioctl,
-#else
-	.ioctl = comedi_ioctl,
-#endif
-#ifdef HAVE_COMPAT_IOCTL
 	.compat_ioctl = comedi_compat_ioctl,
-#endif
 	.open = comedi_open,
 	.release = comedi_close,
 	.read = comedi_read,
@@ -1959,8 +1948,6 @@ static int __init comedi_init(void)
 		}
 	}
 
-	comedi_register_ioctl32();
-
 	return 0;
 }
 
@@ -1977,8 +1964,6 @@ static void __exit comedi_cleanup(void)
 	unregister_chrdev_region(MKDEV(COMEDI_MAJOR, 0), COMEDI_NUM_MINORS);
 
 	comedi_proc_cleanup();
-
-	comedi_unregister_ioctl32();
 }
 
 module_init(comedi_init);
diff --git a/drivers/staging/comedi/comedidev.h b/drivers/staging/comedi/comedidev.h
index e8a5f7d33e7a..ebdccfdf220e 100644
--- a/drivers/staging/comedi/comedidev.h
+++ b/drivers/staging/comedi/comedidev.h
@@ -49,7 +49,8 @@
 } while (0)
 
 #define COMEDI_VERSION(a, b, c) (((a) << 16) + ((b) << 8) + (c))
-#define COMEDI_VERSION_CODE COMEDI_VERSION(COMEDI_MAJORVERSION, COMEDI_MINORVERSION, COMEDI_MICROVERSION)
+#define COMEDI_VERSION_CODE COMEDI_VERSION(COMEDI_MAJORVERSION, \
+	COMEDI_MINORVERSION, COMEDI_MICROVERSION)
 #define COMEDI_RELEASE VERSION
 
 #define COMEDI_INITCLEANUP_NOMODULE(x)					\
@@ -58,12 +59,12 @@
 	static void __exit x ## _cleanup_module(void)			\
 		{comedi_driver_unregister(&(x)); } 			\
 	module_init(x ## _init_module);					\
-	module_exit(x ## _cleanup_module);					\
+	module_exit(x ## _cleanup_module);
 
 #define COMEDI_MODULE_MACROS						\
 	MODULE_AUTHOR("Comedi http://www.comedi.org");		\
 	MODULE_DESCRIPTION("Comedi low-level driver");			\
-	MODULE_LICENSE("GPL");						\
+	MODULE_LICENSE("GPL");
 
 #define COMEDI_INITCLEANUP(x)						\
 	COMEDI_MODULE_MACROS		\
@@ -75,7 +76,8 @@
 	{ \
 		return comedi_pci_auto_config(dev, comedi_driver.driver_name); \
 	} \
-	static void __devexit comedi_driver ## _pci_remove(struct pci_dev *dev) \
+	static void __devexit comedi_driver ## _pci_remove(\
+		struct pci_dev *dev) \
 	{ \
 		comedi_pci_auto_unconfig(dev); \
 	} \
@@ -91,7 +93,8 @@
 		retval = comedi_driver_register(&comedi_driver); \
 		if (retval < 0) \
 			return retval; \
-		comedi_driver ## _pci_driver.name = (char *)comedi_driver.driver_name; \
+			comedi_driver ## _pci_driver.name = \
+				(char *)comedi_driver.driver_name; \
 		return pci_register_driver(&comedi_driver ## _pci_driver); \
 	} \
 	static void __exit comedi_driver ## _cleanup_module(void) \
@@ -170,14 +173,15 @@ struct comedi_subdevice {
 			   struct comedi_cmd *);
 	int (*poll) (struct comedi_device *, struct comedi_subdevice *);
 	int (*cancel) (struct comedi_device *, struct comedi_subdevice *);
-	/* int (*do_lock)(struct comedi_device *,struct comedi_subdevice *); */
-	/* int (*do_unlock)(struct comedi_device *,struct comedi_subdevice *); */
+	/* int (*do_lock)(struct comedi_device *, struct comedi_subdevice *); */
+	/* int (*do_unlock)(struct comedi_device *, \
+			struct comedi_subdevice *); */
 
 	/* called when the buffer changes */
-	int (*buf_change) (struct comedi_device * dev,
-			   struct comedi_subdevice * s, unsigned long new_size);
+	int (*buf_change) (struct comedi_device *dev,
+			   struct comedi_subdevice *s, unsigned long new_size);
 
-	void (*munge) (struct comedi_device * dev, struct comedi_subdevice * s,
+	void (*munge) (struct comedi_device *dev, struct comedi_subdevice *s,
 		       void *data, unsigned int num_bytes,
 		       unsigned int start_chan_index);
 	enum dma_data_direction async_dma_dir;
@@ -198,16 +202,22 @@ struct comedi_async {
 
 	void *prealloc_buf;	/* pre-allocated buffer */
 	unsigned int prealloc_bufsz;	/* buffer size, in bytes */
-	struct comedi_buf_page *buf_page_list;	/* virtual and dma address of each page */
+	/* virtual and dma address of each page */
+	struct comedi_buf_page *buf_page_list;
 	unsigned n_buf_pages;	/* num elements in buf_page_list */
 
 	unsigned int max_bufsize;	/* maximum buffer size, bytes */
-	unsigned int mmap_count;	/* current number of mmaps of prealloc_buf */
-
-	unsigned int buf_write_count;	/* byte count for writer (write completed) */
-	unsigned int buf_write_alloc_count;	/* byte count for writer (allocated for writing) */
-	unsigned int buf_read_count;	/* byte count for reader (read completed) */
-	unsigned int buf_read_alloc_count;	/* byte count for reader (allocated for reading) */
+	/* current number of mmaps of prealloc_buf */
+	unsigned int mmap_count;
+
+	/* byte count for writer (write completed) */
+	unsigned int buf_write_count;
+	/* byte count for writer (allocated for writing) */
+	unsigned int buf_write_alloc_count;
+	/* byte count for reader (read completed) */
+	unsigned int buf_read_count;
+	/* byte count for reader (allocated for reading) */
+	unsigned int buf_read_alloc_count;
 
 	unsigned int buf_write_ptr;	/* buffer marker for writer */
 	unsigned int buf_read_ptr;	/* buffer marker for reader */
@@ -233,7 +243,7 @@ struct comedi_async {
 	int (*cb_func) (unsigned int flags, void *);
 	void *cb_arg;
 
-	int (*inttrig) (struct comedi_device * dev, struct comedi_subdevice * s,
+	int (*inttrig) (struct comedi_device *dev, struct comedi_subdevice *s,
 			unsigned int x);
 };
 
@@ -283,8 +293,8 @@ struct comedi_device {
 
 	struct fasync_struct *async_queue;
 
-	void (*open) (struct comedi_device * dev);
-	void (*close) (struct comedi_device * dev);
+	void (*open) (struct comedi_device *dev);
+	void (*close) (struct comedi_device *dev);
 };
 
 struct comedi_device_file_info {
@@ -318,9 +328,8 @@ static const unsigned COMEDI_SUBDEVICE_MINOR_OFFSET = 1;
 
 struct comedi_device_file_info *comedi_get_device_file_info(unsigned minor);
 
-static inline struct comedi_subdevice *comedi_get_read_subdevice(const struct
-								 comedi_device_file_info
-								 *info)
+static inline struct comedi_subdevice *comedi_get_read_subdevice(
+	const struct comedi_device_file_info *info)
 {
 	if (info->read_subdevice)
 		return info->read_subdevice;
@@ -329,9 +338,8 @@ static inline struct comedi_subdevice *comedi_get_read_subdevice(const struct
 	return info->device->read_subdev;
 }
 
-static inline struct comedi_subdevice *comedi_get_write_subdevice(const struct
-								  comedi_device_file_info
-								  *info)
+static inline struct comedi_subdevice *comedi_get_write_subdevice(
+	const struct comedi_device_file_info *info)
 {
 	if (info->write_subdevice)
 		return info->write_subdevice;
diff --git a/drivers/staging/comedi/drivers.c b/drivers/staging/comedi/drivers.c
index dc53aeeac68f..c2a632d31c61 100644
--- a/drivers/staging/comedi/drivers.c
+++ b/drivers/staging/comedi/drivers.c
@@ -387,7 +387,7 @@ static int insn_rw_emulate_bits(struct comedi_device *dev,
 	return 1;
 }
 
-static inline unsigned long uvirt_to_kva(pgd_t * pgd, unsigned long adr)
+static inline unsigned long uvirt_to_kva(pgd_t *pgd, unsigned long adr)
 {
 	unsigned long ret = 0UL;
 	pmd_t *pmd;
diff --git a/drivers/staging/comedi/drivers/8253.h b/drivers/staging/comedi/drivers/8253.h
index c2ea2d96f1cc..0bb35db4ea3b 100644
--- a/drivers/staging/comedi/drivers/8253.h
+++ b/drivers/staging/comedi/drivers/8253.h
@@ -206,7 +206,8 @@ static inline void i8253_cascade_ns_to_timer_2div(int i8253_osc_base,
 	}
 
 	*nanosec = div1 * div2 * i8253_osc_base;
-	*d1 = div1 & 0xffff;	/*  masking is done since counter maps zero to 0x10000 */
+	/*  masking is done since counter maps zero to 0x10000 */
+	*d1 = div1 & 0xffff;
 	*d2 = div2 & 0xffff;
 	return;
 }
diff --git a/drivers/staging/comedi/drivers/8255.c b/drivers/staging/comedi/drivers/8255.c
index 0a50864767e4..10f488f0e5ee 100644
--- a/drivers/staging/comedi/drivers/8255.c
+++ b/drivers/staging/comedi/drivers/8255.c
@@ -132,6 +132,7 @@ void subdev_8255_interrupt(struct comedi_device *dev,
 
 	comedi_event(dev, s);
 }
+EXPORT_SYMBOL(subdev_8255_interrupt);
 
 static int subdev_8255_cb(int dir, int port, int data, unsigned long arg)
 {
@@ -179,15 +180,14 @@ static int subdev_8255_insn_config(struct comedi_device *dev,
 	unsigned int bits;
 
 	mask = 1 << CR_CHAN(insn->chanspec);
-	if (mask & 0x0000ff) {
+	if (mask & 0x0000ff)
 		bits = 0x0000ff;
-	} else if (mask & 0x00ff00) {
+	else if (mask & 0x00ff00)
 		bits = 0x00ff00;
-	} else if (mask & 0x0f0000) {
+	else if (mask & 0x0f0000)
 		bits = 0x0f0000;
-	} else {
+	else
 		bits = 0xf00000;
-	}
 
 	switch (data[0]) {
 	case INSN_CONFIG_DIO_INPUT:
@@ -333,11 +333,10 @@ int subdev_8255_init(struct comedi_device *dev, struct comedi_subdevice *s,
 		return -ENOMEM;
 
 	CALLBACK_ARG = arg;
-	if (cb == NULL) {
+	if (cb == NULL)
 		CALLBACK_FUNC = subdev_8255_cb;
-	} else {
+	else
 		CALLBACK_FUNC = cb;
-	}
 	s->insn_bits = subdev_8255_insn;
 	s->insn_config = subdev_8255_insn_config;
 
@@ -347,6 +346,7 @@ int subdev_8255_init(struct comedi_device *dev, struct comedi_subdevice *s,
 
 	return 0;
 }
+EXPORT_SYMBOL(subdev_8255_init);
 
 int subdev_8255_init_irq(struct comedi_device *dev, struct comedi_subdevice *s,
 			 int (*cb) (int, int, int, unsigned long),
@@ -366,6 +366,7 @@ int subdev_8255_init_irq(struct comedi_device *dev, struct comedi_subdevice *s,
 
 	return 0;
 }
+EXPORT_SYMBOL(subdev_8255_init_irq);
 
 void subdev_8255_cleanup(struct comedi_device *dev, struct comedi_subdevice *s)
 {
@@ -378,6 +379,7 @@ void subdev_8255_cleanup(struct comedi_device *dev, struct comedi_subdevice *s)
 		kfree(s->private);
 	}
 }
+EXPORT_SYMBOL(subdev_8255_cleanup);
 
 /*
 
@@ -448,8 +450,3 @@ static int dev_8255_detach(struct comedi_device *dev)
 
 	return 0;
 }
-
-EXPORT_SYMBOL(subdev_8255_init);
-EXPORT_SYMBOL(subdev_8255_init_irq);
-EXPORT_SYMBOL(subdev_8255_cleanup);
-EXPORT_SYMBOL(subdev_8255_interrupt);
diff --git a/drivers/staging/comedi/drivers/acl7225b.c b/drivers/staging/comedi/drivers/acl7225b.c
index c3652ef19a5f..e20c3542c069 100644
--- a/drivers/staging/comedi/drivers/acl7225b.c
+++ b/drivers/staging/comedi/drivers/acl7225b.c
@@ -94,10 +94,11 @@ static int acl7225b_attach(struct comedi_device *dev,
 
 	iobase = it->options[0];
 	iorange = this_board->io_range;
-	printk("comedi%d: acl7225b: board=%s 0x%04x ", dev->minor,
+	printk(KERN_INFO "comedi%d: acl7225b: board=%s 0x%04x\n", dev->minor,
 	       this_board->name, iobase);
 	if (!request_region(iobase, iorange, "acl7225b")) {
-		printk("I/O port conflict\n");
+		printk(KERN_ERR "comedi%d: request_region failed - I/O port conflict\n",
+			dev->minor);
 		return -EIO;
 	}
 	dev->board_name = this_board->name;
@@ -137,14 +138,12 @@ static int acl7225b_attach(struct comedi_device *dev,
 	s->range_table = &range_digital;
 	s->private = (void *)ACL7225_DI_LO;
 
-	printk("\n");
-
 	return 0;
 }
 
 static int acl7225b_detach(struct comedi_device *dev)
 {
-	printk("comedi%d: acl7225b: remove\n", dev->minor);
+	printk(KERN_INFO "comedi%d: acl7225b: remove\n", dev->minor);
 
 	if (dev->iobase)
 		release_region(dev->iobase, this_board->io_range);
diff --git a/drivers/staging/comedi/drivers/addi-data/APCI1710_Chrono.c b/drivers/staging/comedi/drivers/addi-data/APCI1710_Chrono.c
index ccb109a851f2..0af12fd2a40a 100644
--- a/drivers/staging/comedi/drivers/addi-data/APCI1710_Chrono.c
+++ b/drivers/staging/comedi/drivers/addi-data/APCI1710_Chrono.c
@@ -1386,8 +1386,7 @@ int i_APCI1710_ReadChronoValue(struct comedi_device *dev,
 				/* Test the timout parameter */
 		 /*****************************/
 
-				if ((ui_TimeOut >= 0)
-					&& (ui_TimeOut <= 65535UL)) {
+				if (ui_TimeOut <= 65535UL) {
 
 					for (;;) {
 			  /*******************/
diff --git a/drivers/staging/comedi/drivers/addi-data/APCI1710_INCCPT.c b/drivers/staging/comedi/drivers/addi-data/APCI1710_INCCPT.c
index 6c092efee7bd..a15c952c0fab 100644
--- a/drivers/staging/comedi/drivers/addi-data/APCI1710_INCCPT.c
+++ b/drivers/staging/comedi/drivers/addi-data/APCI1710_INCCPT.c
@@ -3807,7 +3807,7 @@ int i_APCI1710_EnableFrequencyMeasurement(struct comedi_device *dev,
 			s_ModuleInfo[b_ModulNbr].
 			s_SiemensCounterInfo.s_InitFlag.b_CounterInit == 1) {
 	      /********************************************/
-			/* Test if frequency mesurement initialised */
+			/* Test if frequency measurement initialised */
 	      /********************************************/
 
 			if (devpriv->
@@ -3953,7 +3953,7 @@ int i_APCI1710_DisableFrequencyMeasurement(struct comedi_device *dev, unsigned c
 			s_ModuleInfo[b_ModulNbr].
 			s_SiemensCounterInfo.s_InitFlag.b_CounterInit == 1) {
 	      /********************************************/
-			/* Test if frequency mesurement initialised */
+			/* Test if frequency measurement initialised */
 	      /********************************************/
 
 			if (devpriv->
@@ -5166,7 +5166,7 @@ int i_APCI1710_ReadFrequencyMeasurement(struct comedi_device *dev,
 			s_ModuleInfo[b_ModulNbr].
 			s_SiemensCounterInfo.s_InitFlag.b_CounterInit == 1) {
 	      /********************************************/
-			/* Test if frequency mesurement initialised */
+			/* Test if frequency measurement initialised */
 	      /********************************************/
 
 			if (devpriv->
diff --git a/drivers/staging/comedi/drivers/addi-data/APCI1710_Tor.c b/drivers/staging/comedi/drivers/addi-data/APCI1710_Tor.c
index 43198aafb2dc..7e1254475792 100644
--- a/drivers/staging/comedi/drivers/addi-data/APCI1710_Tor.c
+++ b/drivers/staging/comedi/drivers/addi-data/APCI1710_Tor.c
@@ -1808,7 +1808,7 @@ int i_APCI1710_InsnBitsGetTorCounterProgressStatusAndValue(struct comedi_device
 									2) {
 									if (dw_Status & 4) {
 				/************************/
-										/* Tor counter owerflow */
+										/* Tor counter overflow */
 				/************************/
 
 										*pb_TorCounterStatus
diff --git a/drivers/staging/comedi/drivers/addi-data/addi_common.h b/drivers/staging/comedi/drivers/addi-data/addi_common.h
index edd657b902aa..3ab27cf0facc 100644
--- a/drivers/staging/comedi/drivers/addi-data/addi_common.h
+++ b/drivers/staging/comedi/drivers/addi-data/addi_common.h
@@ -82,7 +82,7 @@ struct addi_board {
 
 	int i_NbrDiChannel;	/*  Number of DI channels */
 	int i_NbrDoChannel;	/*  Number of DO channels */
-	int i_DoMaxdata;	/*  data to set all chanels high */
+	int i_DoMaxdata;	/*  data to set all channels high */
 
 	int i_NbrTTLChannel;	/*  Number of TTL channels */
 	const struct comedi_lrange *pr_TTLRangelist;	/* rangelist for TTL */
diff --git a/drivers/staging/comedi/drivers/addi-data/hwdrv_apci1032.c b/drivers/staging/comedi/drivers/addi-data/hwdrv_apci1032.c
index e9021cd4d341..723a97bab44c 100644
--- a/drivers/staging/comedi/drivers/addi-data/hwdrv_apci1032.c
+++ b/drivers/staging/comedi/drivers/addi-data/hwdrv_apci1032.c
@@ -150,7 +150,7 @@ int i_APCI1032_Read1DigitalInput(struct comedi_device *dev, struct comedi_subdev
 	unsigned int ui_TmpValue = 0;
 	unsigned int ui_Channel;
 	ui_Channel = CR_CHAN(insn->chanspec);
-	if (ui_Channel >= 0 && ui_Channel <= 31) {
+	if (ui_Channel <= 31) {
 		ui_TmpValue = (unsigned int) inl(devpriv->iobase + APCI1032_DIGITAL_IP);
 /*
 * since only 1 channel reqd to bring it to last bit it is rotated 8
diff --git a/drivers/staging/comedi/drivers/addi-data/hwdrv_apci1500.c b/drivers/staging/comedi/drivers/addi-data/hwdrv_apci1500.c
index 236b8a31c824..36b929ffecbd 100644
--- a/drivers/staging/comedi/drivers/addi-data/hwdrv_apci1500.c
+++ b/drivers/staging/comedi/drivers/addi-data/hwdrv_apci1500.c
@@ -968,7 +968,7 @@ int i_APCI1500_ReadMoreDigitalInput(struct comedi_device *dev, struct comedi_sub
 
 	switch (data[0]) {
 	case 0:
-		if (ui_Channel >= 0 && ui_Channel <= 15) {
+		if (ui_Channel <= 15) {
 			ui_TmpValue =
 				(unsigned int) inw(devpriv->i_IobaseAddon +
 				APCI1500_DIGITAL_IP);
diff --git a/drivers/staging/comedi/drivers/addi-data/hwdrv_apci1516.c b/drivers/staging/comedi/drivers/addi-data/hwdrv_apci1516.c
index 38416356628d..866eb8d75820 100644
--- a/drivers/staging/comedi/drivers/addi-data/hwdrv_apci1516.c
+++ b/drivers/staging/comedi/drivers/addi-data/hwdrv_apci1516.c
@@ -79,7 +79,7 @@ int i_APCI1516_Read1DigitalInput(struct comedi_device *dev, struct comedi_subdev
 	unsigned int ui_TmpValue = 0;
 	unsigned int ui_Channel;
 	ui_Channel = CR_CHAN(insn->chanspec);
-	if (ui_Channel >= 0 && ui_Channel <= 7) {
+	if (ui_Channel <= 7) {
 		ui_TmpValue = (unsigned int) inw(devpriv->iobase + APCI1516_DIGITAL_IP);
 		/*   since only 1 channel reqd  to bring it to last bit it is rotated */
 		/*   8 +(chan - 1) times then ANDed with 1 for last bit. */
diff --git a/drivers/staging/comedi/drivers/addi-data/hwdrv_apci1564.c b/drivers/staging/comedi/drivers/addi-data/hwdrv_apci1564.c
index 3a47c3034229..3ae663bc754e 100644
--- a/drivers/staging/comedi/drivers/addi-data/hwdrv_apci1564.c
+++ b/drivers/staging/comedi/drivers/addi-data/hwdrv_apci1564.c
@@ -154,7 +154,7 @@ int i_APCI1564_Read1DigitalInput(struct comedi_device *dev, struct comedi_subdev
 	unsigned int ui_Channel;
 
 	ui_Channel = CR_CHAN(insn->chanspec);
-	if (ui_Channel >= 0 && ui_Channel <= 31) {
+	if (ui_Channel <= 31) {
 		ui_TmpValue =
 			(unsigned int) inl(devpriv->i_IobaseAmcc + APCI1564_DIGITAL_IP);
 /*
diff --git a/drivers/staging/comedi/drivers/addi-data/hwdrv_apci2016.c b/drivers/staging/comedi/drivers/addi-data/hwdrv_apci2016.c
index 457917f292b7..d348cd5687aa 100644
--- a/drivers/staging/comedi/drivers/addi-data/hwdrv_apci2016.c
+++ b/drivers/staging/comedi/drivers/addi-data/hwdrv_apci2016.c
@@ -117,7 +117,7 @@ int i_APCI2016_WriteDigitalOutput(struct comedi_device *dev, struct comedi_subde
 	unsigned int ui_NoOfChannel;
 	unsigned int ui_Temp, ui_Temp1;
 	ui_NoOfChannel = CR_CHAN(insn->chanspec);
-	if ((ui_NoOfChannel < 0) || (ui_NoOfChannel > 15)) {
+	if (ui_NoOfChannel > 15) {
 		comedi_error(dev,
 			"Invalid Channel Numbers !!!, Channel Numbers must be between 0 and 15\n");
 		return -EINVAL;
@@ -272,7 +272,7 @@ int i_APCI2016_BitsDigitalOutput(struct comedi_device *dev, struct comedi_subdev
 	unsigned int ui_Temp;
 	unsigned int ui_NoOfChannel;
 	ui_NoOfChannel = CR_CHAN(insn->chanspec);
-	if ((ui_NoOfChannel < 0) || (ui_NoOfChannel > 15)) {
+	if (ui_NoOfChannel > 15) {
 		comedi_error(dev,
 			"Invalid Channel Numbers !!!, Channel Numbers must be between 0 and 15\n");
 		return -EINVAL;
diff --git a/drivers/staging/comedi/drivers/addi-data/hwdrv_apci2200.c b/drivers/staging/comedi/drivers/addi-data/hwdrv_apci2200.c
index a853c62a4fd9..aa159dccc36a 100644
--- a/drivers/staging/comedi/drivers/addi-data/hwdrv_apci2200.c
+++ b/drivers/staging/comedi/drivers/addi-data/hwdrv_apci2200.c
@@ -79,7 +79,7 @@ int i_APCI2200_Read1DigitalInput(struct comedi_device *dev, struct comedi_subdev
 	unsigned int ui_TmpValue = 0;
 	unsigned int ui_Channel;
 	ui_Channel = CR_CHAN(insn->chanspec);
-	if (ui_Channel >= 0 && ui_Channel <= 7) {
+	if (ui_Channel <= 7) {
 		ui_TmpValue = (unsigned int) inw(devpriv->iobase + APCI2200_DIGITAL_IP);
 		*data = (ui_TmpValue >> ui_Channel) & 0x1;
 	}			/* if(ui_Channel >= 0 && ui_Channel <=7) */
diff --git a/drivers/staging/comedi/drivers/addi-data/hwdrv_apci3120.c b/drivers/staging/comedi/drivers/addi-data/hwdrv_apci3120.c
index 169cee41b871..172fba8dbfe5 100644
--- a/drivers/staging/comedi/drivers/addi-data/hwdrv_apci3120.c
+++ b/drivers/staging/comedi/drivers/addi-data/hwdrv_apci3120.c
@@ -1468,7 +1468,7 @@ void v_APCI3120_Interrupt(int irq, void *d)
 	int_amcc = inl(devpriv->i_IobaseAmcc + AMCC_OP_REG_INTCSR);	/*  get AMCC int register */
 
 	if ((!int_daq) && (!(int_amcc & ANY_S593X_INT))) {
-		comedi_error(dev, "IRQ from unknow source");
+		comedi_error(dev, "IRQ from unknown source");
 		return;
 	}
 
@@ -2350,7 +2350,7 @@ int i_APCI3120_InsnReadDigitalInput(struct comedi_device *dev,
 	ui_Chan = CR_CHAN(insn->chanspec);	/*  channel specified */
 
 	/* this_board->i_hwdrv_InsnReadDigitalInput(dev,ui_Chan,data); */
-	if (ui_Chan >= 0 && ui_Chan <= 3) {
+	if (ui_Chan <= 3) {
 		ui_TmpValue = (unsigned int) inw(devpriv->iobase + APCI3120_RD_STATUS);
 
 /*
@@ -2539,8 +2539,7 @@ int i_APCI3120_InsnWriteDigitalOutput(struct comedi_device *dev,
 			"Not a valid Data !!! ,Data should be 1 or 0\n");
 		return -EINVAL;
 	}
-	if ((ui_NoOfChannel > (this_board->i_NbrDoChannel - 1))
-		|| (ui_NoOfChannel < 0)) {
+	if (ui_NoOfChannel > this_board->i_NbrDoChannel - 1) {
 		comedi_error(dev,
 			"This board doesn't have specified channel !!! \n");
 		return -EINVAL;
diff --git a/drivers/staging/comedi/drivers/addi-data/hwdrv_apci3200.c b/drivers/staging/comedi/drivers/addi-data/hwdrv_apci3200.c
index 010697fa2936..98c23872e374 100644
--- a/drivers/staging/comedi/drivers/addi-data/hwdrv_apci3200.c
+++ b/drivers/staging/comedi/drivers/addi-data/hwdrv_apci3200.c
@@ -461,7 +461,7 @@ int i_APCI3200_GetChannelCalibrationValue(struct comedi_device *dev,
 	if (s_BoardInfos[dev->minor].i_ConnectionType == 1) {
 		/* if diff */
 
-		if ((ui_Channel_num >= 0) && (ui_Channel_num <= 1))
+		if (ui_Channel_num <= 1)
 			i_DiffChannel = ui_Channel_num, i_Module = 0;
 		else if ((ui_Channel_num >= 2) && (ui_Channel_num <= 3))
 			i_DiffChannel = ui_Channel_num - 2, i_Module = 1;
diff --git a/drivers/staging/comedi/drivers/addi-data/hwdrv_apci3501.c b/drivers/staging/comedi/drivers/addi-data/hwdrv_apci3501.c
index ef21f03fc961..7b38d177394b 100644
--- a/drivers/staging/comedi/drivers/addi-data/hwdrv_apci3501.c
+++ b/drivers/staging/comedi/drivers/addi-data/hwdrv_apci3501.c
@@ -724,7 +724,7 @@ void v_APCI3501_Interrupt(int irq, void *d)
 		APCI3501_TCW_IRQ) & 0x1;
 
 	if ((!ui_Timer_AOWatchdog)) {
-		comedi_error(dev, "IRQ from unknow source");
+		comedi_error(dev, "IRQ from unknown source");
 		return;
 	}
 
diff --git a/drivers/staging/comedi/drivers/addi-data/hwdrv_apci3xxx.c b/drivers/staging/comedi/drivers/addi-data/hwdrv_apci3xxx.c
index 338727879827..1d1e5fc2ea9a 100644
--- a/drivers/staging/comedi/drivers/addi-data/hwdrv_apci3xxx.c
+++ b/drivers/staging/comedi/drivers/addi-data/hwdrv_apci3xxx.c
@@ -148,7 +148,7 @@ int i_APCI3XXX_AnalogInputConfigOperatingMode(struct comedi_device *dev,
 			/* Test the convert time value */
 	      /*******************************/
 
-			if ((dw_ReloadValue >= 0) && (dw_ReloadValue <= 65535)) {
+			if (dw_ReloadValue <= 65535) {
 				dw_TestReloadValue = dw_ReloadValue;
 
 				if (b_TimeBase == 1) {
diff --git a/drivers/staging/comedi/drivers/adl_pci6208.c b/drivers/staging/comedi/drivers/adl_pci6208.c
index 8e1befc448a3..6925faaf5293 100644
--- a/drivers/staging/comedi/drivers/adl_pci6208.c
+++ b/drivers/staging/comedi/drivers/adl_pci6208.c
@@ -133,9 +133,11 @@ static int pci6208_ao_winsn(struct comedi_device *dev,
 static int pci6208_ao_rinsn(struct comedi_device *dev,
 			    struct comedi_subdevice *s,
 			    struct comedi_insn *insn, unsigned int *data);
-/* static int pci6208_dio_insn_bits(struct comedi_device *dev,struct comedi_subdevice *s, */
+/* static int pci6208_dio_insn_bits (struct comedi_device *dev,
+ * 					struct comedi_subdevice *s, */
 /* struct comedi_insn *insn,unsigned int *data); */
-/* static int pci6208_dio_insn_config(struct comedi_device *dev,struct comedi_subdevice *s, */
+/* static int pci6208_dio_insn_config(struct comedi_device *dev,
+ * 					struct comedi_subdevice *s, */
 /* struct comedi_insn *insn,unsigned int *data); */
 
 /*
@@ -151,7 +153,7 @@ static int pci6208_attach(struct comedi_device *dev,
 	int retval;
 	unsigned long io_base;
 
-	printk("comedi%d: pci6208: ", dev->minor);
+	printk(KERN_INFO "comedi%d: pci6208: ", dev->minor);
 
 	retval = alloc_private(dev, sizeof(struct pci6208_private));
 	if (retval < 0)
@@ -195,7 +197,7 @@ static int pci6208_attach(struct comedi_device *dev,
 	/* s->insn_bits = pci6208_dio_insn_bits; */
 	/* s->insn_config = pci6208_dio_insn_config; */
 
-	printk("attached\n");
+	printk(KERN_INFO "attached\n");
 
 	return 1;
 }
@@ -210,12 +212,11 @@ static int pci6208_attach(struct comedi_device *dev,
  */
 static int pci6208_detach(struct comedi_device *dev)
 {
-	printk("comedi%d: pci6208: remove\n", dev->minor);
+	printk(KERN_INFO "comedi%d: pci6208: remove\n", dev->minor);
 
 	if (devpriv && devpriv->pci_dev) {
-		if (dev->iobase) {
+		if (dev->iobase)
 			comedi_pci_disable(devpriv->pci_dev);
-		}
 		pci_dev_put(devpriv->pci_dev);
 	}
 
@@ -266,7 +267,8 @@ static int pci6208_ao_rinsn(struct comedi_device *dev,
  * useful to applications if you implement the insn_bits interface.
  * This allows packed reading/writing of the DIO channels.  The
  * comedi core can convert between insn_bits and insn_read/write */
-/* static int pci6208_dio_insn_bits(struct comedi_device *dev,struct comedi_subdevice *s, */
+/* static int pci6208_dio_insn_bits(struct comedi_device *dev,
+ * 					struct comedi_subdevice *s, */
 /* struct comedi_insn *insn,unsigned int *data) */
 /* { */
 /* if(insn->n!=2)return -EINVAL; */
@@ -290,7 +292,8 @@ static int pci6208_ao_rinsn(struct comedi_device *dev,
 /* return 2; */
 /* } */
 
-/* static int pci6208_dio_insn_config(struct comedi_device *dev,struct comedi_subdevice *s, */
+/* static int pci6208_dio_insn_config(struct comedi_device *dev,
+ * 					struct comedi_subdevice *s, */
 /* struct comedi_insn *insn,unsigned int *data) */
 /* { */
 /* int chan=CR_CHAN(insn->chanspec); */
@@ -320,10 +323,16 @@ static int pci6208_find_device(struct comedi_device *dev, int bus, int slot)
 	     pci_dev = pci_get_device(PCI_ANY_ID, PCI_ANY_ID, pci_dev)) {
 		if (pci_dev->vendor == PCI_VENDOR_ID_ADLINK) {
 			for (i = 0; i < ARRAY_SIZE(pci6208_boards); i++) {
-				if (pci6208_boards[i].dev_id == pci_dev->device) {
-					/*  was a particular bus/slot requested? */
+				if (pci6208_boards[i].dev_id ==
+					pci_dev->device) {
+					/*
+					 * was a particular bus/slot requested?
+					*/
 					if ((bus != 0) || (slot != 0)) {
-						/*  are we on the wrong bus/slot? */
+						/*
+						 * are we on the
+						 * wrong bus/slot?
+						*/
 						if (pci_dev->bus->number
 						    != bus ||
 						    PCI_SLOT(pci_dev->devfn)
@@ -338,8 +347,9 @@ static int pci6208_find_device(struct comedi_device *dev, int bus, int slot)
 		}
 	}
 
-	printk("comedi%d: no supported board found! (req. bus/slot : %d/%d)\n",
-	       dev->minor, bus, slot);
+	printk(KERN_ERR "comedi%d: no supported board found! "
+			"(req. bus/slot : %d/%d)\n",
+			dev->minor, bus, slot);
 	return -EIO;
 
 found:
@@ -368,17 +378,20 @@ pci6208_pci_setup(struct pci_dev *pci_dev, unsigned long *io_base_ptr,
 
 	/*  Enable PCI device and request regions */
 	if (comedi_pci_enable(pci_dev, PCI6208_DRIVER_NAME) < 0) {
-		printk
-		    ("comedi%d: Failed to enable PCI device and request regions\n",
-		     dev_minor);
+		printk(KERN_ERR "comedi%d: Failed to enable PCI device "
+			"and request regions\n",
+			dev_minor);
 		return -EIO;
 	}
-	/*  Read local configuration register base address [PCI_BASE_ADDRESS #1]. */
+	/* Read local configuration register
+	 * base address [PCI_BASE_ADDRESS #1].
+	 */
 	lcr_io_base = pci_resource_start(pci_dev, 1);
 	lcr_io_range = pci_resource_len(pci_dev, 1);
 
-	printk("comedi%d: local config registers at address 0x%4lx [0x%4lx]\n",
-	       dev_minor, lcr_io_base, lcr_io_range);
+	printk(KERN_INFO "comedi%d: local config registers at address"
+			" 0x%4lx [0x%4lx]\n",
+			dev_minor, lcr_io_base, lcr_io_range);
 
 	/*  Read PCI6208 register base address [PCI_BASE_ADDRESS #2]. */
 	io_base = pci_resource_start(pci_dev, 2);
diff --git a/drivers/staging/comedi/drivers/adl_pci7296.c b/drivers/staging/comedi/drivers/adl_pci7296.c
index 4de6fadec78b..8602865ae6b7 100644
--- a/drivers/staging/comedi/drivers/adl_pci7296.c
+++ b/drivers/staging/comedi/drivers/adl_pci7296.c
@@ -82,8 +82,7 @@ static int adl_pci7296_attach(struct comedi_device *dev,
 	int bus, slot;
 	int ret;
 
-	printk("comedi: attempt to attach...\n");
-	printk("comedi%d: adl_pci7432\n", dev->minor);
+	printk(KERN_INFO "comedi%d: attach adl_pci7432\n", dev->minor);
 
 	dev->board_name = "pci7432";
 	bus = it->options[0];
@@ -110,14 +109,14 @@ static int adl_pci7296_attach(struct comedi_device *dev,
 			}
 			devpriv->pci_dev = pcidev;
 			if (comedi_pci_enable(pcidev, "adl_pci7296") < 0) {
-				printk
-				    ("comedi%d: Failed to enable PCI device and request regions\n",
+				printk(KERN_ERR "comedi%d: Failed to enable PCI device and request regions\n",
 				     dev->minor);
 				return -EIO;
 			}
 
 			dev->iobase = pci_resource_start(pcidev, 2);
-			printk("comedi: base addr %4lx\n", dev->iobase);
+			printk(KERN_INFO "comedi: base addr %4lx\n",
+				dev->iobase);
 
 			/*  four 8255 digital io subdevices */
 			s = dev->subdevices + 0;
@@ -145,25 +144,25 @@ static int adl_pci7296_attach(struct comedi_device *dev,
 			if (ret < 0)
 				return ret;
 
-			printk("attached\n");
+			printk(KERN_DEBUG "comedi%d: adl_pci7432 attached\n",
+				dev->minor);
 
 			return 1;
 		}
 	}
 
-	printk("comedi%d: no supported board found! (req. bus/slot : %d/%d)\n",
+	printk(KERN_ERR "comedi%d: no supported board found! (req. bus/slot : %d/%d)\n",
 	       dev->minor, bus, slot);
 	return -EIO;
 }
 
 static int adl_pci7296_detach(struct comedi_device *dev)
 {
-	printk("comedi%d: pci7432: remove\n", dev->minor);
+	printk(KERN_INFO "comedi%d: pci7432: remove\n", dev->minor);
 
 	if (devpriv && devpriv->pci_dev) {
-		if (dev->iobase) {
+		if (dev->iobase)
 			comedi_pci_disable(devpriv->pci_dev);
-		}
 		pci_dev_put(devpriv->pci_dev);
 	}
 	/*  detach four 8255 digital io subdevices */
diff --git a/drivers/staging/comedi/drivers/adl_pci7432.c b/drivers/staging/comedi/drivers/adl_pci7432.c
index e0844c69be77..b5a9499e438c 100644
--- a/drivers/staging/comedi/drivers/adl_pci7432.c
+++ b/drivers/staging/comedi/drivers/adl_pci7432.c
@@ -90,8 +90,7 @@ static int adl_pci7432_attach(struct comedi_device *dev,
 	struct comedi_subdevice *s;
 	int bus, slot;
 
-	printk("comedi: attempt to attach...\n");
-	printk("comedi%d: adl_pci7432\n", dev->minor);
+	printk(KERN_INFO "comedi%d: attach adl_pci7432\n", dev->minor);
 
 	dev->board_name = "pci7432";
 	bus = it->options[0];
@@ -118,13 +117,13 @@ static int adl_pci7432_attach(struct comedi_device *dev,
 			}
 			devpriv->pci_dev = pcidev;
 			if (comedi_pci_enable(pcidev, "adl_pci7432") < 0) {
-				printk
-				    ("comedi%d: Failed to enable PCI device and request regions\n",
+				printk(KERN_ERR "comedi%d: Failed to enable PCI device and request regions\n",
 				     dev->minor);
 				return -EIO;
 			}
 			dev->iobase = pci_resource_start(pcidev, 2);
-			printk("comedi: base addr %4lx\n", dev->iobase);
+			printk(KERN_INFO "comedi: base addr %4lx\n",
+				dev->iobase);
 
 			s = dev->subdevices + 0;
 			s->type = COMEDI_SUBD_DI;
@@ -148,25 +147,24 @@ static int adl_pci7432_attach(struct comedi_device *dev,
 			s->range_table = &range_digital;
 			s->insn_bits = adl_pci7432_do_insn_bits;
 
-			printk("comedi: attached\n");
-
+			printk(KERN_DEBUG "comedi%d: adl_pci7432 attached\n",
+				dev->minor);
 			return 1;
 		}
 	}
 
-	printk("comedi%d: no supported board found! (req. bus/slot : %d/%d)\n",
+	printk(KERN_ERR "comedi%d: no supported board found! (req. bus/slot : %d/%d)\n",
 	       dev->minor, bus, slot);
 	return -EIO;
 }
 
 static int adl_pci7432_detach(struct comedi_device *dev)
 {
-	printk("comedi%d: pci7432: remove\n", dev->minor);
+	printk(KERN_INFO "comedi%d: pci7432: remove\n", dev->minor);
 
 	if (devpriv && devpriv->pci_dev) {
-		if (dev->iobase) {
+		if (dev->iobase)
 			comedi_pci_disable(devpriv->pci_dev);
-		}
 		pci_dev_put(devpriv->pci_dev);
 	}
 
@@ -178,8 +176,8 @@ static int adl_pci7432_do_insn_bits(struct comedi_device *dev,
 				    struct comedi_insn *insn,
 				    unsigned int *data)
 {
-	printk("comedi: pci7432_do_insn_bits called\n");
-	printk("comedi: data0: %8x data1: %8x\n", data[0], data[1]);
+	printk(KERN_DEBUG "comedi: pci7432_do_insn_bits called\n");
+	printk(KERN_DEBUG "comedi: data0: %8x data1: %8x\n", data[0], data[1]);
 
 	if (insn->n != 2)
 		return -EINVAL;
@@ -188,7 +186,7 @@ static int adl_pci7432_do_insn_bits(struct comedi_device *dev,
 		s->state &= ~data[0];
 		s->state |= (data[0] & data[1]);
 
-		printk("comedi: out: %8x on iobase %4lx\n", s->state,
+		printk(KERN_DEBUG "comedi: out: %8x on iobase %4lx\n", s->state,
 		       dev->iobase + PCI7432_DO);
 		outl(s->state & 0xffffffff, dev->iobase + PCI7432_DO);
 	}
@@ -200,14 +198,14 @@ static int adl_pci7432_di_insn_bits(struct comedi_device *dev,
 				    struct comedi_insn *insn,
 				    unsigned int *data)
 {
-	printk("comedi: pci7432_di_insn_bits called\n");
-	printk("comedi: data0: %8x data1: %8x\n", data[0], data[1]);
+	printk(KERN_DEBUG "comedi: pci7432_di_insn_bits called\n");
+	printk(KERN_DEBUG "comedi: data0: %8x data1: %8x\n", data[0], data[1]);
 
 	if (insn->n != 2)
 		return -EINVAL;
 
 	data[1] = inl(dev->iobase + PCI7432_DI) & 0xffffffff;
-	printk("comedi: data1 %8x\n", data[1]);
+	printk(KERN_DEBUG "comedi: data1 %8x\n", data[1]);
 
 	return 2;
 }
diff --git a/drivers/staging/comedi/drivers/adl_pci8164.c b/drivers/staging/comedi/drivers/adl_pci8164.c
index 43745ec94ab5..da256a1e0b4d 100644
--- a/drivers/staging/comedi/drivers/adl_pci8164.c
+++ b/drivers/staging/comedi/drivers/adl_pci8164.c
@@ -35,6 +35,7 @@ Configuration Options:
 */
 
 #include "../comedidev.h"
+#include <linux/kernel.h>
 #include <linux/delay.h>
 #include "comedi_fc.h"
 #include "comedi_pci.h"
@@ -128,8 +129,8 @@ static int adl_pci8164_attach(struct comedi_device *dev,
 	struct comedi_subdevice *s;
 	int bus, slot;
 
-	printk("comedi: attempt to attach...\n");
-	printk("comedi%d: adl_pci8164\n", dev->minor);
+	printk(KERN_INFO "comedi: attempt to attach...\n");
+	printk(KERN_INFO "comedi%d: adl_pci8164\n", dev->minor);
 
 	dev->board_name = "pci8164";
 	bus = it->options[0];
@@ -150,19 +151,18 @@ static int adl_pci8164_attach(struct comedi_device *dev,
 			if (bus || slot) {
 				/* requested particular bus/slot */
 				if (pcidev->bus->number != bus
-				    || PCI_SLOT(pcidev->devfn) != slot) {
+					|| PCI_SLOT(pcidev->devfn) != slot)
 					continue;
-				}
 			}
 			devpriv->pci_dev = pcidev;
 			if (comedi_pci_enable(pcidev, "adl_pci8164") < 0) {
-				printk
-				    ("comedi%d: Failed to enable PCI device and request regions\n",
-				     dev->minor);
+				printk(KERN_ERR "comedi%d: Failed to enable "
+				"PCI device and request regions\n", dev->minor);
 				return -EIO;
 			}
 			dev->iobase = pci_resource_start(pcidev, 2);
-			printk("comedi: base addr %4lx\n", dev->iobase);
+			printk(KERN_DEBUG "comedi: base addr %4lx\n",
+				   dev->iobase);
 
 			s = dev->subdevices + 0;
 			s->type = COMEDI_SUBD_PROC;
@@ -204,25 +204,24 @@ static int adl_pci8164_attach(struct comedi_device *dev,
 			s->insn_read = adl_pci8164_insn_read_buf1;
 			s->insn_write = adl_pci8164_insn_write_buf1;
 
-			printk("comedi: attached\n");
+			printk(KERN_INFO "comedi: attached\n");
 
 			return 1;
 		}
 	}
 
-	printk("comedi%d: no supported board found! (req. bus/slot : %d/%d)\n",
-	       dev->minor, bus, slot);
+	printk(KERN_ERR "comedi%d: no supported board found!"
+		   "(req. bus/slot : %d/%d)\n", dev->minor, bus, slot);
 	return -EIO;
 }
 
 static int adl_pci8164_detach(struct comedi_device *dev)
 {
-	printk("comedi%d: pci8164: remove\n", dev->minor);
+	printk(KERN_INFO "comedi%d: pci8164: remove\n", dev->minor);
 
 	if (devpriv && devpriv->pci_dev) {
-		if (dev->iobase) {
+		if (dev->iobase)
 			comedi_pci_disable(devpriv->pci_dev);
-		}
 		pci_dev_put(devpriv->pci_dev);
 	}
 
@@ -267,8 +266,9 @@ static void adl_pci8164_insn_read(struct comedi_device *dev,
 	}
 
 	data[0] = inw(dev->iobase + axis_reg + offset);
-	printk("comedi: pci8164 %s read -> %04X:%04X on axis %s\n", action,
-	       data[0], data[1], axisname);
+	printk(KERN_DEBUG "comedi: pci8164 %s read -> "
+						  "%04X:%04X on axis %s\n",
+				action, data[0], data[1], axisname);
 }
 
 static int adl_pci8164_insn_read_msts(struct comedi_device *dev,
@@ -347,8 +347,9 @@ static void adl_pci8164_insn_out(struct comedi_device *dev,
 
 	outw(data[0], dev->iobase + axis_reg + offset);
 
-	printk("comedi: pci8164 %s write -> %04X:%04X on axis %s\n", action,
-	       data[0], data[1], axisname);
+	printk(KERN_DEBUG "comedi: pci8164 %s write -> "
+						"%04X:%04X on axis %s\n",
+				action, data[0], data[1], axisname);
 
 }
 
diff --git a/drivers/staging/comedi/drivers/adl_pci9118.c b/drivers/staging/comedi/drivers/adl_pci9118.c
index 1ee4b6a91c1f..791ea8334e1e 100644
--- a/drivers/staging/comedi/drivers/adl_pci9118.c
+++ b/drivers/staging/comedi/drivers/adl_pci9118.c
@@ -780,7 +780,7 @@ static int pci9118_ai_cmdtest(struct comedi_device *dev,
 			      struct comedi_cmd *cmd)
 {
 	int err = 0;
-	int tmp, divisor1, divisor2;
+	int tmp, divisor1 = 0, divisor2 = 0;
 
 	/* step 1: make sure trigger sources are trivially valid */
 
diff --git a/drivers/staging/comedi/drivers/adv_pci1710.c b/drivers/staging/comedi/drivers/adv_pci1710.c
index f0ae4c06fe95..951e57949f7f 100644
--- a/drivers/staging/comedi/drivers/adv_pci1710.c
+++ b/drivers/staging/comedi/drivers/adv_pci1710.c
@@ -830,7 +830,7 @@ static irqreturn_t interrupt_service_pci1710(int irq, void *d)
 static int pci171x_ai_docmd_and_mode(int mode, struct comedi_device *dev,
 				     struct comedi_subdevice *s)
 {
-	unsigned int divisor1, divisor2;
+	unsigned int divisor1 = 0, divisor2 = 0;
 	unsigned int seglen;
 
 	DPRINTK("adv_pci1710 EDBG: BGN: pci171x_ai_docmd_and_mode(%d,...)\n",
@@ -934,7 +934,7 @@ static int pci171x_ai_cmdtest(struct comedi_device *dev,
 			      struct comedi_cmd *cmd)
 {
 	int err = 0;
-	int tmp, divisor1, divisor2;
+	int tmp, divisor1 = 0, divisor2 = 0;
 
 	DPRINTK("adv_pci1710 EDBG: BGN: pci171x_ai_cmdtest(...)\n");
 #ifdef PCI171X_EXTDEBUG
diff --git a/drivers/staging/comedi/drivers/amplc_pc263.c b/drivers/staging/comedi/drivers/amplc_pc263.c
index c62a7e1f81bd..15808e95ceab 100644
--- a/drivers/staging/comedi/drivers/amplc_pc263.c
+++ b/drivers/staging/comedi/drivers/amplc_pc263.c
@@ -117,7 +117,8 @@ MODULE_DEVICE_TABLE(pci, pc263_pci_table);
 
 /* this structure is for data unique to this hardware driver.  If
    several hardware drivers keep similar information in this structure,
-   feel free to suggest moving the variable to the struct comedi_device struct.  */
+   feel free to suggest moving the variable to the struct comedi_device struct.
+*/
 #ifdef CONFIG_COMEDI_PCI
 struct pc263_private {
 	/* PCI device. */
@@ -281,7 +282,8 @@ static int pc263_attach(struct comedi_device *dev, struct comedi_devconfig *it)
 		ret = comedi_pci_enable(pci_dev, PC263_DRIVER_NAME);
 		if (ret < 0) {
 			printk(KERN_ERR
-			       "comedi%d: error! cannot enable PCI device and request regions!\n",
+			       "comedi%d: error! cannot enable PCI device and "
+				"request regions!\n",
 			       dev->minor);
 			return ret;
 		}
@@ -290,9 +292,8 @@ static int pc263_attach(struct comedi_device *dev, struct comedi_devconfig *it)
 #endif
 	{
 		ret = pc263_request_region(dev->minor, iobase, PC263_IO_SIZE);
-		if (ret < 0) {
+		if (ret < 0)
 			return ret;
-		}
 	}
 	dev->iobase = iobase;
 
@@ -350,21 +351,18 @@ static int pc263_detach(struct comedi_device *dev)
 	       PC263_DRIVER_NAME);
 
 #ifdef CONFIG_COMEDI_PCI
-	if (devpriv)
+	if (devpriv) {
 #endif
-	{
 #ifdef CONFIG_COMEDI_PCI
 		if (devpriv->pci_dev) {
-			if (dev->iobase) {
+			if (dev->iobase)
 				comedi_pci_disable(devpriv->pci_dev);
-			}
 			pci_dev_put(devpriv->pci_dev);
 		} else
 #endif
 		{
-			if (dev->iobase) {
+			if (dev->iobase)
 				release_region(dev->iobase, PC263_IO_SIZE);
-			}
 		}
 	}
 	if (dev->board_name) {
diff --git a/drivers/staging/comedi/drivers/cb_das16_cs.c b/drivers/staging/comedi/drivers/cb_das16_cs.c
index 39923cb388be..bc375e73abc1 100644
--- a/drivers/staging/comedi/drivers/cb_das16_cs.c
+++ b/drivers/staging/comedi/drivers/cb_das16_cs.c
@@ -372,7 +372,7 @@ static int das16cs_ai_cmdtest(struct comedi_device *dev,
 
 	/* step 2: make sure trigger sources are unique and mutually compatible */
 
-	/* note that mutual compatiblity is not an issue here */
+	/* note that mutual compatibility is not an issue here */
 	if (cmd->scan_begin_src != TRIG_TIMER &&
 	    cmd->scan_begin_src != TRIG_EXT)
 		err++;
@@ -452,7 +452,7 @@ static int das16cs_ai_cmdtest(struct comedi_device *dev,
 	/* step 4: fix up any arguments */
 
 	if (cmd->scan_begin_src == TRIG_TIMER) {
-		unsigned int div1, div2;
+		unsigned int div1 = 0, div2 = 0;
 
 		tmp = cmd->scan_begin_arg;
 		i8253_cascade_ns_to_timer(100, &div1, &div2,
@@ -462,7 +462,7 @@ static int das16cs_ai_cmdtest(struct comedi_device *dev,
 			err++;
 	}
 	if (cmd->convert_src == TRIG_TIMER) {
-		unsigned int div1, div2;
+		unsigned int div1 = 0, div2 = 0;
 
 		tmp = cmd->convert_arg;
 		i8253_cascade_ns_to_timer(100, &div1, &div2,
diff --git a/drivers/staging/comedi/drivers/cb_pcidda.c b/drivers/staging/comedi/drivers/cb_pcidda.c
index 7a5d46ef1b77..782357732eed 100644
--- a/drivers/staging/comedi/drivers/cb_pcidda.c
+++ b/drivers/staging/comedi/drivers/cb_pcidda.c
@@ -497,7 +497,7 @@ static int cb_pcidda_ai_cmdtest(struct comedi_device *dev,
 
 	/* step 2: make sure trigger sources are unique and mutually compatible */
 
-	/* note that mutual compatiblity is not an issue here */
+	/* note that mutual compatibility is not an issue here */
 	if (cmd->scan_begin_src != TRIG_TIMER
 	    && cmd->scan_begin_src != TRIG_EXT)
 		err++;
diff --git a/drivers/staging/comedi/drivers/cb_pcidio.c b/drivers/staging/comedi/drivers/cb_pcidio.c
index 09e6e3bdfb3e..7daad0a17fb1 100644
--- a/drivers/staging/comedi/drivers/cb_pcidio.c
+++ b/drivers/staging/comedi/drivers/cb_pcidio.c
@@ -109,12 +109,12 @@ MODULE_DEVICE_TABLE(pci, pcidio_pci_table);
    several hardware drivers keep similar information in this structure,
    feel free to suggest moving the variable to the struct comedi_device struct.  */
 struct pcidio_private {
-	int data;		/*  curently unused */
+	int data;		/*  currently unused */
 
 	/* would be useful for a PCI device */
 	struct pci_dev *pci_dev;
 
-	/* used for DO readback, curently unused */
+	/* used for DO readback, currently unused */
 	unsigned int do_readback[4];	/* up to 4 unsigned int suffice to hold 96 bits for PCI-DIO96 */
 
 	unsigned long dio_reg_base;	/*  address of port A of the first 8255 chip on board */
diff --git a/drivers/staging/comedi/drivers/comedi_fc.c b/drivers/staging/comedi/drivers/comedi_fc.c
index f781154734ad..63be619dd606 100644
--- a/drivers/staging/comedi/drivers/comedi_fc.c
+++ b/drivers/staging/comedi/drivers/comedi_fc.c
@@ -53,7 +53,7 @@ unsigned int cfc_write_array_to_buffer(struct comedi_subdevice *subd,
 
 	retval = comedi_buf_write_alloc(async, num_bytes);
 	if (retval != num_bytes) {
-		printk("comedi: buffer overrun\n");
+		printk(KERN_WARNING "comedi: buffer overrun\n");
 		async->events |= COMEDI_CB_OVERFLOW;
 		return 0;
 	}
@@ -65,7 +65,6 @@ unsigned int cfc_write_array_to_buffer(struct comedi_subdevice *subd,
 
 	return num_bytes;
 }
-
 EXPORT_SYMBOL(cfc_write_array_to_buffer);
 
 unsigned int cfc_read_array_from_buffer(struct comedi_subdevice *subd,
@@ -84,7 +83,6 @@ unsigned int cfc_read_array_from_buffer(struct comedi_subdevice *subd,
 
 	return num_bytes;
 }
-
 EXPORT_SYMBOL(cfc_read_array_from_buffer);
 
 unsigned int cfc_handle_events(struct comedi_device *dev,
@@ -102,7 +100,6 @@ unsigned int cfc_handle_events(struct comedi_device *dev,
 
 	return events;
 }
-
 EXPORT_SYMBOL(cfc_handle_events);
 
 MODULE_AUTHOR("Frank Mori Hess <fmhess@users.sourceforge.net>");
diff --git a/drivers/staging/comedi/drivers/dmm32at.c b/drivers/staging/comedi/drivers/dmm32at.c
index aeec1ee9ad6b..9db9a467c8f8 100644
--- a/drivers/staging/comedi/drivers/dmm32at.c
+++ b/drivers/staging/comedi/drivers/dmm32at.c
@@ -629,7 +629,7 @@ static int dmm32at_ai_cmdtest(struct comedi_device *dev,
 
 	/* step 2: make sure trigger sources are unique and mutually compatible */
 
-	/* note that mutual compatiblity is not an issue here */
+	/* note that mutual compatibility is not an issue here */
 	if (cmd->scan_begin_src != TRIG_TIMER &&
 	    cmd->scan_begin_src != TRIG_EXT)
 		err++;
diff --git a/drivers/staging/comedi/drivers/dt2814.c b/drivers/staging/comedi/drivers/dt2814.c
index 0364bbf178e1..e1b73752f607 100644
--- a/drivers/staging/comedi/drivers/dt2814.c
+++ b/drivers/staging/comedi/drivers/dt2814.c
@@ -175,7 +175,7 @@ static int dt2814_ai_cmdtest(struct comedi_device *dev,
 
 	/* step 2: make sure trigger sources are unique and mutually compatible */
 
-	/* note that mutual compatiblity is not an issue here */
+	/* note that mutual compatibility is not an issue here */
 	if (cmd->stop_src != TRIG_TIMER && cmd->stop_src != TRIG_EXT)
 		err++;
 
diff --git a/drivers/staging/comedi/drivers/dt282x.c b/drivers/staging/comedi/drivers/dt282x.c
index a4c96c02fa2b..99ca294b1ec5 100644
--- a/drivers/staging/comedi/drivers/dt282x.c
+++ b/drivers/staging/comedi/drivers/dt282x.c
@@ -777,7 +777,7 @@ static int dt282x_ai_cmdtest(struct comedi_device *dev,
 
 	/* step 2: make sure trigger sources are unique and mutually compatible */
 
-	/* note that mutual compatiblity is not an issue here */
+	/* note that mutual compatibility is not an issue here */
 	if (cmd->scan_begin_src != TRIG_FOLLOW &&
 	    cmd->scan_begin_src != TRIG_EXT)
 		err++;
@@ -1050,7 +1050,7 @@ static int dt282x_ao_cmdtest(struct comedi_device *dev,
 
 	/* step 2: make sure trigger sources are unique and mutually compatible */
 
-	/* note that mutual compatiblity is not an issue here */
+	/* note that mutual compatibility is not an issue here */
 	if (cmd->stop_src != TRIG_COUNT && cmd->stop_src != TRIG_NONE)
 		err++;
 
diff --git a/drivers/staging/comedi/drivers/gsc_hpdi.c b/drivers/staging/comedi/drivers/gsc_hpdi.c
index 0bb30162e92c..51f12bf45cf1 100644
--- a/drivers/staging/comedi/drivers/gsc_hpdi.c
+++ b/drivers/staging/comedi/drivers/gsc_hpdi.c
@@ -55,7 +55,7 @@ support could be added to this driver.
 
 static int hpdi_attach(struct comedi_device *dev, struct comedi_devconfig *it);
 static int hpdi_detach(struct comedi_device *dev);
-void abort_dma(struct comedi_device *dev, unsigned int channel);
+static void abort_dma(struct comedi_device *dev, unsigned int channel);
 static int hpdi_cmd(struct comedi_device *dev, struct comedi_subdevice *s);
 static int hpdi_cmd_test(struct comedi_device *dev, struct comedi_subdevice *s,
 			 struct comedi_cmd *cmd);
@@ -110,7 +110,8 @@ enum hpdi_registers {
 int command_channel_valid(unsigned int channel)
 {
 	if (channel == 0 || channel > 6) {
-		printk("gsc_hpdi: bug! invalid cable command channel\n");
+		printk(KERN_WARNING
+		       "gsc_hpdi: bug! invalid cable command channel\n");
 		return 0;
 	}
 	return 1;
@@ -142,7 +143,8 @@ enum board_control_bits {
 	RX_FIFO_RESET_BIT = 0x4,
 	TX_ENABLE_BIT = 0x10,
 	RX_ENABLE_BIT = 0x20,
-	DEMAND_DMA_DIRECTION_TX_BIT = 0x40,	/* for channel 0, channel 1 can only transmit (when present) */
+	DEMAND_DMA_DIRECTION_TX_BIT = 0x40,
+		/* for ch 0, ch 1 can only transmit (when present) */
 	LINE_VALID_ON_STATUS_VALID_BIT = 0x80,
 	START_TX_BIT = 0x10,
 	CABLE_THROTTLE_ENABLE_BIT = 0x20,
@@ -420,9 +422,11 @@ static void init_plx9080(struct comedi_device *dev)
 	bits |= PLX_DMA_EN_READYIN_BIT;
 	/*  enable dma chaining */
 	bits |= PLX_EN_CHAIN_BIT;
-	/*  enable interrupt on dma done (probably don't need this, since chain never finishes) */
+	/*  enable interrupt on dma done
+	 *  (probably don't need this, since chain never finishes) */
 	bits |= PLX_EN_DMA_DONE_INTR_BIT;
-	/*  don't increment local address during transfers (we are transferring from a fixed fifo register) */
+	/*  don't increment local address during transfers
+	 *  (we are transferring from a fixed fifo register) */
 	bits |= PLX_LOCAL_ADDR_CONST_BIT;
 	/*  route dma interrupt to pci bus */
 	bits |= PLX_DMA_INTR_PCI_BIT;
@@ -560,7 +564,7 @@ static int hpdi_attach(struct comedi_device *dev, struct comedi_devconfig *it)
 	int i;
 	int retval;
 
-	printk("comedi%d: gsc_hpdi\n", dev->minor);
+	printk(KERN_WARNING "comedi%d: gsc_hpdi\n", dev->minor);
 
 	if (alloc_private(dev, sizeof(struct hpdi_private)) < 0)
 		return -ENOMEM;
@@ -588,11 +592,12 @@ static int hpdi_attach(struct comedi_device *dev, struct comedi_devconfig *it)
 		} while (pcidev != NULL);
 	}
 	if (dev->board_ptr == NULL) {
-		printk("gsc_hpdi: no hpdi card found\n");
+		printk(KERN_WARNING "gsc_hpdi: no hpdi card found\n");
 		return -EIO;
 	}
 
-	printk("gsc_hpdi: found %s on bus %i, slot %i\n", board(dev)->name,
+	printk(KERN_WARNING
+	       "gsc_hpdi: found %s on bus %i, slot %i\n", board(dev)->name,
 	       pcidev->bus->number, PCI_SLOT(pcidev->devfn));
 
 	if (comedi_pci_enable(pcidev, driver_hpdi.driver_name)) {
@@ -618,7 +623,7 @@ static int hpdi_attach(struct comedi_device *dev, struct comedi_devconfig *it)
 	    ioremap(priv(dev)->hpdi_phys_iobase,
 		    pci_resource_len(pcidev, HPDI_BADDRINDEX));
 	if (!priv(dev)->plx9080_iobase || !priv(dev)->hpdi_iobase) {
-		printk(" failed to remap io memory\n");
+		printk(KERN_WARNING " failed to remap io memory\n");
 		return -ENOMEM;
 	}
 
@@ -630,12 +635,13 @@ static int hpdi_attach(struct comedi_device *dev, struct comedi_devconfig *it)
 	/*  get irq */
 	if (request_irq(pcidev->irq, handle_interrupt, IRQF_SHARED,
 			driver_hpdi.driver_name, dev)) {
-		printk(" unable to allocate irq %u\n", pcidev->irq);
+		printk(KERN_WARNING
+		       " unable to allocate irq %u\n", pcidev->irq);
 		return -EINVAL;
 	}
 	dev->irq = pcidev->irq;
 
-	printk(" irq %u\n", dev->irq);
+	printk(KERN_WARNING " irq %u\n", dev->irq);
 
 	/*  alocate pci dma buffers */
 	for (i = 0; i < NUM_DMA_BUFFERS; i++) {
@@ -653,7 +659,8 @@ static int hpdi_attach(struct comedi_device *dev, struct comedi_devconfig *it)
 						   &priv(dev)->
 						   dma_desc_phys_addr);
 	if (priv(dev)->dma_desc_phys_addr & 0xf) {
-		printk(" dma descriptors not quad-word aligned (bug)\n");
+		printk(KERN_WARNING
+		       " dma descriptors not quad-word aligned (bug)\n");
 		return -EIO;
 	}
 
@@ -672,42 +679,39 @@ static int hpdi_detach(struct comedi_device *dev)
 {
 	unsigned int i;
 
-	printk("comedi%d: gsc_hpdi: remove\n", dev->minor);
+	printk(KERN_WARNING "comedi%d: gsc_hpdi: remove\n", dev->minor);
 
 	if (dev->irq)
 		free_irq(dev->irq, dev);
-	if (priv(dev)) {
-		if (priv(dev)->hw_dev) {
-			if (priv(dev)->plx9080_iobase) {
-				disable_plx_interrupts(dev);
-				iounmap((void *)priv(dev)->plx9080_iobase);
-			}
-			if (priv(dev)->hpdi_iobase)
-				iounmap((void *)priv(dev)->hpdi_iobase);
-			/*  free pci dma buffers */
-			for (i = 0; i < NUM_DMA_BUFFERS; i++) {
-				if (priv(dev)->dio_buffer[i])
-					pci_free_consistent(priv(dev)->hw_dev,
-							    DMA_BUFFER_SIZE,
-							    priv(dev)->
-							    dio_buffer[i],
-							    priv
-							    (dev)->dio_buffer_phys_addr
-							    [i]);
-			}
-			/*  free dma descriptors */
-			if (priv(dev)->dma_desc)
+	if ((priv(dev)) && (priv(dev)->hw_dev)) {
+		if (priv(dev)->plx9080_iobase) {
+			disable_plx_interrupts(dev);
+			iounmap((void *)priv(dev)->plx9080_iobase);
+		}
+		if (priv(dev)->hpdi_iobase)
+			iounmap((void *)priv(dev)->hpdi_iobase);
+		/*  free pci dma buffers */
+		for (i = 0; i < NUM_DMA_BUFFERS; i++) {
+			if (priv(dev)->dio_buffer[i])
 				pci_free_consistent(priv(dev)->hw_dev,
-						    sizeof(struct plx_dma_desc)
-						    * NUM_DMA_DESCRIPTORS,
-						    priv(dev)->dma_desc,
+						    DMA_BUFFER_SIZE,
 						    priv(dev)->
-						    dma_desc_phys_addr);
-			if (priv(dev)->hpdi_phys_iobase) {
-				comedi_pci_disable(priv(dev)->hw_dev);
-			}
-			pci_dev_put(priv(dev)->hw_dev);
+						    dio_buffer[i],
+						    priv
+						    (dev)->dio_buffer_phys_addr
+						    [i]);
 		}
+		/*  free dma descriptors */
+		if (priv(dev)->dma_desc)
+			pci_free_consistent(priv(dev)->hw_dev,
+					    sizeof(struct plx_dma_desc)
+					    * NUM_DMA_DESCRIPTORS,
+					    priv(dev)->dma_desc,
+					    priv(dev)->
+					    dma_desc_phys_addr);
+		if (priv(dev)->hpdi_phys_iobase)
+			comedi_pci_disable(priv(dev)->hw_dev);
+		pci_dev_put(priv(dev)->hw_dev);
 	}
 	return 0;
 }
@@ -810,15 +814,16 @@ static int di_cmd_test(struct comedi_device *dev, struct comedi_subdevice *s,
 	if (err)
 		return 4;
 
-	if (cmd->chanlist) {
-		for (i = 1; i < cmd->chanlist_len; i++) {
-			if (CR_CHAN(cmd->chanlist[i]) != i) {
-				/*  XXX could support 8 channels or 16 channels */
-				comedi_error(dev,
-					     "chanlist must be channels 0 to 31 in order");
-				err++;
-				break;
-			}
+	if (!cmd->chanlist)
+		return 0;
+
+	for (i = 1; i < cmd->chanlist_len; i++) {
+		if (CR_CHAN(cmd->chanlist[i]) != i) {
+			/*  XXX could support 8 or 16 channels */
+			comedi_error(dev,
+				     "chanlist must be ch 0 to 31 in order");
+			err++;
+			break;
 		}
 	}
 
@@ -831,9 +836,9 @@ static int di_cmd_test(struct comedi_device *dev, struct comedi_subdevice *s,
 static int hpdi_cmd_test(struct comedi_device *dev, struct comedi_subdevice *s,
 			 struct comedi_cmd *cmd)
 {
-	if (priv(dev)->dio_config_output) {
+	if (priv(dev)->dio_config_output)
 		return -EINVAL;
-	} else
+	else
 		return di_cmd_test(dev, s, cmd);
 }
 
@@ -899,9 +904,9 @@ static int di_cmd(struct comedi_device *dev, struct comedi_subdevice *s)
 
 static int hpdi_cmd(struct comedi_device *dev, struct comedi_subdevice *s)
 {
-	if (priv(dev)->dio_config_output) {
+	if (priv(dev)->dio_config_output)
 		return -EINVAL;
-	} else
+	else
 		return di_cmd(dev, s);
 }
 
@@ -963,14 +968,12 @@ static irqreturn_t handle_interrupt(int irq, void *d)
 	uint8_t dma0_status, dma1_status;
 	unsigned long flags;
 
-	if (!dev->attached) {
+	if (!dev->attached)
 		return IRQ_NONE;
-	}
 
 	plx_status = readl(priv(dev)->plx9080_iobase + PLX_INTRCS_REG);
-	if ((plx_status & (ICS_DMA0_A | ICS_DMA1_A | ICS_LIA)) == 0) {
+	if ((plx_status & (ICS_DMA0_A | ICS_DMA1_A | ICS_LIA)) == 0)
 		return IRQ_NONE;
-	}
 
 	hpdi_intr_status = readl(priv(dev)->hpdi_iobase + INTERRUPT_STATUS_REG);
 	hpdi_board_status = readl(priv(dev)->hpdi_iobase + BOARD_STATUS_REG);
@@ -990,9 +993,8 @@ static irqreturn_t handle_interrupt(int irq, void *d)
 		       priv(dev)->plx9080_iobase + PLX_DMA0_CS_REG);
 
 		DEBUG_PRINT("dma0 status 0x%x\n", dma0_status);
-		if (dma0_status & PLX_DMA_EN_BIT) {
+		if (dma0_status & PLX_DMA_EN_BIT)
 			drain_dma_buffers(dev, 0);
-		}
 		DEBUG_PRINT(" cleared dma ch0 interrupt\n");
 	}
 	spin_unlock_irqrestore(&dev->spinlock, flags);
@@ -1042,7 +1044,7 @@ static irqreturn_t handle_interrupt(int irq, void *d)
 	return IRQ_HANDLED;
 }
 
-void abort_dma(struct comedi_device *dev, unsigned int channel)
+static void abort_dma(struct comedi_device *dev, unsigned int channel)
 {
 	unsigned long flags;
 
diff --git a/drivers/staging/comedi/drivers/icp_multi.c b/drivers/staging/comedi/drivers/icp_multi.c
index 7a67fff42358..fa0e48173bd4 100644
--- a/drivers/staging/comedi/drivers/icp_multi.c
+++ b/drivers/staging/comedi/drivers/icp_multi.c
@@ -46,7 +46,7 @@ There are 4 x 12-bit Analogue Outputs.  Ranges : 5V, 10V, +/-5V, +/-10V
 
 Options:
  [0] - PCI bus number - if bus number and slot number are 0,
-                        then driver search for first unused card
+			then driver search for first unused card
  [1] - PCI slot number
 */
 
@@ -133,7 +133,7 @@ static int icp_multi_detach(struct comedi_device *dev);
 	Data & Structure declarations
 ==============================================================================
 */
-static unsigned short pci_list_builded = 0;	/*>0 list of card is known */
+static unsigned short pci_list_builded;	/*>0 list of card is known */
 
 struct boardtype {
 	const char *name;	/*  driver name */
@@ -176,13 +176,13 @@ static const struct boardtype boardtypes[] = {
 #define n_boardtypes (sizeof(boardtypes)/sizeof(struct boardtype))
 
 static struct comedi_driver driver_icp_multi = {
-driver_name:"icp_multi",
-module:THIS_MODULE,
-attach:icp_multi_attach,
-detach:icp_multi_detach,
-num_names:n_boardtypes,
-board_name:&boardtypes[0].name,
-offset:sizeof(struct boardtype),
+driver_name: "icp_multi",
+module : THIS_MODULE,
+attach : icp_multi_attach,
+detach : icp_multi_detach,
+num_names : n_boardtypes,
+board_name : &boardtypes[0].name,
+offset : sizeof(struct boardtype),
 };
 
 COMEDI_INITCLEANUP(driver_icp_multi);
@@ -234,18 +234,18 @@ static int icp_multi_reset(struct comedi_device *dev);
 /*
 ==============================================================================
 
-	Name:	icp_multi_insn_read_ai
+Name:	icp_multi_insn_read_ai
 
-	Description:
-		This function reads a single analogue input.
+Description:
+	This function reads a single analogue input.
 
-	Parameters:
-		struct comedi_device *dev	Pointer to current device structure
-		struct comedi_subdevice *s	Pointer to current subdevice structure
-		struct comedi_insn *insn	Pointer to current comedi instruction
-		unsigned int *data		Pointer to analogue input data
+Parameters:
+	struct comedi_device *dev	Pointer to current device structure
+	struct comedi_subdevice *s	Pointer to current subdevice structure
+	struct comedi_insn *insn	Pointer to current comedi instruction
+	unsigned int *data		Pointer to analogue input data
 
-	Returns:int			Nmuber of instructions executed
+Returns:int			Nmuber of instructions executed
 
 ==============================================================================
 */
@@ -256,7 +256,7 @@ static int icp_multi_insn_read_ai(struct comedi_device *dev,
 	int n, timeout;
 
 #ifdef ICP_MULTI_EXTDEBUG
-	printk("icp multi EDBG: BGN: icp_multi_insn_read_ai(...)\n");
+	printk(KERN_DEBUG "icp multi EDBG: BGN: icp_multi_insn_read_ai(...)\n");
 #endif
 	/*  Disable A/D conversion ready interrupt */
 	devpriv->IntEnable &= ~ADC_READY;
@@ -266,11 +266,11 @@ static int icp_multi_insn_read_ai(struct comedi_device *dev,
 	devpriv->IntStatus |= ADC_READY;
 	writew(devpriv->IntStatus, devpriv->io_addr + ICP_MULTI_INT_STAT);
 
-	/*  Set up appropriate channel, mode and range data, for specified channel */
+	/*  Set up appropriate channel, mode and range data, for specified ch */
 	setup_channel_list(dev, s, &insn->chanspec, 1);
 
 #ifdef ICP_MULTI_EXTDEBUG
-	printk("icp_multi A ST=%4x IO=%p\n",
+	printk(KERN_DEBUG "icp_multi A ST=%4x IO=%p\n",
 	       readw(devpriv->io_addr + ICP_MULTI_ADC_CSR),
 	       devpriv->io_addr + ICP_MULTI_ADC_CSR);
 #endif
@@ -283,14 +283,14 @@ static int icp_multi_insn_read_ai(struct comedi_device *dev,
 		devpriv->AdcCmdStatus &= ~ADC_ST;
 
 #ifdef ICP_MULTI_EXTDEBUG
-		printk("icp multi B n=%d ST=%4x\n", n,
+		printk(KERN_DEBUG "icp multi B n=%d ST=%4x\n", n,
 		       readw(devpriv->io_addr + ICP_MULTI_ADC_CSR));
 #endif
 
 		udelay(1);
 
 #ifdef ICP_MULTI_EXTDEBUG
-		printk("icp multi C n=%d ST=%4x\n", n,
+		printk(KERN_DEBUG "icp multi C n=%d ST=%4x\n", n,
 		       readw(devpriv->io_addr + ICP_MULTI_ADC_CSR));
 #endif
 
@@ -303,7 +303,8 @@ static int icp_multi_insn_read_ai(struct comedi_device *dev,
 
 #ifdef ICP_MULTI_EXTDEBUG
 			if (!(timeout % 10))
-				printk("icp multi D n=%d tm=%d ST=%4x\n", n,
+				printk(KERN_DEBUG
+				       "icp multi D n=%d tm=%d ST=%4x\n", n,
 				       timeout,
 				       readw(devpriv->io_addr +
 					     ICP_MULTI_ADC_CSR));
@@ -328,9 +329,9 @@ static int icp_multi_insn_read_ai(struct comedi_device *dev,
 		data[n] = 0;
 
 #ifdef ICP_MULTI_EXTDEBUG
-		printk
-		    ("icp multi EDBG: END: icp_multi_insn_read_ai(...) n=%d\n",
-		     n);
+		printk(KERN_DEBUG
+		      "icp multi EDBG: END: icp_multi_insn_read_ai(...) n=%d\n",
+		      n);
 #endif
 		return -ETIME;
 
@@ -348,7 +349,8 @@ conv_finish:
 	writew(devpriv->IntStatus, devpriv->io_addr + ICP_MULTI_INT_STAT);
 
 #ifdef ICP_MULTI_EXTDEBUG
-	printk("icp multi EDBG: END: icp_multi_insn_read_ai(...) n=%d\n", n);
+	printk(KERN_DEBUG
+	       "icp multi EDBG: END: icp_multi_insn_read_ai(...) n=%d\n", n);
 #endif
 	return n;
 }
@@ -356,18 +358,18 @@ conv_finish:
 /*
 ==============================================================================
 
-	Name:	icp_multi_insn_write_ao
+Name:	icp_multi_insn_write_ao
 
-	Description:
-		This function writes a single analogue output.
+Description:
+	This function writes a single analogue output.
 
-	Parameters:
-		struct comedi_device *dev	Pointer to current device structure
-		struct comedi_subdevice *s	Pointer to current subdevice structure
-		struct comedi_insn *insn	Pointer to current comedi instruction
-		unsigned int *data		Pointer to analogue output data
+Parameters:
+	struct comedi_device *dev	Pointer to current device structure
+	struct comedi_subdevice *s	Pointer to current subdevice structure
+	struct comedi_insn *insn	Pointer to current comedi instruction
+	unsigned int *data		Pointer to analogue output data
 
-	Returns:int			Nmuber of instructions executed
+Returns:int			Nmuber of instructions executed
 
 ==============================================================================
 */
@@ -378,7 +380,8 @@ static int icp_multi_insn_write_ao(struct comedi_device *dev,
 	int n, chan, range, timeout;
 
 #ifdef ICP_MULTI_EXTDEBUG
-	printk("icp multi EDBG: BGN: icp_multi_insn_write_ao(...)\n");
+	printk(KERN_DEBUG
+	       "icp multi EDBG: BGN: icp_multi_insn_write_ao(...)\n");
 #endif
 	/*  Disable D/A conversion ready interrupt */
 	devpriv->IntEnable &= ~DAC_READY;
@@ -404,7 +407,8 @@ static int icp_multi_insn_write_ao(struct comedi_device *dev,
 	writew(devpriv->DacCmdStatus, devpriv->io_addr + ICP_MULTI_DAC_CSR);
 
 	for (n = 0; n < insn->n; n++) {
-		/*  Wait for analogue output data register to be ready for new data, or get fed up waiting */
+		/*  Wait for analogue output data register to be
+		 *  ready for new data, or get fed up waiting */
 		timeout = 100;
 		while (timeout--) {
 			if (!(readw(devpriv->io_addr +
@@ -413,7 +417,8 @@ static int icp_multi_insn_write_ao(struct comedi_device *dev,
 
 #ifdef ICP_MULTI_EXTDEBUG
 			if (!(timeout % 10))
-				printk("icp multi A n=%d tm=%d ST=%4x\n", n,
+				printk(KERN_DEBUG
+				       "icp multi A n=%d tm=%d ST=%4x\n", n,
 				       timeout,
 				       readw(devpriv->io_addr +
 					     ICP_MULTI_DAC_CSR));
@@ -438,8 +443,8 @@ static int icp_multi_insn_write_ao(struct comedi_device *dev,
 		devpriv->ao_data[chan] = 0;
 
 #ifdef ICP_MULTI_EXTDEBUG
-		printk
-		    ("icp multi EDBG: END: icp_multi_insn_write_ao(...) n=%d\n",
+		printk(KERN_DEBUG
+		     "icp multi EDBG: END: icp_multi_insn_write_ao(...) n=%d\n",
 		     n);
 #endif
 		return -ETIME;
@@ -459,7 +464,8 @@ dac_ready:
 	}
 
 #ifdef ICP_MULTI_EXTDEBUG
-	printk("icp multi EDBG: END: icp_multi_insn_write_ao(...) n=%d\n", n);
+	printk(KERN_DEBUG
+	       "icp multi EDBG: END: icp_multi_insn_write_ao(...) n=%d\n", n);
 #endif
 	return n;
 }
@@ -467,18 +473,18 @@ dac_ready:
 /*
 ==============================================================================
 
-	Name:	icp_multi_insn_read_ao
+Name:	icp_multi_insn_read_ao
 
-	Description:
-		This function reads a single analogue output.
+Description:
+	This function reads a single analogue output.
 
-	Parameters:
-		struct comedi_device *dev	Pointer to current device structure
-		struct comedi_subdevice *s	Pointer to current subdevice structure
-		struct comedi_insn *insn	Pointer to current comedi instruction
-		unsigned int *data		Pointer to analogue output data
+Parameters:
+	struct comedi_device *dev	Pointer to current device structure
+	struct comedi_subdevice *s	Pointer to current subdevice structure
+	struct comedi_insn *insn	Pointer to current comedi instruction
+	unsigned int *data		Pointer to analogue output data
 
-	Returns:int			Nmuber of instructions executed
+Returns:int			Nmuber of instructions executed
 
 ==============================================================================
 */
@@ -501,18 +507,18 @@ static int icp_multi_insn_read_ao(struct comedi_device *dev,
 /*
 ==============================================================================
 
-	Name:	icp_multi_insn_bits_di
+Name:	icp_multi_insn_bits_di
 
-	Description:
-		This function reads the digital inputs.
+Description:
+	This function reads the digital inputs.
 
-	Parameters:
-		struct comedi_device *dev	Pointer to current device structure
-		struct comedi_subdevice *s	Pointer to current subdevice structure
-		struct comedi_insn *insn	Pointer to current comedi instruction
-		unsigned int *data		Pointer to analogue output data
+Parameters:
+	struct comedi_device *dev	Pointer to current device structure
+	struct comedi_subdevice *s	Pointer to current subdevice structure
+	struct comedi_insn *insn	Pointer to current comedi instruction
+	unsigned int *data		Pointer to analogue output data
 
-	Returns:int			Nmuber of instructions executed
+Returns:int			Nmuber of instructions executed
 
 ==============================================================================
 */
@@ -528,18 +534,18 @@ static int icp_multi_insn_bits_di(struct comedi_device *dev,
 /*
 ==============================================================================
 
-	Name:	icp_multi_insn_bits_do
+Name:	icp_multi_insn_bits_do
 
-	Description:
-		This function writes the appropriate digital outputs.
+Description:
+	This function writes the appropriate digital outputs.
 
-	Parameters:
-		struct comedi_device *dev	Pointer to current device structure
-		struct comedi_subdevice *s	Pointer to current subdevice structure
-		struct comedi_insn *insn	Pointer to current comedi instruction
-		unsigned int *data		Pointer to analogue output data
+Parameters:
+	struct comedi_device *dev	Pointer to current device structure
+	struct comedi_subdevice *s	Pointer to current subdevice structure
+	struct comedi_insn *insn	Pointer to current comedi instruction
+	unsigned int *data		Pointer to analogue output data
 
-	Returns:int			Nmuber of instructions executed
+Returns:int			Nmuber of instructions executed
 
 ==============================================================================
 */
@@ -548,14 +554,14 @@ static int icp_multi_insn_bits_do(struct comedi_device *dev,
 				  struct comedi_insn *insn, unsigned int *data)
 {
 #ifdef ICP_MULTI_EXTDEBUG
-	printk("icp multi EDBG: BGN: icp_multi_insn_bits_do(...)\n");
+	printk(KERN_DEBUG "icp multi EDBG: BGN: icp_multi_insn_bits_do(...)\n");
 #endif
 
 	if (data[0]) {
 		s->state &= ~data[0];
 		s->state |= (data[0] & data[1]);
 
-		printk("Digital outputs = %4x \n", s->state);
+		printk(KERN_DEBUG "Digital outputs = %4x \n", s->state);
 
 		writew(s->state, devpriv->io_addr + ICP_MULTI_DO);
 	}
@@ -563,7 +569,7 @@ static int icp_multi_insn_bits_do(struct comedi_device *dev,
 	data[1] = readw(devpriv->io_addr + ICP_MULTI_DI);
 
 #ifdef ICP_MULTI_EXTDEBUG
-	printk("icp multi EDBG: END: icp_multi_insn_bits_do(...)\n");
+	printk(KERN_DEBUG "icp multi EDBG: END: icp_multi_insn_bits_do(...)\n");
 #endif
 	return 2;
 }
@@ -571,18 +577,18 @@ static int icp_multi_insn_bits_do(struct comedi_device *dev,
 /*
 ==============================================================================
 
-	Name:	icp_multi_insn_read_ctr
+Name:	icp_multi_insn_read_ctr
 
-	Description:
-		This function reads the specified counter.
+Description:
+	This function reads the specified counter.
 
-	Parameters:
-		struct comedi_device *dev	Pointer to current device structure
-		struct comedi_subdevice *s	Pointer to current subdevice structure
-		struct comedi_insn *insn	Pointer to current comedi instruction
-		unsigned int *data		Pointer to counter data
+Parameters:
+	struct comedi_device *dev	Pointer to current device structure
+	struct comedi_subdevice *s	Pointer to current subdevice structure
+	struct comedi_insn *insn	Pointer to current comedi instruction
+	unsigned int *data		Pointer to counter data
 
-	Returns:int			Nmuber of instructions executed
+Returns:int			Nmuber of instructions executed
 
 ==============================================================================
 */
@@ -596,18 +602,18 @@ static int icp_multi_insn_read_ctr(struct comedi_device *dev,
 /*
 ==============================================================================
 
-	Name:	icp_multi_insn_write_ctr
+Name:	icp_multi_insn_write_ctr
 
-	Description:
-		This function write to the specified counter.
+Description:
+	This function write to the specified counter.
 
-	Parameters:
-		struct comedi_device *dev	Pointer to current device structure
-		struct comedi_subdevice *s	Pointer to current subdevice structure
-		struct comedi_insn *insn	Pointer to current comedi instruction
-		unsigned int *data		Pointer to counter data
+Parameters:
+	struct comedi_device *dev	Pointer to current device structure
+	struct comedi_subdevice *s	Pointer to current subdevice structure
+	struct comedi_insn *insn	Pointer to current comedi instruction
+	unsigned int *data		Pointer to counter data
 
-	Returns:int			Nmuber of instructions executed
+Returns:int			Nmuber of instructions executed
 
 ==============================================================================
 */
@@ -622,15 +628,15 @@ static int icp_multi_insn_write_ctr(struct comedi_device *dev,
 /*
 ==============================================================================
 
-	Name:	interrupt_service_icp_multi
+Name:	interrupt_service_icp_multi
 
-	Description:
-		This function is the interrupt service routine for all
-		interrupts generated by the icp multi board.
+Description:
+	This function is the interrupt service routine for all
+	interrupts generated by the icp multi board.
 
-	Parameters:
-		int irq
-		void *d			Pointer to current device
+Parameters:
+	int irq
+	void *d			Pointer to current device
 
 ==============================================================================
 */
@@ -640,7 +646,8 @@ static irqreturn_t interrupt_service_icp_multi(int irq, void *d)
 	int int_no;
 
 #ifdef ICP_MULTI_EXTDEBUG
-	printk("icp multi EDBG: BGN: interrupt_service_icp_multi(%d,...)\n",
+	printk(KERN_DEBUG
+	       "icp multi EDBG: BGN: interrupt_service_icp_multi(%d,...)\n",
 	       irq);
 #endif
 
@@ -651,7 +658,8 @@ static irqreturn_t interrupt_service_icp_multi(int irq, void *d)
 		return IRQ_NONE;
 
 #ifdef ICP_MULTI_EXTDEBUG
-	printk("icp multi EDBG: interrupt_service_icp_multi() ST: %4x\n",
+	printk(KERN_DEBUG
+	       "icp multi EDBG: interrupt_service_icp_multi() ST: %4x\n",
 	       readw(devpriv->io_addr + ICP_MULTI_INT_STAT));
 #endif
 
@@ -679,7 +687,8 @@ static irqreturn_t interrupt_service_icp_multi(int irq, void *d)
 	}
 
 #ifdef ICP_MULTI_EXTDEBUG
-	printk("icp multi EDBG: END: interrupt_service_icp_multi(...)\n");
+	printk(KERN_DEBUG
+	       "icp multi EDBG: END: interrupt_service_icp_multi(...)\n");
 #endif
 	return IRQ_HANDLED;
 }
@@ -688,20 +697,20 @@ static irqreturn_t interrupt_service_icp_multi(int irq, void *d)
 /*
 ==============================================================================
 
-	Name:	check_channel_list
+Name:	check_channel_list
 
-	Description:
-		This function checks if the channel list, provided by user
-		is built correctly
+Description:
+	This function checks if the channel list, provided by user
+	is built correctly
 
-	Parameters:
-		struct comedi_device *dev	Pointer to current sevice structure
-		struct comedi_subdevice *s	Pointer to current subdevice structure
-		unsigned int *chanlist	Pointer to packed channel list
-		unsigned int n_chan	Number of channels to scan
+Parameters:
+	struct comedi_device *dev	Pointer to current sevice structure
+	struct comedi_subdevice *s	Pointer to current subdevice structure
+	unsigned int *chanlist	Pointer to packed channel list
+	unsigned int n_chan	Number of channels to scan
 
-	Returns:int 0 = failure
-		    1 = success
+Returns:int 0 = failure
+	    1 = success
 
 ==============================================================================
 */
@@ -712,7 +721,8 @@ static int check_channel_list(struct comedi_device *dev,
 	unsigned int i;
 
 #ifdef ICP_MULTI_EXTDEBUG
-	printk("icp multi EDBG:  check_channel_list(...,%d)\n", n_chan);
+	printk(KERN_DEBUG
+	       "icp multi EDBG:  check_channel_list(...,%d)\n", n_chan);
 #endif
 	/*  Check that we at least have one channel to check */
 	if (n_chan < 1) {
@@ -725,7 +735,7 @@ static int check_channel_list(struct comedi_device *dev,
 		if (CR_AREF(chanlist[i]) == AREF_DIFF) {
 			if (CR_CHAN(chanlist[i]) > this_board->n_aichand) {
 				comedi_error(dev,
-					     "Incorrect differential ai channel number");
+					     "Incorrect differential ai ch-nr");
 				return 0;
 			}
 		} else {
@@ -743,20 +753,20 @@ static int check_channel_list(struct comedi_device *dev,
 /*
 ==============================================================================
 
-	Name:	setup_channel_list
+Name:	setup_channel_list
 
-	Description:
-		This function sets the appropriate channel selection,
-		differential input mode and range bits in the ADC Command/
-		Status register.
+Description:
+	This function sets the appropriate channel selection,
+	differential input mode and range bits in the ADC Command/
+	Status register.
 
-	Parameters:
-		struct comedi_device *dev	Pointer to current sevice structure
-		struct comedi_subdevice *s	Pointer to current subdevice structure
-		unsigned int *chanlist	Pointer to packed channel list
-		unsigned int n_chan	Number of channels to scan
+Parameters:
+	struct comedi_device *dev	Pointer to current sevice structure
+	struct comedi_subdevice *s	Pointer to current subdevice structure
+	unsigned int *chanlist	Pointer to packed channel list
+	unsigned int n_chan	Number of channels to scan
 
-	Returns:Void
+Returns:Void
 
 ==============================================================================
 */
@@ -768,7 +778,8 @@ static void setup_channel_list(struct comedi_device *dev,
 	unsigned int diff;
 
 #ifdef ICP_MULTI_EXTDEBUG
-	printk("icp multi EDBG:  setup_channel_list(...,%d)\n", n_chan);
+	printk(KERN_DEBUG
+	       "icp multi EDBG:  setup_channel_list(...,%d)\n", n_chan);
 #endif
 	devpriv->act_chanlist_len = n_chan;
 	devpriv->act_chanlist_pos = 0;
@@ -786,7 +797,8 @@ static void setup_channel_list(struct comedi_device *dev,
 			chanprog &= 0x000f;
 		}
 
-		/*  Clear channel, range and input mode bits in A/D command/status register */
+		/*  Clear channel, range and input mode bits
+		 *  in A/D command/status register */
 		devpriv->AdcCmdStatus &= 0xf00f;
 
 		/*  Set channel number and differential mode status bit */
@@ -808,7 +820,8 @@ static void setup_channel_list(struct comedi_device *dev,
 		       devpriv->io_addr + ICP_MULTI_ADC_CSR);
 
 #ifdef ICP_MULTI_EXTDEBUG
-		printk("GS: %2d. [%4x]=%4x %4x\n", i, chanprog, range,
+		printk(KERN_DEBUG
+		       "GS: %2d. [%4x]=%4x %4x\n", i, chanprog, range,
 		       devpriv->act_chanlist[i]);
 #endif
 	}
@@ -818,15 +831,15 @@ static void setup_channel_list(struct comedi_device *dev,
 /*
 ==============================================================================
 
-	Name:	icp_multi_reset
+Name:	icp_multi_reset
 
-	Description:
-		This function resets the icp multi device to a 'safe' state
+Description:
+	This function resets the icp multi device to a 'safe' state
 
-	Parameters:
-		struct comedi_device *dev	Pointer to current sevice structure
+Parameters:
+	struct comedi_device *dev	Pointer to current sevice structure
 
-	Returns:int	0 = success
+Returns:int	0 = success
 
 ==============================================================================
 */
@@ -835,7 +848,8 @@ static int icp_multi_reset(struct comedi_device *dev)
 	unsigned int i;
 
 #ifdef ICP_MULTI_EXTDEBUG
-	printk("icp_multi EDBG: BGN: icp_multi_reset(...)\n");
+	printk(KERN_DEBUG
+	       "icp_multi EDBG: BGN: icp_multi_reset(...)\n");
 #endif
 	/*  Clear INT enables and requests */
 	writew(0, devpriv->io_addr + ICP_MULTI_INT_EN);
@@ -866,7 +880,8 @@ static int icp_multi_reset(struct comedi_device *dev)
 	writew(0, devpriv->io_addr + ICP_MULTI_DO);
 
 #ifdef ICP_MULTI_EXTDEBUG
-	printk("icp multi EDBG: END: icp_multi_reset(...)\n");
+	printk(KERN_DEBUG
+	       "icp multi EDBG: END: icp_multi_reset(...)\n");
 #endif
 	return 0;
 }
@@ -874,17 +889,17 @@ static int icp_multi_reset(struct comedi_device *dev)
 /*
 ==============================================================================
 
-	Name:	icp_multi_attach
+Name:	icp_multi_attach
 
-	Description:
-		This function sets up all the appropriate data for the current
-		device.
+Description:
+	This function sets up all the appropriate data for the current
+	device.
 
-	Parameters:
-		struct comedi_device *dev	Pointer to current device structure
-		struct comedi_devconfig *it	Pointer to current device configuration
+Parameters:
+	struct comedi_device *dev	Pointer to current device structure
+	struct comedi_devconfig *it	Pointer to current device configuration
 
-	Returns:int	0 = success
+Returns:int	0 = success
 
 ==============================================================================
 */
@@ -898,7 +913,8 @@ static int icp_multi_attach(struct comedi_device *dev,
 	resource_size_t io_addr[5], iobase;
 	unsigned char pci_bus, pci_slot, pci_func;
 
-	printk("icp_multi EDBG: BGN: icp_multi_attach(...)\n");
+	printk(KERN_WARNING
+	       "icp_multi EDBG: BGN: icp_multi_attach(...)\n");
 
 	/*  Alocate private data storage space */
 	ret = alloc_private(dev, sizeof(struct icp_multi_private));
@@ -916,7 +932,8 @@ static int icp_multi_attach(struct comedi_device *dev,
 		    );
 	}
 
-	printk("Anne's comedi%d: icp_multi: board=%s", dev->minor,
+	printk(KERN_WARNING
+	       "Anne's comedi%d: icp_multi: board=%s", dev->minor,
 	       this_board->name);
 
 	card = select_and_alloc_pci_card(PCI_VENDOR_ID_ICP,
@@ -930,24 +947,26 @@ static int icp_multi_attach(struct comedi_device *dev,
 
 	if ((pci_card_data(card, &pci_bus, &pci_slot, &pci_func, &io_addr[0],
 			   &irq)) < 0) {
-		printk(" - Can't get configuration data!\n");
+		printk(KERN_WARNING " - Can't get configuration data!\n");
 		return -EIO;
 	}
 
 	iobase = io_addr[2];
 	devpriv->phys_iobase = iobase;
 
-	printk(", b:s:f=%d:%d:%d, io=0x%8llx \n", pci_bus, pci_slot, pci_func,
+	printk(KERN_WARNING
+	       ", b:s:f=%d:%d:%d, io=0x%8llx \n", pci_bus, pci_slot, pci_func,
 	       (unsigned long long)iobase);
 
 	devpriv->io_addr = ioremap(iobase, ICP_MULTI_SIZE);
 
 	if (devpriv->io_addr == NULL) {
-		printk("ioremap failed.\n");
+		printk(KERN_WARNING "ioremap failed.\n");
 		return -ENOMEM;
 	}
 #ifdef ICP_MULTI_EXTDEBUG
-	printk("0x%08llx mapped to %p, ", (unsigned long long)iobase,
+	printk(KERN_DEBUG
+	       "0x%08llx mapped to %p, ", (unsigned long long)iobase,
 	       devpriv->io_addr);
 #endif
 
@@ -975,20 +994,20 @@ static int icp_multi_attach(struct comedi_device *dev,
 		if (irq) {
 			if (request_irq(irq, interrupt_service_icp_multi,
 					IRQF_SHARED, "Inova Icp Multi", dev)) {
-				printk
-				    (", unable to allocate IRQ %u, DISABLING IT",
+				printk(KERN_WARNING
+				    "unable to allocate IRQ %u, DISABLING IT",
 				     irq);
 				irq = 0;	/* Can't use IRQ */
 			} else
-				printk(", irq=%u", irq);
+				printk(KERN_WARNING ", irq=%u", irq);
 		} else
-			printk(", IRQ disabled");
+			printk(KERN_WARNING ", IRQ disabled");
 	} else
 		irq = 0;
 
 	dev->irq = irq;
 
-	printk(".\n");
+	printk(KERN_WARNING ".\n");
 
 	subdev = 0;
 
@@ -1063,7 +1082,7 @@ static int icp_multi_attach(struct comedi_device *dev,
 	devpriv->valid = 1;
 
 #ifdef ICP_MULTI_EXTDEBUG
-	printk("icp multi EDBG: END: icp_multi_attach(...)\n");
+	printk(KERN_DEBUG "icp multi EDBG: END: icp_multi_attach(...)\n");
 #endif
 
 	return 0;
@@ -1072,16 +1091,16 @@ static int icp_multi_attach(struct comedi_device *dev,
 /*
 ==============================================================================
 
-	Name:	icp_multi_detach
+Name:	icp_multi_detach
 
-	Description:
-		This function releases all the resources used by the current
-		device.
+Description:
+	This function releases all the resources used by the current
+	device.
 
-	Parameters:
-		struct comedi_device *dev	Pointer to current device structure
+Parameters:
+	struct comedi_device *dev	Pointer to current device structure
 
-	Returns:int	0 = success
+Returns:int	0 = success
 
 ==============================================================================
 */
diff --git a/drivers/staging/comedi/drivers/ii_pci20kc.c b/drivers/staging/comedi/drivers/ii_pci20kc.c
index 24df2453e683..e26c1b88ebeb 100644
--- a/drivers/staging/comedi/drivers/ii_pci20kc.c
+++ b/drivers/staging/comedi/drivers/ii_pci20kc.c
@@ -23,7 +23,8 @@
  *	no extern trigger implemented
  *
  *	NOT WORKING (but soon) only 4 on-board differential channels supported
- *	NOT WORKING (but soon) only ONE di-port and ONE do-port supported instead of 4 digital ports
+ *	NOT WORKING (but soon) only ONE di-port and ONE do-port supported
+ *			       instead of 4 digital ports
  *	di-port == Port 0
  *	do-port == Port 1
  *
@@ -63,17 +64,17 @@ Options:
 
 options for PCI-20006M:
   first:   Analog output channel 0 range configuration
-             0  bipolar 10  (-10V -- +10V)
-             1  unipolar 10  (0V -- +10V)
-             2  bipolar 5  (-5V -- 5V)
+	     0  bipolar 10  (-10V -- +10V)
+	     1  unipolar 10  (0V -- +10V)
+	     2  bipolar 5  (-5V -- 5V)
   second:  Analog output channel 1 range configuration
 
 options for PCI-20341M:
   first:   Analog input gain configuration
-             0  1
-             1  10
-             2  100
-             3  200
+	     0  1
+	     1  10
+	     2  100
+	     3  200
 */
 
 /* XXX needs to use ioremap() for compatibility with 2.4 kernels.  Should also
@@ -95,12 +96,12 @@ options for PCI-20341M:
 #define PCI20000_DIO_3			0xc1
 #define PCI20000_DIO_CONTROL_01		0x83	/* port 0, 1 control */
 #define PCI20000_DIO_CONTROL_23		0xc3	/* port 2, 3 control */
-#define PCI20000_DIO_BUFFER		0x82	/* buffer direction and enable */
+#define PCI20000_DIO_BUFFER		0x82	/* buffer direction & enable */
 #define PCI20000_DIO_EOC		0xef	/* even port, control output */
 #define PCI20000_DIO_OOC		0xfd	/* odd port, control output */
 #define PCI20000_DIO_EIC		0x90	/* even port, control input */
 #define PCI20000_DIO_OIC		0x82	/* odd port, control input */
-#define DIO_CAND			0x12	/* and bit 1, bit 4 of control */
+#define DIO_CAND			0x12	/* and bit 1 & 4 of control */
 #define DIO_BE				0x01	/* buffer: port enable */
 #define DIO_BO				0x04	/* buffer: output */
 #define DIO_BI				0x05	/* buffer: input */
@@ -137,7 +138,8 @@ union pci20xxx_subdev_private {
 	void *iobase;
 	struct {
 		void *iobase;
-		const struct comedi_lrange *ao_range_list[2];	/* range of channels of ao module */
+		const struct comedi_lrange *ao_range_list[2];
+					/* range of channels of ao module */
 		unsigned int last_data[2];
 	} pci20006;
 	struct {
@@ -224,14 +226,13 @@ static int pci20xxx_attach(struct comedi_device *dev,
 
 	/* Check PCI-20001 C-2A Carrier Board ID */
 	if ((readb(devpriv->ioaddr) & PCI20000_ID) != PCI20000_ID) {
-		printk("comedi%d: ii_pci20kc", dev->minor);
-		printk
-		    (" PCI-20001 C-2A Carrier Board at base=0x%p not found !\n",
-		     devpriv->ioaddr);
+		printk(KERN_WARNING "comedi%d: ii_pci20kc PCI-20001"
+		       " C-2A Carrier Board at base=0x%p not found !\n",
+		       dev->minor, devpriv->ioaddr);
 		return -EINVAL;
 	}
-	printk("comedi%d:\n", dev->minor);
-	printk("ii_pci20kc: PCI-20001 C-2A at base=0x%p\n", devpriv->ioaddr);
+	printk(KERN_INFO "comedi%d: ii_pci20kc: PCI-20001 C-2A at base=0x%p\n",
+	       dev->minor, devpriv->ioaddr);
 
 	for (i = 0; i < PCI20000_MODULES; i++) {
 		s = dev->subdevices + i;
@@ -244,21 +245,23 @@ static int pci20xxx_attach(struct comedi_device *dev,
 			    devpriv->ioaddr + (i + 1) * PCI20000_OFFSET;
 			pci20006_init(dev, s, it->options[2 * i + 2],
 				      it->options[2 * i + 3]);
-			printk("comedi%d: ii_pci20kc", dev->minor);
-			printk(" PCI-20006 module in slot %d \n", i + 1);
+			printk(KERN_INFO "comedi%d: "
+			       "ii_pci20kc PCI-20006 module in slot %d \n",
+			       dev->minor, i + 1);
 			break;
 		case PCI20341_ID:
 			sdp->pci20341.iobase =
 			    devpriv->ioaddr + (i + 1) * PCI20000_OFFSET;
 			pci20341_init(dev, s, it->options[2 * i + 2],
 				      it->options[2 * i + 3]);
-			printk("comedi%d: ii_pci20kc", dev->minor);
-			printk(" PCI-20341 module in slot %d \n", i + 1);
+			printk(KERN_INFO "comedi%d: "
+			       "ii_pci20kc PCI-20341 module in slot %d \n",
+			       dev->minor, i + 1);
 			break;
 		default:
-			printk
-			    ("ii_pci20kc: unknown module code 0x%02x in slot %d: module disabled\n",
-			     id, i);
+			printk(KERN_WARNING "ii_pci20kc: unknown module "
+			       "code 0x%02x in slot %d: module disabled\n",
+			       id, i); /* XXX this looks like a bug! i + 1 ?? */
 			/* fall through */
 		case PCI20xxx_EMPTY_ID:
 			s->type = COMEDI_SUBD_UNUSED;
@@ -274,7 +277,7 @@ static int pci20xxx_attach(struct comedi_device *dev,
 
 static int pci20xxx_detach(struct comedi_device *dev)
 {
-	printk("comedi%d: pci20xxx: remove\n", dev->minor);
+	printk(KERN_INFO "comedi%d: pci20xxx: remove\n", dev->minor);
 
 	return 0;
 }
@@ -339,7 +342,8 @@ static int pci20006_insn_write(struct comedi_device *dev,
 	unsigned int boarddata;
 
 	sdp->pci20006.last_data[CR_CHAN(insn->chanspec)] = data[0];
-	boarddata = (((unsigned int)data[0] + 0x8000) & 0xffff);	/* comedi-data -> board-data */
+	boarddata = (((unsigned int)data[0] + 0x8000) & 0xffff);
+						/* comedi-data -> board-data */
 	lo = (boarddata & 0xff);
 	hi = ((boarddata >> 8) & 0xff);
 
@@ -355,7 +359,8 @@ static int pci20006_insn_write(struct comedi_device *dev,
 		writeb(0x00, sdp->iobase + PCI20006_STROBE1);
 		break;
 	default:
-		printk(" comedi%d: pci20xxx: ao channel Error!\n", dev->minor);
+		printk(KERN_WARNING
+		       " comedi%d: pci20xxx: ao channel Error!\n", dev->minor);
 		return -EINVAL;
 	}
 
@@ -373,8 +378,7 @@ static const int pci20341_settling_time[] = { 0x58, 0x58, 0x93, 0x99 };
 
 static const struct comedi_lrange range_bipolar0_5 = { 1, {BIP_RANGE(0.5)} };
 static const struct comedi_lrange range_bipolar0_05 = { 1, {BIP_RANGE(0.05)} };
-static const struct comedi_lrange range_bipolar0_025 =
-    { 1, {BIP_RANGE(0.025)} };
+static const struct comedi_lrange range_bipolar0_025 = { 1, {BIP_RANGE(0.025)} };
 
 static const struct comedi_lrange *const pci20341_ranges[] = {
 	&range_bipolar5,
@@ -447,9 +451,10 @@ static int pci20341_insn_read(struct comedi_device *dev,
 			eoc = readb(sdp->iobase + PCI20341_STATUS_REG);
 		}
 		if (j >= 100) {
-			printk
-			    ("comedi%d:  pci20xxx: AI interrupt channel %i polling exit !\n",
-			     dev->minor, i);
+			printk(KERN_WARNING
+			       "comedi%d:  pci20xxx: "
+			       "AI interrupt channel %i polling exit !\n",
+			       dev->minor, i);
 			return -EINVAL;
 		}
 		lo = readb(sdp->iobase + PCI20341_LDATA);
@@ -502,20 +507,18 @@ static int pci20xxx_dio_insn_config(struct comedi_device *dev,
 	int mask, bits;
 
 	mask = 1 << CR_CHAN(insn->chanspec);
-	if (mask & 0x000000ff) {
+	if (mask & 0x000000ff)
 		bits = 0x000000ff;
-	} else if (mask & 0x0000ff00) {
+	else if (mask & 0x0000ff00)
 		bits = 0x0000ff00;
-	} else if (mask & 0x00ff0000) {
+	else if (mask & 0x00ff0000)
 		bits = 0x00ff0000;
-	} else {
+	else
 		bits = 0xff000000;
-	}
-	if (data[0]) {
+	if (data[0])
 		s->io_bits |= bits;
-	} else {
+	else
 		s->io_bits &= ~bits;
-	}
 	pci20xxx_dio_config(dev, s);
 
 	return 1;
diff --git a/drivers/staging/comedi/drivers/jr3_pci.c b/drivers/staging/comedi/drivers/jr3_pci.c
index 0d2c2eb23b23..bd397840dcba 100644
--- a/drivers/staging/comedi/drivers/jr3_pci.c
+++ b/drivers/staging/comedi/drivers/jr3_pci.c
@@ -849,8 +849,11 @@ static int jr3_pci_attach(struct comedi_device *dev,
 	}
 
 	devpriv->pci_enabled = 1;
-	devpriv->iobase =
-	    ioremap(pci_resource_start(card, 0), sizeof(struct jr3_t));
+	devpriv->iobase = ioremap(pci_resource_start(card, 0),
+			offsetof(struct jr3_t, channel[devpriv->n_channels]));
+	if (!devpriv->iobase)
+		return -ENOMEM;
+
 	result = alloc_subdevices(dev, devpriv->n_channels);
 	if (result < 0)
 		goto out;
diff --git a/drivers/staging/comedi/drivers/ke_counter.c b/drivers/staging/comedi/drivers/ke_counter.c
index c145e829108f..73b0445e310f 100644
--- a/drivers/staging/comedi/drivers/ke_counter.c
+++ b/drivers/staging/comedi/drivers/ke_counter.c
@@ -192,12 +192,14 @@ static int cnt_attach(struct comedi_device *dev, struct comedi_devconfig *it)
 			}
 		}
 	}
-	printk("comedi%d: no supported board found! (req. bus/slot: %d/%d)\n",
+	printk(KERN_WARNING
+	       "comedi%d: no supported board found! (req. bus/slot: %d/%d)\n",
 	       dev->minor, it->options[0], it->options[1]);
 	return -EIO;
 
 found:
-	printk("comedi%d: found %s at PCI bus %d, slot %d\n", dev->minor,
+	printk(KERN_INFO
+	       "comedi%d: found %s at PCI bus %d, slot %d\n", dev->minor,
 	       board->name, pci_device->bus->number,
 	       PCI_SLOT(pci_device->devfn));
 	devpriv->pcidev = pci_device;
@@ -206,9 +208,9 @@ found:
 	/* enable PCI device and request regions */
 	error = comedi_pci_enable(pci_device, CNT_DRIVER_NAME);
 	if (error < 0) {
-		printk
-		    ("comedi%d: failed to enable PCI device and request regions!\n",
-		     dev->minor);
+		printk(KERN_WARNING "comedi%d: "
+		       "failed to enable PCI device and request regions!\n",
+		       dev->minor);
 		return error;
 	}
 
@@ -239,7 +241,8 @@ found:
 	outb(0, dev->iobase + 0x20);
 	outb(0, dev->iobase + 0x40);
 
-	printk("comedi%d: " CNT_DRIVER_NAME " attached.\n", dev->minor);
+	printk(KERN_INFO "comedi%d: " CNT_DRIVER_NAME " attached.\n",
+	       dev->minor);
 	return 0;
 }
 
@@ -248,11 +251,11 @@ found:
 static int cnt_detach(struct comedi_device *dev)
 {
 	if (devpriv && devpriv->pcidev) {
-		if (dev->iobase) {
+		if (dev->iobase)
 			comedi_pci_disable(devpriv->pcidev);
-		}
 		pci_dev_put(devpriv->pcidev);
 	}
-	printk("comedi%d: " CNT_DRIVER_NAME " remove\n", dev->minor);
+	printk(KERN_INFO "comedi%d: " CNT_DRIVER_NAME " remove\n",
+	       dev->minor);
 	return 0;
 }
diff --git a/drivers/staging/comedi/drivers/me4000.c b/drivers/staging/comedi/drivers/me4000.c
index 6079913d14b0..8b9fa0f9f1f6 100644
--- a/drivers/staging/comedi/drivers/me4000.c
+++ b/drivers/staging/comedi/drivers/me4000.c
@@ -840,7 +840,7 @@ static int xilinx_download(struct comedi_device *dev)
 		       "comedi%d: me4000: xilinx_download(): DONE flag is not set\n",
 		       dev->minor);
 		printk(KERN_ERR
-		       "comedi%d: me4000: xilinx_download(): Download not succesful\n",
+		       "comedi%d: me4000: xilinx_download(): Download not successful\n",
 		       dev->minor);
 		return -EIO;
 	}
diff --git a/drivers/staging/comedi/drivers/mite.c b/drivers/staging/comedi/drivers/mite.c
index e652f3b270b1..188f58042746 100644
--- a/drivers/staging/comedi/drivers/mite.c
+++ b/drivers/staging/comedi/drivers/mite.c
@@ -64,6 +64,7 @@
 MODULE_LICENSE("GPL");
 
 struct mite_struct *mite_devices;
+EXPORT_SYMBOL(mite_devices);
 
 #define TOP_OF_PAGE(x) ((x)|(~(PAGE_MASK)))
 
@@ -80,7 +81,7 @@ void mite_init(void)
 
 			mite = kzalloc(sizeof(*mite), GFP_KERNEL);
 			if (!mite) {
-				printk("mite: allocation failed\n");
+				printk(KERN_ERR "mite: allocation failed\n");
 				pci_dev_put(pcidev);
 				return;
 			}
@@ -99,14 +100,14 @@ void mite_init(void)
 
 static void dump_chip_signature(u32 csigr_bits)
 {
-	printk
-	    ("mite: version = %i, type = %i, mite mode = %i, interface mode = %i\n",
-	     mite_csigr_version(csigr_bits), mite_csigr_type(csigr_bits),
-	     mite_csigr_mmode(csigr_bits), mite_csigr_imode(csigr_bits));
-	printk
-	    ("mite: num channels = %i, write post fifo depth = %i, wins = %i, iowins = %i\n",
-	     mite_csigr_dmac(csigr_bits), mite_csigr_wpdep(csigr_bits),
-	     mite_csigr_wins(csigr_bits), mite_csigr_iowins(csigr_bits));
+	printk(KERN_INFO "mite: version = %i, type = %i, mite mode = %i,"
+	       "interface mode = %i\n",
+	       mite_csigr_version(csigr_bits), mite_csigr_type(csigr_bits),
+	       mite_csigr_mmode(csigr_bits), mite_csigr_imode(csigr_bits));
+	printk(KERN_INFO "mite: num channels = %i, write post fifo depth = %i,"
+	       "wins = %i, iowins = %i\n",
+	       mite_csigr_dmac(csigr_bits), mite_csigr_wpdep(csigr_bits),
+	       mite_csigr_wins(csigr_bits), mite_csigr_iowins(csigr_bits));
 }
 
 unsigned mite_fifo_size(struct mite_struct *mite, unsigned channel)
@@ -126,7 +127,7 @@ int mite_setup2(struct mite_struct *mite, unsigned use_iodwbsr_1)
 	unsigned unknown_dma_burst_bits;
 
 	if (comedi_pci_enable(mite->pcidev, "mite")) {
-		printk("error enabling mite and requesting io regions\n");
+		printk(KERN_ERR "error enabling mite and requesting io regions\n");
 		return -EIO;
 	}
 	pci_set_master(mite->pcidev);
@@ -135,27 +136,30 @@ int mite_setup2(struct mite_struct *mite, unsigned use_iodwbsr_1)
 	mite->mite_phys_addr = addr;
 	mite->mite_io_addr = ioremap(addr, PCI_MITE_SIZE);
 	if (!mite->mite_io_addr) {
-		printk("failed to remap mite io memory address\n");
+		printk(KERN_ERR "Failed to remap mite io memory address\n");
 		return -ENOMEM;
 	}
-	printk("MITE:0x%08llx mapped to %p ",
+	printk(KERN_INFO "MITE:0x%08llx mapped to %p ",
 	       (unsigned long long)mite->mite_phys_addr, mite->mite_io_addr);
 
 	addr = pci_resource_start(mite->pcidev, 1);
 	mite->daq_phys_addr = addr;
 	length = pci_resource_len(mite->pcidev, 1);
-	/*  In case of a 660x board, DAQ size is 8k instead of 4k (see as shown by lspci output) */
+	/*
+	 * In case of a 660x board, DAQ size is 8k instead of 4k
+	 * (see as shown by lspci output)
+	 */
 	mite->daq_io_addr = ioremap(mite->daq_phys_addr, length);
 	if (!mite->daq_io_addr) {
-		printk("failed to remap daq io memory address\n");
+		printk(KERN_ERR "Failed to remap daq io memory address\n");
 		return -ENOMEM;
 	}
-	printk("DAQ:0x%08llx mapped to %p\n",
+	printk(KERN_INFO "DAQ:0x%08llx mapped to %p\n",
 	       (unsigned long long)mite->daq_phys_addr, mite->daq_io_addr);
 
 	if (use_iodwbsr_1) {
 		writel(0, mite->mite_io_addr + MITE_IODWBSR);
-		printk("mite: using I/O Window Base Size register 1\n");
+		printk(KERN_INFO "mite: using I/O Window Base Size register 1\n");
 		writel(mite->daq_phys_addr | WENAB |
 		       MITE_IODWBSR_1_WSIZE_bits(length),
 		       mite->mite_io_addr + MITE_IODWBSR_1);
@@ -164,11 +168,12 @@ int mite_setup2(struct mite_struct *mite, unsigned use_iodwbsr_1)
 		writel(mite->daq_phys_addr | WENAB,
 		       mite->mite_io_addr + MITE_IODWBSR);
 	}
-	/* make sure dma bursts work.  I got this from running a bus analyzer
-	   on a pxi-6281 and a pxi-6713.  6713 powered up with register value
-	   of 0x61f and bursts worked.  6281 powered up with register value of
-	   0x1f and bursts didn't work.  The NI windows driver reads the register,
-	   then does a bitwise-or of 0x600 with it and writes it back.
+	/*
+	 * make sure dma bursts work. I got this from running a bus analyzer
+	 * on a pxi-6281 and a pxi-6713. 6713 powered up with register value
+	 * of 0x61f and bursts worked. 6281 powered up with register value of
+	 * 0x1f and bursts didn't work. The NI windows driver reads the
+	 * register, then does a bitwise-or of 0x600 with it and writes it back.
 	 */
 	unknown_dma_burst_bits =
 	    readl(mite->mite_io_addr + MITE_UNKNOWN_DMA_BURST_REG);
@@ -179,9 +184,9 @@ int mite_setup2(struct mite_struct *mite, unsigned use_iodwbsr_1)
 	csigr_bits = readl(mite->mite_io_addr + MITE_CSIGR);
 	mite->num_channels = mite_csigr_dmac(csigr_bits);
 	if (mite->num_channels > MAX_MITE_DMA_CHANNELS) {
-		printk
-		    ("mite: bug? chip claims to have %i dma channels.  Setting to %i.\n",
-		     mite->num_channels, MAX_MITE_DMA_CHANNELS);
+		printk(KERN_WARNING "mite: bug? chip claims to have %i dma "
+		       "channels. Setting to %i.\n",
+		       mite->num_channels, MAX_MITE_DMA_CHANNELS);
 		mite->num_channels = MAX_MITE_DMA_CHANNELS;
 	}
 	dump_chip_signature(csigr_bits);
@@ -194,16 +199,18 @@ int mite_setup2(struct mite_struct *mite, unsigned use_iodwbsr_1)
 		       mite->mite_io_addr + MITE_CHCR(i));
 	}
 	mite->fifo_size = mite_fifo_size(mite, 0);
-	printk("mite: fifo size is %i.\n", mite->fifo_size);
+	printk(KERN_INFO "mite: fifo size is %i.\n", mite->fifo_size);
 	mite->used = 1;
 
 	return 0;
 }
+EXPORT_SYMBOL(mite_setup2);
 
 int mite_setup(struct mite_struct *mite)
 {
 	return mite_setup2(mite, 0);
 }
+EXPORT_SYMBOL(mite_setup);
 
 void mite_cleanup(void)
 {
@@ -238,22 +245,23 @@ void mite_unsetup(struct mite_struct *mite)
 
 	mite->used = 0;
 }
+EXPORT_SYMBOL(mite_unsetup);
 
 void mite_list_devices(void)
 {
 	struct mite_struct *mite, *next;
 
-	printk("Available NI device IDs:");
+	printk(KERN_INFO "Available NI device IDs:");
 	if (mite_devices)
 		for (mite = mite_devices; mite; mite = next) {
 			next = mite->next;
-			printk(" 0x%04x", mite_device_id(mite));
+			printk(KERN_INFO " 0x%04x", mite_device_id(mite));
 			if (mite->used)
-				printk("(used)");
+				printk(KERN_INFO "(used)");
 		}
-	printk("\n");
-
+	printk(KERN_INFO "\n");
 }
+EXPORT_SYMBOL(mite_list_devices);
 
 struct mite_channel *mite_request_channel_in_range(struct mite_struct *mite,
 						   struct
@@ -265,7 +273,9 @@ struct mite_channel *mite_request_channel_in_range(struct mite_struct *mite,
 	unsigned long flags;
 	struct mite_channel *channel = NULL;
 
-	/*  spin lock so mite_release_channel can be called safely from interrupts */
+	/* spin lock so mite_release_channel can be called safely
+	 * from interrupts
+	 */
 	spin_lock_irqsave(&mite->lock, flags);
 	for (i = min_channel; i <= max_channel; ++i) {
 		if (mite->channel_allocated[i] == 0) {
@@ -278,6 +288,7 @@ struct mite_channel *mite_request_channel_in_range(struct mite_struct *mite,
 	spin_unlock_irqrestore(&mite->lock, flags);
 	return channel;
 }
+EXPORT_SYMBOL(mite_request_channel_in_range);
 
 void mite_release_channel(struct mite_channel *mite_chan)
 {
@@ -289,8 +300,10 @@ void mite_release_channel(struct mite_channel *mite_chan)
 	if (mite->channel_allocated[mite_chan->channel]) {
 		mite_dma_disarm(mite_chan);
 		mite_dma_reset(mite_chan);
-/* disable all channel's interrupts (do it after disarm/reset so
-MITE_CHCR reg isn't changed while dma is still active!) */
+	/*
+	 * disable all channel's interrupts (do it after disarm/reset so
+	 * MITE_CHCR reg isn't changed while dma is still active!)
+	 */
 		writel(CHCR_CLR_DMA_IE | CHCR_CLR_LINKP_IE |
 		       CHCR_CLR_SAR_IE | CHCR_CLR_DONE_IE |
 		       CHCR_CLR_MRDY_IE | CHCR_CLR_DRDY_IE |
@@ -302,6 +315,7 @@ MITE_CHCR reg isn't changed while dma is still active!) */
 	}
 	spin_unlock_irqrestore(&mite->lock, flags);
 }
+EXPORT_SYMBOL(mite_release_channel);
 
 void mite_dma_arm(struct mite_channel *mite_chan)
 {
@@ -310,8 +324,10 @@ void mite_dma_arm(struct mite_channel *mite_chan)
 	unsigned long flags;
 
 	MDPRINTK("mite_dma_arm ch%i\n", channel);
-	/* memory barrier is intended to insure any twiddling with the buffer
-	   is done before writing to the mite to arm dma transfer */
+	/*
+	 * memory barrier is intended to insure any twiddling with the buffer
+	 * is done before writing to the mite to arm dma transfer
+	 */
 	smp_mb();
 	/* arm */
 	chor = CHOR_START;
@@ -322,6 +338,7 @@ void mite_dma_arm(struct mite_channel *mite_chan)
 	spin_unlock_irqrestore(&mite->lock, flags);
 /*       mite_dma_tcr(mite, channel); */
 }
+EXPORT_SYMBOL(mite_dma_arm);
 
 /**************************************/
 
@@ -354,7 +371,7 @@ int mite_buf_change(struct mite_dma_descriptor_ring *ring,
 			       n_links * sizeof(struct mite_dma_descriptor),
 			       &ring->descriptors_dma_addr, GFP_KERNEL);
 	if (!ring->descriptors) {
-		printk("mite: ring buffer allocation failed\n");
+		printk(KERN_ERR "mite: ring buffer allocation failed\n");
 		return -ENOMEM;
 	}
 	ring->n_links = n_links;
@@ -370,11 +387,14 @@ int mite_buf_change(struct mite_dma_descriptor_ring *ring,
 	}
 	ring->descriptors[n_links - 1].next =
 	    cpu_to_le32(ring->descriptors_dma_addr);
-	/* barrier is meant to insure that all the writes to the dma descriptors
-	   have completed before the dma controller is commanded to read them */
+	/*
+	 * barrier is meant to insure that all the writes to the dma descriptors
+	 * have completed before the dma controller is commanded to read them
+	 */
 	smp_wmb();
 	return 0;
 }
+EXPORT_SYMBOL(mite_buf_change);
 
 void mite_prep_dma(struct mite_channel *mite_chan,
 		   unsigned int num_device_bits, unsigned int num_memory_bits)
@@ -395,16 +415,19 @@ void mite_prep_dma(struct mite_channel *mite_chan,
 	 * Link Complete Interrupt: interrupt every time a link
 	 * in MITE_RING is completed. This can generate a lot of
 	 * extra interrupts, but right now we update the values
-	 * of buf_int_ptr and buf_int_count at each interrupt.  A
+	 * of buf_int_ptr and buf_int_count at each interrupt. A
 	 * better method is to poll the MITE before each user
 	 * "read()" to calculate the number of bytes available.
 	 */
 	chcr |= CHCR_SET_LC_IE;
 	if (num_memory_bits == 32 && num_device_bits == 16) {
-		/* Doing a combined 32 and 16 bit byteswap gets the 16 bit samples into the fifo in the right order.
-		   Tested doing 32 bit memory to 16 bit device transfers to the analog out of a pxi-6281,
-		   which has mite version = 1, type = 4.  This also works for dma reads from the counters
-		   on e-series boards.  */
+		/*
+		 * Doing a combined 32 and 16 bit byteswap gets the 16 bit
+		 * samples into the fifo in the right order. Tested doing 32 bit
+		 * memory to 16 bit device transfers to the analog out of a
+		 * pxi-6281, which has mite version = 1, type = 4. This also
+		 * works for dma reads from the counters on e-series boards.
+		 */
 		chcr |= CHCR_BYTE_SWAP_DEVICE | CHCR_BYTE_SWAP_MEMORY;
 	}
 	if (mite_chan->dir == COMEDI_INPUT)
@@ -425,7 +448,8 @@ void mite_prep_dma(struct mite_channel *mite_chan,
 		mcr |= CR_PSIZE32;
 		break;
 	default:
-		printk("mite: bug! invalid mem bit width for dma transfer\n");
+		printk(KERN_WARNING "mite: bug! invalid mem bit width for dma "
+		       "transfer\n");
 		break;
 	}
 	writel(mcr, mite->mite_io_addr + MITE_MCR(mite_chan->channel));
@@ -444,7 +468,8 @@ void mite_prep_dma(struct mite_channel *mite_chan,
 		dcr |= CR_PSIZE32;
 		break;
 	default:
-		printk("mite: bug! invalid dev bit width for dma transfer\n");
+		printk(KERN_WARNING "mite: bug! invalid dev bit width for dma "
+		       "transfer\n");
 		break;
 	}
 	writel(dcr, mite->mite_io_addr + MITE_DCR(mite_chan->channel));
@@ -462,6 +487,7 @@ void mite_prep_dma(struct mite_channel *mite_chan,
 
 	MDPRINTK("exit mite_prep_dma\n");
 }
+EXPORT_SYMBOL(mite_prep_dma);
 
 u32 mite_device_bytes_transferred(struct mite_channel *mite_chan)
 {
@@ -469,48 +495,53 @@ u32 mite_device_bytes_transferred(struct mite_channel *mite_chan)
 	return readl(mite->mite_io_addr + MITE_DAR(mite_chan->channel));
 }
 
-u32 mite_bytes_in_transit(struct mite_channel * mite_chan)
+u32 mite_bytes_in_transit(struct mite_channel *mite_chan)
 {
 	struct mite_struct *mite = mite_chan->mite;
 	return readl(mite->mite_io_addr +
 		     MITE_FCR(mite_chan->channel)) & 0x000000FF;
 }
+EXPORT_SYMBOL(mite_bytes_in_transit);
 
-/*  returns lower bound for number of bytes transferred from device to memory */
-u32 mite_bytes_written_to_memory_lb(struct mite_channel * mite_chan)
+/* returns lower bound for number of bytes transferred from device to memory */
+u32 mite_bytes_written_to_memory_lb(struct mite_channel *mite_chan)
 {
 	u32 device_byte_count;
 
 	device_byte_count = mite_device_bytes_transferred(mite_chan);
 	return device_byte_count - mite_bytes_in_transit(mite_chan);
 }
+EXPORT_SYMBOL(mite_bytes_written_to_memory_lb);
 
-/*  returns upper bound for number of bytes transferred from device to memory */
-u32 mite_bytes_written_to_memory_ub(struct mite_channel * mite_chan)
+/* returns upper bound for number of bytes transferred from device to memory */
+u32 mite_bytes_written_to_memory_ub(struct mite_channel *mite_chan)
 {
 	u32 in_transit_count;
 
 	in_transit_count = mite_bytes_in_transit(mite_chan);
 	return mite_device_bytes_transferred(mite_chan) - in_transit_count;
 }
+EXPORT_SYMBOL(mite_bytes_written_to_memory_ub);
 
-/*  returns lower bound for number of bytes read from memory for transfer to device */
-u32 mite_bytes_read_from_memory_lb(struct mite_channel * mite_chan)
+/* returns lower bound for number of bytes read from memory to device */
+u32 mite_bytes_read_from_memory_lb(struct mite_channel *mite_chan)
 {
 	u32 device_byte_count;
 
 	device_byte_count = mite_device_bytes_transferred(mite_chan);
 	return device_byte_count + mite_bytes_in_transit(mite_chan);
 }
+EXPORT_SYMBOL(mite_bytes_read_from_memory_lb);
 
-/*  returns upper bound for number of bytes read from memory for transfer to device */
-u32 mite_bytes_read_from_memory_ub(struct mite_channel * mite_chan)
+/* returns upper bound for number of bytes read from memory to device */
+u32 mite_bytes_read_from_memory_ub(struct mite_channel *mite_chan)
 {
 	u32 in_transit_count;
 
 	in_transit_count = mite_bytes_in_transit(mite_chan);
 	return mite_device_bytes_transferred(mite_chan) + in_transit_count;
 }
+EXPORT_SYMBOL(mite_bytes_read_from_memory_ub);
 
 unsigned mite_dma_tcr(struct mite_channel *mite_chan)
 {
@@ -525,6 +556,7 @@ unsigned mite_dma_tcr(struct mite_channel *mite_chan)
 
 	return tcr;
 }
+EXPORT_SYMBOL(mite_dma_tcr);
 
 void mite_dma_disarm(struct mite_channel *mite_chan)
 {
@@ -535,6 +567,7 @@ void mite_dma_disarm(struct mite_channel *mite_chan)
 	chor = CHOR_ABORT;
 	writel(chor, mite->mite_io_addr + MITE_CHOR(mite_chan->channel));
 }
+EXPORT_SYMBOL(mite_dma_disarm);
 
 int mite_sync_input_dma(struct mite_channel *mite_chan,
 			struct comedi_async *async)
@@ -544,7 +577,7 @@ int mite_sync_input_dma(struct mite_channel *mite_chan,
 	const unsigned bytes_per_scan = cfc_bytes_per_scan(async->subdevice);
 
 	old_alloc_count = async->buf_write_alloc_count;
-	/*  write alloc as much as we can */
+	/* write alloc as much as we can */
 	comedi_buf_write_alloc(async, async->prealloc_bufsz);
 
 	nbytes = mite_bytes_written_to_memory_lb(mite_chan);
@@ -571,6 +604,7 @@ int mite_sync_input_dma(struct mite_channel *mite_chan,
 	async->events |= COMEDI_CB_BLOCK;
 	return 0;
 }
+EXPORT_SYMBOL(mite_sync_input_dma);
 
 int mite_sync_output_dma(struct mite_channel *mite_chan,
 			 struct comedi_async *async)
@@ -593,7 +627,7 @@ int mite_sync_output_dma(struct mite_channel *mite_chan,
 	    (int)(nbytes_ub - stop_count) > 0)
 		nbytes_ub = stop_count;
 	if ((int)(nbytes_ub - old_alloc_count) > 0) {
-		printk("mite: DMA underrun\n");
+		printk(KERN_ERR "mite: DMA underrun\n");
 		async->events |= COMEDI_CB_OVERFLOW;
 		return -1;
 	}
@@ -607,6 +641,7 @@ int mite_sync_output_dma(struct mite_channel *mite_chan,
 	}
 	return 0;
 }
+EXPORT_SYMBOL(mite_sync_output_dma);
 
 unsigned mite_get_status(struct mite_channel *mite_chan)
 {
@@ -625,6 +660,7 @@ unsigned mite_get_status(struct mite_channel *mite_chan)
 	spin_unlock_irqrestore(&mite->lock, flags);
 	return status;
 }
+EXPORT_SYMBOL(mite_get_status);
 
 int mite_done(struct mite_channel *mite_chan)
 {
@@ -638,6 +674,7 @@ int mite_done(struct mite_channel *mite_chan)
 	spin_unlock_irqrestore(&mite->lock, flags);
 	return done;
 }
+EXPORT_SYMBOL(mite_done);
 
 #ifdef DEBUG_MITE
 
@@ -719,46 +756,51 @@ void mite_dump_regs(struct mite_channel *mite_chan)
 	unsigned long addr = 0;
 	unsigned long temp = 0;
 
-	printk("mite_dump_regs ch%i\n", mite_chan->channel);
-	printk("mite address is  =0x%08lx\n", mite_io_addr);
+	printk(KERN_DEBUG "mite_dump_regs ch%i\n", mite_chan->channel);
+	printk(KERN_DEBUG "mite address is  =0x%08lx\n", mite_io_addr);
 
 	addr = mite_io_addr + MITE_CHOR(channel);
-	printk("mite status[CHOR]at 0x%08lx =0x%08lx\n", addr, temp =
-	       readl(addr));
+	printk(KERN_DEBUG "mite status[CHOR]at 0x%08lx =0x%08lx\n", addr,
+	       temp = readl(addr));
 	mite_decode(mite_CHOR_strings, temp);
 	addr = mite_io_addr + MITE_CHCR(channel);
-	printk("mite status[CHCR]at 0x%08lx =0x%08lx\n", addr, temp =
-	       readl(addr));
+	printk(KERN_DEBUG "mite status[CHCR]at 0x%08lx =0x%08lx\n", addr,
+	       temp = readl(addr));
 	mite_decode(mite_CHCR_strings, temp);
 	addr = mite_io_addr + MITE_TCR(channel);
-	printk("mite status[TCR] at 0x%08lx =0x%08x\n", addr, readl(addr));
-	addr = mite_io_addr + MITE_MCR(channel);
-	printk("mite status[MCR] at 0x%08lx =0x%08lx\n", addr, temp =
+	printk(KERN_DEBUG "mite status[TCR] at 0x%08lx =0x%08x\n", addr,
 	       readl(addr));
+	addr = mite_io_addr + MITE_MCR(channel);
+	printk(KERN_DEBUG "mite status[MCR] at 0x%08lx =0x%08lx\n", addr,
+	       temp = readl(addr));
 	mite_decode(mite_MCR_strings, temp);
 
 	addr = mite_io_addr + MITE_MAR(channel);
-	printk("mite status[MAR] at 0x%08lx =0x%08x\n", addr, readl(addr));
-	addr = mite_io_addr + MITE_DCR(channel);
-	printk("mite status[DCR] at 0x%08lx =0x%08lx\n", addr, temp =
+	printk(KERN_DEBUG "mite status[MAR] at 0x%08lx =0x%08x\n", addr,
 	       readl(addr));
+	addr = mite_io_addr + MITE_DCR(channel);
+	printk(KERN_DEBUG "mite status[DCR] at 0x%08lx =0x%08lx\n", addr,
+	       temp = readl(addr));
 	mite_decode(mite_DCR_strings, temp);
 	addr = mite_io_addr + MITE_DAR(channel);
-	printk("mite status[DAR] at 0x%08lx =0x%08x\n", addr, readl(addr));
-	addr = mite_io_addr + MITE_LKCR(channel);
-	printk("mite status[LKCR]at 0x%08lx =0x%08lx\n", addr, temp =
+	printk(KERN_DEBUG "mite status[DAR] at 0x%08lx =0x%08x\n", addr,
 	       readl(addr));
+	addr = mite_io_addr + MITE_LKCR(channel);
+	printk(KERN_DEBUG "mite status[LKCR]at 0x%08lx =0x%08lx\n", addr,
+	       temp = readl(addr));
 	mite_decode(mite_LKCR_strings, temp);
 	addr = mite_io_addr + MITE_LKAR(channel);
-	printk("mite status[LKAR]at 0x%08lx =0x%08x\n", addr, readl(addr));
-
-	addr = mite_io_addr + MITE_CHSR(channel);
-	printk("mite status[CHSR]at 0x%08lx =0x%08lx\n", addr, temp =
+	printk(KERN_DEBUG "mite status[LKAR]at 0x%08lx =0x%08x\n", addr,
 	       readl(addr));
+	addr = mite_io_addr + MITE_CHSR(channel);
+	printk(KERN_DEBUG "mite status[CHSR]at 0x%08lx =0x%08lx\n", addr,
+	       temp = readl(addr));
 	mite_decode(mite_CHSR_strings, temp);
 	addr = mite_io_addr + MITE_FCR(channel);
-	printk("mite status[FCR] at 0x%08lx =0x%08x\n\n", addr, readl(addr));
+	printk(KERN_DEBUG "mite status[FCR] at 0x%08lx =0x%08x\n\n", addr,
+	       readl(addr));
 }
+EXPORT_SYMBOL(mite_dump_regs);
 
 static void mite_decode(char **bit_str, unsigned int bits)
 {
@@ -766,10 +808,11 @@ static void mite_decode(char **bit_str, unsigned int bits)
 
 	for (i = 31; i >= 0; i--) {
 		if (bits & (1 << i))
-			printk(" %s", bit_str[i]);
+			printk(KERN_DEBUG " %s", bit_str[i]);
 	}
-	printk("\n");
+	printk(KERN_DEBUG "\n");
 }
+EXPORT_SYMBOL(mite_decode);
 #endif
 
 #ifdef MODULE
@@ -785,36 +828,4 @@ void __exit cleanup_module(void)
 {
 	mite_cleanup();
 }
-
-EXPORT_SYMBOL(mite_dma_tcr);
-EXPORT_SYMBOL(mite_dma_arm);
-EXPORT_SYMBOL(mite_dma_disarm);
-EXPORT_SYMBOL(mite_sync_input_dma);
-EXPORT_SYMBOL(mite_sync_output_dma);
-EXPORT_SYMBOL(mite_setup);
-EXPORT_SYMBOL(mite_setup2);
-EXPORT_SYMBOL(mite_unsetup);
-#if 0
-EXPORT_SYMBOL(mite_kvmem_segment_load);
-EXPORT_SYMBOL(mite_ll_from_kvmem);
-EXPORT_SYMBOL(mite_setregs);
-#endif
-EXPORT_SYMBOL(mite_devices);
-EXPORT_SYMBOL(mite_list_devices);
-EXPORT_SYMBOL(mite_request_channel_in_range);
-EXPORT_SYMBOL(mite_release_channel);
-EXPORT_SYMBOL(mite_prep_dma);
-EXPORT_SYMBOL(mite_buf_change);
-EXPORT_SYMBOL(mite_bytes_written_to_memory_lb);
-EXPORT_SYMBOL(mite_bytes_written_to_memory_ub);
-EXPORT_SYMBOL(mite_bytes_read_from_memory_lb);
-EXPORT_SYMBOL(mite_bytes_read_from_memory_ub);
-EXPORT_SYMBOL(mite_bytes_in_transit);
-EXPORT_SYMBOL(mite_get_status);
-EXPORT_SYMBOL(mite_done);
-#ifdef DEBUG_MITE
-EXPORT_SYMBOL(mite_decode);
-EXPORT_SYMBOL(mite_dump_regs);
-#endif
-
 #endif
diff --git a/drivers/staging/comedi/drivers/mite.h b/drivers/staging/comedi/drivers/mite.h
index 0518fadc4daa..9d5049f8fa85 100644
--- a/drivers/staging/comedi/drivers/mite.h
+++ b/drivers/staging/comedi/drivers/mite.h
@@ -163,13 +163,6 @@ u32 mite_bytes_in_transit(struct mite_channel *mite_chan);
 unsigned mite_get_status(struct mite_channel *mite_chan);
 int mite_done(struct mite_channel *mite_chan);
 
-#if 0
-unsigned long mite_ll_from_kvmem(struct mite_struct *mite,
-				 struct comedi_async *async, int len);
-void mite_setregs(struct mite_struct *mite, unsigned long ll_start, int chan,
-		  int dir);
-#endif
-
 void mite_prep_dma(struct mite_channel *mite_chan,
 		   unsigned int num_device_bits, unsigned int num_memory_bits);
 int mite_buf_change(struct mite_dma_descriptor_ring *ring,
diff --git a/drivers/staging/comedi/drivers/multiq3.c b/drivers/staging/comedi/drivers/multiq3.c
index 5d6af9c459db..6b22f0f8f06a 100644
--- a/drivers/staging/comedi/drivers/multiq3.c
+++ b/drivers/staging/comedi/drivers/multiq3.c
@@ -144,9 +144,8 @@ static int multiq3_ao_insn_read(struct comedi_device *dev,
 	int i;
 	int chan = CR_CHAN(insn->chanspec);
 
-	for (i = 0; i < insn->n; i++) {
+	for (i = 0; i < insn->n; i++)
 		data[i] = devpriv->ao_readback[chan];
-	}
 
 	return i;
 }
@@ -253,20 +252,20 @@ static int multiq3_attach(struct comedi_device *dev,
 	struct comedi_subdevice *s;
 
 	iobase = it->options[0];
-	printk("comedi%d: multiq3: 0x%04lx ", dev->minor, iobase);
+	printk(KERN_INFO "comedi%d: multiq3: 0x%04lx ", dev->minor, iobase);
 	if (!request_region(iobase, MULTIQ3_SIZE, "multiq3")) {
-		printk("comedi%d: I/O port conflict\n", dev->minor);
+		printk(KERN_ERR "comedi%d: I/O port conflict\n", dev->minor);
 		return -EIO;
 	}
 
 	dev->iobase = iobase;
 
 	irq = it->options[1];
-	if (irq) {
-		printk("comedi%d: irq = %u ignored\n", dev->minor, irq);
-	} else {
-		printk("comedi%d: no irq\n", dev->minor);
-	}
+	if (irq)
+		printk(KERN_WARNING "comedi%d: irq = %u ignored\n",
+			dev->minor, irq);
+	else
+		printk(KERN_WARNING "comedi%d: no irq\n", dev->minor);
 	dev->board_name = "multiq3";
 	result = alloc_subdevices(dev, 5);
 	if (result < 0)
@@ -330,14 +329,12 @@ static int multiq3_attach(struct comedi_device *dev,
 
 static int multiq3_detach(struct comedi_device *dev)
 {
-	printk("comedi%d: multiq3: remove\n", dev->minor);
+	printk(KERN_INFO "comedi%d: multiq3: remove\n", dev->minor);
 
-	if (dev->iobase) {
+	if (dev->iobase)
 		release_region(dev->iobase, MULTIQ3_SIZE);
-	}
-	if (dev->irq) {
+	if (dev->irq)
 		free_irq(dev->irq, dev);
-	}
 
 	return 0;
 }
diff --git a/drivers/staging/comedi/drivers/ni_6527.c b/drivers/staging/comedi/drivers/ni_6527.c
index b37ef37c2d2d..653b4c8700af 100644
--- a/drivers/staging/comedi/drivers/ni_6527.c
+++ b/drivers/staging/comedi/drivers/ni_6527.c
@@ -273,7 +273,8 @@ static int ni6527_intr_cmdtest(struct comedi_device *dev,
 	if (err)
 		return 1;
 
-	/* step 2: make sure trigger sources are unique and mutually compatible */
+	/* step 2: make sure trigger sources are unique and */
+	/*         are mutually compatible */
 
 	if (err)
 		return 2;
@@ -377,7 +378,7 @@ static int ni6527_attach(struct comedi_device *dev, struct comedi_devconfig *it)
 	struct comedi_subdevice *s;
 	int ret;
 
-	printk("comedi%d: ni6527:", dev->minor);
+	printk(KERN_INFO "comedi%d: ni6527\n", dev->minor);
 
 	ret = alloc_private(dev, sizeof(struct ni6527_private));
 	if (ret < 0)
@@ -389,14 +390,13 @@ static int ni6527_attach(struct comedi_device *dev, struct comedi_devconfig *it)
 
 	ret = mite_setup(devpriv->mite);
 	if (ret < 0) {
-		printk("error setting up mite\n");
+		printk(KERN_ERR "comedi: error setting up mite\n");
 		return ret;
 	}
 
 	dev->board_name = this_board->name;
-	printk(" %s", dev->board_name);
-
-	printk(" ID=0x%02x", readb(devpriv->mite->daq_io_addr + ID_Register));
+	printk(KERN_INFO "comedi board: %s, ID=0x%02x\n", dev->board_name,
+		readb(devpriv->mite->daq_io_addr + ID_Register));
 
 	ret = alloc_subdevices(dev, 3);
 	if (ret < 0)
@@ -415,7 +415,7 @@ static int ni6527_attach(struct comedi_device *dev, struct comedi_devconfig *it)
 	s->type = COMEDI_SUBD_DO;
 	s->subdev_flags = SDF_READABLE | SDF_WRITABLE;
 	s->n_chan = 24;
-	s->range_table = &range_unknown;	/* FIXME: actually conductance */
+	s->range_table = &range_unknown;  /* FIXME: actually conductance */
 	s->maxdata = 1;
 	s->insn_bits = ni6527_do_insn_bits;
 
@@ -442,30 +442,25 @@ static int ni6527_attach(struct comedi_device *dev, struct comedi_devconfig *it)
 
 	ret = request_irq(mite_irq(devpriv->mite), ni6527_interrupt,
 			  IRQF_SHARED, "ni6527", dev);
-	if (ret < 0) {
-		printk(" irq not available");
-	} else
+	if (ret < 0)
+		printk(KERN_WARNING "comedi i6527 irq not available\n");
+	else
 		dev->irq = mite_irq(devpriv->mite);
 
-	printk("\n");
-
 	return 0;
 }
 
 static int ni6527_detach(struct comedi_device *dev)
 {
-	if (devpriv && devpriv->mite && devpriv->mite->daq_io_addr) {
+	if (devpriv && devpriv->mite && devpriv->mite->daq_io_addr)
 		writeb(0x00,
 		       devpriv->mite->daq_io_addr + Master_Interrupt_Control);
-	}
 
-	if (dev->irq) {
+	if (dev->irq)
 		free_irq(dev->irq, dev);
-	}
 
-	if (devpriv && devpriv->mite) {
+	if (devpriv && devpriv->mite)
 		mite_unsetup(devpriv->mite);
-	}
 
 	return 0;
 }
@@ -491,7 +486,7 @@ static int ni6527_find_device(struct comedi_device *dev, int bus, int slot)
 			}
 		}
 	}
-	printk("no device found\n");
+	printk(KERN_ERR "comedi 6527: no device found\n");
 	mite_list_devices();
 	return -EIO;
 }
diff --git a/drivers/staging/comedi/drivers/ni_at_ao.c b/drivers/staging/comedi/drivers/ni_at_ao.c
index 8adb23739846..3778565c1f6b 100644
--- a/drivers/staging/comedi/drivers/ni_at_ao.c
+++ b/drivers/staging/comedi/drivers/ni_at_ao.c
@@ -32,7 +32,8 @@ Configuration options:
   [0] - I/O port base address
   [1] - IRQ (unused)
   [2] - DMA (unused)
-  [3] - analog output range, set by jumpers on hardware (0 for -10 to 10V bipolar, 1 for 0V to 10V unipolar)
+  [3] - analog output range, set by jumpers on hardware (0 for -10 to 10V
+	bipolar, 1 for 0V to 10V unipolar)
 
 */
 /*
@@ -431,9 +432,8 @@ static int atao_calib_insn_read(struct comedi_device *dev,
 				struct comedi_insn *insn, unsigned int *data)
 {
 	int i;
-	for (i = 0; i < insn->n; i++) {
+	for (i = 0; i < insn->n; i++)
 		data[i] = 0;	/* XXX */
-	}
 	return insn->n;
 }
 
diff --git a/drivers/staging/comedi/drivers/ni_atmio16d.c b/drivers/staging/comedi/drivers/ni_atmio16d.c
index 901833d9b772..cf4f241f210a 100644
--- a/drivers/staging/comedi/drivers/ni_atmio16d.c
+++ b/drivers/staging/comedi/drivers/ni_atmio16d.c
@@ -200,8 +200,8 @@ struct atmio16d_private {
 	enum { dac_2comp, dac_straight } dac0_coding, dac1_coding;
 	const struct comedi_lrange *ao_range_type_list[2];
 	unsigned int ao_readback[2];
-	unsigned int com_reg_1_state;	/* current state of command register 1 */
-	unsigned int com_reg_2_state;	/* current state of command register 2 */
+	unsigned int com_reg_1_state; /* current state of command register 1 */
+	unsigned int com_reg_2_state; /* current state of command register 2 */
 };
 
 static void reset_counters(struct comedi_device *dev)
@@ -279,7 +279,9 @@ static irqreturn_t atmio16d_interrupt(int irq, void *d)
 	struct comedi_device *dev = d;
 	struct comedi_subdevice *s = dev->subdevices + 0;
 
-/* printk("atmio16d_interrupt!\n"); */
+#ifdef DEBUG1
+	printk(KERN_DEBUG "atmio16d_interrupt!\n");
+#endif
 
 	comedi_buf_put(s->async, inw(dev->iobase + AD_FIFO_REG));
 
@@ -293,7 +295,7 @@ static int atmio16d_ai_cmdtest(struct comedi_device *dev,
 {
 	int err = 0, tmp;
 #ifdef DEBUG1
-	printk("atmio16d_ai_cmdtest\n");
+	printk(KERN_DEBUG "atmio16d_ai_cmdtest\n");
 #endif
 	/* make sure triggers are valid */
 	tmp = cmd->start_src;
@@ -324,8 +326,8 @@ static int atmio16d_ai_cmdtest(struct comedi_device *dev,
 	if (err)
 		return 1;
 
-	/* step 2: make sure trigger sources are unique and mutually compatible */
-	/* note that mutual compatiblity is not an issue here */
+	/* step 2: make sure trigger sources are unique & mutually compatible */
+	/* note that mutual compatibility is not an issue here */
 	if (cmd->scan_begin_src != TRIG_FOLLOW &&
 	    cmd->scan_begin_src != TRIG_EXT &&
 	    cmd->scan_begin_src != TRIG_TIMER)
@@ -397,7 +399,7 @@ static int atmio16d_ai_cmd(struct comedi_device *dev,
 	unsigned int sample_count, tmp, chan, gain;
 	int i;
 #ifdef DEBUG1
-	printk("atmio16d_ai_cmd\n");
+	printk(KERN_DEBUG "atmio16d_ai_cmd\n");
 #endif
 	/* This is slowly becoming a working command interface. *
 	 * It is still uber-experimental */
@@ -436,10 +438,10 @@ static int atmio16d_ai_cmd(struct comedi_device *dev,
 	} else if (cmd->convert_arg < 655360000) {
 		base_clock = CLOCK_100_KHZ;
 		timer = cmd->convert_arg / 10000;
-	} else if (cmd->convert_arg <= 0xffffffff /* 6553600000 */ ) {
+	} else if (cmd->convert_arg <= 0xffffffff /* 6553600000 */) {
 		base_clock = CLOCK_10_KHZ;
 		timer = cmd->convert_arg / 100000;
-	} else if (cmd->convert_arg <= 0xffffffff /* 65536000000 */ ) {
+	} else if (cmd->convert_arg <= 0xffffffff /* 65536000000 */) {
 		base_clock = CLOCK_1_KHZ;
 		timer = cmd->convert_arg / 1000000;
 	}
@@ -504,10 +506,10 @@ static int atmio16d_ai_cmd(struct comedi_device *dev,
 		} else if (cmd->scan_begin_arg < 655360000) {
 			base_clock = CLOCK_100_KHZ;
 			timer = cmd->scan_begin_arg / 10000;
-		} else if (cmd->scan_begin_arg < 0xffffffff /* 6553600000 */ ) {
+		} else if (cmd->scan_begin_arg < 0xffffffff /* 6553600000 */) {
 			base_clock = CLOCK_10_KHZ;
 			timer = cmd->scan_begin_arg / 100000;
-		} else if (cmd->scan_begin_arg < 0xffffffff /* 65536000000 */ ) {
+		} else if (cmd->scan_begin_arg < 0xffffffff /* 65536000000 */) {
 			base_clock = CLOCK_1_KHZ;
 			timer = cmd->scan_begin_arg / 1000000;
 		}
@@ -559,7 +561,7 @@ static int atmio16d_ai_insn_read(struct comedi_device *dev,
 	int status;
 
 #ifdef DEBUG1
-	printk("atmio16d_ai_insn_read\n");
+	printk(KERN_DEBUG "atmio16d_ai_insn_read\n");
 #endif
 	chan = CR_CHAN(insn->chanspec);
 	gain = CR_RANGE(insn->chanspec);
@@ -580,19 +582,18 @@ static int atmio16d_ai_insn_read(struct comedi_device *dev,
 			/* check conversion status */
 			status = inw(dev->iobase + STAT_REG);
 #ifdef DEBUG1
-			printk("status=%x\n", status);
+			printk(KERN_DEBUG "status=%x\n", status);
 #endif
 			if (status & STAT_AD_CONVAVAIL) {
 				/* read the data now */
 				data[i] = inw(dev->iobase + AD_FIFO_REG);
 				/* change to two's complement if need be */
-				if (devpriv->adc_coding == adc_2comp) {
+				if (devpriv->adc_coding == adc_2comp)
 					data[i] ^= 0x800;
-				}
 				break;
 			}
 			if (status & STAT_AD_OVERFLOW) {
-				printk("atmio16d: a/d FIFO overflow\n");
+				printk(KERN_INFO "atmio16d: a/d FIFO overflow\n");
 				outw(0, dev->iobase + AD_CLEAR_REG);
 
 				return -ETIME;
@@ -600,7 +601,7 @@ static int atmio16d_ai_insn_read(struct comedi_device *dev,
 		}
 		/* end waiting, now check if it timed out */
 		if (t == ATMIO16D_TIMEOUT) {
-			printk("atmio16d: timeout\n");
+			printk(KERN_INFO "atmio16d: timeout\n");
 
 			return -ETIME;
 		}
@@ -615,13 +616,11 @@ static int atmio16d_ao_insn_read(struct comedi_device *dev,
 {
 	int i;
 #ifdef DEBUG1
-	printk("atmio16d_ao_insn_read\n");
+	printk(KERN_DEBUG "atmio16d_ao_insn_read\n");
 #endif
 
-	for (i = 0; i < insn->n; i++) {
+	for (i = 0; i < insn->n; i++)
 		data[i] = devpriv->ao_readback[CR_CHAN(insn->chanspec)];
-	}
-
 	return i;
 }
 
@@ -633,7 +632,7 @@ static int atmio16d_ao_insn_write(struct comedi_device *dev,
 	int chan;
 	int d;
 #ifdef DEBUG1
-	printk("atmio16d_ao_insn_write\n");
+	printk(KERN_DEBUG "atmio16d_ao_insn_write\n");
 #endif
 
 	chan = CR_CHAN(insn->chanspec);
@@ -642,15 +641,13 @@ static int atmio16d_ao_insn_write(struct comedi_device *dev,
 		d = data[i];
 		switch (chan) {
 		case 0:
-			if (devpriv->dac0_coding == dac_2comp) {
+			if (devpriv->dac0_coding == dac_2comp)
 				d ^= 0x800;
-			}
 			outw(d, dev->iobase + DAC0_REG);
 			break;
 		case 1:
-			if (devpriv->dac1_coding == dac_2comp) {
+			if (devpriv->dac1_coding == dac_2comp)
 				d ^= 0x800;
-			}
 			outw(d, dev->iobase + DAC1_REG);
 			break;
 		default:
@@ -705,29 +702,29 @@ static int atmio16d_dio_insn_config(struct comedi_device *dev,
 /*
    options[0] - I/O port
    options[1] - MIO irq
-                0 == no irq
-                N == irq N {3,4,5,6,7,9,10,11,12,14,15}
+		0 == no irq
+		N == irq N {3,4,5,6,7,9,10,11,12,14,15}
    options[2] - DIO irq
-                0 == no irq
-                N == irq N {3,4,5,6,7,9}
+		0 == no irq
+		N == irq N {3,4,5,6,7,9}
    options[3] - DMA1 channel
-                0 == no DMA
-                N == DMA N {5,6,7}
+		0 == no DMA
+		N == DMA N {5,6,7}
    options[4] - DMA2 channel
-                0 == no DMA
-                N == DMA N {5,6,7}
+		0 == no DMA
+		N == DMA N {5,6,7}
 
    options[5] - a/d mux
-   	0=differential, 1=single
+	0=differential, 1=single
    options[6] - a/d range
-   	0=bipolar10, 1=bipolar5, 2=unipolar10
+	0=bipolar10, 1=bipolar5, 2=unipolar10
 
    options[7] - dac0 range
-   	0=bipolar, 1=unipolar
+	0=bipolar, 1=unipolar
    options[8] - dac0 reference
-    0=internal, 1=external
+	0=internal, 1=external
    options[9] - dac0 coding
-   	0=2's comp, 1=straight binary
+	0=2's comp, 1=straight binary
 
    options[10] - dac1 range
    options[11] - dac1 reference
@@ -745,7 +742,7 @@ static int atmio16d_attach(struct comedi_device *dev,
 
 	/* make sure the address range is free and allocate it */
 	iobase = it->options[0];
-	printk("comedi%d: atmio16d: 0x%04lx ", dev->minor, iobase);
+	printk(KERN_INFO "comedi%d: atmio16d: 0x%04lx ", dev->minor, iobase);
 	if (!request_region(iobase, ATMIO16D_SIZE, "ni_atmio16d")) {
 		printk("I/O port conflict\n");
 		return -EIO;
@@ -772,13 +769,13 @@ static int atmio16d_attach(struct comedi_device *dev,
 
 		ret = request_irq(irq, atmio16d_interrupt, 0, "atmio16d", dev);
 		if (ret < 0) {
-			printk("failed to allocate irq %u\n", irq);
+			printk(KERN_INFO "failed to allocate irq %u\n", irq);
 			return ret;
 		}
 		dev->irq = irq;
-		printk("( irq = %u )\n", irq);
+		printk(KERN_INFO "( irq = %u )\n", irq);
 	} else {
-		printk("( no irq )");
+		printk(KERN_INFO "( no irq )");
 	}
 
 	/* set device options */
@@ -855,11 +852,10 @@ static int atmio16d_attach(struct comedi_device *dev,
 
 	/* 8255 subdevice */
 	s++;
-	if (boardtype->has_8255) {
+	if (boardtype->has_8255)
 		subdev_8255_init(dev, s, NULL, dev->iobase);
-	} else {
+	else
 		s->type = COMEDI_SUBD_UNUSED;
-	}
 
 /* don't yet know how to deal with counter/timers */
 #if 0
@@ -876,7 +872,7 @@ static int atmio16d_attach(struct comedi_device *dev,
 
 static int atmio16d_detach(struct comedi_device *dev)
 {
-	printk("comedi%d: atmio16d: remove\n", dev->minor);
+	printk(KERN_INFO "comedi%d: atmio16d: remove\n", dev->minor);
 
 	if (dev->subdevices && boardtype->has_8255)
 		subdev_8255_cleanup(dev, dev->subdevices + 3);
diff --git a/drivers/staging/comedi/drivers/ni_labpc.h b/drivers/staging/comedi/drivers/ni_labpc.h
index 82596345dcf4..422cee58a967 100644
--- a/drivers/staging/comedi/drivers/ni_labpc.h
+++ b/drivers/staging/comedi/drivers/ni_labpc.h
@@ -38,19 +38,27 @@ struct labpc_board_struct {
 	int device_id;		/*  device id for pci and pcmcia boards */
 	int ai_speed;		/*  maximum input speed in nanoseconds */
 	enum labpc_bustype bustype;	/*  ISA/PCI/etc. */
-	enum labpc_register_layout register_layout;	/*  1200 has extra registers compared to pc+ */
+
+	/*  1200 has extra registers compared to pc+ */
+	enum labpc_register_layout register_layout;
 	int has_ao;		/*  has analog output true/false */
 	const struct comedi_lrange *ai_range_table;
 	const int *ai_range_code;
 	const int *ai_range_is_unipolar;
-	unsigned ai_scan_up:1;	/*  board can auto scan up in ai channels, not just down */
-	unsigned memory_mapped_io:1;	/* uses memory mapped io instead of ioports */
+
+	/*  board can auto scan up in ai channels, not just down */
+	unsigned ai_scan_up:1;
+
+	/* uses memory mapped io instead of ioports */
+	unsigned memory_mapped_io:1;
 };
 
 struct labpc_private {
 	struct mite_struct *mite;	/*  for mite chip on pci-1200 */
-	volatile unsigned long long count;	/* number of data points left to be taken */
-	unsigned int ao_value[NUM_AO_CHAN];	/*  software copy of analog output values */
+	/*  number of data points left to be taken */
+	volatile unsigned long long count;
+	/*  software copy of analog output values */
+	unsigned int ao_value[NUM_AO_CHAN];
 	/*  software copys of bits written to command registers */
 	volatile unsigned int command1_bits;
 	volatile unsigned int command2_bits;
@@ -61,16 +69,34 @@ struct labpc_private {
 	/*  store last read of board status registers */
 	volatile unsigned int status1_bits;
 	volatile unsigned int status2_bits;
-	unsigned int divisor_a0;	/* value to load into board's counter a0 (conversion pacing) for timed conversions */
-	unsigned int divisor_b0;	/* value to load into board's counter b0 (master) for timed conversions */
-	unsigned int divisor_b1;	/* value to load into board's counter b1 (scan pacing) for timed conversions */
+	/*
+	 * value to load into board's counter a0 (conversion pacing) for timed
+	 * conversions
+	 */
+	unsigned int divisor_a0;
+	/*
+	 * value to load into board's counter b0 (master) for timed conversions
+	 */
+	unsigned int divisor_b0;
+	/*
+	 * value to load into board's counter b1 (scan pacing) for timed
+	 * conversions
+	 */
+	unsigned int divisor_b1;
 	unsigned int dma_chan;	/*  dma channel to use */
 	u16 *dma_buffer;	/*  buffer ai will dma into */
-	unsigned int dma_transfer_size;	/*  transfer size in bytes for current transfer */
-	enum transfer_type current_transfer;	/*  we are using dma/fifo-half-full/etc. */
-	unsigned int eeprom_data[EEPROM_SIZE];	/*  stores contents of board's eeprom */
-	unsigned int caldac[16];	/*  stores settings of calibration dacs */
-	/*  function pointers so we can use inb/outb or readb/writeb as appropriate */
+	/* transfer size in bytes for current transfer */
+	unsigned int dma_transfer_size;
+	/* we are using dma/fifo-half-full/etc. */
+	enum transfer_type current_transfer;
+	/* stores contents of board's eeprom */
+	unsigned int eeprom_data[EEPROM_SIZE];
+	/* stores settings of calibration dacs */
+	unsigned int caldac[16];
+	/*
+	 * function pointers so we can use inb/outb or readb/writeb as
+	 * appropriate
+	 */
 	unsigned int (*read_byte) (unsigned long address);
 	void (*write_byte) (unsigned int byte, unsigned long address);
 };
diff --git a/drivers/staging/comedi/drivers/ni_labpc_cs.c b/drivers/staging/comedi/drivers/ni_labpc_cs.c
index 7d514b3ee754..0b963bb3328b 100644
--- a/drivers/staging/comedi/drivers/ni_labpc_cs.c
+++ b/drivers/staging/comedi/drivers/ni_labpc_cs.c
@@ -59,8 +59,7 @@ NI manuals:
 
 */
 
-#undef LABPC_DEBUG
-			    /* #define LABPC_DEBUG *//*  enable debugging messages */
+#undef LABPC_DEBUG  /* debugging messages */
 
 #include "../comedidev.h"
 
@@ -77,14 +76,15 @@ NI manuals:
 #include <pcmcia/cisreg.h>
 #include <pcmcia/ds.h>
 
-static struct pcmcia_device *pcmcia_cur_dev = NULL;
+static struct pcmcia_device *pcmcia_cur_dev;
 
 static int labpc_attach(struct comedi_device *dev, struct comedi_devconfig *it);
 
 static const struct labpc_board_struct labpc_cs_boards[] = {
 	{
 	 .name = "daqcard-1200",
-	 .device_id = 0x103,	/*  0x10b is manufacturer id, 0x103 is device id */
+	 .device_id = 0x103,	/* 0x10b is manufacturer id,
+				   0x103 is device id */
 	 .ai_speed = 10000,
 	 .bustype = pcmcia_bustype,
 	 .register_layout = labpc_1200_layout,
@@ -273,9 +273,8 @@ static void labpc_cs_detach(struct pcmcia_device *link)
 		labpc_release(link);
 	}
 
-	/* This points to the parent local_info_t struct */
-	if (link->priv)
-		kfree(link->priv);
+	/* This points to the parent local_info_t struct (may be null) */
+	kfree(link->priv);
 
 }				/* labpc_cs_detach */
 
diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c
index 753ee0512342..d6d49c3bbf1c 100644
--- a/drivers/staging/comedi/drivers/ni_mio_common.c
+++ b/drivers/staging/comedi/drivers/ni_mio_common.c
@@ -2207,7 +2207,7 @@ static int ni_ai_cmdtest(struct comedi_device *dev, struct comedi_subdevice *s,
 
 	/* step 2: make sure trigger sources are unique and mutually compatible */
 
-	/* note that mutual compatiblity is not an issue here */
+	/* note that mutual compatibility is not an issue here */
 	if (cmd->start_src != TRIG_NOW &&
 	    cmd->start_src != TRIG_INT && cmd->start_src != TRIG_EXT)
 		err++;
diff --git a/drivers/staging/comedi/drivers/ni_mio_cs.c b/drivers/staging/comedi/drivers/ni_mio_cs.c
index d692f4bb47ea..dc4849a40c97 100644
--- a/drivers/staging/comedi/drivers/ni_mio_cs.c
+++ b/drivers/staging/comedi/drivers/ni_mio_cs.c
@@ -250,9 +250,8 @@ static int mio_cs_detach(struct comedi_device *dev)
 
 	/* PCMCIA layer frees the IO region */
 
-	if (dev->irq) {
+	if (dev->irq)
 		free_irq(dev->irq, dev);
-	}
 
 	return 0;
 }
@@ -293,9 +292,8 @@ static void cs_detach(struct pcmcia_device *link)
 {
 	DPRINTK("cs_detach(link=%p)\n", link);
 
-	if (link->dev_node) {
+	if (link->dev_node)
 		cs_release(link);
-	}
 }
 
 static int mio_cs_suspend(struct pcmcia_device *link)
@@ -387,9 +385,8 @@ static int mio_cs_attach(struct comedi_device *dev, struct comedi_devconfig *it)
 		}
 		printk("\n");
 		printk(" board fingerprint (windowed):");
-		for (i = 0; i < 10; i++) {
+		for (i = 0; i < 10; i++)
 			printk(" 0x%04x", win_in(i));
-		}
 		printk("\n");
 	}
 #endif
diff --git a/drivers/staging/comedi/drivers/ni_pcidio.c b/drivers/staging/comedi/drivers/ni_pcidio.c
index d544698f2414..2d88a5be65ff 100644
--- a/drivers/staging/comedi/drivers/ni_pcidio.c
+++ b/drivers/staging/comedi/drivers/ni_pcidio.c
@@ -795,7 +795,7 @@ static int ni_pcidio_cmdtest(struct comedi_device *dev,
 
 	/* step 2: make sure trigger sources are unique and mutually compatible */
 
-	/* note that mutual compatiblity is not an issue here */
+	/* note that mutual compatibility is not an issue here */
 	if (cmd->start_src != TRIG_NOW && cmd->start_src != TRIG_INT)
 		err++;
 	if (cmd->scan_begin_src != TRIG_TIMER &&
diff --git a/drivers/staging/comedi/drivers/pcl711.c b/drivers/staging/comedi/drivers/pcl711.c
index dd9db069a932..4914784f6995 100644
--- a/drivers/staging/comedi/drivers/pcl711.c
+++ b/drivers/staging/comedi/drivers/pcl711.c
@@ -407,6 +407,7 @@ static int pcl711_ai_cmd(struct comedi_device *dev, struct comedi_subdevice *s)
 		 *  0xb4 = Select Counter 2 | LSB/MSB | Mode=2 | Binary
 		 */
 
+		timer1 = timer2 = 0;
 		i8253_cascade_ns_to_timer(i8253_osc_base, &timer1, &timer2,
 					  &cmd->scan_begin_arg,
 					  TRIG_ROUND_NEAREST);
diff --git a/drivers/staging/comedi/drivers/pcl726.c b/drivers/staging/comedi/drivers/pcl726.c
index ccadd095f630..6a1a9790a907 100644
--- a/drivers/staging/comedi/drivers/pcl726.c
+++ b/drivers/staging/comedi/drivers/pcl726.c
@@ -39,27 +39,27 @@ Interrupts are not supported.
     Options for PCL-726:
      [0] - IO Base
      [2]...[7] - D/A output range for channel 1-6:
-               0: 0-5V, 1: 0-10V, 2: +/-5V, 3: +/-10V,
-	       4: 4-20mA, 5: unknown (external reference)
+		0: 0-5V, 1: 0-10V, 2: +/-5V, 3: +/-10V,
+		4: 4-20mA, 5: unknown (external reference)
 
     Options for PCL-727:
      [0] - IO Base
      [2]...[13] - D/A output range for channel 1-12:
-               0: 0-5V, 1: 0-10V, 2: +/-5V,
-	       3: 4-20mA
+		0: 0-5V, 1: 0-10V, 2: +/-5V,
+		3: 4-20mA
 
     Options for PCL-728 and ACL-6128:
      [0] - IO Base
      [2], [3] - D/A output range for channel 1 and 2:
-               0: 0-5V, 1: 0-10V, 2: +/-5V, 3: +/-10V,
-	       4: 4-20mA, 5: 0-20mA
+		0: 0-5V, 1: 0-10V, 2: +/-5V, 3: +/-10V,
+		4: 4-20mA, 5: 0-20mA
 
     Options for ACL-6126:
      [0] - IO Base
      [1] - IRQ (0=disable, 3, 5, 6, 7, 9, 10, 11, 12, 15) (currently ignored)
      [2]...[7] - D/A output range for channel 1-6:
-               0: 0-5V, 1: 0-10V, 2: +/-5V, 3: +/-10V,
-	       4: 4-20mA
+		0: 0-5V, 1: 0-10V, 2: +/-5V, 3: +/-10V,
+		4: 4-20mA
 */
 
 /*
@@ -127,7 +127,8 @@ struct pcl726_board {
 	int di_lo;
 	int do_hi;
 	int do_lo;
-	const struct comedi_lrange *const *range_type_list;	/*  list of supported ranges */
+	const struct comedi_lrange *const *range_type_list;
+	/*  list of supported ranges */
 };
 
 static const struct pcl726_board boardtypes[] = {
@@ -204,9 +205,8 @@ static int pcl726_ao_insn_read(struct comedi_device *dev,
 	int chan = CR_CHAN(insn->chanspec);
 	int n;
 
-	for (n = 0; n < insn->n; n++) {
+	for (n = 0; n < insn->n; n++)
 		data[n] = devpriv->ao_readback[chan];
-	}
 	return n;
 }
 
@@ -256,10 +256,10 @@ static int pcl726_attach(struct comedi_device *dev, struct comedi_devconfig *it)
 
 	iobase = it->options[0];
 	iorange = this_board->io_range;
-	printk("comedi%d: pcl726: board=%s, 0x%03lx ", dev->minor,
+	printk(KERN_WARNING "comedi%d: pcl726: board=%s, 0x%03lx ", dev->minor,
 	       this_board->name, iobase);
 	if (!request_region(iobase, iorange, "pcl726")) {
-		printk("I/O port conflict\n");
+		printk(KERN_WARNING "I/O port conflict\n");
 		return -EIO;
 	}
 
@@ -283,16 +283,16 @@ static int pcl726_attach(struct comedi_device *dev, struct comedi_devconfig *it)
 		devpriv->first_chan = 2;
 		if (irq) {	/* we want to use IRQ */
 			if (((1 << irq) & boardtypes[board].IRQbits) == 0) {
-				printk
-				    (", IRQ %d is out of allowed range, DISABLING IT",
-				     irq);
+				printk(KERN_WARNING
+					", IRQ %d is out of allowed range,"
+					" DISABLING IT", irq);
 				irq = 0;	/* Bad IRQ */
 			} else {
 				if (request_irq(irq, interrupt_pcl818, 0,
 						"pcl726", dev)) {
-					printk
-					    (", unable to allocate IRQ %d, DISABLING IT",
-					     irq);
+					printk(KERN_WARNING
+						", unable to allocate IRQ %d,"
+						" DISABLING IT", irq);
 					irq = 0;	/* Can't use IRQ */
 				} else {
 					printk(", irq=%d", irq);
@@ -372,9 +372,8 @@ static int pcl726_detach(struct comedi_device *dev)
 /* printk("comedi%d: pcl726: remove\n",dev->minor); */
 
 #ifdef ACL6126_IRQ
-	if (dev->irq) {
+	if (dev->irq)
 		free_irq(dev->irq, dev);
-	}
 #endif
 
 	if (dev->iobase)
diff --git a/drivers/staging/comedi/drivers/pcl812.c b/drivers/staging/comedi/drivers/pcl812.c
index 0b51a48c3ad8..0a5bc3d6da8c 100644
--- a/drivers/staging/comedi/drivers/pcl812.c
+++ b/drivers/staging/comedi/drivers/pcl812.c
@@ -51,7 +51,7 @@ Options for PCL-812:
         5=A/D input range is +/-0.3125V
   [5] - 0=D/A outputs 0-5V  (internal reference -5V)
         1=D/A outputs 0-10V (internal reference -10V)
-        2=D/A outputs unknow (external reference)
+        2=D/A outputs unknown (external reference)
 
 Options for PCL-812PG, ACL-8112PG:
   [0] - IO Base
@@ -63,7 +63,7 @@ Options for PCL-812PG, ACL-8112PG:
         1=A/D have max +/-10V input
   [5] - 0=D/A outputs 0-5V  (internal reference -5V)
         1=D/A outputs 0-10V (internal reference -10V)
-        2=D/A outputs unknow (external reference)
+        2=D/A outputs unknown (external reference)
 
 Options for ACL-8112DG/HG, A-822PGL/PGH, A-823PGL/PGH, ACL-8216, A-826PG:
   [0] - IO Base
@@ -75,7 +75,7 @@ Options for ACL-8112DG/HG, A-822PGL/PGH, A-823PGL/PGH, ACL-8216, A-826PG:
         1=A/D channels are DIFF
   [5] - 0=D/A outputs 0-5V  (internal reference -5V)
         1=D/A outputs 0-10V (internal reference -10V)
-        2=D/A outputs unknow (external reference)
+        2=D/A outputs unknown (external reference)
 
 Options for A-821PGL/PGH:
   [0] - IO Base
diff --git a/drivers/staging/comedi/drivers/pcl816.c b/drivers/staging/comedi/drivers/pcl816.c
index fa2414500a07..852fe2458fdc 100644
--- a/drivers/staging/comedi/drivers/pcl816.c
+++ b/drivers/staging/comedi/drivers/pcl816.c
@@ -112,7 +112,7 @@ struct pcl816_board {
 	int n_dichan;		/*  num of DI chans */
 	int n_dochan;		/*  num of DO chans */
 	const struct comedi_lrange *ai_range_type;	/*  default A/D rangelist */
-	const struct comedi_lrange *ao_range_type;	/*  dafault D/A rangelist */
+	const struct comedi_lrange *ao_range_type;	/*  default D/A rangelist */
 	unsigned int io_range;	/*  len of IO space */
 	unsigned int IRQbits;	/*  allowed interrupts */
 	unsigned int DMAbits;	/*  allowed DMA chans */
@@ -445,7 +445,7 @@ static irqreturn_t interrupt_pcl816(int irq, void *d)
 		comedi_error(dev, "bad IRQ!");
 		return IRQ_NONE;
 	}
-	comedi_error(dev, "IRQ from unknow source!");
+	comedi_error(dev, "IRQ from unknown source!");
 	return IRQ_NONE;
 }
 
@@ -472,7 +472,7 @@ static int pcl816_ai_cmdtest(struct comedi_device *dev,
 			     struct comedi_subdevice *s, struct comedi_cmd *cmd)
 {
 	int err = 0;
-	int tmp, divisor1, divisor2;
+	int tmp, divisor1 = 0, divisor2 = 0;
 
 	DEBUG(printk("pcl816 pcl812_ai_cmdtest\n"); pcl816_cmdtest_out(-1, cmd);
 	    );
@@ -488,7 +488,9 @@ static int pcl816_ai_cmdtest(struct comedi_device *dev,
 	if (!cmd->scan_begin_src || tmp != cmd->scan_begin_src)
 		err++;
 
-	if (!(cmd->convert_src & (TRIG_EXT | TRIG_TIMER)))
+	tmp = cmd->convert_src;
+	cmd->convert_src &= TRIG_EXT | TRIG_TIMER;
+	if (!cmd->convert_src || tmp != cmd->convert_src)
 		err++;
 
 	tmp = cmd->scan_end_src;
diff --git a/drivers/staging/comedi/drivers/pcl818.c b/drivers/staging/comedi/drivers/pcl818.c
index e95229b13118..d0481013a837 100644
--- a/drivers/staging/comedi/drivers/pcl818.c
+++ b/drivers/staging/comedi/drivers/pcl818.c
@@ -50,7 +50,7 @@ A word or two about DMA. Driver support DMA operations at two ways:
           1, 10=A/D input -10V..+10V
     [5] - 0,  5=D/A output 0-5V  (internal reference -5V)
           1, 10=D/A output 0-10V (internal reference -10V)
-	  2    =D/A output unknow (external reference)
+	  2    =D/A output unknown (external reference)
 
    Options for PCL-818, PCL-818H:
     [0] - IO Base
@@ -60,7 +60,7 @@ A word or two about DMA. Driver support DMA operations at two ways:
               1= 1MHz clock for 8254
     [4] - 0,  5=D/A output 0-5V  (internal reference -5V)
           1, 10=D/A output 0-10V (internal reference -10V)
-	  2    =D/A output unknow (external reference)
+	  2    =D/A output unknown (external reference)
 
    Options for PCL-818HD, PCL-818HG:
     [0] - IO Base
@@ -71,7 +71,7 @@ A word or two about DMA. Driver support DMA operations at two ways:
               1= 1MHz clock for 8254
     [4] - 0,  5=D/A output 0-5V  (internal reference -5V)
           1, 10=D/A output 0-10V (internal reference -10V)
-   	  2    =D/A output unknow (external reference)
+   	  2    =D/A output unknown (external reference)
 
    Options for PCL-718:
     [0] - IO Base
@@ -92,7 +92,7 @@ A word or two about DMA. Driver support DMA operations at two ways:
 	     10=	     user defined unipolar
     [5] - 0,  5=D/A outputs 0-5V  (internal reference -5V)
           1, 10=D/A outputs 0-10V (internal reference -10V)
-	      2=D/A outputs unknow (external reference)
+	      2=D/A outputs unknown (external reference)
     [6] - 0, 60=max  60kHz A/D sampling
           1,100=max 100kHz A/D sampling (PCL-718 with Option 001 installed)
 
@@ -876,7 +876,7 @@ static irqreturn_t interrupt_pcl818(int irq, void *d)
 		return IRQ_NONE;
 	}
 
-	comedi_error(dev, "IRQ from unknow source!");
+	comedi_error(dev, "IRQ from unknown source!");
 	return IRQ_NONE;
 }
 
@@ -970,7 +970,7 @@ static int pcl818_ai_cmd_mode(int mode, struct comedi_device *dev,
 			      struct comedi_subdevice *s)
 {
 	struct comedi_cmd *cmd = &s->async->cmd;
-	int divisor1, divisor2;
+	int divisor1 = 0, divisor2 = 0;
 	unsigned int seglen;
 
 	printk("pcl818_ai_cmd_mode()\n");
@@ -1089,7 +1089,7 @@ static int pcl818_ai_cmd_mode(int mode, struct comedi_device *dev,
 static int pcl818_ao_mode13(int mode, struct comedi_device *dev,
 			    struct comedi_subdevice *s, comedi_trig * it)
 {
-	int divisor1, divisor2;
+	int divisor1 = 0, divisor2 = 0;
 
 	if (!dev->irq) {
 		comedi_error(dev, "IRQ not defined!");
@@ -1287,7 +1287,7 @@ static int ai_cmdtest(struct comedi_device *dev, struct comedi_subdevice *s,
 		      struct comedi_cmd *cmd)
 {
 	int err = 0;
-	int tmp, divisor1, divisor2;
+	int tmp, divisor1 = 0, divisor2 = 0;
 
 	/* step 1: make sure trigger sources are trivially valid */
 
diff --git a/drivers/staging/comedi/drivers/pcm_common.c b/drivers/staging/comedi/drivers/pcm_common.c
index ebd9838232af..52c2a6698214 100644
--- a/drivers/staging/comedi/drivers/pcm_common.c
+++ b/drivers/staging/comedi/drivers/pcm_common.c
@@ -41,7 +41,8 @@ int comedi_pcm_cmdtest(struct comedi_device *dev,
 	if (err)
 		return 1;
 
-	/* step 2: make sure trigger sources are unique and mutually compatible */
+	/* step 2: make sure trigger sources are unique and
+	 * mutually compatible */
 
 	/* these tests are true if more than one _src bit is set */
 	if ((cmd->start_src & (cmd->start_src - 1)) != 0)
@@ -107,5 +108,4 @@ int comedi_pcm_cmdtest(struct comedi_device *dev,
 
 	return 0;
 }
-
 EXPORT_SYMBOL(comedi_pcm_cmdtest);
diff --git a/drivers/staging/comedi/drivers/pcmmio.c b/drivers/staging/comedi/drivers/pcmmio.c
index d812c2c3af12..35ba93989a36 100644
--- a/drivers/staging/comedi/drivers/pcmmio.c
+++ b/drivers/staging/comedi/drivers/pcmmio.c
@@ -32,8 +32,10 @@ Winsystems.  This board is a PC-104 based I/O board.  It contains
 four subdevices:
   subdevice 0 - 16 channels of 16-bit AI
   subdevice 1 - 8 channels of 16-bit AO
-  subdevice 2 - first 24 channels of the 48 channel of DIO (with edge-triggered interrupt support)
-  subdevice 3 - last 24 channels of the 48 channel DIO (no interrupt support for this bank of channels)
+  subdevice 2 - first 24 channels of the 48 channel of DIO
+	(with edge-triggered interrupt support)
+  subdevice 3 - last 24 channels of the 48 channel DIO
+	(no interrupt support for this bank of channels)
 
   Some notes:
 
@@ -70,7 +72,8 @@ four subdevices:
 
 Configuration Options:
   [0] - I/O port base address
-  [1] - IRQ (optional -- for edge-detect interrupt support only, leave out if you don't need this feature)
+  [1] - IRQ (optional -- for edge-detect interrupt support only,
+	leave out if you don't need this feature)
 */
 
 #include <linux/interrupt.h>
@@ -115,9 +118,11 @@ Configuration Options:
 #define REG_PORT4 0x4
 #define REG_PORT5 0x5
 #define REG_INT_PENDING 0x6
-#define REG_PAGELOCK 0x7	/* page selector register, upper 2 bits select a page
-				   and bits 0-5 are used to 'lock down' a particular
-				   port above to make it readonly.  */
+#define REG_PAGELOCK 0x7	/*
+				 * page selector register, upper 2 bits select
+				 * a page and bits 0-5 are used to 'lock down'
+				 * a particular port above to make it readonly.
+				 */
 #define REG_POL0 0x8
 #define REG_POL1 0x9
 #define REG_POL2 0xA
@@ -134,7 +139,7 @@ Configuration Options:
 #define REG_PAGE_BITOFFSET 6
 #define REG_LOCK_BITOFFSET 0
 #define REG_PAGE_MASK (~((0x1<<REG_PAGE_BITOFFSET)-1))
-#define REG_LOCK_MASK ~(REG_PAGE_MASK)
+#define REG_LOCK_MASK (~(REG_PAGE_MASK))
 #define PAGE_POL 1
 #define PAGE_ENAB 2
 #define PAGE_INT_ID 3
@@ -168,13 +173,12 @@ struct pcmmio_board {
 	comedi_insn_fn_t ai_rinsn, ao_rinsn, ao_winsn;
 };
 
-static const struct comedi_lrange ranges_ai =
-    { 4, {RANGE(-5., 5.), RANGE(-10., 10.), RANGE(0., 5.), RANGE(0.,
-								 10.)}
+static const struct comedi_lrange ranges_ai = {
+	4, {RANGE(-5., 5.), RANGE(-10., 10.), RANGE(0., 5.), RANGE(0., 10.)}
 };
 
-static const struct comedi_lrange ranges_ao =
-    { 6, {RANGE(0., 5.), RANGE(0., 10.), RANGE(-5., 5.), RANGE(-10., 10.),
+static const struct comedi_lrange ranges_ao = {
+	6, {RANGE(0., 5.), RANGE(0., 10.), RANGE(-5., 5.), RANGE(-10., 10.),
 	  RANGE(-2.5, 2.5), RANGE(-2.5, 7.5)}
 };
 
@@ -204,7 +208,8 @@ static const struct pcmmio_board pcmmio_boards[] = {
 struct pcmmio_subdev_private {
 
 	union {
-		/* for DIO: mapping of halfwords (bytes) in port/chanarray to iobase */
+		/* for DIO: mapping of halfwords (bytes)
+		   in port/chanarray to iobase */
 		unsigned long iobases[PORTS_PER_SUBDEV];
 
 		/* for AI/AO */
@@ -215,15 +220,31 @@ struct pcmmio_subdev_private {
 
 			/* The below is only used for intr subdevices */
 			struct {
-				int asic;	/* if non-negative, this subdev has an interrupt asic */
-				int first_chan;	/* if nonnegative, the first channel id for
-						   interrupts. */
-				int num_asic_chans;	/* the number of asic channels in this subdev
-							   that have interrutps */
-				int asic_chan;	/* if nonnegative, the first channel id with
-						   respect to the asic that has interrupts */
-				int enabled_mask;	/* subdev-relative channel mask for channels
-							   we are interested in */
+				/*
+				 * if non-negative, this subdev has an
+				 * interrupt asic
+				 */
+				int asic;
+				/*
+				 * if nonnegative, the first channel id for
+				 * interrupts.
+				 */
+				int first_chan;
+				/*
+				 * the number of asic channels in this subdev
+				 * that have interrutps
+				 */
+				int num_asic_chans;
+				/*
+				 * if nonnegative, the first channel id with
+				 * respect to the asic that has interrupts
+				 */
+				int asic_chan;
+				/*
+				 * subdev-relative channel mask for channels
+				 * we are interested in
+				 */
+				int enabled_mask;
 				int active;
 				int stop_count;
 				int continuous;
@@ -231,20 +252,25 @@ struct pcmmio_subdev_private {
 			} intr;
 		} dio;
 		struct {
-			unsigned int shadow_samples[8];	/* the last unsigned int data written */
+			/* the last unsigned int data written */
+			unsigned int shadow_samples[8];
 		} ao;
 	};
 };
 
-/* this structure is for data unique to this hardware driver.  If
-   several hardware drivers keep similar information in this structure,
-   feel free to suggest moving the variable to the struct comedi_device struct.  */
+/*
+ * this structure is for data unique to this hardware driver.  If
+ * several hardware drivers keep similar information in this structure,
+ * feel free to suggest moving the variable to the struct comedi_device struct.
+ */
 struct pcmmio_private {
 	/* stuff for DIO */
 	struct {
 		unsigned char pagelock;	/* current page and lock */
-		unsigned char pol[NUM_PAGED_REGS];	/* shadow of POLx registers */
-		unsigned char enab[NUM_PAGED_REGS];	/* shadow of ENABx registers */
+		/* shadow of POLx registers */
+		unsigned char pol[NUM_PAGED_REGS];
+		/* shadow of ENABx registers */
+		unsigned char enab[NUM_PAGED_REGS];
 		int num;
 		unsigned long iobase;
 		unsigned int irq;
@@ -312,7 +338,8 @@ static int pcmmio_cmdtest(struct comedi_device *dev, struct comedi_subdevice *s,
 			  struct comedi_cmd *cmd);
 
 /* some helper functions to deal with specifics of this device's registers */
-static void init_asics(struct comedi_device *dev);	/* sets up/clears ASIC chips to defaults */
+/* sets up/clears ASIC chips to defaults */
+static void init_asics(struct comedi_device *dev);
 static void switch_page(struct comedi_device *dev, int asic, int page);
 #ifdef notused
 static void lock_port(struct comedi_device *dev, int asic, int port);
@@ -367,9 +394,11 @@ static int pcmmio_attach(struct comedi_device *dev, struct comedi_devconfig *it)
 		devpriv->asics[asic].num = asic;
 		devpriv->asics[asic].iobase =
 		    dev->iobase + 16 + asic * ASIC_IOSIZE;
-		devpriv->asics[asic].irq = 0;	/* this gets actually set at the end of
-						   this function when we
-						   request_irqs */
+		/*
+		 * this gets actually set at the end of this function when we
+		 * request_irqs
+		 */
+		devpriv->asics[asic].irq = 0;
 		spin_lock_init(&devpriv->asics[asic].spinlock);
 	}
 
@@ -463,7 +492,10 @@ static int pcmmio_attach(struct comedi_device *dev, struct comedi_devconfig *it)
 			if (thisasic_chanct <
 			    CHANS_PER_PORT * INTR_PORTS_PER_ASIC
 			    && subpriv->dio.intr.asic < 0) {
-				/* this is an interrupt subdevice, so setup the struct */
+				/*
+				 * this is an interrupt subdevice,
+				 * so setup the struct
+				 */
 				subpriv->dio.intr.asic = asic;
 				subpriv->dio.intr.active = 0;
 				subpriv->dio.intr.stop_count = 0;
@@ -484,7 +516,11 @@ static int pcmmio_attach(struct comedi_device *dev, struct comedi_devconfig *it)
 		chans_left -= s->n_chan;
 
 		if (!chans_left) {
-			asic = 0;	/* reset the asic to our first asic, to do intr subdevs */
+			/*
+			 * reset the asic to our first asic,
+			 * to do intr subdevs
+			 */
+			asic = 0;
 			port = 0;
 		}
 
@@ -507,8 +543,10 @@ static int pcmmio_attach(struct comedi_device *dev, struct comedi_devconfig *it)
 		devpriv->asics[asic].irq = irq[asic];
 	}
 
-	dev->irq = irq[0];	/* grr.. wish comedi dev struct supported multiple
-				   irqs.. */
+	dev->irq = irq[0];	/*
+				 * grr.. wish comedi dev struct supported
+				 * multiple irqs..
+				 */
 
 	if (irq[0]) {
 		printk("irq: %u ", irq[0]);
@@ -604,9 +642,14 @@ static int pcmmio_dio_insn_bits(struct comedi_device *dev,
 #endif
 
 		if (write_mask_byte) {
-			/* this byte has some write_bits -- so set the output lines */
-			byte &= ~write_mask_byte;	/* clear bits for write mask */
-			byte |= ~data_byte & write_mask_byte;	/* set to inverted data_byte */
+			/*
+			 * this byte has some write_bits
+			 * -- so set the output lines
+			 */
+			/* clear bits for write mask */
+			byte &= ~write_mask_byte;
+			/* set to inverted data_byte */
+			byte |= ~data_byte & write_mask_byte;
 			/* Write out the new digital output state */
 			outb(byte, ioaddr);
 		}
@@ -670,9 +713,11 @@ static int pcmmio_dio_insn_config(struct comedi_device *dev,
 		byte &= ~(1 << bit_no);
 				/**< set input channel to '0' */
 
-		/* write out byte -- this is the only time we actually affect the
-		   hardware as all channels are implicitly output -- but input
-		   channels are set to float-high */
+		/*
+		 * write out byte -- this is the only time we actually affect
+		 * the hardware as all channels are implicitly output
+		 * -- but input channels are set to float-high
+		 */
 		outb(byte, ioaddr);
 
 		/* save to io_bits */
@@ -726,8 +771,8 @@ static void init_asics(struct comedi_device *dev)
 		   outb(0xff, baseaddr + REG_ENAB0); */
 		/* END DEBUG */
 
-		switch_page(dev, asic, 0);	/* switch back to default page 0 */
-
+		/* switch back to default page 0 */
+		switch_page(dev, asic, 0);
 	}
 }
 
@@ -806,7 +851,10 @@ static irqreturn_t interrupt_pcmmio(int irq, void *d)
 							REG_INT_ID0 + port);
 
 						if (io_lines_with_edges)
-							/* clear pending interrupt */
+							/*
+							 * clear pending
+							 * interrupt
+							 */
 							outb(0, iobase +
 							     REG_INT_ID0 +
 							     port);
@@ -825,14 +873,21 @@ static irqreturn_t interrupt_pcmmio(int irq, void *d)
 
 			if (triggered) {
 				struct comedi_subdevice *s;
-				/* TODO here: dispatch io lines to subdevs with commands.. */
+				/*
+				 * TODO here: dispatch io lines to subdevs
+				 * with commands..
+				 */
 				printk
 				    ("PCMMIO DEBUG: got edge detect interrupt %d asic %d which_chans: %06x\n",
 				     irq, asic, triggered);
 				for (s = dev->subdevices + 2;
 				     s < dev->subdevices + dev->n_subdevices;
 				     ++s) {
-					if (subpriv->dio.intr.asic == asic) {	/* this is an interrupt subdev, and it matches this asic! */
+					/*
+					 * this is an interrupt subdev,
+					 * and it matches this asic!
+					 */
+					if (subpriv->dio.intr.asic == asic) {
 						unsigned long flags;
 						unsigned oldevents;
 
@@ -867,9 +922,8 @@ static irqreturn_t interrupt_pcmmio(int irq, void *d)
 								     n < len;
 								     n++) {
 									ch = CR_CHAN(s->async->cmd.chanlist[n]);
-									if (mytrig & (1U << ch)) {
+									if (mytrig & (1U << ch))
 										val |= (1U << n);
-									}
 								}
 								/* Write the scan to the buffer. */
 								if (comedi_buf_put(s->async, ((short *)&val)[0])
@@ -877,8 +931,7 @@ static irqreturn_t interrupt_pcmmio(int irq, void *d)
 								    comedi_buf_put
 								    (s->async,
 								     ((short *)
-								      &val)[1]))
-								{
+								      &val)[1])) {
 									s->async->events |= (COMEDI_CB_BLOCK | COMEDI_CB_EOS);
 								} else {
 									/* Overflow! Stop acquisition!! */
@@ -981,9 +1034,16 @@ static int pcmmio_start_intr(struct comedi_device *dev,
 			 1) << subpriv->dio.intr.first_chan;
 		subpriv->dio.intr.enabled_mask = bits;
 
-		{		/* the below code configures the board to use a specific IRQ from 0-15. */
+		{
+			/*
+			 * the below code configures the board
+			 * to use a specific IRQ from 0-15.
+			 */
 			unsigned char b;
-			/* set resource enable register to enable IRQ operation */
+			/*
+			 * set resource enable register
+			 * to enable IRQ operation
+			 */
 			outb(1 << 4, dev->iobase + 3);
 			/* set bits 0-3 of b to the irq number from 0-15 */
 			b = dev->irq & ((1 << 4) - 1);
@@ -1037,14 +1097,12 @@ pcmmio_inttrig_start_intr(struct comedi_device *dev, struct comedi_subdevice *s,
 
 	spin_lock_irqsave(&subpriv->dio.intr.spinlock, flags);
 	s->async->inttrig = 0;
-	if (subpriv->dio.intr.active) {
+	if (subpriv->dio.intr.active)
 		event = pcmmio_start_intr(dev, s);
-	}
 	spin_unlock_irqrestore(&subpriv->dio.intr.spinlock, flags);
 
-	if (event) {
+	if (event)
 		comedi_event(dev, s);
-	}
 
 	return 1;
 }
@@ -1086,9 +1144,8 @@ static int pcmmio_cmd(struct comedi_device *dev, struct comedi_subdevice *s)
 	}
 	spin_unlock_irqrestore(&subpriv->dio.intr.spinlock, flags);
 
-	if (event) {
+	if (event)
 		comedi_event(dev, s);
-	}
 
 	return 0;
 }
@@ -1136,17 +1193,32 @@ static int ai_rinsn(struct comedi_device *dev, struct comedi_subdevice *s,
 		short sample, adc_adjust = 0;
 
 		if (chan > 7)
-			chan -= 8, iooffset = 4;	/* use the second dword for channels > 7 */
+			chan -= 8, iooffset = 4;	/*
+							 * use the second dword
+							 * for channels > 7
+							 */
 
 		if (aref != AREF_DIFF) {
 			aref = AREF_GROUND;
-			command_byte |= 1 << 7;	/* set bit 7 to indicate single-ended */
+			command_byte |= 1 << 7;	/*
+						 * set bit 7 to indicate
+						 * single-ended
+						 */
 		}
 		if (range < 2)
-			adc_adjust = 0x8000;	/* bipolar ranges (-5,5 .. -10,10 need to be adjusted -- that is.. they need to wrap around by adding 0x8000 */
+			adc_adjust = 0x8000;	/*
+						 * bipolar ranges
+						 * (-5,5 .. -10,10 need to be
+						 * adjusted -- that is.. they
+						 * need to wrap around by
+						 * adding 0x8000
+						 */
 
 		if (chan % 2) {
-			command_byte |= 1 << 6;	/* odd-numbered channels have bit 6 set */
+			command_byte |= 1 << 6;	/*
+						 * odd-numbered channels
+						 * have bit 6 set
+						 */
 		}
 
 		/* select the channel, bits 4-5 == chan/2 */
@@ -1156,16 +1228,22 @@ static int ai_rinsn(struct comedi_device *dev, struct comedi_subdevice *s,
 		command_byte |= (range & 0x3) << 2;
 
 		/* need to do this twice to make sure mux settled */
-		outb(command_byte, iobase + iooffset + 2);	/* chan/range/aref select */
+		/* chan/range/aref select */
+		outb(command_byte, iobase + iooffset + 2);
 
-		adc_wait_ready(iobase + iooffset);	/* wait for the adc to say it finised the conversion */
+		/* wait for the adc to say it finised the conversion */
+		adc_wait_ready(iobase + iooffset);
 
-		outb(command_byte, iobase + iooffset + 2);	/* select the chan/range/aref AGAIN */
+		/* select the chan/range/aref AGAIN */
+		outb(command_byte, iobase + iooffset + 2);
 
 		adc_wait_ready(iobase + iooffset);
 
-		sample = inb(iobase + iooffset + 0);	/* read data lo byte */
-		sample |= inb(iobase + iooffset + 1) << 8;	/* read data hi byte */
+		/* read data lo byte */
+		sample = inb(iobase + iooffset + 0);
+
+		/* read data hi byte */
+		sample |= inb(iobase + iooffset + 1) << 8;
 		sample += adc_adjust;	/* adjustment .. munge data */
 		data[n] = sample;
 	}
@@ -1227,15 +1305,24 @@ static int ao_winsn(struct comedi_device *dev, struct comedi_subdevice *s,
 
 			wait_dac_ready(iobase + iooffset);
 
-			outb(data[n] & 0xff, iobase + iooffset + 0);	/* low order byte */
-			outb((data[n] >> 8) & 0xff, iobase + iooffset + 1);	/* high order byte */
-			command_byte = 0x70 | (chan << 1);	/* set bit 4 of command byte to indicate data is loaded and trigger conversion */
+			/* low order byte */
+			outb(data[n] & 0xff, iobase + iooffset + 0);
+
+			/* high order byte */
+			outb((data[n] >> 8) & 0xff, iobase + iooffset + 1);
+
+			/*
+			 * set bit 4 of command byte to indicate
+			 * data is loaded and trigger conversion
+			 */
+			command_byte = 0x70 | (chan << 1);
 			/* trigger converion */
 			outb(command_byte, iobase + iooffset + 2);
 
 			wait_dac_ready(iobase + iooffset);
 
-			subpriv->ao.shadow_samples[chan] = data[n];	/* save to shadow register for ao_rinsn */
+			/* save to shadow register for ao_rinsn */
+			subpriv->ao.shadow_samples[chan] = data[n];
 		}
 	}
 	return n;
diff --git a/drivers/staging/comedi/drivers/quatech_daqp_cs.c b/drivers/staging/comedi/drivers/quatech_daqp_cs.c
index 5256fd933162..3325f24448b5 100644
--- a/drivers/staging/comedi/drivers/quatech_daqp_cs.c
+++ b/drivers/staging/comedi/drivers/quatech_daqp_cs.c
@@ -489,7 +489,7 @@ static int daqp_ai_cmdtest(struct comedi_device *dev,
 
 	/* step 2: make sure trigger sources are unique and mutually compatible */
 
-	/* note that mutual compatiblity is not an issue here */
+	/* note that mutual compatibility is not an issue here */
 	if (cmd->scan_begin_src != TRIG_TIMER &&
 	    cmd->scan_begin_src != TRIG_FOLLOW)
 		err++;
diff --git a/drivers/staging/comedi/drivers/rtd520.c b/drivers/staging/comedi/drivers/rtd520.c
index f35cce597140..8626658e778c 100644
--- a/drivers/staging/comedi/drivers/rtd520.c
+++ b/drivers/staging/comedi/drivers/rtd520.c
@@ -1768,7 +1768,7 @@ static int rtd_ai_cmdtest(struct comedi_device *dev,
 
 	/* step 2: make sure trigger sources are unique
 	   and mutually compatible */
-	/* note that mutual compatiblity is not an issue here */
+	/* note that mutual compatibility is not an issue here */
 	if (cmd->scan_begin_src != TRIG_TIMER &&
 	    cmd->scan_begin_src != TRIG_EXT) {
 		err++;
diff --git a/drivers/staging/comedi/drivers/s626.c b/drivers/staging/comedi/drivers/s626.c
index 80d2787d1063..fdd7ab954d8c 100644
--- a/drivers/staging/comedi/drivers/s626.c
+++ b/drivers/staging/comedi/drivers/s626.c
@@ -1926,7 +1926,7 @@ static int s626_ai_cmdtest(struct comedi_device *dev,
 	/* step 2: make sure trigger sources are unique and mutually
 	   compatible */
 
-	/* note that mutual compatiblity is not an issue here */
+	/* note that mutual compatibility is not an issue here */
 	if (cmd->scan_begin_src != TRIG_TIMER &&
 	    cmd->scan_begin_src != TRIG_EXT
 	    && cmd->scan_begin_src != TRIG_FOLLOW)
diff --git a/drivers/staging/comedi/drivers/s626.h b/drivers/staging/comedi/drivers/s626.h
index 1d04922ea16c..d02742a95294 100644
--- a/drivers/staging/comedi/drivers/s626.h
+++ b/drivers/staging/comedi/drivers/s626.h
@@ -76,14 +76,6 @@
 #define FALSE   (0)
 #endif
 
-#if !defined(EXTERN)
-#if defined(__cplusplus)
-#define EXTERN extern "C"
-#else
-#define EXTERN extern
-#endif
-#endif
-
 #if !defined(INLINE)
 #define INLINE static __inline
 #endif
diff --git a/drivers/staging/comedi/drivers/serial2002.c b/drivers/staging/comedi/drivers/serial2002.c
index 82aa86e718b2..db37dcdd98b6 100644
--- a/drivers/staging/comedi/drivers/serial2002.c
+++ b/drivers/staging/comedi/drivers/serial2002.c
@@ -125,14 +125,9 @@ struct serial_data {
 
 static long tty_ioctl(struct file *f, unsigned op, unsigned long param)
 {
-#ifdef HAVE_UNLOCKED_IOCTL
-	if (f->f_op->unlocked_ioctl) {
+	if (f->f_op->unlocked_ioctl)
 		return f->f_op->unlocked_ioctl(f, op, param);
-	}
-#endif
-	if (f->f_op->ioctl) {
-		return f->f_op->ioctl(f->f_dentry->d_inode, f, op, param);
-	}
+
 	return -ENOSYS;
 }
 
@@ -409,8 +404,8 @@ static void serial_2002_open(struct comedi_device *dev)
 	} else {
 		struct config_t {
 
-			int kind;
-			int bits;
+			short int kind;
+			short int bits;
 			int min;
 			int max;
 		};
diff --git a/drivers/staging/comedi/drivers/skel.c b/drivers/staging/comedi/drivers/skel.c
index 3dee62aa2d7b..aba57d93dd3d 100644
--- a/drivers/staging/comedi/drivers/skel.c
+++ b/drivers/staging/comedi/drivers/skel.c
@@ -399,7 +399,7 @@ static int skel_ai_cmdtest(struct comedi_device *dev,
 
 	/* step 2: make sure trigger sources are unique and mutually compatible */
 
-	/* note that mutual compatiblity is not an issue here */
+	/* note that mutual compatibility is not an issue here */
 	if (cmd->scan_begin_src != TRIG_TIMER &&
 	    cmd->scan_begin_src != TRIG_EXT)
 		err++;
diff --git a/drivers/staging/comedi/drivers/usbdux.c b/drivers/staging/comedi/drivers/usbdux.c
index cca4e869f0ec..9a1b559c4b0d 100644
--- a/drivers/staging/comedi/drivers/usbdux.c
+++ b/drivers/staging/comedi/drivers/usbdux.c
@@ -1,4 +1,4 @@
-#define DRIVER_VERSION "v2.2"
+#define DRIVER_VERSION "v2.4"
 #define DRIVER_AUTHOR "Bernd Porr, BerndPorr@f2s.com"
 #define DRIVER_DESC "Stirling/ITL USB-DUX -- Bernd.Porr@f2s.com"
 /*
@@ -80,6 +80,9 @@ sampling rate. If you sample two channels you get 4kHz and so on.
  * 2.0:  PWM seems to be stable and is not interfering with the other functions
  * 2.1:  changed PWM API
  * 2.2:  added firmware kernel request to fix an udev problem
+ * 2.3:  corrected a bug in bulk timeouts which were far too short
+ * 2.4:  fixed a bug which causes the driver to hang when it ran out of data.
+ *       Thanks to Jan-Matthias Braun and Ian to spot the bug and fix it.
  *
  */
 
@@ -101,8 +104,8 @@ sampling rate. If you sample two channels you get 4kHz and so on.
 
 #define BOARDNAME "usbdux"
 
-/* timeout for the USB-transfer */
-#define EZTIMEOUT 30
+/* timeout for the USB-transfer in ms*/
+#define BULK_TIMEOUT 1000
 
 /* constants for "firmware" upload and download */
 #define USBDUXSUB_FIRMWARE 0xA0
@@ -531,6 +534,7 @@ static void usbduxsub_ai_IsocIrq(struct urb *urb)
 		}
 	}
 	/* tell comedi that data is there */
+	s->async->events |= COMEDI_CB_BLOCK | COMEDI_CB_EOS;
 	comedi_event(this_usbduxsub->comedidev, s);
 }
 
@@ -750,7 +754,7 @@ static int usbduxsub_start(struct usbduxsub *usbduxsub)
 				  /* Length */
 				  1,
 				  /* Timeout */
-				  EZTIMEOUT);
+				  BULK_TIMEOUT);
 	if (errcode < 0) {
 		dev_err(&usbduxsub->interface->dev,
 			"comedi_: control msg failed (start)\n");
@@ -780,7 +784,7 @@ static int usbduxsub_stop(struct usbduxsub *usbduxsub)
 				  /* Length */
 				  1,
 				  /* Timeout */
-				  EZTIMEOUT);
+				  BULK_TIMEOUT);
 	if (errcode < 0) {
 		dev_err(&usbduxsub->interface->dev,
 			"comedi_: control msg failed (stop)\n");
@@ -810,7 +814,7 @@ static int usbduxsub_upload(struct usbduxsub *usbduxsub,
 				  /* length */
 				  len,
 				  /* timeout */
-				  EZTIMEOUT);
+				  BULK_TIMEOUT);
 	dev_dbg(&usbduxsub->interface->dev, "comedi_: result=%d\n", errcode);
 	if (errcode < 0) {
 		dev_err(&usbduxsub->interface->dev, "comedi_: upload failed\n");
@@ -979,7 +983,7 @@ static int usbdux_ai_cmdtest(struct comedi_device *dev,
 
 	/*
 	 * step 2: make sure trigger sources are unique and mutually compatible
-	 * note that mutual compatiblity is not an issue here
+	 * note that mutual compatibility is not an issue here
 	 */
 	if (cmd->scan_begin_src != TRIG_FOLLOW &&
 	    cmd->scan_begin_src != TRIG_EXT &&
@@ -1110,7 +1114,7 @@ static int send_dux_commands(struct usbduxsub *this_usbduxsub, int cmd_type)
 			      usb_sndbulkpipe(this_usbduxsub->usbdev,
 					      COMMAND_OUT_EP),
 			      this_usbduxsub->dux_commands, SIZEOFDUXBUFFER,
-			      &nsent, 10);
+			      &nsent, BULK_TIMEOUT);
 	if (result < 0)
 		dev_err(&this_usbduxsub->interface->dev, "comedi%d: "
 			"could not transmit dux_command to the usb-device, "
@@ -1130,7 +1134,7 @@ static int receive_dux_commands(struct usbduxsub *this_usbduxsub, int command)
 				      usb_rcvbulkpipe(this_usbduxsub->usbdev,
 						      COMMAND_IN_EP),
 				      this_usbduxsub->insnBuffer, SIZEINSNBUF,
-				      &nrec, 1);
+				      &nrec, BULK_TIMEOUT);
 		if (result < 0) {
 			dev_err(&this_usbduxsub->interface->dev, "comedi%d: "
 				"insn: USB error %d while receiving DUX command"
@@ -1557,7 +1561,7 @@ static int usbdux_ao_cmdtest(struct comedi_device *dev,
 
 	/*
 	 * step 2: make sure trigger sources are unique and mutually compatible
-	 * note that mutual compatiblity is not an issue here
+	 * note that mutual compatibility is not an issue here
 	 */
 	if (cmd->scan_begin_src != TRIG_FOLLOW &&
 	    cmd->scan_begin_src != TRIG_EXT &&
@@ -2327,9 +2331,11 @@ static void usbdux_firmware_request_complete_handler(const struct firmware *fw,
 	if (ret) {
 		dev_err(&usbdev->dev,
 			"Could not upload firmware (err=%d)\n", ret);
-		return;
+		goto out;
 	}
 	comedi_usb_auto_config(usbdev, BOARDNAME);
+ out:
+	release_firmware(fw);
 }
 
 /* allocate memory for the urbs and initialise them */
@@ -2580,6 +2586,7 @@ static int usbduxsub_probe(struct usb_interface *uinterf,
 				      FW_ACTION_HOTPLUG,
 				      "usbdux_firmware.bin",
 				      &udev->dev,
+				      GFP_KERNEL,
 				      usbduxsub + index,
 				      usbdux_firmware_request_complete_handler);
 
diff --git a/drivers/staging/comedi/drivers/usbduxfast.c b/drivers/staging/comedi/drivers/usbduxfast.c
index d143222579c2..2e675cce7dbf 100644
--- a/drivers/staging/comedi/drivers/usbduxfast.c
+++ b/drivers/staging/comedi/drivers/usbduxfast.c
@@ -1451,10 +1451,12 @@ static void usbduxfast_firmware_request_complete_handler(const struct firmware
 	if (ret) {
 		dev_err(&usbdev->dev,
 			"Could not upload firmware (err=%d)\n", ret);
-		return;
+		goto out;
 	}
 
 	comedi_usb_auto_config(usbdev, BOARDNAME);
+ out:
+	release_firmware(fw);
 }
 
 /*
@@ -1569,6 +1571,7 @@ static int usbduxfastsub_probe(struct usb_interface *uinterf,
 				      FW_ACTION_HOTPLUG,
 				      "usbduxfast_firmware.bin",
 				      &udev->dev,
+				      GFP_KERNEL,
 				      usbduxfastsub + index,
 				      usbduxfast_firmware_request_complete_handler);
 
diff --git a/drivers/staging/comedi/drivers/vmk80xx.c b/drivers/staging/comedi/drivers/vmk80xx.c
index c335040778f0..c34a0b9141e2 100644
--- a/drivers/staging/comedi/drivers/vmk80xx.c
+++ b/drivers/staging/comedi/drivers/vmk80xx.c
@@ -76,18 +76,18 @@ enum {
 };
 
 static struct usb_device_id vmk80xx_id_table[] = {
-	{USB_DEVICE(0x10cf, 0x5500),.driver_info = DEVICE_VMK8055},
-	{USB_DEVICE(0x10cf, 0x5501),.driver_info = DEVICE_VMK8055},
-	{USB_DEVICE(0x10cf, 0x5502),.driver_info = DEVICE_VMK8055},
-	{USB_DEVICE(0x10cf, 0x5503),.driver_info = DEVICE_VMK8055},
-	{USB_DEVICE(0x10cf, 0x8061),.driver_info = DEVICE_VMK8061},
-	{USB_DEVICE(0x10cf, 0x8062),.driver_info = DEVICE_VMK8061},
-	{USB_DEVICE(0x10cf, 0x8063),.driver_info = DEVICE_VMK8061},
-	{USB_DEVICE(0x10cf, 0x8064),.driver_info = DEVICE_VMK8061},
-	{USB_DEVICE(0x10cf, 0x8065),.driver_info = DEVICE_VMK8061},
-	{USB_DEVICE(0x10cf, 0x8066),.driver_info = DEVICE_VMK8061},
-	{USB_DEVICE(0x10cf, 0x8067),.driver_info = DEVICE_VMK8061},
-	{USB_DEVICE(0x10cf, 0x8068),.driver_info = DEVICE_VMK8061},
+	{USB_DEVICE(0x10cf, 0x5500), .driver_info = DEVICE_VMK8055},
+	{USB_DEVICE(0x10cf, 0x5501), .driver_info = DEVICE_VMK8055},
+	{USB_DEVICE(0x10cf, 0x5502), .driver_info = DEVICE_VMK8055},
+	{USB_DEVICE(0x10cf, 0x5503), .driver_info = DEVICE_VMK8055},
+	{USB_DEVICE(0x10cf, 0x8061), .driver_info = DEVICE_VMK8061},
+	{USB_DEVICE(0x10cf, 0x8062), .driver_info = DEVICE_VMK8061},
+	{USB_DEVICE(0x10cf, 0x8063), .driver_info = DEVICE_VMK8061},
+	{USB_DEVICE(0x10cf, 0x8064), .driver_info = DEVICE_VMK8061},
+	{USB_DEVICE(0x10cf, 0x8065), .driver_info = DEVICE_VMK8061},
+	{USB_DEVICE(0x10cf, 0x8066), .driver_info = DEVICE_VMK8061},
+	{USB_DEVICE(0x10cf, 0x8067), .driver_info = DEVICE_VMK8061},
+	{USB_DEVICE(0x10cf, 0x8068), .driver_info = DEVICE_VMK8061},
 	{}			/* terminating entry */
 };
 
diff --git a/drivers/staging/cx25821/cx25821-audups11.c b/drivers/staging/cx25821/cx25821-audups11.c
index f78b8912d905..89c8fe2997fa 100644
--- a/drivers/staging/cx25821/cx25821-audups11.c
+++ b/drivers/staging/cx25821/cx25821-audups11.c
@@ -94,36 +94,20 @@ static struct videobuf_queue_ops cx25821_video_qops = {
 
 static int video_open(struct file *file)
 {
-	int minor = video_devdata(file)->minor;
-	struct cx25821_dev *h, *dev = NULL;
+	struct video_device *vdev = video_devdata(file);
+	struct cx25821_dev *dev = video_drvdata(file);
 	struct cx25821_fh *fh;
-	struct list_head *list;
-	enum v4l2_buf_type type = 0;
+	enum v4l2_buf_type type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
 
-	lock_kernel();
-	list_for_each(list, &cx25821_devlist) {
-		h = list_entry(list, struct cx25821_dev, devlist);
-
-		if (h->video_dev[SRAM_CH11]
-		    && h->video_dev[SRAM_CH11]->minor == minor) {
-			dev = h;
-			type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
-		}
-	}
-
-	if (NULL == dev) {
-		unlock_kernel();
-		return -ENODEV;
-	}
-
-	printk("open minor=%d type=%s\n", minor, v4l2_type_names[type]);
+	printk("open dev=%s type=%s\n", video_device_node_name(vdev),
+		v4l2_type_names[type]);
 
 	/* allocate + initialize per filehandle data */
 	fh = kzalloc(sizeof(*fh), GFP_KERNEL);
-	if (NULL == fh) {
-		unlock_kernel();
+	if (NULL == fh)
 		return -ENOMEM;
-	}
+
+	lock_kernel();
 
 	file->private_data = fh;
 	fh->dev = dev;
@@ -427,7 +411,6 @@ static const struct v4l2_ioctl_ops video_ioctl_ops = {
 struct video_device cx25821_video_template11 = {
 	.name = "cx25821-audioupstream",
 	.fops = &video_fops,
-	.minor = -1,
 	.ioctl_ops = &video_ioctl_ops,
 	.tvnorms = CX25821_NORMS,
 	.current_norm = V4L2_STD_NTSC_M,
diff --git a/drivers/staging/cx25821/cx25821-core.c b/drivers/staging/cx25821/cx25821-core.c
index 8aceae5a072e..67f689de4daa 100644
--- a/drivers/staging/cx25821/cx25821-core.c
+++ b/drivers/staging/cx25821/cx25821-core.c
@@ -1521,7 +1521,7 @@ static struct pci_driver cx25821_pci_driver = {
 	.resume = NULL,
 };
 
-static int cx25821_init(void)
+static int __init cx25821_init(void)
 {
 	INIT_LIST_HEAD(&cx25821_devlist);
 	printk(KERN_INFO "cx25821 driver version %d.%d.%d loaded\n",
@@ -1530,7 +1530,7 @@ static int cx25821_init(void)
 	return pci_register_driver(&cx25821_pci_driver);
 }
 
-static void cx25821_fini(void)
+static void __exit cx25821_fini(void)
 {
 	pci_unregister_driver(&cx25821_pci_driver);
 }
diff --git a/drivers/staging/cx25821/cx25821-medusa-video.c b/drivers/staging/cx25821/cx25821-medusa-video.c
index e4df8134f059..1eb079b3d429 100644
--- a/drivers/staging/cx25821/cx25821-medusa-video.c
+++ b/drivers/staging/cx25821/cx25821-medusa-video.c
@@ -860,10 +860,8 @@ int medusa_video_init(struct cx25821_dev *dev)
 
 	ret_val = medusa_set_videostandard(dev);
 
-	if (ret_val < 0) {
-		mutex_unlock(&dev->lock);
+	if (ret_val < 0)
 		return -EINVAL;
-	}
 
 	return 1;
 }
diff --git a/drivers/staging/cx25821/cx25821-video.c b/drivers/staging/cx25821/cx25821-video.c
index 8834bc80a5ab..c7c14c7698a7 100644
--- a/drivers/staging/cx25821/cx25821-video.c
+++ b/drivers/staging/cx25821/cx25821-video.c
@@ -184,11 +184,11 @@ struct video_device *cx25821_vdev_init(struct cx25821_dev *dev,
 	if (NULL == vfd)
 		return NULL;
 	*vfd = *template;
-	vfd->minor = -1;
 	vfd->v4l2_dev = &dev->v4l2_dev;
 	vfd->release = video_device_release;
 	snprintf(vfd->name, sizeof(vfd->name), "%s %s (%s)", dev->name, type,
 		 cx25821_boards[dev->board].name);
+	video_set_drvdata(vfd, dev);
 	return vfd;
 }
 
@@ -424,7 +424,7 @@ int cx25821_video_irq(struct cx25821_dev *dev, int chan_num, u32 status)
 void cx25821_videoioctl_unregister(struct cx25821_dev *dev)
 {
 	if (dev->ioctl_dev) {
-		if (dev->ioctl_dev->minor != -1)
+		if (video_is_registered(dev->ioctl_dev))
 			video_unregister_device(dev->ioctl_dev);
 		else
 			video_device_release(dev->ioctl_dev);
@@ -438,7 +438,7 @@ void cx25821_video_unregister(struct cx25821_dev *dev, int chan_num)
 	cx_clear(PCI_INT_MSK, 1);
 
 	if (dev->video_dev[chan_num]) {
-		if (-1 != dev->video_dev[chan_num]->minor)
+		if (video_is_registered(dev->video_dev[chan_num]))
 			video_unregister_device(dev->video_dev[chan_num]);
 		else
 			video_device_release(dev->video_dev[chan_num]);
diff --git a/drivers/staging/cx25821/cx25821-video0.c b/drivers/staging/cx25821/cx25821-video0.c
index 950fac1d7003..ad7a69129118 100644
--- a/drivers/staging/cx25821/cx25821-video0.c
+++ b/drivers/staging/cx25821/cx25821-video0.c
@@ -94,37 +94,21 @@ static struct videobuf_queue_ops cx25821_video_qops = {
 
 static int video_open(struct file *file)
 {
-	int minor = video_devdata(file)->minor;
-	struct cx25821_dev *h, *dev = NULL;
+	struct video_device *vdev = video_devdata(file);
+	struct cx25821_dev *dev = video_drvdata(file);
 	struct cx25821_fh *fh;
-	struct list_head *list;
-	enum v4l2_buf_type type = 0;
+	enum v4l2_buf_type type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
 	u32 pix_format;
 
-	lock_kernel();
-	list_for_each(list, &cx25821_devlist) {
-		h = list_entry(list, struct cx25821_dev, devlist);
-
-		if (h->video_dev[SRAM_CH00]
-		    && h->video_dev[SRAM_CH00]->minor == minor) {
-			dev = h;
-			type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
-		}
-	}
-
-	if (NULL == dev) {
-		unlock_kernel();
-		return -ENODEV;
-	}
-
-	printk("open minor=%d type=%s\n", minor, v4l2_type_names[type]);
+	printk("open dev=%s type=%s\n", video_device_node_name(vdev),
+		v4l2_type_names[type]);
 
 	/* allocate + initialize per filehandle data */
 	fh = kzalloc(sizeof(*fh), GFP_KERNEL);
-	if (NULL == fh) {
-		unlock_kernel();
+	if (NULL == fh)
 		return -ENOMEM;
-	}
+
+	lock_kernel();
 
 	file->private_data = fh;
 	fh->dev = dev;
@@ -444,7 +428,6 @@ static const struct v4l2_ioctl_ops video_ioctl_ops = {
 struct video_device cx25821_video_template0 = {
 	.name = "cx25821-video",
 	.fops = &video_fops,
-	.minor = -1,
 	.ioctl_ops = &video_ioctl_ops,
 	.tvnorms = CX25821_NORMS,
 	.current_norm = V4L2_STD_NTSC_M,
diff --git a/drivers/staging/cx25821/cx25821-video1.c b/drivers/staging/cx25821/cx25821-video1.c
index a4dddc684adf..e3f3c4ac7908 100644
--- a/drivers/staging/cx25821/cx25821-video1.c
+++ b/drivers/staging/cx25821/cx25821-video1.c
@@ -94,37 +94,21 @@ static struct videobuf_queue_ops cx25821_video_qops = {
 
 static int video_open(struct file *file)
 {
-	int minor = video_devdata(file)->minor;
-	struct cx25821_dev *h, *dev = NULL;
+	struct video_device *vdev = video_devdata(file);
+	struct cx25821_dev *dev = video_drvdata(file);
 	struct cx25821_fh *fh;
-	struct list_head *list;
-	enum v4l2_buf_type type = 0;
+	enum v4l2_buf_type type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
 	u32 pix_format;
 
-	lock_kernel();
-	list_for_each(list, &cx25821_devlist) {
-		h = list_entry(list, struct cx25821_dev, devlist);
-
-		if (h->video_dev[SRAM_CH01]
-		    && h->video_dev[SRAM_CH01]->minor == minor) {
-			dev = h;
-			type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
-		}
-	}
-
-	if (NULL == dev) {
-		unlock_kernel();
-		return -ENODEV;
-	}
-
-	printk("open minor=%d type=%s\n", minor, v4l2_type_names[type]);
+	printk("open dev=%s type=%s\n", video_device_node_name(vdev),
+		v4l2_type_names[type]);
 
 	/* allocate + initialize per filehandle data */
 	fh = kzalloc(sizeof(*fh), GFP_KERNEL);
-	if (NULL == fh) {
-		unlock_kernel();
+	if (NULL == fh)
 		return -ENOMEM;
-	}
+
+	lock_kernel();
 
 	file->private_data = fh;
 	fh->dev = dev;
@@ -444,7 +428,6 @@ static const struct v4l2_ioctl_ops video_ioctl_ops = {
 struct video_device cx25821_video_template1 = {
 	.name = "cx25821-video",
 	.fops = &video_fops,
-	.minor = -1,
 	.ioctl_ops = &video_ioctl_ops,
 	.tvnorms = CX25821_NORMS,
 	.current_norm = V4L2_STD_NTSC_M,
diff --git a/drivers/staging/cx25821/cx25821-video2.c b/drivers/staging/cx25821/cx25821-video2.c
index 8e04e253f5d9..36fb855a497e 100644
--- a/drivers/staging/cx25821/cx25821-video2.c
+++ b/drivers/staging/cx25821/cx25821-video2.c
@@ -94,37 +94,22 @@ static struct videobuf_queue_ops cx25821_video_qops = {
 
 static int video_open(struct file *file)
 {
-	int minor = video_devdata(file)->minor;
-	struct cx25821_dev *h, *dev = NULL;
+	struct video_device *vdev = video_devdata(file);
+	struct cx25821_dev *dev = video_drvdata(file);
 	struct cx25821_fh *fh;
-	struct list_head *list;
-	enum v4l2_buf_type type = 0;
+	enum v4l2_buf_type type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
 	u32 pix_format;
 
-	lock_kernel();
-	list_for_each(list, &cx25821_devlist) {
-		h = list_entry(list, struct cx25821_dev, devlist);
-
-		if (h->video_dev[SRAM_CH02]
-		    && h->video_dev[SRAM_CH02]->minor == minor) {
-			dev = h;
-			type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
-		}
-	}
-
-	if (NULL == dev) {
-		unlock_kernel();
-		return -ENODEV;
-	}
-
-	printk("open minor=%d type=%s\n", minor, v4l2_type_names[type]);
+	printk("open dev=%s type=%s\n", video_device_node_name(vdev),
+		v4l2_type_names[type]);
 
 	/* allocate + initialize per filehandle data */
 	fh = kzalloc(sizeof(*fh), GFP_KERNEL);
-	if (NULL == fh) {
-		unlock_kernel();
+	if (NULL == fh)
 		return -ENOMEM;
-	}
+
+	lock_kernel();
+
 	file->private_data = fh;
 	fh->dev = dev;
 	fh->type = type;
@@ -445,7 +430,6 @@ static const struct v4l2_ioctl_ops video_ioctl_ops = {
 struct video_device cx25821_video_template2 = {
 	.name = "cx25821-video",
 	.fops = &video_fops,
-	.minor = -1,
 	.ioctl_ops = &video_ioctl_ops,
 	.tvnorms = CX25821_NORMS,
 	.current_norm = V4L2_STD_NTSC_M,
diff --git a/drivers/staging/cx25821/cx25821-video3.c b/drivers/staging/cx25821/cx25821-video3.c
index 8801a8ead904..1e0f10abdbcd 100644
--- a/drivers/staging/cx25821/cx25821-video3.c
+++ b/drivers/staging/cx25821/cx25821-video3.c
@@ -94,37 +94,22 @@ static struct videobuf_queue_ops cx25821_video_qops = {
 
 static int video_open(struct file *file)
 {
-	int minor = video_devdata(file)->minor;
-	struct cx25821_dev *h, *dev = NULL;
+	struct video_device *vdev = video_devdata(file);
+	struct cx25821_dev *dev = video_drvdata(file);
 	struct cx25821_fh *fh;
-	struct list_head *list;
-	enum v4l2_buf_type type = 0;
+	enum v4l2_buf_type type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
 	u32 pix_format;
 
-	lock_kernel();
-	list_for_each(list, &cx25821_devlist) {
-		h = list_entry(list, struct cx25821_dev, devlist);
-
-		if (h->video_dev[SRAM_CH03]
-		    && h->video_dev[SRAM_CH03]->minor == minor) {
-			dev = h;
-			type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
-		}
-	}
-
-	if (NULL == dev) {
-		unlock_kernel();
-		return -ENODEV;
-	}
-
-	printk("open minor=%d type=%s\n", minor, v4l2_type_names[type]);
+	printk("open dev=%s type=%s\n", video_device_node_name(vdev),
+		v4l2_type_names[type]);
 
 	/* allocate + initialize per filehandle data */
 	fh = kzalloc(sizeof(*fh), GFP_KERNEL);
-	if (NULL == fh) {
-		unlock_kernel();
+	if (NULL == fh)
 		return -ENOMEM;
-	}
+
+	lock_kernel();
+
 	file->private_data = fh;
 	fh->dev = dev;
 	fh->type = type;
@@ -444,7 +429,6 @@ static const struct v4l2_ioctl_ops video_ioctl_ops = {
 struct video_device cx25821_video_template3 = {
 	.name = "cx25821-video",
 	.fops = &video_fops,
-	.minor = -1,
 	.ioctl_ops = &video_ioctl_ops,
 	.tvnorms = CX25821_NORMS,
 	.current_norm = V4L2_STD_NTSC_M,
diff --git a/drivers/staging/cx25821/cx25821-video4.c b/drivers/staging/cx25821/cx25821-video4.c
index ab0d747138ad..0cbe7a79d8c0 100644
--- a/drivers/staging/cx25821/cx25821-video4.c
+++ b/drivers/staging/cx25821/cx25821-video4.c
@@ -94,37 +94,22 @@ static struct videobuf_queue_ops cx25821_video_qops = {
 
 static int video_open(struct file *file)
 {
-	int minor = video_devdata(file)->minor;
-	struct cx25821_dev *h, *dev = NULL;
+	struct video_device *vdev = video_devdata(file);
+	struct cx25821_dev *dev = video_drvdata(file);
 	struct cx25821_fh *fh;
-	struct list_head *list;
-	enum v4l2_buf_type type = 0;
+	enum v4l2_buf_type type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
 	u32 pix_format;
 
-	lock_kernel();
-	list_for_each(list, &cx25821_devlist) {
-		h = list_entry(list, struct cx25821_dev, devlist);
-
-		if (h->video_dev[SRAM_CH04]
-		    && h->video_dev[SRAM_CH04]->minor == minor) {
-			dev = h;
-			type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
-		}
-	}
-
-	if (NULL == dev) {
-		unlock_kernel();
-		return -ENODEV;
-	}
-
-	printk("open minor=%d type=%s\n", minor, v4l2_type_names[type]);
+	printk("open dev=%s type=%s\n", video_device_node_name(vdev),
+		v4l2_type_names[type]);
 
 	/* allocate + initialize per filehandle data */
 	fh = kzalloc(sizeof(*fh), GFP_KERNEL);
-	if (NULL == fh) {
-		unlock_kernel();
+	if (NULL == fh)
 		return -ENOMEM;
-	}
+
+	lock_kernel();
+
 	file->private_data = fh;
 	fh->dev = dev;
 	fh->type = type;
@@ -443,7 +428,6 @@ static const struct v4l2_ioctl_ops video_ioctl_ops = {
 struct video_device cx25821_video_template4 = {
 	.name = "cx25821-video",
 	.fops = &video_fops,
-	.minor = -1,
 	.ioctl_ops = &video_ioctl_ops,
 	.tvnorms = CX25821_NORMS,
 	.current_norm = V4L2_STD_NTSC_M,
diff --git a/drivers/staging/cx25821/cx25821-video5.c b/drivers/staging/cx25821/cx25821-video5.c
index 7ef0b971f5cf..5dc08adc12e8 100644
--- a/drivers/staging/cx25821/cx25821-video5.c
+++ b/drivers/staging/cx25821/cx25821-video5.c
@@ -94,37 +94,22 @@ static struct videobuf_queue_ops cx25821_video_qops = {
 
 static int video_open(struct file *file)
 {
-	int minor = video_devdata(file)->minor;
-	struct cx25821_dev *h, *dev = NULL;
+	struct video_device *vdev = video_devdata(file);
+	struct cx25821_dev *dev = video_drvdata(file);
 	struct cx25821_fh *fh;
-	struct list_head *list;
-	enum v4l2_buf_type type = 0;
+	enum v4l2_buf_type type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
 	u32 pix_format;
 
-	lock_kernel();
-	list_for_each(list, &cx25821_devlist) {
-		h = list_entry(list, struct cx25821_dev, devlist);
-
-		if (h->video_dev[SRAM_CH05]
-		    && h->video_dev[SRAM_CH05]->minor == minor) {
-			dev = h;
-			type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
-		}
-	}
-
-	if (NULL == dev) {
-		unlock_kernel();
-		return -ENODEV;
-	}
-
-	printk("open minor=%d type=%s\n", minor, v4l2_type_names[type]);
+	printk("open dev=%s type=%s\n", video_device_node_name(vdev),
+		v4l2_type_names[type]);
 
 	/* allocate + initialize per filehandle data */
 	fh = kzalloc(sizeof(*fh), GFP_KERNEL);
-	if (NULL == fh) {
-		unlock_kernel();
+	if (NULL == fh)
 		return -ENOMEM;
-	}
+
+	lock_kernel();
+
 	file->private_data = fh;
 	fh->dev = dev;
 	fh->type = type;
@@ -443,7 +428,6 @@ static const struct v4l2_ioctl_ops video_ioctl_ops = {
 struct video_device cx25821_video_template5 = {
 	.name = "cx25821-video",
 	.fops = &video_fops,
-	.minor = -1,
 	.ioctl_ops = &video_ioctl_ops,
 	.tvnorms = CX25821_NORMS,
 	.current_norm = V4L2_STD_NTSC_M,
diff --git a/drivers/staging/cx25821/cx25821-video6.c b/drivers/staging/cx25821/cx25821-video6.c
index 3c41b49e2ea9..2938ad3ad3c5 100644
--- a/drivers/staging/cx25821/cx25821-video6.c
+++ b/drivers/staging/cx25821/cx25821-video6.c
@@ -94,37 +94,22 @@ static struct videobuf_queue_ops cx25821_video_qops = {
 
 static int video_open(struct file *file)
 {
-	int minor = video_devdata(file)->minor;
-	struct cx25821_dev *h, *dev = NULL;
+	struct video_device *vdev = video_devdata(file);
+	struct cx25821_dev *dev = video_drvdata(file);
 	struct cx25821_fh *fh;
-	struct list_head *list;
-	enum v4l2_buf_type type = 0;
+	enum v4l2_buf_type type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
 	u32 pix_format;
 
-	lock_kernel();
-	list_for_each(list, &cx25821_devlist) {
-		h = list_entry(list, struct cx25821_dev, devlist);
-
-		if (h->video_dev[SRAM_CH06]
-		    && h->video_dev[SRAM_CH06]->minor == minor) {
-			dev = h;
-			type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
-		}
-	}
-
-	if (NULL == dev) {
-		unlock_kernel();
-		return -ENODEV;
-	}
-
-	printk("open minor=%d type=%s\n", minor, v4l2_type_names[type]);
+	printk("open dev=%s type=%s\n", video_device_node_name(vdev),
+		v4l2_type_names[type]);
 
 	/* allocate + initialize per filehandle data */
 	fh = kzalloc(sizeof(*fh), GFP_KERNEL);
-	if (NULL == fh) {
-		unlock_kernel();
+	if (NULL == fh)
 		return -ENOMEM;
-	}
+
+	lock_kernel();
+
 	file->private_data = fh;
 	fh->dev = dev;
 	fh->type = type;
@@ -443,7 +428,6 @@ static const struct v4l2_ioctl_ops video_ioctl_ops = {
 struct video_device cx25821_video_template6 = {
 	.name = "cx25821-video",
 	.fops = &video_fops,
-	.minor = -1,
 	.ioctl_ops = &video_ioctl_ops,
 	.tvnorms = CX25821_NORMS,
 	.current_norm = V4L2_STD_NTSC_M,
diff --git a/drivers/staging/cx25821/cx25821-video7.c b/drivers/staging/cx25821/cx25821-video7.c
index 625c9b78a9cf..458e525d72af 100644
--- a/drivers/staging/cx25821/cx25821-video7.c
+++ b/drivers/staging/cx25821/cx25821-video7.c
@@ -93,37 +93,22 @@ static struct videobuf_queue_ops cx25821_video_qops = {
 
 static int video_open(struct file *file)
 {
-	int minor = video_devdata(file)->minor;
-	struct cx25821_dev *h, *dev = NULL;
+	struct video_device *vdev = video_devdata(file);
+	struct cx25821_dev *dev = video_drvdata(file);
 	struct cx25821_fh *fh;
-	struct list_head *list;
-	enum v4l2_buf_type type = 0;
+	enum v4l2_buf_type type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
 	u32 pix_format;
 
-	lock_kernel();
-	list_for_each(list, &cx25821_devlist) {
-		h = list_entry(list, struct cx25821_dev, devlist);
-
-		if (h->video_dev[SRAM_CH07]
-		    && h->video_dev[SRAM_CH07]->minor == minor) {
-			dev = h;
-			type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
-		}
-	}
-
-	if (NULL == dev) {
-		unlock_kernel();
-		return -ENODEV;
-	}
-
-	printk("open minor=%d type=%s\n", minor, v4l2_type_names[type]);
+	printk("open dev=%s type=%s\n", video_device_node_name(vdev),
+		v4l2_type_names[type]);
 
 	/* allocate + initialize per filehandle data */
 	fh = kzalloc(sizeof(*fh), GFP_KERNEL);
-	if (NULL == fh) {
-		unlock_kernel();
+	if (NULL == fh)
 		return -ENOMEM;
-	}
+
+	lock_kernel();
+
 	file->private_data = fh;
 	fh->dev = dev;
 	fh->type = type;
@@ -442,7 +427,6 @@ static const struct v4l2_ioctl_ops video_ioctl_ops = {
 struct video_device cx25821_video_template7 = {
 	.name = "cx25821-video",
 	.fops = &video_fops,
-	.minor = -1,
 	.ioctl_ops = &video_ioctl_ops,
 	.tvnorms = CX25821_NORMS,
 	.current_norm = V4L2_STD_NTSC_M,
diff --git a/drivers/staging/cx25821/cx25821-videoioctl.c b/drivers/staging/cx25821/cx25821-videoioctl.c
index 2a312ce78c63..1da52b54a454 100644
--- a/drivers/staging/cx25821/cx25821-videoioctl.c
+++ b/drivers/staging/cx25821/cx25821-videoioctl.c
@@ -94,36 +94,21 @@ static struct videobuf_queue_ops cx25821_video_qops = {
 
 static int video_open(struct file *file)
 {
-	int minor = video_devdata(file)->minor;
-	struct cx25821_dev *h, *dev = NULL;
+	struct video_device *vdev = video_devdata(file);
+	struct cx25821_dev *dev = video_drvdata(file);
 	struct cx25821_fh *fh;
-	struct list_head *list;
-	enum v4l2_buf_type type = 0;
+	enum v4l2_buf_type type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
 	u32 pix_format;
 
-	lock_kernel();
-	list_for_each(list, &cx25821_devlist) {
-		h = list_entry(list, struct cx25821_dev, devlist);
-
-		if (h->ioctl_dev && h->ioctl_dev->minor == minor) {
-			dev = h;
-			type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
-		}
-	}
-
-	if (NULL == dev) {
-		unlock_kernel();
-		return -ENODEV;
-	}
-
-	printk("open minor=%d type=%s\n", minor, v4l2_type_names[type]);
+	printk("open dev=%s type=%s\n", video_device_node_name(vdev),
+		v4l2_type_names[type]);
 
 	/* allocate + initialize per filehandle data */
 	fh = kzalloc(sizeof(*fh), GFP_KERNEL);
-	if (NULL == fh) {
-		unlock_kernel();
+	if (NULL == fh)
 		return -ENOMEM;
-	}
+
+	lock_kernel();
 
 	file->private_data = fh;
 	fh->dev = dev;
@@ -489,7 +474,6 @@ static const struct v4l2_ioctl_ops video_ioctl_ops = {
 struct video_device cx25821_videoioctl_template = {
 	.name = "cx25821-videoioctl",
 	.fops = &video_fops,
-	.minor = -1,
 	.ioctl_ops = &video_ioctl_ops,
 	.tvnorms = CX25821_NORMS,
 	.current_norm = V4L2_STD_NTSC_M,
diff --git a/drivers/staging/cx25821/cx25821-vidups10.c b/drivers/staging/cx25821/cx25821-vidups10.c
index 77b63b060405..b76d9f62c3d1 100644
--- a/drivers/staging/cx25821/cx25821-vidups10.c
+++ b/drivers/staging/cx25821/cx25821-vidups10.c
@@ -94,36 +94,20 @@ static struct videobuf_queue_ops cx25821_video_qops = {
 
 static int video_open(struct file *file)
 {
-	int minor = video_devdata(file)->minor;
-	struct cx25821_dev *h, *dev = NULL;
+	struct video_device *vdev = video_devdata(file);
+	struct cx25821_dev *dev = video_drvdata(file);
 	struct cx25821_fh *fh;
-	struct list_head *list;
-	enum v4l2_buf_type type = 0;
+	enum v4l2_buf_type type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
 
-	lock_kernel();
-	list_for_each(list, &cx25821_devlist) {
-		h = list_entry(list, struct cx25821_dev, devlist);
-
-		if (h->video_dev[SRAM_CH10]
-		    && h->video_dev[SRAM_CH10]->minor == minor) {
-			dev = h;
-			type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
-		}
-	}
-
-	if (NULL == dev) {
-		unlock_kernel();
-		return -ENODEV;
-	}
-
-	printk("open minor=%d type=%s\n", minor, v4l2_type_names[type]);
+	printk("open dev=%s type=%s\n", video_device_node_name(vdev),
+		v4l2_type_names[type]);
 
 	/* allocate + initialize per filehandle data */
 	fh = kzalloc(sizeof(*fh), GFP_KERNEL);
-	if (NULL == fh) {
-		unlock_kernel();
+	if (NULL == fh)
 		return -ENOMEM;
-	}
+
+	lock_kernel();
 
 	file->private_data = fh;
 	fh->dev = dev;
@@ -428,7 +412,6 @@ static const struct v4l2_ioctl_ops video_ioctl_ops = {
 struct video_device cx25821_video_template10 = {
 	.name = "cx25821-upstream10",
 	.fops = &video_fops,
-	.minor = -1,
 	.ioctl_ops = &video_ioctl_ops,
 	.tvnorms = CX25821_NORMS,
 	.current_norm = V4L2_STD_NTSC_M,
diff --git a/drivers/staging/cx25821/cx25821-vidups9.c b/drivers/staging/cx25821/cx25821-vidups9.c
index 75c8c1eed2da..1580da3b29aa 100644
--- a/drivers/staging/cx25821/cx25821-vidups9.c
+++ b/drivers/staging/cx25821/cx25821-vidups9.c
@@ -94,36 +94,20 @@ static struct videobuf_queue_ops cx25821_video_qops = {
 
 static int video_open(struct file *file)
 {
-	int minor = video_devdata(file)->minor;
-	struct cx25821_dev *h, *dev = NULL;
+	struct video_device *vdev = video_devdata(file);
+	struct cx25821_dev *dev = video_drvdata(file);
 	struct cx25821_fh *fh;
-	struct list_head *list;
-	enum v4l2_buf_type type = 0;
+	enum v4l2_buf_type type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
 
-	lock_kernel();
-	list_for_each(list, &cx25821_devlist) {
-		h = list_entry(list, struct cx25821_dev, devlist);
-
-		if (h->video_dev[SRAM_CH09]
-		    && h->video_dev[SRAM_CH09]->minor == minor) {
-			dev = h;
-			type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
-		}
-	}
-
-	if (NULL == dev) {
-		unlock_kernel();
-		return -ENODEV;
-	}
-
-	printk("open minor=%d type=%s\n", minor, v4l2_type_names[type]);
+	printk("open dev=%s type=%s\n", video_device_node_name(vdev),
+		v4l2_type_names[type]);
 
 	/* allocate + initialize per filehandle data */
 	fh = kzalloc(sizeof(*fh), GFP_KERNEL);
-	if (NULL == fh) {
-		unlock_kernel();
+	if (NULL == fh)
 		return -ENOMEM;
-	}
+
+	lock_kernel();
 
 	file->private_data = fh;
 	fh->dev = dev;
@@ -426,7 +410,6 @@ static const struct v4l2_ioctl_ops video_ioctl_ops = {
 struct video_device cx25821_video_template9 = {
 	.name = "cx25821-upstream9",
 	.fops = &video_fops,
-	.minor = -1,
 	.ioctl_ops = &video_ioctl_ops,
 	.tvnorms = CX25821_NORMS,
 	.current_norm = V4L2_STD_NTSC_M,
diff --git a/drivers/staging/dream/Kconfig b/drivers/staging/dream/Kconfig
index 52bd187de5a7..4afa081c870c 100644
--- a/drivers/staging/dream/Kconfig
+++ b/drivers/staging/dream/Kconfig
@@ -1,3 +1,7 @@
+config DREAM
+       tristate "HTC Dream support"
+       depends on BROKEN
+
 source "drivers/staging/dream/smd/Kconfig"
 
 source "drivers/staging/dream/camera/Kconfig"
diff --git a/drivers/staging/dream/TODO b/drivers/staging/dream/TODO
new file mode 100644
index 000000000000..c07c8803f07c
--- /dev/null
+++ b/drivers/staging/dream/TODO
@@ -0,0 +1,14 @@
+* remove support for wakelocks since those are not in mainline
+
+* camera driver uses old V4L API
+
+* coding style in some places is lacking
+
+* gpio_input.c has some features matrix_keypad lacks. They should be
+merged to gpio_input, with gpio_input.c removed
+
+* pmem provides interface for userspace. Needs to be reviewed at least.
+
+* it is probably possible to simplify touchscreen driver using threaded_irq's.
+
+* touchscreen driver should be switched to oficial multitouch API
diff --git a/drivers/staging/dream/camera/msm_camera.c b/drivers/staging/dream/camera/msm_camera.c
index 88165998698c..7d938772eacc 100644
--- a/drivers/staging/dream/camera/msm_camera.c
+++ b/drivers/staging/dream/camera/msm_camera.c
@@ -13,6 +13,7 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/init.h>
+#include <linux/sched.h>
 #include <mach/board.h>
 
 #include <linux/fs.h>
@@ -1597,7 +1598,6 @@ static int __msm_release(struct msm_sync *sync)
 		MSM_DRAIN_QUEUE(sync, pict_frame_q);
 
 		sync->sctrl.s_release();
-		wake_unlock(&sync->wake_lock);
 
 		sync->apps_id = NULL;
 		CDBG("msm_release completed!\n");
@@ -1806,7 +1806,6 @@ static int __msm_open(struct msm_sync *sync, const char *const apps_id)
 	sync->apps_id = apps_id;
 
 	if (!sync->opencnt) {
-		wake_lock(&sync->wake_lock);
 
 		msm_camvfe_fn_init(&sync->vfefn, sync);
 		if (sync->vfefn.vfe_init) {
@@ -2044,8 +2043,6 @@ static int msm_sync_init(struct msm_sync *sync,
 	INIT_LIST_HEAD(&sync->pict_frame_q);
 	init_waitqueue_head(&sync->pict_frame_wait);
 
-	wake_lock_init(&sync->wake_lock, WAKE_LOCK_IDLE, "msm_camera");
-
 	rc = msm_camio_probe_on(pdev);
 	if (rc < 0)
 		return rc;
@@ -2058,7 +2055,6 @@ static int msm_sync_init(struct msm_sync *sync,
 	if (rc < 0) {
 		pr_err("msm_camera: failed to initialize %s\n",
 			sync->sdata->sensor_name);
-		wake_lock_destroy(&sync->wake_lock);
 		return rc;
 	}
 
@@ -2070,7 +2066,6 @@ static int msm_sync_init(struct msm_sync *sync,
 
 static int msm_sync_destroy(struct msm_sync *sync)
 {
-	wake_lock_destroy(&sync->wake_lock);
 	return 0;
 }
 
diff --git a/drivers/staging/dream/camera/msm_vfe7x.c b/drivers/staging/dream/camera/msm_vfe7x.c
index 5de96c5d6352..33ab3ac6ac57 100644
--- a/drivers/staging/dream/camera/msm_vfe7x.c
+++ b/drivers/staging/dream/camera/msm_vfe7x.c
@@ -5,6 +5,7 @@
 #include <linux/msm_adsp.h>
 #include <linux/uaccess.h>
 #include <linux/fs.h>
+#include <linux/sched.h>
 #include <linux/android_pmem.h>
 #include <mach/msm_adsp.h>
 #include <linux/delay.h>
diff --git a/drivers/staging/dream/generic_gpio.c b/drivers/staging/dream/generic_gpio.c
new file mode 100644
index 000000000000..fe24d38345d0
--- /dev/null
+++ b/drivers/staging/dream/generic_gpio.c
@@ -0,0 +1,274 @@
+/* arch/arm/mach-msm/generic_gpio.c
+ *
+ * Copyright (C) 2007 Google, Inc.
+ *
+ * This software is licensed under the terms of the GNU General Public
+ * License version 2, as published by the Free Software Foundation, and
+ * may be copied, distributed, and modified under those terms.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/errno.h>
+#include <linux/slab.h>
+#include <linux/spinlock.h>
+#include <asm/gpio.h>
+#include "gpio_chip.h"
+
+#define GPIO_NUM_TO_CHIP_INDEX(gpio) ((gpio)>>5)
+
+struct gpio_state {
+	unsigned long flags;
+	int refcount;
+};
+
+static DEFINE_SPINLOCK(gpio_chips_lock);
+static LIST_HEAD(gpio_chip_list);
+static struct gpio_chip **gpio_chip_array;
+static unsigned long gpio_chip_array_size;
+
+int register_gpio_chip(struct gpio_chip *new_gpio_chip)
+{
+	int err = 0;
+	struct gpio_chip *gpio_chip;
+	int i;
+	unsigned long irq_flags;
+	unsigned int chip_array_start_index, chip_array_end_index;
+
+	new_gpio_chip->state = kzalloc((new_gpio_chip->end + 1 - new_gpio_chip->start) * sizeof(new_gpio_chip->state[0]), GFP_KERNEL);
+	if (new_gpio_chip->state == NULL) {
+		printk(KERN_ERR "register_gpio_chip: failed to allocate state\n");
+		return -ENOMEM;
+	}
+
+	spin_lock_irqsave(&gpio_chips_lock, irq_flags);
+	chip_array_start_index = GPIO_NUM_TO_CHIP_INDEX(new_gpio_chip->start);
+	chip_array_end_index = GPIO_NUM_TO_CHIP_INDEX(new_gpio_chip->end);
+	if (chip_array_end_index >= gpio_chip_array_size) {
+		struct gpio_chip **new_gpio_chip_array;
+		unsigned long new_gpio_chip_array_size = chip_array_end_index + 1;
+
+		new_gpio_chip_array = kmalloc(new_gpio_chip_array_size * sizeof(new_gpio_chip_array[0]), GFP_ATOMIC);
+		if (new_gpio_chip_array == NULL) {
+			printk(KERN_ERR "register_gpio_chip: failed to allocate array\n");
+			err = -ENOMEM;
+			goto failed;
+		}
+		for (i = 0; i < gpio_chip_array_size; i++)
+			new_gpio_chip_array[i] = gpio_chip_array[i];
+		for (i = gpio_chip_array_size; i < new_gpio_chip_array_size; i++)
+			new_gpio_chip_array[i] = NULL;
+		gpio_chip_array = new_gpio_chip_array;
+		gpio_chip_array_size = new_gpio_chip_array_size;
+	}
+	list_for_each_entry(gpio_chip, &gpio_chip_list, list) {
+		if (gpio_chip->start > new_gpio_chip->end) {
+			list_add_tail(&new_gpio_chip->list, &gpio_chip->list);
+			goto added;
+		}
+		if (gpio_chip->end >= new_gpio_chip->start) {
+			printk(KERN_ERR "register_gpio_source %u-%u overlaps with %u-%u\n",
+			       new_gpio_chip->start, new_gpio_chip->end,
+			       gpio_chip->start, gpio_chip->end);
+			err = -EBUSY;
+			goto failed;
+		}
+	}
+	list_add_tail(&new_gpio_chip->list, &gpio_chip_list);
+added:
+	for (i = chip_array_start_index; i <= chip_array_end_index; i++) {
+		if (gpio_chip_array[i] == NULL || gpio_chip_array[i]->start > new_gpio_chip->start)
+			gpio_chip_array[i] = new_gpio_chip;
+	}
+failed:
+	spin_unlock_irqrestore(&gpio_chips_lock, irq_flags);
+	if (err)
+		kfree(new_gpio_chip->state);
+	return err;
+}
+
+static struct gpio_chip *get_gpio_chip_locked(unsigned int gpio)
+{
+	unsigned long i;
+	struct gpio_chip *chip;
+
+	i = GPIO_NUM_TO_CHIP_INDEX(gpio);
+	if (i >= gpio_chip_array_size)
+		return NULL;
+	chip = gpio_chip_array[i];
+	if (chip == NULL)
+		return NULL;
+	list_for_each_entry_from(chip, &gpio_chip_list, list) {
+		if (gpio < chip->start)
+			return NULL;
+		if (gpio <= chip->end)
+			return chip;
+	}
+	return NULL;
+}
+
+static int request_gpio(unsigned int gpio, unsigned long flags)
+{
+	int err = 0;
+	struct gpio_chip *chip;
+	unsigned long irq_flags;
+	unsigned long chip_index;
+
+	spin_lock_irqsave(&gpio_chips_lock, irq_flags);
+	chip = get_gpio_chip_locked(gpio);
+	if (chip == NULL) {
+		err = -EINVAL;
+		goto err;
+	}
+	chip_index = gpio - chip->start;
+	if (chip->state[chip_index].refcount == 0) {
+		chip->configure(chip, gpio, flags);
+		chip->state[chip_index].flags = flags;
+		chip->state[chip_index].refcount++;
+	} else if ((flags & IRQF_SHARED) && (chip->state[chip_index].flags & IRQF_SHARED))
+		chip->state[chip_index].refcount++;
+	else
+		err = -EBUSY;
+err:
+	spin_unlock_irqrestore(&gpio_chips_lock, irq_flags);
+	return err;
+}
+
+int gpio_request(unsigned gpio, const char *label)
+{
+	return request_gpio(gpio, 0);
+}
+EXPORT_SYMBOL(gpio_request);
+
+void gpio_free(unsigned gpio)
+{
+	struct gpio_chip *chip;
+	unsigned long irq_flags;
+	unsigned long chip_index;
+
+	spin_lock_irqsave(&gpio_chips_lock, irq_flags);
+	chip = get_gpio_chip_locked(gpio);
+	if (chip) {
+		chip_index = gpio - chip->start;
+		chip->state[chip_index].refcount--;
+	}
+	spin_unlock_irqrestore(&gpio_chips_lock, irq_flags);
+}
+EXPORT_SYMBOL(gpio_free);
+
+static int gpio_get_irq_num(unsigned int gpio, unsigned int *irqp, unsigned long *irqnumflagsp)
+{
+	int ret = -ENOTSUPP;
+	struct gpio_chip *chip;
+	unsigned long irq_flags;
+
+	spin_lock_irqsave(&gpio_chips_lock, irq_flags);
+	chip = get_gpio_chip_locked(gpio);
+	if (chip && chip->get_irq_num)
+		ret = chip->get_irq_num(chip, gpio, irqp, irqnumflagsp);
+	spin_unlock_irqrestore(&gpio_chips_lock, irq_flags);
+	return ret;
+}
+
+int gpio_to_irq(unsigned gpio)
+{
+	int ret, irq;
+	ret = gpio_get_irq_num(gpio, &irq, NULL);
+	if (ret)
+		return ret;
+	return irq;
+}
+EXPORT_SYMBOL(gpio_to_irq);
+
+int gpio_configure(unsigned int gpio, unsigned long flags)
+{
+	int ret = -ENOTSUPP;
+	struct gpio_chip *chip;
+	unsigned long irq_flags;
+
+	spin_lock_irqsave(&gpio_chips_lock, irq_flags);
+	chip = get_gpio_chip_locked(gpio);
+	if (chip)
+		ret = chip->configure(chip, gpio, flags);
+	spin_unlock_irqrestore(&gpio_chips_lock, irq_flags);
+	return ret;
+}
+EXPORT_SYMBOL(gpio_configure);
+
+int gpio_direction_input(unsigned gpio)
+{
+	return gpio_configure(gpio, GPIOF_INPUT);
+}
+EXPORT_SYMBOL(gpio_direction_input);
+
+int gpio_direction_output(unsigned gpio, int value)
+{
+	gpio_set_value(gpio, value);
+	return gpio_configure(gpio, GPIOF_DRIVE_OUTPUT);
+}
+EXPORT_SYMBOL(gpio_direction_output);
+
+int gpio_get_value(unsigned gpio)
+{
+	int ret = -ENOTSUPP;
+	struct gpio_chip *chip;
+	unsigned long irq_flags;
+
+	spin_lock_irqsave(&gpio_chips_lock, irq_flags);
+	chip = get_gpio_chip_locked(gpio);
+	if (chip && chip->read)
+		ret = chip->read(chip, gpio);
+	spin_unlock_irqrestore(&gpio_chips_lock, irq_flags);
+	return ret;
+}
+EXPORT_SYMBOL(gpio_get_value);
+
+void gpio_set_value(unsigned gpio, int on)
+{
+	int ret = -ENOTSUPP;
+	struct gpio_chip *chip;
+	unsigned long irq_flags;
+
+	spin_lock_irqsave(&gpio_chips_lock, irq_flags);
+	chip = get_gpio_chip_locked(gpio);
+	if (chip && chip->write)
+		ret = chip->write(chip, gpio, on);
+	spin_unlock_irqrestore(&gpio_chips_lock, irq_flags);
+}
+EXPORT_SYMBOL(gpio_set_value);
+
+int gpio_read_detect_status(unsigned int gpio)
+{
+	int ret = -ENOTSUPP;
+	struct gpio_chip *chip;
+	unsigned long irq_flags;
+
+	spin_lock_irqsave(&gpio_chips_lock, irq_flags);
+	chip = get_gpio_chip_locked(gpio);
+	if (chip && chip->read_detect_status)
+		ret = chip->read_detect_status(chip, gpio);
+	spin_unlock_irqrestore(&gpio_chips_lock, irq_flags);
+	return ret;
+}
+EXPORT_SYMBOL(gpio_read_detect_status);
+
+int gpio_clear_detect_status(unsigned int gpio)
+{
+	int ret = -ENOTSUPP;
+	struct gpio_chip *chip;
+	unsigned long irq_flags;
+
+	spin_lock_irqsave(&gpio_chips_lock, irq_flags);
+	chip = get_gpio_chip_locked(gpio);
+	if (chip && chip->clear_detect_status)
+		ret = chip->clear_detect_status(chip, gpio);
+	spin_unlock_irqrestore(&gpio_chips_lock, irq_flags);
+	return ret;
+}
+EXPORT_SYMBOL(gpio_clear_detect_status);
diff --git a/drivers/staging/dream/gpio_event.c b/drivers/staging/dream/gpio_event.c
index 8b64c1e579ba..e60e2c0db9c0 100644
--- a/drivers/staging/dream/gpio_event.c
+++ b/drivers/staging/dream/gpio_event.c
@@ -13,7 +13,7 @@
  *
  */
 
-#include <linux/earlysuspend.h>
+
 #include <linux/module.h>
 #include <linux/input.h>
 #include <linux/gpio_event.h>
@@ -23,7 +23,6 @@
 struct gpio_event {
 	struct input_dev *input_dev;
 	const struct gpio_event_platform_data *info;
-	struct early_suspend early_suspend;
 	void *state[0];
 };
 
diff --git a/drivers/staging/dream/gpio_input.c b/drivers/staging/dream/gpio_input.c
index 7e307f267a2a..0638ec43601a 100644
--- a/drivers/staging/dream/gpio_input.c
+++ b/drivers/staging/dream/gpio_input.c
@@ -19,7 +19,6 @@
 #include <linux/hrtimer.h>
 #include <linux/input.h>
 #include <linux/interrupt.h>
-#include <linux/wakelock.h>
 
 enum {
 	DEBOUNCE_UNSTABLE     = BIT(0),	/* Got irq, while debouncing */
@@ -44,7 +43,6 @@ struct gpio_input_state {
 	int use_irq;
 	int debounce_count;
 	spinlock_t irq_lock;
-	struct wake_lock wake_lock;
 	struct gpio_key_state key_state[0];
 };
 
@@ -143,8 +141,6 @@ static enum hrtimer_restart gpio_event_input_timer_func(struct hrtimer *timer)
 		hrtimer_start(timer, ds->info->debounce_time, HRTIMER_MODE_REL);
 	else if (!ds->use_irq)
 		hrtimer_start(timer, ds->info->poll_time, HRTIMER_MODE_REL);
-	else
-		wake_unlock(&ds->wake_lock);
 
 	spin_unlock_irqrestore(&ds->irq_lock, irqflags);
 
@@ -170,7 +166,6 @@ static irqreturn_t gpio_event_input_irq_handler(int irq, void *dev_id)
 		if (ks->debounce & DEBOUNCE_WAIT_IRQ) {
 			ks->debounce = DEBOUNCE_UNKNOWN;
 			if (ds->debounce_count++ == 0) {
-				wake_lock(&ds->wake_lock);
 				hrtimer_start(
 					&ds->timer, ds->info->debounce_time,
 					HRTIMER_MODE_REL);
@@ -277,7 +272,6 @@ int gpio_event_input_func(struct input_dev *input_dev,
 		ds->debounce_count = di->keymap_size;
 		ds->input_dev = input_dev;
 		ds->info = di;
-		wake_lock_init(&ds->wake_lock, WAKE_LOCK_SUSPEND, "gpio_input");
 		spin_lock_init(&ds->irq_lock);
 
 		for (i = 0; i < di->keymap_size; i++) {
@@ -336,7 +330,6 @@ err_gpio_configure_failed:
 err_gpio_request_failed:
 		;
 	}
-	wake_lock_destroy(&ds->wake_lock);
 	kfree(ds);
 err_ds_alloc_failed:
 	return ret;
diff --git a/drivers/staging/dream/gpio_matrix.c b/drivers/staging/dream/gpio_matrix.c
index c1f47651a493..796de4faf859 100644
--- a/drivers/staging/dream/gpio_matrix.c
+++ b/drivers/staging/dream/gpio_matrix.c
@@ -18,13 +18,11 @@
 #include <linux/gpio_event.h>
 #include <linux/hrtimer.h>
 #include <linux/interrupt.h>
-#include <linux/wakelock.h>
 
 struct gpio_kp {
 	struct input_dev *input_dev;
 	struct gpio_event_matrix_info *keypad_info;
 	struct hrtimer timer;
-	struct wake_lock wake_lock;
 	int current_output;
 	unsigned int use_irq:1;
 	unsigned int key_state_changed:1;
@@ -199,7 +197,6 @@ static enum hrtimer_restart gpio_keypad_timer_func(struct hrtimer *timer)
 	}
 	for (in = 0; in < mi->ninputs; in++)
 		enable_irq(gpio_to_irq(mi->input_gpios[in]));
-	wake_unlock(&kp->wake_lock);
 	return HRTIMER_NORESTART;
 }
 
@@ -222,7 +219,6 @@ static irqreturn_t gpio_keypad_irq_handler(int irq_in, void *dev_id)
 		else
 			gpio_direction_input(mi->output_gpios[i]);
 	}
-	wake_lock(&kp->wake_lock);
 	hrtimer_start(&kp->timer, ktime_set(0, 0), HRTIMER_MODE_REL);
 	return IRQ_HANDLED;
 }
@@ -363,7 +359,6 @@ int gpio_event_matrix_func(struct input_dev *input_dev,
 
 		hrtimer_init(&kp->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
 		kp->timer.function = gpio_keypad_timer_func;
-		wake_lock_init(&kp->wake_lock, WAKE_LOCK_SUSPEND, "gpio_kp");
 		err = gpio_keypad_request_irqs(kp);
 		kp->use_irq = err == 0;
 
@@ -371,8 +366,6 @@ int gpio_event_matrix_func(struct input_dev *input_dev,
 			"in %s mode\n", input_dev->name,
 			kp->use_irq ? "interrupt" : "polling");
 
-		if (kp->use_irq)
-			wake_lock(&kp->wake_lock);
 		hrtimer_start(&kp->timer, ktime_set(0, 0), HRTIMER_MODE_REL);
 
 		return 0;
@@ -386,7 +379,6 @@ int gpio_event_matrix_func(struct input_dev *input_dev,
 			free_irq(gpio_to_irq(mi->input_gpios[i]), kp);
 
 	hrtimer_cancel(&kp->timer);
-	wake_lock_destroy(&kp->wake_lock);
 	for (i = mi->noutputs - 1; i >= 0; i--) {
 err_gpio_direction_input_failed:
 		gpio_free(mi->input_gpios[i]);
diff --git a/drivers/staging/dream/pmem.c b/drivers/staging/dream/pmem.c
new file mode 100644
index 000000000000..def646812348
--- /dev/null
+++ b/drivers/staging/dream/pmem.c
@@ -0,0 +1,1335 @@
+/* drivers/android/pmem.c
+ *
+ * Copyright (C) 2007 Google, Inc.
+ *
+ * This software is licensed under the terms of the GNU General Public
+ * License version 2, as published by the Free Software Foundation, and
+ * may be copied, distributed, and modified under those terms.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ */
+
+#include <linux/miscdevice.h>
+#include <linux/platform_device.h>
+#include <linux/fs.h>
+#include <linux/file.h>
+#include <linux/mm.h>
+#include <linux/list.h>
+#include <linux/debugfs.h>
+#include <linux/android_pmem.h>
+#include <linux/mempolicy.h>
+#include <linux/sched.h>
+#include <asm/io.h>
+#include <asm/uaccess.h>
+#include <asm/cacheflush.h>
+
+#define PMEM_MAX_DEVICES 10
+#define PMEM_MAX_ORDER 128
+#define PMEM_MIN_ALLOC PAGE_SIZE
+
+#define PMEM_DEBUG 1
+
+/* indicates that a refernce to this file has been taken via get_pmem_file,
+ * the file should not be released until put_pmem_file is called */
+#define PMEM_FLAGS_BUSY 0x1
+/* indicates that this is a suballocation of a larger master range */
+#define PMEM_FLAGS_CONNECTED 0x1 << 1
+/* indicates this is a master and not a sub allocation and that it is mmaped */
+#define PMEM_FLAGS_MASTERMAP 0x1 << 2
+/* submap and unsubmap flags indicate:
+ * 00: subregion has never been mmaped
+ * 10: subregion has been mmaped, reference to the mm was taken
+ * 11: subretion has ben released, refernece to the mm still held
+ * 01: subretion has been released, reference to the mm has been released
+ */
+#define PMEM_FLAGS_SUBMAP 0x1 << 3
+#define PMEM_FLAGS_UNSUBMAP 0x1 << 4
+
+
+struct pmem_data {
+	/* in alloc mode: an index into the bitmap
+	 * in no_alloc mode: the size of the allocation */
+	int index;
+	/* see flags above for descriptions */
+	unsigned int flags;
+	/* protects this data field, if the mm_mmap sem will be held at the
+	 * same time as this sem, the mm sem must be taken first (as this is
+	 * the order for vma_open and vma_close ops */
+	struct rw_semaphore sem;
+	/* info about the mmaping process */
+	struct vm_area_struct *vma;
+	/* task struct of the mapping process */
+	struct task_struct *task;
+	/* process id of teh mapping process */
+	pid_t pid;
+	/* file descriptor of the master */
+	int master_fd;
+	/* file struct of the master */
+	struct file *master_file;
+	/* a list of currently available regions if this is a suballocation */
+	struct list_head region_list;
+	/* a linked list of data so we can access them for debugging */
+	struct list_head list;
+#if PMEM_DEBUG
+	int ref;
+#endif
+};
+
+struct pmem_bits {
+	unsigned allocated:1;		/* 1 if allocated, 0 if free */
+	unsigned order:7;		/* size of the region in pmem space */
+};
+
+struct pmem_region_node {
+	struct pmem_region region;
+	struct list_head list;
+};
+
+#define PMEM_DEBUG_MSGS 0
+#if PMEM_DEBUG_MSGS
+#define DLOG(fmt,args...) \
+	do { printk(KERN_INFO "[%s:%s:%d] "fmt, __FILE__, __func__, __LINE__, \
+		    ##args); } \
+	while (0)
+#else
+#define DLOG(x...) do {} while (0)
+#endif
+
+struct pmem_info {
+	struct miscdevice dev;
+	/* physical start address of the remaped pmem space */
+	unsigned long base;
+	/* vitual start address of the remaped pmem space */
+	unsigned char __iomem *vbase;
+	/* total size of the pmem space */
+	unsigned long size;
+	/* number of entries in the pmem space */
+	unsigned long num_entries;
+	/* pfn of the garbage page in memory */
+	unsigned long garbage_pfn;
+	/* index of the garbage page in the pmem space */
+	int garbage_index;
+	/* the bitmap for the region indicating which entries are allocated
+	 * and which are free */
+	struct pmem_bits *bitmap;
+	/* indicates the region should not be managed with an allocator */
+	unsigned no_allocator;
+	/* indicates maps of this region should be cached, if a mix of
+	 * cached and uncached is desired, set this and open the device with
+	 * O_SYNC to get an uncached region */
+	unsigned cached;
+	unsigned buffered;
+	/* in no_allocator mode the first mapper gets the whole space and sets
+	 * this flag */
+	unsigned allocated;
+	/* for debugging, creates a list of pmem file structs, the
+	 * data_list_sem should be taken before pmem_data->sem if both are
+	 * needed */
+	struct semaphore data_list_sem;
+	struct list_head data_list;
+	/* pmem_sem protects the bitmap array
+	 * a write lock should be held when modifying entries in bitmap
+	 * a read lock should be held when reading data from bits or
+	 * dereferencing a pointer into bitmap
+	 *
+	 * pmem_data->sem protects the pmem data of a particular file
+	 * Many of the function that require the pmem_data->sem have a non-
+	 * locking version for when the caller is already holding that sem.
+	 *
+	 * IF YOU TAKE BOTH LOCKS TAKE THEM IN THIS ORDER:
+	 * down(pmem_data->sem) => down(bitmap_sem)
+	 */
+	struct rw_semaphore bitmap_sem;
+
+	long (*ioctl)(struct file *, unsigned int, unsigned long);
+	int (*release)(struct inode *, struct file *);
+};
+
+static struct pmem_info pmem[PMEM_MAX_DEVICES];
+static int id_count;
+
+#define PMEM_IS_FREE(id, index) !(pmem[id].bitmap[index].allocated)
+#define PMEM_ORDER(id, index) pmem[id].bitmap[index].order
+#define PMEM_BUDDY_INDEX(id, index) (index ^ (1 << PMEM_ORDER(id, index)))
+#define PMEM_NEXT_INDEX(id, index) (index + (1 << PMEM_ORDER(id, index)))
+#define PMEM_OFFSET(index) (index * PMEM_MIN_ALLOC)
+#define PMEM_START_ADDR(id, index) (PMEM_OFFSET(index) + pmem[id].base)
+#define PMEM_LEN(id, index) ((1 << PMEM_ORDER(id, index)) * PMEM_MIN_ALLOC)
+#define PMEM_END_ADDR(id, index) (PMEM_START_ADDR(id, index) + \
+	PMEM_LEN(id, index))
+#define PMEM_START_VADDR(id, index) (PMEM_OFFSET(id, index) + pmem[id].vbase)
+#define PMEM_END_VADDR(id, index) (PMEM_START_VADDR(id, index) + \
+	PMEM_LEN(id, index))
+#define PMEM_REVOKED(data) (data->flags & PMEM_FLAGS_REVOKED)
+#define PMEM_IS_PAGE_ALIGNED(addr) (!((addr) & (~PAGE_MASK)))
+#define PMEM_IS_SUBMAP(data) ((data->flags & PMEM_FLAGS_SUBMAP) && \
+	(!(data->flags & PMEM_FLAGS_UNSUBMAP)))
+
+static int pmem_release(struct inode *, struct file *);
+static int pmem_mmap(struct file *, struct vm_area_struct *);
+static int pmem_open(struct inode *, struct file *);
+static long pmem_ioctl(struct file *, unsigned int, unsigned long);
+
+struct file_operations pmem_fops = {
+	.release = pmem_release,
+	.mmap = pmem_mmap,
+	.open = pmem_open,
+	.unlocked_ioctl = pmem_ioctl,
+};
+
+static int get_id(struct file *file)
+{
+	return MINOR(file->f_dentry->d_inode->i_rdev);
+}
+
+static int is_pmem_file(struct file *file)
+{
+	int id;
+
+	if (unlikely(!file || !file->f_dentry || !file->f_dentry->d_inode))
+		return 0;
+	id = get_id(file);
+	if (unlikely(id >= PMEM_MAX_DEVICES))
+		return 0;
+	if (unlikely(file->f_dentry->d_inode->i_rdev !=
+	     MKDEV(MISC_MAJOR, pmem[id].dev.minor)))
+		return 0;
+	return 1;
+}
+
+static int has_allocation(struct file *file)
+{
+	struct pmem_data *data;
+	/* check is_pmem_file first if not accessed via pmem_file_ops */
+
+	if (unlikely(!file->private_data))
+		return 0;
+	data = (struct pmem_data *)file->private_data;
+	if (unlikely(data->index < 0))
+		return 0;
+	return 1;
+}
+
+static int is_master_owner(struct file *file)
+{
+	struct file *master_file;
+	struct pmem_data *data;
+	int put_needed, ret = 0;
+
+	if (!is_pmem_file(file) || !has_allocation(file))
+		return 0;
+	data = (struct pmem_data *)file->private_data;
+	if (PMEM_FLAGS_MASTERMAP & data->flags)
+		return 1;
+	master_file = fget_light(data->master_fd, &put_needed);
+	if (master_file && data->master_file == master_file)
+		ret = 1;
+	fput_light(master_file, put_needed);
+	return ret;
+}
+
+static int pmem_free(int id, int index)
+{
+	/* caller should hold the write lock on pmem_sem! */
+	int buddy, curr = index;
+	DLOG("index %d\n", index);
+
+	if (pmem[id].no_allocator) {
+		pmem[id].allocated = 0;
+		return 0;
+	}
+	/* clean up the bitmap, merging any buddies */
+	pmem[id].bitmap[curr].allocated = 0;
+	/* find a slots buddy Buddy# = Slot# ^ (1 << order)
+	 * if the buddy is also free merge them
+	 * repeat until the buddy is not free or end of the bitmap is reached
+	 */
+	do {
+		buddy = PMEM_BUDDY_INDEX(id, curr);
+		if (PMEM_IS_FREE(id, buddy) &&
+				PMEM_ORDER(id, buddy) == PMEM_ORDER(id, curr)) {
+			PMEM_ORDER(id, buddy)++;
+			PMEM_ORDER(id, curr)++;
+			curr = min(buddy, curr);
+		} else {
+			break;
+		}
+	} while (curr < pmem[id].num_entries);
+
+	return 0;
+}
+
+static void pmem_revoke(struct file *file, struct pmem_data *data);
+
+static int pmem_release(struct inode *inode, struct file *file)
+{
+	struct pmem_data *data = (struct pmem_data *)file->private_data;
+	struct pmem_region_node *region_node;
+	struct list_head *elt, *elt2;
+	int id = get_id(file), ret = 0;
+
+
+	down(&pmem[id].data_list_sem);
+	/* if this file is a master, revoke all the memory in the connected
+	 *  files */
+	if (PMEM_FLAGS_MASTERMAP & data->flags) {
+		struct pmem_data *sub_data;
+		list_for_each(elt, &pmem[id].data_list) {
+			sub_data = list_entry(elt, struct pmem_data, list);
+			down_read(&sub_data->sem);
+			if (PMEM_IS_SUBMAP(sub_data) &&
+			    file == sub_data->master_file) {
+				up_read(&sub_data->sem);
+				pmem_revoke(file, sub_data);
+			}  else
+				up_read(&sub_data->sem);
+		}
+	}
+	list_del(&data->list);
+	up(&pmem[id].data_list_sem);
+
+
+	down_write(&data->sem);
+
+	/* if its not a conencted file and it has an allocation, free it */
+	if (!(PMEM_FLAGS_CONNECTED & data->flags) && has_allocation(file)) {
+		down_write(&pmem[id].bitmap_sem);
+		ret = pmem_free(id, data->index);
+		up_write(&pmem[id].bitmap_sem);
+	}
+
+	/* if this file is a submap (mapped, connected file), downref the
+	 * task struct */
+	if (PMEM_FLAGS_SUBMAP & data->flags)
+		if (data->task) {
+			put_task_struct(data->task);
+			data->task = NULL;
+		}
+
+	file->private_data = NULL;
+
+	list_for_each_safe(elt, elt2, &data->region_list) {
+		region_node = list_entry(elt, struct pmem_region_node, list);
+		list_del(elt);
+		kfree(region_node);
+	}
+	BUG_ON(!list_empty(&data->region_list));
+
+	up_write(&data->sem);
+	kfree(data);
+	if (pmem[id].release)
+		ret = pmem[id].release(inode, file);
+
+	return ret;
+}
+
+static int pmem_open(struct inode *inode, struct file *file)
+{
+	struct pmem_data *data;
+	int id = get_id(file);
+	int ret = 0;
+
+	DLOG("current %u file %p(%d)\n", current->pid, file, file_count(file));
+	/* setup file->private_data to indicate its unmapped */
+	/*  you can only open a pmem device one time */
+	if (file->private_data != NULL)
+		return -1;
+	data = kmalloc(sizeof(struct pmem_data), GFP_KERNEL);
+	if (!data) {
+		printk("pmem: unable to allocate memory for pmem metadata.");
+		return -1;
+	}
+	data->flags = 0;
+	data->index = -1;
+	data->task = NULL;
+	data->vma = NULL;
+	data->pid = 0;
+	data->master_file = NULL;
+#if PMEM_DEBUG
+	data->ref = 0;
+#endif
+	INIT_LIST_HEAD(&data->region_list);
+	init_rwsem(&data->sem);
+
+	file->private_data = data;
+	INIT_LIST_HEAD(&data->list);
+
+	down(&pmem[id].data_list_sem);
+	list_add(&data->list, &pmem[id].data_list);
+	up(&pmem[id].data_list_sem);
+	return ret;
+}
+
+static unsigned long pmem_order(unsigned long len)
+{
+	int i;
+
+	len = (len + PMEM_MIN_ALLOC - 1)/PMEM_MIN_ALLOC;
+	len--;
+	for (i = 0; i < sizeof(len)*8; i++)
+		if (len >> i == 0)
+			break;
+	return i;
+}
+
+static int pmem_allocate(int id, unsigned long len)
+{
+	/* caller should hold the write lock on pmem_sem! */
+	/* return the corresponding pdata[] entry */
+	int curr = 0;
+	int end = pmem[id].num_entries;
+	int best_fit = -1;
+	unsigned long order = pmem_order(len);
+
+	if (pmem[id].no_allocator) {
+		DLOG("no allocator");
+		if ((len > pmem[id].size) || pmem[id].allocated)
+			return -1;
+		pmem[id].allocated = 1;
+		return len;
+	}
+
+	if (order > PMEM_MAX_ORDER)
+		return -1;
+	DLOG("order %lx\n", order);
+
+	/* look through the bitmap:
+	 * 	if you find a free slot of the correct order use it
+	 * 	otherwise, use the best fit (smallest with size > order) slot
+	 */
+	while (curr < end) {
+		if (PMEM_IS_FREE(id, curr)) {
+			if (PMEM_ORDER(id, curr) == (unsigned char)order) {
+				/* set the not free bit and clear others */
+				best_fit = curr;
+				break;
+			}
+			if (PMEM_ORDER(id, curr) > (unsigned char)order &&
+			    (best_fit < 0 ||
+			     PMEM_ORDER(id, curr) < PMEM_ORDER(id, best_fit)))
+				best_fit = curr;
+		}
+		curr = PMEM_NEXT_INDEX(id, curr);
+	}
+
+	/* if best_fit < 0, there are no suitable slots,
+	 * return an error
+	 */
+	if (best_fit < 0) {
+		printk("pmem: no space left to allocate!\n");
+		return -1;
+	}
+
+	/* now partition the best fit:
+	 * 	split the slot into 2 buddies of order - 1
+	 * 	repeat until the slot is of the correct order
+	 */
+	while (PMEM_ORDER(id, best_fit) > (unsigned char)order) {
+		int buddy;
+		PMEM_ORDER(id, best_fit) -= 1;
+		buddy = PMEM_BUDDY_INDEX(id, best_fit);
+		PMEM_ORDER(id, buddy) = PMEM_ORDER(id, best_fit);
+	}
+	pmem[id].bitmap[best_fit].allocated = 1;
+	return best_fit;
+}
+
+static pgprot_t phys_mem_access_prot(struct file *file, pgprot_t vma_prot)
+{
+	int id = get_id(file);
+#ifdef pgprot_noncached
+	if (pmem[id].cached == 0 || file->f_flags & O_SYNC)
+		return pgprot_noncached(vma_prot);
+#endif
+#ifdef pgprot_ext_buffered
+	else if (pmem[id].buffered)
+		return pgprot_ext_buffered(vma_prot);
+#endif
+	return vma_prot;
+}
+
+static unsigned long pmem_start_addr(int id, struct pmem_data *data)
+{
+	if (pmem[id].no_allocator)
+		return PMEM_START_ADDR(id, 0);
+	else
+		return PMEM_START_ADDR(id, data->index);
+
+}
+
+static void *pmem_start_vaddr(int id, struct pmem_data *data)
+{
+	return pmem_start_addr(id, data) - pmem[id].base + pmem[id].vbase;
+}
+
+static unsigned long pmem_len(int id, struct pmem_data *data)
+{
+	if (pmem[id].no_allocator)
+		return data->index;
+	else
+		return PMEM_LEN(id, data->index);
+}
+
+static int pmem_map_garbage(int id, struct vm_area_struct *vma,
+			    struct pmem_data *data, unsigned long offset,
+			    unsigned long len)
+{
+	int i, garbage_pages = len >> PAGE_SHIFT;
+
+	vma->vm_flags |= VM_IO | VM_RESERVED | VM_PFNMAP | VM_SHARED | VM_WRITE;
+	for (i = 0; i < garbage_pages; i++) {
+		if (vm_insert_pfn(vma, vma->vm_start + offset + (i * PAGE_SIZE),
+		    pmem[id].garbage_pfn))
+			return -EAGAIN;
+	}
+	return 0;
+}
+
+static int pmem_unmap_pfn_range(int id, struct vm_area_struct *vma,
+				struct pmem_data *data, unsigned long offset,
+				unsigned long len)
+{
+	int garbage_pages;
+	DLOG("unmap offset %lx len %lx\n", offset, len);
+
+	BUG_ON(!PMEM_IS_PAGE_ALIGNED(len));
+
+	garbage_pages = len >> PAGE_SHIFT;
+	zap_page_range(vma, vma->vm_start + offset, len, NULL);
+	pmem_map_garbage(id, vma, data, offset, len);
+	return 0;
+}
+
+static int pmem_map_pfn_range(int id, struct vm_area_struct *vma,
+			      struct pmem_data *data, unsigned long offset,
+			      unsigned long len)
+{
+	DLOG("map offset %lx len %lx\n", offset, len);
+	BUG_ON(!PMEM_IS_PAGE_ALIGNED(vma->vm_start));
+	BUG_ON(!PMEM_IS_PAGE_ALIGNED(vma->vm_end));
+	BUG_ON(!PMEM_IS_PAGE_ALIGNED(len));
+	BUG_ON(!PMEM_IS_PAGE_ALIGNED(offset));
+
+	if (io_remap_pfn_range(vma, vma->vm_start + offset,
+		(pmem_start_addr(id, data) + offset) >> PAGE_SHIFT,
+		len, vma->vm_page_prot)) {
+		return -EAGAIN;
+	}
+	return 0;
+}
+
+static int pmem_remap_pfn_range(int id, struct vm_area_struct *vma,
+			      struct pmem_data *data, unsigned long offset,
+			      unsigned long len)
+{
+	/* hold the mm semp for the vma you are modifying when you call this */
+	BUG_ON(!vma);
+	zap_page_range(vma, vma->vm_start + offset, len, NULL);
+	return pmem_map_pfn_range(id, vma, data, offset, len);
+}
+
+static void pmem_vma_open(struct vm_area_struct *vma)
+{
+	struct file *file = vma->vm_file;
+	struct pmem_data *data = file->private_data;
+	int id = get_id(file);
+	/* this should never be called as we don't support copying pmem
+	 * ranges via fork */
+	BUG_ON(!has_allocation(file));
+	down_write(&data->sem);
+	/* remap the garbage pages, forkers don't get access to the data */
+	pmem_unmap_pfn_range(id, vma, data, 0, vma->vm_start - vma->vm_end);
+	up_write(&data->sem);
+}
+
+static void pmem_vma_close(struct vm_area_struct *vma)
+{
+	struct file *file = vma->vm_file;
+	struct pmem_data *data = file->private_data;
+
+	DLOG("current %u ppid %u file %p count %d\n", current->pid,
+	     current->parent->pid, file, file_count(file));
+	if (unlikely(!is_pmem_file(file) || !has_allocation(file))) {
+		printk(KERN_WARNING "pmem: something is very wrong, you are "
+		       "closing a vm backing an allocation that doesn't "
+		       "exist!\n");
+		return;
+	}
+	down_write(&data->sem);
+	if (data->vma == vma) {
+		data->vma = NULL;
+		if ((data->flags & PMEM_FLAGS_CONNECTED) &&
+		    (data->flags & PMEM_FLAGS_SUBMAP))
+			data->flags |= PMEM_FLAGS_UNSUBMAP;
+	}
+	/* the kernel is going to free this vma now anyway */
+	up_write(&data->sem);
+}
+
+static struct vm_operations_struct vm_ops = {
+	.open = pmem_vma_open,
+	.close = pmem_vma_close,
+};
+
+static int pmem_mmap(struct file *file, struct vm_area_struct *vma)
+{
+	struct pmem_data *data;
+	int index;
+	unsigned long vma_size =  vma->vm_end - vma->vm_start;
+	int ret = 0, id = get_id(file);
+
+	if (vma->vm_pgoff || !PMEM_IS_PAGE_ALIGNED(vma_size)) {
+#if PMEM_DEBUG
+		printk(KERN_ERR "pmem: mmaps must be at offset zero, aligned"
+				" and a multiple of pages_size.\n");
+#endif
+		return -EINVAL;
+	}
+
+	data = (struct pmem_data *)file->private_data;
+	down_write(&data->sem);
+	/* check this file isn't already mmaped, for submaps check this file
+	 * has never been mmaped */
+	if ((data->flags & PMEM_FLAGS_MASTERMAP) ||
+	    (data->flags & PMEM_FLAGS_SUBMAP) ||
+	    (data->flags & PMEM_FLAGS_UNSUBMAP)) {
+#if PMEM_DEBUG
+		printk(KERN_ERR "pmem: you can only mmap a pmem file once, "
+		       "this file is already mmaped. %x\n", data->flags);
+#endif
+		ret = -EINVAL;
+		goto error;
+	}
+	/* if file->private_data == unalloced, alloc*/
+	if (data && data->index == -1) {
+		down_write(&pmem[id].bitmap_sem);
+		index = pmem_allocate(id, vma->vm_end - vma->vm_start);
+		up_write(&pmem[id].bitmap_sem);
+		data->index = index;
+	}
+	/* either no space was available or an error occured */
+	if (!has_allocation(file)) {
+		ret = -EINVAL;
+		printk("pmem: could not find allocation for map.\n");
+		goto error;
+	}
+
+	if (pmem_len(id, data) < vma_size) {
+#if PMEM_DEBUG
+		printk(KERN_WARNING "pmem: mmap size [%lu] does not match"
+		       "size of backing region [%lu].\n", vma_size,
+		       pmem_len(id, data));
+#endif
+		ret = -EINVAL;
+		goto error;
+	}
+
+	vma->vm_pgoff = pmem_start_addr(id, data) >> PAGE_SHIFT;
+	vma->vm_page_prot = phys_mem_access_prot(file, vma->vm_page_prot);
+
+	if (data->flags & PMEM_FLAGS_CONNECTED) {
+		struct pmem_region_node *region_node;
+		struct list_head *elt;
+		if (pmem_map_garbage(id, vma, data, 0, vma_size)) {
+			printk("pmem: mmap failed in kernel!\n");
+			ret = -EAGAIN;
+			goto error;
+		}
+		list_for_each(elt, &data->region_list) {
+			region_node = list_entry(elt, struct pmem_region_node,
+						 list);
+			DLOG("remapping file: %p %lx %lx\n", file,
+				region_node->region.offset,
+				region_node->region.len);
+			if (pmem_remap_pfn_range(id, vma, data,
+						 region_node->region.offset,
+						 region_node->region.len)) {
+				ret = -EAGAIN;
+				goto error;
+			}
+		}
+		data->flags |= PMEM_FLAGS_SUBMAP;
+		get_task_struct(current->group_leader);
+		data->task = current->group_leader;
+		data->vma = vma;
+#if PMEM_DEBUG
+		data->pid = current->pid;
+#endif
+		DLOG("submmapped file %p vma %p pid %u\n", file, vma,
+		     current->pid);
+	} else {
+		if (pmem_map_pfn_range(id, vma, data, 0, vma_size)) {
+			printk(KERN_INFO "pmem: mmap failed in kernel!\n");
+			ret = -EAGAIN;
+			goto error;
+		}
+		data->flags |= PMEM_FLAGS_MASTERMAP;
+		data->pid = current->pid;
+	}
+	vma->vm_ops = &vm_ops;
+error:
+	up_write(&data->sem);
+	return ret;
+}
+
+/* the following are the api for accessing pmem regions by other drivers
+ * from inside the kernel */
+int get_pmem_user_addr(struct file *file, unsigned long *start,
+		   unsigned long *len)
+{
+	struct pmem_data *data;
+	if (!is_pmem_file(file) || !has_allocation(file)) {
+#if PMEM_DEBUG
+		printk(KERN_INFO "pmem: requested pmem data from invalid"
+				  "file.\n");
+#endif
+		return -1;
+	}
+	data = (struct pmem_data *)file->private_data;
+	down_read(&data->sem);
+	if (data->vma) {
+		*start = data->vma->vm_start;
+		*len = data->vma->vm_end - data->vma->vm_start;
+	} else {
+		*start = 0;
+		*len = 0;
+	}
+	up_read(&data->sem);
+	return 0;
+}
+
+int get_pmem_addr(struct file *file, unsigned long *start,
+		  unsigned long *vstart, unsigned long *len)
+{
+	struct pmem_data *data;
+	int id;
+
+	if (!is_pmem_file(file) || !has_allocation(file)) {
+		return -1;
+	}
+
+	data = (struct pmem_data *)file->private_data;
+	if (data->index == -1) {
+#if PMEM_DEBUG
+		printk(KERN_INFO "pmem: requested pmem data from file with no "
+		       "allocation.\n");
+		return -1;
+#endif
+	}
+	id = get_id(file);
+
+	down_read(&data->sem);
+	*start = pmem_start_addr(id, data);
+	*len = pmem_len(id, data);
+	*vstart = (unsigned long)pmem_start_vaddr(id, data);
+	up_read(&data->sem);
+#if PMEM_DEBUG
+	down_write(&data->sem);
+	data->ref++;
+	up_write(&data->sem);
+#endif
+	return 0;
+}
+
+int get_pmem_file(int fd, unsigned long *start, unsigned long *vstart,
+		  unsigned long *len, struct file **filp)
+{
+	struct file *file;
+
+	file = fget(fd);
+	if (unlikely(file == NULL)) {
+		printk(KERN_INFO "pmem: requested data from file descriptor "
+		       "that doesn't exist.");
+		return -1;
+	}
+
+	if (get_pmem_addr(file, start, vstart, len))
+		goto end;
+
+	if (filp)
+		*filp = file;
+	return 0;
+end:
+	fput(file);
+	return -1;
+}
+
+void put_pmem_file(struct file *file)
+{
+	struct pmem_data *data;
+	int id;
+
+	if (!is_pmem_file(file))
+		return;
+	id = get_id(file);
+	data = (struct pmem_data *)file->private_data;
+#if PMEM_DEBUG
+	down_write(&data->sem);
+	if (data->ref == 0) {
+		printk("pmem: pmem_put > pmem_get %s (pid %d)\n",
+		       pmem[id].dev.name, data->pid);
+		BUG();
+	}
+	data->ref--;
+	up_write(&data->sem);
+#endif
+	fput(file);
+}
+
+void flush_pmem_file(struct file *file, unsigned long offset, unsigned long len)
+{
+	struct pmem_data *data;
+	int id;
+	void *vaddr;
+	struct pmem_region_node *region_node;
+	struct list_head *elt;
+	void *flush_start, *flush_end;
+
+	if (!is_pmem_file(file) || !has_allocation(file)) {
+		return;
+	}
+
+	id = get_id(file);
+	data = (struct pmem_data *)file->private_data;
+	if (!pmem[id].cached)
+		return;
+
+	down_read(&data->sem);
+	vaddr = pmem_start_vaddr(id, data);
+	/* if this isn't a submmapped file, flush the whole thing */
+	if (unlikely(!(data->flags & PMEM_FLAGS_CONNECTED))) {
+		dmac_flush_range(vaddr, vaddr + pmem_len(id, data));
+		goto end;
+	}
+	/* otherwise, flush the region of the file we are drawing */
+	list_for_each(elt, &data->region_list) {
+		region_node = list_entry(elt, struct pmem_region_node, list);
+		if ((offset >= region_node->region.offset) &&
+		    ((offset + len) <= (region_node->region.offset +
+			region_node->region.len))) {
+			flush_start = vaddr + region_node->region.offset;
+			flush_end = flush_start + region_node->region.len;
+			dmac_flush_range(flush_start, flush_end);
+			break;
+		}
+	}
+end:
+	up_read(&data->sem);
+}
+
+static int pmem_connect(unsigned long connect, struct file *file)
+{
+	struct pmem_data *data = (struct pmem_data *)file->private_data;
+	struct pmem_data *src_data;
+	struct file *src_file;
+	int ret = 0, put_needed;
+
+	down_write(&data->sem);
+	/* retrieve the src file and check it is a pmem file with an alloc */
+	src_file = fget_light(connect, &put_needed);
+	DLOG("connect %p to %p\n", file, src_file);
+	if (!src_file) {
+		printk("pmem: src file not found!\n");
+		ret = -EINVAL;
+		goto err_no_file;
+	}
+	if (unlikely(!is_pmem_file(src_file) || !has_allocation(src_file))) {
+		printk(KERN_INFO "pmem: src file is not a pmem file or has no "
+		       "alloc!\n");
+		ret = -EINVAL;
+		goto err_bad_file;
+	}
+	src_data = (struct pmem_data *)src_file->private_data;
+
+	if (has_allocation(file) && (data->index != src_data->index)) {
+		printk("pmem: file is already mapped but doesn't match this"
+		       " src_file!\n");
+		ret = -EINVAL;
+		goto err_bad_file;
+	}
+	data->index = src_data->index;
+	data->flags |= PMEM_FLAGS_CONNECTED;
+	data->master_fd = connect;
+	data->master_file = src_file;
+
+err_bad_file:
+	fput_light(src_file, put_needed);
+err_no_file:
+	up_write(&data->sem);
+	return ret;
+}
+
+static void pmem_unlock_data_and_mm(struct pmem_data *data,
+				    struct mm_struct *mm)
+{
+	up_write(&data->sem);
+	if (mm != NULL) {
+		up_write(&mm->mmap_sem);
+		mmput(mm);
+	}
+}
+
+static int pmem_lock_data_and_mm(struct file *file, struct pmem_data *data,
+				 struct mm_struct **locked_mm)
+{
+	int ret = 0;
+	struct mm_struct *mm = NULL;
+	*locked_mm = NULL;
+lock_mm:
+	down_read(&data->sem);
+	if (PMEM_IS_SUBMAP(data)) {
+		mm = get_task_mm(data->task);
+		if (!mm) {
+#if PMEM_DEBUG
+			printk("pmem: can't remap task is gone!\n");
+#endif
+			up_read(&data->sem);
+			return -1;
+		}
+	}
+	up_read(&data->sem);
+
+	if (mm)
+		down_write(&mm->mmap_sem);
+
+	down_write(&data->sem);
+	/* check that the file didn't get mmaped before we could take the
+	 * data sem, this should be safe b/c you can only submap each file
+	 * once */
+	if (PMEM_IS_SUBMAP(data) && !mm) {
+		pmem_unlock_data_and_mm(data, mm);
+		up_write(&data->sem);
+		goto lock_mm;
+	}
+	/* now check that vma.mm is still there, it could have been
+	 * deleted by vma_close before we could get the data->sem */
+	if ((data->flags & PMEM_FLAGS_UNSUBMAP) && (mm != NULL)) {
+		/* might as well release this */
+		if (data->flags & PMEM_FLAGS_SUBMAP) {
+			put_task_struct(data->task);
+			data->task = NULL;
+			/* lower the submap flag to show the mm is gone */
+			data->flags &= ~(PMEM_FLAGS_SUBMAP);
+		}
+		pmem_unlock_data_and_mm(data, mm);
+		return -1;
+	}
+	*locked_mm = mm;
+	return ret;
+}
+
+int pmem_remap(struct pmem_region *region, struct file *file,
+		      unsigned operation)
+{
+	int ret;
+	struct pmem_region_node *region_node;
+	struct mm_struct *mm = NULL;
+	struct list_head *elt, *elt2;
+	int id = get_id(file);
+	struct pmem_data *data = (struct pmem_data *)file->private_data;
+
+	/* pmem region must be aligned on a page boundry */
+	if (unlikely(!PMEM_IS_PAGE_ALIGNED(region->offset) ||
+		 !PMEM_IS_PAGE_ALIGNED(region->len))) {
+#if PMEM_DEBUG
+		printk("pmem: request for unaligned pmem suballocation "
+		       "%lx %lx\n", region->offset, region->len);
+#endif
+		return -EINVAL;
+	}
+
+	/* if userspace requests a region of len 0, there's nothing to do */
+	if (region->len == 0)
+		return 0;
+
+	/* lock the mm and data */
+	ret = pmem_lock_data_and_mm(file, data, &mm);
+	if (ret)
+		return 0;
+
+	/* only the owner of the master file can remap the client fds
+	 * that back in it */
+	if (!is_master_owner(file)) {
+#if PMEM_DEBUG
+		printk("pmem: remap requested from non-master process\n");
+#endif
+		ret = -EINVAL;
+		goto err;
+	}
+
+	/* check that the requested range is within the src allocation */
+	if (unlikely((region->offset > pmem_len(id, data)) ||
+		     (region->len > pmem_len(id, data)) ||
+		     (region->offset + region->len > pmem_len(id, data)))) {
+#if PMEM_DEBUG
+		printk(KERN_INFO "pmem: suballoc doesn't fit in src_file!\n");
+#endif
+		ret = -EINVAL;
+		goto err;
+	}
+
+	if (operation == PMEM_MAP) {
+		region_node = kmalloc(sizeof(struct pmem_region_node),
+			      GFP_KERNEL);
+		if (!region_node) {
+			ret = -ENOMEM;
+#if PMEM_DEBUG
+			printk(KERN_INFO "No space to allocate metadata!");
+#endif
+			goto err;
+		}
+		region_node->region = *region;
+		list_add(&region_node->list, &data->region_list);
+	} else if (operation == PMEM_UNMAP) {
+		int found = 0;
+		list_for_each_safe(elt, elt2, &data->region_list) {
+			region_node = list_entry(elt, struct pmem_region_node,
+				      list);
+			if (region->len == 0 ||
+			    (region_node->region.offset == region->offset &&
+			    region_node->region.len == region->len)) {
+				list_del(elt);
+				kfree(region_node);
+				found = 1;
+			}
+		}
+		if (!found) {
+#if PMEM_DEBUG
+			printk("pmem: Unmap region does not map any mapped "
+				"region!");
+#endif
+			ret = -EINVAL;
+			goto err;
+		}
+	}
+
+	if (data->vma && PMEM_IS_SUBMAP(data)) {
+		if (operation == PMEM_MAP)
+			ret = pmem_remap_pfn_range(id, data->vma, data,
+						   region->offset, region->len);
+		else if (operation == PMEM_UNMAP)
+			ret = pmem_unmap_pfn_range(id, data->vma, data,
+						   region->offset, region->len);
+	}
+
+err:
+	pmem_unlock_data_and_mm(data, mm);
+	return ret;
+}
+
+static void pmem_revoke(struct file *file, struct pmem_data *data)
+{
+	struct pmem_region_node *region_node;
+	struct list_head *elt, *elt2;
+	struct mm_struct *mm = NULL;
+	int id = get_id(file);
+	int ret = 0;
+
+	data->master_file = NULL;
+	ret = pmem_lock_data_and_mm(file, data, &mm);
+	/* if lock_data_and_mm fails either the task that mapped the fd, or
+	 * the vma that mapped it have already gone away, nothing more
+	 * needs to be done */
+	if (ret)
+		return;
+	/* unmap everything */
+	/* delete the regions and region list nothing is mapped any more */
+	if (data->vma)
+		list_for_each_safe(elt, elt2, &data->region_list) {
+			region_node = list_entry(elt, struct pmem_region_node,
+						 list);
+			pmem_unmap_pfn_range(id, data->vma, data,
+					     region_node->region.offset,
+					     region_node->region.len);
+			list_del(elt);
+			kfree(region_node);
+	}
+	/* delete the master file */
+	pmem_unlock_data_and_mm(data, mm);
+}
+
+static void pmem_get_size(struct pmem_region *region, struct file *file)
+{
+	struct pmem_data *data = (struct pmem_data *)file->private_data;
+	int id = get_id(file);
+
+	if (!has_allocation(file)) {
+		region->offset = 0;
+		region->len = 0;
+		return;
+	} else {
+		region->offset = pmem_start_addr(id, data);
+		region->len = pmem_len(id, data);
+	}
+	DLOG("offset %lx len %lx\n", region->offset, region->len);
+}
+
+
+static long pmem_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+{
+	struct pmem_data *data;
+	int id = get_id(file);
+
+	switch (cmd) {
+	case PMEM_GET_PHYS:
+		{
+			struct pmem_region region;
+			DLOG("get_phys\n");
+			if (!has_allocation(file)) {
+				region.offset = 0;
+				region.len = 0;
+			} else {
+				data = (struct pmem_data *)file->private_data;
+				region.offset = pmem_start_addr(id, data);
+				region.len = pmem_len(id, data);
+			}
+			printk(KERN_INFO "pmem: request for physical address of pmem region "
+					"from process %d.\n", current->pid);
+			if (copy_to_user((void __user *)arg, &region,
+						sizeof(struct pmem_region)))
+				return -EFAULT;
+			break;
+		}
+	case PMEM_MAP:
+		{
+			struct pmem_region region;
+			if (copy_from_user(&region, (void __user *)arg,
+						sizeof(struct pmem_region)))
+				return -EFAULT;
+			data = (struct pmem_data *)file->private_data;
+			return pmem_remap(&region, file, PMEM_MAP);
+		}
+		break;
+	case PMEM_UNMAP:
+		{
+			struct pmem_region region;
+			if (copy_from_user(&region, (void __user *)arg,
+						sizeof(struct pmem_region)))
+				return -EFAULT;
+			data = (struct pmem_data *)file->private_data;
+			return pmem_remap(&region, file, PMEM_UNMAP);
+			break;
+		}
+	case PMEM_GET_SIZE:
+		{
+			struct pmem_region region;
+			DLOG("get_size\n");
+			pmem_get_size(&region, file);
+			if (copy_to_user((void __user *)arg, &region,
+						sizeof(struct pmem_region)))
+				return -EFAULT;
+			break;
+		}
+	case PMEM_GET_TOTAL_SIZE:
+		{
+			struct pmem_region region;
+			DLOG("get total size\n");
+			region.offset = 0;
+			get_id(file);
+			region.len = pmem[id].size;
+			if (copy_to_user((void __user *)arg, &region,
+						sizeof(struct pmem_region)))
+				return -EFAULT;
+			break;
+		}
+	case PMEM_ALLOCATE:
+		{
+			if (has_allocation(file))
+				return -EINVAL;
+			data = (struct pmem_data *)file->private_data;
+			data->index = pmem_allocate(id, arg);
+			break;
+		}
+	case PMEM_CONNECT:
+		DLOG("connect\n");
+		return pmem_connect(arg, file);
+		break;
+	default:
+		if (pmem[id].ioctl)
+			return pmem[id].ioctl(file, cmd, arg);
+		return -EINVAL;
+	}
+	return 0;
+}
+
+#if PMEM_DEBUG
+static ssize_t debug_open(struct inode *inode, struct file *file)
+{
+	file->private_data = inode->i_private;
+	return 0;
+}
+
+static ssize_t debug_read(struct file *file, char __user *buf, size_t count,
+			  loff_t *ppos)
+{
+	struct list_head *elt, *elt2;
+	struct pmem_data *data;
+	struct pmem_region_node *region_node;
+	int id = (int)file->private_data;
+	const int debug_bufmax = 4096;
+	static char buffer[4096];
+	int n = 0;
+
+	DLOG("debug open\n");
+	n = scnprintf(buffer, debug_bufmax,
+		      "pid #: mapped regions (offset, len) (offset,len)...\n");
+
+	down(&pmem[id].data_list_sem);
+	list_for_each(elt, &pmem[id].data_list) {
+		data = list_entry(elt, struct pmem_data, list);
+		down_read(&data->sem);
+		n += scnprintf(buffer + n, debug_bufmax - n, "pid %u:",
+				data->pid);
+		list_for_each(elt2, &data->region_list) {
+			region_node = list_entry(elt2, struct pmem_region_node,
+				      list);
+			n += scnprintf(buffer + n, debug_bufmax - n,
+					"(%lx,%lx) ",
+					region_node->region.offset,
+					region_node->region.len);
+		}
+		n += scnprintf(buffer + n, debug_bufmax - n, "\n");
+		up_read(&data->sem);
+	}
+	up(&pmem[id].data_list_sem);
+
+	n++;
+	buffer[n] = 0;
+	return simple_read_from_buffer(buf, count, ppos, buffer, n);
+}
+
+static struct file_operations debug_fops = {
+	.read = debug_read,
+	.open = debug_open,
+};
+#endif
+
+#if 0
+static struct miscdevice pmem_dev = {
+	.name = "pmem",
+	.fops = &pmem_fops,
+};
+#endif
+
+int pmem_setup(struct android_pmem_platform_data *pdata,
+	       long (*ioctl)(struct file *, unsigned int, unsigned long),
+	       int (*release)(struct inode *, struct file *))
+{
+	int err = 0;
+	int i, index = 0;
+	int id = id_count;
+	id_count++;
+
+	pmem[id].no_allocator = pdata->no_allocator;
+	pmem[id].cached = pdata->cached;
+	pmem[id].buffered = pdata->buffered;
+	pmem[id].base = pdata->start;
+	pmem[id].size = pdata->size;
+	pmem[id].ioctl = ioctl;
+	pmem[id].release = release;
+	init_rwsem(&pmem[id].bitmap_sem);
+	init_MUTEX(&pmem[id].data_list_sem);
+	INIT_LIST_HEAD(&pmem[id].data_list);
+	pmem[id].dev.name = pdata->name;
+	pmem[id].dev.minor = id;
+	pmem[id].dev.fops = &pmem_fops;
+	printk(KERN_INFO "%s: %d init\n", pdata->name, pdata->cached);
+
+	err = misc_register(&pmem[id].dev);
+	if (err) {
+		printk(KERN_ALERT "Unable to register pmem driver!\n");
+		goto err_cant_register_device;
+	}
+	pmem[id].num_entries = pmem[id].size / PMEM_MIN_ALLOC;
+
+	pmem[id].bitmap = kmalloc(pmem[id].num_entries *
+				  sizeof(struct pmem_bits), GFP_KERNEL);
+	if (!pmem[id].bitmap)
+		goto err_no_mem_for_metadata;
+
+	memset(pmem[id].bitmap, 0, sizeof(struct pmem_bits) *
+					  pmem[id].num_entries);
+
+	for (i = sizeof(pmem[id].num_entries) * 8 - 1; i >= 0; i--) {
+		if ((pmem[id].num_entries) &  1<<i) {
+			PMEM_ORDER(id, index) = i;
+			index = PMEM_NEXT_INDEX(id, index);
+		}
+	}
+
+	if (pmem[id].cached)
+		pmem[id].vbase = ioremap_cached(pmem[id].base,
+						pmem[id].size);
+#ifdef ioremap_ext_buffered
+	else if (pmem[id].buffered)
+		pmem[id].vbase = ioremap_ext_buffered(pmem[id].base,
+						      pmem[id].size);
+#endif
+	else
+		pmem[id].vbase = ioremap(pmem[id].base, pmem[id].size);
+
+	if (pmem[id].vbase == 0)
+		goto error_cant_remap;
+
+	pmem[id].garbage_pfn = page_to_pfn(alloc_page(GFP_KERNEL));
+	if (pmem[id].no_allocator)
+		pmem[id].allocated = 0;
+
+#if PMEM_DEBUG
+	debugfs_create_file(pdata->name, S_IFREG | S_IRUGO, NULL, (void *)id,
+			    &debug_fops);
+#endif
+	return 0;
+error_cant_remap:
+	kfree(pmem[id].bitmap);
+err_no_mem_for_metadata:
+	misc_deregister(&pmem[id].dev);
+err_cant_register_device:
+	return -1;
+}
+
+static int pmem_probe(struct platform_device *pdev)
+{
+	struct android_pmem_platform_data *pdata;
+
+	if (!pdev || !pdev->dev.platform_data) {
+		printk(KERN_ALERT "Unable to probe pmem!\n");
+		return -1;
+	}
+	pdata = pdev->dev.platform_data;
+	return pmem_setup(pdata, NULL, NULL);
+}
+
+
+static int pmem_remove(struct platform_device *pdev)
+{
+	int id = pdev->id;
+	__free_page(pfn_to_page(pmem[id].garbage_pfn));
+	misc_deregister(&pmem[id].dev);
+	return 0;
+}
+
+static struct platform_driver pmem_driver = {
+	.probe = pmem_probe,
+	.remove = pmem_remove,
+	.driver = { .name = "android_pmem" }
+};
+
+
+static int __init pmem_init(void)
+{
+	return platform_driver_register(&pmem_driver);
+}
+
+static void __exit pmem_exit(void)
+{
+	platform_driver_unregister(&pmem_driver);
+}
+
+module_init(pmem_init);
+module_exit(pmem_exit);
+
diff --git a/drivers/staging/dream/qdsp5/adsp.c b/drivers/staging/dream/qdsp5/adsp.c
index d096456688da..9069535fcaf1 100644
--- a/drivers/staging/dream/qdsp5/adsp.c
+++ b/drivers/staging/dream/qdsp5/adsp.c
@@ -32,16 +32,12 @@
 #include <linux/module.h>
 #include <linux/uaccess.h>
 #include <linux/wait.h>
-#include <linux/wakelock.h>
 
-static struct wake_lock adsp_wake_lock;
 static inline void prevent_suspend(void)
 {
-	wake_lock(&adsp_wake_lock);
 }
 static inline void allow_suspend(void)
 {
-	wake_unlock(&adsp_wake_lock);
 }
 
 #include <linux/io.h>
@@ -1046,7 +1042,6 @@ static int msm_adsp_probe(struct platform_device *pdev)
 
 	pr_info("adsp: probe\n");
 
-	wake_lock_init(&adsp_wake_lock, WAKE_LOCK_SUSPEND, "adsp");
 #if CONFIG_MSM_AMSS_VERSION >= 6350
 	adsp_info.init_info_ptr = kzalloc(
 		(sizeof(struct adsp_rtos_mp_mtoa_init_info_type)), GFP_KERNEL);
diff --git a/drivers/staging/dream/qdsp5/audio_out.c b/drivers/staging/dream/qdsp5/audio_out.c
index d1adcf65f2bd..df87ca337b94 100644
--- a/drivers/staging/dream/qdsp5/audio_out.c
+++ b/drivers/staging/dream/qdsp5/audio_out.c
@@ -38,8 +38,6 @@
 #include <mach/qdsp5/qdsp5audppcmdi.h>
 #include <mach/qdsp5/qdsp5audppmsg.h>
 
-#include <mach/htc_pwrsink.h>
-
 #include "evlog.h"
 
 #define LOG_AUDIO_EVENTS 1
@@ -260,7 +258,6 @@ static int audio_enable(struct audio *audio)
 	}
 
 	audio->enabled = 1;
-	htc_pwrsink_set(PWRSINK_AUDIO, 100);
 	return 0;
 }
 
@@ -695,7 +692,6 @@ static int audio_release(struct inode *inode, struct file *file)
 	audio_flush(audio);
 	audio->opened = 0;
 	mutex_unlock(&audio->lock);
-	htc_pwrsink_set(PWRSINK_AUDIO, 0);
 	return 0;
 }
 
diff --git a/drivers/staging/dream/smd/smd_qmi.c b/drivers/staging/dream/smd/smd_qmi.c
index d4e7d8804626..687db142904c 100644
--- a/drivers/staging/dream/smd/smd_qmi.c
+++ b/drivers/staging/dream/smd/smd_qmi.c
@@ -24,7 +24,6 @@
 #include <linux/wait.h>
 #include <linux/miscdevice.h>
 #include <linux/workqueue.h>
-#include <linux/wakelock.h>
 
 #include <asm/uaccess.h>
 #include <mach/msm_smd.h>
@@ -74,7 +73,6 @@ struct qmi_ctxt {
 
 	smd_channel_t *ch;
 	const char *ch_name;
-	struct wake_lock wake_lock;
 
 	struct work_struct open_work;
 	struct work_struct read_work;
@@ -90,7 +88,6 @@ void qmi_ctxt_init(struct qmi_ctxt *ctxt, unsigned n)
 	mutex_init(&ctxt->lock);
 	INIT_WORK(&ctxt->read_work, qmi_read_work);
 	INIT_WORK(&ctxt->open_work, qmi_open_work);
-	wake_lock_init(&ctxt->wake_lock, WAKE_LOCK_SUSPEND, ctxt->misc.name);
 	ctxt->ctl_txn_id = 1;
 	ctxt->wds_txn_id = 1;
 	ctxt->wds_busy = 1;
@@ -454,7 +451,6 @@ static void qmi_process_qmux(struct qmi_ctxt *ctxt,
 		break;
 	}
 	mutex_unlock(&ctxt->lock);
-
 	wake_up(&qmi_wait_queue);
 }
 
@@ -509,7 +505,6 @@ static void qmi_notify(void *priv, unsigned event)
 		int sz;
 		sz = smd_cur_packet_size(ctxt->ch);
 		if ((sz > 0) && (sz <= smd_read_avail(ctxt->ch))) {
-			wake_lock_timeout(&ctxt->wake_lock, HZ / 2);
 			queue_work(qmi_wq, &ctxt->read_work);
 		}
 		break;
diff --git a/drivers/staging/dream/smd/smd_rpcrouter.c b/drivers/staging/dream/smd/smd_rpcrouter.c
index d4a4a887e428..5ac2cd4a5978 100644
--- a/drivers/staging/dream/smd/smd_rpcrouter.c
+++ b/drivers/staging/dream/smd/smd_rpcrouter.c
@@ -33,7 +33,6 @@
 #include <linux/err.h>
 #include <linux/sched.h>
 #include <linux/poll.h>
-#include <linux/wakelock.h>
 #include <asm/uaccess.h>
 #include <asm/byteorder.h>
 #include <linux/platform_device.h>
@@ -96,7 +95,6 @@ static DEFINE_SPINLOCK(server_list_lock);
 static DEFINE_SPINLOCK(smd_lock);
 
 static struct workqueue_struct *rpcrouter_workqueue;
-static struct wake_lock rpcrouter_wake_lock;
 static int rpcrouter_need_len;
 
 static atomic_t next_xid = ATOMIC_INIT(1);
@@ -290,7 +288,6 @@ struct msm_rpc_endpoint *msm_rpcrouter_create_local_endpoint(dev_t dev)
 	init_waitqueue_head(&ept->wait_q);
 	INIT_LIST_HEAD(&ept->read_q);
 	spin_lock_init(&ept->read_q_lock);
-	wake_lock_init(&ept->read_q_wake_lock, WAKE_LOCK_SUSPEND, "rpc_read");
 	INIT_LIST_HEAD(&ept->incomplete);
 
 	spin_lock_irqsave(&local_endpoints_lock, flags);
@@ -313,7 +310,6 @@ int msm_rpcrouter_destroy_local_endpoint(struct msm_rpc_endpoint *ept)
 	if (rc < 0)
 		return rc;
 
-	wake_lock_destroy(&ept->read_q_wake_lock);
 	list_del(&ept->list);
 	kfree(ept);
 	return 0;
@@ -540,8 +536,6 @@ static void rpcrouter_smdnotify(void *_dev, unsigned event)
 	if (event != SMD_EVENT_DATA)
 		return;
 
-	if (smd_read_avail(smd_channel) >= rpcrouter_need_len)
-		wake_lock(&rpcrouter_wake_lock);
 	wake_up(&smd_wait);
 }
 
@@ -576,7 +570,6 @@ static int rr_read(void *data, int len)
 				return -EIO;
 		}
 		rpcrouter_need_len = len;
-		wake_unlock(&rpcrouter_wake_lock);
 		spin_unlock_irqrestore(&smd_lock, flags);
 
 //		printk("rr_read: waiting (%d)\n", len);
@@ -676,7 +669,6 @@ static void do_read_data(struct work_struct *work)
 
 packet_complete:
 	spin_lock_irqsave(&ept->read_q_lock, flags);
-	wake_lock(&ept->read_q_wake_lock);
 	list_add_tail(&pkt->list, &ept->read_q);
 	wake_up(&ept->wait_q);
 	spin_unlock_irqrestore(&ept->read_q_lock, flags);
@@ -699,7 +691,6 @@ done:
 fail_io:
 fail_data:
 	printk(KERN_ERR "rpc_router has died\n");
-	wake_unlock(&rpcrouter_wake_lock);
 }
 
 void msm_rpc_setup_req(struct rpc_request_hdr *hdr, uint32_t prog,
@@ -1061,8 +1052,6 @@ int __msm_rpc_read(struct msm_rpc_endpoint *ept,
 		return -ETOOSMALL;
 	}
 	list_del(&pkt->list);
-	if (list_empty(&ept->read_q))
-		wake_unlock(&ept->read_q_wake_lock);
 	spin_unlock_irqrestore(&ept->read_q_lock, flags);
 
 	rc = pkt->length;
@@ -1229,7 +1218,6 @@ static int msm_rpcrouter_probe(struct platform_device *pdev)
 
 	init_waitqueue_head(&newserver_wait);
 	init_waitqueue_head(&smd_wait);
-	wake_lock_init(&rpcrouter_wake_lock, WAKE_LOCK_SUSPEND, "SMD_RPCCALL");
 
 	rpcrouter_workqueue = create_singlethread_workqueue("rpcrouter");
 	if (!rpcrouter_workqueue)
diff --git a/drivers/staging/dream/smd/smd_rpcrouter.h b/drivers/staging/dream/smd/smd_rpcrouter.h
index a7416a2ec58c..86ab997b1b79 100644
--- a/drivers/staging/dream/smd/smd_rpcrouter.h
+++ b/drivers/staging/dream/smd/smd_rpcrouter.h
@@ -22,7 +22,6 @@
 #include <linux/list.h>
 #include <linux/cdev.h>
 #include <linux/platform_device.h>
-#include <linux/wakelock.h>
 
 #include <mach/msm_smd.h>
 #include <mach/msm_rpcrouter.h>
@@ -144,7 +143,6 @@ struct msm_rpc_endpoint {
 	/* complete packets waiting to be read */
 	struct list_head read_q;
 	spinlock_t read_q_lock;
-	struct wake_lock read_q_wake_lock;
 	wait_queue_head_t wait_q;
 	unsigned flags;
 
diff --git a/drivers/staging/dream/smd/smd_tty.c b/drivers/staging/dream/smd/smd_tty.c
index 2edd9d1ec2dc..f40944958d44 100644
--- a/drivers/staging/dream/smd/smd_tty.c
+++ b/drivers/staging/dream/smd/smd_tty.c
@@ -19,7 +19,6 @@
 #include <linux/cdev.h>
 #include <linux/device.h>
 #include <linux/wait.h>
-#include <linux/wakelock.h>
 
 #include <linux/tty.h>
 #include <linux/tty_driver.h>
@@ -34,7 +33,6 @@ static DEFINE_MUTEX(smd_tty_lock);
 struct smd_tty_info {
 	smd_channel_t *ch;
 	struct tty_struct *tty;
-	struct wake_lock wake_lock;
 	int open_count;
 };
 
@@ -69,7 +67,6 @@ static void smd_tty_notify(void *priv, unsigned event)
 			printk(KERN_ERR "OOPS - smd_tty_buffer mismatch?!");
 		}
 
-		wake_lock_timeout(&info->wake_lock, HZ / 2);
 		tty_flip_buffer_push(tty);
 	}
 
@@ -95,7 +92,6 @@ static int smd_tty_open(struct tty_struct *tty, struct file *f)
 	info = smd_tty + n;
 
 	mutex_lock(&smd_tty_lock);
-	wake_lock_init(&info->wake_lock, WAKE_LOCK_SUSPEND, name);
 	tty->driver_data = info;
 
 	if (info->open_count++ == 0) {
@@ -122,7 +118,6 @@ static void smd_tty_close(struct tty_struct *tty, struct file *f)
 	if (--info->open_count == 0) {
 		info->tty = 0;
 		tty->driver_data = 0;
-		wake_lock_destroy(&info->wake_lock);
 		if (info->ch) {
 			smd_close(info->ch);
 			info->ch = 0;
diff --git a/drivers/staging/dream/synaptics_i2c_rmi.c b/drivers/staging/dream/synaptics_i2c_rmi.c
index ae696d3bc8e6..4de6bc917595 100644
--- a/drivers/staging/dream/synaptics_i2c_rmi.c
+++ b/drivers/staging/dream/synaptics_i2c_rmi.c
@@ -379,6 +379,12 @@ static int __devinit synaptics_ts_probe(
 		goto err_check_functionality_failed;
 	}
 
+	if (!i2c_check_functionality(client->adapter, I2C_FUNC_SMBUS_WORD_DATA)) {
+		pr_err("synaptics_ts_probe: need I2C_FUNC_SMBUS_WORD_DATA\n");
+		ret = -ENODEV;
+		goto err_check_functionality_failed;
+	}
+
 	ts = kzalloc(sizeof(*ts), GFP_KERNEL);
 	if (ts == NULL) {
 		ret = -ENOMEM;
diff --git a/drivers/staging/dst/Kconfig b/drivers/staging/dst/Kconfig
deleted file mode 100644
index 448d342ac2a2..000000000000
--- a/drivers/staging/dst/Kconfig
+++ /dev/null
@@ -1,67 +0,0 @@
-config DST
-	tristate "Distributed storage"
-	depends on NET && CRYPTO && SYSFS && BLK_DEV
-	select CONNECTOR
-	---help---
-	DST is a network block device storage, which can be used to organize
-	exported storage on the remote nodes into the local block device.
-
-	DST works on top of any network media and protocol; it is just a matter
-	of configuration utility to understand the correct addresses. The most
-	common example is TCP over IP, which allows to pass through firewalls and
-	create remote backup storage in a different datacenter. DST requires
-	single port to be enabled on the exporting node and outgoing connections
-	on the local node.
-
-	DST works with in-kernel client and server, which improves performance by
-	eliminating unneded data copies and by not depending on the version
-	of the external IO components. It requires userspace configuration utility
-	though.
-
-	DST uses transaction model, when each store has to be explicitly acked
-	from the remote node to be considered as successfully written. There
-	may be lots of in-flight transactions. When remote host does not ack
-	the transaction it will be resent predefined number of times with specified
-	timeouts between them. All those parameters are configurable. Transactions
-	are marked as failed after all resends complete unsuccessfully; having
-	long enough resend timeout and/or large number of resends allows not to
-	return error to the higher (FS usually) layer in case of short network
-	problems or remote node outages. In case of network RAID setup this means
-	that storage will not degrade until transactions are marked as failed, and
-	thus will not force checksum recalculation and data rebuild. In case of
-	connection failure DST will try to reconnect to the remote node automatically.
-	DST sends ping commands at idle time to detect if remote node is alive.
-
-	Because of transactional model it is possible to use zero-copy sending
-	without worry of data corruption (which in turn could be detected by the
-	strong checksums though).
-
-	DST may fully encrypt the data channel in case of untrusted channel and implement
-	strong checksum of the transferred data. It is possible to configure algorithms
-	and crypto keys; they should match on both sides of the network channel.
-	Crypto processing does not introduce noticeble performance overhead, since DST
-	uses configurable pool of threads to perform crypto processing.
-
-	DST utilizes memory pool model of all its transaction allocations (it is the
-	only additional allocation on the client) and server allocations (bio pools,
-	while pages are allocated from the slab).
-
-	At startup DST performs a simple negotiation with the export node to determine
-	access permissions and size of the exported storage. It can be extended if
-	new parameters should be autonegotiated.
-
-	DST carries block IO flags in the protocol, which allows to transparently implement
-	barriers and sync/flush operations. Those flags are used in the export node where
-	IO against the local storage is performed, which means that sync write will be sync
-	on the remote node too, which in turn improves data integrity and improved resistance
-	to errors and data corruption during power outages or storage damages.
-
-	Homepage: http://www.ioremap.net/projects/dst
-	Userspace configuration utility and the latest releases: http://www.ioremap.net/archive/dst/
-
-config DST_DEBUG
-	bool "DST debug"
-	depends on DST
-	---help---
-	This option will enable HEAVY debugging of the DST.
-	Turn it on ONLY if you have to debug some really obscure problem.
diff --git a/drivers/staging/dst/Makefile b/drivers/staging/dst/Makefile
deleted file mode 100644
index 3a8b0cf9643e..000000000000
--- a/drivers/staging/dst/Makefile
+++ /dev/null
@@ -1,3 +0,0 @@
-obj-$(CONFIG_DST) += nst.o
-
-nst-y := dcore.o state.o export.o thread_pool.o crypto.o trans.o
diff --git a/drivers/staging/dst/crypto.c b/drivers/staging/dst/crypto.c
deleted file mode 100644
index 7250f90f5924..000000000000
--- a/drivers/staging/dst/crypto.c
+++ /dev/null
@@ -1,731 +0,0 @@
-/*
- * 2007+ Copyright (c) Evgeniy Polyakov <zbr@ioremap.net>
- * All rights reserved.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- */
-
-#include <linux/bio.h>
-#include <linux/crypto.h>
-#include <linux/dst.h>
-#include <linux/kernel.h>
-#include <linux/scatterlist.h>
-#include <linux/slab.h>
-
-/*
- * Tricky bastard, but IV can be more complex with time...
- */
-static inline u64 dst_gen_iv(struct dst_trans *t)
-{
-	return t->gen;
-}
-
-/*
- * Crypto machinery: hash/cipher support for the given crypto controls.
- */
-static struct crypto_hash *dst_init_hash(struct dst_crypto_ctl *ctl, u8 *key)
-{
-	int err;
-	struct crypto_hash *hash;
-
-	hash = crypto_alloc_hash(ctl->hash_algo, 0, CRYPTO_ALG_ASYNC);
-	if (IS_ERR(hash)) {
-		err = PTR_ERR(hash);
-		dprintk("%s: failed to allocate hash '%s', err: %d.\n",
-				__func__, ctl->hash_algo, err);
-		goto err_out_exit;
-	}
-
-	ctl->crypto_attached_size = crypto_hash_digestsize(hash);
-
-	if (!ctl->hash_keysize)
-		return hash;
-
-	err = crypto_hash_setkey(hash, key, ctl->hash_keysize);
-	if (err) {
-		dprintk("%s: failed to set key for hash '%s', err: %d.\n",
-				__func__, ctl->hash_algo, err);
-		goto err_out_free;
-	}
-
-	return hash;
-
-err_out_free:
-	crypto_free_hash(hash);
-err_out_exit:
-	return ERR_PTR(err);
-}
-
-static struct crypto_ablkcipher *dst_init_cipher(struct dst_crypto_ctl *ctl, u8 *key)
-{
-	int err = -EINVAL;
-	struct crypto_ablkcipher *cipher;
-
-	if (!ctl->cipher_keysize)
-		goto err_out_exit;
-
-	cipher = crypto_alloc_ablkcipher(ctl->cipher_algo, 0, 0);
-	if (IS_ERR(cipher)) {
-		err = PTR_ERR(cipher);
-		dprintk("%s: failed to allocate cipher '%s', err: %d.\n",
-				__func__, ctl->cipher_algo, err);
-		goto err_out_exit;
-	}
-
-	crypto_ablkcipher_clear_flags(cipher, ~0);
-
-	err = crypto_ablkcipher_setkey(cipher, key, ctl->cipher_keysize);
-	if (err) {
-		dprintk("%s: failed to set key for cipher '%s', err: %d.\n",
-				__func__, ctl->cipher_algo, err);
-		goto err_out_free;
-	}
-
-	return cipher;
-
-err_out_free:
-	crypto_free_ablkcipher(cipher);
-err_out_exit:
-	return ERR_PTR(err);
-}
-
-/*
- * Crypto engine has a pool of pages to encrypt data into before sending
- * it over the network. This pool is freed/allocated here.
- */
-static void dst_crypto_pages_free(struct dst_crypto_engine *e)
-{
-	unsigned int i;
-
-	for (i=0; i<e->page_num; ++i)
-		__free_page(e->pages[i]);
-	kfree(e->pages);
-}
-
-static int dst_crypto_pages_alloc(struct dst_crypto_engine *e, int num)
-{
-	int i;
-
-	e->pages = kmalloc(num * sizeof(struct page **), GFP_KERNEL);
-	if (!e->pages)
-		return -ENOMEM;
-
-	for (i=0; i<num; ++i) {
-		e->pages[i] = alloc_page(GFP_KERNEL);
-		if (!e->pages[i])
-			goto err_out_free_pages;
-	}
-
-	e->page_num = num;
-	return 0;
-
-err_out_free_pages:
-	while (--i >= 0)
-		__free_page(e->pages[i]);
-
-	kfree(e->pages);
-	return -ENOMEM;
-}
-
-/*
- * Initialize crypto engine for given node.
- * Setup cipher/hash, keys, pool of threads and private data.
- */
-static int dst_crypto_engine_init(struct dst_crypto_engine *e, struct dst_node *n)
-{
-	int err;
-	struct dst_crypto_ctl *ctl = &n->crypto;
-
-	err = dst_crypto_pages_alloc(e, n->max_pages);
-	if (err)
-		goto err_out_exit;
-
-	e->size = PAGE_SIZE;
-	e->data = kmalloc(e->size, GFP_KERNEL);
-	if (!e->data) {
-		err = -ENOMEM;
-		goto err_out_free_pages;
-	}
-
-	if (ctl->hash_algo[0]) {
-		e->hash = dst_init_hash(ctl, n->hash_key);
-		if (IS_ERR(e->hash)) {
-			err = PTR_ERR(e->hash);
-			e->hash = NULL;
-			goto err_out_free;
-		}
-	}
-
-	if (ctl->cipher_algo[0]) {
-		e->cipher = dst_init_cipher(ctl, n->cipher_key);
-		if (IS_ERR(e->cipher)) {
-			err = PTR_ERR(e->cipher);
-			e->cipher = NULL;
-			goto err_out_free_hash;
-		}
-	}
-
-	return 0;
-
-err_out_free_hash:
-	crypto_free_hash(e->hash);
-err_out_free:
-	kfree(e->data);
-err_out_free_pages:
-	dst_crypto_pages_free(e);
-err_out_exit:
-	return err;
-}
-
-static void dst_crypto_engine_exit(struct dst_crypto_engine *e)
-{
-	if (e->hash)
-		crypto_free_hash(e->hash);
-	if (e->cipher)
-		crypto_free_ablkcipher(e->cipher);
-	dst_crypto_pages_free(e);
-	kfree(e->data);
-}
-
-/*
- * Waiting for cipher processing to be completed.
- */
-struct dst_crypto_completion
-{
-	struct completion		complete;
-	int				error;
-};
-
-static void dst_crypto_complete(struct crypto_async_request *req, int err)
-{
-	struct dst_crypto_completion *c = req->data;
-
-	if (err == -EINPROGRESS)
-		return;
-
-	dprintk("%s: req: %p, err: %d.\n", __func__, req, err);
-	c->error = err;
-	complete(&c->complete);
-}
-
-static int dst_crypto_process(struct ablkcipher_request *req,
-		struct scatterlist *sg_dst, struct scatterlist *sg_src,
-		void *iv, int enc, unsigned long timeout)
-{
-	struct dst_crypto_completion c;
-	int err;
-
-	init_completion(&c.complete);
-	c.error = -EINPROGRESS;
-
-	ablkcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
-					dst_crypto_complete, &c);
-
-	ablkcipher_request_set_crypt(req, sg_src, sg_dst, sg_src->length, iv);
-
-	if (enc)
-		err = crypto_ablkcipher_encrypt(req);
-	else
-		err = crypto_ablkcipher_decrypt(req);
-
-	switch (err) {
-		case -EINPROGRESS:
-		case -EBUSY:
-			err = wait_for_completion_interruptible_timeout(&c.complete,
-					timeout);
-			if (!err)
-				err = -ETIMEDOUT;
-			else
-				err = c.error;
-			break;
-		default:
-			break;
-	}
-
-	return err;
-}
-
-/*
- * DST uses generic iteration approach for data crypto processing.
- * Single block IO request is switched into array of scatterlists,
- * which are submitted to the crypto processing iterator.
- *
- * Input and output iterator initialization are different, since
- * in output case we can not encrypt data in-place and need a
- * temporary storage, which is then being sent to the remote peer.
- */
-static int dst_trans_iter_out(struct bio *bio, struct dst_crypto_engine *e,
-		int (* iterator) (struct dst_crypto_engine *e,
-				  struct scatterlist *dst,
-				  struct scatterlist *src))
-{
-	struct bio_vec *bv;
-	int err, i;
-
-	sg_init_table(e->src, bio->bi_vcnt);
-	sg_init_table(e->dst, bio->bi_vcnt);
-
-	bio_for_each_segment(bv, bio, i) {
-		sg_set_page(&e->src[i], bv->bv_page, bv->bv_len, bv->bv_offset);
-		sg_set_page(&e->dst[i], e->pages[i], bv->bv_len, bv->bv_offset);
-
-		err = iterator(e, &e->dst[i], &e->src[i]);
-		if (err)
-			return err;
-	}
-
-	return 0;
-}
-
-static int dst_trans_iter_in(struct bio *bio, struct dst_crypto_engine *e,
-		int (* iterator) (struct dst_crypto_engine *e,
-				  struct scatterlist *dst,
-				  struct scatterlist *src))
-{
-	struct bio_vec *bv;
-	int err, i;
-
-	sg_init_table(e->src, bio->bi_vcnt);
-	sg_init_table(e->dst, bio->bi_vcnt);
-
-	bio_for_each_segment(bv, bio, i) {
-		sg_set_page(&e->src[i], bv->bv_page, bv->bv_len, bv->bv_offset);
-		sg_set_page(&e->dst[i], bv->bv_page, bv->bv_len, bv->bv_offset);
-
-		err = iterator(e, &e->dst[i], &e->src[i]);
-		if (err)
-			return err;
-	}
-
-	return 0;
-}
-
-static int dst_crypt_iterator(struct dst_crypto_engine *e,
-		struct scatterlist *sg_dst, struct scatterlist *sg_src)
-{
-	struct ablkcipher_request *req = e->data;
-	u8 iv[32];
-
-	memset(iv, 0, sizeof(iv));
-
-	memcpy(iv, &e->iv, sizeof(e->iv));
-
-	return dst_crypto_process(req, sg_dst, sg_src, iv, e->enc, e->timeout);
-}
-
-static int dst_crypt(struct dst_crypto_engine *e, struct bio *bio)
-{
-	struct ablkcipher_request *req = e->data;
-
-	memset(req, 0, sizeof(struct ablkcipher_request));
-	ablkcipher_request_set_tfm(req, e->cipher);
-
-	if (e->enc)
-		return dst_trans_iter_out(bio, e, dst_crypt_iterator);
-	else
-		return dst_trans_iter_in(bio, e, dst_crypt_iterator);
-}
-
-static int dst_hash_iterator(struct dst_crypto_engine *e,
-		struct scatterlist *sg_dst, struct scatterlist *sg_src)
-{
-	return crypto_hash_update(e->data, sg_src, sg_src->length);
-}
-
-static int dst_hash(struct dst_crypto_engine *e, struct bio *bio, void *dst)
-{
-	struct hash_desc *desc = e->data;
-	int err;
-
-	desc->tfm = e->hash;
-	desc->flags = 0;
-
-	err = crypto_hash_init(desc);
-	if (err)
-		return err;
-
-	err = dst_trans_iter_in(bio, e, dst_hash_iterator);
-	if (err)
-		return err;
-
-	err = crypto_hash_final(desc, dst);
-	if (err)
-		return err;
-
-	return 0;
-}
-
-/*
- * Initialize/cleanup a crypto thread. The only thing it should
- * do is to allocate a pool of pages as temporary storage.
- * And to setup cipher and/or hash.
- */
-static void *dst_crypto_thread_init(void *data)
-{
-	struct dst_node *n = data;
-	struct dst_crypto_engine *e;
-	int err = -ENOMEM;
-
-	e = kzalloc(sizeof(struct dst_crypto_engine), GFP_KERNEL);
-	if (!e)
-		goto err_out_exit;
-	e->src = kcalloc(2 * n->max_pages, sizeof(struct scatterlist),
-			GFP_KERNEL);
-	if (!e->src)
-		goto err_out_free;
-
-	e->dst = e->src + n->max_pages;
-
-	err = dst_crypto_engine_init(e, n);
-	if (err)
-		goto err_out_free_all;
-
-	return e;
-
-err_out_free_all:
-	kfree(e->src);
-err_out_free:
-	kfree(e);
-err_out_exit:
-	return ERR_PTR(err);
-}
-
-static void dst_crypto_thread_cleanup(void *private)
-{
-	struct dst_crypto_engine *e = private;
-
-	dst_crypto_engine_exit(e);
-	kfree(e->src);
-	kfree(e);
-}
-
-/*
- * Initialize crypto engine for given node: store keys, create pool
- * of threads, initialize each one.
- *
- * Each thread has unique ID, but 0 and 1 are reserved for receiving and accepting
- * threads (if export node), so IDs could start from 2, but starting them
- * from 10 allows easily understand what this thread is for.
- */
-int dst_node_crypto_init(struct dst_node *n, struct dst_crypto_ctl *ctl)
-{
-	void *key = (ctl + 1);
-	int err = -ENOMEM, i;
-	char name[32];
-
-	if (ctl->hash_keysize) {
-		n->hash_key = kmalloc(ctl->hash_keysize, GFP_KERNEL);
-		if (!n->hash_key)
-			goto err_out_exit;
-		memcpy(n->hash_key, key, ctl->hash_keysize);
-	}
-
-	if (ctl->cipher_keysize) {
-		n->cipher_key = kmalloc(ctl->cipher_keysize, GFP_KERNEL);
-		if (!n->cipher_key)
-			goto err_out_free_hash;
-		memcpy(n->cipher_key, key, ctl->cipher_keysize);
-	}
-	memcpy(&n->crypto, ctl, sizeof(struct dst_crypto_ctl));
-
-	for (i=0; i<ctl->thread_num; ++i) {
-		snprintf(name, sizeof(name), "%s-crypto-%d", n->name, i);
-		/* Unique ids... */
-		err = thread_pool_add_worker(n->pool, name, i+10,
-			dst_crypto_thread_init, dst_crypto_thread_cleanup, n);
-		if (err)
-			goto err_out_free_threads;
-	}
-
-	return 0;
-
-err_out_free_threads:
-	while (--i >= 0)
-		thread_pool_del_worker_id(n->pool, i+10);
-
-	if (ctl->cipher_keysize)
-		kfree(n->cipher_key);
-	ctl->cipher_keysize = 0;
-err_out_free_hash:
-	if (ctl->hash_keysize)
-		kfree(n->hash_key);
-	ctl->hash_keysize = 0;
-err_out_exit:
-	return err;
-}
-
-void dst_node_crypto_exit(struct dst_node *n)
-{
-	struct dst_crypto_ctl *ctl = &n->crypto;
-
-	if (ctl->cipher_algo[0] || ctl->hash_algo[0]) {
-		kfree(n->hash_key);
-		kfree(n->cipher_key);
-	}
-}
-
-/*
- * Thrad pool setup callback. Just stores a transaction in private data.
- */
-static int dst_trans_crypto_setup(void *crypto_engine, void *trans)
-{
-	struct dst_crypto_engine *e = crypto_engine;
-
-	e->private = trans;
-	return 0;
-}
-
-#if 0
-static void dst_dump_bio(struct bio *bio)
-{
-	u8 *p;
-	struct bio_vec *bv;
-	int i;
-
-	bio_for_each_segment(bv, bio, i) {
-		dprintk("%s: %llu/%u: size: %u, offset: %u, data: ",
-				__func__, bio->bi_sector, bio->bi_size,
-				bv->bv_len, bv->bv_offset);
-
-		p = kmap(bv->bv_page) + bv->bv_offset;
-		for (i=0; i<bv->bv_len; ++i)
-			printk("%02x ", p[i]);
-		kunmap(bv->bv_page);
-		printk("\n");
-	}
-}
-#endif
-
-/*
- * Encrypt/hash data and send it to the network.
- */
-static int dst_crypto_process_sending(struct dst_crypto_engine *e,
-		struct bio *bio, u8 *hash)
-{
-	int err;
-
-	if (e->cipher) {
-		err = dst_crypt(e, bio);
-		if (err)
-			goto err_out_exit;
-	}
-
-	if (e->hash) {
-		err = dst_hash(e, bio, hash);
-		if (err)
-			goto err_out_exit;
-
-#ifdef CONFIG_DST_DEBUG
-		{
-			unsigned int i;
-
-			/* dst_dump_bio(bio); */
-
-			printk(KERN_DEBUG "%s: bio: %llu/%u, rw: %lu, hash: ",
-				__func__, (u64)bio->bi_sector,
-				bio->bi_size, bio_data_dir(bio));
-			for (i=0; i<crypto_hash_digestsize(e->hash); ++i)
-					printk("%02x ", hash[i]);
-			printk("\n");
-		}
-#endif
-	}
-
-	return 0;
-
-err_out_exit:
-	return err;
-}
-
-/*
- * Check if received data is valid. Decipher if it is.
- */
-static int dst_crypto_process_receiving(struct dst_crypto_engine *e,
-		struct bio *bio, u8 *hash, u8 *recv_hash)
-{
-	int err;
-
-	if (e->hash) {
-		int mismatch;
-
-		err = dst_hash(e, bio, hash);
-		if (err)
-			goto err_out_exit;
-
-		mismatch = !!memcmp(recv_hash, hash,
-				crypto_hash_digestsize(e->hash));
-#ifdef CONFIG_DST_DEBUG
-		/* dst_dump_bio(bio); */
-
-		printk(KERN_DEBUG "%s: bio: %llu/%u, rw: %lu, hash mismatch: %d",
-			__func__, (u64)bio->bi_sector, bio->bi_size,
-			bio_data_dir(bio), mismatch);
-		if (mismatch) {
-			unsigned int i;
-
-			printk(", recv/calc: ");
-			for (i=0; i<crypto_hash_digestsize(e->hash); ++i) {
-				printk("%02x/%02x ", recv_hash[i], hash[i]);
-			}
-		}
-		printk("\n");
-#endif
-		err = -1;
-		if (mismatch)
-			goto err_out_exit;
-	}
-
-	if (e->cipher) {
-		err = dst_crypt(e, bio);
-		if (err)
-			goto err_out_exit;
-	}
-
-	return 0;
-
-err_out_exit:
-	return err;
-}
-
-/*
- * Thread pool callback to encrypt data and send it to the netowork.
- */
-static int dst_trans_crypto_action(void *crypto_engine, void *schedule_data)
-{
-	struct dst_crypto_engine *e = crypto_engine;
-	struct dst_trans *t = schedule_data;
-	struct bio *bio = t->bio;
-	int err;
-
-	dprintk("%s: t: %p, gen: %llu, cipher: %p, hash: %p.\n",
-			__func__, t, t->gen, e->cipher, e->hash);
-
-	e->enc = t->enc;
-	e->iv = dst_gen_iv(t);
-
-	if (bio_data_dir(bio) == WRITE) {
-		err = dst_crypto_process_sending(e, bio, t->cmd.hash);
-		if (err)
-			goto err_out_exit;
-
-		if (e->hash) {
-			t->cmd.csize = crypto_hash_digestsize(e->hash);
-			t->cmd.size += t->cmd.csize;
-		}
-
-		return dst_trans_send(t);
-	} else {
-		u8 *hash = e->data + e->size/2;
-
-		err = dst_crypto_process_receiving(e, bio, hash, t->cmd.hash);
-		if (err)
-			goto err_out_exit;
-
-		dst_trans_remove(t);
-		dst_trans_put(t);
-	}
-
-	return 0;
-
-err_out_exit:
-	t->error = err;
-	dst_trans_put(t);
-	return err;
-}
-
-/*
- * Schedule crypto processing for given transaction.
- */
-int dst_trans_crypto(struct dst_trans *t)
-{
-	struct dst_node *n = t->n;
-	int err;
-
-	err = thread_pool_schedule(n->pool,
-		dst_trans_crypto_setup, dst_trans_crypto_action,
-		t, MAX_SCHEDULE_TIMEOUT);
-	if (err)
-		goto err_out_exit;
-
-	return 0;
-
-err_out_exit:
-	dst_trans_put(t);
-	return err;
-}
-
-/*
- * Crypto machinery for the export node.
- */
-static int dst_export_crypto_setup(void *crypto_engine, void *bio)
-{
-	struct dst_crypto_engine *e = crypto_engine;
-
-	e->private = bio;
-	return 0;
-}
-
-static int dst_export_crypto_action(void *crypto_engine, void *schedule_data)
-{
-	struct dst_crypto_engine *e = crypto_engine;
-	struct bio *bio = schedule_data;
-	struct dst_export_priv *p = bio->bi_private;
-	int err;
-
-	dprintk("%s: e: %p, data: %p, bio: %llu/%u, dir: %lu.\n", __func__,
-		e, e->data, (u64)bio->bi_sector, bio->bi_size, bio_data_dir(bio));
-
-	e->enc = (bio_data_dir(bio) == READ);
-	e->iv = p->cmd.id;
-
-	if (bio_data_dir(bio) == WRITE) {
-		u8 *hash = e->data + e->size/2;
-
-		err = dst_crypto_process_receiving(e, bio, hash, p->cmd.hash);
-		if (err)
-			goto err_out_exit;
-
-		generic_make_request(bio);
-	} else {
-		err = dst_crypto_process_sending(e, bio, p->cmd.hash);
-		if (err)
-			goto err_out_exit;
-
-		if (e->hash) {
-			p->cmd.csize = crypto_hash_digestsize(e->hash);
-			p->cmd.size += p->cmd.csize;
-		}
-
-		err = dst_export_send_bio(bio);
-	}
-	return 0;
-
-err_out_exit:
-	bio_put(bio);
-	return err;
-}
-
-int dst_export_crypto(struct dst_node *n, struct bio *bio)
-{
-	int err;
-
-	err = thread_pool_schedule(n->pool,
-		dst_export_crypto_setup, dst_export_crypto_action,
-		bio, MAX_SCHEDULE_TIMEOUT);
-	if (err)
-		goto err_out_exit;
-
-	return 0;
-
-err_out_exit:
-	bio_put(bio);
-	return err;
-}
diff --git a/drivers/staging/dst/dcore.c b/drivers/staging/dst/dcore.c
deleted file mode 100644
index c24e4e0367a2..000000000000
--- a/drivers/staging/dst/dcore.c
+++ /dev/null
@@ -1,1000 +0,0 @@
-/*
- * 2007+ Copyright (c) Evgeniy Polyakov <zbr@ioremap.net>
- * All rights reserved.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- */
-
-#include <linux/module.h>
-#include <linux/kernel.h>
-#include <linux/blkdev.h>
-#include <linux/bio.h>
-#include <linux/buffer_head.h>
-#include <linux/connector.h>
-#include <linux/dst.h>
-#include <linux/device.h>
-#include <linux/jhash.h>
-#include <linux/idr.h>
-#include <linux/init.h>
-#include <linux/namei.h>
-#include <linux/slab.h>
-#include <linux/socket.h>
-
-#include <linux/in.h>
-#include <linux/in6.h>
-
-#include <net/sock.h>
-
-static int dst_major;
-
-static DEFINE_MUTEX(dst_hash_lock);
-static struct list_head *dst_hashtable;
-static unsigned int dst_hashtable_size = 128;
-module_param(dst_hashtable_size, uint, 0644);
-
-static char dst_name[] = "Dementianting goldfish";
-
-static DEFINE_IDR(dst_index_idr);
-static struct cb_id cn_dst_id = { CN_DST_IDX, CN_DST_VAL };
-
-/*
- * DST sysfs tree for device called 'storage':
- *
- * /sys/bus/dst/devices/storage/
- * /sys/bus/dst/devices/storage/type : 192.168.4.80:1025
- * /sys/bus/dst/devices/storage/size : 800
- * /sys/bus/dst/devices/storage/name : storage
- */
-
-static int dst_dev_match(struct device *dev, struct device_driver *drv)
-{
-	return 1;
-}
-
-static struct bus_type dst_dev_bus_type = {
-	.name 		= "dst",
-	.match 		= &dst_dev_match,
-};
-
-static void dst_node_release(struct device *dev)
-{
-	struct dst_info *info = container_of(dev, struct dst_info, device);
-
-	kfree(info);
-}
-
-static struct device dst_node_dev = {
-	.bus 		= &dst_dev_bus_type,
-	.release 	= &dst_node_release
-};
-
-/*
- * Setting size of the node after it was changed.
- */
-static void dst_node_set_size(struct dst_node *n)
-{
-	struct block_device *bdev;
-
-	set_capacity(n->disk, n->size >> 9);
-
-	bdev = bdget_disk(n->disk, 0);
-	if (bdev) {
-		mutex_lock(&bdev->bd_inode->i_mutex);
-		i_size_write(bdev->bd_inode, n->size);
-		mutex_unlock(&bdev->bd_inode->i_mutex);
-		bdput(bdev);
-	}
-}
-
-/*
- * Distributed storage request processing function.
- */
-static int dst_request(struct request_queue *q, struct bio *bio)
-{
-	struct dst_node *n = q->queuedata;
-	int err = -EIO;
-
-	if (bio_empty_barrier(bio) && !blk_queue_discard(q)) {
-		/*
-		 * This is a dirty^Wnice hack, but if we complete this
-		 * operation with -EOPNOTSUPP like intended, XFS
-		 * will stuck and freeze the machine. This may be
-		 * not particulary XFS problem though, but it is the
-		 * only FS which sends empty barrier at umount time
-		 * I worked with.
-		 *
-		 * Empty barriers are not allowed anyway, see 51fd77bd9f512
-		 * for example, although later it was changed to
-		 * bio_rw_flagged(bio, BIO_RW_DISCARD) only, which does not
-		 * work in this case.
-		 */
-		//err = -EOPNOTSUPP;
-		err = 0;
-		goto end_io;
-	}
-
-	bio_get(bio);
-
-	return dst_process_bio(n, bio);
-
-end_io:
-	bio_endio(bio, err);
-	return err;
-}
-
-/*
- * Open/close callbacks for appropriate block device.
- */
-static int dst_bdev_open(struct block_device *bdev, fmode_t mode)
-{
-	struct dst_node *n = bdev->bd_disk->private_data;
-
-	dst_node_get(n);
-	return 0;
-}
-
-static int dst_bdev_release(struct gendisk *disk, fmode_t mode)
-{
-	struct dst_node *n = disk->private_data;
-
-	dst_node_put(n);
-	return 0;
-}
-
-static struct block_device_operations dst_blk_ops = {
-	.open		= dst_bdev_open,
-	.release	= dst_bdev_release,
-	.owner		= THIS_MODULE,
-};
-
-/*
- * Block layer binding - disk is created when array is fully configured
- * by userspace request.
- */
-static int dst_node_create_disk(struct dst_node *n)
-{
-	int err = -ENOMEM;
-	u32 index = 0;
-
-	n->queue = blk_init_queue(NULL, NULL);
-	if (!n->queue)
-		goto err_out_exit;
-
-	n->queue->queuedata = n;
-	blk_queue_make_request(n->queue, dst_request);
-	blk_queue_max_phys_segments(n->queue, n->max_pages);
-	blk_queue_max_hw_segments(n->queue, n->max_pages);
-
-	err = -ENOMEM;
-	n->disk = alloc_disk(1);
-	if (!n->disk)
-		goto err_out_free_queue;
-
-	if (!(n->state->permissions & DST_PERM_WRITE)) {
-		printk(KERN_INFO "DST node %s attached read-only.\n", n->name);
-		set_disk_ro(n->disk, 1);
-	}
-
-	if (!idr_pre_get(&dst_index_idr, GFP_KERNEL))
-		goto err_out_put;
-
-	mutex_lock(&dst_hash_lock);
-	err = idr_get_new(&dst_index_idr, NULL, &index);
-	mutex_unlock(&dst_hash_lock);
-	if (err)
-		goto err_out_put;
-
-	n->disk->major = dst_major;
-	n->disk->first_minor = index;
-	n->disk->fops = &dst_blk_ops;
-	n->disk->queue = n->queue;
-	n->disk->private_data = n;
-	snprintf(n->disk->disk_name, sizeof(n->disk->disk_name), "dst-%s", n->name);
-
-	return 0;
-
-err_out_put:
-	put_disk(n->disk);
-err_out_free_queue:
-	blk_cleanup_queue(n->queue);
-err_out_exit:
-	return err;
-}
-
-/*
- * Sysfs machinery: show device's size.
- */
-static ssize_t dst_show_size(struct device *dev,
-		struct device_attribute *attr, char *buf)
-{
-	struct dst_info *info = container_of(dev, struct dst_info, device);
-
-	return sprintf(buf, "%llu\n", info->size);
-}
-
-/*
- * Show local exported device.
- */
-static ssize_t dst_show_local(struct device *dev,
-		struct device_attribute *attr, char *buf)
-{
-	struct dst_info *info = container_of(dev, struct dst_info, device);
-
-	return sprintf(buf, "%s\n", info->local);
-}
-
-/*
- * Shows type of the remote node - device major/minor number
- * for local nodes and address (af_inet ipv4/ipv6 only) for remote nodes.
- */
-static ssize_t dst_show_type(struct device *dev,
-		struct device_attribute *attr, char *buf)
-{
-	struct dst_info *info = container_of(dev, struct dst_info, device);
-	int family = info->net.addr.sa_family;
-
-	if (family == AF_INET) {
-		struct sockaddr_in *sin = (struct sockaddr_in *)&info->net.addr;
-		return sprintf(buf, "%u.%u.%u.%u:%d\n",
-			NIPQUAD(sin->sin_addr.s_addr), ntohs(sin->sin_port));
-	} else if (family == AF_INET6) {
-		struct sockaddr_in6 *sin = (struct sockaddr_in6 *)&info->net.addr;
-		return sprintf(buf,
-			"%pi6:%d\n",
-			&sin->sin6_addr, ntohs(sin->sin6_port));
-	} else {
-		int i, sz = PAGE_SIZE - 2; /* 0 symbol and '\n' below */
-		int size, addrlen = info->net.addr.sa_data_len;
-		unsigned char *a = (unsigned char *)&info->net.addr.sa_data;
-		char *buf_orig = buf;
-
-		size = snprintf(buf, sz, "family: %d, addrlen: %u, addr: ",
-				family, addrlen);
-		sz -= size;
-		buf += size;
-
-		for (i=0; i<addrlen; ++i) {
-			if (sz < 3)
-				break;
-
-			size = snprintf(buf, sz, "%02x ", a[i]);
-			sz -= size;
-			buf += size;
-		}
-		buf += sprintf(buf, "\n");
-
-		return buf - buf_orig;
-	}
-	return 0;
-}
-
-static struct device_attribute dst_node_attrs[] = {
-	__ATTR(size, 0444, dst_show_size, NULL),
-	__ATTR(type, 0444, dst_show_type, NULL),
-	__ATTR(local, 0444, dst_show_local, NULL),
-};
-
-static int dst_create_node_attributes(struct dst_node *n)
-{
-	int err, i;
-
-	for (i=0; i<ARRAY_SIZE(dst_node_attrs); ++i) {
-		err = device_create_file(&n->info->device,
-				&dst_node_attrs[i]);
-		if (err)
-			goto err_out_remove_all;
-	}
-	return 0;
-
-err_out_remove_all:
-	while (--i >= 0)
-		device_remove_file(&n->info->device,
-				&dst_node_attrs[i]);
-
-	return err;
-}
-
-static void dst_remove_node_attributes(struct dst_node *n)
-{
-	int i;
-
-	for (i=0; i<ARRAY_SIZE(dst_node_attrs); ++i)
-		device_remove_file(&n->info->device,
-				&dst_node_attrs[i]);
-}
-
-/*
- * Sysfs cleanup and initialization.
- * Shows number of useful parameters.
- */
-static void dst_node_sysfs_exit(struct dst_node *n)
-{
-	if (n->info) {
-		dst_remove_node_attributes(n);
-		device_unregister(&n->info->device);
-		n->info = NULL;
-	}
-}
-
-static int dst_node_sysfs_init(struct dst_node *n)
-{
-	int err;
-
-	n->info = kzalloc(sizeof(struct dst_info), GFP_KERNEL);
-	if (!n->info)
-		return -ENOMEM;
-
-	memcpy(&n->info->device, &dst_node_dev, sizeof(struct device));
-	n->info->size = n->size;
-
-	dev_set_name(&n->info->device, "dst-%s", n->name);
-	err = device_register(&n->info->device);
-	if (err) {
-		dprintk(KERN_ERR "Failed to register node '%s', err: %d.\n",
-				n->name, err);
-		goto err_out_exit;
-	}
-
-	dst_create_node_attributes(n);
-
-	return 0;
-
-err_out_exit:
-	kfree(n->info);
-	n->info = NULL;
-	return err;
-}
-
-/*
- * DST node hash tables machinery.
- */
-static inline unsigned int dst_hash(char *str, unsigned int size)
-{
-	return (jhash(str, size, 0) % dst_hashtable_size);
-}
-
-static void dst_node_remove(struct dst_node *n)
-{
-	mutex_lock(&dst_hash_lock);
-	list_del_init(&n->node_entry);
-	mutex_unlock(&dst_hash_lock);
-}
-
-static void dst_node_add(struct dst_node *n)
-{
-	unsigned hash = dst_hash(n->name, sizeof(n->name));
-
-	mutex_lock(&dst_hash_lock);
-	list_add_tail(&n->node_entry, &dst_hashtable[hash]);
-	mutex_unlock(&dst_hash_lock);
-}
-
-/*
- * Cleaning node when it is about to be freed.
- * There are still users of the socket though,
- * so connection cleanup should be protected.
- */
-static void dst_node_cleanup(struct dst_node *n)
-{
-	struct dst_state *st = n->state;
-
-	if (!st)
-		return;
-
-	if (n->queue) {
-		blk_cleanup_queue(n->queue);
-
-		mutex_lock(&dst_hash_lock);
-		idr_remove(&dst_index_idr, n->disk->first_minor);
-		mutex_unlock(&dst_hash_lock);
-
-		put_disk(n->disk);
-	}
-
-	if (n->bdev) {
-		sync_blockdev(n->bdev);
-		blkdev_put(n->bdev, FMODE_READ|FMODE_WRITE);
-	}
-
-	dst_state_lock(st);
-	st->need_exit = 1;
-	dst_state_exit_connected(st);
-	dst_state_unlock(st);
-
-	wake_up(&st->thread_wait);
-
-	dst_state_put(st);
-	n->state = NULL;
-}
-
-/*
- * Free security attributes attached to given node.
- */
-static void dst_security_exit(struct dst_node *n)
-{
-	struct dst_secure *s, *tmp;
-
-	list_for_each_entry_safe(s, tmp, &n->security_list, sec_entry) {
-		list_del(&s->sec_entry);
-		kfree(s);
-	}
-}
-
-/*
- * Free node when there are no more users.
- * Actually node has to be freed on behalf od userspace process,
- * since there are number of threads, which are embedded in the
- * node, so they can not exit and free node from there, that is
- * why there is a wakeup if reference counter is not equal to zero.
- */
-void dst_node_put(struct dst_node *n)
-{
-	if (unlikely(!n))
-		return;
-
-	dprintk("%s: n: %p, refcnt: %d.\n",
-			__func__, n, atomic_read(&n->refcnt));
-
-	if (atomic_dec_and_test(&n->refcnt)) {
-		dst_node_remove(n);
-		n->trans_scan_timeout = 0;
-		dst_node_cleanup(n);
-		thread_pool_destroy(n->pool);
-		dst_node_sysfs_exit(n);
-		dst_node_crypto_exit(n);
-		dst_security_exit(n);
-		dst_node_trans_exit(n);
-
-		kfree(n);
-
-		dprintk("%s: freed n: %p.\n", __func__, n);
-	} else {
-		wake_up(&n->wait);
-	}
-}
-
-/*
- * This function finds devices major/minor numbers for given pathname.
- */
-static int dst_lookup_device(const char *path, dev_t *dev)
-{
-	int err;
-	struct nameidata nd;
-	struct inode *inode;
-
-	err = path_lookup(path, LOOKUP_FOLLOW, &nd);
-	if (err)
-		return err;
-
-	inode = nd.path.dentry->d_inode;
-	if (!inode) {
-		err = -ENOENT;
-		goto out;
-	}
-
-	if (!S_ISBLK(inode->i_mode)) {
-		err = -ENOTBLK;
-		goto out;
-	}
-
-	*dev = inode->i_rdev;
-
-out:
-	path_put(&nd.path);
-	return err;
-}
-
-/*
- * Setting up export device: lookup by the name, get its size
- * and setup listening socket, which will accept clients, which
- * will submit IO for given storage.
- */
-static int dst_setup_export(struct dst_node *n, struct dst_ctl *ctl,
-		struct dst_export_ctl *le)
-{
-	int err;
-	dev_t dev = 0; /* gcc likes to scream here */
-
-	snprintf(n->info->local, sizeof(n->info->local), "%s", le->device);
-
-	err = dst_lookup_device(le->device, &dev);
-	if (err)
-		return err;
-
-	n->bdev = open_by_devnum(dev, FMODE_READ|FMODE_WRITE);
-	if (!n->bdev)
-		return -ENODEV;
-
-	if (n->size != 0)
-		n->size = min_t(loff_t, n->bdev->bd_inode->i_size, n->size);
-	else
-		n->size = n->bdev->bd_inode->i_size;
-
-	n->info->size = n->size;
-	err = dst_node_init_listened(n, le);
-	if (err)
-		goto err_out_cleanup;
-
-	return 0;
-
-err_out_cleanup:
-	blkdev_put(n->bdev, FMODE_READ|FMODE_WRITE);
-	n->bdev = NULL;
-
-	return err;
-}
-
-/* Empty thread pool callbacks for the network processing threads. */
-static inline void *dst_thread_network_init(void *data)
-{
-	dprintk("%s: data: %p.\n", __func__, data);
-	return data;
-}
-
-static inline void dst_thread_network_cleanup(void *data)
-{
-	dprintk("%s: data: %p.\n", __func__, data);
-}
-
-/*
- * Allocate DST node and initialize some of its parameters.
- */
-static struct dst_node *dst_alloc_node(struct dst_ctl *ctl,
-		int (*start)(struct dst_node *),
-		int num)
-{
-	struct dst_node *n;
-	int err;
-
-	n = kzalloc(sizeof(struct dst_node), GFP_KERNEL);
-	if (!n)
-		return NULL;
-
-	INIT_LIST_HEAD(&n->node_entry);
-
-	INIT_LIST_HEAD(&n->security_list);
-	mutex_init(&n->security_lock);
-
-	init_waitqueue_head(&n->wait);
-
-	n->trans_scan_timeout = msecs_to_jiffies(ctl->trans_scan_timeout);
-	if (!n->trans_scan_timeout)
-		n->trans_scan_timeout = HZ;
-
-	n->trans_max_retries = ctl->trans_max_retries;
-	if (!n->trans_max_retries)
-		n->trans_max_retries = 10;
-
-	/*
-	 * Pretty much arbitrary default numbers.
-	 * 32 matches maximum number of pages in bio originated from ext3 (31).
-	 */
-	n->max_pages = ctl->max_pages;
-	if (!n->max_pages)
-		n->max_pages = 32;
-
-	if (n->max_pages > 1024)
-		n->max_pages = 1024;
-
-	n->start = start;
-	n->size = ctl->size;
-
-	atomic_set(&n->refcnt, 1);
-	atomic_long_set(&n->gen, 0);
-	snprintf(n->name, sizeof(n->name), "%s", ctl->name);
-
-	err = dst_node_sysfs_init(n);
-	if (err)
-		goto err_out_free;
-
-	n->pool = thread_pool_create(num, n->name, dst_thread_network_init,
-			dst_thread_network_cleanup, n);
-	if (IS_ERR(n->pool)) {
-		err = PTR_ERR(n->pool);
-		goto err_out_sysfs_exit;
-	}
-
-	dprintk("%s: n: %p, name: %s.\n", __func__, n, n->name);
-
-	return n;
-
-err_out_sysfs_exit:
-	dst_node_sysfs_exit(n);
-err_out_free:
-	kfree(n);
-	return NULL;
-}
-
-/*
- * Starting a node, connected to the remote server:
- * register block device and initialize transaction mechanism.
- * In revers order though.
- *
- * It will autonegotiate some parameters with the remote node
- * and update local if needed.
- *
- * Transaction initialization should be the last thing before
- * starting the node, since transaction should include not only
- * block IO, but also crypto related data (if any), which are
- * initialized separately.
- */
-static int dst_start_remote(struct dst_node *n)
-{
-	int err;
-
-	err = dst_node_trans_init(n, sizeof(struct dst_trans));
-	if (err)
-		return err;
-
-	err = dst_node_create_disk(n);
-	if (err)
-		return err;
-
-	dst_node_set_size(n);
-	add_disk(n->disk);
-
-	dprintk("DST: started remote node '%s', minor: %d.\n", n->name, n->disk->first_minor);
-
-	return 0;
-}
-
-/*
- * Adding remote node and initialize connection.
- */
-static int dst_add_remote(struct dst_node *n, struct dst_ctl *ctl,
-		void *data, unsigned int size)
-{
-	int err;
-	struct dst_network_ctl *rctl = data;
-
-	if (n)
-		return -EEXIST;
-
-	if (size != sizeof(struct dst_network_ctl))
-		return -EINVAL;
-
-	n = dst_alloc_node(ctl, dst_start_remote, 1);
-	if (!n)
-		return -ENOMEM;
-
-	memcpy(&n->info->net, rctl, sizeof(struct dst_network_ctl));
-	err = dst_node_init_connected(n, rctl);
-	if (err)
-		goto err_out_free;
-
-	dst_node_add(n);
-
-	return 0;
-
-err_out_free:
-	dst_node_put(n);
-	return err;
-}
-
-/*
- * Adding export node: initializing block device and listening socket.
- */
-static int dst_add_export(struct dst_node *n, struct dst_ctl *ctl,
-		void *data, unsigned int size)
-{
-	int err;
-	struct dst_export_ctl *le = data;
-
-	if (n)
-		return -EEXIST;
-
-	if (size != sizeof(struct dst_export_ctl))
-		return -EINVAL;
-
-	n = dst_alloc_node(ctl, dst_start_export, 2);
-	if (!n)
-		return -EINVAL;
-
-	err = dst_setup_export(n, ctl, le);
-	if (err)
-		goto err_out_free;
-
-	dst_node_add(n);
-
-	return 0;
-
-err_out_free:
-	dst_node_put(n);
-	return err;
-}
-
-static int dst_node_remove_unload(struct dst_node *n)
-{
-	printk(KERN_INFO "STOPPED name: '%s', size: %llu.\n",
-			n->name, n->size);
-
-	if (n->disk)
-		del_gendisk(n->disk);
-
-	dst_node_remove(n);
-	dst_node_sysfs_exit(n);
-
-	/*
-	 * This is not a hack. Really.
-	 * Node's reference counter allows to implement fine grained
-	 * node freeing, but since all transactions (which hold node's
-	 * reference counter) are processed in the dedicated thread,
-	 * it is possible that reference will hit zero in that thread,
-	 * so we will not be able to exit thread and cleanup the node.
-	 *
-	 * So, we remove disk, so no new activity is possible, and
-	 * wait until all pending transaction are completed (either
-	 * in receiving thread or by timeout in workqueue), in this
-	 * case reference counter will be less or equal to 2 (once set in
-	 * dst_alloc_node() and then in connector message parser;
-	 * or when we force module unloading, and connector message
-	 * parser does not hold a reference, in this case reference
-	 * counter will be equal to 1),
-	 * and subsequent dst_node_put() calls will free the node.
-	 */
-	dprintk("%s: going to sleep with %d refcnt.\n", __func__, atomic_read(&n->refcnt));
-	wait_event(n->wait, atomic_read(&n->refcnt) <= 2);
-
-	dst_node_put(n);
-	return 0;
-}
-
-/*
- * Remove node from the hash table.
- */
-static int dst_del_node(struct dst_node *n, struct dst_ctl *ctl,
-		void *data, unsigned int size)
-{
-	if (!n)
-		return -ENODEV;
-
-	return dst_node_remove_unload(n);
-}
-
-/*
- * Initialize crypto processing for given node.
- */
-static int dst_crypto_init(struct dst_node *n, struct dst_ctl *ctl,
-		void *data, unsigned int size)
-{
-	struct dst_crypto_ctl *crypto = data;
-
-	if (!n)
-		return -ENODEV;
-
-	if (size != sizeof(struct dst_crypto_ctl) + crypto->hash_keysize +
-			crypto->cipher_keysize)
-		return -EINVAL;
-
-	if (n->trans_cache)
-		return -EEXIST;
-
-	return dst_node_crypto_init(n, crypto);
-}
-
-/*
- * Security attributes for given node.
- */
-static int dst_security_init(struct dst_node *n, struct dst_ctl *ctl,
-		void *data, unsigned int size)
-{
-	struct dst_secure *s;
-
-	if (!n)
-		return -ENODEV;
-
-	if (size != sizeof(struct dst_secure_user))
-		return -EINVAL;
-
-	s = kmalloc(sizeof(struct dst_secure), GFP_KERNEL);
-	if (!s)
-		return -ENOMEM;
-
-	memcpy(&s->sec, data, size);
-
-	mutex_lock(&n->security_lock);
-	list_add_tail(&s->sec_entry, &n->security_list);
-	mutex_unlock(&n->security_lock);
-
-	return 0;
-}
-
-/*
- * Kill'em all!
- */
-static int dst_start_node(struct dst_node *n, struct dst_ctl *ctl,
-		void *data, unsigned int size)
-{
-	int err;
-
-	if (!n)
-		return -ENODEV;
-
-	if (n->trans_cache)
-		return 0;
-
-	err = n->start(n);
-	if (err)
-		return err;
-
-	printk(KERN_INFO "STARTED name: '%s', size: %llu.\n", n->name, n->size);
-	return 0;
-}
-
-typedef int (*dst_command_func)(struct dst_node *n, struct dst_ctl *ctl,
-		void *data, unsigned int size);
-
-/*
- * List of userspace commands.
- */
-static dst_command_func dst_commands[] = {
-	[DST_ADD_REMOTE] = &dst_add_remote,
-	[DST_ADD_EXPORT] = &dst_add_export,
-	[DST_DEL_NODE] = &dst_del_node,
-	[DST_CRYPTO] = &dst_crypto_init,
-	[DST_SECURITY] = &dst_security_init,
-	[DST_START] = &dst_start_node,
-};
-
-/*
- * Configuration parser.
- */
-static void cn_dst_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp)
-{
-	struct dst_ctl *ctl;
-	int err;
-	struct dst_ctl_ack ack;
-	struct dst_node *n = NULL, *tmp;
-	unsigned int hash;
-
-	if (!cap_raised(nsp->eff_cap, CAP_SYS_ADMIN)) {
-		err = -EPERM;
-		goto out;
-	}
-
-	if (msg->len < sizeof(struct dst_ctl)) {
-		err = -EBADMSG;
-		goto out;
-	}
-
-	ctl = (struct dst_ctl *)msg->data;
-
-	if (ctl->cmd >= DST_CMD_MAX) {
-		err = -EINVAL;
-		goto out;
-	}
-	hash = dst_hash(ctl->name, sizeof(ctl->name));
-
-	mutex_lock(&dst_hash_lock);
-	list_for_each_entry(tmp, &dst_hashtable[hash], node_entry) {
-		if (!memcmp(tmp->name, ctl->name, sizeof(tmp->name))) {
-			n = tmp;
-			dst_node_get(n);
-			break;
-		}
-	}
-	mutex_unlock(&dst_hash_lock);
-
-	err = dst_commands[ctl->cmd](n, ctl, msg->data + sizeof(struct dst_ctl),
-			msg->len - sizeof(struct dst_ctl));
-
-	dst_node_put(n);
-out:
-	memcpy(&ack.msg, msg, sizeof(struct cn_msg));
-
-	ack.msg.ack = msg->ack + 1;
-	ack.msg.len = sizeof(struct dst_ctl_ack) - sizeof(struct cn_msg);
-
-	ack.error = err;
-
-	cn_netlink_send(&ack.msg, 0, GFP_KERNEL);
-}
-
-/*
- * Global initialization: sysfs, hash table, block device registration,
- * connector and various caches.
- */
-static int __init dst_sysfs_init(void)
-{
-	return bus_register(&dst_dev_bus_type);
-}
-
-static void dst_sysfs_exit(void)
-{
-	bus_unregister(&dst_dev_bus_type);
-}
-
-static int __init dst_hashtable_init(void)
-{
-	unsigned int i;
-
-	dst_hashtable = kcalloc(dst_hashtable_size, sizeof(struct list_head),
-			GFP_KERNEL);
-	if (!dst_hashtable)
-		return -ENOMEM;
-
-	for (i=0; i<dst_hashtable_size; ++i)
-		INIT_LIST_HEAD(&dst_hashtable[i]);
-
-	return 0;
-}
-
-static void dst_hashtable_exit(void)
-{
-	unsigned int i;
-	struct dst_node *n, *tmp;
-
-	for (i=0; i<dst_hashtable_size; ++i) {
-		list_for_each_entry_safe(n, tmp, &dst_hashtable[i], node_entry) {
-			dst_node_remove_unload(n);
-		}
-	}
-
-	kfree(dst_hashtable);
-}
-
-static int __init dst_sys_init(void)
-{
-	int err = -ENOMEM;
-
-	err = dst_hashtable_init();
-	if (err)
-		goto err_out_exit;
-
-	err = dst_export_init();
-	if (err)
-		goto err_out_hashtable_exit;
-
-	err = register_blkdev(dst_major, DST_NAME);
-	if (err < 0)
-		goto err_out_export_exit;
-	if (err)
-		dst_major = err;
-
-	err = dst_sysfs_init();
-	if (err)
-		goto err_out_unregister;
-
-	err = cn_add_callback(&cn_dst_id, "DST", cn_dst_callback);
-	if (err)
-		goto err_out_sysfs_exit;
-
-	printk(KERN_INFO "Distributed storage, '%s' release.\n", dst_name);
-
-	return 0;
-
-err_out_sysfs_exit:
-	dst_sysfs_exit();
-err_out_unregister:
-	unregister_blkdev(dst_major, DST_NAME);
-err_out_export_exit:
-	dst_export_exit();
-err_out_hashtable_exit:
-	dst_hashtable_exit();
-err_out_exit:
-	return err;
-}
-
-static void __exit dst_sys_exit(void)
-{
-	cn_del_callback(&cn_dst_id);
-	unregister_blkdev(dst_major, DST_NAME);
-	dst_hashtable_exit();
-	dst_sysfs_exit();
-	dst_export_exit();
-}
-
-module_init(dst_sys_init);
-module_exit(dst_sys_exit);
-
-MODULE_DESCRIPTION("Distributed storage");
-MODULE_AUTHOR("Evgeniy Polyakov <zbr@ioremap.net>");
-MODULE_LICENSE("GPL");
diff --git a/drivers/staging/dst/export.c b/drivers/staging/dst/export.c
deleted file mode 100644
index 4fbd848bd14f..000000000000
--- a/drivers/staging/dst/export.c
+++ /dev/null
@@ -1,657 +0,0 @@
-/*
- * 2007+ Copyright (c) Evgeniy Polyakov <zbr@ioremap.net>
- * All rights reserved.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- */
-
-#include <linux/blkdev.h>
-#include <linux/bio.h>
-#include <linux/dst.h>
-#include <linux/in.h>
-#include <linux/in6.h>
-#include <linux/poll.h>
-#include <linux/slab.h>
-#include <linux/socket.h>
-
-#include <net/sock.h>
-
-/*
- * Export bioset is used for server block IO requests.
- */
-static struct bio_set *dst_bio_set;
-
-int __init dst_export_init(void)
-{
-	int err = -ENOMEM;
-
-	dst_bio_set = bioset_create(32, sizeof(struct dst_export_priv));
-	if (!dst_bio_set)
-		goto err_out_exit;
-
-	return 0;
-
-err_out_exit:
-	return err;
-}
-
-void dst_export_exit(void)
-{
-	bioset_free(dst_bio_set);
-}
-
-/*
- * When client connects and autonegotiates with the server node,
- * its permissions are checked in a security attributes and sent
- * back.
- */
-static unsigned int dst_check_permissions(struct dst_state *main, struct dst_state *st)
-{
-	struct dst_node *n = main->node;
-	struct dst_secure *sentry;
-	struct dst_secure_user *s;
-	struct saddr *sa = &st->ctl.addr;
-	unsigned int perm = 0;
-
-	mutex_lock(&n->security_lock);
-	list_for_each_entry(sentry, &n->security_list, sec_entry) {
-		s = &sentry->sec;
-
-		if (s->addr.sa_family != sa->sa_family)
-			continue;
-
-		if (s->addr.sa_data_len != sa->sa_data_len)
-			continue;
-
-		/*
-		 * This '2' below is a port field. This may be very wrong to do
-		 * in atalk for example though. If there will be any need to extent
-		 * protocol to something else, I can create per-family helpers and
-		 * use them instead of this memcmp.
-		 */
-		if (memcmp(s->addr.sa_data + 2, sa->sa_data + 2,
-					sa->sa_data_len - 2))
-			continue;
-
-		perm = s->permissions;
-	}
-	mutex_unlock(&n->security_lock);
-
-	return perm;
-}
-
-/*
- * Accept new client: allocate appropriate network state and check permissions.
- */
-static struct dst_state *dst_accept_client(struct dst_state *st)
-{
-	unsigned int revents = 0;
-	unsigned int err_mask = POLLERR | POLLHUP | POLLRDHUP;
-	unsigned int mask = err_mask | POLLIN;
-	struct dst_node *n = st->node;
-	int err = 0;
-	struct socket *sock = NULL;
-	struct dst_state *new;
-
-	while (!err && !sock) {
-		revents = dst_state_poll(st);
-
-		if (!(revents & mask)) {
-			DEFINE_WAIT(wait);
-
-			for (;;) {
-				prepare_to_wait(&st->thread_wait,
-						&wait, TASK_INTERRUPTIBLE);
-				if (!n->trans_scan_timeout || st->need_exit)
-					break;
-
-				revents = dst_state_poll(st);
-
-				if (revents & mask)
-					break;
-
-				if (signal_pending(current))
-					break;
-
-				/*
-				 * Magic HZ? Polling check above is not safe in
-				 * all cases (like socket reset in BH context),
-				 * so it is simpler just to postpone it to the
-				 * process context instead of implementing special
-				 * locking there.
-				 */
-				schedule_timeout(HZ);
-			}
-			finish_wait(&st->thread_wait, &wait);
-		}
-
-		err = -ECONNRESET;
-		dst_state_lock(st);
-
-		dprintk("%s: st: %p, revents: %x [err: %d, in: %d].\n",
-			__func__, st, revents, revents & err_mask,
-			revents & POLLIN);
-
-		if (revents & err_mask) {
-			dprintk("%s: revents: %x, socket: %p, err: %d.\n",
-					__func__, revents, st->socket, err);
-			err = -ECONNRESET;
-		}
-
-		if (!n->trans_scan_timeout || st->need_exit)
-			err = -ENODEV;
-
-		if (st->socket && (revents & POLLIN))
-			err = kernel_accept(st->socket, &sock, 0);
-
-		dst_state_unlock(st);
-	}
-
-	if (err)
-		goto err_out_exit;
-
-	new = dst_state_alloc(st->node);
-	if (IS_ERR(new)) {
-		err = -ENOMEM;
-		goto err_out_release;
-	}
-	new->socket = sock;
-
-	new->ctl.addr.sa_data_len = sizeof(struct sockaddr);
-	err = kernel_getpeername(sock, (struct sockaddr *)&new->ctl.addr,
-			(int *)&new->ctl.addr.sa_data_len);
-	if (err)
-		goto err_out_put;
-
-	new->permissions = dst_check_permissions(st, new);
-	if (new->permissions == 0) {
-		err = -EPERM;
-		dst_dump_addr(sock, (struct sockaddr *)&new->ctl.addr,
-				"Client is not allowed to connect");
-		goto err_out_put;
-	}
-
-	err = dst_poll_init(new);
-	if (err)
-		goto err_out_put;
-
-	dst_dump_addr(sock, (struct sockaddr *)&new->ctl.addr,
-			"Connected client");
-
-	return new;
-
-err_out_put:
-	dst_state_put(new);
-err_out_release:
-	sock_release(sock);
-err_out_exit:
-	return ERR_PTR(err);
-}
-
-/*
- * Each server's block request sometime finishes.
- * Usually it happens in hard irq context of the appropriate controller,
- * so to play good with all cases we just queue BIO into the queue
- * and wake up processing thread, which gets completed request and
- * send (encrypting if needed) it back to the client (if it was a read
- * request), or sends back reply that writing succesfully completed.
- */
-static int dst_export_process_request_queue(struct dst_state *st)
-{
-	unsigned long flags;
-	struct dst_export_priv *p = NULL;
-	struct bio *bio;
-	int err = 0;
-
-	while (!list_empty(&st->request_list)) {
-		spin_lock_irqsave(&st->request_lock, flags);
-		if (!list_empty(&st->request_list)) {
-			p = list_first_entry(&st->request_list,
-				struct dst_export_priv, request_entry);
-			list_del(&p->request_entry);
-		}
-		spin_unlock_irqrestore(&st->request_lock, flags);
-
-		if (!p)
-			break;
-
-		bio = p->bio;
-
-		if (dst_need_crypto(st->node) && (bio_data_dir(bio) == READ))
-			err = dst_export_crypto(st->node, bio);
-		else
-			err = dst_export_send_bio(bio);
-
-		if (err)
-			break;
-	}
-
-	return err;
-}
-
-/*
- * Cleanup export state.
- * It has to wait until all requests are finished,
- * and then free them all.
- */
-static void dst_state_cleanup_export(struct dst_state *st)
-{
-	struct dst_export_priv *p;
-	unsigned long flags;
-
-	/*
-	 * This loop waits for all pending bios to be completed and freed.
-	 */
-	while (atomic_read(&st->refcnt) > 1) {
-		dprintk("%s: st: %p, refcnt: %d, list_empty: %d.\n",
-				__func__, st, atomic_read(&st->refcnt),
-				list_empty(&st->request_list));
-		wait_event_timeout(st->thread_wait,
-				(atomic_read(&st->refcnt) == 1) ||
-				!list_empty(&st->request_list),
-				HZ/2);
-
-		while (!list_empty(&st->request_list)) {
-			p = NULL;
-			spin_lock_irqsave(&st->request_lock, flags);
-			if (!list_empty(&st->request_list)) {
-				p = list_first_entry(&st->request_list,
-					struct dst_export_priv, request_entry);
-				list_del(&p->request_entry);
-			}
-			spin_unlock_irqrestore(&st->request_lock, flags);
-
-			if (p)
-				bio_put(p->bio);
-
-			dprintk("%s: st: %p, refcnt: %d, list_empty: %d, p: %p.\n",
-				__func__, st, atomic_read(&st->refcnt),
-				list_empty(&st->request_list), p);
-		}
-	}
-
-	dst_state_put(st);
-}
-
-/*
- * Client accepting thread.
- * Not only accepts new connection, but also schedules receiving thread
- * and performs request completion described above.
- */
-static int dst_accept(void *init_data, void *schedule_data)
-{
-	struct dst_state *main_st = schedule_data;
-	struct dst_node *n = init_data;
-	struct dst_state *st;
-	int err;
-
-	while (n->trans_scan_timeout && !main_st->need_exit) {
-		dprintk("%s: main_st: %p, n: %p.\n", __func__, main_st, n);
-		st = dst_accept_client(main_st);
-		if (IS_ERR(st))
-			continue;
-
-		err = dst_state_schedule_receiver(st);
-		if (!err) {
-			while (n->trans_scan_timeout) {
-				err = wait_event_interruptible_timeout(st->thread_wait,
-						!list_empty(&st->request_list) ||
-						!n->trans_scan_timeout ||
-						st->need_exit,
-					HZ);
-
-				if (!n->trans_scan_timeout || st->need_exit)
-					break;
-
-				if (list_empty(&st->request_list))
-					continue;
-
-				err = dst_export_process_request_queue(st);
-				if (err)
-					break;
-			}
-
-			st->need_exit = 1;
-			wake_up(&st->thread_wait);
-		}
-
-		dst_state_cleanup_export(st);
-	}
-
-	dprintk("%s: freeing listening socket st: %p.\n", __func__, main_st);
-
-	dst_state_lock(main_st);
-	dst_poll_exit(main_st);
-	dst_state_socket_release(main_st);
-	dst_state_unlock(main_st);
-	dst_state_put(main_st);
-	dprintk("%s: freed listening socket st: %p.\n", __func__, main_st);
-
-	return 0;
-}
-
-int dst_start_export(struct dst_node *n)
-{
-	if (list_empty(&n->security_list)) {
-		printk(KERN_ERR "You are trying to export node '%s' without security attributes.\n"
-				"No clients will be allowed to connect. Exiting.\n", n->name);
-		return -EINVAL;
-	}
-	return dst_node_trans_init(n, sizeof(struct dst_export_priv));
-}
-
-/*
- * Initialize listening state and schedule accepting thread.
- */
-int dst_node_init_listened(struct dst_node *n, struct dst_export_ctl *le)
-{
-	struct dst_state *st;
-	int err = -ENOMEM;
-	struct dst_network_ctl *ctl = &le->ctl;
-
-	memcpy(&n->info->net, ctl, sizeof(struct dst_network_ctl));
-
-	st = dst_state_alloc(n);
-	if (IS_ERR(st)) {
-		err = PTR_ERR(st);
-		goto err_out_exit;
-	}
-	memcpy(&st->ctl, ctl, sizeof(struct dst_network_ctl));
-
-	err = dst_state_socket_create(st);
-	if (err)
-		goto err_out_put;
-
-	st->socket->sk->sk_reuse = 1;
-
-	err = kernel_bind(st->socket, (struct sockaddr *)&ctl->addr,
-			ctl->addr.sa_data_len);
-	if (err)
-		goto err_out_socket_release;
-
-	err = kernel_listen(st->socket, 1024);
-	if (err)
-		goto err_out_socket_release;
-	n->state = st;
-
-	err = dst_poll_init(st);
-	if (err)
-		goto err_out_socket_release;
-
-	dst_state_get(st);
-
-	err = thread_pool_schedule(n->pool, dst_thread_setup,
-			dst_accept, st, MAX_SCHEDULE_TIMEOUT);
-	if (err)
-		goto err_out_poll_exit;
-
-	return 0;
-
-err_out_poll_exit:
-	dst_poll_exit(st);
-err_out_socket_release:
-	dst_state_socket_release(st);
-err_out_put:
-	dst_state_put(st);
-err_out_exit:
-	n->state = NULL;
-	return err;
-}
-
-/*
- * Free bio and related private data.
- * Also drop a reference counter for appropriate state,
- * which waits when there are no more block IOs in-flight.
- */
-static void dst_bio_destructor(struct bio *bio)
-{
-	struct bio_vec *bv;
-	struct dst_export_priv *priv = bio->bi_private;
-	int i;
-
-	bio_for_each_segment(bv, bio, i) {
-		if (!bv->bv_page)
-			break;
-
-		__free_page(bv->bv_page);
-	}
-
-	if (priv)
-		dst_state_put(priv->state);
-	bio_free(bio, dst_bio_set);
-}
-
-/*
- * Block IO completion. Queue request to be sent back to
- * the client (or just confirmation).
- */
-static void dst_bio_end_io(struct bio *bio, int err)
-{
-	struct dst_export_priv *p = bio->bi_private;
-	struct dst_state *st = p->state;
-	unsigned long flags;
-
-	spin_lock_irqsave(&st->request_lock, flags);
-	list_add_tail(&p->request_entry, &st->request_list);
-	spin_unlock_irqrestore(&st->request_lock, flags);
-
-	wake_up(&st->thread_wait);
-}
-
-/*
- * Allocate read request for the server.
- */
-static int dst_export_read_request(struct bio *bio, unsigned int total_size)
-{
-	unsigned int size;
-	struct page *page;
-	int err;
-
-	while (total_size) {
-		err = -ENOMEM;
-		page = alloc_page(GFP_KERNEL);
-		if (!page)
-			goto err_out_exit;
-
-		size = min_t(unsigned int, PAGE_SIZE, total_size);
-
-		err = bio_add_page(bio, page, size, 0);
-		dprintk("%s: bio: %llu/%u, size: %u, err: %d.\n",
-				__func__, (u64)bio->bi_sector, bio->bi_size,
-				size, err);
-		if (err <= 0)
-			goto err_out_free_page;
-
-		total_size -= size;
-	}
-
-	return 0;
-
-err_out_free_page:
-	__free_page(page);
-err_out_exit:
-	return err;
-}
-
-/*
- * Allocate write request for the server.
- * Should not only get pages, but also read data from the network.
- */
-static int dst_export_write_request(struct dst_state *st,
-		struct bio *bio, unsigned int total_size)
-{
-	unsigned int size;
-	struct page *page;
-	void *data;
-	int err;
-
-	while (total_size) {
-		err = -ENOMEM;
-		page = alloc_page(GFP_KERNEL);
-		if (!page)
-			goto err_out_exit;
-
-		data = kmap(page);
-		if (!data)
-			goto err_out_free_page;
-
-		size = min_t(unsigned int, PAGE_SIZE, total_size);
-
-		err = dst_data_recv(st, data, size);
-		if (err)
-			goto err_out_unmap_page;
-
-		err = bio_add_page(bio, page, size, 0);
-		if (err <= 0)
-			goto err_out_unmap_page;
-
-		kunmap(page);
-
-		total_size -= size;
-	}
-
-	return 0;
-
-err_out_unmap_page:
-	kunmap(page);
-err_out_free_page:
-	__free_page(page);
-err_out_exit:
-	return err;
-}
-
-/*
- * Groovy, we've gotten an IO request from the client.
- * Allocate BIO from the bioset, private data from the mempool
- * and lots of pages for IO.
- */
-int dst_process_io(struct dst_state *st)
-{
-	struct dst_node *n = st->node;
-	struct dst_cmd *cmd = st->data;
-	struct bio *bio;
-	struct dst_export_priv *priv;
-	int err = -ENOMEM;
-
-	if (unlikely(!n->bdev)) {
-		err = -EINVAL;
-		goto err_out_exit;
-	}
-
-	bio = bio_alloc_bioset(GFP_KERNEL,
-			PAGE_ALIGN(cmd->size) >> PAGE_SHIFT,
-			dst_bio_set);
-	if (!bio)
-		goto err_out_exit;
-
-	priv = (struct dst_export_priv *)(((void *)bio) - sizeof (struct dst_export_priv));
-
-	priv->state = dst_state_get(st);
-	priv->bio = bio;
-
-	bio->bi_private = priv;
-	bio->bi_end_io = dst_bio_end_io;
-	bio->bi_destructor = dst_bio_destructor;
-	bio->bi_bdev = n->bdev;
-
-	/*
-	 * Server side is only interested in two low bits:
-	 * uptodate (set by itself actually) and rw block
-	 */
-	bio->bi_flags |= cmd->flags & 3;
-
-	bio->bi_rw = cmd->rw;
-	bio->bi_size = 0;
-	bio->bi_sector = cmd->sector;
-
-	dst_bio_to_cmd(bio, &priv->cmd, DST_IO_RESPONSE, cmd->id);
-
-	priv->cmd.flags = 0;
-	priv->cmd.size = cmd->size;
-
-	if (bio_data_dir(bio) == WRITE) {
-		err = dst_recv_cdata(st, priv->cmd.hash);
-		if (err)
-			goto err_out_free;
-
-		err = dst_export_write_request(st, bio, cmd->size);
-		if (err)
-			goto err_out_free;
-
-		if (dst_need_crypto(n))
-			return dst_export_crypto(n, bio);
-	} else {
-		err = dst_export_read_request(bio, cmd->size);
-		if (err)
-			goto err_out_free;
-	}
-
-	dprintk("%s: bio: %llu/%u, rw: %lu, dir: %lu, flags: %lx, phys: %d.\n",
-			__func__, (u64)bio->bi_sector, bio->bi_size,
-			bio->bi_rw, bio_data_dir(bio),
-			bio->bi_flags, bio->bi_phys_segments);
-
-	generic_make_request(bio);
-
-	return 0;
-
-err_out_free:
-	bio_put(bio);
-err_out_exit:
-	return err;
-}
-
-/*
- * Ok, block IO is ready, let's send it back to the client...
- */
-int dst_export_send_bio(struct bio *bio)
-{
-	struct dst_export_priv *p = bio->bi_private;
-	struct dst_state *st = p->state;
-	struct dst_cmd *cmd = &p->cmd;
-	int err;
-
-	dprintk("%s: id: %llu, bio: %llu/%u, csize: %u, flags: %lu, rw: %lu.\n",
-			__func__, cmd->id, (u64)bio->bi_sector, bio->bi_size,
-			cmd->csize, bio->bi_flags, bio->bi_rw);
-
-	dst_convert_cmd(cmd);
-
-	dst_state_lock(st);
-	if (!st->socket) {
-		err = -ECONNRESET;
-		goto err_out_unlock;
-	}
-
-	if (bio_data_dir(bio) == WRITE) {
-		/* ... or just confirmation that writing has completed. */
-		cmd->size = cmd->csize = 0;
-		err = dst_data_send_header(st->socket, cmd,
-				sizeof(struct dst_cmd), 0);
-		if (err)
-			goto err_out_unlock;
-	} else {
-		err = dst_send_bio(st, cmd, bio);
-		if (err)
-			goto err_out_unlock;
-	}
-
-	dst_state_unlock(st);
-
-	bio_put(bio);
-	return 0;
-
-err_out_unlock:
-	dst_state_unlock(st);
-
-	bio_put(bio);
-	return err;
-}
diff --git a/drivers/staging/dst/state.c b/drivers/staging/dst/state.c
deleted file mode 100644
index d057e52f3b64..000000000000
--- a/drivers/staging/dst/state.c
+++ /dev/null
@@ -1,839 +0,0 @@
-/*
- * 2007+ Copyright (c) Evgeniy Polyakov <zbr@ioremap.net>
- * All rights reserved.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- */
-
-#include <linux/buffer_head.h>
-#include <linux/blkdev.h>
-#include <linux/bio.h>
-#include <linux/connector.h>
-#include <linux/dst.h>
-#include <linux/device.h>
-#include <linux/in.h>
-#include <linux/in6.h>
-#include <linux/socket.h>
-#include <linux/slab.h>
-
-#include <net/sock.h>
-
-/*
- * Polling machinery.
- */
-
-struct dst_poll_helper
-{
-	poll_table 		pt;
-	struct dst_state	*st;
-};
-
-static int dst_queue_wake(wait_queue_t *wait, unsigned mode, int sync, void *key)
-{
-	struct dst_state *st = container_of(wait, struct dst_state, wait);
-
-	wake_up(&st->thread_wait);
-	return 1;
-}
-
-static void dst_queue_func(struct file *file, wait_queue_head_t *whead,
-				 poll_table *pt)
-{
-	struct dst_state *st = container_of(pt, struct dst_poll_helper, pt)->st;
-
-	st->whead = whead;
-	init_waitqueue_func_entry(&st->wait, dst_queue_wake);
-	add_wait_queue(whead, &st->wait);
-}
-
-void dst_poll_exit(struct dst_state *st)
-{
-	if (st->whead) {
-		remove_wait_queue(st->whead, &st->wait);
-		st->whead = NULL;
-	}
-}
-
-int dst_poll_init(struct dst_state *st)
-{
-	struct dst_poll_helper ph;
-
-	ph.st = st;
-	init_poll_funcptr(&ph.pt, &dst_queue_func);
-
-	st->socket->ops->poll(NULL, st->socket, &ph.pt);
-	return 0;
-}
-
-/*
- * Header receiving function - may block.
- */
-static int dst_data_recv_header(struct socket *sock,
-		void *data, unsigned int size, int block)
-{
-	struct msghdr msg;
-	struct kvec iov;
-	int err;
-
-	iov.iov_base = data;
-	iov.iov_len = size;
-
-	msg.msg_iov = (struct iovec *)&iov;
-	msg.msg_iovlen = 1;
-	msg.msg_name = NULL;
-	msg.msg_namelen = 0;
-	msg.msg_control = NULL;
-	msg.msg_controllen = 0;
-	msg.msg_flags = (block)?MSG_WAITALL:MSG_DONTWAIT;
-
-	err = kernel_recvmsg(sock, &msg, &iov, 1, iov.iov_len,
-			msg.msg_flags);
-	if (err != size)
-		return -1;
-
-	return 0;
-}
-
-/*
- * Header sending function - may block.
- */
-int dst_data_send_header(struct socket *sock,
-		void *data, unsigned int size, int more)
-{
-	struct msghdr msg;
-	struct kvec iov;
-	int err;
-
-	iov.iov_base = data;
-	iov.iov_len = size;
-
-	msg.msg_iov = (struct iovec *)&iov;
-	msg.msg_iovlen = 1;
-	msg.msg_name = NULL;
-	msg.msg_namelen = 0;
-	msg.msg_control = NULL;
-	msg.msg_controllen = 0;
-	msg.msg_flags = MSG_WAITALL | (more)?MSG_MORE:0;
-
-	err = kernel_sendmsg(sock, &msg, &iov, 1, iov.iov_len);
-	if (err != size) {
-		dprintk("%s: size: %u, more: %d, err: %d.\n",
-				__func__, size, more, err);
-		return -1;
-	}
-
-	return 0;
-}
-
-/*
- * Block autoconfiguration: request size of the storage and permissions.
- */
-static int dst_request_remote_config(struct dst_state *st)
-{
-	struct dst_node *n = st->node;
-	int err = -EINVAL;
-	struct dst_cmd *cmd = st->data;
-
-	memset(cmd, 0, sizeof(struct dst_cmd));
-	cmd->cmd = DST_CFG;
-
-	dst_convert_cmd(cmd);
-
-	err = dst_data_send_header(st->socket, cmd, sizeof(struct dst_cmd), 0);
-	if (err)
-		goto out;
-
-	err = dst_data_recv_header(st->socket, cmd, sizeof(struct dst_cmd), 1);
-	if (err)
-		goto out;
-
-	dst_convert_cmd(cmd);
-
-	if (cmd->cmd != DST_CFG) {
-		err = -EINVAL;
-		dprintk("%s: checking result: cmd: %d, size reported: %llu.\n",
-			__func__, cmd->cmd, cmd->sector);
-		goto out;
-	}
-
-	if (n->size != 0)
-		n->size = min_t(loff_t, n->size, cmd->sector);
-	else
-		n->size = cmd->sector;
-
-	n->info->size = n->size;
-	st->permissions = cmd->rw;
-
-out:
-	dprintk("%s: n: %p, err: %d, size: %llu, permission: %x.\n",
-			__func__, n, err, n->size, st->permissions);
-	return err;
-}
-
-/*
- * Socket machinery.
- */
-
-#define DST_DEFAULT_TIMEO	20000
-
-int dst_state_socket_create(struct dst_state *st)
-{
-	int err;
-	struct socket *sock;
-	struct dst_network_ctl *ctl = &st->ctl;
-
-	err = sock_create(ctl->addr.sa_family, ctl->type, ctl->proto, &sock);
-	if (err < 0)
-		return err;
-
-	sock->sk->sk_sndtimeo = sock->sk->sk_rcvtimeo =
-		msecs_to_jiffies(DST_DEFAULT_TIMEO);
-	sock->sk->sk_allocation = GFP_NOIO;
-
-	st->socket = st->read_socket = sock;
-	return 0;
-}
-
-void dst_state_socket_release(struct dst_state *st)
-{
-	dprintk("%s: st: %p, socket: %p, n: %p.\n",
-			__func__, st, st->socket, st->node);
-	if (st->socket) {
-		sock_release(st->socket);
-		st->socket = NULL;
-		st->read_socket = NULL;
-	}
-}
-
-void dst_dump_addr(struct socket *sk, struct sockaddr *sa, char *str)
-{
-	if (sk->ops->family == AF_INET) {
-		struct sockaddr_in *sin = (struct sockaddr_in *)sa;
-		printk(KERN_INFO "%s %u.%u.%u.%u:%d.\n",
-			str, NIPQUAD(sin->sin_addr.s_addr), ntohs(sin->sin_port));
-	} else if (sk->ops->family == AF_INET6) {
-		struct sockaddr_in6 *sin = (struct sockaddr_in6 *)sa;
-		printk(KERN_INFO "%s %pi6:%d",
-			str, &sin->sin6_addr, ntohs(sin->sin6_port));
-	}
-}
-
-void dst_state_exit_connected(struct dst_state *st)
-{
-	if (st->socket) {
-		dst_poll_exit(st);
-		st->socket->ops->shutdown(st->socket, 2);
-
-		dst_dump_addr(st->socket, (struct sockaddr *)&st->ctl.addr,
-				"Disconnected peer");
-		dst_state_socket_release(st);
-	}
-}
-
-static int dst_state_init_connected(struct dst_state *st)
-{
-	int err;
-	struct dst_network_ctl *ctl = &st->ctl;
-
-	err = dst_state_socket_create(st);
-	if (err)
-		goto err_out_exit;
-
-	err = kernel_connect(st->socket, (struct sockaddr *)&st->ctl.addr,
-			st->ctl.addr.sa_data_len, 0);
-	if (err)
-		goto err_out_release;
-
-	err = dst_poll_init(st);
-	if (err)
-		goto err_out_release;
-
-	dst_dump_addr(st->socket, (struct sockaddr *)&ctl->addr,
-			"Connected to peer");
-
-	return 0;
-
-err_out_release:
-	dst_state_socket_release(st);
-err_out_exit:
-	return err;
-}
-
-/*
- * State reset is used to reconnect to the remote peer.
- * May fail, but who cares, we will try again later.
- */
-static void inline dst_state_reset_nolock(struct dst_state *st)
-{
-	dst_state_exit_connected(st);
-	dst_state_init_connected(st);
-}
-
-static void inline dst_state_reset(struct dst_state *st)
-{
-	dst_state_lock(st);
-	dst_state_reset_nolock(st);
-	dst_state_unlock(st);
-}
-
-/*
- * Basic network sending/receiving functions.
- * Blocked mode is used.
- */
-static int dst_data_recv_raw(struct dst_state *st, void *buf, u64 size)
-{
-	struct msghdr msg;
-	struct kvec iov;
-	int err;
-
-	BUG_ON(!size);
-
-	iov.iov_base = buf;
-	iov.iov_len = size;
-
-	msg.msg_iov = (struct iovec *)&iov;
-	msg.msg_iovlen = 1;
-	msg.msg_name = NULL;
-	msg.msg_namelen = 0;
-	msg.msg_control = NULL;
-	msg.msg_controllen = 0;
-	msg.msg_flags = MSG_DONTWAIT;
-
-	err = kernel_recvmsg(st->socket, &msg, &iov, 1, iov.iov_len,
-			msg.msg_flags);
-	if (err <= 0) {
-		dprintk("%s: failed to recv data: size: %llu, err: %d.\n",
-				__func__, size, err);
-		if (err == 0)
-			err = -ECONNRESET;
-
-		dst_state_exit_connected(st);
-	}
-
-	return err;
-}
-
-/*
- * Ping command to early detect failed nodes.
- */
-static int dst_send_ping(struct dst_state *st)
-{
-	struct dst_cmd *cmd = st->data;
-	int err = -ECONNRESET;
-
-	dst_state_lock(st);
-	if (st->socket) {
-		memset(cmd, 0, sizeof(struct dst_cmd));
-
-		cmd->cmd = __cpu_to_be32(DST_PING);
-
-		err = dst_data_send_header(st->socket, cmd, sizeof(struct dst_cmd), 0);
-	}
-	dprintk("%s: st: %p, socket: %p, err: %d.\n", __func__, st, st->socket, err);
-	dst_state_unlock(st);
-
-	return err;
-}
-
-/*
- * Receiving function, which should either return error or read
- * whole block request. If there was no traffic for a one second,
- * send a ping, since remote node may die.
- */
-int dst_data_recv(struct dst_state *st, void *data, unsigned int size)
-{
-	unsigned int revents = 0;
-	unsigned int err_mask = POLLERR | POLLHUP | POLLRDHUP;
-	unsigned int mask = err_mask | POLLIN;
-	struct dst_node *n = st->node;
-	int err = 0;
-
-	while (size && !err) {
-		revents = dst_state_poll(st);
-
-		if (!(revents & mask)) {
-			DEFINE_WAIT(wait);
-
-			for (;;) {
-				prepare_to_wait(&st->thread_wait, &wait,
-						TASK_INTERRUPTIBLE);
-				if (!n->trans_scan_timeout || st->need_exit)
-					break;
-
-				revents = dst_state_poll(st);
-
-				if (revents & mask)
-					break;
-
-				if (signal_pending(current))
-					break;
-
-				if (!schedule_timeout(HZ)) {
-					err = dst_send_ping(st);
-					if (err)
-						return err;
-				}
-
-				continue;
-			}
-			finish_wait(&st->thread_wait, &wait);
-		}
-
-		err = -ECONNRESET;
-		dst_state_lock(st);
-
-		if (		st->socket &&
-				(st->read_socket == st->socket) &&
-				(revents & POLLIN)) {
-			err = dst_data_recv_raw(st, data, size);
-			if (err > 0) {
-				data += err;
-				size -= err;
-				err = 0;
-			}
-		}
-
-		if (revents & err_mask || !st->socket) {
-			dprintk("%s: revents: %x, socket: %p, size: %u, err: %d.\n",
-					__func__, revents, st->socket, size, err);
-			err = -ECONNRESET;
-		}
-
-		dst_state_unlock(st);
-
-		if (!n->trans_scan_timeout)
-			err = -ENODEV;
-	}
-
-	return err;
-}
-
-/*
- * Send block autoconf reply.
- */
-static int dst_process_cfg(struct dst_state *st)
-{
-	struct dst_node *n = st->node;
-	struct dst_cmd *cmd = st->data;
-	int err;
-
-	cmd->sector = n->size;
-	cmd->rw = st->permissions;
-
-	dst_convert_cmd(cmd);
-
-	dst_state_lock(st);
-	err = dst_data_send_header(st->socket, cmd, sizeof(struct dst_cmd), 0);
-	dst_state_unlock(st);
-
-	return err;
-}
-
-/*
- * Receive block IO from the network.
- */
-static int dst_recv_bio(struct dst_state *st, struct bio *bio, unsigned int total_size)
-{
-	struct bio_vec *bv;
-	int i, err;
-	void *data;
-	unsigned int sz;
-
-	bio_for_each_segment(bv, bio, i) {
-		sz = min(total_size, bv->bv_len);
-
-		dprintk("%s: bio: %llu/%u, total: %u, len: %u, sz: %u, off: %u.\n",
-			__func__, (u64)bio->bi_sector, bio->bi_size, total_size,
-			bv->bv_len, sz, bv->bv_offset);
-
-		data = kmap(bv->bv_page) + bv->bv_offset;
-		err = dst_data_recv(st, data, sz);
-		kunmap(bv->bv_page);
-
-		bv->bv_len = sz;
-
-		if (err)
-			return err;
-
-		total_size -= sz;
-		if (total_size == 0)
-			break;
-	}
-
-	return 0;
-}
-
-/*
- * Our block IO has just completed and arrived: get it.
- */
-static int dst_process_io_response(struct dst_state *st)
-{
-	struct dst_node *n = st->node;
-	struct dst_cmd *cmd = st->data;
-	struct dst_trans *t;
-	int err = 0;
-	struct bio *bio;
-
-	mutex_lock(&n->trans_lock);
-	t = dst_trans_search(n, cmd->id);
-	mutex_unlock(&n->trans_lock);
-
-	if (!t)
-		goto err_out_exit;
-
-	bio = t->bio;
-
-	dprintk("%s: bio: %llu/%u, cmd_size: %u, csize: %u, dir: %lu.\n",
-		__func__, (u64)bio->bi_sector, bio->bi_size, cmd->size,
-		cmd->csize, bio_data_dir(bio));
-
-	if (bio_data_dir(bio) == READ) {
-		if (bio->bi_size != cmd->size - cmd->csize)
-			goto err_out_exit;
-
-		if (dst_need_crypto(n)) {
-			err = dst_recv_cdata(st, t->cmd.hash);
-			if (err)
-				goto err_out_exit;
-		}
-
-		err = dst_recv_bio(st, t->bio, bio->bi_size);
-		if (err)
-			goto err_out_exit;
-
-		if (dst_need_crypto(n))
-			return dst_trans_crypto(t);
-	} else {
-		err = -EBADMSG;
-		if (cmd->size || cmd->csize)
-			goto err_out_exit;
-	}
-
-	dst_trans_remove(t);
-	dst_trans_put(t);
-
-	return 0;
-
-err_out_exit:
-	return err;
-}
-
-/*
- * Receive crypto data.
- */
-int dst_recv_cdata(struct dst_state *st, void *cdata)
-{
-	struct dst_cmd *cmd = st->data;
-	struct dst_node *n = st->node;
-	struct dst_crypto_ctl *c = &n->crypto;
-	int err;
-
-	if (cmd->csize != c->crypto_attached_size) {
-		dprintk("%s: cmd: cmd: %u, sector: %llu, size: %u, "
-				"csize: %u != digest size %u.\n",
-				__func__, cmd->cmd, cmd->sector, cmd->size,
-				cmd->csize, c->crypto_attached_size);
-		err = -EINVAL;
-		goto err_out_exit;
-	}
-
-	err = dst_data_recv(st, cdata, cmd->csize);
-	if (err)
-		goto err_out_exit;
-
-	cmd->size -= cmd->csize;
-	return 0;
-
-err_out_exit:
-	return err;
-}
-
-/*
- * Receive the command and start its processing.
- */
-static int dst_recv_processing(struct dst_state *st)
-{
-	int err = -EINTR;
-	struct dst_cmd *cmd = st->data;
-
-	/*
-	 * If socket will be reset after this statement, then
-	 * dst_data_recv() will just fail and loop will
-	 * start again, so it can be done without any locks.
-	 *
-	 * st->read_socket is needed to prevents state machine
-	 * breaking between this data reading and subsequent one
-	 * in protocol specific functions during connection reset.
-	 * In case of reset we have to read next command and do
-	 * not expect data for old command to magically appear in
-	 * new connection.
-	 */
-	st->read_socket = st->socket;
-	err = dst_data_recv(st, cmd, sizeof(struct dst_cmd));
-	if (err)
-		goto out_exit;
-
-	dst_convert_cmd(cmd);
-
-	dprintk("%s: cmd: %u, size: %u, csize: %u, id: %llu, "
-			"sector: %llu, flags: %llx, rw: %llx.\n",
-			__func__, cmd->cmd, cmd->size,
-			cmd->csize, cmd->id, cmd->sector,
-			cmd->flags, cmd->rw);
-
-	/*
-	 * This should catch protocol breakage and random garbage instead of commands.
-	 */
-	if (unlikely(cmd->csize > st->size - sizeof(struct dst_cmd))) {
-		err = -EBADMSG;
-		goto out_exit;
-	}
-
-	err = -EPROTO;
-	switch (cmd->cmd) {
-		case DST_IO_RESPONSE:
-			err = dst_process_io_response(st);
-			break;
-		case DST_IO:
-			err = dst_process_io(st);
-			break;
-		case DST_CFG:
-			err = dst_process_cfg(st);
-			break;
-		case DST_PING:
-			err = 0;
-			break;
-		default:
-			break;
-	}
-
-out_exit:
-	return err;
-}
-
-/*
- * Receiving thread. For the client node we should try to reconnect,
- * for accepted client we just drop the state and expect it to reconnect.
- */
-static int dst_recv(void *init_data, void *schedule_data)
-{
-	struct dst_state *st = schedule_data;
-	struct dst_node *n = init_data;
-	int err = 0;
-
-	dprintk("%s: start st: %p, n: %p, scan: %lu, need_exit: %d.\n",
-			__func__, st, n, n->trans_scan_timeout, st->need_exit);
-
-	while (n->trans_scan_timeout && !st->need_exit) {
-		err = dst_recv_processing(st);
-		if (err < 0) {
-			if (!st->ctl.type)
-				break;
-
-			if (!n->trans_scan_timeout || st->need_exit)
-				break;
-
-			dst_state_reset(st);
-			msleep(1000);
-		}
-	}
-
-	st->need_exit = 1;
-	wake_up(&st->thread_wait);
-
-	dprintk("%s: freeing receiving socket st: %p.\n", __func__, st);
-	dst_state_lock(st);
-	dst_state_exit_connected(st);
-	dst_state_unlock(st);
-	dst_state_put(st);
-
-	dprintk("%s: freed receiving socket st: %p.\n", __func__, st);
-
-	return err;
-}
-
-/*
- * Network state dies here and borns couple of lines below.
- * This object is the main network state processing engine:
- * sending, receiving, reconnections, all network related
- * tasks are handled on behalf of the state.
- */
-static void dst_state_free(struct dst_state *st)
-{
-	dprintk("%s: st: %p.\n", __func__, st);
-	if (st->cleanup)
-		st->cleanup(st);
-	kfree(st->data);
-	kfree(st);
-}
-
-struct dst_state *dst_state_alloc(struct dst_node *n)
-{
-	struct dst_state *st;
-	int err = -ENOMEM;
-
-	st = kzalloc(sizeof(struct dst_state), GFP_KERNEL);
-	if (!st)
-		goto err_out_exit;
-
-	st->node = n;
-	st->need_exit = 0;
-
-	st->size = PAGE_SIZE;
-	st->data = kmalloc(st->size, GFP_KERNEL);
-	if (!st->data)
-		goto err_out_free;
-
-	spin_lock_init(&st->request_lock);
-	INIT_LIST_HEAD(&st->request_list);
-
-	mutex_init(&st->state_lock);
-	init_waitqueue_head(&st->thread_wait);
-
-	/*
-	 * One for processing thread, another one for node itself.
-	 */
-	atomic_set(&st->refcnt, 2);
-
-	dprintk("%s: st: %p, n: %p.\n", __func__, st, st->node);
-
-	return st;
-
-err_out_free:
-	kfree(st);
-err_out_exit:
-	return ERR_PTR(err);
-}
-
-int dst_state_schedule_receiver(struct dst_state *st)
-{
-	return thread_pool_schedule_private(st->node->pool, dst_thread_setup,
-			dst_recv, st, MAX_SCHEDULE_TIMEOUT, st->node);
-}
-
-/*
- * Initialize client's connection to the remote peer: allocate state,
- * connect and perform block IO autoconfiguration.
- */
-int dst_node_init_connected(struct dst_node *n, struct dst_network_ctl *r)
-{
-	struct dst_state *st;
-	int err = -ENOMEM;
-
-	st = dst_state_alloc(n);
-	if (IS_ERR(st)) {
-		err = PTR_ERR(st);
-		goto err_out_exit;
-	}
-	memcpy(&st->ctl, r, sizeof(struct dst_network_ctl));
-
-	err = dst_state_init_connected(st);
-	if (err)
-		goto err_out_free_data;
-
-	err = dst_request_remote_config(st);
-	if (err)
-		goto err_out_exit_connected;
-	n->state = st;
-
-	err = dst_state_schedule_receiver(st);
-	if (err)
-		goto err_out_exit_connected;
-
-	return 0;
-
-err_out_exit_connected:
-	dst_state_exit_connected(st);
-err_out_free_data:
-	dst_state_free(st);
-err_out_exit:
-	n->state = NULL;
-	return err;
-}
-
-void dst_state_put(struct dst_state *st)
-{
-	dprintk("%s: st: %p, refcnt: %d.\n",
-			__func__, st, atomic_read(&st->refcnt));
-	if (atomic_dec_and_test(&st->refcnt))
-		dst_state_free(st);
-}
-
-/*
- * Send block IO to the network one by one using zero-copy ->sendpage().
- */
-int dst_send_bio(struct dst_state *st, struct dst_cmd *cmd, struct bio *bio)
-{
-	struct bio_vec *bv;
-	struct dst_crypto_ctl *c = &st->node->crypto;
-	int err, i = 0;
-	int flags = MSG_WAITALL;
-
-	err = dst_data_send_header(st->socket, cmd,
-		sizeof(struct dst_cmd) + c->crypto_attached_size, bio->bi_vcnt);
-	if (err)
-		goto err_out_exit;
-
-	bio_for_each_segment(bv, bio, i) {
-		if (i < bio->bi_vcnt - 1)
-			flags |= MSG_MORE;
-
-		err = kernel_sendpage(st->socket, bv->bv_page, bv->bv_offset,
-				bv->bv_len, flags);
-		if (err <= 0)
-			goto err_out_exit;
-	}
-
-	return 0;
-
-err_out_exit:
-	dprintk("%s: %d/%d, flags: %x, err: %d.\n",
-			__func__, i, bio->bi_vcnt, flags, err);
-	return err;
-}
-
-/*
- * Send transaction to the remote peer.
- */
-int dst_trans_send(struct dst_trans *t)
-{
-	int err;
-	struct dst_state *st = t->n->state;
-	struct bio *bio = t->bio;
-
-	dst_convert_cmd(&t->cmd);
-
-	dst_state_lock(st);
-	if (!st->socket) {
-		err = dst_state_init_connected(st);
-		if (err)
-			goto err_out_unlock;
-	}
-
-	if (bio_data_dir(bio) == WRITE) {
-		err = dst_send_bio(st, &t->cmd, t->bio);
-	} else {
-		err = dst_data_send_header(st->socket, &t->cmd,
-				sizeof(struct dst_cmd), 0);
-	}
-	if (err)
-		goto err_out_reset;
-
-	dst_state_unlock(st);
-	return 0;
-
-err_out_reset:
-	dst_state_reset_nolock(st);
-err_out_unlock:
-	dst_state_unlock(st);
-
-	return err;
-}
diff --git a/drivers/staging/dst/thread_pool.c b/drivers/staging/dst/thread_pool.c
deleted file mode 100644
index 7bed4e851029..000000000000
--- a/drivers/staging/dst/thread_pool.c
+++ /dev/null
@@ -1,345 +0,0 @@
-/*
- * 2007+ Copyright (c) Evgeniy Polyakov <zbr@ioremap.net>
- * All rights reserved.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- */
-
-#include <linux/kernel.h>
-#include <linux/dst.h>
-#include <linux/kthread.h>
-#include <linux/slab.h>
-
-/*
- * Thread pool abstraction allows to schedule a work to be performed
- * on behalf of kernel thread. One does not operate with threads itself,
- * instead user provides setup and cleanup callbacks for thread pool itself,
- * and action and cleanup callbacks for each submitted work.
- *
- * Each worker has private data initialized at creation time and data,
- * provided by user at scheduling time.
- *
- * When action is being performed, thread can not be used by other users,
- * instead they will sleep until there is free thread to pick their work.
- */
-struct thread_pool_worker
-{
-	struct list_head	worker_entry;
-
-	struct task_struct	*thread;
-
-	struct thread_pool	*pool;
-
-	int			error;
-	int			has_data;
-	int			need_exit;
-	unsigned int		id;
-
-	wait_queue_head_t	wait;
-
-	void			*private;
-	void			*schedule_data;
-
-	int			(* action)(void *private, void *schedule_data);
-	void			(* cleanup)(void *private);
-};
-
-static void thread_pool_exit_worker(struct thread_pool_worker *w)
-{
-	kthread_stop(w->thread);
-
-	w->cleanup(w->private);
-	kfree(w);
-}
-
-/*
- * Called to mark thread as ready and allow users to schedule new work.
- */
-static void thread_pool_worker_make_ready(struct thread_pool_worker *w)
-{
-	struct thread_pool *p = w->pool;
-
-	mutex_lock(&p->thread_lock);
-
-	if (!w->need_exit) {
-		list_move_tail(&w->worker_entry, &p->ready_list);
-		w->has_data = 0;
-		mutex_unlock(&p->thread_lock);
-
-		wake_up(&p->wait);
-	} else {
-		p->thread_num--;
-		list_del(&w->worker_entry);
-		mutex_unlock(&p->thread_lock);
-
-		thread_pool_exit_worker(w);
-	}
-}
-
-/*
- * Thread action loop: waits until there is new work.
- */
-static int thread_pool_worker_func(void *data)
-{
-	struct thread_pool_worker *w = data;
-
-	while (!kthread_should_stop()) {
-		wait_event_interruptible(w->wait,
-			kthread_should_stop() || w->has_data);
-
-		if (kthread_should_stop())
-			break;
-
-		if (!w->has_data)
-			continue;
-
-		w->action(w->private, w->schedule_data);
-		thread_pool_worker_make_ready(w);
-	}
-
-	return 0;
-}
-
-/*
- * Remove single worker without specifying which one.
- */
-void thread_pool_del_worker(struct thread_pool *p)
-{
-	struct thread_pool_worker *w = NULL;
-
-	while (!w && p->thread_num) {
-		wait_event(p->wait, !list_empty(&p->ready_list) || !p->thread_num);
-
-		dprintk("%s: locking list_empty: %d, thread_num: %d.\n",
-				__func__, list_empty(&p->ready_list), p->thread_num);
-
-		mutex_lock(&p->thread_lock);
-		if (!list_empty(&p->ready_list)) {
-			w = list_first_entry(&p->ready_list,
-					struct thread_pool_worker,
-					worker_entry);
-
-			dprintk("%s: deleting w: %p, thread_num: %d, list: %p [%p.%p].\n",
-					__func__, w, p->thread_num, &p->ready_list,
-					p->ready_list.prev, p->ready_list.next);
-
-			p->thread_num--;
-			list_del(&w->worker_entry);
-		}
-		mutex_unlock(&p->thread_lock);
-	}
-
-	if (w)
-		thread_pool_exit_worker(w);
-	dprintk("%s: deleted w: %p, thread_num: %d.\n",
-			__func__, w, p->thread_num);
-}
-
-/*
- * Remove a worker with given ID.
- */
-void thread_pool_del_worker_id(struct thread_pool *p, unsigned int id)
-{
-	struct thread_pool_worker *w;
-	int found = 0;
-
-	mutex_lock(&p->thread_lock);
-	list_for_each_entry(w, &p->ready_list, worker_entry) {
-		if (w->id == id) {
-			found = 1;
-			p->thread_num--;
-			list_del(&w->worker_entry);
-			break;
-		}
-	}
-
-	if (!found) {
-		list_for_each_entry(w, &p->active_list, worker_entry) {
-			if (w->id == id) {
-				w->need_exit = 1;
-				break;
-			}
-		}
-	}
-	mutex_unlock(&p->thread_lock);
-
-	if (found)
-		thread_pool_exit_worker(w);
-}
-
-/*
- * Add new worker thread with given parameters.
- * If initialization callback fails, return error.
- */
-int thread_pool_add_worker(struct thread_pool *p,
-		char *name,
-		unsigned int id,
-		void *(* init)(void *private),
-		void (* cleanup)(void *private),
-		void *private)
-{
-	struct thread_pool_worker *w;
-	int err = -ENOMEM;
-
-	w = kzalloc(sizeof(struct thread_pool_worker), GFP_KERNEL);
-	if (!w)
-		goto err_out_exit;
-
-	w->pool = p;
-	init_waitqueue_head(&w->wait);
-	w->cleanup = cleanup;
-	w->id = id;
-
-	w->thread = kthread_run(thread_pool_worker_func, w, "%s", name);
-	if (IS_ERR(w->thread)) {
-		err = PTR_ERR(w->thread);
-		goto err_out_free;
-	}
-
-	w->private = init(private);
-	if (IS_ERR(w->private)) {
-		err = PTR_ERR(w->private);
-		goto err_out_stop_thread;
-	}
-
-	mutex_lock(&p->thread_lock);
-	list_add_tail(&w->worker_entry, &p->ready_list);
-	p->thread_num++;
-	mutex_unlock(&p->thread_lock);
-
-	return 0;
-
-err_out_stop_thread:
-	kthread_stop(w->thread);
-err_out_free:
-	kfree(w);
-err_out_exit:
-	return err;
-}
-
-/*
- * Destroy the whole pool.
- */
-void thread_pool_destroy(struct thread_pool *p)
-{
-	while (p->thread_num) {
-		dprintk("%s: num: %d.\n", __func__, p->thread_num);
-		thread_pool_del_worker(p);
-	}
-
-	kfree(p);
-}
-
-/*
- * Create a pool with given number of threads.
- * They will have sequential IDs started from zero.
- */
-struct thread_pool *thread_pool_create(int num, char *name,
-		void *(* init)(void *private),
-		void (* cleanup)(void *private),
-		void *private)
-{
-	struct thread_pool_worker *w, *tmp;
-	struct thread_pool *p;
-	int err = -ENOMEM;
-	int i;
-
-	p = kzalloc(sizeof(struct thread_pool), GFP_KERNEL);
-	if (!p)
-		goto err_out_exit;
-
-	init_waitqueue_head(&p->wait);
-	mutex_init(&p->thread_lock);
-	INIT_LIST_HEAD(&p->ready_list);
-	INIT_LIST_HEAD(&p->active_list);
-	p->thread_num = 0;
-
-	for (i=0; i<num; ++i) {
-		err = thread_pool_add_worker(p, name, i, init,
-				cleanup, private);
-		if (err)
-			goto err_out_free_all;
-	}
-
-	return p;
-
-err_out_free_all:
-	list_for_each_entry_safe(w, tmp, &p->ready_list, worker_entry) {
-		list_del(&w->worker_entry);
-		thread_pool_exit_worker(w);
-	}
-	kfree(p);
-err_out_exit:
-	return ERR_PTR(err);
-}
-
-/*
- * Schedule execution of the action on a given thread,
- * provided ID pointer has to match previously stored
- * private data.
- */
-int thread_pool_schedule_private(struct thread_pool *p,
-		int (* setup)(void *private, void *data),
-		int (* action)(void *private, void *data),
-		void *data, long timeout, void *id)
-{
-	struct thread_pool_worker *w, *tmp, *worker = NULL;
-	int err = 0;
-
-	while (!worker && !err) {
-		timeout = wait_event_interruptible_timeout(p->wait,
-				!list_empty(&p->ready_list),
-				timeout);
-
-		if (!timeout) {
-			err = -ETIMEDOUT;
-			break;
-		}
-
-		worker = NULL;
-		mutex_lock(&p->thread_lock);
-		list_for_each_entry_safe(w, tmp, &p->ready_list, worker_entry) {
-			if (id && id != w->private)
-				continue;
-
-			worker = w;
-
-			list_move_tail(&w->worker_entry, &p->active_list);
-
-			err = setup(w->private, data);
-			if (!err) {
-				w->schedule_data = data;
-				w->action = action;
-				w->has_data = 1;
-				wake_up(&w->wait);
-			} else {
-				list_move_tail(&w->worker_entry, &p->ready_list);
-			}
-
-			break;
-		}
-		mutex_unlock(&p->thread_lock);
-	}
-
-	return err;
-}
-
-/*
- * Schedule execution on arbitrary thread from the pool.
- */
-int thread_pool_schedule(struct thread_pool *p,
-		int (* setup)(void *private, void *data),
-		int (* action)(void *private, void *data),
-		void *data, long timeout)
-{
-	return thread_pool_schedule_private(p, setup,
-			action, data, timeout, NULL);
-}
diff --git a/drivers/staging/dst/trans.c b/drivers/staging/dst/trans.c
deleted file mode 100644
index 557d372a496c..000000000000
--- a/drivers/staging/dst/trans.c
+++ /dev/null
@@ -1,335 +0,0 @@
-/*
- * 2007+ Copyright (c) Evgeniy Polyakov <zbr@ioremap.net>
- * All rights reserved.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- */
-
-#include <linux/bio.h>
-#include <linux/dst.h>
-#include <linux/slab.h>
-#include <linux/mempool.h>
-
-/*
- * Transaction memory pool size.
- */
-static int dst_mempool_num = 32;
-module_param(dst_mempool_num, int, 0644);
-
-/*
- * Transaction tree management.
- */
-static inline int dst_trans_cmp(dst_gen_t gen, dst_gen_t new)
-{
-	if (gen < new)
-		return 1;
-	if (gen > new)
-		return -1;
-	return 0;
-}
-
-struct dst_trans *dst_trans_search(struct dst_node *node, dst_gen_t gen)
-{
-	struct rb_root *root = &node->trans_root;
-	struct rb_node *n = root->rb_node;
-	struct dst_trans *t, *ret = NULL;
-	int cmp;
-
-	while (n) {
-		t = rb_entry(n, struct dst_trans, trans_entry);
-
-		cmp = dst_trans_cmp(t->gen, gen);
-		if (cmp < 0)
-			n = n->rb_left;
-		else if (cmp > 0)
-			n = n->rb_right;
-		else {
-			ret = t;
-			break;
-		}
-	}
-
-	dprintk("%s: %s transaction: id: %llu.\n", __func__,
-			(ret)?"found":"not found", gen);
-
-	return ret;
-}
-
-static int dst_trans_insert(struct dst_trans *new)
-{
-	struct rb_root *root = &new->n->trans_root;
-	struct rb_node **n = &root->rb_node, *parent = NULL;
-	struct dst_trans *ret = NULL, *t;
-	int cmp;
-
-	while (*n) {
-		parent = *n;
-
-		t = rb_entry(parent, struct dst_trans, trans_entry);
-
-		cmp = dst_trans_cmp(t->gen, new->gen);
-		if (cmp < 0)
-			n = &parent->rb_left;
-		else if (cmp > 0)
-			n = &parent->rb_right;
-		else {
-			ret = t;
-			break;
-		}
-	}
-
-	new->send_time = jiffies;
-	if (ret) {
-		printk("%s: exist: old: gen: %llu, bio: %llu/%u, send_time: %lu, "
-				"new: gen: %llu, bio: %llu/%u, send_time: %lu.\n",
-			__func__,
-			ret->gen, (u64)ret->bio->bi_sector,
-			ret->bio->bi_size, ret->send_time,
-			new->gen, (u64)new->bio->bi_sector,
-			new->bio->bi_size, new->send_time);
-		return -EEXIST;
-	}
-
-	rb_link_node(&new->trans_entry, parent, n);
-	rb_insert_color(&new->trans_entry, root);
-
-	dprintk("%s: inserted: gen: %llu, bio: %llu/%u, send_time: %lu.\n",
-		__func__, new->gen, (u64)new->bio->bi_sector,
-		new->bio->bi_size, new->send_time);
-
-	return 0;
-}
-
-int dst_trans_remove_nolock(struct dst_trans *t)
-{
-	struct dst_node *n = t->n;
-
-	if (t->trans_entry.rb_parent_color) {
-		rb_erase(&t->trans_entry, &n->trans_root);
-		t->trans_entry.rb_parent_color = 0;
-	}
-	return 0;
-}
-
-int dst_trans_remove(struct dst_trans *t)
-{
-	int ret;
-	struct dst_node *n = t->n;
-
-	mutex_lock(&n->trans_lock);
-	ret = dst_trans_remove_nolock(t);
-	mutex_unlock(&n->trans_lock);
-
-	return ret;
-}
-
-/*
- * When transaction is completed and there are no more users,
- * we complete appriate block IO request with given error status.
- */
-void dst_trans_put(struct dst_trans *t)
-{
-	if (atomic_dec_and_test(&t->refcnt)) {
-		struct bio *bio = t->bio;
-
-		dprintk("%s: completed t: %p, gen: %llu, bio: %p.\n",
-				__func__, t, t->gen, bio);
-
-		bio_endio(bio, t->error);
-		bio_put(bio);
-
-		dst_node_put(t->n);
-		mempool_free(t, t->n->trans_pool);
-	}
-}
-
-/*
- * Process given block IO request: allocate transaction, insert it into the tree
- * and send/schedule crypto processing.
- */
-int dst_process_bio(struct dst_node *n, struct bio *bio)
-{
-	struct dst_trans *t;
-	int err = -ENOMEM;
-
-	t = mempool_alloc(n->trans_pool, GFP_NOFS);
-	if (!t)
-		goto err_out_exit;
-
-	t->n = dst_node_get(n);
-	t->bio = bio;
-	t->error = 0;
-	t->retries = 0;
-	atomic_set(&t->refcnt, 1);
-	t->gen = atomic_long_inc_return(&n->gen);
-
-	t->enc = bio_data_dir(bio);
-	dst_bio_to_cmd(bio, &t->cmd, DST_IO, t->gen);
-
-	mutex_lock(&n->trans_lock);
-	err = dst_trans_insert(t);
-	mutex_unlock(&n->trans_lock);
-	if (err)
-		goto err_out_free;
-
-	dprintk("%s: gen: %llu, bio: %llu/%u, dir/enc: %d, need_crypto: %d.\n",
-			__func__, t->gen, (u64)bio->bi_sector,
-			bio->bi_size, t->enc, dst_need_crypto(n));
-
-	if (dst_need_crypto(n) && t->enc)
-		dst_trans_crypto(t);
-	else
-		dst_trans_send(t);
-
-	return 0;
-
-err_out_free:
-	dst_node_put(n);
-	mempool_free(t, n->trans_pool);
-err_out_exit:
-	bio_endio(bio, err);
-	bio_put(bio);
-	return err;
-}
-
-/*
- * Scan for timeout/stale transactions.
- * Each transaction is being resent multiple times before error completion.
- */
-static void dst_trans_scan(struct work_struct *work)
-{
-	struct dst_node *n = container_of(work, struct dst_node, trans_work.work);
-	struct rb_node *rb_node;
-	struct dst_trans *t;
-	unsigned long timeout = n->trans_scan_timeout;
-	int num = 10 * n->trans_max_retries;
-
-	mutex_lock(&n->trans_lock);
-
-	for (rb_node = rb_first(&n->trans_root); rb_node; ) {
-		t = rb_entry(rb_node, struct dst_trans, trans_entry);
-
-		if (timeout && time_after(t->send_time + timeout, jiffies)
-				&& t->retries == 0)
-			break;
-#if 0
-		dprintk("%s: t: %p, gen: %llu, n: %s, retries: %u, max: %u.\n",
-			__func__, t, t->gen, n->name,
-			t->retries, n->trans_max_retries);
-#endif
-		if (--num == 0)
-			break;
-
-		dst_trans_get(t);
-
-		rb_node = rb_next(rb_node);
-
-		if (timeout && (++t->retries < n->trans_max_retries)) {
-			dst_trans_send(t);
-		} else {
-			t->error = -ETIMEDOUT;
-			dst_trans_remove_nolock(t);
-			dst_trans_put(t);
-		}
-
-		dst_trans_put(t);
-	}
-
-	mutex_unlock(&n->trans_lock);
-
-	/*
-	 * If no timeout specified then system is in the middle of exiting process,
-	 * so no need to reschedule scanning process again.
-	 */
-	if (timeout) {
-		if (!num)
-			timeout = HZ;
-		schedule_delayed_work(&n->trans_work, timeout);
-	}
-}
-
-/*
- * Flush all transactions and mark them as timed out.
- * Destroy transaction pools.
- */
-void dst_node_trans_exit(struct dst_node *n)
-{
-	struct dst_trans *t;
-	struct rb_node *rb_node;
-
-	if (!n->trans_cache)
-		return;
-
-	dprintk("%s: n: %p, cancelling the work.\n", __func__, n);
-	cancel_delayed_work_sync(&n->trans_work);
-	flush_scheduled_work();
-	dprintk("%s: n: %p, work has been cancelled.\n", __func__, n);
-
-	for (rb_node = rb_first(&n->trans_root); rb_node; ) {
-		t = rb_entry(rb_node, struct dst_trans, trans_entry);
-
-		dprintk("%s: t: %p, gen: %llu, n: %s.\n",
-			__func__, t, t->gen, n->name);
-
-		rb_node = rb_next(rb_node);
-
-		t->error = -ETIMEDOUT;
-		dst_trans_remove_nolock(t);
-		dst_trans_put(t);
-	}
-
-	mempool_destroy(n->trans_pool);
-	kmem_cache_destroy(n->trans_cache);
-}
-
-/*
- * Initialize transaction storage for given node.
- * Transaction stores not only control information,
- * but also network command and crypto data (if needed)
- * to reduce number of allocations. Thus transaction size
- * differs from node to node.
- */
-int dst_node_trans_init(struct dst_node *n, unsigned int size)
-{
-	/*
-	 * We need this, since node with given name can be dropped from the
-	 * hash table, but be still alive, so subsequent creation of the node
-	 * with the same name may collide with existing cache name.
-	 */
-
-	snprintf(n->cache_name, sizeof(n->cache_name), "%s-%p", n->name, n);
-
-	n->trans_cache = kmem_cache_create(n->cache_name,
-			size + n->crypto.crypto_attached_size,
-			0, 0, NULL);
-	if (!n->trans_cache)
-		goto err_out_exit;
-
-	n->trans_pool = mempool_create_slab_pool(dst_mempool_num, n->trans_cache);
-	if (!n->trans_pool)
-		goto err_out_cache_destroy;
-
-	mutex_init(&n->trans_lock);
-	n->trans_root = RB_ROOT;
-
-	INIT_DELAYED_WORK(&n->trans_work, dst_trans_scan);
-	schedule_delayed_work(&n->trans_work, n->trans_scan_timeout);
-
-	dprintk("%s: n: %p, size: %u, crypto: %u.\n",
-		__func__, n, size, n->crypto.crypto_attached_size);
-
-	return 0;
-
-err_out_cache_destroy:
-	kmem_cache_destroy(n->trans_cache);
-err_out_exit:
-	return -ENOMEM;
-}
diff --git a/drivers/staging/et131x/et1310_address_map.h b/drivers/staging/et131x/et1310_address_map.h
index 2c3d65a622a7..e715e4dcb523 100644
--- a/drivers/staging/et131x/et1310_address_map.h
+++ b/drivers/staging/et131x/et1310_address_map.h
@@ -198,26 +198,19 @@ typedef struct _GLOBAL_t {			/* Location: */
 /*
  * structure for txdma packet ring number of descriptor reg in txdma address
  * map.  Located at address 0x100C
+ *
+ * 31-10: unused
+ * 9-0: pr ndes
  */
-typedef union _TXDMA_PR_NUM_DES_t {
-	u32 value;
-	struct {
-#ifdef _BIT_FIELDS_HTOL
-		u32 unused:22;	/* bits 10-31 */
-		u32 pr_ndes:10;	/* bits 0-9 */
-#else
-		u32 pr_ndes:10;	/* bits 0-9 */
-		u32 unused:22;	/* bits 10-31 */
-#endif
-	} bits;
-} TXDMA_PR_NUM_DES_t, *PTXDMA_PR_NUM_DES_t;
 
+#define ET_DMA12_MASK		0x0FFF	/* 12 bit mask for DMA12W types */
+#define ET_DMA12_WRAP		0x1000
+#define ET_DMA10_MASK		0x03FF	/* 10 bit mask for DMA10W types */
+#define ET_DMA10_WRAP		0x0400
+#define ET_DMA4_MASK		0x000F	/* 4 bit mask for DMA4W types */
+#define ET_DMA4_WRAP		0x0010
 
-#define ET_DMA10_MASK		0x3FF	/* 10 bit mask for DMA10W types */
-#define ET_DMA10_WRAP		0x400
-#define ET_DMA4_MASK		0x00F	/* 4 bit mask for DMA4W types */
-#define ET_DMA4_WRAP		0x010
-
+#define INDEX12(x)	((x) & ET_DMA12_MASK)
 #define INDEX10(x)	((x) & ET_DMA10_MASK)
 #define INDEX4(x)	((x) & ET_DMA4_MASK)
 
@@ -226,6 +219,11 @@ extern inline void add_10bit(u32 *v, int n)
 	*v = INDEX10(*v + n) | (*v & ET_DMA10_WRAP);
 }
 
+extern inline void add_12bit(u32 *v, int n)
+{
+	*v = INDEX12(*v + n) | (*v & ET_DMA12_WRAP);
+}
+
 /*
  * 10bit DMA with wrap
  * txdma tx queue write address reg in txdma address map at 0x1010
@@ -261,7 +259,7 @@ typedef struct _TXDMA_t {		/* Location: */
 	u32 csr;			/*  0x1000 */
 	u32 pr_base_hi;			/*  0x1004 */
 	u32 pr_base_lo;			/*  0x1008 */
-	TXDMA_PR_NUM_DES_t pr_num_des;	/*  0x100C */
+	u32 pr_num_des;			/*  0x100C */
 	u32 txq_wr_addr;		/*  0x1010 */
 	u32 txq_wr_addr_ext;		/*  0x1014 */
 	u32 txq_rd_addr;		/*  0x1018 */
@@ -349,36 +347,18 @@ typedef union _RXDMA_CSR_t {
 /*
  * structure for number of packets done reg in rxdma address map
  * located at address 0x200C
+ *
+ * 31-8: unused
+ * 7-0: num done
  */
-typedef union _RXDMA_NUM_PKT_DONE_t {
-	u32 value;
-	struct {
-#ifdef _BIT_FIELDS_HTOL
-		u32 unused:24;	/* bits 8-31 */
-		u32 num_done:8;	/* bits 0-7 */
-#else
-		u32 num_done:8;	/* bits 0-7 */
-		u32 unused:24;	/* bits 8-31 */
-#endif
-	} bits;
-} RXDMA_NUM_PKT_DONE_t, *PRXDMA_NUM_PKT_DONE_t;
 
 /*
  * structure for max packet time reg in rxdma address map
  * located at address 0x2010
+ *
+ * 31-18: unused
+ * 17-0: time done
  */
-typedef union _RXDMA_MAX_PKT_TIME_t {
-	u32 value;
-	struct {
-#ifdef _BIT_FIELDS_HTOL
-		u32 unused:14;		/* bits 18-31 */
-		u32 time_done:18;	/* bits 0-17 */
-#else
-		u32 time_done:18;	/* bits 0-17 */
-		u32 unused:14;		/* bits 18-31 */
-#endif
-	} bits;
-} RXDMA_MAX_PKT_TIME_t, *PRXDMA_MAX_PKT_TIME_t;
 
 /*
  * structure for rx queue read address reg in rxdma address map
@@ -413,91 +393,44 @@ typedef union _RXDMA_MAX_PKT_TIME_t {
 /*
  * structure for packet status ring number of descriptors reg in rxdma address
  * map.  Located at address 0x2028
+ *
+ * 31-12: unused
+ * 11-0: psr ndes
  */
-typedef union _RXDMA_PSR_NUM_DES_t {
-	u32 value;
-	struct {
-#ifdef _BIT_FIELDS_HTOL
-		u32 unused:20;		/* bits 12-31 */
-		u32 psr_ndes:12;	/* bit 0-11 */
-#else
-		u32 psr_ndes:12;	/* bit 0-11 */
-		u32 unused:20;		/* bits 12-31 */
-#endif
-	} bits;
-} RXDMA_PSR_NUM_DES_t, *PRXDMA_PSR_NUM_DES_t;
 
 /*
  * structure for packet status ring available offset reg in rxdma address map
  * located at address 0x202C
+ *
+ * 31-13: unused
+ * 12: psr avail wrap
+ * 11-0: psr avail
  */
-typedef union _RXDMA_PSR_AVAIL_OFFSET_t {
-	u32 value;
-	struct {
-#ifdef _BIT_FIELDS_HTOL
-		u32 unused:19;		/* bits 13-31 */
-		u32 psr_avail_wrap:1;	/* bit 12 */
-		u32 psr_avail:12;	/* bit 0-11 */
-#else
-		u32 psr_avail:12;	/* bit 0-11 */
-		u32 psr_avail_wrap:1;	/* bit 12 */
-		u32 unused:19;		/* bits 13-31 */
-#endif
-	} bits;
-} RXDMA_PSR_AVAIL_OFFSET_t, *PRXDMA_PSR_AVAIL_OFFSET_t;
 
 /*
  * structure for packet status ring full offset reg in rxdma address map
  * located at address 0x2030
+ *
+ * 31-13: unused
+ * 12: psr full wrap
+ * 11-0: psr full
  */
-typedef union _RXDMA_PSR_FULL_OFFSET_t {
-	u32 value;
-	struct {
-#ifdef _BIT_FIELDS_HTOL
-		u32 unused:19;		/* bits 13-31 */
-		u32 psr_full_wrap:1;	/* bit 12 */
-		u32 psr_full:12;	/* bit 0-11 */
-#else
-		u32 psr_full:12;	/* bit 0-11 */
-		u32 psr_full_wrap:1;	/* bit 12 */
-		u32 unused:19;		/* bits 13-31 */
-#endif
-	} bits;
-} RXDMA_PSR_FULL_OFFSET_t, *PRXDMA_PSR_FULL_OFFSET_t;
 
 /*
  * structure for packet status ring access index reg in rxdma address map
  * located at address 0x2034
+ *
+ * 31-5: unused
+ * 4-0: psr_ai
  */
-typedef union _RXDMA_PSR_ACCESS_INDEX_t {
-	u32 value;
-	struct {
-#ifdef _BIT_FIELDS_HTOL
-		u32 unused:27;	/* bits 5-31 */
-		u32 psr_ai:5;	/* bits 0-4 */
-#else
-		u32 psr_ai:5;	/* bits 0-4 */
-		u32 unused:27;	/* bits 5-31 */
-#endif
-	} bits;
-} RXDMA_PSR_ACCESS_INDEX_t, *PRXDMA_PSR_ACCESS_INDEX_t;
 
 /*
  * structure for packet status ring minimum descriptors reg in rxdma address
  * map.  Located at address 0x2038
+ *
+ * 31-12: unused
+ * 11-0: psr_min
  */
-typedef union _RXDMA_PSR_MIN_DES_t {
-	u32 value;
-	struct {
-#ifdef _BIT_FIELDS_HTOL
-		u32 unused:20;	/* bits 12-31 */
-		u32 psr_min:12;	/* bits 0-11 */
-#else
-		u32 psr_min:12;	/* bits 0-11 */
-		u32 unused:20;	/* bits 12-31 */
-#endif
-	} bits;
-} RXDMA_PSR_MIN_DES_t, *PRXDMA_PSR_MIN_DES_t;
 
 /*
  * structure for free buffer ring base lo address reg in rxdma address map
@@ -514,6 +447,9 @@ typedef union _RXDMA_PSR_MIN_DES_t {
 /*
  * structure for free buffer ring number of descriptors reg in rxdma address
  * map.  Located at address 0x2044
+ *
+ * 31-10: unused
+ * 9-0: fbr ndesc
  */
 typedef union _RXDMA_FBR_NUM_DES_t {
 	u32 value;
@@ -543,36 +479,18 @@ typedef union _RXDMA_FBR_NUM_DES_t {
 /*
  * structure for free buffer cache 0 full offset reg in rxdma address map
  * located at address 0x2050
+ *
+ * 31-5: unused
+ * 4-0: fbc rdi
  */
-typedef union _RXDMA_FBC_RD_INDEX_t {
-	u32 value;
-	struct {
-#ifdef _BIT_FIELDS_HTOL
-		u32 unused:27;	/* bits 5-31 */
-		u32 fbc_rdi:5;	/* bit 0-4 */
-#else
-		u32 fbc_rdi:5;	/* bit 0-4 */
-		u32 unused:27;	/* bits 5-31 */
-#endif
-	} bits;
-} RXDMA_FBC_RD_INDEX_t, *PRXDMA_FBC_RD_INDEX_t;
 
 /*
  * structure for free buffer ring 0 minimum descriptor reg in rxdma address map
  * located at address 0x2054
+ *
+ * 31-10: unused
+ * 9-0: fbr min
  */
-typedef union _RXDMA_FBR_MIN_DES_t {
-	u32 value;
-	struct {
-#ifdef _BIT_FIELDS_HTOL
-		u32 unused:22;	/* bits 10-31 */
-		u32 fbr_min:10;	/* bits 0-9 */
-#else
-		u32 fbr_min:10;	/* bits 0-9 */
-		u32 unused:22;	/* bits 10-31 */
-#endif
-	} bits;
-} RXDMA_FBR_MIN_DES_t, *PRXDMA_FBR_MIN_DES_t;
 
 /*
  * structure for free buffer ring 1 base address lo reg in rxdma address map
@@ -618,32 +536,32 @@ typedef struct _RXDMA_t {				/* Location: */
 	RXDMA_CSR_t csr;				/*  0x2000 */
 	u32 dma_wb_base_lo;				/*  0x2004 */
 	u32 dma_wb_base_hi;				/*  0x2008 */
-	RXDMA_NUM_PKT_DONE_t num_pkt_done;		/*  0x200C */
-	RXDMA_MAX_PKT_TIME_t max_pkt_time;		/*  0x2010 */
+	u32 num_pkt_done;				/*  0x200C */
+	u32 max_pkt_time;				/*  0x2010 */
 	u32 rxq_rd_addr;				/*  0x2014 */
-	u32 rxq_rd_addr_ext;			/*  0x2018 */
+	u32 rxq_rd_addr_ext;				/*  0x2018 */
 	u32 rxq_wr_addr;				/*  0x201C */
 	u32 psr_base_lo;				/*  0x2020 */
 	u32 psr_base_hi;				/*  0x2024 */
-	RXDMA_PSR_NUM_DES_t psr_num_des;		/*  0x2028 */
-	RXDMA_PSR_AVAIL_OFFSET_t psr_avail_offset;	/*  0x202C */
-	RXDMA_PSR_FULL_OFFSET_t psr_full_offset;	/*  0x2030 */
-	RXDMA_PSR_ACCESS_INDEX_t psr_access_index;	/*  0x2034 */
-	RXDMA_PSR_MIN_DES_t psr_min_des;		/*  0x2038 */
+	u32 psr_num_des;				/*  0x2028 */
+	u32 psr_avail_offset;				/*  0x202C */
+	u32 psr_full_offset;				/*  0x2030 */
+	u32 psr_access_index;				/*  0x2034 */
+	u32 psr_min_des;				/*  0x2038 */
 	u32 fbr0_base_lo;				/*  0x203C */
 	u32 fbr0_base_hi;				/*  0x2040 */
-	RXDMA_FBR_NUM_DES_t fbr0_num_des;		/*  0x2044 */
-	u32 fbr0_avail_offset;			/*  0x2048 */
-	u32 fbr0_full_offset;			/*  0x204C */
-	RXDMA_FBC_RD_INDEX_t fbr0_rd_index;		/*  0x2050 */
-	RXDMA_FBR_MIN_DES_t fbr0_min_des;		/*  0x2054 */
+	u32 fbr0_num_des;				/*  0x2044 */
+	u32 fbr0_avail_offset;				/*  0x2048 */
+	u32 fbr0_full_offset;				/*  0x204C */
+	u32 fbr0_rd_index;				/*  0x2050 */
+	u32 fbr0_min_des;				/*  0x2054 */
 	u32 fbr1_base_lo;				/*  0x2058 */
 	u32 fbr1_base_hi;				/*  0x205C */
-	RXDMA_FBR_NUM_DES_t fbr1_num_des;		/*  0x2060 */
-	u32 fbr1_avail_offset;			/*  0x2064 */
-	u32 fbr1_full_offset;			/*  0x2068 */
-	RXDMA_FBC_RD_INDEX_t fbr1_rd_index;		/*  0x206C */
-	RXDMA_FBR_MIN_DES_t fbr1_min_des;		/*  0x2070 */
+	u32 fbr1_num_des;				/*  0x2060 */
+	u32 fbr1_avail_offset;				/*  0x2064 */
+	u32 fbr1_full_offset;				/*  0x2068 */
+	u32 fbr1_rd_index;				/*  0x206C */
+	u32 fbr1_min_des;				/*  0x2070 */
 } RXDMA_t, *PRXDMA_t;
 
 /* END OF RXDMA REGISTER ADDRESS MAP */
@@ -685,23 +603,11 @@ typedef union _TXMAC_CTL_t {
 /*
  * structure for shadow pointer reg in txmac address map
  * located at address 0x3004
+ * 31-27: reserved
+ * 26-16: txq rd ptr
+ * 15-11: reserved
+ * 10-0: txq wr ptr
  */
-typedef union _TXMAC_SHADOW_PTR_t {
-	u32 value;
-	struct {
-#ifdef _BIT_FIELDS_HTOL
-		u32 reserved2:5;	/* bits 27-31 */
-		u32 txq_rd_ptr:11;	/* bits 16-26 */
-		u32 reserved:5;		/* bits 11-15 */
-		u32 txq_wr_ptr:11;	/* bits 0-10 */
-#else
-		u32 txq_wr_ptr:11;	/* bits 0-10 */
-		u32 reserved:5;		/* bits 11-15 */
-		u32 txq_rd_ptr:11;	/* bits 16-26 */
-		u32 reserved2:5;	/* bits 27-31 */
-#endif
-	} bits;
-} TXMAC_SHADOW_PTR_t, *PTXMAC_SHADOW_PTR_t;
 
 /*
  * structure for error count reg in txmac address map
@@ -727,59 +633,26 @@ typedef union _TXMAC_ERR_CNT_t {
 /*
  * structure for max fill reg in txmac address map
  * located at address 0x300C
+ * 31-12: unused
+ * 11-0: max fill
  */
-typedef union _TXMAC_MAX_FILL_t {
-	u32 value;
-	struct {
-#ifdef _BIT_FIELDS_HTOL
-		u32 unused:20;		/* bits 12-31 */
-		u32 max_fill:12;	/* bits 0-11 */
-#else
-		u32 max_fill:12;	/* bits 0-11 */
-		u32 unused:20;		/* bits 12-31 */
-#endif
-	} bits;
-} TXMAC_MAX_FILL_t, *PTXMAC_MAX_FILL_t;
 
 /*
  * structure for cf parameter reg in txmac address map
  * located at address 0x3010
+ * 31-16: cfep
+ * 15-0: cfpt
  */
-typedef union _TXMAC_CF_PARAM_t {
-	u32 value;
-	struct {
-#ifdef _BIT_FIELDS_HTOL
-		u32 cfep:16;	/* bits 16-31 */
-		u32 cfpt:16;	/* bits 0-15 */
-#else
-		u32 cfpt:16;	/* bits 0-15 */
-		u32 cfep:16;	/* bits 16-31 */
-#endif
-	} bits;
-} TXMAC_CF_PARAM_t, *PTXMAC_CF_PARAM_t;
 
 /*
  * structure for tx test reg in txmac address map
  * located at address 0x3014
+ * 31-17: unused
+ * 16: reserved1
+ * 15: txtest_en
+ * 14-11: unused
+ * 10-0: txq test pointer
  */
-typedef union _TXMAC_TXTEST_t {
-	u32 value;
-	struct {
-#ifdef _BIT_FIELDS_HTOL
-		u32 unused2:15;		/* bits 17-31 */
-		u32 reserved1:1;	/* bit 16 */
-		u32 txtest_en:1;	/* bit 15 */
-		u32 unused1:4;		/* bits 11-14 */
-		u32 txqtest_ptr:11;	/* bits 0-11 */
-#else
-		u32 txqtest_ptr:11;	/* bits 0-10 */
-		u32 unused1:4;		/* bits 11-14 */
-		u32 txtest_en:1;	/* bit 15 */
-		u32 reserved1:1;	/* bit 16 */
-		u32 unused2:15;		/* bits 17-31 */
-#endif
-	} bits;
-} TXMAC_TXTEST_t, *PTXMAC_TXTEST_t;
 
 /*
  * structure for error reg in txmac address map
@@ -846,35 +719,25 @@ typedef union _TXMAC_ERR_INT_t {
 /*
  * structure for error interrupt reg in txmac address map
  * located at address 0x3020
+ *
+ * 31-2: unused
+ * 1: bp_req
+ * 0: bp_xonxoff
  */
-typedef union _TXMAC_CP_CTRL_t {
-	u32 value;
-	struct {
-#ifdef _BIT_FIELDS_HTOL
-		u32 unused:30;		/* bits 2-31 */
-		u32 bp_req:1;		/* bit 1 */
-		u32 bp_xonxoff:1;	/* bit 0 */
-#else
-		u32 bp_xonxoff:1;	/* bit 0 */
-		u32 bp_req:1;		/* bit 1 */
-		u32 unused:30;		/* bits 2-31 */
-#endif
-	} bits;
-} TXMAC_BP_CTRL_t, *PTXMAC_BP_CTRL_t;
 
 /*
  * Tx MAC Module of JAGCore Address Mapping
  */
 typedef struct _TXMAC_t {		/* Location: */
 	TXMAC_CTL_t ctl;		/*  0x3000 */
-	TXMAC_SHADOW_PTR_t shadow_ptr;	/*  0x3004 */
+	u32 shadow_ptr;			/*  0x3004 */
 	TXMAC_ERR_CNT_t err_cnt;	/*  0x3008 */
-	TXMAC_MAX_FILL_t max_fill;	/*  0x300C */
-	TXMAC_CF_PARAM_t cf_param;	/*  0x3010 */
-	TXMAC_TXTEST_t tx_test;		/*  0x3014 */
+	u32 max_fill;			/*  0x300C */
+	u32 cf_param;			/*  0x3010 */
+	u32 tx_test;			/*  0x3014 */
 	TXMAC_ERR_t err;		/*  0x3018 */
 	TXMAC_ERR_INT_t err_int;	/*  0x301C */
-	TXMAC_BP_CTRL_t bp_ctrl;	/*  0x3020 */
+	u32 bp_ctrl;			/*  0x3020 */
 } TXMAC_t, *PTXMAC_t;
 
 /* END OF TXMAC REGISTER ADDRESS MAP */
@@ -1308,157 +1171,77 @@ typedef struct _RXMAC_t {				/* Location: */
 /*
  * structure for configuration #1 reg in mac address map.
  * located at address 0x5000
- */
-typedef union _MAC_CFG1_t {
-	u32 value;
-	struct {
-#ifdef _BIT_FIELDS_HTOL
-		u32 soft_reset:1;		/* bit 31 */
-		u32 sim_reset:1;		/* bit 30 */
-		u32 reserved3:10;		/* bits 20-29 */
-		u32 reset_rx_mc:1;		/* bit 19 */
-		u32 reset_tx_mc:1;		/* bit 18 */
-		u32 reset_rx_fun:1;	/* bit 17 */
-		u32 reset_tx_fun:1;	/* bit 16 */
-		u32 reserved2:7;		/* bits 9-15 */
-		u32 loop_back:1;		/* bit 8 */
-		u32 reserved1:2;		/* bits 6-7 */
-		u32 rx_flow:1;		/* bit 5 */
-		u32 tx_flow:1;		/* bit 4 */
-		u32 syncd_rx_en:1;		/* bit 3 */
-		u32 rx_enable:1;		/* bit 2 */
-		u32 syncd_tx_en:1;		/* bit 1 */
-		u32 tx_enable:1;		/* bit 0 */
-#else
-		u32 tx_enable:1;		/* bit 0 */
-		u32 syncd_tx_en:1;		/* bit 1 */
-		u32 rx_enable:1;		/* bit 2 */
-		u32 syncd_rx_en:1;		/* bit 3 */
-		u32 tx_flow:1;		/* bit 4 */
-		u32 rx_flow:1;		/* bit 5 */
-		u32 reserved1:2;		/* bits 6-7 */
-		u32 loop_back:1;		/* bit 8 */
-		u32 reserved2:7;		/* bits 9-15 */
-		u32 reset_tx_fun:1;	/* bit 16 */
-		u32 reset_rx_fun:1;	/* bit 17 */
-		u32 reset_tx_mc:1;		/* bit 18 */
-		u32 reset_rx_mc:1;		/* bit 19 */
-		u32 reserved3:10;		/* bits 20-29 */
-		u32 sim_reset:1;		/* bit 30 */
-		u32 soft_reset:1;		/* bit 31 */
-#endif
-	} bits;
-} MAC_CFG1_t, *PMAC_CFG1_t;
+ *
+ * 31: soft reset
+ * 30: sim reset
+ * 29-20: reserved
+ * 19: reset rx mc
+ * 18: reset tx mc
+ * 17: reset rx func
+ * 16: reset tx fnc
+ * 15-9: reserved
+ * 8: loopback
+ * 7-6: reserved
+ * 5: rx flow
+ * 4: tx flow
+ * 3: syncd rx en
+ * 2: rx enable
+ * 1: syncd tx en
+ * 0: tx enable
+ */
+
+#define CFG1_LOOPBACK	0x00000100
+#define CFG1_RX_FLOW	0x00000020
+#define CFG1_TX_FLOW	0x00000010
+#define CFG1_RX_ENABLE	0x00000004
+#define CFG1_TX_ENABLE	0x00000001
+#define CFG1_WAIT	0x0000000A	/* RX & TX syncd */
 
 /*
  * structure for configuration #2 reg in mac address map.
  * located at address 0x5004
+ * 31-16: reserved
+ * 15-12: preamble
+ * 11-10: reserved
+ * 9-8: if mode
+ * 7-6: reserved
+ * 5: huge frame
+ * 4: length check
+ * 3: undefined
+ * 2: pad crc
+ * 1: crc enable
+ * 0: full duplex
  */
-typedef union _MAC_CFG2_t {
-	u32 value;
-	struct {
-#ifdef _BIT_FIELDS_HTOL
-		u32 reserved3:16;		/* bits 16-31 */
-		u32 preamble_len:4;	/* bits 12-15 */
-		u32 reserved2:2;		/* bits 10-11 */
-		u32 if_mode:2;		/* bits 8-9 */
-		u32 reserved1:2;		/* bits 6-7 */
-		u32 huge_frame:1;		/* bit 5 */
-		u32 len_check:1;		/* bit 4 */
-		u32 undefined:1;		/* bit 3 */
-		u32 pad_crc:1;		/* bit 2 */
-		u32 crc_enable:1;		/* bit 1 */
-		u32 full_duplex:1;		/* bit 0 */
-#else
-		u32 full_duplex:1;		/* bit 0 */
-		u32 crc_enable:1;		/* bit 1 */
-		u32 pad_crc:1;		/* bit 2 */
-		u32 undefined:1;		/* bit 3 */
-		u32 len_check:1;		/* bit 4 */
-		u32 huge_frame:1;		/* bit 5 */
-		u32 reserved1:2;		/* bits 6-7 */
-		u32 if_mode:2;		/* bits 8-9 */
-		u32 reserved2:2;		/* bits 10-11 */
-		u32 preamble_len:4;	/* bits 12-15 */
-		u32 reserved3:16;		/* bits 16-31 */
-#endif
-	} bits;
-} MAC_CFG2_t, *PMAC_CFG2_t;
+
 
 /*
  * structure for Interpacket gap reg in mac address map.
  * located at address 0x5008
- */
-typedef union _MAC_IPG_t {
-	u32 value;
-	struct {
-#ifdef _BIT_FIELDS_HTOL
-		u32 reserved:1;		/* bit 31 */
-		u32 non_B2B_ipg_1:7;	/* bits 24-30 */
-		u32 undefined2:1;		/* bit 23 */
-		u32 non_B2B_ipg_2:7;	/* bits 16-22 */
-		u32 min_ifg_enforce:8;	/* bits 8-15 */
-		u32 undefined1:1;		/* bit 7 */
-		u32 B2B_ipg:7;		/* bits 0-6 */
-#else
-		u32 B2B_ipg:7;		/* bits 0-6 */
-		u32 undefined1:1;		/* bit 7 */
-		u32 min_ifg_enforce:8;	/* bits 8-15 */
-		u32 non_B2B_ipg_2:7;	/* bits 16-22 */
-		u32 undefined2:1;		/* bit 23 */
-		u32 non_B2B_ipg_1:7;	/* bits 24-30 */
-		u32 reserved:1;		/* bit 31 */
-#endif
-	} bits;
-} MAC_IPG_t, *PMAC_IPG_t;
-
-/*
+ *
+ * 31: reserved
+ * 30-24: non B2B ipg 1
+ * 23: undefined
+ * 22-16: non B2B ipg 2
+ * 15-8: Min ifg enforce
+ * 7-0: B2B ipg
+ *
  * structure for half duplex reg in mac address map.
  * located at address 0x500C
+ * 31-24: reserved
+ * 23-20: Alt BEB trunc
+ * 19: Alt BEB enable
+ * 18: BP no backoff
+ * 17: no backoff
+ * 16: excess defer
+ * 15-12: re-xmit max
+ * 11-10: reserved
+ * 9-0: collision window
  */
-typedef union _MAC_HFDP_t {
-	u32 value;
-	struct {
-#ifdef _BIT_FIELDS_HTOL
-		u32 reserved2:8;		/* bits 24-31 */
-		u32 alt_beb_trunc:4;	/* bits 23-20 */
-		u32 alt_beb_enable:1;	/* bit 19 */
-		u32 bp_no_backoff:1;	/* bit 18 */
-		u32 no_backoff:1;		/* bit 17 */
-		u32 excess_defer:1;	/* bit 16 */
-		u32 rexmit_max:4;		/* bits 12-15 */
-		u32 reserved1:2;		/* bits 10-11 */
-		u32 coll_window:10;	/* bits 0-9 */
-#else
-		u32 coll_window:10;	/* bits 0-9 */
-		u32 reserved1:2;		/* bits 10-11 */
-		u32 rexmit_max:4;		/* bits 12-15 */
-		u32 excess_defer:1;	/* bit 16 */
-		u32 no_backoff:1;		/* bit 17 */
-		u32 bp_no_backoff:1;	/* bit 18 */
-		u32 alt_beb_enable:1;	/* bit 19 */
-		u32 alt_beb_trunc:4;	/* bits 23-20 */
-		u32 reserved2:8;		/* bits 24-31 */
-#endif
-	} bits;
-} MAC_HFDP_t, *PMAC_HFDP_t;
 
 /*
  * structure for Maximum Frame Length reg in mac address map.
- * located at address 0x5010
+ * located at address 0x5010: bits 0-15 hold the length.
  */
-typedef union _MAC_MAX_FM_LEN_t {
-	u32 value;
-	struct {
-#ifdef _BIT_FIELDS_HTOL
-		u32 reserved:16;	/* bits 16-31 */
-		u32 max_len:16;	/* bits 0-15 */
-#else
-		u32 max_len:16;	/* bits 0-15 */
-		u32 reserved:16;	/* bits 16-31 */
-#endif
-	} bits;
-} MAC_MAX_FM_LEN_t, *PMAC_MAX_FM_LEN_t;
 
 /*
  * structure for Reserve 1 reg in mac address map.
@@ -1469,186 +1252,87 @@ typedef union _MAC_MAX_FM_LEN_t {
 /*
  * structure for Test reg in mac address map.
  * located at address 0x501C
+ * test: bits 0-2, rest unused
  */
-typedef union _MAC_TEST_t {
-	u32 value;
-	struct {
-#ifdef _BIT_FIELDS_HTOL
-		u32 unused:29;	/* bits 3-31 */
-		u32 mac_test:3;	/* bits 0-2 */
-#else
-		u32 mac_test:3;	/* bits 0-2 */
-		u32 unused:29;	/* bits 3-31 */
-#endif
-	} bits;
-} MAC_TEST_t, *PMAC_TEST_t;
 
 /*
  * structure for MII Management Configuration reg in mac address map.
  * located at address 0x5020
+ *
+ * 31: reset MII mgmt
+ * 30-6: unused
+ * 5: scan auto increment
+ * 4: preamble supress
+ * 3: undefined
+ * 2-0: mgmt clock reset
  */
-typedef union _MII_MGMT_CFG_t {
-	u32 value;
-	struct {
-#ifdef _BIT_FIELDS_HTOL
-		u32 reset_mii_mgmt:1;	/* bit 31 */
-		u32 reserved:25;		/* bits 6-30 */
-		u32 scan_auto_incremt:1;	/* bit 5 */
-		u32 preamble_suppress:1;	/* bit 4 */
-		u32 undefined:1;		/* bit 3 */
-		u32 mgmt_clk_reset:3;	/* bits 0-2 */
-#else
-		u32 mgmt_clk_reset:3;	/* bits 0-2 */
-		u32 undefined:1;		/* bit 3 */
-		u32 preamble_suppress:1;	/* bit 4 */
-		u32 scan_auto_incremt:1;	/* bit 5 */
-		u32 reserved:25;		/* bits 6-30 */
-		u32 reset_mii_mgmt:1;	/* bit 31 */
-#endif
-	} bits;
-} MII_MGMT_CFG_t, *PMII_MGMT_CFG_t;
 
 /*
  * structure for MII Management Command reg in mac address map.
  * located at address 0x5024
+ * bit 1: scan cycle
+ * bit 0: read cycle
  */
-typedef union _MII_MGMT_CMD_t {
-	u32 value;
-	struct {
-#ifdef _BIT_FIELDS_HTOL
-		u32 reserved:30;	/* bits 2-31 */
-		u32 scan_cycle:1;	/* bit 1 */
-		u32 read_cycle:1;	/* bit 0 */
-#else
-		u32 read_cycle:1;	/* bit 0 */
-		u32 scan_cycle:1;	/* bit 1 */
-		u32 reserved:30;	/* bits 2-31 */
-#endif
-	} bits;
-} MII_MGMT_CMD_t, *PMII_MGMT_CMD_t;
 
 /*
  * structure for MII Management Address reg in mac address map.
  * located at address 0x5028
+ * 31-13: reserved
+ * 12-8: phy addr
+ * 7-5: reserved
+ * 4-0: register
  */
-typedef union _MII_MGMT_ADDR_t {
-	u32 value;
-	struct {
-#ifdef _BIT_FIELDS_HTOL
-		u32 reserved2:19;	/* bit 13-31 */
-		u32 phy_addr:5;	/* bits 8-12 */
-		u32 reserved1:3;	/* bits 5-7 */
-		u32 reg_addr:5;	/* bits 0-4 */
-#else
-		u32 reg_addr:5;	/* bits 0-4 */
-		u32 reserved1:3;	/* bits 5-7 */
-		u32 phy_addr:5;	/* bits 8-12 */
-		u32 reserved2:19;	/* bit 13-31 */
-#endif
-	} bits;
-} MII_MGMT_ADDR_t, *PMII_MGMT_ADDR_t;
+
+#define MII_ADDR(phy,reg)	((phy) << 8 | (reg))
 
 /*
  * structure for MII Management Control reg in mac address map.
  * located at address 0x502C
+ * 31-16: reserved
+ * 15-0: phy control
  */
-typedef union _MII_MGMT_CTRL_t {
-	u32 value;
-	struct {
-#ifdef _BIT_FIELDS_HTOL
-		u32 reserved:16;	/* bits 16-31 */
-		u32 phy_ctrl:16;	/* bits 0-15 */
-#else
-		u32 phy_ctrl:16;	/* bits 0-15 */
-		u32 reserved:16;	/* bits 16-31 */
-#endif
-	} bits;
-} MII_MGMT_CTRL_t, *PMII_MGMT_CTRL_t;
 
 /*
  * structure for MII Management Status reg in mac address map.
  * located at address 0x5030
+ * 31-16: reserved
+ * 15-0: phy control
  */
-typedef union _MII_MGMT_STAT_t {
-	u32 value;
-	struct {
-#ifdef _BIT_FIELDS_HTOL
-		u32 reserved:16;	/* bits 16-31 */
-		u32 phy_stat:16;	/* bits 0-15 */
-#else
-		u32 phy_stat:16;	/* bits 0-15 */
-		u32 reserved:16;	/* bits 16-31 */
-#endif
-	} bits;
-} MII_MGMT_STAT_t, *PMII_MGMT_STAT_t;
 
 /*
  * structure for MII Management Indicators reg in mac address map.
  * located at address 0x5034
+ * 31-3: reserved
+ * 2: not valid
+ * 1: scanning
+ * 0: busy
  */
-typedef union _MII_MGMT_INDICATOR_t {
-	u32 value;
-	struct {
-#ifdef _BIT_FIELDS_HTOL
-		u32 reserved:29;	/* bits 3-31 */
-		u32 not_valid:1;	/* bit 2 */
-		u32 scanning:1;	/* bit 1 */
-		u32 busy:1;	/* bit 0 */
-#else
-		u32 busy:1;	/* bit 0 */
-		u32 scanning:1;	/* bit 1 */
-		u32 not_valid:1;	/* bit 2 */
-		u32 reserved:29;	/* bits 3-31 */
-#endif
-	} bits;
-} MII_MGMT_INDICATOR_t, *PMII_MGMT_INDICATOR_t;
+
+#define MGMT_BUSY	0x00000001	/* busy */
+#define MGMT_WAIT	0x00000005	/* busy | not valid */
 
 /*
  * structure for Interface Control reg in mac address map.
  * located at address 0x5038
+ *
+ * 31: reset if module
+ * 30-28: reserved
+ * 27: tbi mode
+ * 26: ghd mode
+ * 25: lhd mode
+ * 24: phy mode
+ * 23: reset per mii
+ * 22-17: reserved
+ * 16: speed
+ * 15: reset pe100x
+ * 14-11: reserved
+ * 10: force quiet
+ * 9: no cipher
+ * 8: disable link fail
+ * 7: reset gpsi
+ * 6-1: reserved
+ * 0: enable jabber protection
  */
-typedef union _MAC_IF_CTRL_t {
-	u32 value;
-	struct {
-#ifdef _BIT_FIELDS_HTOL
-		u32 reset_if_module:1;	/* bit 31 */
-		u32 reserved4:3;		/* bit 28-30 */
-		u32 tbi_mode:1;		/* bit 27 */
-		u32 ghd_mode:1;		/* bit 26 */
-		u32 lhd_mode:1;		/* bit 25 */
-		u32 phy_mode:1;		/* bit 24 */
-		u32 reset_per_mii:1;	/* bit 23 */
-		u32 reserved3:6;		/* bits 17-22 */
-		u32 speed:1;		/* bit 16 */
-		u32 reset_pe100x:1;	/* bit 15 */
-		u32 reserved2:4;		/* bits 11-14 */
-		u32 force_quiet:1;		/* bit 10 */
-		u32 no_cipher:1;		/* bit 9 */
-		u32 disable_link_fail:1;	/* bit 8 */
-		u32 reset_gpsi:1;		/* bit 7 */
-		u32 reserved1:6;		/* bits 1-6 */
-		u32 enab_jab_protect:1;	/* bit 0 */
-#else
-		u32 enab_jab_protect:1;	/* bit 0 */
-		u32 reserved1:6;		/* bits 1-6 */
-		u32 reset_gpsi:1;		/* bit 7 */
-		u32 disable_link_fail:1;	/* bit 8 */
-		u32 no_cipher:1;		/* bit 9 */
-		u32 force_quiet:1;		/* bit 10 */
-		u32 reserved2:4;		/* bits 11-14 */
-		u32 reset_pe100x:1;	/* bit 15 */
-		u32 speed:1;		/* bit 16 */
-		u32 reserved3:6;		/* bits 17-22 */
-		u32 reset_per_mii:1;	/* bit 23 */
-		u32 phy_mode:1;		/* bit 24 */
-		u32 lhd_mode:1;		/* bit 25 */
-		u32 ghd_mode:1;		/* bit 26 */
-		u32 tbi_mode:1;		/* bit 27 */
-		u32 reserved4:3;		/* bit 28-30 */
-		u32 reset_if_module:1;	/* bit 31 */
-#endif
-	} bits;
-} MAC_IF_CTRL_t, *PMAC_IF_CTRL_t;
 
 /*
  * structure for Interface Status reg in mac address map.
@@ -1729,21 +1413,21 @@ typedef union _MAC_STATION_ADDR2_t {
  * MAC Module of JAGCore Address Mapping
  */
 typedef struct _MAC_t {					/* Location: */
-	MAC_CFG1_t cfg1;				/*  0x5000 */
-	MAC_CFG2_t cfg2;				/*  0x5004 */
-	MAC_IPG_t ipg;					/*  0x5008 */
-	MAC_HFDP_t hfdp;				/*  0x500C */
-	MAC_MAX_FM_LEN_t max_fm_len;			/*  0x5010 */
+	u32 cfg1;					/*  0x5000 */
+	u32 cfg2;					/*  0x5004 */
+	u32 ipg;					/*  0x5008 */
+	u32 hfdp;					/*  0x500C */
+	u32 max_fm_len;					/*  0x5010 */
 	u32 rsv1;					/*  0x5014 */
 	u32 rsv2;					/*  0x5018 */
-	MAC_TEST_t mac_test;				/*  0x501C */
-	MII_MGMT_CFG_t mii_mgmt_cfg;			/*  0x5020 */
-	MII_MGMT_CMD_t mii_mgmt_cmd;			/*  0x5024 */
-	MII_MGMT_ADDR_t mii_mgmt_addr;			/*  0x5028 */
-	MII_MGMT_CTRL_t mii_mgmt_ctrl;			/*  0x502C */
-	MII_MGMT_STAT_t mii_mgmt_stat;			/*  0x5030 */
-	MII_MGMT_INDICATOR_t mii_mgmt_indicator;	/*  0x5034 */
-	MAC_IF_CTRL_t if_ctrl;				/*  0x5038 */
+	u32 mac_test;					/*  0x501C */
+	u32 mii_mgmt_cfg;				/*  0x5020 */
+	u32 mii_mgmt_cmd;				/*  0x5024 */
+	u32 mii_mgmt_addr;				/*  0x5028 */
+	u32 mii_mgmt_ctrl;				/*  0x502C */
+	u32 mii_mgmt_stat;				/*  0x5030 */
+	u32 mii_mgmt_indicator;				/*  0x5034 */
+	u32 if_ctrl;					/*  0x5038 */
 	MAC_IF_STAT_t if_stat;				/*  0x503C */
 	MAC_STATION_ADDR1_t station_addr_1;		/*  0x5040 */
 	MAC_STATION_ADDR2_t station_addr_2;		/*  0x5044 */
@@ -1756,120 +1440,60 @@ typedef struct _MAC_t {					/* Location: */
 /*
  * structure for Carry Register One and it's Mask Register reg located in mac
  * stat address map address 0x6130 and 0x6138.
+ *
+ * 31: tr64
+ * 30: tr127
+ * 29: tr255
+ * 28: tr511
+ * 27: tr1k
+ * 26: trmax
+ * 25: trmgv
+ * 24-17: unused
+ * 16: rbyt
+ * 15: rpkt
+ * 14: rfcs
+ * 13: rmca
+ * 12: rbca
+ * 11: rxcf
+ * 10: rxpf
+ * 9: rxuo
+ * 8: raln
+ * 7: rflr
+ * 6: rcde
+ * 5: rcse
+ * 4: rund
+ * 3: rovr
+ * 2: rfrg
+ * 1: rjbr
+ * 0: rdrp
  */
-typedef union _MAC_STAT_REG_1_t {
-	u32 value;
-	struct {
-#ifdef _BIT_FIELDS_HTOL
-		u32 tr64:1;	/* bit 31 */
-		u32 tr127:1;	/* bit 30 */
-		u32 tr255:1;	/* bit 29 */
-		u32 tr511:1;	/* bit 28 */
-		u32 tr1k:1;	/* bit 27 */
-		u32 trmax:1;	/* bit 26 */
-		u32 trmgv:1;	/* bit 25 */
-		u32 unused:8;	/* bits 17-24 */
-		u32 rbyt:1;	/* bit 16 */
-		u32 rpkt:1;	/* bit 15 */
-		u32 rfcs:1;	/* bit 14 */
-		u32 rmca:1;	/* bit 13 */
-		u32 rbca:1;	/* bit 12 */
-		u32 rxcf:1;	/* bit 11 */
-		u32 rxpf:1;	/* bit 10 */
-		u32 rxuo:1;	/* bit 9 */
-		u32 raln:1;	/* bit 8 */
-		u32 rflr:1;	/* bit 7 */
-		u32 rcde:1;	/* bit 6 */
-		u32 rcse:1;	/* bit 5 */
-		u32 rund:1;	/* bit 4 */
-		u32 rovr:1;	/* bit 3 */
-		u32 rfrg:1;	/* bit 2 */
-		u32 rjbr:1;	/* bit 1 */
-		u32 rdrp:1;	/* bit 0 */
-#else
-		u32 rdrp:1;	/* bit 0 */
-		u32 rjbr:1;	/* bit 1 */
-		u32 rfrg:1;	/* bit 2 */
-		u32 rovr:1;	/* bit 3 */
-		u32 rund:1;	/* bit 4 */
-		u32 rcse:1;	/* bit 5 */
-		u32 rcde:1;	/* bit 6 */
-		u32 rflr:1;	/* bit 7 */
-		u32 raln:1;	/* bit 8 */
-		u32 rxuo:1;	/* bit 9 */
-		u32 rxpf:1;	/* bit 10 */
-		u32 rxcf:1;	/* bit 11 */
-		u32 rbca:1;	/* bit 12 */
-		u32 rmca:1;	/* bit 13 */
-		u32 rfcs:1;	/* bit 14 */
-		u32 rpkt:1;	/* bit 15 */
-		u32 rbyt:1;	/* bit 16 */
-		u32 unused:8;	/* bits 17-24 */
-		u32 trmgv:1;	/* bit 25 */
-		u32 trmax:1;	/* bit 26 */
-		u32 tr1k:1;	/* bit 27 */
-		u32 tr511:1;	/* bit 28 */
-		u32 tr255:1;	/* bit 29 */
-		u32 tr127:1;	/* bit 30 */
-		u32 tr64:1;	/* bit 31 */
-#endif
-	} bits;
-} MAC_STAT_REG_1_t, *PMAC_STAT_REG_1_t;
 
 /*
  * structure for Carry Register Two Mask Register reg in mac stat address map.
  * located at address 0x613C
+ *
+ * 31-20: unused
+ * 19: tjbr
+ * 18: tfcs
+ * 17: txcf
+ * 16: tovr
+ * 15: tund
+ * 14: trfg
+ * 13: tbyt
+ * 12: tpkt
+ * 11: tmca
+ * 10: tbca
+ * 9: txpf
+ * 8: tdfr
+ * 7: tedf
+ * 6: tscl
+ * 5: tmcl
+ * 4: tlcl
+ * 3: txcl
+ * 2: tncl
+ * 1: tpfh
+ * 0: tdrp
  */
-typedef union _MAC_STAT_REG_2_t {
-	u32 value;
-	struct {
-#ifdef _BIT_FIELDS_HTOL
-		u32 unused:12;	/* bit 20-31 */
-		u32 tjbr:1;	/* bit 19 */
-		u32 tfcs:1;	/* bit 18 */
-		u32 txcf:1;	/* bit 17 */
-		u32 tovr:1;	/* bit 16 */
-		u32 tund:1;	/* bit 15 */
-		u32 tfrg:1;	/* bit 14 */
-		u32 tbyt:1;	/* bit 13 */
-		u32 tpkt:1;	/* bit 12 */
-		u32 tmca:1;	/* bit 11 */
-		u32 tbca:1;	/* bit 10 */
-		u32 txpf:1;	/* bit 9 */
-		u32 tdfr:1;	/* bit 8 */
-		u32 tedf:1;	/* bit 7 */
-		u32 tscl:1;	/* bit 6 */
-		u32 tmcl:1;	/* bit 5 */
-		u32 tlcl:1;	/* bit 4 */
-		u32 txcl:1;	/* bit 3 */
-		u32 tncl:1;	/* bit 2 */
-		u32 tpfh:1;	/* bit 1 */
-		u32 tdrp:1;	/* bit 0 */
-#else
-		u32 tdrp:1;	/* bit 0 */
-		u32 tpfh:1;	/* bit 1 */
-		u32 tncl:1;	/* bit 2 */
-		u32 txcl:1;	/* bit 3 */
-		u32 tlcl:1;	/* bit 4 */
-		u32 tmcl:1;	/* bit 5 */
-		u32 tscl:1;	/* bit 6 */
-		u32 tedf:1;	/* bit 7 */
-		u32 tdfr:1;	/* bit 8 */
-		u32 txpf:1;	/* bit 9 */
-		u32 tbca:1;	/* bit 10 */
-		u32 tmca:1;	/* bit 11 */
-		u32 tpkt:1;	/* bit 12 */
-		u32 tbyt:1;	/* bit 13 */
-		u32 tfrg:1;	/* bit 14 */
-		u32 tund:1;	/* bit 15 */
-		u32 tovr:1;	/* bit 16 */
-		u32 txcf:1;	/* bit 17 */
-		u32 tfcs:1;	/* bit 18 */
-		u32 tjbr:1;	/* bit 19 */
-		u32 unused:12;	/* bit 20-31 */
-#endif
-	} bits;
-} MAC_STAT_REG_2_t, *PMAC_STAT_REG_2_t;
 
 /*
  * MAC STATS Module of JAGCore Address Mapping
@@ -2010,16 +1634,16 @@ typedef struct _MAC_STAT_t {		/* Location: */
 	u32 TFrg;			/*  0x612C */
 
 	/* Carry Register One Register */
-	MAC_STAT_REG_1_t Carry1;	/*  0x6130 */
+	u32 Carry1;			/*  0x6130 */
 
 	/* Carry Register Two Register */
-	MAC_STAT_REG_2_t Carry2;	/*  0x6134 */
+	u32 Carry2;			/*  0x6134 */
 
 	/* Carry Register One Mask Register */
-	MAC_STAT_REG_1_t Carry1M;	/*  0x6138 */
+	u32 Carry1M;			/*  0x6138 */
 
 	/* Carry Register Two Mask Register */
-	MAC_STAT_REG_2_t Carry2M;	/*  0x613C */
+	u32 Carry2M;			/*  0x613C */
 } MAC_STAT_t, *PMAC_STAT_t;
 
 /* END OF MAC STAT REGISTER ADDRESS MAP */
diff --git a/drivers/staging/et131x/et1310_eeprom.c b/drivers/staging/et131x/et1310_eeprom.c
index c853a2c243a8..bcca1f86f516 100644
--- a/drivers/staging/et131x/et1310_eeprom.c
+++ b/drivers/staging/et131x/et1310_eeprom.c
@@ -95,198 +95,120 @@
 #include "et1310_tx.h"
 
 
-/*
- * EEPROM Defines
- */
 
-/* LBCIF Register Groups (addressed via 32-bit offsets) */
-#define LBCIF_DWORD0_GROUP_OFFSET       0xAC
-#define LBCIF_DWORD1_GROUP_OFFSET       0xB0
-
-/* LBCIF Registers (addressed via 8-bit offsets) */
-#define LBCIF_ADDRESS_REGISTER_OFFSET   0xAC
-#define LBCIF_DATA_REGISTER_OFFSET      0xB0
-#define LBCIF_CONTROL_REGISTER_OFFSET   0xB1
-#define LBCIF_STATUS_REGISTER_OFFSET    0xB2
-
-/* LBCIF Control Register Bits */
-#define LBCIF_CONTROL_SEQUENTIAL_READ   0x01
-#define LBCIF_CONTROL_PAGE_WRITE        0x02
-#define LBCIF_CONTROL_UNUSED1           0x04
-#define LBCIF_CONTROL_EEPROM_RELOAD     0x08
-#define LBCIF_CONTROL_UNUSED2           0x10
-#define LBCIF_CONTROL_TWO_BYTE_ADDR     0x20
-#define LBCIF_CONTROL_I2C_WRITE         0x40
-#define LBCIF_CONTROL_LBCIF_ENABLE      0x80
-
-/* LBCIF Status Register Bits */
-#define LBCIF_STATUS_PHY_QUEUE_AVAIL    0x01
-#define LBCIF_STATUS_I2C_IDLE           0x02
-#define LBCIF_STATUS_ACK_ERROR          0x04
-#define LBCIF_STATUS_GENERAL_ERROR      0x08
-#define LBCIF_STATUS_UNUSED             0x30
-#define LBCIF_STATUS_CHECKSUM_ERROR     0x40
-#define LBCIF_STATUS_EEPROM_PRESENT     0x80
-
-/* Miscellaneous Constraints */
-#define MAX_NUM_REGISTER_POLLS          1000
-#define MAX_NUM_WRITE_RETRIES           2
+static int eeprom_wait_ready(struct pci_dev *pdev, u32 *status)
+{
+	u32 reg;
+	int i;
+
+	/*
+	 * 1. Check LBCIF Status Register for bits 6 & 3:2 all equal to 0 and
+	 *    bits 7,1:0 both equal to 1, at least once after reset.
+	 *    Subsequent operations need only to check that bits 1:0 are equal
+	 *    to 1 prior to starting a single byte read/write
+	 */
+
+	for (i = 0; i < MAX_NUM_REGISTER_POLLS; i++) {
+		/* Read registers grouped in DWORD1 */
+		if (pci_read_config_dword(pdev, LBCIF_DWORD1_GROUP, &reg))
+			return -EIO;
+
+		/* I2C idle and Phy Queue Avail both true */
+		if ((reg & 0x3000) == 0x3000) {
+			if (status)
+				*status = reg;
+			return reg & 0xFF;
+		}
+	}
+	return -ETIMEDOUT;
+}
 
-/*
- * Define macros that allow individual register values to be extracted from a
- * DWORD1 register grouping
- */
-#define EXTRACT_DATA_REGISTER(x)    (u8)(x & 0xFF)
-#define EXTRACT_STATUS_REGISTER(x)  (u8)((x >> 16) & 0xFF)
-#define EXTRACT_CONTROL_REG(x)      (u8)((x >> 8) & 0xFF)
 
 /**
- * EepromWriteByte - Write a byte to the ET1310's EEPROM
+ * eeprom_write - Write a byte to the ET1310's EEPROM
  * @etdev: pointer to our private adapter structure
  * @addr: the address to write
  * @data: the value to write
  *
- * Returns SUCCESS or FAILURE
+ * Returns 1 for a successful write.
  */
-int EepromWriteByte(struct et131x_adapter *etdev, u32 addr, u8 data)
+static int eeprom_write(struct et131x_adapter *etdev, u32 addr, u8 data)
 {
 	struct pci_dev *pdev = etdev->pdev;
-	int index;
+	int index = 0;
 	int retries;
 	int err = 0;
 	int i2c_wack = 0;
 	int writeok = 0;
-	u8 control;
-	u8 status = 0;
-	u32 dword1 = 0;
+	u32 status;
 	u32 val = 0;
 
 	/*
-	 * The following excerpt is from "Serial EEPROM HW Design
-	 * Specification" Version 0.92 (9/20/2004):
-	 *
-	 * Single Byte Writes
-	 *
 	 * For an EEPROM, an I2C single byte write is defined as a START
 	 * condition followed by the device address, EEPROM address, one byte
 	 * of data and a STOP condition.  The STOP condition will trigger the
 	 * EEPROM's internally timed write cycle to the nonvolatile memory.
 	 * All inputs are disabled during this write cycle and the EEPROM will
 	 * not respond to any access until the internal write is complete.
-	 * The steps to execute a single byte write are as follows:
-	 *
-	 * 1. Check LBCIF Status Register for bits 6 & 3:2 all equal to 0 and
-	 *    bits 7,1:0 both equal to 1, at least once after reset.
-	 *    Subsequent operations need only to check that bits 1:0 are
-	 *    equal to 1 prior to starting a single byte write.
-	 *
+	 */
+
+	err = eeprom_wait_ready(pdev, NULL);
+	if (err)
+		return err;
+
+	 /*
 	 * 2. Write to the LBCIF Control Register:  bit 7=1, bit 6=1, bit 3=0,
 	 *    and bits 1:0 both =0.  Bit 5 should be set according to the
 	 *    type of EEPROM being accessed (1=two byte addressing, 0=one
 	 *    byte addressing).
-	 *
-	 * 3. Write the address to the LBCIF Address Register.
-	 *
-	 * 4. Write the data to the LBCIF Data Register (the I2C write will
-	 *    begin).
-	 *
-	 * 5. Monitor bit 1:0 of the LBCIF Status Register.  When bits 1:0 are
-	 *    both equal to 1, the I2C write has completed and the internal
-	 *    write cycle of the EEPROM is about to start. (bits 1:0 = 01 is
-	 *    a legal state while waiting from both equal to 1, but bits
-	 *    1:0 = 10 is invalid and implies that something is broken).
-	 *
-	 * 6. Check bit 3 of the LBCIF Status Register.  If  equal to 1, an
-	 *    error has occurred.
-	 *
-	 * 7. Check bit 2 of the LBCIF Status Register.  If equal to 1 an ACK
-	 *    error has occurred on the address phase of the write.  This
-	 *    could be due to an actual hardware failure or the EEPROM may
-	 *    still be in its internal write cycle from a previous write.
-	 *    This write operation was ignored and must be repeated later.
-	 *
-	 * 8. Set bit 6 of the LBCIF Control Register = 0. If another write is
-	 *    required, go to step 1.
 	 */
-
-	/* Step 1: */
-	for (index = 0; index < MAX_NUM_REGISTER_POLLS; index++) {
-		/* Read registers grouped in DWORD1 */
-		if (pci_read_config_dword(pdev, LBCIF_DWORD1_GROUP_OFFSET,
-					  &dword1)) {
-			err = 1;
-			break;
-		}
-
-		status = EXTRACT_STATUS_REGISTER(dword1);
-
-		if (status & LBCIF_STATUS_PHY_QUEUE_AVAIL &&
-			status & LBCIF_STATUS_I2C_IDLE)
-			/* bits 1:0 are equal to 1 */
-			break;
-	}
-
-	if (err || (index >= MAX_NUM_REGISTER_POLLS))
-		return FAILURE;
-
-	/* Step 2: */
-	control = 0;
-	control |= LBCIF_CONTROL_LBCIF_ENABLE | LBCIF_CONTROL_I2C_WRITE;
-
-	if (pci_write_config_byte(pdev, LBCIF_CONTROL_REGISTER_OFFSET,
-				  control)) {
-		return FAILURE;
-	}
+	if (pci_write_config_byte(pdev, LBCIF_CONTROL_REGISTER,
+			LBCIF_CONTROL_LBCIF_ENABLE | LBCIF_CONTROL_I2C_WRITE))
+		return -EIO;
 
 	i2c_wack = 1;
 
 	/* Prepare EEPROM address for Step 3 */
 
 	for (retries = 0; retries < MAX_NUM_WRITE_RETRIES; retries++) {
-		/* Step 3:*/
-		if (pci_write_config_dword(pdev, LBCIF_ADDRESS_REGISTER_OFFSET,
-					   addr)) {
-			break;
-		}
-
-		/* Step 4: */
-		if (pci_write_config_byte(pdev, LBCIF_DATA_REGISTER_OFFSET,
-					  data)) {
+		/* Write the address to the LBCIF Address Register */
+		if (pci_write_config_dword(pdev, LBCIF_ADDRESS_REGISTER, addr))
 			break;
-		}
-
-		/* Step 5: */
-		for (index = 0; index < MAX_NUM_REGISTER_POLLS; index++) {
-			/* Read registers grouped in DWORD1 */
-			if (pci_read_config_dword(pdev,
-						  LBCIF_DWORD1_GROUP_OFFSET,
-						  &dword1)) {
-				err = 1;
-				break;
-			}
-
-			status = EXTRACT_STATUS_REGISTER(dword1);
-
-			if (status & LBCIF_STATUS_PHY_QUEUE_AVAIL &&
-				status & LBCIF_STATUS_I2C_IDLE) {
-				/* I2C write complete */
-				break;
-			}
-		}
-
-		if (err || (index >= MAX_NUM_REGISTER_POLLS))
+		/*
+		 * Write the data to the LBCIF Data Register (the I2C write
+		 * will begin).
+		 */
+		if (pci_write_config_byte(pdev, LBCIF_DATA_REGISTER, data))
 			break;
+		/*
+		 * Monitor bit 1:0 of the LBCIF Status Register.  When bits
+		 * 1:0 are both equal to 1, the I2C write has completed and the
+		 * internal write cycle of the EEPROM is about to start.
+		 * (bits 1:0 = 01 is a legal state while waiting from both
+		 * equal to 1, but bits 1:0 = 10 is invalid and implies that
+		 * something is broken).
+		 */
+		err = eeprom_wait_ready(pdev, &status);
+		if (err < 0)
+			return 0;
 
 		/*
-		 * Step 6: Don't break here if we are revision 1, this is
-		 *	   so we do a blind write for load bug.
+		 * Check bit 3 of the LBCIF Status Register.  If  equal to 1,
+		 * an error has occurred.Don't break here if we are revision
+		 * 1, this is so we do a blind write for load bug.
 		 */
-		if (status & LBCIF_STATUS_GENERAL_ERROR
-		    && etdev->pdev->revision == 0) {
+		if ((status & LBCIF_STATUS_GENERAL_ERROR)
+			&& etdev->pdev->revision == 0)
 			break;
-		}
 
-		/* Step 7 */
+		/*
+		 * Check bit 2 of the LBCIF Status Register.  If equal to 1 an
+		 * ACK error has occurred on the address phase of the write.
+		 * This could be due to an actual hardware failure or the
+		 * EEPROM may still be in its internal write cycle from a
+		 * previous write. This write operation was ignored and must be
+		  *repeated later.
+		 */
 		if (status & LBCIF_STATUS_ACK_ERROR) {
 			/*
 			 * This could be due to an actual hardware failure
@@ -302,154 +224,160 @@ int EepromWriteByte(struct et131x_adapter *etdev, u32 addr, u8 data)
 		break;
 	}
 
-	/* Step 8: */
+	/*
+	 * Set bit 6 of the LBCIF Control Register = 0.
+	 */
 	udelay(10);
-	index = 0;
-	while (i2c_wack) {
-		control &= ~LBCIF_CONTROL_I2C_WRITE;
 
-		if (pci_write_config_byte(pdev, LBCIF_CONTROL_REGISTER_OFFSET,
-					  control)) {
+	while (i2c_wack) {
+		if (pci_write_config_byte(pdev, LBCIF_CONTROL_REGISTER,
+			LBCIF_CONTROL_LBCIF_ENABLE))
 			writeok = 0;
-		}
 
 		/* Do read until internal ACK_ERROR goes away meaning write
 		 * completed
 		 */
 		do {
 			pci_write_config_dword(pdev,
-					       LBCIF_ADDRESS_REGISTER_OFFSET,
+					       LBCIF_ADDRESS_REGISTER,
 					       addr);
 			do {
 				pci_read_config_dword(pdev,
-					LBCIF_DATA_REGISTER_OFFSET, &val);
+					LBCIF_DATA_REGISTER, &val);
 			} while ((val & 0x00010000) == 0);
 		} while (val & 0x00040000);
 
-		control = EXTRACT_CONTROL_REG(val);
-
-		if (control != 0xC0 || index == 10000)
+		if ((val & 0xFF00) != 0xC000 || index == 10000)
 			break;
-
 		index++;
 	}
-
-	return writeok ? SUCCESS : FAILURE;
+	return writeok ? 0 : -EIO;
 }
 
 /**
- * EepromReadByte - Read a byte from the ET1310's EEPROM
+ * eeprom_read - Read a byte from the ET1310's EEPROM
  * @etdev: pointer to our private adapter structure
  * @addr: the address from which to read
  * @pdata: a pointer to a byte in which to store the value of the read
  * @eeprom_id: the ID of the EEPROM
  * @addrmode: how the EEPROM is to be accessed
  *
- * Returns SUCCESS or FAILURE
+ * Returns 1 for a successful read
  */
-int EepromReadByte(struct et131x_adapter *etdev, u32 addr, u8 *pdata)
+static int eeprom_read(struct et131x_adapter *etdev, u32 addr, u8 *pdata)
 {
 	struct pci_dev *pdev = etdev->pdev;
-	int index;
-	int err = 0;
-	u8 control;
-	u8 status = 0;
-	u32 dword1 = 0;
+	int err;
+	u32 status;
 
 	/*
-	 * The following excerpt is from "Serial EEPROM HW Design
-	 * Specification" Version 0.92 (9/20/2004):
-	 *
-	 * Single Byte Reads
-	 *
 	 * A single byte read is similar to the single byte write, with the
 	 * exception of the data flow:
-	 *
-	 * 1. Check LBCIF Status Register for bits 6 & 3:2 all equal to 0 and
-	 *    bits 7,1:0 both equal to 1, at least once after reset.
-	 *    Subsequent operations need only to check that bits 1:0 are equal
-	 *    to 1 prior to starting a single byte read.
-	 *
-	 * 2. Write to the LBCIF Control Register:  bit 7=1, bit 6=0, bit 3=0,
-	 *    and bits 1:0 both =0.  Bit 5 should be set according to the type
-	 *    of EEPROM being accessed (1=two byte addressing, 0=one byte
-	 *    addressing).
-	 *
-	 * 3. Write the address to the LBCIF Address Register (I2C read will
-	 *    begin).
-	 *
-	 * 4. Monitor bit 0 of the LBCIF Status Register.  When =1, I2C read
-	 *    is complete. (if bit 1 =1 and bit 0 stays =0, a hardware failure
-	 *    has occurred).
-	 *
-	 * 5. Check bit 2 of the LBCIF Status Register.  If =1, then an error
-	 *    has occurred.  The data that has been returned from the PHY may
-	 *    be invalid.
-	 *
-	 * 6. Regardless of error status, read data byte from LBCIF Data
-	 *    Register.  If another byte is required, go to step 1.
 	 */
 
-	/* Step 1: */
-	for (index = 0; index < MAX_NUM_REGISTER_POLLS; index++) {
-		/* Read registers grouped in DWORD1 */
-		if (pci_read_config_dword(pdev, LBCIF_DWORD1_GROUP_OFFSET,
-					  &dword1)) {
-			err = 1;
-			break;
-		}
-
-		status = EXTRACT_STATUS_REGISTER(dword1);
-
-		if (status & LBCIF_STATUS_PHY_QUEUE_AVAIL &&
-		    status & LBCIF_STATUS_I2C_IDLE) {
-			/* bits 1:0 are equal to 1 */
-			break;
-		}
-	}
-
-	if (err || (index >= MAX_NUM_REGISTER_POLLS))
-		return FAILURE;
-
-	/* Step 2: */
-	control = 0;
-	control |= LBCIF_CONTROL_LBCIF_ENABLE;
-
-	if (pci_write_config_byte(pdev, LBCIF_CONTROL_REGISTER_OFFSET,
-				  control)) {
-		return FAILURE;
-	}
+	err = eeprom_wait_ready(pdev, NULL);
+	if (err)
+		return err;
+ 	/*
+	 * Write to the LBCIF Control Register:  bit 7=1, bit 6=0, bit 3=0,
+	 * and bits 1:0 both =0.  Bit 5 should be set according to the type
+	 * of EEPROM being accessed (1=two byte addressing, 0=one byte
+	 * addressing).
+	 */
+	if (pci_write_config_byte(pdev, LBCIF_CONTROL_REGISTER,
+				  LBCIF_CONTROL_LBCIF_ENABLE))
+		return -EIO;
+	/*
+	 * Write the address to the LBCIF Address Register (I2C read will
+	 * begin).
+	 */
+	if (pci_write_config_dword(pdev, LBCIF_ADDRESS_REGISTER, addr))
+		return -EIO;
+	/*
+	 * Monitor bit 0 of the LBCIF Status Register.  When = 1, I2C read
+	 * is complete. (if bit 1 =1 and bit 0 stays = 0, a hardware failure
+	 * has occurred).
+	 */
+	err = eeprom_wait_ready(pdev, &status);
+	if (err < 0)
+		return err;
+	/*
+	 * Regardless of error status, read data byte from LBCIF Data
+	 * Register.
+	 */
+	*pdata = err;
+	/*
+	 * Check bit 2 of the LBCIF Status Register.  If = 1,
+	 * then an error has occurred.
+	 */
+	return (status & LBCIF_STATUS_ACK_ERROR) ? -EIO : 0;
+}
 
-	/* Step 3: */
+int et131x_init_eeprom(struct et131x_adapter *etdev)
+{
+	struct pci_dev *pdev = etdev->pdev;
+	u8 eestatus;
 
-	if (pci_write_config_dword(pdev, LBCIF_ADDRESS_REGISTER_OFFSET,
-				   addr)) {
-		return FAILURE;
+	/* We first need to check the EEPROM Status code located at offset
+	 * 0xB2 of config space
+	 */
+	pci_read_config_byte(pdev, ET1310_PCI_EEPROM_STATUS,
+				      &eestatus);
+
+	/* THIS IS A WORKAROUND:
+	 * I need to call this function twice to get my card in a
+	 * LG M1 Express Dual running. I tried also a msleep before this
+	 * function, because I thougth there could be some time condidions
+	 * but it didn't work. Call the whole function twice also work.
+	 */
+	if (pci_read_config_byte(pdev, ET1310_PCI_EEPROM_STATUS, &eestatus)) {
+		dev_err(&pdev->dev,
+		       "Could not read PCI config space for EEPROM Status\n");
+		return -EIO;
 	}
 
-	/* Step 4: */
-	for (index = 0; index < MAX_NUM_REGISTER_POLLS; index++) {
-		/* Read registers grouped in DWORD1 */
-		if (pci_read_config_dword(pdev, LBCIF_DWORD1_GROUP_OFFSET,
-					  &dword1)) {
-			err = 1;
-			break;
+	/* Determine if the error(s) we care about are present. If they are
+	 * present we need to fail.
+	 */
+	if (eestatus & 0x4C) {
+		int write_failed = 0;
+		if (pdev->revision == 0x01) {
+			int	i;
+			static const u8 eedata[4] = { 0xFE, 0x13, 0x10, 0xFF };
+
+			/* Re-write the first 4 bytes if we have an eeprom
+			 * present and the revision id is 1, this fixes the
+			 * corruption seen with 1310 B Silicon
+			 */
+			for (i = 0; i < 3; i++)
+				if (eeprom_write(etdev, i, eedata[i]) < 0)
+					write_failed = 1;
 		}
-
-		status = EXTRACT_STATUS_REGISTER(dword1);
-
-		if (status & LBCIF_STATUS_PHY_QUEUE_AVAIL
-		    && status & LBCIF_STATUS_I2C_IDLE) {
-			/* I2C read complete */
-			break;
+		if (pdev->revision  != 0x01 || write_failed) {
+			dev_err(&pdev->dev,
+			    "Fatal EEPROM Status Error - 0x%04x\n", eestatus);
+
+			/* This error could mean that there was an error
+			 * reading the eeprom or that the eeprom doesn't exist.
+			 * We will treat each case the same and not try to gather
+			 * additional information that normally would come from the
+			 * eeprom, like MAC Address
+			 */
+			etdev->has_eeprom = 0;
+			return -EIO;
 		}
 	}
+	etdev->has_eeprom = 1;
 
-	if (err || (index >= MAX_NUM_REGISTER_POLLS))
-		return FAILURE;
+	/* Read the EEPROM for information regarding LED behavior. Refer to
+	 * ET1310_phy.c, et131x_xcvr_init(), for its use.
+	 */
+	eeprom_read(etdev, 0x70, &etdev->eepromData[0]);
+	eeprom_read(etdev, 0x71, &etdev->eepromData[1]);
 
-	/* Step 6: */
-	*pdata = EXTRACT_DATA_REGISTER(dword1);
+	if (etdev->eepromData[0] != 0xcd)
+		/* Disable all optional features */
+		etdev->eepromData[1] = 0x00;
 
-	return (status & LBCIF_STATUS_ACK_ERROR) ? FAILURE : SUCCESS;
+	return 0;
 }
diff --git a/drivers/staging/et131x/et1310_eeprom.h b/drivers/staging/et131x/et1310_eeprom.h
index d8ac9a0439e2..6a6c6a632a8f 100644
--- a/drivers/staging/et131x/et1310_eeprom.h
+++ b/drivers/staging/et131x/et1310_eeprom.h
@@ -61,17 +61,43 @@
 
 #include "et1310_address_map.h"
 
-#ifndef SUCCESS
-#define SUCCESS		0
-#define FAILURE		1
-#endif
+/*
+ * EEPROM Defines
+ */
+
+/* LBCIF Register Groups (addressed via 32-bit offsets) */
+#define LBCIF_DWORD0_GROUP       0xAC
+#define LBCIF_DWORD1_GROUP       0xB0
+
+/* LBCIF Registers (addressed via 8-bit offsets) */
+#define LBCIF_ADDRESS_REGISTER   0xAC
+#define LBCIF_DATA_REGISTER      0xB0
+#define LBCIF_CONTROL_REGISTER   0xB1
+#define LBCIF_STATUS_REGISTER    0xB2
+
+/* LBCIF Control Register Bits */
+#define LBCIF_CONTROL_SEQUENTIAL_READ   0x01
+#define LBCIF_CONTROL_PAGE_WRITE        0x02
+#define LBCIF_CONTROL_EEPROM_RELOAD     0x08
+#define LBCIF_CONTROL_TWO_BYTE_ADDR     0x20
+#define LBCIF_CONTROL_I2C_WRITE         0x40
+#define LBCIF_CONTROL_LBCIF_ENABLE      0x80
+
+/* LBCIF Status Register Bits */
+#define LBCIF_STATUS_PHY_QUEUE_AVAIL    0x01
+#define LBCIF_STATUS_I2C_IDLE           0x02
+#define LBCIF_STATUS_ACK_ERROR          0x04
+#define LBCIF_STATUS_GENERAL_ERROR      0x08
+#define LBCIF_STATUS_CHECKSUM_ERROR     0x40
+#define LBCIF_STATUS_EEPROM_PRESENT     0x80
+
+/* Miscellaneous Constraints */
+#define MAX_NUM_REGISTER_POLLS          1000
+#define MAX_NUM_WRITE_RETRIES           2
 
 /* Forward declaration of the private adapter structure */
 struct et131x_adapter;
 
-int32_t EepromWriteByte(struct et131x_adapter *adapter, u32 unAddress,
-			u8 bData);
-int32_t EepromReadByte(struct et131x_adapter *adapter, u32 unAddress,
-			u8 *pbData);
+int et131x_init_eeprom(struct et131x_adapter *etdev);
 
 #endif /* _ET1310_EEPROM_H_ */
diff --git a/drivers/staging/et131x/et1310_mac.c b/drivers/staging/et131x/et1310_mac.c
index f81e1cba8547..b8a1f2037314 100644
--- a/drivers/staging/et131x/et1310_mac.c
+++ b/drivers/staging/et131x/et1310_mac.c
@@ -101,41 +101,27 @@ void ConfigMACRegs1(struct et131x_adapter *etdev)
 	struct _MAC_t __iomem *pMac = &etdev->regs->mac;
 	MAC_STATION_ADDR1_t station1;
 	MAC_STATION_ADDR2_t station2;
-	MAC_IPG_t ipg;
-	MAC_HFDP_t hfdp;
-	MII_MGMT_CFG_t mii_mgmt_cfg;
+	u32 ipg;
 
 	/* First we need to reset everything.  Write to MAC configuration
 	 * register 1 to perform reset.
 	 */
-	writel(0xC00F0000, &pMac->cfg1.value);
+	writel(0xC00F0000, &pMac->cfg1);
 
 	/* Next lets configure the MAC Inter-packet gap register */
-	ipg.bits.non_B2B_ipg_1 = 0x38;		/* 58d */
-	ipg.bits.non_B2B_ipg_2 = 0x58;		/* 88d */
-	ipg.bits.min_ifg_enforce = 0x50;	/* 80d */
-	ipg.bits.B2B_ipg = 0x60;		/* 96d */
-	writel(ipg.value, &pMac->ipg.value);
+	ipg = 0x38005860;		/* IPG1 0x38 IPG2 0x58 B2B 0x60 */
+	ipg |= 0x50 << 8;		/* ifg enforce 0x50 */
+	writel(ipg, &pMac->ipg);
 
 	/* Next lets configure the MAC Half Duplex register */
-	hfdp.bits.alt_beb_trunc = 0xA;
-	hfdp.bits.alt_beb_enable = 0x0;
-	hfdp.bits.bp_no_backoff = 0x0;
-	hfdp.bits.no_backoff = 0x0;
-	hfdp.bits.excess_defer = 0x1;
-	hfdp.bits.rexmit_max = 0xF;
-	hfdp.bits.coll_window = 0x37;		/* 55d */
-	writel(hfdp.value, &pMac->hfdp.value);
+	/* BEB trunc 0xA, Ex Defer, Rexmit 0xF Coll 0x37 */
+	writel(0x00A1F037, &pMac->hfdp);
 
 	/* Next lets configure the MAC Interface Control register */
-	writel(0, &pMac->if_ctrl.value);
+	writel(0, &pMac->if_ctrl);
 
 	/* Let's move on to setting up the mii management configuration */
-	mii_mgmt_cfg.bits.reset_mii_mgmt = 0;
-	mii_mgmt_cfg.bits.scan_auto_incremt = 0;
-	mii_mgmt_cfg.bits.preamble_suppress = 0;
-	mii_mgmt_cfg.bits.mgmt_clk_reset = 0x7;
-	writel(mii_mgmt_cfg.value, &pMac->mii_mgmt_cfg.value);
+	writel(0x07, &pMac->mii_mgmt_cfg);	/* Clock reset 0x7 */
 
 	/* Next lets configure the MAC Station Address register.  These
 	 * values are read from the EEPROM during initialization and stored
@@ -160,10 +146,10 @@ void ConfigMACRegs1(struct et131x_adapter *etdev)
 	 * Packets larger than (RegistryJumboPacket) that do not contain a
 	 * VLAN ID will be dropped by the Rx function.
 	 */
-	writel(etdev->RegistryJumboPacket + 4, &pMac->max_fm_len.value);
+	writel(etdev->RegistryJumboPacket + 4, &pMac->max_fm_len);
 
 	/* clear out MAC config reset */
-	writel(0, &pMac->cfg1.value);
+	writel(0, &pMac->cfg1);
 }
 
 /**
@@ -174,79 +160,62 @@ void ConfigMACRegs2(struct et131x_adapter *etdev)
 {
 	int32_t delay = 0;
 	struct _MAC_t __iomem *pMac = &etdev->regs->mac;
-	MAC_CFG1_t cfg1;
-	MAC_CFG2_t cfg2;
-	MAC_IF_CTRL_t ifctrl;
+	u32 cfg1;
+	u32 cfg2;
+	u32 ifctrl;
 	TXMAC_CTL_t ctl;
 
 	ctl.value = readl(&etdev->regs->txmac.ctl.value);
-	cfg1.value = readl(&pMac->cfg1.value);
-	cfg2.value = readl(&pMac->cfg2.value);
-	ifctrl.value = readl(&pMac->if_ctrl.value);
+	cfg1 = readl(&pMac->cfg1);
+	cfg2 = readl(&pMac->cfg2);
+	ifctrl = readl(&pMac->if_ctrl);
 
+	/* Set up the if mode bits */
+	cfg2 &= ~0x300;
 	if (etdev->linkspeed == TRUEPHY_SPEED_1000MBPS) {
-		cfg2.bits.if_mode = 0x2;
-		ifctrl.bits.phy_mode = 0x0;
+		cfg2 |= 0x200;
+		/* Phy mode bit */
+		ifctrl &= ~(1 << 24);
 	} else {
-		cfg2.bits.if_mode = 0x1;
-		ifctrl.bits.phy_mode = 0x1;
+		cfg2 |= 0x100;
+		ifctrl |= (1 << 24);
 	}
 
 	/* We need to enable Rx/Tx */
-	cfg1.bits.rx_enable = 0x1;
-	cfg1.bits.tx_enable = 0x1;
-
-	/* Set up flow control */
-	cfg1.bits.tx_flow = 0x1;
-
-	if ((etdev->FlowControl == RxOnly) ||
-	    (etdev->FlowControl == Both)) {
-		cfg1.bits.rx_flow = 0x1;
-	} else {
-		cfg1.bits.rx_flow = 0x0;
-	}
-
+	cfg1 |= CFG1_RX_ENABLE|CFG1_TX_ENABLE|CFG1_TX_FLOW;
 	/* Initialize loop back to off */
-	cfg1.bits.loop_back = 0;
-
-	writel(cfg1.value, &pMac->cfg1.value);
+	cfg1 &= ~(CFG1_LOOPBACK|CFG1_RX_FLOW);
+	if (etdev->FlowControl == RxOnly || etdev->FlowControl == Both)
+		cfg1 |= CFG1_RX_FLOW;
+	writel(cfg1, &pMac->cfg1);
 
 	/* Now we need to initialize the MAC Configuration 2 register */
-	cfg2.bits.preamble_len = 0x7;
-	cfg2.bits.huge_frame = 0x0;
-	/* LENGTH FIELD CHECKING bit4: Set this bit to cause the MAC to check
-	 * the frame's length field to ensure it matches the actual data
-	 * field length. Clear this bit if no length field checking is
-	 * desired. Its default is 0.
-	 */
-	cfg2.bits.len_check = 0x1;
+	/* preamble 7, check length, huge frame off, pad crc, crc enable
+	   full duplex off */
+	cfg2 |= 0x7016;
+	cfg2 &= ~0x0021;
 
-	if (etdev->RegistryPhyLoopbk == false) {
-		cfg2.bits.pad_crc = 0x1;
-		cfg2.bits.crc_enable = 0x1;
-	} else {
-		cfg2.bits.pad_crc = 0;
-		cfg2.bits.crc_enable = 0;
-	}
+	/* Turn on duplex if needed */
+	if (etdev->duplex_mode)
+		cfg2 |= 0x01;
 
-	/* 1 - full duplex, 0 - half-duplex */
-	cfg2.bits.full_duplex = etdev->duplex_mode;
-	ifctrl.bits.ghd_mode = !etdev->duplex_mode;
+	ifctrl &= ~(1 << 26);
+	if (!etdev->duplex_mode)
+		ifctrl |= (1<<26);	/* Enable ghd */
 
-	writel(ifctrl.value, &pMac->if_ctrl.value);
-	writel(cfg2.value, &pMac->cfg2.value);
+	writel(ifctrl, &pMac->if_ctrl);
+	writel(cfg2, &pMac->cfg2);
 
 	do {
 		udelay(10);
 		delay++;
-		cfg1.value = readl(&pMac->cfg1.value);
-	} while ((!cfg1.bits.syncd_rx_en || !cfg1.bits.syncd_tx_en) &&
-								 delay < 100);
+		cfg1 = readl(&pMac->cfg1);
+	} while ((cfg1 & CFG1_WAIT) != CFG1_WAIT && delay < 100);
 
 	if (delay == 100) {
 		dev_warn(&etdev->pdev->dev,
 		    "Syncd bits did not respond correctly cfg1 word 0x%08x\n",
-			cfg1.value);
+			cfg1);
 	}
 
 	/* Enable TXMAC */
@@ -402,106 +371,47 @@ void ConfigRxMacRegs(struct et131x_adapter *etdev)
 void ConfigTxMacRegs(struct et131x_adapter *etdev)
 {
 	struct _TXMAC_t __iomem *pTxMac = &etdev->regs->txmac;
-	TXMAC_CF_PARAM_t Local;
 
 	/* We need to update the Control Frame Parameters
 	 * cfpt - control frame pause timer set to 64 (0x40)
 	 * cfep - control frame extended pause timer set to 0x0
 	 */
-	if (etdev->FlowControl == None) {
-		writel(0, &pTxMac->cf_param.value);
-	} else {
-		Local.bits.cfpt = 0x40;
-		Local.bits.cfep = 0x0;
-		writel(Local.value, &pTxMac->cf_param.value);
-	}
+	if (etdev->FlowControl == None)
+		writel(0, &pTxMac->cf_param);
+	else
+		writel(0x40, &pTxMac->cf_param);
 }
 
 void ConfigMacStatRegs(struct et131x_adapter *etdev)
 {
-	struct _MAC_STAT_t __iomem *pDevMacStat =
+	struct _MAC_STAT_t __iomem *macstat =
 		&etdev->regs->macStat;
 
 	/* Next we need to initialize all the MAC_STAT registers to zero on
 	 * the device.
 	 */
-	writel(0, &pDevMacStat->RFcs);
-	writel(0, &pDevMacStat->RAln);
-	writel(0, &pDevMacStat->RFlr);
-	writel(0, &pDevMacStat->RDrp);
-	writel(0, &pDevMacStat->RCde);
-	writel(0, &pDevMacStat->ROvr);
-	writel(0, &pDevMacStat->RFrg);
-
-	writel(0, &pDevMacStat->TScl);
-	writel(0, &pDevMacStat->TDfr);
-	writel(0, &pDevMacStat->TMcl);
-	writel(0, &pDevMacStat->TLcl);
-	writel(0, &pDevMacStat->TNcl);
-	writel(0, &pDevMacStat->TOvr);
-	writel(0, &pDevMacStat->TUnd);
+	writel(0, &macstat->RFcs);
+	writel(0, &macstat->RAln);
+	writel(0, &macstat->RFlr);
+	writel(0, &macstat->RDrp);
+	writel(0, &macstat->RCde);
+	writel(0, &macstat->ROvr);
+	writel(0, &macstat->RFrg);
+
+	writel(0, &macstat->TScl);
+	writel(0, &macstat->TDfr);
+	writel(0, &macstat->TMcl);
+	writel(0, &macstat->TLcl);
+	writel(0, &macstat->TNcl);
+	writel(0, &macstat->TOvr);
+	writel(0, &macstat->TUnd);
 
 	/* Unmask any counters that we want to track the overflow of.
 	 * Initially this will be all counters.  It may become clear later
 	 * that we do not need to track all counters.
 	 */
-	{
-		MAC_STAT_REG_1_t Carry1M = { 0xffffffff };
-
-		Carry1M.bits.rdrp = 0;
-		Carry1M.bits.rjbr = 1;
-		Carry1M.bits.rfrg = 0;
-		Carry1M.bits.rovr = 0;
-		Carry1M.bits.rund = 1;
-		Carry1M.bits.rcse = 1;
-		Carry1M.bits.rcde = 0;
-		Carry1M.bits.rflr = 0;
-		Carry1M.bits.raln = 0;
-		Carry1M.bits.rxuo = 1;
-		Carry1M.bits.rxpf = 1;
-		Carry1M.bits.rxcf = 1;
-		Carry1M.bits.rbca = 1;
-		Carry1M.bits.rmca = 1;
-		Carry1M.bits.rfcs = 0;
-		Carry1M.bits.rpkt = 1;
-		Carry1M.bits.rbyt = 1;
-		Carry1M.bits.trmgv = 1;
-		Carry1M.bits.trmax = 1;
-		Carry1M.bits.tr1k = 1;
-		Carry1M.bits.tr511 = 1;
-		Carry1M.bits.tr255 = 1;
-		Carry1M.bits.tr127 = 1;
-		Carry1M.bits.tr64 = 1;
-
-		writel(Carry1M.value, &pDevMacStat->Carry1M.value);
-	}
-
-	{
-		MAC_STAT_REG_2_t Carry2M = { 0xffffffff };
-
-		Carry2M.bits.tdrp = 1;
-		Carry2M.bits.tpfh = 1;
-		Carry2M.bits.tncl = 0;
-		Carry2M.bits.txcl = 1;
-		Carry2M.bits.tlcl = 0;
-		Carry2M.bits.tmcl = 0;
-		Carry2M.bits.tscl = 0;
-		Carry2M.bits.tedf = 1;
-		Carry2M.bits.tdfr = 0;
-		Carry2M.bits.txpf = 1;
-		Carry2M.bits.tbca = 1;
-		Carry2M.bits.tmca = 1;
-		Carry2M.bits.tpkt = 1;
-		Carry2M.bits.tbyt = 1;
-		Carry2M.bits.tfrg = 1;
-		Carry2M.bits.tund = 0;
-		Carry2M.bits.tovr = 0;
-		Carry2M.bits.txcf = 1;
-		Carry2M.bits.tfcs = 1;
-		Carry2M.bits.tjbr = 1;
-
-		writel(Carry2M.value, &pDevMacStat->Carry2M.value);
-	}
+	writel(0xFFFFBE32, &macstat->Carry1M);
+	writel(0xFFFE7E8B, &macstat->Carry2M);
 }
 
 void ConfigFlowControl(struct et131x_adapter *etdev)
@@ -509,28 +419,28 @@ void ConfigFlowControl(struct et131x_adapter *etdev)
 	if (etdev->duplex_mode == 0) {
 		etdev->FlowControl = None;
 	} else {
-		char RemotePause, RemoteAsyncPause;
+		char remote_pause, remote_async_pause;
 
 		ET1310_PhyAccessMiBit(etdev,
-				      TRUEPHY_BIT_READ, 5, 10, &RemotePause);
+				      TRUEPHY_BIT_READ, 5, 10, &remote_pause);
 		ET1310_PhyAccessMiBit(etdev,
 				      TRUEPHY_BIT_READ, 5, 11,
-				      &RemoteAsyncPause);
+				      &remote_async_pause);
 
-		if ((RemotePause == TRUEPHY_BIT_SET) &&
-		    (RemoteAsyncPause == TRUEPHY_BIT_SET)) {
+		if ((remote_pause == TRUEPHY_BIT_SET) &&
+		    (remote_async_pause == TRUEPHY_BIT_SET)) {
 			etdev->FlowControl = etdev->RegistryFlowControl;
-		} else if ((RemotePause == TRUEPHY_BIT_SET) &&
-			   (RemoteAsyncPause == TRUEPHY_BIT_CLEAR)) {
+		} else if ((remote_pause == TRUEPHY_BIT_SET) &&
+			   (remote_async_pause == TRUEPHY_BIT_CLEAR)) {
 			if (etdev->RegistryFlowControl == Both)
 				etdev->FlowControl = Both;
 			else
 				etdev->FlowControl = None;
-		} else if ((RemotePause == TRUEPHY_BIT_CLEAR) &&
-			   (RemoteAsyncPause == TRUEPHY_BIT_CLEAR)) {
+		} else if ((remote_pause == TRUEPHY_BIT_CLEAR) &&
+			   (remote_async_pause == TRUEPHY_BIT_CLEAR)) {
 			etdev->FlowControl = None;
-		} else {/* if (RemotePause == TRUEPHY_CLEAR_BIT &&
-			       RemoteAsyncPause == TRUEPHY_SET_BIT) */
+		} else {/* if (remote_pause == TRUEPHY_CLEAR_BIT &&
+			       remote_async_pause == TRUEPHY_SET_BIT) */
 			if (etdev->RegistryFlowControl == Both)
 				etdev->FlowControl = RxOnly;
 			else
@@ -546,25 +456,25 @@ void ConfigFlowControl(struct et131x_adapter *etdev)
 void UpdateMacStatHostCounters(struct et131x_adapter *etdev)
 {
 	struct _ce_stats_t *stats = &etdev->Stats;
-	struct _MAC_STAT_t __iomem *pDevMacStat =
+	struct _MAC_STAT_t __iomem *macstat =
 		&etdev->regs->macStat;
 
-	stats->collisions += readl(&pDevMacStat->TNcl);
-	stats->first_collision += readl(&pDevMacStat->TScl);
-	stats->tx_deferred += readl(&pDevMacStat->TDfr);
-	stats->excessive_collisions += readl(&pDevMacStat->TMcl);
-	stats->late_collisions += readl(&pDevMacStat->TLcl);
-	stats->tx_uflo += readl(&pDevMacStat->TUnd);
-	stats->max_pkt_error += readl(&pDevMacStat->TOvr);
-
-	stats->alignment_err += readl(&pDevMacStat->RAln);
-	stats->crc_err += readl(&pDevMacStat->RCde);
-	stats->norcvbuf += readl(&pDevMacStat->RDrp);
-	stats->rx_ov_flow += readl(&pDevMacStat->ROvr);
-	stats->code_violations += readl(&pDevMacStat->RFcs);
-	stats->length_err += readl(&pDevMacStat->RFlr);
-
-	stats->other_errors += readl(&pDevMacStat->RFrg);
+	stats->collisions += readl(&macstat->TNcl);
+	stats->first_collision += readl(&macstat->TScl);
+	stats->tx_deferred += readl(&macstat->TDfr);
+	stats->excessive_collisions += readl(&macstat->TMcl);
+	stats->late_collisions += readl(&macstat->TLcl);
+	stats->tx_uflo += readl(&macstat->TUnd);
+	stats->max_pkt_error += readl(&macstat->TOvr);
+
+	stats->alignment_err += readl(&macstat->RAln);
+	stats->crc_err += readl(&macstat->RCde);
+	stats->norcvbuf += readl(&macstat->RDrp);
+	stats->rx_ov_flow += readl(&macstat->ROvr);
+	stats->code_violations += readl(&macstat->RFcs);
+	stats->length_err += readl(&macstat->RFlr);
+
+	stats->other_errors += readl(&macstat->RFrg);
 }
 
 /**
@@ -577,17 +487,17 @@ void UpdateMacStatHostCounters(struct et131x_adapter *etdev)
  */
 void HandleMacStatInterrupt(struct et131x_adapter *etdev)
 {
-	MAC_STAT_REG_1_t Carry1;
-	MAC_STAT_REG_2_t Carry2;
+	u32 Carry1;
+	u32 Carry2;
 
 	/* Read the interrupt bits from the register(s).  These are Clear On
 	 * Write.
 	 */
-	Carry1.value = readl(&etdev->regs->macStat.Carry1.value);
-	Carry2.value = readl(&etdev->regs->macStat.Carry2.value);
+	Carry1 = readl(&etdev->regs->macStat.Carry1);
+	Carry2 = readl(&etdev->regs->macStat.Carry2);
 
-	writel(Carry1.value, &etdev->regs->macStat.Carry1.value);
-	writel(Carry2.value, &etdev->regs->macStat.Carry2.value);
+	writel(Carry1, &etdev->regs->macStat.Carry1);
+	writel(Carry2, &etdev->regs->macStat.Carry2);
 
 	/* We need to do update the host copy of all the MAC_STAT counters.
 	 * For each counter, check it's overflow bit.  If the overflow bit is
@@ -595,33 +505,33 @@ void HandleMacStatInterrupt(struct et131x_adapter *etdev)
 	 * revolution of the counter.  This routine is called when the counter
 	 * block indicates that one of the counters has wrapped.
 	 */
-	if (Carry1.bits.rfcs)
+	if (Carry1 & (1 << 14))
 		etdev->Stats.code_violations += COUNTER_WRAP_16_BIT;
-	if (Carry1.bits.raln)
+	if (Carry1 & (1 << 8))
 		etdev->Stats.alignment_err += COUNTER_WRAP_12_BIT;
-	if (Carry1.bits.rflr)
+	if (Carry1 & (1 << 7))
 		etdev->Stats.length_err += COUNTER_WRAP_16_BIT;
-	if (Carry1.bits.rfrg)
+	if (Carry1 & (1 << 2))
 		etdev->Stats.other_errors += COUNTER_WRAP_16_BIT;
-	if (Carry1.bits.rcde)
+	if (Carry1 & (1 << 6))
 		etdev->Stats.crc_err += COUNTER_WRAP_16_BIT;
-	if (Carry1.bits.rovr)
+	if (Carry1 & (1 << 3))
 		etdev->Stats.rx_ov_flow += COUNTER_WRAP_16_BIT;
-	if (Carry1.bits.rdrp)
+	if (Carry1 & (1 << 0))
 		etdev->Stats.norcvbuf += COUNTER_WRAP_16_BIT;
-	if (Carry2.bits.tovr)
+	if (Carry2 & (1 << 16))
 		etdev->Stats.max_pkt_error += COUNTER_WRAP_12_BIT;
-	if (Carry2.bits.tund)
+	if (Carry2 & (1 << 15))
 		etdev->Stats.tx_uflo += COUNTER_WRAP_12_BIT;
-	if (Carry2.bits.tscl)
+	if (Carry2 & (1 << 6))
 		etdev->Stats.first_collision += COUNTER_WRAP_12_BIT;
-	if (Carry2.bits.tdfr)
+	if (Carry2 & (1 << 8))
 		etdev->Stats.tx_deferred += COUNTER_WRAP_12_BIT;
-	if (Carry2.bits.tmcl)
+	if (Carry2 & (1 << 5))
 		etdev->Stats.excessive_collisions += COUNTER_WRAP_12_BIT;
-	if (Carry2.bits.tlcl)
+	if (Carry2 & (1 << 4))
 		etdev->Stats.late_collisions += COUNTER_WRAP_12_BIT;
-	if (Carry2.bits.tncl)
+	if (Carry2 & (1 << 2))
 		etdev->Stats.collisions += COUNTER_WRAP_12_BIT;
 }
 
diff --git a/drivers/staging/et131x/et1310_phy.c b/drivers/staging/et131x/et1310_phy.c
index dd199bdb9eff..6ecad619f779 100644
--- a/drivers/staging/et131x/et1310_phy.c
+++ b/drivers/staging/et131x/et1310_phy.c
@@ -98,238 +98,498 @@
 #include "et1310_mac.h"
 
 /* Prototypes for functions with local scope */
-static int et131x_xcvr_init(struct et131x_adapter *adapter);
+static void et131x_xcvr_init(struct et131x_adapter *etdev);
 
 /**
  * PhyMiRead - Read from the PHY through the MII Interface on the MAC
- * @adapter: pointer to our private adapter structure
+ * @etdev: pointer to our private adapter structure
  * @xcvrAddr: the address of the transciever
  * @xcvrReg: the register to read
  * @value: pointer to a 16-bit value in which the value will be stored
  *
  * Returns 0 on success, errno on failure (as defined in errno.h)
  */
-int PhyMiRead(struct et131x_adapter *adapter, uint8_t xcvrAddr,
-	      uint8_t xcvrReg, uint16_t *value)
+int PhyMiRead(struct et131x_adapter *etdev, u8 xcvrAddr,
+	      u8 xcvrReg, u16 *value)
 {
-	struct _MAC_t __iomem *mac = &adapter->regs->mac;
+	struct _MAC_t __iomem *mac = &etdev->regs->mac;
 	int status = 0;
-	uint32_t delay;
-	MII_MGMT_ADDR_t miiAddr;
-	MII_MGMT_CMD_t miiCmd;
-	MII_MGMT_INDICATOR_t miiIndicator;
+	u32 delay;
+	u32 miiAddr;
+	u32 miiCmd;
+	u32 miiIndicator;
 
 	/* Save a local copy of the registers we are dealing with so we can
 	 * set them back
 	 */
-	miiAddr.value = readl(&mac->mii_mgmt_addr.value);
-	miiCmd.value = readl(&mac->mii_mgmt_cmd.value);
+	miiAddr = readl(&mac->mii_mgmt_addr);
+	miiCmd = readl(&mac->mii_mgmt_cmd);
 
 	/* Stop the current operation */
-	writel(0, &mac->mii_mgmt_cmd.value);
+	writel(0, &mac->mii_mgmt_cmd);
 
 	/* Set up the register we need to read from on the correct PHY */
-	{
-		MII_MGMT_ADDR_t mii_mgmt_addr = { 0 };
-
-		mii_mgmt_addr.bits.phy_addr = xcvrAddr;
-		mii_mgmt_addr.bits.reg_addr = xcvrReg;
-		writel(mii_mgmt_addr.value, &mac->mii_mgmt_addr.value);
-	}
+	writel(MII_ADDR(xcvrAddr, xcvrReg), &mac->mii_mgmt_addr);
 
 	/* Kick the read cycle off */
 	delay = 0;
 
-	writel(0x1, &mac->mii_mgmt_cmd.value);
+	writel(0x1, &mac->mii_mgmt_cmd);
 
 	do {
 		udelay(50);
 		delay++;
-		miiIndicator.value = readl(&mac->mii_mgmt_indicator.value);
-	} while ((miiIndicator.bits.not_valid || miiIndicator.bits.busy) &&
-		 delay < 50);
+		miiIndicator = readl(&mac->mii_mgmt_indicator);
+	} while ((miiIndicator & MGMT_WAIT) && delay < 50);
 
 	/* If we hit the max delay, we could not read the register */
-	if (delay >= 50) {
-		dev_warn(&adapter->pdev->dev,
+	if (delay == 50) {
+		dev_warn(&etdev->pdev->dev,
 			    "xcvrReg 0x%08x could not be read\n", xcvrReg);
-		dev_warn(&adapter->pdev->dev, "status is  0x%08x\n",
-			    miiIndicator.value);
+		dev_warn(&etdev->pdev->dev, "status is  0x%08x\n",
+			    miiIndicator);
 
 		status = -EIO;
 	}
 
 	/* If we hit here we were able to read the register and we need to
-	 * return the value to the caller
-	 */
-	/* TODO: make this stuff a simple readw()?! */
-	{
-		MII_MGMT_STAT_t mii_mgmt_stat;
-
-		mii_mgmt_stat.value = readl(&mac->mii_mgmt_stat.value);
-		*value = (uint16_t) mii_mgmt_stat.bits.phy_stat;
-	}
+	 * return the value to the caller */
+	*value = readl(&mac->mii_mgmt_stat) & 0xFFFF;
 
 	/* Stop the read operation */
-	writel(0, &mac->mii_mgmt_cmd.value);
+	writel(0, &mac->mii_mgmt_cmd);
 
 	/* set the registers we touched back to the state at which we entered
 	 * this function
 	 */
-	writel(miiAddr.value, &mac->mii_mgmt_addr.value);
-	writel(miiCmd.value, &mac->mii_mgmt_cmd.value);
+	writel(miiAddr, &mac->mii_mgmt_addr);
+	writel(miiCmd, &mac->mii_mgmt_cmd);
 
 	return status;
 }
 
 /**
  * MiWrite - Write to a PHY register through the MII interface of the MAC
- * @adapter: pointer to our private adapter structure
+ * @etdev: pointer to our private adapter structure
  * @xcvrReg: the register to read
  * @value: 16-bit value to write
  *
+ * FIXME: one caller in netdev still
+ *
  * Return 0 on success, errno on failure (as defined in errno.h)
  */
-int MiWrite(struct et131x_adapter *adapter, uint8_t xcvrReg, uint16_t value)
+int MiWrite(struct et131x_adapter *etdev, u8 xcvrReg, u16 value)
 {
-	struct _MAC_t __iomem *mac = &adapter->regs->mac;
+	struct _MAC_t __iomem *mac = &etdev->regs->mac;
 	int status = 0;
-	uint8_t xcvrAddr = adapter->Stats.xcvr_addr;
-	uint32_t delay;
-	MII_MGMT_ADDR_t miiAddr;
-	MII_MGMT_CMD_t miiCmd;
-	MII_MGMT_INDICATOR_t miiIndicator;
+	u8 xcvrAddr = etdev->Stats.xcvr_addr;
+	u32 delay;
+	u32 miiAddr;
+	u32 miiCmd;
+	u32 miiIndicator;
 
 	/* Save a local copy of the registers we are dealing with so we can
 	 * set them back
 	 */
-	miiAddr.value = readl(&mac->mii_mgmt_addr.value);
-	miiCmd.value = readl(&mac->mii_mgmt_cmd.value);
+	miiAddr = readl(&mac->mii_mgmt_addr);
+	miiCmd = readl(&mac->mii_mgmt_cmd);
 
 	/* Stop the current operation */
-	writel(0, &mac->mii_mgmt_cmd.value);
+	writel(0, &mac->mii_mgmt_cmd);
 
 	/* Set up the register we need to write to on the correct PHY */
-	{
-		MII_MGMT_ADDR_t mii_mgmt_addr;
-
-		mii_mgmt_addr.bits.phy_addr = xcvrAddr;
-		mii_mgmt_addr.bits.reg_addr = xcvrReg;
-		writel(mii_mgmt_addr.value, &mac->mii_mgmt_addr.value);
-	}
+	writel(MII_ADDR(xcvrAddr, xcvrReg), &mac->mii_mgmt_addr);
 
 	/* Add the value to write to the registers to the mac */
-	writel(value, &mac->mii_mgmt_ctrl.value);
+	writel(value, &mac->mii_mgmt_ctrl);
 	delay = 0;
 
 	do {
 		udelay(50);
 		delay++;
-		miiIndicator.value = readl(&mac->mii_mgmt_indicator.value);
-	} while (miiIndicator.bits.busy && delay < 100);
+		miiIndicator = readl(&mac->mii_mgmt_indicator);
+	} while ((miiIndicator & MGMT_BUSY) && delay < 100);
 
 	/* If we hit the max delay, we could not write the register */
 	if (delay == 100) {
-		uint16_t TempValue;
+		u16 TempValue;
 
-		dev_warn(&adapter->pdev->dev,
+		dev_warn(&etdev->pdev->dev,
 		    "xcvrReg 0x%08x could not be written", xcvrReg);
-		dev_warn(&adapter->pdev->dev, "status is  0x%08x\n",
-			    miiIndicator.value);
-		dev_warn(&adapter->pdev->dev, "command is  0x%08x\n",
-			    readl(&mac->mii_mgmt_cmd.value));
+		dev_warn(&etdev->pdev->dev, "status is  0x%08x\n",
+			    miiIndicator);
+		dev_warn(&etdev->pdev->dev, "command is  0x%08x\n",
+			    readl(&mac->mii_mgmt_cmd));
 
-		MiRead(adapter, xcvrReg, &TempValue);
+		MiRead(etdev, xcvrReg, &TempValue);
 
 		status = -EIO;
 	}
-
 	/* Stop the write operation */
-	writel(0, &mac->mii_mgmt_cmd.value);
+	writel(0, &mac->mii_mgmt_cmd);
 
 	/* set the registers we touched back to the state at which we entered
 	 * this function
 	 */
-	writel(miiAddr.value, &mac->mii_mgmt_addr.value);
-	writel(miiCmd.value, &mac->mii_mgmt_cmd.value);
+	writel(miiAddr, &mac->mii_mgmt_addr);
+	writel(miiCmd, &mac->mii_mgmt_cmd);
 
 	return status;
 }
 
 /**
  * et131x_xcvr_find - Find the PHY ID
- * @adapter: pointer to our private adapter structure
+ * @etdev: pointer to our private adapter structure
  *
  * Returns 0 on success, errno on failure (as defined in errno.h)
  */
-int et131x_xcvr_find(struct et131x_adapter *adapter)
+int et131x_xcvr_find(struct et131x_adapter *etdev)
 {
-	int status = -ENODEV;
-	uint8_t xcvr_addr;
+	u8 xcvr_addr;
 	MI_IDR1_t idr1;
 	MI_IDR2_t idr2;
-	uint32_t xcvr_id;
+	u32 xcvr_id;
 
 	/* We need to get xcvr id and address we just get the first one */
 	for (xcvr_addr = 0; xcvr_addr < 32; xcvr_addr++) {
 		/* Read the ID from the PHY */
-		PhyMiRead(adapter, xcvr_addr,
-			  (uint8_t) offsetof(MI_REGS_t, idr1),
+		PhyMiRead(etdev, xcvr_addr,
+			  (u8) offsetof(MI_REGS_t, idr1),
 			  &idr1.value);
-		PhyMiRead(adapter, xcvr_addr,
-			  (uint8_t) offsetof(MI_REGS_t, idr2),
+		PhyMiRead(etdev, xcvr_addr,
+			  (u8) offsetof(MI_REGS_t, idr2),
 			  &idr2.value);
 
-		xcvr_id = (uint32_t) ((idr1.value << 16) | idr2.value);
+		xcvr_id = (u32) ((idr1.value << 16) | idr2.value);
 
-		if ((idr1.value != 0) && (idr1.value != 0xffff)) {
-			adapter->Stats.xcvr_id = xcvr_id;
-			adapter->Stats.xcvr_addr = xcvr_addr;
-
-			status = 0;
-			break;
+		if (idr1.value != 0 && idr1.value != 0xffff) {
+			etdev->Stats.xcvr_id = xcvr_id;
+			etdev->Stats.xcvr_addr = xcvr_addr;
+			return 0;
 		}
 	}
-	return status;
+	return -ENODEV;
+}
+
+void ET1310_PhyReset(struct et131x_adapter *etdev)
+{
+	MiWrite(etdev, PHY_CONTROL, 0x8000);
+}
+
+/**
+ *	ET1310_PhyPowerDown	-	PHY power control
+ *	@etdev: device to control
+ *	@down: true for off/false for back on
+ *
+ *	one hundred, ten, one thousand megs
+ *	How would you like to have your LAN accessed
+ *	Can't you see that this code processed
+ *	Phy power, phy power..
+ */
+
+void ET1310_PhyPowerDown(struct et131x_adapter *etdev, bool down)
+{
+	u16 data;
+
+	MiRead(etdev, PHY_CONTROL, &data);
+	data &= ~0x0800;	/* Power UP */
+	if (down) /* Power DOWN */
+		data |= 0x0800;
+	MiWrite(etdev, PHY_CONTROL, data);
+}
+
+/**
+ *	ET130_PhyAutoNEg	-	autonegotiate control
+ *	@etdev: device to control
+ *	@enabe: autoneg on/off
+ *
+ *	Set up the autonegotiation state according to whether we will be
+ *	negotiating the state or forcing a speed.
+ */
+
+static void ET1310_PhyAutoNeg(struct et131x_adapter *etdev, bool enable)
+{
+	u16 data;
+
+	MiRead(etdev, PHY_CONTROL, &data);
+	data &= ~0x1000;	/* Autonegotiation OFF */
+	if (enable)
+		data |= 0x1000;		/* Autonegotiation ON */
+	MiWrite(etdev, PHY_CONTROL, data);
+}
+
+/**
+ *	ET130_PhyDuplexMode	-	duplex control
+ *	@etdev: device to control
+ *	@duplex: duplex on/off
+ *
+ *	Set up the duplex state on the PHY
+ */
+
+static void ET1310_PhyDuplexMode(struct et131x_adapter *etdev, u16 duplex)
+{
+	u16 data;
+
+	MiRead(etdev, PHY_CONTROL, &data);
+	data &= ~0x100;		/* Set Half Duplex */
+	if (duplex == TRUEPHY_DUPLEX_FULL)
+		data |= 0x100;	/* Set Full Duplex */
+	MiWrite(etdev, PHY_CONTROL, data);
+}
+
+/**
+ *	ET130_PhySpeedSelect	-	speed control
+ *	@etdev: device to control
+ *	@duplex: duplex on/off
+ *
+ *	Set the speed of our PHY.
+ */
+
+static void ET1310_PhySpeedSelect(struct et131x_adapter *etdev, u16 speed)
+{
+	u16 data;
+	static const u16 bits[3]={0x0000, 0x2000, 0x0040};
+
+	/* Read the PHY control register */
+	MiRead(etdev, PHY_CONTROL, &data);
+	/* Clear all Speed settings (Bits 6, 13) */
+	data &= ~0x2040;
+	/* Write back the new speed */
+	MiWrite(etdev, PHY_CONTROL, data | bits[speed]);
+}
+
+/**
+ *	ET1310_PhyLinkStatus	-	read link state
+ *	@etdev: device to read
+ *	@link_status: reported link state
+ *	@autoneg: reported autonegotiation state (complete/incomplete/disabled)
+ *	@linkspeed: returnedlink speed in use
+ *	@duplex_mode: reported half/full duplex state
+ *	@mdi_mdix: not yet working
+ *	@masterslave: report whether we are master or slave
+ *	@polarity: link polarity
+ *
+ *	I can read your lan like a magazine
+ *	I see if your up
+ *	I know your link speed
+ *	I see all the setting that you'd rather keep
+ */
+
+static void ET1310_PhyLinkStatus(struct et131x_adapter *etdev,
+			  u8 *link_status,
+			  u32 *autoneg,
+			  u32 *linkspeed,
+			  u32 *duplex_mode,
+			  u32 *mdi_mdix,
+			  u32 *masterslave, u32 *polarity)
+{
+	u16 mistatus = 0;
+	u16 is1000BaseT = 0;
+	u16 vmi_phystatus = 0;
+	u16 control = 0;
+
+	MiRead(etdev, PHY_STATUS, &mistatus);
+	MiRead(etdev, PHY_1000_STATUS, &is1000BaseT);
+	MiRead(etdev, PHY_PHY_STATUS, &vmi_phystatus);
+	MiRead(etdev, PHY_CONTROL, &control);
+
+	*link_status = (vmi_phystatus & 0x0040) ? 1 : 0;
+	*autoneg = (control & 0x1000) ? ((vmi_phystatus & 0x0020) ?
+					    TRUEPHY_ANEG_COMPLETE :
+					    TRUEPHY_ANEG_NOT_COMPLETE) :
+		    TRUEPHY_ANEG_DISABLED;
+	*linkspeed = (vmi_phystatus & 0x0300) >> 8;
+	*duplex_mode = (vmi_phystatus & 0x0080) >> 7;
+	/* NOTE: Need to complete this */
+	*mdi_mdix = 0;
+
+	*masterslave = (is1000BaseT & 0x4000) ?
+			TRUEPHY_CFG_MASTER : TRUEPHY_CFG_SLAVE;
+	*polarity = (vmi_phystatus & 0x0400) ?
+			TRUEPHY_POLARITY_INVERTED : TRUEPHY_POLARITY_NORMAL;
+}
+
+static void ET1310_PhyAndOrReg(struct et131x_adapter *etdev,
+			u16 regnum, u16 andMask, u16 orMask)
+{
+	u16 reg;
+
+	MiRead(etdev, regnum, &reg);
+	reg &= andMask;
+	reg |= orMask;
+	MiWrite(etdev, regnum, reg);
+}
+
+/* Still used from _mac  for BIT_READ */
+void ET1310_PhyAccessMiBit(struct et131x_adapter *etdev, u16 action,
+			   u16 regnum, u16 bitnum, u8 *value)
+{
+	u16 reg;
+	u16 mask = 0x0001 << bitnum;
+
+	/* Read the requested register */
+	MiRead(etdev, regnum, &reg);
+
+	switch (action) {
+	case TRUEPHY_BIT_READ:
+		*value = (reg & mask) >> bitnum;
+		break;
+
+	case TRUEPHY_BIT_SET:
+		MiWrite(etdev, regnum, reg | mask);
+		break;
+
+	case TRUEPHY_BIT_CLEAR:
+		MiWrite(etdev, regnum, reg & ~mask);
+		break;
+
+	default:
+		break;
+	}
+}
+
+void ET1310_PhyAdvertise1000BaseT(struct et131x_adapter *etdev,
+				  u16 duplex)
+{
+	u16 data;
+
+	/* Read the PHY 1000 Base-T Control Register */
+	MiRead(etdev, PHY_1000_CONTROL, &data);
+
+	/* Clear Bits 8,9 */
+	data &= ~0x0300;
+
+	switch (duplex) {
+	case TRUEPHY_ADV_DUPLEX_NONE:
+		/* Duplex already cleared, do nothing */
+		break;
+
+	case TRUEPHY_ADV_DUPLEX_FULL:
+		/* Set Bit 9 */
+		data |= 0x0200;
+		break;
+
+	case TRUEPHY_ADV_DUPLEX_HALF:
+		/* Set Bit 8 */
+		data |= 0x0100;
+		break;
+
+	case TRUEPHY_ADV_DUPLEX_BOTH:
+	default:
+		data |= 0x0300;
+		break;
+	}
+
+	/* Write back advertisement */
+	MiWrite(etdev, PHY_1000_CONTROL, data);
+}
+
+static void ET1310_PhyAdvertise100BaseT(struct et131x_adapter *etdev,
+				 u16 duplex)
+{
+	u16 data;
+
+	/* Read the Autonegotiation Register (10/100) */
+	MiRead(etdev, PHY_AUTO_ADVERTISEMENT, &data);
+
+	/* Clear bits 7,8 */
+	data &= ~0x0180;
+
+	switch (duplex) {
+	case TRUEPHY_ADV_DUPLEX_NONE:
+		/* Duplex already cleared, do nothing */
+		break;
+
+	case TRUEPHY_ADV_DUPLEX_FULL:
+		/* Set Bit 8 */
+		data |= 0x0100;
+		break;
+
+	case TRUEPHY_ADV_DUPLEX_HALF:
+		/* Set Bit 7 */
+		data |= 0x0080;
+		break;
+
+	case TRUEPHY_ADV_DUPLEX_BOTH:
+	default:
+		/* Set Bits 7,8 */
+		data |= 0x0180;
+		break;
+	}
+
+	/* Write back advertisement */
+	MiWrite(etdev, PHY_AUTO_ADVERTISEMENT, data);
+}
+
+static void ET1310_PhyAdvertise10BaseT(struct et131x_adapter *etdev,
+				u16 duplex)
+{
+	u16 data;
+
+	/* Read the Autonegotiation Register (10/100) */
+	MiRead(etdev, PHY_AUTO_ADVERTISEMENT, &data);
+
+	/* Clear bits 5,6 */
+	data &= ~0x0060;
+
+	switch (duplex) {
+	case TRUEPHY_ADV_DUPLEX_NONE:
+		/* Duplex already cleared, do nothing */
+		break;
+
+	case TRUEPHY_ADV_DUPLEX_FULL:
+		/* Set Bit 6 */
+		data |= 0x0040;
+		break;
+
+	case TRUEPHY_ADV_DUPLEX_HALF:
+		/* Set Bit 5 */
+		data |= 0x0020;
+		break;
+
+	case TRUEPHY_ADV_DUPLEX_BOTH:
+	default:
+		/* Set Bits 5,6 */
+		data |= 0x0060;
+		break;
+	}
+
+	/* Write back advertisement */
+	MiWrite(etdev, PHY_AUTO_ADVERTISEMENT, data);
 }
 
 /**
  * et131x_setphy_normal - Set PHY for normal operation.
- * @adapter: pointer to our private adapter structure
+ * @etdev: pointer to our private adapter structure
  *
  * Used by Power Management to force the PHY into 10 Base T half-duplex mode,
  * when going to D3 in WOL mode. Also used during initialization to set the
  * PHY for normal operation.
  */
-int et131x_setphy_normal(struct et131x_adapter *adapter)
+void et131x_setphy_normal(struct et131x_adapter *etdev)
 {
-	int status;
-
 	/* Make sure the PHY is powered up */
-	ET1310_PhyPowerDown(adapter, 0);
-	status = et131x_xcvr_init(adapter);
-	return status;
+	ET1310_PhyPowerDown(etdev, 0);
+	et131x_xcvr_init(etdev);
 }
 
+
 /**
  * et131x_xcvr_init - Init the phy if we are setting it into force mode
- * @adapter: pointer to our private adapter structure
+ * @etdev: pointer to our private adapter structure
  *
- * Returns 0 on success, errno on failure (as defined in errno.h)
  */
-static int et131x_xcvr_init(struct et131x_adapter *adapter)
+static void et131x_xcvr_init(struct et131x_adapter *etdev)
 {
-	int status = 0;
 	MI_IMR_t imr;
 	MI_ISR_t isr;
 	MI_LCR2_t lcr2;
 
 	/* Zero out the adapter structure variable representing BMSR */
-	adapter->Bmsr.value = 0;
+	etdev->Bmsr.value = 0;
 
-	MiRead(adapter, (uint8_t) offsetof(MI_REGS_t, isr), &isr.value);
-
-	MiRead(adapter, (uint8_t) offsetof(MI_REGS_t, imr), &imr.value);
+	MiRead(etdev, (u8) offsetof(MI_REGS_t, isr), &isr.value);
+	MiRead(etdev, (u8) offsetof(MI_REGS_t, imr), &imr.value);
 
 	/* Set the link status interrupt only.  Bad behavior when link status
 	 * and auto neg are set, we run into a nested interrupt problem
@@ -338,7 +598,7 @@ static int et131x_xcvr_init(struct et131x_adapter *adapter)
 	imr.bits.link_status = 0x1;
 	imr.bits.autoneg_status = 0x1;
 
-	MiWrite(adapter, (uint8_t) offsetof(MI_REGS_t, imr), imr.value);
+	MiWrite(etdev, (u8) offsetof(MI_REGS_t, imr), imr.value);
 
 	/* Set the LED behavior such that LED 1 indicates speed (off =
 	 * 10Mbits, blink = 100Mbits, on = 1000Mbits) and LED 2 indicates
@@ -348,111 +608,138 @@ static int et131x_xcvr_init(struct et131x_adapter *adapter)
 	 * vendors; The LED behavior is now determined by vendor data in the
 	 * EEPROM. However, the above description is the default.
 	 */
-	if ((adapter->eepromData[1] & 0x4) == 0) {
-		MiRead(adapter, (uint8_t) offsetof(MI_REGS_t, lcr2),
+	if ((etdev->eepromData[1] & 0x4) == 0) {
+		MiRead(etdev, (u8) offsetof(MI_REGS_t, lcr2),
 		       &lcr2.value);
-		if ((adapter->eepromData[1] & 0x8) == 0)
+		if ((etdev->eepromData[1] & 0x8) == 0)
 			lcr2.bits.led_tx_rx = 0x3;
 		else
 			lcr2.bits.led_tx_rx = 0x4;
 		lcr2.bits.led_link = 0xa;
-		MiWrite(adapter, (uint8_t) offsetof(MI_REGS_t, lcr2),
+		MiWrite(etdev, (u8) offsetof(MI_REGS_t, lcr2),
 			lcr2.value);
 	}
 
 	/* Determine if we need to go into a force mode and set it */
-	if (adapter->AiForceSpeed == 0 && adapter->AiForceDpx == 0) {
-		if ((adapter->RegistryFlowControl == TxOnly) ||
-		    (adapter->RegistryFlowControl == Both)) {
-			ET1310_PhyAccessMiBit(adapter,
+	if (etdev->AiForceSpeed == 0 && etdev->AiForceDpx == 0) {
+		if (etdev->RegistryFlowControl == TxOnly ||
+		    etdev->RegistryFlowControl == Both)
+			ET1310_PhyAccessMiBit(etdev,
 					      TRUEPHY_BIT_SET, 4, 11, NULL);
-		} else {
-			ET1310_PhyAccessMiBit(adapter,
+		else
+			ET1310_PhyAccessMiBit(etdev,
 					      TRUEPHY_BIT_CLEAR, 4, 11, NULL);
-		}
 
-		if (adapter->RegistryFlowControl == Both) {
-			ET1310_PhyAccessMiBit(adapter,
+		if (etdev->RegistryFlowControl == Both)
+			ET1310_PhyAccessMiBit(etdev,
 					      TRUEPHY_BIT_SET, 4, 10, NULL);
-		} else {
-			ET1310_PhyAccessMiBit(adapter,
+		else
+			ET1310_PhyAccessMiBit(etdev,
 					      TRUEPHY_BIT_CLEAR, 4, 10, NULL);
-		}
 
 		/* Set the phy to autonegotiation */
-		ET1310_PhyAutoNeg(adapter, true);
+		ET1310_PhyAutoNeg(etdev, true);
 
 		/* NOTE - Do we need this? */
-		ET1310_PhyAccessMiBit(adapter, TRUEPHY_BIT_SET, 0, 9, NULL);
-		return status;
-	} else {
-		ET1310_PhyAutoNeg(adapter, false);
-
-		/* Set to the correct force mode. */
-		if (adapter->AiForceDpx != 1) {
-			if ((adapter->RegistryFlowControl == TxOnly) ||
-			    (adapter->RegistryFlowControl == Both)) {
-				ET1310_PhyAccessMiBit(adapter,
-						      TRUEPHY_BIT_SET, 4, 11,
-						      NULL);
-			} else {
-				ET1310_PhyAccessMiBit(adapter,
-						      TRUEPHY_BIT_CLEAR, 4, 11,
-						      NULL);
-			}
+		ET1310_PhyAccessMiBit(etdev, TRUEPHY_BIT_SET, 0, 9, NULL);
+		return;
+	}
 
-			if (adapter->RegistryFlowControl == Both) {
-				ET1310_PhyAccessMiBit(adapter,
-						      TRUEPHY_BIT_SET, 4, 10,
-						      NULL);
-			} else {
-				ET1310_PhyAccessMiBit(adapter,
-						      TRUEPHY_BIT_CLEAR, 4, 10,
-						      NULL);
-			}
-		} else {
-			ET1310_PhyAccessMiBit(adapter,
-					      TRUEPHY_BIT_CLEAR, 4, 10, NULL);
-			ET1310_PhyAccessMiBit(adapter,
+	ET1310_PhyAutoNeg(etdev, false);
+
+	/* Set to the correct force mode. */
+	if (etdev->AiForceDpx != 1) {
+		if (etdev->RegistryFlowControl == TxOnly ||
+		    etdev->RegistryFlowControl == Both)
+			ET1310_PhyAccessMiBit(etdev,
+				      TRUEPHY_BIT_SET, 4, 11, NULL);
+		else
+			ET1310_PhyAccessMiBit(etdev,
 					      TRUEPHY_BIT_CLEAR, 4, 11, NULL);
-		}
 
-		switch (adapter->AiForceSpeed) {
-		case 10:
-			if (adapter->AiForceDpx == 1)
-				TPAL_SetPhy10HalfDuplex(adapter);
-			else if (adapter->AiForceDpx == 2)
-				TPAL_SetPhy10FullDuplex(adapter);
-			else
-				TPAL_SetPhy10Force(adapter);
-			break;
-		case 100:
-			if (adapter->AiForceDpx == 1)
-				TPAL_SetPhy100HalfDuplex(adapter);
-			else if (adapter->AiForceDpx == 2)
-				TPAL_SetPhy100FullDuplex(adapter);
-			else
-				TPAL_SetPhy100Force(adapter);
-			break;
-		case 1000:
-			TPAL_SetPhy1000FullDuplex(adapter);
-			break;
+		if (etdev->RegistryFlowControl == Both)
+			ET1310_PhyAccessMiBit(etdev,
+					      TRUEPHY_BIT_SET, 4, 10, NULL);
+		else
+			ET1310_PhyAccessMiBit(etdev,
+					      TRUEPHY_BIT_CLEAR, 4, 10, NULL);
+	} else {
+		ET1310_PhyAccessMiBit(etdev, TRUEPHY_BIT_CLEAR, 4, 10, NULL);
+		ET1310_PhyAccessMiBit(etdev, TRUEPHY_BIT_CLEAR, 4, 11, NULL);
+	}
+	ET1310_PhyPowerDown(etdev, 1);
+	switch (etdev->AiForceSpeed) {
+	case 10:
+		/* First we need to turn off all other advertisement */
+		ET1310_PhyAdvertise1000BaseT(etdev, TRUEPHY_ADV_DUPLEX_NONE);
+		ET1310_PhyAdvertise100BaseT(etdev, TRUEPHY_ADV_DUPLEX_NONE);
+		if (etdev->AiForceDpx == 1) {
+			/* Set our advertise values accordingly */
+			ET1310_PhyAdvertise10BaseT(etdev,
+						TRUEPHY_ADV_DUPLEX_HALF);
+		} else if (etdev->AiForceDpx == 2) {
+			/* Set our advertise values accordingly */
+			ET1310_PhyAdvertise10BaseT(etdev,
+						TRUEPHY_ADV_DUPLEX_FULL);
+		} else {
+			/* Disable autoneg */
+			ET1310_PhyAutoNeg(etdev, false);
+			/* Disable rest of the advertisements */
+			ET1310_PhyAdvertise10BaseT(etdev,
+					TRUEPHY_ADV_DUPLEX_NONE);
+			/* Force 10 Mbps */
+			ET1310_PhySpeedSelect(etdev, TRUEPHY_SPEED_10MBPS);
+			/* Force Full duplex */
+			ET1310_PhyDuplexMode(etdev, TRUEPHY_DUPLEX_FULL);
 		}
-
-		return status;
+		break;
+	case 100:
+		/* first we need to turn off all other advertisement */
+		ET1310_PhyAdvertise1000BaseT(etdev, TRUEPHY_ADV_DUPLEX_NONE);
+		ET1310_PhyAdvertise10BaseT(etdev, TRUEPHY_ADV_DUPLEX_NONE);
+		if (etdev->AiForceDpx == 1) {
+			/* Set our advertise values accordingly */
+			ET1310_PhyAdvertise100BaseT(etdev,
+						TRUEPHY_ADV_DUPLEX_HALF);
+			/* Set speed */
+			ET1310_PhySpeedSelect(etdev, TRUEPHY_SPEED_100MBPS);
+		} else if (etdev->AiForceDpx == 2) {
+			/* Set our advertise values accordingly */
+			ET1310_PhyAdvertise100BaseT(etdev,
+						TRUEPHY_ADV_DUPLEX_FULL);
+		} else {
+			/* Disable autoneg */
+			ET1310_PhyAutoNeg(etdev, false);
+			/* Disable other advertisement */
+			ET1310_PhyAdvertise100BaseT(etdev,
+						TRUEPHY_ADV_DUPLEX_NONE);
+			/* Force 100 Mbps */
+			ET1310_PhySpeedSelect(etdev, TRUEPHY_SPEED_100MBPS);
+			/* Force Full duplex */
+			ET1310_PhyDuplexMode(etdev, TRUEPHY_DUPLEX_FULL);
+		}
+		break;
+	case 1000:
+		/* first we need to turn off all other advertisement */
+		ET1310_PhyAdvertise100BaseT(etdev, TRUEPHY_ADV_DUPLEX_NONE);
+		ET1310_PhyAdvertise10BaseT(etdev, TRUEPHY_ADV_DUPLEX_NONE);
+		/* set our advertise values accordingly */
+		ET1310_PhyAdvertise1000BaseT(etdev, TRUEPHY_ADV_DUPLEX_FULL);
+		break;
 	}
+	ET1310_PhyPowerDown(etdev, 0);
 }
 
 void et131x_Mii_check(struct et131x_adapter *etdev,
 		      MI_BMSR_t bmsr, MI_BMSR_t bmsr_ints)
 {
-	uint8_t link_status;
-	uint32_t autoneg_status;
-	uint32_t speed;
-	uint32_t duplex;
-	uint32_t mdi_mdix;
-	uint32_t masterslave;
-	uint32_t polarity;
+	u8 link_status;
+	u32 autoneg_status;
+	u32 speed;
+	u32 duplex;
+	u32 mdi_mdix;
+	u32 masterslave;
+	u32 polarity;
 	unsigned long flags;
 
 	if (bmsr_ints.bits.link_status) {
@@ -469,9 +756,7 @@ void et131x_Mii_check(struct et131x_adapter *etdev,
 
 			spin_unlock_irqrestore(&etdev->Lock, flags);
 
-			/* Don't indicate state if we're in loopback mode */
-			if (etdev->RegistryPhyLoopbk == false)
-				netif_carrier_on(etdev->netdev);
+			netif_carrier_on(etdev->netdev);
 		} else {
 			dev_warn(&etdev->pdev->dev,
 			    "Link down - cable problem ?\n");
@@ -481,7 +766,7 @@ void et131x_Mii_check(struct et131x_adapter *etdev,
 				 * TruePHY?
 				 * && TRU_QueryCoreType(etdev->hTruePhy, 0) == EMI_TRUEPHY_A13O) {
 				 */
-				uint16_t Register18;
+				u16 Register18;
 
 				MiRead(etdev, 0x12, &Register18);
 				MiWrite(etdev, 0x12, Register18 | 0x4);
@@ -504,11 +789,7 @@ void et131x_Mii_check(struct et131x_adapter *etdev,
 				spin_unlock_irqrestore(&etdev->Lock,
 						       flags);
 
-				/* Only indicate state if we're in loopback
-				 * mode
-				 */
-				if (etdev->RegistryPhyLoopbk == false)
-					netif_carrier_off(etdev->netdev);
+				netif_carrier_off(etdev->netdev);
 			}
 
 			etdev->linkspeed = 0;
@@ -561,7 +842,7 @@ void et131x_Mii_check(struct et131x_adapter *etdev,
 				 * TruePHY?
 				 * && TRU_QueryCoreType(etdev->hTruePhy, 0)== EMI_TRUEPHY_A13O) {
 				 */
-				uint16_t Register18;
+				u16 Register18;
 
 				MiRead(etdev, 0x12, &Register18);
 				MiWrite(etdev, 0x12, Register18 | 0x4);
@@ -583,212 +864,13 @@ void et131x_Mii_check(struct et131x_adapter *etdev,
 	}
 }
 
-/**
- * TPAL_SetPhy10HalfDuplex - Force the phy into 10 Base T Half Duplex mode.
- * @etdev: pointer to the adapter structure
- *
- * Also sets the MAC so it is syncd up properly
- */
-void TPAL_SetPhy10HalfDuplex(struct et131x_adapter *etdev)
-{
-	/* Power down PHY */
-	ET1310_PhyPowerDown(etdev, 1);
-
-	/* First we need to turn off all other advertisement */
-	ET1310_PhyAdvertise1000BaseT(etdev, TRUEPHY_ADV_DUPLEX_NONE);
-
-	ET1310_PhyAdvertise100BaseT(etdev, TRUEPHY_ADV_DUPLEX_NONE);
-
-	/* Set our advertise values accordingly */
-	ET1310_PhyAdvertise10BaseT(etdev, TRUEPHY_ADV_DUPLEX_HALF);
-
-	/* Power up PHY */
-	ET1310_PhyPowerDown(etdev, 0);
-}
-
-/**
- * TPAL_SetPhy10FullDuplex - Force the phy into 10 Base T Full Duplex mode.
- * @etdev: pointer to the adapter structure
- *
- * Also sets the MAC so it is syncd up properly
- */
-void TPAL_SetPhy10FullDuplex(struct et131x_adapter *etdev)
-{
-	/* Power down PHY */
-	ET1310_PhyPowerDown(etdev, 1);
-
-	/* First we need to turn off all other advertisement */
-	ET1310_PhyAdvertise1000BaseT(etdev, TRUEPHY_ADV_DUPLEX_NONE);
-
-	ET1310_PhyAdvertise100BaseT(etdev, TRUEPHY_ADV_DUPLEX_NONE);
-
-	/* Set our advertise values accordingly */
-	ET1310_PhyAdvertise10BaseT(etdev, TRUEPHY_ADV_DUPLEX_FULL);
-
-	/* Power up PHY */
-	ET1310_PhyPowerDown(etdev, 0);
-}
-
-/**
- * TPAL_SetPhy10Force - Force Base-T FD mode WITHOUT using autonegotiation
- * @etdev: pointer to the adapter structure
- */
-void TPAL_SetPhy10Force(struct et131x_adapter *etdev)
-{
-	/* Power down PHY */
-	ET1310_PhyPowerDown(etdev, 1);
-
-	/* Disable autoneg */
-	ET1310_PhyAutoNeg(etdev, false);
-
-	/* Disable all advertisement */
-	ET1310_PhyAdvertise1000BaseT(etdev, TRUEPHY_ADV_DUPLEX_NONE);
-	ET1310_PhyAdvertise10BaseT(etdev, TRUEPHY_ADV_DUPLEX_NONE);
-	ET1310_PhyAdvertise100BaseT(etdev, TRUEPHY_ADV_DUPLEX_NONE);
-
-	/* Force 10 Mbps */
-	ET1310_PhySpeedSelect(etdev, TRUEPHY_SPEED_10MBPS);
-
-	/* Force Full duplex */
-	ET1310_PhyDuplexMode(etdev, TRUEPHY_DUPLEX_FULL);
-
-	/* Power up PHY */
-	ET1310_PhyPowerDown(etdev, 0);
-}
-
-/**
- * TPAL_SetPhy100HalfDuplex - Force 100 Base T Half Duplex mode.
- * @etdev: pointer to the adapter structure
- *
- * Also sets the MAC so it is syncd up properly.
- */
-void TPAL_SetPhy100HalfDuplex(struct et131x_adapter *etdev)
-{
-	/* Power down PHY */
-	ET1310_PhyPowerDown(etdev, 1);
-
-	/* first we need to turn off all other advertisement */
-	ET1310_PhyAdvertise1000BaseT(etdev, TRUEPHY_ADV_DUPLEX_NONE);
-
-	ET1310_PhyAdvertise10BaseT(etdev, TRUEPHY_ADV_DUPLEX_NONE);
-
-	/* Set our advertise values accordingly */
-	ET1310_PhyAdvertise100BaseT(etdev, TRUEPHY_ADV_DUPLEX_HALF);
-
-	/* Set speed */
-	ET1310_PhySpeedSelect(etdev, TRUEPHY_SPEED_100MBPS);
-
-	/* Power up PHY */
-	ET1310_PhyPowerDown(etdev, 0);
-}
-
-/**
- * TPAL_SetPhy100FullDuplex - Force 100 Base T Full Duplex mode.
- * @etdev: pointer to the adapter structure
- *
- * Also sets the MAC so it is syncd up properly
- */
-void TPAL_SetPhy100FullDuplex(struct et131x_adapter *etdev)
-{
-	/* Power down PHY */
-	ET1310_PhyPowerDown(etdev, 1);
-
-	/* First we need to turn off all other advertisement */
-	ET1310_PhyAdvertise1000BaseT(etdev, TRUEPHY_ADV_DUPLEX_NONE);
-
-	ET1310_PhyAdvertise10BaseT(etdev, TRUEPHY_ADV_DUPLEX_NONE);
-
-	/* Set our advertise values accordingly */
-	ET1310_PhyAdvertise100BaseT(etdev, TRUEPHY_ADV_DUPLEX_FULL);
-
-	/* Power up PHY */
-	ET1310_PhyPowerDown(etdev, 0);
-}
-
-/**
- * TPAL_SetPhy100Force - Force 100 BaseT FD mode WITHOUT using autonegotiation
- * @etdev: pointer to the adapter structure
- */
-void TPAL_SetPhy100Force(struct et131x_adapter *etdev)
-{
-	/* Power down PHY */
-	ET1310_PhyPowerDown(etdev, 1);
-
-	/* Disable autoneg */
-	ET1310_PhyAutoNeg(etdev, false);
-
-	/* Disable all advertisement */
-	ET1310_PhyAdvertise1000BaseT(etdev, TRUEPHY_ADV_DUPLEX_NONE);
-	ET1310_PhyAdvertise10BaseT(etdev, TRUEPHY_ADV_DUPLEX_NONE);
-	ET1310_PhyAdvertise100BaseT(etdev, TRUEPHY_ADV_DUPLEX_NONE);
-
-	/* Force 100 Mbps */
-	ET1310_PhySpeedSelect(etdev, TRUEPHY_SPEED_100MBPS);
-
-	/* Force Full duplex */
-	ET1310_PhyDuplexMode(etdev, TRUEPHY_DUPLEX_FULL);
-
-	/* Power up PHY */
-	ET1310_PhyPowerDown(etdev, 0);
-}
-
-/**
- * TPAL_SetPhy1000FullDuplex - Force 1000 Base T Full Duplex mode
- * @etdev: pointer to the adapter structure
- *
- * Also sets the MAC so it is syncd up properly.
- */
-void TPAL_SetPhy1000FullDuplex(struct et131x_adapter *etdev)
-{
-	/* Power down PHY */
-	ET1310_PhyPowerDown(etdev, 1);
-
-	/* first we need to turn off all other advertisement */
-	ET1310_PhyAdvertise100BaseT(etdev, TRUEPHY_ADV_DUPLEX_NONE);
-
-	ET1310_PhyAdvertise10BaseT(etdev, TRUEPHY_ADV_DUPLEX_NONE);
-
-	/* set our advertise values accordingly */
-	ET1310_PhyAdvertise1000BaseT(etdev, TRUEPHY_ADV_DUPLEX_FULL);
-
-	/* power up PHY */
-	ET1310_PhyPowerDown(etdev, 0);
-}
-
-/**
- * TPAL_SetPhyAutoNeg - Set phy to autonegotiation mode.
- * @etdev: pointer to the adapter structure
- */
-void TPAL_SetPhyAutoNeg(struct et131x_adapter *etdev)
-{
-	/* Power down PHY */
-	ET1310_PhyPowerDown(etdev, 1);
-
-	/* Turn on advertisement of all capabilities */
-	ET1310_PhyAdvertise10BaseT(etdev, TRUEPHY_ADV_DUPLEX_BOTH);
-
-	ET1310_PhyAdvertise100BaseT(etdev, TRUEPHY_ADV_DUPLEX_BOTH);
-
-	if (etdev->pdev->device != ET131X_PCI_DEVICE_ID_FAST)
-		ET1310_PhyAdvertise1000BaseT(etdev, TRUEPHY_ADV_DUPLEX_FULL);
-	else
-		ET1310_PhyAdvertise1000BaseT(etdev, TRUEPHY_ADV_DUPLEX_NONE);
-
-	/* Make sure auto-neg is ON (it is disabled in FORCE modes) */
-	ET1310_PhyAutoNeg(etdev, true);
-
-	/* Power up PHY */
-	ET1310_PhyPowerDown(etdev, 0);
-}
-
-
 /*
  * The routines which follow provide low-level access to the PHY, and are used
  * primarily by the routines above (although there are a few places elsewhere
  * in the driver where this level of access is required).
  */
 
-static const uint16_t ConfigPhy[25][2] = {
+static const u16 ConfigPhy[25][2] = {
 	/* Reg      Value      Register */
 	/* Addr                         */
 	{0x880B, 0x0926},	/* AfeIfCreg4B1000Msbs */
@@ -831,7 +913,7 @@ static const uint16_t ConfigPhy[25][2] = {
 /* condensed version of the phy initialization routine */
 void ET1310_PhyInit(struct et131x_adapter *etdev)
 {
-	uint16_t data, index;
+	u16 data, index;
 
 	if (etdev == NULL)
 		return;
@@ -896,304 +978,3 @@ void ET1310_PhyInit(struct et131x_adapter *etdev)
 	MiWrite(etdev, PHY_MPHY_CONTROL_REG, 0x0002);
 }
 
-void ET1310_PhyReset(struct et131x_adapter *etdev)
-{
-	MiWrite(etdev, PHY_CONTROL, 0x8000);
-}
-
-void ET1310_PhyPowerDown(struct et131x_adapter *etdev, bool down)
-{
-	uint16_t data;
-
-	MiRead(etdev, PHY_CONTROL, &data);
-
-	if (down == false) {
-		/* Power UP */
-		data &= ~0x0800;
-		MiWrite(etdev, PHY_CONTROL, data);
-	} else {
-		/* Power DOWN */
-		data |= 0x0800;
-		MiWrite(etdev, PHY_CONTROL, data);
-	}
-}
-
-void ET1310_PhyAutoNeg(struct et131x_adapter *etdev, bool enable)
-{
-	uint16_t data;
-
-	MiRead(etdev, PHY_CONTROL, &data);
-
-	if (enable == true) {
-		/* Autonegotiation ON */
-		data |= 0x1000;
-		MiWrite(etdev, PHY_CONTROL, data);
-	} else {
-		/* Autonegotiation OFF */
-		data &= ~0x1000;
-		MiWrite(etdev, PHY_CONTROL, data);
-	}
-}
-
-void ET1310_PhyDuplexMode(struct et131x_adapter *etdev, uint16_t duplex)
-{
-	uint16_t data;
-
-	MiRead(etdev, PHY_CONTROL, &data);
-
-	if (duplex == TRUEPHY_DUPLEX_FULL) {
-		/* Set Full Duplex */
-		data |= 0x100;
-		MiWrite(etdev, PHY_CONTROL, data);
-	} else {
-		/* Set Half Duplex */
-		data &= ~0x100;
-		MiWrite(etdev, PHY_CONTROL, data);
-	}
-}
-
-void ET1310_PhySpeedSelect(struct et131x_adapter *etdev, uint16_t speed)
-{
-	uint16_t data;
-
-	/* Read the PHY control register */
-	MiRead(etdev, PHY_CONTROL, &data);
-
-	/* Clear all Speed settings (Bits 6, 13) */
-	data &= ~0x2040;
-
-	/* Reset the speed bits based on user selection */
-	switch (speed) {
-	case TRUEPHY_SPEED_10MBPS:
-		/* Bits already cleared above, do nothing */
-		break;
-
-	case TRUEPHY_SPEED_100MBPS:
-		/* 100M == Set bit 13 */
-		data |= 0x2000;
-		break;
-
-	case TRUEPHY_SPEED_1000MBPS:
-	default:
-		data |= 0x0040;
-		break;
-	}
-
-	/* Write back the new speed */
-	MiWrite(etdev, PHY_CONTROL, data);
-}
-
-void ET1310_PhyAdvertise1000BaseT(struct et131x_adapter *etdev,
-				  uint16_t duplex)
-{
-	uint16_t data;
-
-	/* Read the PHY 1000 Base-T Control Register */
-	MiRead(etdev, PHY_1000_CONTROL, &data);
-
-	/* Clear Bits 8,9 */
-	data &= ~0x0300;
-
-	switch (duplex) {
-	case TRUEPHY_ADV_DUPLEX_NONE:
-		/* Duplex already cleared, do nothing */
-		break;
-
-	case TRUEPHY_ADV_DUPLEX_FULL:
-		/* Set Bit 9 */
-		data |= 0x0200;
-		break;
-
-	case TRUEPHY_ADV_DUPLEX_HALF:
-		/* Set Bit 8 */
-		data |= 0x0100;
-		break;
-
-	case TRUEPHY_ADV_DUPLEX_BOTH:
-	default:
-		data |= 0x0300;
-		break;
-	}
-
-	/* Write back advertisement */
-	MiWrite(etdev, PHY_1000_CONTROL, data);
-}
-
-void ET1310_PhyAdvertise100BaseT(struct et131x_adapter *etdev,
-				 uint16_t duplex)
-{
-	uint16_t data;
-
-	/* Read the Autonegotiation Register (10/100) */
-	MiRead(etdev, PHY_AUTO_ADVERTISEMENT, &data);
-
-	/* Clear bits 7,8 */
-	data &= ~0x0180;
-
-	switch (duplex) {
-	case TRUEPHY_ADV_DUPLEX_NONE:
-		/* Duplex already cleared, do nothing */
-		break;
-
-	case TRUEPHY_ADV_DUPLEX_FULL:
-		/* Set Bit 8 */
-		data |= 0x0100;
-		break;
-
-	case TRUEPHY_ADV_DUPLEX_HALF:
-		/* Set Bit 7 */
-		data |= 0x0080;
-		break;
-
-	case TRUEPHY_ADV_DUPLEX_BOTH:
-	default:
-		/* Set Bits 7,8 */
-		data |= 0x0180;
-		break;
-	}
-
-	/* Write back advertisement */
-	MiWrite(etdev, PHY_AUTO_ADVERTISEMENT, data);
-}
-
-void ET1310_PhyAdvertise10BaseT(struct et131x_adapter *etdev,
-				uint16_t duplex)
-{
-	uint16_t data;
-
-	/* Read the Autonegotiation Register (10/100) */
-	MiRead(etdev, PHY_AUTO_ADVERTISEMENT, &data);
-
-	/* Clear bits 5,6 */
-	data &= ~0x0060;
-
-	switch (duplex) {
-	case TRUEPHY_ADV_DUPLEX_NONE:
-		/* Duplex already cleared, do nothing */
-		break;
-
-	case TRUEPHY_ADV_DUPLEX_FULL:
-		/* Set Bit 6 */
-		data |= 0x0040;
-		break;
-
-	case TRUEPHY_ADV_DUPLEX_HALF:
-		/* Set Bit 5 */
-		data |= 0x0020;
-		break;
-
-	case TRUEPHY_ADV_DUPLEX_BOTH:
-	default:
-		/* Set Bits 5,6 */
-		data |= 0x0060;
-		break;
-	}
-
-	/* Write back advertisement */
-	MiWrite(etdev, PHY_AUTO_ADVERTISEMENT, data);
-}
-
-void ET1310_PhyLinkStatus(struct et131x_adapter *etdev,
-			  uint8_t *link_status,
-			  uint32_t *autoneg,
-			  uint32_t *linkspeed,
-			  uint32_t *duplex_mode,
-			  uint32_t *mdi_mdix,
-			  uint32_t *masterslave, uint32_t *polarity)
-{
-	uint16_t mistatus = 0;
-	uint16_t is1000BaseT = 0;
-	uint16_t vmi_phystatus = 0;
-	uint16_t control = 0;
-
-	MiRead(etdev, PHY_STATUS, &mistatus);
-	MiRead(etdev, PHY_1000_STATUS, &is1000BaseT);
-	MiRead(etdev, PHY_PHY_STATUS, &vmi_phystatus);
-	MiRead(etdev, PHY_CONTROL, &control);
-
-	if (link_status) {
-		*link_status =
-		    (unsigned char)((vmi_phystatus & 0x0040) ? 1 : 0);
-	}
-
-	if (autoneg) {
-		*autoneg =
-		    (control & 0x1000) ? ((vmi_phystatus & 0x0020) ?
-					    TRUEPHY_ANEG_COMPLETE :
-					    TRUEPHY_ANEG_NOT_COMPLETE) :
-		    TRUEPHY_ANEG_DISABLED;
-	}
-
-	if (linkspeed)
-		*linkspeed = (vmi_phystatus & 0x0300) >> 8;
-
-	if (duplex_mode)
-		*duplex_mode = (vmi_phystatus & 0x0080) >> 7;
-
-	if (mdi_mdix)
-		/* NOTE: Need to complete this */
-		*mdi_mdix = 0;
-
-	if (masterslave) {
-		*masterslave =
-		    (is1000BaseT & 0x4000) ? TRUEPHY_CFG_MASTER :
-		    TRUEPHY_CFG_SLAVE;
-	}
-
-	if (polarity) {
-		*polarity =
-		    (vmi_phystatus & 0x0400) ? TRUEPHY_POLARITY_INVERTED :
-		    TRUEPHY_POLARITY_NORMAL;
-	}
-}
-
-void ET1310_PhyAndOrReg(struct et131x_adapter *etdev,
-			uint16_t regnum, uint16_t andMask, uint16_t orMask)
-{
-	uint16_t reg;
-
-	/* Read the requested register */
-	MiRead(etdev, regnum, &reg);
-
-	/* Apply the AND mask */
-	reg &= andMask;
-
-	/* Apply the OR mask */
-	reg |= orMask;
-
-	/* Write the value back to the register */
-	MiWrite(etdev, regnum, reg);
-}
-
-void ET1310_PhyAccessMiBit(struct et131x_adapter *etdev, uint16_t action,
-			   uint16_t regnum, uint16_t bitnum, uint8_t *value)
-{
-	uint16_t reg;
-	uint16_t mask = 0;
-
-	/* Create a mask to isolate the requested bit */
-	mask = 0x0001 << bitnum;
-
-	/* Read the requested register */
-	MiRead(etdev, regnum, &reg);
-
-	switch (action) {
-	case TRUEPHY_BIT_READ:
-		if (value != NULL)
-			*value = (reg & mask) >> bitnum;
-		break;
-
-	case TRUEPHY_BIT_SET:
-		reg |= mask;
-		MiWrite(etdev, regnum, reg);
-		break;
-
-	case TRUEPHY_BIT_CLEAR:
-		reg &= ~mask;
-		MiWrite(etdev, regnum, reg);
-		break;
-
-	default:
-		break;
-	}
-}
diff --git a/drivers/staging/et131x/et1310_phy.h b/drivers/staging/et131x/et1310_phy.h
index 080656c6142c..758b9b251715 100644
--- a/drivers/staging/et131x/et1310_phy.h
+++ b/drivers/staging/et131x/et1310_phy.h
@@ -61,9 +61,6 @@
 
 #include "et1310_address_map.h"
 
-#define TRUEPHY_SUCCESS 0
-#define TRUEPHY_FAILURE 1
-
 /* MI Register Addresses */
 #define MI_CONTROL_REG                      0
 #define MI_STATUS_REG                       1
@@ -742,25 +739,15 @@ typedef union _MI_LCR2_t {
 /* Forward declaration of the private adapter structure */
 struct et131x_adapter;
 
-/* OS Specific Functions*/
-void TPAL_SetPhy10HalfDuplex(struct et131x_adapter *adapter);
-void TPAL_SetPhy10FullDuplex(struct et131x_adapter *adapter);
-void TPAL_SetPhy10Force(struct et131x_adapter *pAdapter);
-void TPAL_SetPhy100HalfDuplex(struct et131x_adapter *adapter);
-void TPAL_SetPhy100FullDuplex(struct et131x_adapter *adapter);
-void TPAL_SetPhy100Force(struct et131x_adapter *pAdapter);
-void TPAL_SetPhy1000FullDuplex(struct et131x_adapter *adapter);
-void TPAL_SetPhyAutoNeg(struct et131x_adapter *adapter);
-
 /* Prototypes for ET1310_phy.c */
 int et131x_xcvr_find(struct et131x_adapter *adapter);
-int et131x_setphy_normal(struct et131x_adapter *adapter);
-int32_t PhyMiRead(struct et131x_adapter *adapter,
-	       u8 xcvrAddr, u8 xcvrReg, u16 *value);
+void et131x_setphy_normal(struct et131x_adapter *adapter);
 
 /* static inline function does not work because et131x_adapter is not always
  * defined
  */
+int PhyMiRead(struct et131x_adapter *adapter, u8 xcvrAddr,
+	      u8 xcvrReg, u16 *value);
 #define MiRead(adapter, xcvrReg, value) \
 	PhyMiRead((adapter), (adapter)->Stats.xcvr_addr, (xcvrReg), (value))
 
@@ -860,24 +847,8 @@ void SetPhy_10BaseTHalfDuplex(struct et131x_adapter *adapter);
 void ET1310_PhyInit(struct et131x_adapter *adapter);
 void ET1310_PhyReset(struct et131x_adapter *adapter);
 void ET1310_PhyPowerDown(struct et131x_adapter *adapter, bool down);
-void ET1310_PhyAutoNeg(struct et131x_adapter *adapter, bool enable);
-void ET1310_PhyDuplexMode(struct et131x_adapter *adapter, u16 duplex);
-void ET1310_PhySpeedSelect(struct et131x_adapter *adapter, u16 speed);
 void ET1310_PhyAdvertise1000BaseT(struct et131x_adapter *adapter,
 				  u16 duplex);
-void ET1310_PhyAdvertise100BaseT(struct et131x_adapter *adapter,
-				 u16 duplex);
-void ET1310_PhyAdvertise10BaseT(struct et131x_adapter *adapter,
-				u16 duplex);
-void ET1310_PhyLinkStatus(struct et131x_adapter *adapter,
-			  u8 *Link_status,
-			  u32 *autoneg,
-			  u32 *linkspeed,
-			  u32 *duplex_mode,
-			  u32 *mdi_mdix,
-			  u32 *masterslave, u32 *polarity);
-void ET1310_PhyAndOrReg(struct et131x_adapter *adapter,
-			u16 regnum, u16 andMask, u16 orMask);
 void ET1310_PhyAccessMiBit(struct et131x_adapter *adapter,
 			   u16 action,
 			   u16 regnum, u16 bitnum, u8 *value);
diff --git a/drivers/staging/et131x/et1310_rx.c b/drivers/staging/et131x/et1310_rx.c
index 10e21db57ac3..81c1a7478ad6 100644
--- a/drivers/staging/et131x/et1310_rx.c
+++ b/drivers/staging/et131x/et1310_rx.c
@@ -106,9 +106,9 @@ void nic_return_rfd(struct et131x_adapter *etdev, PMP_RFD pMpRfd);
  */
 int et131x_rx_dma_memory_alloc(struct et131x_adapter *adapter)
 {
-	uint32_t OuterLoop, InnerLoop;
-	uint32_t bufsize;
-	uint32_t pktStatRingSize, FBRChunkSize;
+	u32 i, j;
+	u32 bufsize;
+	u32 pktStatRingSize, FBRChunkSize;
 	RX_RING_t *rx_ring;
 
 	/* Setup some convenience pointers */
@@ -227,11 +227,11 @@ int et131x_rx_dma_memory_alloc(struct et131x_adapter *adapter)
 					rx_ring->Fbr0offset);
 #endif
 
-	for (OuterLoop = 0; OuterLoop < (rx_ring->Fbr1NumEntries / FBR_CHUNKS);
-	     OuterLoop++) {
-		uint64_t Fbr1Offset;
-		uint64_t Fbr1TempPa;
-		uint32_t Fbr1Align;
+	for (i = 0; i < (rx_ring->Fbr1NumEntries / FBR_CHUNKS);
+	     i++) {
+		u64 Fbr1Offset;
+		u64 Fbr1TempPa;
+		u32 Fbr1Align;
 
 		/* This code allocates an area of memory big enough for N
 		 * free buffers + (buffer_size - 1) so that the buffers can
@@ -247,39 +247,39 @@ int et131x_rx_dma_memory_alloc(struct et131x_adapter *adapter)
 
 		FBRChunkSize =
 		    (FBR_CHUNKS * rx_ring->Fbr1BufferSize) + Fbr1Align - 1;
-		rx_ring->Fbr1MemVa[OuterLoop] =
+		rx_ring->Fbr1MemVa[i] =
 		    pci_alloc_consistent(adapter->pdev, FBRChunkSize,
-					 &rx_ring->Fbr1MemPa[OuterLoop]);
+					 &rx_ring->Fbr1MemPa[i]);
 
-		if (!rx_ring->Fbr1MemVa[OuterLoop]) {
+		if (!rx_ring->Fbr1MemVa[i]) {
 		dev_err(&adapter->pdev->dev,
 				"Could not alloc memory\n");
 			return -ENOMEM;
 		}
 
 		/* See NOTE in "Save Physical Address" comment above */
-		Fbr1TempPa = rx_ring->Fbr1MemPa[OuterLoop];
+		Fbr1TempPa = rx_ring->Fbr1MemPa[i];
 
 		et131x_align_allocated_memory(adapter,
 					      &Fbr1TempPa,
 					      &Fbr1Offset, (Fbr1Align - 1));
 
-		for (InnerLoop = 0; InnerLoop < FBR_CHUNKS; InnerLoop++) {
-			uint32_t index = (OuterLoop * FBR_CHUNKS) + InnerLoop;
+		for (j = 0; j < FBR_CHUNKS; j++) {
+			u32 index = (i * FBR_CHUNKS) + j;
 
 			/* Save the Virtual address of this index for quick
 			 * access later
 			 */
 			rx_ring->Fbr[1]->Va[index] =
-			    (uint8_t *) rx_ring->Fbr1MemVa[OuterLoop] +
-			    (InnerLoop * rx_ring->Fbr1BufferSize) + Fbr1Offset;
+			    (uint8_t *) rx_ring->Fbr1MemVa[i] +
+			    (j * rx_ring->Fbr1BufferSize) + Fbr1Offset;
 
 			/* now store the physical address in the descriptor
 			 * so the device can access it
 			 */
 			rx_ring->Fbr[1]->PAHigh[index] =
-			    (uint32_t) (Fbr1TempPa >> 32);
-			rx_ring->Fbr[1]->PALow[index] = (uint32_t) Fbr1TempPa;
+			    (u32) (Fbr1TempPa >> 32);
+			rx_ring->Fbr[1]->PALow[index] = (u32) Fbr1TempPa;
 
 			Fbr1TempPa += rx_ring->Fbr1BufferSize;
 
@@ -292,40 +292,40 @@ int et131x_rx_dma_memory_alloc(struct et131x_adapter *adapter)
 
 #ifdef USE_FBR0
 	/* Same for FBR0 (if in use) */
-	for (OuterLoop = 0; OuterLoop < (rx_ring->Fbr0NumEntries / FBR_CHUNKS);
-	     OuterLoop++) {
-		uint64_t Fbr0Offset;
-		uint64_t Fbr0TempPa;
+	for (i = 0; i < (rx_ring->Fbr0NumEntries / FBR_CHUNKS);
+	     i++) {
+		u64 Fbr0Offset;
+		u64 Fbr0TempPa;
 
 		FBRChunkSize = ((FBR_CHUNKS + 1) * rx_ring->Fbr0BufferSize) - 1;
-		rx_ring->Fbr0MemVa[OuterLoop] =
+		rx_ring->Fbr0MemVa[i] =
 		    pci_alloc_consistent(adapter->pdev, FBRChunkSize,
-					 &rx_ring->Fbr0MemPa[OuterLoop]);
+					 &rx_ring->Fbr0MemPa[i]);
 
-		if (!rx_ring->Fbr0MemVa[OuterLoop]) {
+		if (!rx_ring->Fbr0MemVa[i]) {
 			dev_err(&adapter->pdev->dev,
 				"Could not alloc memory\n");
 			return -ENOMEM;
 		}
 
 		/* See NOTE in "Save Physical Address" comment above */
-		Fbr0TempPa = rx_ring->Fbr0MemPa[OuterLoop];
+		Fbr0TempPa = rx_ring->Fbr0MemPa[i];
 
 		et131x_align_allocated_memory(adapter,
 					      &Fbr0TempPa,
 					      &Fbr0Offset,
 					      rx_ring->Fbr0BufferSize - 1);
 
-		for (InnerLoop = 0; InnerLoop < FBR_CHUNKS; InnerLoop++) {
-			uint32_t index = (OuterLoop * FBR_CHUNKS) + InnerLoop;
+		for (j = 0; j < FBR_CHUNKS; j++) {
+			u32 index = (i * FBR_CHUNKS) + j;
 
 			rx_ring->Fbr[0]->Va[index] =
-			    (uint8_t *) rx_ring->Fbr0MemVa[OuterLoop] +
-			    (InnerLoop * rx_ring->Fbr0BufferSize) + Fbr0Offset;
+			    (uint8_t *) rx_ring->Fbr0MemVa[i] +
+			    (j * rx_ring->Fbr0BufferSize) + Fbr0Offset;
 
 			rx_ring->Fbr[0]->PAHigh[index] =
-			    (uint32_t) (Fbr0TempPa >> 32);
-			rx_ring->Fbr[0]->PALow[index] = (uint32_t) Fbr0TempPa;
+			    (u32) (Fbr0TempPa >> 32);
+			rx_ring->Fbr[0]->PALow[index] = (u32) Fbr0TempPa;
 
 			Fbr0TempPa += rx_ring->Fbr0BufferSize;
 
@@ -342,7 +342,7 @@ int et131x_rx_dma_memory_alloc(struct et131x_adapter *adapter)
 	    sizeof(PKT_STAT_DESC_t) * adapter->RxRing.PsrNumEntries;
 
 	rx_ring->pPSRingVa = pci_alloc_consistent(adapter->pdev,
-						  pktStatRingSize + 0x0fff,
+						  pktStatRingSize,
 						  &rx_ring->pPSRingPa);
 
 	if (!rx_ring->pPSRingVa) {
@@ -350,45 +350,26 @@ int et131x_rx_dma_memory_alloc(struct et131x_adapter *adapter)
 			  "Cannot alloc memory for Packet Status Ring\n");
 		return -ENOMEM;
 	}
+	printk("PSR %lx\n", (unsigned long) rx_ring->pPSRingPa);
 
-	/* Save physical address
-	 *
+	/*
 	 * NOTE : pci_alloc_consistent(), used above to alloc DMA regions,
 	 * ALWAYS returns SAC (32-bit) addresses. If DAC (64-bit) addresses
 	 * are ever returned, make sure the high part is retrieved here before
 	 * storing the adjusted address.
 	 */
-	rx_ring->pPSRingRealPa = rx_ring->pPSRingPa;
-
-	/* Align Packet Status Ring on a 4K boundary */
-	et131x_align_allocated_memory(adapter,
-				      &rx_ring->pPSRingRealPa,
-				      &rx_ring->pPSRingOffset, 0x0FFF);
-
-	rx_ring->pPSRingVa = (void *)((uint8_t *) rx_ring->pPSRingVa +
-				      rx_ring->pPSRingOffset);
 
 	/* Allocate an area of memory for writeback of status information */
 	rx_ring->pRxStatusVa = pci_alloc_consistent(adapter->pdev,
-						    sizeof(RX_STATUS_BLOCK_t) +
-						    0x7, &rx_ring->pRxStatusPa);
+						    sizeof(RX_STATUS_BLOCK_t),
+						    &rx_ring->pRxStatusPa);
 	if (!rx_ring->pRxStatusVa) {
 		dev_err(&adapter->pdev->dev,
 			  "Cannot alloc memory for Status Block\n");
 		return -ENOMEM;
 	}
-
-	/* Save physical address */
-	rx_ring->RxStatusRealPA = rx_ring->pRxStatusPa;
-
-	/* Align write back on an 8 byte boundary */
-	et131x_align_allocated_memory(adapter,
-				      &rx_ring->RxStatusRealPA,
-				      &rx_ring->RxStatusOffset, 0x07);
-
-	rx_ring->pRxStatusVa = (void *)((uint8_t *) rx_ring->pRxStatusVa +
-					rx_ring->RxStatusOffset);
 	rx_ring->NumRfd = NIC_DEFAULT_NUM_RFD;
+	printk("PRS %lx\n", (unsigned long)rx_ring->pRxStatusPa);
 
 	/* Recv
 	 * pci_pool_create initializes a lookaside list. After successful
@@ -409,7 +390,6 @@ int et131x_rx_dma_memory_alloc(struct et131x_adapter *adapter)
 	 * lists now.
 	 */
 	INIT_LIST_HEAD(&rx_ring->RecvList);
-	INIT_LIST_HEAD(&rx_ring->RecvPendingList);
 	return 0;
 }
 
@@ -419,10 +399,10 @@ int et131x_rx_dma_memory_alloc(struct et131x_adapter *adapter)
  */
 void et131x_rx_dma_memory_free(struct et131x_adapter *adapter)
 {
-	uint32_t index;
-	uint32_t bufsize;
-	uint32_t pktStatRingSize;
-	PMP_RFD pMpRfd;
+	u32 index;
+	u32 bufsize;
+	u32 pktStatRingSize;
+	PMP_RFD rfd;
 	RX_RING_t *rx_ring;
 
 	/* Setup some convenience pointers */
@@ -432,18 +412,12 @@ void et131x_rx_dma_memory_free(struct et131x_adapter *adapter)
 	WARN_ON(rx_ring->nReadyRecv != rx_ring->NumRfd);
 
 	while (!list_empty(&rx_ring->RecvList)) {
-		pMpRfd = (MP_RFD *) list_entry(rx_ring->RecvList.next,
+		rfd = (MP_RFD *) list_entry(rx_ring->RecvList.next,
 					       MP_RFD, list_node);
 
-		list_del(&pMpRfd->list_node);
-		et131x_rfd_resources_free(adapter, pMpRfd);
-	}
-
-	while (!list_empty(&rx_ring->RecvPendingList)) {
-		pMpRfd = (MP_RFD *) list_entry(rx_ring->RecvPendingList.next,
-					       MP_RFD, list_node);
-		list_del(&pMpRfd->list_node);
-		et131x_rfd_resources_free(adapter, pMpRfd);
+		list_del(&rfd->list_node);
+		rfd->Packet = NULL;
+		kmem_cache_free(adapter->RxRing.RecvLookaside, rfd);
 	}
 
 	/* Free Free Buffer Ring 1 */
@@ -452,7 +426,7 @@ void et131x_rx_dma_memory_free(struct et131x_adapter *adapter)
 		for (index = 0; index <
 		     (rx_ring->Fbr1NumEntries / FBR_CHUNKS); index++) {
 			if (rx_ring->Fbr1MemVa[index]) {
-				uint32_t Fbr1Align;
+				u32 Fbr1Align;
 
 				if (rx_ring->Fbr1BufferSize > 4096)
 					Fbr1Align = 4096;
@@ -523,14 +497,10 @@ void et131x_rx_dma_memory_free(struct et131x_adapter *adapter)
 
 	/* Free Packet Status Ring */
 	if (rx_ring->pPSRingVa) {
-		rx_ring->pPSRingVa = (void *)((uint8_t *) rx_ring->pPSRingVa -
-					      rx_ring->pPSRingOffset);
-
 		pktStatRingSize =
 		    sizeof(PKT_STAT_DESC_t) * adapter->RxRing.PsrNumEntries;
 
-		pci_free_consistent(adapter->pdev,
-				    pktStatRingSize + 0x0fff,
+		pci_free_consistent(adapter->pdev, pktStatRingSize,
 				    rx_ring->pPSRingVa, rx_ring->pPSRingPa);
 
 		rx_ring->pPSRingVa = NULL;
@@ -538,11 +508,8 @@ void et131x_rx_dma_memory_free(struct et131x_adapter *adapter)
 
 	/* Free area of memory for the writeback of status information */
 	if (rx_ring->pRxStatusVa) {
-		rx_ring->pRxStatusVa = (void *)((uint8_t *)
-				rx_ring->pRxStatusVa - rx_ring->RxStatusOffset);
-
 		pci_free_consistent(adapter->pdev,
-				sizeof(RX_STATUS_BLOCK_t) + 0x7,
+				sizeof(RX_STATUS_BLOCK_t),
 				rx_ring->pRxStatusVa, rx_ring->pRxStatusPa);
 
 		rx_ring->pRxStatusVa = NULL;
@@ -578,49 +545,43 @@ void et131x_rx_dma_memory_free(struct et131x_adapter *adapter)
 int et131x_init_recv(struct et131x_adapter *adapter)
 {
 	int status = -ENOMEM;
-	PMP_RFD pMpRfd = NULL;
-	uint32_t RfdCount;
-	uint32_t TotalNumRfd = 0;
+	PMP_RFD rfd = NULL;
+	u32 rfdct;
+	u32 numrfd = 0;
 	RX_RING_t *rx_ring = NULL;
 
 	/* Setup some convenience pointers */
 	rx_ring = (RX_RING_t *) &adapter->RxRing;
 
 	/* Setup each RFD */
-	for (RfdCount = 0; RfdCount < rx_ring->NumRfd; RfdCount++) {
-		pMpRfd = (MP_RFD *) kmem_cache_alloc(rx_ring->RecvLookaside,
+	for (rfdct = 0; rfdct < rx_ring->NumRfd; rfdct++) {
+		rfd = (MP_RFD *) kmem_cache_alloc(rx_ring->RecvLookaside,
 						     GFP_ATOMIC | GFP_DMA);
 
-		if (!pMpRfd) {
+		if (!rfd) {
 			dev_err(&adapter->pdev->dev,
 				  "Couldn't alloc RFD out of kmem_cache\n");
 			status = -ENOMEM;
 			continue;
 		}
 
-		status = et131x_rfd_resources_alloc(adapter, pMpRfd);
-		if (status != 0) {
-			dev_err(&adapter->pdev->dev,
-				  "Couldn't alloc packet for RFD\n");
-			kmem_cache_free(rx_ring->RecvLookaside, pMpRfd);
-			continue;
-		}
+		rfd->Packet = NULL;
 
 		/* Add this RFD to the RecvList */
-		list_add_tail(&pMpRfd->list_node, &rx_ring->RecvList);
+		list_add_tail(&rfd->list_node, &rx_ring->RecvList);
 
 		/* Increment both the available RFD's, and the total RFD's. */
 		rx_ring->nReadyRecv++;
-		TotalNumRfd++;
+		numrfd++;
 	}
 
-	if (TotalNumRfd > NIC_MIN_NUM_RFD)
+	if (numrfd > NIC_MIN_NUM_RFD)
 		status = 0;
 
-	rx_ring->NumRfd = TotalNumRfd;
+	rx_ring->NumRfd = numrfd;
 
 	if (status != 0) {
-		kmem_cache_free(rx_ring->RecvLookaside, pMpRfd);
+		kmem_cache_free(rx_ring->RecvLookaside, rfd);
 		dev_err(&adapter->pdev->dev,
 			  "Allocation problems in et131x_init_recv\n");
 	}
@@ -628,41 +589,16 @@ int et131x_init_recv(struct et131x_adapter *adapter)
 }
 
 /**
- * et131x_rfd_resources_alloc
- * @adapter: pointer to our private adapter structure
- * @pMpRfd: pointer to a RFD
- *
- * Returns 0 on success and errno on failure (as defined in errno.h)
- */
-int et131x_rfd_resources_alloc(struct et131x_adapter *adapter, MP_RFD *pMpRfd)
-{
-	pMpRfd->Packet = NULL;
-
-	return 0;
-}
-
-/**
- * et131x_rfd_resources_free - Free the packet allocated for the given RFD
- * @adapter: pointer to our private adapter structure
- * @pMpRfd: pointer to a RFD
- */
-void et131x_rfd_resources_free(struct et131x_adapter *adapter, MP_RFD *pMpRfd)
-{
-	pMpRfd->Packet = NULL;
-	kmem_cache_free(adapter->RxRing.RecvLookaside, pMpRfd);
-}
-
-/**
  * ConfigRxDmaRegs - Start of Rx_DMA init sequence
  * @etdev: pointer to our adapter structure
  */
 void ConfigRxDmaRegs(struct et131x_adapter *etdev)
 {
 	struct _RXDMA_t __iomem *rx_dma = &etdev->regs->rxdma;
-	struct _rx_ring_t *pRxLocal = &etdev->RxRing;
+	struct _rx_ring_t *rx_local = &etdev->RxRing;
 	PFBR_DESC_t fbr_entry;
-	uint32_t entry;
-	RXDMA_PSR_NUM_DES_t psr_num_des;
+	u32 entry;
+	u32 psr_num_des;
 	unsigned long flags;
 
 	/* Halt RXDMA to perform the reconfigure.  */
@@ -675,36 +611,35 @@ void ConfigRxDmaRegs(struct et131x_adapter *etdev)
 	 * are ever returned, make sure the high part is retrieved here
 	 * before storing the adjusted address.
 	 */
-	writel((uint32_t) (pRxLocal->RxStatusRealPA >> 32),
+	writel((u32) ((u64)rx_local->pRxStatusPa >> 32),
 	       &rx_dma->dma_wb_base_hi);
-	writel((uint32_t) pRxLocal->RxStatusRealPA, &rx_dma->dma_wb_base_lo);
+	writel((u32) rx_local->pRxStatusPa, &rx_dma->dma_wb_base_lo);
 
-	memset(pRxLocal->pRxStatusVa, 0, sizeof(RX_STATUS_BLOCK_t));
+	memset(rx_local->pRxStatusVa, 0, sizeof(RX_STATUS_BLOCK_t));
 
 	/* Set the address and parameters of the packet status ring into the
 	 * 1310's registers
 	 */
-	writel((uint32_t) (pRxLocal->pPSRingRealPa >> 32),
+	writel((u32) ((u64)rx_local->pPSRingPa >> 32),
 	       &rx_dma->psr_base_hi);
-	writel((uint32_t) pRxLocal->pPSRingRealPa, &rx_dma->psr_base_lo);
-	writel(pRxLocal->PsrNumEntries - 1, &rx_dma->psr_num_des.value);
-	writel(0, &rx_dma->psr_full_offset.value);
+	writel((u32) rx_local->pPSRingPa, &rx_dma->psr_base_lo);
+	writel(rx_local->PsrNumEntries - 1, &rx_dma->psr_num_des);
+	writel(0, &rx_dma->psr_full_offset);
 
-	psr_num_des.value = readl(&rx_dma->psr_num_des.value);
-	writel((psr_num_des.bits.psr_ndes * LO_MARK_PERCENT_FOR_PSR) / 100,
-	       &rx_dma->psr_min_des.value);
+	psr_num_des = readl(&rx_dma->psr_num_des) & 0xFFF;
+	writel((psr_num_des * LO_MARK_PERCENT_FOR_PSR) / 100,
+	       &rx_dma->psr_min_des);
 
 	spin_lock_irqsave(&etdev->RcvLock, flags);
 
 	/* These local variables track the PSR in the adapter structure */
-	pRxLocal->local_psr_full.bits.psr_full = 0;
-	pRxLocal->local_psr_full.bits.psr_full_wrap = 0;
+	rx_local->local_psr_full = 0;
 
 	/* Now's the best time to initialize FBR1 contents */
-	fbr_entry = (PFBR_DESC_t) pRxLocal->pFbr1RingVa;
-	for (entry = 0; entry < pRxLocal->Fbr1NumEntries; entry++) {
-		fbr_entry->addr_hi = pRxLocal->Fbr[1]->PAHigh[entry];
-		fbr_entry->addr_lo = pRxLocal->Fbr[1]->PALow[entry];
+	fbr_entry = (PFBR_DESC_t) rx_local->pFbr1RingVa;
+	for (entry = 0; entry < rx_local->Fbr1NumEntries; entry++) {
+		fbr_entry->addr_hi = rx_local->Fbr[1]->PAHigh[entry];
+		fbr_entry->addr_lo = rx_local->Fbr[1]->PALow[entry];
 		fbr_entry->word2.bits.bi = entry;
 		fbr_entry++;
 	}
@@ -712,39 +647,39 @@ void ConfigRxDmaRegs(struct et131x_adapter *etdev)
 	/* Set the address and parameters of Free buffer ring 1 (and 0 if
 	 * required) into the 1310's registers
 	 */
-	writel((uint32_t) (pRxLocal->Fbr1Realpa >> 32), &rx_dma->fbr1_base_hi);
-	writel((uint32_t) pRxLocal->Fbr1Realpa, &rx_dma->fbr1_base_lo);
-	writel(pRxLocal->Fbr1NumEntries - 1, &rx_dma->fbr1_num_des.value);
+	writel((u32) (rx_local->Fbr1Realpa >> 32), &rx_dma->fbr1_base_hi);
+	writel((u32) rx_local->Fbr1Realpa, &rx_dma->fbr1_base_lo);
+	writel(rx_local->Fbr1NumEntries - 1, &rx_dma->fbr1_num_des);
 	writel(ET_DMA10_WRAP, &rx_dma->fbr1_full_offset);
 
 	/* This variable tracks the free buffer ring 1 full position, so it
 	 * has to match the above.
 	 */
-	pRxLocal->local_Fbr1_full = ET_DMA10_WRAP;
-	writel(((pRxLocal->Fbr1NumEntries * LO_MARK_PERCENT_FOR_RX) / 100) - 1,
-	       &rx_dma->fbr1_min_des.value);
+	rx_local->local_Fbr1_full = ET_DMA10_WRAP;
+	writel(((rx_local->Fbr1NumEntries * LO_MARK_PERCENT_FOR_RX) / 100) - 1,
+	       &rx_dma->fbr1_min_des);
 
 #ifdef USE_FBR0
 	/* Now's the best time to initialize FBR0 contents */
-	fbr_entry = (PFBR_DESC_t) pRxLocal->pFbr0RingVa;
-	for (entry = 0; entry < pRxLocal->Fbr0NumEntries; entry++) {
-		fbr_entry->addr_hi = pRxLocal->Fbr[0]->PAHigh[entry];
-		fbr_entry->addr_lo = pRxLocal->Fbr[0]->PALow[entry];
+	fbr_entry = (PFBR_DESC_t) rx_local->pFbr0RingVa;
+	for (entry = 0; entry < rx_local->Fbr0NumEntries; entry++) {
+		fbr_entry->addr_hi = rx_local->Fbr[0]->PAHigh[entry];
+		fbr_entry->addr_lo = rx_local->Fbr[0]->PALow[entry];
 		fbr_entry->word2.bits.bi = entry;
 		fbr_entry++;
 	}
 
-	writel((uint32_t) (pRxLocal->Fbr0Realpa >> 32), &rx_dma->fbr0_base_hi);
-	writel((uint32_t) pRxLocal->Fbr0Realpa, &rx_dma->fbr0_base_lo);
-	writel(pRxLocal->Fbr0NumEntries - 1, &rx_dma->fbr0_num_des.value);
+	writel((u32) (rx_local->Fbr0Realpa >> 32), &rx_dma->fbr0_base_hi);
+	writel((u32) rx_local->Fbr0Realpa, &rx_dma->fbr0_base_lo);
+	writel(rx_local->Fbr0NumEntries - 1, &rx_dma->fbr0_num_des);
 	writel(ET_DMA10_WRAP, &rx_dma->fbr0_full_offset);
 
 	/* This variable tracks the free buffer ring 0 full position, so it
 	 * has to match the above.
 	 */
-	pRxLocal->local_Fbr0_full = ET_DMA10_WRAP;
-	writel(((pRxLocal->Fbr0NumEntries * LO_MARK_PERCENT_FOR_RX) / 100) - 1,
-	       &rx_dma->fbr0_min_des.value);
+	rx_local->local_Fbr0_full = ET_DMA10_WRAP;
+	writel(((rx_local->Fbr0NumEntries * LO_MARK_PERCENT_FOR_RX) / 100) - 1,
+	       &rx_dma->fbr0_min_des);
 #endif
 
 	/* Program the number of packets we will receive before generating an
@@ -752,14 +687,14 @@ void ConfigRxDmaRegs(struct et131x_adapter *etdev)
 	 * For version B silicon, this value gets updated once autoneg is
 	 *complete.
 	 */
-	writel(PARM_RX_NUM_BUFS_DEF, &rx_dma->num_pkt_done.value);
+	writel(PARM_RX_NUM_BUFS_DEF, &rx_dma->num_pkt_done);
 
 	/* The "time_done" is not working correctly to coalesce interrupts
 	 * after a given time period, but rather is giving us an interrupt
 	 * regardless of whether we have received packets.
 	 * This value gets updated once autoneg is complete.
 	 */
-	writel(PARM_RX_TIME_INT_DEF, &rx_dma->max_pkt_time.value);
+	writel(PARM_RX_TIME_INT_DEF, &rx_dma->max_pkt_time);
 
 	spin_unlock_irqrestore(&etdev->RcvLock, flags);
 }
@@ -775,8 +710,8 @@ void SetRxDmaTimer(struct et131x_adapter *etdev)
 	 */
 	if ((etdev->linkspeed == TRUEPHY_SPEED_100MBPS) ||
 	    (etdev->linkspeed == TRUEPHY_SPEED_10MBPS)) {
-		writel(0, &etdev->regs->rxdma.max_pkt_time.value);
-		writel(1, &etdev->regs->rxdma.num_pkt_done.value);
+		writel(0, &etdev->regs->rxdma.max_pkt_time);
+		writel(1, &etdev->regs->rxdma.num_pkt_done);
 	}
 }
 
@@ -807,40 +742,35 @@ void et131x_rx_dma_disable(struct et131x_adapter *etdev)
  */
 void et131x_rx_dma_enable(struct et131x_adapter *etdev)
 {
-	if (etdev->RegistryPhyLoopbk)
-		/* RxDMA is disabled for loopback operation. */
-		writel(0x1, &etdev->regs->rxdma.csr.value);
-	else {
 	/* Setup the receive dma configuration register for normal operation */
-		RXDMA_CSR_t csr = { 0 };
-
-		csr.bits.fbr1_enable = 1;
-		if (etdev->RxRing.Fbr1BufferSize == 4096)
-			csr.bits.fbr1_size = 1;
-		else if (etdev->RxRing.Fbr1BufferSize == 8192)
-			csr.bits.fbr1_size = 2;
-		else if (etdev->RxRing.Fbr1BufferSize == 16384)
-			csr.bits.fbr1_size = 3;
+	RXDMA_CSR_t csr = { 0 };
+
+	csr.bits.fbr1_enable = 1;
+	if (etdev->RxRing.Fbr1BufferSize == 4096)
+		csr.bits.fbr1_size = 1;
+	else if (etdev->RxRing.Fbr1BufferSize == 8192)
+		csr.bits.fbr1_size = 2;
+	else if (etdev->RxRing.Fbr1BufferSize == 16384)
+		csr.bits.fbr1_size = 3;
 #ifdef USE_FBR0
-		csr.bits.fbr0_enable = 1;
-		if (etdev->RxRing.Fbr0BufferSize == 256)
-			csr.bits.fbr0_size = 1;
-		else if (etdev->RxRing.Fbr0BufferSize == 512)
-			csr.bits.fbr0_size = 2;
-		else if (etdev->RxRing.Fbr0BufferSize == 1024)
-			csr.bits.fbr0_size = 3;
+	csr.bits.fbr0_enable = 1;
+	if (etdev->RxRing.Fbr0BufferSize == 256)
+		csr.bits.fbr0_size = 1;
+	else if (etdev->RxRing.Fbr0BufferSize == 512)
+		csr.bits.fbr0_size = 2;
+	else if (etdev->RxRing.Fbr0BufferSize == 1024)
+		csr.bits.fbr0_size = 3;
 #endif
-		writel(csr.value, &etdev->regs->rxdma.csr.value);
+	writel(csr.value, &etdev->regs->rxdma.csr.value);
 
+	csr.value = readl(&etdev->regs->rxdma.csr.value);
+	if (csr.bits.halt_status != 0) {
+		udelay(5);
 		csr.value = readl(&etdev->regs->rxdma.csr.value);
 		if (csr.bits.halt_status != 0) {
-			udelay(5);
-			csr.value = readl(&etdev->regs->rxdma.csr.value);
-			if (csr.bits.halt_status != 0) {
-				dev_err(&etdev->pdev->dev,
-					"RX Dma failed to exit halt state.  CSR 0x%08x\n",
-					csr.value);
-			}
+			dev_err(&etdev->pdev->dev,
+			    "RX Dma failed to exit halt state.  CSR 0x%08x\n",
+				csr.value);
 		}
 	}
 }
@@ -849,7 +779,7 @@ void et131x_rx_dma_enable(struct et131x_adapter *etdev)
  * nic_rx_pkts - Checks the hardware for available packets
  * @etdev: pointer to our adapter
  *
- * Returns pMpRfd, a pointer to our MPRFD.
+ * Returns rfd, a pointer to our MPRFD.
  *
  * Checks the hardware for available packets, using completion ring
  * If packets are available, it gets an RFD from the RecvList, attaches
@@ -858,119 +788,122 @@ void et131x_rx_dma_enable(struct et131x_adapter *etdev)
  */
 PMP_RFD nic_rx_pkts(struct et131x_adapter *etdev)
 {
-	struct _rx_ring_t *pRxLocal = &etdev->RxRing;
-	PRX_STATUS_BLOCK_t pRxStatusBlock;
-	PPKT_STAT_DESC_t pPSREntry;
-	PMP_RFD pMpRfd;
-	uint32_t nIndex;
-	uint8_t *pBufVa;
+	struct _rx_ring_t *rx_local = &etdev->RxRing;
+	PRX_STATUS_BLOCK_t status;
+	PPKT_STAT_DESC_t psr;
+	PMP_RFD rfd;
+	u32 i;
+	uint8_t *buf;
 	unsigned long flags;
 	struct list_head *element;
-	uint8_t ringIndex;
-	uint16_t bufferIndex;
-	uint32_t localLen;
+	uint8_t rindex;
+	uint16_t bindex;
+	u32 len;
 	PKT_STAT_DESC_WORD0_t Word0;
 
 	/* RX Status block is written by the DMA engine prior to every
 	 * interrupt. It contains the next to be used entry in the Packet
 	 * Status Ring, and also the two Free Buffer rings.
 	 */
-	pRxStatusBlock = (PRX_STATUS_BLOCK_t) pRxLocal->pRxStatusVa;
+	status = (PRX_STATUS_BLOCK_t) rx_local->pRxStatusVa;
 
-	if (pRxStatusBlock->Word1.bits.PSRoffset ==
-			pRxLocal->local_psr_full.bits.psr_full &&
-			pRxStatusBlock->Word1.bits.PSRwrap ==
-			pRxLocal->local_psr_full.bits.psr_full_wrap) {
+	/* FIXME: tidy later when conversions complete */
+	if (status->Word1.bits.PSRoffset ==
+			(rx_local->local_psr_full & 0xFFF) &&
+			status->Word1.bits.PSRwrap ==
+			((rx_local->local_psr_full >> 12) & 1)) {
 		/* Looks like this ring is not updated yet */
 		return NULL;
 	}
 
 	/* The packet status ring indicates that data is available. */
-	pPSREntry = (PPKT_STAT_DESC_t) (pRxLocal->pPSRingVa) +
-			pRxLocal->local_psr_full.bits.psr_full;
+	psr = (PPKT_STAT_DESC_t) (rx_local->pPSRingVa) +
+			(rx_local->local_psr_full & 0xFFF);
 
 	/* Grab any information that is required once the PSR is
 	 * advanced, since we can no longer rely on the memory being
 	 * accurate
 	 */
-	localLen = pPSREntry->word1.bits.length;
-	ringIndex = (uint8_t) pPSREntry->word1.bits.ri;
-	bufferIndex = (uint16_t) pPSREntry->word1.bits.bi;
-	Word0 = pPSREntry->word0;
+	len = psr->word1.bits.length;
+	rindex = (uint8_t) psr->word1.bits.ri;
+	bindex = (uint16_t) psr->word1.bits.bi;
+	Word0 = psr->word0;
 
 	/* Indicate that we have used this PSR entry. */
-	if (++pRxLocal->local_psr_full.bits.psr_full >
-	    pRxLocal->PsrNumEntries - 1) {
-		pRxLocal->local_psr_full.bits.psr_full = 0;
-		pRxLocal->local_psr_full.bits.psr_full_wrap ^= 1;
+	/* FIXME wrap 12 */
+	add_12bit(&rx_local->local_psr_full, 1);
+	if ((rx_local->local_psr_full & 0xFFF)  > rx_local->PsrNumEntries - 1) {
+		/* Clear psr full and toggle the wrap bit */
+		rx_local->local_psr_full &=  ~0xFFF;
+		rx_local->local_psr_full ^= 0x1000;
 	}
 
-	writel(pRxLocal->local_psr_full.value,
-	       &etdev->regs->rxdma.psr_full_offset.value);
+	writel(rx_local->local_psr_full,
+	       &etdev->regs->rxdma.psr_full_offset);
 
 #ifndef USE_FBR0
-	if (ringIndex != 1) {
+	if (rindex != 1) {
 		return NULL;
 	}
 #endif
 
 #ifdef USE_FBR0
-	if (ringIndex > 1 ||
-		(ringIndex == 0 &&
-		bufferIndex > pRxLocal->Fbr0NumEntries - 1) ||
-		(ringIndex == 1 &&
-		bufferIndex > pRxLocal->Fbr1NumEntries - 1))
+	if (rindex > 1 ||
+		(rindex == 0 &&
+		bindex > rx_local->Fbr0NumEntries - 1) ||
+		(rindex == 1 &&
+		bindex > rx_local->Fbr1NumEntries - 1))
 #else
-	if (ringIndex != 1 ||
-		bufferIndex > pRxLocal->Fbr1NumEntries - 1)
+	if (rindex != 1 ||
+		bindex > rx_local->Fbr1NumEntries - 1)
 #endif
 	{
 		/* Illegal buffer or ring index cannot be used by S/W*/
 		dev_err(&etdev->pdev->dev,
 			  "NICRxPkts PSR Entry %d indicates "
 			  "length of %d and/or bad bi(%d)\n",
-			  pRxLocal->local_psr_full.bits.psr_full,
-			  localLen, bufferIndex);
+			  rx_local->local_psr_full & 0xFFF,
+			  len, bindex);
 		return NULL;
 	}
 
 	/* Get and fill the RFD. */
 	spin_lock_irqsave(&etdev->RcvLock, flags);
 
-	pMpRfd = NULL;
-	element = pRxLocal->RecvList.next;
-	pMpRfd = (PMP_RFD) list_entry(element, MP_RFD, list_node);
+	rfd = NULL;
+	element = rx_local->RecvList.next;
+	rfd = (PMP_RFD) list_entry(element, MP_RFD, list_node);
 
-	if (pMpRfd == NULL) {
+	if (rfd == NULL) {
 		spin_unlock_irqrestore(&etdev->RcvLock, flags);
 		return NULL;
 	}
 
-	list_del(&pMpRfd->list_node);
-	pRxLocal->nReadyRecv--;
+	list_del(&rfd->list_node);
+	rx_local->nReadyRecv--;
 
 	spin_unlock_irqrestore(&etdev->RcvLock, flags);
 
-	pMpRfd->bufferindex = bufferIndex;
-	pMpRfd->ringindex = ringIndex;
+	rfd->bufferindex = bindex;
+	rfd->ringindex = rindex;
 
 	/* In V1 silicon, there is a bug which screws up filtering of
 	 * runt packets.  Therefore runt packet filtering is disabled
 	 * in the MAC and the packets are dropped here.  They are
 	 * also counted here.
 	 */
-	if (localLen < (NIC_MIN_PACKET_SIZE + 4)) {
+	if (len < (NIC_MIN_PACKET_SIZE + 4)) {
 		etdev->Stats.other_errors++;
-		localLen = 0;
+		len = 0;
 	}
 
-	if (localLen) {
+	if (len) {
 		if (etdev->ReplicaPhyLoopbk == 1) {
-			pBufVa = pRxLocal->Fbr[ringIndex]->Va[bufferIndex];
+			buf = rx_local->Fbr[rindex]->Va[bindex];
 
-			if (memcmp(&pBufVa[6], &etdev->CurrentAddress[0],
+			if (memcmp(&buf[6], &etdev->CurrentAddress[0],
 				   ETH_ALEN) == 0) {
-				if (memcmp(&pBufVa[42], "Replica packet",
+				if (memcmp(&buf[42], "Replica packet",
 					   ETH_HLEN)) {
 					etdev->ReplicaPhyLoopbkPF = 1;
 				}
@@ -990,28 +923,28 @@ PMP_RFD nic_rx_pkts(struct et131x_adapter *etdev)
 			if ((etdev->PacketFilter & ET131X_PACKET_TYPE_MULTICAST)
 			    && !(etdev->PacketFilter & ET131X_PACKET_TYPE_PROMISCUOUS)
 			    && !(etdev->PacketFilter & ET131X_PACKET_TYPE_ALL_MULTICAST)) {
-				pBufVa = pRxLocal->Fbr[ringIndex]->
-						Va[bufferIndex];
+				buf = rx_local->Fbr[rindex]->
+						Va[bindex];
 
 				/* Loop through our list to see if the
 				 * destination address of this packet
 				 * matches one in our list.
 				 */
-				for (nIndex = 0;
-				     nIndex < etdev->MCAddressCount;
-				     nIndex++) {
-					if (pBufVa[0] ==
-					    etdev->MCList[nIndex][0]
-					    && pBufVa[1] ==
-					    etdev->MCList[nIndex][1]
-					    && pBufVa[2] ==
-					    etdev->MCList[nIndex][2]
-					    && pBufVa[3] ==
-					    etdev->MCList[nIndex][3]
-					    && pBufVa[4] ==
-					    etdev->MCList[nIndex][4]
-					    && pBufVa[5] ==
-					    etdev->MCList[nIndex][5]) {
+				for (i = 0;
+				     i < etdev->MCAddressCount;
+				     i++) {
+					if (buf[0] ==
+					    etdev->MCList[i][0]
+					    && buf[1] ==
+					    etdev->MCList[i][1]
+					    && buf[2] ==
+					    etdev->MCList[i][2]
+					    && buf[3] ==
+					    etdev->MCList[i][3]
+					    && buf[4] ==
+					    etdev->MCList[i][4]
+					    && buf[5] ==
+					    etdev->MCList[i][5]) {
 						break;
 					}
 				}
@@ -1024,11 +957,11 @@ PMP_RFD nic_rx_pkts(struct et131x_adapter *etdev)
 				 * so we free our RFD when we return
 				 * from this function.
 				 */
-				if (nIndex == etdev->MCAddressCount)
-					localLen = 0;
+				if (i == etdev->MCAddressCount)
+					len = 0;
 			}
 
-			if (localLen > 0)
+			if (len > 0)
 				etdev->Stats.multircv++;
 		} else if (Word0.value & ALCATEL_BROADCAST_PKT)
 			etdev->Stats.brdcstrcv++;
@@ -1041,24 +974,24 @@ PMP_RFD nic_rx_pkts(struct et131x_adapter *etdev)
 			etdev->Stats.unircv++;
 	}
 
-	if (localLen > 0) {
+	if (len > 0) {
 		struct sk_buff *skb = NULL;
 
-		/* pMpRfd->PacketSize = localLen - 4; */
-		pMpRfd->PacketSize = localLen;
+		/* rfd->PacketSize = len - 4; */
+		rfd->PacketSize = len;
 
-		skb = dev_alloc_skb(pMpRfd->PacketSize + 2);
+		skb = dev_alloc_skb(rfd->PacketSize + 2);
 		if (!skb) {
 			dev_err(&etdev->pdev->dev,
 				  "Couldn't alloc an SKB for Rx\n");
 			return NULL;
 		}
 
-		etdev->net_stats.rx_bytes += pMpRfd->PacketSize;
+		etdev->net_stats.rx_bytes += rfd->PacketSize;
 
-		memcpy(skb_put(skb, pMpRfd->PacketSize),
-		       pRxLocal->Fbr[ringIndex]->Va[bufferIndex],
-		       pMpRfd->PacketSize);
+		memcpy(skb_put(skb, rfd->PacketSize),
+		       rx_local->Fbr[rindex]->Va[bindex],
+		       rfd->PacketSize);
 
 		skb->dev = etdev->netdev;
 		skb->protocol = eth_type_trans(skb, etdev->netdev);
@@ -1066,11 +999,11 @@ PMP_RFD nic_rx_pkts(struct et131x_adapter *etdev)
 
 		netif_rx(skb);
 	} else {
-		pMpRfd->PacketSize = 0;
+		rfd->PacketSize = 0;
 	}
 
-	nic_return_rfd(etdev, pMpRfd);
-	return pMpRfd;
+	nic_return_rfd(etdev, rfd);
+	return rfd;
 }
 
 /**
@@ -1081,21 +1014,8 @@ PMP_RFD nic_rx_pkts(struct et131x_adapter *etdev)
  */
 void et131x_reset_recv(struct et131x_adapter *etdev)
 {
-	PMP_RFD pMpRfd;
-	struct list_head *element;
-
 	WARN_ON(list_empty(&etdev->RxRing.RecvList));
 
-	/* Take all the RFD's from the pending list, and stick them on the
-	 * RecvList.
-	 */
-	while (!list_empty(&etdev->RxRing.RecvPendingList)) {
-		element = etdev->RxRing.RecvPendingList.next;
-
-		pMpRfd = (PMP_RFD) list_entry(element, MP_RFD, list_node);
-
-		list_move_tail(&pMpRfd->list_node, &etdev->RxRing.RecvList);
-	}
 }
 
 /**
@@ -1106,27 +1026,21 @@ void et131x_reset_recv(struct et131x_adapter *etdev)
  */
 void et131x_handle_recv_interrupt(struct et131x_adapter *etdev)
 {
-	PMP_RFD pMpRfd = NULL;
-	struct sk_buff *PacketArray[NUM_PACKETS_HANDLED];
-	PMP_RFD RFDFreeArray[NUM_PACKETS_HANDLED];
-	uint32_t PacketArrayCount = 0;
-	uint32_t PacketsToHandle;
-	uint32_t PacketFreeCount = 0;
-	bool TempUnfinishedRec = false;
-
-	PacketsToHandle = NUM_PACKETS_HANDLED;
+	PMP_RFD rfd = NULL;
+	u32 count = 0;
+	bool done = true;
 
 	/* Process up to available RFD's */
-	while (PacketArrayCount < PacketsToHandle) {
+	while (count < NUM_PACKETS_HANDLED) {
 		if (list_empty(&etdev->RxRing.RecvList)) {
 			WARN_ON(etdev->RxRing.nReadyRecv != 0);
-			TempUnfinishedRec = true;
+			done = false;
 			break;
 		}
 
-		pMpRfd = nic_rx_pkts(etdev);
+		rfd = nic_rx_pkts(etdev);
 
-		if (pMpRfd == NULL)
+		if (rfd == NULL)
 			break;
 
 		/* Do not receive any packets until a filter has been set.
@@ -1136,7 +1050,7 @@ void et131x_handle_recv_interrupt(struct et131x_adapter *etdev)
 		 */
 		if (!etdev->PacketFilter ||
 		    !(etdev->Flags & fMP_ADAPTER_LINK_DETECTION) ||
-		    pMpRfd->PacketSize == 0) {
+		    rfd->PacketSize == 0) {
 			continue;
 		}
 
@@ -1144,35 +1058,20 @@ void et131x_handle_recv_interrupt(struct et131x_adapter *etdev)
 		etdev->Stats.ipackets++;
 
 		/* Set the status on the packet, either resources or success */
-		if (etdev->RxRing.nReadyRecv >= RFD_LOW_WATER_MARK) {
-			/* Put this RFD on the pending list
-			 *
-			 * NOTE: nic_rx_pkts() above is already returning the
-			 * RFD to the RecvList, so don't additionally do that
-			 * here.
-			 * Besides, we don't really need (at this point) the
-			 * pending list anyway.
-			 */
-		} else {
-			RFDFreeArray[PacketFreeCount] = pMpRfd;
-			PacketFreeCount++;
-
+		if (etdev->RxRing.nReadyRecv < RFD_LOW_WATER_MARK) {
 			dev_warn(&etdev->pdev->dev,
 				    "RFD's are running out\n");
 		}
-
-		PacketArray[PacketArrayCount] = pMpRfd->Packet;
-		PacketArrayCount++;
+		count++;
 	}
 
-	if ((PacketArrayCount == NUM_PACKETS_HANDLED) || TempUnfinishedRec) {
+	if (count == NUM_PACKETS_HANDLED || !done) {
 		etdev->RxRing.UnfinishedReceives = true;
 		writel(PARM_TX_TIME_INT_DEF * NANO_IN_A_MICRO,
 		       &etdev->regs->global.watchdog_timer);
-	} else {
+	} else
 		/* Watchdog timer will disable itself if appropriate. */
 		etdev->RxRing.UnfinishedReceives = false;
-	}
 }
 
 static inline u32 bump_fbr(u32 *fbr, u32 limit)
@@ -1196,14 +1095,14 @@ static inline u32 bump_fbr(u32 *fbr, u32 limit)
 /**
  * NICReturnRFD - Recycle a RFD and put it back onto the receive list
  * @etdev: pointer to our adapter
- * @pMpRfd: pointer to the RFD
+ * @rfd: pointer to the RFD
  */
-void nic_return_rfd(struct et131x_adapter *etdev, PMP_RFD pMpRfd)
+void nic_return_rfd(struct et131x_adapter *etdev, PMP_RFD rfd)
 {
 	struct _rx_ring_t *rx_local = &etdev->RxRing;
 	struct _RXDMA_t __iomem *rx_dma = &etdev->regs->rxdma;
-	uint16_t bi = pMpRfd->bufferindex;
-	uint8_t ri = pMpRfd->ringindex;
+	uint16_t bi = rfd->bufferindex;
+	uint8_t ri = rfd->ringindex;
 	unsigned long flags;
 
 	/* We don't use any of the OOB data besides status. Otherwise, we
@@ -1217,7 +1116,7 @@ void nic_return_rfd(struct et131x_adapter *etdev, PMP_RFD pMpRfd)
 		spin_lock_irqsave(&etdev->FbrLock, flags);
 
 		if (ri == 1) {
-			PFBR_DESC_t pNextDesc =
+			PFBR_DESC_t next =
 			    (PFBR_DESC_t) (rx_local->pFbr1RingVa) +
 			    INDEX10(rx_local->local_Fbr1_full);
 
@@ -1225,9 +1124,9 @@ void nic_return_rfd(struct et131x_adapter *etdev, PMP_RFD pMpRfd)
 			 * the PA / Buffer Index for the returned buffer into
 			 * the oldest (next to be freed)FBR entry
 			 */
-			pNextDesc->addr_hi = rx_local->Fbr[1]->PAHigh[bi];
-			pNextDesc->addr_lo = rx_local->Fbr[1]->PALow[bi];
-			pNextDesc->word2.value = bi;
+			next->addr_hi = rx_local->Fbr[1]->PAHigh[bi];
+			next->addr_lo = rx_local->Fbr[1]->PALow[bi];
+			next->word2.value = bi;
 
 			writel(bump_fbr(&rx_local->local_Fbr1_full,
 				rx_local->Fbr1NumEntries - 1),
@@ -1235,7 +1134,7 @@ void nic_return_rfd(struct et131x_adapter *etdev, PMP_RFD pMpRfd)
 		}
 #ifdef USE_FBR0
 		else {
-			PFBR_DESC_t pNextDesc =
+			PFBR_DESC_t next =
 			    (PFBR_DESC_t) rx_local->pFbr0RingVa +
 			    INDEX10(rx_local->local_Fbr0_full);
 
@@ -1243,9 +1142,9 @@ void nic_return_rfd(struct et131x_adapter *etdev, PMP_RFD pMpRfd)
 			 * the PA / Buffer Index for the returned buffer into
 			 * the oldest (next to be freed) FBR entry
 			 */
-			pNextDesc->addr_hi = rx_local->Fbr[0]->PAHigh[bi];
-			pNextDesc->addr_lo = rx_local->Fbr[0]->PALow[bi];
-			pNextDesc->word2.value = bi;
+			next->addr_hi = rx_local->Fbr[0]->PAHigh[bi];
+			next->addr_lo = rx_local->Fbr[0]->PALow[bi];
+			next->word2.value = bi;
 
 			writel(bump_fbr(&rx_local->local_Fbr0_full,
 					rx_local->Fbr0NumEntries - 1),
@@ -1262,7 +1161,7 @@ void nic_return_rfd(struct et131x_adapter *etdev, PMP_RFD pMpRfd)
 	 * our list
 	 */
 	spin_lock_irqsave(&etdev->RcvLock, flags);
-	list_add_tail(&pMpRfd->list_node, &rx_local->RecvList);
+	list_add_tail(&rfd->list_node, &rx_local->RecvList);
 	rx_local->nReadyRecv++;
 	spin_unlock_irqrestore(&etdev->RcvLock, flags);
 
diff --git a/drivers/staging/et131x/et1310_rx.h b/drivers/staging/et131x/et1310_rx.h
index 72a522985270..69514593612c 100644
--- a/drivers/staging/et131x/et1310_rx.h
+++ b/drivers/staging/et131x/et1310_rx.h
@@ -209,36 +209,26 @@ typedef struct _PKT_STAT_DESC_t {
 /* Typedefs for the RX DMA status word */
 
 /*
- * RXSTAT_WORD0_t structure holds part of the status bits of the Rx DMA engine
+ * rx status word 0 holds part of the status bits of the Rx DMA engine
  * that get copied out to memory by the ET-1310.  Word 0 is a 32 bit word
- * whichcontains Free Buffer ring 0 and 1 available offset.
+ * which contains the Free Buffer ring 0 and 1 available offset.
+ *
+ * bit 0-9 FBR1 offset
+ * bit 10 Wrap flag for FBR1
+ * bit 16-25 FBR0 offset
+ * bit 26 Wrap flag for FBR0
  */
-typedef union _rxstat_word0_t {
-	u32 value;
-	struct {
-#ifdef _BIT_FIELDS_HTOL
-		u32 FBR1unused:5;	/* bits 27-31 */
-		u32 FBR1wrap:1;	/* bit 26 */
-		u32 FBR1offset:10;	/* bits 16-25 */
-		u32 FBR0unused:5;	/* bits 11-15 */
-		u32 FBR0wrap:1;	/* bit 10 */
-		u32 FBR0offset:10;	/* bits 0-9 */
-#else
-		u32 FBR0offset:10;	/* bits 0-9 */
-		u32 FBR0wrap:1;	/* bit 10 */
-		u32 FBR0unused:5;	/* bits 11-15 */
-		u32 FBR1offset:10;	/* bits 16-25 */
-		u32 FBR1wrap:1;	/* bit 26 */
-		u32 FBR1unused:5;	/* bits 27-31 */
-#endif
-	} bits;
-} RXSTAT_WORD0_t, *PRXSTAT_WORD0_t;
 
 /*
  * RXSTAT_WORD1_t structure holds part of the status bits of the Rx DMA engine
  * that get copied out to memory by the ET-1310.  Word 3 is a 32 bit word
  * which contains the Packet Status Ring available offset.
  */
+
+#define RXSTAT1_OFFSET	16
+#define RXSTAT1_MASK	0xFFF
+#define RXSTAT1_WRAP	0x10000000
+
 typedef union _rxstat_word1_t {
 	u32 value;
 	struct {
@@ -261,7 +251,7 @@ typedef union _rxstat_word1_t {
  * it sits in free memory, and is pointed to by 0x101c / 0x1020
  */
 typedef struct _rx_status_block_t {
-	RXSTAT_WORD0_t Word0;
+	u32 Word0;
 	RXSTAT_WORD1_t Word1;
 } RX_STATUS_BLOCK_t, *PRX_STATUS_BLOCK_t;
 
@@ -282,15 +272,6 @@ typedef enum {
 } eRX_INTERRUPT_STATE_t, *PeRX_INTERRUPT_STATE_t;
 
 /*
- * Structure to hold the skb's in a list
- */
-typedef struct rx_skb_list_elem {
-	struct list_head skb_list_elem;
-	dma_addr_t dma_addr;
-	struct sk_buff *skb;
-} RX_SKB_LIST_ELEM, *PRX_SKB_LIST_ELEM;
-
-/*
  * RX_RING_t is sructure representing the adaptor's local reference(s) to the
  * rings
  */
@@ -319,21 +300,16 @@ typedef struct _rx_ring_t {
 
 	void *pPSRingVa;
 	dma_addr_t pPSRingPa;
-	uint64_t pPSRingRealPa;
-	uint64_t pPSRingOffset;
-	RXDMA_PSR_FULL_OFFSET_t local_psr_full;
+	u32 local_psr_full;
 	u32 PsrNumEntries;
 
 	void *pRxStatusVa;
 	dma_addr_t pRxStatusPa;
-	uint64_t RxStatusRealPA;
-	uint64_t RxStatusOffset;
 
 	struct list_head RecvBufferPool;
 
 	/* RECV */
 	struct list_head RecvList;
-	struct list_head RecvPendingList;
 	u32 nReadyRecv;
 
 	u32 NumRfd;
diff --git a/drivers/staging/et131x/et1310_tx.c b/drivers/staging/et131x/et1310_tx.c
index 94f7752e2ccc..977e8b34e7a6 100644
--- a/drivers/staging/et131x/et1310_tx.c
+++ b/drivers/staging/et131x/et1310_tx.c
@@ -94,13 +94,11 @@
 #include "et1310_tx.h"
 
 
-static void et131x_update_tcb_list(struct et131x_adapter *etdev);
-static void et131x_check_send_wait_list(struct et131x_adapter *etdev);
 static inline void et131x_free_send_packet(struct et131x_adapter *etdev,
-					   PMP_TCB pMpTcb);
+					   struct tcb *tcb);
 static int et131x_send_packet(struct sk_buff *skb,
 			      struct et131x_adapter *etdev);
-static int nic_send_packet(struct et131x_adapter *etdev, PMP_TCB pMpTcb);
+static int nic_send_packet(struct et131x_adapter *etdev, struct tcb *tcb);
 
 /**
  * et131x_tx_dma_memory_alloc
@@ -117,12 +115,12 @@ static int nic_send_packet(struct et131x_adapter *etdev, PMP_TCB pMpTcb);
 int et131x_tx_dma_memory_alloc(struct et131x_adapter *adapter)
 {
 	int desc_size = 0;
-	TX_RING_t *tx_ring = &adapter->TxRing;
+	struct tx_ring *tx_ring = &adapter->tx_ring;
 
 	/* Allocate memory for the TCB's (Transmit Control Block) */
-	adapter->TxRing.MpTcbMem = (MP_TCB *)kcalloc(NUM_TCB, sizeof(MP_TCB),
-						      GFP_ATOMIC | GFP_DMA);
-	if (!adapter->TxRing.MpTcbMem) {
+	adapter->tx_ring.tcb_ring = (struct tcb *)
+		kcalloc(NUM_TCB, sizeof(struct tcb), GFP_ATOMIC | GFP_DMA);
+	if (!adapter->tx_ring.tcb_ring) {
 		dev_err(&adapter->pdev->dev, "Cannot alloc memory for TCBs\n");
 		return -ENOMEM;
 	}
@@ -130,12 +128,13 @@ int et131x_tx_dma_memory_alloc(struct et131x_adapter *adapter)
 	/* Allocate enough memory for the Tx descriptor ring, and allocate
 	 * some extra so that the ring can be aligned on a 4k boundary.
 	 */
-	desc_size = (sizeof(TX_DESC_ENTRY_t) * NUM_DESC_PER_RING_TX) + 4096 - 1;
-	tx_ring->pTxDescRingVa =
-	    (PTX_DESC_ENTRY_t) pci_alloc_consistent(adapter->pdev, desc_size,
-						    &tx_ring->pTxDescRingPa);
-	if (!adapter->TxRing.pTxDescRingVa) {
-		dev_err(&adapter->pdev->dev, "Cannot alloc memory for Tx Ring\n");
+	desc_size = (sizeof(struct tx_desc) * NUM_DESC_PER_RING_TX) + 4096 - 1;
+	tx_ring->tx_desc_ring =
+	    (struct tx_desc *) pci_alloc_consistent(adapter->pdev, desc_size,
+						    &tx_ring->tx_desc_ring_pa);
+	if (!adapter->tx_ring.tx_desc_ring) {
+		dev_err(&adapter->pdev->dev,
+					"Cannot alloc memory for Tx Ring\n");
 		return -ENOMEM;
 	}
 
@@ -146,35 +145,15 @@ int et131x_tx_dma_memory_alloc(struct et131x_adapter *adapter)
 	 * are ever returned, make sure the high part is retrieved here before
 	 * storing the adjusted address.
 	 */
-	tx_ring->pTxDescRingAdjustedPa = tx_ring->pTxDescRingPa;
-
-	/* Align Tx Descriptor Ring on a 4k (0x1000) byte boundary */
-	et131x_align_allocated_memory(adapter,
-				      &tx_ring->pTxDescRingAdjustedPa,
-				      &tx_ring->TxDescOffset, 0x0FFF);
-
-	tx_ring->pTxDescRingVa += tx_ring->TxDescOffset;
-
 	/* Allocate memory for the Tx status block */
-	tx_ring->pTxStatusVa = pci_alloc_consistent(adapter->pdev,
-						    sizeof(TX_STATUS_BLOCK_t),
-						    &tx_ring->pTxStatusPa);
-	if (!adapter->TxRing.pTxStatusPa) {
+	tx_ring->tx_status = pci_alloc_consistent(adapter->pdev,
+						    sizeof(u32),
+						    &tx_ring->tx_status_pa);
+	if (!adapter->tx_ring.tx_status_pa) {
 		dev_err(&adapter->pdev->dev,
 				  "Cannot alloc memory for Tx status block\n");
 		return -ENOMEM;
 	}
-
-	/* Allocate memory for a dummy buffer */
-	tx_ring->pTxDummyBlkVa = pci_alloc_consistent(adapter->pdev,
-						      NIC_MIN_PACKET_SIZE,
-						      &tx_ring->pTxDummyBlkPa);
-	if (!adapter->TxRing.pTxDummyBlkPa) {
-		dev_err(&adapter->pdev->dev,
-			"Cannot alloc memory for Tx dummy buffer\n");
-		return -ENOMEM;
-	}
-
 	return 0;
 }
 
@@ -188,76 +167,59 @@ void et131x_tx_dma_memory_free(struct et131x_adapter *adapter)
 {
 	int desc_size = 0;
 
-	if (adapter->TxRing.pTxDescRingVa) {
+	if (adapter->tx_ring.tx_desc_ring) {
 		/* Free memory relating to Tx rings here */
-		adapter->TxRing.pTxDescRingVa -= adapter->TxRing.TxDescOffset;
-
-		desc_size =
-		    (sizeof(TX_DESC_ENTRY_t) * NUM_DESC_PER_RING_TX) + 4096 - 1;
-
+		desc_size = (sizeof(struct tx_desc) * NUM_DESC_PER_RING_TX)
+								+ 4096 - 1;
 		pci_free_consistent(adapter->pdev,
 				    desc_size,
-				    adapter->TxRing.pTxDescRingVa,
-				    adapter->TxRing.pTxDescRingPa);
-
-		adapter->TxRing.pTxDescRingVa = NULL;
+				    adapter->tx_ring.tx_desc_ring,
+				    adapter->tx_ring.tx_desc_ring_pa);
+		adapter->tx_ring.tx_desc_ring = NULL;
 	}
 
 	/* Free memory for the Tx status block */
-	if (adapter->TxRing.pTxStatusVa) {
-		pci_free_consistent(adapter->pdev,
-				    sizeof(TX_STATUS_BLOCK_t),
-				    adapter->TxRing.pTxStatusVa,
-				    adapter->TxRing.pTxStatusPa);
-
-		adapter->TxRing.pTxStatusVa = NULL;
-	}
-
-	/* Free memory for the dummy buffer */
-	if (adapter->TxRing.pTxDummyBlkVa) {
+	if (adapter->tx_ring.tx_status) {
 		pci_free_consistent(adapter->pdev,
-				    NIC_MIN_PACKET_SIZE,
-				    adapter->TxRing.pTxDummyBlkVa,
-				    adapter->TxRing.pTxDummyBlkPa);
+				    sizeof(u32),
+				    adapter->tx_ring.tx_status,
+				    adapter->tx_ring.tx_status_pa);
 
-		adapter->TxRing.pTxDummyBlkVa = NULL;
+		adapter->tx_ring.tx_status = NULL;
 	}
-
-	/* Free the memory for MP_TCB structures */
-	kfree(adapter->TxRing.MpTcbMem);
+	/* Free the memory for the tcb structures */
+	kfree(adapter->tx_ring.tcb_ring);
 }
 
 /**
  * ConfigTxDmaRegs - Set up the tx dma section of the JAGCore.
  * @etdev: pointer to our private adapter structure
+ *
+ * Configure the transmit engine with the ring buffers we have created
+ * and prepare it for use.
  */
 void ConfigTxDmaRegs(struct et131x_adapter *etdev)
 {
 	struct _TXDMA_t __iomem *txdma = &etdev->regs->txdma;
 
 	/* Load the hardware with the start of the transmit descriptor ring. */
-	writel((uint32_t) (etdev->TxRing.pTxDescRingAdjustedPa >> 32),
+	writel((u32) ((u64)etdev->tx_ring.tx_desc_ring_pa >> 32),
 	       &txdma->pr_base_hi);
-	writel((uint32_t) etdev->TxRing.pTxDescRingAdjustedPa,
+	writel((u32) etdev->tx_ring.tx_desc_ring_pa,
 	       &txdma->pr_base_lo);
 
 	/* Initialise the transmit DMA engine */
-	writel(NUM_DESC_PER_RING_TX - 1, &txdma->pr_num_des.value);
+	writel(NUM_DESC_PER_RING_TX - 1, &txdma->pr_num_des);
 
-	/* Load the completion writeback physical address
-	 *
-	 * NOTE: pci_alloc_consistent(), used above to alloc DMA regions,
-	 * ALWAYS returns SAC (32-bit) addresses. If DAC (64-bit) addresses
-	 * are ever returned, make sure the high part is retrieved here before
-	 * storing the adjusted address.
-	 */
-	writel(0, &txdma->dma_wb_base_hi);
-	writel(etdev->TxRing.pTxStatusPa, &txdma->dma_wb_base_lo);
+	/* Load the completion writeback physical address */
+	writel((u32)((u64)etdev->tx_ring.tx_status_pa >> 32),
+						&txdma->dma_wb_base_hi);
+	writel((u32)etdev->tx_ring.tx_status_pa, &txdma->dma_wb_base_lo);
 
-	memset(etdev->TxRing.pTxStatusVa, 0, sizeof(TX_STATUS_BLOCK_t));
+	*etdev->tx_ring.tx_status = 0;
 
 	writel(0, &txdma->service_request);
-	etdev->TxRing.txDmaReadyToSend = 0;
+	etdev->tx_ring.send_idx = 0;
 }
 
 /**
@@ -279,16 +241,11 @@ void et131x_tx_dma_disable(struct et131x_adapter *etdev)
  */
 void et131x_tx_dma_enable(struct et131x_adapter *etdev)
 {
-	u32 csr = ET_TXDMA_SNGL_EPKT;
-	if (etdev->RegistryPhyLoopbk)
-		/* TxDMA is disabled for loopback operation. */
-		csr |= ET_TXDMA_CSR_HALT;
-	else
-		/* Setup the transmit dma configuration register for normal
-		 * operation
-		 */
-		csr |= PARM_DMA_CACHE_DEF << ET_TXDMA_CACHE_SHIFT;
-	writel(csr, &etdev->regs->txdma.csr);
+	/* Setup the transmit dma configuration register for normal
+	 * operation
+	 */
+	writel(ET_TXDMA_SNGL_EPKT|(PARM_DMA_CACHE_DEF << ET_TXDMA_CACHE_SHIFT),
+					&etdev->regs->txdma.csr);
 }
 
 /**
@@ -297,39 +254,32 @@ void et131x_tx_dma_enable(struct et131x_adapter *etdev)
  */
 void et131x_init_send(struct et131x_adapter *adapter)
 {
-	PMP_TCB pMpTcb;
-	uint32_t TcbCount;
-	TX_RING_t *tx_ring;
+	struct tcb *tcb;
+	u32 ct;
+	struct tx_ring *tx_ring;
 
 	/* Setup some convenience pointers */
-	tx_ring = &adapter->TxRing;
-	pMpTcb = adapter->TxRing.MpTcbMem;
+	tx_ring = &adapter->tx_ring;
+	tcb = adapter->tx_ring.tcb_ring;
 
-	tx_ring->TCBReadyQueueHead = pMpTcb;
+	tx_ring->tcb_qhead = tcb;
 
-	/* Go through and set up each TCB */
-	for (TcbCount = 0; TcbCount < NUM_TCB; TcbCount++) {
-		memset(pMpTcb, 0, sizeof(MP_TCB));
+	memset(tcb, 0, sizeof(struct tcb) * NUM_TCB);
 
+	/* Go through and set up each TCB */
+	for (ct = 0; ct++ < NUM_TCB; tcb++)
 		/* Set the link pointer in HW TCB to the next TCB in the
-		 * chain.  If this is the last TCB in the chain, also set the
-		 * tail pointer.
+		 * chain
 		 */
-		if (TcbCount < NUM_TCB - 1) {
-			pMpTcb->Next = pMpTcb + 1;
-		} else {
-			tx_ring->TCBReadyQueueTail = pMpTcb;
-			pMpTcb->Next = (PMP_TCB) NULL;
-		}
-
-		pMpTcb++;
-	}
+		tcb->next = tcb + 1;
 
+	/* Set the  tail pointer */
+	tcb--;
+	tx_ring->tcb_qtail = tcb;
+	tcb->next = NULL;
 	/* Curr send queue should now be empty */
-	tx_ring->CurrSendHead = (PMP_TCB) NULL;
-	tx_ring->CurrSendTail = (PMP_TCB) NULL;
-
-	INIT_LIST_HEAD(&adapter->TxRing.SendWaitQueue);
+	tx_ring->send_head = NULL;
+	tx_ring->send_tail = NULL;
 }
 
 /**
@@ -352,9 +302,8 @@ int et131x_send_packets(struct sk_buff *skb, struct net_device *netdev)
 	 * to Tx, so the PacketCount and it's array used makes no sense here
 	 */
 
-	/* Queue is not empty or TCB is not available */
-	if (!list_empty(&etdev->TxRing.SendWaitQueue) ||
-	    MP_TCB_RESOURCES_NOT_AVAILABLE(etdev)) {
+	/* TCB is not available */
+	if (etdev->tx_ring.used >= NUM_TCB) {
 		/* NOTE: If there's an error on send, no need to queue the
 		 * packet under Linux; if we just send an error up to the
 		 * netif layer, it will resend the skb to us.
@@ -364,27 +313,15 @@ int et131x_send_packets(struct sk_buff *skb, struct net_device *netdev)
 		/* We need to see if the link is up; if it's not, make the
 		 * netif layer think we're good and drop the packet
 		 */
-		/*
-		 * if( MP_SHOULD_FAIL_SEND( etdev ) ||
-		 *  etdev->DriverNoPhyAccess )
-		 */
-		if (MP_SHOULD_FAIL_SEND(etdev) || etdev->DriverNoPhyAccess
-		    || !netif_carrier_ok(netdev)) {
+		if ((etdev->Flags & fMP_ADAPTER_FAIL_SEND_MASK) ||
+					!netif_carrier_ok(netdev)) {
 			dev_kfree_skb_any(skb);
 			skb = NULL;
 
 			etdev->net_stats.tx_dropped++;
 		} else {
 			status = et131x_send_packet(skb, etdev);
-
-			if (status == -ENOMEM) {
-
-				/* NOTE: If there's an error on send, no need
-				 * to queue the packet under Linux; if we just
-				 * send an error up to the netif layer, it
-				 * will resend the skb to us.
-				 */
-			} else if (status != 0) {
+			if (status != 0 && status != -ENOMEM) {
 				/* On any other error, make netif think we're
 				 * OK and drop the packet
 				 */
@@ -409,87 +346,83 @@ int et131x_send_packets(struct sk_buff *skb, struct net_device *netdev)
 static int et131x_send_packet(struct sk_buff *skb,
 			      struct et131x_adapter *etdev)
 {
-	int status = 0;
-	PMP_TCB pMpTcb = NULL;
-	uint16_t *shbufva;
+	int status;
+	struct tcb *tcb = NULL;
+	u16 *shbufva;
 	unsigned long flags;
 
 	/* All packets must have at least a MAC address and a protocol type */
-	if (skb->len < ETH_HLEN) {
+	if (skb->len < ETH_HLEN)
 		return -EIO;
-	}
 
 	/* Get a TCB for this packet */
 	spin_lock_irqsave(&etdev->TCBReadyQLock, flags);
 
-	pMpTcb = etdev->TxRing.TCBReadyQueueHead;
+	tcb = etdev->tx_ring.tcb_qhead;
 
-	if (pMpTcb == NULL) {
+	if (tcb == NULL) {
 		spin_unlock_irqrestore(&etdev->TCBReadyQLock, flags);
 		return -ENOMEM;
 	}
 
-	etdev->TxRing.TCBReadyQueueHead = pMpTcb->Next;
+	etdev->tx_ring.tcb_qhead = tcb->next;
 
-	if (etdev->TxRing.TCBReadyQueueHead == NULL)
-		etdev->TxRing.TCBReadyQueueTail = NULL;
+	if (etdev->tx_ring.tcb_qhead == NULL)
+		etdev->tx_ring.tcb_qtail = NULL;
 
 	spin_unlock_irqrestore(&etdev->TCBReadyQLock, flags);
 
-	pMpTcb->PacketLength = skb->len;
-	pMpTcb->Packet = skb;
+	tcb->skb = skb;
 
-	if ((skb->data != NULL) && ((skb->len - skb->data_len) >= 6)) {
-		shbufva = (uint16_t *) skb->data;
+	if (skb->data != NULL && skb->len - skb->data_len >= 6) {
+		shbufva = (u16 *) skb->data;
 
 		if ((shbufva[0] == 0xffff) &&
 		    (shbufva[1] == 0xffff) && (shbufva[2] == 0xffff)) {
-			pMpTcb->Flags |= fMP_DEST_BROAD;
+			tcb->flags |= fMP_DEST_BROAD;
 		} else if ((shbufva[0] & 0x3) == 0x0001) {
-			pMpTcb->Flags |=  fMP_DEST_MULTI;
+			tcb->flags |=  fMP_DEST_MULTI;
 		}
 	}
 
-	pMpTcb->Next = NULL;
+	tcb->next = NULL;
 
 	/* Call the NIC specific send handler. */
-	if (status == 0)
-		status = nic_send_packet(etdev, pMpTcb);
+	status = nic_send_packet(etdev, tcb);
 
 	if (status != 0) {
 		spin_lock_irqsave(&etdev->TCBReadyQLock, flags);
 
-		if (etdev->TxRing.TCBReadyQueueTail) {
-			etdev->TxRing.TCBReadyQueueTail->Next = pMpTcb;
-		} else {
+		if (etdev->tx_ring.tcb_qtail)
+			etdev->tx_ring.tcb_qtail->next = tcb;
+		else
 			/* Apparently ready Q is empty. */
-			etdev->TxRing.TCBReadyQueueHead = pMpTcb;
-		}
+			etdev->tx_ring.tcb_qhead = tcb;
 
-		etdev->TxRing.TCBReadyQueueTail = pMpTcb;
+		etdev->tx_ring.tcb_qtail = tcb;
 		spin_unlock_irqrestore(&etdev->TCBReadyQLock, flags);
 		return status;
 	}
-	WARN_ON(etdev->TxRing.nBusySend > NUM_TCB);
+	WARN_ON(etdev->tx_ring.used > NUM_TCB);
 	return 0;
 }
 
 /**
  * nic_send_packet - NIC specific send handler for version B silicon.
  * @etdev: pointer to our adapter
- * @pMpTcb: pointer to MP_TCB
+ * @tcb: pointer to struct tcb
  *
  * Returns 0 or errno.
  */
-static int nic_send_packet(struct et131x_adapter *etdev, PMP_TCB pMpTcb)
+static int nic_send_packet(struct et131x_adapter *etdev, struct tcb *tcb)
 {
-	uint32_t loopIndex;
-	TX_DESC_ENTRY_t CurDesc[24];
-	uint32_t FragmentNumber = 0;
-	uint32_t thiscopy, remainder;
-	struct sk_buff *pPacket = pMpTcb->Packet;
-	uint32_t FragListCount = skb_shinfo(pPacket)->nr_frags + 1;
-	struct skb_frag_struct *pFragList = &skb_shinfo(pPacket)->frags[0];
+	u32 i;
+	struct tx_desc desc[24];	/* 24 x 16 byte */
+	u32 frag = 0;
+	u32 thiscopy, remainder;
+	struct sk_buff *skb = tcb->skb;
+	u32 nr_frags = skb_shinfo(skb)->nr_frags + 1;
+	struct skb_frag_struct *frags = &skb_shinfo(skb)->frags[0];
 	unsigned long flags;
 
 	/* Part of the optimizations of this send routine restrict us to
@@ -500,17 +433,16 @@ static int nic_send_packet(struct et131x_adapter *etdev, PMP_TCB pMpTcb)
 	 * number of fragments. If needed, we can call this function,
 	 * although it is less efficient.
 	 */
-	if (FragListCount > 23) {
+	if (nr_frags > 23)
 		return -EIO;
-	}
 
-	memset(CurDesc, 0, sizeof(TX_DESC_ENTRY_t) * (FragListCount + 1));
+	memset(desc, 0, sizeof(struct tx_desc) * (nr_frags + 1));
 
-	for (loopIndex = 0; loopIndex < FragListCount; loopIndex++) {
+	for (i = 0; i < nr_frags; i++) {
 		/* If there is something in this element, lets get a
 		 * descriptor from the ring and get the necessary data
 		 */
-		if (loopIndex == 0) {
+		if (i == 0) {
 			/* If the fragments are smaller than a standard MTU,
 			 * then map them to a single descriptor in the Tx
 			 * Desc ring. However, if they're larger, as is
@@ -520,166 +452,164 @@ static int nic_send_packet(struct et131x_adapter *etdev, PMP_TCB pMpTcb)
 			 * This will work until we determine why the hardware
 			 * doesn't seem to like large fragments.
 			 */
-			if ((pPacket->len - pPacket->data_len) <= 1514) {
-				CurDesc[FragmentNumber].DataBufferPtrHigh = 0;
-				CurDesc[FragmentNumber].word2.bits.
-				    length_in_bytes =
-				    pPacket->len - pPacket->data_len;
+			if ((skb->len - skb->data_len) <= 1514) {
+				desc[frag].addr_hi = 0;
+				/* Low 16bits are length, high is vlan and
+				   unused currently so zero */
+				desc[frag].len_vlan =
+					skb->len - skb->data_len;
 
 				/* NOTE: Here, the dma_addr_t returned from
 				 * pci_map_single() is implicitly cast as a
-				 * uint32_t. Although dma_addr_t can be
+				 * u32. Although dma_addr_t can be
 				 * 64-bit, the address returned by
 				 * pci_map_single() is always 32-bit
 				 * addressable (as defined by the pci/dma
 				 * subsystem)
 				 */
-				CurDesc[FragmentNumber++].DataBufferPtrLow =
+				desc[frag++].addr_lo =
 				    pci_map_single(etdev->pdev,
-						   pPacket->data,
-						   pPacket->len -
-						   pPacket->data_len,
+						   skb->data,
+						   skb->len -
+						   skb->data_len,
 						   PCI_DMA_TODEVICE);
 			} else {
-				CurDesc[FragmentNumber].DataBufferPtrHigh = 0;
-				CurDesc[FragmentNumber].word2.bits.
-				    length_in_bytes =
-				    ((pPacket->len - pPacket->data_len) / 2);
+				desc[frag].addr_hi = 0;
+				desc[frag].len_vlan =
+				    (skb->len - skb->data_len) / 2;
 
 				/* NOTE: Here, the dma_addr_t returned from
 				 * pci_map_single() is implicitly cast as a
-				 * uint32_t. Although dma_addr_t can be
+				 * u32. Although dma_addr_t can be
 				 * 64-bit, the address returned by
 				 * pci_map_single() is always 32-bit
 				 * addressable (as defined by the pci/dma
 				 * subsystem)
 				 */
-				CurDesc[FragmentNumber++].DataBufferPtrLow =
+				desc[frag++].addr_lo =
 				    pci_map_single(etdev->pdev,
-						   pPacket->data,
-						   ((pPacket->len -
-						     pPacket->data_len) / 2),
+						   skb->data,
+						   ((skb->len -
+						     skb->data_len) / 2),
 						   PCI_DMA_TODEVICE);
-				CurDesc[FragmentNumber].DataBufferPtrHigh = 0;
+				desc[frag].addr_hi = 0;
 
-				CurDesc[FragmentNumber].word2.bits.
-				    length_in_bytes =
-				    ((pPacket->len - pPacket->data_len) / 2);
+				desc[frag].len_vlan =
+				    (skb->len - skb->data_len) / 2;
 
 				/* NOTE: Here, the dma_addr_t returned from
 				 * pci_map_single() is implicitly cast as a
-				 * uint32_t. Although dma_addr_t can be
+				 * u32. Although dma_addr_t can be
 				 * 64-bit, the address returned by
 				 * pci_map_single() is always 32-bit
 				 * addressable (as defined by the pci/dma
 				 * subsystem)
 				 */
-				CurDesc[FragmentNumber++].DataBufferPtrLow =
+				desc[frag++].addr_lo =
 				    pci_map_single(etdev->pdev,
-						   pPacket->data +
-						   ((pPacket->len -
-						     pPacket->data_len) / 2),
-						   ((pPacket->len -
-						     pPacket->data_len) / 2),
+						   skb->data +
+						   ((skb->len -
+						     skb->data_len) / 2),
+						   ((skb->len -
+						     skb->data_len) / 2),
 						   PCI_DMA_TODEVICE);
 			}
 		} else {
-			CurDesc[FragmentNumber].DataBufferPtrHigh = 0;
-			CurDesc[FragmentNumber].word2.bits.length_in_bytes =
-			    pFragList[loopIndex - 1].size;
+			desc[frag].addr_hi = 0;
+			desc[frag].len_vlan =
+					frags[i - 1].size;
 
 			/* NOTE: Here, the dma_addr_t returned from
-			 * pci_map_page() is implicitly cast as a uint32_t.
+			 * pci_map_page() is implicitly cast as a u32.
 			 * Although dma_addr_t can be 64-bit, the address
 			 * returned by pci_map_page() is always 32-bit
 			 * addressable (as defined by the pci/dma subsystem)
 			 */
-			CurDesc[FragmentNumber++].DataBufferPtrLow =
+			desc[frag++].addr_lo =
 			    pci_map_page(etdev->pdev,
-					 pFragList[loopIndex - 1].page,
-					 pFragList[loopIndex - 1].page_offset,
-					 pFragList[loopIndex - 1].size,
+					 frags[i - 1].page,
+					 frags[i - 1].page_offset,
+					 frags[i - 1].size,
 					 PCI_DMA_TODEVICE);
 		}
 	}
 
-	if (FragmentNumber == 0)
+	if (frag == 0)
 		return -EIO;
 
 	if (etdev->linkspeed == TRUEPHY_SPEED_1000MBPS) {
-		if (++etdev->TxRing.TxPacketsSinceLastinterrupt ==
-		    PARM_TX_NUM_BUFS_DEF) {
-			CurDesc[FragmentNumber - 1].word3.value = 0x5;
-			etdev->TxRing.TxPacketsSinceLastinterrupt = 0;
-		} else {
-			CurDesc[FragmentNumber - 1].word3.value = 0x1;
+		if (++etdev->tx_ring.since_irq == PARM_TX_NUM_BUFS_DEF) {
+			/* Last element & Interrupt flag */
+			desc[frag - 1].flags = 0x5;
+			etdev->tx_ring.since_irq = 0;
+		} else { /* Last element */
+			desc[frag - 1].flags = 0x1;
 		}
-	} else {
-		CurDesc[FragmentNumber - 1].word3.value = 0x5;
-	}
+	} else
+		desc[frag - 1].flags = 0x5;
 
-	CurDesc[0].word3.bits.f = 1;
+	desc[0].flags |= 2;	/* First element flag */
 
-	pMpTcb->WrIndexStart = etdev->TxRing.txDmaReadyToSend;
-	pMpTcb->PacketStaleCount = 0;
+	tcb->index_start = etdev->tx_ring.send_idx;
+	tcb->stale = 0;
 
 	spin_lock_irqsave(&etdev->SendHWLock, flags);
 
 	thiscopy = NUM_DESC_PER_RING_TX -
-				INDEX10(etdev->TxRing.txDmaReadyToSend);
+				INDEX10(etdev->tx_ring.send_idx);
 
-	if (thiscopy >= FragmentNumber) {
+	if (thiscopy >= frag) {
 		remainder = 0;
-		thiscopy = FragmentNumber;
+		thiscopy = frag;
 	} else {
-		remainder = FragmentNumber - thiscopy;
+		remainder = frag - thiscopy;
 	}
 
-	memcpy(etdev->TxRing.pTxDescRingVa +
-	       INDEX10(etdev->TxRing.txDmaReadyToSend), CurDesc,
-	       sizeof(TX_DESC_ENTRY_t) * thiscopy);
+	memcpy(etdev->tx_ring.tx_desc_ring +
+	       INDEX10(etdev->tx_ring.send_idx), desc,
+	       sizeof(struct tx_desc) * thiscopy);
 
-	add_10bit(&etdev->TxRing.txDmaReadyToSend, thiscopy);
+	add_10bit(&etdev->tx_ring.send_idx, thiscopy);
 
-	if (INDEX10(etdev->TxRing.txDmaReadyToSend)== 0 ||
-	    INDEX10(etdev->TxRing.txDmaReadyToSend) == NUM_DESC_PER_RING_TX) {
-	     	etdev->TxRing.txDmaReadyToSend &= ~ET_DMA10_MASK;
-	     	etdev->TxRing.txDmaReadyToSend ^= ET_DMA10_WRAP;
+	if (INDEX10(etdev->tx_ring.send_idx) == 0 ||
+		    INDEX10(etdev->tx_ring.send_idx) == NUM_DESC_PER_RING_TX) {
+		etdev->tx_ring.send_idx &= ~ET_DMA10_MASK;
+		etdev->tx_ring.send_idx ^= ET_DMA10_WRAP;
 	}
 
 	if (remainder) {
-		memcpy(etdev->TxRing.pTxDescRingVa,
-		       CurDesc + thiscopy,
-		       sizeof(TX_DESC_ENTRY_t) * remainder);
+		memcpy(etdev->tx_ring.tx_desc_ring,
+		       desc + thiscopy,
+		       sizeof(struct tx_desc) * remainder);
 
-		add_10bit(&etdev->TxRing.txDmaReadyToSend, remainder);
+		add_10bit(&etdev->tx_ring.send_idx, remainder);
 	}
 
-	if (INDEX10(etdev->TxRing.txDmaReadyToSend) == 0) {
-		if (etdev->TxRing.txDmaReadyToSend)
-			pMpTcb->WrIndex = NUM_DESC_PER_RING_TX - 1;
+	if (INDEX10(etdev->tx_ring.send_idx) == 0) {
+		if (etdev->tx_ring.send_idx)
+			tcb->index = NUM_DESC_PER_RING_TX - 1;
 		else
-			pMpTcb->WrIndex= ET_DMA10_WRAP | (NUM_DESC_PER_RING_TX - 1);
+			tcb->index = ET_DMA10_WRAP|(NUM_DESC_PER_RING_TX - 1);
 	} else
-		pMpTcb->WrIndex = etdev->TxRing.txDmaReadyToSend - 1;
+		tcb->index = etdev->tx_ring.send_idx - 1;
 
 	spin_lock(&etdev->TCBSendQLock);
 
-	if (etdev->TxRing.CurrSendTail)
-		etdev->TxRing.CurrSendTail->Next = pMpTcb;
+	if (etdev->tx_ring.send_tail)
+		etdev->tx_ring.send_tail->next = tcb;
 	else
-		etdev->TxRing.CurrSendHead = pMpTcb;
+		etdev->tx_ring.send_head = tcb;
 
-	etdev->TxRing.CurrSendTail = pMpTcb;
+	etdev->tx_ring.send_tail = tcb;
 
-	WARN_ON(pMpTcb->Next != NULL);
+	WARN_ON(tcb->next != NULL);
 
-	etdev->TxRing.nBusySend++;
+	etdev->tx_ring.used++;
 
 	spin_unlock(&etdev->TCBSendQLock);
 
 	/* Write the new write pointer back to the device. */
-	writel(etdev->TxRing.txDmaReadyToSend,
+	writel(etdev->tx_ring.send_idx,
 	       &etdev->regs->txdma.service_request);
 
 	/* For Gig only, we use Tx Interrupt coalescing.  Enable the software
@@ -696,72 +626,71 @@ static int nic_send_packet(struct et131x_adapter *etdev, PMP_TCB pMpTcb)
 
 
 /**
- * et131x_free_send_packet - Recycle a MP_TCB, complete the packet if necessary
+ * et131x_free_send_packet - Recycle a struct tcb
  * @etdev: pointer to our adapter
- * @pMpTcb: pointer to MP_TCB
+ * @tcb: pointer to struct tcb
  *
+ * Complete the packet if necessary
  * Assumption - Send spinlock has been acquired
  */
 inline void et131x_free_send_packet(struct et131x_adapter *etdev,
-							PMP_TCB pMpTcb)
+						struct tcb *tcb)
 {
 	unsigned long flags;
-	TX_DESC_ENTRY_t *desc = NULL;
+	struct tx_desc *desc = NULL;
 	struct net_device_stats *stats = &etdev->net_stats;
 
-	if (pMpTcb->Flags & fMP_DEST_BROAD)
+	if (tcb->flags & fMP_DEST_BROAD)
 		atomic_inc(&etdev->Stats.brdcstxmt);
-	else if (pMpTcb->Flags & fMP_DEST_MULTI)
+	else if (tcb->flags & fMP_DEST_MULTI)
 		atomic_inc(&etdev->Stats.multixmt);
 	else
 		atomic_inc(&etdev->Stats.unixmt);
 
-	if (pMpTcb->Packet) {
-		stats->tx_bytes += pMpTcb->Packet->len;
+	if (tcb->skb) {
+		stats->tx_bytes += tcb->skb->len;
 
 		/* Iterate through the TX descriptors on the ring
 		 * corresponding to this packet and umap the fragments
 		 * they point to
 		 */
 		do {
-			desc =
-			    (TX_DESC_ENTRY_t *) (etdev->TxRing.pTxDescRingVa +
-			    	INDEX10(pMpTcb->WrIndexStart));
+			desc = (struct tx_desc *)(etdev->tx_ring.tx_desc_ring +
+						INDEX10(tcb->index_start));
 
 			pci_unmap_single(etdev->pdev,
-					 desc->DataBufferPtrLow,
-					 desc->word2.value, PCI_DMA_TODEVICE);
-
-			add_10bit(&pMpTcb->WrIndexStart, 1);
-			if (INDEX10(pMpTcb->WrIndexStart) >=
-			    NUM_DESC_PER_RING_TX) {
-			    	pMpTcb->WrIndexStart &= ~ET_DMA10_MASK;
-			    	pMpTcb->WrIndexStart ^= ET_DMA10_WRAP;
+					 desc->addr_lo,
+					 desc->len_vlan, PCI_DMA_TODEVICE);
+
+			add_10bit(&tcb->index_start, 1);
+			if (INDEX10(tcb->index_start) >=
+							NUM_DESC_PER_RING_TX) {
+				tcb->index_start &= ~ET_DMA10_MASK;
+				tcb->index_start ^= ET_DMA10_WRAP;
 			}
-		} while (desc != (etdev->TxRing.pTxDescRingVa +
-				INDEX10(pMpTcb->WrIndex)));
+		} while (desc != (etdev->tx_ring.tx_desc_ring +
+				INDEX10(tcb->index)));
 
-		dev_kfree_skb_any(pMpTcb->Packet);
+		dev_kfree_skb_any(tcb->skb);
 	}
 
-	memset(pMpTcb, 0, sizeof(MP_TCB));
+	memset(tcb, 0, sizeof(struct tcb));
 
 	/* Add the TCB to the Ready Q */
 	spin_lock_irqsave(&etdev->TCBReadyQLock, flags);
 
 	etdev->Stats.opackets++;
 
-	if (etdev->TxRing.TCBReadyQueueTail) {
-		etdev->TxRing.TCBReadyQueueTail->Next = pMpTcb;
-	} else {
+	if (etdev->tx_ring.tcb_qtail)
+		etdev->tx_ring.tcb_qtail->next = tcb;
+	else
 		/* Apparently ready Q is empty. */
-		etdev->TxRing.TCBReadyQueueHead = pMpTcb;
-	}
+		etdev->tx_ring.tcb_qhead = tcb;
 
-	etdev->TxRing.TCBReadyQueueTail = pMpTcb;
+	etdev->tx_ring.tcb_qtail = tcb;
 
 	spin_unlock_irqrestore(&etdev->TCBReadyQLock, flags);
-	WARN_ON(etdev->TxRing.nBusySend < 0);
+	WARN_ON(etdev->tx_ring.used < 0);
 }
 
 /**
@@ -772,52 +701,40 @@ inline void et131x_free_send_packet(struct et131x_adapter *etdev,
  */
 void et131x_free_busy_send_packets(struct et131x_adapter *etdev)
 {
-	PMP_TCB pMpTcb;
-	struct list_head *entry;
+	struct tcb *tcb;
 	unsigned long flags;
-	uint32_t FreeCounter = 0;
-
-	while (!list_empty(&etdev->TxRing.SendWaitQueue)) {
-		spin_lock_irqsave(&etdev->SendWaitLock, flags);
-
-		etdev->TxRing.nWaitSend--;
-		spin_unlock_irqrestore(&etdev->SendWaitLock, flags);
-
-		entry = etdev->TxRing.SendWaitQueue.next;
-	}
-
-	etdev->TxRing.nWaitSend = 0;
+	u32 freed = 0;
 
 	/* Any packets being sent? Check the first TCB on the send list */
 	spin_lock_irqsave(&etdev->TCBSendQLock, flags);
 
-	pMpTcb = etdev->TxRing.CurrSendHead;
+	tcb = etdev->tx_ring.send_head;
 
-	while ((pMpTcb != NULL) && (FreeCounter < NUM_TCB)) {
-		PMP_TCB pNext = pMpTcb->Next;
+	while (tcb != NULL && freed < NUM_TCB) {
+		struct tcb *next = tcb->next;
 
-		etdev->TxRing.CurrSendHead = pNext;
+		etdev->tx_ring.send_head = next;
 
-		if (pNext == NULL)
-			etdev->TxRing.CurrSendTail = NULL;
+		if (next == NULL)
+			etdev->tx_ring.send_tail = NULL;
 
-		etdev->TxRing.nBusySend--;
+		etdev->tx_ring.used--;
 
 		spin_unlock_irqrestore(&etdev->TCBSendQLock, flags);
 
-		FreeCounter++;
-		et131x_free_send_packet(etdev, pMpTcb);
+		freed++;
+		et131x_free_send_packet(etdev, tcb);
 
 		spin_lock_irqsave(&etdev->TCBSendQLock, flags);
 
-		pMpTcb = etdev->TxRing.CurrSendHead;
+		tcb = etdev->tx_ring.send_head;
 	}
 
-	WARN_ON(FreeCounter == NUM_TCB);
+	WARN_ON(freed == NUM_TCB);
 
 	spin_unlock_irqrestore(&etdev->TCBSendQLock, flags);
 
-	etdev->TxRing.nBusySend = 0;
+	etdev->tx_ring.used = 0;
 }
 
 /**
@@ -831,99 +748,56 @@ void et131x_free_busy_send_packets(struct et131x_adapter *etdev)
  */
 void et131x_handle_send_interrupt(struct et131x_adapter *etdev)
 {
-	/* Mark as completed any packets which have been sent by the device. */
-	et131x_update_tcb_list(etdev);
-
-	/* If we queued any transmits because we didn't have any TCBs earlier,
-	 * dequeue and send those packets now, as long as we have free TCBs.
-	 */
-	et131x_check_send_wait_list(etdev);
-}
-
-/**
- * et131x_update_tcb_list - Helper routine for Send Interrupt handler
- * @etdev: pointer to our adapter
- *
- * Re-claims the send resources and completes sends.  Can also be called as
- * part of the NIC send routine when the "ServiceComplete" indication has
- * wrapped.
- */
-static void et131x_update_tcb_list(struct et131x_adapter *etdev)
-{
 	unsigned long flags;
-	u32 ServiceComplete;
-	PMP_TCB pMpTcb;
+	u32 serviced;
+	struct tcb *tcb;
 	u32 index;
 
-	ServiceComplete = readl(&etdev->regs->txdma.NewServiceComplete);
-	index = INDEX10(ServiceComplete);
+	serviced = readl(&etdev->regs->txdma.NewServiceComplete);
+	index = INDEX10(serviced);
 
 	/* Has the ring wrapped?  Process any descriptors that do not have
 	 * the same "wrap" indicator as the current completion indicator
 	 */
 	spin_lock_irqsave(&etdev->TCBSendQLock, flags);
 
-	pMpTcb = etdev->TxRing.CurrSendHead;
+	tcb = etdev->tx_ring.send_head;
 
-	while (pMpTcb &&
-	       ((ServiceComplete ^ pMpTcb->WrIndex) & ET_DMA10_WRAP) &&
-	       index < INDEX10(pMpTcb->WrIndex)) {
-		etdev->TxRing.nBusySend--;
-		etdev->TxRing.CurrSendHead = pMpTcb->Next;
-		if (pMpTcb->Next == NULL)
-			etdev->TxRing.CurrSendTail = NULL;
+	while (tcb &&
+	       ((serviced ^ tcb->index) & ET_DMA10_WRAP) &&
+	       index < INDEX10(tcb->index)) {
+		etdev->tx_ring.used--;
+		etdev->tx_ring.send_head = tcb->next;
+		if (tcb->next == NULL)
+			etdev->tx_ring.send_tail = NULL;
 
 		spin_unlock_irqrestore(&etdev->TCBSendQLock, flags);
-		et131x_free_send_packet(etdev, pMpTcb);
+		et131x_free_send_packet(etdev, tcb);
 		spin_lock_irqsave(&etdev->TCBSendQLock, flags);
 
 		/* Goto the next packet */
-		pMpTcb = etdev->TxRing.CurrSendHead;
+		tcb = etdev->tx_ring.send_head;
 	}
-	while (pMpTcb &&
-	       !((ServiceComplete ^ pMpTcb->WrIndex) & ET_DMA10_WRAP)
-	       && index > (pMpTcb->WrIndex & ET_DMA10_MASK)) {
-		etdev->TxRing.nBusySend--;
-		etdev->TxRing.CurrSendHead = pMpTcb->Next;
-		if (pMpTcb->Next == NULL)
-			etdev->TxRing.CurrSendTail = NULL;
+	while (tcb &&
+	       !((serviced ^ tcb->index) & ET_DMA10_WRAP)
+	       && index > (tcb->index & ET_DMA10_MASK)) {
+		etdev->tx_ring.used--;
+		etdev->tx_ring.send_head = tcb->next;
+		if (tcb->next == NULL)
+			etdev->tx_ring.send_tail = NULL;
 
 		spin_unlock_irqrestore(&etdev->TCBSendQLock, flags);
-		et131x_free_send_packet(etdev, pMpTcb);
+		et131x_free_send_packet(etdev, tcb);
 		spin_lock_irqsave(&etdev->TCBSendQLock, flags);
 
 		/* Goto the next packet */
-		pMpTcb = etdev->TxRing.CurrSendHead;
+		tcb = etdev->tx_ring.send_head;
 	}
 
 	/* Wake up the queue when we hit a low-water mark */
-	if (etdev->TxRing.nBusySend <= (NUM_TCB / 3))
+	if (etdev->tx_ring.used <= NUM_TCB / 3)
 		netif_wake_queue(etdev->netdev);
 
 	spin_unlock_irqrestore(&etdev->TCBSendQLock, flags);
 }
 
-/**
- * et131x_check_send_wait_list - Helper routine for the interrupt handler
- * @etdev: pointer to our adapter
- *
- * Takes packets from the send wait queue and posts them to the device (if
- * room available).
- */
-static void et131x_check_send_wait_list(struct et131x_adapter *etdev)
-{
-	unsigned long flags;
-
-	spin_lock_irqsave(&etdev->SendWaitLock, flags);
-
-	while (!list_empty(&etdev->TxRing.SendWaitQueue) &&
-				MP_TCB_RESOURCES_AVAILABLE(etdev)) {
-		struct list_head *entry;
-
-		entry = etdev->TxRing.SendWaitQueue.next;
-
-		etdev->TxRing.nWaitSend--;
-	}
-
-	spin_unlock_irqrestore(&etdev->SendWaitLock, flags);
-}
diff --git a/drivers/staging/et131x/et1310_tx.h b/drivers/staging/et131x/et1310_tx.h
index ad0372121de0..4f0ea81978f5 100644
--- a/drivers/staging/et131x/et1310_tx.h
+++ b/drivers/staging/et131x/et1310_tx.h
@@ -63,167 +63,89 @@
 /* Typedefs for Tx Descriptor Ring */
 
 /*
- * TXDESC_WORD2_t structure holds part of the control bits in the Tx Descriptor
- * ring for the ET-1310
+ * word 2 of the control bits in the Tx Descriptor ring for the ET-1310
+ *
+ * 0-15: length of packet
+ * 16-27: VLAN tag
+ * 28: VLAN CFI
+ * 29-31: VLAN priority
+ *
+ * word 3 of the control bits in the Tx Descriptor ring for the ET-1310
+ *
+ * 0: last packet in the sequence
+ * 1: first packet in the sequence
+ * 2: interrupt the processor when this pkt sent
+ * 3: Control word - no packet data
+ * 4: Issue half-duplex backpressure : XON/XOFF
+ * 5: send pause frame
+ * 6: Tx frame has error
+ * 7: append CRC
+ * 8: MAC override
+ * 9: pad packet
+ * 10: Packet is a Huge packet
+ * 11: append VLAN tag
+ * 12: IP checksum assist
+ * 13: TCP checksum assist
+ * 14: UDP checksum assist
  */
-typedef union _txdesc_word2_t {
-	u32 value;
-	struct {
-#ifdef _BIT_FIELDS_HTOL
-		u32 vlan_prio:3;		/* bits 29-31(VLAN priority) */
-		u32 vlan_cfi:1;		/* bit 28(cfi) */
-		u32 vlan_tag:12;		/* bits 16-27(VLAN tag) */
-		u32 length_in_bytes:16;	/* bits  0-15(packet length) */
-#else
-		u32 length_in_bytes:16;	/* bits  0-15(packet length) */
-		u32 vlan_tag:12;		/* bits 16-27(VLAN tag) */
-		u32 vlan_cfi:1;		/* bit 28(cfi) */
-		u32 vlan_prio:3;		/* bits 29-31(VLAN priority) */
-#endif	/* _BIT_FIELDS_HTOL */
-	} bits;
-} TXDESC_WORD2_t, *PTXDESC_WORD2_t;
 
-/*
- * TXDESC_WORD3_t structure holds part of the control bits in the Tx Descriptor
- * ring for the ET-1310
- */
-typedef union _txdesc_word3_t {
-	u32 value;
-	struct {
-#ifdef _BIT_FIELDS_HTOL
-		u32 unused:17;	/* bits 15-31 */
-		u32 udpa:1;	/* bit 14(UDP checksum assist) */
-		u32 tcpa:1;	/* bit 13(TCP checksum assist) */
-		u32 ipa:1;		/* bit 12(IP checksum assist) */
-		u32 vlan:1;	/* bit 11(append VLAN tag) */
-		u32 hp:1;		/* bit 10(Packet is a Huge packet) */
-		u32 pp:1;		/* bit  9(pad packet) */
-		u32 mac:1;		/* bit  8(MAC override) */
-		u32 crc:1;		/* bit  7(append CRC) */
-		u32 e:1;		/* bit  6(Tx frame has error) */
-		u32 pf:1;		/* bit  5(send pause frame) */
-		u32 bp:1;		/* bit  4(Issue half-duplex backpressure (XON/XOFF) */
-		u32 cw:1;		/* bit  3(Control word - no packet data) */
-		u32 ir:1;		/* bit  2(interrupt the processor when this pkt sent) */
-		u32 f:1;		/* bit  1(first packet in the sequence) */
-		u32 l:1;		/* bit  0(last packet in the sequence) */
-#else
-		u32 l:1;		/* bit  0(last packet in the sequence) */
-		u32 f:1;		/* bit  1(first packet in the sequence) */
-		u32 ir:1;		/* bit  2(interrupt the processor when this pkt sent) */
-		u32 cw:1;		/* bit  3(Control word - no packet data) */
-		u32 bp:1;		/* bit  4(Issue half-duplex backpressure (XON/XOFF) */
-		u32 pf:1;		/* bit  5(send pause frame) */
-		u32 e:1;		/* bit  6(Tx frame has error) */
-		u32 crc:1;		/* bit  7(append CRC) */
-		u32 mac:1;		/* bit  8(MAC override) */
-		u32 pp:1;		/* bit  9(pad packet) */
-		u32 hp:1;		/* bit 10(Packet is a Huge packet) */
-		u32 vlan:1;	/* bit 11(append VLAN tag) */
-		u32 ipa:1;		/* bit 12(IP checksum assist) */
-		u32 tcpa:1;	/* bit 13(TCP checksum assist) */
-		u32 udpa:1;	/* bit 14(UDP checksum assist) */
-		u32 unused:17;	/* bits 15-31 */
-#endif	/* _BIT_FIELDS_HTOL */
-	} bits;
-} TXDESC_WORD3_t, *PTXDESC_WORD3_t;
-
-/* TX_DESC_ENTRY_t is sructure representing each descriptor on the ring */
-typedef struct _tx_desc_entry_t {
-	u32 DataBufferPtrHigh;
-	u32 DataBufferPtrLow;
-	TXDESC_WORD2_t word2;	/* control words how to xmit the */
-	TXDESC_WORD3_t word3;	/* data (detailed above) */
-} TX_DESC_ENTRY_t, *PTX_DESC_ENTRY_t;
-
-
-/* Typedefs for Tx DMA engine status writeback */
+/* struct tx_desc represents each descriptor on the ring */
+struct tx_desc {
+	u32 addr_hi;
+	u32 addr_lo;
+	u32 len_vlan;	/* control words how to xmit the */
+	u32 flags;	/* data (detailed above) */
+};
 
 /*
- * TX_STATUS_BLOCK_t is sructure representing the status of the Tx DMA engine
- * it sits in free memory, and is pointed to by 0x101c / 0x1020
+ * The status of the Tx DMA engine it sits in free memory, and is pointed to
+ * by 0x101c / 0x1020. This is a DMA10 type
  */
-typedef union _tx_status_block_t {
-	u32 value;
-	struct {
-#ifdef _BIT_FIELDS_HTOL
-		u32 unused:21;		/* bits 11-31 */
-		u32 serv_cpl_wrap:1;	/* bit 10 */
-		u32 serv_cpl:10;		/* bits 0-9 */
-#else
-		u32 serv_cpl:10;		/* bits 0-9 */
-		u32 serv_cpl_wrap:1;	/* bit 10 */
-		u32 unused:21;		/* bits 11-31 */
-#endif
-	} bits;
-} TX_STATUS_BLOCK_t, *PTX_STATUS_BLOCK_t;
-
-/* TCB (Transmit Control Block) */
-typedef struct _MP_TCB {
-	struct _MP_TCB *Next;
-	u32 Flags;
-	u32 Count;
-	u32 PacketStaleCount;
-	struct sk_buff *Packet;
-	u32 PacketLength;
-	u32 WrIndex;
-	u32 WrIndexStart;
-} MP_TCB, *PMP_TCB;
-
-/* Structure to hold the skb's in a list */
-typedef struct tx_skb_list_elem {
-	struct list_head skb_list_elem;
-	struct sk_buff *skb;
-} TX_SKB_LIST_ELEM, *PTX_SKB_LIST_ELEM;
-
-/* TX_RING_t is sructure representing our local reference(s) to the ring */
-typedef struct _tx_ring_t {
+
+/* TCB (Transmit Control Block: Host Side) */
+struct tcb {
+	struct tcb *next;	/* Next entry in ring */
+	u32 flags;		/* Our flags for the packet */
+	u32 count;		/* Used to spot stuck/lost packets */
+	u32 stale;		/* Used to spot stuck/lost packets */
+	struct sk_buff *skb;	/* Network skb we are tied to */
+	u32 index;		/* Ring indexes */
+	u32 index_start;
+};
+
+/* Structure representing our local reference(s) to the ring */
+struct tx_ring {
 	/* TCB (Transmit Control Block) memory and lists */
-	PMP_TCB MpTcbMem;
+	struct tcb *tcb_ring;
 
 	/* List of TCBs that are ready to be used */
-	PMP_TCB TCBReadyQueueHead;
-	PMP_TCB TCBReadyQueueTail;
+	struct tcb *tcb_qhead;
+	struct tcb *tcb_qtail;
 
 	/* list of TCBs that are currently being sent.  NOTE that access to all
-	 * three of these (including nBusySend) are controlled via the
+	 * three of these (including used) are controlled via the
 	 * TCBSendQLock.  This lock should be secured prior to incementing /
-	 * decrementing nBusySend, or any queue manipulation on CurrSendHead /
-	 * Tail
+	 * decrementing used, or any queue manipulation on send_head /
+	 * tail
 	 */
-	PMP_TCB CurrSendHead;
-	PMP_TCB CurrSendTail;
-	int32_t nBusySend;
-
-	/* List of packets (not TCBs) that were queued for lack of resources */
-	struct list_head SendWaitQueue;
-	int32_t nWaitSend;
+	struct tcb *send_head;
+	struct tcb *send_tail;
+	int used;
 
 	/* The actual descriptor ring */
-	PTX_DESC_ENTRY_t pTxDescRingVa;
-	dma_addr_t pTxDescRingPa;
-	uint64_t pTxDescRingAdjustedPa;
-	uint64_t TxDescOffset;
+	struct tx_desc *tx_desc_ring;
+	dma_addr_t tx_desc_ring_pa;
 
-	/* ReadyToSend indicates where we last wrote to in the descriptor ring. */
-	u32 txDmaReadyToSend;
+	/* send_idx indicates where we last wrote to in the descriptor ring. */
+	u32 send_idx;
 
 	/* The location of the write-back status block */
-	PTX_STATUS_BLOCK_t pTxStatusVa;
-	dma_addr_t pTxStatusPa;
-
-	/* A Block of zeroes used to pad packets that are less than 60 bytes */
-	void *pTxDummyBlkVa;
-	dma_addr_t pTxDummyBlkPa;
-
-	TXMAC_ERR_t TxMacErr;
-
-	/* Variables to track the Tx interrupt coalescing features */
-	int32_t TxPacketsSinceLastinterrupt;
-} TX_RING_t, *PTX_RING_t;
+	u32 *tx_status;
+	dma_addr_t tx_status_pa;
 
-/* Forward declaration of the frag-list for the following prototypes */
-typedef struct _MP_FRAG_LIST MP_FRAG_LIST, *PMP_FRAG_LIST;
+	/* Packets since the last IRQ: used for interrupt coalescing */
+	int since_irq;
+};
 
 /* Forward declaration of the private adapter structure */
 struct et131x_adapter;
@@ -231,12 +153,12 @@ struct et131x_adapter;
 /* PROTOTYPES for et1310_tx.c */
 int et131x_tx_dma_memory_alloc(struct et131x_adapter *adapter);
 void et131x_tx_dma_memory_free(struct et131x_adapter *adapter);
-void ConfigTxDmaRegs(struct et131x_adapter *pAdapter);
+void ConfigTxDmaRegs(struct et131x_adapter *adapter);
 void et131x_init_send(struct et131x_adapter *adapter);
-void et131x_tx_dma_disable(struct et131x_adapter *pAdapter);
-void et131x_tx_dma_enable(struct et131x_adapter *pAdapter);
-void et131x_handle_send_interrupt(struct et131x_adapter *pAdapter);
-void et131x_free_busy_send_packets(struct et131x_adapter *pAdapter);
+void et131x_tx_dma_disable(struct et131x_adapter *adapter);
+void et131x_tx_dma_enable(struct et131x_adapter *adapter);
+void et131x_handle_send_interrupt(struct et131x_adapter *adapter);
+void et131x_free_busy_send_packets(struct et131x_adapter *adapter);
 int et131x_send_packets(struct sk_buff *skb, struct net_device *netdev);
 
 #endif /* __ET1310_TX_H__ */
diff --git a/drivers/staging/et131x/et131x_adapter.h b/drivers/staging/et131x/et131x_adapter.h
index 1dfe06f1b1a7..3f7f37a56b6c 100644
--- a/drivers/staging/et131x/et131x_adapter.h
+++ b/drivers/staging/et131x/et131x_adapter.h
@@ -100,12 +100,6 @@
 #define LO_MARK_PERCENT_FOR_PSR     15
 #define LO_MARK_PERCENT_FOR_RX      15
 
-/* Macros specific to the private adapter structure */
-#define MP_TCB_RESOURCES_AVAILABLE(_M) ((_M)->TxRing.nBusySend < NUM_TCB)
-#define MP_TCB_RESOURCES_NOT_AVAILABLE(_M) ((_M)->TxRing.nBusySend >= NUM_TCB)
-
-#define MP_SHOULD_FAIL_SEND(_M)   ((_M)->Flags & fMP_ADAPTER_FAIL_SEND_MASK)
-
 /* Counters for error rate monitoring */
 typedef struct _MP_ERR_COUNTERS {
 	u32 PktCountTxPackets;
@@ -168,7 +162,7 @@ typedef struct _ce_stats_t {
 	u32 tx_deferred;
 
 	/* Rx Statistics. */
-	u32 rx_ov_flow;	/* Rx Over Flow */
+	u32 rx_ov_flow;	/* Rx Overflow */
 
 	u32 length_err;
 	u32 alignment_err;
@@ -203,7 +197,6 @@ struct et131x_adapter {
 	spinlock_t TCBSendQLock;
 	spinlock_t TCBReadyQLock;
 	spinlock_t SendHWLock;
-	spinlock_t SendWaitLock;
 
 	spinlock_t RcvLock;
 	spinlock_t RcvPendLock;
@@ -220,9 +213,6 @@ struct et131x_adapter {
 	u32 MCAddressCount;
 	u8 MCList[NIC_MAX_MCAST_LIST][ETH_ALEN];
 
-	/* MAC test */
-	TXMAC_TXTEST_t TxMacTest;
-
 	/* Pointer to the device's PCI register space */
 	ADDRESS_MAP_t __iomem *regs;
 
@@ -234,9 +224,6 @@ struct et131x_adapter {
 	u32 RegistryRxMemEnd;	/* Size of internal rx memory */
 	u32 RegistryJumboPacket;	/* Max supported ethernet packet size */
 
-	/* Validation helpers */
-	u8 RegistryNMIDisable;
-	u8 RegistryPhyLoopbk;	/* Enable Phy loopback */
 
 	/* Derived from the registry: */
 	u8 AiForceDpx;		/* duplex setting */
@@ -248,7 +235,6 @@ struct et131x_adapter {
 		NETIF_STATUS_MEDIA_DISCONNECT,
 		NETIF_STATUS_MAX
 	} MediaState;
-	u8 DriverNoPhyAccess;
 
 	/* Minimize init-time */
 	struct timer_list ErrorTimer;
@@ -259,7 +245,7 @@ struct et131x_adapter {
 	MI_BMSR_t Bmsr;
 
 	/* Tx Memory Variables */
-	TX_RING_t TxRing;
+	struct tx_ring tx_ring;
 
 	/* Rx Memory Variables */
 	RX_RING_t RxRing;
diff --git a/drivers/staging/et131x/et131x_defs.h b/drivers/staging/et131x/et131x_defs.h
index f98dca5fd26b..d81fc77a501f 100644
--- a/drivers/staging/et131x/et131x_defs.h
+++ b/drivers/staging/et131x/et131x_defs.h
@@ -102,7 +102,6 @@
 
 /* Some offsets in PCI config space that are actually used. */
 #define ET1310_PCI_MAX_PYLD		0x4C
-#define ET1310_NMI_DISABLE		0x61
 #define ET1310_PCI_MAC_ADDRESS		0xA4
 #define ET1310_PCI_EEPROM_STATUS	0xB2
 #define ET1310_PCI_ACK_NACK		0xC0
diff --git a/drivers/staging/et131x/et131x_initpci.c b/drivers/staging/et131x/et131x_initpci.c
index 9db205667262..0892b6a538db 100644
--- a/drivers/staging/et131x/et131x_initpci.c
+++ b/drivers/staging/et131x/et131x_initpci.c
@@ -106,17 +106,6 @@
 #define PARM_SPEED_DUPLEX_MIN   0
 #define PARM_SPEED_DUPLEX_MAX   5
 
-/* Module parameter for disabling NMI
- * et131x_nmi_disable :
- * Disable NMI (0-2) [0]
- *  0 :
- *  1 :
- *  2 :
- */
-static u32 et131x_nmi_disable;	/* 0-2 */
-module_param(et131x_nmi_disable, uint, 0);
-MODULE_PARM_DESC(et131x_nmi_disable, "Disable NMI (0-2) [0]");
-
 /* Module parameter for manual speed setting
  * Set Link speed and dublex manually (0-5)  [0]
  *  1 : 10Mb   Half-Duplex
@@ -132,128 +121,88 @@ MODULE_PARM_DESC(et131x_speed_set,
 		"Set Link speed and dublex manually (0-5)  [0] \n  1 : 10Mb   Half-Duplex \n  2 : 10Mb   Full-Duplex \n  3 : 100Mb  Half-Duplex \n  4 : 100Mb  Full-Duplex \n  5 : 1000Mb Full-Duplex \n 0 : Auto Speed Auto Dublex");
 
 /**
- * et131x_find_adapter - Find the adapter and get all the assigned resources
+ * et131x_hwaddr_init - set up the MAC Address on the ET1310
  * @adapter: pointer to our private adapter structure
- *
- * Returns 0 on success, errno on failure (as defined in errno.h)
  */
-int et131x_find_adapter(struct et131x_adapter *adapter, struct pci_dev *pdev)
+void et131x_hwaddr_init(struct et131x_adapter *adapter)
 {
-	int result;
-	uint8_t eepromStat;
-	uint8_t maxPayload = 0;
-	uint8_t read_size_reg;
-	u8 rev;
-
-	/* Allow disabling of Non-Maskable Interrupts in I/O space, to
-	 * support validation.
+	/* If have our default mac from init and no mac address from
+	 * EEPROM then we need to generate the last octet and set it on the
+	 * device
 	 */
-	if (adapter->RegistryNMIDisable) {
-		uint8_t RegisterVal;
-
-		RegisterVal = inb(ET1310_NMI_DISABLE);
-		RegisterVal &= 0xf3;
-
-		if (adapter->RegistryNMIDisable == 2)
-			RegisterVal |= 0xc;
-
-		outb(ET1310_NMI_DISABLE, RegisterVal);
+	if (adapter->PermanentAddress[0] == 0x00 &&
+	    adapter->PermanentAddress[1] == 0x00 &&
+	    adapter->PermanentAddress[2] == 0x00 &&
+	    adapter->PermanentAddress[3] == 0x00 &&
+	    adapter->PermanentAddress[4] == 0x00 &&
+	    adapter->PermanentAddress[5] == 0x00) {
+		/*
+		 * We need to randomly generate the last octet so we
+		 * decrease our chances of setting the mac address to
+		 * same as another one of our cards in the system
+		 */
+		get_random_bytes(&adapter->CurrentAddress[5], 1);
+		/*
+		 * We have the default value in the register we are
+		 * working with so we need to copy the current
+		 * address into the permanent address
+		 */
+		memcpy(adapter->PermanentAddress,
+			adapter->CurrentAddress, ETH_ALEN);
+	} else {
+		/* We do not have an override address, so set the
+		 * current address to the permanent address and add
+		 * it to the device
+		 */
+		memcpy(adapter->CurrentAddress,
+		       adapter->PermanentAddress, ETH_ALEN);
 	}
+}
 
-	/* We first need to check the EEPROM Status code located at offset
-	 * 0xB2 of config space
-	 */
-	result = pci_read_config_byte(pdev, ET1310_PCI_EEPROM_STATUS,
-				      &eepromStat);
-
-	/* THIS IS A WORKAROUND:
-	 * I need to call this function twice to get my card in a
-	 * LG M1 Express Dual running. I tried also a msleep before this
-	 * function, because I thougth there could be some time condidions
-	 * but it didn't work. Call the whole function twice also work.
-	 */
-	result = pci_read_config_byte(pdev, ET1310_PCI_EEPROM_STATUS,
-				      &eepromStat);
-	if (result != PCIBIOS_SUCCESSFUL) {
-		dev_err(&pdev->dev, "Could not read PCI config space for "
-			  "EEPROM Status\n");
-		return -EIO;
-	}
 
-	/* Determine if the error(s) we care about are present.  If they are
-	 * present, we need to fail.
-	 */
-	if (eepromStat & 0x4C) {
-		result = pci_read_config_byte(pdev, PCI_REVISION_ID, &rev);
-		if (result != PCIBIOS_SUCCESSFUL) {
-			dev_err(&pdev->dev,
-				  "Could not read PCI config space for "
-				  "Revision ID\n");
-			return -EIO;
-		} else if (rev == 0x01) {
-			int32_t nLoop;
-			uint8_t temp[4] = { 0xFE, 0x13, 0x10, 0xFF };
-
-			/* Re-write the first 4 bytes if we have an eeprom
-			 * present and the revision id is 1, this fixes the
-			 * corruption seen with 1310 B Silicon
-			 */
-			for (nLoop = 0; nLoop < 3; nLoop++) {
-				EepromWriteByte(adapter, nLoop, temp[nLoop]);
-			}
-		}
+/**
+ * et131x_pci_init	 - initial PCI setup
+ * @adapter: pointer to our private adapter structure
+ * @pdev: our PCI device
+ *
+ * Perform the initial setup of PCI registers and if possible initialise
+ * the MAC address. At this point the I/O registers have yet to be mapped
+ */
 
-		dev_err(&pdev->dev, "Fatal EEPROM Status Error - 0x%04x\n", eepromStat);
+static int et131x_pci_init(struct et131x_adapter *adapter,
+						struct pci_dev *pdev)
+{
+	int i;
+	u8 max_payload;
+	u8 read_size_reg;
 
-		/* This error could mean that there was an error reading the
-		 * eeprom or that the eeprom doesn't exist.  We will treat
-		 * each case the same and not try to gather additional
-		 * information that normally would come from the eeprom, like
-		 * MAC Address
-		 */
-		adapter->has_eeprom = 0;
+	if (et131x_init_eeprom(adapter) < 0)
 		return -EIO;
-	} else
-		adapter->has_eeprom = 1;
-
-	/* Read the EEPROM for information regarding LED behavior. Refer to
-	 * ET1310_phy.c, et131x_xcvr_init(), for its use.
-	 */
-	EepromReadByte(adapter, 0x70, &adapter->eepromData[0]);
-	EepromReadByte(adapter, 0x71, &adapter->eepromData[1]);
-
-	if (adapter->eepromData[0] != 0xcd)
-		/* Disable all optional features */
-		adapter->eepromData[1] = 0x00;
 
 	/* Let's set up the PORT LOGIC Register.  First we need to know what
 	 * the max_payload_size is
 	 */
-	result = pci_read_config_byte(pdev, ET1310_PCI_MAX_PYLD, &maxPayload);
-	if (result != PCIBIOS_SUCCESSFUL) {
+	if (pci_read_config_byte(pdev, ET1310_PCI_MAX_PYLD, &max_payload)) {
 		dev_err(&pdev->dev,
 		    "Could not read PCI config space for Max Payload Size\n");
 		return -EIO;
 	}
 
 	/* Program the Ack/Nak latency and replay timers */
-	maxPayload &= 0x07;	/* Only the lower 3 bits are valid */
+	max_payload &= 0x07;	/* Only the lower 3 bits are valid */
 
-	if (maxPayload < 2) {
-		const uint16_t AckNak[2] = { 0x76, 0xD0 };
-		const uint16_t Replay[2] = { 0x1E0, 0x2ED };
+	if (max_payload < 2) {
+		static const u16 AckNak[2] = { 0x76, 0xD0 };
+		static const u16 Replay[2] = { 0x1E0, 0x2ED };
 
-		result = pci_write_config_word(pdev, ET1310_PCI_ACK_NACK,
-					       AckNak[maxPayload]);
-		if (result != PCIBIOS_SUCCESSFUL) {
+		if (pci_write_config_word(pdev, ET1310_PCI_ACK_NACK,
+					       AckNak[max_payload])) {
 			dev_err(&pdev->dev,
 			  "Could not write PCI config space for ACK/NAK\n");
 			return -EIO;
 		}
-
-		result = pci_write_config_word(pdev, ET1310_PCI_REPLAY,
-					       Replay[maxPayload]);
-		if (result != PCIBIOS_SUCCESSFUL) {
+		if (pci_write_config_word(pdev, ET1310_PCI_REPLAY,
+					       Replay[max_payload])) {
 			dev_err(&pdev->dev,
 			  "Could not write PCI config space for Replay Timer\n");
 			return -EIO;
@@ -263,16 +212,14 @@ int et131x_find_adapter(struct et131x_adapter *adapter, struct pci_dev *pdev)
 	/* l0s and l1 latency timers.  We are using default values.
 	 * Representing 001 for L0s and 010 for L1
 	 */
-	result = pci_write_config_byte(pdev, ET1310_PCI_L0L1LATENCY, 0x11);
-	if (result != PCIBIOS_SUCCESSFUL) {
+	if (pci_write_config_byte(pdev, ET1310_PCI_L0L1LATENCY, 0x11)) {
 		dev_err(&pdev->dev,
 		  "Could not write PCI config space for Latency Timers\n");
 		return -EIO;
 	}
 
 	/* Change the max read size to 2k */
-	result = pci_read_config_byte(pdev, 0x51, &read_size_reg);
-	if (result != PCIBIOS_SUCCESSFUL) {
+	if (pci_read_config_byte(pdev, 0x51, &read_size_reg)) {
 		dev_err(&pdev->dev,
 			"Could not read PCI config space for Max read size\n");
 		return -EIO;
@@ -281,8 +228,7 @@ int et131x_find_adapter(struct et131x_adapter *adapter, struct pci_dev *pdev)
 	read_size_reg &= 0x8f;
 	read_size_reg |= 0x40;
 
-	result = pci_write_config_byte(pdev, 0x51, read_size_reg);
-	if (result != PCIBIOS_SUCCESSFUL) {
+	if (pci_write_config_byte(pdev, 0x51, read_size_reg)) {
 		dev_err(&pdev->dev,
 		      "Could not write PCI config space for Max read size\n");
 		return -EIO;
@@ -291,19 +237,19 @@ int et131x_find_adapter(struct et131x_adapter *adapter, struct pci_dev *pdev)
 	/* Get MAC address from config space if an eeprom exists, otherwise
 	 * the MAC address there will not be valid
 	 */
-	if (adapter->has_eeprom) {
-		int i;
-
-		for (i = 0; i < ETH_ALEN; i++) {
-			result = pci_read_config_byte(
-					pdev, ET1310_PCI_MAC_ADDRESS + i,
-					adapter->PermanentAddress + i);
-			if (result != PCIBIOS_SUCCESSFUL) {
-				dev_err(&pdev->dev, ";Could not read PCI config space for MAC address\n");
-				return -EIO;
-			}
+	if (!adapter->has_eeprom) {
+		et131x_hwaddr_init(adapter);
+		return 0;
+	}
+
+	for (i = 0; i < ETH_ALEN; i++) {
+		if (pci_read_config_byte(pdev, ET1310_PCI_MAC_ADDRESS + i,
+					adapter->PermanentAddress + i)) {
+			dev_err(&pdev->dev, "Could not read PCI config space for MAC address\n");
+			return -EIO;
 		}
 	}
+	memcpy(adapter->CurrentAddress, adapter->PermanentAddress, ETH_ALEN);
 	return 0;
 }
 
@@ -383,52 +329,34 @@ void ConfigGlobalRegs(struct et131x_adapter *etdev)
 {
 	struct _GLOBAL_t __iomem *regs = &etdev->regs->global;
 
-	if (etdev->RegistryPhyLoopbk == false) {
-		if (etdev->RegistryJumboPacket < 2048) {
-			/* Tx / RxDMA and Tx/Rx MAC interfaces have a 1k word
-			 * block of RAM that the driver can split between Tx
-			 * and Rx as it desires.  Our default is to split it
-			 * 50/50:
-			 */
-			writel(0, &regs->rxq_start_addr);
-			writel(PARM_RX_MEM_END_DEF, &regs->rxq_end_addr);
-			writel(PARM_RX_MEM_END_DEF + 1, &regs->txq_start_addr);
-			writel(INTERNAL_MEM_SIZE - 1, &regs->txq_end_addr);
-		} else if (etdev->RegistryJumboPacket < 8192) {
-			/* For jumbo packets > 2k but < 8k, split 50-50. */
-			writel(0, &regs->rxq_start_addr);
-			writel(INTERNAL_MEM_RX_OFFSET, &regs->rxq_end_addr);
-			writel(INTERNAL_MEM_RX_OFFSET + 1, &regs->txq_start_addr);
-			writel(INTERNAL_MEM_SIZE - 1, &regs->txq_end_addr);
-		} else {
-			/* 9216 is the only packet size greater than 8k that
-			 * is available. The Tx buffer has to be big enough
-			 * for one whole packet on the Tx side. We'll make
-			 * the Tx 9408, and give the rest to Rx
-			 */
-			writel(0x0000, &regs->rxq_start_addr);
-			writel(0x01b3, &regs->rxq_end_addr);
-			writel(0x01b4, &regs->txq_start_addr);
-			writel(INTERNAL_MEM_SIZE - 1,&regs->txq_end_addr);
-		}
+	writel(0, &regs->rxq_start_addr);
+	writel(INTERNAL_MEM_SIZE - 1, &regs->txq_end_addr);
 
-		/* Initialize the loopback register. Disable all loopbacks. */
-		writel(0, &regs->loopback);
+	if (etdev->RegistryJumboPacket < 2048) {
+		/* Tx / RxDMA and Tx/Rx MAC interfaces have a 1k word
+		 * block of RAM that the driver can split between Tx
+		 * and Rx as it desires.  Our default is to split it
+		 * 50/50:
+		 */
+		writel(PARM_RX_MEM_END_DEF, &regs->rxq_end_addr);
+		writel(PARM_RX_MEM_END_DEF + 1, &regs->txq_start_addr);
+	} else if (etdev->RegistryJumboPacket < 8192) {
+		/* For jumbo packets > 2k but < 8k, split 50-50. */
+		writel(INTERNAL_MEM_RX_OFFSET, &regs->rxq_end_addr);
+		writel(INTERNAL_MEM_RX_OFFSET + 1, &regs->txq_start_addr);
 	} else {
-		/* For PHY Line loopback, the memory is configured as if Tx
-		 * and Rx both have all the memory.  This is because the
-		 * RxMAC will write data into the space, and the TxMAC will
-		 * read it out.
+		/* 9216 is the only packet size greater than 8k that
+		 * is available. The Tx buffer has to be big enough
+		 * for one whole packet on the Tx side. We'll make
+		 * the Tx 9408, and give the rest to Rx
 		 */
-		writel(0, &regs->rxq_start_addr);
-		writel(INTERNAL_MEM_SIZE - 1, &regs->rxq_end_addr);
-		writel(0, &regs->txq_start_addr);
-		writel(INTERNAL_MEM_SIZE - 1, &regs->txq_end_addr);
-
-		/* Initialize the loopback register (MAC loopback). */
-		writel(ET_LOOP_MAC, &regs->loopback);
+		writel(0x01b3, &regs->rxq_end_addr);
+		writel(0x01b4, &regs->txq_start_addr);
 	}
 
+	/* Initialize the loopback register. Disable all loopbacks. */
+	writel(0, &regs->loopback);
+
 	/* MSI Register */
 	writel(0, &regs->msi_config);
 
@@ -498,57 +426,18 @@ int et131x_adapter_setup(struct et131x_adapter *etdev)
 }
 
 /**
- * et131x_setup_hardware_properties - set up the MAC Address on the ET1310
- * @adapter: pointer to our private adapter structure
- */
-void et131x_setup_hardware_properties(struct et131x_adapter *adapter)
-{
-	/* If have our default mac from registry and no mac address from
-	 * EEPROM then we need to generate the last octet and set it on the
-	 * device
-	 */
-	if (adapter->PermanentAddress[0] == 0x00 &&
-	    adapter->PermanentAddress[1] == 0x00 &&
-	    adapter->PermanentAddress[2] == 0x00 &&
-	    adapter->PermanentAddress[3] == 0x00 &&
-	    adapter->PermanentAddress[4] == 0x00 &&
-	    adapter->PermanentAddress[5] == 0x00) {
-		/*
-		 * We need to randomly generate the last octet so we
-		 * decrease our chances of setting the mac address to
-		 * same as another one of our cards in the system
-		 */
-		get_random_bytes(&adapter->CurrentAddress[5], 1);
-		/*
-		 * We have the default value in the register we are
-		 * working with so we need to copy the current
-		 * address into the permanent address
-		 */
-		memcpy(adapter->PermanentAddress,
-			adapter->CurrentAddress, ETH_ALEN);
-	} else {
-		/* We do not have an override address, so set the
-		 * current address to the permanent address and add
-		 * it to the device
-		 */
-		memcpy(adapter->CurrentAddress,
-		       adapter->PermanentAddress, ETH_ALEN);
-	}
-}
-
-/**
  * et131x_soft_reset - Issue a soft reset to the hardware, complete for ET1310
  * @adapter: pointer to our private adapter structure
  */
 void et131x_soft_reset(struct et131x_adapter *adapter)
 {
 	/* Disable MAC Core */
-	writel(0xc00f0000, &adapter->regs->mac.cfg1.value);
+	writel(0xc00f0000, &adapter->regs->mac.cfg1);
 
 	/* Set everything to a reset value */
 	writel(0x7F, &adapter->regs->global.sw_reset);
-	writel(0x000f0000, &adapter->regs->mac.cfg1.value);
-	writel(0x00000000, &adapter->regs->mac.cfg1.value);
+	writel(0x000f0000, &adapter->regs->mac.cfg1);
+	writel(0x00000000, &adapter->regs->mac.cfg1);
 }
 
 /**
@@ -588,36 +477,32 @@ void et131x_align_allocated_memory(struct et131x_adapter *adapter,
  */
 int et131x_adapter_memory_alloc(struct et131x_adapter *adapter)
 {
-	int status = 0;
-
-	do {
-		/* Allocate memory for the Tx Ring */
-		status = et131x_tx_dma_memory_alloc(adapter);
-		if (status != 0) {
-			dev_err(&adapter->pdev->dev,
-				  "et131x_tx_dma_memory_alloc FAILED\n");
-			break;
-		}
+	int status;
 
-		/* Receive buffer memory allocation */
-		status = et131x_rx_dma_memory_alloc(adapter);
-		if (status != 0) {
-			dev_err(&adapter->pdev->dev,
-				  "et131x_rx_dma_memory_alloc FAILED\n");
-			et131x_tx_dma_memory_free(adapter);
-			break;
-		}
+	/* Allocate memory for the Tx Ring */
+	status = et131x_tx_dma_memory_alloc(adapter);
+	if (status != 0) {
+		dev_err(&adapter->pdev->dev,
+			  "et131x_tx_dma_memory_alloc FAILED\n");
+		return status;
+	}
+	/* Receive buffer memory allocation */
+	status = et131x_rx_dma_memory_alloc(adapter);
+	if (status != 0) {
+		dev_err(&adapter->pdev->dev,
+			  "et131x_rx_dma_memory_alloc FAILED\n");
+		et131x_tx_dma_memory_free(adapter);
+		return status;
+	}
 
-		/* Init receive data structures */
-		status = et131x_init_recv(adapter);
-		if (status != 0) {
-			dev_err(&adapter->pdev->dev,
-				"et131x_init_recv FAILED\n");
-			et131x_tx_dma_memory_free(adapter);
-			et131x_rx_dma_memory_free(adapter);
-			break;
-		}
-	} while (0);
+	/* Init receive data structures */
+	status = et131x_init_recv(adapter);
+	if (status != 0) {
+		dev_err(&adapter->pdev->dev,
+			"et131x_init_recv FAILED\n");
+		et131x_tx_dma_memory_free(adapter);
+		et131x_rx_dma_memory_free(adapter);
+	}
 	return status;
 }
 
@@ -632,22 +517,50 @@ void et131x_adapter_memory_free(struct et131x_adapter *adapter)
 	et131x_rx_dma_memory_free(adapter);
 }
 
+
+
 /**
- * et131x_config_parse
+ * et131x_adapter_init
  * @etdev: pointer to the private adapter struct
+ * @pdev: pointer to the PCI device
  *
- * Parses a configuration from some location (module parameters, for example)
- * into the private adapter struct. This really has no sensible analogy in
- * Linux as sysfs parameters are dynamic. Several things that were hee could
- * go into sysfs, but other stuff like speed handling is part of the mii
- * interfaces/ethtool.
+ * Initialize the data structures for the et131x_adapter object and link
+ * them together with the platform provided device structures.
  */
-void et131x_config_parse(struct et131x_adapter *etdev)
+
+
+static struct et131x_adapter *et131x_adapter_init(struct net_device *netdev,
+		struct pci_dev *pdev)
 {
 	static const u8 default_mac[] = { 0x00, 0x05, 0x3d, 0x00, 0x02, 0x00 };
 	static const u8 duplex[] = { 0, 1, 2, 1, 2, 2 };
 	static const u16 speed[] = { 0, 10, 10, 100, 100, 1000 };
 
+	struct et131x_adapter *etdev;
+
+	/* Setup the fundamental net_device and private adapter structure elements  */
+	SET_NETDEV_DEV(netdev, &pdev->dev);
+
+	/* Allocate private adapter struct and copy in relevant information */
+	etdev = netdev_priv(netdev);
+	etdev->pdev = pci_dev_get(pdev);
+	etdev->netdev = netdev;
+
+	/* Do the same for the netdev struct */
+	netdev->irq = pdev->irq;
+	netdev->base_addr = pci_resource_start(pdev, 0);
+
+	/* Initialize spinlocks here */
+	spin_lock_init(&etdev->Lock);
+	spin_lock_init(&etdev->TCBSendQLock);
+	spin_lock_init(&etdev->TCBReadyQLock);
+	spin_lock_init(&etdev->SendHWLock);
+	spin_lock_init(&etdev->RcvLock);
+	spin_lock_init(&etdev->RcvPendLock);
+	spin_lock_init(&etdev->FbrLock);
+	spin_lock_init(&etdev->PHYLock);
+
+	/* Parse configuration parameters into the private adapter struct */
 	if (et131x_speed_set)
 		dev_info(&etdev->pdev->dev,
 			"Speed set manually to : %d \n", et131x_speed_set);
@@ -655,8 +568,6 @@ void et131x_config_parse(struct et131x_adapter *etdev)
 	etdev->SpeedDuplex = et131x_speed_set;
 	etdev->RegistryJumboPacket = 1514;	/* 1514-9216 */
 
-	etdev->RegistryNMIDisable = et131x_nmi_disable;
-
 	/* Set the MAC address to a default */
 	memcpy(etdev->CurrentAddress, default_mac, ETH_ALEN);
 
@@ -674,40 +585,10 @@ void et131x_config_parse(struct et131x_adapter *etdev)
 
 	etdev->AiForceSpeed = speed[etdev->SpeedDuplex];
 	etdev->AiForceDpx = duplex[etdev->SpeedDuplex];	/* Auto FDX */
-}
-
-
-/**
- * et131x_pci_remove
- * @pdev: a pointer to the device's pci_dev structure
- *
- * Registered in the pci_driver structure, this function is called when the
- * PCI subsystem detects that a PCI device which matches the information
- * contained in the pci_device_id table has been removed.
- */
-
-void __devexit et131x_pci_remove(struct pci_dev *pdev)
-{
-	struct net_device *netdev;
-	struct et131x_adapter *adapter;
 
-	/* Retrieve the net_device pointer from the pci_dev struct, as well
-	 * as the private adapter struct
-	 */
-	netdev = (struct net_device *) pci_get_drvdata(pdev);
-	adapter = netdev_priv(netdev);
-
-	/* Perform device cleanup */
-	unregister_netdev(netdev);
-	et131x_adapter_memory_free(adapter);
-	iounmap(adapter->regs);
-	pci_dev_put(adapter->pdev);
-	free_netdev(netdev);
-	pci_release_regions(pdev);
-	pci_disable_device(pdev);
+	return etdev;
 }
 
-
 /**
  * et131x_pci_setup - Perform device initialization
  * @pdev: a pointer to the device's pci_dev structure
@@ -721,34 +602,31 @@ void __devexit et131x_pci_remove(struct pci_dev *pdev)
  * a device insertion routine.
  */
 
-int __devinit et131x_pci_setup(struct pci_dev *pdev,
+static int __devinit et131x_pci_setup(struct pci_dev *pdev,
 			       const struct pci_device_id *ent)
 {
-	int result = 0;
+	int result = -EBUSY;
 	int pm_cap;
 	bool pci_using_dac;
-	struct net_device *netdev = NULL;
-	struct et131x_adapter *adapter = NULL;
+	struct net_device *netdev;
+	struct et131x_adapter *adapter;
 
 	/* Enable the device via the PCI subsystem */
-	result = pci_enable_device(pdev);
-	if (result != 0) {
-		dev_err(&adapter->pdev->dev,
+	if (pci_enable_device(pdev) != 0) {
+		dev_err(&pdev->dev,
 			"pci_enable_device() failed\n");
-		goto out;
+		return -EIO;
 	}
 
 	/* Perform some basic PCI checks */
 	if (!(pci_resource_flags(pdev, 0) & IORESOURCE_MEM)) {
-		dev_err(&adapter->pdev->dev,
+		dev_err(&pdev->dev,
 			  "Can't find PCI device's base address\n");
-		result = -ENODEV;
-		goto out;
+		goto err_disable;
 	}
 
-	result = pci_request_regions(pdev, DRIVER_NAME);
-	if (result != 0) {
-		dev_err(&adapter->pdev->dev,
+	if (pci_request_regions(pdev, DRIVER_NAME)) {
+		dev_err(&pdev->dev,
 			"Can't get PCI resources\n");
 		goto err_disable;
 	}
@@ -763,27 +641,26 @@ int __devinit et131x_pci_setup(struct pci_dev *pdev,
 	 */
 	pm_cap = pci_find_capability(pdev, PCI_CAP_ID_PM);
 	if (pm_cap == 0) {
-		dev_err(&adapter->pdev->dev,
+		dev_err(&pdev->dev,
 			  "Cannot find Power Management capabilities\n");
 		result = -EIO;
 		goto err_release_res;
 	}
 
 	/* Check the DMA addressing support of this device */
-	if (!pci_set_dma_mask(pdev, 0xffffffffffffffffULL)) {
+	if (!pci_set_dma_mask(pdev, DMA_BIT_MASK(64))) {
 		pci_using_dac = true;
 
-		result =
-		    pci_set_consistent_dma_mask(pdev, 0xffffffffffffffffULL);
+		result = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64));
 		if (result != 0) {
 			dev_err(&pdev->dev,
 				  "Unable to obtain 64 bit DMA for consistent allocations\n");
 			goto err_release_res;
 		}
-	} else if (!pci_set_dma_mask(pdev, 0xffffffffULL)) {
+	} else if (!pci_set_dma_mask(pdev, DMA_BIT_MASK(32))) {
 		pci_using_dac = false;
 	} else {
-		dev_err(&adapter->pdev->dev,
+		dev_err(&pdev->dev,
 			"No usable DMA addressing method\n");
 		result = -EIO;
 		goto err_release_res;
@@ -792,87 +669,22 @@ int __devinit et131x_pci_setup(struct pci_dev *pdev,
 	/* Allocate netdev and private adapter structs */
 	netdev = et131x_device_alloc();
 	if (netdev == NULL) {
-		dev_err(&adapter->pdev->dev,
-			"Couldn't alloc netdev struct\n");
+		dev_err(&pdev->dev, "Couldn't alloc netdev struct\n");
 		result = -ENOMEM;
 		goto err_release_res;
 	}
-
-	/* Setup the fundamental net_device and private adapter structure elements  */
-	SET_NETDEV_DEV(netdev, &pdev->dev);
-	/*
-	if (pci_using_dac) {
-		netdev->features |= NETIF_F_HIGHDMA;
-	}
-	*/
-
-	/*
-	 * NOTE - Turn this on when we're ready to deal with SG-DMA
-	 *
-	 * NOTE: According to "Linux Device Drivers", 3rd ed, Rubini et al,
-	 * if checksumming is not performed in HW, then the kernel will not
-	 * use SG.
-	 * From pp 510-511:
-	 *
-	 * "Note that the kernel does not perform scatter/gather I/O to your
-	 * device if it does not also provide some form of checksumming as
-	 * well. The reason is that, if the kernel has to make a pass over a
-	 * fragmented ("nonlinear") packet to calculate the checksum, it
-	 * might as well copy the data and coalesce the packet at the same
-	 * time."
-	 *
-	 * This has been verified by setting the flags below and still not
-	 * receiving a scattered buffer from the network stack, so leave it
-	 * off until checksums are calculated in HW.
-	 */
-	/* netdev->features |= NETIF_F_SG; */
-	/* netdev->features |= NETIF_F_NO_CSUM; */
-	/* netdev->features |= NETIF_F_LLTX; */
-
-	/* Allocate private adapter struct and copy in relevant information */
-	adapter = netdev_priv(netdev);
-	adapter->pdev = pci_dev_get(pdev);
-	adapter->netdev = netdev;
-
-	/* Do the same for the netdev struct */
-	netdev->irq = pdev->irq;
-	netdev->base_addr = pdev->resource[0].start;
-
-	/* Initialize spinlocks here */
-	spin_lock_init(&adapter->Lock);
-	spin_lock_init(&adapter->TCBSendQLock);
-	spin_lock_init(&adapter->TCBReadyQLock);
-	spin_lock_init(&adapter->SendHWLock);
-	spin_lock_init(&adapter->SendWaitLock);
-	spin_lock_init(&adapter->RcvLock);
-	spin_lock_init(&adapter->RcvPendLock);
-	spin_lock_init(&adapter->FbrLock);
-	spin_lock_init(&adapter->PHYLock);
-
-	/* Parse configuration parameters into the private adapter struct */
-	et131x_config_parse(adapter);
-
-	/* Find the physical adapter
-	 *
-	 * NOTE: This is the equivalent of the MpFindAdapter() routine; can we
-	 *       lump it's init with the device specific init below into a
-	 *       single init function?
-	 */
-	/* while (et131x_find_adapter(adapter, pdev) != 0); */
-	et131x_find_adapter(adapter, pdev);
+	adapter = et131x_adapter_init(netdev, pdev);
+	/* Initialise the PCI setup for the device */
+	et131x_pci_init(adapter, pdev);
 
 	/* Map the bus-relative registers to system virtual memory */
-
-	adapter->regs = ioremap_nocache(pci_resource_start(pdev, 0),
-					      pci_resource_len(pdev, 0));
+	adapter->regs = pci_ioremap_bar(pdev, 0);
 	if (adapter->regs == NULL) {
 		dev_err(&pdev->dev, "Cannot map device registers\n");
 		result = -ENOMEM;
 		goto err_free_dev;
 	}
 
-	/* Perform device-specific initialization here (See code below) */
-
 	/* If Phy COMA mode was enabled when we went down, disable it here. */
 	writel(ET_PMCSR_INIT,  &adapter->regs->global.pm_csr);
 
@@ -892,20 +704,12 @@ int __devinit et131x_pci_setup(struct pci_dev *pdev,
 	/* Init send data structures */
 	et131x_init_send(adapter);
 
-	/* Register the interrupt
-	 *
-	 * NOTE - This is being done in the open routine, where most other
-	 *         Linux drivers setup IRQ handlers. Make sure device
-	 *         interrupts are not turned on before the IRQ is registered!!
-	 *
-	 *         What we will do here is setup the task structure for the
-	 *         ISR's deferred handler
+	/*
+	 * Set up the task structure for the ISR's deferred handler
 	 */
 	INIT_WORK(&adapter->task, et131x_isr_handler);
 
-	/* Determine MAC Address, and copy into the net_device struct */
-	et131x_setup_hardware_properties(adapter);
-
+	/* Copy address into the net_device struct */
 	memcpy(netdev->dev_addr, adapter->CurrentAddress, ETH_ALEN);
 
 	/* Setup et1310 as per the documentation */
@@ -944,10 +748,7 @@ int __devinit et131x_pci_setup(struct pci_dev *pdev,
 	 * been initialized, just in case it needs to be quickly restored.
 	 */
 	pci_set_drvdata(pdev, netdev);
-
 	pci_save_state(adapter->pdev);
-
-out:
 	return result;
 
 err_mem_free:
@@ -961,7 +762,37 @@ err_release_res:
 	pci_release_regions(pdev);
 err_disable:
 	pci_disable_device(pdev);
-	goto out;
+	return result;
+}
+
+/**
+ * et131x_pci_remove
+ * @pdev: a pointer to the device's pci_dev structure
+ *
+ * Registered in the pci_driver structure, this function is called when the
+ * PCI subsystem detects that a PCI device which matches the information
+ * contained in the pci_device_id table has been removed.
+ */
+
+static void __devexit et131x_pci_remove(struct pci_dev *pdev)
+{
+	struct net_device *netdev;
+	struct et131x_adapter *adapter;
+
+	/* Retrieve the net_device pointer from the pci_dev struct, as well
+	 * as the private adapter struct
+	 */
+	netdev = (struct net_device *) pci_get_drvdata(pdev);
+	adapter = netdev_priv(netdev);
+
+	/* Perform device cleanup */
+	unregister_netdev(netdev);
+	et131x_adapter_memory_free(adapter);
+	iounmap(adapter->regs);
+	pci_dev_put(adapter->pdev);
+	free_netdev(netdev);
+	pci_release_regions(pdev);
+	pci_disable_device(pdev);
 }
 
 static struct pci_device_id et131x_pci_table[] __devinitdata = {
@@ -989,7 +820,7 @@ static struct pci_driver et131x_driver = {
  *
  * Returns 0 on success, errno on failure (as defined in errno.h)
  */
-static int et131x_init_module(void)
+static int __init et131x_init_module(void)
 {
 	if (et131x_speed_set < PARM_SPEED_DUPLEX_MIN ||
 	    et131x_speed_set > PARM_SPEED_DUPLEX_MAX) {
@@ -1002,7 +833,7 @@ static int et131x_init_module(void)
 /**
  * et131x_cleanup_module - The entry point called on driver cleanup
  */
-static void et131x_cleanup_module(void)
+static void __exit et131x_cleanup_module(void)
 {
 	pci_unregister_driver(&et131x_driver);
 }
@@ -1010,7 +841,6 @@ static void et131x_cleanup_module(void)
 module_init(et131x_init_module);
 module_exit(et131x_cleanup_module);
 
-
 /* Modinfo parameters (filled out using defines from et131x_version.h) */
 MODULE_AUTHOR(DRIVER_AUTHOR);
 MODULE_DESCRIPTION(DRIVER_INFO);
diff --git a/drivers/staging/et131x/et131x_initpci.h b/drivers/staging/et131x/et131x_initpci.h
index 8131d6a65c2a..7269569a874b 100644
--- a/drivers/staging/et131x/et131x_initpci.h
+++ b/drivers/staging/et131x/et131x_initpci.h
@@ -67,7 +67,7 @@ void et131x_align_allocated_memory(struct et131x_adapter *adapter,
 int et131x_adapter_setup(struct et131x_adapter *adapter);
 int et131x_adapter_memory_alloc(struct et131x_adapter *adapter);
 void et131x_adapter_memory_free(struct et131x_adapter *adapter);
-void et131x_setup_hardware_properties(struct et131x_adapter *adapter);
+void et131x_hwaddr_init(struct et131x_adapter *adapter);
 void et131x_soft_reset(struct et131x_adapter *adapter);
 
 #endif /* __ET131X_INITPCI_H__ */
diff --git a/drivers/staging/et131x/et131x_isr.c b/drivers/staging/et131x/et131x_isr.c
index f80189d7cb6d..f6d452dd14e2 100644
--- a/drivers/staging/et131x/et131x_isr.c
+++ b/drivers/staging/et131x/et131x_isr.c
@@ -109,9 +109,6 @@ void et131x_enable_interrupts(struct et131x_adapter *adapter)
 	else
 		mask = INT_MASK_ENABLE_NO_FLOW;
 
-	if (adapter->DriverNoPhyAccess)
-		mask |= ET_INTR_PHY;
-
 	adapter->CachedMaskValue = mask;
 	writel(mask, &adapter->regs->global.int_mask);
 }
@@ -182,15 +179,15 @@ irqreturn_t et131x_isr(int irq, void *dev_id)
 	/* This is our interrupt, so process accordingly */
 
 	if (status & ET_INTR_WATCHDOG) {
-		PMP_TCB pMpTcb = adapter->TxRing.CurrSendHead;
+		struct tcb *tcb = adapter->tx_ring.send_head;
 
-		if (pMpTcb)
-			if (++pMpTcb->PacketStaleCount > 1)
+		if (tcb)
+			if (++tcb->stale > 1)
 				status |= ET_INTR_TXDMA_ISR;
 
 		if (adapter->RxRing.UnfinishedReceives)
 			status |= ET_INTR_RXDMA_XFR_DONE;
-		else if (pMpTcb == NULL)
+		else if (tcb == NULL)
 			writel(0, &adapter->regs->global.watchdog_timer);
 
 		status &= ~ET_INTR_WATCHDOG;
@@ -290,17 +287,12 @@ void et131x_isr_handler(struct work_struct *work)
 				u32 pm_csr;
 
 				/* Tell the device to send a pause packet via
-				 * the back pressure register
+				 * the back pressure register (bp req  and
+				 * bp xon/xoff)
 				 */
 				pm_csr = readl(&iomem->global.pm_csr);
-				if ((pm_csr & ET_PM_PHY_SW_COMA) == 0) {
-					TXMAC_BP_CTRL_t bp_ctrl = { 0 };
-
-					bp_ctrl.bits.bp_req = 1;
-					bp_ctrl.bits.bp_xonxoff = 1;
-					writel(bp_ctrl.value,
-					       &iomem->txmac.bp_ctrl.value);
-				}
+				if ((pm_csr & ET_PM_PHY_SW_COMA) == 0)
+					writel(3, &iomem->txmac.bp_ctrl);
 			}
 		}
 
@@ -340,11 +332,9 @@ void et131x_isr_handler(struct work_struct *work)
 			 */
 			/* TRAP();*/
 
-			etdev->TxMacTest.value =
-				readl(&iomem->txmac.tx_test.value);
 			dev_warn(&etdev->pdev->dev,
 				    "RxDMA_ERR interrupt, error %x\n",
-				    etdev->TxMacTest.value);
+				    readl(&iomem->txmac.tx_test));
 		}
 
 		/* Handle the Wake on LAN Event */
@@ -400,8 +390,7 @@ void et131x_isr_handler(struct work_struct *work)
 
 		/* Let's move on to the TxMac */
 		if (status & ET_INTR_TXMAC) {
-			etdev->TxRing.TxMacErr.value =
-				readl(&iomem->txmac.err.value);
+			u32 err = readl(&iomem->txmac.err.value);
 
 			/*
 			 * When any of the errors occur and TXMAC generates
@@ -415,7 +404,7 @@ void et131x_isr_handler(struct work_struct *work)
 			 */
 			dev_warn(&etdev->pdev->dev,
 				    "TXMAC interrupt, error 0x%08x\n",
-				    etdev->TxRing.TxMacErr.value);
+				    err);
 
 			/* If we are debugging, we want to see this error,
 			 * otherwise we just want the device to be reset and
diff --git a/drivers/staging/et131x/et131x_netdev.c b/drivers/staging/et131x/et131x_netdev.c
index 8c7612f63f91..24d97b4fa6fb 100644
--- a/drivers/staging/et131x/et131x_netdev.c
+++ b/drivers/staging/et131x/et131x_netdev.c
@@ -519,7 +519,7 @@ int et131x_tx(struct sk_buff *skb, struct net_device *netdev)
 void et131x_tx_timeout(struct net_device *netdev)
 {
 	struct et131x_adapter *etdev = netdev_priv(netdev);
-	PMP_TCB pMpTcb;
+	struct tcb *tcb;
 	unsigned long flags;
 
 	/* Just skip this part if the adapter is doing link detection */
@@ -541,28 +541,19 @@ void et131x_tx_timeout(struct net_device *netdev)
 	/* Is send stuck? */
 	spin_lock_irqsave(&etdev->TCBSendQLock, flags);
 
-	pMpTcb = etdev->TxRing.CurrSendHead;
+	tcb = etdev->tx_ring.send_head;
 
-	if (pMpTcb != NULL) {
-		pMpTcb->Count++;
-
-		if (pMpTcb->Count > NIC_SEND_HANG_THRESHOLD) {
-			TX_DESC_ENTRY_t StuckDescriptors[10];
-
-			if (INDEX10(pMpTcb->WrIndex) > 7) {
-				memcpy(StuckDescriptors,
-				       etdev->TxRing.pTxDescRingVa +
-				       INDEX10(pMpTcb->WrIndex) - 6,
-				       sizeof(TX_DESC_ENTRY_t) * 10);
-			}
+	if (tcb != NULL) {
+		tcb->count++;
 
+		if (tcb->count > NIC_SEND_HANG_THRESHOLD) {
 			spin_unlock_irqrestore(&etdev->TCBSendQLock,
 					       flags);
 
 			dev_warn(&etdev->pdev->dev,
-				"Send stuck - reset.  pMpTcb->WrIndex %x, Flags 0x%08x\n",
-				pMpTcb->WrIndex,
-				pMpTcb->Flags);
+				"Send stuck - reset.  tcb->WrIndex %x, Flags 0x%08x\n",
+				tcb->index,
+				tcb->flags);
 
 			et131x_close(netdev);
 			et131x_open(netdev);
@@ -622,7 +613,7 @@ int et131x_change_mtu(struct net_device *netdev, int new_mtu)
 
 	et131x_init_send(adapter);
 
-	et131x_setup_hardware_properties(adapter);
+	et131x_hwaddr_init(adapter);
 	memcpy(netdev->dev_addr, adapter->CurrentAddress, ETH_ALEN);
 
 	/* Init the device with the new settings */
@@ -709,9 +700,7 @@ int et131x_set_mac_addr(struct net_device *netdev, void *new_mac)
 
 	et131x_init_send(adapter);
 
-	et131x_setup_hardware_properties(adapter);
-	/* memcpy( netdev->dev_addr, adapter->CurrentAddress, ETH_ALEN ); */
-	/* blux: no, do not override our nice address */
+	et131x_hwaddr_init(adapter);
 
 	/* Init the device with the new settings */
 	et131x_adapter_setup(adapter);
diff --git a/drivers/staging/go7007/Makefile b/drivers/staging/go7007/Makefile
index 1301caa7495d..d37b7edc2793 100644
--- a/drivers/staging/go7007/Makefile
+++ b/drivers/staging/go7007/Makefile
@@ -5,7 +5,7 @@
 
 obj-$(CONFIG_VIDEO_GO7007) += go7007.o
 obj-$(CONFIG_VIDEO_GO7007_USB) += go7007-usb.o
-obj-$(CONFIG_VIDEO_GO7007_USB_S2250_BOARD) += s2250.o
+obj-$(CONFIG_VIDEO_GO7007_USB_S2250_BOARD) += s2250.o s2250-loader.o
 obj-$(CONFIG_VIDEO_GO7007_SAA7113) += wis-saa7113.o
 obj-$(CONFIG_VIDEO_GO7007_OV7640) += wis-ov7640.o
 obj-$(CONFIG_VIDEO_GO7007_SAA7115) += wis-saa7115.o
@@ -17,7 +17,7 @@ obj-$(CONFIG_VIDEO_GO7007_TW2804) += wis-tw2804.o
 go7007-objs += go7007-v4l2.o go7007-driver.o go7007-i2c.o go7007-fw.o \
 		snd-go7007.o
 
-s2250-objs += s2250-board.o s2250-loader.o
+s2250-objs += s2250-board.o
 
 # Uncomment when the saa7134 patches get into upstream
 #ifneq ($(CONFIG_VIDEO_SAA7134),)
diff --git a/drivers/staging/go7007/go7007-driver.c b/drivers/staging/go7007/go7007-driver.c
index 472f4bb08fdc..fb1345ffb858 100644
--- a/drivers/staging/go7007/go7007-driver.c
+++ b/drivers/staging/go7007/go7007-driver.c
@@ -49,7 +49,7 @@ int go7007_read_interrupt(struct go7007 *go, u16 *value, u16 *data)
 	go->hpi_ops->read_interrupt(go);
 	if (wait_event_timeout(go->interrupt_waitq,
 				go->interrupt_available, 5*HZ) < 0) {
-		v4l2_err(go->video_dev, "timeout waiting for read interrupt\n");
+		v4l2_err(&go->v4l2_dev, "timeout waiting for read interrupt\n");
 		return -1;
 	}
 	if (!go->interrupt_available)
@@ -193,7 +193,8 @@ int go7007_reset_encoder(struct go7007 *go)
 static int init_i2c_module(struct i2c_adapter *adapter, const char *type,
 			   int id, int addr)
 {
-	struct i2c_board_info info;
+	struct go7007 *go = i2c_get_adapdata(adapter);
+	struct v4l2_device *v4l2_dev = &go->v4l2_dev;
 	char *modname;
 
 	switch (id) {
@@ -219,20 +220,16 @@ static int init_i2c_module(struct i2c_adapter *adapter, const char *type,
 		modname = "wis-ov7640";
 		break;
 	case I2C_DRIVERID_S2250:
-		modname = "s2250-board";
+		modname = "s2250";
 		break;
 	default:
 		modname = NULL;
 		break;
 	}
-	if (modname != NULL)
-		request_module(modname);
 
-	memset(&info, 0, sizeof(struct i2c_board_info));
-	info.addr = addr;
-	strlcpy(info.type, type, I2C_NAME_SIZE);
-	if (!i2c_new_device(adapter, &info))
+	if (v4l2_i2c_new_subdev(v4l2_dev, adapter, modname, type, addr, NULL))
 		return 0;
+
 	if (modname != NULL)
 		printk(KERN_INFO
 			"go7007: probing for module %s failed\n", modname);
@@ -262,6 +259,11 @@ int go7007_register_encoder(struct go7007 *go)
 	if (ret < 0)
 		return -1;
 
+	/* v4l2 init must happen before i2c subdevs */
+	ret = go7007_v4l2_init(go);
+	if (ret < 0)
+		return ret;
+
 	if (!go->i2c_adapter_online &&
 			go->board_info->flags & GO7007_BOARD_USE_ONBOARD_I2C) {
 		if (go7007_i2c_init(go) < 0)
@@ -282,7 +284,7 @@ int go7007_register_encoder(struct go7007 *go)
 		go->audio_enabled = 1;
 		go7007_snd_init(go);
 	}
-	return go7007_v4l2_init(go);
+	return 0;
 }
 EXPORT_SYMBOL(go7007_register_encoder);
 
@@ -315,7 +317,7 @@ int go7007_start_encoder(struct go7007 *go)
 
 	if (go7007_send_firmware(go, fw, fw_len) < 0 ||
 			go7007_read_interrupt(go, &intr_val, &intr_data) < 0) {
-		v4l2_err(go->video_dev, "error transferring firmware\n");
+		v4l2_err(&go->v4l2_dev, "error transferring firmware\n");
 		rv = -1;
 		goto start_error;
 	}
@@ -324,7 +326,7 @@ int go7007_start_encoder(struct go7007 *go)
 	go->parse_length = 0;
 	go->seen_frame = 0;
 	if (go7007_stream_start(go) < 0) {
-		v4l2_err(go->video_dev, "error starting stream transfer\n");
+		v4l2_err(&go->v4l2_dev, "error starting stream transfer\n");
 		rv = -1;
 		goto start_error;
 	}
@@ -420,7 +422,7 @@ void go7007_parse_video_stream(struct go7007 *go, u8 *buf, int length)
 	for (i = 0; i < length; ++i) {
 		if (go->active_buf != NULL &&
 			    go->active_buf->bytesused >= GO7007_BUF_SIZE - 3) {
-			v4l2_info(go->video_dev, "dropping oversized frame\n");
+			v4l2_info(&go->v4l2_dev, "dropping oversized frame\n");
 			go->active_buf->offset -= go->active_buf->bytesused;
 			go->active_buf->bytesused = 0;
 			go->active_buf->modet_active = 0;
@@ -668,7 +670,7 @@ void go7007_remove(struct go7007 *go)
 		if (i2c_del_adapter(&go->i2c_adapter) == 0)
 			go->i2c_adapter_online = 0;
 		else
-			v4l2_err(go->video_dev,
+			v4l2_err(&go->v4l2_dev,
 				"error removing I2C adapter!\n");
 	}
 
diff --git a/drivers/staging/go7007/go7007-priv.h b/drivers/staging/go7007/go7007-priv.h
index ce9307e3e186..b58c394c6555 100644
--- a/drivers/staging/go7007/go7007-priv.h
+++ b/drivers/staging/go7007/go7007-priv.h
@@ -21,6 +21,8 @@
  * user-space applications.
  */
 
+#include <media/v4l2-device.h>
+
 struct go7007;
 
 /* IDs to activate board-specific support code */
@@ -167,6 +169,7 @@ struct go7007 {
 	int channel_number; /* for multi-channel boards like Adlink PCI-MPG24 */
 	char name[64];
 	struct video_device *video_dev;
+	struct v4l2_device v4l2_dev;
 	int ref_count;
 	enum { STATUS_INIT, STATUS_ONLINE, STATUS_SHUTDOWN } status;
 	spinlock_t spinlock;
@@ -240,6 +243,11 @@ struct go7007 {
 	unsigned short interrupt_data;
 };
 
+static inline struct go7007 *to_go7007(struct v4l2_device *v4l2_dev)
+{
+	return container_of(v4l2_dev, struct go7007, v4l2_dev);
+}
+
 /* All of these must be called with the hpi_lock mutex held! */
 #define go7007_interface_reset(go) \
 			((go)->hpi_ops->interface_reset(go))
diff --git a/drivers/staging/go7007/go7007-usb.c b/drivers/staging/go7007/go7007-usb.c
index ecaa3c989cf4..1e89dc04ec23 100644
--- a/drivers/staging/go7007/go7007-usb.c
+++ b/drivers/staging/go7007/go7007-usb.c
@@ -425,7 +425,7 @@ static struct go7007_usb_board board_sensoray_2250 = {
 		.num_i2c_devs	 = 1,
 		.i2c_devs	 = {
 			{
-				.type	= "s2250_board",
+				.type	= "s2250",
 				.id	= I2C_DRIVERID_S2250,
 				.addr	= 0x43,
 			},
@@ -1057,7 +1057,7 @@ static int go7007_usb_probe(struct usb_interface *intf,
 			usb_rcvintpipe(usb->usbdev, 4),
 			usb->intr_urb->transfer_buffer, 2*sizeof(u16),
 			go7007_usb_readinterrupt_complete, go, 8);
-	usb_set_intfdata(intf, go);
+	usb_set_intfdata(intf, &go->v4l2_dev);
 
 	/* Boot the GO7007 */
 	if (go7007_boot_encoder(go, go->board_info->flags &
@@ -1233,7 +1233,7 @@ allocfail:
 
 static void go7007_usb_disconnect(struct usb_interface *intf)
 {
-	struct go7007 *go = usb_get_intfdata(intf);
+	struct go7007 *go = to_go7007(usb_get_intfdata(intf));
 	struct go7007_usb *usb = go->hpi_context;
 	struct urb *vurb, *aurb;
 	int i;
diff --git a/drivers/staging/go7007/go7007-v4l2.c b/drivers/staging/go7007/go7007-v4l2.c
index 4bd353afa596..3af79242313e 100644
--- a/drivers/staging/go7007/go7007-v4l2.c
+++ b/drivers/staging/go7007/go7007-v4l2.c
@@ -29,6 +29,7 @@
 #include <linux/videodev2.h>
 #include <media/v4l2-common.h>
 #include <media/v4l2-ioctl.h>
+#include <media/v4l2-subdev.h>
 #include <linux/i2c.h>
 #include <linux/mutex.h>
 #include <linux/uaccess.h>
@@ -46,6 +47,9 @@
 #define	V4L2_MPEG_VIDEO_ENCODING_MPEG_4   3
 #endif
 
+#define call_all(dev, o, f, args...) \
+	v4l2_device_call_until_err(dev, 0, o, f, ##args)
+
 static void deactivate_buffer(struct go7007_buffer *gobuf)
 {
 	int i;
@@ -247,19 +251,23 @@ static int set_capture_size(struct go7007 *go, struct v4l2_format *fmt, int try)
 		go->modet_map[i] = 0;
 
 	if (go->board_info->sensor_flags & GO7007_SENSOR_SCALING) {
-		struct video_decoder_resolution res;
+		struct v4l2_format res;
+
+		if (fmt != NULL) {
+			res = *fmt;
+		} else {
+			res.type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
+			res.fmt.pix.width = width;
+		}
 
-		res.width = width;
 		if (height > sensor_height / 2) {
-			res.height = height / 2;
+			res.fmt.pix.height = height / 2;
 			go->encoder_v_halve = 0;
 		} else {
-			res.height = height;
+			res.fmt.pix.height = height;
 			go->encoder_v_halve = 1;
 		}
-		if (go->i2c_adapter_online)
-			i2c_clients_command(&go->i2c_adapter,
-					DECODER_SET_RESOLUTION, &res);
+		call_all(&go->v4l2_dev, video, s_fmt, &res);
 	} else {
 		if (width <= sensor_width / 4) {
 			go->encoder_h_halve = 1;
@@ -385,7 +393,7 @@ static int clip_to_modet_map(struct go7007 *go, int region,
 }
 #endif
 
-static int mpeg_queryctrl(struct v4l2_queryctrl *ctrl)
+static int mpeg_query_ctrl(struct v4l2_queryctrl *ctrl)
 {
 	static const u32 mpeg_ctrls[] = {
 		V4L2_CID_MPEG_CLASS,
@@ -973,51 +981,35 @@ static int vidioc_queryctrl(struct file *file, void *priv,
 			   struct v4l2_queryctrl *query)
 {
 	struct go7007 *go = ((struct go7007_file *) priv)->go;
+	int id = query->id;
 
-	if (!go->i2c_adapter_online)
-		return -EIO;
-
-	i2c_clients_command(&go->i2c_adapter, VIDIOC_QUERYCTRL, query);
+	if (0 == call_all(&go->v4l2_dev, core, queryctrl, query))
+		return 0;
 
-	return (!query->name[0]) ? mpeg_queryctrl(query) : 0;
+	query->id = id;
+	return mpeg_query_ctrl(query);
 }
 
 static int vidioc_g_ctrl(struct file *file, void *priv,
 				struct v4l2_control *ctrl)
 {
 	struct go7007 *go = ((struct go7007_file *) priv)->go;
-	struct v4l2_queryctrl query;
 
-	if (!go->i2c_adapter_online)
-		return -EIO;
-
-	memset(&query, 0, sizeof(query));
-	query.id = ctrl->id;
-	i2c_clients_command(&go->i2c_adapter, VIDIOC_QUERYCTRL, &query);
-	if (query.name[0] == 0)
-		return mpeg_g_ctrl(ctrl, go);
-	i2c_clients_command(&go->i2c_adapter, VIDIOC_G_CTRL, ctrl);
+	if (0 == call_all(&go->v4l2_dev, core, g_ctrl, ctrl))
+		return 0;
 
-	return 0;
+	return mpeg_g_ctrl(ctrl, go);
 }
 
 static int vidioc_s_ctrl(struct file *file, void *priv,
 				struct v4l2_control *ctrl)
 {
 	struct go7007 *go = ((struct go7007_file *) priv)->go;
-	struct v4l2_queryctrl query;
 
-	if (!go->i2c_adapter_online)
-		return -EIO;
-
-	memset(&query, 0, sizeof(query));
-	query.id = ctrl->id;
-	i2c_clients_command(&go->i2c_adapter, VIDIOC_QUERYCTRL, &query);
-	if (query.name[0] == 0)
-		return mpeg_s_ctrl(ctrl, go);
-	i2c_clients_command(&go->i2c_adapter, VIDIOC_S_CTRL, ctrl);
+	if (0 == call_all(&go->v4l2_dev, core, s_ctrl, ctrl))
+		return 0;
 
-	return 0;
+	return mpeg_s_ctrl(ctrl, go);
 }
 
 static int vidioc_g_parm(struct file *filp, void *priv,
@@ -1135,8 +1127,7 @@ static int vidioc_s_std(struct file *file, void *priv, v4l2_std_id *std)
 	if (go->streaming)
 		return -EBUSY;
 
-	if (!(go->board_info->sensor_flags & GO7007_SENSOR_TV) &&
-			*std != 0)
+	if (!(go->board_info->sensor_flags & GO7007_SENSOR_TV) && *std != 0)
 		return -EINVAL;
 
 	if (*std == 0)
@@ -1146,9 +1137,7 @@ static int vidioc_s_std(struct file *file, void *priv, v4l2_std_id *std)
 			go->input == go->board_info->num_inputs - 1) {
 		if (!go->i2c_adapter_online)
 			return -EIO;
-		i2c_clients_command(&go->i2c_adapter,
-					VIDIOC_S_STD, std);
-		if (!*std) /* hack to indicate EINVAL from tuner */
+		if (call_all(&go->v4l2_dev, core, s_std, *std) < 0)
 			return -EINVAL;
 	}
 
@@ -1164,9 +1153,7 @@ static int vidioc_s_std(struct file *file, void *priv, v4l2_std_id *std)
 	} else
 		return -EINVAL;
 
-	if (go->i2c_adapter_online)
-		i2c_clients_command(&go->i2c_adapter,
-					VIDIOC_S_STD, std);
+	call_all(&go->v4l2_dev, core, s_std, *std);
 	set_capture_size(go, NULL, 0);
 
 	return 0;
@@ -1180,7 +1167,7 @@ static int vidioc_querystd(struct file *file, void *priv, v4l2_std_id *std)
 			go->input == go->board_info->num_inputs - 1) {
 		if (!go->i2c_adapter_online)
 			return -EIO;
-		i2c_clients_command(&go->i2c_adapter, VIDIOC_QUERYSTD, std);
+		return call_all(&go->v4l2_dev, video, querystd, std);
 	} else if (go->board_info->sensor_flags & GO7007_SENSOR_TV)
 		*std = V4L2_STD_NTSC | V4L2_STD_PAL | V4L2_STD_SECAM;
 	else
@@ -1238,14 +1225,8 @@ static int vidioc_s_input(struct file *file, void *priv, unsigned int input)
 		return -EBUSY;
 
 	go->input = input;
-	if (go->i2c_adapter_online) {
-		i2c_clients_command(&go->i2c_adapter, VIDIOC_S_INPUT,
-			&go->board_info->inputs[input].video_input);
-		i2c_clients_command(&go->i2c_adapter, VIDIOC_S_AUDIO,
-			&go->board_info->inputs[input].audio_input);
-	}
 
-	return 0;
+	return call_all(&go->v4l2_dev, video, s_routing, input, 0, 0);
 }
 
 static int vidioc_g_tuner(struct file *file, void *priv,
@@ -1260,10 +1241,7 @@ static int vidioc_g_tuner(struct file *file, void *priv,
 	if (!go->i2c_adapter_online)
 		return -EIO;
 
-	i2c_clients_command(&go->i2c_adapter, VIDIOC_G_TUNER, t);
-
-	t->index = 0;
-	return 0;
+	return call_all(&go->v4l2_dev, tuner, g_tuner, t);
 }
 
 static int vidioc_s_tuner(struct file *file, void *priv,
@@ -1287,9 +1265,7 @@ static int vidioc_s_tuner(struct file *file, void *priv,
 		break;
 	}
 
-	i2c_clients_command(&go->i2c_adapter, VIDIOC_S_TUNER, t);
-
-	return 0;
+	return call_all(&go->v4l2_dev, tuner, s_tuner, t);
 }
 
 static int vidioc_g_frequency(struct file *file, void *priv,
@@ -1303,8 +1279,8 @@ static int vidioc_g_frequency(struct file *file, void *priv,
 		return -EIO;
 
 	f->type = V4L2_TUNER_ANALOG_TV;
-	i2c_clients_command(&go->i2c_adapter, VIDIOC_G_FREQUENCY, f);
-	return 0;
+
+	return call_all(&go->v4l2_dev, tuner, g_frequency, f);
 }
 
 static int vidioc_s_frequency(struct file *file, void *priv,
@@ -1317,9 +1293,7 @@ static int vidioc_s_frequency(struct file *file, void *priv,
 	if (!go->i2c_adapter_online)
 		return -EIO;
 
-	i2c_clients_command(&go->i2c_adapter, VIDIOC_S_FREQUENCY, f);
-
-	return 0;
+	return call_all(&go->v4l2_dev, tuner, s_frequency, f);
 }
 
 static int vidioc_cropcap(struct file *file, void *priv,
@@ -1813,7 +1787,6 @@ static const struct v4l2_ioctl_ops video_ioctl_ops = {
 static struct video_device go7007_template = {
 	.name		= "go7007",
 	.fops		= &go7007_fops,
-	.minor		= -1,
 	.release	= go7007_vfl_release,
 	.ioctl_ops	= &video_ioctl_ops,
 	.tvnorms	= V4L2_STD_ALL,
@@ -1827,7 +1800,7 @@ int go7007_v4l2_init(struct go7007 *go)
 	go->video_dev = video_device_alloc();
 	if (go->video_dev == NULL)
 		return -ENOMEM;
-	memcpy(go->video_dev, &go7007_template, sizeof(go7007_template));
+	*go->video_dev = go7007_template;
 	go->video_dev->parent = go->dev;
 	rv = video_register_device(go->video_dev, VFL_TYPE_GRABBER, -1);
 	if (rv < 0) {
@@ -1835,10 +1808,16 @@ int go7007_v4l2_init(struct go7007 *go)
 		go->video_dev = NULL;
 		return rv;
 	}
+	rv = v4l2_device_register(go->dev, &go->v4l2_dev);
+	if (rv < 0) {
+		video_device_release(go->video_dev);
+		go->video_dev = NULL;
+		return rv;
+	}
 	video_set_drvdata(go->video_dev, go);
 	++go->ref_count;
-	printk(KERN_INFO "%s: registered device video%d [v4l2]\n",
-	       go->video_dev->name, go->video_dev->num);
+	printk(KERN_INFO "%s: registered device %s [v4l2]\n",
+	       go->video_dev->name, video_device_node_name(go->video_dev));
 
 	return 0;
 }
@@ -1858,4 +1837,5 @@ void go7007_v4l2_remove(struct go7007 *go)
 	mutex_unlock(&go->hw_lock);
 	if (go->video_dev)
 		video_unregister_device(go->video_dev);
+	v4l2_device_unregister(&go->v4l2_dev);
 }
diff --git a/drivers/staging/go7007/s2250-board.c b/drivers/staging/go7007/s2250-board.c
index f4a6541c3e60..8cf7f2750b3f 100644
--- a/drivers/staging/go7007/s2250-board.c
+++ b/drivers/staging/go7007/s2250-board.c
@@ -20,10 +20,14 @@
 #include <linux/usb.h>
 #include <linux/i2c.h>
 #include <linux/videodev2.h>
+#include <media/v4l2-device.h>
 #include <media/v4l2-common.h>
-#include "s2250-loader.h"
+#include <media/v4l2-i2c-drv.h>
+#include <media/v4l2-subdev.h>
 #include "go7007-priv.h"
-#include "wis-i2c.h"
+
+MODULE_DESCRIPTION("Sensoray 2250/2251 i2c v4l2 subdev driver");
+MODULE_LICENSE("GPL v2");
 
 #define TLV320_ADDRESS      0x34
 #define VPX322_ADDR_ANALOGCONTROL1	0x02
@@ -112,6 +116,7 @@ static u16 vid_regs_fp_pal[] =
 };
 
 struct s2250 {
+	struct v4l2_subdev sd;
 	v4l2_std_id std;
 	int input;
 	int brightness;
@@ -123,6 +128,11 @@ struct s2250 {
 	struct i2c_client *audio;
 };
 
+static inline struct s2250 *to_state(struct v4l2_subdev *sd)
+{
+	return container_of(sd, struct s2250, sd);
+}
+
 /* from go7007-usb.c which is Copyright (C) 2005-2006 Micronas USA Inc.*/
 static int go7007_usb_vendor_request(struct go7007 *go, u16 request,
 	u16 value, u16 index, void *transfer_buffer, int length, int in)
@@ -306,253 +316,262 @@ static int write_regs_fp(struct i2c_client *client, u16 *regs)
 }
 
 
-static int s2250_command(struct i2c_client *client,
-			 unsigned int cmd, void *arg)
+/* ------------------------------------------------------------------------- */
+
+static int s2250_s_video_routing(struct v4l2_subdev *sd, u32 input, u32 output,
+				 u32 config)
 {
-	struct s2250 *dec = i2c_get_clientdata(client);
+	struct s2250 *state = to_state(sd);
+	struct i2c_client *client = v4l2_get_subdevdata(sd);
+	int vidsys;
+
+	vidsys = (state->std == V4L2_STD_NTSC) ? 0x01 : 0x00;
+	if (input == 0) {
+		/* composite */
+		write_reg_fp(client, 0x20, 0x020 | vidsys);
+		write_reg_fp(client, 0x21, 0x662);
+		write_reg_fp(client, 0x140, 0x060);
+	} else if (input == 1) {
+		/* S-Video */
+		write_reg_fp(client, 0x20, 0x040 | vidsys);
+		write_reg_fp(client, 0x21, 0x666);
+		write_reg_fp(client, 0x140, 0x060);
+	} else {
+		return -EINVAL;
+	}
+	state->input = input;
+	return 0;
+}
 
-	switch (cmd) {
-	case VIDIOC_S_INPUT:
-	{
-		int vidsys;
-		int *input = arg;
-
-		vidsys = (dec->std == V4L2_STD_NTSC) ? 0x01 : 0x00;
-		if (*input == 0) {
-			/* composite */
-			write_reg_fp(client, 0x20, 0x020 | vidsys);
-			write_reg_fp(client, 0x21, 0x662);
-			write_reg_fp(client, 0x140, 0x060);
-		} else {
-			/* S-Video */
-			write_reg_fp(client, 0x20, 0x040 | vidsys);
-			write_reg_fp(client, 0x21, 0x666);
-			write_reg_fp(client, 0x140, 0x060);
-		}
-		dec->input = *input;
+static int s2250_s_std(struct v4l2_subdev *sd, v4l2_std_id norm)
+{
+	struct s2250 *state = to_state(sd);
+	struct i2c_client *client = v4l2_get_subdevdata(sd);
+	u16 vidsource;
+
+	vidsource = (state->input == 1) ? 0x040 : 0x020;
+	switch (norm) {
+	case V4L2_STD_NTSC:
+		write_regs_fp(client, vid_regs_fp);
+		write_reg_fp(client, 0x20, vidsource | 1);
 		break;
-	}
-	case VIDIOC_S_STD:
-	{
-		v4l2_std_id *std = arg;
-		u16 vidsource;
-
-		vidsource = (dec->input == 1) ? 0x040 : 0x020;
-		dec->std = *std;
-		switch (dec->std) {
-		case V4L2_STD_NTSC:
-			write_regs_fp(client, vid_regs_fp);
-			write_reg_fp(client, 0x20, vidsource | 1);
-			break;
-		case V4L2_STD_PAL:
-			write_regs_fp(client, vid_regs_fp);
-			write_regs_fp(client, vid_regs_fp_pal);
-			write_reg_fp(client, 0x20, vidsource);
-			break;
-		default:
-			return -EINVAL;
-		}
+	case V4L2_STD_PAL:
+		write_regs_fp(client, vid_regs_fp);
+		write_regs_fp(client, vid_regs_fp_pal);
+		write_reg_fp(client, 0x20, vidsource);
 		break;
+	default:
+		return -EINVAL;
 	}
-	case VIDIOC_QUERYCTRL:
-	{
-		struct v4l2_queryctrl *ctrl = arg;
-		static const u32 user_ctrls[] = {
-			V4L2_CID_BRIGHTNESS,
-			V4L2_CID_CONTRAST,
-			V4L2_CID_SATURATION,
-			V4L2_CID_HUE,
-			0
-		};
-		static const u32 *ctrl_classes[] = {
-			user_ctrls,
-			NULL
-		};
-
-		ctrl->id = v4l2_ctrl_next(ctrl_classes, ctrl->id);
-		switch (ctrl->id) {
-		case V4L2_CID_BRIGHTNESS:
-			v4l2_ctrl_query_fill(ctrl, 0, 100, 1, 50);
-			break;
-		case V4L2_CID_CONTRAST:
-			v4l2_ctrl_query_fill(ctrl, 0, 100, 1, 50);
-			break;
-		case V4L2_CID_SATURATION:
-			v4l2_ctrl_query_fill(ctrl, 0, 100, 1, 50);
-			break;
-		case V4L2_CID_HUE:
-			v4l2_ctrl_query_fill(ctrl, -50, 50, 1, 0);
-			break;
-		default:
-			ctrl->name[0] = '\0';
-			return -EINVAL;
-		}
-		break;
+	state->std = norm;
+	return 0;
+}
+
+static int s2250_queryctrl(struct v4l2_subdev *sd, struct v4l2_queryctrl *query)
+{
+	switch (query->id) {
+	case V4L2_CID_BRIGHTNESS:
+		return v4l2_ctrl_query_fill(query, 0, 100, 1, 50);
+	case V4L2_CID_CONTRAST:
+		return v4l2_ctrl_query_fill(query, 0, 100, 1, 50);
+	case V4L2_CID_SATURATION:
+		return v4l2_ctrl_query_fill(query, 0, 100, 1, 50);
+	case V4L2_CID_HUE:
+		return v4l2_ctrl_query_fill(query, -50, 50, 1, 0);
+	default:
+		return -EINVAL;
 	}
-	case VIDIOC_S_CTRL:
-	{
-		struct v4l2_control *ctrl = arg;
-		int value1;
-		u16 oldvalue;
-
-		switch (ctrl->id) {
-		case V4L2_CID_BRIGHTNESS:
-			if (ctrl->value > 100)
-				dec->brightness = 100;
-			else if (ctrl->value < 0)
-				dec->brightness = 0;
-			else
-				dec->brightness = ctrl->value;
-			value1 = (dec->brightness - 50) * 255 / 100;
-			read_reg_fp(client, VPX322_ADDR_BRIGHTNESS0, &oldvalue);
-			write_reg_fp(client, VPX322_ADDR_BRIGHTNESS0,
-				     value1 | (oldvalue & ~0xff));
-			read_reg_fp(client, VPX322_ADDR_BRIGHTNESS1, &oldvalue);
-			write_reg_fp(client, VPX322_ADDR_BRIGHTNESS1,
-				     value1 | (oldvalue & ~0xff));
-			write_reg_fp(client, 0x140, 0x60);
-			break;
-		case V4L2_CID_CONTRAST:
-			if (ctrl->value > 100)
-				dec->contrast = 100;
-			else if (ctrl->value < 0)
-				dec->contrast = 0;
-			else
-				dec->contrast = ctrl->value;
-			value1 = dec->contrast * 0x40 / 100;
-			if (value1 > 0x3f)
-				value1 = 0x3f; /* max */
-			read_reg_fp(client, VPX322_ADDR_CONTRAST0, &oldvalue);
-			write_reg_fp(client, VPX322_ADDR_CONTRAST0,
-				     value1 | (oldvalue & ~0x3f));
-			read_reg_fp(client, VPX322_ADDR_CONTRAST1, &oldvalue);
-			write_reg_fp(client, VPX322_ADDR_CONTRAST1,
-				     value1 | (oldvalue & ~0x3f));
-			write_reg_fp(client, 0x140, 0x60);
-			break;
-		case V4L2_CID_SATURATION:
-			if (ctrl->value > 127)
-				dec->saturation = 127;
-			else if (ctrl->value < 0)
-				dec->saturation = 0;
-			else
-				dec->saturation = ctrl->value;
-
-			value1 = dec->saturation * 4140 / 100;
-			if (value1 > 4094)
-				value1 = 4094;
-			write_reg_fp(client, VPX322_ADDR_SAT, value1);
-			break;
-		case V4L2_CID_HUE:
-			if (ctrl->value > 50)
-				dec->hue = 50;
-			else if (ctrl->value < -50)
-				dec->hue = -50;
-			else
-				dec->hue = ctrl->value;
-			/* clamp the hue range */
-			value1 = dec->hue * 280 / 50;
-			write_reg_fp(client, VPX322_ADDR_HUE, value1);
-			break;
-		}
+	return 0;
+}
+
+static int s2250_s_ctrl(struct v4l2_subdev *sd, struct v4l2_control *ctrl)
+{
+	struct s2250 *state = to_state(sd);
+	struct i2c_client *client = v4l2_get_subdevdata(sd);
+	int value1;
+	u16 oldvalue;
+
+	switch (ctrl->id) {
+	case V4L2_CID_BRIGHTNESS:
+		if (ctrl->value > 100)
+			state->brightness = 100;
+		else if (ctrl->value < 0)
+			state->brightness = 0;
+		else
+			state->brightness = ctrl->value;
+		value1 = (state->brightness - 50) * 255 / 100;
+		read_reg_fp(client, VPX322_ADDR_BRIGHTNESS0, &oldvalue);
+		write_reg_fp(client, VPX322_ADDR_BRIGHTNESS0,
+			     value1 | (oldvalue & ~0xff));
+		read_reg_fp(client, VPX322_ADDR_BRIGHTNESS1, &oldvalue);
+		write_reg_fp(client, VPX322_ADDR_BRIGHTNESS1,
+			     value1 | (oldvalue & ~0xff));
+		write_reg_fp(client, 0x140, 0x60);
 		break;
-	}
-	case VIDIOC_G_CTRL:
-	{
-		struct v4l2_control *ctrl = arg;
-
-		switch (ctrl->id) {
-		case V4L2_CID_BRIGHTNESS:
-			ctrl->value = dec->brightness;
-			break;
-		case V4L2_CID_CONTRAST:
-			ctrl->value = dec->contrast;
-			break;
-		case V4L2_CID_SATURATION:
-			ctrl->value = dec->saturation;
-			break;
-		case V4L2_CID_HUE:
-			ctrl->value = dec->hue;
-			break;
-		}
+	case V4L2_CID_CONTRAST:
+		if (ctrl->value > 100)
+			state->contrast = 100;
+		else if (ctrl->value < 0)
+			state->contrast = 0;
+		else
+			state->contrast = ctrl->value;
+		value1 = state->contrast * 0x40 / 100;
+		if (value1 > 0x3f)
+			value1 = 0x3f; /* max */
+		read_reg_fp(client, VPX322_ADDR_CONTRAST0, &oldvalue);
+		write_reg_fp(client, VPX322_ADDR_CONTRAST0,
+			     value1 | (oldvalue & ~0x3f));
+		read_reg_fp(client, VPX322_ADDR_CONTRAST1, &oldvalue);
+		write_reg_fp(client, VPX322_ADDR_CONTRAST1,
+			     value1 | (oldvalue & ~0x3f));
+		write_reg_fp(client, 0x140, 0x60);
 		break;
+	case V4L2_CID_SATURATION:
+		if (ctrl->value > 100)
+			state->saturation = 100;
+		else if (ctrl->value < 0)
+			state->saturation = 0;
+		else
+			state->saturation = ctrl->value;
+		value1 = state->saturation * 4140 / 100;
+		if (value1 > 4094)
+			value1 = 4094;
+		write_reg_fp(client, VPX322_ADDR_SAT, value1);
+		break;
+	case V4L2_CID_HUE:
+		if (ctrl->value > 50)
+			state->hue = 50;
+		else if (ctrl->value < -50)
+			state->hue = -50;
+		else
+			state->hue = ctrl->value;
+		/* clamp the hue range */
+		value1 = state->hue * 280 / 50;
+		write_reg_fp(client, VPX322_ADDR_HUE, value1);
+		break;
+	default:
+		return -EINVAL;
 	}
-	case VIDIOC_S_FMT:
-	{
-		struct v4l2_format *fmt = arg;
-		if (fmt->fmt.pix.height < 640) {
-			write_reg_fp(client, 0x12b, dec->reg12b_val | 0x400);
-			write_reg_fp(client, 0x140, 0x060);
-		} else {
-			write_reg_fp(client, 0x12b, dec->reg12b_val & ~0x400);
-			write_reg_fp(client, 0x140, 0x060);
-		}
-		return 0;
-	}
-	case VIDIOC_G_AUDIO:
-	{
-		struct v4l2_audio *audio = arg;
+	return 0;
+}
 
-		memset(audio, 0, sizeof(*audio));
-		audio->index = dec->audio_input;
-		/* fall through */
-	}
-	case VIDIOC_ENUMAUDIO:
-	{
-		struct v4l2_audio *audio = arg;
-
-		switch (audio->index) {
-		case 0:
-			strcpy(audio->name, "Line In");
-			break;
-		case 1:
-			strcpy(audio->name, "Mic");
-			break;
-		case 2:
-			strcpy(audio->name, "Mic Boost");
-			break;
-		default:
-			audio->name[0] = '\0';
-			return 0;
-		}
-		audio->capability = V4L2_AUDCAP_STEREO;
-		audio->mode = 0;
-		return 0;
+static int s2250_g_ctrl(struct v4l2_subdev *sd, struct v4l2_control *ctrl)
+{
+	struct s2250 *state = to_state(sd);
+
+	switch (ctrl->id) {
+	case V4L2_CID_BRIGHTNESS:
+		ctrl->value = state->brightness;
+		break;
+	case V4L2_CID_CONTRAST:
+		ctrl->value = state->contrast;
+		break;
+	case V4L2_CID_SATURATION:
+		ctrl->value = state->saturation;
+		break;
+	case V4L2_CID_HUE:
+		ctrl->value = state->hue;
+		break;
+	default:
+		return -EINVAL;
 	}
-	case VIDIOC_S_AUDIO:
-	{
-		struct v4l2_audio *audio = arg;
-
-		switch (audio->index) {
-		case 0:
-			write_reg(dec->audio, 0x08, 0x02); /* Line In */
-			break;
-		case 1:
-			write_reg(dec->audio, 0x08, 0x04); /* Mic */
-			break;
-		case 2:
-			write_reg(dec->audio, 0x08, 0x05); /* Mic Boost */
-			break;
-		default:
-			return -EINVAL;
-		}
-		dec->audio_input = audio->index;
-		return 0;
+	return 0;
+}
+
+static int s2250_s_fmt(struct v4l2_subdev *sd, struct v4l2_format *fmt)
+{
+	struct s2250 *state = to_state(sd);
+	struct i2c_client *client = v4l2_get_subdevdata(sd);
+
+	if (fmt->fmt.pix.height < 640) {
+		write_reg_fp(client, 0x12b, state->reg12b_val | 0x400);
+		write_reg_fp(client, 0x140, 0x060);
+	} else {
+		write_reg_fp(client, 0x12b, state->reg12b_val & ~0x400);
+		write_reg_fp(client, 0x140, 0x060);
 	}
+	return 0;
+}
 
-	default:
-		printk(KERN_INFO "s2250: unknown command 0x%x\n", cmd);
+static int s2250_s_audio_routing(struct v4l2_subdev *sd, u32 input, u32 output,
+				 u32 config)
+{
+	struct s2250 *state = to_state(sd);
+
+	switch (input) {
+	case 0:
+		write_reg(state->audio, 0x08, 0x02); /* Line In */
+		break;
+	case 1:
+		write_reg(state->audio, 0x08, 0x04); /* Mic */
 		break;
+	case 2:
+		write_reg(state->audio, 0x08, 0x05); /* Mic Boost */
+		break;
+	default:
+		return -EINVAL;
 	}
+	state->audio_input = input;
+	return 0;
+}
+
+
+static int s2250_log_status(struct v4l2_subdev *sd)
+{
+	struct s2250 *state = to_state(sd);
+
+	v4l2_info(sd, "Standard: %s\n", state->std == V4L2_STD_NTSC ? "NTSC" :
+					state->std == V4L2_STD_PAL ? "PAL" :
+					state->std == V4L2_STD_SECAM ? "SECAM" :
+					"unknown");
+	v4l2_info(sd, "Input: %s\n", state->input == 0 ? "Composite" :
+					state->input == 1 ? "S-video" :
+					"error");
+	v4l2_info(sd, "Brightness: %d\n", state->brightness);
+	v4l2_info(sd, "Contrast: %d\n", state->contrast);
+	v4l2_info(sd, "Saturation: %d\n", state->saturation);
+	v4l2_info(sd, "Hue: %d\n", state->hue);	return 0;
+	v4l2_info(sd, "Audio input: %s\n", state->audio_input == 0 ? "Line In" :
+					state->audio_input == 1 ? "Mic" :
+					state->audio_input == 2 ? "Mic Boost" :
+					"error");
 	return 0;
 }
 
+/* --------------------------------------------------------------------------*/
+
+static const struct v4l2_subdev_core_ops s2250_core_ops = {
+	.log_status = s2250_log_status,
+	.g_ctrl = s2250_g_ctrl,
+	.s_ctrl = s2250_s_ctrl,
+	.queryctrl = s2250_queryctrl,
+	.s_std = s2250_s_std,
+};
+
+static const struct v4l2_subdev_audio_ops s2250_audio_ops = {
+	.s_routing = s2250_s_audio_routing,
+};
+
+static const struct v4l2_subdev_video_ops s2250_video_ops = {
+	.s_routing = s2250_s_video_routing,
+	.s_fmt = s2250_s_fmt,
+};
+
+static const struct v4l2_subdev_ops s2250_ops = {
+	.core = &s2250_core_ops,
+	.audio = &s2250_audio_ops,
+	.video = &s2250_video_ops,
+};
+
+/* --------------------------------------------------------------------------*/
+
 static int s2250_probe(struct i2c_client *client,
 		       const struct i2c_device_id *id)
 {
 	struct i2c_client *audio;
 	struct i2c_adapter *adapter = client->adapter;
-	struct s2250 *dec;
+	struct s2250 *state;
+	struct v4l2_subdev *sd;
 	u8 *data;
 	struct go7007 *go = i2c_get_adapdata(adapter);
 	struct go7007_usb *usb = go->hpi_context;
@@ -561,30 +580,31 @@ static int s2250_probe(struct i2c_client *client,
 	if (audio == NULL)
 		return -ENOMEM;
 
-	dec = kmalloc(sizeof(struct s2250), GFP_KERNEL);
-	if (dec == NULL) {
+	state = kmalloc(sizeof(struct s2250), GFP_KERNEL);
+	if (state == NULL) {
 		i2c_unregister_device(audio);
 		return -ENOMEM;
 	}
 
-	dec->std = V4L2_STD_NTSC;
-	dec->brightness = 50;
-	dec->contrast = 50;
-	dec->saturation = 50;
-	dec->hue = 0;
-	dec->audio = audio;
-	i2c_set_clientdata(client, dec);
+	sd = &state->sd;
+	v4l2_i2c_subdev_init(sd, client, &s2250_ops);
+
+	v4l2_info(sd, "initializing %s at address 0x%x on %s\n",
+	       "Sensoray 2250/2251", client->addr, client->adapter->name);
 
-	printk(KERN_DEBUG
-	       "s2250: initializing video decoder on %s\n",
-	       adapter->name);
+	state->std = V4L2_STD_NTSC;
+	state->brightness = 50;
+	state->contrast = 50;
+	state->saturation = 50;
+	state->hue = 0;
+	state->audio = audio;
 
 	/* initialize the audio */
 	if (write_regs(audio, aud_regs) < 0) {
 		printk(KERN_ERR
 		       "s2250: error initializing audio\n");
 		i2c_unregister_device(audio);
-		kfree(dec);
+		kfree(state);
 		return 0;
 	}
 
@@ -592,14 +612,14 @@ static int s2250_probe(struct i2c_client *client,
 		printk(KERN_ERR
 		       "s2250: error initializing decoder\n");
 		i2c_unregister_device(audio);
-		kfree(dec);
+		kfree(state);
 		return 0;
 	}
 	if (write_regs_fp(client, vid_regs_fp) < 0) {
 		printk(KERN_ERR
 		       "s2250: error initializing decoder\n");
 		i2c_unregister_device(audio);
-		kfree(dec);
+		kfree(state);
 		return 0;
 	}
 	/* set default channel */
@@ -609,7 +629,7 @@ static int s2250_probe(struct i2c_client *client,
 	write_reg_fp(client, 0x140, 0x060);
 
 	/* set default audio input */
-	dec->audio_input = 0;
+	state->audio_input = 0;
 	write_reg(client, 0x08, 0x02); /* Line In */
 
 	if (mutex_lock_interruptible(&usb->i2c_lock) == 0) {
@@ -634,60 +654,28 @@ static int s2250_probe(struct i2c_client *client,
 		mutex_unlock(&usb->i2c_lock);
 	}
 
-	printk("s2250: initialized successfully\n");
+	v4l2_info(sd, "initialized successfully\n");
 	return 0;
 }
 
 static int s2250_remove(struct i2c_client *client)
 {
-	struct s2250 *dec = i2c_get_clientdata(client);
+	struct v4l2_subdev *sd = i2c_get_clientdata(client);
 
-	i2c_set_clientdata(client, NULL);
-	i2c_unregister_device(dec->audio);
-	kfree(dec);
+	v4l2_device_unregister_subdev(sd);
+	kfree(to_state(sd));
 	return 0;
 }
 
 static struct i2c_device_id s2250_id[] = {
-	{ "s2250_board", 0 },
+	{ "s2250", 0 },
 	{ }
 };
+MODULE_DEVICE_TABLE(i2c, s2250_id);
 
-static struct i2c_driver s2250_driver = {
-	.driver = {
-		.name	= "Sensoray 2250 board driver",
-	},
-	.probe		= s2250_probe,
-	.remove		= s2250_remove,
-	.command	= s2250_command,
-	.id_table	= s2250_id,
+static struct v4l2_i2c_driver_data v4l2_i2c_data = {
+	.name = "s2250",
+	.probe = s2250_probe,
+	.remove = s2250_remove,
+	.id_table = s2250_id,
 };
-
-static int __init s2250_init(void)
-{
-	int r;
-
-	r = s2250loader_init();
-	if (r < 0)
-		return r;
-
-	r = i2c_add_driver(&s2250_driver);
-	if (r < 0)
-		s2250loader_cleanup();
-
-	return r;
-}
-
-static void __exit s2250_cleanup(void)
-{
-	i2c_del_driver(&s2250_driver);
-
-	s2250loader_cleanup();
-}
-
-module_init(s2250_init);
-module_exit(s2250_cleanup);
-
-MODULE_AUTHOR("");
-MODULE_DESCRIPTION("Board driver for Sensoryray 2250");
-MODULE_LICENSE("GPL v2");
diff --git a/drivers/staging/go7007/s2250-loader.c b/drivers/staging/go7007/s2250-loader.c
index d7bf82983274..c152ab9be2fb 100644
--- a/drivers/staging/go7007/s2250-loader.c
+++ b/drivers/staging/go7007/s2250-loader.c
@@ -162,7 +162,7 @@ static struct usb_driver s2250loader_driver = {
 	.id_table	= s2250loader_ids,
 };
 
-int s2250loader_init(void)
+static int __init s2250loader_init(void)
 {
 	int r;
 	unsigned i = 0;
@@ -179,11 +179,15 @@ int s2250loader_init(void)
 	printk(KERN_INFO "s2250loader_init: driver registered\n");
 	return 0;
 }
-EXPORT_SYMBOL(s2250loader_init);
+module_init(s2250loader_init);
 
-void s2250loader_cleanup(void)
+static void __exit s2250loader_cleanup(void)
 {
 	printk(KERN_INFO "s2250loader_cleanup\n");
 	usb_deregister(&s2250loader_driver);
 }
-EXPORT_SYMBOL(s2250loader_cleanup);
+module_exit(s2250loader_cleanup);
+
+MODULE_AUTHOR("");
+MODULE_DESCRIPTION("firmware loader for Sensoray 2250/2251");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/staging/hv/Hv.c b/drivers/staging/hv/Hv.c
index c5b6613f2f2f..c2809f2a2ce0 100644
--- a/drivers/staging/hv/Hv.c
+++ b/drivers/staging/hv/Hv.c
@@ -386,7 +386,7 @@ u16 HvSignalEvent(void)
  * retrieve the initialized message and event pages.  Otherwise, we create and
  * initialize the message and event pages.
  */
-int HvSynicInit(u32 irqVector)
+void HvSynicInit(void *irqarg)
 {
 	u64 version;
 	union hv_synic_simp simp;
@@ -394,13 +394,14 @@ int HvSynicInit(u32 irqVector)
 	union hv_synic_sint sharedSint;
 	union hv_synic_scontrol sctrl;
 	u64 guestID;
-	int ret = 0;
+	u32 irqVector = *((u32 *)(irqarg));
+	int cpu = smp_processor_id();
 
 	DPRINT_ENTER(VMBUS);
 
 	if (!gHvContext.HypercallPage) {
 		DPRINT_EXIT(VMBUS);
-		return ret;
+		return;
 	}
 
 	/* Check the version */
@@ -425,27 +426,27 @@ int HvSynicInit(u32 irqVector)
 		 */
 		rdmsrl(HV_X64_MSR_GUEST_OS_ID, guestID);
 		if (guestID == HV_LINUX_GUEST_ID) {
-			gHvContext.synICMessagePage[0] =
+			gHvContext.synICMessagePage[cpu] =
 				phys_to_virt(simp.BaseSimpGpa << PAGE_SHIFT);
-			gHvContext.synICEventPage[0] =
+			gHvContext.synICEventPage[cpu] =
 				phys_to_virt(siefp.BaseSiefpGpa << PAGE_SHIFT);
 		} else {
 			DPRINT_ERR(VMBUS, "unknown guest id!!");
 			goto Cleanup;
 		}
 		DPRINT_DBG(VMBUS, "MAPPED: Simp: %p, Sifep: %p",
-			   gHvContext.synICMessagePage[0],
-			   gHvContext.synICEventPage[0]);
+			   gHvContext.synICMessagePage[cpu],
+			   gHvContext.synICEventPage[cpu]);
 	} else {
-		gHvContext.synICMessagePage[0] = osd_PageAlloc(1);
-		if (gHvContext.synICMessagePage[0] == NULL) {
+		gHvContext.synICMessagePage[cpu] = (void *)get_zeroed_page(GFP_ATOMIC);
+		if (gHvContext.synICMessagePage[cpu] == NULL) {
 			DPRINT_ERR(VMBUS,
 				   "unable to allocate SYNIC message page!!");
 			goto Cleanup;
 		}
 
-		gHvContext.synICEventPage[0] = osd_PageAlloc(1);
-		if (gHvContext.synICEventPage[0] == NULL) {
+		gHvContext.synICEventPage[cpu] = (void *)get_zeroed_page(GFP_ATOMIC);
+		if (gHvContext.synICEventPage[cpu] == NULL) {
 			DPRINT_ERR(VMBUS,
 				   "unable to allocate SYNIC event page!!");
 			goto Cleanup;
@@ -454,7 +455,7 @@ int HvSynicInit(u32 irqVector)
 		/* Setup the Synic's message page */
 		rdmsrl(HV_X64_MSR_SIMP, simp.AsUINT64);
 		simp.SimpEnabled = 1;
-		simp.BaseSimpGpa = virt_to_phys(gHvContext.synICMessagePage[0])
+		simp.BaseSimpGpa = virt_to_phys(gHvContext.synICMessagePage[cpu])
 					>> PAGE_SHIFT;
 
 		DPRINT_DBG(VMBUS, "HV_X64_MSR_SIMP msr set to: %llx",
@@ -465,7 +466,7 @@ int HvSynicInit(u32 irqVector)
 		/* Setup the Synic's event page */
 		rdmsrl(HV_X64_MSR_SIEFP, siefp.AsUINT64);
 		siefp.SiefpEnabled = 1;
-		siefp.BaseSiefpGpa = virt_to_phys(gHvContext.synICEventPage[0])
+		siefp.BaseSiefpGpa = virt_to_phys(gHvContext.synICEventPage[cpu])
 					>> PAGE_SHIFT;
 
 		DPRINT_DBG(VMBUS, "HV_X64_MSR_SIEFP msr set to: %llx",
@@ -501,32 +502,30 @@ int HvSynicInit(u32 irqVector)
 
 	DPRINT_EXIT(VMBUS);
 
-	return ret;
+	return;
 
 Cleanup:
-	ret = -1;
-
 	if (gHvContext.GuestId == HV_LINUX_GUEST_ID) {
-		if (gHvContext.synICEventPage[0])
-			osd_PageFree(gHvContext.synICEventPage[0], 1);
+		if (gHvContext.synICEventPage[cpu])
+			osd_PageFree(gHvContext.synICEventPage[cpu], 1);
 
-		if (gHvContext.synICMessagePage[0])
-			osd_PageFree(gHvContext.synICMessagePage[0], 1);
+		if (gHvContext.synICMessagePage[cpu])
+			osd_PageFree(gHvContext.synICMessagePage[cpu], 1);
 	}
 
 	DPRINT_EXIT(VMBUS);
-
-	return ret;
+	return;
 }
 
 /**
  * HvSynicCleanup - Cleanup routine for HvSynicInit().
  */
-void HvSynicCleanup(void)
+void HvSynicCleanup(void *arg)
 {
 	union hv_synic_sint sharedSint;
 	union hv_synic_simp simp;
 	union hv_synic_siefp siefp;
+	int cpu = smp_processor_id();
 
 	DPRINT_ENTER(VMBUS);
 
@@ -539,6 +538,7 @@ void HvSynicCleanup(void)
 
 	sharedSint.Masked = 1;
 
+	/* Need to correctly cleanup in the case of SMP!!! */
 	/* Disable the interrupt */
 	wrmsrl(HV_X64_MSR_SINT0 + VMBUS_MESSAGE_SINT, sharedSint.AsUINT64);
 
@@ -560,8 +560,8 @@ void HvSynicCleanup(void)
 
 		wrmsrl(HV_X64_MSR_SIEFP, siefp.AsUINT64);
 
-		osd_PageFree(gHvContext.synICMessagePage[0], 1);
-		osd_PageFree(gHvContext.synICEventPage[0], 1);
+		osd_PageFree(gHvContext.synICMessagePage[cpu], 1);
+		osd_PageFree(gHvContext.synICEventPage[cpu], 1);
 	}
 
 	DPRINT_EXIT(VMBUS);
diff --git a/drivers/staging/hv/Hv.h b/drivers/staging/hv/Hv.h
index 5379e4bfc56e..fce4b5cdac30 100644
--- a/drivers/staging/hv/Hv.h
+++ b/drivers/staging/hv/Hv.h
@@ -93,7 +93,7 @@ static const struct hv_guid VMBUS_SERVICE_ID = {
 	},
 };
 
-#define MAX_NUM_CPUS	1
+#define MAX_NUM_CPUS	32
 
 
 struct hv_input_signal_event_buffer {
@@ -137,8 +137,8 @@ extern u16 HvPostMessage(union hv_connection_id connectionId,
 
 extern u16 HvSignalEvent(void);
 
-extern int HvSynicInit(u32 irqVector);
+extern void HvSynicInit(void *irqarg);
 
-extern void HvSynicCleanup(void);
+extern void HvSynicCleanup(void *arg);
 
 #endif /* __HV_H__ */
diff --git a/drivers/staging/hv/Vmbus.c b/drivers/staging/hv/Vmbus.c
index a4dd06f6d459..35a023e9f9d1 100644
--- a/drivers/staging/hv/Vmbus.c
+++ b/drivers/staging/hv/Vmbus.c
@@ -129,7 +129,7 @@ static int VmbusOnDeviceAdd(struct hv_device *dev, void *AdditionalInfo)
 
 	/* strcpy(dev->name, "vmbus"); */
 	/* SynIC setup... */
-	ret = HvSynicInit(*irqvector);
+	on_each_cpu(HvSynicInit, (void *)irqvector, 1);
 
 	/* Connect to VMBus in the root partition */
 	ret = VmbusConnect();
@@ -150,7 +150,7 @@ static int VmbusOnDeviceRemove(struct hv_device *dev)
 	DPRINT_ENTER(VMBUS);
 	VmbusChannelReleaseUnattachedChannels();
 	VmbusDisconnect();
-	HvSynicCleanup();
+	on_each_cpu(HvSynicCleanup, NULL, 1);
 	DPRINT_EXIT(VMBUS);
 
 	return ret;
@@ -173,7 +173,8 @@ static void VmbusOnCleanup(struct hv_driver *drv)
  */
 static void VmbusOnMsgDPC(struct hv_driver *drv)
 {
-	void *page_addr = gHvContext.synICMessagePage[0];
+	int cpu = smp_processor_id();
+	void *page_addr = gHvContext.synICMessagePage[cpu];
 	struct hv_message *msg = (struct hv_message *)page_addr +
 				  VMBUS_MESSAGE_SINT;
 	struct hv_message *copied;
@@ -230,11 +231,12 @@ static void VmbusOnEventDPC(struct hv_driver *drv)
 static int VmbusOnISR(struct hv_driver *drv)
 {
 	int ret = 0;
+	int cpu = smp_processor_id();
 	void *page_addr;
 	struct hv_message *msg;
 	union hv_synic_event_flags *event;
 
-	page_addr = gHvContext.synICMessagePage[0];
+	page_addr = gHvContext.synICMessagePage[cpu];
 	msg = (struct hv_message *)page_addr + VMBUS_MESSAGE_SINT;
 
 	DPRINT_ENTER(VMBUS);
@@ -248,7 +250,7 @@ static int VmbusOnISR(struct hv_driver *drv)
 	}
 
 	/* TODO: Check if there are events to be process */
-	page_addr = gHvContext.synICEventPage[0];
+	page_addr = gHvContext.synICEventPage[cpu];
 	event = (union hv_synic_event_flags *)page_addr + VMBUS_MESSAGE_SINT;
 
 	/* Since we are a child, we only need to check bit 0 */
diff --git a/drivers/staging/hv/hv_api.h b/drivers/staging/hv/hv_api.h
index 251e2d155331..9eb818ee07ba 100644
--- a/drivers/staging/hv/hv_api.h
+++ b/drivers/staging/hv/hv_api.h
@@ -316,13 +316,13 @@
 
 /*
  * HV_STATUS_VMX_INSTRUCTION_FAILED
- * The requested VMX instruction failed to complete succesfully.
+ * The requested VMX instruction failed to complete successfully.
  */
 #define HV_STATUS_VMX_INSTRUCTION_FAILED		((u16)0x1011)
 
 /*
  * HV_STATUS_VMX_INSTRUCTION_FAILED_WITH_STATUS
- * The requested VMX instruction failed to complete succesfully indicating
+ * The requested VMX instruction failed to complete successfully indicating
  * status.
  */
 #define HV_STATUS_VMX_INSTRUCTION_FAILED_WITH_STATUS	((u16)0x1012)
diff --git a/drivers/staging/iio/Documentation/device.txt b/drivers/staging/iio/Documentation/device.txt
index 6916cd333350..69d9570f29fc 100644
--- a/drivers/staging/iio/Documentation/device.txt
+++ b/drivers/staging/iio/Documentation/device.txt
@@ -10,7 +10,7 @@ First allocate one using:
 
 struct iio_dev *indio_dev = iio_allocate_device();
 
-The fill in the following.
+Then fill in the following:
 
 indio_dev->dev.parent
   the struct device associated with the underlying hardware.
@@ -45,5 +45,5 @@ allocated prior to registering the device with the iio-core, but must
 be registered afterwards (otherwise the whole parentage of devices
 gets confused)
 
-On remove iio_device_unregister(indio_dev) will remove the device from
+On remove, iio_device_unregister(indio_dev) will remove the device from
 the core, and iio_free_device will clean up.
diff --git a/drivers/staging/iio/Documentation/overview.txt b/drivers/staging/iio/Documentation/overview.txt
index 64584ad40241..e39dfc1705aa 100644
--- a/drivers/staging/iio/Documentation/overview.txt
+++ b/drivers/staging/iio/Documentation/overview.txt
@@ -24,11 +24,12 @@ hwmon with simple polled access to device channels via sysfs.
 * Event chrdevs.  These are similar to input in that they provide a
 route to user space for hardware triggered events. Such events include
 threshold detectors, free-fall detectors and more complex action
-detection.  They events themselves are currently very simple with
+detection.  The events themselves are currently very simple with
 merely an event code and a timestamp.  Any data associated with the
-event must be accessed via polling. Note a given device may have one
-or more event channel.  These events are turned on or off (if possible)
-via sysfs interfaces.
+event must be accessed via polling.
+
+Note: A given device may have one or more event channel.  These events are
+turned on or off (if possible) via sysfs interfaces.
 
 * Hardware ring buffer support.  Some recent sensors have included
 fifo / ring buffers on the sensor chip.  These greatly reduce the load
diff --git a/drivers/staging/iio/Kconfig b/drivers/staging/iio/Kconfig
index 4586650d65c3..ace99f6d1166 100644
--- a/drivers/staging/iio/Kconfig
+++ b/drivers/staging/iio/Kconfig
@@ -8,7 +8,7 @@ menuconfig IIO
 	---help---
 	  The industrial I/O subsystem provides a unified framework for
 	  drivers for many different types of embedded sensors using a
-	  number of different physical interfaces (i2c, spi etc). See
+	  number of different physical interfaces (i2c, spi, etc). See
 	  Documentation/industrialio for more information.
 if IIO
 
@@ -23,10 +23,10 @@ if IIO_RING_BUFFER
 config IIO_SW_RING
 	tristate "Industrial I/O lock free software ring"
 	help
-	example software ring buffer implementation.  The design aim
-	of this particular realization was to minize write locking
-	with the intention that some devices would be able to write
-	in interrupt context.
+	  Example software ring buffer implementation.  The design aim
+	  of this particular realization was to minimize write locking
+	  with the intention that some devices would be able to write
+	  in interrupt context.
 
 endif # IIO_RINGBUFFER
 
diff --git a/drivers/staging/iio/accel/Kconfig b/drivers/staging/iio/accel/Kconfig
index fef3da48276c..3d3c3339dbc7 100644
--- a/drivers/staging/iio/accel/Kconfig
+++ b/drivers/staging/iio/accel/Kconfig
@@ -13,6 +13,8 @@ config KXSD9
 config LIS3L02DQ
 	tristate "ST Microelectronics LIS3L02DQ Accelerometer Driver"
 	depends on SPI
+	select IIO_TRIGGER if IIO_RING_BUFFER
+	select IIO_SW_RING if IIO_RING_BUFFER
 	help
 	  Say yes here to build SPI support for the ST microelectronics
 	  accelerometer. The driver supplies direct access via sysfs files
diff --git a/drivers/staging/iio/accel/accel.h b/drivers/staging/iio/accel/accel.h
index 811fa0527a43..d7fc7f98348e 100644
--- a/drivers/staging/iio/accel/accel.h
+++ b/drivers/staging/iio/accel/accel.h
@@ -31,13 +31,13 @@
 	IIO_DEVICE_ATTR(accel_z, S_IRUGO, _show, NULL, _addr)
 
 /* Thresholds are somewhat chip dependent - may need quite a few defs here */
-/* For unified thesholds (shared across all directions */
+/* For unified thresholds (shared across all directions */
 
 /**
  * IIO_DEV_ATTR_ACCEL_THRESH: unified threshold
  * @_mode: read/write
  * @_show: read detector threshold value
- * @_store: write detector theshold value
+ * @_store: write detector threshold value
  * @_addr: driver specific data, typically a register address
  *
  * This one is for cases where as single threshold covers all directions
@@ -48,7 +48,7 @@
 /**
  * IIO_DEV_ATTR_ACCEL_THRESH_X: independant direction threshold, x axis
  * @_mode: readable / writable
- * @_show: read x axis detector theshold value
+ * @_show: read x axis detector threshold value
  * @_store: write x axis detector threshold value
  * @_addr: device driver dependant, typically a register address
  **/
diff --git a/drivers/staging/iio/accel/sca3000.h b/drivers/staging/iio/accel/sca3000.h
index 29e11da09572..da7d3cb5ae71 100644
--- a/drivers/staging/iio/accel/sca3000.h
+++ b/drivers/staging/iio/accel/sca3000.h
@@ -74,7 +74,7 @@
 #define SCA3000_MEAS_MODE_OP_2			0x02
 
 /* In motion detection mode the accelerations are band pass filtered
- * (aprox 1 - 25Hz) and then a programmable theshold used to trigger
+ * (aprox 1 - 25Hz) and then a programmable threshold used to trigger
  * and interrupt.
  */
 #define SCA3000_MEAS_MODE_MOT_DET		0x03
@@ -139,7 +139,7 @@
 /* Values of mulipexed registers (write to ctrl_data after select) */
 #define SCA3000_REG_ADDR_CTRL_DATA		0x22
 
-/* Measurment modes available on some sca3000 series chips. Code assumes others
+/* Measurement modes available on some sca3000 series chips. Code assumes others
  * may become available in the future.
  *
  * Bypass - Bypass the low-pass filter in the signal channel so as to increase
diff --git a/drivers/staging/iio/accel/sca3000_core.c b/drivers/staging/iio/accel/sca3000_core.c
index e27e3b7d1003..cedcaa2b3d1f 100644
--- a/drivers/staging/iio/accel/sca3000_core.c
+++ b/drivers/staging/iio/accel/sca3000_core.c
@@ -720,7 +720,7 @@ error_ret:
 static IIO_DEV_ATTR_TEMP(sca3000_read_temp);
 
 /**
- * sca3000_show_thresh() sysfs query of a theshold
+ * sca3000_show_thresh() sysfs query of a threshold
  **/
 static ssize_t sca3000_show_thresh(struct device *dev,
 				   struct device_attribute *attr,
diff --git a/drivers/staging/iio/adc/Kconfig b/drivers/staging/iio/adc/Kconfig
index b8c2858585f9..3989c0ca0e0d 100644
--- a/drivers/staging/iio/adc/Kconfig
+++ b/drivers/staging/iio/adc/Kconfig
@@ -6,8 +6,18 @@ comment "Analog to digital convertors"
 config MAX1363
 	tristate "MAXIM max1363 ADC driver"
 	depends on I2C
+	select IIO_TRIGGER if IIO_RING_BUFFER
 	help
 	  Say yes here to build support for many MAXIM i2c analog to digital
 	  convertors (ADC). (max1361, max1362, max1363, max1364, max1136,
 	  max1136, max1137, max1138, max1139, max1236, max1237, max11238,
 	  max1239) Provides direct access via sysfs.
+
+config MAX1363_RING_BUFFER
+	bool "MAXIM max1363: use ring buffer"
+	depends on MAX1363
+	select IIO_RING_BUFFER
+	select IIO_SW_RING
+	help
+	  Say yes here to include ring buffer support in the MAX1363
+	  ADC driver.
diff --git a/drivers/staging/iio/adc/Makefile b/drivers/staging/iio/adc/Makefile
index 0c2b6f39e8c8..08cee5c22b92 100644
--- a/drivers/staging/iio/adc/Makefile
+++ b/drivers/staging/iio/adc/Makefile
@@ -3,6 +3,6 @@
 #
 
 max1363-y := max1363_core.o
-max1363-$(CONFIG_IIO_RING_BUFFER) += max1363_ring.o
+max1363-$(CONFIG_MAX1363_RING_BUFFER) += max1363_ring.o
 
 obj-$(CONFIG_MAX1363) += max1363.o
diff --git a/drivers/staging/iio/adc/max1363.h b/drivers/staging/iio/adc/max1363.h
index 8aca81f14d0b..c112fbef2705 100644
--- a/drivers/staging/iio/adc/max1363.h
+++ b/drivers/staging/iio/adc/max1363.h
@@ -228,7 +228,7 @@ struct max1363_state {
 	struct iio_trigger		*trig;
 	struct regulator		*reg;
 };
-#ifdef CONFIG_IIO_RING_BUFFER
+#ifdef CONFIG_MAX1363_RING_BUFFER
 
 ssize_t max1363_scan_from_ring(struct device *dev,
 			       struct device_attribute *attr,
@@ -239,7 +239,7 @@ void max1363_ring_cleanup(struct iio_dev *indio_dev);
 int max1363_initialize_ring(struct iio_ring_buffer *ring);
 void max1363_uninitialize_ring(struct iio_ring_buffer *ring);
 
-#else /* CONFIG_IIO_RING_BUFFER */
+#else /* CONFIG_MAX1363_RING_BUFFER */
 
 static inline void max1363_uninitialize_ring(struct iio_ring_buffer *ring)
 {
@@ -265,5 +265,5 @@ max1363_register_ring_funcs_and_init(struct iio_dev *indio_dev)
 };
 
 static inline void max1363_ring_cleanup(struct iio_dev *indio_dev) {};
-#endif /* CONFIG_IIO_RING_BUFFER */
+#endif /* CONFIG_MAX1363_RING_BUFFER */
 #endif /* _MAX1363_H_ */
diff --git a/drivers/staging/iio/chrdev.h b/drivers/staging/iio/chrdev.h
index 8bc64bf08459..f42bafb3a894 100644
--- a/drivers/staging/iio/chrdev.h
+++ b/drivers/staging/iio/chrdev.h
@@ -75,10 +75,12 @@ struct iio_shared_ev_pointer {
  * @current_events:	number of events in detected list
  * @id:			indentifier to allow the event interface to know which
  *			physical line it corresponds to
+ * @attr:		this chrdev's minor number sysfs attribute
  * @owner:		ensure the driver module owns the file, not iio
  * @private:		driver specific data
  * @_name:		used internally to store the sysfs name for minor id
  *			attribute
+ * @_attrname:		the event interface's attribute name
  */
 struct iio_event_interface {
 	struct device				dev;
@@ -105,7 +107,7 @@ struct iio_event_interface {
  * @handler:		event handler function - called on event if this
  *			event_handler is enabled.
  *
- * Each device has one list of these per interrupt line
+ * Each device has one list of these per interrupt line.
  **/
 struct iio_event_handler_list {
 	struct list_head	list;
diff --git a/drivers/staging/iio/iio.h b/drivers/staging/iio/iio.h
index 25ccb809221e..71dbfe12b579 100644
--- a/drivers/staging/iio/iio.h
+++ b/drivers/staging/iio/iio.h
@@ -166,7 +166,7 @@ static inline int iio_scan_mask_clear(struct iio_dev *dev_info, int bit)
  * @bit: which number scan element is this
  **/
 static inline int iio_scan_mask_count_to_right(struct iio_dev *dev_info,
-int bit)
+						int bit)
 {
 	int count = 0;
 	int mask = (1 << bit);
@@ -239,7 +239,7 @@ void iio_unregister_interrupt_line(struct iio_dev *dev_info,
  * @dev_info:		IIO device structure
  * @ev_line:		Which event line (hardware interrupt)
  * @ev_code:		What event
- * @timestamp:		When the event occured
+ * @timestamp:		When the event occurred
  **/
 int iio_push_event(struct iio_dev *dev_info,
 		  int ev_line,
@@ -248,11 +248,11 @@ int iio_push_event(struct iio_dev *dev_info,
 
 /**
  * struct iio_work_cont - container for when singleton handler case matters
- * @ws:			[DEVICE]work_struct when not only possible event
- * @ws_nocheck:		[DEVICE]work_struct when only possible event
- * @address:		[DEVICE]associated register address
- * @mask:		[DEVICE]associated mask for identifying event source
- * @st:			[DEVICE]device specific state information
+ * @ws:			[DEVICE] work_struct when not only possible event
+ * @ws_nocheck:		[DEVICE] work_struct when only possible event
+ * @address:		[DEVICE] associated register address
+ * @mask:		[DEVICE] associated mask for identifying event source
+ * @st:			[DEVICE] device specific state information
  **/
 struct iio_work_cont {
 	struct work_struct	ws;
@@ -273,9 +273,9 @@ struct iio_work_cont {
  * @cont: the work container
  * @_checkfunc: function called when there are multiple possible int sources
  * @_nocheckfunc: function for when there is only one int source
- * @_add: driver dependant, typically a register address
- * @_mask: driver dependant, typically a bit mask for a register
- * @_st: driver dependant, typically pointer to a device state structure
+ * @_add: driver dependent, typically a register address
+ * @_mask: driver dependent, typically a bit mask for a register
+ * @_st: driver dependent, typically pointer to a device state structure
  **/
 static inline void
 iio_init_work_cont(struct iio_work_cont *cont,
@@ -290,7 +290,7 @@ iio_init_work_cont(struct iio_work_cont *cont,
 	cont->st = _st;
 }
 /**
- * __iio_push_event() tries to add an event to the list associated with a chrdev
+ * __iio_push_event() - tries to add an event to the list associated with a chrdev
  * @ev_int:		the event interface to which we are pushing the event
  * @ev_code:		the outgoing event code
  * @timestamp:		timestamp of the event
@@ -302,8 +302,8 @@ int __iio_push_event(struct iio_event_interface *ev_int,
 		    struct iio_shared_ev_pointer*
 		    shared_pointer_p);
 /**
- * __iio_change_event() change an event code in case of event escallation
- * @ev:			the evnet to be changed
+ * __iio_change_event() - change an event code in case of event escalation
+ * @ev:			the event to be changed
  * @ev_code:		new event code
  * @timestamp:		new timestamp
  **/
@@ -312,7 +312,7 @@ void __iio_change_event(struct iio_detected_event_list *ev,
 			s64 timestamp);
 
 /**
- * iio_setup_ev_int() Configure an event interface (chrdev)
+ * iio_setup_ev_int() - configure an event interface (chrdev)
  * @name:		name used for resulting sysfs directory etc.
  * @ev_int:		interface we are configuring
  * @owner:		module that is responsible for registering this ev_int
@@ -343,7 +343,7 @@ extern dev_t iio_devt;
 extern struct class iio_class;
 
 /**
- * iio_put_device() - reference counted deallocated of struct device
+ * iio_put_device() - reference counted deallocation of struct device
  * @dev: the iio_device containing the device
  **/
 static inline void iio_put_device(struct iio_dev *dev)
@@ -353,7 +353,7 @@ static inline void iio_put_device(struct iio_dev *dev)
 };
 
 /**
- * to_iio_dev() - get iio_dev for which we have have the struct device
+ * to_iio_dev() - get iio_dev for which we have the struct device
  * @d: the struct device
  **/
 static inline struct iio_dev *to_iio_dev(struct device *d)
@@ -377,6 +377,7 @@ struct iio_dev *iio_allocate_device(void);
 
 /**
  * iio_free_device() - free an iio_dev from a driver
+ * @dev: the iio_dev associated with the device
  **/
 void iio_free_device(struct iio_dev *dev);
 
@@ -395,7 +396,8 @@ int iio_device_get_chrdev_minor(void);
 void iio_device_free_chrdev_minor(int val);
 
 /**
- * iio_ring_enabled() helper function to test if any form of ring enabled
+ * iio_ring_enabled() - helper function to test if any form of ring is enabled
+ * @dev_info:		IIO device info structure for device
  **/
 static inline bool iio_ring_enabled(struct iio_dev *dev_info)
 {
diff --git a/drivers/staging/iio/light/Kconfig b/drivers/staging/iio/light/Kconfig
index 12af0c46fe22..80cb6e590fbb 100644
--- a/drivers/staging/iio/light/Kconfig
+++ b/drivers/staging/iio/light/Kconfig
@@ -3,11 +3,13 @@
 #
 comment "Light sensors"
 
-config TSL2561
-       tristate "TAOS TSL2561 light-to-digital convertor"
-       depends on I2C
-       help
-	Say yes bere to build support for the TAOS light to digital
-	convertor.  This chip has two light sensors. One is broadband
-	including infrared whilst the other measures only infrared.
-	Provides direct access via sysfs.
+config SENSORS_TSL2563
+	tristate "TAOS TSL256[0-3] ambient light sensor"
+	depends on I2C
+	help
+	 If you say yes here you get support for the Taos TSL2560,
+	 TSL2561, TSL2562 and TSL2563 ambient light sensors.
+
+	 This driver can also be built as a module.  If so, the module
+	 will be called tsl2563.
+
diff --git a/drivers/staging/iio/light/Makefile b/drivers/staging/iio/light/Makefile
index ccff15167609..30f3300e2a68 100644
--- a/drivers/staging/iio/light/Makefile
+++ b/drivers/staging/iio/light/Makefile
@@ -2,4 +2,4 @@
 # Makefile for industrial I/O Light sensors
 #
 
-obj-$(CONFIG_TSL2561)   += tsl2561.o
+obj-$(CONFIG_SENSORS_TSL2563)	+= tsl2563.o
diff --git a/drivers/staging/iio/light/tsl2561.c b/drivers/staging/iio/light/tsl2561.c
deleted file mode 100644
index fc2107f4c049..000000000000
--- a/drivers/staging/iio/light/tsl2561.c
+++ /dev/null
@@ -1,272 +0,0 @@
-/*
- *  tsl2561.c - Linux kernel modules for light to digital convertor
- *
- *  Copyright (C) 2008-2009 Jonathan Cameron <jic23@cam.ac.uk>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
- *
- *  Some portions based upon the tsl2550 driver.
- *
- *  This driver could probably be adapted easily to talk to the tsl2560 (smbus)
- *
- *  Needs some work to support the events this can generate.
- *  Todo: Implement interrupt handling.  Currently a hardware bug means
- *  this isn't available on my test board.
- */
-
-#include <linux/module.h>
-#include <linux/init.h>
-#include <linux/i2c.h>
-#include "../iio.h"
-#include "../sysfs.h"
-#include "light.h"
-
-#define TSL2561_CONTROL_REGISTER 0x00
-#define TSL2561_TIMING_REGISTER 0x01
-#define TSL2561_THRESHLOW_LOW_REGISTER 0x02
-#define TSL2561_THRESHLOW_HIGH_REGISTER 0x03
-#define TSL2561_THRESHHIGH_LOW_REGISTER 0x04
-#define TSL2561_THRESHHIGH_HIGH_REGISTER 0x05
-#define TSL2561_INT_CONTROL_REGISTER 0x06
-
-#define TSL2561_INT_REG_INT_OFF 0x00
-#define TSL2561_INT_REG_INT_LEVEL 0x08
-#define TSL2561_INT_REG_INT_SMBUS 0x10
-#define TSL2561_INT_REG_INT_TEST 0x18
-
-#define TSL2561_ID_REGISTER 0x0A
-
-#define TSL2561_DATA_0_LOW 0x0C
-#define TSL2561_DATA_1_LOW 0x0E
-
-/* Control Register Values */
-#define TSL2561_CONT_REG_PWR_ON 0x03
-#define TSL2561_CONT_REG_PWR_OFF 0x00
-
-/**
- * struct tsl2561_state - device specific state
- * @indio_dev:		the industrialio I/O info structure
- * @client:		i2c client
- * @command_buf:	single command buffer used for all operations
- * @command_buf_lock:	ensure unique access to command_buf
- */
-struct tsl2561_state {
-	struct iio_dev		*indio_dev;
-	struct i2c_client	*client;
-	struct tsl2561_command	*command_buf;
-	struct mutex		command_buf_lock;
-};
-
-/**
- * struct tsl2561_command - command byte for smbus
- * @address:	register address
- * @block:	is this a block r/w
- * @word:	is this a word r/w
- * @clear:	set to 1 to clear pending interrupt
- * @cmd:	select the command register - always 1.
- */
-struct tsl2561_command {
-	unsigned int address:4;
-	unsigned int block:1;
-	unsigned int word:1;
-	unsigned int clear:1;
-	unsigned int cmd:1;
-};
-
-static inline void tsl2561_init_command_buf(struct tsl2561_command *buf)
-{
-	buf->address = 0;
-	buf->block = 0;
-	buf->word = 0;
-	buf->clear = 0;
-	buf->cmd = 1;
-}
-
-static ssize_t tsl2561_read_val(struct device *dev,
-				struct device_attribute *attr,
-				char *buf)
-{
-	int ret = 0, data;
-	ssize_t len = 0;
-	struct iio_dev_attr *this_attr = to_iio_dev_attr(attr);
-	struct iio_dev *indio_dev = dev_get_drvdata(dev);
-	struct tsl2561_state *st = indio_dev->dev_data;
-
-	mutex_lock(&st->command_buf_lock);
-	st->command_buf->cmd = 1;
-	st->command_buf->word = 1;
-	st->command_buf->address = this_attr->address;
-
-	data = i2c_smbus_read_word_data(st->client, *(char *)(st->command_buf));
-	if (data < 0) {
-		ret = data;
-		goto error_ret;
-	}
-	len = sprintf(buf, "%u\n", data);
-
-error_ret:
-	mutex_unlock(&st->command_buf_lock);
-
-	return ret ? ret : len;
-}
-
-static IIO_DEV_ATTR_LIGHT_INFRARED(0, tsl2561_read_val, TSL2561_DATA_0_LOW);
-static IIO_DEV_ATTR_LIGHT_BROAD(0, tsl2561_read_val, TSL2561_DATA_1_LOW);
-
-static struct attribute *tsl2561_attributes[] = {
-	&iio_dev_attr_light_infrared0.dev_attr.attr,
-	&iio_dev_attr_light_broadspectrum0.dev_attr.attr,
-	NULL,
-};
-
-static const struct attribute_group tsl2561_attribute_group = {
-	.attrs = tsl2561_attributes,
-};
-
-static int tsl2561_initialize(struct tsl2561_state *st)
-{
-	int err;
-
-	mutex_lock(&st->command_buf_lock);
-	st->command_buf->word = 0;
-	st->command_buf->block = 0;
-	st->command_buf->address = TSL2561_CONTROL_REGISTER;
-	err = i2c_smbus_write_byte_data(st->client, *(char *)(st->command_buf),
-					TSL2561_CONT_REG_PWR_ON);
-	if (err)
-		goto error_ret;
-
-	st->command_buf->address = TSL2561_INT_CONTROL_REGISTER;
-	err = i2c_smbus_write_byte_data(st->client, *(char *)(st->command_buf),
-					TSL2561_INT_REG_INT_TEST);
-
-error_ret:
-	mutex_unlock(&st->command_buf_lock);
-
-	return err;
-}
-
-static int tsl2561_powerdown(struct i2c_client *client)
-{
-	int err;
-	struct tsl2561_command Command = {
-		.cmd =  1,
-		.clear = 0,
-		.word = 0,
-		.block = 0,
-		.address = TSL2561_CONTROL_REGISTER,
-	};
-
-	err = i2c_smbus_write_byte_data(client, *(char *)(&Command),
-					TSL2561_CONT_REG_PWR_OFF);
-	return (err < 0) ? err : 0;
-}
-static int __devinit tsl2561_probe(struct i2c_client *client,
-				   const struct i2c_device_id *id)
-{
-	int ret = 0, regdone = 0;
-	struct tsl2561_state *st = kzalloc(sizeof(*st), GFP_KERNEL);
-
-	if (st == NULL) {
-		ret = -ENOMEM;
-		goto error_ret;
-	}
-	i2c_set_clientdata(client, st);
-	st->client = client;
-	mutex_init(&st->command_buf_lock);
-
-	st->command_buf = kmalloc(sizeof(*st->command_buf), GFP_KERNEL);
-	if (st->command_buf == NULL) {
-		ret = -ENOMEM;
-		goto error_free_state;
-	}
-	tsl2561_init_command_buf(st->command_buf);
-
-	st->indio_dev = iio_allocate_device();
-	if (st->indio_dev == NULL) {
-		ret = -ENOMEM;
-		goto error_free_command_buf;
-	}
-	st->indio_dev->attrs = &tsl2561_attribute_group;
-	st->indio_dev->dev.parent = &client->dev;
-	st->indio_dev->dev_data = (void *)(st);
-	st->indio_dev->driver_module = THIS_MODULE;
-	st->indio_dev->modes = INDIO_DIRECT_MODE;
-	ret = iio_device_register(st->indio_dev);
-	if (ret)
-		goto error_free_iiodev;
-	regdone = 1;
-	/* Intialize the chip */
-	ret = tsl2561_initialize(st);
-	if (ret)
-		goto error_unregister_iiodev;
-
-	return 0;
-error_unregister_iiodev:
-error_free_iiodev:
-	if (regdone)
-		iio_device_unregister(st->indio_dev);
-	else
-		iio_free_device(st->indio_dev);
-error_free_command_buf:
-	kfree(st->command_buf);
-error_free_state:
-	kfree(st);
-error_ret:
-	return ret;
-
-}
-
-static int __devexit tsl2561_remove(struct i2c_client *client)
-{
-	struct tsl2561_state *st =  i2c_get_clientdata(client);
-
-	iio_device_unregister(st->indio_dev);
-	kfree(st);
-
-	return tsl2561_powerdown(client);
-}
-
-static const struct i2c_device_id tsl2561_id[] = {
-	{ "tsl2561", 0 },
-	{ }
-};
-MODULE_DEVICE_TABLE(i2c, tsl2561_id);
-
-
-static struct i2c_driver tsl2561_driver = {
-	.driver = {
-		.name = "tsl2561",
-	},
-	.probe = tsl2561_probe,
-	.remove = __devexit_p(tsl2561_remove),
-	.id_table  = tsl2561_id,
-};
-
-static __init int tsl2561_init(void)
-{
-	return i2c_add_driver(&tsl2561_driver);
-}
-module_init(tsl2561_init);
-
-static __exit void tsl2561_exit(void)
-{
-	i2c_del_driver(&tsl2561_driver);
-}
-module_exit(tsl2561_exit);
-
-MODULE_AUTHOR("Jonathan Cameron <jic23@cam.ac.uk>");
-MODULE_DESCRIPTION("TSL2561 light sensor driver");
-MODULE_LICENSE("GPL");
diff --git a/drivers/staging/iio/light/tsl2563.c b/drivers/staging/iio/light/tsl2563.c
new file mode 100644
index 000000000000..78b9432c8105
--- /dev/null
+++ b/drivers/staging/iio/light/tsl2563.c
@@ -0,0 +1,773 @@
+/*
+ * drivers/i2c/chips/tsl2563.c
+ *
+ * Copyright (C) 2008 Nokia Corporation
+ *
+ * Written by Timo O. Karjalainen <timo.o.karjalainen@nokia.com>
+ * Contact: Amit Kucheria <amit.kucheria@verdurent.com>
+ *
+ * Converted to IIO driver
+ * Amit Kucheria <amit.kucheria@verdurent.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ */
+
+#include <linux/module.h>
+#include <linux/i2c.h>
+#include <linux/interrupt.h>
+#include <linux/sched.h>
+#include <linux/mutex.h>
+#include <linux/delay.h>
+#include <linux/platform_device.h>
+#include <linux/pm.h>
+#include <linux/hwmon.h>
+#include <linux/err.h>
+
+#include "../iio.h"
+#include "tsl2563.h"
+
+/* Use this many bits for fraction part. */
+#define ADC_FRAC_BITS		(14)
+
+/* Given number of 1/10000's in ADC_FRAC_BITS precision. */
+#define FRAC10K(f)		(((f) * (1L << (ADC_FRAC_BITS))) / (10000))
+
+/* Bits used for fraction in calibration coefficients.*/
+#define CALIB_FRAC_BITS		(10)
+/* 0.5 in CALIB_FRAC_BITS precision */
+#define CALIB_FRAC_HALF		(1 << (CALIB_FRAC_BITS - 1))
+/* Make a fraction from a number n that was multiplied with b. */
+#define CALIB_FRAC(n, b)	(((n) << CALIB_FRAC_BITS) / (b))
+/* Decimal 10^(digits in sysfs presentation) */
+#define CALIB_BASE_SYSFS	(1000)
+
+#define TSL2563_CMD		(0x80)
+#define TSL2563_CLEARINT	(0x40)
+
+#define TSL2563_REG_CTRL	(0x00)
+#define TSL2563_REG_TIMING	(0x01)
+#define TSL2563_REG_LOWLOW	(0x02) /* data0 low threshold, 2 bytes */
+#define TSL2563_REG_LOWHIGH	(0x03)
+#define TSL2563_REG_HIGHLOW	(0x04) /* data0 high threshold, 2 bytes */
+#define TSL2563_REG_HIGHHIGH	(0x05)
+#define TSL2563_REG_INT		(0x06)
+#define TSL2563_REG_ID		(0x0a)
+#define TSL2563_REG_DATA0LOW	(0x0c) /* broadband sensor value, 2 bytes */
+#define TSL2563_REG_DATA0HIGH	(0x0d)
+#define TSL2563_REG_DATA1LOW	(0x0e) /* infrared sensor value, 2 bytes */
+#define TSL2563_REG_DATA1HIGH	(0x0f)
+
+#define TSL2563_CMD_POWER_ON	(0x03)
+#define TSL2563_CMD_POWER_OFF	(0x00)
+#define TSL2563_CTRL_POWER_MASK	(0x03)
+
+#define TSL2563_TIMING_13MS	(0x00)
+#define TSL2563_TIMING_100MS	(0x01)
+#define TSL2563_TIMING_400MS	(0x02)
+#define TSL2563_TIMING_MASK	(0x03)
+#define TSL2563_TIMING_GAIN16	(0x10)
+#define TSL2563_TIMING_GAIN1	(0x00)
+
+#define TSL2563_INT_DISBLED	(0x00)
+#define TSL2563_INT_LEVEL	(0x10)
+#define TSL2563_INT_PERSIST(n)	((n) & 0x0F)
+
+struct tsl2563_gainlevel_coeff {
+	u8 gaintime;
+	u16 min;
+	u16 max;
+};
+
+static struct tsl2563_gainlevel_coeff tsl2563_gainlevel_table[] = {
+	{
+		.gaintime	= TSL2563_TIMING_400MS | TSL2563_TIMING_GAIN16,
+		.min		= 0,
+		.max		= 65534,
+	}, {
+		.gaintime	= TSL2563_TIMING_400MS | TSL2563_TIMING_GAIN1,
+		.min		= 2048,
+		.max		= 65534,
+	}, {
+		.gaintime	= TSL2563_TIMING_100MS | TSL2563_TIMING_GAIN1,
+		.min		= 4095,
+		.max		= 37177,
+	}, {
+		.gaintime	= TSL2563_TIMING_13MS | TSL2563_TIMING_GAIN1,
+		.min		= 3000,
+		.max		= 65535,
+	},
+};
+
+struct tsl2563_chip {
+	struct mutex		lock;
+	struct i2c_client	*client;
+	struct iio_dev		*indio_dev;
+	struct delayed_work	poweroff_work;
+
+	/* Remember state for suspend and resume functions */
+	pm_message_t		state;
+
+	struct tsl2563_gainlevel_coeff *gainlevel;
+
+	/* Thresholds are in lux */
+	u16			low_thres;
+	u16			high_thres;
+	u8			intr;
+
+	/* Calibration coefficients */
+	u32			calib0;
+	u32			calib1;
+	int			cover_comp_gain;
+
+	/* Cache current values, to be returned while suspended */
+	u32			data0;
+	u32			data1;
+};
+
+static int tsl2563_write(struct i2c_client *client, u8 reg, u8 value)
+{
+	int ret;
+	u8 buf[2];
+
+	buf[0] = TSL2563_CMD | reg;
+	buf[1] = value;
+
+	ret = i2c_master_send(client, buf, sizeof(buf));
+	return (ret == sizeof(buf)) ? 0 : ret;
+}
+
+static int tsl2563_read(struct i2c_client *client, u8 reg, void *buf, int len)
+{
+	int ret;
+	u8 cmd = TSL2563_CMD | reg;
+
+	ret = i2c_master_send(client, &cmd, sizeof(cmd));
+	if (ret != sizeof(cmd))
+		return ret;
+
+	return i2c_master_recv(client, buf, len);
+}
+
+static int tsl2563_set_power(struct tsl2563_chip *chip, int on)
+{
+	struct i2c_client *client = chip->client;
+	u8 cmd;
+
+	cmd = on ? TSL2563_CMD_POWER_ON : TSL2563_CMD_POWER_OFF;
+	return tsl2563_write(client, TSL2563_REG_CTRL, cmd);
+}
+
+/*
+ * Return value is 0 for off, 1 for on, or a negative error
+ * code if reading failed.
+ */
+static int tsl2563_get_power(struct tsl2563_chip *chip)
+{
+	struct i2c_client *client = chip->client;
+	int ret;
+	u8 val;
+
+	ret = tsl2563_read(client, TSL2563_REG_CTRL, &val, sizeof(val));
+	if (ret != sizeof(val))
+		return ret;
+
+	return (val & TSL2563_CTRL_POWER_MASK) == TSL2563_CMD_POWER_ON;
+}
+
+static int tsl2563_configure(struct tsl2563_chip *chip)
+{
+	struct i2c_client *client = chip->client;
+	int ret;
+
+	ret = tsl2563_write(client, TSL2563_REG_TIMING,
+			chip->gainlevel->gaintime);
+	if (ret)
+		goto out;
+
+	ret = tsl2563_write(client, TSL2563_REG_INT, chip->intr);
+
+out:
+	return ret;
+}
+
+static void tsl2563_poweroff_work(struct work_struct *work)
+{
+	struct tsl2563_chip *chip =
+		container_of(work, struct tsl2563_chip, poweroff_work.work);
+	tsl2563_set_power(chip, 0);
+}
+
+static int tsl2563_detect(struct tsl2563_chip *chip)
+{
+	int ret;
+
+	ret = tsl2563_set_power(chip, 1);
+	if (ret)
+		return ret;
+
+	ret = tsl2563_get_power(chip);
+	if (ret < 0)
+		return ret;
+
+	return ret ? 0 : -ENODEV;
+}
+
+static int tsl2563_read_id(struct tsl2563_chip *chip, u8 *id)
+{
+	struct i2c_client *client = chip->client;
+	int ret;
+
+	ret = tsl2563_read(client, TSL2563_REG_ID, id, sizeof(*id));
+	if (ret != sizeof(*id))
+		return ret;
+
+	return 0;
+}
+
+/*
+ * "Normalized" ADC value is one obtained with 400ms of integration time and
+ * 16x gain. This function returns the number of bits of shift needed to
+ * convert between normalized values and HW values obtained using given
+ * timing and gain settings.
+ */
+static int adc_shiftbits(u8 timing)
+{
+	int shift = 0;
+
+	switch (timing & TSL2563_TIMING_MASK) {
+	case TSL2563_TIMING_13MS:
+		shift += 5;
+		break;
+	case TSL2563_TIMING_100MS:
+		shift += 2;
+		break;
+	case TSL2563_TIMING_400MS:
+		/* no-op */
+		break;
+	}
+
+	if (!(timing & TSL2563_TIMING_GAIN16))
+		shift += 4;
+
+	return shift;
+}
+
+/* Convert a HW ADC value to normalized scale. */
+static u32 normalize_adc(u16 adc, u8 timing)
+{
+	return adc << adc_shiftbits(timing);
+}
+
+static void tsl2563_wait_adc(struct tsl2563_chip *chip)
+{
+	unsigned int delay;
+
+	switch (chip->gainlevel->gaintime & TSL2563_TIMING_MASK) {
+	case TSL2563_TIMING_13MS:
+		delay = 14;
+		break;
+	case TSL2563_TIMING_100MS:
+		delay = 101;
+		break;
+	default:
+		delay = 402;
+	}
+	/*
+	 * TODO: Make sure that we wait at least required delay but why we
+	 * have to extend it one tick more?
+	 */
+	schedule_timeout_interruptible(msecs_to_jiffies(delay) + 2);
+}
+
+static int tsl2563_adjust_gainlevel(struct tsl2563_chip *chip, u16 adc)
+{
+	struct i2c_client *client = chip->client;
+
+	if (adc > chip->gainlevel->max || adc < chip->gainlevel->min) {
+
+		(adc > chip->gainlevel->max) ?
+			chip->gainlevel++ : chip->gainlevel--;
+
+		tsl2563_write(client, TSL2563_REG_TIMING,
+			      chip->gainlevel->gaintime);
+
+		tsl2563_wait_adc(chip);
+		tsl2563_wait_adc(chip);
+
+		return 1;
+	} else
+		return 0;
+}
+
+static int tsl2563_get_adc(struct tsl2563_chip *chip)
+{
+	struct i2c_client *client = chip->client;
+	u8 buf0[2], buf1[2];
+	u16 adc0, adc1;
+	int retry = 1;
+	int ret = 0;
+
+	if (chip->state.event != PM_EVENT_ON)
+		goto out;
+
+	cancel_delayed_work(&chip->poweroff_work);
+
+	if (!tsl2563_get_power(chip)) {
+		ret = tsl2563_set_power(chip, 1);
+		if (ret)
+			goto out;
+		ret = tsl2563_configure(chip);
+		if (ret)
+			goto out;
+		tsl2563_wait_adc(chip);
+	}
+
+	while (retry) {
+		ret = tsl2563_read(client,
+				   TSL2563_REG_DATA0LOW | TSL2563_CLEARINT,
+				   buf0, sizeof(buf0));
+		if (ret != sizeof(buf0))
+			goto out;
+
+		ret = tsl2563_read(client, TSL2563_REG_DATA1LOW,
+				   buf1, sizeof(buf1));
+		if (ret != sizeof(buf1))
+			goto out;
+
+		adc0 = (buf0[1] << 8) + buf0[0];
+		adc1 = (buf1[1] << 8) + buf1[0];
+
+		retry = tsl2563_adjust_gainlevel(chip, adc0);
+	}
+
+	chip->data0 = normalize_adc(adc0, chip->gainlevel->gaintime);
+	chip->data1 = normalize_adc(adc1, chip->gainlevel->gaintime);
+
+	schedule_delayed_work(&chip->poweroff_work, 5 * HZ);
+
+	ret = 0;
+out:
+	return ret;
+}
+
+static inline int calib_to_sysfs(u32 calib)
+{
+	return (int) (((calib * CALIB_BASE_SYSFS) +
+		       CALIB_FRAC_HALF) >> CALIB_FRAC_BITS);
+}
+
+static inline u32 calib_from_sysfs(int value)
+{
+	return (((u32) value) << CALIB_FRAC_BITS) / CALIB_BASE_SYSFS;
+}
+
+/*
+ * Conversions between lux and ADC values.
+ *
+ * The basic formula is lux = c0 * adc0 - c1 * adc1, where c0 and c1 are
+ * appropriate constants. Different constants are needed for different
+ * kinds of light, determined by the ratio adc1/adc0 (basically the ratio
+ * of the intensities in infrared and visible wavelengths). lux_table below
+ * lists the upper threshold of the adc1/adc0 ratio and the corresponding
+ * constants.
+ */
+
+struct tsl2563_lux_coeff {
+	unsigned long ch_ratio;
+	unsigned long ch0_coeff;
+	unsigned long ch1_coeff;
+};
+
+static const struct tsl2563_lux_coeff lux_table[] = {
+	{
+		.ch_ratio	= FRAC10K(1300),
+		.ch0_coeff	= FRAC10K(315),
+		.ch1_coeff	= FRAC10K(262),
+	}, {
+		.ch_ratio	= FRAC10K(2600),
+		.ch0_coeff	= FRAC10K(337),
+		.ch1_coeff	= FRAC10K(430),
+	}, {
+		.ch_ratio	= FRAC10K(3900),
+		.ch0_coeff	= FRAC10K(363),
+		.ch1_coeff	= FRAC10K(529),
+	}, {
+		.ch_ratio	= FRAC10K(5200),
+		.ch0_coeff	= FRAC10K(392),
+		.ch1_coeff	= FRAC10K(605),
+	}, {
+		.ch_ratio	= FRAC10K(6500),
+		.ch0_coeff	= FRAC10K(229),
+		.ch1_coeff	= FRAC10K(291),
+	}, {
+		.ch_ratio	= FRAC10K(8000),
+		.ch0_coeff	= FRAC10K(157),
+		.ch1_coeff	= FRAC10K(180),
+	}, {
+		.ch_ratio	= FRAC10K(13000),
+		.ch0_coeff	= FRAC10K(34),
+		.ch1_coeff	= FRAC10K(26),
+	}, {
+		.ch_ratio	= ULONG_MAX,
+		.ch0_coeff	= 0,
+		.ch1_coeff	= 0,
+	},
+};
+
+/*
+ * Convert normalized, scaled ADC values to lux.
+ */
+static unsigned int adc_to_lux(u32 adc0, u32 adc1)
+{
+	const struct tsl2563_lux_coeff *lp = lux_table;
+	unsigned long ratio, lux, ch0 = adc0, ch1 = adc1;
+
+	ratio = ch0 ? ((ch1 << ADC_FRAC_BITS) / ch0) : ULONG_MAX;
+
+	while (lp->ch_ratio < ratio)
+		lp++;
+
+	lux = ch0 * lp->ch0_coeff - ch1 * lp->ch1_coeff;
+
+	return (unsigned int) (lux >> ADC_FRAC_BITS);
+}
+
+/*--------------------------------------------------------------*/
+/*                      Sysfs interface                         */
+/*--------------------------------------------------------------*/
+
+static ssize_t tsl2563_adc0_show(struct device *dev,
+				struct device_attribute *attr, char *buf)
+{
+	struct iio_dev *indio_dev = dev_get_drvdata(dev);
+	struct tsl2563_chip *chip = indio_dev->dev_data;
+	int ret;
+
+	mutex_lock(&chip->lock);
+
+	ret = tsl2563_get_adc(chip);
+	if (ret)
+		goto out;
+
+	ret = snprintf(buf, PAGE_SIZE, "%d\n", chip->data0);
+out:
+	mutex_unlock(&chip->lock);
+	return ret;
+}
+
+static ssize_t tsl2563_adc1_show(struct device *dev,
+				struct device_attribute *attr, char *buf)
+{
+	struct iio_dev *indio_dev = dev_get_drvdata(dev);
+	struct tsl2563_chip *chip = indio_dev->dev_data;
+	int ret;
+
+	mutex_lock(&chip->lock);
+
+	ret = tsl2563_get_adc(chip);
+	if (ret)
+		goto out;
+
+	ret = snprintf(buf, PAGE_SIZE, "%d\n", chip->data1);
+out:
+	mutex_unlock(&chip->lock);
+	return ret;
+}
+
+/* Apply calibration coefficient to ADC count. */
+static u32 calib_adc(u32 adc, u32 calib)
+{
+	unsigned long scaled = adc;
+
+	scaled *= calib;
+	scaled >>= CALIB_FRAC_BITS;
+
+	return (u32) scaled;
+}
+
+static ssize_t tsl2563_lux_show(struct device *dev,
+				struct device_attribute *attr, char *buf)
+{
+	struct iio_dev *indio_dev = dev_get_drvdata(dev);
+	struct tsl2563_chip *chip = indio_dev->dev_data;
+	u32 calib0, calib1;
+	int ret;
+
+	mutex_lock(&chip->lock);
+
+	ret = tsl2563_get_adc(chip);
+	if (ret)
+		goto out;
+
+	calib0 = calib_adc(chip->data0, chip->calib0) * chip->cover_comp_gain;
+	calib1 = calib_adc(chip->data1, chip->calib1) * chip->cover_comp_gain;
+
+	ret = snprintf(buf, PAGE_SIZE, "%d\n", adc_to_lux(calib0, calib1));
+
+out:
+	mutex_unlock(&chip->lock);
+	return ret;
+}
+
+static ssize_t format_calib(char *buf, int len, u32 calib)
+{
+	return snprintf(buf, PAGE_SIZE, "%d\n", calib_to_sysfs(calib));
+}
+
+static ssize_t tsl2563_calib0_show(struct device *dev,
+				   struct device_attribute *attr, char *buf)
+{
+	struct iio_dev *indio_dev = dev_get_drvdata(dev);
+	struct tsl2563_chip *chip = indio_dev->dev_data;
+	int ret;
+
+	mutex_lock(&chip->lock);
+	ret = format_calib(buf, PAGE_SIZE, chip->calib0);
+	mutex_unlock(&chip->lock);
+	return ret;
+}
+
+static ssize_t tsl2563_calib1_show(struct device *dev,
+				   struct device_attribute *attr, char *buf)
+{
+	struct iio_dev *indio_dev = dev_get_drvdata(dev);
+	struct tsl2563_chip *chip = indio_dev->dev_data;
+	int ret;
+
+	mutex_lock(&chip->lock);
+	ret = format_calib(buf, PAGE_SIZE, chip->calib1);
+	mutex_unlock(&chip->lock);
+	return ret;
+}
+
+static int do_calib_store(struct device *dev, const char *buf, size_t len,
+			  int ch)
+{
+	struct iio_dev *indio_dev = dev_get_drvdata(dev);
+	struct tsl2563_chip *chip = indio_dev->dev_data;
+	int value;
+	u32 calib;
+
+	if (1 != sscanf(buf, "%d", &value))
+		return -EINVAL;
+
+	calib = calib_from_sysfs(value);
+
+	if (ch)
+		chip->calib1 = calib;
+	else
+		chip->calib0 = calib;
+
+	return len;
+}
+
+static ssize_t tsl2563_calib0_store(struct device *dev,
+				    struct device_attribute *attr,
+				    const char *buf, size_t len)
+{
+	return do_calib_store(dev, buf, len, 0);
+}
+
+static ssize_t tsl2563_calib1_store(struct device *dev,
+				    struct device_attribute *attr,
+				    const char *buf, size_t len)
+{
+	return do_calib_store(dev, buf, len, 1);
+}
+
+/* AmitXXXX: Convert to IIO_DEV_ATTR_LIGHT* as in tsl2561
+ * once I understand what they mean */
+static DEVICE_ATTR(adc0, S_IRUGO, tsl2563_adc0_show, NULL);
+static DEVICE_ATTR(adc1, S_IRUGO, tsl2563_adc1_show, NULL);
+static DEVICE_ATTR(lux, S_IRUGO, tsl2563_lux_show, NULL);
+static DEVICE_ATTR(calib0, S_IRUGO | S_IWUSR,
+		   tsl2563_calib0_show, tsl2563_calib0_store);
+static DEVICE_ATTR(calib1, S_IRUGO | S_IWUSR,
+		   tsl2563_calib1_show, tsl2563_calib1_store);
+
+static struct attribute *tsl2563_attributes[] = {
+	&dev_attr_adc0.attr,
+	&dev_attr_adc1.attr,
+	&dev_attr_lux.attr,
+	&dev_attr_calib0.attr,
+	&dev_attr_calib1.attr,
+	NULL
+};
+
+static const struct attribute_group tsl2563_group = {
+	.attrs = tsl2563_attributes,
+};
+
+/*--------------------------------------------------------------*/
+/*                      Probe, Attach, Remove                   */
+/*--------------------------------------------------------------*/
+static struct i2c_driver tsl2563_i2c_driver;
+
+static int __devinit tsl2563_probe(struct i2c_client *client,
+				const struct i2c_device_id *device_id)
+{
+	struct tsl2563_chip *chip;
+	struct tsl2563_platform_data *pdata = client->dev.platform_data;
+	int err = 0;
+	int ret;
+	u8 id;
+
+	chip = kzalloc(sizeof(*chip), GFP_KERNEL);
+	if (!chip)
+		return -ENOMEM;
+
+	i2c_set_clientdata(client, chip);
+	chip->client = client;
+
+	err = tsl2563_detect(chip);
+	if (err) {
+		dev_err(&client->dev, "device not found, error %d \n", -err);
+		goto fail1;
+	}
+
+	err = tsl2563_read_id(chip, &id);
+	if (err)
+		goto fail1;
+
+	mutex_init(&chip->lock);
+
+	/* Default values used until userspace says otherwise */
+	chip->low_thres = 0x0;
+	chip->high_thres = 0xffff;
+	chip->gainlevel = tsl2563_gainlevel_table;
+	chip->intr = TSL2563_INT_PERSIST(4);
+	chip->calib0 = calib_from_sysfs(CALIB_BASE_SYSFS);
+	chip->calib1 = calib_from_sysfs(CALIB_BASE_SYSFS);
+
+	if (pdata)
+		chip->cover_comp_gain = pdata->cover_comp_gain;
+	else
+		chip->cover_comp_gain = 1;
+
+	dev_info(&client->dev, "model %d, rev. %d\n", id >> 4, id & 0x0f);
+
+	chip->indio_dev = iio_allocate_device();
+	if (!chip->indio_dev)
+		goto fail1;
+	chip->indio_dev->attrs = &tsl2563_group;
+	chip->indio_dev->dev.parent = &client->dev;
+	chip->indio_dev->dev_data = (void *)(chip);
+	chip->indio_dev->driver_module = THIS_MODULE;
+	chip->indio_dev->modes = INDIO_DIRECT_MODE;
+	ret = iio_device_register(chip->indio_dev);
+	if (ret)
+		goto fail1;
+
+	err = tsl2563_configure(chip);
+	if (err)
+		goto fail2;
+
+	INIT_DELAYED_WORK(&chip->poweroff_work, tsl2563_poweroff_work);
+	schedule_delayed_work(&chip->poweroff_work, 5 * HZ);
+
+	return 0;
+fail2:
+	iio_device_unregister(chip->indio_dev);
+fail1:
+	kfree(chip);
+	return err;
+}
+
+static int tsl2563_remove(struct i2c_client *client)
+{
+	struct tsl2563_chip *chip = i2c_get_clientdata(client);
+
+	iio_device_unregister(chip->indio_dev);
+
+	kfree(chip);
+	return 0;
+}
+
+static int tsl2563_suspend(struct i2c_client *client, pm_message_t state)
+{
+	struct tsl2563_chip *chip = i2c_get_clientdata(client);
+	int ret;
+
+	mutex_lock(&chip->lock);
+
+	ret = tsl2563_set_power(chip, 0);
+	if (ret)
+		goto out;
+
+	chip->state = state;
+
+out:
+	mutex_unlock(&chip->lock);
+	return ret;
+}
+
+static int tsl2563_resume(struct i2c_client *client)
+{
+	struct tsl2563_chip *chip = i2c_get_clientdata(client);
+	int ret;
+
+	mutex_lock(&chip->lock);
+
+	ret = tsl2563_set_power(chip, 1);
+	if (ret)
+		goto out;
+
+	ret = tsl2563_configure(chip);
+	if (ret)
+		goto out;
+
+	chip->state.event = PM_EVENT_ON;
+
+out:
+	mutex_unlock(&chip->lock);
+	return ret;
+}
+
+static const struct i2c_device_id tsl2563_id[] = {
+	{ "tsl2560", 0 },
+	{ "tsl2561", 1 },
+	{ "tsl2562", 2 },
+	{ "tsl2563", 3 },
+	{}
+};
+MODULE_DEVICE_TABLE(i2c, tsl2563_id);
+
+static struct i2c_driver tsl2563_i2c_driver = {
+	.driver = {
+		.name	 = "tsl2563",
+	},
+	.suspend	= tsl2563_suspend,
+	.resume		= tsl2563_resume,
+	.probe		= tsl2563_probe,
+	.remove		= __devexit_p(tsl2563_remove),
+	.id_table	= tsl2563_id,
+};
+
+static int __init tsl2563_init(void)
+{
+	return i2c_add_driver(&tsl2563_i2c_driver);
+}
+
+static void __exit tsl2563_exit(void)
+{
+	i2c_del_driver(&tsl2563_i2c_driver);
+}
+
+MODULE_AUTHOR("Nokia Corporation");
+MODULE_DESCRIPTION("tsl2563 light sensor driver");
+MODULE_LICENSE("GPL");
+
+module_init(tsl2563_init);
+module_exit(tsl2563_exit);
diff --git a/drivers/staging/iio/light/tsl2563.h b/drivers/staging/iio/light/tsl2563.h
new file mode 100644
index 000000000000..b97368bd7fff
--- /dev/null
+++ b/drivers/staging/iio/light/tsl2563.h
@@ -0,0 +1,9 @@
+#ifndef __LINUX_TSL2563_H
+#define __LINUX_TSL2563_H
+
+struct tsl2563_platform_data {
+	int cover_comp_gain;
+};
+
+#endif /* __LINUX_TSL2563_H */
+
diff --git a/drivers/staging/iio/ring_generic.h b/drivers/staging/iio/ring_generic.h
index d9261897f332..93b91b28a02f 100644
--- a/drivers/staging/iio/ring_generic.h
+++ b/drivers/staging/iio/ring_generic.h
@@ -25,9 +25,12 @@ int iio_push_ring_event(struct iio_ring_buffer *ring_buf,
 			int event_code,
 			s64 timestamp);
 /**
- * iio_push_or_escallate_ring_event() -	escallate or add as appropriate
+ * iio_push_or_escallate_ring_event() -	escalate or add as appropriate
+ * @ring_buf:		ring buffer that is the event source
+ * @event_code:		event indentification code
+ * @timestamp:		time of event
  *
- * Typical usecase is to escallate a 50% ring full to 75% full if noone has yet
+ * Typical usecase is to escalate a 50% ring full to 75% full if noone has yet
  * read the first event. Clearly the 50% full is no longer of interest in
  * typical use case.
  **/
@@ -37,10 +40,6 @@ int iio_push_or_escallate_ring_event(struct iio_ring_buffer *ring_buf,
 
 /**
  * struct iio_ring_access_funcs - access functions for ring buffers.
- * @create:		perform allocation
- * @init:		get ring buffer ready for use
- * @_exit:		reverse steps in init
- * @_free:		deallocate ring buffer
  * @mark_in_use:	reference counting, typically to prevent module removal
  * @unmark_in_use:	reduce reference count when no longer using ring buffer
  * @store_to:		actually store stuff to the ring buffer
@@ -60,7 +59,7 @@ int iio_push_or_escallate_ring_event(struct iio_ring_buffer *ring_buf,
  *
  * The purpose of this structure is to make the ring buffer element
  * modular as event for a given driver, different usecases may require
- * different ring designs (space efficiency vs speed for example.
+ * different ring designs (space efficiency vs speed for example).
  *
  * It is worth noting that a given ring implementation may only support a small
  * proportion of these functions.  The core code 'should' cope fine with any of
@@ -91,23 +90,25 @@ struct iio_ring_access_funcs {
 
 /**
  * struct iio_ring_buffer - general ring buffer structure
- * @length:		[DEVICE]number of datums in ring
- * @bpd:		[DEVICE]size of individual datum including timestamp
- * @loopcount:		[INTERN]number of times the ring has looped
- * @access_minor_name:	[INTERN]store of name of the access chrdev minor number
- *			sysfs attribute
- * @access_handler:	[INTERN]chrdev access handling
- * @event_minor_name:	[INTERN]store of name of the event chrdev minor number
- *			sysfs attribute
- * @ev_int:		[INTERN]chrdev interface for the event chrdev
- * @shared_ev_pointer:	[INTERN]the shared event pointer to allow escalation of
+ * @dev:		ring buffer device struct
+ * @access_dev:		system device struct for the chrdev
+ * @indio_dev:		industrial I/O device structure
+ * @owner:		module that owns the ring buffer (for ref counting)
+ * @id:			unique id number
+ * @access_id:		device id number
+ * @length:		[DEVICE] number of datums in ring
+ * @bpd:		[DEVICE] size of individual datum including timestamp
+ * @loopcount:		[INTERN] number of times the ring has looped
+ * @access_handler:	[INTERN] chrdev access handling
+ * @ev_int:		[INTERN] chrdev interface for the event chrdev
+ * @shared_ev_pointer:	[INTERN] the shared event pointer to allow escalation of
  *			events
- * @ring_access:	[DRIVER]ring access functions associated with the
+ * @access:		[DRIVER] ring access functions associated with the
  *			implementation.
- * @ring_prenable:	[DRIVER] function to run prior to marking ring enabled
- * @ring_postenable:	[DRIVER] function to run after marking ring enabled
- * @ring_predisable:	[DRIVER] function to run prior to marking ring disabled
- * @ring_postdisable:	[DRIVER] function to run after marking ring disabled
+ * @preenable:		[DRIVER] function to run prior to marking ring enabled
+ * @postenable:		[DRIVER] function to run after marking ring enabled
+ * @predisable:		[DRIVER] function to run prior to marking ring disabled
+ * @postdisable:	[DRIVER] function to run after marking ring disabled
   **/
 struct iio_ring_buffer {
 	struct device dev;
@@ -133,7 +134,10 @@ void iio_ring_buffer_init(struct iio_ring_buffer *ring,
 			  struct iio_dev *dev_info);
 
 /**
- * __iio_init_ring_buffer() - initialize common elements of ring buffers.
+ * __iio_init_ring_buffer() - initialize common elements of ring buffers
+ * @ring:		ring buffer that is the event source
+ * @bytes_per_datum:	size of individual datum including timestamp
+ * @length:		number of datums in ring
  **/
 static inline void __iio_init_ring_buffer(struct iio_ring_buffer *ring,
 				 int bytes_per_datum, int length)
@@ -171,7 +175,11 @@ struct iio_scan_el {
 	container_of(_dev_attr, struct iio_scan_el, dev_attr);
 
 /**
- * iio_scan_el_store() - sysfs scan element selection interface.
+ * iio_scan_el_store() - sysfs scan element selection interface
+ * @dev: the target device
+ * @attr: the device attribute that is being processed
+ * @buf: input from userspace
+ * @len: length of input
  *
  * A generic function used to enable various scan elements.  In some
  * devices explicit read commands for each channel mean this is merely
@@ -184,12 +192,15 @@ ssize_t iio_scan_el_store(struct device *dev, struct device_attribute *attr,
 			  const char *buf, size_t len);
 /**
  * iio_scal_el_show() -	sysfs interface to query whether a scan element is
- *			is enabled or not.
+ *			is enabled or not
+ * @dev: the target device
+ * @attr: the device attribute that is being processed
+ * @buf: output buffer
  **/
 ssize_t iio_scan_el_show(struct device *dev, struct device_attribute *attr,
 			 char *buf);
 /**
- * IIO_SCAN_EL: - declare and initialize a scan element without control func
+ * IIO_SCAN_EL - declare and initialize a scan element without control func
  * @_name:	identifying name. Resulting struct is iio_scan_el_##_name,
  *		sysfs element, scan_en_##_name.
  * @_number:	unique id number for the scan element.
@@ -214,8 +225,14 @@ ssize_t iio_scan_el_ts_store(struct device *dev, struct device_attribute *attr,
 ssize_t iio_scan_el_ts_show(struct device *dev, struct device_attribute *attr,
 			    char *buf);
 /**
- * IIO_SCAN_EL_C: - declare and initialize a scan element with a control func
+ * IIO_SCAN_EL_C - declare and initialize a scan element with a control func
  *
+ * @_name:	identifying name. Resulting struct is iio_scan_el_##_name,
+ *		sysfs element, scan_en_##_name.
+ * @_number:	unique id number for the scan element.
+ * @_bits:	number of bits in the scan element result (used in mixed bit
+ *		length devices).
+ * @_label:	indentification variable used by drivers.  Often a reg address.
  * @_controlfunc: function used to notify hardware of whether state changes
  **/
 #define IIO_SCAN_EL_C(_name, _number, _bits, _label, _controlfunc)	\
@@ -230,7 +247,7 @@ ssize_t iio_scan_el_ts_show(struct device *dev, struct device_attribute *attr,
 		.set_state = _controlfunc,				\
 	}
 /**
- * IIO_SCAN_EL_TIMESTAMP: - declare a special scan element for timestamps
+ * IIO_SCAN_EL_TIMESTAMP - declare a special scan element for timestamps
  *
  * Odd one out. Handled slightly differently from other scan elements.
  **/
diff --git a/drivers/staging/iio/ring_sw.h b/drivers/staging/iio/ring_sw.h
index ae70ee0538fb..fd677f008365 100644
--- a/drivers/staging/iio/ring_sw.h
+++ b/drivers/staging/iio/ring_sw.h
@@ -29,59 +29,71 @@
  * driver requests - some may support multiple options */
 
 
-#include <linux/autoconf.h>
 #include "iio.h"
 #include "ring_generic.h"
 
 #if defined CONFIG_IIO_SW_RING || defined CONFIG_IIO_SW_RING_MODULE
 
 /**
- * iio_create_sw_rb() software ring buffer allocation
+ * iio_create_sw_rb() - software ring buffer allocation
  * @r:		pointer to ring buffer pointer
  **/
 int iio_create_sw_rb(struct iio_ring_buffer **r);
 
 /**
- * iio_init_sw_rb() initialize the software ring buffer
+ * iio_init_sw_rb() - initialize the software ring buffer
  * @r:		pointer to a software ring buffer created by an
- *		iio_create_sw_rb call.
+ *		iio_create_sw_rb call
+ * @indio_dev:		industrial I/O device structure
  **/
 int iio_init_sw_rb(struct iio_ring_buffer *r, struct iio_dev *indio_dev);
+
 /**
- * iio_exit_sw_rb() reverse what was done in iio_init_sw_rb
+ * iio_exit_sw_rb() - reverse what was done in iio_init_sw_rb
+ * @r:		pointer to a software ring buffer created by an
+ *		iio_create_sw_rb call
  **/
 void iio_exit_sw_rb(struct iio_ring_buffer *r);
 
 /**
- * iio_free_sw_rb() free memory occupied by the core ring buffer struct
+ * iio_free_sw_rb() - free memory occupied by the core ring buffer struct
+ * @r:		pointer to a software ring buffer created by an
+ *		iio_create_sw_rb call
  **/
 void iio_free_sw_rb(struct iio_ring_buffer *r);
 
 /**
- * iio_mark_sw_rb_in_use() reference counting to prevent incorrect chances
+ * iio_mark_sw_rb_in_use() - reference counting to prevent incorrect chances
+ * @r:		pointer to a software ring buffer created by an
+ *		iio_create_sw_rb call
  **/
 void iio_mark_sw_rb_in_use(struct iio_ring_buffer *r);
 
 /**
- *  iio_unmark_sw_rb_in_use() notify the ring buffer that we don't care anymore
+ *  iio_unmark_sw_rb_in_use() - notify the ring buffer that we don't care anymore
+ * @r:		pointer to a software ring buffer created by an
+ *		iio_create_sw_rb call
  **/
 void iio_unmark_sw_rb_in_use(struct iio_ring_buffer *r);
 
 /**
- * iio_read_last_from_sw_rb() attempt to read the last stored datum from the rb
+ * iio_read_last_from_sw_rb() - attempt to read the last stored datum from the rb
+ * @r:		pointer to a software ring buffer created by an
+ *		iio_create_sw_rb call
+ * @data:	where to store the last datum
  **/
 int iio_read_last_from_sw_rb(struct iio_ring_buffer *r, u8 *data);
 
 /**
- * iio_store_to_sw_rb() store a new datum to the ring buffer
- * @rb:	pointer to ring buffer instance
- * @data:	the datum to be stored including timestamp if relevant.
- * @timestamp:	timestamp which will be attached to buffer events if relevant.
+ * iio_store_to_sw_rb() - store a new datum to the ring buffer
+ * @r:		pointer to ring buffer instance
+ * @data:	the datum to be stored including timestamp if relevant
+ * @timestamp:	timestamp which will be attached to buffer events if relevant
  **/
 int iio_store_to_sw_rb(struct iio_ring_buffer *r, u8 *data, s64 timestamp);
 
 /**
- * iio_rip_sw_rb() attempt to read data from the ring buffer
+ * iio_rip_sw_rb() - attempt to read data from the ring buffer
  * @r:			ring buffer instance
  * @count:		number of datum's to try and read
  * @data:		where the data will be stored.
@@ -94,38 +106,53 @@ int iio_rip_sw_rb(struct iio_ring_buffer *r,
 		  int *dead_offset);
 
 /**
- * iio_request_update_sw_rb() update params if update needed
+ * iio_request_update_sw_rb() - update params if update needed
+ * @r:		pointer to a software ring buffer created by an
+ *		iio_create_sw_rb call
  **/
 int iio_request_update_sw_rb(struct iio_ring_buffer *r);
 
 /**
- * iio_mark_update_needed_sw_rb() tell the ring buffer it needs a param update
+ * iio_mark_update_needed_sw_rb() - tell the ring buffer it needs a param update
+ * @r:		pointer to a software ring buffer created by an
+ *		iio_create_sw_rb call
  **/
 int iio_mark_update_needed_sw_rb(struct iio_ring_buffer *r);
 
 
 /**
- * iio_get_bpd_sw_rb() get the datum size in bytes
+ * iio_get_bpd_sw_rb() - get the datum size in bytes
+ * @r:		pointer to a software ring buffer created by an
+ *		iio_create_sw_rb call
  **/
 int iio_get_bpd_sw_rb(struct iio_ring_buffer *r);
 
 /**
- * iio_set_bpd_sw_rb() set the datum size in bytes
+ * iio_set_bpd_sw_rb() - set the datum size in bytes
+ * @r:		pointer to a software ring buffer created by an
+ *		iio_create_sw_rb call
+ * @bpd:	bytes per datum value
  **/
 int iio_set_bpd_sw_rb(struct iio_ring_buffer *r, size_t bpd);
 
 /**
- * iio_get_length_sw_rb() get how many datums the rb may contain
+ * iio_get_length_sw_rb() - get how many datums the rb may contain
+ * @r:		pointer to a software ring buffer created by an
+ *		iio_create_sw_rb call
  **/
 int iio_get_length_sw_rb(struct iio_ring_buffer *r);
 
 /**
- * iio_set_length_sw_rb() set how many datums the rb may contain
+ * iio_set_length_sw_rb() - set how many datums the rb may contain
+ * @r:		pointer to a software ring buffer created by an
+ *		iio_create_sw_rb call
+ * @length:	max number of data items for the ring buffer
  **/
 int iio_set_length_sw_rb(struct iio_ring_buffer *r, int length);
 
 /**
- * iio_ring_sw_register_funcs() helper function to set up rb access
+ * iio_ring_sw_register_funcs() - helper function to set up rb access
+ * @ra:		pointer to @iio_ring_access_funcs
  **/
 static inline void iio_ring_sw_register_funcs(struct iio_ring_access_funcs *ra)
 {
diff --git a/drivers/staging/iio/sysfs.h b/drivers/staging/iio/sysfs.h
index bfe4055c0ed2..e501e1338e11 100644
--- a/drivers/staging/iio/sysfs.h
+++ b/drivers/staging/iio/sysfs.h
@@ -15,7 +15,7 @@
 #include "iio.h"
 
 /**
- * struct iio_event_attribute - event control attribute
+ * struct iio_event_attr - event control attribute
  * @dev_attr:	underlying device attribute
  * @mask:	mask for the event when detecting
  * @listel:	list header to allow addition to list of event handlers
@@ -54,6 +54,7 @@ __init_iio_chrdev_minor_attr(struct iio_chrdev_minor_attr *minor_attr,
  * struct iio_dev_attr - iio specific device attribute
  * @dev_attr:	underlying device attribute
  * @address:	associated register address
+ * @val2:	secondary attribute value
  */
 struct iio_dev_attr {
 	struct device_attribute dev_attr;
@@ -71,6 +72,8 @@ ssize_t iio_read_const_attr(struct device *dev,
 /**
  * struct iio_const_attr - constant device specific attribute
  *                         often used for things like available modes
+ * @string:	attribute string
+ * @dev_attr:	underlying device attribute
  */
 struct iio_const_attr {
 	const char *string;
@@ -80,7 +83,7 @@ struct iio_const_attr {
 #define to_iio_const_attr(_dev_attr) \
 	container_of(_dev_attr, struct iio_const_attr, dev_attr)
 
-/* Some attributes will be hard coded (device dependant) and not require an
+/* Some attributes will be hard coded (device dependent) and not require an
    address, in these cases pass a negative */
 #define IIO_ATTR(_name, _mode, _show, _store, _addr)		\
 	{ .dev_attr = __ATTR(_name, _mode, _show, _store),	\
@@ -108,102 +111,130 @@ struct iio_const_attr {
 /* Generic attributes of onetype or another */
 
 /**
- * IIO_DEV_ATTR_REG: revision number for the device
+ * IIO_DEV_ATTR_REV - revision number for the device
+ * @_show: output method for the attribute
  *
  * Very much device dependent.
  **/
 #define IIO_DEV_ATTR_REV(_show)			\
 	IIO_DEVICE_ATTR(revision, S_IRUGO, _show, NULL, 0)
+
 /**
- * IIO_DEV_ATTR_NAME: chip type dependant identifier
+ * IIO_DEV_ATTR_NAME - chip type dependent identifier
+ * @_show: output method for the attribute
  **/
 #define IIO_DEV_ATTR_NAME(_show)				\
 	IIO_DEVICE_ATTR(name, S_IRUGO, _show, NULL, 0)
 
 /**
- * IIO_DEV_ATTR_SAMP_FREQ: sets any internal clock frequency
+ * IIO_DEV_ATTR_SAMP_FREQ - sets any internal clock frequency
+ * @_mode: sysfs file mode/permissions
+ * @_show: output method for the attribute
+ * @_store: input method for the attribute
  **/
 #define IIO_DEV_ATTR_SAMP_FREQ(_mode, _show, _store)			\
 	IIO_DEVICE_ATTR(sampling_frequency, _mode, _show, _store, 0)
 
 /**
- * IIO_DEV_ATTR_AVAIL_SAMP_FREQ: list available sampling frequencies.
+ * IIO_DEV_ATTR_AVAIL_SAMP_FREQ - list available sampling frequencies
+ * @_show: output method for the attribute
  *
- * May be mode dependant on some devices
+ * May be mode dependent on some devices
  **/
 #define IIO_DEV_ATTR_AVAIL_SAMP_FREQ(_show)				\
 	IIO_DEVICE_ATTR(available_sampling_frequency, S_IRUGO, _show, NULL, 0)
 
 /**
- * IIO_DEV_ATTR_CONST_AVAIL_SAMP_FREQ: list available sampling frequencies.
+ * IIO_CONST_ATTR_AVAIL_SAMP_FREQ - list available sampling frequencies
+ * @_string: frequency string for the attribute
  *
  * Constant version
  **/
 #define IIO_CONST_ATTR_AVAIL_SAMP_FREQ(_string)	\
 	IIO_CONST_ATTR(available_sampling_frequency, _string)
+
 /**
- * IIO_DEV_ATTR_SCAN_MODE: select a scan mode
+ * IIO_DEV_ATTR_SCAN_MODE - select a scan mode
+ * @_mode: sysfs file mode/permissions
+ * @_show: output method for the attribute
+ * @_store: input method for the attribute
  *
  * This is used when only certain combinations of inputs may be read in one
  * scan.
  **/
 #define IIO_DEV_ATTR_SCAN_MODE(_mode, _show, _store)		\
 	IIO_DEVICE_ATTR(scan_mode, _mode, _show, _store, 0)
+
 /**
- * IIO_DEV_ATTR_AVAIL_SCAN_MODES: list available scan modes
+ * IIO_DEV_ATTR_AVAIL_SCAN_MODES - list available scan modes
+ * @_show: output method for the attribute
  **/
 #define IIO_DEV_ATTR_AVAIL_SCAN_MODES(_show)				\
 	IIO_DEVICE_ATTR(available_scan_modes, S_IRUGO, _show, NULL, 0)
 
 /**
- * IIO_DEV_ATTR_SCAN: result of scan of multiple channels
+ * IIO_DEV_ATTR_SCAN - result of scan of multiple channels
+ * @_show: output method for the attribute
  **/
 #define IIO_DEV_ATTR_SCAN(_show)		\
 	IIO_DEVICE_ATTR(scan, S_IRUGO, _show, NULL, 0);
 
 /**
- * IIO_DEV_ATTR_INPUT: direct read of a single input channel
+ * IIO_DEV_ATTR_INPUT - direct read of a single input channel
+ * @_number: input channel number
+ * @_show: output method for the attribute
  **/
 #define IIO_DEV_ATTR_INPUT(_number, _show)				\
 	IIO_DEVICE_ATTR(in##_number, S_IRUGO, _show, NULL, _number)
 
-
 /**
- * IIO_DEV_ATTR_SW_RING_ENABLE: enable software ring buffer
+ * IIO_DEV_ATTR_SW_RING_ENABLE - enable software ring buffer
+ * @_show: output method for the attribute
+ * @_store: input method for the attribute
  *
- * Success may be dependant on attachment of trigger previously
+ * Success may be dependent on attachment of trigger previously.
  **/
 #define IIO_DEV_ATTR_SW_RING_ENABLE(_show, _store)			\
 	IIO_DEVICE_ATTR(sw_ring_enable, S_IRUGO | S_IWUSR, _show, _store, 0)
 
 /**
- * IIO_DEV_ATTR_HW_RING_ENABLE: enable hardware ring buffer
+ * IIO_DEV_ATTR_HW_RING_ENABLE - enable hardware ring buffer
+ * @_show: output method for the attribute
+ * @_store: input method for the attribute
  *
- * This is a different attribute from the software one as one can invision
+ * This is a different attribute from the software one as one can envision
  * schemes where a combination of the two may be used.
  **/
 #define IIO_DEV_ATTR_HW_RING_ENABLE(_show, _store)			\
 	IIO_DEVICE_ATTR(hw_ring_enable, S_IRUGO | S_IWUSR, _show, _store, 0)
 
 /**
- * IIO_DEV_ATTR_BPSE: set number of bits per scan element
+ * IIO_DEV_ATTR_BPSE - set number of bits per scan element
+ * @_mode: sysfs file mode/permissions
+ * @_show: output method for the attribute
+ * @_store: input method for the attribute
  **/
 #define IIO_DEV_ATTR_BPSE(_mode, _show, _store)		\
 	IIO_DEVICE_ATTR(bpse, _mode, _show, _store, 0)
 
 /**
- * IIO_DEV_ATTR_BPSE_AVAILABLE: no of bits per scan element supported
+ * IIO_DEV_ATTR_BPSE_AVAILABLE - number of bits per scan element supported
+ * @_show: output method for the attribute
  **/
 #define IIO_DEV_ATTR_BPSE_AVAILABLE(_show)				\
 	IIO_DEVICE_ATTR(bpse_available, S_IRUGO, _show, NULL, 0)
 
 /**
- * IIO_DEV_ATTR_TEMP: many sensors have auxiliary temperature sensors
+ * IIO_DEV_ATTR_TEMP - many sensors have auxiliary temperature sensors
+ * @_show: output method for the attribute
  **/
 #define IIO_DEV_ATTR_TEMP(_show)			\
 	IIO_DEVICE_ATTR(temp, S_IRUGO, _show, NULL, 0)
+
 /**
- * IIO_EVENT_SH: generic shared event handler
+ * IIO_EVENT_SH - generic shared event handler
+ * @_name: event name
+ * @_handler: handler function to be called
  *
  * This is used in cases where more than one event may result from a single
  * handler.  Often the case that some alarm register must be read and multiple
@@ -221,8 +252,14 @@ struct iio_const_attr {
 			.prev = &iio_event_##_name.list,		\
 		},							\
 	};
+
 /**
- * IIO_EVENT_ATTR_SH: generic shared event attribute
+ * IIO_EVENT_ATTR_SH - generic shared event attribute
+ * @_name: event name
+ * @_ev_list: event handler list
+ * @_show: output method for the attribute
+ * @_store: input method for the attribute
+ * @_mask: mask used when detecting the event
  *
  * An attribute with an associated IIO_EVENT_SH
  **/
@@ -235,7 +272,12 @@ struct iio_const_attr {
 	    .listel = &_ev_list };
 
 /**
- * IIO_EVENT_ATTR: non shared event attribute
+ * IIO_EVENT_ATTR - non-shared event attribute
+ * @_name: event name
+ * @_show: output method for the attribute
+ * @_store: input method for the attribute
+ * @_mask: mask used when detecting the event
+ * @_handler: handler function to be called
  **/
 #define IIO_EVENT_ATTR(_name, _show, _store, _mask, _handler)		\
 	static struct iio_event_handler_list				\
@@ -251,10 +293,14 @@ struct iio_const_attr {
 	    .listel = &iio_event_##_name };				\
 
 /**
- * IIO_EVENT_ATTR_DATA_RDY: event driven by data ready signal
+ * IIO_EVENT_ATTR_DATA_RDY - event driven by data ready signal
+ * @_show: output method for the attribute
+ * @_store: input method for the attribute
+ * @_mask: mask used when detecting the event
+ * @_handler: handler function to be called
  *
  * Not typically implemented in devices where full triggering support
- * has been implemented
+ * has been implemented.
  **/
 #define IIO_EVENT_ATTR_DATA_RDY(_show, _store, _mask, _handler) \
 	IIO_EVENT_ATTR(data_rdy, _show, _store, _mask, _handler)
@@ -269,19 +315,31 @@ struct iio_const_attr {
 #define IIO_EVENT_CODE_DEVICE_SPECIFIC	1000
 
 /**
- * IIO_EVENT_ATTR_RING_50_FULL: ring buffer event to indicate 50% full
+ * IIO_EVENT_ATTR_RING_50_FULL - ring buffer event to indicate 50% full
+ * @_show: output method for the attribute
+ * @_store: input method for the attribute
+ * @_mask: mask used when detecting the event
+ * @_handler: handler function to be called
  **/
 #define IIO_EVENT_ATTR_RING_50_FULL(_show, _store, _mask, _handler)	\
 	IIO_EVENT_ATTR(ring_50_full, _show, _store, _mask, _handler)
 
 /**
- * IIO_EVENT_ATTR_RING_50_FULL_SH: shared ring event to indicate 50% full
+ * IIO_EVENT_ATTR_RING_50_FULL_SH - shared ring event to indicate 50% full
+ * @_evlist: event handler list
+ * @_show: output method for the attribute
+ * @_store: input method for the attribute
+ * @_mask: mask used when detecting the event
  **/
 #define IIO_EVENT_ATTR_RING_50_FULL_SH(_evlist, _show, _store, _mask)	\
 	IIO_EVENT_ATTR_SH(ring_50_full, _evlist, _show, _store, _mask)
 
 /**
- * IIO_EVENT_ATTR_RING_75_FULL_SH: shared ring event to indicate 75% full
+ * IIO_EVENT_ATTR_RING_75_FULL_SH - shared ring event to indicate 75% full
+ * @_evlist: event handler list
+ * @_show: output method for the attribute
+ * @_store: input method for the attribute
+ * @_mask: mask used when detecting the event
  **/
 #define IIO_EVENT_ATTR_RING_75_FULL_SH(_evlist, _show, _store, _mask)	\
 	IIO_EVENT_ATTR_SH(ring_75_full, _evlist, _show, _store, _mask)
diff --git a/drivers/staging/iio/trigger.h b/drivers/staging/iio/trigger.h
index 8284098c9589..784e7b6fac1c 100644
--- a/drivers/staging/iio/trigger.h
+++ b/drivers/staging/iio/trigger.h
@@ -19,16 +19,18 @@
  * @id:			[INTERN] unique id number
  * @name:		[DRIVER] unique name
  * @dev:		[DRIVER] associated device (if relevant)
- * @sysfs_dev:		[INTERN] sysfs relevant device
  * @private_data:	[DRIVER] device specific data
  * @list:		[INTERN] used in maintenance of global trigger list
  * @alloc_list:		[DRIVER] used for driver specific trigger list
- * @poll_func_list_lock:[INTERN] protection of the polling function list
+ * @pollfunc_list_lock:	[INTERN] protection of the polling function list
  * @pollfunc_list:	[INTERN] list of functions to run on trigger.
  * @control_attrs:	[DRIVER] sysfs attributes relevant to trigger type
- * @set_trigger_state:	[DRIVER] switch on/off the trigger on demand
  * @timestamp:		[INTERN] timestamp usesd by some trigs (e.g. datardy)
  * @owner:		[DRIVER] used to monitor usage count of the trigger.
+ * @use_count:		use count for the trigger
+ * @set_trigger_state:	[DRIVER] switch on/off the trigger on demand
+ * @try_reenable:	function to reenable the trigger when the
+ *			use count is zero (may be NULL)
  **/
 struct iio_trigger {
 	int				id;
@@ -68,6 +70,9 @@ static inline void iio_get_trigger(struct iio_trigger *trig)
 
 /**
  * iio_trigger_read_name() - sysfs access function to get the trigger name
+ * @dev: the system device
+ * @attr: device attributes for the device
+ * @buf: output buffer to store the trigger name
  **/
 ssize_t iio_trigger_read_name(struct device *dev,
 			      struct device_attribute *attr,
@@ -79,6 +84,8 @@ ssize_t iio_trigger_read_name(struct device *dev,
 
 /**
  * iio_trigger_find_by_name() - search global trigger list
+ * @name: trigger name to search for
+ * @len: trigger name string length to compare
  **/
 struct iio_trigger *iio_trigger_find_by_name(const char *name, size_t len);
 
@@ -90,32 +97,35 @@ int iio_trigger_register(struct iio_trigger *trig_info);
 
 /**
  * iio_trigger_unregister() - unregister a trigger from the core
+ * @trig_info:	trigger to be unregistered
  **/
 void iio_trigger_unregister(struct iio_trigger *trig_info);
 
 /**
  * iio_trigger_attach_poll_func() - add a function pair to be run on trigger
  * @trig:	trigger to which the function pair are being added
- * @pf:	poll function pair
+ * @pf:		poll function pair
  **/
 int iio_trigger_attach_poll_func(struct iio_trigger *trig,
 				 struct iio_poll_func *pf);
 
 /**
  * iio_trigger_dettach_poll_func() -	remove function pair from those to be
- *					run on trigger.
- * @trig:	trigger from which the function is being removed.
+ *					run on trigger
+ * @trig:	trigger from which the function is being removed
  * @pf:		poll function pair
  **/
 int iio_trigger_dettach_poll_func(struct iio_trigger *trig,
 				  struct iio_poll_func *pf);
 
 /**
- * iio_trigger_poll() - called on a trigger occuring
+ * iio_trigger_poll() - called on a trigger occurring
+ * @trig: trigger which occurred
+ *
  * Typically called in relevant hardware interrupt handler.
  **/
-void iio_trigger_poll(struct iio_trigger *);
-void iio_trigger_notify_done(struct iio_trigger *);
+void iio_trigger_poll(struct iio_trigger *trig);
+void iio_trigger_notify_done(struct iio_trigger *trig);
 
 /**
  * struct iio_poll_func - poll function pair
@@ -127,11 +137,10 @@ void iio_trigger_notify_done(struct iio_trigger *);
  *				control on sensor supporting it.
  * @poll_func_main:		function in here is run after all immediates.
  *				Reading from sensor etc typically involves
- *				scheduling
- *				from here.
+ *				scheduling from here.
  *
- * The two stage approach used here only important when multiple sensors are
- * being triggered by a single trigger. This really comes into it's own with
+ * The two stage approach used here is only important when multiple sensors are
+ * being triggered by a single trigger. This really comes into its own with
  * simultaneous sampling devices where a simple latch command can be used to
  * make the device store the values on all inputs.
  **/
diff --git a/drivers/staging/iio/trigger/Kconfig b/drivers/staging/iio/trigger/Kconfig
index fdd9301271a4..d842a584a3af 100644
--- a/drivers/staging/iio/trigger/Kconfig
+++ b/drivers/staging/iio/trigger/Kconfig
@@ -9,13 +9,13 @@ config IIO_PERIODIC_RTC_TRIGGER
 	tristate "Periodic RTC triggers"
 	depends on RTC_CLASS
 	help
-	    Provides support for using periodic capable real time
-	    clocks as IIO triggers.
+	  Provides support for using periodic capable real time
+	  clocks as IIO triggers.
 
 config IIO_GPIO_TRIGGER
 	tristate "GPIO trigger"
 	depends on GENERIC_GPIO
 	help
-	    Provides support for using GPIO pins as IIO triggers.
+	  Provides support for using GPIO pins as IIO triggers.
 
 endif # IIO_TRIGGER
diff --git a/drivers/staging/iio/trigger_consumer.h b/drivers/staging/iio/trigger_consumer.h
index 4c7f527dc79f..a02d70b0d24a 100644
--- a/drivers/staging/iio/trigger_consumer.h
+++ b/drivers/staging/iio/trigger_consumer.h
@@ -10,12 +10,13 @@
 
 #ifdef CONFIG_IIO_TRIGGER
 /**
- * iio_device_register_trigger_consumer() - set up an iio_dev to use triggers.
+ * iio_device_register_trigger_consumer() - set up an iio_dev to use triggers
  * @dev_info: iio_dev associated with the device that will consume the trigger
  **/
 int iio_device_register_trigger_consumer(struct iio_dev *dev_info);
+
 /**
- * iio_device_unregister_trigger_consumer() - reverse the registration process.
+ * iio_device_unregister_trigger_consumer() - reverse the registration process
  * @dev_info: iio_dev associated with the device that consumed the trigger
  **/
 int iio_device_unregister_trigger_consumer(struct iio_dev *dev_info);
@@ -23,13 +24,14 @@ int iio_device_unregister_trigger_consumer(struct iio_dev *dev_info);
 #else
 
 /**
- * iio_device_register_trigger_consumer() - set up an iio_dev to use triggers.
+ * iio_device_register_trigger_consumer() - set up an iio_dev to use triggers
  * @dev_info: iio_dev associated with the device that will consume the trigger
  **/
 int iio_device_register_trigger_consumer(struct iio_dev *dev_info)
 {
 	return 0;
 };
+
 /**
  * iio_device_unregister_trigger_consumer() - reverse the registration process
  * @dev_info: iio_dev associated with the device that consumed the trigger
diff --git a/drivers/staging/line6/capture.c b/drivers/staging/line6/capture.c
index ea2060b4919d..fd4890de8dbc 100644
--- a/drivers/staging/line6/capture.c
+++ b/drivers/staging/line6/capture.c
@@ -20,7 +20,6 @@
 #include "pod.h"
 #include "capture.h"
 
-
 /*
 	Find a free URB and submit it.
 */
@@ -33,7 +32,8 @@ static int submit_audio_in_urb(struct snd_pcm_substream *substream)
 	struct urb *urb_in;
 
 	spin_lock_irqsave(&line6pcm->lock_audio_in, flags);
-	index = find_first_zero_bit(&line6pcm->active_urb_in, LINE6_ISO_BUFFERS);
+	index =
+	    find_first_zero_bit(&line6pcm->active_urb_in, LINE6_ISO_BUFFERS);
 
 	if (index >= LINE6_ISO_BUFFERS) {
 		spin_unlock_irqrestore(&line6pcm->lock_audio_in, flags);
@@ -45,20 +45,24 @@ static int submit_audio_in_urb(struct snd_pcm_substream *substream)
 	urb_size = 0;
 
 	for (i = 0; i < LINE6_ISO_PACKETS; ++i) {
-		struct usb_iso_packet_descriptor *fin = &urb_in->iso_frame_desc[i];
+		struct usb_iso_packet_descriptor *fin =
+		    &urb_in->iso_frame_desc[i];
 		fin->offset = urb_size;
 		fin->length = line6pcm->max_packet_size;
 		urb_size += line6pcm->max_packet_size;
 	}
 
-	urb_in->transfer_buffer = line6pcm->buffer_in + index * LINE6_ISO_PACKETS * line6pcm->max_packet_size;
+	urb_in->transfer_buffer =
+	    line6pcm->buffer_in +
+	    index * LINE6_ISO_PACKETS * line6pcm->max_packet_size;
 	urb_in->transfer_buffer_length = urb_size;
 	urb_in->context = substream;
 
 	if (usb_submit_urb(urb_in, GFP_ATOMIC) == 0)
 		set_bit(index, &line6pcm->active_urb_in);
 	else
-		dev_err(s2m(substream), "URB in #%d submission failed\n", index);
+		dev_err(s2m(substream), "URB in #%d submission failed\n",
+			index);
 
 	spin_unlock_irqrestore(&line6pcm->lock_audio_in, flags);
 	return 0;
@@ -143,7 +147,8 @@ static void audio_in_callback(struct urb *urb)
 	int frames;
 	unsigned long flags;
 
-	struct snd_pcm_substream *substream = (struct snd_pcm_substream *)urb->context;
+	struct snd_pcm_substream *substream =
+	    (struct snd_pcm_substream *)urb->context;
 	struct snd_line6_pcm *line6pcm = snd_pcm_substream_chip(substream);
 	const int bytes_per_frame = line6pcm->properties->bytes_per_frame;
 	struct snd_pcm_runtime *runtime = substream->runtime;
@@ -155,8 +160,11 @@ static void audio_in_callback(struct urb *urb)
 
 #if DO_DUMP_PCM_RECEIVE
 	for (i = 0; i < LINE6_ISO_PACKETS; ++i) {
-		struct usb_iso_packet_descriptor *fout = &urb->iso_frame_desc[i];
-		line6_write_hexdump(line6pcm->line6, 'C', urb->transfer_buffer + fout->offset, fout->length);
+		struct usb_iso_packet_descriptor *fout =
+		    &urb->iso_frame_desc[i];
+		line6_write_hexdump(line6pcm->line6, 'C',
+				    urb->transfer_buffer + fout->offset,
+				    fout->length);
 	}
 #endif
 
@@ -179,25 +187,40 @@ static void audio_in_callback(struct urb *urb)
 		if (fsize > 0) {
 			frames = fsize / bytes_per_frame;
 
-			if (line6pcm->pos_in_done + frames > runtime->buffer_size) {
+			if (line6pcm->pos_in_done + frames >
+			    runtime->buffer_size) {
 				/*
-					The transferred area goes over buffer boundary,
-					copy two separate chunks.
-				*/
+				   The transferred area goes over buffer
+				   boundary, copy two separate chunks.
+				 */
 				int len;
-				len = runtime->buffer_size - line6pcm->pos_in_done;
+				len =
+				    runtime->buffer_size -
+				    line6pcm->pos_in_done;
 
 				if (len > 0) {
-					memcpy(runtime->dma_area + line6pcm->pos_in_done * bytes_per_frame, fbuf, len * bytes_per_frame);
-					memcpy(runtime->dma_area, fbuf + len * bytes_per_frame, (frames - len) * bytes_per_frame);
-				} else
-					dev_err(s2m(substream), "driver bug: len = %d\n", len);  /* this is somewhat paranoid */
+					memcpy(runtime->dma_area +
+					       line6pcm->pos_in_done *
+					       bytes_per_frame, fbuf,
+					       len * bytes_per_frame);
+					memcpy(runtime->dma_area,
+					       fbuf + len * bytes_per_frame,
+					       (frames -
+						len) * bytes_per_frame);
+				} else {
+					/* this is somewhat paranoid */
+					dev_err(s2m(substream),
+						"driver bug: len = %d\n", len);
+				}
 			} else {
 				/* copy single chunk */
-				memcpy(runtime->dma_area + line6pcm->pos_in_done * bytes_per_frame, fbuf, fsize * bytes_per_frame);
+				memcpy(runtime->dma_area +
+				       line6pcm->pos_in_done * bytes_per_frame,
+				       fbuf, fsize * bytes_per_frame);
 			}
 
-			if ((line6pcm->pos_in_done += frames) >= runtime->buffer_size)
+			line6pcm->pos_in_done += frames;
+			if (line6pcm->pos_in_done >= runtime->buffer_size)
 				line6pcm->pos_in_done -= runtime->buffer_size;
 		}
 	}
@@ -212,7 +235,8 @@ static void audio_in_callback(struct urb *urb)
 	if (!shutdown) {
 		submit_audio_in_urb(substream);
 
-		if ((line6pcm->bytes_in += length) >= line6pcm->period_in) {
+		line6pcm->bytes_in += length;
+		if (line6pcm->bytes_in >= line6pcm->period_in) {
 			line6pcm->bytes_in -= line6pcm->period_in;
 			snd_pcm_period_elapsed(substream);
 		}
@@ -228,7 +252,8 @@ static int snd_line6_capture_open(struct snd_pcm_substream *substream)
 
 	err = snd_pcm_hw_constraint_ratdens(runtime, 0,
 					    SNDRV_PCM_HW_PARAM_RATE,
-					    (&line6pcm->properties->snd_line6_rates));
+					    (&line6pcm->properties->
+					     snd_line6_rates));
 	if (err < 0)
 		return err;
 
@@ -267,7 +292,9 @@ static int snd_line6_capture_hw_params(struct snd_pcm_substream *substream,
 		return ret;
 
 	line6pcm->period_in = params_period_bytes(hw_params);
-	line6pcm->buffer_in = kmalloc(LINE6_ISO_BUFFERS * LINE6_ISO_PACKETS * LINE6_ISO_PACKET_SIZE_MAX, GFP_KERNEL);
+	line6pcm->buffer_in =
+	    kmalloc(LINE6_ISO_BUFFERS * LINE6_ISO_PACKETS *
+		    LINE6_ISO_PACKET_SIZE_MAX, GFP_KERNEL);
 
 	if (!line6pcm->buffer_in) {
 		dev_err(s2m(substream), "cannot malloc buffer_in\n");
@@ -302,7 +329,8 @@ int snd_line6_capture_trigger(struct snd_pcm_substream *substream, int cmd)
 			err = submit_audio_in_all_urbs(substream);
 
 			if (err < 0) {
-				clear_bit(BIT_RUNNING_CAPTURE, &line6pcm->flags);
+				clear_bit(BIT_RUNNING_CAPTURE,
+					  &line6pcm->flags);
 				return err;
 			}
 		}
@@ -332,14 +360,14 @@ snd_line6_capture_pointer(struct snd_pcm_substream *substream)
 
 /* capture operators */
 struct snd_pcm_ops snd_line6_capture_ops = {
-	.open =        snd_line6_capture_open,
-	.close =       snd_line6_capture_close,
-	.ioctl =       snd_pcm_lib_ioctl,
-	.hw_params =   snd_line6_capture_hw_params,
-	.hw_free =     snd_line6_capture_hw_free,
-	.prepare =     snd_line6_prepare,
-	.trigger =     snd_line6_trigger,
-	.pointer =     snd_line6_capture_pointer,
+	.open = snd_line6_capture_open,
+	.close = snd_line6_capture_close,
+	.ioctl = snd_pcm_lib_ioctl,
+	.hw_params = snd_line6_capture_hw_params,
+	.hw_free = snd_line6_capture_hw_free,
+	.prepare = snd_line6_prepare,
+	.trigger = snd_line6_trigger,
+	.pointer = snd_line6_capture_pointer,
 };
 
 int create_audio_in_urbs(struct snd_line6_pcm *line6pcm)
@@ -351,7 +379,8 @@ int create_audio_in_urbs(struct snd_line6_pcm *line6pcm)
 		struct urb *urb;
 
 		/* URB for audio in: */
-		urb = line6pcm->urb_audio_in[i] = usb_alloc_urb(LINE6_ISO_PACKETS, GFP_KERNEL);
+		urb = line6pcm->urb_audio_in[i] =
+		    usb_alloc_urb(LINE6_ISO_PACKETS, GFP_KERNEL);
 
 		if (urb == NULL) {
 			dev_err(line6pcm->line6->ifcdev, "Out of memory\n");
@@ -359,7 +388,10 @@ int create_audio_in_urbs(struct snd_line6_pcm *line6pcm)
 		}
 
 		urb->dev = line6pcm->line6->usbdev;
-		urb->pipe = usb_rcvisocpipe(line6pcm->line6->usbdev, line6pcm->ep_audio_read & USB_ENDPOINT_NUMBER_MASK);
+		urb->pipe =
+		    usb_rcvisocpipe(line6pcm->line6->usbdev,
+				    line6pcm->
+				    ep_audio_read & USB_ENDPOINT_NUMBER_MASK);
 		urb->transfer_flags = URB_ISO_ASAP;
 		urb->start_frame = -1;
 		urb->number_of_packets = LINE6_ISO_PACKETS;
diff --git a/drivers/staging/line6/control.c b/drivers/staging/line6/control.c
index 23ad08e17f84..0b598526de62 100644
--- a/drivers/staging/line6/control.c
+++ b/drivers/staging/line6/control.c
@@ -22,18 +22,18 @@
 struct device_attribute dev_attr_##_name1 = __ATTR(_name2, _mode, _show, _store)
 
 #define LINE6_PARAM_R(PREFIX, prefix, type, param) \
-static ssize_t prefix ## _get_ ## param(struct device *dev, \
+static ssize_t prefix##_get_##param(struct device *dev, \
 			struct device_attribute *attr, char *buf) \
 { \
-	return prefix ## _get_param_ ## type(dev, buf, PREFIX ## _ ## param); \
+	return prefix##_get_param_##type(dev, buf, PREFIX##_##param); \
 }
 
 #define LINE6_PARAM_RW(PREFIX, prefix, type, param) \
 LINE6_PARAM_R(PREFIX, prefix, type, param); \
-static ssize_t prefix ## _set_ ## param(struct device *dev, \
+static ssize_t prefix##_set_##param(struct device *dev, \
 		struct device_attribute *attr, const char *buf, size_t count) \
 { \
-	return prefix ## _set_param_ ## type(dev, buf, count, PREFIX ## _ ## param); \
+	return prefix##_set_param_##type(dev, buf, count, PREFIX##_##param); \
 }
 
 #define POD_PARAM_R(type, param) LINE6_PARAM_R(POD, pod, type, param)
@@ -41,7 +41,6 @@ static ssize_t prefix ## _set_ ## param(struct device *dev, \
 #define VARIAX_PARAM_R(type, param) LINE6_PARAM_R(VARIAX, variax, type, param)
 #define VARIAX_PARAM_RW(type, param) LINE6_PARAM_RW(VARIAX, variax, type, param)
 
-
 static ssize_t pod_get_param_int(struct device *dev, char *buf, int param)
 {
 	struct usb_interface *interface = to_usb_interface(dev);
@@ -52,11 +51,18 @@ static ssize_t pod_get_param_int(struct device *dev, char *buf, int param)
 	return sprintf(buf, "%d\n", pod->prog_data.control[param]);
 }
 
-static ssize_t pod_set_param_int(struct device *dev, const char *buf, size_t count, int param)
+static ssize_t pod_set_param_int(struct device *dev, const char *buf,
+				 size_t count, int param)
 {
 	struct usb_interface *interface = to_usb_interface(dev);
 	struct usb_line6_pod *pod = usb_get_intfdata(interface);
-	int value = simple_strtoul(buf, NULL, 10);
+	unsigned long value;
+	int retval;
+
+	retval = strict_strtoul(buf, 10, &value);
+	if (retval)
+		return retval;
+
 	pod_transmit_parameter(pod, param, value);
 	return count;
 }
@@ -74,13 +80,13 @@ static ssize_t variax_get_param_int(struct device *dev, char *buf, int param)
 static ssize_t variax_get_param_float(struct device *dev, char *buf, int param)
 {
 	/*
-		We do our own floating point handling here since floats in the
-		kernel are problematic for at least two reasons: - many distros
-		are still shipped with binary kernels optimized for the ancient
-		80386 without FPU
-		- there isn't a printf("%f")
-		  (see http://www.kernelthread.com/publications/faq/335.html)
-	*/
+	   We do our own floating point handling here since floats in the
+	   kernel are problematic for at least two reasons: - many distros
+	   are still shipped with binary kernels optimized for the ancient
+	   80386 without FPU
+	   - there isn't a printf("%f")
+	   (see http://www.kernelthread.com/publications/faq/335.html)
+	 */
 
 	static const int BIAS = 0x7f;
 	static const int OFFSET = 0xf;
@@ -110,10 +116,13 @@ static ssize_t variax_get_param_float(struct device *dev, char *buf, int param)
 			part_frac = (mantissa << (32 + exponent)) & 0xffffffff;
 		}
 
-		part_frac = (part_frac / ((1UL << 31) / (PRECISION / 2 * 10)) + 5) / 10;
+		part_frac =
+		    (part_frac / ((1UL << 31) / (PRECISION / 2 * 10)) + 5) / 10;
 	}
 
-	len += sprintf(buf + len, "%s%d.%03d\n", ((p[0] & 0x80) ? "-" : ""), part_int, part_frac);
+	len +=
+	    sprintf(buf + len, "%s%d.%03d\n", ((p[0] & 0x80) ? "-" : ""),
+		    part_int, part_frac);
 	return len;
 }
 
@@ -260,127 +269,246 @@ VARIAX_PARAM_R(float, mix1);
 VARIAX_PARAM_R(int, pickup_wiring);
 
 static DEVICE_ATTR(tweak, S_IWUGO | S_IRUGO, pod_get_tweak, pod_set_tweak);
-static DEVICE_ATTR(wah_position, S_IWUGO | S_IRUGO, pod_get_wah_position, pod_set_wah_position);
-static DEVICE_ATTR(compression_gain, S_IWUGO | S_IRUGO, pod_get_compression_gain, pod_set_compression_gain);
-static DEVICE_ATTR(vol_pedal_position, S_IWUGO | S_IRUGO, pod_get_vol_pedal_position, pod_set_vol_pedal_position);
-static DEVICE_ATTR(compression_threshold, S_IWUGO | S_IRUGO, pod_get_compression_threshold, pod_set_compression_threshold);
+static DEVICE_ATTR(wah_position, S_IWUGO | S_IRUGO, pod_get_wah_position,
+		   pod_set_wah_position);
+static DEVICE_ATTR(compression_gain, S_IWUGO | S_IRUGO,
+		   pod_get_compression_gain, pod_set_compression_gain);
+static DEVICE_ATTR(vol_pedal_position, S_IWUGO | S_IRUGO,
+		   pod_get_vol_pedal_position, pod_set_vol_pedal_position);
+static DEVICE_ATTR(compression_threshold, S_IWUGO | S_IRUGO,
+		   pod_get_compression_threshold,
+		   pod_set_compression_threshold);
 static DEVICE_ATTR(pan, S_IWUGO | S_IRUGO, pod_get_pan, pod_set_pan);
-static DEVICE_ATTR(amp_model_setup, S_IWUGO | S_IRUGO, pod_get_amp_model_setup, pod_set_amp_model_setup);
-static DEVICE_ATTR(amp_model, S_IWUGO | S_IRUGO, pod_get_amp_model, pod_set_amp_model);
+static DEVICE_ATTR(amp_model_setup, S_IWUGO | S_IRUGO, pod_get_amp_model_setup,
+		   pod_set_amp_model_setup);
+static DEVICE_ATTR(amp_model, S_IWUGO | S_IRUGO, pod_get_amp_model,
+		   pod_set_amp_model);
 static DEVICE_ATTR(drive, S_IWUGO | S_IRUGO, pod_get_drive, pod_set_drive);
 static DEVICE_ATTR(bass, S_IWUGO | S_IRUGO, pod_get_bass, pod_set_bass);
 static DEVICE_ATTR(mid, S_IWUGO | S_IRUGO, pod_get_mid, pod_set_mid);
 static DEVICE_ATTR(lowmid, S_IWUGO | S_IRUGO, pod_get_lowmid, pod_set_lowmid);
 static DEVICE_ATTR(treble, S_IWUGO | S_IRUGO, pod_get_treble, pod_set_treble);
-static DEVICE_ATTR(highmid, S_IWUGO | S_IRUGO, pod_get_highmid, pod_set_highmid);
-static DEVICE_ATTR(chan_vol, S_IWUGO | S_IRUGO, pod_get_chan_vol, pod_set_chan_vol);
-static DEVICE_ATTR(reverb_mix, S_IWUGO | S_IRUGO, pod_get_reverb_mix, pod_set_reverb_mix);
-static DEVICE_ATTR(effect_setup, S_IWUGO | S_IRUGO, pod_get_effect_setup, pod_set_effect_setup);
-static DEVICE_ATTR(band_1_frequency, S_IWUGO | S_IRUGO, pod_get_band_1_frequency, pod_set_band_1_frequency);
-static DEVICE_ATTR(presence, S_IWUGO | S_IRUGO, pod_get_presence, pod_set_presence);
-static DEVICE_ATTR2(treble__bass, treble, S_IWUGO | S_IRUGO, pod_get_treble__bass, pod_set_treble__bass);
-static DEVICE_ATTR(noise_gate_enable, S_IWUGO | S_IRUGO, pod_get_noise_gate_enable, pod_set_noise_gate_enable);
-static DEVICE_ATTR(gate_threshold, S_IWUGO | S_IRUGO, pod_get_gate_threshold, pod_set_gate_threshold);
-static DEVICE_ATTR(gate_decay_time, S_IWUGO | S_IRUGO, pod_get_gate_decay_time, pod_set_gate_decay_time);
-static DEVICE_ATTR(stomp_enable, S_IWUGO | S_IRUGO, pod_get_stomp_enable, pod_set_stomp_enable);
-static DEVICE_ATTR(comp_enable, S_IWUGO | S_IRUGO, pod_get_comp_enable, pod_set_comp_enable);
-static DEVICE_ATTR(stomp_time, S_IWUGO | S_IRUGO, pod_get_stomp_time, pod_set_stomp_time);
-static DEVICE_ATTR(delay_enable, S_IWUGO | S_IRUGO, pod_get_delay_enable, pod_set_delay_enable);
-static DEVICE_ATTR(mod_param_1, S_IWUGO | S_IRUGO, pod_get_mod_param_1, pod_set_mod_param_1);
-static DEVICE_ATTR(delay_param_1, S_IWUGO | S_IRUGO, pod_get_delay_param_1, pod_set_delay_param_1);
-static DEVICE_ATTR(delay_param_1_note_value, S_IWUGO | S_IRUGO, pod_get_delay_param_1_note_value, pod_set_delay_param_1_note_value);
-static DEVICE_ATTR2(band_2_frequency__bass, band_2_frequency, S_IWUGO | S_IRUGO, pod_get_band_2_frequency__bass, pod_set_band_2_frequency__bass);
-static DEVICE_ATTR(delay_param_2, S_IWUGO | S_IRUGO, pod_get_delay_param_2, pod_set_delay_param_2);
-static DEVICE_ATTR(delay_volume_mix, S_IWUGO | S_IRUGO, pod_get_delay_volume_mix, pod_set_delay_volume_mix);
-static DEVICE_ATTR(delay_param_3, S_IWUGO | S_IRUGO, pod_get_delay_param_3, pod_set_delay_param_3);
-static DEVICE_ATTR(reverb_enable, S_IWUGO | S_IRUGO, pod_get_reverb_enable, pod_set_reverb_enable);
-static DEVICE_ATTR(reverb_type, S_IWUGO | S_IRUGO, pod_get_reverb_type, pod_set_reverb_type);
-static DEVICE_ATTR(reverb_decay, S_IWUGO | S_IRUGO, pod_get_reverb_decay, pod_set_reverb_decay);
-static DEVICE_ATTR(reverb_tone, S_IWUGO | S_IRUGO, pod_get_reverb_tone, pod_set_reverb_tone);
-static DEVICE_ATTR(reverb_pre_delay, S_IWUGO | S_IRUGO, pod_get_reverb_pre_delay, pod_set_reverb_pre_delay);
-static DEVICE_ATTR(reverb_pre_post, S_IWUGO | S_IRUGO, pod_get_reverb_pre_post, pod_set_reverb_pre_post);
-static DEVICE_ATTR(band_2_frequency, S_IWUGO | S_IRUGO, pod_get_band_2_frequency, pod_set_band_2_frequency);
-static DEVICE_ATTR2(band_3_frequency__bass, band_3_frequency, S_IWUGO | S_IRUGO, pod_get_band_3_frequency__bass, pod_set_band_3_frequency__bass);
-static DEVICE_ATTR(wah_enable, S_IWUGO | S_IRUGO, pod_get_wah_enable, pod_set_wah_enable);
-static DEVICE_ATTR(modulation_lo_cut, S_IWUGO | S_IRUGO, pod_get_modulation_lo_cut, pod_set_modulation_lo_cut);
-static DEVICE_ATTR(delay_reverb_lo_cut, S_IWUGO | S_IRUGO, pod_get_delay_reverb_lo_cut, pod_set_delay_reverb_lo_cut);
-static DEVICE_ATTR(volume_pedal_minimum, S_IWUGO | S_IRUGO, pod_get_volume_pedal_minimum, pod_set_volume_pedal_minimum);
-static DEVICE_ATTR(eq_pre_post, S_IWUGO | S_IRUGO, pod_get_eq_pre_post, pod_set_eq_pre_post);
-static DEVICE_ATTR(volume_pre_post, S_IWUGO | S_IRUGO, pod_get_volume_pre_post, pod_set_volume_pre_post);
-static DEVICE_ATTR(di_model, S_IWUGO | S_IRUGO, pod_get_di_model, pod_set_di_model);
-static DEVICE_ATTR(di_delay, S_IWUGO | S_IRUGO, pod_get_di_delay, pod_set_di_delay);
-static DEVICE_ATTR(mod_enable, S_IWUGO | S_IRUGO, pod_get_mod_enable, pod_set_mod_enable);
-static DEVICE_ATTR(mod_param_1_note_value, S_IWUGO | S_IRUGO, pod_get_mod_param_1_note_value, pod_set_mod_param_1_note_value);
-static DEVICE_ATTR(mod_param_2, S_IWUGO | S_IRUGO, pod_get_mod_param_2, pod_set_mod_param_2);
-static DEVICE_ATTR(mod_param_3, S_IWUGO | S_IRUGO, pod_get_mod_param_3, pod_set_mod_param_3);
-static DEVICE_ATTR(mod_param_4, S_IWUGO | S_IRUGO, pod_get_mod_param_4, pod_set_mod_param_4);
-static DEVICE_ATTR(mod_param_5, S_IWUGO | S_IRUGO, pod_get_mod_param_5, pod_set_mod_param_5);
-static DEVICE_ATTR(mod_volume_mix, S_IWUGO | S_IRUGO, pod_get_mod_volume_mix, pod_set_mod_volume_mix);
-static DEVICE_ATTR(mod_pre_post, S_IWUGO | S_IRUGO, pod_get_mod_pre_post, pod_set_mod_pre_post);
-static DEVICE_ATTR(modulation_model, S_IWUGO | S_IRUGO, pod_get_modulation_model, pod_set_modulation_model);
-static DEVICE_ATTR(band_3_frequency, S_IWUGO | S_IRUGO, pod_get_band_3_frequency, pod_set_band_3_frequency);
-static DEVICE_ATTR2(band_4_frequency__bass, band_4_frequency, S_IWUGO | S_IRUGO, pod_get_band_4_frequency__bass, pod_set_band_4_frequency__bass);
-static DEVICE_ATTR(mod_param_1_double_precision, S_IWUGO | S_IRUGO, pod_get_mod_param_1_double_precision, pod_set_mod_param_1_double_precision);
-static DEVICE_ATTR(delay_param_1_double_precision, S_IWUGO | S_IRUGO, pod_get_delay_param_1_double_precision, pod_set_delay_param_1_double_precision);
-static DEVICE_ATTR(eq_enable, S_IWUGO | S_IRUGO, pod_get_eq_enable, pod_set_eq_enable);
+static DEVICE_ATTR(highmid, S_IWUGO | S_IRUGO, pod_get_highmid,
+		   pod_set_highmid);
+static DEVICE_ATTR(chan_vol, S_IWUGO | S_IRUGO, pod_get_chan_vol,
+		   pod_set_chan_vol);
+static DEVICE_ATTR(reverb_mix, S_IWUGO | S_IRUGO, pod_get_reverb_mix,
+		   pod_set_reverb_mix);
+static DEVICE_ATTR(effect_setup, S_IWUGO | S_IRUGO, pod_get_effect_setup,
+		   pod_set_effect_setup);
+static DEVICE_ATTR(band_1_frequency, S_IWUGO | S_IRUGO,
+		   pod_get_band_1_frequency, pod_set_band_1_frequency);
+static DEVICE_ATTR(presence, S_IWUGO | S_IRUGO, pod_get_presence,
+		   pod_set_presence);
+static DEVICE_ATTR2(treble__bass, treble, S_IWUGO | S_IRUGO,
+		    pod_get_treble__bass, pod_set_treble__bass);
+static DEVICE_ATTR(noise_gate_enable, S_IWUGO | S_IRUGO,
+		   pod_get_noise_gate_enable, pod_set_noise_gate_enable);
+static DEVICE_ATTR(gate_threshold, S_IWUGO | S_IRUGO, pod_get_gate_threshold,
+		   pod_set_gate_threshold);
+static DEVICE_ATTR(gate_decay_time, S_IWUGO | S_IRUGO, pod_get_gate_decay_time,
+		   pod_set_gate_decay_time);
+static DEVICE_ATTR(stomp_enable, S_IWUGO | S_IRUGO, pod_get_stomp_enable,
+		   pod_set_stomp_enable);
+static DEVICE_ATTR(comp_enable, S_IWUGO | S_IRUGO, pod_get_comp_enable,
+		   pod_set_comp_enable);
+static DEVICE_ATTR(stomp_time, S_IWUGO | S_IRUGO, pod_get_stomp_time,
+		   pod_set_stomp_time);
+static DEVICE_ATTR(delay_enable, S_IWUGO | S_IRUGO, pod_get_delay_enable,
+		   pod_set_delay_enable);
+static DEVICE_ATTR(mod_param_1, S_IWUGO | S_IRUGO, pod_get_mod_param_1,
+		   pod_set_mod_param_1);
+static DEVICE_ATTR(delay_param_1, S_IWUGO | S_IRUGO, pod_get_delay_param_1,
+		   pod_set_delay_param_1);
+static DEVICE_ATTR(delay_param_1_note_value, S_IWUGO | S_IRUGO,
+		   pod_get_delay_param_1_note_value,
+		   pod_set_delay_param_1_note_value);
+static DEVICE_ATTR2(band_2_frequency__bass, band_2_frequency, S_IWUGO | S_IRUGO,
+		    pod_get_band_2_frequency__bass,
+		    pod_set_band_2_frequency__bass);
+static DEVICE_ATTR(delay_param_2, S_IWUGO | S_IRUGO, pod_get_delay_param_2,
+		   pod_set_delay_param_2);
+static DEVICE_ATTR(delay_volume_mix, S_IWUGO | S_IRUGO,
+		   pod_get_delay_volume_mix, pod_set_delay_volume_mix);
+static DEVICE_ATTR(delay_param_3, S_IWUGO | S_IRUGO, pod_get_delay_param_3,
+		   pod_set_delay_param_3);
+static DEVICE_ATTR(reverb_enable, S_IWUGO | S_IRUGO, pod_get_reverb_enable,
+		   pod_set_reverb_enable);
+static DEVICE_ATTR(reverb_type, S_IWUGO | S_IRUGO, pod_get_reverb_type,
+		   pod_set_reverb_type);
+static DEVICE_ATTR(reverb_decay, S_IWUGO | S_IRUGO, pod_get_reverb_decay,
+		   pod_set_reverb_decay);
+static DEVICE_ATTR(reverb_tone, S_IWUGO | S_IRUGO, pod_get_reverb_tone,
+		   pod_set_reverb_tone);
+static DEVICE_ATTR(reverb_pre_delay, S_IWUGO | S_IRUGO,
+		   pod_get_reverb_pre_delay, pod_set_reverb_pre_delay);
+static DEVICE_ATTR(reverb_pre_post, S_IWUGO | S_IRUGO, pod_get_reverb_pre_post,
+		   pod_set_reverb_pre_post);
+static DEVICE_ATTR(band_2_frequency, S_IWUGO | S_IRUGO,
+		   pod_get_band_2_frequency, pod_set_band_2_frequency);
+static DEVICE_ATTR2(band_3_frequency__bass, band_3_frequency, S_IWUGO | S_IRUGO,
+		    pod_get_band_3_frequency__bass,
+		    pod_set_band_3_frequency__bass);
+static DEVICE_ATTR(wah_enable, S_IWUGO | S_IRUGO, pod_get_wah_enable,
+		   pod_set_wah_enable);
+static DEVICE_ATTR(modulation_lo_cut, S_IWUGO | S_IRUGO,
+		   pod_get_modulation_lo_cut, pod_set_modulation_lo_cut);
+static DEVICE_ATTR(delay_reverb_lo_cut, S_IWUGO | S_IRUGO,
+		   pod_get_delay_reverb_lo_cut, pod_set_delay_reverb_lo_cut);
+static DEVICE_ATTR(volume_pedal_minimum, S_IWUGO | S_IRUGO,
+		   pod_get_volume_pedal_minimum, pod_set_volume_pedal_minimum);
+static DEVICE_ATTR(eq_pre_post, S_IWUGO | S_IRUGO, pod_get_eq_pre_post,
+		   pod_set_eq_pre_post);
+static DEVICE_ATTR(volume_pre_post, S_IWUGO | S_IRUGO, pod_get_volume_pre_post,
+		   pod_set_volume_pre_post);
+static DEVICE_ATTR(di_model, S_IWUGO | S_IRUGO, pod_get_di_model,
+		   pod_set_di_model);
+static DEVICE_ATTR(di_delay, S_IWUGO | S_IRUGO, pod_get_di_delay,
+		   pod_set_di_delay);
+static DEVICE_ATTR(mod_enable, S_IWUGO | S_IRUGO, pod_get_mod_enable,
+		   pod_set_mod_enable);
+static DEVICE_ATTR(mod_param_1_note_value, S_IWUGO | S_IRUGO,
+		   pod_get_mod_param_1_note_value,
+		   pod_set_mod_param_1_note_value);
+static DEVICE_ATTR(mod_param_2, S_IWUGO | S_IRUGO, pod_get_mod_param_2,
+		   pod_set_mod_param_2);
+static DEVICE_ATTR(mod_param_3, S_IWUGO | S_IRUGO, pod_get_mod_param_3,
+		   pod_set_mod_param_3);
+static DEVICE_ATTR(mod_param_4, S_IWUGO | S_IRUGO, pod_get_mod_param_4,
+		   pod_set_mod_param_4);
+static DEVICE_ATTR(mod_param_5, S_IWUGO | S_IRUGO, pod_get_mod_param_5,
+		   pod_set_mod_param_5);
+static DEVICE_ATTR(mod_volume_mix, S_IWUGO | S_IRUGO, pod_get_mod_volume_mix,
+		   pod_set_mod_volume_mix);
+static DEVICE_ATTR(mod_pre_post, S_IWUGO | S_IRUGO, pod_get_mod_pre_post,
+		   pod_set_mod_pre_post);
+static DEVICE_ATTR(modulation_model, S_IWUGO | S_IRUGO,
+		   pod_get_modulation_model, pod_set_modulation_model);
+static DEVICE_ATTR(band_3_frequency, S_IWUGO | S_IRUGO,
+		   pod_get_band_3_frequency, pod_set_band_3_frequency);
+static DEVICE_ATTR2(band_4_frequency__bass, band_4_frequency, S_IWUGO | S_IRUGO,
+		    pod_get_band_4_frequency__bass,
+		    pod_set_band_4_frequency__bass);
+static DEVICE_ATTR(mod_param_1_double_precision, S_IWUGO | S_IRUGO,
+		   pod_get_mod_param_1_double_precision,
+		   pod_set_mod_param_1_double_precision);
+static DEVICE_ATTR(delay_param_1_double_precision, S_IWUGO | S_IRUGO,
+		   pod_get_delay_param_1_double_precision,
+		   pod_set_delay_param_1_double_precision);
+static DEVICE_ATTR(eq_enable, S_IWUGO | S_IRUGO, pod_get_eq_enable,
+		   pod_set_eq_enable);
 static DEVICE_ATTR(tap, S_IWUGO | S_IRUGO, pod_get_tap, pod_set_tap);
-static DEVICE_ATTR(volume_tweak_pedal_assign, S_IWUGO | S_IRUGO, pod_get_volume_tweak_pedal_assign, pod_set_volume_tweak_pedal_assign);
-static DEVICE_ATTR(band_5_frequency, S_IWUGO | S_IRUGO, pod_get_band_5_frequency, pod_set_band_5_frequency);
+static DEVICE_ATTR(volume_tweak_pedal_assign, S_IWUGO | S_IRUGO,
+		   pod_get_volume_tweak_pedal_assign,
+		   pod_set_volume_tweak_pedal_assign);
+static DEVICE_ATTR(band_5_frequency, S_IWUGO | S_IRUGO,
+		   pod_get_band_5_frequency, pod_set_band_5_frequency);
 static DEVICE_ATTR(tuner, S_IWUGO | S_IRUGO, pod_get_tuner, pod_set_tuner);
-static DEVICE_ATTR(mic_selection, S_IWUGO | S_IRUGO, pod_get_mic_selection, pod_set_mic_selection);
-static DEVICE_ATTR(cabinet_model, S_IWUGO | S_IRUGO, pod_get_cabinet_model, pod_set_cabinet_model);
-static DEVICE_ATTR(stomp_model, S_IWUGO | S_IRUGO, pod_get_stomp_model, pod_set_stomp_model);
-static DEVICE_ATTR(roomlevel, S_IWUGO | S_IRUGO, pod_get_roomlevel, pod_set_roomlevel);
-static DEVICE_ATTR(band_4_frequency, S_IWUGO | S_IRUGO, pod_get_band_4_frequency, pod_set_band_4_frequency);
-static DEVICE_ATTR(band_6_frequency, S_IWUGO | S_IRUGO, pod_get_band_6_frequency, pod_set_band_6_frequency);
-static DEVICE_ATTR(stomp_param_1_note_value, S_IWUGO | S_IRUGO, pod_get_stomp_param_1_note_value, pod_set_stomp_param_1_note_value);
-static DEVICE_ATTR(stomp_param_2, S_IWUGO | S_IRUGO, pod_get_stomp_param_2, pod_set_stomp_param_2);
-static DEVICE_ATTR(stomp_param_3, S_IWUGO | S_IRUGO, pod_get_stomp_param_3, pod_set_stomp_param_3);
-static DEVICE_ATTR(stomp_param_4, S_IWUGO | S_IRUGO, pod_get_stomp_param_4, pod_set_stomp_param_4);
-static DEVICE_ATTR(stomp_param_5, S_IWUGO | S_IRUGO, pod_get_stomp_param_5, pod_set_stomp_param_5);
-static DEVICE_ATTR(stomp_param_6, S_IWUGO | S_IRUGO, pod_get_stomp_param_6, pod_set_stomp_param_6);
-static DEVICE_ATTR(amp_switch_select, S_IWUGO | S_IRUGO, pod_get_amp_switch_select, pod_set_amp_switch_select);
-static DEVICE_ATTR(delay_param_4, S_IWUGO | S_IRUGO, pod_get_delay_param_4, pod_set_delay_param_4);
-static DEVICE_ATTR(delay_param_5, S_IWUGO | S_IRUGO, pod_get_delay_param_5, pod_set_delay_param_5);
-static DEVICE_ATTR(delay_pre_post, S_IWUGO | S_IRUGO, pod_get_delay_pre_post, pod_set_delay_pre_post);
-static DEVICE_ATTR(delay_model, S_IWUGO | S_IRUGO, pod_get_delay_model, pod_set_delay_model);
-static DEVICE_ATTR(delay_verb_model, S_IWUGO | S_IRUGO, pod_get_delay_verb_model, pod_set_delay_verb_model);
-static DEVICE_ATTR(tempo_msb, S_IWUGO | S_IRUGO, pod_get_tempo_msb, pod_set_tempo_msb);
-static DEVICE_ATTR(tempo_lsb, S_IWUGO | S_IRUGO, pod_get_tempo_lsb, pod_set_tempo_lsb);
-static DEVICE_ATTR(wah_model, S_IWUGO | S_IRUGO, pod_get_wah_model, pod_set_wah_model);
-static DEVICE_ATTR(bypass_volume, S_IWUGO | S_IRUGO, pod_get_bypass_volume, pod_set_bypass_volume);
-static DEVICE_ATTR(fx_loop_on_off, S_IWUGO | S_IRUGO, pod_get_fx_loop_on_off, pod_set_fx_loop_on_off);
-static DEVICE_ATTR(tweak_param_select, S_IWUGO | S_IRUGO, pod_get_tweak_param_select, pod_set_tweak_param_select);
-static DEVICE_ATTR(amp1_engage, S_IWUGO | S_IRUGO, pod_get_amp1_engage, pod_set_amp1_engage);
-static DEVICE_ATTR(band_1_gain, S_IWUGO | S_IRUGO, pod_get_band_1_gain, pod_set_band_1_gain);
-static DEVICE_ATTR2(band_2_gain__bass, band_2_gain, S_IWUGO | S_IRUGO, pod_get_band_2_gain__bass, pod_set_band_2_gain__bass);
-static DEVICE_ATTR(band_2_gain, S_IWUGO | S_IRUGO, pod_get_band_2_gain, pod_set_band_2_gain);
-static DEVICE_ATTR2(band_3_gain__bass, band_3_gain, S_IWUGO | S_IRUGO, pod_get_band_3_gain__bass, pod_set_band_3_gain__bass);
-static DEVICE_ATTR(band_3_gain, S_IWUGO | S_IRUGO, pod_get_band_3_gain, pod_set_band_3_gain);
-static DEVICE_ATTR2(band_4_gain__bass, band_4_gain, S_IWUGO | S_IRUGO, pod_get_band_4_gain__bass, pod_set_band_4_gain__bass);
-static DEVICE_ATTR2(band_5_gain__bass, band_5_gain, S_IWUGO | S_IRUGO, pod_get_band_5_gain__bass, pod_set_band_5_gain__bass);
-static DEVICE_ATTR(band_4_gain, S_IWUGO | S_IRUGO, pod_get_band_4_gain, pod_set_band_4_gain);
-static DEVICE_ATTR2(band_6_gain__bass, band_6_gain, S_IWUGO | S_IRUGO, pod_get_band_6_gain__bass, pod_set_band_6_gain__bass);
+static DEVICE_ATTR(mic_selection, S_IWUGO | S_IRUGO, pod_get_mic_selection,
+		   pod_set_mic_selection);
+static DEVICE_ATTR(cabinet_model, S_IWUGO | S_IRUGO, pod_get_cabinet_model,
+		   pod_set_cabinet_model);
+static DEVICE_ATTR(stomp_model, S_IWUGO | S_IRUGO, pod_get_stomp_model,
+		   pod_set_stomp_model);
+static DEVICE_ATTR(roomlevel, S_IWUGO | S_IRUGO, pod_get_roomlevel,
+		   pod_set_roomlevel);
+static DEVICE_ATTR(band_4_frequency, S_IWUGO | S_IRUGO,
+		   pod_get_band_4_frequency, pod_set_band_4_frequency);
+static DEVICE_ATTR(band_6_frequency, S_IWUGO | S_IRUGO,
+		   pod_get_band_6_frequency, pod_set_band_6_frequency);
+static DEVICE_ATTR(stomp_param_1_note_value, S_IWUGO | S_IRUGO,
+		   pod_get_stomp_param_1_note_value,
+		   pod_set_stomp_param_1_note_value);
+static DEVICE_ATTR(stomp_param_2, S_IWUGO | S_IRUGO, pod_get_stomp_param_2,
+		   pod_set_stomp_param_2);
+static DEVICE_ATTR(stomp_param_3, S_IWUGO | S_IRUGO, pod_get_stomp_param_3,
+		   pod_set_stomp_param_3);
+static DEVICE_ATTR(stomp_param_4, S_IWUGO | S_IRUGO, pod_get_stomp_param_4,
+		   pod_set_stomp_param_4);
+static DEVICE_ATTR(stomp_param_5, S_IWUGO | S_IRUGO, pod_get_stomp_param_5,
+		   pod_set_stomp_param_5);
+static DEVICE_ATTR(stomp_param_6, S_IWUGO | S_IRUGO, pod_get_stomp_param_6,
+		   pod_set_stomp_param_6);
+static DEVICE_ATTR(amp_switch_select, S_IWUGO | S_IRUGO,
+		   pod_get_amp_switch_select, pod_set_amp_switch_select);
+static DEVICE_ATTR(delay_param_4, S_IWUGO | S_IRUGO, pod_get_delay_param_4,
+		   pod_set_delay_param_4);
+static DEVICE_ATTR(delay_param_5, S_IWUGO | S_IRUGO, pod_get_delay_param_5,
+		   pod_set_delay_param_5);
+static DEVICE_ATTR(delay_pre_post, S_IWUGO | S_IRUGO, pod_get_delay_pre_post,
+		   pod_set_delay_pre_post);
+static DEVICE_ATTR(delay_model, S_IWUGO | S_IRUGO, pod_get_delay_model,
+		   pod_set_delay_model);
+static DEVICE_ATTR(delay_verb_model, S_IWUGO | S_IRUGO,
+		   pod_get_delay_verb_model, pod_set_delay_verb_model);
+static DEVICE_ATTR(tempo_msb, S_IWUGO | S_IRUGO, pod_get_tempo_msb,
+		   pod_set_tempo_msb);
+static DEVICE_ATTR(tempo_lsb, S_IWUGO | S_IRUGO, pod_get_tempo_lsb,
+		   pod_set_tempo_lsb);
+static DEVICE_ATTR(wah_model, S_IWUGO | S_IRUGO, pod_get_wah_model,
+		   pod_set_wah_model);
+static DEVICE_ATTR(bypass_volume, S_IWUGO | S_IRUGO, pod_get_bypass_volume,
+		   pod_set_bypass_volume);
+static DEVICE_ATTR(fx_loop_on_off, S_IWUGO | S_IRUGO, pod_get_fx_loop_on_off,
+		   pod_set_fx_loop_on_off);
+static DEVICE_ATTR(tweak_param_select, S_IWUGO | S_IRUGO,
+		   pod_get_tweak_param_select, pod_set_tweak_param_select);
+static DEVICE_ATTR(amp1_engage, S_IWUGO | S_IRUGO, pod_get_amp1_engage,
+		   pod_set_amp1_engage);
+static DEVICE_ATTR(band_1_gain, S_IWUGO | S_IRUGO, pod_get_band_1_gain,
+		   pod_set_band_1_gain);
+static DEVICE_ATTR2(band_2_gain__bass, band_2_gain, S_IWUGO | S_IRUGO,
+		    pod_get_band_2_gain__bass, pod_set_band_2_gain__bass);
+static DEVICE_ATTR(band_2_gain, S_IWUGO | S_IRUGO, pod_get_band_2_gain,
+		   pod_set_band_2_gain);
+static DEVICE_ATTR2(band_3_gain__bass, band_3_gain, S_IWUGO | S_IRUGO,
+		    pod_get_band_3_gain__bass, pod_set_band_3_gain__bass);
+static DEVICE_ATTR(band_3_gain, S_IWUGO | S_IRUGO, pod_get_band_3_gain,
+		   pod_set_band_3_gain);
+static DEVICE_ATTR2(band_4_gain__bass, band_4_gain, S_IWUGO | S_IRUGO,
+		    pod_get_band_4_gain__bass, pod_set_band_4_gain__bass);
+static DEVICE_ATTR2(band_5_gain__bass, band_5_gain, S_IWUGO | S_IRUGO,
+		    pod_get_band_5_gain__bass, pod_set_band_5_gain__bass);
+static DEVICE_ATTR(band_4_gain, S_IWUGO | S_IRUGO, pod_get_band_4_gain,
+		   pod_set_band_4_gain);
+static DEVICE_ATTR2(band_6_gain__bass, band_6_gain, S_IWUGO | S_IRUGO,
+		    pod_get_band_6_gain__bass, pod_set_band_6_gain__bass);
 static DEVICE_ATTR(body, S_IRUGO, variax_get_body, line6_nop_write);
-static DEVICE_ATTR(pickup1_enable, S_IRUGO, variax_get_pickup1_enable, line6_nop_write);
-static DEVICE_ATTR(pickup1_type, S_IRUGO, variax_get_pickup1_type, line6_nop_write);
-static DEVICE_ATTR(pickup1_position, S_IRUGO, variax_get_pickup1_position, line6_nop_write);
-static DEVICE_ATTR(pickup1_angle, S_IRUGO, variax_get_pickup1_angle, line6_nop_write);
-static DEVICE_ATTR(pickup1_level, S_IRUGO, variax_get_pickup1_level, line6_nop_write);
-static DEVICE_ATTR(pickup2_enable, S_IRUGO, variax_get_pickup2_enable, line6_nop_write);
-static DEVICE_ATTR(pickup2_type, S_IRUGO, variax_get_pickup2_type, line6_nop_write);
-static DEVICE_ATTR(pickup2_position, S_IRUGO, variax_get_pickup2_position, line6_nop_write);
-static DEVICE_ATTR(pickup2_angle, S_IRUGO, variax_get_pickup2_angle, line6_nop_write);
-static DEVICE_ATTR(pickup2_level, S_IRUGO, variax_get_pickup2_level, line6_nop_write);
-static DEVICE_ATTR(pickup_phase, S_IRUGO, variax_get_pickup_phase, line6_nop_write);
-static DEVICE_ATTR(capacitance, S_IRUGO, variax_get_capacitance, line6_nop_write);
-static DEVICE_ATTR(tone_resistance, S_IRUGO, variax_get_tone_resistance, line6_nop_write);
-static DEVICE_ATTR(volume_resistance, S_IRUGO, variax_get_volume_resistance, line6_nop_write);
+static DEVICE_ATTR(pickup1_enable, S_IRUGO, variax_get_pickup1_enable,
+		   line6_nop_write);
+static DEVICE_ATTR(pickup1_type, S_IRUGO, variax_get_pickup1_type,
+		   line6_nop_write);
+static DEVICE_ATTR(pickup1_position, S_IRUGO, variax_get_pickup1_position,
+		   line6_nop_write);
+static DEVICE_ATTR(pickup1_angle, S_IRUGO, variax_get_pickup1_angle,
+		   line6_nop_write);
+static DEVICE_ATTR(pickup1_level, S_IRUGO, variax_get_pickup1_level,
+		   line6_nop_write);
+static DEVICE_ATTR(pickup2_enable, S_IRUGO, variax_get_pickup2_enable,
+		   line6_nop_write);
+static DEVICE_ATTR(pickup2_type, S_IRUGO, variax_get_pickup2_type,
+		   line6_nop_write);
+static DEVICE_ATTR(pickup2_position, S_IRUGO, variax_get_pickup2_position,
+		   line6_nop_write);
+static DEVICE_ATTR(pickup2_angle, S_IRUGO, variax_get_pickup2_angle,
+		   line6_nop_write);
+static DEVICE_ATTR(pickup2_level, S_IRUGO, variax_get_pickup2_level,
+		   line6_nop_write);
+static DEVICE_ATTR(pickup_phase, S_IRUGO, variax_get_pickup_phase,
+		   line6_nop_write);
+static DEVICE_ATTR(capacitance, S_IRUGO, variax_get_capacitance,
+		   line6_nop_write);
+static DEVICE_ATTR(tone_resistance, S_IRUGO, variax_get_tone_resistance,
+		   line6_nop_write);
+static DEVICE_ATTR(volume_resistance, S_IRUGO, variax_get_volume_resistance,
+		   line6_nop_write);
 static DEVICE_ATTR(taper, S_IRUGO, variax_get_taper, line6_nop_write);
 static DEVICE_ATTR(tone_dump, S_IRUGO, variax_get_tone_dump, line6_nop_write);
 static DEVICE_ATTR(save_tone, S_IRUGO, variax_get_save_tone, line6_nop_write);
-static DEVICE_ATTR(volume_dump, S_IRUGO, variax_get_volume_dump, line6_nop_write);
-static DEVICE_ATTR(tuning_enable, S_IRUGO, variax_get_tuning_enable, line6_nop_write);
+static DEVICE_ATTR(volume_dump, S_IRUGO, variax_get_volume_dump,
+		   line6_nop_write);
+static DEVICE_ATTR(tuning_enable, S_IRUGO, variax_get_tuning_enable,
+		   line6_nop_write);
 static DEVICE_ATTR(tuning6, S_IRUGO, variax_get_tuning6, line6_nop_write);
 static DEVICE_ATTR(tuning5, S_IRUGO, variax_get_tuning5, line6_nop_write);
 static DEVICE_ATTR(tuning4, S_IRUGO, variax_get_tuning4, line6_nop_write);
@@ -399,7 +527,8 @@ static DEVICE_ATTR(mix4, S_IRUGO, variax_get_mix4, line6_nop_write);
 static DEVICE_ATTR(mix3, S_IRUGO, variax_get_mix3, line6_nop_write);
 static DEVICE_ATTR(mix2, S_IRUGO, variax_get_mix2, line6_nop_write);
 static DEVICE_ATTR(mix1, S_IRUGO, variax_get_mix1, line6_nop_write);
-static DEVICE_ATTR(pickup_wiring, S_IRUGO, variax_get_pickup_wiring, line6_nop_write);
+static DEVICE_ATTR(pickup_wiring, S_IRUGO, variax_get_pickup_wiring,
+		   line6_nop_write);
 
 int pod_create_files(int firmware, int type, struct device *dev)
 {
@@ -407,7 +536,8 @@ int pod_create_files(int firmware, int type, struct device *dev)
 	CHECK_RETURN(device_create_file(dev, &dev_attr_tweak));
 	CHECK_RETURN(device_create_file(dev, &dev_attr_wah_position));
 	if ((type & (LINE6_BITS_PODXTALL)) != 0)
-		CHECK_RETURN(device_create_file(dev, &dev_attr_compression_gain));
+		CHECK_RETURN(device_create_file
+			     (dev, &dev_attr_compression_gain));
 	CHECK_RETURN(device_create_file(dev, &dev_attr_vol_pedal_position));
 	CHECK_RETURN(device_create_file(dev, &dev_attr_compression_threshold));
 	CHECK_RETURN(device_create_file(dev, &dev_attr_pan));
@@ -429,7 +559,8 @@ int pod_create_files(int firmware, int type, struct device *dev)
 		CHECK_RETURN(device_create_file(dev, &dev_attr_reverb_mix));
 	CHECK_RETURN(device_create_file(dev, &dev_attr_effect_setup));
 	if (firmware >= 200)
-		CHECK_RETURN(device_create_file(dev, &dev_attr_band_1_frequency));
+		CHECK_RETURN(device_create_file
+			     (dev, &dev_attr_band_1_frequency));
 	if ((type & (LINE6_BITS_PODXTALL)) != 0)
 		CHECK_RETURN(device_create_file(dev, &dev_attr_presence));
 	if ((type & (LINE6_BITS_BASSPODXTALL)) != 0)
@@ -443,10 +574,12 @@ int pod_create_files(int firmware, int type, struct device *dev)
 	CHECK_RETURN(device_create_file(dev, &dev_attr_delay_enable));
 	CHECK_RETURN(device_create_file(dev, &dev_attr_mod_param_1));
 	CHECK_RETURN(device_create_file(dev, &dev_attr_delay_param_1));
-	CHECK_RETURN(device_create_file(dev, &dev_attr_delay_param_1_note_value));
+	CHECK_RETURN(device_create_file
+		     (dev, &dev_attr_delay_param_1_note_value));
 	if ((type & (LINE6_BITS_BASSPODXTALL)) != 0)
 		if (firmware >= 200)
-			CHECK_RETURN(device_create_file(dev, &dev_attr_band_2_frequency__bass));
+			CHECK_RETURN(device_create_file
+				     (dev, &dev_attr_band_2_frequency__bass));
 	CHECK_RETURN(device_create_file(dev, &dev_attr_delay_param_2));
 	CHECK_RETURN(device_create_file(dev, &dev_attr_delay_volume_mix));
 	CHECK_RETURN(device_create_file(dev, &dev_attr_delay_param_3));
@@ -459,26 +592,34 @@ int pod_create_files(int firmware, int type, struct device *dev)
 	if ((type & (LINE6_BITS_PODXTALL)) != 0)
 		CHECK_RETURN(device_create_file(dev, &dev_attr_reverb_tone));
 	if ((type & (LINE6_BITS_PODXTALL)) != 0)
-		CHECK_RETURN(device_create_file(dev, &dev_attr_reverb_pre_delay));
+		CHECK_RETURN(device_create_file
+			     (dev, &dev_attr_reverb_pre_delay));
 	if ((type & (LINE6_BITS_PODXTALL)) != 0)
-		CHECK_RETURN(device_create_file(dev, &dev_attr_reverb_pre_post));
+		CHECK_RETURN(device_create_file
+			     (dev, &dev_attr_reverb_pre_post));
 	if ((type & (LINE6_BITS_PODXTALL)) != 0)
 		if (firmware >= 200)
-			CHECK_RETURN(device_create_file(dev, &dev_attr_band_2_frequency));
+			CHECK_RETURN(device_create_file
+				     (dev, &dev_attr_band_2_frequency));
 	if ((type & (LINE6_BITS_BASSPODXTALL)) != 0)
 		if (firmware >= 200)
-			CHECK_RETURN(device_create_file(dev, &dev_attr_band_3_frequency__bass));
+			CHECK_RETURN(device_create_file
+				     (dev, &dev_attr_band_3_frequency__bass));
 	CHECK_RETURN(device_create_file(dev, &dev_attr_wah_enable));
 	if ((type & (LINE6_BITS_BASSPODXTALL)) != 0)
-		CHECK_RETURN(device_create_file(dev, &dev_attr_modulation_lo_cut));
+		CHECK_RETURN(device_create_file
+			     (dev, &dev_attr_modulation_lo_cut));
 	if ((type & (LINE6_BITS_BASSPODXTALL)) != 0)
-		CHECK_RETURN(device_create_file(dev, &dev_attr_delay_reverb_lo_cut));
+		CHECK_RETURN(device_create_file
+			     (dev, &dev_attr_delay_reverb_lo_cut));
 	if ((type & (LINE6_BITS_PODXTALL)) != 0)
 		if (firmware >= 200)
-			CHECK_RETURN(device_create_file(dev, &dev_attr_volume_pedal_minimum));
+			CHECK_RETURN(device_create_file
+				     (dev, &dev_attr_volume_pedal_minimum));
 	if ((type & (LINE6_BITS_BASSPODXTALL)) != 0)
 		if (firmware >= 200)
-			CHECK_RETURN(device_create_file(dev, &dev_attr_eq_pre_post));
+			CHECK_RETURN(device_create_file
+				     (dev, &dev_attr_eq_pre_post));
 	CHECK_RETURN(device_create_file(dev, &dev_attr_volume_pre_post));
 	if ((type & (LINE6_BITS_BASSPODXTALL)) != 0)
 		CHECK_RETURN(device_create_file(dev, &dev_attr_di_model));
@@ -496,19 +637,25 @@ int pod_create_files(int firmware, int type, struct device *dev)
 	CHECK_RETURN(device_create_file(dev, &dev_attr_modulation_model));
 	if ((type & (LINE6_BITS_PODXTALL)) != 0)
 		if (firmware >= 200)
-			CHECK_RETURN(device_create_file(dev, &dev_attr_band_3_frequency));
+			CHECK_RETURN(device_create_file
+				     (dev, &dev_attr_band_3_frequency));
 	if ((type & (LINE6_BITS_BASSPODXTALL)) != 0)
 		if (firmware >= 200)
-			CHECK_RETURN(device_create_file(dev, &dev_attr_band_4_frequency__bass));
-	CHECK_RETURN(device_create_file(dev, &dev_attr_mod_param_1_double_precision));
-	CHECK_RETURN(device_create_file(dev, &dev_attr_delay_param_1_double_precision));
+			CHECK_RETURN(device_create_file
+				     (dev, &dev_attr_band_4_frequency__bass));
+	CHECK_RETURN(device_create_file
+		     (dev, &dev_attr_mod_param_1_double_precision));
+	CHECK_RETURN(device_create_file
+		     (dev, &dev_attr_delay_param_1_double_precision));
 	if (firmware >= 200)
 		CHECK_RETURN(device_create_file(dev, &dev_attr_eq_enable));
 	CHECK_RETURN(device_create_file(dev, &dev_attr_tap));
-	CHECK_RETURN(device_create_file(dev, &dev_attr_volume_tweak_pedal_assign));
+	CHECK_RETURN(device_create_file
+		     (dev, &dev_attr_volume_tweak_pedal_assign));
 	if ((type & (LINE6_BITS_BASSPODXTALL)) != 0)
 		if (firmware >= 200)
-			CHECK_RETURN(device_create_file(dev, &dev_attr_band_5_frequency));
+			CHECK_RETURN(device_create_file
+				     (dev, &dev_attr_band_5_frequency));
 	CHECK_RETURN(device_create_file(dev, &dev_attr_tuner));
 	CHECK_RETURN(device_create_file(dev, &dev_attr_mic_selection));
 	CHECK_RETURN(device_create_file(dev, &dev_attr_cabinet_model));
@@ -516,25 +663,30 @@ int pod_create_files(int firmware, int type, struct device *dev)
 	CHECK_RETURN(device_create_file(dev, &dev_attr_roomlevel));
 	if ((type & (LINE6_BITS_PODXTALL)) != 0)
 		if (firmware >= 200)
-			CHECK_RETURN(device_create_file(dev, &dev_attr_band_4_frequency));
+			CHECK_RETURN(device_create_file
+				     (dev, &dev_attr_band_4_frequency));
 	if ((type & (LINE6_BITS_BASSPODXTALL)) != 0)
 		if (firmware >= 200)
-			CHECK_RETURN(device_create_file(dev, &dev_attr_band_6_frequency));
-	CHECK_RETURN(device_create_file(dev, &dev_attr_stomp_param_1_note_value));
+			CHECK_RETURN(device_create_file
+				     (dev, &dev_attr_band_6_frequency));
+	CHECK_RETURN(device_create_file
+		     (dev, &dev_attr_stomp_param_1_note_value));
 	CHECK_RETURN(device_create_file(dev, &dev_attr_stomp_param_2));
 	CHECK_RETURN(device_create_file(dev, &dev_attr_stomp_param_3));
 	CHECK_RETURN(device_create_file(dev, &dev_attr_stomp_param_4));
 	CHECK_RETURN(device_create_file(dev, &dev_attr_stomp_param_5));
 	CHECK_RETURN(device_create_file(dev, &dev_attr_stomp_param_6));
 	if ((type & (LINE6_BITS_LIVE)) != 0)
-		CHECK_RETURN(device_create_file(dev, &dev_attr_amp_switch_select));
+		CHECK_RETURN(device_create_file
+			     (dev, &dev_attr_amp_switch_select));
 	CHECK_RETURN(device_create_file(dev, &dev_attr_delay_param_4));
 	CHECK_RETURN(device_create_file(dev, &dev_attr_delay_param_5));
 	CHECK_RETURN(device_create_file(dev, &dev_attr_delay_pre_post));
 	if ((type & (LINE6_BITS_PODXTALL)) != 0)
 		CHECK_RETURN(device_create_file(dev, &dev_attr_delay_model));
 	if ((type & (LINE6_BITS_BASSPODXTALL)) != 0)
-		CHECK_RETURN(device_create_file(dev, &dev_attr_delay_verb_model));
+		CHECK_RETURN(device_create_file
+			     (dev, &dev_attr_delay_verb_model));
 	CHECK_RETURN(device_create_file(dev, &dev_attr_tempo_msb));
 	CHECK_RETURN(device_create_file(dev, &dev_attr_tempo_lsb));
 	if (firmware >= 300)
@@ -549,30 +701,39 @@ int pod_create_files(int firmware, int type, struct device *dev)
 		CHECK_RETURN(device_create_file(dev, &dev_attr_band_1_gain));
 	if ((type & (LINE6_BITS_BASSPODXTALL)) != 0)
 		if (firmware >= 200)
-			CHECK_RETURN(device_create_file(dev, &dev_attr_band_2_gain__bass));
+			CHECK_RETURN(device_create_file
+				     (dev, &dev_attr_band_2_gain__bass));
 	if ((type & (LINE6_BITS_PODXTALL)) != 0)
 		if (firmware >= 200)
-			CHECK_RETURN(device_create_file(dev, &dev_attr_band_2_gain));
+			CHECK_RETURN(device_create_file
+				     (dev, &dev_attr_band_2_gain));
 	if ((type & (LINE6_BITS_BASSPODXTALL)) != 0)
 		if (firmware >= 200)
-			CHECK_RETURN(device_create_file(dev, &dev_attr_band_3_gain__bass));
+			CHECK_RETURN(device_create_file
+				     (dev, &dev_attr_band_3_gain__bass));
 	if ((type & (LINE6_BITS_PODXTALL)) != 0)
 		if (firmware >= 200)
-			CHECK_RETURN(device_create_file(dev, &dev_attr_band_3_gain));
+			CHECK_RETURN(device_create_file
+				     (dev, &dev_attr_band_3_gain));
 	if ((type & (LINE6_BITS_BASSPODXTALL)) != 0)
 		if (firmware >= 200)
-			CHECK_RETURN(device_create_file(dev, &dev_attr_band_4_gain__bass));
+			CHECK_RETURN(device_create_file
+				     (dev, &dev_attr_band_4_gain__bass));
 	if ((type & (LINE6_BITS_BASSPODXTALL)) != 0)
 		if (firmware >= 200)
-			CHECK_RETURN(device_create_file(dev, &dev_attr_band_5_gain__bass));
+			CHECK_RETURN(device_create_file
+				     (dev, &dev_attr_band_5_gain__bass));
 	if ((type & (LINE6_BITS_PODXTALL)) != 0)
 		if (firmware >= 200)
-			CHECK_RETURN(device_create_file(dev, &dev_attr_band_4_gain));
+			CHECK_RETURN(device_create_file
+				     (dev, &dev_attr_band_4_gain));
 	if ((type & (LINE6_BITS_BASSPODXTALL)) != 0)
 		if (firmware >= 200)
-			CHECK_RETURN(device_create_file(dev, &dev_attr_band_6_gain__bass));
-  return 0;
+			CHECK_RETURN(device_create_file
+				     (dev, &dev_attr_band_6_gain__bass));
+	return 0;
 }
+EXPORT_SYMBOL(pod_create_files);
 
 void pod_remove_files(int firmware, int type, struct device *dev)
 {
@@ -618,7 +779,8 @@ void pod_remove_files(int firmware, int type, struct device *dev)
 	device_remove_file(dev, &dev_attr_delay_param_1_note_value);
 	if ((type & (LINE6_BITS_BASSPODXTALL)) != 0)
 		if (firmware >= 200)
-			device_remove_file(dev, &dev_attr_band_2_frequency__bass);
+			device_remove_file(dev,
+					   &dev_attr_band_2_frequency__bass);
 	device_remove_file(dev, &dev_attr_delay_param_2);
 	device_remove_file(dev, &dev_attr_delay_volume_mix);
 	device_remove_file(dev, &dev_attr_delay_param_3);
@@ -639,7 +801,8 @@ void pod_remove_files(int firmware, int type, struct device *dev)
 			device_remove_file(dev, &dev_attr_band_2_frequency);
 	if ((type & (LINE6_BITS_BASSPODXTALL)) != 0)
 		if (firmware >= 200)
-			device_remove_file(dev, &dev_attr_band_3_frequency__bass);
+			device_remove_file(dev,
+					   &dev_attr_band_3_frequency__bass);
 	device_remove_file(dev, &dev_attr_wah_enable);
 	if ((type & (LINE6_BITS_BASSPODXTALL)) != 0)
 		device_remove_file(dev, &dev_attr_modulation_lo_cut);
@@ -671,7 +834,8 @@ void pod_remove_files(int firmware, int type, struct device *dev)
 			device_remove_file(dev, &dev_attr_band_3_frequency);
 	if ((type & (LINE6_BITS_BASSPODXTALL)) != 0)
 		if (firmware >= 200)
-			device_remove_file(dev, &dev_attr_band_4_frequency__bass);
+			device_remove_file(dev,
+					   &dev_attr_band_4_frequency__bass);
 	device_remove_file(dev, &dev_attr_mod_param_1_double_precision);
 	device_remove_file(dev, &dev_attr_delay_param_1_double_precision);
 	if (firmware >= 200)
@@ -744,8 +908,6 @@ void pod_remove_files(int firmware, int type, struct device *dev)
 		if (firmware >= 200)
 			device_remove_file(dev, &dev_attr_band_6_gain__bass);
 }
-
-EXPORT_SYMBOL(pod_create_files);
 EXPORT_SYMBOL(pod_remove_files);
 
 int variax_create_files(int firmware, int type, struct device *dev)
@@ -790,8 +952,9 @@ int variax_create_files(int firmware, int type, struct device *dev)
 	CHECK_RETURN(device_create_file(dev, &dev_attr_mix2));
 	CHECK_RETURN(device_create_file(dev, &dev_attr_mix1));
 	CHECK_RETURN(device_create_file(dev, &dev_attr_pickup_wiring));
-  return 0;
+	return 0;
 }
+EXPORT_SYMBOL(variax_create_files);
 
 void variax_remove_files(int firmware, int type, struct device *dev)
 {
@@ -835,6 +998,4 @@ void variax_remove_files(int firmware, int type, struct device *dev)
 	device_remove_file(dev, &dev_attr_mix1);
 	device_remove_file(dev, &dev_attr_pickup_wiring);
 }
-
-EXPORT_SYMBOL(variax_create_files);
 EXPORT_SYMBOL(variax_remove_files);
diff --git a/drivers/staging/line6/driver.c b/drivers/staging/line6/driver.c
index f188ecee502f..e4078a92d399 100644
--- a/drivers/staging/line6/driver.c
+++ b/drivers/staging/line6/driver.c
@@ -168,19 +168,19 @@ static void line6_dump_urb(struct urb *urb)
 #endif
 
 /*
-	Send raw message in pieces of wMaxPacketSize bytes.
+	Send raw message in pieces of max_packet_size bytes.
 */
 int line6_send_raw_message(struct usb_line6 *line6, const char *buffer,
 			   int size)
 {
 	int i, done = 0;
+	int actual_size;
 
 #if DO_DUMP_URB_SEND
 	line6_write_hexdump(line6, 'S', buffer, size);
 #endif
 
-	for (i = 0; i < size; i += line6->max_packet_size) {
-		int partial;
+	for (i = 0; i < size; i += actual_size) {
 		const char *frag_buf = buffer + i;
 		int frag_size = min(line6->max_packet_size, size - i);
 		int retval;
@@ -189,7 +189,7 @@ int line6_send_raw_message(struct usb_line6 *line6, const char *buffer,
 					   usb_sndintpipe(line6->usbdev,
 							  line6->ep_control_write),
 					   (char *)frag_buf, frag_size,
-					   &partial, LINE6_TIMEOUT * HZ);
+					   &actual_size, LINE6_TIMEOUT * HZ);
 
 		if (retval) {
 			dev_err(line6->ifcdev,
@@ -197,7 +197,7 @@ int line6_send_raw_message(struct usb_line6 *line6, const char *buffer,
 			break;
 		}
 
-		done += frag_size;
+		done += actual_size;
 	}
 
 	return done;
@@ -395,17 +395,44 @@ static void line6_data_received(struct urb *urb)
 	line6_start_listen(line6);
 }
 
+static int line6_send(struct usb_line6 *line6, unsigned char *buf, size_t len)
+{
+	int retval;
+	unsigned int partial;
+
+#if DO_DUMP_URB_SEND
+	line6_write_hexdump(line6, 'S', buf, len);
+#endif
+
+	retval = usb_interrupt_msg(line6->usbdev,
+				   usb_sndintpipe(line6->usbdev,
+						  line6->ep_control_write),
+				   buf, len, &partial,
+				   LINE6_TIMEOUT * HZ);
+
+	if (retval) {
+		dev_err(line6->ifcdev,
+			"usb_interrupt_msg failed (%d)\n", retval);
+	}
+
+	if (partial != len) {
+		dev_err(line6->ifcdev,
+			"usb_interrupt_msg sent partial message (%d)\n",
+			 retval);
+	}
+
+	return retval;
+}
+
 /*
 	Send channel number (i.e., switch to a different sound).
 */
 int line6_send_program(struct usb_line6 *line6, int value)
 {
-	int retval;
 	unsigned char *buffer;
-	unsigned int partial;
-
-	buffer = kmalloc(2, GFP_KERNEL);
+	size_t len = 2;
 
+	buffer = kmalloc(len, GFP_KERNEL);
 	if (!buffer) {
 		dev_err(line6->ifcdev, "out of memory\n");
 		return -ENOMEM;
@@ -414,20 +441,7 @@ int line6_send_program(struct usb_line6 *line6, int value)
 	buffer[0] = LINE6_PROGRAM_CHANGE | LINE6_CHANNEL_HOST;
 	buffer[1] = value;
 
-#if DO_DUMP_URB_SEND
-	line6_write_hexdump(line6, 'S', buffer, 2);
-#endif
-
-	retval = usb_interrupt_msg(line6->usbdev,
-				   usb_sndintpipe(line6->usbdev,
-						  line6->ep_control_write),
-				   buffer, 2, &partial, LINE6_TIMEOUT * HZ);
-
-	if (retval)
-		dev_err(line6->ifcdev, "usb_interrupt_msg failed (%d)\n", retval);
-
-	kfree(buffer);
-	return retval;
+	return line6_send(line6, buffer, len);
 }
 
 /*
@@ -435,12 +449,10 @@ int line6_send_program(struct usb_line6 *line6, int value)
 */
 int line6_transmit_parameter(struct usb_line6 *line6, int param, int value)
 {
-	int retval;
 	unsigned char *buffer;
-	unsigned int partial;
-
-	buffer = kmalloc(3, GFP_KERNEL);
+	size_t len = 3;
 
+	buffer = kmalloc(len, GFP_KERNEL);
 	if (!buffer) {
 		dev_err(line6->ifcdev, "out of memory\n");
 		return -ENOMEM;
@@ -450,19 +462,7 @@ int line6_transmit_parameter(struct usb_line6 *line6, int param, int value)
 	buffer[1] = param;
 	buffer[2] = value;
 
-#if DO_DUMP_URB_SEND
-	line6_write_hexdump(line6, 'S', buffer, 3);
-#endif
-
-	retval = usb_interrupt_msg(line6->usbdev,
-														 usb_sndintpipe(line6->usbdev, line6->ep_control_write),
-														 buffer, 3, &partial, LINE6_TIMEOUT * HZ);
-
-	if (retval)
-		dev_err(line6->ifcdev, "usb_interrupt_msg failed (%d)\n", retval);
-
-	kfree(buffer);
-	return retval;
+	return line6_send(line6, buffer, len);
 }
 
 /*
@@ -476,8 +476,10 @@ int line6_read_data(struct usb_line6 *line6, int address, void *data, size_t dat
 
 	/* query the serial number: */
 	ret = usb_control_msg(usbdev, usb_sndctrlpipe(usbdev, 0), 0x67,
-												USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT,
-												(datalen << 8) | 0x21, address, NULL, 0, LINE6_TIMEOUT * HZ);
+				      USB_TYPE_VENDOR | USB_RECIP_DEVICE
+				      | USB_DIR_OUT,
+				      (datalen << 8) | 0x21, address,
+				      NULL, 0, LINE6_TIMEOUT * HZ);
 
 	if (ret < 0) {
 		dev_err(line6->ifcdev, "read request failed (error %d)\n", ret);
@@ -496,9 +498,7 @@ int line6_read_data(struct usb_line6 *line6, int address, void *data, size_t dat
 				"receive length failed (error %d)\n", ret);
 			return ret;
 		}
-	}
-	while (len == 0xff)
-		;
+	} while (len == 0xff);
 
 	if (len != datalen) {
 		/* should be equal or something went wrong */
@@ -682,10 +682,14 @@ static int line6_probe(struct usb_interface *interface, const struct usb_device_
 		return -ENODEV;
 
 	/* check vendor and product id */
-	for (devtype = ARRAY_SIZE(line6_id_table) - 1; devtype--;)
-		if ((le16_to_cpu(usbdev->descriptor.idVendor) == line6_id_table[devtype].idVendor) &&
-			 (le16_to_cpu(usbdev->descriptor.idProduct) == line6_id_table[devtype].idProduct))
+	for (devtype = ARRAY_SIZE(line6_id_table) - 1; devtype--;) {
+		u16 vendor = le16_to_cpu(usbdev->descriptor.idVendor);
+		u16 product = le16_to_cpu(usbdev->descriptor.idProduct);
+
+		if (vendor == line6_id_table[devtype].idVendor
+		     && product == line6_id_table[devtype].idProduct)
 			break;
+	}
 
 	if (devtype < 0)
 		return -ENODEV;
@@ -1036,9 +1040,10 @@ static void line6_disconnect(struct usb_interface *interface)
 
 		dev_info(&interface->dev, "Line6 %s now disconnected\n", line6->properties->name);
 
-		for (i = LINE6_MAX_DEVICES; i--;)
+		for (i = LINE6_MAX_DEVICES; i--;) {
 			if (line6_devices[i] == line6)
 				line6_devices[i] = NULL;
+		}
 	}
 
 	line6_destruct(interface);
diff --git a/drivers/staging/line6/midi.c b/drivers/staging/line6/midi.c
index 89a2b17e9caf..6ef4455d87d8 100644
--- a/drivers/staging/line6/midi.c
+++ b/drivers/staging/line6/midi.c
@@ -318,7 +318,13 @@ static ssize_t midi_set_midi_mask_transmit(struct device *dev,
 {
 	struct usb_interface *interface = to_usb_interface(dev);
 	struct usb_line6 *line6 = usb_get_intfdata(interface);
-	int value = simple_strtoul(buf, NULL, 10);
+	unsigned long value;
+	int ret;
+
+	ret = strict_strtoul(buf, 10, &value);
+	if (ret)
+		return ret;
+
 	line6->line6midi->midi_mask_transmit = value;
 	return count;
 }
@@ -344,7 +350,13 @@ static ssize_t midi_set_midi_mask_receive(struct device *dev,
 {
 	struct usb_interface *interface = to_usb_interface(dev);
 	struct usb_line6 *line6 = usb_get_intfdata(interface);
-	int value = simple_strtoul(buf, NULL, 10);
+	unsigned long value;
+	int ret;
+
+	ret = strict_strtoul(buf, 10, &value);
+	if (ret)
+		return ret;
+
 	line6->line6midi->midi_mask_receive = value;
 	return count;
 }
diff --git a/drivers/staging/line6/pcm.c b/drivers/staging/line6/pcm.c
index fc4113f33159..dd98121eb80b 100644
--- a/drivers/staging/line6/pcm.c
+++ b/drivers/staging/line6/pcm.c
@@ -156,7 +156,8 @@ static int snd_line6_new_pcm(struct snd_line6_pcm *line6pcm)
 	strcpy(pcm->name, line6pcm->line6->properties->name);
 
 	/* set operators */
-	snd_pcm_set_ops(pcm, SNDRV_PCM_STREAM_PLAYBACK, &snd_line6_playback_ops);
+	snd_pcm_set_ops(pcm, SNDRV_PCM_STREAM_PLAYBACK,
+			&snd_line6_playback_ops);
 	snd_pcm_set_ops(pcm, SNDRV_PCM_STREAM_CAPTURE, &snd_line6_capture_ops);
 
 	/* pre-allocation of buffers */
diff --git a/drivers/staging/line6/playback.c b/drivers/staging/line6/playback.c
index acb06126a6a5..3431f5cd2852 100644
--- a/drivers/staging/line6/playback.c
+++ b/drivers/staging/line6/playback.c
@@ -20,7 +20,6 @@
 #include "pod.h"
 #include "playback.h"
 
-
 /*
 	Software stereo volume control.
 */
@@ -30,7 +29,7 @@ static void change_volume(struct urb *urb_out, int volume[],
 	int chn = 0;
 
 	if (volume[0] == 256 && volume[1] == 256)
-		return;  /* maximum volume - no change */
+		return;		/* maximum volume - no change */
 
 	if (bytes_per_frame == 4) {
 		short *p, *buf_end;
@@ -68,13 +67,17 @@ static int submit_audio_out_urb(struct snd_pcm_substream *substream)
 	int i, urb_size, urb_frames;
 	struct snd_line6_pcm *line6pcm = snd_pcm_substream_chip(substream);
 	const int bytes_per_frame = line6pcm->properties->bytes_per_frame;
-	const int frame_increment = line6pcm->properties->snd_line6_rates.rats[0].num_min;
-	const int frame_factor = line6pcm->properties->snd_line6_rates.rats[0].den * (USB_INTERVALS_PER_SECOND / LINE6_ISO_INTERVAL);
+	const int frame_increment =
+	    line6pcm->properties->snd_line6_rates.rats[0].num_min;
+	const int frame_factor =
+	    line6pcm->properties->snd_line6_rates.rats[0].den *
+	    (USB_INTERVALS_PER_SECOND / LINE6_ISO_INTERVAL);
 	struct snd_pcm_runtime *runtime = substream->runtime;
 	struct urb *urb_out;
 
 	spin_lock_irqsave(&line6pcm->lock_audio_out, flags);
-	index = find_first_zero_bit(&line6pcm->active_urb_out, LINE6_ISO_BUFFERS);
+	index =
+	    find_first_zero_bit(&line6pcm->active_urb_out, LINE6_ISO_BUFFERS);
 
 	if (index < 0 || index >= LINE6_ISO_BUFFERS) {
 		spin_unlock_irqrestore(&line6pcm->lock_audio_out, flags);
@@ -88,7 +91,8 @@ static int submit_audio_out_urb(struct snd_pcm_substream *substream)
 	for (i = 0; i < LINE6_ISO_PACKETS; ++i) {
 		/* compute frame size for given sampling rate */
 		int n, fs;
-		struct usb_iso_packet_descriptor *fout = &urb_out->iso_frame_desc[i];
+		struct usb_iso_packet_descriptor *fout =
+		    &urb_out->iso_frame_desc[i];
 		line6pcm->count_out += frame_increment;
 		n = line6pcm->count_out / frame_factor;
 		line6pcm->count_out -= n * frame_factor;
@@ -106,25 +110,36 @@ static int submit_audio_out_urb(struct snd_pcm_substream *substream)
 	} else {
 		if (line6pcm->pos_out + urb_frames > runtime->buffer_size) {
 			/*
-				The transferred area goes over buffer boundary,
-				copy the data to the temp buffer.
-			*/
+			   The transferred area goes over buffer boundary,
+			   copy the data to the temp buffer.
+			 */
 			int len;
 			len = runtime->buffer_size - line6pcm->pos_out;
 			urb_out->transfer_buffer = line6pcm->wrap_out;
 
 			if (len > 0) {
-				memcpy(line6pcm->wrap_out, runtime->dma_area + line6pcm->pos_out * bytes_per_frame, len * bytes_per_frame);
-				memcpy(line6pcm->wrap_out + len * bytes_per_frame, runtime->dma_area, (urb_frames - len) * bytes_per_frame);
-			} else
-				dev_err(s2m(substream), "driver bug: len = %d\n", len);  /* this is somewhat paranoid */
+				memcpy(line6pcm->wrap_out,
+				       runtime->dma_area +
+				       line6pcm->pos_out * bytes_per_frame,
+				       len * bytes_per_frame);
+				memcpy(line6pcm->wrap_out +
+				       len * bytes_per_frame, runtime->dma_area,
+				       (urb_frames - len) * bytes_per_frame);
+			} else {
+				/* this is somewhat paranoid */
+				dev_err(s2m(substream),
+					"driver bug: len = %d\n", len);
+			}
 		} else {
 			/* set the buffer pointer */
-			urb_out->transfer_buffer = runtime->dma_area + line6pcm->pos_out * bytes_per_frame;
+			urb_out->transfer_buffer =
+			    runtime->dma_area +
+			    line6pcm->pos_out * bytes_per_frame;
 		}
 	}
 
-	if ((line6pcm->pos_out += urb_frames) >= runtime->buffer_size)
+	line6pcm->pos_out += urb_frames;
+	if (line6pcm->pos_out >= runtime->buffer_size)
 		line6pcm->pos_out -= runtime->buffer_size;
 
 	urb_out->transfer_buffer_length = urb_size;
@@ -133,15 +148,19 @@ static int submit_audio_out_urb(struct snd_pcm_substream *substream)
 
 #if DO_DUMP_PCM_SEND
 	for (i = 0; i < LINE6_ISO_PACKETS; ++i) {
-		struct usb_iso_packet_descriptor *fout = &urb_out->iso_frame_desc[i];
-		line6_write_hexdump(line6pcm->line6, 'P', urb_out->transfer_buffer + fout->offset, fout->length);
+		struct usb_iso_packet_descriptor *fout =
+		    &urb_out->iso_frame_desc[i];
+		line6_write_hexdump(line6pcm->line6, 'P',
+				    urb_out->transfer_buffer + fout->offset,
+				    fout->length);
 	}
 #endif
 
 	if (usb_submit_urb(urb_out, GFP_ATOMIC) == 0)
 		set_bit(index, &line6pcm->active_urb_out);
 	else
-		dev_err(s2m(substream), "URB out #%d submission failed\n", index);
+		dev_err(s2m(substream), "URB out #%d submission failed\n",
+			index);
 
 	spin_unlock_irqrestore(&line6pcm->lock_audio_out, flags);
 	return 0;
@@ -181,7 +200,7 @@ static void unlink_audio_out_urbs(struct snd_line6_pcm *line6pcm)
 }
 
 /*
-	Wait until unlinking of all currently active playback URBs has been finished.
+   Wait until unlinking of all currently active playback URBs has been finished.
 */
 static void wait_clear_audio_out_urbs(struct snd_line6_pcm *line6pcm)
 {
@@ -224,7 +243,8 @@ static void audio_out_callback(struct urb *urb)
 	int i, index, length = 0, shutdown = 0;
 	unsigned long flags;
 
-	struct snd_pcm_substream *substream = (struct snd_pcm_substream *)urb->context;
+	struct snd_pcm_substream *substream =
+	    (struct snd_pcm_substream *)urb->context;
 	struct snd_line6_pcm *line6pcm = snd_pcm_substream_chip(substream);
 	struct snd_pcm_runtime *runtime = substream->runtime;
 
@@ -234,13 +254,14 @@ static void audio_out_callback(struct urb *urb)
 			break;
 
 	if (index < 0)
-		return;  /* URB has been unlinked asynchronously */
+		return;		/* URB has been unlinked asynchronously */
 
 	for (i = LINE6_ISO_PACKETS; i--;)
 		length += urb->iso_frame_desc[i].length;
 
 	spin_lock_irqsave(&line6pcm->lock_audio_out, flags);
-	line6pcm->pos_out_done += length / line6pcm->properties->bytes_per_frame;
+	line6pcm->pos_out_done +=
+	    length / line6pcm->properties->bytes_per_frame;
 
 	if (line6pcm->pos_out_done >= runtime->buffer_size)
 		line6pcm->pos_out_done -= runtime->buffer_size;
@@ -261,7 +282,8 @@ static void audio_out_callback(struct urb *urb)
 	if (!shutdown) {
 		submit_audio_out_urb(substream);
 
-		if ((line6pcm->bytes_out += length) >= line6pcm->period_out) {
+		line6pcm->bytes_out += length;
+		if (line6pcm->bytes_out >= line6pcm->period_out) {
 			line6pcm->bytes_out -= line6pcm->period_out;
 			snd_pcm_period_elapsed(substream);
 		}
@@ -276,7 +298,8 @@ static int snd_line6_playback_open(struct snd_pcm_substream *substream)
 	struct snd_line6_pcm *line6pcm = snd_pcm_substream_chip(substream);
 
 	err = snd_pcm_hw_constraint_ratdens(runtime, 0, SNDRV_PCM_HW_PARAM_RATE,
-					    (&line6pcm->properties->snd_line6_rates));
+					    (&line6pcm->properties->
+					     snd_line6_rates));
 	if (err < 0)
 		return err;
 
@@ -291,7 +314,8 @@ static int snd_line6_playback_close(struct snd_pcm_substream *substream)
 }
 
 /* hw_params playback callback */
-static int snd_line6_playback_hw_params(struct snd_pcm_substream *substream, struct snd_pcm_hw_params *hw_params)
+static int snd_line6_playback_hw_params(struct snd_pcm_substream *substream,
+					struct snd_pcm_hw_params *hw_params)
 {
 	int ret;
 	struct snd_line6_pcm *line6pcm = snd_pcm_substream_chip(substream);
@@ -349,7 +373,8 @@ int snd_line6_playback_trigger(struct snd_pcm_substream *substream, int cmd)
 			err = submit_audio_out_all_urbs(substream);
 
 			if (err < 0) {
-				clear_bit(BIT_RUNNING_PLAYBACK, &line6pcm->flags);
+				clear_bit(BIT_RUNNING_PLAYBACK,
+					  &line6pcm->flags);
 				return err;
 			}
 		}
@@ -387,14 +412,14 @@ snd_line6_playback_pointer(struct snd_pcm_substream *substream)
 
 /* playback operators */
 struct snd_pcm_ops snd_line6_playback_ops = {
-	.open =        snd_line6_playback_open,
-	.close =       snd_line6_playback_close,
-	.ioctl =       snd_pcm_lib_ioctl,
-	.hw_params =   snd_line6_playback_hw_params,
-	.hw_free =     snd_line6_playback_hw_free,
-	.prepare =     snd_line6_prepare,
-	.trigger =     snd_line6_trigger,
-	.pointer =     snd_line6_playback_pointer,
+	.open = snd_line6_playback_open,
+	.close = snd_line6_playback_close,
+	.ioctl = snd_pcm_lib_ioctl,
+	.hw_params = snd_line6_playback_hw_params,
+	.hw_free = snd_line6_playback_hw_free,
+	.prepare = snd_line6_prepare,
+	.trigger = snd_line6_trigger,
+	.pointer = snd_line6_playback_pointer,
 };
 
 int create_audio_out_urbs(struct snd_line6_pcm *line6pcm)
@@ -406,7 +431,8 @@ int create_audio_out_urbs(struct snd_line6_pcm *line6pcm)
 		struct urb *urb;
 
 		/* URB for audio out: */
-		urb = line6pcm->urb_audio_out[i] = usb_alloc_urb(LINE6_ISO_PACKETS, GFP_KERNEL);
+		urb = line6pcm->urb_audio_out[i] =
+		    usb_alloc_urb(LINE6_ISO_PACKETS, GFP_KERNEL);
 
 		if (urb == NULL) {
 			dev_err(line6pcm->line6->ifcdev, "Out of memory\n");
@@ -414,7 +440,10 @@ int create_audio_out_urbs(struct snd_line6_pcm *line6pcm)
 		}
 
 		urb->dev = line6pcm->line6->usbdev;
-		urb->pipe = usb_sndisocpipe(line6pcm->line6->usbdev, line6pcm->ep_audio_write & USB_ENDPOINT_NUMBER_MASK);
+		urb->pipe =
+		    usb_sndisocpipe(line6pcm->line6->usbdev,
+				    line6pcm->
+				    ep_audio_write & USB_ENDPOINT_NUMBER_MASK);
 		urb->transfer_flags = URB_ISO_ASAP;
 		urb->start_frame = -1;
 		urb->number_of_packets = LINE6_ISO_PACKETS;
diff --git a/drivers/staging/line6/pod.c b/drivers/staging/line6/pod.c
index 4c5b9d584000..685c529950eb 100644
--- a/drivers/staging/line6/pod.c
+++ b/drivers/staging/line6/pod.c
@@ -422,13 +422,21 @@ void pod_transmit_parameter(struct usb_line6_pod *pod, int param, int value)
 /*
 	Resolve value to memory location.
 */
-static void pod_resolve(const char *buf, short block0, short block1, unsigned char *location)
+static int pod_resolve(const char *buf, short block0, short block1, unsigned char *location)
 {
-	int value = simple_strtoul(buf, NULL, 10);
-	short block = (value < 0x40) ? block0 : block1;
+	unsigned long value;
+	short block;
+	int ret;
+
+	ret = strict_strtoul(buf, 10, &value);
+	if (ret)
+		return ret;
+
+	block = (value < 0x40) ? block0 : block1;
 	value &= 0x3f;
 	location[0] = block >> 7;
 	location[1] = value | (block & 0x7f);
+	return 0;
 }
 
 /*
@@ -438,14 +446,20 @@ static ssize_t pod_send_store_command(struct device *dev, const char *buf, size_
 {
 	struct usb_interface *interface = to_usb_interface(dev);
 	struct usb_line6_pod *pod = usb_get_intfdata(interface);
-
+	int ret;
 	int size = 3 + sizeof(pod->prog_data_buf);
 	char *sysex = pod_alloc_sysex_buffer(pod, POD_SYSEX_STORE, size);
+
 	if (!sysex)
 		return 0;
 
 	sysex[SYSEX_DATA_OFS] = 5;  /* see pod_dump() */
-	pod_resolve(buf, block0, block1, sysex + SYSEX_DATA_OFS + 1);
+	ret = pod_resolve(buf, block0, block1, sysex + SYSEX_DATA_OFS + 1);
+	if (ret) {
+		kfree(sysex);
+		return ret;
+	}
+
 	memcpy(sysex + SYSEX_DATA_OFS + 3, &pod->prog_data_buf, sizeof(pod->prog_data_buf));
 
 	line6_send_sysex_message(&pod->line6, sysex, size);
@@ -461,13 +475,18 @@ static ssize_t pod_send_retrieve_command(struct device *dev, const char *buf, si
 {
 	struct usb_interface *interface = to_usb_interface(dev);
 	struct usb_line6_pod *pod = usb_get_intfdata(interface);
+	int ret;
 	int size = 4;
 	char *sysex = pod_alloc_sysex_buffer(pod, POD_SYSEX_DUMPMEM, size);
 
 	if (!sysex)
 		return 0;
 
-	pod_resolve(buf, block0, block1, sysex + SYSEX_DATA_OFS);
+	ret = pod_resolve(buf, block0, block1, sysex + SYSEX_DATA_OFS);
+	if (ret) {
+		kfree(sysex);
+		return ret;
+	}
 	sysex[SYSEX_DATA_OFS + 2] = 0;
 	sysex[SYSEX_DATA_OFS + 3] = 0;
 	line6_dump_started(&pod->dumpreq, POD_DUMP_MEMORY);
@@ -526,7 +545,13 @@ static ssize_t pod_set_channel(struct device *dev,
 {
 	struct usb_interface *interface = to_usb_interface(dev);
 	struct usb_line6_pod *pod = usb_get_intfdata(interface);
-	int value = simple_strtoul(buf, NULL, 10);
+	unsigned long value;
+	int ret;
+
+	ret = strict_strtoul(buf, 10, &value);
+	if (ret)
+		return ret;
+
 	pod_send_channel(pod, value);
 	return count;
 }
@@ -579,7 +604,7 @@ static ssize_t pod_set_dump(struct device *dev, struct device_attribute *attr,
 
 	if (count != sizeof(pod->prog_data)) {
 		dev_err(pod->line6.ifcdev,
-			"data block must be exactly %d bytes\n",
+			"data block must be exactly %zu bytes\n",
 			sizeof(pod->prog_data));
 		return -EINVAL;
 	}
@@ -645,6 +670,8 @@ static ssize_t pod_set_system_param(struct usb_line6_pod *pod, const char *buf,
 	char *sysex;
 	static const int size = 5;
 	unsigned short value;
+	unsigned long result;
+	int ret;
 
 	if (((pod->prog_data.control[POD_tuner] & 0x40) == 0) && tuner)
 		return -EINVAL;
@@ -653,7 +680,12 @@ static ssize_t pod_set_system_param(struct usb_line6_pod *pod, const char *buf,
 	sysex = pod_alloc_sysex_buffer(pod, POD_SYSEX_SYSTEM, size);
 	if (!sysex)
 		return 0;
-	value = simple_strtoul(buf, NULL, 10) & mask;
+
+	ret = strict_strtoul(buf, 10, &result);
+	if (ret)
+		return ret;
+
+	value = result & mask;
 	sysex[SYSEX_DATA_OFS] = code;
 	sysex[SYSEX_DATA_OFS + 1] = (value >> 12) & 0x0f;
 	sysex[SYSEX_DATA_OFS + 2] = (value >>  8) & 0x0f;
@@ -691,7 +723,7 @@ static ssize_t pod_set_dump_buf(struct device *dev,
 
 	if (count != sizeof(pod->prog_data)) {
 		dev_err(pod->line6.ifcdev,
-						"data block must be exactly %d bytes\n",
+						"data block must be exactly %zu bytes\n",
 						sizeof(pod->prog_data));
 		return -EINVAL;
 	}
@@ -812,7 +844,13 @@ static ssize_t pod_set_midi_postprocess(struct device *dev,
 {
 	struct usb_interface *interface = to_usb_interface(dev);
 	struct usb_line6_pod *pod = usb_get_intfdata(interface);
-	int value = simple_strtoul(buf, NULL, 10);
+	unsigned long value;
+	int ret;
+
+	ret = strict_strtoul(buf, 10, &value);
+	if (ret)
+		return ret;
+
 	pod->midi_postprocess = value ? 1 : 0;
 	return count;
 }
diff --git a/drivers/staging/line6/toneport.c b/drivers/staging/line6/toneport.c
index eaa1229002aa..e6770ea17936 100644
--- a/drivers/staging/line6/toneport.c
+++ b/drivers/staging/line6/toneport.c
@@ -17,10 +17,8 @@
 #include "playback.h"
 #include "toneport.h"
 
-
 static int toneport_send_cmd(struct usb_device *usbdev, int cmd1, int cmd2);
 
-
 static struct snd_ratden toneport_ratden = {
 	.num_min = 44100,
 	.num_max = 44100,
@@ -29,47 +27,44 @@ static struct snd_ratden toneport_ratden = {
 };
 
 static struct line6_pcm_properties toneport_pcm_properties = {
-  .snd_line6_playback_hw = {
-		.info = (SNDRV_PCM_INFO_MMAP |
-						 SNDRV_PCM_INFO_INTERLEAVED |
-						 SNDRV_PCM_INFO_BLOCK_TRANSFER |
-						 SNDRV_PCM_INFO_MMAP_VALID |
-						 SNDRV_PCM_INFO_PAUSE |
-						 SNDRV_PCM_INFO_SYNC_START),
-		.formats =          SNDRV_PCM_FMTBIT_S16_LE,
-		.rates =            SNDRV_PCM_RATE_KNOT,
-		.rate_min =         44100,
-		.rate_max =         44100,
-		.channels_min =     2,
-		.channels_max =     2,
-		.buffer_bytes_max = 60000,
-		.period_bytes_min = 180 * 4,
-		.period_bytes_max = 8192,
-		.periods_min =      1,
-		.periods_max =      1024
-	},
-  .snd_line6_capture_hw = {
-		.info = (SNDRV_PCM_INFO_MMAP |
-						 SNDRV_PCM_INFO_INTERLEAVED |
-						 SNDRV_PCM_INFO_BLOCK_TRANSFER |
-						 SNDRV_PCM_INFO_MMAP_VALID |
-						 SNDRV_PCM_INFO_SYNC_START),
-		.formats =          SNDRV_PCM_FMTBIT_S16_LE,
-		.rates =            SNDRV_PCM_RATE_KNOT,
-		.rate_min =         44100,
-		.rate_max =         44100,
-		.channels_min =     2,
-		.channels_max =     2,
-		.buffer_bytes_max = 60000,
-		.period_bytes_min = 188 * 4,
-		.period_bytes_max = 8192,
-		.periods_min =      1,
-		.periods_max =      1024
-	},
+	.snd_line6_playback_hw = {
+				  .info = (SNDRV_PCM_INFO_MMAP |
+					   SNDRV_PCM_INFO_INTERLEAVED |
+					   SNDRV_PCM_INFO_BLOCK_TRANSFER |
+					   SNDRV_PCM_INFO_MMAP_VALID |
+					   SNDRV_PCM_INFO_PAUSE |
+					   SNDRV_PCM_INFO_SYNC_START),
+				  .formats = SNDRV_PCM_FMTBIT_S16_LE,
+				  .rates = SNDRV_PCM_RATE_KNOT,
+				  .rate_min = 44100,
+				  .rate_max = 44100,
+				  .channels_min = 2,
+				  .channels_max = 2,
+				  .buffer_bytes_max = 60000,
+				  .period_bytes_min = 180 * 4,
+				  .period_bytes_max = 8192,
+				  .periods_min = 1,
+				  .periods_max = 1024},
+	.snd_line6_capture_hw = {
+				 .info = (SNDRV_PCM_INFO_MMAP |
+					  SNDRV_PCM_INFO_INTERLEAVED |
+					  SNDRV_PCM_INFO_BLOCK_TRANSFER |
+					  SNDRV_PCM_INFO_MMAP_VALID |
+					  SNDRV_PCM_INFO_SYNC_START),
+				 .formats = SNDRV_PCM_FMTBIT_S16_LE,
+				 .rates = SNDRV_PCM_RATE_KNOT,
+				 .rate_min = 44100,
+				 .rate_max = 44100,
+				 .channels_min = 2,
+				 .channels_max = 2,
+				 .buffer_bytes_max = 60000,
+				 .period_bytes_min = 188 * 4,
+				 .period_bytes_max = 8192,
+				 .periods_min = 1,
+				 .periods_max = 1024},
 	.snd_line6_rates = {
-		.nrats = 1,
-		.rats = &toneport_ratden
-	},
+			    .nrats = 1,
+			    .rats = &toneport_ratden},
 	.bytes_per_frame = 4
 };
 
@@ -101,8 +96,14 @@ static ssize_t toneport_set_led_red(struct device *dev,
 				    struct device_attribute *attr,
 				    const char *buf, size_t count)
 {
-	char *c;
-	led_red = simple_strtol(buf, &c, 10);
+	int retval;
+	long value;
+
+	retval = strict_strtol(buf, 10, &value);
+	if (retval)
+		return retval;
+
+	led_red = value;
 	toneport_update_led(dev);
 	return count;
 }
@@ -111,15 +112,22 @@ static ssize_t toneport_set_led_green(struct device *dev,
 				      struct device_attribute *attr,
 				      const char *buf, size_t count)
 {
-	char *c;
-	led_green = simple_strtol(buf, &c, 10);
+	int retval;
+	long value;
+
+	retval = strict_strtol(buf, 10, &value);
+	if (retval)
+		return retval;
+
+	led_green = value;
 	toneport_update_led(dev);
 	return count;
 }
 
-static DEVICE_ATTR(led_red, S_IWUGO | S_IRUGO, line6_nop_read, toneport_set_led_red);
-static DEVICE_ATTR(led_green, S_IWUGO | S_IRUGO, line6_nop_read, toneport_set_led_green);
-
+static DEVICE_ATTR(led_red, S_IWUGO | S_IRUGO, line6_nop_read,
+		   toneport_set_led_red);
+static DEVICE_ATTR(led_green, S_IWUGO | S_IRUGO, line6_nop_read,
+		   toneport_set_led_green);
 
 static int toneport_send_cmd(struct usb_device *usbdev, int cmd1, int cmd2)
 {
@@ -196,16 +204,18 @@ int toneport_init(struct usb_interface *interface,
 	line6_write_data(line6, 0x80c6, &ticks, 4);
 
 	/*
-	seems to work without the first two...
-	*/
+	   seems to work without the first two...
+	 */
 	/* toneport_send_cmd(usbdev, 0x0201, 0x0002); */
 	/* toneport_send_cmd(usbdev, 0x0801, 0x0000); */
 	/* only one that works for me; on GP, TP might be different? */
 	toneport_send_cmd(usbdev, 0x0301, 0x0000);
 
 	if (usbdev->descriptor.idProduct != LINE6_DEVID_GUITARPORT) {
-		CHECK_RETURN(device_create_file(&interface->dev, &dev_attr_led_red));
-		CHECK_RETURN(device_create_file(&interface->dev, &dev_attr_led_green));
+		CHECK_RETURN(device_create_file
+			     (&interface->dev, &dev_attr_led_red));
+		CHECK_RETURN(device_create_file
+			     (&interface->dev, &dev_attr_led_green));
 		toneport_update_led(&usbdev->dev);
 	}
 
@@ -223,7 +233,8 @@ void toneport_disconnect(struct usb_interface *interface)
 		return;
 	toneport = usb_get_intfdata(interface);
 
-	if (toneport->line6.usbdev->descriptor.idProduct != LINE6_DEVID_GUITARPORT) {
+	if (toneport->line6.usbdev->descriptor.idProduct !=
+	    LINE6_DEVID_GUITARPORT) {
 		device_remove_file(&interface->dev, &dev_attr_led_red);
 		device_remove_file(&interface->dev, &dev_attr_led_green);
 	}
diff --git a/drivers/staging/line6/variax.c b/drivers/staging/line6/variax.c
index f9d96984733a..48d834b0fa1b 100644
--- a/drivers/staging/line6/variax.c
+++ b/drivers/staging/line6/variax.c
@@ -184,7 +184,12 @@ static ssize_t variax_set_volume(struct device *dev,
 				 const char *buf, size_t count)
 {
 	struct usb_line6_variax *variax = usb_get_intfdata(to_usb_interface(dev));
-	int value = simple_strtoul(buf, NULL, 10);
+	unsigned long value;
+	int ret;
+
+	ret = strict_strtoul(buf, 10, &value);
+	if (ret)
+		return ret;
 
 	if (line6_transmit_parameter(&variax->line6, VARIAXMIDI_volume,
 				     value) == 0)
@@ -211,7 +216,12 @@ static ssize_t variax_set_model(struct device *dev,
 				const char *buf, size_t count)
 {
 	struct usb_line6_variax *variax = usb_get_intfdata(to_usb_interface(dev));
-	int value = simple_strtoul(buf, NULL, 10);
+	unsigned long value;
+	int ret;
+
+	ret = strict_strtoul(buf, 10, &value);
+	if (ret)
+		return ret;
 
 	if (line6_send_program(&variax->line6, value) == 0)
 		variax->model = value;
@@ -237,8 +247,14 @@ static ssize_t variax_set_active(struct device *dev,
 				 const char *buf, size_t count)
 {
 	struct usb_line6_variax *variax = usb_get_intfdata(to_usb_interface(dev));
-	int value = simple_strtoul(buf, NULL, 10) ? 1 : 0;
-	variax->buffer_activate[VARIAX_OFFSET_ACTIVATE] = value;
+	unsigned long value;
+	int ret;
+
+	ret = strict_strtoul(buf, 10, &value);
+	if (ret)
+		return ret;
+
+	variax->buffer_activate[VARIAX_OFFSET_ACTIVATE] = value ? 1: 0;
 	line6_send_raw_message_async(&variax->line6, variax->buffer_activate,
 				     sizeof(variax_activate));
 	return count;
@@ -262,7 +278,12 @@ static ssize_t variax_set_tone(struct device *dev,
 			       const char *buf, size_t count)
 {
 	struct usb_line6_variax *variax = usb_get_intfdata(to_usb_interface(dev));
-	int value = simple_strtoul(buf, NULL, 10);
+	unsigned long value;
+	int ret;
+
+	ret = strict_strtoul(buf, 10, &value);
+	if (ret)
+		return ret;
 
 	if (line6_transmit_parameter(&variax->line6, VARIAXMIDI_tone,
 				     value) == 0)
diff --git a/drivers/staging/octeon/Kconfig b/drivers/staging/octeon/Kconfig
index 536e2382de54..638ad6b35891 100644
--- a/drivers/staging/octeon/Kconfig
+++ b/drivers/staging/octeon/Kconfig
@@ -1,7 +1,8 @@
 config OCTEON_ETHERNET
 	tristate "Cavium Networks Octeon Ethernet support"
 	depends on CPU_CAVIUM_OCTEON
-	select MII
+	select PHYLIB
+	select MDIO_OCTEON
 	help
 	  This driver supports the builtin ethernet ports on Cavium
 	  Networks' products in the Octeon family. This driver supports the
diff --git a/drivers/staging/octeon/cvmx-pow.h b/drivers/staging/octeon/cvmx-pow.h
index c5d66f272b0d..bf9e069a898c 100644
--- a/drivers/staging/octeon/cvmx-pow.h
+++ b/drivers/staging/octeon/cvmx-pow.h
@@ -1959,7 +1959,7 @@ static inline uint32_t cvmx_pow_tag_get_hw_bits(uint64_t tag)
  * @buffer_size:
  *               The size of the supplied buffer
  *
- * Returns Zero on sucess, negative on failure
+ * Returns Zero on success, negative on failure
  */
 extern int cvmx_pow_capture(void *buffer, int buffer_size);
 
diff --git a/drivers/staging/octeon/ethernet-mdio.c b/drivers/staging/octeon/ethernet-mdio.c
index 31a58e508924..05a5cc0f43ed 100644
--- a/drivers/staging/octeon/ethernet-mdio.c
+++ b/drivers/staging/octeon/ethernet-mdio.c
@@ -26,7 +26,8 @@
 **********************************************************************/
 #include <linux/kernel.h>
 #include <linux/ethtool.h>
-#include <linux/mii.h>
+#include <linux/phy.h>
+
 #include <net/dst.h>
 
 #include <asm/octeon/octeon.h>
@@ -34,86 +35,12 @@
 #include "ethernet-defines.h"
 #include "octeon-ethernet.h"
 #include "ethernet-mdio.h"
+#include "ethernet-util.h"
 
 #include "cvmx-helper-board.h"
 
 #include "cvmx-smix-defs.h"
 
-DECLARE_MUTEX(mdio_sem);
-
-/**
- * Perform an MII read. Called by the generic MII routines
- *
- * @dev:      Device to perform read for
- * @phy_id:   The MII phy id
- * @location: Register location to read
- * Returns Result from the read or zero on failure
- */
-static int cvm_oct_mdio_read(struct net_device *dev, int phy_id, int location)
-{
-	union cvmx_smix_cmd smi_cmd;
-	union cvmx_smix_rd_dat smi_rd;
-
-	smi_cmd.u64 = 0;
-	smi_cmd.s.phy_op = 1;
-	smi_cmd.s.phy_adr = phy_id;
-	smi_cmd.s.reg_adr = location;
-	cvmx_write_csr(CVMX_SMIX_CMD(0), smi_cmd.u64);
-
-	do {
-		if (!in_interrupt())
-			yield();
-		smi_rd.u64 = cvmx_read_csr(CVMX_SMIX_RD_DAT(0));
-	} while (smi_rd.s.pending);
-
-	if (smi_rd.s.val)
-		return smi_rd.s.dat;
-	else
-		return 0;
-}
-
-static int cvm_oct_mdio_dummy_read(struct net_device *dev, int phy_id,
-				   int location)
-{
-	return 0xffff;
-}
-
-/**
- * Perform an MII write. Called by the generic MII routines
- *
- * @dev:      Device to perform write for
- * @phy_id:   The MII phy id
- * @location: Register location to write
- * @val:      Value to write
- */
-static void cvm_oct_mdio_write(struct net_device *dev, int phy_id, int location,
-			       int val)
-{
-	union cvmx_smix_cmd smi_cmd;
-	union cvmx_smix_wr_dat smi_wr;
-
-	smi_wr.u64 = 0;
-	smi_wr.s.dat = val;
-	cvmx_write_csr(CVMX_SMIX_WR_DAT(0), smi_wr.u64);
-
-	smi_cmd.u64 = 0;
-	smi_cmd.s.phy_op = 0;
-	smi_cmd.s.phy_adr = phy_id;
-	smi_cmd.s.reg_adr = location;
-	cvmx_write_csr(CVMX_SMIX_CMD(0), smi_cmd.u64);
-
-	do {
-		if (!in_interrupt())
-			yield();
-		smi_wr.u64 = cvmx_read_csr(CVMX_SMIX_WR_DAT(0));
-	} while (smi_wr.s.pending);
-}
-
-static void cvm_oct_mdio_dummy_write(struct net_device *dev, int phy_id,
-				     int location, int val)
-{
-}
-
 static void cvm_oct_get_drvinfo(struct net_device *dev,
 				struct ethtool_drvinfo *info)
 {
@@ -125,49 +52,37 @@ static void cvm_oct_get_drvinfo(struct net_device *dev,
 static int cvm_oct_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
 {
 	struct octeon_ethernet *priv = netdev_priv(dev);
-	int ret;
 
-	down(&mdio_sem);
-	ret = mii_ethtool_gset(&priv->mii_info, cmd);
-	up(&mdio_sem);
+	if (priv->phydev)
+		return phy_ethtool_gset(priv->phydev, cmd);
 
-	return ret;
+	return -EINVAL;
 }
 
 static int cvm_oct_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
 {
 	struct octeon_ethernet *priv = netdev_priv(dev);
-	int ret;
 
-	down(&mdio_sem);
-	ret = mii_ethtool_sset(&priv->mii_info, cmd);
-	up(&mdio_sem);
+	if (!capable(CAP_NET_ADMIN))
+		return -EPERM;
+
+	if (priv->phydev)
+		return phy_ethtool_sset(priv->phydev, cmd);
 
-	return ret;
+	return -EINVAL;
 }
 
 static int cvm_oct_nway_reset(struct net_device *dev)
 {
 	struct octeon_ethernet *priv = netdev_priv(dev);
-	int ret;
 
-	down(&mdio_sem);
-	ret = mii_nway_restart(&priv->mii_info);
-	up(&mdio_sem);
+	if (!capable(CAP_NET_ADMIN))
+		return -EPERM;
 
-	return ret;
-}
+	if (priv->phydev)
+		return phy_start_aneg(priv->phydev);
 
-static u32 cvm_oct_get_link(struct net_device *dev)
-{
-	struct octeon_ethernet *priv = netdev_priv(dev);
-	u32 ret;
-
-	down(&mdio_sem);
-	ret = mii_link_ok(&priv->mii_info);
-	up(&mdio_sem);
-
-	return ret;
+	return -EINVAL;
 }
 
 const struct ethtool_ops cvm_oct_ethtool_ops = {
@@ -175,7 +90,7 @@ const struct ethtool_ops cvm_oct_ethtool_ops = {
 	.get_settings = cvm_oct_get_settings,
 	.set_settings = cvm_oct_set_settings,
 	.nway_reset = cvm_oct_nway_reset,
-	.get_link = cvm_oct_get_link,
+	.get_link = ethtool_op_get_link,
 	.get_sg = ethtool_op_get_sg,
 	.get_tx_csum = ethtool_op_get_tx_csum,
 };
@@ -191,41 +106,78 @@ const struct ethtool_ops cvm_oct_ethtool_ops = {
 int cvm_oct_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
 {
 	struct octeon_ethernet *priv = netdev_priv(dev);
-	struct mii_ioctl_data *data = if_mii(rq);
-	unsigned int duplex_chg;
-	int ret;
 
-	down(&mdio_sem);
-	ret = generic_mii_ioctl(&priv->mii_info, data, cmd, &duplex_chg);
-	up(&mdio_sem);
+	if (!netif_running(dev))
+		return -EINVAL;
+
+	if (!priv->phydev)
+		return -EINVAL;
+
+	return phy_mii_ioctl(priv->phydev, if_mii(rq), cmd);
+}
 
-	return ret;
+static void cvm_oct_adjust_link(struct net_device *dev)
+{
+	struct octeon_ethernet *priv = netdev_priv(dev);
+	cvmx_helper_link_info_t link_info;
+
+	if (priv->last_link != priv->phydev->link) {
+		priv->last_link = priv->phydev->link;
+		link_info.u64 = 0;
+		link_info.s.link_up = priv->last_link ? 1 : 0;
+		link_info.s.full_duplex = priv->phydev->duplex ? 1 : 0;
+		link_info.s.speed = priv->phydev->speed;
+		cvmx_helper_link_set( priv->port, link_info);
+		if (priv->last_link) {
+			netif_carrier_on(dev);
+			if (priv->queue != -1)
+				DEBUGPRINT("%s: %u Mbps %s duplex, "
+					   "port %2d, queue %2d\n",
+					   dev->name, priv->phydev->speed,
+					   priv->phydev->duplex ?
+						"Full" : "Half",
+					   priv->port, priv->queue);
+			else
+				DEBUGPRINT("%s: %u Mbps %s duplex, "
+					   "port %2d, POW\n",
+					   dev->name, priv->phydev->speed,
+					   priv->phydev->duplex ?
+						"Full" : "Half",
+					   priv->port);
+		} else {
+			netif_carrier_off(dev);
+			DEBUGPRINT("%s: Link down\n", dev->name);
+		}
+	}
 }
 
+
 /**
- * Setup the MDIO device structures
+ * Setup the PHY
  *
  * @dev:    Device to setup
  *
  * Returns Zero on success, negative on failure
  */
-int cvm_oct_mdio_setup_device(struct net_device *dev)
+int cvm_oct_phy_setup_device(struct net_device *dev)
 {
 	struct octeon_ethernet *priv = netdev_priv(dev);
-	int phy_id = cvmx_helper_board_get_mii_address(priv->port);
-	if (phy_id != -1) {
-		priv->mii_info.dev = dev;
-		priv->mii_info.phy_id = phy_id;
-		priv->mii_info.phy_id_mask = 0xff;
-		priv->mii_info.supports_gmii = 1;
-		priv->mii_info.reg_num_mask = 0x1f;
-		priv->mii_info.mdio_read = cvm_oct_mdio_read;
-		priv->mii_info.mdio_write = cvm_oct_mdio_write;
-	} else {
-		/* Supply dummy MDIO routines so the kernel won't crash
-		   if the user tries to read them */
-		priv->mii_info.mdio_read = cvm_oct_mdio_dummy_read;
-		priv->mii_info.mdio_write = cvm_oct_mdio_dummy_write;
+
+	int phy_addr = cvmx_helper_board_get_mii_address(priv->port);
+	if (phy_addr != -1) {
+		char phy_id[20];
+
+		snprintf(phy_id, sizeof(phy_id), PHY_ID_FMT, "0", phy_addr);
+
+		priv->phydev = phy_connect(dev, phy_id, cvm_oct_adjust_link, 0,
+					PHY_INTERFACE_MODE_GMII);
+
+		if (IS_ERR(priv->phydev)) {
+			priv->phydev = NULL;
+			return -1;
+		}
+		priv->last_link = 0;
+		phy_start_aneg(priv->phydev);
 	}
 	return 0;
 }
diff --git a/drivers/staging/octeon/ethernet-mdio.h b/drivers/staging/octeon/ethernet-mdio.h
index b3328aeec2df..55d0614a7cd9 100644
--- a/drivers/staging/octeon/ethernet-mdio.h
+++ b/drivers/staging/octeon/ethernet-mdio.h
@@ -43,4 +43,4 @@
 
 extern const struct ethtool_ops cvm_oct_ethtool_ops;
 int cvm_oct_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
-int cvm_oct_mdio_setup_device(struct net_device *dev);
+int cvm_oct_phy_setup_device(struct net_device *dev);
diff --git a/drivers/staging/octeon/ethernet-proc.c b/drivers/staging/octeon/ethernet-proc.c
index 8fa88fc419b7..16308d484d3b 100644
--- a/drivers/staging/octeon/ethernet-proc.c
+++ b/drivers/staging/octeon/ethernet-proc.c
@@ -25,7 +25,6 @@
  * Contact Cavium Networks for more information
 **********************************************************************/
 #include <linux/kernel.h>
-#include <linux/mii.h>
 #include <linux/seq_file.h>
 #include <linux/proc_fs.h>
 #include <net/dst.h>
@@ -38,112 +37,6 @@
 #include "cvmx-helper.h"
 #include "cvmx-pip.h"
 
-static unsigned long long cvm_oct_stats_read_switch(struct net_device *dev,
-						    int phy_id, int offset)
-{
-	struct octeon_ethernet *priv = netdev_priv(dev);
-
-	priv->mii_info.mdio_write(dev, phy_id, 0x1d, 0xcc00 | offset);
-	return ((uint64_t) priv->mii_info.
-		mdio_read(dev, phy_id,
-			  0x1e) << 16) | (uint64_t) priv->mii_info.
-	    mdio_read(dev, phy_id, 0x1f);
-}
-
-static int cvm_oct_stats_switch_show(struct seq_file *m, void *v)
-{
-	static const int ports[] = { 0, 1, 2, 3, 9, -1 };
-	struct net_device *dev = cvm_oct_device[0];
-	int index = 0;
-
-	while (ports[index] != -1) {
-
-		/* Latch port */
-		struct octeon_ethernet *priv = netdev_priv(dev);
-
-		priv->mii_info.mdio_write(dev, 0x1b, 0x1d,
-					  0xdc00 | ports[index]);
-		seq_printf(m, "\nSwitch Port %d\n", ports[index]);
-		seq_printf(m, "InGoodOctets:   %12llu\t"
-			   "OutOctets:      %12llu\t"
-			   "64 Octets:      %12llu\n",
-			   cvm_oct_stats_read_switch(dev, 0x1b,
-						     0x00) |
-			   (cvm_oct_stats_read_switch(dev, 0x1b, 0x01) << 32),
-			   cvm_oct_stats_read_switch(dev, 0x1b,
-						     0x0E) |
-			   (cvm_oct_stats_read_switch(dev, 0x1b, 0x0F) << 32),
-			   cvm_oct_stats_read_switch(dev, 0x1b, 0x08));
-
-		seq_printf(m, "InBadOctets:    %12llu\t"
-			   "OutUnicast:     %12llu\t"
-			   "65-127 Octets:  %12llu\n",
-			   cvm_oct_stats_read_switch(dev, 0x1b, 0x02),
-			   cvm_oct_stats_read_switch(dev, 0x1b, 0x10),
-			   cvm_oct_stats_read_switch(dev, 0x1b, 0x09));
-
-		seq_printf(m, "InUnicast:      %12llu\t"
-			   "OutBroadcasts:  %12llu\t"
-			   "128-255 Octets: %12llu\n",
-			   cvm_oct_stats_read_switch(dev, 0x1b, 0x04),
-			   cvm_oct_stats_read_switch(dev, 0x1b, 0x13),
-			   cvm_oct_stats_read_switch(dev, 0x1b, 0x0A));
-
-		seq_printf(m, "InBroadcasts:   %12llu\t"
-			   "OutMulticasts:  %12llu\t"
-			   "256-511 Octets: %12llu\n",
-			   cvm_oct_stats_read_switch(dev, 0x1b, 0x06),
-			   cvm_oct_stats_read_switch(dev, 0x1b, 0x12),
-			   cvm_oct_stats_read_switch(dev, 0x1b, 0x0B));
-
-		seq_printf(m, "InMulticasts:   %12llu\t"
-			   "OutPause:       %12llu\t"
-			   "512-1023 Octets:%12llu\n",
-			   cvm_oct_stats_read_switch(dev, 0x1b, 0x07),
-			   cvm_oct_stats_read_switch(dev, 0x1b, 0x15),
-			   cvm_oct_stats_read_switch(dev, 0x1b, 0x0C));
-
-		seq_printf(m, "InPause:        %12llu\t"
-			   "Excessive:      %12llu\t"
-			   "1024-Max Octets:%12llu\n",
-			   cvm_oct_stats_read_switch(dev, 0x1b, 0x16),
-			   cvm_oct_stats_read_switch(dev, 0x1b, 0x11),
-			   cvm_oct_stats_read_switch(dev, 0x1b, 0x0D));
-
-		seq_printf(m, "InUndersize:    %12llu\t"
-			   "Collisions:     %12llu\n",
-			   cvm_oct_stats_read_switch(dev, 0x1b, 0x18),
-			   cvm_oct_stats_read_switch(dev, 0x1b, 0x1E));
-
-		seq_printf(m, "InFragments:    %12llu\t"
-			   "Deferred:       %12llu\n",
-			   cvm_oct_stats_read_switch(dev, 0x1b, 0x19),
-			   cvm_oct_stats_read_switch(dev, 0x1b, 0x05));
-
-		seq_printf(m, "InOversize:     %12llu\t"
-			   "Single:         %12llu\n",
-			   cvm_oct_stats_read_switch(dev, 0x1b, 0x1A),
-			   cvm_oct_stats_read_switch(dev, 0x1b, 0x14));
-
-		seq_printf(m, "InJabber:       %12llu\t"
-			   "Multiple:       %12llu\n",
-			   cvm_oct_stats_read_switch(dev, 0x1b, 0x1B),
-			   cvm_oct_stats_read_switch(dev, 0x1b, 0x17));
-
-		seq_printf(m, "In RxErr:       %12llu\t"
-			   "OutFCSErr:      %12llu\n",
-			   cvm_oct_stats_read_switch(dev, 0x1b, 0x1C),
-			   cvm_oct_stats_read_switch(dev, 0x1b, 0x03));
-
-		seq_printf(m, "InFCSErr:       %12llu\t"
-			   "Late:           %12llu\n",
-			   cvm_oct_stats_read_switch(dev, 0x1b, 0x1D),
-			   cvm_oct_stats_read_switch(dev, 0x1b, 0x1F));
-		index++;
-	}
-	return 0;
-}
-
 /**
  * User is reading /proc/octeon_ethernet_stats
  *
@@ -215,11 +108,6 @@ static int cvm_oct_stats_show(struct seq_file *m, void *v)
 		}
 	}
 
-	if (cvm_oct_device[0]) {
-		priv = netdev_priv(cvm_oct_device[0]);
-		if (priv->imode == CVMX_HELPER_INTERFACE_MODE_GMII)
-			cvm_oct_stats_switch_show(m, v);
-	}
 	return 0;
 }
 
diff --git a/drivers/staging/octeon/ethernet-rgmii.c b/drivers/staging/octeon/ethernet-rgmii.c
index 8704133fe127..3820f1ec11d1 100644
--- a/drivers/staging/octeon/ethernet-rgmii.c
+++ b/drivers/staging/octeon/ethernet-rgmii.c
@@ -147,32 +147,36 @@ static void cvm_oct_rgmii_poll(struct net_device *dev)
 		cvmx_write_csr(CVMX_GMXX_RXX_INT_REG(index, interface),
 			       gmxx_rxx_int_reg.u64);
 	}
-
-	link_info = cvmx_helper_link_autoconf(priv->port);
-	priv->link_info = link_info.u64;
+	if (priv->phydev == NULL) {
+		link_info = cvmx_helper_link_autoconf(priv->port);
+		priv->link_info = link_info.u64;
+	}
 	spin_unlock_irqrestore(&global_register_lock, flags);
 
-	/* Tell Linux */
-	if (link_info.s.link_up) {
-
-		if (!netif_carrier_ok(dev))
-			netif_carrier_on(dev);
-		if (priv->queue != -1)
-			DEBUGPRINT
-			    ("%s: %u Mbps %s duplex, port %2d, queue %2d\n",
-			     dev->name, link_info.s.speed,
-			     (link_info.s.full_duplex) ? "Full" : "Half",
-			     priv->port, priv->queue);
-		else
-			DEBUGPRINT("%s: %u Mbps %s duplex, port %2d, POW\n",
-				   dev->name, link_info.s.speed,
-				   (link_info.s.full_duplex) ? "Full" : "Half",
-				   priv->port);
-	} else {
-
-		if (netif_carrier_ok(dev))
-			netif_carrier_off(dev);
-		DEBUGPRINT("%s: Link down\n", dev->name);
+	if (priv->phydev == NULL) {
+		/* Tell core. */
+		if (link_info.s.link_up) {
+			if (!netif_carrier_ok(dev))
+				netif_carrier_on(dev);
+			if (priv->queue != -1)
+				DEBUGPRINT("%s: %u Mbps %s duplex, "
+					   "port %2d, queue %2d\n",
+					   dev->name, link_info.s.speed,
+					   (link_info.s.full_duplex) ?
+						"Full" : "Half",
+					   priv->port, priv->queue);
+			else
+				DEBUGPRINT("%s: %u Mbps %s duplex, "
+					   "port %2d, POW\n",
+					   dev->name, link_info.s.speed,
+					   (link_info.s.full_duplex) ?
+						"Full" : "Half",
+					   priv->port);
+		} else {
+			if (netif_carrier_ok(dev))
+				netif_carrier_off(dev);
+			DEBUGPRINT("%s: Link down\n", dev->name);
+		}
 	}
 }
 
@@ -308,7 +312,7 @@ int cvm_oct_rgmii_init(struct net_device *dev)
 
 	/*
 	 * Due to GMX errata in CN3XXX series chips, it is necessary
-	 * to take the link down immediately whne the PHY changes
+	 * to take the link down immediately when the PHY changes
 	 * state. In order to do this we call the poll function every
 	 * time the RGMII inband status changes.  This may cause
 	 * problems if the PHY doesn't implement inband status
@@ -317,6 +321,8 @@ int cvm_oct_rgmii_init(struct net_device *dev)
 	if (number_rgmii_ports == 0) {
 		r = request_irq(OCTEON_IRQ_RML, cvm_oct_rgmii_rml_interrupt,
 				IRQF_SHARED, "RGMII", &number_rgmii_ports);
+		if (r != 0)
+			return r;
 	}
 	number_rgmii_ports++;
 
diff --git a/drivers/staging/octeon/ethernet-sgmii.c b/drivers/staging/octeon/ethernet-sgmii.c
index 2b54996bd85d..6061d01eca2d 100644
--- a/drivers/staging/octeon/ethernet-sgmii.c
+++ b/drivers/staging/octeon/ethernet-sgmii.c
@@ -113,7 +113,7 @@ int cvm_oct_sgmii_init(struct net_device *dev)
 	struct octeon_ethernet *priv = netdev_priv(dev);
 	cvm_oct_common_init(dev);
 	dev->netdev_ops->ndo_stop(dev);
-	if (!octeon_is_simulation())
+	if (!octeon_is_simulation() && priv->phydev == NULL)
 		priv->poll = cvm_oct_sgmii_poll;
 
 	/* FIXME: Need autoneg logic */
diff --git a/drivers/staging/octeon/ethernet-tx.c b/drivers/staging/octeon/ethernet-tx.c
index 81a851390f1b..535294105f65 100644
--- a/drivers/staging/octeon/ethernet-tx.c
+++ b/drivers/staging/octeon/ethernet-tx.c
@@ -624,7 +624,7 @@ int cvm_oct_transmit_qos(struct net_device *dev, void *work_queue_entry,
 EXPORT_SYMBOL(cvm_oct_transmit_qos);
 
 /**
- * This function frees all skb that are currenty queued for TX.
+ * This function frees all skb that are currently queued for TX.
  *
  * @dev:    Device being shutdown
  */
diff --git a/drivers/staging/octeon/ethernet-xaui.c b/drivers/staging/octeon/ethernet-xaui.c
index 0c2e7cc40f35..ee3dc41b2c53 100644
--- a/drivers/staging/octeon/ethernet-xaui.c
+++ b/drivers/staging/octeon/ethernet-xaui.c
@@ -112,7 +112,7 @@ int cvm_oct_xaui_init(struct net_device *dev)
 	struct octeon_ethernet *priv = netdev_priv(dev);
 	cvm_oct_common_init(dev);
 	dev->netdev_ops->ndo_stop(dev);
-	if (!octeon_is_simulation())
+	if (!octeon_is_simulation() && priv->phydev == NULL)
 		priv->poll = cvm_oct_xaui_poll;
 
 	return 0;
diff --git a/drivers/staging/octeon/ethernet.c b/drivers/staging/octeon/ethernet.c
index 492c5029992d..4cfd4b136b32 100644
--- a/drivers/staging/octeon/ethernet.c
+++ b/drivers/staging/octeon/ethernet.c
@@ -30,7 +30,7 @@
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
 #include <linux/delay.h>
-#include <linux/mii.h>
+#include <linux/phy.h>
 
 #include <net/dst.h>
 
@@ -132,8 +132,6 @@ static struct timer_list cvm_oct_poll_timer;
  */
 struct net_device *cvm_oct_device[TOTAL_NUMBER_OF_PORTS];
 
-extern struct semaphore mdio_sem;
-
 /**
  * Periodic timer tick for slow management operations
  *
@@ -160,13 +158,8 @@ static void cvm_do_timer(unsigned long arg)
 		goto out;
 
 	priv = netdev_priv(cvm_oct_device[port]);
-	if (priv->poll) {
-		/* skip polling if we don't get the lock */
-		if (!down_trylock(&mdio_sem)) {
-			priv->poll(cvm_oct_device[port]);
-			up(&mdio_sem);
-		}
-	}
+	if (priv->poll)
+		priv->poll(cvm_oct_device[port]);
 
 	queues_per_port = cvmx_pko_get_num_queues(port);
 	/* Drain any pending packets in the free list */
@@ -524,7 +517,7 @@ int cvm_oct_common_init(struct net_device *dev)
 	dev->features |= NETIF_F_LLTX;
 	SET_ETHTOOL_OPS(dev, &cvm_oct_ethtool_ops);
 
-	cvm_oct_mdio_setup_device(dev);
+	cvm_oct_phy_setup_device(dev);
 	dev->netdev_ops->ndo_set_mac_address(dev, &sa);
 	dev->netdev_ops->ndo_change_mtu(dev, dev->mtu);
 
@@ -540,7 +533,10 @@ int cvm_oct_common_init(struct net_device *dev)
 
 void cvm_oct_common_uninit(struct net_device *dev)
 {
-	/* Currently nothing to do */
+	struct octeon_ethernet *priv = netdev_priv(dev);
+
+	if (priv->phydev)
+		phy_disconnect(priv->phydev);
 }
 
 static const struct net_device_ops cvm_oct_npi_netdev_ops = {
@@ -627,6 +623,8 @@ static const struct net_device_ops cvm_oct_pow_netdev_ops = {
 #endif
 };
 
+extern void octeon_mdiobus_force_mod_depencency(void);
+
 /**
  * Module/ driver initialization. Creates the linux network
  * devices.
@@ -640,6 +638,7 @@ static int __init cvm_oct_init_module(void)
 	int fau = FAU_NUM_PACKET_BUFFERS_TO_FREE;
 	int qos;
 
+	octeon_mdiobus_force_mod_depencency();
 	pr_notice("cavium-ethernet %s\n", OCTEON_ETHERNET_VERSION);
 
 	if (OCTEON_IS_MODEL(OCTEON_CN52XX))
diff --git a/drivers/staging/octeon/octeon-ethernet.h b/drivers/staging/octeon/octeon-ethernet.h
index 3aef9878fc0a..402a15b9bb0e 100644
--- a/drivers/staging/octeon/octeon-ethernet.h
+++ b/drivers/staging/octeon/octeon-ethernet.h
@@ -50,9 +50,9 @@ struct octeon_ethernet {
 	/* List of outstanding tx buffers per queue */
 	struct sk_buff_head tx_free_list[16];
 	/* Device statistics */
-	struct net_device_stats stats
-;	/* Generic MII info structure */
-	struct mii_if_info mii_info;
+	struct net_device_stats stats;
+	struct phy_device *phydev;
+	unsigned int last_link;
 	/* Last negotiated link state */
 	uint64_t link_info;
 	/* Called periodically to check link status */
diff --git a/drivers/staging/otus/80211core/ccmd.c b/drivers/staging/otus/80211core/ccmd.c
index 83dd8ba1328c..8da28eee7fb0 100644
--- a/drivers/staging/otus/80211core/ccmd.c
+++ b/drivers/staging/otus/80211core/ccmd.c
@@ -899,7 +899,7 @@ u16_t zfiWlanDisable(zdev_t *dev, u8_t ResetKeyCache)
 		zfStaDisableSWEncryption(dev);
 	}
 
-	/* Improve WEP/TKIP performace with HT AP,
+	/* Improve WEP/TKIP performance with HT AP,
 	detail information please look bug#32495 */
 	/* zfHpSetTTSIFSTime(dev, 0x8); */
 
@@ -1407,7 +1407,7 @@ u16_t zfWlanReset(zdev_t *dev)
 		zfStaDisableSWEncryption(dev);
 	}
 
-	/* 	Improve WEP/TKIP performace with HT AP,
+	/* 	Improve WEP/TKIP performance with HT AP,
 		detail information please look bug#32495
 	*/
 	/* zfHpSetTTSIFSTime(dev, 0x8); */
diff --git a/drivers/staging/otus/80211core/cmm.c b/drivers/staging/otus/80211core/cmm.c
index bed16b581a5f..a6c1b41ba848 100644
--- a/drivers/staging/otus/80211core/cmm.c
+++ b/drivers/staging/otus/80211core/cmm.c
@@ -1428,7 +1428,7 @@ void zfProcessManagement(zdev_t* dev, zbuf_t* buf, struct zsAdditionInfo* AddInf
         {
                 /* Beacon */
             case ZM_WLAN_FRAME_TYPE_BEACON :
-                /* if enable 802.11h and current chanel is silent but receive beacon from other AP */
+                /* if enable 802.11h and current channel is silent but receive beacon from other AP */
                 if (((wd->regulationTable.allowChannel[wd->regulationTable.CurChIndex].channelFlags
                         & ZM_REG_FLAG_CHANNEL_CSA) != 0) && wd->sta.DFSEnable)
                 {
@@ -1469,7 +1469,7 @@ void zfProcessManagement(zdev_t* dev, zbuf_t* buf, struct zsAdditionInfo* AddInf
                 break;
                 /* Probe response */
             case ZM_WLAN_FRAME_TYPE_PROBERSP :
-                /* if enable 802.11h and current chanel is silent but receive probe response from other AP */
+                /* if enable 802.11h and current channel is silent but receive probe response from other AP */
                 if (((wd->regulationTable.allowChannel[wd->regulationTable.CurChIndex].channelFlags
                         & ZM_REG_FLAG_CHANNEL_CSA) != 0) && wd->sta.DFSEnable)
                 {
diff --git a/drivers/staging/otus/80211core/cmmsta.c b/drivers/staging/otus/80211core/cmmsta.c
index b28a4e25e107..a11d559167b1 100644
--- a/drivers/staging/otus/80211core/cmmsta.c
+++ b/drivers/staging/otus/80211core/cmmsta.c
@@ -216,7 +216,7 @@ void zfStaConnectFail(zdev_t* dev, u16_t reason, u16_t* bssid, u8_t weight)
     /* Change internal state */
     zfChangeAdapterState(dev, ZM_STA_STATE_DISCONNECT);
 
-    /* Improve WEP/TKIP performace with HT AP, detail information please look bug#32495 */
+    /* Improve WEP/TKIP performance with HT AP, detail information please look bug#32495 */
     //zfHpSetTTSIFSTime(dev, 0x8);
 
     /* Notify wrapper of connection status changes */
@@ -4148,7 +4148,7 @@ void zfInfraConnectNetwork(zdev_t* dev)
             wd->sta.bIsSharedKey = 0;
         }
 
-        /* Improve WEP/TKIP performace with HT AP, detail information please look bug#32495 */
+        /* Improve WEP/TKIP performance with HT AP, detail information please look bug#32495 */
         /*
         if ( (pBssInfo->broadcomHTAp == 1)
              && (wd->sta.SWEncryptEnable != 0) )
diff --git a/drivers/staging/otus/80211core/ctxrx.c b/drivers/staging/otus/80211core/ctxrx.c
index e258a7df5363..ac54d5a636b0 100644
--- a/drivers/staging/otus/80211core/ctxrx.c
+++ b/drivers/staging/otus/80211core/ctxrx.c
@@ -3093,7 +3093,7 @@ u16_t zfWlanRxFilter(zdev_t* dev, zbuf_t* buf)
 
     frameType = zmw_rx_buf_readh(dev, buf, offset);
 
-    // Don't divide 2^4 because we don't want the fragementation pkt to be treated as
+    // Don't divide 2^4 because we don't want the fragmentation pkt to be treated as
     // duplicated frames
     seq = zmw_rx_buf_readh(dev, buf, offset+22);
     dst0 = zmw_rx_buf_readh(dev, buf, offset+4);
diff --git a/drivers/staging/otus/80211core/pub_zfi.h b/drivers/staging/otus/80211core/pub_zfi.h
index a35bd5d41d2c..b7b7f455f357 100644
--- a/drivers/staging/otus/80211core/pub_zfi.h
+++ b/drivers/staging/otus/80211core/pub_zfi.h
@@ -20,7 +20,7 @@
 #include "../oal_dt.h"
 
 /***** Section 1 : Tunable Parameters *****/
-/* The defintions in this section are tunabel parameters */
+/* The definitions in this section are tunabel parameters */
 
 /* Maximum number of BSS that could be scaned */
 #define ZM_MAX_BSS                          128
@@ -782,7 +782,7 @@ extern void zfiWlanSetDynamicSIFSParam(zdev_t* dev, u8_t val);
 
 /***** End of section 2 *****/
 
-/***** section 3 performace evaluation *****/
+/***** section 3 performance evaluation *****/
 #ifdef ZM_ENABLE_PERFORMANCE_EVALUATION
 extern void zfiTxPerformanceMSDU(zdev_t* dev, u32_t tick);
 extern void zfiRxPerformanceMPDU(zdev_t* dev, zbuf_t* buf);
diff --git a/drivers/staging/otus/apdbg.c b/drivers/staging/otus/apdbg.c
index d3e2f6224196..0eb93f19958a 100644
--- a/drivers/staging/otus/apdbg.c
+++ b/drivers/staging/otus/apdbg.c
@@ -38,39 +38,39 @@
 
 #include <linux/sockios.h>
 
-#define ZM_IOCTL_REG_READ           0x01
-#define ZM_IOCTL_REG_WRITE          0x02
-#define ZM_IOCTL_MEM_DUMP           0x03
-#define ZM_IOCTL_REG_DUMP           0x05
-#define ZM_IOCTL_TXD_DUMP           0x06
-#define ZM_IOCTL_RXD_DUMP           0x07
-#define ZM_IOCTL_MEM_READ           0x0B
-#define ZM_IOCTL_MEM_WRITE          0x0C
-#define ZM_IOCTL_DMA_TEST           0x10
-#define ZM_IOCTL_REG_TEST           0x11
-#define ZM_IOCTL_TEST               0x80
-#define ZM_IOCTL_TALLY              0x81 //CWYang(+)
-#define ZM_IOCTL_RTS                0xA0
-#define ZM_IOCTL_MIX_MODE           0xA1
-#define ZM_IOCTL_FRAG               0xA2
-#define ZM_IOCTL_SCAN               0xA3
-#define ZM_IOCTL_KEY                0xA4
-#define ZM_IOCTL_RATE               0xA5
-#define ZM_IOCTL_ENCRYPTION_MODE    0xA6
-#define ZM_IOCTL_GET_TXCNT          0xA7
-#define ZM_IOCTL_GET_DEAGG_CNT      0xA8
-#define ZM_IOCTL_DURATION_MODE      0xA9
-#define ZM_IOCTL_SET_AES_KEY        0xAA
-#define ZM_IOCTL_SET_AES_MODE       0xAB
-#define ZM_IOCTL_SIGNAL_STRENGTH    0xAC //CWYang(+)
-#define ZM_IOCTL_SIGNAL_QUALITY     0xAD //CWYang(+)
-#define ZM_IOCTL_SET_PIBSS_MODE     0xAE
-#define	ZDAPIOCTL                   SIOCDEVPRIVATE
+#define ZM_IOCTL_REG_READ			0x01
+#define ZM_IOCTL_REG_WRITE			0x02
+#define ZM_IOCTL_MEM_DUMP			0x03
+#define ZM_IOCTL_REG_DUMP			0x05
+#define ZM_IOCTL_TXD_DUMP			0x06
+#define ZM_IOCTL_RXD_DUMP			0x07
+#define ZM_IOCTL_MEM_READ			0x0B
+#define ZM_IOCTL_MEM_WRITE			0x0C
+#define ZM_IOCTL_DMA_TEST			0x10
+#define ZM_IOCTL_REG_TEST			0x11
+#define ZM_IOCTL_TEST				0x80
+#define ZM_IOCTL_TALLY				0x81 /* CWYang(+) */
+#define ZM_IOCTL_RTS				0xA0
+#define ZM_IOCTL_MIX_MODE			0xA1
+#define ZM_IOCTL_FRAG				0xA2
+#define ZM_IOCTL_SCAN				0xA3
+#define ZM_IOCTL_KEY				0xA4
+#define ZM_IOCTL_RATE				0xA5
+#define ZM_IOCTL_ENCRYPTION_MODE		0xA6
+#define ZM_IOCTL_GET_TXCNT			0xA7
+#define ZM_IOCTL_GET_DEAGG_CNT			0xA8
+#define ZM_IOCTL_DURATION_MODE			0xA9
+#define ZM_IOCTL_SET_AES_KEY			0xAA
+#define ZM_IOCTL_SET_AES_MODE			0xAB
+#define ZM_IOCTL_SIGNAL_STRENGTH		0xAC /* CWYang(+) */
+#define ZM_IOCTL_SIGNAL_QUALITY			0xAD /* CWYang(+) */
+#define ZM_IOCTL_SET_PIBSS_MODE			0xAE
+#define	ZDAPIOCTL				SIOCDEVPRIVATE
 
 struct zdap_ioctl {
-	unsigned short cmd;                /* Command to run */
-	unsigned int   addr;                /* Length of the data buffer */
-	unsigned int   value;               /* Pointer to the data buffer */
+	unsigned short cmd;			/* Command to run */
+	unsigned int   addr;			/* Length of the data buffer */
+	unsigned int   value;			/* Pointer to the data buffer */
 	unsigned char data[0x100];
 };
 
@@ -79,13 +79,13 @@ struct zdap_ioctl {
 #if 0
 
 #define SKIP_ELEM { \
-    while(isxdigit(*p)) \
-        p++; \
+	while (isxdigit(*p)) \
+		p++; \
 }
 
 #define SKIP_DELIMETER { \
-    if(*p == ':' || *p == ' ') \
-        p++; \
+	if (*p == ':' || *p == ' ') \
+		p++; \
 }
 
 #endif
@@ -97,361 +97,308 @@ char *prgname;
 
 int set_ioctl(int sock, struct ifreq *req)
 {
-    if (ioctl(sock, ZDAPIOCTL, req) < 0) {
-        fprintf(stderr, "%s: ioctl(SIOCGIFMAP): %s\n",
-                prgname, strerror(errno));
-        return -1;
-    }
+	if (ioctl(sock, ZDAPIOCTL, req) < 0) {
+		fprintf(stderr, "%s: ioctl(SIOCGIFMAP): %s\n",
+			prgname, strerror(errno));
+		return -1;
+	}
 
-    return 0;
+	return 0;
 }
 
 
 int read_reg(int sock, struct ifreq *req)
 {
-    struct zdap_ioctl *zdreq = 0;
+	struct zdap_ioctl *zdreq = 0;
 
-    if (!set_ioctl(sock, req))
-        return -1;
+	if (!set_ioctl(sock, req))
+			return -1;
 
-    //zdreq = (struct zdap_ioctl *)req->ifr_data;
-    //printf( "reg = %4x, value = %4x\n", zdreq->addr, zdreq->value);
+	/*
+	 * zdreq = (struct zdap_ioctl *)req->ifr_data;
+	 * printf( "reg = %4x, value = %4x\n", zdreq->addr, zdreq->value);
+	 */
 
-    return 0;
+	return 0;
 }
 
 
 int read_mem(int sock, struct ifreq *req)
 {
-    struct zdap_ioctl *zdreq = 0;
-    int i;
-
-    if (!set_ioctl(sock, req))
-        return -1;
-
-    /*zdreq = (struct zdap_ioctl *)req->ifr_data;
-    printf( "dump mem from %x, length = %x\n", zdreq->addr, zdreq->value);
-
-    for (i=0; i<zdreq->value; i++) {
-        printf("%02x", zdreq->data[i]);
-        printf(" ");
-
-        if ((i>0) && ((i+1)%16 == 0))
-            printf("\n");
-    }*/
-
-    return 0;
+	struct zdap_ioctl *zdreq = 0;
+	int i;
+
+	if (!set_ioctl(sock, req))
+		return -1;
+
+	/*
+	 * zdreq = (struct zdap_ioctl *)req->ifr_data;
+	 * printf("dump mem from %x, length = %x\n", zdreq->addr, zdreq->value);
+	 *
+	 * for (i=0; i<zdreq->value; i++) {
+	 *	printf("%02x", zdreq->data[i]);
+	 *	printf(" ");
+	 *
+	 *	if ((i>0) && ((i+1)%16 == 0))
+	 *		printf("\n");
+	 * }
+	 */
+
+	return 0;
 }
 
 
 int main(int argc, char **argv)
 {
-    int sock;
-    int addr, value;
-    struct ifreq req;
-    char *action = NULL;
-    struct zdap_ioctl zdreq;
-
-    prgname = argv[0];
-
-    if (argc < 3) {
-        fprintf(stderr,"%s: usage is \"%s <ifname> <operation> [<address>] [<value>]\"\n",
-                prgname, prgname);
-        fprintf(stderr,"valid operation: read, write, mem, reg,\n");
-        fprintf(stderr,"               : txd, rxd, rmem, wmem\n");
-        fprintf(stderr,"               : dmat, regt, test\n");
-
-        fprintf(stderr,"    scan, Channel Scan\n");
-        fprintf(stderr,"    rts <decimal>, Set RTS Threshold\n");
-        fprintf(stderr,"    frag <decimal>, Set Fragment Threshold\n");
-        fprintf(stderr,"    rate <0-28>, 0:AUTO, 1-4:CCK, 5-12:OFDM, 13-28:HT\n");
-        fprintf(stderr,"    TBD mix <0 or 1>, Set 1 to enable mixed mode\n");
-        fprintf(stderr,"    enc, <0-3>, 0=>OPEN, 1=>WEP64, 2=>WEP128, 3=>WEP256\n");
-        fprintf(stderr,"    skey <key>, Set WEP key\n");
-        fprintf(stderr,"    txcnt, Get TxQ Cnt\n");
-        fprintf(stderr,"    dagcnt, Get Deaggregate Cnt\n");
-        fprintf(stderr,"    durmode <mode>, Set Duration Mode 0=>HW, 1=>SW\n");
-        fprintf(stderr,"    aeskey <user> <key>\n");
-        fprintf(stderr,"    aesmode <mode>\n");
-        fprintf(stderr,"    wlanmode <0,1> 0:Station mode, 1:PIBSS mode\n");
-        fprintf(stderr,"    tal <0,1>, Get Current Tally Info, 0=>read, 1=>read and reset\n");
-
-        exit(1);
-    }
-
-    strcpy(req.ifr_name, argv[1]);
-    zdreq.addr = 0;
-    zdreq.value = 0;
-
-    /* a silly raw socket just for ioctl()ling it */
-    sock = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
-    if (sock < 0) {
-        fprintf(stderr, "%s: socket(): %s\n", argv[0], strerror(errno));
-        exit(1);
-    }
-
-    if (argc >= 4)
-    {
-        sscanf(argv[3], "%x", &addr);
-    }
-
-    if (argc >= 5)
-    {
-        sscanf(argv[4], "%x", &value);
-    }
-
-    zdreq.addr = addr;
-    zdreq.value = value;
-
-    if (!strcmp(argv[2], "read"))
-    {
-        zdreq.cmd = ZM_IOCTL_REG_READ;
-    }
-    else if (!strcmp(argv[2], "mem"))
-    {
-        zdreq.cmd = ZM_IOCTL_MEM_DUMP;
-    }
-    else if (!strcmp(argv[2], "write"))
-    {
-        zdreq.cmd = ZM_IOCTL_REG_WRITE;
-    }
-    else if (!strcmp(argv[2], "reg"))
-    {
-        zdreq.cmd = ZM_IOCTL_REG_DUMP;
-    }
-    else if (!strcmp(argv[2], "txd"))
-    {
-        zdreq.cmd = ZM_IOCTL_TXD_DUMP;
-    }
-    else if (!strcmp(argv[2], "rxd"))
-    {
-        zdreq.cmd = ZM_IOCTL_RXD_DUMP;
-    }
-    else if (!strcmp(argv[2], "rmem"))
-    {
-        zdreq.cmd = ZM_IOCTL_MEM_READ;
-    }
-    else if (!strcmp(argv[2], "wmem"))
-    {
-        zdreq.cmd = ZM_IOCTL_MEM_WRITE;
-    }
-    else if (!strcmp(argv[2], "dmat"))
-    {
-        zdreq.cmd = ZM_IOCTL_DMA_TEST;
-    }
-    else if (!strcmp(argv[2], "regt"))
-    {
-        zdreq.cmd = ZM_IOCTL_REG_TEST;
-    }
-    else if (!strcmp(argv[2], "test"))
-    {
-        zdreq.cmd = ZM_IOCTL_TEST;
-    }
-    else if (!strcmp(argv[2], "tal"))
-    {
-        sscanf(argv[3], "%d", &addr);
-        zdreq.addr = addr;
-        zdreq.cmd = ZM_IOCTL_TALLY;
-    }
-    else if (!strcmp(argv[2], "rts"))
-    {
-        sscanf(argv[3], "%d", &addr);
-        zdreq.addr = addr;
-        zdreq.cmd = ZM_IOCTL_RTS;
-    }
-    else if (!strcmp(argv[2], "mix"))
-    {
-        zdreq.cmd = ZM_IOCTL_MIX_MODE;
-    }
-    else if (!strcmp(argv[2], "frag"))
-    {
-        sscanf(argv[3], "%d", &addr);
-        zdreq.addr = addr;
-        zdreq.cmd = ZM_IOCTL_FRAG;
-    }
-    else if (!strcmp(argv[2], "scan"))
-    {
-        zdreq.cmd = ZM_IOCTL_SCAN;
-    }
-    else if (!strcmp(argv[2], "skey"))
-    {
-        zdreq.cmd = ZM_IOCTL_KEY;
-
-        if (argc >= 4)
-        {
-            unsigned char temp[29];
-            int i;
-            int keyLen;
-            int encType;
-
-            keyLen = strlen(argv[3]);
-
-            if (keyLen == 10)
-            {
-                sscanf(argv[3], "%02x%02x%02x%02x%02x", &temp[0], &temp[1],
-                        &temp[2], &temp[3], &temp[4]);
-            }
-            else if (keyLen == 26)
-            {
-                sscanf(argv[3], "%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x",
-                        &temp[0], &temp[1], &temp[2], &temp[3], &temp[4],
-                        &temp[5], &temp[6], &temp[7], &temp[8], &temp[9],
-                         &temp[10], &temp[11], &temp[12]);
-            }
-            else if (keyLen == 58)
-            {
-                sscanf(argv[3], "%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x",
-                        &temp[0], &temp[1], &temp[2], &temp[3], &temp[4],
-                        &temp[5], &temp[6], &temp[7], &temp[8], &temp[9],
-                        &temp[10], &temp[11], &temp[12], &temp[13], &temp[14],
-                        &temp[15], &temp[16], &temp[17], &temp[18], &temp[19],
-                        &temp[20], &temp[21], &temp[22], &temp[23], &temp[24],
-                        &temp[25], &temp[26], &temp[27], &temp[28]);
-            }
-            else
-            {
-                fprintf(stderr, "Invalid key length\n");
-                exit(1);
-            }
-            zdreq.addr = keyLen/2;
-
-            for(i=0; i<zdreq.addr; i++)
-            {
-                zdreq.data[i] = temp[i];
-            }
-        }
-        else
-        {
-            printf("Error : Key required!\n");
-        }
-    }
-    else if (!strcmp(argv[2], "rate"))
-    {
-        sscanf(argv[3], "%d", &addr);
-
-        if (addr > 28)
-        {
-            fprintf(stderr, "Invalid rate, range:0~28\n");
-            exit(1);
-        }
-        zdreq.addr = addr;
-        zdreq.cmd = ZM_IOCTL_RATE;
-    }
-    else if (!strcmp(argv[2], "enc"))
-    {
-        sscanf(argv[3], "%d", &addr);
-
-        if (addr > 3)
-        {
-            fprintf(stderr, "Invalid encryption mode, range:0~3\n");
-            exit(1);
-        }
-
-        if (addr == 2)
-        {
-            addr = 5;
-        }
-        else if (addr == 3)
-        {
-            addr = 6;
-        }
-
-        zdreq.addr = addr;
-        zdreq.cmd = ZM_IOCTL_ENCRYPTION_MODE;
-    }
-    else if (!strcmp(argv[2], "txcnt"))
-    {
-        zdreq.cmd = ZM_IOCTL_GET_TXCNT;
-    }
-    else if (!strcmp(argv[2], "dagcnt"))
-    {
-        sscanf(argv[3], "%d", &addr);
-
-        if (addr != 0 && addr != 1)
-        {
-            fprintf(stderr, "The value should be 0 or 1\n");
-            exit(0);
-        }
-
-        zdreq.addr = addr;
-        zdreq.cmd = ZM_IOCTL_GET_DEAGG_CNT;
-    }
-    else if (!strcmp(argv[2], "durmode"))
-    {
-        sscanf(argv[3], "%d", &addr);
-
-        if (addr != 0 && addr != 1)
-        {
-            fprintf(stderr, "The Duration mode should be 0 or 1\n");
-            exit(0);
-        }
-
-        zdreq.addr = addr;
-        zdreq.cmd = ZM_IOCTL_DURATION_MODE;
-    }
-    else if (!strcmp(argv[2], "aeskey"))
-    {
-        unsigned char temp[16];
-        int i;
-
-        sscanf(argv[3], "%d", &addr);
-
-        sscanf(argv[4], "%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x", &temp[0], &temp[1], &temp[2], &temp[3], &temp[4], &temp[5], &temp[6], &temp[7], &temp[8], &temp[9], &temp[10], &temp[11], &temp[12], &temp[13], &temp[14], &temp[15]);
-
-        for(i = 0; i < 16; i++)
-        {
-            zdreq.data[i] = temp[i];
-        }
-
-        zdreq.addr = addr;
-        zdreq.cmd = ZM_IOCTL_SET_AES_KEY;
-    }
-    else if (!strcmp(argv[2], "aesmode"))
-    {
-        sscanf(argv[3], "%d", &addr);
-
-        zdreq.addr = addr;
-        zdreq.cmd = ZM_IOCTL_SET_AES_MODE;
-    }
-    else if (!strcmp(argv[2], "wlanmode"))
-    {
-        sscanf(argv[3], "%d", &addr);
-
-        zdreq.addr = addr;
-        zdreq.cmd = ZM_IOCTL_SET_PIBSS_MODE;
-    }
-    else
-    {
-	    fprintf(stderr, "error action\n");
-        exit(1);
-    }
-
-    req.ifr_data = (char *)&zdreq;
-    set_ioctl(sock, &req);
+	int sock;
+	int addr, value;
+	struct ifreq req;
+	char *action = NULL;
+	struct zdap_ioctl zdreq;
+
+	prgname = argv[0];
+
+	if (argc < 3) {
+		fprintf(stderr, "%s: usage is \"%s <ifname> <operation>"
+				"[<address>] [<value>]\"\n", prgname, prgname);
+		fprintf(stderr, "valid operation : read, write, mem, reg, \n");
+		fprintf(stderr, "		: txd, rxd, rmem, wmem\n");
+		fprintf(stderr, "		: dmat, regt, test\n");
+
+		fprintf(stderr, "	scan, Channel Scan\n");
+		fprintf(stderr, "	rts <decimal>, Set RTS Threshold\n");
+		fprintf(stderr, "	frag <decimal>, Set Fragment"
+			" Threshold\n");
+		fprintf(stderr, "	rate <0-28>, 0:AUTO, 1-4:CCK,"
+			" 5-12:OFDM, 13-28:HT\n");
+		fprintf(stderr, "	TBD mix <0 or 1>, Set 1 to enable"
+			" mixed mode\n");
+		fprintf(stderr, "	enc, <0-3>, 0=>OPEN, 1=>WEP64, "
+			"2=>WEP128, 3=>WEP256\n");
+		fprintf(stderr, "	skey <key>, Set WEP key\n");
+		fprintf(stderr, "	txcnt, Get TxQ Cnt\n");
+		fprintf(stderr, "	dagcnt, Get Deaggregate Cnt\n");
+		fprintf(stderr, "	durmode <mode>, Set Duration Mode "
+			"0=>HW, 1=>SW\n");
+		fprintf(stderr, "	aeskey <user> <key>\n");
+		fprintf(stderr, "	aesmode <mode>\n");
+		fprintf(stderr, "	wlanmode <0,1> 0:Station mode, "
+			"1:PIBSS mode\n");
+		fprintf(stderr, "	tal <0,1>, Get Current Tally Info, "
+			"0=>read, 1=>read and reset\n");
+
+		exit(1);
+	}
+
+	strcpy(req.ifr_name, argv[1]);
+	zdreq.addr = 0;
+	zdreq.value = 0;
+
+	/* a silly raw socket just for ioctl()ling it */
+	sock = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
+	if (sock < 0) {
+		fprintf(stderr, "%s: socket(): %s\n", argv[0], strerror(errno));
+		exit(1);
+	}
+
+	if (argc >= 4)
+		sscanf(argv[3], "%x", &addr);
+
+	if (argc >= 5)
+		sscanf(argv[4], "%x", &value);
+
+	zdreq.addr = addr;
+	zdreq.value = value;
+
+	if (!strcmp(argv[2], "read"))
+		zdreq.cmd = ZM_IOCTL_REG_READ;
+	else if (!strcmp(argv[2], "mem"))
+		zdreq.cmd = ZM_IOCTL_MEM_DUMP;
+	else if (!strcmp(argv[2], "write"))
+		zdreq.cmd = ZM_IOCTL_REG_WRITE;
+	else if (!strcmp(argv[2], "reg"))
+		zdreq.cmd = ZM_IOCTL_REG_DUMP;
+	else if (!strcmp(argv[2], "txd"))
+		zdreq.cmd = ZM_IOCTL_TXD_DUMP;
+	else if (!strcmp(argv[2], "rxd"))
+		zdreq.cmd = ZM_IOCTL_RXD_DUMP;
+	else if (!strcmp(argv[2], "rmem"))
+		zdreq.cmd = ZM_IOCTL_MEM_READ;
+	else if (!strcmp(argv[2], "wmem"))
+		zdreq.cmd = ZM_IOCTL_MEM_WRITE;
+	else if (!strcmp(argv[2], "dmat"))
+		zdreq.cmd = ZM_IOCTL_DMA_TEST;
+	else if (!strcmp(argv[2], "regt"))
+		zdreq.cmd = ZM_IOCTL_REG_TEST;
+	else if (!strcmp(argv[2], "test"))
+		zdreq.cmd = ZM_IOCTL_TEST;
+	else if (!strcmp(argv[2], "tal")) {
+		sscanf(argv[3], "%d", &addr);
+		zdreq.addr = addr;
+		zdreq.cmd = ZM_IOCTL_TALLY;
+	} else if (!strcmp(argv[2], "rts")) {
+		sscanf(argv[3], "%d", &addr);
+		zdreq.addr = addr;
+		zdreq.cmd = ZM_IOCTL_RTS;
+	} else if (!strcmp(argv[2], "mix")) {
+		zdreq.cmd = ZM_IOCTL_MIX_MODE;
+	} else if (!strcmp(argv[2], "frag")) {
+		sscanf(argv[3], "%d", &addr);
+		zdreq.addr = addr;
+		zdreq.cmd = ZM_IOCTL_FRAG;
+	} else if (!strcmp(argv[2], "scan")) {
+		zdreq.cmd = ZM_IOCTL_SCAN;
+	} else if (!strcmp(argv[2], "skey")) {
+		zdreq.cmd = ZM_IOCTL_KEY;
+
+		if (argc >= 4) {
+			unsigned char temp[29];
+			int i;
+			int keyLen;
+			int encType;
+
+			keyLen = strlen(argv[3]);
+
+			if (keyLen == 10)
+				sscanf(argv[3], "%02x%02x%02x%02x%02x",
+					&temp[0], &temp[1], &temp[2], &temp[3],
+					&temp[4]);
+			else if (keyLen == 26)
+				sscanf(argv[3], "%02x%02x%02x%02x%02x%02x"
+					"%02x%02x%02x%02x%02x%02x%02x",
+					&temp[0], &temp[1], &temp[2], &temp[3],
+					&temp[4], &temp[5], &temp[6], &temp[7],
+					&temp[8], &temp[9], &temp[10],
+					&temp[11], &temp[12]);
+			else if (keyLen == 58)
+				sscanf(argv[3], "%02x%02x%02x%02x%02x%02x"
+					"%02x%02x%02x%02x%02x%02x%02x%02x%02x"
+					"%02x%02x%02x%02x%02x%02x%02x%02x%02x"
+					"%02x%02x%02x%02x%02x",
+					&temp[0], &temp[1], &temp[2], &temp[3],
+					&temp[4], &temp[5], &temp[6], &temp[7],
+					&temp[8], &temp[9], &temp[10],
+					&temp[11], &temp[12], &temp[13],
+					&temp[14], &temp[15], &temp[16],
+					&temp[17], &temp[18], &temp[19],
+					&temp[20], &temp[21], &temp[22],
+					&temp[23], &temp[24], &temp[25],
+					&temp[26], &temp[27], &temp[28]);
+			else {
+				fprintf(stderr, "Invalid key length\n");
+				exit(1);
+			}
+			zdreq.addr = keyLen/2;
+
+			for (i = 0; i < zdreq.addr; i++)
+				zdreq.data[i] = temp[i];
+		} else {
+			printf("Error : Key required!\n");
+		}
+	} else if (!strcmp(argv[2], "rate")) {
+		sscanf(argv[3], "%d", &addr);
+
+		if (addr > 28) {
+			fprintf(stderr, "Invalid rate, range:0~28\n");
+			exit(1);
+		}
+		zdreq.addr = addr;
+		zdreq.cmd = ZM_IOCTL_RATE;
+	} else if (!strcmp(argv[2], "enc")) {
+		sscanf(argv[3], "%d", &addr);
+
+		if (addr > 3) {
+			fprintf(stderr, "Invalid encryption mode, range:0~3\n");
+			exit(1);
+		}
+
+		if (addr == 2)
+			addr = 5;
+		else if (addr == 3)
+			addr = 6;
+
+		zdreq.addr = addr;
+		zdreq.cmd = ZM_IOCTL_ENCRYPTION_MODE;
+	} else if (!strcmp(argv[2], "txcnt")) {
+		zdreq.cmd = ZM_IOCTL_GET_TXCNT;
+	} else if (!strcmp(argv[2], "dagcnt")) {
+		sscanf(argv[3], "%d", &addr);
+
+		if (addr != 0 && addr != 1) {
+			fprintf(stderr, "The value should be 0 or 1\n");
+			exit(0);
+		}
+
+		zdreq.addr = addr;
+		zdreq.cmd = ZM_IOCTL_GET_DEAGG_CNT;
+	} else if (!strcmp(argv[2], "durmode"))	{
+		sscanf(argv[3], "%d", &addr);
+
+		if (addr != 0 && addr != 1) {
+			fprintf(stderr, "The Duration mode should be 0 or 1\n");
+			exit(0);
+		}
+
+		zdreq.addr = addr;
+		zdreq.cmd = ZM_IOCTL_DURATION_MODE;
+	} else if (!strcmp(argv[2], "aeskey")) {
+		unsigned char temp[16];
+		int i;
+
+		sscanf(argv[3], "%d", &addr);
+
+		sscanf(argv[4], "%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x"
+			"%02x%02x%02x%02x%02x%02x", &temp[0], &temp[1],
+			&temp[2], &temp[3], &temp[4], &temp[5], &temp[6],
+			&temp[7], &temp[8], &temp[9], &temp[10], &temp[11],
+			&temp[12], &temp[13], &temp[14], &temp[15]);
+
+		for (i = 0; i < 16; i++)
+			zdreq.data[i] = temp[i];
+
+		zdreq.addr = addr;
+		zdreq.cmd = ZM_IOCTL_SET_AES_KEY;
+	} else if (!strcmp(argv[2], "aesmode")) {
+		sscanf(argv[3], "%d", &addr);
+
+		zdreq.addr = addr;
+		zdreq.cmd = ZM_IOCTL_SET_AES_MODE;
+	} else if (!strcmp(argv[2], "wlanmode")) {
+		sscanf(argv[3], "%d", &addr);
+
+		zdreq.addr = addr;
+		zdreq.cmd = ZM_IOCTL_SET_PIBSS_MODE;
+	} else 	{
+		fprintf(stderr, "error action\n");
+		exit(1);
+	}
+
+	req.ifr_data = (char *)&zdreq;
+	set_ioctl(sock, &req);
 
 fail:
-    exit(0);
+	exit(0);
 }
 
 unsigned char asctohex(char *str)
 {
-    unsigned char value;
+	unsigned char value;
 
-    value = hex(*str) & 0x0f;
-    value = value << 4;
-    str++;
-    value |= hex(*str) & 0x0f;
+	value = hex(*str) & 0x0f;
+	value = value << 4;
+	str++;
+	value |= hex(*str) & 0x0f;
 
-    return value;
+	return value;
 }
 
 char hex(char v)
 {
-    if(isdigit(v))
-        return v - '0';
-    else if(isxdigit(v))
-        return (tolower(v) - 'a' + 10);
-    else
-        return 0;
+	if (isdigit(v))
+		return v - '0';
+	else if (isxdigit(v))
+		return tolower(v) - 'a' + 10;
+	else
+		return 0;
 }
 
diff --git a/drivers/staging/otus/athr_common.h b/drivers/staging/otus/athr_common.h
index 620f78a41d5f..3e32f5b4ac68 100644
--- a/drivers/staging/otus/athr_common.h
+++ b/drivers/staging/otus/athr_common.h
@@ -68,7 +68,7 @@
 
 #define ZM_WAPI_KEY_SIZE                32
 #define ZM_WAPI_IV_LEN                  16
-#endif //ZM_ENALBE_WAPI
+#endif /* ZM_ENALBE_WAPI */
 /* structure definition */
 
 struct athr_wlan_param {
@@ -123,7 +123,7 @@ struct athr_wapi_param {
 			u8 key[ZM_WAPI_KEY_SIZE];
 		} crypt;
 		struct {
-                        u8 wapi_policy;
+			u8 wapi_policy;
 		} info;
 	} u;
 };
@@ -132,10 +132,10 @@ struct athr_wapi_sta_info
 {
 	u16	msg_type;
 	u16	datalen;
-    	u8	sta_mac[ETH_ALEN];
+	u8	sta_mac[ETH_ALEN];
 	u8	reserve_data[2];
-    	u8	gsn[ZM_WAPI_IV_LEN];
+	u8	gsn[ZM_WAPI_IV_LEN];
 	u8	wie[256];
 };
-#endif //ZM_ENALBE_WAPI
+#endif /* ZM_ENALBE_WAPI */
 #endif
diff --git a/drivers/staging/otus/oal_dt.h b/drivers/staging/otus/oal_dt.h
index e82b9770fca1..fb6d11a99cc5 100644
--- a/drivers/staging/otus/oal_dt.h
+++ b/drivers/staging/otus/oal_dt.h
@@ -39,15 +39,15 @@ typedef     long                s32_t;
 typedef     short               s16_t;
 typedef     char                s8_t;
 
-#ifndef     TRUE
-#define     TRUE                (1==1)
+#ifndef TRUE
+#define     TRUE                (1 == 1)
 #endif
 
-#ifndef     FALSE
-#define     FALSE               (1==0)
+#ifndef FALSE
+#define     FALSE               (1 == 0)
 #endif
 
-#ifndef     NULL
+#ifndef	NULL
 #define     NULL                0
 #endif
 
diff --git a/drivers/staging/otus/oal_marc.h b/drivers/staging/otus/oal_marc.h
index 206111616a03..e7a9081b1a7c 100644
--- a/drivers/staging/otus/oal_marc.h
+++ b/drivers/staging/otus/oal_marc.h
@@ -34,17 +34,19 @@
 /***** Critical section *****/
 /* Declare for critical section */
 #ifndef ZM_HALPLUS_LOCK
-#define zmw_get_wlan_dev(dev)    struct zsWlanDev *wd = (struct zsWlanDev*) ((((struct usbdrv_private*)dev->priv)->wd))
+#define zmw_get_wlan_dev(dev) struct zsWlanDev *wd = (struct zsWlanDev *) \
+	((((struct usbdrv_private *)dev->priv)->wd))
 
 #define zmw_declare_for_critical_section() unsigned long irqFlag;
 
 /* Enter critical section */
-#define zmw_enter_critical_section(dev) \
-        spin_lock_irqsave(&(((struct usbdrv_private *)(dev->priv))->cs_lock), irqFlag);
+#define zmw_enter_critical_section(dev) spin_lock_irqsave(	\
+	&(((struct usbdrv_private *)(dev->priv))->cs_lock), irqFlag);
 
 /* leave critical section */
 #define zmw_leave_critical_section(dev) \
-        spin_unlock_irqrestore(&(((struct usbdrv_private *)(dev->priv))->cs_lock), irqFlag);
+	spin_unlock_irqrestore(&(((struct usbdrv_private *)	\
+			(dev->priv))->cs_lock), irqFlag);
 #else
 #define zmw_get_wlan_dev(dev)    struct zsWlanDev *wd = zfwGetWlanDev(dev);
 
@@ -52,31 +54,29 @@
 #define zmw_declare_for_critical_section()
 
 /* Enter critical section */
-#define zmw_enter_critical_section(dev) \
-        zfwEnterCriticalSection(dev);
+#define zmw_enter_critical_section(dev) zfwEnterCriticalSection(dev);
 
 /* leave critical section */
-#define zmw_leave_critical_section(dev) \
-        zfwLeaveCriticalSection(dev);
+#define zmw_leave_critical_section(dev) zfwLeaveCriticalSection(dev);
 #endif
 
 /***** Byte order converting *****/
 #ifdef ZM_CONFIG_BIG_ENDIAN
-#define zmw_cpu_to_le32(v)    (((v & 0xff000000) >> 24) | \
-                               ((v & 0x00ff0000) >> 8)  | \
-                               ((v & 0x0000ff00) << 8)  | \
-                               ((v & 0x000000ff) << 24))
+#define zmw_cpu_to_le32(v)    	(((v & 0xff000000) >> 24) | 	\
+				((v & 0x00ff0000) >> 8)  | 	\
+				((v & 0x0000ff00) << 8)  | 	\
+				((v & 0x000000ff) << 24))
 
-#define zmw_le32_to_cpu(v)    (((v & 0xff000000) >> 24) | \
-                               ((v & 0x00ff0000) >> 8)  | \
-                               ((v & 0x0000ff00) << 8)  | \
-                               ((v & 0x000000ff) << 24))
+#define zmw_le32_to_cpu(v)    (((v & 0xff000000) >> 24) | 	\
+				((v & 0x00ff0000) >> 8) | 	\
+				((v & 0x0000ff00) << 8) | 	\
+				((v & 0x000000ff) << 24))
 
 #define zmw_cpu_to_le16(v)    (((v & 0xff00) >> 8) | \
-                               ((v & 0x00ff) << 8))
+				((v & 0x00ff) << 8))
 
 #define zmw_le16_to_cpu(v)    (((v & 0xff00) >> 8) | \
-                               ((v & 0x00ff) << 8))
+				((v & 0x00ff) << 8))
 #else
 #define zmw_cpu_to_le32(v)    (v)
 #define zmw_le32_to_cpu(v)    (v)
@@ -88,33 +88,41 @@
 /* Called to read/write buffer */
 #ifndef ZM_HALPLUS_LOCK
 
-#define zmw_buf_readb(dev, buf, offset) *(u8_t*)((u8_t*)buf->data+offset)
-#define zmw_buf_readh(dev, buf, offset) zmw_cpu_to_le16(*(u16_t*)((u8_t*)buf->data+offset))
-#define zmw_buf_writeb(dev, buf, offset, value) *(u8_t*)((u8_t*)buf->data+offset) = value
-#define zmw_buf_writeh(dev, buf, offset, value) *(u16_t*)((u8_t*)buf->data+offset) = zmw_cpu_to_le16(value)
-#define zmw_buf_get_buffer(dev, buf) (u8_t*)(buf->data)
+#define zmw_buf_readb(dev, buf, offset) (*(u8_t *)((u8_t *)buf->data+offset))
+#define zmw_buf_readh(dev, buf, offset) zmw_cpu_to_le16(*(u16_t *)	\
+					((u8_t *)buf->data+offset))
+#define zmw_buf_writeb(dev, buf, offset, value) (*(u8_t *)		\
+					((u8_t *)buf->data+offset) = value)
+#define zmw_buf_writeh(dev, buf, offset, value) (*(u16_t *)		\
+			((u8_t *)buf->data+offset) = zmw_cpu_to_le16(value))
+#define zmw_buf_get_buffer(dev, buf) (u8_t *)(buf->data)
 
 #else
 
 #define zmw_buf_readb(dev, buf, offset) zfwBufReadByte(dev, buf, offset)
 #define zmw_buf_readh(dev, buf, offset) zfwBufReadHalfWord(dev, buf, offset)
-#define zmw_buf_writeb(dev, buf, offset, value) zfwBufWriteByte(dev, buf, offset, value)
-#define zmw_buf_writeh(dev, buf, offset, value) zfwBufWriteHalfWord(dev, buf, offset, value)
+#define zmw_buf_writeb(dev, buf, offset, value) 			\
+			zfwBufWriteByte(dev, buf, offset, value)
+#define zmw_buf_writeh(dev, buf, offset, value)				\
+			zfwBufWriteHalfWord(dev, buf, offset, value)
 #define zmw_buf_get_buffer(dev, buf) zfwGetBuffer(dev, buf)
 
 #endif
 
 /***** Debug message *****/
 #if 0
-#define zm_debug_msg0(msg) printk("%s:%s\n", __func__, msg);
-#define zm_debug_msg1(msg, val) printk("%s:%s%ld\n", __func__, \
-        msg, (u32_t)val);
-#define zm_debug_msg2(msg, val) printk("%s:%s%lxh\n", __func__, \
-        msg, (u32_t)val);
-#define zm_debug_msg_s(msg, val) printk("%s:%s%s\n", __func__, \
-        msg, val);
-#define zm_debug_msg_p(msg, val1, val2) printk("%s:%s%01ld.%02ld\n", __func__, \
-        msg, (val1/val2), (((val1*100)/val2)%100));
+#define zm_debug_msg0(msg) printk(KERN_DEBUG "%s:%s\n", __func__, msg);
+#define zm_debug_msg1(msg, val) printk(KERN_DEBUG "%s:%s%ld\n", __func__, \
+	msg, (u32_t)val);
+#define zm_debug_msg2(msg, val) printk(KERN_DEBUG "%s:%s%lxh\n", __func__, \
+	msg, (u32_t)val);
+#define zm_debug_msg_s(msg, val) printk(KERN_DEBUG "%s:%s%s\n", __func__, \
+	msg, val);
+#define zm_debug_msg_p(msg, val1, val2) do { 			\
+			printk(KERN_DEBUG "%s:%s%01ld.%02ld\n",	\
+						__func__, 	\
+			msg, (val1/val2), (((val1*100)/val2)%100));
+			} while (0)
 #define zm_dbg(S) printk S
 #else
 #define zm_debug_msg0(msg)
@@ -125,10 +133,10 @@
 #define zm_dbg(S)
 #endif
 
-#define zm_assert(expr) if(!(expr)) {                           \
-        printk( "Atheors Assertion failed! %s,%s,%s,line=%d\n",   \
-        #expr,__FILE__,__func__,__LINE__);                  \
-        }
+#define zm_assert(expr) if (!(expr)) {					 \
+	printk(KERN_ERR "Atheors Assertion failed! %s, %s, %s,line=%d\n",\
+		#expr, __FILE__, __func__, __LINE__);			 \
+	}
 
 #define DbgPrint printk
 
diff --git a/drivers/staging/otus/usbdrv.c b/drivers/staging/otus/usbdrv.c
index 48aa30a62164..b0adbc8b2dc2 100644
--- a/drivers/staging/otus/usbdrv.c
+++ b/drivers/staging/otus/usbdrv.c
@@ -111,7 +111,7 @@ extern u8_t zfLnxCreateThread(zdev_t *dev);
 
 /* Definition of Wireless Extension */
 
-//wireless extension helper functions
+/* wireless extension helper functions */
 extern int usbdrv_ioctl_setessid(struct net_device *dev, struct iw_point *erq);
 extern int usbdrv_ioctl_setrts(struct net_device *dev, struct iw_param *rrq);
 /* Wireless Extension Handler functions */
@@ -282,8 +282,8 @@ static struct iw_handler_def p80211wext_handler_def = {
 };
 
 /* WDS */
-//struct zsWdsStruct wds[ZM_WDS_PORT_NUMBER];
-//void zfInitWdsStruct(void);
+/* struct zsWdsStruct wds[ZM_WDS_PORT_NUMBER]; */
+/* void zfInitWdsStruct(void);	*/
 
 /* VAP */
 struct zsVapStruct vap[ZM_VAP_PORT_NUMBER];
@@ -314,13 +314,11 @@ irqreturn_t usbdrv_intr(int irq, void *dev_inst, struct pt_regs *regs)
         return IRQ_NONE;
 
     /* the device is closed, don't continue or else bad things may happen. */
-    if (!netif_running(dev)) {
+    if (!netif_running(dev))
         return IRQ_NONE;
-    }
 
-    if (macp->driver_isolated) {
+    if (macp->driver_isolated)
         return IRQ_NONE;
-    }
 
 #if (WLAN_HOSTIF == WLAN_PCI)
     //zfiIsrPci(dev);
@@ -340,9 +338,11 @@ int usbdrv_open(struct net_device *dev)
 
     printk("Enter open()\n");
 
-//#ifndef CONFIG_SMP
-//    read_lock(&(macp->isolate_lock));
-//#endif
+/*
+ * #ifndef CONFIG_SMP
+ *   read_lock(&(macp->isolate_lock));
+ * #endif
+ */
     if (macp->driver_isolated) {
         rc = -EBUSY;
         goto exit;
@@ -393,11 +393,11 @@ int usbdrv_open(struct net_device *dev)
     dev->dev_addr[4] = addr[4];
     dev->dev_addr[5] = addr[5];
 #endif
-    //zfwMacAddressNotify() will be called to setup dev->dev_addr[]
+    /* zfwMacAddressNotify() will be called to setup dev->dev_addr[] */
 
     zfLnxCreateThread(dev);
 
-    mod_timer(&(macp->hbTimer10ms), jiffies + (1*HZ)/100);   //10 ms
+    mod_timer(&(macp->hbTimer10ms), jiffies + (1*HZ)/100);   /* 10 ms */
 
     netif_carrier_on(dev);
 
@@ -425,15 +425,15 @@ int usbdrv_open(struct net_device *dev)
 
     #if ZM_SHARE_AUTH == 1
     zfiWlanSetAuthenticationMode(dev, 1);
-    #endif //#if ZM_SHARE_AUTH == 1
-  #endif //#if ZM_WEP_MOME == 1
+    #endif /* #if ZM_SHARE_AUTH == 1 */
+  #endif /* #if ZM_WEP_MOME == 1 */
 
 #elif ZM_PIBSS_MODE == 1
     zfiWlanSetWlanMode(dev, ZM_MODE_PSEUDO);
 #else
     zfiWlanSetWlanMode(dev, ZM_MODE_INFRASTRUCTURE);
 #endif
-    //zfiWlanSetChannel(dev, ZM_CHANNEL, FALSE);
+    /* zfiWlanSetChannel(dev, ZM_CHANNEL, FALSE); */
     zfiWlanSetFrequency(dev, 2462000, FALSE);
     zfiWlanSetRtsThreshold(dev, 32767);
     zfiWlanSetFragThreshold(dev, 0);
@@ -720,7 +720,7 @@ void zfLnxInitVapStruct(void)
 {
     u16_t i;
 
-    for (i=0; i<ZM_VAP_PORT_NUMBER; i++)
+    for (i = 0; i < ZM_VAP_PORT_NUMBER; i++)
     {
         vap[i].dev = NULL;
         vap[i].openFlag = 0;
@@ -1128,8 +1128,7 @@ u8_t zfLnxClearStructs(struct net_device *dev)
 
     printk(KERN_ERR "TxQCnt: %d\n", TxQCnt);
 
-    for(ii = 0; ii < TxQCnt; ii++)
-    {
+    for (ii = 0; ii < TxQCnt; ii++) {
         UsbTxQ_t *TxQ = zfLnxGetUsbTxBuffer(dev);
 
         printk(KERN_ERR "dev_kfree_skb_any\n");
diff --git a/drivers/staging/otus/usbdrv.h b/drivers/staging/otus/usbdrv.h
index 78004062caba..330d1b95cb88 100644
--- a/drivers/staging/otus/usbdrv.h
+++ b/drivers/staging/otus/usbdrv.h
@@ -45,7 +45,7 @@
 #include "oal_dt.h"
 #include "oal_marc.h"
 #include "80211core/pub_zfi.h"
-//#include "pub_zfw.h"
+/* #include "pub_zfw.h"	*/
 #include "80211core/pub_usb.h"
 
 #include <linux/usb.h>
@@ -86,8 +86,7 @@ struct driver_stats {
 #define ZM_MAX_RX_URB_NUM                   16
 #define ZM_MAX_TX_BUF_NUM                   128
 
-typedef struct UsbTxQ
-{
+typedef struct UsbTxQ {
     zbuf_t *buf;
     u8_t hdr[80];
     u16_t hdrlen;
@@ -100,17 +99,16 @@ typedef struct UsbTxQ
 
 
 struct zdap_ioctl {
-	u16_t cmd;                /* Command to run */
-	u32_t addr;                /* Length of the data buffer */
-	u32_t value;              /* Pointer to the data buffer */
+	u16_t cmd;		  /* Command to run */
+	u32_t addr;		  /* Length of the data buffer */
+	u32_t value;		/* Pointer to the data buffer */
 	u8_t	data[0x100];
 };
 
 #define ZM_OAL_MAX_STA_SUPPORT 16
 
-struct usbdrv_private
-{
-	//linux used
+struct usbdrv_private {
+	/* linux used */
 	struct net_device 	*device;
 #if (WLAN_HOSTIF == WLAN_PCI)
 	struct pci_dev 		*pdev;
@@ -121,7 +119,7 @@ struct usbdrv_private
 #endif
 	struct driver_stats drv_stats;
 	char ifname[IFNAMSIZ];
-	int	                using_dac;
+	int			  using_dac;
 	u8_t			rev_id;		/* adapter PCI revision ID */
 	rwlock_t 		isolate_lock;
     spinlock_t      cs_lock;
@@ -130,78 +128,76 @@ struct usbdrv_private
 	void			*regp;
 #endif
 
-        /* timer for heart beat */
+	 /* timer for heart beat */
 	struct timer_list hbTimer10ms;
 
 	/* For driver core */
-	void* wd;
+	void *wd;
 
 #if (WLAN_HOSTIF == WLAN_USB)
-	u8_t                    txUsbBuf[ZM_MAX_TX_URB_NUM][ZM_USB_TX_BUF_SIZE];
-	u8_t                    regUsbReadBuf[ZM_USB_REG_MAX_BUF_SIZE];
-	u8_t                    regUsbWriteBuf[ZM_USB_REG_MAX_BUF_SIZE];
+	u8_t		      txUsbBuf[ZM_MAX_TX_URB_NUM][ZM_USB_TX_BUF_SIZE];
+	u8_t		      regUsbReadBuf[ZM_USB_REG_MAX_BUF_SIZE];
+	u8_t		      regUsbWriteBuf[ZM_USB_REG_MAX_BUF_SIZE];
 	urb_t			*WlanTxDataUrb[ZM_MAX_TX_URB_NUM];
 	urb_t			*WlanRxDataUrb[ZM_MAX_RX_URB_NUM];
 	urb_t			*RegOutUrb;
 	urb_t			*RegInUrb;
-	UsbTxQ_t                UsbTxBufQ[ZM_MAX_TX_BUF_NUM];
-	zbuf_t                  *UsbRxBufQ[ZM_MAX_RX_URB_NUM];
-        u16_t                   TxBufHead;
-        u16_t                   TxBufTail;
-        u16_t                   TxBufCnt;
-        u16_t                   TxUrbHead;
-        u16_t                   TxUrbTail;
-        u16_t                   TxUrbCnt;
-        u16_t                   RxBufHead;
-        u16_t                   RxBufTail;
-        u16_t                   RxBufCnt;
+	UsbTxQ_t		  UsbTxBufQ[ZM_MAX_TX_BUF_NUM];
+	zbuf_t		    *UsbRxBufQ[ZM_MAX_RX_URB_NUM];
+	 u16_t		     TxBufHead;
+	 u16_t		     TxBufTail;
+	 u16_t		     TxBufCnt;
+	 u16_t		     TxUrbHead;
+	 u16_t		     TxUrbTail;
+	 u16_t		     TxUrbCnt;
+	 u16_t		     RxBufHead;
+	 u16_t		     RxBufTail;
+	 u16_t		     RxBufCnt;
 #endif
 
 #if ZM_USB_STREAM_MODE == 1
-        zbuf_t                  *reamin_buf;
+	 zbuf_t		    *reamin_buf;
 #endif
 
 #ifdef ZM_HOSTAPD_SUPPORT
-        struct athr_wlan_param  athr_wpa_req;
+	 struct athr_wlan_param  athr_wpa_req;
 #endif
-        struct sock             *netlink_sk;
-        u8_t            DeviceOpened; //CWYang(+)
-        u8_t            supIe[50];
-        u8_t            supLen;
-        struct ieee80211req_wpaie stawpaie[ZM_OAL_MAX_STA_SUPPORT];
-        u8_t            forwardMgmt;
-
-        struct zfCbUsbFuncTbl usbCbFunctions;
-
-        /* For keventd */
-        u32_t                   flags;
-        unsigned long           kevent_flags;
-        u16_t                   kevent_ready;
-
-        struct semaphore        ioctl_sem;
-        struct work_struct      kevent;
-        wait_queue_head_t       wait_queue_event;
+	 struct sock	      *netlink_sk;
+	 u8_t	     DeviceOpened; /* CWYang(+) */
+	 u8_t	     supIe[50];
+	 u8_t	     supLen;
+	 struct ieee80211req_wpaie stawpaie[ZM_OAL_MAX_STA_SUPPORT];
+	 u8_t	     forwardMgmt;
+
+	 struct zfCbUsbFuncTbl usbCbFunctions;
+
+	 /* For keventd */
+	 u32_t		     flags;
+	 unsigned long	    kevent_flags;
+	 u16_t		     kevent_ready;
+
+	 struct semaphore	 ioctl_sem;
+	 struct work_struct      kevent;
+	 wait_queue_head_t	wait_queue_event;
 #ifdef ZM_HALPLUS_LOCK
-        unsigned long           hal_irqFlag;
+	 unsigned long	    hal_irqFlag;
 #endif
-        u16_t                   adapterState;
+	 u16_t		     adapterState;
 };
 
 /* WDS */
 #define ZM_WDS_PORT_NUMBER  6
 
-struct zsWdsStruct
-{
-    struct net_device* dev;
+struct zsWdsStruct {
+    struct net_device *dev;
     u16_t openFlag;
 };
 
 /* VAP */
 #define ZM_VAP_PORT_NUMBER  7
 
-struct zsVapStruct
-{
-    struct net_device* dev;
+struct zsVapStruct {
+    struct net_device *dev;
     u16_t openFlag;
 };
 
@@ -215,25 +211,25 @@ struct zsVapStruct
 #define ZM_IOCTL_RXD_DUMP 			0x07
 #define ZM_IOCTL_MEM_READ			0x0B
 #define ZM_IOCTL_MEM_WRITE			0x0C
-#define ZM_IOCTL_DMA_TEST           0x10
-#define ZM_IOCTL_REG_TEST           0x11
-#define ZM_IOCTL_TEST               0x80
-#define ZM_IOCTL_TALLY              0x81 //CWYang(+)
-#define ZM_IOCTL_RTS                0xA0
-#define ZM_IOCTL_MIX_MODE           0xA1
-#define ZM_IOCTL_FRAG               0xA2
-#define ZM_IOCTL_SCAN               0xA3
-#define ZM_IOCTL_KEY                0xA4
-#define ZM_IOCTL_RATE               0xA5
-#define ZM_IOCTL_ENCRYPTION_MODE    0xA6
-#define ZM_IOCTL_GET_TXCNT          0xA7
-#define ZM_IOCTL_GET_DEAGG_CNT      0xA8
-#define ZM_IOCTL_DURATION_MODE      0xA9
-#define ZM_IOCTL_SET_AES_KEY        0xAA
-#define ZM_IOCTL_SET_AES_MODE       0xAB
-#define ZM_IOCTL_SIGNAL_STRENGTH    0xAC //CWYang(+)
-#define ZM_IOCTL_SIGNAL_QUALITY     0xAD //CWYang(+)
-#define ZM_IOCTL_SET_PIBSS_MODE     0xAE
+#define ZM_IOCTL_DMA_TEST	    		0x10
+#define ZM_IOCTL_REG_TEST	    		0x11
+#define ZM_IOCTL_TEST		 		0x80
+#define ZM_IOCTL_TALLY				0x81 /* CWYang(+) */
+#define ZM_IOCTL_RTS				0xA0
+#define ZM_IOCTL_MIX_MODE			0xA1
+#define ZM_IOCTL_FRAG				0xA2
+#define ZM_IOCTL_SCAN				0xA3
+#define ZM_IOCTL_KEY				0xA4
+#define ZM_IOCTL_RATE				0xA5
+#define ZM_IOCTL_ENCRYPTION_MODE		0xA6
+#define ZM_IOCTL_GET_TXCNT			0xA7
+#define ZM_IOCTL_GET_DEAGG_CNT    		0xA8
+#define ZM_IOCTL_DURATION_MODE			0xA9
+#define ZM_IOCTL_SET_AES_KEY			0xAA
+#define ZM_IOCTL_SET_AES_MODE			0xAB
+#define ZM_IOCTL_SIGNAL_STRENGTH		0xAC /* CWYang(+) */
+#define ZM_IOCTL_SIGNAL_QUALITY			0xAD /* CWYang(+) */
+#define ZM_IOCTL_SET_PIBSS_MODE			0xAE
 
 #define	ZDAPIOCTL				SIOCDEVPRIVATE
 
diff --git a/drivers/staging/otus/wrap_buf.c b/drivers/staging/otus/wrap_buf.c
index a0f677a52616..d7ee0b454e91 100644
--- a/drivers/staging/otus/wrap_buf.c
+++ b/drivers/staging/otus/wrap_buf.c
@@ -34,9 +34,9 @@
 
 
 /* Called to allocate buffer, must return a continue buffer space */
-zbuf_t* zfwBufAllocate(zdev_t* dev, u16_t len)
+zbuf_t *zfwBufAllocate(zdev_t *dev, u16_t len)
 {
-    zbuf_t* buf;
+    zbuf_t *buf;
 
     /* Allocate SKB for packet*/
     buf = dev_alloc_skb(len);
@@ -46,15 +46,15 @@ zbuf_t* zfwBufAllocate(zdev_t* dev, u16_t len)
 
 
 /* Called to free buffer, replace below 3 functions */
-void zfwBufFree(zdev_t* dev, zbuf_t* buf, u16_t status)
+void zfwBufFree(zdev_t *dev, zbuf_t *buf, u16_t status)
 {
     dev_kfree_skb_any(buf);
 }
 
 /* Called to adjust buffer size and head pointer */
-u16_t zfwBufRemoveHead(zdev_t* dev, zbuf_t* buf, u16_t size)
+u16_t zfwBufRemoveHead(zdev_t *dev, zbuf_t *buf, u16_t size)
 {
-    //zm_assert(buf->len > size);
+    /* zm_assert(buf->len > size); */
 
     buf->data += size;
     buf->len -= size;
@@ -68,7 +68,7 @@ u16_t zfwBufRemoveHead(zdev_t* dev, zbuf_t* buf, u16_t size)
 /* Used to chain Rx buffer to form a frame. if the prepared Rx buffer  */
 /* is greater than an ethernet frame(1518+32 byte), then this function    */
 /* will only be called with head=NULL.                                 */
-u16_t zfwBufChain(zdev_t* dev, zbuf_t** head, zbuf_t* tail)
+u16_t zfwBufChain(zdev_t *dev, zbuf_t **head, zbuf_t *tail)
 {
 
     *head = tail;
@@ -77,7 +77,7 @@ u16_t zfwBufChain(zdev_t* dev, zbuf_t** head, zbuf_t* tail)
 
 
 /* Called when doing infra-bss forwarding */
-u16_t zfwBufCopy(zdev_t* dev, zbuf_t* dst, zbuf_t* src)
+u16_t zfwBufCopy(zdev_t *dev, zbuf_t *dst, zbuf_t *src)
 {
     memcpy(dst->data, src->data, src->len);
     dst->tail = dst->data;
@@ -87,7 +87,7 @@ u16_t zfwBufCopy(zdev_t* dev, zbuf_t* dst, zbuf_t* src)
 
 
 /* Called to adjust buffer size and tail pointer */
-u16_t zfwBufSetSize(zdev_t* dev, zbuf_t* buf, u16_t size)
+u16_t zfwBufSetSize(zdev_t *dev, zbuf_t *buf, u16_t size)
 {
 #ifdef NET_SKBUFF_DATA_USES_OFFSET
     buf->tail = 0;
@@ -101,11 +101,11 @@ u16_t zfwBufSetSize(zdev_t* dev, zbuf_t* buf, u16_t size)
     return 0;
 }
 
-u16_t zfwBufGetSize(zdev_t* dev, zbuf_t* buf)
+u16_t zfwBufGetSize(zdev_t *dev, zbuf_t *buf)
 {
     return buf->len;
 }
 
-void zfwCopyBufContext(zdev_t* dev, zbuf_t* source, zbuf_t* dst)
+void zfwCopyBufContext(zdev_t *dev, zbuf_t *source, zbuf_t *dst)
 {
 }
diff --git a/drivers/staging/otus/wrap_dbg.c b/drivers/staging/otus/wrap_dbg.c
index d47e9ab9179a..ee0ee1532601 100644
--- a/drivers/staging/otus/wrap_dbg.c
+++ b/drivers/staging/otus/wrap_dbg.c
@@ -29,70 +29,67 @@
 #include <linux/netlink.h>
 #include <net/iw_handler.h>
 
-void zfwDumpBuf(zdev_t* dev, zbuf_t* buf)
+void zfwDumpBuf(zdev_t *dev, zbuf_t *buf)
 {
-    u16_t i;
-
-    for (i=0; i<buf->len; i++)
-    {
-        printk("%02x ", *(((u8_t*)buf->data)+i));
-        if ((i&0xf)==0xf)
-        {
-            printk("\n");
-        }
-    }
-    printk("\n");
+	u16_t i;
+
+	for (i = 0; i < buf->len; i++) {
+		printk(KERN_DEBUG "%02x ", *(((u8_t *)buf->data)+i));
+		if ((i & 0xf) == 0xf)
+			printk(KERN_DEBUG "\n");
+	}
+	printk(KERN_DEBUG "\n");
 }
 
 
-void zfwDbgReadRegDone(zdev_t* dev, u32_t addr, u32_t val)
+void zfwDbgReadRegDone(zdev_t *dev, u32_t addr, u32_t val)
 {
-    printk("Read addr:%x = %x\n", addr, val);
+	printk(KERN_DEBUG "Read addr:%x = %x\n", addr, val);
 }
 
-void zfwDbgWriteRegDone(zdev_t* dev, u32_t addr, u32_t val)
+void zfwDbgWriteRegDone(zdev_t *dev, u32_t addr, u32_t val)
 {
-    printk("Write addr:%x = %x\n", addr, val);
+	printk(KERN_DEBUG "Write addr:%x = %x\n", addr, val);
 }
 
-void zfwDbgReadTallyDone(zdev_t* dev)
+void zfwDbgReadTallyDone(zdev_t *dev)
 {
-    //printk("Read Tall Done\n");
+	/* printk(KERN_DEBUG "Read Tall Done\n"); */
 }
 
-void zfwDbgWriteEepromDone(zdev_t* dev, u32_t addr, u32_t val)
+void zfwDbgWriteEepromDone(zdev_t *dev, u32_t addr, u32_t val)
 {
 }
 
-void zfwDbgQueryHwTxBusyDone(zdev_t* dev, u32_t val)
+void zfwDbgQueryHwTxBusyDone(zdev_t *dev, u32_t val)
 {
 }
 
-//For Evl ++
-void zfwDbgReadFlashDone(zdev_t* dev, u32_t addr, u32_t* rspdata, u32_t datalen)
+/* For Evl ++ */
+void zfwDbgReadFlashDone(zdev_t *dev, u32_t addr, u32_t *rspdata, u32_t datalen)
 {
-    printk("Read Flash addr:%x length:%x\n", addr, datalen);
+	printk(KERN_DEBUG "Read Flash addr:%x length:%x\n", addr, datalen);
 }
 
-void zfwDbgProgrameFlashDone(zdev_t* dev)
+void zfwDbgProgrameFlashDone(zdev_t *dev)
 {
-    printk("Program Flash Done\n");
+	printk(KERN_DEBUG "Program Flash Done\n");
 }
 
-void zfwDbgProgrameFlashChkDone(zdev_t* dev)
+void zfwDbgProgrameFlashChkDone(zdev_t *dev)
 {
-    printk("Program Flash Done\n");
+	printk(KERN_DEBUG "Program Flash Done\n");
 }
 
-void zfwDbgGetFlashChkSumDone(zdev_t* dev, u32_t* rspdata)
+void zfwDbgGetFlashChkSumDone(zdev_t *dev, u32_t *rspdata)
 {
-    printk("Get Flash ChkSum Done\n");
+	printk(KERN_DEBUG "Get Flash ChkSum Done\n");
 }
 
-void zfwDbgDownloadFwInitDone(zdev_t* dev)
+void zfwDbgDownloadFwInitDone(zdev_t *dev)
 {
-    printk("Download FW Init Done\n");
+	printk(KERN_DEBUG "Download FW Init Done\n");
 }
-//For Evl --
+/* For Evl -- */
 
 /* Leave an empty line below to remove warning message on some compiler */
diff --git a/drivers/staging/otus/wrap_ev.c b/drivers/staging/otus/wrap_ev.c
index bcda0b9673dc..29f560372555 100644
--- a/drivers/staging/otus/wrap_ev.c
+++ b/drivers/staging/otus/wrap_ev.c
@@ -32,202 +32,214 @@
 
 
 /***** Management *****/
-u16_t zfLnxAuthNotify(zdev_t* dev, u16_t* macAddr)
+u16_t zfLnxAuthNotify(zdev_t *dev, u16_t *macAddr)
 {
-    return 0;
+	return 0;
 }
 
-u16_t zfLnxAsocNotify(zdev_t* dev, u16_t* macAddr, u8_t* body, u16_t bodySize, u16_t port)
+u16_t zfLnxAsocNotify(zdev_t *dev, u16_t *macAddr, u8_t *body, u16_t bodySize,
+			 u16_t port)
 {
-//#ifdef ZM_HOSTAPD_SUPPORT
-    struct usbdrv_private *macp = dev->ml_priv;
-    union iwreq_data wreq;
-    u8_t *addr = (u8_t *) macAddr;
-    u16_t i, j;
-
-    memset(&wreq, 0, sizeof(wreq));
-    memcpy(wreq.addr.sa_data, macAddr, ETH_ALEN);
-    wreq.addr.sa_family = ARPHRD_ETHER;
-    printk(KERN_DEBUG "join_event of MAC: %02x:%02x:%02x:%02x:%02x:%02x\n",
-            addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]);
-
-    for(i = 0; i < ZM_OAL_MAX_STA_SUPPORT; i++)
-    {
-        for(j = 0; j < IEEE80211_ADDR_LEN; j++)
-        {
-            if ((macp->stawpaie[i].wpa_macaddr[j] != 0) &&
-                (macp->stawpaie[i].wpa_macaddr[j] != addr[j]))
-                break;
-        }
-        if (j == 6)
-            break;
-    }
-    if (i < ZM_OAL_MAX_STA_SUPPORT)
-    {
-        //printk("zfwAsocNotify - store wpa ie in macp, index = %d\n", i);
-        memcpy(macp->stawpaie[i].wpa_macaddr, macAddr, IEEE80211_ADDR_LEN);
-        memcpy(macp->stawpaie[i].wpa_ie, body, bodySize);
-    }
-    //if(macp->cardSetting.BssType == INFRASTRUCTURE_BSS) {
-    //            //wireless_send_event(macp->device, SIOCGIWSCAN, &wreq, NULL);
-    //    wireless_send_event(macp->device, SIOCGIWAP, &wreq, NULL);
-    //}
-    //else if(macp->cardSetting.BssType == AP_BSS) {
-//        if (port == 0)
-//        {
-            wireless_send_event(dev, IWEVREGISTERED, &wreq, NULL);
-//        }
-//        else
-//        {
-//            /* Check whether the VAP device is valid */
-//            if (vap[port].dev != NULL)
-//            {
-//                wireless_send_event(vap[port].dev, IWEVREGISTERED, &wreq, NULL);
-//            }
-//            else
-//            {
-//                printk(KERN_ERR "Can' find a valid VAP device, port: %d\n", port);
-//            }
-//        }
-    //}
-//#endif
-
-    return 0;
+/* #ifdef ZM_HOSTAPD_SUPPORT	*/
+	struct usbdrv_private *macp = dev->ml_priv;
+	union iwreq_data wreq;
+	u8_t *addr = (u8_t *) macAddr;
+	u16_t i, j;
+
+	memset(&wreq, 0, sizeof(wreq));
+	memcpy(wreq.addr.sa_data, macAddr, ETH_ALEN);
+	wreq.addr.sa_family = ARPHRD_ETHER;
+	printk(KERN_DEBUG "join_event of MAC: %02x:%02x:%02x:%02x:%02x:%02x\n",
+			addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]);
+
+	for (i = 0; i < ZM_OAL_MAX_STA_SUPPORT; i++) {
+		for (j = 0; j < IEEE80211_ADDR_LEN; j++) {
+			if ((macp->stawpaie[i].wpa_macaddr[j] != 0) &&
+				(macp->stawpaie[i].wpa_macaddr[j] != addr[j]))
+				break;
+		}
+		if (j == 6)
+			break;
+	}
+	if (i < ZM_OAL_MAX_STA_SUPPORT) {
+		/*
+		 * printk("zfwAsocNotify - store wpa ie in macp,
+		 * 	index = %d\n", i);
+		 */
+		memcpy(macp->stawpaie[i].wpa_macaddr, macAddr,
+			IEEE80211_ADDR_LEN);
+		memcpy(macp->stawpaie[i].wpa_ie, body, bodySize);
+	}
+	/*
+	 * if(macp->cardSetting.BssType == INFRASTRUCTURE_BSS) {
+	 * wireless_send_event(macp->device, SIOCGIWSCAN, &wreq, NULL);
+	 *	wireless_send_event(macp->device, SIOCGIWAP, &wreq, NULL);
+	 * }
+	 * else if(macp->cardSetting.BssType == AP_BSS) {
+	 *	if (port == 0)
+	 *	{
+	 */
+			wireless_send_event(dev, IWEVREGISTERED, &wreq, NULL);
+	/*
+	 *	}
+	 *	else
+	 *	{
+	 *		 Check whether the VAP device is valid
+	 *		if (vap[port].dev != NULL)
+	 *		{
+	 *			wireless_send_event(vap[port].dev,
+	 *					IWEVREGISTERED, &wreq, NULL);
+	 *		}
+	 *		else
+	 *		{
+	 *			printk(KERN_ERR "Can' find a valid VAP device,
+	 *				 port: %d\n", port);
+	 *		}
+	 *	}
+	 * }
+	 */
+/* #endif	*/
+
+	return 0;
 }
 
 
 /* Notification that a STA is disassociated from AP */
 /* AP mode only */
-u16_t zfLnxDisAsocNotify(zdev_t* dev, u8_t* macAddr, u16_t port)
+u16_t zfLnxDisAsocNotify(zdev_t *dev, u8_t *macAddr, u16_t port)
 {
-    union iwreq_data wreq;
-    u8_t *addr = (u8_t *) macAddr;
+	union iwreq_data wreq;
+	u8_t *addr = (u8_t *) macAddr;
 
-    memset(&wreq, 0, sizeof(wreq));
-    memcpy(wreq.addr.sa_data, macAddr, ETH_ALEN);
-    wreq.addr.sa_family = ARPHRD_ETHER;
-    printk(KERN_DEBUG "zfwDisAsocNotify(), MAC: %02x:%02x:%02x:%02x:%02x:%02x\n",
-            addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]);
+	memset(&wreq, 0, sizeof(wreq));
+	memcpy(wreq.addr.sa_data, macAddr, ETH_ALEN);
+	wreq.addr.sa_family = ARPHRD_ETHER;
+	printk(KERN_DEBUG "zfwDisAsocNotify(), MAC: %02x:%02x:%02x:%02x:%02x:%02x\n",
+			addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]);
 
 
-    return 0;
+	return 0;
 }
 
 /* Notification that a STA is connect to AP */
 /* AP mode only */
-u16_t zfLnxApConnectNotify(zdev_t* dev, u8_t* macAddr, u16_t port)
+u16_t zfLnxApConnectNotify(zdev_t *dev, u8_t *macAddr, u16_t port)
 {
-    union iwreq_data wreq;
-    u8_t *addr = (u8_t *) macAddr;
+	union iwreq_data wreq;
+	u8_t *addr = (u8_t *) macAddr;
 
-    memset(&wreq, 0, sizeof(wreq));
-    memcpy(wreq.addr.sa_data, macAddr, ETH_ALEN);
-    wreq.addr.sa_family = ARPHRD_ETHER;
-    printk(KERN_DEBUG "zfwApConnectNotify(), MAC: %02x:%02x:%02x:%02x:%02x:%02x\n",
-            addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]);
+	memset(&wreq, 0, sizeof(wreq));
+	memcpy(wreq.addr.sa_data, macAddr, ETH_ALEN);
+	wreq.addr.sa_family = ARPHRD_ETHER;
+	printk(KERN_DEBUG "zfwApConnectNotify(), MAC: %02x:%02x:%02x:%02x:%02x:%02x\n",
+			addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]);
 
 
-    return 0;
+	return 0;
 }
 
 
 
-void zfLnxConnectNotify(zdev_t* dev, u16_t status, u16_t* bssid)
+void zfLnxConnectNotify(zdev_t *dev, u16_t status, u16_t *bssid)
 {
-    union iwreq_data wreq;
-    u8_t *addr = (u8_t *) bssid;
-    struct usbdrv_private *macp = dev->ml_priv;
-
-    if (bssid != NULL)
-    {
-        memset(&wreq, 0, sizeof(wreq));
-        if (status == ZM_STATUS_MEDIA_CONNECT)
-            memcpy(wreq.addr.sa_data, bssid, ETH_ALEN);
-        wreq.addr.sa_family = ARPHRD_ETHER;
-
-        if (status == ZM_STATUS_MEDIA_CONNECT)
-        {
+	union iwreq_data wreq;
+	u8_t *addr = (u8_t *) bssid;
+	struct usbdrv_private *macp = dev->ml_priv;
+
+	if (bssid != NULL) {
+		memset(&wreq, 0, sizeof(wreq));
+		if (status == ZM_STATUS_MEDIA_CONNECT)
+			memcpy(wreq.addr.sa_data, bssid, ETH_ALEN);
+		wreq.addr.sa_family = ARPHRD_ETHER;
+
+		if (status == ZM_STATUS_MEDIA_CONNECT) {
 #ifdef ZM_CONFIG_BIG_ENDIAN
-            printk(KERN_DEBUG "Connected to AP, MAC: %02x:%02x:%02x:%02x:%02x:%02x\n",
-                    addr[1], addr[0], addr[3], addr[2], addr[5], addr[4]);
+			printk(KERN_DEBUG "Connected to AP, MAC:"
+				"%02x:%02x:%02x:%02x:%02x:%02x\n",
+				addr[1], addr[0], addr[3], addr[2],
+				addr[5], addr[4]);
 #else
-            printk(KERN_DEBUG "Connected to AP, MAC: %02x:%02x:%02x:%02x:%02x:%02x\n",
-                    addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]);
+			printk(KERN_DEBUG "Connected to AP, MAC:"
+				 "%02x:%02x:%02x:%02x:%02x:%02x\n",
+				addr[0], addr[1], addr[2], addr[3],
+				addr[4], addr[5]);
 #endif
 
-            netif_start_queue(dev);
-        }
-        else if ((status == ZM_STATUS_MEDIA_DISCONNECT) ||
-                 (status == ZM_STATUS_MEDIA_DISABLED) ||
-                 (status == ZM_STATUS_MEDIA_CONNECTION_DISABLED) ||
-	         (status == ZM_STATUS_MEDIA_CONNECTION_RESET) ||
-	         (status == ZM_STATUS_MEDIA_RESET) ||
-	         (status == ZM_STATUS_MEDIA_DISCONNECT_DEAUTH) ||
-	         (status == ZM_STATUS_MEDIA_DISCONNECT_DISASOC) ||
-	         (status == ZM_STATUS_MEDIA_DISCONNECT_BEACON_MISS) ||
-                 (status == ZM_STATUS_MEDIA_DISCONNECT_NOT_FOUND) ||
-	         (status == ZM_STATUS_MEDIA_DISCONNECT_TIMEOUT))
-        {
-            printk(KERN_DEBUG "Disconnection Notify\n");
-
-            netif_stop_queue(dev);
-        }
+			netif_start_queue(dev);
+		} else if ((status == ZM_STATUS_MEDIA_DISCONNECT) ||
+			    (status == ZM_STATUS_MEDIA_DISABLED) ||
+			    (status == ZM_STATUS_MEDIA_CONNECTION_DISABLED) ||
+			    (status == ZM_STATUS_MEDIA_CONNECTION_RESET) ||
+			    (status == ZM_STATUS_MEDIA_RESET) ||
+			    (status == ZM_STATUS_MEDIA_DISCONNECT_DEAUTH) ||
+			    (status == ZM_STATUS_MEDIA_DISCONNECT_DISASOC) ||
+			   (status == ZM_STATUS_MEDIA_DISCONNECT_BEACON_MISS) ||
+			    (status == ZM_STATUS_MEDIA_DISCONNECT_NOT_FOUND) ||
+			    (status == ZM_STATUS_MEDIA_DISCONNECT_TIMEOUT)) {
+			printk(KERN_DEBUG "Disconnection Notify\n");
+
+			netif_stop_queue(dev);
+		}
 
 	/* Save the connected status */
 	macp->adapterState = status;
 
-        if(zfiWlanQueryWlanMode(dev) == ZM_MODE_INFRASTRUCTURE) {
-        //            //wireless_send_event(dev, SIOCGIWSCAN, &wreq, NULL);
-            wireless_send_event(dev, SIOCGIWAP, &wreq, NULL);
-        }
-        else if(zfiWlanQueryWlanMode(dev) == ZM_MODE_AP) {
-            //if (port == 0)
-            //{
-                wireless_send_event(dev, IWEVREGISTERED, &wreq, NULL);
-            //}
-            //else
-            //{
-            //    /* Check whether the VAP device is valid */
-            //    if (vap[port].dev != NULL)
-            //    {
-            //        wireless_send_event(vap[port].dev, IWEVREGISTERED, &wreq, NULL);
-            //    }
-            //    else
-            //    {
-            //        printk(KERN_ERR "Can' find a valid VAP device, port: %d\n", port);
-            //    }
-            //}
-        }
-    }
-    //return 0;
+		if (zfiWlanQueryWlanMode(dev) == ZM_MODE_INFRASTRUCTURE) {
+			/*wireless_send_event(dev, SIOCGIWSCAN, &wreq, NULL);*/
+			wireless_send_event(dev, SIOCGIWAP, &wreq, NULL);
+		} else if (zfiWlanQueryWlanMode(dev) == ZM_MODE_AP) {
+			/*
+			 * if (port == 0)
+			 * {
+			 *	wireless_send_event(dev, IWEVREGISTERED,
+			 *				 &wreq, NULL);
+			 * }
+			 * else
+			 * {
+			 *	Check whether the VAP device is valid
+			 *	if (vap[port].dev != NULL)
+			 *	{
+			 *		wireless_send_event(vap[port].dev,
+		 *				 IWEVREGISTERED, &wreq, NULL);
+			 *	}
+			 *	else
+			 *	{
+			 *		printk(KERN_ERR "Can' find a valid VAP"
+			 *			" device, port: %d\n", port);
+			 *	}
+			 * }
+			*/
+		}
+	}
+	/* return 0;	*/
 }
 
-void zfLnxScanNotify(zdev_t* dev, struct zsScanResult* result)
+void zfLnxScanNotify(zdev_t *dev, struct zsScanResult *result)
 {
-    return;
+	return;
 }
 
-void zfLnxStatisticsNotify(zdev_t* dev, struct zsStastics* result)
+void zfLnxStatisticsNotify(zdev_t *dev, struct zsStastics *result)
 {
-    return;
+	return;
 }
 
-//void zfwMicFailureNotify(zdev_t* dev, u8_t* message, u16_t event)
-void zfLnxMicFailureNotify(zdev_t* dev, u16_t* addr, u16_t status)
+/* void zfwMicFailureNotify(zdev_t *dev, u8_t *message, u16_t event) */
+void zfLnxMicFailureNotify(zdev_t *dev, u16_t *addr, u16_t status)
 {
 	static const char *tag = "MLME-MICHAELMICFAILURE.indication";
 	union iwreq_data wrqu;
 	char buf[128];
 
 	/* TODO: needed parameters: count, type, src address */
-	//snprintf(buf, sizeof(buf), "%s(%scast addr=%s)", tag,
-	//    (status == ZM_MIC_GROUP_ERROR) ?  "broad" : "uni",
-	//    ether_sprintf((u8_t *)addr));
+	/*
+	 * snprintf(buf, sizeof(buf), "%s(%scast addr=%s)", tag,
+	 *	(status == ZM_MIC_GROUP_ERROR) ?  "broad" : "uni",
+	 *	ether_sprintf((u8_t *)addr));
+	 */
 
 	if (zfiWlanQueryWlanMode(dev) == ZM_MODE_INFRASTRUCTURE)
-	{
 		strcpy(buf, tag);
-	}
 
 	memset(&wrqu, 0, sizeof(wrqu));
 	wrqu.data.length = strlen(buf);
@@ -235,42 +247,46 @@ void zfLnxMicFailureNotify(zdev_t* dev, u16_t* addr, u16_t status)
 }
 
 
-void zfLnxApMicFailureNotify(zdev_t* dev, u8_t* addr, zbuf_t* buf)
+void zfLnxApMicFailureNotify(zdev_t *dev, u8_t *addr, zbuf_t *buf)
 {
-    union iwreq_data wreq;
+	union iwreq_data wreq;
 
-    memset(&wreq, 0, sizeof(wreq));
-    memcpy(wreq.addr.sa_data, addr, ETH_ALEN);
-    wreq.addr.sa_family = ARPHRD_ETHER;
-    printk(KERN_DEBUG "zfwApMicFailureNotify(), MAC: %02x:%02x:%02x:%02x:%02x:%02x\n",
-            addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]);
+	memset(&wreq, 0, sizeof(wreq));
+	memcpy(wreq.addr.sa_data, addr, ETH_ALEN);
+	wreq.addr.sa_family = ARPHRD_ETHER;
+	printk(KERN_DEBUG "zfwApMicFailureNotify(), "
+			"MAC: %02x:%02x:%02x:%02x:%02x:%02x\n",
+			addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]);
 
-    return;
+	return;
 }
-
-// status = 0  => partner lost
-//        = 1  => partner alive
-//void zfwIbssPartnerNotify(zdev_t* dev, u8_t status)
-void zfLnxIbssPartnerNotify(zdev_t* dev, u16_t status, struct zsPartnerNotifyEvent *event)
+/*
+ * status = 0  => partner lost
+ *		= 1  => partner alive
+ * void zfwIbssPartnerNotify(zdev_t* dev, u8_t status)
+ */
+void zfLnxIbssPartnerNotify(zdev_t *dev, u16_t status,
+				struct zsPartnerNotifyEvent *event)
 {
 }
 
-void zfLnxMacAddressNotify(zdev_t* dev, u8_t* addr)
+void zfLnxMacAddressNotify(zdev_t *dev, u8_t *addr)
 {
-    dev->dev_addr[0] = addr[0];
-    dev->dev_addr[1] = addr[1];
-    dev->dev_addr[2] = addr[2];
-    dev->dev_addr[3] = addr[3];
-    dev->dev_addr[4] = addr[4];
-    dev->dev_addr[5] = addr[5];
+	dev->dev_addr[0] = addr[0];
+	dev->dev_addr[1] = addr[1];
+	dev->dev_addr[2] = addr[2];
+	dev->dev_addr[3] = addr[3];
+	dev->dev_addr[4] = addr[4];
+	dev->dev_addr[5] = addr[5];
 }
 
-void zfLnxSendCompleteIndication(zdev_t* dev, zbuf_t* buf)
+void zfLnxSendCompleteIndication(zdev_t *dev, zbuf_t *buf)
 {
 }
 
 
-void zfLnxRestoreBufData(zdev_t* dev, zbuf_t* buf) {
+void zfLnxRestoreBufData(zdev_t *dev, zbuf_t *buf)
+{
 
 }
 /* Leave an empty line below to remove warning message on some compiler */
diff --git a/drivers/staging/otus/wrap_mem.c b/drivers/staging/otus/wrap_mem.c
index 32416d77a471..47cbce1346a9 100644
--- a/drivers/staging/otus/wrap_mem.c
+++ b/drivers/staging/otus/wrap_mem.c
@@ -30,69 +30,75 @@
 #include <net/iw_handler.h>
 
 /* Memory management */
-/* Called to allocate uncached memory, allocated memory must    */
-/* in 4-byte boundary                                           */
-void* zfwMemAllocate(zdev_t* dev, u32_t size)
+/* Called to allocate uncached memory, allocated memory must	*/
+/* in 4-byte boundary						*/
+void *zfwMemAllocate(zdev_t *dev, u32_t size)
 {
-    void* mem = NULL;
-    mem = kmalloc(size, GFP_ATOMIC);
-    return mem;
+	void *mem = NULL;
+	mem = kmalloc(size, GFP_ATOMIC);
+	return mem;
 }
 
 
 /* Called to free allocated memory */
-void zfwMemFree(zdev_t* dev, void* mem, u32_t size)
+void zfwMemFree(zdev_t *dev, void *mem, u32_t size)
 {
-    kfree(mem);
-    return;
+	kfree(mem);
+	return;
 }
 
-void zfwMemoryCopy(u8_t* dst, u8_t* src, u16_t length)
+void zfwMemoryCopy(u8_t *dst, u8_t *src, u16_t length)
 {
-    //u16_t i;
+	/* u16_t i; */
 
-    memcpy(dst, src, length);
-    //for(i=0; i<length; i++)
-    //{
-    //    dst[i] = src[i];
-    //}
-    return;
+	memcpy(dst, src, length);
+	/*
+	 * for(i=0; i<length; i++)
+	 * {
+	 *	dst[i] = src[i];
+	 * }
+	 */
+	return;
 }
 
-void zfwZeroMemory(u8_t* va, u16_t length)
+void zfwZeroMemory(u8_t *va, u16_t length)
 {
-    //u16_t i;
-    memset(va, 0, length);
-    //for(i=0; i<length; i++)
-    //{
-    //    va[i] = 0;
-    //}
-    return;
+	/* u16_t i; */
+	memset(va, 0, length);
+	/*
+	 * for(i=0; i<length; i++)
+	 * {
+	 *	va[i] = 0;
+	 * }
+	 */
+	return;
 }
 
-void zfwMemoryMove(u8_t* dst, u8_t* src, u16_t length)
+void zfwMemoryMove(u8_t *dst, u8_t *src, u16_t length)
 {
-    memcpy(dst, src, length);
-    return;
+	memcpy(dst, src, length);
+	return;
 }
 
-u8_t zfwMemoryIsEqual(u8_t* m1, u8_t* m2, u16_t length)
+u8_t zfwMemoryIsEqual(u8_t *m1, u8_t *m2, u16_t length)
 {
-    //u16_t i;
-    int ret;
+	/* u16_t i; */
+	int ret;
 
-    ret = memcmp(m1, m2, length);
+	ret = memcmp(m1, m2, length);
 
-    return ((ret==0)?TRUE:FALSE);
-    //for(i=0; i<length; i++)
-    //{
-    //    if ( m1[i] != m2[i] )
-    //    {
-    //        return FALSE;
-    //    }
-    //}
-
-    //return TRUE;
+	return ((ret == 0) ? TRUE : FALSE);
+	/*
+	 * for(i=0; i<length; i++)
+	 *{
+	 *	 if ( m1[i] != m2[i] )
+	 *	{
+	 *		return FALSE;
+	 *	}
+	 *}
+	 *
+	 * return TRUE;
+	 */
 }
 
 /* Leave an empty line below to remove warning message on some compiler */
diff --git a/drivers/staging/otus/wrap_mis.c b/drivers/staging/otus/wrap_mis.c
index ea2199fecbbe..26f49b7ec834 100644
--- a/drivers/staging/otus/wrap_mis.c
+++ b/drivers/staging/otus/wrap_mis.c
@@ -30,76 +30,73 @@
 #include <linux/netlink.h>
 #include <net/iw_handler.h>
 
-//extern struct zsWdsStruct wds[ZM_WDS_PORT_NUMBER];
+/* extern struct zsWdsStruct wds[ZM_WDS_PORT_NUMBER];	*/
 extern struct zsVapStruct vap[ZM_VAP_PORT_NUMBER];
-extern u16_t zfLnxGetVapId(zdev_t* dev);
+extern u16_t zfLnxGetVapId(zdev_t *dev);
 
 /* Simply return 0xffff if VAP function is not supported */
-u16_t zfwGetVapId(zdev_t* dev)
+u16_t zfwGetVapId(zdev_t *dev)
 {
-    return zfLnxGetVapId(dev);
+	return zfLnxGetVapId(dev);
 }
 
-void zfwSleep(zdev_t* dev, u32_t ms)
+void zfwSleep(zdev_t *dev, u32_t ms)
 {
-    if (in_interrupt() == 0)
-    {
-        mdelay(ms);
-    }
-    else
-    {
-        int ii;
-        int iter = 100000 * ms;
-
-        for (ii = 0; ii < iter; ii++)
-        {
-
-        }
-    }
+	if (in_interrupt() == 0)
+		mdelay(ms);
+	else {
+		int ii;
+		int iter = 100000 * ms;
+
+		for (ii = 0; ii < iter; ii++) {
+		}
+	}
 }
 
 #ifdef ZM_HALPLUS_LOCK
-asmlinkage struct zsWlanDev *zfwGetWlanDev(zdev_t* dev)
+asmlinkage struct zsWlanDev *zfwGetWlanDev(zdev_t *dev)
 {
 	struct usbdrv_private *macp = dev->ml_priv;
 	return macp->wd;
 }
 
-asmlinkage void zfwEnterCriticalSection(zdev_t* dev)
+asmlinkage void zfwEnterCriticalSection(zdev_t *dev)
 {
 	struct usbdrv_private *macp = dev->ml_priv;
 	spin_lock_irqsave(&macp->cs_lock, macp->hal_irqFlag);
 }
 
-asmlinkage void zfwLeaveCriticalSection(zdev_t* dev)
+asmlinkage void zfwLeaveCriticalSection(zdev_t *dev)
 {
 	struct usbdrv_private *macp = dev->ml_priv;
 	spin_unlock_irqrestore(&macp->cs_lock, macp->hal_irqFlag);
 }
 
-asmlinkage u8_t zfwBufReadByte(zdev_t* dev, zbuf_t* buf, u16_t offset)
+asmlinkage u8_t zfwBufReadByte(zdev_t *dev, zbuf_t *buf, u16_t offset)
 {
-    return *(u8_t*)((u8_t*)buf->data+offset);
+	return *(u8_t *)((u8_t *)buf->data+offset);
 }
 
-asmlinkage u16_t zfwBufReadHalfWord(zdev_t* dev, zbuf_t* buf, u16_t offset)
+asmlinkage u16_t zfwBufReadHalfWord(zdev_t *dev, zbuf_t *buf, u16_t offset)
 {
-    return zmw_cpu_to_le16(*(u16_t*)((u8_t*)buf->data+offset));
+	return zmw_cpu_to_le16(*(u16_t *)((u8_t *)buf->data+offset));
 }
 
-asmlinkage void zfwBufWriteByte(zdev_t* dev, zbuf_t* buf, u16_t offset, u8_t value)
+asmlinkage void zfwBufWriteByte(zdev_t *dev, zbuf_t *buf, u16_t offset,
+				u8_t value)
 {
-    *(u8_t*)((u8_t*)buf->data+offset) = value;
+	*(u8_t *)((u8_t *)buf->data+offset) = value;
 }
 
-asmlinkage void zfwBufWriteHalfWord(zdev_t* dev, zbuf_t* buf, u16_t offset, u16_t value)
+asmlinkage void zfwBufWriteHalfWord(zdev_t *dev, zbuf_t *buf, u16_t offset,
+					u16_t value)
 {
-    *(u16_t*)((u8_t*)buf->data+offset) = zmw_cpu_to_le16(value);
+	*(u16_t *)((u8_t *)buf->data+offset) = zmw_cpu_to_le16(value);
 }
 
-asmlinkage u8_t *zfwGetBuffer(zdev_t* dev, zbuf_t* buf)
+asmlinkage u8_t *zfwGetBuffer(zdev_t *dev, zbuf_t *buf)
 {
-    return (u8_t*)(buf->data);
+	return (u8_t *)(buf->data);
 }
 #endif
 
diff --git a/drivers/staging/otus/wrap_pkt.c b/drivers/staging/otus/wrap_pkt.c
index 0d5920fdf4f3..75bb952fd0a5 100644
--- a/drivers/staging/otus/wrap_pkt.c
+++ b/drivers/staging/otus/wrap_pkt.c
@@ -31,136 +31,122 @@
 #include <net/iw_handler.h>
 
 
-//extern struct zsWdsStruct wds[ZM_WDS_PORT_NUMBER];
+/* extern struct zsWdsStruct wds[ZM_WDS_PORT_NUMBER]; 	*/
 extern struct zsVapStruct vap[ZM_VAP_PORT_NUMBER];
 
 
 /***** Rx *****/
-void zfLnxRecv80211(zdev_t* dev, zbuf_t* buf, struct zsAdditionInfo* addInfo)
+void zfLnxRecv80211(zdev_t *dev, zbuf_t *buf, struct zsAdditionInfo *addInfo)
 {
-    u16_t frameType;
-    u16_t frameCtrl;
-    u16_t frameSubtype;
-    zbuf_t *skb1;
-    struct usbdrv_private *macp = dev->ml_priv;
-
-    //frameCtrl = zmw_buf_readb(dev, buf, 0);
-    frameCtrl = *(u8_t*)((u8_t*)buf->data);
-    frameType = frameCtrl & 0xf;
-    frameSubtype = frameCtrl & 0xf0;
-
-    if ((frameType == 0x0) && (macp->forwardMgmt))
-    {
-        switch (frameSubtype)
-        {
-                /* Beacon */
-            case 0x80 :
-                /* Probe response */
-            case 0x50 :
-                skb1 = skb_copy(buf, GFP_ATOMIC);
-                if(skb1 != NULL)
-                {
-                    skb1->dev = dev;
-                    skb1->mac_header = skb1->data;
-	            skb1->ip_summed = CHECKSUM_NONE;
-	            skb1->pkt_type = PACKET_OTHERHOST;
-	            skb1->protocol = __constant_htons(0x0019);  /* ETH_P_80211_RAW */
-    	            netif_rx(skb1);
-	            }
-                break;
-            default:
-                break;
-        }
-    }
-
-    zfiRecv80211(dev, buf, addInfo);
-    return;
+	u16_t frameType;
+	u16_t frameCtrl;
+	u16_t frameSubtype;
+	zbuf_t *skb1;
+	struct usbdrv_private *macp = dev->ml_priv;
+
+	/* frameCtrl = zmw_buf_readb(dev, buf, 0);	*/
+	frameCtrl = *(u8_t *)((u8_t *)buf->data);
+	frameType = frameCtrl & 0xf;
+	frameSubtype = frameCtrl & 0xf0;
+
+	if ((frameType == 0x0) && (macp->forwardMgmt)) {
+		switch (frameSubtype) {
+			/* Beacon */
+		case 0x80:
+			/* Probe response */
+		case 0x50:
+			skb1 = skb_copy(buf, GFP_ATOMIC);
+			if (skb1 != NULL) {
+				skb1->dev = dev;
+				skb1->mac_header = skb1->data;
+				skb1->ip_summed = CHECKSUM_NONE;
+				skb1->pkt_type = PACKET_OTHERHOST;
+				/* ETH_P_80211_RAW */
+				skb1->protocol = __constant_htons(0x0019);
+				netif_rx(skb1);
+			}
+			break;
+		default:
+			break;
+		}
+	}
+
+	zfiRecv80211(dev, buf, addInfo);
+	return;
 }
 
 #define ZM_AVOID_UDP_LARGE_PACKET_FAIL
-void zfLnxRecvEth(zdev_t* dev, zbuf_t* buf, u16_t port)
+void zfLnxRecvEth(zdev_t *dev, zbuf_t *buf, u16_t port)
 {
-    struct usbdrv_private *macp = dev->ml_priv;
+	struct usbdrv_private *macp = dev->ml_priv;
 #ifdef ZM_AVOID_UDP_LARGE_PACKET_FAIL
-    zbuf_t *new_buf;
+	zbuf_t *new_buf;
 
-    //new_buf = dev_alloc_skb(2048);
-    new_buf = dev_alloc_skb(buf->len);
+	/* new_buf = dev_alloc_skb(2048);	*/
+	new_buf = dev_alloc_skb(buf->len);
 
 #ifdef NET_SKBUFF_DATA_USES_OFFSET
-    new_buf->tail = 0;
-    new_buf->len = 0;
+	new_buf->tail = 0;
+	new_buf->len = 0;
 #else
-    new_buf->tail = new_buf->data;
-    new_buf->len = 0;
+	new_buf->tail = new_buf->data;
+	new_buf->len = 0;
 #endif
 
-    skb_put(new_buf, buf->len);
-    memcpy(new_buf->data, buf->data, buf->len);
-
-    /* Free buffer */
-    dev_kfree_skb_any(buf);
-
-    if (port == 0)
-    {
-        new_buf->dev = dev;
-        new_buf->protocol = eth_type_trans(new_buf, dev);
-    }
-    else
-    {
-        /* VAP */
-        if (vap[0].dev != NULL)
-        {
-            new_buf->dev = vap[0].dev;
-            new_buf->protocol = eth_type_trans(new_buf, vap[0].dev);
-        }
-        else
-        {
-            new_buf->dev = dev;
-            new_buf->protocol = eth_type_trans(new_buf, dev);
-        }
-    }
-
-    new_buf->ip_summed = CHECKSUM_NONE;
-    dev->last_rx = jiffies;
-
-    switch(netif_rx(new_buf))
+	skb_put(new_buf, buf->len);
+	memcpy(new_buf->data, buf->data, buf->len);
+
+	/* Free buffer */
+	dev_kfree_skb_any(buf);
+
+	if (port == 0) {
+		new_buf->dev = dev;
+		new_buf->protocol = eth_type_trans(new_buf, dev);
+	} else {
+		/* VAP */
+		if (vap[0].dev != NULL) {
+			new_buf->dev = vap[0].dev;
+			new_buf->protocol = eth_type_trans(new_buf, vap[0].dev);
+		} else {
+			new_buf->dev = dev;
+			new_buf->protocol = eth_type_trans(new_buf, dev);
+		}
+	}
+
+	new_buf->ip_summed = CHECKSUM_NONE;
+	dev->last_rx = jiffies;
+
+	switch (netif_rx(new_buf))
 #else
-    if (port == 0)
-    {
-        buf->dev = dev;
-        buf->protocol = eth_type_trans(buf, dev);
-    }
-    else
-    {
-        /* VAP */
-        if (vap[0].dev != NULL)
-        {
-            buf->dev = vap[0].dev;
-            buf->protocol = eth_type_trans(buf, vap[0].dev);
-        }
-        else
-        {
-            buf->dev = dev;
-            buf->protocol = eth_type_trans(buf, dev);
-        }
-    }
-
-    buf->ip_summed = CHECKSUM_NONE;
-    dev->last_rx = jiffies;
-
-    switch(netif_rx(buf))
+	if (port == 0) {
+		buf->dev = dev;
+		buf->protocol = eth_type_trans(buf, dev);
+	} else {
+		/* VAP */
+		if (vap[0].dev != NULL) {
+			buf->dev = vap[0].dev;
+			buf->protocol = eth_type_trans(buf, vap[0].dev);
+		} else {
+			buf->dev = dev;
+			buf->protocol = eth_type_trans(buf, dev);
+		}
+	}
+
+	buf->ip_summed = CHECKSUM_NONE;
+	dev->last_rx = jiffies;
+
+	switch (netif_rx(buf))
 #endif
-    {
-    case NET_RX_DROP:
-        break;
-    default:
-            macp->drv_stats.net_stats.rx_packets++;
-            macp->drv_stats.net_stats.rx_bytes += buf->len;
-        break;
-    }
-
-    return;
+	{
+	case NET_RX_DROP:
+		break;
+	default:
+			macp->drv_stats.net_stats.rx_packets++;
+			macp->drv_stats.net_stats.rx_bytes += buf->len;
+		break;
+	}
+
+	return;
 }
 
 /* Leave an empty line below to remove warning message on some compiler */
diff --git a/drivers/staging/otus/wrap_sec.c b/drivers/staging/otus/wrap_sec.c
index 0f780bacc598..0b238e9999bf 100644
--- a/drivers/staging/otus/wrap_sec.c
+++ b/drivers/staging/otus/wrap_sec.c
@@ -33,92 +33,93 @@
 #ifdef ZM_ENABLE_CENC
 extern int zfLnxCencSendMsg(struct sock *netlink_sk, u_int8_t *msg, int len);
 
-u16_t zfLnxCencAsocNotify(zdev_t* dev, u16_t* macAddr, u8_t* body, u16_t bodySize, u16_t port)
+u16_t zfLnxCencAsocNotify(zdev_t *dev, u16_t *macAddr, u8_t *body,
+				u16_t bodySize, u16_t port)
 {
-    struct usbdrv_private *macp = (struct usbdrv_private *)dev->priv;
-    struct zydas_cenc_sta_info cenc_info;
-    //struct sock *netlink_sk;
-    u8_t ie_len;
-    int ii;
+	struct usbdrv_private *macp = (struct usbdrv_private *)dev->priv;
+	struct zydas_cenc_sta_info cenc_info;
+	/* struct sock *netlink_sk;	*/
+	u8_t ie_len;
+	int ii;
 
-    /* Create NETLINK socket */
-    //netlink_sk = netlink_kernel_create(NETLINK_USERSOCK, NULL);
+	/* Create NETLINK socket */
+	/*netlink_sk = netlink_kernel_create(NETLINK_USERSOCK, NULL);	*/
 
-    if (macp->netlink_sk == NULL)
-    {
-        printk(KERN_ERR "NETLINK Socket is NULL\n");
-        return -1;
-    }
+	if (macp->netlink_sk == NULL) {
+		printk(KERN_ERR "NETLINK Socket is NULL\n");
+		return -1;
+	}
 
-    memset(&cenc_info, 0, sizeof(cenc_info));
+	memset(&cenc_info, 0, sizeof(cenc_info));
 
-    //memcpy(cenc_info.gsn, vap->iv_cencmsk_keys.wk_txiv, ZM_CENC_IV_LEN);
-    zfiWlanQueryGSN(dev, cenc_info.gsn, port);
-    cenc_info.datalen += ZM_CENC_IV_LEN;
-    ie_len = body[1] + 2;
-    memcpy(cenc_info.wie, body, ie_len);
-    cenc_info.datalen += ie_len;
+	/* memcpy(cenc_info.gsn, vap->iv_cencmsk_keys.wk_txiv,
+	 *  	ZM_CENC_IV_LEN);
+	 */
+	zfiWlanQueryGSN(dev, cenc_info.gsn, port);
+	cenc_info.datalen += ZM_CENC_IV_LEN;
+	ie_len = body[1] + 2;
+	memcpy(cenc_info.wie, body, ie_len);
+	cenc_info.datalen += ie_len;
 
-    memcpy(cenc_info.sta_mac, macAddr, 6);
-    cenc_info.msg_type = ZM_CENC_WAI_REQUEST;
-    cenc_info.datalen += 6 + 2;
+	memcpy(cenc_info.sta_mac, macAddr, 6);
+	cenc_info.msg_type = ZM_CENC_WAI_REQUEST;
+	cenc_info.datalen += 6 + 2;
 
-    printk(KERN_ERR "===== zfwCencSendMsg, bodySize: %d =====\n", bodySize);
+	printk(KERN_ERR "===== zfwCencSendMsg, bodySize: %d =====\n", bodySize);
 
-    for(ii = 0; ii < bodySize; ii++)
-    {
-        printk(KERN_ERR "%02x ", body[ii]);
+	for (ii = 0; ii < bodySize; ii++) {
+		printk(KERN_ERR "%02x ", body[ii]);
 
-        if ((ii & 0xf) == 0xf)
-        {
-            printk(KERN_ERR "\n");
-        }
-    }
+		if ((ii & 0xf) == 0xf)
+			printk(KERN_ERR "\n");
+	}
 
-    zfLnxCencSendMsg(macp->netlink_sk, (u8_t *)&cenc_info, cenc_info.datalen+4);
+	zfLnxCencSendMsg(macp->netlink_sk, (u8_t *)&cenc_info,
+			 cenc_info.datalen+4);
 
-    /* Close NETLINK socket */
-    //sock_release(netlink_sk);
+	/* Close NETLINK socket */
+	/* sock_release(netlink_sk);	*/
 
-    return 0;
+	return 0;
 }
-#endif //ZM_ENABLE_CENC
+#endif /* ZM_ENABLE_CENC	*/
 
-u8_t zfwCencHandleBeaconProbrespon(zdev_t* dev, u8_t *pWIEc,
-        u8_t *pPeerSSIDc, u8_t *pPeerAddrc)
+u8_t zfwCencHandleBeaconProbrespon(zdev_t *dev, u8_t *pWIEc,
+		u8_t *pPeerSSIDc, u8_t *pPeerAddrc)
 {
-    return 0;
+	return 0;
 }
 
-u8_t zfwGetPktEncExemptionActionType(zdev_t* dev, zbuf_t* buf)
+u8_t zfwGetPktEncExemptionActionType(zdev_t *dev, zbuf_t *buf)
 {
-    return ZM_ENCRYPTION_EXEMPT_NO_EXEMPTION;
+	return ZM_ENCRYPTION_EXEMPT_NO_EXEMPTION;
 }
 
-void copyToIntTxBuffer(zdev_t* dev, zbuf_t* buf, u8_t* src,
-                         u16_t offset, u16_t length)
+void copyToIntTxBuffer(zdev_t *dev, zbuf_t *buf, u8_t *src,
+						 u16_t offset, u16_t length)
 {
-    u16_t i;
+	u16_t i;
 
-    for(i=0; i<length;i++)
-    {
-        //zmw_tx_buf_writeb(dev, buf, offset+i, src[i]);
-        *(u8_t*)((u8_t*)buf->data+offset+i) = src[i];
-    }
+	for (i = 0; i < length; i++) {
+		/* zmw_tx_buf_writeb(dev, buf, offset+i, src[i]);	*/
+		*(u8_t *)((u8_t *)buf->data+offset+i) = src[i];
+	}
 }
 
-u16_t zfwStaAddIeWpaRsn(zdev_t* dev, zbuf_t* buf, u16_t offset, u8_t frameType)
+u16_t zfwStaAddIeWpaRsn(zdev_t *dev, zbuf_t *buf, u16_t offset, u8_t frameType)
 {
-    struct usbdrv_private *macp = dev->ml_priv;
-    //zm_msg1_mm(ZM_LV_0, "CWY - add wpaie content Length : ", macp->supIe[1]);
-    if (macp->supIe[1] != 0)
-    {
-        copyToIntTxBuffer(dev, buf, macp->supIe, offset, macp->supIe[1]+2);
-        //memcpy(buf->data[offset], macp->supIe, macp->supIe[1]+2);
-        offset += (macp->supIe[1]+2);
-    }
-
-    return offset;
+	struct usbdrv_private *macp = dev->ml_priv;
+	/* zm_msg1_mm(ZM_LV_0, "CWY - add wpaie content Length : "
+	 * 		, macp->supIe[1]);
+	 */
+	if (macp->supIe[1] != 0) {
+		copyToIntTxBuffer(dev, buf, macp->supIe, offset,
+					 macp->supIe[1]+2);
+		/* memcpy(buf->data[offset], macp->supIe, macp->supIe[1]+2);*/
+		offset += (macp->supIe[1]+2);
+	}
+
+	return offset;
 }
 
 /* Leave an empty line below to remove warning message on some compiler */
diff --git a/drivers/staging/otus/wrap_usb.c b/drivers/staging/otus/wrap_usb.c
index 70fd410bc894..6b336ede8867 100644
--- a/drivers/staging/otus/wrap_usb.c
+++ b/drivers/staging/otus/wrap_usb.c
@@ -30,159 +30,152 @@
 #include <linux/netlink.h>
 #include <net/iw_handler.h>
 
-extern void zfLnxInitUsbTxQ(zdev_t* dev);
-extern void zfLnxInitUsbRxQ(zdev_t* dev);
+extern void zfLnxInitUsbTxQ(zdev_t *dev);
+extern void zfLnxInitUsbRxQ(zdev_t *dev);
 extern u32_t zfLnxSubmitRegInUrb(zdev_t *dev);
-u32_t zfLnxUsbOut(zdev_t* dev, u8_t *hdr, u16_t hdrlen, u8_t *snap, u16_t snapLen,
-        u8_t *tail, u16_t tailLen, zbuf_t *buf, u16_t offset);
-u32_t zfLnxUsbWriteReg(zdev_t* dev, u32_t* cmd, u16_t cmdLen);
+u32_t zfLnxUsbOut(zdev_t *dev, u8_t *hdr, u16_t hdrlen, u8_t *snap,
+		u16_t snapLen, u8_t *tail, u16_t tailLen, zbuf_t *buf,
+		u16_t offset);
+u32_t zfLnxUsbWriteReg(zdev_t *dev, u32_t *cmd, u16_t cmdLen);
 
-void zfwUsbRegisterCallBack(zdev_t* dev, struct zfCbUsbFuncTbl *zfUsbFunc) {
-    struct usbdrv_private *macp = dev->ml_priv;
+void zfwUsbRegisterCallBack(zdev_t *dev, struct zfCbUsbFuncTbl *zfUsbFunc)
+{
+	struct usbdrv_private *macp = dev->ml_priv;
 
-    macp->usbCbFunctions.zfcbUsbRecv = zfUsbFunc->zfcbUsbRecv;
-    macp->usbCbFunctions.zfcbUsbRegIn = zfUsbFunc->zfcbUsbRegIn;
-    macp->usbCbFunctions.zfcbUsbOutComplete = zfUsbFunc->zfcbUsbOutComplete;
+	macp->usbCbFunctions.zfcbUsbRecv = zfUsbFunc->zfcbUsbRecv;
+	macp->usbCbFunctions.zfcbUsbRegIn = zfUsbFunc->zfcbUsbRegIn;
+	macp->usbCbFunctions.zfcbUsbOutComplete = zfUsbFunc->zfcbUsbOutComplete;
 
-    return;
+	return;
 }
 
-u32_t zfwUsbGetFreeTxQSize(zdev_t* dev)
+u32_t zfwUsbGetFreeTxQSize(zdev_t *dev)
 {
-    struct usbdrv_private *macp = dev->ml_priv;
-    u32_t        freeTxQSize;
-    unsigned long irqFlag;
-    //zmw_declare_for_critical_section();
+	struct usbdrv_private *macp = dev->ml_priv;
+	u32_t		freeTxQSize;
+	unsigned long irqFlag;
+	/* zmw_declare_for_critical_section();	*/
 
-    //zmw_enter_critical_section(dev);
-    spin_lock_irqsave(&macp->cs_lock, irqFlag);
+	/* zmw_enter_critical_section(dev);	*/
+	spin_lock_irqsave(&macp->cs_lock, irqFlag);
 
-    freeTxQSize = ZM_MAX_TX_BUF_NUM - macp->TxBufCnt;
+	freeTxQSize = ZM_MAX_TX_BUF_NUM - macp->TxBufCnt;
 
-    //zmw_leave_critical_section(dev);
-    spin_unlock_irqrestore(&macp->cs_lock, irqFlag);
+	/* zmw_leave_critical_section(dev);	*/
+	spin_unlock_irqrestore(&macp->cs_lock, irqFlag);
 
-    return freeTxQSize;
+	return freeTxQSize;
 }
 
-u32_t zfwUsbGetMaxTxQSize(zdev_t* dev)
+u32_t zfwUsbGetMaxTxQSize(zdev_t *dev)
 {
-    return ZM_MAX_TX_BUF_NUM;
+	return ZM_MAX_TX_BUF_NUM;
 }
 
 u32_t zfwUsbEnableIntEpt(zdev_t *dev, u8_t endpt)
 {
-    /* Initialize USB TxQ */
-    zfLnxInitUsbTxQ(dev);
+	/* Initialize USB TxQ */
+	zfLnxInitUsbTxQ(dev);
 
-    /* Initialize USB RxQ */
-    zfLnxInitUsbRxQ(dev);
+	/* Initialize USB RxQ */
+	zfLnxInitUsbRxQ(dev);
 
-    /* Initialize USB Register In URB */
-    //zfwUsbSubmitRegIn(dev);
-    /* Initialize USB Register In URB */
-    zfLnxSubmitRegInUrb(dev);
+	/* Initialize USB Register In URB */
+	/* zfwUsbSubmitRegIn(dev);	*/
+	/* Initialize USB Register In URB */
+	zfLnxSubmitRegInUrb(dev);
 
-    return 0;
+	return 0;
 }
 
-int zfwUsbEnableRxEpt(zdev_t* dev, u8_t endpt)
+int zfwUsbEnableRxEpt(zdev_t *dev, u8_t endpt)
 {
-    return 0;
+	return 0;
 }
 
-u32_t zfwUsbSubmitControl(zdev_t* dev, u8_t req, u16_t value, u16_t index, void *data, u32_t size)
+u32_t zfwUsbSubmitControl(zdev_t *dev, u8_t req, u16_t value, u16_t index,
+			 void *data, u32_t size)
 {
-    int result = 0;
-    u32_t ret = 0;
-    struct usbdrv_private *macp = dev->ml_priv;
-    u8_t* buf;
-
-    if (size > 0)
-    {
-        buf = kmalloc(size, GFP_KERNEL);
-        memcpy(buf, (u8_t*)data, size);
-    }
-    else
-    {
-        buf = NULL;
-    }
+	int result = 0;
+	u32_t ret = 0;
+	struct usbdrv_private *macp = dev->ml_priv;
+	u8_t *buf;
+
+	if (size > 0) {
+		buf = kmalloc(size, GFP_KERNEL);
+		memcpy(buf, (u8_t *)data, size);
+	} else
+		buf = NULL;
 
 #if 0
-    printk(KERN_ERR "req = 0x%02x\n", req);
-    printk(KERN_ERR "value = 0x%04x\n", value);
-    printk(KERN_ERR "index = 0x%04x\n", index);
-    printk(KERN_ERR "data = 0x%lx\n", (u32_t) data);
-    printk(KERN_ERR "size = %ld\n", size);
+	printk(KERN_ERR "req = 0x%02x\n", req);
+	printk(KERN_ERR "value = 0x%04x\n", value);
+	printk(KERN_ERR "index = 0x%04x\n", index);
+	printk(KERN_ERR "data = 0x%lx\n", (u32_t) data);
+	printk(KERN_ERR "size = %ld\n", size);
 #endif
 
-    result = usb_control_msg(macp->udev, usb_sndctrlpipe(macp->udev, 0),
-            req, USB_DIR_OUT | 0x40, value, index, buf, size, HZ);
+	result = usb_control_msg(macp->udev, usb_sndctrlpipe(macp->udev, 0),
+			req, USB_DIR_OUT | 0x40, value, index, buf, size, HZ);
 
-    if (result < 0)
-    {
-        printk("zfwUsbSubmitControl() failed, result=0x%x\n", result);
-        ret = 1;
-    }
-    kfree(buf);
+	if (result < 0) {
+		printk(KERN_ERR "zfwUsbSubmitControl() failed, result = 0x%x\n",
+			result);
+		ret = 1;
+	}
+	kfree(buf);
 
-    return ret;
+	return ret;
 }
 
-void zfwUsbCmd(zdev_t* dev, u8_t endpt, u32_t* cmd, u16_t cmdLen)
+void zfwUsbCmd(zdev_t *dev, u8_t endpt, u32_t *cmd, u16_t cmdLen)
 {
-    struct usbdrv_private *macp = dev->ml_priv;
-    u32_t ret;
-
-    //MPUsbCommand(dev, endpt, cmd, cmdLen);
-    ret = zfLnxUsbWriteReg(dev, cmd, cmdLen);
-
-    /* if zfLnxUsbWriteReg() return error, free and allocate urb, resend again */
-    if (ret != 0)
-    {
-        usb_free_urb(macp->RegOutUrb);
-        macp->RegOutUrb = usb_alloc_urb(0, GFP_ATOMIC);
-        ret = zfLnxUsbWriteReg(dev, cmd, cmdLen);
-    }
+	struct usbdrv_private *macp = dev->ml_priv;
+	u32_t ret;
+
+	/* MPUsbCommand(dev, endpt, cmd, cmdLen);	*/
+	ret = zfLnxUsbWriteReg(dev, cmd, cmdLen);
+
+	/*
+	 * if zfLnxUsbWriteReg() return error, free and allocate urb,
+	 * resend again
+	 */
+	if (ret != 0) {
+		usb_free_urb(macp->RegOutUrb);
+		macp->RegOutUrb = usb_alloc_urb(0, GFP_ATOMIC);
+		ret = zfLnxUsbWriteReg(dev, cmd, cmdLen);
+	}
 }
 
-u32_t zfwUsbSend(zdev_t* dev, u8_t endpt, u8_t *hdr, u16_t hdrlen, u8_t *snap, u16_t snapLen,
-                u8_t *tail, u16_t tailLen, zbuf_t *buf, u16_t offset)
+u32_t zfwUsbSend(zdev_t *dev, u8_t endpt, u8_t *hdr, u16_t hdrlen, u8_t *snap,
+			u16_t snapLen,	u8_t *tail, u16_t tailLen,
+			zbuf_t *buf, u16_t offset)
 {
-    u32_t status;
+	u32_t status;
 
 #ifdef ZM_CONFIG_BIG_ENDIAN
-    u32_t ii = 0;
-    u16_t *pc = NULL;
-
-    pc = (u16_t *)hdr;
-    for(ii=0; ii<(hdrlen>>1); ii++)
-    {
-        pc[ii] = cpu_to_le16(pc[ii]);
-    }
-
-    pc = (u16_t *)snap;
-    for(ii=0; ii<(snapLen>>1); ii++)
-    {
-        pc[ii] = cpu_to_le16(pc[ii]);
-    }
-
-    pc = (u16_t *)tail;
-    for(ii=0; ii<(tailLen>>1); ii++)
-    {
-        pc[ii] = cpu_to_le16(pc[ii]);
-    }
+	u32_t ii = 0;
+	u16_t *pc = NULL;
+
+	pc = (u16_t *)hdr;
+	for (ii = 0; ii < (hdrlen >> 1); ii++)
+		pc[ii] = cpu_to_le16(pc[ii]);
+
+	pc = (u16_t *)snap;
+	for (ii = 0; ii < (snapLen >> 1); ii++)
+		pc[ii] = cpu_to_le16(pc[ii]);
+
+	pc = (u16_t *)tail;
+	for (ii = 0; ii < (tailLen>>1); ii++)
+		pc[ii] = cpu_to_le16(pc[ii]);
 #endif
 
-    status = zfLnxUsbOut(dev, hdr, hdrlen, snap, snapLen, tail, tailLen, buf, offset);
-    if ( status == 0 )
-    {
-        return 0;
-    }
-    else
-    {
-        return 1;
-    }
+	status = zfLnxUsbOut(dev, hdr, hdrlen, snap, snapLen, tail, tailLen,
+				buf, offset);
+	if (status == 0)
+		return 0;
+	else
+		return 1;
 }
 
 /* Leave an empty line below to remove warning message on some compiler */
diff --git a/drivers/staging/otus/zdcompat.h b/drivers/staging/otus/zdcompat.h
index 84ac43356b77..cdcaef54afcd 100644
--- a/drivers/staging/otus/zdcompat.h
+++ b/drivers/staging/otus/zdcompat.h
@@ -17,7 +17,7 @@
 /*  Module Name : zdcompat.h                                            */
 /*                                                                      */
 /*  Abstract                                                            */
-/*     This module contains function defintion for compatibility.       */
+/*     This module contains function definition for compatibility.      */
 /*                                                                      */
 /*  NOTES                                                               */
 /*     Platform dependent.                                              */
diff --git a/drivers/staging/otus/zdusb.h b/drivers/staging/otus/zdusb.h
index 9f8ab2e96169..97e4ef09567a 100644
--- a/drivers/staging/otus/zdusb.h
+++ b/drivers/staging/otus/zdusb.h
@@ -34,10 +34,10 @@
 #define VERSIONID               "0.0.0.999"
 
 /* Define these values to match your device */
-#define VENDOR_ATHR             0x0CF3  //Atheros
+#define VENDOR_ATHR             0x0CF3  /* Atheros */
 #define PRODUCT_AR9170          0x9170
 
-#define VENDOR_DLINK            0x07D1  //Dlink
+#define VENDOR_DLINK            0x07D1  /* Dlink */
 #define PRODUCT_DWA160A         0x3C10
 
 #define	VENDOR_NETGEAR		0x0846	/* NetGear */
diff --git a/drivers/staging/p9auth/p9auth.c b/drivers/staging/p9auth/p9auth.c
index 8ccfff723eec..db7962621210 100644
--- a/drivers/staging/p9auth/p9auth.c
+++ b/drivers/staging/p9auth/p9auth.c
@@ -334,6 +334,7 @@ static const struct file_operations cap_fops = {
 	.release = cap_release,
 };
 
+/* no __exit here because it can be called by the init function */
 static void cap_cleanup_module(void)
 {
 	int i;
@@ -360,7 +361,7 @@ static void cap_setup_cdev(struct cap_dev *dev, int index)
 		printk(KERN_NOTICE "Error %d adding cap%d", err, index);
 }
 
-static int cap_init_module(void)
+static int __init cap_init_module(void)
 {
 	int result, i;
 	dev_t dev = 0;
diff --git a/drivers/staging/panel/Kconfig b/drivers/staging/panel/Kconfig
index 3abe7c9d558d..3defa0133f2e 100644
--- a/drivers/staging/panel/Kconfig
+++ b/drivers/staging/panel/Kconfig
@@ -47,7 +47,7 @@ config PANEL_PROFILE
 config PANEL_KEYPAD
 	depends on PANEL && PANEL_PROFILE="0"
 	int "Keypad type (0=none, 1=old 6 keys, 2=new 6 keys, 3=Nexcom 4 keys)"
-	range 0 4
+	range 0 3
 	default 0
 	---help---
 	  This enables and configures a keypad connected to the parallel port.
diff --git a/drivers/staging/panel/panel.c b/drivers/staging/panel/panel.c
index 4ce399b6d237..95c93e82ccec 100644
--- a/drivers/staging/panel/panel.c
+++ b/drivers/staging/panel/panel.c
@@ -55,7 +55,7 @@
 #include <linux/list.h>
 #include <linux/notifier.h>
 #include <linux/reboot.h>
-#include <linux/utsrelease.h>
+#include <generated/utsrelease.h>
 
 #include <linux/io.h>
 #include <asm/uaccess.h>
@@ -378,7 +378,7 @@ static unsigned char lcd_bits[LCD_PORTS][LCD_BITS][BIT_STATES];
 
 #ifdef CONFIG_PANEL_LCD_CHARSET
 #undef DEFAULT_LCD_CHARSET
-#define DEFAULT_LCD_CHARSET
+#define DEFAULT_LCD_CHARSET CONFIG_PANEL_LCD_CHARSET
 #endif
 
 #endif /* DEFAULT_PROFILE == 0 */
diff --git a/drivers/staging/phison/phison.c b/drivers/staging/phison/phison.c
index 270ebcb681a2..3817d7497049 100644
--- a/drivers/staging/phison/phison.c
+++ b/drivers/staging/phison/phison.c
@@ -87,12 +87,12 @@ static struct pci_driver phison_pci_driver = {
 #endif
 };
 
-static int phison_ide_init(void)
+static int __init phison_ide_init(void)
 {
 	return pci_register_driver(&phison_pci_driver);
 }
 
-static void phison_ide_exit(void)
+static void __exit phison_ide_exit(void)
 {
 	pci_unregister_driver(&phison_pci_driver);
 }
diff --git a/drivers/staging/poch/README b/drivers/staging/poch/README
index 842afd464993..ac76ff969a2f 100644
--- a/drivers/staging/poch/README
+++ b/drivers/staging/poch/README
@@ -1,7 +1,6 @@
 TODO:
 	- Rx block size is limited to < 2048, hardware bug?
 	- Group size is limited to < page size, kernel alloc/mmap API issues
-	- fix/workaround cache issues in circular buffer header
 	- test whether Tx is transmitting data from provided buffers
 	- handle device unplug case
 	- handle temperature above threshold
@@ -10,5 +9,128 @@ TODO:
 	- audit userspace interfaces
 	- get reserved major/minor if needed
 
+Sample Code:
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/mman.h>
+#include <sys/ioctl.h>
+#include <poll.h>
+#include <stdio.h>
+#include <error.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <stdint.h>
+
+#include <sysfs/libsysfs.h>
+
+#include <poch.h>
+
+struct pconsume {
+	uint32_t * offsets;
+	uint32_t nfetch;
+	uint32_t nflush;
+};
+
+uint32_t offsets[10];
+
+void process_group(unsigned char *buf, uint32_t size)
+{
+	uint16_t *buf16 = (uint16_t *)buf;
+
+	printf("RX: %p %u %04x %04x %04x %04x %04x %04x\n", buf, size,
+	       buf16[0], buf16[1], buf16[2], buf16[3], buf16[4], buf16[5]);
+}
+
+int main()
+{
+	struct sysfs_attribute *attr;
+	char *path;
+	int ret;
+	unsigned long mmap_size;
+	int fd;
+	unsigned char *cbuf;
+
+	uint32_t nflush;
+	struct pollfd poll_fds;
+	int count = 0;
+	int i;
+
+	path = "/sys/class/pocketchange/poch0/ch0/block_size";
+	attr = sysfs_open_attribute(path);
+	ret = sysfs_write_attribute(attr, "256", strlen("256"));
+	if (ret == -1)
+		error(1, errno, "error writing attribute %s", path);
+	sysfs_close_attribute(attr);
+
+	path = "/sys/class/pocketchange/poch0/ch0/group_size";
+	attr = sysfs_open_attribute(path);
+	ret = sysfs_write_attribute(attr, "4096", strlen("4096"));
+	if (ret == -1)
+		error(1, errno, "error writing attribute %s", path);
+	sysfs_close_attribute(attr);
+
+	path = "/sys/class/pocketchange/poch0/ch0/group_count";
+	attr = sysfs_open_attribute(path);
+	ret = sysfs_write_attribute(attr, "64", strlen("64"));
+	if (ret == -1)
+		error(1, errno, "error writing attribute %s", path);
+	sysfs_close_attribute(attr);
+
+	fd = open("/dev/ch0", O_RDWR);
+	if (fd == -1)
+		error(1, errno, "error opening device node");
+
+	path = "/sys/class/pocketchange/poch0/ch0/mmap_size";
+	attr = sysfs_open_attribute(path);
+	ret = sysfs_read_attribute(attr);
+	if (ret == -1)
+		error(1, errno, "error reading attribute %s", path);
+	printf("%s", attr->value);
+	sscanf(attr->value, "%lu", &mmap_size);
+	sysfs_close_attribute(attr);
+
+	cbuf = mmap(NULL, mmap_size, PROT_READ | PROT_WRITE,
+		    MAP_PRIVATE, fd, 0);
+	if (cbuf == MAP_FAILED)
+		error(1, errno, "error mapping DMA buffers");
+
+	ret = ioctl(fd, POCH_IOC_TRANSFER_START, 0);
+	if (ret == -1)
+		error(1, errno, "error starting transfer");
+
+	nflush = 0;
+	while (1) {
+		struct pconsume consume;
+
+		consume.offsets = offsets;
+		consume.nfetch = 10;
+		consume.nflush = nflush;
+
+		ret = ioctl(fd, POCH_IOC_CONSUME, &consume);
+		if (ret == -1)
+			error(1, errno, "error consuming groups");
+
+		nflush = consume.nfetch;
+
+		for (i = 0; i < nflush; i++) {
+			process_group(cbuf + consume.offsets[i], 4096);
+
+			count++;
+			if (count == 1000)
+				break;
+		}
+
+		if (count == 1000)
+			break;
+	}
+
+	ret = ioctl(fd, POCH_IOC_TRANSFER_STOP, 0);
+	if (ret == -1)
+		error(1, errno, "error starting transfer");
+
+	return 0;
+}
+
 Please send patches to Greg Kroah-Hartman <greg@kroah.com> and
 Vijay Kumar <vijaykumar@bravegnu.org> and Jaya Kumar <jayakumar.lkml@gmail.com>
diff --git a/drivers/staging/poch/poch.c b/drivers/staging/poch/poch.c
index 2eb8e3d43c4d..9095158fb1b3 100644
--- a/drivers/staging/poch/poch.c
+++ b/drivers/staging/poch/poch.c
@@ -197,10 +197,9 @@ struct channel_info {
 
 	/* Contains the header and circular buffer exported to userspace. */
 	spinlock_t group_offsets_lock;
-	struct poch_cbuf_header *header;
-	struct page *header_pg;
-	unsigned long header_size;
 
+	/* Last group consumed by user space. */
+	unsigned int consumed;
 	/* Last group indicated as 'complete' to user space. */
 	unsigned int transfer;
 
@@ -245,6 +244,16 @@ struct poch_dev {
 	struct device *dev;
 };
 
+static int synth_rx;
+module_param(synth_rx, bool, 0600);
+MODULE_PARM_DESC(synth_rx,
+		"Synthesize received values using a counter. Default: No");
+
+static int loopback;
+module_param(loopback, bool, 0600);
+MODULE_PARM_DESC(loopback,
+		"Enable hardware loopback of trasnmitted data. Default: No");
+
 static dev_t poch_first_dev;
 static struct class *poch_cls;
 static DEFINE_IDR(poch_ids);
@@ -317,14 +326,12 @@ static ssize_t show_mmap_size(struct device *dev,
 	int len;
 	unsigned long mmap_size;
 	unsigned long group_pages;
-	unsigned long header_pages;
 	unsigned long total_group_pages;
 
 	group_pages = npages(channel->group_size);
-	header_pages = npages(channel->header_size);
 	total_group_pages = group_pages * channel->group_count;
 
-	mmap_size = (header_pages + total_group_pages) * PAGE_SIZE;
+	mmap_size = total_group_pages * PAGE_SIZE;
 	len = sprintf(buf, "%lu\n", mmap_size);
 	return len;
 }
@@ -357,10 +364,8 @@ static int poch_channel_alloc_groups(struct channel_info *channel)
 {
 	unsigned long i;
 	unsigned long group_pages;
-	unsigned long header_pages;
 
 	group_pages = npages(channel->group_size);
-	header_pages = npages(channel->header_size);
 
 	for (i = 0; i < channel->group_count; i++) {
 		struct poch_group_info *group;
@@ -390,8 +395,7 @@ static int poch_channel_alloc_groups(struct channel_info *channel)
 		 * this?
 		 */
 		group->dma_addr = page_to_pfn(group->pg) * PAGE_SIZE;
-		group->user_offset =
-			(header_pages + (i * group_pages)) * PAGE_SIZE;
+		group->user_offset = (i * group_pages) * PAGE_SIZE;
 
 		printk(KERN_INFO PFX "%ld: user_offset: 0x%lx\n", i,
 		       group->user_offset);
@@ -476,7 +480,7 @@ static void channel_dma_init(struct channel_info *channel)
 		  fpga + block_count_reg);
 	iowrite32(channel->group_count, fpga + group_count_reg);
 	/* FIXME: Hardcoded groups per int. Get it from sysfs? */
-	iowrite32(1, fpga + groups_per_int_reg);
+	iowrite32(16, fpga + groups_per_int_reg);
 
 	/* Unlock PCI address? Not defined in the data sheet, but used
 	 * in the reference code by Redrapids.
@@ -513,56 +517,6 @@ static void channel_dma_init(struct channel_info *channel)
 
 }
 
-static int poch_channel_alloc_header(struct channel_info *channel)
-{
-	struct poch_cbuf_header *header = channel->header;
-	unsigned long group_offset_size;
-	unsigned long tot_group_offsets_size;
-
-	/* Allocate memory to hold header exported userspace */
-	group_offset_size = sizeof(header->group_offsets[0]);
-	tot_group_offsets_size = group_offset_size * channel->group_count;
-	channel->header_size = sizeof(*header) + tot_group_offsets_size;
-	channel->header_pg = alloc_pages(GFP_KERNEL | __GFP_ZERO,
-					 get_order(channel->header_size));
-	if (!channel->header_pg)
-		return -ENOMEM;
-
-	channel->header = page_address(channel->header_pg);
-
-	return 0;
-}
-
-static void poch_channel_free_header(struct channel_info *channel)
-{
-	unsigned int order;
-
-	order = get_order(channel->header_size);
-	__free_pages(channel->header_pg, order);
-}
-
-static void poch_channel_init_header(struct channel_info *channel)
-{
-	int i;
-	struct poch_group_info *groups;
-	s32 *group_offsets;
-
-	channel->header->group_size_bytes = channel->group_size;
-	channel->header->group_count = channel->group_count;
-
-	spin_lock_init(&channel->group_offsets_lock);
-
-	group_offsets = channel->header->group_offsets;
-	groups = channel->groups;
-
-	for (i = 0; i < channel->group_count; i++) {
-		if (channel->dir == CHANNEL_DIR_RX)
-			group_offsets[i] = -1;
-		else
-			group_offsets[i] = groups[i].user_offset;
-	}
-}
-
 static void __poch_channel_clear_counters(struct channel_info *channel)
 {
 	channel->counters.pll_unlock = 0;
@@ -584,6 +538,7 @@ static int poch_channel_init(struct channel_info *channel,
 	if (ret != 0)
 		goto out;
 
+	channel->consumed = 0;
 	channel->transfer = 0;
 
 	/* Allocate memory to hold group information. */
@@ -604,12 +559,6 @@ static int poch_channel_init(struct channel_info *channel,
 		goto out_free_group_info;
 	}
 
-	ret = poch_channel_alloc_header(channel);
-	if (ret) {
-		dev_err(dev, "error allocating user space header\n");
-		goto out_free_groups;
-	}
-
 	channel->fpga_iomem = poch_dev->fpga_iomem;
 	channel->bridge_iomem = poch_dev->bridge_iomem;
 	channel->iomem_lock = &poch_dev->iomem_lock;
@@ -617,14 +566,8 @@ static int poch_channel_init(struct channel_info *channel,
 
 	__poch_channel_clear_counters(channel);
 
-	printk(KERN_WARNING "poch_channel_init_header\n");
-
-	poch_channel_init_header(channel);
-
 	return 0;
 
- out_free_groups:
-	poch_channel_free_groups(channel);
  out_free_group_info:
 	kfree(channel->groups);
  out:
@@ -822,14 +765,21 @@ static int poch_open(struct inode *inode, struct file *filp)
 
 	if (channel->dir == CHANNEL_DIR_TX) {
 		/* Flush TX FIFO and output data from cardbus. */
-		iowrite32(FPGA_TX_CTL_FIFO_FLUSH
-			  | FPGA_TX_CTL_OUTPUT_CARDBUS,
-			  fpga + FPGA_TX_CTL_REG);
+		u32 ctl_val = 0;
+
+		ctl_val |= FPGA_TX_CTL_FIFO_FLUSH;
+		ctl_val |= FPGA_TX_CTL_OUTPUT_CARDBUS;
+		if (loopback)
+			ctl_val |= FPGA_TX_CTL_LOOPBACK;
+
+		iowrite32(ctl_val, fpga + FPGA_TX_CTL_REG);
 	} else {
 		/* Flush RX FIFO and output data to cardbus. */
-		iowrite32(FPGA_RX_CTL_CONT_CAP
-			  | FPGA_RX_CTL_FIFO_FLUSH,
-			  fpga + FPGA_RX_CTL_REG);
+		u32 ctl_val = FPGA_RX_CTL_CONT_CAP | FPGA_RX_CTL_FIFO_FLUSH;
+		if (synth_rx)
+			ctl_val |= FPGA_RX_CTL_SYNTH_DATA;
+
+		iowrite32(ctl_val, fpga + FPGA_RX_CTL_REG);
 	}
 
 	atomic_inc(&channel->inited);
@@ -861,7 +811,6 @@ static int poch_release(struct inode *inode, struct file *filp)
 	}
 
 	atomic_dec(&channel->inited);
-	poch_channel_free_header(channel);
 	poch_channel_free_groups(channel);
 	kfree(channel->groups);
 	atomic_inc(&channel->free);
@@ -870,7 +819,7 @@ static int poch_release(struct inode *inode, struct file *filp)
 }
 
 /*
- * Map the header and the group buffers, to user space.
+ * Map the the group buffers, to user space.
  */
 static int poch_mmap(struct file *filp, struct vm_area_struct *vma)
 {
@@ -880,7 +829,6 @@ static int poch_mmap(struct file *filp, struct vm_area_struct *vma)
 	unsigned long size;
 
 	unsigned long group_pages;
-	unsigned long header_pages;
 	unsigned long total_group_pages;
 
 	int pg_num;
@@ -897,30 +845,16 @@ static int poch_mmap(struct file *filp, struct vm_area_struct *vma)
 	}
 
 	group_pages = npages(channel->group_size);
-	header_pages = npages(channel->header_size);
 	total_group_pages = group_pages * channel->group_count;
 
 	size = vma->vm_end - vma->vm_start;
-	if (size != (header_pages + total_group_pages) * PAGE_SIZE) {
+	if (size != total_group_pages * PAGE_SIZE) {
 		printk(KERN_WARNING PFX "required %lu bytes\n", size);
 		return -EINVAL;
 	}
 
 	start = vma->vm_start;
 
-	/* FIXME: Cleanup required on failure? */
-	pg = channel->header_pg;
-	for (pg_num = 0; pg_num < header_pages; pg_num++, pg++) {
-		printk(KERN_DEBUG PFX "page_count: %d\n", page_count(pg));
-		printk(KERN_DEBUG PFX "%d: header: 0x%lx\n", pg_num, start);
-		ret = vm_insert_page(vma, start, pg);
-		if (ret) {
-			printk(KERN_DEBUG "vm_insert 1 failed at %lx\n", start);
-			return ret;
-		}
-		start += PAGE_SIZE;
-	}
-
 	for (i = 0; i < channel->group_count; i++) {
 		pg = channel->groups[i].pg;
 		for (pg_num = 0; pg_num < group_pages; pg_num++, pg++) {
@@ -947,20 +881,16 @@ static int poch_mmap(struct file *filp, struct vm_area_struct *vma)
  */
 static int poch_channel_available(struct channel_info *channel)
 {
-	int i;
+	int available = 0;
 
 	spin_lock_irq(&channel->group_offsets_lock);
 
-	for (i = 0; i < channel->group_count; i++) {
-		if (channel->header->group_offsets[i] != -1) {
-			spin_unlock_irq(&channel->group_offsets_lock);
-			return 1;
-		}
-	}
+	if (channel->consumed != channel->transfer)
+		available = 1;
 
 	spin_unlock_irq(&channel->group_offsets_lock);
 
-	return 0;
+	return available;
 }
 
 static unsigned int poch_poll(struct file *filp, poll_table *pt)
@@ -1026,6 +956,51 @@ static int poch_ioctl(struct inode *inode, struct file *filp,
 			break;
 		}
 		break;
+	case POCH_IOC_CONSUME:
+	{
+		int available;
+		int nfetch;
+		unsigned int from;
+		unsigned int count;
+		unsigned int i, j;
+		struct poch_consume consume;
+		struct poch_consume *uconsume;
+
+		uconsume = argp;
+		ret = copy_from_user(&consume, uconsume, sizeof(consume));
+		if (ret)
+			return ret;
+
+		spin_lock_irq(&channel->group_offsets_lock);
+
+		channel->consumed += consume.nflush;
+		channel->consumed %= channel->group_count;
+
+		available = channel->transfer - channel->consumed;
+		if (available < 0)
+			available += channel->group_count;
+
+		from = channel->consumed;
+
+		spin_unlock_irq(&channel->group_offsets_lock);
+
+		nfetch = consume.nfetch;
+		count = min(available, nfetch);
+
+		for (i = 0; i < count; i++) {
+			j = (from + i) % channel->group_count;
+			ret = put_user(channel->groups[j].user_offset,
+				       &consume.offsets[i]);
+			if (ret)
+				return -EFAULT;
+		}
+
+		ret = put_user(count, &uconsume->nfetch);
+		if (ret)
+			return -EFAULT;
+
+		break;
+	}
 	case POCH_IOC_GET_COUNTERS:
 		if (!access_ok(VERIFY_WRITE, argp, sizeof(struct poch_counters)))
 			return -EFAULT;
@@ -1073,7 +1048,6 @@ static void poch_irq_dma(struct channel_info *channel)
 	long groups_done;
 	unsigned long i, j;
 	struct poch_group_info *groups;
-	s32 *group_offsets;
 	u32 curr_group_reg;
 
 	if (!atomic_read(&channel->inited))
@@ -1093,20 +1067,24 @@ static void poch_irq_dma(struct channel_info *channel)
 	if (groups_done <= 0)
 		groups_done += channel->group_count;
 
-	group_offsets = channel->header->group_offsets;
 	groups = channel->groups;
 
 	spin_lock(&channel->group_offsets_lock);
 
 	for (i = 0; i < groups_done; i++) {
 		j = (prev_transfer + i) % channel->group_count;
-		group_offsets[j] = groups[j].user_offset;
+
+		channel->transfer += 1;
+		channel->transfer %= channel->group_count;
+
+		if (channel->transfer == channel->consumed) {
+			channel->consumed += 1;
+			channel->consumed %= channel->group_count;
+		}
 	}
 
 	spin_unlock(&channel->group_offsets_lock);
 
-	channel->transfer = curr_transfer;
-
 	wake_up_interruptible(&channel->wq);
 }
 
diff --git a/drivers/staging/poch/poch.h b/drivers/staging/poch/poch.h
index 51a2d145798e..8b08385861fd 100644
--- a/drivers/staging/poch/poch.h
+++ b/drivers/staging/poch/poch.h
@@ -7,11 +7,8 @@
  * include/linux for final version.
  *
  */
-struct poch_cbuf_header {
-	__s32 group_size_bytes;
-	__s32 group_count;
-	__s32 group_offsets[0];
-};
+
+#include <linux/types.h>
 
 struct poch_counters {
 	__u32 fifo_empty;
@@ -19,6 +16,12 @@ struct poch_counters {
 	__u32 pll_unlock;
 };
 
+struct poch_consume {
+	__u32 __user *offsets;
+	__u32 nfetch;
+	__u32 nflush;
+};
+
 #define POCH_IOC_NUM			'9'
 
 #define POCH_IOC_TRANSFER_START		_IO(POCH_IOC_NUM, 0)
@@ -27,3 +30,6 @@ struct poch_counters {
 					     struct poch_counters)
 #define POCH_IOC_SYNC_GROUP_FOR_USER	_IO(POCH_IOC_NUM, 3)
 #define POCH_IOC_SYNC_GROUP_FOR_DEVICE	_IO(POCH_IOC_NUM, 4)
+
+#define POCH_IOC_CONSUME		_IOWR(POCH_IOC_NUM, 5, \
+					      struct poch_consume)
diff --git a/drivers/staging/pohmelfs/dir.c b/drivers/staging/pohmelfs/dir.c
index 6c5b261e9f06..aacd25bfb0cb 100644
--- a/drivers/staging/pohmelfs/dir.c
+++ b/drivers/staging/pohmelfs/dir.c
@@ -722,8 +722,6 @@ static int pohmelfs_remove_entry(struct inode *dir, struct dentry *dentry)
 		if (inode->i_nlink)
 			inode_dec_link_count(inode);
 	}
-	dprintk("%s: inode: %p, lock: %ld, unhashed: %d.\n",
-		__func__, pi, inode->i_state & I_LOCK, hlist_unhashed(&inode->i_hash));
 
 	return err;
 }
diff --git a/drivers/staging/quatech_usb2/quatech_usb2.c b/drivers/staging/quatech_usb2/quatech_usb2.c
index 2acef9466d47..f7726f1d3641 100644
--- a/drivers/staging/quatech_usb2/quatech_usb2.c
+++ b/drivers/staging/quatech_usb2/quatech_usb2.c
@@ -1670,7 +1670,7 @@ __func__);
 		dbg("%s(): failed resubmitting read urb, error %d",
 			__func__, result);
 	} else {
-		dbg("%s() sucessfully resumitted read urb", __func__);
+		dbg("%s() successfully resubmitted read urb", __func__);
 		if (tty_st && RxCount) {
 			/* if some inbound data was processed, then
 			 * we need to push that through the tty layer
diff --git a/drivers/staging/ramzswap/Kconfig b/drivers/staging/ramzswap/Kconfig
new file mode 100644
index 000000000000..24e25691fae2
--- /dev/null
+++ b/drivers/staging/ramzswap/Kconfig
@@ -0,0 +1,21 @@
+config RAMZSWAP
+	tristate "Compressed in-memory swap device (ramzswap)"
+	depends on SWAP
+	select LZO_COMPRESS
+	select LZO_DECOMPRESS
+	default n
+	help
+	  Creates virtual block devices which can be used (only) as a swap
+	  disks. Pages swapped to these disks are compressed and stored in
+	  memory itself.
+
+	  See ramzswap.txt for more information.
+	  Project home: http://compcache.googlecode.com/
+
+config RAMZSWAP_STATS
+	bool "Enable ramzswap stats"
+	depends on RAMZSWAP
+	default y
+	help
+	  Enable statistics collection for ramzswap. This adds only a minimal
+	  overhead. In unsure, say Y.
diff --git a/drivers/staging/ramzswap/Makefile b/drivers/staging/ramzswap/Makefile
new file mode 100644
index 000000000000..507d7dc3b864
--- /dev/null
+++ b/drivers/staging/ramzswap/Makefile
@@ -0,0 +1,3 @@
+ramzswap-objs	:=	ramzswap_drv.o xvmalloc.o
+
+obj-$(CONFIG_RAMZSWAP)	+=	ramzswap.o
diff --git a/drivers/staging/ramzswap/TODO b/drivers/staging/ramzswap/TODO
new file mode 100644
index 000000000000..8d64e28fac0e
--- /dev/null
+++ b/drivers/staging/ramzswap/TODO
@@ -0,0 +1,5 @@
+TODO:
+	- Add support for swap notifiers
+
+Please send patches to Greg Kroah-Hartman <greg@kroah.com> and
+Nitin Gupta <ngupta@vflare.org>
diff --git a/drivers/staging/ramzswap/ramzswap.txt b/drivers/staging/ramzswap/ramzswap.txt
new file mode 100644
index 000000000000..e9f1619505a0
--- /dev/null
+++ b/drivers/staging/ramzswap/ramzswap.txt
@@ -0,0 +1,51 @@
+ramzswap: Compressed RAM based swap device
+-------------------------------------------
+
+Project home: http://compcache.googlecode.com/
+
+* Introduction
+
+It creates RAM based block devices which can be used (only) as swap disks.
+Pages swapped to these devices are compressed and stored in memory itself.
+See project home for use cases, performance numbers and a lot more.
+
+Individual ramzswap devices are configured and initialized using rzscontrol
+userspace utility as shown in examples below. See rzscontrol man page for more
+details.
+
+* Usage
+
+Following shows a typical sequence of steps for using ramzswap.
+
+1) Load Modules:
+	modprobe ramzswap num_devices=4
+	This creates 4 (uninitialized) devices: /dev/ramzswap{0,1,2,3}
+	(num_devices parameter is optional. Default: 1)
+
+2) Initialize:
+	Use rzscontrol utility to configure and initialize individual
+	ramzswap devices. Example:
+	rzscontrol /dev/ramzswap2 --init # uses default value of disksize_kb
+
+	*See rzscontrol man page for more details and examples*
+
+3) Activate:
+	swapon /dev/ramzswap2 # or any other initialized ramzswap device
+
+4) Stats:
+	rzscontrol /dev/ramzswap2 --stats
+
+5) Deactivate:
+	swapoff /dev/ramzswap2
+
+6) Reset:
+	rzscontrol /dev/ramzswap2 --reset
+	(This frees all the memory allocated for this device).
+
+
+Please report any problems at:
+ - Mailing list: linux-mm-cc at laptop dot org
+ - Issue tracker: http://code.google.com/p/compcache/issues/list
+
+Nitin Gupta
+ngupta@vflare.org
diff --git a/drivers/staging/ramzswap/ramzswap_drv.c b/drivers/staging/ramzswap/ramzswap_drv.c
new file mode 100644
index 000000000000..989fac5b01b3
--- /dev/null
+++ b/drivers/staging/ramzswap/ramzswap_drv.c
@@ -0,0 +1,1413 @@
+/*
+ * Compressed RAM based swap device
+ *
+ * Copyright (C) 2008, 2009  Nitin Gupta
+ *
+ * This code is released using a dual license strategy: BSD/GPL
+ * You can choose the licence that better fits your requirements.
+ *
+ * Released under the terms of 3-clause BSD License
+ * Released under the terms of GNU General Public License Version 2.0
+ *
+ * Project home: http://compcache.googlecode.com
+ */
+
+#define KMSG_COMPONENT "ramzswap"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/bitops.h>
+#include <linux/blkdev.h>
+#include <linux/buffer_head.h>
+#include <linux/device.h>
+#include <linux/genhd.h>
+#include <linux/highmem.h>
+#include <linux/lzo.h>
+#include <linux/mutex.h>
+#include <linux/string.h>
+#include <linux/swap.h>
+#include <linux/swapops.h>
+#include <linux/vmalloc.h>
+#include <linux/version.h>
+
+#include "ramzswap_drv.h"
+
+/* Globals */
+static int ramzswap_major;
+static struct ramzswap *devices;
+
+/*
+ * Pages that compress to larger than this size are
+ * forwarded to backing swap, if present or stored
+ * uncompressed in memory otherwise.
+ */
+static unsigned int max_zpage_size;
+
+/* Module params (documentation at end) */
+static unsigned int num_devices;
+
+static int rzs_test_flag(struct ramzswap *rzs, u32 index,
+			enum rzs_pageflags flag)
+{
+	return rzs->table[index].flags & BIT(flag);
+}
+
+static void rzs_set_flag(struct ramzswap *rzs, u32 index,
+			enum rzs_pageflags flag)
+{
+	rzs->table[index].flags |= BIT(flag);
+}
+
+static void rzs_clear_flag(struct ramzswap *rzs, u32 index,
+			enum rzs_pageflags flag)
+{
+	rzs->table[index].flags &= ~BIT(flag);
+}
+
+static int page_zero_filled(void *ptr)
+{
+	unsigned int pos;
+	unsigned long *page;
+
+	page = (unsigned long *)ptr;
+
+	for (pos = 0; pos != PAGE_SIZE / sizeof(*page); pos++) {
+		if (page[pos])
+			return 0;
+	}
+
+	return 1;
+}
+
+/*
+ * memlimit cannot be greater than backing disk size.
+ */
+static void ramzswap_set_memlimit(struct ramzswap *rzs, size_t totalram_bytes)
+{
+	int memlimit_valid = 1;
+
+	if (!rzs->memlimit) {
+		pr_info("Memory limit not set.\n");
+		memlimit_valid = 0;
+	}
+
+	if (rzs->memlimit > rzs->disksize) {
+		pr_info("Memory limit cannot be greater than "
+			"disksize: limit=%zu, disksize=%zu\n",
+			rzs->memlimit, rzs->disksize);
+		memlimit_valid = 0;
+	}
+
+	if (!memlimit_valid) {
+		size_t mempart, disksize;
+		pr_info("Using default: smaller of (%u%% of RAM) and "
+			"(backing disk size).\n",
+			default_memlimit_perc_ram);
+		mempart = default_memlimit_perc_ram * (totalram_bytes / 100);
+		disksize = rzs->disksize;
+		rzs->memlimit = mempart > disksize ? disksize : mempart;
+	}
+
+	if (rzs->memlimit > totalram_bytes / 2) {
+		pr_info(
+		"Its not advisable setting limit more than half of "
+		"size of memory since we expect a 2:1 compression ratio. "
+		"Limit represents amount of *compressed* data we can keep "
+		"in memory!\n"
+		"\tMemory Size: %zu kB\n"
+		"\tLimit you selected: %zu kB\n"
+		"Continuing anyway ...\n",
+		totalram_bytes >> 10, rzs->memlimit >> 10
+		);
+	}
+
+	rzs->memlimit &= PAGE_MASK;
+	BUG_ON(!rzs->memlimit);
+}
+
+static void ramzswap_set_disksize(struct ramzswap *rzs, size_t totalram_bytes)
+{
+	if (!rzs->disksize) {
+		pr_info(
+		"disk size not provided. You can use disksize_kb module "
+		"param to specify size.\nUsing default: (%u%% of RAM).\n",
+		default_disksize_perc_ram
+		);
+		rzs->disksize = default_disksize_perc_ram *
+					(totalram_bytes / 100);
+	}
+
+	if (rzs->disksize > 2 * (totalram_bytes)) {
+		pr_info(
+		"There is little point creating a ramzswap of greater than "
+		"twice the size of memory since we expect a 2:1 compression "
+		"ratio. Note that ramzswap uses about 0.1%% of the size of "
+		"the swap device when not in use so a huge ramzswap is "
+		"wasteful.\n"
+		"\tMemory Size: %zu kB\n"
+		"\tSize you selected: %zu kB\n"
+		"Continuing anyway ...\n",
+		totalram_bytes >> 10, rzs->disksize
+		);
+	}
+
+	rzs->disksize &= PAGE_MASK;
+}
+
+/*
+ * Swap header (1st page of swap device) contains information
+ * to indentify it as a swap partition. Prepare such a header
+ * for ramzswap device (ramzswap0) so that swapon can identify
+ * it as swap partition. In case backing swap device is provided,
+ * copy its swap header.
+ */
+static int setup_swap_header(struct ramzswap *rzs, union swap_header *s)
+{
+	int ret = 0;
+	struct page *page;
+	struct address_space *mapping;
+	union swap_header *backing_swap_header;
+
+	/*
+	 * There is no backing swap device. Create a swap header
+	 * that is acceptable by swapon.
+	 */
+	if (!rzs->backing_swap) {
+		s->info.version = 1;
+		s->info.last_page = (rzs->disksize >> PAGE_SHIFT) - 1;
+		s->info.nr_badpages = 0;
+		memcpy(s->magic.magic, "SWAPSPACE2", 10);
+		return 0;
+	}
+
+	/*
+	 * We have a backing swap device. Copy its swap header
+	 * to ramzswap device header. If this header contains
+	 * invalid information (backing device not a swap
+	 * partition, etc.), swapon will fail for ramzswap
+	 * which is correct behavior - we don't want to swap
+	 * over filesystem partition!
+	 */
+
+	/* Read the backing swap header (code from sys_swapon) */
+	mapping = rzs->swap_file->f_mapping;
+	if (!mapping->a_ops->readpage) {
+		ret = -EINVAL;
+		goto out;
+	}
+
+	page = read_mapping_page(mapping, 0, rzs->swap_file);
+	if (IS_ERR(page)) {
+		ret = PTR_ERR(page);
+		goto out;
+	}
+
+	backing_swap_header = kmap(page);
+	memcpy(s, backing_swap_header, sizeof(*s));
+	if (s->info.nr_badpages) {
+		pr_info("Cannot use backing swap with bad pages (%u)\n",
+			s->info.nr_badpages);
+		ret = -EINVAL;
+	}
+	/*
+	 * ramzswap disksize equals number of usable pages in backing
+	 * swap. Set last_page in swap header to match this disksize
+	 * ('last_page' means 0-based index of last usable swap page).
+	 */
+	s->info.last_page = (rzs->disksize >> PAGE_SHIFT) - 1;
+	kunmap(page);
+
+out:
+	return ret;
+}
+
+void ramzswap_ioctl_get_stats(struct ramzswap *rzs,
+			struct ramzswap_ioctl_stats *s)
+{
+	strncpy(s->backing_swap_name, rzs->backing_swap_name,
+		MAX_SWAP_NAME_LEN - 1);
+	s->backing_swap_name[MAX_SWAP_NAME_LEN - 1] = '\0';
+
+	s->disksize = rzs->disksize;
+	s->memlimit = rzs->memlimit;
+
+#if defined(CONFIG_RAMZSWAP_STATS)
+	{
+	struct ramzswap_stats *rs = &rzs->stats;
+	size_t succ_writes, mem_used;
+	unsigned int good_compress_perc = 0, no_compress_perc = 0;
+
+	mem_used = xv_get_total_size_bytes(rzs->mem_pool)
+			+ (rs->pages_expand << PAGE_SHIFT);
+	succ_writes = rs->num_writes - rs->failed_writes;
+
+	if (succ_writes && rs->pages_stored) {
+		good_compress_perc = rs->good_compress * 100
+					/ rs->pages_stored;
+		no_compress_perc = rs->pages_expand * 100
+					/ rs->pages_stored;
+	}
+
+	s->num_reads = rs->num_reads;
+	s->num_writes = rs->num_writes;
+	s->failed_reads = rs->failed_reads;
+	s->failed_writes = rs->failed_writes;
+	s->invalid_io = rs->invalid_io;
+	s->pages_zero = rs->pages_zero;
+
+	s->good_compress_pct = good_compress_perc;
+	s->pages_expand_pct = no_compress_perc;
+
+	s->pages_stored = rs->pages_stored;
+	s->pages_used = mem_used >> PAGE_SHIFT;
+	s->orig_data_size = rs->pages_stored << PAGE_SHIFT;
+	s->compr_data_size = rs->compr_size;
+	s->mem_used_total = mem_used;
+
+	s->bdev_num_reads = rs->bdev_num_reads;
+	s->bdev_num_writes = rs->bdev_num_writes;
+	}
+#endif /* CONFIG_RAMZSWAP_STATS */
+}
+
+static int add_backing_swap_extent(struct ramzswap *rzs,
+				pgoff_t phy_pagenum,
+				pgoff_t num_pages)
+{
+	unsigned int idx;
+	struct list_head *head;
+	struct page *curr_page, *new_page;
+	unsigned int extents_per_page = PAGE_SIZE /
+				sizeof(struct ramzswap_backing_extent);
+
+	idx = rzs->num_extents % extents_per_page;
+	if (!idx) {
+		new_page = alloc_page(__GFP_ZERO);
+		if (!new_page)
+			return -ENOMEM;
+
+		if (rzs->num_extents) {
+			curr_page = virt_to_page(rzs->curr_extent);
+			head = &curr_page->lru;
+		} else {
+			head = &rzs->backing_swap_extent_list;
+		}
+
+		list_add(&new_page->lru, head);
+		rzs->curr_extent = page_address(new_page);
+	}
+
+	rzs->curr_extent->phy_pagenum = phy_pagenum;
+	rzs->curr_extent->num_pages = num_pages;
+
+	pr_debug("add_extent: idx=%u, phy_pgnum=%lu, num_pgs=%lu, "
+		"pg_last=%lu, curr_ext=%p\n", idx, phy_pagenum, num_pages,
+		phy_pagenum + num_pages - 1, rzs->curr_extent);
+
+	if (idx != extents_per_page - 1)
+		rzs->curr_extent++;
+
+	return 0;
+}
+
+static int setup_backing_swap_extents(struct ramzswap *rzs,
+				struct inode *inode, unsigned long *num_pages)
+{
+	int ret = 0;
+	unsigned blkbits;
+	unsigned blocks_per_page;
+	pgoff_t contig_pages = 0, total_pages = 0;
+	pgoff_t pagenum = 0, prev_pagenum = 0;
+	sector_t probe_block = 0;
+	sector_t last_block;
+
+	blkbits = inode->i_blkbits;
+	blocks_per_page = PAGE_SIZE >> blkbits;
+
+	last_block = i_size_read(inode) >> blkbits;
+	while (probe_block + blocks_per_page <= last_block) {
+		unsigned block_in_page;
+		sector_t first_block;
+
+		first_block = bmap(inode, probe_block);
+		if (first_block == 0)
+			goto bad_bmap;
+
+		/* It must be PAGE_SIZE aligned on-disk */
+		if (first_block & (blocks_per_page - 1)) {
+			probe_block++;
+			goto probe_next;
+		}
+
+		/* All blocks within this page must be contiguous on disk */
+		for (block_in_page = 1; block_in_page < blocks_per_page;
+					block_in_page++) {
+			sector_t block;
+
+			block = bmap(inode, probe_block + block_in_page);
+			if (block == 0)
+				goto bad_bmap;
+			if (block != first_block + block_in_page) {
+				/* Discontiguity */
+				probe_block++;
+				goto probe_next;
+			}
+		}
+
+		/*
+		 * We found a PAGE_SIZE length, PAGE_SIZE aligned
+		 * run of blocks.
+		 */
+		pagenum = first_block >> (PAGE_SHIFT - blkbits);
+
+		if (total_pages && (pagenum != prev_pagenum + 1)) {
+			ret = add_backing_swap_extent(rzs, prev_pagenum -
+					(contig_pages - 1), contig_pages);
+			if (ret < 0)
+				goto out;
+			rzs->num_extents++;
+			contig_pages = 0;
+		}
+		total_pages++;
+		contig_pages++;
+		prev_pagenum = pagenum;
+		probe_block += blocks_per_page;
+
+probe_next:
+		continue;
+	}
+
+	if (contig_pages) {
+		pr_debug("adding last extent: pagenum=%lu, "
+			"contig_pages=%lu\n", pagenum, contig_pages);
+		ret = add_backing_swap_extent(rzs,
+			prev_pagenum - (contig_pages - 1), contig_pages);
+		if (ret < 0)
+			goto out;
+		rzs->num_extents++;
+	}
+	if (!rzs->num_extents) {
+		pr_err("No swap extents found!\n");
+		ret = -EINVAL;
+	}
+
+	if (!ret) {
+		*num_pages = total_pages;
+		pr_info("Found %lu extents containing %luk\n",
+			rzs->num_extents, *num_pages << (PAGE_SHIFT - 10));
+	}
+	goto out;
+
+bad_bmap:
+	pr_err("Backing swapfile has holes\n");
+	ret = -EINVAL;
+out:
+	while (ret && !list_empty(&rzs->backing_swap_extent_list)) {
+		struct page *page;
+		struct list_head *entry = rzs->backing_swap_extent_list.next;
+		page = list_entry(entry, struct page, lru);
+		list_del(entry);
+		__free_page(page);
+	}
+	return ret;
+}
+
+static void map_backing_swap_extents(struct ramzswap *rzs)
+{
+	struct ramzswap_backing_extent *se;
+	struct page *table_page, *se_page;
+	unsigned long num_pages, num_table_pages, entry;
+	unsigned long se_idx, span;
+	unsigned entries_per_page = PAGE_SIZE / sizeof(*rzs->table);
+	unsigned extents_per_page = PAGE_SIZE / sizeof(*se);
+
+	/* True for block device */
+	if (!rzs->num_extents)
+		return;
+
+	se_page = list_entry(rzs->backing_swap_extent_list.next,
+					struct page, lru);
+	se = page_address(se_page);
+	span = se->num_pages;
+	num_pages = rzs->disksize >> PAGE_SHIFT;
+	num_table_pages = DIV_ROUND_UP(num_pages * sizeof(*rzs->table),
+							PAGE_SIZE);
+
+	entry = 0;
+	se_idx = 0;
+	while (num_table_pages--) {
+		table_page = vmalloc_to_page(&rzs->table[entry]);
+		while (span <= entry) {
+			se_idx++;
+			if (se_idx == rzs->num_extents)
+				BUG();
+
+			if (!(se_idx % extents_per_page)) {
+				se_page = list_entry(se_page->lru.next,
+						struct page, lru);
+				se = page_address(se_page);
+			} else
+				se++;
+
+			span += se->num_pages;
+		}
+		table_page->mapping = (struct address_space *)se;
+		table_page->private = se->num_pages - (span - entry);
+		pr_debug("map_table: entry=%lu, span=%lu, map=%p, priv=%lu\n",
+			entry, span, table_page->mapping, table_page->private);
+		entry += entries_per_page;
+	}
+}
+
+/*
+ * Check if value of backing_swap module param is sane.
+ * Claim this device and set ramzswap size equal to
+ * size of this block device.
+ */
+static int setup_backing_swap(struct ramzswap *rzs)
+{
+	int ret = 0;
+	size_t disksize;
+	unsigned long num_pages = 0;
+	struct inode *inode;
+	struct file *swap_file;
+	struct address_space *mapping;
+	struct block_device *bdev = NULL;
+
+	if (!rzs->backing_swap_name[0]) {
+		pr_debug("backing_swap param not given\n");
+		goto out;
+	}
+
+	pr_info("Using backing swap device: %s\n", rzs->backing_swap_name);
+
+	swap_file = filp_open(rzs->backing_swap_name,
+				O_RDWR | O_LARGEFILE, 0);
+	if (IS_ERR(swap_file)) {
+		pr_err("Error opening backing device: %s\n",
+			rzs->backing_swap_name);
+		ret = -EINVAL;
+		goto out;
+	}
+
+	mapping = swap_file->f_mapping;
+	inode = mapping->host;
+
+	if (S_ISBLK(inode->i_mode)) {
+		bdev = I_BDEV(inode);
+		ret = bd_claim(bdev, setup_backing_swap);
+		if (ret < 0) {
+			bdev = NULL;
+			goto bad_param;
+		}
+		disksize = i_size_read(inode);
+	} else if (S_ISREG(inode->i_mode)) {
+		bdev = inode->i_sb->s_bdev;
+		if (IS_SWAPFILE(inode)) {
+			ret = -EBUSY;
+			goto bad_param;
+		}
+		ret = setup_backing_swap_extents(rzs, inode, &num_pages);
+		if (ret < 0)
+			goto bad_param;
+		disksize = num_pages << PAGE_SHIFT;
+	} else {
+		goto bad_param;
+	}
+
+	rzs->swap_file = swap_file;
+	rzs->backing_swap = bdev;
+	rzs->disksize = disksize;
+	BUG_ON(!rzs->disksize);
+
+	return 0;
+
+bad_param:
+	if (bdev)
+		bd_release(bdev);
+	filp_close(swap_file, NULL);
+
+out:
+	rzs->backing_swap = NULL;
+	return ret;
+}
+
+/*
+ * Map logical page number 'pagenum' to physical page number
+ * on backing swap device. For block device, this is a nop.
+ */
+u32 map_backing_swap_page(struct ramzswap *rzs, u32 pagenum)
+{
+	u32 skip_pages, entries_per_page;
+	size_t delta, se_offset, skipped;
+	struct page *table_page, *se_page;
+	struct ramzswap_backing_extent *se;
+
+	if (!rzs->num_extents)
+		return pagenum;
+
+	entries_per_page = PAGE_SIZE / sizeof(*rzs->table);
+
+	table_page = vmalloc_to_page(&rzs->table[pagenum]);
+	se = (struct ramzswap_backing_extent *)table_page->mapping;
+	se_page = virt_to_page(se);
+
+	skip_pages = pagenum - (pagenum / entries_per_page * entries_per_page);
+	se_offset = table_page->private + skip_pages;
+
+	if (se_offset < se->num_pages)
+		return se->phy_pagenum + se_offset;
+
+	skipped = se->num_pages - table_page->private;
+	do {
+		struct ramzswap_backing_extent *se_base;
+		u32 se_entries_per_page = PAGE_SIZE / sizeof(*se);
+
+		/* Get next swap extent */
+		se_base = (struct ramzswap_backing_extent *)
+						page_address(se_page);
+		if (se - se_base == se_entries_per_page - 1) {
+			se_page = list_entry(se_page->lru.next,
+						struct page, lru);
+			se = page_address(se_page);
+		} else {
+			se++;
+		}
+
+		skipped += se->num_pages;
+	} while (skipped < skip_pages);
+
+	delta = skipped - skip_pages;
+	se_offset = se->num_pages - delta;
+
+	return se->phy_pagenum + se_offset;
+}
+
+static void ramzswap_free_page(struct ramzswap *rzs, size_t index)
+{
+	u32 clen;
+	void *obj;
+
+	struct page *page = rzs->table[index].page;
+	u32 offset = rzs->table[index].offset;
+
+	if (unlikely(!page)) {
+		if (rzs_test_flag(rzs, index, RZS_ZERO)) {
+			rzs_clear_flag(rzs, index, RZS_ZERO);
+			stat_dec(rzs->stats.pages_zero);
+		}
+		return;
+	}
+
+	if (unlikely(rzs_test_flag(rzs, index, RZS_UNCOMPRESSED))) {
+		clen = PAGE_SIZE;
+		__free_page(page);
+		rzs_clear_flag(rzs, index, RZS_UNCOMPRESSED);
+		stat_dec(rzs->stats.pages_expand);
+		goto out;
+	}
+
+	obj = kmap_atomic(page, KM_USER0) + offset;
+	clen = xv_get_object_size(obj) - sizeof(struct zobj_header);
+	kunmap_atomic(obj, KM_USER0);
+
+	xv_free(rzs->mem_pool, page, offset);
+	if (clen <= PAGE_SIZE / 2)
+		stat_dec(rzs->stats.good_compress);
+
+out:
+	rzs->stats.compr_size -= clen;
+	stat_dec(rzs->stats.pages_stored);
+
+	rzs->table[index].page = NULL;
+	rzs->table[index].offset = 0;
+}
+
+static int handle_zero_page(struct bio *bio)
+{
+	void *user_mem;
+	struct page *page = bio->bi_io_vec[0].bv_page;
+
+	user_mem = kmap_atomic(page, KM_USER0);
+	memset(user_mem, 0, PAGE_SIZE);
+	kunmap_atomic(user_mem, KM_USER0);
+
+	flush_dcache_page(page);
+
+	set_bit(BIO_UPTODATE, &bio->bi_flags);
+	bio_endio(bio, 0);
+	return 0;
+}
+
+static int handle_uncompressed_page(struct ramzswap *rzs, struct bio *bio)
+{
+	u32 index;
+	struct page *page;
+	unsigned char *user_mem, *cmem;
+
+	page = bio->bi_io_vec[0].bv_page;
+	index = bio->bi_sector >> SECTORS_PER_PAGE_SHIFT;
+
+	user_mem = kmap_atomic(page, KM_USER0);
+	cmem = kmap_atomic(rzs->table[index].page, KM_USER1) +
+			rzs->table[index].offset;
+
+	memcpy(user_mem, cmem, PAGE_SIZE);
+	kunmap_atomic(user_mem, KM_USER0);
+	kunmap_atomic(cmem, KM_USER1);
+
+	flush_dcache_page(page);
+
+	set_bit(BIO_UPTODATE, &bio->bi_flags);
+	bio_endio(bio, 0);
+	return 0;
+}
+
+
+/*
+ * Called when request page is not present in ramzswap.
+ * Its either in backing swap device (if present) or
+ * this is an attempt to read before any previous write
+ * to this location - this happens due to readahead when
+ * swap device is read from user-space (e.g. during swapon)
+ */
+static int handle_ramzswap_fault(struct ramzswap *rzs, struct bio *bio)
+{
+	/*
+	 * Always forward such requests to backing swap
+	 * device (if present)
+	 */
+	if (rzs->backing_swap) {
+		u32 pagenum;
+		stat_dec(rzs->stats.num_reads);
+		stat_inc(rzs->stats.bdev_num_reads);
+		bio->bi_bdev = rzs->backing_swap;
+
+		/*
+		 * In case backing swap is a file, find the right offset within
+		 * the file corresponding to logical position 'index'. For block
+		 * device, this is a nop.
+		 */
+		pagenum = bio->bi_sector >> SECTORS_PER_PAGE_SHIFT;
+		bio->bi_sector = map_backing_swap_page(rzs, pagenum)
+					<< SECTORS_PER_PAGE_SHIFT;
+		return 1;
+	}
+
+	/*
+	 * Its unlikely event in case backing dev is
+	 * not present
+	 */
+	pr_debug("Read before write on swap device: "
+		"sector=%lu, size=%u, offset=%u\n",
+		(ulong)(bio->bi_sector), bio->bi_size,
+		bio->bi_io_vec[0].bv_offset);
+
+	/* Do nothing. Just return success */
+	set_bit(BIO_UPTODATE, &bio->bi_flags);
+	bio_endio(bio, 0);
+	return 0;
+}
+
+static int ramzswap_read(struct ramzswap *rzs, struct bio *bio)
+{
+	int ret;
+	u32 index;
+	size_t clen;
+	struct page *page;
+	struct zobj_header *zheader;
+	unsigned char *user_mem, *cmem;
+
+	stat_inc(rzs->stats.num_reads);
+
+	page = bio->bi_io_vec[0].bv_page;
+	index = bio->bi_sector >> SECTORS_PER_PAGE_SHIFT;
+
+	if (rzs_test_flag(rzs, index, RZS_ZERO))
+		return handle_zero_page(bio);
+
+	/* Requested page is not present in compressed area */
+	if (!rzs->table[index].page)
+		return handle_ramzswap_fault(rzs, bio);
+
+	/* Page is stored uncompressed since its incompressible */
+	if (unlikely(rzs_test_flag(rzs, index, RZS_UNCOMPRESSED)))
+		return handle_uncompressed_page(rzs, bio);
+
+	user_mem = kmap_atomic(page, KM_USER0);
+	clen = PAGE_SIZE;
+
+	cmem = kmap_atomic(rzs->table[index].page, KM_USER1) +
+			rzs->table[index].offset;
+
+	ret = lzo1x_decompress_safe(
+		cmem + sizeof(*zheader),
+		xv_get_object_size(cmem) - sizeof(*zheader),
+		user_mem, &clen);
+
+	kunmap_atomic(user_mem, KM_USER0);
+	kunmap_atomic(cmem, KM_USER1);
+
+	/* should NEVER happen */
+	if (unlikely(ret != LZO_E_OK)) {
+		pr_err("Decompression failed! err=%d, page=%u\n",
+			ret, index);
+		stat_inc(rzs->stats.failed_reads);
+		goto out;
+	}
+
+	flush_dcache_page(page);
+
+	set_bit(BIO_UPTODATE, &bio->bi_flags);
+	bio_endio(bio, 0);
+	return 0;
+
+out:
+	bio_io_error(bio);
+	return 0;
+}
+
+static int ramzswap_write(struct ramzswap *rzs, struct bio *bio)
+{
+	int ret, fwd_write_request = 0;
+	u32 offset, index;
+	size_t clen;
+	struct zobj_header *zheader;
+	struct page *page, *page_store;
+	unsigned char *user_mem, *cmem, *src;
+
+	stat_inc(rzs->stats.num_writes);
+
+	page = bio->bi_io_vec[0].bv_page;
+	index = bio->bi_sector >> SECTORS_PER_PAGE_SHIFT;
+
+	src = rzs->compress_buffer;
+
+	/*
+	 * System swaps to same sector again when the stored page
+	 * is no longer referenced by any process. So, its now safe
+	 * to free the memory that was allocated for this page.
+	 */
+	if (rzs->table[index].page)
+		ramzswap_free_page(rzs, index);
+
+	/*
+	 * No memory ia allocated for zero filled pages.
+	 * Simply clear zero page flag.
+	 */
+	if (rzs_test_flag(rzs, index, RZS_ZERO)) {
+		stat_dec(rzs->stats.pages_zero);
+		rzs_clear_flag(rzs, index, RZS_ZERO);
+	}
+
+	mutex_lock(&rzs->lock);
+
+	user_mem = kmap_atomic(page, KM_USER0);
+	if (page_zero_filled(user_mem)) {
+		kunmap_atomic(user_mem, KM_USER0);
+		mutex_unlock(&rzs->lock);
+		stat_inc(rzs->stats.pages_zero);
+		rzs_set_flag(rzs, index, RZS_ZERO);
+
+		set_bit(BIO_UPTODATE, &bio->bi_flags);
+		bio_endio(bio, 0);
+		return 0;
+	}
+
+	if (rzs->backing_swap &&
+		(rzs->stats.compr_size > rzs->memlimit - PAGE_SIZE)) {
+		kunmap_atomic(user_mem, KM_USER0);
+		mutex_unlock(&rzs->lock);
+		fwd_write_request = 1;
+		goto out;
+	}
+
+	ret = lzo1x_1_compress(user_mem, PAGE_SIZE, src, &clen,
+				rzs->compress_workmem);
+
+	kunmap_atomic(user_mem, KM_USER0);
+
+	if (unlikely(ret != LZO_E_OK)) {
+		mutex_unlock(&rzs->lock);
+		pr_err("Compression failed! err=%d\n", ret);
+		stat_inc(rzs->stats.failed_writes);
+		goto out;
+	}
+
+	/*
+	 * Page is incompressible. Forward it to backing swap
+	 * if present. Otherwise, store it as-is (uncompressed)
+	 * since we do not want to return too many swap write
+	 * errors which has side effect of hanging the system.
+	 */
+	if (unlikely(clen > max_zpage_size)) {
+		if (rzs->backing_swap) {
+			mutex_unlock(&rzs->lock);
+			fwd_write_request = 1;
+			goto out;
+		}
+
+		clen = PAGE_SIZE;
+		page_store = alloc_page(GFP_NOIO | __GFP_HIGHMEM);
+		if (unlikely(!page_store)) {
+			mutex_unlock(&rzs->lock);
+			pr_info("Error allocating memory for incompressible "
+				"page: %u\n", index);
+			stat_inc(rzs->stats.failed_writes);
+			goto out;
+		}
+
+		offset = 0;
+		rzs_set_flag(rzs, index, RZS_UNCOMPRESSED);
+		stat_inc(rzs->stats.pages_expand);
+		rzs->table[index].page = page_store;
+		src = kmap_atomic(page, KM_USER0);
+		goto memstore;
+	}
+
+	if (xv_malloc(rzs->mem_pool, clen + sizeof(*zheader),
+			&rzs->table[index].page, &offset,
+			GFP_NOIO | __GFP_HIGHMEM)) {
+		mutex_unlock(&rzs->lock);
+		pr_info("Error allocating memory for compressed "
+			"page: %u, size=%zu\n", index, clen);
+		stat_inc(rzs->stats.failed_writes);
+		if (rzs->backing_swap)
+			fwd_write_request = 1;
+		goto out;
+	}
+
+memstore:
+	rzs->table[index].offset = offset;
+
+	cmem = kmap_atomic(rzs->table[index].page, KM_USER1) +
+			rzs->table[index].offset;
+
+#if 0
+	/* Back-reference needed for memory defragmentation */
+	if (!rzs_test_flag(rzs, index, RZS_UNCOMPRESSED)) {
+		zheader = (struct zobj_header *)cmem;
+		zheader->table_idx = index;
+		cmem += sizeof(*zheader);
+	}
+#endif
+
+	memcpy(cmem, src, clen);
+
+	kunmap_atomic(cmem, KM_USER1);
+	if (unlikely(rzs_test_flag(rzs, index, RZS_UNCOMPRESSED)))
+		kunmap_atomic(src, KM_USER0);
+
+	/* Update stats */
+	rzs->stats.compr_size += clen;
+	stat_inc(rzs->stats.pages_stored);
+	if (clen <= PAGE_SIZE / 2)
+		stat_inc(rzs->stats.good_compress);
+
+	mutex_unlock(&rzs->lock);
+
+	set_bit(BIO_UPTODATE, &bio->bi_flags);
+	bio_endio(bio, 0);
+	return 0;
+
+out:
+	if (fwd_write_request) {
+		stat_inc(rzs->stats.bdev_num_writes);
+		bio->bi_bdev = rzs->backing_swap;
+#if 0
+		/*
+		 * TODO: We currently have linear mapping of ramzswap and
+		 * backing swap sectors. This is not desired since we want
+		 * to optimize writes to backing swap to minimize disk seeks
+		 * or have effective wear leveling (for SSDs). Also, a
+		 * non-linear mapping is required to implement compressed
+		 * on-disk swapping.
+		 */
+		 bio->bi_sector = get_backing_swap_page()
+					<< SECTORS_PER_PAGE_SHIFT;
+#endif
+		/*
+		 * In case backing swap is a file, find the right offset within
+		 * the file corresponding to logical position 'index'. For block
+		 * device, this is a nop.
+		 */
+		bio->bi_sector = map_backing_swap_page(rzs, index)
+					<< SECTORS_PER_PAGE_SHIFT;
+		return 1;
+	}
+
+	bio_io_error(bio);
+	return 0;
+}
+
+
+/*
+ * Check if request is within bounds and page aligned.
+ */
+static inline int valid_swap_request(struct ramzswap *rzs, struct bio *bio)
+{
+	if (unlikely(
+		(bio->bi_sector >= (rzs->disksize >> SECTOR_SHIFT)) ||
+		(bio->bi_sector & (SECTORS_PER_PAGE - 1)) ||
+		(bio->bi_vcnt != 1) ||
+		(bio->bi_size != PAGE_SIZE) ||
+		(bio->bi_io_vec[0].bv_offset != 0))) {
+
+		return 0;
+	}
+
+	/* swap request is valid */
+	return 1;
+}
+
+/*
+ * Handler function for all ramzswap I/O requests.
+ */
+static int ramzswap_make_request(struct request_queue *queue, struct bio *bio)
+{
+	int ret = 0;
+	struct ramzswap *rzs = queue->queuedata;
+
+	if (unlikely(!rzs->init_done)) {
+		bio_io_error(bio);
+		return 0;
+	}
+
+	if (!valid_swap_request(rzs, bio)) {
+		stat_inc(rzs->stats.invalid_io);
+		bio_io_error(bio);
+		return 0;
+	}
+
+	switch (bio_data_dir(bio)) {
+	case READ:
+		ret = ramzswap_read(rzs, bio);
+		break;
+
+	case WRITE:
+		ret = ramzswap_write(rzs, bio);
+		break;
+	}
+
+	return ret;
+}
+
+static void reset_device(struct ramzswap *rzs)
+{
+	int is_backing_blkdev = 0;
+	size_t index, num_pages;
+	unsigned entries_per_page;
+	unsigned long num_table_pages, entry = 0;
+
+	if (rzs->backing_swap && !rzs->num_extents)
+		is_backing_blkdev = 1;
+
+	num_pages = rzs->disksize >> PAGE_SHIFT;
+
+	/* Free various per-device buffers */
+	kfree(rzs->compress_workmem);
+	free_pages((unsigned long)rzs->compress_buffer, 1);
+
+	rzs->compress_workmem = NULL;
+	rzs->compress_buffer = NULL;
+
+	/* Free all pages that are still in this ramzswap device */
+	for (index = 0; index < num_pages; index++) {
+		struct page *page;
+		u16 offset;
+
+		page = rzs->table[index].page;
+		offset = rzs->table[index].offset;
+
+		if (!page)
+			continue;
+
+		if (unlikely(rzs_test_flag(rzs, index, RZS_UNCOMPRESSED)))
+			__free_page(page);
+		else
+			xv_free(rzs->mem_pool, page, offset);
+	}
+
+	entries_per_page = PAGE_SIZE / sizeof(*rzs->table);
+	num_table_pages = DIV_ROUND_UP(num_pages * sizeof(*rzs->table),
+					PAGE_SIZE);
+	/*
+	 * Set page->mapping to NULL for every table page.
+	 * Otherwise, we will hit bad_page() during free.
+	 */
+	while (rzs->num_extents && num_table_pages--) {
+		struct page *page;
+		page = vmalloc_to_page(&rzs->table[entry]);
+		page->mapping = NULL;
+		entry += entries_per_page;
+	}
+	vfree(rzs->table);
+	rzs->table = NULL;
+
+	xv_destroy_pool(rzs->mem_pool);
+	rzs->mem_pool = NULL;
+
+	/* Free all swap extent pages */
+	while (!list_empty(&rzs->backing_swap_extent_list)) {
+		struct page *page;
+		struct list_head *entry;
+		entry = rzs->backing_swap_extent_list.next;
+		page = list_entry(entry, struct page, lru);
+		list_del(entry);
+		__free_page(page);
+	}
+	INIT_LIST_HEAD(&rzs->backing_swap_extent_list);
+	rzs->num_extents = 0;
+
+	/* Close backing swap device, if present */
+	if (rzs->backing_swap) {
+		if (is_backing_blkdev)
+			bd_release(rzs->backing_swap);
+		filp_close(rzs->swap_file, NULL);
+		rzs->backing_swap = NULL;
+	}
+
+	/* Reset stats */
+	memset(&rzs->stats, 0, sizeof(rzs->stats));
+
+	rzs->disksize = 0;
+	rzs->memlimit = 0;
+
+	/* Back to uninitialized state */
+	rzs->init_done = 0;
+}
+
+static int ramzswap_ioctl_init_device(struct ramzswap *rzs)
+{
+	int ret;
+	size_t num_pages;
+	struct page *page;
+	union swap_header *swap_header;
+
+	if (rzs->init_done) {
+		pr_info("Device already initialized!\n");
+		return -EBUSY;
+	}
+
+	ret = setup_backing_swap(rzs);
+	if (ret)
+		goto fail;
+
+	if (rzs->backing_swap)
+		ramzswap_set_memlimit(rzs, totalram_pages << PAGE_SHIFT);
+	else
+		ramzswap_set_disksize(rzs, totalram_pages << PAGE_SHIFT);
+
+	rzs->compress_workmem = kzalloc(LZO1X_MEM_COMPRESS, GFP_KERNEL);
+	if (!rzs->compress_workmem) {
+		pr_err("Error allocating compressor working memory!\n");
+		ret = -ENOMEM;
+		goto fail;
+	}
+
+	rzs->compress_buffer = (void *)__get_free_pages(__GFP_ZERO, 1);
+	if (!rzs->compress_buffer) {
+		pr_err("Error allocating compressor buffer space\n");
+		ret = -ENOMEM;
+		goto fail;
+	}
+
+	num_pages = rzs->disksize >> PAGE_SHIFT;
+	rzs->table = vmalloc(num_pages * sizeof(*rzs->table));
+	if (!rzs->table) {
+		pr_err("Error allocating ramzswap address table\n");
+		/* To prevent accessing table entries during cleanup */
+		rzs->disksize = 0;
+		ret = -ENOMEM;
+		goto fail;
+	}
+	memset(rzs->table, 0, num_pages * sizeof(*rzs->table));
+
+	map_backing_swap_extents(rzs);
+
+	page = alloc_page(__GFP_ZERO);
+	if (!page) {
+		pr_err("Error allocating swap header page\n");
+		ret = -ENOMEM;
+		goto fail;
+	}
+	rzs->table[0].page = page;
+	rzs_set_flag(rzs, 0, RZS_UNCOMPRESSED);
+
+	swap_header = kmap(page);
+	ret = setup_swap_header(rzs, swap_header);
+	kunmap(page);
+	if (ret) {
+		pr_err("Error setting swap header\n");
+		goto fail;
+	}
+
+	set_capacity(rzs->disk, rzs->disksize >> SECTOR_SHIFT);
+
+	/*
+	 * We have ident mapping of sectors for ramzswap and
+	 * and the backing swap device. So, this queue flag
+	 * should be according to backing dev.
+	 */
+	if (!rzs->backing_swap ||
+			blk_queue_nonrot(rzs->backing_swap->bd_disk->queue))
+		queue_flag_set_unlocked(QUEUE_FLAG_NONROT, rzs->disk->queue);
+
+	rzs->mem_pool = xv_create_pool();
+	if (!rzs->mem_pool) {
+		pr_err("Error creating memory pool\n");
+		ret = -ENOMEM;
+		goto fail;
+	}
+
+	/*
+	 * Pages that compress to size greater than this are forwarded
+	 * to physical swap disk (if backing dev is provided)
+	 * TODO: make this configurable
+	 */
+	if (rzs->backing_swap)
+		max_zpage_size = max_zpage_size_bdev;
+	else
+		max_zpage_size = max_zpage_size_nobdev;
+	pr_debug("Max compressed page size: %u bytes\n", max_zpage_size);
+
+	rzs->init_done = 1;
+
+	pr_debug("Initialization done!\n");
+	return 0;
+
+fail:
+	reset_device(rzs);
+
+	pr_err("Initialization failed: err=%d\n", ret);
+	return ret;
+}
+
+static int ramzswap_ioctl_reset_device(struct ramzswap *rzs)
+{
+	if (rzs->init_done)
+		reset_device(rzs);
+
+	return 0;
+}
+
+static int ramzswap_ioctl(struct block_device *bdev, fmode_t mode,
+			unsigned int cmd, unsigned long arg)
+{
+	int ret = 0;
+	size_t disksize_kb, memlimit_kb;
+
+	struct ramzswap *rzs = bdev->bd_disk->private_data;
+
+	switch (cmd) {
+	case RZSIO_SET_DISKSIZE_KB:
+		if (rzs->init_done) {
+			ret = -EBUSY;
+			goto out;
+		}
+		if (copy_from_user(&disksize_kb, (void *)arg,
+						_IOC_SIZE(cmd))) {
+			ret = -EFAULT;
+			goto out;
+		}
+		rzs->disksize = disksize_kb << 10;
+		pr_info("Disk size set to %zu kB\n", disksize_kb);
+		break;
+
+	case RZSIO_SET_MEMLIMIT_KB:
+		if (rzs->init_done) {
+			/* TODO: allow changing memlimit */
+			ret = -EBUSY;
+			goto out;
+		}
+		if (copy_from_user(&memlimit_kb, (void *)arg,
+						_IOC_SIZE(cmd))) {
+			ret = -EFAULT;
+			goto out;
+		}
+		rzs->memlimit = memlimit_kb << 10;
+		pr_info("Memory limit set to %zu kB\n", memlimit_kb);
+		break;
+
+	case RZSIO_SET_BACKING_SWAP:
+		if (rzs->init_done) {
+			ret = -EBUSY;
+			goto out;
+		}
+
+		if (copy_from_user(&rzs->backing_swap_name, (void *)arg,
+						_IOC_SIZE(cmd))) {
+			ret = -EFAULT;
+			goto out;
+		}
+		rzs->backing_swap_name[MAX_SWAP_NAME_LEN - 1] = '\0';
+		pr_info("Backing swap set to %s\n", rzs->backing_swap_name);
+		break;
+
+	case RZSIO_GET_STATS:
+	{
+		struct ramzswap_ioctl_stats *stats;
+		if (!rzs->init_done) {
+			ret = -ENOTTY;
+			goto out;
+		}
+		stats = kzalloc(sizeof(*stats), GFP_KERNEL);
+		if (!stats) {
+			ret = -ENOMEM;
+			goto out;
+		}
+		ramzswap_ioctl_get_stats(rzs, stats);
+		if (copy_to_user((void *)arg, stats, sizeof(*stats))) {
+			kfree(stats);
+			ret = -EFAULT;
+			goto out;
+		}
+		kfree(stats);
+		break;
+	}
+	case RZSIO_INIT:
+		ret = ramzswap_ioctl_init_device(rzs);
+		break;
+
+	case RZSIO_RESET:
+		/* Do not reset an active device! */
+		if (bdev->bd_holders) {
+			ret = -EBUSY;
+			goto out;
+		}
+		ret = ramzswap_ioctl_reset_device(rzs);
+		break;
+
+	default:
+		pr_info("Invalid ioctl %u\n", cmd);
+		ret = -ENOTTY;
+	}
+
+out:
+	return ret;
+}
+
+static struct block_device_operations ramzswap_devops = {
+	.ioctl = ramzswap_ioctl,
+	.owner = THIS_MODULE,
+};
+
+static void create_device(struct ramzswap *rzs, int device_id)
+{
+	mutex_init(&rzs->lock);
+	INIT_LIST_HEAD(&rzs->backing_swap_extent_list);
+
+	rzs->queue = blk_alloc_queue(GFP_KERNEL);
+	if (!rzs->queue) {
+		pr_err("Error allocating disk queue for device %d\n",
+			device_id);
+		return;
+	}
+
+	blk_queue_make_request(rzs->queue, ramzswap_make_request);
+	rzs->queue->queuedata = rzs;
+
+	 /* gendisk structure */
+	rzs->disk = alloc_disk(1);
+	if (!rzs->disk) {
+		blk_cleanup_queue(rzs->queue);
+		pr_warning("Error allocating disk structure for device %d\n",
+			device_id);
+		return;
+	}
+
+	rzs->disk->major = ramzswap_major;
+	rzs->disk->first_minor = device_id;
+	rzs->disk->fops = &ramzswap_devops;
+	rzs->disk->queue = rzs->queue;
+	rzs->disk->private_data = rzs;
+	snprintf(rzs->disk->disk_name, 16, "ramzswap%d", device_id);
+
+	/*
+	 * Actual capacity set using RZSIO_SET_DISKSIZE_KB ioctl
+	 * or set equal to backing swap device (if provided)
+	 */
+	set_capacity(rzs->disk, 0);
+	add_disk(rzs->disk);
+
+	rzs->init_done = 0;
+}
+
+static void destroy_device(struct ramzswap *rzs)
+{
+	if (rzs->disk) {
+		del_gendisk(rzs->disk);
+		put_disk(rzs->disk);
+	}
+
+	if (rzs->queue)
+		blk_cleanup_queue(rzs->queue);
+}
+
+static int __init ramzswap_init(void)
+{
+	int i, ret;
+
+	if (num_devices > max_num_devices) {
+		pr_warning("Invalid value for num_devices: %u\n",
+				num_devices);
+		return -EINVAL;
+	}
+
+	ramzswap_major = register_blkdev(0, "ramzswap");
+	if (ramzswap_major <= 0) {
+		pr_warning("Unable to get major number\n");
+		return -EBUSY;
+	}
+
+	if (!num_devices) {
+		pr_info("num_devices not specified. Using default: 1\n");
+		num_devices = 1;
+	}
+
+	/* Allocate the device array and initialize each one */
+	pr_info("Creating %u devices ...\n", num_devices);
+	devices = kzalloc(num_devices * sizeof(struct ramzswap), GFP_KERNEL);
+	if (!devices) {
+		ret = -ENOMEM;
+		goto out;
+	}
+
+	for (i = 0; i < num_devices; i++)
+		create_device(&devices[i], i);
+
+	return 0;
+out:
+	unregister_blkdev(ramzswap_major, "ramzswap");
+	return ret;
+}
+
+static void __exit ramzswap_exit(void)
+{
+	int i;
+	struct ramzswap *rzs;
+
+	for (i = 0; i < num_devices; i++) {
+		rzs = &devices[i];
+
+		destroy_device(rzs);
+		if (rzs->init_done)
+			reset_device(rzs);
+	}
+
+	unregister_blkdev(ramzswap_major, "ramzswap");
+
+	kfree(devices);
+	pr_debug("Cleanup done!\n");
+}
+
+module_param(num_devices, uint, 0);
+MODULE_PARM_DESC(num_devices, "Number of ramzswap devices");
+
+module_init(ramzswap_init);
+module_exit(ramzswap_exit);
+
+MODULE_LICENSE("Dual BSD/GPL");
+MODULE_AUTHOR("Nitin Gupta <ngupta@vflare.org>");
+MODULE_DESCRIPTION("Compressed RAM Based Swap Device");
diff --git a/drivers/staging/ramzswap/ramzswap_drv.h b/drivers/staging/ramzswap/ramzswap_drv.h
new file mode 100644
index 000000000000..a6ea240935b6
--- /dev/null
+++ b/drivers/staging/ramzswap/ramzswap_drv.h
@@ -0,0 +1,171 @@
+/*
+ * Compressed RAM based swap device
+ *
+ * Copyright (C) 2008, 2009  Nitin Gupta
+ *
+ * This code is released using a dual license strategy: BSD/GPL
+ * You can choose the licence that better fits your requirements.
+ *
+ * Released under the terms of 3-clause BSD License
+ * Released under the terms of GNU General Public License Version 2.0
+ *
+ * Project home: http://compcache.googlecode.com
+ */
+
+#ifndef _RAMZSWAP_DRV_H_
+#define _RAMZSWAP_DRV_H_
+
+#include "ramzswap_ioctl.h"
+#include "xvmalloc.h"
+
+/*
+ * Some arbitrary value. This is just to catch
+ * invalid value for num_devices module parameter.
+ */
+static const unsigned max_num_devices = 32;
+
+/*
+ * Stored at beginning of each compressed object.
+ *
+ * It stores back-reference to table entry which points to this
+ * object. This is required to support memory defragmentation or
+ * migrating compressed pages to backing swap disk.
+ */
+struct zobj_header {
+#if 0
+	u32 table_idx;
+#endif
+};
+
+/*-- Configurable parameters */
+
+/* Default ramzswap disk size: 25% of total RAM */
+static const unsigned default_disksize_perc_ram = 25;
+static const unsigned default_memlimit_perc_ram = 15;
+
+/*
+ * Max compressed page size when backing device is provided.
+ * Pages that compress to size greater than this are sent to
+ * physical swap disk.
+ */
+static const unsigned max_zpage_size_bdev = PAGE_SIZE / 2;
+
+/*
+ * Max compressed page size when there is no backing dev.
+ * Pages that compress to size greater than this are stored
+ * uncompressed in memory.
+ */
+static const unsigned max_zpage_size_nobdev = PAGE_SIZE / 4 * 3;
+
+/*
+ * NOTE: max_zpage_size_{bdev,nobdev} sizes must be
+ * less than or equal to:
+ *   XV_MAX_ALLOC_SIZE - sizeof(struct zobj_header)
+ * since otherwise xv_malloc would always return failure.
+ */
+
+/*-- End of configurable params */
+
+#define SECTOR_SHIFT		9
+#define SECTOR_SIZE		(1 << SECTOR_SHIFT)
+#define SECTORS_PER_PAGE_SHIFT	(PAGE_SHIFT - SECTOR_SHIFT)
+#define SECTORS_PER_PAGE	(1 << SECTORS_PER_PAGE_SHIFT)
+
+/* Debugging and Stats */
+#if defined(CONFIG_RAMZSWAP_STATS)
+#define stat_inc(stat)	((stat)++)
+#define stat_dec(stat)	((stat)--)
+#else
+#define stat_inc(x)
+#define stat_dec(x)
+#endif
+
+/* Flags for ramzswap pages (table[page_no].flags) */
+enum rzs_pageflags {
+	/* Page is stored uncompressed */
+	RZS_UNCOMPRESSED,
+
+	/* Page consists entirely of zeros */
+	RZS_ZERO,
+
+	__NR_RZS_PAGEFLAGS,
+};
+
+/*-- Data structures */
+
+/*
+ * Allocated for each swap slot, indexed by page no.
+ * These table entries must fit exactly in a page.
+ */
+struct table {
+	struct page *page;
+	u16 offset;
+	u8 count;	/* object ref count (not yet used) */
+	u8 flags;
+} __attribute__((aligned(4)));;
+
+/*
+ * Swap extent information in case backing swap is a regular
+ * file. These extent entries must fit exactly in a page.
+ */
+struct ramzswap_backing_extent {
+	pgoff_t phy_pagenum;
+	pgoff_t num_pages;
+} __attribute__((aligned(4)));
+
+struct ramzswap_stats {
+	/* basic stats */
+	size_t compr_size;	/* compressed size of pages stored -
+				 * needed to enforce memlimit */
+	/* more stats */
+#if defined(CONFIG_RAMZSWAP_STATS)
+	u64 num_reads;		/* failed + successful */
+	u64 num_writes;		/* --do-- */
+	u64 failed_reads;	/* can happen when memory is too low */
+	u64 failed_writes;	/* should NEVER! happen */
+	u64 invalid_io;		/* non-swap I/O requests */
+	u32 pages_zero;		/* no. of zero filled pages */
+	u32 pages_stored;	/* no. of pages currently stored */
+	u32 good_compress;	/* % of pages with compression ratio<=50% */
+	u32 pages_expand;	/* % of incompressible pages */
+	u64 bdev_num_reads;	/* no. of reads on backing dev */
+	u64 bdev_num_writes;	/* no. of writes on backing dev */
+#endif
+};
+
+struct ramzswap {
+	struct xv_pool *mem_pool;
+	void *compress_workmem;
+	void *compress_buffer;
+	struct table *table;
+	struct mutex lock;
+	struct request_queue *queue;
+	struct gendisk *disk;
+	int init_done;
+	/*
+	 * This is limit on compressed data size (stats.compr_size)
+	 * Its applicable only when backing swap device is present.
+	 */
+	size_t memlimit;	/* bytes */
+	/*
+	 * This is limit on amount of *uncompressed* worth of data
+	 * we can hold. When backing swap device is provided, it is
+	 * set equal to device size.
+	 */
+	size_t disksize;	/* bytes */
+
+	struct ramzswap_stats stats;
+
+	/* backing swap device info */
+	struct ramzswap_backing_extent *curr_extent;
+	struct list_head backing_swap_extent_list;
+	unsigned long num_extents;
+	char backing_swap_name[MAX_SWAP_NAME_LEN];
+	struct block_device *backing_swap;
+	struct file *swap_file;
+};
+
+/*-- */
+
+#endif
+
diff --git a/drivers/staging/ramzswap/ramzswap_ioctl.h b/drivers/staging/ramzswap/ramzswap_ioctl.h
new file mode 100644
index 000000000000..c713a09af580
--- /dev/null
+++ b/drivers/staging/ramzswap/ramzswap_ioctl.h
@@ -0,0 +1,49 @@
+/*
+ * Compressed RAM based swap device
+ *
+ * Copyright (C) 2008, 2009  Nitin Gupta
+ *
+ * This code is released using a dual license strategy: BSD/GPL
+ * You can choose the licence that better fits your requirements.
+ *
+ * Released under the terms of 3-clause BSD License
+ * Released under the terms of GNU General Public License Version 2.0
+ *
+ * Project home: http://compcache.googlecode.com
+ */
+
+#ifndef _RAMZSWAP_IOCTL_H_
+#define _RAMZSWAP_IOCTL_H_
+
+#define MAX_SWAP_NAME_LEN 128
+
+struct ramzswap_ioctl_stats {
+	char backing_swap_name[MAX_SWAP_NAME_LEN];
+	u64 memlimit;		/* only applicable if backing swap present */
+	u64 disksize;		/* user specified or equal to backing swap
+				 * size (if present) */
+	u64 num_reads;		/* failed + successful */
+	u64 num_writes;		/* --do-- */
+	u64 failed_reads;	/* can happen when memory is too low */
+	u64 failed_writes;	/* should NEVER! happen */
+	u64 invalid_io;		/* non-swap I/O requests */
+	u32 pages_zero;		/* no. of zero filled pages */
+	u32 good_compress_pct;	/* no. of pages with compression ratio<=50% */
+	u32 pages_expand_pct;	/* no. of incompressible pages */
+	u32 pages_stored;
+	u32 pages_used;
+	u64 orig_data_size;
+	u64 compr_data_size;
+	u64 mem_used_total;
+	u64 bdev_num_reads;	/* no. of reads on backing dev */
+	u64 bdev_num_writes;	/* no. of writes on backing dev */
+} __attribute__ ((packed, aligned(4)));
+
+#define RZSIO_SET_DISKSIZE_KB	_IOW('z', 0, size_t)
+#define RZSIO_SET_MEMLIMIT_KB	_IOW('z', 1, size_t)
+#define RZSIO_SET_BACKING_SWAP	_IOW('z', 2, unsigned char[MAX_SWAP_NAME_LEN])
+#define RZSIO_GET_STATS		_IOR('z', 3, struct ramzswap_ioctl_stats)
+#define RZSIO_INIT		_IO('z', 4)
+#define RZSIO_RESET		_IO('z', 5)
+
+#endif
diff --git a/drivers/staging/ramzswap/xvmalloc.c b/drivers/staging/ramzswap/xvmalloc.c
new file mode 100644
index 000000000000..b3e986c33141
--- /dev/null
+++ b/drivers/staging/ramzswap/xvmalloc.c
@@ -0,0 +1,507 @@
+/*
+ * xvmalloc memory allocator
+ *
+ * Copyright (C) 2008, 2009  Nitin Gupta
+ *
+ * This code is released using a dual license strategy: BSD/GPL
+ * You can choose the licence that better fits your requirements.
+ *
+ * Released under the terms of 3-clause BSD License
+ * Released under the terms of GNU General Public License Version 2.0
+ */
+
+#include <linux/bitops.h>
+#include <linux/errno.h>
+#include <linux/highmem.h>
+#include <linux/init.h>
+#include <linux/string.h>
+#include <linux/slab.h>
+
+#include "xvmalloc.h"
+#include "xvmalloc_int.h"
+
+static void stat_inc(u64 *value)
+{
+	*value = *value + 1;
+}
+
+static void stat_dec(u64 *value)
+{
+	*value = *value - 1;
+}
+
+static int test_flag(struct block_header *block, enum blockflags flag)
+{
+	return block->prev & BIT(flag);
+}
+
+static void set_flag(struct block_header *block, enum blockflags flag)
+{
+	block->prev |= BIT(flag);
+}
+
+static void clear_flag(struct block_header *block, enum blockflags flag)
+{
+	block->prev &= ~BIT(flag);
+}
+
+/*
+ * Given <page, offset> pair, provide a derefrencable pointer.
+ * This is called from xv_malloc/xv_free path, so it
+ * needs to be fast.
+ */
+static void *get_ptr_atomic(struct page *page, u16 offset, enum km_type type)
+{
+	unsigned char *base;
+
+	base = kmap_atomic(page, type);
+	return base + offset;
+}
+
+static void put_ptr_atomic(void *ptr, enum km_type type)
+{
+	kunmap_atomic(ptr, type);
+}
+
+static u32 get_blockprev(struct block_header *block)
+{
+	return block->prev & PREV_MASK;
+}
+
+static void set_blockprev(struct block_header *block, u16 new_offset)
+{
+	block->prev = new_offset | (block->prev & FLAGS_MASK);
+}
+
+static struct block_header *BLOCK_NEXT(struct block_header *block)
+{
+	return (struct block_header *)
+		((char *)block + block->size + XV_ALIGN);
+}
+
+/*
+ * Get index of free list containing blocks of maximum size
+ * which is less than or equal to given size.
+ */
+static u32 get_index_for_insert(u32 size)
+{
+	if (unlikely(size > XV_MAX_ALLOC_SIZE))
+		size = XV_MAX_ALLOC_SIZE;
+	size &= ~FL_DELTA_MASK;
+	return (size - XV_MIN_ALLOC_SIZE) >> FL_DELTA_SHIFT;
+}
+
+/*
+ * Get index of free list having blocks of size greater than
+ * or equal to requested size.
+ */
+static u32 get_index(u32 size)
+{
+	if (unlikely(size < XV_MIN_ALLOC_SIZE))
+		size = XV_MIN_ALLOC_SIZE;
+	size = ALIGN(size, FL_DELTA);
+	return (size - XV_MIN_ALLOC_SIZE) >> FL_DELTA_SHIFT;
+}
+
+/**
+ * find_block - find block of at least given size
+ * @pool: memory pool to search from
+ * @size: size of block required
+ * @page: page containing required block
+ * @offset: offset within the page where block is located.
+ *
+ * Searches two level bitmap to locate block of at least
+ * the given size. If such a block is found, it provides
+ * <page, offset> to identify this block and returns index
+ * in freelist where we found this block.
+ * Otherwise, returns 0 and <page, offset> params are not touched.
+ */
+static u32 find_block(struct xv_pool *pool, u32 size,
+			struct page **page, u32 *offset)
+{
+	ulong flbitmap, slbitmap;
+	u32 flindex, slindex, slbitstart;
+
+	/* There are no free blocks in this pool */
+	if (!pool->flbitmap)
+		return 0;
+
+	/* Get freelist index correspoding to this size */
+	slindex = get_index(size);
+	slbitmap = pool->slbitmap[slindex / BITS_PER_LONG];
+	slbitstart = slindex % BITS_PER_LONG;
+
+	/*
+	 * If freelist is not empty at this index, we found the
+	 * block - head of this list. This is approximate best-fit match.
+	 */
+	if (test_bit(slbitstart, &slbitmap)) {
+		*page = pool->freelist[slindex].page;
+		*offset = pool->freelist[slindex].offset;
+		return slindex;
+	}
+
+	/*
+	 * No best-fit found. Search a bit further in bitmap for a free block.
+	 * Second level bitmap consists of series of 32-bit chunks. Search
+	 * further in the chunk where we expected a best-fit, starting from
+	 * index location found above.
+	 */
+	slbitstart++;
+	slbitmap >>= slbitstart;
+
+	/* Skip this search if we were already at end of this bitmap chunk */
+	if ((slbitstart != BITS_PER_LONG) && slbitmap) {
+		slindex += __ffs(slbitmap) + 1;
+		*page = pool->freelist[slindex].page;
+		*offset = pool->freelist[slindex].offset;
+		return slindex;
+	}
+
+	/* Now do a full two-level bitmap search to find next nearest fit */
+	flindex = slindex / BITS_PER_LONG;
+
+	flbitmap = (pool->flbitmap) >> (flindex + 1);
+	if (!flbitmap)
+		return 0;
+
+	flindex += __ffs(flbitmap) + 1;
+	slbitmap = pool->slbitmap[flindex];
+	slindex = (flindex * BITS_PER_LONG) + __ffs(slbitmap);
+	*page = pool->freelist[slindex].page;
+	*offset = pool->freelist[slindex].offset;
+
+	return slindex;
+}
+
+/*
+ * Insert block at <page, offset> in freelist of given pool.
+ * freelist used depends on block size.
+ */
+static void insert_block(struct xv_pool *pool, struct page *page, u32 offset,
+			struct block_header *block)
+{
+	u32 flindex, slindex;
+	struct block_header *nextblock;
+
+	slindex = get_index_for_insert(block->size);
+	flindex = slindex / BITS_PER_LONG;
+
+	block->link.prev_page = 0;
+	block->link.prev_offset = 0;
+	block->link.next_page = pool->freelist[slindex].page;
+	block->link.next_offset = pool->freelist[slindex].offset;
+	pool->freelist[slindex].page = page;
+	pool->freelist[slindex].offset = offset;
+
+	if (block->link.next_page) {
+		nextblock = get_ptr_atomic(block->link.next_page,
+					block->link.next_offset, KM_USER1);
+		nextblock->link.prev_page = page;
+		nextblock->link.prev_offset = offset;
+		put_ptr_atomic(nextblock, KM_USER1);
+	}
+
+	__set_bit(slindex % BITS_PER_LONG, &pool->slbitmap[flindex]);
+	__set_bit(flindex, &pool->flbitmap);
+}
+
+/*
+ * Remove block from head of freelist. Index 'slindex' identifies the freelist.
+ */
+static void remove_block_head(struct xv_pool *pool,
+			struct block_header *block, u32 slindex)
+{
+	struct block_header *tmpblock;
+	u32 flindex = slindex / BITS_PER_LONG;
+
+	pool->freelist[slindex].page = block->link.next_page;
+	pool->freelist[slindex].offset = block->link.next_offset;
+	block->link.prev_page = 0;
+	block->link.prev_offset = 0;
+
+	if (!pool->freelist[slindex].page) {
+		__clear_bit(slindex % BITS_PER_LONG, &pool->slbitmap[flindex]);
+		if (!pool->slbitmap[flindex])
+			__clear_bit(flindex, &pool->flbitmap);
+	} else {
+		/*
+		 * DEBUG ONLY: We need not reinitialize freelist head previous
+		 * pointer to 0 - we never depend on its value. But just for
+		 * sanity, lets do it.
+		 */
+		tmpblock = get_ptr_atomic(pool->freelist[slindex].page,
+				pool->freelist[slindex].offset, KM_USER1);
+		tmpblock->link.prev_page = 0;
+		tmpblock->link.prev_offset = 0;
+		put_ptr_atomic(tmpblock, KM_USER1);
+	}
+}
+
+/*
+ * Remove block from freelist. Index 'slindex' identifies the freelist.
+ */
+static void remove_block(struct xv_pool *pool, struct page *page, u32 offset,
+			struct block_header *block, u32 slindex)
+{
+	u32 flindex;
+	struct block_header *tmpblock;
+
+	if (pool->freelist[slindex].page == page
+	   && pool->freelist[slindex].offset == offset) {
+		remove_block_head(pool, block, slindex);
+		return;
+	}
+
+	flindex = slindex / BITS_PER_LONG;
+
+	if (block->link.prev_page) {
+		tmpblock = get_ptr_atomic(block->link.prev_page,
+				block->link.prev_offset, KM_USER1);
+		tmpblock->link.next_page = block->link.next_page;
+		tmpblock->link.next_offset = block->link.next_offset;
+		put_ptr_atomic(tmpblock, KM_USER1);
+	}
+
+	if (block->link.next_page) {
+		tmpblock = get_ptr_atomic(block->link.next_page,
+				block->link.next_offset, KM_USER1);
+		tmpblock->link.prev_page = block->link.prev_page;
+		tmpblock->link.prev_offset = block->link.prev_offset;
+		put_ptr_atomic(tmpblock, KM_USER1);
+	}
+}
+
+/*
+ * Allocate a page and add it freelist of given pool.
+ */
+static int grow_pool(struct xv_pool *pool, gfp_t flags)
+{
+	struct page *page;
+	struct block_header *block;
+
+	page = alloc_page(flags);
+	if (unlikely(!page))
+		return -ENOMEM;
+
+	stat_inc(&pool->total_pages);
+
+	spin_lock(&pool->lock);
+	block = get_ptr_atomic(page, 0, KM_USER0);
+
+	block->size = PAGE_SIZE - XV_ALIGN;
+	set_flag(block, BLOCK_FREE);
+	clear_flag(block, PREV_FREE);
+	set_blockprev(block, 0);
+
+	insert_block(pool, page, 0, block);
+
+	put_ptr_atomic(block, KM_USER0);
+	spin_unlock(&pool->lock);
+
+	return 0;
+}
+
+/*
+ * Create a memory pool. Allocates freelist, bitmaps and other
+ * per-pool metadata.
+ */
+struct xv_pool *xv_create_pool(void)
+{
+	u32 ovhd_size;
+	struct xv_pool *pool;
+
+	ovhd_size = roundup(sizeof(*pool), PAGE_SIZE);
+	pool = kzalloc(ovhd_size, GFP_KERNEL);
+	if (!pool)
+		return NULL;
+
+	spin_lock_init(&pool->lock);
+
+	return pool;
+}
+
+void xv_destroy_pool(struct xv_pool *pool)
+{
+	kfree(pool);
+}
+
+/**
+ * xv_malloc - Allocate block of given size from pool.
+ * @pool: pool to allocate from
+ * @size: size of block to allocate
+ * @page: page no. that holds the object
+ * @offset: location of object within page
+ *
+ * On success, <page, offset> identifies block allocated
+ * and 0 is returned. On failure, <page, offset> is set to
+ * 0 and -ENOMEM is returned.
+ *
+ * Allocation requests with size > XV_MAX_ALLOC_SIZE will fail.
+ */
+int xv_malloc(struct xv_pool *pool, u32 size, struct page **page,
+		u32 *offset, gfp_t flags)
+{
+	int error;
+	u32 index, tmpsize, origsize, tmpoffset;
+	struct block_header *block, *tmpblock;
+
+	*page = NULL;
+	*offset = 0;
+	origsize = size;
+
+	if (unlikely(!size || size > XV_MAX_ALLOC_SIZE))
+		return -ENOMEM;
+
+	size = ALIGN(size, XV_ALIGN);
+
+	spin_lock(&pool->lock);
+
+	index = find_block(pool, size, page, offset);
+
+	if (!*page) {
+		spin_unlock(&pool->lock);
+		if (flags & GFP_NOWAIT)
+			return -ENOMEM;
+		error = grow_pool(pool, flags);
+		if (unlikely(error))
+			return error;
+
+		spin_lock(&pool->lock);
+		index = find_block(pool, size, page, offset);
+	}
+
+	if (!*page) {
+		spin_unlock(&pool->lock);
+		return -ENOMEM;
+	}
+
+	block = get_ptr_atomic(*page, *offset, KM_USER0);
+
+	remove_block_head(pool, block, index);
+
+	/* Split the block if required */
+	tmpoffset = *offset + size + XV_ALIGN;
+	tmpsize = block->size - size;
+	tmpblock = (struct block_header *)((char *)block + size + XV_ALIGN);
+	if (tmpsize) {
+		tmpblock->size = tmpsize - XV_ALIGN;
+		set_flag(tmpblock, BLOCK_FREE);
+		clear_flag(tmpblock, PREV_FREE);
+
+		set_blockprev(tmpblock, *offset);
+		if (tmpblock->size >= XV_MIN_ALLOC_SIZE)
+			insert_block(pool, *page, tmpoffset, tmpblock);
+
+		if (tmpoffset + XV_ALIGN + tmpblock->size != PAGE_SIZE) {
+			tmpblock = BLOCK_NEXT(tmpblock);
+			set_blockprev(tmpblock, tmpoffset);
+		}
+	} else {
+		/* This block is exact fit */
+		if (tmpoffset != PAGE_SIZE)
+			clear_flag(tmpblock, PREV_FREE);
+	}
+
+	block->size = origsize;
+	clear_flag(block, BLOCK_FREE);
+
+	put_ptr_atomic(block, KM_USER0);
+	spin_unlock(&pool->lock);
+
+	*offset += XV_ALIGN;
+
+	return 0;
+}
+
+/*
+ * Free block identified with <page, offset>
+ */
+void xv_free(struct xv_pool *pool, struct page *page, u32 offset)
+{
+	void *page_start;
+	struct block_header *block, *tmpblock;
+
+	offset -= XV_ALIGN;
+
+	spin_lock(&pool->lock);
+
+	page_start = get_ptr_atomic(page, 0, KM_USER0);
+	block = (struct block_header *)((char *)page_start + offset);
+
+	/* Catch double free bugs */
+	BUG_ON(test_flag(block, BLOCK_FREE));
+
+	block->size = ALIGN(block->size, XV_ALIGN);
+
+	tmpblock = BLOCK_NEXT(block);
+	if (offset + block->size + XV_ALIGN == PAGE_SIZE)
+		tmpblock = NULL;
+
+	/* Merge next block if its free */
+	if (tmpblock && test_flag(tmpblock, BLOCK_FREE)) {
+		/*
+		 * Blocks smaller than XV_MIN_ALLOC_SIZE
+		 * are not inserted in any free list.
+		 */
+		if (tmpblock->size >= XV_MIN_ALLOC_SIZE) {
+			remove_block(pool, page,
+				    offset + block->size + XV_ALIGN, tmpblock,
+				    get_index_for_insert(tmpblock->size));
+		}
+		block->size += tmpblock->size + XV_ALIGN;
+	}
+
+	/* Merge previous block if its free */
+	if (test_flag(block, PREV_FREE)) {
+		tmpblock = (struct block_header *)((char *)(page_start) +
+						get_blockprev(block));
+		offset = offset - tmpblock->size - XV_ALIGN;
+
+		if (tmpblock->size >= XV_MIN_ALLOC_SIZE)
+			remove_block(pool, page, offset, tmpblock,
+				    get_index_for_insert(tmpblock->size));
+
+		tmpblock->size += block->size + XV_ALIGN;
+		block = tmpblock;
+	}
+
+	/* No used objects in this page. Free it. */
+	if (block->size == PAGE_SIZE - XV_ALIGN) {
+		put_ptr_atomic(page_start, KM_USER0);
+		spin_unlock(&pool->lock);
+
+		__free_page(page);
+		stat_dec(&pool->total_pages);
+		return;
+	}
+
+	set_flag(block, BLOCK_FREE);
+	if (block->size >= XV_MIN_ALLOC_SIZE)
+		insert_block(pool, page, offset, block);
+
+	if (offset + block->size + XV_ALIGN != PAGE_SIZE) {
+		tmpblock = BLOCK_NEXT(block);
+		set_flag(tmpblock, PREV_FREE);
+		set_blockprev(tmpblock, offset);
+	}
+
+	put_ptr_atomic(page_start, KM_USER0);
+	spin_unlock(&pool->lock);
+}
+
+u32 xv_get_object_size(void *obj)
+{
+	struct block_header *blk;
+
+	blk = (struct block_header *)((char *)(obj) - XV_ALIGN);
+	return blk->size;
+}
+
+/*
+ * Returns total memory used by allocator (userdata + metadata)
+ */
+u64 xv_get_total_size_bytes(struct xv_pool *pool)
+{
+	return pool->total_pages << PAGE_SHIFT;
+}
diff --git a/drivers/staging/ramzswap/xvmalloc.h b/drivers/staging/ramzswap/xvmalloc.h
new file mode 100644
index 000000000000..010c6fe5e173
--- /dev/null
+++ b/drivers/staging/ramzswap/xvmalloc.h
@@ -0,0 +1,30 @@
+/*
+ * xvmalloc memory allocator
+ *
+ * Copyright (C) 2008, 2009  Nitin Gupta
+ *
+ * This code is released using a dual license strategy: BSD/GPL
+ * You can choose the licence that better fits your requirements.
+ *
+ * Released under the terms of 3-clause BSD License
+ * Released under the terms of GNU General Public License Version 2.0
+ */
+
+#ifndef _XV_MALLOC_H_
+#define _XV_MALLOC_H_
+
+#include <linux/types.h>
+
+struct xv_pool;
+
+struct xv_pool *xv_create_pool(void);
+void xv_destroy_pool(struct xv_pool *pool);
+
+int xv_malloc(struct xv_pool *pool, u32 size, struct page **page,
+			u32 *offset, gfp_t flags);
+void xv_free(struct xv_pool *pool, struct page *page, u32 offset);
+
+u32 xv_get_object_size(void *obj);
+u64 xv_get_total_size_bytes(struct xv_pool *pool);
+
+#endif
diff --git a/drivers/staging/ramzswap/xvmalloc_int.h b/drivers/staging/ramzswap/xvmalloc_int.h
new file mode 100644
index 000000000000..03c1a652a3aa
--- /dev/null
+++ b/drivers/staging/ramzswap/xvmalloc_int.h
@@ -0,0 +1,86 @@
+/*
+ * xvmalloc memory allocator
+ *
+ * Copyright (C) 2008, 2009  Nitin Gupta
+ *
+ * This code is released using a dual license strategy: BSD/GPL
+ * You can choose the licence that better fits your requirements.
+ *
+ * Released under the terms of 3-clause BSD License
+ * Released under the terms of GNU General Public License Version 2.0
+ */
+
+#ifndef _XV_MALLOC_INT_H_
+#define _XV_MALLOC_INT_H_
+
+#include <linux/kernel.h>
+#include <linux/types.h>
+
+/* User configurable params */
+
+/* Must be power of two */
+#define XV_ALIGN_SHIFT	2
+#define XV_ALIGN	(1 << XV_ALIGN_SHIFT)
+#define XV_ALIGN_MASK	(XV_ALIGN - 1)
+
+/* This must be greater than sizeof(link_free) */
+#define XV_MIN_ALLOC_SIZE	32
+#define XV_MAX_ALLOC_SIZE	(PAGE_SIZE - XV_ALIGN)
+
+/* Free lists are separated by FL_DELTA bytes */
+#define FL_DELTA_SHIFT	3
+#define FL_DELTA	(1 << FL_DELTA_SHIFT)
+#define FL_DELTA_MASK	(FL_DELTA - 1)
+#define NUM_FREE_LISTS	((XV_MAX_ALLOC_SIZE - XV_MIN_ALLOC_SIZE) \
+				/ FL_DELTA + 1)
+
+#define MAX_FLI		DIV_ROUND_UP(NUM_FREE_LISTS, BITS_PER_LONG)
+
+/* End of user params */
+
+enum blockflags {
+	BLOCK_FREE,
+	PREV_FREE,
+	__NR_BLOCKFLAGS,
+};
+
+#define FLAGS_MASK	XV_ALIGN_MASK
+#define PREV_MASK	(~FLAGS_MASK)
+
+struct freelist_entry {
+	struct page *page;
+	u16 offset;
+	u16 pad;
+};
+
+struct link_free {
+	struct page *prev_page;
+	struct page *next_page;
+	u16 prev_offset;
+	u16 next_offset;
+};
+
+struct block_header {
+	union {
+		/* This common header must be ALIGN bytes */
+		u8 common[XV_ALIGN];
+		struct {
+			u16 size;
+			u16 prev;
+		};
+	};
+	struct link_free link;
+};
+
+struct xv_pool {
+	ulong flbitmap;
+	ulong slbitmap[MAX_FLI];
+	spinlock_t lock;
+
+	struct freelist_entry freelist[NUM_FREE_LISTS];
+
+	/* stats */
+	u64 total_pages;
+};
+
+#endif
diff --git a/drivers/staging/rar/rar_driver.c b/drivers/staging/rar/rar_driver.c
index 9805d74bd341..d85d1890e81e 100644
--- a/drivers/staging/rar/rar_driver.c
+++ b/drivers/staging/rar/rar_driver.c
@@ -66,7 +66,7 @@ static int __init rar_init_handler(void);
 static void __exit rar_exit_handler(void);
 
 /*
-  function that is activated on the succesfull probe of the RAR device
+  function that is activated on the successfull probe of the RAR device
 */
 static int __devinit rar_probe(struct pci_dev *pdev, const struct pci_device_id *ent);
 
@@ -319,7 +319,7 @@ static int memrar_init_rar_params(struct pci_dev *pdev)
 }
 
 /*
-  function that is activaed on the succesfull probe of the RAR device
+  function that is activated on the successfull probe of the RAR device
 */
 static int __devinit rar_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 {
diff --git a/drivers/staging/rt2860/2860_main_dev.c b/drivers/staging/rt2860/2860_main_dev.c
deleted file mode 100644
index c2f02963f91c..000000000000
--- a/drivers/staging/rt2860/2860_main_dev.c
+++ /dev/null
@@ -1,1319 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-    Module Name:
-    2870_main_dev.c
-
-    Abstract:
-    Create and register network interface.
-
-    Revision History:
-    Who         When            What
-    --------    ----------      ----------------------------------------------
-*/
-
-#include "rt_config.h"
-
-extern INT __devinit rt28xx_probe(IN void *_dev_p, IN void *_dev_id_p,
-									IN UINT argc, OUT PRTMP_ADAPTER *ppAd);
-
-static void rx_done_tasklet(unsigned long data);
-static void mgmt_dma_done_tasklet(unsigned long data);
-static void ac0_dma_done_tasklet(unsigned long data);
-static void ac1_dma_done_tasklet(unsigned long data);
-static void ac2_dma_done_tasklet(unsigned long data);
-static void ac3_dma_done_tasklet(unsigned long data);
-static void hcca_dma_done_tasklet(unsigned long data);
-static void fifo_statistic_full_tasklet(unsigned long data);
-
-
-/*---------------------------------------------------------------------*/
-/* Symbol & Macro Definitions                                          */
-/*---------------------------------------------------------------------*/
-#define RT2860_INT_RX_DLY				(1<<0)		// bit 0
-#define RT2860_INT_TX_DLY				(1<<1)		// bit 1
-#define RT2860_INT_RX_DONE				(1<<2)		// bit 2
-#define RT2860_INT_AC0_DMA_DONE			(1<<3)		// bit 3
-#define RT2860_INT_AC1_DMA_DONE			(1<<4)		// bit 4
-#define RT2860_INT_AC2_DMA_DONE			(1<<5)		// bit 5
-#define RT2860_INT_AC3_DMA_DONE			(1<<6)		// bit 6
-#define RT2860_INT_HCCA_DMA_DONE		(1<<7)		// bit 7
-#define RT2860_INT_MGMT_DONE			(1<<8)		// bit 8
-
-#define INT_RX			RT2860_INT_RX_DONE
-
-#define INT_AC0_DLY		(RT2860_INT_AC0_DMA_DONE) //| RT2860_INT_TX_DLY)
-#define INT_AC1_DLY		(RT2860_INT_AC1_DMA_DONE) //| RT2860_INT_TX_DLY)
-#define INT_AC2_DLY		(RT2860_INT_AC2_DMA_DONE) //| RT2860_INT_TX_DLY)
-#define INT_AC3_DLY		(RT2860_INT_AC3_DMA_DONE) //| RT2860_INT_TX_DLY)
-#define INT_HCCA_DLY 	(RT2860_INT_HCCA_DMA_DONE) //| RT2860_INT_TX_DLY)
-#define INT_MGMT_DLY	RT2860_INT_MGMT_DONE
-
-/*---------------------------------------------------------------------*/
-/* Prototypes of Functions Used                                        */
-/*---------------------------------------------------------------------*/
-/* function declarations */
-static INT __devinit rt2860_init_one (struct pci_dev *pci_dev, const struct pci_device_id  *ent);
-static VOID __devexit rt2860_remove_one(struct pci_dev *pci_dev);
-static INT __devinit rt2860_probe(struct pci_dev *pci_dev, const struct pci_device_id  *ent);
-void init_thread_task(PRTMP_ADAPTER pAd);
-static void __exit rt2860_cleanup_module(void);
-static int __init rt2860_init_module(void);
-
-#ifdef CONFIG_PM
-static int rt2860_suspend(struct pci_dev *pci_dev, pm_message_t state);
-static int rt2860_resume(struct pci_dev *pci_dev);
-#endif // CONFIG_PM //
-
-
-//
-// Ralink PCI device table, include all supported chipsets
-//
-static struct pci_device_id rt2860_pci_tbl[] __devinitdata =
-{
-	{PCI_DEVICE(NIC_PCI_VENDOR_ID, NIC2860_PCI_DEVICE_ID)},		//RT28602.4G
-	{PCI_DEVICE(NIC_PCI_VENDOR_ID, NIC2860_PCIe_DEVICE_ID)},
-	{PCI_DEVICE(NIC_PCI_VENDOR_ID, NIC2760_PCI_DEVICE_ID)},
-	{PCI_DEVICE(NIC_PCI_VENDOR_ID, NIC2790_PCIe_DEVICE_ID)},
-	{PCI_DEVICE(VEN_AWT_PCI_VENDOR_ID, VEN_AWT_PCIe_DEVICE_ID)},
-	{PCI_DEVICE(EDIMAX_PCI_VENDOR_ID, 0x7708)},
-	{PCI_DEVICE(EDIMAX_PCI_VENDOR_ID, 0x7728)},
-	{PCI_DEVICE(EDIMAX_PCI_VENDOR_ID, 0x7758)},
-	{PCI_DEVICE(EDIMAX_PCI_VENDOR_ID, 0x7727)},
-	{PCI_DEVICE(EDIMAX_PCI_VENDOR_ID, 0x7738)},
-	{PCI_DEVICE(EDIMAX_PCI_VENDOR_ID, 0x7748)},
-	{PCI_DEVICE(EDIMAX_PCI_VENDOR_ID, 0x7768)},
-    {0,}		// terminate list
-};
-
-MODULE_DEVICE_TABLE(pci, rt2860_pci_tbl);
-MODULE_LICENSE("GPL");
-#ifdef MODULE_VERSION
-MODULE_VERSION(STA_DRIVER_VERSION);
-#endif
-
-//
-// Our PCI driver structure
-//
-static struct pci_driver rt2860_driver =
-{
-    name:       "rt2860",
-    id_table:   rt2860_pci_tbl,
-    probe:      rt2860_init_one,
-    remove:     __devexit_p(rt2860_remove_one),
-
-#ifdef CONFIG_PM
-	suspend:	rt2860_suspend,
-	resume:		rt2860_resume,
-#endif
-};
-
-
-#ifdef CONFIG_PM
-
-VOID RT2860RejectPendingPackets(
-	IN	PRTMP_ADAPTER	pAd)
-{
-	// clear PS packets
-	// clear TxSw packets
-}
-
-static int rt2860_suspend(
-	struct pci_dev *pci_dev,
-	pm_message_t state)
-{
-	struct net_device *net_dev = pci_get_drvdata(pci_dev);
-	PRTMP_ADAPTER pAd = (PRTMP_ADAPTER)NULL;
-	INT32 retval;
-
-
-	DBGPRINT(RT_DEBUG_TRACE, ("===> rt2860_suspend()\n"));
-
-	if (net_dev == NULL)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("net_dev == NULL!\n"));
-	}
-	else
-	{
-		pAd = net_dev->ml_priv;
-
-		/* we can not use IFF_UP because ra0 down but ra1 up */
-		/* and 1 suspend/resume function for 1 module, not for each interface */
-		/* so Linux will call suspend/resume function once */
-		if (VIRTUAL_IF_NUM(pAd) > 0)
-		{
-			// avoid users do suspend after interface is down
-
-			// stop interface
-			netif_carrier_off(net_dev);
-			netif_stop_queue(net_dev);
-
-			// mark device as removed from system and therefore no longer available
-			netif_device_detach(net_dev);
-
-			// mark halt flag
-			RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS);
-			RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_RADIO_OFF);
-
-			// take down the device
-			rt28xx_close((PNET_DEV)net_dev);
-
-			RT_MOD_DEC_USE_COUNT();
-		}
-	}
-
-	// reference to http://vovo2000.com/type-lab/linux/kernel-api/linux-kernel-api.html
-	// enable device to generate PME# when suspended
-	// pci_choose_state(): Choose the power state of a PCI device to be suspended
-	retval = pci_enable_wake(pci_dev, pci_choose_state(pci_dev, state), 1);
-	// save the PCI configuration space of a device before suspending
-	pci_save_state(pci_dev);
-	// disable PCI device after use
-	pci_disable_device(pci_dev);
-
-	retval = pci_set_power_state(pci_dev, pci_choose_state(pci_dev, state));
-
-	DBGPRINT(RT_DEBUG_TRACE, ("<=== rt2860_suspend()\n"));
-	return retval;
-}
-
-static int rt2860_resume(
-	struct pci_dev *pci_dev)
-{
-	struct net_device *net_dev = pci_get_drvdata(pci_dev);
-	PRTMP_ADAPTER pAd = (PRTMP_ADAPTER)NULL;
-	INT32 retval;
-
-
-	// set the power state of a PCI device
-	// PCI has 4 power states, DO (normal) ~ D3(less power)
-	// in include/linux/pci.h, you can find that
-	// #define PCI_D0          ((pci_power_t __force) 0)
-	// #define PCI_D1          ((pci_power_t __force) 1)
-	// #define PCI_D2          ((pci_power_t __force) 2)
-	// #define PCI_D3hot       ((pci_power_t __force) 3)
-	// #define PCI_D3cold      ((pci_power_t __force) 4)
-	// #define PCI_UNKNOWN     ((pci_power_t __force) 5)
-	// #define PCI_POWER_ERROR ((pci_power_t __force) -1)
-	retval = pci_set_power_state(pci_dev, PCI_D0);
-
-	// restore the saved state of a PCI device
-	pci_restore_state(pci_dev);
-
-	// initialize device before it's used by a driver
-	if (pci_enable_device(pci_dev))
-	{
-		printk("pci enable fail!\n");
-		return 0;
-	}
-
-	DBGPRINT(RT_DEBUG_TRACE, ("===> rt2860_resume()\n"));
-
-	if (net_dev == NULL)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("net_dev == NULL!\n"));
-	}
-	else
-		pAd = net_dev->ml_priv;
-
-	if (pAd != NULL)
-	{
-		/* we can not use IFF_UP because ra0 down but ra1 up */
-		/* and 1 suspend/resume function for 1 module, not for each interface */
-		/* so Linux will call suspend/resume function once */
-		if (VIRTUAL_IF_NUM(pAd) > 0)
-		{
-			// mark device as attached from system and restart if needed
-			netif_device_attach(net_dev);
-
-			if (rt28xx_open((PNET_DEV)net_dev) != 0)
-			{
-				// open fail
-				DBGPRINT(RT_DEBUG_TRACE, ("<=== rt2860_resume()\n"));
-				return 0;
-			}
-
-			// increase MODULE use count
-			RT_MOD_INC_USE_COUNT();
-
-			RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS);
-			RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_RADIO_OFF);
-
-			netif_start_queue(net_dev);
-			netif_carrier_on(net_dev);
-			netif_wake_queue(net_dev);
-		}
-	}
-
-	DBGPRINT(RT_DEBUG_TRACE, ("<=== rt2860_resume()\n"));
-	return 0;
-}
-#endif // CONFIG_PM //
-
-
-static INT __init rt2860_init_module(VOID)
-{
-	return pci_register_driver(&rt2860_driver);
-}
-
-
-//
-// Driver module unload function
-//
-static VOID __exit rt2860_cleanup_module(VOID)
-{
-    pci_unregister_driver(&rt2860_driver);
-}
-
-module_init(rt2860_init_module);
-module_exit(rt2860_cleanup_module);
-
-
-static INT __devinit rt2860_init_one (
-    IN  struct pci_dev              *pci_dev,
-    IN  const struct pci_device_id  *ent)
-{
-    INT rc;
-
-    DBGPRINT(RT_DEBUG_TRACE, ("===> rt2860_init_one\n"));
-
-    // wake up and enable device
-    if (pci_enable_device (pci_dev))
-    {
-        rc = -EIO;
-    }
-    else
-    {
-        rc = rt2860_probe(pci_dev, ent);
-    }
-
-    DBGPRINT(RT_DEBUG_TRACE, ("<=== rt2860_init_one\n"));
-    return rc;
-}
-
-
-static VOID __devexit rt2860_remove_one(
-    IN  struct pci_dev  *pci_dev)
-{
-    struct net_device   *net_dev = pci_get_drvdata(pci_dev);
-    RTMP_ADAPTER        *pAd = net_dev->ml_priv;
-
-    DBGPRINT(RT_DEBUG_TRACE, ("===> rt2860_remove_one\n"));
-
-	if (pAd != NULL)
-	{
-		// Unregister network device
-		unregister_netdev(net_dev);
-
-		// Unmap CSR base address
-		iounmap((char *)(net_dev->base_addr));
-
-		RTMPFreeAdapter(pAd);
-
-		// release memory region
-		release_mem_region(pci_resource_start(pci_dev, 0), pci_resource_len(pci_dev, 0));
-	}
-	else
-	{
-		// Unregister network device
-		unregister_netdev(net_dev);
-
-		// Unmap CSR base address
-		iounmap((char *)(net_dev->base_addr));
-
-		// release memory region
-		release_mem_region(pci_resource_start(pci_dev, 0), pci_resource_len(pci_dev, 0));
-	}
-
-	// Free pre-allocated net_device memory
-	free_netdev(net_dev);
-}
-
-//
-// PCI device probe & initialization function
-//
-static INT __devinit   rt2860_probe(
-    IN  struct pci_dev              *pci_dev,
-    IN  const struct pci_device_id  *ent)
-{
-	PRTMP_ADAPTER pAd;
-    INT rv = 0;
-
-    rv = (INT)rt28xx_probe((void *)pci_dev, (void *)ent, 0, &pAd);
-	OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_ADVANCE_POWER_SAVE_PCIE_DEVICE);
-	return rv;
-}
-
-
-void init_thread_task(IN PRTMP_ADAPTER pAd)
-{
-	POS_COOKIE pObj;
-
-	pObj = (POS_COOKIE) pAd->OS_Cookie;
-
-	tasklet_init(&pObj->rx_done_task, rx_done_tasklet, (unsigned long)pAd);
-	tasklet_init(&pObj->mgmt_dma_done_task, mgmt_dma_done_tasklet, (unsigned long)pAd);
-	tasklet_init(&pObj->ac0_dma_done_task, ac0_dma_done_tasklet, (unsigned long)pAd);
-	tasklet_init(&pObj->ac1_dma_done_task, ac1_dma_done_tasklet, (unsigned long)pAd);
-	tasklet_init(&pObj->ac2_dma_done_task, ac2_dma_done_tasklet, (unsigned long)pAd);
-	tasklet_init(&pObj->ac3_dma_done_task, ac3_dma_done_tasklet, (unsigned long)pAd);
-	tasklet_init(&pObj->hcca_dma_done_task, hcca_dma_done_tasklet, (unsigned long)pAd);
-	tasklet_init(&pObj->tbtt_task, tbtt_tasklet, (unsigned long)pAd);
-	tasklet_init(&pObj->fifo_statistic_full_task, fifo_statistic_full_tasklet, (unsigned long)pAd);
-}
-
-void kill_thread_task(IN PRTMP_ADAPTER pAd)
-{
-	POS_COOKIE pObj;
-
-	pObj = (POS_COOKIE) pAd->OS_Cookie;
-
-	tasklet_kill(&pObj->rx_done_task);
-	tasklet_kill(&pObj->mgmt_dma_done_task);
-	tasklet_kill(&pObj->ac0_dma_done_task);
-	tasklet_kill(&pObj->ac1_dma_done_task);
-	tasklet_kill(&pObj->ac2_dma_done_task);
-	tasklet_kill(&pObj->ac3_dma_done_task);
-	tasklet_kill(&pObj->hcca_dma_done_task);
-	tasklet_kill(&pObj->tbtt_task);
-	tasklet_kill(&pObj->fifo_statistic_full_task);
-}
-
-
-static void rt2860_int_enable(PRTMP_ADAPTER pAd, unsigned int mode)
-{
-	u32 regValue;
-
-	pAd->int_disable_mask &= ~(mode);
-	regValue = pAd->int_enable_reg & ~(pAd->int_disable_mask);
-	RTMP_IO_WRITE32(pAd, INT_MASK_CSR, regValue);     // 1:enable
-
-	if (regValue != 0)
-		RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_INTERRUPT_ACTIVE);
-}
-
-
-static void rt2860_int_disable(PRTMP_ADAPTER pAd, unsigned int mode)
-{
-	u32 regValue;
-
-	pAd->int_disable_mask |= mode;
-	regValue = 	pAd->int_enable_reg & ~(pAd->int_disable_mask);
-	RTMP_IO_WRITE32(pAd, INT_MASK_CSR, regValue);     // 0: disable
-
-	if (regValue == 0)
-	{
-		RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_INTERRUPT_ACTIVE);
-	}
-}
-
-static void mgmt_dma_done_tasklet(unsigned long data)
-{
-	unsigned long flags;
-	PRTMP_ADAPTER pAd = (PRTMP_ADAPTER) data;
-    INT_SOURCE_CSR_STRUC	IntSource;
-	POS_COOKIE pObj;
-
-	// Do nothing if the driver is starting halt state.
-	// This might happen when timer already been fired before cancel timer with mlmehalt
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
-		return;
-
-    pObj = (POS_COOKIE) pAd->OS_Cookie;
-
-	IntSource.word = 0;
-	IntSource.field.MgmtDmaDone = 1;
-	pAd->int_pending &= ~INT_MGMT_DLY;
-
-	RTMPHandleMgmtRingDmaDoneInterrupt(pAd);
-
-	// if you use RTMP_SEM_LOCK, sometimes kernel will hang up, no any
-	// bug report output
-	RTMP_INT_LOCK(&pAd->irq_lock, flags);
-	/*
-	 * double check to avoid lose of interrupts
-	 */
-	if (pAd->int_pending & INT_MGMT_DLY)
-	{
-		tasklet_hi_schedule(&pObj->mgmt_dma_done_task);
-		RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
-		return;
-	}
-
-	/* enable TxDataInt again */
-	rt2860_int_enable(pAd, INT_MGMT_DLY);
-	RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
-}
-
-static void rx_done_tasklet(unsigned long data)
-{
-	unsigned long flags;
-	PRTMP_ADAPTER pAd = (PRTMP_ADAPTER) data;
-	BOOLEAN	bReschedule = 0;
-	POS_COOKIE pObj;
-
-	// Do nothing if the driver is starting halt state.
-	// This might happen when timer already been fired before cancel timer with mlmehalt
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
-		return;
-
-    pObj = (POS_COOKIE) pAd->OS_Cookie;
-
-	pAd->int_pending &= ~(INT_RX);
-
-	bReschedule = STARxDoneInterruptHandle(pAd, 0);
-
-	RTMP_INT_LOCK(&pAd->irq_lock, flags);
-	/*
-	 * double check to avoid rotting packet
-	 */
-	if (pAd->int_pending & INT_RX || bReschedule)
-	{
-		tasklet_hi_schedule(&pObj->rx_done_task);
-		RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
-		return;
-	}
-
-	/* enable RxINT again */
-	rt2860_int_enable(pAd, INT_RX);
-	RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
-
-}
-
-void fifo_statistic_full_tasklet(unsigned long data)
-{
-	unsigned long flags;
-	PRTMP_ADAPTER pAd = (PRTMP_ADAPTER) data;
-	POS_COOKIE pObj;
-
-	// Do nothing if the driver is starting halt state.
-	// This might happen when timer already been fired before cancel timer with mlmehalt
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
-		return;
-
-    pObj = (POS_COOKIE) pAd->OS_Cookie;
-
-	pAd->int_pending &= ~(FifoStaFullInt);
-	NICUpdateFifoStaCounters(pAd);
-
-	RTMP_INT_LOCK(&pAd->irq_lock, flags);
-	/*
-	 * double check to avoid rotting packet
-	 */
-	if (pAd->int_pending & FifoStaFullInt)
-	{
-		tasklet_hi_schedule(&pObj->fifo_statistic_full_task);
-		RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
-		return;
-	}
-
-	/* enable RxINT again */
-
-	rt2860_int_enable(pAd, FifoStaFullInt);
-	RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
-
-}
-
-static void hcca_dma_done_tasklet(unsigned long data)
-{
-	unsigned long flags;
-	PRTMP_ADAPTER pAd = (PRTMP_ADAPTER) data;
-    INT_SOURCE_CSR_STRUC	IntSource;
-	POS_COOKIE pObj;
-
-	// Do nothing if the driver is starting halt state.
-	// This might happen when timer already been fired before cancel timer with mlmehalt
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
-		return;
-
-    pObj = (POS_COOKIE) pAd->OS_Cookie;
-
-
-	IntSource.word = 0;
-	IntSource.field.HccaDmaDone = 1;
-	pAd->int_pending &= ~INT_HCCA_DLY;
-
-	RTMPHandleTxRingDmaDoneInterrupt(pAd, IntSource);
-
-	RTMP_INT_LOCK(&pAd->irq_lock, flags);
-	/*
-	 * double check to avoid lose of interrupts
-	 */
-	if (pAd->int_pending & INT_HCCA_DLY)
-	{
-		tasklet_hi_schedule(&pObj->hcca_dma_done_task);
-		RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
-		return;
-	}
-
-	/* enable TxDataInt again */
-	rt2860_int_enable(pAd, INT_HCCA_DLY);
-	RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
-}
-
-static void ac3_dma_done_tasklet(unsigned long data)
-{
-	unsigned long flags;
-	PRTMP_ADAPTER pAd = (PRTMP_ADAPTER) data;
-    INT_SOURCE_CSR_STRUC	IntSource;
-	POS_COOKIE pObj;
-	BOOLEAN bReschedule = 0;
-
-	// Do nothing if the driver is starting halt state.
-	// This might happen when timer already been fired before cancel timer with mlmehalt
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
-		return;
-
-    pObj = (POS_COOKIE) pAd->OS_Cookie;
-
-	IntSource.word = 0;
-	IntSource.field.Ac3DmaDone = 1;
-	pAd->int_pending &= ~INT_AC3_DLY;
-
-	bReschedule = RTMPHandleTxRingDmaDoneInterrupt(pAd, IntSource);
-
-	RTMP_INT_LOCK(&pAd->irq_lock, flags);
-	/*
-	 * double check to avoid lose of interrupts
-	 */
-	if ((pAd->int_pending & INT_AC3_DLY) || bReschedule)
-	{
-		tasklet_hi_schedule(&pObj->ac3_dma_done_task);
-		RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
-		return;
-	}
-
-	/* enable TxDataInt again */
-	rt2860_int_enable(pAd, INT_AC3_DLY);
-	RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
-}
-
-static void ac2_dma_done_tasklet(unsigned long data)
-{
-	unsigned long flags;
-	PRTMP_ADAPTER pAd = (PRTMP_ADAPTER) data;
-    INT_SOURCE_CSR_STRUC	IntSource;
-	POS_COOKIE pObj;
-	BOOLEAN bReschedule = 0;
-
-	// Do nothing if the driver is starting halt state.
-	// This might happen when timer already been fired before cancel timer with mlmehalt
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
-		return;
-
-    pObj = (POS_COOKIE) pAd->OS_Cookie;
-
-	IntSource.word = 0;
-	IntSource.field.Ac2DmaDone = 1;
-	pAd->int_pending &= ~INT_AC2_DLY;
-
-	bReschedule = RTMPHandleTxRingDmaDoneInterrupt(pAd, IntSource);
-
-	RTMP_INT_LOCK(&pAd->irq_lock, flags);
-
-	/*
-	 * double check to avoid lose of interrupts
-	 */
-	if ((pAd->int_pending & INT_AC2_DLY) || bReschedule)
-	{
-		tasklet_hi_schedule(&pObj->ac2_dma_done_task);
-		RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
-		return;
-	}
-
-	/* enable TxDataInt again */
-	rt2860_int_enable(pAd, INT_AC2_DLY);
-	RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
-}
-
-static void ac1_dma_done_tasklet(unsigned long data)
-{
-	unsigned long flags;
-	PRTMP_ADAPTER pAd = (PRTMP_ADAPTER) data;
-    INT_SOURCE_CSR_STRUC	IntSource;
-	POS_COOKIE pObj;
-	BOOLEAN bReschedule = 0;
-
-	// Do nothing if the driver is starting halt state.
-	// This might happen when timer already been fired before cancel timer with mlmehalt
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
-		return;
-
-    pObj = (POS_COOKIE) pAd->OS_Cookie;
-
-	IntSource.word = 0;
-	IntSource.field.Ac1DmaDone = 1;
-	pAd->int_pending &= ~INT_AC1_DLY;
-
-	bReschedule = RTMPHandleTxRingDmaDoneInterrupt(pAd, IntSource);
-
-	RTMP_INT_LOCK(&pAd->irq_lock, flags);
-	/*
-	 * double check to avoid lose of interrupts
-	 */
-	if ((pAd->int_pending & INT_AC1_DLY) || bReschedule)
-	{
-		tasklet_hi_schedule(&pObj->ac1_dma_done_task);
-		RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
-		return;
-	}
-
-	/* enable TxDataInt again */
-	rt2860_int_enable(pAd, INT_AC1_DLY);
-	RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
-}
-
-static void ac0_dma_done_tasklet(unsigned long data)
-{
-	unsigned long flags;
-	PRTMP_ADAPTER pAd = (PRTMP_ADAPTER) data;
-    INT_SOURCE_CSR_STRUC	IntSource;
-	POS_COOKIE pObj;
-	BOOLEAN bReschedule = 0;
-
-	// Do nothing if the driver is starting halt state.
-	// This might happen when timer already been fired before cancel timer with mlmehalt
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
-		return;
-
-    pObj = (POS_COOKIE) pAd->OS_Cookie;
-
-	IntSource.word = 0;
-	IntSource.field.Ac0DmaDone = 1;
-	pAd->int_pending &= ~INT_AC0_DLY;
-
-	bReschedule = RTMPHandleTxRingDmaDoneInterrupt(pAd, IntSource);
-
-	RTMP_INT_LOCK(&pAd->irq_lock, flags);
-	/*
-	 * double check to avoid lose of interrupts
-	 */
-	if ((pAd->int_pending & INT_AC0_DLY) || bReschedule)
-	{
-		tasklet_hi_schedule(&pObj->ac0_dma_done_task);
-		RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
-		return;
-	}
-
-	/* enable TxDataInt again */
-	rt2860_int_enable(pAd, INT_AC0_DLY);
-	RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
-}
-
-
-int print_int_count;
-
-IRQ_HANDLE_TYPE
-rt2860_interrupt(int irq, void *dev_instance)
-{
-	struct net_device *net_dev = (struct net_device *) dev_instance;
-	PRTMP_ADAPTER pAd = net_dev->ml_priv;
-	INT_SOURCE_CSR_STRUC	IntSource;
-	POS_COOKIE pObj;
-	BOOLEAN	bOldValue;
-
-	pObj = (POS_COOKIE) pAd->OS_Cookie;
-
-
-	/* Note 03312008: we can not return here before
-		RTMP_IO_READ32(pAd, INT_SOURCE_CSR, &IntSource.word);
-		RTMP_IO_WRITE32(pAd, INT_SOURCE_CSR, IntSource.word);
-		Or kernel will panic after ifconfig ra0 down sometimes */
-
-
-	//
-	// Inital the Interrupt source.
-	//
-	IntSource.word = 0x00000000L;
-//	McuIntSource.word = 0x00000000L;
-
-	//
-	// Get the interrupt sources & saved to local variable
-	//
-	//RTMP_IO_READ32(pAd, where, &McuIntSource.word);
-	//RTMP_IO_WRITE32(pAd, , McuIntSource.word);
-
-	//
-	// Flag fOP_STATUS_DOZE On, means ASIC put to sleep, elase means ASICK WakeUp
-	// And at the same time, clock maybe turned off that say there is no DMA service.
-	// when ASIC get to sleep.
-	// To prevent system hang on power saving.
-	// We need to check it before handle the INT_SOURCE_CSR, ASIC must be wake up.
-	//
-	// RT2661 => when ASIC is sleeping, MAC register cannot be read and written.
-	// RT2860 => when ASIC is sleeping, MAC register can be read and written.
-
-	bOldValue = pAd->bPCIclkOff;
-	pAd->bPCIclkOff = FALSE;
-	{
-		RTMP_IO_READ32(pAd, INT_SOURCE_CSR, &IntSource.word);
-		RTMP_IO_WRITE32(pAd, INT_SOURCE_CSR, IntSource.word); // write 1 to clear
-	}
-	pAd->bPCIclkOff = bOldValue;
-
-	// Do nothing if Reset in progress
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RESET_IN_PROGRESS) ||
-		RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS))
-	{
-		return IRQ_HANDLED;
-	}
-
-	//
-	// Handle interrupt, walk through all bits
-	// Should start from highest priority interrupt
-	// The priority can be adjust by altering processing if statement
-	//
-
-	// If required spinlock, each interrupt service routine has to acquire
-	// and release itself.
-	//
-
-	// Do nothing if NIC doesn't exist
-	if (IntSource.word == 0xffffffff)
-	{
-		RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST | fRTMP_ADAPTER_HALT_IN_PROGRESS);
-		printk("snowpin - IntSource.word == 0xffffffff\n");
-		return IRQ_HANDLED;
-	}
-
-	if (IntSource.word & TxCoherent)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, (">>>TxCoherent<<<\n"));
-		RTMPHandleRxCoherentInterrupt(pAd);
-	}
-
-	if (IntSource.word & RxCoherent)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, (">>>RxCoherent<<<\n"));
-		RTMPHandleRxCoherentInterrupt(pAd);
-	}
-
-	if (IntSource.word & FifoStaFullInt)
-	{
-#if 1
-		if ((pAd->int_disable_mask & FifoStaFullInt) == 0)
-		{
-			/* mask FifoStaFullInt */
-			rt2860_int_disable(pAd, FifoStaFullInt);
-			tasklet_hi_schedule(&pObj->fifo_statistic_full_task);
-		}
-		pAd->int_pending |= FifoStaFullInt;
-#else
-		NICUpdateFifoStaCounters(pAd);
-#endif
-	}
-
-	if (IntSource.word & INT_MGMT_DLY)
-	{
-		if ((pAd->int_disable_mask & INT_MGMT_DLY) ==0 )
-		{
-			rt2860_int_disable(pAd, INT_MGMT_DLY);
-			tasklet_hi_schedule(&pObj->mgmt_dma_done_task);
-		}
-		pAd->int_pending |= INT_MGMT_DLY ;
-	}
-
-	if (IntSource.word & INT_RX)
-	{
-		if ((pAd->int_disable_mask & INT_RX) == 0)
-		{
-			/* mask RxINT */
-			rt2860_int_disable(pAd, INT_RX);
-			tasklet_hi_schedule(&pObj->rx_done_task);
-		}
-		pAd->int_pending |= INT_RX;
-	}
-
-	if (IntSource.word & INT_HCCA_DLY)
-	{
-
-		if ((pAd->int_disable_mask & INT_HCCA_DLY) == 0)
-		{
-			/* mask TxDataInt */
-			rt2860_int_disable(pAd, INT_HCCA_DLY);
-			tasklet_hi_schedule(&pObj->hcca_dma_done_task);
-		}
-		pAd->int_pending |= INT_HCCA_DLY;
-	}
-
-	if (IntSource.word & INT_AC3_DLY)
-	{
-
-		if ((pAd->int_disable_mask & INT_AC3_DLY) == 0)
-		{
-			/* mask TxDataInt */
-			rt2860_int_disable(pAd, INT_AC3_DLY);
-			tasklet_hi_schedule(&pObj->ac3_dma_done_task);
-		}
-		pAd->int_pending |= INT_AC3_DLY;
-	}
-
-	if (IntSource.word & INT_AC2_DLY)
-	{
-
-		if ((pAd->int_disable_mask & INT_AC2_DLY) == 0)
-		{
-			/* mask TxDataInt */
-			rt2860_int_disable(pAd, INT_AC2_DLY);
-			tasklet_hi_schedule(&pObj->ac2_dma_done_task);
-		}
-		pAd->int_pending |= INT_AC2_DLY;
-	}
-
-	if (IntSource.word & INT_AC1_DLY)
-	{
-
-		pAd->int_pending |= INT_AC1_DLY;
-
-		if ((pAd->int_disable_mask & INT_AC1_DLY) == 0)
-		{
-			/* mask TxDataInt */
-			rt2860_int_disable(pAd, INT_AC1_DLY);
-			tasklet_hi_schedule(&pObj->ac1_dma_done_task);
-		}
-
-	}
-
-	if (IntSource.word & INT_AC0_DLY)
-	{
-		pAd->int_pending |= INT_AC0_DLY;
-
-		if ((pAd->int_disable_mask & INT_AC0_DLY) == 0)
-		{
-			/* mask TxDataInt */
-			rt2860_int_disable(pAd, INT_AC0_DLY);
-			tasklet_hi_schedule(&pObj->ac0_dma_done_task);
-		}
-
-	}
-
-    if (IntSource.word & PreTBTTInt)
-	{
-		RTMPHandlePreTBTTInterrupt(pAd);
-	}
-
-	if (IntSource.word & TBTTInt)
-	{
-		RTMPHandleTBTTInterrupt(pAd);
-	}
-
-	if (IntSource.word & AutoWakeupInt)
-		RTMPHandleTwakeupInterrupt(pAd);
-
-    return  IRQ_HANDLED;
-}
-
-/*
-========================================================================
-Routine Description:
-    Check the chipset vendor/product ID.
-
-Arguments:
-    _dev_p				Point to the PCI or USB device
-
-Return Value:
-    TRUE				Check ok
-	FALSE				Check fail
-
-Note:
-========================================================================
-*/
-BOOLEAN RT28XXChipsetCheck(
-	IN void *_dev_p)
-{
-	/* always TRUE */
-	return TRUE;
-}
-
-
-/*
-========================================================================
-Routine Description:
-    Init net device structure.
-
-Arguments:
-    _dev_p				Point to the PCI or USB device
-    *net_dev			Point to the net device
-	*pAd				the raxx interface data pointer
-
-Return Value:
-    TRUE				Init ok
-	FALSE				Init fail
-
-Note:
-========================================================================
-*/
-BOOLEAN RT28XXNetDevInit(
-	IN void 				*_dev_p,
-	IN struct  net_device	*net_dev,
-	IN RTMP_ADAPTER 		*pAd)
-{
-	struct pci_dev *pci_dev = (struct pci_dev *)_dev_p;
-    const CHAR	*print_name;
-    ULONG	csr_addr;
-
-
-	print_name = pci_dev ? pci_name(pci_dev) : "rt2860";
-
-	net_dev->base_addr = 0;
-	net_dev->irq = 0;
-
-    if (pci_request_regions(pci_dev, print_name))
-        goto err_out_free_netdev;
-
-    // interrupt IRQ number
-    net_dev->irq = pci_dev->irq;
-
-    // map physical address to virtual address for accessing register
-    csr_addr = (unsigned long) ioremap(pci_resource_start(pci_dev, 0),
-										pci_resource_len(pci_dev, 0));
-
-    if (!csr_addr)
-    {
-        DBGPRINT(RT_DEBUG_ERROR,
-				("ioremap failed for device %s, region 0x%lX @ 0x%lX\n",
-				print_name, (ULONG)pci_resource_len(pci_dev, 0),
-				(ULONG)pci_resource_start(pci_dev, 0)));
-        goto err_out_free_res;
-    }
-
-    // Save CSR virtual address and irq to device structure
-    net_dev->base_addr = csr_addr;
-    pAd->CSRBaseAddress = (PUCHAR)net_dev->base_addr;
-
-    // Set DMA master
-    pci_set_master(pci_dev);
-
-    net_dev->priv_flags = INT_MAIN;
-
-    DBGPRINT(RT_DEBUG_TRACE, ("%s: at 0x%lx, VA 0x%lx, IRQ %d. \n",
-        	net_dev->name, (ULONG)pci_resource_start(pci_dev, 0),
-			(ULONG)csr_addr, pci_dev->irq));
-	return TRUE;
-
-
-	/* --------------------------- ERROR HANDLE --------------------------- */
-err_out_free_res:
-    pci_release_regions(pci_dev);
-err_out_free_netdev:
-	/* free netdev in caller, not here */
-	return FALSE;
-}
-
-
-/*
-========================================================================
-Routine Description:
-    Init net device structure.
-
-Arguments:
-    _dev_p				Point to the PCI or USB device
-	*pAd				the raxx interface data pointer
-
-Return Value:
-    TRUE				Config ok
-	FALSE				Config fail
-
-Note:
-========================================================================
-*/
-BOOLEAN RT28XXProbePostConfig(
-	IN void 				*_dev_p,
-	IN RTMP_ADAPTER 		*pAd,
-	IN INT32				argc)
-{
-	/* no use */
-	return TRUE;
-}
-
-
-/*
-========================================================================
-Routine Description:
-    Disable DMA.
-
-Arguments:
-	*pAd				the raxx interface data pointer
-
-Return Value:
-	None
-
-Note:
-========================================================================
-*/
-VOID RT28XXDMADisable(
-	IN RTMP_ADAPTER 		*pAd)
-{
-	WPDMA_GLO_CFG_STRUC     GloCfg;
-
-
-	RTMP_IO_READ32(pAd, WPDMA_GLO_CFG, &GloCfg.word);
-	GloCfg.word &= 0xff0;
-	GloCfg.field.EnTXWriteBackDDONE =1;
-	RTMP_IO_WRITE32(pAd, WPDMA_GLO_CFG, GloCfg.word);
-}
-
-
-/*
-========================================================================
-Routine Description:
-    Enable DMA.
-
-Arguments:
-	*pAd				the raxx interface data pointer
-
-Return Value:
-	None
-
-Note:
-========================================================================
-*/
-VOID RT28XXDMAEnable(
-	IN RTMP_ADAPTER 		*pAd)
-{
-	WPDMA_GLO_CFG_STRUC	GloCfg;
-	int i = 0;
-
-	RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, 0x4);
-	do
-	{
-		RTMP_IO_READ32(pAd, WPDMA_GLO_CFG, &GloCfg.word);
-		if ((GloCfg.field.TxDMABusy == 0)  && (GloCfg.field.RxDMABusy == 0))
-			break;
-
-		DBGPRINT(RT_DEBUG_TRACE, ("==>  DMABusy\n"));
-		RTMPusecDelay(1000);
-		i++;
-	}while ( i <200);
-
-	RTMPusecDelay(50);
-
-	GloCfg.field.EnTXWriteBackDDONE = 1;
-	GloCfg.field.WPDMABurstSIZE = 2;
-	GloCfg.field.EnableRxDMA = 1;
-	GloCfg.field.EnableTxDMA = 1;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("<== WRITE DMA offset 0x208 = 0x%x\n", GloCfg.word));
-	RTMP_IO_WRITE32(pAd, WPDMA_GLO_CFG, GloCfg.word);
-
-}
-
-/*
-========================================================================
-Routine Description:
-    Write Beacon buffer to Asic.
-
-Arguments:
-	*pAd				the raxx interface data pointer
-
-Return Value:
-	None
-
-Note:
-========================================================================
-*/
-VOID RT28xx_UpdateBeaconToAsic(
-	IN RTMP_ADAPTER		*pAd,
-	IN INT				apidx,
-	IN ULONG			FrameLen,
-	IN ULONG			UpdatePos)
-{
-	ULONG				CapInfoPos = 0;
-	UCHAR  			*ptr, *ptr_update, *ptr_capinfo;
-	UINT  			i;
-	BOOLEAN			bBcnReq = FALSE;
-	UCHAR			bcn_idx = 0;
-
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("%s() : No valid Interface be found.\n", __func__));
-		return;
-	}
-
-	if (bBcnReq == FALSE)
-	{
-		/* when the ra interface is down, do not send its beacon frame */
-		/* clear all zero */
-		for(i=0; i<TXWI_SIZE; i+=4)
-			RTMP_IO_WRITE32(pAd, pAd->BeaconOffset[bcn_idx] + i, 0x00);
-	}
-	else
-	{
-		ptr = (PUCHAR)&pAd->BeaconTxWI;
-
-		for (i=0; i<TXWI_SIZE; i+=4)  // 16-byte TXWI field
-		{
-			UINT32 longptr =  *ptr + (*(ptr+1)<<8) + (*(ptr+2)<<16) + (*(ptr+3)<<24);
-			RTMP_IO_WRITE32(pAd, pAd->BeaconOffset[bcn_idx] + i, longptr);
-			ptr += 4;
-		}
-
-		// Update CapabilityInfo in Beacon
-		for (i = CapInfoPos; i < (CapInfoPos+2); i++)
-		{
-			RTMP_IO_WRITE8(pAd, pAd->BeaconOffset[bcn_idx] + TXWI_SIZE + i, *ptr_capinfo);
-			ptr_capinfo ++;
-		}
-
-		if (FrameLen > UpdatePos)
-		{
-			for (i= UpdatePos; i< (FrameLen); i++)
-			{
-				RTMP_IO_WRITE8(pAd, pAd->BeaconOffset[bcn_idx] + TXWI_SIZE + i, *ptr_update);
-				ptr_update ++;
-			}
-		}
-
-	}
-
-}
-
-VOID RTMPInitPCIeLinkCtrlValue(
-	IN	PRTMP_ADAPTER	pAd)
-{
-}
-
-VOID RTMPFindHostPCIDev(
-    IN	PRTMP_ADAPTER	pAd)
-{
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-
-	Arguments:
-		Level = RESTORE_HALT : Restore PCI host and Ralink PCIe Link Control field to its default value.
-		Level = Other Value : Restore from dot11 power save or radio off status. And force PCI host Link Control fields to 0x1
-
-	========================================================================
-*/
-VOID RTMPPCIeLinkCtrlValueRestore(
-	IN	PRTMP_ADAPTER	pAd,
-	IN   UCHAR		Level)
-{
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-
-	Arguments:
-		Max : limit Host PCI and Ralink PCIe device's LINK CONTROL field's value.
-		Because now frequently set our device to mode 1 or mode 3 will cause problem.
-
-	========================================================================
-*/
-VOID RTMPPCIeLinkCtrlSetting(
-	IN	PRTMP_ADAPTER	pAd,
-	IN 	USHORT		Max)
-{
-}
-
-VOID rt2860_stop(struct net_device *net_dev)
-{
-    PRTMP_ADAPTER pAd = (PRTMP_ADAPTER)NULL;
-    if (net_dev == NULL)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("net_dev == NULL!\n"));
-	}
-	else
-		pAd = net_dev->ml_priv;
-
-	if (pAd != NULL)
-	{
-	    // stop interface
-		netif_carrier_off(net_dev);
-		netif_stop_queue(net_dev);
-
-		// mark device as removed from system and therefore no longer available
-		netif_device_detach(net_dev);
-
-		// mark halt flag
-		RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS);
-		RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_RADIO_OFF);
-
-		// take down the device
-		rt28xx_close((PNET_DEV)net_dev);
-		RT_MOD_DEC_USE_COUNT();
-	}
-    return;
-}
-
-/*
- * invaild or writeback cache
- * and convert virtual address to physical address
- */
-dma_addr_t linux_pci_map_single(void *handle, void *ptr, size_t size, int sd_idx, int direction)
-{
-	PRTMP_ADAPTER pAd;
-	POS_COOKIE pObj;
-
-	/*
-		------ Porting Information ------
-		> For Tx Alloc:
-			mgmt packets => sd_idx = 0
-			SwIdx: pAd->MgmtRing.TxCpuIdx
-			pTxD : pAd->MgmtRing.Cell[SwIdx].AllocVa;
-
-			data packets => sd_idx = 1
-	 		TxIdx : pAd->TxRing[pTxBlk->QueIdx].TxCpuIdx
-	 		QueIdx: pTxBlk->QueIdx
-	 		pTxD  : pAd->TxRing[pTxBlk->QueIdx].Cell[TxIdx].AllocVa;
-
-	 	> For Rx Alloc:
-	 		sd_idx = -1
-	*/
-
-	pAd = (PRTMP_ADAPTER)handle;
-	pObj = (POS_COOKIE)pAd->OS_Cookie;
-
-	if (sd_idx == 1)
-	{
-		PTX_BLK		pTxBlk;
-		pTxBlk = (PTX_BLK)ptr;
-		return pci_map_single(pObj->pci_dev, pTxBlk->pSrcBufData, pTxBlk->SrcBufLen, direction);
-	}
-	else
-	{
-		return pci_map_single(pObj->pci_dev, ptr, size, direction);
-	}
-
-}
-
-void linux_pci_unmap_single(void *handle, dma_addr_t dma_addr, size_t size, int direction)
-{
-	PRTMP_ADAPTER pAd;
-	POS_COOKIE pObj;
-
-	pAd=(PRTMP_ADAPTER)handle;
-	pObj = (POS_COOKIE)pAd->OS_Cookie;
-
-	pci_unmap_single(pObj->pci_dev, dma_addr, size, direction);
-
-}
-
diff --git a/drivers/staging/rt2860/Kconfig b/drivers/staging/rt2860/Kconfig
index efe38e25c5ed..f9962b693128 100644
--- a/drivers/staging/rt2860/Kconfig
+++ b/drivers/staging/rt2860/Kconfig
@@ -1,5 +1,8 @@
 config RT2860
-	tristate "Ralink 2860 wireless support"
+	tristate "Ralink 2860/3090 wireless support"
 	depends on PCI && X86 && WLAN
+	select WIRELESS_EXT
+	select WEXT_PRIV
 	---help---
-	  This is an experimental driver for the Ralink 2860 wireless chip.
+	  This is an experimental driver for the Ralink 2860 and 3090
+	  wireless chips.
diff --git a/drivers/staging/rt2860/Makefile b/drivers/staging/rt2860/Makefile
index c9fe92583d7e..23ae07f00ead 100644
--- a/drivers/staging/rt2860/Makefile
+++ b/drivers/staging/rt2860/Makefile
@@ -2,26 +2,33 @@ obj-$(CONFIG_RT2860)	+= rt2860sta.o
 
 # TODO: all of these should be removed
 EXTRA_CFLAGS += -DLINUX -DAGGREGATION_SUPPORT -DPIGGYBACK_SUPPORT -DWMM_SUPPORT
-EXTRA_CFLAGS += -DRT2860
+EXTRA_CFLAGS += -DRTMP_MAC_PCI -DRTMP_PCI_SUPPORT -DRT2860
+EXTRA_CFLAGS += -DRTMP_RF_RW_SUPPORT -DRTMP_EFUSE_SUPPORT -DRT30xx -DRT3090
 EXTRA_CFLAGS += -DDBG
 
 rt2860sta-objs :=	\
-	common/md5.o		\
+	common/crypt_md5.o	\
+	common/crypt_sha2.o	\
+	common/crypt_hmac.o	\
 	common/mlme.o		\
-	common/rtmp_wep.o	\
+	common/cmm_wep.o	\
 	common/action.o		\
 	common/cmm_data.o	\
 	common/rtmp_init.o	\
-	common/rtmp_tkip.o	\
+	common/cmm_tkip.o	\
+	common/cmm_aes.o	\
 	common/cmm_sync.o	\
 	common/eeprom.o		\
 	common/cmm_sanity.o	\
 	common/cmm_info.o	\
+	common/cmm_cfg.o	\
 	common/cmm_wpa.o	\
 	common/dfs.o		\
 	common/spectrum.o	\
+	common/rtmp_timer.o	\
+	common/rt_channel.o	\
+	common/cmm_asic.o	\
 	sta/assoc.o		\
-	sta/aironet.o		\
 	sta/auth.o		\
 	sta/auth_rsp.o		\
 	sta/sync.o		\
@@ -30,10 +37,16 @@ rt2860sta-objs :=	\
 	sta/connect.o		\
 	sta/wpa.o		\
 	rt_linux.o		\
-	rt_profile.o		\
 	rt_main_dev.o		\
 	sta_ioctl.o		\
 	common/ba_action.o	\
-	common/2860_rtmp_init.o	\
-	2860_main_dev.o		\
-	common/cmm_data_2860.o
+	pci_main_dev.o		\
+	rt_pci_rbus.o		\
+	common/cmm_mac_pci.o	\
+	common/cmm_data_pci.o	\
+	common/ee_prom.o	\
+	common/rtmp_mcu.o	\
+	common/ee_efuse.o	\
+	chips/rt30xx.o		\
+	common/rt_rf.o		\
+	chips/rt3090.o
diff --git a/drivers/staging/rt2860/TODO b/drivers/staging/rt2860/TODO
index 6158dc2a4b66..8e2f6ee0a2be 100644
--- a/drivers/staging/rt2860/TODO
+++ b/drivers/staging/rt2860/TODO
@@ -9,7 +9,6 @@ TODO:
 	- checkpatch.pl clean
 	- sparse clean
 	- port to in-kernel 80211 stack and common rt2x00 infrastructure
-	- remove reading from /etc/ config files
 	- review by the wireless developer community
 
 Please send any patches or complaints about this driver to Greg
diff --git a/drivers/staging/rt2860/aironet.h b/drivers/staging/rt2860/aironet.h
deleted file mode 100644
index 1e07b19b8cdc..000000000000
--- a/drivers/staging/rt2860/aironet.h
+++ /dev/null
@@ -1,210 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-	Module Name:
-	aironet.h
-
-	Abstract:
-
-	Revision History:
-	Who			When			What
-	--------	----------		----------------------------------------------
-	Name		Date			Modification logs
-	Paul Lin	04-06-15		Initial
-*/
-
-#ifndef	__AIRONET_H__
-#define	__AIRONET_H__
-
-// Measurement Type definition
-#define	MSRN_TYPE_UNUSED				0
-#define	MSRN_TYPE_CHANNEL_LOAD_REQ		1
-#define	MSRN_TYPE_NOISE_HIST_REQ		2
-#define	MSRN_TYPE_BEACON_REQ			3
-#define	MSRN_TYPE_FRAME_REQ				4
-
-// Scan Mode in Beacon Request
-#define	MSRN_SCAN_MODE_PASSIVE			0
-#define	MSRN_SCAN_MODE_ACTIVE			1
-#define	MSRN_SCAN_MODE_BEACON_TABLE		2
-
-// PHY type definition for Aironet beacon report, CCX 2 table 36-9
-#define	PHY_FH							1
-#define	PHY_DSS							2
-#define	PHY_UNUSED						3
-#define	PHY_OFDM						4
-#define	PHY_HR_DSS						5
-#define	PHY_ERP							6
-
-// RPI table in dBm
-#define	RPI_0			0			//	Power <= -87
-#define	RPI_1			1			//	-87 < Power <= -82
-#define	RPI_2			2			//	-82 < Power <= -77
-#define	RPI_3			3			//	-77 < Power <= -72
-#define	RPI_4			4			//	-72 < Power <= -67
-#define	RPI_5			5			//	-67 < Power <= -62
-#define	RPI_6			6			//	-62 < Power <= -57
-#define	RPI_7			7			//	-57 < Power
-
-// Cisco Aironet IAPP definetions
-#define	AIRONET_IAPP_TYPE					0x32
-#define	AIRONET_IAPP_SUBTYPE_REQUEST		0x01
-#define	AIRONET_IAPP_SUBTYPE_REPORT			0x81
-
-// Measurement Request detail format
-typedef	struct	_MEASUREMENT_REQUEST	{
-	UCHAR	Channel;
-	UCHAR	ScanMode;			// Use only in beacon request, other requests did not use this field
-	USHORT	Duration;
-}	MEASUREMENT_REQUEST, *PMEASUREMENT_REQUEST;
-
-// Beacon Measurement Report
-// All these field might change to UCHAR, because we didn't do anything to these report.
-// We copy all these beacons and report to CCX 2 AP.
-typedef	struct	_BEACON_REPORT	{
-	UCHAR	Channel;
-	UCHAR	Spare;
-	USHORT	Duration;
-	UCHAR	PhyType;			// Definiation is listed above table 36-9
-	UCHAR	RxPower;
-	UCHAR	BSSID[6];
-	UCHAR	ParentTSF[4];
-	UCHAR	TargetTSF[8];
-	USHORT	BeaconInterval;
-	USHORT	CapabilityInfo;
-}	BEACON_REPORT, *PBEACON_REPORT;
-
-// Frame Measurement Report (Optional)
-typedef	struct	_FRAME_REPORT	{
-	UCHAR	Channel;
-	UCHAR	Spare;
-	USHORT	Duration;
-	UCHAR	TA;
-	UCHAR	BSSID[6];
-	UCHAR	RSSI;
-	UCHAR	Count;
-}	FRAME_REPORT, *PFRAME_REPORT;
-
-#pragma pack(1)
-// Channel Load Report
-typedef	struct	_CHANNEL_LOAD_REPORT	{
-	UCHAR	Channel;
-	UCHAR	Spare;
-	USHORT	Duration;
-	UCHAR	CCABusy;
-}	CHANNEL_LOAD_REPORT, *PCHANNEL_LOAD_REPORT;
-#pragma pack()
-
-// Nosie Histogram Report
-typedef	struct	_NOISE_HIST_REPORT	{
-	UCHAR	Channel;
-	UCHAR	Spare;
-	USHORT	Duration;
-	UCHAR	Density[8];
-}	NOISE_HIST_REPORT, *PNOISE_HIST_REPORT;
-
-// Radio Management Capability element
-typedef	struct	_RADIO_MANAGEMENT_CAPABILITY	{
-	UCHAR	Eid;				// TODO: Why the Eid is 1 byte, not normal 2 bytes???
-	UCHAR	Length;
-	UCHAR	AironetOui[3];		// AIronet OUI (00 40 96)
-	UCHAR	Type;				// Type / Version
-	USHORT	Status;				// swap16 required
-}	RADIO_MANAGEMENT_CAPABILITY, *PRADIO_MANAGEMENT_CAPABILITY;
-
-// Measurement Mode Bit definition
-typedef	struct	_MEASUREMENT_MODE	{
-	UCHAR	Rsvd:4;
-	UCHAR	Report:1;
-	UCHAR	NotUsed:1;
-	UCHAR	Enable:1;
-	UCHAR	Parallel:1;
-}	MEASUREMENT_MODE, *PMEASUREMENT_MODE;
-
-// Measurement Request element, This is little endian mode
-typedef	struct	_MEASUREMENT_REQUEST_ELEMENT	{
-	USHORT				Eid;
-	USHORT				Length;				// swap16 required
-	USHORT				Token;				// non-zero unique token
-	UCHAR				Mode;				// Measurement Mode
-	UCHAR				Type;				// Measurement type
-}	MEASUREMENT_REQUEST_ELEMENT, *PMEASUREMENT_REQUEST_ELEMENT;
-
-// Measurement Report element, This is little endian mode
-typedef	struct	_MEASUREMENT_REPORT_ELEMENT	{
-	USHORT				Eid;
-	USHORT				Length;				// swap16 required
-	USHORT				Token;				// non-zero unique token
-	UCHAR				Mode;				// Measurement Mode
-	UCHAR				Type;				// Measurement type
-}	MEASUREMENT_REPORT_ELEMENT, *PMEASUREMENT_REPORT_ELEMENT;
-
-// Cisco Aironet IAPP Frame Header, Network byte order used
-typedef	struct	_AIRONET_IAPP_HEADER {
-	UCHAR	CiscoSnapHeader[8];	// 8 bytes Cisco snap header
-	USHORT	Length;				// IAPP ID & length, remember to swap16 in LE system
-	UCHAR	Type;				// IAPP type
-	UCHAR	SubType;			// IAPP subtype
-	UCHAR	DA[6];				// Destination MAC address
-	UCHAR	SA[6];				// Source MAC address
-	USHORT	Token;				// Dialog token, no need to swap16 since it is for yoken usage only
-}	AIRONET_IAPP_HEADER, *PAIRONET_IAPP_HEADER;
-
-// Radio Measurement Request frame
-typedef	struct	_AIRONET_RM_REQUEST_FRAME	{
-    AIRONET_IAPP_HEADER	IAPP;			// Common header
-	UCHAR				Delay;			// Activation Delay
-	UCHAR				Offset;			// Measurement offset
-}	AIRONET_RM_REQUEST_FRAME, *PAIRONET_RM_REQUEST_FRAME;
-
-// Radio Measurement Report frame
-typedef	struct	_AIRONET_RM_REPORT_FRAME	{
-    AIRONET_IAPP_HEADER	IAPP;			// Common header
-}	AIRONET_RM_REPORT_FRAME, *PAIRONET_RM_REPORT_FRAME;
-
-// Saved element request actions which will saved in StaCfg.
-typedef	struct	_RM_REQUEST_ACTION	{
-	MEASUREMENT_REQUEST_ELEMENT	ReqElem;		// Saved request element
-	MEASUREMENT_REQUEST			Measurement;	// Saved measurement within the request element
-}	RM_REQUEST_ACTION, *PRM_REQUEST_ACTION;
-
-// CCX administration control
-typedef	union	_CCX_CONTROL	{
-	struct	{
-		UINT32		Enable:1;			// Enable CCX2
-		UINT32		LeapEnable:1;		// Enable LEAP at CCX2
-		UINT32		RMEnable:1;			// Radio Measurement Enable
-		UINT32		DCRMEnable:1;		// Non serving channel Radio Measurement enable
-		UINT32		QOSEnable:1;		// Enable QOS for CCX 2.0 support
-		UINT32		FastRoamEnable:1;	// Enable fast roaming
-		UINT32		Rsvd:2;				// Not used
-		UINT32		dBmToRoam:8;		// the condition to roam when receiving Rssi less than this value. It's negative value.
-		UINT32		TuLimit:16;			// Limit for different channel scan
-	}	field;
-	UINT32			word;
-}	CCX_CONTROL, *PCCX_CONTROL;
-
-#endif	// __AIRONET_H__
diff --git a/drivers/staging/rt2860/ap.h b/drivers/staging/rt2860/ap.h
index fcdb35847b10..3f744a52aac7 100644
--- a/drivers/staging/rt2860/ap.h
+++ b/drivers/staging/rt2860/ap.h
@@ -40,39 +40,27 @@
 #ifndef __AP_H__
 #define __AP_H__
 
-// ap_mlme.c
+/* ap_wpa.c */
+void WpaStateMachineInit(struct rt_rtmp_adapter *pAd,
+			 struct rt_state_machine *Sm, OUT STATE_MACHINE_FUNC Trans[]);
 
-#ifdef RT2870
-VOID BeaconUpdateExec(
-    IN PVOID SystemSpecific1,
-    IN PVOID FunctionContext,
-    IN PVOID SystemSpecific2,
-    IN PVOID SystemSpecific3);
-#endif // RT2870 //
+#ifdef RTMP_MAC_USB
+void BeaconUpdateExec(void *SystemSpecific1,
+		      void *FunctionContext,
+		      void *SystemSpecific2, void *SystemSpecific3);
+#endif /* RTMP_MAC_USB // */
 
-VOID RTMPSetPiggyBack(
-	IN PRTMP_ADAPTER	pAd,
-	IN BOOLEAN			bPiggyBack);
+void RTMPSetPiggyBack(struct rt_rtmp_adapter *pAd, IN BOOLEAN bPiggyBack);
 
-// ap.c
+void MacTableReset(struct rt_rtmp_adapter *pAd);
 
-VOID MacTableReset(
-    IN  PRTMP_ADAPTER   pAd);
+struct rt_mac_table_entry *MacTableInsertEntry(struct rt_rtmp_adapter *pAd,
+				     u8 *pAddr,
+				     u8 apidx, IN BOOLEAN CleanAll);
 
-MAC_TABLE_ENTRY *MacTableInsertEntry(
-    IN  PRTMP_ADAPTER   pAd,
-    IN  PUCHAR          pAddr,
-	IN	UCHAR			apidx,
-	IN BOOLEAN	CleanAll);
+BOOLEAN MacTableDeleteEntry(struct rt_rtmp_adapter *pAd,
+			    u16 wcid, u8 *pAddr);
 
-BOOLEAN MacTableDeleteEntry(
-    IN  PRTMP_ADAPTER   pAd,
-	IN USHORT wcid,
-    IN  PUCHAR          pAddr);
-
-MAC_TABLE_ENTRY *MacTableLookup(
-    IN  PRTMP_ADAPTER   pAd,
-    IN  PUCHAR          pAddr);
-
-#endif  // __AP_H__
+struct rt_mac_table_entry *MacTableLookup(struct rt_rtmp_adapter *pAd, u8 *pAddr);
 
+#endif /* __AP_H__ */
diff --git a/drivers/staging/rt3090/mac_pci.h b/drivers/staging/rt2860/chip/mac_pci.h
index bad04d43ebae..bc704acaa3d7 100644
--- a/drivers/staging/rt3090/mac_pci.h
+++ b/drivers/staging/rt2860/chip/mac_pci.h
@@ -25,7 +25,7 @@
  *************************************************************************
 
     Module Name:
-        mac_pci.h
+	mac_pci.h
 
     Abstract:
 
@@ -37,17 +37,16 @@
 #ifndef __MAC_PCI_H__
 #define __MAC_PCI_H__
 
-#include "rtmp_type.h"
+#include "../rtmp_type.h"
 #include "rtmp_mac.h"
 #include "rtmp_phy.h"
-#include "rtmp_iface.h"
-#include "rtmp_dot11.h"
+#include "../rtmp_iface.h"
+#include "../rtmp_dot11.h"
 
-
-//
-// Device ID & Vendor ID related definitions,
-// NOTE: you should not add the new VendorID/DeviceID here unless you not sure it belongs to what chip.
-//
+/* */
+/* Device ID & Vendor ID related definitions, */
+/* NOTE: you should not add the new VendorID/DeviceID here unless you not sure it belongs to what chip. */
+/* */
 #define NIC_PCI_VENDOR_ID		0x1814
 #define PCIBUS_INTEL_VENDOR	0x8086
 
@@ -61,177 +60,95 @@
 #define PCI_CLASS_BRIDGE_PCI		0x0604
 #endif
 
-
-
-
-
 #define TXINFO_SIZE						0
 #define RTMP_PKT_TAIL_PADDING			0
 #define fRTMP_ADAPTER_NEED_STOP_TX	0
 
 #define AUX_CTRL           0x10c
 
-//
-// TX descriptor format, Tx	ring, Mgmt Ring
-//
-#ifdef RT_BIG_ENDIAN
-typedef	struct	PACKED _TXD_STRUC {
-	// Word 0
-	UINT32		SDPtr0;
-	// Word 1
-	UINT32		DMADONE:1;
-	UINT32		LastSec0:1;
-	UINT32		SDLen0:14;
-	UINT32		Burst:1;
-	UINT32		LastSec1:1;
-	UINT32		SDLen1:14;
-	// Word 2
-	UINT32		SDPtr1;
-	// Word 3
-	UINT32		ICO:1;
-	UINT32		UCO:1;
-	UINT32		TCO:1;
-	UINT32		rsv:2;
-	UINT32		QSEL:2;	// select on-chip FIFO ID for 2nd-stage output scheduler.0:MGMT, 1:HCCA 2:EDCA
-	UINT32		WIV:1;	// Wireless Info Valid. 1 if Driver already fill WI,  o if DMA needs to copy WI to correctposition
-	UINT32		rsv2:24;
-}	TXD_STRUC, *PTXD_STRUC;
-#else
-typedef	struct	PACKED _TXD_STRUC {
-	// Word	0
-	UINT32		SDPtr0;
-	// Word	1
-	UINT32		SDLen1:14;
-	UINT32		LastSec1:1;
-	UINT32		Burst:1;
-	UINT32		SDLen0:14;
-	UINT32		LastSec0:1;
-	UINT32		DMADONE:1;
-	//Word2
-	UINT32		SDPtr1;
-	//Word3
-	UINT32		rsv2:24;
-	UINT32		WIV:1;	// Wireless Info Valid. 1 if Driver already fill WI,  o if DMA needs to copy WI to correctposition
-	UINT32		QSEL:2;	// select on-chip FIFO ID for 2nd-stage output scheduler.0:MGMT, 1:HCCA 2:EDCA
-	UINT32		rsv:2;
-	UINT32		TCO:1;	//
-	UINT32		UCO:1;	//
-	UINT32		ICO:1;	//
-}	TXD_STRUC, *PTXD_STRUC;
-#endif
-
+/* */
+/* TX descriptor format, Tx     ring, Mgmt Ring */
+/* */
+struct PACKED rt_txd {
+	/* Word 0 */
+	u32 SDPtr0;
+	/* Word 1 */
+	u32 SDLen1:14;
+	u32 LastSec1:1;
+	u32 Burst:1;
+	u32 SDLen0:14;
+	u32 LastSec0:1;
+	u32 DMADONE:1;
+	/*Word2 */
+	u32 SDPtr1;
+	/*Word3 */
+	u32 rsv2:24;
+	u32 WIV:1;		/* Wireless Info Valid. 1 if Driver already fill WI,  o if DMA needs to copy WI to correctposition */
+	u32 QSEL:2;		/* select on-chip FIFO ID for 2nd-stage output scheduler.0:MGMT, 1:HCCA 2:EDCA */
+	u32 rsv:2;
+	u32 TCO:1;		/* */
+	u32 UCO:1;		/* */
+	u32 ICO:1;		/* */
+};
+
+/* */
+/* Rx descriptor format, Rx Ring */
+/* */
+typedef struct PACKED rt_rxd {
+	/* Word 0 */
+	u32 SDP0;
+	/* Word 1 */
+	u32 SDL1:14;
+	u32 Rsv:2;
+	u32 SDL0:14;
+	u32 LS0:1;
+	u32 DDONE:1;
+	/* Word 2 */
+	u32 SDP1;
+	/* Word 3 */
+	u32 BA:1;
+	u32 DATA:1;
+	u32 NULLDATA:1;
+	u32 FRAG:1;
+	u32 U2M:1;		/* 1: this RX frame is unicast to me */
+	u32 Mcast:1;		/* 1: this is a multicast frame */
+	u32 Bcast:1;		/* 1: this is a broadcast frame */
+	u32 MyBss:1;		/* 1: this frame belongs to the same BSSID */
+	u32 Crc:1;		/* 1: CRC error */
+	u32 CipherErr:2;	/* 0: decryption okay, 1:ICV error, 2:MIC error, 3:KEY not valid */
+	u32 AMSDU:1;		/* rx with 802.3 header, not 802.11 header. */
+	u32 HTC:1;
+	u32 RSSI:1;
+	u32 L2PAD:1;
+	u32 AMPDU:1;
+	u32 Decrypted:1;	/* this frame is being decrypted. */
+	u32 PlcpSignal:1;	/* To be moved */
+	u32 PlcpRssil:1;	/* To be moved */
+	u32 Rsv1:13;
+} RT28XX_RXD_STRUC, *PRT28XX_RXD_STRUC;
 
-//
-// Rx descriptor format, Rx Ring
-//
-#ifdef RT_BIG_ENDIAN
-typedef	struct	PACKED _RXD_STRUC{
-	// Word 0
-	UINT32		SDP0;
-	// Word 1
-	UINT32		DDONE:1;
-	UINT32		LS0:1;
-	UINT32		SDL0:14;
-	UINT32		Rsv:2;
-	UINT32		SDL1:14;
-	// Word 2
-	UINT32		SDP1;
-	// Word 3
-	UINT32		Rsv1:13;
-	UINT32		PlcpRssil:1;// To be moved
-	UINT32		PlcpSignal:1;		// To be moved
-	UINT32		Decrypted:1;	// this frame is being decrypted.
-	UINT32		AMPDU:1;
-	UINT32		L2PAD:1;
-	UINT32		RSSI:1;
-	UINT32		HTC:1;
-	UINT32		AMSDU:1;		// rx with 802.3 header, not 802.11 header. obsolete.
-	UINT32		CipherErr:2;        // 0: decryption okay, 1:ICV error, 2:MIC error, 3:KEY not valid
-	UINT32		Crc:1;              // 1: CRC error
-	UINT32		MyBss:1;	// 1: this frame belongs to the same BSSID
-	UINT32		Bcast:1;            // 1: this is a broadcast frame
-	UINT32		Mcast:1;            // 1: this is a multicast frame
-	UINT32		U2M:1;              // 1: this RX frame is unicast to me
-	UINT32		FRAG:1;
-	UINT32		NULLDATA:1;
-	UINT32		DATA:1;
-	UINT32		BA:1;
-
-}	RXD_STRUC, *PRXD_STRUC, RT28XX_RXD_STRUC, *PRT28XX_RXD_STRUC;
-#else
-typedef	struct	PACKED _RXD_STRUC{
-	// Word	0
-	UINT32		SDP0;
-	// Word	1
-	UINT32		SDL1:14;
-	UINT32		Rsv:2;
-	UINT32		SDL0:14;
-	UINT32		LS0:1;
-	UINT32		DDONE:1;
-	// Word	2
-	UINT32		SDP1;
-	// Word	3
-	UINT32		BA:1;
-	UINT32		DATA:1;
-	UINT32		NULLDATA:1;
-	UINT32		FRAG:1;
-	UINT32		U2M:1;              // 1: this RX frame is unicast to me
-	UINT32		Mcast:1;            // 1: this is a multicast frame
-	UINT32		Bcast:1;            // 1: this is a broadcast frame
-	UINT32		MyBss:1;	// 1: this frame belongs to the same BSSID
-	UINT32		Crc:1;              // 1: CRC error
-	UINT32		CipherErr:2;        // 0: decryption okay, 1:ICV error, 2:MIC error, 3:KEY not valid
-	UINT32		AMSDU:1;		// rx with 802.3 header, not 802.11 header.
-	UINT32		HTC:1;
-	UINT32		RSSI:1;
-	UINT32		L2PAD:1;
-	UINT32		AMPDU:1;
-	UINT32		Decrypted:1;	// this frame is being decrypted.
-	UINT32		PlcpSignal:1;		// To be moved
-	UINT32		PlcpRssil:1;// To be moved
-	UINT32		Rsv1:13;
-}	RXD_STRUC, *PRXD_STRUC, RT28XX_RXD_STRUC, *PRT28XX_RXD_STRUC;
-#endif
-
-#ifdef BIG_ENDIAN
-typedef union _TX_ATTENUATION_CTRL_STRUC
-{
-	struct
-	{
-		ULONG	Reserve1:20;
-		ULONG	PCIE_PHY_TX_ATTEN_EN:1;
-		ULONG	PCIE_PHY_TX_ATTEN_VALUE:3;
-		ULONG	Reserve2:7;
-		ULONG	RF_ISOLATION_ENABLE:1;
-	} field;
-
-	ULONG	word;
-} TX_ATTENUATION_CTRL_STRUC, *PTX_ATTENUATION_CTRL_STRUC;
-#else
 typedef union _TX_ATTENUATION_CTRL_STRUC {
-	struct
-	{
-		ULONG	RF_ISOLATION_ENABLE:1;
-		ULONG	Reserve2:7;
-		ULONG	PCIE_PHY_TX_ATTEN_VALUE:3;
-		ULONG	PCIE_PHY_TX_ATTEN_EN:1;
-		ULONG	Reserve1:20;
+	struct {
+		unsigned long RF_ISOLATION_ENABLE:1;
+		unsigned long Reserve2:7;
+		unsigned long PCIE_PHY_TX_ATTEN_VALUE:3;
+		unsigned long PCIE_PHY_TX_ATTEN_EN:1;
+		unsigned long Reserve1:20;
 	} field;
 
-	ULONG	word;
+	unsigned long word;
 } TX_ATTENUATION_CTRL_STRUC, *PTX_ATTENUATION_CTRL_STRUC;
-#endif
+
 /* ----------------- EEPROM Related MACRO ----------------- */
 
-// 8051 firmware image for RT2860 - base address = 0x4000
+/* 8051 firmware image for RT2860 - base address = 0x4000 */
 #define FIRMWARE_IMAGE_BASE     0x2000
-#define MAX_FIRMWARE_IMAGE_SIZE 0x2000    // 8kbyte
-
+#define MAX_FIRMWARE_IMAGE_SIZE 0x2000	/* 8kbyte */
 
 /* ----------------- Frimware Related MACRO ----------------- */
 #define RTMP_WRITE_FIRMWARE(_pAd, _pFwImage, _FwLen)			\
 	do{								\
-		ULONG	_i, _firm;					\
+		unsigned long	_i, _firm;					\
 		RTMP_IO_WRITE32(_pAd, PBF_SYS_CTRL, 0x10000);		\
 									\
 		for(_i=0; _i<_FwLen; _i+=4)				\
@@ -250,27 +167,23 @@ typedef union _TX_ATTENUATION_CTRL_STRUC {
 		RTMP_IO_WRITE32(_pAd, H2M_MAILBOX_CSR, 0);		\
 	}while(0)
 
-
 /* ----------------- TX Related MACRO ----------------- */
 #define RTMP_START_DEQUEUE(pAd, QueIdx, irqFlags)		do{}while(0)
 #define RTMP_STOP_DEQUEUE(pAd, QueIdx, irqFlags)		do{}while(0)
 
-
 #define RTMP_HAS_ENOUGH_FREE_DESC(pAd, pTxBlk, freeNum, pPacket) \
-		((freeNum) >= (ULONG)(pTxBlk->TotalFragNum + RTMP_GET_PACKET_FRAGMENTS(pPacket) + 3)) /* rough estimate we will use 3 more descriptor. */
+		((freeNum) >= (unsigned long)(pTxBlk->TotalFragNum + RTMP_GET_PACKET_FRAGMENTS(pPacket) + 3))	/* rough estimate we will use 3 more descriptor. */
 #define RTMP_RELEASE_DESC_RESOURCE(pAd, QueIdx)	\
 		do{}while(0)
 
 #define NEED_QUEUE_BACK_FOR_AGG(pAd, QueIdx, freeNum, _TxFrameType) \
 		(((freeNum != (TX_RING_SIZE-1)) && (pAd->TxSwQueue[QueIdx].Number == 0)) || (freeNum<3))
-		//(((freeNum) != (TX_RING_SIZE-1)) && (pAd->TxSwQueue[QueIdx].Number == 1 /*0*/))
-
 
 #define HAL_KickOutMgmtTx(_pAd, _QueIdx, _pPacket, _pSrcBufVA, _SrcBufLen)	\
 			RtmpPCIMgmtKickOut(_pAd, _QueIdx, _pPacket, _pSrcBufVA, _SrcBufLen)
 
 #define HAL_WriteSubTxResource(pAd, pTxBlk, bIsLast, pFreeNumber)	\
-		/* RtmpPCI_WriteSubTxResource(pAd, pTxBlk, bIsLast, pFreeNumber)*/
+				/* RtmpPCI_WriteSubTxResource(pAd, pTxBlk, bIsLast, pFreeNumber) */
 
 #define HAL_WriteTxResource(pAd, pTxBlk,bIsLast, pFreeNumber)	\
 			RtmpPCI_WriteSingleTxResource(pAd, pTxBlk, bIsLast, pFreeNumber)
@@ -285,7 +198,7 @@ typedef union _TX_ATTENUATION_CTRL_STRUC {
 			RtmpPCI_FinalWriteTxResource(_pAd, _pTxBlk, _TotalMPDUSize, _FirstTxIdx)
 
 #define HAL_LastTxIdx(_pAd, _QueIdx,_LastTxIdx) \
-			/*RtmpPCIDataLastTxIdx(_pAd, _QueIdx,_LastTxIdx)*/
+				/*RtmpPCIDataLastTxIdx(_pAd, _QueIdx,_LastTxIdx) */
 
 #define HAL_KickOutTx(_pAd, _pTxBlk, _QueIdx)	\
 			RTMP_IO_WRITE32((_pAd), TX_CTX_IDX0+((_QueIdx)*0x10), (_pAd)->TxRing[(_QueIdx)].TxCpuIdx)
@@ -300,37 +213,34 @@ typedef union _TX_ATTENUATION_CTRL_STRUC {
 			 :	\
 			(_pAd->TxRing[_QueIdx].TxSwFreeIdx + TX_RING_SIZE - _pAd->TxRing[_QueIdx].TxCpuIdx - 1);
 
-
 #define GET_MGMTRING_FREENO(_pAd) \
 	(_pAd->MgmtRing.TxSwFreeIdx > _pAd->MgmtRing.TxCpuIdx)	? \
 			(_pAd->MgmtRing.TxSwFreeIdx - _pAd->MgmtRing.TxCpuIdx - 1) \
 			 :	\
 			(_pAd->MgmtRing.TxSwFreeIdx + MGMT_RING_SIZE - _pAd->MgmtRing.TxCpuIdx - 1);
 
-
 /* ----------------- RX Related MACRO ----------------- */
 
-
 /* ----------------- ASIC Related MACRO ----------------- */
-// reset MAC of a station entry to 0x000000000000
+/* reset MAC of a station entry to 0x000000000000 */
 #define RTMP_STA_ENTRY_MAC_RESET(pAd, Wcid)	\
 	AsicDelWcidTab(pAd, Wcid);
 
-// add this entry into ASIC RX WCID search table
+/* add this entry into ASIC RX WCID search table */
 #define RTMP_STA_ENTRY_ADD(pAd, pEntry)		\
 	AsicUpdateRxWCIDTable(pAd, pEntry->Aid, pEntry->Addr);
 
-// add by johnli, fix "in_interrupt" error when call "MacTableDeleteEntry" in Rx tasklet
-// Set MAC register value according operation mode
+/* add by johnli, fix "in_interrupt" error when call "MacTableDeleteEntry" in Rx tasklet */
+/* Set MAC register value according operation mode */
 #define RTMP_UPDATE_PROTECT(pAd)	\
 	AsicUpdateProtect(pAd, 0, (ALLN_SETPROTECT), TRUE, 0);
-// end johnli
+/* end johnli */
 
-// remove Pair-wise key material from ASIC
+/* remove Pair-wise key material from ASIC */
 #define RTMP_STA_ENTRY_KEY_DEL(pAd, BssIdx, Wcid)	\
-	AsicRemovePairwiseKeyEntry(pAd, BssIdx, (UCHAR)Wcid);
+	AsicRemovePairwiseKeyEntry(pAd, BssIdx, (u8)Wcid);
 
-// add Client security information into ASIC WCID table and IVEIV table
+/* add Client security information into ASIC WCID table and IVEIV table */
 #define RTMP_STA_SECURITY_INFO_ADD(pAd, apidx, KeyID, pEntry)		\
 	RTMPAddWcidAttributeEntry(pAd, apidx, KeyID,			\
 							pAd->SharedKey[apidx][KeyID].CipherAlg, pEntry);
@@ -347,36 +257,33 @@ typedef union _TX_ATTENUATION_CTRL_STRUC {
 						  pAd->SharedKey[apidx][KeyID].CipherAlg,		\
 						  pEntry); }
 
-
-// Insert the BA bitmap to ASIC for the Wcid entry
+/* Insert the BA bitmap to ASIC for the Wcid entry */
 #define RTMP_ADD_BA_SESSION_TO_ASIC(_pAd, _Aid, _TID)	\
 		do{					\
-			UINT32	_Value = 0, _Offset;					\
+			u32 _Value = 0, _Offset;					\
 			_Offset = MAC_WCID_BASE + (_Aid) * HW_WCID_ENTRY_SIZE + 4;	\
 			RTMP_IO_READ32((_pAd), _Offset, &_Value);\
 			_Value |= (0x10000<<(_TID));	\
 			RTMP_IO_WRITE32((_pAd), _Offset, _Value);\
 		}while(0)
 
-
-// Remove the BA bitmap from ASIC for the Wcid entry
-//		bitmap field starts at 0x10000 in ASIC WCID table
+/* Remove the BA bitmap from ASIC for the Wcid entry */
+/*              bitmap field starts at 0x10000 in ASIC WCID table */
 #define RTMP_DEL_BA_SESSION_FROM_ASIC(_pAd, _Wcid, _TID)				\
 		do{								\
-			UINT32	_Value = 0, _Offset;				\
+			u32 _Value = 0, _Offset;				\
 			_Offset = MAC_WCID_BASE + (_Wcid) * HW_WCID_ENTRY_SIZE + 4;	\
 			RTMP_IO_READ32((_pAd), _Offset, &_Value);			\
 			_Value &= (~(0x10000 << (_TID)));				\
 			RTMP_IO_WRITE32((_pAd), _Offset, _Value);			\
 		}while(0)
 
-
 /* ----------------- Interface Related MACRO ----------------- */
 
-//
-// Enable & Disable NIC interrupt via writing interrupt mask register
-// Since it use ADAPTER structure, it have to be put after structure definition.
-//
+/* */
+/* Enable & Disable NIC interrupt via writing interrupt mask register */
+/* Since it use ADAPTER structure, it have to be put after structure definition. */
+/* */
 #define RTMP_ASIC_INTERRUPT_DISABLE(_pAd)		\
 	do{			\
 		RTMP_IO_WRITE32((_pAd), INT_MASK_CSR, 0x0);     /* 0: disable */	\
@@ -389,7 +296,6 @@ typedef union _TX_ATTENUATION_CTRL_STRUC {
 		RTMP_SET_FLAG((_pAd), fRTMP_ADAPTER_INTERRUPT_ACTIVE);	\
 	}while(0)
 
-
 #define RTMP_IRQ_INIT(pAd)	\
 	{	pAd->int_enable_reg = ((DELAYINTMASK) |		\
 					(RxINT|TxDataInt|TxMgmtInt)) & ~(0x03);	\
@@ -401,7 +307,6 @@ typedef union _TX_ATTENUATION_CTRL_STRUC {
 		RTMP_IO_WRITE32(pAd, INT_SOURCE_CSR, 0xffffffff);\
 		RTMP_ASIC_INTERRUPT_ENABLE(pAd); }
 
-
 /* ----------------- MLME Related MACRO ----------------- */
 #define RTMP_MLME_HANDLER(pAd)			MlmeHandler(pAd)
 
@@ -419,8 +324,7 @@ typedef union _TX_ATTENUATION_CTRL_STRUC {
 /* ----------------- Power Save Related MACRO ----------------- */
 #define RTMP_PS_POLL_ENQUEUE(pAd)				EnqueuePsPoll(pAd)
 
-
-// For RTMPPCIePowerLinkCtrlRestore () function
+/* For RTMPPCIePowerLinkCtrlRestore () function */
 #define RESTORE_HALT		1
 #define RESTORE_WAKEUP		2
 #define RESTORE_CLOSE           3
@@ -433,8 +337,6 @@ typedef union _TX_ATTENUATION_CTRL_STRUC {
 #define CID2MASK		0x00ff0000
 #define CID3MASK		0xff000000
 
-
-#ifdef CONFIG_STA_SUPPORT
 #define RTMP_STA_FORCE_WAKEUP(pAd, bFromTx) \
     RT28xxPciStaAsicForceWakeup(pAd, bFromTx);
 
@@ -443,7 +345,6 @@ typedef union _TX_ATTENUATION_CTRL_STRUC {
 
 #define RTMP_SET_PSM_BIT(_pAd, _val) \
 	MlmeSetPsmBit(_pAd, _val);
-#endif // CONFIG_STA_SUPPORT //
 
 #define RTMP_MLME_RADIO_ON(pAd) \
     RT28xxPciMlmeRadioOn(pAd);
@@ -451,4 +352,4 @@ typedef union _TX_ATTENUATION_CTRL_STRUC {
 #define RTMP_MLME_RADIO_OFF(pAd) \
     RT28xxPciMlmeRadioOFF(pAd);
 
-#endif //__MAC_PCI_H__ //
+#endif /*__MAC_PCI_H__ // */
diff --git a/drivers/staging/rt2860/chip/mac_usb.h b/drivers/staging/rt2860/chip/mac_usb.h
new file mode 100644
index 000000000000..0b67c0b1de03
--- /dev/null
+++ b/drivers/staging/rt2860/chip/mac_usb.h
@@ -0,0 +1,347 @@
+/*
+ *************************************************************************
+ * Ralink Tech Inc.
+ * 5F., No.36, Taiyuan St., Jhubei City,
+ * Hsinchu County 302,
+ * Taiwan, R.O.C.
+ *
+ * (c) Copyright 2002-2007, Ralink Technology, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify  *
+ * it under the terms of the GNU General Public License as published by  *
+ * the Free Software Foundation; either version 2 of the License, or     *
+ * (at your option) any later version.                                   *
+ *                                                                       *
+ * This program is distributed in the hope that it will be useful,       *
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
+ * GNU General Public License for more details.                          *
+ *                                                                       *
+ * You should have received a copy of the GNU General Public License     *
+ * along with this program; if not, write to the                         *
+ * Free Software Foundation, Inc.,                                       *
+ * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
+ *                                                                       *
+ *************************************************************************
+
+    Module Name:
+        mac_usb.h
+
+    Abstract:
+
+    Revision History:
+    Who          When          What
+    ---------    ----------    ----------------------------------------------
+ */
+
+#ifndef __MAC_USB_H__
+#define __MAC_USB_H__
+
+#include "../rtmp_type.h"
+#include "rtmp_mac.h"
+#include "rtmp_phy.h"
+#include "../rtmp_iface.h"
+#include "../rtmp_dot11.h"
+
+#define USB_CYC_CFG				0x02a4
+
+#define BEACON_RING_SIZE		2
+#define MGMTPIPEIDX				0	/* EP6 is highest priority */
+
+#define RTMP_PKT_TAIL_PADDING	11	/* 3(max 4 byte padding) + 4 (last packet padding) + 4 (MaxBulkOutsize align padding) */
+
+#define fRTMP_ADAPTER_NEED_STOP_TX		\
+		(fRTMP_ADAPTER_NIC_NOT_EXIST | fRTMP_ADAPTER_HALT_IN_PROGRESS |	\
+		 fRTMP_ADAPTER_RESET_IN_PROGRESS | fRTMP_ADAPTER_BULKOUT_RESET | \
+		 fRTMP_ADAPTER_RADIO_OFF | fRTMP_ADAPTER_REMOVE_IN_PROGRESS)
+
+/* */
+/* RXINFO appends at the end of each rx packet. */
+/* */
+#define RXINFO_SIZE				4
+#define RT2870_RXDMALEN_FIELD_SIZE	4
+
+typedef struct PACKED rt_rxinfo {
+	u32 BA:1;
+	u32 DATA:1;
+	u32 NULLDATA:1;
+	u32 FRAG:1;
+	u32 U2M:1;		/* 1: this RX frame is unicast to me */
+	u32 Mcast:1;		/* 1: this is a multicast frame */
+	u32 Bcast:1;		/* 1: this is a broadcast frame */
+	u32 MyBss:1;		/* 1: this frame belongs to the same BSSID */
+	u32 Crc:1;		/* 1: CRC error */
+	u32 CipherErr:2;	/* 0: decryption okay, 1:ICV error, 2:MIC error, 3:KEY not valid */
+	u32 AMSDU:1;		/* rx with 802.3 header, not 802.11 header. */
+	u32 HTC:1;
+	u32 RSSI:1;
+	u32 L2PAD:1;
+	u32 AMPDU:1;		/* To be moved */
+	u32 Decrypted:1;
+	u32 PlcpRssil:1;
+	u32 CipherAlg:1;
+	u32 LastAMSDU:1;
+	u32 PlcpSignal:12;
+} RT28XX_RXD_STRUC, *PRT28XX_RXD_STRUC;
+
+/* */
+/* TXINFO */
+/* */
+#define TXINFO_SIZE				4
+
+struct rt_txinfo {
+	/* Word 0 */
+	u32 USBDMATxPktLen:16;	/*used ONLY in USB bulk Aggregation,  Total byte counts of all sub-frame. */
+	u32 rsv:8;
+	u32 WIV:1;		/* Wireless Info Valid. 1 if Driver already fill WI,  o if DMA needs to copy WI to correctposition */
+	u32 QSEL:2;		/* select on-chip FIFO ID for 2nd-stage output scheduler.0:MGMT, 1:HCCA 2:EDCA */
+	u32 SwUseLastRound:1;	/* Software use. */
+	u32 rsv2:2;		/* Software use. */
+	u32 USBDMANextVLD:1;	/*used ONLY in USB bulk Aggregation, NextValid */
+	u32 USBDMATxburst:1;	/*used ONLY in USB bulk Aggre. Force USB DMA transmit frame from current selected endpoint */
+};
+
+/* */
+/* Management ring buffer format */
+/* */
+struct rt_mgmt {
+	BOOLEAN Valid;
+	u8 *pBuffer;
+	unsigned long Length;
+};
+
+/*////////////////////////////////////////////////////////////////////////// */
+/* The struct rt_tx_buffer structure forms the transmitted USB packet to the device */
+/*////////////////////////////////////////////////////////////////////////// */
+struct rt_tx_buffer {
+	union {
+		u8 WirelessPacket[TX_BUFFER_NORMSIZE];
+		struct rt_header_802_11 NullFrame;
+		struct rt_pspoll_frame PsPollPacket;
+		struct rt_rts_frame RTSFrame;
+	} field;
+	u8 Aggregation[4];	/*Buffer for save Aggregation size. */
+};
+
+struct rt_httx_buffer {
+	union {
+		u8 WirelessPacket[MAX_TXBULK_SIZE];
+		struct rt_header_802_11 NullFrame;
+		struct rt_pspoll_frame PsPollPacket;
+		struct rt_rts_frame RTSFrame;
+	} field;
+	u8 Aggregation[4];	/*Buffer for save Aggregation size. */
+};
+
+/* used to track driver-generated write irps */
+struct rt_tx_context {
+	void *pAd;		/*Initialized in MiniportInitialize */
+	PURB pUrb;		/*Initialized in MiniportInitialize */
+	PIRP pIrp;		/*used to cancel pending bulk out. */
+	/*Initialized in MiniportInitialize */
+	struct rt_tx_buffer *TransferBuffer;	/*Initialized in MiniportInitialize */
+	unsigned long BulkOutSize;
+	u8 BulkOutPipeId;
+	u8 SelfIdx;
+	BOOLEAN InUse;
+	BOOLEAN bWaitingBulkOut;	/* at least one packet is in this TxContext, ready for making IRP anytime. */
+	BOOLEAN bFullForBulkOut;	/* all tx buffer are full , so waiting for tx bulkout. */
+	BOOLEAN IRPPending;
+	BOOLEAN LastOne;
+	BOOLEAN bAggregatible;
+	u8 Header_802_3[LENGTH_802_3];
+	u8 Rsv[2];
+	unsigned long DataOffset;
+	u32 TxRate;
+	dma_addr_t data_dma;	/* urb dma on linux */
+
+};
+
+/* used to track driver-generated write irps */
+struct rt_ht_tx_context {
+	void *pAd;		/*Initialized in MiniportInitialize */
+	PURB pUrb;		/*Initialized in MiniportInitialize */
+	PIRP pIrp;		/*used to cancel pending bulk out. */
+	/*Initialized in MiniportInitialize */
+	struct rt_httx_buffer *TransferBuffer;	/*Initialized in MiniportInitialize */
+	unsigned long BulkOutSize;	/* Indicate the total bulk-out size in bytes in one bulk-transmission */
+	u8 BulkOutPipeId;
+	BOOLEAN IRPPending;
+	BOOLEAN LastOne;
+	BOOLEAN bCurWriting;
+	BOOLEAN bRingEmpty;
+	BOOLEAN bCopySavePad;
+	u8 SavedPad[8];
+	u8 Header_802_3[LENGTH_802_3];
+	unsigned long CurWritePosition;	/* Indicate the buffer offset which packet will be inserted start from. */
+	unsigned long CurWriteRealPos;	/* Indicate the buffer offset which packet now are writing to. */
+	unsigned long NextBulkOutPosition;	/* Indicate the buffer start offset of a bulk-transmission */
+	unsigned long ENextBulkOutPosition;	/* Indicate the buffer end offset of a bulk-transmission */
+	u32 TxRate;
+	dma_addr_t data_dma;	/* urb dma on linux */
+};
+
+/* */
+/* Structure to keep track of receive packets and buffers to indicate */
+/* receive data to the protocol. */
+/* */
+struct rt_rx_context {
+	u8 *TransferBuffer;
+	void *pAd;
+	PIRP pIrp;		/*used to cancel pending bulk in. */
+	PURB pUrb;
+	/*These 2 Boolean shouldn't both be 1 at the same time. */
+	unsigned long BulkInOffset;	/* number of packets waiting for reordering . */
+/*      BOOLEAN                         ReorderInUse;   // At least one packet in this buffer are in reordering buffer and wait for receive indication */
+	BOOLEAN bRxHandling;	/* Notify this packet is being process now. */
+	BOOLEAN InUse;		/* USB Hardware Occupied. Wait for USB HW to put packet. */
+	BOOLEAN Readable;	/* Receive Complete back. OK for driver to indicate receiving packet. */
+	BOOLEAN IRPPending;	/* TODO: To be removed */
+	atomic_t IrpLock;
+	spinlock_t RxContextLock;
+	dma_addr_t data_dma;	/* urb dma on linux */
+};
+
+/******************************************************************************
+
+	USB Frimware Related MACRO
+
+******************************************************************************/
+/* 8051 firmware image for usb - use last-half base address = 0x3000 */
+#define FIRMWARE_IMAGE_BASE			0x3000
+#define MAX_FIRMWARE_IMAGE_SIZE		0x1000	/* 4kbyte */
+
+#define RTMP_WRITE_FIRMWARE(_pAd, _pFwImage, _FwLen)		\
+	RTUSBFirmwareWrite(_pAd, _pFwImage, _FwLen)
+
+/******************************************************************************
+
+	USB TX Related MACRO
+
+******************************************************************************/
+#define RTMP_START_DEQUEUE(pAd, QueIdx, irqFlags)				\
+			do{													\
+				RTMP_IRQ_LOCK(&pAd->DeQueueLock[QueIdx], irqFlags);		\
+				if (pAd->DeQueueRunning[QueIdx])						\
+				{														\
+					RTMP_IRQ_UNLOCK(&pAd->DeQueueLock[QueIdx], irqFlags);\
+					DBGPRINT(RT_DEBUG_OFF, ("DeQueueRunning[%d]= TRUE!\n", QueIdx));		\
+					continue;											\
+				}														\
+				else													\
+				{														\
+					pAd->DeQueueRunning[QueIdx] = TRUE;					\
+					RTMP_IRQ_UNLOCK(&pAd->DeQueueLock[QueIdx], irqFlags);\
+				}														\
+			}while(0)
+
+#define RTMP_STOP_DEQUEUE(pAd, QueIdx, irqFlags)						\
+			do{															\
+				RTMP_IRQ_LOCK(&pAd->DeQueueLock[QueIdx], irqFlags);		\
+				pAd->DeQueueRunning[QueIdx] = FALSE;					\
+				RTMP_IRQ_UNLOCK(&pAd->DeQueueLock[QueIdx], irqFlags);	\
+			}while(0)
+
+#define	RTMP_HAS_ENOUGH_FREE_DESC(pAd, pTxBlk, freeNum, pPacket) \
+		(RTUSBFreeDescriptorRequest(pAd, pTxBlk->QueIdx, (pTxBlk->TotalFrameLen + GET_OS_PKT_LEN(pPacket))) == NDIS_STATUS_SUCCESS)
+
+#define RTMP_RELEASE_DESC_RESOURCE(pAd, QueIdx)			\
+		do{}while(0)
+
+#define NEED_QUEUE_BACK_FOR_AGG(_pAd, _QueIdx, _freeNum, _TxFrameType)		\
+		((_TxFrameType == TX_RALINK_FRAME) && (RTUSBNeedQueueBackForAgg(_pAd, _QueIdx)))
+
+#define HAL_WriteSubTxResource(pAd, pTxBlk, bIsLast, pFreeNumber)	\
+			RtmpUSB_WriteSubTxResource(pAd, pTxBlk, bIsLast, pFreeNumber)
+
+#define HAL_WriteTxResource(pAd, pTxBlk,bIsLast, pFreeNumber)	\
+			RtmpUSB_WriteSingleTxResource(pAd, pTxBlk,bIsLast, pFreeNumber)
+
+#define HAL_WriteFragTxResource(pAd, pTxBlk, fragNum, pFreeNumber) \
+			RtmpUSB_WriteFragTxResource(pAd, pTxBlk, fragNum, pFreeNumber)
+
+#define HAL_WriteMultiTxResource(pAd, pTxBlk,frameNum, pFreeNumber)	\
+			RtmpUSB_WriteMultiTxResource(pAd, pTxBlk,frameNum, pFreeNumber)
+
+#define HAL_FinalWriteTxResource(pAd, pTxBlk, totalMPDUSize, TxIdx)	\
+			RtmpUSB_FinalWriteTxResource(pAd, pTxBlk, totalMPDUSize, TxIdx)
+
+#define HAL_LastTxIdx(pAd, QueIdx,TxIdx) \
+				/*RtmpUSBDataLastTxIdx(pAd, QueIdx,TxIdx) */
+
+#define HAL_KickOutTx(pAd, pTxBlk, QueIdx)	\
+			RtmpUSBDataKickOut(pAd, pTxBlk, QueIdx)
+
+#define HAL_KickOutMgmtTx(pAd, QueIdx, pPacket, pSrcBufVA, SrcBufLen)	\
+			RtmpUSBMgmtKickOut(pAd, QueIdx, pPacket, pSrcBufVA, SrcBufLen)
+
+#define HAL_KickOutNullFrameTx(_pAd, _QueIdx, _pNullFrame, _frameLen)	\
+			RtmpUSBNullFrameKickOut(_pAd, _QueIdx, _pNullFrame, _frameLen)
+
+#define GET_TXRING_FREENO(_pAd, _QueIdx)	(_QueIdx)	/*(_pAd->TxRing[_QueIdx].TxSwFreeIdx) */
+#define GET_MGMTRING_FREENO(_pAd)			(_pAd->MgmtRing.TxSwFreeIdx)
+
+/* ----------------- RX Related MACRO ----------------- */
+
+/*
+  *	Device Hardware Interface Related MACRO
+  */
+#define RTMP_IRQ_INIT(pAd)				do{}while(0)
+#define RTMP_IRQ_ENABLE(pAd)			do{}while(0)
+
+/*
+  *	MLME Related MACRO
+  */
+#define RTMP_MLME_HANDLER(pAd)			RTUSBMlmeUp(pAd)
+
+#define RTMP_MLME_PRE_SANITY_CHECK(pAd)								\
+	{	if ((pAd->CommonCfg.bHardwareRadio == TRUE) &&					\
+			(!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)) &&		\
+			(!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS))) {	\
+			RTUSBEnqueueInternalCmd(pAd, CMDTHREAD_CHECK_GPIO, NULL, 0); } }
+
+#define RTMP_MLME_STA_QUICK_RSP_WAKE_UP(pAd)	\
+	{	RTUSBEnqueueInternalCmd(pAd, CMDTHREAD_QKERIODIC_EXECUT, NULL, 0);	\
+		RTUSBMlmeUp(pAd); }
+
+#define RTMP_MLME_RESET_STATE_MACHINE(pAd)	\
+		        MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_RESET_CONF, 0, NULL);	\
+		        RTUSBMlmeUp(pAd);
+
+#define RTMP_HANDLE_COUNTER_MEASURE(_pAd, _pEntry)		\
+	{	RTUSBEnqueueInternalCmd(_pAd, CMDTHREAD_802_11_COUNTER_MEASURE, _pEntry, sizeof(struct rt_mac_table_entry));	\
+		RTUSBMlmeUp(_pAd);									\
+	}
+
+/*
+  *	Power Save Related MACRO
+  */
+#define RTMP_PS_POLL_ENQUEUE(pAd)						\
+	{	RTUSB_SET_BULK_FLAG(pAd, fRTUSB_BULK_OUT_PSPOLL);	\
+		RTUSBKickBulkOut(pAd); }
+
+#define RTMP_STA_FORCE_WAKEUP(_pAd, bFromTx) \
+	RT28xxUsbStaAsicForceWakeup(_pAd, bFromTx);
+
+#define RTMP_STA_SLEEP_THEN_AUTO_WAKEUP(pAd, TbttNumToNextWakeUp) \
+    RT28xxUsbStaAsicSleepThenAutoWakeup(pAd, TbttNumToNextWakeUp);
+
+#define RTMP_SET_PSM_BIT(_pAd, _val) \
+	{\
+		if ((_pAd)->StaCfg.WindowsPowerMode == Ndis802_11PowerModeFast_PSP) \
+			MlmeSetPsmBit(_pAd, _val);\
+		else \
+		{ \
+			u16 _psm_val; \
+			_psm_val = _val; \
+			RTUSBEnqueueInternalCmd(_pAd, CMDTHREAD_SET_PSM_BIT, &(_psm_val), sizeof(u16)); \
+		}\
+	}
+
+#define RTMP_MLME_RADIO_ON(pAd) \
+    RT28xxUsbMlmeRadioOn(pAd);
+
+#define RTMP_MLME_RADIO_OFF(pAd) \
+    RT28xxUsbMlmeRadioOFF(pAd);
+
+#endif /*__MAC_USB_H__ // */
diff --git a/drivers/staging/rt3090/netif_block.h b/drivers/staging/rt2860/chip/rt2860.h
index 9e753894f294..f30b80820b92 100644
--- a/drivers/staging/rt3090/netif_block.h
+++ b/drivers/staging/rt2860/chip/rt2860.h
@@ -25,32 +25,30 @@
  *************************************************************************
  */
 
-#ifndef __NET_IF_BLOCK_H__
-#define __NET_IF_BLOCK_H__
+#ifndef __RT2860_H__
+#define __RT2860_H__
 
-#include "link_list.h"
-#include "rtmp.h"
+#include "mac_pci.h"
 
-#define FREE_NETIF_POOL_SIZE 32
+#ifndef RTMP_PCI_SUPPORT
+#error "For RT2860, you should define the compile flag -DRTMP_PCI_SUPPORT"
+#endif
 
-typedef struct _NETIF_ENTRY
-{
-	struct _NETIF_ENTRY *pNext;
-	PNET_DEV pNetDev;
-} NETIF_ENTRY, *PNETIF_ENTRY;
+#ifndef RTMP_MAC_PCI
+#error "For RT2880, you should define the compile flag -DRTMP_MAC_PCI"
+#endif
 
-void initblockQueueTab(
-	IN PRTMP_ADAPTER pAd);
+/* */
+/* Device ID & Vendor ID, these values should match EEPROM value */
+/* */
+#define NIC2860_PCI_DEVICE_ID	0x0601
+#define NIC2860_PCIe_DEVICE_ID	0x0681
+#define NIC2760_PCI_DEVICE_ID	0x0701	/* 1T/2R Cardbus ??? */
+#define NIC2790_PCIe_DEVICE_ID  0x0781	/* 1T/2R miniCard */
 
-BOOLEAN blockNetIf(
-	IN PBLOCK_QUEUE_ENTRY pBlockQueueEntry,
-	IN PNET_DEV pNetDev);
+#define VEN_AWT_PCIe_DEVICE_ID	0x1059
+#define VEN_AWT_PCI_VENDOR_ID		0x1A3B
 
-VOID releaseNetIf(
-	IN PBLOCK_QUEUE_ENTRY pBlockQueueEntry);
+#define EDIMAX_PCI_VENDOR_ID		0x1432
 
-VOID StopNetIfQueue(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR QueIdx,
-	IN PNDIS_PACKET pPacket);
-#endif // __NET_IF_BLOCK_H__
+#endif /*__RT2860_H__ // */
diff --git a/drivers/staging/rt3090/rt33xx.h b/drivers/staging/rt2860/chip/rt2870.h
index 6eb938860b77..8263f1baefae 100644
--- a/drivers/staging/rt3090/rt33xx.h
+++ b/drivers/staging/rt2860/chip/rt2870.h
@@ -23,26 +23,24 @@
  * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
  *                                                                       *
  *************************************************************************
-
-    Module Name:
-    rt33xx.h
-
-    Abstract:
-
-    Revision History:
-    Who          When          What
-    ---------    ----------    ----------------------------------------------
  */
+#ifndef __RT2870_H__
+#define __RT2870_H__
 
-#ifndef __RT33XX_H__
-#define __RT33XX_H__
+#ifdef RT2870
 
-#ifdef RT33xx
+#ifndef RTMP_USB_SUPPORT
+#error "For RT2870, you should define the compile flag -DRTMP_USB_SUPPORT"
+#endif
 
+#ifndef RTMP_MAC_USB
+#error "For RT2870, you should define the compile flag -DRTMP_MAC_USB"
+#endif
 
-extern REG_PAIR RFRegTableOverRT3390[];
-extern UCHAR NUM_RF_REG_PARMS_OVER_RT3390;
+#include "../rtmp_type.h"
+#include "mac_usb.h"
 
-#endif // RT33xx //
+/*#define RTMP_CHIP_NAME                "RT2870" */
 
-#endif //__RT33XX_H__ //
+#endif /* RT2870 // */
+#endif /*__RT2870_H__ // */
diff --git a/drivers/staging/rt3090/rt3370.h b/drivers/staging/rt2860/chip/rt3070.h
index bfa9006d059a..172ce7054233 100644
--- a/drivers/staging/rt3090/rt3370.h
+++ b/drivers/staging/rt2860/chip/rt3070.h
@@ -25,7 +25,7 @@
  *************************************************************************
 
     Module Name:
-    rt3370.h
+	rt3070.h
 
     Abstract:
 
@@ -34,31 +34,34 @@
     ---------    ----------    ----------------------------------------------
  */
 
-#ifndef __RT3370_H__
-#define __RT3370_H__
-
-#ifdef RT3370
+#ifndef __RT3070_H__
+#define __RT3070_H__
 
+#ifdef RT3070
 
+#ifndef RTMP_USB_SUPPORT
 #error "For RT3070, you should define the compile flag -DRTMP_USB_SUPPORT"
+#endif
 
+#ifndef RTMP_MAC_USB
 #error "For RT3070, you should define the compile flag -DRTMP_MAC_USB"
+#endif
 
 #ifndef RTMP_RF_RW_SUPPORT
 #error "For RT3070, you should define the compile flag -DRTMP_RF_RW_SUPPORT"
 #endif
 
-#ifndef RT33xx
+#ifndef RT30xx
 #error "For RT3070, you should define the compile flag -DRT30xx"
 #endif
 
 #include "mac_usb.h"
-#include "rt33xx.h"
+#include "rt30xx.h"
 
-//
-// Device ID & Vendor ID, these values should match EEPROM value
-//
+/* */
+/* Device ID & Vendor ID, these values should match EEPROM value */
+/* */
 
-#endif // RT3370 //
+#endif /* RT3070 // */
 
-#endif //__RT3370_H__ //
+#endif /*__RT3070_H__ // */
diff --git a/drivers/staging/rt3090/rt3090.h b/drivers/staging/rt2860/chip/rt3090.h
index d325cb028c05..102b938e74bd 100644
--- a/drivers/staging/rt3090/rt3090.h
+++ b/drivers/staging/rt2860/chip/rt3090.h
@@ -55,23 +55,18 @@
 #error "For RT3090, you should define the compile flag -DRT30xx"
 #endif
 
-#ifdef CARRIER_DETECTION_SUPPORT
-#define TONE_RADAR_DETECT_SUPPORT
-#define CARRIER_SENSE_NEW_ALGO
-#endif // CARRIER_DETECTION_SUPPORT //
-
 #define PCIE_PS_SUPPORT
 
 #include "mac_pci.h"
 #include "rt30xx.h"
 
-//
-// Device ID & Vendor ID, these values should match EEPROM value
-//
-#define NIC3090_PCIe_DEVICE_ID  0x3090		// 1T/1R miniCard
-#define NIC3091_PCIe_DEVICE_ID  0x3091		// 1T/2R miniCard
-#define NIC3092_PCIe_DEVICE_ID  0x3092		// 2T/2R miniCard
+/* */
+/* Device ID & Vendor ID, these values should match EEPROM value */
+/* */
+#define NIC3090_PCIe_DEVICE_ID  0x3090	/* 1T/1R miniCard */
+#define NIC3091_PCIe_DEVICE_ID  0x3091	/* 1T/2R miniCard */
+#define NIC3092_PCIe_DEVICE_ID  0x3092	/* 2T/2R miniCard */
 
-#endif // RT3090 //
+#endif /* RT3090 // */
 
-#endif //__RT3090_H__ //
+#endif /*__RT3090_H__ // */
diff --git a/drivers/staging/rt3090/rt30xx.h b/drivers/staging/rt2860/chip/rt30xx.h
index 70971a062607..02e1d728fb41 100644
--- a/drivers/staging/rt3090/rt30xx.h
+++ b/drivers/staging/rt2860/chip/rt30xx.h
@@ -39,10 +39,9 @@
 
 #ifdef RT30xx
 
+extern struct rt_reg_pair RT30xx_RFRegTable[];
+extern u8 NUM_RF_REG_PARMS;
 
-extern REG_PAIR RT30xx_RFRegTable[];
-extern UCHAR NUM_RF_REG_PARMS;
+#endif /* RT30xx // */
 
-#endif // RT30xx //
-
-#endif //__RT30XX_H__ //
+#endif /*__RT30XX_H__ // */
diff --git a/drivers/staging/rt2860/chip/rtmp_mac.h b/drivers/staging/rt2860/chip/rtmp_mac.h
new file mode 100644
index 000000000000..f6a72581d3bd
--- /dev/null
+++ b/drivers/staging/rt2860/chip/rtmp_mac.h
@@ -0,0 +1,1307 @@
+/*
+ *************************************************************************
+ * Ralink Tech Inc.
+ * 5F., No.36, Taiyuan St., Jhubei City,
+ * Hsinchu County 302,
+ * Taiwan, R.O.C.
+ *
+ * (c) Copyright 2002-2007, Ralink Technology, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify  *
+ * it under the terms of the GNU General Public License as published by  *
+ * the Free Software Foundation; either version 2 of the License, or     *
+ * (at your option) any later version.                                   *
+ *                                                                       *
+ * This program is distributed in the hope that it will be useful,       *
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
+ * GNU General Public License for more details.                          *
+ *                                                                       *
+ * You should have received a copy of the GNU General Public License     *
+ * along with this program; if not, write to the                         *
+ * Free Software Foundation, Inc.,                                       *
+ * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
+ *                                                                       *
+ *************************************************************************
+
+	Module Name:
+	rtmp_mac.h
+
+	Abstract:
+	Ralink Wireless Chip MAC related definition & structures
+
+	Revision History:
+	Who			When		  What
+	--------	----------	  ----------------------------------------------
+*/
+
+#ifndef __RTMP_MAC_H__
+#define __RTMP_MAC_H__
+
+/* ================================================================================= */
+/* TX / RX ring descriptor format */
+/* ================================================================================= */
+
+/* the first 24-byte in TXD is called TXINFO and will be DMAed to MAC block through TXFIFO. */
+/* MAC block use this TXINFO to control the transmission behavior of this frame. */
+#define FIFO_MGMT                 0
+#define FIFO_HCCA                 1
+#define FIFO_EDCA                 2
+
+/* */
+/* TXD Wireless Information format for Tx ring and Mgmt Ring */
+/* */
+/*txop : for txop mode */
+/* 0:txop for the MPDU frame will be handles by ASIC by register */
+/* 1/2/3:the MPDU frame is send after PIFS/backoff/SIFS */
+struct PACKED rt_txwi {
+	/* Word 0 */
+	/* ex: 00 03 00 40 means txop = 3, PHYMODE = 1 */
+	u32 FRAG:1;		/* 1 to inform TKIP engine this is a fragment. */
+	u32 MIMOps:1;	/* the remote peer is in dynamic MIMO-PS mode */
+	u32 CFACK:1;
+	u32 TS:1;
+
+	u32 AMPDU:1;
+	u32 MpduDensity:3;
+	u32 txop:2;		/*FOR "THIS" frame. 0:HT TXOP rule , 1:PIFS TX ,2:Backoff, 3:sifs only when previous frame exchange is successful. */
+	u32 rsv:6;
+
+	u32 MCS:7;
+	u32 BW:1;		/*channel bandwidth 20MHz or 40 MHz */
+	u32 ShortGI:1;
+	u32 STBC:2;		/* 1: STBC support MCS =0-7,   2,3 : RESERVE */
+	u32 Ifs:1;		/* */
+/*      u32          rsv2:2; //channel bandwidth 20MHz or 40 MHz */
+	u32 rsv2:1;
+	u32 TxBF:1;		/* 3*3 */
+	u32 PHYMODE:2;
+	/* Word1 */
+	/* ex:  1c ff 38 00 means ACK=0, BAWinSize=7, MPDUtotalByteCount = 0x38 */
+	u32 ACK:1;
+	u32 NSEQ:1;
+	u32 BAWinSize:6;
+	u32 WirelessCliID:8;
+	u32 MPDUtotalByteCount:12;
+	u32 PacketId:4;
+	/*Word2 */
+	u32 IV;
+	/*Word3 */
+	u32 EIV;
+};
+
+/* */
+/* RXWI wireless information format, in PBF. invisible in driver. */
+/* */
+struct PACKED rt_rxwi {
+	/* Word 0 */
+	u32 WirelessCliID:8;
+	u32 KeyIndex:2;
+	u32 BSSID:3;
+	u32 UDF:3;
+	u32 MPDUtotalByteCount:12;
+	u32 TID:4;
+	/* Word 1 */
+	u32 FRAG:4;
+	u32 SEQUENCE:12;
+	u32 MCS:7;
+	u32 BW:1;
+	u32 ShortGI:1;
+	u32 STBC:2;
+	u32 rsv:3;
+	u32 PHYMODE:2;	/* 1: this RX frame is unicast to me */
+	/*Word2 */
+	u32 RSSI0:8;
+	u32 RSSI1:8;
+	u32 RSSI2:8;
+	u32 rsv1:8;
+	/*Word3 */
+	u32 SNR0:8;
+	u32 SNR1:8;
+	u32 FOFFSET:8;	/* RT35xx */
+	u32 rsv2:8;
+	/*u32                rsv2:16; */
+};
+
+/* ================================================================================= */
+/* Register format */
+/* ================================================================================= */
+
+/* */
+/* SCH/DMA registers - base address 0x0200 */
+/* */
+/* INT_SOURCE_CSR: Interrupt source register. Write one to clear corresponding bit */
+/* */
+#define DMA_CSR0		0x200
+#define INT_SOURCE_CSR		0x200
+typedef union _INT_SOURCE_CSR_STRUC {
+	struct {
+		u32 RxDelayINT:1;
+		u32 TxDelayINT:1;
+		u32 RxDone:1;
+		u32 Ac0DmaDone:1;	/*4 */
+		u32 Ac1DmaDone:1;
+		u32 Ac2DmaDone:1;
+		u32 Ac3DmaDone:1;
+		u32 HccaDmaDone:1;	/* bit7 */
+		u32 MgmtDmaDone:1;
+		u32 MCUCommandINT:1;	/*bit 9 */
+		u32 RxTxCoherent:1;
+		u32 TBTTInt:1;
+		u32 PreTBTT:1;
+		u32 TXFifoStatusInt:1;	/*FIFO Statistics is full, sw should read 0x171c */
+		u32 AutoWakeup:1;	/*bit14 */
+		u32 GPTimer:1;
+		u32 RxCoherent:1;	/*bit16 */
+		u32 TxCoherent:1;
+		u32 : 14;
+	} field;
+	u32 word;
+} INT_SOURCE_CSR_STRUC, *PINT_SOURCE_CSR_STRUC;
+
+/* */
+/* INT_MASK_CSR:   Interrupt MASK register.   1: the interrupt is mask OFF */
+/* */
+#define INT_MASK_CSR        0x204
+typedef union _INT_MASK_CSR_STRUC {
+	struct {
+		u32 RXDelay_INT_MSK:1;
+		u32 TxDelay:1;
+		u32 RxDone:1;
+		u32 Ac0DmaDone:1;
+		u32 Ac1DmaDone:1;
+		u32 Ac2DmaDone:1;
+		u32 Ac3DmaDone:1;
+		u32 HccaDmaDone:1;
+		u32 MgmtDmaDone:1;
+		u32 MCUCommandINT:1;
+		u32 : 20;
+		u32 RxCoherent:1;
+		u32 TxCoherent:1;
+	} field;
+	u32 word;
+} INT_MASK_CSR_STRUC, *PINT_MASK_CSR_STRUC;
+
+#define WPDMA_GLO_CFG	0x208
+typedef union _WPDMA_GLO_CFG_STRUC {
+	struct {
+		u32 EnableTxDMA:1;
+		u32 TxDMABusy:1;
+		u32 EnableRxDMA:1;
+		u32 RxDMABusy:1;
+		u32 WPDMABurstSIZE:2;
+		u32 EnTXWriteBackDDONE:1;
+		u32 BigEndian:1;
+		u32 RXHdrScater:8;
+		u32 HDR_SEG_LEN:16;
+	} field;
+	u32 word;
+} WPDMA_GLO_CFG_STRUC, *PWPDMA_GLO_CFG_STRUC;
+
+#define WPDMA_RST_IDX	0x20c
+typedef union _WPDMA_RST_IDX_STRUC {
+	struct {
+		u32 RST_DTX_IDX0:1;
+		u32 RST_DTX_IDX1:1;
+		u32 RST_DTX_IDX2:1;
+		u32 RST_DTX_IDX3:1;
+		u32 RST_DTX_IDX4:1;
+		u32 RST_DTX_IDX5:1;
+		u32 rsv:10;
+		u32 RST_DRX_IDX0:1;
+		u32 : 15;
+	} field;
+	u32 word;
+} WPDMA_RST_IDX_STRUC, *PWPDMA_RST_IDX_STRUC;
+#define DELAY_INT_CFG  0x0210
+typedef union _DELAY_INT_CFG_STRUC {
+	struct {
+		u32 RXMAX_PTIME:8;
+		u32 RXMAX_PINT:7;
+		u32 RXDLY_INT_EN:1;
+		u32 TXMAX_PTIME:8;
+		u32 TXMAX_PINT:7;
+		u32 TXDLY_INT_EN:1;
+	} field;
+	u32 word;
+} DELAY_INT_CFG_STRUC, *PDELAY_INT_CFG_STRUC;
+#define WMM_AIFSN_CFG   0x0214
+typedef union _AIFSN_CSR_STRUC {
+	struct {
+		u32 Aifsn0:4;	/* for AC_BE */
+		u32 Aifsn1:4;	/* for AC_BK */
+		u32 Aifsn2:4;	/* for AC_VI */
+		u32 Aifsn3:4;	/* for AC_VO */
+		u32 Rsv:16;
+	} field;
+	u32 word;
+} AIFSN_CSR_STRUC, *PAIFSN_CSR_STRUC;
+/* */
+/* CWMIN_CSR: CWmin for each EDCA AC */
+/* */
+#define WMM_CWMIN_CFG   0x0218
+typedef union _CWMIN_CSR_STRUC {
+	struct {
+		u32 Cwmin0:4;	/* for AC_BE */
+		u32 Cwmin1:4;	/* for AC_BK */
+		u32 Cwmin2:4;	/* for AC_VI */
+		u32 Cwmin3:4;	/* for AC_VO */
+		u32 Rsv:16;
+	} field;
+	u32 word;
+} CWMIN_CSR_STRUC, *PCWMIN_CSR_STRUC;
+
+/* */
+/* CWMAX_CSR: CWmin for each EDCA AC */
+/* */
+#define WMM_CWMAX_CFG   0x021c
+typedef union _CWMAX_CSR_STRUC {
+	struct {
+		u32 Cwmax0:4;	/* for AC_BE */
+		u32 Cwmax1:4;	/* for AC_BK */
+		u32 Cwmax2:4;	/* for AC_VI */
+		u32 Cwmax3:4;	/* for AC_VO */
+		u32 Rsv:16;
+	} field;
+	u32 word;
+} CWMAX_CSR_STRUC, *PCWMAX_CSR_STRUC;
+
+/* */
+/* AC_TXOP_CSR0: AC_BK/AC_BE TXOP register */
+/* */
+#define WMM_TXOP0_CFG    0x0220
+typedef union _AC_TXOP_CSR0_STRUC {
+	struct {
+		u16 Ac0Txop;	/* for AC_BK, in unit of 32us */
+		u16 Ac1Txop;	/* for AC_BE, in unit of 32us */
+	} field;
+	u32 word;
+} AC_TXOP_CSR0_STRUC, *PAC_TXOP_CSR0_STRUC;
+
+/* */
+/* AC_TXOP_CSR1: AC_VO/AC_VI TXOP register */
+/* */
+#define WMM_TXOP1_CFG    0x0224
+typedef union _AC_TXOP_CSR1_STRUC {
+	struct {
+		u16 Ac2Txop;	/* for AC_VI, in unit of 32us */
+		u16 Ac3Txop;	/* for AC_VO, in unit of 32us */
+	} field;
+	u32 word;
+} AC_TXOP_CSR1_STRUC, *PAC_TXOP_CSR1_STRUC;
+
+#define RINGREG_DIFF			0x10
+#define GPIO_CTRL_CFG    0x0228	/*MAC_CSR13 */
+#define MCU_CMD_CFG    0x022c
+#define TX_BASE_PTR0     0x0230	/*AC_BK base address */
+#define TX_MAX_CNT0      0x0234
+#define TX_CTX_IDX0       0x0238
+#define TX_DTX_IDX0      0x023c
+#define TX_BASE_PTR1     0x0240	/*AC_BE base address */
+#define TX_MAX_CNT1      0x0244
+#define TX_CTX_IDX1       0x0248
+#define TX_DTX_IDX1      0x024c
+#define TX_BASE_PTR2     0x0250	/*AC_VI base address */
+#define TX_MAX_CNT2      0x0254
+#define TX_CTX_IDX2       0x0258
+#define TX_DTX_IDX2      0x025c
+#define TX_BASE_PTR3     0x0260	/*AC_VO base address */
+#define TX_MAX_CNT3      0x0264
+#define TX_CTX_IDX3       0x0268
+#define TX_DTX_IDX3      0x026c
+#define TX_BASE_PTR4     0x0270	/*HCCA base address */
+#define TX_MAX_CNT4      0x0274
+#define TX_CTX_IDX4       0x0278
+#define TX_DTX_IDX4      0x027c
+#define TX_BASE_PTR5     0x0280	/*MGMT base address */
+#define  TX_MAX_CNT5     0x0284
+#define TX_CTX_IDX5       0x0288
+#define TX_DTX_IDX5      0x028c
+#define TX_MGMTMAX_CNT      TX_MAX_CNT5
+#define TX_MGMTCTX_IDX       TX_CTX_IDX5
+#define TX_MGMTDTX_IDX      TX_DTX_IDX5
+#define RX_BASE_PTR     0x0290	/*RX base address */
+#define RX_MAX_CNT      0x0294
+#define RX_CRX_IDX       0x0298
+#define RX_DRX_IDX      0x029c
+
+#define USB_DMA_CFG      0x02a0
+typedef union _USB_DMA_CFG_STRUC {
+	struct {
+		u32 RxBulkAggTOut:8;	/*Rx Bulk Aggregation TimeOut  in unit of 33ns */
+		u32 RxBulkAggLmt:8;	/*Rx Bulk Aggregation Limit  in unit of 256 bytes */
+		u32 phyclear:1;	/*phy watch dog enable. write 1 */
+		u32 rsv:2;
+		u32 TxClear:1;	/*Clear USB DMA TX path */
+		u32 TxopHalt:1;	/*Halt TXOP count down when TX buffer is full. */
+		u32 RxBulkAggEn:1;	/*Enable Rx Bulk Aggregation */
+		u32 RxBulkEn:1;	/*Enable USB DMA Rx */
+		u32 TxBulkEn:1;	/*Enable USB DMA Tx */
+		u32 EpoutValid:6;	/*OUT endpoint data valid */
+		u32 RxBusy:1;	/*USB DMA RX FSM busy */
+		u32 TxBusy:1;	/*USB DMA TX FSM busy */
+	} field;
+	u32 word;
+} USB_DMA_CFG_STRUC, *PUSB_DMA_CFG_STRUC;
+
+/* */
+/*  3  PBF  registers */
+/* */
+/* */
+/* Most are for debug. Driver doesn't touch PBF register. */
+#define PBF_SYS_CTRL	 0x0400
+#define PBF_CFG                 0x0408
+#define PBF_MAX_PCNT	 0x040C
+#define PBF_CTRL		0x0410
+#define PBF_INT_STA	 0x0414
+#define PBF_INT_ENA	 0x0418
+#define TXRXQ_PCNT	 0x0438
+#define PBF_DBG			 0x043c
+#define PBF_CAP_CTRL     0x0440
+
+#ifdef RT30xx
+#ifdef RTMP_EFUSE_SUPPORT
+/* eFuse registers */
+#define EFUSE_CTRL				0x0580
+#define EFUSE_DATA0				0x0590
+#define EFUSE_DATA1				0x0594
+#define EFUSE_DATA2				0x0598
+#define EFUSE_DATA3				0x059c
+#endif /* RTMP_EFUSE_SUPPORT // */
+#endif /* RT30xx // */
+
+#define OSC_CTRL		0x5a4
+#define PCIE_PHY_TX_ATTENUATION_CTRL	0x05C8
+#define LDO_CFG0				0x05d4
+#define GPIO_SWITCH				0x05dc
+
+/* */
+/*  4  MAC  registers */
+/* */
+/* */
+/*  4.1 MAC SYSTEM  configuration registers (offset:0x1000) */
+/* */
+#define MAC_CSR0            0x1000
+typedef union _ASIC_VER_ID_STRUC {
+	struct {
+		u16 ASICRev;	/* reversion  : 0 */
+		u16 ASICVer;	/* version : 2860 */
+	} field;
+	u32 word;
+} ASIC_VER_ID_STRUC, *PASIC_VER_ID_STRUC;
+#define MAC_SYS_CTRL            0x1004	/*MAC_CSR1 */
+#define MAC_ADDR_DW0				0x1008	/* MAC ADDR DW0 */
+#define MAC_ADDR_DW1			 0x100c	/* MAC ADDR DW1 */
+/* */
+/* MAC_CSR2: STA MAC register 0 */
+/* */
+typedef union _MAC_DW0_STRUC {
+	struct {
+		u8 Byte0;	/* MAC address byte 0 */
+		u8 Byte1;	/* MAC address byte 1 */
+		u8 Byte2;	/* MAC address byte 2 */
+		u8 Byte3;	/* MAC address byte 3 */
+	} field;
+	u32 word;
+} MAC_DW0_STRUC, *PMAC_DW0_STRUC;
+
+/* */
+/* MAC_CSR3: STA MAC register 1 */
+/* */
+typedef union _MAC_DW1_STRUC {
+	struct {
+		u8 Byte4;	/* MAC address byte 4 */
+		u8 Byte5;	/* MAC address byte 5 */
+		u8 U2MeMask;
+		u8 Rsvd1;
+	} field;
+	u32 word;
+} MAC_DW1_STRUC, *PMAC_DW1_STRUC;
+
+#define MAC_BSSID_DW0				0x1010	/* MAC BSSID DW0 */
+#define MAC_BSSID_DW1				0x1014	/* MAC BSSID DW1 */
+
+/* */
+/* MAC_CSR5: BSSID register 1 */
+/* */
+typedef union _MAC_CSR5_STRUC {
+	struct {
+		u8 Byte4;	/* BSSID byte 4 */
+		u8 Byte5;	/* BSSID byte 5 */
+		u16 BssIdMask:2;	/* 0: one BSSID, 10: 4 BSSID,  01: 2 BSSID , 11: 8BSSID */
+		u16 MBssBcnNum:3;
+		u16 Rsvd:11;
+	} field;
+	u32 word;
+} MAC_CSR5_STRUC, *PMAC_CSR5_STRUC;
+
+#define MAX_LEN_CFG              0x1018	/* rt2860b max 16k bytes. bit12:13 Maximum PSDU length (power factor) 0:2^13, 1:2^14, 2:2^15, 3:2^16 */
+#define BBP_CSR_CFG			0x101c	/* */
+/* */
+/* BBP_CSR_CFG: BBP serial control register */
+/* */
+typedef union _BBP_CSR_CFG_STRUC {
+	struct {
+		u32 Value:8;	/* Register     value to program into BBP */
+		u32 RegNum:8;	/* Selected     BBP     register */
+		u32 fRead:1;	/* 0: Write BBP, 1: Read BBP */
+		u32 Busy:1;	/* 1: ASIC is busy execute BBP programming. */
+		u32 BBP_PAR_DUR:1;	/* 0: 4 MAC clock cycles  1: 8 MAC clock cycles */
+		u32 BBP_RW_MODE:1;	/* 0: use serial mode  1:parallel */
+		u32 : 12;
+	} field;
+	u32 word;
+} BBP_CSR_CFG_STRUC, *PBBP_CSR_CFG_STRUC;
+#define RF_CSR_CFG0			0x1020
+/* */
+/* RF_CSR_CFG: RF control register */
+/* */
+typedef union _RF_CSR_CFG0_STRUC {
+	struct {
+		u32 RegIdAndContent:24;	/* Register     value to program into BBP */
+		u32 bitwidth:5;	/* Selected     BBP     register */
+		u32 StandbyMode:1;	/* 0: high when stand by 1: low when standby */
+		u32 Sel:1;	/* 0:RF_LE0 activate  1:RF_LE1 activate */
+		u32 Busy:1;	/* 0: idle 1: 8busy */
+	} field;
+	u32 word;
+} RF_CSR_CFG0_STRUC, *PRF_CSR_CFG0_STRUC;
+#define RF_CSR_CFG1			0x1024
+typedef union _RF_CSR_CFG1_STRUC {
+	struct {
+		u32 RegIdAndContent:24;	/* Register     value to program into BBP */
+		u32 RFGap:5;	/* Gap between BB_CONTROL_RF and RF_LE. 0: 3 system clock cycle (37.5usec) 1: 5 system clock cycle (62.5usec) */
+		u32 rsv:7;	/* 0: idle 1: 8busy */
+	} field;
+	u32 word;
+} RF_CSR_CFG1_STRUC, *PRF_CSR_CFG1_STRUC;
+#define RF_CSR_CFG2			0x1028	/* */
+typedef union _RF_CSR_CFG2_STRUC {
+	struct {
+		u32 RegIdAndContent:24;	/* Register     value to program into BBP */
+		u32 rsv:8;	/* 0: idle 1: 8busy */
+	} field;
+	u32 word;
+} RF_CSR_CFG2_STRUC, *PRF_CSR_CFG2_STRUC;
+#define LED_CFG				0x102c	/*  MAC_CSR14 */
+typedef union _LED_CFG_STRUC {
+	struct {
+		u32 OnPeriod:8;	/* blinking on period unit 1ms */
+		u32 OffPeriod:8;	/* blinking off period unit 1ms */
+		u32 SlowBlinkPeriod:6;	/* slow blinking period. unit:1ms */
+		u32 rsv:2;
+		u32 RLedMode:2;	/* red Led Mode    0: off1: blinking upon TX2: periodic slow blinking3: always on */
+		u32 GLedMode:2;	/* green Led Mode */
+		u32 YLedMode:2;	/* yellow Led Mode */
+		u32 LedPolar:1;	/* Led Polarity.  0: active low1: active high */
+		u32 : 1;
+	} field;
+	u32 word;
+} LED_CFG_STRUC, *PLED_CFG_STRUC;
+/* */
+/*  4.2 MAC TIMING  configuration registers (offset:0x1100) */
+/* */
+#define XIFS_TIME_CFG             0x1100	/* MAC_CSR8  MAC_CSR9 */
+typedef union _IFS_SLOT_CFG_STRUC {
+	struct {
+		u32 CckmSifsTime:8;	/*  unit 1us. Applied after CCK RX/TX */
+		u32 OfdmSifsTime:8;	/*  unit 1us. Applied after OFDM RX/TX */
+		u32 OfdmXifsTime:4;	/*OFDM SIFS. unit 1us. Applied after OFDM RX when MAC doesn't reference BBP signal BBRXEND */
+		u32 EIFS:9;	/*  unit 1us */
+		u32 BBRxendEnable:1;	/*  reference RXEND signal to begin XIFS defer */
+		u32 rsv:2;
+	} field;
+	u32 word;
+} IFS_SLOT_CFG_STRUC, *PIFS_SLOT_CFG_STRUC;
+
+#define BKOFF_SLOT_CFG             0x1104	/*  mac_csr9 last 8 bits */
+#define NAV_TIME_CFG             0x1108	/* NAV  (MAC_CSR15) */
+#define CH_TIME_CFG             0x110C	/* Count as channel busy */
+#define PBF_LIFE_TIMER             0x1110	/*TX/RX MPDU timestamp timer (free run)Unit: 1us */
+#define BCN_TIME_CFG             0x1114	/* TXRX_CSR9 */
+
+#define BCN_OFFSET0				0x042C
+#define BCN_OFFSET1				0x0430
+
+/* */
+/* BCN_TIME_CFG : Synchronization control register */
+/* */
+typedef union _BCN_TIME_CFG_STRUC {
+	struct {
+		u32 BeaconInterval:16;	/* in unit of 1/16 TU */
+		u32 bTsfTicking:1;	/* Enable TSF auto counting */
+		u32 TsfSyncMode:2;	/* Enable TSF sync, 00: disable, 01: infra mode, 10: ad-hoc mode */
+		u32 bTBTTEnable:1;
+		u32 bBeaconGen:1;	/* Enable beacon generator */
+		u32 : 3;
+		u32 TxTimestampCompensate:8;
+	} field;
+	u32 word;
+} BCN_TIME_CFG_STRUC, *PBCN_TIME_CFG_STRUC;
+#define TBTT_SYNC_CFG            0x1118	/* txrx_csr10 */
+#define TSF_TIMER_DW0             0x111C	/* Local TSF timer lsb 32 bits. Read-only */
+#define TSF_TIMER_DW1             0x1120	/* msb 32 bits. Read-only. */
+#define TBTT_TIMER		0x1124	/* TImer remains till next TBTT. Read-only.  TXRX_CSR14 */
+#define INT_TIMER_CFG			0x1128	/* */
+#define INT_TIMER_EN			0x112c	/*  GP-timer and pre-tbtt Int enable */
+#define CH_IDLE_STA			0x1130	/*  channel idle time */
+#define CH_BUSY_STA			0x1134	/*  channle busy time */
+/* */
+/*  4.2 MAC POWER  configuration registers (offset:0x1200) */
+/* */
+#define MAC_STATUS_CFG             0x1200	/* old MAC_CSR12 */
+#define PWR_PIN_CFG             0x1204	/* old MAC_CSR12 */
+#define AUTO_WAKEUP_CFG             0x1208	/* old MAC_CSR10 */
+/* */
+/* AUTO_WAKEUP_CFG: Manual power control / status register */
+/* */
+typedef union _AUTO_WAKEUP_STRUC {
+	struct {
+		u32 AutoLeadTime:8;
+		u32 NumofSleepingTbtt:7;	/* ForceWake has high privilege than PutToSleep when both set */
+		u32 EnableAutoWakeup:1;	/* 0:sleep, 1:awake */
+		u32 : 16;
+	} field;
+	u32 word;
+} AUTO_WAKEUP_STRUC, *PAUTO_WAKEUP_STRUC;
+/* */
+/*  4.3 MAC TX  configuration registers (offset:0x1300) */
+/* */
+
+#define EDCA_AC0_CFG	0x1300	/*AC_TXOP_CSR0 0x3474 */
+#define EDCA_AC1_CFG	0x1304
+#define EDCA_AC2_CFG	0x1308
+#define EDCA_AC3_CFG	0x130c
+typedef union _EDCA_AC_CFG_STRUC {
+	struct {
+		u32 AcTxop:8;	/*  in unit of 32us */
+		u32 Aifsn:4;	/* # of slot time */
+		u32 Cwmin:4;	/* */
+		u32 Cwmax:4;	/*unit power of 2 */
+		u32 : 12;	/* */
+	} field;
+	u32 word;
+} EDCA_AC_CFG_STRUC, *PEDCA_AC_CFG_STRUC;
+
+#define EDCA_TID_AC_MAP	0x1310
+#define TX_PWR_CFG_0	0x1314
+#define TX_PWR_CFG_1	0x1318
+#define TX_PWR_CFG_2	0x131C
+#define TX_PWR_CFG_3	0x1320
+#define TX_PWR_CFG_4	0x1324
+#define TX_PIN_CFG		0x1328
+#define TX_BAND_CFG	0x132c	/* 0x1 use upper 20MHz. 0 juse lower 20MHz */
+#define TX_SW_CFG0		0x1330
+#define TX_SW_CFG1		0x1334
+#define TX_SW_CFG2		0x1338
+#define TXOP_THRES_CFG		0x133c
+#define TXOP_CTRL_CFG		0x1340
+#define TX_RTS_CFG		0x1344
+
+typedef union _TX_RTS_CFG_STRUC {
+	struct {
+		u32 AutoRtsRetryLimit:8;
+		u32 RtsThres:16;	/* unit:byte */
+		u32 RtsFbkEn:1;	/* enable rts rate fallback */
+		u32 rsv:7;	/* 1: HT non-STBC control frame enable */
+	} field;
+	u32 word;
+} TX_RTS_CFG_STRUC, *PTX_RTS_CFG_STRUC;
+#define TX_TIMEOUT_CFG	0x1348
+typedef union _TX_TIMEOUT_CFG_STRUC {
+	struct {
+		u32 rsv:4;
+		u32 MpduLifeTime:4;	/*  expiration time = 2^(9+MPDU LIFE TIME)  us */
+		u32 RxAckTimeout:8;	/* unit:slot. Used for TX precedure */
+		u32 TxopTimeout:8;	/*TXOP timeout value for TXOP truncation.  It is recommended that (SLOT_TIME) > (TX_OP_TIMEOUT) > (RX_ACK_TIMEOUT) */
+		u32 rsv2:8;	/* 1: HT non-STBC control frame enable */
+	} field;
+	u32 word;
+} TX_TIMEOUT_CFG_STRUC, *PTX_TIMEOUT_CFG_STRUC;
+#define TX_RTY_CFG	0x134c
+typedef union PACKED _TX_RTY_CFG_STRUC {
+	struct {
+		u32 ShortRtyLimit:8;	/*  short retry limit */
+		u32 LongRtyLimit:8;	/*long retry limit */
+		u32 LongRtyThre:12;	/* Long retry threshoold */
+		u32 NonAggRtyMode:1;	/* Non-Aggregate MPDU retry mode.  0:expired by retry limit, 1: expired by mpdu life timer */
+		u32 AggRtyMode:1;	/* Aggregate MPDU retry mode.  0:expired by retry limit, 1: expired by mpdu life timer */
+		u32 TxautoFBEnable:1;	/* Tx retry PHY rate auto fallback enable */
+		u32 rsv:1;	/* 1: HT non-STBC control frame enable */
+	} field;
+	u32 word;
+} TX_RTY_CFG_STRUC, *PTX_RTY_CFG_STRUC;
+#define TX_LINK_CFG	0x1350
+typedef union PACKED _TX_LINK_CFG_STRUC {
+	struct PACKED {
+		u32 RemoteMFBLifeTime:8;	/*remote MFB life time. unit : 32us */
+		u32 MFBEnable:1;	/*  TX apply remote MFB 1:enable */
+		u32 RemoteUMFSEnable:1;	/*  remote unsolicit  MFB enable.  0: not apply remote remote unsolicit (MFS=7) */
+		u32 TxMRQEn:1;	/*  MCS request TX enable */
+		u32 TxRDGEn:1;	/* RDG TX enable */
+		u32 TxCFAckEn:1;	/*   Piggyback CF-ACK enable */
+		u32 rsv:3;	/* */
+		u32 RemotMFB:8;	/*  remote MCS feedback */
+		u32 RemotMFS:8;	/*remote MCS feedback sequence number */
+	} field;
+	u32 word;
+} TX_LINK_CFG_STRUC, *PTX_LINK_CFG_STRUC;
+#define HT_FBK_CFG0	0x1354
+typedef union PACKED _HT_FBK_CFG0_STRUC {
+	struct {
+		u32 HTMCS0FBK:4;
+		u32 HTMCS1FBK:4;
+		u32 HTMCS2FBK:4;
+		u32 HTMCS3FBK:4;
+		u32 HTMCS4FBK:4;
+		u32 HTMCS5FBK:4;
+		u32 HTMCS6FBK:4;
+		u32 HTMCS7FBK:4;
+	} field;
+	u32 word;
+} HT_FBK_CFG0_STRUC, *PHT_FBK_CFG0_STRUC;
+#define HT_FBK_CFG1	0x1358
+typedef union _HT_FBK_CFG1_STRUC {
+	struct {
+		u32 HTMCS8FBK:4;
+		u32 HTMCS9FBK:4;
+		u32 HTMCS10FBK:4;
+		u32 HTMCS11FBK:4;
+		u32 HTMCS12FBK:4;
+		u32 HTMCS13FBK:4;
+		u32 HTMCS14FBK:4;
+		u32 HTMCS15FBK:4;
+	} field;
+	u32 word;
+} HT_FBK_CFG1_STRUC, *PHT_FBK_CFG1_STRUC;
+#define LG_FBK_CFG0	0x135c
+typedef union _LG_FBK_CFG0_STRUC {
+	struct {
+		u32 OFDMMCS0FBK:4;	/*initial value is 0 */
+		u32 OFDMMCS1FBK:4;	/*initial value is 0 */
+		u32 OFDMMCS2FBK:4;	/*initial value is 1 */
+		u32 OFDMMCS3FBK:4;	/*initial value is 2 */
+		u32 OFDMMCS4FBK:4;	/*initial value is 3 */
+		u32 OFDMMCS5FBK:4;	/*initial value is 4 */
+		u32 OFDMMCS6FBK:4;	/*initial value is 5 */
+		u32 OFDMMCS7FBK:4;	/*initial value is 6 */
+	} field;
+	u32 word;
+} LG_FBK_CFG0_STRUC, *PLG_FBK_CFG0_STRUC;
+#define LG_FBK_CFG1		0x1360
+typedef union _LG_FBK_CFG1_STRUC {
+	struct {
+		u32 CCKMCS0FBK:4;	/*initial value is 0 */
+		u32 CCKMCS1FBK:4;	/*initial value is 0 */
+		u32 CCKMCS2FBK:4;	/*initial value is 1 */
+		u32 CCKMCS3FBK:4;	/*initial value is 2 */
+		u32 rsv:16;
+	} field;
+	u32 word;
+} LG_FBK_CFG1_STRUC, *PLG_FBK_CFG1_STRUC;
+
+/*======================================================= */
+/*================ Protection Paramater================================ */
+/*======================================================= */
+#define CCK_PROT_CFG	0x1364	/*CCK Protection */
+#define ASIC_SHORTNAV		1
+#define ASIC_longNAV		2
+#define ASIC_RTS		1
+#define ASIC_CTS		2
+typedef union _PROT_CFG_STRUC {
+	struct {
+		u32 ProtectRate:16;	/*Protection control frame rate for CCK TX(RTS/CTS/CFEnd). */
+		u32 ProtectCtrl:2;	/*Protection control frame type for CCK TX. 1:RTS/CTS, 2:CTS-to-self, 0:None, 3:rsv */
+		u32 ProtectNav:2;	/*TXOP protection type for CCK TX. 0:None, 1:ShortNAVprotect,  2:LongNAVProtect, 3:rsv */
+		u32 TxopAllowCck:1;	/*CCK TXOP allowance.0:disallow. */
+		u32 TxopAllowOfdm:1;	/*CCK TXOP allowance.0:disallow. */
+		u32 TxopAllowMM20:1;	/*CCK TXOP allowance. 0:disallow. */
+		u32 TxopAllowMM40:1;	/*CCK TXOP allowance.0:disallow. */
+		u32 TxopAllowGF20:1;	/*CCK TXOP allowance.0:disallow. */
+		u32 TxopAllowGF40:1;	/*CCK TXOP allowance.0:disallow. */
+		u32 RTSThEn:1;	/*RTS threshold enable on CCK TX */
+		u32 rsv:5;
+	} field;
+	u32 word;
+} PROT_CFG_STRUC, *PPROT_CFG_STRUC;
+
+#define OFDM_PROT_CFG	0x1368	/*OFDM Protection */
+#define MM20_PROT_CFG	0x136C	/*MM20 Protection */
+#define MM40_PROT_CFG	0x1370	/*MM40 Protection */
+#define GF20_PROT_CFG	0x1374	/*GF20 Protection */
+#define GF40_PROT_CFG	0x1378	/*GR40 Protection */
+#define EXP_CTS_TIME	0x137C	/* */
+#define EXP_ACK_TIME	0x1380	/* */
+
+/* */
+/*  4.4 MAC RX configuration registers (offset:0x1400) */
+/* */
+#define RX_FILTR_CFG	0x1400	/*TXRX_CSR0 */
+#define AUTO_RSP_CFG	0x1404	/*TXRX_CSR4 */
+/* */
+/* TXRX_CSR4: Auto-Responder/ */
+/* */
+typedef union _AUTO_RSP_CFG_STRUC {
+	struct {
+		u32 AutoResponderEnable:1;
+		u32 BACAckPolicyEnable:1;	/* 0:long, 1:short preamble */
+		u32 CTS40MMode:1;	/* Response CTS 40MHz duplicate mode */
+		u32 CTS40MRef:1;	/* Response CTS 40MHz duplicate mode */
+		u32 AutoResponderPreamble:1;	/* 0:long, 1:short preamble */
+		u32 rsv:1;	/* Power bit value in conrtrol frame */
+		u32 DualCTSEn:1;	/* Power bit value in conrtrol frame */
+		u32 AckCtsPsmBit:1;	/* Power bit value in conrtrol frame */
+		u32 : 24;
+	} field;
+	u32 word;
+} AUTO_RSP_CFG_STRUC, *PAUTO_RSP_CFG_STRUC;
+
+#define LEGACY_BASIC_RATE	0x1408	/*  TXRX_CSR5           0x3054 */
+#define HT_BASIC_RATE		0x140c
+#define HT_CTRL_CFG		0x1410
+#define SIFS_COST_CFG		0x1414
+#define RX_PARSER_CFG		0x1418	/*Set NAV for all received frames */
+
+/* */
+/*  4.5 MAC Security configuration (offset:0x1500) */
+/* */
+#define TX_SEC_CNT0		0x1500	/* */
+#define RX_SEC_CNT0		0x1504	/* */
+#define CCMP_FC_MUTE		0x1508	/* */
+/* */
+/*  4.6 HCCA/PSMP (offset:0x1600) */
+/* */
+#define TXOP_HLDR_ADDR0		0x1600
+#define TXOP_HLDR_ADDR1		0x1604
+#define TXOP_HLDR_ET		0x1608
+#define QOS_CFPOLL_RA_DW0		0x160c
+#define QOS_CFPOLL_A1_DW1		0x1610
+#define QOS_CFPOLL_QC		0x1614
+/* */
+/*  4.7 MAC Statistis registers (offset:0x1700) */
+/* */
+#define RX_STA_CNT0		0x1700	/* */
+#define RX_STA_CNT1		0x1704	/* */
+#define RX_STA_CNT2		0x1708	/* */
+
+/* */
+/* RX_STA_CNT0_STRUC: RX PLCP error count & RX CRC error count */
+/* */
+typedef union _RX_STA_CNT0_STRUC {
+	struct {
+		u16 CrcErr;
+		u16 PhyErr;
+	} field;
+	u32 word;
+} RX_STA_CNT0_STRUC, *PRX_STA_CNT0_STRUC;
+
+/* */
+/* RX_STA_CNT1_STRUC: RX False CCA count & RX long frame count */
+/* */
+typedef union _RX_STA_CNT1_STRUC {
+	struct {
+		u16 FalseCca;
+		u16 PlcpErr;
+	} field;
+	u32 word;
+} RX_STA_CNT1_STRUC, *PRX_STA_CNT1_STRUC;
+
+/* */
+/* RX_STA_CNT2_STRUC: */
+/* */
+typedef union _RX_STA_CNT2_STRUC {
+	struct {
+		u16 RxDupliCount;
+		u16 RxFifoOverflowCount;
+	} field;
+	u32 word;
+} RX_STA_CNT2_STRUC, *PRX_STA_CNT2_STRUC;
+#define TX_STA_CNT0		0x170C	/* */
+/* */
+/* STA_CSR3: TX Beacon count */
+/* */
+typedef union _TX_STA_CNT0_STRUC {
+	struct {
+		u16 TxFailCount;
+		u16 TxBeaconCount;
+	} field;
+	u32 word;
+} TX_STA_CNT0_STRUC, *PTX_STA_CNT0_STRUC;
+#define TX_STA_CNT1		0x1710	/* */
+/* */
+/* TX_STA_CNT1: TX tx count */
+/* */
+typedef union _TX_STA_CNT1_STRUC {
+	struct {
+		u16 TxSuccess;
+		u16 TxRetransmit;
+	} field;
+	u32 word;
+} TX_STA_CNT1_STRUC, *PTX_STA_CNT1_STRUC;
+#define TX_STA_CNT2		0x1714	/* */
+/* */
+/* TX_STA_CNT2: TX tx count */
+/* */
+typedef union _TX_STA_CNT2_STRUC {
+	struct {
+		u16 TxZeroLenCount;
+		u16 TxUnderFlowCount;
+	} field;
+	u32 word;
+} TX_STA_CNT2_STRUC, *PTX_STA_CNT2_STRUC;
+#define TX_STA_FIFO		0x1718	/* */
+/* */
+/* TX_STA_FIFO_STRUC: TX Result for specific PID status fifo register */
+/* */
+typedef union PACKED _TX_STA_FIFO_STRUC {
+	struct {
+		u32 bValid:1;	/* 1:This register contains a valid TX result */
+		u32 PidType:4;
+		u32 TxSuccess:1;	/* Tx No retry success */
+		u32 TxAggre:1;	/* Tx Retry Success */
+		u32 TxAckRequired:1;	/* Tx fail */
+		u32 wcid:8;	/*wireless client index */
+/*              u32          SuccessRate:16; //include MCS, mode ,shortGI, BW settingSame format as TXWI Word 0 Bit 31-16. */
+		u32 SuccessRate:13;	/*include MCS, mode ,shortGI, BW settingSame format as TXWI Word 0 Bit 31-16. */
+		u32 TxBF:1;
+		u32 Reserve:2;
+	} field;
+	u32 word;
+} TX_STA_FIFO_STRUC, *PTX_STA_FIFO_STRUC;
+/* Debug counter */
+#define TX_AGG_CNT	0x171c
+typedef union _TX_AGG_CNT_STRUC {
+	struct {
+		u16 NonAggTxCount;
+		u16 AggTxCount;
+	} field;
+	u32 word;
+} TX_AGG_CNT_STRUC, *PTX_AGG_CNT_STRUC;
+/* Debug counter */
+#define TX_AGG_CNT0	0x1720
+typedef union _TX_AGG_CNT0_STRUC {
+	struct {
+		u16 AggSize1Count;
+		u16 AggSize2Count;
+	} field;
+	u32 word;
+} TX_AGG_CNT0_STRUC, *PTX_AGG_CNT0_STRUC;
+/* Debug counter */
+#define TX_AGG_CNT1	0x1724
+typedef union _TX_AGG_CNT1_STRUC {
+	struct {
+		u16 AggSize3Count;
+		u16 AggSize4Count;
+	} field;
+	u32 word;
+} TX_AGG_CNT1_STRUC, *PTX_AGG_CNT1_STRUC;
+#define TX_AGG_CNT2	0x1728
+typedef union _TX_AGG_CNT2_STRUC {
+	struct {
+		u16 AggSize5Count;
+		u16 AggSize6Count;
+	} field;
+	u32 word;
+} TX_AGG_CNT2_STRUC, *PTX_AGG_CNT2_STRUC;
+/* Debug counter */
+#define TX_AGG_CNT3	0x172c
+typedef union _TX_AGG_CNT3_STRUC {
+	struct {
+		u16 AggSize7Count;
+		u16 AggSize8Count;
+	} field;
+	u32 word;
+} TX_AGG_CNT3_STRUC, *PTX_AGG_CNT3_STRUC;
+/* Debug counter */
+#define TX_AGG_CNT4	0x1730
+typedef union _TX_AGG_CNT4_STRUC {
+	struct {
+		u16 AggSize9Count;
+		u16 AggSize10Count;
+	} field;
+	u32 word;
+} TX_AGG_CNT4_STRUC, *PTX_AGG_CNT4_STRUC;
+#define TX_AGG_CNT5	0x1734
+typedef union _TX_AGG_CNT5_STRUC {
+	struct {
+		u16 AggSize11Count;
+		u16 AggSize12Count;
+	} field;
+	u32 word;
+} TX_AGG_CNT5_STRUC, *PTX_AGG_CNT5_STRUC;
+#define TX_AGG_CNT6		0x1738
+typedef union _TX_AGG_CNT6_STRUC {
+	struct {
+		u16 AggSize13Count;
+		u16 AggSize14Count;
+	} field;
+	u32 word;
+} TX_AGG_CNT6_STRUC, *PTX_AGG_CNT6_STRUC;
+#define TX_AGG_CNT7		0x173c
+typedef union _TX_AGG_CNT7_STRUC {
+	struct {
+		u16 AggSize15Count;
+		u16 AggSize16Count;
+	} field;
+	u32 word;
+} TX_AGG_CNT7_STRUC, *PTX_AGG_CNT7_STRUC;
+#define MPDU_DENSITY_CNT		0x1740
+typedef union _MPDU_DEN_CNT_STRUC {
+	struct {
+		u16 TXZeroDelCount;	/*TX zero length delimiter count */
+		u16 RXZeroDelCount;	/*RX zero length delimiter count */
+	} field;
+	u32 word;
+} MPDU_DEN_CNT_STRUC, *PMPDU_DEN_CNT_STRUC;
+/* */
+/* TXRX control registers - base address 0x3000 */
+/* */
+/* rt2860b  UNKNOWN reg use R/O Reg Addr 0x77d0 first.. */
+#define TXRX_CSR1           0x77d0
+
+/* */
+/* Security key table memory, base address = 0x1000 */
+/* */
+#define MAC_WCID_BASE		0x1800	/*8-bytes(use only 6-bytes) * 256 entry = */
+#define HW_WCID_ENTRY_SIZE   8
+#define PAIRWISE_KEY_TABLE_BASE     0x4000	/* 32-byte * 256-entry =  -byte */
+#define HW_KEY_ENTRY_SIZE           0x20
+#define PAIRWISE_IVEIV_TABLE_BASE     0x6000	/* 8-byte * 256-entry =  -byte */
+#define MAC_IVEIV_TABLE_BASE     0x6000	/* 8-byte * 256-entry =  -byte */
+#define HW_IVEIV_ENTRY_SIZE   8
+#define MAC_WCID_ATTRIBUTE_BASE     0x6800	/* 4-byte * 256-entry =  -byte */
+#define HW_WCID_ATTRI_SIZE   4
+#define WCID_RESERVED			0x6bfc
+#define SHARED_KEY_TABLE_BASE       0x6c00	/* 32-byte * 16-entry = 512-byte */
+#define SHARED_KEY_MODE_BASE       0x7000	/* 32-byte * 16-entry = 512-byte */
+#define HW_SHARED_KEY_MODE_SIZE   4
+#define SHAREDKEYTABLE			0
+#define PAIRWISEKEYTABLE			1
+
+typedef union _SHAREDKEY_MODE_STRUC {
+	struct {
+		u32 Bss0Key0CipherAlg:3;
+		u32 : 1;
+		u32 Bss0Key1CipherAlg:3;
+		u32 : 1;
+		u32 Bss0Key2CipherAlg:3;
+		u32 : 1;
+		u32 Bss0Key3CipherAlg:3;
+		u32 : 1;
+		u32 Bss1Key0CipherAlg:3;
+		u32 : 1;
+		u32 Bss1Key1CipherAlg:3;
+		u32 : 1;
+		u32 Bss1Key2CipherAlg:3;
+		u32 : 1;
+		u32 Bss1Key3CipherAlg:3;
+		u32 : 1;
+	} field;
+	u32 word;
+} SHAREDKEY_MODE_STRUC, *PSHAREDKEY_MODE_STRUC;
+
+/* 8-byte per entry, 64-entry for pairwise key table */
+struct rt_hw_wcid_entry {
+	u8 Address[6];
+	u8 Rsv[2];
+};
+
+/* ================================================================================= */
+/* WCID  format */
+/* ================================================================================= */
+/*7.1   WCID  ENTRY  format  : 8bytes */
+struct rt_wcid_entry {
+	u8 RXBABitmap7;	/* bit0 for TID8, bit7 for TID 15 */
+	u8 RXBABitmap0;	/* bit0 for TID0, bit7 for TID 7 */
+	u8 MAC[6];		/* 0 for shared key table.  1 for pairwise key table */
+};
+
+/*8.1.1 SECURITY  KEY  format  : 8DW */
+/* 32-byte per entry, total 16-entry for shared key table, 64-entry for pairwise key table */
+struct rt_hw_key_entry {
+	u8 Key[16];
+	u8 TxMic[8];
+	u8 RxMic[8];
+};
+
+/*8.1.2 IV/EIV  format  : 2DW */
+
+/*8.1.3 RX attribute entry format  : 1DW */
+struct rt_mac_attribute {
+	u32 KeyTab:1;	/* 0 for shared key table.  1 for pairwise key table */
+	u32 PairKeyMode:3;
+	u32 BSSIDIdx:3;	/*multipleBSS index for the WCID */
+	u32 RXWIUDF:3;
+	u32 rsv:22;
+};
+
+/* ================================================================================= */
+/* HOST-MCU communication data structure */
+/* ================================================================================= */
+
+/* */
+/* H2M_MAILBOX_CSR: Host-to-MCU Mailbox */
+/* */
+typedef union _H2M_MAILBOX_STRUC {
+	struct {
+		u32 LowByte:8;
+		u32 HighByte:8;
+		u32 CmdToken:8;
+		u32 Owner:8;
+	} field;
+	u32 word;
+} H2M_MAILBOX_STRUC, *PH2M_MAILBOX_STRUC;
+
+/* */
+/* M2H_CMD_DONE_CSR: MCU-to-Host command complete indication */
+/* */
+typedef union _M2H_CMD_DONE_STRUC {
+	struct {
+		u32 CmdToken0;
+		u32 CmdToken1;
+		u32 CmdToken2;
+		u32 CmdToken3;
+	} field;
+	u32 word;
+} M2H_CMD_DONE_STRUC, *PM2H_CMD_DONE_STRUC;
+
+/*NAV_TIME_CFG :NAV */
+typedef union _NAV_TIME_CFG_STRUC {
+	struct {
+		u8 Sifs;	/* in unit of 1-us */
+		u8 SlotTime;	/* in unit of 1-us */
+		u16 Eifs:9;	/* in unit of 1-us */
+		u16 ZeroSifs:1;	/* Applied zero SIFS timer after OFDM RX 0: disable */
+		u16 rsv:6;
+	} field;
+	u32 word;
+} NAV_TIME_CFG_STRUC, *PNAV_TIME_CFG_STRUC;
+
+/* */
+/* RX_FILTR_CFG:  /RX configuration register */
+/* */
+typedef union _RX_FILTR_CFG_STRUC {
+	struct {
+		u32 DropCRCErr:1;	/* Drop CRC error */
+		u32 DropPhyErr:1;	/* Drop physical error */
+		u32 DropNotToMe:1;	/* Drop not to me unicast frame */
+		u32 DropNotMyBSSID:1;	/* Drop fram ToDs bit is true */
+
+		u32 DropVerErr:1;	/* Drop version error frame */
+		u32 DropMcast:1;	/* Drop multicast frames */
+		u32 DropBcast:1;	/* Drop broadcast frames */
+		u32 DropDuplicate:1;	/* Drop duplicate frame */
+
+		u32 DropCFEndAck:1;	/* Drop Ps-Poll */
+		u32 DropCFEnd:1;	/* Drop Ps-Poll */
+		u32 DropAck:1;	/* Drop Ps-Poll */
+		u32 DropCts:1;	/* Drop Ps-Poll */
+
+		u32 DropRts:1;	/* Drop Ps-Poll */
+		u32 DropPsPoll:1;	/* Drop Ps-Poll */
+		u32 DropBA:1;	/* */
+		u32 DropBAR:1;	/* */
+
+		u32 DropRsvCntlType:1;
+		u32 : 15;
+	} field;
+	u32 word;
+} RX_FILTR_CFG_STRUC, *PRX_FILTR_CFG_STRUC;
+
+/* */
+/* PHY_CSR4: RF serial control register */
+/* */
+typedef union _PHY_CSR4_STRUC {
+	struct {
+		u32 RFRegValue:24;	/* Register     value (include register id)     serial out to RF/IF     chip. */
+		u32 NumberOfBits:5;	/* Number of bits used in RFRegValue (I:20,     RFMD:22) */
+		u32 IFSelect:1;	/* 1: select IF to program,     0: select RF to program */
+		u32 PLL_LD:1;	/* RF PLL_LD status */
+		u32 Busy:1;	/* 1: ASIC is busy execute RF programming. */
+	} field;
+	u32 word;
+} PHY_CSR4_STRUC, *PPHY_CSR4_STRUC;
+
+/* */
+/* SEC_CSR5: shared key table security mode register */
+/* */
+typedef union _SEC_CSR5_STRUC {
+	struct {
+		u32 Bss2Key0CipherAlg:3;
+		u32 : 1;
+		u32 Bss2Key1CipherAlg:3;
+		u32 : 1;
+		u32 Bss2Key2CipherAlg:3;
+		u32 : 1;
+		u32 Bss2Key3CipherAlg:3;
+		u32 : 1;
+		u32 Bss3Key0CipherAlg:3;
+		u32 : 1;
+		u32 Bss3Key1CipherAlg:3;
+		u32 : 1;
+		u32 Bss3Key2CipherAlg:3;
+		u32 : 1;
+		u32 Bss3Key3CipherAlg:3;
+		u32 : 1;
+	} field;
+	u32 word;
+} SEC_CSR5_STRUC, *PSEC_CSR5_STRUC;
+
+/* */
+/* HOST_CMD_CSR: For HOST to interrupt embedded processor */
+/* */
+typedef union _HOST_CMD_CSR_STRUC {
+	struct {
+		u32 HostCommand:8;
+		u32 Rsv:24;
+	} field;
+	u32 word;
+} HOST_CMD_CSR_STRUC, *PHOST_CMD_CSR_STRUC;
+
+/* */
+/* AIFSN_CSR: AIFSN for each EDCA AC */
+/* */
+
+/* */
+/* E2PROM_CSR: EEPROM control register */
+/* */
+typedef union _E2PROM_CSR_STRUC {
+	struct {
+		u32 Reload:1;	/* Reload EEPROM content, write one to reload, self-cleared. */
+		u32 EepromSK:1;
+		u32 EepromCS:1;
+		u32 EepromDI:1;
+		u32 EepromDO:1;
+		u32 Type:1;	/* 1: 93C46, 0:93C66 */
+		u32 LoadStatus:1;	/* 1:loading, 0:done */
+		u32 Rsvd:25;
+	} field;
+	u32 word;
+} E2PROM_CSR_STRUC, *PE2PROM_CSR_STRUC;
+
+/* */
+/* QOS_CSR0: TXOP holder address0 register */
+/* */
+typedef union _QOS_CSR0_STRUC {
+	struct {
+		u8 Byte0;	/* MAC address byte 0 */
+		u8 Byte1;	/* MAC address byte 1 */
+		u8 Byte2;	/* MAC address byte 2 */
+		u8 Byte3;	/* MAC address byte 3 */
+	} field;
+	u32 word;
+} QOS_CSR0_STRUC, *PQOS_CSR0_STRUC;
+
+/* */
+/* QOS_CSR1: TXOP holder address1 register */
+/* */
+typedef union _QOS_CSR1_STRUC {
+	struct {
+		u8 Byte4;	/* MAC address byte 4 */
+		u8 Byte5;	/* MAC address byte 5 */
+		u8 Rsvd0;
+		u8 Rsvd1;
+	} field;
+	u32 word;
+} QOS_CSR1_STRUC, *PQOS_CSR1_STRUC;
+
+#define	RF_CSR_CFG	0x500
+typedef union _RF_CSR_CFG_STRUC {
+	struct {
+		u32 RF_CSR_DATA:8;	/* DATA */
+		u32 TESTCSR_RFACC_REGNUM:5;	/* RF register ID */
+		u32 Rsvd2:3;	/* Reserved */
+		u32 RF_CSR_WR:1;	/* 0: read  1: write */
+		u32 RF_CSR_KICK:1;	/* kick RF register read/write */
+		u32 Rsvd1:14;	/* Reserved */
+	} field;
+	u32 word;
+} RF_CSR_CFG_STRUC, *PRF_CSR_CFG_STRUC;
+
+/* */
+/* Other on-chip shared memory space, base = 0x2000 */
+/* */
+
+/* CIS space - base address = 0x2000 */
+#define HW_CIS_BASE             0x2000
+
+/* Carrier-sense CTS frame base address. It's where mac stores carrier-sense frame for carrier-sense function. */
+#define HW_CS_CTS_BASE			0x7700
+/* DFS CTS frame base address. It's where mac stores CTS frame for DFS. */
+#define HW_DFS_CTS_BASE			0x7780
+#define HW_CTS_FRAME_SIZE		0x80
+
+/* 2004-11-08 john - since NULL frame won't be that long (256 byte). We steal 16 tail bytes */
+/* to save debugging settings */
+#define HW_DEBUG_SETTING_BASE   0x77f0	/* 0x77f0~0x77ff total 16 bytes */
+#define HW_DEBUG_SETTING_BASE2   0x7770	/* 0x77f0~0x77ff total 16 bytes */
+
+/* In order to support maximum 8 MBSS and its maximum length is 512 for each beacon */
+/* Three section discontinue memory segments will be used. */
+/* 1. The original region for BCN 0~3 */
+/* 2. Extract memory from FCE table for BCN 4~5 */
+/* 3. Extract memory from Pair-wise key table for BCN 6~7 */
+/*        It occupied those memory of wcid 238~253 for BCN 6 */
+/*                                                    and wcid 222~237 for BCN 7 */
+#define HW_BEACON_MAX_SIZE      0x1000	/* unit: byte */
+#define HW_BEACON_BASE0         0x7800
+#define HW_BEACON_BASE1         0x7A00
+#define HW_BEACON_BASE2         0x7C00
+#define HW_BEACON_BASE3         0x7E00
+#define HW_BEACON_BASE4         0x7200
+#define HW_BEACON_BASE5         0x7400
+#define HW_BEACON_BASE6         0x5DC0
+#define HW_BEACON_BASE7         0x5BC0
+
+#define HW_BEACON_MAX_COUNT     8
+#define HW_BEACON_OFFSET		0x0200
+#define HW_BEACON_CONTENT_LEN	(HW_BEACON_OFFSET - TXWI_SIZE)
+
+/* HOST-MCU shared memory - base address = 0x2100 */
+#define HOST_CMD_CSR		0x404
+#define H2M_MAILBOX_CSR         0x7010
+#define H2M_MAILBOX_CID         0x7014
+#define H2M_MAILBOX_STATUS      0x701c
+#define H2M_INT_SRC             0x7024
+#define H2M_BBP_AGENT           0x7028
+#define M2H_CMD_DONE_CSR        0x000c
+#define MCU_TXOP_ARRAY_BASE     0x000c	/* TODO: to be provided by Albert */
+#define MCU_TXOP_ENTRY_SIZE     32	/* TODO: to be provided by Albert */
+#define MAX_NUM_OF_TXOP_ENTRY   16	/* TODO: must be same with 8051 firmware */
+#define MCU_MBOX_VERSION        0x01	/* TODO: to be confirmed by Albert */
+#define MCU_MBOX_VERSION_OFFSET 5	/* TODO: to be provided by Albert */
+
+/* */
+/* Host DMA registers - base address 0x200 .  TX0-3=EDCAQid0-3, TX4=HCCA, TX5=MGMT, */
+/* */
+/* */
+/*  DMA RING DESCRIPTOR */
+/* */
+#define E2PROM_CSR          0x0004
+#define IO_CNTL_CSR         0x77d0
+
+/* ================================================================ */
+/* Tx / Rx / Mgmt ring descriptor definition */
+/* ================================================================ */
+
+/* the following PID values are used to mark outgoing frame type in TXD->PID so that */
+/* proper TX statistics can be collected based on these categories */
+/* b3-2 of PID field - */
+#define PID_MGMT			0x05
+#define PID_BEACON			0x0c
+#define PID_DATA_NORMALUCAST		0x02
+#define PID_DATA_AMPDU		0x04
+#define PID_DATA_NO_ACK		0x08
+#define PID_DATA_NOT_NORM_ACK		0x03
+/* value domain of pTxD->HostQId (4-bit: 0~15) */
+#define QID_AC_BK               1	/* meet ACI definition in 802.11e */
+#define QID_AC_BE               0	/* meet ACI definition in 802.11e */
+#define QID_AC_VI               2
+#define QID_AC_VO               3
+#define QID_HCCA                4
+#define NUM_OF_TX_RING          4
+#define QID_MGMT                13
+#define QID_RX                  14
+#define QID_OTHER               15
+
+#endif /* __RTMP_MAC_H__ // */
diff --git a/drivers/staging/rt3090/rtmp_phy.h b/drivers/staging/rt2860/chip/rtmp_phy.h
index b9848cac282e..8b8b0f47f03b 100644
--- a/drivers/staging/rt3090/rtmp_phy.h
+++ b/drivers/staging/rt2860/chip/rtmp_phy.h
@@ -38,7 +38,6 @@
 #ifndef __RTMP_PHY_H__
 #define __RTMP_PHY_H__
 
-
 /*
 	RF sections
 */
@@ -75,31 +74,30 @@
 #define RF_R30			30
 #define RF_R31			31
 
-
-// value domain of pAd->RfIcType
-#define RFIC_2820                   1       // 2.4G 2T3R
-#define RFIC_2850                   2       // 2.4G/5G 2T3R
-#define RFIC_2720                   3       // 2.4G 1T2R
-#define RFIC_2750                   4       // 2.4G/5G 1T2R
-#define RFIC_3020                   5       // 2.4G 1T1R
-#define RFIC_2020                   6       // 2.4G B/G
-#define RFIC_3021                   7       // 2.4G 1T2R
-#define RFIC_3022                   8       // 2.4G 2T2R
-#define RFIC_3052                   9       // 2.4G/5G 2T2R
+/* value domain of pAd->RfIcType */
+#define RFIC_2820                   1	/* 2.4G 2T3R */
+#define RFIC_2850                   2	/* 2.4G/5G 2T3R */
+#define RFIC_2720                   3	/* 2.4G 1T2R */
+#define RFIC_2750                   4	/* 2.4G/5G 1T2R */
+#define RFIC_3020                   5	/* 2.4G 1T1R */
+#define RFIC_2020                   6	/* 2.4G B/G */
+#define RFIC_3021                   7	/* 2.4G 1T2R */
+#define RFIC_3022                   8	/* 2.4G 2T2R */
+#define RFIC_3052                   9	/* 2.4G/5G 2T2R */
 
 /*
 	BBP sections
 */
-#define BBP_R0			0  // version
-#define BBP_R1			1  // TSSI
-#define BBP_R2			2  // TX configure
+#define BBP_R0			0	/* version */
+#define BBP_R1			1	/* TSSI */
+#define BBP_R2			2	/* TX configure */
 #define BBP_R3			3
 #define BBP_R4			4
 #define BBP_R5			5
 #define BBP_R6			6
-#define BBP_R14			14 // RX configure
+#define BBP_R14			14	/* RX configure */
 #define BBP_R16			16
-#define BBP_R17			17 // RX sensibility
+#define BBP_R17			17	/* RX sensibility */
 #define BBP_R18			18
 #define BBP_R21			21
 #define BBP_R22			22
@@ -108,12 +106,12 @@
 #define BBP_R26			26
 #define BBP_R27			27
 #define BBP_R31			31
-#define BBP_R49			49 //TSSI
+#define BBP_R49			49	/*TSSI */
 #define BBP_R50			50
 #define BBP_R51			51
 #define BBP_R52			52
 #define BBP_R55			55
-#define BBP_R62			62 // Rx SQ0 Threshold HIGH
+#define BBP_R62			62	/* Rx SQ0 Threshold HIGH */
 #define BBP_R63			63
 #define BBP_R64			64
 #define BBP_R65			65
@@ -121,7 +119,7 @@
 #define BBP_R67			67
 #define BBP_R68			68
 #define BBP_R69			69
-#define BBP_R70			70 // Rx AGC SQ CCK Xcorr threshold
+#define BBP_R70			70	/* Rx AGC SQ CCK Xcorr threshold */
 #define BBP_R73			73
 #define BBP_R75			75
 #define BBP_R77			77
@@ -135,7 +133,7 @@
 #define BBP_R86			86
 #define BBP_R91			91
 #define BBP_R92			92
-#define BBP_R94			94 // Tx Gain Control
+#define BBP_R94			94	/* Tx Gain Control */
 #define BBP_R103		103
 #define BBP_R105		105
 #define BBP_R106		106
@@ -151,39 +149,22 @@
 #define BBP_R122		122
 #define BBP_R123		123
 #ifdef RT30xx
-#define BBP_R138		138 // add by johnli, RF power sequence setup, ADC dynamic on/off control
-#endif // RT30xx //
-
-
-#define BBPR94_DEFAULT	0x06 // Add 1 value will gain 1db
-
-
-#ifdef MERGE_ARCH_TEAM
-	#define MAX_BBP_ID	200
-	#define MAX_BBP_MSG_SIZE	4096
-#else
-#ifdef RT30xx
-	// edit by johnli, RF power sequence setup, add BBP R138 for ADC dynamic on/off control
-	#define MAX_BBP_ID	138
-#endif // RT30xx //
-#ifndef RT30xx
-	#define MAX_BBP_ID	136
-#endif // RT30xx //
-	#define MAX_BBP_MSG_SIZE	2048
-#endif // MERGE_ARCH_TEAM //
+#define BBP_R138		138	/* add by johnli, RF power sequence setup, ADC dynamic on/off control */
+#endif /* RT30xx // */
 
+#define BBPR94_DEFAULT	0x06	/* Add 1 value will gain 1db */
 
-//
-// BBP & RF are using indirect access. Before write any value into it.
-// We have to make sure there is no outstanding command pending via checking busy bit.
-//
-#define MAX_BUSY_COUNT  100         // Number of retry before failing access BBP & RF indirect register
+/* */
+/* BBP & RF are using indirect access. Before write any value into it. */
+/* We have to make sure there is no outstanding command pending via checking busy bit. */
+/* */
+#define MAX_BUSY_COUNT  100	/* Number of retry before failing access BBP & RF indirect register */
 
-//#define PHY_TR_SWITCH_TIME          5  // usec
+/*#define PHY_TR_SWITCH_TIME          5  // usec */
 
-//#define BBP_R17_LOW_SENSIBILITY     0x50
-//#define BBP_R17_MID_SENSIBILITY     0x41
-//#define BBP_R17_DYNAMIC_UP_BOUND    0x40
+/*#define BBP_R17_LOW_SENSIBILITY     0x50 */
+/*#define BBP_R17_MID_SENSIBILITY     0x41 */
+/*#define BBP_R17_DYNAMIC_UP_BOUND    0x40 */
 
 #define RSSI_FOR_VERY_LOW_SENSIBILITY   -35
 #define RSSI_FOR_LOW_SENSIBILITY		-58
@@ -199,7 +180,7 @@
 	if ((_A)->bPCIclkOff == FALSE)	                \
 	{												\
 		PHY_CSR4_STRUC  _value;                          \
-		ULONG           _busyCnt = 0;                    \
+		unsigned long           _busyCnt = 0;                    \
 											\
 		do {                                            \
 			RTMP_IO_READ32((_A), RF_CSR_CFG0, &_value.word);  \
@@ -213,15 +194,15 @@
 		}                                               \
 	}								\
 }
-#endif // RTMP_MAC_PCI //
-
-
+#endif /* RTMP_MAC_PCI // */
+#ifdef RTMP_MAC_USB
+#define RTMP_RF_IO_WRITE32(_A, _V)                 RTUSBWriteRFRegister(_A, _V)
+#endif /* RTMP_MAC_USB // */
 
 #ifdef RT30xx
 #define RTMP_RF_IO_READ8_BY_REG_ID(_A, _I, _pV)    RT30xxReadRFRegister(_A, _I, _pV)
 #define RTMP_RF_IO_WRITE8_BY_REG_ID(_A, _I, _V)    RT30xxWriteRFRegister(_A, _I, _V)
-#endif // RT30xx //
-
+#endif /* RT30xx // */
 
 /*****************************************************************************
 	BBP register Read/Write marco definitions.
@@ -231,7 +212,7 @@
 #ifdef RTMP_MAC_PCI
 /*
 	basic marco for BBP read operation.
-	_pAd: the data structure pointer of RTMP_ADAPTER
+	_pAd: the data structure pointer of struct rt_rtmp_adapter
 	_bbpID : the bbp register ID
 	_pV: data pointer used to save the value of queried bbp register.
 	_bViaMCU: if we need access the bbp via the MCU.
@@ -267,7 +248,7 @@
 			if ((BbpCsr.field.Busy == IDLE) &&              \
 				(BbpCsr.field.RegNum == _bbpID))                \
 			{                                               \
-				*(_pV) = (UCHAR)BbpCsr.field.Value;         \
+				*(_pV) = (u8)BbpCsr.field.Value;         \
 				break;                                      \
 			}                                               \
 		}                                                   \
@@ -295,20 +276,7 @@
 	But for some chipset which didn't have mcu (e.g., RBUS based chipset), we
 	will use this function too and didn't access the bbp register via the MCU.
 */
-#ifndef CONFIG_STA_SUPPORT
-#define RTMP_BBP_IO_READ8_BY_REG_ID(_A, _I, _pV)			\
-	do{														\
-		if ((_A)->bPCIclkOff == FALSE)							\
-		{													\
-			if ((_A)->infType == RTMP_DEV_INF_RBUS)			\
-				RTMP_BBP_IO_READ8((_A), (_I), (_pV), FALSE);	\
-			else												\
-				RTMP_BBP_IO_READ8((_A), (_I), (_pV), TRUE);	\
-		}													\
-	}while(0)
-#endif // CONFIG_STA_SUPPORT //
-#ifdef CONFIG_STA_SUPPORT
-// Read BBP register by register's ID. Generate PER to test BA
+/* Read BBP register by register's ID. Generate PER to test BA */
 #define RTMP_BBP_IO_READ8_BY_REG_ID(_A, _I, _pV)						\
 {																		\
 	BBP_CSR_CFG_STRUC	BbpCsr;											\
@@ -345,7 +313,7 @@
 				if ((BbpCsr.field.Busy == IDLE) &&								\
 					(BbpCsr.field.RegNum == _I))								\
 				{																\
-					*(_pV) = (UCHAR)BbpCsr.field.Value;							\
+					*(_pV) = (u8)BbpCsr.field.Value;							\
 					break;														\
 				}																\
 			}																\
@@ -383,7 +351,7 @@
 			if ((BbpCsr.field.Busy == IDLE) &&								\
 				(BbpCsr.field.RegNum == _I))								\
 			{																\
-				*(_pV) = (UCHAR)BbpCsr.field.Value;							\
+				*(_pV) = (u8)BbpCsr.field.Value;							\
 				break;														\
 			}																\
 		}																	\
@@ -399,11 +367,10 @@
 		*(_pV) = (_A)->BbpWriteLatch[_I];								\
 	}																	\
 }
-#endif // CONFIG_STA_SUPPORT //
 
 /*
 	basic marco for BBP write operation.
-	_pAd: the data structure pointer of RTMP_ADAPTER
+	_pAd: the data structure pointer of struct rt_rtmp_adapter
 	_bbpID : the bbp register ID
 	_pV: data used to save the value of queried bbp register.
 	_bViaMCU: if we need access the bbp via the MCU.
@@ -447,7 +414,6 @@
 		}														\
 	}while(0)
 
-
 /*
 	This marco used for the BBP write operation which didn't need via MCU.
 */
@@ -459,24 +425,11 @@
 	But for some chipset which didn't have mcu (e.g., RBUS based chipset), we
 	will use this function too and didn't access the bbp register via the MCU.
 */
-#ifndef CONFIG_STA_SUPPORT
-#define RTMP_BBP_IO_WRITE8_BY_REG_ID(_A, _I, _pV)			\
-	do{														\
-		if ((_A)->bPCIclkOff == FALSE)							\
-		{													\
-			if ((_A)->infType == RTMP_DEV_INF_RBUS)			\
-				RTMP_BBP_IO_WRITE8((_A), (_I), (_pV), FALSE);	\
-			else												\
-				RTMP_BBP_IO_WRITE8((_A), (_I), (_pV), TRUE);	\
-		}													\
-	}while(0)
-#endif // CONFIG_STA_SUPPORT //
-#ifdef CONFIG_STA_SUPPORT
-// Write BBP register by register's ID & value
+/* Write BBP register by register's ID & value */
 #define RTMP_BBP_IO_WRITE8_BY_REG_ID(_A, _I, _V)						\
 {																		\
 	BBP_CSR_CFG_STRUC	BbpCsr;											\
-	INT					BusyCnt = 0;										\
+	int					BusyCnt = 0;										\
 	BOOLEAN					brc;			\
 	if (_I < MAX_NUM_OF_BBP_LATCH)										\
 	{																	\
@@ -557,48 +510,21 @@
 		DBGPRINT_ERR(("****** BBP_Write_Latch Buffer exceeds max boundry ****** \n"));	\
 	}																		\
 }
-#endif // CONFIG_STA_SUPPORT //
-#endif // RTMP_MAC_PCI //
+#endif /* RTMP_MAC_PCI // */
 
+#ifdef RTMP_MAC_USB
+#define RTMP_BBP_IO_READ8_BY_REG_ID(_A, _I, _pV)   RTUSBReadBBPRegister(_A, _I, _pV)
+#define RTMP_BBP_IO_WRITE8_BY_REG_ID(_A, _I, _V)   RTUSBWriteBBPRegister(_A, _I, _V)
 
+#define BBP_IO_WRITE8_BY_REG_ID(_A, _I, _V)			RTUSBWriteBBPRegister(_A, _I, _V)
+#define BBP_IO_READ8_BY_REG_ID(_A, _I, _pV)		RTUSBReadBBPRegister(_A, _I, _pV)
+#endif /* RTMP_MAC_USB // */
 
 #ifdef RT30xx
-//Need to collect each ant's rssi concurrently
-//rssi1 is report to pair2 Ant and rss2 is reprot to pair1 Ant when 4 Ant
-#define COLLECT_RX_ANTENNA_AVERAGE_RSSI(_pAd, _rssi1, _rssi2)					\
-{																				\
-	SHORT	AvgRssi;															\
-	UCHAR	UsedAnt;															\
-	if (_pAd->RxAnt.EvaluatePeriod == 0)									\
-	{																		\
-		UsedAnt = _pAd->RxAnt.Pair1PrimaryRxAnt;							\
-		AvgRssi = _pAd->RxAnt.Pair1AvgRssi[UsedAnt];						\
-		if (AvgRssi < 0)													\
-			AvgRssi = AvgRssi - (AvgRssi >> 3) + _rssi1;					\
-		else																\
-			AvgRssi = _rssi1 << 3;											\
-		_pAd->RxAnt.Pair1AvgRssi[UsedAnt] = AvgRssi;						\
-	}																		\
-	else																	\
-	{																		\
-		UsedAnt = _pAd->RxAnt.Pair1SecondaryRxAnt;							\
-		AvgRssi = _pAd->RxAnt.Pair1AvgRssi[UsedAnt];						\
-		if ((AvgRssi < 0) && (_pAd->RxAnt.FirstPktArrivedWhenEvaluate))		\
-			AvgRssi = AvgRssi - (AvgRssi >> 3) + _rssi1;					\
-		else																\
-		{																	\
-			_pAd->RxAnt.FirstPktArrivedWhenEvaluate = TRUE;					\
-			AvgRssi = _rssi1 << 3;											\
-		}																	\
-		_pAd->RxAnt.Pair1AvgRssi[UsedAnt] = AvgRssi;						\
-		_pAd->RxAnt.RcvPktNumWhenEvaluate++;								\
-	}																		\
-}
-
 #define RTMP_ASIC_MMPS_DISABLE(_pAd)							\
 	do{															\
-		UCHAR _bbpData;											\
-		UINT32 _macData;											\
+		u32 _macData; \
+		u8 _bbpData = 0; \
 		/* disable MMPS BBP control register */						\
 		RTMP_BBP_IO_READ8_BY_REG_ID(_pAd, BBP_R3, &_bbpData);	\
 		_bbpData &= ~(0x04);	/*bit 2*/								\
@@ -610,11 +536,10 @@
 		RTMP_IO_WRITE32(_pAd, 0x1210, _macData);				\
 	}while(0)
 
-
 #define RTMP_ASIC_MMPS_ENABLE(_pAd)							\
 	do{															\
-		UCHAR _bbpData;											\
-		UINT32 _macData;											\
+		u32 _macData; \
+		u8 _bbpData = 0; \
 		/* enable MMPS BBP control register */						\
 		RTMP_BBP_IO_READ8_BY_REG_ID(_pAd, BBP_R3, &_bbpData);	\
 		_bbpData |= (0x04);	/*bit 2*/								\
@@ -626,6 +551,6 @@
 		RTMP_IO_WRITE32(_pAd, 0x1210, _macData);				\
 	}while(0)
 
-#endif // RT30xx //
+#endif /* RT30xx // */
 
-#endif // __RTMP_PHY_H__ //
+#endif /* __RTMP_PHY_H__ // */
diff --git a/drivers/staging/rt2860/chips/rt3070.c b/drivers/staging/rt2860/chips/rt3070.c
new file mode 100644
index 000000000000..627bad943a3c
--- /dev/null
+++ b/drivers/staging/rt2860/chips/rt3070.c
@@ -0,0 +1,169 @@
+/*
+ *************************************************************************
+ * Ralink Tech Inc.
+ * 5F., No.36, Taiyuan St., Jhubei City,
+ * Hsinchu County 302,
+ * Taiwan, R.O.C.
+ *
+ * (c) Copyright 2002-2007, Ralink Technology, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify  *
+ * it under the terms of the GNU General Public License as published by  *
+ * the Free Software Foundation; either version 2 of the License, or     *
+ * (at your option) any later version.                                   *
+ *                                                                       *
+ * This program is distributed in the hope that it will be useful,       *
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
+ * GNU General Public License for more details.                          *
+ *                                                                       *
+ * You should have received a copy of the GNU General Public License     *
+ * along with this program; if not, write to the                         *
+ * Free Software Foundation, Inc.,                                       *
+ * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
+ *                                                                       *
+ *************************************************************************
+
+	Module Name:
+	rt3070.c
+
+	Abstract:
+	Specific funcitons and variables for RT3070
+
+	Revision History:
+	Who         When          What
+	--------    ----------    ----------------------------------------------
+*/
+
+#ifdef RT3070
+
+#include "../rt_config.h"
+
+#ifndef RTMP_RF_RW_SUPPORT
+#error "You Should Enable compile flag RTMP_RF_RW_SUPPORT for this chip"
+#endif /* RTMP_RF_RW_SUPPORT // */
+
+void NICInitRT3070RFRegisters(struct rt_rtmp_adapter *pAd)
+{
+	int i;
+	u8 RFValue;
+
+	/* Driver must read EEPROM to get RfIcType before initial RF registers */
+	/* Initialize RF register to default value */
+	if (IS_RT3070(pAd) || IS_RT3071(pAd)) {
+		/* Init RF calibration */
+		/* Driver should toggle RF R30 bit7 before init RF registers */
+		u32 RfReg = 0;
+		u32 data;
+
+		RT30xxReadRFRegister(pAd, RF_R30, (u8 *)& RfReg);
+		RfReg |= 0x80;
+		RT30xxWriteRFRegister(pAd, RF_R30, (u8)RfReg);
+		RTMPusecDelay(1000);
+		RfReg &= 0x7F;
+		RT30xxWriteRFRegister(pAd, RF_R30, (u8)RfReg);
+
+		/* Initialize RF register to default value */
+		for (i = 0; i < NUM_RF_REG_PARMS; i++) {
+			RT30xxWriteRFRegister(pAd,
+					      RT30xx_RFRegTable[i].Register,
+					      RT30xx_RFRegTable[i].Value);
+		}
+
+		/* add by johnli */
+		if (IS_RT3070(pAd)) {
+			/* */
+			/* The DAC issue(LDO_CFG0) has been fixed in RT3070(F). */
+			/* The voltage raising patch is no longer needed for RT3070(F) */
+			/* */
+			if ((pAd->MACVersion & 0xffff) < 0x0201) {
+				/*  Update MAC 0x05D4 from 01xxxxxx to 0Dxxxxxx (voltage 1.2V to 1.35V) for RT3070 to improve yield rate */
+				RTUSBReadMACRegister(pAd, LDO_CFG0, &data);
+				data = ((data & 0xF0FFFFFF) | 0x0D000000);
+				RTUSBWriteMACRegister(pAd, LDO_CFG0, data);
+			}
+		} else if (IS_RT3071(pAd)) {
+			/* Driver should set RF R6 bit6 on before init RF registers */
+			RT30xxReadRFRegister(pAd, RF_R06, (u8 *)& RfReg);
+			RfReg |= 0x40;
+			RT30xxWriteRFRegister(pAd, RF_R06, (u8)RfReg);
+
+			/* init R31 */
+			RT30xxWriteRFRegister(pAd, RF_R31, 0x14);
+
+			/* RT3071 version E has fixed this issue */
+			if ((pAd->NicConfig2.field.DACTestBit == 1)
+			    && ((pAd->MACVersion & 0xffff) < 0x0211)) {
+				/* patch tx EVM issue temporarily */
+				RTUSBReadMACRegister(pAd, LDO_CFG0, &data);
+				data = ((data & 0xE0FFFFFF) | 0x0D000000);
+				RTUSBWriteMACRegister(pAd, LDO_CFG0, data);
+			} else {
+				RTMP_IO_READ32(pAd, LDO_CFG0, &data);
+				data = ((data & 0xE0FFFFFF) | 0x01000000);
+				RTMP_IO_WRITE32(pAd, LDO_CFG0, data);
+			}
+
+			/* patch LNA_PE_G1 failed issue */
+			RTUSBReadMACRegister(pAd, GPIO_SWITCH, &data);
+			data &= ~(0x20);
+			RTUSBWriteMACRegister(pAd, GPIO_SWITCH, data);
+		}
+		/*For RF filter Calibration */
+		RTMPFilterCalibration(pAd);
+
+		/* Initialize RF R27 register, set RF R27 must be behind RTMPFilterCalibration() */
+		/* */
+		/* TX to RX IQ glitch(RF_R27) has been fixed in RT3070(F). */
+		/* Raising RF voltage is no longer needed for RT3070(F) */
+		/* */
+		if ((IS_RT3070(pAd)) && ((pAd->MACVersion & 0xffff) < 0x0201)) {
+			RT30xxWriteRFRegister(pAd, RF_R27, 0x3);
+		} else if ((IS_RT3071(pAd))
+			   && ((pAd->MACVersion & 0xffff) < 0x0211)) {
+			RT30xxWriteRFRegister(pAd, RF_R27, 0x3);
+		}
+		/* set led open drain enable */
+		RTUSBReadMACRegister(pAd, OPT_14, &data);
+		data |= 0x01;
+		RTUSBWriteMACRegister(pAd, OPT_14, data);
+
+		/* move from RT30xxLoadRFNormalModeSetup because it's needed for both RT3070 and RT3071 */
+		/* TX_LO1_en, RF R17 register Bit 3 to 0 */
+		RT30xxReadRFRegister(pAd, RF_R17, &RFValue);
+		RFValue &= (~0x08);
+		/* to fix rx long range issue */
+		if (pAd->NicConfig2.field.ExternalLNAForG == 0) {
+			if ((IS_RT3071(pAd)
+			     && ((pAd->MACVersion & 0xffff) >= 0x0211))
+			    || IS_RT3070(pAd)) {
+				RFValue |= 0x20;
+			}
+		}
+		/* set RF_R17_bit[2:0] equal to EEPROM setting at 0x48h */
+		if (pAd->TxMixerGain24G >= 1) {
+			RFValue &= (~0x7);	/* clean bit [2:0] */
+			RFValue |= pAd->TxMixerGain24G;
+		}
+		RT30xxWriteRFRegister(pAd, RF_R17, RFValue);
+
+		if (IS_RT3071(pAd)) {
+			/* add by johnli, RF power sequence setup, load RF normal operation-mode setup */
+			RT30xxLoadRFNormalModeSetup(pAd);
+		} else if (IS_RT3070(pAd)) {
+			/* add by johnli, reset RF_R27 when interface down & up to fix throughput problem */
+			/* LDORF_VC, RF R27 register Bit 2 to 0 */
+			RT30xxReadRFRegister(pAd, RF_R27, &RFValue);
+			/* TX to RX IQ glitch(RF_R27) has been fixed in RT3070(F). */
+			/* Raising RF voltage is no longer needed for RT3070(F) */
+			if ((pAd->MACVersion & 0xffff) < 0x0201)
+				RFValue = (RFValue & (~0x77)) | 0x3;
+			else
+				RFValue = (RFValue & (~0x77));
+			RT30xxWriteRFRegister(pAd, RF_R27, RFValue);
+			/* end johnli */
+		}
+	}
+
+}
+#endif /* RT3070 // */
diff --git a/drivers/staging/rt3090/chips/rt3090.c b/drivers/staging/rt2860/chips/rt3090.c
index 35c549dc4ce1..5927ba4c5a9b 100644
--- a/drivers/staging/rt3090/chips/rt3090.c
+++ b/drivers/staging/rt2860/chips/rt3090.c
@@ -39,85 +39,81 @@
 
 #include "../rt_config.h"
 
-
 #ifndef RTMP_RF_RW_SUPPORT
 #error "You Should Enable compile flag RTMP_RF_RW_SUPPORT for this chip"
-#endif // RTMP_RF_RW_SUPPORT //
-
+#endif /* RTMP_RF_RW_SUPPORT // */
 
-VOID NICInitRT3090RFRegisters(IN PRTMP_ADAPTER pAd)
+void NICInitRT3090RFRegisters(struct rt_rtmp_adapter *pAd)
 {
-		INT i;
-	// Driver must read EEPROM to get RfIcType before initial RF registers
-	// Initialize RF register to default value
-	if (IS_RT3090(pAd))
-	{
-		// Init RF calibration
-		// Driver should toggle RF R30 bit7 before init RF registers
-		UINT32 RfReg = 0, data;
-
-		RT30xxReadRFRegister(pAd, RF_R30, (PUCHAR)&RfReg);
+	int i;
+	/* Driver must read EEPROM to get RfIcType before initial RF registers */
+	/* Initialize RF register to default value */
+	if (IS_RT3090(pAd)) {
+		/* Init RF calibration */
+		/* Driver should toggle RF R30 bit7 before init RF registers */
+		u32 RfReg = 0, data;
+
+		RT30xxReadRFRegister(pAd, RF_R30, (u8 *)& RfReg);
 		RfReg |= 0x80;
-		RT30xxWriteRFRegister(pAd, RF_R30, (UCHAR)RfReg);
+		RT30xxWriteRFRegister(pAd, RF_R30, (u8)RfReg);
 		RTMPusecDelay(1000);
 		RfReg &= 0x7F;
-		RT30xxWriteRFRegister(pAd, RF_R30, (UCHAR)RfReg);
+		RT30xxWriteRFRegister(pAd, RF_R30, (u8)RfReg);
 
-		// init R24, R31
+		/* init R24, R31 */
 		RT30xxWriteRFRegister(pAd, RF_R24, 0x0F);
 		RT30xxWriteRFRegister(pAd, RF_R31, 0x0F);
 
-		// RT309x version E has fixed this issue
-		if ((pAd->NicConfig2.field.DACTestBit == 1) && ((pAd->MACVersion & 0xffff) < 0x0211))
-		{
-			// patch tx EVM issue temporarily
+		/* RT309x version E has fixed this issue */
+		if ((pAd->NicConfig2.field.DACTestBit == 1)
+		    && ((pAd->MACVersion & 0xffff) < 0x0211)) {
+			/* patch tx EVM issue temporarily */
 			RTMP_IO_READ32(pAd, LDO_CFG0, &data);
 			data = ((data & 0xE0FFFFFF) | 0x0D000000);
 			RTMP_IO_WRITE32(pAd, LDO_CFG0, data);
-		}
-		else
-		{
+		} else {
 			RTMP_IO_READ32(pAd, LDO_CFG0, &data);
 			data = ((data & 0xE0FFFFFF) | 0x01000000);
 			RTMP_IO_WRITE32(pAd, LDO_CFG0, data);
 		}
 
-		// patch LNA_PE_G1 failed issue
+		/* patch LNA_PE_G1 failed issue */
 		RTMP_IO_READ32(pAd, GPIO_SWITCH, &data);
 		data &= ~(0x20);
 		RTMP_IO_WRITE32(pAd, GPIO_SWITCH, data);
 
-		// Initialize RF register to default value
-		for (i = 0; i < NUM_RF_REG_PARMS; i++)
-		{
-			RT30xxWriteRFRegister(pAd, RT30xx_RFRegTable[i].Register, RT30xx_RFRegTable[i].Value);
+		/* Initialize RF register to default value */
+		for (i = 0; i < NUM_RF_REG_PARMS; i++) {
+			RT30xxWriteRFRegister(pAd,
+					      RT30xx_RFRegTable[i].Register,
+					      RT30xx_RFRegTable[i].Value);
 		}
 
-		// Driver should set RF R6 bit6 on before calibration
-		RT30xxReadRFRegister(pAd, RF_R06, (PUCHAR)&RfReg);
+		/* Driver should set RF R6 bit6 on before calibration */
+		RT30xxReadRFRegister(pAd, RF_R06, (u8 *)& RfReg);
 		RfReg |= 0x40;
-		RT30xxWriteRFRegister(pAd, RF_R06, (UCHAR)RfReg);
+		RT30xxWriteRFRegister(pAd, RF_R06, (u8)RfReg);
 
-		//For RF filter Calibration
+		/*For RF filter Calibration */
 		RTMPFilterCalibration(pAd);
 
-		// Initialize RF R27 register, set RF R27 must be behind RTMPFilterCalibration()
+		/* Initialize RF R27 register, set RF R27 must be behind RTMPFilterCalibration() */
 		if ((pAd->MACVersion & 0xffff) < 0x0211)
 			RT30xxWriteRFRegister(pAd, RF_R27, 0x3);
 
-		// set led open drain enable
+		/* set led open drain enable */
 		RTMP_IO_READ32(pAd, OPT_14, &data);
 		data |= 0x01;
 		RTMP_IO_WRITE32(pAd, OPT_14, data);
 
-		// set default antenna as main
+		/* set default antenna as main */
 		if (pAd->RfIcType == RFIC_3020)
 			AsicSetRxAnt(pAd, pAd->RxAnt.Pair1PrimaryRxAnt);
 
-		// add by johnli, RF power sequence setup, load RF normal operation-mode setup
+		/* add by johnli, RF power sequence setup, load RF normal operation-mode setup */
 		RT30xxLoadRFNormalModeSetup(pAd);
 	}
 
 }
 
-#endif // RT3090 //
+#endif /* RT3090 // */
diff --git a/drivers/staging/rt3090/chips/rt30xx.c b/drivers/staging/rt2860/chips/rt30xx.c
index 9c8ae009dff9..6e684a3ccf0e 100644
--- a/drivers/staging/rt3090/chips/rt30xx.c
+++ b/drivers/staging/rt2860/chips/rt30xx.c
@@ -35,104 +35,114 @@
 	--------    ----------    ----------------------------------------------
 */
 
-
 #ifdef RT30xx
 
-
 #ifndef RTMP_RF_RW_SUPPORT
 #error "You Should Enable compile flag RTMP_RF_RW_SUPPORT for this chip"
-#endif // RTMP_RF_RW_SUPPORT //
+#endif /* RTMP_RF_RW_SUPPORT // */
 
 #include "../rt_config.h"
 
-
-//
-// RF register initialization set
-//
-REG_PAIR   RT30xx_RFRegTable[] = {
-        {RF_R04,          0x40},
-        {RF_R05,          0x03},
-        {RF_R06,          0x02},
-        {RF_R07,          0x70},
-        {RF_R09,          0x0F},
-        {RF_R10,          0x41},
-        {RF_R11,          0x21},
-        {RF_R12,          0x7B},
-        {RF_R14,          0x90},
-        {RF_R15,          0x58},
-        {RF_R16,          0xB3},
-        {RF_R17,          0x92},
-        {RF_R18,          0x2C},
-        {RF_R19,          0x02},
-        {RF_R20,          0xBA},
-        {RF_R21,          0xDB},
-        {RF_R24,          0x16},
-        {RF_R25,          0x01},
-        {RF_R29,          0x1F},
+/* */
+/* RF register initialization set */
+/* */
+struct rt_reg_pair RT30xx_RFRegTable[] = {
+	{RF_R04, 0x40}
+	,
+	{RF_R05, 0x03}
+	,
+	{RF_R06, 0x02}
+	,
+	{RF_R07, 0x70}
+	,
+	{RF_R09, 0x0F}
+	,
+	{RF_R10, 0x41}
+	,
+	{RF_R11, 0x21}
+	,
+	{RF_R12, 0x7B}
+	,
+	{RF_R14, 0x90}
+	,
+	{RF_R15, 0x58}
+	,
+	{RF_R16, 0xB3}
+	,
+	{RF_R17, 0x92}
+	,
+	{RF_R18, 0x2C}
+	,
+	{RF_R19, 0x02}
+	,
+	{RF_R20, 0xBA}
+	,
+	{RF_R21, 0xDB}
+	,
+	{RF_R24, 0x16}
+	,
+	{RF_R25, 0x01}
+	,
+	{RF_R29, 0x1F}
+	,
 };
 
-UCHAR NUM_RF_REG_PARMS = (sizeof(RT30xx_RFRegTable) / sizeof(REG_PAIR));
+u8 NUM_RF_REG_PARMS = (sizeof(RT30xx_RFRegTable) / sizeof(struct rt_reg_pair));
 
-
-
-// Antenna divesity use GPIO3 and EESK pin for control
-// Antenna and EEPROM access are both using EESK pin,
-// Therefor we should avoid accessing EESK at the same time
-// Then restore antenna after EEPROM access
-// The original name of this function is AsicSetRxAnt(), now change to
-//VOID AsicSetRxAnt(
-VOID RT30xxSetRxAnt(
-	IN PRTMP_ADAPTER	pAd,
-	IN UCHAR			Ant)
+/* Antenna divesity use GPIO3 and EESK pin for control */
+/* Antenna and EEPROM access are both using EESK pin, */
+/* Therefor we should avoid accessing EESK at the same time */
+/* Then restore antenna after EEPROM access */
+/* The original name of this function is AsicSetRxAnt(), now change to */
+/*void AsicSetRxAnt( */
+void RT30xxSetRxAnt(struct rt_rtmp_adapter *pAd, u8 Ant)
 {
-	UINT32	Value;
-	UINT32	x;
+	u32 Value;
+#ifdef RTMP_MAC_PCI
+	u32 x;
+#endif
 
 	if ((pAd->EepromAccess) ||
-		(RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RESET_IN_PROGRESS))	||
-		(RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS))	||
-		(RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RADIO_OFF)) ||
-		(RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)))
-	{
+	    (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RESET_IN_PROGRESS)) ||
+	    (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS)) ||
+	    (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RADIO_OFF)) ||
+	    (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST))) {
 		return;
 	}
-
-	// the antenna selection is through firmware and MAC register(GPIO3)
-	if (Ant == 0)
-	{
-		// Main antenna
+	/* the antenna selection is through firmware and MAC register(GPIO3) */
+	if (Ant == 0) {
+		/* Main antenna */
 #ifdef RTMP_MAC_PCI
 		RTMP_IO_READ32(pAd, E2PROM_CSR, &x);
 		x |= (EESK);
 		RTMP_IO_WRITE32(pAd, E2PROM_CSR, x);
 #else
 		AsicSendCommandToMcu(pAd, 0x73, 0xFF, 0x1, 0x0);
-#endif // RTMP_MAC_PCI //
+#endif /* RTMP_MAC_PCI // */
 
 		RTMP_IO_READ32(pAd, GPIO_CTRL_CFG, &Value);
 		Value &= ~(0x0808);
 		RTMP_IO_WRITE32(pAd, GPIO_CTRL_CFG, Value);
-		DBGPRINT_RAW(RT_DEBUG_TRACE, ("AsicSetRxAnt, switch to main antenna\n"));
-	}
-	else
-	{
-		// Aux antenna
+		DBGPRINT_RAW(RT_DEBUG_TRACE,
+			     ("AsicSetRxAnt, switch to main antenna\n"));
+	} else {
+		/* Aux antenna */
 #ifdef RTMP_MAC_PCI
 		RTMP_IO_READ32(pAd, E2PROM_CSR, &x);
 		x &= ~(EESK);
 		RTMP_IO_WRITE32(pAd, E2PROM_CSR, x);
 #else
 		AsicSendCommandToMcu(pAd, 0x73, 0xFF, 0x0, 0x0);
-#endif // RTMP_MAC_PCI //
+#endif /* RTMP_MAC_PCI // */
 		RTMP_IO_READ32(pAd, GPIO_CTRL_CFG, &Value);
 		Value &= ~(0x0808);
 		Value |= 0x08;
 		RTMP_IO_WRITE32(pAd, GPIO_CTRL_CFG, Value);
-		DBGPRINT_RAW(RT_DEBUG_TRACE, ("AsicSetRxAnt, switch to aux antenna\n"));
+		DBGPRINT_RAW(RT_DEBUG_TRACE,
+			     ("AsicSetRxAnt, switch to aux antenna\n"));
 	}
 }
 
-
 /*
 	========================================================================
 
@@ -149,161 +159,145 @@ VOID RT30xxSetRxAnt(
 
 	========================================================================
 */
-VOID RTMPFilterCalibration(
-	IN PRTMP_ADAPTER pAd)
+void RTMPFilterCalibration(struct rt_rtmp_adapter *pAd)
 {
-	UCHAR	R55x = 0, value, FilterTarget = 0x1E, BBPValue=0;
-	UINT	loop = 0, count = 0, loopcnt = 0, ReTry = 0;
-	UCHAR	RF_R24_Value = 0;
+	u8 R55x = 0, value, FilterTarget = 0x1E, BBPValue = 0;
+	u32 loop = 0, count = 0, loopcnt = 0, ReTry = 0;
+	u8 RF_R24_Value = 0;
 
-	// Give bbp filter initial value
+	/* Give bbp filter initial value */
 	pAd->Mlme.CaliBW20RfR24 = 0x1F;
-	pAd->Mlme.CaliBW40RfR24 = 0x2F; //Bit[5] must be 1 for BW 40
+	pAd->Mlme.CaliBW40RfR24 = 0x2F;	/*Bit[5] must be 1 for BW 40 */
 
-	do
-	{
-		if (loop == 1)	//BandWidth = 40 MHz
+	do {
+		if (loop == 1)	/*BandWidth = 40 MHz */
 		{
-			// Write 0x27 to RF_R24 to program filter
+			/* Write 0x27 to RF_R24 to program filter */
 			RF_R24_Value = 0x27;
 			RT30xxWriteRFRegister(pAd, RF_R24, RF_R24_Value);
-			if (IS_RT3090(pAd) || IS_RT3572(pAd)|| IS_RT3390(pAd))
+			if (IS_RT3090(pAd) || IS_RT3572(pAd) || IS_RT3390(pAd))
 				FilterTarget = 0x15;
 			else
 				FilterTarget = 0x19;
 
-			// when calibrate BW40, BBP mask must set to BW40.
+			/* when calibrate BW40, BBP mask must set to BW40. */
 			RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R4, &BBPValue);
-			BBPValue&= (~0x18);
-			BBPValue|= (0x10);
+			BBPValue &= (~0x18);
+			BBPValue |= (0x10);
 			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R4, BBPValue);
 
-			// set to BW40
+			/* set to BW40 */
 			RT30xxReadRFRegister(pAd, RF_R31, &value);
 			value |= 0x20;
 			RT30xxWriteRFRegister(pAd, RF_R31, value);
-		}
-		else			//BandWidth = 20 MHz
+		} else		/*BandWidth = 20 MHz */
 		{
-			// Write 0x07 to RF_R24 to program filter
+			/* Write 0x07 to RF_R24 to program filter */
 			RF_R24_Value = 0x07;
 			RT30xxWriteRFRegister(pAd, RF_R24, RF_R24_Value);
-			if (IS_RT3090(pAd) || IS_RT3572(pAd)|| IS_RT3390(pAd))
+			if (IS_RT3090(pAd) || IS_RT3572(pAd) || IS_RT3390(pAd))
 				FilterTarget = 0x13;
 			else
 				FilterTarget = 0x16;
 
-			// set to BW20
+			/* set to BW20 */
 			RT30xxReadRFRegister(pAd, RF_R31, &value);
 			value &= (~0x20);
 			RT30xxWriteRFRegister(pAd, RF_R31, value);
 		}
 
-		// Write 0x01 to RF_R22 to enable baseband loopback mode
+		/* Write 0x01 to RF_R22 to enable baseband loopback mode */
 		RT30xxReadRFRegister(pAd, RF_R22, &value);
 		value |= 0x01;
 		RT30xxWriteRFRegister(pAd, RF_R22, value);
 
-		// Write 0x00 to BBP_R24 to set power & frequency of passband test tone
+		/* Write 0x00 to BBP_R24 to set power & frequency of passband test tone */
 		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R24, 0);
 
-		do
-		{
-			// Write 0x90 to BBP_R25 to transmit test tone
+		do {
+			/* Write 0x90 to BBP_R25 to transmit test tone */
 			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R25, 0x90);
 
 			RTMPusecDelay(1000);
-			// Read BBP_R55[6:0] for received power, set R55x = BBP_R55[6:0]
+			/* Read BBP_R55[6:0] for received power, set R55x = BBP_R55[6:0] */
 			RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R55, &value);
 			R55x = value & 0xFF;
 
 		} while ((ReTry++ < 100) && (R55x == 0));
 
-		// Write 0x06 to BBP_R24 to set power & frequency of stopband test tone
+		/* Write 0x06 to BBP_R24 to set power & frequency of stopband test tone */
 		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R24, 0x06);
 
-		while(TRUE)
-		{
-			// Write 0x90 to BBP_R25 to transmit test tone
+		while (TRUE) {
+			/* Write 0x90 to BBP_R25 to transmit test tone */
 			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R25, 0x90);
 
-			//We need to wait for calibration
+			/*We need to wait for calibration */
 			RTMPusecDelay(1000);
 			RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R55, &value);
 			value &= 0xFF;
-			if ((R55x - value) < FilterTarget)
-			{
-				RF_R24_Value ++;
-			}
-			else if ((R55x - value) == FilterTarget)
-			{
-				RF_R24_Value ++;
-				count ++;
-			}
-			else
-			{
+			if ((R55x - value) < FilterTarget) {
+				RF_R24_Value++;
+			} else if ((R55x - value) == FilterTarget) {
+				RF_R24_Value++;
+				count++;
+			} else {
 				break;
 			}
 
-			// prevent infinite loop cause driver hang.
-			if (loopcnt++ > 100)
-			{
-				DBGPRINT(RT_DEBUG_ERROR, ("RTMPFilterCalibration - can't find a valid value, loopcnt=%d stop calibrating", loopcnt));
+			/* prevent infinite loop cause driver hang. */
+			if (loopcnt++ > 100) {
+				DBGPRINT(RT_DEBUG_ERROR,
+					 ("RTMPFilterCalibration - can't find a valid value, loopcnt=%d stop calibrating",
+					  loopcnt));
 				break;
 			}
-
-			// Write RF_R24 to program filter
+			/* Write RF_R24 to program filter */
 			RT30xxWriteRFRegister(pAd, RF_R24, RF_R24_Value);
 		}
 
-		if (count > 0)
-		{
+		if (count > 0) {
 			RF_R24_Value = RF_R24_Value - ((count) ? (1) : (0));
 		}
-
-		// Store for future usage
-		if (loopcnt < 100)
-		{
-			if (loop++ == 0)
-			{
-				//BandWidth = 20 MHz
-				pAd->Mlme.CaliBW20RfR24 = (UCHAR)RF_R24_Value;
-			}
-			else
-			{
-				//BandWidth = 40 MHz
-				pAd->Mlme.CaliBW40RfR24 = (UCHAR)RF_R24_Value;
+		/* Store for future usage */
+		if (loopcnt < 100) {
+			if (loop++ == 0) {
+				/*BandWidth = 20 MHz */
+				pAd->Mlme.CaliBW20RfR24 = (u8)RF_R24_Value;
+			} else {
+				/*BandWidth = 40 MHz */
+				pAd->Mlme.CaliBW40RfR24 = (u8)RF_R24_Value;
 				break;
 			}
-		}
-		else
+		} else
 			break;
 
 		RT30xxWriteRFRegister(pAd, RF_R24, RF_R24_Value);
 
-		// reset count
+		/* reset count */
 		count = 0;
-	} while(TRUE);
+	} while (TRUE);
 
-	//
-	// Set back to initial state
-	//
+	/* */
+	/* Set back to initial state */
+	/* */
 	RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R24, 0);
 
 	RT30xxReadRFRegister(pAd, RF_R22, &value);
 	value &= ~(0x01);
 	RT30xxWriteRFRegister(pAd, RF_R22, value);
 
-	// set BBP back to BW20
+	/* set BBP back to BW20 */
 	RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R4, &BBPValue);
-	BBPValue&= (~0x18);
+	BBPValue &= (~0x18);
 	RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R4, BBPValue);
 
-	DBGPRINT(RT_DEBUG_TRACE, ("RTMPFilterCalibration - CaliBW20RfR24=0x%x, CaliBW40RfR24=0x%x\n", pAd->Mlme.CaliBW20RfR24, pAd->Mlme.CaliBW40RfR24));
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("RTMPFilterCalibration - CaliBW20RfR24=0x%x, CaliBW40RfR24=0x%x\n",
+		  pAd->Mlme.CaliBW20RfR24, pAd->Mlme.CaliBW40RfR24));
 }
 
-
-// add by johnli, RF power sequence setup
+/* add by johnli, RF power sequence setup */
 /*
 	==========================================================================
 	Description:
@@ -312,55 +306,54 @@ VOID RTMPFilterCalibration(
 
 	==========================================================================
  */
-VOID RT30xxLoadRFNormalModeSetup(
-	IN PRTMP_ADAPTER	pAd)
+void RT30xxLoadRFNormalModeSetup(struct rt_rtmp_adapter *pAd)
 {
-	UCHAR RFValue;
+	u8 RFValue;
 
-	// RX0_PD & TX0_PD, RF R1 register Bit 2 & Bit 3 to 0 and RF_BLOCK_en,RX1_PD & TX1_PD, Bit0, Bit 4 & Bit5 to 1
+	/* RX0_PD & TX0_PD, RF R1 register Bit 2 & Bit 3 to 0 and RF_BLOCK_en,RX1_PD & TX1_PD, Bit0, Bit 4 & Bit5 to 1 */
 	RT30xxReadRFRegister(pAd, RF_R01, &RFValue);
 	RFValue = (RFValue & (~0x0C)) | 0x31;
 	RT30xxWriteRFRegister(pAd, RF_R01, RFValue);
 
-	// TX_LO2_en, RF R15 register Bit 3 to 0
+	/* TX_LO2_en, RF R15 register Bit 3 to 0 */
 	RT30xxReadRFRegister(pAd, RF_R15, &RFValue);
 	RFValue &= (~0x08);
 	RT30xxWriteRFRegister(pAd, RF_R15, RFValue);
 
 	/* move to NICInitRT30xxRFRegisters
-	// TX_LO1_en, RF R17 register Bit 3 to 0
-	RT30xxReadRFRegister(pAd, RF_R17, &RFValue);
-	RFValue &= (~0x08);
-	// to fix rx long range issue
-	if (((pAd->MACVersion & 0xffff) >= 0x0211) && (pAd->NicConfig2.field.ExternalLNAForG == 0))
-	{
-		RFValue |= 0x20;
-	}
-	// set RF_R17_bit[2:0] equal to EEPROM setting at 0x48h
-	if (pAd->TxMixerGain24G >= 2)
-	{
-		RFValue &= (~0x7);  // clean bit [2:0]
-		RFValue |= pAd->TxMixerGain24G;
-	}
-	RT30xxWriteRFRegister(pAd, RF_R17, RFValue);
-	*/
-
-	// RX_LO1_en, RF R20 register Bit 3 to 0
+	   // TX_LO1_en, RF R17 register Bit 3 to 0
+	   RT30xxReadRFRegister(pAd, RF_R17, &RFValue);
+	   RFValue &= (~0x08);
+	   // to fix rx long range issue
+	   if (((pAd->MACVersion & 0xffff) >= 0x0211) && (pAd->NicConfig2.field.ExternalLNAForG == 0))
+	   {
+	   RFValue |= 0x20;
+	   }
+	   // set RF_R17_bit[2:0] equal to EEPROM setting at 0x48h
+	   if (pAd->TxMixerGain24G >= 2)
+	   {
+	   RFValue &= (~0x7);  // clean bit [2:0]
+	   RFValue |= pAd->TxMixerGain24G;
+	   }
+	   RT30xxWriteRFRegister(pAd, RF_R17, RFValue);
+	 */
+
+	/* RX_LO1_en, RF R20 register Bit 3 to 0 */
 	RT30xxReadRFRegister(pAd, RF_R20, &RFValue);
 	RFValue &= (~0x08);
 	RT30xxWriteRFRegister(pAd, RF_R20, RFValue);
 
-	// RX_LO2_en, RF R21 register Bit 3 to 0
+	/* RX_LO2_en, RF R21 register Bit 3 to 0 */
 	RT30xxReadRFRegister(pAd, RF_R21, &RFValue);
 	RFValue &= (~0x08);
 	RT30xxWriteRFRegister(pAd, RF_R21, RFValue);
 
-	/* add by johnli, reset RF_R27 when interface down & up to fix throughput problem*/
-	// LDORF_VC, RF R27 register Bit 2 to 0
+	/* add by johnli, reset RF_R27 when interface down & up to fix throughput problem */
+	/* LDORF_VC, RF R27 register Bit 2 to 0 */
 	RT30xxReadRFRegister(pAd, RF_R27, &RFValue);
-	// TX to RX IQ glitch(RF_R27) has been fixed in RT3070(F).
-	// Raising RF voltage is no longer needed for RT3070(F)
-	if (IS_RT3090(pAd))	// RT309x and RT3071/72
+	/* TX to RX IQ glitch(RF_R27) has been fixed in RT3070(F). */
+	/* Raising RF voltage is no longer needed for RT3070(F) */
+	if (IS_RT3090(pAd))	/* RT309x and RT3071/72 */
 	{
 		if ((pAd->MACVersion & 0xffff) < 0x0211)
 			RFValue = (RFValue & (~0x77)) | 0x3;
@@ -379,39 +372,42 @@ VOID RT30xxLoadRFNormalModeSetup(
 
 	==========================================================================
  */
-VOID RT30xxLoadRFSleepModeSetup(
-	IN PRTMP_ADAPTER	pAd)
+void RT30xxLoadRFSleepModeSetup(struct rt_rtmp_adapter *pAd)
 {
-	UCHAR RFValue;
-	UINT32 MACValue;
-
+	u8 RFValue;
+	u32 MACValue;
 
+#ifdef RTMP_MAC_USB
+	if (!IS_RT3572(pAd))
+#endif /* RTMP_MAC_USB // */
 	{
-		// RF_BLOCK_en. RF R1 register Bit 0 to 0
+		/* RF_BLOCK_en. RF R1 register Bit 0 to 0 */
 		RT30xxReadRFRegister(pAd, RF_R01, &RFValue);
 		RFValue &= (~0x01);
 		RT30xxWriteRFRegister(pAd, RF_R01, RFValue);
 
-		// VCO_IC, RF R7 register Bit 4 & Bit 5 to 0
+		/* VCO_IC, RF R7 register Bit 4 & Bit 5 to 0 */
 		RT30xxReadRFRegister(pAd, RF_R07, &RFValue);
 		RFValue &= (~0x30);
 		RT30xxWriteRFRegister(pAd, RF_R07, RFValue);
 
-		// Idoh, RF R9 register Bit 1, Bit 2 & Bit 3 to 0
+		/* Idoh, RF R9 register Bit 1, Bit 2 & Bit 3 to 0 */
 		RT30xxReadRFRegister(pAd, RF_R09, &RFValue);
 		RFValue &= (~0x0E);
 		RT30xxWriteRFRegister(pAd, RF_R09, RFValue);
 
-		// RX_CTB_en, RF R21 register Bit 7 to 0
+		/* RX_CTB_en, RF R21 register Bit 7 to 0 */
 		RT30xxReadRFRegister(pAd, RF_R21, &RFValue);
 		RFValue &= (~0x80);
 		RT30xxWriteRFRegister(pAd, RF_R21, RFValue);
 	}
 
-	if (IS_RT3090(pAd) ||	// IS_RT3090 including RT309x and RT3071/72
-		IS_RT3572(pAd) ||
-		(IS_RT3070(pAd) && ((pAd->MACVersion & 0xffff) < 0x0201)))
-	{
+	if (IS_RT3090(pAd) ||	/* IS_RT3090 including RT309x and RT3071/72 */
+	    IS_RT3572(pAd) ||
+	    (IS_RT3070(pAd) && ((pAd->MACVersion & 0xffff) < 0x0201))) {
+#ifdef RTMP_MAC_USB
+		if (!IS_RT3572(pAd))
+#endif /* RTMP_MAC_USB // */
 		{
 			RT30xxReadRFRegister(pAd, RF_R27, &RFValue);
 			RFValue |= 0x77;
@@ -432,39 +428,43 @@ VOID RT30xxLoadRFSleepModeSetup(
 
 	==========================================================================
  */
-VOID RT30xxReverseRFSleepModeSetup(
-	IN PRTMP_ADAPTER	pAd)
+void RT30xxReverseRFSleepModeSetup(struct rt_rtmp_adapter *pAd)
 {
-	UCHAR RFValue;
-	UINT32 MACValue;
+	u8 RFValue;
+	u32 MACValue;
 
+#ifdef RTMP_MAC_USB
+	if (!IS_RT3572(pAd))
+#endif /* RTMP_MAC_USB // */
 	{
-		// RF_BLOCK_en, RF R1 register Bit 0 to 1
+		/* RF_BLOCK_en, RF R1 register Bit 0 to 1 */
 		RT30xxReadRFRegister(pAd, RF_R01, &RFValue);
 		RFValue |= 0x01;
 		RT30xxWriteRFRegister(pAd, RF_R01, RFValue);
 
-		// VCO_IC, RF R7 register Bit 4 & Bit 5 to 1
+		/* VCO_IC, RF R7 register Bit 4 & Bit 5 to 1 */
 		RT30xxReadRFRegister(pAd, RF_R07, &RFValue);
 		RFValue |= 0x30;
 		RT30xxWriteRFRegister(pAd, RF_R07, RFValue);
 
-		// Idoh, RF R9 register Bit 1, Bit 2 & Bit 3 to 1
+		/* Idoh, RF R9 register Bit 1, Bit 2 & Bit 3 to 1 */
 		RT30xxReadRFRegister(pAd, RF_R09, &RFValue);
 		RFValue |= 0x0E;
 		RT30xxWriteRFRegister(pAd, RF_R09, RFValue);
 
-		// RX_CTB_en, RF R21 register Bit 7 to 1
+		/* RX_CTB_en, RF R21 register Bit 7 to 1 */
 		RT30xxReadRFRegister(pAd, RF_R21, &RFValue);
 		RFValue |= 0x80;
 		RT30xxWriteRFRegister(pAd, RF_R21, RFValue);
 	}
 
-	if (IS_RT3090(pAd) ||	// IS_RT3090 including RT309x and RT3071/72
-		IS_RT3572(pAd) ||
-		IS_RT3390(pAd) ||
-		(IS_RT3070(pAd) && ((pAd->MACVersion & 0xffff) < 0x0201)))
-	{
+	if (IS_RT3090(pAd) ||	/* IS_RT3090 including RT309x and RT3071/72 */
+	    IS_RT3572(pAd) ||
+	    IS_RT3390(pAd) ||
+	    (IS_RT3070(pAd) && ((pAd->MACVersion & 0xffff) < 0x0201))) {
+#ifdef RTMP_MAC_USB
+		if (!IS_RT3572(pAd))
+#endif /* RTMP_MAC_USB // */
 		{
 			RT30xxReadRFRegister(pAd, RF_R27, &RFValue);
 			if ((pAd->MACVersion & 0xffff) < 0x0211)
@@ -473,48 +473,41 @@ VOID RT30xxReverseRFSleepModeSetup(
 				RFValue = (RFValue & (~0x77));
 			RT30xxWriteRFRegister(pAd, RF_R27, RFValue);
 		}
-
-		// RT3071 version E has fixed this issue
-		if ((pAd->NicConfig2.field.DACTestBit == 1) && ((pAd->MACVersion & 0xffff) < 0x0211))
-		{
-			// patch tx EVM issue temporarily
+		/* RT3071 version E has fixed this issue */
+		if ((pAd->NicConfig2.field.DACTestBit == 1)
+		    && ((pAd->MACVersion & 0xffff) < 0x0211)) {
+			/* patch tx EVM issue temporarily */
 			RTMP_IO_READ32(pAd, LDO_CFG0, &MACValue);
 			MACValue = ((MACValue & 0xE0FFFFFF) | 0x0D000000);
 			RTMP_IO_WRITE32(pAd, LDO_CFG0, MACValue);
-		}
-		else
-		{
+		} else {
 			RTMP_IO_READ32(pAd, LDO_CFG0, &MACValue);
 			MACValue = ((MACValue & 0xE0FFFFFF) | 0x01000000);
 			RTMP_IO_WRITE32(pAd, LDO_CFG0, MACValue);
 		}
 	}
 
-	if(IS_RT3572(pAd))
+	if (IS_RT3572(pAd))
 		RT30xxWriteRFRegister(pAd, RF_R08, 0x80);
 }
-// end johnli
 
-VOID RT30xxHaltAction(
-	IN PRTMP_ADAPTER	pAd)
+/* end johnli */
+
+void RT30xxHaltAction(struct rt_rtmp_adapter *pAd)
 {
-	UINT32		TxPinCfg = 0x00050F0F;
+	u32 TxPinCfg = 0x00050F0F;
 
-	//
-	// Turn off LNA_PE or TRSW_POL
-	//
-	if (IS_RT3070(pAd) || IS_RT3071(pAd) || IS_RT3572(pAd))
-	{
+	/* */
+	/* Turn off LNA_PE or TRSW_POL */
+	/* */
+	if (IS_RT3070(pAd) || IS_RT3071(pAd) || IS_RT3572(pAd)) {
 		if ((IS_RT3071(pAd) || IS_RT3572(pAd))
 #ifdef RTMP_EFUSE_SUPPORT
-			&& (pAd->bUseEfuse)
-#endif // RTMP_EFUSE_SUPPORT //
-			)
-		{
-			TxPinCfg &= 0xFFFBF0F0; // bit18 off
-		}
-		else
-		{
+		    && (pAd->bUseEfuse)
+#endif /* RTMP_EFUSE_SUPPORT // */
+		    ) {
+			TxPinCfg &= 0xFFFBF0F0;	/* bit18 off */
+		} else {
 			TxPinCfg &= 0xFFFFF0F0;
 		}
 
@@ -522,4 +515,4 @@ VOID RT30xxHaltAction(
 	}
 }
 
-#endif // RT30xx //
+#endif /* RT30xx // */
diff --git a/drivers/staging/rt2860/chlist.h b/drivers/staging/rt2860/chlist.h
index f49a35c95de6..ada65e5ac610 100644
--- a/drivers/staging/rt2860/chlist.h
+++ b/drivers/staging/rt2860/chlist.h
@@ -41,7 +41,6 @@
 #include "rtmp_type.h"
 #include "rtmp_def.h"
 
-
 #define ODOR			0
 #define IDOR			1
 #define BOTH			2
@@ -50,1196 +49,69 @@
 #define BAND_24G        1
 #define BAND_BOTH       2
 
-typedef struct _CH_DESP {
-	UCHAR FirstChannel;
-	UCHAR NumOfCh;
-	CHAR MaxTxPwr;			// dBm
-	UCHAR Geography;			// 0:out door, 1:in door, 2:both
-	BOOLEAN DfsReq;			// Dfs require, 0: No, 1: yes.
-} CH_DESP, *PCH_DESP;
-
-typedef struct _CH_REGION {
-	UCHAR CountReg[3];
-	UCHAR DfsType;			// 0: CE, 1: FCC, 2: JAP, 3:JAP_W53, JAP_W56
-	CH_DESP ChDesp[10];
-} CH_REGION, *PCH_REGION;
-
-static CH_REGION ChRegion[] =
-{
-		{	// Antigua and Berbuda
-			"AG",
-			CE,
-			{
-				{ 1,   13, 20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,  23, BOTH, FALSE},	// 5G, ch 36~48
-				{ 52,  4,  23, BOTH, FALSE},	// 5G, ch 52~64
-				{ 100, 11, 30, BOTH, FALSE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Argentina
-			"AR",
-			CE,
-			{
-				{ 1,   13, 20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 52,  4,  24, BOTH, FALSE},	// 5G, ch 52~64
-				{ 149, 4,  30, BOTH, FALSE},	// 5G, ch 149~161
-				{ 0},							// end
-			}
-		},
-
-		{	// Aruba
-			"AW",
-			CE,
-			{
-				{ 1,   13, 20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,  23, BOTH, FALSE},	// 5G, ch 36~48
-				{ 52,  4,  23, BOTH, FALSE},	// 5G, ch 52~64
-				{ 100, 11, 30, BOTH, FALSE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Australia
-			"AU",
-			CE,
-			{
-				{ 1,   13, 20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,  23, BOTH, FALSE},	// 5G, ch 36~48
-				{ 52,  4,  24, BOTH, FALSE},	// 5G, ch 52~64
-				{ 149, 5,  30, BOTH, FALSE},	// 5G, ch 149~165
-				{ 0},							// end
-			}
-		},
-
-		{	// Austria
-			"AT",
-			CE,
-			{
-				{ 1,   13, 20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,  23, IDOR, TRUE},		// 5G, ch 36~48
-				{ 52,  4,  23, IDOR, TRUE},		// 5G, ch 52~64
-				{ 100, 11, 30, BOTH, TRUE},		// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Bahamas
-			"BS",
-			CE,
-			{
-				{ 1,   13, 20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,  23, BOTH, FALSE},	// 5G, ch 36~48
-				{ 52,  4,  24, BOTH, FALSE},	// 5G, ch 52~64
-				{ 149, 5,  30, BOTH, FALSE},	// 5G, ch 149~165
-				{ 0},							// end
-			}
-		},
-
-		{	// Barbados
-			"BB",
-			CE,
-			{
-				{ 1,   13, 20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,  23, BOTH, FALSE},	// 5G, ch 36~48
-				{ 52,  4,  24, BOTH, FALSE},	// 5G, ch 52~64
-				{ 100, 11, 30, BOTH, FALSE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Bermuda
-			"BM",
-			CE,
-			{
-				{ 1,   13, 20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,  23, BOTH, FALSE},	// 5G, ch 36~48
-				{ 52,  4,  24, BOTH, FALSE},	// 5G, ch 52~64
-				{ 100, 11, 30, BOTH, FALSE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Brazil
-			"BR",
-			CE,
-			{
-				{ 1,   13, 20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,  23, BOTH, FALSE},	// 5G, ch 36~48
-				{ 52,  4,  24, BOTH, FALSE},	// 5G, ch 52~64
-				{ 100, 11, 24, BOTH, FALSE},	// 5G, ch 100~140
-				{ 149, 5,  30, BOTH, FALSE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Belgium
-			"BE",
-			CE,
-			{
-				{ 1,   13, 20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,  18, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52,  4,  18, IDOR, FALSE},	// 5G, ch 52~64
-				{ 0},							// end
-			}
-		},
-
-		{	// Bulgaria
-			"BG",
-			CE,
-			{
-				{ 1,   13, 20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,  23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52,  4,  23, IDOR, TRUE},	// 5G, ch 52~64
-				{ 100, 11, 30, ODOR, TRUE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Canada
-			"CA",
-			CE,
-			{
-				{ 1,   13, 20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,  23, BOTH, FALSE},	// 5G, ch 36~48
-				{ 52,  4,  23, BOTH, FALSE},	// 5G, ch 52~64
-				{ 149, 5,  30, BOTH, FALSE},	// 5G, ch 149~165
-				{ 0},							// end
-			}
-		},
-
-		{	// Cayman IsLands
-			"KY",
-			CE,
-			{
-				{ 1,   13, 20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,  23, BOTH, FALSE},	// 5G, ch 36~48
-				{ 52,  4,  24, BOTH, FALSE},	// 5G, ch 52~64
-				{ 100, 11, 30, BOTH, FALSE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Chile
-			"CL",
-			CE,
-			{
-				{ 1,   13, 20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,  20, BOTH, FALSE},	// 5G, ch 36~48
-				{ 52,  4,  20, BOTH, FALSE},	// 5G, ch 52~64
-				{ 149, 5,  20, BOTH, FALSE},	// 5G, ch 149~165
-				{ 0},							// end
-			}
-		},
-
-		{	// China
-			"CN",
-			CE,
-			{
-				{ 1,   13, 20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 149, 4,  27, BOTH, FALSE},	// 5G, ch 149~161
-				{ 0},							// end
-			}
-		},
-
-		{	// Colombia
-			"CO",
-			CE,
-			{
-				{ 1,   13, 20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,  17, BOTH, FALSE},	// 5G, ch 36~48
-				{ 52,  4,  24, BOTH, FALSE},	// 5G, ch 52~64
-				{ 100, 11, 30, BOTH, FALSE},	// 5G, ch 100~140
-				{ 149, 5,  30, BOTH, FALSE},	// 5G, ch 149~165
-				{ 0},							// end
-			}
-		},
-
-		{	// Costa Rica
-			"CR",
-			CE,
-			{
-				{ 1,   13, 20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,  17, BOTH, FALSE},	// 5G, ch 36~48
-				{ 52,  4,  24, BOTH, FALSE},	// 5G, ch 52~64
-				{ 149, 4,  30, BOTH, FALSE},	// 5G, ch 149~161
-				{ 0},							// end
-			}
-		},
-
-		{	// Cyprus
-			"CY",
-			CE,
-			{
-				{ 1,   13, 20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,  23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52,  4,  24, IDOR, TRUE},		// 5G, ch 52~64
-				{ 100, 11, 30, BOTH, TRUE},		// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Czech_Republic
-			"CZ",
-			CE,
-			{
-				{ 1,   13, 20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,  23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52,  4,  23, IDOR, TRUE},		// 5G, ch 52~64
-				{ 0},							// end
-			}
-		},
-
-		{	// Denmark
-			"DK",
-			CE,
-			{
-				{ 1,   13, 20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,  23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52,  4,  23, IDOR, TRUE},		// 5G, ch 52~64
-				{ 100, 11, 30, BOTH, TRUE},		// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Dominican Republic
-			"DO",
-			CE,
-			{
-				{ 1,   0,  20, BOTH, FALSE},	// 2.4 G, ch 0
-				{ 149, 4,  20, BOTH, FALSE},	// 5G, ch 149~161
-				{ 0},							// end
-			}
-		},
-
-		{	// Equador
-			"EC",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 100, 11,  27, BOTH, FALSE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// El Salvador
-			"SV",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,   23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52,  4,   30, BOTH, TRUE},	// 5G, ch 52~64
-				{ 149, 4,   36, BOTH, TRUE},	// 5G, ch 149~165
-				{ 0},							// end
-			}
-		},
-
-		{	// Finland
-			"FI",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,   23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52,  4,   23, IDOR, TRUE},	// 5G, ch 52~64
-				{ 100, 11,  30, BOTH, TRUE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// France
-			"FR",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,   23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52,  4,   23, IDOR, TRUE},	// 5G, ch 52~64
-				{ 0},							// end
-			}
-		},
-
-		{	// Germany
-			"DE",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,   23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52,  4,   23, IDOR, TRUE},	// 5G, ch 52~64
-				{ 100, 11,  30, BOTH, TRUE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Greece
-			"GR",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,   23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52,  4,   23, IDOR, TRUE},	// 5G, ch 52~64
-				{ 100, 11,  30, ODOR, TRUE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Guam
-			"GU",
-			CE,
-			{
-				{ 1,   11,  20, BOTH, FALSE},	// 2.4 G, ch 1~11
-				{ 36,  4,   17, BOTH, FALSE},	// 5G, ch 36~48
-				{ 52,  4,   24, BOTH, FALSE},	// 5G, ch 52~64
-				{ 100, 11,  30, BOTH, FALSE},	// 5G, ch 100~140
-				{ 149,  5,  30, BOTH, FALSE},	// 5G, ch 149~165
-				{ 0},							// end
-			}
-		},
-
-		{	// Guatemala
-			"GT",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,   17, BOTH, FALSE},	// 5G, ch 36~48
-				{ 52,  4,   24, BOTH, FALSE},	// 5G, ch 52~64
-				{ 149,  4,  30, BOTH, FALSE},	// 5G, ch 149~161
-				{ 0},							// end
-			}
-		},
-
-		{	// Haiti
-			"HT",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,   17, BOTH, FALSE},	// 5G, ch 36~48
-				{ 52,  4,   24, BOTH, FALSE},	// 5G, ch 52~64
-				{ 149,  4,  30, BOTH, FALSE},	// 5G, ch 149~161
-				{ 0},							// end
-			}
-		},
-
-		{	// Honduras
-			"HN",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 149,  4,  27, BOTH, FALSE},	// 5G, ch 149~161
-				{ 0},							// end
-			}
-		},
-
-		{	// Hong Kong
-			"HK",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,   4,  23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52,   4,  23, IDOR, FALSE},	// 5G, ch 52~64
-				{ 149,  4,  30, BOTH, FALSE},	// 5G, ch 149~161
-				{ 0},							// end
-			}
-		},
-
-		{	// Hungary
-			"HU",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,   4,  23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52,   4,  23, IDOR, TRUE},	// 5G, ch 52~64
-				{ 0},							// end
-			}
-		},
-
-		{	// Iceland
-			"IS",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,   4,  23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52,   4,  23, IDOR, TRUE},	// 5G, ch 52~64
-				{ 100, 11,  30, BOTH, TRUE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// India
-			"IN",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 149, 	4,  24, IDOR, FALSE},	// 5G, ch 149~161
-				{ 0},							// end
-			}
-		},
-
-		{	// Indonesia
-			"ID",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 149, 	4,  27, BOTH, FALSE},	// 5G, ch 149~161
-				{ 0},							// end
-			}
-		},
-
-		{	// Ireland
-			"IE",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36, 	4,  23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52, 	4,  23, IDOR, TRUE},	// 5G, ch 52~64
-				{ 100, 11,  30, ODOR, TRUE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Israel
-			"IL",
-			CE,
-			{
-				{ 1,    3,  20, IDOR, FALSE},	// 2.4 G, ch 1~3
-				{ 4, 	6,  20, BOTH, FALSE},	// 2.4 G, ch 4~9
-				{ 10, 	4,  20, IDOR, FALSE},	// 2.4 G, ch 10~13
-				{ 0},							// end
-			}
-		},
-
-		{	// Italy
-			"IT",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36, 	4,  23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52, 	4,  23, IDOR, TRUE},	// 5G, ch 52~64
-				{ 100, 11,  30, ODOR, TRUE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Japan
-			"JP",
-			JAP,
-			{
-				{ 1,   14,  20, BOTH, FALSE},	// 2.4 G, ch 1~14
-				{ 36, 	4,  23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 0},							// end
-			}
-		},
-
-		{	// Jordan
-			"JO",
-			CE,
-			{
-				{ 1,   13,  20, IDOR, FALSE},	// 2.4 G, ch 1~13
-				{ 36, 	4,  23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 149, 	4,  23, IDOR, FALSE},	// 5G, ch 149~161
-				{ 0},							// end
-			}
-		},
-
-		{	// Latvia
-			"LV",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36, 	4,  23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52, 	4,  23, IDOR, TRUE},	// 5G, ch 52~64
-				{ 100, 11,  30, BOTH, TRUE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Liechtenstein
-			"LI",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 52, 	4,  23, IDOR, TRUE},	// 5G, ch 52~64
-				{ 100, 11,  30, BOTH, TRUE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Lithuania
-			"LT",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36, 	4,  23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52, 	4,  23, IDOR, TRUE},	// 5G, ch 52~64
-				{ 100, 11,  30, BOTH, TRUE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Luxemburg
-			"LU",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36, 	4,  23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52, 	4,  23, IDOR, TRUE},	// 5G, ch 52~64
-				{ 100, 11,  30, BOTH, TRUE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Malaysia
-			"MY",
-			CE,
-			{
-				{ 36, 	4,  23, BOTH, FALSE},	// 5G, ch 36~48
-				{ 52, 	4,  23, BOTH, FALSE},	// 5G, ch 52~64
-				{ 149,  5,  20, BOTH, FALSE},	// 5G, ch 149~165
-				{ 0},							// end
-			}
-		},
-
-		{	// Malta
-			"MT",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36, 	4,  23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52, 	4,  23, IDOR, TRUE},	// 5G, ch 52~64
-				{ 100, 11,  30, BOTH, TRUE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Marocco
-			"MA",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36, 	4,  24, IDOR, FALSE},	// 5G, ch 36~48
-				{ 0},							// end
-			}
-		},
-
-		{	// Mexico
-			"MX",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36, 	4,  23, BOTH, FALSE},	// 5G, ch 36~48
-				{ 52, 	4,  24, BOTH, FALSE},	// 5G, ch 52~64
-				{ 149,  5,  30, IDOR, FALSE},	// 5G, ch 149~165
-				{ 0},							// end
-			}
-		},
-
-		{	// Netherlands
-			"NL",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36, 	4,  23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52, 	4,  24, IDOR, TRUE},	// 5G, ch 52~64
-				{ 100, 11,  30, BOTH, TRUE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// New Zealand
-			"NZ",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36, 	4,  24, BOTH, FALSE},	// 5G, ch 36~48
-				{ 52, 	4,  24, BOTH, FALSE},	// 5G, ch 52~64
-				{ 149,  4,  30, BOTH, FALSE},	// 5G, ch 149~161
-				{ 0},							// end
-			}
-		},
-
-		{	// Norway
-			"NO",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36, 	4,  24, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52, 	4,  24, IDOR, TRUE},	// 5G, ch 52~64
-				{ 100, 11,  30, BOTH, TRUE},	// 5G, ch 149~161
-				{ 0},							// end
-			}
-		},
-
-		{	// Peru
-			"PE",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 149,  4,  27, BOTH, FALSE},	// 5G, ch 149~161
-				{ 0},							// end
-			}
-		},
-
-		{	// Portugal
-			"PT",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,   4,  23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52,   4,  23, IDOR, TRUE},	// 5G, ch 52~64
-				{ 100, 11,  30, BOTH, TRUE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Poland
-			"PL",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,   4,  23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52,   4,  23, IDOR, TRUE},	// 5G, ch 52~64
-				{ 100, 11,  30, BOTH, TRUE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Romania
-			"RO",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,   4,  23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52,   4,  23, IDOR, TRUE},	// 5G, ch 52~64
-				{ 100, 11,  30, BOTH, TRUE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Russia
-			"RU",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 149,  4,  20, IDOR, FALSE},	// 5G, ch 149~161
-				{ 0},							// end
-			}
-		},
-
-		{	// Saudi Arabia
-			"SA",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,   4,  23, BOTH, FALSE},	// 5G, ch 36~48
-				{ 52,   4,  23, BOTH, FALSE},	// 5G, ch 52~64
-				{ 149,  4,  23, BOTH, FALSE},	// 5G, ch 149~161
-				{ 0},							// end
-			}
-		},
-
-		{	// Serbia_and_Montenegro
-			"CS",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 0},							// end
-			}
-		},
-
-		{	// Singapore
-			"SG",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,   4,  23, BOTH, FALSE},	// 5G, ch 36~48
-				{ 52,   4,  23, BOTH, FALSE},	// 5G, ch 52~64
-				{ 149,  4,  20, BOTH, FALSE},	// 5G, ch 149~161
-				{ 0},							// end
-			}
-		},
-
-		{	// Slovakia
-			"SK",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,   4,  23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52,   4,  23, IDOR, TRUE},	// 5G, ch 52~64
-				{ 100, 11,  30, BOTH, TRUE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Slovenia
-			"SI",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,   4,  23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52,   4,  23, IDOR, TRUE},	// 5G, ch 52~64
-				{ 0},							// end
-			}
-		},
-
-		{	// South Africa
-			"ZA",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,   4,  23, BOTH, FALSE},	// 5G, ch 36~48
-				{ 52,   4,  23, IDOR, FALSE},	// 5G, ch 52~64
-				{ 100, 11,  30, BOTH, TRUE},	// 5G, ch 100~140
-				{ 149,  4,  30, BOTH, FALSE},	// 5G, ch 149~161
-				{ 0},							// end
-			}
-		},
-
-		{	// South Korea
-			"KR",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,   4,  20, BOTH, FALSE},	// 5G, ch 36~48
-				{ 52,   4,  20, BOTH, FALSE},	// 5G, ch 52~64
-				{ 100,  8,  20, BOTH, FALSE},	// 5G, ch 100~128
-				{ 149,  4,  20, BOTH, FALSE},	// 5G, ch 149~161
-				{ 0},							// end
-			}
-		},
-
-		{	// Spain
-			"ES",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,   4,  17, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52,   4,  23, IDOR, TRUE},	// 5G, ch 52~64
-				{ 100, 11,  30, BOTH, TRUE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Sweden
-			"SE",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,   4,  23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52,   4,  23, IDOR, TRUE},	// 5G, ch 52~64
-				{ 100, 11,  30, BOTH, TRUE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Switzerland
-			"CH",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,   4,  23, IDOR, TRUE},	// 5G, ch 36~48
-				{ 52,   4,  23, IDOR, TRUE},	// 5G, ch 52~64
-				{ 0},							// end
-			}
-		},
-
-		{	// Taiwan
-			"TW",
-			CE,
-			{
-				{ 1,   11,  30, BOTH, FALSE},	// 2.4 G, ch 1~11
-				{ 52,   4,  23, IDOR, FALSE},	// 5G, ch 52~64
-				{ 0},							// end
-			}
-		},
-
-		{	// Turkey
-			"TR",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~11
-				{ 36,   4,  23, BOTH, FALSE},	// 5G, ch 36~48
-				{ 52,   4,  23, BOTH, FALSE},	// 5G, ch 52~64
-				{ 0},							// end
-			}
-		},
-
-		{	// UK
-			"GB",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~11
-				{ 36,   4,  23, IDOR, FALSE},	// 5G, ch 52~64
-				{ 52,   4,  23, IDOR, TRUE},	// 5G, ch 52~64
-				{ 100, 11,  30, BOTH, TRUE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Ukraine
-			"UA",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~11
-				{ 0},							// end
-			}
-		},
-
-		{	// United_Arab_Emirates
-			"AE",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~11
-				{ 0},							// end
-			}
-		},
-
-		{	// United_States
-			"US",
-			CE,
-			{
-				{ 1,   11,  30, BOTH, FALSE},	// 2.4 G, ch 1~11
-				{ 36,   4,  17, IDOR, FALSE},	// 5G, ch 52~64
-				{ 52,   4,  24, BOTH, TRUE},	// 5G, ch 52~64
-				{ 100, 11,  30, BOTH, TRUE},	// 5G, ch 100~140
-				{ 149,  5,  30, BOTH, FALSE},	// 5G, ch 149~165
-				{ 0},							// end
-			}
-		},
-
-		{	// Venezuela
-			"VE",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~11
-				{ 149,  4,  27, BOTH, FALSE},	// 5G, ch 149~161
-				{ 0},							// end
-			}
-		},
-
-		{	// Default
-			"",
-			CE,
-			{
-				{ 1,   11,  20, BOTH, FALSE},	// 2.4 G, ch 1~11
-				{ 36,   4,  20, BOTH, FALSE},	// 5G, ch 52~64
-				{ 52,   4,  20, BOTH, FALSE},	// 5G, ch 52~64
-				{ 100, 11,  20, BOTH, FALSE},	// 5G, ch 100~140
-				{ 149,  5,  20, BOTH, FALSE},	// 5G, ch 149~165
-				{ 0},							// end
-			}
-		},
+struct rt_ch_desp {
+	u8 FirstChannel;
+	u8 NumOfCh;
+	char MaxTxPwr;		/* dBm */
+	u8 Geography;	/* 0:out door, 1:in door, 2:both */
+	BOOLEAN DfsReq;		/* Dfs require, 0: No, 1: yes. */
 };
 
-static inline PCH_REGION GetChRegion(
-	IN PUCHAR CntryCode)
-{
-	INT loop = 0;
-	PCH_REGION pChRegion = NULL;
-
-	while (strcmp(ChRegion[loop].CountReg, "") != 0)
-	{
-		if (strncmp(ChRegion[loop].CountReg, CntryCode, 2) == 0)
-		{
-			pChRegion = &ChRegion[loop];
-			break;
-		}
-		loop++;
-	}
-
-	if (pChRegion == NULL)
-		pChRegion = &ChRegion[loop];
-	return pChRegion;
-}
-
-static inline VOID ChBandCheck(
-	IN UCHAR PhyMode,
-	OUT PUCHAR pChType)
-{
-	switch(PhyMode)
-	{
-		case PHY_11A:
-		case PHY_11AN_MIXED:
-			*pChType = BAND_5G;
-			break;
-		case PHY_11ABG_MIXED:
-		case PHY_11AGN_MIXED:
-		case PHY_11ABGN_MIXED:
-			*pChType = BAND_BOTH;
-			break;
-
-		default:
-			*pChType = BAND_24G;
-			break;
-	}
-}
-
-static inline UCHAR FillChList(
-	IN PRTMP_ADAPTER pAd,
-	IN PCH_DESP pChDesp,
-	IN UCHAR Offset,
-	IN UCHAR increment)
-{
-	INT i, j, l;
-	UCHAR channel;
-
-	j = Offset;
-	for (i = 0; i < pChDesp->NumOfCh; i++)
-	{
-		channel = pChDesp->FirstChannel + i * increment;
-		for (l=0; l<MAX_NUM_OF_CHANNELS; l++)
-		{
-			if (channel == pAd->TxPower[l].Channel)
-			{
-				pAd->ChannelList[j].Power = pAd->TxPower[l].Power;
-				pAd->ChannelList[j].Power2 = pAd->TxPower[l].Power2;
-				break;
-			}
-		}
-		if (l == MAX_NUM_OF_CHANNELS)
-			continue;
-
-		pAd->ChannelList[j].Channel = pChDesp->FirstChannel + i * increment;
-		pAd->ChannelList[j].MaxTxPwr = pChDesp->MaxTxPwr;
-		pAd->ChannelList[j].DfsReq = pChDesp->DfsReq;
-		j++;
-	}
-	pAd->ChannelListNum = j;
-
-	return j;
-}
-
-static inline VOID CreateChList(
-	IN PRTMP_ADAPTER pAd,
-	IN PCH_REGION pChRegion,
-	IN UCHAR Geography)
-{
-	INT i;
-	UCHAR offset = 0;
-	PCH_DESP pChDesp;
-	UCHAR ChType;
-	UCHAR increment;
-
-	if (pChRegion == NULL)
-		return;
-
-	ChBandCheck(pAd->CommonCfg.PhyMode, &ChType);
-
-	for (i=0; i<10; i++)
-	{
-		pChDesp = &pChRegion->ChDesp[i];
-		if (pChDesp->FirstChannel == 0)
-			break;
-
-		if (ChType == BAND_5G)
-		{
-			if (pChDesp->FirstChannel <= 14)
-				continue;
-		}
-		else if (ChType == BAND_24G)
-		{
-			if (pChDesp->FirstChannel > 14)
-				continue;
-		}
-
-		if ((pChDesp->Geography == BOTH)
-			|| (pChDesp->Geography == Geography))
-        {
-			if (pChDesp->FirstChannel > 14)
-                increment = 4;
-            else
-                increment = 1;
-			offset = FillChList(pAd, pChDesp, offset, increment);
-        }
-	}
-}
-
-static inline VOID BuildChannelListEx(
-	IN PRTMP_ADAPTER pAd)
-{
-	PCH_REGION pChReg;
-
-	pChReg = GetChRegion(pAd->CommonCfg.CountryCode);
-	CreateChList(pAd, pChReg, pAd->CommonCfg.Geography);
-}
-
-static inline VOID BuildBeaconChList(
-	IN PRTMP_ADAPTER pAd,
-	OUT PUCHAR pBuf,
-	OUT	PULONG pBufLen)
-{
-	INT i;
-	ULONG TmpLen;
-	PCH_REGION pChRegion;
-	PCH_DESP pChDesp;
-	UCHAR ChType;
-
-	pChRegion = GetChRegion(pAd->CommonCfg.CountryCode);
-
-	if (pChRegion == NULL)
-		return;
-
-	ChBandCheck(pAd->CommonCfg.PhyMode, &ChType);
-	*pBufLen = 0;
-
-	for (i=0; i<10; i++)
-	{
-		pChDesp = &pChRegion->ChDesp[i];
-		if (pChDesp->FirstChannel == 0)
-			break;
-
-		if (ChType == BAND_5G)
-		{
-			if (pChDesp->FirstChannel <= 14)
-				continue;
-		}
-		else if (ChType == BAND_24G)
-		{
-			if (pChDesp->FirstChannel > 14)
-				continue;
-		}
-
-		if ((pChDesp->Geography == BOTH)
-			|| (pChDesp->Geography == pAd->CommonCfg.Geography))
-		{
-			MakeOutgoingFrame(pBuf + *pBufLen,		&TmpLen,
-								1,                 	&pChDesp->FirstChannel,
-								1,                 	&pChDesp->NumOfCh,
-								1,                 	&pChDesp->MaxTxPwr,
-								END_OF_ARGS);
-			*pBufLen += TmpLen;
-		}
-	}
-}
-
-static inline BOOLEAN IsValidChannel(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR channel)
-
-{
-	INT i;
-
-	for (i = 0; i < pAd->ChannelListNum; i++)
-	{
-		if (pAd->ChannelList[i].Channel == channel)
-			break;
-	}
-
-	if (i == pAd->ChannelListNum)
-		return FALSE;
-	else
-		return TRUE;
-}
-
-
-static inline UCHAR GetExtCh(
-	IN UCHAR Channel,
-	IN UCHAR Direction)
-{
-	CHAR ExtCh;
-
-	if (Direction == EXTCHA_ABOVE)
-		ExtCh = Channel + 4;
-	else
-		ExtCh = (Channel - 4) > 0 ? (Channel - 4) : 0;
-
-	return ExtCh;
-}
-
-
-static inline VOID N_ChannelCheck(
-	IN PRTMP_ADAPTER pAd)
-{
-	//UCHAR ChannelNum = pAd->ChannelListNum;
-	UCHAR Channel = pAd->CommonCfg.Channel;
-
-	if ((pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED) && (pAd->CommonCfg.RegTransmitSetting.field.BW  == BW_40))
-	{
-		if (Channel > 14)
-		{
-			if ((Channel == 36) || (Channel == 44) || (Channel == 52) || (Channel == 60) || (Channel == 100) || (Channel == 108) ||
-			    (Channel == 116) || (Channel == 124) || (Channel == 132) || (Channel == 149) || (Channel == 157))
-			{
-				pAd->CommonCfg.RegTransmitSetting.field.EXTCHA = EXTCHA_ABOVE;
-			}
-			else if ((Channel == 40) || (Channel == 48) || (Channel == 56) || (Channel == 64) || (Channel == 104) || (Channel == 112) ||
-					(Channel == 120) || (Channel == 128) || (Channel == 136) || (Channel == 153) || (Channel == 161))
-			{
-				pAd->CommonCfg.RegTransmitSetting.field.EXTCHA = EXTCHA_BELOW;
-			}
-			else
-			{
-				pAd->CommonCfg.RegTransmitSetting.field.BW  = BW_20;
-			}
-		}
-		else
-		{
-			do
-			{
-				UCHAR ExtCh;
-				UCHAR Dir = pAd->CommonCfg.RegTransmitSetting.field.EXTCHA;
-				ExtCh = GetExtCh(Channel, Dir);
-				if (IsValidChannel(pAd, ExtCh))
-					break;
-
-				Dir = (Dir == EXTCHA_ABOVE) ? EXTCHA_BELOW : EXTCHA_ABOVE;
-				ExtCh = GetExtCh(Channel, Dir);
-				if (IsValidChannel(pAd, ExtCh))
-				{
-					pAd->CommonCfg.RegTransmitSetting.field.EXTCHA = Dir;
-					break;
-				}
-				pAd->CommonCfg.RegTransmitSetting.field.BW  = BW_20;
-			} while(FALSE);
-
-			if (Channel == 14)
-			{
-				pAd->CommonCfg.RegTransmitSetting.field.BW  = BW_20;
-				//pAd->CommonCfg.RegTransmitSetting.field.EXTCHA = EXTCHA_NONE;	// We didn't set the ExtCh as NONE due to it'll set in RTMPSetHT()
-			}
-		}
-	}
-
-
-}
-
-
-static inline VOID N_SetCenCh(
-	IN PRTMP_ADAPTER pAd)
-{
-	if (pAd->CommonCfg.RegTransmitSetting.field.BW == BW_40)
-	{
-		if (pAd->CommonCfg.RegTransmitSetting.field.EXTCHA == EXTCHA_ABOVE)
-		{
-			pAd->CommonCfg.CentralChannel = pAd->CommonCfg.Channel + 2;
-		}
-		else
-		{
-			if (pAd->CommonCfg.Channel == 14)
-				pAd->CommonCfg.CentralChannel = pAd->CommonCfg.Channel - 1;
-			else
-				pAd->CommonCfg.CentralChannel = pAd->CommonCfg.Channel - 2;
-		}
-	}
-	else
-	{
-		pAd->CommonCfg.CentralChannel = pAd->CommonCfg.Channel;
-	}
-}
+struct rt_ch_region {
+	u8 CountReg[3];
+	u8 DfsType;		/* 0: CE, 1: FCC, 2: JAP, 3:JAP_W53, JAP_W56 */
+	struct rt_ch_desp ChDesp[10];
+};
 
-static inline UINT8 GetCuntryMaxTxPwr(
-	IN PRTMP_ADAPTER pAd,
-	IN UINT8 channel)
-{
-	int i;
-	for (i = 0; i < pAd->ChannelListNum; i++)
-	{
-		if (pAd->ChannelList[i].Channel == channel)
-			break;
-	}
+extern struct rt_ch_region ChRegion[];
 
-	if (i == pAd->ChannelListNum)
-		return 0xff;
-	else
-		return pAd->ChannelList[i].MaxTxPwr;
-}
-#endif // __CHLIST_H__
+struct rt_ch_freq_map {
+	u16 channel;
+	u16 freqKHz;
+};
 
+extern struct rt_ch_freq_map CH_HZ_ID_MAP[];
+extern int CH_HZ_ID_MAP_NUM;
+
+#define     MAP_CHANNEL_ID_TO_KHZ(_ch, _khz)					\
+		do{													\
+			int _chIdx;											\
+			for (_chIdx = 0; _chIdx < CH_HZ_ID_MAP_NUM; _chIdx++)\
+			{													\
+				if ((_ch) == CH_HZ_ID_MAP[_chIdx].channel)			\
+				{												\
+					(_khz) = CH_HZ_ID_MAP[_chIdx].freqKHz * 1000;	\
+					break;										\
+				}												\
+			}													\
+			if (_chIdx == CH_HZ_ID_MAP_NUM)					\
+				(_khz) = 2412000;									\
+            }while(0)
+
+#define     MAP_KHZ_TO_CHANNEL_ID(_khz, _ch)                 \
+		do{													\
+			int _chIdx;											\
+			for (_chIdx = 0; _chIdx < CH_HZ_ID_MAP_NUM; _chIdx++)\
+			{													\
+				if ((_khz) == CH_HZ_ID_MAP[_chIdx].freqKHz)			\
+				{												\
+					(_ch) = CH_HZ_ID_MAP[_chIdx].channel;			\
+					break;										\
+				}												\
+			}													\
+			if (_chIdx == CH_HZ_ID_MAP_NUM)					\
+				(_ch) = 1;											\
+		}while(0)
+
+void BuildChannelListEx(struct rt_rtmp_adapter *pAd);
+
+void BuildBeaconChList(struct rt_rtmp_adapter *pAd,
+		       u8 *pBuf, unsigned long *pBufLen);
+
+void N_ChannelCheck(struct rt_rtmp_adapter *pAd);
+
+void N_SetCenCh(struct rt_rtmp_adapter *pAd);
+
+u8 GetCuntryMaxTxPwr(struct rt_rtmp_adapter *pAd, u8 channel);
+
+#endif /* __CHLIST_H__ */
diff --git a/drivers/staging/rt2860/common/2860_rtmp_init.c b/drivers/staging/rt2860/common/2860_rtmp_init.c
deleted file mode 100644
index 0bc0fb99d2e4..000000000000
--- a/drivers/staging/rt2860/common/2860_rtmp_init.c
+++ /dev/null
@@ -1,897 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-	Module Name:
-	2860_rtmp_init.c
-
-	Abstract:
-	Miniport generic portion header file
-
-	Revision History:
-	Who         When          What
-	--------    ----------    ----------------------------------------------
-	Paul Lin    2002-08-01    created
-    John Chang  2004-08-20    RT2561/2661 use scatter-gather scheme
-    Jan Lee  2006-09-15    RT2860. Change for 802.11n , EEPROM, Led, BA, HT.
-*/
-#include "../rt_config.h"
-
-
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		Allocate DMA memory blocks for send, receive
-
-	Arguments:
-		Adapter		Pointer to our adapter
-
-	Return Value:
-		NDIS_STATUS_SUCCESS
-		NDIS_STATUS_FAILURE
-		NDIS_STATUS_RESOURCES
-
-	IRQL = PASSIVE_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-NDIS_STATUS	RTMPAllocTxRxRingMemory(
-	IN	PRTMP_ADAPTER	pAd)
-{
-	NDIS_STATUS		Status = NDIS_STATUS_SUCCESS;
-	ULONG			RingBasePaHigh;
-	ULONG			RingBasePaLow;
-	PVOID			RingBaseVa;
-	INT				index, num;
-	PTXD_STRUC		pTxD;
-	PRXD_STRUC		pRxD;
-	ULONG			ErrorValue = 0;
-	PRTMP_TX_RING	pTxRing;
-	PRTMP_DMABUF	pDmaBuf;
-	PNDIS_PACKET	pPacket;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("--> RTMPAllocTxRxRingMemory\n"));
-	do
-	{
-		//
-		// Allocate all ring descriptors, include TxD, RxD, MgmtD.
-		// Although each size is different, to prevent cacheline and alignment
-		// issue, I intentional set them all to 64 bytes.
-		//
-		for (num=0; num<NUM_OF_TX_RING; num++)
-		{
-			ULONG  BufBasePaHigh;
-			ULONG  BufBasePaLow;
-			PVOID  BufBaseVa;
-
-			//
-			// Allocate Tx ring descriptor's memory (5 TX rings = 4 ACs + 1 HCCA)
-			//
-			pAd->TxDescRing[num].AllocSize = TX_RING_SIZE * TXD_SIZE;
-			RTMP_AllocateTxDescMemory(
-				pAd,
-				num,
-				pAd->TxDescRing[num].AllocSize,
-				FALSE,
-				&pAd->TxDescRing[num].AllocVa,
-				&pAd->TxDescRing[num].AllocPa);
-
-			if (pAd->TxDescRing[num].AllocVa == NULL)
-			{
-				ErrorValue = ERRLOG_OUT_OF_SHARED_MEMORY;
-				DBGPRINT_ERR(("Failed to allocate a big buffer\n"));
-				Status = NDIS_STATUS_RESOURCES;
-				break;
-			}
-
-			// Zero init this memory block
-			NdisZeroMemory(pAd->TxDescRing[num].AllocVa, pAd->TxDescRing[num].AllocSize);
-
-			// Save PA & VA for further operation
-			RingBasePaHigh = RTMP_GetPhysicalAddressHigh(pAd->TxDescRing[num].AllocPa);
-			RingBasePaLow  = RTMP_GetPhysicalAddressLow (pAd->TxDescRing[num].AllocPa);
-			RingBaseVa     = pAd->TxDescRing[num].AllocVa;
-
-			//
-			// Allocate all 1st TXBuf's memory for this TxRing
-			//
-			pAd->TxBufSpace[num].AllocSize = TX_RING_SIZE * TX_DMA_1ST_BUFFER_SIZE;
-			RTMP_AllocateFirstTxBuffer(
-				pAd,
-				num,
-				pAd->TxBufSpace[num].AllocSize,
-				FALSE,
-				&pAd->TxBufSpace[num].AllocVa,
-				&pAd->TxBufSpace[num].AllocPa);
-
-			if (pAd->TxBufSpace[num].AllocVa == NULL)
-			{
-				ErrorValue = ERRLOG_OUT_OF_SHARED_MEMORY;
-				DBGPRINT_ERR(("Failed to allocate a big buffer\n"));
-				Status = NDIS_STATUS_RESOURCES;
-				break;
-			}
-
-			// Zero init this memory block
-			NdisZeroMemory(pAd->TxBufSpace[num].AllocVa, pAd->TxBufSpace[num].AllocSize);
-
-			// Save PA & VA for further operation
-			BufBasePaHigh = RTMP_GetPhysicalAddressHigh(pAd->TxBufSpace[num].AllocPa);
-			BufBasePaLow  = RTMP_GetPhysicalAddressLow (pAd->TxBufSpace[num].AllocPa);
-			BufBaseVa     = pAd->TxBufSpace[num].AllocVa;
-
-			//
-			// Initialize Tx Ring Descriptor and associated buffer memory
-			//
-			pTxRing = &pAd->TxRing[num];
-			for (index = 0; index < TX_RING_SIZE; index++)
-			{
-				pTxRing->Cell[index].pNdisPacket = NULL;
-				pTxRing->Cell[index].pNextNdisPacket = NULL;
-				// Init Tx Ring Size, Va, Pa variables
-				pTxRing->Cell[index].AllocSize = TXD_SIZE;
-				pTxRing->Cell[index].AllocVa = RingBaseVa;
-				RTMP_SetPhysicalAddressHigh(pTxRing->Cell[index].AllocPa, RingBasePaHigh);
-				RTMP_SetPhysicalAddressLow (pTxRing->Cell[index].AllocPa, RingBasePaLow);
-
-				// Setup Tx Buffer size & address. only 802.11 header will store in this space
-				pDmaBuf = &pTxRing->Cell[index].DmaBuf;
-				pDmaBuf->AllocSize = TX_DMA_1ST_BUFFER_SIZE;
-				pDmaBuf->AllocVa = BufBaseVa;
-				RTMP_SetPhysicalAddressHigh(pDmaBuf->AllocPa, BufBasePaHigh);
-				RTMP_SetPhysicalAddressLow(pDmaBuf->AllocPa, BufBasePaLow);
-
-				// link the pre-allocated TxBuf to TXD
-				pTxD = (PTXD_STRUC) pTxRing->Cell[index].AllocVa;
-				pTxD->SDPtr0 = BufBasePaLow;
-				// advance to next ring descriptor address
-				pTxD->DMADONE = 1;
-				RingBasePaLow += TXD_SIZE;
-				RingBaseVa = (PUCHAR) RingBaseVa + TXD_SIZE;
-
-				// advance to next TxBuf address
-				BufBasePaLow += TX_DMA_1ST_BUFFER_SIZE;
-				BufBaseVa = (PUCHAR) BufBaseVa + TX_DMA_1ST_BUFFER_SIZE;
-			}
-			DBGPRINT(RT_DEBUG_TRACE, ("TxRing[%d]: total %d entry allocated\n", num, index));
-		}
-		if (Status == NDIS_STATUS_RESOURCES)
-			break;
-
-		//
-		// Allocate MGMT ring descriptor's memory except Tx ring which allocated eariler
-		//
-		pAd->MgmtDescRing.AllocSize = MGMT_RING_SIZE * TXD_SIZE;
-		RTMP_AllocateMgmtDescMemory(
-			pAd,
-			pAd->MgmtDescRing.AllocSize,
-			FALSE,
-			&pAd->MgmtDescRing.AllocVa,
-			&pAd->MgmtDescRing.AllocPa);
-
-		if (pAd->MgmtDescRing.AllocVa == NULL)
-		{
-			ErrorValue = ERRLOG_OUT_OF_SHARED_MEMORY;
-			DBGPRINT_ERR(("Failed to allocate a big buffer\n"));
-			Status = NDIS_STATUS_RESOURCES;
-			break;
-		}
-
-		// Zero init this memory block
-		NdisZeroMemory(pAd->MgmtDescRing.AllocVa, pAd->MgmtDescRing.AllocSize);
-
-		// Save PA & VA for further operation
-		RingBasePaHigh = RTMP_GetPhysicalAddressHigh(pAd->MgmtDescRing.AllocPa);
-		RingBasePaLow  = RTMP_GetPhysicalAddressLow (pAd->MgmtDescRing.AllocPa);
-		RingBaseVa     = pAd->MgmtDescRing.AllocVa;
-
-		//
-		// Initialize MGMT Ring and associated buffer memory
-		//
-		for (index = 0; index < MGMT_RING_SIZE; index++)
-		{
-			pAd->MgmtRing.Cell[index].pNdisPacket = NULL;
-			pAd->MgmtRing.Cell[index].pNextNdisPacket = NULL;
-			// Init MGMT Ring Size, Va, Pa variables
-			pAd->MgmtRing.Cell[index].AllocSize = TXD_SIZE;
-			pAd->MgmtRing.Cell[index].AllocVa = RingBaseVa;
-			RTMP_SetPhysicalAddressHigh(pAd->MgmtRing.Cell[index].AllocPa, RingBasePaHigh);
-			RTMP_SetPhysicalAddressLow (pAd->MgmtRing.Cell[index].AllocPa, RingBasePaLow);
-
-			// Offset to next ring descriptor address
-			RingBasePaLow += TXD_SIZE;
-			RingBaseVa = (PUCHAR) RingBaseVa + TXD_SIZE;
-
-			// link the pre-allocated TxBuf to TXD
-			pTxD = (PTXD_STRUC) pAd->MgmtRing.Cell[index].AllocVa;
-			pTxD->DMADONE = 1;
-
-			// no pre-allocated buffer required in MgmtRing for scatter-gather case
-		}
-		DBGPRINT(RT_DEBUG_TRACE, ("MGMT Ring: total %d entry allocated\n", index));
-
-		//
-		// Allocate RX ring descriptor's memory except Tx ring which allocated eariler
-		//
-		pAd->RxDescRing.AllocSize = RX_RING_SIZE * RXD_SIZE;
-		RTMP_AllocateRxDescMemory(
-			pAd,
-			pAd->RxDescRing.AllocSize,
-			FALSE,
-			&pAd->RxDescRing.AllocVa,
-			&pAd->RxDescRing.AllocPa);
-
-		if (pAd->RxDescRing.AllocVa == NULL)
-		{
-			ErrorValue = ERRLOG_OUT_OF_SHARED_MEMORY;
-			DBGPRINT_ERR(("Failed to allocate a big buffer\n"));
-			Status = NDIS_STATUS_RESOURCES;
-			break;
-		}
-
-		// Zero init this memory block
-		NdisZeroMemory(pAd->RxDescRing.AllocVa, pAd->RxDescRing.AllocSize);
-
-
-		printk("RX DESC %p  size = %ld\n", pAd->RxDescRing.AllocVa,
-					pAd->RxDescRing.AllocSize);
-
-		// Save PA & VA for further operation
-		RingBasePaHigh = RTMP_GetPhysicalAddressHigh(pAd->RxDescRing.AllocPa);
-		RingBasePaLow  = RTMP_GetPhysicalAddressLow (pAd->RxDescRing.AllocPa);
-		RingBaseVa     = pAd->RxDescRing.AllocVa;
-
-		//
-		// Initialize Rx Ring and associated buffer memory
-		//
-		for (index = 0; index < RX_RING_SIZE; index++)
-		{
-			// Init RX Ring Size, Va, Pa variables
-			pAd->RxRing.Cell[index].AllocSize = RXD_SIZE;
-			pAd->RxRing.Cell[index].AllocVa = RingBaseVa;
-			RTMP_SetPhysicalAddressHigh(pAd->RxRing.Cell[index].AllocPa, RingBasePaHigh);
-			RTMP_SetPhysicalAddressLow (pAd->RxRing.Cell[index].AllocPa, RingBasePaLow);
-
-			// Offset to next ring descriptor address
-			RingBasePaLow += RXD_SIZE;
-			RingBaseVa = (PUCHAR) RingBaseVa + RXD_SIZE;
-
-			// Setup Rx associated Buffer size & allocate share memory
-			pDmaBuf = &pAd->RxRing.Cell[index].DmaBuf;
-			pDmaBuf->AllocSize = RX_BUFFER_AGGRESIZE;
-			pPacket = RTMP_AllocateRxPacketBuffer(
-				pAd,
-				pDmaBuf->AllocSize,
-				FALSE,
-				&pDmaBuf->AllocVa,
-				&pDmaBuf->AllocPa);
-
-			/* keep allocated rx packet */
-			pAd->RxRing.Cell[index].pNdisPacket = pPacket;
-
-			// Error handling
-			if (pDmaBuf->AllocVa == NULL)
-			{
-				ErrorValue = ERRLOG_OUT_OF_SHARED_MEMORY;
-				DBGPRINT_ERR(("Failed to allocate RxRing's 1st buffer\n"));
-				Status = NDIS_STATUS_RESOURCES;
-				break;
-			}
-
-			// Zero init this memory block
-			NdisZeroMemory(pDmaBuf->AllocVa, pDmaBuf->AllocSize);
-
-			// Write RxD buffer address & allocated buffer length
-			pRxD = (PRXD_STRUC) pAd->RxRing.Cell[index].AllocVa;
-			pRxD->SDP0 = RTMP_GetPhysicalAddressLow(pDmaBuf->AllocPa);
-			pRxD->DDONE = 0;
-		}
-
-		DBGPRINT(RT_DEBUG_TRACE, ("Rx Ring: total %d entry allocated\n", index));
-
-	}	while (FALSE);
-
-
-	NdisZeroMemory(&pAd->FragFrame, sizeof(FRAGMENT_FRAME));
-	pAd->FragFrame.pFragPacket =  RTMP_AllocateFragPacketBuffer(pAd, RX_BUFFER_NORMSIZE);
-
-	if (pAd->FragFrame.pFragPacket == NULL)
-	{
-		Status = NDIS_STATUS_RESOURCES;
-	}
-
-	if (Status != NDIS_STATUS_SUCCESS)
-	{
-		// Log error inforamtion
-		NdisWriteErrorLogEntry(
-			pAd->AdapterHandle,
-			NDIS_ERROR_CODE_OUT_OF_RESOURCES,
-			1,
-			ErrorValue);
-	}
-
-	DBGPRINT_S(Status, ("<-- RTMPAllocTxRxRingMemory, Status=%x\n", Status));
-	return Status;
-}
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		Initialize transmit data structures
-
-	Arguments:
-		Adapter						Pointer to our adapter
-
-	Return Value:
-		None
-
-	IRQL = PASSIVE_LEVEL
-
-	Note:
-		Initialize all transmit releated private buffer, include those define
-		in RTMP_ADAPTER structure and all private data structures.
-
-	========================================================================
-*/
-VOID	NICInitTxRxRingAndBacklogQueue(
-	IN	PRTMP_ADAPTER	pAd)
-{
-	//WPDMA_GLO_CFG_STRUC	GloCfg;
-	int i;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("<--> NICInitTxRxRingAndBacklogQueue\n"));
-
-	// Initialize all transmit related software queues
-	InitializeQueueHeader(&pAd->TxSwQueue[QID_AC_BE]);
-	InitializeQueueHeader(&pAd->TxSwQueue[QID_AC_BK]);
-	InitializeQueueHeader(&pAd->TxSwQueue[QID_AC_VI]);
-	InitializeQueueHeader(&pAd->TxSwQueue[QID_AC_VO]);
-	InitializeQueueHeader(&pAd->TxSwQueue[QID_HCCA]);
-
-	// Init RX Ring index pointer
-	pAd->RxRing.RxSwReadIdx = 0;
-	pAd->RxRing.RxCpuIdx = RX_RING_SIZE - 1;
-
-	// Init TX rings index pointer
-		for (i=0; i<NUM_OF_TX_RING; i++)
-		{
-			pAd->TxRing[i].TxSwFreeIdx = 0;
-			pAd->TxRing[i].TxCpuIdx = 0;
-		}
-
-	// init MGMT ring index pointer
-	pAd->MgmtRing.TxSwFreeIdx = 0;
-	pAd->MgmtRing.TxCpuIdx = 0;
-
-	pAd->PrivateInfo.TxRingFullCnt       = 0;
-}
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		Reset NIC Asics. Call after rest DMA. So reset TX_CTX_IDX to zero.
-
-	Arguments:
-		Adapter						Pointer to our adapter
-
-	Return Value:
-		None
-
-	IRQL = PASSIVE_LEVEL
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-		Reset NIC to initial state AS IS system boot up time.
-
-	========================================================================
-*/
-VOID	RTMPRingCleanUp(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			RingType)
-{
-	PTXD_STRUC		pTxD;
-	PRXD_STRUC		pRxD;
-	PQUEUE_ENTRY	pEntry;
-	PNDIS_PACKET	pPacket;
-	int				i;
-	PRTMP_TX_RING	pTxRing;
-	unsigned long	IrqFlags;
-
-	DBGPRINT(RT_DEBUG_TRACE,("RTMPRingCleanUp(RingIdx=%d, Pending-NDIS=%ld)\n", RingType, pAd->RalinkCounters.PendingNdisPacketCount));
-	switch (RingType)
-	{
-		case QID_AC_BK:
-		case QID_AC_BE:
-		case QID_AC_VI:
-		case QID_AC_VO:
-		case QID_HCCA:
-			RTMP_IRQ_LOCK(&pAd->irq_lock, IrqFlags);
-			pTxRing = &pAd->TxRing[RingType];
-
-			// We have to clean all descriptors in case some error happened with reset
-			for (i=0; i<TX_RING_SIZE; i++) // We have to scan all TX ring
-			{
-				pTxD  = (PTXD_STRUC) pTxRing->Cell[i].AllocVa;
-
-				pPacket = (PNDIS_PACKET) pTxRing->Cell[i].pNdisPacket;
-				// release scatter-and-gather NDIS_PACKET
-				if (pPacket)
-				{
-					RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_FAILURE);
-					pTxRing->Cell[i].pNdisPacket = NULL;
-				}
-
-				pPacket = (PNDIS_PACKET) pTxRing->Cell[i].pNextNdisPacket;
-				// release scatter-and-gather NDIS_PACKET
-				if (pPacket)
-				{
-					RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_FAILURE);
-					pTxRing->Cell[i].pNextNdisPacket = NULL;
-				}
-			}
-
-			RTMP_IO_READ32(pAd, TX_DTX_IDX0 + RingType * 0x10, &pTxRing->TxDmaIdx);
-			pTxRing->TxSwFreeIdx = pTxRing->TxDmaIdx;
-			pTxRing->TxCpuIdx = pTxRing->TxDmaIdx;
-			RTMP_IO_WRITE32(pAd, TX_CTX_IDX0 + RingType * 0x10, pTxRing->TxCpuIdx);
-
-			RTMP_IRQ_UNLOCK(&pAd->irq_lock, IrqFlags);
-			RTMP_IRQ_LOCK(&pAd->irq_lock, IrqFlags);
-			while (pAd->TxSwQueue[RingType].Head != NULL)
-			{
-				pEntry = RemoveHeadQueue(&pAd->TxSwQueue[RingType]);
-				pPacket = QUEUE_ENTRY_TO_PACKET(pEntry);
-				RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_FAILURE);
-				DBGPRINT(RT_DEBUG_TRACE,("Release 1 NDIS packet from s/w backlog queue\n"));
-			}
-			RTMP_IRQ_UNLOCK(&pAd->irq_lock, IrqFlags);
-			break;
-
-		case QID_MGMT:
-			// We have to clean all descriptors in case some error happened with reset
-			NdisAcquireSpinLock(&pAd->MgmtRingLock);
-
-			for (i=0; i<MGMT_RING_SIZE; i++)
-			{
-				pTxD  = (PTXD_STRUC) pAd->MgmtRing.Cell[i].AllocVa;
-
-				pPacket = (PNDIS_PACKET) pAd->MgmtRing.Cell[i].pNdisPacket;
-				// rlease scatter-and-gather NDIS_PACKET
-				if (pPacket)
-				{
-					PCI_UNMAP_SINGLE(pAd, pTxD->SDPtr0, pTxD->SDLen0, PCI_DMA_TODEVICE);
-					RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_FAILURE);
-				}
-				pAd->MgmtRing.Cell[i].pNdisPacket = NULL;
-
-				pPacket = (PNDIS_PACKET) pAd->MgmtRing.Cell[i].pNextNdisPacket;
-				// release scatter-and-gather NDIS_PACKET
-				if (pPacket)
-				{
-					PCI_UNMAP_SINGLE(pAd, pTxD->SDPtr1, pTxD->SDLen1, PCI_DMA_TODEVICE);
-					RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_FAILURE);
-				}
-				pAd->MgmtRing.Cell[i].pNextNdisPacket = NULL;
-
-			}
-
-			RTMP_IO_READ32(pAd, TX_MGMTDTX_IDX, &pAd->MgmtRing.TxDmaIdx);
-			pAd->MgmtRing.TxSwFreeIdx = pAd->MgmtRing.TxDmaIdx;
-			pAd->MgmtRing.TxCpuIdx = pAd->MgmtRing.TxDmaIdx;
-			RTMP_IO_WRITE32(pAd, TX_MGMTCTX_IDX, pAd->MgmtRing.TxCpuIdx);
-
-			NdisReleaseSpinLock(&pAd->MgmtRingLock);
-			pAd->RalinkCounters.MgmtRingFullCount = 0;
-			break;
-
-		case QID_RX:
-			// We have to clean all descriptors in case some error happened with reset
-			NdisAcquireSpinLock(&pAd->RxRingLock);
-
-			for (i=0; i<RX_RING_SIZE; i++)
-			{
-				pRxD  = (PRXD_STRUC) pAd->RxRing.Cell[i].AllocVa;
-				pRxD->DDONE = 0 ;
-			}
-
-			RTMP_IO_READ32(pAd, RX_DRX_IDX, &pAd->RxRing.RxDmaIdx);
-			pAd->RxRing.RxSwReadIdx = pAd->RxRing.RxDmaIdx;
-			pAd->RxRing.RxCpuIdx = ((pAd->RxRing.RxDmaIdx == 0) ? (RX_RING_SIZE-1) : (pAd->RxRing.RxDmaIdx-1));
-			RTMP_IO_WRITE32(pAd, RX_CRX_IDX, pAd->RxRing.RxCpuIdx);
-
-			NdisReleaseSpinLock(&pAd->RxRingLock);
-			break;
-
-		default:
-			break;
-	}
-}
-
-
-NDIS_STATUS AdapterBlockAllocateMemory(
-	IN PVOID	handle,
-	OUT	PVOID	*ppAd)
-{
-	PPCI_DEV pci_dev;
-	dma_addr_t	*phy_addr;
-	POS_COOKIE pObj = (POS_COOKIE) handle;
-
-	pci_dev = pObj->pci_dev;
-	phy_addr = &pObj->pAd_pa;
-
-	*ppAd = (PVOID)vmalloc(sizeof(RTMP_ADAPTER)); //pci_alloc_consistent(pci_dev, sizeof(RTMP_ADAPTER), phy_addr);
-
-	if (*ppAd)
-	{
-		NdisZeroMemory(*ppAd, sizeof(RTMP_ADAPTER));
-		((PRTMP_ADAPTER)*ppAd)->OS_Cookie = handle;
-		return (NDIS_STATUS_SUCCESS);
-	} else {
-		return (NDIS_STATUS_FAILURE);
-	}
-}
-
-
-void RTMP_AllocateTxDescMemory(
-	IN	PRTMP_ADAPTER pAd,
-	IN	UINT	Index,
-	IN	ULONG	Length,
-	IN	BOOLEAN	Cached,
-	OUT	PVOID	*VirtualAddress,
-	OUT	PNDIS_PHYSICAL_ADDRESS PhysicalAddress)
-{
-	POS_COOKIE pObj = (POS_COOKIE)pAd->OS_Cookie;
-
-	*VirtualAddress = (PVOID)PCI_ALLOC_CONSISTENT(pObj->pci_dev,sizeof(char)*Length, PhysicalAddress);
-
-}
-
-void RTMP_AllocateMgmtDescMemory(
-	IN	PRTMP_ADAPTER pAd,
-	IN	ULONG	Length,
-	IN	BOOLEAN	Cached,
-	OUT	PVOID	*VirtualAddress,
-	OUT	PNDIS_PHYSICAL_ADDRESS PhysicalAddress)
-{
-	POS_COOKIE pObj = (POS_COOKIE)pAd->OS_Cookie;
-
-	*VirtualAddress = (PVOID)PCI_ALLOC_CONSISTENT(pObj->pci_dev,sizeof(char)*Length, PhysicalAddress);
-
-}
-
-void RTMP_AllocateRxDescMemory(
-	IN	PRTMP_ADAPTER pAd,
-	IN	ULONG	Length,
-	IN	BOOLEAN	Cached,
-	OUT	PVOID	*VirtualAddress,
-	OUT	PNDIS_PHYSICAL_ADDRESS PhysicalAddress)
-{
-	POS_COOKIE pObj = (POS_COOKIE)pAd->OS_Cookie;
-
-	*VirtualAddress = (PVOID)PCI_ALLOC_CONSISTENT(pObj->pci_dev,sizeof(char)*Length, PhysicalAddress);
-
-}
-
-void RTMP_FreeRxDescMemory(
-	IN	PRTMP_ADAPTER pAd,
-	IN	ULONG	Length,
-	IN	PVOID	VirtualAddress,
-	IN	NDIS_PHYSICAL_ADDRESS PhysicalAddress)
-{
-	POS_COOKIE pObj = (POS_COOKIE)pAd->OS_Cookie;
-
-	PCI_FREE_CONSISTENT(pObj->pci_dev, Length, VirtualAddress, PhysicalAddress);
-}
-
-
-void RTMP_AllocateFirstTxBuffer(
-	IN	PRTMP_ADAPTER pAd,
-	IN	UINT	Index,
-	IN	ULONG	Length,
-	IN	BOOLEAN	Cached,
-	OUT	PVOID	*VirtualAddress,
-	OUT	PNDIS_PHYSICAL_ADDRESS PhysicalAddress)
-{
-	POS_COOKIE pObj = (POS_COOKIE)pAd->OS_Cookie;
-
-	*VirtualAddress = (PVOID)PCI_ALLOC_CONSISTENT(pObj->pci_dev,sizeof(char)*Length, PhysicalAddress);
-}
-
-/*
- * FUNCTION: Allocate a common buffer for DMA
- * ARGUMENTS:
- *     AdapterHandle:  AdapterHandle
- *     Length:  Number of bytes to allocate
- *     Cached:  Whether or not the memory can be cached
- *     VirtualAddress:  Pointer to memory is returned here
- *     PhysicalAddress:  Physical address corresponding to virtual address
- */
-
-void RTMP_AllocateSharedMemory(
-	IN	PRTMP_ADAPTER pAd,
-	IN	ULONG	Length,
-	IN	BOOLEAN	Cached,
-	OUT	PVOID	*VirtualAddress,
-	OUT	PNDIS_PHYSICAL_ADDRESS PhysicalAddress)
-{
-	POS_COOKIE pObj = (POS_COOKIE)pAd->OS_Cookie;
-
-	*VirtualAddress = (PVOID)PCI_ALLOC_CONSISTENT(pObj->pci_dev,sizeof(char)*Length, PhysicalAddress);
-}
-
-VOID RTMPFreeTxRxRingMemory(
-    IN  PRTMP_ADAPTER   pAd)
-{
-	int index, num , j;
-	PRTMP_TX_RING pTxRing;
-	PTXD_STRUC	  pTxD;
-	PNDIS_PACKET  pPacket;
-	unsigned int  IrqFlags;
-
-	POS_COOKIE pObj =(POS_COOKIE) pAd->OS_Cookie;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("--> RTMPFreeTxRxRingMemory\n"));
-
-	// Free TxSwQueue Packet
-	for (index=0; index <NUM_OF_TX_RING; index++)
-	{
-		PQUEUE_ENTRY pEntry;
-		PNDIS_PACKET pPacket;
-		PQUEUE_HEADER   pQueue;
-
-		RTMP_IRQ_LOCK(&pAd->irq_lock, IrqFlags);
-		pQueue = &pAd->TxSwQueue[index];
-		while (pQueue->Head)
-		{
-			pEntry = RemoveHeadQueue(pQueue);
-			pPacket = QUEUE_ENTRY_TO_PACKET(pEntry);
-			RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_FAILURE);
-		}
-		RTMP_IRQ_UNLOCK(&pAd->irq_lock, IrqFlags);
-	}
-
-	// Free Tx Ring Packet
-	for (index=0;index< NUM_OF_TX_RING;index++)
-	{
-		pTxRing = &pAd->TxRing[index];
-
-		for (j=0; j< TX_RING_SIZE; j++)
-		{
-			pTxD = (PTXD_STRUC) (pTxRing->Cell[j].AllocVa);
-			pPacket = pTxRing->Cell[j].pNdisPacket;
-
-			if (pPacket)
-			{
-            	PCI_UNMAP_SINGLE(pAd, pTxD->SDPtr0, pTxD->SDLen0, PCI_DMA_TODEVICE);
-				RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_SUCCESS);
-			}
-			//Always assign pNdisPacket as NULL after clear
-			pTxRing->Cell[j].pNdisPacket = NULL;
-
-			pPacket = pTxRing->Cell[j].pNextNdisPacket;
-
-			if (pPacket)
-			{
-            	PCI_UNMAP_SINGLE(pAd, pTxD->SDPtr1, pTxD->SDLen1, PCI_DMA_TODEVICE);
-				RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_SUCCESS);
-			}
-			//Always assign pNextNdisPacket as NULL after clear
-			pTxRing->Cell[pTxRing->TxSwFreeIdx].pNextNdisPacket = NULL;
-
-		}
-	}
-
-	for (index = RX_RING_SIZE - 1 ; index >= 0; index--)
-	{
-		if ((pAd->RxRing.Cell[index].DmaBuf.AllocVa) && (pAd->RxRing.Cell[index].pNdisPacket))
-		{
-			PCI_UNMAP_SINGLE(pObj->pci_dev, pAd->RxRing.Cell[index].DmaBuf.AllocPa, pAd->RxRing.Cell[index].DmaBuf.AllocSize, PCI_DMA_FROMDEVICE);
-			RELEASE_NDIS_PACKET(pAd, pAd->RxRing.Cell[index].pNdisPacket, NDIS_STATUS_SUCCESS);
-		}
-	}
-	NdisZeroMemory(pAd->RxRing.Cell, RX_RING_SIZE * sizeof(RTMP_DMACB));
-
-	if (pAd->RxDescRing.AllocVa)
-    {
-    	PCI_FREE_CONSISTENT(pObj->pci_dev, pAd->RxDescRing.AllocSize, pAd->RxDescRing.AllocVa, pAd->RxDescRing.AllocPa);
-    }
-    NdisZeroMemory(&pAd->RxDescRing, sizeof(RTMP_DMABUF));
-
-	if (pAd->MgmtDescRing.AllocVa)
-	{
-		PCI_FREE_CONSISTENT(pObj->pci_dev, pAd->MgmtDescRing.AllocSize,	pAd->MgmtDescRing.AllocVa, pAd->MgmtDescRing.AllocPa);
-	}
-	NdisZeroMemory(&pAd->MgmtDescRing, sizeof(RTMP_DMABUF));
-
-	for (num = 0; num < NUM_OF_TX_RING; num++)
-	{
-    	if (pAd->TxBufSpace[num].AllocVa)
-	    {
-	    	PCI_FREE_CONSISTENT(pObj->pci_dev, pAd->TxBufSpace[num].AllocSize, pAd->TxBufSpace[num].AllocVa, pAd->TxBufSpace[num].AllocPa);
-	    }
-	    NdisZeroMemory(&pAd->TxBufSpace[num], sizeof(RTMP_DMABUF));
-
-    	if (pAd->TxDescRing[num].AllocVa)
-	    {
-	    	PCI_FREE_CONSISTENT(pObj->pci_dev, pAd->TxDescRing[num].AllocSize, pAd->TxDescRing[num].AllocVa, pAd->TxDescRing[num].AllocPa);
-	    }
-	    NdisZeroMemory(&pAd->TxDescRing[num], sizeof(RTMP_DMABUF));
-	}
-
-	if (pAd->FragFrame.pFragPacket)
-		RELEASE_NDIS_PACKET(pAd, pAd->FragFrame.pFragPacket, NDIS_STATUS_SUCCESS);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("<-- RTMPFreeTxRxRingMemory\n"));
-}
-
-
-/*
- * FUNCTION: Allocate a packet buffer for DMA
- * ARGUMENTS:
- *     AdapterHandle:  AdapterHandle
- *     Length:  Number of bytes to allocate
- *     Cached:  Whether or not the memory can be cached
- *     VirtualAddress:  Pointer to memory is returned here
- *     PhysicalAddress:  Physical address corresponding to virtual address
- * Notes:
- *     Cached is ignored: always cached memory
- */
-PNDIS_PACKET RTMP_AllocateRxPacketBuffer(
-	IN	PRTMP_ADAPTER pAd,
-	IN	ULONG	Length,
-	IN	BOOLEAN	Cached,
-	OUT	PVOID	*VirtualAddress,
-	OUT	PNDIS_PHYSICAL_ADDRESS PhysicalAddress)
-{
-	PNDIS_PACKET pkt;
-
-	pkt = RTPKT_TO_OSPKT(DEV_ALLOC_SKB(Length));
-
-	if (pkt == NULL) {
-		DBGPRINT(RT_DEBUG_ERROR, ("can't allocate rx %ld size packet\n",Length));
-	}
-
-	if (pkt) {
-		RTMP_SET_PACKET_SOURCE(pkt, PKTSRC_NDIS);
-		*VirtualAddress = (PVOID) RTPKT_TO_OSPKT(pkt)->data;
-		*PhysicalAddress = PCI_MAP_SINGLE(pAd, *VirtualAddress, Length, -1, PCI_DMA_FROMDEVICE);
-	} else {
-		*VirtualAddress = (PVOID) NULL;
-		*PhysicalAddress = (NDIS_PHYSICAL_ADDRESS) NULL;
-	}
-
-	return (PNDIS_PACKET) pkt;
-}
-
-
-VOID Invalid_Remaining_Packet(
-	IN	PRTMP_ADAPTER pAd,
-	IN	 ULONG VirtualAddress)
-{
-	NDIS_PHYSICAL_ADDRESS PhysicalAddress;
-
-	PhysicalAddress = PCI_MAP_SINGLE(pAd, (void *)(VirtualAddress+1600), RX_BUFFER_NORMSIZE-1600, -1, PCI_DMA_FROMDEVICE);
-}
-
-PNDIS_PACKET GetPacketFromRxRing(
-	IN		PRTMP_ADAPTER	pAd,
-	OUT		PRT28XX_RXD_STRUC	pSaveRxD,
-	OUT		BOOLEAN			*pbReschedule,
-	IN OUT	UINT32			*pRxPending)
-{
-	PRXD_STRUC				pRxD;
-	PNDIS_PACKET			pRxPacket = NULL;
-	PNDIS_PACKET			pNewPacket;
-	PVOID					AllocVa;
-	NDIS_PHYSICAL_ADDRESS	AllocPa;
-	BOOLEAN					bReschedule = FALSE;
-
-	RTMP_SEM_LOCK(&pAd->RxRingLock);
-
-	if (*pRxPending == 0)
-	{
-		// Get how may packets had been received
-		RTMP_IO_READ32(pAd, RX_DRX_IDX , &pAd->RxRing.RxDmaIdx);
-
-		if (pAd->RxRing.RxSwReadIdx == pAd->RxRing.RxDmaIdx)
-		{
-			// no more rx packets
-			bReschedule = FALSE;
-			goto done;
-		}
-
-		// get rx pending count
-		if (pAd->RxRing.RxDmaIdx > pAd->RxRing.RxSwReadIdx)
-			*pRxPending = pAd->RxRing.RxDmaIdx - pAd->RxRing.RxSwReadIdx;
-		else
-			*pRxPending	= pAd->RxRing.RxDmaIdx + RX_RING_SIZE - pAd->RxRing.RxSwReadIdx;
-
-	}
-
-	// Point to Rx indexed rx ring descriptor
-	pRxD = (PRXD_STRUC) pAd->RxRing.Cell[pAd->RxRing.RxSwReadIdx].AllocVa;
-
-	if (pRxD->DDONE == 0)
-	{
-		*pRxPending = 0;
-		// DMAIndx had done but DDONE bit not ready
-		bReschedule = TRUE;
-		goto done;
-	}
-
-
-	// return rx descriptor
-	NdisMoveMemory(pSaveRxD, pRxD, RXD_SIZE);
-
-	pNewPacket = RTMP_AllocateRxPacketBuffer(pAd, RX_BUFFER_AGGRESIZE, FALSE, &AllocVa, &AllocPa);
-
-	if (pNewPacket)
-	{
-		// unmap the rx buffer
-		PCI_UNMAP_SINGLE(pAd, pAd->RxRing.Cell[pAd->RxRing.RxSwReadIdx].DmaBuf.AllocPa,
-					 pAd->RxRing.Cell[pAd->RxRing.RxSwReadIdx].DmaBuf.AllocSize, PCI_DMA_FROMDEVICE);
-		pRxPacket = pAd->RxRing.Cell[pAd->RxRing.RxSwReadIdx].pNdisPacket;
-
-		pAd->RxRing.Cell[pAd->RxRing.RxSwReadIdx].DmaBuf.AllocSize	= RX_BUFFER_AGGRESIZE;
-		pAd->RxRing.Cell[pAd->RxRing.RxSwReadIdx].pNdisPacket		= (PNDIS_PACKET) pNewPacket;
-		pAd->RxRing.Cell[pAd->RxRing.RxSwReadIdx].DmaBuf.AllocVa	= AllocVa;
-		pAd->RxRing.Cell[pAd->RxRing.RxSwReadIdx].DmaBuf.AllocPa	= AllocPa;
-		/* update SDP0 to new buffer of rx packet */
-		pRxD->SDP0 = AllocPa;
-	}
-	else
-	{
-		//printk("No Rx Buffer\n");
-		pRxPacket = NULL;
-		bReschedule = TRUE;
-	}
-
-	pRxD->DDONE = 0;
-
-	// had handled one rx packet
-	*pRxPending = *pRxPending - 1;
-
-	// update rx descriptor and kick rx
-	INC_RING_INDEX(pAd->RxRing.RxSwReadIdx, RX_RING_SIZE);
-
-	pAd->RxRing.RxCpuIdx = (pAd->RxRing.RxSwReadIdx == 0) ? (RX_RING_SIZE-1) : (pAd->RxRing.RxSwReadIdx-1);
-	RTMP_IO_WRITE32(pAd, RX_CRX_IDX, pAd->RxRing.RxCpuIdx);
-
-done:
-	RTMP_SEM_UNLOCK(&pAd->RxRingLock);
-	*pbReschedule = bReschedule;
-	return pRxPacket;
-}
-/* End of 2860_rtmp_init.c */
-
diff --git a/drivers/staging/rt2860/common/action.c b/drivers/staging/rt2860/common/action.c
index 256cb67e0594..56ad236e1144 100644
--- a/drivers/staging/rt2860/common/action.c
+++ b/drivers/staging/rt2860/common/action.c
@@ -39,10 +39,7 @@
 #include "../rt_config.h"
 #include "action.h"
 
-
-static VOID ReservedAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem);
+static void ReservedAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
 
 /*
     ==========================================================================
@@ -61,75 +58,89 @@ static VOID ReservedAction(
         MT2_CLS3ERR              cls3err_action
     ==========================================================================
  */
-VOID ActionStateMachineInit(
-    IN	PRTMP_ADAPTER	pAd,
-    IN  STATE_MACHINE *S,
-    OUT STATE_MACHINE_FUNC Trans[])
+void ActionStateMachineInit(struct rt_rtmp_adapter *pAd,
+			    struct rt_state_machine *S,
+			    OUT STATE_MACHINE_FUNC Trans[])
 {
-	StateMachineInit(S, (STATE_MACHINE_FUNC *)Trans, MAX_ACT_STATE, MAX_ACT_MSG, (STATE_MACHINE_FUNC)Drop, ACT_IDLE, ACT_MACHINE_BASE);
-
-	StateMachineSetAction(S, ACT_IDLE, MT2_PEER_SPECTRUM_CATE, (STATE_MACHINE_FUNC)PeerSpectrumAction);
-	StateMachineSetAction(S, ACT_IDLE, MT2_PEER_QOS_CATE, (STATE_MACHINE_FUNC)PeerQOSAction);
-
-	StateMachineSetAction(S, ACT_IDLE, MT2_PEER_DLS_CATE, (STATE_MACHINE_FUNC)ReservedAction);
-
-	StateMachineSetAction(S, ACT_IDLE, MT2_PEER_BA_CATE, (STATE_MACHINE_FUNC)PeerBAAction);
-	StateMachineSetAction(S, ACT_IDLE, MT2_PEER_HT_CATE, (STATE_MACHINE_FUNC)PeerHTAction);
-	StateMachineSetAction(S, ACT_IDLE, MT2_MLME_ADD_BA_CATE, (STATE_MACHINE_FUNC)MlmeADDBAAction);
-	StateMachineSetAction(S, ACT_IDLE, MT2_MLME_ORI_DELBA_CATE, (STATE_MACHINE_FUNC)MlmeDELBAAction);
-	StateMachineSetAction(S, ACT_IDLE, MT2_MLME_REC_DELBA_CATE, (STATE_MACHINE_FUNC)MlmeDELBAAction);
-
-	StateMachineSetAction(S, ACT_IDLE, MT2_PEER_PUBLIC_CATE, (STATE_MACHINE_FUNC)PeerPublicAction);
-	StateMachineSetAction(S, ACT_IDLE, MT2_PEER_RM_CATE, (STATE_MACHINE_FUNC)PeerRMAction);
-
-	StateMachineSetAction(S, ACT_IDLE, MT2_MLME_QOS_CATE, (STATE_MACHINE_FUNC)MlmeQOSAction);
-	StateMachineSetAction(S, ACT_IDLE, MT2_MLME_DLS_CATE, (STATE_MACHINE_FUNC)MlmeDLSAction);
-	StateMachineSetAction(S, ACT_IDLE, MT2_ACT_INVALID, (STATE_MACHINE_FUNC)MlmeInvalidAction);
+	StateMachineInit(S, (STATE_MACHINE_FUNC *) Trans, MAX_ACT_STATE,
+			 MAX_ACT_MSG, (STATE_MACHINE_FUNC) Drop, ACT_IDLE,
+			 ACT_MACHINE_BASE);
+
+	StateMachineSetAction(S, ACT_IDLE, MT2_PEER_SPECTRUM_CATE,
+			      (STATE_MACHINE_FUNC) PeerSpectrumAction);
+	StateMachineSetAction(S, ACT_IDLE, MT2_PEER_QOS_CATE,
+			      (STATE_MACHINE_FUNC) PeerQOSAction);
+
+	StateMachineSetAction(S, ACT_IDLE, MT2_PEER_DLS_CATE,
+			      (STATE_MACHINE_FUNC) ReservedAction);
+
+	StateMachineSetAction(S, ACT_IDLE, MT2_PEER_BA_CATE,
+			      (STATE_MACHINE_FUNC) PeerBAAction);
+	StateMachineSetAction(S, ACT_IDLE, MT2_PEER_HT_CATE,
+			      (STATE_MACHINE_FUNC) PeerHTAction);
+	StateMachineSetAction(S, ACT_IDLE, MT2_MLME_ADD_BA_CATE,
+			      (STATE_MACHINE_FUNC) MlmeADDBAAction);
+	StateMachineSetAction(S, ACT_IDLE, MT2_MLME_ORI_DELBA_CATE,
+			      (STATE_MACHINE_FUNC) MlmeDELBAAction);
+	StateMachineSetAction(S, ACT_IDLE, MT2_MLME_REC_DELBA_CATE,
+			      (STATE_MACHINE_FUNC) MlmeDELBAAction);
+
+	StateMachineSetAction(S, ACT_IDLE, MT2_PEER_PUBLIC_CATE,
+			      (STATE_MACHINE_FUNC) PeerPublicAction);
+	StateMachineSetAction(S, ACT_IDLE, MT2_PEER_RM_CATE,
+			      (STATE_MACHINE_FUNC) PeerRMAction);
+
+	StateMachineSetAction(S, ACT_IDLE, MT2_MLME_QOS_CATE,
+			      (STATE_MACHINE_FUNC) MlmeQOSAction);
+	StateMachineSetAction(S, ACT_IDLE, MT2_MLME_DLS_CATE,
+			      (STATE_MACHINE_FUNC) MlmeDLSAction);
+	StateMachineSetAction(S, ACT_IDLE, MT2_ACT_INVALID,
+			      (STATE_MACHINE_FUNC) MlmeInvalidAction);
 }
 
-VOID MlmeADDBAAction(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem)
-
+void MlmeADDBAAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-	MLME_ADDBA_REQ_STRUCT *pInfo;
-	UCHAR           Addr[6];
-	PUCHAR         pOutBuffer = NULL;
-	NDIS_STATUS     NStatus;
-	ULONG		Idx;
-	FRAME_ADDBA_REQ  Frame;
-	ULONG		FrameLen;
-	BA_ORI_ENTRY			*pBAEntry = NULL;
-
-	pInfo = (MLME_ADDBA_REQ_STRUCT *)Elem->Msg;
-	NdisZeroMemory(&Frame, sizeof(FRAME_ADDBA_REQ));
-
-	if(MlmeAddBAReqSanity(pAd, Elem->Msg, Elem->MsgLen, Addr))
-	{
-		NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);  //Get an unused nonpaged memory
-		if(NStatus != NDIS_STATUS_SUCCESS)
-		{
-			DBGPRINT(RT_DEBUG_TRACE,("BA - MlmeADDBAAction() allocate memory failed \n"));
+	struct rt_mlme_addba_req *pInfo;
+	u8 Addr[6];
+	u8 *pOutBuffer = NULL;
+	int NStatus;
+	unsigned long Idx;
+	struct rt_frame_addba_req Frame;
+	unsigned long FrameLen;
+	struct rt_ba_ori_entry *pBAEntry = NULL;
+
+	pInfo = (struct rt_mlme_addba_req *)Elem->Msg;
+	NdisZeroMemory(&Frame, sizeof(struct rt_frame_addba_req));
+
+	if (MlmeAddBAReqSanity(pAd, Elem->Msg, Elem->MsgLen, Addr)) {
+		NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);	/*Get an unused nonpaged memory */
+		if (NStatus != NDIS_STATUS_SUCCESS) {
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("BA - MlmeADDBAAction() allocate memory failed \n"));
 			return;
 		}
-		// 1. find entry
-		Idx = pAd->MacTab.Content[pInfo->Wcid].BAOriWcidArray[pInfo->TID];
-		if (Idx == 0)
-		{
+		/* 1. find entry */
+		Idx =
+		    pAd->MacTab.Content[pInfo->Wcid].BAOriWcidArray[pInfo->TID];
+		if (Idx == 0) {
 			MlmeFreeMemory(pAd, pOutBuffer);
-			DBGPRINT(RT_DEBUG_ERROR,("BA - MlmeADDBAAction() can't find BAOriEntry \n"));
+			DBGPRINT(RT_DEBUG_ERROR,
+				 ("BA - MlmeADDBAAction() can't find BAOriEntry \n"));
 			return;
-		}
-		else
-		{
-			pBAEntry =&pAd->BATable.BAOriEntry[Idx];
+		} else {
+			pBAEntry = &pAd->BATable.BAOriEntry[Idx];
 		}
 
 		{
 			if (ADHOC_ON(pAd))
-				ActHeaderInit(pAd, &Frame.Hdr, pInfo->pAddr, pAd->CurrentAddress, pAd->CommonCfg.Bssid);
+				ActHeaderInit(pAd, &Frame.Hdr, pInfo->pAddr,
+					      pAd->CurrentAddress,
+					      pAd->CommonCfg.Bssid);
 			else
-				ActHeaderInit(pAd, &Frame.Hdr, pAd->CommonCfg.Bssid, pAd->CurrentAddress, pInfo->pAddr);
+				ActHeaderInit(pAd, &Frame.Hdr,
+					      pAd->CommonCfg.Bssid,
+					      pAd->CurrentAddress,
+					      pInfo->pAddr);
 		}
 
 		Frame.Category = CATEGORY_BA;
@@ -141,20 +152,29 @@ VOID MlmeADDBAAction(
 		Frame.Token = pInfo->Token;
 		Frame.TimeOutValue = pInfo->TimeOutValue;
 		Frame.BaStartSeq.field.FragNum = 0;
-		Frame.BaStartSeq.field.StartSeq = pAd->MacTab.Content[pInfo->Wcid].TxSeq[pInfo->TID];
+		Frame.BaStartSeq.field.StartSeq =
+		    pAd->MacTab.Content[pInfo->Wcid].TxSeq[pInfo->TID];
 
-		*(USHORT *)(&Frame.BaParm) = cpu2le16(*(USHORT *)(&Frame.BaParm));
+		*(u16 *) (&Frame.BaParm) =
+		    cpu2le16(*(u16 *) (&Frame.BaParm));
 		Frame.TimeOutValue = cpu2le16(Frame.TimeOutValue);
 		Frame.BaStartSeq.word = cpu2le16(Frame.BaStartSeq.word);
 
-		MakeOutgoingFrame(pOutBuffer,		   &FrameLen,
-		              sizeof(FRAME_ADDBA_REQ), &Frame,
-		              END_OF_ARGS);
-		MiniportMMRequest(pAd, QID_AC_BE, pOutBuffer, FrameLen);
+		MakeOutgoingFrame(pOutBuffer, &FrameLen,
+				  sizeof(struct rt_frame_addba_req), &Frame, END_OF_ARGS);
+
+		MiniportMMRequest(pAd,
+				  (MGMT_USE_QUEUE_FLAG |
+				   MapUserPriorityToAccessCategory[pInfo->TID]),
+				  pOutBuffer, FrameLen);
+
 		MlmeFreeMemory(pAd, pOutBuffer);
 
-		DBGPRINT(RT_DEBUG_TRACE, ("BA - Send ADDBA request. StartSeq = %x,  FrameLen = %ld. BufSize = %d\n", Frame.BaStartSeq.field.StartSeq, FrameLen, Frame.BaParm.BufSize));
-    }
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("BA - Send ADDBA request. StartSeq = %x,  FrameLen = %ld. BufSize = %d\n",
+			  Frame.BaStartSeq.field.StartSeq, FrameLen,
+			  Frame.BaParm.BufSize));
+	}
 }
 
 /*
@@ -162,288 +182,277 @@ VOID MlmeADDBAAction(
     Description:
         send DELBA and delete BaEntry if any
     Parametrs:
-        Elem - MLME message MLME_DELBA_REQ_STRUCT
+        Elem - MLME message struct rt_mlme_delba_req
 
 	IRQL = DISPATCH_LEVEL
 
     ==========================================================================
  */
-VOID MlmeDELBAAction(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem)
+void MlmeDELBAAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-	MLME_DELBA_REQ_STRUCT *pInfo;
-	PUCHAR         pOutBuffer = NULL;
-	PUCHAR		   pOutBuffer2 = NULL;
-	NDIS_STATUS     NStatus;
-	ULONG		Idx;
-	FRAME_DELBA_REQ  Frame;
-	ULONG		FrameLen;
-	FRAME_BAR	FrameBar;
-
-	pInfo = (MLME_DELBA_REQ_STRUCT *)Elem->Msg;
-	// must send back DELBA
-	NdisZeroMemory(&Frame, sizeof(FRAME_DELBA_REQ));
-	DBGPRINT(RT_DEBUG_TRACE, ("==> MlmeDELBAAction(), Initiator(%d) \n", pInfo->Initiator));
-
-	if(MlmeDelBAReqSanity(pAd, Elem->Msg, Elem->MsgLen))
-	{
-		NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);  //Get an unused nonpaged memory
-		if(NStatus != NDIS_STATUS_SUCCESS)
-		{
-			DBGPRINT(RT_DEBUG_ERROR,("BA - MlmeDELBAAction() allocate memory failed 1. \n"));
+	struct rt_mlme_delba_req *pInfo;
+	u8 *pOutBuffer = NULL;
+	u8 *pOutBuffer2 = NULL;
+	int NStatus;
+	unsigned long Idx;
+	struct rt_frame_delba_req Frame;
+	unsigned long FrameLen;
+	struct rt_frame_bar FrameBar;
+
+	pInfo = (struct rt_mlme_delba_req *)Elem->Msg;
+	/* must send back DELBA */
+	NdisZeroMemory(&Frame, sizeof(struct rt_frame_delba_req));
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("==> MlmeDELBAAction(), Initiator(%d) \n", pInfo->Initiator));
+
+	if (MlmeDelBAReqSanity(pAd, Elem->Msg, Elem->MsgLen)) {
+		NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);	/*Get an unused nonpaged memory */
+		if (NStatus != NDIS_STATUS_SUCCESS) {
+			DBGPRINT(RT_DEBUG_ERROR,
+				 ("BA - MlmeDELBAAction() allocate memory failed 1. \n"));
 			return;
 		}
 
-		NStatus = MlmeAllocateMemory(pAd, &pOutBuffer2);  //Get an unused nonpaged memory
-		if(NStatus != NDIS_STATUS_SUCCESS)
-		{
+		NStatus = MlmeAllocateMemory(pAd, &pOutBuffer2);	/*Get an unused nonpaged memory */
+		if (NStatus != NDIS_STATUS_SUCCESS) {
 			MlmeFreeMemory(pAd, pOutBuffer);
-			DBGPRINT(RT_DEBUG_ERROR, ("BA - MlmeDELBAAction() allocate memory failed 2. \n"));
+			DBGPRINT(RT_DEBUG_ERROR,
+				 ("BA - MlmeDELBAAction() allocate memory failed 2. \n"));
 			return;
 		}
-
-		// SEND BAR (Send BAR to refresh peer reordering buffer.)
-		Idx = pAd->MacTab.Content[pInfo->Wcid].BAOriWcidArray[pInfo->TID];
-
-		BarHeaderInit(pAd, &FrameBar, pAd->MacTab.Content[pInfo->Wcid].Addr, pAd->CurrentAddress);
-
-		FrameBar.StartingSeq.field.FragNum = 0; // make sure sequence not clear in DEL funciton.
-		FrameBar.StartingSeq.field.StartSeq = pAd->MacTab.Content[pInfo->Wcid].TxSeq[pInfo->TID]; // make sure sequence not clear in DEL funciton.
-		FrameBar.BarControl.TID = pInfo->TID; // make sure sequence not clear in DEL funciton.
-		FrameBar.BarControl.ACKPolicy = IMMED_BA; // make sure sequence not clear in DEL funciton.
-		FrameBar.BarControl.Compressed = 1; // make sure sequence not clear in DEL funciton.
-		FrameBar.BarControl.MTID = 0; // make sure sequence not clear in DEL funciton.
-
-		MakeOutgoingFrame(pOutBuffer2,				&FrameLen,
-					  sizeof(FRAME_BAR),	  &FrameBar,
-					  END_OF_ARGS);
+		/* SEND BAR (Send BAR to refresh peer reordering buffer.) */
+		Idx =
+		    pAd->MacTab.Content[pInfo->Wcid].BAOriWcidArray[pInfo->TID];
+
+		BarHeaderInit(pAd, &FrameBar,
+			      pAd->MacTab.Content[pInfo->Wcid].Addr,
+			      pAd->CurrentAddress);
+
+		FrameBar.StartingSeq.field.FragNum = 0;	/* make sure sequence not clear in DEL funciton. */
+		FrameBar.StartingSeq.field.StartSeq = pAd->MacTab.Content[pInfo->Wcid].TxSeq[pInfo->TID];	/* make sure sequence not clear in DEL funciton. */
+		FrameBar.BarControl.TID = pInfo->TID;	/* make sure sequence not clear in DEL funciton. */
+		FrameBar.BarControl.ACKPolicy = IMMED_BA;	/* make sure sequence not clear in DEL funciton. */
+		FrameBar.BarControl.Compressed = 1;	/* make sure sequence not clear in DEL funciton. */
+		FrameBar.BarControl.MTID = 0;	/* make sure sequence not clear in DEL funciton. */
+
+		MakeOutgoingFrame(pOutBuffer2, &FrameLen,
+				  sizeof(struct rt_frame_bar), &FrameBar, END_OF_ARGS);
 		MiniportMMRequest(pAd, QID_AC_BE, pOutBuffer2, FrameLen);
 		MlmeFreeMemory(pAd, pOutBuffer2);
-		DBGPRINT(RT_DEBUG_TRACE,("BA - MlmeDELBAAction() . Send BAR to refresh peer reordering buffer \n"));
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("BA - MlmeDELBAAction() . Send BAR to refresh peer reordering buffer \n"));
 
-		// SEND DELBA FRAME
+		/* SEND DELBA FRAME */
 		FrameLen = 0;
 
 		{
 			if (ADHOC_ON(pAd))
-				ActHeaderInit(pAd, &Frame.Hdr, pAd->MacTab.Content[pInfo->Wcid].Addr, pAd->CurrentAddress, pAd->CommonCfg.Bssid);
+				ActHeaderInit(pAd, &Frame.Hdr,
+					      pAd->MacTab.Content[pInfo->Wcid].
+					      Addr, pAd->CurrentAddress,
+					      pAd->CommonCfg.Bssid);
 			else
-				ActHeaderInit(pAd, &Frame.Hdr,  pAd->CommonCfg.Bssid, pAd->CurrentAddress, pAd->MacTab.Content[pInfo->Wcid].Addr);
+				ActHeaderInit(pAd, &Frame.Hdr,
+					      pAd->CommonCfg.Bssid,
+					      pAd->CurrentAddress,
+					      pAd->MacTab.Content[pInfo->Wcid].
+					      Addr);
 		}
 
 		Frame.Category = CATEGORY_BA;
 		Frame.Action = DELBA;
 		Frame.DelbaParm.Initiator = pInfo->Initiator;
 		Frame.DelbaParm.TID = pInfo->TID;
-		Frame.ReasonCode = 39; // Time Out
-		*(USHORT *)(&Frame.DelbaParm) = cpu2le16(*(USHORT *)(&Frame.DelbaParm));
+		Frame.ReasonCode = 39;	/* Time Out */
+		*(u16 *) (&Frame.DelbaParm) =
+		    cpu2le16(*(u16 *) (&Frame.DelbaParm));
 		Frame.ReasonCode = cpu2le16(Frame.ReasonCode);
 
-		MakeOutgoingFrame(pOutBuffer,               &FrameLen,
-		              sizeof(FRAME_DELBA_REQ),    &Frame,
-		              END_OF_ARGS);
+		MakeOutgoingFrame(pOutBuffer, &FrameLen,
+				  sizeof(struct rt_frame_delba_req), &Frame, END_OF_ARGS);
 		MiniportMMRequest(pAd, QID_AC_BE, pOutBuffer, FrameLen);
 		MlmeFreeMemory(pAd, pOutBuffer);
-		DBGPRINT(RT_DEBUG_TRACE, ("BA - MlmeDELBAAction() . 3 DELBA sent. Initiator(%d)\n", pInfo->Initiator));
-    	}
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("BA - MlmeDELBAAction() . 3 DELBA sent. Initiator(%d)\n",
+			  pInfo->Initiator));
+	}
 }
 
-VOID MlmeQOSAction(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem)
+void MlmeQOSAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
 }
 
-VOID MlmeDLSAction(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem)
+void MlmeDLSAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
 }
 
-VOID MlmeInvalidAction(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem)
+void MlmeInvalidAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-	//PUCHAR		   pOutBuffer = NULL;
-	//Return the receiving frame except the MSB of category filed set to 1.  7.3.1.11
+	/*u8 *                  pOutBuffer = NULL; */
+	/*Return the receiving frame except the MSB of category filed set to 1.  7.3.1.11 */
 }
 
-VOID PeerQOSAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
+void PeerQOSAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
 }
 
-VOID PeerBAAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
+void PeerBAAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-	UCHAR	Action = Elem->Msg[LENGTH_802_11+1];
-
-	switch(Action)
-	{
-		case ADDBA_REQ:
-			PeerAddBAReqAction(pAd,Elem);
-			break;
-		case ADDBA_RESP:
-			PeerAddBARspAction(pAd,Elem);
-			break;
-		case DELBA:
-			PeerDelBAAction(pAd,Elem);
-			break;
+	u8 Action = Elem->Msg[LENGTH_802_11 + 1];
+
+	switch (Action) {
+	case ADDBA_REQ:
+		PeerAddBAReqAction(pAd, Elem);
+		break;
+	case ADDBA_RESP:
+		PeerAddBARspAction(pAd, Elem);
+		break;
+	case DELBA:
+		PeerDelBAAction(pAd, Elem);
+		break;
 	}
 }
 
-VOID PeerPublicAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
+void PeerPublicAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
 	if (Elem->Wcid >= MAX_LEN_OF_MAC_TABLE)
 		return;
 }
 
-
-static VOID ReservedAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
+static void ReservedAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-	UCHAR Category;
+	u8 Category;
 
-	if (Elem->MsgLen <= LENGTH_802_11)
-	{
+	if (Elem->MsgLen <= LENGTH_802_11) {
 		return;
 	}
 
 	Category = Elem->Msg[LENGTH_802_11];
-	DBGPRINT(RT_DEBUG_TRACE,("Rcv reserved category(%d) Action Frame\n", Category));
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("Rcv reserved category(%d) Action Frame\n", Category));
 	hex_dump("Reserved Action Frame", &Elem->Msg[0], Elem->MsgLen);
 }
 
-VOID PeerRMAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-
+void PeerRMAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
 	return;
 }
 
-static VOID respond_ht_information_exchange_action(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
+static void respond_ht_information_exchange_action(struct rt_rtmp_adapter *pAd,
+						   struct rt_mlme_queue_elem *Elem)
 {
-	PUCHAR			pOutBuffer = NULL;
-	NDIS_STATUS		NStatus;
-	ULONG			FrameLen;
-	FRAME_HT_INFO	HTINFOframe, *pFrame;
-	UCHAR   		*pAddr;
-
-
-	// 2. Always send back ADDBA Response
-	NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);	 //Get an unused nonpaged memory
-
-	if (NStatus != NDIS_STATUS_SUCCESS)
-	{
-		DBGPRINT(RT_DEBUG_TRACE,("ACTION - respond_ht_information_exchange_action() allocate memory failed \n"));
+	u8 *pOutBuffer = NULL;
+	int NStatus;
+	unsigned long FrameLen;
+	struct rt_frame_ht_info HTINFOframe, *pFrame;
+	u8 *pAddr;
+
+	/* 2. Always send back ADDBA Response */
+	NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);	/*Get an unused nonpaged memory */
+
+	if (NStatus != NDIS_STATUS_SUCCESS) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("ACTION - respond_ht_information_exchange_action() allocate memory failed \n"));
 		return;
 	}
-
-	// get RA
-	pFrame = (FRAME_HT_INFO *) &Elem->Msg[0];
+	/* get RA */
+	pFrame = (struct rt_frame_ht_info *) & Elem->Msg[0];
 	pAddr = pFrame->Hdr.Addr2;
 
-	NdisZeroMemory(&HTINFOframe, sizeof(FRAME_HT_INFO));
-	// 2-1. Prepare ADDBA Response frame.
+	NdisZeroMemory(&HTINFOframe, sizeof(struct rt_frame_ht_info));
+	/* 2-1. Prepare ADDBA Response frame. */
 	{
 		if (ADHOC_ON(pAd))
-			ActHeaderInit(pAd, &HTINFOframe.Hdr, pAddr, pAd->CurrentAddress, pAd->CommonCfg.Bssid);
+			ActHeaderInit(pAd, &HTINFOframe.Hdr, pAddr,
+				      pAd->CurrentAddress,
+				      pAd->CommonCfg.Bssid);
 		else
-			ActHeaderInit(pAd, &HTINFOframe.Hdr, pAd->CommonCfg.Bssid, pAd->CurrentAddress, pAddr);
+			ActHeaderInit(pAd, &HTINFOframe.Hdr,
+				      pAd->CommonCfg.Bssid, pAd->CurrentAddress,
+				      pAddr);
 	}
 
 	HTINFOframe.Category = CATEGORY_HT;
 	HTINFOframe.Action = HT_INFO_EXCHANGE;
 	HTINFOframe.HT_Info.Request = 0;
-	HTINFOframe.HT_Info.Forty_MHz_Intolerant = pAd->CommonCfg.HtCapability.HtCapInfo.Forty_Mhz_Intolerant;
-	HTINFOframe.HT_Info.STA_Channel_Width	 = pAd->CommonCfg.AddHTInfo.AddHtInfo.RecomWidth;
+	HTINFOframe.HT_Info.Forty_MHz_Intolerant =
+	    pAd->CommonCfg.HtCapability.HtCapInfo.Forty_Mhz_Intolerant;
+	HTINFOframe.HT_Info.STA_Channel_Width =
+	    pAd->CommonCfg.AddHTInfo.AddHtInfo.RecomWidth;
 
-	MakeOutgoingFrame(pOutBuffer,					&FrameLen,
-					  sizeof(FRAME_HT_INFO),	&HTINFOframe,
-					  END_OF_ARGS);
+	MakeOutgoingFrame(pOutBuffer, &FrameLen,
+			  sizeof(struct rt_frame_ht_info), &HTINFOframe, END_OF_ARGS);
 
 	MiniportMMRequest(pAd, QID_AC_BE, pOutBuffer, FrameLen);
 	MlmeFreeMemory(pAd, pOutBuffer);
 }
 
-VOID PeerHTAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
+void PeerHTAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-	UCHAR	Action = Elem->Msg[LENGTH_802_11+1];
+	u8 Action = Elem->Msg[LENGTH_802_11 + 1];
 
 	if (Elem->Wcid >= MAX_LEN_OF_MAC_TABLE)
 		return;
 
-	switch(Action)
-	{
-		case NOTIFY_BW_ACTION:
-			DBGPRINT(RT_DEBUG_TRACE,("ACTION - HT Notify Channel bandwidth action----> \n"));
-
-			if(pAd->StaActive.SupportedPhyInfo.bHtEnable == FALSE)
-			{
-				// Note, this is to patch DIR-1353 AP. When the AP set to Wep, it will use legacy mode. But AP still keeps
-				// sending BW_Notify Action frame, and cause us to linkup and linkdown.
-				// In legacy mode, don't need to parse HT action frame.
-				DBGPRINT(RT_DEBUG_TRACE,("ACTION -Ignore HT Notify Channel BW when link as legacy mode. BW = %d---> \n",
-								Elem->Msg[LENGTH_802_11+2] ));
-				break;
-			}
-
-			if (Elem->Msg[LENGTH_802_11+2] == 0)	// 7.4.8.2. if value is 1, keep the same as supported channel bandwidth.
-				pAd->MacTab.Content[Elem->Wcid].HTPhyMode.field.BW = 0;
-
+	switch (Action) {
+	case NOTIFY_BW_ACTION:
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("ACTION - HT Notify Channel bandwidth action----> \n"));
+
+		if (pAd->StaActive.SupportedPhyInfo.bHtEnable == FALSE) {
+			/* Note, this is to patch DIR-1353 AP. When the AP set to Wep, it will use legacy mode. But AP still keeps */
+			/* sending BW_Notify Action frame, and cause us to linkup and linkdown. */
+			/* In legacy mode, don't need to parse HT action frame. */
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("ACTION -Ignore HT Notify Channel BW when link as legacy mode. BW = %d---> \n",
+				  Elem->Msg[LENGTH_802_11 + 2]));
 			break;
-		case SMPS_ACTION:
-			// 7.3.1.25
- 			DBGPRINT(RT_DEBUG_TRACE,("ACTION - SMPS action----> \n"));
-			if (((Elem->Msg[LENGTH_802_11+2]&0x1) == 0))
-			{
-				pAd->MacTab.Content[Elem->Wcid].MmpsMode = MMPS_ENABLE;
-			}
-			else if (((Elem->Msg[LENGTH_802_11+2]&0x2) == 0))
-			{
-				pAd->MacTab.Content[Elem->Wcid].MmpsMode = MMPS_STATIC;
-			}
-			else
-			{
-				pAd->MacTab.Content[Elem->Wcid].MmpsMode = MMPS_DYNAMIC;
-			}
+		}
 
-			DBGPRINT(RT_DEBUG_TRACE,("Aid(%d) MIMO PS = %d\n", Elem->Wcid, pAd->MacTab.Content[Elem->Wcid].MmpsMode));
-			// rt2860c : add something for smps change.
-			break;
+		if (Elem->Msg[LENGTH_802_11 + 2] == 0)	/* 7.4.8.2. if value is 1, keep the same as supported channel bandwidth. */
+			pAd->MacTab.Content[Elem->Wcid].HTPhyMode.field.BW = 0;
+
+		break;
+	case SMPS_ACTION:
+		/* 7.3.1.25 */
+		DBGPRINT(RT_DEBUG_TRACE, ("ACTION - SMPS action----> \n"));
+		if (((Elem->Msg[LENGTH_802_11 + 2] & 0x1) == 0)) {
+			pAd->MacTab.Content[Elem->Wcid].MmpsMode = MMPS_ENABLE;
+		} else if (((Elem->Msg[LENGTH_802_11 + 2] & 0x2) == 0)) {
+			pAd->MacTab.Content[Elem->Wcid].MmpsMode = MMPS_STATIC;
+		} else {
+			pAd->MacTab.Content[Elem->Wcid].MmpsMode = MMPS_DYNAMIC;
+		}
 
-		case SETPCO_ACTION:
-			break;
-		case MIMO_CHA_MEASURE_ACTION:
-			break;
-		case HT_INFO_EXCHANGE:
-			{
-				HT_INFORMATION_OCTET	*pHT_info;
-
-				pHT_info = (HT_INFORMATION_OCTET *) &Elem->Msg[LENGTH_802_11+2];
-    				// 7.4.8.10
-    				DBGPRINT(RT_DEBUG_TRACE,("ACTION - HT Information Exchange action----> \n"));
-    				if (pHT_info->Request)
-    				{
-    					respond_ht_information_exchange_action(pAd, Elem);
-    				}
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("Aid(%d) MIMO PS = %d\n", Elem->Wcid,
+			  pAd->MacTab.Content[Elem->Wcid].MmpsMode));
+		/* rt2860c : add something for smps change. */
+		break;
+
+	case SETPCO_ACTION:
+		break;
+	case MIMO_CHA_MEASURE_ACTION:
+		break;
+	case HT_INFO_EXCHANGE:
+		{
+			struct rt_ht_information_octet *pHT_info;
+
+			pHT_info =
+			    (struct rt_ht_information_octet *) & Elem->Msg[LENGTH_802_11 +
+								 2];
+			/* 7.4.8.10 */
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("ACTION - HT Information Exchange action----> \n"));
+			if (pHT_info->Request) {
+				respond_ht_information_exchange_action(pAd,
+								       Elem);
 			}
-    			break;
+		}
+		break;
 	}
 }
 
-
 /*
 	==========================================================================
 	Description:
@@ -458,120 +467,116 @@ VOID PeerHTAction(
 				FALSE , then continue indicaterx at this moment.
 	==========================================================================
  */
-VOID ORIBATimerTimeout(
-	IN	PRTMP_ADAPTER	pAd)
+void ORIBATimerTimeout(struct rt_rtmp_adapter *pAd)
 {
-	MAC_TABLE_ENTRY	*pEntry;
-	INT			i, total;
-	UCHAR			TID;
+	struct rt_mac_table_entry *pEntry;
+	int i, total;
+	u8 TID;
 
 	total = pAd->MacTab.Size * NUM_OF_TID;
 
-	for (i = 1; ((i <MAX_LEN_OF_BA_ORI_TABLE) && (total > 0)) ; i++)
-	{
-		if  (pAd->BATable.BAOriEntry[i].ORI_BA_Status == Originator_Done)
-		{
-			pEntry = &pAd->MacTab.Content[pAd->BATable.BAOriEntry[i].Wcid];
+	for (i = 1; ((i < MAX_LEN_OF_BA_ORI_TABLE) && (total > 0)); i++) {
+		if (pAd->BATable.BAOriEntry[i].ORI_BA_Status == Originator_Done) {
+			pEntry =
+			    &pAd->MacTab.Content[pAd->BATable.BAOriEntry[i].
+						 Wcid];
 			TID = pAd->BATable.BAOriEntry[i].TID;
 
-			ASSERT(pAd->BATable.BAOriEntry[i].Wcid < MAX_LEN_OF_MAC_TABLE);
+			ASSERT(pAd->BATable.BAOriEntry[i].Wcid <
+			       MAX_LEN_OF_MAC_TABLE);
 		}
-		total --;
+		total--;
 	}
 }
 
-
-VOID SendRefreshBAR(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	MAC_TABLE_ENTRY	*pEntry)
+void SendRefreshBAR(struct rt_rtmp_adapter *pAd, struct rt_mac_table_entry *pEntry)
 {
-	FRAME_BAR		FrameBar;
-	ULONG			FrameLen;
-	NDIS_STATUS 	NStatus;
-	PUCHAR			pOutBuffer = NULL;
-	USHORT			Sequence;
-	UCHAR			i, TID;
-	USHORT			idx;
-	BA_ORI_ENTRY	*pBAEntry;
-
-	for (i = 0; i <NUM_OF_TID; i++)
-	{
+	struct rt_frame_bar FrameBar;
+	unsigned long FrameLen;
+	int NStatus;
+	u8 *pOutBuffer = NULL;
+	u16 Sequence;
+	u8 i, TID;
+	u16 idx;
+	struct rt_ba_ori_entry *pBAEntry;
+
+	for (i = 0; i < NUM_OF_TID; i++) {
 		idx = pEntry->BAOriWcidArray[i];
-		if (idx == 0)
-		{
+		if (idx == 0) {
 			continue;
 		}
 		pBAEntry = &pAd->BATable.BAOriEntry[idx];
 
-		if  (pBAEntry->ORI_BA_Status == Originator_Done)
-		{
+		if (pBAEntry->ORI_BA_Status == Originator_Done) {
 			TID = pBAEntry->TID;
 
 			ASSERT(pBAEntry->Wcid < MAX_LEN_OF_MAC_TABLE);
 
-			NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);  //Get an unused nonpaged memory
-			if(NStatus != NDIS_STATUS_SUCCESS)
-			{
-				DBGPRINT(RT_DEBUG_ERROR,("BA - MlmeADDBAAction() allocate memory failed \n"));
+			NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);	/*Get an unused nonpaged memory */
+			if (NStatus != NDIS_STATUS_SUCCESS) {
+				DBGPRINT(RT_DEBUG_ERROR,
+					 ("BA - MlmeADDBAAction() allocate memory failed \n"));
 				return;
 			}
 
 			Sequence = pEntry->TxSeq[TID];
 
-			BarHeaderInit(pAd, &FrameBar, pEntry->Addr, pAd->CurrentAddress);
+			BarHeaderInit(pAd, &FrameBar, pEntry->Addr,
+				      pAd->CurrentAddress);
 
-			FrameBar.StartingSeq.field.FragNum = 0; // make sure sequence not clear in DEL function.
-			FrameBar.StartingSeq.field.StartSeq = Sequence; // make sure sequence not clear in DEL funciton.
-			FrameBar.BarControl.TID = TID; // make sure sequence not clear in DEL funciton.
+			FrameBar.StartingSeq.field.FragNum = 0;	/* make sure sequence not clear in DEL function. */
+			FrameBar.StartingSeq.field.StartSeq = Sequence;	/* make sure sequence not clear in DEL funciton. */
+			FrameBar.BarControl.TID = TID;	/* make sure sequence not clear in DEL funciton. */
 
-			MakeOutgoingFrame(pOutBuffer,				&FrameLen,
-							  sizeof(FRAME_BAR),	  &FrameBar,
-							  END_OF_ARGS);
-
-			MiniportMMRequest(pAd, QID_AC_BE, pOutBuffer, FrameLen);
+			MakeOutgoingFrame(pOutBuffer, &FrameLen,
+					  sizeof(struct rt_frame_bar), &FrameBar,
+					  END_OF_ARGS);
+			/*if (!(CLIENT_STATUS_TEST_FLAG(pEntry, fCLIENT_STATUS_RALINK_CHIPSET))) */
+			if (1)	/* Now we always send BAR. */
+			{
+				/*MiniportMMRequestUnlock(pAd, 0, pOutBuffer, FrameLen); */
+				MiniportMMRequest(pAd,
+						  (MGMT_USE_QUEUE_FLAG |
+						   MapUserPriorityToAccessCategory
+						   [TID]), pOutBuffer,
+						  FrameLen);
 
+			}
 			MlmeFreeMemory(pAd, pOutBuffer);
 		}
 	}
 }
 
-VOID ActHeaderInit(
-    IN	PRTMP_ADAPTER	pAd,
-    IN OUT PHEADER_802_11 pHdr80211,
-    IN PUCHAR Addr1,
-    IN PUCHAR Addr2,
-    IN PUCHAR Addr3)
+void ActHeaderInit(struct rt_rtmp_adapter *pAd,
+		   struct rt_header_802_11 * pHdr80211,
+		   u8 *Addr1, u8 *Addr2, u8 *Addr3)
 {
-    NdisZeroMemory(pHdr80211, sizeof(HEADER_802_11));
-    pHdr80211->FC.Type = BTYPE_MGMT;
-    pHdr80211->FC.SubType = SUBTYPE_ACTION;
+	NdisZeroMemory(pHdr80211, sizeof(struct rt_header_802_11));
+	pHdr80211->FC.Type = BTYPE_MGMT;
+	pHdr80211->FC.SubType = SUBTYPE_ACTION;
 
-    COPY_MAC_ADDR(pHdr80211->Addr1, Addr1);
+	COPY_MAC_ADDR(pHdr80211->Addr1, Addr1);
 	COPY_MAC_ADDR(pHdr80211->Addr2, Addr2);
-    COPY_MAC_ADDR(pHdr80211->Addr3, Addr3);
+	COPY_MAC_ADDR(pHdr80211->Addr3, Addr3);
 }
 
-VOID BarHeaderInit(
-	IN	PRTMP_ADAPTER	pAd,
-	IN OUT PFRAME_BAR pCntlBar,
-	IN PUCHAR pDA,
-	IN PUCHAR pSA)
+void BarHeaderInit(struct rt_rtmp_adapter *pAd,
+		   struct rt_frame_bar * pCntlBar, u8 *pDA, u8 *pSA)
 {
-	NdisZeroMemory(pCntlBar, sizeof(FRAME_BAR));
+	NdisZeroMemory(pCntlBar, sizeof(struct rt_frame_bar));
 	pCntlBar->FC.Type = BTYPE_CNTL;
 	pCntlBar->FC.SubType = SUBTYPE_BLOCK_ACK_REQ;
-   	pCntlBar->BarControl.MTID = 0;
+	pCntlBar->BarControl.MTID = 0;
 	pCntlBar->BarControl.Compressed = 1;
 	pCntlBar->BarControl.ACKPolicy = 0;
 
-
-	pCntlBar->Duration = 16 + RTMPCalcDuration(pAd, RATE_1, sizeof(FRAME_BA));
+	pCntlBar->Duration =
+	    16 + RTMPCalcDuration(pAd, RATE_1, sizeof(struct rt_frame_ba));
 
 	COPY_MAC_ADDR(pCntlBar->Addr1, pDA);
 	COPY_MAC_ADDR(pCntlBar->Addr2, pSA);
 }
 
-
 /*
 	==========================================================================
 	Description:
@@ -586,19 +591,14 @@ VOID BarHeaderInit(
 	Return	: None.
 	==========================================================================
  */
-VOID InsertActField(
-	IN PRTMP_ADAPTER pAd,
-	OUT PUCHAR pFrameBuf,
-	OUT PULONG pFrameLen,
-	IN UINT8 Category,
-	IN UINT8 ActCode)
+void InsertActField(struct rt_rtmp_adapter *pAd,
+		    u8 *pFrameBuf,
+		    unsigned long *pFrameLen, u8 Category, u8 ActCode)
 {
-	ULONG TempLen;
+	unsigned long TempLen;
 
-	MakeOutgoingFrame(	pFrameBuf,		&TempLen,
-						1,				&Category,
-						1,				&ActCode,
-						END_OF_ARGS);
+	MakeOutgoingFrame(pFrameBuf, &TempLen,
+			  1, &Category, 1, &ActCode, END_OF_ARGS);
 
 	*pFrameLen = *pFrameLen + TempLen;
 
diff --git a/drivers/staging/rt2860/common/action.h b/drivers/staging/rt2860/common/action.h
index cfc2a5f8d1aa..974f8b84039f 100644
--- a/drivers/staging/rt2860/common/action.h
+++ b/drivers/staging/rt2860/common/action.h
@@ -39,23 +39,18 @@
 #ifndef	__ACTION_H__
 #define	__ACTION_H__
 
-typedef struct PACKED __HT_INFO_OCTET
-{
-	UCHAR	Request:1;
-	UCHAR	Forty_MHz_Intolerant:1;
-	UCHAR 	STA_Channel_Width:1;
-	UCHAR	Reserved:5;
-} HT_INFORMATION_OCTET;
-
-
-typedef struct PACKED __FRAME_HT_INFO
-{
-	HEADER_802_11   		Hdr;
-	UCHAR					Category;
-	UCHAR					Action;
-	HT_INFORMATION_OCTET	HT_Info;
-}   FRAME_HT_INFO, *PFRAME_HT_INFO;
+struct PACKED rt_ht_information_octet {
+	u8 Request:1;
+	u8 Forty_MHz_Intolerant:1;
+	u8 STA_Channel_Width:1;
+	u8 Reserved:5;
+};
+
+struct PACKED rt_frame_ht_info {
+	struct rt_header_802_11 Hdr;
+	u8 Category;
+	u8 Action;
+	struct rt_ht_information_octet HT_Info;
+};
 
 #endif /* __ACTION_H__ */
-
-
diff --git a/drivers/staging/rt2860/common/ba_action.c b/drivers/staging/rt2860/common/ba_action.c
index b7bbe99d4d57..174f2a73a1bb 100644
--- a/drivers/staging/rt2860/common/ba_action.c
+++ b/drivers/staging/rt2860/common/ba_action.c
@@ -27,42 +27,33 @@
 
 #include "../rt_config.h"
 
-
-
-#define BA_ORI_INIT_SEQ		(pEntry->TxSeq[TID]) //1			// inital sequence number of BA session
+#define BA_ORI_INIT_SEQ		(pEntry->TxSeq[TID])	/*1                        // inital sequence number of BA session */
 
 #define ORI_SESSION_MAX_RETRY	8
-#define ORI_BA_SESSION_TIMEOUT	(2000)	// ms
-#define REC_BA_SESSION_IDLE_TIMEOUT	(1000)	// ms
+#define ORI_BA_SESSION_TIMEOUT	(2000)	/* ms */
+#define REC_BA_SESSION_IDLE_TIMEOUT	(1000)	/* ms */
 
-#define REORDERING_PACKET_TIMEOUT		((100 * HZ)/1000)	// system ticks -- 100 ms
-#define MAX_REORDERING_PACKET_TIMEOUT	((3000 * HZ)/1000)	// system ticks -- 100 ms
+#define REORDERING_PACKET_TIMEOUT		((100 * OS_HZ)/1000)	/* system ticks -- 100 ms */
+#define MAX_REORDERING_PACKET_TIMEOUT	((3000 * OS_HZ)/1000)	/* system ticks -- 100 ms */
 
 #define RESET_RCV_SEQ		(0xFFFF)
 
-static void ba_mpdu_blk_free(PRTMP_ADAPTER pAd, struct reordering_mpdu *mpdu_blk);
-
+static void ba_mpdu_blk_free(struct rt_rtmp_adapter *pAd,
+			     struct reordering_mpdu *mpdu_blk);
 
-BA_ORI_ENTRY *BATableAllocOriEntry(
-								  IN  PRTMP_ADAPTER   pAd,
-								  OUT USHORT          *Idx);
+struct rt_ba_ori_entry *BATableAllocOriEntry(struct rt_rtmp_adapter *pAd, u16 * Idx);
 
-BA_REC_ENTRY *BATableAllocRecEntry(
-								  IN  PRTMP_ADAPTER   pAd,
-								  OUT USHORT          *Idx);
+struct rt_ba_rec_entry *BATableAllocRecEntry(struct rt_rtmp_adapter *pAd, u16 * Idx);
 
-VOID BAOriSessionSetupTimeout(
-    IN PVOID SystemSpecific1,
-    IN PVOID FunctionContext,
-    IN PVOID SystemSpecific2,
-    IN PVOID SystemSpecific3);
-
-VOID BARecSessionIdleTimeout(
-    IN PVOID SystemSpecific1,
-    IN PVOID FunctionContext,
-    IN PVOID SystemSpecific2,
-    IN PVOID SystemSpecific3);
+void BAOriSessionSetupTimeout(void *SystemSpecific1,
+			      void *FunctionContext,
+			      void *SystemSpecific2,
+			      void *SystemSpecific3);
 
+void BARecSessionIdleTimeout(void *SystemSpecific1,
+			     void *FunctionContext,
+			     void *SystemSpecific2,
+			     void *SystemSpecific3);
 
 BUILD_TIMER_FUNCTION(BAOriSessionSetupTimeout);
 BUILD_TIMER_FUNCTION(BARecSessionIdleTimeout);
@@ -70,91 +61,78 @@ BUILD_TIMER_FUNCTION(BARecSessionIdleTimeout);
 #define ANNOUNCE_REORDERING_PACKET(_pAd, _mpdu_blk)	\
 			Announce_Reordering_Packet(_pAd, _mpdu_blk);
 
-VOID BA_MaxWinSizeReasign(
-	IN PRTMP_ADAPTER	pAd,
-	IN MAC_TABLE_ENTRY  *pEntryPeer,
-	OUT UCHAR			*pWinSize)
+void BA_MaxWinSizeReasign(struct rt_rtmp_adapter *pAd,
+			  struct rt_mac_table_entry *pEntryPeer, u8 * pWinSize)
 {
-	UCHAR MaxSize;
-
+	u8 MaxSize;
 
-	if (pAd->MACVersion >= RALINK_2883_VERSION) // 3*3
+	if (pAd->MACVersion >= RALINK_2883_VERSION)	/* 3*3 */
 	{
-		if (pAd->MACVersion >= RALINK_3070_VERSION)
-		{
-			if (pEntryPeer->WepStatus != Ndis802_11EncryptionDisabled)
-				MaxSize = 7; // for non-open mode
+		if (pAd->MACVersion >= RALINK_3070_VERSION) {
+			if (pEntryPeer->WepStatus !=
+			    Ndis802_11EncryptionDisabled)
+				MaxSize = 7;	/* for non-open mode */
 			else
 				MaxSize = 13;
-		}
-		else
+		} else
 			MaxSize = 31;
-	}
-	else if (pAd->MACVersion >= RALINK_2880E_VERSION) // 2880 e
+	} else if (pAd->MACVersion >= RALINK_2880E_VERSION)	/* 2880 e */
 	{
 		if (pEntryPeer->WepStatus != Ndis802_11EncryptionDisabled)
-			MaxSize = 7; // for non-open mode
+			MaxSize = 7;	/* for non-open mode */
 		else
 			MaxSize = 13;
-	}
-	else
+	} else
 		MaxSize = 7;
 
 	DBGPRINT(RT_DEBUG_TRACE, ("ba> Win Size = %d, Max Size = %d\n",
-			*pWinSize, MaxSize));
+				  *pWinSize, MaxSize));
 
-	if ((*pWinSize) > MaxSize)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("ba> reassign max win size from %d to %d\n",
-				*pWinSize, MaxSize));
+	if ((*pWinSize) > MaxSize) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("ba> reassign max win size from %d to %d\n",
+			  *pWinSize, MaxSize));
 
 		*pWinSize = MaxSize;
 	}
 }
 
-void Announce_Reordering_Packet(IN PRTMP_ADAPTER			pAd,
-								IN struct reordering_mpdu	*mpdu)
+void Announce_Reordering_Packet(struct rt_rtmp_adapter *pAd,
+				IN struct reordering_mpdu *mpdu)
 {
-	PNDIS_PACKET    pPacket;
+	void *pPacket;
 
 	pPacket = mpdu->pPacket;
 
-	if (mpdu->bAMSDU)
-	{
+	if (mpdu->bAMSDU) {
 		ASSERT(0);
 		BA_Reorder_AMSDU_Annnounce(pAd, pPacket);
-	}
-	else
-	{
-		//
-		// pass this 802.3 packet to upper layer or forward this packet to WM directly
-		//
+	} else {
+		/* */
+		/* pass this 802.3 packet to upper layer or forward this packet to WM directly */
+		/* */
 
-		ANNOUNCE_OR_FORWARD_802_3_PACKET(pAd, pPacket, RTMP_GET_PACKET_IF(pPacket));
+		ANNOUNCE_OR_FORWARD_802_3_PACKET(pAd, pPacket,
+						 RTMP_GET_PACKET_IF(pPacket));
 	}
 }
 
 /*
  * Insert a reordering mpdu into sorted linked list by sequence no.
  */
-BOOLEAN ba_reordering_mpdu_insertsorted(struct reordering_list *list, struct reordering_mpdu *mpdu)
+BOOLEAN ba_reordering_mpdu_insertsorted(struct reordering_list *list,
+					struct reordering_mpdu *mpdu)
 {
 
 	struct reordering_mpdu **ppScan = &list->next;
 
-	while (*ppScan != NULL)
-	{
-		if (SEQ_SMALLER((*ppScan)->Sequence, mpdu->Sequence, MAXSEQ))
-		{
+	while (*ppScan != NULL) {
+		if (SEQ_SMALLER((*ppScan)->Sequence, mpdu->Sequence, MAXSEQ)) {
 			ppScan = &(*ppScan)->next;
-		}
-		else if ((*ppScan)->Sequence == mpdu->Sequence)
-		{
+		} else if ((*ppScan)->Sequence == mpdu->Sequence) {
 			/* give up this duplicated frame */
-			return(FALSE);
-		}
-		else
-		{
+			return (FALSE);
+		} else {
 			/* find position */
 			break;
 		}
@@ -166,11 +144,11 @@ BOOLEAN ba_reordering_mpdu_insertsorted(struct reordering_list *list, struct reo
 	return TRUE;
 }
 
-
 /*
  * caller lock critical section if necessary
  */
-static inline void ba_enqueue(struct reordering_list *list, struct reordering_mpdu *mpdu_blk)
+static inline void ba_enqueue(struct reordering_list *list,
+			      struct reordering_mpdu *mpdu_blk)
 {
 	list->qlen++;
 	mpdu_blk->next = list->next;
@@ -180,47 +158,46 @@ static inline void ba_enqueue(struct reordering_list *list, struct reordering_mp
 /*
  * caller lock critical section if necessary
  */
-static inline struct reordering_mpdu * ba_dequeue(struct reordering_list *list)
+static inline struct reordering_mpdu *ba_dequeue(struct reordering_list *list)
 {
 	struct reordering_mpdu *mpdu_blk = NULL;
 
 	ASSERT(list);
 
-		if (list->qlen)
-		{
-			list->qlen--;
-			mpdu_blk = list->next;
-			if (mpdu_blk)
-			{
-				list->next = mpdu_blk->next;
-				mpdu_blk->next = NULL;
-			}
+	if (list->qlen) {
+		list->qlen--;
+		mpdu_blk = list->next;
+		if (mpdu_blk) {
+			list->next = mpdu_blk->next;
+			mpdu_blk->next = NULL;
 		}
+	}
 	return mpdu_blk;
 }
 
-
-static inline struct reordering_mpdu  *ba_reordering_mpdu_dequeue(struct reordering_list *list)
+static inline struct reordering_mpdu *ba_reordering_mpdu_dequeue(struct
+								 reordering_list
+								 *list)
 {
-	return(ba_dequeue(list));
+	return (ba_dequeue(list));
 }
 
-
-static inline struct reordering_mpdu  *ba_reordering_mpdu_probe(struct reordering_list *list)
-	{
+static inline struct reordering_mpdu *ba_reordering_mpdu_probe(struct
+							       reordering_list
+							       *list)
+{
 	ASSERT(list);
 
-		return(list->next);
-	}
-
+	return (list->next);
+}
 
 /*
  * free all resource for reordering mechanism
  */
-void ba_reordering_resource_release(PRTMP_ADAPTER pAd)
+void ba_reordering_resource_release(struct rt_rtmp_adapter *pAd)
 {
-	BA_TABLE        *Tab;
-	PBA_REC_ENTRY   pBAEntry;
+	struct rt_ba_table *Tab;
+	struct rt_ba_rec_entry *pBAEntry;
 	struct reordering_mpdu *mpdu_blk;
 	int i;
 
@@ -228,15 +205,14 @@ void ba_reordering_resource_release(PRTMP_ADAPTER pAd)
 
 	/* I.  release all pending reordering packet */
 	NdisAcquireSpinLock(&pAd->BATabLock);
-	for (i = 0; i < MAX_LEN_OF_BA_REC_TABLE; i++)
-	{
+	for (i = 0; i < MAX_LEN_OF_BA_REC_TABLE; i++) {
 		pBAEntry = &Tab->BARecEntry[i];
-		if (pBAEntry->REC_BA_Status != Recipient_NONE)
-		{
-			while ((mpdu_blk = ba_reordering_mpdu_dequeue(&pBAEntry->list)))
-			{
+		if (pBAEntry->REC_BA_Status != Recipient_NONE) {
+			while ((mpdu_blk =
+				ba_reordering_mpdu_dequeue(&pBAEntry->list))) {
 				ASSERT(mpdu_blk->pPacket);
-				RELEASE_NDIS_PACKET(pAd, mpdu_blk->pPacket, NDIS_STATUS_FAILURE);
+				RELEASE_NDIS_PACKET(pAd, mpdu_blk->pPacket,
+						    NDIS_STATUS_FAILURE);
 				ba_mpdu_blk_free(pAd, mpdu_blk);
 			}
 		}
@@ -250,15 +226,13 @@ void ba_reordering_resource_release(PRTMP_ADAPTER pAd)
 	NdisReleaseSpinLock(&pAd->mpdu_blk_pool.lock);
 }
 
-
-
 /*
  * Allocate all resource for reordering mechanism
  */
-BOOLEAN ba_reordering_resource_init(PRTMP_ADAPTER pAd, int num)
+BOOLEAN ba_reordering_resource_init(struct rt_rtmp_adapter *pAd, int num)
 {
-	int     i;
-	PUCHAR  mem;
+	int i;
+	u8 *mem;
 	struct reordering_mpdu *mpdu_blk;
 	struct reordering_list *freelist;
 
@@ -270,24 +244,26 @@ BOOLEAN ba_reordering_resource_init(PRTMP_ADAPTER pAd, int num)
 	freelist->next = NULL;
 	freelist->qlen = 0;
 
-	DBGPRINT(RT_DEBUG_TRACE, ("Allocate %d memory for BA reordering\n", (UINT32)(num*sizeof(struct reordering_mpdu))));
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("Allocate %d memory for BA reordering\n",
+		  (u32)(num * sizeof(struct reordering_mpdu))));
 
 	/* allocate number of mpdu_blk memory */
-	os_alloc_mem(pAd, (PUCHAR *)&mem, (num*sizeof(struct reordering_mpdu)));
+	os_alloc_mem(pAd, (u8 **) & mem,
+		     (num * sizeof(struct reordering_mpdu)));
 
 	pAd->mpdu_blk_pool.mem = mem;
 
-	if (mem == NULL)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("Can't Allocate Memory for BA Reordering\n"));
-		return(FALSE);
+	if (mem == NULL) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("Can't Allocate Memory for BA Reordering\n"));
+		return (FALSE);
 	}
 
 	/* build mpdu_blk free list */
-	for (i=0; i<num; i++)
-	{
+	for (i = 0; i < num; i++) {
 		/* get mpdu_blk */
-		mpdu_blk = (struct reordering_mpdu *) mem;
+		mpdu_blk = (struct reordering_mpdu *)mem;
 		/* initial mpdu_blk */
 		NdisZeroMemory(mpdu_blk, sizeof(struct reordering_mpdu));
 		/* next mpdu_blk */
@@ -296,20 +272,19 @@ BOOLEAN ba_reordering_resource_init(PRTMP_ADAPTER pAd, int num)
 		ba_enqueue(freelist, mpdu_blk);
 	}
 
-	return(TRUE);
+	return (TRUE);
 }
 
-//static int blk_count=0; // sample take off, no use
+/*static int blk_count=0; // sample take off, no use */
 
-static struct reordering_mpdu *ba_mpdu_blk_alloc(PRTMP_ADAPTER pAd)
+static struct reordering_mpdu *ba_mpdu_blk_alloc(struct rt_rtmp_adapter *pAd)
 {
 	struct reordering_mpdu *mpdu_blk;
 
 	NdisAcquireSpinLock(&pAd->mpdu_blk_pool.lock);
 	mpdu_blk = ba_dequeue(&pAd->mpdu_blk_pool.freelist);
-	if (mpdu_blk)
-	{
-//		blk_count++;
+	if (mpdu_blk) {
+/*              blk_count++; */
 		/* reset mpdu_blk */
 		NdisZeroMemory(mpdu_blk, sizeof(struct reordering_mpdu));
 	}
@@ -317,43 +292,40 @@ static struct reordering_mpdu *ba_mpdu_blk_alloc(PRTMP_ADAPTER pAd)
 	return mpdu_blk;
 }
 
-static void ba_mpdu_blk_free(PRTMP_ADAPTER pAd, struct reordering_mpdu *mpdu_blk)
+static void ba_mpdu_blk_free(struct rt_rtmp_adapter *pAd,
+			     struct reordering_mpdu *mpdu_blk)
 {
 	ASSERT(mpdu_blk);
 
 	NdisAcquireSpinLock(&pAd->mpdu_blk_pool.lock);
-//	blk_count--;
+/*      blk_count--; */
 	ba_enqueue(&pAd->mpdu_blk_pool.freelist, mpdu_blk);
 	NdisReleaseSpinLock(&pAd->mpdu_blk_pool.lock);
 }
 
-
-static USHORT ba_indicate_reordering_mpdus_in_order(
-												   IN PRTMP_ADAPTER    pAd,
-												   IN PBA_REC_ENTRY    pBAEntry,
-												   IN USHORT           StartSeq)
+static u16 ba_indicate_reordering_mpdus_in_order(struct rt_rtmp_adapter *pAd,
+						    struct rt_ba_rec_entry *pBAEntry,
+						    u16 StartSeq)
 {
 	struct reordering_mpdu *mpdu_blk;
-	USHORT  LastIndSeq = RESET_RCV_SEQ;
+	u16 LastIndSeq = RESET_RCV_SEQ;
 
 	NdisAcquireSpinLock(&pBAEntry->RxReRingLock);
 
-	while ((mpdu_blk = ba_reordering_mpdu_probe(&pBAEntry->list)))
-		{
-			/* find in-order frame */
-		if (!SEQ_STEPONE(mpdu_blk->Sequence, StartSeq, MAXSEQ))
-			{
-				break;
-			}
-			/* dequeue in-order frame from reodering list */
-			mpdu_blk = ba_reordering_mpdu_dequeue(&pBAEntry->list);
-			/* pass this frame up */
+	while ((mpdu_blk = ba_reordering_mpdu_probe(&pBAEntry->list))) {
+		/* find in-order frame */
+		if (!SEQ_STEPONE(mpdu_blk->Sequence, StartSeq, MAXSEQ)) {
+			break;
+		}
+		/* dequeue in-order frame from reodering list */
+		mpdu_blk = ba_reordering_mpdu_dequeue(&pBAEntry->list);
+		/* pass this frame up */
 		ANNOUNCE_REORDERING_PACKET(pAd, mpdu_blk);
 		/* move to next sequence */
-			StartSeq = mpdu_blk->Sequence;
+		StartSeq = mpdu_blk->Sequence;
 		LastIndSeq = StartSeq;
 		/* free mpdu_blk */
-			ba_mpdu_blk_free(pAd, mpdu_blk);
+		ba_mpdu_blk_free(pAd, mpdu_blk);
 	}
 
 	NdisReleaseSpinLock(&pBAEntry->RxReRingLock);
@@ -362,51 +334,44 @@ static USHORT ba_indicate_reordering_mpdus_in_order(
 	return LastIndSeq;
 }
 
-static void ba_indicate_reordering_mpdus_le_seq(
-											   IN PRTMP_ADAPTER    pAd,
-											   IN PBA_REC_ENTRY    pBAEntry,
-											   IN USHORT           Sequence)
+static void ba_indicate_reordering_mpdus_le_seq(struct rt_rtmp_adapter *pAd,
+						struct rt_ba_rec_entry *pBAEntry,
+						u16 Sequence)
 {
 	struct reordering_mpdu *mpdu_blk;
 
 	NdisAcquireSpinLock(&pBAEntry->RxReRingLock);
-	while ((mpdu_blk = ba_reordering_mpdu_probe(&pBAEntry->list)))
-		{
-			/* find in-order frame */
-		if ((mpdu_blk->Sequence == Sequence) || SEQ_SMALLER(mpdu_blk->Sequence, Sequence, MAXSEQ))
-		{
+	while ((mpdu_blk = ba_reordering_mpdu_probe(&pBAEntry->list))) {
+		/* find in-order frame */
+		if ((mpdu_blk->Sequence == Sequence)
+		    || SEQ_SMALLER(mpdu_blk->Sequence, Sequence, MAXSEQ)) {
 			/* dequeue in-order frame from reodering list */
 			mpdu_blk = ba_reordering_mpdu_dequeue(&pBAEntry->list);
 			/* pass this frame up */
 			ANNOUNCE_REORDERING_PACKET(pAd, mpdu_blk);
 			/* free mpdu_blk */
 			ba_mpdu_blk_free(pAd, mpdu_blk);
+		} else {
+			break;
 		}
-		else
-			{
-				break;
-			}
 	}
 	NdisReleaseSpinLock(&pBAEntry->RxReRingLock);
 }
 
-
-static void ba_refresh_reordering_mpdus(
-									   IN PRTMP_ADAPTER    pAd,
-									   PBA_REC_ENTRY       pBAEntry)
+static void ba_refresh_reordering_mpdus(struct rt_rtmp_adapter *pAd,
+					struct rt_ba_rec_entry *pBAEntry)
 {
 	struct reordering_mpdu *mpdu_blk;
 
 	NdisAcquireSpinLock(&pBAEntry->RxReRingLock);
 
-			/* dequeue in-order frame from reodering list */
-	while ((mpdu_blk = ba_reordering_mpdu_dequeue(&pBAEntry->list)))
-	{
-			/* pass this frame up */
+	/* dequeue in-order frame from reodering list */
+	while ((mpdu_blk = ba_reordering_mpdu_dequeue(&pBAEntry->list))) {
+		/* pass this frame up */
 		ANNOUNCE_REORDERING_PACKET(pAd, mpdu_blk);
 
 		pBAEntry->LastIndSeq = mpdu_blk->Sequence;
-			ba_mpdu_blk_free(pAd, mpdu_blk);
+		ba_mpdu_blk_free(pAd, mpdu_blk);
 
 		/* update last indicated sequence */
 	}
@@ -415,248 +380,240 @@ static void ba_refresh_reordering_mpdus(
 	NdisReleaseSpinLock(&pBAEntry->RxReRingLock);
 }
 
-
-//static
-void ba_flush_reordering_timeout_mpdus(
-									IN PRTMP_ADAPTER    pAd,
-									IN PBA_REC_ENTRY    pBAEntry,
-									IN ULONG            Now32)
-
+/*static */
+void ba_flush_reordering_timeout_mpdus(struct rt_rtmp_adapter *pAd,
+				       struct rt_ba_rec_entry *pBAEntry,
+				       unsigned long Now32)
 {
-	USHORT Sequence;
-
-//	if ((RTMP_TIME_AFTER((unsigned long)Now32, (unsigned long)(pBAEntry->LastIndSeqAtTimer+REORDERING_PACKET_TIMEOUT)) &&
-//		 (pBAEntry->list.qlen > ((pBAEntry->BAWinSize*7)/8))) //||
-//		(RTMP_TIME_AFTER((unsigned long)Now32, (unsigned long)(pBAEntry->LastIndSeqAtTimer+(10*REORDERING_PACKET_TIMEOUT))) &&
-//		 (pBAEntry->list.qlen > (pBAEntry->BAWinSize/8)))
-	if (RTMP_TIME_AFTER((unsigned long)Now32, (unsigned long)(pBAEntry->LastIndSeqAtTimer+(MAX_REORDERING_PACKET_TIMEOUT/6)))
-		 &&(pBAEntry->list.qlen > 1)
-		)
-	{
-		DBGPRINT(RT_DEBUG_TRACE,("timeout[%d] (%08lx-%08lx = %d > %d): %x, flush all!\n ", pBAEntry->list.qlen, Now32, (pBAEntry->LastIndSeqAtTimer),
-			   (int)((long) Now32 - (long)(pBAEntry->LastIndSeqAtTimer)), MAX_REORDERING_PACKET_TIMEOUT,
-			   pBAEntry->LastIndSeq));
+	u16 Sequence;
+
+/*      if ((RTMP_TIME_AFTER((unsigned long)Now32, (unsigned long)(pBAEntry->LastIndSeqAtTimer+REORDERING_PACKET_TIMEOUT)) && */
+/*               (pBAEntry->list.qlen > ((pBAEntry->BAWinSize*7)/8))) //|| */
+/*              (RTMP_TIME_AFTER((unsigned long)Now32, (unsigned long)(pBAEntry->LastIndSeqAtTimer+(10*REORDERING_PACKET_TIMEOUT))) && */
+/*               (pBAEntry->list.qlen > (pBAEntry->BAWinSize/8))) */
+	if (RTMP_TIME_AFTER
+	    ((unsigned long)Now32,
+	     (unsigned long)(pBAEntry->LastIndSeqAtTimer +
+			     (MAX_REORDERING_PACKET_TIMEOUT / 6)))
+	    && (pBAEntry->list.qlen > 1)
+	    ) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("timeout[%d] (%08lx-%08lx = %d > %d): %x, flush all!\n ",
+			  pBAEntry->list.qlen, Now32,
+			  (pBAEntry->LastIndSeqAtTimer),
+			  (int)((long)Now32 -
+				(long)(pBAEntry->LastIndSeqAtTimer)),
+			  MAX_REORDERING_PACKET_TIMEOUT, pBAEntry->LastIndSeq));
 		ba_refresh_reordering_mpdus(pAd, pBAEntry);
 		pBAEntry->LastIndSeqAtTimer = Now32;
-	}
-	else
-	if (RTMP_TIME_AFTER((unsigned long)Now32, (unsigned long)(pBAEntry->LastIndSeqAtTimer+(REORDERING_PACKET_TIMEOUT)))
+	} else
+	    if (RTMP_TIME_AFTER
+		((unsigned long)Now32,
+		 (unsigned long)(pBAEntry->LastIndSeqAtTimer +
+				 (REORDERING_PACKET_TIMEOUT)))
 		&& (pBAEntry->list.qlen > 0)
-	   )
-		{
-    		//
-		// force LastIndSeq to shift to LastIndSeq+1
-    		//
-    		Sequence = (pBAEntry->LastIndSeq+1) & MAXSEQ;
-    		ba_indicate_reordering_mpdus_le_seq(pAd, pBAEntry, Sequence);
-    		pBAEntry->LastIndSeqAtTimer = Now32;
+	    ) {
+		/* */
+		/* force LastIndSeq to shift to LastIndSeq+1 */
+		/* */
+		Sequence = (pBAEntry->LastIndSeq + 1) & MAXSEQ;
+		ba_indicate_reordering_mpdus_le_seq(pAd, pBAEntry, Sequence);
+		pBAEntry->LastIndSeqAtTimer = Now32;
+		pBAEntry->LastIndSeq = Sequence;
+		/* */
+		/* indicate in-order mpdus */
+		/* */
+		Sequence =
+		    ba_indicate_reordering_mpdus_in_order(pAd, pBAEntry,
+							  Sequence);
+		if (Sequence != RESET_RCV_SEQ) {
 			pBAEntry->LastIndSeq = Sequence;
-    		//
-    		// indicate in-order mpdus
-    		//
-    		Sequence = ba_indicate_reordering_mpdus_in_order(pAd, pBAEntry, Sequence);
-    		if (Sequence != RESET_RCV_SEQ)
-    		{
-    			pBAEntry->LastIndSeq = Sequence;
-    		}
+		}
+
+		DBGPRINT(RT_DEBUG_OFF,
+			 ("%x, flush one!\n", pBAEntry->LastIndSeq));
 
 	}
 }
 
-
 /*
  * generate ADDBA request to
  * set up BA agreement
  */
-VOID BAOriSessionSetUp(
-					  IN PRTMP_ADAPTER    pAd,
-					  IN MAC_TABLE_ENTRY  *pEntry,
-					  IN UCHAR            TID,
-					  IN USHORT           TimeOut,
-					  IN ULONG            DelayTime,
-					  IN BOOLEAN          isForced)
-
+void BAOriSessionSetUp(struct rt_rtmp_adapter *pAd,
+		       struct rt_mac_table_entry *pEntry,
+		       u8 TID,
+		       u16 TimeOut,
+		       unsigned long DelayTime, IN BOOLEAN isForced)
 {
-	//MLME_ADDBA_REQ_STRUCT	AddbaReq;
-	BA_ORI_ENTRY            *pBAEntry = NULL;
-	USHORT                  Idx;
-	BOOLEAN                 Cancelled;
+	/*struct rt_mlme_addba_req AddbaReq; */
+	struct rt_ba_ori_entry *pBAEntry = NULL;
+	u16 Idx;
+	BOOLEAN Cancelled;
 
-	if ((pAd->CommonCfg.BACapability.field.AutoBA != TRUE)  &&  (isForced == FALSE))
+	if ((pAd->CommonCfg.BACapability.field.AutoBA != TRUE)
+	    && (isForced == FALSE))
 		return;
 
-	// if this entry is limited to use legacy tx mode, it doesn't generate BA.
+	/* if this entry is limited to use legacy tx mode, it doesn't generate BA. */
 	if (RTMPStaFixedTxMode(pAd, pEntry) != FIXED_TXMODE_HT)
 		return;
 
-	if ((pEntry->BADeclineBitmap & (1<<TID)) && (isForced == FALSE))
-	{
-		// try again after 3 secs
+	if ((pEntry->BADeclineBitmap & (1 << TID)) && (isForced == FALSE)) {
+		/* try again after 3 secs */
 		DelayTime = 3000;
-//		printk("DeCline BA from Peer\n");
-//		return;
+/*              DBGPRINT(RT_DEBUG_TRACE, ("DeCline BA from Peer\n")); */
+/*              return; */
 	}
 
-
 	Idx = pEntry->BAOriWcidArray[TID];
-	if (Idx == 0)
-	{
-		// allocate a BA session
+	if (Idx == 0) {
+		/* allocate a BA session */
 		pBAEntry = BATableAllocOriEntry(pAd, &Idx);
-		if (pBAEntry == NULL)
-		{
-			DBGPRINT(RT_DEBUG_TRACE,("ADDBA - MlmeADDBAAction() allocate BA session failed \n"));
+		if (pBAEntry == NULL) {
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("ADDBA - MlmeADDBAAction() allocate BA session failed \n"));
 			return;
 		}
-	}
-	else
-	{
-		pBAEntry =&pAd->BATable.BAOriEntry[Idx];
+	} else {
+		pBAEntry = &pAd->BATable.BAOriEntry[Idx];
 	}
 
-	if (pBAEntry->ORI_BA_Status >= Originator_WaitRes)
-	{
+	if (pBAEntry->ORI_BA_Status >= Originator_WaitRes) {
 		return;
 	}
 
 	pEntry->BAOriWcidArray[TID] = Idx;
 
-	// Initialize BA session
+	/* Initialize BA session */
 	pBAEntry->ORI_BA_Status = Originator_WaitRes;
 	pBAEntry->Wcid = pEntry->Aid;
 	pBAEntry->BAWinSize = pAd->CommonCfg.BACapability.field.RxBAWinLimit;
 	pBAEntry->Sequence = BA_ORI_INIT_SEQ;
-	pBAEntry->Token = 1;	// (2008-01-21) Jan Lee recommends it - this token can't be 0
+	pBAEntry->Token = 1;	/* (2008-01-21) Jan Lee recommends it - this token can't be 0 */
 	pBAEntry->TID = TID;
 	pBAEntry->TimeOutValue = TimeOut;
 	pBAEntry->pAdapter = pAd;
 
-	DBGPRINT(RT_DEBUG_TRACE,("Send AddBA to %02x:%02x:%02x:%02x:%02x:%02x Tid:%d isForced:%d Wcid:%d\n"
-		,pEntry->Addr[0],pEntry->Addr[1],pEntry->Addr[2]
-		,pEntry->Addr[3],pEntry->Addr[4],pEntry->Addr[5]
-		,TID,isForced,pEntry->Aid));
-
-	if (!(pEntry->TXBAbitmap & (1<<TID)))
-	{
-		RTMPInitTimer(pAd, &pBAEntry->ORIBATimer, GET_TIMER_FUNCTION(BAOriSessionSetupTimeout), pBAEntry, FALSE);
-	}
-	else
+	if (!(pEntry->TXBAbitmap & (1 << TID))) {
+		RTMPInitTimer(pAd, &pBAEntry->ORIBATimer,
+			      GET_TIMER_FUNCTION(BAOriSessionSetupTimeout),
+			      pBAEntry, FALSE);
+	} else
 		RTMPCancelTimer(&pBAEntry->ORIBATimer, &Cancelled);
 
-	// set timer to send ADDBA request
+	/* set timer to send ADDBA request */
 	RTMPSetTimer(&pBAEntry->ORIBATimer, DelayTime);
 }
 
-VOID BAOriSessionAdd(
-			IN PRTMP_ADAPTER    pAd,
-					IN MAC_TABLE_ENTRY  *pEntry,
-			IN PFRAME_ADDBA_RSP pFrame)
+void BAOriSessionAdd(struct rt_rtmp_adapter *pAd,
+		     struct rt_mac_table_entry *pEntry, struct rt_frame_addba_rsp * pFrame)
 {
-	BA_ORI_ENTRY  *pBAEntry = NULL;
-	BOOLEAN       Cancelled;
-	UCHAR         TID;
-	USHORT        Idx;
-	PUCHAR          pOutBuffer2 = NULL;
-	NDIS_STATUS     NStatus;
-	ULONG           FrameLen;
-	FRAME_BAR       FrameBar;
+	struct rt_ba_ori_entry *pBAEntry = NULL;
+	BOOLEAN Cancelled;
+	u8 TID;
+	u16 Idx;
+	u8 *pOutBuffer2 = NULL;
+	int NStatus;
+	unsigned long FrameLen;
+	struct rt_frame_bar FrameBar;
 
 	TID = pFrame->BaParm.TID;
 	Idx = pEntry->BAOriWcidArray[TID];
-	pBAEntry =&pAd->BATable.BAOriEntry[Idx];
+	pBAEntry = &pAd->BATable.BAOriEntry[Idx];
 
-	// Start fill in parameters.
-	if ((Idx !=0) && (pBAEntry->TID == TID) && (pBAEntry->ORI_BA_Status == Originator_WaitRes))
-	{
-		pBAEntry->BAWinSize = min(pBAEntry->BAWinSize, ((UCHAR)pFrame->BaParm.BufSize));
+	/* Start fill in parameters. */
+	if ((Idx != 0) && (pBAEntry->TID == TID)
+	    && (pBAEntry->ORI_BA_Status == Originator_WaitRes)) {
+		pBAEntry->BAWinSize =
+		    min(pBAEntry->BAWinSize, ((u8)pFrame->BaParm.BufSize));
 		BA_MaxWinSizeReasign(pAd, pEntry, &pBAEntry->BAWinSize);
 
 		pBAEntry->TimeOutValue = pFrame->TimeOutValue;
 		pBAEntry->ORI_BA_Status = Originator_Done;
-		// reset sequence number
+		pAd->BATable.numDoneOriginator++;
+
+		/* reset sequence number */
 		pBAEntry->Sequence = BA_ORI_INIT_SEQ;
-		// Set Bitmap flag.
-		pEntry->TXBAbitmap |= (1<<TID);
-				RTMPCancelTimer(&pBAEntry->ORIBATimer, &Cancelled);
+		/* Set Bitmap flag. */
+		pEntry->TXBAbitmap |= (1 << TID);
+		RTMPCancelTimer(&pBAEntry->ORIBATimer, &Cancelled);
 
-		pBAEntry->ORIBATimer.TimerValue = 0;	//pFrame->TimeOutValue;
+		pBAEntry->ORIBATimer.TimerValue = 0;	/*pFrame->TimeOutValue; */
 
-		DBGPRINT(RT_DEBUG_TRACE,("%s : TXBAbitmap = %x, BAWinSize = %d, TimeOut = %ld\n", __func__, pEntry->TXBAbitmap,
-								 pBAEntry->BAWinSize, pBAEntry->ORIBATimer.TimerValue));
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("%s : TXBAbitmap = %x, BAWinSize = %d, TimeOut = %ld\n",
+			  __func__, pEntry->TXBAbitmap, pBAEntry->BAWinSize,
+			  pBAEntry->ORIBATimer.TimerValue));
 
-		// SEND BAR ;
-		NStatus = MlmeAllocateMemory(pAd, &pOutBuffer2);  //Get an unused nonpaged memory
-		if (NStatus != NDIS_STATUS_SUCCESS)
-		{
-			DBGPRINT(RT_DEBUG_TRACE,("BA - BAOriSessionAdd() allocate memory failed \n"));
+		/* SEND BAR ; */
+		NStatus = MlmeAllocateMemory(pAd, &pOutBuffer2);	/*Get an unused nonpaged memory */
+		if (NStatus != NDIS_STATUS_SUCCESS) {
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("BA - BAOriSessionAdd() allocate memory failed \n"));
 			return;
 		}
 
-		BarHeaderInit(pAd, &FrameBar, pAd->MacTab.Content[pBAEntry->Wcid].Addr, pAd->CurrentAddress);
+		BarHeaderInit(pAd, &FrameBar,
+			      pAd->MacTab.Content[pBAEntry->Wcid].Addr,
+			      pAd->CurrentAddress);
 
-		FrameBar.StartingSeq.field.FragNum = 0;	// make sure sequence not clear in DEL function.
-		FrameBar.StartingSeq.field.StartSeq = pBAEntry->Sequence; // make sure sequence not clear in DEL funciton.
-		FrameBar.BarControl.TID = pBAEntry->TID; // make sure sequence not clear in DEL funciton.
-		MakeOutgoingFrame(pOutBuffer2,              &FrameLen,
-						  sizeof(FRAME_BAR),      &FrameBar,
-					  END_OF_ARGS);
+		FrameBar.StartingSeq.field.FragNum = 0;	/* make sure sequence not clear in DEL function. */
+		FrameBar.StartingSeq.field.StartSeq = pBAEntry->Sequence;	/* make sure sequence not clear in DEL funciton. */
+		FrameBar.BarControl.TID = pBAEntry->TID;	/* make sure sequence not clear in DEL funciton. */
+		MakeOutgoingFrame(pOutBuffer2, &FrameLen,
+				  sizeof(struct rt_frame_bar), &FrameBar, END_OF_ARGS);
 		MiniportMMRequest(pAd, QID_AC_BE, pOutBuffer2, FrameLen);
 		MlmeFreeMemory(pAd, pOutBuffer2);
 
-
 		if (pBAEntry->ORIBATimer.TimerValue)
-			RTMPSetTimer(&pBAEntry->ORIBATimer, pBAEntry->ORIBATimer.TimerValue); // in mSec
+			RTMPSetTimer(&pBAEntry->ORIBATimer, pBAEntry->ORIBATimer.TimerValue);	/* in mSec */
 	}
 }
 
-BOOLEAN BARecSessionAdd(
-					   IN PRTMP_ADAPTER    pAd,
-					   IN MAC_TABLE_ENTRY  *pEntry,
-					   IN PFRAME_ADDBA_REQ pFrame)
+BOOLEAN BARecSessionAdd(struct rt_rtmp_adapter *pAd,
+			struct rt_mac_table_entry *pEntry, struct rt_frame_addba_req * pFrame)
 {
-	BA_REC_ENTRY            *pBAEntry = NULL;
-	BOOLEAN                 Status = TRUE;
-	BOOLEAN                 Cancelled;
-	USHORT                  Idx;
-	UCHAR                   TID;
-	UCHAR                   BAWinSize;
-	//UINT32                  Value;
-	//UINT                    offset;
-
+	struct rt_ba_rec_entry *pBAEntry = NULL;
+	BOOLEAN Status = TRUE;
+	BOOLEAN Cancelled;
+	u16 Idx;
+	u8 TID;
+	u8 BAWinSize;
+	/*u32                  Value; */
+	/*u32                    offset; */
 
 	ASSERT(pEntry);
 
-	// find TID
+	/* find TID */
 	TID = pFrame->BaParm.TID;
 
-	BAWinSize = min(((UCHAR)pFrame->BaParm.BufSize), (UCHAR)pAd->CommonCfg.BACapability.field.RxBAWinLimit);
+	BAWinSize =
+	    min(((u8)pFrame->BaParm.BufSize),
+		(u8)pAd->CommonCfg.BACapability.field.RxBAWinLimit);
 
-	// Intel patch
-	if (BAWinSize == 0)
-	{
+	/* Intel patch */
+	if (BAWinSize == 0) {
 		BAWinSize = 64;
 	}
 
 	Idx = pEntry->BARecWcidArray[TID];
 
-
-	if (Idx == 0)
-	{
+	if (Idx == 0) {
 		pBAEntry = BATableAllocRecEntry(pAd, &Idx);
-	}
-	else
-	{
+	} else {
 		pBAEntry = &pAd->BATable.BARecEntry[Idx];
-		// flush all pending reordering mpdus
+		/* flush all pending reordering mpdus */
 		ba_refresh_reordering_mpdus(pAd, pBAEntry);
 	}
 
-	DBGPRINT(RT_DEBUG_TRACE,("%s(%ld): Idx = %d, BAWinSize(req %d) = %d\n", __func__, pAd->BATable.numAsRecipient, Idx,
-							 pFrame->BaParm.BufSize, BAWinSize));
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("%s(%ld): Idx = %d, BAWinSize(req %d) = %d\n", __func__,
+		  pAd->BATable.numAsRecipient, Idx, pFrame->BaParm.BufSize,
+		  BAWinSize));
 
-	// Start fill in parameters.
-	if (pBAEntry != NULL)
-	{
+	/* Start fill in parameters. */
+	if (pBAEntry != NULL) {
 		ASSERT(pBAEntry->list.qlen == 0);
 
 		pBAEntry->REC_BA_Status = Recipient_HandleRes;
@@ -665,66 +622,62 @@ BOOLEAN BARecSessionAdd(
 		pBAEntry->TID = TID;
 		pBAEntry->TimeOutValue = pFrame->TimeOutValue;
 		pBAEntry->REC_BA_Status = Recipient_Accept;
-		// initial sequence number
-		pBAEntry->LastIndSeq = RESET_RCV_SEQ; //pFrame->BaStartSeq.field.StartSeq;
+		/* initial sequence number */
+		pBAEntry->LastIndSeq = RESET_RCV_SEQ;	/*pFrame->BaStartSeq.field.StartSeq; */
 
-		printk("Start Seq = %08x\n",  pFrame->BaStartSeq.field.StartSeq);
+		DBGPRINT(RT_DEBUG_OFF,
+			 ("Start Seq = %08x\n",
+			  pFrame->BaStartSeq.field.StartSeq));
 
-		if (pEntry->RXBAbitmap & (1<<TID))
-		{
+		if (pEntry->RXBAbitmap & (1 << TID)) {
 			RTMPCancelTimer(&pBAEntry->RECBATimer, &Cancelled);
-		}
-		else
-		{
-			RTMPInitTimer(pAd, &pBAEntry->RECBATimer, GET_TIMER_FUNCTION(BARecSessionIdleTimeout), pBAEntry, TRUE);
+		} else {
+			RTMPInitTimer(pAd, &pBAEntry->RECBATimer,
+				      GET_TIMER_FUNCTION
+				      (BARecSessionIdleTimeout), pBAEntry,
+				      TRUE);
 		}
 
-		// Set Bitmap flag.
-		pEntry->RXBAbitmap |= (1<<TID);
+		/* Set Bitmap flag. */
+		pEntry->RXBAbitmap |= (1 << TID);
 		pEntry->BARecWcidArray[TID] = Idx;
 
-		pEntry->BADeclineBitmap &= ~(1<<TID);
+		pEntry->BADeclineBitmap &= ~(1 << TID);
 
-		// Set BA session mask in WCID table.
-		RT28XX_ADD_BA_SESSION_TO_ASIC(pAd, pEntry->Aid, TID);
+		/* Set BA session mask in WCID table. */
+		RTMP_ADD_BA_SESSION_TO_ASIC(pAd, pEntry->Aid, TID);
 
-		DBGPRINT(RT_DEBUG_TRACE,("MACEntry[%d]RXBAbitmap = 0x%x. BARecWcidArray=%d\n",
-				pEntry->Aid, pEntry->RXBAbitmap, pEntry->BARecWcidArray[TID]));
-	}
-	else
-	{
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("MACEntry[%d]RXBAbitmap = 0x%x. BARecWcidArray=%d\n",
+			  pEntry->Aid, pEntry->RXBAbitmap,
+			  pEntry->BARecWcidArray[TID]));
+	} else {
 		Status = FALSE;
-		DBGPRINT(RT_DEBUG_TRACE,("Can't Accept ADDBA for %02x:%02x:%02x:%02x:%02x:%02x TID = %d\n",
-				PRINT_MAC(pEntry->Addr), TID));
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("Can't Accept ADDBA for %02x:%02x:%02x:%02x:%02x:%02x TID = %d\n",
+			  PRINT_MAC(pEntry->Addr), TID));
 	}
-	return(Status);
+	return (Status);
 }
 
-
-BA_REC_ENTRY *BATableAllocRecEntry(
-								  IN  PRTMP_ADAPTER   pAd,
-								  OUT USHORT          *Idx)
+struct rt_ba_rec_entry *BATableAllocRecEntry(struct rt_rtmp_adapter *pAd, u16 * Idx)
 {
-	int             i;
-	BA_REC_ENTRY    *pBAEntry = NULL;
-
+	int i;
+	struct rt_ba_rec_entry *pBAEntry = NULL;
 
 	NdisAcquireSpinLock(&pAd->BATabLock);
 
-	if (pAd->BATable.numAsRecipient >= MAX_BARECI_SESSION)
-	{
-		printk("BA Recipeint Session (%ld) > %d\n", pAd->BATable.numAsRecipient,
-			MAX_BARECI_SESSION);
+	if (pAd->BATable.numAsRecipient >= MAX_BARECI_SESSION) {
+		DBGPRINT(RT_DEBUG_OFF, ("BA Recipeint Session (%ld) > %d\n",
+					pAd->BATable.numAsRecipient,
+					MAX_BARECI_SESSION));
 		goto done;
 	}
-
-	// reserve idx 0 to identify BAWcidArray[TID] as empty
-	for (i=1; i < MAX_LEN_OF_BA_REC_TABLE; i++)
-	{
-		pBAEntry =&pAd->BATable.BARecEntry[i];
-		if ((pBAEntry->REC_BA_Status == Recipient_NONE))
-		{
-			// get one
+	/* reserve idx 0 to identify BAWcidArray[TID] as empty */
+	for (i = 1; i < MAX_LEN_OF_BA_REC_TABLE; i++) {
+		pBAEntry = &pAd->BATable.BARecEntry[i];
+		if ((pBAEntry->REC_BA_Status == Recipient_NONE)) {
+			/* get one */
 			pAd->BATable.numAsRecipient++;
 			pBAEntry->REC_BA_Status = Recipient_USED;
 			*Idx = i;
@@ -737,27 +690,21 @@ done:
 	return pBAEntry;
 }
 
-BA_ORI_ENTRY *BATableAllocOriEntry(
-								  IN  PRTMP_ADAPTER   pAd,
-								  OUT USHORT          *Idx)
+struct rt_ba_ori_entry *BATableAllocOriEntry(struct rt_rtmp_adapter *pAd, u16 * Idx)
 {
-	int             i;
-	BA_ORI_ENTRY    *pBAEntry = NULL;
+	int i;
+	struct rt_ba_ori_entry *pBAEntry = NULL;
 
 	NdisAcquireSpinLock(&pAd->BATabLock);
 
-	if (pAd->BATable.numAsOriginator >= (MAX_LEN_OF_BA_ORI_TABLE))
-	{
+	if (pAd->BATable.numAsOriginator >= (MAX_LEN_OF_BA_ORI_TABLE)) {
 		goto done;
 	}
-
-	// reserve idx 0 to identify BAWcidArray[TID] as empty
-	for (i=1; i<MAX_LEN_OF_BA_ORI_TABLE; i++)
-	{
-		pBAEntry =&pAd->BATable.BAOriEntry[i];
-		if ((pBAEntry->ORI_BA_Status == Originator_NONE))
-		{
-			// get one
+	/* reserve idx 0 to identify BAWcidArray[TID] as empty */
+	for (i = 1; i < MAX_LEN_OF_BA_ORI_TABLE; i++) {
+		pBAEntry = &pAd->BATable.BAOriEntry[i];
+		if ((pBAEntry->ORI_BA_Status == Originator_NONE)) {
+			/* get one */
 			pAd->BATable.numAsOriginator++;
 			pBAEntry->ORI_BA_Status = Originator_USED;
 			pBAEntry->pAdapter = pAd;
@@ -771,32 +718,28 @@ done:
 	return pBAEntry;
 }
 
-
-VOID BATableFreeOriEntry(
-						IN  PRTMP_ADAPTER   pAd,
-						IN  ULONG           Idx)
+void BATableFreeOriEntry(struct rt_rtmp_adapter *pAd, unsigned long Idx)
 {
-	BA_ORI_ENTRY    *pBAEntry = NULL;
-	MAC_TABLE_ENTRY *pEntry;
-
+	struct rt_ba_ori_entry *pBAEntry = NULL;
+	struct rt_mac_table_entry *pEntry;
 
 	if ((Idx == 0) || (Idx >= MAX_LEN_OF_BA_ORI_TABLE))
 		return;
 
-	pBAEntry =&pAd->BATable.BAOriEntry[Idx];
+	pBAEntry = &pAd->BATable.BAOriEntry[Idx];
 
-	if (pBAEntry->ORI_BA_Status != Originator_NONE)
-	{
+	if (pBAEntry->ORI_BA_Status != Originator_NONE) {
 		pEntry = &pAd->MacTab.Content[pBAEntry->Wcid];
 		pEntry->BAOriWcidArray[pBAEntry->TID] = 0;
 
-
 		NdisAcquireSpinLock(&pAd->BATabLock);
-		if (pBAEntry->ORI_BA_Status == Originator_Done)
-		{
-		 	pEntry->TXBAbitmap &= (~(1<<(pBAEntry->TID) ));
-			DBGPRINT(RT_DEBUG_TRACE, ("BATableFreeOriEntry numAsOriginator= %ld\n", pAd->BATable.numAsRecipient));
-			// Erase Bitmap flag.
+		if (pBAEntry->ORI_BA_Status == Originator_Done) {
+			pAd->BATable.numDoneOriginator -= 1;
+			pEntry->TXBAbitmap &= (~(1 << (pBAEntry->TID)));
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("BATableFreeOriEntry numAsOriginator= %ld\n",
+				  pAd->BATable.numAsRecipient));
+			/* Erase Bitmap flag. */
 		}
 
 		ASSERT(pAd->BATable.numAsOriginator != 0);
@@ -809,22 +752,17 @@ VOID BATableFreeOriEntry(
 	}
 }
 
-
-VOID BATableFreeRecEntry(
-						IN  PRTMP_ADAPTER   pAd,
-						IN  ULONG           Idx)
+void BATableFreeRecEntry(struct rt_rtmp_adapter *pAd, unsigned long Idx)
 {
-	BA_REC_ENTRY    *pBAEntry = NULL;
-	MAC_TABLE_ENTRY *pEntry;
-
+	struct rt_ba_rec_entry *pBAEntry = NULL;
+	struct rt_mac_table_entry *pEntry;
 
 	if ((Idx == 0) || (Idx >= MAX_LEN_OF_BA_REC_TABLE))
 		return;
 
-	pBAEntry =&pAd->BATable.BARecEntry[Idx];
+	pBAEntry = &pAd->BATable.BARecEntry[Idx];
 
-	if (pBAEntry->REC_BA_Status != Recipient_NONE)
-	{
+	if (pBAEntry->REC_BA_Status != Recipient_NONE) {
 		pEntry = &pAd->MacTab.Content[pBAEntry->Wcid];
 		pEntry->BARecWcidArray[pBAEntry->TID] = 0;
 
@@ -839,177 +777,177 @@ VOID BATableFreeRecEntry(
 	}
 }
 
-
-VOID BAOriSessionTearDown(
-						 IN OUT  PRTMP_ADAPTER   pAd,
-						 IN      UCHAR           Wcid,
-						 IN      UCHAR           TID,
-						 IN      BOOLEAN         bPassive,
-						 IN      BOOLEAN         bForceSend)
+void BAOriSessionTearDown(struct rt_rtmp_adapter *pAd,
+			  u8 Wcid,
+			  u8 TID,
+			  IN BOOLEAN bPassive, IN BOOLEAN bForceSend)
 {
-	ULONG           Idx = 0;
-	BA_ORI_ENTRY    *pBAEntry;
-	BOOLEAN         Cancelled;
+	unsigned long Idx = 0;
+	struct rt_ba_ori_entry *pBAEntry;
+	BOOLEAN Cancelled;
 
-	if (Wcid >= MAX_LEN_OF_MAC_TABLE)
-	{
+	if (Wcid >= MAX_LEN_OF_MAC_TABLE) {
 		return;
 	}
-
-	//
-	// Locate corresponding BA Originator Entry in BA Table with the (pAddr,TID).
-	//
+	/* */
+	/* Locate corresponding BA Originator Entry in BA Table with the (pAddr,TID). */
+	/* */
 	Idx = pAd->MacTab.Content[Wcid].BAOriWcidArray[TID];
-	if ((Idx == 0) || (Idx >= MAX_LEN_OF_BA_ORI_TABLE))
-	{
-		if (bForceSend == TRUE)
-		{
-			// force send specified TID DelBA
-			MLME_DELBA_REQ_STRUCT   DelbaReq;
-			MLME_QUEUE_ELEM *Elem = (MLME_QUEUE_ELEM *) kmalloc(sizeof(MLME_QUEUE_ELEM), MEM_ALLOC_FLAG);
-			if (Elem == NULL)
-				return;
+	if ((Idx == 0) || (Idx >= MAX_LEN_OF_BA_ORI_TABLE)) {
+		if (bForceSend == TRUE) {
+			/* force send specified TID DelBA */
+			struct rt_mlme_delba_req DelbaReq;
+			struct rt_mlme_queue_elem *Elem =
+			    (struct rt_mlme_queue_elem *)kmalloc(sizeof(struct rt_mlme_queue_elem),
+							MEM_ALLOC_FLAG);
+			if (Elem != NULL) {
+				NdisZeroMemory(&DelbaReq, sizeof(DelbaReq));
+				NdisZeroMemory(Elem, sizeof(struct rt_mlme_queue_elem));
+
+				COPY_MAC_ADDR(DelbaReq.Addr,
+					      pAd->MacTab.Content[Wcid].Addr);
+				DelbaReq.Wcid = Wcid;
+				DelbaReq.TID = TID;
+				DelbaReq.Initiator = ORIGINATOR;
+				Elem->MsgLen = sizeof(DelbaReq);
+				NdisMoveMemory(Elem->Msg, &DelbaReq,
+					       sizeof(DelbaReq));
+				MlmeDELBAAction(pAd, Elem);
+				kfree(Elem);
+			} else {
+				DBGPRINT(RT_DEBUG_ERROR,
+					 ("%s(bForceSend):alloc memory failed!\n",
+					  __func__));
+			}
+		}
+
+		return;
+	}
+
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("%s===>Wcid=%d.TID=%d \n", __func__, Wcid, TID));
 
+	pBAEntry = &pAd->BATable.BAOriEntry[Idx];
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("\t===>Idx = %ld, Wcid=%d.TID=%d, ORI_BA_Status = %d \n", Idx,
+		  Wcid, TID, pBAEntry->ORI_BA_Status));
+	/* */
+	/* Prepare DelBA action frame and send to the peer. */
+	/* */
+	if ((bPassive == FALSE) && (TID == pBAEntry->TID)
+	    && (pBAEntry->ORI_BA_Status == Originator_Done)) {
+		struct rt_mlme_delba_req DelbaReq;
+		struct rt_mlme_queue_elem *Elem =
+		    (struct rt_mlme_queue_elem *)kmalloc(sizeof(struct rt_mlme_queue_elem),
+						MEM_ALLOC_FLAG);
+		if (Elem != NULL) {
 			NdisZeroMemory(&DelbaReq, sizeof(DelbaReq));
-			NdisZeroMemory(Elem, sizeof(MLME_QUEUE_ELEM));
+			NdisZeroMemory(Elem, sizeof(struct rt_mlme_queue_elem));
 
-			COPY_MAC_ADDR(DelbaReq.Addr, pAd->MacTab.Content[Wcid].Addr);
+			COPY_MAC_ADDR(DelbaReq.Addr,
+				      pAd->MacTab.Content[Wcid].Addr);
 			DelbaReq.Wcid = Wcid;
-			DelbaReq.TID = TID;
+			DelbaReq.TID = pBAEntry->TID;
 			DelbaReq.Initiator = ORIGINATOR;
-#if 1
-			Elem->MsgLen  = sizeof(DelbaReq);
+			Elem->MsgLen = sizeof(DelbaReq);
 			NdisMoveMemory(Elem->Msg, &DelbaReq, sizeof(DelbaReq));
 			MlmeDELBAAction(pAd, Elem);
 			kfree(Elem);
-#else
-			MlmeEnqueue(pAd, ACTION_STATE_MACHINE, MT2_MLME_ORI_DELBA_CATE, sizeof(MLME_DELBA_REQ_STRUCT), (PVOID)&DelbaReq);
-			RT28XX_MLME_HANDLER(pAd);
-#endif
-		}
-
-		return;
-	}
-
-	DBGPRINT(RT_DEBUG_TRACE,("%s===>Wcid=%d.TID=%d \n", __func__, Wcid, TID));
-
-	pBAEntry = &pAd->BATable.BAOriEntry[Idx];
-	DBGPRINT(RT_DEBUG_TRACE,("\t===>Idx = %ld, Wcid=%d.TID=%d, ORI_BA_Status = %d \n", Idx, Wcid, TID, pBAEntry->ORI_BA_Status));
-	//
-	// Prepare DelBA action frame and send to the peer.
-	//
-	if ((bPassive == FALSE) && (TID == pBAEntry->TID) && (pBAEntry->ORI_BA_Status == Originator_Done))
-	{
-		MLME_DELBA_REQ_STRUCT   DelbaReq;
-		MLME_QUEUE_ELEM *Elem = (MLME_QUEUE_ELEM *) kmalloc(sizeof(MLME_QUEUE_ELEM), MEM_ALLOC_FLAG);
-		if (Elem == NULL)
+		} else {
+			DBGPRINT(RT_DEBUG_ERROR,
+				 ("%s():alloc memory failed!\n", __func__));
 			return;
-
-		NdisZeroMemory(&DelbaReq, sizeof(DelbaReq));
-		NdisZeroMemory(Elem, sizeof(MLME_QUEUE_ELEM));
-
-		COPY_MAC_ADDR(DelbaReq.Addr, pAd->MacTab.Content[Wcid].Addr);
-		DelbaReq.Wcid = Wcid;
-		DelbaReq.TID = pBAEntry->TID;
-		DelbaReq.Initiator = ORIGINATOR;
-#if 1
-		Elem->MsgLen  = sizeof(DelbaReq);
-		NdisMoveMemory(Elem->Msg, &DelbaReq, sizeof(DelbaReq));
-		MlmeDELBAAction(pAd, Elem);
-		kfree(Elem);
-#else
-		MlmeEnqueue(pAd, ACTION_STATE_MACHINE, MT2_MLME_ORI_DELBA_CATE, sizeof(MLME_DELBA_REQ_STRUCT), (PVOID)&DelbaReq);
-		RT28XX_MLME_HANDLER(pAd);
-#endif
+		}
 	}
 	RTMPCancelTimer(&pBAEntry->ORIBATimer, &Cancelled);
 	BATableFreeOriEntry(pAd, Idx);
 
-	if (bPassive)
-	{
-		//BAOriSessionSetUp(pAd, &pAd->MacTab.Content[Wcid], TID, 0, 10000, TRUE);
+	if (bPassive) {
+		/*BAOriSessionSetUp(pAd, &pAd->MacTab.Content[Wcid], TID, 0, 10000, TRUE); */
 	}
 }
 
-VOID BARecSessionTearDown(
-						 IN OUT  PRTMP_ADAPTER   pAd,
-						 IN      UCHAR           Wcid,
-						 IN      UCHAR           TID,
-						 IN      BOOLEAN         bPassive)
+void BARecSessionTearDown(struct rt_rtmp_adapter *pAd,
+			  u8 Wcid, u8 TID, IN BOOLEAN bPassive)
 {
-	ULONG           Idx = 0;
-	BA_REC_ENTRY    *pBAEntry;
+	unsigned long Idx = 0;
+	struct rt_ba_rec_entry *pBAEntry;
 
-	if (Wcid >= MAX_LEN_OF_MAC_TABLE)
-	{
+	if (Wcid >= MAX_LEN_OF_MAC_TABLE) {
 		return;
 	}
-
-	//
-	//  Locate corresponding BA Originator Entry in BA Table with the (pAddr,TID).
-	//
+	/* */
+	/*  Locate corresponding BA Originator Entry in BA Table with the (pAddr,TID). */
+	/* */
 	Idx = pAd->MacTab.Content[Wcid].BARecWcidArray[TID];
 	if (Idx == 0)
 		return;
 
-	DBGPRINT(RT_DEBUG_TRACE,("%s===>Wcid=%d.TID=%d \n", __func__, Wcid, TID));
-
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("%s===>Wcid=%d.TID=%d \n", __func__, Wcid, TID));
 
 	pBAEntry = &pAd->BATable.BARecEntry[Idx];
-	DBGPRINT(RT_DEBUG_TRACE,("\t===>Idx = %ld, Wcid=%d.TID=%d, REC_BA_Status = %d \n", Idx, Wcid, TID, pBAEntry->REC_BA_Status));
-	//
-	// Prepare DelBA action frame and send to the peer.
-	//
-	if ((TID == pBAEntry->TID) && (pBAEntry->REC_BA_Status == Recipient_Accept))
-	{
-		MLME_DELBA_REQ_STRUCT   DelbaReq;
-		BOOLEAN 				Cancelled;
-		MLME_QUEUE_ELEM *Elem = (MLME_QUEUE_ELEM *) kmalloc(sizeof(MLME_QUEUE_ELEM), MEM_ALLOC_FLAG);
-		//ULONG   offset;
-		//UINT32  VALUE;
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("\t===>Idx = %ld, Wcid=%d.TID=%d, REC_BA_Status = %d \n", Idx,
+		  Wcid, TID, pBAEntry->REC_BA_Status));
+	/* */
+	/* Prepare DelBA action frame and send to the peer. */
+	/* */
+	if ((TID == pBAEntry->TID)
+	    && (pBAEntry->REC_BA_Status == Recipient_Accept)) {
+		struct rt_mlme_delba_req DelbaReq;
+		BOOLEAN Cancelled;
+		/*unsigned long   offset; */
+		/*u32  VALUE; */
 
 		RTMPCancelTimer(&pBAEntry->RECBATimer, &Cancelled);
 
-		//
-		// 1. Send DELBA Action Frame
-		//
-		if (bPassive == FALSE)
-		{
-			NdisZeroMemory(&DelbaReq, sizeof(DelbaReq));
-			NdisZeroMemory(Elem, sizeof(MLME_QUEUE_ELEM));
-
-			COPY_MAC_ADDR(DelbaReq.Addr, pAd->MacTab.Content[Wcid].Addr);
-			DelbaReq.Wcid = Wcid;
-			DelbaReq.TID = TID;
-			DelbaReq.Initiator = RECIPIENT;
-#if 1
-			Elem->MsgLen  = sizeof(DelbaReq);
-			NdisMoveMemory(Elem->Msg, &DelbaReq, sizeof(DelbaReq));
-			MlmeDELBAAction(pAd, Elem);
-			kfree(Elem);
-#else
-			MlmeEnqueue(pAd, ACTION_STATE_MACHINE, MT2_MLME_ORI_DELBA_CATE, sizeof(MLME_DELBA_REQ_STRUCT), (PVOID)&DelbaReq);
-			RT28XX_MLME_HANDLER(pAd);
-#endif
+		/* */
+		/* 1. Send DELBA Action Frame */
+		/* */
+		if (bPassive == FALSE) {
+			struct rt_mlme_queue_elem *Elem =
+			    (struct rt_mlme_queue_elem *)kmalloc(sizeof(struct rt_mlme_queue_elem),
+							MEM_ALLOC_FLAG);
+			if (Elem != NULL) {
+				NdisZeroMemory(&DelbaReq, sizeof(DelbaReq));
+				NdisZeroMemory(Elem, sizeof(struct rt_mlme_queue_elem));
+
+				COPY_MAC_ADDR(DelbaReq.Addr,
+					      pAd->MacTab.Content[Wcid].Addr);
+				DelbaReq.Wcid = Wcid;
+				DelbaReq.TID = TID;
+				DelbaReq.Initiator = RECIPIENT;
+				Elem->MsgLen = sizeof(DelbaReq);
+				NdisMoveMemory(Elem->Msg, &DelbaReq,
+					       sizeof(DelbaReq));
+				MlmeDELBAAction(pAd, Elem);
+				kfree(Elem);
+			} else {
+				DBGPRINT(RT_DEBUG_ERROR,
+					 ("%s():alloc memory failed!\n",
+					  __func__));
+				return;
+			}
 		}
 
-
-		//
-		// 2. Free resource of BA session
-		//
-		// flush all pending reordering mpdus
+		/* */
+		/* 2. Free resource of BA session */
+		/* */
+		/* flush all pending reordering mpdus */
 		ba_refresh_reordering_mpdus(pAd, pBAEntry);
 
 		NdisAcquireSpinLock(&pAd->BATabLock);
 
-		// Erase Bitmap flag.
+		/* Erase Bitmap flag. */
 		pBAEntry->LastIndSeq = RESET_RCV_SEQ;
 		pBAEntry->BAWinSize = 0;
-		// Erase Bitmap flag at software mactable
-		pAd->MacTab.Content[Wcid].RXBAbitmap &= (~(1<<(pBAEntry->TID)));
+		/* Erase Bitmap flag at software mactable */
+		pAd->MacTab.Content[Wcid].RXBAbitmap &=
+		    (~(1 << (pBAEntry->TID)));
 		pAd->MacTab.Content[Wcid].BARecWcidArray[TID] = 0;
 
-		RT28XX_DEL_BA_SESSION_FROM_ASIC(pAd, Wcid, TID);
+		RTMP_DEL_BA_SESSION_FROM_ASIC(pAd, Wcid, TID);
 
 		NdisReleaseSpinLock(&pAd->BATabLock);
 
@@ -1018,20 +956,16 @@ VOID BARecSessionTearDown(
 	BATableFreeRecEntry(pAd, Idx);
 }
 
-VOID BASessionTearDownALL(
-						 IN OUT  PRTMP_ADAPTER pAd,
-						 IN      UCHAR Wcid)
+void BASessionTearDownALL(struct rt_rtmp_adapter *pAd, u8 Wcid)
 {
 	int i;
 
-	for (i=0; i<NUM_OF_TID; i++)
-	{
+	for (i = 0; i < NUM_OF_TID; i++) {
 		BAOriSessionTearDown(pAd, Wcid, i, FALSE, FALSE);
 		BARecSessionTearDown(pAd, Wcid, i, FALSE);
 	}
 }
 
-
 /*
 	==========================================================================
 	Description:
@@ -1046,50 +980,50 @@ VOID BASessionTearDownALL(
 				FALSE , then continue indicaterx at this moment.
 	==========================================================================
  */
-VOID BAOriSessionSetupTimeout(
-    IN PVOID SystemSpecific1,
-    IN PVOID FunctionContext,
-    IN PVOID SystemSpecific2,
-    IN PVOID SystemSpecific3)
+void BAOriSessionSetupTimeout(void *SystemSpecific1,
+			      void *FunctionContext,
+			      void *SystemSpecific2,
+			      void *SystemSpecific3)
 {
-	BA_ORI_ENTRY    *pBAEntry = (BA_ORI_ENTRY *)FunctionContext;
-	MAC_TABLE_ENTRY *pEntry;
-	PRTMP_ADAPTER   pAd;
+	struct rt_ba_ori_entry *pBAEntry = (struct rt_ba_ori_entry *)FunctionContext;
+	struct rt_mac_table_entry *pEntry;
+	struct rt_rtmp_adapter *pAd;
 
 	if (pBAEntry == NULL)
 		return;
 
 	pAd = pBAEntry->pAdapter;
 
-	// Do nothing if monitor mode is on
-	if (MONITOR_ON(pAd))
-		return;
+	{
+		/* Do nothing if monitor mode is on */
+		if (MONITOR_ON(pAd))
+			return;
+	}
 
 	pEntry = &pAd->MacTab.Content[pBAEntry->Wcid];
 
-	if ((pBAEntry->ORI_BA_Status == Originator_WaitRes) && (pBAEntry->Token < ORI_SESSION_MAX_RETRY))
-	{
-		MLME_ADDBA_REQ_STRUCT    AddbaReq;
+	if ((pBAEntry->ORI_BA_Status == Originator_WaitRes)
+	    && (pBAEntry->Token < ORI_SESSION_MAX_RETRY)) {
+		struct rt_mlme_addba_req AddbaReq;
 
 		NdisZeroMemory(&AddbaReq, sizeof(AddbaReq));
 		COPY_MAC_ADDR(AddbaReq.pAddr, pEntry->Addr);
-		AddbaReq.Wcid = (UCHAR)(pEntry->Aid);
+		AddbaReq.Wcid = (u8)(pEntry->Aid);
 		AddbaReq.TID = pBAEntry->TID;
-		AddbaReq.BaBufSize = pAd->CommonCfg.BACapability.field.RxBAWinLimit;
+		AddbaReq.BaBufSize =
+		    pAd->CommonCfg.BACapability.field.RxBAWinLimit;
 		AddbaReq.TimeOutValue = 0;
 		AddbaReq.Token = pBAEntry->Token;
-		MlmeEnqueue(pAd, ACTION_STATE_MACHINE, MT2_MLME_ADD_BA_CATE, sizeof(MLME_ADDBA_REQ_STRUCT), (PVOID)&AddbaReq);
-		RT28XX_MLME_HANDLER(pAd);
-		DBGPRINT(RT_DEBUG_TRACE,("BA Ori Session Timeout(%d) to %02x:%02x:%02x:%02x:%02x:%02x Tid:%d Wcid:%d\n"
-		,pBAEntry->Token
-		,pEntry->Addr[0],pEntry->Addr[1],pEntry->Addr[2]
-		,pEntry->Addr[3],pEntry->Addr[4],pEntry->Addr[5]
-		,pBAEntry->TID,pEntry->Aid));
+		MlmeEnqueue(pAd, ACTION_STATE_MACHINE, MT2_MLME_ADD_BA_CATE,
+			    sizeof(struct rt_mlme_addba_req), (void *)& AddbaReq);
+		RTMP_MLME_HANDLER(pAd);
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("BA Ori Session Timeout(%d) : Send ADD BA again\n",
+			  pBAEntry->Token));
+
 		pBAEntry->Token++;
 		RTMPSetTimer(&pBAEntry->ORIBATimer, ORI_BA_SESSION_TIMEOUT);
-	}
-	else
-	{
+	} else {
 		BATableFreeOriEntry(pAd, pEntry->BAOriWcidArray[pBAEntry->TID]);
 	}
 }
@@ -1108,419 +1042,383 @@ VOID BAOriSessionSetupTimeout(
 				FALSE , then continue indicaterx at this moment.
 	==========================================================================
  */
-VOID BARecSessionIdleTimeout(
-    IN PVOID SystemSpecific1,
-    IN PVOID FunctionContext,
-    IN PVOID SystemSpecific2,
-    IN PVOID SystemSpecific3)
+void BARecSessionIdleTimeout(void *SystemSpecific1,
+			     void *FunctionContext,
+			     void *SystemSpecific2, void *SystemSpecific3)
 {
 
-	BA_REC_ENTRY    *pBAEntry = (BA_REC_ENTRY *)FunctionContext;
-	PRTMP_ADAPTER   pAd;
-	ULONG           Now32;
+	struct rt_ba_rec_entry *pBAEntry = (struct rt_ba_rec_entry *)FunctionContext;
+	struct rt_rtmp_adapter *pAd;
+	unsigned long Now32;
 
 	if (pBAEntry == NULL)
 		return;
 
-	if ((pBAEntry->REC_BA_Status == Recipient_Accept))
-	{
+	if ((pBAEntry->REC_BA_Status == Recipient_Accept)) {
 		NdisGetSystemUpTime(&Now32);
 
-		if (RTMP_TIME_AFTER((unsigned long)Now32, (unsigned long)(pBAEntry->LastIndSeqAtTimer + REC_BA_SESSION_IDLE_TIMEOUT)))
-		{
+		if (RTMP_TIME_AFTER
+		    ((unsigned long)Now32,
+		     (unsigned long)(pBAEntry->LastIndSeqAtTimer +
+				     REC_BA_SESSION_IDLE_TIMEOUT))) {
 			pAd = pBAEntry->pAdapter;
-			// flush all pending reordering mpdus
+			/* flush all pending reordering mpdus */
 			ba_refresh_reordering_mpdus(pAd, pBAEntry);
-			printk("%ld: REC BA session Timeout\n", Now32);
+			DBGPRINT(RT_DEBUG_OFF,
+				 ("%ld: REC BA session Timeout\n", Now32));
 		}
 	}
 }
 
-
-VOID PeerAddBAReqAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-
+void PeerAddBAReqAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-	//	7.4.4.1
-	//ULONG	Idx;
-	UCHAR   Status = 1;
-	UCHAR   pAddr[6];
-	FRAME_ADDBA_RSP ADDframe;
-	PUCHAR         pOutBuffer = NULL;
-	NDIS_STATUS     NStatus;
-	PFRAME_ADDBA_REQ  pAddreqFrame = NULL;
-	//UCHAR		BufSize;
-	ULONG       FrameLen;
-	PULONG      ptemp;
-	PMAC_TABLE_ENTRY	pMacEntry;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("%s ==> (Wcid = %d)\n", __func__, Elem->Wcid));
-
-	//hex_dump("AddBAReq", Elem->Msg, Elem->MsgLen);
-
-	//ADDBA Request from unknown peer, ignore this.
+	/*      7.4.4.1 */
+	/*unsigned long Idx; */
+	u8 Status = 1;
+	u8 pAddr[6];
+	struct rt_frame_addba_rsp ADDframe;
+	u8 *pOutBuffer = NULL;
+	int NStatus;
+	struct rt_frame_addba_req * pAddreqFrame = NULL;
+	/*u8         BufSize; */
+	unsigned long FrameLen;
+	unsigned long *ptemp;
+	struct rt_mac_table_entry *pMacEntry;
+
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("%s ==> (Wcid = %d)\n", __func__, Elem->Wcid));
+
+	/*hex_dump("AddBAReq", Elem->Msg, Elem->MsgLen); */
+
+	/*ADDBA Request from unknown peer, ignore this. */
 	if (Elem->Wcid >= MAX_LEN_OF_MAC_TABLE)
 		return;
 
 	pMacEntry = &pAd->MacTab.Content[Elem->Wcid];
-	DBGPRINT(RT_DEBUG_TRACE,("BA - PeerAddBAReqAction----> \n"));
-	ptemp = (PULONG)Elem->Msg;
-	//DBGPRINT_RAW(RT_DEBUG_EMU, ("%08x:: %08x:: %08x:: %08x:: %08x:: %08x:: %08x:: %08x:: %08x\n", *(ptemp), *(ptemp+1), *(ptemp+2), *(ptemp+3), *(ptemp+4), *(ptemp+5), *(ptemp+6), *(ptemp+7), *(ptemp+8)));
-
-	if (PeerAddBAReqActionSanity(pAd, Elem->Msg, Elem->MsgLen, pAddr))
-	{
-
-		if ((pAd->CommonCfg.bBADecline == FALSE) && IS_HT_STA(pMacEntry))
-		{
-			pAddreqFrame = (PFRAME_ADDBA_REQ)(&Elem->Msg[0]);
-			printk("Rcv Wcid(%d) AddBAReq\n", Elem->Wcid);
-			if (BARecSessionAdd(pAd, &pAd->MacTab.Content[Elem->Wcid], pAddreqFrame))
+	DBGPRINT(RT_DEBUG_TRACE, ("BA - PeerAddBAReqAction----> \n"));
+	ptemp = (unsigned long *)Elem->Msg;
+	/*DBGPRINT_RAW(RT_DEBUG_EMU, ("%08x:: %08x:: %08x:: %08x:: %08x:: %08x:: %08x:: %08x:: %08x\n", *(ptemp), *(ptemp+1), *(ptemp+2), *(ptemp+3), *(ptemp+4), *(ptemp+5), *(ptemp+6), *(ptemp+7), *(ptemp+8))); */
+
+	if (PeerAddBAReqActionSanity(pAd, Elem->Msg, Elem->MsgLen, pAddr)) {
+
+		if ((pAd->CommonCfg.bBADecline == FALSE)
+		    && IS_HT_STA(pMacEntry)) {
+			pAddreqFrame = (struct rt_frame_addba_req *) (&Elem->Msg[0]);
+			DBGPRINT(RT_DEBUG_OFF,
+				 ("Rcv Wcid(%d) AddBAReq\n", Elem->Wcid));
+			if (BARecSessionAdd
+			    (pAd, &pAd->MacTab.Content[Elem->Wcid],
+			     pAddreqFrame))
 				Status = 0;
 			else
-				Status = 38; // more parameters have invalid values
-		}
-		else
-		{
-			Status = 37; // the request has been declined.
+				Status = 38;	/* more parameters have invalid values */
+		} else {
+			Status = 37;	/* the request has been declined. */
 		}
 	}
 
 	if (pAd->MacTab.Content[Elem->Wcid].ValidAsCLI)
 		ASSERT(pAd->MacTab.Content[Elem->Wcid].Sst == SST_ASSOC);
 
-	pAddreqFrame = (PFRAME_ADDBA_REQ)(&Elem->Msg[0]);
-	// 2. Always send back ADDBA Response
-	NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);	 //Get an unused nonpaged memory
-	if (NStatus != NDIS_STATUS_SUCCESS)
-	{
-		DBGPRINT(RT_DEBUG_TRACE,("ACTION - PeerBAAction() allocate memory failed \n"));
+	pAddreqFrame = (struct rt_frame_addba_req *) (&Elem->Msg[0]);
+	/* 2. Always send back ADDBA Response */
+	NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);	/*Get an unused nonpaged memory */
+	if (NStatus != NDIS_STATUS_SUCCESS) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("ACTION - PeerBAAction() allocate memory failed \n"));
 		return;
 	}
 
-	NdisZeroMemory(&ADDframe, sizeof(FRAME_ADDBA_RSP));
+	NdisZeroMemory(&ADDframe, sizeof(struct rt_frame_addba_rsp));
 
-	// 2-1. Prepare ADDBA Response frame.
+	/* 2-1. Prepare ADDBA Response frame. */
 	{
 		if (ADHOC_ON(pAd))
-			ActHeaderInit(pAd, &ADDframe.Hdr, pAddr, pAd->CurrentAddress, pAd->CommonCfg.Bssid);
+			ActHeaderInit(pAd, &ADDframe.Hdr, pAddr,
+				      pAd->CurrentAddress,
+				      pAd->CommonCfg.Bssid);
 		else
-			ActHeaderInit(pAd, &ADDframe.Hdr, pAd->CommonCfg.Bssid, pAd->CurrentAddress, pAddr);
+			ActHeaderInit(pAd, &ADDframe.Hdr, pAd->CommonCfg.Bssid,
+				      pAd->CurrentAddress, pAddr);
 	}
 
 	ADDframe.Category = CATEGORY_BA;
 	ADDframe.Action = ADDBA_RESP;
 	ADDframe.Token = pAddreqFrame->Token;
-	// What is the Status code??  need to check.
+	/* What is the Status code??  need to check. */
 	ADDframe.StatusCode = Status;
 	ADDframe.BaParm.BAPolicy = IMMED_BA;
 	ADDframe.BaParm.AMSDUSupported = 0;
 	ADDframe.BaParm.TID = pAddreqFrame->BaParm.TID;
-	ADDframe.BaParm.BufSize = min(((UCHAR)pAddreqFrame->BaParm.BufSize), (UCHAR)pAd->CommonCfg.BACapability.field.RxBAWinLimit);
-	if (ADDframe.BaParm.BufSize == 0)
-	{
+	ADDframe.BaParm.BufSize =
+	    min(((u8)pAddreqFrame->BaParm.BufSize),
+		(u8)pAd->CommonCfg.BACapability.field.RxBAWinLimit);
+	if (ADDframe.BaParm.BufSize == 0) {
 		ADDframe.BaParm.BufSize = 64;
 	}
-	ADDframe.TimeOutValue = 0; //pAddreqFrame->TimeOutValue;
+	ADDframe.TimeOutValue = 0;	/*pAddreqFrame->TimeOutValue; */
 
-	*(USHORT *)(&ADDframe.BaParm) = cpu2le16(*(USHORT *)(&ADDframe.BaParm));
+	*(u16 *) (&ADDframe.BaParm) =
+	    cpu2le16(*(u16 *) (&ADDframe.BaParm));
 	ADDframe.StatusCode = cpu2le16(ADDframe.StatusCode);
 	ADDframe.TimeOutValue = cpu2le16(ADDframe.TimeOutValue);
 
-	MakeOutgoingFrame(pOutBuffer,               &FrameLen,
-					  sizeof(FRAME_ADDBA_RSP),  &ADDframe,
-			  END_OF_ARGS);
+	MakeOutgoingFrame(pOutBuffer, &FrameLen,
+			  sizeof(struct rt_frame_addba_rsp), &ADDframe, END_OF_ARGS);
 	MiniportMMRequest(pAd, QID_AC_BE, pOutBuffer, FrameLen);
 	MlmeFreeMemory(pAd, pOutBuffer);
 
-	DBGPRINT(RT_DEBUG_TRACE, ("%s(%d): TID(%d), BufSize(%d) <== \n", __func__, Elem->Wcid, ADDframe.BaParm.TID,
-							  ADDframe.BaParm.BufSize));
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("%s(%d): TID(%d), BufSize(%d) <== \n", __func__, Elem->Wcid,
+		  ADDframe.BaParm.TID, ADDframe.BaParm.BufSize));
 }
 
-
-VOID PeerAddBARspAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-
+void PeerAddBARspAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-	//UCHAR		Idx, i;
-	//PUCHAR		   pOutBuffer = NULL;
-	PFRAME_ADDBA_RSP    pFrame = NULL;
-	//PBA_ORI_ENTRY		pBAEntry;
+	/*u8         Idx, i; */
+	/*u8 *                  pOutBuffer = NULL; */
+	struct rt_frame_addba_rsp * pFrame = NULL;
+	/*struct rt_ba_ori_entry *pBAEntry; */
 
-	//ADDBA Response from unknown peer, ignore this.
+	/*ADDBA Response from unknown peer, ignore this. */
 	if (Elem->Wcid >= MAX_LEN_OF_MAC_TABLE)
 		return;
 
 	DBGPRINT(RT_DEBUG_TRACE, ("%s ==> Wcid(%d)\n", __func__, Elem->Wcid));
 
-	//hex_dump("PeerAddBARspAction()", Elem->Msg, Elem->MsgLen);
+	/*hex_dump("PeerAddBARspAction()", Elem->Msg, Elem->MsgLen); */
 
-	if (PeerAddBARspActionSanity(pAd, Elem->Msg, Elem->MsgLen))
-	{
-		pFrame = (PFRAME_ADDBA_RSP)(&Elem->Msg[0]);
+	if (PeerAddBARspActionSanity(pAd, Elem->Msg, Elem->MsgLen)) {
+		pFrame = (struct rt_frame_addba_rsp *) (&Elem->Msg[0]);
 
-		DBGPRINT(RT_DEBUG_TRACE, ("\t\t StatusCode = %d\n", pFrame->StatusCode));
-		switch (pFrame->StatusCode)
-		{
-			case 0:
-				// I want a BAsession with this peer as an originator.
-				BAOriSessionAdd(pAd, &pAd->MacTab.Content[Elem->Wcid], pFrame);
-				break;
-			default:
-				// check status == USED ???
-				BAOriSessionTearDown(pAd, Elem->Wcid, pFrame->BaParm.TID, TRUE, FALSE);
-				break;
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("\t\t StatusCode = %d\n", pFrame->StatusCode));
+		switch (pFrame->StatusCode) {
+		case 0:
+			/* I want a BAsession with this peer as an originator. */
+			BAOriSessionAdd(pAd, &pAd->MacTab.Content[Elem->Wcid],
+					pFrame);
+			break;
+		default:
+			/* check status == USED ??? */
+			BAOriSessionTearDown(pAd, Elem->Wcid,
+					     pFrame->BaParm.TID, TRUE, FALSE);
+			break;
 		}
-		// Rcv Decline StatusCode
+		/* Rcv Decline StatusCode */
 		if ((pFrame->StatusCode == 37)
-            || ((pAd->OpMode == OPMODE_STA) && STA_TGN_WIFI_ON(pAd) && (pFrame->StatusCode != 0))
-            )
-		{
-			pAd->MacTab.Content[Elem->Wcid].BADeclineBitmap |= 1<<pFrame->BaParm.TID;
+		    || ((pAd->OpMode == OPMODE_STA) && STA_TGN_WIFI_ON(pAd)
+			&& (pFrame->StatusCode != 0))
+		    ) {
+			pAd->MacTab.Content[Elem->Wcid].BADeclineBitmap |=
+			    1 << pFrame->BaParm.TID;
 		}
 	}
 }
 
-VOID PeerDelBAAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-
+void PeerDelBAAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-	//UCHAR				Idx;
-	//PUCHAR				pOutBuffer = NULL;
-	PFRAME_DELBA_REQ    pDelFrame = NULL;
-
-	DBGPRINT(RT_DEBUG_TRACE,("%s ==>\n", __func__));
-	//DELBA Request from unknown peer, ignore this.
-	if (PeerDelBAActionSanity(pAd, Elem->Wcid, Elem->Msg, Elem->MsgLen))
-	{
-		pDelFrame = (PFRAME_DELBA_REQ)(&Elem->Msg[0]);
-		if (pDelFrame->DelbaParm.Initiator == ORIGINATOR)
-		{
-			DBGPRINT(RT_DEBUG_TRACE,("BA - PeerDelBAAction----> ORIGINATOR\n"));
-			BARecSessionTearDown(pAd, Elem->Wcid, pDelFrame->DelbaParm.TID, TRUE);
-		}
-		else
-		{
-			DBGPRINT(RT_DEBUG_TRACE,("BA - PeerDelBAAction----> RECIPIENT, Reason = %d\n",  pDelFrame->ReasonCode));
-			//hex_dump("DelBA Frame", pDelFrame, Elem->MsgLen);
-			BAOriSessionTearDown(pAd, Elem->Wcid, pDelFrame->DelbaParm.TID, TRUE, FALSE);
+	/*u8                         Idx; */
+	/*u8 *                               pOutBuffer = NULL; */
+	struct rt_frame_delba_req * pDelFrame = NULL;
+
+	DBGPRINT(RT_DEBUG_TRACE, ("%s ==>\n", __func__));
+	/*DELBA Request from unknown peer, ignore this. */
+	if (PeerDelBAActionSanity(pAd, Elem->Wcid, Elem->Msg, Elem->MsgLen)) {
+		pDelFrame = (struct rt_frame_delba_req *) (&Elem->Msg[0]);
+		if (pDelFrame->DelbaParm.Initiator == ORIGINATOR) {
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("BA - PeerDelBAAction----> ORIGINATOR\n"));
+			BARecSessionTearDown(pAd, Elem->Wcid,
+					     pDelFrame->DelbaParm.TID, TRUE);
+		} else {
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("BA - PeerDelBAAction----> RECIPIENT, Reason = %d\n",
+				  pDelFrame->ReasonCode));
+			/*hex_dump("DelBA Frame", pDelFrame, Elem->MsgLen); */
+			BAOriSessionTearDown(pAd, Elem->Wcid,
+					     pDelFrame->DelbaParm.TID, TRUE,
+					     FALSE);
 		}
 	}
 }
 
-
-BOOLEAN CntlEnqueueForRecv(
-						  IN PRTMP_ADAPTER		pAd,
-						  IN ULONG				Wcid,
-						  IN ULONG				MsgLen,
-						  IN PFRAME_BA_REQ		pMsg)
+BOOLEAN CntlEnqueueForRecv(struct rt_rtmp_adapter *pAd,
+			   unsigned long Wcid,
+			   unsigned long MsgLen, struct rt_frame_ba_req * pMsg)
 {
-	PFRAME_BA_REQ   pFrame = pMsg;
-	//PRTMP_REORDERBUF	pBuffer;
-	//PRTMP_REORDERBUF	pDmaBuf;
-	PBA_REC_ENTRY pBAEntry;
-	//BOOLEAN 	Result;
-	ULONG   Idx;
-	//UCHAR	NumRxPkt;
-	UCHAR	TID;//, i;
-
-	TID = (UCHAR)pFrame->BARControl.TID;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("%s(): BAR-Wcid(%ld), Tid (%d)\n", __func__, Wcid, TID));
-	//hex_dump("BAR", (PCHAR) pFrame, MsgLen);
-	// Do nothing if the driver is starting halt state.
-	// This might happen when timer already been fired before cancel timer with mlmehalt
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
+	struct rt_frame_ba_req * pFrame = pMsg;
+	/*PRTMP_REORDERBUF      pBuffer; */
+	/*PRTMP_REORDERBUF      pDmaBuf; */
+	struct rt_ba_rec_entry *pBAEntry;
+	/*BOOLEAN       Result; */
+	unsigned long Idx;
+	/*u8 NumRxPkt; */
+	u8 TID;		/*, i; */
+
+	TID = (u8)pFrame->BARControl.TID;
+
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("%s(): BAR-Wcid(%ld), Tid (%d)\n", __func__, Wcid, TID));
+	/*hex_dump("BAR", (char *)pFrame, MsgLen); */
+	/* Do nothing if the driver is starting halt state. */
+	/* This might happen when timer already been fired before cancel timer with mlmehalt */
+	if (RTMP_TEST_FLAG
+	    (pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
 		return FALSE;
 
-	// First check the size, it MUST not exceed the mlme queue size
-	if (MsgLen > MGMT_DMA_BUFFER_SIZE)
-	{
+	/* First check the size, it MUST not exceed the mlme queue size */
+	if (MsgLen > MGMT_DMA_BUFFER_SIZE) {
 		DBGPRINT_ERR(("CntlEnqueueForRecv: frame too large, size = %ld \n", MsgLen));
 		return FALSE;
-	}
-	else if (MsgLen != sizeof(FRAME_BA_REQ))
-	{
+	} else if (MsgLen != sizeof(struct rt_frame_ba_req)) {
 		DBGPRINT_ERR(("CntlEnqueueForRecv: BlockAck Request frame length size = %ld incorrect\n", MsgLen));
 		return FALSE;
-	}
-	else if (MsgLen != sizeof(FRAME_BA_REQ))
-	{
+	} else if (MsgLen != sizeof(struct rt_frame_ba_req)) {
 		DBGPRINT_ERR(("CntlEnqueueForRecv: BlockAck Request frame length size = %ld incorrect\n", MsgLen));
 		return FALSE;
 	}
 
-	if ((Wcid < MAX_LEN_OF_MAC_TABLE) && (TID < 8))
-		{
-		// if this receiving packet is from SA that is in our OriEntry. Since WCID <9 has direct mapping. no need search.
+	if ((Wcid < MAX_LEN_OF_MAC_TABLE) && (TID < 8)) {
+		/* if this receiving packet is from SA that is in our OriEntry. Since WCID <9 has direct mapping. no need search. */
 		Idx = pAd->MacTab.Content[Wcid].BARecWcidArray[TID];
 		pBAEntry = &pAd->BATable.BARecEntry[Idx];
-		}
-		else
-		{
+	} else {
 		return FALSE;
 	}
 
-	DBGPRINT(RT_DEBUG_TRACE, ("BAR(%ld) : Tid (%d) - %04x:%04x\n", Wcid, TID, pFrame->BAStartingSeq.field.StartSeq, pBAEntry->LastIndSeq ));
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("BAR(%ld) : Tid (%d) - %04x:%04x\n", Wcid, TID,
+		  pFrame->BAStartingSeq.field.StartSeq, pBAEntry->LastIndSeq));
 
-	if (SEQ_SMALLER(pBAEntry->LastIndSeq, pFrame->BAStartingSeq.field.StartSeq, MAXSEQ))
-	{
-		//printk("BAR Seq = %x, LastIndSeq = %x\n", pFrame->BAStartingSeq.field.StartSeq, pBAEntry->LastIndSeq);
-		ba_indicate_reordering_mpdus_le_seq(pAd, pBAEntry, pFrame->BAStartingSeq.field.StartSeq);
-		pBAEntry->LastIndSeq = (pFrame->BAStartingSeq.field.StartSeq == 0) ? MAXSEQ :(pFrame->BAStartingSeq.field.StartSeq -1);
+	if (SEQ_SMALLER
+	    (pBAEntry->LastIndSeq, pFrame->BAStartingSeq.field.StartSeq,
+	     MAXSEQ)) {
+		/*DBGPRINT(RT_DEBUG_TRACE, ("BAR Seq = %x, LastIndSeq = %x\n", pFrame->BAStartingSeq.field.StartSeq, pBAEntry->LastIndSeq)); */
+		ba_indicate_reordering_mpdus_le_seq(pAd, pBAEntry,
+						    pFrame->BAStartingSeq.field.
+						    StartSeq);
+		pBAEntry->LastIndSeq =
+		    (pFrame->BAStartingSeq.field.StartSeq ==
+		     0) ? MAXSEQ : (pFrame->BAStartingSeq.field.StartSeq - 1);
 	}
-	//ba_refresh_reordering_mpdus(pAd, pBAEntry);
+	/*ba_refresh_reordering_mpdus(pAd, pBAEntry); */
 	return TRUE;
 }
 
 /*
 Description : Send PSMP Action frame If PSMP mode switches.
 */
-VOID SendPSMPAction(
-				   IN PRTMP_ADAPTER		pAd,
-				   IN UCHAR				Wcid,
-				   IN UCHAR				Psmp)
+void SendPSMPAction(struct rt_rtmp_adapter *pAd, u8 Wcid, u8 Psmp)
 {
-	PUCHAR          pOutBuffer = NULL;
-	NDIS_STATUS     NStatus;
-	//ULONG           Idx;
-	FRAME_PSMP_ACTION   Frame;
-	ULONG           FrameLen;
-	UCHAR			bbpdata=0;
-	UINT32			macdata;
-
-	NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);	 //Get an unused nonpaged memory
-	if (NStatus != NDIS_STATUS_SUCCESS)
-	{
-		DBGPRINT(RT_DEBUG_ERROR,("BA - MlmeADDBAAction() allocate memory failed \n"));
+	u8 *pOutBuffer = NULL;
+	int NStatus;
+	/*unsigned long           Idx; */
+	struct rt_frame_psmp_action Frame;
+	unsigned long FrameLen;
+
+	NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);	/*Get an unused nonpaged memory */
+	if (NStatus != NDIS_STATUS_SUCCESS) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("BA - MlmeADDBAAction() allocate memory failed \n"));
 		return;
 	}
 
-	ActHeaderInit(pAd, &Frame.Hdr, pAd->CommonCfg.Bssid, pAd->CurrentAddress, pAd->MacTab.Content[Wcid].Addr);
+	ActHeaderInit(pAd, &Frame.Hdr, pAd->CommonCfg.Bssid,
+		      pAd->CurrentAddress, pAd->MacTab.Content[Wcid].Addr);
 
 	Frame.Category = CATEGORY_HT;
 	Frame.Action = SMPS_ACTION;
-	switch (Psmp)
-	{
-		case MMPS_ENABLE:
-			if (IS_RT3090(pAd))
-			{
-				// disable MMPS BBP control register
-				RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R3, &bbpdata);
-				bbpdata &= ~(0x04);	//bit 2
-				RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R3, bbpdata);
-
-				// disable MMPS MAC control register
-				RTMP_IO_READ32(pAd, 0x1210, &macdata);
-				macdata &= ~(0x09);	//bit 0, 3
-				RTMP_IO_WRITE32(pAd, 0x1210, macdata);
-			}
-			Frame.Psmp = 0;
-			break;
-		case MMPS_DYNAMIC:
-			if (IS_RT3090(pAd))
-			{
-				// enable MMPS BBP control register
-				RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R3, &bbpdata);
-				bbpdata |= 0x04;	//bit 2
-				RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R3, bbpdata);
-
-				// enable MMPS MAC control register
-				RTMP_IO_READ32(pAd, 0x1210, &macdata);
-				macdata |= 0x09;	//bit 0, 3
-				RTMP_IO_WRITE32(pAd, 0x1210, macdata);
-			}
-			Frame.Psmp = 3;
-			break;
-		case MMPS_STATIC:
-			if (IS_RT3090(pAd))
-			{
-				// enable MMPS BBP control register
-				RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R3, &bbpdata);
-				bbpdata |= 0x04;	//bit 2
-				RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R3, bbpdata);
-
-				// enable MMPS MAC control register
-				RTMP_IO_READ32(pAd, 0x1210, &macdata);
-				macdata |= 0x09;	//bit 0, 3
-				RTMP_IO_WRITE32(pAd, 0x1210, macdata);
-			}
-			Frame.Psmp = 1;
-			break;
+	switch (Psmp) {
+	case MMPS_ENABLE:
+#ifdef RT30xx
+		if (IS_RT30xx(pAd)
+		    && (pAd->Antenna.field.RxPath > 1
+			|| pAd->Antenna.field.TxPath > 1)) {
+			RTMP_ASIC_MMPS_DISABLE(pAd);
+		}
+#endif /* RT30xx // */
+		Frame.Psmp = 0;
+		break;
+	case MMPS_DYNAMIC:
+		Frame.Psmp = 3;
+		break;
+	case MMPS_STATIC:
+#ifdef RT30xx
+		if (IS_RT30xx(pAd)
+		    && (pAd->Antenna.field.RxPath > 1
+			|| pAd->Antenna.field.TxPath > 1)) {
+			RTMP_ASIC_MMPS_ENABLE(pAd);
+		}
+#endif /* RT30xx // */
+		Frame.Psmp = 1;
+		break;
 	}
-	MakeOutgoingFrame(pOutBuffer,               &FrameLen,
-					  sizeof(FRAME_PSMP_ACTION),      &Frame,
-					  END_OF_ARGS);
+	MakeOutgoingFrame(pOutBuffer, &FrameLen,
+			  sizeof(struct rt_frame_psmp_action), &Frame, END_OF_ARGS);
 	MiniportMMRequest(pAd, QID_AC_BE, pOutBuffer, FrameLen);
 	MlmeFreeMemory(pAd, pOutBuffer);
-	DBGPRINT(RT_DEBUG_ERROR,("HT - SendPSMPAction( %d )  \n", Frame.Psmp));
+	DBGPRINT(RT_DEBUG_ERROR, ("HT - SendPSMPAction( %d )  \n", Frame.Psmp));
 }
 
-
 #define RADIO_MEASUREMENT_REQUEST_ACTION	0
 
-typedef struct PACKED
-{
-	UCHAR	RegulatoryClass;
-	UCHAR	ChannelNumber;
-	USHORT	RandomInterval;
-	USHORT	MeasurementDuration;
-	UCHAR	MeasurementMode;
-	UCHAR   BSSID[MAC_ADDR_LEN];
-	UCHAR	ReportingCondition;
-	UCHAR	Threshold;
-	UCHAR   SSIDIE[2];			// 2 byte
-} BEACON_REQUEST;
-
-typedef struct PACKED
-{
-	UCHAR	ID;
-	UCHAR	Length;
-	UCHAR	Token;
-	UCHAR	RequestMode;
-	UCHAR	Type;
-} MEASUREMENT_REQ;
-
-
-
-
-void convert_reordering_packet_to_preAMSDU_or_802_3_packet(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	RX_BLK			*pRxBlk,
-	IN  UCHAR			FromWhichBSSID)
+struct PACKED rt_beacon_request {
+	u8 RegulatoryClass;
+	u8 ChannelNumber;
+	u16 RandomInterval;
+	u16 MeasurementDuration;
+	u8 MeasurementMode;
+	u8 BSSID[MAC_ADDR_LEN];
+	u8 ReportingCondition;
+	u8 Threshold;
+	u8 SSIDIE[2];	/* 2 byte */
+};
+
+struct PACKED rt_measurement_req {
+	u8 ID;
+	u8 Length;
+	u8 Token;
+	u8 RequestMode;
+	u8 Type;
+};
+
+void convert_reordering_packet_to_preAMSDU_or_802_3_packet(struct rt_rtmp_adapter *pAd,
+							   struct rt_rx_blk *pRxBlk,
+							   u8
+							   FromWhichBSSID)
 {
-	PNDIS_PACKET	pRxPkt;
-	UCHAR			Header802_3[LENGTH_802_3];
+	void *pRxPkt;
+	u8 Header802_3[LENGTH_802_3];
 
-	// 1. get 802.3 Header
-	// 2. remove LLC
-	// 		a. pointer pRxBlk->pData to payload
-	//      b. modify pRxBlk->DataSize
+	/* 1. get 802.3 Header */
+	/* 2. remove LLC */
+	/*              a. pointer pRxBlk->pData to payload */
+	/*      b. modify pRxBlk->DataSize */
 
 	RTMP_802_11_REMOVE_LLC_AND_CONVERT_TO_802_3(pRxBlk, Header802_3);
 
 	ASSERT(pRxBlk->pRxPacket);
 	pRxPkt = RTPKT_TO_OSPKT(pRxBlk->pRxPacket);
 
-	RTPKT_TO_OSPKT(pRxPkt)->dev = get_netdev_from_bssid(pAd, FromWhichBSSID);
-	RTPKT_TO_OSPKT(pRxPkt)->data = pRxBlk->pData;
-	RTPKT_TO_OSPKT(pRxPkt)->len = pRxBlk->DataSize;
-	RTPKT_TO_OSPKT(pRxPkt)->tail = RTPKT_TO_OSPKT(pRxPkt)->data + RTPKT_TO_OSPKT(pRxPkt)->len;
+	SET_OS_PKT_NETDEV(pRxPkt, get_netdev_from_bssid(pAd, FromWhichBSSID));
+	SET_OS_PKT_DATAPTR(pRxPkt, pRxBlk->pData);
+	SET_OS_PKT_LEN(pRxPkt, pRxBlk->DataSize);
+	SET_OS_PKT_DATATAIL(pRxPkt, pRxBlk->pData, pRxBlk->DataSize);
 
-	//
-	// copy 802.3 header, if necessary
-	//
-	if (!RX_BLK_TEST_FLAG(pRxBlk, fRX_AMSDU))
-	{
+	/* */
+	/* copy 802.3 header, if necessary */
+	/* */
+	if (!RX_BLK_TEST_FLAG(pRxBlk, fRX_AMSDU)) {
+		{
 #ifdef LINUX
-		NdisMoveMemory(skb_push(pRxPkt, LENGTH_802_3), Header802_3, LENGTH_802_3);
+			NdisMoveMemory(skb_push(pRxPkt, LENGTH_802_3),
+				       Header802_3, LENGTH_802_3);
 #endif
+		}
 	}
 }
 
-
 #define INDICATE_LEGACY_OR_AMSDU(_pAd, _pRxBlk, _fromWhichBSSID)		\
 	do																	\
 	{																	\
@@ -1538,61 +1436,60 @@ void convert_reordering_packet_to_preAMSDU_or_802_3_packet(
     	}																\
 	} while (0);
 
-
-
-static VOID ba_enqueue_reordering_packet(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PBA_REC_ENTRY	pBAEntry,
-	IN	RX_BLK			*pRxBlk,
-	IN	UCHAR			FromWhichBSSID)
+static void ba_enqueue_reordering_packet(struct rt_rtmp_adapter *pAd,
+					 struct rt_ba_rec_entry *pBAEntry,
+					 struct rt_rx_blk *pRxBlk,
+					 u8 FromWhichBSSID)
 {
 	struct reordering_mpdu *mpdu_blk;
-	UINT16	Sequence = (UINT16) pRxBlk->pHeader->Sequence;
+	u16 Sequence = (u16)pRxBlk->pHeader->Sequence;
 
 	mpdu_blk = ba_mpdu_blk_alloc(pAd);
-	if (mpdu_blk != NULL)
-	{
-		// Write RxD buffer address & allocated buffer length
+	if ((mpdu_blk != NULL) && (!RX_BLK_TEST_FLAG(pRxBlk, fRX_EAP))) {
+		/* Write RxD buffer address & allocated buffer length */
 		NdisAcquireSpinLock(&pBAEntry->RxReRingLock);
 
 		mpdu_blk->Sequence = Sequence;
 
 		mpdu_blk->bAMSDU = RX_BLK_TEST_FLAG(pRxBlk, fRX_AMSDU);
 
-		convert_reordering_packet_to_preAMSDU_or_802_3_packet(pAd, pRxBlk, FromWhichBSSID);
+		convert_reordering_packet_to_preAMSDU_or_802_3_packet(pAd,
+								      pRxBlk,
+								      FromWhichBSSID);
 
 		STATS_INC_RX_PACKETS(pAd, FromWhichBSSID);
 
-        //
-		// it is necessary for reordering packet to record
-		// which BSS it come from
-		//
+		/* */
+		/* it is necessary for reordering packet to record */
+		/* which BSS it come from */
+		/* */
 		RTMP_SET_PACKET_IF(pRxBlk->pRxPacket, FromWhichBSSID);
 
 		mpdu_blk->pPacket = pRxBlk->pRxPacket;
 
-		if (ba_reordering_mpdu_insertsorted(&pBAEntry->list, mpdu_blk) == FALSE)
-		{
-			// had been already within reordering list
-			// don't indicate
-			RELEASE_NDIS_PACKET(pAd, pRxBlk->pRxPacket, NDIS_STATUS_SUCCESS);
+		if (ba_reordering_mpdu_insertsorted(&pBAEntry->list, mpdu_blk)
+		    == FALSE) {
+			/* had been already within reordering list */
+			/* don't indicate */
+			RELEASE_NDIS_PACKET(pAd, pRxBlk->pRxPacket,
+					    NDIS_STATUS_SUCCESS);
 			ba_mpdu_blk_free(pAd, mpdu_blk);
 		}
 
-		ASSERT((0<= pBAEntry->list.qlen)  && (pBAEntry->list.qlen <= pBAEntry->BAWinSize));
+		ASSERT((0 <= pBAEntry->list.qlen)
+		       && (pBAEntry->list.qlen <= pBAEntry->BAWinSize));
 		NdisReleaseSpinLock(&pBAEntry->RxReRingLock);
-	}
-	else
-	{
-		DBGPRINT(RT_DEBUG_ERROR,  ("!!! (%d) Can't allocate reordering mpdu blk\n",
-								   pBAEntry->list.qlen));
+	} else {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 (" (%d) Can't allocate reordering mpdu blk\n",
+			  pBAEntry->list.qlen));
 
 		/*
 		 * flush all pending reordering mpdus
 		 * and receving mpdu to upper layer
 		 * make tcp/ip to take care reordering mechanism
 		 */
-		//ba_refresh_reordering_mpdus(pAd, pBAEntry);
+		/*ba_refresh_reordering_mpdus(pAd, pBAEntry); */
 		ba_indicate_reordering_mpdus_le_seq(pAd, pBAEntry, Sequence);
 
 		pBAEntry->LastIndSeq = Sequence;
@@ -1600,7 +1497,6 @@ static VOID ba_enqueue_reordering_packet(
 	}
 }
 
-
 /*
 	==========================================================================
 	Description:
@@ -1619,139 +1515,134 @@ static VOID ba_enqueue_reordering_packet(
 	==========================================================================
  */
 
-VOID Indicate_AMPDU_Packet(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	RX_BLK			*pRxBlk,
-	IN	UCHAR			FromWhichBSSID)
+void Indicate_AMPDU_Packet(struct rt_rtmp_adapter *pAd,
+			   struct rt_rx_blk *pRxBlk, u8 FromWhichBSSID)
 {
-	USHORT				Idx;
-	PBA_REC_ENTRY		pBAEntry = NULL;
-	UINT16				Sequence = pRxBlk->pHeader->Sequence;
-	ULONG				Now32;
-	UCHAR				Wcid = pRxBlk->pRxWI->WirelessCliID;
-	UCHAR				TID = pRxBlk->pRxWI->TID;
-
-
-	if (!RX_BLK_TEST_FLAG(pRxBlk, fRX_AMSDU) &&  (pRxBlk->DataSize > MAX_RX_PKT_LEN))
-	{
-		// release packet
-		RELEASE_NDIS_PACKET(pAd, pRxBlk->pRxPacket, NDIS_STATUS_FAILURE);
+	u16 Idx;
+	struct rt_ba_rec_entry *pBAEntry = NULL;
+	u16 Sequence = pRxBlk->pHeader->Sequence;
+	unsigned long Now32;
+	u8 Wcid = pRxBlk->pRxWI->WirelessCliID;
+	u8 TID = pRxBlk->pRxWI->TID;
+
+	if (!RX_BLK_TEST_FLAG(pRxBlk, fRX_AMSDU)
+	    && (pRxBlk->DataSize > MAX_RX_PKT_LEN)) {
+		/* release packet */
+		RELEASE_NDIS_PACKET(pAd, pRxBlk->pRxPacket,
+				    NDIS_STATUS_FAILURE);
 		return;
 	}
 
-	if (Wcid < MAX_LEN_OF_MAC_TABLE)
-	{
+	if (Wcid < MAX_LEN_OF_MAC_TABLE) {
 		Idx = pAd->MacTab.Content[Wcid].BARecWcidArray[TID];
-		if (Idx == 0)
-		{
+		if (Idx == 0) {
 			/* Rec BA Session had been torn down */
 			INDICATE_LEGACY_OR_AMSDU(pAd, pRxBlk, FromWhichBSSID);
 			return;
 		}
 		pBAEntry = &pAd->BATable.BARecEntry[Idx];
-	}
-	else
-	{
-		// impossible !!!
+	} else {
+		/* impossible ! */
 		ASSERT(0);
-		// release packet
-		RELEASE_NDIS_PACKET(pAd, pRxBlk->pRxPacket, NDIS_STATUS_FAILURE);
+		/* release packet */
+		RELEASE_NDIS_PACKET(pAd, pRxBlk->pRxPacket,
+				    NDIS_STATUS_FAILURE);
 		return;
 	}
 
 	ASSERT(pBAEntry);
 
-	// update last rx time
+	/* update last rx time */
 	NdisGetSystemUpTime(&Now32);
 
 	pBAEntry->rcvSeq = Sequence;
 
-
 	ba_flush_reordering_timeout_mpdus(pAd, pBAEntry, Now32);
 	pBAEntry->LastIndSeqAtTimer = Now32;
 
-	//
-	// Reset Last Indicate Sequence
-	//
-	if (pBAEntry->LastIndSeq == RESET_RCV_SEQ)
-	{
-		ASSERT((pBAEntry->list.qlen == 0) && (pBAEntry->list.next == NULL));
+	/* */
+	/* Reset Last Indicate Sequence */
+	/* */
+	if (pBAEntry->LastIndSeq == RESET_RCV_SEQ) {
+		ASSERT((pBAEntry->list.qlen == 0)
+		       && (pBAEntry->list.next == NULL));
 
-		// reset rcv sequence of BA session
+		/* reset rcv sequence of BA session */
 		pBAEntry->LastIndSeq = Sequence;
 		pBAEntry->LastIndSeqAtTimer = Now32;
 		INDICATE_LEGACY_OR_AMSDU(pAd, pRxBlk, FromWhichBSSID);
 		return;
 	}
 
-
-	//
-	// I. Check if in order.
-	//
-	if (SEQ_STEPONE(Sequence, pBAEntry->LastIndSeq, MAXSEQ))
-	{
-		USHORT  LastIndSeq;
+	/* */
+	/* I. Check if in order. */
+	/* */
+	if (SEQ_STEPONE(Sequence, pBAEntry->LastIndSeq, MAXSEQ)) {
+		u16 LastIndSeq;
 
 		pBAEntry->LastIndSeq = Sequence;
 		INDICATE_LEGACY_OR_AMSDU(pAd, pRxBlk, FromWhichBSSID);
- 		LastIndSeq = ba_indicate_reordering_mpdus_in_order(pAd, pBAEntry, pBAEntry->LastIndSeq);
-		if (LastIndSeq != RESET_RCV_SEQ)
-		{
+		LastIndSeq =
+		    ba_indicate_reordering_mpdus_in_order(pAd, pBAEntry,
+							  pBAEntry->LastIndSeq);
+		if (LastIndSeq != RESET_RCV_SEQ) {
 			pBAEntry->LastIndSeq = LastIndSeq;
 		}
 		pBAEntry->LastIndSeqAtTimer = Now32;
 	}
-	//
-	// II. Drop Duplicated Packet
-	//
-	else if (Sequence == pBAEntry->LastIndSeq)
-	{
+	/* */
+	/* II. Drop Duplicated Packet */
+	/* */
+	else if (Sequence == pBAEntry->LastIndSeq) {
 
-		// drop and release packet
+		/* drop and release packet */
 		pBAEntry->nDropPacket++;
-		RELEASE_NDIS_PACKET(pAd, pRxBlk->pRxPacket, NDIS_STATUS_FAILURE);
+		RELEASE_NDIS_PACKET(pAd, pRxBlk->pRxPacket,
+				    NDIS_STATUS_FAILURE);
 	}
-	//
-	// III. Drop Old Received Packet
-	//
-	else if (SEQ_SMALLER(Sequence, pBAEntry->LastIndSeq, MAXSEQ))
-	{
+	/* */
+	/* III. Drop Old Received Packet */
+	/* */
+	else if (SEQ_SMALLER(Sequence, pBAEntry->LastIndSeq, MAXSEQ)) {
 
-		// drop and release packet
+		/* drop and release packet */
 		pBAEntry->nDropPacket++;
-		RELEASE_NDIS_PACKET(pAd, pRxBlk->pRxPacket, NDIS_STATUS_FAILURE);
-	}
-	//
-	// IV. Receive Sequence within Window Size
-	//
-	else if (SEQ_SMALLER(Sequence, (((pBAEntry->LastIndSeq+pBAEntry->BAWinSize+1)) & MAXSEQ), MAXSEQ))
-	{
-		ba_enqueue_reordering_packet(pAd, pBAEntry, pRxBlk, FromWhichBSSID);
-	}
-	//
-	// V. Receive seq surpasses Win(lastseq + nMSDU). So refresh all reorder buffer
-	//
-	else
-	{
-		LONG WinStartSeq, TmpSeq;
-
-
-		TmpSeq = Sequence - (pBAEntry->BAWinSize) -1;
-		if (TmpSeq < 0)
-		{
-			TmpSeq = (MAXSEQ+1) + TmpSeq;
+		RELEASE_NDIS_PACKET(pAd, pRxBlk->pRxPacket,
+				    NDIS_STATUS_FAILURE);
+	}
+	/* */
+	/* IV. Receive Sequence within Window Size */
+	/* */
+	else if (SEQ_SMALLER
+		 (Sequence,
+		  (((pBAEntry->LastIndSeq + pBAEntry->BAWinSize + 1)) & MAXSEQ),
+		  MAXSEQ)) {
+		ba_enqueue_reordering_packet(pAd, pBAEntry, pRxBlk,
+					     FromWhichBSSID);
+	}
+	/* */
+	/* V. Receive seq surpasses Win(lastseq + nMSDU). So refresh all reorder buffer */
+	/* */
+	else {
+		long WinStartSeq, TmpSeq;
+
+		TmpSeq = Sequence - (pBAEntry->BAWinSize) - 1;
+		if (TmpSeq < 0) {
+			TmpSeq = (MAXSEQ + 1) + TmpSeq;
 		}
-		WinStartSeq = (TmpSeq+1) & MAXSEQ;
+		WinStartSeq = (TmpSeq + 1) & MAXSEQ;
 		ba_indicate_reordering_mpdus_le_seq(pAd, pBAEntry, WinStartSeq);
-		pBAEntry->LastIndSeq = WinStartSeq; //TmpSeq;
+		pBAEntry->LastIndSeq = WinStartSeq;	/*TmpSeq; */
 
 		pBAEntry->LastIndSeqAtTimer = Now32;
 
-		ba_enqueue_reordering_packet(pAd, pBAEntry, pRxBlk, FromWhichBSSID);
+		ba_enqueue_reordering_packet(pAd, pBAEntry, pRxBlk,
+					     FromWhichBSSID);
 
-		TmpSeq = ba_indicate_reordering_mpdus_in_order(pAd, pBAEntry, pBAEntry->LastIndSeq);
-		if (TmpSeq != RESET_RCV_SEQ)
-		{
+		TmpSeq =
+		    ba_indicate_reordering_mpdus_in_order(pAd, pBAEntry,
+							  pBAEntry->LastIndSeq);
+		if (TmpSeq != RESET_RCV_SEQ) {
 			pBAEntry->LastIndSeq = TmpSeq;
 		}
 	}
diff --git a/drivers/staging/rt3090/common/cmm_aes.c b/drivers/staging/rt2860/common/cmm_aes.c
index 4ccbbbfe4cca..250357c5cd65 100644
--- a/drivers/staging/rt3090/common/cmm_aes.c
+++ b/drivers/staging/rt2860/common/cmm_aes.c
@@ -35,23 +35,19 @@
 	Paul Wu		02-25-02		Initial
 */
 
-#include "../rt_config.h"
+#include	"../rt_config.h"
 
-
-typedef	struct
-{
-    UINT32 erk[64];     /* encryption round keys */
-    UINT32 drk[64];     /* decryption round keys */
-    int nr;             /* number of rounds */
-}
-aes_context;
+struct aes_context {
+	u32 erk[64];		/* encryption round keys */
+	u32 drk[64];		/* decryption round keys */
+	int nr;			/* number of rounds */
+};
 
 /*****************************/
 /******** SBOX Table *********/
 /*****************************/
 
-UCHAR SboxTable[256] =
-{
+u8 SboxTable[256] = {
 	0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5,
 	0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7, 0xab, 0x76,
 	0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0,
@@ -86,46 +82,34 @@ UCHAR SboxTable[256] =
 	0x41, 0x99, 0x2d, 0x0f, 0xb0, 0x54, 0xbb, 0x16
 };
 
-VOID xor_32(
-	IN  PUCHAR  a,
-	IN  PUCHAR  b,
-	OUT PUCHAR  out)
+void xor_32(u8 *a, u8 *b, u8 *out)
 {
-	INT i;
+	int i;
 
-	for (i=0;i<4; i++)
-	{
+	for (i = 0; i < 4; i++) {
 		out[i] = a[i] ^ b[i];
 	}
 }
 
-VOID xor_128(
-	IN  PUCHAR  a,
-	IN  PUCHAR  b,
-	OUT PUCHAR  out)
+void xor_128(u8 *a, u8 *b, u8 *out)
 {
-	INT i;
+	int i;
 
-	for (i=0;i<16; i++)
-	{
+	for (i = 0; i < 16; i++) {
 		out[i] = a[i] ^ b[i];
 	}
 }
 
-UCHAR RTMPCkipSbox(
-	IN  UCHAR   a)
+u8 RTMPCkipSbox(u8 a)
 {
 	return SboxTable[(int)a];
 }
 
-VOID next_key(
-	IN  PUCHAR  key,
-	IN  INT     round)
+void next_key(u8 *key, int round)
 {
-	UCHAR       rcon;
-	UCHAR       sbox_key[4];
-	UCHAR       rcon_table[12] =
-	{
+	u8 rcon;
+	u8 sbox_key[4];
+	u8 rcon_table[12] = {
 		0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80,
 		0x1b, 0x36, 0x36, 0x36
 	};
@@ -145,14 +129,11 @@ VOID next_key(
 	xor_32(&key[12], &key[8], &key[12]);
 }
 
-VOID byte_sub(
-	IN  PUCHAR  in,
-	OUT PUCHAR  out)
+void byte_sub(u8 *in, u8 *out)
 {
-	INT i;
+	int i;
 
-	for (i=0; i< 16; i++)
-	{
+	for (i = 0; i < 16; i++) {
 		out[i] = RTMPCkipSbox(in[i]);
 	}
 }
@@ -165,26 +146,23 @@ VOID byte_sub(
 void bitwise_xor(unsigned char *ina, unsigned char *inb, unsigned char *out)
 {
 	int i;
-	for (i=0; i<16; i++)
-	{
+	for (i = 0; i < 16; i++) {
 		out[i] = ina[i] ^ inb[i];
 	}
 }
 
-VOID shift_row(
-	IN  PUCHAR  in,
-	OUT PUCHAR  out)
+void shift_row(u8 *in, u8 *out)
 {
-	out[0] =  in[0];
-	out[1] =  in[5];
-	out[2] =  in[10];
-	out[3] =  in[15];
-	out[4] =  in[4];
-	out[5] =  in[9];
-	out[6] =  in[14];
-	out[7] =  in[3];
-	out[8] =  in[8];
-	out[9] =  in[13];
+	out[0] = in[0];
+	out[1] = in[5];
+	out[2] = in[10];
+	out[3] = in[15];
+	out[4] = in[4];
+	out[5] = in[9];
+	out[6] = in[14];
+	out[7] = in[3];
+	out[8] = in[8];
+	out[9] = in[13];
 	out[10] = in[2];
 	out[11] = in[7];
 	out[12] = in[12];
@@ -193,34 +171,31 @@ VOID shift_row(
 	out[15] = in[11];
 }
 
-VOID mix_column(
-	IN  PUCHAR  in,
-	OUT PUCHAR  out)
+void mix_column(u8 *in, u8 *out)
 {
-	INT         i;
-	UCHAR       add1b[4];
-	UCHAR       add1bf7[4];
-	UCHAR       rotl[4];
-	UCHAR       swap_halfs[4];
-	UCHAR       andf7[4];
-	UCHAR       rotr[4];
-	UCHAR       temp[4];
-	UCHAR       tempb[4];
-
-	for (i=0 ; i<4; i++)
-	{
-		if ((in[i] & 0x80)== 0x80)
+	int i;
+	u8 add1b[4];
+	u8 add1bf7[4];
+	u8 rotl[4];
+	u8 swap_halfs[4];
+	u8 andf7[4];
+	u8 rotr[4];
+	u8 temp[4];
+	u8 tempb[4];
+
+	for (i = 0; i < 4; i++) {
+		if ((in[i] & 0x80) == 0x80)
 			add1b[i] = 0x1b;
 		else
 			add1b[i] = 0x00;
 	}
 
-	swap_halfs[0] = in[2];    /* Swap halfs */
+	swap_halfs[0] = in[2];	/* Swap halfs */
 	swap_halfs[1] = in[3];
 	swap_halfs[2] = in[0];
 	swap_halfs[3] = in[1];
 
-	rotl[0] = in[3];        /* Rotate left 8 bits */
+	rotl[0] = in[3];	/* Rotate left 8 bits */
 	rotl[1] = in[0];
 	rotl[2] = in[1];
 	rotl[3] = in[2];
@@ -230,11 +205,9 @@ VOID mix_column(
 	andf7[2] = in[2] & 0x7f;
 	andf7[3] = in[3] & 0x7f;
 
-	for (i = 3; i>0; i--)    /* logical shift left 1 bit */
-	{
+	for (i = 3; i > 0; i--) {	/* logical shift left 1 bit */
 		andf7[i] = andf7[i] << 1;
-		if ((andf7[i-1] & 0x80) == 0x80)
-		{
+		if ((andf7[i - 1] & 0x80) == 0x80) {
 			andf7[i] = (andf7[i] | 0x01);
 		}
 	}
@@ -245,40 +218,37 @@ VOID mix_column(
 
 	xor_32(in, add1bf7, rotr);
 
-	temp[0] = rotr[0];         /* Rotate right 8 bits */
+	temp[0] = rotr[0];	/* Rotate right 8 bits */
 	rotr[0] = rotr[1];
 	rotr[1] = rotr[2];
 	rotr[2] = rotr[3];
 	rotr[3] = temp[0];
 
 	xor_32(add1bf7, rotr, temp);
-	xor_32(swap_halfs, rotl,tempb);
+	xor_32(swap_halfs, rotl, tempb);
 	xor_32(temp, tempb, out);
 }
 
-
 /************************************************/
 /* construct_mic_header1()                      */
 /* Builds the first MIC header block from       */
 /* header fields.                               */
 /************************************************/
 
-void construct_mic_header1(
-	unsigned char *mic_header1,
-	int header_length,
-	unsigned char *mpdu)
+void construct_mic_header1(unsigned char *mic_header1,
+			   int header_length, unsigned char *mpdu)
 {
 	mic_header1[0] = (unsigned char)((header_length - 2) / 256);
 	mic_header1[1] = (unsigned char)((header_length - 2) % 256);
-	mic_header1[2] = mpdu[0] & 0xcf;    /* Mute CF poll & CF ack bits */
-	mic_header1[3] = mpdu[1] & 0xc7;    /* Mute retry, more data and pwr mgt bits */
-	mic_header1[4] = mpdu[4];       /* A1 */
+	mic_header1[2] = mpdu[0] & 0xcf;	/* Mute CF poll & CF ack bits */
+	mic_header1[3] = mpdu[1] & 0xc7;	/* Mute retry, more data and pwr mgt bits */
+	mic_header1[4] = mpdu[4];	/* A1 */
 	mic_header1[5] = mpdu[5];
 	mic_header1[6] = mpdu[6];
 	mic_header1[7] = mpdu[7];
 	mic_header1[8] = mpdu[8];
 	mic_header1[9] = mpdu[9];
-	mic_header1[10] = mpdu[10];     /* A2 */
+	mic_header1[10] = mpdu[10];	/* A2 */
 	mic_header1[11] = mpdu[11];
 	mic_header1[12] = mpdu[12];
 	mic_header1[13] = mpdu[13];
@@ -292,84 +262,78 @@ void construct_mic_header1(
 /* header fields.                               */
 /************************************************/
 
-void construct_mic_header2(
-	unsigned char *mic_header2,
-	unsigned char *mpdu,
-	int a4_exists,
-	int qc_exists)
+void construct_mic_header2(unsigned char *mic_header2,
+			   unsigned char *mpdu, int a4_exists, int qc_exists)
 {
 	int i;
 
-	for (i = 0; i<16; i++) mic_header2[i]=0x00;
+	for (i = 0; i < 16; i++)
+		mic_header2[i] = 0x00;
 
-	mic_header2[0] = mpdu[16];    /* A3 */
+	mic_header2[0] = mpdu[16];	/* A3 */
 	mic_header2[1] = mpdu[17];
 	mic_header2[2] = mpdu[18];
 	mic_header2[3] = mpdu[19];
 	mic_header2[4] = mpdu[20];
 	mic_header2[5] = mpdu[21];
 
-	// In Sequence Control field, mute sequence numer bits (12-bit)
-	mic_header2[6] = mpdu[22] & 0x0f;   /* SC */
-	mic_header2[7] = 0x00; /* mpdu[23]; */
+	/* In Sequence Control field, mute sequence numer bits (12-bit) */
+	mic_header2[6] = mpdu[22] & 0x0f;	/* SC */
+	mic_header2[7] = 0x00;	/* mpdu[23]; */
 
-	if ((!qc_exists) & a4_exists)
-	{
-		for (i=0;i<6;i++) mic_header2[8+i] = mpdu[24+i];   /* A4 */
+	if ((!qc_exists) & a4_exists) {
+		for (i = 0; i < 6; i++)
+			mic_header2[8 + i] = mpdu[24 + i];	/* A4 */
 
 	}
 
-	if (qc_exists && (!a4_exists))
-	{
-		mic_header2[8] = mpdu[24] & 0x0f; /* mute bits 15 - 4 */
+	if (qc_exists && (!a4_exists)) {
+		mic_header2[8] = mpdu[24] & 0x0f;	/* mute bits 15 - 4 */
 		mic_header2[9] = mpdu[25] & 0x00;
 	}
 
-	if (qc_exists && a4_exists)
-	{
-		for (i=0;i<6;i++) mic_header2[8+i] = mpdu[24+i];   /* A4 */
+	if (qc_exists && a4_exists) {
+		for (i = 0; i < 6; i++)
+			mic_header2[8 + i] = mpdu[24 + i];	/* A4 */
 
 		mic_header2[14] = mpdu[30] & 0x0f;
 		mic_header2[15] = mpdu[31] & 0x00;
 	}
 }
 
-
 /************************************************/
 /* construct_mic_iv()                           */
 /* Builds the MIC IV from header fields and PN  */
 /************************************************/
 
-void construct_mic_iv(
-	unsigned char *mic_iv,
-	int qc_exists,
-	int a4_exists,
-	unsigned char *mpdu,
-	unsigned int payload_length,
-	unsigned char *pn_vector)
+void construct_mic_iv(unsigned char *mic_iv,
+		      int qc_exists,
+		      int a4_exists,
+		      unsigned char *mpdu,
+		      unsigned int payload_length, unsigned char *pn_vector)
 {
 	int i;
 
 	mic_iv[0] = 0x59;
 	if (qc_exists && a4_exists)
-		mic_iv[1] = mpdu[30] & 0x0f;    /* QoS_TC           */
+		mic_iv[1] = mpdu[30] & 0x0f;	/* QoS_TC           */
 	if (qc_exists && !a4_exists)
-		mic_iv[1] = mpdu[24] & 0x0f;   /* mute bits 7-4    */
+		mic_iv[1] = mpdu[24] & 0x0f;	/* mute bits 7-4    */
 	if (!qc_exists)
 		mic_iv[1] = 0x00;
 	for (i = 2; i < 8; i++)
-		mic_iv[i] = mpdu[i + 8];                    /* mic_iv[2:7] = A2[0:5] = mpdu[10:15] */
+		mic_iv[i] = mpdu[i + 8];	/* mic_iv[2:7] = A2[0:5] = mpdu[10:15] */
 #ifdef CONSISTENT_PN_ORDER
-		for (i = 8; i < 14; i++)
-			mic_iv[i] = pn_vector[i - 8];           /* mic_iv[8:13] = PN[0:5] */
+	for (i = 8; i < 14; i++)
+		mic_iv[i] = pn_vector[i - 8];	/* mic_iv[8:13] = PN[0:5] */
 #else
-		for (i = 8; i < 14; i++)
-			mic_iv[i] = pn_vector[13 - i];          /* mic_iv[8:13] = PN[5:0] */
+	for (i = 8; i < 14; i++)
+		mic_iv[i] = pn_vector[13 - i];	/* mic_iv[8:13] = PN[5:0] */
 #endif
 	i = (payload_length / 256);
 	i = (payload_length % 256);
-	mic_iv[14] = (unsigned char) (payload_length / 256);
-	mic_iv[15] = (unsigned char) (payload_length % 256);
+	mic_iv[14] = (unsigned char)(payload_length / 256);
+	mic_iv[15] = (unsigned char)(payload_length % 256);
 
 }
 
@@ -378,7 +342,8 @@ void construct_mic_iv(
 /* Performs a 128 bit AES encrypt with  */
 /* 128 bit data.                        */
 /****************************************/
-void aes128k128d(unsigned char *key, unsigned char *data, unsigned char *ciphertext)
+void aes128k128d(unsigned char *key, unsigned char *data,
+		 unsigned char *ciphertext)
 {
 	int round;
 	int i;
@@ -386,23 +351,19 @@ void aes128k128d(unsigned char *key, unsigned char *data, unsigned char *ciphert
 	unsigned char intermediateb[16];
 	unsigned char round_key[16];
 
-	for(i=0; i<16; i++) round_key[i] = key[i];
+	for (i = 0; i < 16; i++)
+		round_key[i] = key[i];
 
-	for (round = 0; round < 11; round++)
-	{
-		if (round == 0)
-		{
+	for (round = 0; round < 11; round++) {
+		if (round == 0) {
 			xor_128(round_key, data, ciphertext);
 			next_key(round_key, round);
-		}
-		else if (round == 10)
-		{
+		} else if (round == 10) {
 			byte_sub(ciphertext, intermediatea);
 			shift_row(intermediatea, intermediateb);
 			xor_128(intermediateb, round_key, ciphertext);
-		}
-		else    /* 1 - 9 */
-		{
+		} else {	/* 1 - 9 */
+
 			byte_sub(ciphertext, intermediatea);
 			shift_row(intermediatea, intermediateb);
 			mix_column(&intermediateb[0], &intermediatea[0]);
@@ -416,78 +377,72 @@ void aes128k128d(unsigned char *key, unsigned char *data, unsigned char *ciphert
 
 }
 
-void construct_ctr_preload(
-	unsigned char *ctr_preload,
-	int a4_exists,
-	int qc_exists,
-	unsigned char *mpdu,
-	unsigned char *pn_vector,
-	int c)
+void construct_ctr_preload(unsigned char *ctr_preload,
+			   int a4_exists,
+			   int qc_exists,
+			   unsigned char *mpdu, unsigned char *pn_vector, int c)
 {
 
 	int i = 0;
-	for (i=0; i<16; i++) ctr_preload[i] = 0x00;
+	for (i = 0; i < 16; i++)
+		ctr_preload[i] = 0x00;
 	i = 0;
 
-	ctr_preload[0] = 0x01;                                  /* flag */
-	if (qc_exists && a4_exists) ctr_preload[1] = mpdu[30] & 0x0f;   /* QoC_Control  */
-	if (qc_exists && !a4_exists) ctr_preload[1] = mpdu[24] & 0x0f;
+	ctr_preload[0] = 0x01;	/* flag */
+	if (qc_exists && a4_exists)
+		ctr_preload[1] = mpdu[30] & 0x0f;	/* QoC_Control  */
+	if (qc_exists && !a4_exists)
+		ctr_preload[1] = mpdu[24] & 0x0f;
 
 	for (i = 2; i < 8; i++)
-		ctr_preload[i] = mpdu[i + 8];                       /* ctr_preload[2:7] = A2[0:5] = mpdu[10:15] */
+		ctr_preload[i] = mpdu[i + 8];	/* ctr_preload[2:7] = A2[0:5] = mpdu[10:15] */
 #ifdef CONSISTENT_PN_ORDER
-	  for (i = 8; i < 14; i++)
-			ctr_preload[i] =    pn_vector[i - 8];           /* ctr_preload[8:13] = PN[0:5] */
+	for (i = 8; i < 14; i++)
+		ctr_preload[i] = pn_vector[i - 8];	/* ctr_preload[8:13] = PN[0:5] */
 #else
-	  for (i = 8; i < 14; i++)
-			ctr_preload[i] =    pn_vector[13 - i];          /* ctr_preload[8:13] = PN[5:0] */
+	for (i = 8; i < 14; i++)
+		ctr_preload[i] = pn_vector[13 - i];	/* ctr_preload[8:13] = PN[5:0] */
 #endif
-	ctr_preload[14] =  (unsigned char) (c / 256); // Ctr
-	ctr_preload[15] =  (unsigned char) (c % 256);
+	ctr_preload[14] = (unsigned char)(c / 256);	/* Ctr */
+	ctr_preload[15] = (unsigned char)(c % 256);
 
 }
 
-BOOLEAN RTMPSoftDecryptAES(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR	pData,
-	IN ULONG	DataByteCnt,
-	IN PCIPHER_KEY	pWpaKey)
+BOOLEAN RTMPSoftDecryptAES(struct rt_rtmp_adapter *pAd,
+			   u8 *pData,
+			   unsigned long DataByteCnt, struct rt_cipher_key *pWpaKey)
 {
-	UCHAR			KeyID;
-	UINT			HeaderLen;
-	UCHAR			PN[6];
-	UINT			payload_len;
-	UINT			num_blocks;
-	UINT			payload_remainder;
-	USHORT			fc;
-	UCHAR			fc0;
-	UCHAR			fc1;
-	UINT			frame_type;
-	UINT			frame_subtype;
-	UINT			from_ds;
-	UINT			to_ds;
-	INT				a4_exists;
-	INT				qc_exists;
-	UCHAR			aes_out[16];
-	int			payload_index;
-	UINT			i;
-	UCHAR			ctr_preload[16];
-	UCHAR			chain_buffer[16];
-	UCHAR			padded_buffer[16];
-	UCHAR			mic_iv[16];
-	UCHAR			mic_header1[16];
-	UCHAR			mic_header2[16];
-	UCHAR			MIC[8];
-	UCHAR			TrailMIC[8];
-
-#ifdef RT_BIG_ENDIAN
-	RTMPFrameEndianChange(pAd, (PUCHAR)pData, DIR_READ, FALSE);
-#endif
+	u8 KeyID;
+	u32 HeaderLen;
+	u8 PN[6];
+	u32 payload_len;
+	u32 num_blocks;
+	u32 payload_remainder;
+	u16 fc;
+	u8 fc0;
+	u8 fc1;
+	u32 frame_type;
+	u32 frame_subtype;
+	u32 from_ds;
+	u32 to_ds;
+	int a4_exists;
+	int qc_exists;
+	u8 aes_out[16];
+	int payload_index;
+	u32 i;
+	u8 ctr_preload[16];
+	u8 chain_buffer[16];
+	u8 padded_buffer[16];
+	u8 mic_iv[16];
+	u8 mic_header1[16];
+	u8 mic_header2[16];
+	u8 MIC[8];
+	u8 TrailMIC[8];
 
 	fc0 = *pData;
 	fc1 = *(pData + 1);
 
-	fc = *((PUSHORT)pData);
+	fc = *((u16 *)pData);
 
 	frame_type = ((fc0 >> 2) & 0x03);
 	frame_subtype = ((fc0 >> 4) & 0x0f);
@@ -496,49 +451,42 @@ BOOLEAN RTMPSoftDecryptAES(
 	to_ds = (fc1 & 0x1);
 
 	a4_exists = (from_ds & to_ds);
-	qc_exists = ((frame_subtype == 0x08) ||    /* Assumed QoS subtypes */
-				  (frame_subtype == 0x09) ||   /* Likely to change.    */
-				  (frame_subtype == 0x0a) ||
-				  (frame_subtype == 0x0b)
-				 );
+	qc_exists = ((frame_subtype == 0x08) ||	/* Assumed QoS subtypes */
+		     (frame_subtype == 0x09) ||	/* Likely to change.    */
+		     (frame_subtype == 0x0a) || (frame_subtype == 0x0b)
+	    );
 
 	HeaderLen = 24;
 	if (a4_exists)
 		HeaderLen += 6;
 
-	KeyID = *((PUCHAR)(pData+ HeaderLen + 3));
+	KeyID = *((u8 *)(pData + HeaderLen + 3));
 	KeyID = KeyID >> 6;
 
-	if (pWpaKey[KeyID].KeyLen == 0)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("RTMPSoftDecryptAES failed!(KeyID[%d] Length can not be 0)\n", KeyID));
+	if (pWpaKey[KeyID].KeyLen == 0) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("RTMPSoftDecryptAES failed!(KeyID[%d] Length can not be 0)\n",
+			  KeyID));
 		return FALSE;
 	}
 
-	PN[0] = *(pData+ HeaderLen);
-	PN[1] = *(pData+ HeaderLen + 1);
-	PN[2] = *(pData+ HeaderLen + 4);
-	PN[3] = *(pData+ HeaderLen + 5);
-	PN[4] = *(pData+ HeaderLen + 6);
-	PN[5] = *(pData+ HeaderLen + 7);
+	PN[0] = *(pData + HeaderLen);
+	PN[1] = *(pData + HeaderLen + 1);
+	PN[2] = *(pData + HeaderLen + 4);
+	PN[3] = *(pData + HeaderLen + 5);
+	PN[4] = *(pData + HeaderLen + 6);
+	PN[5] = *(pData + HeaderLen + 7);
 
-	payload_len = DataByteCnt - HeaderLen - 8 - 8;	// 8 bytes for CCMP header , 8 bytes for MIC
+	payload_len = DataByteCnt - HeaderLen - 8 - 8;	/* 8 bytes for CCMP header , 8 bytes for MIC */
 	payload_remainder = (payload_len) % 16;
 	num_blocks = (payload_len) / 16;
 
+	/* Find start of payload */
+	payload_index = HeaderLen + 8;	/*IV+EIV */
 
-
-	// Find start of payload
-	payload_index = HeaderLen + 8; //IV+EIV
-
-	for (i=0; i< num_blocks; i++)
-	{
+	for (i = 0; i < num_blocks; i++) {
 		construct_ctr_preload(ctr_preload,
-								a4_exists,
-								qc_exists,
-								pData,
-								PN,
-								i+1 );
+				      a4_exists, qc_exists, pData, PN, i + 1);
 
 		aes128k128d(pWpaKey[KeyID].Key, ctr_preload, aes_out);
 
@@ -547,38 +495,30 @@ BOOLEAN RTMPSoftDecryptAES(
 		payload_index += 16;
 	}
 
-	//
-	// If there is a short final block, then pad it
-	// encrypt it and copy the unpadded part back
-	//
-	if (payload_remainder > 0)
-	{
+	/* */
+	/* If there is a short final block, then pad it */
+	/* encrypt it and copy the unpadded part back */
+	/* */
+	if (payload_remainder > 0) {
 		construct_ctr_preload(ctr_preload,
-								a4_exists,
-								qc_exists,
-								pData,
-								PN,
-								num_blocks + 1);
+				      a4_exists,
+				      qc_exists, pData, PN, num_blocks + 1);
 
 		NdisZeroMemory(padded_buffer, 16);
-		NdisMoveMemory(padded_buffer, pData + payload_index, payload_remainder);
+		NdisMoveMemory(padded_buffer, pData + payload_index,
+			       payload_remainder);
 
 		aes128k128d(pWpaKey[KeyID].Key, ctr_preload, aes_out);
 
 		bitwise_xor(aes_out, padded_buffer, chain_buffer);
-		NdisMoveMemory(pData + payload_index - 8, chain_buffer, payload_remainder);
+		NdisMoveMemory(pData + payload_index - 8, chain_buffer,
+			       payload_remainder);
 		payload_index += payload_remainder;
 	}
-
-	//
-	// Descrypt the MIC
-	//
-	construct_ctr_preload(ctr_preload,
-							a4_exists,
-							qc_exists,
-							pData,
-							PN,
-							0);
+	/* */
+	/* Descrypt the MIC */
+	/* */
+	construct_ctr_preload(ctr_preload, a4_exists, qc_exists, pData, PN, 0);
 	NdisZeroMemory(padded_buffer, 16);
 	NdisMoveMemory(padded_buffer, pData + payload_index, 8);
 
@@ -588,36 +528,22 @@ BOOLEAN RTMPSoftDecryptAES(
 
 	NdisMoveMemory(TrailMIC, chain_buffer, 8);
 
+	/* */
+	/* Calculate MIC */
+	/* */
 
-	//
-	// Calculate MIC
-	//
-
-	//Force the protected frame bit on
+	/*Force the protected frame bit on */
 	*(pData + 1) = *(pData + 1) | 0x40;
 
-	// Find start of payload
-	// Because the CCMP header has been removed
+	/* Find start of payload */
+	/* Because the CCMP header has been removed */
 	payload_index = HeaderLen;
 
-	construct_mic_iv(
-					mic_iv,
-					qc_exists,
-					a4_exists,
-					pData,
-					payload_len,
-					PN);
-
-	construct_mic_header1(
-						mic_header1,
-						HeaderLen,
-						pData);
-
-	construct_mic_header2(
-						mic_header2,
-						pData,
-						a4_exists,
-						qc_exists);
+	construct_mic_iv(mic_iv, qc_exists, a4_exists, pData, payload_len, PN);
+
+	construct_mic_header1(mic_header1, HeaderLen, pData);
+
+	construct_mic_header2(mic_header2, pData, a4_exists, qc_exists);
 
 	aes128k128d(pWpaKey[KeyID].Key, mic_iv, aes_out);
 	bitwise_xor(aes_out, mic_header1, chain_buffer);
@@ -625,38 +551,32 @@ BOOLEAN RTMPSoftDecryptAES(
 	bitwise_xor(aes_out, mic_header2, chain_buffer);
 	aes128k128d(pWpaKey[KeyID].Key, chain_buffer, aes_out);
 
-	// iterate through each 16 byte payload block
-	for (i = 0; i < num_blocks; i++)
-	{
+	/* iterate through each 16 byte payload block */
+	for (i = 0; i < num_blocks; i++) {
 		bitwise_xor(aes_out, pData + payload_index, chain_buffer);
 		payload_index += 16;
 		aes128k128d(pWpaKey[KeyID].Key, chain_buffer, aes_out);
 	}
 
-	// Add on the final payload block if it needs padding
-	if (payload_remainder > 0)
-	{
+	/* Add on the final payload block if it needs padding */
+	if (payload_remainder > 0) {
 		NdisZeroMemory(padded_buffer, 16);
-		NdisMoveMemory(padded_buffer, pData + payload_index, payload_remainder);
+		NdisMoveMemory(padded_buffer, pData + payload_index,
+			       payload_remainder);
 
 		bitwise_xor(aes_out, padded_buffer, chain_buffer);
 		aes128k128d(pWpaKey[KeyID].Key, chain_buffer, aes_out);
 	}
+	/* aes_out contains padded mic, discard most significant */
+	/* 8 bytes to generate 64 bit MIC */
+	for (i = 0; i < 8; i++)
+		MIC[i] = aes_out[i];
 
-	// aes_out contains padded mic, discard most significant
-	// 8 bytes to generate 64 bit MIC
-	for (i = 0 ; i < 8; i++) MIC[i] = aes_out[i];
-
-	if (!NdisEqualMemory(MIC, TrailMIC, 8))
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("RTMPSoftDecryptAES, MIC Error !\n"));	 //MIC error.
+	if (!NdisEqualMemory(MIC, TrailMIC, 8)) {
+		DBGPRINT(RT_DEBUG_ERROR, ("RTMPSoftDecryptAES, MIC Error !\n"));	/*MIC error. */
 		return FALSE;
 	}
 
-#ifdef RT_BIG_ENDIAN
-	RTMPFrameEndianChange(pAd, (PUCHAR)pData, DIR_READ, FALSE);
-#endif
-
 	return TRUE;
 }
 
@@ -670,40 +590,39 @@ BOOLEAN RTMPSoftDecryptAES(
 #endif
 
 /* forward S-box */
-static uint32 FSb[256] =
-{
-	0x63, 0x7C,	0x77, 0x7B,	0xF2, 0x6B,	0x6F, 0xC5,
-	0x30, 0x01,	0x67, 0x2B,	0xFE, 0xD7,	0xAB, 0x76,
-	0xCA, 0x82,	0xC9, 0x7D,	0xFA, 0x59,	0x47, 0xF0,
-	0xAD, 0xD4,	0xA2, 0xAF,	0x9C, 0xA4,	0x72, 0xC0,
-	0xB7, 0xFD,	0x93, 0x26,	0x36, 0x3F,	0xF7, 0xCC,
-	0x34, 0xA5,	0xE5, 0xF1,	0x71, 0xD8,	0x31, 0x15,
-	0x04, 0xC7,	0x23, 0xC3,	0x18, 0x96,	0x05, 0x9A,
-	0x07, 0x12,	0x80, 0xE2,	0xEB, 0x27,	0xB2, 0x75,
-	0x09, 0x83,	0x2C, 0x1A,	0x1B, 0x6E,	0x5A, 0xA0,
-	0x52, 0x3B,	0xD6, 0xB3,	0x29, 0xE3,	0x2F, 0x84,
-	0x53, 0xD1,	0x00, 0xED,	0x20, 0xFC,	0xB1, 0x5B,
-	0x6A, 0xCB,	0xBE, 0x39,	0x4A, 0x4C,	0x58, 0xCF,
-	0xD0, 0xEF,	0xAA, 0xFB,	0x43, 0x4D,	0x33, 0x85,
-	0x45, 0xF9,	0x02, 0x7F,	0x50, 0x3C,	0x9F, 0xA8,
-	0x51, 0xA3,	0x40, 0x8F,	0x92, 0x9D,	0x38, 0xF5,
-	0xBC, 0xB6,	0xDA, 0x21,	0x10, 0xFF,	0xF3, 0xD2,
-	0xCD, 0x0C,	0x13, 0xEC,	0x5F, 0x97,	0x44, 0x17,
-	0xC4, 0xA7,	0x7E, 0x3D,	0x64, 0x5D,	0x19, 0x73,
-	0x60, 0x81,	0x4F, 0xDC,	0x22, 0x2A,	0x90, 0x88,
-	0x46, 0xEE,	0xB8, 0x14,	0xDE, 0x5E,	0x0B, 0xDB,
-	0xE0, 0x32,	0x3A, 0x0A,	0x49, 0x06,	0x24, 0x5C,
-	0xC2, 0xD3,	0xAC, 0x62,	0x91, 0x95,	0xE4, 0x79,
-	0xE7, 0xC8,	0x37, 0x6D,	0x8D, 0xD5,	0x4E, 0xA9,
-	0x6C, 0x56,	0xF4, 0xEA,	0x65, 0x7A,	0xAE, 0x08,
-	0xBA, 0x78,	0x25, 0x2E,	0x1C, 0xA6,	0xB4, 0xC6,
-	0xE8, 0xDD,	0x74, 0x1F,	0x4B, 0xBD,	0x8B, 0x8A,
-	0x70, 0x3E,	0xB5, 0x66,	0x48, 0x03,	0xF6, 0x0E,
-	0x61, 0x35,	0x57, 0xB9,	0x86, 0xC1,	0x1D, 0x9E,
-	0xE1, 0xF8,	0x98, 0x11,	0x69, 0xD9,	0x8E, 0x94,
-	0x9B, 0x1E,	0x87, 0xE9,	0xCE, 0x55,	0x28, 0xDF,
-	0x8C, 0xA1,	0x89, 0x0D,	0xBF, 0xE6,	0x42, 0x68,
-	0x41, 0x99,	0x2D, 0x0F,	0xB0, 0x54,	0xBB, 0x16
+static uint32 FSb[256] = {
+	0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5,
+	0x30, 0x01, 0x67, 0x2B, 0xFE, 0xD7, 0xAB, 0x76,
+	0xCA, 0x82, 0xC9, 0x7D, 0xFA, 0x59, 0x47, 0xF0,
+	0xAD, 0xD4, 0xA2, 0xAF, 0x9C, 0xA4, 0x72, 0xC0,
+	0xB7, 0xFD, 0x93, 0x26, 0x36, 0x3F, 0xF7, 0xCC,
+	0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15,
+	0x04, 0xC7, 0x23, 0xC3, 0x18, 0x96, 0x05, 0x9A,
+	0x07, 0x12, 0x80, 0xE2, 0xEB, 0x27, 0xB2, 0x75,
+	0x09, 0x83, 0x2C, 0x1A, 0x1B, 0x6E, 0x5A, 0xA0,
+	0x52, 0x3B, 0xD6, 0xB3, 0x29, 0xE3, 0x2F, 0x84,
+	0x53, 0xD1, 0x00, 0xED, 0x20, 0xFC, 0xB1, 0x5B,
+	0x6A, 0xCB, 0xBE, 0x39, 0x4A, 0x4C, 0x58, 0xCF,
+	0xD0, 0xEF, 0xAA, 0xFB, 0x43, 0x4D, 0x33, 0x85,
+	0x45, 0xF9, 0x02, 0x7F, 0x50, 0x3C, 0x9F, 0xA8,
+	0x51, 0xA3, 0x40, 0x8F, 0x92, 0x9D, 0x38, 0xF5,
+	0xBC, 0xB6, 0xDA, 0x21, 0x10, 0xFF, 0xF3, 0xD2,
+	0xCD, 0x0C, 0x13, 0xEC, 0x5F, 0x97, 0x44, 0x17,
+	0xC4, 0xA7, 0x7E, 0x3D, 0x64, 0x5D, 0x19, 0x73,
+	0x60, 0x81, 0x4F, 0xDC, 0x22, 0x2A, 0x90, 0x88,
+	0x46, 0xEE, 0xB8, 0x14, 0xDE, 0x5E, 0x0B, 0xDB,
+	0xE0, 0x32, 0x3A, 0x0A, 0x49, 0x06, 0x24, 0x5C,
+	0xC2, 0xD3, 0xAC, 0x62, 0x91, 0x95, 0xE4, 0x79,
+	0xE7, 0xC8, 0x37, 0x6D, 0x8D, 0xD5, 0x4E, 0xA9,
+	0x6C, 0x56, 0xF4, 0xEA, 0x65, 0x7A, 0xAE, 0x08,
+	0xBA, 0x78, 0x25, 0x2E, 0x1C, 0xA6, 0xB4, 0xC6,
+	0xE8, 0xDD, 0x74, 0x1F, 0x4B, 0xBD, 0x8B, 0x8A,
+	0x70, 0x3E, 0xB5, 0x66, 0x48, 0x03, 0xF6, 0x0E,
+	0x61, 0x35, 0x57, 0xB9, 0x86, 0xC1, 0x1D, 0x9E,
+	0xE1, 0xF8, 0x98, 0x11, 0x69, 0xD9, 0x8E, 0x94,
+	0x9B, 0x1E, 0x87, 0xE9, 0xCE, 0x55, 0x28, 0xDF,
+	0x8C, 0xA1, 0x89, 0x0D, 0xBF, 0xE6, 0x42, 0x68,
+	0x41, 0x99, 0x2D, 0x0F, 0xB0, 0x54, 0xBB, 0x16
 };
 
 /* forward table */
@@ -776,58 +695,61 @@ static uint32 FSb[256] =
 
 #define	V(a,b,c,d) 0x##a##b##c##d
 static uint32 FT0[256] = { FT };
+
 #undef V
 
 #define	V(a,b,c,d) 0x##d##a##b##c
 static uint32 FT1[256] = { FT };
+
 #undef V
 
 #define	V(a,b,c,d) 0x##c##d##a##b
 static uint32 FT2[256] = { FT };
+
 #undef V
 
 #define	V(a,b,c,d) 0x##b##c##d##a
 static uint32 FT3[256] = { FT };
+
 #undef V
 
 #undef FT
 
 /* reverse S-box */
 
-static uint32 RSb[256] =
-{
-	0x52, 0x09,	0x6A, 0xD5,	0x30, 0x36,	0xA5, 0x38,
-	0xBF, 0x40,	0xA3, 0x9E,	0x81, 0xF3,	0xD7, 0xFB,
-	0x7C, 0xE3,	0x39, 0x82,	0x9B, 0x2F,	0xFF, 0x87,
-	0x34, 0x8E,	0x43, 0x44,	0xC4, 0xDE,	0xE9, 0xCB,
-	0x54, 0x7B,	0x94, 0x32,	0xA6, 0xC2,	0x23, 0x3D,
-	0xEE, 0x4C,	0x95, 0x0B,	0x42, 0xFA,	0xC3, 0x4E,
-	0x08, 0x2E,	0xA1, 0x66,	0x28, 0xD9,	0x24, 0xB2,
-	0x76, 0x5B,	0xA2, 0x49,	0x6D, 0x8B,	0xD1, 0x25,
-	0x72, 0xF8,	0xF6, 0x64,	0x86, 0x68,	0x98, 0x16,
-	0xD4, 0xA4,	0x5C, 0xCC,	0x5D, 0x65,	0xB6, 0x92,
-	0x6C, 0x70,	0x48, 0x50,	0xFD, 0xED,	0xB9, 0xDA,
-	0x5E, 0x15,	0x46, 0x57,	0xA7, 0x8D,	0x9D, 0x84,
-	0x90, 0xD8,	0xAB, 0x00,	0x8C, 0xBC,	0xD3, 0x0A,
-	0xF7, 0xE4,	0x58, 0x05,	0xB8, 0xB3,	0x45, 0x06,
-	0xD0, 0x2C,	0x1E, 0x8F,	0xCA, 0x3F,	0x0F, 0x02,
-	0xC1, 0xAF,	0xBD, 0x03,	0x01, 0x13,	0x8A, 0x6B,
-	0x3A, 0x91,	0x11, 0x41,	0x4F, 0x67,	0xDC, 0xEA,
-	0x97, 0xF2,	0xCF, 0xCE,	0xF0, 0xB4,	0xE6, 0x73,
-	0x96, 0xAC,	0x74, 0x22,	0xE7, 0xAD,	0x35, 0x85,
-	0xE2, 0xF9,	0x37, 0xE8,	0x1C, 0x75,	0xDF, 0x6E,
-	0x47, 0xF1,	0x1A, 0x71,	0x1D, 0x29,	0xC5, 0x89,
-	0x6F, 0xB7,	0x62, 0x0E,	0xAA, 0x18,	0xBE, 0x1B,
-	0xFC, 0x56,	0x3E, 0x4B,	0xC6, 0xD2,	0x79, 0x20,
-	0x9A, 0xDB,	0xC0, 0xFE,	0x78, 0xCD,	0x5A, 0xF4,
-	0x1F, 0xDD,	0xA8, 0x33,	0x88, 0x07,	0xC7, 0x31,
-	0xB1, 0x12,	0x10, 0x59,	0x27, 0x80,	0xEC, 0x5F,
-	0x60, 0x51,	0x7F, 0xA9,	0x19, 0xB5,	0x4A, 0x0D,
-	0x2D, 0xE5,	0x7A, 0x9F,	0x93, 0xC9,	0x9C, 0xEF,
-	0xA0, 0xE0,	0x3B, 0x4D,	0xAE, 0x2A,	0xF5, 0xB0,
-	0xC8, 0xEB,	0xBB, 0x3C,	0x83, 0x53,	0x99, 0x61,
-	0x17, 0x2B,	0x04, 0x7E,	0xBA, 0x77,	0xD6, 0x26,
-	0xE1, 0x69,	0x14, 0x63,	0x55, 0x21,	0x0C, 0x7D
+static uint32 RSb[256] = {
+	0x52, 0x09, 0x6A, 0xD5, 0x30, 0x36, 0xA5, 0x38,
+	0xBF, 0x40, 0xA3, 0x9E, 0x81, 0xF3, 0xD7, 0xFB,
+	0x7C, 0xE3, 0x39, 0x82, 0x9B, 0x2F, 0xFF, 0x87,
+	0x34, 0x8E, 0x43, 0x44, 0xC4, 0xDE, 0xE9, 0xCB,
+	0x54, 0x7B, 0x94, 0x32, 0xA6, 0xC2, 0x23, 0x3D,
+	0xEE, 0x4C, 0x95, 0x0B, 0x42, 0xFA, 0xC3, 0x4E,
+	0x08, 0x2E, 0xA1, 0x66, 0x28, 0xD9, 0x24, 0xB2,
+	0x76, 0x5B, 0xA2, 0x49, 0x6D, 0x8B, 0xD1, 0x25,
+	0x72, 0xF8, 0xF6, 0x64, 0x86, 0x68, 0x98, 0x16,
+	0xD4, 0xA4, 0x5C, 0xCC, 0x5D, 0x65, 0xB6, 0x92,
+	0x6C, 0x70, 0x48, 0x50, 0xFD, 0xED, 0xB9, 0xDA,
+	0x5E, 0x15, 0x46, 0x57, 0xA7, 0x8D, 0x9D, 0x84,
+	0x90, 0xD8, 0xAB, 0x00, 0x8C, 0xBC, 0xD3, 0x0A,
+	0xF7, 0xE4, 0x58, 0x05, 0xB8, 0xB3, 0x45, 0x06,
+	0xD0, 0x2C, 0x1E, 0x8F, 0xCA, 0x3F, 0x0F, 0x02,
+	0xC1, 0xAF, 0xBD, 0x03, 0x01, 0x13, 0x8A, 0x6B,
+	0x3A, 0x91, 0x11, 0x41, 0x4F, 0x67, 0xDC, 0xEA,
+	0x97, 0xF2, 0xCF, 0xCE, 0xF0, 0xB4, 0xE6, 0x73,
+	0x96, 0xAC, 0x74, 0x22, 0xE7, 0xAD, 0x35, 0x85,
+	0xE2, 0xF9, 0x37, 0xE8, 0x1C, 0x75, 0xDF, 0x6E,
+	0x47, 0xF1, 0x1A, 0x71, 0x1D, 0x29, 0xC5, 0x89,
+	0x6F, 0xB7, 0x62, 0x0E, 0xAA, 0x18, 0xBE, 0x1B,
+	0xFC, 0x56, 0x3E, 0x4B, 0xC6, 0xD2, 0x79, 0x20,
+	0x9A, 0xDB, 0xC0, 0xFE, 0x78, 0xCD, 0x5A, 0xF4,
+	0x1F, 0xDD, 0xA8, 0x33, 0x88, 0x07, 0xC7, 0x31,
+	0xB1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xEC, 0x5F,
+	0x60, 0x51, 0x7F, 0xA9, 0x19, 0xB5, 0x4A, 0x0D,
+	0x2D, 0xE5, 0x7A, 0x9F, 0x93, 0xC9, 0x9C, 0xEF,
+	0xA0, 0xE0, 0x3B, 0x4D, 0xAE, 0x2A, 0xF5, 0xB0,
+	0xC8, 0xEB, 0xBB, 0x3C, 0x83, 0x53, 0x99, 0x61,
+	0x17, 0x2B, 0x04, 0x7E, 0xBA, 0x77, 0xD6, 0x26,
+	0xE1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0C, 0x7D
 };
 
 /* reverse table */
@@ -901,29 +823,32 @@ static uint32 RSb[256] =
 
 #define	V(a,b,c,d) 0x##a##b##c##d
 static uint32 RT0[256] = { RT };
+
 #undef V
 
 #define	V(a,b,c,d) 0x##d##a##b##c
 static uint32 RT1[256] = { RT };
+
 #undef V
 
 #define	V(a,b,c,d) 0x##c##d##a##b
 static uint32 RT2[256] = { RT };
+
 #undef V
 
 #define	V(a,b,c,d) 0x##b##c##d##a
 static uint32 RT3[256] = { RT };
+
 #undef V
 
 #undef RT
 
 /* round constants */
 
-static uint32 RCON[10] =
-{
-	0x01000000,	0x02000000,	0x04000000,	0x08000000,
-	0x10000000,	0x20000000,	0x40000000,	0x80000000,
-	0x1B000000,	0x36000000
+static uint32 RCON[10] = {
+	0x01000000, 0x02000000, 0x04000000, 0x08000000,
+	0x10000000, 0x20000000, 0x40000000, 0x80000000,
+	0x1B000000, 0x36000000
 };
 
 /* key schedule	tables */
@@ -953,60 +878,61 @@ static uint32 KT3[256];
 	(b)[(i)	+ 3] = (uint8) ( (n)	   );		\
 }
 
-
-int	rt_aes_set_key( aes_context *ctx, uint8 *key, int nbits )
+int rt_aes_set_key(struct aes_context * ctx, uint8 * key, int nbits)
 {
-	int	i;
-	uint32 *RK,	*SK;
-
-	switch(	nbits )
-	{
-		case 128: ctx->nr =	10;	break;
-		case 192: ctx->nr =	12;	break;
-		case 256: ctx->nr =	14;	break;
-		default	: return( 1	);
+	int i;
+	uint32 *RK, *SK;
+
+	switch (nbits) {
+	case 128:
+		ctx->nr = 10;
+		break;
+	case 192:
+		ctx->nr = 12;
+		break;
+	case 256:
+		ctx->nr = 14;
+		break;
+	default:
+		return (1);
 	}
 
 	RK = (uint32 *) ctx->erk;
 
-	for( i = 0;	i <	(nbits >> 5); i++ )
-	{
-		GET_UINT32(	RK[i], key,	i *	4 );
+	for (i = 0; i < (nbits >> 5); i++) {
+		GET_UINT32(RK[i], key, i * 4);
 	}
 
-	/* setup encryption	round keys */
+	/* setup encryption     round keys */
 
-	switch(	nbits )
-	{
+	switch (nbits) {
 	case 128:
 
-		for( i = 0;	i <	10;	i++, RK	+= 4 )
-		{
-			RK[4]  = RK[0] ^ RCON[i] ^
-						( FSb[ (uint8) ( RK[3] >> 16 ) ] <<	24 ) ^
-						( FSb[ (uint8) ( RK[3] >>  8 ) ] <<	16 ) ^
-						( FSb[ (uint8) ( RK[3]		 ) ] <<	 8 ) ^
-						( FSb[ (uint8) ( RK[3] >> 24 ) ]	   );
-
-			RK[5]  = RK[1] ^ RK[4];
-			RK[6]  = RK[2] ^ RK[5];
-			RK[7]  = RK[3] ^ RK[6];
+		for (i = 0; i < 10; i++, RK += 4) {
+			RK[4] = RK[0] ^ RCON[i] ^
+			    (FSb[(uint8) (RK[3] >> 16)] << 24) ^
+			    (FSb[(uint8) (RK[3] >> 8)] << 16) ^
+			    (FSb[(uint8) (RK[3])] << 8) ^
+			    (FSb[(uint8) (RK[3] >> 24)]);
+
+			RK[5] = RK[1] ^ RK[4];
+			RK[6] = RK[2] ^ RK[5];
+			RK[7] = RK[3] ^ RK[6];
 		}
 		break;
 
 	case 192:
 
-		for( i = 0;	i <	8; i++,	RK += 6	)
-		{
-			RK[6]  = RK[0] ^ RCON[i] ^
-						( FSb[ (uint8) ( RK[5] >> 16 ) ] <<	24 ) ^
-						( FSb[ (uint8) ( RK[5] >>  8 ) ] <<	16 ) ^
-						( FSb[ (uint8) ( RK[5]		 ) ] <<	 8 ) ^
-						( FSb[ (uint8) ( RK[5] >> 24 ) ]	   );
-
-			RK[7]  = RK[1] ^ RK[6];
-			RK[8]  = RK[2] ^ RK[7];
-			RK[9]  = RK[3] ^ RK[8];
+		for (i = 0; i < 8; i++, RK += 6) {
+			RK[6] = RK[0] ^ RCON[i] ^
+			    (FSb[(uint8) (RK[5] >> 16)] << 24) ^
+			    (FSb[(uint8) (RK[5] >> 8)] << 16) ^
+			    (FSb[(uint8) (RK[5])] << 8) ^
+			    (FSb[(uint8) (RK[5] >> 24)]);
+
+			RK[7] = RK[1] ^ RK[6];
+			RK[8] = RK[2] ^ RK[7];
+			RK[9] = RK[3] ^ RK[8];
 			RK[10] = RK[4] ^ RK[9];
 			RK[11] = RK[5] ^ RK[10];
 		}
@@ -1014,23 +940,22 @@ int	rt_aes_set_key( aes_context *ctx, uint8 *key, int nbits )
 
 	case 256:
 
-		for( i = 0;	i <	7; i++,	RK += 8	)
-		{
-			RK[8]  = RK[0] ^ RCON[i] ^
-						( FSb[ (uint8) ( RK[7] >> 16 ) ] <<	24 ) ^
-						( FSb[ (uint8) ( RK[7] >>  8 ) ] <<	16 ) ^
-						( FSb[ (uint8) ( RK[7]		 ) ] <<	 8 ) ^
-						( FSb[ (uint8) ( RK[7] >> 24 ) ]	   );
+		for (i = 0; i < 7; i++, RK += 8) {
+			RK[8] = RK[0] ^ RCON[i] ^
+			    (FSb[(uint8) (RK[7] >> 16)] << 24) ^
+			    (FSb[(uint8) (RK[7] >> 8)] << 16) ^
+			    (FSb[(uint8) (RK[7])] << 8) ^
+			    (FSb[(uint8) (RK[7] >> 24)]);
 
-			RK[9]  = RK[1] ^ RK[8];
+			RK[9] = RK[1] ^ RK[8];
 			RK[10] = RK[2] ^ RK[9];
 			RK[11] = RK[3] ^ RK[10];
 
 			RK[12] = RK[4] ^
-						( FSb[ (uint8) ( RK[11]	>> 24 )	] << 24	) ^
-						( FSb[ (uint8) ( RK[11]	>> 16 )	] << 16	) ^
-						( FSb[ (uint8) ( RK[11]	>>	8 )	] <<  8	) ^
-						( FSb[ (uint8) ( RK[11]		  )	]		);
+			    (FSb[(uint8) (RK[11] >> 24)] << 24) ^
+			    (FSb[(uint8) (RK[11] >> 16)] << 16) ^
+			    (FSb[(uint8) (RK[11] >> 8)] << 8) ^
+			    (FSb[(uint8) (RK[11])]);
 
 			RK[13] = RK[5] ^ RK[12];
 			RK[14] = RK[6] ^ RK[13];
@@ -1039,74 +964,75 @@ int	rt_aes_set_key( aes_context *ctx, uint8 *key, int nbits )
 		break;
 	}
 
-	/* setup decryption	round keys */
+	/* setup decryption     round keys */
 
-	if(	KT_init	)
-	{
-		for( i = 0;	i <	256; i++ )
-		{
-			KT0[i] = RT0[ FSb[i] ];
-			KT1[i] = RT1[ FSb[i] ];
-			KT2[i] = RT2[ FSb[i] ];
-			KT3[i] = RT3[ FSb[i] ];
+	if (KT_init) {
+		for (i = 0; i < 256; i++) {
+			KT0[i] = RT0[FSb[i]];
+			KT1[i] = RT1[FSb[i]];
+			KT2[i] = RT2[FSb[i]];
+			KT3[i] = RT3[FSb[i]];
 		}
 
-		KT_init	= 0;
+		KT_init = 0;
 	}
 
 	SK = (uint32 *) ctx->drk;
 
-	*SK++ =	*RK++;
-	*SK++ =	*RK++;
-	*SK++ =	*RK++;
-	*SK++ =	*RK++;
+	*SK++ = *RK++;
+	*SK++ = *RK++;
+	*SK++ = *RK++;
+	*SK++ = *RK++;
 
-	for( i = 1;	i <	ctx->nr; i++ )
-	{
+	for (i = 1; i < ctx->nr; i++) {
 		RK -= 8;
 
-		*SK++ =	KT0[ (uint8) ( *RK >> 24 ) ] ^
-				KT1[ (uint8) ( *RK >> 16 ) ] ^
-				KT2[ (uint8) ( *RK >>  8 ) ] ^
-				KT3[ (uint8) ( *RK		 ) ]; RK++;
-
-		*SK++ =	KT0[ (uint8) ( *RK >> 24 ) ] ^
-				KT1[ (uint8) ( *RK >> 16 ) ] ^
-				KT2[ (uint8) ( *RK >>  8 ) ] ^
-				KT3[ (uint8) ( *RK		 ) ]; RK++;
-
-		*SK++ =	KT0[ (uint8) ( *RK >> 24 ) ] ^
-				KT1[ (uint8) ( *RK >> 16 ) ] ^
-				KT2[ (uint8) ( *RK >>  8 ) ] ^
-				KT3[ (uint8) ( *RK		 ) ]; RK++;
-
-		*SK++ =	KT0[ (uint8) ( *RK >> 24 ) ] ^
-				KT1[ (uint8) ( *RK >> 16 ) ] ^
-				KT2[ (uint8) ( *RK >>  8 ) ] ^
-				KT3[ (uint8) ( *RK		 ) ]; RK++;
+		*SK++ = KT0[(uint8) (*RK >> 24)] ^
+		    KT1[(uint8) (*RK >> 16)] ^
+		    KT2[(uint8) (*RK >> 8)] ^ KT3[(uint8) (*RK)];
+		RK++;
+
+		*SK++ = KT0[(uint8) (*RK >> 24)] ^
+		    KT1[(uint8) (*RK >> 16)] ^
+		    KT2[(uint8) (*RK >> 8)] ^ KT3[(uint8) (*RK)];
+		RK++;
+
+		*SK++ = KT0[(uint8) (*RK >> 24)] ^
+		    KT1[(uint8) (*RK >> 16)] ^
+		    KT2[(uint8) (*RK >> 8)] ^ KT3[(uint8) (*RK)];
+		RK++;
+
+		*SK++ = KT0[(uint8) (*RK >> 24)] ^
+		    KT1[(uint8) (*RK >> 16)] ^
+		    KT2[(uint8) (*RK >> 8)] ^ KT3[(uint8) (*RK)];
+		RK++;
 	}
 
 	RK -= 8;
 
-	*SK++ =	*RK++;
-	*SK++ =	*RK++;
-	*SK++ =	*RK++;
-	*SK++ =	*RK++;
+	*SK++ = *RK++;
+	*SK++ = *RK++;
+	*SK++ = *RK++;
+	*SK++ = *RK++;
 
-	return(	0 );
+	return (0);
 }
 
 /* AES 128-bit block encryption	routine	*/
 
-void rt_aes_encrypt(aes_context *ctx, uint8 input[16],	uint8 output[16] )
+void rt_aes_encrypt(struct aes_context * ctx, uint8 input[16], uint8 output[16])
 {
-	uint32 *RK,	X0,	X1,	X2,	X3,	Y0,	Y1,	Y2,	Y3;
+	uint32 *RK, X0, X1, X2, X3, Y0, Y1, Y2, Y3;
 
 	RK = (uint32 *) ctx->erk;
-	GET_UINT32(	X0,	input,	0 ); X0	^= RK[0];
-	GET_UINT32(	X1,	input,	4 ); X1	^= RK[1];
-	GET_UINT32(	X2,	input,	8 ); X2	^= RK[2];
-	GET_UINT32(	X3,	input, 12 ); X3	^= RK[3];
+	GET_UINT32(X0, input, 0);
+	X0 ^= RK[0];
+	GET_UINT32(X1, input, 4);
+	X1 ^= RK[1];
+	GET_UINT32(X2, input, 8);
+	X2 ^= RK[2];
+	GET_UINT32(X3, input, 12);
+	X3 ^= RK[3];
 
 #define	AES_FROUND(X0,X1,X2,X3,Y0,Y1,Y2,Y3)		\
 {												\
@@ -1133,70 +1059,68 @@ void rt_aes_encrypt(aes_context *ctx, uint8 input[16],	uint8 output[16] )
 				 FT3[ (uint8) (	Y2		 ) ];	\
 }
 
-	AES_FROUND(	Y0,	Y1,	Y2,	Y3,	X0,	X1,	X2,	X3 );		/* round 1 */
-	AES_FROUND(	X0,	X1,	X2,	X3,	Y0,	Y1,	Y2,	Y3 );		/* round 2 */
-	AES_FROUND(	Y0,	Y1,	Y2,	Y3,	X0,	X1,	X2,	X3 );		/* round 3 */
-	AES_FROUND(	X0,	X1,	X2,	X3,	Y0,	Y1,	Y2,	Y3 );		/* round 4 */
-	AES_FROUND(	Y0,	Y1,	Y2,	Y3,	X0,	X1,	X2,	X3 );		/* round 5 */
-	AES_FROUND(	X0,	X1,	X2,	X3,	Y0,	Y1,	Y2,	Y3 );		/* round 6 */
-	AES_FROUND(	Y0,	Y1,	Y2,	Y3,	X0,	X1,	X2,	X3 );		/* round 7 */
-	AES_FROUND(	X0,	X1,	X2,	X3,	Y0,	Y1,	Y2,	Y3 );		/* round 8 */
-	AES_FROUND(	Y0,	Y1,	Y2,	Y3,	X0,	X1,	X2,	X3 );		/* round 9 */
-
-	if(	ctx->nr	> 10 )
-	{
-		AES_FROUND(	X0,	X1,	X2,	X3,	Y0,	Y1,	Y2,	Y3 );	/* round 10	*/
-		AES_FROUND(	Y0,	Y1,	Y2,	Y3,	X0,	X1,	X2,	X3 );	/* round 11	*/
+	AES_FROUND(Y0, Y1, Y2, Y3, X0, X1, X2, X3);	/* round 1 */
+	AES_FROUND(X0, X1, X2, X3, Y0, Y1, Y2, Y3);	/* round 2 */
+	AES_FROUND(Y0, Y1, Y2, Y3, X0, X1, X2, X3);	/* round 3 */
+	AES_FROUND(X0, X1, X2, X3, Y0, Y1, Y2, Y3);	/* round 4 */
+	AES_FROUND(Y0, Y1, Y2, Y3, X0, X1, X2, X3);	/* round 5 */
+	AES_FROUND(X0, X1, X2, X3, Y0, Y1, Y2, Y3);	/* round 6 */
+	AES_FROUND(Y0, Y1, Y2, Y3, X0, X1, X2, X3);	/* round 7 */
+	AES_FROUND(X0, X1, X2, X3, Y0, Y1, Y2, Y3);	/* round 8 */
+	AES_FROUND(Y0, Y1, Y2, Y3, X0, X1, X2, X3);	/* round 9 */
+
+	if (ctx->nr > 10) {
+		AES_FROUND(X0, X1, X2, X3, Y0, Y1, Y2, Y3);	/* round 10     */
+		AES_FROUND(Y0, Y1, Y2, Y3, X0, X1, X2, X3);	/* round 11     */
 	}
 
-	if(	ctx->nr	> 12 )
-	{
-		AES_FROUND(	X0,	X1,	X2,	X3,	Y0,	Y1,	Y2,	Y3 );	/* round 12	*/
-		AES_FROUND(	Y0,	Y1,	Y2,	Y3,	X0,	X1,	X2,	X3 );	/* round 13	*/
+	if (ctx->nr > 12) {
+		AES_FROUND(X0, X1, X2, X3, Y0, Y1, Y2, Y3);	/* round 12     */
+		AES_FROUND(Y0, Y1, Y2, Y3, X0, X1, X2, X3);	/* round 13     */
 	}
 
-	/* last	round */
+	/* last round */
 
 	RK += 4;
 
-	X0 = RK[0] ^ ( FSb[	(uint8)	( Y0 >>	24 ) ] << 24 ) ^
-				 ( FSb[	(uint8)	( Y1 >>	16 ) ] << 16 ) ^
-				 ( FSb[	(uint8)	( Y2 >>	 8 ) ] <<  8 ) ^
-				 ( FSb[	(uint8)	( Y3	   ) ]		 );
-
-	X1 = RK[1] ^ ( FSb[	(uint8)	( Y1 >>	24 ) ] << 24 ) ^
-				 ( FSb[	(uint8)	( Y2 >>	16 ) ] << 16 ) ^
-				 ( FSb[	(uint8)	( Y3 >>	 8 ) ] <<  8 ) ^
-				 ( FSb[	(uint8)	( Y0	   ) ]		 );
-
-	X2 = RK[2] ^ ( FSb[	(uint8)	( Y2 >>	24 ) ] << 24 ) ^
-				 ( FSb[	(uint8)	( Y3 >>	16 ) ] << 16 ) ^
-				 ( FSb[	(uint8)	( Y0 >>	 8 ) ] <<  8 ) ^
-				 ( FSb[	(uint8)	( Y1	   ) ]		 );
-
-	X3 = RK[3] ^ ( FSb[	(uint8)	( Y3 >>	24 ) ] << 24 ) ^
-				 ( FSb[	(uint8)	( Y0 >>	16 ) ] << 16 ) ^
-				 ( FSb[	(uint8)	( Y1 >>	 8 ) ] <<  8 ) ^
-				 ( FSb[	(uint8)	( Y2	   ) ]		 );
-
-	PUT_UINT32(	X0,	output,	 0 );
-	PUT_UINT32(	X1,	output,	 4 );
-	PUT_UINT32(	X2,	output,	 8 );
-	PUT_UINT32(	X3,	output,	12 );
+	X0 = RK[0] ^ (FSb[(uint8) (Y0 >> 24)] << 24) ^
+	    (FSb[(uint8) (Y1 >> 16)] << 16) ^
+	    (FSb[(uint8) (Y2 >> 8)] << 8) ^ (FSb[(uint8) (Y3)]);
+
+	X1 = RK[1] ^ (FSb[(uint8) (Y1 >> 24)] << 24) ^
+	    (FSb[(uint8) (Y2 >> 16)] << 16) ^
+	    (FSb[(uint8) (Y3 >> 8)] << 8) ^ (FSb[(uint8) (Y0)]);
+
+	X2 = RK[2] ^ (FSb[(uint8) (Y2 >> 24)] << 24) ^
+	    (FSb[(uint8) (Y3 >> 16)] << 16) ^
+	    (FSb[(uint8) (Y0 >> 8)] << 8) ^ (FSb[(uint8) (Y1)]);
+
+	X3 = RK[3] ^ (FSb[(uint8) (Y3 >> 24)] << 24) ^
+	    (FSb[(uint8) (Y0 >> 16)] << 16) ^
+	    (FSb[(uint8) (Y1 >> 8)] << 8) ^ (FSb[(uint8) (Y2)]);
+
+	PUT_UINT32(X0, output, 0);
+	PUT_UINT32(X1, output, 4);
+	PUT_UINT32(X2, output, 8);
+	PUT_UINT32(X3, output, 12);
 }
 
 /* AES 128-bit block decryption	routine	*/
 
-void rt_aes_decrypt( aes_context *ctx,	uint8 input[16], uint8 output[16] )
+void rt_aes_decrypt(struct aes_context * ctx, uint8 input[16], uint8 output[16])
 {
-	uint32 *RK,	X0,	X1,	X2,	X3,	Y0,	Y1,	Y2,	Y3;
+	uint32 *RK, X0, X1, X2, X3, Y0, Y1, Y2, Y3;
 
 	RK = (uint32 *) ctx->drk;
 
-	GET_UINT32(	X0,	input,	0 ); X0	^= RK[0];
-	GET_UINT32(	X1,	input,	4 ); X1	^= RK[1];
-	GET_UINT32(	X2,	input,	8 ); X2	^= RK[2];
-	GET_UINT32(	X3,	input, 12 ); X3	^= RK[3];
+	GET_UINT32(X0, input, 0);
+	X0 ^= RK[0];
+	GET_UINT32(X1, input, 4);
+	X1 ^= RK[1];
+	GET_UINT32(X2, input, 8);
+	X2 ^= RK[2];
+	GET_UINT32(X3, input, 12);
+	X3 ^= RK[3];
 
 #define	AES_RROUND(X0,X1,X2,X3,Y0,Y1,Y2,Y3)		\
 {												\
@@ -1223,56 +1147,50 @@ void rt_aes_decrypt( aes_context *ctx,	uint8 input[16], uint8 output[16] )
 				 RT3[ (uint8) (	Y0		 ) ];	\
 }
 
-	AES_RROUND(	Y0,	Y1,	Y2,	Y3,	X0,	X1,	X2,	X3 );		/* round 1 */
-	AES_RROUND(	X0,	X1,	X2,	X3,	Y0,	Y1,	Y2,	Y3 );		/* round 2 */
-	AES_RROUND(	Y0,	Y1,	Y2,	Y3,	X0,	X1,	X2,	X3 );		/* round 3 */
-	AES_RROUND(	X0,	X1,	X2,	X3,	Y0,	Y1,	Y2,	Y3 );		/* round 4 */
-	AES_RROUND(	Y0,	Y1,	Y2,	Y3,	X0,	X1,	X2,	X3 );		/* round 5 */
-	AES_RROUND(	X0,	X1,	X2,	X3,	Y0,	Y1,	Y2,	Y3 );		/* round 6 */
-	AES_RROUND(	Y0,	Y1,	Y2,	Y3,	X0,	X1,	X2,	X3 );		/* round 7 */
-	AES_RROUND(	X0,	X1,	X2,	X3,	Y0,	Y1,	Y2,	Y3 );		/* round 8 */
-	AES_RROUND(	Y0,	Y1,	Y2,	Y3,	X0,	X1,	X2,	X3 );		/* round 9 */
-
-	if(	ctx->nr	> 10 )
-	{
-		AES_RROUND(	X0,	X1,	X2,	X3,	Y0,	Y1,	Y2,	Y3 );	/* round 10	*/
-		AES_RROUND(	Y0,	Y1,	Y2,	Y3,	X0,	X1,	X2,	X3 );	/* round 11	*/
+	AES_RROUND(Y0, Y1, Y2, Y3, X0, X1, X2, X3);	/* round 1 */
+	AES_RROUND(X0, X1, X2, X3, Y0, Y1, Y2, Y3);	/* round 2 */
+	AES_RROUND(Y0, Y1, Y2, Y3, X0, X1, X2, X3);	/* round 3 */
+	AES_RROUND(X0, X1, X2, X3, Y0, Y1, Y2, Y3);	/* round 4 */
+	AES_RROUND(Y0, Y1, Y2, Y3, X0, X1, X2, X3);	/* round 5 */
+	AES_RROUND(X0, X1, X2, X3, Y0, Y1, Y2, Y3);	/* round 6 */
+	AES_RROUND(Y0, Y1, Y2, Y3, X0, X1, X2, X3);	/* round 7 */
+	AES_RROUND(X0, X1, X2, X3, Y0, Y1, Y2, Y3);	/* round 8 */
+	AES_RROUND(Y0, Y1, Y2, Y3, X0, X1, X2, X3);	/* round 9 */
+
+	if (ctx->nr > 10) {
+		AES_RROUND(X0, X1, X2, X3, Y0, Y1, Y2, Y3);	/* round 10     */
+		AES_RROUND(Y0, Y1, Y2, Y3, X0, X1, X2, X3);	/* round 11     */
 	}
 
-	if(	ctx->nr	> 12 )
-	{
-		AES_RROUND(	X0,	X1,	X2,	X3,	Y0,	Y1,	Y2,	Y3 );	/* round 12	*/
-		AES_RROUND(	Y0,	Y1,	Y2,	Y3,	X0,	X1,	X2,	X3 );	/* round 13	*/
+	if (ctx->nr > 12) {
+		AES_RROUND(X0, X1, X2, X3, Y0, Y1, Y2, Y3);	/* round 12     */
+		AES_RROUND(Y0, Y1, Y2, Y3, X0, X1, X2, X3);	/* round 13     */
 	}
 
-	/* last	round */
+	/* last round */
 
 	RK += 4;
 
-	X0 = RK[0] ^ ( RSb[	(uint8)	( Y0 >>	24 ) ] << 24 ) ^
-				 ( RSb[	(uint8)	( Y3 >>	16 ) ] << 16 ) ^
-				 ( RSb[	(uint8)	( Y2 >>	 8 ) ] <<  8 ) ^
-				 ( RSb[	(uint8)	( Y1	   ) ]		 );
-
-	X1 = RK[1] ^ ( RSb[	(uint8)	( Y1 >>	24 ) ] << 24 ) ^
-				 ( RSb[	(uint8)	( Y0 >>	16 ) ] << 16 ) ^
-				 ( RSb[	(uint8)	( Y3 >>	 8 ) ] <<  8 ) ^
-				 ( RSb[	(uint8)	( Y2	   ) ]		 );
-
-	X2 = RK[2] ^ ( RSb[	(uint8)	( Y2 >>	24 ) ] << 24 ) ^
-				 ( RSb[	(uint8)	( Y1 >>	16 ) ] << 16 ) ^
-				 ( RSb[	(uint8)	( Y0 >>	 8 ) ] <<  8 ) ^
-				 ( RSb[	(uint8)	( Y3	   ) ]		 );
-
-	X3 = RK[3] ^ ( RSb[	(uint8)	( Y3 >>	24 ) ] << 24 ) ^
-				 ( RSb[	(uint8)	( Y2 >>	16 ) ] << 16 ) ^
-				 ( RSb[	(uint8)	( Y1 >>	 8 ) ] <<  8 ) ^
-				 ( RSb[	(uint8)	( Y0	   ) ]		 );
-
-	PUT_UINT32(	X0,	output,	 0 );
-	PUT_UINT32(	X1,	output,	 4 );
-	PUT_UINT32(	X2,	output,	 8 );
-	PUT_UINT32(	X3,	output,	12 );
+	X0 = RK[0] ^ (RSb[(uint8) (Y0 >> 24)] << 24) ^
+	    (RSb[(uint8) (Y3 >> 16)] << 16) ^
+	    (RSb[(uint8) (Y2 >> 8)] << 8) ^ (RSb[(uint8) (Y1)]);
+
+	X1 = RK[1] ^ (RSb[(uint8) (Y1 >> 24)] << 24) ^
+	    (RSb[(uint8) (Y0 >> 16)] << 16) ^
+	    (RSb[(uint8) (Y3 >> 8)] << 8) ^ (RSb[(uint8) (Y2)]);
+
+	X2 = RK[2] ^ (RSb[(uint8) (Y2 >> 24)] << 24) ^
+	    (RSb[(uint8) (Y1 >> 16)] << 16) ^
+	    (RSb[(uint8) (Y0 >> 8)] << 8) ^ (RSb[(uint8) (Y3)]);
+
+	X3 = RK[3] ^ (RSb[(uint8) (Y3 >> 24)] << 24) ^
+	    (RSb[(uint8) (Y2 >> 16)] << 16) ^
+	    (RSb[(uint8) (Y1 >> 8)] << 8) ^ (RSb[(uint8) (Y0)]);
+
+	PUT_UINT32(X0, output, 0);
+	PUT_UINT32(X1, output, 4);
+	PUT_UINT32(X2, output, 8);
+	PUT_UINT32(X3, output, 12);
 }
 
 /*
@@ -1284,57 +1202,51 @@ void rt_aes_decrypt( aes_context *ctx,	uint8 input[16], uint8 output[16] )
     Return:
     ==========================================================================
 */
-VOID AES_GTK_KEY_WRAP(
-    IN UCHAR    *key,
-    IN UCHAR    *plaintext,
-    IN UINT32    p_len,
-    OUT UCHAR   *ciphertext)
+void AES_GTK_KEY_WRAP(u8 * key,
+		      u8 * plaintext,
+		      u32 p_len, u8 * ciphertext)
 {
-    UCHAR       A[8], BIN[16], BOUT[16];
-    UCHAR       R[512];
-    INT         num_blocks = p_len/8;   // unit:64bits
-    INT         i, j;
-    aes_context aesctx;
-    UCHAR       xor;
-
-    rt_aes_set_key(&aesctx, key, 128);
-
-    // Init IA
-    for (i = 0; i < 8; i++)
-        A[i] = 0xa6;
-
-    //Input plaintext
-    for (i = 0; i < num_blocks; i++)
-    {
-        for (j = 0 ; j < 8; j++)
-            R[8 * (i + 1) + j] = plaintext[8 * i + j];
-    }
-
-    // Key Mix
-    for (j = 0; j < 6; j++)
-    {
-        for(i = 1; i <= num_blocks; i++)
-        {
-            //phase 1
-            NdisMoveMemory(BIN, A, 8);
-            NdisMoveMemory(&BIN[8], &R[8 * i], 8);
-            rt_aes_encrypt(&aesctx, BIN, BOUT);
-
-            NdisMoveMemory(A, &BOUT[0], 8);
-            xor = num_blocks * j + i;
-            A[7] = BOUT[7] ^ xor;
-            NdisMoveMemory(&R[8 * i], &BOUT[8], 8);
-        }
-    }
-
-    // Output ciphertext
-    NdisMoveMemory(ciphertext, A, 8);
-
-    for (i = 1; i <= num_blocks; i++)
-    {
-        for (j = 0 ; j < 8; j++)
-            ciphertext[8 * i + j] = R[8 * i + j];
-    }
+	u8 A[8], BIN[16], BOUT[16];
+	u8 R[512];
+	int num_blocks = p_len / 8;	/* unit:64bits */
+	int i, j;
+	struct aes_context aesctx;
+	u8 xor;
+
+	rt_aes_set_key(&aesctx, key, 128);
+
+	/* Init IA */
+	for (i = 0; i < 8; i++)
+		A[i] = 0xa6;
+
+	/*Input plaintext */
+	for (i = 0; i < num_blocks; i++) {
+		for (j = 0; j < 8; j++)
+			R[8 * (i + 1) + j] = plaintext[8 * i + j];
+	}
+
+	/* Key Mix */
+	for (j = 0; j < 6; j++) {
+		for (i = 1; i <= num_blocks; i++) {
+			/*phase 1 */
+			NdisMoveMemory(BIN, A, 8);
+			NdisMoveMemory(&BIN[8], &R[8 * i], 8);
+			rt_aes_encrypt(&aesctx, BIN, BOUT);
+
+			NdisMoveMemory(A, &BOUT[0], 8);
+			xor = num_blocks * j + i;
+			A[7] = BOUT[7] ^ xor;
+			NdisMoveMemory(&R[8 * i], &BOUT[8], 8);
+		}
+	}
+
+	/* Output ciphertext */
+	NdisMoveMemory(ciphertext, A, 8);
+
+	for (i = 1; i <= num_blocks; i++) {
+		for (j = 0; j < 8; j++)
+			ciphertext[8 * i + j] = R[8 * i + j];
+	}
 }
 
 /*
@@ -1352,209 +1264,50 @@ VOID AES_GTK_KEY_WRAP(
 
 	========================================================================
 */
-VOID	AES_GTK_KEY_UNWRAP(
-	IN	UCHAR	*key,
-	OUT	UCHAR	*plaintext,
-	IN	UINT32   c_len,
-	IN	UCHAR	*ciphertext)
-
+void AES_GTK_KEY_UNWRAP(u8 * key,
+			u8 * plaintext,
+			u32 c_len, u8 * ciphertext)
 {
-	UCHAR       A[8], BIN[16], BOUT[16];
-	UCHAR       xor;
-	INT         i, j;
-	aes_context aesctx;
-	UCHAR       *R;
-	INT         num_blocks = c_len/8;	// unit:64bits
-
-
-	os_alloc_mem(NULL, (PUCHAR *)&R, 512);
-
-	if (R == NULL)
-    {
-        DBGPRINT(RT_DEBUG_ERROR, ("!!!AES_GTK_KEY_UNWRAP: no memory!!!\n"));
-        return;
-    } /* End of if */
-
-	// Initialize
+	u8 A[8], BIN[16], BOUT[16];
+	u8 xor;
+	int i, j;
+	struct aes_context aesctx;
+	u8 *R;
+	int num_blocks = c_len / 8;	/* unit:64bits */
+
+	os_alloc_mem(NULL, (u8 **) & R, 512);
+
+	if (R == NULL) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("AES_GTK_KEY_UNWRAP: no memory!\n"));
+		return;
+	}
+	/* End of if */
+	/* Initialize */
 	NdisMoveMemory(A, ciphertext, 8);
-	//Input plaintext
-	for(i = 0; i < (c_len-8); i++)
-	{
-		R[ i] = ciphertext[i + 8];
+	/*Input plaintext */
+	for (i = 0; i < (c_len - 8); i++) {
+		R[i] = ciphertext[i + 8];
 	}
 
 	rt_aes_set_key(&aesctx, key, 128);
 
-	for(j = 5; j >= 0; j--)
-	{
-		for(i = (num_blocks-1); i > 0; i--)
-		{
-			xor = (num_blocks -1 )* j + i;
+	for (j = 5; j >= 0; j--) {
+		for (i = (num_blocks - 1); i > 0; i--) {
+			xor = (num_blocks - 1) * j + i;
 			NdisMoveMemory(BIN, A, 8);
 			BIN[7] = A[7] ^ xor;
-			NdisMoveMemory(&BIN[8], &R[(i-1)*8], 8);
+			NdisMoveMemory(&BIN[8], &R[(i - 1) * 8], 8);
 			rt_aes_decrypt(&aesctx, BIN, BOUT);
 			NdisMoveMemory(A, &BOUT[0], 8);
-			NdisMoveMemory(&R[(i-1)*8], &BOUT[8], 8);
+			NdisMoveMemory(&R[(i - 1) * 8], &BOUT[8], 8);
 		}
 	}
 
-	// OUTPUT
-	for(i = 0; i < c_len; i++)
-	{
+	/* OUTPUT */
+	for (i = 0; i < c_len; i++) {
 		plaintext[i] = R[i];
 	}
 
-
 	os_free_mem(NULL, R);
 }
-
-
-/* =======  The related function of AES-128-CMAC  ======= */
-VOID leftshift_onebit(
-	IN  PUCHAR	input,
-	OUT PUCHAR	output)
-{
-	INT i;
-	UCHAR overflow = 0;
-
-	for (i=15; i>=0; i--)
-	{
-		output[i] = input[i] << 1;
-		output[i] |= overflow;
-		overflow = (input[i] & 0x80) ? 1 : 0;
-	}
-}
-
-VOID do_padding(
-	IN	PUCHAR	lastb,
-	OUT	PUCHAR	pad,
-	IN  INT		len)
-{
-	INT	j;
-
-	for (j=0; j<16; j++)
-	{
-		if (j < len)
-			pad[j] = lastb[j];
-		else if (j == len)
-			pad[j] = 0x80;
-		else
-			pad[j] = 0x00;
-	}
-
-
-}
-
-/*
- *	The Subkey Generation Algorithm
- */
-VOID generate_subkey(
-	IN	PUCHAR key,
-	OUT	PUCHAR K1,
-	OUT PUCHAR K2)
-{
-	aes_context aesctx;
-	UCHAR aes_128_key[16];
-	UCHAR const_Zero[16];
-	UCHAR tmp[16];
-	UCHAR const_Rb[16] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-					      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x87};
-
-	// initial the key material
-	memset(const_Zero, 0, 16);
-	memset(aes_128_key, 0, 16);
-
-	// AES-128 with key is applied to an all-zero input block
-	rt_aes_set_key(&aesctx, key, 128);
-	rt_aes_encrypt(&aesctx, const_Zero, aes_128_key);
-
-	// derive K1(128-bit first subkey) and K2(128-bit second subkey), refer to rfc-4493 ch 2.3
-	if ((aes_128_key[0] & 0x80) == 0)
-	{
-		leftshift_onebit(aes_128_key, K1);
-	}
-	else
-	{
-		leftshift_onebit(aes_128_key, tmp);
-		xor_128(tmp, const_Rb, K1);
-	}
-
-	if ((K1[0] & 0x80) == 0)
-	{
-		leftshift_onebit(K1, K2);
-	}
-	else
-	{
-		leftshift_onebit(K1, tmp);
-		xor_128(tmp, const_Rb, K2);
-	}
-
-}
-
-/*
- *	AES-CMAC Algorithm. (refer to rfc-4493 and SP800-38B)
- *
- *	Input : key		(128-bit key)
- *			input		(message to be authenticated)
- *			len			(length of the message in octets)
- *
- *	output: mac			(message authentication code)
- */
-VOID AES_128_CMAC(
-	IN	PUCHAR	key,
-	IN	PUCHAR	input,
-	IN	INT		len,
-	OUT	PUCHAR	mac)
-{
-	UCHAR	X[16], Y[16], M_last[16], padded[16];
-	UCHAR	K1[16], K2[16];
-	aes_context aesctx;
-	INT		n, i, flag;
-
-	generate_subkey(key, K1, K2);
-
-	n = (len+15) / 16;		// n is number of rounds
-
-	if (n == 0)
-	{
-		n = 1;
-		flag = 0;
-	}
-	else
-	{
-		if ((len%16) == 0)
-			flag = 1;			// indicate that last block is a complete block
-		else
-			flag = 0;			// indicate that last block is not a complete block
-	}
-
-	if (flag)
-	{
-		xor_128(&input[16*(n-1)], K1, M_last);
-	}
-	else
-	{
-		do_padding(&input[16*(n-1)], padded, len%16);
-		xor_128(padded, K2, M_last);
-	}
-
-	memset(X, 0, 16);
-	for (i=0; i<n-1; i++)
-	{
-		xor_128(X, &input[16*i], Y);
-		rt_aes_set_key(&aesctx, key, 128);
-		rt_aes_encrypt(&aesctx, Y, X);
-	}
-
-	xor_128(X, M_last, Y);
-	rt_aes_set_key(&aesctx, key, 128);
-	rt_aes_encrypt(&aesctx, Y, X);
-
-	for (i=0; i<16; i++)
-	{
-		mac[i] = X[i];
-	}
-
-}
-/* =======  The related function of AES-128-CMAC  ======= */
diff --git a/drivers/staging/rt2860/common/cmm_asic.c b/drivers/staging/rt2860/common/cmm_asic.c
new file mode 100644
index 000000000000..4d77e83eb418
--- /dev/null
+++ b/drivers/staging/rt2860/common/cmm_asic.c
@@ -0,0 +1,2565 @@
+/*
+ *************************************************************************
+ * Ralink Tech Inc.
+ * 5F., No.36, Taiyuan St., Jhubei City,
+ * Hsinchu County 302,
+ * Taiwan, R.O.C.
+ *
+ * (c) Copyright 2002-2007, Ralink Technology, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify  *
+ * it under the terms of the GNU General Public License as published by  *
+ * the Free Software Foundation; either version 2 of the License, or     *
+ * (at your option) any later version.                                   *
+ *                                                                       *
+ * This program is distributed in the hope that it will be useful,       *
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
+ * GNU General Public License for more details.                          *
+ *                                                                       *
+ * You should have received a copy of the GNU General Public License     *
+ * along with this program; if not, write to the                         *
+ * Free Software Foundation, Inc.,                                       *
+ * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
+ *                                                                       *
+ *************************************************************************
+
+	Module Name:
+	cmm_asic.c
+
+	Abstract:
+	Functions used to communicate with ASIC
+
+	Revision History:
+	Who			When			What
+	--------	----------		----------------------------------------------
+*/
+
+#include "../rt_config.h"
+
+/* Reset the RFIC setting to new series */
+struct rt_rtmp_rf_regs RF2850RegTable[] = {
+/*              ch       R1              R2              R3(TX0~4=0) R4 */
+	{1, 0x98402ecc, 0x984c0786, 0x9816b455, 0x9800510b}
+	,
+	{2, 0x98402ecc, 0x984c0786, 0x98168a55, 0x9800519f}
+	,
+	{3, 0x98402ecc, 0x984c078a, 0x98168a55, 0x9800518b}
+	,
+	{4, 0x98402ecc, 0x984c078a, 0x98168a55, 0x9800519f}
+	,
+	{5, 0x98402ecc, 0x984c078e, 0x98168a55, 0x9800518b}
+	,
+	{6, 0x98402ecc, 0x984c078e, 0x98168a55, 0x9800519f}
+	,
+	{7, 0x98402ecc, 0x984c0792, 0x98168a55, 0x9800518b}
+	,
+	{8, 0x98402ecc, 0x984c0792, 0x98168a55, 0x9800519f}
+	,
+	{9, 0x98402ecc, 0x984c0796, 0x98168a55, 0x9800518b}
+	,
+	{10, 0x98402ecc, 0x984c0796, 0x98168a55, 0x9800519f}
+	,
+	{11, 0x98402ecc, 0x984c079a, 0x98168a55, 0x9800518b}
+	,
+	{12, 0x98402ecc, 0x984c079a, 0x98168a55, 0x9800519f}
+	,
+	{13, 0x98402ecc, 0x984c079e, 0x98168a55, 0x9800518b}
+	,
+	{14, 0x98402ecc, 0x984c07a2, 0x98168a55, 0x98005193}
+	,
+
+	/* 802.11 UNI / HyperLan 2 */
+	{36, 0x98402ecc, 0x984c099a, 0x98158a55, 0x980ed1a3}
+	,
+	{38, 0x98402ecc, 0x984c099e, 0x98158a55, 0x980ed193}
+	,
+	{40, 0x98402ec8, 0x984c0682, 0x98158a55, 0x980ed183}
+	,
+	{44, 0x98402ec8, 0x984c0682, 0x98158a55, 0x980ed1a3}
+	,
+	{46, 0x98402ec8, 0x984c0686, 0x98158a55, 0x980ed18b}
+	,
+	{48, 0x98402ec8, 0x984c0686, 0x98158a55, 0x980ed19b}
+	,
+	{52, 0x98402ec8, 0x984c068a, 0x98158a55, 0x980ed193}
+	,
+	{54, 0x98402ec8, 0x984c068a, 0x98158a55, 0x980ed1a3}
+	,
+	{56, 0x98402ec8, 0x984c068e, 0x98158a55, 0x980ed18b}
+	,
+	{60, 0x98402ec8, 0x984c0692, 0x98158a55, 0x980ed183}
+	,
+	{62, 0x98402ec8, 0x984c0692, 0x98158a55, 0x980ed193}
+	,
+	{64, 0x98402ec8, 0x984c0692, 0x98158a55, 0x980ed1a3}
+	,			/* Plugfest#4, Day4, change RFR3 left4th 9->5. */
+
+	/* 802.11 HyperLan 2 */
+	{100, 0x98402ec8, 0x984c06b2, 0x98178a55, 0x980ed783}
+	,
+
+	/* 2008.04.30 modified */
+	/* The system team has AN to improve the EVM value */
+	/* for channel 102 to 108 for the RT2850/RT2750 dual band solution. */
+	{102, 0x98402ec8, 0x985c06b2, 0x98578a55, 0x980ed793}
+	,
+	{104, 0x98402ec8, 0x985c06b2, 0x98578a55, 0x980ed1a3}
+	,
+	{108, 0x98402ecc, 0x985c0a32, 0x98578a55, 0x980ed193}
+	,
+
+	{110, 0x98402ecc, 0x984c0a36, 0x98178a55, 0x980ed183}
+	,
+	{112, 0x98402ecc, 0x984c0a36, 0x98178a55, 0x980ed19b}
+	,
+	{116, 0x98402ecc, 0x984c0a3a, 0x98178a55, 0x980ed1a3}
+	,
+	{118, 0x98402ecc, 0x984c0a3e, 0x98178a55, 0x980ed193}
+	,
+	{120, 0x98402ec4, 0x984c0382, 0x98178a55, 0x980ed183}
+	,
+	{124, 0x98402ec4, 0x984c0382, 0x98178a55, 0x980ed193}
+	,
+	{126, 0x98402ec4, 0x984c0382, 0x98178a55, 0x980ed15b}
+	,			/* 0x980ed1bb->0x980ed15b required by Rory 20070927 */
+	{128, 0x98402ec4, 0x984c0382, 0x98178a55, 0x980ed1a3}
+	,
+	{132, 0x98402ec4, 0x984c0386, 0x98178a55, 0x980ed18b}
+	,
+	{134, 0x98402ec4, 0x984c0386, 0x98178a55, 0x980ed193}
+	,
+	{136, 0x98402ec4, 0x984c0386, 0x98178a55, 0x980ed19b}
+	,
+	{140, 0x98402ec4, 0x984c038a, 0x98178a55, 0x980ed183}
+	,
+
+	/* 802.11 UNII */
+	{149, 0x98402ec4, 0x984c038a, 0x98178a55, 0x980ed1a7}
+	,
+	{151, 0x98402ec4, 0x984c038e, 0x98178a55, 0x980ed187}
+	,
+	{153, 0x98402ec4, 0x984c038e, 0x98178a55, 0x980ed18f}
+	,
+	{157, 0x98402ec4, 0x984c038e, 0x98178a55, 0x980ed19f}
+	,
+	{159, 0x98402ec4, 0x984c038e, 0x98178a55, 0x980ed1a7}
+	,
+	{161, 0x98402ec4, 0x984c0392, 0x98178a55, 0x980ed187}
+	,
+	{165, 0x98402ec4, 0x984c0392, 0x98178a55, 0x980ed197}
+	,
+	{167, 0x98402ec4, 0x984c03d2, 0x98179855, 0x9815531f}
+	,
+	{169, 0x98402ec4, 0x984c03d2, 0x98179855, 0x98155327}
+	,
+	{171, 0x98402ec4, 0x984c03d6, 0x98179855, 0x98155307}
+	,
+	{173, 0x98402ec4, 0x984c03d6, 0x98179855, 0x9815530f}
+	,
+
+	/* Japan */
+	{184, 0x95002ccc, 0x9500491e, 0x9509be55, 0x950c0a0b}
+	,
+	{188, 0x95002ccc, 0x95004922, 0x9509be55, 0x950c0a13}
+	,
+	{192, 0x95002ccc, 0x95004926, 0x9509be55, 0x950c0a1b}
+	,
+	{196, 0x95002ccc, 0x9500492a, 0x9509be55, 0x950c0a23}
+	,
+	{208, 0x95002ccc, 0x9500493a, 0x9509be55, 0x950c0a13}
+	,
+	{212, 0x95002ccc, 0x9500493e, 0x9509be55, 0x950c0a1b}
+	,
+	{216, 0x95002ccc, 0x95004982, 0x9509be55, 0x950c0a23}
+	,
+
+	/* still lack of MMAC(Japan) ch 34,38,42,46 */
+};
+
+u8 NUM_OF_2850_CHNL = (sizeof(RF2850RegTable) / sizeof(struct rt_rtmp_rf_regs));
+
+struct rt_frequency_item FreqItems3020[] = {
+	/**************************************************/
+	/* ISM : 2.4 to 2.483 GHz                         // */
+	/**************************************************/
+	/* 11g */
+	/**************************************************/
+	/*-CH---N-------R---K----------- */
+	{1, 241, 2, 2}
+	,
+	{2, 241, 2, 7}
+	,
+	{3, 242, 2, 2}
+	,
+	{4, 242, 2, 7}
+	,
+	{5, 243, 2, 2}
+	,
+	{6, 243, 2, 7}
+	,
+	{7, 244, 2, 2}
+	,
+	{8, 244, 2, 7}
+	,
+	{9, 245, 2, 2}
+	,
+	{10, 245, 2, 7}
+	,
+	{11, 246, 2, 2}
+	,
+	{12, 246, 2, 7}
+	,
+	{13, 247, 2, 2}
+	,
+	{14, 248, 2, 4}
+	,
+};
+
+u8 NUM_OF_3020_CHNL = (sizeof(FreqItems3020) / sizeof(struct rt_frequency_item));
+
+void AsicUpdateAutoFallBackTable(struct rt_rtmp_adapter *pAd, u8 *pRateTable)
+{
+	u8 i;
+	HT_FBK_CFG0_STRUC HtCfg0;
+	HT_FBK_CFG1_STRUC HtCfg1;
+	LG_FBK_CFG0_STRUC LgCfg0;
+	LG_FBK_CFG1_STRUC LgCfg1;
+	struct rt_rtmp_tx_rate_switch *pCurrTxRate, *pNextTxRate;
+
+	/* set to initial value */
+	HtCfg0.word = 0x65432100;
+	HtCfg1.word = 0xedcba988;
+	LgCfg0.word = 0xedcba988;
+	LgCfg1.word = 0x00002100;
+
+	pNextTxRate = (struct rt_rtmp_tx_rate_switch *) pRateTable + 1;
+	for (i = 1; i < *((u8 *)pRateTable); i++) {
+		pCurrTxRate = (struct rt_rtmp_tx_rate_switch *) pRateTable + 1 + i;
+		switch (pCurrTxRate->Mode) {
+		case 0:	/*CCK */
+			break;
+		case 1:	/*OFDM */
+			{
+				switch (pCurrTxRate->CurrMCS) {
+				case 0:
+					LgCfg0.field.OFDMMCS0FBK =
+					    (pNextTxRate->Mode ==
+					     MODE_OFDM) ? (pNextTxRate->
+							   CurrMCS +
+							   8) : pNextTxRate->
+					    CurrMCS;
+					break;
+				case 1:
+					LgCfg0.field.OFDMMCS1FBK =
+					    (pNextTxRate->Mode ==
+					     MODE_OFDM) ? (pNextTxRate->
+							   CurrMCS +
+							   8) : pNextTxRate->
+					    CurrMCS;
+					break;
+				case 2:
+					LgCfg0.field.OFDMMCS2FBK =
+					    (pNextTxRate->Mode ==
+					     MODE_OFDM) ? (pNextTxRate->
+							   CurrMCS +
+							   8) : pNextTxRate->
+					    CurrMCS;
+					break;
+				case 3:
+					LgCfg0.field.OFDMMCS3FBK =
+					    (pNextTxRate->Mode ==
+					     MODE_OFDM) ? (pNextTxRate->
+							   CurrMCS +
+							   8) : pNextTxRate->
+					    CurrMCS;
+					break;
+				case 4:
+					LgCfg0.field.OFDMMCS4FBK =
+					    (pNextTxRate->Mode ==
+					     MODE_OFDM) ? (pNextTxRate->
+							   CurrMCS +
+							   8) : pNextTxRate->
+					    CurrMCS;
+					break;
+				case 5:
+					LgCfg0.field.OFDMMCS5FBK =
+					    (pNextTxRate->Mode ==
+					     MODE_OFDM) ? (pNextTxRate->
+							   CurrMCS +
+							   8) : pNextTxRate->
+					    CurrMCS;
+					break;
+				case 6:
+					LgCfg0.field.OFDMMCS6FBK =
+					    (pNextTxRate->Mode ==
+					     MODE_OFDM) ? (pNextTxRate->
+							   CurrMCS +
+							   8) : pNextTxRate->
+					    CurrMCS;
+					break;
+				case 7:
+					LgCfg0.field.OFDMMCS7FBK =
+					    (pNextTxRate->Mode ==
+					     MODE_OFDM) ? (pNextTxRate->
+							   CurrMCS +
+							   8) : pNextTxRate->
+					    CurrMCS;
+					break;
+				}
+			}
+			break;
+		case 2:	/*HT-MIX */
+		case 3:	/*HT-GF */
+			{
+				if ((pNextTxRate->Mode >= MODE_HTMIX)
+				    && (pCurrTxRate->CurrMCS !=
+					pNextTxRate->CurrMCS)) {
+					switch (pCurrTxRate->CurrMCS) {
+					case 0:
+						HtCfg0.field.HTMCS0FBK =
+						    pNextTxRate->CurrMCS;
+						break;
+					case 1:
+						HtCfg0.field.HTMCS1FBK =
+						    pNextTxRate->CurrMCS;
+						break;
+					case 2:
+						HtCfg0.field.HTMCS2FBK =
+						    pNextTxRate->CurrMCS;
+						break;
+					case 3:
+						HtCfg0.field.HTMCS3FBK =
+						    pNextTxRate->CurrMCS;
+						break;
+					case 4:
+						HtCfg0.field.HTMCS4FBK =
+						    pNextTxRate->CurrMCS;
+						break;
+					case 5:
+						HtCfg0.field.HTMCS5FBK =
+						    pNextTxRate->CurrMCS;
+						break;
+					case 6:
+						HtCfg0.field.HTMCS6FBK =
+						    pNextTxRate->CurrMCS;
+						break;
+					case 7:
+						HtCfg0.field.HTMCS7FBK =
+						    pNextTxRate->CurrMCS;
+						break;
+					case 8:
+						HtCfg1.field.HTMCS8FBK =
+						    pNextTxRate->CurrMCS;
+						break;
+					case 9:
+						HtCfg1.field.HTMCS9FBK =
+						    pNextTxRate->CurrMCS;
+						break;
+					case 10:
+						HtCfg1.field.HTMCS10FBK =
+						    pNextTxRate->CurrMCS;
+						break;
+					case 11:
+						HtCfg1.field.HTMCS11FBK =
+						    pNextTxRate->CurrMCS;
+						break;
+					case 12:
+						HtCfg1.field.HTMCS12FBK =
+						    pNextTxRate->CurrMCS;
+						break;
+					case 13:
+						HtCfg1.field.HTMCS13FBK =
+						    pNextTxRate->CurrMCS;
+						break;
+					case 14:
+						HtCfg1.field.HTMCS14FBK =
+						    pNextTxRate->CurrMCS;
+						break;
+					case 15:
+						HtCfg1.field.HTMCS15FBK =
+						    pNextTxRate->CurrMCS;
+						break;
+					default:
+						DBGPRINT(RT_DEBUG_ERROR,
+							 ("AsicUpdateAutoFallBackTable: not support CurrMCS=%d\n",
+							  pCurrTxRate->
+							  CurrMCS));
+					}
+				}
+			}
+			break;
+		}
+
+		pNextTxRate = pCurrTxRate;
+	}
+
+	RTMP_IO_WRITE32(pAd, HT_FBK_CFG0, HtCfg0.word);
+	RTMP_IO_WRITE32(pAd, HT_FBK_CFG1, HtCfg1.word);
+	RTMP_IO_WRITE32(pAd, LG_FBK_CFG0, LgCfg0.word);
+	RTMP_IO_WRITE32(pAd, LG_FBK_CFG1, LgCfg1.word);
+}
+
+/*
+	========================================================================
+
+	Routine Description:
+		Set MAC register value according operation mode.
+		OperationMode AND bNonGFExist are for MM and GF Proteciton.
+		If MM or GF mask is not set, those passing argument doesn't not take effect.
+
+		Operation mode meaning:
+		= 0 : Pure HT, no preotection.
+		= 0x01; there may be non-HT devices in both the control and extension channel, protection is optional in BSS.
+		= 0x10: No Transmission in 40M is protected.
+		= 0x11: Transmission in both 40M and 20M shall be protected
+		if (bNonGFExist)
+			we should choose not to use GF. But still set correct ASIC registers.
+	========================================================================
+*/
+void AsicUpdateProtect(struct rt_rtmp_adapter *pAd,
+		       u16 OperationMode,
+		       u8 SetMask,
+		       IN BOOLEAN bDisableBGProtect, IN BOOLEAN bNonGFExist)
+{
+	PROT_CFG_STRUC ProtCfg, ProtCfg4;
+	u32 Protect[6];
+	u16 offset;
+	u8 i;
+	u32 MacReg = 0;
+
+	if (!(pAd->CommonCfg.bHTProtect) && (OperationMode != 8)) {
+		return;
+	}
+
+	if (pAd->BATable.numDoneOriginator) {
+		/* */
+		/* enable the RTS/CTS to avoid channel collision */
+		/* */
+		SetMask = ALLN_SETPROTECT;
+		OperationMode = 8;
+	}
+	/* Config ASIC RTS threshold register */
+	RTMP_IO_READ32(pAd, TX_RTS_CFG, &MacReg);
+	MacReg &= 0xFF0000FF;
+	/* If the user want disable RtsThreshold and enable Amsdu/Ralink-Aggregation, set the RtsThreshold as 4096 */
+	if (((pAd->CommonCfg.BACapability.field.AmsduEnable) ||
+	     (pAd->CommonCfg.bAggregationCapable == TRUE))
+	    && pAd->CommonCfg.RtsThreshold == MAX_RTS_THRESHOLD) {
+		MacReg |= (0x1000 << 8);
+	} else {
+		MacReg |= (pAd->CommonCfg.RtsThreshold << 8);
+	}
+
+	RTMP_IO_WRITE32(pAd, TX_RTS_CFG, MacReg);
+
+	/* Initial common protection settings */
+	RTMPZeroMemory(Protect, sizeof(Protect));
+	ProtCfg4.word = 0;
+	ProtCfg.word = 0;
+	ProtCfg.field.TxopAllowGF40 = 1;
+	ProtCfg.field.TxopAllowGF20 = 1;
+	ProtCfg.field.TxopAllowMM40 = 1;
+	ProtCfg.field.TxopAllowMM20 = 1;
+	ProtCfg.field.TxopAllowOfdm = 1;
+	ProtCfg.field.TxopAllowCck = 1;
+	ProtCfg.field.RTSThEn = 1;
+	ProtCfg.field.ProtectNav = ASIC_SHORTNAV;
+
+	/* update PHY mode and rate */
+	if (pAd->CommonCfg.Channel > 14)
+		ProtCfg.field.ProtectRate = 0x4000;
+	ProtCfg.field.ProtectRate |= pAd->CommonCfg.RtsRate;
+
+	/* Handle legacy(B/G) protection */
+	if (bDisableBGProtect) {
+		/*ProtCfg.field.ProtectRate = pAd->CommonCfg.RtsRate; */
+		ProtCfg.field.ProtectCtrl = 0;
+		Protect[0] = ProtCfg.word;
+		Protect[1] = ProtCfg.word;
+		pAd->FlgCtsEnabled = 0;	/* CTS-self is not used */
+	} else {
+		/*ProtCfg.field.ProtectRate = pAd->CommonCfg.RtsRate; */
+		ProtCfg.field.ProtectCtrl = 0;	/* CCK do not need to be protected */
+		Protect[0] = ProtCfg.word;
+		ProtCfg.field.ProtectCtrl = ASIC_CTS;	/* OFDM needs using CCK to protect */
+		Protect[1] = ProtCfg.word;
+		pAd->FlgCtsEnabled = 1;	/* CTS-self is used */
+	}
+
+	/* Decide HT frame protection. */
+	if ((SetMask & ALLN_SETPROTECT) != 0) {
+		switch (OperationMode) {
+		case 0x0:
+			/* NO PROTECT */
+			/* 1.All STAs in the BSS are 20/40 MHz HT */
+			/* 2. in ai 20/40MHz BSS */
+			/* 3. all STAs are 20MHz in a 20MHz BSS */
+			/* Pure HT. no protection. */
+
+			/* MM20_PROT_CFG */
+			/*      Reserved (31:27) */
+			/*      PROT_TXOP(25:20) -- 010111 */
+			/*      PROT_NAV(19:18)  -- 01 (Short NAV protection) */
+			/*  PROT_CTRL(17:16) -- 00 (None) */
+			/*      PROT_RATE(15:0)  -- 0x4004 (OFDM 24M) */
+			Protect[2] = 0x01744004;
+
+			/* MM40_PROT_CFG */
+			/*      Reserved (31:27) */
+			/*      PROT_TXOP(25:20) -- 111111 */
+			/*      PROT_NAV(19:18)  -- 01 (Short NAV protection) */
+			/*  PROT_CTRL(17:16) -- 00 (None) */
+			/*      PROT_RATE(15:0)  -- 0x4084 (duplicate OFDM 24M) */
+			Protect[3] = 0x03f44084;
+
+			/* CF20_PROT_CFG */
+			/*      Reserved (31:27) */
+			/*      PROT_TXOP(25:20) -- 010111 */
+			/*      PROT_NAV(19:18)  -- 01 (Short NAV protection) */
+			/*  PROT_CTRL(17:16) -- 00 (None) */
+			/*      PROT_RATE(15:0)  -- 0x4004 (OFDM 24M) */
+			Protect[4] = 0x01744004;
+
+			/* CF40_PROT_CFG */
+			/*      Reserved (31:27) */
+			/*      PROT_TXOP(25:20) -- 111111 */
+			/*      PROT_NAV(19:18)  -- 01 (Short NAV protection) */
+			/*  PROT_CTRL(17:16) -- 00 (None) */
+			/*      PROT_RATE(15:0)  -- 0x4084 (duplicate OFDM 24M) */
+			Protect[5] = 0x03f44084;
+
+			if (bNonGFExist) {
+				/* PROT_NAV(19:18)  -- 01 (Short NAV protectiion) */
+				/* PROT_CTRL(17:16) -- 01 (RTS/CTS) */
+				Protect[4] = 0x01754004;
+				Protect[5] = 0x03f54084;
+			}
+			pAd->CommonCfg.IOTestParm.bRTSLongProtOn = FALSE;
+			break;
+
+		case 1:
+			/* This is "HT non-member protection mode." */
+			/* If there may be non-HT STAs my BSS */
+			ProtCfg.word = 0x01744004;	/* PROT_CTRL(17:16) : 0 (None) */
+			ProtCfg4.word = 0x03f44084;	/* duplicaet legacy 24M. BW set 1. */
+			if (OPSTATUS_TEST_FLAG
+			    (pAd, fOP_STATUS_BG_PROTECTION_INUSED)) {
+				ProtCfg.word = 0x01740003;	/*ERP use Protection bit is set, use protection rate at Clause 18.. */
+				ProtCfg4.word = 0x03f40003;	/* Don't duplicate RTS/CTS in CCK mode. 0x03f40083; */
+			}
+			/*Assign Protection method for 20&40 MHz packets */
+			ProtCfg.field.ProtectCtrl = ASIC_RTS;
+			ProtCfg.field.ProtectNav = ASIC_SHORTNAV;
+			ProtCfg4.field.ProtectCtrl = ASIC_RTS;
+			ProtCfg4.field.ProtectNav = ASIC_SHORTNAV;
+			Protect[2] = ProtCfg.word;
+			Protect[3] = ProtCfg4.word;
+			Protect[4] = ProtCfg.word;
+			Protect[5] = ProtCfg4.word;
+			pAd->CommonCfg.IOTestParm.bRTSLongProtOn = TRUE;
+			break;
+
+		case 2:
+			/* If only HT STAs are in BSS. at least one is 20MHz. Only protect 40MHz packets */
+			ProtCfg.word = 0x01744004;	/* PROT_CTRL(17:16) : 0 (None) */
+			ProtCfg4.word = 0x03f44084;	/* duplicaet legacy 24M. BW set 1. */
+
+			/*Assign Protection method for 40MHz packets */
+			ProtCfg4.field.ProtectCtrl = ASIC_RTS;
+			ProtCfg4.field.ProtectNav = ASIC_SHORTNAV;
+			Protect[2] = ProtCfg.word;
+			Protect[3] = ProtCfg4.word;
+			if (bNonGFExist) {
+				ProtCfg.field.ProtectCtrl = ASIC_RTS;
+				ProtCfg.field.ProtectNav = ASIC_SHORTNAV;
+			}
+			Protect[4] = ProtCfg.word;
+			Protect[5] = ProtCfg4.word;
+
+			pAd->CommonCfg.IOTestParm.bRTSLongProtOn = FALSE;
+			break;
+
+		case 3:
+			/* HT mixed mode.        PROTECT ALL! */
+			/* Assign Rate */
+			ProtCfg.word = 0x01744004;	/*duplicaet legacy 24M. BW set 1. */
+			ProtCfg4.word = 0x03f44084;
+			/* both 20MHz and 40MHz are protected. Whether use RTS or CTS-to-self depends on the */
+			if (OPSTATUS_TEST_FLAG
+			    (pAd, fOP_STATUS_BG_PROTECTION_INUSED)) {
+				ProtCfg.word = 0x01740003;	/*ERP use Protection bit is set, use protection rate at Clause 18.. */
+				ProtCfg4.word = 0x03f40003;	/* Don't duplicate RTS/CTS in CCK mode. 0x03f40083 */
+			}
+			/*Assign Protection method for 20&40 MHz packets */
+			ProtCfg.field.ProtectCtrl = ASIC_RTS;
+			ProtCfg.field.ProtectNav = ASIC_SHORTNAV;
+			ProtCfg4.field.ProtectCtrl = ASIC_RTS;
+			ProtCfg4.field.ProtectNav = ASIC_SHORTNAV;
+			Protect[2] = ProtCfg.word;
+			Protect[3] = ProtCfg4.word;
+			Protect[4] = ProtCfg.word;
+			Protect[5] = ProtCfg4.word;
+			pAd->CommonCfg.IOTestParm.bRTSLongProtOn = TRUE;
+			break;
+
+		case 8:
+			/* Special on for Atheros problem n chip. */
+			Protect[2] = 0x01754004;
+			Protect[3] = 0x03f54084;
+			Protect[4] = 0x01754004;
+			Protect[5] = 0x03f54084;
+			pAd->CommonCfg.IOTestParm.bRTSLongProtOn = TRUE;
+			break;
+		}
+	}
+
+	offset = CCK_PROT_CFG;
+	for (i = 0; i < 6; i++) {
+		if ((SetMask & (1 << i))) {
+			RTMP_IO_WRITE32(pAd, offset + i * 4, Protect[i]);
+		}
+	}
+}
+
+/*
+	==========================================================================
+	Description:
+
+	IRQL = PASSIVE_LEVEL
+	IRQL = DISPATCH_LEVEL
+
+	==========================================================================
+ */
+void AsicSwitchChannel(struct rt_rtmp_adapter *pAd, u8 Channel, IN BOOLEAN bScan)
+{
+	unsigned long R2 = 0, R3 = DEFAULT_RF_TX_POWER, R4 = 0;
+	char TxPwer = 0, TxPwer2 = DEFAULT_RF_TX_POWER;	/*Bbp94 = BBPR94_DEFAULT, TxPwer2 = DEFAULT_RF_TX_POWER; */
+	u8 index;
+	u32 Value = 0;	/*BbpReg, Value; */
+	struct rt_rtmp_rf_regs *RFRegTable;
+	u8 RFValue;
+
+	RFValue = 0;
+	/* Search Tx power value */
+	/* We can't use ChannelList to search channel, since some central channl's txpowr doesn't list */
+	/* in ChannelList, so use TxPower array instead. */
+	/* */
+	for (index = 0; index < MAX_NUM_OF_CHANNELS; index++) {
+		if (Channel == pAd->TxPower[index].Channel) {
+			TxPwer = pAd->TxPower[index].Power;
+			TxPwer2 = pAd->TxPower[index].Power2;
+			break;
+		}
+	}
+
+	if (index == MAX_NUM_OF_CHANNELS) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("AsicSwitchChannel: Can't find the Channel#%d \n",
+			  Channel));
+	}
+#ifdef RT30xx
+	/* The RF programming sequence is difference between 3xxx and 2xxx */
+	if ((IS_RT3070(pAd) || IS_RT3090(pAd) || IS_RT3390(pAd))
+	    && ((pAd->RfIcType == RFIC_3020) || (pAd->RfIcType == RFIC_2020)
+		|| (pAd->RfIcType == RFIC_3021)
+		|| (pAd->RfIcType == RFIC_3022))) {
+		/* modify by WY for Read RF Reg. error */
+
+		for (index = 0; index < NUM_OF_3020_CHNL; index++) {
+			if (Channel == FreqItems3020[index].Channel) {
+				/* Programming channel parameters */
+				RT30xxWriteRFRegister(pAd, RF_R02,
+						      FreqItems3020[index].N);
+				RT30xxWriteRFRegister(pAd, RF_R03,
+						      FreqItems3020[index].K);
+				RT30xxReadRFRegister(pAd, RF_R06, &RFValue);
+				RFValue =
+				    (RFValue & 0xFC) | FreqItems3020[index].R;
+				RT30xxWriteRFRegister(pAd, RF_R06, RFValue);
+
+				/* Set Tx0 Power */
+				RT30xxReadRFRegister(pAd, RF_R12, &RFValue);
+				RFValue = (RFValue & 0xE0) | TxPwer;
+				RT30xxWriteRFRegister(pAd, RF_R12, RFValue);
+
+				/* Set Tx1 Power */
+				RT30xxReadRFRegister(pAd, RF_R13, &RFValue);
+				RFValue = (RFValue & 0xE0) | TxPwer2;
+				RT30xxWriteRFRegister(pAd, RF_R13, RFValue);
+
+				/* Tx/Rx Stream setting */
+				RT30xxReadRFRegister(pAd, RF_R01, &RFValue);
+				/*if (IS_RT3090(pAd)) */
+				/*      RFValue |= 0x01; // Enable RF block. */
+				RFValue &= 0x03;	/*clear bit[7~2] */
+				if (pAd->Antenna.field.TxPath == 1)
+					RFValue |= 0xA0;
+				else if (pAd->Antenna.field.TxPath == 2)
+					RFValue |= 0x80;
+				if (pAd->Antenna.field.RxPath == 1)
+					RFValue |= 0x50;
+				else if (pAd->Antenna.field.RxPath == 2)
+					RFValue |= 0x40;
+				RT30xxWriteRFRegister(pAd, RF_R01, RFValue);
+
+				/* Set RF offset */
+				RT30xxReadRFRegister(pAd, RF_R23, &RFValue);
+				RFValue = (RFValue & 0x80) | pAd->RfFreqOffset;
+				RT30xxWriteRFRegister(pAd, RF_R23, RFValue);
+
+				/* Set BW */
+				if (!bScan
+				    && (pAd->CommonCfg.BBPCurrentBW == BW_40)) {
+					RFValue = pAd->Mlme.CaliBW40RfR24;
+					/*DISABLE_11N_CHECK(pAd); */
+				} else {
+					RFValue = pAd->Mlme.CaliBW20RfR24;
+				}
+				RT30xxWriteRFRegister(pAd, RF_R24, RFValue);
+				RT30xxWriteRFRegister(pAd, RF_R31, RFValue);
+
+				/* Enable RF tuning */
+				RT30xxReadRFRegister(pAd, RF_R07, &RFValue);
+				RFValue = RFValue | 0x1;
+				RT30xxWriteRFRegister(pAd, RF_R07, RFValue);
+
+				/* latch channel for future usage. */
+				pAd->LatchRfRegs.Channel = Channel;
+
+				DBGPRINT(RT_DEBUG_TRACE,
+					 ("SwitchChannel#%d(RF=%d, Pwr0=%d, Pwr1=%d, %dT), N=0x%02X, K=0x%02X, R=0x%02X\n",
+					  Channel, pAd->RfIcType, TxPwer,
+					  TxPwer2, pAd->Antenna.field.TxPath,
+					  FreqItems3020[index].N,
+					  FreqItems3020[index].K,
+					  FreqItems3020[index].R));
+
+				break;
+			}
+		}
+	} else
+#endif /* RT30xx // */
+	{
+		RFRegTable = RF2850RegTable;
+		switch (pAd->RfIcType) {
+		case RFIC_2820:
+		case RFIC_2850:
+		case RFIC_2720:
+		case RFIC_2750:
+
+			for (index = 0; index < NUM_OF_2850_CHNL; index++) {
+				if (Channel == RFRegTable[index].Channel) {
+					R2 = RFRegTable[index].R2;
+					if (pAd->Antenna.field.TxPath == 1) {
+						R2 |= 0x4000;	/* If TXpath is 1, bit 14 = 1; */
+					}
+
+					if (pAd->Antenna.field.RxPath == 2) {
+						R2 |= 0x40;	/* write 1 to off Rxpath. */
+					} else if (pAd->Antenna.field.RxPath ==
+						   1) {
+						R2 |= 0x20040;	/* write 1 to off RxPath */
+					}
+
+					if (Channel > 14) {
+						/* initialize R3, R4 */
+						R3 = (RFRegTable[index].
+						      R3 & 0xffffc1ff);
+						R4 = (RFRegTable[index].
+						      R4 & (~0x001f87c0)) |
+						    (pAd->RfFreqOffset << 15);
+
+						/* 5G band power range: 0xF9~0X0F, TX0 Reg3 bit9/TX1 Reg4 bit6="0" means the TX power reduce 7dB */
+						/* R3 */
+						if ((TxPwer >= -7)
+						    && (TxPwer < 0)) {
+							TxPwer = (7 + TxPwer);
+							TxPwer =
+							    (TxPwer >
+							     0xF) ? (0xF)
+							    : (TxPwer);
+							R3 |= (TxPwer << 10);
+							DBGPRINT(RT_DEBUG_ERROR,
+								 ("AsicSwitchChannel: TxPwer=%d \n",
+								  TxPwer));
+						} else {
+							TxPwer =
+							    (TxPwer >
+							     0xF) ? (0xF)
+							    : (TxPwer);
+							R3 |=
+							    (TxPwer << 10) | (1
+									      <<
+									      9);
+						}
+
+						/* R4 */
+						if ((TxPwer2 >= -7)
+						    && (TxPwer2 < 0)) {
+							TxPwer2 = (7 + TxPwer2);
+							TxPwer2 =
+							    (TxPwer2 >
+							     0xF) ? (0xF)
+							    : (TxPwer2);
+							R4 |= (TxPwer2 << 7);
+							DBGPRINT(RT_DEBUG_ERROR,
+								 ("AsicSwitchChannel: TxPwer2=%d \n",
+								  TxPwer2));
+						} else {
+							TxPwer2 =
+							    (TxPwer2 >
+							     0xF) ? (0xF)
+							    : (TxPwer2);
+							R4 |=
+							    (TxPwer2 << 7) | (1
+									      <<
+									      6);
+						}
+					} else {
+						R3 = (RFRegTable[index].R3 & 0xffffc1ff) | (TxPwer << 9);	/* set TX power0 */
+						R4 = (RFRegTable[index].R4 & (~0x001f87c0)) | (pAd->RfFreqOffset << 15) | (TxPwer2 << 6);	/* Set freq Offset & TxPwr1 */
+					}
+
+					/* Based on BBP current mode before changing RF channel. */
+					if (!bScan
+					    && (pAd->CommonCfg.BBPCurrentBW ==
+						BW_40)) {
+						R4 |= 0x200000;
+					}
+					/* Update variables */
+					pAd->LatchRfRegs.Channel = Channel;
+					pAd->LatchRfRegs.R1 =
+					    RFRegTable[index].R1;
+					pAd->LatchRfRegs.R2 = R2;
+					pAd->LatchRfRegs.R3 = R3;
+					pAd->LatchRfRegs.R4 = R4;
+
+					/* Set RF value 1's set R3[bit2] = [0] */
+					RTMP_RF_IO_WRITE32(pAd,
+							   pAd->LatchRfRegs.R1);
+					RTMP_RF_IO_WRITE32(pAd,
+							   pAd->LatchRfRegs.R2);
+					RTMP_RF_IO_WRITE32(pAd,
+							   (pAd->LatchRfRegs.
+							    R3 & (~0x04)));
+					RTMP_RF_IO_WRITE32(pAd,
+							   pAd->LatchRfRegs.R4);
+
+					RTMPusecDelay(200);
+
+					/* Set RF value 2's set R3[bit2] = [1] */
+					RTMP_RF_IO_WRITE32(pAd,
+							   pAd->LatchRfRegs.R1);
+					RTMP_RF_IO_WRITE32(pAd,
+							   pAd->LatchRfRegs.R2);
+					RTMP_RF_IO_WRITE32(pAd,
+							   (pAd->LatchRfRegs.
+							    R3 | 0x04));
+					RTMP_RF_IO_WRITE32(pAd,
+							   pAd->LatchRfRegs.R4);
+
+					RTMPusecDelay(200);
+
+					/* Set RF value 3's set R3[bit2] = [0] */
+					RTMP_RF_IO_WRITE32(pAd,
+							   pAd->LatchRfRegs.R1);
+					RTMP_RF_IO_WRITE32(pAd,
+							   pAd->LatchRfRegs.R2);
+					RTMP_RF_IO_WRITE32(pAd,
+							   (pAd->LatchRfRegs.
+							    R3 & (~0x04)));
+					RTMP_RF_IO_WRITE32(pAd,
+							   pAd->LatchRfRegs.R4);
+
+					break;
+				}
+			}
+			break;
+
+		default:
+			break;
+		}
+
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("SwitchChannel#%d(RF=%d, Pwr0=%lu, Pwr1=%lu, %dT) to , R1=0x%08lx, R2=0x%08lx, R3=0x%08lx, R4=0x%08lx\n",
+			  Channel, pAd->RfIcType, (R3 & 0x00003e00) >> 9,
+			  (R4 & 0x000007c0) >> 6, pAd->Antenna.field.TxPath,
+			  pAd->LatchRfRegs.R1, pAd->LatchRfRegs.R2,
+			  pAd->LatchRfRegs.R3, pAd->LatchRfRegs.R4));
+	}
+
+	/* Change BBP setting during siwtch from a->g, g->a */
+	if (Channel <= 14) {
+		unsigned long TxPinCfg = 0x00050F0A;	/*Gary 2007/08/09 0x050A0A */
+
+		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R62,
+					     (0x37 - GET_LNA_GAIN(pAd)));
+		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R63,
+					     (0x37 - GET_LNA_GAIN(pAd)));
+		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R64,
+					     (0x37 - GET_LNA_GAIN(pAd)));
+		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R86, 0);	/*(0x44 - GET_LNA_GAIN(pAd)));    // According the Rory's suggestion to solve the middle range issue. */
+		/*RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R82, 0x62); */
+
+		/* Rx High power VGA offset for LNA select */
+		if (pAd->NicConfig2.field.ExternalLNAForG) {
+			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R82, 0x62);
+			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R75, 0x46);
+		} else {
+			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R82, 0x84);
+			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R75, 0x50);
+		}
+
+		/* 5G band selection PIN, bit1 and bit2 are complement */
+		RTMP_IO_READ32(pAd, TX_BAND_CFG, &Value);
+		Value &= (~0x6);
+		Value |= (0x04);
+		RTMP_IO_WRITE32(pAd, TX_BAND_CFG, Value);
+
+		/* Turn off unused PA or LNA when only 1T or 1R */
+		if (pAd->Antenna.field.TxPath == 1) {
+			TxPinCfg &= 0xFFFFFFF3;
+		}
+		if (pAd->Antenna.field.RxPath == 1) {
+			TxPinCfg &= 0xFFFFF3FF;
+		}
+
+		RTMP_IO_WRITE32(pAd, TX_PIN_CFG, TxPinCfg);
+
+#if defined(RT3090) || defined(RT3390)
+		/* PCIe PHY Transmit attenuation adjustment */
+		if (IS_RT3090A(pAd) || IS_RT3390(pAd)) {
+			TX_ATTENUATION_CTRL_STRUC TxAttenuationCtrl = {
+			.word = 0};
+
+			RTMP_IO_READ32(pAd, PCIE_PHY_TX_ATTENUATION_CTRL,
+				       &TxAttenuationCtrl.word);
+
+			if (Channel == 14)	/* Channel #14 */
+			{
+				TxAttenuationCtrl.field.PCIE_PHY_TX_ATTEN_EN = 1;	/* Enable PCIe PHY Tx attenuation */
+				TxAttenuationCtrl.field.PCIE_PHY_TX_ATTEN_VALUE = 4;	/* 9/16 full drive level */
+			} else	/* Channel #1~#13 */
+			{
+				TxAttenuationCtrl.field.PCIE_PHY_TX_ATTEN_EN = 0;	/* Disable PCIe PHY Tx attenuation */
+				TxAttenuationCtrl.field.PCIE_PHY_TX_ATTEN_VALUE = 0;	/* n/a */
+			}
+
+			RTMP_IO_WRITE32(pAd, PCIE_PHY_TX_ATTENUATION_CTRL,
+					TxAttenuationCtrl.word);
+		}
+#endif
+	} else {
+		unsigned long TxPinCfg = 0x00050F05;	/*Gary 2007/8/9 0x050505 */
+
+		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R62,
+					     (0x37 - GET_LNA_GAIN(pAd)));
+		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R63,
+					     (0x37 - GET_LNA_GAIN(pAd)));
+		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R64,
+					     (0x37 - GET_LNA_GAIN(pAd)));
+		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R86, 0);	/*(0x44 - GET_LNA_GAIN(pAd)));   // According the Rory's suggestion to solve the middle range issue. */
+		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R82, 0xF2);
+
+		/* Rx High power VGA offset for LNA select */
+		if (pAd->NicConfig2.field.ExternalLNAForA) {
+			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R75, 0x46);
+		} else {
+			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R75, 0x50);
+		}
+
+		/* 5G band selection PIN, bit1 and bit2 are complement */
+		RTMP_IO_READ32(pAd, TX_BAND_CFG, &Value);
+		Value &= (~0x6);
+		Value |= (0x02);
+		RTMP_IO_WRITE32(pAd, TX_BAND_CFG, Value);
+
+		/* Turn off unused PA or LNA when only 1T or 1R */
+		if (pAd->Antenna.field.TxPath == 1) {
+			TxPinCfg &= 0xFFFFFFF3;
+		}
+		if (pAd->Antenna.field.RxPath == 1) {
+			TxPinCfg &= 0xFFFFF3FF;
+		}
+
+		RTMP_IO_WRITE32(pAd, TX_PIN_CFG, TxPinCfg);
+
+	}
+
+	/* R66 should be set according to Channel and use 20MHz when scanning */
+	/*RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R66, (0x2E + GET_LNA_GAIN(pAd))); */
+	if (bScan)
+		RTMPSetAGCInitValue(pAd, BW_20);
+	else
+		RTMPSetAGCInitValue(pAd, pAd->CommonCfg.BBPCurrentBW);
+
+	/* */
+	/* On 11A, We should delay and wait RF/BBP to be stable */
+	/* and the appropriate time should be 1000 micro seconds */
+	/* 2005/06/05 - On 11G, We also need this delay time. Otherwise it's difficult to pass the WHQL. */
+	/* */
+	RTMPusecDelay(1000);
+}
+
+void AsicResetBBPAgent(struct rt_rtmp_adapter *pAd)
+{
+	BBP_CSR_CFG_STRUC BbpCsr;
+	DBGPRINT(RT_DEBUG_ERROR, ("Reset BBP Agent busy bit!\n"));
+	/* Still need to find why BBP agent keeps busy, but in fact, hardware still function ok. Now clear busy first. */
+	RTMP_IO_READ32(pAd, H2M_BBP_AGENT, &BbpCsr.word);
+	BbpCsr.field.Busy = 0;
+	RTMP_IO_WRITE32(pAd, H2M_BBP_AGENT, BbpCsr.word);
+}
+
+/*
+	==========================================================================
+	Description:
+		This function is required for 2421 only, and should not be used during
+		site survey. It's only required after NIC decided to stay at a channel
+		for a longer period.
+		When this function is called, it's always after AsicSwitchChannel().
+
+	IRQL = PASSIVE_LEVEL
+	IRQL = DISPATCH_LEVEL
+
+	==========================================================================
+ */
+void AsicLockChannel(struct rt_rtmp_adapter *pAd, u8 Channel)
+{
+}
+
+void AsicRfTuningExec(void *SystemSpecific1,
+		      void *FunctionContext,
+		      void *SystemSpecific2, void *SystemSpecific3)
+{
+}
+
+/*
+	==========================================================================
+	Description:
+		Gives CCK TX rate 2 more dB TX power.
+		This routine works only in LINK UP in INFRASTRUCTURE mode.
+
+		calculate desired Tx power in RF R3.Tx0~5,	should consider -
+		0. if current radio is a noisy environment (pAd->DrsCounters.fNoisyEnvironment)
+		1. TxPowerPercentage
+		2. auto calibration based on TSSI feedback
+		3. extra 2 db for CCK
+		4. -10 db upon very-short distance (AvgRSSI >= -40db) to AP
+
+	NOTE: Since this routine requires the value of (pAd->DrsCounters.fNoisyEnvironment),
+		it should be called AFTER MlmeDynamicTxRatSwitching()
+	==========================================================================
+ */
+void AsicAdjustTxPower(struct rt_rtmp_adapter *pAd)
+{
+	int i, j;
+	char DeltaPwr = 0;
+	BOOLEAN bAutoTxAgc = FALSE;
+	u8 TssiRef, *pTssiMinusBoundary, *pTssiPlusBoundary, TxAgcStep;
+	u8 BbpR1 = 0, BbpR49 = 0, idx;
+	char *pTxAgcCompensate;
+	unsigned long TxPwr[5];
+	char Value;
+	char Rssi = -127;
+
+	if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE) ||
+#ifdef RTMP_MAC_PCI
+	    (pAd->bPCIclkOff == TRUE) ||
+#endif /* RTMP_MAC_PCI // */
+	    RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_IDLE_RADIO_OFF) ||
+	    RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS))
+		return;
+
+	Rssi = RTMPMaxRssi(pAd,
+			   pAd->StaCfg.RssiSample.AvgRssi0,
+			   pAd->StaCfg.RssiSample.AvgRssi1,
+			   pAd->StaCfg.RssiSample.AvgRssi2);
+
+	if (pAd->CommonCfg.BBPCurrentBW == BW_40) {
+		if (pAd->CommonCfg.CentralChannel > 14) {
+			TxPwr[0] = pAd->Tx40MPwrCfgABand[0];
+			TxPwr[1] = pAd->Tx40MPwrCfgABand[1];
+			TxPwr[2] = pAd->Tx40MPwrCfgABand[2];
+			TxPwr[3] = pAd->Tx40MPwrCfgABand[3];
+			TxPwr[4] = pAd->Tx40MPwrCfgABand[4];
+		} else {
+			TxPwr[0] = pAd->Tx40MPwrCfgGBand[0];
+			TxPwr[1] = pAd->Tx40MPwrCfgGBand[1];
+			TxPwr[2] = pAd->Tx40MPwrCfgGBand[2];
+			TxPwr[3] = pAd->Tx40MPwrCfgGBand[3];
+			TxPwr[4] = pAd->Tx40MPwrCfgGBand[4];
+		}
+	} else {
+		if (pAd->CommonCfg.Channel > 14) {
+			TxPwr[0] = pAd->Tx20MPwrCfgABand[0];
+			TxPwr[1] = pAd->Tx20MPwrCfgABand[1];
+			TxPwr[2] = pAd->Tx20MPwrCfgABand[2];
+			TxPwr[3] = pAd->Tx20MPwrCfgABand[3];
+			TxPwr[4] = pAd->Tx20MPwrCfgABand[4];
+		} else {
+			TxPwr[0] = pAd->Tx20MPwrCfgGBand[0];
+			TxPwr[1] = pAd->Tx20MPwrCfgGBand[1];
+			TxPwr[2] = pAd->Tx20MPwrCfgGBand[2];
+			TxPwr[3] = pAd->Tx20MPwrCfgGBand[3];
+			TxPwr[4] = pAd->Tx20MPwrCfgGBand[4];
+		}
+	}
+
+	/* TX power compensation for temperature variation based on TSSI. try every 4 second */
+	if (pAd->Mlme.OneSecPeriodicRound % 4 == 0) {
+		if (pAd->CommonCfg.Channel <= 14) {
+			/* bg channel */
+			bAutoTxAgc = pAd->bAutoTxAgcG;
+			TssiRef = pAd->TssiRefG;
+			pTssiMinusBoundary = &pAd->TssiMinusBoundaryG[0];
+			pTssiPlusBoundary = &pAd->TssiPlusBoundaryG[0];
+			TxAgcStep = pAd->TxAgcStepG;
+			pTxAgcCompensate = &pAd->TxAgcCompensateG;
+		} else {
+			/* a channel */
+			bAutoTxAgc = pAd->bAutoTxAgcA;
+			TssiRef = pAd->TssiRefA;
+			pTssiMinusBoundary = &pAd->TssiMinusBoundaryA[0];
+			pTssiPlusBoundary = &pAd->TssiPlusBoundaryA[0];
+			TxAgcStep = pAd->TxAgcStepA;
+			pTxAgcCompensate = &pAd->TxAgcCompensateA;
+		}
+
+		if (bAutoTxAgc) {
+			/* BbpR1 is unsigned char */
+			RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R49, &BbpR49);
+
+			/* (p) TssiPlusBoundaryG[0] = 0 = (m) TssiMinusBoundaryG[0] */
+			/* compensate: +4     +3   +2   +1    0   -1   -2   -3   -4 * steps */
+			/* step value is defined in pAd->TxAgcStepG for tx power value */
+
+			/* [4]+1+[4]   p4     p3   p2   p1   o1   m1   m2   m3   m4 */
+			/* ex:         0x00 0x15 0x25 0x45 0x88 0xA0 0xB5 0xD0 0xF0
+			   above value are examined in mass factory production */
+			/*             [4]    [3]  [2]  [1]  [0]  [1]  [2]  [3]  [4] */
+
+			/* plus (+) is 0x00 ~ 0x45, minus (-) is 0xa0 ~ 0xf0 */
+			/* if value is between p1 ~ o1 or o1 ~ s1, no need to adjust tx power */
+			/* if value is 0xa5, tx power will be -= TxAgcStep*(2-1) */
+
+			if (BbpR49 > pTssiMinusBoundary[1]) {
+				/* Reading is larger than the reference value */
+				/* check for how large we need to decrease the Tx power */
+				for (idx = 1; idx < 5; idx++) {
+					if (BbpR49 <= pTssiMinusBoundary[idx])	/* Found the range */
+						break;
+				}
+				/* The index is the step we should decrease, idx = 0 means there is nothing to compensate */
+/*                              if (R3 > (unsigned long)(TxAgcStep * (idx-1))) */
+				*pTxAgcCompensate = -(TxAgcStep * (idx - 1));
+/*                              else */
+/*                                      *pTxAgcCompensate = -((u8)R3); */
+
+				DeltaPwr += (*pTxAgcCompensate);
+				DBGPRINT(RT_DEBUG_TRACE,
+					 ("-- Tx Power, BBP R1=%x, TssiRef=%x, TxAgcStep=%x, step = -%d\n",
+					  BbpR49, TssiRef, TxAgcStep, idx - 1));
+			} else if (BbpR49 < pTssiPlusBoundary[1]) {
+				/* Reading is smaller than the reference value */
+				/* check for how large we need to increase the Tx power */
+				for (idx = 1; idx < 5; idx++) {
+					if (BbpR49 >= pTssiPlusBoundary[idx])	/* Found the range */
+						break;
+				}
+				/* The index is the step we should increase, idx = 0 means there is nothing to compensate */
+				*pTxAgcCompensate = TxAgcStep * (idx - 1);
+				DeltaPwr += (*pTxAgcCompensate);
+				DBGPRINT(RT_DEBUG_TRACE,
+					 ("++ Tx Power, BBP R1=%x, TssiRef=%x, TxAgcStep=%x, step = +%d\n",
+					  BbpR49, TssiRef, TxAgcStep, idx - 1));
+			} else {
+				*pTxAgcCompensate = 0;
+				DBGPRINT(RT_DEBUG_TRACE,
+					 ("   Tx Power, BBP R49=%x, TssiRef=%x, TxAgcStep=%x, step = +%d\n",
+					  BbpR49, TssiRef, TxAgcStep, 0));
+			}
+		}
+	} else {
+		if (pAd->CommonCfg.Channel <= 14) {
+			bAutoTxAgc = pAd->bAutoTxAgcG;
+			pTxAgcCompensate = &pAd->TxAgcCompensateG;
+		} else {
+			bAutoTxAgc = pAd->bAutoTxAgcA;
+			pTxAgcCompensate = &pAd->TxAgcCompensateA;
+		}
+
+		if (bAutoTxAgc)
+			DeltaPwr += (*pTxAgcCompensate);
+	}
+
+	RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R1, &BbpR1);
+	BbpR1 &= 0xFC;
+
+	/* calculate delta power based on the percentage specified from UI */
+	/* E2PROM setting is calibrated for maximum TX power (i.e. 100%) */
+	/* We lower TX power here according to the percentage specified from UI */
+	if (pAd->CommonCfg.TxPowerPercentage == 0xffffffff)	/* AUTO TX POWER control */
+	{
+		{
+			/* to patch high power issue with some APs, like Belkin N1. */
+			if (Rssi > -35) {
+				BbpR1 |= 0x02;	/* DeltaPwr -= 12; */
+			} else if (Rssi > -40) {
+				BbpR1 |= 0x01;	/* DeltaPwr -= 6; */
+			} else;
+		}
+	} else if (pAd->CommonCfg.TxPowerPercentage > 90)	/* 91 ~ 100% & AUTO, treat as 100% in terms of mW */
+		;
+	else if (pAd->CommonCfg.TxPowerPercentage > 60)	/* 61 ~ 90%, treat as 75% in terms of mW               // DeltaPwr -= 1; */
+	{
+		DeltaPwr -= 1;
+	} else if (pAd->CommonCfg.TxPowerPercentage > 30)	/* 31 ~ 60%, treat as 50% in terms of mW               // DeltaPwr -= 3; */
+	{
+		DeltaPwr -= 3;
+	} else if (pAd->CommonCfg.TxPowerPercentage > 15)	/* 16 ~ 30%, treat as 25% in terms of mW               // DeltaPwr -= 6; */
+	{
+		BbpR1 |= 0x01;
+	} else if (pAd->CommonCfg.TxPowerPercentage > 9)	/* 10 ~ 15%, treat as 12.5% in terms of mW             // DeltaPwr -= 9; */
+	{
+		BbpR1 |= 0x01;
+		DeltaPwr -= 3;
+	} else			/* 0 ~ 9 %, treat as MIN(~3%) in terms of mW             // DeltaPwr -= 12; */
+	{
+		BbpR1 |= 0x02;
+	}
+
+	RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R1, BbpR1);
+
+	/* reset different new tx power for different TX rate */
+	for (i = 0; i < 5; i++) {
+		if (TxPwr[i] != 0xffffffff) {
+			for (j = 0; j < 8; j++) {
+				Value = (char)((TxPwr[i] >> j * 4) & 0x0F);	/* 0 ~ 15 */
+
+				if ((Value + DeltaPwr) < 0) {
+					Value = 0;	/* min */
+				} else if ((Value + DeltaPwr) > 0xF) {
+					Value = 0xF;	/* max */
+				} else {
+					Value += DeltaPwr;	/* temperature compensation */
+				}
+
+				/* fill new value to CSR offset */
+				TxPwr[i] =
+				    (TxPwr[i] & ~(0x0000000F << j * 4)) | (Value
+									   << j
+									   * 4);
+			}
+
+			/* write tx power value to CSR */
+			/* TX_PWR_CFG_0 (8 tx rate) for TX power for OFDM 12M/18M
+			   TX power for OFDM 6M/9M
+			   TX power for CCK5.5M/11M
+			   TX power for CCK1M/2M */
+			/* TX_PWR_CFG_1 ~ TX_PWR_CFG_4 */
+			RTMP_IO_WRITE32(pAd, TX_PWR_CFG_0 + i * 4, TxPwr[i]);
+		}
+	}
+
+}
+
+/*
+	==========================================================================
+	Description:
+		put PHY to sleep here, and set next wakeup timer. PHY doesn't not wakeup
+		automatically. Instead, MCU will issue a TwakeUpInterrupt to host after
+		the wakeup timer timeout. Driver has to issue a separate command to wake
+		PHY up.
+
+	IRQL = DISPATCH_LEVEL
+
+	==========================================================================
+ */
+void AsicSleepThenAutoWakeup(struct rt_rtmp_adapter *pAd,
+			     u16 TbttNumToNextWakeUp)
+{
+	RTMP_STA_SLEEP_THEN_AUTO_WAKEUP(pAd, TbttNumToNextWakeUp);
+}
+
+/*
+	==========================================================================
+	Description:
+		AsicForceWakeup() is used whenever manual wakeup is required
+		AsicForceSleep() should only be used when not in INFRA BSS. When
+		in INFRA BSS, we should use AsicSleepThenAutoWakeup() instead.
+	==========================================================================
+ */
+void AsicForceSleep(struct rt_rtmp_adapter *pAd)
+{
+
+}
+
+/*
+	==========================================================================
+	Description:
+		AsicForceWakeup() is used whenever Twakeup timer (set via AsicSleepThenAutoWakeup)
+		expired.
+
+	IRQL = PASSIVE_LEVEL
+	IRQL = DISPATCH_LEVEL
+	==========================================================================
+ */
+void AsicForceWakeup(struct rt_rtmp_adapter *pAd, IN BOOLEAN bFromTx)
+{
+	DBGPRINT(RT_DEBUG_INFO, ("--> AsicForceWakeup \n"));
+	RTMP_STA_FORCE_WAKEUP(pAd, bFromTx);
+}
+
+/*
+	==========================================================================
+	Description:
+		Set My BSSID
+
+	IRQL = DISPATCH_LEVEL
+
+	==========================================================================
+ */
+void AsicSetBssid(struct rt_rtmp_adapter *pAd, u8 *pBssid)
+{
+	unsigned long Addr4;
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("==============> AsicSetBssid %x:%x:%x:%x:%x:%x\n", pBssid[0],
+		  pBssid[1], pBssid[2], pBssid[3], pBssid[4], pBssid[5]));
+
+	Addr4 = (unsigned long)(pBssid[0]) |
+	    (unsigned long)(pBssid[1] << 8) |
+	    (unsigned long)(pBssid[2] << 16) | (unsigned long)(pBssid[3] << 24);
+	RTMP_IO_WRITE32(pAd, MAC_BSSID_DW0, Addr4);
+
+	Addr4 = 0;
+	/* always one BSSID in STA mode */
+	Addr4 = (unsigned long)(pBssid[4]) | (unsigned long)(pBssid[5] << 8);
+
+	RTMP_IO_WRITE32(pAd, MAC_BSSID_DW1, Addr4);
+}
+
+void AsicSetMcastWC(struct rt_rtmp_adapter *pAd)
+{
+	struct rt_mac_table_entry *pEntry = &pAd->MacTab.Content[MCAST_WCID];
+	u16 offset;
+
+	pEntry->Sst = SST_ASSOC;
+	pEntry->Aid = MCAST_WCID;	/* Softap supports 1 BSSID and use WCID=0 as multicast Wcid index */
+	pEntry->PsMode = PWR_ACTIVE;
+	pEntry->CurrTxRate = pAd->CommonCfg.MlmeRate;
+	offset = MAC_WCID_BASE + BSS0Mcast_WCID * HW_WCID_ENTRY_SIZE;
+}
+
+/*
+	==========================================================================
+	Description:
+
+	IRQL = DISPATCH_LEVEL
+
+	==========================================================================
+ */
+void AsicDelWcidTab(struct rt_rtmp_adapter *pAd, u8 Wcid)
+{
+	unsigned long Addr0 = 0x0, Addr1 = 0x0;
+	unsigned long offset;
+
+	DBGPRINT(RT_DEBUG_TRACE, ("AsicDelWcidTab==>Wcid = 0x%x\n", Wcid));
+	offset = MAC_WCID_BASE + Wcid * HW_WCID_ENTRY_SIZE;
+	RTMP_IO_WRITE32(pAd, offset, Addr0);
+	offset += 4;
+	RTMP_IO_WRITE32(pAd, offset, Addr1);
+}
+
+/*
+	==========================================================================
+	Description:
+
+	IRQL = DISPATCH_LEVEL
+
+	==========================================================================
+ */
+void AsicEnableRDG(struct rt_rtmp_adapter *pAd)
+{
+	TX_LINK_CFG_STRUC TxLinkCfg;
+	u32 Data = 0;
+
+	RTMP_IO_READ32(pAd, TX_LINK_CFG, &TxLinkCfg.word);
+	TxLinkCfg.field.TxRDGEn = 1;
+	RTMP_IO_WRITE32(pAd, TX_LINK_CFG, TxLinkCfg.word);
+
+	RTMP_IO_READ32(pAd, EDCA_AC0_CFG, &Data);
+	Data &= 0xFFFFFF00;
+	Data |= 0x80;
+	RTMP_IO_WRITE32(pAd, EDCA_AC0_CFG, Data);
+
+	/*OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_AGGREGATION_INUSED); */
+}
+
+/*
+	==========================================================================
+	Description:
+
+	IRQL = DISPATCH_LEVEL
+
+	==========================================================================
+ */
+void AsicDisableRDG(struct rt_rtmp_adapter *pAd)
+{
+	TX_LINK_CFG_STRUC TxLinkCfg;
+	u32 Data = 0;
+
+	RTMP_IO_READ32(pAd, TX_LINK_CFG, &TxLinkCfg.word);
+	TxLinkCfg.field.TxRDGEn = 0;
+	RTMP_IO_WRITE32(pAd, TX_LINK_CFG, TxLinkCfg.word);
+
+	RTMP_IO_READ32(pAd, EDCA_AC0_CFG, &Data);
+
+	Data &= 0xFFFFFF00;
+	/*Data  |= 0x20; */
+#ifndef WIFI_TEST
+	/*if ( pAd->CommonCfg.bEnableTxBurst ) */
+	/*      Data |= 0x60; // for performance issue not set the TXOP to 0 */
+#endif
+	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_DYNAMIC_BE_TXOP_ACTIVE)
+	    && (pAd->MacTab.fAnyStationMIMOPSDynamic == FALSE)
+	    ) {
+		/* For CWC test, change txop from 0x30 to 0x20 in TxBurst mode */
+		if (pAd->CommonCfg.bEnableTxBurst)
+			Data |= 0x20;
+	}
+	RTMP_IO_WRITE32(pAd, EDCA_AC0_CFG, Data);
+}
+
+/*
+	==========================================================================
+	Description:
+
+	IRQL = PASSIVE_LEVEL
+	IRQL = DISPATCH_LEVEL
+
+	==========================================================================
+ */
+void AsicDisableSync(struct rt_rtmp_adapter *pAd)
+{
+	BCN_TIME_CFG_STRUC csr;
+
+	DBGPRINT(RT_DEBUG_TRACE, ("--->Disable TSF synchronization\n"));
+
+	/* 2003-12-20 disable TSF and TBTT while NIC in power-saving have side effect */
+	/*                        that NIC will never wakes up because TSF stops and no more */
+	/*                        TBTT interrupts */
+	pAd->TbttTickCount = 0;
+	RTMP_IO_READ32(pAd, BCN_TIME_CFG, &csr.word);
+	csr.field.bBeaconGen = 0;
+	csr.field.bTBTTEnable = 0;
+	csr.field.TsfSyncMode = 0;
+	csr.field.bTsfTicking = 0;
+	RTMP_IO_WRITE32(pAd, BCN_TIME_CFG, csr.word);
+
+}
+
+/*
+	==========================================================================
+	Description:
+
+	IRQL = DISPATCH_LEVEL
+
+	==========================================================================
+ */
+void AsicEnableBssSync(struct rt_rtmp_adapter *pAd)
+{
+	BCN_TIME_CFG_STRUC csr;
+
+	DBGPRINT(RT_DEBUG_TRACE, ("--->AsicEnableBssSync(INFRA mode)\n"));
+
+	RTMP_IO_READ32(pAd, BCN_TIME_CFG, &csr.word);
+/*      RTMP_IO_WRITE32(pAd, BCN_TIME_CFG, 0x00000000); */
+	{
+		csr.field.BeaconInterval = pAd->CommonCfg.BeaconPeriod << 4;	/* ASIC register in units of 1/16 TU */
+		csr.field.bTsfTicking = 1;
+		csr.field.TsfSyncMode = 1;	/* sync TSF in INFRASTRUCTURE mode */
+		csr.field.bBeaconGen = 0;	/* do NOT generate BEACON */
+		csr.field.bTBTTEnable = 1;
+	}
+	RTMP_IO_WRITE32(pAd, BCN_TIME_CFG, csr.word);
+}
+
+/*
+	==========================================================================
+	Description:
+	Note:
+		BEACON frame in shared memory should be built ok before this routine
+		can be called. Otherwise, a garbage frame maybe transmitted out every
+		Beacon period.
+
+	IRQL = DISPATCH_LEVEL
+
+	==========================================================================
+ */
+void AsicEnableIbssSync(struct rt_rtmp_adapter *pAd)
+{
+	BCN_TIME_CFG_STRUC csr9;
+	u8 *ptr;
+	u32 i;
+
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("--->AsicEnableIbssSync(ADHOC mode. MPDUtotalByteCount = %d)\n",
+		  pAd->BeaconTxWI.MPDUtotalByteCount));
+
+	RTMP_IO_READ32(pAd, BCN_TIME_CFG, &csr9.word);
+	csr9.field.bBeaconGen = 0;
+	csr9.field.bTBTTEnable = 0;
+	csr9.field.bTsfTicking = 0;
+	RTMP_IO_WRITE32(pAd, BCN_TIME_CFG, csr9.word);
+
+#ifdef RTMP_MAC_PCI
+	/* move BEACON TXD and frame content to on-chip memory */
+	ptr = (u8 *)& pAd->BeaconTxWI;
+	for (i = 0; i < TXWI_SIZE; i += 4)	/* 16-byte TXWI field */
+	{
+		u32 longptr =
+		    *ptr + (*(ptr + 1) << 8) + (*(ptr + 2) << 16) +
+		    (*(ptr + 3) << 24);
+		RTMP_IO_WRITE32(pAd, HW_BEACON_BASE0 + i, longptr);
+		ptr += 4;
+	}
+
+	/* start right after the 16-byte TXWI field */
+	ptr = pAd->BeaconBuf;
+	for (i = 0; i < pAd->BeaconTxWI.MPDUtotalByteCount; i += 4) {
+		u32 longptr =
+		    *ptr + (*(ptr + 1) << 8) + (*(ptr + 2) << 16) +
+		    (*(ptr + 3) << 24);
+		RTMP_IO_WRITE32(pAd, HW_BEACON_BASE0 + TXWI_SIZE + i, longptr);
+		ptr += 4;
+	}
+#endif /* RTMP_MAC_PCI // */
+#ifdef RTMP_MAC_USB
+	/* move BEACON TXD and frame content to on-chip memory */
+	ptr = (u8 *)& pAd->BeaconTxWI;
+	for (i = 0; i < TXWI_SIZE; i += 2)	/* 16-byte TXWI field */
+	{
+		/*u32 longptr =  *ptr + (*(ptr+1)<<8) + (*(ptr+2)<<16) + (*(ptr+3)<<24); */
+		/*RTMP_IO_WRITE32(pAd, HW_BEACON_BASE0 + i, longptr); */
+		RTUSBMultiWrite(pAd, HW_BEACON_BASE0 + i, ptr, 2);
+		ptr += 2;
+	}
+
+	/* start right after the 16-byte TXWI field */
+	ptr = pAd->BeaconBuf;
+	for (i = 0; i < pAd->BeaconTxWI.MPDUtotalByteCount; i += 2) {
+		/*u32 longptr =  *ptr + (*(ptr+1)<<8) + (*(ptr+2)<<16) + (*(ptr+3)<<24); */
+		/*RTMP_IO_WRITE32(pAd, HW_BEACON_BASE0 + TXWI_SIZE + i, longptr); */
+		RTUSBMultiWrite(pAd, HW_BEACON_BASE0 + TXWI_SIZE + i, ptr, 2);
+		ptr += 2;
+	}
+#endif /* RTMP_MAC_USB // */
+
+	/* */
+	/* For Wi-Fi faily generated beacons between participating stations. */
+	/* Set TBTT phase adaptive adjustment step to 8us (default 16us) */
+	/* don't change settings 2006-5- by Jerry */
+	/*RTMP_IO_WRITE32(pAd, TBTT_SYNC_CFG, 0x00001010); */
+
+	/* start sending BEACON */
+	csr9.field.BeaconInterval = pAd->CommonCfg.BeaconPeriod << 4;	/* ASIC register in units of 1/16 TU */
+	csr9.field.bTsfTicking = 1;
+	csr9.field.TsfSyncMode = 2;	/* sync TSF in IBSS mode */
+	csr9.field.bTBTTEnable = 1;
+	csr9.field.bBeaconGen = 1;
+	RTMP_IO_WRITE32(pAd, BCN_TIME_CFG, csr9.word);
+}
+
+/*
+	==========================================================================
+	Description:
+
+	IRQL = PASSIVE_LEVEL
+	IRQL = DISPATCH_LEVEL
+
+	==========================================================================
+ */
+void AsicSetEdcaParm(struct rt_rtmp_adapter *pAd, struct rt_edca_parm *pEdcaParm)
+{
+	EDCA_AC_CFG_STRUC Ac0Cfg, Ac1Cfg, Ac2Cfg, Ac3Cfg;
+	AC_TXOP_CSR0_STRUC csr0;
+	AC_TXOP_CSR1_STRUC csr1;
+	AIFSN_CSR_STRUC AifsnCsr;
+	CWMIN_CSR_STRUC CwminCsr;
+	CWMAX_CSR_STRUC CwmaxCsr;
+	int i;
+
+	Ac0Cfg.word = 0;
+	Ac1Cfg.word = 0;
+	Ac2Cfg.word = 0;
+	Ac3Cfg.word = 0;
+	if ((pEdcaParm == NULL) || (pEdcaParm->bValid == FALSE)) {
+		DBGPRINT(RT_DEBUG_TRACE, ("AsicSetEdcaParm\n"));
+		OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_WMM_INUSED);
+		for (i = 0; i < MAX_LEN_OF_MAC_TABLE; i++) {
+			if (pAd->MacTab.Content[i].ValidAsCLI
+			    || pAd->MacTab.Content[i].ValidAsApCli)
+				CLIENT_STATUS_CLEAR_FLAG(&pAd->MacTab.
+							 Content[i],
+							 fCLIENT_STATUS_WMM_CAPABLE);
+		}
+
+		/*======================================================== */
+		/*      MAC Register has a copy . */
+		/*======================================================== */
+/*#ifndef WIFI_TEST */
+		if (pAd->CommonCfg.bEnableTxBurst) {
+			/* For CWC test, change txop from 0x30 to 0x20 in TxBurst mode */
+			Ac0Cfg.field.AcTxop = 0x20;	/* Suggest by John for TxBurst in HT Mode */
+		} else
+			Ac0Cfg.field.AcTxop = 0;	/* QID_AC_BE */
+/*#else */
+/*              Ac0Cfg.field.AcTxop = 0;        // QID_AC_BE */
+/*#endif */
+		Ac0Cfg.field.Cwmin = CW_MIN_IN_BITS;
+		Ac0Cfg.field.Cwmax = CW_MAX_IN_BITS;
+		Ac0Cfg.field.Aifsn = 2;
+		RTMP_IO_WRITE32(pAd, EDCA_AC0_CFG, Ac0Cfg.word);
+
+		Ac1Cfg.field.AcTxop = 0;	/* QID_AC_BK */
+		Ac1Cfg.field.Cwmin = CW_MIN_IN_BITS;
+		Ac1Cfg.field.Cwmax = CW_MAX_IN_BITS;
+		Ac1Cfg.field.Aifsn = 2;
+		RTMP_IO_WRITE32(pAd, EDCA_AC1_CFG, Ac1Cfg.word);
+
+		if (pAd->CommonCfg.PhyMode == PHY_11B) {
+			Ac2Cfg.field.AcTxop = 192;	/* AC_VI: 192*32us ~= 6ms */
+			Ac3Cfg.field.AcTxop = 96;	/* AC_VO: 96*32us  ~= 3ms */
+		} else {
+			Ac2Cfg.field.AcTxop = 96;	/* AC_VI: 96*32us ~= 3ms */
+			Ac3Cfg.field.AcTxop = 48;	/* AC_VO: 48*32us ~= 1.5ms */
+		}
+		Ac2Cfg.field.Cwmin = CW_MIN_IN_BITS;
+		Ac2Cfg.field.Cwmax = CW_MAX_IN_BITS;
+		Ac2Cfg.field.Aifsn = 2;
+		RTMP_IO_WRITE32(pAd, EDCA_AC2_CFG, Ac2Cfg.word);
+		Ac3Cfg.field.Cwmin = CW_MIN_IN_BITS;
+		Ac3Cfg.field.Cwmax = CW_MAX_IN_BITS;
+		Ac3Cfg.field.Aifsn = 2;
+		RTMP_IO_WRITE32(pAd, EDCA_AC3_CFG, Ac3Cfg.word);
+
+		/*======================================================== */
+		/*      DMA Register has a copy too. */
+		/*======================================================== */
+		csr0.field.Ac0Txop = 0;	/* QID_AC_BE */
+		csr0.field.Ac1Txop = 0;	/* QID_AC_BK */
+		RTMP_IO_WRITE32(pAd, WMM_TXOP0_CFG, csr0.word);
+		if (pAd->CommonCfg.PhyMode == PHY_11B) {
+			csr1.field.Ac2Txop = 192;	/* AC_VI: 192*32us ~= 6ms */
+			csr1.field.Ac3Txop = 96;	/* AC_VO: 96*32us  ~= 3ms */
+		} else {
+			csr1.field.Ac2Txop = 96;	/* AC_VI: 96*32us ~= 3ms */
+			csr1.field.Ac3Txop = 48;	/* AC_VO: 48*32us ~= 1.5ms */
+		}
+		RTMP_IO_WRITE32(pAd, WMM_TXOP1_CFG, csr1.word);
+
+		CwminCsr.word = 0;
+		CwminCsr.field.Cwmin0 = CW_MIN_IN_BITS;
+		CwminCsr.field.Cwmin1 = CW_MIN_IN_BITS;
+		CwminCsr.field.Cwmin2 = CW_MIN_IN_BITS;
+		CwminCsr.field.Cwmin3 = CW_MIN_IN_BITS;
+		RTMP_IO_WRITE32(pAd, WMM_CWMIN_CFG, CwminCsr.word);
+
+		CwmaxCsr.word = 0;
+		CwmaxCsr.field.Cwmax0 = CW_MAX_IN_BITS;
+		CwmaxCsr.field.Cwmax1 = CW_MAX_IN_BITS;
+		CwmaxCsr.field.Cwmax2 = CW_MAX_IN_BITS;
+		CwmaxCsr.field.Cwmax3 = CW_MAX_IN_BITS;
+		RTMP_IO_WRITE32(pAd, WMM_CWMAX_CFG, CwmaxCsr.word);
+
+		RTMP_IO_WRITE32(pAd, WMM_AIFSN_CFG, 0x00002222);
+
+		NdisZeroMemory(&pAd->CommonCfg.APEdcaParm, sizeof(struct rt_edca_parm));
+	} else {
+		OPSTATUS_SET_FLAG(pAd, fOP_STATUS_WMM_INUSED);
+		/*======================================================== */
+		/*      MAC Register has a copy. */
+		/*======================================================== */
+		/* */
+		/* Modify Cwmin/Cwmax/Txop on queue[QID_AC_VI], Recommend by Jerry 2005/07/27 */
+		/* To degrade our VIDO Queue's throughput for WiFi WMM S3T07 Issue. */
+		/* */
+		/*pEdcaParm->Txop[QID_AC_VI] = pEdcaParm->Txop[QID_AC_VI] * 7 / 10; // rt2860c need this */
+
+		Ac0Cfg.field.AcTxop = pEdcaParm->Txop[QID_AC_BE];
+		Ac0Cfg.field.Cwmin = pEdcaParm->Cwmin[QID_AC_BE];
+		Ac0Cfg.field.Cwmax = pEdcaParm->Cwmax[QID_AC_BE];
+		Ac0Cfg.field.Aifsn = pEdcaParm->Aifsn[QID_AC_BE];	/*+1; */
+
+		Ac1Cfg.field.AcTxop = pEdcaParm->Txop[QID_AC_BK];
+		Ac1Cfg.field.Cwmin = pEdcaParm->Cwmin[QID_AC_BK];	/*+2; */
+		Ac1Cfg.field.Cwmax = pEdcaParm->Cwmax[QID_AC_BK];
+		Ac1Cfg.field.Aifsn = pEdcaParm->Aifsn[QID_AC_BK];	/*+1; */
+
+		Ac2Cfg.field.AcTxop = (pEdcaParm->Txop[QID_AC_VI] * 6) / 10;
+		if (pAd->Antenna.field.TxPath == 1) {
+			Ac2Cfg.field.Cwmin = pEdcaParm->Cwmin[QID_AC_VI] + 1;
+			Ac2Cfg.field.Cwmax = pEdcaParm->Cwmax[QID_AC_VI] + 1;
+		} else {
+			Ac2Cfg.field.Cwmin = pEdcaParm->Cwmin[QID_AC_VI];
+			Ac2Cfg.field.Cwmax = pEdcaParm->Cwmax[QID_AC_VI];
+		}
+		Ac2Cfg.field.Aifsn = pEdcaParm->Aifsn[QID_AC_VI] + 1;
+#ifdef RTMP_MAC_USB
+		Ac2Cfg.field.Aifsn = pEdcaParm->Aifsn[QID_AC_VI] + 3;
+#endif /* RTMP_MAC_USB // */
+
+		{
+			/* Tuning for Wi-Fi WMM S06 */
+			if (pAd->CommonCfg.bWiFiTest &&
+			    pEdcaParm->Aifsn[QID_AC_VI] == 10)
+				Ac2Cfg.field.Aifsn -= 1;
+
+			/* Tuning for TGn Wi-Fi 5.2.32 */
+			/* STA TestBed changes in this item: conexant legacy sta ==> broadcom 11n sta */
+			if (STA_TGN_WIFI_ON(pAd) &&
+			    pEdcaParm->Aifsn[QID_AC_VI] == 10) {
+				Ac0Cfg.field.Aifsn = 3;
+				Ac2Cfg.field.AcTxop = 5;
+			}
+#ifdef RT30xx
+			if (pAd->RfIcType == RFIC_3020
+			    || pAd->RfIcType == RFIC_2020) {
+				/* Tuning for WiFi WMM S3-T07: connexant legacy sta ==> broadcom 11n sta. */
+				Ac2Cfg.field.Aifsn = 5;
+			}
+#endif /* RT30xx // */
+		}
+
+		Ac3Cfg.field.AcTxop = pEdcaParm->Txop[QID_AC_VO];
+		Ac3Cfg.field.Cwmin = pEdcaParm->Cwmin[QID_AC_VO];
+		Ac3Cfg.field.Cwmax = pEdcaParm->Cwmax[QID_AC_VO];
+		Ac3Cfg.field.Aifsn = pEdcaParm->Aifsn[QID_AC_VO];
+
+/*#ifdef WIFI_TEST */
+		if (pAd->CommonCfg.bWiFiTest) {
+			if (Ac3Cfg.field.AcTxop == 102) {
+				Ac0Cfg.field.AcTxop =
+				    pEdcaParm->Txop[QID_AC_BE] ? pEdcaParm->
+				    Txop[QID_AC_BE] : 10;
+				Ac0Cfg.field.Aifsn = pEdcaParm->Aifsn[QID_AC_BE] - 1;	/* AIFSN must >= 1 */
+				Ac1Cfg.field.AcTxop =
+				    pEdcaParm->Txop[QID_AC_BK];
+				Ac1Cfg.field.Aifsn =
+				    pEdcaParm->Aifsn[QID_AC_BK];
+				Ac2Cfg.field.AcTxop =
+				    pEdcaParm->Txop[QID_AC_VI];
+			}	/* End of if */
+		}
+/*#endif // WIFI_TEST // */
+
+		RTMP_IO_WRITE32(pAd, EDCA_AC0_CFG, Ac0Cfg.word);
+		RTMP_IO_WRITE32(pAd, EDCA_AC1_CFG, Ac1Cfg.word);
+		RTMP_IO_WRITE32(pAd, EDCA_AC2_CFG, Ac2Cfg.word);
+		RTMP_IO_WRITE32(pAd, EDCA_AC3_CFG, Ac3Cfg.word);
+
+		/*======================================================== */
+		/*      DMA Register has a copy too. */
+		/*======================================================== */
+		csr0.field.Ac0Txop = Ac0Cfg.field.AcTxop;
+		csr0.field.Ac1Txop = Ac1Cfg.field.AcTxop;
+		RTMP_IO_WRITE32(pAd, WMM_TXOP0_CFG, csr0.word);
+
+		csr1.field.Ac2Txop = Ac2Cfg.field.AcTxop;
+		csr1.field.Ac3Txop = Ac3Cfg.field.AcTxop;
+		RTMP_IO_WRITE32(pAd, WMM_TXOP1_CFG, csr1.word);
+
+		CwminCsr.word = 0;
+		CwminCsr.field.Cwmin0 = pEdcaParm->Cwmin[QID_AC_BE];
+		CwminCsr.field.Cwmin1 = pEdcaParm->Cwmin[QID_AC_BK];
+		CwminCsr.field.Cwmin2 = pEdcaParm->Cwmin[QID_AC_VI];
+		CwminCsr.field.Cwmin3 = pEdcaParm->Cwmin[QID_AC_VO] - 1;	/*for TGn wifi test */
+		RTMP_IO_WRITE32(pAd, WMM_CWMIN_CFG, CwminCsr.word);
+
+		CwmaxCsr.word = 0;
+		CwmaxCsr.field.Cwmax0 = pEdcaParm->Cwmax[QID_AC_BE];
+		CwmaxCsr.field.Cwmax1 = pEdcaParm->Cwmax[QID_AC_BK];
+		CwmaxCsr.field.Cwmax2 = pEdcaParm->Cwmax[QID_AC_VI];
+		CwmaxCsr.field.Cwmax3 = pEdcaParm->Cwmax[QID_AC_VO];
+		RTMP_IO_WRITE32(pAd, WMM_CWMAX_CFG, CwmaxCsr.word);
+
+		AifsnCsr.word = 0;
+		AifsnCsr.field.Aifsn0 = Ac0Cfg.field.Aifsn;	/*pEdcaParm->Aifsn[QID_AC_BE]; */
+		AifsnCsr.field.Aifsn1 = Ac1Cfg.field.Aifsn;	/*pEdcaParm->Aifsn[QID_AC_BK]; */
+		AifsnCsr.field.Aifsn2 = Ac2Cfg.field.Aifsn;	/*pEdcaParm->Aifsn[QID_AC_VI]; */
+
+		{
+			/* Tuning for Wi-Fi WMM S06 */
+			if (pAd->CommonCfg.bWiFiTest &&
+			    pEdcaParm->Aifsn[QID_AC_VI] == 10)
+				AifsnCsr.field.Aifsn2 = Ac2Cfg.field.Aifsn - 4;
+
+			/* Tuning for TGn Wi-Fi 5.2.32 */
+			/* STA TestBed changes in this item: connexant legacy sta ==> broadcom 11n sta */
+			if (STA_TGN_WIFI_ON(pAd) &&
+			    pEdcaParm->Aifsn[QID_AC_VI] == 10) {
+				AifsnCsr.field.Aifsn0 = 3;
+				AifsnCsr.field.Aifsn2 = 7;
+			}
+
+			if (INFRA_ON(pAd))
+				CLIENT_STATUS_SET_FLAG(&pAd->MacTab.
+						       Content[BSSID_WCID],
+						       fCLIENT_STATUS_WMM_CAPABLE);
+		}
+
+		{
+			AifsnCsr.field.Aifsn3 = Ac3Cfg.field.Aifsn - 1;	/*pEdcaParm->Aifsn[QID_AC_VO]; //for TGn wifi test */
+#ifdef RT30xx
+			/* TODO: Shiang, this modification also suitable for RT3052/RT3050 ??? */
+			if (pAd->RfIcType == RFIC_3020
+			    || pAd->RfIcType == RFIC_2020) {
+				AifsnCsr.field.Aifsn2 = 0x2;	/*pEdcaParm->Aifsn[QID_AC_VI]; //for WiFi WMM S4-T04. */
+			}
+#endif /* RT30xx // */
+		}
+		RTMP_IO_WRITE32(pAd, WMM_AIFSN_CFG, AifsnCsr.word);
+
+		NdisMoveMemory(&pAd->CommonCfg.APEdcaParm, pEdcaParm,
+			       sizeof(struct rt_edca_parm));
+		if (!ADHOC_ON(pAd)) {
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("EDCA [#%d]: AIFSN CWmin CWmax  TXOP(us)  ACM\n",
+				  pEdcaParm->EdcaUpdateCount));
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("     AC_BE      %2d     %2d     %2d      %4d     %d\n",
+				  pEdcaParm->Aifsn[0], pEdcaParm->Cwmin[0],
+				  pEdcaParm->Cwmax[0], pEdcaParm->Txop[0] << 5,
+				  pEdcaParm->bACM[0]));
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("     AC_BK      %2d     %2d     %2d      %4d     %d\n",
+				  pEdcaParm->Aifsn[1], pEdcaParm->Cwmin[1],
+				  pEdcaParm->Cwmax[1], pEdcaParm->Txop[1] << 5,
+				  pEdcaParm->bACM[1]));
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("     AC_VI      %2d     %2d     %2d      %4d     %d\n",
+				  pEdcaParm->Aifsn[2], pEdcaParm->Cwmin[2],
+				  pEdcaParm->Cwmax[2], pEdcaParm->Txop[2] << 5,
+				  pEdcaParm->bACM[2]));
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("     AC_VO      %2d     %2d     %2d      %4d     %d\n",
+				  pEdcaParm->Aifsn[3], pEdcaParm->Cwmin[3],
+				  pEdcaParm->Cwmax[3], pEdcaParm->Txop[3] << 5,
+				  pEdcaParm->bACM[3]));
+		}
+	}
+
+}
+
+/*
+	==========================================================================
+	Description:
+
+	IRQL = PASSIVE_LEVEL
+	IRQL = DISPATCH_LEVEL
+
+	==========================================================================
+ */
+void AsicSetSlotTime(struct rt_rtmp_adapter *pAd, IN BOOLEAN bUseShortSlotTime)
+{
+	unsigned long SlotTime;
+	u32 RegValue = 0;
+
+	if (pAd->CommonCfg.Channel > 14)
+		bUseShortSlotTime = TRUE;
+
+	if (bUseShortSlotTime
+	    && OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_SHORT_SLOT_INUSED))
+		return;
+	else if ((!bUseShortSlotTime)
+		 && (!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_SHORT_SLOT_INUSED)))
+		return;
+
+	if (bUseShortSlotTime)
+		OPSTATUS_SET_FLAG(pAd, fOP_STATUS_SHORT_SLOT_INUSED);
+	else
+		OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_SHORT_SLOT_INUSED);
+
+	SlotTime = (bUseShortSlotTime) ? 9 : 20;
+
+	{
+		/* force using short SLOT time for FAE to demo performance when TxBurst is ON */
+		if (((pAd->StaActive.SupportedPhyInfo.bHtEnable == FALSE)
+		     && (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_WMM_INUSED)))
+		    || ((pAd->StaActive.SupportedPhyInfo.bHtEnable == TRUE)
+			&& (pAd->CommonCfg.BACapability.field.Policy ==
+			    BA_NOTUSE))
+		    ) {
+			/* In this case, we will think it is doing Wi-Fi test */
+			/* And we will not set to short slot when bEnableTxBurst is TRUE. */
+		} else if (pAd->CommonCfg.bEnableTxBurst) {
+			OPSTATUS_SET_FLAG(pAd, fOP_STATUS_SHORT_SLOT_INUSED);
+			SlotTime = 9;
+		}
+	}
+
+	/* */
+	/* For some reasons, always set it to short slot time. */
+	/* */
+	/* ToDo: Should consider capability with 11B */
+	/* */
+	{
+		if (pAd->StaCfg.BssType == BSS_ADHOC) {
+			OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_SHORT_SLOT_INUSED);
+			SlotTime = 20;
+		}
+	}
+
+	RTMP_IO_READ32(pAd, BKOFF_SLOT_CFG, &RegValue);
+	RegValue = RegValue & 0xFFFFFF00;
+
+	RegValue |= SlotTime;
+
+	RTMP_IO_WRITE32(pAd, BKOFF_SLOT_CFG, RegValue);
+}
+
+/*
+	========================================================================
+	Description:
+		Add Shared key information into ASIC.
+		Update shared key, TxMic and RxMic to Asic Shared key table
+		Update its cipherAlg to Asic Shared key Mode.
+
+    Return:
+	========================================================================
+*/
+void AsicAddSharedKeyEntry(struct rt_rtmp_adapter *pAd,
+			   u8 BssIndex,
+			   u8 KeyIdx,
+			   u8 CipherAlg,
+			   u8 *pKey, u8 *pTxMic, u8 *pRxMic)
+{
+	unsigned long offset;		/*, csr0; */
+	SHAREDKEY_MODE_STRUC csr1;
+#ifdef RTMP_MAC_PCI
+	int i;
+#endif /* RTMP_MAC_PCI // */
+
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("AsicAddSharedKeyEntry BssIndex=%d, KeyIdx=%d\n", BssIndex,
+		  KeyIdx));
+/*============================================================================================ */
+
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("AsicAddSharedKeyEntry: %s key #%d\n", CipherName[CipherAlg],
+		  BssIndex * 4 + KeyIdx));
+	DBGPRINT_RAW(RT_DEBUG_TRACE,
+		     ("		Key = %02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x\n",
+		      pKey[0], pKey[1], pKey[2], pKey[3], pKey[4],
+		      pKey[5], pKey[6], pKey[7], pKey[8], pKey[9],
+		      pKey[10], pKey[11], pKey[12], pKey[13], pKey[14],
+		      pKey[15]));
+	if (pRxMic) {
+		DBGPRINT_RAW(RT_DEBUG_TRACE,
+			     ("		Rx MIC Key = %02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x\n",
+			      pRxMic[0], pRxMic[1], pRxMic[2], pRxMic[3],
+			      pRxMic[4], pRxMic[5], pRxMic[6], pRxMic[7]));
+	}
+	if (pTxMic) {
+		DBGPRINT_RAW(RT_DEBUG_TRACE,
+			     ("		Tx MIC Key = %02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x\n",
+			      pTxMic[0], pTxMic[1], pTxMic[2], pTxMic[3],
+			      pTxMic[4], pTxMic[5], pTxMic[6], pTxMic[7]));
+	}
+/*============================================================================================ */
+	/* */
+	/* fill key material - key + TX MIC + RX MIC */
+	/* */
+#ifdef RTMP_MAC_PCI
+	offset =
+	    SHARED_KEY_TABLE_BASE + (4 * BssIndex + KeyIdx) * HW_KEY_ENTRY_SIZE;
+	for (i = 0; i < MAX_LEN_OF_SHARE_KEY; i++) {
+		RTMP_IO_WRITE8(pAd, offset + i, pKey[i]);
+	}
+
+	offset += MAX_LEN_OF_SHARE_KEY;
+	if (pTxMic) {
+		for (i = 0; i < 8; i++) {
+			RTMP_IO_WRITE8(pAd, offset + i, pTxMic[i]);
+		}
+	}
+
+	offset += 8;
+	if (pRxMic) {
+		for (i = 0; i < 8; i++) {
+			RTMP_IO_WRITE8(pAd, offset + i, pRxMic[i]);
+		}
+	}
+#endif /* RTMP_MAC_PCI // */
+#ifdef RTMP_MAC_USB
+	{
+		offset =
+		    SHARED_KEY_TABLE_BASE + (4 * BssIndex +
+					     KeyIdx) * HW_KEY_ENTRY_SIZE;
+		RTUSBMultiWrite(pAd, offset, pKey, MAX_LEN_OF_SHARE_KEY);
+
+		offset += MAX_LEN_OF_SHARE_KEY;
+		if (pTxMic) {
+			RTUSBMultiWrite(pAd, offset, pTxMic, 8);
+		}
+
+		offset += 8;
+		if (pRxMic) {
+			RTUSBMultiWrite(pAd, offset, pRxMic, 8);
+		}
+	}
+#endif /* RTMP_MAC_USB // */
+
+	/* */
+	/* Update cipher algorithm. WSTA always use BSS0 */
+	/* */
+	RTMP_IO_READ32(pAd, SHARED_KEY_MODE_BASE + 4 * (BssIndex / 2),
+		       &csr1.word);
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("Read: SHARED_KEY_MODE_BASE at this Bss[%d] KeyIdx[%d]= 0x%x \n",
+		  BssIndex, KeyIdx, csr1.word));
+	if ((BssIndex % 2) == 0) {
+		if (KeyIdx == 0)
+			csr1.field.Bss0Key0CipherAlg = CipherAlg;
+		else if (KeyIdx == 1)
+			csr1.field.Bss0Key1CipherAlg = CipherAlg;
+		else if (KeyIdx == 2)
+			csr1.field.Bss0Key2CipherAlg = CipherAlg;
+		else
+			csr1.field.Bss0Key3CipherAlg = CipherAlg;
+	} else {
+		if (KeyIdx == 0)
+			csr1.field.Bss1Key0CipherAlg = CipherAlg;
+		else if (KeyIdx == 1)
+			csr1.field.Bss1Key1CipherAlg = CipherAlg;
+		else if (KeyIdx == 2)
+			csr1.field.Bss1Key2CipherAlg = CipherAlg;
+		else
+			csr1.field.Bss1Key3CipherAlg = CipherAlg;
+	}
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("Write: SHARED_KEY_MODE_BASE at this Bss[%d] = 0x%x \n",
+		  BssIndex, csr1.word));
+	RTMP_IO_WRITE32(pAd, SHARED_KEY_MODE_BASE + 4 * (BssIndex / 2),
+			csr1.word);
+
+}
+
+/*      IRQL = DISPATCH_LEVEL */
+void AsicRemoveSharedKeyEntry(struct rt_rtmp_adapter *pAd,
+			      u8 BssIndex, u8 KeyIdx)
+{
+	/*unsigned long SecCsr0; */
+	SHAREDKEY_MODE_STRUC csr1;
+
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("AsicRemoveSharedKeyEntry: #%d \n", BssIndex * 4 + KeyIdx));
+
+	RTMP_IO_READ32(pAd, SHARED_KEY_MODE_BASE + 4 * (BssIndex / 2),
+		       &csr1.word);
+	if ((BssIndex % 2) == 0) {
+		if (KeyIdx == 0)
+			csr1.field.Bss0Key0CipherAlg = 0;
+		else if (KeyIdx == 1)
+			csr1.field.Bss0Key1CipherAlg = 0;
+		else if (KeyIdx == 2)
+			csr1.field.Bss0Key2CipherAlg = 0;
+		else
+			csr1.field.Bss0Key3CipherAlg = 0;
+	} else {
+		if (KeyIdx == 0)
+			csr1.field.Bss1Key0CipherAlg = 0;
+		else if (KeyIdx == 1)
+			csr1.field.Bss1Key1CipherAlg = 0;
+		else if (KeyIdx == 2)
+			csr1.field.Bss1Key2CipherAlg = 0;
+		else
+			csr1.field.Bss1Key3CipherAlg = 0;
+	}
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("Write: SHARED_KEY_MODE_BASE at this Bss[%d] = 0x%x \n",
+		  BssIndex, csr1.word));
+	RTMP_IO_WRITE32(pAd, SHARED_KEY_MODE_BASE + 4 * (BssIndex / 2),
+			csr1.word);
+	ASSERT(BssIndex < 4);
+	ASSERT(KeyIdx < 4);
+
+}
+
+void AsicUpdateWCIDAttribute(struct rt_rtmp_adapter *pAd,
+			     u16 WCID,
+			     u8 BssIndex,
+			     u8 CipherAlg,
+			     IN BOOLEAN bUsePairewiseKeyTable)
+{
+	unsigned long WCIDAttri = 0, offset;
+
+	/* */
+	/* Update WCID attribute. */
+	/* Only TxKey could update WCID attribute. */
+	/* */
+	offset = MAC_WCID_ATTRIBUTE_BASE + (WCID * HW_WCID_ATTRI_SIZE);
+	WCIDAttri =
+	    (BssIndex << 4) | (CipherAlg << 1) | (bUsePairewiseKeyTable);
+	RTMP_IO_WRITE32(pAd, offset, WCIDAttri);
+}
+
+void AsicUpdateWCIDIVEIV(struct rt_rtmp_adapter *pAd,
+			 u16 WCID, unsigned long uIV, unsigned long uEIV)
+{
+	unsigned long offset;
+
+	offset = MAC_IVEIV_TABLE_BASE + (WCID * HW_IVEIV_ENTRY_SIZE);
+
+	RTMP_IO_WRITE32(pAd, offset, uIV);
+	RTMP_IO_WRITE32(pAd, offset + 4, uEIV);
+}
+
+void AsicUpdateRxWCIDTable(struct rt_rtmp_adapter *pAd,
+			   u16 WCID, u8 *pAddr)
+{
+	unsigned long offset;
+	unsigned long Addr;
+
+	offset = MAC_WCID_BASE + (WCID * HW_WCID_ENTRY_SIZE);
+	Addr = pAddr[0] + (pAddr[1] << 8) + (pAddr[2] << 16) + (pAddr[3] << 24);
+	RTMP_IO_WRITE32(pAd, offset, Addr);
+	Addr = pAddr[4] + (pAddr[5] << 8);
+	RTMP_IO_WRITE32(pAd, offset + 4, Addr);
+}
+
+/*
+    ========================================================================
+
+    Routine Description:
+        Set Cipher Key, Cipher algorithm, IV/EIV to Asic
+
+    Arguments:
+        pAd                     Pointer to our adapter
+        WCID                    WCID Entry number.
+        BssIndex                BSSID index, station or none multiple BSSID support
+                                this value should be 0.
+        KeyIdx                  This KeyIdx will set to IV's KeyID if bTxKey enabled
+        pCipherKey              Pointer to Cipher Key.
+        bUsePairewiseKeyTable   TRUE means saved the key in SharedKey table,
+                                otherwise PairewiseKey table
+        bTxKey                  This is the transmit key if enabled.
+
+    Return Value:
+        None
+
+    Note:
+        This routine will set the relative key stuff to Asic including WCID attribute,
+        Cipher Key, Cipher algorithm and IV/EIV.
+
+        IV/EIV will be update if this CipherKey is the transmission key because
+        ASIC will base on IV's KeyID value to select Cipher Key.
+
+        If bTxKey sets to FALSE, this is not the TX key, but it could be
+        RX key
+
+	For AP mode bTxKey must be always set to TRUE.
+    ========================================================================
+*/
+void AsicAddKeyEntry(struct rt_rtmp_adapter *pAd,
+		     u16 WCID,
+		     u8 BssIndex,
+		     u8 KeyIdx,
+		     struct rt_cipher_key *pCipherKey,
+		     IN BOOLEAN bUsePairewiseKeyTable, IN BOOLEAN bTxKey)
+{
+	unsigned long offset;
+/*      unsigned long   WCIDAttri = 0; */
+	u8 IV4 = 0;
+	u8 *pKey = pCipherKey->Key;
+/*      unsigned long           KeyLen = pCipherKey->KeyLen; */
+	u8 *pTxMic = pCipherKey->TxMic;
+	u8 *pRxMic = pCipherKey->RxMic;
+	u8 *pTxtsc = pCipherKey->TxTsc;
+	u8 CipherAlg = pCipherKey->CipherAlg;
+	SHAREDKEY_MODE_STRUC csr1;
+#ifdef RTMP_MAC_PCI
+	u8 i;
+#endif /* RTMP_MAC_PCI // */
+
+/*      ASSERT(KeyLen <= MAX_LEN_OF_PEER_KEY); */
+
+	DBGPRINT(RT_DEBUG_TRACE, ("==> AsicAddKeyEntry\n"));
+	/* */
+	/* 1.) decide key table offset */
+	/* */
+	if (bUsePairewiseKeyTable)
+		offset = PAIRWISE_KEY_TABLE_BASE + (WCID * HW_KEY_ENTRY_SIZE);
+	else
+		offset =
+		    SHARED_KEY_TABLE_BASE + (4 * BssIndex +
+					     KeyIdx) * HW_KEY_ENTRY_SIZE;
+
+	/* */
+	/* 2.) Set Key to Asic */
+	/* */
+	/*for (i = 0; i < KeyLen; i++) */
+#ifdef RTMP_MAC_PCI
+	for (i = 0; i < MAX_LEN_OF_PEER_KEY; i++) {
+		RTMP_IO_WRITE8(pAd, offset + i, pKey[i]);
+	}
+	offset += MAX_LEN_OF_PEER_KEY;
+
+	/* */
+	/* 3.) Set MIC key if available */
+	/* */
+	if (pTxMic) {
+		for (i = 0; i < 8; i++) {
+			RTMP_IO_WRITE8(pAd, offset + i, pTxMic[i]);
+		}
+	}
+	offset += LEN_TKIP_TXMICK;
+
+	if (pRxMic) {
+		for (i = 0; i < 8; i++) {
+			RTMP_IO_WRITE8(pAd, offset + i, pRxMic[i]);
+		}
+	}
+#endif /* RTMP_MAC_PCI // */
+#ifdef RTMP_MAC_USB
+	RTUSBMultiWrite(pAd, offset, pKey, MAX_LEN_OF_PEER_KEY);
+	offset += MAX_LEN_OF_PEER_KEY;
+
+	/* */
+	/* 3.) Set MIC key if available */
+	/* */
+	if (pTxMic) {
+		RTUSBMultiWrite(pAd, offset, pTxMic, 8);
+	}
+	offset += LEN_TKIP_TXMICK;
+
+	if (pRxMic) {
+		RTUSBMultiWrite(pAd, offset, pRxMic, 8);
+	}
+#endif /* RTMP_MAC_USB // */
+
+	/* */
+	/* 4.) Modify IV/EIV if needs */
+	/*     This will force Asic to use this key ID by setting IV. */
+	/* */
+	if (bTxKey) {
+#ifdef RTMP_MAC_PCI
+		offset = MAC_IVEIV_TABLE_BASE + (WCID * HW_IVEIV_ENTRY_SIZE);
+		/* */
+		/* Write IV */
+		/* */
+		RTMP_IO_WRITE8(pAd, offset, pTxtsc[1]);
+		RTMP_IO_WRITE8(pAd, offset + 1, ((pTxtsc[1] | 0x20) & 0x7f));
+		RTMP_IO_WRITE8(pAd, offset + 2, pTxtsc[0]);
+
+		IV4 = (KeyIdx << 6);
+		if ((CipherAlg == CIPHER_TKIP)
+		    || (CipherAlg == CIPHER_TKIP_NO_MIC)
+		    || (CipherAlg == CIPHER_AES))
+			IV4 |= 0x20;	/* turn on extension bit means EIV existence */
+
+		RTMP_IO_WRITE8(pAd, offset + 3, IV4);
+
+		/* */
+		/* Write EIV */
+		/* */
+		offset += 4;
+		for (i = 0; i < 4; i++) {
+			RTMP_IO_WRITE8(pAd, offset + i, pTxtsc[i + 2]);
+		}
+#endif /* RTMP_MAC_PCI // */
+#ifdef RTMP_MAC_USB
+		u32 tmpVal;
+
+		/* */
+		/* Write IV */
+		/* */
+		IV4 = (KeyIdx << 6);
+		if ((CipherAlg == CIPHER_TKIP)
+		    || (CipherAlg == CIPHER_TKIP_NO_MIC)
+		    || (CipherAlg == CIPHER_AES))
+			IV4 |= 0x20;	/* turn on extension bit means EIV existence */
+
+		tmpVal =
+		    pTxtsc[1] + (((pTxtsc[1] | 0x20) & 0x7f) << 8) +
+		    (pTxtsc[0] << 16) + (IV4 << 24);
+		RTMP_IO_WRITE32(pAd, offset, tmpVal);
+
+		/* */
+		/* Write EIV */
+		/* */
+		offset += 4;
+		RTMP_IO_WRITE32(pAd, offset, *(u32 *)& pCipherKey->TxTsc[2]);
+#endif /* RTMP_MAC_USB // */
+
+		AsicUpdateWCIDAttribute(pAd, WCID, BssIndex, CipherAlg,
+					bUsePairewiseKeyTable);
+	}
+
+	if (!bUsePairewiseKeyTable) {
+		/* */
+		/* Only update the shared key security mode */
+		/* */
+		RTMP_IO_READ32(pAd, SHARED_KEY_MODE_BASE + 4 * (BssIndex / 2),
+			       &csr1.word);
+		if ((BssIndex % 2) == 0) {
+			if (KeyIdx == 0)
+				csr1.field.Bss0Key0CipherAlg = CipherAlg;
+			else if (KeyIdx == 1)
+				csr1.field.Bss0Key1CipherAlg = CipherAlg;
+			else if (KeyIdx == 2)
+				csr1.field.Bss0Key2CipherAlg = CipherAlg;
+			else
+				csr1.field.Bss0Key3CipherAlg = CipherAlg;
+		} else {
+			if (KeyIdx == 0)
+				csr1.field.Bss1Key0CipherAlg = CipherAlg;
+			else if (KeyIdx == 1)
+				csr1.field.Bss1Key1CipherAlg = CipherAlg;
+			else if (KeyIdx == 2)
+				csr1.field.Bss1Key2CipherAlg = CipherAlg;
+			else
+				csr1.field.Bss1Key3CipherAlg = CipherAlg;
+		}
+		RTMP_IO_WRITE32(pAd, SHARED_KEY_MODE_BASE + 4 * (BssIndex / 2),
+				csr1.word);
+	}
+
+	DBGPRINT(RT_DEBUG_TRACE, ("<== AsicAddKeyEntry\n"));
+}
+
+/*
+	========================================================================
+	Description:
+		Add Pair-wise key material into ASIC.
+		Update pairwise key, TxMic and RxMic to Asic Pair-wise key table
+
+    Return:
+	========================================================================
+*/
+void AsicAddPairwiseKeyEntry(struct rt_rtmp_adapter *pAd,
+			     u8 *pAddr,
+			     u8 WCID, struct rt_cipher_key *pCipherKey)
+{
+	int i;
+	unsigned long offset;
+	u8 *pKey = pCipherKey->Key;
+	u8 *pTxMic = pCipherKey->TxMic;
+	u8 *pRxMic = pCipherKey->RxMic;
+#ifdef DBG
+	u8 CipherAlg = pCipherKey->CipherAlg;
+#endif /* DBG // */
+
+	/* EKEY */
+	offset = PAIRWISE_KEY_TABLE_BASE + (WCID * HW_KEY_ENTRY_SIZE);
+#ifdef RTMP_MAC_PCI
+	for (i = 0; i < MAX_LEN_OF_PEER_KEY; i++) {
+		RTMP_IO_WRITE8(pAd, offset + i, pKey[i]);
+	}
+#endif /* RTMP_MAC_PCI // */
+#ifdef RTMP_MAC_USB
+	RTUSBMultiWrite(pAd, offset, &pCipherKey->Key[0], MAX_LEN_OF_PEER_KEY);
+#endif /* RTMP_MAC_USB // */
+	for (i = 0; i < MAX_LEN_OF_PEER_KEY; i += 4) {
+		u32 Value;
+		RTMP_IO_READ32(pAd, offset + i, &Value);
+	}
+
+	offset += MAX_LEN_OF_PEER_KEY;
+
+	/*  MIC KEY */
+	if (pTxMic) {
+#ifdef RTMP_MAC_PCI
+		for (i = 0; i < 8; i++) {
+			RTMP_IO_WRITE8(pAd, offset + i, pTxMic[i]);
+		}
+#endif /* RTMP_MAC_PCI // */
+#ifdef RTMP_MAC_USB
+		RTUSBMultiWrite(pAd, offset, &pCipherKey->TxMic[0], 8);
+#endif /* RTMP_MAC_USB // */
+	}
+	offset += 8;
+	if (pRxMic) {
+#ifdef RTMP_MAC_PCI
+		for (i = 0; i < 8; i++) {
+			RTMP_IO_WRITE8(pAd, offset + i, pRxMic[i]);
+		}
+#endif /* RTMP_MAC_PCI // */
+#ifdef RTMP_MAC_USB
+		RTUSBMultiWrite(pAd, offset, &pCipherKey->RxMic[0], 8);
+#endif /* RTMP_MAC_USB // */
+	}
+
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("AsicAddPairwiseKeyEntry: WCID #%d Alg=%s\n", WCID,
+		  CipherName[CipherAlg]));
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("	Key = %02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x\n",
+		  pKey[0], pKey[1], pKey[2], pKey[3], pKey[4], pKey[5],
+		  pKey[6], pKey[7], pKey[8], pKey[9], pKey[10], pKey[11],
+		  pKey[12], pKey[13], pKey[14], pKey[15]));
+	if (pRxMic) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("	Rx MIC Key = %02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x\n",
+			  pRxMic[0], pRxMic[1], pRxMic[2], pRxMic[3],
+			  pRxMic[4], pRxMic[5], pRxMic[6], pRxMic[7]));
+	}
+	if (pTxMic) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("	Tx MIC Key = %02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x\n",
+			  pTxMic[0], pTxMic[1], pTxMic[2], pTxMic[3],
+			  pTxMic[4], pTxMic[5], pTxMic[6], pTxMic[7]));
+	}
+}
+
+/*
+	========================================================================
+	Description:
+		Remove Pair-wise key material from ASIC.
+
+    Return:
+	========================================================================
+*/
+void AsicRemovePairwiseKeyEntry(struct rt_rtmp_adapter *pAd,
+				u8 BssIdx, u8 Wcid)
+{
+	unsigned long WCIDAttri;
+	u16 offset;
+
+	/* re-set the entry's WCID attribute as OPEN-NONE. */
+	offset = MAC_WCID_ATTRIBUTE_BASE + (Wcid * HW_WCID_ATTRI_SIZE);
+	WCIDAttri = (BssIdx << 4) | PAIRWISEKEYTABLE;
+	RTMP_IO_WRITE32(pAd, offset, WCIDAttri);
+}
+
+BOOLEAN AsicSendCommandToMcu(struct rt_rtmp_adapter *pAd,
+			     u8 Command,
+			     u8 Token, u8 Arg0, u8 Arg1)
+{
+
+	if (pAd->chipOps.sendCommandToMcu)
+		pAd->chipOps.sendCommandToMcu(pAd, Command, Token, Arg0, Arg1);
+
+	return TRUE;
+}
+
+void AsicSetRxAnt(struct rt_rtmp_adapter *pAd, u8 Ant)
+{
+#ifdef RT30xx
+	/* RT3572 ATE need not to do this. */
+	RT30xxSetRxAnt(pAd, Ant);
+#endif /* RT30xx // */
+}
+
+void AsicTurnOffRFClk(struct rt_rtmp_adapter *pAd, u8 Channel)
+{
+	if (pAd->chipOps.AsicRfTurnOff) {
+		pAd->chipOps.AsicRfTurnOff(pAd);
+	} else {
+		/* RF R2 bit 18 = 0 */
+		u32 R1 = 0, R2 = 0, R3 = 0;
+		u8 index;
+		struct rt_rtmp_rf_regs *RFRegTable;
+
+		RFRegTable = RF2850RegTable;
+
+		switch (pAd->RfIcType) {
+		case RFIC_2820:
+		case RFIC_2850:
+		case RFIC_2720:
+		case RFIC_2750:
+
+			for (index = 0; index < NUM_OF_2850_CHNL; index++) {
+				if (Channel == RFRegTable[index].Channel) {
+					R1 = RFRegTable[index].R1 & 0xffffdfff;
+					R2 = RFRegTable[index].R2 & 0xfffbffff;
+					R3 = RFRegTable[index].R3 & 0xfff3ffff;
+
+					RTMP_RF_IO_WRITE32(pAd, R1);
+					RTMP_RF_IO_WRITE32(pAd, R2);
+
+					/* Program R1b13 to 1, R3/b18,19 to 0, R2b18 to 0. */
+					/* Set RF R2 bit18=0, R3 bit[18:19]=0 */
+					/*if (pAd->StaCfg.bRadio == FALSE) */
+					if (1) {
+						RTMP_RF_IO_WRITE32(pAd, R3);
+
+						DBGPRINT(RT_DEBUG_TRACE,
+							 ("AsicTurnOffRFClk#%d(RF=%d, ) , R2=0x%08x,  R3 = 0x%08x \n",
+							  Channel,
+							  pAd->RfIcType, R2,
+							  R3));
+					} else
+						DBGPRINT(RT_DEBUG_TRACE,
+							 ("AsicTurnOffRFClk#%d(RF=%d, ) , R2=0x%08x \n",
+							  Channel,
+							  pAd->RfIcType, R2));
+					break;
+				}
+			}
+			break;
+
+		default:
+			break;
+		}
+	}
+}
+
+void AsicTurnOnRFClk(struct rt_rtmp_adapter *pAd, u8 Channel)
+{
+	/* RF R2 bit 18 = 0 */
+	u32 R1 = 0, R2 = 0, R3 = 0;
+	u8 index;
+	struct rt_rtmp_rf_regs *RFRegTable;
+
+#ifdef PCIE_PS_SUPPORT
+	/* The RF programming sequence is difference between 3xxx and 2xxx */
+	if ((IS_RT3090(pAd) || IS_RT3572(pAd) || IS_RT3390(pAd))) {
+		return;
+	}
+#endif /* PCIE_PS_SUPPORT // */
+
+	RFRegTable = RF2850RegTable;
+
+	switch (pAd->RfIcType) {
+	case RFIC_2820:
+	case RFIC_2850:
+	case RFIC_2720:
+	case RFIC_2750:
+
+		for (index = 0; index < NUM_OF_2850_CHNL; index++) {
+			if (Channel == RFRegTable[index].Channel) {
+				R3 = pAd->LatchRfRegs.R3;
+				R3 &= 0xfff3ffff;
+				R3 |= 0x00080000;
+				RTMP_RF_IO_WRITE32(pAd, R3);
+
+				R1 = RFRegTable[index].R1;
+				RTMP_RF_IO_WRITE32(pAd, R1);
+
+				R2 = RFRegTable[index].R2;
+				if (pAd->Antenna.field.TxPath == 1) {
+					R2 |= 0x4000;	/* If TXpath is 1, bit 14 = 1; */
+				}
+
+				if (pAd->Antenna.field.RxPath == 2) {
+					R2 |= 0x40;	/* write 1 to off Rxpath. */
+				} else if (pAd->Antenna.field.RxPath == 1) {
+					R2 |= 0x20040;	/* write 1 to off RxPath */
+				}
+				RTMP_RF_IO_WRITE32(pAd, R2);
+
+				break;
+			}
+		}
+		break;
+
+	default:
+		break;
+	}
+
+	DBGPRINT(RT_DEBUG_TRACE, ("AsicTurnOnRFClk#%d(RF=%d, ) , R2=0x%08x\n",
+				  Channel, pAd->RfIcType, R2));
+}
diff --git a/drivers/staging/rt3090/common/cmm_cfg.c b/drivers/staging/rt2860/common/cmm_cfg.c
index d8be9793c61b..24f439378439 100644
--- a/drivers/staging/rt3090/common/cmm_cfg.c
+++ b/drivers/staging/rt2860/common/cmm_cfg.c
@@ -37,50 +37,39 @@
 
 #include "../rt_config.h"
 
-
-char* GetPhyMode(
-	int Mode)
+char *GetPhyMode(int Mode)
 {
-	switch(Mode)
-	{
-		case MODE_CCK:
-			return "CCK";
-
-		case MODE_OFDM:
-			return "OFDM";
-#ifdef DOT11_N_SUPPORT
-		case MODE_HTMIX:
-			return "HTMIX";
-
-		case MODE_HTGREENFIELD:
-			return "GREEN";
-#endif // DOT11_N_SUPPORT //
-		default:
-			return "N/A";
+	switch (Mode) {
+	case MODE_CCK:
+		return "CCK";
+
+	case MODE_OFDM:
+		return "OFDM";
+	case MODE_HTMIX:
+		return "HTMIX";
+
+	case MODE_HTGREENFIELD:
+		return "GREEN";
+	default:
+		return "N/A";
 	}
 }
 
-
-char* GetBW(
-	int BW)
+char *GetBW(int BW)
 {
-	switch(BW)
-	{
-		case BW_10:
-			return "10M";
-
-		case BW_20:
-			return "20M";
-#ifdef DOT11_N_SUPPORT
-		case BW_40:
-			return "40M";
-#endif // DOT11_N_SUPPORT //
-		default:
-			return "N/A";
+	switch (BW) {
+	case BW_10:
+		return "10M";
+
+	case BW_20:
+		return "20M";
+	case BW_40:
+		return "40M";
+	default:
+		return "N/A";
 	}
 }
 
-
 /*
     ==========================================================================
     Description:
@@ -91,46 +80,37 @@ char* GetBW(
         TRUE if all parameters are OK, FALSE otherwise
     ==========================================================================
 */
-INT RT_CfgSetCountryRegion(
-	IN PRTMP_ADAPTER	pAd,
-	IN PSTRING			arg,
-	IN INT				band)
+int RT_CfgSetCountryRegion(struct rt_rtmp_adapter *pAd, char *arg, int band)
 {
-	LONG region, regionMax;
-	UCHAR *pCountryRegion;
+	long region, regionMax;
+	u8 *pCountryRegion;
 
 	region = simple_strtol(arg, 0, 10);
 
-	if (band == BAND_24G)
-	{
+	if (band == BAND_24G) {
 		pCountryRegion = &pAd->CommonCfg.CountryRegion;
 		regionMax = REGION_MAXIMUM_BG_BAND;
-	}
-	else
-	{
+	} else {
 		pCountryRegion = &pAd->CommonCfg.CountryRegionForABand;
 		regionMax = REGION_MAXIMUM_A_BAND;
 	}
 
-	// TODO: Is it neccesay for following check???
-	// Country can be set only when EEPROM not programmed
-	if (*pCountryRegion & 0x80)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("CfgSetCountryRegion():CountryRegion in eeprom was programmed\n"));
+	/* TODO: Is it neccesay for following check??? */
+	/* Country can be set only when EEPROM not programmed */
+	if (*pCountryRegion & 0x80) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("CfgSetCountryRegion():CountryRegion in eeprom was programmed\n"));
 		return FALSE;
 	}
 
-	if((region >= 0) && (region <= REGION_MAXIMUM_BG_BAND))
-	{
-		*pCountryRegion= (UCHAR) region;
-	}
-	else if ((region == REGION_31_BG_BAND) && (band == BAND_24G))
-	{
-		*pCountryRegion = (UCHAR) region;
-	}
-	else
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("CfgSetCountryRegion():region(%ld) out of range!\n", region));
+	if ((region >= 0) && (region <= REGION_MAXIMUM_BG_BAND)) {
+		*pCountryRegion = (u8)region;
+	} else if ((region == REGION_31_BG_BAND) && (band == BAND_24G)) {
+		*pCountryRegion = (u8)region;
+	} else {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("CfgSetCountryRegion():region(%ld) out of range!\n",
+			  region));
 		return FALSE;
 	}
 
@@ -138,7 +118,6 @@ INT RT_CfgSetCountryRegion(
 
 }
 
-
 /*
     ==========================================================================
     Description:
@@ -147,22 +126,16 @@ INT RT_CfgSetCountryRegion(
         TRUE if all parameters are OK, FALSE otherwise
     ==========================================================================
 */
-INT RT_CfgSetWirelessMode(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
+int RT_CfgSetWirelessMode(struct rt_rtmp_adapter *pAd, char *arg)
 {
-	INT		MaxPhyMode = PHY_11G;
-	LONG	WirelessMode;
+	int MaxPhyMode = PHY_11G;
+	long WirelessMode;
 
-#ifdef DOT11_N_SUPPORT
 	MaxPhyMode = PHY_11N_5G;
-#endif // DOT11_N_SUPPORT //
 
 	WirelessMode = simple_strtol(arg, 0, 10);
-	if (WirelessMode <= MaxPhyMode)
-	{
+	if (WirelessMode <= MaxPhyMode) {
 		pAd->CommonCfg.PhyMode = WirelessMode;
-		pAd->CommonCfg.DesiredPhyMode = WirelessMode;
 		return TRUE;
 	}
 
@@ -170,12 +143,9 @@ INT RT_CfgSetWirelessMode(
 
 }
 
-
-INT RT_CfgSetShortSlot(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
+int RT_CfgSetShortSlot(struct rt_rtmp_adapter *pAd, char *arg)
 {
-	LONG ShortSlot;
+	long ShortSlot;
 
 	ShortSlot = simple_strtol(arg, 0, 10);
 
@@ -184,12 +154,11 @@ INT RT_CfgSetShortSlot(
 	else if (ShortSlot == 0)
 		pAd->CommonCfg.bUseShortSlotTime = FALSE;
 	else
-		return FALSE;  //Invalid argument
+		return FALSE;	/*Invalid argument */
 
 	return TRUE;
 }
 
-
 /*
     ==========================================================================
     Description:
@@ -198,54 +167,53 @@ INT RT_CfgSetShortSlot(
         TRUE if all parameters are OK, FALSE otherwise
     ==========================================================================
 */
-INT	RT_CfgSetWepKey(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			keyString,
-	IN	CIPHER_KEY		*pSharedKey,
-	IN	INT				keyIdx)
+int RT_CfgSetWepKey(struct rt_rtmp_adapter *pAd,
+		    char *keyString,
+		    struct rt_cipher_key *pSharedKey, int keyIdx)
 {
-	INT				KeyLen;
-	INT				i;
-	UCHAR			CipherAlg = CIPHER_NONE;
-	BOOLEAN			bKeyIsHex = FALSE;
+	int KeyLen;
+	int i;
+	u8 CipherAlg = CIPHER_NONE;
+	BOOLEAN bKeyIsHex = FALSE;
 
-	// TODO: Shall we do memset for the original key info??
-	memset(pSharedKey, 0, sizeof(CIPHER_KEY));
+	/* TODO: Shall we do memset for the original key info?? */
+	memset(pSharedKey, 0, sizeof(struct rt_cipher_key));
 	KeyLen = strlen(keyString);
-	switch (KeyLen)
-	{
-		case 5: //wep 40 Ascii type
-		case 13: //wep 104 Ascii type
-			bKeyIsHex = FALSE;
-			pSharedKey->KeyLen = KeyLen;
-			NdisMoveMemory(pSharedKey->Key, keyString, KeyLen);
-			break;
-
-		case 10: //wep 40 Hex type
-		case 26: //wep 104 Hex type
-			for(i=0; i < KeyLen; i++)
-			{
-				if( !isxdigit(*(keyString+i)) )
-					return FALSE;  //Not Hex value;
-			}
-			bKeyIsHex = TRUE;
-			pSharedKey->KeyLen = KeyLen/2 ;
-			AtoH(keyString, pSharedKey->Key, pSharedKey->KeyLen);
-			break;
-
-		default: //Invalid argument
-			DBGPRINT(RT_DEBUG_TRACE, ("RT_CfgSetWepKey(keyIdx=%d):Invalid argument (arg=%s)\n", keyIdx, keyString));
-			return FALSE;
+	switch (KeyLen) {
+	case 5:		/*wep 40 Ascii type */
+	case 13:		/*wep 104 Ascii type */
+		bKeyIsHex = FALSE;
+		pSharedKey->KeyLen = KeyLen;
+		NdisMoveMemory(pSharedKey->Key, keyString, KeyLen);
+		break;
+
+	case 10:		/*wep 40 Hex type */
+	case 26:		/*wep 104 Hex type */
+		for (i = 0; i < KeyLen; i++) {
+			if (!isxdigit(*(keyString + i)))
+				return FALSE;	/*Not Hex value; */
+		}
+		bKeyIsHex = TRUE;
+		pSharedKey->KeyLen = KeyLen / 2;
+		AtoH(keyString, pSharedKey->Key, pSharedKey->KeyLen);
+		break;
+
+	default:		/*Invalid argument */
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("RT_CfgSetWepKey(keyIdx=%d):Invalid argument (arg=%s)\n",
+			  keyIdx, keyString));
+		return FALSE;
 	}
 
 	pSharedKey->CipherAlg = ((KeyLen % 5) ? CIPHER_WEP128 : CIPHER_WEP64);
-	DBGPRINT(RT_DEBUG_TRACE, ("RT_CfgSetWepKey:(KeyIdx=%d,type=%s, Alg=%s)\n",
-						keyIdx, (bKeyIsHex == FALSE ? "Ascii" : "Hex"), CipherName[CipherAlg]));
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("RT_CfgSetWepKey:(KeyIdx=%d,type=%s, Alg=%s)\n", keyIdx,
+		  (bKeyIsHex == FALSE ? "Ascii" : "Hex"),
+		  CipherName[CipherAlg]));
 
 	return TRUE;
 }
 
-
 /*
     ==========================================================================
     Description:
@@ -262,33 +230,28 @@ INT	RT_CfgSetWepKey(
         TRUE if all parameters are OK, FALSE otherwise
     ==========================================================================
 */
-INT RT_CfgSetWPAPSKKey(
-	IN RTMP_ADAPTER	*pAd,
-	IN PSTRING		keyString,
-	IN UCHAR		*pHashStr,
-	IN INT			hashStrLen,
-	OUT PUCHAR		pPMKBuf)
+int RT_CfgSetWPAPSKKey(struct rt_rtmp_adapter *pAd,
+		       char *keyString,
+		       u8 * pHashStr,
+		       int hashStrLen, u8 *pPMKBuf)
 {
 	int keyLen;
-	UCHAR keyMaterial[40];
+	u8 keyMaterial[40];
 
 	keyLen = strlen(keyString);
-	if ((keyLen < 8) || (keyLen > 64))
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("WPAPSK Key length(%d) error, required 8 ~ 64 characters!(keyStr=%s)\n",
-									keyLen, keyString));
+	if ((keyLen < 8) || (keyLen > 64)) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("WPAPSK Key length(%d) error, required 8 ~ 64 characters!(keyStr=%s)\n",
+			  keyLen, keyString));
 		return FALSE;
 	}
 
 	memset(pPMKBuf, 0, 32);
-	if (keyLen == 64)
-	{
-	    AtoH(keyString, pPMKBuf, 32);
-	}
-	else
-	{
-	    PasswordHash(keyString, pHashStr, hashStrLen, keyMaterial);
-	    NdisMoveMemory(pPMKBuf, keyMaterial, 32);
+	if (keyLen == 64) {
+		AtoH(keyString, pPMKBuf, 32);
+	} else {
+		PasswordHash(keyString, pHashStr, hashStrLen, keyMaterial);
+		NdisMoveMemory(pPMKBuf, keyMaterial, 32);
 	}
 
 	return TRUE;
diff --git a/drivers/staging/rt2860/common/cmm_data.c b/drivers/staging/rt2860/common/cmm_data.c
index 774fabb0be40..68263cee7952 100644
--- a/drivers/staging/rt2860/common/cmm_data.c
+++ b/drivers/staging/rt2860/common/cmm_data.c
@@ -27,50 +27,58 @@
 
 #include "../rt_config.h"
 
-#define MAX_TX_IN_TBTT		(16)
-
-
-UCHAR	SNAP_802_1H[] = {0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00};
-UCHAR	SNAP_BRIDGE_TUNNEL[] = {0xaa, 0xaa, 0x03, 0x00, 0x00, 0xf8};
-// Add Cisco Aironet SNAP heade for CCX2 support
-UCHAR	SNAP_AIRONET[] = {0xaa, 0xaa, 0x03, 0x00, 0x40, 0x96, 0x00, 0x00};
-UCHAR	CKIP_LLC_SNAP[] = {0xaa, 0xaa, 0x03, 0x00, 0x40, 0x96, 0x00, 0x02};
-UCHAR	EAPOL_LLC_SNAP[]= {0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00, 0x88, 0x8e};
-UCHAR	EAPOL[] = {0x88, 0x8e};
-UCHAR   TPID[] = {0x81, 0x00}; /* VLAN related */
-
-UCHAR	IPX[] = {0x81, 0x37};
-UCHAR	APPLE_TALK[] = {0x80, 0xf3};
-UCHAR	RateIdToPlcpSignal[12] = {
-	 0, /* RATE_1 */	1, /* RATE_2 */ 	2, /* RATE_5_5 */	3, /* RATE_11 */	// see BBP spec
-	11, /* RATE_6 */   15, /* RATE_9 */    10, /* RATE_12 */   14, /* RATE_18 */	// see IEEE802.11a-1999 p.14
-	 9, /* RATE_24 */  13, /* RATE_36 */	8, /* RATE_48 */   12  /* RATE_54 */ }; // see IEEE802.11a-1999 p.14
-
-UCHAR	 OfdmSignalToRateId[16] = {
-	RATE_54,  RATE_54,	RATE_54,  RATE_54,	// OFDM PLCP Signal = 0,  1,  2,  3 respectively
-	RATE_54,  RATE_54,	RATE_54,  RATE_54,	// OFDM PLCP Signal = 4,  5,  6,  7 respectively
-	RATE_48,  RATE_24,	RATE_12,  RATE_6,	// OFDM PLCP Signal = 8,  9,  10, 11 respectively
-	RATE_54,  RATE_36,	RATE_18,  RATE_9,	// OFDM PLCP Signal = 12, 13, 14, 15 respectively
+u8 SNAP_802_1H[] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
+u8 SNAP_BRIDGE_TUNNEL[] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0xf8 };
+
+/* Add Cisco Aironet SNAP heade for CCX2 support */
+u8 SNAP_AIRONET[] = { 0xaa, 0xaa, 0x03, 0x00, 0x40, 0x96, 0x00, 0x00 };
+u8 CKIP_LLC_SNAP[] = { 0xaa, 0xaa, 0x03, 0x00, 0x40, 0x96, 0x00, 0x02 };
+u8 EAPOL_LLC_SNAP[] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00, 0x88, 0x8e };
+u8 EAPOL[] = { 0x88, 0x8e };
+u8 TPID[] = { 0x81, 0x00 };	/* VLAN related */
+
+u8 IPX[] = { 0x81, 0x37 };
+u8 APPLE_TALK[] = { 0x80, 0xf3 };
+
+u8 RateIdToPlcpSignal[12] = {
+	0, /* RATE_1 */ 1, /* RATE_2 */ 2, /* RATE_5_5 */ 3,	/* RATE_11 *//* see BBP spec */
+	11, /* RATE_6 */ 15, /* RATE_9 */ 10, /* RATE_12 */ 14,	/* RATE_18 *//* see IEEE802.11a-1999 p.14 */
+	9, /* RATE_24 */ 13, /* RATE_36 */ 8, /* RATE_48 */ 12 /* RATE_54 */
+};				/* see IEEE802.11a-1999 p.14 */
+
+u8 OfdmSignalToRateId[16] = {
+	RATE_54, RATE_54, RATE_54, RATE_54,	/* OFDM PLCP Signal = 0,  1,  2,  3 respectively */
+	RATE_54, RATE_54, RATE_54, RATE_54,	/* OFDM PLCP Signal = 4,  5,  6,  7 respectively */
+	RATE_48, RATE_24, RATE_12, RATE_6,	/* OFDM PLCP Signal = 8,  9,  10, 11 respectively */
+	RATE_54, RATE_36, RATE_18, RATE_9,	/* OFDM PLCP Signal = 12, 13, 14, 15 respectively */
 };
 
-UCHAR	 OfdmRateToRxwiMCS[12] = {
-	0,  0,	0,  0,
-	0,  1,	2,  3,	// OFDM rate 6,9,12,18 = rxwi mcs 0,1,2,3
-	4,  5,	6,  7,	// OFDM rate 24,36,48,54 = rxwi mcs 4,5,6,7
-};
-UCHAR	 RxwiMCSToOfdmRate[12] = {
-	RATE_6,  RATE_9,	RATE_12,  RATE_18,
-	RATE_24,  RATE_36,	RATE_48,  RATE_54,	// OFDM rate 6,9,12,18 = rxwi mcs 0,1,2,3
-	4,  5,	6,  7,	// OFDM rate 24,36,48,54 = rxwi mcs 4,5,6,7
+u8 OfdmRateToRxwiMCS[12] = {
+	0, 0, 0, 0,
+	0, 1, 2, 3,		/* OFDM rate 6,9,12,18 = rxwi mcs 0,1,2,3 */
+	4, 5, 6, 7,		/* OFDM rate 24,36,48,54 = rxwi mcs 4,5,6,7 */
 };
 
-char*   MCSToMbps[] = {"1Mbps","2Mbps","5.5Mbps","11Mbps","06Mbps","09Mbps","12Mbps","18Mbps","24Mbps","36Mbps","48Mbps","54Mbps","MM-0","MM-1","MM-2","MM-3","MM-4","MM-5","MM-6","MM-7","MM-8","MM-9","MM-10","MM-11","MM-12","MM-13","MM-14","MM-15","MM-32","ee1","ee2","ee3"};
+u8 RxwiMCSToOfdmRate[12] = {
+	RATE_6, RATE_9, RATE_12, RATE_18,
+	RATE_24, RATE_36, RATE_48, RATE_54,	/* OFDM rate 6,9,12,18 = rxwi mcs 0,1,2,3 */
+	4, 5, 6, 7,		/* OFDM rate 24,36,48,54 = rxwi mcs 4,5,6,7 */
+};
 
-UCHAR default_cwmin[]={CW_MIN_IN_BITS, CW_MIN_IN_BITS, CW_MIN_IN_BITS-1, CW_MIN_IN_BITS-2};
-UCHAR default_sta_aifsn[]={3,7,2,2};
+char *MCSToMbps[] =
+    { "1Mbps", "2Mbps", "5.5Mbps", "11Mbps", "06Mbps", "09Mbps", "12Mbps",
+"18Mbps", "24Mbps", "36Mbps", "48Mbps", "54Mbps", "MM-0", "MM-1", "MM-2", "MM-3",
+"MM-4", "MM-5", "MM-6", "MM-7", "MM-8", "MM-9", "MM-10", "MM-11", "MM-12", "MM-13",
+"MM-14", "MM-15", "MM-32", "ee1", "ee2", "ee3" };
 
-UCHAR MapUserPriorityToAccessCategory[8] = {QID_AC_BE, QID_AC_BK, QID_AC_BK, QID_AC_BE, QID_AC_VI, QID_AC_VI, QID_AC_VO, QID_AC_VO};
+u8 default_cwmin[] =
+    { CW_MIN_IN_BITS, CW_MIN_IN_BITS, CW_MIN_IN_BITS - 1, CW_MIN_IN_BITS - 2 };
+/*u8 default_cwmax[]={CW_MAX_IN_BITS, CW_MAX_IN_BITS, CW_MIN_IN_BITS, CW_MIN_IN_BITS-1}; */
+u8 default_sta_aifsn[] = { 3, 7, 2, 2 };
 
+u8 MapUserPriorityToAccessCategory[8] =
+    { QID_AC_BE, QID_AC_BK, QID_AC_BK, QID_AC_BE, QID_AC_VI, QID_AC_VI,
+QID_AC_VO, QID_AC_VO };
 
 /*
 	========================================================================
@@ -96,162 +104,119 @@ UCHAR MapUserPriorityToAccessCategory[8] = {QID_AC_BE, QID_AC_BK, QID_AC_BK, QID
 
 	========================================================================
 */
-NDIS_STATUS MiniportMMRequest(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			QueIdx,
-	IN	PUCHAR			pData,
-	IN	UINT			Length)
+int MiniportMMRequest(struct rt_rtmp_adapter *pAd,
+			      u8 QueIdx, u8 *pData, u32 Length)
 {
-	PNDIS_PACKET	pPacket;
-	NDIS_STATUS  	Status = NDIS_STATUS_SUCCESS;
-	ULONG	 		FreeNum;
-#ifdef RT2860
-	unsigned long	IrqFlags = 0;
-#endif
-	UCHAR			IrqState;
-	UCHAR			rtmpHwHdr[TXINFO_SIZE + TXWI_SIZE]; //RTMP_HW_HDR_LEN];
+	void *pPacket;
+	int Status = NDIS_STATUS_SUCCESS;
+	unsigned long FreeNum;
+	u8 rtmpHwHdr[TXINFO_SIZE + TXWI_SIZE];	/*RTMP_HW_HDR_LEN]; */
+#ifdef RTMP_MAC_PCI
+	unsigned long IrqFlags = 0;
+	u8 IrqState;
+#endif /* RTMP_MAC_PCI // */
+	BOOLEAN bUseDataQ = FALSE;
+	int retryCnt = 0;
 
 	ASSERT(Length <= MGMT_DMA_BUFFER_SIZE);
 
-	QueIdx=3;
-
-	// 2860C use Tx Ring
-
+	if ((QueIdx & MGMT_USE_QUEUE_FLAG) == MGMT_USE_QUEUE_FLAG) {
+		bUseDataQ = TRUE;
+		QueIdx &= (~MGMT_USE_QUEUE_FLAG);
+	}
+#ifdef RTMP_MAC_PCI
+	/* 2860C use Tx Ring */
 	IrqState = pAd->irq_disabled;
-
-#ifdef RT2860
-	if ((pAd->MACVersion == 0x28600100) && (!IrqState))
+	if (pAd->MACVersion == 0x28600100) {
+		QueIdx = (bUseDataQ == TRUE ? QueIdx : 3);
+		bUseDataQ = TRUE;
+	}
+	if (bUseDataQ && (!IrqState))
 		RTMP_IRQ_LOCK(&pAd->irq_lock, IrqFlags);
-#endif
-	do
-	{
-		// Reset is in progress, stop immediately
-		if ( RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RESET_IN_PROGRESS) ||
-			 RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST)||
-			 !RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_START_UP))
-		{
+#endif /* RTMP_MAC_PCI // */
+
+	do {
+		/* Reset is in progress, stop immediately */
+		if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RESET_IN_PROGRESS) ||
+		    RTMP_TEST_FLAG(pAd,
+				   fRTMP_ADAPTER_HALT_IN_PROGRESS |
+				   fRTMP_ADAPTER_NIC_NOT_EXIST)
+		    || !RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_START_UP)) {
 			Status = NDIS_STATUS_FAILURE;
 			break;
 		}
-
-		// Check Free priority queue
-		// Since we use PBF Queue2 for management frame.  Its corresponding DMA ring should be using TxRing.
-
-		// 2860C use Tx Ring
-		if (pAd->MACVersion == 0x28600100)
-		{
+		/* Check Free priority queue */
+		/* Since we use PBF Queue2 for management frame.  Its corresponding DMA ring should be using TxRing. */
+#ifdef RTMP_MAC_PCI
+		if (bUseDataQ) {
+			retryCnt = MAX_DATAMM_RETRY;
+			/* free Tx(QueIdx) resources */
+			RTMPFreeTXDUponTxDmaDone(pAd, QueIdx);
 			FreeNum = GET_TXRING_FREENO(pAd, QueIdx);
-		}
-		else
+		} else
+#endif /* RTMP_MAC_PCI // */
 		{
 			FreeNum = GET_MGMTRING_FREENO(pAd);
 		}
 
-		if ((FreeNum > 0))
-		{
-			// We need to reserve space for rtmp hardware header. i.e., TxWI for RT2860 and TxInfo+TxWI for RT2870
+		if ((FreeNum > 0)) {
+			/* We need to reserve space for rtmp hardware header. i.e., TxWI for RT2860 and TxInfo+TxWI for RT2870 */
 			NdisZeroMemory(&rtmpHwHdr, (TXINFO_SIZE + TXWI_SIZE));
-			Status = RTMPAllocateNdisPacket(pAd, &pPacket, (PUCHAR)&rtmpHwHdr, (TXINFO_SIZE + TXWI_SIZE), pData, Length);
-			if (Status != NDIS_STATUS_SUCCESS)
-			{
-				DBGPRINT(RT_DEBUG_WARN, ("MiniportMMRequest (error:: can't allocate NDIS PACKET)\n"));
+			Status =
+			    RTMPAllocateNdisPacket(pAd, &pPacket,
+						   (u8 *)& rtmpHwHdr,
+						   (TXINFO_SIZE + TXWI_SIZE),
+						   pData, Length);
+			if (Status != NDIS_STATUS_SUCCESS) {
+				DBGPRINT(RT_DEBUG_WARN,
+					 ("MiniportMMRequest (error:: can't allocate NDIS PACKET)\n"));
 				break;
 			}
-
-			//pAd->CommonCfg.MlmeTransmit.field.MODE = MODE_CCK;
-			//pAd->CommonCfg.MlmeRate = RATE_2;
-
-
-			Status = MlmeHardTransmit(pAd, QueIdx, pPacket);
-			if (Status != NDIS_STATUS_SUCCESS)
+			/*pAd->CommonCfg.MlmeTransmit.field.MODE = MODE_CCK; */
+			/*pAd->CommonCfg.MlmeRate = RATE_2; */
+
+#ifdef RTMP_MAC_PCI
+			if (bUseDataQ) {
+				Status =
+				    MlmeDataHardTransmit(pAd, QueIdx, pPacket);
+				retryCnt--;
+			} else
+#endif /* RTMP_MAC_PCI // */
+				Status = MlmeHardTransmit(pAd, QueIdx, pPacket);
+			if (Status == NDIS_STATUS_SUCCESS)
+				retryCnt = 0;
+			else
 				RTMPFreeNdisPacket(pAd, pPacket);
-		}
-		else
-		{
+		} else {
 			pAd->RalinkCounters.MgmtRingFullCount++;
-			DBGPRINT(RT_DEBUG_ERROR, ("Qidx(%d), not enough space in MgmtRing, MgmtRingFullCount=%ld!\n",
-										QueIdx, pAd->RalinkCounters.MgmtRingFullCount));
-		}
-
-	} while (FALSE);
-
-#ifdef RT2860
-	// 2860C use Tx Ring
-	if ((pAd->MACVersion == 0x28600100) && (!IrqState))
-		RTMP_IRQ_UNLOCK(&pAd->irq_lock, IrqFlags);
-#endif
-	return Status;
-}
-
-#ifdef RT2860
-NDIS_STATUS MiniportMMRequestUnlock(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			QueIdx,
-	IN	PUCHAR			pData,
-	IN	UINT			Length)
-{
-	PNDIS_PACKET	pPacket;
-	NDIS_STATUS  Status = NDIS_STATUS_SUCCESS;
-	ULONG	 FreeNum;
-	TXWI_STRUC		TXWI;
-	ULONG	SW_TX_IDX;
-	PTXD_STRUC		pTxD;
-
-	QueIdx = 3;
-	ASSERT(Length <= MGMT_DMA_BUFFER_SIZE);
-
-	do
-	{
-		// Reset is in progress, stop immediately
-		if ( RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RESET_IN_PROGRESS) ||
-			 RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST)||
-			 !RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_START_UP))
-		{
-			Status = NDIS_STATUS_FAILURE;
-			break;
-		}
-
-		// Check Free priority queue
-		// Since we use PBF Queue2 for management frame.  Its corresponding DMA ring should be using TxRing.
-		// 2860C use Tx Ring
-		if (pAd->MACVersion == 0x28600100)
-		{
-			FreeNum = GET_TXRING_FREENO(pAd, QueIdx);
-			SW_TX_IDX = pAd->TxRing[QueIdx].TxCpuIdx;
-			pTxD  = (PTXD_STRUC) pAd->TxRing[QueIdx].Cell[SW_TX_IDX].AllocVa;
-		}
-		else
-		{
-			FreeNum = GET_MGMTRING_FREENO(pAd);
-			SW_TX_IDX = pAd->MgmtRing.TxCpuIdx;
-			pTxD  = (PTXD_STRUC) pAd->MgmtRing.Cell[SW_TX_IDX].AllocVa;
-		}
-		if ((FreeNum > 0))
-		{
-			NdisZeroMemory(&TXWI, TXWI_SIZE);
-			Status = RTMPAllocateNdisPacket(pAd, &pPacket, (PUCHAR)&TXWI, TXWI_SIZE, pData, Length);
-			if (Status != NDIS_STATUS_SUCCESS)
-			{
-				DBGPRINT(RT_DEBUG_WARN, ("MiniportMMRequest (error:: can't allocate NDIS PACKET)\n"));
-				break;
+#ifdef RTMP_MAC_PCI
+			if (bUseDataQ) {
+				retryCnt--;
+				DBGPRINT(RT_DEBUG_TRACE,
+					 ("retryCnt %d\n", retryCnt));
+				if (retryCnt == 0) {
+					DBGPRINT(RT_DEBUG_ERROR,
+						 ("Qidx(%d), not enough space in DataRing, MgmtRingFullCount=%ld!\n",
+						  QueIdx,
+						  pAd->RalinkCounters.
+						  MgmtRingFullCount));
+				}
 			}
-
-			Status = MlmeHardTransmit(pAd, QueIdx, pPacket);
-			if (Status != NDIS_STATUS_SUCCESS)
-				RTMPFreeNdisPacket(pAd, pPacket);
+#endif /* RTMP_MAC_PCI // */
+			DBGPRINT(RT_DEBUG_ERROR,
+				 ("Qidx(%d), not enough space in MgmtRing, MgmtRingFullCount=%ld!\n",
+				  QueIdx,
+				  pAd->RalinkCounters.MgmtRingFullCount));
 		}
-		else
-		{
-			pAd->RalinkCounters.MgmtRingFullCount++;
-			DBGPRINT(RT_DEBUG_ERROR, ("Qidx(%d), not enough space in MgmtRing\n", QueIdx));
-		}
-
-	} while (FALSE);
+	} while (retryCnt > 0);
 
+#ifdef RTMP_MAC_PCI
+	if (bUseDataQ && (!IrqState))
+		RTMP_IRQ_UNLOCK(&pAd->irq_lock, IrqFlags);
+#endif /* RTMP_MAC_PCI // */
 
 	return Status;
 }
-#endif
 
 /*
 	========================================================================
@@ -277,270 +242,85 @@ NDIS_STATUS MiniportMMRequestUnlock(
 
 	========================================================================
 */
-NDIS_STATUS MlmeHardTransmit(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			QueIdx,
-	IN	PNDIS_PACKET	pPacket)
+int MlmeHardTransmit(struct rt_rtmp_adapter *pAd,
+			     u8 QueIdx, void *pPacket)
 {
-	if (pAd->CommonCfg.RadarDetect.RDMode != RD_NORMAL_MODE)
-	{
+	struct rt_packet_info PacketInfo;
+	u8 *pSrcBufVA;
+	u32 SrcBufLen;
+	struct rt_header_802_11 * pHeader_802_11;
+
+	if ((pAd->CommonCfg.RadarDetect.RDMode != RD_NORMAL_MODE)
+	    ) {
 		return NDIS_STATUS_FAILURE;
 	}
 
-#ifdef RT2860
-	if ( pAd->MACVersion == 0x28600100 )
-		return MlmeHardTransmitTxRing(pAd,QueIdx,pPacket);
-	else
-#endif
-		return MlmeHardTransmitMgmtRing(pAd,QueIdx,pPacket);
-
-}
-
-#ifdef RT2860
-NDIS_STATUS MlmeHardTransmitTxRing(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR	QueIdx,
-	IN	PNDIS_PACKET	pPacket)
-{
-	PACKET_INFO 	PacketInfo;
-	PUCHAR			pSrcBufVA;
-	UINT			SrcBufLen;
-	PTXD_STRUC		pTxD;
-	PHEADER_802_11	pHeader_802_11;
-	BOOLEAN 		bAckRequired, bInsertTimestamp;
-	ULONG			SrcBufPA;
-	UCHAR			MlmeRate;
-	ULONG			SwIdx = pAd->TxRing[QueIdx].TxCpuIdx;
-	PTXWI_STRUC 	pFirstTxWI;
-	ULONG	 FreeNum;
-	MAC_TABLE_ENTRY	*pMacEntry = NULL;
-
-
 	RTMP_QueryPacketInfo(pPacket, &PacketInfo, &pSrcBufVA, &SrcBufLen);
-
 	if (pSrcBufVA == NULL)
-	{
-		// The buffer shouldn't be NULL
-		return NDIS_STATUS_FAILURE;
-	}
-
-	// Make sure MGMT ring resource won't be used by other threads
-	//NdisAcquireSpinLock(&pAd->TxRingLock);
-
-	FreeNum = GET_TXRING_FREENO(pAd, QueIdx);
-
-	if (FreeNum == 0)
-	{
-		//NdisReleaseSpinLock(&pAd->TxRingLock);
-		return NDIS_STATUS_FAILURE;
-	}
-
-	SwIdx = pAd->TxRing[QueIdx].TxCpuIdx;
-
-	pTxD  = (PTXD_STRUC) pAd->TxRing[QueIdx].Cell[SwIdx].AllocVa;
-
-	if (pAd->TxRing[QueIdx].Cell[SwIdx].pNdisPacket)
-	{
-		printk("MlmeHardTransmit Error\n");
 		return NDIS_STATUS_FAILURE;
-	}
-
-	// outgoing frame always wakeup PHY to prevent frame lost
-	if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE))
-		AsicForceWakeup(pAd, FROM_TX);
-
-	pFirstTxWI	=(PTXWI_STRUC)pSrcBufVA;
-
-	pHeader_802_11 = (PHEADER_802_11) (pSrcBufVA + TXWI_SIZE);
-	if (pHeader_802_11->Addr1[0] & 0x01)
-	{
-		MlmeRate = pAd->CommonCfg.BasicMlmeRate;
-	}
-	else
-	{
-		MlmeRate = pAd->CommonCfg.MlmeRate;
-	}
-
-	if ((pHeader_802_11->FC.Type == BTYPE_DATA) &&
-		(pHeader_802_11->FC.SubType == SUBTYPE_QOS_NULL))
-	{
-		pMacEntry = MacTableLookup(pAd, pHeader_802_11->Addr1);
-	}
-
-	// Verify Mlme rate for a / g bands.
-	if ((pAd->LatchRfRegs.Channel > 14) && (MlmeRate < RATE_6)) // 11A band
-		MlmeRate = RATE_6;
-
-	//
-	// Should not be hard code to set PwrMgmt to 0 (PWR_ACTIVE)
-	// Snice it's been set to 0 while on MgtMacHeaderInit
-	// By the way this will cause frame to be send on PWR_SAVE failed.
-	//
-	//
-	// In WMM-UAPSD, mlme frame should be set psm as power saving but probe request frame
-
-    // Data-Null packets alse pass through MMRequest in RT2860, however, we hope control the psm bit to pass APSD
-	if (pHeader_802_11->FC.Type != BTYPE_DATA)
-    {
-    	if ((pHeader_802_11->FC.SubType == SUBTYPE_PROBE_REQ) || !(pAd->CommonCfg.bAPSDCapable && pAd->CommonCfg.APEdcaParm.bAPSDCapable))
-    	{
-    		pHeader_802_11->FC.PwrMgmt = PWR_ACTIVE;
-    	}
-    	else
-    	{
-    		pHeader_802_11->FC.PwrMgmt = pAd->CommonCfg.bAPSDForcePowerSave;
-    	}
-    }
-
-	bInsertTimestamp = FALSE;
-	if (pHeader_802_11->FC.Type == BTYPE_CNTL) // must be PS-POLL
-	{
-		bAckRequired = FALSE;
-	}
-	else // BTYPE_MGMT or BTYPE_DATA(must be NULL frame)
-	{
-		if (pHeader_802_11->Addr1[0] & 0x01) // MULTICAST, BROADCAST
-		{
-			bAckRequired = FALSE;
-			pHeader_802_11->Duration = 0;
-		}
-		else
-		{
-			bAckRequired = TRUE;
-			pHeader_802_11->Duration = RTMPCalcDuration(pAd, MlmeRate, 14);
-			if (pHeader_802_11->FC.SubType == SUBTYPE_PROBE_RSP)
-			{
-				bInsertTimestamp = TRUE;
-			}
-		}
-	}
-	pHeader_802_11->Sequence = pAd->Sequence++;
-	if (pAd->Sequence > 0xfff)
-		pAd->Sequence = 0;
-	// Before radar detection done, mgmt frame can not be sent but probe req
-	// Because we need to use probe req to trigger driver to send probe req in passive scan
-	if ((pHeader_802_11->FC.SubType != SUBTYPE_PROBE_REQ)
-		&& (pAd->CommonCfg.bIEEE80211H == 1)
-		&& (pAd->CommonCfg.RadarDetect.RDMode != RD_NORMAL_MODE))
-	{
-		DBGPRINT(RT_DEBUG_ERROR,("MlmeHardTransmit --> radar detect not in normal mode !!!\n"));
-		return (NDIS_STATUS_FAILURE);
-	}
-
-	//
-	// fill scatter-and-gather buffer list into TXD. Internally created NDIS PACKET
-	// should always has only one ohysical buffer, and the whole frame size equals
-	// to the first scatter buffer size
-	//
 
-	// Initialize TX Descriptor
-	// For inter-frame gap, the number is for this frame and next frame
-	// For MLME rate, we will fix as 2Mb to match other vendor's implement
+	pHeader_802_11 = (struct rt_header_802_11 *) (pSrcBufVA + TXINFO_SIZE + TXWI_SIZE);
 
-// management frame doesn't need encryption. so use RESERVED_WCID no matter u are sending to specific wcid or not.
-	// Only beacon use Nseq=TRUE. So here we use Nseq=FALSE.
-	if (pMacEntry == NULL)
-	{
-		RTMPWriteTxWI(pAd, pFirstTxWI, FALSE, FALSE, bInsertTimestamp, FALSE, bAckRequired, FALSE,
-		0, RESERVED_WCID, (SrcBufLen - TXWI_SIZE), PID_MGMT, 0,  (UCHAR)pAd->CommonCfg.MlmeTransmit.field.MCS, IFS_BACKOFF, FALSE, &pAd->CommonCfg.MlmeTransmit);
-	}
+#ifdef RTMP_MAC_PCI
+	if (pAd->MACVersion == 0x28600100)
+		return MlmeHardTransmitTxRing(pAd, QueIdx, pPacket);
 	else
-	{
-		RTMPWriteTxWI(pAd, pFirstTxWI, FALSE, FALSE,
-					bInsertTimestamp, FALSE, bAckRequired, FALSE,
-					0, pMacEntry->Aid, (SrcBufLen - TXWI_SIZE),
-					pMacEntry->MaxHTPhyMode.field.MCS, 0,
-					(UCHAR)pMacEntry->MaxHTPhyMode.field.MCS,
-					IFS_BACKOFF, FALSE, &pMacEntry->MaxHTPhyMode);
-	}
-
-	pAd->TxRing[QueIdx].Cell[SwIdx].pNdisPacket = pPacket;
-	pAd->TxRing[QueIdx].Cell[SwIdx].pNextNdisPacket = NULL;
-
-	SrcBufPA = PCI_MAP_SINGLE(pAd, pSrcBufVA, SrcBufLen, 0, PCI_DMA_TODEVICE);
+#endif /* RTMP_MAC_PCI // */
+		return MlmeHardTransmitMgmtRing(pAd, QueIdx, pPacket);
 
-
-	RTMPWriteTxDescriptor(pAd, pTxD, TRUE, FIFO_EDCA);
-	pTxD->LastSec0 = 1;
-	pTxD->LastSec1 = 1;
-	pTxD->SDLen0 = SrcBufLen;
-	pTxD->SDLen1 = 0;
-	pTxD->SDPtr0 = SrcBufPA;
-	pTxD->DMADONE = 0;
-
-	pAd->RalinkCounters.KickTxCount++;
-	pAd->RalinkCounters.OneSecTxDoneCount++;
-
-   	// Increase TX_CTX_IDX, but write to register later.
-	INC_RING_INDEX(pAd->TxRing[QueIdx].TxCpuIdx, TX_RING_SIZE);
-
-	RTMP_IO_WRITE32(pAd, TX_CTX_IDX0 + QueIdx*0x10,  pAd->TxRing[QueIdx].TxCpuIdx);
-
-	return NDIS_STATUS_SUCCESS;
 }
-#endif /* RT2860 */
 
-NDIS_STATUS MlmeHardTransmitMgmtRing(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR	QueIdx,
-	IN	PNDIS_PACKET	pPacket)
+int MlmeHardTransmitMgmtRing(struct rt_rtmp_adapter *pAd,
+				     u8 QueIdx, void *pPacket)
 {
-	PACKET_INFO 	PacketInfo;
-	PUCHAR			pSrcBufVA;
-	UINT			SrcBufLen;
-	PHEADER_802_11	pHeader_802_11;
-	BOOLEAN 		bAckRequired, bInsertTimestamp;
-	UCHAR			MlmeRate;
-	PTXWI_STRUC 	pFirstTxWI;
-	MAC_TABLE_ENTRY	*pMacEntry = NULL;
+	struct rt_packet_info PacketInfo;
+	u8 *pSrcBufVA;
+	u32 SrcBufLen;
+	struct rt_header_802_11 * pHeader_802_11;
+	BOOLEAN bAckRequired, bInsertTimestamp;
+	u8 MlmeRate;
+	struct rt_txwi * pFirstTxWI;
+	struct rt_mac_table_entry *pMacEntry = NULL;
+	u8 PID;
 
 	RTMP_QueryPacketInfo(pPacket, &PacketInfo, &pSrcBufVA, &SrcBufLen);
-		RTMP_SEM_LOCK(&pAd->MgmtRingLock);
-
 
-	if (pSrcBufVA == NULL)
-	{
+	/* Make sure MGMT ring resource won't be used by other threads */
+	RTMP_SEM_LOCK(&pAd->MgmtRingLock);
+	if (pSrcBufVA == NULL) {
+		/* The buffer shouldn't be NULL */
 		RTMP_SEM_UNLOCK(&pAd->MgmtRingLock);
 		return NDIS_STATUS_FAILURE;
 	}
 
-	// outgoing frame always wakeup PHY to prevent frame lost
-	if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE))
-#ifdef RT2860
-		AsicForceWakeup(pAd, FROM_TX);
-#endif
-#ifdef RT2870
-		AsicForceWakeup(pAd, TRUE);
-#endif
+	{
+		/* outgoing frame always wakeup PHY to prevent frame lost */
+		if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE))
+			AsicForceWakeup(pAd, TRUE);
+	}
 
-	pFirstTxWI = (PTXWI_STRUC)(pSrcBufVA +  TXINFO_SIZE);
-	pHeader_802_11 = (PHEADER_802_11) (pSrcBufVA + TXINFO_SIZE + TXWI_SIZE); //TXWI_SIZE);
+	pFirstTxWI = (struct rt_txwi *) (pSrcBufVA + TXINFO_SIZE);
+	pHeader_802_11 = (struct rt_header_802_11 *) (pSrcBufVA + TXINFO_SIZE + TXWI_SIZE);	/*TXWI_SIZE); */
 
-	if (pHeader_802_11->Addr1[0] & 0x01)
-	{
+	if (pHeader_802_11->Addr1[0] & 0x01) {
 		MlmeRate = pAd->CommonCfg.BasicMlmeRate;
-	}
-	else
-	{
+	} else {
 		MlmeRate = pAd->CommonCfg.MlmeRate;
 	}
 
-	// Verify Mlme rate for a / g bands.
-	if ((pAd->LatchRfRegs.Channel > 14) && (MlmeRate < RATE_6)) // 11A band
+	/* Verify Mlme rate for a / g bands. */
+	if ((pAd->LatchRfRegs.Channel > 14) && (MlmeRate < RATE_6))	/* 11A band */
 		MlmeRate = RATE_6;
 
 	if ((pHeader_802_11->FC.Type == BTYPE_DATA) &&
-		(pHeader_802_11->FC.SubType == SUBTYPE_QOS_NULL))
-	{
+	    (pHeader_802_11->FC.SubType == SUBTYPE_QOS_NULL)) {
 		pMacEntry = MacTableLookup(pAd, pHeader_802_11->Addr1);
 	}
 
 	{
-		// Fixed W52 with Activity scan issue in ABG_MIXED and ABGN_MIXED mode.
+		/* Fixed W52 with Activity scan issue in ABG_MIXED and ABGN_MIXED mode. */
 		if (pAd->CommonCfg.PhyMode == PHY_11ABG_MIXED
-			|| pAd->CommonCfg.PhyMode == PHY_11ABGN_MIXED
-		)
-		{
+		    || pAd->CommonCfg.PhyMode == PHY_11ABGN_MIXED) {
 			if (pAd->LatchRfRegs.Channel > 14)
 				pAd->CommonCfg.MlmeTransmit.field.MODE = 1;
 			else
@@ -548,103 +328,121 @@ NDIS_STATUS MlmeHardTransmitMgmtRing(
 		}
 	}
 
-	//
-	// Should not be hard code to set PwrMgmt to 0 (PWR_ACTIVE)
-	// Snice it's been set to 0 while on MgtMacHeaderInit
-	// By the way this will cause frame to be send on PWR_SAVE failed.
-	//
-	// pHeader_802_11->FC.PwrMgmt = 0; // (pAd->StaCfg.Psm == PWR_SAVE);
-	//
-	// In WMM-UAPSD, mlme frame should be set psm as power saving but probe request frame
-
-    // Data-Null packets alse pass through MMRequest in RT2860, however, we hope control the psm bit to pass APSD
-	if ((pHeader_802_11->FC.Type != BTYPE_DATA) && (pHeader_802_11->FC.Type != BTYPE_CNTL))
+	/* */
+	/* Should not be hard code to set PwrMgmt to 0 (PWR_ACTIVE) */
+	/* Snice it's been set to 0 while on MgtMacHeaderInit */
+	/* By the way this will cause frame to be send on PWR_SAVE failed. */
+	/* */
+	pHeader_802_11->FC.PwrMgmt = PWR_ACTIVE;	/* (pAd->StaCfg.Psm == PWR_SAVE); */
+
+	/* */
+	/* In WMM-UAPSD, mlme frame should be set psm as power saving but probe request frame */
+	/* Data-Null packets alse pass through MMRequest in RT2860, however, we hope control the psm bit to pass APSD */
+/*      if ((pHeader_802_11->FC.Type != BTYPE_DATA) && (pHeader_802_11->FC.Type != BTYPE_CNTL)) */
 	{
-		if ((pAd->StaCfg.Psm == PWR_SAVE) &&
-			(pHeader_802_11->FC.SubType == SUBTYPE_ACTION))
-			pHeader_802_11->FC.PwrMgmt = PWR_SAVE;
-		else
-			pHeader_802_11->FC.PwrMgmt = PWR_ACTIVE;
+		if ((pHeader_802_11->FC.SubType == SUBTYPE_ACTION) ||
+		    ((pHeader_802_11->FC.Type == BTYPE_DATA) &&
+		     ((pHeader_802_11->FC.SubType == SUBTYPE_QOS_NULL) ||
+		      (pHeader_802_11->FC.SubType == SUBTYPE_NULL_FUNC)))) {
+			if (pAd->StaCfg.Psm == PWR_SAVE)
+				pHeader_802_11->FC.PwrMgmt = PWR_SAVE;
+			else
+				pHeader_802_11->FC.PwrMgmt =
+				    pAd->CommonCfg.bAPSDForcePowerSave;
+		}
 	}
 
 	bInsertTimestamp = FALSE;
-	if (pHeader_802_11->FC.Type == BTYPE_CNTL) // must be PS-POLL
+	if (pHeader_802_11->FC.Type == BTYPE_CNTL)	/* must be PS-POLL */
 	{
-		//Set PM bit in ps-poll, to fix WLK 1.2  PowerSaveMode_ext failure issue.
-		if ((pAd->OpMode == OPMODE_STA) && (pHeader_802_11->FC.SubType == SUBTYPE_PS_POLL))
-		{
+		/*Set PM bit in ps-poll, to fix WLK 1.2  PowerSaveMode_ext failure issue. */
+		if ((pAd->OpMode == OPMODE_STA)
+		    && (pHeader_802_11->FC.SubType == SUBTYPE_PS_POLL)) {
 			pHeader_802_11->FC.PwrMgmt = PWR_SAVE;
 		}
 		bAckRequired = FALSE;
-	}
-	else // BTYPE_MGMT or BTYPE_DATA(must be NULL frame)
+	} else			/* BTYPE_MGMT or BTYPE_DATA(must be NULL frame) */
 	{
-		if (pHeader_802_11->Addr1[0] & 0x01) // MULTICAST, BROADCAST
+		/*pAd->Sequence++; */
+		/*pHeader_802_11->Sequence = pAd->Sequence; */
+
+		if (pHeader_802_11->Addr1[0] & 0x01)	/* MULTICAST, BROADCAST */
 		{
 			bAckRequired = FALSE;
 			pHeader_802_11->Duration = 0;
-		}
-		else
-		{
+		} else {
 			bAckRequired = TRUE;
-			pHeader_802_11->Duration = RTMPCalcDuration(pAd, MlmeRate, 14);
-			if (pHeader_802_11->FC.SubType == SUBTYPE_PROBE_RSP)
-			{
+			pHeader_802_11->Duration =
+			    RTMPCalcDuration(pAd, MlmeRate, 14);
+			if ((pHeader_802_11->FC.SubType == SUBTYPE_PROBE_RSP)
+			    && (pHeader_802_11->FC.Type == BTYPE_MGMT)) {
 				bInsertTimestamp = TRUE;
+				bAckRequired = FALSE;	/* Disable ACK to prevent retry 0x1f for Probe Response */
+			} else
+			    if ((pHeader_802_11->FC.SubType ==
+				 SUBTYPE_PROBE_REQ)
+				&& (pHeader_802_11->FC.Type == BTYPE_MGMT)) {
+				bAckRequired = FALSE;	/* Disable ACK to prevent retry 0x1f for Probe Request */
 			}
 		}
 	}
 
 	pHeader_802_11->Sequence = pAd->Sequence++;
-	if (pAd->Sequence >0xfff)
+	if (pAd->Sequence > 0xfff)
 		pAd->Sequence = 0;
 
-	// Before radar detection done, mgmt frame can not be sent but probe req
-	// Because we need to use probe req to trigger driver to send probe req in passive scan
+	/* Before radar detection done, mgmt frame can not be sent but probe req */
+	/* Because we need to use probe req to trigger driver to send probe req in passive scan */
 	if ((pHeader_802_11->FC.SubType != SUBTYPE_PROBE_REQ)
-		&& (pAd->CommonCfg.bIEEE80211H == 1)
-		&& (pAd->CommonCfg.RadarDetect.RDMode != RD_NORMAL_MODE))
-	{
-		DBGPRINT(RT_DEBUG_ERROR,("MlmeHardTransmit --> radar detect not in normal mode !!!\n"));
+	    && (pAd->CommonCfg.bIEEE80211H == 1)
+	    && (pAd->CommonCfg.RadarDetect.RDMode != RD_NORMAL_MODE)) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("MlmeHardTransmit --> radar detect not in normal mode!\n"));
+/*              if (!IrqState) */
 		RTMP_SEM_UNLOCK(&pAd->MgmtRingLock);
 		return (NDIS_STATUS_FAILURE);
 	}
 
-	//
-	// fill scatter-and-gather buffer list into TXD. Internally created NDIS PACKET
-	// should always has only one ohysical buffer, and the whole frame size equals
-	// to the first scatter buffer size
-	//
-
-	// Initialize TX Descriptor
-	// For inter-frame gap, the number is for this frame and next frame
-	// For MLME rate, we will fix as 2Mb to match other vendor's implement
-
-// management frame doesn't need encryption. so use RESERVED_WCID no matter u are sending to specific wcid or not.
-	if (pMacEntry == NULL)
-	{
-		RTMPWriteTxWI(pAd, pFirstTxWI, FALSE, FALSE, bInsertTimestamp, FALSE, bAckRequired, FALSE,
-		0, RESERVED_WCID, (SrcBufLen - TXINFO_SIZE - TXWI_SIZE), PID_MGMT, 0,  (UCHAR)pAd->CommonCfg.MlmeTransmit.field.MCS, IFS_BACKOFF, FALSE, &pAd->CommonCfg.MlmeTransmit);
-	}
-	else
-	{
+	/* */
+	/* fill scatter-and-gather buffer list into TXD. Internally created NDIS PACKET */
+	/* should always has only one physical buffer, and the whole frame size equals */
+	/* to the first scatter buffer size */
+	/* */
+
+	/* Initialize TX Descriptor */
+	/* For inter-frame gap, the number is for this frame and next frame */
+	/* For MLME rate, we will fix as 2Mb to match other vendor's implement */
+/*      pAd->CommonCfg.MlmeTransmit.field.MODE = 1; */
+
+/* management frame doesn't need encryption. so use RESERVED_WCID no matter u are sending to specific wcid or not. */
+	PID = PID_MGMT;
+
+	if (pMacEntry == NULL) {
+		RTMPWriteTxWI(pAd, pFirstTxWI, FALSE, FALSE, bInsertTimestamp,
+			      FALSE, bAckRequired, FALSE, 0, RESERVED_WCID,
+			      (SrcBufLen - TXINFO_SIZE - TXWI_SIZE), PID, 0,
+			      (u8)pAd->CommonCfg.MlmeTransmit.field.MCS,
+			      IFS_BACKOFF, FALSE, &pAd->CommonCfg.MlmeTransmit);
+	} else {
+		/* dont use low rate to send QoS Null data frame */
 		RTMPWriteTxWI(pAd, pFirstTxWI, FALSE, FALSE,
-					bInsertTimestamp, FALSE, bAckRequired, FALSE,
-					0, pMacEntry->Aid, (SrcBufLen - TXINFO_SIZE - TXWI_SIZE),
-					pMacEntry->MaxHTPhyMode.field.MCS, 0,
-					(UCHAR)pMacEntry->MaxHTPhyMode.field.MCS,
-					IFS_BACKOFF, FALSE, &pMacEntry->MaxHTPhyMode);
+			      bInsertTimestamp, FALSE, bAckRequired, FALSE,
+			      0, pMacEntry->Aid,
+			      (SrcBufLen - TXINFO_SIZE - TXWI_SIZE),
+			      pMacEntry->MaxHTPhyMode.field.MCS, 0,
+			      (u8)pMacEntry->MaxHTPhyMode.field.MCS,
+			      IFS_BACKOFF, FALSE, &pMacEntry->MaxHTPhyMode);
 	}
 
-	// Now do hardware-depened kick out.
+	/* Now do hardware-depened kick out. */
 	HAL_KickOutMgmtTx(pAd, QueIdx, pPacket, pSrcBufVA, SrcBufLen);
 
-	// Make sure to release MGMT ring resource
+	/* Make sure to release MGMT ring resource */
+/*      if (!IrqState) */
 	RTMP_SEM_UNLOCK(&pAd->MgmtRingLock);
 	return NDIS_STATUS_SUCCESS;
 }
 
-
 /********************************************************************************
 
 	New DeQueue Procedures.
@@ -708,178 +506,153 @@ NDIS_STATUS MlmeHardTransmitMgmtRing(
 								(2).Normal
 	========================================================================
 */
-static UCHAR TxPktClassification(
-	IN RTMP_ADAPTER *pAd,
-	IN PNDIS_PACKET  pPacket)
+static u8 TxPktClassification(struct rt_rtmp_adapter *pAd, void *pPacket)
 {
-	UCHAR			TxFrameType = TX_UNKOWN_FRAME;
-	UCHAR			Wcid;
-	MAC_TABLE_ENTRY	*pMacEntry = NULL;
-	BOOLEAN			bHTRate = FALSE;
+	u8 TxFrameType = TX_UNKOWN_FRAME;
+	u8 Wcid;
+	struct rt_mac_table_entry *pMacEntry = NULL;
+	BOOLEAN bHTRate = FALSE;
 
 	Wcid = RTMP_GET_PACKET_WCID(pPacket);
-	if (Wcid == MCAST_WCID)
-	{	// Handle for RA is Broadcast/Multicast Address.
+	if (Wcid == MCAST_WCID) {	/* Handle for RA is Broadcast/Multicast Address. */
 		return TX_MCAST_FRAME;
 	}
-
-	// Handle for unicast packets
+	/* Handle for unicast packets */
 	pMacEntry = &pAd->MacTab.Content[Wcid];
-	if (RTMP_GET_PACKET_LOWRATE(pPacket))
-	{	// It's a specific packet need to force low rate, i.e., bDHCPFrame, bEAPOLFrame, bWAIFrame
+	if (RTMP_GET_PACKET_LOWRATE(pPacket)) {	/* It's a specific packet need to force low rate, i.e., bDHCPFrame, bEAPOLFrame, bWAIFrame */
 		TxFrameType = TX_LEGACY_FRAME;
-	}
-	else if (IS_HT_RATE(pMacEntry))
-	{	// it's a 11n capable packet
+	} else if (IS_HT_RATE(pMacEntry)) {	/* it's a 11n capable packet */
 
-		// Depends on HTPhyMode to check if the peer support the HTRate transmission.
-		// 	Currently didn't support A-MSDU embedded in A-MPDU
+		/* Depends on HTPhyMode to check if the peer support the HTRate transmission. */
+		/*      Currently didn't support A-MSDU embedded in A-MPDU */
 		bHTRate = TRUE;
-		if (RTMP_GET_PACKET_MOREDATA(pPacket) || (pMacEntry->PsMode == PWR_SAVE))
+		if (RTMP_GET_PACKET_MOREDATA(pPacket)
+		    || (pMacEntry->PsMode == PWR_SAVE))
 			TxFrameType = TX_LEGACY_FRAME;
-#ifdef UAPSD_AP_SUPPORT
-		else if (RTMP_GET_PACKET_EOSP(pPacket))
-			TxFrameType = TX_LEGACY_FRAME;
-#endif // UAPSD_AP_SUPPORT //
-		else if((pMacEntry->TXBAbitmap & (1<<(RTMP_GET_PACKET_UP(pPacket)))) != 0)
+		else if ((pMacEntry->
+			  TXBAbitmap & (1 << (RTMP_GET_PACKET_UP(pPacket)))) !=
+			 0)
 			return TX_AMPDU_FRAME;
-		else if(CLIENT_STATUS_TEST_FLAG(pMacEntry, fCLIENT_STATUS_AMSDU_INUSED))
+		else if (CLIENT_STATUS_TEST_FLAG
+			 (pMacEntry, fCLIENT_STATUS_AMSDU_INUSED))
 			return TX_AMSDU_FRAME;
 		else
 			TxFrameType = TX_LEGACY_FRAME;
-	}
-	else
-	{	// it's a legacy b/g packet.
-		if ((CLIENT_STATUS_TEST_FLAG(pMacEntry, fCLIENT_STATUS_AGGREGATION_CAPABLE) && pAd->CommonCfg.bAggregationCapable) &&
-			(RTMP_GET_PACKET_TXRATE(pPacket) >= RATE_6) &&
-			(!(OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_WMM_INUSED) && CLIENT_STATUS_TEST_FLAG(pMacEntry, fCLIENT_STATUS_WMM_CAPABLE))))
-		{	// if peer support Ralink Aggregation, we use it.
+	} else {		/* it's a legacy b/g packet. */
+		if ((CLIENT_STATUS_TEST_FLAG(pMacEntry, fCLIENT_STATUS_AGGREGATION_CAPABLE) && pAd->CommonCfg.bAggregationCapable) && (RTMP_GET_PACKET_TXRATE(pPacket) >= RATE_6) && (!(OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_WMM_INUSED) && CLIENT_STATUS_TEST_FLAG(pMacEntry, fCLIENT_STATUS_WMM_CAPABLE)))) {	/* if peer support Ralink Aggregation, we use it. */
 			TxFrameType = TX_RALINK_FRAME;
-		}
-		else
-		{
+		} else {
 			TxFrameType = TX_LEGACY_FRAME;
 		}
 	}
 
-	// Currently, our fragment only support when a unicast packet send as NOT-ARALINK, NOT-AMSDU and NOT-AMPDU.
-	if ((RTMP_GET_PACKET_FRAGMENTS(pPacket) > 1) && (TxFrameType == TX_LEGACY_FRAME))
+	/* Currently, our fragment only support when a unicast packet send as NOT-ARALINK, NOT-AMSDU and NOT-AMPDU. */
+	if ((RTMP_GET_PACKET_FRAGMENTS(pPacket) > 1)
+	    && (TxFrameType == TX_LEGACY_FRAME))
 		TxFrameType = TX_FRAG_FRAME;
 
 	return TxFrameType;
 }
 
-
-BOOLEAN RTMP_FillTxBlkInfo(
-	IN RTMP_ADAPTER *pAd,
-	IN TX_BLK *pTxBlk)
+BOOLEAN RTMP_FillTxBlkInfo(struct rt_rtmp_adapter *pAd, struct rt_tx_blk *pTxBlk)
 {
-	PACKET_INFO			PacketInfo;
-	PNDIS_PACKET		pPacket;
-	PMAC_TABLE_ENTRY	pMacEntry = NULL;
+	struct rt_packet_info PacketInfo;
+	void *pPacket;
+	struct rt_mac_table_entry *pMacEntry = NULL;
 
 	pPacket = pTxBlk->pPacket;
-	RTMP_QueryPacketInfo(pPacket, &PacketInfo, &pTxBlk->pSrcBufHeader, &pTxBlk->SrcBufLen);
+	RTMP_QueryPacketInfo(pPacket, &PacketInfo, &pTxBlk->pSrcBufHeader,
+			     &pTxBlk->SrcBufLen);
 
-	pTxBlk->Wcid	 	 		= RTMP_GET_PACKET_WCID(pPacket);
-	pTxBlk->apidx		 		= RTMP_GET_PACKET_IF(pPacket);
-	pTxBlk->UserPriority 		= RTMP_GET_PACKET_UP(pPacket);
-	pTxBlk->FrameGap = IFS_HTTXOP;		// ASIC determine Frame Gap
+	pTxBlk->Wcid = RTMP_GET_PACKET_WCID(pPacket);
+	pTxBlk->apidx = RTMP_GET_PACKET_IF(pPacket);
+	pTxBlk->UserPriority = RTMP_GET_PACKET_UP(pPacket);
+	pTxBlk->FrameGap = IFS_HTTXOP;	/* ASIC determine Frame Gap */
 
 	if (RTMP_GET_PACKET_CLEAR_EAP_FRAME(pTxBlk->pPacket))
 		TX_BLK_SET_FLAG(pTxBlk, fTX_bClearEAPFrame);
 	else
 		TX_BLK_CLEAR_FLAG(pTxBlk, fTX_bClearEAPFrame);
 
-	// Default to clear this flag
+	/* Default to clear this flag */
 	TX_BLK_CLEAR_FLAG(pTxBlk, fTX_bForceNonQoS);
 
-
-	if (pTxBlk->Wcid == MCAST_WCID)
-	{
+	if (pTxBlk->Wcid == MCAST_WCID) {
 		pTxBlk->pMacEntry = NULL;
 		{
-#ifdef MCAST_RATE_SPECIFIC
-			PUCHAR pDA = GET_OS_PKT_DATAPTR(pPacket);
-			if (((*pDA & 0x01) == 0x01) && (*pDA != 0xff))
-				pTxBlk->pTransmit = &pAd->CommonCfg.MCastPhyMode;
-			else
-#endif // MCAST_RATE_SPECIFIC //
-				pTxBlk->pTransmit = &pAd->MacTab.Content[MCAST_WCID].HTPhyMode;
+			pTxBlk->pTransmit =
+			    &pAd->MacTab.Content[MCAST_WCID].HTPhyMode;
 		}
 
-		TX_BLK_CLEAR_FLAG(pTxBlk, fTX_bAckRequired);	// AckRequired = FALSE, when broadcast packet in Adhoc mode.
-		//TX_BLK_SET_FLAG(pTxBlk, fTX_bForceLowRate);
+		TX_BLK_CLEAR_FLAG(pTxBlk, fTX_bAckRequired);	/* AckRequired = FALSE, when broadcast packet in Adhoc mode. */
+		/*TX_BLK_SET_FLAG(pTxBlk, fTX_bForceLowRate); */
 		TX_BLK_CLEAR_FLAG(pTxBlk, fTX_bAllowFrag);
 		TX_BLK_CLEAR_FLAG(pTxBlk, fTX_bWMM);
-		if (RTMP_GET_PACKET_MOREDATA(pPacket))
-		{
+		if (RTMP_GET_PACKET_MOREDATA(pPacket)) {
 			TX_BLK_SET_FLAG(pTxBlk, fTX_bMoreData);
 		}
 
-	}
-	else
-	{
+	} else {
 		pTxBlk->pMacEntry = &pAd->MacTab.Content[pTxBlk->Wcid];
 		pTxBlk->pTransmit = &pTxBlk->pMacEntry->HTPhyMode;
 
 		pMacEntry = pTxBlk->pMacEntry;
 
-
-		// For all unicast packets, need Ack unless the Ack Policy is not set as NORMAL_ACK.
+		/* For all unicast packets, need Ack unless the Ack Policy is not set as NORMAL_ACK. */
 		if (pAd->CommonCfg.AckPolicy[pTxBlk->QueIdx] != NORMAL_ACK)
 			TX_BLK_CLEAR_FLAG(pTxBlk, fTX_bAckRequired);
 		else
 			TX_BLK_SET_FLAG(pTxBlk, fTX_bAckRequired);
 
-		{
-			// If support WMM, enable it.
-#ifdef RT2860
-			if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_WMM_INUSED))
-#endif
-#ifdef RT2870
-			if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_WMM_INUSED) &&
-				CLIENT_STATUS_TEST_FLAG(pMacEntry, fCLIENT_STATUS_WMM_CAPABLE))
-#endif
-				TX_BLK_SET_FLAG(pTxBlk, fTX_bWMM);
+		if ((pAd->OpMode == OPMODE_STA) &&
+		    (ADHOC_ON(pAd)) &&
+		    (RX_FILTER_TEST_FLAG(pAd, fRX_FILTER_ACCEPT_PROMISCUOUS))) {
+			if (pAd->CommonCfg.PSPXlink)
+				TX_BLK_CLEAR_FLAG(pTxBlk, fTX_bAckRequired);
 		}
 
-		if (pTxBlk->TxFrameType == TX_LEGACY_FRAME)
 		{
-			if ( (RTMP_GET_PACKET_LOWRATE(pPacket)) ||
-                ((pAd->OpMode == OPMODE_AP) && (pMacEntry->MaxHTPhyMode.field.MODE == MODE_CCK) && (pMacEntry->MaxHTPhyMode.field.MCS == RATE_1)))
-			{	// Specific packet, i.e., bDHCPFrame, bEAPOLFrame, bWAIFrame, need force low rate.
-				pTxBlk->pTransmit = &pAd->MacTab.Content[MCAST_WCID].HTPhyMode;
+			{
+
+				/* If support WMM, enable it. */
+				if (OPSTATUS_TEST_FLAG
+				    (pAd, fOP_STATUS_WMM_INUSED)
+				    && CLIENT_STATUS_TEST_FLAG(pMacEntry,
+							       fCLIENT_STATUS_WMM_CAPABLE))
+					TX_BLK_SET_FLAG(pTxBlk, fTX_bWMM);
+
+/*                              if (pAd->StaCfg.bAutoTxRateSwitch) */
+/*                                      TX_BLK_SET_FLAG(pTxBlk, fTX_AutoRateSwitch); */
+			}
+		}
 
-				// Modify the WMM bit for ICV issue. If we have a packet with EOSP field need to set as 1, how to handle it???
+		if (pTxBlk->TxFrameType == TX_LEGACY_FRAME) {
+			if ((RTMP_GET_PACKET_LOWRATE(pPacket)) || ((pAd->OpMode == OPMODE_AP) && (pMacEntry->MaxHTPhyMode.field.MODE == MODE_CCK) && (pMacEntry->MaxHTPhyMode.field.MCS == RATE_1))) {	/* Specific packet, i.e., bDHCPFrame, bEAPOLFrame, bWAIFrame, need force low rate. */
+				pTxBlk->pTransmit =
+				    &pAd->MacTab.Content[MCAST_WCID].HTPhyMode;
+
+				/* Modify the WMM bit for ICV issue. If we have a packet with EOSP field need to set as 1, how to handle it??? */
 				if (IS_HT_STA(pTxBlk->pMacEntry) &&
-					(CLIENT_STATUS_TEST_FLAG(pMacEntry, fCLIENT_STATUS_RALINK_CHIPSET)) &&
-					((pAd->CommonCfg.bRdg == TRUE) && CLIENT_STATUS_TEST_FLAG(pMacEntry, fCLIENT_STATUS_RDG_CAPABLE)))
+				    (CLIENT_STATUS_TEST_FLAG
+				     (pMacEntry, fCLIENT_STATUS_RALINK_CHIPSET))
+				    && ((pAd->CommonCfg.bRdg == TRUE)
+					&& CLIENT_STATUS_TEST_FLAG(pMacEntry,
+								   fCLIENT_STATUS_RDG_CAPABLE)))
 				{
 					TX_BLK_CLEAR_FLAG(pTxBlk, fTX_bWMM);
-					TX_BLK_SET_FLAG(pTxBlk, fTX_bForceNonQoS);
+					TX_BLK_SET_FLAG(pTxBlk,
+							fTX_bForceNonQoS);
 				}
 			}
 
-			if ( (IS_HT_RATE(pMacEntry) == FALSE) &&
-				(CLIENT_STATUS_TEST_FLAG(pMacEntry, fCLIENT_STATUS_PIGGYBACK_CAPABLE)))
-			{	// Currently piggy-back only support when peer is operate in b/g mode.
+			if ((IS_HT_RATE(pMacEntry) == FALSE) && (CLIENT_STATUS_TEST_FLAG(pMacEntry, fCLIENT_STATUS_PIGGYBACK_CAPABLE))) {	/* Currently piggy-back only support when peer is operate in b/g mode. */
 				TX_BLK_SET_FLAG(pTxBlk, fTX_bPiggyBack);
 			}
 
-			if (RTMP_GET_PACKET_MOREDATA(pPacket))
-			{
+			if (RTMP_GET_PACKET_MOREDATA(pPacket)) {
 				TX_BLK_SET_FLAG(pTxBlk, fTX_bMoreData);
 			}
-#ifdef UAPSD_AP_SUPPORT
-			if (RTMP_GET_PACKET_EOSP(pPacket))
-			{
-				TX_BLK_SET_FLAG(pTxBlk, fTX_bWMM_UAPSD_EOSP);
-			}
-#endif // UAPSD_AP_SUPPORT //
-		}
-		else if (pTxBlk->TxFrameType == TX_FRAG_FRAME)
-		{
+		} else if (pTxBlk->TxFrameType == TX_FRAG_FRAME) {
 			TX_BLK_SET_FLAG(pTxBlk, fTX_bAllowFrag);
 		}
 
@@ -889,41 +662,33 @@ BOOLEAN RTMP_FillTxBlkInfo(
 	return TRUE;
 }
 
-
-BOOLEAN CanDoAggregateTransmit(
-	IN RTMP_ADAPTER *pAd,
-	IN NDIS_PACKET *pPacket,
-	IN TX_BLK		*pTxBlk)
+BOOLEAN CanDoAggregateTransmit(struct rt_rtmp_adapter *pAd,
+			       char * pPacket, struct rt_tx_blk *pTxBlk)
 {
 
-	//printk("Check if can do aggregation! TxFrameType=%d!\n", pTxBlk->TxFrameType);
+	/*DBGPRINT(RT_DEBUG_TRACE, ("Check if can do aggregation! TxFrameType=%d!\n", pTxBlk->TxFrameType)); */
 
 	if (RTMP_GET_PACKET_WCID(pPacket) == MCAST_WCID)
 		return FALSE;
 
 	if (RTMP_GET_PACKET_DHCP(pPacket) ||
-		RTMP_GET_PACKET_EAPOL(pPacket) ||
-		RTMP_GET_PACKET_WAI(pPacket))
+	    RTMP_GET_PACKET_EAPOL(pPacket) || RTMP_GET_PACKET_WAI(pPacket))
 		return FALSE;
 
-	if ((pTxBlk->TxFrameType == TX_AMSDU_FRAME) &&
-		((pTxBlk->TotalFrameLen + GET_OS_PKT_LEN(pPacket))> (RX_BUFFER_AGGRESIZE - 100)))
-	{	// For AMSDU, allow the packets with total length < max-amsdu size
+	if ((pTxBlk->TxFrameType == TX_AMSDU_FRAME) && ((pTxBlk->TotalFrameLen + GET_OS_PKT_LEN(pPacket)) > (RX_BUFFER_AGGRESIZE - 100))) {	/* For AMSDU, allow the packets with total length < max-amsdu size */
 		return FALSE;
 	}
 
-	if ((pTxBlk->TxFrameType == TX_RALINK_FRAME) &&
-		(pTxBlk->TxPacketList.Number == 2))
-	{	// For RALINK-Aggregation, allow two frames in one batch.
+	if ((pTxBlk->TxFrameType == TX_RALINK_FRAME) && (pTxBlk->TxPacketList.Number == 2)) {	/* For RALINK-Aggregation, allow two frames in one batch. */
 		return FALSE;
 	}
 
-	if ((INFRA_ON(pAd)) && (pAd->OpMode == OPMODE_STA)) // must be unicast to AP
+	if ((INFRA_ON(pAd)) && (pAd->OpMode == OPMODE_STA))	/* must be unicast to AP */
 		return TRUE;
 	else
 		return FALSE;
-}
 
+}
 
 /*
 	========================================================================
@@ -947,53 +712,42 @@ BOOLEAN CanDoAggregateTransmit(
 
 	========================================================================
 */
-VOID RTMPDeQueuePacket(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  BOOLEAN         bIntContext,
-	IN  UCHAR			QIdx, /* BulkOutPipeId */
-	IN  UCHAR           Max_Tx_Packets)
+void RTMPDeQueuePacket(struct rt_rtmp_adapter *pAd, IN BOOLEAN bIntContext, u8 QIdx,	/* BulkOutPipeId */
+		       u8 Max_Tx_Packets)
 {
-	PQUEUE_ENTRY    pEntry = NULL;
-	PNDIS_PACKET 	pPacket;
-	NDIS_STATUS     Status = NDIS_STATUS_SUCCESS;
-	UCHAR           Count=0;
-	PQUEUE_HEADER   pQueue;
-	ULONG           FreeNumber[NUM_OF_TX_RING];
-	UCHAR			QueIdx, sQIdx, eQIdx;
-	unsigned long	IrqFlags = 0;
-	BOOLEAN			hasTxDesc = FALSE;
-	TX_BLK			TxBlk;
-	TX_BLK			*pTxBlk;
-
-
-
-	if (QIdx == NUM_OF_TX_RING)
-	{
+	struct rt_queue_entry *pEntry = NULL;
+	void *pPacket;
+	int Status = NDIS_STATUS_SUCCESS;
+	u8 Count = 0;
+	struct rt_queue_header *pQueue;
+	unsigned long FreeNumber[NUM_OF_TX_RING];
+	u8 QueIdx, sQIdx, eQIdx;
+	unsigned long IrqFlags = 0;
+	BOOLEAN hasTxDesc = FALSE;
+	struct rt_tx_blk TxBlk;
+	struct rt_tx_blk *pTxBlk;
+
+	if (QIdx == NUM_OF_TX_RING) {
 		sQIdx = 0;
-//PS packets use HCCA queue when dequeue from PS unicast queue (WiFi WPA2 MA9_DT1 for Marvell B STA)
-		eQIdx = 3;	// 4 ACs, start from 0.
-	}
-	else
-	{
+		eQIdx = 3;	/* 4 ACs, start from 0. */
+	} else {
 		sQIdx = eQIdx = QIdx;
 	}
 
-	for (QueIdx=sQIdx; QueIdx <= eQIdx; QueIdx++)
-	{
-		Count=0;
+	for (QueIdx = sQIdx; QueIdx <= eQIdx; QueIdx++) {
+		Count = 0;
 
-		RT28XX_START_DEQUEUE(pAd, QueIdx, IrqFlags);
+		RTMP_START_DEQUEUE(pAd, QueIdx, IrqFlags);
 
-
-		while (1)
-		{
-			if ((RTMP_TEST_FLAG(pAd, (fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS |
-										fRTMP_ADAPTER_RADIO_OFF |
-										fRTMP_ADAPTER_RESET_IN_PROGRESS |
-										fRTMP_ADAPTER_HALT_IN_PROGRESS |
-										fRTMP_ADAPTER_NIC_NOT_EXIST))))
-			{
-				RT28XX_STOP_DEQUEUE(pAd, QueIdx, IrqFlags);
+		while (1) {
+			if ((RTMP_TEST_FLAG
+			     (pAd,
+			      (fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS |
+			       fRTMP_ADAPTER_RADIO_OFF |
+			       fRTMP_ADAPTER_RESET_IN_PROGRESS |
+			       fRTMP_ADAPTER_HALT_IN_PROGRESS |
+			       fRTMP_ADAPTER_NIC_NOT_EXIST)))) {
+				RTMP_STOP_DEQUEUE(pAd, QueIdx, IrqFlags);
 				return;
 			}
 
@@ -1001,43 +755,47 @@ VOID RTMPDeQueuePacket(
 				break;
 
 			DEQUEUE_LOCK(&pAd->irq_lock, bIntContext, IrqFlags);
-			if (&pAd->TxSwQueue[QueIdx] == NULL)
-			{
-				DEQUEUE_UNLOCK(&pAd->irq_lock, bIntContext, IrqFlags);
+			if (&pAd->TxSwQueue[QueIdx] == NULL) {
+				DEQUEUE_UNLOCK(&pAd->irq_lock, bIntContext,
+					       IrqFlags);
 				break;
 			}
-#ifdef RT2860
+#ifdef RTMP_MAC_PCI
 			FreeNumber[QueIdx] = GET_TXRING_FREENO(pAd, QueIdx);
 
-
-			if (FreeNumber[QueIdx] <= 5)
-			{
-				// free Tx(QueIdx) resources
+			if (FreeNumber[QueIdx] <= 5) {
+				/* free Tx(QueIdx) resources */
 				RTMPFreeTXDUponTxDmaDone(pAd, QueIdx);
-				FreeNumber[QueIdx] = GET_TXRING_FREENO(pAd, QueIdx);
+				FreeNumber[QueIdx] =
+				    GET_TXRING_FREENO(pAd, QueIdx);
 			}
-#endif /* RT2860 */
-			// probe the Queue Head
+#endif /* RTMP_MAC_PCI // */
+
+			/* probe the Queue Head */
 			pQueue = &pAd->TxSwQueue[QueIdx];
-			if ((pEntry = pQueue->Head) == NULL)
-			{
-				DEQUEUE_UNLOCK(&pAd->irq_lock, bIntContext, IrqFlags);
+			if ((pEntry = pQueue->Head) == NULL) {
+				DEQUEUE_UNLOCK(&pAd->irq_lock, bIntContext,
+					       IrqFlags);
 				break;
 			}
 
 			pTxBlk = &TxBlk;
-			NdisZeroMemory((PUCHAR)pTxBlk, sizeof(TX_BLK));
+			NdisZeroMemory((u8 *)pTxBlk, sizeof(struct rt_tx_blk));
+			/*InitializeQueueHeader(&pTxBlk->TxPacketList);         // Didn't need it because we already memzero it. */
 			pTxBlk->QueIdx = QueIdx;
 
-			pPacket = QUEUE_ENTRY_TO_PKT(pEntry);
+			pPacket = QUEUE_ENTRY_TO_PACKET(pEntry);
 
-			// Early check to make sure we have enoguh Tx Resource.
-			hasTxDesc = RT28XX_HAS_ENOUGH_FREE_DESC(pAd, pTxBlk, FreeNumber[QueIdx], pPacket);
-			if (!hasTxDesc)
-			{
+			/* Early check to make sure we have enoguh Tx Resource. */
+			hasTxDesc =
+			    RTMP_HAS_ENOUGH_FREE_DESC(pAd, pTxBlk,
+						      FreeNumber[QueIdx],
+						      pPacket);
+			if (!hasTxDesc) {
 				pAd->PrivateInfo.TxRingFullCnt++;
 
-				DEQUEUE_UNLOCK(&pAd->irq_lock, bIntContext, IrqFlags);
+				DEQUEUE_UNLOCK(&pAd->irq_lock, bIntContext,
+					       IrqFlags);
 
 				break;
 			}
@@ -1045,74 +803,89 @@ VOID RTMPDeQueuePacket(
 			pTxBlk->TxFrameType = TxPktClassification(pAd, pPacket);
 			pEntry = RemoveHeadQueue(pQueue);
 			pTxBlk->TotalFrameNum++;
-			pTxBlk->TotalFragNum += RTMP_GET_PACKET_FRAGMENTS(pPacket);	// The real fragment number maybe vary
+			pTxBlk->TotalFragNum += RTMP_GET_PACKET_FRAGMENTS(pPacket);	/* The real fragment number maybe vary */
 			pTxBlk->TotalFrameLen += GET_OS_PKT_LEN(pPacket);
 			pTxBlk->pPacket = pPacket;
-			InsertTailQueue(&pTxBlk->TxPacketList, PACKET_TO_QUEUE_ENTRY(pPacket));
-
-			if (pTxBlk->TxFrameType == TX_RALINK_FRAME || pTxBlk->TxFrameType == TX_AMSDU_FRAME)
-			{
-				// Enhance SW Aggregation Mechanism
-				if (NEED_QUEUE_BACK_FOR_AGG(pAd, QueIdx, FreeNumber[QueIdx], pTxBlk->TxFrameType))
-				{
-					InsertHeadQueue(pQueue, PACKET_TO_QUEUE_ENTRY(pPacket));
-					DEQUEUE_UNLOCK(&pAd->irq_lock, bIntContext, IrqFlags);
+			InsertTailQueue(&pTxBlk->TxPacketList,
+					PACKET_TO_QUEUE_ENTRY(pPacket));
+
+			if (pTxBlk->TxFrameType == TX_RALINK_FRAME
+			    || pTxBlk->TxFrameType == TX_AMSDU_FRAME) {
+				/* Enhance SW Aggregation Mechanism */
+				if (NEED_QUEUE_BACK_FOR_AGG
+				    (pAd, QueIdx, FreeNumber[QueIdx],
+				     pTxBlk->TxFrameType)) {
+					InsertHeadQueue(pQueue,
+							PACKET_TO_QUEUE_ENTRY
+							(pPacket));
+					DEQUEUE_UNLOCK(&pAd->irq_lock,
+						       bIntContext, IrqFlags);
 					break;
 				}
 
-				do{
-					if((pEntry = pQueue->Head) == NULL)
+				do {
+					if ((pEntry = pQueue->Head) == NULL)
 						break;
 
-					// For TX_AMSDU_FRAME/TX_RALINK_FRAME, Need to check if next pakcet can do aggregation.
-					pPacket = QUEUE_ENTRY_TO_PKT(pEntry);
-					FreeNumber[QueIdx] = GET_TXRING_FREENO(pAd, QueIdx);
-					hasTxDesc = RT28XX_HAS_ENOUGH_FREE_DESC(pAd, pTxBlk, FreeNumber[QueIdx], pPacket);
-					if ((hasTxDesc == FALSE) || (CanDoAggregateTransmit(pAd, pPacket, pTxBlk) == FALSE))
+					/* For TX_AMSDU_FRAME/TX_RALINK_FRAME, Need to check if next pakcet can do aggregation. */
+					pPacket = QUEUE_ENTRY_TO_PACKET(pEntry);
+					FreeNumber[QueIdx] =
+					    GET_TXRING_FREENO(pAd, QueIdx);
+					hasTxDesc =
+					    RTMP_HAS_ENOUGH_FREE_DESC(pAd,
+								      pTxBlk,
+								      FreeNumber
+								      [QueIdx],
+								      pPacket);
+					if ((hasTxDesc == FALSE)
+					    ||
+					    (CanDoAggregateTransmit
+					     (pAd, pPacket, pTxBlk) == FALSE))
 						break;
 
-					//Remove the packet from the TxSwQueue and insert into pTxBlk
+					/*Remove the packet from the TxSwQueue and insert into pTxBlk */
 					pEntry = RemoveHeadQueue(pQueue);
 					ASSERT(pEntry);
-					pPacket = QUEUE_ENTRY_TO_PKT(pEntry);
+					pPacket = QUEUE_ENTRY_TO_PACKET(pEntry);
 					pTxBlk->TotalFrameNum++;
-					pTxBlk->TotalFragNum += RTMP_GET_PACKET_FRAGMENTS(pPacket);	// The real fragment number maybe vary
-					pTxBlk->TotalFrameLen += GET_OS_PKT_LEN(pPacket);
-					InsertTailQueue(&pTxBlk->TxPacketList, PACKET_TO_QUEUE_ENTRY(pPacket));
-				}while(1);
+					pTxBlk->TotalFragNum += RTMP_GET_PACKET_FRAGMENTS(pPacket);	/* The real fragment number maybe vary */
+					pTxBlk->TotalFrameLen +=
+					    GET_OS_PKT_LEN(pPacket);
+					InsertTailQueue(&pTxBlk->TxPacketList,
+							PACKET_TO_QUEUE_ENTRY
+							(pPacket));
+				} while (1);
 
 				if (pTxBlk->TxPacketList.Number == 1)
 					pTxBlk->TxFrameType = TX_LEGACY_FRAME;
 			}
-
-#ifdef RT2870
+#ifdef RTMP_MAC_USB
 			DEQUEUE_UNLOCK(&pAd->irq_lock, bIntContext, IrqFlags);
-#endif // RT2870 //
-
+#endif /* RTMP_MAC_USB // */
 			Count += pTxBlk->TxPacketList.Number;
 
-			// Do HardTransmit now.
+			/* Do HardTransmit now. */
 			Status = STAHardTransmit(pAd, pTxBlk, QueIdx);
 
-#ifdef RT2860
+#ifdef RTMP_MAC_PCI
 			DEQUEUE_UNLOCK(&pAd->irq_lock, bIntContext, IrqFlags);
-			// static rate also need NICUpdateFifoStaCounters() function.
-			//if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_TX_RATE_SWITCH_ENABLED))
-				NICUpdateFifoStaCounters(pAd);
-#endif
+			/* static rate also need NICUpdateFifoStaCounters() function. */
+			/*if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_TX_RATE_SWITCH_ENABLED)) */
+			NICUpdateFifoStaCounters(pAd);
+#endif /* RTMP_MAC_PCI // */
+
 		}
 
-		RT28XX_STOP_DEQUEUE(pAd, QueIdx, IrqFlags);
+		RTMP_STOP_DEQUEUE(pAd, QueIdx, IrqFlags);
 
-#ifdef RT2870
+#ifdef RTMP_MAC_USB
 		if (!hasTxDesc)
 			RTUSBKickBulkOut(pAd);
-#endif // RT2870 //
+#endif /* RTMP_MAC_USB // */
 	}
 
 }
 
-
 /*
 	========================================================================
 
@@ -1135,40 +908,37 @@ VOID RTMPDeQueuePacket(
 
 	========================================================================
 */
-USHORT	RTMPCalcDuration(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			Rate,
-	IN	ULONG			Size)
+u16 RTMPCalcDuration(struct rt_rtmp_adapter *pAd, u8 Rate, unsigned long Size)
 {
-	ULONG	Duration = 0;
+	unsigned long Duration = 0;
 
-	if (Rate < RATE_FIRST_OFDM_RATE) // CCK
+	if (Rate < RATE_FIRST_OFDM_RATE)	/* CCK */
 	{
-		if ((Rate > RATE_1) && OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_SHORT_PREAMBLE_INUSED))
-			Duration = 96;	// 72+24 preamble+plcp
+		if ((Rate > RATE_1)
+		    && OPSTATUS_TEST_FLAG(pAd,
+					  fOP_STATUS_SHORT_PREAMBLE_INUSED))
+			Duration = 96;	/* 72+24 preamble+plcp */
 		else
-			Duration = 192; // 144+48 preamble+plcp
+			Duration = 192;	/* 144+48 preamble+plcp */
 
-		Duration += (USHORT)((Size << 4) / RateIdTo500Kbps[Rate]);
+		Duration += (u16)((Size << 4) / RateIdTo500Kbps[Rate]);
 		if ((Size << 4) % RateIdTo500Kbps[Rate])
-			Duration ++;
-	}
-	else if (Rate <= RATE_LAST_OFDM_RATE)// OFDM rates
+			Duration++;
+	} else if (Rate <= RATE_LAST_OFDM_RATE)	/* OFDM rates */
 	{
-		Duration = 20 + 6;		// 16+4 preamble+plcp + Signal Extension
-		Duration += 4 * (USHORT)((11 + Size * 4) / RateIdTo500Kbps[Rate]);
+		Duration = 20 + 6;	/* 16+4 preamble+plcp + Signal Extension */
+		Duration +=
+		    4 * (u16)((11 + Size * 4) / RateIdTo500Kbps[Rate]);
 		if ((11 + Size * 4) % RateIdTo500Kbps[Rate])
 			Duration += 4;
-	}
-	else	//mimo rate
+	} else			/*mimo rate */
 	{
-		Duration = 20 + 6;		// 16+4 preamble+plcp + Signal Extension
+		Duration = 20 + 6;	/* 16+4 preamble+plcp + Signal Extension */
 	}
 
-	return (USHORT)Duration;
+	return (u16)Duration;
 }
 
-
 /*
 	========================================================================
 
@@ -1194,58 +964,53 @@ USHORT	RTMPCalcDuration(
 	IRQL = PASSIVE_LEVEL
 	IRQL = DISPATCH_LEVEL
 
-    See also : BASmartHardTransmit()    !!!
+    See also : BASmartHardTransmit()    !
 
 	========================================================================
 */
-VOID RTMPWriteTxWI(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PTXWI_STRUC 	pOutTxWI,
-	IN	BOOLEAN			FRAG,
-	IN	BOOLEAN			CFACK,
-	IN	BOOLEAN			InsTimestamp,
-	IN	BOOLEAN 		AMPDU,
-	IN	BOOLEAN 		Ack,
-	IN	BOOLEAN 		NSeq,		// HW new a sequence.
-	IN	UCHAR			BASize,
-	IN	UCHAR			WCID,
-	IN	ULONG			Length,
-	IN	UCHAR 			PID,
-	IN	UCHAR			TID,
-	IN	UCHAR			TxRate,
-	IN	UCHAR			Txopmode,
-	IN	BOOLEAN			CfAck,
-	IN	HTTRANSMIT_SETTING	*pTransmit)
+void RTMPWriteTxWI(struct rt_rtmp_adapter *pAd, struct rt_txwi * pOutTxWI, IN BOOLEAN FRAG, IN BOOLEAN CFACK, IN BOOLEAN InsTimestamp, IN BOOLEAN AMPDU, IN BOOLEAN Ack, IN BOOLEAN NSeq,	/* HW new a sequence. */
+		   u8 BASize,
+		   u8 WCID,
+		   unsigned long Length,
+		   u8 PID,
+		   u8 TID,
+		   u8 TxRate,
+		   u8 Txopmode,
+		   IN BOOLEAN CfAck, IN HTTRANSMIT_SETTING * pTransmit)
 {
-	PMAC_TABLE_ENTRY	pMac = NULL;
-	TXWI_STRUC 		TxWI;
-	PTXWI_STRUC 	pTxWI;
+	struct rt_mac_table_entry *pMac = NULL;
+	struct rt_txwi TxWI;
+	struct rt_txwi * pTxWI;
 
 	if (WCID < MAX_LEN_OF_MAC_TABLE)
 		pMac = &pAd->MacTab.Content[WCID];
 
-	//
-	// Always use Long preamble before verifiation short preamble functionality works well.
-	// Todo: remove the following line if short preamble functionality works
-	//
+	/* */
+	/* Always use Long preamble before verifiation short preamble functionality works well. */
+	/* Todo: remove the following line if short preamble functionality works */
+	/* */
 	OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_SHORT_PREAMBLE_INUSED);
 	NdisZeroMemory(&TxWI, TXWI_SIZE);
 	pTxWI = &TxWI;
 
-	pTxWI->FRAG= FRAG;
+	pTxWI->FRAG = FRAG;
 
 	pTxWI->CFACK = CFACK;
-	pTxWI->TS= InsTimestamp;
+	pTxWI->TS = InsTimestamp;
 	pTxWI->AMPDU = AMPDU;
 	pTxWI->ACK = Ack;
-	pTxWI->txop= Txopmode;
+	pTxWI->txop = Txopmode;
 
 	pTxWI->NSEQ = NSeq;
-	// John tune the performace with Intel Client in 20 MHz performance
+	/* John tune the performace with Intel Client in 20 MHz performance */
 	BASize = pAd->CommonCfg.TxBASize;
-
-	if( BASize >7 )
-		BASize =7;
+	if (pAd->MACVersion == 0x28720200) {
+		if (BASize > 13)
+			BASize = 13;
+	} else {
+		if (BASize > 7)
+			BASize = 7;
+	}
 	pTxWI->BAWinSize = BASize;
 	pTxWI->ShortGI = pTransmit->field.ShortGI;
 	pTxWI->STBC = pTransmit->field.STBC;
@@ -1254,90 +1019,84 @@ VOID RTMPWriteTxWI(
 	pTxWI->MPDUtotalByteCount = Length;
 	pTxWI->PacketId = PID;
 
-	// If CCK or OFDM, BW must be 20
-	pTxWI->BW = (pTransmit->field.MODE <= MODE_OFDM) ? (BW_20) : (pTransmit->field.BW);
+	/* If CCK or OFDM, BW must be 20 */
+	pTxWI->BW =
+	    (pTransmit->field.MODE <=
+	     MODE_OFDM) ? (BW_20) : (pTransmit->field.BW);
 
 	pTxWI->MCS = pTransmit->field.MCS;
 	pTxWI->PHYMODE = pTransmit->field.MODE;
 	pTxWI->CFACK = CfAck;
 
-	if (pMac)
-	{
-		if (pAd->CommonCfg.bMIMOPSEnable)
-		{
-			if ((pMac->MmpsMode == MMPS_DYNAMIC) && (pTransmit->field.MCS > 7))
-			{
-				// Dynamic MIMO Power Save Mode
+	if (pMac) {
+		if (pAd->CommonCfg.bMIMOPSEnable) {
+			if ((pMac->MmpsMode == MMPS_DYNAMIC)
+			    && (pTransmit->field.MCS > 7)) {
+				/* Dynamic MIMO Power Save Mode */
 				pTxWI->MIMOps = 1;
-			}
-			else if (pMac->MmpsMode == MMPS_STATIC)
-			{
-				// Static MIMO Power Save Mode
-				if (pTransmit->field.MODE >= MODE_HTMIX && pTransmit->field.MCS > 7)
-				{
+			} else if (pMac->MmpsMode == MMPS_STATIC) {
+				/* Static MIMO Power Save Mode */
+				if (pTransmit->field.MODE >= MODE_HTMIX
+				    && pTransmit->field.MCS > 7) {
 					pTxWI->MCS = 7;
 					pTxWI->MIMOps = 0;
 				}
 			}
 		}
-		//pTxWI->MIMOps = (pMac->PsMode == PWR_MMPS)? 1:0;
-		if (pMac->bIAmBadAtheros && (pMac->WepStatus != Ndis802_11WEPDisabled))
-		{
+		/*pTxWI->MIMOps = (pMac->PsMode == PWR_MMPS)? 1:0; */
+		if (pMac->bIAmBadAtheros
+		    && (pMac->WepStatus != Ndis802_11WEPDisabled)) {
 			pTxWI->MpduDensity = 7;
-		}
-		else
-		{
+		} else {
 			pTxWI->MpduDensity = pMac->MpduDensity;
 		}
 	}
 
 	pTxWI->PacketId = pTxWI->MCS;
-	NdisMoveMemory(pOutTxWI, &TxWI, sizeof(TXWI_STRUC));
+	NdisMoveMemory(pOutTxWI, &TxWI, sizeof(struct rt_txwi));
 }
 
-
-VOID RTMPWriteTxWI_Data(
-	IN	PRTMP_ADAPTER		pAd,
-	IN	OUT PTXWI_STRUC		pTxWI,
-	IN	TX_BLK				*pTxBlk)
+void RTMPWriteTxWI_Data(struct rt_rtmp_adapter *pAd,
+			struct rt_txwi * pTxWI, struct rt_tx_blk *pTxBlk)
 {
-	HTTRANSMIT_SETTING	*pTransmit;
-	PMAC_TABLE_ENTRY	pMacEntry;
-	UCHAR				BASize;
+	HTTRANSMIT_SETTING *pTransmit;
+	struct rt_mac_table_entry *pMacEntry;
+	u8 BASize;
 
 	ASSERT(pTxWI);
 
 	pTransmit = pTxBlk->pTransmit;
 	pMacEntry = pTxBlk->pMacEntry;
 
-
-	//
-	// Always use Long preamble before verifiation short preamble functionality works well.
-	// Todo: remove the following line if short preamble functionality works
-	//
+	/* */
+	/* Always use Long preamble before verifiation short preamble functionality works well. */
+	/* Todo: remove the following line if short preamble functionality works */
+	/* */
 	OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_SHORT_PREAMBLE_INUSED);
 	NdisZeroMemory(pTxWI, TXWI_SIZE);
 
-	pTxWI->FRAG		= TX_BLK_TEST_FLAG(pTxBlk, fTX_bAllowFrag);
-	pTxWI->ACK		= TX_BLK_TEST_FLAG(pTxBlk, fTX_bAckRequired);
-	pTxWI->txop		= pTxBlk->FrameGap;
+	pTxWI->FRAG = TX_BLK_TEST_FLAG(pTxBlk, fTX_bAllowFrag);
+	pTxWI->ACK = TX_BLK_TEST_FLAG(pTxBlk, fTX_bAckRequired);
+	pTxWI->txop = pTxBlk->FrameGap;
 
-		pTxWI->WirelessCliID		= pTxBlk->Wcid;
+	pTxWI->WirelessCliID = pTxBlk->Wcid;
 
-	pTxWI->MPDUtotalByteCount	= pTxBlk->MpduHeaderLen + pTxBlk->SrcBufLen;
-	pTxWI->CFACK				= TX_BLK_TEST_FLAG(pTxBlk, fTX_bPiggyBack);
+	pTxWI->MPDUtotalByteCount = pTxBlk->MpduHeaderLen + pTxBlk->SrcBufLen;
+	pTxWI->CFACK = TX_BLK_TEST_FLAG(pTxBlk, fTX_bPiggyBack);
 
-	// If CCK or OFDM, BW must be 20
-	pTxWI->BW = (pTransmit->field.MODE <= MODE_OFDM) ? (BW_20) : (pTransmit->field.BW);
-	pTxWI->AMPDU	= ((pTxBlk->TxFrameType == TX_AMPDU_FRAME) ? TRUE : FALSE);
+	/* If CCK or OFDM, BW must be 20 */
+	pTxWI->BW =
+	    (pTransmit->field.MODE <=
+	     MODE_OFDM) ? (BW_20) : (pTransmit->field.BW);
+	pTxWI->AMPDU = ((pTxBlk->TxFrameType == TX_AMPDU_FRAME) ? TRUE : FALSE);
 
-	// John tune the performace with Intel Client in 20 MHz performance
+	/* John tune the performace with Intel Client in 20 MHz performance */
 	BASize = pAd->CommonCfg.TxBASize;
-	if((pTxBlk->TxFrameType == TX_AMPDU_FRAME) && (pMacEntry))
-	{
-		UCHAR		RABAOriIdx = 0;	//The RA's BA Originator table index.
+	if ((pTxBlk->TxFrameType == TX_AMPDU_FRAME) && (pMacEntry)) {
+		u8 RABAOriIdx = 0;	/*The RA's BA Originator table index. */
 
-		RABAOriIdx = pTxBlk->pMacEntry->BAOriWcidArray[pTxBlk->UserPriority];
+		RABAOriIdx =
+		    pTxBlk->pMacEntry->BAOriWcidArray[pTxBlk->UserPriority];
 		BASize = pAd->BATable.BAOriEntry[RABAOriIdx].BAWinSize;
 	}
 
@@ -1349,172 +1108,112 @@ VOID RTMPWriteTxWI_Data(
 	pTxWI->MCS = pTransmit->field.MCS;
 	pTxWI->PHYMODE = pTransmit->field.MODE;
 
-	if (pMacEntry)
-	{
-		if ((pMacEntry->MmpsMode == MMPS_DYNAMIC) && (pTransmit->field.MCS > 7))
-		{
-			// Dynamic MIMO Power Save Mode
+	if (pMacEntry) {
+		if ((pMacEntry->MmpsMode == MMPS_DYNAMIC)
+		    && (pTransmit->field.MCS > 7)) {
+			/* Dynamic MIMO Power Save Mode */
 			pTxWI->MIMOps = 1;
-		}
-		else if (pMacEntry->MmpsMode == MMPS_STATIC)
-		{
-			// Static MIMO Power Save Mode
-			if (pTransmit->field.MODE >= MODE_HTMIX && pTransmit->field.MCS > 7)
-			{
+		} else if (pMacEntry->MmpsMode == MMPS_STATIC) {
+			/* Static MIMO Power Save Mode */
+			if (pTransmit->field.MODE >= MODE_HTMIX
+			    && pTransmit->field.MCS > 7) {
 				pTxWI->MCS = 7;
 				pTxWI->MIMOps = 0;
 			}
 		}
 
-		if (pMacEntry->bIAmBadAtheros && (pMacEntry->WepStatus != Ndis802_11WEPDisabled))
-		{
+		if (pMacEntry->bIAmBadAtheros
+		    && (pMacEntry->WepStatus != Ndis802_11WEPDisabled)) {
 			pTxWI->MpduDensity = 7;
-		}
-		else
-		{
+		} else {
 			pTxWI->MpduDensity = pMacEntry->MpduDensity;
 		}
 	}
 
-
-	// for rate adapation
+	/* for rate adapation */
 	pTxWI->PacketId = pTxWI->MCS;
 }
 
-
-VOID RTMPWriteTxWI_Cache(
-	IN	PRTMP_ADAPTER		pAd,
-	IN	OUT PTXWI_STRUC		pTxWI,
-	IN	TX_BLK				*pTxBlk)
+void RTMPWriteTxWI_Cache(struct rt_rtmp_adapter *pAd,
+			 struct rt_txwi * pTxWI, struct rt_tx_blk *pTxBlk)
 {
-	PHTTRANSMIT_SETTING	pTransmit;
-	PMAC_TABLE_ENTRY	pMacEntry;
+	PHTTRANSMIT_SETTING /*pTxHTPhyMode, */ pTransmit;
+	struct rt_mac_table_entry *pMacEntry;
 
-	//
-	// update TXWI
-	//
+	/* */
+	/* update TXWI */
+	/* */
 	pMacEntry = pTxBlk->pMacEntry;
 	pTransmit = pTxBlk->pTransmit;
 
-	if (pMacEntry->bAutoTxRateSwitch)
-	{
+	/*if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_TX_RATE_SWITCH_ENABLED)) */
+	/*if (RTMPCheckEntryEnableAutoRateSwitch(pAd, pMacEntry)) */
+	/*if (TX_BLK_TEST_FLAG(pTxBlk, fTX_AutoRateSwitch)) */
+	if (pMacEntry->bAutoTxRateSwitch) {
 		pTxWI->txop = IFS_HTTXOP;
 
-		// If CCK or OFDM, BW must be 20
-		pTxWI->BW = (pTransmit->field.MODE <= MODE_OFDM) ? (BW_20) : (pTransmit->field.BW);
+		/* If CCK or OFDM, BW must be 20 */
+		pTxWI->BW =
+		    (pTransmit->field.MODE <=
+		     MODE_OFDM) ? (BW_20) : (pTransmit->field.BW);
 		pTxWI->ShortGI = pTransmit->field.ShortGI;
 		pTxWI->STBC = pTransmit->field.STBC;
 
 		pTxWI->MCS = pTransmit->field.MCS;
 		pTxWI->PHYMODE = pTransmit->field.MODE;
 
-		// set PID for TxRateSwitching
+		/* set PID for TxRateSwitching */
 		pTxWI->PacketId = pTransmit->field.MCS;
 	}
 
-	pTxWI->AMPDU = ((pMacEntry->NoBADataCountDown == 0) ? TRUE: FALSE);
+	pTxWI->AMPDU = ((pMacEntry->NoBADataCountDown == 0) ? TRUE : FALSE);
 	pTxWI->MIMOps = 0;
 
-	if (pAd->CommonCfg.bMIMOPSEnable)
-	{
-		// MIMO Power Save Mode
-		if ((pMacEntry->MmpsMode == MMPS_DYNAMIC) && (pTransmit->field.MCS > 7))
-		{
-			// Dynamic MIMO Power Save Mode
+	if (pAd->CommonCfg.bMIMOPSEnable) {
+		/* MIMO Power Save Mode */
+		if ((pMacEntry->MmpsMode == MMPS_DYNAMIC)
+		    && (pTransmit->field.MCS > 7)) {
+			/* Dynamic MIMO Power Save Mode */
 			pTxWI->MIMOps = 1;
-		}
-		else if (pMacEntry->MmpsMode == MMPS_STATIC)
-		{
-			// Static MIMO Power Save Mode
-			if ((pTransmit->field.MODE >= MODE_HTMIX) && (pTransmit->field.MCS > 7))
-			{
+		} else if (pMacEntry->MmpsMode == MMPS_STATIC) {
+			/* Static MIMO Power Save Mode */
+			if ((pTransmit->field.MODE >= MODE_HTMIX)
+			    && (pTransmit->field.MCS > 7)) {
 				pTxWI->MCS = 7;
 				pTxWI->MIMOps = 0;
 			}
 		}
 	}
 
-
 	pTxWI->MPDUtotalByteCount = pTxBlk->MpduHeaderLen + pTxBlk->SrcBufLen;
 
 }
 
-
-/*
-	========================================================================
-
-	Routine Description:
-		Calculates the duration which is required to transmit out frames
-	with given size and specified rate.
-
-	Arguments:
-		pTxD		Pointer to transmit descriptor
-		Ack 		Setting for Ack requirement bit
-		Fragment	Setting for Fragment bit
-		RetryMode	Setting for retry mode
-		Ifs 		Setting for IFS gap
-		Rate		Setting for transmit rate
-		Service 	Setting for service
-		Length		Frame length
-		TxPreamble	Short or Long preamble when using CCK rates
-		QueIdx - 0-3, according to 802.11e/d4.4 June/2003
-
-	Return Value:
-		None
-
-	IRQL = PASSIVE_LEVEL
-	IRQL = DISPATCH_LEVEL
-
-	========================================================================
-*/
-VOID RTMPWriteTxDescriptor(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PTXD_STRUC		pTxD,
-	IN	BOOLEAN 		bWIV,
-	IN	UCHAR			QueueSEL)
+/* should be called only when - */
+/* 1. MEADIA_CONNECTED */
+/* 2. AGGREGATION_IN_USED */
+/* 3. Fragmentation not in used */
+/* 4. either no previous frame (pPrevAddr1=NULL) .OR. previoud frame is aggregatible */
+BOOLEAN TxFrameIsAggregatible(struct rt_rtmp_adapter *pAd,
+			      u8 *pPrevAddr1, u8 *p8023hdr)
 {
-	//
-	// Always use Long preamble before verifiation short preamble functionality works well.
-	// Todo: remove the following line if short preamble functionality works
-	//
-	OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_SHORT_PREAMBLE_INUSED);
 
-	pTxD->WIV	= (bWIV) ? 1: 0;
-	pTxD->QSEL= (QueueSEL);
-	if (pAd->bGenOneHCCA == TRUE)
-		pTxD->QSEL= FIFO_HCCA;
-	pTxD->DMADONE = 0;
-}
-
-
-// should be called only when -
-// 1. MEADIA_CONNECTED
-// 2. AGGREGATION_IN_USED
-// 3. Fragmentation not in used
-// 4. either no previous frame (pPrevAddr1=NULL) .OR. previoud frame is aggregatible
-BOOLEAN TxFrameIsAggregatible(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			pPrevAddr1,
-	IN	PUCHAR			p8023hdr)
-{
-
-	// can't aggregate EAPOL (802.1x) frame
+	/* can't aggregate EAPOL (802.1x) frame */
 	if ((p8023hdr[12] == 0x88) && (p8023hdr[13] == 0x8e))
 		return FALSE;
 
-	// can't aggregate multicast/broadcast frame
+	/* can't aggregate multicast/broadcast frame */
 	if (p8023hdr[0] & 0x01)
 		return FALSE;
 
-	if (INFRA_ON(pAd)) // must be unicast to AP
+	if (INFRA_ON(pAd))	/* must be unicast to AP */
 		return TRUE;
-	else if ((pPrevAddr1 == NULL) || MAC_ADDR_EQUAL(pPrevAddr1, p8023hdr)) // unicast to same STA
+	else if ((pPrevAddr1 == NULL) || MAC_ADDR_EQUAL(pPrevAddr1, p8023hdr))	/* unicast to same STA */
 		return TRUE;
 	else
 		return FALSE;
 }
 
-
 /*
 	========================================================================
 
@@ -1531,33 +1230,27 @@ BOOLEAN TxFrameIsAggregatible(
 
 	========================================================================
 */
-BOOLEAN PeerIsAggreOn(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	ULONG		   TxRate,
-	IN	PMAC_TABLE_ENTRY pMacEntry)
+BOOLEAN PeerIsAggreOn(struct rt_rtmp_adapter *pAd,
+		      unsigned long TxRate, struct rt_mac_table_entry *pMacEntry)
 {
-	ULONG	AFlags = (fCLIENT_STATUS_AMSDU_INUSED | fCLIENT_STATUS_AGGREGATION_CAPABLE);
+	unsigned long AFlags =
+	    (fCLIENT_STATUS_AMSDU_INUSED | fCLIENT_STATUS_AGGREGATION_CAPABLE);
 
-	if (pMacEntry != NULL && CLIENT_STATUS_TEST_FLAG(pMacEntry, AFlags))
-	{
-		if (pMacEntry->HTPhyMode.field.MODE >= MODE_HTMIX)
-		{
+	if (pMacEntry != NULL && CLIENT_STATUS_TEST_FLAG(pMacEntry, AFlags)) {
+		if (pMacEntry->HTPhyMode.field.MODE >= MODE_HTMIX) {
 			return TRUE;
 		}
-
 #ifdef AGGREGATION_SUPPORT
-		if (TxRate >= RATE_6 && pAd->CommonCfg.bAggregationCapable && (!(OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_WMM_INUSED) && CLIENT_STATUS_TEST_FLAG(pMacEntry, fCLIENT_STATUS_WMM_CAPABLE))))
-		{	// legacy  Ralink Aggregation support
+		if (TxRate >= RATE_6 && pAd->CommonCfg.bAggregationCapable && (!(OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_WMM_INUSED) && CLIENT_STATUS_TEST_FLAG(pMacEntry, fCLIENT_STATUS_WMM_CAPABLE)))) {	/* legacy  Ralink Aggregation support */
 			return TRUE;
 		}
-#endif // AGGREGATION_SUPPORT //
+#endif /* AGGREGATION_SUPPORT // */
 	}
 
 	return FALSE;
 
 }
 
-
 /*
 	========================================================================
 
@@ -1576,323 +1269,38 @@ BOOLEAN PeerIsAggreOn(
 
 	========================================================================
 */
-PQUEUE_HEADER	RTMPCheckTxSwQueue(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT PUCHAR			pQueIdx)
+struct rt_queue_header *RTMPCheckTxSwQueue(struct rt_rtmp_adapter *pAd, u8 *pQueIdx)
 {
 
-	ULONG	Number;
+	unsigned long Number;
+	/* 2004-11-15 to be removed. test aggregation only */
+/*      if ((OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_AGGREGATION_INUSED)) && (*pNumber < 2)) */
+/*               return NULL; */
 
 	Number = pAd->TxSwQueue[QID_AC_BK].Number
-			 + pAd->TxSwQueue[QID_AC_BE].Number
-			 + pAd->TxSwQueue[QID_AC_VI].Number
-			 + pAd->TxSwQueue[QID_AC_VO].Number
-			 + pAd->TxSwQueue[QID_HCCA].Number;
+	    + pAd->TxSwQueue[QID_AC_BE].Number
+	    + pAd->TxSwQueue[QID_AC_VI].Number
+	    + pAd->TxSwQueue[QID_AC_VO].Number;
 
-	if (pAd->TxSwQueue[QID_AC_VO].Head != NULL)
-	{
+	if (pAd->TxSwQueue[QID_AC_VO].Head != NULL) {
 		*pQueIdx = QID_AC_VO;
 		return (&pAd->TxSwQueue[QID_AC_VO]);
-	}
-	else if (pAd->TxSwQueue[QID_AC_VI].Head != NULL)
-	{
+	} else if (pAd->TxSwQueue[QID_AC_VI].Head != NULL) {
 		*pQueIdx = QID_AC_VI;
 		return (&pAd->TxSwQueue[QID_AC_VI]);
-	}
-	else if (pAd->TxSwQueue[QID_AC_BE].Head != NULL)
-	{
+	} else if (pAd->TxSwQueue[QID_AC_BE].Head != NULL) {
 		*pQueIdx = QID_AC_BE;
 		return (&pAd->TxSwQueue[QID_AC_BE]);
-	}
-	else if (pAd->TxSwQueue[QID_AC_BK].Head != NULL)
-	{
+	} else if (pAd->TxSwQueue[QID_AC_BK].Head != NULL) {
 		*pQueIdx = QID_AC_BK;
 		return (&pAd->TxSwQueue[QID_AC_BK]);
 	}
-	else if (pAd->TxSwQueue[QID_HCCA].Head != NULL)
-	{
-		*pQueIdx = QID_HCCA;
-		return (&pAd->TxSwQueue[QID_HCCA]);
-	}
-
-	// No packet pending in Tx Sw queue
+	/* No packet pending in Tx Sw queue */
 	*pQueIdx = QID_AC_BK;
 
 	return (NULL);
 }
 
-#ifdef RT2860
-BOOLEAN  RTMPFreeTXDUponTxDmaDone(
-	IN PRTMP_ADAPTER	pAd,
-	IN UCHAR			QueIdx)
-{
-	PRTMP_TX_RING pTxRing;
-	PTXD_STRUC	  pTxD;
-	PNDIS_PACKET  pPacket;
-	UCHAR	FREE = 0;
-	TXD_STRUC	TxD, *pOriTxD;
-	//ULONG		IrqFlags;
-	BOOLEAN			bReschedule = FALSE;
-
-
-	ASSERT(QueIdx < NUM_OF_TX_RING);
-	pTxRing = &pAd->TxRing[QueIdx];
-
-	RTMP_IO_READ32(pAd, TX_DTX_IDX0 + QueIdx * RINGREG_DIFF, &pTxRing->TxDmaIdx);
-	while (pTxRing->TxSwFreeIdx != pTxRing->TxDmaIdx)
-	{
-		// static rate also need NICUpdateFifoStaCounters() function.
-		//if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_TX_RATE_SWITCH_ENABLED))
-			NICUpdateFifoStaCounters(pAd);
-
-		/* Note : If (pAd->ate.bQATxStart == TRUE), we will never reach here. */
-		FREE++;
-                pTxD = (PTXD_STRUC) (pTxRing->Cell[pTxRing->TxSwFreeIdx].AllocVa);
-		pOriTxD = pTxD;
-                NdisMoveMemory(&TxD, pTxD, sizeof(TXD_STRUC));
-		pTxD = &TxD;
-
-		pTxD->DMADONE = 0;
-
-/*====================================================================*/
-		{
-			pPacket = pTxRing->Cell[pTxRing->TxSwFreeIdx].pNdisPacket;
-			if (pPacket)
-			{
-#ifdef CONFIG_5VT_ENHANCE
-				if (RTMP_GET_PACKET_5VT(pPacket))
-					PCI_UNMAP_SINGLE(pAd, pTxD->SDPtr1, 16, PCI_DMA_TODEVICE);
-				else
-#endif // CONFIG_5VT_ENHANCE //
-					PCI_UNMAP_SINGLE(pAd, pTxD->SDPtr1, pTxD->SDLen1, PCI_DMA_TODEVICE);
-				RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_SUCCESS);
-			}
-			//Always assign pNdisPacket as NULL after clear
-			pTxRing->Cell[pTxRing->TxSwFreeIdx].pNdisPacket = NULL;
-
-			pPacket = pTxRing->Cell[pTxRing->TxSwFreeIdx].pNextNdisPacket;
-
-			ASSERT(pPacket == NULL);
-			if (pPacket)
-			{
-#ifdef CONFIG_5VT_ENHANCE
-				if (RTMP_GET_PACKET_5VT(pPacket))
-					PCI_UNMAP_SINGLE(pAd, pTxD->SDPtr1, 16, PCI_DMA_TODEVICE);
-				else
-#endif // CONFIG_5VT_ENHANCE //
-					PCI_UNMAP_SINGLE(pAd, pTxD->SDPtr1, pTxD->SDLen1, PCI_DMA_TODEVICE);
-				RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_SUCCESS);
-			}
-			//Always assign pNextNdisPacket as NULL after clear
-			pTxRing->Cell[pTxRing->TxSwFreeIdx].pNextNdisPacket = NULL;
-		}
-/*====================================================================*/
-
-		pAd->RalinkCounters.TransmittedByteCount +=  (pTxD->SDLen1 + pTxD->SDLen0);
-		pAd->RalinkCounters.OneSecDmaDoneCount[QueIdx] ++;
-		INC_RING_INDEX(pTxRing->TxSwFreeIdx, TX_RING_SIZE);
-		/* get tx_tdx_idx again */
-		RTMP_IO_READ32(pAd, TX_DTX_IDX0 + QueIdx * RINGREG_DIFF ,  &pTxRing->TxDmaIdx);
-
-        NdisMoveMemory(pOriTxD, pTxD, sizeof(TXD_STRUC));
-	}
-
-
-	return  bReschedule;
-
-}
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		Process TX Rings DMA Done interrupt, running in DPC level
-
-	Arguments:
-		Adapter 	Pointer to our adapter
-
-	Return Value:
-		None
-
-	IRQL = DISPATCH_LEVEL
-
-	========================================================================
-*/
-BOOLEAN	RTMPHandleTxRingDmaDoneInterrupt(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	INT_SOURCE_CSR_STRUC TxRingBitmap)
-{
-    unsigned long	IrqFlags;
-	BOOLEAN			bReschedule = FALSE;
-
-	// Make sure Tx ring resource won't be used by other threads
-
-	RTMP_IRQ_LOCK(&pAd->irq_lock, IrqFlags);
-
-	if (TxRingBitmap.field.Ac0DmaDone)
-		bReschedule = RTMPFreeTXDUponTxDmaDone(pAd, QID_AC_BE);
-
-	if (TxRingBitmap.field.HccaDmaDone)
-		bReschedule |= RTMPFreeTXDUponTxDmaDone(pAd, QID_HCCA);
-
-	if (TxRingBitmap.field.Ac3DmaDone)
-		bReschedule |= RTMPFreeTXDUponTxDmaDone(pAd, QID_AC_VO);
-
-	if (TxRingBitmap.field.Ac2DmaDone)
-		bReschedule |= RTMPFreeTXDUponTxDmaDone(pAd, QID_AC_VI);
-
-	if (TxRingBitmap.field.Ac1DmaDone)
-		bReschedule |= RTMPFreeTXDUponTxDmaDone(pAd, QID_AC_BK);
-
-	// Make sure to release Tx ring resource
-	RTMP_IRQ_UNLOCK(&pAd->irq_lock, IrqFlags);
-
-	// Dequeue outgoing frames from TxSwQueue[] and process it
-	RTMPDeQueuePacket(pAd, FALSE, NUM_OF_TX_RING, MAX_TX_PROCESS);
-
-	return  bReschedule;
-}
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		Process MGMT ring DMA done interrupt, running in DPC level
-
-	Arguments:
-		pAd 	Pointer to our adapter
-
-	Return Value:
-		None
-
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-VOID	RTMPHandleMgmtRingDmaDoneInterrupt(
-	IN	PRTMP_ADAPTER	pAd)
-{
-	PTXD_STRUC	 pTxD;
-	PNDIS_PACKET pPacket;
-	UCHAR	FREE = 0;
-	PRTMP_MGMT_RING pMgmtRing = &pAd->MgmtRing;
-
-	NdisAcquireSpinLock(&pAd->MgmtRingLock);
-
-	RTMP_IO_READ32(pAd, TX_MGMTDTX_IDX, &pMgmtRing->TxDmaIdx);
-	while (pMgmtRing->TxSwFreeIdx!= pMgmtRing->TxDmaIdx)
-	{
-		FREE++;
-		pTxD = (PTXD_STRUC) (pMgmtRing->Cell[pAd->MgmtRing.TxSwFreeIdx].AllocVa);
-		pTxD->DMADONE = 0;
-		pPacket = pMgmtRing->Cell[pMgmtRing->TxSwFreeIdx].pNdisPacket;
-
-
-		if (pPacket)
-		{
-			PCI_UNMAP_SINGLE(pAd, pTxD->SDPtr0, pTxD->SDLen0, PCI_DMA_TODEVICE);
-			RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_SUCCESS);
-		}
-		pMgmtRing->Cell[pMgmtRing->TxSwFreeIdx].pNdisPacket = NULL;
-
-		pPacket = pMgmtRing->Cell[pMgmtRing->TxSwFreeIdx].pNextNdisPacket;
-		if (pPacket)
-		{
-			PCI_UNMAP_SINGLE(pAd, pTxD->SDPtr1, pTxD->SDLen1, PCI_DMA_TODEVICE);
-			RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_SUCCESS);
-		}
-		pMgmtRing->Cell[pMgmtRing->TxSwFreeIdx].pNextNdisPacket = NULL;
-		INC_RING_INDEX(pMgmtRing->TxSwFreeIdx, MGMT_RING_SIZE);
-	}
-	NdisReleaseSpinLock(&pAd->MgmtRingLock);
-
-}
-
-
-/*
-	========================================================================
-
-	Routine Description:
-	Arguments:
-		Adapter 	Pointer to our adapter. Dequeue all power safe delayed braodcast frames after beacon.
-
-	IRQL = DISPATCH_LEVEL
-
-	========================================================================
-*/
-VOID	RTMPHandleTBTTInterrupt(
-	IN PRTMP_ADAPTER pAd)
-{
-	{
-		if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE))
-		{
-		}
-	}
-}
-
-
-/*
-	========================================================================
-
-	Routine Description:
-	Arguments:
-		Adapter 	Pointer to our adapter. Rewrite beacon content before next send-out.
-
-	IRQL = DISPATCH_LEVEL
-
-	========================================================================
-*/
-VOID	RTMPHandlePreTBTTInterrupt(
-	IN PRTMP_ADAPTER pAd)
-{
-	{
-		if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE))
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("RTMPHandlePreTBTTInterrupt...\n"));
-		}
-	}
-
-
-}
-
-VOID	RTMPHandleRxCoherentInterrupt(
-	IN	PRTMP_ADAPTER	pAd)
-{
-	WPDMA_GLO_CFG_STRUC	GloCfg;
-
-	if (pAd == NULL)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("====> pAd is NULL, return.\n"));
-		return;
-	}
-
-	DBGPRINT(RT_DEBUG_TRACE, ("==> RTMPHandleRxCoherentInterrupt \n"));
-
-	RTMP_IO_READ32(pAd, WPDMA_GLO_CFG , &GloCfg.word);
-
-	GloCfg.field.EnTXWriteBackDDONE = 0;
-	GloCfg.field.EnableRxDMA = 0;
-	GloCfg.field.EnableTxDMA = 0;
-	RTMP_IO_WRITE32(pAd, WPDMA_GLO_CFG, GloCfg.word);
-
-	RTMPRingCleanUp(pAd, QID_AC_BE);
-	RTMPRingCleanUp(pAd, QID_AC_BK);
-	RTMPRingCleanUp(pAd, QID_AC_VI);
-	RTMPRingCleanUp(pAd, QID_AC_VO);
-	RTMPRingCleanUp(pAd, QID_HCCA);
-	RTMPRingCleanUp(pAd, QID_MGMT);
-	RTMPRingCleanUp(pAd, QID_RX);
-
-	RTMPEnableRxTx(pAd);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("<== RTMPHandleRxCoherentInterrupt \n"));
-}
-#endif /* RT2860 */
-
 /*
 	========================================================================
 
@@ -1909,25 +1317,25 @@ VOID	RTMPHandleRxCoherentInterrupt(
 
 	========================================================================
 */
-VOID	RTMPSuspendMsduTransmission(
-	IN	PRTMP_ADAPTER	pAd)
+void RTMPSuspendMsduTransmission(struct rt_rtmp_adapter *pAd)
 {
-	DBGPRINT(RT_DEBUG_TRACE,("SCANNING, suspend MSDU transmission ...\n"));
+	DBGPRINT(RT_DEBUG_TRACE, ("SCANNING, suspend MSDU transmission ...\n"));
 
+	/* */
+	/* Before BSS_SCAN_IN_PROGRESS, we need to keep Current R66 value and */
+	/* use Lowbound as R66 value on ScanNextChannel(...) */
+	/* */
+	RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R66,
+				    &pAd->BbpTuning.R66CurrentValue);
 
-	//
-	// Before BSS_SCAN_IN_PROGRESS, we need to keep Current R66 value and
-	// use Lowbound as R66 value on ScanNextChannel(...)
-	//
-	RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R66, &pAd->BbpTuning.R66CurrentValue);
-
-	// set BBP_R66 to 0x30/0x40 when scanning (AsicSwitchChannel will set R66 according to channel when scanning)
+	/* set BBP_R66 to 0x30/0x40 when scanning (AsicSwitchChannel will set R66 according to channel when scanning) */
+	/*RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R66, (0x26 + GET_LNA_GAIN(pAd))); */
 	RTMPSetAGCInitValue(pAd, BW_20);
 
 	RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS);
+	/*RTMP_IO_WRITE32(pAd, TX_CNTL_CSR, 0x000f0000);                // abort all TX rings */
 }
 
-
 /*
 	========================================================================
 
@@ -1946,141 +1354,145 @@ VOID	RTMPSuspendMsduTransmission(
 
 	========================================================================
 */
-VOID RTMPResumeMsduTransmission(
-	IN	PRTMP_ADAPTER	pAd)
+void RTMPResumeMsduTransmission(struct rt_rtmp_adapter *pAd)
 {
-	DBGPRINT(RT_DEBUG_TRACE,("SCAN done, resume MSDU transmission ...\n"));
+/*    u8                     IrqState; */
 
-	// After finish BSS_SCAN_IN_PROGRESS, we need to restore Current R66 value
-	// R66 should not be 0
-	if (pAd->BbpTuning.R66CurrentValue == 0)
-	{
+	DBGPRINT(RT_DEBUG_TRACE, ("SCAN done, resume MSDU transmission ...\n"));
+
+	/* After finish BSS_SCAN_IN_PROGRESS, we need to restore Current R66 value */
+	/* R66 should not be 0 */
+	if (pAd->BbpTuning.R66CurrentValue == 0) {
 		pAd->BbpTuning.R66CurrentValue = 0x38;
 		DBGPRINT_ERR(("RTMPResumeMsduTransmission, R66CurrentValue=0...\n"));
 	}
 
-	RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R66, pAd->BbpTuning.R66CurrentValue);
+	RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R66,
+				     pAd->BbpTuning.R66CurrentValue);
 
 	RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS);
+/* sample, for IRQ LOCK to SEM LOCK */
+/*    IrqState = pAd->irq_disabled; */
+/*      if (IrqState) */
+/*              RTMPDeQueuePacket(pAd, TRUE, NUM_OF_TX_RING, MAX_TX_PROCESS); */
+/*    else */
 	RTMPDeQueuePacket(pAd, FALSE, NUM_OF_TX_RING, MAX_TX_PROCESS);
 }
 
-
-UINT deaggregate_AMSDU_announce(
-	IN	PRTMP_ADAPTER	pAd,
-	PNDIS_PACKET		pPacket,
-	IN	PUCHAR			pData,
-	IN	ULONG			DataSize)
+u32 deaggregate_AMSDU_announce(struct rt_rtmp_adapter *pAd,
+				void *pPacket,
+				u8 *pData, unsigned long DataSize)
 {
-	USHORT 			PayloadSize;
-	USHORT 			SubFrameSize;
-	PHEADER_802_3 	pAMSDUsubheader;
-	UINT			nMSDU;
-    UCHAR			Header802_3[14];
-
-	PUCHAR			pPayload, pDA, pSA, pRemovedLLCSNAP;
-	PNDIS_PACKET	pClonePacket;
-
+	u16 PayloadSize;
+	u16 SubFrameSize;
+	struct rt_header_802_3 * pAMSDUsubheader;
+	u32 nMSDU;
+	u8 Header802_3[14];
 
+	u8 *pPayload, *pDA, *pSA, *pRemovedLLCSNAP;
+	void *pClonePacket;
 
 	nMSDU = 0;
 
-	while (DataSize > LENGTH_802_3)
-	{
+	while (DataSize > LENGTH_802_3) {
 
 		nMSDU++;
 
-		pAMSDUsubheader = (PHEADER_802_3)pData;
-		PayloadSize = pAMSDUsubheader->Octet[1] + (pAMSDUsubheader->Octet[0]<<8);
+		/*hex_dump("subheader", pData, 64); */
+		pAMSDUsubheader = (struct rt_header_802_3 *) pData;
+		/*pData += LENGTH_802_3; */
+		PayloadSize =
+		    pAMSDUsubheader->Octet[1] +
+		    (pAMSDUsubheader->Octet[0] << 8);
 		SubFrameSize = PayloadSize + LENGTH_802_3;
 
-
-		if ((DataSize < SubFrameSize) || (PayloadSize > 1518 ))
-		{
+		if ((DataSize < SubFrameSize) || (PayloadSize > 1518)) {
 			break;
 		}
+		/*DBGPRINT(RT_DEBUG_TRACE,("%d subframe: Size = %d\n",  nMSDU, PayloadSize)); */
 
 		pPayload = pData + LENGTH_802_3;
 		pDA = pData;
 		pSA = pData + MAC_ADDR_LEN;
 
-		// convert to 802.3 header
-        CONVERT_TO_802_3(Header802_3, pDA, pSA, pPayload, PayloadSize, pRemovedLLCSNAP);
-
-		if ((Header802_3[12] == 0x88) && (Header802_3[13] == 0x8E) )
-		{
-		    // avoid local heap overflow, use dyanamic allocation
-		   MLME_QUEUE_ELEM *Elem = (MLME_QUEUE_ELEM *) kmalloc(sizeof(MLME_QUEUE_ELEM), MEM_ALLOC_FLAG);
-		   if (Elem == NULL)
-			return;
-		   memmove(Elem->Msg+(LENGTH_802_11 + LENGTH_802_1_H), pPayload, PayloadSize);
-		   Elem->MsgLen = LENGTH_802_11 + LENGTH_802_1_H + PayloadSize;
-		   WpaEAPOLKeyAction(pAd, Elem);
-		   kfree(Elem);
+		/* convert to 802.3 header */
+		CONVERT_TO_802_3(Header802_3, pDA, pSA, pPayload, PayloadSize,
+				 pRemovedLLCSNAP);
+
+		if ((Header802_3[12] == 0x88) && (Header802_3[13] == 0x8E)) {
+			/* avoid local heap overflow, use dyanamic allocation */
+			struct rt_mlme_queue_elem *Elem =
+			    (struct rt_mlme_queue_elem *)kmalloc(sizeof(struct rt_mlme_queue_elem),
+							MEM_ALLOC_FLAG);
+			if (Elem != NULL) {
+				memmove(Elem->Msg +
+					(LENGTH_802_11 + LENGTH_802_1_H),
+					pPayload, PayloadSize);
+				Elem->MsgLen =
+				    LENGTH_802_11 + LENGTH_802_1_H +
+				    PayloadSize;
+				/*WpaEAPOLKeyAction(pAd, Elem); */
+				REPORT_MGMT_FRAME_TO_MLME(pAd, BSSID_WCID,
+							  Elem->Msg,
+							  Elem->MsgLen, 0, 0, 0,
+							  0);
+				kfree(Elem);
+			}
 		}
 
 		{
-	        	if (pRemovedLLCSNAP)
-	        	{
-	    			pPayload -= LENGTH_802_3;
-	    			PayloadSize += LENGTH_802_3;
-	    			NdisMoveMemory(pPayload, &Header802_3[0], LENGTH_802_3);
-	        	}
+			if (pRemovedLLCSNAP) {
+				pPayload -= LENGTH_802_3;
+				PayloadSize += LENGTH_802_3;
+				NdisMoveMemory(pPayload, &Header802_3[0],
+					       LENGTH_802_3);
+			}
 		}
 
 		pClonePacket = ClonePacket(pAd, pPacket, pPayload, PayloadSize);
-		if (pClonePacket)
-		{
-			ANNOUNCE_OR_FORWARD_802_3_PACKET(pAd, pClonePacket, RTMP_GET_PACKET_IF(pPacket));
+		if (pClonePacket) {
+			ANNOUNCE_OR_FORWARD_802_3_PACKET(pAd, pClonePacket,
+							 RTMP_GET_PACKET_IF
+							 (pPacket));
 		}
 
+		/* A-MSDU has padding to multiple of 4 including subframe header. */
+		/* align SubFrameSize up to multiple of 4 */
+		SubFrameSize = (SubFrameSize + 3) & (~0x3);
 
-		// A-MSDU has padding to multiple of 4 including subframe header.
-		// align SubFrameSize up to multiple of 4
-		SubFrameSize = (SubFrameSize+3)&(~0x3);
-
-
-		if (SubFrameSize > 1528 || SubFrameSize < 32)
-		{
+		if (SubFrameSize > 1528 || SubFrameSize < 32) {
 			break;
 		}
 
-		if (DataSize > SubFrameSize)
-		{
+		if (DataSize > SubFrameSize) {
 			pData += SubFrameSize;
 			DataSize -= SubFrameSize;
-		}
-		else
-		{
-			// end of A-MSDU
+		} else {
+			/* end of A-MSDU */
 			DataSize = 0;
 		}
 	}
 
-	// finally release original rx packet
+	/* finally release original rx packet */
 	RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_SUCCESS);
 
 	return nMSDU;
 }
 
-
-UINT BA_Reorder_AMSDU_Annnounce(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PNDIS_PACKET	pPacket)
+u32 BA_Reorder_AMSDU_Annnounce(struct rt_rtmp_adapter *pAd, void *pPacket)
 {
-	PUCHAR			pData;
-	USHORT			DataSize;
-	UINT			nMSDU = 0;
+	u8 *pData;
+	u16 DataSize;
+	u32 nMSDU = 0;
 
-	pData = (PUCHAR) GET_OS_PKT_DATAPTR(pPacket);
-	DataSize = (USHORT) GET_OS_PKT_LEN(pPacket);
+	pData = (u8 *)GET_OS_PKT_DATAPTR(pPacket);
+	DataSize = (u16)GET_OS_PKT_LEN(pPacket);
 
 	nMSDU = deaggregate_AMSDU_announce(pAd, pPacket, pData, DataSize);
 
 	return nMSDU;
 }
 
-
 /*
 	==========================================================================
 	Description:
@@ -2089,40 +1501,37 @@ UINT BA_Reorder_AMSDU_Annnounce(
 		pEntry - pointer to the MAC entry; NULL is not found
 	==========================================================================
 */
-MAC_TABLE_ENTRY *MacTableLookup(
-	IN PRTMP_ADAPTER pAd,
-	PUCHAR pAddr)
+struct rt_mac_table_entry *MacTableLookup(struct rt_rtmp_adapter *pAd, u8 *pAddr)
 {
-	ULONG HashIdx;
-	MAC_TABLE_ENTRY *pEntry = NULL;
+	unsigned long HashIdx;
+	struct rt_mac_table_entry *pEntry = NULL;
 
 	HashIdx = MAC_ADDR_HASH_INDEX(pAddr);
 	pEntry = pAd->MacTab.Hash[HashIdx];
 
-	while (pEntry && (pEntry->ValidAsCLI || pEntry->ValidAsWDS || pEntry->ValidAsApCli || pEntry->ValidAsMesh))
-	{
-		if (MAC_ADDR_EQUAL(pEntry->Addr, pAddr))
-		{
+	while (pEntry
+	       && (pEntry->ValidAsCLI || pEntry->ValidAsWDS
+		   || pEntry->ValidAsApCli || pEntry->ValidAsMesh)) {
+		if (MAC_ADDR_EQUAL(pEntry->Addr, pAddr)) {
 			break;
-		}
-		else
+		} else
 			pEntry = pEntry->pNext;
 	}
 
 	return pEntry;
 }
 
-MAC_TABLE_ENTRY *MacTableInsertEntry(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PUCHAR			pAddr,
-	IN	UCHAR			apidx,
-	IN BOOLEAN	CleanAll)
+struct rt_mac_table_entry *MacTableInsertEntry(struct rt_rtmp_adapter *pAd,
+				     u8 *pAddr,
+				     u8 apidx, IN BOOLEAN CleanAll)
 {
-	UCHAR HashIdx;
+	u8 HashIdx;
 	int i, FirstWcid;
-	MAC_TABLE_ENTRY *pEntry = NULL, *pCurrEntry;
+	struct rt_mac_table_entry *pEntry = NULL, *pCurrEntry;
+/*      u16  offset; */
+/*      unsigned long   addr; */
 
-	// if FULL, return
+	/* if FULL, return */
 	if (pAd->MacTab.Size >= MAX_LEN_OF_MAC_TABLE)
 		return NULL;
 
@@ -2131,23 +1540,21 @@ MAC_TABLE_ENTRY *MacTableInsertEntry(
 	if (pAd->StaCfg.BssType == BSS_INFRA)
 		FirstWcid = 2;
 
-	// allocate one MAC entry
+	/* allocate one MAC entry */
 	NdisAcquireSpinLock(&pAd->MacTabLock);
-	for (i = FirstWcid; i< MAX_LEN_OF_MAC_TABLE; i++)   // skip entry#0 so that "entry index == AID" for fast lookup
+	for (i = FirstWcid; i < MAX_LEN_OF_MAC_TABLE; i++)	/* skip entry#0 so that "entry index == AID" for fast lookup */
 	{
-		// pick up the first available vacancy
+		/* pick up the first available vacancy */
 		if ((pAd->MacTab.Content[i].ValidAsCLI == FALSE) &&
-			(pAd->MacTab.Content[i].ValidAsWDS == FALSE) &&
-			(pAd->MacTab.Content[i].ValidAsApCli== FALSE) &&
-			(pAd->MacTab.Content[i].ValidAsMesh == FALSE)
-			)
-		{
+		    (pAd->MacTab.Content[i].ValidAsWDS == FALSE) &&
+		    (pAd->MacTab.Content[i].ValidAsApCli == FALSE) &&
+		    (pAd->MacTab.Content[i].ValidAsMesh == FALSE)
+		    ) {
 			pEntry = &pAd->MacTab.Content[i];
-			if (CleanAll == TRUE)
-			{
+			if (CleanAll == TRUE) {
 				pEntry->MaxSupportedRate = RATE_11;
 				pEntry->CurrTxRate = RATE_11;
-				NdisZeroMemory(pEntry, sizeof(MAC_TABLE_ENTRY));
+				NdisZeroMemory(pEntry, sizeof(struct rt_mac_table_entry));
 				pEntry->PairwiseKey.KeyLen = 0;
 				pEntry->PairwiseKey.CipherAlg = CIPHER_NONE;
 			}
@@ -2164,77 +1571,76 @@ MAC_TABLE_ENTRY *MacTableInsertEntry(
 			pEntry->bIAmBadAtheros = FALSE;
 			pEntry->pAd = pAd;
 			pEntry->CMTimerRunning = FALSE;
-			pEntry->EnqueueEapolStartTimerRunning = EAPOL_START_DISABLE;
+			pEntry->EnqueueEapolStartTimerRunning =
+			    EAPOL_START_DISABLE;
 			pEntry->RSNIE_Len = 0;
-			NdisZeroMemory(pEntry->R_Counter, sizeof(pEntry->R_Counter));
+			NdisZeroMemory(pEntry->R_Counter,
+				       sizeof(pEntry->R_Counter));
 			pEntry->ReTryCounter = PEER_MSG1_RETRY_TIMER_CTR;
 
 			if (pEntry->ValidAsMesh)
-				pEntry->apidx = (apidx - MIN_NET_DEVICE_FOR_MESH);
+				pEntry->apidx =
+				    (apidx - MIN_NET_DEVICE_FOR_MESH);
 			else if (pEntry->ValidAsApCli)
-				pEntry->apidx = (apidx - MIN_NET_DEVICE_FOR_APCLI);
+				pEntry->apidx =
+				    (apidx - MIN_NET_DEVICE_FOR_APCLI);
 			else if (pEntry->ValidAsWDS)
-				pEntry->apidx = (apidx - MIN_NET_DEVICE_FOR_WDS);
+				pEntry->apidx =
+				    (apidx - MIN_NET_DEVICE_FOR_WDS);
 			else
 				pEntry->apidx = apidx;
 
 			{
 				{
 					pEntry->AuthMode = pAd->StaCfg.AuthMode;
-					pEntry->WepStatus = pAd->StaCfg.WepStatus;
-					pEntry->PrivacyFilter = Ndis802_11PrivFilterAcceptAll;
-#ifdef RT2860
-					AsicRemovePairwiseKeyEntry(pAd, pEntry->apidx, (UCHAR)i);
-#endif
+					pEntry->WepStatus =
+					    pAd->StaCfg.WepStatus;
+					pEntry->PrivacyFilter =
+					    Ndis802_11PrivFilterAcceptAll;
+#ifdef RTMP_MAC_PCI
+					AsicRemovePairwiseKeyEntry(pAd,
+								   pEntry->
+								   apidx,
+								   (u8)i);
+#endif /* RTMP_MAC_PCI // */
 				}
 			}
 
 			pEntry->GTKState = REKEY_NEGOTIATING;
 			pEntry->PairwiseKey.KeyLen = 0;
 			pEntry->PairwiseKey.CipherAlg = CIPHER_NONE;
-
-#ifdef RT2860
-			if ((pAd->OpMode == OPMODE_STA) &&
-				(pAd->StaCfg.BssType == BSS_ADHOC))
-				pEntry->PortSecured = WPA_802_1X_PORT_SECURED;
-			else
-#endif
 			pEntry->PortSecured = WPA_802_1X_PORT_NOT_SECURED;
 
 			pEntry->PMKID_CacheIdx = ENTRY_NOT_FOUND;
 			COPY_MAC_ADDR(pEntry->Addr, pAddr);
 			pEntry->Sst = SST_NOT_AUTH;
 			pEntry->AuthState = AS_NOT_AUTH;
-			pEntry->Aid = (USHORT)i;  //0;
+			pEntry->Aid = (u16)i;	/*0; */
 			pEntry->CapabilityInfo = 0;
 			pEntry->PsMode = PWR_ACTIVE;
 			pEntry->PsQIdleCount = 0;
 			pEntry->NoDataIdleCount = 0;
+			pEntry->AssocDeadLine = MAC_TABLE_ASSOC_TIMEOUT;
 			pEntry->ContinueTxFailCnt = 0;
 			InitializeQueueHeader(&pEntry->PsQueue);
 
+			pAd->MacTab.Size++;
+			/* Add this entry into ASIC RX WCID search table */
+			RTMP_STA_ENTRY_ADD(pAd, pEntry);
 
-			pAd->MacTab.Size ++;
-			// Add this entry into ASIC RX WCID search table
-			RT28XX_STA_ENTRY_ADD(pAd, pEntry);
-
-
-
-			DBGPRINT(RT_DEBUG_TRACE, ("MacTableInsertEntry - allocate entry #%d, Total= %d\n",i, pAd->MacTab.Size));
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("MacTableInsertEntry - allocate entry #%d, Total= %d\n",
+				  i, pAd->MacTab.Size));
 			break;
 		}
 	}
 
-	// add this MAC entry into HASH table
-	if (pEntry)
-	{
+	/* add this MAC entry into HASH table */
+	if (pEntry) {
 		HashIdx = MAC_ADDR_HASH_INDEX(pAddr);
-		if (pAd->MacTab.Hash[HashIdx] == NULL)
-		{
+		if (pAd->MacTab.Hash[HashIdx] == NULL) {
 			pAd->MacTab.Hash[HashIdx] = pEntry;
-		}
-		else
-		{
+		} else {
 			pCurrEntry = pAd->MacTab.Hash[HashIdx];
 			while (pCurrEntry->pNext != NULL)
 				pCurrEntry = pCurrEntry->pNext;
@@ -2252,14 +1658,14 @@ MAC_TABLE_ENTRY *MacTableInsertEntry(
 		Delete a specified client from MAC table
 	==========================================================================
  */
-BOOLEAN MacTableDeleteEntry(
-	IN PRTMP_ADAPTER pAd,
-	IN USHORT wcid,
-	IN PUCHAR pAddr)
+BOOLEAN MacTableDeleteEntry(struct rt_rtmp_adapter *pAd,
+			    u16 wcid, u8 *pAddr)
 {
-	USHORT HashIdx;
-	MAC_TABLE_ENTRY *pEntry, *pPrevEntry, *pProbeEntry;
+	u16 HashIdx;
+	struct rt_mac_table_entry *pEntry, *pPrevEntry, *pProbeEntry;
 	BOOLEAN Cancelled;
+	/*u16        offset; // unused variable */
+	/*u8 j;                      // unused variable */
 
 	if (wcid >= MAX_LEN_OF_MAC_TABLE)
 		return FALSE;
@@ -2267,36 +1673,33 @@ BOOLEAN MacTableDeleteEntry(
 	NdisAcquireSpinLock(&pAd->MacTabLock);
 
 	HashIdx = MAC_ADDR_HASH_INDEX(pAddr);
+	/*pEntry = pAd->MacTab.Hash[HashIdx]; */
 	pEntry = &pAd->MacTab.Content[wcid];
 
-	if (pEntry && (pEntry->ValidAsCLI || pEntry->ValidAsApCli || pEntry->ValidAsWDS || pEntry->ValidAsMesh
-		))
-	{
-		if (MAC_ADDR_EQUAL(pEntry->Addr, pAddr))
-		{
+	if (pEntry
+	    && (pEntry->ValidAsCLI || pEntry->ValidAsApCli || pEntry->ValidAsWDS
+		|| pEntry->ValidAsMesh)) {
+		if (MAC_ADDR_EQUAL(pEntry->Addr, pAddr)) {
 
-			// Delete this entry from ASIC on-chip WCID Table
-			RT28XX_STA_ENTRY_MAC_RESET(pAd, wcid);
+			/* Delete this entry from ASIC on-chip WCID Table */
+			RTMP_STA_ENTRY_MAC_RESET(pAd, wcid);
 
-			// free resources of BA
+			/* free resources of BA */
 			BASessionTearDownALL(pAd, pEntry->Aid);
 
 			pPrevEntry = NULL;
 			pProbeEntry = pAd->MacTab.Hash[HashIdx];
 			ASSERT(pProbeEntry);
 
-			// update Hash list
-			do
-			{
-				if (pProbeEntry == pEntry)
-				{
-					if (pPrevEntry == NULL)
-					{
-						pAd->MacTab.Hash[HashIdx] = pEntry->pNext;
-					}
-					else
-					{
-						pPrevEntry->pNext = pEntry->pNext;
+			/* update Hash list */
+			do {
+				if (pProbeEntry == pEntry) {
+					if (pPrevEntry == NULL) {
+						pAd->MacTab.Hash[HashIdx] =
+						    pEntry->pNext;
+					} else {
+						pPrevEntry->pNext =
+						    pEntry->pNext;
 					}
 					break;
 				}
@@ -2305,48 +1708,43 @@ BOOLEAN MacTableDeleteEntry(
 				pProbeEntry = pProbeEntry->pNext;
 			} while (pProbeEntry);
 
-			// not found !!!
+			/* not found ! */
 			ASSERT(pProbeEntry != NULL);
 
-			RT28XX_STA_ENTRY_KEY_DEL(pAd, BSS0, wcid);
-
-
-		if (pEntry->EnqueueEapolStartTimerRunning != EAPOL_START_DISABLE)
-		{
-			RTMPCancelTimer(&pEntry->EnqueueStartForPSKTimer, &Cancelled);
-			pEntry->EnqueueEapolStartTimerRunning = EAPOL_START_DISABLE;
-		}
+			RTMP_STA_ENTRY_KEY_DEL(pAd, BSS0, wcid);
 
+			if (pEntry->EnqueueEapolStartTimerRunning !=
+			    EAPOL_START_DISABLE) {
+				RTMPCancelTimer(&pEntry->
+						EnqueueStartForPSKTimer,
+						&Cancelled);
+				pEntry->EnqueueEapolStartTimerRunning =
+				    EAPOL_START_DISABLE;
+			}
 
-   			NdisZeroMemory(pEntry, sizeof(MAC_TABLE_ENTRY));
-			pAd->MacTab.Size --;
-			DBGPRINT(RT_DEBUG_TRACE, ("MacTableDeleteEntry1 - Total= %d\n", pAd->MacTab.Size));
-		}
-		else
-		{
-			printk("\n%s: Impossible Wcid = %d !!!!!\n", __func__, wcid);
+			NdisZeroMemory(pEntry, sizeof(struct rt_mac_table_entry));
+			pAd->MacTab.Size--;
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("MacTableDeleteEntry1 - Total= %d\n",
+				  pAd->MacTab.Size));
+		} else {
+			DBGPRINT(RT_DEBUG_OFF,
+				 ("\n%s: Impossible Wcid = %d !\n",
+				  __func__, wcid));
 		}
 	}
 
 	NdisReleaseSpinLock(&pAd->MacTabLock);
 
-	//Reset operating mode when no Sta.
-	if (pAd->MacTab.Size == 0)
-	{
+	/*Reset operating mode when no Sta. */
+	if (pAd->MacTab.Size == 0) {
 		pAd->CommonCfg.AddHTInfo.AddHtInfo2.OperaionMode = 0;
-#ifdef RT2860
-		AsicUpdateProtect(pAd, 0 /*pAd->CommonCfg.AddHTInfo.AddHtInfo2.OperaionMode*/, (ALLN_SETPROTECT), TRUE, 0 /*pAd->MacTab.fAnyStationNonGF*/);
-#else
-		// edit by johnli, fix "in_interrupt" error when call "MacTableDeleteEntry" in Rx tasklet
-		// Set MAC register value according operation mode
-		RTUSBEnqueueInternalCmd(pAd, CMDTHREAD_UPDATE_PROTECT, NULL, 0);
-#endif
+		RTMP_UPDATE_PROTECT(pAd);	/* edit by johnli, fix "in_interrupt" error when call "MacTableDeleteEntry" in Rx tasklet */
 	}
 
 	return TRUE;
 }
 
-
 /*
 	==========================================================================
 	Description:
@@ -2354,34 +1752,30 @@ BOOLEAN MacTableDeleteEntry(
 		the power-saving queues are freed here.
 	==========================================================================
  */
-VOID MacTableReset(
-	IN  PRTMP_ADAPTER  pAd)
+void MacTableReset(struct rt_rtmp_adapter *pAd)
 {
-	int         i;
+	int i;
 
 	DBGPRINT(RT_DEBUG_TRACE, ("MacTableReset\n"));
-	//NdisAcquireSpinLock(&pAd->MacTabLock);
+	/*NdisAcquireSpinLock(&pAd->MacTabLock); */
 
-	for (i=1; i<MAX_LEN_OF_MAC_TABLE; i++)
-	{
-#ifdef RT2860
-		RT28XX_STA_ENTRY_MAC_RESET(pAd, i);
-#endif
-		if (pAd->MacTab.Content[i].ValidAsCLI == TRUE)
-	   {
-			// free resources of BA
+	for (i = 1; i < MAX_LEN_OF_MAC_TABLE; i++) {
+#ifdef RTMP_MAC_PCI
+		RTMP_STA_ENTRY_MAC_RESET(pAd, i);
+#endif /* RTMP_MAC_PCI // */
+		if (pAd->MacTab.Content[i].ValidAsCLI == TRUE) {
+
+			/* free resources of BA */
 			BASessionTearDownALL(pAd, i);
 
 			pAd->MacTab.Content[i].ValidAsCLI = FALSE;
 
-
-
-#ifdef RT2870
+#ifdef RTMP_MAC_USB
 			NdisZeroMemory(pAd->MacTab.Content[i].Addr, 6);
-			RT28XX_STA_ENTRY_MAC_RESET(pAd, i);
-#endif // RT2870 //
+			RTMP_STA_ENTRY_MAC_RESET(pAd, i);
+#endif /* RTMP_MAC_USB // */
 
-			//AsicDelWcidTab(pAd, i);
+			/*AsicDelWcidTab(pAd, i); */
 		}
 	}
 
@@ -2396,22 +1790,19 @@ VOID MacTableReset(
 
 	==========================================================================
 */
-VOID AssocParmFill(
-	IN PRTMP_ADAPTER pAd,
-	IN OUT MLME_ASSOC_REQ_STRUCT *AssocReq,
-	IN PUCHAR                     pAddr,
-	IN USHORT                     CapabilityInfo,
-	IN ULONG                      Timeout,
-	IN USHORT                     ListenIntv)
+void AssocParmFill(struct rt_rtmp_adapter *pAd,
+		   struct rt_mlme_assoc_req *AssocReq,
+		   u8 *pAddr,
+		   u16 CapabilityInfo,
+		   unsigned long Timeout, u16 ListenIntv)
 {
 	COPY_MAC_ADDR(AssocReq->Addr, pAddr);
-	// Add mask to support 802.11b mode only
-	AssocReq->CapabilityInfo = CapabilityInfo & SUPPORTED_CAPABILITY_INFO; // not cf-pollable, not cf-poll-request
+	/* Add mask to support 802.11b mode only */
+	AssocReq->CapabilityInfo = CapabilityInfo & SUPPORTED_CAPABILITY_INFO;	/* not cf-pollable, not cf-poll-request */
 	AssocReq->Timeout = Timeout;
 	AssocReq->ListenIntv = ListenIntv;
 }
 
-
 /*
 	==========================================================================
 	Description:
@@ -2420,17 +1811,14 @@ VOID AssocParmFill(
 
 	==========================================================================
 */
-VOID DisassocParmFill(
-	IN PRTMP_ADAPTER pAd,
-	IN OUT MLME_DISASSOC_REQ_STRUCT *DisassocReq,
-	IN PUCHAR pAddr,
-	IN USHORT Reason)
+void DisassocParmFill(struct rt_rtmp_adapter *pAd,
+		      struct rt_mlme_disassoc_req *DisassocReq,
+		      u8 *pAddr, u16 Reason)
 {
 	COPY_MAC_ADDR(DisassocReq->Addr, pAddr);
 	DisassocReq->Reason = Reason;
 }
 
-
 /*
 	========================================================================
 
@@ -2465,76 +1853,69 @@ VOID DisassocParmFill(
 	========================================================================
 */
 
-BOOLEAN RTMPCheckDHCPFrame(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PNDIS_PACKET	pPacket)
+BOOLEAN RTMPCheckDHCPFrame(struct rt_rtmp_adapter *pAd, void *pPacket)
 {
-	PACKET_INFO 	PacketInfo;
-	ULONG			NumberOfBytesRead = 0;
-	ULONG			CurrentOffset = 0;
-	PVOID			pVirtualAddress = NULL;
-	UINT			NdisBufferLength;
-	PUCHAR			pSrc;
-	USHORT			Protocol;
-	UCHAR			ByteOffset36 = 0;
-	UCHAR			ByteOffset38 = 0;
-	BOOLEAN 		ReadFirstParm = TRUE;
-
-	RTMP_QueryPacketInfo(pPacket, &PacketInfo, (PUCHAR *)&pVirtualAddress, &NdisBufferLength);
+	struct rt_packet_info PacketInfo;
+	unsigned long NumberOfBytesRead = 0;
+	unsigned long CurrentOffset = 0;
+	void *pVirtualAddress = NULL;
+	u32 NdisBufferLength;
+	u8 *pSrc;
+	u16 Protocol;
+	u8 ByteOffset36 = 0;
+	u8 ByteOffset38 = 0;
+	BOOLEAN ReadFirstParm = TRUE;
+
+	RTMP_QueryPacketInfo(pPacket, &PacketInfo, (u8 **) & pVirtualAddress,
+			     &NdisBufferLength);
 
 	NumberOfBytesRead += NdisBufferLength;
-	pSrc = (PUCHAR) pVirtualAddress;
+	pSrc = (u8 *)pVirtualAddress;
 	Protocol = *(pSrc + 12) * 256 + *(pSrc + 13);
 
-	//
-	// Check DHCP & BOOTP protocol
-	//
-	while (NumberOfBytesRead <= PacketInfo.TotalPacketLength)
-	{
-		if ((NumberOfBytesRead >= 35) && (ReadFirstParm == TRUE))
-		{
-			CurrentOffset = 35 - (NumberOfBytesRead - NdisBufferLength);
+	/* */
+	/* Check DHCP & BOOTP protocol */
+	/* */
+	while (NumberOfBytesRead <= PacketInfo.TotalPacketLength) {
+		if ((NumberOfBytesRead >= 35) && (ReadFirstParm == TRUE)) {
+			CurrentOffset =
+			    35 - (NumberOfBytesRead - NdisBufferLength);
 			ByteOffset36 = *(pSrc + CurrentOffset);
 			ReadFirstParm = FALSE;
 		}
 
-		if (NumberOfBytesRead >= 37)
-		{
-			CurrentOffset = 37 - (NumberOfBytesRead - NdisBufferLength);
+		if (NumberOfBytesRead >= 37) {
+			CurrentOffset =
+			    37 - (NumberOfBytesRead - NdisBufferLength);
 			ByteOffset38 = *(pSrc + CurrentOffset);
-			//End of Read
+			/*End of Read */
 			break;
 		}
 		return FALSE;
 	}
 
-	// Check for DHCP & BOOTP protocol
-	if ((ByteOffset36 != 0x44) || (ByteOffset38 != 0x43))
-		{
-		//
-		// 2054 (hex 0806) for ARP datagrams
-		// if this packet is not ARP datagrams, then do nothing
-		// ARP datagrams will also be duplicate at 1mb broadcast frames
-		//
-		if (Protocol != 0x0806 )
+	/* Check for DHCP & BOOTP protocol */
+	if ((ByteOffset36 != 0x44) || (ByteOffset38 != 0x43)) {
+		/* */
+		/* 2054 (hex 0806) for ARP datagrams */
+		/* if this packet is not ARP datagrams, then do nothing */
+		/* ARP datagrams will also be duplicate at 1mb broadcast frames */
+		/* */
+		if (Protocol != 0x0806)
 			return FALSE;
-		}
+	}
 
 	return TRUE;
 }
 
-
-BOOLEAN RTMPCheckEtherType(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PNDIS_PACKET	pPacket)
+BOOLEAN RTMPCheckEtherType(struct rt_rtmp_adapter *pAd, void *pPacket)
 {
-	USHORT	TypeLen;
-	UCHAR	Byte0, Byte1;
-	PUCHAR	pSrcBuf;
-	UINT32	pktLen;
-	UINT16 	srcPort, dstPort;
-	BOOLEAN	status = TRUE;
-
+	u16 TypeLen;
+	u8 Byte0, Byte1;
+	u8 *pSrcBuf;
+	u32 pktLen;
+	u16 srcPort, dstPort;
+	BOOLEAN status = TRUE;
 
 	pSrcBuf = GET_OS_PKT_DATAPTR(pPacket);
 	pktLen = GET_OS_PKT_LEN(pPacket);
@@ -2543,35 +1924,31 @@ BOOLEAN RTMPCheckEtherType(
 
 	RTMP_SET_PACKET_SPECIFIC(pPacket, 0);
 
-	// get Ethernet protocol field
-	TypeLen = (pSrcBuf[12] << 8) + pSrcBuf[13];
+	/* get Ethernet protocol field */
+	TypeLen = (pSrcBuf[12] << 8) | pSrcBuf[13];
 
-	pSrcBuf += LENGTH_802_3;	// Skip the Ethernet Header.
+	pSrcBuf += LENGTH_802_3;	/* Skip the Ethernet Header. */
 
-	if (TypeLen <= 1500)
-	{	// 802.3, 802.3 LLC
+	if (TypeLen <= 1500) {	/* 802.3, 802.3 LLC */
 		/*
-			DestMAC(6) + SrcMAC(6) + Lenght(2) +
-			DSAP(1) + SSAP(1) + Control(1) +
-			if the DSAP = 0xAA, SSAP=0xAA, Contorl = 0x03, it has a 5-bytes SNAP header.
-				=> + SNAP (5, OriginationID(3) + etherType(2))
-		*/
-		if (pSrcBuf[0] == 0xAA && pSrcBuf[1] == 0xAA && pSrcBuf[2] == 0x03)
-		{
-			Sniff2BytesFromNdisBuffer(pSrcBuf, 6, &Byte0, &Byte1);
+		   DestMAC(6) + SrcMAC(6) + Lenght(2) +
+		   DSAP(1) + SSAP(1) + Control(1) +
+		   if the DSAP = 0xAA, SSAP=0xAA, Contorl = 0x03, it has a 5-bytes SNAP header.
+		   => + SNAP (5, OriginationID(3) + etherType(2))
+		 */
+		if (pSrcBuf[0] == 0xAA && pSrcBuf[1] == 0xAA
+		    && pSrcBuf[2] == 0x03) {
+			Sniff2BytesFromNdisBuffer((char *)pSrcBuf, 6,
+						  &Byte0, &Byte1);
 			RTMP_SET_PACKET_LLCSNAP(pPacket, 1);
-			TypeLen = (USHORT)((Byte0 << 8) + Byte1);
-			pSrcBuf += 8; // Skip this LLC/SNAP header
-		}
-		else
-		{
-			//It just has 3-byte LLC header, maybe a legacy ether type frame. we didn't handle it.
+			TypeLen = (u16)((Byte0 << 8) + Byte1);
+			pSrcBuf += 8;	/* Skip this LLC/SNAP header */
+		} else {
+			/*It just has 3-byte LLC header, maybe a legacy ether type frame. we didn't handle it. */
 		}
 	}
-
-	// If it's a VLAN packet, get the real Type/Length field.
-	if (TypeLen == 0x8100)
-	{
+	/* If it's a VLAN packet, get the real Type/Length field. */
+	if (TypeLen == 0x8100) {
 		/* 0x8100 means VLAN packets */
 
 		/* Dest. MAC Address (6-bytes) +
@@ -2584,243 +1961,229 @@ BOOLEAN RTMPCheckEtherType(
 		   Frame Check Sequence (4-bytes) */
 
 		RTMP_SET_PACKET_VLAN(pPacket, 1);
-		Sniff2BytesFromNdisBuffer(pSrcBuf, 2, &Byte0, &Byte1);
-		TypeLen = (USHORT)((Byte0 << 8) + Byte1);
+		Sniff2BytesFromNdisBuffer((char *)pSrcBuf, 2, &Byte0,
+					  &Byte1);
+		TypeLen = (u16)((Byte0 << 8) + Byte1);
 
-		pSrcBuf += 4; // Skip the VLAN Header.
+		pSrcBuf += 4;	/* Skip the VLAN Header. */
 	}
 
-	switch (TypeLen)
-	{
-		case 0x0800:
-			{
-				ASSERT((pktLen > 34));
-				if (*(pSrcBuf + 9) == 0x11)
-				{	// udp packet
-					ASSERT((pktLen > 34));	// 14 for ethernet header, 20 for IP header
-
-					pSrcBuf += 20;	// Skip the IP header
-					srcPort = OS_NTOHS(*((UINT16 *)pSrcBuf));
-					dstPort = OS_NTOHS(*((UINT16 *)(pSrcBuf +2)));
-
-					if ((srcPort==0x44 && dstPort==0x43) || (srcPort==0x43 && dstPort==0x44))
-					{	//It's a BOOTP/DHCP packet
-						RTMP_SET_PACKET_DHCP(pPacket, 1);
-					}
+	switch (TypeLen) {
+	case 0x0800:
+		{
+			ASSERT((pktLen > 34));
+			if (*(pSrcBuf + 9) == 0x11) {	/* udp packet */
+				ASSERT((pktLen > 34));	/* 14 for ethernet header, 20 for IP header */
+
+				pSrcBuf += 20;	/* Skip the IP header */
+				srcPort =
+				    OS_NTOHS(get_unaligned
+					     ((u16 *)(pSrcBuf)));
+				dstPort =
+				    OS_NTOHS(get_unaligned
+					     ((u16 *)(pSrcBuf + 2)));
+
+				if ((srcPort == 0x44 && dstPort == 0x43) || (srcPort == 0x43 && dstPort == 0x44)) {	/*It's a BOOTP/DHCP packet */
+					RTMP_SET_PACKET_DHCP(pPacket, 1);
 				}
 			}
-			break;
-		case 0x0806:
-			{
-				//ARP Packet.
-				RTMP_SET_PACKET_DHCP(pPacket, 1);
-			}
-			break;
-		case 0x888e:
-			{
-				// EAPOL Packet.
-				RTMP_SET_PACKET_EAPOL(pPacket, 1);
-			}
-			break;
-		default:
-			status = FALSE;
-			break;
+		}
+		break;
+	case 0x0806:
+		{
+			/*ARP Packet. */
+			RTMP_SET_PACKET_DHCP(pPacket, 1);
+		}
+		break;
+	case 0x888e:
+		{
+			/* EAPOL Packet. */
+			RTMP_SET_PACKET_EAPOL(pPacket, 1);
+		}
+		break;
+	default:
+		status = FALSE;
+		break;
 	}
 
 	return status;
 
 }
 
+void Update_Rssi_Sample(struct rt_rtmp_adapter *pAd,
+			struct rt_rssi_sample *pRssi, struct rt_rxwi * pRxWI)
+{
+	char rssi0 = pRxWI->RSSI0;
+	char rssi1 = pRxWI->RSSI1;
+	char rssi2 = pRxWI->RSSI2;
 
-
-VOID Update_Rssi_Sample(
-	IN PRTMP_ADAPTER	pAd,
-	IN RSSI_SAMPLE		*pRssi,
-	IN PRXWI_STRUC		pRxWI)
-		{
-	CHAR	rssi0 = pRxWI->RSSI0;
-	CHAR	rssi1 = pRxWI->RSSI1;
-	CHAR	rssi2 = pRxWI->RSSI2;
-
-	if (rssi0 != 0)
-	{
-		pRssi->LastRssi0	= ConvertToRssi(pAd, (CHAR)rssi0, RSSI_0);
-		pRssi->AvgRssi0X8	= (pRssi->AvgRssi0X8 - pRssi->AvgRssi0) + pRssi->LastRssi0;
-		pRssi->AvgRssi0	= pRssi->AvgRssi0X8 >> 3;
+	if (rssi0 != 0) {
+		pRssi->LastRssi0 = ConvertToRssi(pAd, (char)rssi0, RSSI_0);
+		pRssi->AvgRssi0X8 =
+		    (pRssi->AvgRssi0X8 - pRssi->AvgRssi0) + pRssi->LastRssi0;
+		pRssi->AvgRssi0 = pRssi->AvgRssi0X8 >> 3;
 	}
 
-	if (rssi1 != 0)
-	{
-		pRssi->LastRssi1	= ConvertToRssi(pAd, (CHAR)rssi1, RSSI_1);
-		pRssi->AvgRssi1X8	= (pRssi->AvgRssi1X8 - pRssi->AvgRssi1) + pRssi->LastRssi1;
-		pRssi->AvgRssi1	= pRssi->AvgRssi1X8 >> 3;
+	if (rssi1 != 0) {
+		pRssi->LastRssi1 = ConvertToRssi(pAd, (char)rssi1, RSSI_1);
+		pRssi->AvgRssi1X8 =
+		    (pRssi->AvgRssi1X8 - pRssi->AvgRssi1) + pRssi->LastRssi1;
+		pRssi->AvgRssi1 = pRssi->AvgRssi1X8 >> 3;
 	}
 
-	if (rssi2 != 0)
-	{
-		pRssi->LastRssi2	= ConvertToRssi(pAd, (CHAR)rssi2, RSSI_2);
-		pRssi->AvgRssi2X8  = (pRssi->AvgRssi2X8 - pRssi->AvgRssi2) + pRssi->LastRssi2;
+	if (rssi2 != 0) {
+		pRssi->LastRssi2 = ConvertToRssi(pAd, (char)rssi2, RSSI_2);
+		pRssi->AvgRssi2X8 =
+		    (pRssi->AvgRssi2X8 - pRssi->AvgRssi2) + pRssi->LastRssi2;
 		pRssi->AvgRssi2 = pRssi->AvgRssi2X8 >> 3;
 	}
 }
 
-
-
-// Normal legacy Rx packet indication
-VOID Indicate_Legacy_Packet(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	RX_BLK			*pRxBlk,
-	IN	UCHAR			FromWhichBSSID)
+/* Normal legacy Rx packet indication */
+void Indicate_Legacy_Packet(struct rt_rtmp_adapter *pAd,
+			    struct rt_rx_blk *pRxBlk, u8 FromWhichBSSID)
 {
-	PNDIS_PACKET	pRxPacket = pRxBlk->pRxPacket;
-	UCHAR			Header802_3[LENGTH_802_3];
+	void *pRxPacket = pRxBlk->pRxPacket;
+	u8 Header802_3[LENGTH_802_3];
 
-	// 1. get 802.3 Header
-	// 2. remove LLC
-	// 		a. pointer pRxBlk->pData to payload
-	//      b. modify pRxBlk->DataSize
+	/* 1. get 802.3 Header */
+	/* 2. remove LLC */
+	/*              a. pointer pRxBlk->pData to payload */
+	/*      b. modify pRxBlk->DataSize */
 	RTMP_802_11_REMOVE_LLC_AND_CONVERT_TO_802_3(pRxBlk, Header802_3);
 
-	if (pRxBlk->DataSize > MAX_RX_PKT_LEN)
-	{
+	if (pRxBlk->DataSize > MAX_RX_PKT_LEN) {
 
-		// release packet
+		/* release packet */
 		RELEASE_NDIS_PACKET(pAd, pRxPacket, NDIS_STATUS_FAILURE);
 		return;
 	}
 
-
 	STATS_INC_RX_PACKETS(pAd, FromWhichBSSID);
 
-#ifdef RT2870
-	if (pAd->CommonCfg.bDisableReordering == 0)
-	{
-		PBA_REC_ENTRY		pBAEntry;
-		ULONG				Now32;
-		UCHAR				Wcid = pRxBlk->pRxWI->WirelessCliID;
-		UCHAR				TID = pRxBlk->pRxWI->TID;
-		USHORT				Idx;
+#ifdef RTMP_MAC_USB
+	if (pAd->CommonCfg.bDisableReordering == 0) {
+		struct rt_ba_rec_entry *pBAEntry;
+		unsigned long Now32;
+		u8 Wcid = pRxBlk->pRxWI->WirelessCliID;
+		u8 TID = pRxBlk->pRxWI->TID;
+		u16 Idx;
 
-#define REORDERING_PACKET_TIMEOUT		((100 * HZ)/1000)	// system ticks -- 100 ms
+#define REORDERING_PACKET_TIMEOUT		((100 * OS_HZ)/1000)	/* system ticks -- 100 ms */
 
-		if (Wcid < MAX_LEN_OF_MAC_TABLE)
-		{
+		if (Wcid < MAX_LEN_OF_MAC_TABLE) {
 			Idx = pAd->MacTab.Content[Wcid].BARecWcidArray[TID];
-			if (Idx != 0)
-			{
+			if (Idx != 0) {
 				pBAEntry = &pAd->BATable.BARecEntry[Idx];
-				// update last rx time
+				/* update last rx time */
 				NdisGetSystemUpTime(&Now32);
 				if ((pBAEntry->list.qlen > 0) &&
-					 RTMP_TIME_AFTER((unsigned long)Now32, (unsigned long)(pBAEntry->LastIndSeqAtTimer+(REORDERING_PACKET_TIMEOUT)))
-	   				)
-				{
-					printk("Indicate_Legacy_Packet():flush reordering_timeout_mpdus! RxWI->Flags=%d, pRxWI.TID=%d, RxD->AMPDU=%d!\n", pRxBlk->Flags, pRxBlk->pRxWI->TID, pRxBlk->RxD.AMPDU);
-					hex_dump("Dump the legacy Packet:", GET_OS_PKT_DATAPTR(pRxBlk->pRxPacket), 64);
-					ba_flush_reordering_timeout_mpdus(pAd, pBAEntry, Now32);
+				    RTMP_TIME_AFTER((unsigned long)Now32,
+						    (unsigned long)(pBAEntry->
+								    LastIndSeqAtTimer
+								    +
+								    (REORDERING_PACKET_TIMEOUT)))
+				    ) {
+					DBGPRINT(RT_DEBUG_OFF,
+						 ("Indicate_Legacy_Packet():flush reordering_timeout_mpdus! RxWI->Flags=%d, pRxWI.TID=%d, RxD->AMPDU=%d!\n",
+						  pRxBlk->Flags,
+						  pRxBlk->pRxWI->TID,
+						  pRxBlk->RxD.AMPDU));
+					hex_dump("Dump the legacy Packet:",
+						 GET_OS_PKT_DATAPTR(pRxBlk->
+								    pRxPacket),
+						 64);
+					ba_flush_reordering_timeout_mpdus(pAd,
+									  pBAEntry,
+									  Now32);
 				}
 			}
 		}
 	}
-#endif // RT2870 //
+#endif /* RTMP_MAC_USB // */
 
 	wlan_802_11_to_802_3_packet(pAd, pRxBlk, Header802_3, FromWhichBSSID);
 
-	//
-	// pass this 802.3 packet to upper layer or forward this packet to WM directly
-	//
+	/* */
+	/* pass this 802.3 packet to upper layer or forward this packet to WM directly */
+	/* */
 	ANNOUNCE_OR_FORWARD_802_3_PACKET(pAd, pRxPacket, FromWhichBSSID);
 }
 
-
-// Normal, AMPDU or AMSDU
-VOID CmmRxnonRalinkFrameIndicate(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	RX_BLK			*pRxBlk,
-	IN	UCHAR			FromWhichBSSID)
+/* Normal, AMPDU or AMSDU */
+void CmmRxnonRalinkFrameIndicate(struct rt_rtmp_adapter *pAd,
+				 struct rt_rx_blk *pRxBlk, u8 FromWhichBSSID)
 {
-	if (RX_BLK_TEST_FLAG(pRxBlk, fRX_AMPDU) && (pAd->CommonCfg.bDisableReordering == 0))
-	{
+	if (RX_BLK_TEST_FLAG(pRxBlk, fRX_AMPDU)
+	    && (pAd->CommonCfg.bDisableReordering == 0)) {
 		Indicate_AMPDU_Packet(pAd, pRxBlk, FromWhichBSSID);
-	}
-	else
-	{
-		if (RX_BLK_TEST_FLAG(pRxBlk, fRX_AMSDU))
-		{
-			// handle A-MSDU
+	} else {
+		if (RX_BLK_TEST_FLAG(pRxBlk, fRX_AMSDU)) {
+			/* handle A-MSDU */
 			Indicate_AMSDU_Packet(pAd, pRxBlk, FromWhichBSSID);
-		}
-		else
-		{
+		} else {
 			Indicate_Legacy_Packet(pAd, pRxBlk, FromWhichBSSID);
 		}
 	}
 }
 
-
-VOID CmmRxRalinkFrameIndicate(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	MAC_TABLE_ENTRY	*pEntry,
-	IN	RX_BLK			*pRxBlk,
-	IN	UCHAR			FromWhichBSSID)
+void CmmRxRalinkFrameIndicate(struct rt_rtmp_adapter *pAd,
+			      struct rt_mac_table_entry *pEntry,
+			      struct rt_rx_blk *pRxBlk, u8 FromWhichBSSID)
 {
-	UCHAR			Header802_3[LENGTH_802_3];
-	UINT16			Msdu2Size;
-	UINT16 			Payload1Size, Payload2Size;
-	PUCHAR 			pData2;
-	PNDIS_PACKET	pPacket2 = NULL;
-
-
+	u8 Header802_3[LENGTH_802_3];
+	u16 Msdu2Size;
+	u16 Payload1Size, Payload2Size;
+	u8 *pData2;
+	void *pPacket2 = NULL;
 
-	Msdu2Size = *(pRxBlk->pData) + (*(pRxBlk->pData+1) << 8);
+	Msdu2Size = *(pRxBlk->pData) + (*(pRxBlk->pData + 1) << 8);
 
-	if ((Msdu2Size <= 1536) && (Msdu2Size < pRxBlk->DataSize))
-	{
+	if ((Msdu2Size <= 1536) && (Msdu2Size < pRxBlk->DataSize)) {
 		/* skip two byte MSDU2 len */
 		pRxBlk->pData += 2;
 		pRxBlk->DataSize -= 2;
-	}
-	else
-	{
-		// release packet
-		RELEASE_NDIS_PACKET(pAd, pRxBlk->pRxPacket, NDIS_STATUS_FAILURE);
+	} else {
+		/* release packet */
+		RELEASE_NDIS_PACKET(pAd, pRxBlk->pRxPacket,
+				    NDIS_STATUS_FAILURE);
 		return;
 	}
 
-	// get 802.3 Header and  remove LLC
+	/* get 802.3 Header and  remove LLC */
 	RTMP_802_11_REMOVE_LLC_AND_CONVERT_TO_802_3(pRxBlk, Header802_3);
 
 	ASSERT(pRxBlk->pRxPacket);
 
-	// Ralink Aggregation frame
-	pAd->RalinkCounters.OneSecRxAggregationCount ++;
+	/* Ralink Aggregation frame */
+	pAd->RalinkCounters.OneSecRxAggregationCount++;
 	Payload1Size = pRxBlk->DataSize - Msdu2Size;
 	Payload2Size = Msdu2Size - LENGTH_802_3;
 
 	pData2 = pRxBlk->pData + Payload1Size + LENGTH_802_3;
 
-	pPacket2 = duplicate_pkt(pAd, (pData2-LENGTH_802_3), LENGTH_802_3, pData2, Payload2Size, FromWhichBSSID);
+	pPacket2 =
+	    duplicate_pkt(pAd, (pData2 - LENGTH_802_3), LENGTH_802_3, pData2,
+			  Payload2Size, FromWhichBSSID);
 
-	if (!pPacket2)
-	{
-		// release packet
-		RELEASE_NDIS_PACKET(pAd, pRxBlk->pRxPacket, NDIS_STATUS_FAILURE);
+	if (!pPacket2) {
+		/* release packet */
+		RELEASE_NDIS_PACKET(pAd, pRxBlk->pRxPacket,
+				    NDIS_STATUS_FAILURE);
 		return;
 	}
-
-	// update payload size of 1st packet
+	/* update payload size of 1st packet */
 	pRxBlk->DataSize = Payload1Size;
 	wlan_802_11_to_802_3_packet(pAd, pRxBlk, Header802_3, FromWhichBSSID);
 
-	ANNOUNCE_OR_FORWARD_802_3_PACKET(pAd, pRxBlk->pRxPacket, FromWhichBSSID);
+	ANNOUNCE_OR_FORWARD_802_3_PACKET(pAd, pRxBlk->pRxPacket,
+					 FromWhichBSSID);
 
-	if (pPacket2)
-	{
+	if (pPacket2) {
 		ANNOUNCE_OR_FORWARD_802_3_PACKET(pAd, pPacket2, FromWhichBSSID);
 	}
 }
 
-
 #define RESET_FRAGFRAME(_fragFrame) \
 	{								\
 		_fragFrame.RxSize = 0;		\
@@ -2829,109 +2192,102 @@ VOID CmmRxRalinkFrameIndicate(
 		_fragFrame.Flags = 0;		\
 	}
 
-
-PNDIS_PACKET RTMPDeFragmentDataFrame(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	RX_BLK			*pRxBlk)
+void *RTMPDeFragmentDataFrame(struct rt_rtmp_adapter *pAd, struct rt_rx_blk *pRxBlk)
 {
-	PHEADER_802_11	pHeader = pRxBlk->pHeader;
-	PNDIS_PACKET	pRxPacket = pRxBlk->pRxPacket;
-	UCHAR			*pData = pRxBlk->pData;
-	USHORT			DataSize = pRxBlk->DataSize;
-	PNDIS_PACKET	pRetPacket = NULL;
-	UCHAR			*pFragBuffer = NULL;
-	BOOLEAN 		bReassDone = FALSE;
-	UCHAR			HeaderRoom = 0;
-
+	struct rt_header_802_11 * pHeader = pRxBlk->pHeader;
+	void *pRxPacket = pRxBlk->pRxPacket;
+	u8 *pData = pRxBlk->pData;
+	u16 DataSize = pRxBlk->DataSize;
+	void *pRetPacket = NULL;
+	u8 *pFragBuffer = NULL;
+	BOOLEAN bReassDone = FALSE;
+	u8 HeaderRoom = 0;
 
 	ASSERT(pHeader);
 
-	HeaderRoom = pData - (UCHAR *)pHeader;
+	HeaderRoom = pData - (u8 *) pHeader;
 
-	// Re-assemble the fragmented packets
-	if (pHeader->Frag == 0)		// Frag. Number is 0 : First frag or only one pkt
+	/* Re-assemble the fragmented packets */
+	if (pHeader->Frag == 0)	/* Frag. Number is 0 : First frag or only one pkt */
 	{
-		// the first pkt of fragment, record it.
-		if (pHeader->FC.MoreFrag)
-		{
+		/* the first pkt of fragment, record it. */
+		if (pHeader->FC.MoreFrag) {
 			ASSERT(pAd->FragFrame.pFragPacket);
-			pFragBuffer = GET_OS_PKT_DATAPTR(pAd->FragFrame.pFragPacket);
-			pAd->FragFrame.RxSize   = DataSize + HeaderRoom;
-			NdisMoveMemory(pFragBuffer,	 pHeader, pAd->FragFrame.RxSize);
+			pFragBuffer =
+			    GET_OS_PKT_DATAPTR(pAd->FragFrame.pFragPacket);
+			pAd->FragFrame.RxSize = DataSize + HeaderRoom;
+			NdisMoveMemory(pFragBuffer, pHeader,
+				       pAd->FragFrame.RxSize);
 			pAd->FragFrame.Sequence = pHeader->Sequence;
-			pAd->FragFrame.LastFrag = pHeader->Frag;	   // Should be 0
+			pAd->FragFrame.LastFrag = pHeader->Frag;	/* Should be 0 */
 			ASSERT(pAd->FragFrame.LastFrag == 0);
-			goto done;	// end of processing this frame
+			goto done;	/* end of processing this frame */
 		}
-	}
-	else	//Middle & End of fragment
+	} else			/*Middle & End of fragment */
 	{
 		if ((pHeader->Sequence != pAd->FragFrame.Sequence) ||
-			(pHeader->Frag != (pAd->FragFrame.LastFrag + 1)))
-		{
-			// Fragment is not the same sequence or out of fragment number order
-			// Reset Fragment control blk
+		    (pHeader->Frag != (pAd->FragFrame.LastFrag + 1))) {
+			/* Fragment is not the same sequence or out of fragment number order */
+			/* Reset Fragment control blk */
 			RESET_FRAGFRAME(pAd->FragFrame);
-			DBGPRINT(RT_DEBUG_ERROR, ("Fragment is not the same sequence or out of fragment number order.\n"));
-			goto done; // give up this frame
-		}
-		else if ((pAd->FragFrame.RxSize + DataSize) > MAX_FRAME_SIZE)
-		{
-			// Fragment frame is too large, it exeeds the maximum frame size.
-			// Reset Fragment control blk
+			DBGPRINT(RT_DEBUG_ERROR,
+				 ("Fragment is not the same sequence or out of fragment number order.\n"));
+			goto done;	/* give up this frame */
+		} else if ((pAd->FragFrame.RxSize + DataSize) > MAX_FRAME_SIZE) {
+			/* Fragment frame is too large, it exeeds the maximum frame size. */
+			/* Reset Fragment control blk */
 			RESET_FRAGFRAME(pAd->FragFrame);
-			DBGPRINT(RT_DEBUG_ERROR, ("Fragment frame is too large, it exeeds the maximum frame size.\n"));
-			goto done; // give up this frame
+			DBGPRINT(RT_DEBUG_ERROR,
+				 ("Fragment frame is too large, it exeeds the maximum frame size.\n"));
+			goto done;	/* give up this frame */
 		}
-
-        //
-		// Broadcom AP(BCM94704AGR) will send out LLC in fragment's packet, LLC only can accpet at first fragment.
-		// In this case, we will dropt it.
-		//
-		if (NdisEqualMemory(pData, SNAP_802_1H, sizeof(SNAP_802_1H)))
-		{
-			DBGPRINT(RT_DEBUG_ERROR, ("Find another LLC at Middle or End fragment(SN=%d, Frag=%d)\n", pHeader->Sequence, pHeader->Frag));
-			goto done; // give up this frame
+		/* */
+		/* Broadcom AP(BCM94704AGR) will send out LLC in fragment's packet, LLC only can accpet at first fragment. */
+		/* In this case, we will dropt it. */
+		/* */
+		if (NdisEqualMemory(pData, SNAP_802_1H, sizeof(SNAP_802_1H))) {
+			DBGPRINT(RT_DEBUG_ERROR,
+				 ("Find another LLC at Middle or End fragment(SN=%d, Frag=%d)\n",
+				  pHeader->Sequence, pHeader->Frag));
+			goto done;	/* give up this frame */
 		}
 
 		pFragBuffer = GET_OS_PKT_DATAPTR(pAd->FragFrame.pFragPacket);
 
-		// concatenate this fragment into the re-assembly buffer
-		NdisMoveMemory((pFragBuffer + pAd->FragFrame.RxSize), pData, DataSize);
-		pAd->FragFrame.RxSize  += DataSize;
-		pAd->FragFrame.LastFrag = pHeader->Frag;	   // Update fragment number
+		/* concatenate this fragment into the re-assembly buffer */
+		NdisMoveMemory((pFragBuffer + pAd->FragFrame.RxSize), pData,
+			       DataSize);
+		pAd->FragFrame.RxSize += DataSize;
+		pAd->FragFrame.LastFrag = pHeader->Frag;	/* Update fragment number */
 
-		// Last fragment
-		if (pHeader->FC.MoreFrag == FALSE)
-		{
+		/* Last fragment */
+		if (pHeader->FC.MoreFrag == FALSE) {
 			bReassDone = TRUE;
 		}
 	}
 
 done:
-	// always release rx fragmented packet
+	/* always release rx fragmented packet */
 	RELEASE_NDIS_PACKET(pAd, pRxPacket, NDIS_STATUS_FAILURE);
 
-	// return defragmented packet if packet is reassembled completely
-	// otherwise return NULL
-	if (bReassDone)
-	{
-		PNDIS_PACKET pNewFragPacket;
+	/* return defragmented packet if packet is reassembled completely */
+	/* otherwise return NULL */
+	if (bReassDone) {
+		void *pNewFragPacket;
 
-		// allocate a new packet buffer for fragment
-		pNewFragPacket = RTMP_AllocateFragPacketBuffer(pAd, RX_BUFFER_NORMSIZE);
-		if (pNewFragPacket)
-		{
-			// update RxBlk
+		/* allocate a new packet buffer for fragment */
+		pNewFragPacket =
+		    RTMP_AllocateFragPacketBuffer(pAd, RX_BUFFER_NORMSIZE);
+		if (pNewFragPacket) {
+			/* update RxBlk */
 			pRetPacket = pAd->FragFrame.pFragPacket;
 			pAd->FragFrame.pFragPacket = pNewFragPacket;
-			pRxBlk->pHeader = (PHEADER_802_11) GET_OS_PKT_DATAPTR(pRetPacket);
-			pRxBlk->pData = (UCHAR *)pRxBlk->pHeader + HeaderRoom;
+			pRxBlk->pHeader =
+			    (struct rt_header_802_11 *) GET_OS_PKT_DATAPTR(pRetPacket);
+			pRxBlk->pData = (u8 *) pRxBlk->pHeader + HeaderRoom;
 			pRxBlk->DataSize = pAd->FragFrame.RxSize - HeaderRoom;
 			pRxBlk->pRxPacket = pRetPacket;
-		}
-		else
-		{
+		} else {
 			RESET_FRAGFRAME(pAd->FragFrame);
 		}
 	}
@@ -2939,25 +2295,22 @@ done:
 	return pRetPacket;
 }
 
-
-VOID Indicate_AMSDU_Packet(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	RX_BLK			*pRxBlk,
-	IN	UCHAR			FromWhichBSSID)
+void Indicate_AMSDU_Packet(struct rt_rtmp_adapter *pAd,
+			   struct rt_rx_blk *pRxBlk, u8 FromWhichBSSID)
 {
-	UINT			nMSDU;
+	u32 nMSDU;
 
 	update_os_packet_info(pAd, pRxBlk, FromWhichBSSID);
 	RTMP_SET_PACKET_IF(pRxBlk->pRxPacket, FromWhichBSSID);
-	nMSDU = deaggregate_AMSDU_announce(pAd, pRxBlk->pRxPacket, pRxBlk->pData, pRxBlk->DataSize);
+	nMSDU =
+	    deaggregate_AMSDU_announce(pAd, pRxBlk->pRxPacket, pRxBlk->pData,
+				       pRxBlk->DataSize);
 }
 
-VOID Indicate_EAPOL_Packet(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	RX_BLK			*pRxBlk,
-	IN	UCHAR			FromWhichBSSID)
+void Indicate_EAPOL_Packet(struct rt_rtmp_adapter *pAd,
+			   struct rt_rx_blk *pRxBlk, u8 FromWhichBSSID)
 {
-	MAC_TABLE_ENTRY *pEntry = NULL;
+	struct rt_mac_table_entry *pEntry = NULL;
 
 	{
 		pEntry = &pAd->MacTab.Content[BSSID_WCID];
@@ -2965,48 +2318,42 @@ VOID Indicate_EAPOL_Packet(
 		return;
 	}
 
-	if (pEntry == NULL)
-	{
-		DBGPRINT(RT_DEBUG_WARN, ("Indicate_EAPOL_Packet: drop and release the invalid packet.\n"));
-		// release packet
-		RELEASE_NDIS_PACKET(pAd, pRxBlk->pRxPacket, NDIS_STATUS_FAILURE);
+	if (pEntry == NULL) {
+		DBGPRINT(RT_DEBUG_WARN,
+			 ("Indicate_EAPOL_Packet: drop and release the invalid packet.\n"));
+		/* release packet */
+		RELEASE_NDIS_PACKET(pAd, pRxBlk->pRxPacket,
+				    NDIS_STATUS_FAILURE);
 		return;
 	}
 }
 
-#define BCN_TBTT_OFFSET		64	//defer 64 us
-VOID ReSyncBeaconTime(
-	IN  PRTMP_ADAPTER   pAd)
+#define BCN_TBTT_OFFSET		64	/*defer 64 us */
+void ReSyncBeaconTime(struct rt_rtmp_adapter *pAd)
 {
 
-	UINT32  Offset;
-
+	u32 Offset;
 
 	Offset = (pAd->TbttTickCount) % (BCN_TBTT_OFFSET);
 
 	pAd->TbttTickCount++;
 
-	//
-	// The updated BeaconInterval Value will affect Beacon Interval after two TBTT
-	// beacasue the original BeaconInterval had been loaded into next TBTT_TIMER
-	//
-	if (Offset == (BCN_TBTT_OFFSET-2))
-	{
+	/* */
+	/* The updated BeaconInterval Value will affect Beacon Interval after two TBTT */
+	/* beacasue the original BeaconInterval had been loaded into next TBTT_TIMER */
+	/* */
+	if (Offset == (BCN_TBTT_OFFSET - 2)) {
 		BCN_TIME_CFG_STRUC csr;
 		RTMP_IO_READ32(pAd, BCN_TIME_CFG, &csr.word);
-		csr.field.BeaconInterval = (pAd->CommonCfg.BeaconPeriod << 4) - 1 ;	// ASIC register in units of 1/16 TU = 64us
+		csr.field.BeaconInterval = (pAd->CommonCfg.BeaconPeriod << 4) - 1;	/* ASIC register in units of 1/16 TU = 64us */
 		RTMP_IO_WRITE32(pAd, BCN_TIME_CFG, csr.word);
-	}
-	else
-	{
-		if (Offset == (BCN_TBTT_OFFSET-1))
-		{
+	} else {
+		if (Offset == (BCN_TBTT_OFFSET - 1)) {
 			BCN_TIME_CFG_STRUC csr;
 
 			RTMP_IO_READ32(pAd, BCN_TIME_CFG, &csr.word);
-			csr.field.BeaconInterval = (pAd->CommonCfg.BeaconPeriod) << 4; // ASIC register in units of 1/16 TU
+			csr.field.BeaconInterval = (pAd->CommonCfg.BeaconPeriod) << 4;	/* ASIC register in units of 1/16 TU */
 			RTMP_IO_WRITE32(pAd, BCN_TIME_CFG, csr.word);
 		}
 	}
 }
-
diff --git a/drivers/staging/rt2860/common/cmm_data_2860.c b/drivers/staging/rt2860/common/cmm_data_2860.c
deleted file mode 100644
index 857ff450b6c9..000000000000
--- a/drivers/staging/rt2860/common/cmm_data_2860.c
+++ /dev/null
@@ -1,1199 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-*/
-
-/*
-   All functions in this file must be PCI-depended, or you should out your function
-	in other files.
-
-*/
-#include "../rt_config.h"
-
-extern RTMP_RF_REGS RF2850RegTable[];
-extern UCHAR	NUM_OF_2850_CHNL;
-
-USHORT RtmpPCI_WriteTxResource(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	TX_BLK			*pTxBlk,
-	IN	BOOLEAN			bIsLast,
-	OUT	USHORT			*FreeNumber)
-{
-
-	UCHAR			*pDMAHeaderBufVA;
-	USHORT			TxIdx, RetTxIdx;
-	PTXD_STRUC		pTxD;
-	UINT32			BufBasePaLow;
-	PRTMP_TX_RING	pTxRing;
-	USHORT			hwHeaderLen;
-
-	//
-	// get Tx Ring Resource
-	//
-	pTxRing = &pAd->TxRing[pTxBlk->QueIdx];
-	TxIdx = pAd->TxRing[pTxBlk->QueIdx].TxCpuIdx;
-	pDMAHeaderBufVA = (PUCHAR) pTxRing->Cell[TxIdx].DmaBuf.AllocVa;
-	BufBasePaLow = RTMP_GetPhysicalAddressLow(pTxRing->Cell[TxIdx].DmaBuf.AllocPa);
-
-	// copy TXINFO + TXWI + WLAN Header + LLC into DMA Header Buffer
-	if (pTxBlk->TxFrameType == TX_AMSDU_FRAME)
-	{
-		hwHeaderLen = pTxBlk->MpduHeaderLen - LENGTH_AMSDU_SUBFRAMEHEAD + pTxBlk->HdrPadLen + LENGTH_AMSDU_SUBFRAMEHEAD;
-	}
-	else
-	{
-		hwHeaderLen = pTxBlk->MpduHeaderLen + pTxBlk->HdrPadLen;
-	}
-	NdisMoveMemory(pDMAHeaderBufVA, pTxBlk->HeaderBuf, TXINFO_SIZE + TXWI_SIZE + hwHeaderLen);
-
-	pTxRing->Cell[TxIdx].pNdisPacket = pTxBlk->pPacket;
-	pTxRing->Cell[TxIdx].pNextNdisPacket = NULL;
-
-	//
-	// build Tx Descriptor
-	//
-
-	pTxD = (PTXD_STRUC) pTxRing->Cell[TxIdx].AllocVa;
-	NdisZeroMemory(pTxD, TXD_SIZE);
-
-	pTxD->SDPtr0 = BufBasePaLow;
-	pTxD->SDLen0 = TXINFO_SIZE + TXWI_SIZE + hwHeaderLen; // include padding
-	pTxD->SDPtr1 = PCI_MAP_SINGLE(pAd, pTxBlk, 0, 1, PCI_DMA_TODEVICE);;
-	pTxD->SDLen1 = pTxBlk->SrcBufLen;
-	pTxD->LastSec0 = 0;
-	pTxD->LastSec1 = (bIsLast) ? 1 : 0;
-
-	RTMPWriteTxDescriptor(pAd, pTxD, FALSE, FIFO_EDCA);
-
-	RetTxIdx = TxIdx;
-	//
-	// Update Tx index
-	//
-	INC_RING_INDEX(TxIdx, TX_RING_SIZE);
-	pTxRing->TxCpuIdx = TxIdx;
-
-	*FreeNumber -= 1;
-
-	return RetTxIdx;
-}
-
-
-USHORT RtmpPCI_WriteSingleTxResource(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	TX_BLK			*pTxBlk,
-	IN	BOOLEAN			bIsLast,
-	OUT	USHORT			*FreeNumber)
-{
-
-	UCHAR			*pDMAHeaderBufVA;
-	USHORT			TxIdx, RetTxIdx;
-	PTXD_STRUC		pTxD;
-	UINT32			BufBasePaLow;
-	PRTMP_TX_RING	pTxRing;
-	USHORT			hwHeaderLen;
-
-	//
-	// get Tx Ring Resource
-	//
-	pTxRing = &pAd->TxRing[pTxBlk->QueIdx];
-	TxIdx = pAd->TxRing[pTxBlk->QueIdx].TxCpuIdx;
-	pDMAHeaderBufVA = (PUCHAR) pTxRing->Cell[TxIdx].DmaBuf.AllocVa;
-	BufBasePaLow = RTMP_GetPhysicalAddressLow(pTxRing->Cell[TxIdx].DmaBuf.AllocPa);
-
-	// copy TXINFO + TXWI + WLAN Header + LLC into DMA Header Buffer
-	hwHeaderLen = pTxBlk->MpduHeaderLen + pTxBlk->HdrPadLen;
-
-	NdisMoveMemory(pDMAHeaderBufVA, pTxBlk->HeaderBuf, TXINFO_SIZE + TXWI_SIZE + hwHeaderLen);
-
-	pTxRing->Cell[TxIdx].pNdisPacket = pTxBlk->pPacket;
-	pTxRing->Cell[TxIdx].pNextNdisPacket = NULL;
-
-	//
-	// build Tx Descriptor
-	//
-	pTxD = (PTXD_STRUC) pTxRing->Cell[TxIdx].AllocVa;
-
-	NdisZeroMemory(pTxD, TXD_SIZE);
-
-	pTxD->SDPtr0 = BufBasePaLow;
-	pTxD->SDLen0 = TXINFO_SIZE + TXWI_SIZE + hwHeaderLen; // include padding
-	pTxD->SDPtr1 = PCI_MAP_SINGLE(pAd, pTxBlk, 0, 1, PCI_DMA_TODEVICE);;
-	pTxD->SDLen1 = pTxBlk->SrcBufLen;
-	pTxD->LastSec0 = 0;
-	pTxD->LastSec1 = (bIsLast) ? 1 : 0;
-
-	RTMPWriteTxDescriptor(pAd, pTxD, FALSE, FIFO_EDCA);
-
-	RetTxIdx = TxIdx;
-	//
-	// Update Tx index
-	//
-	INC_RING_INDEX(TxIdx, TX_RING_SIZE);
-	pTxRing->TxCpuIdx = TxIdx;
-
-	*FreeNumber -= 1;
-
-	return RetTxIdx;
-}
-
-
-USHORT RtmpPCI_WriteMultiTxResource(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	TX_BLK			*pTxBlk,
-	IN	UCHAR			frameNum,
-	OUT	USHORT			*FreeNumber)
-{
-	BOOLEAN bIsLast;
-	UCHAR			*pDMAHeaderBufVA;
-	USHORT			TxIdx, RetTxIdx;
-	PTXD_STRUC		pTxD;
-	UINT32			BufBasePaLow;
-	PRTMP_TX_RING	pTxRing;
-	USHORT			hwHdrLen;
-	UINT32			firstDMALen;
-
-	bIsLast = ((frameNum == (pTxBlk->TotalFrameNum - 1)) ? 1 : 0);
-
-	//
-	// get Tx Ring Resource
-	//
-	pTxRing = &pAd->TxRing[pTxBlk->QueIdx];
-	TxIdx = pAd->TxRing[pTxBlk->QueIdx].TxCpuIdx;
-	pDMAHeaderBufVA = (PUCHAR) pTxRing->Cell[TxIdx].DmaBuf.AllocVa;
-	BufBasePaLow = RTMP_GetPhysicalAddressLow(pTxRing->Cell[TxIdx].DmaBuf.AllocPa);
-
-	if (frameNum == 0)
-	{
-		// copy TXINFO + TXWI + WLAN Header + LLC into DMA Header Buffer
-		if (pTxBlk->TxFrameType == TX_AMSDU_FRAME)
-			//hwHdrLen = ROUND_UP(pTxBlk->MpduHeaderLen-LENGTH_AMSDU_SUBFRAMEHEAD, 4)+LENGTH_AMSDU_SUBFRAMEHEAD;
-			hwHdrLen = pTxBlk->MpduHeaderLen - LENGTH_AMSDU_SUBFRAMEHEAD + pTxBlk->HdrPadLen + LENGTH_AMSDU_SUBFRAMEHEAD;
-		else if (pTxBlk->TxFrameType == TX_RALINK_FRAME)
-			//hwHdrLen = ROUND_UP(pTxBlk->MpduHeaderLen-LENGTH_ARALINK_HEADER_FIELD, 4)+LENGTH_ARALINK_HEADER_FIELD;
-			hwHdrLen = pTxBlk->MpduHeaderLen - LENGTH_ARALINK_HEADER_FIELD + pTxBlk->HdrPadLen + LENGTH_ARALINK_HEADER_FIELD;
-		else
-			//hwHdrLen = ROUND_UP(pTxBlk->MpduHeaderLen, 4);
-			hwHdrLen = pTxBlk->MpduHeaderLen + pTxBlk->HdrPadLen;
-
-		firstDMALen = TXINFO_SIZE + TXWI_SIZE + hwHdrLen;
-	}
-	else
-	{
-		firstDMALen = pTxBlk->MpduHeaderLen;
-	}
-
-	NdisMoveMemory(pDMAHeaderBufVA, pTxBlk->HeaderBuf, firstDMALen);
-
-	pTxRing->Cell[TxIdx].pNdisPacket = pTxBlk->pPacket;
-	pTxRing->Cell[TxIdx].pNextNdisPacket = NULL;
-
-	//
-	// build Tx Descriptor
-	//
-	pTxD = (PTXD_STRUC) pTxRing->Cell[TxIdx].AllocVa;
-
-	NdisZeroMemory(pTxD, TXD_SIZE);
-
-	pTxD->SDPtr0 = BufBasePaLow;
-	pTxD->SDLen0 = firstDMALen; // include padding
-	pTxD->SDPtr1 = PCI_MAP_SINGLE(pAd, pTxBlk, 0, 1, PCI_DMA_TODEVICE);;
-	pTxD->SDLen1 = pTxBlk->SrcBufLen;
-	pTxD->LastSec0 = 0;
-	pTxD->LastSec1 = (bIsLast) ? 1 : 0;
-
-	RTMPWriteTxDescriptor(pAd, pTxD, FALSE, FIFO_EDCA);
-
-	RetTxIdx = TxIdx;
-	//
-	// Update Tx index
-	//
-	INC_RING_INDEX(TxIdx, TX_RING_SIZE);
-	pTxRing->TxCpuIdx = TxIdx;
-
-	*FreeNumber -= 1;
-
-	return RetTxIdx;
-
-}
-
-
-VOID RtmpPCI_FinalWriteTxResource(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	TX_BLK			*pTxBlk,
-	IN	USHORT			totalMPDUSize,
-	IN	USHORT			FirstTxIdx)
-{
-
-	PTXWI_STRUC		pTxWI;
-	PRTMP_TX_RING	pTxRing;
-
-	//
-	// get Tx Ring Resource
-	//
-	pTxRing = &pAd->TxRing[pTxBlk->QueIdx];
-	pTxWI = (PTXWI_STRUC) pTxRing->Cell[FirstTxIdx].DmaBuf.AllocVa;
-	pTxWI->MPDUtotalByteCount = totalMPDUSize;
-}
-
-
-VOID RtmpPCIDataLastTxIdx(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			QueIdx,
-	IN	USHORT			LastTxIdx)
-{
-	PTXD_STRUC		pTxD;
-	PRTMP_TX_RING	pTxRing;
-
-	//
-	// get Tx Ring Resource
-	//
-	pTxRing = &pAd->TxRing[QueIdx];
-
-	//
-	// build Tx Descriptor
-	//
-	pTxD = (PTXD_STRUC) pTxRing->Cell[LastTxIdx].AllocVa;
-
-	pTxD->LastSec1 = 1;
-}
-
-
-USHORT	RtmpPCI_WriteFragTxResource(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	TX_BLK			*pTxBlk,
-	IN	UCHAR			fragNum,
-	OUT	USHORT			*FreeNumber)
-{
-	UCHAR			*pDMAHeaderBufVA;
-	USHORT			TxIdx, RetTxIdx;
-	PTXD_STRUC		pTxD;
-	UINT32			BufBasePaLow;
-	PRTMP_TX_RING	pTxRing;
-	USHORT			hwHeaderLen;
-	UINT32			firstDMALen;
-
-	//
-	// Get Tx Ring Resource
-	//
-	pTxRing = &pAd->TxRing[pTxBlk->QueIdx];
-	TxIdx = pAd->TxRing[pTxBlk->QueIdx].TxCpuIdx;
-	pDMAHeaderBufVA = (PUCHAR) pTxRing->Cell[TxIdx].DmaBuf.AllocVa;
-	BufBasePaLow = RTMP_GetPhysicalAddressLow(pTxRing->Cell[TxIdx].DmaBuf.AllocPa);
-
-	//
-	// Copy TXINFO + TXWI + WLAN Header + LLC into DMA Header Buffer
-	//
-	hwHeaderLen = pTxBlk->MpduHeaderLen + pTxBlk->HdrPadLen;
-
-	firstDMALen = TXINFO_SIZE + TXWI_SIZE + hwHeaderLen;
-	NdisMoveMemory(pDMAHeaderBufVA, pTxBlk->HeaderBuf, firstDMALen);
-
-
-	//
-	// Build Tx Descriptor
-	//
-	pTxD = (PTXD_STRUC) pTxRing->Cell[TxIdx].AllocVa;
-
-	NdisZeroMemory(pTxD, TXD_SIZE);
-
-	if (fragNum == pTxBlk->TotalFragNum)
-	{
-		pTxRing->Cell[TxIdx].pNdisPacket = pTxBlk->pPacket;
-		pTxRing->Cell[TxIdx].pNextNdisPacket = NULL;
-	}
-
-	pTxD->SDPtr0 = BufBasePaLow;
-	pTxD->SDLen0 = firstDMALen; // include padding
-	pTxD->SDPtr1 = PCI_MAP_SINGLE(pAd, pTxBlk, 0, 1, PCI_DMA_TODEVICE);
-	pTxD->SDLen1 = pTxBlk->SrcBufLen;
-	pTxD->LastSec0 = 0;
-	pTxD->LastSec1 = 1;
-
-	RTMPWriteTxDescriptor(pAd, pTxD, FALSE, FIFO_EDCA);
-
-	RetTxIdx = TxIdx;
-	pTxBlk->Priv += pTxBlk->SrcBufLen;
-
-	//
-	// Update Tx index
-	//
-	INC_RING_INDEX(TxIdx, TX_RING_SIZE);
-	pTxRing->TxCpuIdx = TxIdx;
-
-	*FreeNumber -= 1;
-
-	return RetTxIdx;
-
-}
-
-/*
-	Must be run in Interrupt context
-	This function handle PCI specific TxDesc and cpu index update and kick the packet out.
- */
-int RtmpPCIMgmtKickOut(
-	IN RTMP_ADAPTER 	*pAd,
-	IN UCHAR 			QueIdx,
-	IN PNDIS_PACKET		pPacket,
-	IN PUCHAR			pSrcBufVA,
-	IN UINT 			SrcBufLen)
-{
-	PTXD_STRUC		pTxD;
-	ULONG			SwIdx = pAd->MgmtRing.TxCpuIdx;
-
-	pTxD  = (PTXD_STRUC) pAd->MgmtRing.Cell[SwIdx].AllocVa;
-	if (!pTxD)
-		return 0;
-
-	pAd->MgmtRing.Cell[SwIdx].pNdisPacket = pPacket;
-	pAd->MgmtRing.Cell[SwIdx].pNextNdisPacket = NULL;
-
-	RTMPWriteTxDescriptor(pAd, pTxD, TRUE, FIFO_MGMT);
-	pTxD->LastSec0 = 1;
-	pTxD->LastSec1 = 1;
-	pTxD->DMADONE = 0;
-	pTxD->SDLen1 = 0;
-	pTxD->SDPtr0 = PCI_MAP_SINGLE(pAd, pSrcBufVA, SrcBufLen, 0, PCI_DMA_TODEVICE);;
-	pTxD->SDLen0 = SrcBufLen;
-
-	pAd->RalinkCounters.KickTxCount++;
-	pAd->RalinkCounters.OneSecTxDoneCount++;
-
-	// Increase TX_CTX_IDX, but write to register later.
-	INC_RING_INDEX(pAd->MgmtRing.TxCpuIdx, MGMT_RING_SIZE);
-
-	RTMP_IO_WRITE32(pAd, TX_MGMTCTX_IDX,  pAd->MgmtRing.TxCpuIdx);
-
-	return 0;
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-		Check Rx descriptor, return NDIS_STATUS_FAILURE if any error dound
-
-	Arguments:
-		pRxD		Pointer to the Rx descriptor
-
-	Return Value:
-		NDIS_STATUS_SUCCESS 	No err
-		NDIS_STATUS_FAILURE 	Error
-
-	Note:
-
-	========================================================================
-*/
-NDIS_STATUS RTMPCheckRxError(
-	IN	PRTMP_ADAPTER		pAd,
-	IN	PHEADER_802_11		pHeader,
-	IN	PRXWI_STRUC 		pRxWI,
-	IN  PRT28XX_RXD_STRUC 	pRxD)
-{
-	PCIPHER_KEY pWpaKey;
-	INT dBm;
-
-	// Phy errors & CRC errors
-	if (/*(pRxD->PhyErr) ||*/ (pRxD->Crc))
-	{
-		// Check RSSI for Noise Hist statistic collection.
-		dBm = (INT) (pRxWI->RSSI0) - pAd->BbpRssiToDbmDelta;
-		if (dBm <= -87)
-			pAd->StaCfg.RPIDensity[0] += 1;
-		else if (dBm <= -82)
-			pAd->StaCfg.RPIDensity[1] += 1;
-		else if (dBm <= -77)
-			pAd->StaCfg.RPIDensity[2] += 1;
-		else if (dBm <= -72)
-			pAd->StaCfg.RPIDensity[3] += 1;
-		else if (dBm <= -67)
-			pAd->StaCfg.RPIDensity[4] += 1;
-		else if (dBm <= -62)
-			pAd->StaCfg.RPIDensity[5] += 1;
-		else if (dBm <= -57)
-			pAd->StaCfg.RPIDensity[6] += 1;
-		else if (dBm > -57)
-			pAd->StaCfg.RPIDensity[7] += 1;
-
-		return(NDIS_STATUS_FAILURE);
-	}
-
-	// Add Rx size to channel load counter, we should ignore error counts
-	pAd->StaCfg.CLBusyBytes += (pRxD->SDL0 + 14);
-
-	// Drop ToDs promiscous frame, it is opened due to CCX 2 channel load statistics
-	if (pHeader != NULL)
-	{
-		if (pHeader->FC.ToDs)
-		{
-			return(NDIS_STATUS_FAILURE);
-		}
-	}
-
-	// Drop not U2M frames, cant's drop here because we will drop beacon in this case
-	// I am kind of doubting the U2M bit operation
-	// if (pRxD->U2M == 0)
-	//	return(NDIS_STATUS_FAILURE);
-
-	// drop decyption fail frame
-	if (pRxD->CipherErr)
-	{
-		if (pRxD->CipherErr == 2)
-			{DBGPRINT_RAW(RT_DEBUG_TRACE,("pRxD ERROR: ICV ok but MICErr "));}
-		else if (pRxD->CipherErr == 1)
-			{DBGPRINT_RAW(RT_DEBUG_TRACE,("pRxD ERROR: ICV Err "));}
-		else if (pRxD->CipherErr == 3)
-			DBGPRINT_RAW(RT_DEBUG_TRACE,("pRxD ERROR: Key not valid "));
-
-        if (((pRxD->CipherErr & 1) == 1) && pAd->CommonCfg.bWirelessEvent && INFRA_ON(pAd))
-            RTMPSendWirelessEvent(pAd, IW_ICV_ERROR_EVENT_FLAG, pAd->MacTab.Content[BSSID_WCID].Addr, BSS0, 0);
-
-		DBGPRINT_RAW(RT_DEBUG_TRACE,(" %d (len=%d, Mcast=%d, MyBss=%d, Wcid=%d, KeyId=%d)\n",
-			pRxD->CipherErr,
-			pRxD->SDL0,
-			pRxD->Mcast | pRxD->Bcast,
-			pRxD->MyBss,
-			pRxWI->WirelessCliID,
-			pRxWI->KeyIndex));
-
-		//
-		// MIC Error
-		//
-		if (pRxD->CipherErr == 2)
-		{
-			pWpaKey = &pAd->SharedKey[BSS0][pRxWI->KeyIndex];
-
-            if (pAd->StaCfg.WpaSupplicantUP)
-                WpaSendMicFailureToWpaSupplicant(pAd,
-                                   (pWpaKey->Type == PAIRWISEKEY) ? TRUE:FALSE);
-            else
-			    RTMPReportMicError(pAd, pWpaKey);
-
-            if (((pRxD->CipherErr & 2) == 2) && pAd->CommonCfg.bWirelessEvent && INFRA_ON(pAd))
-                RTMPSendWirelessEvent(pAd, IW_MIC_ERROR_EVENT_FLAG, pAd->MacTab.Content[BSSID_WCID].Addr, BSS0, 0);
-
-			DBGPRINT_RAW(RT_DEBUG_ERROR,("Rx MIC Value error\n"));
-		}
-
-		if (pHeader == NULL)
-			return(NDIS_STATUS_SUCCESS);
-
-		return(NDIS_STATUS_FAILURE);
-	}
-
-	return(NDIS_STATUS_SUCCESS);
-}
-
-/*
-	==========================================================================
-	Description:
-		This routine sends command to firmware and turn our chip to power save mode.
-		Both RadioOff and .11 power save function needs to call this routine.
-	Input:
-		Level = GUIRADIO_OFF  : GUI Radio Off mode
-		Level = DOT11POWERSAVE  : 802.11 power save mode
-		Level = RTMP_HALT  : When Disable device.
-
-	==========================================================================
- */
-VOID RT28xxPciAsicRadioOff(
-	IN PRTMP_ADAPTER    pAd,
-	IN UCHAR            Level,
-	IN USHORT           TbttNumToNextWakeUp)
-{
-	WPDMA_GLO_CFG_STRUC	DmaCfg;
-	UCHAR		i, tempBBP_R3 = 0;
-	BOOLEAN		brc = FALSE, Cancelled;
-    UINT32		TbTTTime = 0;
-	UINT32		PsPollTime = 0, MACValue;
-    ULONG		BeaconPeriodTime;
-    UINT32		RxDmaIdx, RxCpuIdx;
-	DBGPRINT(RT_DEBUG_TRACE, ("AsicRadioOff ===> TxCpuIdx = %d, TxDmaIdx = %d. RxCpuIdx = %d, RxDmaIdx = %d.\n", pAd->TxRing[0].TxCpuIdx, pAd->TxRing[0].TxDmaIdx, pAd->RxRing.RxCpuIdx, pAd->RxRing.RxDmaIdx));
-
-    // Check Rx DMA busy status, if more than half is occupied, give up this radio off.
-	RTMP_IO_READ32(pAd, RX_DRX_IDX , &RxDmaIdx);
-	RTMP_IO_READ32(pAd, RX_CRX_IDX , &RxCpuIdx);
-	if ((RxDmaIdx > RxCpuIdx) && ((RxDmaIdx - RxCpuIdx) > RX_RING_SIZE/3))
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("AsicRadioOff ===> return1. RxDmaIdx = %d ,  RxCpuIdx = %d. \n", RxDmaIdx, RxCpuIdx));
-		return;
-	}
-	else if ((RxCpuIdx >= RxDmaIdx) && ((RxCpuIdx - RxDmaIdx) < RX_RING_SIZE/3))
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("AsicRadioOff ===> return2.  RxCpuIdx = %d. RxDmaIdx = %d ,  \n", RxCpuIdx, RxDmaIdx));
-		return;
-	}
-
-    // Once go into this function, disable tx because don't want too many packets in queue to prevent HW stops.
-	RTMP_SET_PSFLAG(pAd, fRTMP_PS_DISABLE_TX);
-
-	if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_ADVANCE_POWER_SAVE_PCIE_DEVICE))
-	{
-	    RTMPCancelTimer(&pAd->Mlme.RadioOnOffTimer,	&Cancelled);
-	    RTMPCancelTimer(&pAd->Mlme.PsPollTimer,	&Cancelled);
-
-	    if (Level == DOT11POWERSAVE)
-		{
-			RTMP_IO_READ32(pAd, TBTT_TIMER, &TbTTTime);
-			TbTTTime &= 0x1ffff;
-			// 00. check if need to do sleep in this DTIM period.   If next beacon will arrive within 30ms , ...doesn't necessarily sleep.
-			// TbTTTime uint = 64us, LEAD_TIME unit = 1024us, PsPollTime unit = 1ms
-	        if  (((64*TbTTTime) <((LEAD_TIME*1024) + 40000)) && (TbttNumToNextWakeUp == 0))
-			{
-				DBGPRINT(RT_DEBUG_TRACE, ("TbTTTime = 0x%x , give up this sleep. \n", TbTTTime));
-	            OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_DOZE);
-				RTMP_CLEAR_PSFLAG(pAd, fRTMP_PS_DISABLE_TX);
-				return;
-			}
-			else
-			{
-				PsPollTime = (64*TbTTTime- LEAD_TIME*1024)/1000;
-				PsPollTime -= 3;
-
-	            BeaconPeriodTime = pAd->CommonCfg.BeaconPeriod*102/100;
-				if (TbttNumToNextWakeUp > 0)
-					PsPollTime += ((TbttNumToNextWakeUp -1) * BeaconPeriodTime);
-
-	            pAd->Mlme.bPsPollTimerRunning = TRUE;
-				RTMPSetTimer(&pAd->Mlme.PsPollTimer, PsPollTime);
-			}
-		}
-	}
-
-    // 0. Disable Tx DMA.
-	RTMP_IO_READ32(pAd, WPDMA_GLO_CFG, &DmaCfg.word);
-	DmaCfg.field.EnableTxDMA = 0;
-	RTMP_IO_WRITE32(pAd, WPDMA_GLO_CFG, DmaCfg.word);
-
-	// 1. Wait DMA not busy
-	i = 0;
-	do
-	{
-		RTMP_IO_READ32(pAd, WPDMA_GLO_CFG, &DmaCfg.word);
-		if ((DmaCfg.field.TxDMABusy == 0) && (DmaCfg.field.RxDMABusy == 0))
-			break;
-		RTMPusecDelay(20);
-		i++;
-	}while(i < 50);
-
-	if (i >= 50)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("DMA keeps busy.  return on RT28xxPciAsicRadioOff ()\n"));
-		RTMP_IO_READ32(pAd, WPDMA_GLO_CFG, &DmaCfg.word);
-		DmaCfg.field.EnableTxDMA = 1;
-		RTMP_IO_WRITE32(pAd, WPDMA_GLO_CFG, DmaCfg.word);
-		pAd->CheckDmaBusyCount++;
-		return;
-	}
-	else
-	{
-		pAd->CheckDmaBusyCount = 0;
-	}
-
-    RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_IDLE_RADIO_OFF);
-
-    // Set to 1R.
-	if (pAd->Antenna.field.RxPath > 1)
-	{
-		tempBBP_R3 = (pAd->StaCfg.BBPR3 & 0xE7);
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R3, tempBBP_R3);
-	}
-
-	// In Radio Off, we turn off RF clk, So now need to call ASICSwitchChannel again.
-	if (INFRA_ON(pAd) && (pAd->CommonCfg.CentralChannel != pAd->CommonCfg.Channel)
-		&& (pAd->MlmeAux.HtCapability.HtCapInfo.ChannelWidth == BW_40))
-	{
-		// Must using 40MHz.
-		AsicTurnOffRFClk(pAd, pAd->CommonCfg.CentralChannel);
-	}
-	else
-	{
-		// Must using 20MHz.
-		AsicTurnOffRFClk(pAd, pAd->CommonCfg.Channel);
-	}
-
-	if (Level != RTMP_HALT)
-	{
-		// Change Interrupt bitmask.
-		RTMP_IO_WRITE32(pAd, INT_MASK_CSR, AutoWakeupInt);
-	}
-	else
-	{
-		NICDisableInterrupt(pAd);
-	}
-
-    RTMP_IO_WRITE32(pAd, RX_CRX_IDX, pAd->RxRing.RxCpuIdx);
-	// Disable MAC Rx
-	RTMP_IO_READ32(pAd, MAC_SYS_CTRL , &MACValue);
-	MACValue &= 0xf7;
-	RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL , MACValue);
-
-	//  2. Send Sleep command
-	RTMP_IO_WRITE32(pAd, H2M_MAILBOX_STATUS, 0xffffffff);
-	RTMP_IO_WRITE32(pAd, H2M_MAILBOX_CID, 0xffffffff);
-	// send POWER-SAVE command to MCU. high-byte = 1 save power as much as possible. high byte = 0 save less power
-	AsicSendCommandToMcu(pAd, 0x30, PowerSafeCID, 0xff, 0x1);
-	//  2-1. Wait command success
-	// Status = 1 : success, Status = 2, already sleep, Status = 3, Maybe MAC is busy so can't finish this task.
-	brc = AsicCheckCommanOk(pAd, PowerSafeCID);
-
-    if (brc == FALSE)
-    {
-        // try again
-    	AsicSendCommandToMcu(pAd, 0x30, PowerSafeCID, 0xff, 0x01);   // send POWER-SAVE command to MCU. Timeout unit:40us.
-    	//RTMPusecDelay(200);
-    	brc = AsicCheckCommanOk(pAd, PowerSafeCID);
-    }
-
-	//  3. After 0x30 command is ok, send radio off command. lowbyte = 0 for power safe.
-	// If 0x30 command is not ok this time, we can ignore 0x35 command. It will make sure not cause firmware'r problem.
-	if ((Level == DOT11POWERSAVE) && (brc == TRUE))
-	{
-		AsicSendCommandToMcu(pAd, 0x35, PowerRadioOffCID, 0, 0x00);	// lowbyte = 0 means to do power safe, NOT turn off radio.
-	 	//  3-1. Wait command success
-	 	AsicCheckCommanOk(pAd, PowerRadioOffCID);
-	}
-	else if (brc == TRUE)
-	{
-		AsicSendCommandToMcu(pAd, 0x35, PowerRadioOffCID, 1, 0x00);	// lowbyte = 0 means to do power safe, NOT turn off radio.
-	 	//  3-1. Wait command success
-	 	AsicCheckCommanOk(pAd, PowerRadioOffCID);
-	}
-
-    // Wait DMA not busy
-	i = 0;
-	do
-	{
-		RTMP_IO_READ32(pAd, WPDMA_GLO_CFG, &DmaCfg.word);
-		if ((DmaCfg.field.RxDMABusy == 0) && (DmaCfg.field.TxDMABusy == 0))
-			break;
-		RTMPusecDelay(20);
-		i++;
-	}while(i < 50);
-
-	if (i >= 50)
-	{
-		pAd->CheckDmaBusyCount++;
-		DBGPRINT(RT_DEBUG_TRACE, ("DMA Rx keeps busy.  on RT28xxPciAsicRadioOff ()\n"));
-	}
-	else
-	{
-		pAd->CheckDmaBusyCount = 0;
-	}
-
-	if (Level == DOT11POWERSAVE)
-	{
-		AUTO_WAKEUP_STRUC	AutoWakeupCfg;
-		//RTMPSetTimer(&pAd->Mlme.PsPollTimer, 90);
-
-		// we have decided to SLEEP, so at least do it for a BEACON period.
-		if (TbttNumToNextWakeUp == 0)
-			TbttNumToNextWakeUp = 1;
-
-		AutoWakeupCfg.word = 0;
-		RTMP_IO_WRITE32(pAd, AUTO_WAKEUP_CFG, AutoWakeupCfg.word);
-
-		// 1. Set auto wake up timer.
-		AutoWakeupCfg.field.NumofSleepingTbtt = TbttNumToNextWakeUp - 1;
-		AutoWakeupCfg.field.EnableAutoWakeup = 1;
-		AutoWakeupCfg.field.AutoLeadTime = LEAD_TIME;
-		RTMP_IO_WRITE32(pAd, AUTO_WAKEUP_CFG, AutoWakeupCfg.word);
-	}
-
-	//  4-1. If it's to disable our device. Need to restore PCI Configuration Space to its original value.
-	if (Level == RTMP_HALT)
-	{
-		if ((brc == TRUE) && (i < 50))
-			RTMPPCIeLinkCtrlSetting(pAd, 0);
-	}
-	//  4. Set PCI configuration Space Link Comtrol fields.  Only Radio Off needs to call this function
-	else
-	{
-		if ((brc == TRUE) && (i < 50))
-			RTMPPCIeLinkCtrlSetting(pAd, 3);
-	}
-
-	RTMP_CLEAR_PSFLAG(pAd, fRTMP_PS_DISABLE_TX);
-}
-
-
-/*
-	==========================================================================
-	Description:
-		This routine sends command to firmware and turn our chip to wake up mode from power save mode.
-		Both RadioOn and .11 power save function needs to call this routine.
-	Input:
-		Level = GUIRADIO_OFF : call this function is from Radio Off to Radio On.  Need to restore PCI host value.
-		Level = other value : normal wake up function.
-
-	==========================================================================
- */
-BOOLEAN RT28xxPciAsicRadioOn(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR     Level)
-{
-    WPDMA_GLO_CFG_STRUC	DmaCfg;
-	BOOLEAN				Cancelled, brv = TRUE;
-    UINT32			    MACValue;
-
-	if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_ADVANCE_POWER_SAVE_PCIE_DEVICE))
-	{
-	    pAd->Mlme.bPsPollTimerRunning = FALSE;
-		RTMPCancelTimer(&pAd->Mlme.PsPollTimer,	&Cancelled);
-		if ((Level == GUIRADIO_OFF) || (Level == GUI_IDLE_POWER_SAVE)
-		|| (RTMP_TEST_PSFLAG(pAd, fRTMP_PS_SET_PCI_CLK_OFF_COMMAND)))
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("RT28xxPciAsicRadioOn ()\n"));
-			// 1. Set PCI Link Control in Configuration Space.
-			RTMPPCIeLinkCtrlValueRestore(pAd, RESTORE_WAKEUP);
-			RTMPusecDelay(6000);
-		}
-	}
-
-    pAd->bPCIclkOff = FALSE;
-	RTMP_IO_WRITE32(pAd, PBF_SYS_CTRL, 0x3a80);
-	// 2. Send wake up command.
-	AsicSendCommandToMcu(pAd, 0x31, PowerWakeCID, 0x00, 0x02);
-
-	// 2-1. wait command ok.
-	brv = AsicCheckCommanOk(pAd, PowerWakeCID);
-    if (brv)
-    {
-    	NICEnableInterrupt(pAd);
-
-    	// 3. Enable Tx DMA.
-    	RTMP_IO_READ32(pAd, WPDMA_GLO_CFG, &DmaCfg.word);
-    	DmaCfg.field.EnableTxDMA = 1;
-        DmaCfg.field.EnableRxDMA = 1;
-    	RTMP_IO_WRITE32(pAd, WPDMA_GLO_CFG, DmaCfg.word);
-
-        // Eable MAC Rx
-    	RTMP_IO_READ32(pAd, MAC_SYS_CTRL , &MACValue);
-    	MACValue |= 0x8;
-    	RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL , MACValue);
-
-    	RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_IDLE_RADIO_OFF);
-    	if (Level == GUI_IDLE_POWER_SAVE)
-    	{
-    		// In Radio Off, we turn off RF clk, So now need to call ASICSwitchChannel again.
-    		if (INFRA_ON(pAd) && (pAd->CommonCfg.CentralChannel != pAd->CommonCfg.Channel)
-    			&& (pAd->MlmeAux.HtCapability.HtCapInfo.ChannelWidth == BW_40))
-    		{
-    			// Must using 40MHz.
-    			AsicSwitchChannel(pAd, pAd->CommonCfg.CentralChannel, FALSE);
-    			AsicLockChannel(pAd, pAd->CommonCfg.CentralChannel);
-    		}
-    		else
-    		{
-    			// Must using 20MHz.
-    			AsicSwitchChannel(pAd, pAd->CommonCfg.Channel, FALSE);
-    			AsicLockChannel(pAd, pAd->CommonCfg.Channel);
-    		}
-    	}
-        return TRUE;
-    }
-    else
-        return FALSE;
-}
-
-VOID RT28xxPciStaAsicForceWakeup(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR    	 Level)
-{
-    AUTO_WAKEUP_STRUC	AutoWakeupCfg;
-
-    if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_WAKEUP_NOW))
-    {
-        DBGPRINT(RT_DEBUG_TRACE, ("waking up now!\n"));
-        return;
-    }
-
-    OPSTATUS_SET_FLAG(pAd, fOP_STATUS_WAKEUP_NOW);
-	RTMP_CLEAR_PSFLAG(pAd, fRTMP_PS_GO_TO_SLEEP_NOW);
-
-    if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_ADVANCE_POWER_SAVE_PCIE_DEVICE))
-    {
-        // Support PCIe Advance Power Save
-    	if (((Level == FROM_TX) && (pAd->Mlme.bPsPollTimerRunning == TRUE)) ||
-			(Level == RTMP_HALT))
-    	{
-            pAd->Mlme.bPsPollTimerRunning = FALSE;
-    		RTMPPCIeLinkCtrlValueRestore(pAd, RESTORE_WAKEUP);
-    		RTMPusecDelay(5000);
-            DBGPRINT(RT_DEBUG_TRACE, ("=======AsicForceWakeup===bFromTx\n"));
-    	}
-
-		AutoWakeupCfg.word = 0;
-		RTMP_IO_WRITE32(pAd, AUTO_WAKEUP_CFG, AutoWakeupCfg.word);
-
-		// If this is called from Halt. ALWAYS force wakeup!!!
-		if (Level == RTMP_HALT)
-		{
-			RT28xxPciAsicRadioOn(pAd, RTMP_HALT);
-		}
-		else
-		{
-			if (RT28xxPciAsicRadioOn(pAd, DOT11POWERSAVE))
-			{
-				// In Radio Off, we turn off RF clk, So now need to call ASICSwitchChannel again.
-				if (INFRA_ON(pAd) && (pAd->CommonCfg.CentralChannel != pAd->CommonCfg.Channel)
-					&& (pAd->MlmeAux.HtCapability.HtCapInfo.ChannelWidth == BW_40))
-				{
-					// Must using 40MHz.
-					AsicSwitchChannel(pAd, pAd->CommonCfg.CentralChannel, FALSE);
-					AsicLockChannel(pAd, pAd->CommonCfg.CentralChannel);
-				}
-				else
-				{
-					// Must using 20MHz.
-					AsicSwitchChannel(pAd, pAd->CommonCfg.Channel, FALSE);
-					AsicLockChannel(pAd, pAd->CommonCfg.Channel);
-				}
-			}
-		}
-    }
-    else
-    {
-        // PCI, 2860-PCIe
-        AsicSendCommandToMcu(pAd, 0x31, 0xff, 0x00, 0x00);
-		AutoWakeupCfg.word = 0;
-		RTMP_IO_WRITE32(pAd, AUTO_WAKEUP_CFG, AutoWakeupCfg.word);
-    }
-
-    OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_DOZE);
-    OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_WAKEUP_NOW);
-    DBGPRINT(RT_DEBUG_TRACE, ("<=======RT28xxPciStaAsicForceWakeup\n"));
-}
-
-VOID RT28xxPciStaAsicSleepThenAutoWakeup(
-	IN PRTMP_ADAPTER pAd,
-	IN USHORT TbttNumToNextWakeUp)
-{
-    if (pAd->StaCfg.bRadio == FALSE)
-	{
-		OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_DOZE);
-		return;
-	}
-    if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_ADVANCE_POWER_SAVE_PCIE_DEVICE))
-    {
-    	ULONG	Now = 0;
-        if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_WAKEUP_NOW))
-        {
-            DBGPRINT(RT_DEBUG_TRACE, ("waking up now!\n"));
-            OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_DOZE);
-            return;
-        }
-
-		NdisGetSystemUpTime(&Now);
-		// If last send NULL fram time is too close to this receiving beacon (within 8ms), don't go to sleep for this DTM.
-		// Because Some AP can't queuing outgoing frames immediately.
-		if (((pAd->Mlme.LastSendNULLpsmTime + 8) >= Now) && (pAd->Mlme.LastSendNULLpsmTime <= Now))
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("Now = %lu, LastSendNULLpsmTime=%lu :  RxCountSinceLastNULL = %lu. \n", Now, pAd->Mlme.LastSendNULLpsmTime, pAd->RalinkCounters.RxCountSinceLastNULL));
-			return;
-		}
-		else if ((pAd->RalinkCounters.RxCountSinceLastNULL > 0) && ((pAd->Mlme.LastSendNULLpsmTime + pAd->CommonCfg.BeaconPeriod) >= Now))
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("Now = %lu, LastSendNULLpsmTime=%lu: RxCountSinceLastNULL = %lu > 0 \n", Now, pAd->Mlme.LastSendNULLpsmTime,  pAd->RalinkCounters.RxCountSinceLastNULL));
-			return;
-		}
-
-        RT28xxPciAsicRadioOff(pAd, DOT11POWERSAVE, TbttNumToNextWakeUp);
-    }
-    else
-    {
-        AUTO_WAKEUP_STRUC	AutoWakeupCfg;
-        // we have decided to SLEEP, so at least do it for a BEACON period.
-        if (TbttNumToNextWakeUp == 0)
-            TbttNumToNextWakeUp = 1;
-
-        AutoWakeupCfg.word = 0;
-        RTMP_IO_WRITE32(pAd, AUTO_WAKEUP_CFG, AutoWakeupCfg.word);
-        AutoWakeupCfg.field.NumofSleepingTbtt = TbttNumToNextWakeUp - 1;
-        AutoWakeupCfg.field.EnableAutoWakeup = 1;
-        AutoWakeupCfg.field.AutoLeadTime = 5;
-        RTMP_IO_WRITE32(pAd, AUTO_WAKEUP_CFG, AutoWakeupCfg.word);
-        AsicSendCommandToMcu(pAd, 0x30, 0xff, 0xff, 0x00);   // send POWER-SAVE command to MCU. Timeout 40us.
-        DBGPRINT(RT_DEBUG_TRACE, ("<-- %s, TbttNumToNextWakeUp=%d \n", __func__, TbttNumToNextWakeUp));
-    }
-    OPSTATUS_SET_FLAG(pAd, fOP_STATUS_DOZE);
-}
-
-VOID PsPollWakeExec(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3)
-{
-	RTMP_ADAPTER *pAd = (RTMP_ADAPTER *)FunctionContext;
-	unsigned long flags;
-
-    DBGPRINT(RT_DEBUG_TRACE,("-->PsPollWakeExec \n"));
-	RTMP_INT_LOCK(&pAd->irq_lock, flags);
-    if (pAd->Mlme.bPsPollTimerRunning)
-    {
-	    RTMPPCIeLinkCtrlValueRestore(pAd, RESTORE_WAKEUP);
-    }
-    pAd->Mlme.bPsPollTimerRunning = FALSE;
-	RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
-}
-
-VOID  RadioOnExec(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3)
-{
-	RTMP_ADAPTER *pAd = (RTMP_ADAPTER *)FunctionContext;
-	WPDMA_GLO_CFG_STRUC	DmaCfg;
-	BOOLEAN				Cancelled;
-
-	if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE))
-	{
-		DBGPRINT(RT_DEBUG_TRACE,("-->RadioOnExec() return on fOP_STATUS_DOZE == TRUE; \n"));
-		RTMPSetTimer(&pAd->Mlme.RadioOnOffTimer, 10);
-		return;
-	}
-
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS))
-	{
-		DBGPRINT(RT_DEBUG_TRACE,("-->RadioOnExec() return on SCAN_IN_PROGRESS; \n"));
-		RTMPSetTimer(&pAd->Mlme.RadioOnOffTimer, 10);
-		return;
-	}
-    pAd->Mlme.bPsPollTimerRunning = FALSE;
-	RTMPCancelTimer(&pAd->Mlme.PsPollTimer,	&Cancelled);
-	if (pAd->StaCfg.bRadio == TRUE)
-	{
-		pAd->bPCIclkOff = FALSE;
-        RTMPRingCleanUp(pAd, QID_AC_BK);
-		RTMPRingCleanUp(pAd, QID_AC_BE);
-		RTMPRingCleanUp(pAd, QID_AC_VI);
-		RTMPRingCleanUp(pAd, QID_AC_VO);
-		RTMPRingCleanUp(pAd, QID_HCCA);
-		RTMPRingCleanUp(pAd, QID_MGMT);
-		RTMPRingCleanUp(pAd, QID_RX);
-
-		// 2. Send wake up command.
-		AsicSendCommandToMcu(pAd, 0x31, PowerWakeCID, 0x00, 0x02);
-		// 2-1. wait command ok.
-		AsicCheckCommanOk(pAd, PowerWakeCID);
-
-		// When PCI clock is off, don't want to service interrupt. So when back to clock on, enable interrupt.
-		NICEnableInterrupt(pAd);
-
-		// 3. Enable Tx DMA.
-		RTMP_IO_READ32(pAd, WPDMA_GLO_CFG, &DmaCfg.word);
-		DmaCfg.field.EnableTxDMA = 1;
-		RTMP_IO_WRITE32(pAd, WPDMA_GLO_CFG, DmaCfg.word);
-
-		// In Radio Off, we turn off RF clk, So now need to call ASICSwitchChannel again.
-		if (INFRA_ON(pAd) && (pAd->CommonCfg.CentralChannel != pAd->CommonCfg.Channel)
-			&& (pAd->MlmeAux.HtCapability.HtCapInfo.ChannelWidth == BW_40))
-		{
-			// Must using 40MHz.
-			AsicSwitchChannel(pAd, pAd->CommonCfg.CentralChannel, FALSE);
-			AsicLockChannel(pAd, pAd->CommonCfg.CentralChannel);
-		}
-		else
-		{
-			// Must using 20MHz.
-			AsicSwitchChannel(pAd, pAd->CommonCfg.Channel, FALSE);
-			AsicLockChannel(pAd, pAd->CommonCfg.Channel);
-		}
-
-		// Clear Radio off flag
-		RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_RADIO_OFF);
-
-		// Set LED
-		RTMPSetLED(pAd, LED_RADIO_ON);
-
-        if (pAd->StaCfg.Psm == PWR_ACTIVE)
-        {
-    		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R3, pAd->StaCfg.BBPR3);
-        }
-	}
-	else
-	{
-		RT28xxPciAsicRadioOff(pAd, GUIRADIO_OFF, 0);
-	}
-}
-
-VOID RT28xxPciMlmeRadioOn(
-	IN PRTMP_ADAPTER pAd)
-{
-    if (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RADIO_OFF))
-   		return;
-
-    DBGPRINT(RT_DEBUG_TRACE,("%s===>\n", __func__));
-
-    if ((pAd->OpMode == OPMODE_AP) ||
-        ((pAd->OpMode == OPMODE_STA) && (!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_ADVANCE_POWER_SAVE_PCIE_DEVICE))))
-    {
-    	NICResetFromError(pAd);
-
-    	/*
-    	RTMPRingCleanUp(pAd, QID_AC_BK);
-    	RTMPRingCleanUp(pAd, QID_AC_BE);
-    	RTMPRingCleanUp(pAd, QID_AC_VI);
-    	RTMPRingCleanUp(pAd, QID_AC_VO);
-    	RTMPRingCleanUp(pAd, QID_HCCA);
-    	RTMPRingCleanUp(pAd, QID_MGMT);
-    	RTMPRingCleanUp(pAd, QID_RX);
-		*/
-
-    	// Enable Tx/Rx
-    	RTMPEnableRxTx(pAd);
-
-    	// Clear Radio off flag
-    	RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_RADIO_OFF);
-
-	    // Set LED
-	    RTMPSetLED(pAd, LED_RADIO_ON);
-    }
-
-    if ((pAd->OpMode == OPMODE_STA) &&
-        (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_ADVANCE_POWER_SAVE_PCIE_DEVICE)))
-    {
-        BOOLEAN		Cancelled;
-
-    	RTMPPCIeLinkCtrlValueRestore(pAd, RESTORE_WAKEUP);
-
-        pAd->Mlme.bPsPollTimerRunning = FALSE;
-    	RTMPCancelTimer(&pAd->Mlme.PsPollTimer,	&Cancelled);
-    	RTMPCancelTimer(&pAd->Mlme.RadioOnOffTimer,	&Cancelled);
-    	RTMPSetTimer(&pAd->Mlme.RadioOnOffTimer, 10);
-    }
-}
-
-VOID RT28xxPciMlmeRadioOFF(
-	IN PRTMP_ADAPTER pAd)
-{
-    WPDMA_GLO_CFG_STRUC	GloCfg;
-	UINT32	i;
-
-	if (pAd->StaCfg.bRadio == TRUE)
-	{
-		DBGPRINT(RT_DEBUG_TRACE,("-->MlmeRadioOff() return on bRadio == TRUE; \n"));
-		return;
-	}
-
-    if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RADIO_OFF))
-    	return;
-
-    DBGPRINT(RT_DEBUG_TRACE,("%s===>\n", __func__));
-
-	// Set LED
-	RTMPSetLED(pAd, LED_RADIO_OFF);
-
-    {
-    	BOOLEAN		Cancelled;
-
-    	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS))
-    	{
-			RTMPCancelTimer(&pAd->MlmeAux.ScanTimer, &Cancelled);
-			RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS);
-    	}
-
-		if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_ADVANCE_POWER_SAVE_PCIE_DEVICE))
-        {
-            BOOLEAN Cancelled;
-
-			// Always radio on since the NIC needs to set the MCU command (LED_RADIO_OFF).

-			if ((pAd->OpMode == OPMODE_STA) && 

-			     (IDLE_ON(pAd)) && 

-			     (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_IDLE_RADIO_OFF)))

-			{

-				RT28xxPciAsicRadioOn(pAd, GUI_IDLE_POWER_SAVE);

-			}
-
-            pAd->Mlme.bPsPollTimerRunning = FALSE;
-            RTMPCancelTimer(&pAd->Mlme.PsPollTimer,	&Cancelled);
-	        RTMPCancelTimer(&pAd->Mlme.RadioOnOffTimer,	&Cancelled);
-        }
-
-        // Link down first if any association exists
-        if (INFRA_ON(pAd) || ADHOC_ON(pAd))
-            LinkDown(pAd, FALSE);
-        RTMPusecDelay(10000);
-        //==========================================
-        // Clean up old bss table
-        BssTableInit(&pAd->ScanTab);
-
-		RTMPRingCleanUp(pAd, QID_AC_BK);
-    	RTMPRingCleanUp(pAd, QID_AC_BE);
-    	RTMPRingCleanUp(pAd, QID_AC_VI);
-    	RTMPRingCleanUp(pAd, QID_AC_VO);
-    	RTMPRingCleanUp(pAd, QID_HCCA);
-    	RTMPRingCleanUp(pAd, QID_MGMT);
-    	RTMPRingCleanUp(pAd, QID_RX);
-
-		if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_ADVANCE_POWER_SAVE_PCIE_DEVICE))
-		{
-			RTMPSetTimer(&pAd->Mlme.RadioOnOffTimer, 500);
-			return;
-		}
-    }
-
-	// Set Radio off flag
-	RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_RADIO_OFF);
-
-	// Disable Tx/Rx DMA
-	RTMP_IO_READ32(pAd, WPDMA_GLO_CFG, &GloCfg.word);	   // disable DMA
-	GloCfg.field.EnableTxDMA = 0;
-	GloCfg.field.EnableRxDMA = 0;
-	RTMP_IO_WRITE32(pAd, WPDMA_GLO_CFG, GloCfg.word);	   // abort all TX rings
-
-
-	// MAC_SYS_CTRL => value = 0x0 => 40mA
-	RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, 0);
-
-	// PWR_PIN_CFG => value = 0x0 => 40mA
-	RTMP_IO_WRITE32(pAd, PWR_PIN_CFG, 0);
-
-	// TX_PIN_CFG => value = 0x0 => 20mA
-	RTMP_IO_WRITE32(pAd, TX_PIN_CFG, 0);
-
-	if (pAd->CommonCfg.BBPCurrentBW == BW_40)
-	{
-		// Must using 40MHz.
-		AsicTurnOffRFClk(pAd, pAd->CommonCfg.CentralChannel);
-	}
-	else
-	{
-		// Must using 20MHz.
-		AsicTurnOffRFClk(pAd, pAd->CommonCfg.Channel);
-	}
-
-	// Waiting for DMA idle
-	i = 0;
-	do
-	{
-		RTMP_IO_READ32(pAd, WPDMA_GLO_CFG, &GloCfg.word);
-		if ((GloCfg.field.TxDMABusy == 0) && (GloCfg.field.RxDMABusy == 0))
-			break;
-
-		RTMPusecDelay(1000);
-	}while (i++ < 100);
-}
diff --git a/drivers/staging/rt2860/common/cmm_data_pci.c b/drivers/staging/rt2860/common/cmm_data_pci.c
new file mode 100644
index 000000000000..43d73a05c8eb
--- /dev/null
+++ b/drivers/staging/rt2860/common/cmm_data_pci.c
@@ -0,0 +1,1096 @@
+/*
+ *************************************************************************
+ * Ralink Tech Inc.
+ * 5F., No.36, Taiyuan St., Jhubei City,
+ * Hsinchu County 302,
+ * Taiwan, R.O.C.
+ *
+ * (c) Copyright 2002-2007, Ralink Technology, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify  *
+ * it under the terms of the GNU General Public License as published by  *
+ * the Free Software Foundation; either version 2 of the License, or     *
+ * (at your option) any later version.                                   *
+ *                                                                       *
+ * This program is distributed in the hope that it will be useful,       *
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
+ * GNU General Public License for more details.                          *
+ *                                                                       *
+ * You should have received a copy of the GNU General Public License     *
+ * along with this program; if not, write to the                         *
+ * Free Software Foundation, Inc.,                                       *
+ * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
+ *                                                                       *
+ *************************************************************************
+ */
+
+/*
+   All functions in this file must be PCI-depended, or you should out your function
+	in other files.
+
+*/
+#include	"../rt_config.h"
+
+u16 RtmpPCI_WriteTxResource(struct rt_rtmp_adapter *pAd,
+			       struct rt_tx_blk *pTxBlk,
+			       IN BOOLEAN bIsLast, u16 * FreeNumber)
+{
+
+	u8 *pDMAHeaderBufVA;
+	u16 TxIdx, RetTxIdx;
+	struct rt_txd * pTxD;
+	u32 BufBasePaLow;
+	struct rt_rtmp_tx_ring *pTxRing;
+	u16 hwHeaderLen;
+
+	/* */
+	/* get Tx Ring Resource */
+	/* */
+	pTxRing = &pAd->TxRing[pTxBlk->QueIdx];
+	TxIdx = pAd->TxRing[pTxBlk->QueIdx].TxCpuIdx;
+	pDMAHeaderBufVA = (u8 *)pTxRing->Cell[TxIdx].DmaBuf.AllocVa;
+	BufBasePaLow =
+	    RTMP_GetPhysicalAddressLow(pTxRing->Cell[TxIdx].DmaBuf.AllocPa);
+
+	/* copy TXINFO + TXWI + WLAN Header + LLC into DMA Header Buffer */
+	if (pTxBlk->TxFrameType == TX_AMSDU_FRAME) {
+		/*hwHeaderLen = ROUND_UP(pTxBlk->MpduHeaderLen-LENGTH_AMSDU_SUBFRAMEHEAD, 4)+LENGTH_AMSDU_SUBFRAMEHEAD; */
+		hwHeaderLen =
+		    pTxBlk->MpduHeaderLen - LENGTH_AMSDU_SUBFRAMEHEAD +
+		    pTxBlk->HdrPadLen + LENGTH_AMSDU_SUBFRAMEHEAD;
+	} else {
+		/*hwHeaderLen = ROUND_UP(pTxBlk->MpduHeaderLen, 4); */
+		hwHeaderLen = pTxBlk->MpduHeaderLen + pTxBlk->HdrPadLen;
+	}
+	NdisMoveMemory(pDMAHeaderBufVA, pTxBlk->HeaderBuf,
+		       TXINFO_SIZE + TXWI_SIZE + hwHeaderLen);
+
+	pTxRing->Cell[TxIdx].pNdisPacket = pTxBlk->pPacket;
+	pTxRing->Cell[TxIdx].pNextNdisPacket = NULL;
+
+	/* */
+	/* build Tx Descriptor */
+	/* */
+
+	pTxD = (struct rt_txd *) pTxRing->Cell[TxIdx].AllocVa;
+	NdisZeroMemory(pTxD, TXD_SIZE);
+
+	pTxD->SDPtr0 = BufBasePaLow;
+	pTxD->SDLen0 = TXINFO_SIZE + TXWI_SIZE + hwHeaderLen;	/* include padding */
+	pTxD->SDPtr1 = PCI_MAP_SINGLE(pAd, pTxBlk, 0, 1, PCI_DMA_TODEVICE);
+	pTxD->SDLen1 = pTxBlk->SrcBufLen;
+	pTxD->LastSec0 = 0;
+	pTxD->LastSec1 = (bIsLast) ? 1 : 0;
+
+	RTMPWriteTxDescriptor(pAd, pTxD, FALSE, FIFO_EDCA);
+
+	RetTxIdx = TxIdx;
+	/* */
+	/* Update Tx index */
+	/* */
+	INC_RING_INDEX(TxIdx, TX_RING_SIZE);
+	pTxRing->TxCpuIdx = TxIdx;
+
+	*FreeNumber -= 1;
+
+	return RetTxIdx;
+}
+
+u16 RtmpPCI_WriteSingleTxResource(struct rt_rtmp_adapter *pAd,
+				     struct rt_tx_blk *pTxBlk,
+				     IN BOOLEAN bIsLast,
+				     u16 * FreeNumber)
+{
+
+	u8 *pDMAHeaderBufVA;
+	u16 TxIdx, RetTxIdx;
+	struct rt_txd * pTxD;
+	u32 BufBasePaLow;
+	struct rt_rtmp_tx_ring *pTxRing;
+	u16 hwHeaderLen;
+
+	/* */
+	/* get Tx Ring Resource */
+	/* */
+	pTxRing = &pAd->TxRing[pTxBlk->QueIdx];
+	TxIdx = pAd->TxRing[pTxBlk->QueIdx].TxCpuIdx;
+	pDMAHeaderBufVA = (u8 *)pTxRing->Cell[TxIdx].DmaBuf.AllocVa;
+	BufBasePaLow =
+	    RTMP_GetPhysicalAddressLow(pTxRing->Cell[TxIdx].DmaBuf.AllocPa);
+
+	/* copy TXINFO + TXWI + WLAN Header + LLC into DMA Header Buffer */
+	/*hwHeaderLen = ROUND_UP(pTxBlk->MpduHeaderLen, 4); */
+	hwHeaderLen = pTxBlk->MpduHeaderLen + pTxBlk->HdrPadLen;
+
+	NdisMoveMemory(pDMAHeaderBufVA, pTxBlk->HeaderBuf,
+		       TXINFO_SIZE + TXWI_SIZE + hwHeaderLen);
+
+	pTxRing->Cell[TxIdx].pNdisPacket = pTxBlk->pPacket;
+	pTxRing->Cell[TxIdx].pNextNdisPacket = NULL;
+
+	/* */
+	/* build Tx Descriptor */
+	/* */
+	pTxD = (struct rt_txd *) pTxRing->Cell[TxIdx].AllocVa;
+	NdisZeroMemory(pTxD, TXD_SIZE);
+
+	pTxD->SDPtr0 = BufBasePaLow;
+	pTxD->SDLen0 = TXINFO_SIZE + TXWI_SIZE + hwHeaderLen;	/* include padding */
+	pTxD->SDPtr1 = PCI_MAP_SINGLE(pAd, pTxBlk, 0, 1, PCI_DMA_TODEVICE);;
+	pTxD->SDLen1 = pTxBlk->SrcBufLen;
+	pTxD->LastSec0 = 0;
+	pTxD->LastSec1 = (bIsLast) ? 1 : 0;
+
+	RTMPWriteTxDescriptor(pAd, pTxD, FALSE, FIFO_EDCA);
+
+	RetTxIdx = TxIdx;
+	/* */
+	/* Update Tx index */
+	/* */
+	INC_RING_INDEX(TxIdx, TX_RING_SIZE);
+	pTxRing->TxCpuIdx = TxIdx;
+
+	*FreeNumber -= 1;
+
+	return RetTxIdx;
+}
+
+u16 RtmpPCI_WriteMultiTxResource(struct rt_rtmp_adapter *pAd,
+				    struct rt_tx_blk *pTxBlk,
+				    u8 frameNum, u16 * FreeNumber)
+{
+	BOOLEAN bIsLast;
+	u8 *pDMAHeaderBufVA;
+	u16 TxIdx, RetTxIdx;
+	struct rt_txd * pTxD;
+	u32 BufBasePaLow;
+	struct rt_rtmp_tx_ring *pTxRing;
+	u16 hwHdrLen;
+	u32 firstDMALen;
+
+	bIsLast = ((frameNum == (pTxBlk->TotalFrameNum - 1)) ? 1 : 0);
+
+	/* */
+	/* get Tx Ring Resource */
+	/* */
+	pTxRing = &pAd->TxRing[pTxBlk->QueIdx];
+	TxIdx = pAd->TxRing[pTxBlk->QueIdx].TxCpuIdx;
+	pDMAHeaderBufVA = (u8 *)pTxRing->Cell[TxIdx].DmaBuf.AllocVa;
+	BufBasePaLow =
+	    RTMP_GetPhysicalAddressLow(pTxRing->Cell[TxIdx].DmaBuf.AllocPa);
+
+	if (frameNum == 0) {
+		/* copy TXINFO + TXWI + WLAN Header + LLC into DMA Header Buffer */
+		if (pTxBlk->TxFrameType == TX_AMSDU_FRAME)
+			/*hwHdrLen = ROUND_UP(pTxBlk->MpduHeaderLen-LENGTH_AMSDU_SUBFRAMEHEAD, 4)+LENGTH_AMSDU_SUBFRAMEHEAD; */
+			hwHdrLen =
+			    pTxBlk->MpduHeaderLen - LENGTH_AMSDU_SUBFRAMEHEAD +
+			    pTxBlk->HdrPadLen + LENGTH_AMSDU_SUBFRAMEHEAD;
+		else if (pTxBlk->TxFrameType == TX_RALINK_FRAME)
+			/*hwHdrLen = ROUND_UP(pTxBlk->MpduHeaderLen-LENGTH_ARALINK_HEADER_FIELD, 4)+LENGTH_ARALINK_HEADER_FIELD; */
+			hwHdrLen =
+			    pTxBlk->MpduHeaderLen -
+			    LENGTH_ARALINK_HEADER_FIELD + pTxBlk->HdrPadLen +
+			    LENGTH_ARALINK_HEADER_FIELD;
+		else
+			/*hwHdrLen = ROUND_UP(pTxBlk->MpduHeaderLen, 4); */
+			hwHdrLen = pTxBlk->MpduHeaderLen + pTxBlk->HdrPadLen;
+
+		firstDMALen = TXINFO_SIZE + TXWI_SIZE + hwHdrLen;
+	} else {
+		firstDMALen = pTxBlk->MpduHeaderLen;
+	}
+
+	NdisMoveMemory(pDMAHeaderBufVA, pTxBlk->HeaderBuf, firstDMALen);
+
+	pTxRing->Cell[TxIdx].pNdisPacket = pTxBlk->pPacket;
+	pTxRing->Cell[TxIdx].pNextNdisPacket = NULL;
+
+	/* */
+	/* build Tx Descriptor */
+	/* */
+	pTxD = (struct rt_txd *) pTxRing->Cell[TxIdx].AllocVa;
+	NdisZeroMemory(pTxD, TXD_SIZE);
+
+	pTxD->SDPtr0 = BufBasePaLow;
+	pTxD->SDLen0 = firstDMALen;	/* include padding */
+	pTxD->SDPtr1 = PCI_MAP_SINGLE(pAd, pTxBlk, 0, 1, PCI_DMA_TODEVICE);;
+	pTxD->SDLen1 = pTxBlk->SrcBufLen;
+	pTxD->LastSec0 = 0;
+	pTxD->LastSec1 = (bIsLast) ? 1 : 0;
+
+	RTMPWriteTxDescriptor(pAd, pTxD, FALSE, FIFO_EDCA);
+
+	RetTxIdx = TxIdx;
+	/* */
+	/* Update Tx index */
+	/* */
+	INC_RING_INDEX(TxIdx, TX_RING_SIZE);
+	pTxRing->TxCpuIdx = TxIdx;
+
+	*FreeNumber -= 1;
+
+	return RetTxIdx;
+
+}
+
+void RtmpPCI_FinalWriteTxResource(struct rt_rtmp_adapter *pAd,
+				  struct rt_tx_blk *pTxBlk,
+				  u16 totalMPDUSize, u16 FirstTxIdx)
+{
+
+	struct rt_txwi * pTxWI;
+	struct rt_rtmp_tx_ring *pTxRing;
+
+	/* */
+	/* get Tx Ring Resource */
+	/* */
+	pTxRing = &pAd->TxRing[pTxBlk->QueIdx];
+	pTxWI = (struct rt_txwi *) pTxRing->Cell[FirstTxIdx].DmaBuf.AllocVa;
+	pTxWI->MPDUtotalByteCount = totalMPDUSize;
+
+}
+
+void RtmpPCIDataLastTxIdx(struct rt_rtmp_adapter *pAd,
+			  u8 QueIdx, u16 LastTxIdx)
+{
+	struct rt_txd * pTxD;
+	struct rt_rtmp_tx_ring *pTxRing;
+
+	/* */
+	/* get Tx Ring Resource */
+	/* */
+	pTxRing = &pAd->TxRing[QueIdx];
+
+	/* */
+	/* build Tx Descriptor */
+	/* */
+	pTxD = (struct rt_txd *) pTxRing->Cell[LastTxIdx].AllocVa;
+
+	pTxD->LastSec1 = 1;
+
+}
+
+u16 RtmpPCI_WriteFragTxResource(struct rt_rtmp_adapter *pAd,
+				   struct rt_tx_blk *pTxBlk,
+				   u8 fragNum, u16 * FreeNumber)
+{
+	u8 *pDMAHeaderBufVA;
+	u16 TxIdx, RetTxIdx;
+	struct rt_txd * pTxD;
+	u32 BufBasePaLow;
+	struct rt_rtmp_tx_ring *pTxRing;
+	u16 hwHeaderLen;
+	u32 firstDMALen;
+
+	/* */
+	/* Get Tx Ring Resource */
+	/* */
+	pTxRing = &pAd->TxRing[pTxBlk->QueIdx];
+	TxIdx = pAd->TxRing[pTxBlk->QueIdx].TxCpuIdx;
+	pDMAHeaderBufVA = (u8 *)pTxRing->Cell[TxIdx].DmaBuf.AllocVa;
+	BufBasePaLow =
+	    RTMP_GetPhysicalAddressLow(pTxRing->Cell[TxIdx].DmaBuf.AllocPa);
+
+	/* */
+	/* Copy TXINFO + TXWI + WLAN Header + LLC into DMA Header Buffer */
+	/* */
+	/*hwHeaderLen = ROUND_UP(pTxBlk->MpduHeaderLen, 4); */
+	hwHeaderLen = pTxBlk->MpduHeaderLen + pTxBlk->HdrPadLen;
+
+	firstDMALen = TXINFO_SIZE + TXWI_SIZE + hwHeaderLen;
+	NdisMoveMemory(pDMAHeaderBufVA, pTxBlk->HeaderBuf, firstDMALen);
+
+	/* */
+	/* Build Tx Descriptor */
+	/* */
+	pTxD = (struct rt_txd *) pTxRing->Cell[TxIdx].AllocVa;
+	NdisZeroMemory(pTxD, TXD_SIZE);
+
+	if (fragNum == pTxBlk->TotalFragNum) {
+		pTxRing->Cell[TxIdx].pNdisPacket = pTxBlk->pPacket;
+		pTxRing->Cell[TxIdx].pNextNdisPacket = NULL;
+	}
+
+	pTxD->SDPtr0 = BufBasePaLow;
+	pTxD->SDLen0 = firstDMALen;	/* include padding */
+	pTxD->SDPtr1 = PCI_MAP_SINGLE(pAd, pTxBlk, 0, 1, PCI_DMA_TODEVICE);
+	pTxD->SDLen1 = pTxBlk->SrcBufLen;
+	pTxD->LastSec0 = 0;
+	pTxD->LastSec1 = 1;
+
+	RTMPWriteTxDescriptor(pAd, pTxD, FALSE, FIFO_EDCA);
+
+	RetTxIdx = TxIdx;
+	pTxBlk->Priv += pTxBlk->SrcBufLen;
+
+	/* */
+	/* Update Tx index */
+	/* */
+	INC_RING_INDEX(TxIdx, TX_RING_SIZE);
+	pTxRing->TxCpuIdx = TxIdx;
+
+	*FreeNumber -= 1;
+
+	return RetTxIdx;
+
+}
+
+/*
+	Must be run in Interrupt context
+	This function handle PCI specific TxDesc and cpu index update and kick the packet out.
+ */
+int RtmpPCIMgmtKickOut(struct rt_rtmp_adapter *pAd,
+		       u8 QueIdx,
+		       void *pPacket,
+		       u8 *pSrcBufVA, u32 SrcBufLen)
+{
+	struct rt_txd * pTxD;
+	unsigned long SwIdx = pAd->MgmtRing.TxCpuIdx;
+
+	pTxD = (struct rt_txd *) pAd->MgmtRing.Cell[SwIdx].AllocVa;
+
+	pAd->MgmtRing.Cell[SwIdx].pNdisPacket = pPacket;
+	pAd->MgmtRing.Cell[SwIdx].pNextNdisPacket = NULL;
+
+	RTMPWriteTxDescriptor(pAd, pTxD, TRUE, FIFO_MGMT);
+	pTxD->LastSec0 = 1;
+	pTxD->LastSec1 = 1;
+	pTxD->DMADONE = 0;
+	pTxD->SDLen1 = 0;
+	pTxD->SDPtr0 =
+	    PCI_MAP_SINGLE(pAd, pSrcBufVA, SrcBufLen, 0, PCI_DMA_TODEVICE);
+	pTxD->SDLen0 = SrcBufLen;
+
+/*================================================================== */
+/*	DBGPRINT_RAW(RT_DEBUG_TRACE, ("MLMEHardTransmit\n"));
+	for (i = 0; i < (TXWI_SIZE+24); i++)
+	{
+
+		DBGPRINT_RAW(RT_DEBUG_TRACE, ("%x:", *(pSrcBufVA+i)));
+		if ( i%4 == 3)
+			DBGPRINT_RAW(RT_DEBUG_TRACE, (" :: "));
+		if ( i%16 == 15)
+			DBGPRINT_RAW(RT_DEBUG_TRACE, ("\n      "));
+	}
+	DBGPRINT_RAW(RT_DEBUG_TRACE, ("\n      "));*/
+/*======================================================================= */
+
+	pAd->RalinkCounters.KickTxCount++;
+	pAd->RalinkCounters.OneSecTxDoneCount++;
+
+	/* Increase TX_CTX_IDX, but write to register later. */
+	INC_RING_INDEX(pAd->MgmtRing.TxCpuIdx, MGMT_RING_SIZE);
+
+	RTMP_IO_WRITE32(pAd, TX_MGMTCTX_IDX, pAd->MgmtRing.TxCpuIdx);
+
+	return 0;
+}
+
+/*
+	========================================================================
+
+	Routine Description:
+		Check Rx descriptor, return NDIS_STATUS_FAILURE if any error dound
+
+	Arguments:
+		pRxD		Pointer to the Rx descriptor
+
+	Return Value:
+		NDIS_STATUS_SUCCESS	No err
+		NDIS_STATUS_FAILURE	Error
+
+	Note:
+
+	========================================================================
+*/
+int RTMPCheckRxError(struct rt_rtmp_adapter *pAd,
+			     struct rt_header_802_11 * pHeader,
+			     struct rt_rxwi * pRxWI, IN PRT28XX_RXD_STRUC pRxD)
+{
+	struct rt_cipher_key *pWpaKey;
+	int dBm;
+
+	/* Phy errors & CRC errors */
+	if ( /*(pRxD->PhyErr) || */ (pRxD->Crc)) {
+		/* Check RSSI for Noise Hist statistic collection. */
+		dBm = (int)(pRxWI->RSSI0) - pAd->BbpRssiToDbmDelta;
+		if (dBm <= -87)
+			pAd->StaCfg.RPIDensity[0] += 1;
+		else if (dBm <= -82)
+			pAd->StaCfg.RPIDensity[1] += 1;
+		else if (dBm <= -77)
+			pAd->StaCfg.RPIDensity[2] += 1;
+		else if (dBm <= -72)
+			pAd->StaCfg.RPIDensity[3] += 1;
+		else if (dBm <= -67)
+			pAd->StaCfg.RPIDensity[4] += 1;
+		else if (dBm <= -62)
+			pAd->StaCfg.RPIDensity[5] += 1;
+		else if (dBm <= -57)
+			pAd->StaCfg.RPIDensity[6] += 1;
+		else if (dBm > -57)
+			pAd->StaCfg.RPIDensity[7] += 1;
+
+		return (NDIS_STATUS_FAILURE);
+	}
+	/* Add Rx size to channel load counter, we should ignore error counts */
+	pAd->StaCfg.CLBusyBytes += (pRxD->SDL0 + 14);
+
+	/* Drop ToDs promiscous frame, it is opened due to CCX 2 channel load statistics */
+	if (pHeader != NULL) {
+		if (pHeader->FC.ToDs) {
+			return (NDIS_STATUS_FAILURE);
+		}
+	}
+	/* Drop not U2M frames, cant's drop here because we will drop beacon in this case */
+	/* I am kind of doubting the U2M bit operation */
+	/* if (pRxD->U2M == 0) */
+	/*      return(NDIS_STATUS_FAILURE); */
+
+	/* drop decyption fail frame */
+	if (pRxD->CipherErr) {
+		if (pRxD->CipherErr == 2) {
+			DBGPRINT_RAW(RT_DEBUG_TRACE,
+				     ("pRxD ERROR: ICV ok but MICErr "));
+		} else if (pRxD->CipherErr == 1) {
+			DBGPRINT_RAW(RT_DEBUG_TRACE, ("pRxD ERROR: ICV Err "));
+		} else if (pRxD->CipherErr == 3)
+			DBGPRINT_RAW(RT_DEBUG_TRACE,
+				     ("pRxD ERROR: Key not valid "));
+
+		if (((pRxD->CipherErr & 1) == 1)
+		    && pAd->CommonCfg.bWirelessEvent && INFRA_ON(pAd))
+			RTMPSendWirelessEvent(pAd, IW_ICV_ERROR_EVENT_FLAG,
+					      pAd->MacTab.Content[BSSID_WCID].
+					      Addr, BSS0, 0);
+
+		DBGPRINT_RAW(RT_DEBUG_TRACE,
+			     (" %d (len=%d, Mcast=%d, MyBss=%d, Wcid=%d, KeyId=%d)\n",
+			      pRxD->CipherErr, pRxD->SDL0,
+			      pRxD->Mcast | pRxD->Bcast, pRxD->MyBss,
+			      pRxWI->WirelessCliID,
+/*                      CipherName[pRxD->CipherAlg], */
+			      pRxWI->KeyIndex));
+
+		/* */
+		/* MIC Error */
+		/* */
+		if (pRxD->CipherErr == 2) {
+			pWpaKey = &pAd->SharedKey[BSS0][pRxWI->KeyIndex];
+			if (pAd->StaCfg.WpaSupplicantUP)
+				WpaSendMicFailureToWpaSupplicant(pAd,
+								 (pWpaKey->
+								  Type ==
+								  PAIRWISEKEY) ?
+								 TRUE : FALSE);
+			else
+				RTMPReportMicError(pAd, pWpaKey);
+
+			if (((pRxD->CipherErr & 2) == 2)
+			    && pAd->CommonCfg.bWirelessEvent && INFRA_ON(pAd))
+				RTMPSendWirelessEvent(pAd,
+						      IW_MIC_ERROR_EVENT_FLAG,
+						      pAd->MacTab.
+						      Content[BSSID_WCID].Addr,
+						      BSS0, 0);
+
+			DBGPRINT_RAW(RT_DEBUG_ERROR, ("Rx MIC Value error\n"));
+		}
+
+		if (pHeader == NULL)
+			return (NDIS_STATUS_SUCCESS);
+		/*if ((pRxD->CipherAlg == CIPHER_AES) &&
+		   (pHeader->Sequence == pAd->FragFrame.Sequence))
+		   {
+		   //
+		   // Acceptable since the First FragFrame no CipherErr problem.
+		   //
+		   return(NDIS_STATUS_SUCCESS);
+		   } */
+
+		return (NDIS_STATUS_FAILURE);
+	}
+
+	return (NDIS_STATUS_SUCCESS);
+}
+
+BOOLEAN RTMPFreeTXDUponTxDmaDone(struct rt_rtmp_adapter *pAd, u8 QueIdx)
+{
+	struct rt_rtmp_tx_ring *pTxRing;
+	struct rt_txd * pTxD;
+	void *pPacket;
+	u8 FREE = 0;
+	struct rt_txd TxD, *pOriTxD;
+	/*unsigned long         IrqFlags; */
+	BOOLEAN bReschedule = FALSE;
+
+	ASSERT(QueIdx < NUM_OF_TX_RING);
+	pTxRing = &pAd->TxRing[QueIdx];
+
+	RTMP_IO_READ32(pAd, TX_DTX_IDX0 + QueIdx * RINGREG_DIFF,
+		       &pTxRing->TxDmaIdx);
+	while (pTxRing->TxSwFreeIdx != pTxRing->TxDmaIdx) {
+/*              RTMP_IRQ_LOCK(&pAd->irq_lock, IrqFlags); */
+
+		/* static rate also need NICUpdateFifoStaCounters() function. */
+		/*if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_TX_RATE_SWITCH_ENABLED)) */
+		NICUpdateFifoStaCounters(pAd);
+
+		/* Note : If (pAd->ate.bQATxStart == TRUE), we will never reach here. */
+		FREE++;
+		pTxD =
+		    (struct rt_txd *) (pTxRing->Cell[pTxRing->TxSwFreeIdx].AllocVa);
+		pOriTxD = pTxD;
+		NdisMoveMemory(&TxD, pTxD, sizeof(struct rt_txd));
+		pTxD = &TxD;
+
+		pTxD->DMADONE = 0;
+
+		{
+			pPacket =
+			    pTxRing->Cell[pTxRing->TxSwFreeIdx].pNdisPacket;
+			if (pPacket) {
+				PCI_UNMAP_SINGLE(pAd, pTxD->SDPtr1,
+						 pTxD->SDLen1,
+						 PCI_DMA_TODEVICE);
+				RELEASE_NDIS_PACKET(pAd, pPacket,
+						    NDIS_STATUS_SUCCESS);
+			}
+			/*Always assign pNdisPacket as NULL after clear */
+			pTxRing->Cell[pTxRing->TxSwFreeIdx].pNdisPacket = NULL;
+
+			pPacket =
+			    pTxRing->Cell[pTxRing->TxSwFreeIdx].pNextNdisPacket;
+
+			ASSERT(pPacket == NULL);
+			if (pPacket) {
+				PCI_UNMAP_SINGLE(pAd, pTxD->SDPtr1,
+						 pTxD->SDLen1,
+						 PCI_DMA_TODEVICE);
+				RELEASE_NDIS_PACKET(pAd, pPacket,
+						    NDIS_STATUS_SUCCESS);
+			}
+			/*Always assign pNextNdisPacket as NULL after clear */
+			pTxRing->Cell[pTxRing->TxSwFreeIdx].pNextNdisPacket =
+			    NULL;
+		}
+
+		pAd->RalinkCounters.TransmittedByteCount +=
+		    (pTxD->SDLen1 + pTxD->SDLen0);
+		pAd->RalinkCounters.OneSecDmaDoneCount[QueIdx]++;
+		INC_RING_INDEX(pTxRing->TxSwFreeIdx, TX_RING_SIZE);
+		/* get tx_tdx_idx again */
+		RTMP_IO_READ32(pAd, TX_DTX_IDX0 + QueIdx * RINGREG_DIFF,
+			       &pTxRing->TxDmaIdx);
+		NdisMoveMemory(pOriTxD, pTxD, sizeof(struct rt_txd));
+
+/*         RTMP_IRQ_UNLOCK(&pAd->irq_lock, IrqFlags); */
+	}
+
+	return bReschedule;
+
+}
+
+/*
+	========================================================================
+
+	Routine Description:
+		Process TX Rings DMA Done interrupt, running in DPC level
+
+	Arguments:
+		Adapter		Pointer to our adapter
+
+	Return Value:
+		None
+
+	IRQL = DISPATCH_LEVEL
+
+	========================================================================
+*/
+BOOLEAN RTMPHandleTxRingDmaDoneInterrupt(struct rt_rtmp_adapter *pAd,
+					 INT_SOURCE_CSR_STRUC TxRingBitmap)
+{
+/*      u8                   Count = 0; */
+	unsigned long IrqFlags;
+	BOOLEAN bReschedule = FALSE;
+
+	/* Make sure Tx ring resource won't be used by other threads */
+	/*NdisAcquireSpinLock(&pAd->TxRingLock); */
+
+	RTMP_IRQ_LOCK(&pAd->irq_lock, IrqFlags);
+
+	if (TxRingBitmap.field.Ac0DmaDone)
+		bReschedule = RTMPFreeTXDUponTxDmaDone(pAd, QID_AC_BE);
+
+	if (TxRingBitmap.field.Ac3DmaDone)
+		bReschedule |= RTMPFreeTXDUponTxDmaDone(pAd, QID_AC_VO);
+
+	if (TxRingBitmap.field.Ac2DmaDone)
+		bReschedule |= RTMPFreeTXDUponTxDmaDone(pAd, QID_AC_VI);
+
+	if (TxRingBitmap.field.Ac1DmaDone)
+		bReschedule |= RTMPFreeTXDUponTxDmaDone(pAd, QID_AC_BK);
+
+	/* Make sure to release Tx ring resource */
+	/*NdisReleaseSpinLock(&pAd->TxRingLock); */
+	RTMP_IRQ_UNLOCK(&pAd->irq_lock, IrqFlags);
+
+	/* Dequeue outgoing frames from TxSwQueue[] and process it */
+	RTMPDeQueuePacket(pAd, FALSE, NUM_OF_TX_RING, MAX_TX_PROCESS);
+
+	return bReschedule;
+}
+
+/*
+	========================================================================
+
+	Routine Description:
+		Process MGMT ring DMA done interrupt, running in DPC level
+
+	Arguments:
+		pAd	Pointer to our adapter
+
+	Return Value:
+		None
+
+	IRQL = DISPATCH_LEVEL
+
+	Note:
+
+	========================================================================
+*/
+void RTMPHandleMgmtRingDmaDoneInterrupt(struct rt_rtmp_adapter *pAd)
+{
+	struct rt_txd * pTxD;
+	void *pPacket;
+/*      int              i; */
+	u8 FREE = 0;
+	struct rt_rtmp_mgmt_ring *pMgmtRing = &pAd->MgmtRing;
+
+	NdisAcquireSpinLock(&pAd->MgmtRingLock);
+
+	RTMP_IO_READ32(pAd, TX_MGMTDTX_IDX, &pMgmtRing->TxDmaIdx);
+	while (pMgmtRing->TxSwFreeIdx != pMgmtRing->TxDmaIdx) {
+		FREE++;
+		pTxD =
+		    (struct rt_txd *) (pMgmtRing->Cell[pAd->MgmtRing.TxSwFreeIdx].
+				  AllocVa);
+		pTxD->DMADONE = 0;
+		pPacket = pMgmtRing->Cell[pMgmtRing->TxSwFreeIdx].pNdisPacket;
+
+		if (pPacket) {
+			PCI_UNMAP_SINGLE(pAd, pTxD->SDPtr0, pTxD->SDLen0,
+					 PCI_DMA_TODEVICE);
+			RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_SUCCESS);
+		}
+		pMgmtRing->Cell[pMgmtRing->TxSwFreeIdx].pNdisPacket = NULL;
+
+		pPacket =
+		    pMgmtRing->Cell[pMgmtRing->TxSwFreeIdx].pNextNdisPacket;
+		if (pPacket) {
+			PCI_UNMAP_SINGLE(pAd, pTxD->SDPtr1, pTxD->SDLen1,
+					 PCI_DMA_TODEVICE);
+			RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_SUCCESS);
+		}
+		pMgmtRing->Cell[pMgmtRing->TxSwFreeIdx].pNextNdisPacket = NULL;
+		INC_RING_INDEX(pMgmtRing->TxSwFreeIdx, MGMT_RING_SIZE);
+
+	}
+	NdisReleaseSpinLock(&pAd->MgmtRingLock);
+
+}
+
+/*
+	========================================================================
+
+	Routine Description:
+	Arguments:
+		Adapter		Pointer to our adapter. Dequeue all power safe delayed braodcast frames after beacon.
+
+	IRQL = DISPATCH_LEVEL
+
+	========================================================================
+*/
+void RTMPHandleTBTTInterrupt(struct rt_rtmp_adapter *pAd)
+{
+	{
+		if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE)) {
+		}
+	}
+}
+
+/*
+	========================================================================
+
+	Routine Description:
+	Arguments:
+		pAd		Pointer to our adapter. Rewrite beacon content before next send-out.
+
+	IRQL = DISPATCH_LEVEL
+
+	========================================================================
+*/
+void RTMPHandlePreTBTTInterrupt(struct rt_rtmp_adapter *pAd)
+{
+	{
+		if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE)) {
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("RTMPHandlePreTBTTInterrupt...\n"));
+		}
+	}
+
+}
+
+void RTMPHandleRxCoherentInterrupt(struct rt_rtmp_adapter *pAd)
+{
+	WPDMA_GLO_CFG_STRUC GloCfg;
+
+	if (pAd == NULL) {
+		DBGPRINT(RT_DEBUG_TRACE, ("====> pAd is NULL, return.\n"));
+		return;
+	}
+
+	DBGPRINT(RT_DEBUG_TRACE, ("==> RTMPHandleRxCoherentInterrupt \n"));
+
+	RTMP_IO_READ32(pAd, WPDMA_GLO_CFG, &GloCfg.word);
+
+	GloCfg.field.EnTXWriteBackDDONE = 0;
+	GloCfg.field.EnableRxDMA = 0;
+	GloCfg.field.EnableTxDMA = 0;
+	RTMP_IO_WRITE32(pAd, WPDMA_GLO_CFG, GloCfg.word);
+
+	RTMPRingCleanUp(pAd, QID_AC_BE);
+	RTMPRingCleanUp(pAd, QID_AC_BK);
+	RTMPRingCleanUp(pAd, QID_AC_VI);
+	RTMPRingCleanUp(pAd, QID_AC_VO);
+	RTMPRingCleanUp(pAd, QID_MGMT);
+	RTMPRingCleanUp(pAd, QID_RX);
+
+	RTMPEnableRxTx(pAd);
+
+	DBGPRINT(RT_DEBUG_TRACE, ("<== RTMPHandleRxCoherentInterrupt \n"));
+}
+
+void *GetPacketFromRxRing(struct rt_rtmp_adapter *pAd,
+				 OUT PRT28XX_RXD_STRUC pSaveRxD,
+				 OUT BOOLEAN * pbReschedule,
+				 IN u32 * pRxPending)
+{
+	struct rt_rxd * pRxD;
+	void *pRxPacket = NULL;
+	void *pNewPacket;
+	void *AllocVa;
+	dma_addr_t AllocPa;
+	BOOLEAN bReschedule = FALSE;
+	struct rt_rtmp_dmacb *pRxCell;
+
+	RTMP_SEM_LOCK(&pAd->RxRingLock);
+
+	if (*pRxPending == 0) {
+		/* Get how may packets had been received */
+		RTMP_IO_READ32(pAd, RX_DRX_IDX, &pAd->RxRing.RxDmaIdx);
+
+		if (pAd->RxRing.RxSwReadIdx == pAd->RxRing.RxDmaIdx) {
+			/* no more rx packets */
+			bReschedule = FALSE;
+			goto done;
+		}
+		/* get rx pending count */
+		if (pAd->RxRing.RxDmaIdx > pAd->RxRing.RxSwReadIdx)
+			*pRxPending =
+			    pAd->RxRing.RxDmaIdx - pAd->RxRing.RxSwReadIdx;
+		else
+			*pRxPending =
+			    pAd->RxRing.RxDmaIdx + RX_RING_SIZE -
+			    pAd->RxRing.RxSwReadIdx;
+
+	}
+
+	pRxCell = &pAd->RxRing.Cell[pAd->RxRing.RxSwReadIdx];
+
+	/* Point to Rx indexed rx ring descriptor */
+	pRxD = (struct rt_rxd *) pRxCell->AllocVa;
+
+	if (pRxD->DDONE == 0) {
+		*pRxPending = 0;
+		/* DMAIndx had done but DDONE bit not ready */
+		bReschedule = TRUE;
+		goto done;
+	}
+
+	/* return rx descriptor */
+	NdisMoveMemory(pSaveRxD, pRxD, RXD_SIZE);
+
+	pNewPacket =
+	    RTMP_AllocateRxPacketBuffer(pAd, RX_BUFFER_AGGRESIZE, FALSE,
+					&AllocVa, &AllocPa);
+
+	if (pNewPacket) {
+		/* unmap the rx buffer */
+		PCI_UNMAP_SINGLE(pAd, pRxCell->DmaBuf.AllocPa,
+				 pRxCell->DmaBuf.AllocSize, PCI_DMA_FROMDEVICE);
+		pRxPacket = pRxCell->pNdisPacket;
+
+		pRxCell->DmaBuf.AllocSize = RX_BUFFER_AGGRESIZE;
+		pRxCell->pNdisPacket = (void *)pNewPacket;
+		pRxCell->DmaBuf.AllocVa = AllocVa;
+		pRxCell->DmaBuf.AllocPa = AllocPa;
+		/* update SDP0 to new buffer of rx packet */
+		pRxD->SDP0 = AllocPa;
+	} else {
+		/*DBGPRINT(RT_DEBUG_TRACE,("No Rx Buffer\n")); */
+		pRxPacket = NULL;
+		bReschedule = TRUE;
+	}
+
+	pRxD->DDONE = 0;
+
+	/* had handled one rx packet */
+	*pRxPending = *pRxPending - 1;
+
+	/* update rx descriptor and kick rx */
+	INC_RING_INDEX(pAd->RxRing.RxSwReadIdx, RX_RING_SIZE);
+
+	pAd->RxRing.RxCpuIdx =
+	    (pAd->RxRing.RxSwReadIdx ==
+	     0) ? (RX_RING_SIZE - 1) : (pAd->RxRing.RxSwReadIdx - 1);
+	RTMP_IO_WRITE32(pAd, RX_CRX_IDX, pAd->RxRing.RxCpuIdx);
+
+done:
+	RTMP_SEM_UNLOCK(&pAd->RxRingLock);
+	*pbReschedule = bReschedule;
+	return pRxPacket;
+}
+
+int MlmeHardTransmitTxRing(struct rt_rtmp_adapter *pAd,
+				   u8 QueIdx, void *pPacket)
+{
+	struct rt_packet_info PacketInfo;
+	u8 *pSrcBufVA;
+	u32 SrcBufLen;
+	struct rt_txd * pTxD;
+	struct rt_header_802_11 * pHeader_802_11;
+	BOOLEAN bAckRequired, bInsertTimestamp;
+	unsigned long SrcBufPA;
+	/*u8                 TxBufIdx; */
+	u8 MlmeRate;
+	unsigned long SwIdx = pAd->TxRing[QueIdx].TxCpuIdx;
+	struct rt_txwi * pFirstTxWI;
+	/*unsigned long i; */
+	/*HTTRANSMIT_SETTING    MlmeTransmit;   //Rate for this MGMT frame. */
+	unsigned long FreeNum;
+	struct rt_mac_table_entry *pMacEntry = NULL;
+
+	RTMP_QueryPacketInfo(pPacket, &PacketInfo, &pSrcBufVA, &SrcBufLen);
+
+	if (pSrcBufVA == NULL) {
+		/* The buffer shouldn't be NULL */
+		return NDIS_STATUS_FAILURE;
+	}
+	/* Make sure MGMT ring resource won't be used by other threads */
+	/*NdisAcquireSpinLock(&pAd->TxRingLock); */
+
+	FreeNum = GET_TXRING_FREENO(pAd, QueIdx);
+
+	if (FreeNum == 0) {
+		/*NdisReleaseSpinLock(&pAd->TxRingLock); */
+		return NDIS_STATUS_FAILURE;
+	}
+
+	SwIdx = pAd->TxRing[QueIdx].TxCpuIdx;
+
+	pTxD = (struct rt_txd *) pAd->TxRing[QueIdx].Cell[SwIdx].AllocVa;
+
+	if (pAd->TxRing[QueIdx].Cell[SwIdx].pNdisPacket) {
+		DBGPRINT(RT_DEBUG_OFF, ("MlmeHardTransmit Error\n"));
+		/*NdisReleaseSpinLock(&pAd->TxRingLock); */
+		return NDIS_STATUS_FAILURE;
+	}
+
+	{
+		/* outgoing frame always wakeup PHY to prevent frame lost */
+		/* if (pAd->StaCfg.Psm == PWR_SAVE) */
+		if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE))
+			AsicForceWakeup(pAd, TRUE);
+	}
+	pFirstTxWI = (struct rt_txwi *) pSrcBufVA;
+
+	pHeader_802_11 = (struct rt_header_802_11 *) (pSrcBufVA + TXWI_SIZE);
+	if (pHeader_802_11->Addr1[0] & 0x01) {
+		MlmeRate = pAd->CommonCfg.BasicMlmeRate;
+	} else {
+		MlmeRate = pAd->CommonCfg.MlmeRate;
+	}
+
+	if ((pHeader_802_11->FC.Type == BTYPE_DATA) &&
+	    (pHeader_802_11->FC.SubType == SUBTYPE_QOS_NULL)) {
+		pMacEntry = MacTableLookup(pAd, pHeader_802_11->Addr1);
+	}
+	/* Verify Mlme rate for a / g bands. */
+	if ((pAd->LatchRfRegs.Channel > 14) && (MlmeRate < RATE_6))	/* 11A band */
+		MlmeRate = RATE_6;
+
+	/* */
+	/* Should not be hard code to set PwrMgmt to 0 (PWR_ACTIVE) */
+	/* Snice it's been set to 0 while on MgtMacHeaderInit */
+	/* By the way this will cause frame to be send on PWR_SAVE failed. */
+	/* */
+	/* */
+	/* In WMM-UAPSD, mlme frame should be set psm as power saving but probe request frame */
+	/* Data-Null packets alse pass through MMRequest in RT2860, however, we hope control the psm bit to pass APSD */
+	if (pHeader_802_11->FC.Type != BTYPE_DATA) {
+		if ((pHeader_802_11->FC.SubType == SUBTYPE_PROBE_REQ)
+		    || !(pAd->CommonCfg.bAPSDCapable
+			 && pAd->CommonCfg.APEdcaParm.bAPSDCapable)) {
+			pHeader_802_11->FC.PwrMgmt = PWR_ACTIVE;
+		} else {
+			pHeader_802_11->FC.PwrMgmt =
+			    pAd->CommonCfg.bAPSDForcePowerSave;
+		}
+	}
+
+	bInsertTimestamp = FALSE;
+	if (pHeader_802_11->FC.Type == BTYPE_CNTL)	/* must be PS-POLL */
+	{
+		bAckRequired = FALSE;
+	} else			/* BTYPE_MGMT or BTYPE_DATA(must be NULL frame) */
+	{
+		if (pHeader_802_11->Addr1[0] & 0x01)	/* MULTICAST, BROADCAST */
+		{
+			bAckRequired = FALSE;
+			pHeader_802_11->Duration = 0;
+		} else {
+			bAckRequired = TRUE;
+			pHeader_802_11->Duration =
+			    RTMPCalcDuration(pAd, MlmeRate, 14);
+			if (pHeader_802_11->FC.SubType == SUBTYPE_PROBE_RSP) {
+				bInsertTimestamp = TRUE;
+			}
+		}
+	}
+	pHeader_802_11->Sequence = pAd->Sequence++;
+	if (pAd->Sequence > 0xfff)
+		pAd->Sequence = 0;
+	/* Before radar detection done, mgmt frame can not be sent but probe req */
+	/* Because we need to use probe req to trigger driver to send probe req in passive scan */
+	if ((pHeader_802_11->FC.SubType != SUBTYPE_PROBE_REQ)
+	    && (pAd->CommonCfg.bIEEE80211H == 1)
+	    && (pAd->CommonCfg.RadarDetect.RDMode != RD_NORMAL_MODE)) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("MlmeHardTransmit --> radar detect not in normal mode!\n"));
+		/*NdisReleaseSpinLock(&pAd->TxRingLock); */
+		return (NDIS_STATUS_FAILURE);
+	}
+	/* */
+	/* fill scatter-and-gather buffer list into TXD. Internally created NDIS PACKET */
+	/* should always has only one ohysical buffer, and the whole frame size equals */
+	/* to the first scatter buffer size */
+	/* */
+
+	/* Initialize TX Descriptor */
+	/* For inter-frame gap, the number is for this frame and next frame */
+	/* For MLME rate, we will fix as 2Mb to match other vendor's implement */
+/*      pAd->CommonCfg.MlmeTransmit.field.MODE = 1; */
+
+/* management frame doesn't need encryption. so use RESERVED_WCID no matter u are sending to specific wcid or not. */
+	/* Only beacon use Nseq=TRUE. So here we use Nseq=FALSE. */
+	if (pMacEntry == NULL) {
+		RTMPWriteTxWI(pAd, pFirstTxWI, FALSE, FALSE, bInsertTimestamp,
+			      FALSE, bAckRequired, FALSE, 0, RESERVED_WCID,
+			      (SrcBufLen - TXWI_SIZE), PID_MGMT, 0,
+			      (u8)pAd->CommonCfg.MlmeTransmit.field.MCS,
+			      IFS_BACKOFF, FALSE, &pAd->CommonCfg.MlmeTransmit);
+	} else {
+		RTMPWriteTxWI(pAd, pFirstTxWI, FALSE, FALSE,
+			      bInsertTimestamp, FALSE, bAckRequired, FALSE,
+			      0, pMacEntry->Aid, (SrcBufLen - TXWI_SIZE),
+			      pMacEntry->MaxHTPhyMode.field.MCS, 0,
+			      (u8)pMacEntry->MaxHTPhyMode.field.MCS,
+			      IFS_BACKOFF, FALSE, &pMacEntry->MaxHTPhyMode);
+	}
+
+	pAd->TxRing[QueIdx].Cell[SwIdx].pNdisPacket = pPacket;
+	pAd->TxRing[QueIdx].Cell[SwIdx].pNextNdisPacket = NULL;
+/*      pFirstTxWI->MPDUtotalByteCount = SrcBufLen - TXWI_SIZE; */
+	SrcBufPA =
+	    PCI_MAP_SINGLE(pAd, pSrcBufVA, SrcBufLen, 0, PCI_DMA_TODEVICE);
+
+	RTMPWriteTxDescriptor(pAd, pTxD, TRUE, FIFO_EDCA);
+	pTxD->LastSec0 = 1;
+	pTxD->LastSec1 = 1;
+	pTxD->SDLen0 = SrcBufLen;
+	pTxD->SDLen1 = 0;
+	pTxD->SDPtr0 = SrcBufPA;
+	pTxD->DMADONE = 0;
+
+	pAd->RalinkCounters.KickTxCount++;
+	pAd->RalinkCounters.OneSecTxDoneCount++;
+
+	/* Increase TX_CTX_IDX, but write to register later. */
+	INC_RING_INDEX(pAd->TxRing[QueIdx].TxCpuIdx, TX_RING_SIZE);
+
+	RTMP_IO_WRITE32(pAd, TX_CTX_IDX0 + QueIdx * 0x10,
+			pAd->TxRing[QueIdx].TxCpuIdx);
+
+	/* Make sure to release MGMT ring resource */
+/*      NdisReleaseSpinLock(&pAd->TxRingLock); */
+
+	return NDIS_STATUS_SUCCESS;
+}
+
+int MlmeDataHardTransmit(struct rt_rtmp_adapter *pAd,
+				 u8 QueIdx, void *pPacket)
+{
+	if ((pAd->CommonCfg.RadarDetect.RDMode != RD_NORMAL_MODE)
+	    ) {
+		return NDIS_STATUS_FAILURE;
+	}
+
+	return MlmeHardTransmitTxRing(pAd, QueIdx, pPacket);
+}
+
+/*
+	========================================================================
+
+	Routine Description:
+		Calculates the duration which is required to transmit out frames
+	with given size and specified rate.
+
+	Arguments:
+		pTxD		Pointer to transmit descriptor
+		Ack		Setting for Ack requirement bit
+		Fragment	Setting for Fragment bit
+		RetryMode	Setting for retry mode
+		Ifs		Setting for IFS gap
+		Rate		Setting for transmit rate
+		Service		Setting for service
+		Length		Frame length
+		TxPreamble	Short or Long preamble when using CCK rates
+		QueIdx - 0-3, according to 802.11e/d4.4 June/2003
+
+	Return Value:
+		None
+
+	IRQL = PASSIVE_LEVEL
+	IRQL = DISPATCH_LEVEL
+
+	========================================================================
+*/
+void RTMPWriteTxDescriptor(struct rt_rtmp_adapter *pAd,
+			   struct rt_txd * pTxD,
+			   IN BOOLEAN bWIV, u8 QueueSEL)
+{
+	/* */
+	/* Always use Long preamble before verifiation short preamble functionality works well. */
+	/* Todo: remove the following line if short preamble functionality works */
+	/* */
+	OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_SHORT_PREAMBLE_INUSED);
+
+	pTxD->WIV = (bWIV) ? 1 : 0;
+	pTxD->QSEL = (QueueSEL);
+	/*RT2860c??  fixed using EDCA queue for test...  We doubt Queue1 has problem.  2006-09-26 Jan */
+	/*pTxD->QSEL= FIFO_EDCA; */
+	pTxD->DMADONE = 0;
+}
diff --git a/drivers/staging/rt2860/common/cmm_data_usb.c b/drivers/staging/rt2860/common/cmm_data_usb.c
new file mode 100644
index 000000000000..7c56c2f51987
--- /dev/null
+++ b/drivers/staging/rt2860/common/cmm_data_usb.c
@@ -0,0 +1,951 @@
+/*
+ *************************************************************************
+ * Ralink Tech Inc.
+ * 5F., No.36, Taiyuan St., Jhubei City,
+ * Hsinchu County 302,
+ * Taiwan, R.O.C.
+ *
+ * (c) Copyright 2002-2007, Ralink Technology, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify  *
+ * it under the terms of the GNU General Public License as published by  *
+ * the Free Software Foundation; either version 2 of the License, or     *
+ * (at your option) any later version.                                   *
+ *                                                                       *
+ * This program is distributed in the hope that it will be useful,       *
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
+ * GNU General Public License for more details.                          *
+ *                                                                       *
+ * You should have received a copy of the GNU General Public License     *
+ * along with this program; if not, write to the                         *
+ * Free Software Foundation, Inc.,                                       *
+ * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
+ *                                                                       *
+ *************************************************************************
+*/
+
+/*
+   All functions in this file must be USB-depended, or you should out your function
+	in other files.
+
+*/
+
+#ifdef RTMP_MAC_USB
+
+#include	"../rt_config.h"
+
+/*
+	We can do copy the frame into pTxContext when match following conditions.
+		=>
+		=>
+		=>
+*/
+static inline int RtmpUSBCanDoWrite(struct rt_rtmp_adapter *pAd,
+					    u8 QueIdx,
+					    struct rt_ht_tx_context *pHTTXContext)
+{
+	int canWrite = NDIS_STATUS_RESOURCES;
+
+	if (((pHTTXContext->CurWritePosition) <
+	     pHTTXContext->NextBulkOutPosition)
+	    && (pHTTXContext->CurWritePosition + LOCAL_TXBUF_SIZE) >
+	    pHTTXContext->NextBulkOutPosition) {
+		DBGPRINT(RT_DEBUG_ERROR, ("RtmpUSBCanDoWrite c1!\n"));
+		RTUSB_SET_BULK_FLAG(pAd,
+				    (fRTUSB_BULK_OUT_DATA_NORMAL << QueIdx));
+	} else if ((pHTTXContext->CurWritePosition == 8)
+		   && (pHTTXContext->NextBulkOutPosition < LOCAL_TXBUF_SIZE)) {
+		DBGPRINT(RT_DEBUG_ERROR, ("RtmpUSBCanDoWrite c2!\n"));
+		RTUSB_SET_BULK_FLAG(pAd,
+				    (fRTUSB_BULK_OUT_DATA_NORMAL << QueIdx));
+	} else if (pHTTXContext->bCurWriting == TRUE) {
+		DBGPRINT(RT_DEBUG_ERROR, ("RtmpUSBCanDoWrite c3!\n"));
+	} else {
+		canWrite = NDIS_STATUS_SUCCESS;
+	}
+
+	return canWrite;
+}
+
+u16 RtmpUSB_WriteSubTxResource(struct rt_rtmp_adapter *pAd,
+				  struct rt_tx_blk *pTxBlk,
+				  IN BOOLEAN bIsLast, u16 * FreeNumber)
+{
+
+	/* Dummy function. Should be removed in the future. */
+	return 0;
+
+}
+
+u16 RtmpUSB_WriteFragTxResource(struct rt_rtmp_adapter *pAd,
+				   struct rt_tx_blk *pTxBlk,
+				   u8 fragNum, u16 * FreeNumber)
+{
+	struct rt_ht_tx_context *pHTTXContext;
+	u16 hwHdrLen;	/* The hwHdrLen consist of 802.11 header length plus the header padding length. */
+	u32 fillOffset;
+	struct rt_txinfo *pTxInfo;
+	struct rt_txwi *pTxWI;
+	u8 *pWirelessPacket = NULL;
+	u8 QueIdx;
+	int Status;
+	unsigned long IrqFlags;
+	u32 USBDMApktLen = 0, DMAHdrLen, padding;
+	BOOLEAN TxQLastRound = FALSE;
+
+	/* */
+	/* get Tx Ring Resource & Dma Buffer address */
+	/* */
+	QueIdx = pTxBlk->QueIdx;
+	pHTTXContext = &pAd->TxContext[QueIdx];
+
+	RTMP_IRQ_LOCK(&pAd->TxContextQueueLock[QueIdx], IrqFlags);
+
+	pHTTXContext = &pAd->TxContext[QueIdx];
+	fillOffset = pHTTXContext->CurWritePosition;
+
+	if (fragNum == 0) {
+		/* Check if we have enough space for this bulk-out batch. */
+		Status = RtmpUSBCanDoWrite(pAd, QueIdx, pHTTXContext);
+		if (Status == NDIS_STATUS_SUCCESS) {
+			pHTTXContext->bCurWriting = TRUE;
+
+			/* Reserve space for 8 bytes padding. */
+			if ((pHTTXContext->ENextBulkOutPosition ==
+			     pHTTXContext->CurWritePosition)) {
+				pHTTXContext->ENextBulkOutPosition += 8;
+				pHTTXContext->CurWritePosition += 8;
+				fillOffset += 8;
+			}
+			pTxBlk->Priv = 0;
+			pHTTXContext->CurWriteRealPos =
+			    pHTTXContext->CurWritePosition;
+		} else {
+			RTMP_IRQ_UNLOCK(&pAd->TxContextQueueLock[QueIdx],
+					IrqFlags);
+
+			RELEASE_NDIS_PACKET(pAd, pTxBlk->pPacket,
+					    NDIS_STATUS_FAILURE);
+			return (Status);
+		}
+	} else {
+		/* For sub-sequent frames of this bulk-out batch. Just copy it to our bulk-out buffer. */
+		Status =
+		    ((pHTTXContext->bCurWriting ==
+		      TRUE) ? NDIS_STATUS_SUCCESS : NDIS_STATUS_FAILURE);
+		if (Status == NDIS_STATUS_SUCCESS) {
+			fillOffset += pTxBlk->Priv;
+		} else {
+			RTMP_IRQ_UNLOCK(&pAd->TxContextQueueLock[QueIdx],
+					IrqFlags);
+
+			RELEASE_NDIS_PACKET(pAd, pTxBlk->pPacket,
+					    NDIS_STATUS_FAILURE);
+			return (Status);
+		}
+	}
+
+	NdisZeroMemory((u8 *)(&pTxBlk->HeaderBuf[0]), TXINFO_SIZE);
+	pTxInfo = (struct rt_txinfo *)(&pTxBlk->HeaderBuf[0]);
+	pTxWI = (struct rt_txwi *) (&pTxBlk->HeaderBuf[TXINFO_SIZE]);
+
+	pWirelessPacket =
+	    &pHTTXContext->TransferBuffer->field.WirelessPacket[fillOffset];
+
+	/* copy TXWI + WLAN Header + LLC into DMA Header Buffer */
+	/*hwHdrLen = ROUND_UP(pTxBlk->MpduHeaderLen, 4); */
+	hwHdrLen = pTxBlk->MpduHeaderLen + pTxBlk->HdrPadLen;
+
+	/* Build our URB for USBD */
+	DMAHdrLen = TXWI_SIZE + hwHdrLen;
+	USBDMApktLen = DMAHdrLen + pTxBlk->SrcBufLen;
+	padding = (4 - (USBDMApktLen % 4)) & 0x03;	/* round up to 4 byte alignment */
+	USBDMApktLen += padding;
+
+	pTxBlk->Priv += (TXINFO_SIZE + USBDMApktLen);
+
+	/* For TxInfo, the length of USBDMApktLen = TXWI_SIZE + 802.11 header + payload */
+	RTMPWriteTxInfo(pAd, pTxInfo, (u16)(USBDMApktLen), FALSE, FIFO_EDCA,
+			FALSE /*NextValid */ , FALSE);
+
+	if (fragNum == pTxBlk->TotalFragNum) {
+		pTxInfo->USBDMATxburst = 0;
+		if ((pHTTXContext->CurWritePosition + pTxBlk->Priv + 3906) >
+		    MAX_TXBULK_LIMIT) {
+			pTxInfo->SwUseLastRound = 1;
+			TxQLastRound = TRUE;
+		}
+	} else {
+		pTxInfo->USBDMATxburst = 1;
+	}
+
+	NdisMoveMemory(pWirelessPacket, pTxBlk->HeaderBuf,
+		       TXINFO_SIZE + TXWI_SIZE + hwHdrLen);
+	pWirelessPacket += (TXINFO_SIZE + TXWI_SIZE + hwHdrLen);
+	pHTTXContext->CurWriteRealPos += (TXINFO_SIZE + TXWI_SIZE + hwHdrLen);
+
+	RTMP_IRQ_UNLOCK(&pAd->TxContextQueueLock[QueIdx], IrqFlags);
+
+	NdisMoveMemory(pWirelessPacket, pTxBlk->pSrcBufData, pTxBlk->SrcBufLen);
+
+	/*      Zero the last padding. */
+	pWirelessPacket += pTxBlk->SrcBufLen;
+	NdisZeroMemory(pWirelessPacket, padding + 8);
+
+	if (fragNum == pTxBlk->TotalFragNum) {
+		RTMP_IRQ_LOCK(&pAd->TxContextQueueLock[QueIdx], IrqFlags);
+
+		/* Update the pHTTXContext->CurWritePosition. 3906 used to prevent the NextBulkOut is a A-RALINK/A-MSDU Frame. */
+		pHTTXContext->CurWritePosition += pTxBlk->Priv;
+		if (TxQLastRound == TRUE)
+			pHTTXContext->CurWritePosition = 8;
+		pHTTXContext->CurWriteRealPos = pHTTXContext->CurWritePosition;
+
+		/* Finally, set bCurWriting as FALSE */
+		pHTTXContext->bCurWriting = FALSE;
+
+		RTMP_IRQ_UNLOCK(&pAd->TxContextQueueLock[QueIdx], IrqFlags);
+
+		/* succeed and release the skb buffer */
+		RELEASE_NDIS_PACKET(pAd, pTxBlk->pPacket, NDIS_STATUS_SUCCESS);
+	}
+
+	return (Status);
+
+}
+
+u16 RtmpUSB_WriteSingleTxResource(struct rt_rtmp_adapter *pAd,
+				     struct rt_tx_blk *pTxBlk,
+				     IN BOOLEAN bIsLast,
+				     u16 * FreeNumber)
+{
+	struct rt_ht_tx_context *pHTTXContext;
+	u16 hwHdrLen;
+	u32 fillOffset;
+	struct rt_txinfo *pTxInfo;
+	struct rt_txwi *pTxWI;
+	u8 *pWirelessPacket;
+	u8 QueIdx;
+	unsigned long IrqFlags;
+	int Status;
+	u32 USBDMApktLen = 0, DMAHdrLen, padding;
+	BOOLEAN bTxQLastRound = FALSE;
+
+	/* For USB, didn't need PCI_MAP_SINGLE() */
+	/*SrcBufPA = PCI_MAP_SINGLE(pAd, (char *) pTxBlk->pSrcBufData, pTxBlk->SrcBufLen, PCI_DMA_TODEVICE); */
+
+	/* */
+	/* get Tx Ring Resource & Dma Buffer address */
+	/* */
+	QueIdx = pTxBlk->QueIdx;
+
+	RTMP_IRQ_LOCK(&pAd->TxContextQueueLock[QueIdx], IrqFlags);
+	pHTTXContext = &pAd->TxContext[QueIdx];
+	fillOffset = pHTTXContext->CurWritePosition;
+
+	/* Check ring full. */
+	Status = RtmpUSBCanDoWrite(pAd, QueIdx, pHTTXContext);
+	if (Status == NDIS_STATUS_SUCCESS) {
+		pHTTXContext->bCurWriting = TRUE;
+
+		pTxInfo = (struct rt_txinfo *)(&pTxBlk->HeaderBuf[0]);
+		pTxWI = (struct rt_txwi *) (&pTxBlk->HeaderBuf[TXINFO_SIZE]);
+
+		/* Reserve space for 8 bytes padding. */
+		if ((pHTTXContext->ENextBulkOutPosition ==
+		     pHTTXContext->CurWritePosition)) {
+			pHTTXContext->ENextBulkOutPosition += 8;
+			pHTTXContext->CurWritePosition += 8;
+			fillOffset += 8;
+		}
+		pHTTXContext->CurWriteRealPos = pHTTXContext->CurWritePosition;
+
+		pWirelessPacket =
+		    &pHTTXContext->TransferBuffer->field.
+		    WirelessPacket[fillOffset];
+
+		/* copy TXWI + WLAN Header + LLC into DMA Header Buffer */
+		/*hwHdrLen = ROUND_UP(pTxBlk->MpduHeaderLen, 4); */
+		hwHdrLen = pTxBlk->MpduHeaderLen + pTxBlk->HdrPadLen;
+
+		/* Build our URB for USBD */
+		DMAHdrLen = TXWI_SIZE + hwHdrLen;
+		USBDMApktLen = DMAHdrLen + pTxBlk->SrcBufLen;
+		padding = (4 - (USBDMApktLen % 4)) & 0x03;	/* round up to 4 byte alignment */
+		USBDMApktLen += padding;
+
+		pTxBlk->Priv = (TXINFO_SIZE + USBDMApktLen);
+
+		/* For TxInfo, the length of USBDMApktLen = TXWI_SIZE + 802.11 header + payload */
+		RTMPWriteTxInfo(pAd, pTxInfo, (u16)(USBDMApktLen), FALSE,
+				FIFO_EDCA, FALSE /*NextValid */ , FALSE);
+
+		if ((pHTTXContext->CurWritePosition + 3906 + pTxBlk->Priv) >
+		    MAX_TXBULK_LIMIT) {
+			pTxInfo->SwUseLastRound = 1;
+			bTxQLastRound = TRUE;
+		}
+		NdisMoveMemory(pWirelessPacket, pTxBlk->HeaderBuf,
+			       TXINFO_SIZE + TXWI_SIZE + hwHdrLen);
+		pWirelessPacket += (TXINFO_SIZE + TXWI_SIZE + hwHdrLen);
+
+		/* We unlock it here to prevent the first 8 bytes maybe over-writed issue. */
+		/*      1. First we got CurWritePosition but the first 8 bytes still not write to the pTxcontext. */
+		/*      2. An interrupt break our routine and handle bulk-out complete. */
+		/*      3. In the bulk-out compllete, it need to do another bulk-out, */
+		/*                      if the ENextBulkOutPosition is just the same as CurWritePosition, it will save the first 8 bytes from CurWritePosition, */
+		/*                      but the payload still not copyed. the pTxContext->SavedPad[] will save as allzero. and set the bCopyPad = TRUE. */
+		/*      4. Interrupt complete. */
+		/*  5. Our interrupted routine go back and fill the first 8 bytes to pTxContext. */
+		/*      6. Next time when do bulk-out, it found the bCopyPad==TRUE and will copy the SavedPad[] to pTxContext->NextBulkOutPosition. */
+		/*              and the packet will wrong. */
+		pHTTXContext->CurWriteRealPos +=
+		    (TXINFO_SIZE + TXWI_SIZE + hwHdrLen);
+		RTMP_IRQ_UNLOCK(&pAd->TxContextQueueLock[QueIdx], IrqFlags);
+
+		NdisMoveMemory(pWirelessPacket, pTxBlk->pSrcBufData,
+			       pTxBlk->SrcBufLen);
+		pWirelessPacket += pTxBlk->SrcBufLen;
+		NdisZeroMemory(pWirelessPacket, padding + 8);
+
+		RTMP_IRQ_LOCK(&pAd->TxContextQueueLock[QueIdx], IrqFlags);
+
+		pHTTXContext->CurWritePosition += pTxBlk->Priv;
+		if (bTxQLastRound)
+			pHTTXContext->CurWritePosition = 8;
+		pHTTXContext->CurWriteRealPos = pHTTXContext->CurWritePosition;
+
+		pHTTXContext->bCurWriting = FALSE;
+	}
+
+	RTMP_IRQ_UNLOCK(&pAd->TxContextQueueLock[QueIdx], IrqFlags);
+
+	/* succeed and release the skb buffer */
+	RELEASE_NDIS_PACKET(pAd, pTxBlk->pPacket, NDIS_STATUS_SUCCESS);
+
+	return (Status);
+
+}
+
+u16 RtmpUSB_WriteMultiTxResource(struct rt_rtmp_adapter *pAd,
+				    struct rt_tx_blk *pTxBlk,
+				    u8 frameNum, u16 * FreeNumber)
+{
+	struct rt_ht_tx_context *pHTTXContext;
+	u16 hwHdrLen;	/* The hwHdrLen consist of 802.11 header length plus the header padding length. */
+	u32 fillOffset;
+	struct rt_txinfo *pTxInfo;
+	struct rt_txwi *pTxWI;
+	u8 *pWirelessPacket = NULL;
+	u8 QueIdx;
+	int Status;
+	unsigned long IrqFlags;
+	/*u32                        USBDMApktLen = 0, DMAHdrLen, padding; */
+
+	/* */
+	/* get Tx Ring Resource & Dma Buffer address */
+	/* */
+	QueIdx = pTxBlk->QueIdx;
+	pHTTXContext = &pAd->TxContext[QueIdx];
+
+	RTMP_IRQ_LOCK(&pAd->TxContextQueueLock[QueIdx], IrqFlags);
+
+	if (frameNum == 0) {
+		/* Check if we have enough space for this bulk-out batch. */
+		Status = RtmpUSBCanDoWrite(pAd, QueIdx, pHTTXContext);
+		if (Status == NDIS_STATUS_SUCCESS) {
+			pHTTXContext->bCurWriting = TRUE;
+
+			pTxInfo = (struct rt_txinfo *)(&pTxBlk->HeaderBuf[0]);
+			pTxWI = (struct rt_txwi *) (&pTxBlk->HeaderBuf[TXINFO_SIZE]);
+
+			/* Reserve space for 8 bytes padding. */
+			if ((pHTTXContext->ENextBulkOutPosition ==
+			     pHTTXContext->CurWritePosition)) {
+
+				pHTTXContext->CurWritePosition += 8;
+				pHTTXContext->ENextBulkOutPosition += 8;
+			}
+			fillOffset = pHTTXContext->CurWritePosition;
+			pHTTXContext->CurWriteRealPos =
+			    pHTTXContext->CurWritePosition;
+
+			pWirelessPacket =
+			    &pHTTXContext->TransferBuffer->field.
+			    WirelessPacket[fillOffset];
+
+			/* */
+			/* Copy TXINFO + TXWI + WLAN Header + LLC into DMA Header Buffer */
+			/* */
+			if (pTxBlk->TxFrameType == TX_AMSDU_FRAME)
+				/*hwHdrLen = ROUND_UP(pTxBlk->MpduHeaderLen-LENGTH_AMSDU_SUBFRAMEHEAD, 4)+LENGTH_AMSDU_SUBFRAMEHEAD; */
+				hwHdrLen =
+				    pTxBlk->MpduHeaderLen -
+				    LENGTH_AMSDU_SUBFRAMEHEAD +
+				    pTxBlk->HdrPadLen +
+				    LENGTH_AMSDU_SUBFRAMEHEAD;
+			else if (pTxBlk->TxFrameType == TX_RALINK_FRAME)
+				/*hwHdrLen = ROUND_UP(pTxBlk->MpduHeaderLen-LENGTH_ARALINK_HEADER_FIELD, 4)+LENGTH_ARALINK_HEADER_FIELD; */
+				hwHdrLen =
+				    pTxBlk->MpduHeaderLen -
+				    LENGTH_ARALINK_HEADER_FIELD +
+				    pTxBlk->HdrPadLen +
+				    LENGTH_ARALINK_HEADER_FIELD;
+			else
+				/*hwHdrLen = ROUND_UP(pTxBlk->MpduHeaderLen, 4); */
+				hwHdrLen =
+				    pTxBlk->MpduHeaderLen + pTxBlk->HdrPadLen;
+
+			/* Update the pTxBlk->Priv. */
+			pTxBlk->Priv = TXINFO_SIZE + TXWI_SIZE + hwHdrLen;
+
+			/*      pTxInfo->USBDMApktLen now just a temp value and will to correct latter. */
+			RTMPWriteTxInfo(pAd, pTxInfo, (u16)(pTxBlk->Priv),
+					FALSE, FIFO_EDCA, FALSE /*NextValid */ ,
+					FALSE);
+
+			/* Copy it. */
+			NdisMoveMemory(pWirelessPacket, pTxBlk->HeaderBuf,
+				       pTxBlk->Priv);
+			pHTTXContext->CurWriteRealPos += pTxBlk->Priv;
+			pWirelessPacket += pTxBlk->Priv;
+		}
+	} else {		/* For sub-sequent frames of this bulk-out batch. Just copy it to our bulk-out buffer. */
+
+		Status =
+		    ((pHTTXContext->bCurWriting ==
+		      TRUE) ? NDIS_STATUS_SUCCESS : NDIS_STATUS_FAILURE);
+		if (Status == NDIS_STATUS_SUCCESS) {
+			fillOffset =
+			    (pHTTXContext->CurWritePosition + pTxBlk->Priv);
+			pWirelessPacket =
+			    &pHTTXContext->TransferBuffer->field.
+			    WirelessPacket[fillOffset];
+
+			/*hwHdrLen = pTxBlk->MpduHeaderLen; */
+			NdisMoveMemory(pWirelessPacket, pTxBlk->HeaderBuf,
+				       pTxBlk->MpduHeaderLen);
+			pWirelessPacket += (pTxBlk->MpduHeaderLen);
+			pTxBlk->Priv += pTxBlk->MpduHeaderLen;
+		} else {	/* It should not happened now unless we are going to shutdown. */
+			DBGPRINT(RT_DEBUG_ERROR,
+				 ("WriteMultiTxResource():bCurWriting is FALSE when handle sub-sequent frames.\n"));
+			Status = NDIS_STATUS_FAILURE;
+		}
+	}
+
+	/* We unlock it here to prevent the first 8 bytes maybe over-write issue. */
+	/*      1. First we got CurWritePosition but the first 8 bytes still not write to the pTxContext. */
+	/*      2. An interrupt break our routine and handle bulk-out complete. */
+	/*      3. In the bulk-out compllete, it need to do another bulk-out, */
+	/*                      if the ENextBulkOutPosition is just the same as CurWritePosition, it will save the first 8 bytes from CurWritePosition, */
+	/*                      but the payload still not copyed. the pTxContext->SavedPad[] will save as allzero. and set the bCopyPad = TRUE. */
+	/*      4. Interrupt complete. */
+	/*  5. Our interrupted routine go back and fill the first 8 bytes to pTxContext. */
+	/*      6. Next time when do bulk-out, it found the bCopyPad==TRUE and will copy the SavedPad[] to pTxContext->NextBulkOutPosition. */
+	/*              and the packet will wrong. */
+	RTMP_IRQ_UNLOCK(&pAd->TxContextQueueLock[QueIdx], IrqFlags);
+
+	if (Status != NDIS_STATUS_SUCCESS) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("WriteMultiTxResource: CWPos = %ld, NBOutPos = %ld.\n",
+			  pHTTXContext->CurWritePosition,
+			  pHTTXContext->NextBulkOutPosition));
+		goto done;
+	}
+	/* Copy the frame content into DMA buffer and update the pTxBlk->Priv */
+	NdisMoveMemory(pWirelessPacket, pTxBlk->pSrcBufData, pTxBlk->SrcBufLen);
+	pWirelessPacket += pTxBlk->SrcBufLen;
+	pTxBlk->Priv += pTxBlk->SrcBufLen;
+
+done:
+	/* Release the skb buffer here */
+	RELEASE_NDIS_PACKET(pAd, pTxBlk->pPacket, NDIS_STATUS_SUCCESS);
+
+	return (Status);
+
+}
+
+void RtmpUSB_FinalWriteTxResource(struct rt_rtmp_adapter *pAd,
+				  struct rt_tx_blk *pTxBlk,
+				  u16 totalMPDUSize, u16 TxIdx)
+{
+	u8 QueIdx;
+	struct rt_ht_tx_context *pHTTXContext;
+	u32 fillOffset;
+	struct rt_txinfo *pTxInfo;
+	struct rt_txwi *pTxWI;
+	u32 USBDMApktLen, padding;
+	unsigned long IrqFlags;
+	u8 *pWirelessPacket;
+
+	QueIdx = pTxBlk->QueIdx;
+	pHTTXContext = &pAd->TxContext[QueIdx];
+
+	RTMP_IRQ_LOCK(&pAd->TxContextQueueLock[QueIdx], IrqFlags);
+
+	if (pHTTXContext->bCurWriting == TRUE) {
+		fillOffset = pHTTXContext->CurWritePosition;
+		if (((pHTTXContext->ENextBulkOutPosition ==
+		      pHTTXContext->CurWritePosition)
+		     || ((pHTTXContext->ENextBulkOutPosition - 8) ==
+			 pHTTXContext->CurWritePosition))
+		    && (pHTTXContext->bCopySavePad == TRUE))
+			pWirelessPacket = (u8 *)(&pHTTXContext->SavedPad[0]);
+		else
+			pWirelessPacket =
+			    (u8 *)(&pHTTXContext->TransferBuffer->field.
+				      WirelessPacket[fillOffset]);
+
+		/* */
+		/* Update TxInfo->USBDMApktLen , */
+		/*              the length = TXWI_SIZE + 802.11_hdr + 802.11_hdr_pad + payload_of_all_batch_frames + Bulk-Out-padding */
+		/* */
+		pTxInfo = (struct rt_txinfo *)(pWirelessPacket);
+
+		/* Calculate the bulk-out padding */
+		USBDMApktLen = pTxBlk->Priv - TXINFO_SIZE;
+		padding = (4 - (USBDMApktLen % 4)) & 0x03;	/* round up to 4 byte alignment */
+		USBDMApktLen += padding;
+
+		pTxInfo->USBDMATxPktLen = USBDMApktLen;
+
+		/* */
+		/* Update TXWI->MPDUtotalByteCount , */
+		/*              the length = 802.11 header + payload_of_all_batch_frames */
+		pTxWI = (struct rt_txwi *) (pWirelessPacket + TXINFO_SIZE);
+		pTxWI->MPDUtotalByteCount = totalMPDUSize;
+
+		/* */
+		/* Update the pHTTXContext->CurWritePosition */
+		/* */
+		pHTTXContext->CurWritePosition += (TXINFO_SIZE + USBDMApktLen);
+		if ((pHTTXContext->CurWritePosition + 3906) > MAX_TXBULK_LIMIT) {	/* Add 3906 for prevent the NextBulkOut packet size is a A-RALINK/A-MSDU Frame. */
+			pHTTXContext->CurWritePosition = 8;
+			pTxInfo->SwUseLastRound = 1;
+		}
+		pHTTXContext->CurWriteRealPos = pHTTXContext->CurWritePosition;
+
+		/* */
+		/*      Zero the last padding. */
+		/* */
+		pWirelessPacket =
+		    (&pHTTXContext->TransferBuffer->field.
+		     WirelessPacket[fillOffset + pTxBlk->Priv]);
+		NdisZeroMemory(pWirelessPacket, padding + 8);
+
+		/* Finally, set bCurWriting as FALSE */
+		pHTTXContext->bCurWriting = FALSE;
+
+	} else {		/* It should not happened now unless we are going to shutdown. */
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("FinalWriteTxResource():bCurWriting is FALSE when handle last frames.\n"));
+	}
+
+	RTMP_IRQ_UNLOCK(&pAd->TxContextQueueLock[QueIdx], IrqFlags);
+
+}
+
+void RtmpUSBDataLastTxIdx(struct rt_rtmp_adapter *pAd,
+			  u8 QueIdx, u16 TxIdx)
+{
+	/* DO nothing for USB. */
+}
+
+/*
+	When can do bulk-out:
+		1. TxSwFreeIdx < TX_RING_SIZE;
+			It means has at least one Ring entity is ready for bulk-out, kick it out.
+		2. If TxSwFreeIdx == TX_RING_SIZE
+			Check if the CurWriting flag is FALSE, if it's FALSE, we can do kick out.
+
+*/
+void RtmpUSBDataKickOut(struct rt_rtmp_adapter *pAd,
+			struct rt_tx_blk *pTxBlk, u8 QueIdx)
+{
+	RTUSB_SET_BULK_FLAG(pAd, (fRTUSB_BULK_OUT_DATA_NORMAL << QueIdx));
+	RTUSBKickBulkOut(pAd);
+
+}
+
+/*
+	Must be run in Interrupt context
+	This function handle RT2870 specific TxDesc and cpu index update and kick the packet out.
+ */
+int RtmpUSBMgmtKickOut(struct rt_rtmp_adapter *pAd,
+		       u8 QueIdx,
+		       void *pPacket,
+		       u8 *pSrcBufVA, u32 SrcBufLen)
+{
+	struct rt_txinfo *pTxInfo;
+	unsigned long BulkOutSize;
+	u8 padLen;
+	u8 *pDest;
+	unsigned long SwIdx = pAd->MgmtRing.TxCpuIdx;
+	struct rt_tx_context *pMLMEContext =
+	    (struct rt_tx_context *)pAd->MgmtRing.Cell[SwIdx].AllocVa;
+	unsigned long IrqFlags;
+
+	pTxInfo = (struct rt_txinfo *)(pSrcBufVA);
+
+	/* Build our URB for USBD */
+	BulkOutSize = SrcBufLen;
+	BulkOutSize = (BulkOutSize + 3) & (~3);
+	RTMPWriteTxInfo(pAd, pTxInfo, (u16)(BulkOutSize - TXINFO_SIZE),
+			TRUE, EpToQueue[MGMTPIPEIDX], FALSE, FALSE);
+
+	BulkOutSize += 4;	/* Always add 4 extra bytes at every packet. */
+
+	/* If BulkOutSize is multiple of BulkOutMaxPacketSize, add extra 4 bytes again. */
+	if ((BulkOutSize % pAd->BulkOutMaxPacketSize) == 0)
+		BulkOutSize += 4;
+
+	padLen = BulkOutSize - SrcBufLen;
+	ASSERT((padLen <= RTMP_PKT_TAIL_PADDING));
+
+	/* Now memzero all extra padding bytes. */
+	pDest = (u8 *)(pSrcBufVA + SrcBufLen);
+	skb_put(GET_OS_PKT_TYPE(pPacket), padLen);
+	NdisZeroMemory(pDest, padLen);
+
+	RTMP_IRQ_LOCK(&pAd->MLMEBulkOutLock, IrqFlags);
+
+	pAd->MgmtRing.Cell[pAd->MgmtRing.TxCpuIdx].pNdisPacket = pPacket;
+	pMLMEContext->TransferBuffer =
+	    (struct rt_tx_buffer *)(GET_OS_PKT_DATAPTR(pPacket));
+
+	/* Length in TxInfo should be 8 less than bulkout size. */
+	pMLMEContext->BulkOutSize = BulkOutSize;
+	pMLMEContext->InUse = TRUE;
+	pMLMEContext->bWaitingBulkOut = TRUE;
+
+	/*for debug */
+	/*hex_dump("RtmpUSBMgmtKickOut", &pMLMEContext->TransferBuffer->field.WirelessPacket[0], (pMLMEContext->BulkOutSize > 16 ? 16 : pMLMEContext->BulkOutSize)); */
+
+	/*pAd->RalinkCounters.KickTxCount++; */
+	/*pAd->RalinkCounters.OneSecTxDoneCount++; */
+
+	/*if (pAd->MgmtRing.TxSwFreeIdx == MGMT_RING_SIZE) */
+	/*      needKickOut = TRUE; */
+
+	/* Decrease the TxSwFreeIdx and Increase the TX_CTX_IDX */
+	pAd->MgmtRing.TxSwFreeIdx--;
+	INC_RING_INDEX(pAd->MgmtRing.TxCpuIdx, MGMT_RING_SIZE);
+
+	RTMP_IRQ_UNLOCK(&pAd->MLMEBulkOutLock, IrqFlags);
+
+	RTUSB_SET_BULK_FLAG(pAd, fRTUSB_BULK_OUT_MLME);
+	/*if (needKickOut) */
+	RTUSBKickBulkOut(pAd);
+
+	return 0;
+}
+
+void RtmpUSBNullFrameKickOut(struct rt_rtmp_adapter *pAd,
+			     u8 QueIdx,
+			     u8 * pNullFrame, u32 frameLen)
+{
+	if (pAd->NullContext.InUse == FALSE) {
+		struct rt_tx_context *pNullContext;
+		struct rt_txinfo *pTxInfo;
+		struct rt_txwi * pTxWI;
+		u8 *pWirelessPkt;
+
+		pNullContext = &(pAd->NullContext);
+
+		/* Set the in use bit */
+		pNullContext->InUse = TRUE;
+		pWirelessPkt =
+		    (u8 *)& pNullContext->TransferBuffer->field.
+		    WirelessPacket[0];
+
+		RTMPZeroMemory(&pWirelessPkt[0], 100);
+		pTxInfo = (struct rt_txinfo *)& pWirelessPkt[0];
+		RTMPWriteTxInfo(pAd, pTxInfo,
+				(u16)(sizeof(struct rt_header_802_11) + TXWI_SIZE),
+				TRUE, EpToQueue[MGMTPIPEIDX], FALSE, FALSE);
+		pTxInfo->QSEL = FIFO_EDCA;
+		pTxWI = (struct rt_txwi *) & pWirelessPkt[TXINFO_SIZE];
+		RTMPWriteTxWI(pAd, pTxWI, FALSE, FALSE, FALSE, FALSE, TRUE,
+			      FALSE, 0, BSSID_WCID, (sizeof(struct rt_header_802_11)), 0,
+			      0, (u8)pAd->CommonCfg.MlmeTransmit.field.MCS,
+			      IFS_HTTXOP, FALSE, &pAd->CommonCfg.MlmeTransmit);
+
+		RTMPMoveMemory(&pWirelessPkt[TXWI_SIZE + TXINFO_SIZE],
+			       &pAd->NullFrame, sizeof(struct rt_header_802_11));
+		pAd->NullContext.BulkOutSize =
+		    TXINFO_SIZE + TXWI_SIZE + sizeof(pAd->NullFrame) + 4;
+
+		/* Fill out frame length information for global Bulk out arbitor */
+		/*pNullContext->BulkOutSize = TransferBufferLength; */
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("SYNC - send NULL Frame @%d Mbps...\n",
+			  RateIdToMbps[pAd->CommonCfg.TxRate]));
+		RTUSB_SET_BULK_FLAG(pAd, fRTUSB_BULK_OUT_DATA_NULL);
+
+		/* Kick bulk out */
+		RTUSBKickBulkOut(pAd);
+	}
+
+}
+
+/*
+========================================================================
+Routine Description:
+    Get a received packet.
+
+Arguments:
+	pAd					device control block
+	pSaveRxD			receive descriptor information
+	*pbReschedule		need reschedule flag
+	*pRxPending			pending received packet flag
+
+Return Value:
+    the recieved packet
+
+Note:
+========================================================================
+*/
+void *GetPacketFromRxRing(struct rt_rtmp_adapter *pAd,
+				 OUT PRT28XX_RXD_STRUC pSaveRxD,
+				 OUT BOOLEAN * pbReschedule,
+				 IN u32 * pRxPending)
+{
+	struct rt_rx_context *pRxContext;
+	void *pSkb;
+	u8 *pData;
+	unsigned long ThisFrameLen;
+	unsigned long RxBufferLength;
+	struct rt_rxwi * pRxWI;
+
+	pRxContext = &pAd->RxContext[pAd->NextRxBulkInReadIndex];
+	if ((pRxContext->Readable == FALSE) || (pRxContext->InUse == TRUE))
+		return NULL;
+
+	RxBufferLength = pRxContext->BulkInOffset - pAd->ReadPosition;
+	if (RxBufferLength <
+	    (RT2870_RXDMALEN_FIELD_SIZE + sizeof(struct rt_rxwi) +
+	     sizeof(struct rt_rxinfo))) {
+		goto label_null;
+	}
+
+	pData = &pRxContext->TransferBuffer[pAd->ReadPosition];	/* 4KB */
+	/* The RXDMA field is 4 bytes, now just use the first 2 bytes. The Length including the (RXWI + MSDU + Padding) */
+	ThisFrameLen = *pData + (*(pData + 1) << 8);
+	if (ThisFrameLen == 0) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("BIRIdx(%d): RXDMALen is zero.[%ld], BulkInBufLen = %ld)\n",
+			  pAd->NextRxBulkInReadIndex, ThisFrameLen,
+			  pRxContext->BulkInOffset));
+		goto label_null;
+	}
+	if ((ThisFrameLen & 0x3) != 0) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("BIRIdx(%d): RXDMALen not multiple of 4.[%ld], BulkInBufLen = %ld)\n",
+			  pAd->NextRxBulkInReadIndex, ThisFrameLen,
+			  pRxContext->BulkInOffset));
+		goto label_null;
+	}
+
+	if ((ThisFrameLen + 8) > RxBufferLength)	/* 8 for (RT2870_RXDMALEN_FIELD_SIZE + sizeof(struct rt_rxinfo)) */
+	{
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("BIRIdx(%d):FrameLen(0x%lx) outranges. BulkInLen=0x%lx, remaining RxBufLen=0x%lx, ReadPos=0x%lx\n",
+			  pAd->NextRxBulkInReadIndex, ThisFrameLen,
+			  pRxContext->BulkInOffset, RxBufferLength,
+			  pAd->ReadPosition));
+
+		/* error frame. finish this loop */
+		goto label_null;
+	}
+	/* skip USB frame length field */
+	pData += RT2870_RXDMALEN_FIELD_SIZE;
+	pRxWI = (struct rt_rxwi *) pData;
+	if (pRxWI->MPDUtotalByteCount > ThisFrameLen) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("%s():pRxWIMPDUtotalByteCount(%d) large than RxDMALen(%ld)\n",
+			  __FUNCTION__, pRxWI->MPDUtotalByteCount,
+			  ThisFrameLen));
+		goto label_null;
+	}
+	/* allocate a rx packet */
+	pSkb = dev_alloc_skb(ThisFrameLen);
+	if (pSkb == NULL) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("%s():Cannot Allocate sk buffer for this Bulk-In buffer!\n",
+			  __FUNCTION__));
+		goto label_null;
+	}
+	/* copy the rx packet */
+	memcpy(skb_put(pSkb, ThisFrameLen), pData, ThisFrameLen);
+	RTPKT_TO_OSPKT(pSkb)->dev = get_netdev_from_bssid(pAd, BSS0);
+	RTMP_SET_PACKET_SOURCE(OSPKT_TO_RTPKT(pSkb), PKTSRC_NDIS);
+
+	/* copy RxD */
+	*pSaveRxD = *(struct rt_rxinfo *) (pData + ThisFrameLen);
+
+	/* update next packet read position. */
+	pAd->ReadPosition += (ThisFrameLen + RT2870_RXDMALEN_FIELD_SIZE + RXINFO_SIZE);	/* 8 for (RT2870_RXDMALEN_FIELD_SIZE + sizeof(struct rt_rxinfo)) */
+
+	return pSkb;
+
+label_null:
+
+	return NULL;
+}
+
+/*
+	========================================================================
+
+	Routine	Description:
+		Check Rx descriptor, return NDIS_STATUS_FAILURE if any error dound
+
+	Arguments:
+		pRxD		Pointer	to the Rx descriptor
+
+	Return Value:
+		NDIS_STATUS_SUCCESS		No err
+		NDIS_STATUS_FAILURE		Error
+
+	Note:
+
+	========================================================================
+*/
+int RTMPCheckRxError(struct rt_rtmp_adapter *pAd,
+			     struct rt_header_802_11 * pHeader,
+			     struct rt_rxwi * pRxWI, IN PRT28XX_RXD_STRUC pRxINFO)
+{
+	struct rt_cipher_key *pWpaKey;
+	int dBm;
+
+	if (pAd->bPromiscuous == TRUE)
+		return (NDIS_STATUS_SUCCESS);
+	if (pRxINFO == NULL)
+		return (NDIS_STATUS_FAILURE);
+
+	/* Phy errors & CRC errors */
+	if (pRxINFO->Crc) {
+		/* Check RSSI for Noise Hist statistic collection. */
+		dBm = (int)(pRxWI->RSSI0) - pAd->BbpRssiToDbmDelta;
+		if (dBm <= -87)
+			pAd->StaCfg.RPIDensity[0] += 1;
+		else if (dBm <= -82)
+			pAd->StaCfg.RPIDensity[1] += 1;
+		else if (dBm <= -77)
+			pAd->StaCfg.RPIDensity[2] += 1;
+		else if (dBm <= -72)
+			pAd->StaCfg.RPIDensity[3] += 1;
+		else if (dBm <= -67)
+			pAd->StaCfg.RPIDensity[4] += 1;
+		else if (dBm <= -62)
+			pAd->StaCfg.RPIDensity[5] += 1;
+		else if (dBm <= -57)
+			pAd->StaCfg.RPIDensity[6] += 1;
+		else if (dBm > -57)
+			pAd->StaCfg.RPIDensity[7] += 1;
+
+		return (NDIS_STATUS_FAILURE);
+	}
+	/* Add Rx size to channel load counter, we should ignore error counts */
+	pAd->StaCfg.CLBusyBytes += (pRxWI->MPDUtotalByteCount + 14);
+
+	/* Drop ToDs promiscous frame, it is opened due to CCX 2 channel load statistics */
+	if (pHeader->FC.ToDs) {
+		DBGPRINT_RAW(RT_DEBUG_ERROR, ("Err;FC.ToDs\n"));
+		return NDIS_STATUS_FAILURE;
+	}
+	/* Paul 04-03 for OFDM Rx length issue */
+	if (pRxWI->MPDUtotalByteCount > MAX_AGGREGATION_SIZE) {
+		DBGPRINT_RAW(RT_DEBUG_ERROR, ("received packet too long\n"));
+		return NDIS_STATUS_FAILURE;
+	}
+	/* Drop not U2M frames, cant's drop here because we will drop beacon in this case */
+	/* I am kind of doubting the U2M bit operation */
+	/* if (pRxD->U2M == 0) */
+	/*      return(NDIS_STATUS_FAILURE); */
+
+	/* drop decyption fail frame */
+	if (pRxINFO->Decrypted && pRxINFO->CipherErr) {
+
+		if (((pRxINFO->CipherErr & 1) == 1)
+		    && pAd->CommonCfg.bWirelessEvent && INFRA_ON(pAd))
+			RTMPSendWirelessEvent(pAd, IW_ICV_ERROR_EVENT_FLAG,
+					      pAd->MacTab.Content[BSSID_WCID].
+					      Addr, BSS0, 0);
+
+		if (((pRxINFO->CipherErr & 2) == 2)
+		    && pAd->CommonCfg.bWirelessEvent && INFRA_ON(pAd))
+			RTMPSendWirelessEvent(pAd, IW_MIC_ERROR_EVENT_FLAG,
+					      pAd->MacTab.Content[BSSID_WCID].
+					      Addr, BSS0, 0);
+		/* */
+		/* MIC Error */
+		/* */
+		if ((pRxINFO->CipherErr == 2) && pRxINFO->MyBss) {
+			pWpaKey = &pAd->SharedKey[BSS0][pRxWI->KeyIndex];
+			RTMPReportMicError(pAd, pWpaKey);
+			DBGPRINT_RAW(RT_DEBUG_ERROR, ("Rx MIC Value error\n"));
+		}
+
+		if (pRxINFO->Decrypted &&
+		    (pAd->SharedKey[BSS0][pRxWI->KeyIndex].CipherAlg ==
+		     CIPHER_AES)
+		    && (pHeader->Sequence == pAd->FragFrame.Sequence)) {
+			/* */
+			/* Acceptable since the First FragFrame no CipherErr problem. */
+			/* */
+			return (NDIS_STATUS_SUCCESS);
+		}
+
+		return (NDIS_STATUS_FAILURE);
+	}
+
+	return (NDIS_STATUS_SUCCESS);
+}
+
+void RtmpUsbStaAsicForceWakeupTimeout(void *SystemSpecific1,
+				      void *FunctionContext,
+				      void *SystemSpecific2,
+				      void *SystemSpecific3)
+{
+	struct rt_rtmp_adapter *pAd = (struct rt_rtmp_adapter *)FunctionContext;
+
+	if (pAd && pAd->Mlme.AutoWakeupTimerRunning) {
+		AsicSendCommandToMcu(pAd, 0x31, 0xff, 0x00, 0x02);
+
+		OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_DOZE);
+		pAd->Mlme.AutoWakeupTimerRunning = FALSE;
+	}
+}
+
+void RT28xxUsbStaAsicForceWakeup(struct rt_rtmp_adapter *pAd, IN BOOLEAN bFromTx)
+{
+	BOOLEAN Canceled;
+
+	if (pAd->Mlme.AutoWakeupTimerRunning)
+		RTMPCancelTimer(&pAd->Mlme.AutoWakeupTimer, &Canceled);
+
+	AsicSendCommandToMcu(pAd, 0x31, 0xff, 0x00, 0x02);
+
+	OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_DOZE);
+}
+
+void RT28xxUsbStaAsicSleepThenAutoWakeup(struct rt_rtmp_adapter *pAd,
+					 u16 TbttNumToNextWakeUp)
+{
+
+	/* we have decided to SLEEP, so at least do it for a BEACON period. */
+	if (TbttNumToNextWakeUp == 0)
+		TbttNumToNextWakeUp = 1;
+
+	RTMPSetTimer(&pAd->Mlme.AutoWakeupTimer, AUTO_WAKEUP_TIMEOUT);
+	pAd->Mlme.AutoWakeupTimerRunning = TRUE;
+
+	AsicSendCommandToMcu(pAd, 0x30, 0xff, 0xff, 0x02);	/* send POWER-SAVE command to MCU. Timeout 40us. */
+
+	OPSTATUS_SET_FLAG(pAd, fOP_STATUS_DOZE);
+
+}
+
+#endif /* RTMP_MAC_USB // */
diff --git a/drivers/staging/rt2860/common/cmm_info.c b/drivers/staging/rt2860/common/cmm_info.c
index 019cc4474ce8..25302e8363b9 100644
--- a/drivers/staging/rt2860/common/cmm_info.c
+++ b/drivers/staging/rt2860/common/cmm_info.c
@@ -23,826 +23,11 @@
  * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
  *                                                                       *
  *************************************************************************
-*/
+ */
 
 #include <linux/sched.h>
 #include "../rt_config.h"
 
-INT	Show_SSID_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf);
-
-INT	Show_WirelessMode_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf);
-
-INT	Show_TxBurst_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf);
-
-INT	Show_TxPreamble_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf);
-
-INT	Show_TxPower_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf);
-
-INT	Show_Channel_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf);
-
-INT	Show_BGProtection_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf);
-
-INT	Show_RTSThreshold_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf);
-
-INT	Show_FragThreshold_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf);
-
-INT	Show_HtBw_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf);
-
-INT	Show_HtMcs_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf);
-
-INT	Show_HtGi_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf);
-
-INT	Show_HtOpMode_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf);
-
-INT	Show_HtExtcha_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf);
-
-INT	Show_HtMpduDensity_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf);
-
-INT	Show_HtBaWinSize_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf);
-
-INT	Show_HtRdg_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf);
-
-INT	Show_HtAmsdu_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf);
-
-INT	Show_HtAutoBa_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf);
-
-INT	Show_CountryRegion_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf);
-
-INT	Show_CountryRegionABand_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf);
-
-INT	Show_CountryCode_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf);
-
-#ifdef AGGREGATION_SUPPORT
-INT	Show_PktAggregate_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf);
-#endif // AGGREGATION_SUPPORT //
-
-#ifdef WMM_SUPPORT
-INT	Show_WmmCapable_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf);
-#endif // WMM_SUPPORT //
-
-INT	Show_IEEE80211H_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf);
-
-INT	Show_NetworkType_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf);
-
-INT	Show_AuthMode_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf);
-
-INT	Show_EncrypType_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf);
-
-INT	Show_DefaultKeyID_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf);
-
-INT	Show_Key1_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf);
-
-INT	Show_Key2_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf);
-
-INT	Show_Key3_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf);
-
-INT	Show_Key4_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf);
-
-INT	Show_WPAPSK_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf);
-
-static struct {
-	CHAR *name;
-	INT (*show_proc)(PRTMP_ADAPTER pAdapter, PUCHAR arg);
-} *PRTMP_PRIVATE_STA_SHOW_CFG_VALUE_PROC, RTMP_PRIVATE_STA_SHOW_CFG_VALUE_PROC[] = {
-	{"SSID",					Show_SSID_Proc},
-	{"WirelessMode",			Show_WirelessMode_Proc},
-	{"TxBurst",					Show_TxBurst_Proc},
-	{"TxPreamble",				Show_TxPreamble_Proc},
-	{"TxPower",					Show_TxPower_Proc},
-	{"Channel",					Show_Channel_Proc},
-	{"BGProtection",			Show_BGProtection_Proc},
-	{"RTSThreshold",			Show_RTSThreshold_Proc},
-	{"FragThreshold",			Show_FragThreshold_Proc},
-	{"HtBw",					Show_HtBw_Proc},
-	{"HtMcs",					Show_HtMcs_Proc},
-	{"HtGi",					Show_HtGi_Proc},
-	{"HtOpMode",				Show_HtOpMode_Proc},
-	{"HtExtcha",				Show_HtExtcha_Proc},
-	{"HtMpduDensity",			Show_HtMpduDensity_Proc},
-	{"HtBaWinSize",		        Show_HtBaWinSize_Proc},
-	{"HtRdg",		        	Show_HtRdg_Proc},
-	{"HtAmsdu",		        	Show_HtAmsdu_Proc},
-	{"HtAutoBa",		        Show_HtAutoBa_Proc},
-	{"CountryRegion",			Show_CountryRegion_Proc},
-	{"CountryRegionABand",		Show_CountryRegionABand_Proc},
-	{"CountryCode",				Show_CountryCode_Proc},
-#ifdef AGGREGATION_SUPPORT
-	{"PktAggregate",			Show_PktAggregate_Proc},
-#endif
-
-#ifdef WMM_SUPPORT
-	{"WmmCapable",				Show_WmmCapable_Proc},
-#endif
-	{"IEEE80211H",				Show_IEEE80211H_Proc},
-    {"NetworkType",				Show_NetworkType_Proc},
-	{"AuthMode",				Show_AuthMode_Proc},
-	{"EncrypType",				Show_EncrypType_Proc},
-	{"DefaultKeyID",			Show_DefaultKeyID_Proc},
-	{"Key1",					Show_Key1_Proc},
-	{"Key2",					Show_Key2_Proc},
-	{"Key3",					Show_Key3_Proc},
-	{"Key4",					Show_Key4_Proc},
-	{"WPAPSK",					Show_WPAPSK_Proc},
-	{NULL, NULL}
-};
-
-/*
-    ==========================================================================
-    Description:
-        Get Driver version.
-
-    Return:
-    ==========================================================================
-*/
-INT Set_DriverVersion_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
-	DBGPRINT(RT_DEBUG_TRACE, ("Driver version-%s\n", STA_DRIVER_VERSION));
-
-    return TRUE;
-}
-
-/*
-    ==========================================================================
-    Description:
-        Set Country Region.
-        This command will not work, if the field of CountryRegion in eeprom is programmed.
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT Set_CountryRegion_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
-	ULONG region;
-
-	region = simple_strtol(arg, 0, 10);
-
-	// Country can be set only when EEPROM not programmed
-	if (pAd->CommonCfg.CountryRegion & 0x80)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("Set_CountryRegion_Proc::parameter of CountryRegion in eeprom is programmed \n"));
-		return FALSE;
-	}
-
-	if((region >= 0) && (region <= REGION_MAXIMUM_BG_BAND))
-	{
-		pAd->CommonCfg.CountryRegion = (UCHAR) region;
-	}
-	else if (region == REGION_31_BG_BAND)
-	{
-		pAd->CommonCfg.CountryRegion = (UCHAR) region;
-	}
-	else
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("Set_CountryRegion_Proc::parameters out of range\n"));
-		return FALSE;
-	}
-
-	// if set country region, driver needs to be reset
-	BuildChannelList(pAd);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_CountryRegion_Proc::(CountryRegion=%d)\n", pAd->CommonCfg.CountryRegion));
-
-	return TRUE;
-}
-
-/*
-    ==========================================================================
-    Description:
-        Set Country Region for A band.
-        This command will not work, if the field of CountryRegion in eeprom is programmed.
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT Set_CountryRegionABand_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
-	ULONG region;
-
-	region = simple_strtol(arg, 0, 10);
-
-	// Country can be set only when EEPROM not programmed
-	if (pAd->CommonCfg.CountryRegionForABand & 0x80)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("Set_CountryRegionABand_Proc::parameter of CountryRegion in eeprom is programmed \n"));
-		return FALSE;
-	}
-
-	if((region >= 0) && (region <= REGION_MAXIMUM_A_BAND))
-	{
-		pAd->CommonCfg.CountryRegionForABand = (UCHAR) region;
-	}
-	else
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("Set_CountryRegionABand_Proc::parameters out of range\n"));
-		return FALSE;
-	}
-
-	// if set country region, driver needs to be reset
-	BuildChannelList(pAd);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_CountryRegionABand_Proc::(CountryRegion=%d)\n", pAd->CommonCfg.CountryRegionForABand));
-
-	return TRUE;
-}
-
-/*
-    ==========================================================================
-    Description:
-        Set Wireless Mode
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT	Set_WirelessMode_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
-	ULONG	WirelessMode;
-	INT		success = TRUE;
-
-	WirelessMode = simple_strtol(arg, 0, 10);
-
-	{
-		INT MaxPhyMode = PHY_11G;
-
-		MaxPhyMode = PHY_11N_5G;
-
-		if (WirelessMode <= MaxPhyMode)
-		{
-			RTMPSetPhyMode(pAd, WirelessMode);
-
-			if (WirelessMode >= PHY_11ABGN_MIXED)
-			{
-				pAd->CommonCfg.BACapability.field.AutoBA = TRUE;
-				pAd->CommonCfg.REGBACapability.field.AutoBA = TRUE;
-			}
-			else
-			{
-				pAd->CommonCfg.BACapability.field.AutoBA = FALSE;
-				pAd->CommonCfg.REGBACapability.field.AutoBA = FALSE;
-			}
-
-			// Set AdhocMode rates
-			if (pAd->StaCfg.BssType == BSS_ADHOC)
-			{
-				MlmeUpdateTxRates(pAd, FALSE, 0);
-				MakeIbssBeacon(pAd);           // re-build BEACON frame
-				AsicEnableIbssSync(pAd);       // copy to on-chip memory
-			}
-		}
-		else
-		{
-			success = FALSE;
-		}
-	}
-
-	// it is needed to set SSID to take effect
-	if (success == TRUE)
-	{
-		SetCommonHT(pAd);
-		DBGPRINT(RT_DEBUG_TRACE, ("Set_WirelessMode_Proc::(=%ld)\n", WirelessMode));
-	}
-	else
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("Set_WirelessMode_Proc::parameters out of range\n"));
-	}
-
-	return success;
-}
-
-/*
-    ==========================================================================
-    Description:
-        Set Channel
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT	Set_Channel_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
- 	INT		success = TRUE;
-	UCHAR	Channel;
-
-	Channel = (UCHAR) simple_strtol(arg, 0, 10);
-
-	// check if this channel is valid
-	if (ChannelSanity(pAd, Channel) == TRUE)
-	{
-		{
-			pAd->CommonCfg.Channel = Channel;
-
-			if (MONITOR_ON(pAd))
-			{
-				N_ChannelCheck(pAd);
-				if (pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED &&
-					pAd->CommonCfg.RegTransmitSetting.field.BW == BW_40)
-				{
-					N_SetCenCh(pAd);
-					AsicSwitchChannel(pAd, pAd->CommonCfg.CentralChannel, FALSE);
-					AsicLockChannel(pAd, pAd->CommonCfg.CentralChannel);
-					DBGPRINT(RT_DEBUG_TRACE, ("BW_40, control_channel(%d), CentralChannel(%d) \n",
-								pAd->CommonCfg.Channel, pAd->CommonCfg.CentralChannel));
-				}
-				else
-				{
-					AsicSwitchChannel(pAd, pAd->CommonCfg.Channel, FALSE);
-					AsicLockChannel(pAd, pAd->CommonCfg.Channel);
-					DBGPRINT(RT_DEBUG_TRACE, ("BW_20, Channel(%d)\n", pAd->CommonCfg.Channel));
-				}
-			}
-		}
-		success = TRUE;
-	}
-	else
-	{
-		success = FALSE;
-	}
-
-
-	if (success == TRUE)
-		DBGPRINT(RT_DEBUG_TRACE, ("Set_Channel_Proc::(Channel=%d)\n", pAd->CommonCfg.Channel));
-
-	return success;
-}
-
-/*
-    ==========================================================================
-    Description:
-        Set Short Slot Time Enable or Disable
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT	Set_ShortSlot_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
-	ULONG ShortSlot;
-
-	ShortSlot = simple_strtol(arg, 0, 10);
-
-	if (ShortSlot == 1)
-		pAd->CommonCfg.bUseShortSlotTime = TRUE;
-	else if (ShortSlot == 0)
-		pAd->CommonCfg.bUseShortSlotTime = FALSE;
-	else
-		return FALSE;  //Invalid argument
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_ShortSlot_Proc::(ShortSlot=%d)\n", pAd->CommonCfg.bUseShortSlotTime));
-
-	return TRUE;
-}
-
-/*
-    ==========================================================================
-    Description:
-        Set Tx power
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT	Set_TxPower_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
-	ULONG TxPower;
-	INT   success = FALSE;
-
-	TxPower = (ULONG) simple_strtol(arg, 0, 10);
-	if (TxPower <= 100)
-	{
-		{
-			pAd->CommonCfg.TxPowerDefault = TxPower;
-			pAd->CommonCfg.TxPowerPercentage = pAd->CommonCfg.TxPowerDefault;
-		}
-		success = TRUE;
-	}
-	else
-		success = FALSE;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_TxPower_Proc::(TxPowerPercentage=%ld)\n", pAd->CommonCfg.TxPowerPercentage));
-
-	return success;
-}
-
-/*
-    ==========================================================================
-    Description:
-        Set 11B/11G Protection
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT	Set_BGProtection_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
-	switch (simple_strtol(arg, 0, 10))
-	{
-		case 0: //AUTO
-			pAd->CommonCfg.UseBGProtection = 0;
-			break;
-		case 1: //Always On
-			pAd->CommonCfg.UseBGProtection = 1;
-			break;
-		case 2: //Always OFF
-			pAd->CommonCfg.UseBGProtection = 2;
-			break;
-		default:  //Invalid argument
-			return FALSE;
-	}
-
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_BGProtection_Proc::(BGProtection=%ld)\n", pAd->CommonCfg.UseBGProtection));
-
-	return TRUE;
-}
-
-/*
-    ==========================================================================
-    Description:
-        Set TxPreamble
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT	Set_TxPreamble_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
-	RT_802_11_PREAMBLE	Preamble;
-
-	Preamble = simple_strtol(arg, 0, 10);
-
-
-	switch (Preamble)
-	{
-		case Rt802_11PreambleShort:
-			pAd->CommonCfg.TxPreamble = Preamble;
-
-			MlmeSetTxPreamble(pAd, Rt802_11PreambleShort);
-			break;
-		case Rt802_11PreambleLong:
-		case Rt802_11PreambleAuto:
-			// if user wants AUTO, initialize to LONG here, then change according to AP's
-			// capability upon association.
-			pAd->CommonCfg.TxPreamble = Preamble;
-
-			MlmeSetTxPreamble(pAd, Rt802_11PreambleLong);
-			break;
-		default: //Invalid argument
-			return FALSE;
-	}
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_TxPreamble_Proc::(TxPreamble=%ld)\n", pAd->CommonCfg.TxPreamble));
-
-	return TRUE;
-}
-
-/*
-    ==========================================================================
-    Description:
-        Set RTS Threshold
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT	Set_RTSThreshold_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
-	 NDIS_802_11_RTS_THRESHOLD           RtsThresh;
-
-	RtsThresh = simple_strtol(arg, 0, 10);
-
-	if((RtsThresh > 0) && (RtsThresh <= MAX_RTS_THRESHOLD))
-		pAd->CommonCfg.RtsThreshold  = (USHORT)RtsThresh;
-	else if (RtsThresh == 0)
-		pAd->CommonCfg.RtsThreshold = MAX_RTS_THRESHOLD;
-	else
-		return FALSE; //Invalid argument
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_RTSThreshold_Proc::(RTSThreshold=%d)\n", pAd->CommonCfg.RtsThreshold));
-
-	return TRUE;
-}
-
-/*
-    ==========================================================================
-    Description:
-        Set Fragment Threshold
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT	Set_FragThreshold_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
-	 NDIS_802_11_FRAGMENTATION_THRESHOLD     FragThresh;
-
-	FragThresh = simple_strtol(arg, 0, 10);
-
-	if (FragThresh > MAX_FRAG_THRESHOLD || FragThresh < MIN_FRAG_THRESHOLD)
-	{
-		//Illegal FragThresh so we set it to default
-		pAd->CommonCfg.FragmentThreshold = MAX_FRAG_THRESHOLD;
-	}
-	else if (FragThresh % 2 == 1)
-	{
-		// The length of each fragment shall always be an even number of octets, except for the last fragment
-		// of an MSDU or MMPDU, which may be either an even or an odd number of octets.
-		pAd->CommonCfg.FragmentThreshold = (USHORT)(FragThresh - 1);
-	}
-	else
-	{
-		pAd->CommonCfg.FragmentThreshold = (USHORT)FragThresh;
-	}
-
-	{
-		if (pAd->CommonCfg.FragmentThreshold == MAX_FRAG_THRESHOLD)
-			pAd->CommonCfg.bUseZeroToDisableFragment = TRUE;
-		else
-			pAd->CommonCfg.bUseZeroToDisableFragment = FALSE;
-	}
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_FragThreshold_Proc::(FragThreshold=%d)\n", pAd->CommonCfg.FragmentThreshold));
-
-	return TRUE;
-}
-
-/*
-    ==========================================================================
-    Description:
-        Set TxBurst
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT	Set_TxBurst_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
-	ULONG TxBurst;
-
-	TxBurst = simple_strtol(arg, 0, 10);
-	if (TxBurst == 1)
-		pAd->CommonCfg.bEnableTxBurst = TRUE;
-	else if (TxBurst == 0)
-		pAd->CommonCfg.bEnableTxBurst = FALSE;
-	else
-		return FALSE;  //Invalid argument
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_TxBurst_Proc::(TxBurst=%d)\n", pAd->CommonCfg.bEnableTxBurst));
-
-	return TRUE;
-}
-
-#ifdef AGGREGATION_SUPPORT
-/*
-    ==========================================================================
-    Description:
-        Set TxBurst
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT	Set_PktAggregate_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
-	ULONG aggre;
-
-	aggre = simple_strtol(arg, 0, 10);
-
-	if (aggre == 1)
-		pAd->CommonCfg.bAggregationCapable = TRUE;
-	else if (aggre == 0)
-		pAd->CommonCfg.bAggregationCapable = FALSE;
-	else
-		return FALSE;  //Invalid argument
-
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_PktAggregate_Proc::(AGGRE=%d)\n", pAd->CommonCfg.bAggregationCapable));
-
-	return TRUE;
-}
-#endif
-
-/*
-    ==========================================================================
-    Description:
-        Set IEEE80211H.
-        This parameter is 1 when needs radar detection, otherwise 0
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT	Set_IEEE80211H_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
-    ULONG ieee80211h;
-
-	ieee80211h = simple_strtol(arg, 0, 10);
-
-	if (ieee80211h == 1)
-		pAd->CommonCfg.bIEEE80211H = TRUE;
-	else if (ieee80211h == 0)
-		pAd->CommonCfg.bIEEE80211H = FALSE;
-	else
-		return FALSE;  //Invalid argument
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_IEEE80211H_Proc::(IEEE80211H=%d)\n", pAd->CommonCfg.bIEEE80211H));
-
-	return TRUE;
-}
-
-
-#ifdef DBG
-/*
-    ==========================================================================
-    Description:
-        For Debug information
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT	Set_Debug_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
-	DBGPRINT(RT_DEBUG_TRACE, ("==> Set_Debug_Proc *******************\n"));
-
-    if(simple_strtol(arg, 0, 10) <= RT_DEBUG_LOUD)
-        RTDebugLevel = simple_strtol(arg, 0, 10);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("<== Set_Debug_Proc(RTDebugLevel = %ld)\n", RTDebugLevel));
-
-	return TRUE;
-}
-#endif
-
-INT	Show_DescInfo_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
-#ifdef RT2860
-	INT i, QueIdx=0;
-	PRT28XX_RXD_STRUC pRxD;
-    PTXD_STRUC pTxD;
-	PRTMP_TX_RING	pTxRing = &pAd->TxRing[QueIdx];
-	PRTMP_MGMT_RING	pMgmtRing = &pAd->MgmtRing;
-	PRTMP_RX_RING	pRxRing = &pAd->RxRing;
-
-	for(i=0;i<TX_RING_SIZE;i++)
-	{
-	    pTxD = (PTXD_STRUC) pTxRing->Cell[i].AllocVa;
-	    printk("Desc #%d\n",i);
-	    hex_dump("Tx Descriptor", (char *)pTxD, 16);
-	    printk("pTxD->DMADONE = %x\n", pTxD->DMADONE);
-	}
-	printk("---------------------------------------------------\n");
-	for(i=0;i<MGMT_RING_SIZE;i++)
-	{
-	    pTxD = (PTXD_STRUC) pMgmtRing->Cell[i].AllocVa;
-	    printk("Desc #%d\n",i);
-	    hex_dump("Mgmt Descriptor", (char *)pTxD, 16);
-	    printk("pMgmt->DMADONE = %x\n", pTxD->DMADONE);
-	}
-	printk("---------------------------------------------------\n");
-	for(i=0;i<RX_RING_SIZE;i++)
-	{
-	    pRxD = (PRT28XX_RXD_STRUC) pRxRing->Cell[i].AllocVa;
-	    printk("Desc #%d\n",i);
-	    hex_dump("Rx Descriptor", (char *)pRxD, 16);
-		printk("pRxD->DDONE = %x\n", pRxD->DDONE);
-	}
-#endif /* RT2860 */
-	return TRUE;
-}
-
-/*
-    ==========================================================================
-    Description:
-        Reset statistics counter
-
-    Arguments:
-        pAdapter            Pointer to our adapter
-        arg
-
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT	Set_ResetStatCounter_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
-	DBGPRINT(RT_DEBUG_TRACE, ("==>Set_ResetStatCounter_Proc\n"));
-
-	// add the most up-to-date h/w raw counters into software counters
-	NICUpdateRawCounters(pAd);
-
-	NdisZeroMemory(&pAd->WlanCounters, sizeof(COUNTER_802_11));
-	NdisZeroMemory(&pAd->Counters8023, sizeof(COUNTER_802_3));
-	NdisZeroMemory(&pAd->RalinkCounters, sizeof(COUNTER_RALINK));
-
-	return TRUE;
-}
-
-BOOLEAN RTMPCheckStrPrintAble(
-    IN  CHAR *pInPutStr,
-    IN  UCHAR strLen)
-{
-    UCHAR i=0;
-
-    for (i=0; i<strLen; i++)
-    {
-        if ((pInPutStr[i] < 0x21) ||
-            (pInPutStr[i] > 0x7E))
-            return FALSE;
-    }
-
-    return TRUE;
-}
-
 /*
 	========================================================================
 
@@ -862,217 +47,174 @@ BOOLEAN RTMPCheckStrPrintAble(
 
 	========================================================================
 */
-VOID    RTMPSetDesiredRates(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  LONG            Rates)
-{
-    NDIS_802_11_RATES aryRates;
-
-    memset(&aryRates, 0x00, sizeof(NDIS_802_11_RATES));
-    switch (pAdapter->CommonCfg.PhyMode)
-    {
-        case PHY_11A: // A only
-            switch (Rates)
-            {
-                case 6000000: //6M
-                    aryRates[0] = 0x0c; // 6M
-                    pAdapter->StaCfg.DesiredTransmitSetting.field.MCS = MCS_0;
-                    break;
-                case 9000000: //9M
-                    aryRates[0] = 0x12; // 9M
-                    pAdapter->StaCfg.DesiredTransmitSetting.field.MCS = MCS_1;
-                    break;
-                case 12000000: //12M
-                    aryRates[0] = 0x18; // 12M
-                    pAdapter->StaCfg.DesiredTransmitSetting.field.MCS = MCS_2;
-                    break;
-                case 18000000: //18M
-                    aryRates[0] = 0x24; // 18M
-                    pAdapter->StaCfg.DesiredTransmitSetting.field.MCS = MCS_3;
-                    break;
-                case 24000000: //24M
-                    aryRates[0] = 0x30; // 24M
-                    pAdapter->StaCfg.DesiredTransmitSetting.field.MCS = MCS_4;
-                    break;
-                case 36000000: //36M
-                    aryRates[0] = 0x48; // 36M
-                    pAdapter->StaCfg.DesiredTransmitSetting.field.MCS = MCS_5;
-                    break;
-                case 48000000: //48M
-                    aryRates[0] = 0x60; // 48M
-                    pAdapter->StaCfg.DesiredTransmitSetting.field.MCS = MCS_6;
-                    break;
-                case 54000000: //54M
-                    aryRates[0] = 0x6c; // 54M
-                    pAdapter->StaCfg.DesiredTransmitSetting.field.MCS = MCS_7;
-                    break;
-                case -1: //Auto
-                default:
-                    aryRates[0] = 0x6c; // 54Mbps
-                    aryRates[1] = 0x60; // 48Mbps
-                    aryRates[2] = 0x48; // 36Mbps
-                    aryRates[3] = 0x30; // 24Mbps
-                    aryRates[4] = 0x24; // 18M
-                    aryRates[5] = 0x18; // 12M
-                    aryRates[6] = 0x12; // 9M
-                    aryRates[7] = 0x0c; // 6M
-                    pAdapter->StaCfg.DesiredTransmitSetting.field.MCS = MCS_AUTO;
-                    break;
-            }
-            break;
-        case PHY_11BG_MIXED: // B/G Mixed
-        case PHY_11B: // B only
-        case PHY_11ABG_MIXED: // A/B/G Mixed
-        default:
-            switch (Rates)
-            {
-                case 1000000: //1M
-                    aryRates[0] = 0x02;
-                    pAdapter->StaCfg.DesiredTransmitSetting.field.MCS = MCS_0;
-                    break;
-                case 2000000: //2M
-                    aryRates[0] = 0x04;
-                    pAdapter->StaCfg.DesiredTransmitSetting.field.MCS = MCS_1;
-                    break;
-                case 5000000: //5.5M
-                    aryRates[0] = 0x0b; // 5.5M
-                    pAdapter->StaCfg.DesiredTransmitSetting.field.MCS = MCS_2;
-                    break;
-                case 11000000: //11M
-                    aryRates[0] = 0x16; // 11M
-                    pAdapter->StaCfg.DesiredTransmitSetting.field.MCS = MCS_3;
-                    break;
-                case 6000000: //6M
-                    aryRates[0] = 0x0c; // 6M
-                    pAdapter->StaCfg.DesiredTransmitSetting.field.MCS = MCS_0;
-                    break;
-                case 9000000: //9M
-                    aryRates[0] = 0x12; // 9M
-                    pAdapter->StaCfg.DesiredTransmitSetting.field.MCS = MCS_1;
-                    break;
-                case 12000000: //12M
-                    aryRates[0] = 0x18; // 12M
-                    pAdapter->StaCfg.DesiredTransmitSetting.field.MCS = MCS_2;
-                    break;
-                case 18000000: //18M
-                    aryRates[0] = 0x24; // 18M
-                    pAdapter->StaCfg.DesiredTransmitSetting.field.MCS = MCS_3;
-                    break;
-                case 24000000: //24M
-                    aryRates[0] = 0x30; // 24M
-                    pAdapter->StaCfg.DesiredTransmitSetting.field.MCS = MCS_4;
-                    break;
-                case 36000000: //36M
-                    aryRates[0] = 0x48; // 36M
-                    pAdapter->StaCfg.DesiredTransmitSetting.field.MCS = MCS_5;
-                    break;
-                case 48000000: //48M
-                    aryRates[0] = 0x60; // 48M
-                    pAdapter->StaCfg.DesiredTransmitSetting.field.MCS = MCS_6;
-                    break;
-                case 54000000: //54M
-                    aryRates[0] = 0x6c; // 54M
-                    pAdapter->StaCfg.DesiredTransmitSetting.field.MCS = MCS_7;
-                    break;
-                case -1: //Auto
-                default:
-                    if (pAdapter->CommonCfg.PhyMode == PHY_11B)
-                    { //B Only
-                        aryRates[0] = 0x16; // 11Mbps
-                        aryRates[1] = 0x0b; // 5.5Mbps
-                        aryRates[2] = 0x04; // 2Mbps
-                        aryRates[3] = 0x02; // 1Mbps
-                    }
-                    else
-                    { //(B/G) Mixed or (A/B/G) Mixed
-                        aryRates[0] = 0x6c; // 54Mbps
-                        aryRates[1] = 0x60; // 48Mbps
-                        aryRates[2] = 0x48; // 36Mbps
-                        aryRates[3] = 0x30; // 24Mbps
-                        aryRates[4] = 0x16; // 11Mbps
-                        aryRates[5] = 0x0b; // 5.5Mbps
-                        aryRates[6] = 0x04; // 2Mbps
-                        aryRates[7] = 0x02; // 1Mbps
-                    }
-                    pAdapter->StaCfg.DesiredTransmitSetting.field.MCS = MCS_AUTO;
-                    break;
-            }
-            break;
-    }
-
-    NdisZeroMemory(pAdapter->CommonCfg.DesireRate, MAX_LEN_OF_SUPPORTED_RATES);
-    NdisMoveMemory(pAdapter->CommonCfg.DesireRate, &aryRates, sizeof(NDIS_802_11_RATES));
-    DBGPRINT(RT_DEBUG_TRACE, (" RTMPSetDesiredRates (%02x,%02x,%02x,%02x,%02x,%02x,%02x,%02x)\n",
-        pAdapter->CommonCfg.DesireRate[0],pAdapter->CommonCfg.DesireRate[1],
-        pAdapter->CommonCfg.DesireRate[2],pAdapter->CommonCfg.DesireRate[3],
-        pAdapter->CommonCfg.DesireRate[4],pAdapter->CommonCfg.DesireRate[5],
-        pAdapter->CommonCfg.DesireRate[6],pAdapter->CommonCfg.DesireRate[7] ));
-    // Changing DesiredRate may affect the MAX TX rate we used to TX frames out
-    MlmeUpdateTxRates(pAdapter, FALSE, 0);
-}
-
-NDIS_STATUS RTMPWPARemoveKeyProc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PVOID			pBuf)
-{
-	PNDIS_802_11_REMOVE_KEY pKey;
-	ULONG					KeyIdx;
-	NDIS_STATUS 			Status = NDIS_STATUS_FAILURE;
-	BOOLEAN 	bTxKey; 		// Set the key as transmit key
-	BOOLEAN 	bPairwise;		// Indicate the key is pairwise key
-	BOOLEAN 	bKeyRSC;		// indicate the receive  SC set by KeyRSC value.
-								// Otherwise, it will set by the NIC.
-	BOOLEAN 	bAuthenticator; // indicate key is set by authenticator.
-	INT 		i;
-
-	DBGPRINT(RT_DEBUG_TRACE,("---> RTMPWPARemoveKeyProc\n"));
-
-	pKey = (PNDIS_802_11_REMOVE_KEY) pBuf;
-	KeyIdx = pKey->KeyIndex & 0xff;
-	// Bit 31 of Add-key, Tx Key
-	bTxKey		   = (pKey->KeyIndex & 0x80000000) ? TRUE : FALSE;
-	// Bit 30 of Add-key PairwiseKey
-	bPairwise	   = (pKey->KeyIndex & 0x40000000) ? TRUE : FALSE;
-	// Bit 29 of Add-key KeyRSC
-	bKeyRSC 	   = (pKey->KeyIndex & 0x20000000) ? TRUE : FALSE;
-	// Bit 28 of Add-key Authenticator
-	bAuthenticator = (pKey->KeyIndex & 0x10000000) ? TRUE : FALSE;
-
-	// 1. If bTx is TRUE, return failure information
-	if (bTxKey == TRUE)
-		return(NDIS_STATUS_INVALID_DATA);
-
-	// 2. Check Pairwise Key
-	if (bPairwise)
-	{
-		// a. If BSSID is broadcast, remove all pairwise keys.
-		// b. If not broadcast, remove the pairwise specified by BSSID
-		for (i = 0; i < SHARE_KEY_NUM; i++)
-		{
-			if (MAC_ADDR_EQUAL(pAd->SharedKey[BSS0][i].BssId, pKey->BSSID))
-			{
-				DBGPRINT(RT_DEBUG_TRACE,("RTMPWPARemoveKeyProc(KeyIdx=%d)\n", i));
-				pAd->SharedKey[BSS0][i].KeyLen = 0;
-				pAd->SharedKey[BSS0][i].CipherAlg = CIPHER_NONE;
-				AsicRemoveSharedKeyEntry(pAd, BSS0, (UCHAR)i);
-				Status = NDIS_STATUS_SUCCESS;
-				break;
+void RTMPSetDesiredRates(struct rt_rtmp_adapter *pAdapter, long Rates)
+{
+	NDIS_802_11_RATES aryRates;
+
+	memset(&aryRates, 0x00, sizeof(NDIS_802_11_RATES));
+	switch (pAdapter->CommonCfg.PhyMode) {
+	case PHY_11A:		/* A only */
+		switch (Rates) {
+		case 6000000:	/*6M */
+			aryRates[0] = 0x0c;	/* 6M */
+			pAdapter->StaCfg.DesiredTransmitSetting.field.MCS =
+			    MCS_0;
+			break;
+		case 9000000:	/*9M */
+			aryRates[0] = 0x12;	/* 9M */
+			pAdapter->StaCfg.DesiredTransmitSetting.field.MCS =
+			    MCS_1;
+			break;
+		case 12000000:	/*12M */
+			aryRates[0] = 0x18;	/* 12M */
+			pAdapter->StaCfg.DesiredTransmitSetting.field.MCS =
+			    MCS_2;
+			break;
+		case 18000000:	/*18M */
+			aryRates[0] = 0x24;	/* 18M */
+			pAdapter->StaCfg.DesiredTransmitSetting.field.MCS =
+			    MCS_3;
+			break;
+		case 24000000:	/*24M */
+			aryRates[0] = 0x30;	/* 24M */
+			pAdapter->StaCfg.DesiredTransmitSetting.field.MCS =
+			    MCS_4;
+			break;
+		case 36000000:	/*36M */
+			aryRates[0] = 0x48;	/* 36M */
+			pAdapter->StaCfg.DesiredTransmitSetting.field.MCS =
+			    MCS_5;
+			break;
+		case 48000000:	/*48M */
+			aryRates[0] = 0x60;	/* 48M */
+			pAdapter->StaCfg.DesiredTransmitSetting.field.MCS =
+			    MCS_6;
+			break;
+		case 54000000:	/*54M */
+			aryRates[0] = 0x6c;	/* 54M */
+			pAdapter->StaCfg.DesiredTransmitSetting.field.MCS =
+			    MCS_7;
+			break;
+		case -1:	/*Auto */
+		default:
+			aryRates[0] = 0x6c;	/* 54Mbps */
+			aryRates[1] = 0x60;	/* 48Mbps */
+			aryRates[2] = 0x48;	/* 36Mbps */
+			aryRates[3] = 0x30;	/* 24Mbps */
+			aryRates[4] = 0x24;	/* 18M */
+			aryRates[5] = 0x18;	/* 12M */
+			aryRates[6] = 0x12;	/* 9M */
+			aryRates[7] = 0x0c;	/* 6M */
+			pAdapter->StaCfg.DesiredTransmitSetting.field.MCS =
+			    MCS_AUTO;
+			break;
+		}
+		break;
+	case PHY_11BG_MIXED:	/* B/G Mixed */
+	case PHY_11B:		/* B only */
+	case PHY_11ABG_MIXED:	/* A/B/G Mixed */
+	default:
+		switch (Rates) {
+		case 1000000:	/*1M */
+			aryRates[0] = 0x02;
+			pAdapter->StaCfg.DesiredTransmitSetting.field.MCS =
+			    MCS_0;
+			break;
+		case 2000000:	/*2M */
+			aryRates[0] = 0x04;
+			pAdapter->StaCfg.DesiredTransmitSetting.field.MCS =
+			    MCS_1;
+			break;
+		case 5000000:	/*5.5M */
+			aryRates[0] = 0x0b;	/* 5.5M */
+			pAdapter->StaCfg.DesiredTransmitSetting.field.MCS =
+			    MCS_2;
+			break;
+		case 11000000:	/*11M */
+			aryRates[0] = 0x16;	/* 11M */
+			pAdapter->StaCfg.DesiredTransmitSetting.field.MCS =
+			    MCS_3;
+			break;
+		case 6000000:	/*6M */
+			aryRates[0] = 0x0c;	/* 6M */
+			pAdapter->StaCfg.DesiredTransmitSetting.field.MCS =
+			    MCS_0;
+			break;
+		case 9000000:	/*9M */
+			aryRates[0] = 0x12;	/* 9M */
+			pAdapter->StaCfg.DesiredTransmitSetting.field.MCS =
+			    MCS_1;
+			break;
+		case 12000000:	/*12M */
+			aryRates[0] = 0x18;	/* 12M */
+			pAdapter->StaCfg.DesiredTransmitSetting.field.MCS =
+			    MCS_2;
+			break;
+		case 18000000:	/*18M */
+			aryRates[0] = 0x24;	/* 18M */
+			pAdapter->StaCfg.DesiredTransmitSetting.field.MCS =
+			    MCS_3;
+			break;
+		case 24000000:	/*24M */
+			aryRates[0] = 0x30;	/* 24M */
+			pAdapter->StaCfg.DesiredTransmitSetting.field.MCS =
+			    MCS_4;
+			break;
+		case 36000000:	/*36M */
+			aryRates[0] = 0x48;	/* 36M */
+			pAdapter->StaCfg.DesiredTransmitSetting.field.MCS =
+			    MCS_5;
+			break;
+		case 48000000:	/*48M */
+			aryRates[0] = 0x60;	/* 48M */
+			pAdapter->StaCfg.DesiredTransmitSetting.field.MCS =
+			    MCS_6;
+			break;
+		case 54000000:	/*54M */
+			aryRates[0] = 0x6c;	/* 54M */
+			pAdapter->StaCfg.DesiredTransmitSetting.field.MCS =
+			    MCS_7;
+			break;
+		case -1:	/*Auto */
+		default:
+			if (pAdapter->CommonCfg.PhyMode == PHY_11B) {	/*B Only */
+				aryRates[0] = 0x16;	/* 11Mbps */
+				aryRates[1] = 0x0b;	/* 5.5Mbps */
+				aryRates[2] = 0x04;	/* 2Mbps */
+				aryRates[3] = 0x02;	/* 1Mbps */
+			} else {	/*(B/G) Mixed or (A/B/G) Mixed */
+				aryRates[0] = 0x6c;	/* 54Mbps */
+				aryRates[1] = 0x60;	/* 48Mbps */
+				aryRates[2] = 0x48;	/* 36Mbps */
+				aryRates[3] = 0x30;	/* 24Mbps */
+				aryRates[4] = 0x16;	/* 11Mbps */
+				aryRates[5] = 0x0b;	/* 5.5Mbps */
+				aryRates[6] = 0x04;	/* 2Mbps */
+				aryRates[7] = 0x02;	/* 1Mbps */
 			}
+			pAdapter->StaCfg.DesiredTransmitSetting.field.MCS =
+			    MCS_AUTO;
+			break;
 		}
-	}
-	// 3. Group Key
-	else
-	{
-		// a. If BSSID is broadcast, remove all group keys indexed
-		// b. If BSSID matched, delete the group key indexed.
-		DBGPRINT(RT_DEBUG_TRACE,("RTMPWPARemoveKeyProc(KeyIdx=%ld)\n", KeyIdx));
-		pAd->SharedKey[BSS0][KeyIdx].KeyLen = 0;
-		pAd->SharedKey[BSS0][KeyIdx].CipherAlg = CIPHER_NONE;
-		AsicRemoveSharedKeyEntry(pAd, BSS0, (UCHAR)KeyIdx);
-		Status = NDIS_STATUS_SUCCESS;
-	}
-
-	return (Status);
+		break;
+	}
+
+	NdisZeroMemory(pAdapter->CommonCfg.DesireRate,
+		       MAX_LEN_OF_SUPPORTED_RATES);
+	NdisMoveMemory(pAdapter->CommonCfg.DesireRate, &aryRates,
+		       sizeof(NDIS_802_11_RATES));
+	DBGPRINT(RT_DEBUG_TRACE,
+		 (" RTMPSetDesiredRates (%02x,%02x,%02x,%02x,%02x,%02x,%02x,%02x)\n",
+		  pAdapter->CommonCfg.DesireRate[0],
+		  pAdapter->CommonCfg.DesireRate[1],
+		  pAdapter->CommonCfg.DesireRate[2],
+		  pAdapter->CommonCfg.DesireRate[3],
+		  pAdapter->CommonCfg.DesireRate[4],
+		  pAdapter->CommonCfg.DesireRate[5],
+		  pAdapter->CommonCfg.DesireRate[6],
+		  pAdapter->CommonCfg.DesireRate[7]));
+	/* Changing DesiredRate may affect the MAX TX rate we used to TX frames out */
+	MlmeUpdateTxRates(pAdapter, FALSE, 0);
 }
 
 /*
@@ -1093,40 +235,65 @@ NDIS_STATUS RTMPWPARemoveKeyProc(
 
 	========================================================================
 */
-VOID	RTMPWPARemoveAllKeys(
-	IN	PRTMP_ADAPTER	pAd)
+void RTMPWPARemoveAllKeys(struct rt_rtmp_adapter *pAd)
 {
 
-	UCHAR 	i;
+	u8 i;
 
-	DBGPRINT(RT_DEBUG_TRACE,("RTMPWPARemoveAllKeys(AuthMode=%d, WepStatus=%d)\n", pAd->StaCfg.AuthMode, pAd->StaCfg.WepStatus));
-
-	// For WEP/CKIP, there is no need to remove it, since WinXP won't set it again after
-	// Link up. And it will be replaced if user changed it.
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("RTMPWPARemoveAllKeys(AuthMode=%d, WepStatus=%d)\n",
+		  pAd->StaCfg.AuthMode, pAd->StaCfg.WepStatus));
+	RTMP_CLEAR_PSFLAG(pAd, fRTMP_PS_CAN_GO_SLEEP);
+	/* For WEP/CKIP, there is no need to remove it, since WinXP won't set it again after */
+	/* Link up. And it will be replaced if user changed it. */
 	if (pAd->StaCfg.AuthMode < Ndis802_11AuthModeWPA)
 		return;
 
-	// For WPA-None, there is no need to remove it, since WinXP won't set it again after
-	// Link up. And it will be replaced if user changed it.
+	/* For WPA-None, there is no need to remove it, since WinXP won't set it again after */
+	/* Link up. And it will be replaced if user changed it. */
 	if (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPANone)
 		return;
 
-	// set BSSID wcid entry of the Pair-wise Key table as no-security mode
+	/* set BSSID wcid entry of the Pair-wise Key table as no-security mode */
 	AsicRemovePairwiseKeyEntry(pAd, BSS0, BSSID_WCID);
 
-	// set all shared key mode as no-security.
-	for (i = 0; i < SHARE_KEY_NUM; i++)
-    {
-		DBGPRINT(RT_DEBUG_TRACE,("remove %s key #%d\n", CipherName[pAd->SharedKey[BSS0][i].CipherAlg], i));
-		NdisZeroMemory(&pAd->SharedKey[BSS0][i], sizeof(CIPHER_KEY));
+	/* set all shared key mode as no-security. */
+	for (i = 0; i < SHARE_KEY_NUM; i++) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("remove %s key #%d\n",
+			  CipherName[pAd->SharedKey[BSS0][i].CipherAlg], i));
+		NdisZeroMemory(&pAd->SharedKey[BSS0][i], sizeof(struct rt_cipher_key));
 
 		AsicRemoveSharedKeyEntry(pAd, BSS0, i);
 	}
-
+	RTMP_SET_PSFLAG(pAd, fRTMP_PS_CAN_GO_SLEEP);
 }
 
 /*
 	========================================================================
+
+	Routine Description:
+		As STA's BSSID is a WC too, it uses shared key table.
+		This function write correct unicast TX key to ASIC WCID.
+		And we still make a copy in our MacTab.Content[BSSID_WCID].PairwiseKey.
+		Caller guarantee TKIP/AES always has keyidx = 0. (pairwise key)
+		Caller guarantee WEP calls this function when set Txkey,  default key index=0~3.
+
+	Arguments:
+		pAd					Pointer to our adapter
+		pKey							Pointer to the where the key stored
+
+	Return Value:
+		NDIS_SUCCESS					Add key successfully
+
+	IRQL = DISPATCH_LEVEL
+
+	Note:
+
+	========================================================================
+*/
+/*
+	========================================================================
 	Routine Description:
 		Change NIC PHY mode. Re-association may be necessary. possible settings
 		include - PHY_11B, PHY_11BG_MIXED, PHY_11A, and PHY_11ABG_MIXED
@@ -1140,115 +307,119 @@ VOID	RTMPWPARemoveAllKeys(
 
 	========================================================================
 */
-VOID	RTMPSetPhyMode(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	ULONG phymode)
+void RTMPSetPhyMode(struct rt_rtmp_adapter *pAd, unsigned long phymode)
 {
-	INT i;
-	// the selected phymode must be supported by the RF IC encoded in E2PROM
+	int i;
+	/* the selected phymode must be supported by the RF IC encoded in E2PROM */
 
-	pAd->CommonCfg.PhyMode = (UCHAR)phymode;
+	/* if no change, do nothing */
+	/* bug fix
+	   if (pAd->CommonCfg.PhyMode == phymode)
+	   return;
+	 */
+	pAd->CommonCfg.PhyMode = (u8)phymode;
 
-	DBGPRINT(RT_DEBUG_TRACE,("RTMPSetPhyMode : PhyMode=%d, channel=%d \n", pAd->CommonCfg.PhyMode, pAd->CommonCfg.Channel));
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("RTMPSetPhyMode : PhyMode=%d, channel=%d \n",
+		  pAd->CommonCfg.PhyMode, pAd->CommonCfg.Channel));
 
 	BuildChannelList(pAd);
 
-	// sanity check user setting
-	for (i = 0; i < pAd->ChannelListNum; i++)
-	{
+	/* sanity check user setting */
+	for (i = 0; i < pAd->ChannelListNum; i++) {
 		if (pAd->CommonCfg.Channel == pAd->ChannelList[i].Channel)
 			break;
 	}
 
-	if (i == pAd->ChannelListNum)
-	{
+	if (i == pAd->ChannelListNum) {
 		pAd->CommonCfg.Channel = FirstChannel(pAd);
-		DBGPRINT(RT_DEBUG_ERROR, ("RTMPSetPhyMode: channel is out of range, use first channel=%d \n", pAd->CommonCfg.Channel));
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("RTMPSetPhyMode: channel is out of range, use first channel=%d \n",
+			  pAd->CommonCfg.Channel));
 	}
 
 	NdisZeroMemory(pAd->CommonCfg.SupRate, MAX_LEN_OF_SUPPORTED_RATES);
 	NdisZeroMemory(pAd->CommonCfg.ExtRate, MAX_LEN_OF_SUPPORTED_RATES);
 	NdisZeroMemory(pAd->CommonCfg.DesireRate, MAX_LEN_OF_SUPPORTED_RATES);
 	switch (phymode) {
-		case PHY_11B:
-			pAd->CommonCfg.SupRate[0]  = 0x82;	  // 1 mbps, in units of 0.5 Mbps, basic rate
-			pAd->CommonCfg.SupRate[1]  = 0x84;	  // 2 mbps, in units of 0.5 Mbps, basic rate
-			pAd->CommonCfg.SupRate[2]  = 0x8B;	  // 5.5 mbps, in units of 0.5 Mbps, basic rate
-			pAd->CommonCfg.SupRate[3]  = 0x96;	  // 11 mbps, in units of 0.5 Mbps, basic rate
-			pAd->CommonCfg.SupRateLen  = 4;
-			pAd->CommonCfg.ExtRateLen  = 0;
-			pAd->CommonCfg.DesireRate[0]  = 2;	   // 1 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.DesireRate[1]  = 4;	   // 2 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.DesireRate[2]  = 11;    // 5.5 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.DesireRate[3]  = 22;    // 11 mbps, in units of 0.5 Mbps
-			//pAd->CommonCfg.HTPhyMode.field.MODE = MODE_CCK; // This MODE is only FYI. not use
-			break;
-
-		case PHY_11G:
-		case PHY_11BG_MIXED:
-		case PHY_11ABG_MIXED:
-		case PHY_11N_2_4G:
-		case PHY_11ABGN_MIXED:
-		case PHY_11BGN_MIXED:
-		case PHY_11GN_MIXED:
-			pAd->CommonCfg.SupRate[0]  = 0x82;	  // 1 mbps, in units of 0.5 Mbps, basic rate
-			pAd->CommonCfg.SupRate[1]  = 0x84;	  // 2 mbps, in units of 0.5 Mbps, basic rate
-			pAd->CommonCfg.SupRate[2]  = 0x8B;	  // 5.5 mbps, in units of 0.5 Mbps, basic rate
-			pAd->CommonCfg.SupRate[3]  = 0x96;	  // 11 mbps, in units of 0.5 Mbps, basic rate
-			pAd->CommonCfg.SupRate[4]  = 0x12;	  // 9 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.SupRate[5]  = 0x24;	  // 18 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.SupRate[6]  = 0x48;	  // 36 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.SupRate[7]  = 0x6c;	  // 54 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.SupRateLen  = 8;
-			pAd->CommonCfg.ExtRate[0]  = 0x0C;	  // 6 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.ExtRate[1]  = 0x18;	  // 12 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.ExtRate[2]  = 0x30;	  // 24 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.ExtRate[3]  = 0x60;	  // 48 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.ExtRateLen  = 4;
-			pAd->CommonCfg.DesireRate[0]  = 2;	   // 1 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.DesireRate[1]  = 4;	   // 2 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.DesireRate[2]  = 11;    // 5.5 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.DesireRate[3]  = 22;    // 11 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.DesireRate[4]  = 12;    // 6 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.DesireRate[5]  = 18;    // 9 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.DesireRate[6]  = 24;    // 12 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.DesireRate[7]  = 36;    // 18 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.DesireRate[8]  = 48;    // 24 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.DesireRate[9]  = 72;    // 36 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.DesireRate[10] = 96;    // 48 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.DesireRate[11] = 108;   // 54 mbps, in units of 0.5 Mbps
-			break;
-
-		case PHY_11A:
-		case PHY_11AN_MIXED:
-		case PHY_11AGN_MIXED:
-		case PHY_11N_5G:
-			pAd->CommonCfg.SupRate[0]  = 0x8C;	  // 6 mbps, in units of 0.5 Mbps, basic rate
-			pAd->CommonCfg.SupRate[1]  = 0x12;	  // 9 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.SupRate[2]  = 0x98;	  // 12 mbps, in units of 0.5 Mbps, basic rate
-			pAd->CommonCfg.SupRate[3]  = 0x24;	  // 18 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.SupRate[4]  = 0xb0;	  // 24 mbps, in units of 0.5 Mbps, basic rate
-			pAd->CommonCfg.SupRate[5]  = 0x48;	  // 36 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.SupRate[6]  = 0x60;	  // 48 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.SupRate[7]  = 0x6c;	  // 54 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.SupRateLen  = 8;
-			pAd->CommonCfg.ExtRateLen  = 0;
-			pAd->CommonCfg.DesireRate[0]  = 12;    // 6 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.DesireRate[1]  = 18;    // 9 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.DesireRate[2]  = 24;    // 12 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.DesireRate[3]  = 36;    // 18 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.DesireRate[4]  = 48;    // 24 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.DesireRate[5]  = 72;    // 36 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.DesireRate[6]  = 96;    // 48 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.DesireRate[7]  = 108;   // 54 mbps, in units of 0.5 Mbps
-			//pAd->CommonCfg.HTPhyMode.field.MODE = MODE_OFDM; // This MODE is only FYI. not use
-			break;
-
-		default:
-			break;
+	case PHY_11B:
+		pAd->CommonCfg.SupRate[0] = 0x82;	/* 1 mbps, in units of 0.5 Mbps, basic rate */
+		pAd->CommonCfg.SupRate[1] = 0x84;	/* 2 mbps, in units of 0.5 Mbps, basic rate */
+		pAd->CommonCfg.SupRate[2] = 0x8B;	/* 5.5 mbps, in units of 0.5 Mbps, basic rate */
+		pAd->CommonCfg.SupRate[3] = 0x96;	/* 11 mbps, in units of 0.5 Mbps, basic rate */
+		pAd->CommonCfg.SupRateLen = 4;
+		pAd->CommonCfg.ExtRateLen = 0;
+		pAd->CommonCfg.DesireRate[0] = 2;	/* 1 mbps, in units of 0.5 Mbps */
+		pAd->CommonCfg.DesireRate[1] = 4;	/* 2 mbps, in units of 0.5 Mbps */
+		pAd->CommonCfg.DesireRate[2] = 11;	/* 5.5 mbps, in units of 0.5 Mbps */
+		pAd->CommonCfg.DesireRate[3] = 22;	/* 11 mbps, in units of 0.5 Mbps */
+		/*pAd->CommonCfg.HTPhyMode.field.MODE = MODE_CCK; // This MODE is only FYI. not use */
+		break;
+
+	case PHY_11G:
+	case PHY_11BG_MIXED:
+	case PHY_11ABG_MIXED:
+	case PHY_11N_2_4G:
+	case PHY_11ABGN_MIXED:
+	case PHY_11BGN_MIXED:
+	case PHY_11GN_MIXED:
+		pAd->CommonCfg.SupRate[0] = 0x82;	/* 1 mbps, in units of 0.5 Mbps, basic rate */
+		pAd->CommonCfg.SupRate[1] = 0x84;	/* 2 mbps, in units of 0.5 Mbps, basic rate */
+		pAd->CommonCfg.SupRate[2] = 0x8B;	/* 5.5 mbps, in units of 0.5 Mbps, basic rate */
+		pAd->CommonCfg.SupRate[3] = 0x96;	/* 11 mbps, in units of 0.5 Mbps, basic rate */
+		pAd->CommonCfg.SupRate[4] = 0x12;	/* 9 mbps, in units of 0.5 Mbps */
+		pAd->CommonCfg.SupRate[5] = 0x24;	/* 18 mbps, in units of 0.5 Mbps */
+		pAd->CommonCfg.SupRate[6] = 0x48;	/* 36 mbps, in units of 0.5 Mbps */
+		pAd->CommonCfg.SupRate[7] = 0x6c;	/* 54 mbps, in units of 0.5 Mbps */
+		pAd->CommonCfg.SupRateLen = 8;
+		pAd->CommonCfg.ExtRate[0] = 0x0C;	/* 6 mbps, in units of 0.5 Mbps */
+		pAd->CommonCfg.ExtRate[1] = 0x18;	/* 12 mbps, in units of 0.5 Mbps */
+		pAd->CommonCfg.ExtRate[2] = 0x30;	/* 24 mbps, in units of 0.5 Mbps */
+		pAd->CommonCfg.ExtRate[3] = 0x60;	/* 48 mbps, in units of 0.5 Mbps */
+		pAd->CommonCfg.ExtRateLen = 4;
+		pAd->CommonCfg.DesireRate[0] = 2;	/* 1 mbps, in units of 0.5 Mbps */
+		pAd->CommonCfg.DesireRate[1] = 4;	/* 2 mbps, in units of 0.5 Mbps */
+		pAd->CommonCfg.DesireRate[2] = 11;	/* 5.5 mbps, in units of 0.5 Mbps */
+		pAd->CommonCfg.DesireRate[3] = 22;	/* 11 mbps, in units of 0.5 Mbps */
+		pAd->CommonCfg.DesireRate[4] = 12;	/* 6 mbps, in units of 0.5 Mbps */
+		pAd->CommonCfg.DesireRate[5] = 18;	/* 9 mbps, in units of 0.5 Mbps */
+		pAd->CommonCfg.DesireRate[6] = 24;	/* 12 mbps, in units of 0.5 Mbps */
+		pAd->CommonCfg.DesireRate[7] = 36;	/* 18 mbps, in units of 0.5 Mbps */
+		pAd->CommonCfg.DesireRate[8] = 48;	/* 24 mbps, in units of 0.5 Mbps */
+		pAd->CommonCfg.DesireRate[9] = 72;	/* 36 mbps, in units of 0.5 Mbps */
+		pAd->CommonCfg.DesireRate[10] = 96;	/* 48 mbps, in units of 0.5 Mbps */
+		pAd->CommonCfg.DesireRate[11] = 108;	/* 54 mbps, in units of 0.5 Mbps */
+		break;
+
+	case PHY_11A:
+	case PHY_11AN_MIXED:
+	case PHY_11AGN_MIXED:
+	case PHY_11N_5G:
+		pAd->CommonCfg.SupRate[0] = 0x8C;	/* 6 mbps, in units of 0.5 Mbps, basic rate */
+		pAd->CommonCfg.SupRate[1] = 0x12;	/* 9 mbps, in units of 0.5 Mbps */
+		pAd->CommonCfg.SupRate[2] = 0x98;	/* 12 mbps, in units of 0.5 Mbps, basic rate */
+		pAd->CommonCfg.SupRate[3] = 0x24;	/* 18 mbps, in units of 0.5 Mbps */
+		pAd->CommonCfg.SupRate[4] = 0xb0;	/* 24 mbps, in units of 0.5 Mbps, basic rate */
+		pAd->CommonCfg.SupRate[5] = 0x48;	/* 36 mbps, in units of 0.5 Mbps */
+		pAd->CommonCfg.SupRate[6] = 0x60;	/* 48 mbps, in units of 0.5 Mbps */
+		pAd->CommonCfg.SupRate[7] = 0x6c;	/* 54 mbps, in units of 0.5 Mbps */
+		pAd->CommonCfg.SupRateLen = 8;
+		pAd->CommonCfg.ExtRateLen = 0;
+		pAd->CommonCfg.DesireRate[0] = 12;	/* 6 mbps, in units of 0.5 Mbps */
+		pAd->CommonCfg.DesireRate[1] = 18;	/* 9 mbps, in units of 0.5 Mbps */
+		pAd->CommonCfg.DesireRate[2] = 24;	/* 12 mbps, in units of 0.5 Mbps */
+		pAd->CommonCfg.DesireRate[3] = 36;	/* 18 mbps, in units of 0.5 Mbps */
+		pAd->CommonCfg.DesireRate[4] = 48;	/* 24 mbps, in units of 0.5 Mbps */
+		pAd->CommonCfg.DesireRate[5] = 72;	/* 36 mbps, in units of 0.5 Mbps */
+		pAd->CommonCfg.DesireRate[6] = 96;	/* 48 mbps, in units of 0.5 Mbps */
+		pAd->CommonCfg.DesireRate[7] = 108;	/* 54 mbps, in units of 0.5 Mbps */
+		/*pAd->CommonCfg.HTPhyMode.field.MODE = MODE_OFDM; // This MODE is only FYI. not use */
+		break;
+
+	default:
+		break;
 	}
 
-
 	pAd->CommonCfg.BandState = UNKNOWN_BAND;
 }
 
@@ -1264,34 +435,33 @@ VOID	RTMPSetPhyMode(
 
 	========================================================================
 */
-VOID	RTMPSetHT(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	OID_SET_HT_PHYMODE *pHTPhyMode)
-{
-	//ULONG	*pmcs;
-	UINT32	Value = 0;
-	UCHAR	BBPValue = 0;
-	UCHAR	BBP3Value = 0;
-	UCHAR	RxStream = pAd->CommonCfg.RxStream;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("RTMPSetHT : HT_mode(%d), ExtOffset(%d), MCS(%d), BW(%d), STBC(%d), SHORTGI(%d)\n",
-										pHTPhyMode->HtMode, pHTPhyMode->ExtOffset,
-										pHTPhyMode->MCS, pHTPhyMode->BW,
-										pHTPhyMode->STBC, pHTPhyMode->SHORTGI));
-
-	// Don't zero supportedHyPhy structure.
-	RTMPZeroMemory(&pAd->CommonCfg.HtCapability, sizeof(pAd->CommonCfg.HtCapability));
-	RTMPZeroMemory(&pAd->CommonCfg.AddHTInfo, sizeof(pAd->CommonCfg.AddHTInfo));
-	RTMPZeroMemory(&pAd->CommonCfg.NewExtChanOffset, sizeof(pAd->CommonCfg.NewExtChanOffset));
-	RTMPZeroMemory(&pAd->CommonCfg.DesiredHtPhy, sizeof(pAd->CommonCfg.DesiredHtPhy));
-
-   	if (pAd->CommonCfg.bRdg)
-	{
+void RTMPSetHT(struct rt_rtmp_adapter *pAd, struct rt_oid_set_ht_phymode *pHTPhyMode)
+{
+	/*unsigned long *pmcs; */
+	u32 Value = 0;
+	u8 BBPValue = 0;
+	u8 BBP3Value = 0;
+	u8 RxStream = pAd->CommonCfg.RxStream;
+
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("RTMPSetHT : HT_mode(%d), ExtOffset(%d), MCS(%d), BW(%d), STBC(%d), SHORTGI(%d)\n",
+		  pHTPhyMode->HtMode, pHTPhyMode->ExtOffset, pHTPhyMode->MCS,
+		  pHTPhyMode->BW, pHTPhyMode->STBC, pHTPhyMode->SHORTGI));
+
+	/* Don't zero supportedHyPhy structure. */
+	RTMPZeroMemory(&pAd->CommonCfg.HtCapability,
+		       sizeof(pAd->CommonCfg.HtCapability));
+	RTMPZeroMemory(&pAd->CommonCfg.AddHTInfo,
+		       sizeof(pAd->CommonCfg.AddHTInfo));
+	RTMPZeroMemory(&pAd->CommonCfg.NewExtChanOffset,
+		       sizeof(pAd->CommonCfg.NewExtChanOffset));
+	RTMPZeroMemory(&pAd->CommonCfg.DesiredHtPhy,
+		       sizeof(pAd->CommonCfg.DesiredHtPhy));
+
+	if (pAd->CommonCfg.bRdg) {
 		pAd->CommonCfg.HtCapability.ExtHtCapInfo.PlusHTC = 1;
 		pAd->CommonCfg.HtCapability.ExtHtCapInfo.RDGSupport = 1;
-	}
-	else
-	{
+	} else {
 		pAd->CommonCfg.HtCapability.ExtHtCapInfo.PlusHTC = 0;
 		pAd->CommonCfg.HtCapability.ExtHtCapInfo.RDGSupport = 0;
 	}
@@ -1299,89 +469,92 @@ VOID	RTMPSetHT(
 	pAd->CommonCfg.HtCapability.HtCapParm.MaxRAmpduFactor = 3;
 	pAd->CommonCfg.DesiredHtPhy.MaxRAmpduFactor = 3;
 
-	DBGPRINT(RT_DEBUG_TRACE, ("RTMPSetHT : RxBAWinLimit = %d\n", pAd->CommonCfg.BACapability.field.RxBAWinLimit));
-
-	// Mimo power save, A-MSDU size,
-	pAd->CommonCfg.DesiredHtPhy.AmsduEnable = (USHORT)pAd->CommonCfg.BACapability.field.AmsduEnable;
-	pAd->CommonCfg.DesiredHtPhy.AmsduSize = (UCHAR)pAd->CommonCfg.BACapability.field.AmsduSize;
-	pAd->CommonCfg.DesiredHtPhy.MimoPs = (UCHAR)pAd->CommonCfg.BACapability.field.MMPSmode;
-	pAd->CommonCfg.DesiredHtPhy.MpduDensity = (UCHAR)pAd->CommonCfg.BACapability.field.MpduDensity;
-
-	pAd->CommonCfg.HtCapability.HtCapInfo.AMsduSize = (USHORT)pAd->CommonCfg.BACapability.field.AmsduSize;
-	pAd->CommonCfg.HtCapability.HtCapInfo.MimoPs = (USHORT)pAd->CommonCfg.BACapability.field.MMPSmode;
-	pAd->CommonCfg.HtCapability.HtCapParm.MpduDensity = (UCHAR)pAd->CommonCfg.BACapability.field.MpduDensity;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("RTMPSetHT : AMsduSize = %d, MimoPs = %d, MpduDensity = %d, MaxRAmpduFactor = %d\n",
-													pAd->CommonCfg.DesiredHtPhy.AmsduSize,
-													pAd->CommonCfg.DesiredHtPhy.MimoPs,
-													pAd->CommonCfg.DesiredHtPhy.MpduDensity,
-													pAd->CommonCfg.DesiredHtPhy.MaxRAmpduFactor));
-
-	if(pHTPhyMode->HtMode == HTMODE_GF)
-	{
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("RTMPSetHT : RxBAWinLimit = %d\n",
+		  pAd->CommonCfg.BACapability.field.RxBAWinLimit));
+
+	/* Mimo power save, A-MSDU size, */
+	pAd->CommonCfg.DesiredHtPhy.AmsduEnable =
+	    (u16)pAd->CommonCfg.BACapability.field.AmsduEnable;
+	pAd->CommonCfg.DesiredHtPhy.AmsduSize =
+	    (u8)pAd->CommonCfg.BACapability.field.AmsduSize;
+	pAd->CommonCfg.DesiredHtPhy.MimoPs =
+	    (u8)pAd->CommonCfg.BACapability.field.MMPSmode;
+	pAd->CommonCfg.DesiredHtPhy.MpduDensity =
+	    (u8)pAd->CommonCfg.BACapability.field.MpduDensity;
+
+	pAd->CommonCfg.HtCapability.HtCapInfo.AMsduSize =
+	    (u16)pAd->CommonCfg.BACapability.field.AmsduSize;
+	pAd->CommonCfg.HtCapability.HtCapInfo.MimoPs =
+	    (u16)pAd->CommonCfg.BACapability.field.MMPSmode;
+	pAd->CommonCfg.HtCapability.HtCapParm.MpduDensity =
+	    (u8)pAd->CommonCfg.BACapability.field.MpduDensity;
+
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("RTMPSetHT : AMsduSize = %d, MimoPs = %d, MpduDensity = %d, MaxRAmpduFactor = %d\n",
+		  pAd->CommonCfg.DesiredHtPhy.AmsduSize,
+		  pAd->CommonCfg.DesiredHtPhy.MimoPs,
+		  pAd->CommonCfg.DesiredHtPhy.MpduDensity,
+		  pAd->CommonCfg.DesiredHtPhy.MaxRAmpduFactor));
+
+	if (pHTPhyMode->HtMode == HTMODE_GF) {
 		pAd->CommonCfg.HtCapability.HtCapInfo.GF = 1;
 		pAd->CommonCfg.DesiredHtPhy.GF = 1;
-	}
-	else
+	} else
 		pAd->CommonCfg.DesiredHtPhy.GF = 0;
 
-	// Decide Rx MCSSet
-	switch (RxStream)
-	{
-		case 1:
-			pAd->CommonCfg.HtCapability.MCSSet[0] =  0xff;
-			pAd->CommonCfg.HtCapability.MCSSet[1] =  0x00;
-			break;
+	/* Decide Rx MCSSet */
+	switch (RxStream) {
+	case 1:
+		pAd->CommonCfg.HtCapability.MCSSet[0] = 0xff;
+		pAd->CommonCfg.HtCapability.MCSSet[1] = 0x00;
+		break;
 
-		case 2:
-			pAd->CommonCfg.HtCapability.MCSSet[0] =  0xff;
-			pAd->CommonCfg.HtCapability.MCSSet[1] =  0xff;
-			break;
+	case 2:
+		pAd->CommonCfg.HtCapability.MCSSet[0] = 0xff;
+		pAd->CommonCfg.HtCapability.MCSSet[1] = 0xff;
+		break;
 
-		case 3: // 3*3
-			pAd->CommonCfg.HtCapability.MCSSet[0] =  0xff;
-			pAd->CommonCfg.HtCapability.MCSSet[1] =  0xff;
-			pAd->CommonCfg.HtCapability.MCSSet[2] =  0xff;
-			break;
+	case 3:		/* 3*3 */
+		pAd->CommonCfg.HtCapability.MCSSet[0] = 0xff;
+		pAd->CommonCfg.HtCapability.MCSSet[1] = 0xff;
+		pAd->CommonCfg.HtCapability.MCSSet[2] = 0xff;
+		break;
 	}
 
-	if (pAd->CommonCfg.bForty_Mhz_Intolerant && (pAd->CommonCfg.Channel <= 14) && (pHTPhyMode->BW == BW_40) )
-	{
+	if (pAd->CommonCfg.bForty_Mhz_Intolerant
+	    && (pAd->CommonCfg.Channel <= 14) && (pHTPhyMode->BW == BW_40)) {
 		pHTPhyMode->BW = BW_20;
 		pAd->CommonCfg.HtCapability.HtCapInfo.Forty_Mhz_Intolerant = 1;
 	}
 
-	if(pHTPhyMode->BW == BW_40)
-	{
-		pAd->CommonCfg.HtCapability.MCSSet[4] = 0x1; // MCS 32
+	if (pHTPhyMode->BW == BW_40) {
+		pAd->CommonCfg.HtCapability.MCSSet[4] = 0x1;	/* MCS 32 */
 		pAd->CommonCfg.HtCapability.HtCapInfo.ChannelWidth = 1;
 		if (pAd->CommonCfg.Channel <= 14)
 			pAd->CommonCfg.HtCapability.HtCapInfo.CCKmodein40 = 1;
 
 		pAd->CommonCfg.DesiredHtPhy.ChannelWidth = 1;
 		pAd->CommonCfg.AddHTInfo.AddHtInfo.RecomWidth = 1;
-		pAd->CommonCfg.AddHTInfo.AddHtInfo.ExtChanOffset = (pHTPhyMode->ExtOffset == EXTCHA_BELOW)? (EXTCHA_BELOW): EXTCHA_ABOVE;
-		// Set Regsiter for extension channel position.
+		pAd->CommonCfg.AddHTInfo.AddHtInfo.ExtChanOffset =
+		    (pHTPhyMode->ExtOffset ==
+		     EXTCHA_BELOW) ? (EXTCHA_BELOW) : EXTCHA_ABOVE;
+		/* Set Regsiter for extension channel position. */
 		RTMP_IO_READ32(pAd, TX_BAND_CFG, &Value);
 		RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R3, &BBP3Value);
-		if ((pHTPhyMode->ExtOffset == EXTCHA_BELOW))
-		{
+		if ((pHTPhyMode->ExtOffset == EXTCHA_BELOW)) {
 			Value |= 0x1;
 			BBP3Value |= (0x20);
 			RTMP_IO_WRITE32(pAd, TX_BAND_CFG, Value);
-		}
-		else if ((pHTPhyMode->ExtOffset == EXTCHA_ABOVE))
-		{
+		} else if ((pHTPhyMode->ExtOffset == EXTCHA_ABOVE)) {
 			Value &= 0xfe;
 			BBP3Value &= (~0x20);
 			RTMP_IO_WRITE32(pAd, TX_BAND_CFG, Value);
 		}
-
-		// Turn on BBP 40MHz mode now only as AP .
-		// Sta can turn on BBP 40MHz after connection with 40MHz AP. Sta only broadcast 40MHz capability before connection.
+		/* Turn on BBP 40MHz mode now only as AP . */
+		/* Sta can turn on BBP 40MHz after connection with 40MHz AP. Sta only broadcast 40MHz capability before connection. */
 		if ((pAd->OpMode == OPMODE_AP) || INFRA_ON(pAd) || ADHOC_ON(pAd)
-			)
-		{
+		    ) {
 			RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R4, &BBPValue);
 			BBPValue &= (~0x18);
 			BBPValue |= 0x10;
@@ -1390,15 +563,13 @@ VOID	RTMPSetHT(
 			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R3, BBP3Value);
 			pAd->CommonCfg.BBPCurrentBW = BW_40;
 		}
-	}
-	else
-	{
+	} else {
 		pAd->CommonCfg.HtCapability.HtCapInfo.ChannelWidth = 0;
 		pAd->CommonCfg.DesiredHtPhy.ChannelWidth = 0;
 		pAd->CommonCfg.AddHTInfo.AddHtInfo.RecomWidth = 0;
 		pAd->CommonCfg.AddHTInfo.AddHtInfo.ExtChanOffset = EXTCHA_NONE;
 		pAd->CommonCfg.CentralChannel = pAd->CommonCfg.Channel;
-		// Turn on BBP 20MHz mode by request here.
+		/* Turn on BBP 20MHz mode by request here. */
 		{
 			RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R4, &BBPValue);
 			BBPValue &= (~0x18);
@@ -1407,42 +578,35 @@ VOID	RTMPSetHT(
 		}
 	}
 
-	if(pHTPhyMode->STBC == STBC_USE)
-	{
+	if (pHTPhyMode->STBC == STBC_USE) {
 		pAd->CommonCfg.HtCapability.HtCapInfo.TxSTBC = 1;
 		pAd->CommonCfg.DesiredHtPhy.TxSTBC = 1;
 		pAd->CommonCfg.HtCapability.HtCapInfo.RxSTBC = 1;
 		pAd->CommonCfg.DesiredHtPhy.RxSTBC = 1;
-	}
-	else
-	{
+	} else {
 		pAd->CommonCfg.DesiredHtPhy.TxSTBC = 0;
 		pAd->CommonCfg.DesiredHtPhy.RxSTBC = 0;
 	}
 
-	if(pHTPhyMode->SHORTGI == GI_400)
-	{
+	if (pHTPhyMode->SHORTGI == GI_400) {
 		pAd->CommonCfg.HtCapability.HtCapInfo.ShortGIfor20 = 1;
 		pAd->CommonCfg.HtCapability.HtCapInfo.ShortGIfor40 = 1;
 		pAd->CommonCfg.DesiredHtPhy.ShortGIfor20 = 1;
 		pAd->CommonCfg.DesiredHtPhy.ShortGIfor40 = 1;
-	}
-	else
-	{
+	} else {
 		pAd->CommonCfg.HtCapability.HtCapInfo.ShortGIfor20 = 0;
 		pAd->CommonCfg.HtCapability.HtCapInfo.ShortGIfor40 = 0;
 		pAd->CommonCfg.DesiredHtPhy.ShortGIfor20 = 0;
 		pAd->CommonCfg.DesiredHtPhy.ShortGIfor40 = 0;
 	}
 
-	// We support link adaptation for unsolicit MCS feedback, set to 2.
-	pAd->CommonCfg.HtCapability.ExtHtCapInfo.MCSFeedback = MCSFBK_NONE; //MCSFBK_UNSOLICIT;
+	/* We support link adaptation for unsolicit MCS feedback, set to 2. */
+	pAd->CommonCfg.HtCapability.ExtHtCapInfo.MCSFeedback = MCSFBK_NONE;	/*MCSFBK_UNSOLICIT; */
 	pAd->CommonCfg.AddHTInfo.ControlChan = pAd->CommonCfg.Channel;
-	// 1, the extension channel above the control channel.
+	/* 1, the extension channel above the control channel. */
 
-	// EDCA parameters used for AP's own transmission
-	if (pAd->CommonCfg.APEdcaParm.bValid == FALSE)
-	{
+	/* EDCA parameters used for AP's own transmission */
+	if (pAd->CommonCfg.APEdcaParm.bValid == FALSE) {
 		pAd->CommonCfg.APEdcaParm.bValid = TRUE;
 		pAd->CommonCfg.APEdcaParm.Aifsn[0] = 3;
 		pAd->CommonCfg.APEdcaParm.Aifsn[1] = 7;
@@ -1459,14 +623,17 @@ VOID	RTMPSetHT(
 		pAd->CommonCfg.APEdcaParm.Cwmax[2] = 4;
 		pAd->CommonCfg.APEdcaParm.Cwmax[3] = 3;
 
-		pAd->CommonCfg.APEdcaParm.Txop[0]  = 0;
-		pAd->CommonCfg.APEdcaParm.Txop[1]  = 0;
-		pAd->CommonCfg.APEdcaParm.Txop[2]  = 94;
-		pAd->CommonCfg.APEdcaParm.Txop[3]  = 47;
+		pAd->CommonCfg.APEdcaParm.Txop[0] = 0;
+		pAd->CommonCfg.APEdcaParm.Txop[1] = 0;
+		pAd->CommonCfg.APEdcaParm.Txop[2] = 94;
+		pAd->CommonCfg.APEdcaParm.Txop[3] = 47;
 	}
 	AsicSetEdcaParm(pAd, &pAd->CommonCfg.APEdcaParm);
 
-	RTMPSetIndividualHT(pAd, 0);
+	{
+		RTMPSetIndividualHT(pAd, 0);
+	}
+
 }
 
 /*
@@ -1481,112 +648,103 @@ VOID	RTMPSetHT(
 
 	========================================================================
 */
-VOID	RTMPSetIndividualHT(
-	IN	PRTMP_ADAPTER		pAd,
-	IN	UCHAR				apidx)
+void RTMPSetIndividualHT(struct rt_rtmp_adapter *pAd, u8 apidx)
 {
-	PRT_HT_PHY_INFO		pDesired_ht_phy = NULL;
-	UCHAR	TxStream = pAd->CommonCfg.TxStream;
-	UCHAR	DesiredMcs	= MCS_AUTO;
+	struct rt_ht_phy_info *pDesired_ht_phy = NULL;
+	u8 TxStream = pAd->CommonCfg.TxStream;
+	u8 DesiredMcs = MCS_AUTO;
 
-	do
-	{
+	do {
 		{
 			pDesired_ht_phy = &pAd->StaCfg.DesiredHtPhyInfo;
-			DesiredMcs = pAd->StaCfg.DesiredTransmitSetting.field.MCS;
-			//pAd->StaCfg.bAutoTxRateSwitch = (DesiredMcs == MCS_AUTO) ? TRUE : FALSE;
-				break;
+			DesiredMcs =
+			    pAd->StaCfg.DesiredTransmitSetting.field.MCS;
+			/*pAd->StaCfg.bAutoTxRateSwitch = (DesiredMcs == MCS_AUTO) ? TRUE : FALSE; */
+			break;
 		}
 	} while (FALSE);
 
-	if (pDesired_ht_phy == NULL)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("RTMPSetIndividualHT: invalid apidx(%d)\n", apidx));
+	if (pDesired_ht_phy == NULL) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("RTMPSetIndividualHT: invalid apidx(%d)\n", apidx));
 		return;
 	}
-	RTMPZeroMemory(pDesired_ht_phy, sizeof(RT_HT_PHY_INFO));
+	RTMPZeroMemory(pDesired_ht_phy, sizeof(struct rt_ht_phy_info));
 
-	DBGPRINT(RT_DEBUG_TRACE, ("RTMPSetIndividualHT : Desired MCS = %d\n", DesiredMcs));
-	// Check the validity of MCS
-	if ((TxStream == 1) && ((DesiredMcs >= MCS_8) && (DesiredMcs <= MCS_15)))
-	{
-		DBGPRINT(RT_DEBUG_WARN, ("RTMPSetIndividualHT: MCS(%d) is invalid in 1S, reset it as MCS_7\n", DesiredMcs));
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("RTMPSetIndividualHT : Desired MCS = %d\n", DesiredMcs));
+	/* Check the validity of MCS */
+	if ((TxStream == 1)
+	    && ((DesiredMcs >= MCS_8) && (DesiredMcs <= MCS_15))) {
+		DBGPRINT(RT_DEBUG_WARN,
+			 ("RTMPSetIndividualHT: MCS(%d) is invalid in 1S, reset it as MCS_7\n",
+			  DesiredMcs));
 		DesiredMcs = MCS_7;
 	}
 
-	if ((pAd->CommonCfg.DesiredHtPhy.ChannelWidth == BW_20) && (DesiredMcs == MCS_32))
-	{
-		DBGPRINT(RT_DEBUG_WARN, ("RTMPSetIndividualHT: MCS_32 is only supported in 40-MHz, reset it as MCS_0\n"));
+	if ((pAd->CommonCfg.DesiredHtPhy.ChannelWidth == BW_20)
+	    && (DesiredMcs == MCS_32)) {
+		DBGPRINT(RT_DEBUG_WARN,
+			 ("RTMPSetIndividualHT: MCS_32 is only supported in 40-MHz, reset it as MCS_0\n"));
 		DesiredMcs = MCS_0;
 	}
 
 	pDesired_ht_phy->bHtEnable = TRUE;
 
-	// Decide desired Tx MCS
-	switch (TxStream)
-	{
-		case 1:
-			if (DesiredMcs == MCS_AUTO)
-			{
-				pDesired_ht_phy->MCSSet[0]= 0xff;
-				pDesired_ht_phy->MCSSet[1]= 0x00;
-			}
-			else if (DesiredMcs <= MCS_7)
-			{
-				pDesired_ht_phy->MCSSet[0]= 1<<DesiredMcs;
-				pDesired_ht_phy->MCSSet[1]= 0x00;
-			}
-			break;
-
-		case 2:
-			if (DesiredMcs == MCS_AUTO)
-			{
-				pDesired_ht_phy->MCSSet[0]= 0xff;
-				pDesired_ht_phy->MCSSet[1]= 0xff;
-			}
-			else if (DesiredMcs <= MCS_15)
-			{
-				ULONG mode;
-
-				mode = DesiredMcs / 8;
-				if (mode < 2)
-					pDesired_ht_phy->MCSSet[mode] = (1 << (DesiredMcs - mode * 8));
-			}
-			break;
-
-		case 3: // 3*3
-			if (DesiredMcs == MCS_AUTO)
-			{
-				/* MCS0 ~ MCS23, 3 bytes */
-				pDesired_ht_phy->MCSSet[0]= 0xff;
-				pDesired_ht_phy->MCSSet[1]= 0xff;
-				pDesired_ht_phy->MCSSet[2]= 0xff;
-			}
-			else if (DesiredMcs <= MCS_23)
-			{
-				ULONG mode;
-
-				mode = DesiredMcs / 8;
-				if (mode < 3)
-					pDesired_ht_phy->MCSSet[mode] = (1 << (DesiredMcs - mode * 8));
-			}
-			break;
+	/* Decide desired Tx MCS */
+	switch (TxStream) {
+	case 1:
+		if (DesiredMcs == MCS_AUTO) {
+			pDesired_ht_phy->MCSSet[0] = 0xff;
+			pDesired_ht_phy->MCSSet[1] = 0x00;
+		} else if (DesiredMcs <= MCS_7) {
+			pDesired_ht_phy->MCSSet[0] = 1 << DesiredMcs;
+			pDesired_ht_phy->MCSSet[1] = 0x00;
+		}
+		break;
+
+	case 2:
+		if (DesiredMcs == MCS_AUTO) {
+			pDesired_ht_phy->MCSSet[0] = 0xff;
+			pDesired_ht_phy->MCSSet[1] = 0xff;
+		} else if (DesiredMcs <= MCS_15) {
+			unsigned long mode;
+
+			mode = DesiredMcs / 8;
+			if (mode < 2)
+				pDesired_ht_phy->MCSSet[mode] =
+				    (1 << (DesiredMcs - mode * 8));
+		}
+		break;
+
+	case 3:		/* 3*3 */
+		if (DesiredMcs == MCS_AUTO) {
+			/* MCS0 ~ MCS23, 3 bytes */
+			pDesired_ht_phy->MCSSet[0] = 0xff;
+			pDesired_ht_phy->MCSSet[1] = 0xff;
+			pDesired_ht_phy->MCSSet[2] = 0xff;
+		} else if (DesiredMcs <= MCS_23) {
+			unsigned long mode;
+
+			mode = DesiredMcs / 8;
+			if (mode < 3)
+				pDesired_ht_phy->MCSSet[mode] =
+				    (1 << (DesiredMcs - mode * 8));
+		}
+		break;
 	}
 
-	if(pAd->CommonCfg.DesiredHtPhy.ChannelWidth == BW_40)
-	{
+	if (pAd->CommonCfg.DesiredHtPhy.ChannelWidth == BW_40) {
 		if (DesiredMcs == MCS_AUTO || DesiredMcs == MCS_32)
 			pDesired_ht_phy->MCSSet[4] = 0x1;
 	}
-
-	// update HT Rate setting
-    if (pAd->OpMode == OPMODE_STA)
-        MlmeUpdateHtTxRates(pAd, BSS0);
-    else
-	    MlmeUpdateHtTxRates(pAd, apidx);
+	/* update HT Rate setting */
+	if (pAd->OpMode == OPMODE_STA)
+		MlmeUpdateHtTxRates(pAd, BSS0);
+	else
+		MlmeUpdateHtTxRates(pAd, apidx);
 }
 
-
 /*
 	========================================================================
 	Routine Description:
@@ -1595,36 +753,34 @@ VOID	RTMPSetIndividualHT(
 	Arguments:
 		Send all HT IE in beacon/probe rsp/assoc rsp/action frame.
 
-
 	========================================================================
 */
-VOID	RTMPUpdateHTIE(
-	IN	RT_HT_CAPABILITY	*pRtHt,
-	IN		UCHAR				*pMcsSet,
-	OUT		HT_CAPABILITY_IE *pHtCapability,
-	OUT		ADD_HT_INFO_IE		*pAddHtInfo)
-{
-	RTMPZeroMemory(pHtCapability, sizeof(HT_CAPABILITY_IE));
-	RTMPZeroMemory(pAddHtInfo, sizeof(ADD_HT_INFO_IE));
-
-		pHtCapability->HtCapInfo.ChannelWidth = pRtHt->ChannelWidth;
-		pHtCapability->HtCapInfo.MimoPs = pRtHt->MimoPs;
-		pHtCapability->HtCapInfo.GF = pRtHt->GF;
-		pHtCapability->HtCapInfo.ShortGIfor20 = pRtHt->ShortGIfor20;
-		pHtCapability->HtCapInfo.ShortGIfor40 = pRtHt->ShortGIfor40;
-		pHtCapability->HtCapInfo.TxSTBC = pRtHt->TxSTBC;
-		pHtCapability->HtCapInfo.RxSTBC = pRtHt->RxSTBC;
-		pHtCapability->HtCapInfo.AMsduSize = pRtHt->AmsduSize;
-		pHtCapability->HtCapParm.MaxRAmpduFactor = pRtHt->MaxRAmpduFactor;
-		pHtCapability->HtCapParm.MpduDensity = pRtHt->MpduDensity;
-
-		pAddHtInfo->AddHtInfo.ExtChanOffset = pRtHt->ExtChanOffset ;
-		pAddHtInfo->AddHtInfo.RecomWidth = pRtHt->RecomWidth;
-		pAddHtInfo->AddHtInfo2.OperaionMode = pRtHt->OperaionMode;
-		pAddHtInfo->AddHtInfo2.NonGfPresent = pRtHt->NonGfPresent;
-		RTMPMoveMemory(pAddHtInfo->MCSSet, /*pRtHt->MCSSet*/pMcsSet, 4); // rt2860 only support MCS max=32, no need to copy all 16 uchar.
-
-        DBGPRINT(RT_DEBUG_TRACE,("RTMPUpdateHTIE <== \n"));
+void RTMPUpdateHTIE(struct rt_ht_capability *pRtHt,
+		    u8 * pMcsSet,
+		    struct rt_ht_capability_ie * pHtCapability,
+		    struct rt_add_ht_info_ie * pAddHtInfo)
+{
+	RTMPZeroMemory(pHtCapability, sizeof(struct rt_ht_capability_ie));
+	RTMPZeroMemory(pAddHtInfo, sizeof(struct rt_add_ht_info_ie));
+
+	pHtCapability->HtCapInfo.ChannelWidth = pRtHt->ChannelWidth;
+	pHtCapability->HtCapInfo.MimoPs = pRtHt->MimoPs;
+	pHtCapability->HtCapInfo.GF = pRtHt->GF;
+	pHtCapability->HtCapInfo.ShortGIfor20 = pRtHt->ShortGIfor20;
+	pHtCapability->HtCapInfo.ShortGIfor40 = pRtHt->ShortGIfor40;
+	pHtCapability->HtCapInfo.TxSTBC = pRtHt->TxSTBC;
+	pHtCapability->HtCapInfo.RxSTBC = pRtHt->RxSTBC;
+	pHtCapability->HtCapInfo.AMsduSize = pRtHt->AmsduSize;
+	pHtCapability->HtCapParm.MaxRAmpduFactor = pRtHt->MaxRAmpduFactor;
+	pHtCapability->HtCapParm.MpduDensity = pRtHt->MpduDensity;
+
+	pAddHtInfo->AddHtInfo.ExtChanOffset = pRtHt->ExtChanOffset;
+	pAddHtInfo->AddHtInfo.RecomWidth = pRtHt->RecomWidth;
+	pAddHtInfo->AddHtInfo2.OperaionMode = pRtHt->OperaionMode;
+	pAddHtInfo->AddHtInfo2.NonGfPresent = pRtHt->NonGfPresent;
+	RTMPMoveMemory(pAddHtInfo->MCSSet, /*pRtHt->MCSSet */ pMcsSet, 4);	/* rt2860 only support MCS max=32, no need to copy all 16 uchar. */
+
+	DBGPRINT(RT_DEBUG_TRACE, ("RTMPUpdateHTIE <== \n"));
 }
 
 /*
@@ -1634,78 +790,71 @@ VOID	RTMPUpdateHTIE(
     Return:
 	========================================================================
 */
-VOID	RTMPAddWcidAttributeEntry(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			BssIdx,
-	IN 	UCHAR		 	KeyIdx,
-	IN 	UCHAR		 	CipherAlg,
-	IN 	MAC_TABLE_ENTRY *pEntry)
+void RTMPAddWcidAttributeEntry(struct rt_rtmp_adapter *pAd,
+			       u8 BssIdx,
+			       u8 KeyIdx,
+			       u8 CipherAlg, struct rt_mac_table_entry *pEntry)
 {
-	UINT32		WCIDAttri = 0;
-	USHORT		offset;
-	UCHAR		IVEIV = 0;
-	USHORT		Wcid = 0;
+	u32 WCIDAttri = 0;
+	u16 offset;
+	u8 IVEIV = 0;
+	u16 Wcid = 0;
 
 	{
 		{
-			if (BssIdx > BSS0)
-			{
-				DBGPRINT(RT_DEBUG_ERROR, ("RTMPAddWcidAttributeEntry: The BSS-index(%d) is out of range for Infra link. \n", BssIdx));
+			if (BssIdx > BSS0) {
+				DBGPRINT(RT_DEBUG_ERROR,
+					 ("RTMPAddWcidAttributeEntry: The BSS-index(%d) is out of range for Infra link. \n",
+					  BssIdx));
 				return;
 			}
-
-			// 1.	In ADHOC mode, the AID is wcid number. And NO mesh link exists.
-			// 2.	In Infra mode, the AID:1 MUST be wcid of infra STA.
-			//					   the AID:2~ assign to mesh link entry.
-			if (pEntry && ADHOC_ON(pAd))
+			/* 1.   In ADHOC mode, the AID is wcid number. And NO mesh link exists. */
+			/* 2.   In Infra mode, the AID:1 MUST be wcid of infra STA. */
+			/*                                         the AID:2~ assign to mesh link entry. */
+			if (pEntry)
 				Wcid = pEntry->Aid;
-			else if (pEntry && INFRA_ON(pAd))
-			{
-				Wcid = BSSID_WCID;
-			}
 			else
 				Wcid = MCAST_WCID;
 		}
 	}
 
-	// Update WCID attribute table
+	/* Update WCID attribute table */
 	offset = MAC_WCID_ATTRIBUTE_BASE + (Wcid * HW_WCID_ATTRI_SIZE);
 
 	{
 		if (pEntry && pEntry->ValidAsMesh)
-			WCIDAttri = (CipherAlg<<1) | PAIRWISEKEYTABLE;
+			WCIDAttri = (CipherAlg << 1) | PAIRWISEKEYTABLE;
 		else
-			WCIDAttri = (CipherAlg<<1) | SHAREDKEYTABLE;
+			WCIDAttri = (CipherAlg << 1) | SHAREDKEYTABLE;
 	}
 
 	RTMP_IO_WRITE32(pAd, offset, WCIDAttri);
 
-
-	// Update IV/EIV table
+	/* Update IV/EIV table */
 	offset = MAC_IVEIV_TABLE_BASE + (Wcid * HW_IVEIV_ENTRY_SIZE);
 
-	// WPA mode
-	if ((CipherAlg == CIPHER_TKIP) || (CipherAlg == CIPHER_TKIP_NO_MIC) || (CipherAlg == CIPHER_AES))
-	{
-		// Eiv bit on. keyid always is 0 for pairwise key
-		IVEIV = (KeyIdx <<6) | 0x20;
-	}
-	else
-	{
-		// WEP KeyIdx is default tx key.
+	/* WPA mode */
+	if ((CipherAlg == CIPHER_TKIP) || (CipherAlg == CIPHER_TKIP_NO_MIC)
+	    || (CipherAlg == CIPHER_AES)) {
+		/* Eiv bit on. keyid always is 0 for pairwise key */
+		IVEIV = (KeyIdx << 6) | 0x20;
+	} else {
+		/* WEP KeyIdx is default tx key. */
 		IVEIV = (KeyIdx << 6);
 	}
 
-	// For key index and ext IV bit, so only need to update the position(offset+3).
-#ifdef RT2860
-	RTMP_IO_WRITE8(pAd, offset+3, IVEIV);
-#endif
-#ifdef RT2870
-	RTUSBMultiWrite_OneByte(pAd, offset+3, &IVEIV);
-#endif // RT2870 //
+	/* For key index and ext IV bit, so only need to update the position(offset+3). */
+#ifdef RTMP_MAC_PCI
+	RTMP_IO_WRITE8(pAd, offset + 3, IVEIV);
+#endif /* RTMP_MAC_PCI // */
+#ifdef RTMP_MAC_USB
+	RTUSBMultiWrite_OneByte(pAd, offset + 3, &IVEIV);
+#endif /* RTMP_MAC_USB // */
 
-	DBGPRINT(RT_DEBUG_TRACE,("RTMPAddWcidAttributeEntry: WCID #%d, KeyIndex #%d, Alg=%s\n",Wcid, KeyIdx, CipherName[CipherAlg]));
-	DBGPRINT(RT_DEBUG_TRACE,("	WCIDAttri = 0x%x \n",  WCIDAttri));
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("RTMPAddWcidAttributeEntry: WCID #%d, KeyIndex #%d, Alg=%s\n",
+		  Wcid, KeyIdx, CipherName[CipherAlg]));
+	DBGPRINT(RT_DEBUG_TRACE, ("	WCIDAttri = 0x%x \n", WCIDAttri));
 
 }
 
@@ -1723,1524 +872,84 @@ Arguments:
     Note:
     ==========================================================================
 */
-CHAR *GetEncryptType(CHAR enc)
-{
-    if(enc == Ndis802_11WEPDisabled)
-        return "NONE";
-    if(enc == Ndis802_11WEPEnabled)
-    	return "WEP";
-    if(enc == Ndis802_11Encryption2Enabled)
-    	return "TKIP";
-    if(enc == Ndis802_11Encryption3Enabled)
-    	return "AES";
-	if(enc == Ndis802_11Encryption4Enabled)
-    	return "TKIPAES";
-    else
-    	return "UNKNOW";
-}
-
-CHAR *GetAuthMode(CHAR auth)
-{
-    if(auth == Ndis802_11AuthModeOpen)
-    	return "OPEN";
-    if(auth == Ndis802_11AuthModeShared)
-    	return "SHARED";
-	if(auth == Ndis802_11AuthModeAutoSwitch)
-    	return "AUTOWEP";
-    if(auth == Ndis802_11AuthModeWPA)
-    	return "WPA";
-    if(auth == Ndis802_11AuthModeWPAPSK)
-    	return "WPAPSK";
-    if(auth == Ndis802_11AuthModeWPANone)
-    	return "WPANONE";
-    if(auth == Ndis802_11AuthModeWPA2)
-    	return "WPA2";
-    if(auth == Ndis802_11AuthModeWPA2PSK)
-    	return "WPA2PSK";
-	if(auth == Ndis802_11AuthModeWPA1WPA2)
-    	return "WPA1WPA2";
-	if(auth == Ndis802_11AuthModeWPA1PSKWPA2PSK)
-    	return "WPA1PSKWPA2PSK";
-
-    	return "UNKNOW";
-}
-
-/*
-    ==========================================================================
-    Description:
-        Get site survey results
-	Arguments:
-	    pAdapter                    Pointer to our adapter
-	    wrq                         Pointer to the ioctl argument
-
-    Return Value:
-        None
-
-    Note:
-        Usage:
-        		1.) UI needs to wait 4 seconds after issue a site survey command
-        		2.) iwpriv ra0 get_site_survey
-        		3.) UI needs to prepare at least 4096bytes to get the results
-    ==========================================================================
-*/
-#define	LINE_LEN	(4+33+20+8+10+9+7+3)	// Channel+SSID+Bssid+WepStatus+AuthMode+Signal+WiressMode+NetworkType
-VOID RTMPIoctlGetSiteSurvey(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq)
-{
-	CHAR		*msg;
-	INT 		i=0;
-	INT			WaitCnt;
-	INT 		Status=0;
-	CHAR		Ssid[MAX_LEN_OF_SSID +1];
-    INT         Rssi = 0, max_len = LINE_LEN;
-	UINT        Rssi_Quality = 0;
-	NDIS_802_11_NETWORK_TYPE    wireless_mode;
-
-	os_alloc_mem(NULL, (PUCHAR *)&msg, sizeof(CHAR)*((MAX_LEN_OF_BSS_TABLE)*max_len));
-
-	if (msg == NULL)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("RTMPIoctlGetSiteSurvey - msg memory alloc fail.\n"));
-		return;
-	}
-
-	memset(msg, 0 ,(MAX_LEN_OF_BSS_TABLE)*max_len );
-	memset(Ssid, 0 ,(MAX_LEN_OF_SSID +1));
-	sprintf(msg,"%s","\n");
-	sprintf(msg+strlen(msg),"%-4s%-33s%-20s%-8s%-10s%-9s%-7s%-3s\n",
-	    "Ch", "SSID", "BSSID", "Enc", "Auth", "Siganl(%)", "W-Mode", " NT");
-
-	WaitCnt = 0;
-	pAdapter->StaCfg.bScanReqIsFromWebUI = TRUE;
-
-	while ((ScanRunning(pAdapter) == TRUE) && (WaitCnt++ < 200))
-		OS_WAIT(500);
-
-	for(i=0; i<pAdapter->ScanTab.BssNr ;i++)
-	{
-		if( pAdapter->ScanTab.BssEntry[i].Channel==0)
-			break;
-
-		if((strlen(msg)+max_len ) >= IW_SCAN_MAX_DATA)
-			break;
-
-		//Channel
-		sprintf(msg+strlen(msg),"%-4d", pAdapter->ScanTab.BssEntry[i].Channel);
-		//SSID
-		memcpy(Ssid, pAdapter->ScanTab.BssEntry[i].Ssid, pAdapter->ScanTab.BssEntry[i].SsidLen);
-		Ssid[pAdapter->ScanTab.BssEntry[i].SsidLen] = '\0';
-		sprintf(msg+strlen(msg),"%-33s", Ssid);
-		//BSSID
-		sprintf(msg+strlen(msg),"%02x:%02x:%02x:%02x:%02x:%02x   ",
-			pAdapter->ScanTab.BssEntry[i].Bssid[0],
-			pAdapter->ScanTab.BssEntry[i].Bssid[1],
-			pAdapter->ScanTab.BssEntry[i].Bssid[2],
-			pAdapter->ScanTab.BssEntry[i].Bssid[3],
-			pAdapter->ScanTab.BssEntry[i].Bssid[4],
-			pAdapter->ScanTab.BssEntry[i].Bssid[5]);
-		//Encryption Type
-		sprintf(msg+strlen(msg),"%-8s",GetEncryptType(pAdapter->ScanTab.BssEntry[i].WepStatus));
-		//Authentication Mode
-		if (pAdapter->ScanTab.BssEntry[i].WepStatus == Ndis802_11WEPEnabled)
-			sprintf(msg+strlen(msg),"%-10s", "UNKNOW");
-		else
-			sprintf(msg+strlen(msg),"%-10s",GetAuthMode(pAdapter->ScanTab.BssEntry[i].AuthMode));
-		// Rssi
-		Rssi = (INT)pAdapter->ScanTab.BssEntry[i].Rssi;
-		if (Rssi >= -50)
-			Rssi_Quality = 100;
-		else if (Rssi >= -80)    // between -50 ~ -80dbm
-			Rssi_Quality = (UINT)(24 + ((Rssi + 80) * 26)/10);
-		else if (Rssi >= -90)   // between -80 ~ -90dbm
-			Rssi_Quality = (UINT)(((Rssi + 90) * 26)/10);
-		else    // < -84 dbm
-			Rssi_Quality = 0;
-		sprintf(msg+strlen(msg),"%-9d", Rssi_Quality);
-		// Wireless Mode
-		wireless_mode = NetworkTypeInUseSanity(&pAdapter->ScanTab.BssEntry[i]);
-		if (wireless_mode == Ndis802_11FH ||
-			wireless_mode == Ndis802_11DS)
-			sprintf(msg+strlen(msg),"%-7s", "11b");
-		else if (wireless_mode == Ndis802_11OFDM5)
-			sprintf(msg+strlen(msg),"%-7s", "11a");
-		else if (wireless_mode == Ndis802_11OFDM5_N)
-			sprintf(msg+strlen(msg),"%-7s", "11a/n");
-		else if (wireless_mode == Ndis802_11OFDM24)
-			sprintf(msg+strlen(msg),"%-7s", "11b/g");
-		else if (wireless_mode == Ndis802_11OFDM24_N)
-			sprintf(msg+strlen(msg),"%-7s", "11b/g/n");
-		else
-			sprintf(msg+strlen(msg),"%-7s", "unknow");
-		//Network Type
-		if (pAdapter->ScanTab.BssEntry[i].BssType == BSS_ADHOC)
-			sprintf(msg+strlen(msg),"%-3s", " Ad");
-		else
-			sprintf(msg+strlen(msg),"%-3s", " In");
-
-        sprintf(msg+strlen(msg),"\n");
-	}
-
-	pAdapter->StaCfg.bScanReqIsFromWebUI = FALSE;
-	wrq->u.data.length = strlen(msg);
-	Status = copy_to_user(wrq->u.data.pointer, msg, wrq->u.data.length);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("RTMPIoctlGetSiteSurvey - wrq->u.data.length = %d\n", wrq->u.data.length));
-	os_free_mem(NULL, (PUCHAR)msg);
-}
-
-
-#define	MAC_LINE_LEN	(14+4+4+10+10+10+6+6)	// Addr+aid+psm+datatime+rxbyte+txbyte+current tx rate+last tx rate
-VOID RTMPIoctlGetMacTable(
-	IN PRTMP_ADAPTER pAd,
-	IN struct iwreq *wrq)
-{
-	INT i;
-	RT_802_11_MAC_TABLE MacTab;
-	char *msg;
-
-	MacTab.Num = 0;
-	for (i=0; i<MAX_LEN_OF_MAC_TABLE; i++)
-	{
-		if (pAd->MacTab.Content[i].ValidAsCLI && (pAd->MacTab.Content[i].Sst == SST_ASSOC))
-		{
-			COPY_MAC_ADDR(MacTab.Entry[MacTab.Num].Addr, &pAd->MacTab.Content[i].Addr);
-			MacTab.Entry[MacTab.Num].Aid = (UCHAR)pAd->MacTab.Content[i].Aid;
-			MacTab.Entry[MacTab.Num].Psm = pAd->MacTab.Content[i].PsMode;
-			MacTab.Entry[MacTab.Num].MimoPs = pAd->MacTab.Content[i].MmpsMode;
-
-			// Fill in RSSI per entry
-			MacTab.Entry[MacTab.Num].AvgRssi0 = pAd->MacTab.Content[i].RssiSample.AvgRssi0;
-			MacTab.Entry[MacTab.Num].AvgRssi1 = pAd->MacTab.Content[i].RssiSample.AvgRssi1;
-			MacTab.Entry[MacTab.Num].AvgRssi2 = pAd->MacTab.Content[i].RssiSample.AvgRssi2;
-
-			// the connected time per entry
-			MacTab.Entry[MacTab.Num].ConnectedTime = pAd->MacTab.Content[i].StaConnectTime;
-			MacTab.Entry[MacTab.Num].TxRate.field.MCS = pAd->MacTab.Content[i].HTPhyMode.field.MCS;
-			MacTab.Entry[MacTab.Num].TxRate.field.BW = pAd->MacTab.Content[i].HTPhyMode.field.BW;
-			MacTab.Entry[MacTab.Num].TxRate.field.ShortGI = pAd->MacTab.Content[i].HTPhyMode.field.ShortGI;
-			MacTab.Entry[MacTab.Num].TxRate.field.STBC = pAd->MacTab.Content[i].HTPhyMode.field.STBC;
-			MacTab.Entry[MacTab.Num].TxRate.field.rsv = pAd->MacTab.Content[i].HTPhyMode.field.rsv;
-			MacTab.Entry[MacTab.Num].TxRate.field.MODE = pAd->MacTab.Content[i].HTPhyMode.field.MODE;
-			MacTab.Entry[MacTab.Num].TxRate.word = pAd->MacTab.Content[i].HTPhyMode.word;
-
-			MacTab.Num += 1;
-		}
-	}
-	wrq->u.data.length = sizeof(RT_802_11_MAC_TABLE);
-	if (copy_to_user(wrq->u.data.pointer, &MacTab, wrq->u.data.length))
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("%s: copy_to_user() fail\n", __func__));
-	}
-
-	msg = (CHAR *) kmalloc(sizeof(CHAR)*(MAX_LEN_OF_MAC_TABLE*MAC_LINE_LEN), MEM_ALLOC_FLAG);
-	memset(msg, 0 ,MAX_LEN_OF_MAC_TABLE*MAC_LINE_LEN );
-	sprintf(msg,"%s","\n");
-	sprintf(msg+strlen(msg),"%-14s%-4s%-4s%-10s%-10s%-10s%-6s%-6s\n",
-		"MAC", "AID", "PSM", "LDT", "RxB", "TxB","CTxR", "LTxR");
-
-	for (i=0; i<MAX_LEN_OF_MAC_TABLE; i++)
-	{
-		PMAC_TABLE_ENTRY pEntry = &pAd->MacTab.Content[i];
-		if (pEntry->ValidAsCLI && (pEntry->Sst == SST_ASSOC))
-		{
-			if((strlen(msg)+MAC_LINE_LEN ) >= (MAX_LEN_OF_MAC_TABLE*MAC_LINE_LEN) )
-				break;
-			sprintf(msg+strlen(msg),"%02x%02x%02x%02x%02x%02x  ",
-				pEntry->Addr[0], pEntry->Addr[1], pEntry->Addr[2],
-				pEntry->Addr[3], pEntry->Addr[4], pEntry->Addr[5]);
-			sprintf(msg+strlen(msg),"%-4d", (int)pEntry->Aid);
-			sprintf(msg+strlen(msg),"%-4d", (int)pEntry->PsMode);
-			sprintf(msg+strlen(msg),"%-10d",0/*pAd->MacTab.Content[i].HSCounter.LastDataPacketTime*/); // ToDo
-			sprintf(msg+strlen(msg),"%-10d",0/*pAd->MacTab.Content[i].HSCounter.TotalRxByteCount*/); // ToDo
-			sprintf(msg+strlen(msg),"%-10d",0/*pAd->MacTab.Content[i].HSCounter.TotalTxByteCount*/); // ToDo
-			sprintf(msg+strlen(msg),"%-6d",RateIdToMbps[pAd->MacTab.Content[i].CurrTxRate]);
-			sprintf(msg+strlen(msg),"%-6d\n",0/*RateIdToMbps[pAd->MacTab.Content[i].LastTxRate]*/); // ToDo
-		}
-	}
-	// for compatible with old API just do the printk to console
-	//wrq->u.data.length = strlen(msg);
-	//if (copy_to_user(wrq->u.data.pointer, msg, wrq->u.data.length))
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("%s", msg));
-	}
-
-	kfree(msg);
-}
-
-INT	Set_BASetup_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
-    UCHAR mac[6], tid;
-	char *token, sepValue[] = ":", DASH = '-';
-	INT i;
-    MAC_TABLE_ENTRY *pEntry;
-
-/*
-	The BASetup inupt string format should be xx:xx:xx:xx:xx:xx-d,
-		=>The six 2 digit hex-decimal number previous are the Mac address,
-		=>The seventh decimal number is the tid value.
-*/
-
-	if(strlen(arg) < 19)  //Mac address acceptable format 01:02:03:04:05:06 length 17 plus the "-" and tid value in decimal format.
-		return FALSE;
-
-	token = strchr(arg, DASH);
-	if ((token != NULL) && (strlen(token)>1))
-	{
-		tid = simple_strtol((token+1), 0, 10);
-		if (tid > 15)
-			return FALSE;
-
-		*token = '\0';
-		for (i = 0, token = rstrtok(arg, &sepValue[0]); token; token = rstrtok(NULL, &sepValue[0]), i++)
-		{
-			if((strlen(token) != 2) || (!isxdigit(*token)) || (!isxdigit(*(token+1))))
-				return FALSE;
-			AtoH(token, (PUCHAR)(&mac[i]), 1);
-		}
-		if(i != 6)
-			return FALSE;
-
-		printk("\n%02x:%02x:%02x:%02x:%02x:%02x-%02x\n", mac[0], mac[1],
-				mac[2], mac[3], mac[4], mac[5], tid);
-
-	    pEntry = MacTableLookup(pAd, mac);
-
-    	if (pEntry) {
-        	printk("\nSetup BA Session: Tid = %d\n", tid);
-	        BAOriSessionSetUp(pAd, pEntry, tid, 0, 100, TRUE);
-    	}
-
-		return TRUE;
-	}
-
-	return FALSE;
-
-}
-
-INT	Set_BADecline_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
-	ULONG bBADecline;
-
-	bBADecline = simple_strtol(arg, 0, 10);
-
-	if (bBADecline == 0)
-	{
-		pAd->CommonCfg.bBADecline = FALSE;
-	}
-	else if (bBADecline == 1)
-	{
-		pAd->CommonCfg.bBADecline = TRUE;
-	}
-	else
-	{
-		return FALSE; //Invalid argument
-	}
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_BADecline_Proc::(BADecline=%d)\n", pAd->CommonCfg.bBADecline));
-
-	return TRUE;
-}
-
-INT	Set_BAOriTearDown_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
-    UCHAR mac[6], tid;
-	char *token, sepValue[] = ":", DASH = '-';
-	INT i;
-    MAC_TABLE_ENTRY *pEntry;
-
-/*
-	The BAOriTearDown inupt string format should be xx:xx:xx:xx:xx:xx-d,
-		=>The six 2 digit hex-decimal number previous are the Mac address,
-		=>The seventh decimal number is the tid value.
-*/
-    if(strlen(arg) < 19)  //Mac address acceptable format 01:02:03:04:05:06 length 17 plus the "-" and tid value in decimal format.
-		return FALSE;
-
-	token = strchr(arg, DASH);
-	if ((token != NULL) && (strlen(token)>1))
-	{
-		tid = simple_strtol((token+1), 0, 10);
-		if (tid > NUM_OF_TID)
-			return FALSE;
-
-		*token = '\0';
-		for (i = 0, token = rstrtok(arg, &sepValue[0]); token; token = rstrtok(NULL, &sepValue[0]), i++)
-		{
-			if((strlen(token) != 2) || (!isxdigit(*token)) || (!isxdigit(*(token+1))))
-				return FALSE;
-			AtoH(token, (PUCHAR)(&mac[i]), 1);
-		}
-		if(i != 6)
-			return FALSE;
-
-	    printk("\n%02x:%02x:%02x:%02x:%02x:%02x-%02x", mac[0], mac[1],
-	           mac[2], mac[3], mac[4], mac[5], tid);
-
-	    pEntry = MacTableLookup(pAd, mac);
-
-	    if (pEntry) {
-	        printk("\nTear down Ori BA Session: Tid = %d\n", tid);
-        BAOriSessionTearDown(pAd, pEntry->Aid, tid, FALSE, TRUE);
-	    }
-
-		return TRUE;
-	}
-
-	return FALSE;
-
-}
-
-INT	Set_BARecTearDown_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
-    UCHAR mac[6], tid;
-	char *token, sepValue[] = ":", DASH = '-';
-	INT i;
-    MAC_TABLE_ENTRY *pEntry;
-
-    //printk("\n%s\n", arg);
-/*
-	The BARecTearDown inupt string format should be xx:xx:xx:xx:xx:xx-d,
-		=>The six 2 digit hex-decimal number previous are the Mac address,
-		=>The seventh decimal number is the tid value.
-*/
-    if(strlen(arg) < 19)  //Mac address acceptable format 01:02:03:04:05:06 length 17 plus the "-" and tid value in decimal format.
-		return FALSE;
-
-	token = strchr(arg, DASH);
-	if ((token != NULL) && (strlen(token)>1))
-	{
-		tid = simple_strtol((token+1), 0, 10);
-		if (tid > NUM_OF_TID)
-			return FALSE;
-
-		*token = '\0';
-		for (i = 0, token = rstrtok(arg, &sepValue[0]); token; token = rstrtok(NULL, &sepValue[0]), i++)
-		{
-			if((strlen(token) != 2) || (!isxdigit(*token)) || (!isxdigit(*(token+1))))
-				return FALSE;
-			AtoH(token, (PUCHAR)(&mac[i]), 1);
-		}
-		if(i != 6)
-			return FALSE;
-
-		printk("\n%02x:%02x:%02x:%02x:%02x:%02x-%02x", mac[0], mac[1],
-		       mac[2], mac[3], mac[4], mac[5], tid);
-
-		pEntry = MacTableLookup(pAd, mac);
-
-		if (pEntry) {
-		    printk("\nTear down Rec BA Session: Tid = %d\n", tid);
-		    BARecSessionTearDown(pAd, pEntry->Aid, tid, FALSE);
-		}
-
-		return TRUE;
-	}
-
-	return FALSE;
-
-}
-
-INT	Set_HtBw_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
-	ULONG HtBw;
-
-	HtBw = simple_strtol(arg, 0, 10);
-	if (HtBw == BW_40)
-		pAd->CommonCfg.RegTransmitSetting.field.BW  = BW_40;
-	else if (HtBw == BW_20)
-		pAd->CommonCfg.RegTransmitSetting.field.BW  = BW_20;
-	else
-		return FALSE;  //Invalid argument
-
-	SetCommonHT(pAd);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_HtBw_Proc::(HtBw=%d)\n", pAd->CommonCfg.RegTransmitSetting.field.BW));
-
-	return TRUE;
-}
-
-INT	Set_HtMcs_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
-	ULONG HtMcs, Mcs_tmp;
-    BOOLEAN bAutoRate = FALSE;
-
-	Mcs_tmp = simple_strtol(arg, 0, 10);
-
-	if (Mcs_tmp <= 15 || Mcs_tmp == 32)
-		HtMcs = Mcs_tmp;
-	else
-		HtMcs = MCS_AUTO;
-
-	{
-		pAd->StaCfg.DesiredTransmitSetting.field.MCS = HtMcs;
-		pAd->StaCfg.bAutoTxRateSwitch = (HtMcs == MCS_AUTO) ? TRUE:FALSE;
-		DBGPRINT(RT_DEBUG_TRACE, ("Set_HtMcs_Proc::(HtMcs=%d, bAutoTxRateSwitch = %d)\n",
-						pAd->StaCfg.DesiredTransmitSetting.field.MCS, pAd->StaCfg.bAutoTxRateSwitch));
-
-		if ((pAd->CommonCfg.PhyMode < PHY_11ABGN_MIXED) ||
-			(pAd->MacTab.Content[BSSID_WCID].HTPhyMode.field.MODE < MODE_HTMIX))
-		{
-	        if ((pAd->StaCfg.DesiredTransmitSetting.field.MCS != MCS_AUTO) &&
-				(HtMcs >= 0 && HtMcs <= 3) &&
-	            (pAd->StaCfg.DesiredTransmitSetting.field.FixedTxMode == FIXED_TXMODE_CCK))
-			{
-				RTMPSetDesiredRates(pAd, (LONG) (RateIdToMbps[HtMcs] * 1000000));
-			}
-	        else if ((pAd->StaCfg.DesiredTransmitSetting.field.MCS != MCS_AUTO) &&
-					(HtMcs >= 0 && HtMcs <= 7) &&
-	            	(pAd->StaCfg.DesiredTransmitSetting.field.FixedTxMode == FIXED_TXMODE_OFDM))
-			{
-				RTMPSetDesiredRates(pAd, (LONG) (RateIdToMbps[HtMcs+4] * 1000000));
-			}
-			else
-				bAutoRate = TRUE;
-
-			if (bAutoRate)
-			{
-	            pAd->StaCfg.DesiredTransmitSetting.field.MCS = MCS_AUTO;
-				RTMPSetDesiredRates(pAd, -1);
-			}
-	        DBGPRINT(RT_DEBUG_TRACE, ("Set_HtMcs_Proc::(FixedTxMode=%d)\n",pAd->StaCfg.DesiredTransmitSetting.field.FixedTxMode));
-		}
-        if (ADHOC_ON(pAd))
-            return TRUE;
-	}
-
-	SetCommonHT(pAd);
-
-	return TRUE;
-}
-
-INT	Set_HtGi_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
-	ULONG HtGi;
-
-	HtGi = simple_strtol(arg, 0, 10);
-
-	if ( HtGi == GI_400)
-		pAd->CommonCfg.RegTransmitSetting.field.ShortGI = GI_400;
-	else if ( HtGi == GI_800 )
-		pAd->CommonCfg.RegTransmitSetting.field.ShortGI = GI_800;
-	else
-		return FALSE; //Invalid argument
-
-	SetCommonHT(pAd);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_HtGi_Proc::(ShortGI=%d)\n",pAd->CommonCfg.RegTransmitSetting.field.ShortGI));
-
-	return TRUE;
-}
-
-
-INT	Set_HtTxBASize_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
-	UCHAR Size;
-
-	Size = simple_strtol(arg, 0, 10);
-
-	if (Size <=0 || Size >=64)
-	{
-		Size = 8;
-	}
-	pAd->CommonCfg.TxBASize = Size-1;
-	DBGPRINT(RT_DEBUG_ERROR, ("Set_HtTxBASize ::(TxBASize= %d)\n", Size));
-
-	return TRUE;
-}
-
-
-INT	Set_HtOpMode_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
-
-	ULONG Value;
-
-	Value = simple_strtol(arg, 0, 10);
-
-	if (Value == HTMODE_GF)
-		pAd->CommonCfg.RegTransmitSetting.field.HTMODE  = HTMODE_GF;
-	else if ( Value == HTMODE_MM )
-		pAd->CommonCfg.RegTransmitSetting.field.HTMODE  = HTMODE_MM;
-	else
-		return FALSE; //Invalid argument
-
-	SetCommonHT(pAd);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_HtOpMode_Proc::(HtOpMode=%d)\n",pAd->CommonCfg.RegTransmitSetting.field.HTMODE));
-
-	return TRUE;
-
-}
-
-INT	Set_HtStbc_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
-
-	ULONG Value;
-
-	Value = simple_strtol(arg, 0, 10);
-
-	if (Value == STBC_USE)
-		pAd->CommonCfg.RegTransmitSetting.field.STBC = STBC_USE;
-	else if ( Value == STBC_NONE )
-		pAd->CommonCfg.RegTransmitSetting.field.STBC = STBC_NONE;
-	else
-		return FALSE; //Invalid argument
-
-	SetCommonHT(pAd);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_Stbc_Proc::(HtStbc=%d)\n",pAd->CommonCfg.RegTransmitSetting.field.STBC));
-
-	return TRUE;
-}
-
-INT	Set_HtHtc_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
-
-	ULONG Value;
-
-	Value = simple_strtol(arg, 0, 10);
-	if (Value == 0)
-		pAd->HTCEnable = FALSE;
-	else if ( Value ==1 )
-        	pAd->HTCEnable = TRUE;
-	else
-		return FALSE; //Invalid argument
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_HtHtc_Proc::(HtHtc=%d)\n",pAd->HTCEnable));
-
-	return TRUE;
-}
-
-INT	Set_HtExtcha_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
-
-	ULONG Value;
-
-	Value = simple_strtol(arg, 0, 10);
-
-	if (Value == 0)
-		pAd->CommonCfg.RegTransmitSetting.field.EXTCHA  = EXTCHA_BELOW;
-	else if ( Value ==1 )
-        pAd->CommonCfg.RegTransmitSetting.field.EXTCHA = EXTCHA_ABOVE;
-	else
-		return FALSE; //Invalid argument
-
-	SetCommonHT(pAd);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_HtExtcha_Proc::(HtExtcha=%d)\n",pAd->CommonCfg.RegTransmitSetting.field.EXTCHA));
-
-	return TRUE;
-}
-
-INT	Set_HtMpduDensity_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
-	ULONG Value;
-
-	Value = simple_strtol(arg, 0, 10);
-
-	if (Value <=7 && Value >= 0)
-		pAd->CommonCfg.BACapability.field.MpduDensity = Value;
-	else
-		pAd->CommonCfg.BACapability.field.MpduDensity = 4;
-
-	SetCommonHT(pAd);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_HtMpduDensity_Proc::(HtMpduDensity=%d)\n",pAd->CommonCfg.BACapability.field.MpduDensity));
-
-	return TRUE;
-}
-
-INT	Set_HtBaWinSize_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
-	ULONG Value;
-
-	Value = simple_strtol(arg, 0, 10);
-
-
-	if (Value >=1 && Value <= 64)
-	{
-		pAd->CommonCfg.REGBACapability.field.RxBAWinLimit = Value;
-		pAd->CommonCfg.BACapability.field.RxBAWinLimit = Value;
-	}
-	else
-	{
-        pAd->CommonCfg.REGBACapability.field.RxBAWinLimit = 64;
-		pAd->CommonCfg.BACapability.field.RxBAWinLimit = 64;
-	}
-
-	SetCommonHT(pAd);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_HtBaWinSize_Proc::(HtBaWinSize=%d)\n",pAd->CommonCfg.BACapability.field.RxBAWinLimit));
-
-	return TRUE;
-}
-
-INT	Set_HtRdg_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
-	ULONG Value;
-
-	Value = simple_strtol(arg, 0, 10);
-
-	if (Value == 0)
-		pAd->CommonCfg.bRdg = FALSE;
-	else if ( Value ==1 )
-	{
-		pAd->HTCEnable = TRUE;
-        	pAd->CommonCfg.bRdg = TRUE;
-	}
-	else
-		return FALSE; //Invalid argument
-
-	SetCommonHT(pAd);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_HtRdg_Proc::(HtRdg=%d)\n",pAd->CommonCfg.bRdg));
-
-	return TRUE;
-}
-
-INT	Set_HtLinkAdapt_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
-	ULONG Value;
-
-	Value = simple_strtol(arg, 0, 10);
-	if (Value == 0)
-		pAd->bLinkAdapt = FALSE;
-	else if ( Value ==1 )
-	{
-			pAd->HTCEnable = TRUE;
-			pAd->bLinkAdapt = TRUE;
-	}
-	else
-		return FALSE; //Invalid argument
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_HtLinkAdapt_Proc::(HtLinkAdapt=%d)\n",pAd->bLinkAdapt));
-
-	return TRUE;
-}
-
-INT	Set_HtAmsdu_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
-	ULONG Value;
-
-	Value = simple_strtol(arg, 0, 10);
-	if (Value == 0)
-		pAd->CommonCfg.BACapability.field.AmsduEnable = FALSE;
-	else if ( Value == 1 )
-        pAd->CommonCfg.BACapability.field.AmsduEnable = TRUE;
-	else
-		return FALSE; //Invalid argument
-
-	SetCommonHT(pAd);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_HtAmsdu_Proc::(HtAmsdu=%d)\n",pAd->CommonCfg.BACapability.field.AmsduEnable));
-
-	return TRUE;
-}
-
-INT	Set_HtAutoBa_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
-	ULONG Value;
-
-	Value = simple_strtol(arg, 0, 10);
-	if (Value == 0)
-	{
-		pAd->CommonCfg.BACapability.field.AutoBA = FALSE;
-		pAd->CommonCfg.BACapability.field.Policy = BA_NOTUSE;
-	}
-    else if (Value == 1)
-	{
-		pAd->CommonCfg.BACapability.field.AutoBA = TRUE;
-		pAd->CommonCfg.BACapability.field.Policy = IMMED_BA;
-	}
-	else
-		return FALSE; //Invalid argument
-
-    pAd->CommonCfg.REGBACapability.field.AutoBA = pAd->CommonCfg.BACapability.field.AutoBA;
-    pAd->CommonCfg.REGBACapability.field.Policy = pAd->CommonCfg.BACapability.field.Policy;
-
-	SetCommonHT(pAd);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_HtAutoBa_Proc::(HtAutoBa=%d)\n",pAd->CommonCfg.BACapability.field.AutoBA));
-
-	return TRUE;
-
-}
-
-INT	Set_HtProtect_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
-	ULONG Value;
-
-	Value = simple_strtol(arg, 0, 10);
-	if (Value == 0)
-		pAd->CommonCfg.bHTProtect = FALSE;
-    else if (Value == 1)
-		pAd->CommonCfg.bHTProtect = TRUE;
-	else
-		return FALSE; //Invalid argument
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_HtProtect_Proc::(HtProtect=%d)\n",pAd->CommonCfg.bHTProtect));
-
-	return TRUE;
-}
-
-INT	Set_SendPSMPAction_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
-    UCHAR mac[6], mode;
-	char *token, sepValue[] = ":", DASH = '-';
-	INT i;
-    MAC_TABLE_ENTRY *pEntry;
-
-    //printk("\n%s\n", arg);
-/*
-	The BARecTearDown inupt string format should be xx:xx:xx:xx:xx:xx-d,
-		=>The six 2 digit hex-decimal number previous are the Mac address,
-		=>The seventh decimal number is the mode value.
-*/
-    if(strlen(arg) < 19)  //Mac address acceptable format 01:02:03:04:05:06 length 17 plus the "-" and mode value in decimal format.
-		return FALSE;
-
-   	token = strchr(arg, DASH);
-	if ((token != NULL) && (strlen(token)>1))
-	{
-		mode = simple_strtol((token+1), 0, 10);
-		if (mode > MMPS_ENABLE)
-			return FALSE;
-
-		*token = '\0';
-		for (i = 0, token = rstrtok(arg, &sepValue[0]); token; token = rstrtok(NULL, &sepValue[0]), i++)
-		{
-			if((strlen(token) != 2) || (!isxdigit(*token)) || (!isxdigit(*(token+1))))
-				return FALSE;
-			AtoH(token, (PUCHAR)(&mac[i]), 1);
-		}
-		if(i != 6)
-			return FALSE;
-
-		printk("\n%02x:%02x:%02x:%02x:%02x:%02x-%02x", mac[0], mac[1],
-		       mac[2], mac[3], mac[4], mac[5], mode);
-
-		pEntry = MacTableLookup(pAd, mac);
-
-		if (pEntry) {
-		    printk("\nSendPSMPAction MIPS mode = %d\n", mode);
-		    SendPSMPAction(pAd, pEntry->Aid, mode);
-		}
-
-		return TRUE;
-	}
-
-	return FALSE;
-
-
-}
-
-INT	Set_HtMIMOPSmode_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
-	ULONG Value;
-
-	Value = simple_strtol(arg, 0, 10);
-
-	if (Value <=3 && Value >= 0)
-		pAd->CommonCfg.BACapability.field.MMPSmode = Value;
-	else
-		pAd->CommonCfg.BACapability.field.MMPSmode = 3;
-
-	SetCommonHT(pAd);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_HtMIMOPSmode_Proc::(MIMOPS mode=%d)\n",pAd->CommonCfg.BACapability.field.MMPSmode));
-
-	return TRUE;
-}
-
-
-INT	Set_ForceShortGI_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
-	ULONG Value;
-
-	Value = simple_strtol(arg, 0, 10);
-	if (Value == 0)
-		pAd->WIFItestbed.bShortGI = FALSE;
-	else if (Value == 1)
-		pAd->WIFItestbed.bShortGI = TRUE;
-	else
-		return FALSE; //Invalid argument
-
-	SetCommonHT(pAd);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_ForceShortGI_Proc::(ForceShortGI=%d)\n", pAd->WIFItestbed.bShortGI));
-
-	return TRUE;
-}
-
-
-
-INT	Set_ForceGF_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
-	ULONG Value;
-
-	Value = simple_strtol(arg, 0, 10);
-	if (Value == 0)
-		pAd->WIFItestbed.bGreenField = FALSE;
-	else if (Value == 1)
-		pAd->WIFItestbed.bGreenField = TRUE;
-	else
-		return FALSE; //Invalid argument
-
-	SetCommonHT(pAd);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_ForceGF_Proc::(ForceGF=%d)\n", pAd->WIFItestbed.bGreenField));
-
-	return TRUE;
-}
-
-INT	Set_HtMimoPs_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
-	ULONG Value;
-
-	Value = simple_strtol(arg, 0, 10);
-	if (Value == 0)
-		pAd->CommonCfg.bMIMOPSEnable = FALSE;
-	else if (Value == 1)
-		pAd->CommonCfg.bMIMOPSEnable = TRUE;
-	else
-		return FALSE; //Invalid argument
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_HtMimoPs_Proc::(HtMimoPs=%d)\n",pAd->CommonCfg.bMIMOPSEnable));
-
-	return TRUE;
-}
-
-INT	SetCommonHT(
-	IN	PRTMP_ADAPTER	pAd)
-{
-	OID_SET_HT_PHYMODE		SetHT;
+char *GetEncryptType(char enc)
+{
+	if (enc == Ndis802_11WEPDisabled)
+		return "NONE";
+	if (enc == Ndis802_11WEPEnabled)
+		return "WEP";
+	if (enc == Ndis802_11Encryption2Enabled)
+		return "TKIP";
+	if (enc == Ndis802_11Encryption3Enabled)
+		return "AES";
+	if (enc == Ndis802_11Encryption4Enabled)
+		return "TKIPAES";
+	else
+		return "UNKNOW";
+}
+
+char *GetAuthMode(char auth)
+{
+	if (auth == Ndis802_11AuthModeOpen)
+		return "OPEN";
+	if (auth == Ndis802_11AuthModeShared)
+		return "SHARED";
+	if (auth == Ndis802_11AuthModeAutoSwitch)
+		return "AUTOWEP";
+	if (auth == Ndis802_11AuthModeWPA)
+		return "WPA";
+	if (auth == Ndis802_11AuthModeWPAPSK)
+		return "WPAPSK";
+	if (auth == Ndis802_11AuthModeWPANone)
+		return "WPANONE";
+	if (auth == Ndis802_11AuthModeWPA2)
+		return "WPA2";
+	if (auth == Ndis802_11AuthModeWPA2PSK)
+		return "WPA2PSK";
+	if (auth == Ndis802_11AuthModeWPA1WPA2)
+		return "WPA1WPA2";
+	if (auth == Ndis802_11AuthModeWPA1PSKWPA2PSK)
+		return "WPA1PSKWPA2PSK";
+
+	return "UNKNOW";
+}
+
+int SetCommonHT(struct rt_rtmp_adapter *pAd)
+{
+	struct rt_oid_set_ht_phymode SetHT;
 
 	if (pAd->CommonCfg.PhyMode < PHY_11ABGN_MIXED)
 		return FALSE;
 
 	SetHT.PhyMode = pAd->CommonCfg.PhyMode;
-	SetHT.TransmitNo = ((UCHAR)pAd->Antenna.field.TxPath);
-	SetHT.HtMode = (UCHAR)pAd->CommonCfg.RegTransmitSetting.field.HTMODE;
-	SetHT.ExtOffset = (UCHAR)pAd->CommonCfg.RegTransmitSetting.field.EXTCHA;
+	SetHT.TransmitNo = ((u8)pAd->Antenna.field.TxPath);
+	SetHT.HtMode = (u8)pAd->CommonCfg.RegTransmitSetting.field.HTMODE;
+	SetHT.ExtOffset =
+	    (u8)pAd->CommonCfg.RegTransmitSetting.field.EXTCHA;
 	SetHT.MCS = MCS_AUTO;
-	SetHT.BW = (UCHAR)pAd->CommonCfg.RegTransmitSetting.field.BW;
-	SetHT.STBC = (UCHAR)pAd->CommonCfg.RegTransmitSetting.field.STBC;
-	SetHT.SHORTGI = (UCHAR)pAd->CommonCfg.RegTransmitSetting.field.ShortGI;
+	SetHT.BW = (u8)pAd->CommonCfg.RegTransmitSetting.field.BW;
+	SetHT.STBC = (u8)pAd->CommonCfg.RegTransmitSetting.field.STBC;
+	SetHT.SHORTGI = (u8)pAd->CommonCfg.RegTransmitSetting.field.ShortGI;
 
 	RTMPSetHT(pAd, &SetHT);
 
 	return TRUE;
 }
 
-INT	Set_FixedTxMode_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
-	UCHAR	fix_tx_mode = FIXED_TXMODE_HT;
-
-	if (strcmp(arg, "OFDM") == 0 || strcmp(arg, "ofdm") == 0)
-	{
-		fix_tx_mode = FIXED_TXMODE_OFDM;
-	}
-	else if (strcmp(arg, "CCK") == 0 || strcmp(arg, "cck") == 0)
-	{
-        fix_tx_mode = FIXED_TXMODE_CCK;
-	}
-
-	pAd->StaCfg.DesiredTransmitSetting.field.FixedTxMode = fix_tx_mode;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_FixedTxMode_Proc::(FixedTxMode=%d)\n", fix_tx_mode));
-
-	return TRUE;
-}
-
-/////////////////////////////////////////////////////////////////////////
-PCHAR   RTMPGetRalinkAuthModeStr(
-    IN  NDIS_802_11_AUTHENTICATION_MODE authMode)
-{
-	switch(authMode)
-	{
-		case Ndis802_11AuthModeOpen:
-			return "OPEN";
-		case Ndis802_11AuthModeWPAPSK:
-			return "WPAPSK";
-		case Ndis802_11AuthModeShared:
-			return "SHARED";
-		case Ndis802_11AuthModeWPA:
-			return "WPA";
-		case Ndis802_11AuthModeWPA2:
-			return "WPA2";
-		case Ndis802_11AuthModeWPA2PSK:
-			return "WPA2PSK";
-        case Ndis802_11AuthModeWPA1PSKWPA2PSK:
-			return "WPAPSKWPA2PSK";
-        case Ndis802_11AuthModeWPA1WPA2:
-			return "WPA1WPA2";
-		case Ndis802_11AuthModeWPANone:
-			return "WPANONE";
-		default:
-			return "UNKNOW";
-	}
-}
-
-PCHAR   RTMPGetRalinkEncryModeStr(
-    IN  USHORT encryMode)
-{
-	switch(encryMode)
-	{
-#if defined(RT2860) || defined(RT30xx)
-	    default:
-#endif
-		case Ndis802_11WEPDisabled:
-			return "NONE";
-		case Ndis802_11WEPEnabled:
-			return "WEP";
-		case Ndis802_11Encryption2Enabled:
-			return "TKIP";
-		case Ndis802_11Encryption3Enabled:
-			return "AES";
-        case Ndis802_11Encryption4Enabled:
-			return "TKIPAES";
-#if !defined(RT2860) && !defined(RT30xx)
-		default:
-			return "UNKNOW";
-#endif
-	}
-}
-
-INT RTMPShowCfgValue(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			pName,
-	IN	PUCHAR			pBuf)
-{
-	INT	Status = 0;
-
-	for (PRTMP_PRIVATE_STA_SHOW_CFG_VALUE_PROC = RTMP_PRIVATE_STA_SHOW_CFG_VALUE_PROC; PRTMP_PRIVATE_STA_SHOW_CFG_VALUE_PROC->name; PRTMP_PRIVATE_STA_SHOW_CFG_VALUE_PROC++)
-	{
-		if (!strcmp(pName, PRTMP_PRIVATE_STA_SHOW_CFG_VALUE_PROC->name))
-		{
-			if(PRTMP_PRIVATE_STA_SHOW_CFG_VALUE_PROC->show_proc(pAd, pBuf))
-				Status = -EINVAL;
-			break;  //Exit for loop.
-		}
-	}
-
-	if(PRTMP_PRIVATE_STA_SHOW_CFG_VALUE_PROC->name == NULL)
-	{
-		sprintf(pBuf, "\n");
-		for (PRTMP_PRIVATE_STA_SHOW_CFG_VALUE_PROC = RTMP_PRIVATE_STA_SHOW_CFG_VALUE_PROC; PRTMP_PRIVATE_STA_SHOW_CFG_VALUE_PROC->name; PRTMP_PRIVATE_STA_SHOW_CFG_VALUE_PROC++)
-			sprintf(pBuf + strlen(pBuf), "%s\n", PRTMP_PRIVATE_STA_SHOW_CFG_VALUE_PROC->name);
-	}
-
-	return Status;
-}
-
-INT	Show_SSID_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf)
-{
-	sprintf(pBuf, "\t%s", pAd->CommonCfg.Ssid);
-	return 0;
-}
-
-INT	Show_WirelessMode_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf)
-{
-	switch(pAd->CommonCfg.PhyMode)
-	{
-		case PHY_11BG_MIXED:
-			sprintf(pBuf, "\t11B/G");
-			break;
-		case PHY_11B:
-			sprintf(pBuf, "\t11B");
-			break;
-		case PHY_11A:
-			sprintf(pBuf, "\t11A");
-			break;
-		case PHY_11ABG_MIXED:
-			sprintf(pBuf, "\t11A/B/G");
-			break;
-		case PHY_11G:
-			sprintf(pBuf, "\t11G");
-			break;
-		case PHY_11ABGN_MIXED:
-			sprintf(pBuf, "\t11A/B/G/N");
-			break;
-		case PHY_11N_2_4G:
-			sprintf(pBuf, "\t11N only with 2.4G");
-			break;
-		case PHY_11GN_MIXED:
-			sprintf(pBuf, "\t11G/N");
-			break;
-		case PHY_11AN_MIXED:
-			sprintf(pBuf, "\t11A/N");
-			break;
-		case PHY_11BGN_MIXED:
-			sprintf(pBuf, "\t11B/G/N");
-			break;
-		case PHY_11AGN_MIXED:
-			sprintf(pBuf, "\t11A/G/N");
-			break;
-		case PHY_11N_5G:
-			sprintf(pBuf, "\t11N only with 5G");
-			break;
-		default:
-			sprintf(pBuf, "\tUnknow Value(%d)", pAd->CommonCfg.PhyMode);
-			break;
-	}
-	return 0;
-}
-
-
-INT	Show_TxBurst_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf)
-{
-	sprintf(pBuf, "\t%s", pAd->CommonCfg.bEnableTxBurst ? "TRUE":"FALSE");
-	return 0;
-}
-
-INT	Show_TxPreamble_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf)
-{
-	switch(pAd->CommonCfg.TxPreamble)
-	{
-		case Rt802_11PreambleShort:
-			sprintf(pBuf, "\tShort");
-			break;
-		case Rt802_11PreambleLong:
-			sprintf(pBuf, "\tLong");
-			break;
-		case Rt802_11PreambleAuto:
-			sprintf(pBuf, "\tAuto");
-			break;
-		default:
-			sprintf(pBuf, "\tUnknow Value(%lu)", pAd->CommonCfg.TxPreamble);
-			break;
-	}
-
-	return 0;
-}
-
-INT	Show_TxPower_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf)
-{
-	sprintf(pBuf, "\t%lu", pAd->CommonCfg.TxPowerPercentage);
-	return 0;
-}
-
-INT	Show_Channel_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf)
-{
-	sprintf(pBuf, "\t%d", pAd->CommonCfg.Channel);
-	return 0;
-}
-
-INT	Show_BGProtection_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf)
-{
-	switch(pAd->CommonCfg.UseBGProtection)
-	{
-		case 1: //Always On
-			sprintf(pBuf, "\tON");
-			break;
-		case 2: //Always OFF
-			sprintf(pBuf, "\tOFF");
-			break;
-		case 0: //AUTO
-			sprintf(pBuf, "\tAuto");
-			break;
-		default:
-			sprintf(pBuf, "\tUnknow Value(%lu)", pAd->CommonCfg.UseBGProtection);
-			break;
-	}
-	return 0;
-}
-
-INT	Show_RTSThreshold_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf)
+char *RTMPGetRalinkEncryModeStr(u16 encryMode)
 {
-	sprintf(pBuf, "\t%u", pAd->CommonCfg.RtsThreshold);
-	return 0;
-}
-
-INT	Show_FragThreshold_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf)
-{
-	sprintf(pBuf, "\t%u", pAd->CommonCfg.FragmentThreshold);
-	return 0;
-}
-
-INT	Show_HtBw_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf)
-{
-	if (pAd->CommonCfg.RegTransmitSetting.field.BW == BW_40)
-	{
-		sprintf(pBuf, "\t40 MHz");
+	switch (encryMode) {
+	case Ndis802_11WEPDisabled:
+		return "NONE";
+	case Ndis802_11WEPEnabled:
+		return "WEP";
+	case Ndis802_11Encryption2Enabled:
+		return "TKIP";
+	case Ndis802_11Encryption3Enabled:
+		return "AES";
+	case Ndis802_11Encryption4Enabled:
+		return "TKIPAES";
+	default:
+		return "UNKNOW";
 	}
-	else
-	{
-        sprintf(pBuf, "\t20 MHz");
-	}
-	return 0;
-}
-
-INT	Show_HtMcs_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf)
-{
-	sprintf(pBuf, "\t%u", pAd->StaCfg.DesiredTransmitSetting.field.MCS);
-	return 0;
 }
-
-INT	Show_HtGi_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf)
-{
-	switch(pAd->CommonCfg.RegTransmitSetting.field.ShortGI)
-	{
-		case GI_400:
-			sprintf(pBuf, "\tGI_400");
-			break;
-		case GI_800:
-			sprintf(pBuf, "\tGI_800");
-			break;
-		default:
-			sprintf(pBuf, "\tUnknow Value(%u)", pAd->CommonCfg.RegTransmitSetting.field.ShortGI);
-			break;
-	}
-	return 0;
-}
-
-INT	Show_HtOpMode_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf)
-{
-	switch(pAd->CommonCfg.RegTransmitSetting.field.HTMODE)
-	{
-		case HTMODE_GF:
-			sprintf(pBuf, "\tGF");
-			break;
-		case HTMODE_MM:
-			sprintf(pBuf, "\tMM");
-			break;
-		default:
-			sprintf(pBuf, "\tUnknow Value(%u)", pAd->CommonCfg.RegTransmitSetting.field.HTMODE);
-			break;
-	}
-	return 0;
-}
-
-INT	Show_HtExtcha_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf)
-{
-	switch(pAd->CommonCfg.RegTransmitSetting.field.EXTCHA)
-	{
-		case EXTCHA_BELOW:
-			sprintf(pBuf, "\tBelow");
-			break;
-		case EXTCHA_ABOVE:
-			sprintf(pBuf, "\tAbove");
-			break;
-		default:
-			sprintf(pBuf, "\tUnknow Value(%u)", pAd->CommonCfg.RegTransmitSetting.field.EXTCHA);
-			break;
-	}
-	return 0;
-}
-
-
-INT	Show_HtMpduDensity_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf)
-{
-	sprintf(pBuf, "\t%u", pAd->CommonCfg.BACapability.field.MpduDensity);
-	return 0;
-}
-
-INT	Show_HtBaWinSize_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf)
-{
-	sprintf(pBuf, "\t%u", pAd->CommonCfg.BACapability.field.RxBAWinLimit);
-	return 0;
-}
-
-INT	Show_HtRdg_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf)
-{
-	sprintf(pBuf, "\t%s", pAd->CommonCfg.bRdg ? "TRUE":"FALSE");
-	return 0;
-}
-
-INT	Show_HtAmsdu_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf)
-{
-	sprintf(pBuf, "\t%s", pAd->CommonCfg.BACapability.field.AmsduEnable ? "TRUE":"FALSE");
-	return 0;
-}
-
-INT	Show_HtAutoBa_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf)
-{
-	sprintf(pBuf, "\t%s", pAd->CommonCfg.BACapability.field.AutoBA ? "TRUE":"FALSE");
-	return 0;
-}
-
-INT	Show_CountryRegion_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf)
-{
-	sprintf(pBuf, "\t%d", pAd->CommonCfg.CountryRegion);
-	return 0;
-}
-
-INT	Show_CountryRegionABand_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf)
-{
-	sprintf(pBuf, "\t%d", pAd->CommonCfg.CountryRegionForABand);
-	return 0;
-}
-
-INT	Show_CountryCode_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf)
-{
-	sprintf(pBuf, "\t%s", pAd->CommonCfg.CountryCode);
-	return 0;
-}
-
-#ifdef AGGREGATION_SUPPORT
-INT	Show_PktAggregate_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf)
-{
-	sprintf(pBuf, "\t%s", pAd->CommonCfg.bAggregationCapable ? "TRUE":"FALSE");
-	return 0;
-}
-#endif // AGGREGATION_SUPPORT //
-
-#ifdef WMM_SUPPORT
-INT	Show_WmmCapable_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf)
-{
-	sprintf(pBuf, "\t%s", pAd->CommonCfg.bWmmCapable ? "TRUE":"FALSE");
-
-	return 0;
-}
-#endif // WMM_SUPPORT //
-
-INT	Show_IEEE80211H_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf)
-{
-	sprintf(pBuf, "\t%s", pAd->CommonCfg.bIEEE80211H ? "TRUE":"FALSE");
-	return 0;
-}
-
-INT	Show_NetworkType_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf)
-{
-	switch(pAd->StaCfg.BssType)
-	{
-		case BSS_ADHOC:
-			sprintf(pBuf, "\tAdhoc");
-			break;
-		case BSS_INFRA:
-			sprintf(pBuf, "\tInfra");
-			break;
-		case BSS_ANY:
-			sprintf(pBuf, "\tAny");
-			break;
-		case BSS_MONITOR:
-			sprintf(pBuf, "\tMonitor");
-			break;
-		default:
-			sprintf(pBuf, "\tUnknow Value(%d)", pAd->StaCfg.BssType);
-			break;
-	}
-	return 0;
-}
-
-INT	Show_AuthMode_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf)
-{
-	NDIS_802_11_AUTHENTICATION_MODE	AuthMode = Ndis802_11AuthModeOpen;
-
-	AuthMode = pAd->StaCfg.AuthMode;
-
-	if ((AuthMode >= Ndis802_11AuthModeOpen) &&
-		(AuthMode <= Ndis802_11AuthModeWPA1PSKWPA2PSK))
-		sprintf(pBuf, "\t%s", RTMPGetRalinkAuthModeStr(AuthMode));
-	else
-		sprintf(pBuf, "\tUnknow Value(%d)", AuthMode);
-
-	return 0;
-}
-
-INT	Show_EncrypType_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf)
-{
-	NDIS_802_11_WEP_STATUS	WepStatus = Ndis802_11WEPDisabled;
-
-	WepStatus = pAd->StaCfg.WepStatus;
-
-	if ((WepStatus >= Ndis802_11WEPEnabled) &&
-		(WepStatus <= Ndis802_11Encryption4KeyAbsent))
-		sprintf(pBuf, "\t%s", RTMPGetRalinkEncryModeStr(WepStatus));
-	else
-		sprintf(pBuf, "\tUnknow Value(%d)", WepStatus);
-
-	return 0;
-}
-
-INT	Show_DefaultKeyID_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf)
-{
-	UCHAR DefaultKeyId = 0;
-
-	DefaultKeyId = pAd->StaCfg.DefaultKeyId;
-
-	sprintf(pBuf, "\t%d", DefaultKeyId);
-
-	return 0;
-}
-
-INT	Show_WepKey_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN  INT				KeyIdx,
-	OUT	PUCHAR			pBuf)
-{
-	UCHAR   Key[16] = {0}, KeyLength = 0;
-	INT		index = BSS0;
-
-	KeyLength = pAd->SharedKey[index][KeyIdx].KeyLen;
-	NdisMoveMemory(Key, pAd->SharedKey[index][KeyIdx].Key, KeyLength);
-
-	//check key string is ASCII or not
-    if (RTMPCheckStrPrintAble(Key, KeyLength))
-        sprintf(pBuf, "\t%s", Key);
-    else
-    {
-        int idx;
-        sprintf(pBuf, "\t");
-        for (idx = 0; idx < KeyLength; idx++)
-            sprintf(pBuf+strlen(pBuf), "%02X", Key[idx]);
-    }
-	return 0;
-}
-
-INT	Show_Key1_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf)
-{
-	Show_WepKey_Proc(pAd, 0, pBuf);
-	return 0;
-}
-
-INT	Show_Key2_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf)
-{
-	Show_WepKey_Proc(pAd, 1, pBuf);
-	return 0;
-}
-
-INT	Show_Key3_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf)
-{
-	Show_WepKey_Proc(pAd, 2, pBuf);
-	return 0;
-}
-
-INT	Show_Key4_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf)
-{
-	Show_WepKey_Proc(pAd, 3, pBuf);
-	return 0;
-}
-
-INT	Show_WPAPSK_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUCHAR			pBuf)
-{
-	INT 	idx;
-	UCHAR	PMK[32] = {0};
-
-	NdisMoveMemory(PMK, pAd->StaCfg.PMK, 32);
-
-    sprintf(pBuf, "\tPMK = ");
-    for (idx = 0; idx < 32; idx++)
-        sprintf(pBuf+strlen(pBuf), "%02X", PMK[idx]);
-
-	return 0;
-}
-
diff --git a/drivers/staging/rt2860/common/cmm_mac_pci.c b/drivers/staging/rt2860/common/cmm_mac_pci.c
new file mode 100644
index 000000000000..560ebd398e1d
--- /dev/null
+++ b/drivers/staging/rt2860/common/cmm_mac_pci.c
@@ -0,0 +1,1661 @@
+/*
+ *************************************************************************
+ * Ralink Tech Inc.
+ * 5F., No.36, Taiyuan St., Jhubei City,
+ * Hsinchu County 302,
+ * Taiwan, R.O.C.
+ *
+ * (c) Copyright 2002-2007, Ralink Technology, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify  *
+ * it under the terms of the GNU General Public License as published by  *
+ * the Free Software Foundation; either version 2 of the License, or     *
+ * (at your option) any later version.                                   *
+ *                                                                       *
+ * This program is distributed in the hope that it will be useful,       *
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
+ * GNU General Public License for more details.                          *
+ *                                                                       *
+ * You should have received a copy of the GNU General Public License     *
+ * along with this program; if not, write to the                         *
+ * Free Software Foundation, Inc.,                                       *
+ * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
+ *                                                                       *
+ *************************************************************************
+*/
+
+#ifdef RTMP_MAC_PCI
+#include	"../rt_config.h"
+
+/*
+	========================================================================
+
+	Routine Description:
+		Allocate DMA memory blocks for send, receive
+
+	Arguments:
+		Adapter		Pointer to our adapter
+
+	Return Value:
+		NDIS_STATUS_SUCCESS
+		NDIS_STATUS_FAILURE
+		NDIS_STATUS_RESOURCES
+
+	IRQL = PASSIVE_LEVEL
+
+	Note:
+
+	========================================================================
+*/
+int RTMPAllocTxRxRingMemory(struct rt_rtmp_adapter *pAd)
+{
+	int Status = NDIS_STATUS_SUCCESS;
+	unsigned long RingBasePaHigh;
+	unsigned long RingBasePaLow;
+	void *RingBaseVa;
+	int index, num;
+	struct rt_txd * pTxD;
+	struct rt_rxd * pRxD;
+	unsigned long ErrorValue = 0;
+	struct rt_rtmp_tx_ring *pTxRing;
+	struct rt_rtmp_dmabuf *pDmaBuf;
+	void *pPacket;
+/*      PRTMP_REORDERBUF        pReorderBuf; */
+
+	DBGPRINT(RT_DEBUG_TRACE, ("--> RTMPAllocTxRxRingMemory\n"));
+	do {
+		/* */
+		/* Allocate all ring descriptors, include TxD, RxD, MgmtD. */
+		/* Although each size is different, to prevent cacheline and alignment */
+		/* issue, I intentional set them all to 64 bytes. */
+		/* */
+		for (num = 0; num < NUM_OF_TX_RING; num++) {
+			unsigned long BufBasePaHigh;
+			unsigned long BufBasePaLow;
+			void *BufBaseVa;
+
+			/* */
+			/* Allocate Tx ring descriptor's memory (5 TX rings = 4 ACs + 1 HCCA) */
+			/* */
+			pAd->TxDescRing[num].AllocSize =
+			    TX_RING_SIZE * TXD_SIZE;
+			RTMP_AllocateTxDescMemory(pAd, num,
+						  pAd->TxDescRing[num].
+						  AllocSize, FALSE,
+						  &pAd->TxDescRing[num].AllocVa,
+						  &pAd->TxDescRing[num].
+						  AllocPa);
+
+			if (pAd->TxDescRing[num].AllocVa == NULL) {
+				ErrorValue = ERRLOG_OUT_OF_SHARED_MEMORY;
+				DBGPRINT_ERR(("Failed to allocate a big buffer\n"));
+				Status = NDIS_STATUS_RESOURCES;
+				break;
+			}
+			/* Zero init this memory block */
+			NdisZeroMemory(pAd->TxDescRing[num].AllocVa,
+				       pAd->TxDescRing[num].AllocSize);
+
+			/* Save PA & VA for further operation */
+			RingBasePaHigh =
+			    RTMP_GetPhysicalAddressHigh(pAd->TxDescRing[num].
+							AllocPa);
+			RingBasePaLow =
+			    RTMP_GetPhysicalAddressLow(pAd->TxDescRing[num].
+						       AllocPa);
+			RingBaseVa = pAd->TxDescRing[num].AllocVa;
+
+			/* */
+			/* Allocate all 1st TXBuf's memory for this TxRing */
+			/* */
+			pAd->TxBufSpace[num].AllocSize =
+			    TX_RING_SIZE * TX_DMA_1ST_BUFFER_SIZE;
+			RTMP_AllocateFirstTxBuffer(pAd, num,
+						   pAd->TxBufSpace[num].
+						   AllocSize, FALSE,
+						   &pAd->TxBufSpace[num].
+						   AllocVa,
+						   &pAd->TxBufSpace[num].
+						   AllocPa);
+
+			if (pAd->TxBufSpace[num].AllocVa == NULL) {
+				ErrorValue = ERRLOG_OUT_OF_SHARED_MEMORY;
+				DBGPRINT_ERR(("Failed to allocate a big buffer\n"));
+				Status = NDIS_STATUS_RESOURCES;
+				break;
+			}
+			/* Zero init this memory block */
+			NdisZeroMemory(pAd->TxBufSpace[num].AllocVa,
+				       pAd->TxBufSpace[num].AllocSize);
+
+			/* Save PA & VA for further operation */
+			BufBasePaHigh =
+			    RTMP_GetPhysicalAddressHigh(pAd->TxBufSpace[num].
+							AllocPa);
+			BufBasePaLow =
+			    RTMP_GetPhysicalAddressLow(pAd->TxBufSpace[num].
+						       AllocPa);
+			BufBaseVa = pAd->TxBufSpace[num].AllocVa;
+
+			/* */
+			/* Initialize Tx Ring Descriptor and associated buffer memory */
+			/* */
+			pTxRing = &pAd->TxRing[num];
+			for (index = 0; index < TX_RING_SIZE; index++) {
+				pTxRing->Cell[index].pNdisPacket = NULL;
+				pTxRing->Cell[index].pNextNdisPacket = NULL;
+				/* Init Tx Ring Size, Va, Pa variables */
+				pTxRing->Cell[index].AllocSize = TXD_SIZE;
+				pTxRing->Cell[index].AllocVa = RingBaseVa;
+				RTMP_SetPhysicalAddressHigh(pTxRing->
+							    Cell[index].AllocPa,
+							    RingBasePaHigh);
+				RTMP_SetPhysicalAddressLow(pTxRing->Cell[index].
+							   AllocPa,
+							   RingBasePaLow);
+
+				/* Setup Tx Buffer size & address. only 802.11 header will store in this space */
+				pDmaBuf = &pTxRing->Cell[index].DmaBuf;
+				pDmaBuf->AllocSize = TX_DMA_1ST_BUFFER_SIZE;
+				pDmaBuf->AllocVa = BufBaseVa;
+				RTMP_SetPhysicalAddressHigh(pDmaBuf->AllocPa,
+							    BufBasePaHigh);
+				RTMP_SetPhysicalAddressLow(pDmaBuf->AllocPa,
+							   BufBasePaLow);
+
+				/* link the pre-allocated TxBuf to TXD */
+				pTxD =
+				    (struct rt_txd *) pTxRing->Cell[index].AllocVa;
+				pTxD->SDPtr0 = BufBasePaLow;
+				/* advance to next ring descriptor address */
+				pTxD->DMADONE = 1;
+				RingBasePaLow += TXD_SIZE;
+				RingBaseVa = (u8 *)RingBaseVa + TXD_SIZE;
+
+				/* advance to next TxBuf address */
+				BufBasePaLow += TX_DMA_1ST_BUFFER_SIZE;
+				BufBaseVa =
+				    (u8 *)BufBaseVa + TX_DMA_1ST_BUFFER_SIZE;
+			}
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("TxRing[%d]: total %d entry allocated\n", num,
+				  index));
+		}
+		if (Status == NDIS_STATUS_RESOURCES)
+			break;
+
+		/* */
+		/* Allocate MGMT ring descriptor's memory except Tx ring which allocated eariler */
+		/* */
+		pAd->MgmtDescRing.AllocSize = MGMT_RING_SIZE * TXD_SIZE;
+		RTMP_AllocateMgmtDescMemory(pAd,
+					    pAd->MgmtDescRing.AllocSize,
+					    FALSE,
+					    &pAd->MgmtDescRing.AllocVa,
+					    &pAd->MgmtDescRing.AllocPa);
+
+		if (pAd->MgmtDescRing.AllocVa == NULL) {
+			ErrorValue = ERRLOG_OUT_OF_SHARED_MEMORY;
+			DBGPRINT_ERR(("Failed to allocate a big buffer\n"));
+			Status = NDIS_STATUS_RESOURCES;
+			break;
+		}
+		/* Zero init this memory block */
+		NdisZeroMemory(pAd->MgmtDescRing.AllocVa,
+			       pAd->MgmtDescRing.AllocSize);
+
+		/* Save PA & VA for further operation */
+		RingBasePaHigh =
+		    RTMP_GetPhysicalAddressHigh(pAd->MgmtDescRing.AllocPa);
+		RingBasePaLow =
+		    RTMP_GetPhysicalAddressLow(pAd->MgmtDescRing.AllocPa);
+		RingBaseVa = pAd->MgmtDescRing.AllocVa;
+
+		/* */
+		/* Initialize MGMT Ring and associated buffer memory */
+		/* */
+		for (index = 0; index < MGMT_RING_SIZE; index++) {
+			pAd->MgmtRing.Cell[index].pNdisPacket = NULL;
+			pAd->MgmtRing.Cell[index].pNextNdisPacket = NULL;
+			/* Init MGMT Ring Size, Va, Pa variables */
+			pAd->MgmtRing.Cell[index].AllocSize = TXD_SIZE;
+			pAd->MgmtRing.Cell[index].AllocVa = RingBaseVa;
+			RTMP_SetPhysicalAddressHigh(pAd->MgmtRing.Cell[index].
+						    AllocPa, RingBasePaHigh);
+			RTMP_SetPhysicalAddressLow(pAd->MgmtRing.Cell[index].
+						   AllocPa, RingBasePaLow);
+
+			/* Offset to next ring descriptor address */
+			RingBasePaLow += TXD_SIZE;
+			RingBaseVa = (u8 *)RingBaseVa + TXD_SIZE;
+
+			/* link the pre-allocated TxBuf to TXD */
+			pTxD = (struct rt_txd *) pAd->MgmtRing.Cell[index].AllocVa;
+			pTxD->DMADONE = 1;
+
+			/* no pre-allocated buffer required in MgmtRing for scatter-gather case */
+		}
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("MGMT Ring: total %d entry allocated\n", index));
+
+		/* */
+		/* Allocate RX ring descriptor's memory except Tx ring which allocated eariler */
+		/* */
+		pAd->RxDescRing.AllocSize = RX_RING_SIZE * RXD_SIZE;
+		RTMP_AllocateRxDescMemory(pAd,
+					  pAd->RxDescRing.AllocSize,
+					  FALSE,
+					  &pAd->RxDescRing.AllocVa,
+					  &pAd->RxDescRing.AllocPa);
+
+		if (pAd->RxDescRing.AllocVa == NULL) {
+			ErrorValue = ERRLOG_OUT_OF_SHARED_MEMORY;
+			DBGPRINT_ERR(("Failed to allocate a big buffer\n"));
+			Status = NDIS_STATUS_RESOURCES;
+			break;
+		}
+		/* Zero init this memory block */
+		NdisZeroMemory(pAd->RxDescRing.AllocVa,
+			       pAd->RxDescRing.AllocSize);
+
+		DBGPRINT(RT_DEBUG_OFF,
+			 ("RX DESC %p  size = %ld\n", pAd->RxDescRing.AllocVa,
+			  pAd->RxDescRing.AllocSize));
+
+		/* Save PA & VA for further operation */
+		RingBasePaHigh =
+		    RTMP_GetPhysicalAddressHigh(pAd->RxDescRing.AllocPa);
+		RingBasePaLow =
+		    RTMP_GetPhysicalAddressLow(pAd->RxDescRing.AllocPa);
+		RingBaseVa = pAd->RxDescRing.AllocVa;
+
+		/* */
+		/* Initialize Rx Ring and associated buffer memory */
+		/* */
+		for (index = 0; index < RX_RING_SIZE; index++) {
+			/* Init RX Ring Size, Va, Pa variables */
+			pAd->RxRing.Cell[index].AllocSize = RXD_SIZE;
+			pAd->RxRing.Cell[index].AllocVa = RingBaseVa;
+			RTMP_SetPhysicalAddressHigh(pAd->RxRing.Cell[index].
+						    AllocPa, RingBasePaHigh);
+			RTMP_SetPhysicalAddressLow(pAd->RxRing.Cell[index].
+						   AllocPa, RingBasePaLow);
+
+			/*NdisZeroMemory(RingBaseVa, RXD_SIZE); */
+
+			/* Offset to next ring descriptor address */
+			RingBasePaLow += RXD_SIZE;
+			RingBaseVa = (u8 *)RingBaseVa + RXD_SIZE;
+
+			/* Setup Rx associated Buffer size & allocate share memory */
+			pDmaBuf = &pAd->RxRing.Cell[index].DmaBuf;
+			pDmaBuf->AllocSize = RX_BUFFER_AGGRESIZE;
+			pPacket = RTMP_AllocateRxPacketBuffer(pAd,
+							      pDmaBuf->
+							      AllocSize, FALSE,
+							      &pDmaBuf->AllocVa,
+							      &pDmaBuf->
+							      AllocPa);
+
+			/* keep allocated rx packet */
+			pAd->RxRing.Cell[index].pNdisPacket = pPacket;
+
+			/* Error handling */
+			if (pDmaBuf->AllocVa == NULL) {
+				ErrorValue = ERRLOG_OUT_OF_SHARED_MEMORY;
+				DBGPRINT_ERR(("Failed to allocate RxRing's 1st buffer\n"));
+				Status = NDIS_STATUS_RESOURCES;
+				break;
+			}
+			/* Zero init this memory block */
+			NdisZeroMemory(pDmaBuf->AllocVa, pDmaBuf->AllocSize);
+
+			/* Write RxD buffer address & allocated buffer length */
+			pRxD = (struct rt_rxd *) pAd->RxRing.Cell[index].AllocVa;
+			pRxD->SDP0 =
+			    RTMP_GetPhysicalAddressLow(pDmaBuf->AllocPa);
+			pRxD->DDONE = 0;
+
+		}
+
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("Rx Ring: total %d entry allocated\n", index));
+
+	} while (FALSE);
+
+	NdisZeroMemory(&pAd->FragFrame, sizeof(struct rt_fragment_frame));
+	pAd->FragFrame.pFragPacket =
+	    RTMP_AllocateFragPacketBuffer(pAd, RX_BUFFER_NORMSIZE);
+
+	if (pAd->FragFrame.pFragPacket == NULL) {
+		Status = NDIS_STATUS_RESOURCES;
+	}
+
+	if (Status != NDIS_STATUS_SUCCESS) {
+		/* Log error inforamtion */
+		NdisWriteErrorLogEntry(pAd->AdapterHandle,
+				       NDIS_ERROR_CODE_OUT_OF_RESOURCES,
+				       1, ErrorValue);
+	}
+	/* Following code segment get from original func:NICInitTxRxRingAndBacklogQueue(), now should integrate it to here. */
+	{
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("--> NICInitTxRxRingAndBacklogQueue\n"));
+
+/*
+		// Disable DMA.
+		RTMP_IO_READ32(pAd, WPDMA_GLO_CFG, &GloCfg.word);
+		GloCfg.word &= 0xff0;
+		GloCfg.field.EnTXWriteBackDDONE =1;
+		RTMP_IO_WRITE32(pAd, WPDMA_GLO_CFG, GloCfg.word);
+*/
+
+		/* Initialize all transmit related software queues */
+		for (index = 0; index < NUM_OF_TX_RING; index++) {
+			InitializeQueueHeader(&pAd->TxSwQueue[index]);
+			/* Init TX rings index pointer */
+			pAd->TxRing[index].TxSwFreeIdx = 0;
+			pAd->TxRing[index].TxCpuIdx = 0;
+			/*RTMP_IO_WRITE32(pAd, (TX_CTX_IDX0 + i * 0x10) ,  pAd->TxRing[i].TX_CTX_IDX); */
+		}
+
+		/* Init RX Ring index pointer */
+		pAd->RxRing.RxSwReadIdx = 0;
+		pAd->RxRing.RxCpuIdx = RX_RING_SIZE - 1;
+		/*RTMP_IO_WRITE32(pAd, RX_CRX_IDX, pAd->RxRing.RX_CRX_IDX0); */
+
+		/* init MGMT ring index pointer */
+		pAd->MgmtRing.TxSwFreeIdx = 0;
+		pAd->MgmtRing.TxCpuIdx = 0;
+
+		pAd->PrivateInfo.TxRingFullCnt = 0;
+
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("<-- NICInitTxRxRingAndBacklogQueue\n"));
+	}
+
+	DBGPRINT_S(Status,
+		   ("<-- RTMPAllocTxRxRingMemory, Status=%x\n", Status));
+	return Status;
+}
+
+/*
+	========================================================================
+
+	Routine Description:
+		Reset NIC Asics. Call after rest DMA. So reset TX_CTX_IDX to zero.
+
+	Arguments:
+		Adapter						Pointer to our adapter
+
+	Return Value:
+		None
+
+	IRQL = PASSIVE_LEVEL
+	IRQL = DISPATCH_LEVEL
+
+	Note:
+		Reset NIC to initial state AS IS system boot up time.
+
+	========================================================================
+*/
+void RTMPRingCleanUp(struct rt_rtmp_adapter *pAd, u8 RingType)
+{
+	struct rt_txd * pTxD;
+	struct rt_rxd * pRxD;
+	struct rt_queue_entry *pEntry;
+	void *pPacket;
+	int i;
+	struct rt_rtmp_tx_ring *pTxRing;
+	unsigned long IrqFlags;
+	/*u32                        RxSwReadIdx; */
+
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("RTMPRingCleanUp(RingIdx=%d, Pending-NDIS=%ld)\n", RingType,
+		  pAd->RalinkCounters.PendingNdisPacketCount));
+	switch (RingType) {
+	case QID_AC_BK:
+	case QID_AC_BE:
+	case QID_AC_VI:
+	case QID_AC_VO:
+
+		pTxRing = &pAd->TxRing[RingType];
+
+		RTMP_IRQ_LOCK(&pAd->irq_lock, IrqFlags);
+		/* We have to clean all descriptors in case some error happened with reset */
+		for (i = 0; i < TX_RING_SIZE; i++)	/* We have to scan all TX ring */
+		{
+			pTxD = (struct rt_txd *) pTxRing->Cell[i].AllocVa;
+
+			pPacket = (void *)pTxRing->Cell[i].pNdisPacket;
+			/* release scatter-and-gather char */
+			if (pPacket) {
+				RELEASE_NDIS_PACKET(pAd, pPacket,
+						    NDIS_STATUS_FAILURE);
+				pTxRing->Cell[i].pNdisPacket = NULL;
+			}
+
+			pPacket =
+			    (void *)pTxRing->Cell[i].pNextNdisPacket;
+			/* release scatter-and-gather char */
+			if (pPacket) {
+				RELEASE_NDIS_PACKET(pAd, pPacket,
+						    NDIS_STATUS_FAILURE);
+				pTxRing->Cell[i].pNextNdisPacket = NULL;
+			}
+		}
+
+		RTMP_IO_READ32(pAd, TX_DTX_IDX0 + RingType * 0x10,
+			       &pTxRing->TxDmaIdx);
+		pTxRing->TxSwFreeIdx = pTxRing->TxDmaIdx;
+		pTxRing->TxCpuIdx = pTxRing->TxDmaIdx;
+		RTMP_IO_WRITE32(pAd, TX_CTX_IDX0 + RingType * 0x10,
+				pTxRing->TxCpuIdx);
+
+		RTMP_IRQ_UNLOCK(&pAd->irq_lock, IrqFlags);
+
+		RTMP_IRQ_LOCK(&pAd->irq_lock, IrqFlags);
+		while (pAd->TxSwQueue[RingType].Head != NULL) {
+			pEntry = RemoveHeadQueue(&pAd->TxSwQueue[RingType]);
+			pPacket = QUEUE_ENTRY_TO_PACKET(pEntry);
+			RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_FAILURE);
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("Release 1 NDIS packet from s/w backlog queue\n"));
+		}
+		RTMP_IRQ_UNLOCK(&pAd->irq_lock, IrqFlags);
+		break;
+
+	case QID_MGMT:
+		/* We have to clean all descriptors in case some error happened with reset */
+		NdisAcquireSpinLock(&pAd->MgmtRingLock);
+
+		for (i = 0; i < MGMT_RING_SIZE; i++) {
+			pTxD = (struct rt_txd *) pAd->MgmtRing.Cell[i].AllocVa;
+
+			pPacket =
+			    (void *)pAd->MgmtRing.Cell[i].pNdisPacket;
+			/* rlease scatter-and-gather char */
+			if (pPacket) {
+				PCI_UNMAP_SINGLE(pAd, pTxD->SDPtr0,
+						 pTxD->SDLen0,
+						 PCI_DMA_TODEVICE);
+				RELEASE_NDIS_PACKET(pAd, pPacket,
+						    NDIS_STATUS_FAILURE);
+			}
+			pAd->MgmtRing.Cell[i].pNdisPacket = NULL;
+
+			pPacket =
+			    (void *)pAd->MgmtRing.Cell[i].
+			    pNextNdisPacket;
+			/* release scatter-and-gather char */
+			if (pPacket) {
+				PCI_UNMAP_SINGLE(pAd, pTxD->SDPtr1,
+						 pTxD->SDLen1,
+						 PCI_DMA_TODEVICE);
+				RELEASE_NDIS_PACKET(pAd, pPacket,
+						    NDIS_STATUS_FAILURE);
+			}
+			pAd->MgmtRing.Cell[i].pNextNdisPacket = NULL;
+
+		}
+
+		RTMP_IO_READ32(pAd, TX_MGMTDTX_IDX, &pAd->MgmtRing.TxDmaIdx);
+		pAd->MgmtRing.TxSwFreeIdx = pAd->MgmtRing.TxDmaIdx;
+		pAd->MgmtRing.TxCpuIdx = pAd->MgmtRing.TxDmaIdx;
+		RTMP_IO_WRITE32(pAd, TX_MGMTCTX_IDX, pAd->MgmtRing.TxCpuIdx);
+
+		NdisReleaseSpinLock(&pAd->MgmtRingLock);
+		pAd->RalinkCounters.MgmtRingFullCount = 0;
+		break;
+
+	case QID_RX:
+		/* We have to clean all descriptors in case some error happened with reset */
+		NdisAcquireSpinLock(&pAd->RxRingLock);
+
+		for (i = 0; i < RX_RING_SIZE; i++) {
+			pRxD = (struct rt_rxd *) pAd->RxRing.Cell[i].AllocVa;
+			pRxD->DDONE = 0;
+		}
+
+		RTMP_IO_READ32(pAd, RX_DRX_IDX, &pAd->RxRing.RxDmaIdx);
+		pAd->RxRing.RxSwReadIdx = pAd->RxRing.RxDmaIdx;
+		pAd->RxRing.RxCpuIdx =
+		    ((pAd->RxRing.RxDmaIdx ==
+		      0) ? (RX_RING_SIZE - 1) : (pAd->RxRing.RxDmaIdx - 1));
+		RTMP_IO_WRITE32(pAd, RX_CRX_IDX, pAd->RxRing.RxCpuIdx);
+
+		NdisReleaseSpinLock(&pAd->RxRingLock);
+		break;
+
+	default:
+		break;
+	}
+}
+
+void RTMPFreeTxRxRingMemory(struct rt_rtmp_adapter *pAd)
+{
+	int index, num, j;
+	struct rt_rtmp_tx_ring *pTxRing;
+	struct rt_txd * pTxD;
+	void *pPacket;
+	unsigned int IrqFlags;
+
+	/*struct os_cookie *pObj =(struct os_cookie *)pAd->OS_Cookie; */
+
+	DBGPRINT(RT_DEBUG_TRACE, ("--> RTMPFreeTxRxRingMemory\n"));
+
+	/* Free TxSwQueue Packet */
+	for (index = 0; index < NUM_OF_TX_RING; index++) {
+		struct rt_queue_entry *pEntry;
+		void *pPacket;
+		struct rt_queue_header *pQueue;
+
+		RTMP_IRQ_LOCK(&pAd->irq_lock, IrqFlags);
+		pQueue = &pAd->TxSwQueue[index];
+		while (pQueue->Head) {
+			pEntry = RemoveHeadQueue(pQueue);
+			pPacket = QUEUE_ENTRY_TO_PACKET(pEntry);
+			RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_FAILURE);
+		}
+		RTMP_IRQ_UNLOCK(&pAd->irq_lock, IrqFlags);
+	}
+
+	/* Free Tx Ring Packet */
+	for (index = 0; index < NUM_OF_TX_RING; index++) {
+		pTxRing = &pAd->TxRing[index];
+
+		for (j = 0; j < TX_RING_SIZE; j++) {
+			pTxD = (struct rt_txd *) (pTxRing->Cell[j].AllocVa);
+			pPacket = pTxRing->Cell[j].pNdisPacket;
+
+			if (pPacket) {
+				PCI_UNMAP_SINGLE(pAd, pTxD->SDPtr0,
+						 pTxD->SDLen0,
+						 PCI_DMA_TODEVICE);
+				RELEASE_NDIS_PACKET(pAd, pPacket,
+						    NDIS_STATUS_SUCCESS);
+			}
+			/*Always assign pNdisPacket as NULL after clear */
+			pTxRing->Cell[j].pNdisPacket = NULL;
+
+			pPacket = pTxRing->Cell[j].pNextNdisPacket;
+
+			if (pPacket) {
+				PCI_UNMAP_SINGLE(pAd, pTxD->SDPtr1,
+						 pTxD->SDLen1,
+						 PCI_DMA_TODEVICE);
+				RELEASE_NDIS_PACKET(pAd, pPacket,
+						    NDIS_STATUS_SUCCESS);
+			}
+			/*Always assign pNextNdisPacket as NULL after clear */
+			pTxRing->Cell[pTxRing->TxSwFreeIdx].pNextNdisPacket =
+			    NULL;
+
+		}
+	}
+
+	for (index = RX_RING_SIZE - 1; index >= 0; index--) {
+		if ((pAd->RxRing.Cell[index].DmaBuf.AllocVa)
+		    && (pAd->RxRing.Cell[index].pNdisPacket)) {
+			PCI_UNMAP_SINGLE(pAd,
+					 pAd->RxRing.Cell[index].DmaBuf.AllocPa,
+					 pAd->RxRing.Cell[index].DmaBuf.
+					 AllocSize, PCI_DMA_FROMDEVICE);
+			RELEASE_NDIS_PACKET(pAd,
+					    pAd->RxRing.Cell[index].pNdisPacket,
+					    NDIS_STATUS_SUCCESS);
+		}
+	}
+	NdisZeroMemory(pAd->RxRing.Cell, RX_RING_SIZE * sizeof(struct rt_rtmp_dmacb));
+
+	if (pAd->RxDescRing.AllocVa) {
+		RTMP_FreeDescMemory(pAd, pAd->RxDescRing.AllocSize,
+				    pAd->RxDescRing.AllocVa,
+				    pAd->RxDescRing.AllocPa);
+	}
+	NdisZeroMemory(&pAd->RxDescRing, sizeof(struct rt_rtmp_dmabuf));
+
+	if (pAd->MgmtDescRing.AllocVa) {
+		RTMP_FreeDescMemory(pAd, pAd->MgmtDescRing.AllocSize,
+				    pAd->MgmtDescRing.AllocVa,
+				    pAd->MgmtDescRing.AllocPa);
+	}
+	NdisZeroMemory(&pAd->MgmtDescRing, sizeof(struct rt_rtmp_dmabuf));
+
+	for (num = 0; num < NUM_OF_TX_RING; num++) {
+		if (pAd->TxBufSpace[num].AllocVa) {
+			RTMP_FreeFirstTxBuffer(pAd,
+					       pAd->TxBufSpace[num].AllocSize,
+					       FALSE,
+					       pAd->TxBufSpace[num].AllocVa,
+					       pAd->TxBufSpace[num].AllocPa);
+		}
+		NdisZeroMemory(&pAd->TxBufSpace[num], sizeof(struct rt_rtmp_dmabuf));
+
+		if (pAd->TxDescRing[num].AllocVa) {
+			RTMP_FreeDescMemory(pAd, pAd->TxDescRing[num].AllocSize,
+					    pAd->TxDescRing[num].AllocVa,
+					    pAd->TxDescRing[num].AllocPa);
+		}
+		NdisZeroMemory(&pAd->TxDescRing[num], sizeof(struct rt_rtmp_dmabuf));
+	}
+
+	if (pAd->FragFrame.pFragPacket)
+		RELEASE_NDIS_PACKET(pAd, pAd->FragFrame.pFragPacket,
+				    NDIS_STATUS_SUCCESS);
+
+	DBGPRINT(RT_DEBUG_TRACE, ("<-- RTMPFreeTxRxRingMemory\n"));
+}
+
+/***************************************************************************
+  *
+  *	register related procedures.
+  *
+  **************************************************************************/
+/*
+========================================================================
+Routine Description:
+    Disable DMA.
+
+Arguments:
+	*pAd				the raxx interface data pointer
+
+Return Value:
+	None
+
+Note:
+========================================================================
+*/
+void RT28XXDMADisable(struct rt_rtmp_adapter *pAd)
+{
+	WPDMA_GLO_CFG_STRUC GloCfg;
+
+	RTMP_IO_READ32(pAd, WPDMA_GLO_CFG, &GloCfg.word);
+	GloCfg.word &= 0xff0;
+	GloCfg.field.EnTXWriteBackDDONE = 1;
+	RTMP_IO_WRITE32(pAd, WPDMA_GLO_CFG, GloCfg.word);
+}
+
+/*
+========================================================================
+Routine Description:
+    Enable DMA.
+
+Arguments:
+	*pAd				the raxx interface data pointer
+
+Return Value:
+	None
+
+Note:
+========================================================================
+*/
+void RT28XXDMAEnable(struct rt_rtmp_adapter *pAd)
+{
+	WPDMA_GLO_CFG_STRUC GloCfg;
+	int i = 0;
+
+	RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, 0x4);
+	do {
+		RTMP_IO_READ32(pAd, WPDMA_GLO_CFG, &GloCfg.word);
+		if ((GloCfg.field.TxDMABusy == 0)
+		    && (GloCfg.field.RxDMABusy == 0))
+			break;
+
+		DBGPRINT(RT_DEBUG_TRACE, ("==>  DMABusy\n"));
+		RTMPusecDelay(1000);
+		i++;
+	} while (i < 200);
+
+	RTMPusecDelay(50);
+
+	GloCfg.field.EnTXWriteBackDDONE = 1;
+	GloCfg.field.WPDMABurstSIZE = 2;
+	GloCfg.field.EnableRxDMA = 1;
+	GloCfg.field.EnableTxDMA = 1;
+
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("<== WRITE DMA offset 0x208 = 0x%x\n", GloCfg.word));
+	RTMP_IO_WRITE32(pAd, WPDMA_GLO_CFG, GloCfg.word);
+
+}
+
+BOOLEAN AsicCheckCommanOk(struct rt_rtmp_adapter *pAd, u8 Command)
+{
+	u32 CmdStatus = 0, CID = 0, i;
+	u32 ThisCIDMask = 0;
+
+	i = 0;
+	do {
+		RTMP_IO_READ32(pAd, H2M_MAILBOX_CID, &CID);
+		/* Find where the command is. Because this is randomly specified by firmware. */
+		if ((CID & CID0MASK) == Command) {
+			ThisCIDMask = CID0MASK;
+			break;
+		} else if ((((CID & CID1MASK) >> 8) & 0xff) == Command) {
+			ThisCIDMask = CID1MASK;
+			break;
+		} else if ((((CID & CID2MASK) >> 16) & 0xff) == Command) {
+			ThisCIDMask = CID2MASK;
+			break;
+		} else if ((((CID & CID3MASK) >> 24) & 0xff) == Command) {
+			ThisCIDMask = CID3MASK;
+			break;
+		}
+
+		RTMPusecDelay(100);
+		i++;
+	} while (i < 200);
+
+	/* Get CommandStatus Value */
+	RTMP_IO_READ32(pAd, H2M_MAILBOX_STATUS, &CmdStatus);
+
+	/* This command's status is at the same position as command. So AND command position's bitmask to read status. */
+	if (i < 200) {
+		/* If Status is 1, the comamnd is success. */
+		if (((CmdStatus & ThisCIDMask) == 0x1)
+		    || ((CmdStatus & ThisCIDMask) == 0x100)
+		    || ((CmdStatus & ThisCIDMask) == 0x10000)
+		    || ((CmdStatus & ThisCIDMask) == 0x1000000)) {
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("--> AsicCheckCommanOk CID = 0x%x, CmdStatus= 0x%x \n",
+				  CID, CmdStatus));
+			RTMP_IO_WRITE32(pAd, H2M_MAILBOX_STATUS, 0xffffffff);
+			RTMP_IO_WRITE32(pAd, H2M_MAILBOX_CID, 0xffffffff);
+			return TRUE;
+		}
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("--> AsicCheckCommanFail1 CID = 0x%x, CmdStatus= 0x%x \n",
+			  CID, CmdStatus));
+	} else {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("--> AsicCheckCommanFail2 Timeout Command = %d, CmdStatus= 0x%x \n",
+			  Command, CmdStatus));
+	}
+	/* Clear Command and Status. */
+	RTMP_IO_WRITE32(pAd, H2M_MAILBOX_STATUS, 0xffffffff);
+	RTMP_IO_WRITE32(pAd, H2M_MAILBOX_CID, 0xffffffff);
+
+	return FALSE;
+}
+
+/*
+========================================================================
+Routine Description:
+    Write Beacon buffer to Asic.
+
+Arguments:
+	*pAd				the raxx interface data pointer
+
+Return Value:
+	None
+
+Note:
+========================================================================
+*/
+void RT28xx_UpdateBeaconToAsic(struct rt_rtmp_adapter *pAd,
+			       int apidx,
+			       unsigned long FrameLen, unsigned long UpdatePos)
+{
+	unsigned long CapInfoPos = 0;
+	u8 *ptr, *ptr_update, *ptr_capinfo;
+	u32 i;
+	BOOLEAN bBcnReq = FALSE;
+	u8 bcn_idx = 0;
+
+	{
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("%s() : No valid Interface be found.\n", __func__));
+		return;
+	}
+
+	/*if ((pAd->WdsTab.Mode == WDS_BRIDGE_MODE) */
+	/*      || ((pAd->ApCfg.MBSSID[apidx].MSSIDDev == NULL) */
+	/*              || !(pAd->ApCfg.MBSSID[apidx].MSSIDDev->flags & IFF_UP)) */
+	/*      ) */
+	if (bBcnReq == FALSE) {
+		/* when the ra interface is down, do not send its beacon frame */
+		/* clear all zero */
+		for (i = 0; i < TXWI_SIZE; i += 4)
+			RTMP_IO_WRITE32(pAd, pAd->BeaconOffset[bcn_idx] + i,
+					0x00);
+	} else {
+		ptr = (u8 *)& pAd->BeaconTxWI;
+		for (i = 0; i < TXWI_SIZE; i += 4)	/* 16-byte TXWI field */
+		{
+			u32 longptr =
+			    *ptr + (*(ptr + 1) << 8) + (*(ptr + 2) << 16) +
+			    (*(ptr + 3) << 24);
+			RTMP_IO_WRITE32(pAd, pAd->BeaconOffset[bcn_idx] + i,
+					longptr);
+			ptr += 4;
+		}
+
+		/* Update CapabilityInfo in Beacon */
+		for (i = CapInfoPos; i < (CapInfoPos + 2); i++) {
+			RTMP_IO_WRITE8(pAd,
+				       pAd->BeaconOffset[bcn_idx] + TXWI_SIZE +
+				       i, *ptr_capinfo);
+			ptr_capinfo++;
+		}
+
+		if (FrameLen > UpdatePos) {
+			for (i = UpdatePos; i < (FrameLen); i++) {
+				RTMP_IO_WRITE8(pAd,
+					       pAd->BeaconOffset[bcn_idx] +
+					       TXWI_SIZE + i, *ptr_update);
+				ptr_update++;
+			}
+		}
+
+	}
+
+}
+
+void RT28xxPciStaAsicForceWakeup(struct rt_rtmp_adapter *pAd, IN BOOLEAN bFromTx)
+{
+	AUTO_WAKEUP_STRUC AutoWakeupCfg;
+
+	if (!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE))
+		return;
+
+	if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_WAKEUP_NOW)) {
+		DBGPRINT(RT_DEBUG_TRACE, ("waking up now!\n"));
+		return;
+	}
+
+	OPSTATUS_SET_FLAG(pAd, fOP_STATUS_WAKEUP_NOW);
+
+	RTMP_CLEAR_PSFLAG(pAd, fRTMP_PS_GO_TO_SLEEP_NOW);
+
+	if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE)
+	    && pAd->StaCfg.PSControl.field.EnableNewPS == TRUE) {
+		/* Support PCIe Advance Power Save */
+		if (bFromTx == TRUE && (pAd->Mlme.bPsPollTimerRunning == TRUE)) {
+			pAd->Mlme.bPsPollTimerRunning = FALSE;
+			RTMPPCIeLinkCtrlValueRestore(pAd, RESTORE_WAKEUP);
+			RTMPusecDelay(3000);
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("=======AsicForceWakeup===bFromTx\n"));
+		}
+
+		AutoWakeupCfg.word = 0;
+		RTMP_IO_WRITE32(pAd, AUTO_WAKEUP_CFG, AutoWakeupCfg.word);
+
+		if (RT28xxPciAsicRadioOn(pAd, DOT11POWERSAVE)) {
+#ifdef PCIE_PS_SUPPORT
+			/* add by johnli, RF power sequence setup, load RF normal operation-mode setup */
+			if ((IS_RT3090(pAd) || IS_RT3572(pAd) || IS_RT3390(pAd))
+			    && IS_VERSION_AFTER_F(pAd)) {
+				struct rt_rtmp_chip_op *pChipOps = &pAd->chipOps;
+
+				if (pChipOps->AsicReverseRfFromSleepMode)
+					pChipOps->
+					    AsicReverseRfFromSleepMode(pAd);
+			} else
+#endif /* PCIE_PS_SUPPORT // */
+			{
+				/* end johnli */
+				/* In Radio Off, we turn off RF clk, So now need to call ASICSwitchChannel again. */
+				if (INFRA_ON(pAd)
+				    && (pAd->CommonCfg.CentralChannel !=
+					pAd->CommonCfg.Channel)
+				    && (pAd->MlmeAux.HtCapability.HtCapInfo.
+					ChannelWidth == BW_40)) {
+					/* Must using 40MHz. */
+					AsicSwitchChannel(pAd,
+							  pAd->CommonCfg.
+							  CentralChannel,
+							  FALSE);
+					AsicLockChannel(pAd,
+							pAd->CommonCfg.
+							CentralChannel);
+				} else {
+					/* Must using 20MHz. */
+					AsicSwitchChannel(pAd,
+							  pAd->CommonCfg.
+							  Channel, FALSE);
+					AsicLockChannel(pAd,
+							pAd->CommonCfg.Channel);
+				}
+			}
+		}
+#ifdef PCIE_PS_SUPPORT
+		/* 3090 MCU Wakeup command needs more time to be stable. */
+		/* Before stable, don't issue other MCU command to prevent from firmware error. */
+		if (((IS_RT3090(pAd) || IS_RT3572(pAd) || IS_RT3390(pAd))
+		     && IS_VERSION_AFTER_F(pAd)) && IS_VERSION_AFTER_F(pAd)
+		    && (pAd->StaCfg.PSControl.field.rt30xxPowerMode == 3)
+		    && (pAd->StaCfg.PSControl.field.EnableNewPS == TRUE)) {
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("<==RT28xxPciStaAsicForceWakeup::Release the MCU Lock(3090)\n"));
+			RTMP_SEM_LOCK(&pAd->McuCmdLock);
+			pAd->brt30xxBanMcuCmd = FALSE;
+			RTMP_SEM_UNLOCK(&pAd->McuCmdLock);
+		}
+#endif /* PCIE_PS_SUPPORT // */
+	} else {
+		/* PCI, 2860-PCIe */
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("<==RT28xxPciStaAsicForceWakeup::Original PCI Power Saving\n"));
+		AsicSendCommandToMcu(pAd, 0x31, 0xff, 0x00, 0x02);
+		AutoWakeupCfg.word = 0;
+		RTMP_IO_WRITE32(pAd, AUTO_WAKEUP_CFG, AutoWakeupCfg.word);
+	}
+
+	OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_DOZE);
+	OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_WAKEUP_NOW);
+	DBGPRINT(RT_DEBUG_TRACE, ("<=======RT28xxPciStaAsicForceWakeup\n"));
+}
+
+void RT28xxPciStaAsicSleepThenAutoWakeup(struct rt_rtmp_adapter *pAd,
+					 u16 TbttNumToNextWakeUp)
+{
+	BOOLEAN brc;
+
+	if (pAd->StaCfg.bRadio == FALSE) {
+		OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_DOZE);
+		return;
+	}
+	if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE)
+	    && pAd->StaCfg.PSControl.field.EnableNewPS == TRUE) {
+		unsigned long Now = 0;
+		if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_WAKEUP_NOW)) {
+			DBGPRINT(RT_DEBUG_TRACE, ("waking up now!\n"));
+			OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_DOZE);
+			return;
+		}
+
+		NdisGetSystemUpTime(&Now);
+		/* If last send NULL fram time is too close to this receiving beacon (within 8ms), don't go to sleep for this DTM. */
+		/* Because Some AP can't queuing outgoing frames immediately. */
+		if (((pAd->Mlme.LastSendNULLpsmTime + 8) >= Now)
+		    && (pAd->Mlme.LastSendNULLpsmTime <= Now)) {
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("Now = %lu, LastSendNULLpsmTime=%lu :  RxCountSinceLastNULL = %lu. \n",
+				  Now, pAd->Mlme.LastSendNULLpsmTime,
+				  pAd->RalinkCounters.RxCountSinceLastNULL));
+			return;
+		} else if ((pAd->RalinkCounters.RxCountSinceLastNULL > 0)
+			   &&
+			   ((pAd->Mlme.LastSendNULLpsmTime +
+			     pAd->CommonCfg.BeaconPeriod) >= Now)) {
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("Now = %lu, LastSendNULLpsmTime=%lu: RxCountSinceLastNULL = %lu > 0 \n",
+				  Now, pAd->Mlme.LastSendNULLpsmTime,
+				  pAd->RalinkCounters.RxCountSinceLastNULL));
+			return;
+		}
+
+		brc =
+		    RT28xxPciAsicRadioOff(pAd, DOT11POWERSAVE,
+					  TbttNumToNextWakeUp);
+		if (brc == TRUE)
+			OPSTATUS_SET_FLAG(pAd, fOP_STATUS_DOZE);
+	} else {
+		AUTO_WAKEUP_STRUC AutoWakeupCfg;
+		/* we have decided to SLEEP, so at least do it for a BEACON period. */
+		if (TbttNumToNextWakeUp == 0)
+			TbttNumToNextWakeUp = 1;
+
+		/*RTMP_IO_WRITE32(pAd, INT_MASK_CSR, AutoWakeupInt); */
+
+		AutoWakeupCfg.word = 0;
+		RTMP_IO_WRITE32(pAd, AUTO_WAKEUP_CFG, AutoWakeupCfg.word);
+		AutoWakeupCfg.field.NumofSleepingTbtt = TbttNumToNextWakeUp - 1;
+		AutoWakeupCfg.field.EnableAutoWakeup = 1;
+		AutoWakeupCfg.field.AutoLeadTime = 5;
+		RTMP_IO_WRITE32(pAd, AUTO_WAKEUP_CFG, AutoWakeupCfg.word);
+		AsicSendCommandToMcu(pAd, 0x30, 0xff, 0xff, 0x00);	/* send POWER-SAVE command to MCU. Timeout 40us. */
+		OPSTATUS_SET_FLAG(pAd, fOP_STATUS_DOZE);
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("<-- %s, TbttNumToNextWakeUp=%d \n", __func__,
+			  TbttNumToNextWakeUp));
+	}
+
+}
+
+void PsPollWakeExec(void *SystemSpecific1,
+		    void *FunctionContext,
+		    void *SystemSpecific2, void *SystemSpecific3)
+{
+	struct rt_rtmp_adapter *pAd = (struct rt_rtmp_adapter *)FunctionContext;
+	unsigned long flags;
+
+	DBGPRINT(RT_DEBUG_TRACE, ("-->PsPollWakeExec \n"));
+	RTMP_INT_LOCK(&pAd->irq_lock, flags);
+	if (pAd->Mlme.bPsPollTimerRunning) {
+		RTMPPCIeLinkCtrlValueRestore(pAd, RESTORE_WAKEUP);
+	}
+	pAd->Mlme.bPsPollTimerRunning = FALSE;
+	RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
+#ifdef PCIE_PS_SUPPORT
+	/* For rt30xx power solution 3, Use software timer to wake up in psm. So call */
+	/* AsicForceWakeup here instead of handling twakeup interrupt. */
+	if (((IS_RT3090(pAd) || IS_RT3572(pAd) || IS_RT3390(pAd))
+	     && IS_VERSION_AFTER_F(pAd))
+	    && (pAd->StaCfg.PSControl.field.rt30xxPowerMode == 3)
+	    && (pAd->StaCfg.PSControl.field.EnableNewPS == TRUE)) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("<--PsPollWakeExec::3090 calls AsicForceWakeup(pAd, DOT11POWERSAVE) in advance \n"));
+		AsicForceWakeup(pAd, DOT11POWERSAVE);
+	}
+#endif /* PCIE_PS_SUPPORT // */
+}
+
+void RadioOnExec(void *SystemSpecific1,
+		 void *FunctionContext,
+		 void *SystemSpecific2, void *SystemSpecific3)
+{
+	struct rt_rtmp_adapter *pAd = (struct rt_rtmp_adapter *)FunctionContext;
+	struct rt_rtmp_chip_op *pChipOps = &pAd->chipOps;
+	WPDMA_GLO_CFG_STRUC DmaCfg;
+	BOOLEAN Cancelled;
+
+	if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE)) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("-->RadioOnExec() return on fOP_STATUS_DOZE == TRUE; \n"));
+/*KH Debug: Add the compile flag "RT2860 and condition */
+#ifdef RTMP_PCI_SUPPORT
+		if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE)
+		    && pAd->StaCfg.PSControl.field.EnableNewPS == TRUE)
+			RTMPSetTimer(&pAd->Mlme.RadioOnOffTimer, 10);
+#endif /* RTMP_PCI_SUPPORT // */
+		return;
+	}
+
+	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS)) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("-->RadioOnExec() return on SCAN_IN_PROGRESS; \n"));
+#ifdef RTMP_PCI_SUPPORT
+		if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE)
+		    && pAd->StaCfg.PSControl.field.EnableNewPS == TRUE)
+			RTMPSetTimer(&pAd->Mlme.RadioOnOffTimer, 10);
+#endif /* RTMP_PCI_SUPPORT // */
+		return;
+	}
+/*KH Debug: need to check. I add the compile flag "CONFIG_STA_SUPPORT" to enclose the following codes. */
+#ifdef RTMP_PCI_SUPPORT
+	if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE)
+	    && pAd->StaCfg.PSControl.field.EnableNewPS == TRUE) {
+		pAd->Mlme.bPsPollTimerRunning = FALSE;
+		RTMPCancelTimer(&pAd->Mlme.PsPollTimer, &Cancelled);
+	}
+#endif /* RTMP_PCI_SUPPORT // */
+	if (pAd->StaCfg.bRadio == TRUE) {
+		pAd->bPCIclkOff = FALSE;
+		RTMPRingCleanUp(pAd, QID_AC_BK);
+		RTMPRingCleanUp(pAd, QID_AC_BE);
+		RTMPRingCleanUp(pAd, QID_AC_VI);
+		RTMPRingCleanUp(pAd, QID_AC_VO);
+		RTMPRingCleanUp(pAd, QID_MGMT);
+		RTMPRingCleanUp(pAd, QID_RX);
+
+		/* 2. Send wake up command. */
+		AsicSendCommandToMcu(pAd, 0x31, PowerWakeCID, 0x00, 0x02);
+		/* 2-1. wait command ok. */
+		AsicCheckCommanOk(pAd, PowerWakeCID);
+
+		/* When PCI clock is off, don't want to service interrupt. So when back to clock on, enable interrupt. */
+		/*RTMP_IO_WRITE32(pAd, INT_MASK_CSR, (DELAYINTMASK|RxINT)); */
+		RTMP_ASIC_INTERRUPT_ENABLE(pAd);
+
+		/* 3. Enable Tx DMA. */
+		RTMP_IO_READ32(pAd, WPDMA_GLO_CFG, &DmaCfg.word);
+		DmaCfg.field.EnableTxDMA = 1;
+		RTMP_IO_WRITE32(pAd, WPDMA_GLO_CFG, DmaCfg.word);
+
+		/* In Radio Off, we turn off RF clk, So now need to call ASICSwitchChannel again. */
+		if (INFRA_ON(pAd)
+		    && (pAd->CommonCfg.CentralChannel != pAd->CommonCfg.Channel)
+		    && (pAd->MlmeAux.HtCapability.HtCapInfo.ChannelWidth ==
+			BW_40)) {
+			/* Must using 40MHz. */
+			AsicSwitchChannel(pAd, pAd->CommonCfg.CentralChannel,
+					  FALSE);
+			AsicLockChannel(pAd, pAd->CommonCfg.CentralChannel);
+		} else {
+			/* Must using 20MHz. */
+			AsicSwitchChannel(pAd, pAd->CommonCfg.Channel, FALSE);
+			AsicLockChannel(pAd, pAd->CommonCfg.Channel);
+		}
+
+/*KH Debug:The following codes should be enclosed by RT3090 compile flag */
+		if (pChipOps->AsicReverseRfFromSleepMode)
+			pChipOps->AsicReverseRfFromSleepMode(pAd);
+
+#ifdef PCIE_PS_SUPPORT
+/* 3090 MCU Wakeup command needs more time to be stable. */
+/* Before stable, don't issue other MCU command to prevent from firmware error. */
+		if ((IS_RT3090(pAd) || IS_RT3572(pAd) || IS_RT3390(pAd))
+		    && IS_VERSION_AFTER_F(pAd)
+		    && (pAd->StaCfg.PSControl.field.rt30xxPowerMode == 3)
+		    && (pAd->StaCfg.PSControl.field.EnableNewPS == TRUE)) {
+			RTMP_SEM_LOCK(&pAd->McuCmdLock);
+			pAd->brt30xxBanMcuCmd = FALSE;
+			RTMP_SEM_UNLOCK(&pAd->McuCmdLock);
+		}
+#endif /* PCIE_PS_SUPPORT // */
+
+		/* Clear Radio off flag */
+		RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_RADIO_OFF);
+
+		/* Set LED */
+		RTMPSetLED(pAd, LED_RADIO_ON);
+
+		if (pAd->StaCfg.Psm == PWR_ACTIVE) {
+			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R3,
+						     pAd->StaCfg.BBPR3);
+		}
+	} else {
+		RT28xxPciAsicRadioOff(pAd, GUIRADIO_OFF, 0);
+	}
+}
+
+/*
+	==========================================================================
+	Description:
+		This routine sends command to firmware and turn our chip to wake up mode from power save mode.
+		Both RadioOn and .11 power save function needs to call this routine.
+	Input:
+		Level = GUIRADIO_OFF : call this function is from Radio Off to Radio On.  Need to restore PCI host value.
+		Level = other value : normal wake up function.
+
+	==========================================================================
+ */
+BOOLEAN RT28xxPciAsicRadioOn(struct rt_rtmp_adapter *pAd, u8 Level)
+{
+	/*WPDMA_GLO_CFG_STRUC       DmaCfg; */
+	BOOLEAN Cancelled;
+	/*u32                        MACValue; */
+
+	if (pAd->OpMode == OPMODE_AP && Level == DOT11POWERSAVE)
+		return FALSE;
+
+	if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE)) {
+		if (pAd->StaCfg.PSControl.field.EnableNewPS == TRUE) {
+			pAd->Mlme.bPsPollTimerRunning = FALSE;
+			RTMPCancelTimer(&pAd->Mlme.PsPollTimer, &Cancelled);
+		}
+		if ((pAd->StaCfg.PSControl.field.EnableNewPS == TRUE &&
+		     (Level == GUIRADIO_OFF || Level == GUI_IDLE_POWER_SAVE)) ||
+		    RTMP_TEST_PSFLAG(pAd, fRTMP_PS_SET_PCI_CLK_OFF_COMMAND)) {
+			/* Some chips don't need to delay 6ms, so copy RTMPPCIePowerLinkCtrlRestore */
+			/* return condition here. */
+			/*
+			   if (((pAd->MACVersion&0xffff0000) != 0x28600000)
+			   && ((pAd->DeviceID == NIC2860_PCIe_DEVICE_ID)
+			   ||(pAd->DeviceID == NIC2790_PCIe_DEVICE_ID)))
+			 */
+			{
+				DBGPRINT(RT_DEBUG_TRACE,
+					 ("RT28xxPciAsicRadioOn ()\n"));
+				/* 1. Set PCI Link Control in Configuration Space. */
+				RTMPPCIeLinkCtrlValueRestore(pAd,
+							     RESTORE_WAKEUP);
+				RTMPusecDelay(6000);
+			}
+		}
+	}
+#ifdef PCIE_PS_SUPPORT
+	if (!
+	    (((IS_RT3090(pAd) || IS_RT3572(pAd) || IS_RT3390(pAd))
+	      && IS_VERSION_AFTER_F(pAd)
+	      && (pAd->StaCfg.PSControl.field.rt30xxPowerMode == 3)
+	      && (pAd->StaCfg.PSControl.field.EnableNewPS == TRUE))))
+#endif /* PCIE_PS_SUPPORT // */
+	{
+		pAd->bPCIclkOff = FALSE;
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("PSM :309xbPCIclkOff == %d\n", pAd->bPCIclkOff));
+	}
+	/* 2. Send wake up command. */
+	AsicSendCommandToMcu(pAd, 0x31, PowerWakeCID, 0x00, 0x02);
+	pAd->bPCIclkOff = FALSE;
+	/* 2-1. wait command ok. */
+	AsicCheckCommanOk(pAd, PowerWakeCID);
+	RTMP_ASIC_INTERRUPT_ENABLE(pAd);
+
+	RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_IDLE_RADIO_OFF);
+	if (Level == GUI_IDLE_POWER_SAVE) {
+#ifdef  PCIE_PS_SUPPORT
+
+		/* add by johnli, RF power sequence setup, load RF normal operation-mode setup */
+		if ((IS_RT3090(pAd) || IS_RT3572(pAd) || IS_RT3390(pAd))) {
+			struct rt_rtmp_chip_op *pChipOps = &pAd->chipOps;
+
+			if (pChipOps->AsicReverseRfFromSleepMode)
+				pChipOps->AsicReverseRfFromSleepMode(pAd);
+			/* 3090 MCU Wakeup command needs more time to be stable. */
+			/* Before stable, don't issue other MCU command to prevent from firmware error. */
+			if ((IS_RT3090(pAd) || IS_RT3572(pAd) || IS_RT3390(pAd))
+			    && IS_VERSION_AFTER_F(pAd)
+			    && (pAd->StaCfg.PSControl.field.rt30xxPowerMode ==
+				3)
+			    && (pAd->StaCfg.PSControl.field.EnableNewPS ==
+				TRUE)) {
+				RTMP_SEM_LOCK(&pAd->McuCmdLock);
+				pAd->brt30xxBanMcuCmd = FALSE;
+				RTMP_SEM_UNLOCK(&pAd->McuCmdLock);
+			}
+		} else
+			/* end johnli */
+#endif /* PCIE_PS_SUPPORT // */
+		{
+			/* In Radio Off, we turn off RF clk, So now need to call ASICSwitchChannel again. */
+			{
+				if (INFRA_ON(pAd)
+				    && (pAd->CommonCfg.CentralChannel !=
+					pAd->CommonCfg.Channel)
+				    && (pAd->MlmeAux.HtCapability.HtCapInfo.
+					ChannelWidth == BW_40)) {
+					/* Must using 40MHz. */
+					AsicSwitchChannel(pAd,
+							  pAd->CommonCfg.
+							  CentralChannel,
+							  FALSE);
+					AsicLockChannel(pAd,
+							pAd->CommonCfg.
+							CentralChannel);
+				} else {
+					/* Must using 20MHz. */
+					AsicSwitchChannel(pAd,
+							  pAd->CommonCfg.
+							  Channel, FALSE);
+					AsicLockChannel(pAd,
+							pAd->CommonCfg.Channel);
+				}
+			}
+
+		}
+	}
+	return TRUE;
+
+}
+
+/*
+	==========================================================================
+	Description:
+		This routine sends command to firmware and turn our chip to power save mode.
+		Both RadioOff and .11 power save function needs to call this routine.
+	Input:
+		Level = GUIRADIO_OFF  : GUI Radio Off mode
+		Level = DOT11POWERSAVE  : 802.11 power save mode
+		Level = RTMP_HALT  : When Disable device.
+
+	==========================================================================
+ */
+BOOLEAN RT28xxPciAsicRadioOff(struct rt_rtmp_adapter *pAd,
+			      u8 Level, u16 TbttNumToNextWakeUp)
+{
+	WPDMA_GLO_CFG_STRUC DmaCfg;
+	u8 i, tempBBP_R3 = 0;
+	BOOLEAN brc = FALSE, Cancelled;
+	u32 TbTTTime = 0;
+	u32 PsPollTime = 0 /*, MACValue */ ;
+	unsigned long BeaconPeriodTime;
+	u32 RxDmaIdx, RxCpuIdx;
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("AsicRadioOff ===> Lv= %d, TxCpuIdx = %d, TxDmaIdx = %d. RxCpuIdx = %d, RxDmaIdx = %d.\n",
+		  Level, pAd->TxRing[0].TxCpuIdx, pAd->TxRing[0].TxDmaIdx,
+		  pAd->RxRing.RxCpuIdx, pAd->RxRing.RxDmaIdx));
+
+	if (pAd->OpMode == OPMODE_AP && Level == DOT11POWERSAVE)
+		return FALSE;
+
+	/* Check Rx DMA busy status, if more than half is occupied, give up this radio off. */
+	RTMP_IO_READ32(pAd, RX_DRX_IDX, &RxDmaIdx);
+	RTMP_IO_READ32(pAd, RX_CRX_IDX, &RxCpuIdx);
+	if ((RxDmaIdx > RxCpuIdx) && ((RxDmaIdx - RxCpuIdx) > RX_RING_SIZE / 3)) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("AsicRadioOff ===> return1. RxDmaIdx = %d ,  RxCpuIdx = %d. \n",
+			  RxDmaIdx, RxCpuIdx));
+		return FALSE;
+	} else if ((RxCpuIdx >= RxDmaIdx)
+		   && ((RxCpuIdx - RxDmaIdx) < RX_RING_SIZE / 3)) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("AsicRadioOff ===> return2.  RxCpuIdx = %d. RxDmaIdx = %d ,  \n",
+			  RxCpuIdx, RxDmaIdx));
+		return FALSE;
+	}
+	/* Once go into this function, disable tx because don't want too many packets in queue to prevent HW stops. */
+	/*pAd->bPCIclkOffDisableTx = TRUE; */
+	RTMP_SET_PSFLAG(pAd, fRTMP_PS_DISABLE_TX);
+	if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE)
+	    && pAd->OpMode == OPMODE_STA
+	    && pAd->StaCfg.PSControl.field.EnableNewPS == TRUE) {
+		RTMPCancelTimer(&pAd->Mlme.RadioOnOffTimer, &Cancelled);
+		RTMPCancelTimer(&pAd->Mlme.PsPollTimer, &Cancelled);
+
+		if (Level == DOT11POWERSAVE) {
+			RTMP_IO_READ32(pAd, TBTT_TIMER, &TbTTTime);
+			TbTTTime &= 0x1ffff;
+			/* 00. check if need to do sleep in this DTIM period.   If next beacon will arrive within 30ms , ...doesn't necessarily sleep. */
+			/* TbTTTime uint = 64us, LEAD_TIME unit = 1024us, PsPollTime unit = 1ms */
+			if (((64 * TbTTTime) < ((LEAD_TIME * 1024) + 40000))
+			    && (TbttNumToNextWakeUp == 0)) {
+				DBGPRINT(RT_DEBUG_TRACE,
+					 ("TbTTTime = 0x%x , give up this sleep. \n",
+					  TbTTTime));
+				OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_DOZE);
+				/*pAd->bPCIclkOffDisableTx = FALSE; */
+				RTMP_CLEAR_PSFLAG(pAd, fRTMP_PS_DISABLE_TX);
+				return FALSE;
+			} else {
+				PsPollTime =
+				    (64 * TbTTTime - LEAD_TIME * 1024) / 1000;
+#ifdef PCIE_PS_SUPPORT
+				if ((IS_RT3090(pAd) || IS_RT3572(pAd)
+				     || IS_RT3390(pAd))
+				    && IS_VERSION_AFTER_F(pAd)
+				    && (pAd->StaCfg.PSControl.field.
+					rt30xxPowerMode == 3)
+				    && (pAd->StaCfg.PSControl.field.
+					EnableNewPS == TRUE)) {
+					PsPollTime -= 5;
+				} else
+#endif /* PCIE_PS_SUPPORT // */
+					PsPollTime -= 3;
+
+				BeaconPeriodTime =
+				    pAd->CommonCfg.BeaconPeriod * 102 / 100;
+				if (TbttNumToNextWakeUp > 0)
+					PsPollTime +=
+					    ((TbttNumToNextWakeUp -
+					      1) * BeaconPeriodTime);
+
+				pAd->Mlme.bPsPollTimerRunning = TRUE;
+				RTMPSetTimer(&pAd->Mlme.PsPollTimer,
+					     PsPollTime);
+			}
+		}
+	} else {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("RT28xxPciAsicRadioOff::Level!=DOT11POWERSAVE \n"));
+	}
+
+	pAd->bPCIclkOffDisableTx = FALSE;
+
+	RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_IDLE_RADIO_OFF);
+
+	/* Set to 1R. */
+	if (pAd->Antenna.field.RxPath > 1 && pAd->OpMode == OPMODE_STA) {
+		tempBBP_R3 = (pAd->StaCfg.BBPR3 & 0xE7);
+		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R3, tempBBP_R3);
+	}
+	/* In Radio Off, we turn off RF clk, So now need to call ASICSwitchChannel again. */
+	if ((INFRA_ON(pAd) || pAd->OpMode == OPMODE_AP)
+	    && (pAd->CommonCfg.CentralChannel != pAd->CommonCfg.Channel)
+	    && (pAd->MlmeAux.HtCapability.HtCapInfo.ChannelWidth == BW_40)) {
+		/* Must using 40MHz. */
+		AsicTurnOffRFClk(pAd, pAd->CommonCfg.CentralChannel);
+	} else {
+		/* Must using 20MHz. */
+		AsicTurnOffRFClk(pAd, pAd->CommonCfg.Channel);
+	}
+
+	if (Level != RTMP_HALT) {
+		/* Change Interrupt bitmask. */
+		/* When PCI clock is off, don't want to service interrupt. */
+		RTMP_IO_WRITE32(pAd, INT_MASK_CSR, AutoWakeupInt);
+	} else {
+		RTMP_ASIC_INTERRUPT_DISABLE(pAd);
+	}
+
+	RTMP_IO_WRITE32(pAd, RX_CRX_IDX, pAd->RxRing.RxCpuIdx);
+	/*  2. Send Sleep command */
+	RTMP_IO_WRITE32(pAd, H2M_MAILBOX_STATUS, 0xffffffff);
+	RTMP_IO_WRITE32(pAd, H2M_MAILBOX_CID, 0xffffffff);
+	/* send POWER-SAVE command to MCU. high-byte = 1 save power as much as possible. high byte = 0 save less power */
+	AsicSendCommandToMcu(pAd, 0x30, PowerSafeCID, 0xff, 0x1);
+	/*  2-1. Wait command success */
+	/* Status = 1 : success, Status = 2, already sleep, Status = 3, Maybe MAC is busy so can't finish this task. */
+	brc = AsicCheckCommanOk(pAd, PowerSafeCID);
+
+	/*  3. After 0x30 command is ok, send radio off command. lowbyte = 0 for power safe. */
+	/* If 0x30 command is not ok this time, we can ignore 0x35 command. It will make sure not cause firmware'r problem. */
+	if ((Level == DOT11POWERSAVE) && (brc == TRUE)) {
+		AsicSendCommandToMcu(pAd, 0x35, PowerRadioOffCID, 0, 0x00);	/* lowbyte = 0 means to do power safe, NOT turn off radio. */
+		/*  3-1. Wait command success */
+		AsicCheckCommanOk(pAd, PowerRadioOffCID);
+	} else if (brc == TRUE) {
+		AsicSendCommandToMcu(pAd, 0x35, PowerRadioOffCID, 1, 0x00);	/* lowbyte = 0 means to do power safe, NOT turn off radio. */
+		/*  3-1. Wait command success */
+		AsicCheckCommanOk(pAd, PowerRadioOffCID);
+	}
+	/* 1. Wait DMA not busy */
+	i = 0;
+	do {
+		RTMP_IO_READ32(pAd, WPDMA_GLO_CFG, &DmaCfg.word);
+		if ((DmaCfg.field.RxDMABusy == 0)
+		    && (DmaCfg.field.TxDMABusy == 0))
+			break;
+		RTMPusecDelay(20);
+		i++;
+	} while (i < 50);
+
+	/*
+	   if (i >= 50)
+	   {
+	   pAd->CheckDmaBusyCount++;
+	   DBGPRINT(RT_DEBUG_TRACE, ("DMA Rx keeps busy.  return on AsicRadioOff () CheckDmaBusyCount = %d \n", pAd->CheckDmaBusyCount));
+	   }
+	   else
+	   {
+	   pAd->CheckDmaBusyCount = 0;
+	   }
+	 */
+/*KH Debug:My original codes have the follwoing codes, but currecnt codes do not have it. */
+/* Disable for stability. If PCIE Link Control is modified for advance power save, re-covery this code segment. */
+	RTMP_IO_WRITE32(pAd, PBF_SYS_CTRL, 0x1280);
+/*OPSTATUS_SET_FLAG(pAd, fOP_STATUS_CLKSELECT_40MHZ); */
+
+#ifdef PCIE_PS_SUPPORT
+	if ((IS_RT3090(pAd) || IS_RT3572(pAd) || IS_RT3390(pAd))
+	    && IS_VERSION_AFTER_F(pAd)
+	    && (pAd->StaCfg.PSControl.field.rt30xxPowerMode == 3)
+	    && (pAd->StaCfg.PSControl.field.EnableNewPS == TRUE)) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("RT28xxPciAsicRadioOff::3090 return to skip the following TbttNumToNextWakeUp setting for 279x\n"));
+		pAd->bPCIclkOff = TRUE;
+		RTMP_CLEAR_PSFLAG(pAd, fRTMP_PS_DISABLE_TX);
+		/* For this case, doesn't need to below actions, so return here. */
+		return brc;
+	}
+#endif /* PCIE_PS_SUPPORT // */
+
+	if (Level == DOT11POWERSAVE) {
+		AUTO_WAKEUP_STRUC AutoWakeupCfg;
+		/*RTMPSetTimer(&pAd->Mlme.PsPollTimer, 90); */
+
+		/* we have decided to SLEEP, so at least do it for a BEACON period. */
+		if (TbttNumToNextWakeUp == 0)
+			TbttNumToNextWakeUp = 1;
+
+		AutoWakeupCfg.word = 0;
+		RTMP_IO_WRITE32(pAd, AUTO_WAKEUP_CFG, AutoWakeupCfg.word);
+
+		/* 1. Set auto wake up timer. */
+		AutoWakeupCfg.field.NumofSleepingTbtt = TbttNumToNextWakeUp - 1;
+		AutoWakeupCfg.field.EnableAutoWakeup = 1;
+		AutoWakeupCfg.field.AutoLeadTime = LEAD_TIME;
+		RTMP_IO_WRITE32(pAd, AUTO_WAKEUP_CFG, AutoWakeupCfg.word);
+	}
+	/*  4-1. If it's to disable our device. Need to restore PCI Configuration Space to its original value. */
+	if (Level == RTMP_HALT && pAd->OpMode == OPMODE_STA) {
+		if ((brc == TRUE) && (i < 50))
+			RTMPPCIeLinkCtrlSetting(pAd, 1);
+	}
+	/*  4. Set PCI configuration Space Link Comtrol fields.  Only Radio Off needs to call this function */
+	else if (pAd->OpMode == OPMODE_STA) {
+		if ((brc == TRUE) && (i < 50))
+			RTMPPCIeLinkCtrlSetting(pAd, 3);
+	}
+	/*pAd->bPCIclkOffDisableTx = FALSE; */
+	RTMP_CLEAR_PSFLAG(pAd, fRTMP_PS_DISABLE_TX);
+	return TRUE;
+}
+
+void RT28xxPciMlmeRadioOn(struct rt_rtmp_adapter *pAd)
+{
+	if (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RADIO_OFF))
+		return;
+
+	DBGPRINT(RT_DEBUG_TRACE, ("%s===>\n", __func__));
+
+	if ((pAd->OpMode == OPMODE_AP) || ((pAd->OpMode == OPMODE_STA)
+					   &&
+					   (!OPSTATUS_TEST_FLAG
+					    (pAd, fOP_STATUS_PCIE_DEVICE)
+					    || pAd->StaCfg.PSControl.field.
+					    EnableNewPS == FALSE))) {
+		RT28xxPciAsicRadioOn(pAd, GUI_IDLE_POWER_SAVE);
+		/*NICResetFromError(pAd); */
+
+		RTMPRingCleanUp(pAd, QID_AC_BK);
+		RTMPRingCleanUp(pAd, QID_AC_BE);
+		RTMPRingCleanUp(pAd, QID_AC_VI);
+		RTMPRingCleanUp(pAd, QID_AC_VO);
+		RTMPRingCleanUp(pAd, QID_MGMT);
+		RTMPRingCleanUp(pAd, QID_RX);
+
+		/* Enable Tx/Rx */
+		RTMPEnableRxTx(pAd);
+
+		/* Clear Radio off flag */
+		RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_RADIO_OFF);
+
+		RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_IDLE_RADIO_OFF);
+
+		/* Set LED */
+		RTMPSetLED(pAd, LED_RADIO_ON);
+	}
+
+	if ((pAd->OpMode == OPMODE_STA) &&
+	    (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE))
+	    && (pAd->StaCfg.PSControl.field.EnableNewPS == TRUE)) {
+		BOOLEAN Cancelled;
+
+		RTMPPCIeLinkCtrlValueRestore(pAd, RESTORE_WAKEUP);
+
+		pAd->Mlme.bPsPollTimerRunning = FALSE;
+		RTMPCancelTimer(&pAd->Mlme.PsPollTimer, &Cancelled);
+		RTMPCancelTimer(&pAd->Mlme.RadioOnOffTimer, &Cancelled);
+		RTMPSetTimer(&pAd->Mlme.RadioOnOffTimer, 40);
+	}
+}
+
+void RT28xxPciMlmeRadioOFF(struct rt_rtmp_adapter *pAd)
+{
+	BOOLEAN brc = TRUE;
+
+	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RADIO_OFF))
+		return;
+
+	/* Link down first if any association exists */
+	if (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)) {
+		if (INFRA_ON(pAd) || ADHOC_ON(pAd)) {
+			struct rt_mlme_disassoc_req DisReq;
+			struct rt_mlme_queue_elem *pMsgElem =
+			    (struct rt_mlme_queue_elem *)kmalloc(sizeof(struct rt_mlme_queue_elem),
+							MEM_ALLOC_FLAG);
+
+			if (pMsgElem) {
+				COPY_MAC_ADDR(&DisReq.Addr,
+					      pAd->CommonCfg.Bssid);
+				DisReq.Reason = REASON_DISASSOC_STA_LEAVING;
+
+				pMsgElem->Machine = ASSOC_STATE_MACHINE;
+				pMsgElem->MsgType = MT2_MLME_DISASSOC_REQ;
+				pMsgElem->MsgLen =
+				    sizeof(struct rt_mlme_disassoc_req);
+				NdisMoveMemory(pMsgElem->Msg, &DisReq,
+					       sizeof
+					       (struct rt_mlme_disassoc_req));
+
+				MlmeDisassocReqAction(pAd, pMsgElem);
+				kfree(pMsgElem);
+
+				RTMPusecDelay(1000);
+			}
+		}
+	}
+
+	DBGPRINT(RT_DEBUG_TRACE, ("%s===>\n", __func__));
+
+	/* Set Radio off flag */
+	RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_RADIO_OFF);
+
+	{
+		BOOLEAN Cancelled;
+		if (pAd->StaCfg.PSControl.field.EnableNewPS == TRUE) {
+			if (RTMP_TEST_FLAG
+			    (pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS)) {
+				RTMPCancelTimer(&pAd->MlmeAux.ScanTimer,
+						&Cancelled);
+				RTMP_CLEAR_FLAG(pAd,
+						fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS);
+			}
+			/* If during power safe mode. */
+			if (pAd->StaCfg.bRadio == TRUE) {
+				DBGPRINT(RT_DEBUG_TRACE,
+					 ("-->MlmeRadioOff() return on bRadio == TRUE; \n"));
+				return;
+			}
+			/* Always radio on since the NIC needs to set the MCU command (LED_RADIO_OFF). */
+			if (IDLE_ON(pAd) &&
+			    (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_IDLE_RADIO_OFF)))
+			{
+				RT28xxPciAsicRadioOn(pAd, GUI_IDLE_POWER_SAVE);
+			}
+			if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE)) {
+				BOOLEAN Cancelled;
+				pAd->Mlme.bPsPollTimerRunning = FALSE;
+				RTMPCancelTimer(&pAd->Mlme.PsPollTimer,
+						&Cancelled);
+				RTMPCancelTimer(&pAd->Mlme.RadioOnOffTimer,
+						&Cancelled);
+			}
+		}
+		/* Link down first if any association exists */
+		if (INFRA_ON(pAd) || ADHOC_ON(pAd))
+			LinkDown(pAd, FALSE);
+		RTMPusecDelay(10000);
+		/*========================================== */
+		/* Clean up old bss table */
+		BssTableInit(&pAd->ScanTab);
+
+		/*
+		   if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE))
+		   {
+		   RTMPSetTimer(&pAd->Mlme.RadioOnOffTimer, 10);
+		   return;
+		   }
+		 */
+	}
+
+	/* Set LED.Move to here for fixing LED bug. This flag must be called after LinkDown */
+	RTMPSetLED(pAd, LED_RADIO_OFF);
+
+/*KH Debug:All PCIe devices need to use timer to execute radio off function, or the PCIe&&EnableNewPS needs. */
+/*KH Ans:It is right, because only when the PCIe and EnableNewPs is true, we need to delay the RadioOffTimer */
+/*to avoid the deadlock with PCIe Power saving function. */
+	if (pAd->OpMode == OPMODE_STA &&
+	    OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE) &&
+	    pAd->StaCfg.PSControl.field.EnableNewPS == TRUE) {
+		RTMPSetTimer(&pAd->Mlme.RadioOnOffTimer, 10);
+	} else {
+		brc = RT28xxPciAsicRadioOff(pAd, GUIRADIO_OFF, 0);
+
+		if (brc == FALSE) {
+			DBGPRINT(RT_DEBUG_ERROR,
+				 ("%s call RT28xxPciAsicRadioOff fail!\n",
+				  __func__));
+		}
+	}
+/*
+*/
+}
+
+#endif /* RTMP_MAC_PCI // */
diff --git a/drivers/staging/rt2860/common/cmm_mac_usb.c b/drivers/staging/rt2860/common/cmm_mac_usb.c
new file mode 100644
index 000000000000..9dd6959cd5a5
--- /dev/null
+++ b/drivers/staging/rt2860/common/cmm_mac_usb.c
@@ -0,0 +1,1165 @@
+/*
+ *************************************************************************
+ * Ralink Tech Inc.
+ * 5F., No.36, Taiyuan St., Jhubei City,
+ * Hsinchu County 302,
+ * Taiwan, R.O.C.
+ *
+ * (c) Copyright 2002-2007, Ralink Technology, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify  *
+ * it under the terms of the GNU General Public License as published by  *
+ * the Free Software Foundation; either version 2 of the License, or     *
+ * (at your option) any later version.                                   *
+ *                                                                       *
+ * This program is distributed in the hope that it will be useful,       *
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
+ * GNU General Public License for more details.                          *
+ *                                                                       *
+ * You should have received a copy of the GNU General Public License     *
+ * along with this program; if not, write to the                         *
+ * Free Software Foundation, Inc.,                                       *
+ * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
+ *                                                                       *
+ *************************************************************************
+*/
+
+#ifdef RTMP_MAC_USB
+
+#include	"../rt_config.h"
+
+/*
+========================================================================
+Routine Description:
+    Initialize receive data structures.
+
+Arguments:
+    pAd					Pointer to our adapter
+
+Return Value:
+	NDIS_STATUS_SUCCESS
+	NDIS_STATUS_RESOURCES
+
+Note:
+	Initialize all receive releated private buffer, include those define
+	in struct rt_rtmp_adapter structure and all private data structures. The mahor
+	work is to allocate buffer for each packet and chain buffer to
+	NDIS packet descriptor.
+========================================================================
+*/
+int NICInitRecv(struct rt_rtmp_adapter *pAd)
+{
+	u8 i;
+	int Status = NDIS_STATUS_SUCCESS;
+	struct os_cookie *pObj = (struct os_cookie *)pAd->OS_Cookie;
+
+	DBGPRINT(RT_DEBUG_TRACE, ("--> NICInitRecv\n"));
+	pObj = pObj;
+
+	/*InterlockedExchange(&pAd->PendingRx, 0); */
+	pAd->PendingRx = 0;
+	pAd->NextRxBulkInReadIndex = 0;	/* Next Rx Read index */
+	pAd->NextRxBulkInIndex = 0;	/*RX_RING_SIZE -1; // Rx Bulk pointer */
+	pAd->NextRxBulkInPosition = 0;
+
+	for (i = 0; i < (RX_RING_SIZE); i++) {
+		struct rt_rx_context *pRxContext = &(pAd->RxContext[i]);
+
+		/*Allocate URB */
+		pRxContext->pUrb = RTUSB_ALLOC_URB(0);
+		if (pRxContext->pUrb == NULL) {
+			Status = NDIS_STATUS_RESOURCES;
+			goto out1;
+		}
+		/* Allocate transfer buffer */
+		pRxContext->TransferBuffer =
+		    RTUSB_URB_ALLOC_BUFFER(pObj->pUsb_Dev, MAX_RXBULK_SIZE,
+					   &pRxContext->data_dma);
+		if (pRxContext->TransferBuffer == NULL) {
+			Status = NDIS_STATUS_RESOURCES;
+			goto out1;
+		}
+
+		NdisZeroMemory(pRxContext->TransferBuffer, MAX_RXBULK_SIZE);
+
+		pRxContext->pAd = pAd;
+		pRxContext->pIrp = NULL;
+		pRxContext->InUse = FALSE;
+		pRxContext->IRPPending = FALSE;
+		pRxContext->Readable = FALSE;
+		/*pRxContext->ReorderInUse = FALSE; */
+		pRxContext->bRxHandling = FALSE;
+		pRxContext->BulkInOffset = 0;
+	}
+
+	DBGPRINT(RT_DEBUG_TRACE, ("<-- NICInitRecv(Status=%d)\n", Status));
+	return Status;
+
+out1:
+	for (i = 0; i < (RX_RING_SIZE); i++) {
+		struct rt_rx_context *pRxContext = &(pAd->RxContext[i]);
+
+		if (NULL != pRxContext->TransferBuffer) {
+			RTUSB_URB_FREE_BUFFER(pObj->pUsb_Dev, MAX_RXBULK_SIZE,
+					      pRxContext->TransferBuffer,
+					      pRxContext->data_dma);
+			pRxContext->TransferBuffer = NULL;
+		}
+
+		if (NULL != pRxContext->pUrb) {
+			RTUSB_UNLINK_URB(pRxContext->pUrb);
+			RTUSB_FREE_URB(pRxContext->pUrb);
+			pRxContext->pUrb = NULL;
+		}
+	}
+
+	return Status;
+}
+
+/*
+========================================================================
+Routine Description:
+    Initialize transmit data structures.
+
+Arguments:
+    pAd					Pointer to our adapter
+
+Return Value:
+	NDIS_STATUS_SUCCESS
+	NDIS_STATUS_RESOURCES
+
+Note:
+========================================================================
+*/
+int NICInitTransmit(struct rt_rtmp_adapter *pAd)
+{
+#define LM_USB_ALLOC(pObj, Context, TB_Type, BufferSize, Status, msg1, err1, msg2, err2)	\
+	Context->pUrb = RTUSB_ALLOC_URB(0);		\
+	if (Context->pUrb == NULL) {			\
+		DBGPRINT(RT_DEBUG_ERROR, msg1);		\
+		Status = NDIS_STATUS_RESOURCES;		\
+		goto err1; }						\
+											\
+	Context->TransferBuffer =				\
+		(TB_Type)RTUSB_URB_ALLOC_BUFFER(pObj->pUsb_Dev, BufferSize, &Context->data_dma);	\
+	if (Context->TransferBuffer == NULL) {	\
+		DBGPRINT(RT_DEBUG_ERROR, msg2);		\
+		Status = NDIS_STATUS_RESOURCES;		\
+		goto err2; }
+
+#define LM_URB_FREE(pObj, Context, BufferSize)				\
+	if (NULL != Context->pUrb) {							\
+		RTUSB_UNLINK_URB(Context->pUrb);					\
+		RTUSB_FREE_URB(Context->pUrb);						\
+		Context->pUrb = NULL; }								\
+	if (NULL != Context->TransferBuffer) {				\
+		RTUSB_URB_FREE_BUFFER(pObj->pUsb_Dev, BufferSize,	\
+								Context->TransferBuffer,	\
+								Context->data_dma);			\
+		Context->TransferBuffer = NULL; }
+
+	u8 i, acidx;
+	int Status = NDIS_STATUS_SUCCESS;
+	struct rt_tx_context *pNullContext = &(pAd->NullContext);
+	struct rt_tx_context *pPsPollContext = &(pAd->PsPollContext);
+	struct rt_tx_context *pRTSContext = &(pAd->RTSContext);
+	struct rt_tx_context *pMLMEContext = NULL;
+/*      struct rt_ht_tx_context *pHTTXContext = NULL; */
+	struct os_cookie *pObj = (struct os_cookie *)pAd->OS_Cookie;
+	void *RingBaseVa;
+/*      struct rt_rtmp_tx_ring *pTxRing; */
+	struct rt_rtmp_mgmt_ring *pMgmtRing;
+
+	DBGPRINT(RT_DEBUG_TRACE, ("--> NICInitTransmit\n"));
+	pObj = pObj;
+
+	/* Init 4 set of Tx parameters */
+	for (acidx = 0; acidx < NUM_OF_TX_RING; acidx++) {
+		/* Initialize all Transmit releated queues */
+		InitializeQueueHeader(&pAd->TxSwQueue[acidx]);
+
+		/* Next Local tx ring pointer waiting for buck out */
+		pAd->NextBulkOutIndex[acidx] = acidx;
+		pAd->BulkOutPending[acidx] = FALSE;	/* Buck Out control flag */
+		/*pAd->DataBulkDoneIdx[acidx] = 0; */
+	}
+
+	/*pAd->NextMLMEIndex    = 0; */
+	/*pAd->PushMgmtIndex    = 0; */
+	/*pAd->PopMgmtIndex     = 0; */
+	/*InterlockedExchange(&pAd->MgmtQueueSize, 0); */
+	/*InterlockedExchange(&pAd->TxCount, 0); */
+
+	/*pAd->PrioRingFirstIndex       = 0; */
+	/*pAd->PrioRingTxCnt            = 0; */
+
+	do {
+		/* */
+		/* TX_RING_SIZE, 4 ACs */
+		/* */
+		for (acidx = 0; acidx < 4; acidx++) {
+			struct rt_ht_tx_context *pHTTXContext = &(pAd->TxContext[acidx]);
+
+			NdisZeroMemory(pHTTXContext, sizeof(struct rt_ht_tx_context));
+			/*Allocate URB */
+			LM_USB_ALLOC(pObj, pHTTXContext, struct rt_httx_buffer *,
+				     sizeof(struct rt_httx_buffer), Status,
+				     ("<-- ERROR in Alloc TX TxContext[%d] urb!\n",
+				      acidx), done,
+				     ("<-- ERROR in Alloc TX TxContext[%d] struct rt_httx_buffer!\n",
+				      acidx), out1);
+
+			NdisZeroMemory(pHTTXContext->TransferBuffer->
+				       Aggregation, 4);
+			pHTTXContext->pAd = pAd;
+			pHTTXContext->pIrp = NULL;
+			pHTTXContext->IRPPending = FALSE;
+			pHTTXContext->NextBulkOutPosition = 0;
+			pHTTXContext->ENextBulkOutPosition = 0;
+			pHTTXContext->CurWritePosition = 0;
+			pHTTXContext->CurWriteRealPos = 0;
+			pHTTXContext->BulkOutSize = 0;
+			pHTTXContext->BulkOutPipeId = acidx;
+			pHTTXContext->bRingEmpty = TRUE;
+			pHTTXContext->bCopySavePad = FALSE;
+			pAd->BulkOutPending[acidx] = FALSE;
+		}
+
+		/* */
+		/* MGMT_RING_SIZE */
+		/* */
+
+		/* Allocate MGMT ring descriptor's memory */
+		pAd->MgmtDescRing.AllocSize =
+		    MGMT_RING_SIZE * sizeof(struct rt_tx_context);
+		os_alloc_mem(pAd, (u8 **) (&pAd->MgmtDescRing.AllocVa),
+			     pAd->MgmtDescRing.AllocSize);
+		if (pAd->MgmtDescRing.AllocVa == NULL) {
+			DBGPRINT_ERR(("Failed to allocate a big buffer for MgmtDescRing!\n"));
+			Status = NDIS_STATUS_RESOURCES;
+			goto out1;
+		}
+		NdisZeroMemory(pAd->MgmtDescRing.AllocVa,
+			       pAd->MgmtDescRing.AllocSize);
+		RingBaseVa = pAd->MgmtDescRing.AllocVa;
+
+		/* Initialize MGMT Ring and associated buffer memory */
+		pMgmtRing = &pAd->MgmtRing;
+		for (i = 0; i < MGMT_RING_SIZE; i++) {
+			/* link the pre-allocated Mgmt buffer to MgmtRing.Cell */
+			pMgmtRing->Cell[i].AllocSize = sizeof(struct rt_tx_context);
+			pMgmtRing->Cell[i].AllocVa = RingBaseVa;
+			pMgmtRing->Cell[i].pNdisPacket = NULL;
+			pMgmtRing->Cell[i].pNextNdisPacket = NULL;
+
+			/*Allocate URB for MLMEContext */
+			pMLMEContext =
+			    (struct rt_tx_context *)pAd->MgmtRing.Cell[i].AllocVa;
+			pMLMEContext->pUrb = RTUSB_ALLOC_URB(0);
+			if (pMLMEContext->pUrb == NULL) {
+				DBGPRINT(RT_DEBUG_ERROR,
+					 ("<-- ERROR in Alloc TX MLMEContext[%d] urb!\n",
+					  i));
+				Status = NDIS_STATUS_RESOURCES;
+				goto out2;
+			}
+			pMLMEContext->pAd = pAd;
+			pMLMEContext->pIrp = NULL;
+			pMLMEContext->TransferBuffer = NULL;
+			pMLMEContext->InUse = FALSE;
+			pMLMEContext->IRPPending = FALSE;
+			pMLMEContext->bWaitingBulkOut = FALSE;
+			pMLMEContext->BulkOutSize = 0;
+			pMLMEContext->SelfIdx = i;
+
+			/* Offset to next ring descriptor address */
+			RingBaseVa = (u8 *)RingBaseVa + sizeof(struct rt_tx_context);
+		}
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("MGMT Ring: total %d entry allocated\n", i));
+
+		/*pAd->MgmtRing.TxSwFreeIdx = (MGMT_RING_SIZE - 1); */
+		pAd->MgmtRing.TxSwFreeIdx = MGMT_RING_SIZE;
+		pAd->MgmtRing.TxCpuIdx = 0;
+		pAd->MgmtRing.TxDmaIdx = 0;
+
+		/* */
+		/* BEACON_RING_SIZE */
+		/* */
+		for (i = 0; i < BEACON_RING_SIZE; i++)	/* 2 */
+		{
+			struct rt_tx_context *pBeaconContext = &(pAd->BeaconContext[i]);
+
+			NdisZeroMemory(pBeaconContext, sizeof(struct rt_tx_context));
+
+			/*Allocate URB */
+			LM_USB_ALLOC(pObj, pBeaconContext, struct rt_tx_buffer *,
+				     sizeof(struct rt_tx_buffer), Status,
+				     ("<-- ERROR in Alloc TX BeaconContext[%d] urb!\n",
+				      i), out2,
+				     ("<-- ERROR in Alloc TX BeaconContext[%d] struct rt_tx_buffer!\n",
+				      i), out3);
+
+			pBeaconContext->pAd = pAd;
+			pBeaconContext->pIrp = NULL;
+			pBeaconContext->InUse = FALSE;
+			pBeaconContext->IRPPending = FALSE;
+		}
+
+		/* */
+		/* NullContext */
+		/* */
+		NdisZeroMemory(pNullContext, sizeof(struct rt_tx_context));
+
+		/*Allocate URB */
+		LM_USB_ALLOC(pObj, pNullContext, struct rt_tx_buffer *, sizeof(struct rt_tx_buffer),
+			     Status,
+			     ("<-- ERROR in Alloc TX NullContext urb!\n"),
+			     out3,
+			     ("<-- ERROR in Alloc TX NullContext struct rt_tx_buffer!\n"),
+			     out4);
+
+		pNullContext->pAd = pAd;
+		pNullContext->pIrp = NULL;
+		pNullContext->InUse = FALSE;
+		pNullContext->IRPPending = FALSE;
+
+		/* */
+		/* RTSContext */
+		/* */
+		NdisZeroMemory(pRTSContext, sizeof(struct rt_tx_context));
+
+		/*Allocate URB */
+		LM_USB_ALLOC(pObj, pRTSContext, struct rt_tx_buffer *, sizeof(struct rt_tx_buffer),
+			     Status,
+			     ("<-- ERROR in Alloc TX RTSContext urb!\n"),
+			     out4,
+			     ("<-- ERROR in Alloc TX RTSContext struct rt_tx_buffer!\n"),
+			     out5);
+
+		pRTSContext->pAd = pAd;
+		pRTSContext->pIrp = NULL;
+		pRTSContext->InUse = FALSE;
+		pRTSContext->IRPPending = FALSE;
+
+		/* */
+		/* PsPollContext */
+		/* */
+		/*NdisZeroMemory(pPsPollContext, sizeof(struct rt_tx_context)); */
+		/*Allocate URB */
+		LM_USB_ALLOC(pObj, pPsPollContext, struct rt_tx_buffer *,
+			     sizeof(struct rt_tx_buffer), Status,
+			     ("<-- ERROR in Alloc TX PsPollContext urb!\n"),
+			     out5,
+			     ("<-- ERROR in Alloc TX PsPollContext struct rt_tx_buffer!\n"),
+			     out6);
+
+		pPsPollContext->pAd = pAd;
+		pPsPollContext->pIrp = NULL;
+		pPsPollContext->InUse = FALSE;
+		pPsPollContext->IRPPending = FALSE;
+		pPsPollContext->bAggregatible = FALSE;
+		pPsPollContext->LastOne = TRUE;
+
+	} while (FALSE);
+
+done:
+	DBGPRINT(RT_DEBUG_TRACE, ("<-- NICInitTransmit(Status=%d)\n", Status));
+
+	return Status;
+
+	/* --------------------------- ERROR HANDLE --------------------------- */
+out6:
+	LM_URB_FREE(pObj, pPsPollContext, sizeof(struct rt_tx_buffer));
+
+out5:
+	LM_URB_FREE(pObj, pRTSContext, sizeof(struct rt_tx_buffer));
+
+out4:
+	LM_URB_FREE(pObj, pNullContext, sizeof(struct rt_tx_buffer));
+
+out3:
+	for (i = 0; i < BEACON_RING_SIZE; i++) {
+		struct rt_tx_context *pBeaconContext = &(pAd->BeaconContext[i]);
+		if (pBeaconContext)
+			LM_URB_FREE(pObj, pBeaconContext, sizeof(struct rt_tx_buffer));
+	}
+
+out2:
+	if (pAd->MgmtDescRing.AllocVa) {
+		pMgmtRing = &pAd->MgmtRing;
+		for (i = 0; i < MGMT_RING_SIZE; i++) {
+			pMLMEContext =
+			    (struct rt_tx_context *)pAd->MgmtRing.Cell[i].AllocVa;
+			if (pMLMEContext)
+				LM_URB_FREE(pObj, pMLMEContext,
+					    sizeof(struct rt_tx_buffer));
+		}
+		os_free_mem(pAd, pAd->MgmtDescRing.AllocVa);
+		pAd->MgmtDescRing.AllocVa = NULL;
+	}
+
+out1:
+	for (acidx = 0; acidx < 4; acidx++) {
+		struct rt_ht_tx_context *pTxContext = &(pAd->TxContext[acidx]);
+		if (pTxContext)
+			LM_URB_FREE(pObj, pTxContext, sizeof(struct rt_httx_buffer));
+	}
+
+	/* Here we didn't have any pre-allocated memory need to free. */
+
+	return Status;
+}
+
+/*
+========================================================================
+Routine Description:
+    Allocate DMA memory blocks for send, receive.
+
+Arguments:
+    pAd					Pointer to our adapter
+
+Return Value:
+	NDIS_STATUS_SUCCESS
+	NDIS_STATUS_FAILURE
+	NDIS_STATUS_RESOURCES
+
+Note:
+========================================================================
+*/
+int RTMPAllocTxRxRingMemory(struct rt_rtmp_adapter *pAd)
+{
+/*      struct rt_counter_802_11  pCounter = &pAd->WlanCounters; */
+	int Status;
+	int num;
+
+	DBGPRINT(RT_DEBUG_TRACE, ("--> RTMPAllocTxRxRingMemory\n"));
+
+	do {
+		/* Init the struct rt_cmdq and CmdQLock */
+		NdisAllocateSpinLock(&pAd->CmdQLock);
+		NdisAcquireSpinLock(&pAd->CmdQLock);
+		RTUSBInitializeCmdQ(&pAd->CmdQ);
+		NdisReleaseSpinLock(&pAd->CmdQLock);
+
+		NdisAllocateSpinLock(&pAd->MLMEBulkOutLock);
+		/*NdisAllocateSpinLock(&pAd->MLMEWaitQueueLock); */
+		NdisAllocateSpinLock(&pAd->BulkOutLock[0]);
+		NdisAllocateSpinLock(&pAd->BulkOutLock[1]);
+		NdisAllocateSpinLock(&pAd->BulkOutLock[2]);
+		NdisAllocateSpinLock(&pAd->BulkOutLock[3]);
+		NdisAllocateSpinLock(&pAd->BulkOutLock[4]);
+		NdisAllocateSpinLock(&pAd->BulkOutLock[5]);
+		NdisAllocateSpinLock(&pAd->BulkInLock);
+
+		for (num = 0; num < NUM_OF_TX_RING; num++) {
+			NdisAllocateSpinLock(&pAd->TxContextQueueLock[num]);
+		}
+
+/*              NdisAllocateSpinLock(&pAd->MemLock);    // Not used in RT28XX */
+
+/*              NdisAllocateSpinLock(&pAd->MacTabLock); // init it in UserCfgInit() */
+/*              NdisAllocateSpinLock(&pAd->BATabLock); // init it in BATableInit() */
+
+/*              for(num=0; num<MAX_LEN_OF_BA_REC_TABLE; num++) */
+/*              { */
+/*                      NdisAllocateSpinLock(&pAd->BATable.BARecEntry[num].RxReRingLock); */
+/*              } */
+
+		/* */
+		/* Init Mac Table */
+		/* */
+/*              MacTableInitialize(pAd); */
+
+		/* */
+		/* Init send data structures and related parameters */
+		/* */
+		Status = NICInitTransmit(pAd);
+		if (Status != NDIS_STATUS_SUCCESS)
+			break;
+
+		/* */
+		/* Init receive data structures and related parameters */
+		/* */
+		Status = NICInitRecv(pAd);
+		if (Status != NDIS_STATUS_SUCCESS)
+			break;
+
+		pAd->PendingIoCount = 1;
+
+	} while (FALSE);
+
+	NdisZeroMemory(&pAd->FragFrame, sizeof(struct rt_fragment_frame));
+	pAd->FragFrame.pFragPacket =
+	    RTMP_AllocateFragPacketBuffer(pAd, RX_BUFFER_NORMSIZE);
+
+	if (pAd->FragFrame.pFragPacket == NULL) {
+		Status = NDIS_STATUS_RESOURCES;
+	}
+
+	DBGPRINT_S(Status,
+		   ("<-- RTMPAllocTxRxRingMemory, Status=%x\n", Status));
+	return Status;
+}
+
+/*
+========================================================================
+Routine Description:
+	Calls USB_InterfaceStop and frees memory allocated for the URBs
+    calls NdisMDeregisterDevice and frees the memory
+    allocated in VNetInitialize for the Adapter Object
+
+Arguments:
+	*pAd				the raxx interface data pointer
+
+Return Value:
+	None
+
+Note:
+========================================================================
+*/
+void RTMPFreeTxRxRingMemory(struct rt_rtmp_adapter *pAd)
+{
+#define LM_URB_FREE(pObj, Context, BufferSize)				\
+	if (NULL != Context->pUrb) {							\
+		RTUSB_UNLINK_URB(Context->pUrb);					\
+		RTUSB_FREE_URB(Context->pUrb);						\
+		Context->pUrb = NULL; }								\
+	if (NULL != Context->TransferBuffer) {					\
+		RTUSB_URB_FREE_BUFFER(pObj->pUsb_Dev, BufferSize,	\
+								Context->TransferBuffer,	\
+								Context->data_dma);			\
+		Context->TransferBuffer = NULL; }
+
+	u32 i, acidx;
+	struct rt_tx_context *pNullContext = &pAd->NullContext;
+	struct rt_tx_context *pPsPollContext = &pAd->PsPollContext;
+	struct rt_tx_context *pRTSContext = &pAd->RTSContext;
+/*      struct rt_ht_tx_context *pHTTXContext; */
+	/*PRTMP_REORDERBUF      pReorderBuf; */
+	struct os_cookie *pObj = (struct os_cookie *)pAd->OS_Cookie;
+/*      struct rt_rtmp_tx_ring *pTxRing; */
+
+	DBGPRINT(RT_DEBUG_ERROR, ("---> RTMPFreeTxRxRingMemory\n"));
+	pObj = pObj;
+
+	/* Free all resources for the RECEIVE buffer queue. */
+	for (i = 0; i < (RX_RING_SIZE); i++) {
+		struct rt_rx_context *pRxContext = &(pAd->RxContext[i]);
+		if (pRxContext)
+			LM_URB_FREE(pObj, pRxContext, MAX_RXBULK_SIZE);
+	}
+
+	/* Free PsPoll frame resource */
+	LM_URB_FREE(pObj, pPsPollContext, sizeof(struct rt_tx_buffer));
+
+	/* Free NULL frame resource */
+	LM_URB_FREE(pObj, pNullContext, sizeof(struct rt_tx_buffer));
+
+	/* Free RTS frame resource */
+	LM_URB_FREE(pObj, pRTSContext, sizeof(struct rt_tx_buffer));
+
+	/* Free beacon frame resource */
+	for (i = 0; i < BEACON_RING_SIZE; i++) {
+		struct rt_tx_context *pBeaconContext = &(pAd->BeaconContext[i]);
+		if (pBeaconContext)
+			LM_URB_FREE(pObj, pBeaconContext, sizeof(struct rt_tx_buffer));
+	}
+
+	/* Free mgmt frame resource */
+	for (i = 0; i < MGMT_RING_SIZE; i++) {
+		struct rt_tx_context *pMLMEContext =
+		    (struct rt_tx_context *)pAd->MgmtRing.Cell[i].AllocVa;
+		/*LM_URB_FREE(pObj, pMLMEContext, sizeof(struct rt_tx_buffer)); */
+		if (NULL != pAd->MgmtRing.Cell[i].pNdisPacket) {
+			RTMPFreeNdisPacket(pAd,
+					   pAd->MgmtRing.Cell[i].pNdisPacket);
+			pAd->MgmtRing.Cell[i].pNdisPacket = NULL;
+			pMLMEContext->TransferBuffer = NULL;
+		}
+
+		if (pMLMEContext) {
+			if (NULL != pMLMEContext->pUrb) {
+				RTUSB_UNLINK_URB(pMLMEContext->pUrb);
+				RTUSB_FREE_URB(pMLMEContext->pUrb);
+				pMLMEContext->pUrb = NULL;
+			}
+		}
+	}
+	if (pAd->MgmtDescRing.AllocVa)
+		os_free_mem(pAd, pAd->MgmtDescRing.AllocVa);
+
+	/* Free Tx frame resource */
+	for (acidx = 0; acidx < 4; acidx++) {
+		struct rt_ht_tx_context *pHTTXContext = &(pAd->TxContext[acidx]);
+		if (pHTTXContext)
+			LM_URB_FREE(pObj, pHTTXContext, sizeof(struct rt_httx_buffer));
+	}
+
+	if (pAd->FragFrame.pFragPacket)
+		RELEASE_NDIS_PACKET(pAd, pAd->FragFrame.pFragPacket,
+				    NDIS_STATUS_SUCCESS);
+
+	for (i = 0; i < 6; i++) {
+		NdisFreeSpinLock(&pAd->BulkOutLock[i]);
+	}
+
+	NdisFreeSpinLock(&pAd->BulkInLock);
+	NdisFreeSpinLock(&pAd->MLMEBulkOutLock);
+
+	NdisFreeSpinLock(&pAd->CmdQLock);
+	/* Clear all pending bulk-out request flags. */
+	RTUSB_CLEAR_BULK_FLAG(pAd, 0xffffffff);
+
+/*      NdisFreeSpinLock(&pAd->MacTabLock); */
+
+/*      for(i=0; i<MAX_LEN_OF_BA_REC_TABLE; i++) */
+/*      { */
+/*              NdisFreeSpinLock(&pAd->BATable.BARecEntry[i].RxReRingLock); */
+/*      } */
+
+	DBGPRINT(RT_DEBUG_ERROR, ("<--- RTMPFreeTxRxRingMemory\n"));
+}
+
+/*
+========================================================================
+Routine Description:
+    Write WLAN MAC address to USB 2870.
+
+Arguments:
+    pAd					Pointer to our adapter
+
+Return Value:
+	NDIS_STATUS_SUCCESS
+
+Note:
+========================================================================
+*/
+int RTUSBWriteHWMACAddress(struct rt_rtmp_adapter *pAd)
+{
+	MAC_DW0_STRUC StaMacReg0;
+	MAC_DW1_STRUC StaMacReg1;
+	int Status = NDIS_STATUS_SUCCESS;
+	LARGE_INTEGER NOW;
+
+	/* initialize the random number generator */
+	RTMP_GetCurrentSystemTime(&NOW);
+
+	if (pAd->bLocalAdminMAC != TRUE) {
+		pAd->CurrentAddress[0] = pAd->PermanentAddress[0];
+		pAd->CurrentAddress[1] = pAd->PermanentAddress[1];
+		pAd->CurrentAddress[2] = pAd->PermanentAddress[2];
+		pAd->CurrentAddress[3] = pAd->PermanentAddress[3];
+		pAd->CurrentAddress[4] = pAd->PermanentAddress[4];
+		pAd->CurrentAddress[5] = pAd->PermanentAddress[5];
+	}
+	/* Write New MAC address to MAC_CSR2 & MAC_CSR3 & let ASIC know our new MAC */
+	StaMacReg0.field.Byte0 = pAd->CurrentAddress[0];
+	StaMacReg0.field.Byte1 = pAd->CurrentAddress[1];
+	StaMacReg0.field.Byte2 = pAd->CurrentAddress[2];
+	StaMacReg0.field.Byte3 = pAd->CurrentAddress[3];
+	StaMacReg1.field.Byte4 = pAd->CurrentAddress[4];
+	StaMacReg1.field.Byte5 = pAd->CurrentAddress[5];
+	StaMacReg1.field.U2MeMask = 0xff;
+	DBGPRINT_RAW(RT_DEBUG_TRACE,
+		     ("Local MAC = %02x:%02x:%02x:%02x:%02x:%02x\n",
+		      pAd->CurrentAddress[0], pAd->CurrentAddress[1],
+		      pAd->CurrentAddress[2], pAd->CurrentAddress[3],
+		      pAd->CurrentAddress[4], pAd->CurrentAddress[5]));
+
+	RTUSBWriteMACRegister(pAd, MAC_ADDR_DW0, StaMacReg0.word);
+	RTUSBWriteMACRegister(pAd, MAC_ADDR_DW1, StaMacReg1.word);
+	return Status;
+}
+
+/*
+========================================================================
+Routine Description:
+    Disable DMA.
+
+Arguments:
+	*pAd				the raxx interface data pointer
+
+Return Value:
+	None
+
+Note:
+========================================================================
+*/
+void RT28XXDMADisable(struct rt_rtmp_adapter *pAd)
+{
+	/* no use */
+}
+
+/*
+========================================================================
+Routine Description:
+    Enable DMA.
+
+Arguments:
+	*pAd				the raxx interface data pointer
+
+Return Value:
+	None
+
+Note:
+========================================================================
+*/
+void RT28XXDMAEnable(struct rt_rtmp_adapter *pAd)
+{
+	WPDMA_GLO_CFG_STRUC GloCfg;
+	USB_DMA_CFG_STRUC UsbCfg;
+	int i = 0;
+
+	RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, 0x4);
+	do {
+		RTMP_IO_READ32(pAd, WPDMA_GLO_CFG, &GloCfg.word);
+		if ((GloCfg.field.TxDMABusy == 0)
+		    && (GloCfg.field.RxDMABusy == 0))
+			break;
+
+		DBGPRINT(RT_DEBUG_TRACE, ("==>  DMABusy\n"));
+		RTMPusecDelay(1000);
+		i++;
+	} while (i < 200);
+
+	RTMPusecDelay(50);
+	GloCfg.field.EnTXWriteBackDDONE = 1;
+	GloCfg.field.EnableRxDMA = 1;
+	GloCfg.field.EnableTxDMA = 1;
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("<== WRITE DMA offset 0x208 = 0x%x\n", GloCfg.word));
+	RTMP_IO_WRITE32(pAd, WPDMA_GLO_CFG, GloCfg.word);
+
+	UsbCfg.word = 0;
+	UsbCfg.field.phyclear = 0;
+	/* usb version is 1.1,do not use bulk in aggregation */
+	if (pAd->BulkInMaxPacketSize == 512)
+		UsbCfg.field.RxBulkAggEn = 1;
+	/* for last packet, PBF might use more than limited, so minus 2 to prevent from error */
+	UsbCfg.field.RxBulkAggLmt = (MAX_RXBULK_SIZE / 1024) - 3;
+	UsbCfg.field.RxBulkAggTOut = 0x80;	/* 2006-10-18 */
+	UsbCfg.field.RxBulkEn = 1;
+	UsbCfg.field.TxBulkEn = 1;
+
+	RTUSBWriteMACRegister(pAd, USB_DMA_CFG, UsbCfg.word);
+
+}
+
+/********************************************************************
+  *
+  *	2870 Beacon Update Related functions.
+  *
+  ********************************************************************/
+
+/*
+========================================================================
+Routine Description:
+    Write Beacon buffer to Asic.
+
+Arguments:
+	*pAd				the raxx interface data pointer
+
+Return Value:
+	None
+
+Note:
+========================================================================
+*/
+void RT28xx_UpdateBeaconToAsic(struct rt_rtmp_adapter *pAd,
+			       int apidx,
+			       unsigned long FrameLen, unsigned long UpdatePos)
+{
+	u8 *pBeaconFrame = NULL;
+	u8 *ptr;
+	u32 i, padding;
+	struct rt_beacon_sync *pBeaconSync = pAd->CommonCfg.pBeaconSync;
+	u32 longValue;
+/*      u16                  shortValue; */
+	BOOLEAN bBcnReq = FALSE;
+	u8 bcn_idx = 0;
+
+	if (pBeaconFrame == NULL) {
+		DBGPRINT(RT_DEBUG_ERROR, ("pBeaconFrame is NULL!\n"));
+		return;
+	}
+
+	if (pBeaconSync == NULL) {
+		DBGPRINT(RT_DEBUG_ERROR, ("pBeaconSync is NULL!\n"));
+		return;
+	}
+	/*if ((pAd->WdsTab.Mode == WDS_BRIDGE_MODE) || */
+	/*      ((pAd->ApCfg.MBSSID[apidx].MSSIDDev == NULL) || !(pAd->ApCfg.MBSSID[apidx].MSSIDDev->flags & IFF_UP)) */
+	/*      ) */
+	if (bBcnReq == FALSE) {
+		/* when the ra interface is down, do not send its beacon frame */
+		/* clear all zero */
+		for (i = 0; i < TXWI_SIZE; i += 4) {
+			RTMP_IO_WRITE32(pAd, pAd->BeaconOffset[bcn_idx] + i,
+					0x00);
+		}
+		pBeaconSync->BeaconBitMap &=
+		    (~(BEACON_BITMAP_MASK & (1 << bcn_idx)));
+		NdisZeroMemory(pBeaconSync->BeaconTxWI[bcn_idx], TXWI_SIZE);
+	} else {
+		ptr = (u8 *)& pAd->BeaconTxWI;
+		if (NdisEqualMemory(pBeaconSync->BeaconTxWI[bcn_idx], &pAd->BeaconTxWI, TXWI_SIZE) == FALSE) {	/* If BeaconTxWI changed, we need to rewrite the TxWI for the Beacon frames. */
+			pBeaconSync->BeaconBitMap &=
+			    (~(BEACON_BITMAP_MASK & (1 << bcn_idx)));
+			NdisMoveMemory(pBeaconSync->BeaconTxWI[bcn_idx],
+				       &pAd->BeaconTxWI, TXWI_SIZE);
+		}
+
+		if ((pBeaconSync->BeaconBitMap & (1 << bcn_idx)) !=
+		    (1 << bcn_idx)) {
+			for (i = 0; i < TXWI_SIZE; i += 4)	/* 16-byte TXWI field */
+			{
+				longValue =
+				    *ptr + (*(ptr + 1) << 8) +
+				    (*(ptr + 2) << 16) + (*(ptr + 3) << 24);
+				RTMP_IO_WRITE32(pAd,
+						pAd->BeaconOffset[bcn_idx] + i,
+						longValue);
+				ptr += 4;
+			}
+		}
+
+		ptr = pBeaconSync->BeaconBuf[bcn_idx];
+		padding = (FrameLen & 0x01);
+		NdisZeroMemory((u8 *)(pBeaconFrame + FrameLen), padding);
+		FrameLen += padding;
+		for (i = 0; i < FrameLen /*HW_BEACON_OFFSET */ ; i += 2) {
+			if (NdisEqualMemory(ptr, pBeaconFrame, 2) == FALSE) {
+				NdisMoveMemory(ptr, pBeaconFrame, 2);
+				/*shortValue = *ptr + (*(ptr+1)<<8); */
+				/*RTMP_IO_WRITE8(pAd, pAd->BeaconOffset[bcn_idx] + TXWI_SIZE + i, shortValue); */
+				RTUSBMultiWrite(pAd,
+						pAd->BeaconOffset[bcn_idx] +
+						TXWI_SIZE + i, ptr, 2);
+			}
+			ptr += 2;
+			pBeaconFrame += 2;
+		}
+
+		pBeaconSync->BeaconBitMap |= (1 << bcn_idx);
+
+		/* For AP interface, set the DtimBitOn so that we can send Bcast/Mcast frame out after this beacon frame. */
+	}
+
+}
+
+void RTUSBBssBeaconStop(struct rt_rtmp_adapter *pAd)
+{
+	struct rt_beacon_sync *pBeaconSync;
+	int i, offset;
+	BOOLEAN Cancelled = TRUE;
+
+	pBeaconSync = pAd->CommonCfg.pBeaconSync;
+	if (pBeaconSync && pBeaconSync->EnableBeacon) {
+		int NumOfBcn;
+
+		{
+			NumOfBcn = MAX_MESH_NUM;
+		}
+
+		RTMPCancelTimer(&pAd->CommonCfg.BeaconUpdateTimer, &Cancelled);
+
+		for (i = 0; i < NumOfBcn; i++) {
+			NdisZeroMemory(pBeaconSync->BeaconBuf[i],
+				       HW_BEACON_OFFSET);
+			NdisZeroMemory(pBeaconSync->BeaconTxWI[i], TXWI_SIZE);
+
+			for (offset = 0; offset < HW_BEACON_OFFSET; offset += 4)
+				RTMP_IO_WRITE32(pAd,
+						pAd->BeaconOffset[i] + offset,
+						0x00);
+
+			pBeaconSync->CapabilityInfoLocationInBeacon[i] = 0;
+			pBeaconSync->TimIELocationInBeacon[i] = 0;
+		}
+		pBeaconSync->BeaconBitMap = 0;
+		pBeaconSync->DtimBitOn = 0;
+	}
+}
+
+void RTUSBBssBeaconStart(struct rt_rtmp_adapter *pAd)
+{
+	int apidx;
+	struct rt_beacon_sync *pBeaconSync;
+/*      LARGE_INTEGER   tsfTime, deltaTime; */
+
+	pBeaconSync = pAd->CommonCfg.pBeaconSync;
+	if (pBeaconSync && pBeaconSync->EnableBeacon) {
+		int NumOfBcn;
+
+		{
+			NumOfBcn = MAX_MESH_NUM;
+		}
+
+		for (apidx = 0; apidx < NumOfBcn; apidx++) {
+			u8 CapabilityInfoLocationInBeacon = 0;
+			u8 TimIELocationInBeacon = 0;
+
+			NdisZeroMemory(pBeaconSync->BeaconBuf[apidx],
+				       HW_BEACON_OFFSET);
+			pBeaconSync->CapabilityInfoLocationInBeacon[apidx] =
+			    CapabilityInfoLocationInBeacon;
+			pBeaconSync->TimIELocationInBeacon[apidx] =
+			    TimIELocationInBeacon;
+			NdisZeroMemory(pBeaconSync->BeaconTxWI[apidx],
+				       TXWI_SIZE);
+		}
+		pBeaconSync->BeaconBitMap = 0;
+		pBeaconSync->DtimBitOn = 0;
+		pAd->CommonCfg.BeaconUpdateTimer.Repeat = TRUE;
+
+		pAd->CommonCfg.BeaconAdjust = 0;
+		pAd->CommonCfg.BeaconFactor =
+		    0xffffffff / (pAd->CommonCfg.BeaconPeriod << 10);
+		pAd->CommonCfg.BeaconRemain =
+		    (0xffffffff % (pAd->CommonCfg.BeaconPeriod << 10)) + 1;
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("RTUSBBssBeaconStart:BeaconFactor=%d, BeaconRemain=%d!\n",
+			  pAd->CommonCfg.BeaconFactor,
+			  pAd->CommonCfg.BeaconRemain));
+		RTMPSetTimer(&pAd->CommonCfg.BeaconUpdateTimer,
+			     10 /*pAd->CommonCfg.BeaconPeriod */ );
+
+	}
+}
+
+void RTUSBBssBeaconInit(struct rt_rtmp_adapter *pAd)
+{
+	struct rt_beacon_sync *pBeaconSync;
+	int i;
+
+	os_alloc_mem(pAd, (u8 **) (&pAd->CommonCfg.pBeaconSync),
+		     sizeof(struct rt_beacon_sync));
+	/*NdisAllocMemory(pAd->CommonCfg.pBeaconSync, sizeof(struct rt_beacon_sync), MEM_ALLOC_FLAG); */
+	if (pAd->CommonCfg.pBeaconSync) {
+		pBeaconSync = pAd->CommonCfg.pBeaconSync;
+		NdisZeroMemory(pBeaconSync, sizeof(struct rt_beacon_sync));
+		for (i = 0; i < HW_BEACON_MAX_COUNT; i++) {
+			NdisZeroMemory(pBeaconSync->BeaconBuf[i],
+				       HW_BEACON_OFFSET);
+			pBeaconSync->CapabilityInfoLocationInBeacon[i] = 0;
+			pBeaconSync->TimIELocationInBeacon[i] = 0;
+			NdisZeroMemory(pBeaconSync->BeaconTxWI[i], TXWI_SIZE);
+		}
+		pBeaconSync->BeaconBitMap = 0;
+
+		/*RTMPInitTimer(pAd, &pAd->CommonCfg.BeaconUpdateTimer, GET_TIMER_FUNCTION(BeaconUpdateExec), pAd, TRUE); */
+		pBeaconSync->EnableBeacon = TRUE;
+	}
+}
+
+void RTUSBBssBeaconExit(struct rt_rtmp_adapter *pAd)
+{
+	struct rt_beacon_sync *pBeaconSync;
+	BOOLEAN Cancelled = TRUE;
+	int i;
+
+	if (pAd->CommonCfg.pBeaconSync) {
+		pBeaconSync = pAd->CommonCfg.pBeaconSync;
+		pBeaconSync->EnableBeacon = FALSE;
+		RTMPCancelTimer(&pAd->CommonCfg.BeaconUpdateTimer, &Cancelled);
+		pBeaconSync->BeaconBitMap = 0;
+
+		for (i = 0; i < HW_BEACON_MAX_COUNT; i++) {
+			NdisZeroMemory(pBeaconSync->BeaconBuf[i],
+				       HW_BEACON_OFFSET);
+			pBeaconSync->CapabilityInfoLocationInBeacon[i] = 0;
+			pBeaconSync->TimIELocationInBeacon[i] = 0;
+			NdisZeroMemory(pBeaconSync->BeaconTxWI[i], TXWI_SIZE);
+		}
+
+		os_free_mem(pAd, pAd->CommonCfg.pBeaconSync);
+		pAd->CommonCfg.pBeaconSync = NULL;
+	}
+}
+
+/*
+    ========================================================================
+    Routine Description:
+        For device work as AP mode but didn't have TBTT interrupt event, we need a mechanism
+        to update the beacon context in each Beacon interval. Here we use a periodical timer
+        to simulate the TBTT interrupt to handle the beacon context update.
+
+    Arguments:
+        SystemSpecific1         - Not used.
+        FunctionContext         - Pointer to our Adapter context.
+        SystemSpecific2         - Not used.
+        SystemSpecific3         - Not used.
+
+    Return Value:
+        None
+
+    ========================================================================
+*/
+void BeaconUpdateExec(void *SystemSpecific1,
+		      void *FunctionContext,
+		      void *SystemSpecific2, void *SystemSpecific3)
+{
+	struct rt_rtmp_adapter *pAd = (struct rt_rtmp_adapter *)FunctionContext;
+	LARGE_INTEGER tsfTime_a;	/*, tsfTime_b, deltaTime_exp, deltaTime_ab; */
+	u32 delta, delta2MS, period2US, remain, remain_low, remain_high;
+/*      BOOLEAN                 positive; */
+
+	if (pAd->CommonCfg.IsUpdateBeacon == TRUE) {
+		ReSyncBeaconTime(pAd);
+
+	}
+
+	RTMP_IO_READ32(pAd, TSF_TIMER_DW0, &tsfTime_a.u.LowPart);
+	RTMP_IO_READ32(pAd, TSF_TIMER_DW1, &tsfTime_a.u.HighPart);
+
+	/*positive=getDeltaTime(tsfTime_a, expectedTime, &deltaTime_exp); */
+	period2US = (pAd->CommonCfg.BeaconPeriod << 10);
+	remain_high = pAd->CommonCfg.BeaconRemain * tsfTime_a.u.HighPart;
+	remain_low = tsfTime_a.u.LowPart % (pAd->CommonCfg.BeaconPeriod << 10);
+	remain =
+	    (remain_high + remain_low) % (pAd->CommonCfg.BeaconPeriod << 10);
+	delta = (pAd->CommonCfg.BeaconPeriod << 10) - remain;
+
+	delta2MS = (delta >> 10);
+	if (delta2MS > 150) {
+		pAd->CommonCfg.BeaconUpdateTimer.TimerValue = 100;
+		pAd->CommonCfg.IsUpdateBeacon = FALSE;
+	} else {
+		pAd->CommonCfg.BeaconUpdateTimer.TimerValue = delta2MS + 10;
+		pAd->CommonCfg.IsUpdateBeacon = TRUE;
+	}
+
+}
+
+/********************************************************************
+  *
+  *	2870 Radio on/off Related functions.
+  *
+  ********************************************************************/
+void RT28xxUsbMlmeRadioOn(struct rt_rtmp_adapter *pAd)
+{
+	struct rt_rtmp_chip_op *pChipOps = &pAd->chipOps;
+
+	DBGPRINT(RT_DEBUG_TRACE, ("RT28xxUsbMlmeRadioOn()\n"));
+
+	if (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RADIO_OFF))
+		return;
+
+	{
+		AsicSendCommandToMcu(pAd, 0x31, 0xff, 0x00, 0x02);
+		RTMPusecDelay(10000);
+	}
+	/*NICResetFromError(pAd); */
+
+	/* Enable Tx/Rx */
+	RTMPEnableRxTx(pAd);
+
+	if (pChipOps->AsicReverseRfFromSleepMode)
+		pChipOps->AsicReverseRfFromSleepMode(pAd);
+
+	/* Clear Radio off flag */
+	RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_RADIO_OFF);
+
+	RTUSBBulkReceive(pAd);
+
+	/* Set LED */
+	RTMPSetLED(pAd, LED_RADIO_ON);
+}
+
+void RT28xxUsbMlmeRadioOFF(struct rt_rtmp_adapter *pAd)
+{
+	WPDMA_GLO_CFG_STRUC GloCfg;
+	u32 Value, i;
+
+	DBGPRINT(RT_DEBUG_TRACE, ("RT28xxUsbMlmeRadioOFF()\n"));
+
+	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RADIO_OFF))
+		return;
+
+	/* Clear PMKID cache. */
+	pAd->StaCfg.SavedPMKNum = 0;
+	RTMPZeroMemory(pAd->StaCfg.SavedPMK, (PMKID_NO * sizeof(struct rt_bssid_info)));
+
+	/* Link down first if any association exists */
+	if (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)) {
+		if (INFRA_ON(pAd) || ADHOC_ON(pAd)) {
+			struct rt_mlme_disassoc_req DisReq;
+			struct rt_mlme_queue_elem *pMsgElem =
+			    (struct rt_mlme_queue_elem *)kmalloc(sizeof(struct rt_mlme_queue_elem),
+							MEM_ALLOC_FLAG);
+
+			if (pMsgElem) {
+				COPY_MAC_ADDR(&DisReq.Addr,
+					      pAd->CommonCfg.Bssid);
+				DisReq.Reason = REASON_DISASSOC_STA_LEAVING;
+
+				pMsgElem->Machine = ASSOC_STATE_MACHINE;
+				pMsgElem->MsgType = MT2_MLME_DISASSOC_REQ;
+				pMsgElem->MsgLen =
+				    sizeof(struct rt_mlme_disassoc_req);
+				NdisMoveMemory(pMsgElem->Msg, &DisReq,
+					       sizeof
+					       (struct rt_mlme_disassoc_req));
+
+				MlmeDisassocReqAction(pAd, pMsgElem);
+				kfree(pMsgElem);
+
+				RTMPusecDelay(1000);
+			}
+		}
+	}
+	/* Set Radio off flag */
+	RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_RADIO_OFF);
+
+	{
+		/* Link down first if any association exists */
+		if (INFRA_ON(pAd) || ADHOC_ON(pAd))
+			LinkDown(pAd, FALSE);
+		RTMPusecDelay(10000);
+
+		/*========================================== */
+		/* Clean up old bss table */
+		BssTableInit(&pAd->ScanTab);
+	}
+
+	/* Set LED */
+	RTMPSetLED(pAd, LED_RADIO_OFF);
+
+	if (pAd->CommonCfg.BBPCurrentBW == BW_40) {
+		/* Must using 40MHz. */
+		AsicTurnOffRFClk(pAd, pAd->CommonCfg.CentralChannel);
+	} else {
+		/* Must using 20MHz. */
+		AsicTurnOffRFClk(pAd, pAd->CommonCfg.Channel);
+	}
+
+	/* Disable Tx/Rx DMA */
+	RTUSBReadMACRegister(pAd, WPDMA_GLO_CFG, &GloCfg.word);	/* disable DMA */
+	GloCfg.field.EnableTxDMA = 0;
+	GloCfg.field.EnableRxDMA = 0;
+	RTUSBWriteMACRegister(pAd, WPDMA_GLO_CFG, GloCfg.word);	/* abort all TX rings */
+
+	/* Waiting for DMA idle */
+	i = 0;
+	do {
+		RTMP_IO_READ32(pAd, WPDMA_GLO_CFG, &GloCfg.word);
+		if ((GloCfg.field.TxDMABusy == 0)
+		    && (GloCfg.field.RxDMABusy == 0))
+			break;
+
+		RTMPusecDelay(1000);
+	} while (i++ < 100);
+
+	/* Disable MAC Tx/Rx */
+	RTMP_IO_READ32(pAd, MAC_SYS_CTRL, &Value);
+	Value &= (0xfffffff3);
+	RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, Value);
+
+	{
+		AsicSendCommandToMcu(pAd, 0x30, 0xff, 0xff, 0x02);
+	}
+}
+
+#endif /* RTMP_MAC_USB // */
diff --git a/drivers/staging/rt2860/common/cmm_sanity.c b/drivers/staging/rt2860/common/cmm_sanity.c
index 85855f7f38cb..6b003c903444 100644
--- a/drivers/staging/rt2860/common/cmm_sanity.c
+++ b/drivers/staging/rt2860/common/cmm_sanity.c
@@ -36,17 +36,16 @@
 */
 #include "../rt_config.h"
 
+extern u8 CISCO_OUI[];
 
-extern UCHAR	CISCO_OUI[];
-
-extern UCHAR	WPA_OUI[];
-extern UCHAR	RSN_OUI[];
-extern UCHAR	WME_INFO_ELEM[];
-extern UCHAR	WME_PARM_ELEM[];
-extern UCHAR	Ccx2QosInfo[];
-extern UCHAR	RALINK_OUI[];
-extern UCHAR	BROADCOM_OUI[];
-extern UCHAR    WPS_OUI[];
+extern u8 WPA_OUI[];
+extern u8 RSN_OUI[];
+extern u8 WME_INFO_ELEM[];
+extern u8 WME_PARM_ELEM[];
+extern u8 Ccx2QosInfo[];
+extern u8 RALINK_OUI[];
+extern u8 BROADCOM_OUI[];
+extern u8 WPS_OUI[];
 
 /*
     ==========================================================================
@@ -59,35 +58,32 @@ extern UCHAR    WPS_OUI[];
 
     ==========================================================================
  */
-BOOLEAN MlmeAddBAReqSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN VOID *Msg,
-    IN ULONG MsgLen,
-    OUT PUCHAR pAddr2)
+BOOLEAN MlmeAddBAReqSanity(struct rt_rtmp_adapter *pAd,
+			   void * Msg, unsigned long MsgLen, u8 *pAddr2)
 {
-    PMLME_ADDBA_REQ_STRUCT   pInfo;
+	struct rt_mlme_addba_req *pInfo;
 
-    pInfo = (MLME_ADDBA_REQ_STRUCT *)Msg;
+	pInfo = (struct rt_mlme_addba_req *)Msg;
 
-    if ((MsgLen != sizeof(MLME_ADDBA_REQ_STRUCT)))
-    {
-        DBGPRINT(RT_DEBUG_TRACE, ("MlmeAddBAReqSanity fail - message lenght not correct.\n"));
-        return FALSE;
-    }
+	if ((MsgLen != sizeof(struct rt_mlme_addba_req))) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("MlmeAddBAReqSanity fail - message lenght not correct.\n"));
+		return FALSE;
+	}
 
-    if ((pInfo->Wcid >= MAX_LEN_OF_MAC_TABLE))
-    {
-        DBGPRINT(RT_DEBUG_TRACE, ("MlmeAddBAReqSanity fail - The peer Mac is not associated yet.\n"));
-        return FALSE;
-    }
+	if ((pInfo->Wcid >= MAX_LEN_OF_MAC_TABLE)) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("MlmeAddBAReqSanity fail - The peer Mac is not associated yet.\n"));
+		return FALSE;
+	}
 
-    if ((pInfo->pAddr[0]&0x01) == 0x01)
-    {
-        DBGPRINT(RT_DEBUG_TRACE, ("MlmeAddBAReqSanity fail - broadcast address not support BA\n"));
-        return FALSE;
-    }
+	if ((pInfo->pAddr[0] & 0x01) == 0x01) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("MlmeAddBAReqSanity fail - broadcast address not support BA\n"));
+		return FALSE;
+	}
 
-    return TRUE;
+	return TRUE;
 }
 
 /*
@@ -101,131 +97,133 @@ BOOLEAN MlmeAddBAReqSanity(
 
     ==========================================================================
  */
-BOOLEAN MlmeDelBAReqSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN VOID *Msg,
-    IN ULONG MsgLen)
+BOOLEAN MlmeDelBAReqSanity(struct rt_rtmp_adapter *pAd, void * Msg, unsigned long MsgLen)
 {
-	MLME_DELBA_REQ_STRUCT *pInfo;
-	pInfo = (MLME_DELBA_REQ_STRUCT *)Msg;
-
-    if ((MsgLen != sizeof(MLME_DELBA_REQ_STRUCT)))
-    {
-        DBGPRINT(RT_DEBUG_ERROR, ("MlmeDelBAReqSanity fail - message lenght not correct.\n"));
-        return FALSE;
-    }
-
-    if ((pInfo->Wcid >= MAX_LEN_OF_MAC_TABLE))
-    {
-        DBGPRINT(RT_DEBUG_ERROR, ("MlmeDelBAReqSanity fail - The peer Mac is not associated yet.\n"));
-        return FALSE;
-    }
-
-    if ((pInfo->TID & 0xf0))
-    {
-        DBGPRINT(RT_DEBUG_ERROR, ("MlmeDelBAReqSanity fail - The peer TID is incorrect.\n"));
-        return FALSE;
-    }
-
-	if (NdisEqualMemory(pAd->MacTab.Content[pInfo->Wcid].Addr, pInfo->Addr, MAC_ADDR_LEN) == 0)
-    {
-        DBGPRINT(RT_DEBUG_ERROR, ("MlmeDelBAReqSanity fail - the peer addr dosen't exist.\n"));
-        return FALSE;
-    }
-
-    return TRUE;
+	struct rt_mlme_delba_req *pInfo;
+	pInfo = (struct rt_mlme_delba_req *)Msg;
+
+	if ((MsgLen != sizeof(struct rt_mlme_delba_req))) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("MlmeDelBAReqSanity fail - message lenght not correct.\n"));
+		return FALSE;
+	}
+
+	if ((pInfo->Wcid >= MAX_LEN_OF_MAC_TABLE)) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("MlmeDelBAReqSanity fail - The peer Mac is not associated yet.\n"));
+		return FALSE;
+	}
+
+	if ((pInfo->TID & 0xf0)) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("MlmeDelBAReqSanity fail - The peer TID is incorrect.\n"));
+		return FALSE;
+	}
+
+	if (NdisEqualMemory
+	    (pAd->MacTab.Content[pInfo->Wcid].Addr, pInfo->Addr,
+	     MAC_ADDR_LEN) == 0) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("MlmeDelBAReqSanity fail - the peer addr dosen't exist.\n"));
+		return FALSE;
+	}
+
+	return TRUE;
 }
 
-BOOLEAN PeerAddBAReqActionSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN VOID *pMsg,
-    IN ULONG MsgLen,
-	OUT PUCHAR pAddr2)
+BOOLEAN PeerAddBAReqActionSanity(struct rt_rtmp_adapter *pAd,
+				 void * pMsg,
+				 unsigned long MsgLen, u8 *pAddr2)
 {
-	PFRAME_802_11 pFrame = (PFRAME_802_11)pMsg;
-	PFRAME_ADDBA_REQ pAddFrame;
-	pAddFrame = (PFRAME_ADDBA_REQ)(pMsg);
-	if (MsgLen < (sizeof(FRAME_ADDBA_REQ)))
-	{
-		DBGPRINT(RT_DEBUG_ERROR,("PeerAddBAReqActionSanity: ADDBA Request frame length size = %ld incorrect\n", MsgLen));
+	struct rt_frame_802_11 * pFrame = (struct rt_frame_802_11 *) pMsg;
+	struct rt_frame_addba_req * pAddFrame;
+	pAddFrame = (struct rt_frame_addba_req *) (pMsg);
+	if (MsgLen < (sizeof(struct rt_frame_addba_req))) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("PeerAddBAReqActionSanity: ADDBA Request frame length size = %ld incorrect\n",
+			  MsgLen));
 		return FALSE;
 	}
-	// we support immediate BA.
-	*(USHORT *)(&pAddFrame->BaParm) = cpu2le16(*(USHORT *)(&pAddFrame->BaParm));
+	/* we support immediate BA. */
+	*(u16 *) (&pAddFrame->BaParm) =
+	    cpu2le16(*(u16 *) (&pAddFrame->BaParm));
 	pAddFrame->TimeOutValue = cpu2le16(pAddFrame->TimeOutValue);
 	pAddFrame->BaStartSeq.word = cpu2le16(pAddFrame->BaStartSeq.word);
 
-	if (pAddFrame->BaParm.BAPolicy != IMMED_BA)
-	{
-		DBGPRINT(RT_DEBUG_ERROR,("PeerAddBAReqActionSanity: ADDBA Request Ba Policy[%d] not support\n", pAddFrame->BaParm.BAPolicy));
-		DBGPRINT(RT_DEBUG_ERROR,("ADDBA Request. tid=%x, Bufsize=%x, AMSDUSupported=%x \n", pAddFrame->BaParm.TID, pAddFrame->BaParm.BufSize, pAddFrame->BaParm.AMSDUSupported));
+	if (pAddFrame->BaParm.BAPolicy != IMMED_BA) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("PeerAddBAReqActionSanity: ADDBA Request Ba Policy[%d] not support\n",
+			  pAddFrame->BaParm.BAPolicy));
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("ADDBA Request. tid=%x, Bufsize=%x, AMSDUSupported=%x \n",
+			  pAddFrame->BaParm.TID, pAddFrame->BaParm.BufSize,
+			  pAddFrame->BaParm.AMSDUSupported));
 		return FALSE;
 	}
-
-	// we support immediate BA.
-	if (pAddFrame->BaParm.TID &0xfff0)
-	{
-		DBGPRINT(RT_DEBUG_ERROR,("PeerAddBAReqActionSanity: ADDBA Request incorrect TID = %d\n", pAddFrame->BaParm.TID));
+	/* we support immediate BA. */
+	if (pAddFrame->BaParm.TID & 0xfff0) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("PeerAddBAReqActionSanity: ADDBA Request incorrect TID = %d\n",
+			  pAddFrame->BaParm.TID));
 		return FALSE;
 	}
 	COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
 	return TRUE;
 }
 
-BOOLEAN PeerAddBARspActionSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN VOID *pMsg,
-    IN ULONG MsgLen)
+BOOLEAN PeerAddBARspActionSanity(struct rt_rtmp_adapter *pAd,
+				 void * pMsg, unsigned long MsgLen)
 {
-	PFRAME_ADDBA_RSP pAddFrame;
+	struct rt_frame_addba_rsp * pAddFrame;
 
-	pAddFrame = (PFRAME_ADDBA_RSP)(pMsg);
-	if (MsgLen < (sizeof(FRAME_ADDBA_RSP)))
-	{
-		DBGPRINT(RT_DEBUG_ERROR,("PeerAddBARspActionSanity: ADDBA Response frame length size = %ld incorrect\n", MsgLen));
+	pAddFrame = (struct rt_frame_addba_rsp *) (pMsg);
+	if (MsgLen < (sizeof(struct rt_frame_addba_rsp))) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("PeerAddBARspActionSanity: ADDBA Response frame length size = %ld incorrect\n",
+			  MsgLen));
 		return FALSE;
 	}
-	// we support immediate BA.
-	*(USHORT *)(&pAddFrame->BaParm) = cpu2le16(*(USHORT *)(&pAddFrame->BaParm));
+	/* we support immediate BA. */
+	*(u16 *) (&pAddFrame->BaParm) =
+	    cpu2le16(*(u16 *) (&pAddFrame->BaParm));
 	pAddFrame->StatusCode = cpu2le16(pAddFrame->StatusCode);
 	pAddFrame->TimeOutValue = cpu2le16(pAddFrame->TimeOutValue);
 
-	if (pAddFrame->BaParm.BAPolicy != IMMED_BA)
-	{
-		DBGPRINT(RT_DEBUG_ERROR,("PeerAddBAReqActionSanity: ADDBA Response Ba Policy[%d] not support\n", pAddFrame->BaParm.BAPolicy));
+	if (pAddFrame->BaParm.BAPolicy != IMMED_BA) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("PeerAddBAReqActionSanity: ADDBA Response Ba Policy[%d] not support\n",
+			  pAddFrame->BaParm.BAPolicy));
 		return FALSE;
 	}
-
-	// we support immediate BA.
-	if (pAddFrame->BaParm.TID &0xfff0)
-	{
-		DBGPRINT(RT_DEBUG_ERROR,("PeerAddBARspActionSanity: ADDBA Response incorrect TID = %d\n", pAddFrame->BaParm.TID));
+	/* we support immediate BA. */
+	if (pAddFrame->BaParm.TID & 0xfff0) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("PeerAddBARspActionSanity: ADDBA Response incorrect TID = %d\n",
+			  pAddFrame->BaParm.TID));
 		return FALSE;
 	}
 	return TRUE;
 
 }
 
-BOOLEAN PeerDelBAActionSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN UCHAR Wcid,
-    IN VOID *pMsg,
-    IN ULONG MsgLen )
+BOOLEAN PeerDelBAActionSanity(struct rt_rtmp_adapter *pAd,
+			      u8 Wcid, void * pMsg, unsigned long MsgLen)
 {
-	//PFRAME_802_11 pFrame = (PFRAME_802_11)pMsg;
-	PFRAME_DELBA_REQ  pDelFrame;
-	if (MsgLen != (sizeof(FRAME_DELBA_REQ)))
+	/*struct rt_frame_802_11 * pFrame = (struct rt_frame_802_11 *)pMsg; */
+	struct rt_frame_delba_req * pDelFrame;
+	if (MsgLen != (sizeof(struct rt_frame_delba_req)))
 		return FALSE;
 
 	if (Wcid >= MAX_LEN_OF_MAC_TABLE)
 		return FALSE;
 
-	pDelFrame = (PFRAME_DELBA_REQ)(pMsg);
+	pDelFrame = (struct rt_frame_delba_req *) (pMsg);
 
-	*(USHORT *)(&pDelFrame->DelbaParm) = cpu2le16(*(USHORT *)(&pDelFrame->DelbaParm));
+	*(u16 *) (&pDelFrame->DelbaParm) =
+	    cpu2le16(*(u16 *) (&pDelFrame->DelbaParm));
 	pDelFrame->ReasonCode = cpu2le16(pDelFrame->ReasonCode);
 
-	if (pDelFrame->DelbaParm.TID &0xfff0)
+	if (pDelFrame->DelbaParm.TID & 0xfff0)
 		return FALSE;
 
 	return TRUE;
@@ -242,472 +240,469 @@ BOOLEAN PeerDelBAActionSanity(
 
     ==========================================================================
  */
-BOOLEAN PeerBeaconAndProbeRspSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN VOID *Msg,
-    IN ULONG MsgLen,
-    IN UCHAR  MsgChannel,
-    OUT PUCHAR pAddr2,
-    OUT PUCHAR pBssid,
-    OUT CHAR Ssid[],
-    OUT UCHAR *pSsidLen,
-    OUT UCHAR *pBssType,
-    OUT USHORT *pBeaconPeriod,
-    OUT UCHAR *pChannel,
-    OUT UCHAR *pNewChannel,
-    OUT LARGE_INTEGER *pTimestamp,
-    OUT CF_PARM *pCfParm,
-    OUT USHORT *pAtimWin,
-    OUT USHORT *pCapabilityInfo,
-    OUT UCHAR *pErp,
-    OUT UCHAR *pDtimCount,
-    OUT UCHAR *pDtimPeriod,
-    OUT UCHAR *pBcastFlag,
-    OUT UCHAR *pMessageToMe,
-    OUT UCHAR SupRate[],
-    OUT UCHAR *pSupRateLen,
-    OUT UCHAR ExtRate[],
-    OUT UCHAR *pExtRateLen,
-    OUT	UCHAR *pCkipFlag,
-    OUT	UCHAR *pAironetCellPowerLimit,
-    OUT PEDCA_PARM       pEdcaParm,
-    OUT PQBSS_LOAD_PARM  pQbssLoad,
-    OUT PQOS_CAPABILITY_PARM pQosCapability,
-    OUT ULONG *pRalinkIe,
-    OUT UCHAR		 *pHtCapabilityLen,
-    OUT UCHAR		 *pPreNHtCapabilityLen,
-    OUT HT_CAPABILITY_IE *pHtCapability,
-	OUT UCHAR		 *AddHtInfoLen,
-	OUT ADD_HT_INFO_IE *AddHtInfo,
-	OUT UCHAR *NewExtChannelOffset,		// Ht extension channel offset(above or below)
-    OUT USHORT *LengthVIE,
-    OUT	PNDIS_802_11_VARIABLE_IEs pVIE)
+BOOLEAN PeerBeaconAndProbeRspSanity(struct rt_rtmp_adapter *pAd, void * Msg, unsigned long MsgLen, u8 MsgChannel, u8 *pAddr2, u8 *pBssid, char Ssid[], u8 * pSsidLen, u8 * pBssType, u16 * pBeaconPeriod, u8 * pChannel, u8 * pNewChannel, OUT LARGE_INTEGER * pTimestamp, struct rt_cf_parm * pCfParm, u16 * pAtimWin, u16 * pCapabilityInfo, u8 * pErp, u8 * pDtimCount, u8 * pDtimPeriod, u8 * pBcastFlag, u8 * pMessageToMe, u8 SupRate[], u8 * pSupRateLen, u8 ExtRate[], u8 * pExtRateLen, u8 * pCkipFlag, u8 * pAironetCellPowerLimit, struct rt_edca_parm *pEdcaParm, struct rt_qbss_load_parm *pQbssLoad, struct rt_qos_capability_parm *pQosCapability, unsigned long * pRalinkIe, u8 * pHtCapabilityLen, u8 * pPreNHtCapabilityLen, struct rt_ht_capability_ie * pHtCapability, u8 * AddHtInfoLen, struct rt_add_ht_info_ie * AddHtInfo, u8 * NewExtChannelOffset,	/* Ht extension channel offset(above or below) */
+				    u16 * LengthVIE,
+				    struct rt_ndis_802_11_variable_ies *pVIE)
 {
-    CHAR				*Ptr;
-	CHAR 				TimLen;
-    PFRAME_802_11		pFrame;
-    PEID_STRUCT         pEid;
-    UCHAR				SubType;
-    UCHAR				Sanity;
-    //UCHAR				ECWMin, ECWMax;
-    //MAC_CSR9_STRUC		Csr9;
-    ULONG				Length = 0;
-
-	// For some 11a AP which didn't have DS_IE, we use two conditions to decide the channel
-	//	1. If the AP is 11n enabled, then check the control channel.
-	//	2. If the AP didn't have any info about channel, use the channel we received this frame as the channel. (May inaccuracy!!)
-	UCHAR			CtrlChannel = 0;
-
-    // Add for 3 necessary EID field check
-    Sanity = 0;
-
-    *pAtimWin = 0;
-    *pErp = 0;
-    *pDtimCount = 0;
-    *pDtimPeriod = 0;
-    *pBcastFlag = 0;
-    *pMessageToMe = 0;
-    *pExtRateLen = 0;
-    *pCkipFlag = 0;			        // Default of CkipFlag is 0
-    *pAironetCellPowerLimit = 0xFF;  // Default of AironetCellPowerLimit is 0xFF
-    *LengthVIE = 0;					// Set the length of VIE to init value 0
-    *pHtCapabilityLen = 0;					// Set the length of VIE to init value 0
+	u8 *Ptr;
+	u8 TimLen;
+	struct rt_frame_802_11 * pFrame;
+	struct rt_eid * pEid;
+	u8 SubType;
+	u8 Sanity;
+	/*u8                             ECWMin, ECWMax; */
+	/*MAC_CSR9_STRUC            Csr9; */
+	unsigned long Length = 0;
+
+	/* For some 11a AP which didn't have DS_IE, we use two conditions to decide the channel */
+	/*      1. If the AP is 11n enabled, then check the control channel. */
+	/*      2. If the AP didn't have any info about channel, use the channel we received this frame as the channel. (May inaccuracy!) */
+	u8 CtrlChannel = 0;
+
+	/* Add for 3 necessary EID field check */
+	Sanity = 0;
+
+	*pAtimWin = 0;
+	*pErp = 0;
+	*pDtimCount = 0;
+	*pDtimPeriod = 0;
+	*pBcastFlag = 0;
+	*pMessageToMe = 0;
+	*pExtRateLen = 0;
+	*pCkipFlag = 0;		/* Default of CkipFlag is 0 */
+	*pAironetCellPowerLimit = 0xFF;	/* Default of AironetCellPowerLimit is 0xFF */
+	*LengthVIE = 0;		/* Set the length of VIE to init value 0 */
+	*pHtCapabilityLen = 0;	/* Set the length of VIE to init value 0 */
 	if (pAd->OpMode == OPMODE_STA)
-		*pPreNHtCapabilityLen = 0;					// Set the length of VIE to init value 0
-    *AddHtInfoLen = 0;					// Set the length of VIE to init value 0
-    *pRalinkIe = 0;
-    *pNewChannel = 0;
-    *NewExtChannelOffset = 0xff;	//Default 0xff means no such IE
-    pCfParm->bValid = FALSE;        // default: no IE_CF found
-    pQbssLoad->bValid = FALSE;      // default: no IE_QBSS_LOAD found
-    pEdcaParm->bValid = FALSE;      // default: no IE_EDCA_PARAMETER found
-    pQosCapability->bValid = FALSE; // default: no IE_QOS_CAPABILITY found
+		*pPreNHtCapabilityLen = 0;	/* Set the length of VIE to init value 0 */
+	*AddHtInfoLen = 0;	/* Set the length of VIE to init value 0 */
+	*pRalinkIe = 0;
+	*pNewChannel = 0;
+	*NewExtChannelOffset = 0xff;	/*Default 0xff means no such IE */
+	pCfParm->bValid = FALSE;	/* default: no IE_CF found */
+	pQbssLoad->bValid = FALSE;	/* default: no IE_QBSS_LOAD found */
+	pEdcaParm->bValid = FALSE;	/* default: no IE_EDCA_PARAMETER found */
+	pQosCapability->bValid = FALSE;	/* default: no IE_QOS_CAPABILITY found */
+
+	pFrame = (struct rt_frame_802_11 *) Msg;
+
+	/* get subtype from header */
+	SubType = (u8)pFrame->Hdr.FC.SubType;
+
+	/* get Addr2 and BSSID from header */
+	COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
+	COPY_MAC_ADDR(pBssid, pFrame->Hdr.Addr3);
 
-    pFrame = (PFRAME_802_11)Msg;
+	Ptr = pFrame->Octet;
+	Length += LENGTH_802_11;
 
-    // get subtype from header
-    SubType = (UCHAR)pFrame->Hdr.FC.SubType;
+	/* get timestamp from payload and advance the pointer */
+	NdisMoveMemory(pTimestamp, Ptr, TIMESTAMP_LEN);
 
-    // get Addr2 and BSSID from header
-    COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
-    COPY_MAC_ADDR(pBssid, pFrame->Hdr.Addr3);
+	pTimestamp->u.LowPart = cpu2le32(pTimestamp->u.LowPart);
+	pTimestamp->u.HighPart = cpu2le32(pTimestamp->u.HighPart);
 
-    Ptr = pFrame->Octet;
-    Length += LENGTH_802_11;
+	Ptr += TIMESTAMP_LEN;
+	Length += TIMESTAMP_LEN;
 
-    // get timestamp from payload and advance the pointer
-    NdisMoveMemory(pTimestamp, Ptr, TIMESTAMP_LEN);
+	/* get beacon interval from payload and advance the pointer */
+	NdisMoveMemory(pBeaconPeriod, Ptr, 2);
+	Ptr += 2;
+	Length += 2;
 
-	pTimestamp->u.LowPart = cpu2le32(pTimestamp->u.LowPart);
-	pTimestamp->u.HighPart = cpu2le32(pTimestamp->u.HighPart);
+	/* get capability info from payload and advance the pointer */
+	NdisMoveMemory(pCapabilityInfo, Ptr, 2);
+	Ptr += 2;
+	Length += 2;
+
+	if (CAP_IS_ESS_ON(*pCapabilityInfo))
+		*pBssType = BSS_INFRA;
+	else
+		*pBssType = BSS_ADHOC;
+
+	pEid = (struct rt_eid *) Ptr;
+
+	/* get variable fields from payload and advance the pointer */
+	while ((Length + 2 + pEid->Len) <= MsgLen) {
+		/* */
+		/* Secure copy VIE to VarIE[MAX_VIE_LEN] didn't overflow. */
+		/* */
+		if ((*LengthVIE + pEid->Len + 2) >= MAX_VIE_LEN) {
+			DBGPRINT(RT_DEBUG_WARN,
+				 ("PeerBeaconAndProbeRspSanity - Variable IEs out of resource [len(=%d) > MAX_VIE_LEN(=%d)]\n",
+				  (*LengthVIE + pEid->Len + 2), MAX_VIE_LEN));
+			break;
+		}
 
-    Ptr += TIMESTAMP_LEN;
-    Length += TIMESTAMP_LEN;
-
-    // get beacon interval from payload and advance the pointer
-    NdisMoveMemory(pBeaconPeriod, Ptr, 2);
-    Ptr += 2;
-    Length += 2;
-
-    // get capability info from payload and advance the pointer
-    NdisMoveMemory(pCapabilityInfo, Ptr, 2);
-    Ptr += 2;
-    Length += 2;
-
-    if (CAP_IS_ESS_ON(*pCapabilityInfo))
-        *pBssType = BSS_INFRA;
-    else
-        *pBssType = BSS_ADHOC;
-
-    pEid = (PEID_STRUCT) Ptr;
-
-    // get variable fields from payload and advance the pointer
-    while ((Length + 2 + pEid->Len) <= MsgLen)
-    {
-        //
-        // Secure copy VIE to VarIE[MAX_VIE_LEN] didn't overflow.
-        //
-        if ((*LengthVIE + pEid->Len + 2) >= MAX_VIE_LEN)
-        {
-            DBGPRINT(RT_DEBUG_WARN, ("PeerBeaconAndProbeRspSanity - Variable IEs out of resource [len(=%d) > MAX_VIE_LEN(=%d)]\n",
-                    (*LengthVIE + pEid->Len + 2), MAX_VIE_LEN));
-            break;
-        }
-
-        switch(pEid->Eid)
-        {
-            case IE_SSID:
-                // Already has one SSID EID in this beacon, ignore the second one
-                if (Sanity & 0x1)
-                    break;
-                if(pEid->Len <= MAX_LEN_OF_SSID)
-                {
-                    NdisMoveMemory(Ssid, pEid->Octet, pEid->Len);
-                    *pSsidLen = pEid->Len;
-                    Sanity |= 0x1;
-                }
-                else
-                {
-                    DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_SSID (len=%d)\n",pEid->Len));
-                    return FALSE;
-                }
-                break;
-
-            case IE_SUPP_RATES:
-                if(pEid->Len <= MAX_LEN_OF_SUPPORTED_RATES)
-                {
-                    Sanity |= 0x2;
-                    NdisMoveMemory(SupRate, pEid->Octet, pEid->Len);
-                    *pSupRateLen = pEid->Len;
-
-                    // TODO: 2004-09-14 not a good design here, cause it exclude extra rates
-                    // from ScanTab. We should report as is. And filter out unsupported
-                    // rates in MlmeAux.
-                    // Check against the supported rates
-                    // RTMPCheckRates(pAd, SupRate, pSupRateLen);
-                }
-                else
-                {
-                    DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_SUPP_RATES (len=%d)\n",pEid->Len));
-                    return FALSE;
-                }
-                break;
-
-            case IE_HT_CAP:
-			if (pEid->Len >= SIZE_HT_CAP_IE)  //Note: allow extension.!!
+		switch (pEid->Eid) {
+		case IE_SSID:
+			/* Already has one SSID EID in this beacon, ignore the second one */
+			if (Sanity & 0x1)
+				break;
+			if (pEid->Len <= MAX_LEN_OF_SSID) {
+				NdisMoveMemory(Ssid, pEid->Octet, pEid->Len);
+				*pSsidLen = pEid->Len;
+				Sanity |= 0x1;
+			} else {
+				DBGPRINT(RT_DEBUG_TRACE,
+					 ("PeerBeaconAndProbeRspSanity - wrong IE_SSID (len=%d)\n",
+					  pEid->Len));
+				return FALSE;
+			}
+			break;
+
+		case IE_SUPP_RATES:
+			if (pEid->Len <= MAX_LEN_OF_SUPPORTED_RATES) {
+				Sanity |= 0x2;
+				NdisMoveMemory(SupRate, pEid->Octet, pEid->Len);
+				*pSupRateLen = pEid->Len;
+
+				/* TODO: 2004-09-14 not a good design here, cause it exclude extra rates */
+				/* from ScanTab. We should report as is. And filter out unsupported */
+				/* rates in MlmeAux. */
+				/* Check against the supported rates */
+				/* RTMPCheckRates(pAd, SupRate, pSupRateLen); */
+			} else {
+				DBGPRINT(RT_DEBUG_TRACE,
+					 ("PeerBeaconAndProbeRspSanity - wrong IE_SUPP_RATES (len=%d)\n",
+					  pEid->Len));
+				return FALSE;
+			}
+			break;
+
+		case IE_HT_CAP:
+			if (pEid->Len >= SIZE_HT_CAP_IE)	/*Note: allow extension! */
 			{
-				NdisMoveMemory(pHtCapability, pEid->Octet, sizeof(HT_CAPABILITY_IE));
-				*pHtCapabilityLen = SIZE_HT_CAP_IE;	// Nnow we only support 26 bytes.
+				NdisMoveMemory(pHtCapability, pEid->Octet,
+					       sizeof(struct rt_ht_capability_ie));
+				*pHtCapabilityLen = SIZE_HT_CAP_IE;	/* Nnow we only support 26 bytes. */
 
-				*(USHORT *)(&pHtCapability->HtCapInfo) = cpu2le16(*(USHORT *)(&pHtCapability->HtCapInfo));
-				*(USHORT *)(&pHtCapability->ExtHtCapInfo) = cpu2le16(*(USHORT *)(&pHtCapability->ExtHtCapInfo));
+				*(u16 *) (&pHtCapability->HtCapInfo) =
+				    cpu2le16(*(u16 *)
+					     (&pHtCapability->HtCapInfo));
+				*(u16 *) (&pHtCapability->ExtHtCapInfo) =
+				    cpu2le16(*(u16 *)
+					     (&pHtCapability->ExtHtCapInfo));
 
 				{
-					*pPreNHtCapabilityLen = 0;	// Nnow we only support 26 bytes.
+					*pPreNHtCapabilityLen = 0;	/* Nnow we only support 26 bytes. */
 
-					Ptr = (PUCHAR) pVIE;
-					NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid, pEid->Len + 2);
+					Ptr = (u8 *)pVIE;
+					NdisMoveMemory(Ptr + *LengthVIE,
+						       &pEid->Eid,
+						       pEid->Len + 2);
 					*LengthVIE += (pEid->Len + 2);
 				}
-			}
-			else
-			{
-				DBGPRINT(RT_DEBUG_WARN, ("PeerBeaconAndProbeRspSanity - wrong IE_HT_CAP. pEid->Len = %d\n", pEid->Len));
+			} else {
+				DBGPRINT(RT_DEBUG_WARN,
+					 ("PeerBeaconAndProbeRspSanity - wrong IE_HT_CAP. pEid->Len = %d\n",
+					  pEid->Len));
 			}
 
-		break;
-            case IE_ADD_HT:
-			if (pEid->Len >= sizeof(ADD_HT_INFO_IE))
-			{
-				// This IE allows extension, but we can ignore extra bytes beyond our knowledge , so only
-				// copy first sizeof(ADD_HT_INFO_IE)
-				NdisMoveMemory(AddHtInfo, pEid->Octet, sizeof(ADD_HT_INFO_IE));
+			break;
+		case IE_ADD_HT:
+			if (pEid->Len >= sizeof(struct rt_add_ht_info_ie)) {
+				/* This IE allows extension, but we can ignore extra bytes beyond our knowledge , so only */
+				/* copy first sizeof(struct rt_add_ht_info_ie) */
+				NdisMoveMemory(AddHtInfo, pEid->Octet,
+					       sizeof(struct rt_add_ht_info_ie));
 				*AddHtInfoLen = SIZE_ADD_HT_INFO_IE;
 
 				CtrlChannel = AddHtInfo->ControlChan;
 
-				*(USHORT *)(&AddHtInfo->AddHtInfo2) = cpu2le16(*(USHORT *)(&AddHtInfo->AddHtInfo2));
-				*(USHORT *)(&AddHtInfo->AddHtInfo3) = cpu2le16(*(USHORT *)(&AddHtInfo->AddHtInfo3));
+				*(u16 *) (&AddHtInfo->AddHtInfo2) =
+				    cpu2le16(*(u16 *)
+					     (&AddHtInfo->AddHtInfo2));
+				*(u16 *) (&AddHtInfo->AddHtInfo3) =
+				    cpu2le16(*(u16 *)
+					     (&AddHtInfo->AddHtInfo3));
 
 				{
-			                Ptr = (PUCHAR) pVIE;
-			                NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid, pEid->Len + 2);
-			                *LengthVIE += (pEid->Len + 2);
+					Ptr = (u8 *)pVIE;
+					NdisMoveMemory(Ptr + *LengthVIE,
+						       &pEid->Eid,
+						       pEid->Len + 2);
+					*LengthVIE += (pEid->Len + 2);
 				}
-			}
-			else
-			{
-				DBGPRINT(RT_DEBUG_WARN, ("PeerBeaconAndProbeRspSanity - wrong IE_ADD_HT. \n"));
+			} else {
+				DBGPRINT(RT_DEBUG_WARN,
+					 ("PeerBeaconAndProbeRspSanity - wrong IE_ADD_HT. \n"));
 			}
 
-		break;
-            case IE_SECONDARY_CH_OFFSET:
-			if (pEid->Len == 1)
-			{
+			break;
+		case IE_SECONDARY_CH_OFFSET:
+			if (pEid->Len == 1) {
 				*NewExtChannelOffset = pEid->Octet[0];
-			}
-			else
-			{
-				DBGPRINT(RT_DEBUG_WARN, ("PeerBeaconAndProbeRspSanity - wrong IE_SECONDARY_CH_OFFSET. \n"));
+			} else {
+				DBGPRINT(RT_DEBUG_WARN,
+					 ("PeerBeaconAndProbeRspSanity - wrong IE_SECONDARY_CH_OFFSET. \n"));
 			}
 
-		break;
-            case IE_FH_PARM:
-                DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity(IE_FH_PARM) \n"));
-                break;
+			break;
+		case IE_FH_PARM:
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("PeerBeaconAndProbeRspSanity(IE_FH_PARM) \n"));
+			break;
 
-            case IE_DS_PARM:
-                if(pEid->Len == 1)
-                {
-                    *pChannel = *pEid->Octet;
+		case IE_DS_PARM:
+			if (pEid->Len == 1) {
+				*pChannel = *pEid->Octet;
 
-					{
-						if (ChannelSanity(pAd, *pChannel) == 0)
-						{
+				{
+					if (ChannelSanity(pAd, *pChannel) == 0) {
 
-							return FALSE;
-						}
+						return FALSE;
 					}
+				}
+
+				Sanity |= 0x4;
+			} else {
+				DBGPRINT(RT_DEBUG_TRACE,
+					 ("PeerBeaconAndProbeRspSanity - wrong IE_DS_PARM (len=%d)\n",
+					  pEid->Len));
+				return FALSE;
+			}
+			break;
+
+		case IE_CF_PARM:
+			if (pEid->Len == 6) {
+				pCfParm->bValid = TRUE;
+				pCfParm->CfpCount = pEid->Octet[0];
+				pCfParm->CfpPeriod = pEid->Octet[1];
+				pCfParm->CfpMaxDuration =
+				    pEid->Octet[2] + 256 * pEid->Octet[3];
+				pCfParm->CfpDurRemaining =
+				    pEid->Octet[4] + 256 * pEid->Octet[5];
+			} else {
+				DBGPRINT(RT_DEBUG_TRACE,
+					 ("PeerBeaconAndProbeRspSanity - wrong IE_CF_PARM\n"));
+				return FALSE;
+			}
+			break;
+
+		case IE_IBSS_PARM:
+			if (pEid->Len == 2) {
+				NdisMoveMemory(pAtimWin, pEid->Octet,
+					       pEid->Len);
+			} else {
+				DBGPRINT(RT_DEBUG_TRACE,
+					 ("PeerBeaconAndProbeRspSanity - wrong IE_IBSS_PARM\n"));
+				return FALSE;
+			}
+			break;
+
+		case IE_TIM:
+			if (INFRA_ON(pAd) && SubType == SUBTYPE_BEACON) {
+				GetTimBit((char *)pEid, pAd->StaActive.Aid,
+					  &TimLen, pBcastFlag, pDtimCount,
+					  pDtimPeriod, pMessageToMe);
+			}
+			break;
+		case IE_CHANNEL_SWITCH_ANNOUNCEMENT:
+			if (pEid->Len == 3) {
+				*pNewChannel = pEid->Octet[1];	/*extract new channel number */
+			}
+			break;
+
+			/* New for WPA */
+			/* CCX v2 has the same IE, we need to parse that too */
+			/* Wifi WMM use the same IE vale, need to parse that too */
+			/* case IE_WPA: */
+		case IE_VENDOR_SPECIFIC:
+			/* Check Broadcom/Atheros 802.11n OUI version, for HT Capability IE. */
+			/* This HT IE is before IEEE draft set HT IE value.2006-09-28 by Jan. */
+			/*if (NdisEqualMemory(pEid->Octet, BROADCOM_OUI, 3) && (pEid->Len >= 4))
+			   {
+			   if ((pEid->Octet[3] == OUI_BROADCOM_HT) && (pEid->Len >= 30))
+			   {
+			   {
+			   NdisMoveMemory(pHtCapability, &pEid->Octet[4], sizeof(struct rt_ht_capability_ie));
+			   *pHtCapabilityLen = SIZE_HT_CAP_IE;  // Nnow we only support 26 bytes.
+			   }
+			   }
+			   if ((pEid->Octet[3] == OUI_BROADCOM_HT) && (pEid->Len >= 26))
+			   {
+			   {
+			   NdisMoveMemory(AddHtInfo, &pEid->Octet[4], sizeof(struct rt_add_ht_info_ie));
+			   *AddHtInfoLen = SIZE_ADD_HT_INFO_IE; // Nnow we only support 26 bytes.
+			   }
+			   }
+			   }
+			 */
+			/* Check the OUI version, filter out non-standard usage */
+			if (NdisEqualMemory(pEid->Octet, RALINK_OUI, 3)
+			    && (pEid->Len == 7)) {
+				/**pRalinkIe = pEid->Octet[3]; */
+				if (pEid->Octet[3] != 0)
+					*pRalinkIe = pEid->Octet[3];
+				else
+					*pRalinkIe = 0xf0000000;	/* Set to non-zero value (can't set bit0-2) to represent this is Ralink Chip. So at linkup, we will set ralinkchip flag. */
+			}
+			/* This HT IE is before IEEE draft set HT IE value.2006-09-28 by Jan. */
+
+			/* Other vendors had production before IE_HT_CAP value is assigned. To backward support those old-firmware AP, */
+			/* Check broadcom-defiend pre-802.11nD1.0 OUI for HT related IE, including HT Capatilities IE and HT Information IE */
+			else if ((*pHtCapabilityLen == 0)
+				 && NdisEqualMemory(pEid->Octet, PRE_N_HT_OUI,
+						    3) && (pEid->Len >= 4)
+				 && (pAd->OpMode == OPMODE_STA)) {
+				if ((pEid->Octet[3] == OUI_PREN_HT_CAP)
+				    && (pEid->Len >= 30)
+				    && (*pHtCapabilityLen == 0)) {
+					NdisMoveMemory(pHtCapability,
+						       &pEid->Octet[4],
+						       sizeof
+						       (struct rt_ht_capability_ie));
+					*pPreNHtCapabilityLen = SIZE_HT_CAP_IE;
+				}
+
+				if ((pEid->Octet[3] == OUI_PREN_ADD_HT)
+				    && (pEid->Len >= 26)) {
+					NdisMoveMemory(AddHtInfo,
+						       &pEid->Octet[4],
+						       sizeof(struct rt_add_ht_info_ie));
+					*AddHtInfoLen = SIZE_ADD_HT_INFO_IE;
+				}
+			} else if (NdisEqualMemory(pEid->Octet, WPA_OUI, 4)) {
+				/* Copy to pVIE which will report to microsoft bssid list. */
+				Ptr = (u8 *)pVIE;
+				NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid,
+					       pEid->Len + 2);
+				*LengthVIE += (pEid->Len + 2);
+			} else
+			    if (NdisEqualMemory(pEid->Octet, WME_PARM_ELEM, 6)
+				&& (pEid->Len == 24)) {
+				u8 *ptr;
+				int i;
+
+				/* parsing EDCA parameters */
+				pEdcaParm->bValid = TRUE;
+				pEdcaParm->bQAck = FALSE;	/* pEid->Octet[0] & 0x10; */
+				pEdcaParm->bQueueRequest = FALSE;	/* pEid->Octet[0] & 0x20; */
+				pEdcaParm->bTxopRequest = FALSE;	/* pEid->Octet[0] & 0x40; */
+				pEdcaParm->EdcaUpdateCount =
+				    pEid->Octet[6] & 0x0f;
+				pEdcaParm->bAPSDCapable =
+				    (pEid->Octet[6] & 0x80) ? 1 : 0;
+				ptr = &pEid->Octet[8];
+				for (i = 0; i < 4; i++) {
+					u8 aci = (*ptr & 0x60) >> 5;	/* b5~6 is AC INDEX */
+					pEdcaParm->bACM[aci] = (((*ptr) & 0x10) == 0x10);	/* b5 is ACM */
+					pEdcaParm->Aifsn[aci] = (*ptr) & 0x0f;	/* b0~3 is AIFSN */
+					pEdcaParm->Cwmin[aci] = *(ptr + 1) & 0x0f;	/* b0~4 is Cwmin */
+					pEdcaParm->Cwmax[aci] = *(ptr + 1) >> 4;	/* b5~8 is Cwmax */
+					pEdcaParm->Txop[aci] = *(ptr + 2) + 256 * (*(ptr + 3));	/* in unit of 32-us */
+					ptr += 4;	/* point to next AC */
+				}
+			} else
+			    if (NdisEqualMemory(pEid->Octet, WME_INFO_ELEM, 6)
+				&& (pEid->Len == 7)) {
+				/* parsing EDCA parameters */
+				pEdcaParm->bValid = TRUE;
+				pEdcaParm->bQAck = FALSE;	/* pEid->Octet[0] & 0x10; */
+				pEdcaParm->bQueueRequest = FALSE;	/* pEid->Octet[0] & 0x20; */
+				pEdcaParm->bTxopRequest = FALSE;	/* pEid->Octet[0] & 0x40; */
+				pEdcaParm->EdcaUpdateCount =
+				    pEid->Octet[6] & 0x0f;
+				pEdcaParm->bAPSDCapable =
+				    (pEid->Octet[6] & 0x80) ? 1 : 0;
+
+				/* use default EDCA parameter */
+				pEdcaParm->bACM[QID_AC_BE] = 0;
+				pEdcaParm->Aifsn[QID_AC_BE] = 3;
+				pEdcaParm->Cwmin[QID_AC_BE] = CW_MIN_IN_BITS;
+				pEdcaParm->Cwmax[QID_AC_BE] = CW_MAX_IN_BITS;
+				pEdcaParm->Txop[QID_AC_BE] = 0;
+
+				pEdcaParm->bACM[QID_AC_BK] = 0;
+				pEdcaParm->Aifsn[QID_AC_BK] = 7;
+				pEdcaParm->Cwmin[QID_AC_BK] = CW_MIN_IN_BITS;
+				pEdcaParm->Cwmax[QID_AC_BK] = CW_MAX_IN_BITS;
+				pEdcaParm->Txop[QID_AC_BK] = 0;
+
+				pEdcaParm->bACM[QID_AC_VI] = 0;
+				pEdcaParm->Aifsn[QID_AC_VI] = 2;
+				pEdcaParm->Cwmin[QID_AC_VI] =
+				    CW_MIN_IN_BITS - 1;
+				pEdcaParm->Cwmax[QID_AC_VI] = CW_MAX_IN_BITS;
+				pEdcaParm->Txop[QID_AC_VI] = 96;	/* AC_VI: 96*32us ~= 3ms */
+
+				pEdcaParm->bACM[QID_AC_VO] = 0;
+				pEdcaParm->Aifsn[QID_AC_VO] = 2;
+				pEdcaParm->Cwmin[QID_AC_VO] =
+				    CW_MIN_IN_BITS - 2;
+				pEdcaParm->Cwmax[QID_AC_VO] =
+				    CW_MAX_IN_BITS - 1;
+				pEdcaParm->Txop[QID_AC_VO] = 48;	/* AC_VO: 48*32us ~= 1.5ms */
+			}
+
+			break;
+
+		case IE_EXT_SUPP_RATES:
+			if (pEid->Len <= MAX_LEN_OF_SUPPORTED_RATES) {
+				NdisMoveMemory(ExtRate, pEid->Octet, pEid->Len);
+				*pExtRateLen = pEid->Len;
+
+				/* TODO: 2004-09-14 not a good design here, cause it exclude extra rates */
+				/* from ScanTab. We should report as is. And filter out unsupported */
+				/* rates in MlmeAux. */
+				/* Check against the supported rates */
+				/* RTMPCheckRates(pAd, ExtRate, pExtRateLen); */
+			}
+			break;
+
+		case IE_ERP:
+			if (pEid->Len == 1) {
+				*pErp = (u8)pEid->Octet[0];
+			}
+			break;
+
+		case IE_AIRONET_CKIP:
+			/* 0. Check Aironet IE length, it must be larger or equal to 28 */
+			/* Cisco AP350 used length as 28 */
+			/* Cisco AP12XX used length as 30 */
+			if (pEid->Len < (CKIP_NEGOTIATION_LENGTH - 2))
+				break;
+
+			/* 1. Copy CKIP flag byte to buffer for process */
+			*pCkipFlag = *(pEid->Octet + 8);
+			break;
+
+		case IE_AP_TX_POWER:
+			/* AP Control of Client Transmit Power */
+			/*0. Check Aironet IE length, it must be 6 */
+			if (pEid->Len != 0x06)
+				break;
+
+			/* Get cell power limit in dBm */
+			if (NdisEqualMemory(pEid->Octet, CISCO_OUI, 3) == 1)
+				*pAironetCellPowerLimit = *(pEid->Octet + 4);
+			break;
+
+			/* WPA2 & 802.11i RSN */
+		case IE_RSN:
+			/* There is no OUI for version anymore, check the group cipher OUI before copying */
+			if (RTMPEqualMemory(pEid->Octet + 2, RSN_OUI, 3)) {
+				/* Copy to pVIE which will report to microsoft bssid list. */
+				Ptr = (u8 *)pVIE;
+				NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid,
+					       pEid->Len + 2);
+				*LengthVIE += (pEid->Len + 2);
+			}
+			break;
+
+		default:
+			break;
+		}
 
-                    Sanity |= 0x4;
-                }
-                else
-                {
-                    DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_DS_PARM (len=%d)\n",pEid->Len));
-                    return FALSE;
-                }
-                break;
-
-            case IE_CF_PARM:
-                if(pEid->Len == 6)
-                {
-                    pCfParm->bValid = TRUE;
-                    pCfParm->CfpCount = pEid->Octet[0];
-                    pCfParm->CfpPeriod = pEid->Octet[1];
-                    pCfParm->CfpMaxDuration = pEid->Octet[2] + 256 * pEid->Octet[3];
-                    pCfParm->CfpDurRemaining = pEid->Octet[4] + 256 * pEid->Octet[5];
-                }
-                else
-                {
-                    DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_CF_PARM\n"));
-                    return FALSE;
-                }
-                break;
-
-            case IE_IBSS_PARM:
-                if(pEid->Len == 2)
-                {
-                    NdisMoveMemory(pAtimWin, pEid->Octet, pEid->Len);
-                }
-                else
-                {
-                    DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_IBSS_PARM\n"));
-                    return FALSE;
-                }
-                break;
-
-            case IE_TIM:
-                if(INFRA_ON(pAd) && SubType == SUBTYPE_BEACON)
-                {
-                    GetTimBit((PUCHAR)pEid, pAd->StaActive.Aid, &TimLen, pBcastFlag, pDtimCount, pDtimPeriod, pMessageToMe);
-                }
-                break;
-
-            case IE_CHANNEL_SWITCH_ANNOUNCEMENT:
-                if(pEid->Len == 3)
-                {
-                	*pNewChannel = pEid->Octet[1];	//extract new channel number
-                }
-                break;
-
-            // New for WPA
-            // CCX v2 has the same IE, we need to parse that too
-            // Wifi WMM use the same IE vale, need to parse that too
-            // case IE_WPA:
-            case IE_VENDOR_SPECIFIC:
-                // Check the OUI version, filter out non-standard usage
-                if (NdisEqualMemory(pEid->Octet, RALINK_OUI, 3) && (pEid->Len == 7))
-                {
-                    //*pRalinkIe = pEid->Octet[3];
-                    if (pEid->Octet[3] != 0)
-        				*pRalinkIe = pEid->Octet[3];
-        			else
-        				*pRalinkIe = 0xf0000000; // Set to non-zero value (can't set bit0-2) to represent this is Ralink Chip. So at linkup, we will set ralinkchip flag.
-                }
-		// This HT IE is before IEEE draft set HT IE value.2006-09-28 by Jan.
-
-                // Other vendors had production before IE_HT_CAP value is assigned. To backward support those old-firmware AP,
-                // Check broadcom-defiend pre-802.11nD1.0 OUI for HT related IE, including HT Capatilities IE and HT Information IE
-                else if ((*pHtCapabilityLen == 0) && NdisEqualMemory(pEid->Octet, PRE_N_HT_OUI, 3) && (pEid->Len >= 4) && (pAd->OpMode == OPMODE_STA))
-                {
-                    if ((pEid->Octet[3] == OUI_PREN_HT_CAP) && (pEid->Len >= 30) && (*pHtCapabilityLen == 0))
-                    {
-                        NdisMoveMemory(pHtCapability, &pEid->Octet[4], sizeof(HT_CAPABILITY_IE));
-                        *pPreNHtCapabilityLen = SIZE_HT_CAP_IE;
-                    }
-
-                    if ((pEid->Octet[3] == OUI_PREN_ADD_HT) && (pEid->Len >= 26))
-                    {
-                        NdisMoveMemory(AddHtInfo, &pEid->Octet[4], sizeof(ADD_HT_INFO_IE));
-                        *AddHtInfoLen = SIZE_ADD_HT_INFO_IE;
-                    }
-                }
-                else if (NdisEqualMemory(pEid->Octet, WPA_OUI, 4))
-                {
-                    // Copy to pVIE which will report to microsoft bssid list.
-                    Ptr = (PUCHAR) pVIE;
-                    NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid, pEid->Len + 2);
-                    *LengthVIE += (pEid->Len + 2);
-                }
-                else if (NdisEqualMemory(pEid->Octet, WME_PARM_ELEM, 6) && (pEid->Len == 24))
-                {
-                    PUCHAR ptr;
-                    int i;
-
-                    // parsing EDCA parameters
-                    pEdcaParm->bValid          = TRUE;
-                    pEdcaParm->bQAck           = FALSE; // pEid->Octet[0] & 0x10;
-                    pEdcaParm->bQueueRequest   = FALSE; // pEid->Octet[0] & 0x20;
-                    pEdcaParm->bTxopRequest    = FALSE; // pEid->Octet[0] & 0x40;
-                    pEdcaParm->EdcaUpdateCount = pEid->Octet[6] & 0x0f;
-                    pEdcaParm->bAPSDCapable    = (pEid->Octet[6] & 0x80) ? 1 : 0;
-                    ptr = &pEid->Octet[8];
-                    for (i=0; i<4; i++)
-                    {
-                        UCHAR aci = (*ptr & 0x60) >> 5; // b5~6 is AC INDEX
-                        pEdcaParm->bACM[aci]  = (((*ptr) & 0x10) == 0x10);   // b5 is ACM
-                        pEdcaParm->Aifsn[aci] = (*ptr) & 0x0f;               // b0~3 is AIFSN
-                        pEdcaParm->Cwmin[aci] = *(ptr+1) & 0x0f;             // b0~4 is Cwmin
-                        pEdcaParm->Cwmax[aci] = *(ptr+1) >> 4;               // b5~8 is Cwmax
-                        pEdcaParm->Txop[aci]  = *(ptr+2) + 256 * (*(ptr+3)); // in unit of 32-us
-                        ptr += 4; // point to next AC
-                    }
-                }
-                else if (NdisEqualMemory(pEid->Octet, WME_INFO_ELEM, 6) && (pEid->Len == 7))
-                {
-                    // parsing EDCA parameters
-                    pEdcaParm->bValid          = TRUE;
-                    pEdcaParm->bQAck           = FALSE; // pEid->Octet[0] & 0x10;
-                    pEdcaParm->bQueueRequest   = FALSE; // pEid->Octet[0] & 0x20;
-                    pEdcaParm->bTxopRequest    = FALSE; // pEid->Octet[0] & 0x40;
-                    pEdcaParm->EdcaUpdateCount = pEid->Octet[6] & 0x0f;
-                    pEdcaParm->bAPSDCapable    = (pEid->Octet[6] & 0x80) ? 1 : 0;
-
-                    // use default EDCA parameter
-                    pEdcaParm->bACM[QID_AC_BE]  = 0;
-                    pEdcaParm->Aifsn[QID_AC_BE] = 3;
-                    pEdcaParm->Cwmin[QID_AC_BE] = CW_MIN_IN_BITS;
-                    pEdcaParm->Cwmax[QID_AC_BE] = CW_MAX_IN_BITS;
-                    pEdcaParm->Txop[QID_AC_BE]  = 0;
-
-                    pEdcaParm->bACM[QID_AC_BK]  = 0;
-                    pEdcaParm->Aifsn[QID_AC_BK] = 7;
-                    pEdcaParm->Cwmin[QID_AC_BK] = CW_MIN_IN_BITS;
-                    pEdcaParm->Cwmax[QID_AC_BK] = CW_MAX_IN_BITS;
-                    pEdcaParm->Txop[QID_AC_BK]  = 0;
-
-                    pEdcaParm->bACM[QID_AC_VI]  = 0;
-                    pEdcaParm->Aifsn[QID_AC_VI] = 2;
-                    pEdcaParm->Cwmin[QID_AC_VI] = CW_MIN_IN_BITS-1;
-                    pEdcaParm->Cwmax[QID_AC_VI] = CW_MAX_IN_BITS;
-                    pEdcaParm->Txop[QID_AC_VI]  = 96;   // AC_VI: 96*32us ~= 3ms
-
-                    pEdcaParm->bACM[QID_AC_VO]  = 0;
-                    pEdcaParm->Aifsn[QID_AC_VO] = 2;
-                    pEdcaParm->Cwmin[QID_AC_VO] = CW_MIN_IN_BITS-2;
-                    pEdcaParm->Cwmax[QID_AC_VO] = CW_MAX_IN_BITS-1;
-                    pEdcaParm->Txop[QID_AC_VO]  = 48;   // AC_VO: 48*32us ~= 1.5ms
-                }
-                break;
-
-            case IE_EXT_SUPP_RATES:
-                if (pEid->Len <= MAX_LEN_OF_SUPPORTED_RATES)
-                {
-                    NdisMoveMemory(ExtRate, pEid->Octet, pEid->Len);
-                    *pExtRateLen = pEid->Len;
-
-                    // TODO: 2004-09-14 not a good design here, cause it exclude extra rates
-                    // from ScanTab. We should report as is. And filter out unsupported
-                    // rates in MlmeAux.
-                    // Check against the supported rates
-                    // RTMPCheckRates(pAd, ExtRate, pExtRateLen);
-                }
-                break;
-
-            case IE_ERP:
-                if (pEid->Len == 1)
-                {
-                    *pErp = (UCHAR)pEid->Octet[0];
-                }
-                break;
-
-            case IE_AIRONET_CKIP:
-                // 0. Check Aironet IE length, it must be larger or equal to 28
-                // Cisco AP350 used length as 28
-                // Cisco AP12XX used length as 30
-                if (pEid->Len < (CKIP_NEGOTIATION_LENGTH - 2))
-                    break;
-
-                // 1. Copy CKIP flag byte to buffer for process
-                *pCkipFlag = *(pEid->Octet + 8);
-                break;
-
-            case IE_AP_TX_POWER:
-                // AP Control of Client Transmit Power
-                //0. Check Aironet IE length, it must be 6
-                if (pEid->Len != 0x06)
-                    break;
-
-                // Get cell power limit in dBm
-                if (NdisEqualMemory(pEid->Octet, CISCO_OUI, 3) == 1)
-                    *pAironetCellPowerLimit = *(pEid->Octet + 4);
-                break;
-
-            // WPA2 & 802.11i RSN
-            case IE_RSN:
-                // There is no OUI for version anymore, check the group cipher OUI before copying
-                if (RTMPEqualMemory(pEid->Octet + 2, RSN_OUI, 3))
-                {
-                    // Copy to pVIE which will report to microsoft bssid list.
-                    Ptr = (PUCHAR) pVIE;
-                    NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid, pEid->Len + 2);
-                    *LengthVIE += (pEid->Len + 2);
-                }
-                break;
-
-            default:
-                break;
-        }
-
-        Length = Length + 2 + pEid->Len;  // Eid[1] + Len[1]+ content[Len]
-        pEid = (PEID_STRUCT)((UCHAR*)pEid + 2 + pEid->Len);
-    }
-
-    // For some 11a AP. it did not have the channel EID, patch here
+		Length = Length + 2 + pEid->Len;	/* Eid[1] + Len[1]+ content[Len] */
+		pEid = (struct rt_eid *) ((u8 *) pEid + 2 + pEid->Len);
+	}
+
+	/* For some 11a AP. it did not have the channel EID, patch here */
 	{
-		UCHAR LatchRfChannel = MsgChannel;
-		if ((pAd->LatchRfRegs.Channel > 14) && ((Sanity & 0x4) == 0))
-		{
+		u8 LatchRfChannel = MsgChannel;
+		if ((pAd->LatchRfRegs.Channel > 14) && ((Sanity & 0x4) == 0)) {
 			if (CtrlChannel != 0)
 				*pChannel = CtrlChannel;
 			else
@@ -716,13 +711,12 @@ BOOLEAN PeerBeaconAndProbeRspSanity(
 		}
 	}
 
-	if (Sanity != 0x7)
-	{
-		DBGPRINT(RT_DEBUG_WARN, ("PeerBeaconAndProbeRspSanity - missing field, Sanity=0x%02x\n", Sanity));
+	if (Sanity != 0x7) {
+		DBGPRINT(RT_DEBUG_LOUD,
+			 ("PeerBeaconAndProbeRspSanity - missing field, Sanity=0x%02x\n",
+			  Sanity));
 		return FALSE;
-	}
-	else
-	{
+	} else {
 		return TRUE;
 	}
 
@@ -736,51 +730,42 @@ BOOLEAN PeerBeaconAndProbeRspSanity(
         TRUE if all parameters are OK, FALSE otherwise
     ==========================================================================
  */
-BOOLEAN MlmeScanReqSanity(
-	IN PRTMP_ADAPTER pAd,
-	IN VOID *Msg,
-	IN ULONG MsgLen,
-	OUT UCHAR *pBssType,
-	OUT CHAR Ssid[],
-	OUT UCHAR *pSsidLen,
-	OUT UCHAR *pScanType)
+BOOLEAN MlmeScanReqSanity(struct rt_rtmp_adapter *pAd,
+			  void * Msg,
+			  unsigned long MsgLen,
+			  u8 * pBssType,
+			  char Ssid[],
+			  u8 * pSsidLen, u8 * pScanType)
 {
-	MLME_SCAN_REQ_STRUCT *Info;
+	struct rt_mlme_scan_req *Info;
 
-	Info = (MLME_SCAN_REQ_STRUCT *)(Msg);
+	Info = (struct rt_mlme_scan_req *)(Msg);
 	*pBssType = Info->BssType;
 	*pSsidLen = Info->SsidLen;
 	NdisMoveMemory(Ssid, Info->Ssid, *pSsidLen);
 	*pScanType = Info->ScanType;
 
-	if ((*pBssType == BSS_INFRA || *pBssType == BSS_ADHOC || *pBssType == BSS_ANY)
-		&& (*pScanType == SCAN_ACTIVE || *pScanType == SCAN_PASSIVE
-		|| *pScanType == SCAN_CISCO_PASSIVE || *pScanType == SCAN_CISCO_ACTIVE
-		|| *pScanType == SCAN_CISCO_CHANNEL_LOAD || *pScanType == SCAN_CISCO_NOISE
-		))
-	{
+	if ((*pBssType == BSS_INFRA || *pBssType == BSS_ADHOC
+	     || *pBssType == BSS_ANY)
+	    && (*pScanType == SCAN_ACTIVE || *pScanType == SCAN_PASSIVE)) {
 		return TRUE;
-	}
-	else
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("MlmeScanReqSanity fail - wrong BssType or ScanType\n"));
+	} else {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("MlmeScanReqSanity fail - wrong BssType or ScanType\n"));
 		return FALSE;
 	}
 }
 
-// IRQL = DISPATCH_LEVEL
-UCHAR ChannelSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN UCHAR channel)
+/* IRQL = DISPATCH_LEVEL */
+u8 ChannelSanity(struct rt_rtmp_adapter *pAd, u8 channel)
 {
-    int i;
-
-    for (i = 0; i < pAd->ChannelListNum; i ++)
-    {
-        if (channel == pAd->ChannelList[i].Channel)
-            return 1;
-    }
-    return 0;
+	int i;
+
+	for (i = 0; i < pAd->ChannelListNum; i++) {
+		if (channel == pAd->ChannelList[i].Channel)
+			return 1;
+	}
+	return 0;
 }
 
 /*
@@ -794,19 +779,17 @@ UCHAR ChannelSanity(
 
     ==========================================================================
  */
-BOOLEAN PeerDeauthSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN VOID *Msg,
-    IN ULONG MsgLen,
-    OUT PUCHAR pAddr2,
-    OUT USHORT *pReason)
+BOOLEAN PeerDeauthSanity(struct rt_rtmp_adapter *pAd,
+			 void * Msg,
+			 unsigned long MsgLen,
+			 u8 *pAddr2, u16 * pReason)
 {
-    PFRAME_802_11 pFrame = (PFRAME_802_11)Msg;
+	struct rt_frame_802_11 * pFrame = (struct rt_frame_802_11 *) Msg;
 
-    COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
-    NdisMoveMemory(pReason, &pFrame->Octet[0], 2);
+	COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
+	NdisMoveMemory(pReason, &pFrame->Octet[0], 2);
 
-    return TRUE;
+	return TRUE;
 }
 
 /*
@@ -820,58 +803,46 @@ BOOLEAN PeerDeauthSanity(
 
     ==========================================================================
  */
-BOOLEAN PeerAuthSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN VOID *Msg,
-    IN ULONG MsgLen,
-    OUT PUCHAR pAddr,
-    OUT USHORT *pAlg,
-    OUT USHORT *pSeq,
-    OUT USHORT *pStatus,
-    CHAR *pChlgText)
+BOOLEAN PeerAuthSanity(struct rt_rtmp_adapter *pAd,
+		       void * Msg,
+		       unsigned long MsgLen,
+		       u8 *pAddr,
+		       u16 * pAlg,
+		       u16 * pSeq,
+		       u16 * pStatus, char * pChlgText)
 {
-    PFRAME_802_11 pFrame = (PFRAME_802_11)Msg;
-
-    COPY_MAC_ADDR(pAddr,   pFrame->Hdr.Addr2);
-    NdisMoveMemory(pAlg,    &pFrame->Octet[0], 2);
-    NdisMoveMemory(pSeq,    &pFrame->Octet[2], 2);
-    NdisMoveMemory(pStatus, &pFrame->Octet[4], 2);
-
-    if ((*pAlg == Ndis802_11AuthModeOpen)
-      )
-    {
-        if (*pSeq == 1 || *pSeq == 2)
-        {
-            return TRUE;
-        }
-        else
-        {
-            DBGPRINT(RT_DEBUG_TRACE, ("PeerAuthSanity fail - wrong Seg#\n"));
-            return FALSE;
-        }
-    }
-    else if (*pAlg == Ndis802_11AuthModeShared)
-    {
-        if (*pSeq == 1 || *pSeq == 4)
-        {
-            return TRUE;
-        }
-        else if (*pSeq == 2 || *pSeq == 3)
-        {
-            NdisMoveMemory(pChlgText, &pFrame->Octet[8], CIPHER_TEXT_LEN);
-            return TRUE;
-        }
-        else
-        {
-            DBGPRINT(RT_DEBUG_TRACE, ("PeerAuthSanity fail - wrong Seg#\n"));
-            return FALSE;
-        }
-    }
-    else
-    {
-        DBGPRINT(RT_DEBUG_TRACE, ("PeerAuthSanity fail - wrong algorithm\n"));
-        return FALSE;
-    }
+	struct rt_frame_802_11 * pFrame = (struct rt_frame_802_11 *) Msg;
+
+	COPY_MAC_ADDR(pAddr, pFrame->Hdr.Addr2);
+	NdisMoveMemory(pAlg, &pFrame->Octet[0], 2);
+	NdisMoveMemory(pSeq, &pFrame->Octet[2], 2);
+	NdisMoveMemory(pStatus, &pFrame->Octet[4], 2);
+
+	if (*pAlg == AUTH_MODE_OPEN) {
+		if (*pSeq == 1 || *pSeq == 2) {
+			return TRUE;
+		} else {
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("PeerAuthSanity fail - wrong Seg#\n"));
+			return FALSE;
+		}
+	} else if (*pAlg == AUTH_MODE_KEY) {
+		if (*pSeq == 1 || *pSeq == 4) {
+			return TRUE;
+		} else if (*pSeq == 2 || *pSeq == 3) {
+			NdisMoveMemory(pChlgText, &pFrame->Octet[8],
+				       CIPHER_TEXT_LEN);
+			return TRUE;
+		} else {
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("PeerAuthSanity fail - wrong Seg#\n"));
+			return FALSE;
+		}
+	} else {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("PeerAuthSanity fail - wrong algorithm\n"));
+		return FALSE;
+	}
 }
 
 /*
@@ -882,32 +853,27 @@ BOOLEAN PeerAuthSanity(
         TRUE if all parameters are OK, FALSE otherwise
     ==========================================================================
  */
-BOOLEAN MlmeAuthReqSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN VOID *Msg,
-    IN ULONG MsgLen,
-    OUT PUCHAR pAddr,
-    OUT ULONG *pTimeout,
-    OUT USHORT *pAlg)
+BOOLEAN MlmeAuthReqSanity(struct rt_rtmp_adapter *pAd,
+			  void * Msg,
+			  unsigned long MsgLen,
+			  u8 *pAddr,
+			  unsigned long * pTimeout, u16 * pAlg)
 {
-    MLME_AUTH_REQ_STRUCT *pInfo;
-
-    pInfo  = (MLME_AUTH_REQ_STRUCT *)Msg;
-    COPY_MAC_ADDR(pAddr, pInfo->Addr);
-    *pTimeout = pInfo->Timeout;
-    *pAlg = pInfo->Alg;
-
-    if (((*pAlg == Ndis802_11AuthModeShared) ||(*pAlg == Ndis802_11AuthModeOpen)
-     	) &&
-        ((*pAddr & 0x01) == 0))
-    {
-        return TRUE;
-    }
-    else
-    {
-        DBGPRINT(RT_DEBUG_TRACE, ("MlmeAuthReqSanity fail - wrong algorithm\n"));
-        return FALSE;
-    }
+	struct rt_mlme_auth_req *pInfo;
+
+	pInfo = (struct rt_mlme_auth_req *)Msg;
+	COPY_MAC_ADDR(pAddr, pInfo->Addr);
+	*pTimeout = pInfo->Timeout;
+	*pAlg = pInfo->Alg;
+
+	if (((*pAlg == AUTH_MODE_KEY) || (*pAlg == AUTH_MODE_OPEN)
+	    ) && ((*pAddr & 0x01) == 0)) {
+		return TRUE;
+	} else {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("MlmeAuthReqSanity fail - wrong algorithm\n"));
+		return FALSE;
+	}
 }
 
 /*
@@ -921,24 +887,22 @@ BOOLEAN MlmeAuthReqSanity(
 
     ==========================================================================
  */
-BOOLEAN MlmeAssocReqSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN VOID *Msg,
-    IN ULONG MsgLen,
-    OUT PUCHAR pApAddr,
-    OUT USHORT *pCapabilityInfo,
-    OUT ULONG *pTimeout,
-    OUT USHORT *pListenIntv)
+BOOLEAN MlmeAssocReqSanity(struct rt_rtmp_adapter *pAd,
+			   void * Msg,
+			   unsigned long MsgLen,
+			   u8 *pApAddr,
+			   u16 * pCapabilityInfo,
+			   unsigned long * pTimeout, u16 * pListenIntv)
 {
-    MLME_ASSOC_REQ_STRUCT *pInfo;
+	struct rt_mlme_assoc_req *pInfo;
 
-    pInfo = (MLME_ASSOC_REQ_STRUCT *)Msg;
-    *pTimeout = pInfo->Timeout;                             // timeout
-    COPY_MAC_ADDR(pApAddr, pInfo->Addr);                   // AP address
-    *pCapabilityInfo = pInfo->CapabilityInfo;               // capability info
-    *pListenIntv = pInfo->ListenIntv;
+	pInfo = (struct rt_mlme_assoc_req *)Msg;
+	*pTimeout = pInfo->Timeout;	/* timeout */
+	COPY_MAC_ADDR(pApAddr, pInfo->Addr);	/* AP address */
+	*pCapabilityInfo = pInfo->CapabilityInfo;	/* capability info */
+	*pListenIntv = pInfo->ListenIntv;
 
-    return TRUE;
+	return TRUE;
 }
 
 /*
@@ -952,19 +916,17 @@ BOOLEAN MlmeAssocReqSanity(
 
     ==========================================================================
  */
-BOOLEAN PeerDisassocSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN VOID *Msg,
-    IN ULONG MsgLen,
-    OUT PUCHAR pAddr2,
-    OUT USHORT *pReason)
+BOOLEAN PeerDisassocSanity(struct rt_rtmp_adapter *pAd,
+			   void * Msg,
+			   unsigned long MsgLen,
+			   u8 *pAddr2, u16 * pReason)
 {
-    PFRAME_802_11 pFrame = (PFRAME_802_11)Msg;
+	struct rt_frame_802_11 * pFrame = (struct rt_frame_802_11 *) Msg;
 
-    COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
-    NdisMoveMemory(pReason, &pFrame->Octet[0], 2);
+	COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
+	NdisMoveMemory(pReason, &pFrame->Octet[0], 2);
 
-    return TRUE;
+	return TRUE;
 }
 
 /*
@@ -984,71 +946,260 @@ BOOLEAN PeerDisassocSanity(
 
 	========================================================================
 */
-NDIS_802_11_NETWORK_TYPE NetworkTypeInUseSanity(
-    IN PBSS_ENTRY pBss)
+NDIS_802_11_NETWORK_TYPE NetworkTypeInUseSanity(struct rt_bss_entry *pBss)
 {
-	NDIS_802_11_NETWORK_TYPE	NetWorkType;
-	UCHAR						rate, i;
+	NDIS_802_11_NETWORK_TYPE NetWorkType;
+	u8 rate, i;
 
 	NetWorkType = Ndis802_11DS;
 
-	if (pBss->Channel <= 14)
-	{
-		//
-		// First check support Rate.
-		//
-		for (i = 0; i < pBss->SupRateLen; i++)
-		{
-			rate = pBss->SupRate[i] & 0x7f; // Mask out basic rate set bit
-			if ((rate == 2) || (rate == 4) || (rate == 11) || (rate == 22))
-			{
+	if (pBss->Channel <= 14) {
+		/* */
+		/* First check support Rate. */
+		/* */
+		for (i = 0; i < pBss->SupRateLen; i++) {
+			rate = pBss->SupRate[i] & 0x7f;	/* Mask out basic rate set bit */
+			if ((rate == 2) || (rate == 4) || (rate == 11)
+			    || (rate == 22)) {
 				continue;
-			}
-			else
-			{
-				//
-				// Otherwise (even rate > 108) means Ndis802_11OFDM24
-				//
+			} else {
+				/* */
+				/* Otherwise (even rate > 108) means Ndis802_11OFDM24 */
+				/* */
 				NetWorkType = Ndis802_11OFDM24;
 				break;
 			}
 		}
 
-		//
-		// Second check Extend Rate.
-		//
-		if (NetWorkType != Ndis802_11OFDM24)
-		{
-			for (i = 0; i < pBss->ExtRateLen; i++)
-			{
-				rate = pBss->SupRate[i] & 0x7f; // Mask out basic rate set bit
-				if ((rate == 2) || (rate == 4) || (rate == 11) || (rate == 22))
-				{
+		/* */
+		/* Second check Extend Rate. */
+		/* */
+		if (NetWorkType != Ndis802_11OFDM24) {
+			for (i = 0; i < pBss->ExtRateLen; i++) {
+				rate = pBss->SupRate[i] & 0x7f;	/* Mask out basic rate set bit */
+				if ((rate == 2) || (rate == 4) || (rate == 11)
+				    || (rate == 22)) {
 					continue;
-				}
-				else
-				{
-					//
-					// Otherwise (even rate > 108) means Ndis802_11OFDM24
-					//
+				} else {
+					/* */
+					/* Otherwise (even rate > 108) means Ndis802_11OFDM24 */
+					/* */
 					NetWorkType = Ndis802_11OFDM24;
 					break;
 				}
 			}
 		}
-	}
-	else
-	{
+	} else {
 		NetWorkType = Ndis802_11OFDM5;
 	}
 
-    if (pBss->HtCapabilityLen != 0)
-    {
-        if (NetWorkType == Ndis802_11OFDM5)
-            NetWorkType = Ndis802_11OFDM5_N;
-        else
-            NetWorkType = Ndis802_11OFDM24_N;
-    }
+	if (pBss->HtCapabilityLen != 0) {
+		if (NetWorkType == Ndis802_11OFDM5)
+			NetWorkType = Ndis802_11OFDM5_N;
+		else
+			NetWorkType = Ndis802_11OFDM24_N;
+	}
 
 	return NetWorkType;
 }
+
+/*
+    ==========================================================================
+    Description:
+        Check the validity of the received EAPoL frame
+    Return:
+        TRUE if all parameters are OK,
+        FALSE otherwise
+    ==========================================================================
+ */
+BOOLEAN PeerWpaMessageSanity(struct rt_rtmp_adapter *pAd,
+			     struct rt_eapol_packet * pMsg,
+			     unsigned long MsgLen,
+			     u8 MsgType, struct rt_mac_table_entry *pEntry)
+{
+	u8 mic[LEN_KEY_DESC_MIC], digest[80], KEYDATA[MAX_LEN_OF_RSNIE];
+	BOOLEAN bReplayDiff = FALSE;
+	BOOLEAN bWPA2 = FALSE;
+	struct rt_key_info EapolKeyInfo;
+	u8 GroupKeyIndex = 0;
+
+	NdisZeroMemory(mic, sizeof(mic));
+	NdisZeroMemory(digest, sizeof(digest));
+	NdisZeroMemory(KEYDATA, sizeof(KEYDATA));
+	NdisZeroMemory((u8 *)& EapolKeyInfo, sizeof(EapolKeyInfo));
+
+	NdisMoveMemory((u8 *)& EapolKeyInfo,
+		       (u8 *)& pMsg->KeyDesc.KeyInfo, sizeof(struct rt_key_info));
+
+	*((u16 *) & EapolKeyInfo) = cpu2le16(*((u16 *) & EapolKeyInfo));
+
+	/* Choose WPA2 or not */
+	if ((pEntry->AuthMode == Ndis802_11AuthModeWPA2)
+	    || (pEntry->AuthMode == Ndis802_11AuthModeWPA2PSK))
+		bWPA2 = TRUE;
+
+	/* 0. Check MsgType */
+	if ((MsgType > EAPOL_GROUP_MSG_2) || (MsgType < EAPOL_PAIR_MSG_1)) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("The message type is invalid(%d)! \n", MsgType));
+		return FALSE;
+	}
+	/* 1. Replay counter check */
+	if (MsgType == EAPOL_PAIR_MSG_1 || MsgType == EAPOL_PAIR_MSG_3 || MsgType == EAPOL_GROUP_MSG_1)	/* For supplicant */
+	{
+		/* First validate replay counter, only accept message with larger replay counter. */
+		/* Let equal pass, some AP start with all zero replay counter */
+		u8 ZeroReplay[LEN_KEY_DESC_REPLAY];
+
+		NdisZeroMemory(ZeroReplay, LEN_KEY_DESC_REPLAY);
+		if ((RTMPCompareMemory
+		     (pMsg->KeyDesc.ReplayCounter, pEntry->R_Counter,
+		      LEN_KEY_DESC_REPLAY) != 1)
+		    &&
+		    (RTMPCompareMemory
+		     (pMsg->KeyDesc.ReplayCounter, ZeroReplay,
+		      LEN_KEY_DESC_REPLAY) != 0)) {
+			bReplayDiff = TRUE;
+		}
+	} else if (MsgType == EAPOL_PAIR_MSG_2 || MsgType == EAPOL_PAIR_MSG_4 || MsgType == EAPOL_GROUP_MSG_2)	/* For authenticator */
+	{
+		/* check Replay Counter coresponds to MSG from authenticator, otherwise discard */
+		if (!NdisEqualMemory
+		    (pMsg->KeyDesc.ReplayCounter, pEntry->R_Counter,
+		     LEN_KEY_DESC_REPLAY)) {
+			bReplayDiff = TRUE;
+		}
+	}
+	/* Replay Counter different condition */
+	if (bReplayDiff) {
+		/* send wireless event - for replay counter different */
+		if (pAd->CommonCfg.bWirelessEvent)
+			RTMPSendWirelessEvent(pAd,
+					      IW_REPLAY_COUNTER_DIFF_EVENT_FLAG,
+					      pEntry->Addr, pEntry->apidx, 0);
+
+		if (MsgType < EAPOL_GROUP_MSG_1) {
+			DBGPRINT(RT_DEBUG_ERROR,
+				 ("Replay Counter Different in pairwise msg %d of 4-way handshake!\n",
+				  MsgType));
+		} else {
+			DBGPRINT(RT_DEBUG_ERROR,
+				 ("Replay Counter Different in group msg %d of 2-way handshake!\n",
+				  (MsgType - EAPOL_PAIR_MSG_4)));
+		}
+
+		hex_dump("Receive replay counter ", pMsg->KeyDesc.ReplayCounter,
+			 LEN_KEY_DESC_REPLAY);
+		hex_dump("Current replay counter ", pEntry->R_Counter,
+			 LEN_KEY_DESC_REPLAY);
+		return FALSE;
+	}
+	/* 2. Verify MIC except Pairwise Msg1 */
+	if (MsgType != EAPOL_PAIR_MSG_1) {
+		u8 rcvd_mic[LEN_KEY_DESC_MIC];
+
+		/* Record the received MIC for check later */
+		NdisMoveMemory(rcvd_mic, pMsg->KeyDesc.KeyMic,
+			       LEN_KEY_DESC_MIC);
+		NdisZeroMemory(pMsg->KeyDesc.KeyMic, LEN_KEY_DESC_MIC);
+
+		if (EapolKeyInfo.KeyDescVer == DESC_TYPE_TKIP)	/* TKIP */
+		{
+			HMAC_MD5(pEntry->PTK, LEN_EAP_MICK, (u8 *)pMsg,
+				 MsgLen, mic, MD5_DIGEST_SIZE);
+		} else if (EapolKeyInfo.KeyDescVer == DESC_TYPE_AES)	/* AES */
+		{
+			HMAC_SHA1(pEntry->PTK, LEN_EAP_MICK, (u8 *)pMsg,
+				  MsgLen, digest, SHA1_DIGEST_SIZE);
+			NdisMoveMemory(mic, digest, LEN_KEY_DESC_MIC);
+		}
+
+		if (!NdisEqualMemory(rcvd_mic, mic, LEN_KEY_DESC_MIC)) {
+			/* send wireless event - for MIC different */
+			if (pAd->CommonCfg.bWirelessEvent)
+				RTMPSendWirelessEvent(pAd,
+						      IW_MIC_DIFF_EVENT_FLAG,
+						      pEntry->Addr,
+						      pEntry->apidx, 0);
+
+			if (MsgType < EAPOL_GROUP_MSG_1) {
+				DBGPRINT(RT_DEBUG_ERROR,
+					 ("MIC Different in pairwise msg %d of 4-way handshake!\n",
+					  MsgType));
+			} else {
+				DBGPRINT(RT_DEBUG_ERROR,
+					 ("MIC Different in group msg %d of 2-way handshake!\n",
+					  (MsgType - EAPOL_PAIR_MSG_4)));
+			}
+
+			hex_dump("Received MIC", rcvd_mic, LEN_KEY_DESC_MIC);
+			hex_dump("Desired  MIC", mic, LEN_KEY_DESC_MIC);
+
+			return FALSE;
+		}
+	}
+	/* 1. Decrypt the Key Data field if GTK is included. */
+	/* 2. Extract the context of the Key Data field if it exist. */
+	/* The field in pairwise_msg_2_WPA1(WPA2) & pairwise_msg_3_WPA1 is clear. */
+	/* The field in group_msg_1_WPA1(WPA2) & pairwise_msg_3_WPA2 is encrypted. */
+	if (CONV_ARRARY_TO_u16(pMsg->KeyDesc.KeyDataLen) > 0) {
+		/* Decrypt this field */
+		if ((MsgType == EAPOL_PAIR_MSG_3 && bWPA2)
+		    || (MsgType == EAPOL_GROUP_MSG_1)) {
+			if ((EapolKeyInfo.KeyDescVer == DESC_TYPE_AES)) {
+				/* AES */
+				AES_GTK_KEY_UNWRAP(&pEntry->PTK[16], KEYDATA,
+						   CONV_ARRARY_TO_u16(pMsg->
+									 KeyDesc.
+									 KeyDataLen),
+						   pMsg->KeyDesc.KeyData);
+			} else {
+				int i;
+				u8 Key[32];
+				/* Decrypt TKIP GTK */
+				/* Construct 32 bytes RC4 Key */
+				NdisMoveMemory(Key, pMsg->KeyDesc.KeyIv, 16);
+				NdisMoveMemory(&Key[16], &pEntry->PTK[16], 16);
+				ARCFOUR_INIT(&pAd->PrivateInfo.WEPCONTEXT, Key,
+					     32);
+				/*discard first 256 bytes */
+				for (i = 0; i < 256; i++)
+					ARCFOUR_BYTE(&pAd->PrivateInfo.
+						     WEPCONTEXT);
+				/* Decrypt GTK. Becareful, there is no ICV to check the result is correct or not */
+				ARCFOUR_DECRYPT(&pAd->PrivateInfo.WEPCONTEXT,
+						KEYDATA, pMsg->KeyDesc.KeyData,
+						CONV_ARRARY_TO_u16(pMsg->
+								      KeyDesc.
+								      KeyDataLen));
+			}
+
+			if (!bWPA2 && (MsgType == EAPOL_GROUP_MSG_1))
+				GroupKeyIndex = EapolKeyInfo.KeyIndex;
+
+		} else if ((MsgType == EAPOL_PAIR_MSG_2)
+			   || (MsgType == EAPOL_PAIR_MSG_3 && !bWPA2)) {
+			NdisMoveMemory(KEYDATA, pMsg->KeyDesc.KeyData,
+				       CONV_ARRARY_TO_u16(pMsg->KeyDesc.
+							     KeyDataLen));
+		} else {
+
+			return TRUE;
+		}
+
+		/* Parse Key Data field to */
+		/* 1. verify RSN IE for pairwise_msg_2_WPA1(WPA2) ,pairwise_msg_3_WPA1(WPA2) */
+		/* 2. verify KDE format for pairwise_msg_3_WPA2, group_msg_1_WPA2 */
+		/* 3. update shared key for pairwise_msg_3_WPA2, group_msg_1_WPA1(WPA2) */
+		if (!RTMPParseEapolKeyData(pAd, KEYDATA,
+					   CONV_ARRARY_TO_u16(pMsg->KeyDesc.
+								 KeyDataLen),
+					   GroupKeyIndex, MsgType, bWPA2,
+					   pEntry)) {
+			return FALSE;
+		}
+	}
+
+	return TRUE;
+
+}
diff --git a/drivers/staging/rt2860/common/cmm_sync.c b/drivers/staging/rt2860/common/cmm_sync.c
index a6e1b6ddfe57..f84194da47bc 100644
--- a/drivers/staging/rt2860/common/cmm_sync.c
+++ b/drivers/staging/rt2860/common/cmm_sync.c
@@ -25,7 +25,7 @@
  *************************************************************************
 
 	Module Name:
-	sync.c
+	cmm_sync.c
 
 	Abstract:
 
@@ -36,42 +36,62 @@
 */
 #include "../rt_config.h"
 
-// 2.4 Ghz channel plan index in the TxPower arrays.
-#define	BG_BAND_REGION_0_START	0			// 1,2,3,4,5,6,7,8,9,10,11
+/* 2.4 Ghz channel plan index in the TxPower arrays. */
+#define	BG_BAND_REGION_0_START	0	/* 1,2,3,4,5,6,7,8,9,10,11 */
 #define	BG_BAND_REGION_0_SIZE	11
-#define	BG_BAND_REGION_1_START	0			// 1,2,3,4,5,6,7,8,9,10,11,12,13
+#define	BG_BAND_REGION_1_START	0	/* 1,2,3,4,5,6,7,8,9,10,11,12,13 */
 #define	BG_BAND_REGION_1_SIZE	13
-#define	BG_BAND_REGION_2_START	9			// 10,11
+#define	BG_BAND_REGION_2_START	9	/* 10,11 */
 #define	BG_BAND_REGION_2_SIZE	2
-#define	BG_BAND_REGION_3_START	9			// 10,11,12,13
+#define	BG_BAND_REGION_3_START	9	/* 10,11,12,13 */
 #define	BG_BAND_REGION_3_SIZE	4
-#define	BG_BAND_REGION_4_START	13			// 14
+#define	BG_BAND_REGION_4_START	13	/* 14 */
 #define	BG_BAND_REGION_4_SIZE	1
-#define	BG_BAND_REGION_5_START	0			// 1,2,3,4,5,6,7,8,9,10,11,12,13,14
+#define	BG_BAND_REGION_5_START	0	/* 1,2,3,4,5,6,7,8,9,10,11,12,13,14 */
 #define	BG_BAND_REGION_5_SIZE	14
-#define	BG_BAND_REGION_6_START	2			// 3,4,5,6,7,8,9
+#define	BG_BAND_REGION_6_START	2	/* 3,4,5,6,7,8,9 */
 #define	BG_BAND_REGION_6_SIZE	7
-#define	BG_BAND_REGION_7_START	4			// 5,6,7,8,9,10,11,12,13
+#define	BG_BAND_REGION_7_START	4	/* 5,6,7,8,9,10,11,12,13 */
 #define	BG_BAND_REGION_7_SIZE	9
-#define	BG_BAND_REGION_31_START	0			// 1,2,3,4,5,6,7,8,9,10,11,12,13,14
+#define	BG_BAND_REGION_31_START	0	/* 1,2,3,4,5,6,7,8,9,10,11,12,13,14 */
 #define	BG_BAND_REGION_31_SIZE	14
 
-// 5 Ghz channel plan index in the TxPower arrays.
-UCHAR A_BAND_REGION_0_CHANNEL_LIST[]={36, 40, 44, 48, 52, 56, 60, 64, 149, 153, 157, 161, 165};
-UCHAR A_BAND_REGION_1_CHANNEL_LIST[]={36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140};
-UCHAR A_BAND_REGION_2_CHANNEL_LIST[]={36, 40, 44, 48, 52, 56, 60, 64};
-UCHAR A_BAND_REGION_3_CHANNEL_LIST[]={52, 56, 60, 64, 149, 153, 157, 161};
-UCHAR A_BAND_REGION_4_CHANNEL_LIST[]={149, 153, 157, 161, 165};
-UCHAR A_BAND_REGION_5_CHANNEL_LIST[]={149, 153, 157, 161};
-UCHAR A_BAND_REGION_6_CHANNEL_LIST[]={36, 40, 44, 48};
-UCHAR A_BAND_REGION_7_CHANNEL_LIST[]={36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 149, 153, 157, 161, 165};
-UCHAR A_BAND_REGION_8_CHANNEL_LIST[]={52, 56, 60, 64};
-UCHAR A_BAND_REGION_9_CHANNEL_LIST[]={36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 132, 136, 140, 149, 153, 157, 161, 165};
-UCHAR A_BAND_REGION_10_CHANNEL_LIST[]={36, 40, 44, 48, 149, 153, 157, 161, 165};
-UCHAR A_BAND_REGION_11_CHANNEL_LIST[]={36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 149, 153, 157, 161};
-
-//BaSizeArray follows the 802.11n definition as MaxRxFactor.  2^(13+factor) bytes. When factor =0, it's about Ba buffer size =8.
-UCHAR BaSizeArray[4] = {8,16,32,64};
+/* 5 Ghz channel plan index in the TxPower arrays. */
+u8 A_BAND_REGION_0_CHANNEL_LIST[] =
+    { 36, 40, 44, 48, 52, 56, 60, 64, 149, 153, 157, 161, 165 };
+u8 A_BAND_REGION_1_CHANNEL_LIST[] =
+    { 36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 124, 128,
+132, 136, 140 };
+u8 A_BAND_REGION_2_CHANNEL_LIST[] = { 36, 40, 44, 48, 52, 56, 60, 64 };
+u8 A_BAND_REGION_3_CHANNEL_LIST[] = { 52, 56, 60, 64, 149, 153, 157, 161 };
+u8 A_BAND_REGION_4_CHANNEL_LIST[] = { 149, 153, 157, 161, 165 };
+u8 A_BAND_REGION_5_CHANNEL_LIST[] = { 149, 153, 157, 161 };
+u8 A_BAND_REGION_6_CHANNEL_LIST[] = { 36, 40, 44, 48 };
+u8 A_BAND_REGION_7_CHANNEL_LIST[] =
+    { 36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 124, 128,
+132, 136, 140, 149, 153, 157, 161, 165, 169, 173 };
+u8 A_BAND_REGION_8_CHANNEL_LIST[] = { 52, 56, 60, 64 };
+u8 A_BAND_REGION_9_CHANNEL_LIST[] =
+    { 36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 132, 136, 140,
+149, 153, 157, 161, 165 };
+u8 A_BAND_REGION_10_CHANNEL_LIST[] =
+    { 36, 40, 44, 48, 149, 153, 157, 161, 165 };
+u8 A_BAND_REGION_11_CHANNEL_LIST[] =
+    { 36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 149, 153,
+157, 161 };
+u8 A_BAND_REGION_12_CHANNEL_LIST[] =
+    { 36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 124, 128,
+132, 136, 140 };
+u8 A_BAND_REGION_13_CHANNEL_LIST[] =
+    { 52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140,
+149, 153, 157, 161 };
+u8 A_BAND_REGION_14_CHANNEL_LIST[] =
+    { 36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 136, 140, 149,
+153, 157, 161, 165 };
+u8 A_BAND_REGION_15_CHANNEL_LIST[] = { 149, 153, 157, 161, 165, 169, 173 };
+
+/*BaSizeArray follows the 802.11n definition as MaxRxFactor.  2^(13+factor) bytes. When factor =0, it's about Ba buffer size =8. */
+u8 BaSizeArray[4] = { 8, 16, 32, 64 };
 
 /*
 	==========================================================================
@@ -85,155 +105,243 @@ UCHAR BaSizeArray[4] = {8,16,32,64};
 
 	==========================================================================
  */
-VOID BuildChannelList(
-	IN PRTMP_ADAPTER pAd)
+void BuildChannelList(struct rt_rtmp_adapter *pAd)
 {
-	UCHAR i, j, index=0, num=0;
-	PUCHAR	pChannelList = NULL;
+	u8 i, j, index = 0, num = 0;
+	u8 *pChannelList = NULL;
 
-	NdisZeroMemory(pAd->ChannelList, MAX_NUM_OF_CHANNELS * sizeof(CHANNEL_TX_POWER));
+	NdisZeroMemory(pAd->ChannelList,
+		       MAX_NUM_OF_CHANNELS * sizeof(struct rt_channel_tx_power));
 
-	// if not 11a-only mode, channel list starts from 2.4Ghz band
+	/* if not 11a-only mode, channel list starts from 2.4Ghz band */
 	if ((pAd->CommonCfg.PhyMode != PHY_11A)
-		&& (pAd->CommonCfg.PhyMode != PHY_11AN_MIXED) && (pAd->CommonCfg.PhyMode != PHY_11N_5G)
-	)
-	{
-		switch (pAd->CommonCfg.CountryRegion  & 0x7f)
-		{
-			case REGION_0_BG_BAND:	// 1 -11
-				NdisMoveMemory(&pAd->ChannelList[index], &pAd->TxPower[BG_BAND_REGION_0_START], sizeof(CHANNEL_TX_POWER) * BG_BAND_REGION_0_SIZE);
-				index += BG_BAND_REGION_0_SIZE;
-				break;
-			case REGION_1_BG_BAND:	// 1 - 13
-				NdisMoveMemory(&pAd->ChannelList[index], &pAd->TxPower[BG_BAND_REGION_1_START], sizeof(CHANNEL_TX_POWER) * BG_BAND_REGION_1_SIZE);
-				index += BG_BAND_REGION_1_SIZE;
-				break;
-			case REGION_2_BG_BAND:	// 10 - 11
-				NdisMoveMemory(&pAd->ChannelList[index], &pAd->TxPower[BG_BAND_REGION_2_START], sizeof(CHANNEL_TX_POWER) * BG_BAND_REGION_2_SIZE);
-				index += BG_BAND_REGION_2_SIZE;
-				break;
-			case REGION_3_BG_BAND:	// 10 - 13
-				NdisMoveMemory(&pAd->ChannelList[index], &pAd->TxPower[BG_BAND_REGION_3_START], sizeof(CHANNEL_TX_POWER) * BG_BAND_REGION_3_SIZE);
-				index += BG_BAND_REGION_3_SIZE;
-				break;
-			case REGION_4_BG_BAND:	// 14
-				NdisMoveMemory(&pAd->ChannelList[index], &pAd->TxPower[BG_BAND_REGION_4_START], sizeof(CHANNEL_TX_POWER) * BG_BAND_REGION_4_SIZE);
-				index += BG_BAND_REGION_4_SIZE;
-				break;
-			case REGION_5_BG_BAND:	// 1 - 14
-				NdisMoveMemory(&pAd->ChannelList[index], &pAd->TxPower[BG_BAND_REGION_5_START], sizeof(CHANNEL_TX_POWER) * BG_BAND_REGION_5_SIZE);
-				index += BG_BAND_REGION_5_SIZE;
-				break;
-			case REGION_6_BG_BAND:	// 3 - 9
-				NdisMoveMemory(&pAd->ChannelList[index], &pAd->TxPower[BG_BAND_REGION_6_START], sizeof(CHANNEL_TX_POWER) * BG_BAND_REGION_6_SIZE);
-				index += BG_BAND_REGION_6_SIZE;
-				break;
-			case REGION_7_BG_BAND:  // 5 - 13
-				NdisMoveMemory(&pAd->ChannelList[index], &pAd->TxPower[BG_BAND_REGION_7_START], sizeof(CHANNEL_TX_POWER) * BG_BAND_REGION_7_SIZE);
-				index += BG_BAND_REGION_7_SIZE;
-				break;
-			case REGION_31_BG_BAND:	// 1 - 14
-				NdisMoveMemory(&pAd->ChannelList[index], &pAd->TxPower[BG_BAND_REGION_31_START], sizeof(CHANNEL_TX_POWER) * BG_BAND_REGION_31_SIZE);
-				index += BG_BAND_REGION_31_SIZE;
-				break;
-			default:            // Error. should never happen
-				break;
+	    && (pAd->CommonCfg.PhyMode != PHY_11AN_MIXED)
+	    && (pAd->CommonCfg.PhyMode != PHY_11N_5G)
+	    ) {
+		switch (pAd->CommonCfg.CountryRegion & 0x7f) {
+		case REGION_0_BG_BAND:	/* 1 -11 */
+			NdisMoveMemory(&pAd->ChannelList[index],
+				       &pAd->TxPower[BG_BAND_REGION_0_START],
+				       sizeof(struct rt_channel_tx_power) *
+				       BG_BAND_REGION_0_SIZE);
+			index += BG_BAND_REGION_0_SIZE;
+			break;
+		case REGION_1_BG_BAND:	/* 1 - 13 */
+			NdisMoveMemory(&pAd->ChannelList[index],
+				       &pAd->TxPower[BG_BAND_REGION_1_START],
+				       sizeof(struct rt_channel_tx_power) *
+				       BG_BAND_REGION_1_SIZE);
+			index += BG_BAND_REGION_1_SIZE;
+			break;
+		case REGION_2_BG_BAND:	/* 10 - 11 */
+			NdisMoveMemory(&pAd->ChannelList[index],
+				       &pAd->TxPower[BG_BAND_REGION_2_START],
+				       sizeof(struct rt_channel_tx_power) *
+				       BG_BAND_REGION_2_SIZE);
+			index += BG_BAND_REGION_2_SIZE;
+			break;
+		case REGION_3_BG_BAND:	/* 10 - 13 */
+			NdisMoveMemory(&pAd->ChannelList[index],
+				       &pAd->TxPower[BG_BAND_REGION_3_START],
+				       sizeof(struct rt_channel_tx_power) *
+				       BG_BAND_REGION_3_SIZE);
+			index += BG_BAND_REGION_3_SIZE;
+			break;
+		case REGION_4_BG_BAND:	/* 14 */
+			NdisMoveMemory(&pAd->ChannelList[index],
+				       &pAd->TxPower[BG_BAND_REGION_4_START],
+				       sizeof(struct rt_channel_tx_power) *
+				       BG_BAND_REGION_4_SIZE);
+			index += BG_BAND_REGION_4_SIZE;
+			break;
+		case REGION_5_BG_BAND:	/* 1 - 14 */
+			NdisMoveMemory(&pAd->ChannelList[index],
+				       &pAd->TxPower[BG_BAND_REGION_5_START],
+				       sizeof(struct rt_channel_tx_power) *
+				       BG_BAND_REGION_5_SIZE);
+			index += BG_BAND_REGION_5_SIZE;
+			break;
+		case REGION_6_BG_BAND:	/* 3 - 9 */
+			NdisMoveMemory(&pAd->ChannelList[index],
+				       &pAd->TxPower[BG_BAND_REGION_6_START],
+				       sizeof(struct rt_channel_tx_power) *
+				       BG_BAND_REGION_6_SIZE);
+			index += BG_BAND_REGION_6_SIZE;
+			break;
+		case REGION_7_BG_BAND:	/* 5 - 13 */
+			NdisMoveMemory(&pAd->ChannelList[index],
+				       &pAd->TxPower[BG_BAND_REGION_7_START],
+				       sizeof(struct rt_channel_tx_power) *
+				       BG_BAND_REGION_7_SIZE);
+			index += BG_BAND_REGION_7_SIZE;
+			break;
+		case REGION_31_BG_BAND:	/* 1 - 14 */
+			NdisMoveMemory(&pAd->ChannelList[index],
+				       &pAd->TxPower[BG_BAND_REGION_31_START],
+				       sizeof(struct rt_channel_tx_power) *
+				       BG_BAND_REGION_31_SIZE);
+			index += BG_BAND_REGION_31_SIZE;
+			break;
+		default:	/* Error. should never happen */
+			break;
 		}
-		for (i=0; i<index; i++)
+		for (i = 0; i < index; i++)
 			pAd->ChannelList[i].MaxTxPwr = 20;
 	}
 
-	if ((pAd->CommonCfg.PhyMode == PHY_11A) || (pAd->CommonCfg.PhyMode == PHY_11ABG_MIXED)
-		|| (pAd->CommonCfg.PhyMode == PHY_11ABGN_MIXED) || (pAd->CommonCfg.PhyMode == PHY_11AN_MIXED)
-		|| (pAd->CommonCfg.PhyMode == PHY_11AGN_MIXED) || (pAd->CommonCfg.PhyMode == PHY_11N_5G)
-	)
-	{
-		switch (pAd->CommonCfg.CountryRegionForABand & 0x7f)
-		{
-			case REGION_0_A_BAND:
-				num = sizeof(A_BAND_REGION_0_CHANNEL_LIST)/sizeof(UCHAR);
-				pChannelList = A_BAND_REGION_0_CHANNEL_LIST;
-				break;
-			case REGION_1_A_BAND:
-				num = sizeof(A_BAND_REGION_1_CHANNEL_LIST)/sizeof(UCHAR);
-				pChannelList = A_BAND_REGION_1_CHANNEL_LIST;
-				break;
-			case REGION_2_A_BAND:
-				num = sizeof(A_BAND_REGION_2_CHANNEL_LIST)/sizeof(UCHAR);
-				pChannelList = A_BAND_REGION_2_CHANNEL_LIST;
-				break;
-			case REGION_3_A_BAND:
-				num = sizeof(A_BAND_REGION_3_CHANNEL_LIST)/sizeof(UCHAR);
-				pChannelList = A_BAND_REGION_3_CHANNEL_LIST;
-				break;
-			case REGION_4_A_BAND:
-				num = sizeof(A_BAND_REGION_4_CHANNEL_LIST)/sizeof(UCHAR);
-				pChannelList = A_BAND_REGION_4_CHANNEL_LIST;
-				break;
-			case REGION_5_A_BAND:
-				num = sizeof(A_BAND_REGION_5_CHANNEL_LIST)/sizeof(UCHAR);
-				pChannelList = A_BAND_REGION_5_CHANNEL_LIST;
-				break;
-			case REGION_6_A_BAND:
-				num = sizeof(A_BAND_REGION_6_CHANNEL_LIST)/sizeof(UCHAR);
-				pChannelList = A_BAND_REGION_6_CHANNEL_LIST;
-				break;
-			case REGION_7_A_BAND:
-				num = sizeof(A_BAND_REGION_7_CHANNEL_LIST)/sizeof(UCHAR);
-				pChannelList = A_BAND_REGION_7_CHANNEL_LIST;
-				break;
-			case REGION_8_A_BAND:
-				num = sizeof(A_BAND_REGION_8_CHANNEL_LIST)/sizeof(UCHAR);
-				pChannelList = A_BAND_REGION_8_CHANNEL_LIST;
-				break;
-			case REGION_9_A_BAND:
-				num = sizeof(A_BAND_REGION_9_CHANNEL_LIST)/sizeof(UCHAR);
-				pChannelList = A_BAND_REGION_9_CHANNEL_LIST;
-				break;
-
-			case REGION_10_A_BAND:
-				num = sizeof(A_BAND_REGION_10_CHANNEL_LIST)/sizeof(UCHAR);
-				pChannelList = A_BAND_REGION_10_CHANNEL_LIST;
-				break;
-
-			case REGION_11_A_BAND:
-				num = sizeof(A_BAND_REGION_11_CHANNEL_LIST)/sizeof(UCHAR);
-				pChannelList = A_BAND_REGION_11_CHANNEL_LIST;
-				break;
-
-			default:            // Error. should never happen
-				DBGPRINT(RT_DEBUG_WARN,("countryregion=%d not support", pAd->CommonCfg.CountryRegionForABand));
-				break;
+	if ((pAd->CommonCfg.PhyMode == PHY_11A)
+	    || (pAd->CommonCfg.PhyMode == PHY_11ABG_MIXED)
+	    || (pAd->CommonCfg.PhyMode == PHY_11ABGN_MIXED)
+	    || (pAd->CommonCfg.PhyMode == PHY_11AN_MIXED)
+	    || (pAd->CommonCfg.PhyMode == PHY_11AGN_MIXED)
+	    || (pAd->CommonCfg.PhyMode == PHY_11N_5G)
+	    ) {
+		switch (pAd->CommonCfg.CountryRegionForABand & 0x7f) {
+		case REGION_0_A_BAND:
+			num =
+			    sizeof(A_BAND_REGION_0_CHANNEL_LIST) /
+			    sizeof(u8);
+			pChannelList = A_BAND_REGION_0_CHANNEL_LIST;
+			break;
+		case REGION_1_A_BAND:
+			num =
+			    sizeof(A_BAND_REGION_1_CHANNEL_LIST) /
+			    sizeof(u8);
+			pChannelList = A_BAND_REGION_1_CHANNEL_LIST;
+			break;
+		case REGION_2_A_BAND:
+			num =
+			    sizeof(A_BAND_REGION_2_CHANNEL_LIST) /
+			    sizeof(u8);
+			pChannelList = A_BAND_REGION_2_CHANNEL_LIST;
+			break;
+		case REGION_3_A_BAND:
+			num =
+			    sizeof(A_BAND_REGION_3_CHANNEL_LIST) /
+			    sizeof(u8);
+			pChannelList = A_BAND_REGION_3_CHANNEL_LIST;
+			break;
+		case REGION_4_A_BAND:
+			num =
+			    sizeof(A_BAND_REGION_4_CHANNEL_LIST) /
+			    sizeof(u8);
+			pChannelList = A_BAND_REGION_4_CHANNEL_LIST;
+			break;
+		case REGION_5_A_BAND:
+			num =
+			    sizeof(A_BAND_REGION_5_CHANNEL_LIST) /
+			    sizeof(u8);
+			pChannelList = A_BAND_REGION_5_CHANNEL_LIST;
+			break;
+		case REGION_6_A_BAND:
+			num =
+			    sizeof(A_BAND_REGION_6_CHANNEL_LIST) /
+			    sizeof(u8);
+			pChannelList = A_BAND_REGION_6_CHANNEL_LIST;
+			break;
+		case REGION_7_A_BAND:
+			num =
+			    sizeof(A_BAND_REGION_7_CHANNEL_LIST) /
+			    sizeof(u8);
+			pChannelList = A_BAND_REGION_7_CHANNEL_LIST;
+			break;
+		case REGION_8_A_BAND:
+			num =
+			    sizeof(A_BAND_REGION_8_CHANNEL_LIST) /
+			    sizeof(u8);
+			pChannelList = A_BAND_REGION_8_CHANNEL_LIST;
+			break;
+		case REGION_9_A_BAND:
+			num =
+			    sizeof(A_BAND_REGION_9_CHANNEL_LIST) /
+			    sizeof(u8);
+			pChannelList = A_BAND_REGION_9_CHANNEL_LIST;
+			break;
+
+		case REGION_10_A_BAND:
+			num =
+			    sizeof(A_BAND_REGION_10_CHANNEL_LIST) /
+			    sizeof(u8);
+			pChannelList = A_BAND_REGION_10_CHANNEL_LIST;
+			break;
+
+		case REGION_11_A_BAND:
+			num =
+			    sizeof(A_BAND_REGION_11_CHANNEL_LIST) /
+			    sizeof(u8);
+			pChannelList = A_BAND_REGION_11_CHANNEL_LIST;
+			break;
+		case REGION_12_A_BAND:
+			num =
+			    sizeof(A_BAND_REGION_12_CHANNEL_LIST) /
+			    sizeof(u8);
+			pChannelList = A_BAND_REGION_12_CHANNEL_LIST;
+			break;
+		case REGION_13_A_BAND:
+			num =
+			    sizeof(A_BAND_REGION_13_CHANNEL_LIST) /
+			    sizeof(u8);
+			pChannelList = A_BAND_REGION_13_CHANNEL_LIST;
+			break;
+		case REGION_14_A_BAND:
+			num =
+			    sizeof(A_BAND_REGION_14_CHANNEL_LIST) /
+			    sizeof(u8);
+			pChannelList = A_BAND_REGION_14_CHANNEL_LIST;
+			break;
+		case REGION_15_A_BAND:
+			num =
+			    sizeof(A_BAND_REGION_15_CHANNEL_LIST) /
+			    sizeof(u8);
+			pChannelList = A_BAND_REGION_15_CHANNEL_LIST;
+			break;
+		default:	/* Error. should never happen */
+			DBGPRINT(RT_DEBUG_WARN,
+				 ("countryregion=%d not support",
+				  pAd->CommonCfg.CountryRegionForABand));
+			break;
 		}
 
-		if (num != 0)
-		{
-			UCHAR RadarCh[15]={52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140};
-			for (i=0; i<num; i++)
-			{
-				for (j=0; j<MAX_NUM_OF_CHANNELS; j++)
-				{
-					if (pChannelList[i] == pAd->TxPower[j].Channel)
-						NdisMoveMemory(&pAd->ChannelList[index+i], &pAd->TxPower[j], sizeof(CHANNEL_TX_POWER));
-					}
-				for (j=0; j<15; j++)
-				{
+		if (num != 0) {
+			u8 RadarCh[15] =
+			    { 52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 124,
+		    128, 132, 136, 140 };
+			for (i = 0; i < num; i++) {
+				for (j = 0; j < MAX_NUM_OF_CHANNELS; j++) {
+					if (pChannelList[i] ==
+					    pAd->TxPower[j].Channel)
+						NdisMoveMemory(&pAd->
+							       ChannelList[index
+									   + i],
+							       &pAd->TxPower[j],
+							       sizeof
+							       (struct rt_channel_tx_power));
+				}
+				for (j = 0; j < 15; j++) {
 					if (pChannelList[i] == RadarCh[j])
-						pAd->ChannelList[index+i].DfsReq = TRUE;
+						pAd->ChannelList[index +
+								 i].DfsReq =
+						    TRUE;
 				}
-				pAd->ChannelList[index+i].MaxTxPwr = 20;
+				pAd->ChannelList[index + i].MaxTxPwr = 20;
 			}
 			index += num;
 		}
 	}
 
 	pAd->ChannelListNum = index;
-	DBGPRINT(RT_DEBUG_TRACE,("country code=%d/%d, RFIC=%d, PHY mode=%d, support %d channels\n",
-		pAd->CommonCfg.CountryRegion, pAd->CommonCfg.CountryRegionForABand, pAd->RfIcType, pAd->CommonCfg.PhyMode, pAd->ChannelListNum));
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("country code=%d/%d, RFIC=%d, PHY mode=%d, support %d channels\n",
+		  pAd->CommonCfg.CountryRegion,
+		  pAd->CommonCfg.CountryRegionForABand, pAd->RfIcType,
+		  pAd->CommonCfg.PhyMode, pAd->ChannelListNum));
 #ifdef DBG
-	for (i=0;i<pAd->ChannelListNum;i++)
-	{
-		DBGPRINT_RAW(RT_DEBUG_TRACE,("BuildChannel # %d :: Pwr0 = %d, Pwr1 =%d, \n ", pAd->ChannelList[i].Channel, pAd->ChannelList[i].Power, pAd->ChannelList[i].Power2));
+	for (i = 0; i < pAd->ChannelListNum; i++) {
+		DBGPRINT_RAW(RT_DEBUG_TRACE,
+			     ("BuildChannel # %d :: Pwr0 = %d, Pwr1 =%d, \n ",
+			      pAd->ChannelList[i].Channel,
+			      pAd->ChannelList[i].Power,
+			      pAd->ChannelList[i].Power2));
 	}
 #endif
 }
@@ -251,8 +359,7 @@ VOID BuildChannelList(
 
 	==========================================================================
  */
-UCHAR FirstChannel(
-	IN PRTMP_ADAPTER pAd)
+u8 FirstChannel(struct rt_rtmp_adapter *pAd)
 {
 	return pAd->ChannelList[0].Channel;
 }
@@ -268,19 +375,16 @@ UCHAR FirstChannel(
 		return 0 if no more next channel
 	==========================================================================
  */
-UCHAR NextChannel(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR channel)
+u8 NextChannel(struct rt_rtmp_adapter *pAd, u8 channel)
 {
 	int i;
-	UCHAR next_channel = 0;
+	u8 next_channel = 0;
 
 	for (i = 0; i < (pAd->ChannelListNum - 1); i++)
-		if (channel == pAd->ChannelList[i].Channel)
-		{
-			next_channel = pAd->ChannelList[i+1].Channel;
+		if (channel == pAd->ChannelList[i].Channel) {
+			next_channel = pAd->ChannelList[i + 1].Channel;
 			break;
-	}
+		}
 	return next_channel;
 }
 
@@ -304,16 +408,15 @@ UCHAR NextChannel(
 		the minimum value or next lower value.
 	==========================================================================
  */
-VOID ChangeToCellPowerLimit(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR         AironetCellPowerLimit)
+void ChangeToCellPowerLimit(struct rt_rtmp_adapter *pAd,
+			    u8 AironetCellPowerLimit)
 {
-	//valud 0xFF means that hasn't found power limit information
-	//from the AP's Beacon/Probe response.
+	/*valud 0xFF means that hasn't found power limit information */
+	/*from the AP's Beacon/Probe response. */
 	if (AironetCellPowerLimit == 0xFF)
 		return;
 
-	if (AironetCellPowerLimit < 6) //Used Lowest Power Percentage.
+	if (AironetCellPowerLimit < 6)	/*Used Lowest Power Percentage. */
 		pAd->CommonCfg.TxPowerPercentage = 6;
 	else if (AironetCellPowerLimit < 9)
 		pAd->CommonCfg.TxPowerPercentage = 10;
@@ -324,45 +427,40 @@ VOID ChangeToCellPowerLimit(
 	else if (AironetCellPowerLimit < 15)
 		pAd->CommonCfg.TxPowerPercentage = 75;
 	else
-		pAd->CommonCfg.TxPowerPercentage = 100; //else used maximum
+		pAd->CommonCfg.TxPowerPercentage = 100;	/*else used maximum */
 
 	if (pAd->CommonCfg.TxPowerPercentage > pAd->CommonCfg.TxPowerDefault)
-		pAd->CommonCfg.TxPowerPercentage = pAd->CommonCfg.TxPowerDefault;
+		pAd->CommonCfg.TxPowerPercentage =
+		    pAd->CommonCfg.TxPowerDefault;
 
 }
 
-CHAR	ConvertToRssi(
-	IN PRTMP_ADAPTER pAd,
-	IN	CHAR			Rssi,
-	IN  UCHAR   RssiNumber)
+char ConvertToRssi(struct rt_rtmp_adapter *pAd, char Rssi, u8 RssiNumber)
 {
-	UCHAR	RssiOffset, LNAGain;
+	u8 RssiOffset, LNAGain;
 
-	// Rssi equals to zero should be an invalid value
+	/* Rssi equals to zero should be an invalid value */
 	if (Rssi == 0)
 		return -99;
 
 	LNAGain = GET_LNA_GAIN(pAd);
-    if (pAd->LatchRfRegs.Channel > 14)
-    {
-        if (RssiNumber == 0)
+	if (pAd->LatchRfRegs.Channel > 14) {
+		if (RssiNumber == 0)
 			RssiOffset = pAd->ARssiOffset0;
 		else if (RssiNumber == 1)
 			RssiOffset = pAd->ARssiOffset1;
 		else
 			RssiOffset = pAd->ARssiOffset2;
-    }
-    else
-    {
-        if (RssiNumber == 0)
+	} else {
+		if (RssiNumber == 0)
 			RssiOffset = pAd->BGRssiOffset0;
 		else if (RssiNumber == 1)
 			RssiOffset = pAd->BGRssiOffset1;
 		else
 			RssiOffset = pAd->BGRssiOffset2;
-    }
+	}
 
-    return (-12 - RssiOffset - LNAGain - Rssi);
+	return (-12 - RssiOffset - LNAGain - Rssi);
 }
 
 /*
@@ -371,63 +469,75 @@ CHAR	ConvertToRssi(
 		Scan next channel
 	==========================================================================
  */
-VOID ScanNextChannel(
-	IN PRTMP_ADAPTER pAd)
+void ScanNextChannel(struct rt_rtmp_adapter *pAd)
 {
-	HEADER_802_11   Hdr80211;
-	PUCHAR          pOutBuffer = NULL;
-	NDIS_STATUS     NStatus;
-	ULONG           FrameLen = 0;
-	UCHAR           SsidLen = 0, ScanType = pAd->MlmeAux.ScanType, BBPValue = 0;
-	USHORT          Status;
-	PHEADER_802_11  pHdr80211;
-	UINT			ScanTimeIn5gChannel = SHORT_CHANNEL_TIME;
-
-	if (MONITOR_ON(pAd))
-		return;
+	struct rt_header_802_11 Hdr80211;
+	u8 *pOutBuffer = NULL;
+	int NStatus;
+	unsigned long FrameLen = 0;
+	u8 SsidLen = 0, ScanType = pAd->MlmeAux.ScanType, BBPValue = 0;
+	u16 Status;
+	struct rt_header_802_11 * pHdr80211;
+	u32 ScanTimeIn5gChannel = SHORT_CHANNEL_TIME;
 
-	if (pAd->MlmeAux.Channel == 0)
 	{
+		if (MONITOR_ON(pAd))
+			return;
+	}
+
+	if (pAd->MlmeAux.Channel == 0) {
 		if ((pAd->CommonCfg.BBPCurrentBW == BW_40)
-			&& (INFRA_ON(pAd)
-				|| (pAd->OpMode == OPMODE_AP))
-			)
-		{
-			AsicSwitchChannel(pAd, pAd->CommonCfg.CentralChannel, FALSE);
+		    && (INFRA_ON(pAd)
+			|| (pAd->OpMode == OPMODE_AP))
+		    ) {
+			AsicSwitchChannel(pAd, pAd->CommonCfg.CentralChannel,
+					  FALSE);
 			AsicLockChannel(pAd, pAd->CommonCfg.CentralChannel);
 			RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R4, &BBPValue);
 			BBPValue &= (~0x18);
 			BBPValue |= 0x10;
 			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R4, BBPValue);
-			DBGPRINT(RT_DEBUG_TRACE, ("SYNC - End of SCAN, restore to 40MHz channel %d, Total BSS[%02d]\n",pAd->CommonCfg.CentralChannel, pAd->ScanTab.BssNr));
-		}
-		else
-		{
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("SYNC - End of SCAN, restore to 40MHz channel %d, Total BSS[%02d]\n",
+				  pAd->CommonCfg.CentralChannel,
+				  pAd->ScanTab.BssNr));
+		} else {
 			AsicSwitchChannel(pAd, pAd->CommonCfg.Channel, FALSE);
 			AsicLockChannel(pAd, pAd->CommonCfg.Channel);
-			DBGPRINT(RT_DEBUG_TRACE, ("SYNC - End of SCAN, restore to channel %d, Total BSS[%02d]\n",pAd->CommonCfg.Channel, pAd->ScanTab.BssNr));
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("SYNC - End of SCAN, restore to channel %d, Total BSS[%02d]\n",
+				  pAd->CommonCfg.Channel, pAd->ScanTab.BssNr));
 		}
 
 		{
-			//
-			// To prevent data lost.
-			// Send an NULL data with turned PSM bit on to current associated AP before SCAN progress.
-			// Now, we need to send an NULL data with turned PSM bit off to AP, when scan progress done
-			//
-			if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED) && (INFRA_ON(pAd)))
-			{
-				NStatus = MlmeAllocateMemory(pAd, (PVOID)&pOutBuffer);
-				if (NStatus	== NDIS_STATUS_SUCCESS)
-				{
-					pHdr80211 = (PHEADER_802_11) pOutBuffer;
-					MgtMacHeaderInit(pAd, pHdr80211, SUBTYPE_NULL_FUNC, 1, pAd->CommonCfg.Bssid, pAd->CommonCfg.Bssid);
+			/* */
+			/* To prevent data lost. */
+			/* Send an NULL data with turned PSM bit on to current associated AP before SCAN progress. */
+			/* Now, we need to send an NULL data with turned PSM bit off to AP, when scan progress done */
+			/* */
+			if (OPSTATUS_TEST_FLAG
+			    (pAd, fOP_STATUS_MEDIA_STATE_CONNECTED)
+			    && (INFRA_ON(pAd))) {
+				NStatus =
+				    MlmeAllocateMemory(pAd,
+						       (void *)& pOutBuffer);
+				if (NStatus == NDIS_STATUS_SUCCESS) {
+					pHdr80211 = (struct rt_header_802_11 *) pOutBuffer;
+					MgtMacHeaderInit(pAd, pHdr80211,
+							 SUBTYPE_NULL_FUNC, 1,
+							 pAd->CommonCfg.Bssid,
+							 pAd->CommonCfg.Bssid);
 					pHdr80211->Duration = 0;
 					pHdr80211->FC.Type = BTYPE_DATA;
-					pHdr80211->FC.PwrMgmt = (pAd->StaCfg.Psm == PWR_SAVE);
-
-					// Send using priority queue
-					MiniportMMRequest(pAd, 0, pOutBuffer, sizeof(HEADER_802_11));
-					DBGPRINT(RT_DEBUG_TRACE, ("MlmeScanReqAction -- Send PSM Data frame\n"));
+					pHdr80211->FC.PwrMgmt =
+					    (pAd->StaCfg.Psm == PWR_SAVE);
+
+					/* Send using priority queue */
+					MiniportMMRequest(pAd, 0, pOutBuffer,
+							  sizeof
+							  (struct rt_header_802_11));
+					DBGPRINT(RT_DEBUG_TRACE,
+						 ("MlmeScanReqAction -- Send PSM Data frame\n"));
 					MlmeFreeMemory(pAd, pOutBuffer);
 					RTMPusecDelay(5000);
 				}
@@ -435,155 +545,148 @@ VOID ScanNextChannel(
 
 			pAd->Mlme.SyncMachine.CurrState = SYNC_IDLE;
 			Status = MLME_SUCCESS;
-			MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_SCAN_CONF, 2, &Status);
+			MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_SCAN_CONF,
+				    2, &Status);
 		}
 
 		RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS);
 	}
-#ifdef RT2870
-	else if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST) && (pAd->OpMode == OPMODE_STA))
-	{
+#ifdef RTMP_MAC_USB
+	else if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)
+		 && (pAd->OpMode == OPMODE_STA)) {
 		pAd->Mlme.SyncMachine.CurrState = SYNC_IDLE;
 		MlmeCntlConfirm(pAd, MT2_SCAN_CONF, MLME_FAIL_NO_RESOURCE);
 	}
-#endif // RT2870 //
-	else
-	{
+#endif /* RTMP_MAC_USB // */
+	else {
 		{
-		// BBP and RF are not accessible in PS mode, we has to wake them up first
-		if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE))
-#ifdef RT2860
-				AsicForceWakeup(pAd, FROM_TX);
-#endif
-#ifdef RT2870
-			AsicForceWakeup(pAd, TRUE);
-#endif
-			// leave PSM during scanning. otherwise we may lost ProbeRsp & BEACON
+			/* BBP and RF are not accessible in PS mode, we has to wake them up first */
+			if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE))
+				AsicForceWakeup(pAd, TRUE);
+
+			/* leave PSM during scanning. otherwise we may lost ProbeRsp & BEACON */
 			if (pAd->StaCfg.Psm == PWR_SAVE)
-				MlmeSetPsmBit(pAd, PWR_ACTIVE);
+				RTMP_SET_PSM_BIT(pAd, PWR_ACTIVE);
 		}
 
 		AsicSwitchChannel(pAd, pAd->MlmeAux.Channel, TRUE);
 		AsicLockChannel(pAd, pAd->MlmeAux.Channel);
 
 		{
-			if (pAd->MlmeAux.Channel > 14)
-			{
-				if ((pAd->CommonCfg.bIEEE80211H == 1) && RadarChannelCheck(pAd, pAd->MlmeAux.Channel))
-				{
+			if (pAd->MlmeAux.Channel > 14) {
+				if ((pAd->CommonCfg.bIEEE80211H == 1)
+				    && RadarChannelCheck(pAd,
+							 pAd->MlmeAux.
+							 Channel)) {
 					ScanType = SCAN_PASSIVE;
 					ScanTimeIn5gChannel = MIN_CHANNEL_TIME;
 				}
 			}
 		}
 
-		//Global country domain(ch1-11:active scan, ch12-14 passive scan)
-		if ((pAd->MlmeAux.Channel <= 14) && (pAd->MlmeAux.Channel >= 12) && ((pAd->CommonCfg.CountryRegion & 0x7f) == REGION_31_BG_BAND))
-		{
+		/*Global country domain(ch1-11:active scan, ch12-14 passive scan) */
+		if ((pAd->MlmeAux.Channel <= 14) && (pAd->MlmeAux.Channel >= 12)
+		    && ((pAd->CommonCfg.CountryRegion & 0x7f) ==
+			REGION_31_BG_BAND)) {
 			ScanType = SCAN_PASSIVE;
 		}
-
-		// We need to shorten active scan time in order for WZC connect issue
-		// Chnage the channel scan time for CISCO stuff based on its IAPP announcement
+		/* We need to shorten active scan time in order for WZC connect issue */
+		/* Chnage the channel scan time for CISCO stuff based on its IAPP announcement */
 		if (ScanType == FAST_SCAN_ACTIVE)
-			RTMPSetTimer(&pAd->MlmeAux.ScanTimer, FAST_ACTIVE_SCAN_TIME);
-		else if (((ScanType == SCAN_CISCO_ACTIVE) ||
-				(ScanType == SCAN_CISCO_PASSIVE) ||
-				(ScanType == SCAN_CISCO_CHANNEL_LOAD) ||
-				(ScanType == SCAN_CISCO_NOISE)) && (pAd->OpMode == OPMODE_STA))
-		{
-			if (pAd->StaCfg.CCXScanTime < 25)
-				RTMPSetTimer(&pAd->MlmeAux.ScanTimer, pAd->StaCfg.CCXScanTime * 2);
-			else
-				RTMPSetTimer(&pAd->MlmeAux.ScanTimer, pAd->StaCfg.CCXScanTime);
-		}
-		else // must be SCAN_PASSIVE or SCAN_ACTIVE
+			RTMPSetTimer(&pAd->MlmeAux.ScanTimer,
+				     FAST_ACTIVE_SCAN_TIME);
+		else		/* must be SCAN_PASSIVE or SCAN_ACTIVE */
 		{
 			if ((pAd->CommonCfg.PhyMode == PHY_11ABG_MIXED)
-				|| (pAd->CommonCfg.PhyMode == PHY_11ABGN_MIXED) || (pAd->CommonCfg.PhyMode == PHY_11AGN_MIXED)
-			)
-			{
+			    || (pAd->CommonCfg.PhyMode == PHY_11ABGN_MIXED)
+			    || (pAd->CommonCfg.PhyMode == PHY_11AGN_MIXED)
+			    ) {
 				if (pAd->MlmeAux.Channel > 14)
-					RTMPSetTimer(&pAd->MlmeAux.ScanTimer, ScanTimeIn5gChannel);
+					RTMPSetTimer(&pAd->MlmeAux.ScanTimer,
+						     ScanTimeIn5gChannel);
 				else
-				RTMPSetTimer(&pAd->MlmeAux.ScanTimer, MIN_CHANNEL_TIME);
-			}
-			else
-				RTMPSetTimer(&pAd->MlmeAux.ScanTimer, MAX_CHANNEL_TIME);
+					RTMPSetTimer(&pAd->MlmeAux.ScanTimer,
+						     MIN_CHANNEL_TIME);
+			} else
+				RTMPSetTimer(&pAd->MlmeAux.ScanTimer,
+					     MAX_CHANNEL_TIME);
 		}
 
-		if ((ScanType == SCAN_ACTIVE) || (ScanType == FAST_SCAN_ACTIVE) ||
-			(ScanType == SCAN_CISCO_ACTIVE))
-		{
-			NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);  //Get an unused nonpaged memory
-			if (NStatus != NDIS_STATUS_SUCCESS)
-			{
-				DBGPRINT(RT_DEBUG_TRACE, ("SYNC - ScanNextChannel() allocate memory fail\n"));
+		if ((ScanType == SCAN_ACTIVE)
+		    || (ScanType == FAST_SCAN_ACTIVE)
+		    ) {
+			NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);	/*Get an unused nonpaged memory */
+			if (NStatus != NDIS_STATUS_SUCCESS) {
+				DBGPRINT(RT_DEBUG_TRACE,
+					 ("SYNC - ScanNextChannel() allocate memory fail\n"));
 
 				{
-					pAd->Mlme.SyncMachine.CurrState = SYNC_IDLE;
+					pAd->Mlme.SyncMachine.CurrState =
+					    SYNC_IDLE;
 					Status = MLME_FAIL_NO_RESOURCE;
-					MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_SCAN_CONF, 2, &Status);
+					MlmeEnqueue(pAd,
+						    MLME_CNTL_STATE_MACHINE,
+						    MT2_SCAN_CONF, 2, &Status);
 				}
 
 				return;
 			}
-
-			// There is no need to send broadcast probe request if active scan is in effect.
-			if ((ScanType == SCAN_ACTIVE) || (ScanType == FAST_SCAN_ACTIVE)
-				)
+			/* There is no need to send broadcast probe request if active scan is in effect. */
+			if ((ScanType == SCAN_ACTIVE)
+			    || (ScanType == FAST_SCAN_ACTIVE)
+			    )
 				SsidLen = pAd->MlmeAux.SsidLen;
 			else
 				SsidLen = 0;
 
-			MgtMacHeaderInit(pAd, &Hdr80211, SUBTYPE_PROBE_REQ, 0, BROADCAST_ADDR, BROADCAST_ADDR);
-			MakeOutgoingFrame(pOutBuffer,               &FrameLen,
-							  sizeof(HEADER_802_11),    &Hdr80211,
-							  1,                        &SsidIe,
-							  1,                        &SsidLen,
-							  SsidLen,			        pAd->MlmeAux.Ssid,
-							  1,                        &SupRateIe,
-							  1,                        &pAd->CommonCfg.SupRateLen,
-							  pAd->CommonCfg.SupRateLen,  pAd->CommonCfg.SupRate,
-							  END_OF_ARGS);
-
-			if (pAd->CommonCfg.ExtRateLen)
-			{
-				ULONG Tmp;
-				MakeOutgoingFrame(pOutBuffer + FrameLen,            &Tmp,
-								  1,                                &ExtRateIe,
-								  1,                                &pAd->CommonCfg.ExtRateLen,
-								  pAd->CommonCfg.ExtRateLen,          pAd->CommonCfg.ExtRate,
-								  END_OF_ARGS);
+			MgtMacHeaderInit(pAd, &Hdr80211, SUBTYPE_PROBE_REQ, 0,
+					 BROADCAST_ADDR, BROADCAST_ADDR);
+			MakeOutgoingFrame(pOutBuffer, &FrameLen,
+					  sizeof(struct rt_header_802_11), &Hdr80211, 1,
+					  &SsidIe, 1, &SsidLen, SsidLen,
+					  pAd->MlmeAux.Ssid, 1, &SupRateIe, 1,
+					  &pAd->CommonCfg.SupRateLen,
+					  pAd->CommonCfg.SupRateLen,
+					  pAd->CommonCfg.SupRate, END_OF_ARGS);
+
+			if (pAd->CommonCfg.ExtRateLen) {
+				unsigned long Tmp;
+				MakeOutgoingFrame(pOutBuffer + FrameLen, &Tmp,
+						  1, &ExtRateIe,
+						  1, &pAd->CommonCfg.ExtRateLen,
+						  pAd->CommonCfg.ExtRateLen,
+						  pAd->CommonCfg.ExtRate,
+						  END_OF_ARGS);
 				FrameLen += Tmp;
 			}
 
-			if (pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED)
-			{
-				ULONG	Tmp;
-				UCHAR	HtLen;
-				UCHAR	BROADCOM[4] = {0x0, 0x90, 0x4c, 0x33};
-
-				if (pAd->bBroadComHT == TRUE)
-				{
-					HtLen = pAd->MlmeAux.HtCapabilityLen + 4;
-
-					MakeOutgoingFrame(pOutBuffer + FrameLen,          &Tmp,
-									1,                                &WpaIe,
-									1,                                &HtLen,
-									4,                                &BROADCOM[0],
-									pAd->MlmeAux.HtCapabilityLen,     &pAd->MlmeAux.HtCapability,
-									END_OF_ARGS);
-				}
-				else
-				{
+			if (pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED) {
+				unsigned long Tmp;
+				u8 HtLen;
+				u8 BROADCOM[4] = { 0x0, 0x90, 0x4c, 0x33 };
+
+				if (pAd->bBroadComHT == TRUE) {
+					HtLen =
+					    pAd->MlmeAux.HtCapabilityLen + 4;
+
+					MakeOutgoingFrame(pOutBuffer + FrameLen,
+							  &Tmp, 1, &WpaIe, 1,
+							  &HtLen, 4,
+							  &BROADCOM[0],
+							  pAd->MlmeAux.
+							  HtCapabilityLen,
+							  &pAd->MlmeAux.
+							  HtCapability,
+							  END_OF_ARGS);
+				} else {
 					HtLen = pAd->MlmeAux.HtCapabilityLen;
 
-					MakeOutgoingFrame(pOutBuffer + FrameLen,          &Tmp,
-									1,                                &HtCapIe,
-									1,                                &HtLen,
-									HtLen,                            &pAd->CommonCfg.HtCapability,
-									END_OF_ARGS);
+					MakeOutgoingFrame(pOutBuffer + FrameLen,
+							  &Tmp, 1, &HtCapIe, 1,
+							  &HtLen, HtLen,
+							  &pAd->CommonCfg.
+							  HtCapability,
+							  END_OF_ARGS);
 				}
 				FrameLen += Tmp;
 			}
@@ -591,22 +694,18 @@ VOID ScanNextChannel(
 			MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
 			MlmeFreeMemory(pAd, pOutBuffer);
 		}
-
-		// For SCAN_CISCO_PASSIVE, do nothing and silently wait for beacon or other probe reponse
+		/* For SCAN_CISCO_PASSIVE, do nothing and silently wait for beacon or other probe reponse */
 
 		pAd->Mlme.SyncMachine.CurrState = SCAN_LISTEN;
 	}
 }
 
-VOID MgtProbReqMacHeaderInit(
-	IN	PRTMP_ADAPTER	pAd,
-	IN OUT PHEADER_802_11 pHdr80211,
-	IN UCHAR SubType,
-	IN UCHAR ToDs,
-	IN PUCHAR pDA,
-	IN PUCHAR pBssid)
+void MgtProbReqMacHeaderInit(struct rt_rtmp_adapter *pAd,
+			     struct rt_header_802_11 * pHdr80211,
+			     u8 SubType,
+			     u8 ToDs, u8 *pDA, u8 *pBssid)
 {
-	NdisZeroMemory(pHdr80211, sizeof(HEADER_802_11));
+	NdisZeroMemory(pHdr80211, sizeof(struct rt_header_802_11));
 
 	pHdr80211->FC.Type = BTYPE_MGMT;
 	pHdr80211->FC.SubType = SubType;
@@ -617,5 +716,3 @@ VOID MgtProbReqMacHeaderInit(
 	COPY_MAC_ADDR(pHdr80211->Addr2, pAd->CurrentAddress);
 	COPY_MAC_ADDR(pHdr80211->Addr3, pBssid);
 }
-
-
diff --git a/drivers/staging/rt2860/common/cmm_tkip.c b/drivers/staging/rt2860/common/cmm_tkip.c
new file mode 100644
index 000000000000..4881ef9ba022
--- /dev/null
+++ b/drivers/staging/rt2860/common/cmm_tkip.c
@@ -0,0 +1,833 @@
+/*
+ *************************************************************************
+ * Ralink Tech Inc.
+ * 5F., No.36, Taiyuan St., Jhubei City,
+ * Hsinchu County 302,
+ * Taiwan, R.O.C.
+ *
+ * (c) Copyright 2002-2007, Ralink Technology, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify  *
+ * it under the terms of the GNU General Public License as published by  *
+ * the Free Software Foundation; either version 2 of the License, or     *
+ * (at your option) any later version.                                   *
+ *                                                                       *
+ * This program is distributed in the hope that it will be useful,       *
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
+ * GNU General Public License for more details.                          *
+ *                                                                       *
+ * You should have received a copy of the GNU General Public License     *
+ * along with this program; if not, write to the                         *
+ * Free Software Foundation, Inc.,                                       *
+ * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
+ *                                                                       *
+ *************************************************************************
+
+	Module Name:
+	cmm_tkip.c
+
+	Abstract:
+
+	Revision History:
+	Who			When			What
+	--------	----------		----------------------------------------------
+	Paul Wu		02-25-02		Initial
+*/
+
+#include	"../rt_config.h"
+
+/* Rotation functions on 32 bit values */
+#define ROL32( A, n ) \
+	( ((A) << (n)) | ( ((A)>>(32-(n))) & ( (1UL << (n)) - 1 ) ) )
+#define ROR32( A, n ) ROL32( (A), 32-(n) )
+
+u32 Tkip_Sbox_Lower[256] = {
+	0xA5, 0x84, 0x99, 0x8D, 0x0D, 0xBD, 0xB1, 0x54,
+	0x50, 0x03, 0xA9, 0x7D, 0x19, 0x62, 0xE6, 0x9A,
+	0x45, 0x9D, 0x40, 0x87, 0x15, 0xEB, 0xC9, 0x0B,
+	0xEC, 0x67, 0xFD, 0xEA, 0xBF, 0xF7, 0x96, 0x5B,
+	0xC2, 0x1C, 0xAE, 0x6A, 0x5A, 0x41, 0x02, 0x4F,
+	0x5C, 0xF4, 0x34, 0x08, 0x93, 0x73, 0x53, 0x3F,
+	0x0C, 0x52, 0x65, 0x5E, 0x28, 0xA1, 0x0F, 0xB5,
+	0x09, 0x36, 0x9B, 0x3D, 0x26, 0x69, 0xCD, 0x9F,
+	0x1B, 0x9E, 0x74, 0x2E, 0x2D, 0xB2, 0xEE, 0xFB,
+	0xF6, 0x4D, 0x61, 0xCE, 0x7B, 0x3E, 0x71, 0x97,
+	0xF5, 0x68, 0x00, 0x2C, 0x60, 0x1F, 0xC8, 0xED,
+	0xBE, 0x46, 0xD9, 0x4B, 0xDE, 0xD4, 0xE8, 0x4A,
+	0x6B, 0x2A, 0xE5, 0x16, 0xC5, 0xD7, 0x55, 0x94,
+	0xCF, 0x10, 0x06, 0x81, 0xF0, 0x44, 0xBA, 0xE3,
+	0xF3, 0xFE, 0xC0, 0x8A, 0xAD, 0xBC, 0x48, 0x04,
+	0xDF, 0xC1, 0x75, 0x63, 0x30, 0x1A, 0x0E, 0x6D,
+	0x4C, 0x14, 0x35, 0x2F, 0xE1, 0xA2, 0xCC, 0x39,
+	0x57, 0xF2, 0x82, 0x47, 0xAC, 0xE7, 0x2B, 0x95,
+	0xA0, 0x98, 0xD1, 0x7F, 0x66, 0x7E, 0xAB, 0x83,
+	0xCA, 0x29, 0xD3, 0x3C, 0x79, 0xE2, 0x1D, 0x76,
+	0x3B, 0x56, 0x4E, 0x1E, 0xDB, 0x0A, 0x6C, 0xE4,
+	0x5D, 0x6E, 0xEF, 0xA6, 0xA8, 0xA4, 0x37, 0x8B,
+	0x32, 0x43, 0x59, 0xB7, 0x8C, 0x64, 0xD2, 0xE0,
+	0xB4, 0xFA, 0x07, 0x25, 0xAF, 0x8E, 0xE9, 0x18,
+	0xD5, 0x88, 0x6F, 0x72, 0x24, 0xF1, 0xC7, 0x51,
+	0x23, 0x7C, 0x9C, 0x21, 0xDD, 0xDC, 0x86, 0x85,
+	0x90, 0x42, 0xC4, 0xAA, 0xD8, 0x05, 0x01, 0x12,
+	0xA3, 0x5F, 0xF9, 0xD0, 0x91, 0x58, 0x27, 0xB9,
+	0x38, 0x13, 0xB3, 0x33, 0xBB, 0x70, 0x89, 0xA7,
+	0xB6, 0x22, 0x92, 0x20, 0x49, 0xFF, 0x78, 0x7A,
+	0x8F, 0xF8, 0x80, 0x17, 0xDA, 0x31, 0xC6, 0xB8,
+	0xC3, 0xB0, 0x77, 0x11, 0xCB, 0xFC, 0xD6, 0x3A
+};
+
+u32 Tkip_Sbox_Upper[256] = {
+	0xC6, 0xF8, 0xEE, 0xF6, 0xFF, 0xD6, 0xDE, 0x91,
+	0x60, 0x02, 0xCE, 0x56, 0xE7, 0xB5, 0x4D, 0xEC,
+	0x8F, 0x1F, 0x89, 0xFA, 0xEF, 0xB2, 0x8E, 0xFB,
+	0x41, 0xB3, 0x5F, 0x45, 0x23, 0x53, 0xE4, 0x9B,
+	0x75, 0xE1, 0x3D, 0x4C, 0x6C, 0x7E, 0xF5, 0x83,
+	0x68, 0x51, 0xD1, 0xF9, 0xE2, 0xAB, 0x62, 0x2A,
+	0x08, 0x95, 0x46, 0x9D, 0x30, 0x37, 0x0A, 0x2F,
+	0x0E, 0x24, 0x1B, 0xDF, 0xCD, 0x4E, 0x7F, 0xEA,
+	0x12, 0x1D, 0x58, 0x34, 0x36, 0xDC, 0xB4, 0x5B,
+	0xA4, 0x76, 0xB7, 0x7D, 0x52, 0xDD, 0x5E, 0x13,
+	0xA6, 0xB9, 0x00, 0xC1, 0x40, 0xE3, 0x79, 0xB6,
+	0xD4, 0x8D, 0x67, 0x72, 0x94, 0x98, 0xB0, 0x85,
+	0xBB, 0xC5, 0x4F, 0xED, 0x86, 0x9A, 0x66, 0x11,
+	0x8A, 0xE9, 0x04, 0xFE, 0xA0, 0x78, 0x25, 0x4B,
+	0xA2, 0x5D, 0x80, 0x05, 0x3F, 0x21, 0x70, 0xF1,
+	0x63, 0x77, 0xAF, 0x42, 0x20, 0xE5, 0xFD, 0xBF,
+	0x81, 0x18, 0x26, 0xC3, 0xBE, 0x35, 0x88, 0x2E,
+	0x93, 0x55, 0xFC, 0x7A, 0xC8, 0xBA, 0x32, 0xE6,
+	0xC0, 0x19, 0x9E, 0xA3, 0x44, 0x54, 0x3B, 0x0B,
+	0x8C, 0xC7, 0x6B, 0x28, 0xA7, 0xBC, 0x16, 0xAD,
+	0xDB, 0x64, 0x74, 0x14, 0x92, 0x0C, 0x48, 0xB8,
+	0x9F, 0xBD, 0x43, 0xC4, 0x39, 0x31, 0xD3, 0xF2,
+	0xD5, 0x8B, 0x6E, 0xDA, 0x01, 0xB1, 0x9C, 0x49,
+	0xD8, 0xAC, 0xF3, 0xCF, 0xCA, 0xF4, 0x47, 0x10,
+	0x6F, 0xF0, 0x4A, 0x5C, 0x38, 0x57, 0x73, 0x97,
+	0xCB, 0xA1, 0xE8, 0x3E, 0x96, 0x61, 0x0D, 0x0F,
+	0xE0, 0x7C, 0x71, 0xCC, 0x90, 0x06, 0xF7, 0x1C,
+	0xC2, 0x6A, 0xAE, 0x69, 0x17, 0x99, 0x3A, 0x27,
+	0xD9, 0xEB, 0x2B, 0x22, 0xD2, 0xA9, 0x07, 0x33,
+	0x2D, 0x3C, 0x15, 0xC9, 0x87, 0xAA, 0x50, 0xA5,
+	0x03, 0x59, 0x09, 0x1A, 0x65, 0xD7, 0x84, 0xD0,
+	0x82, 0x29, 0x5A, 0x1E, 0x7B, 0xA8, 0x6D, 0x2C
+};
+
+/* */
+/* Expanded IV for TKIP function. */
+/* */
+struct PACKED rt_tkip_iv {
+	union PACKED {
+		struct PACKED {
+			u8 rc0;
+			u8 rc1;
+			u8 rc2;
+
+			union PACKED {
+				struct PACKED {
+					u8 Rsvd:5;
+					u8 ExtIV:1;
+					u8 KeyID:2;
+				} field;
+				u8 Byte;
+			} CONTROL;
+		} field;
+
+		unsigned long word;
+	} IV16;
+
+	unsigned long IV32;
+};
+
+/*
+	========================================================================
+
+	Routine	Description:
+		Convert from u8[] to unsigned long in a portable way
+
+	Arguments:
+      pMICKey		pointer to MIC Key
+
+	Return Value:
+		None
+
+	Note:
+
+	========================================================================
+*/
+unsigned long RTMPTkipGetUInt32(u8 *pMICKey)
+{
+	unsigned long res = 0;
+	int i;
+
+	for (i = 0; i < 4; i++) {
+		res |= (*pMICKey++) << (8 * i);
+	}
+
+	return res;
+}
+
+/*
+	========================================================================
+
+	Routine	Description:
+		Convert from unsigned long to u8[] in a portable way
+
+	Arguments:
+      pDst			pointer to destination for convert unsigned long to u8[]
+      val			the value for convert
+
+	Return Value:
+		None
+
+	IRQL = DISPATCH_LEVEL
+
+	Note:
+
+	========================================================================
+*/
+void RTMPTkipPutUInt32(IN u8 *pDst, unsigned long val)
+{
+	int i;
+
+	for (i = 0; i < 4; i++) {
+		*pDst++ = (u8)(val & 0xff);
+		val >>= 8;
+	}
+}
+
+/*
+	========================================================================
+
+	Routine	Description:
+		Set the MIC Key.
+
+	Arguments:
+      pAd		Pointer to our adapter
+      pMICKey		pointer to MIC Key
+
+	Return Value:
+		None
+
+	IRQL = DISPATCH_LEVEL
+
+	Note:
+
+	========================================================================
+*/
+void RTMPTkipSetMICKey(struct rt_tkip_key_info *pTkip, u8 *pMICKey)
+{
+	/* Set the key */
+	pTkip->K0 = RTMPTkipGetUInt32(pMICKey);
+	pTkip->K1 = RTMPTkipGetUInt32(pMICKey + 4);
+	/* and reset the message */
+	pTkip->L = pTkip->K0;
+	pTkip->R = pTkip->K1;
+	pTkip->nBytesInM = 0;
+	pTkip->M = 0;
+}
+
+/*
+	========================================================================
+
+	Routine	Description:
+		Calculate the MIC Value.
+
+	Arguments:
+      pAd		Pointer to our adapter
+      uChar			Append this uChar
+
+	Return Value:
+		None
+
+	IRQL = DISPATCH_LEVEL
+
+	Note:
+
+	========================================================================
+*/
+void RTMPTkipAppendByte(struct rt_tkip_key_info *pTkip, u8 uChar)
+{
+	/* Append the byte to our word-sized buffer */
+	pTkip->M |= (uChar << (8 * pTkip->nBytesInM));
+	pTkip->nBytesInM++;
+	/* Process the word if it is full. */
+	if (pTkip->nBytesInM >= 4) {
+		pTkip->L ^= pTkip->M;
+		pTkip->R ^= ROL32(pTkip->L, 17);
+		pTkip->L += pTkip->R;
+		pTkip->R ^=
+		    ((pTkip->L & 0xff00ff00) >> 8) | ((pTkip->
+						       L & 0x00ff00ff) << 8);
+		pTkip->L += pTkip->R;
+		pTkip->R ^= ROL32(pTkip->L, 3);
+		pTkip->L += pTkip->R;
+		pTkip->R ^= ROR32(pTkip->L, 2);
+		pTkip->L += pTkip->R;
+		/* Clear the buffer */
+		pTkip->M = 0;
+		pTkip->nBytesInM = 0;
+	}
+}
+
+/*
+	========================================================================
+
+	Routine	Description:
+		Calculate the MIC Value.
+
+	Arguments:
+      pAd		Pointer to our adapter
+      pSrc			Pointer to source data for Calculate MIC Value
+      Len			Indicate the length of the source data
+
+	Return Value:
+		None
+
+	IRQL = DISPATCH_LEVEL
+
+	Note:
+
+	========================================================================
+*/
+void RTMPTkipAppend(struct rt_tkip_key_info *pTkip, u8 *pSrc, u32 nBytes)
+{
+	/* This is simple */
+	while (nBytes > 0) {
+		RTMPTkipAppendByte(pTkip, *pSrc++);
+		nBytes--;
+	}
+}
+
+/*
+	========================================================================
+
+	Routine	Description:
+		Get the MIC Value.
+
+	Arguments:
+      pAd		Pointer to our adapter
+
+	Return Value:
+		None
+
+	IRQL = DISPATCH_LEVEL
+
+	Note:
+		the MIC Value is store in pAd->PrivateInfo.MIC
+	========================================================================
+*/
+void RTMPTkipGetMIC(struct rt_tkip_key_info *pTkip)
+{
+	/* Append the minimum padding */
+	RTMPTkipAppendByte(pTkip, 0x5a);
+	RTMPTkipAppendByte(pTkip, 0);
+	RTMPTkipAppendByte(pTkip, 0);
+	RTMPTkipAppendByte(pTkip, 0);
+	RTMPTkipAppendByte(pTkip, 0);
+	/* and then zeroes until the length is a multiple of 4 */
+	while (pTkip->nBytesInM != 0) {
+		RTMPTkipAppendByte(pTkip, 0);
+	}
+	/* The appendByte function has already computed the result. */
+	RTMPTkipPutUInt32(pTkip->MIC, pTkip->L);
+	RTMPTkipPutUInt32(pTkip->MIC + 4, pTkip->R);
+}
+
+/*
+	========================================================================
+
+	Routine	Description:
+		Init Tkip function.
+
+	Arguments:
+      pAd		Pointer to our adapter
+		pTKey       Pointer to the Temporal Key (TK), TK shall be 128bits.
+		KeyId		TK Key ID
+		pTA			Pointer to transmitter address
+		pMICKey		pointer to MIC Key
+
+	Return Value:
+		None
+
+	IRQL = DISPATCH_LEVEL
+
+	Note:
+
+	========================================================================
+*/
+void RTMPInitTkipEngine(struct rt_rtmp_adapter *pAd,
+			u8 *pKey,
+			u8 KeyId,
+			u8 *pTA,
+			u8 *pMICKey,
+			u8 *pTSC, unsigned long *pIV16, unsigned long *pIV32)
+{
+	struct rt_tkip_iv tkipIv;
+
+	/* Prepare 8 bytes TKIP encapsulation for MPDU */
+	NdisZeroMemory(&tkipIv, sizeof(struct rt_tkip_iv));
+	tkipIv.IV16.field.rc0 = *(pTSC + 1);
+	tkipIv.IV16.field.rc1 = (tkipIv.IV16.field.rc0 | 0x20) & 0x7f;
+	tkipIv.IV16.field.rc2 = *pTSC;
+	tkipIv.IV16.field.CONTROL.field.ExtIV = 1;	/* 0: non-extended IV, 1: an extended IV */
+	tkipIv.IV16.field.CONTROL.field.KeyID = KeyId;
+/*      tkipIv.IV32 = *(unsigned long *)(pTSC + 2); */
+	NdisMoveMemory(&tkipIv.IV32, (pTSC + 2), 4);	/* Copy IV */
+
+	*pIV16 = tkipIv.IV16.word;
+	*pIV32 = tkipIv.IV32;
+}
+
+/*
+	========================================================================
+
+	Routine	Description:
+		Init MIC Value calculation function which include set MIC key &
+		calculate first 16 bytes (DA + SA + priority +  0)
+
+	Arguments:
+      pAd		Pointer to our adapter
+		pTKey       Pointer to the Temporal Key (TK), TK shall be 128bits.
+		pDA			Pointer to DA address
+		pSA			Pointer to SA address
+		pMICKey		pointer to MIC Key
+
+	Return Value:
+		None
+
+	Note:
+
+	========================================================================
+*/
+void RTMPInitMICEngine(struct rt_rtmp_adapter *pAd,
+		       u8 *pKey,
+		       u8 *pDA,
+		       u8 *pSA, u8 UserPriority, u8 *pMICKey)
+{
+	unsigned long Priority = UserPriority;
+
+	/* Init MIC value calculation */
+	RTMPTkipSetMICKey(&pAd->PrivateInfo.Tx, pMICKey);
+	/* DA */
+	RTMPTkipAppend(&pAd->PrivateInfo.Tx, pDA, MAC_ADDR_LEN);
+	/* SA */
+	RTMPTkipAppend(&pAd->PrivateInfo.Tx, pSA, MAC_ADDR_LEN);
+	/* Priority + 3 bytes of 0 */
+	RTMPTkipAppend(&pAd->PrivateInfo.Tx, (u8 *)& Priority, 4);
+}
+
+/*
+	========================================================================
+
+	Routine	Description:
+		Compare MIC value of received MSDU
+
+	Arguments:
+		pAd	Pointer to our adapter
+		pSrc        Pointer to the received Plain text data
+		pDA			Pointer to DA address
+		pSA			Pointer to SA address
+		pMICKey		pointer to MIC Key
+		Len         the length of the received plain text data exclude MIC value
+
+	Return Value:
+		TRUE        MIC value matched
+		FALSE       MIC value mismatched
+
+	IRQL = DISPATCH_LEVEL
+
+	Note:
+
+	========================================================================
+*/
+BOOLEAN RTMPTkipCompareMICValue(struct rt_rtmp_adapter *pAd,
+				u8 *pSrc,
+				u8 *pDA,
+				u8 *pSA,
+				u8 *pMICKey,
+				u8 UserPriority, u32 Len)
+{
+	u8 OldMic[8];
+	unsigned long Priority = UserPriority;
+
+	/* Init MIC value calculation */
+	RTMPTkipSetMICKey(&pAd->PrivateInfo.Rx, pMICKey);
+	/* DA */
+	RTMPTkipAppend(&pAd->PrivateInfo.Rx, pDA, MAC_ADDR_LEN);
+	/* SA */
+	RTMPTkipAppend(&pAd->PrivateInfo.Rx, pSA, MAC_ADDR_LEN);
+	/* Priority + 3 bytes of 0 */
+	RTMPTkipAppend(&pAd->PrivateInfo.Rx, (u8 *)& Priority, 4);
+
+	/* Calculate MIC value from plain text data */
+	RTMPTkipAppend(&pAd->PrivateInfo.Rx, pSrc, Len);
+
+	/* Get MIC valude from received frame */
+	NdisMoveMemory(OldMic, pSrc + Len, 8);
+
+	/* Get MIC value from decrypted plain data */
+	RTMPTkipGetMIC(&pAd->PrivateInfo.Rx);
+
+	/* Move MIC value from MSDU, this steps should move to data path. */
+	/* Since the MIC value might cross MPDUs. */
+	if (!NdisEqualMemory(pAd->PrivateInfo.Rx.MIC, OldMic, 8)) {
+		DBGPRINT_RAW(RT_DEBUG_ERROR, ("RTMPTkipCompareMICValue(): TKIP MIC Error !\n"));	/*MIC error. */
+
+		return (FALSE);
+	}
+	return (TRUE);
+}
+
+/*
+	========================================================================
+
+	Routine	Description:
+		Copy frame from waiting queue into relative ring buffer and set
+	appropriate ASIC register to kick hardware transmit function
+
+	Arguments:
+		pAd		Pointer	to our adapter
+		void *	Pointer to Ndis Packet for MIC calculation
+		pEncap			Pointer to LLC encap data
+		LenEncap		Total encap length, might be 0 which indicates no encap
+
+	Return Value:
+		None
+
+	IRQL = DISPATCH_LEVEL
+
+	Note:
+
+	========================================================================
+*/
+void RTMPCalculateMICValue(struct rt_rtmp_adapter *pAd,
+			   void *pPacket,
+			   u8 *pEncap,
+			   struct rt_cipher_key *pKey, u8 apidx)
+{
+	struct rt_packet_info PacketInfo;
+	u8 *pSrcBufVA;
+	u32 SrcBufLen;
+	u8 *pSrc;
+	u8 UserPriority;
+	u8 vlan_offset = 0;
+
+	RTMP_QueryPacketInfo(pPacket, &PacketInfo, &pSrcBufVA, &SrcBufLen);
+
+	UserPriority = RTMP_GET_PACKET_UP(pPacket);
+	pSrc = pSrcBufVA;
+
+	/* determine if this is a vlan packet */
+	if (((*(pSrc + 12) << 8) + *(pSrc + 13)) == 0x8100)
+		vlan_offset = 4;
+
+	{
+		RTMPInitMICEngine(pAd,
+				  pKey->Key,
+				  pSrc, pSrc + 6, UserPriority, pKey->TxMic);
+	}
+
+	if (pEncap != NULL) {
+		/* LLC encapsulation */
+		RTMPTkipAppend(&pAd->PrivateInfo.Tx, pEncap, 6);
+		/* Protocol Type */
+		RTMPTkipAppend(&pAd->PrivateInfo.Tx, pSrc + 12 + vlan_offset,
+			       2);
+	}
+	SrcBufLen -= (14 + vlan_offset);
+	pSrc += (14 + vlan_offset);
+	do {
+		if (SrcBufLen > 0) {
+			RTMPTkipAppend(&pAd->PrivateInfo.Tx, pSrc, SrcBufLen);
+		}
+
+		break;		/* No need handle next packet */
+
+	} while (TRUE);		/* End of copying payload */
+
+	/* Compute the final MIC Value */
+	RTMPTkipGetMIC(&pAd->PrivateInfo.Tx);
+}
+
+/************************************************************/
+/* tkip_sbox()																*/
+/* Returns a 16 bit value from a 64K entry table. The Table */
+/* is synthesized from two 256 entry byte wide tables.		*/
+/************************************************************/
+
+u32 tkip_sbox(u32 index)
+{
+	u32 index_low;
+	u32 index_high;
+	u32 left, right;
+
+	index_low = (index % 256);
+	index_high = ((index >> 8) % 256);
+
+	left = Tkip_Sbox_Lower[index_low] + (Tkip_Sbox_Upper[index_low] * 256);
+	right =
+	    Tkip_Sbox_Upper[index_high] + (Tkip_Sbox_Lower[index_high] * 256);
+
+	return (left ^ right);
+}
+
+u32 rotr1(u32 a)
+{
+	unsigned int b;
+
+	if ((a & 0x01) == 0x01) {
+		b = (a >> 1) | 0x8000;
+	} else {
+		b = (a >> 1) & 0x7fff;
+	}
+	b = b % 65536;
+	return b;
+}
+
+void RTMPTkipMixKey(u8 * key, u8 * ta, unsigned long pnl,	/* Least significant 16 bits of PN */
+		    unsigned long pnh,	/* Most significant 32 bits of PN */
+		    u8 * rc4key, u32 * p1k)
+{
+
+	u32 tsc0;
+	u32 tsc1;
+	u32 tsc2;
+
+	u32 ppk0;
+	u32 ppk1;
+	u32 ppk2;
+	u32 ppk3;
+	u32 ppk4;
+	u32 ppk5;
+
+	int i;
+	int j;
+
+	tsc0 = (unsigned int)((pnh >> 16) % 65536);	/* msb */
+	tsc1 = (unsigned int)(pnh % 65536);
+	tsc2 = (unsigned int)(pnl % 65536);	/* lsb */
+
+	/* Phase 1, step 1 */
+	p1k[0] = tsc1;
+	p1k[1] = tsc0;
+	p1k[2] = (u32)(ta[0] + (ta[1] * 256));
+	p1k[3] = (u32)(ta[2] + (ta[3] * 256));
+	p1k[4] = (u32)(ta[4] + (ta[5] * 256));
+
+	/* Phase 1, step 2 */
+	for (i = 0; i < 8; i++) {
+		j = 2 * (i & 1);
+		p1k[0] =
+		    (p1k[0] +
+		     tkip_sbox((p1k[4] ^ ((256 * key[1 + j]) + key[j])) %
+			       65536)) % 65536;
+		p1k[1] =
+		    (p1k[1] +
+		     tkip_sbox((p1k[0] ^ ((256 * key[5 + j]) + key[4 + j])) %
+			       65536)) % 65536;
+		p1k[2] =
+		    (p1k[2] +
+		     tkip_sbox((p1k[1] ^ ((256 * key[9 + j]) + key[8 + j])) %
+			       65536)) % 65536;
+		p1k[3] =
+		    (p1k[3] +
+		     tkip_sbox((p1k[2] ^ ((256 * key[13 + j]) + key[12 + j])) %
+			       65536)) % 65536;
+		p1k[4] =
+		    (p1k[4] +
+		     tkip_sbox((p1k[3] ^ (((256 * key[1 + j]) + key[j]))) %
+			       65536)) % 65536;
+		p1k[4] = (p1k[4] + i) % 65536;
+	}
+
+	/* Phase 2, Step 1 */
+	ppk0 = p1k[0];
+	ppk1 = p1k[1];
+	ppk2 = p1k[2];
+	ppk3 = p1k[3];
+	ppk4 = p1k[4];
+	ppk5 = (p1k[4] + tsc2) % 65536;
+
+	/* Phase2, Step 2 */
+	ppk0 = ppk0 + tkip_sbox((ppk5 ^ ((256 * key[1]) + key[0])) % 65536);
+	ppk1 = ppk1 + tkip_sbox((ppk0 ^ ((256 * key[3]) + key[2])) % 65536);
+	ppk2 = ppk2 + tkip_sbox((ppk1 ^ ((256 * key[5]) + key[4])) % 65536);
+	ppk3 = ppk3 + tkip_sbox((ppk2 ^ ((256 * key[7]) + key[6])) % 65536);
+	ppk4 = ppk4 + tkip_sbox((ppk3 ^ ((256 * key[9]) + key[8])) % 65536);
+	ppk5 = ppk5 + tkip_sbox((ppk4 ^ ((256 * key[11]) + key[10])) % 65536);
+
+	ppk0 = ppk0 + rotr1(ppk5 ^ ((256 * key[13]) + key[12]));
+	ppk1 = ppk1 + rotr1(ppk0 ^ ((256 * key[15]) + key[14]));
+	ppk2 = ppk2 + rotr1(ppk1);
+	ppk3 = ppk3 + rotr1(ppk2);
+	ppk4 = ppk4 + rotr1(ppk3);
+	ppk5 = ppk5 + rotr1(ppk4);
+
+	/* Phase 2, Step 3 */
+	/* Phase 2, Step 3 */
+
+	tsc0 = (unsigned int)((pnh >> 16) % 65536);	/* msb */
+	tsc1 = (unsigned int)(pnh % 65536);
+	tsc2 = (unsigned int)(pnl % 65536);	/* lsb */
+
+	rc4key[0] = (tsc2 >> 8) % 256;
+	rc4key[1] = (((tsc2 >> 8) % 256) | 0x20) & 0x7f;
+	rc4key[2] = tsc2 % 256;
+	rc4key[3] = ((ppk5 ^ ((256 * key[1]) + key[0])) >> 1) % 256;
+
+	rc4key[4] = ppk0 % 256;
+	rc4key[5] = (ppk0 >> 8) % 256;
+
+	rc4key[6] = ppk1 % 256;
+	rc4key[7] = (ppk1 >> 8) % 256;
+
+	rc4key[8] = ppk2 % 256;
+	rc4key[9] = (ppk2 >> 8) % 256;
+
+	rc4key[10] = ppk3 % 256;
+	rc4key[11] = (ppk3 >> 8) % 256;
+
+	rc4key[12] = ppk4 % 256;
+	rc4key[13] = (ppk4 >> 8) % 256;
+
+	rc4key[14] = ppk5 % 256;
+	rc4key[15] = (ppk5 >> 8) % 256;
+}
+
+/* */
+/* TRUE: Success! */
+/* FALSE: Decrypt Error! */
+/* */
+BOOLEAN RTMPSoftDecryptTKIP(struct rt_rtmp_adapter *pAd,
+			    u8 *pData,
+			    unsigned long DataByteCnt,
+			    u8 UserPriority, struct rt_cipher_key *pWpaKey)
+{
+	u8 KeyID;
+	u32 HeaderLen;
+	u8 fc0;
+	u8 fc1;
+	u16 fc;
+	u32 frame_type;
+	u32 frame_subtype;
+	u32 from_ds;
+	u32 to_ds;
+	int a4_exists;
+	int qc_exists;
+	u16 duration;
+	u16 seq_control;
+	u16 qos_control;
+	u8 TA[MAC_ADDR_LEN];
+	u8 DA[MAC_ADDR_LEN];
+	u8 SA[MAC_ADDR_LEN];
+	u8 RC4Key[16];
+	u32 p1k[5];		/*for mix_key; */
+	unsigned long pnl;		/* Least significant 16 bits of PN */
+	unsigned long pnh;		/* Most significant 32 bits of PN */
+	u32 num_blocks;
+	u32 payload_remainder;
+	struct rt_arcfourcontext ArcFourContext;
+	u32 crc32 = 0;
+	u32 trailfcs = 0;
+	u8 MIC[8];
+	u8 TrailMIC[8];
+
+	fc0 = *pData;
+	fc1 = *(pData + 1);
+
+	fc = *((u16 *)pData);
+
+	frame_type = ((fc0 >> 2) & 0x03);
+	frame_subtype = ((fc0 >> 4) & 0x0f);
+
+	from_ds = (fc1 & 0x2) >> 1;
+	to_ds = (fc1 & 0x1);
+
+	a4_exists = (from_ds & to_ds);
+	qc_exists = ((frame_subtype == 0x08) ||	/* Assumed QoS subtypes */
+		     (frame_subtype == 0x09) ||	/* Likely to change.    */
+		     (frame_subtype == 0x0a) || (frame_subtype == 0x0b)
+	    );
+
+	HeaderLen = 24;
+	if (a4_exists)
+		HeaderLen += 6;
+
+	KeyID = *((u8 *)(pData + HeaderLen + 3));
+	KeyID = KeyID >> 6;
+
+	if (pWpaKey[KeyID].KeyLen == 0) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("RTMPSoftDecryptTKIP failed!(KeyID[%d] Length can not be 0)\n",
+			  KeyID));
+		return FALSE;
+	}
+
+	duration = *((u16 *)(pData + 2));
+
+	seq_control = *((u16 *)(pData + 22));
+
+	if (qc_exists) {
+		if (a4_exists) {
+			qos_control = *((u16 *)(pData + 30));
+		} else {
+			qos_control = *((u16 *)(pData + 24));
+		}
+	}
+
+	if (to_ds == 0 && from_ds == 1) {
+		NdisMoveMemory(DA, pData + 4, MAC_ADDR_LEN);
+		NdisMoveMemory(SA, pData + 16, MAC_ADDR_LEN);
+		NdisMoveMemory(TA, pData + 10, MAC_ADDR_LEN);	/*BSSID */
+	} else if (to_ds == 0 && from_ds == 0) {
+		NdisMoveMemory(TA, pData + 10, MAC_ADDR_LEN);
+		NdisMoveMemory(DA, pData + 4, MAC_ADDR_LEN);
+		NdisMoveMemory(SA, pData + 10, MAC_ADDR_LEN);
+	} else if (to_ds == 1 && from_ds == 0) {
+		NdisMoveMemory(SA, pData + 10, MAC_ADDR_LEN);
+		NdisMoveMemory(TA, pData + 10, MAC_ADDR_LEN);
+		NdisMoveMemory(DA, pData + 16, MAC_ADDR_LEN);
+	} else if (to_ds == 1 && from_ds == 1) {
+		NdisMoveMemory(TA, pData + 10, MAC_ADDR_LEN);
+		NdisMoveMemory(DA, pData + 16, MAC_ADDR_LEN);
+		NdisMoveMemory(SA, pData + 22, MAC_ADDR_LEN);
+	}
+
+	num_blocks = (DataByteCnt - 16) / 16;
+	payload_remainder = (DataByteCnt - 16) % 16;
+
+	pnl = (*(pData + HeaderLen)) * 256 + *(pData + HeaderLen + 2);
+	pnh = *((unsigned long *)(pData + HeaderLen + 4));
+	pnh = cpu2le32(pnh);
+	RTMPTkipMixKey(pWpaKey[KeyID].Key, TA, pnl, pnh, RC4Key, p1k);
+
+	ARCFOUR_INIT(&ArcFourContext, RC4Key, 16);
+
+	ARCFOUR_DECRYPT(&ArcFourContext, pData + HeaderLen,
+			pData + HeaderLen + 8, DataByteCnt - HeaderLen - 8);
+	NdisMoveMemory(&trailfcs, pData + DataByteCnt - 8 - 4, 4);
+	crc32 = RTMP_CALC_FCS32(PPPINITFCS32, pData + HeaderLen, DataByteCnt - HeaderLen - 8 - 4);	/*Skip IV+EIV 8 bytes & Skip last 4 bytes(FCS). */
+	crc32 ^= 0xffffffff;	/* complement */
+
+	if (crc32 != cpu2le32(trailfcs)) {
+		DBGPRINT(RT_DEBUG_TRACE, ("RTMPSoftDecryptTKIP, WEP Data ICV Error !\n"));	/*ICV error. */
+
+		return (FALSE);
+	}
+
+	NdisMoveMemory(TrailMIC, pData + DataByteCnt - 8 - 8 - 4, 8);
+	RTMPInitMICEngine(pAd, pWpaKey[KeyID].Key, DA, SA, UserPriority,
+			  pWpaKey[KeyID].RxMic);
+	RTMPTkipAppend(&pAd->PrivateInfo.Tx, pData + HeaderLen,
+		       DataByteCnt - HeaderLen - 8 - 12);
+	RTMPTkipGetMIC(&pAd->PrivateInfo.Tx);
+	NdisMoveMemory(MIC, pAd->PrivateInfo.Tx.MIC, 8);
+
+	if (!NdisEqualMemory(MIC, TrailMIC, 8)) {
+		DBGPRINT(RT_DEBUG_ERROR, ("RTMPSoftDecryptTKIP, WEP Data MIC Error !\n"));	/*MIC error. */
+		/*RTMPReportMicError(pAd, &pWpaKey[KeyID]);     // marked by AlbertY @ 20060630 */
+		return (FALSE);
+	}
+	/*DBGPRINT(RT_DEBUG_TRACE, "RTMPSoftDecryptTKIP Decript done!\n"); */
+	return TRUE;
+}
diff --git a/drivers/staging/rt3090/common/cmm_wep.c b/drivers/staging/rt2860/common/cmm_wep.c
index d8ddfb245578..76f880cb39b0 100644
--- a/drivers/staging/rt3090/common/cmm_wep.c
+++ b/drivers/staging/rt2860/common/cmm_wep.c
@@ -35,11 +35,9 @@
 	Paul Wu		10-28-02		Initial
 */
 
-#include "../rt_config.h"
+#include	"../rt_config.h"
 
-
-UINT FCSTAB_32[256] =
-{
+u32 FCSTAB_32[256] = {
 	0x00000000, 0x77073096, 0xee0e612c, 0x990951ba,
 	0x076dc419, 0x706af48f, 0xe963a535, 0x9e6495a3,
 	0x0edb8832, 0x79dcb8a4, 0xe0d5e91e, 0x97d2d988,
@@ -107,7 +105,7 @@ UINT FCSTAB_32[256] =
 };
 
 /*
-UCHAR   WEPKEY[] = {
+u8   WEPKEY[] = {
 		//IV
 		0x00, 0x11, 0x22,
 		//WEP KEY
@@ -137,33 +135,31 @@ UCHAR   WEPKEY[] = {
 
 	========================================================================
 */
-VOID	RTMPInitWepEngine(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			pKey,
-	IN	UCHAR			KeyId,
-	IN	UCHAR			KeyLen,
-	IN OUT	PUCHAR		pDest)
+void RTMPInitWepEngine(struct rt_rtmp_adapter *pAd,
+		       u8 *pKey,
+		       u8 KeyId, u8 KeyLen, IN u8 *pDest)
 {
-	UINT i;
-	UCHAR   WEPKEY[] = {
-		//IV
+	u32 i;
+	u8 WEPKEY[] = {
+		/*IV */
 		0x00, 0x11, 0x22,
-		//WEP KEY
-		0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99, 0xAA, 0xBB, 0xCC
+		/*WEP KEY */
+		0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99,
+		    0xAA, 0xBB, 0xCC
 	};
 
-	pAd->PrivateInfo.FCSCRC32 = PPPINITFCS32;   //Init crc32.
+	pAd->PrivateInfo.FCSCRC32 = PPPINITFCS32;	/*Init crc32. */
 
-    {
+	{
 		NdisMoveMemory(WEPKEY + 3, pKey, KeyLen);
 
-        for(i = 0; i < 3; i++)
-			WEPKEY[i] = RandomByte(pAd);   //Call mlme RandomByte() function.
-		ARCFOUR_INIT(&pAd->PrivateInfo.WEPCONTEXT, WEPKEY, KeyLen + 3);  //INIT SBOX, KEYLEN+3(IV)
+		for (i = 0; i < 3; i++)
+			WEPKEY[i] = RandomByte(pAd);	/*Call mlme RandomByte() function. */
+		ARCFOUR_INIT(&pAd->PrivateInfo.WEPCONTEXT, WEPKEY, KeyLen + 3);	/*INIT SBOX, KEYLEN+3(IV) */
 
-		NdisMoveMemory(pDest, WEPKEY, 3);  //Append Init Vector
-    }
-	*(pDest+3) = (KeyId << 6);       //Append KEYID
+		NdisMoveMemory(pDest, WEPKEY, 3);	/*Append Init Vector */
+	}
+	*(pDest + 3) = (KeyId << 6);	/*Append KEYID */
 
 }
 
@@ -188,17 +184,14 @@ VOID	RTMPInitWepEngine(
 
 	========================================================================
 */
-VOID	RTMPEncryptData(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			pSrc,
-	IN	PUCHAR			pDest,
-	IN	UINT			Len)
+void RTMPEncryptData(struct rt_rtmp_adapter *pAd,
+		     u8 *pSrc, u8 *pDest, u32 Len)
 {
-	pAd->PrivateInfo.FCSCRC32 = RTMP_CALC_FCS32(pAd->PrivateInfo.FCSCRC32, pSrc, Len);
+	pAd->PrivateInfo.FCSCRC32 =
+	    RTMP_CALC_FCS32(pAd->PrivateInfo.FCSCRC32, pSrc, Len);
 	ARCFOUR_ENCRYPT(&pAd->PrivateInfo.WEPCONTEXT, pDest, pSrc, Len);
 }
 
-
 /*
 	========================================================================
 
@@ -218,40 +211,41 @@ VOID	RTMPEncryptData(
 
 	========================================================================
 */
-BOOLEAN	RTMPSoftDecryptWEP(
-	IN PRTMP_ADAPTER	pAd,
-	IN PUCHAR			pData,
-	IN ULONG			DataByteCnt,
-	IN PCIPHER_KEY		pGroupKey)
+BOOLEAN RTMPSoftDecryptWEP(struct rt_rtmp_adapter *pAd,
+			   u8 *pData,
+			   unsigned long DataByteCnt, struct rt_cipher_key *pGroupKey)
 {
-	UINT	trailfcs;
-	UINT    crc32;
-	UCHAR	KeyIdx;
-	UCHAR   WEPKEY[] = {
-		//IV
+	u32 trailfcs;
+	u32 crc32;
+	u8 KeyIdx;
+	u8 WEPKEY[] = {
+		/*IV */
 		0x00, 0x11, 0x22,
-		//WEP KEY
-		0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99, 0xAA, 0xBB, 0xCC
+		/*WEP KEY */
+		0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99,
+		    0xAA, 0xBB, 0xCC
 	};
-	UCHAR	*pPayload = (UCHAR *)pData + LENGTH_802_11;
-	ULONG	payload_len = DataByteCnt - LENGTH_802_11;
+	u8 *pPayload = (u8 *) pData + LENGTH_802_11;
+	unsigned long payload_len = DataByteCnt - LENGTH_802_11;
 
-	NdisMoveMemory(WEPKEY, pPayload, 3);    //Get WEP IV
+	NdisMoveMemory(WEPKEY, pPayload, 3);	/*Get WEP IV */
 
 	KeyIdx = (*(pPayload + 3) & 0xc0) >> 6;
 	if (pGroupKey[KeyIdx].KeyLen == 0)
 		return (FALSE);
 
-	NdisMoveMemory(WEPKEY + 3, pGroupKey[KeyIdx].Key, pGroupKey[KeyIdx].KeyLen);
-	ARCFOUR_INIT(&pAd->PrivateInfo.WEPCONTEXT, WEPKEY, pGroupKey[KeyIdx].KeyLen + 3);
-	ARCFOUR_DECRYPT(&pAd->PrivateInfo.WEPCONTEXT, pPayload, pPayload + 4, payload_len - 4);
+	NdisMoveMemory(WEPKEY + 3, pGroupKey[KeyIdx].Key,
+		       pGroupKey[KeyIdx].KeyLen);
+	ARCFOUR_INIT(&pAd->PrivateInfo.WEPCONTEXT, WEPKEY,
+		     pGroupKey[KeyIdx].KeyLen + 3);
+	ARCFOUR_DECRYPT(&pAd->PrivateInfo.WEPCONTEXT, pPayload, pPayload + 4,
+			payload_len - 4);
 	NdisMoveMemory(&trailfcs, pPayload + payload_len - 8, 4);
-	crc32 = RTMP_CALC_FCS32(PPPINITFCS32, pPayload, payload_len - 8);  //Skip last 4 bytes(FCS).
-	crc32 ^= 0xffffffff;             /* complement */
+	crc32 = RTMP_CALC_FCS32(PPPINITFCS32, pPayload, payload_len - 8);	/*Skip last 4 bytes(FCS). */
+	crc32 ^= 0xffffffff;	/* complement */
 
-    if(crc32 != cpu2le32(trailfcs))
-    {
-		DBGPRINT(RT_DEBUG_TRACE, ("! WEP Data CRC Error !\n"));	 //CRC error.
+	if (crc32 != cpu2le32(trailfcs)) {
+		DBGPRINT(RT_DEBUG_TRACE, ("WEP Data CRC Error!\n"));	/*CRC error. */
 		return (FALSE);
 	}
 	return (TRUE);
@@ -261,10 +255,10 @@ BOOLEAN	RTMPSoftDecryptWEP(
 	========================================================================
 
 	Routine	Description:
-		The Stream Cipher Encryption Algorithm "ARCFOUR" initialize
+		The Stream Cipher Encryption Algorithm "struct rt_arcfour" initialize
 
 	Arguments:
-	   Ctx         Pointer to ARCFOUR CONTEXT (SBOX)
+	   Ctx         Pointer to struct rt_arcfour CONTEXT (SBOX)
 		pKey        Pointer to the WEP KEY
 		KeyLen      Indicate the length fo the WEP KEY
 
@@ -277,26 +271,22 @@ BOOLEAN	RTMPSoftDecryptWEP(
 
 	========================================================================
 */
-VOID	ARCFOUR_INIT(
-	IN	PARCFOURCONTEXT	Ctx,
-	IN	PUCHAR			pKey,
-	IN	UINT			KeyLen)
+void ARCFOUR_INIT(struct rt_arcfourcontext *Ctx, u8 *pKey, u32 KeyLen)
 {
-	UCHAR	t, u;
-	UINT	keyindex;
-	UINT	stateindex;
-	PUCHAR	state;
-	UINT	counter;
+	u8 t, u;
+	u32 keyindex;
+	u32 stateindex;
+	u8 *state;
+	u32 counter;
 
 	state = Ctx->STATE;
 	Ctx->X = 0;
 	Ctx->Y = 0;
 	for (counter = 0; counter < 256; counter++)
-		state[counter] = (UCHAR)counter;
+		state[counter] = (u8)counter;
 	keyindex = 0;
 	stateindex = 0;
-	for (counter = 0; counter < 256; counter++)
-	{
+	for (counter = 0; counter < 256; counter++) {
 		t = state[counter];
 		stateindex = (stateindex + pKey[keyindex] + t) & 0xff;
 		u = state[stateindex];
@@ -311,37 +301,36 @@ VOID	ARCFOUR_INIT(
 	========================================================================
 
 	Routine	Description:
-		Get bytes from ARCFOUR CONTEXT (S-BOX)
+		Get bytes from struct rt_arcfour CONTEXT (S-BOX)
 
 	Arguments:
-	   Ctx         Pointer to ARCFOUR CONTEXT (SBOX)
+	   Ctx         Pointer to struct rt_arcfour CONTEXT (SBOX)
 
 	Return Value:
-	   UCHAR  - the value of the ARCFOUR CONTEXT (S-BOX)
+	   u8  - the value of the struct rt_arcfour CONTEXT (S-BOX)
 
 	Note:
 
 	========================================================================
 */
-UCHAR	ARCFOUR_BYTE(
-	IN	PARCFOURCONTEXT		Ctx)
+u8 ARCFOUR_BYTE(struct rt_arcfourcontext *Ctx)
 {
-  UINT x;
-  UINT y;
-  UCHAR sx, sy;
-  PUCHAR state;
-
-  state = Ctx->STATE;
-  x = (Ctx->X + 1) & 0xff;
-  sx = state[x];
-  y = (sx + Ctx->Y) & 0xff;
-  sy = state[y];
-  Ctx->X = x;
-  Ctx->Y = y;
-  state[y] = sx;
-  state[x] = sy;
-
-  return(state[(sx + sy) & 0xff]);
+	u32 x;
+	u32 y;
+	u8 sx, sy;
+	u8 *state;
+
+	state = Ctx->STATE;
+	x = (Ctx->X + 1) & 0xff;
+	sx = state[x];
+	y = (sx + Ctx->Y) & 0xff;
+	sy = state[y];
+	Ctx->X = x;
+	Ctx->Y = y;
+	state[y] = sx;
+	state[x] = sy;
+
+	return (state[(sx + sy) & 0xff]);
 
 }
 
@@ -352,7 +341,7 @@ UCHAR	ARCFOUR_BYTE(
 		The Stream Cipher Decryption Algorithm
 
 	Arguments:
-		Ctx         Pointer to ARCFOUR CONTEXT (SBOX)
+		Ctx         Pointer to struct rt_arcfour CONTEXT (SBOX)
 		pDest			Pointer to the Destination
 		pSrc        Pointer to the Source data
 		Len         Indicate the length of the Source data
@@ -364,13 +353,10 @@ UCHAR	ARCFOUR_BYTE(
 
 	========================================================================
 */
-VOID	ARCFOUR_DECRYPT(
-	IN	PARCFOURCONTEXT	Ctx,
-	IN	PUCHAR			pDest,
-	IN	PUCHAR			pSrc,
-	IN	UINT			Len)
+void ARCFOUR_DECRYPT(struct rt_arcfourcontext *Ctx,
+		     u8 *pDest, u8 *pSrc, u32 Len)
 {
-	UINT i;
+	u32 i;
 
 	for (i = 0; i < Len; i++)
 		pDest[i] = pSrc[i] ^ ARCFOUR_BYTE(Ctx);
@@ -383,7 +369,7 @@ VOID	ARCFOUR_DECRYPT(
 		The Stream Cipher Encryption Algorithm
 
 	Arguments:
-		Ctx         Pointer to ARCFOUR CONTEXT (SBOX)
+		Ctx         Pointer to struct rt_arcfour CONTEXT (SBOX)
 		pDest			Pointer to the Destination
 		pSrc        Pointer to the Source data
 		Len         Indicate the length of the Source dta
@@ -397,13 +383,10 @@ VOID	ARCFOUR_DECRYPT(
 
 	========================================================================
 */
-VOID	ARCFOUR_ENCRYPT(
-	IN	PARCFOURCONTEXT	Ctx,
-	IN	PUCHAR			pDest,
-	IN	PUCHAR			pSrc,
-	IN	UINT			Len)
+void ARCFOUR_ENCRYPT(struct rt_arcfourcontext *Ctx,
+		     u8 *pDest, u8 *pSrc, u32 Len)
 {
-	UINT i;
+	u32 i;
 
 	for (i = 0; i < Len; i++)
 		pDest[i] = pSrc[i] ^ ARCFOUR_BYTE(Ctx);
@@ -416,31 +399,26 @@ VOID	ARCFOUR_ENCRYPT(
 		The Stream Cipher Encryption Algorithm which conform to the special requirement to encrypt  GTK.
 
 	Arguments:
-		Ctx         Pointer to ARCFOUR CONTEXT (SBOX)
+		Ctx         Pointer to struct rt_arcfour CONTEXT (SBOX)
 		pDest			Pointer to the Destination
 		pSrc        Pointer to the Source data
 		Len         Indicate the length of the Source dta
 
-
 	========================================================================
 */
 
-VOID	WPAARCFOUR_ENCRYPT(
-	IN	PARCFOURCONTEXT	Ctx,
-	IN	PUCHAR			pDest,
-	IN	PUCHAR			pSrc,
-	IN	UINT			Len)
+void WPAARCFOUR_ENCRYPT(struct rt_arcfourcontext *Ctx,
+			u8 *pDest, u8 *pSrc, u32 Len)
 {
-	UINT i;
-        //discard first 256 bytes
+	u32 i;
+	/*discard first 256 bytes */
 	for (i = 0; i < 256; i++)
-            ARCFOUR_BYTE(Ctx);
+		ARCFOUR_BYTE(Ctx);
 
 	for (i = 0; i < Len; i++)
 		pDest[i] = pSrc[i] ^ ARCFOUR_BYTE(Ctx);
 }
 
-
 /*
 	========================================================================
 
@@ -453,7 +431,7 @@ VOID	WPAARCFOUR_ENCRYPT(
 		Len         the length of the data
 
 	Return Value:
-		UINT - FCS 32 bits
+		u32 - FCS 32 bits
 
 	IRQL = DISPATCH_LEVEL
 
@@ -461,18 +439,14 @@ VOID	WPAARCFOUR_ENCRYPT(
 
 	========================================================================
 */
-UINT	RTMP_CALC_FCS32(
-	IN	UINT	Fcs,
-	IN	PUCHAR	Cp,
-	IN	INT		Len)
+u32 RTMP_CALC_FCS32(u32 Fcs, u8 *Cp, int Len)
 {
 	while (Len--)
-	   Fcs = (((Fcs) >> 8) ^ FCSTAB_32[((Fcs) ^ (*Cp++)) & 0xff]);
+		Fcs = (((Fcs) >> 8) ^ FCSTAB_32[((Fcs) ^ (*Cp++)) & 0xff]);
 
 	return (Fcs);
 }
 
-
 /*
 	========================================================================
 
@@ -489,12 +463,11 @@ UINT	RTMP_CALC_FCS32(
 
 	========================================================================
 */
-VOID	RTMPSetICV(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR	pDest)
+void RTMPSetICV(struct rt_rtmp_adapter *pAd, u8 *pDest)
 {
-	pAd->PrivateInfo.FCSCRC32 ^= 0xffffffff;             /* complement */
+	pAd->PrivateInfo.FCSCRC32 ^= 0xffffffff;	/* complement */
 	pAd->PrivateInfo.FCSCRC32 = cpu2le32(pAd->PrivateInfo.FCSCRC32);
 
-	ARCFOUR_ENCRYPT(&pAd->PrivateInfo.WEPCONTEXT, pDest, (PUCHAR) &pAd->PrivateInfo.FCSCRC32, 4);
+	ARCFOUR_ENCRYPT(&pAd->PrivateInfo.WEPCONTEXT, pDest,
+			(u8 *)& pAd->PrivateInfo.FCSCRC32, 4);
 }
diff --git a/drivers/staging/rt2860/common/cmm_wpa.c b/drivers/staging/rt2860/common/cmm_wpa.c
index 2de29fde2c40..94e119faaa71 100644
--- a/drivers/staging/rt2860/common/cmm_wpa.c
+++ b/drivers/staging/rt2860/common/cmm_wpa.c
@@ -36,25 +36,1219 @@
 	Paul Lin	03-11-28		Modify for supplicant
 */
 #include "../rt_config.h"
-// WPA OUI
-UCHAR		OUI_WPA_NONE_AKM[4]		= {0x00, 0x50, 0xF2, 0x00};
-UCHAR       OUI_WPA_VERSION[4]      = {0x00, 0x50, 0xF2, 0x01};
-UCHAR       OUI_WPA_WEP40[4]      = {0x00, 0x50, 0xF2, 0x01};
-UCHAR       OUI_WPA_TKIP[4]     = {0x00, 0x50, 0xF2, 0x02};
-UCHAR       OUI_WPA_CCMP[4]     = {0x00, 0x50, 0xF2, 0x04};
-UCHAR       OUI_WPA_WEP104[4]      = {0x00, 0x50, 0xF2, 0x05};
-UCHAR       OUI_WPA_8021X_AKM[4]	= {0x00, 0x50, 0xF2, 0x01};
-UCHAR       OUI_WPA_PSK_AKM[4]      = {0x00, 0x50, 0xF2, 0x02};
-// WPA2 OUI
-UCHAR       OUI_WPA2_WEP40[4]   = {0x00, 0x0F, 0xAC, 0x01};
-UCHAR       OUI_WPA2_TKIP[4]        = {0x00, 0x0F, 0xAC, 0x02};
-UCHAR       OUI_WPA2_CCMP[4]        = {0x00, 0x0F, 0xAC, 0x04};
-UCHAR       OUI_WPA2_8021X_AKM[4]   = {0x00, 0x0F, 0xAC, 0x01};
-UCHAR       OUI_WPA2_PSK_AKM[4]   	= {0x00, 0x0F, 0xAC, 0x02};
-UCHAR       OUI_WPA2_WEP104[4]   = {0x00, 0x0F, 0xAC, 0x05};
-// MSA OUI
-UCHAR   	OUI_MSA_8021X_AKM[4]    = {0x00, 0x0F, 0xAC, 0x05};		// Not yet final - IEEE 802.11s-D1.06
-UCHAR   	OUI_MSA_PSK_AKM[4]   	= {0x00, 0x0F, 0xAC, 0x06};		// Not yet final - IEEE 802.11s-D1.06
+/* WPA OUI */
+u8 OUI_WPA_NONE_AKM[4] = { 0x00, 0x50, 0xF2, 0x00 };
+u8 OUI_WPA_VERSION[4] = { 0x00, 0x50, 0xF2, 0x01 };
+u8 OUI_WPA_WEP40[4] = { 0x00, 0x50, 0xF2, 0x01 };
+u8 OUI_WPA_TKIP[4] = { 0x00, 0x50, 0xF2, 0x02 };
+u8 OUI_WPA_CCMP[4] = { 0x00, 0x50, 0xF2, 0x04 };
+u8 OUI_WPA_WEP104[4] = { 0x00, 0x50, 0xF2, 0x05 };
+u8 OUI_WPA_8021X_AKM[4] = { 0x00, 0x50, 0xF2, 0x01 };
+u8 OUI_WPA_PSK_AKM[4] = { 0x00, 0x50, 0xF2, 0x02 };
+
+/* WPA2 OUI */
+u8 OUI_WPA2_WEP40[4] = { 0x00, 0x0F, 0xAC, 0x01 };
+u8 OUI_WPA2_TKIP[4] = { 0x00, 0x0F, 0xAC, 0x02 };
+u8 OUI_WPA2_CCMP[4] = { 0x00, 0x0F, 0xAC, 0x04 };
+u8 OUI_WPA2_8021X_AKM[4] = { 0x00, 0x0F, 0xAC, 0x01 };
+u8 OUI_WPA2_PSK_AKM[4] = { 0x00, 0x0F, 0xAC, 0x02 };
+u8 OUI_WPA2_WEP104[4] = { 0x00, 0x0F, 0xAC, 0x05 };
+
+static void ConstructEapolKeyData(struct rt_mac_table_entry *pEntry,
+				  u8 GroupKeyWepStatus,
+				  u8 keyDescVer,
+				  u8 MsgType,
+				  u8 DefaultKeyIdx,
+				  u8 * GTK,
+				  u8 * RSNIE,
+				  u8 RSNIE_LEN, struct rt_eapol_packet * pMsg);
+
+static void CalculateMIC(u8 KeyDescVer,
+			 u8 * PTK, struct rt_eapol_packet * pMsg);
+
+static void WpaEAPPacketAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+static void WpaEAPOLASFAlertAction(struct rt_rtmp_adapter *pAd,
+				   struct rt_mlme_queue_elem *Elem);
+
+static void WpaEAPOLLogoffAction(struct rt_rtmp_adapter *pAd,
+				 struct rt_mlme_queue_elem *Elem);
+
+static void WpaEAPOLStartAction(struct rt_rtmp_adapter *pAd,
+				struct rt_mlme_queue_elem *Elem);
+
+static void WpaEAPOLKeyAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+/*
+    ==========================================================================
+    Description:
+        association state machine init, including state transition and timer init
+    Parameters:
+        S - pointer to the association state machine
+    ==========================================================================
+ */
+void WpaStateMachineInit(struct rt_rtmp_adapter *pAd,
+			 struct rt_state_machine *S, OUT STATE_MACHINE_FUNC Trans[])
+{
+	StateMachineInit(S, (STATE_MACHINE_FUNC *) Trans, MAX_WPA_PTK_STATE,
+			 MAX_WPA_MSG, (STATE_MACHINE_FUNC) Drop, WPA_PTK,
+			 WPA_MACHINE_BASE);
+
+	StateMachineSetAction(S, WPA_PTK, MT2_EAPPacket,
+			      (STATE_MACHINE_FUNC) WpaEAPPacketAction);
+	StateMachineSetAction(S, WPA_PTK, MT2_EAPOLStart,
+			      (STATE_MACHINE_FUNC) WpaEAPOLStartAction);
+	StateMachineSetAction(S, WPA_PTK, MT2_EAPOLLogoff,
+			      (STATE_MACHINE_FUNC) WpaEAPOLLogoffAction);
+	StateMachineSetAction(S, WPA_PTK, MT2_EAPOLKey,
+			      (STATE_MACHINE_FUNC) WpaEAPOLKeyAction);
+	StateMachineSetAction(S, WPA_PTK, MT2_EAPOLASFAlert,
+			      (STATE_MACHINE_FUNC) WpaEAPOLASFAlertAction);
+}
+
+/*
+    ==========================================================================
+    Description:
+        this is state machine function.
+        When receiving EAP packets which is  for 802.1x authentication use.
+        Not use in PSK case
+    Return:
+    ==========================================================================
+*/
+void WpaEAPPacketAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
+{
+}
+
+void WpaEAPOLASFAlertAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
+{
+}
+
+void WpaEAPOLLogoffAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
+{
+}
+
+/*
+    ==========================================================================
+    Description:
+       Start 4-way HS when rcv EAPOL_START which may create by our driver in assoc.c
+    Return:
+    ==========================================================================
+*/
+void WpaEAPOLStartAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
+{
+	struct rt_mac_table_entry *pEntry;
+	struct rt_header_802_11 * pHeader;
+
+	DBGPRINT(RT_DEBUG_TRACE, ("WpaEAPOLStartAction ===> \n"));
+
+	pHeader = (struct rt_header_802_11 *) Elem->Msg;
+
+	/*For normaol PSK, we enqueue an EAPOL-Start command to trigger the process. */
+	if (Elem->MsgLen == 6)
+		pEntry = MacTableLookup(pAd, Elem->Msg);
+	else {
+		pEntry = MacTableLookup(pAd, pHeader->Addr2);
+	}
+
+	if (pEntry) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 (" PortSecured(%d), WpaState(%d), AuthMode(%d), PMKID_CacheIdx(%d) \n",
+			  pEntry->PortSecured, pEntry->WpaState,
+			  pEntry->AuthMode, pEntry->PMKID_CacheIdx));
+
+		if ((pEntry->PortSecured == WPA_802_1X_PORT_NOT_SECURED)
+		    && (pEntry->WpaState < AS_PTKSTART)
+		    && ((pEntry->AuthMode == Ndis802_11AuthModeWPAPSK)
+			|| (pEntry->AuthMode == Ndis802_11AuthModeWPA2PSK)
+			|| ((pEntry->AuthMode == Ndis802_11AuthModeWPA2)
+			    && (pEntry->PMKID_CacheIdx != ENTRY_NOT_FOUND)))) {
+			pEntry->PrivacyFilter = Ndis802_11PrivFilter8021xWEP;
+			pEntry->WpaState = AS_INITPSK;
+			pEntry->PortSecured = WPA_802_1X_PORT_NOT_SECURED;
+			NdisZeroMemory(pEntry->R_Counter,
+				       sizeof(pEntry->R_Counter));
+			pEntry->ReTryCounter = PEER_MSG1_RETRY_TIMER_CTR;
+
+			WPAStart4WayHS(pAd, pEntry, PEER_MSG1_RETRY_EXEC_INTV);
+		}
+	}
+}
+
+/*
+    ==========================================================================
+    Description:
+        This is state machine function.
+        When receiving EAPOL packets which is  for 802.1x key management.
+        Use both in WPA, and WPAPSK case.
+        In this function, further dispatch to different functions according to the received packet.  3 categories are :
+          1.  normal 4-way pairwisekey and 2-way groupkey handshake
+          2.  MIC error (Countermeasures attack)  report packet from STA.
+          3.  Request for pairwise/group key update from STA
+    Return:
+    ==========================================================================
+*/
+void WpaEAPOLKeyAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
+{
+	struct rt_mac_table_entry *pEntry;
+	struct rt_header_802_11 * pHeader;
+	struct rt_eapol_packet * pEapol_packet;
+	struct rt_key_info peerKeyInfo;
+
+	DBGPRINT(RT_DEBUG_TRACE, ("WpaEAPOLKeyAction ===>\n"));
+
+	pHeader = (struct rt_header_802_11 *) Elem->Msg;
+	pEapol_packet =
+	    (struct rt_eapol_packet *) & Elem->Msg[LENGTH_802_11 + LENGTH_802_1_H];
+
+	NdisZeroMemory((u8 *)& peerKeyInfo, sizeof(peerKeyInfo));
+	NdisMoveMemory((u8 *)& peerKeyInfo,
+		       (u8 *)& pEapol_packet->KeyDesc.KeyInfo,
+		       sizeof(struct rt_key_info));
+
+	hex_dump("Received Eapol frame", (unsigned char *)pEapol_packet,
+		 (Elem->MsgLen - LENGTH_802_11 - LENGTH_802_1_H));
+
+	*((u16 *) & peerKeyInfo) = cpu2le16(*((u16 *) & peerKeyInfo));
+
+	do {
+		pEntry = MacTableLookup(pAd, pHeader->Addr2);
+
+		if (!pEntry
+		    || ((!pEntry->ValidAsCLI) && (!pEntry->ValidAsApCli)))
+			break;
+
+		if (pEntry->AuthMode < Ndis802_11AuthModeWPA)
+			break;
+
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("Receive EAPoL-Key frame from STA %02X-%02X-%02X-%02X-%02X-%02X\n",
+			  PRINT_MAC(pEntry->Addr)));
+
+		if (((pEapol_packet->ProVer != EAPOL_VER)
+		     && (pEapol_packet->ProVer != EAPOL_VER2))
+		    || ((pEapol_packet->KeyDesc.Type != WPA1_KEY_DESC)
+			&& (pEapol_packet->KeyDesc.Type != WPA2_KEY_DESC))) {
+			DBGPRINT(RT_DEBUG_ERROR,
+				 ("Key descripter does not match with WPA rule\n"));
+			break;
+		}
+		/* The value 1 shall be used for all EAPOL-Key frames to and from a STA when */
+		/* neither the group nor pairwise ciphers are CCMP for Key Descriptor 1. */
+		if ((pEntry->WepStatus == Ndis802_11Encryption2Enabled)
+		    && (peerKeyInfo.KeyDescVer != DESC_TYPE_TKIP)) {
+			DBGPRINT(RT_DEBUG_ERROR,
+				 ("Key descripter version not match(TKIP) \n"));
+			break;
+		}
+		/* The value 2 shall be used for all EAPOL-Key frames to and from a STA when */
+		/* either the pairwise or the group cipher is AES-CCMP for Key Descriptor 2. */
+		else if ((pEntry->WepStatus == Ndis802_11Encryption3Enabled)
+			 && (peerKeyInfo.KeyDescVer != DESC_TYPE_AES)) {
+			DBGPRINT(RT_DEBUG_ERROR,
+				 ("Key descripter version not match(AES) \n"));
+			break;
+		}
+		/* Check if this STA is in class 3 state and the WPA state is started */
+		if ((pEntry->Sst == SST_ASSOC)
+		    && (pEntry->WpaState >= AS_INITPSK)) {
+			/* Check the Key Ack (bit 7) of the Key Information to determine the Authenticator */
+			/* or not. */
+			/* An EAPOL-Key frame that is sent by the Supplicant in response to an EAPOL- */
+			/* Key frame from the Authenticator must not have the Ack bit set. */
+			if (peerKeyInfo.KeyAck == 1) {
+				/* The frame is snet by Authenticator. */
+				/* So the Supplicant side shall handle this. */
+
+				if ((peerKeyInfo.Secure == 0)
+				    && (peerKeyInfo.Request == 0)
+				    && (peerKeyInfo.Error == 0)
+				    && (peerKeyInfo.KeyType == PAIRWISEKEY)) {
+					/* Process 1. the message 1 of 4-way HS in WPA or WPA2 */
+					/*                        EAPOL-Key(0,0,1,0,P,0,0,ANonce,0,DataKD_M1) */
+					/*                 2. the message 3 of 4-way HS in WPA */
+					/*                        EAPOL-Key(0,1,1,1,P,0,KeyRSC,ANonce,MIC,DataKD_M3) */
+					if (peerKeyInfo.KeyMic == 0)
+						PeerPairMsg1Action(pAd, pEntry,
+								   Elem);
+					else
+						PeerPairMsg3Action(pAd, pEntry,
+								   Elem);
+				} else if ((peerKeyInfo.Secure == 1)
+					   && (peerKeyInfo.KeyMic == 1)
+					   && (peerKeyInfo.Request == 0)
+					   && (peerKeyInfo.Error == 0)) {
+					/* Process 1. the message 3 of 4-way HS in WPA2 */
+					/*                        EAPOL-Key(1,1,1,1,P,0,KeyRSC,ANonce,MIC,DataKD_M3) */
+					/*                 2. the message 1 of group KS in WPA or WPA2 */
+					/*                        EAPOL-Key(1,1,1,0,G,0,Key RSC,0, MIC,GTK[N]) */
+					if (peerKeyInfo.KeyType == PAIRWISEKEY)
+						PeerPairMsg3Action(pAd, pEntry,
+								   Elem);
+					else
+						PeerGroupMsg1Action(pAd, pEntry,
+								    Elem);
+				}
+			} else {
+				/* The frame is snet by Supplicant. */
+				/* So the Authenticator side shall handle this. */
+				if ((peerKeyInfo.Request == 0) &&
+				    (peerKeyInfo.Error == 0) &&
+				    (peerKeyInfo.KeyMic == 1)) {
+					if (peerKeyInfo.Secure == 0
+					    && peerKeyInfo.KeyType ==
+					    PAIRWISEKEY) {
+						/* EAPOL-Key(0,1,0,0,P,0,0,SNonce,MIC,Data) */
+						/* Process 1. message 2 of 4-way HS in WPA or WPA2 */
+						/*                 2. message 4 of 4-way HS in WPA */
+						if (CONV_ARRARY_TO_u16
+						    (pEapol_packet->KeyDesc.
+						     KeyDataLen) == 0) {
+							PeerPairMsg4Action(pAd,
+									   pEntry,
+									   Elem);
+						} else {
+							PeerPairMsg2Action(pAd,
+									   pEntry,
+									   Elem);
+						}
+					} else if (peerKeyInfo.Secure == 1
+						   && peerKeyInfo.KeyType ==
+						   PAIRWISEKEY) {
+						/* EAPOL-Key(1,1,0,0,P,0,0,0,MIC,0) */
+						/* Process message 4 of 4-way HS in WPA2 */
+						PeerPairMsg4Action(pAd, pEntry,
+								   Elem);
+					} else if (peerKeyInfo.Secure == 1
+						   && peerKeyInfo.KeyType ==
+						   GROUPKEY) {
+						/* EAPOL-Key(1,1,0,0,G,0,0,0,MIC,0) */
+						/* Process message 2 of Group key HS in WPA or WPA2 */
+						PeerGroupMsg2Action(pAd, pEntry,
+								    &Elem->
+								    Msg
+								    [LENGTH_802_11],
+								    (Elem->
+								     MsgLen -
+								     LENGTH_802_11));
+					}
+				}
+			}
+		}
+	} while (FALSE);
+}
+
+/*
+	========================================================================
+
+	Routine	Description:
+		Copy frame from waiting queue into relative ring buffer and set
+	appropriate ASIC register to kick hardware encryption before really
+	sent out to air.
+
+	Arguments:
+		pAd		Pointer	to our adapter
+		void *	Pointer to outgoing Ndis frame
+		NumberOfFrag	Number of fragment required
+
+	Return Value:
+		None
+
+	Note:
+
+	========================================================================
+*/
+void RTMPToWirelessSta(struct rt_rtmp_adapter *pAd,
+		       struct rt_mac_table_entry *pEntry,
+		       u8 *pHeader802_3,
+		       u32 HdrLen,
+		       u8 *pData, u32 DataLen, IN BOOLEAN bClearFrame)
+{
+	void *pPacket;
+	int Status;
+
+	if ((!pEntry) || ((!pEntry->ValidAsCLI) && (!pEntry->ValidAsApCli)))
+		return;
+
+	do {
+		/* build a NDIS packet */
+		Status =
+		    RTMPAllocateNdisPacket(pAd, &pPacket, pHeader802_3, HdrLen,
+					   pData, DataLen);
+		if (Status != NDIS_STATUS_SUCCESS)
+			break;
+
+		if (bClearFrame)
+			RTMP_SET_PACKET_CLEAR_EAP_FRAME(pPacket, 1);
+		else
+			RTMP_SET_PACKET_CLEAR_EAP_FRAME(pPacket, 0);
+		{
+			RTMP_SET_PACKET_SOURCE(pPacket, PKTSRC_NDIS);
+
+			RTMP_SET_PACKET_NET_DEVICE_MBSSID(pPacket, MAIN_MBSSID);	/* set a default value */
+			if (pEntry->apidx != 0)
+				RTMP_SET_PACKET_NET_DEVICE_MBSSID(pPacket,
+								  pEntry->
+								  apidx);
+
+			RTMP_SET_PACKET_WCID(pPacket, (u8)pEntry->Aid);
+			RTMP_SET_PACKET_MOREDATA(pPacket, FALSE);
+		}
+
+		{
+			/* send out the packet */
+			Status = STASendPacket(pAd, pPacket);
+			if (Status == NDIS_STATUS_SUCCESS) {
+				u8 Index;
+
+				/* Dequeue one frame from TxSwQueue0..3 queue and process it */
+				/* There are three place calling dequeue for TX ring. */
+				/* 1. Here, right after queueing the frame. */
+				/* 2. At the end of TxRingTxDone service routine. */
+				/* 3. Upon NDIS call RTMPSendPackets */
+				if ((!RTMP_TEST_FLAG
+				     (pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS))
+				    &&
+				    (!RTMP_TEST_FLAG
+				     (pAd, fRTMP_ADAPTER_RESET_IN_PROGRESS))) {
+					for (Index = 0; Index < 5; Index++)
+						if (pAd->TxSwQueue[Index].
+						    Number > 0)
+							RTMPDeQueuePacket(pAd,
+									  FALSE,
+									  Index,
+									  MAX_TX_PROCESS);
+				}
+			}
+		}
+
+	} while (FALSE);
+}
+
+/*
+    ==========================================================================
+    Description:
+        This is a function to initilize 4-way handshake
+
+    Return:
+
+    ==========================================================================
+*/
+void WPAStart4WayHS(struct rt_rtmp_adapter *pAd,
+		    struct rt_mac_table_entry *pEntry, unsigned long TimeInterval)
+{
+	u8 Header802_3[14];
+	struct rt_eapol_packet EAPOLPKT;
+	u8 *pBssid = NULL;
+	u8 group_cipher = Ndis802_11WEPDisabled;
+
+	DBGPRINT(RT_DEBUG_TRACE, ("===> WPAStart4WayHS\n"));
+
+	if (RTMP_TEST_FLAG
+	    (pAd,
+	     fRTMP_ADAPTER_RESET_IN_PROGRESS | fRTMP_ADAPTER_HALT_IN_PROGRESS))
+	{
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("[ERROR]WPAStart4WayHS : The interface is closed...\n"));
+		return;
+	}
+
+	if (pBssid == NULL) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("[ERROR]WPAStart4WayHS : No corresponding Authenticator.\n"));
+		return;
+	}
+	/* Check the status */
+	if ((pEntry->WpaState > AS_PTKSTART) || (pEntry->WpaState < AS_INITPMK)) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("[ERROR]WPAStart4WayHS : Not expect calling\n"));
+		return;
+	}
+
+	/* Increment replay counter by 1 */
+	ADD_ONE_To_64BIT_VAR(pEntry->R_Counter);
+
+	/* Randomly generate ANonce */
+	GenRandom(pAd, (u8 *) pBssid, pEntry->ANonce);
+
+	/* Construct EAPoL message - Pairwise Msg 1 */
+	/* EAPOL-Key(0,0,1,0,P,0,0,ANonce,0,DataKD_M1) */
+	NdisZeroMemory(&EAPOLPKT, sizeof(struct rt_eapol_packet));
+	ConstructEapolMsg(pEntry, group_cipher, EAPOL_PAIR_MSG_1, 0,	/* Default key index */
+			  pEntry->ANonce, NULL,	/* TxRSC */
+			  NULL,	/* GTK */
+			  NULL,	/* RSNIE */
+			  0,	/* RSNIE length */
+			  &EAPOLPKT);
+
+	/* Make outgoing frame */
+	MAKE_802_3_HEADER(Header802_3, pEntry->Addr, pBssid, EAPOL);
+	RTMPToWirelessSta(pAd, pEntry, Header802_3,
+			  LENGTH_802_3, (u8 *)& EAPOLPKT,
+			  CONV_ARRARY_TO_u16(EAPOLPKT.Body_Len) + 4,
+			  (pEntry->PortSecured ==
+			   WPA_802_1X_PORT_SECURED) ? FALSE : TRUE);
+
+	/* Trigger Retry Timer */
+	RTMPModTimer(&pEntry->RetryTimer, TimeInterval);
+
+	/* Update State */
+	pEntry->WpaState = AS_PTKSTART;
+
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("<=== WPAStart4WayHS: send Msg1 of 4-way \n"));
+
+}
+
+/*
+	========================================================================
+
+	Routine Description:
+		Process Pairwise key Msg-1 of 4-way handshaking and send Msg-2
+
+	Arguments:
+		pAd			Pointer	to our adapter
+		Elem		Message body
+
+	Return Value:
+		None
+
+	Note:
+
+	========================================================================
+*/
+void PeerPairMsg1Action(struct rt_rtmp_adapter *pAd,
+			struct rt_mac_table_entry *pEntry, struct rt_mlme_queue_elem *Elem)
+{
+	u8 PTK[80];
+	u8 Header802_3[14];
+	struct rt_eapol_packet * pMsg1;
+	u32 MsgLen;
+	struct rt_eapol_packet EAPOLPKT;
+	u8 *pCurrentAddr = NULL;
+	u8 *pmk_ptr = NULL;
+	u8 group_cipher = Ndis802_11WEPDisabled;
+	u8 *rsnie_ptr = NULL;
+	u8 rsnie_len = 0;
+
+	DBGPRINT(RT_DEBUG_TRACE, ("===> PeerPairMsg1Action \n"));
+
+	if ((!pEntry) || ((!pEntry->ValidAsCLI) && (!pEntry->ValidAsApCli)))
+		return;
+
+	if (Elem->MsgLen <
+	    (LENGTH_802_11 + LENGTH_802_1_H + LENGTH_EAPOL_H +
+	     sizeof(struct rt_key_descripter) - MAX_LEN_OF_RSNIE - 2))
+		return;
+
+	{
+		pCurrentAddr = pAd->CurrentAddress;
+		pmk_ptr = pAd->StaCfg.PMK;
+		group_cipher = pAd->StaCfg.GroupCipher;
+		rsnie_ptr = pAd->StaCfg.RSN_IE;
+		rsnie_len = pAd->StaCfg.RSNIE_Len;
+	}
+
+	/* Store the received frame */
+	pMsg1 = (struct rt_eapol_packet *) & Elem->Msg[LENGTH_802_11 + LENGTH_802_1_H];
+	MsgLen = Elem->MsgLen - LENGTH_802_11 - LENGTH_802_1_H;
+
+	/* Sanity Check peer Pairwise message 1 - Replay Counter */
+	if (PeerWpaMessageSanity(pAd, pMsg1, MsgLen, EAPOL_PAIR_MSG_1, pEntry)
+	    == FALSE)
+		return;
+
+	/* Store Replay counter, it will use to verify message 3 and construct message 2 */
+	NdisMoveMemory(pEntry->R_Counter, pMsg1->KeyDesc.ReplayCounter,
+		       LEN_KEY_DESC_REPLAY);
+
+	/* Store ANonce */
+	NdisMoveMemory(pEntry->ANonce, pMsg1->KeyDesc.KeyNonce,
+		       LEN_KEY_DESC_NONCE);
+
+	/* Generate random SNonce */
+	GenRandom(pAd, (u8 *) pCurrentAddr, pEntry->SNonce);
+
+	{
+		/* Calculate PTK(ANonce, SNonce) */
+		WpaDerivePTK(pAd,
+			     pmk_ptr,
+			     pEntry->ANonce,
+			     pEntry->Addr,
+			     pEntry->SNonce, pCurrentAddr, PTK, LEN_PTK);
+
+		/* Save key to PTK entry */
+		NdisMoveMemory(pEntry->PTK, PTK, LEN_PTK);
+	}
+
+	/* Update WpaState */
+	pEntry->WpaState = AS_PTKINIT_NEGOTIATING;
+
+	/* Construct EAPoL message - Pairwise Msg 2 */
+	/*  EAPOL-Key(0,1,0,0,P,0,0,SNonce,MIC,DataKD_M2) */
+	NdisZeroMemory(&EAPOLPKT, sizeof(struct rt_eapol_packet));
+	ConstructEapolMsg(pEntry, group_cipher, EAPOL_PAIR_MSG_2, 0,	/* DefaultKeyIdx */
+			  pEntry->SNonce, NULL,	/* TxRsc */
+			  NULL,	/* GTK */
+			  (u8 *) rsnie_ptr, rsnie_len, &EAPOLPKT);
+
+	/* Make outgoing frame */
+	MAKE_802_3_HEADER(Header802_3, pEntry->Addr, pCurrentAddr, EAPOL);
+
+	RTMPToWirelessSta(pAd, pEntry,
+			  Header802_3, sizeof(Header802_3), (u8 *)& EAPOLPKT,
+			  CONV_ARRARY_TO_u16(EAPOLPKT.Body_Len) + 4, TRUE);
+
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("<=== PeerPairMsg1Action: send Msg2 of 4-way \n"));
+}
+
+/*
+    ==========================================================================
+    Description:
+        When receiving the second packet of 4-way pairwisekey handshake.
+    Return:
+    ==========================================================================
+*/
+void PeerPairMsg2Action(struct rt_rtmp_adapter *pAd,
+			struct rt_mac_table_entry *pEntry, struct rt_mlme_queue_elem *Elem)
+{
+	u8 PTK[80];
+	BOOLEAN Cancelled;
+	struct rt_header_802_11 * pHeader;
+	struct rt_eapol_packet EAPOLPKT;
+	struct rt_eapol_packet * pMsg2;
+	u32 MsgLen;
+	u8 Header802_3[LENGTH_802_3];
+	u8 TxTsc[6];
+	u8 *pBssid = NULL;
+	u8 *pmk_ptr = NULL;
+	u8 *gtk_ptr = NULL;
+	u8 default_key = 0;
+	u8 group_cipher = Ndis802_11WEPDisabled;
+	u8 *rsnie_ptr = NULL;
+	u8 rsnie_len = 0;
+
+	DBGPRINT(RT_DEBUG_TRACE, ("===> PeerPairMsg2Action \n"));
+
+	if ((!pEntry) || (!pEntry->ValidAsCLI))
+		return;
+
+	if (Elem->MsgLen <
+	    (LENGTH_802_11 + LENGTH_802_1_H + LENGTH_EAPOL_H +
+	     sizeof(struct rt_key_descripter) - MAX_LEN_OF_RSNIE - 2))
+		return;
+
+	/* check Entry in valid State */
+	if (pEntry->WpaState < AS_PTKSTART)
+		return;
+
+	/* pointer to 802.11 header */
+	pHeader = (struct rt_header_802_11 *) Elem->Msg;
+
+	/* skip 802.11_header(24-byte) and LLC_header(8) */
+	pMsg2 = (struct rt_eapol_packet *) & Elem->Msg[LENGTH_802_11 + LENGTH_802_1_H];
+	MsgLen = Elem->MsgLen - LENGTH_802_11 - LENGTH_802_1_H;
+
+	/* Store SNonce */
+	NdisMoveMemory(pEntry->SNonce, pMsg2->KeyDesc.KeyNonce,
+		       LEN_KEY_DESC_NONCE);
+
+	{
+		/* Derive PTK */
+		WpaDerivePTK(pAd, (u8 *) pmk_ptr, pEntry->ANonce,	/* ANONCE */
+			     (u8 *) pBssid, pEntry->SNonce,	/* SNONCE */
+			     pEntry->Addr, PTK, LEN_PTK);
+
+		NdisMoveMemory(pEntry->PTK, PTK, LEN_PTK);
+	}
+
+	/* Sanity Check peer Pairwise message 2 - Replay Counter, MIC, RSNIE */
+	if (PeerWpaMessageSanity(pAd, pMsg2, MsgLen, EAPOL_PAIR_MSG_2, pEntry)
+	    == FALSE)
+		return;
+
+	do {
+		/* delete retry timer */
+		RTMPCancelTimer(&pEntry->RetryTimer, &Cancelled);
+
+		/* Change state */
+		pEntry->WpaState = AS_PTKINIT_NEGOTIATING;
+
+		/* Increment replay counter by 1 */
+		ADD_ONE_To_64BIT_VAR(pEntry->R_Counter);
+
+		/* Construct EAPoL message - Pairwise Msg 3 */
+		NdisZeroMemory(&EAPOLPKT, sizeof(struct rt_eapol_packet));
+		ConstructEapolMsg(pEntry,
+				  group_cipher,
+				  EAPOL_PAIR_MSG_3,
+				  default_key,
+				  pEntry->ANonce,
+				  TxTsc,
+				  (u8 *) gtk_ptr,
+				  (u8 *) rsnie_ptr, rsnie_len, &EAPOLPKT);
+
+		/* Make outgoing frame */
+		MAKE_802_3_HEADER(Header802_3, pEntry->Addr, pBssid, EAPOL);
+		RTMPToWirelessSta(pAd, pEntry, Header802_3, LENGTH_802_3,
+				  (u8 *)& EAPOLPKT,
+				  CONV_ARRARY_TO_u16(EAPOLPKT.Body_Len) + 4,
+				  (pEntry->PortSecured ==
+				   WPA_802_1X_PORT_SECURED) ? FALSE : TRUE);
+
+		pEntry->ReTryCounter = PEER_MSG3_RETRY_TIMER_CTR;
+		RTMPSetTimer(&pEntry->RetryTimer, PEER_MSG3_RETRY_EXEC_INTV);
+
+		/* Update State */
+		pEntry->WpaState = AS_PTKINIT_NEGOTIATING;
+	} while (FALSE);
+
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("<=== PeerPairMsg2Action: send Msg3 of 4-way \n"));
+}
+
+/*
+	========================================================================
+
+	Routine Description:
+		Process Pairwise key Msg 3 of 4-way handshaking and send Msg 4
+
+	Arguments:
+		pAd	Pointer	to our adapter
+		Elem		Message body
+
+	Return Value:
+		None
+
+	Note:
+
+	========================================================================
+*/
+void PeerPairMsg3Action(struct rt_rtmp_adapter *pAd,
+			struct rt_mac_table_entry *pEntry, struct rt_mlme_queue_elem *Elem)
+{
+	struct rt_header_802_11 * pHeader;
+	u8 Header802_3[14];
+	struct rt_eapol_packet EAPOLPKT;
+	struct rt_eapol_packet * pMsg3;
+	u32 MsgLen;
+	u8 *pCurrentAddr = NULL;
+	u8 group_cipher = Ndis802_11WEPDisabled;
+
+	DBGPRINT(RT_DEBUG_TRACE, ("===> PeerPairMsg3Action \n"));
+
+	if ((!pEntry) || ((!pEntry->ValidAsCLI) && (!pEntry->ValidAsApCli)))
+		return;
+
+	if (Elem->MsgLen <
+	    (LENGTH_802_11 + LENGTH_802_1_H + LENGTH_EAPOL_H +
+	     sizeof(struct rt_key_descripter) - MAX_LEN_OF_RSNIE - 2))
+		return;
+
+	{
+		pCurrentAddr = pAd->CurrentAddress;
+		group_cipher = pAd->StaCfg.GroupCipher;
+
+	}
+
+	/* Record 802.11 header & the received EAPOL packet Msg3 */
+	pHeader = (struct rt_header_802_11 *) Elem->Msg;
+	pMsg3 = (struct rt_eapol_packet *) & Elem->Msg[LENGTH_802_11 + LENGTH_802_1_H];
+	MsgLen = Elem->MsgLen - LENGTH_802_11 - LENGTH_802_1_H;
+
+	/* Sanity Check peer Pairwise message 3 - Replay Counter, MIC, RSNIE */
+	if (PeerWpaMessageSanity(pAd, pMsg3, MsgLen, EAPOL_PAIR_MSG_3, pEntry)
+	    == FALSE)
+		return;
+
+	/* Save Replay counter, it will use construct message 4 */
+	NdisMoveMemory(pEntry->R_Counter, pMsg3->KeyDesc.ReplayCounter,
+		       LEN_KEY_DESC_REPLAY);
+
+	/* Double check ANonce */
+	if (!NdisEqualMemory
+	    (pEntry->ANonce, pMsg3->KeyDesc.KeyNonce, LEN_KEY_DESC_NONCE)) {
+		return;
+	}
+	/* Construct EAPoL message - Pairwise Msg 4 */
+	NdisZeroMemory(&EAPOLPKT, sizeof(struct rt_eapol_packet));
+	ConstructEapolMsg(pEntry, group_cipher, EAPOL_PAIR_MSG_4, 0,	/* group key index not used in message 4 */
+			  NULL,	/* Nonce not used in message 4 */
+			  NULL,	/* TxRSC not used in message 4 */
+			  NULL,	/* GTK not used in message 4 */
+			  NULL,	/* RSN IE not used in message 4 */
+			  0, &EAPOLPKT);
+
+	/* Update WpaState */
+	pEntry->WpaState = AS_PTKINITDONE;
+
+	/* Update pairwise key */
+	{
+		struct rt_cipher_key *pSharedKey;
+
+		pSharedKey = &pAd->SharedKey[BSS0][0];
+
+		NdisMoveMemory(pAd->StaCfg.PTK, pEntry->PTK, LEN_PTK);
+
+		/* Prepare pair-wise key information into shared key table */
+		NdisZeroMemory(pSharedKey, sizeof(struct rt_cipher_key));
+		pSharedKey->KeyLen = LEN_TKIP_EK;
+		NdisMoveMemory(pSharedKey->Key, &pAd->StaCfg.PTK[32],
+			       LEN_TKIP_EK);
+		NdisMoveMemory(pSharedKey->RxMic, &pAd->StaCfg.PTK[48],
+			       LEN_TKIP_RXMICK);
+		NdisMoveMemory(pSharedKey->TxMic,
+			       &pAd->StaCfg.PTK[48 + LEN_TKIP_RXMICK],
+			       LEN_TKIP_TXMICK);
+
+		/* Decide its ChiperAlg */
+		if (pAd->StaCfg.PairCipher == Ndis802_11Encryption2Enabled)
+			pSharedKey->CipherAlg = CIPHER_TKIP;
+		else if (pAd->StaCfg.PairCipher == Ndis802_11Encryption3Enabled)
+			pSharedKey->CipherAlg = CIPHER_AES;
+		else
+			pSharedKey->CipherAlg = CIPHER_NONE;
+
+		/* Update these related information to struct rt_mac_table_entry */
+		pEntry = &pAd->MacTab.Content[BSSID_WCID];
+		NdisMoveMemory(pEntry->PairwiseKey.Key, &pAd->StaCfg.PTK[32],
+			       LEN_TKIP_EK);
+		NdisMoveMemory(pEntry->PairwiseKey.RxMic, &pAd->StaCfg.PTK[48],
+			       LEN_TKIP_RXMICK);
+		NdisMoveMemory(pEntry->PairwiseKey.TxMic,
+			       &pAd->StaCfg.PTK[48 + LEN_TKIP_RXMICK],
+			       LEN_TKIP_TXMICK);
+		pEntry->PairwiseKey.CipherAlg = pSharedKey->CipherAlg;
+
+		/* Update pairwise key information to ASIC Shared Key Table */
+		AsicAddSharedKeyEntry(pAd,
+				      BSS0,
+				      0,
+				      pSharedKey->CipherAlg,
+				      pSharedKey->Key,
+				      pSharedKey->TxMic, pSharedKey->RxMic);
+
+		/* Update ASIC WCID attribute table and IVEIV table */
+		RTMPAddWcidAttributeEntry(pAd,
+					  BSS0,
+					  0, pSharedKey->CipherAlg, pEntry);
+
+	}
+
+	/* open 802.1x port control and privacy filter */
+	if (pEntry->AuthMode == Ndis802_11AuthModeWPA2PSK ||
+	    pEntry->AuthMode == Ndis802_11AuthModeWPA2) {
+		pEntry->PortSecured = WPA_802_1X_PORT_SECURED;
+		pEntry->PrivacyFilter = Ndis802_11PrivFilterAcceptAll;
+
+		STA_PORT_SECURED(pAd);
+		/* Indicate Connected for GUI */
+		pAd->IndicateMediaState = NdisMediaStateConnected;
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("PeerPairMsg3Action: AuthMode(%s) PairwiseCipher(%s) GroupCipher(%s) \n",
+			  GetAuthMode(pEntry->AuthMode),
+			  GetEncryptType(pEntry->WepStatus),
+			  GetEncryptType(group_cipher)));
+	} else {
+	}
+
+	/* Init 802.3 header and send out */
+	MAKE_802_3_HEADER(Header802_3, pEntry->Addr, pCurrentAddr, EAPOL);
+	RTMPToWirelessSta(pAd, pEntry,
+			  Header802_3, sizeof(Header802_3),
+			  (u8 *)& EAPOLPKT,
+			  CONV_ARRARY_TO_u16(EAPOLPKT.Body_Len) + 4, TRUE);
+
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("<=== PeerPairMsg3Action: send Msg4 of 4-way \n"));
+}
+
+/*
+    ==========================================================================
+    Description:
+        When receiving the last packet of 4-way pairwisekey handshake.
+        Initilize 2-way groupkey handshake following.
+    Return:
+    ==========================================================================
+*/
+void PeerPairMsg4Action(struct rt_rtmp_adapter *pAd,
+			struct rt_mac_table_entry *pEntry, struct rt_mlme_queue_elem *Elem)
+{
+	struct rt_eapol_packet * pMsg4;
+	struct rt_header_802_11 * pHeader;
+	u32 MsgLen;
+	BOOLEAN Cancelled;
+	u8 group_cipher = Ndis802_11WEPDisabled;
+
+	DBGPRINT(RT_DEBUG_TRACE, ("===> PeerPairMsg4Action\n"));
+
+	do {
+		if ((!pEntry) || (!pEntry->ValidAsCLI))
+			break;
+
+		if (Elem->MsgLen <
+		    (LENGTH_802_11 + LENGTH_802_1_H + LENGTH_EAPOL_H +
+		     sizeof(struct rt_key_descripter) - MAX_LEN_OF_RSNIE - 2))
+			break;
+
+		if (pEntry->WpaState < AS_PTKINIT_NEGOTIATING)
+			break;
+
+		/* pointer to 802.11 header */
+		pHeader = (struct rt_header_802_11 *) Elem->Msg;
+
+		/* skip 802.11_header(24-byte) and LLC_header(8) */
+		pMsg4 =
+		    (struct rt_eapol_packet *) & Elem->Msg[LENGTH_802_11 + LENGTH_802_1_H];
+		MsgLen = Elem->MsgLen - LENGTH_802_11 - LENGTH_802_1_H;
+
+		/* Sanity Check peer Pairwise message 4 - Replay Counter, MIC */
+		if (PeerWpaMessageSanity
+		    (pAd, pMsg4, MsgLen, EAPOL_PAIR_MSG_4, pEntry) == FALSE)
+			break;
+
+		/* 3. uses the MLME.SETKEYS.request to configure PTK into MAC */
+		NdisZeroMemory(&pEntry->PairwiseKey, sizeof(struct rt_cipher_key));
+
+		/* reset IVEIV in Asic */
+		AsicUpdateWCIDIVEIV(pAd, pEntry->Aid, 1, 0);
+
+		pEntry->PairwiseKey.KeyLen = LEN_TKIP_EK;
+		NdisMoveMemory(pEntry->PairwiseKey.Key, &pEntry->PTK[32],
+			       LEN_TKIP_EK);
+		NdisMoveMemory(pEntry->PairwiseKey.RxMic,
+			       &pEntry->PTK[TKIP_AP_RXMICK_OFFSET],
+			       LEN_TKIP_RXMICK);
+		NdisMoveMemory(pEntry->PairwiseKey.TxMic,
+			       &pEntry->PTK[TKIP_AP_TXMICK_OFFSET],
+			       LEN_TKIP_TXMICK);
+
+		/* Set pairwise key to Asic */
+		{
+			pEntry->PairwiseKey.CipherAlg = CIPHER_NONE;
+			if (pEntry->WepStatus == Ndis802_11Encryption2Enabled)
+				pEntry->PairwiseKey.CipherAlg = CIPHER_TKIP;
+			else if (pEntry->WepStatus ==
+				 Ndis802_11Encryption3Enabled)
+				pEntry->PairwiseKey.CipherAlg = CIPHER_AES;
+
+			/* Add Pair-wise key to Asic */
+			AsicAddPairwiseKeyEntry(pAd,
+						pEntry->Addr,
+						(u8)pEntry->Aid,
+						&pEntry->PairwiseKey);
+
+			/* update WCID attribute table and IVEIV table for this entry */
+			RTMPAddWcidAttributeEntry(pAd,
+						  pEntry->apidx,
+						  0,
+						  pEntry->PairwiseKey.CipherAlg,
+						  pEntry);
+		}
+
+		/* 4. upgrade state */
+		pEntry->PrivacyFilter = Ndis802_11PrivFilterAcceptAll;
+		pEntry->WpaState = AS_PTKINITDONE;
+		pEntry->PortSecured = WPA_802_1X_PORT_SECURED;
+
+		if (pEntry->AuthMode == Ndis802_11AuthModeWPA2 ||
+		    pEntry->AuthMode == Ndis802_11AuthModeWPA2PSK) {
+			pEntry->GTKState = REKEY_ESTABLISHED;
+			RTMPCancelTimer(&pEntry->RetryTimer, &Cancelled);
+
+			/* send wireless event - for set key done WPA2 */
+			if (pAd->CommonCfg.bWirelessEvent)
+				RTMPSendWirelessEvent(pAd,
+						      IW_SET_KEY_DONE_WPA2_EVENT_FLAG,
+						      pEntry->Addr,
+						      pEntry->apidx, 0);
+
+			DBGPRINT(RT_DEBUG_OFF,
+				 ("AP SETKEYS DONE - WPA2, AuthMode(%d)=%s, WepStatus(%d)=%s, GroupWepStatus(%d)=%s\n\n",
+				  pEntry->AuthMode,
+				  GetAuthMode(pEntry->AuthMode),
+				  pEntry->WepStatus,
+				  GetEncryptType(pEntry->WepStatus),
+				  group_cipher, GetEncryptType(group_cipher)));
+		} else {
+			/* 5. init Group 2-way handshake if necessary. */
+			WPAStart2WayGroupHS(pAd, pEntry);
+
+			pEntry->ReTryCounter = GROUP_MSG1_RETRY_TIMER_CTR;
+			RTMPModTimer(&pEntry->RetryTimer,
+				     PEER_MSG3_RETRY_EXEC_INTV);
+		}
+	} while (FALSE);
+
+}
+
+/*
+    ==========================================================================
+    Description:
+        This is a function to send the first packet of 2-way groupkey handshake
+    Return:
+
+    ==========================================================================
+*/
+void WPAStart2WayGroupHS(struct rt_rtmp_adapter *pAd, struct rt_mac_table_entry *pEntry)
+{
+	u8 Header802_3[14];
+	u8 TxTsc[6];
+	struct rt_eapol_packet EAPOLPKT;
+	u8 group_cipher = Ndis802_11WEPDisabled;
+	u8 default_key = 0;
+	u8 *gnonce_ptr = NULL;
+	u8 *gtk_ptr = NULL;
+	u8 *pBssid = NULL;
+
+	DBGPRINT(RT_DEBUG_TRACE, ("===> WPAStart2WayGroupHS\n"));
+
+	if ((!pEntry) || (!pEntry->ValidAsCLI))
+		return;
+
+	do {
+		/* Increment replay counter by 1 */
+		ADD_ONE_To_64BIT_VAR(pEntry->R_Counter);
+
+		/* Construct EAPoL message - Group Msg 1 */
+		NdisZeroMemory(&EAPOLPKT, sizeof(struct rt_eapol_packet));
+		ConstructEapolMsg(pEntry,
+				  group_cipher,
+				  EAPOL_GROUP_MSG_1,
+				  default_key,
+				  (u8 *) gnonce_ptr,
+				  TxTsc, (u8 *) gtk_ptr, NULL, 0, &EAPOLPKT);
+
+		/* Make outgoing frame */
+		MAKE_802_3_HEADER(Header802_3, pEntry->Addr, pBssid, EAPOL);
+		RTMPToWirelessSta(pAd, pEntry,
+				  Header802_3, LENGTH_802_3,
+				  (u8 *)& EAPOLPKT,
+				  CONV_ARRARY_TO_u16(EAPOLPKT.Body_Len) + 4,
+				  FALSE);
+
+	} while (FALSE);
+
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("<=== WPAStart2WayGroupHS : send out Group Message 1 \n"));
+
+	return;
+}
+
+/*
+	========================================================================
+
+	Routine Description:
+		Process Group key 2-way handshaking
+
+	Arguments:
+		pAd	Pointer	to our adapter
+		Elem		Message body
+
+	Return Value:
+		None
+
+	Note:
+
+	========================================================================
+*/
+void PeerGroupMsg1Action(struct rt_rtmp_adapter *pAd,
+			 struct rt_mac_table_entry *pEntry, struct rt_mlme_queue_elem *Elem)
+{
+	u8 Header802_3[14];
+	struct rt_eapol_packet EAPOLPKT;
+	struct rt_eapol_packet * pGroup;
+	u32 MsgLen;
+	BOOLEAN Cancelled;
+	u8 default_key = 0;
+	u8 group_cipher = Ndis802_11WEPDisabled;
+	u8 *pCurrentAddr = NULL;
+
+	DBGPRINT(RT_DEBUG_TRACE, ("===> PeerGroupMsg1Action \n"));
+
+	if ((!pEntry) || ((!pEntry->ValidAsCLI) && (!pEntry->ValidAsApCli)))
+		return;
+
+	{
+		pCurrentAddr = pAd->CurrentAddress;
+		group_cipher = pAd->StaCfg.GroupCipher;
+		default_key = pAd->StaCfg.DefaultKeyId;
+	}
+
+	/* Process Group Message 1 frame. skip 802.11 header(24) & LLC_SNAP header(8) */
+	pGroup = (struct rt_eapol_packet *) & Elem->Msg[LENGTH_802_11 + LENGTH_802_1_H];
+	MsgLen = Elem->MsgLen - LENGTH_802_11 - LENGTH_802_1_H;
+
+	/* Sanity Check peer group message 1 - Replay Counter, MIC, RSNIE */
+	if (PeerWpaMessageSanity(pAd, pGroup, MsgLen, EAPOL_GROUP_MSG_1, pEntry)
+	    == FALSE)
+		return;
+
+	/* delete retry timer */
+	RTMPCancelTimer(&pEntry->RetryTimer, &Cancelled);
+
+	/* Save Replay counter, it will use to construct message 2 */
+	NdisMoveMemory(pEntry->R_Counter, pGroup->KeyDesc.ReplayCounter,
+		       LEN_KEY_DESC_REPLAY);
+
+	/* Construct EAPoL message - Group Msg 2 */
+	NdisZeroMemory(&EAPOLPKT, sizeof(struct rt_eapol_packet));
+	ConstructEapolMsg(pEntry, group_cipher, EAPOL_GROUP_MSG_2, default_key, NULL,	/* Nonce not used */
+			  NULL,	/* TxRSC not used */
+			  NULL,	/* GTK not used */
+			  NULL,	/* RSN IE not used */
+			  0, &EAPOLPKT);
+
+	/* open 802.1x port control and privacy filter */
+	pEntry->PortSecured = WPA_802_1X_PORT_SECURED;
+	pEntry->PrivacyFilter = Ndis802_11PrivFilterAcceptAll;
+
+	STA_PORT_SECURED(pAd);
+	/* Indicate Connected for GUI */
+	pAd->IndicateMediaState = NdisMediaStateConnected;
+
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("PeerGroupMsg1Action: AuthMode(%s) PairwiseCipher(%s) GroupCipher(%s) \n",
+		  GetAuthMode(pEntry->AuthMode),
+		  GetEncryptType(pEntry->WepStatus),
+		  GetEncryptType(group_cipher)));
+
+	/* init header and Fill Packet and send Msg 2 to authenticator */
+	MAKE_802_3_HEADER(Header802_3, pEntry->Addr, pCurrentAddr, EAPOL);
+	RTMPToWirelessSta(pAd, pEntry,
+			  Header802_3, sizeof(Header802_3),
+			  (u8 *)& EAPOLPKT,
+			  CONV_ARRARY_TO_u16(EAPOLPKT.Body_Len) + 4, FALSE);
+
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("<=== PeerGroupMsg1Action: sned group message 2\n"));
+}
+
+/*
+    ==========================================================================
+    Description:
+        When receiving the last packet of 2-way groupkey handshake.
+    Return:
+    ==========================================================================
+*/
+void PeerGroupMsg2Action(struct rt_rtmp_adapter *pAd,
+			 struct rt_mac_table_entry *pEntry,
+			 void * Msg, u32 MsgLen)
+{
+	u32 Len;
+	u8 *pData;
+	BOOLEAN Cancelled;
+	struct rt_eapol_packet * pMsg2;
+	u8 group_cipher = Ndis802_11WEPDisabled;
+
+	DBGPRINT(RT_DEBUG_TRACE, ("===> PeerGroupMsg2Action \n"));
+
+	do {
+		if ((!pEntry) || (!pEntry->ValidAsCLI))
+			break;
+
+		if (MsgLen <
+		    (LENGTH_802_1_H + LENGTH_EAPOL_H + sizeof(struct rt_key_descripter) -
+		     MAX_LEN_OF_RSNIE - 2))
+			break;
+
+		if (pEntry->WpaState != AS_PTKINITDONE)
+			break;
+
+		pData = (u8 *)Msg;
+		pMsg2 = (struct rt_eapol_packet *) (pData + LENGTH_802_1_H);
+		Len = MsgLen - LENGTH_802_1_H;
+
+		/* Sanity Check peer group message 2 - Replay Counter, MIC */
+		if (PeerWpaMessageSanity
+		    (pAd, pMsg2, Len, EAPOL_GROUP_MSG_2, pEntry) == FALSE)
+			break;
+
+		/* 3.  upgrade state */
+
+		RTMPCancelTimer(&pEntry->RetryTimer, &Cancelled);
+		pEntry->GTKState = REKEY_ESTABLISHED;
+
+		if ((pEntry->AuthMode == Ndis802_11AuthModeWPA2)
+		    || (pEntry->AuthMode == Ndis802_11AuthModeWPA2PSK)) {
+			/* send wireless event - for set key done WPA2 */
+			if (pAd->CommonCfg.bWirelessEvent)
+				RTMPSendWirelessEvent(pAd,
+						      IW_SET_KEY_DONE_WPA2_EVENT_FLAG,
+						      pEntry->Addr,
+						      pEntry->apidx, 0);
+
+			DBGPRINT(RT_DEBUG_OFF,
+				 ("AP SETKEYS DONE - WPA2, AuthMode(%d)=%s, WepStatus(%d)=%s, GroupWepStatus(%d)=%s\n\n",
+				  pEntry->AuthMode,
+				  GetAuthMode(pEntry->AuthMode),
+				  pEntry->WepStatus,
+				  GetEncryptType(pEntry->WepStatus),
+				  group_cipher, GetEncryptType(group_cipher)));
+		} else {
+			/* send wireless event - for set key done WPA */
+			if (pAd->CommonCfg.bWirelessEvent)
+				RTMPSendWirelessEvent(pAd,
+						      IW_SET_KEY_DONE_WPA1_EVENT_FLAG,
+						      pEntry->Addr,
+						      pEntry->apidx, 0);
+
+			DBGPRINT(RT_DEBUG_OFF,
+				 ("AP SETKEYS DONE - WPA1, AuthMode(%d)=%s, WepStatus(%d)=%s, GroupWepStatus(%d)=%s\n\n",
+				  pEntry->AuthMode,
+				  GetAuthMode(pEntry->AuthMode),
+				  pEntry->WepStatus,
+				  GetEncryptType(pEntry->WepStatus),
+				  group_cipher, GetEncryptType(group_cipher)));
+		}
+	} while (FALSE);
+}
+
+/*
+	========================================================================
+
+	Routine Description:
+		Classify WPA EAP message type
+
+	Arguments:
+		EAPType		Value of EAP message type
+		MsgType		Internal Message definition for MLME state machine
+
+	Return Value:
+		TRUE		Found appropriate message type
+		FALSE		No appropriate message type
+
+	IRQL = DISPATCH_LEVEL
+
+	Note:
+		All these constants are defined in wpa.h
+		For supplicant, there is only EAPOL Key message avaliable
+
+	========================================================================
+*/
+BOOLEAN WpaMsgTypeSubst(u8 EAPType, int * MsgType)
+{
+	switch (EAPType) {
+	case EAPPacket:
+		*MsgType = MT2_EAPPacket;
+		break;
+	case EAPOLStart:
+		*MsgType = MT2_EAPOLStart;
+		break;
+	case EAPOLLogoff:
+		*MsgType = MT2_EAPOLLogoff;
+		break;
+	case EAPOLKey:
+		*MsgType = MT2_EAPOLKey;
+		break;
+	case EAPOLASFAlert:
+		*MsgType = MT2_EAPOLASFAlert;
+		break;
+	default:
+		return FALSE;
+	}
+	return TRUE;
+}
 
 /*
 	========================================================================
@@ -67,72 +1261,118 @@ UCHAR   	OUI_MSA_PSK_AKM[4]   	= {0x00, 0x0F, 0xAC, 0x06};		// Not yet final - I
 		It is used to generate PTK, GTK or some specific random value.
 
 	Arguments:
-		UCHAR	*key,		-	the key material for HMAC_SHA1 use
-		INT		key_len		-	the length of key
-		UCHAR	*prefix		-	a prefix label
-		INT		prefix_len	-	the length of the label
-		UCHAR	*data		-	a specific data with variable length
-		INT		data_len	-	the length of a specific data
-		INT		len			-	the output lenght
+		u8	*key,		-	the key material for HMAC_SHA1 use
+		int		key_len		-	the length of key
+		u8	*prefix		-	a prefix label
+		int		prefix_len	-	the length of the label
+		u8	*data		-	a specific data with variable length
+		int		data_len	-	the length of a specific data
+		int		len			-	the output lenght
 
 	Return Value:
-		UCHAR	*output		-	the calculated result
+		u8	*output		-	the calculated result
 
 	Note:
 		802.11i-2004	Annex H.3
 
 	========================================================================
 */
-VOID	PRF(
-	IN	UCHAR	*key,
-	IN	INT		key_len,
-	IN	UCHAR	*prefix,
-	IN	INT		prefix_len,
-	IN	UCHAR	*data,
-	IN	INT		data_len,
-	OUT	UCHAR	*output,
-	IN	INT		len)
-{
-	INT		i;
-    UCHAR   *input;
-	INT		currentindex = 0;
-	INT		total_len;
-
-	// Allocate memory for input
-	os_alloc_mem(NULL, (PUCHAR *)&input, 1024);
-
-    if (input == NULL)
-    {
-        DBGPRINT(RT_DEBUG_ERROR, ("!!!PRF: no memory!!!\n"));
-        return;
-    }
-
-	// Generate concatenation input
+void PRF(u8 * key,
+	 int key_len,
+	 u8 * prefix,
+	 int prefix_len,
+	 u8 * data, int data_len, u8 * output, int len)
+{
+	int i;
+	u8 *input;
+	int currentindex = 0;
+	int total_len;
+
+	/* Allocate memory for input */
+	os_alloc_mem(NULL, (u8 **) & input, 1024);
+
+	if (input == NULL) {
+		DBGPRINT(RT_DEBUG_ERROR, ("PRF: no memory!\n"));
+		return;
+	}
+	/* Generate concatenation input */
 	NdisMoveMemory(input, prefix, prefix_len);
 
-	// Concatenate a single octet containing 0
-	input[prefix_len] =	0;
+	/* Concatenate a single octet containing 0 */
+	input[prefix_len] = 0;
 
-	// Concatenate specific data
+	/* Concatenate specific data */
 	NdisMoveMemory(&input[prefix_len + 1], data, data_len);
-	total_len =	prefix_len + 1 + data_len;
+	total_len = prefix_len + 1 + data_len;
 
-	// Concatenate a single octet containing 0
-	// This octet shall be update later
+	/* Concatenate a single octet containing 0 */
+	/* This octet shall be update later */
 	input[total_len] = 0;
 	total_len++;
 
-	// Iterate to calculate the result by hmac-sha-1
-	// Then concatenate to last result
-	for	(i = 0;	i <	(len + 19) / 20; i++)
-	{
-		HMAC_SHA1(input, total_len,	key, key_len, &output[currentindex]);
-		currentindex +=	20;
+	/* Iterate to calculate the result by hmac-sha-1 */
+	/* Then concatenate to last result */
+	for (i = 0; i < (len + 19) / 20; i++) {
+		HMAC_SHA1(key, key_len, input, total_len, &output[currentindex],
+			  SHA1_DIGEST_SIZE);
+		currentindex += 20;
 
-		// update the last octet
+		/* update the last octet */
 		input[total_len - 1]++;
 	}
-    os_free_mem(NULL, input);
+	os_free_mem(NULL, input);
+}
+
+/*
+* F(P, S, c, i) = U1 xor U2 xor ... Uc
+* U1 = PRF(P, S || Int(i))
+* U2 = PRF(P, U1)
+* Uc = PRF(P, Uc-1)
+*/
+
+static void F(char *password, unsigned char *ssid, int ssidlength,
+	      int iterations, int count, unsigned char *output)
+{
+	unsigned char digest[36], digest1[SHA1_DIGEST_SIZE];
+	int i, j;
+
+	/* U1 = PRF(P, S || int(i)) */
+	memcpy(digest, ssid, ssidlength);
+	digest[ssidlength] = (unsigned char)((count >> 24) & 0xff);
+	digest[ssidlength + 1] = (unsigned char)((count >> 16) & 0xff);
+	digest[ssidlength + 2] = (unsigned char)((count >> 8) & 0xff);
+	digest[ssidlength + 3] = (unsigned char)(count & 0xff);
+	HMAC_SHA1((unsigned char *)password, (int)strlen(password), digest, ssidlength + 4, digest1, SHA1_DIGEST_SIZE);	/* for WPA update */
+
+	/* output = U1 */
+	memcpy(output, digest1, SHA1_DIGEST_SIZE);
+
+	for (i = 1; i < iterations; i++) {
+		/* Un = PRF(P, Un-1) */
+		HMAC_SHA1((unsigned char *)password, (int)strlen(password), digest1, SHA1_DIGEST_SIZE, digest, SHA1_DIGEST_SIZE);	/* for WPA update */
+		memcpy(digest1, digest, SHA1_DIGEST_SIZE);
+
+		/* output = output xor Un */
+		for (j = 0; j < SHA1_DIGEST_SIZE; j++) {
+			output[j] ^= digest[j];
+		}
+	}
+}
+
+/*
+* password - ascii string up to 63 characters in length
+* ssid - octet string up to 32 octets
+* ssidlength - length of ssid in octets
+* output must be 40 octets in length and outputs 256 bits of key
+*/
+int PasswordHash(char *password, u8 *ssid, int ssidlength, u8 *output)
+{
+	if ((strlen(password) > 63) || (ssidlength > 32))
+		return 0;
+
+	F(password, ssid, ssidlength, 4096, 1, output);
+	F(password, ssid, ssidlength, 4096, 2, &output[SHA1_DIGEST_SIZE]);
+	return 1;
 }
 
 /*
@@ -143,7 +1383,7 @@ VOID	PRF(
 		It shall be called by 4-way handshake processing.
 
 	Arguments:
-		pAd 	-	pointer to our pAdapter context
+		pAd	-	pointer to our pAdapter context
 		PMK		-	pointer to PMK
 		ANonce	-	pointer to ANonce
 		AA		-	pointer to Authenticator Address
@@ -159,56 +1399,55 @@ VOID	PRF(
 
 	========================================================================
 */
-VOID WpaCountPTK(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR	*PMK,
-	IN	UCHAR	*ANonce,
-	IN	UCHAR	*AA,
-	IN	UCHAR	*SNonce,
-	IN	UCHAR	*SA,
-	OUT	UCHAR	*output,
-	IN	UINT	len)
-{
-	UCHAR	concatenation[76];
-	UINT	CurrPos = 0;
-	UCHAR	temp[32];
-	UCHAR	Prefix[] = {'P', 'a', 'i', 'r', 'w', 'i', 's', 'e', ' ', 'k', 'e', 'y', ' ',
-						'e', 'x', 'p', 'a', 'n', 's', 'i', 'o', 'n'};
-
-	// initiate the concatenation input
+void WpaDerivePTK(struct rt_rtmp_adapter *pAd,
+		  u8 * PMK,
+		  u8 * ANonce,
+		  u8 * AA,
+		  u8 * SNonce,
+		  u8 * SA, u8 * output, u32 len)
+{
+	u8 concatenation[76];
+	u32 CurrPos = 0;
+	u8 temp[32];
+	u8 Prefix[] =
+	    { 'P', 'a', 'i', 'r', 'w', 'i', 's', 'e', ' ', 'k', 'e', 'y', ' ',
+		'e', 'x', 'p', 'a', 'n', 's', 'i', 'o', 'n'
+	};
+
+	/* initiate the concatenation input */
 	NdisZeroMemory(temp, sizeof(temp));
 	NdisZeroMemory(concatenation, 76);
 
-	// Get smaller address
+	/* Get smaller address */
 	if (RTMPCompareMemory(SA, AA, 6) == 1)
 		NdisMoveMemory(concatenation, AA, 6);
 	else
 		NdisMoveMemory(concatenation, SA, 6);
 	CurrPos += 6;
 
-	// Get larger address
+	/* Get larger address */
 	if (RTMPCompareMemory(SA, AA, 6) == 1)
 		NdisMoveMemory(&concatenation[CurrPos], SA, 6);
 	else
 		NdisMoveMemory(&concatenation[CurrPos], AA, 6);
 
-	// store the larger mac address for backward compatible of
-	// ralink proprietary STA-key issue
+	/* store the larger mac address for backward compatible of */
+	/* ralink proprietary STA-key issue */
 	NdisMoveMemory(temp, &concatenation[CurrPos], MAC_ADDR_LEN);
 	CurrPos += 6;
 
-	// Get smaller Nonce
+	/* Get smaller Nonce */
 	if (RTMPCompareMemory(ANonce, SNonce, 32) == 0)
-		NdisMoveMemory(&concatenation[CurrPos], temp, 32);	// patch for ralink proprietary STA-key issue
+		NdisMoveMemory(&concatenation[CurrPos], temp, 32);	/* patch for ralink proprietary STA-key issue */
 	else if (RTMPCompareMemory(ANonce, SNonce, 32) == 1)
 		NdisMoveMemory(&concatenation[CurrPos], SNonce, 32);
 	else
 		NdisMoveMemory(&concatenation[CurrPos], ANonce, 32);
 	CurrPos += 32;
 
-	// Get larger Nonce
+	/* Get larger Nonce */
 	if (RTMPCompareMemory(ANonce, SNonce, 32) == 0)
-		NdisMoveMemory(&concatenation[CurrPos], temp, 32);	// patch for ralink proprietary STA-key issue
+		NdisMoveMemory(&concatenation[CurrPos], temp, 32);	/* patch for ralink proprietary STA-key issue */
 	else if (RTMPCompareMemory(ANonce, SNonce, 32) == 1)
 		NdisMoveMemory(&concatenation[CurrPos], ANonce, 32);
 	else
@@ -217,7 +1456,7 @@ VOID WpaCountPTK(
 
 	hex_dump("concatenation=", concatenation, 76);
 
-	// Use PRF to generate PTK
+	/* Use PRF to generate PTK */
 	PRF(PMK, LEN_MASTER_KEY, Prefix, 22, concatenation, 76, output, len);
 
 }
@@ -239,46 +1478,43 @@ VOID WpaCountPTK(
 
 	========================================================================
 */
-VOID	GenRandom(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			*macAddr,
-	OUT	UCHAR			*random)
-{
-	INT		i, curr;
-	UCHAR	local[80], KeyCounter[32];
-	UCHAR	result[80];
-	ULONG	CurrentTime;
-	UCHAR	prefix[] = {'I', 'n', 'i', 't', ' ', 'C', 'o', 'u', 'n', 't', 'e', 'r'};
-
-	// Zero the related information
+void GenRandom(struct rt_rtmp_adapter *pAd, u8 * macAddr, u8 * random)
+{
+	int i, curr;
+	u8 local[80], KeyCounter[32];
+	u8 result[80];
+	unsigned long CurrentTime;
+	u8 prefix[] =
+	    { 'I', 'n', 'i', 't', ' ', 'C', 'o', 'u', 'n', 't', 'e', 'r' };
+
+	/* Zero the related information */
 	NdisZeroMemory(result, 80);
 	NdisZeroMemory(local, 80);
 	NdisZeroMemory(KeyCounter, 32);
 
-	for	(i = 0;	i <	32;	i++)
-	{
-		// copy the local MAC address
+	for (i = 0; i < 32; i++) {
+		/* copy the local MAC address */
 		COPY_MAC_ADDR(local, macAddr);
-		curr =	MAC_ADDR_LEN;
+		curr = MAC_ADDR_LEN;
 
-		// concatenate the current time
+		/* concatenate the current time */
 		NdisGetSystemUpTime(&CurrentTime);
-		NdisMoveMemory(&local[curr],  &CurrentTime,	sizeof(CurrentTime));
-		curr +=	sizeof(CurrentTime);
+		NdisMoveMemory(&local[curr], &CurrentTime, sizeof(CurrentTime));
+		curr += sizeof(CurrentTime);
 
-		// concatenate the last result
-		NdisMoveMemory(&local[curr],  result, 32);
-		curr +=	32;
+		/* concatenate the last result */
+		NdisMoveMemory(&local[curr], result, 32);
+		curr += 32;
 
-		// concatenate a variable
-		NdisMoveMemory(&local[curr],  &i,  2);
-		curr +=	2;
+		/* concatenate a variable */
+		NdisMoveMemory(&local[curr], &i, 2);
+		curr += 2;
 
-		// calculate the result
-		PRF(KeyCounter, 32, prefix,12, local, curr, result, 32);
+		/* calculate the result */
+		PRF(KeyCounter, 32, prefix, 12, local, curr, result, 32);
 	}
 
-	NdisMoveMemory(random, result,	32);
+	NdisMoveMemory(random, result, 32);
 }
 
 /*
@@ -290,8 +1526,8 @@ VOID	GenRandom(
 
 	Arguments:
 		pAd			-	pointer to our pAdapter context
-    	ElementID	-	indicate the WPA1 or WPA2
-    	WepStatus	-	indicate the encryption type
+	ElementID	-	indicate the WPA1 or WPA2
+	WepStatus	-	indicate the encryption type
 		bMixCipher	-	a boolean to indicate the pairwise cipher and group
 						cipher are the same or not
 
@@ -301,170 +1537,169 @@ VOID	GenRandom(
 
 	========================================================================
 */
-static VOID RTMPInsertRsnIeCipher(
-	IN  PRTMP_ADAPTER   pAd,
-	IN	UCHAR			ElementID,
-	IN	UINT			WepStatus,
-	IN	BOOLEAN			bMixCipher,
-	IN	UCHAR			FlexibleCipher,
-	OUT	PUCHAR			pRsnIe,
-	OUT	UCHAR			*rsn_len)
+static void RTMPMakeRsnIeCipher(struct rt_rtmp_adapter *pAd,
+				u8 ElementID,
+				u32 WepStatus,
+				IN BOOLEAN bMixCipher,
+				u8 FlexibleCipher,
+				u8 *pRsnIe, u8 * rsn_len)
 {
-	UCHAR	PairwiseCnt;
+	u8 PairwiseCnt;
 
 	*rsn_len = 0;
 
-	// decide WPA2 or WPA1
-	if (ElementID == Wpa2Ie)
-	{
-		RSNIE2	*pRsnie_cipher = (RSNIE2*)pRsnIe;
+	/* decide WPA2 or WPA1 */
+	if (ElementID == Wpa2Ie) {
+		struct rt_rsnie2 *pRsnie_cipher = (struct rt_rsnie2 *)pRsnIe;
 
-		// Assign the verson as 1
+		/* Assign the verson as 1 */
 		pRsnie_cipher->version = 1;
 
-        switch (WepStatus)
-        {
-        	// TKIP mode
-            case Ndis802_11Encryption2Enabled:
-                NdisMoveMemory(pRsnie_cipher->mcast, OUI_WPA2_TKIP, 4);
-                pRsnie_cipher->ucount = 1;
-                NdisMoveMemory(pRsnie_cipher->ucast[0].oui, OUI_WPA2_TKIP, 4);
-                *rsn_len = sizeof(RSNIE2);
-                break;
-
-			// AES mode
-            case Ndis802_11Encryption3Enabled:
-				if (bMixCipher)
-					NdisMoveMemory(pRsnie_cipher->mcast, OUI_WPA2_TKIP, 4);
-				else
-					NdisMoveMemory(pRsnie_cipher->mcast, OUI_WPA2_CCMP, 4);
-                pRsnie_cipher->ucount = 1;
-                NdisMoveMemory(pRsnie_cipher->ucast[0].oui, OUI_WPA2_CCMP, 4);
-                *rsn_len = sizeof(RSNIE2);
-                break;
-
-			// TKIP-AES mix mode
-            case Ndis802_11Encryption4Enabled:
-                NdisMoveMemory(pRsnie_cipher->mcast, OUI_WPA2_TKIP, 4);
-
-				PairwiseCnt = 1;
-				// Insert WPA2 TKIP as the first pairwise cipher
-				if (MIX_CIPHER_WPA2_TKIP_ON(FlexibleCipher))
-				{
-                	NdisMoveMemory(pRsnie_cipher->ucast[0].oui, OUI_WPA2_TKIP, 4);
-					// Insert WPA2 AES as the secondary pairwise cipher
-					if (MIX_CIPHER_WPA2_AES_ON(FlexibleCipher))
-					{
-                		NdisMoveMemory(pRsnie_cipher->ucast[0].oui + 4, OUI_WPA2_CCMP, 4);
-						PairwiseCnt = 2;
-					}
-				}
-				else
-				{
-					// Insert WPA2 AES as the first pairwise cipher
-					NdisMoveMemory(pRsnie_cipher->ucast[0].oui, OUI_WPA2_CCMP, 4);
+		switch (WepStatus) {
+			/* TKIP mode */
+		case Ndis802_11Encryption2Enabled:
+			NdisMoveMemory(pRsnie_cipher->mcast, OUI_WPA2_TKIP, 4);
+			pRsnie_cipher->ucount = 1;
+			NdisMoveMemory(pRsnie_cipher->ucast[0].oui,
+				       OUI_WPA2_TKIP, 4);
+			*rsn_len = sizeof(struct rt_rsnie2);
+			break;
+
+			/* AES mode */
+		case Ndis802_11Encryption3Enabled:
+			if (bMixCipher)
+				NdisMoveMemory(pRsnie_cipher->mcast,
+					       OUI_WPA2_TKIP, 4);
+			else
+				NdisMoveMemory(pRsnie_cipher->mcast,
+					       OUI_WPA2_CCMP, 4);
+			pRsnie_cipher->ucount = 1;
+			NdisMoveMemory(pRsnie_cipher->ucast[0].oui,
+				       OUI_WPA2_CCMP, 4);
+			*rsn_len = sizeof(struct rt_rsnie2);
+			break;
+
+			/* TKIP-AES mix mode */
+		case Ndis802_11Encryption4Enabled:
+			NdisMoveMemory(pRsnie_cipher->mcast, OUI_WPA2_TKIP, 4);
+
+			PairwiseCnt = 1;
+			/* Insert WPA2 TKIP as the first pairwise cipher */
+			if (MIX_CIPHER_WPA2_TKIP_ON(FlexibleCipher)) {
+				NdisMoveMemory(pRsnie_cipher->ucast[0].oui,
+					       OUI_WPA2_TKIP, 4);
+				/* Insert WPA2 AES as the secondary pairwise cipher */
+				if (MIX_CIPHER_WPA2_AES_ON(FlexibleCipher)) {
+					NdisMoveMemory(pRsnie_cipher->ucast[0].
+						       oui + 4, OUI_WPA2_CCMP,
+						       4);
+					PairwiseCnt = 2;
 				}
+			} else {
+				/* Insert WPA2 AES as the first pairwise cipher */
+				NdisMoveMemory(pRsnie_cipher->ucast[0].oui,
+					       OUI_WPA2_CCMP, 4);
+			}
 
-                pRsnie_cipher->ucount = PairwiseCnt;
-                *rsn_len = sizeof(RSNIE2) + (4 * (PairwiseCnt - 1));
-                break;
-        }
+			pRsnie_cipher->ucount = PairwiseCnt;
+			*rsn_len = sizeof(struct rt_rsnie2) + (4 * (PairwiseCnt - 1));
+			break;
+		}
 
 		if ((pAd->OpMode == OPMODE_STA) &&
-			(pAd->StaCfg.GroupCipher != Ndis802_11Encryption2Enabled) &&
-			(pAd->StaCfg.GroupCipher != Ndis802_11Encryption3Enabled))
-		{
-			UINT GroupCipher = pAd->StaCfg.GroupCipher;
-			switch(GroupCipher)
-			{
-				case Ndis802_11GroupWEP40Enabled:
-					NdisMoveMemory(pRsnie_cipher->mcast, OUI_WPA2_WEP40, 4);
-					break;
-				case Ndis802_11GroupWEP104Enabled:
-					NdisMoveMemory(pRsnie_cipher->mcast, OUI_WPA2_WEP104, 4);
-					break;
+		    (pAd->StaCfg.GroupCipher != Ndis802_11Encryption2Enabled) &&
+		    (pAd->StaCfg.GroupCipher != Ndis802_11Encryption3Enabled)) {
+			u32 GroupCipher = pAd->StaCfg.GroupCipher;
+			switch (GroupCipher) {
+			case Ndis802_11GroupWEP40Enabled:
+				NdisMoveMemory(pRsnie_cipher->mcast,
+					       OUI_WPA2_WEP40, 4);
+				break;
+			case Ndis802_11GroupWEP104Enabled:
+				NdisMoveMemory(pRsnie_cipher->mcast,
+					       OUI_WPA2_WEP104, 4);
+				break;
 			}
 		}
-
-		// swap for big-endian platform
+		/* swap for big-endian platform */
 		pRsnie_cipher->version = cpu2le16(pRsnie_cipher->version);
-	    pRsnie_cipher->ucount = cpu2le16(pRsnie_cipher->ucount);
-	}
-	else
-	{
-		RSNIE	*pRsnie_cipher = (RSNIE*)pRsnIe;
+		pRsnie_cipher->ucount = cpu2le16(pRsnie_cipher->ucount);
+	} else {
+		struct rt_rsnie *pRsnie_cipher = (struct rt_rsnie *)pRsnIe;
 
-		// Assign OUI and version
+		/* Assign OUI and version */
 		NdisMoveMemory(pRsnie_cipher->oui, OUI_WPA_VERSION, 4);
-        pRsnie_cipher->version = 1;
+		pRsnie_cipher->version = 1;
 
-		switch (WepStatus)
-		{
-			// TKIP mode
-            case Ndis802_11Encryption2Enabled:
-                NdisMoveMemory(pRsnie_cipher->mcast, OUI_WPA_TKIP, 4);
-                pRsnie_cipher->ucount = 1;
-                NdisMoveMemory(pRsnie_cipher->ucast[0].oui, OUI_WPA_TKIP, 4);
-                *rsn_len = sizeof(RSNIE);
-                break;
-
-			// AES mode
-            case Ndis802_11Encryption3Enabled:
-				if (bMixCipher)
-					NdisMoveMemory(pRsnie_cipher->mcast, OUI_WPA_TKIP, 4);
-				else
-					NdisMoveMemory(pRsnie_cipher->mcast, OUI_WPA_CCMP, 4);
-                pRsnie_cipher->ucount = 1;
-                NdisMoveMemory(pRsnie_cipher->ucast[0].oui, OUI_WPA_CCMP, 4);
-                *rsn_len = sizeof(RSNIE);
-                break;
-
-			// TKIP-AES mix mode
-            case Ndis802_11Encryption4Enabled:
-                NdisMoveMemory(pRsnie_cipher->mcast, OUI_WPA_TKIP, 4);
-
-				PairwiseCnt = 1;
-				// Insert WPA TKIP as the first pairwise cipher
-				if (MIX_CIPHER_WPA_TKIP_ON(FlexibleCipher))
-				{
-                	NdisMoveMemory(pRsnie_cipher->ucast[0].oui, OUI_WPA_TKIP, 4);
-					// Insert WPA AES as the secondary pairwise cipher
-					if (MIX_CIPHER_WPA_AES_ON(FlexibleCipher))
-					{
-                		NdisMoveMemory(pRsnie_cipher->ucast[0].oui + 4, OUI_WPA_CCMP, 4);
-						PairwiseCnt = 2;
-					}
-				}
-				else
-				{
-					// Insert WPA AES as the first pairwise cipher
-					NdisMoveMemory(pRsnie_cipher->ucast[0].oui, OUI_WPA_CCMP, 4);
+		switch (WepStatus) {
+			/* TKIP mode */
+		case Ndis802_11Encryption2Enabled:
+			NdisMoveMemory(pRsnie_cipher->mcast, OUI_WPA_TKIP, 4);
+			pRsnie_cipher->ucount = 1;
+			NdisMoveMemory(pRsnie_cipher->ucast[0].oui,
+				       OUI_WPA_TKIP, 4);
+			*rsn_len = sizeof(struct rt_rsnie);
+			break;
+
+			/* AES mode */
+		case Ndis802_11Encryption3Enabled:
+			if (bMixCipher)
+				NdisMoveMemory(pRsnie_cipher->mcast,
+					       OUI_WPA_TKIP, 4);
+			else
+				NdisMoveMemory(pRsnie_cipher->mcast,
+					       OUI_WPA_CCMP, 4);
+			pRsnie_cipher->ucount = 1;
+			NdisMoveMemory(pRsnie_cipher->ucast[0].oui,
+				       OUI_WPA_CCMP, 4);
+			*rsn_len = sizeof(struct rt_rsnie);
+			break;
+
+			/* TKIP-AES mix mode */
+		case Ndis802_11Encryption4Enabled:
+			NdisMoveMemory(pRsnie_cipher->mcast, OUI_WPA_TKIP, 4);
+
+			PairwiseCnt = 1;
+			/* Insert WPA TKIP as the first pairwise cipher */
+			if (MIX_CIPHER_WPA_TKIP_ON(FlexibleCipher)) {
+				NdisMoveMemory(pRsnie_cipher->ucast[0].oui,
+					       OUI_WPA_TKIP, 4);
+				/* Insert WPA AES as the secondary pairwise cipher */
+				if (MIX_CIPHER_WPA_AES_ON(FlexibleCipher)) {
+					NdisMoveMemory(pRsnie_cipher->ucast[0].
+						       oui + 4, OUI_WPA_CCMP,
+						       4);
+					PairwiseCnt = 2;
 				}
+			} else {
+				/* Insert WPA AES as the first pairwise cipher */
+				NdisMoveMemory(pRsnie_cipher->ucast[0].oui,
+					       OUI_WPA_CCMP, 4);
+			}
 
-                pRsnie_cipher->ucount = PairwiseCnt;
-                *rsn_len = sizeof(RSNIE) + (4 * (PairwiseCnt - 1));
-                break;
-        }
+			pRsnie_cipher->ucount = PairwiseCnt;
+			*rsn_len = sizeof(struct rt_rsnie) + (4 * (PairwiseCnt - 1));
+			break;
+		}
 
 		if ((pAd->OpMode == OPMODE_STA) &&
-			(pAd->StaCfg.GroupCipher != Ndis802_11Encryption2Enabled) &&
-			(pAd->StaCfg.GroupCipher != Ndis802_11Encryption3Enabled))
-		{
-			UINT GroupCipher = pAd->StaCfg.GroupCipher;
-			switch(GroupCipher)
-			{
-				case Ndis802_11GroupWEP40Enabled:
-					NdisMoveMemory(pRsnie_cipher->mcast, OUI_WPA_WEP40, 4);
-					break;
-				case Ndis802_11GroupWEP104Enabled:
-					NdisMoveMemory(pRsnie_cipher->mcast, OUI_WPA_WEP104, 4);
-					break;
+		    (pAd->StaCfg.GroupCipher != Ndis802_11Encryption2Enabled) &&
+		    (pAd->StaCfg.GroupCipher != Ndis802_11Encryption3Enabled)) {
+			u32 GroupCipher = pAd->StaCfg.GroupCipher;
+			switch (GroupCipher) {
+			case Ndis802_11GroupWEP40Enabled:
+				NdisMoveMemory(pRsnie_cipher->mcast,
+					       OUI_WPA_WEP40, 4);
+				break;
+			case Ndis802_11GroupWEP104Enabled:
+				NdisMoveMemory(pRsnie_cipher->mcast,
+					       OUI_WPA_WEP104, 4);
+				break;
 			}
 		}
-
-		// swap for big-endian platform
+		/* swap for big-endian platform */
 		pRsnie_cipher->version = cpu2le16(pRsnie_cipher->version);
-	    pRsnie_cipher->ucount = cpu2le16(pRsnie_cipher->ucount);
+		pRsnie_cipher->ucount = cpu2le16(pRsnie_cipher->ucount);
 	}
 }
 
@@ -477,8 +1712,8 @@ static VOID RTMPInsertRsnIeCipher(
 
 	Arguments:
 		pAd			-	pointer to our pAdapter context
-    	ElementID	-	indicate the WPA1 or WPA2
-    	AuthMode	-	indicate the authentication mode
+	ElementID	-	indicate the WPA1 or WPA2
+	AuthMode	-	indicate the authentication mode
 		apidx		-	indicate the interface index
 
 	Return Value:
@@ -487,62 +1722,66 @@ static VOID RTMPInsertRsnIeCipher(
 
 	========================================================================
 */
-static VOID RTMPInsertRsnIeAKM(
-	IN  PRTMP_ADAPTER   pAd,
-	IN	UCHAR			ElementID,
-	IN	UINT			AuthMode,
-	IN	UCHAR			apidx,
-	OUT	PUCHAR			pRsnIe,
-	OUT	UCHAR			*rsn_len)
+static void RTMPMakeRsnIeAKM(struct rt_rtmp_adapter *pAd,
+			     u8 ElementID,
+			     u32 AuthMode,
+			     u8 apidx,
+			     u8 *pRsnIe, u8 * rsn_len)
 {
-	RSNIE_AUTH		*pRsnie_auth;
-
-	pRsnie_auth = (RSNIE_AUTH*)(pRsnIe + (*rsn_len));
+	struct rt_rsnie_auth *pRsnie_auth;
+	u8 AkmCnt = 1;	/* default as 1 */
+
+	pRsnie_auth = (struct rt_rsnie_auth *) (pRsnIe + (*rsn_len));
+
+	/* decide WPA2 or WPA1 */
+	if (ElementID == Wpa2Ie) {
+
+		switch (AuthMode) {
+		case Ndis802_11AuthModeWPA2:
+		case Ndis802_11AuthModeWPA1WPA2:
+			NdisMoveMemory(pRsnie_auth->auth[0].oui,
+				       OUI_WPA2_8021X_AKM, 4);
+			break;
+
+		case Ndis802_11AuthModeWPA2PSK:
+		case Ndis802_11AuthModeWPA1PSKWPA2PSK:
+			NdisMoveMemory(pRsnie_auth->auth[0].oui,
+				       OUI_WPA2_PSK_AKM, 4);
+			break;
+		default:
+			AkmCnt = 0;
+			break;
 
-	// decide WPA2 or WPA1
-	if (ElementID == Wpa2Ie)
-	{
-		switch (AuthMode)
-        {
-            case Ndis802_11AuthModeWPA2:
-            case Ndis802_11AuthModeWPA1WPA2:
-                pRsnie_auth->acount = 1;
-                	NdisMoveMemory(pRsnie_auth->auth[0].oui, OUI_WPA2_8021X_AKM, 4);
-                break;
-
-            case Ndis802_11AuthModeWPA2PSK:
-            case Ndis802_11AuthModeWPA1PSKWPA2PSK:
-                pRsnie_auth->acount = 1;
-                	NdisMoveMemory(pRsnie_auth->auth[0].oui, OUI_WPA2_PSK_AKM, 4);
-                break;
-        }
-	}
-	else
-	{
-		switch (AuthMode)
-        {
-            case Ndis802_11AuthModeWPA:
-            case Ndis802_11AuthModeWPA1WPA2:
-                pRsnie_auth->acount = 1;
-                NdisMoveMemory(pRsnie_auth->auth[0].oui, OUI_WPA_8021X_AKM, 4);
-                break;
-
-            case Ndis802_11AuthModeWPAPSK:
-            case Ndis802_11AuthModeWPA1PSKWPA2PSK:
-                pRsnie_auth->acount = 1;
-                NdisMoveMemory(pRsnie_auth->auth[0].oui, OUI_WPA_PSK_AKM, 4);
-                break;
-
-			case Ndis802_11AuthModeWPANone:
-                pRsnie_auth->acount = 1;
-                NdisMoveMemory(pRsnie_auth->auth[0].oui, OUI_WPA_NONE_AKM, 4);
-                break;
-        }
+		}
+	} else {
+		switch (AuthMode) {
+		case Ndis802_11AuthModeWPA:
+		case Ndis802_11AuthModeWPA1WPA2:
+			NdisMoveMemory(pRsnie_auth->auth[0].oui,
+				       OUI_WPA_8021X_AKM, 4);
+			break;
+
+		case Ndis802_11AuthModeWPAPSK:
+		case Ndis802_11AuthModeWPA1PSKWPA2PSK:
+			NdisMoveMemory(pRsnie_auth->auth[0].oui,
+				       OUI_WPA_PSK_AKM, 4);
+			break;
+
+		case Ndis802_11AuthModeWPANone:
+			NdisMoveMemory(pRsnie_auth->auth[0].oui,
+				       OUI_WPA_NONE_AKM, 4);
+			break;
+		default:
+			AkmCnt = 0;
+			break;
+		}
 	}
 
+	pRsnie_auth->acount = AkmCnt;
 	pRsnie_auth->acount = cpu2le16(pRsnie_auth->acount);
 
-	(*rsn_len) += sizeof(RSNIE_AUTH);	// update current RSNIE length
+	/* update current RSNIE length */
+	(*rsn_len) += (sizeof(struct rt_rsnie_auth) + (4 * (AkmCnt - 1)));
 
 }
 
@@ -555,7 +1794,7 @@ static VOID RTMPInsertRsnIeAKM(
 
 	Arguments:
 		pAd			-	pointer to our pAdapter context
-    	ElementID	-	indicate the WPA1 or WPA2
+	ElementID	-	indicate the WPA1 or WPA2
 		apidx		-	indicate the interface index
 
 	Return Value:
@@ -564,29 +1803,25 @@ static VOID RTMPInsertRsnIeAKM(
 
 	========================================================================
 */
-static VOID RTMPInsertRsnIeCap(
-	IN  PRTMP_ADAPTER   pAd,
-	IN	UCHAR			ElementID,
-	IN	UCHAR			apidx,
-	OUT	PUCHAR			pRsnIe,
-	OUT	UCHAR			*rsn_len)
+static void RTMPMakeRsnIeCap(struct rt_rtmp_adapter *pAd,
+			     u8 ElementID,
+			     u8 apidx,
+			     u8 *pRsnIe, u8 * rsn_len)
 {
-	RSN_CAPABILITIES    *pRSN_Cap;
+	RSN_CAPABILITIES *pRSN_Cap;
 
-	// it could be ignored in WPA1 mode
+	/* it could be ignored in WPA1 mode */
 	if (ElementID == WpaIe)
 		return;
 
-	pRSN_Cap = (RSN_CAPABILITIES*)(pRsnIe + (*rsn_len));
-
+	pRSN_Cap = (RSN_CAPABILITIES *) (pRsnIe + (*rsn_len));
 
 	pRSN_Cap->word = cpu2le16(pRSN_Cap->word);
 
-	(*rsn_len) += sizeof(RSN_CAPABILITIES);	// update current RSNIE length
+	(*rsn_len) += sizeof(RSN_CAPABILITIES);	/* update current RSNIE length */
 
 }
 
-
 /*
 	========================================================================
 
@@ -595,8 +1830,8 @@ static VOID RTMPInsertRsnIeCap(
 
 	Arguments:
 		pAd			-	pointer to our pAdapter context
-    	AuthMode	-	indicate the authentication mode
-    	WepStatus	-	indicate the encryption type
+	AuthMode	-	indicate the authentication mode
+	WepStatus	-	indicate the encryption type
 		apidx		-	indicate the interface index
 
 	Return Value:
@@ -605,48 +1840,43 @@ static VOID RTMPInsertRsnIeCap(
 
 	========================================================================
 */
-VOID RTMPMakeRSNIE(
-    IN  PRTMP_ADAPTER   pAd,
-    IN  UINT            AuthMode,
-    IN  UINT            WepStatus,
-	IN	UCHAR			apidx)
-{
-	PUCHAR		pRsnIe = NULL;			// primary RSNIE
-	UCHAR 		*rsnielen_cur_p = 0;	// the length of the primary RSNIE
-	UCHAR		*rsnielen_ex_cur_p = 0;	// the length of the secondary RSNIE
-	UCHAR		PrimaryRsnie;
-	BOOLEAN		bMixCipher = FALSE;	// indicate the pairwise and group cipher are different
-	UCHAR		p_offset;
-	WPA_MIX_PAIR_CIPHER		FlexibleCipher = WPA_TKIPAES_WPA2_TKIPAES;	// it provide the more flexible cipher combination in WPA-WPA2 and TKIPAES mode
+void RTMPMakeRSNIE(struct rt_rtmp_adapter *pAd,
+		   u32 AuthMode, u32 WepStatus, u8 apidx)
+{
+	u8 *pRsnIe = NULL;	/* primary RSNIE */
+	u8 *rsnielen_cur_p = 0;	/* the length of the primary RSNIE */
+	u8 *rsnielen_ex_cur_p = 0;	/* the length of the secondary RSNIE */
+	u8 PrimaryRsnie;
+	BOOLEAN bMixCipher = FALSE;	/* indicate the pairwise and group cipher are different */
+	u8 p_offset;
+	WPA_MIX_PAIR_CIPHER FlexibleCipher = WPA_TKIPAES_WPA2_TKIPAES;	/* it provide the more flexible cipher combination in WPA-WPA2 and TKIPAES mode */
 
 	rsnielen_cur_p = NULL;
 	rsnielen_ex_cur_p = NULL;
 
 	{
 		{
-			if (pAd->StaCfg.WpaSupplicantUP != WPA_SUPPLICANT_DISABLE)
-			{
+			if (pAd->StaCfg.WpaSupplicantUP !=
+			    WPA_SUPPLICANT_DISABLE) {
 				if (AuthMode < Ndis802_11AuthModeWPA)
 					return;
-			}
-			else
-			{
-				// Support WPAPSK or WPA2PSK in STA-Infra mode
-				// Support WPANone in STA-Adhoc mode
+			} else {
+				/* Support WPAPSK or WPA2PSK in STA-Infra mode */
+				/* Support WPANone in STA-Adhoc mode */
 				if ((AuthMode != Ndis802_11AuthModeWPAPSK) &&
-					(AuthMode != Ndis802_11AuthModeWPA2PSK) &&
-					(AuthMode != Ndis802_11AuthModeWPANone)
-					)
+				    (AuthMode != Ndis802_11AuthModeWPA2PSK) &&
+				    (AuthMode != Ndis802_11AuthModeWPANone)
+				    )
 					return;
 			}
 
-			DBGPRINT(RT_DEBUG_TRACE,("==> RTMPMakeRSNIE(STA)\n"));
+			DBGPRINT(RT_DEBUG_TRACE, ("==> RTMPMakeRSNIE(STA)\n"));
 
-			// Zero RSNIE context
+			/* Zero RSNIE context */
 			pAd->StaCfg.RSNIE_Len = 0;
 			NdisZeroMemory(pAd->StaCfg.RSN_IE, MAX_LEN_OF_RSNIE);
 
-			// Pointer to RSNIE
+			/* Pointer to RSNIE */
 			rsnielen_cur_p = &pAd->StaCfg.RSNIE_Len;
 			pRsnIe = pAd->StaCfg.RSN_IE;
 
@@ -654,34 +1884,35 @@ VOID RTMPMakeRSNIE(
 		}
 	}
 
-	// indicate primary RSNIE as WPA or WPA2
+	/* indicate primary RSNIE as WPA or WPA2 */
 	if ((AuthMode == Ndis802_11AuthModeWPA) ||
-		(AuthMode == Ndis802_11AuthModeWPAPSK) ||
-		(AuthMode == Ndis802_11AuthModeWPANone) ||
-		(AuthMode == Ndis802_11AuthModeWPA1WPA2) ||
-		(AuthMode == Ndis802_11AuthModeWPA1PSKWPA2PSK))
+	    (AuthMode == Ndis802_11AuthModeWPAPSK) ||
+	    (AuthMode == Ndis802_11AuthModeWPANone) ||
+	    (AuthMode == Ndis802_11AuthModeWPA1WPA2) ||
+	    (AuthMode == Ndis802_11AuthModeWPA1PSKWPA2PSK))
 		PrimaryRsnie = WpaIe;
 	else
 		PrimaryRsnie = Wpa2Ie;
 
 	{
-		// Build the primary RSNIE
-		// 1. insert cipher suite
-		RTMPInsertRsnIeCipher(pAd, PrimaryRsnie, WepStatus, bMixCipher, FlexibleCipher, pRsnIe, &p_offset);
+		/* Build the primary RSNIE */
+		/* 1. insert cipher suite */
+		RTMPMakeRsnIeCipher(pAd, PrimaryRsnie, WepStatus, bMixCipher,
+				    FlexibleCipher, pRsnIe, &p_offset);
 
-		// 2. insert AKM
-		RTMPInsertRsnIeAKM(pAd, PrimaryRsnie, AuthMode, apidx, pRsnIe, &p_offset);
+		/* 2. insert AKM */
+		RTMPMakeRsnIeAKM(pAd, PrimaryRsnie, AuthMode, apidx, pRsnIe,
+				 &p_offset);
 
-		// 3. insert capability
-		RTMPInsertRsnIeCap(pAd, PrimaryRsnie, apidx, pRsnIe, &p_offset);
+		/* 3. insert capability */
+		RTMPMakeRsnIeCap(pAd, PrimaryRsnie, apidx, pRsnIe, &p_offset);
 	}
 
-	// 4. update the RSNIE length
+	/* 4. update the RSNIE length */
 	*rsnielen_cur_p = p_offset;
 
 	hex_dump("The primary RSNIE", pRsnIe, (*rsnielen_cur_p));
 
-
 }
 
 /*
@@ -693,144 +1924,1093 @@ VOID RTMPMakeRSNIE(
 		pAd				-	pointer to our pAdapter context
 		pEntry			-	pointer to active entry
 		pData			-	the received frame
-		DataByteCount 	-	the received frame's length
+		DataByteCount	-	the received frame's length
 		FromWhichBSSID	-	indicate the interface index
 
     Return:
-         TRUE 			-	This frame is EAP frame
-         FALSE 			-	otherwise
+         TRUE			-	This frame is EAP frame
+         FALSE			-	otherwise
     ==========================================================================
 */
-BOOLEAN RTMPCheckWPAframe(
-    IN PRTMP_ADAPTER    pAd,
-    IN PMAC_TABLE_ENTRY	pEntry,
-    IN PUCHAR           pData,
-    IN ULONG            DataByteCount,
-	IN UCHAR			FromWhichBSSID)
-{
-	ULONG	Body_len;
+BOOLEAN RTMPCheckWPAframe(struct rt_rtmp_adapter *pAd,
+			  struct rt_mac_table_entry *pEntry,
+			  u8 *pData,
+			  unsigned long DataByteCount, u8 FromWhichBSSID)
+{
+	unsigned long Body_len;
 	BOOLEAN Cancelled;
 
+	if (DataByteCount < (LENGTH_802_1_H + LENGTH_EAPOL_H))
+		return FALSE;
+
+	/* Skip LLC header */
+	if (NdisEqualMemory(SNAP_802_1H, pData, 6) ||
+	    /* Cisco 1200 AP may send packet with SNAP_BRIDGE_TUNNEL */
+	    NdisEqualMemory(SNAP_BRIDGE_TUNNEL, pData, 6)) {
+		pData += 6;
+	}
+	/* Skip 2-bytes EAPoL type */
+	if (NdisEqualMemory(EAPOL, pData, 2)) {
+		pData += 2;
+	} else
+		return FALSE;
+
+	switch (*(pData + 1)) {
+	case EAPPacket:
+		Body_len = (*(pData + 2) << 8) | (*(pData + 3));
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("Receive EAP-Packet frame, TYPE = 0, Length = %ld\n",
+			  Body_len));
+		break;
+	case EAPOLStart:
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("Receive EAPOL-Start frame, TYPE = 1 \n"));
+		if (pEntry->EnqueueEapolStartTimerRunning !=
+		    EAPOL_START_DISABLE) {
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("Cancel the EnqueueEapolStartTimerRunning \n"));
+			RTMPCancelTimer(&pEntry->EnqueueStartForPSKTimer,
+					&Cancelled);
+			pEntry->EnqueueEapolStartTimerRunning =
+			    EAPOL_START_DISABLE;
+		}
+		break;
+	case EAPOLLogoff:
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("Receive EAPOLLogoff frame, TYPE = 2 \n"));
+		break;
+	case EAPOLKey:
+		Body_len = (*(pData + 2) << 8) | (*(pData + 3));
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("Receive EAPOL-Key frame, TYPE = 3, Length = %ld\n",
+			  Body_len));
+		break;
+	case EAPOLASFAlert:
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("Receive EAPOLASFAlert frame, TYPE = 4 \n"));
+		break;
+	default:
+		return FALSE;
+
+	}
+	return TRUE;
+}
+
+/*
+    ==========================================================================
+    Description:
+		Report the EAP message type
+
+	Arguments:
+		msg		-	EAPOL_PAIR_MSG_1
+					EAPOL_PAIR_MSG_2
+					EAPOL_PAIR_MSG_3
+					EAPOL_PAIR_MSG_4
+					EAPOL_GROUP_MSG_1
+					EAPOL_GROUP_MSG_2
+
+    Return:
+         message type string
+
+    ==========================================================================
+*/
+char *GetEapolMsgType(char msg)
+{
+	if (msg == EAPOL_PAIR_MSG_1)
+		return "Pairwise Message 1";
+	else if (msg == EAPOL_PAIR_MSG_2)
+		return "Pairwise Message 2";
+	else if (msg == EAPOL_PAIR_MSG_3)
+		return "Pairwise Message 3";
+	else if (msg == EAPOL_PAIR_MSG_4)
+		return "Pairwise Message 4";
+	else if (msg == EAPOL_GROUP_MSG_1)
+		return "Group Message 1";
+	else if (msg == EAPOL_GROUP_MSG_2)
+		return "Group Message 2";
+	else
+		return "Invalid Message";
+}
+
+/*
+	========================================================================
+
+	Routine Description:
+    Check Sanity RSN IE of EAPoL message
+
+	Arguments:
+
+	Return Value:
+
+	========================================================================
+*/
+BOOLEAN RTMPCheckRSNIE(struct rt_rtmp_adapter *pAd,
+		       u8 *pData,
+		       u8 DataLen,
+		       struct rt_mac_table_entry *pEntry, u8 * Offset)
+{
+	u8 *pVIE;
+	u8 len;
+	struct rt_eid * pEid;
+	BOOLEAN result = FALSE;
+
+	pVIE = pData;
+	len = DataLen;
+	*Offset = 0;
+
+	while (len > sizeof(struct rt_rsnie2)) {
+		pEid = (struct rt_eid *) pVIE;
+		/* WPA RSN IE */
+		if ((pEid->Eid == IE_WPA)
+		    && (NdisEqualMemory(pEid->Octet, WPA_OUI, 4))) {
+			if ((pEntry->AuthMode == Ndis802_11AuthModeWPA
+			     || pEntry->AuthMode == Ndis802_11AuthModeWPAPSK)
+			    &&
+			    (NdisEqualMemory
+			     (pVIE, pEntry->RSN_IE, pEntry->RSNIE_Len))
+			    && (pEntry->RSNIE_Len == (pEid->Len + 2))) {
+				result = TRUE;
+			}
+
+			*Offset += (pEid->Len + 2);
+		}
+		/* WPA2 RSN IE */
+		else if ((pEid->Eid == IE_RSN)
+			 && (NdisEqualMemory(pEid->Octet + 2, RSN_OUI, 3))) {
+			if ((pEntry->AuthMode == Ndis802_11AuthModeWPA2
+			     || pEntry->AuthMode == Ndis802_11AuthModeWPA2PSK)
+			    && (pEid->Eid == pEntry->RSN_IE[0])
+			    && ((pEid->Len + 2) >= pEntry->RSNIE_Len)
+			    &&
+			    (NdisEqualMemory
+			     (pEid->Octet, &pEntry->RSN_IE[2],
+			      pEntry->RSNIE_Len - 2))) {
+
+				result = TRUE;
+			}
+
+			*Offset += (pEid->Len + 2);
+		} else {
+			break;
+		}
+
+		pVIE += (pEid->Len + 2);
+		len -= (pEid->Len + 2);
+	}
+
+	return result;
 
-    if(DataByteCount < (LENGTH_802_1_H + LENGTH_EAPOL_H))
-        return FALSE;
-
-
-	// Skip LLC header
-    if (NdisEqualMemory(SNAP_802_1H, pData, 6) ||
-        // Cisco 1200 AP may send packet with SNAP_BRIDGE_TUNNEL
-        NdisEqualMemory(SNAP_BRIDGE_TUNNEL, pData, 6))
-    {
-        pData += 6;
-    }
-	// Skip 2-bytes EAPoL type
-    if (NdisEqualMemory(EAPOL, pData, 2))
-    {
-        pData += 2;
-    }
-    else
-        return FALSE;
-
-    switch (*(pData+1))
-    {
-        case EAPPacket:
-			Body_len = (*(pData+2)<<8) | (*(pData+3));
-            DBGPRINT(RT_DEBUG_TRACE, ("Receive EAP-Packet frame, TYPE = 0, Length = %ld\n", Body_len));
-            break;
-        case EAPOLStart:
-            DBGPRINT(RT_DEBUG_TRACE, ("Receive EAPOL-Start frame, TYPE = 1 \n"));
-			if (pEntry->EnqueueEapolStartTimerRunning != EAPOL_START_DISABLE)
-            {
-            	DBGPRINT(RT_DEBUG_TRACE, ("Cancel the EnqueueEapolStartTimerRunning \n"));
-                RTMPCancelTimer(&pEntry->EnqueueStartForPSKTimer, &Cancelled);
-                pEntry->EnqueueEapolStartTimerRunning = EAPOL_START_DISABLE;
-            }
-            break;
-        case EAPOLLogoff:
-            DBGPRINT(RT_DEBUG_TRACE, ("Receive EAPOLLogoff frame, TYPE = 2 \n"));
-            break;
-        case EAPOLKey:
-			Body_len = (*(pData+2)<<8) | (*(pData+3));
-            DBGPRINT(RT_DEBUG_TRACE, ("Receive EAPOL-Key frame, TYPE = 3, Length = %ld\n", Body_len));
-            break;
-        case EAPOLASFAlert:
-            DBGPRINT(RT_DEBUG_TRACE, ("Receive EAPOLASFAlert frame, TYPE = 4 \n"));
-            break;
-        default:
-            return FALSE;
-
-    }
-    return TRUE;
 }
 
 /*
 	========================================================================
 
 	Routine Description:
-		Misc function to decrypt AES body
+    Parse KEYDATA field.  KEYDATA[] May contain 2 RSN IE and optionally GTK.
+    GTK  is encaptulated in KDE format at  p.83 802.11i D10
 
 	Arguments:
 
 	Return Value:
 
 	Note:
-		This function references to	RFC	3394 for aes key unwrap algorithm.
+        802.11i D10
 
 	========================================================================
 */
-VOID	AES_GTK_KEY_UNWRAP(
-	IN	UCHAR	*key,
-	OUT	UCHAR	*plaintext,
-	IN	UCHAR    c_len,
-	IN	UCHAR	*ciphertext)
+BOOLEAN RTMPParseEapolKeyData(struct rt_rtmp_adapter *pAd,
+			      u8 *pKeyData,
+			      u8 KeyDataLen,
+			      u8 GroupKeyIndex,
+			      u8 MsgType,
+			      IN BOOLEAN bWPA2, struct rt_mac_table_entry *pEntry)
+{
+	struct rt_kde_encap * pKDE = NULL;
+	u8 *pMyKeyData = pKeyData;
+	u8 KeyDataLength = KeyDataLen;
+	u8 GTKLEN = 0;
+	u8 DefaultIdx = 0;
+	u8 skip_offset;
+
+	/* Verify The RSN IE contained in pairewise_msg_2 && pairewise_msg_3 and skip it */
+	if (MsgType == EAPOL_PAIR_MSG_2 || MsgType == EAPOL_PAIR_MSG_3) {
+		/* Check RSN IE whether it is WPA2/WPA2PSK */
+		if (!RTMPCheckRSNIE
+		    (pAd, pKeyData, KeyDataLen, pEntry, &skip_offset)) {
+			/* send wireless event - for RSN IE different */
+			if (pAd->CommonCfg.bWirelessEvent)
+				RTMPSendWirelessEvent(pAd,
+						      IW_RSNIE_DIFF_EVENT_FLAG,
+						      pEntry->Addr,
+						      pEntry->apidx, 0);
+
+			DBGPRINT(RT_DEBUG_ERROR,
+				 ("RSN_IE Different in msg %d of 4-way handshake!\n",
+				  MsgType));
+			hex_dump("Receive RSN_IE ", pKeyData, KeyDataLen);
+			hex_dump("Desired RSN_IE ", pEntry->RSN_IE,
+				 pEntry->RSNIE_Len);
+
+			return FALSE;
+		} else {
+			if (bWPA2 && MsgType == EAPOL_PAIR_MSG_3) {
+				WpaShowAllsuite(pMyKeyData, skip_offset);
+
+				/* skip RSN IE */
+				pMyKeyData += skip_offset;
+				KeyDataLength -= skip_offset;
+				DBGPRINT(RT_DEBUG_TRACE,
+					 ("RTMPParseEapolKeyData ==> WPA2/WPA2PSK RSN IE matched in Msg 3, Length(%d) \n",
+					  skip_offset));
+			} else
+				return TRUE;
+		}
+	}
+
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("RTMPParseEapolKeyData ==> KeyDataLength %d without RSN_IE \n",
+		  KeyDataLength));
+	/*hex_dump("remain data", pMyKeyData, KeyDataLength); */
+
+	/* Parse EKD format in pairwise_msg_3_WPA2 && group_msg_1_WPA2 */
+	if (bWPA2
+	    && (MsgType == EAPOL_PAIR_MSG_3 || MsgType == EAPOL_GROUP_MSG_1)) {
+		if (KeyDataLength >= 8)	/* KDE format exclude GTK length */
+		{
+			pKDE = (struct rt_kde_encap *) pMyKeyData;
 
+			DefaultIdx = pKDE->GTKEncap.Kid;
+
+			/* Sanity check - KED length */
+			if (KeyDataLength < (pKDE->Len + 2)) {
+				DBGPRINT(RT_DEBUG_ERROR,
+					 ("ERROR: The len from KDE is too short \n"));
+				return FALSE;
+			}
+			/* Get GTK length - refer to IEEE 802.11i-2004 p.82 */
+			GTKLEN = pKDE->Len - 6;
+			if (GTKLEN < LEN_AES_KEY) {
+				DBGPRINT(RT_DEBUG_ERROR,
+					 ("ERROR: GTK Key length is too short (%d) \n",
+					  GTKLEN));
+				return FALSE;
+			}
+
+		} else {
+			DBGPRINT(RT_DEBUG_ERROR,
+				 ("ERROR: KDE format length is too short \n"));
+			return FALSE;
+		}
+
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("GTK in KDE format ,DefaultKeyID=%d, KeyLen=%d \n",
+			  DefaultIdx, GTKLEN));
+		/* skip it */
+		pMyKeyData += 8;
+		KeyDataLength -= 8;
+
+	} else if (!bWPA2 && MsgType == EAPOL_GROUP_MSG_1) {
+		DefaultIdx = GroupKeyIndex;
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("GTK DefaultKeyID=%d \n", DefaultIdx));
+	}
+	/* Sanity check - shared key index must be 1 ~ 3 */
+	if (DefaultIdx < 1 || DefaultIdx > 3) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("ERROR: GTK Key index(%d) is invalid in %s %s \n",
+			  DefaultIdx, ((bWPA2) ? "WPA2" : "WPA"),
+			  GetEapolMsgType(MsgType)));
+		return FALSE;
+	}
+
+	{
+		struct rt_cipher_key *pSharedKey;
+
+		/* set key material, TxMic and RxMic */
+		NdisMoveMemory(pAd->StaCfg.GTK, pMyKeyData, 32);
+		pAd->StaCfg.DefaultKeyId = DefaultIdx;
+
+		pSharedKey = &pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId];
+
+		/* Prepare pair-wise key information into shared key table */
+		NdisZeroMemory(pSharedKey, sizeof(struct rt_cipher_key));
+		pSharedKey->KeyLen = LEN_TKIP_EK;
+		NdisMoveMemory(pSharedKey->Key, pAd->StaCfg.GTK, LEN_TKIP_EK);
+		NdisMoveMemory(pSharedKey->RxMic, &pAd->StaCfg.GTK[16],
+			       LEN_TKIP_RXMICK);
+		NdisMoveMemory(pSharedKey->TxMic, &pAd->StaCfg.GTK[24],
+			       LEN_TKIP_TXMICK);
+
+		/* Update Shared Key CipherAlg */
+		pSharedKey->CipherAlg = CIPHER_NONE;
+		if (pAd->StaCfg.GroupCipher == Ndis802_11Encryption2Enabled)
+			pSharedKey->CipherAlg = CIPHER_TKIP;
+		else if (pAd->StaCfg.GroupCipher ==
+			 Ndis802_11Encryption3Enabled)
+			pSharedKey->CipherAlg = CIPHER_AES;
+		else if (pAd->StaCfg.GroupCipher == Ndis802_11GroupWEP40Enabled)
+			pSharedKey->CipherAlg = CIPHER_WEP64;
+		else if (pAd->StaCfg.GroupCipher ==
+			 Ndis802_11GroupWEP104Enabled)
+			pSharedKey->CipherAlg = CIPHER_WEP128;
+
+		/* Update group key information to ASIC Shared Key Table */
+		AsicAddSharedKeyEntry(pAd,
+				      BSS0,
+				      pAd->StaCfg.DefaultKeyId,
+				      pSharedKey->CipherAlg,
+				      pSharedKey->Key,
+				      pSharedKey->TxMic, pSharedKey->RxMic);
+
+		/* Update ASIC WCID attribute table and IVEIV table */
+		RTMPAddWcidAttributeEntry(pAd,
+					  BSS0,
+					  pAd->StaCfg.DefaultKeyId,
+					  pSharedKey->CipherAlg, NULL);
+	}
+
+	return TRUE;
+
+}
+
+/*
+	========================================================================
+
+	Routine Description:
+		Construct EAPoL message for WPA handshaking
+		Its format is below,
+
+		+--------------------+
+		| Protocol Version	 |  1 octet
+		+--------------------+
+		| Protocol Type		 |	1 octet
+		+--------------------+
+		| Body Length		 |  2 octets
+		+--------------------+
+		| Descriptor Type	 |	1 octet
+		+--------------------+
+		| Key Information    |	2 octets
+		+--------------------+
+		| Key Length	     |  1 octet
+		+--------------------+
+		| Key Repaly Counter |	8 octets
+		+--------------------+
+		| Key Nonce		     |  32 octets
+		+--------------------+
+		| Key IV			 |  16 octets
+		+--------------------+
+		| Key RSC			 |  8 octets
+		+--------------------+
+		| Key ID or Reserved |	8 octets
+		+--------------------+
+		| Key MIC			 |	16 octets
+		+--------------------+
+		| Key Data Length	 |	2 octets
+		+--------------------+
+		| Key Data			 |	n octets
+		+--------------------+
+
+	Arguments:
+		pAd			Pointer	to our adapter
+
+	Return Value:
+		None
+
+	Note:
+
+	========================================================================
+*/
+void ConstructEapolMsg(struct rt_mac_table_entry *pEntry,
+		       u8 GroupKeyWepStatus,
+		       u8 MsgType,
+		       u8 DefaultKeyIdx,
+		       u8 * KeyNonce,
+		       u8 * TxRSC,
+		       u8 * GTK,
+		       u8 * RSNIE,
+		       u8 RSNIE_Len, struct rt_eapol_packet * pMsg)
 {
-	UCHAR       A[8], BIN[16], BOUT[16];
-	UCHAR       xor;
-	INT         i, j;
-	aes_context aesctx;
-	UCHAR       *R;
-	INT         num_blocks = c_len/8;	// unit:64bits
+	BOOLEAN bWPA2 = FALSE;
+	u8 KeyDescVer;
 
+	/* Choose WPA2 or not */
+	if ((pEntry->AuthMode == Ndis802_11AuthModeWPA2) ||
+	    (pEntry->AuthMode == Ndis802_11AuthModeWPA2PSK))
+		bWPA2 = TRUE;
 
-	os_alloc_mem(NULL, (PUCHAR *)&R, 512);
+	/* Init Packet and Fill header */
+	pMsg->ProVer = EAPOL_VER;
+	pMsg->ProType = EAPOLKey;
 
-	if (R == NULL)
-    {
-        DBGPRINT(RT_DEBUG_ERROR, ("!!!AES_GTK_KEY_UNWRAP: no memory!!!\n"));
-        return;
-    } /* End of if */
+	/* Default 95 bytes, the EAPoL-Key descriptor exclude Key-data field */
+	SET_u16_TO_ARRARY(pMsg->Body_Len, LEN_EAPOL_KEY_MSG);
 
-	// Initialize
-	NdisMoveMemory(A, ciphertext, 8);
-	//Input plaintext
-	for(i = 0; i < (c_len-8); i++)
+	/* Fill in EAPoL descriptor */
+	if (bWPA2)
+		pMsg->KeyDesc.Type = WPA2_KEY_DESC;
+	else
+		pMsg->KeyDesc.Type = WPA1_KEY_DESC;
+
+	/* Key Descriptor Version (bits 0-2) specifies the key descriptor version type */
 	{
-		R[ i] = ciphertext[i + 8];
+		/* Fill in Key information, refer to IEEE Std 802.11i-2004 page 78 */
+		/* When either the pairwise or the group cipher is AES, the DESC_TYPE_AES(2) shall be used. */
+		KeyDescVer =
+		    (((pEntry->WepStatus == Ndis802_11Encryption3Enabled)
+		      || (GroupKeyWepStatus ==
+			  Ndis802_11Encryption3Enabled)) ? (DESC_TYPE_AES)
+		     : (DESC_TYPE_TKIP));
 	}
 
-	rtmp_aes_set_key(&aesctx, key, 128);
+	pMsg->KeyDesc.KeyInfo.KeyDescVer = KeyDescVer;
+
+	/* Specify Key Type as Group(0) or Pairwise(1) */
+	if (MsgType >= EAPOL_GROUP_MSG_1)
+		pMsg->KeyDesc.KeyInfo.KeyType = GROUPKEY;
+	else
+		pMsg->KeyDesc.KeyInfo.KeyType = PAIRWISEKEY;
+
+	/* Specify Key Index, only group_msg1_WPA1 */
+	if (!bWPA2 && (MsgType >= EAPOL_GROUP_MSG_1))
+		pMsg->KeyDesc.KeyInfo.KeyIndex = DefaultKeyIdx;
+
+	if (MsgType == EAPOL_PAIR_MSG_3)
+		pMsg->KeyDesc.KeyInfo.Install = 1;
+
+	if ((MsgType == EAPOL_PAIR_MSG_1) || (MsgType == EAPOL_PAIR_MSG_3)
+	    || (MsgType == EAPOL_GROUP_MSG_1))
+		pMsg->KeyDesc.KeyInfo.KeyAck = 1;
+
+	if (MsgType != EAPOL_PAIR_MSG_1)
+		pMsg->KeyDesc.KeyInfo.KeyMic = 1;
+
+	if ((bWPA2 && (MsgType >= EAPOL_PAIR_MSG_3)) ||
+	    (!bWPA2 && (MsgType >= EAPOL_GROUP_MSG_1))) {
+		pMsg->KeyDesc.KeyInfo.Secure = 1;
+	}
 
-	for(j = 5; j >= 0; j--)
+	if (bWPA2 && ((MsgType == EAPOL_PAIR_MSG_3) ||
+		      (MsgType == EAPOL_GROUP_MSG_1))) {
+		pMsg->KeyDesc.KeyInfo.EKD_DL = 1;
+	}
+	/* key Information element has done. */
+	*(u16 *) (&pMsg->KeyDesc.KeyInfo) =
+	    cpu2le16(*(u16 *) (&pMsg->KeyDesc.KeyInfo));
+
+	/* Fill in Key Length */
 	{
-		for(i = (num_blocks-1); i > 0; i--)
-		{
-			xor = (num_blocks -1 )* j + i;
-			NdisMoveMemory(BIN, A, 8);
-			BIN[7] = A[7] ^ xor;
-			NdisMoveMemory(&BIN[8], &R[(i-1)*8], 8);
-			rtmp_aes_decrypt(&aesctx, BIN, BOUT);
-			NdisMoveMemory(A, &BOUT[0], 8);
-			NdisMoveMemory(&R[(i-1)*8], &BOUT[8], 8);
+		if (MsgType >= EAPOL_GROUP_MSG_1) {
+			/* the length of group key cipher */
+			pMsg->KeyDesc.KeyLength[1] =
+			    ((GroupKeyWepStatus ==
+			      Ndis802_11Encryption2Enabled) ? TKIP_GTK_LENGTH :
+			     LEN_AES_KEY);
+		} else {
+			/* the length of pairwise key cipher */
+			pMsg->KeyDesc.KeyLength[1] =
+			    ((pEntry->WepStatus ==
+			      Ndis802_11Encryption2Enabled) ? LEN_TKIP_KEY :
+			     LEN_AES_KEY);
 		}
 	}
 
-	// OUTPUT
-	for(i = 0; i < c_len; i++)
-	{
-		plaintext[i] = R[i];
+	/* Fill in replay counter */
+	NdisMoveMemory(pMsg->KeyDesc.ReplayCounter, pEntry->R_Counter,
+		       LEN_KEY_DESC_REPLAY);
+
+	/* Fill Key Nonce field */
+	/* ANonce : pairwise_msg1 & pairwise_msg3 */
+	/* SNonce : pairwise_msg2 */
+	/* GNonce : group_msg1_wpa1 */
+	if ((MsgType <= EAPOL_PAIR_MSG_3)
+	    || ((!bWPA2 && (MsgType == EAPOL_GROUP_MSG_1))))
+		NdisMoveMemory(pMsg->KeyDesc.KeyNonce, KeyNonce,
+			       LEN_KEY_DESC_NONCE);
+
+	/* Fill key IV - WPA2 as 0, WPA1 as random */
+	if (!bWPA2 && (MsgType == EAPOL_GROUP_MSG_1)) {
+		/* Suggest IV be random number plus some number, */
+		NdisMoveMemory(pMsg->KeyDesc.KeyIv, &KeyNonce[16],
+			       LEN_KEY_DESC_IV);
+		pMsg->KeyDesc.KeyIv[15] += 2;
+	}
+	/* Fill Key RSC field */
+	/* It contains the RSC for the GTK being installed. */
+	if ((MsgType == EAPOL_PAIR_MSG_3 && bWPA2)
+	    || (MsgType == EAPOL_GROUP_MSG_1)) {
+		NdisMoveMemory(pMsg->KeyDesc.KeyRsc, TxRSC, 6);
+	}
+	/* Clear Key MIC field for MIC calculation later */
+	NdisZeroMemory(pMsg->KeyDesc.KeyMic, LEN_KEY_DESC_MIC);
+
+	ConstructEapolKeyData(pEntry,
+			      GroupKeyWepStatus,
+			      KeyDescVer,
+			      MsgType,
+			      DefaultKeyIdx, GTK, RSNIE, RSNIE_Len, pMsg);
+
+	/* Calculate MIC and fill in KeyMic Field except Pairwise Msg 1. */
+	if (MsgType != EAPOL_PAIR_MSG_1) {
+		CalculateMIC(KeyDescVer, pEntry->PTK, pMsg);
+	}
+
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("===> ConstructEapolMsg for %s %s\n",
+		  ((bWPA2) ? "WPA2" : "WPA"), GetEapolMsgType(MsgType)));
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("	     Body length = %d \n",
+		  CONV_ARRARY_TO_u16(pMsg->Body_Len)));
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("	     Key length  = %d \n",
+		  CONV_ARRARY_TO_u16(pMsg->KeyDesc.KeyLength)));
+
+}
+
+/*
+	========================================================================
+
+	Routine Description:
+		Construct the Key Data field of EAPoL message
+
+	Arguments:
+		pAd			Pointer	to our adapter
+		Elem		Message body
+
+	Return Value:
+		None
+
+	Note:
+
+	========================================================================
+*/
+void ConstructEapolKeyData(struct rt_mac_table_entry *pEntry,
+			   u8 GroupKeyWepStatus,
+			   u8 keyDescVer,
+			   u8 MsgType,
+			   u8 DefaultKeyIdx,
+			   u8 * GTK,
+			   u8 * RSNIE,
+			   u8 RSNIE_LEN, struct rt_eapol_packet * pMsg)
+{
+	u8 *mpool, *Key_Data, *Rc4GTK;
+	u8 ekey[(LEN_KEY_DESC_IV + LEN_EAP_EK)];
+	unsigned long data_offset;
+	BOOLEAN bWPA2Capable = FALSE;
+	struct rt_rtmp_adapter *pAd = pEntry->pAd;
+	BOOLEAN GTK_Included = FALSE;
+
+	/* Choose WPA2 or not */
+	if ((pEntry->AuthMode == Ndis802_11AuthModeWPA2) ||
+	    (pEntry->AuthMode == Ndis802_11AuthModeWPA2PSK))
+		bWPA2Capable = TRUE;
+
+	if (MsgType == EAPOL_PAIR_MSG_1 ||
+	    MsgType == EAPOL_PAIR_MSG_4 || MsgType == EAPOL_GROUP_MSG_2)
+		return;
+
+	/* allocate memory pool */
+	os_alloc_mem(NULL, (u8 **) & mpool, 1500);
+
+	if (mpool == NULL)
+		return;
+
+	/* Rc4GTK Len = 512 */
+	Rc4GTK = (u8 *) ROUND_UP(mpool, 4);
+	/* Key_Data Len = 512 */
+	Key_Data = (u8 *) ROUND_UP(Rc4GTK + 512, 4);
+
+	NdisZeroMemory(Key_Data, 512);
+	SET_u16_TO_ARRARY(pMsg->KeyDesc.KeyDataLen, 0);
+	data_offset = 0;
+
+	/* Encapsulate RSNIE in pairwise_msg2 & pairwise_msg3 */
+	if (RSNIE_LEN
+	    && ((MsgType == EAPOL_PAIR_MSG_2)
+		|| (MsgType == EAPOL_PAIR_MSG_3))) {
+		u8 *pmkid_ptr = NULL;
+		u8 pmkid_len = 0;
+
+		RTMPInsertRSNIE(&Key_Data[data_offset],
+				&data_offset,
+				RSNIE, RSNIE_LEN, pmkid_ptr, pmkid_len);
+	}
+
+	/* Encapsulate KDE format in pairwise_msg3_WPA2 & group_msg1_WPA2 */
+	if (bWPA2Capable
+	    && ((MsgType == EAPOL_PAIR_MSG_3)
+		|| (MsgType == EAPOL_GROUP_MSG_1))) {
+		/* Key Data Encapsulation (KDE) format - 802.11i-2004  Figure-43w and Table-20h */
+		Key_Data[data_offset + 0] = 0xDD;
+
+		if (GroupKeyWepStatus == Ndis802_11Encryption3Enabled) {
+			Key_Data[data_offset + 1] = 0x16;	/* 4+2+16(OUI+DataType+DataField) */
+		} else {
+			Key_Data[data_offset + 1] = 0x26;	/* 4+2+32(OUI+DataType+DataField) */
+		}
+
+		Key_Data[data_offset + 2] = 0x00;
+		Key_Data[data_offset + 3] = 0x0F;
+		Key_Data[data_offset + 4] = 0xAC;
+		Key_Data[data_offset + 5] = 0x01;
+
+		/* GTK KDE format - 802.11i-2004  Figure-43x */
+		Key_Data[data_offset + 6] = (DefaultKeyIdx & 0x03);
+		Key_Data[data_offset + 7] = 0x00;	/* Reserved Byte */
+
+		data_offset += 8;
+	}
+
+	/* Encapsulate GTK */
+	/* Only for pairwise_msg3_WPA2 and group_msg1 */
+	if ((MsgType == EAPOL_PAIR_MSG_3 && bWPA2Capable)
+	    || (MsgType == EAPOL_GROUP_MSG_1)) {
+		/* Fill in GTK */
+		if (GroupKeyWepStatus == Ndis802_11Encryption3Enabled) {
+			NdisMoveMemory(&Key_Data[data_offset], GTK,
+				       LEN_AES_KEY);
+			data_offset += LEN_AES_KEY;
+		} else {
+			NdisMoveMemory(&Key_Data[data_offset], GTK,
+				       TKIP_GTK_LENGTH);
+			data_offset += TKIP_GTK_LENGTH;
+		}
+
+		GTK_Included = TRUE;
+	}
+
+	/* This whole key-data field shall be encrypted if a GTK is included. */
+	/* Encrypt the data material in key data field with KEK */
+	if (GTK_Included) {
+		/*hex_dump("GTK_Included", Key_Data, data_offset); */
+
+		if ((keyDescVer == DESC_TYPE_AES)) {
+			u8 remainder = 0;
+			u8 pad_len = 0;
+
+			/* Key Descriptor Version 2 or 3: AES key wrap, defined in IETF RFC 3394, */
+			/* shall be used to encrypt the Key Data field using the KEK field from */
+			/* the derived PTK. */
+
+			/* If the Key Data field uses the NIST AES key wrap, then the Key Data field */
+			/* shall be padded before encrypting if the key data length is less than 16 */
+			/* octets or if it is not a multiple of 8. The padding consists of appending */
+			/* a single octet 0xdd followed by zero or more 0x00 octets. */
+			if ((remainder = data_offset & 0x07) != 0) {
+				int i;
+
+				pad_len = (8 - remainder);
+				Key_Data[data_offset] = 0xDD;
+				for (i = 1; i < pad_len; i++)
+					Key_Data[data_offset + i] = 0;
+
+				data_offset += pad_len;
+			}
+
+			AES_GTK_KEY_WRAP(&pEntry->PTK[16], Key_Data,
+					 data_offset, Rc4GTK);
+			/* AES wrap function will grow 8 bytes in length */
+			data_offset += 8;
+		} else {
+			/*      Key Descriptor Version 1: ARC4 is used to encrypt the Key Data field
+			   using the KEK field from the derived PTK. */
+
+			/* PREPARE Encrypted  "Key DATA" field.  (Encrypt GTK with RC4, usinf PTK[16]->[31] as Key, IV-field as IV) */
+			/* put TxTsc in Key RSC field */
+			pAd->PrivateInfo.FCSCRC32 = PPPINITFCS32;	/*Init crc32. */
+
+			/* ekey is the contanetion of IV-field, and PTK[16]->PTK[31] */
+			NdisMoveMemory(ekey, pMsg->KeyDesc.KeyIv,
+				       LEN_KEY_DESC_IV);
+			NdisMoveMemory(&ekey[LEN_KEY_DESC_IV], &pEntry->PTK[16],
+				       LEN_EAP_EK);
+			ARCFOUR_INIT(&pAd->PrivateInfo.WEPCONTEXT, ekey, sizeof(ekey));	/*INIT SBOX, KEYLEN+3(IV) */
+			pAd->PrivateInfo.FCSCRC32 =
+			    RTMP_CALC_FCS32(pAd->PrivateInfo.FCSCRC32, Key_Data,
+					    data_offset);
+			WPAARCFOUR_ENCRYPT(&pAd->PrivateInfo.WEPCONTEXT, Rc4GTK,
+					   Key_Data, data_offset);
+		}
+
+		NdisMoveMemory(pMsg->KeyDesc.KeyData, Rc4GTK, data_offset);
+	} else {
+		NdisMoveMemory(pMsg->KeyDesc.KeyData, Key_Data, data_offset);
+	}
+
+	/* Update key data length field and total body length */
+	SET_u16_TO_ARRARY(pMsg->KeyDesc.KeyDataLen, data_offset);
+	INC_u16_TO_ARRARY(pMsg->Body_Len, data_offset);
+
+	os_free_mem(NULL, mpool);
+
+}
+
+/*
+	========================================================================
+
+	Routine Description:
+		Calcaulate MIC. It is used during 4-ways handsharking.
+
+	Arguments:
+		pAd			-	pointer to our pAdapter context
+	PeerWepStatus	-	indicate the encryption type
+
+	Return Value:
+
+	Note:
+
+	========================================================================
+*/
+static void CalculateMIC(u8 KeyDescVer,
+			 u8 * PTK, struct rt_eapol_packet * pMsg)
+{
+	u8 *OutBuffer;
+	unsigned long FrameLen = 0;
+	u8 mic[LEN_KEY_DESC_MIC];
+	u8 digest[80];
+
+	/* allocate memory for MIC calculation */
+	os_alloc_mem(NULL, (u8 **) & OutBuffer, 512);
+
+	if (OutBuffer == NULL) {
+		DBGPRINT(RT_DEBUG_ERROR, ("CalculateMIC: no memory!\n"));
+		return;
+	}
+	/* make a frame for calculating MIC. */
+	MakeOutgoingFrame(OutBuffer, &FrameLen,
+			  CONV_ARRARY_TO_u16(pMsg->Body_Len) + 4, pMsg,
+			  END_OF_ARGS);
+
+	NdisZeroMemory(mic, sizeof(mic));
+
+	/* Calculate MIC */
+	if (KeyDescVer == DESC_TYPE_AES) {
+		HMAC_SHA1(PTK, LEN_EAP_MICK, OutBuffer, FrameLen, digest,
+			  SHA1_DIGEST_SIZE);
+		NdisMoveMemory(mic, digest, LEN_KEY_DESC_MIC);
+	} else {
+		HMAC_MD5(PTK, LEN_EAP_MICK, OutBuffer, FrameLen, mic,
+			 MD5_DIGEST_SIZE);
 	}
 
+	/* store the calculated MIC */
+	NdisMoveMemory(pMsg->KeyDesc.KeyMic, mic, LEN_KEY_DESC_MIC);
+
+	os_free_mem(NULL, OutBuffer);
+}
+
+/*
+	========================================================================
+
+	Routine Description:
+		Some received frames can't decrypt by Asic, so decrypt them by software.
+
+	Arguments:
+		pAd			-	pointer to our pAdapter context
+	PeerWepStatus	-	indicate the encryption type
+
+	Return Value:
+		NDIS_STATUS_SUCCESS		-	decryption successful
+		NDIS_STATUS_FAILURE		-	decryption failure
+
+	========================================================================
+*/
+int RTMPSoftDecryptBroadCastData(struct rt_rtmp_adapter *pAd,
+					 struct rt_rx_blk *pRxBlk,
+					 IN NDIS_802_11_ENCRYPTION_STATUS
+					 GroupCipher, struct rt_cipher_key *pShard_key)
+{
+	struct rt_rxwi * pRxWI = pRxBlk->pRxWI;
+
+	/* handle WEP decryption */
+	if (GroupCipher == Ndis802_11Encryption1Enabled) {
+		if (RTMPSoftDecryptWEP
+		    (pAd, pRxBlk->pData, pRxWI->MPDUtotalByteCount,
+		     pShard_key)) {
+
+			/*Minus IV[4] & ICV[4] */
+			pRxWI->MPDUtotalByteCount -= 8;
+		} else {
+			DBGPRINT(RT_DEBUG_ERROR,
+				 ("ERROR : Software decrypt WEP data fails.\n"));
+			/* give up this frame */
+			return NDIS_STATUS_FAILURE;
+		}
+	}
+	/* handle TKIP decryption */
+	else if (GroupCipher == Ndis802_11Encryption2Enabled) {
+		if (RTMPSoftDecryptTKIP
+		    (pAd, pRxBlk->pData, pRxWI->MPDUtotalByteCount, 0,
+		     pShard_key)) {
+
+			/*Minus 8 bytes MIC, 8 bytes IV/EIV, 4 bytes ICV */
+			pRxWI->MPDUtotalByteCount -= 20;
+		} else {
+			DBGPRINT(RT_DEBUG_ERROR,
+				 ("ERROR : RTMPSoftDecryptTKIP Failed\n"));
+			/* give up this frame */
+			return NDIS_STATUS_FAILURE;
+		}
+	}
+	/* handle AES decryption */
+	else if (GroupCipher == Ndis802_11Encryption3Enabled) {
+		if (RTMPSoftDecryptAES
+		    (pAd, pRxBlk->pData, pRxWI->MPDUtotalByteCount,
+		     pShard_key)) {
+
+			/*8 bytes MIC, 8 bytes IV/EIV (CCMP Header) */
+			pRxWI->MPDUtotalByteCount -= 16;
+		} else {
+			DBGPRINT(RT_DEBUG_ERROR,
+				 ("ERROR : RTMPSoftDecryptAES Failed\n"));
+			/* give up this frame */
+			return NDIS_STATUS_FAILURE;
+		}
+	} else {
+		/* give up this frame */
+		return NDIS_STATUS_FAILURE;
+	}
+
+	return NDIS_STATUS_SUCCESS;
+
+}
+
+u8 *GetSuiteFromRSNIE(u8 *rsnie,
+			 u32 rsnie_len, u8 type, u8 * count)
+{
+	struct rt_eid * pEid;
+	int len;
+	u8 *pBuf;
+	int offset = 0;
+	struct rt_rsnie_auth *pAkm;
+	u16 acount;
+	BOOLEAN isWPA2 = FALSE;
+
+	pEid = (struct rt_eid *) rsnie;
+	len = rsnie_len - 2;	/* exclude IE and length */
+	pBuf = (u8 *)& pEid->Octet[0];
+
+	/* set default value */
+	*count = 0;
+
+	/* Check length */
+	if ((len <= 0) || (pEid->Len != len)) {
+		DBGPRINT_ERR(("%s : The length is invalid\n", __func__));
+		return NULL;
+	}
+	/* Check WPA or WPA2 */
+	if (pEid->Eid == IE_WPA) {
+		struct rt_rsnie *pRsnie = (struct rt_rsnie *)pBuf;
+		u16 ucount;
+
+		if (len < sizeof(struct rt_rsnie)) {
+			DBGPRINT_ERR(("%s : The length is too short for WPA\n",
+				      __func__));
+			return NULL;
+		}
+		/* Get the count of pairwise cipher */
+		ucount = cpu2le16(pRsnie->ucount);
+		if (ucount > 2) {
+			DBGPRINT_ERR(("%s : The count(%d) of pairwise cipher is invlaid\n", __func__, ucount));
+			return NULL;
+		}
+		/* Get the group cipher */
+		if (type == GROUP_SUITE) {
+			*count = 1;
+			return pRsnie->mcast;
+		}
+		/* Get the pairwise cipher suite */
+		else if (type == PAIRWISE_SUITE) {
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("%s : The count of pairwise cipher is %d\n",
+				  __func__, ucount));
+			*count = ucount;
+			return pRsnie->ucast[0].oui;
+		}
+
+		offset = sizeof(struct rt_rsnie) + (4 * (ucount - 1));
+
+	} else if (pEid->Eid == IE_RSN) {
+		struct rt_rsnie2 *pRsnie = (struct rt_rsnie2 *)pBuf;
+		u16 ucount;
+
+		isWPA2 = TRUE;
+
+		if (len < sizeof(struct rt_rsnie2)) {
+			DBGPRINT_ERR(("%s : The length is too short for WPA2\n",
+				      __func__));
+			return NULL;
+		}
+		/* Get the count of pairwise cipher */
+		ucount = cpu2le16(pRsnie->ucount);
+		if (ucount > 2) {
+			DBGPRINT_ERR(("%s : The count(%d) of pairwise cipher is invlaid\n", __func__, ucount));
+			return NULL;
+		}
+		/* Get the group cipher */
+		if (type == GROUP_SUITE) {
+			*count = 1;
+			return pRsnie->mcast;
+		}
+		/* Get the pairwise cipher suite */
+		else if (type == PAIRWISE_SUITE) {
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("%s : The count of pairwise cipher is %d\n",
+				  __func__, ucount));
+			*count = ucount;
+			return pRsnie->ucast[0].oui;
+		}
+
+		offset = sizeof(struct rt_rsnie2) + (4 * (ucount - 1));
+
+	} else {
+		DBGPRINT_ERR(("%s : Unknown IE (%d)\n", __func__, pEid->Eid));
+		return NULL;
+	}
+
+	/* skip group cipher and pairwise cipher suite */
+	pBuf += offset;
+	len -= offset;
+
+	if (len < sizeof(struct rt_rsnie_auth)) {
+		DBGPRINT_ERR(("%s : The length of RSNIE is too short\n",
+			      __func__));
+		return NULL;
+	}
+	/* pointer to AKM count */
+	pAkm = (struct rt_rsnie_auth *)pBuf;
+
+	/* Get the count of pairwise cipher */
+	acount = cpu2le16(pAkm->acount);
+	if (acount > 2) {
+		DBGPRINT_ERR(("%s : The count(%d) of AKM is invlaid\n",
+			      __func__, acount));
+		return NULL;
+	}
+	/* Get the AKM suite */
+	if (type == AKM_SUITE) {
+		DBGPRINT(RT_DEBUG_TRACE, ("%s : The count of AKM is %d\n",
+					  __func__, acount));
+		*count = acount;
+		return pAkm->auth[0].oui;
+	}
+	offset = sizeof(struct rt_rsnie_auth) + (4 * (acount - 1));
+
+	pBuf += offset;
+	len -= offset;
+
+	/* The remaining length must larger than (RSN-Capability(2) + PMKID-Count(2) + PMKID(16~)) */
+	if (len >= (sizeof(RSN_CAPABILITIES) + 2 + LEN_PMKID)) {
+		/* Skip RSN capability and PMKID-Count */
+		pBuf += (sizeof(RSN_CAPABILITIES) + 2);
+		len -= (sizeof(RSN_CAPABILITIES) + 2);
+
+		/* Get PMKID */
+		if (type == PMKID_LIST) {
+			*count = 1;
+			return pBuf;
+		}
+	} else {
+		DBGPRINT_ERR(("%s : it can't get any more information beyond AKM \n", __func__));
+		return NULL;
+	}
+
+	*count = 0;
+	/*DBGPRINT_ERR(("%s : The type(%d) doesn't support \n", __func__, type)); */
+	return NULL;
+
+}
+
+void WpaShowAllsuite(u8 *rsnie, u32 rsnie_len)
+{
+	u8 *pSuite = NULL;
+	u8 count;
+
+	hex_dump("RSNIE", rsnie, rsnie_len);
+
+	/* group cipher */
+	if ((pSuite =
+	     GetSuiteFromRSNIE(rsnie, rsnie_len, GROUP_SUITE,
+			       &count)) != NULL) {
+		hex_dump("group cipher", pSuite, 4 * count);
+	}
+	/* pairwise cipher */
+	if ((pSuite =
+	     GetSuiteFromRSNIE(rsnie, rsnie_len, PAIRWISE_SUITE,
+			       &count)) != NULL) {
+		hex_dump("pairwise cipher", pSuite, 4 * count);
+	}
+	/* AKM */
+	if ((pSuite =
+	     GetSuiteFromRSNIE(rsnie, rsnie_len, AKM_SUITE, &count)) != NULL) {
+		hex_dump("AKM suite", pSuite, 4 * count);
+	}
+	/* PMKID */
+	if ((pSuite =
+	     GetSuiteFromRSNIE(rsnie, rsnie_len, PMKID_LIST, &count)) != NULL) {
+		hex_dump("PMKID", pSuite, LEN_PMKID);
+	}
+
+}
+
+void RTMPInsertRSNIE(u8 *pFrameBuf,
+		     unsigned long *pFrameLen,
+		     u8 *rsnie_ptr,
+		     u8 rsnie_len,
+		     u8 *pmkid_ptr, u8 pmkid_len)
+{
+	u8 *pTmpBuf;
+	unsigned long TempLen = 0;
+	u8 extra_len = 0;
+	u16 pmk_count = 0;
+	u8 ie_num;
+	u8 total_len = 0;
+	u8 WPA2_OUI[3] = { 0x00, 0x0F, 0xAC };
+
+	pTmpBuf = pFrameBuf;
+
+	/* PMKID-List Must larger than 0 and the multiple of 16. */
+	if (pmkid_len > 0 && ((pmkid_len & 0x0f) == 0)) {
+		extra_len = sizeof(u16)+ pmkid_len;
+
+		pmk_count = (pmkid_len >> 4);
+		pmk_count = cpu2le16(pmk_count);
+	} else {
+		DBGPRINT(RT_DEBUG_WARN,
+			 ("%s : The length is PMKID-List is invalid (%d), so don't insert it.\n",
+			  __func__, pmkid_len));
+	}
+
+	if (rsnie_len != 0) {
+		ie_num = IE_WPA;
+		total_len = rsnie_len;
+
+		if (NdisEqualMemory(rsnie_ptr + 2, WPA2_OUI, sizeof(WPA2_OUI))) {
+			ie_num = IE_RSN;
+			total_len += extra_len;
+		}
+
+		/* construct RSNIE body */
+		MakeOutgoingFrame(pTmpBuf, &TempLen,
+				  1, &ie_num,
+				  1, &total_len,
+				  rsnie_len, rsnie_ptr, END_OF_ARGS);
+
+		pTmpBuf += TempLen;
+		*pFrameLen = *pFrameLen + TempLen;
+
+		if (ie_num == IE_RSN) {
+			/* Insert PMKID-List field */
+			if (extra_len > 0) {
+				MakeOutgoingFrame(pTmpBuf, &TempLen,
+						  2, &pmk_count,
+						  pmkid_len, pmkid_ptr,
+						  END_OF_ARGS);
+
+				pTmpBuf += TempLen;
+				*pFrameLen = *pFrameLen + TempLen;
+			}
+		}
+	}
 
-	os_free_mem(NULL, R);
+	return;
 }
diff --git a/drivers/staging/rt2860/common/crypt_hmac.c b/drivers/staging/rt2860/common/crypt_hmac.c
new file mode 100644
index 000000000000..d7ab08ec1a41
--- /dev/null
+++ b/drivers/staging/rt2860/common/crypt_hmac.c
@@ -0,0 +1,187 @@
+/*
+ *************************************************************************
+ * Ralink Tech Inc.
+ * 5F., No.36, Taiyuan St., Jhubei City,
+ * Hsinchu County 302,
+ * Taiwan, R.O.C.
+ *
+ * (c) Copyright 2002-2007, Ralink Technology, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify  *
+ * it under the terms of the GNU General Public License as published by  *
+ * the Free Software Foundation; either version 2 of the License, or     *
+ * (at your option) any later version.                                   *
+ *                                                                       *
+ * This program is distributed in the hope that it will be useful,       *
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
+ * GNU General Public License for more details.                          *
+ *                                                                       *
+ * You should have received a copy of the GNU General Public License     *
+ * along with this program; if not, write to the                         *
+ * Free Software Foundation, Inc.,                                       *
+ * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
+ *                                                                       *
+ *************************************************************************/
+
+#include "../crypt_hmac.h"
+
+#ifdef HMAC_SHA1_SUPPORT
+/*
+========================================================================
+Routine Description:
+    HMAC using SHA1 hash function
+
+Arguments:
+    key             Secret key
+    key_len         The length of the key in bytes
+    message         Message context
+    message_len     The length of message in bytes
+    macLen          Request the length of message authentication code
+
+Return Value:
+    mac             Message authentication code
+
+Note:
+    None
+========================================================================
+*/
+void HMAC_SHA1(IN const u8 Key[],
+	       u32 KeyLen,
+	       IN const u8 Message[],
+	       u32 MessageLen, u8 MAC[], u32 MACLen)
+{
+	struct rt_sha1_ctx sha_ctx1;
+	struct rt_sha1_ctx sha_ctx2;
+	u8 K0[SHA1_BLOCK_SIZE];
+	u8 Digest[SHA1_DIGEST_SIZE];
+	u32 index;
+
+	NdisZeroMemory(&sha_ctx1, sizeof(struct rt_sha1_ctx));
+	NdisZeroMemory(&sha_ctx2, sizeof(struct rt_sha1_ctx));
+	/*
+	 * If the length of K = B(Block size): K0 = K.
+	 * If the length of K > B: hash K to obtain an L byte string,
+	 * then append (B-L) zeros to create a B-byte string K0 (i.e., K0 = H(K) || 00...00).
+	 * If the length of K < B: append zeros to the end of K to create a B-byte string K0
+	 */
+	NdisZeroMemory(K0, SHA1_BLOCK_SIZE);
+	if (KeyLen <= SHA1_BLOCK_SIZE)
+		NdisMoveMemory(K0, Key, KeyLen);
+	else
+		RT_SHA1(Key, KeyLen, K0);
+	/* End of if */
+
+	/* Exclusive-Or K0 with ipad */
+	/* ipad: Inner pad; the byte x¡¦36¡¦ repeated B times. */
+	for (index = 0; index < SHA1_BLOCK_SIZE; index++)
+		K0[index] ^= 0x36;
+	/* End of for */
+
+	RT_SHA1_Init(&sha_ctx1);
+	/* H(K0^ipad) */
+	SHA1_Append(&sha_ctx1, K0, sizeof(K0));
+	/* H((K0^ipad)||text) */
+	SHA1_Append(&sha_ctx1, Message, MessageLen);
+	SHA1_End(&sha_ctx1, Digest);
+
+	/* Exclusive-Or K0 with opad and remove ipad */
+	/* opad: Outer pad; the byte x¡¦5c¡¦ repeated B times. */
+	for (index = 0; index < SHA1_BLOCK_SIZE; index++)
+		K0[index] ^= 0x36 ^ 0x5c;
+	/* End of for */
+
+	RT_SHA1_Init(&sha_ctx2);
+	/* H(K0^opad) */
+	SHA1_Append(&sha_ctx2, K0, sizeof(K0));
+	/* H( (K0^opad) || H((K0^ipad)||text) ) */
+	SHA1_Append(&sha_ctx2, Digest, SHA1_DIGEST_SIZE);
+	SHA1_End(&sha_ctx2, Digest);
+
+	if (MACLen > SHA1_DIGEST_SIZE)
+		NdisMoveMemory(MAC, Digest, SHA1_DIGEST_SIZE);
+	else
+		NdisMoveMemory(MAC, Digest, MACLen);
+}				/* End of HMAC_SHA1 */
+#endif /* HMAC_SHA1_SUPPORT */
+
+#ifdef HMAC_MD5_SUPPORT
+/*
+========================================================================
+Routine Description:
+    HMAC using MD5 hash function
+
+Arguments:
+    key             Secret key
+    key_len         The length of the key in bytes
+    message         Message context
+    message_len     The length of message in bytes
+    macLen          Request the length of message authentication code
+
+Return Value:
+    mac             Message authentication code
+
+Note:
+    None
+========================================================================
+*/
+void HMAC_MD5(IN const u8 Key[],
+	      u32 KeyLen,
+	      IN const u8 Message[],
+	      u32 MessageLen, u8 MAC[], u32 MACLen)
+{
+	struct rt_md5_ctx_struc md5_ctx1;
+	struct rt_md5_ctx_struc md5_ctx2;
+	u8 K0[MD5_BLOCK_SIZE];
+	u8 Digest[MD5_DIGEST_SIZE];
+	u32 index;
+
+	NdisZeroMemory(&md5_ctx1, sizeof(struct rt_md5_ctx_struc));
+	NdisZeroMemory(&md5_ctx2, sizeof(struct rt_md5_ctx_struc));
+	/*
+	 * If the length of K = B(Block size): K0 = K.
+	 * If the length of K > B: hash K to obtain an L byte string,
+	 * then append (B-L) zeros to create a B-byte string K0 (i.e., K0 = H(K) || 00...00).
+	 * If the length of K < B: append zeros to the end of K to create a B-byte string K0
+	 */
+	NdisZeroMemory(K0, MD5_BLOCK_SIZE);
+	if (KeyLen <= MD5_BLOCK_SIZE) {
+		NdisMoveMemory(K0, Key, KeyLen);
+	} else {
+		RT_MD5(Key, KeyLen, K0);
+	}
+
+	/* Exclusive-Or K0 with ipad */
+	/* ipad: Inner pad; the byte x¡¦36¡¦ repeated B times. */
+	for (index = 0; index < MD5_BLOCK_SIZE; index++)
+		K0[index] ^= 0x36;
+	/* End of for */
+
+	MD5_Init(&md5_ctx1);
+	/* H(K0^ipad) */
+	MD5_Append(&md5_ctx1, K0, sizeof(K0));
+	/* H((K0^ipad)||text) */
+	MD5_Append(&md5_ctx1, Message, MessageLen);
+	MD5_End(&md5_ctx1, Digest);
+
+	/* Exclusive-Or K0 with opad and remove ipad */
+	/* opad: Outer pad; the byte x¡¦5c¡¦ repeated B times. */
+	for (index = 0; index < MD5_BLOCK_SIZE; index++)
+		K0[index] ^= 0x36 ^ 0x5c;
+	/* End of for */
+
+	MD5_Init(&md5_ctx2);
+	/* H(K0^opad) */
+	MD5_Append(&md5_ctx2, K0, sizeof(K0));
+	/* H( (K0^opad) || H((K0^ipad)||text) ) */
+	MD5_Append(&md5_ctx2, Digest, MD5_DIGEST_SIZE);
+	MD5_End(&md5_ctx2, Digest);
+
+	if (MACLen > MD5_DIGEST_SIZE)
+		NdisMoveMemory(MAC, Digest, MD5_DIGEST_SIZE);
+	else
+		NdisMoveMemory(MAC, Digest, MACLen);
+}				/* End of HMAC_SHA256 */
+#endif /* HMAC_MD5_SUPPORT */
+
+/* End of crypt_hmac.c */
diff --git a/drivers/staging/rt2860/common/crypt_md5.c b/drivers/staging/rt2860/common/crypt_md5.c
new file mode 100644
index 000000000000..6deab659c22b
--- /dev/null
+++ b/drivers/staging/rt2860/common/crypt_md5.c
@@ -0,0 +1,339 @@
+/*
+ *************************************************************************
+ * Ralink Tech Inc.
+ * 5F., No.36, Taiyuan St., Jhubei City,
+ * Hsinchu County 302,
+ * Taiwan, R.O.C.
+ *
+ * (c) Copyright 2002-2007, Ralink Technology, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify  *
+ * it under the terms of the GNU General Public License as published by  *
+ * the Free Software Foundation; either version 2 of the License, or     *
+ * (at your option) any later version.                                   *
+ *                                                                       *
+ * This program is distributed in the hope that it will be useful,       *
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
+ * GNU General Public License for more details.                          *
+ *                                                                       *
+ * You should have received a copy of the GNU General Public License     *
+ * along with this program; if not, write to the                         *
+ * Free Software Foundation, Inc.,                                       *
+ * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
+ *                                                                       *
+ *************************************************************************/
+
+#include "../crypt_md5.h"
+
+#ifdef MD5_SUPPORT
+/*
+ * F, G, H and I are basic MD5 functions.
+ */
+#define F(x, y, z) (((x) & (y)) | ((~x) & (z)))
+#define G(x, y, z) (((x) & (z)) | ((y) & (~z)))
+#define H(x, y, z) ((x) ^ (y) ^ (z))
+#define I(x, y, z) ((y) ^ ((x) | (~z)))
+
+#define ROTL(x,n,w) ((x << n) | (x >> (w - n)))
+#define ROTL32(x,n) ROTL(x,n,32)	/* 32 bits word */
+
+#define ROUND1(a, b, c, d, x, s, ac) {          \
+    (a) += F((b),(c),(d)) + (x) + (u32)(ac); \
+    (a)  = ROTL32((a),(s));                     \
+    (a) += (b);                                 \
+}
+#define ROUND2(a, b, c, d, x, s, ac) {          \
+    (a) += G((b),(c),(d)) + (x) + (u32)(ac); \
+    (a)  = ROTL32((a),(s));                     \
+    (a) += (b);                                 \
+}
+#define ROUND3(a, b, c, d, x, s, ac) {          \
+    (a) += H((b),(c),(d)) + (x) + (u32)(ac); \
+    (a)  = ROTL32((a),(s));                     \
+    (a) += (b);                                 \
+}
+#define ROUND4(a, b, c, d, x, s, ac) {          \
+    (a) += I((b),(c),(d)) + (x) + (u32)(ac); \
+    (a)  = ROTL32((a),(s));                     \
+    (a) += (b);                                 \
+}
+static const u32 MD5_DefaultHashValue[4] = {
+	0x67452301UL, 0xefcdab89UL, 0x98badcfeUL, 0x10325476UL
+};
+#endif /* MD5_SUPPORT */
+
+#ifdef MD5_SUPPORT
+/*
+========================================================================
+Routine Description:
+    Initial Md5_CTX_STRUC
+
+Arguments:
+    pMD5_CTX        Pointer to Md5_CTX_STRUC
+
+Return Value:
+    None
+
+Note:
+    None
+========================================================================
+*/
+void MD5_Init(struct rt_md5_ctx_struc *pMD5_CTX)
+{
+	NdisMoveMemory(pMD5_CTX->HashValue, MD5_DefaultHashValue,
+		       sizeof(MD5_DefaultHashValue));
+	NdisZeroMemory(pMD5_CTX->Block, MD5_BLOCK_SIZE);
+	pMD5_CTX->BlockLen = 0;
+	pMD5_CTX->MessageLen = 0;
+}				/* End of MD5_Init */
+
+/*
+========================================================================
+Routine Description:
+    MD5 computation for one block (512 bits)
+
+Arguments:
+    pMD5_CTX        Pointer to Md5_CTX_STRUC
+
+Return Value:
+    None
+
+Note:
+    T[i] := floor(abs(sin(i + 1)) * (2 pow 32)), i is number of round
+========================================================================
+*/
+void MD5_Hash(struct rt_md5_ctx_struc *pMD5_CTX)
+{
+	u32 X_i;
+	u32 X[16];
+	u32 a, b, c, d;
+
+	/* Prepare the message schedule, {X_i} */
+	NdisMoveMemory(X, pMD5_CTX->Block, MD5_BLOCK_SIZE);
+	for (X_i = 0; X_i < 16; X_i++)
+		X[X_i] = cpu2le32(X[X_i]);	/* Endian Swap */
+	/* End of for */
+
+	/* MD5 hash computation */
+	/* Initialize the working variables */
+	a = pMD5_CTX->HashValue[0];
+	b = pMD5_CTX->HashValue[1];
+	c = pMD5_CTX->HashValue[2];
+	d = pMD5_CTX->HashValue[3];
+
+	/*
+	 *  Round 1
+	 *  Let [abcd k s i] denote the operation
+	 *  a = b + ((a + F(b,c,d) + X[k] + T[i]) <<< s)
+	 */
+	ROUND1(a, b, c, d, X[0], 7, 0xd76aa478);	/* 1 */
+	ROUND1(d, a, b, c, X[1], 12, 0xe8c7b756);	/* 2 */
+	ROUND1(c, d, a, b, X[2], 17, 0x242070db);	/* 3 */
+	ROUND1(b, c, d, a, X[3], 22, 0xc1bdceee);	/* 4 */
+	ROUND1(a, b, c, d, X[4], 7, 0xf57c0faf);	/* 5 */
+	ROUND1(d, a, b, c, X[5], 12, 0x4787c62a);	/* 6 */
+	ROUND1(c, d, a, b, X[6], 17, 0xa8304613);	/* 7 */
+	ROUND1(b, c, d, a, X[7], 22, 0xfd469501);	/* 8 */
+	ROUND1(a, b, c, d, X[8], 7, 0x698098d8);	/* 9 */
+	ROUND1(d, a, b, c, X[9], 12, 0x8b44f7af);	/* 10 */
+	ROUND1(c, d, a, b, X[10], 17, 0xffff5bb1);	/* 11 */
+	ROUND1(b, c, d, a, X[11], 22, 0x895cd7be);	/* 12 */
+	ROUND1(a, b, c, d, X[12], 7, 0x6b901122);	/* 13 */
+	ROUND1(d, a, b, c, X[13], 12, 0xfd987193);	/* 14 */
+	ROUND1(c, d, a, b, X[14], 17, 0xa679438e);	/* 15 */
+	ROUND1(b, c, d, a, X[15], 22, 0x49b40821);	/* 16 */
+
+	/*
+	 *  Round 2
+	 *  Let [abcd k s i] denote the operation
+	 *  a = b + ((a + G(b,c,d) + X[k] + T[i]) <<< s)
+	 */
+	ROUND2(a, b, c, d, X[1], 5, 0xf61e2562);	/* 17 */
+	ROUND2(d, a, b, c, X[6], 9, 0xc040b340);	/* 18 */
+	ROUND2(c, d, a, b, X[11], 14, 0x265e5a51);	/* 19 */
+	ROUND2(b, c, d, a, X[0], 20, 0xe9b6c7aa);	/* 20 */
+	ROUND2(a, b, c, d, X[5], 5, 0xd62f105d);	/* 21 */
+	ROUND2(d, a, b, c, X[10], 9, 0x2441453);	/* 22 */
+	ROUND2(c, d, a, b, X[15], 14, 0xd8a1e681);	/* 23 */
+	ROUND2(b, c, d, a, X[4], 20, 0xe7d3fbc8);	/* 24 */
+	ROUND2(a, b, c, d, X[9], 5, 0x21e1cde6);	/* 25 */
+	ROUND2(d, a, b, c, X[14], 9, 0xc33707d6);	/* 26 */
+	ROUND2(c, d, a, b, X[3], 14, 0xf4d50d87);	/* 27 */
+	ROUND2(b, c, d, a, X[8], 20, 0x455a14ed);	/* 28 */
+	ROUND2(a, b, c, d, X[13], 5, 0xa9e3e905);	/* 29 */
+	ROUND2(d, a, b, c, X[2], 9, 0xfcefa3f8);	/* 30 */
+	ROUND2(c, d, a, b, X[7], 14, 0x676f02d9);	/* 31 */
+	ROUND2(b, c, d, a, X[12], 20, 0x8d2a4c8a);	/* 32 */
+
+	/*
+	 *  Round 3
+	 *  Let [abcd k s t] denote the operation
+	 *  a = b + ((a + H(b,c,d) + X[k] + T[i]) <<< s)
+	 */
+	ROUND3(a, b, c, d, X[5], 4, 0xfffa3942);	/* 33 */
+	ROUND3(d, a, b, c, X[8], 11, 0x8771f681);	/* 34 */
+	ROUND3(c, d, a, b, X[11], 16, 0x6d9d6122);	/* 35 */
+	ROUND3(b, c, d, a, X[14], 23, 0xfde5380c);	/* 36 */
+	ROUND3(a, b, c, d, X[1], 4, 0xa4beea44);	/* 37 */
+	ROUND3(d, a, b, c, X[4], 11, 0x4bdecfa9);	/* 38 */
+	ROUND3(c, d, a, b, X[7], 16, 0xf6bb4b60);	/* 39 */
+	ROUND3(b, c, d, a, X[10], 23, 0xbebfbc70);	/* 40 */
+	ROUND3(a, b, c, d, X[13], 4, 0x289b7ec6);	/* 41 */
+	ROUND3(d, a, b, c, X[0], 11, 0xeaa127fa);	/* 42 */
+	ROUND3(c, d, a, b, X[3], 16, 0xd4ef3085);	/* 43 */
+	ROUND3(b, c, d, a, X[6], 23, 0x4881d05);	/* 44 */
+	ROUND3(a, b, c, d, X[9], 4, 0xd9d4d039);	/* 45 */
+	ROUND3(d, a, b, c, X[12], 11, 0xe6db99e5);	/* 46 */
+	ROUND3(c, d, a, b, X[15], 16, 0x1fa27cf8);	/* 47 */
+	ROUND3(b, c, d, a, X[2], 23, 0xc4ac5665);	/* 48 */
+
+	/*
+	 *  Round 4
+	 *  Let [abcd k s t] denote the operation
+	 *  a = b + ((a + I(b,c,d) + X[k] + T[i]) <<< s)
+	 */
+	ROUND4(a, b, c, d, X[0], 6, 0xf4292244);	/* 49 */
+	ROUND4(d, a, b, c, X[7], 10, 0x432aff97);	/* 50 */
+	ROUND4(c, d, a, b, X[14], 15, 0xab9423a7);	/* 51 */
+	ROUND4(b, c, d, a, X[5], 21, 0xfc93a039);	/* 52 */
+	ROUND4(a, b, c, d, X[12], 6, 0x655b59c3);	/* 53 */
+	ROUND4(d, a, b, c, X[3], 10, 0x8f0ccc92);	/* 54 */
+	ROUND4(c, d, a, b, X[10], 15, 0xffeff47d);	/* 55 */
+	ROUND4(b, c, d, a, X[1], 21, 0x85845dd1);	/* 56 */
+	ROUND4(a, b, c, d, X[8], 6, 0x6fa87e4f);	/* 57 */
+	ROUND4(d, a, b, c, X[15], 10, 0xfe2ce6e0);	/* 58 */
+	ROUND4(c, d, a, b, X[6], 15, 0xa3014314);	/* 59 */
+	ROUND4(b, c, d, a, X[13], 21, 0x4e0811a1);	/* 60 */
+	ROUND4(a, b, c, d, X[4], 6, 0xf7537e82);	/* 61 */
+	ROUND4(d, a, b, c, X[11], 10, 0xbd3af235);	/* 62 */
+	ROUND4(c, d, a, b, X[2], 15, 0x2ad7d2bb);	/* 63 */
+	ROUND4(b, c, d, a, X[9], 21, 0xeb86d391);	/* 64 */
+
+	/* Compute the i^th intermediate hash value H^(i) */
+	pMD5_CTX->HashValue[0] += a;
+	pMD5_CTX->HashValue[1] += b;
+	pMD5_CTX->HashValue[2] += c;
+	pMD5_CTX->HashValue[3] += d;
+
+	NdisZeroMemory(pMD5_CTX->Block, MD5_BLOCK_SIZE);
+	pMD5_CTX->BlockLen = 0;
+}				/* End of MD5_Hash */
+
+/*
+========================================================================
+Routine Description:
+    The message is appended to block. If block size > 64 bytes, the MD5_Hash
+will be called.
+
+Arguments:
+    pMD5_CTX        Pointer to struct rt_md5_ctx_struc
+    message         Message context
+    messageLen      The length of message in bytes
+
+Return Value:
+    None
+
+Note:
+    None
+========================================================================
+*/
+void MD5_Append(struct rt_md5_ctx_struc *pMD5_CTX,
+		IN const u8 Message[], u32 MessageLen)
+{
+	u32 appendLen = 0;
+	u32 diffLen = 0;
+
+	while (appendLen != MessageLen) {
+		diffLen = MessageLen - appendLen;
+		if ((pMD5_CTX->BlockLen + diffLen) < MD5_BLOCK_SIZE) {
+			NdisMoveMemory(pMD5_CTX->Block + pMD5_CTX->BlockLen,
+				       Message + appendLen, diffLen);
+			pMD5_CTX->BlockLen += diffLen;
+			appendLen += diffLen;
+		} else {
+			NdisMoveMemory(pMD5_CTX->Block + pMD5_CTX->BlockLen,
+				       Message + appendLen,
+				       MD5_BLOCK_SIZE - pMD5_CTX->BlockLen);
+			appendLen += (MD5_BLOCK_SIZE - pMD5_CTX->BlockLen);
+			pMD5_CTX->BlockLen = MD5_BLOCK_SIZE;
+			MD5_Hash(pMD5_CTX);
+		}		/* End of if */
+	}			/* End of while */
+	pMD5_CTX->MessageLen += MessageLen;
+}				/* End of MD5_Append */
+
+/*
+========================================================================
+Routine Description:
+    1. Append bit 1 to end of the message
+    2. Append the length of message in rightmost 64 bits
+    3. Transform the Hash Value to digest message
+
+Arguments:
+    pMD5_CTX        Pointer to struct rt_md5_ctx_struc
+
+Return Value:
+    digestMessage   Digest message
+
+Note:
+    None
+========================================================================
+*/
+void MD5_End(struct rt_md5_ctx_struc *pMD5_CTX, u8 DigestMessage[])
+{
+	u32 index;
+	u64 message_length_bits;
+
+	/* append 1 bits to end of the message */
+	NdisFillMemory(pMD5_CTX->Block + pMD5_CTX->BlockLen, 1, 0x80);
+
+	/* 55 = 64 - 8 - 1: append 1 bit(1 byte) and message length (8 bytes) */
+	if (pMD5_CTX->BlockLen > 55)
+		MD5_Hash(pMD5_CTX);
+	/* End of if */
+
+	/* Append the length of message in rightmost 64 bits */
+	message_length_bits = pMD5_CTX->MessageLen * 8;
+	message_length_bits = cpu2le64(message_length_bits);
+	NdisMoveMemory(&pMD5_CTX->Block[56], &message_length_bits, 8);
+	MD5_Hash(pMD5_CTX);
+
+	/* Return message digest, transform the u32 hash value to bytes */
+	for (index = 0; index < 4; index++)
+		pMD5_CTX->HashValue[index] =
+		    cpu2le32(pMD5_CTX->HashValue[index]);
+	/* End of for */
+	NdisMoveMemory(DigestMessage, pMD5_CTX->HashValue, MD5_DIGEST_SIZE);
+}				/* End of MD5_End */
+
+/*
+========================================================================
+Routine Description:
+    MD5 algorithm
+
+Arguments:
+    message         Message context
+    messageLen      The length of message in bytes
+
+Return Value:
+    digestMessage   Digest message
+
+Note:
+    None
+========================================================================
+*/
+void RT_MD5(IN const u8 Message[],
+	    u32 MessageLen, u8 DigestMessage[])
+{
+	struct rt_md5_ctx_struc md5_ctx;
+
+	NdisZeroMemory(&md5_ctx, sizeof(struct rt_md5_ctx_struc));
+	MD5_Init(&md5_ctx);
+	MD5_Append(&md5_ctx, Message, MessageLen);
+	MD5_End(&md5_ctx, DigestMessage);
+}				/* End of RT_MD5 */
+
+#endif /* MD5_SUPPORT */
+
+/* End of crypt_md5.c */
diff --git a/drivers/staging/rt2860/common/crypt_sha2.c b/drivers/staging/rt2860/common/crypt_sha2.c
new file mode 100644
index 000000000000..fa83fb287fe5
--- /dev/null
+++ b/drivers/staging/rt2860/common/crypt_sha2.c
@@ -0,0 +1,269 @@
+/*
+ *************************************************************************
+ * Ralink Tech Inc.
+ * 5F., No.36, Taiyuan St., Jhubei City,
+ * Hsinchu County 302,
+ * Taiwan, R.O.C.
+ *
+ * (c) Copyright 2002-2007, Ralink Technology, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify  *
+ * it under the terms of the GNU General Public License as published by  *
+ * the Free Software Foundation; either version 2 of the License, or     *
+ * (at your option) any later version.                                   *
+ *                                                                       *
+ * This program is distributed in the hope that it will be useful,       *
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
+ * GNU General Public License for more details.                          *
+ *                                                                       *
+ * You should have received a copy of the GNU General Public License     *
+ * along with this program; if not, write to the                         *
+ * Free Software Foundation, Inc.,                                       *
+ * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
+ *                                                                       *
+ *************************************************************************/
+
+#include "../crypt_sha2.h"
+
+/* Basic operations */
+#define SHR(x,n) (x >> n)	/* SHR(x)^n, right shift n bits , x is w-bit word, 0 <= n <= w */
+#define ROTR(x,n,w) ((x >> n) | (x << (w - n)))	/* ROTR(x)^n, circular right shift n bits , x is w-bit word, 0 <= n <= w */
+#define ROTL(x,n,w) ((x << n) | (x >> (w - n)))	/* ROTL(x)^n, circular left shift n bits , x is w-bit word, 0 <= n <= w */
+#define ROTR32(x,n) ROTR(x,n,32)	/* 32 bits word */
+#define ROTL32(x,n) ROTL(x,n,32)	/* 32 bits word */
+
+/* Basic functions */
+#define Ch(x,y,z) ((x & y) ^ ((~x) & z))
+#define Maj(x,y,z) ((x & y) ^ (x & z) ^ (y & z))
+#define Parity(x,y,z) (x ^ y ^ z)
+
+#ifdef SHA1_SUPPORT
+/* SHA1 constants */
+#define SHA1_MASK 0x0000000f
+static const u32 SHA1_K[4] = {
+	0x5a827999UL, 0x6ed9eba1UL, 0x8f1bbcdcUL, 0xca62c1d6UL
+};
+
+static const u32 SHA1_DefaultHashValue[5] = {
+	0x67452301UL, 0xefcdab89UL, 0x98badcfeUL, 0x10325476UL, 0xc3d2e1f0UL
+};
+
+/*
+========================================================================
+Routine Description:
+    Initial struct rt_sha1_ctx
+
+Arguments:
+    pSHA_CTX        Pointer to struct rt_sha1_ctx
+
+Return Value:
+    None
+
+Note:
+    None
+========================================================================
+*/
+void RT_SHA1_Init(struct rt_sha1_ctx *pSHA_CTX)
+{
+	NdisMoveMemory(pSHA_CTX->HashValue, SHA1_DefaultHashValue,
+		       sizeof(SHA1_DefaultHashValue));
+	NdisZeroMemory(pSHA_CTX->Block, SHA1_BLOCK_SIZE);
+	pSHA_CTX->MessageLen = 0;
+	pSHA_CTX->BlockLen = 0;
+}				/* End of RT_SHA1_Init */
+
+/*
+========================================================================
+Routine Description:
+    SHA1 computation for one block (512 bits)
+
+Arguments:
+    pSHA_CTX        Pointer to struct rt_sha1_ctx
+
+Return Value:
+    None
+
+Note:
+    None
+========================================================================
+*/
+void SHA1_Hash(struct rt_sha1_ctx *pSHA_CTX)
+{
+	u32 W_i, t, s;
+	u32 W[16];
+	u32 a, b, c, d, e, T, f_t = 0;
+
+	/* Prepare the message schedule, {W_i}, 0 < t < 15 */
+	NdisMoveMemory(W, pSHA_CTX->Block, SHA1_BLOCK_SIZE);
+	for (W_i = 0; W_i < 16; W_i++)
+		W[W_i] = cpu2be32(W[W_i]);	/* Endian Swap */
+	/* End of for */
+
+	/* SHA256 hash computation */
+	/* Initialize the working variables */
+	a = pSHA_CTX->HashValue[0];
+	b = pSHA_CTX->HashValue[1];
+	c = pSHA_CTX->HashValue[2];
+	d = pSHA_CTX->HashValue[3];
+	e = pSHA_CTX->HashValue[4];
+
+	/* 80 rounds */
+	for (t = 0; t < 80; t++) {
+		s = t & SHA1_MASK;
+		if (t > 15) {	/* Prepare the message schedule, {W_i}, 16 < t < 79 */
+			W[s] =
+			    (W[(s + 13) & SHA1_MASK]) ^ (W[(s + 8) & SHA1_MASK])
+			    ^ (W[(s + 2) & SHA1_MASK]) ^ W[s];
+			W[s] = ROTL32(W[s], 1);
+		}		/* End of if */
+		switch (t / 20) {
+		case 0:
+			f_t = Ch(b, c, d);
+			break;
+		case 1:
+			f_t = Parity(b, c, d);
+			break;
+		case 2:
+			f_t = Maj(b, c, d);
+			break;
+		case 3:
+			f_t = Parity(b, c, d);
+			break;
+		}		/* End of switch */
+		T = ROTL32(a, 5) + f_t + e + SHA1_K[t / 20] + W[s];
+		e = d;
+		d = c;
+		c = ROTL32(b, 30);
+		b = a;
+		a = T;
+	}			/* End of for */
+
+	/* Compute the i^th intermediate hash value H^(i) */
+	pSHA_CTX->HashValue[0] += a;
+	pSHA_CTX->HashValue[1] += b;
+	pSHA_CTX->HashValue[2] += c;
+	pSHA_CTX->HashValue[3] += d;
+	pSHA_CTX->HashValue[4] += e;
+
+	NdisZeroMemory(pSHA_CTX->Block, SHA1_BLOCK_SIZE);
+	pSHA_CTX->BlockLen = 0;
+}				/* End of SHA1_Hash */
+
+/*
+========================================================================
+Routine Description:
+    The message is appended to block. If block size > 64 bytes, the SHA1_Hash
+will be called.
+
+Arguments:
+    pSHA_CTX        Pointer to struct rt_sha1_ctx
+    message         Message context
+    messageLen      The length of message in bytes
+
+Return Value:
+    None
+
+Note:
+    None
+========================================================================
+*/
+void SHA1_Append(struct rt_sha1_ctx *pSHA_CTX,
+		 IN const u8 Message[], u32 MessageLen)
+{
+	u32 appendLen = 0;
+	u32 diffLen = 0;
+
+	while (appendLen != MessageLen) {
+		diffLen = MessageLen - appendLen;
+		if ((pSHA_CTX->BlockLen + diffLen) < SHA1_BLOCK_SIZE) {
+			NdisMoveMemory(pSHA_CTX->Block + pSHA_CTX->BlockLen,
+				       Message + appendLen, diffLen);
+			pSHA_CTX->BlockLen += diffLen;
+			appendLen += diffLen;
+		} else {
+			NdisMoveMemory(pSHA_CTX->Block + pSHA_CTX->BlockLen,
+				       Message + appendLen,
+				       SHA1_BLOCK_SIZE - pSHA_CTX->BlockLen);
+			appendLen += (SHA1_BLOCK_SIZE - pSHA_CTX->BlockLen);
+			pSHA_CTX->BlockLen = SHA1_BLOCK_SIZE;
+			SHA1_Hash(pSHA_CTX);
+		}		/* End of if */
+	}			/* End of while */
+	pSHA_CTX->MessageLen += MessageLen;
+}				/* End of SHA1_Append */
+
+/*
+========================================================================
+Routine Description:
+    1. Append bit 1 to end of the message
+    2. Append the length of message in rightmost 64 bits
+    3. Transform the Hash Value to digest message
+
+Arguments:
+    pSHA_CTX        Pointer to struct rt_sha1_ctx
+
+Return Value:
+    digestMessage   Digest message
+
+Note:
+    None
+========================================================================
+*/
+void SHA1_End(struct rt_sha1_ctx *pSHA_CTX, u8 DigestMessage[])
+{
+	u32 index;
+	u64 message_length_bits;
+
+	/* Append bit 1 to end of the message */
+	NdisFillMemory(pSHA_CTX->Block + pSHA_CTX->BlockLen, 1, 0x80);
+
+	/* 55 = 64 - 8 - 1: append 1 bit(1 byte) and message length (8 bytes) */
+	if (pSHA_CTX->BlockLen > 55)
+		SHA1_Hash(pSHA_CTX);
+	/* End of if */
+
+	/* Append the length of message in rightmost 64 bits */
+	message_length_bits = pSHA_CTX->MessageLen * 8;
+	message_length_bits = cpu2be64(message_length_bits);
+	NdisMoveMemory(&pSHA_CTX->Block[56], &message_length_bits, 8);
+	SHA1_Hash(pSHA_CTX);
+
+	/* Return message digest, transform the u32 hash value to bytes */
+	for (index = 0; index < 5; index++)
+		pSHA_CTX->HashValue[index] =
+		    cpu2be32(pSHA_CTX->HashValue[index]);
+	/* End of for */
+	NdisMoveMemory(DigestMessage, pSHA_CTX->HashValue, SHA1_DIGEST_SIZE);
+}				/* End of SHA1_End */
+
+/*
+========================================================================
+Routine Description:
+    SHA1 algorithm
+
+Arguments:
+    message         Message context
+    messageLen      The length of message in bytes
+
+Return Value:
+    digestMessage   Digest message
+
+Note:
+    None
+========================================================================
+*/
+void RT_SHA1(IN const u8 Message[],
+	     u32 MessageLen, u8 DigestMessage[])
+{
+
+	struct rt_sha1_ctx sha_ctx;
+
+	NdisZeroMemory(&sha_ctx, sizeof(struct rt_sha1_ctx));
+	RT_SHA1_Init(&sha_ctx);
+	SHA1_Append(&sha_ctx, Message, MessageLen);
+	SHA1_End(&sha_ctx, DigestMessage);
+}				/* End of RT_SHA1 */
+#endif /* SHA1_SUPPORT */
+
+/* End of crypt_sha2.c */
diff --git a/drivers/staging/rt2860/common/dfs.c b/drivers/staging/rt2860/common/dfs.c
index 23330f2661d9..71cbb2665243 100644
--- a/drivers/staging/rt2860/common/dfs.c
+++ b/drivers/staging/rt2860/common/dfs.c
@@ -33,164 +33,10 @@
     Revision History:
     Who       When            What
     --------  ----------      ----------------------------------------------
-    Fonchi    03-12-2007      created
 */
 
 #include "../rt_config.h"
 
-typedef struct _RADAR_DURATION_TABLE
-{
-	ULONG RDDurRegion;
-	ULONG RadarSignalDuration;
-	ULONG Tolerance;
-} RADAR_DURATION_TABLE, *PRADAR_DURATION_TABLE;
-
-
-static UCHAR RdIdleTimeTable[MAX_RD_REGION][4] =
-{
-	{9, 250, 250, 250},		// CE
-	{4, 250, 250, 250},		// FCC
-	{4, 250, 250, 250},		// JAP
-	{15, 250, 250, 250},	// JAP_W53
-	{4, 250, 250, 250}		// JAP_W56
-};
-
-/*
-	========================================================================
-
-	Routine Description:
-		Bbp Radar detection routine
-
-	Arguments:
-		pAd 	Pointer to our adapter
-
-	Return Value:
-
-	========================================================================
-*/
-VOID BbpRadarDetectionStart(
-	IN PRTMP_ADAPTER pAd)
-{
-	UINT8 RadarPeriod;
-
-	RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, 114, 0x02);
-	RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, 121, 0x20);
-	RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, 122, 0x00);
-	RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, 123, 0x08/*0x80*/);
-	RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, 124, 0x28);
-	RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, 125, 0xff);
-
-	RadarPeriod = ((UINT)RdIdleTimeTable[pAd->CommonCfg.RadarDetect.RDDurRegion][0] + (UINT)pAd->CommonCfg.RadarDetect.DfsSessionTime) < 250 ?
-			(RdIdleTimeTable[pAd->CommonCfg.RadarDetect.RDDurRegion][0] + pAd->CommonCfg.RadarDetect.DfsSessionTime) : 250;
-
-	RTMP_IO_WRITE8(pAd, 0x7020, 0x1d);
-	RTMP_IO_WRITE8(pAd, 0x7021, 0x40);
-
-	RadarDetectionStart(pAd, 0, RadarPeriod);
-	return;
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-		Bbp Radar detection routine
-
-	Arguments:
-		pAd 	Pointer to our adapter
-
-	Return Value:
-
-	========================================================================
-*/
-VOID BbpRadarDetectionStop(
-	IN PRTMP_ADAPTER pAd)
-{
-	RTMP_IO_WRITE8(pAd, 0x7020, 0x1d);
-	RTMP_IO_WRITE8(pAd, 0x7021, 0x60);
-
-	RadarDetectionStop(pAd);
-	return;
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-		Radar detection routine
-
-	Arguments:
-		pAd 	Pointer to our adapter
-
-	Return Value:
-
-	========================================================================
-*/
-VOID RadarDetectionStart(
-	IN PRTMP_ADAPTER pAd,
-	IN BOOLEAN CTSProtect,
-	IN UINT8 CTSPeriod)
-{
-	UINT8 DfsActiveTime = (pAd->CommonCfg.RadarDetect.DfsSessionTime & 0x1f);
-	UINT8 CtsProtect = (CTSProtect == 1) ? 0x02 : 0x01; // CTS protect.
-
-	if (CTSProtect != 0)
-	{
-		switch(pAd->CommonCfg.RadarDetect.RDDurRegion)
-		{
-		case FCC:
-		case JAP_W56:
-			CtsProtect = 0x03;
-			break;
-
-		case CE:
-		case JAP_W53:
-		default:
-			CtsProtect = 0x02;
-			break;
-		}
-	}
-	else
-		CtsProtect = 0x01;
-
-
-	// send start-RD with CTS protection command to MCU
-	// highbyte [7]		reserve
-	// highbyte [6:5]	0x: stop Carrier/Radar detection
-	// highbyte [10]:	Start Carrier/Radar detection without CTS protection, 11: Start Carrier/Radar detection with CTS protection
-	// highbyte [4:0]	Radar/carrier detection duration. In 1ms.
-
-	// lowbyte [7:0]	Radar/carrier detection period, in 1ms.
-	AsicSendCommandToMcu(pAd, 0x60, 0xff, CTSPeriod, DfsActiveTime | (CtsProtect << 5));
-	//AsicSendCommandToMcu(pAd, 0x63, 0xff, 10, 0);
-
-	return;
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-		Radar detection routine
-
-	Arguments:
-		pAd 	Pointer to our adapter
-
-	Return Value:
-		TRUE	Found radar signal
-		FALSE	Not found radar signal
-
-	========================================================================
-*/
-VOID RadarDetectionStop(
-	IN PRTMP_ADAPTER	pAd)
-{
-	DBGPRINT(RT_DEBUG_TRACE,("RadarDetectionStop.\n"));
-	AsicSendCommandToMcu(pAd, 0x60, 0xff, 0x00, 0x00);	// send start-RD with CTS protection command to MCU
-
-	return;
-}
-
 /*
 	========================================================================
 
@@ -206,227 +52,17 @@ VOID RadarDetectionStop(
 
 	========================================================================
 */
-BOOLEAN RadarChannelCheck(
-	IN PRTMP_ADAPTER	pAd,
-	IN UCHAR			Ch)
+BOOLEAN RadarChannelCheck(struct rt_rtmp_adapter *pAd, u8 Ch)
 {
-#if 1
-	INT		i;
+	int i;
 	BOOLEAN result = FALSE;
 
-	for (i=0; i<pAd->ChannelListNum; i++)
-	{
-		if (Ch == pAd->ChannelList[i].Channel)
-		{
+	for (i = 0; i < pAd->ChannelListNum; i++) {
+		if (Ch == pAd->ChannelList[i].Channel) {
 			result = pAd->ChannelList[i].DfsReq;
 			break;
 		}
 	}
 
 	return result;
-#else
-	INT		i;
-	UCHAR	Channel[15]={52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140};
-
-	for (i=0; i<15; i++)
-	{
-		if (Ch == Channel[i])
-		{
-			break;
-		}
-	}
-
-	if (i != 15)
-		return TRUE;
-	else
-		return FALSE;
-#endif
 }
-
-ULONG JapRadarType(
-	IN PRTMP_ADAPTER pAd)
-{
-	ULONG		i;
-	const UCHAR	Channel[15]={52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140};
-
-	if (pAd->CommonCfg.RadarDetect.RDDurRegion != JAP)
-	{
-		return pAd->CommonCfg.RadarDetect.RDDurRegion;
-	}
-
-	for (i=0; i<15; i++)
-	{
-		if (pAd->CommonCfg.Channel == Channel[i])
-		{
-			break;
-		}
-	}
-
-	if (i < 4)
-		return JAP_W53;
-	else if (i < 15)
-		return JAP_W56;
-	else
-		return JAP; // W52
-
-}
-
-ULONG RTMPBbpReadRadarDuration(
-	IN PRTMP_ADAPTER	pAd)
-{
-	UINT8 byteValue = 0;
-	ULONG result;
-
-	BBP_IO_READ8_BY_REG_ID(pAd, BBP_R115, &byteValue);
-
-	result = 0;
-	switch (byteValue)
-	{
-	case 1: // radar signal detected by pulse mode.
-	case 2: // radar signal detected by width mode.
-		result = RTMPReadRadarDuration(pAd);
-		break;
-
-	case 0: // No radar signal.
-	default:
-
-		result = 0;
-		break;
-	}
-
-	return result;
-}
-
-ULONG RTMPReadRadarDuration(
-	IN PRTMP_ADAPTER	pAd)
-{
-	ULONG result = 0;
-
-	return result;
-
-}
-
-VOID RTMPCleanRadarDuration(
-	IN PRTMP_ADAPTER	pAd)
-{
-	return;
-}
-
-/*
-    ========================================================================
-    Routine Description:
-        Radar wave detection. The API should be invoke each second.
-
-    Arguments:
-        pAd         - Adapter pointer
-
-    Return Value:
-        None
-
-    ========================================================================
-*/
-VOID ApRadarDetectPeriodic(
-	IN PRTMP_ADAPTER pAd)
-{
-	INT	i;
-
-	pAd->CommonCfg.RadarDetect.InServiceMonitorCount++;
-
-	for (i=0; i<pAd->ChannelListNum; i++)
-	{
-		if (pAd->ChannelList[i].RemainingTimeForUse > 0)
-		{
-			pAd->ChannelList[i].RemainingTimeForUse --;
-			if ((pAd->Mlme.PeriodicRound%5) == 0)
-			{
-				DBGPRINT(RT_DEBUG_TRACE, ("RadarDetectPeriodic - ch=%d, RemainingTimeForUse=%d\n", pAd->ChannelList[i].Channel, pAd->ChannelList[i].RemainingTimeForUse));
-			}
-		}
-	}
-
-	//radar detect
-	if ((pAd->CommonCfg.Channel > 14)
-		&& (pAd->CommonCfg.bIEEE80211H == 1)
-		&& RadarChannelCheck(pAd, pAd->CommonCfg.Channel))
-	{
-		RadarDetectPeriodic(pAd);
-	}
-
-	return;
-}
-
-// Periodic Radar detection, switch channel will occur in RTMPHandleTBTTInterrupt()
-// Before switch channel, driver needs doing channel switch announcement.
-VOID RadarDetectPeriodic(
-	IN PRTMP_ADAPTER	pAd)
-{
-	// need to check channel availability, after switch channel
-	if (pAd->CommonCfg.RadarDetect.RDMode != RD_SILENCE_MODE)
-			return;
-
-	// channel availability check time is 60sec, use 65 for assurance
-	if (pAd->CommonCfg.RadarDetect.RDCount++ > pAd->CommonCfg.RadarDetect.ChMovingTime)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("Not found radar signal, start send beacon and radar detection in service monitor\n\n"));
-			BbpRadarDetectionStop(pAd);
-		AsicEnableBssSync(pAd);
-		pAd->CommonCfg.RadarDetect.RDMode = RD_NORMAL_MODE;
-
-
-		return;
-	}
-
-	return;
-}
-
-
-/*
-    ==========================================================================
-    Description:
-		change channel moving time for DFS testing.
-
-	Arguments:
-	    pAdapter                    Pointer to our adapter
-	    wrq                         Pointer to the ioctl argument
-
-    Return Value:
-        None
-
-    Note:
-        Usage:
-               1.) iwpriv ra0 set ChMovTime=[value]
-    ==========================================================================
-*/
-INT Set_ChMovingTime_Proc(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR arg)
-{
-	UINT8 Value;
-
-	Value = simple_strtol(arg, 0, 10);
-
-	pAd->CommonCfg.RadarDetect.ChMovingTime = Value;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("%s:: %d\n", __func__,
-		pAd->CommonCfg.RadarDetect.ChMovingTime));
-
-	return TRUE;
-}
-
-INT Set_LongPulseRadarTh_Proc(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR arg)
-{
-	UINT8 Value;
-
-	Value = simple_strtol(arg, 0, 10) > 10 ? 10 : simple_strtol(arg, 0, 10);
-
-	pAd->CommonCfg.RadarDetect.LongPulseRadarTh = Value;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("%s:: %d\n", __func__,
-		pAd->CommonCfg.RadarDetect.LongPulseRadarTh));
-
-	return TRUE;
-}
-
-
diff --git a/drivers/staging/rt2860/common/ee_efuse.c b/drivers/staging/rt2860/common/ee_efuse.c
new file mode 100644
index 000000000000..03412f5bc990
--- /dev/null
+++ b/drivers/staging/rt2860/common/ee_efuse.c
@@ -0,0 +1,344 @@
+/*
+ *************************************************************************
+ * Ralink Tech Inc.
+ * 5F., No.36, Taiyuan St., Jhubei City,
+ * Hsinchu County 302,
+ * Taiwan, R.O.C.
+ *
+ * (c) Copyright 2002-2007, Ralink Technology, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify  *
+ * it under the terms of the GNU General Public License as published by  *
+ * the Free Software Foundation; either version 2 of the License, or     *
+ * (at your option) any later version.                                   *
+ *                                                                       *
+ * This program is distributed in the hope that it will be useful,       *
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
+ * GNU General Public License for more details.                          *
+ *                                                                       *
+ * You should have received a copy of the GNU General Public License     *
+ * along with this program; if not, write to the                         *
+ * Free Software Foundation, Inc.,                                       *
+ * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
+ *                                                                       *
+ *************************************************************************
+
+	Module Name:
+	ee_efuse.c
+
+	Abstract:
+	Miniport generic portion header file
+
+	Revision History:
+	Who         When          What
+	--------    ----------    ----------------------------------------------
+*/
+
+#include	"../rt_config.h"
+
+#define EFUSE_USAGE_MAP_START	0x2d0
+#define EFUSE_USAGE_MAP_END		0x2fc
+#define EFUSE_USAGE_MAP_SIZE	45
+
+#define EFUSE_EEPROM_DEFULT_FILE	"RT30xxEEPROM.bin"
+#define MAX_EEPROM_BIN_FILE_SIZE	1024
+
+#define EFUSE_TAG				0x2fe
+
+typedef union _EFUSE_CTRL_STRUC {
+	struct {
+		u32 EFSROM_AOUT:6;
+		u32 EFSROM_MODE:2;
+		u32 EFSROM_LDO_OFF_TIME:6;
+		u32 EFSROM_LDO_ON_TIME:2;
+		u32 EFSROM_AIN:10;
+		u32 RESERVED:4;
+		u32 EFSROM_KICK:1;
+		u32 SEL_EFUSE:1;
+	} field;
+	u32 word;
+} EFUSE_CTRL_STRUC, *PEFUSE_CTRL_STRUC;
+
+/*
+========================================================================
+
+	Routine Description:
+
+	Arguments:
+
+	Return Value:
+
+	Note:
+
+========================================================================
+*/
+u8 eFuseReadRegisters(struct rt_rtmp_adapter *pAd,
+			 u16 Offset, u16 Length, u16 * pData)
+{
+	EFUSE_CTRL_STRUC eFuseCtrlStruc;
+	int i;
+	u16 efuseDataOffset;
+	u32 data;
+
+	RTMP_IO_READ32(pAd, EFUSE_CTRL, &eFuseCtrlStruc.word);
+
+	/*Step0. Write 10-bit of address to EFSROM_AIN (0x580, bit25:bit16). The address must be 16-byte alignment. */
+	/*Use the eeprom logical address and covert to address to block number */
+	eFuseCtrlStruc.field.EFSROM_AIN = Offset & 0xfff0;
+
+	/*Step1. Write EFSROM_MODE (0x580, bit7:bit6) to 0. */
+	eFuseCtrlStruc.field.EFSROM_MODE = 0;
+
+	/*Step2. Write EFSROM_KICK (0x580, bit30) to 1 to kick-off physical read procedure. */
+	eFuseCtrlStruc.field.EFSROM_KICK = 1;
+
+	NdisMoveMemory(&data, &eFuseCtrlStruc, 4);
+	RTMP_IO_WRITE32(pAd, EFUSE_CTRL, data);
+
+	/*Step3. Polling EFSROM_KICK(0x580, bit30) until it become 0 again. */
+	i = 0;
+	while (i < 500) {
+		/*rtmp.HwMemoryReadDword(EFUSE_CTRL, (DWORD *) &eFuseCtrlStruc, 4); */
+		RTMP_IO_READ32(pAd, EFUSE_CTRL, &eFuseCtrlStruc.word);
+		if (eFuseCtrlStruc.field.EFSROM_KICK == 0) {
+			break;
+		}
+		RTMPusecDelay(2);
+		i++;
+	}
+
+	/*if EFSROM_AOUT is not found in physical address, write 0xffff */
+	if (eFuseCtrlStruc.field.EFSROM_AOUT == 0x3f) {
+		for (i = 0; i < Length / 2; i++)
+			*(pData + 2 * i) = 0xffff;
+	} else {
+		/*Step4. Read 16-byte of data from EFUSE_DATA0-3 (0x590-0x59C) */
+		efuseDataOffset = EFUSE_DATA3 - (Offset & 0xC);
+		/*data hold 4 bytes data. */
+		/*In RTMP_IO_READ32 will automatically execute 32-bytes swapping */
+		RTMP_IO_READ32(pAd, efuseDataOffset, &data);
+		/*Decide the upper 2 bytes or the bottom 2 bytes. */
+		/* Little-endian                S       |       S       Big-endian */
+		/* addr 3       2       1       0       |       0       1       2       3 */
+		/* Ori-V        D       C       B       A       |       A       B       C       D */
+		/*After swapping */
+		/*              D       C       B       A       |       D       C       B       A */
+		/*Return 2-bytes */
+		/*The return byte statrs from S. Therefore, the little-endian will return BA, the Big-endian will return DC. */
+		/*For returning the bottom 2 bytes, the Big-endian should shift right 2-bytes. */
+		data = data >> (8 * (Offset & 0x3));
+
+		NdisMoveMemory(pData, &data, Length);
+	}
+
+	return (u8)eFuseCtrlStruc.field.EFSROM_AOUT;
+
+}
+
+/*
+========================================================================
+
+	Routine Description:
+
+	Arguments:
+
+	Return Value:
+
+	Note:
+
+========================================================================
+*/
+void eFusePhysicalReadRegisters(struct rt_rtmp_adapter *pAd,
+				u16 Offset,
+				u16 Length, u16 * pData)
+{
+	EFUSE_CTRL_STRUC eFuseCtrlStruc;
+	int i;
+	u16 efuseDataOffset;
+	u32 data;
+
+	RTMP_IO_READ32(pAd, EFUSE_CTRL, &eFuseCtrlStruc.word);
+
+	/*Step0. Write 10-bit of address to EFSROM_AIN (0x580, bit25:bit16). The address must be 16-byte alignment. */
+	eFuseCtrlStruc.field.EFSROM_AIN = Offset & 0xfff0;
+
+	/*Step1. Write EFSROM_MODE (0x580, bit7:bit6) to 1. */
+	/*Read in physical view */
+	eFuseCtrlStruc.field.EFSROM_MODE = 1;
+
+	/*Step2. Write EFSROM_KICK (0x580, bit30) to 1 to kick-off physical read procedure. */
+	eFuseCtrlStruc.field.EFSROM_KICK = 1;
+
+	NdisMoveMemory(&data, &eFuseCtrlStruc, 4);
+	RTMP_IO_WRITE32(pAd, EFUSE_CTRL, data);
+
+	/*Step3. Polling EFSROM_KICK(0x580, bit30) until it become 0 again. */
+	i = 0;
+	while (i < 500) {
+		RTMP_IO_READ32(pAd, EFUSE_CTRL, &eFuseCtrlStruc.word);
+		if (eFuseCtrlStruc.field.EFSROM_KICK == 0)
+			break;
+		RTMPusecDelay(2);
+		i++;
+	}
+
+	/*Step4. Read 16-byte of data from EFUSE_DATA0-3 (0x59C-0x590) */
+	/*Because the size of each EFUSE_DATA is 4 Bytes, the size of address of each is 2 bits. */
+	/*The previous 2 bits is the EFUSE_DATA number, the last 2 bits is used to decide which bytes */
+	/*Decide which EFUSE_DATA to read */
+	/*590:F E D C */
+	/*594:B A 9 8 */
+	/*598:7 6 5 4 */
+	/*59C:3 2 1 0 */
+	efuseDataOffset = EFUSE_DATA3 - (Offset & 0xC);
+
+	RTMP_IO_READ32(pAd, efuseDataOffset, &data);
+
+	data = data >> (8 * (Offset & 0x3));
+
+	NdisMoveMemory(pData, &data, Length);
+
+}
+
+/*
+========================================================================
+
+	Routine Description:
+
+	Arguments:
+
+	Return Value:
+
+	Note:
+
+========================================================================
+*/
+static void eFuseReadPhysical(struct rt_rtmp_adapter *pAd,
+			      u16 *lpInBuffer,
+			      unsigned long nInBufferSize,
+			      u16 *lpOutBuffer, unsigned long nOutBufferSize)
+{
+	u16 *pInBuf = (u16 *) lpInBuffer;
+	u16 *pOutBuf = (u16 *) lpOutBuffer;
+
+	u16 Offset = pInBuf[0];	/*addr */
+	u16 Length = pInBuf[1];	/*length */
+	int i;
+
+	for (i = 0; i < Length; i += 2) {
+		eFusePhysicalReadRegisters(pAd, Offset + i, 2, &pOutBuf[i / 2]);
+	}
+}
+
+/*
+========================================================================
+
+	Routine Description:
+
+	Arguments:
+
+	Return Value:
+
+	Note:
+
+========================================================================
+*/
+int set_eFuseGetFreeBlockCount_Proc(struct rt_rtmp_adapter *pAd, char *arg)
+{
+	u16 i;
+	u16 LogicalAddress;
+	u16 efusefreenum = 0;
+	if (!pAd->bUseEfuse)
+		return FALSE;
+	for (i = EFUSE_USAGE_MAP_START; i <= EFUSE_USAGE_MAP_END; i += 2) {
+		eFusePhysicalReadRegisters(pAd, i, 2, &LogicalAddress);
+		if ((LogicalAddress & 0xff) == 0) {
+			efusefreenum = (u8)(EFUSE_USAGE_MAP_END - i + 1);
+			break;
+		} else if (((LogicalAddress >> 8) & 0xff) == 0) {
+			efusefreenum = (u8)(EFUSE_USAGE_MAP_END - i);
+			break;
+		}
+
+		if (i == EFUSE_USAGE_MAP_END)
+			efusefreenum = 0;
+	}
+	printk("efuseFreeNumber is %d\n", efusefreenum);
+	return TRUE;
+}
+
+int set_eFusedump_Proc(struct rt_rtmp_adapter *pAd, char *arg)
+{
+	u16 InBuf[3];
+	int i = 0;
+	if (!pAd->bUseEfuse)
+		return FALSE;
+	for (i = 0; i < EFUSE_USAGE_MAP_END / 2; i++) {
+		InBuf[0] = 2 * i;
+		InBuf[1] = 2;
+		InBuf[2] = 0x0;
+
+		eFuseReadPhysical(pAd, &InBuf[0], 4, &InBuf[2], 2);
+		if (i % 4 == 0)
+			printk("\nBlock %x:", i / 8);
+		printk("%04x ", InBuf[2]);
+	}
+	return TRUE;
+}
+
+int rtmp_ee_efuse_read16(struct rt_rtmp_adapter *pAd,
+			 u16 Offset, u16 * pValue)
+{
+	eFuseReadRegisters(pAd, Offset, 2, pValue);
+	return (*pValue);
+}
+
+int RtmpEfuseSupportCheck(struct rt_rtmp_adapter *pAd)
+{
+	u16 value;
+
+	if (IS_RT30xx(pAd)) {
+		eFusePhysicalReadRegisters(pAd, EFUSE_TAG, 2, &value);
+		pAd->EFuseTag = (value & 0xff);
+	}
+	return 0;
+}
+
+void eFuseGetFreeBlockCount(struct rt_rtmp_adapter *pAd, u32 *EfuseFreeBlock)
+{
+	u16 i;
+	u16 LogicalAddress;
+	if (!pAd->bUseEfuse) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("eFuseGetFreeBlockCount Only supports efuse Mode\n"));
+		return;
+	}
+	for (i = EFUSE_USAGE_MAP_START; i <= EFUSE_USAGE_MAP_END; i += 2) {
+		eFusePhysicalReadRegisters(pAd, i, 2, &LogicalAddress);
+		if ((LogicalAddress & 0xff) == 0) {
+			*EfuseFreeBlock = (u8)(EFUSE_USAGE_MAP_END - i + 1);
+			break;
+		} else if (((LogicalAddress >> 8) & 0xff) == 0) {
+			*EfuseFreeBlock = (u8)(EFUSE_USAGE_MAP_END - i);
+			break;
+		}
+
+		if (i == EFUSE_USAGE_MAP_END)
+			*EfuseFreeBlock = 0;
+	}
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("eFuseGetFreeBlockCount is 0x%x\n", *EfuseFreeBlock));
+}
+
+int eFuse_init(struct rt_rtmp_adapter *pAd)
+{
+	u32 EfuseFreeBlock = 0;
+	DBGPRINT(RT_DEBUG_ERROR,
+		 ("NVM is Efuse and its size =%x[%x-%x] \n",
+		  EFUSE_USAGE_MAP_SIZE, EFUSE_USAGE_MAP_START,
+		  EFUSE_USAGE_MAP_END));
+	eFuseGetFreeBlockCount(pAd, &EfuseFreeBlock);
+
+	return 0;
+}
diff --git a/drivers/staging/rt2860/common/ee_prom.c b/drivers/staging/rt2860/common/ee_prom.c
new file mode 100644
index 000000000000..2083740a844b
--- /dev/null
+++ b/drivers/staging/rt2860/common/ee_prom.c
@@ -0,0 +1,197 @@
+/*
+ *************************************************************************
+ * Ralink Tech Inc.
+ * 5F., No.36, Taiyuan St., Jhubei City,
+ * Hsinchu County 302,
+ * Taiwan, R.O.C.
+ *
+ * (c) Copyright 2002-2007, Ralink Technology, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify  *
+ * it under the terms of the GNU General Public License as published by  *
+ * the Free Software Foundation; either version 2 of the License, or     *
+ * (at your option) any later version.                                   *
+ *                                                                       *
+ * This program is distributed in the hope that it will be useful,       *
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
+ * GNU General Public License for more details.                          *
+ *                                                                       *
+ * You should have received a copy of the GNU General Public License     *
+ * along with this program; if not, write to the                         *
+ * Free Software Foundation, Inc.,                                       *
+ * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
+ *                                                                       *
+ *************************************************************************
+
+	Module Name:
+	ee_prom.c
+
+	Abstract:
+	Miniport generic portion header file
+
+	Revision History:
+	Who         When          What
+	--------    ----------    ----------------------------------------------
+*/
+
+#include	"../rt_config.h"
+
+/* IRQL = PASSIVE_LEVEL */
+static inline void RaiseClock(struct rt_rtmp_adapter *pAd, u32 * x)
+{
+	*x = *x | EESK;
+	RTMP_IO_WRITE32(pAd, E2PROM_CSR, *x);
+	RTMPusecDelay(1);	/* Max frequency = 1MHz in Spec. definition */
+}
+
+/* IRQL = PASSIVE_LEVEL */
+static inline void LowerClock(struct rt_rtmp_adapter *pAd, u32 * x)
+{
+	*x = *x & ~EESK;
+	RTMP_IO_WRITE32(pAd, E2PROM_CSR, *x);
+	RTMPusecDelay(1);
+}
+
+/* IRQL = PASSIVE_LEVEL */
+static inline u16 ShiftInBits(struct rt_rtmp_adapter *pAd)
+{
+	u32 x, i;
+	u16 data = 0;
+
+	RTMP_IO_READ32(pAd, E2PROM_CSR, &x);
+
+	x &= ~(EEDO | EEDI);
+
+	for (i = 0; i < 16; i++) {
+		data = data << 1;
+		RaiseClock(pAd, &x);
+
+		RTMP_IO_READ32(pAd, E2PROM_CSR, &x);
+		LowerClock(pAd, &x);	/*prevent read failed */
+
+		x &= ~(EEDI);
+		if (x & EEDO)
+			data |= 1;
+	}
+
+	return data;
+}
+
+/* IRQL = PASSIVE_LEVEL */
+static inline void ShiftOutBits(struct rt_rtmp_adapter *pAd,
+				u16 data, u16 count)
+{
+	u32 x, mask;
+
+	mask = 0x01 << (count - 1);
+	RTMP_IO_READ32(pAd, E2PROM_CSR, &x);
+
+	x &= ~(EEDO | EEDI);
+
+	do {
+		x &= ~EEDI;
+		if (data & mask)
+			x |= EEDI;
+
+		RTMP_IO_WRITE32(pAd, E2PROM_CSR, x);
+
+		RaiseClock(pAd, &x);
+		LowerClock(pAd, &x);
+
+		mask = mask >> 1;
+	} while (mask);
+
+	x &= ~EEDI;
+	RTMP_IO_WRITE32(pAd, E2PROM_CSR, x);
+}
+
+/* IRQL = PASSIVE_LEVEL */
+static inline void EEpromCleanup(struct rt_rtmp_adapter *pAd)
+{
+	u32 x;
+
+	RTMP_IO_READ32(pAd, E2PROM_CSR, &x);
+
+	x &= ~(EECS | EEDI);
+	RTMP_IO_WRITE32(pAd, E2PROM_CSR, x);
+
+	RaiseClock(pAd, &x);
+	LowerClock(pAd, &x);
+}
+
+static inline void EWEN(struct rt_rtmp_adapter *pAd)
+{
+	u32 x;
+
+	/* reset bits and set EECS */
+	RTMP_IO_READ32(pAd, E2PROM_CSR, &x);
+	x &= ~(EEDI | EEDO | EESK);
+	x |= EECS;
+	RTMP_IO_WRITE32(pAd, E2PROM_CSR, x);
+
+	/* kick a pulse */
+	RaiseClock(pAd, &x);
+	LowerClock(pAd, &x);
+
+	/* output the read_opcode and six pulse in that order */
+	ShiftOutBits(pAd, EEPROM_EWEN_OPCODE, 5);
+	ShiftOutBits(pAd, 0, 6);
+
+	EEpromCleanup(pAd);
+}
+
+static inline void EWDS(struct rt_rtmp_adapter *pAd)
+{
+	u32 x;
+
+	/* reset bits and set EECS */
+	RTMP_IO_READ32(pAd, E2PROM_CSR, &x);
+	x &= ~(EEDI | EEDO | EESK);
+	x |= EECS;
+	RTMP_IO_WRITE32(pAd, E2PROM_CSR, x);
+
+	/* kick a pulse */
+	RaiseClock(pAd, &x);
+	LowerClock(pAd, &x);
+
+	/* output the read_opcode and six pulse in that order */
+	ShiftOutBits(pAd, EEPROM_EWDS_OPCODE, 5);
+	ShiftOutBits(pAd, 0, 6);
+
+	EEpromCleanup(pAd);
+}
+
+/* IRQL = PASSIVE_LEVEL */
+int rtmp_ee_prom_read16(struct rt_rtmp_adapter *pAd,
+			u16 Offset, u16 * pValue)
+{
+	u32 x;
+	u16 data;
+
+	Offset /= 2;
+	/* reset bits and set EECS */
+	RTMP_IO_READ32(pAd, E2PROM_CSR, &x);
+	x &= ~(EEDI | EEDO | EESK);
+	x |= EECS;
+	RTMP_IO_WRITE32(pAd, E2PROM_CSR, x);
+
+	/* patch can not access e-Fuse issue */
+	if (!(IS_RT3090(pAd) || IS_RT3572(pAd) || IS_RT3390(pAd))) {
+		/* kick a pulse */
+		RaiseClock(pAd, &x);
+		LowerClock(pAd, &x);
+	}
+	/* output the read_opcode and register number in that order */
+	ShiftOutBits(pAd, EEPROM_READ_OPCODE, 3);
+	ShiftOutBits(pAd, Offset, pAd->EEPROMAddressNum);
+
+	/* Now read the data (16 bits) in from the selected EEPROM word */
+	data = ShiftInBits(pAd);
+
+	EEpromCleanup(pAd);
+
+	*pValue = data;
+
+	return NDIS_STATUS_SUCCESS;
+}
diff --git a/drivers/staging/rt2860/common/eeprom.c b/drivers/staging/rt2860/common/eeprom.c
index ffcb4ce1a034..94670076d32b 100644
--- a/drivers/staging/rt2860/common/eeprom.c
+++ b/drivers/staging/rt2860/common/eeprom.c
@@ -36,1444 +36,56 @@
 */
 #include "../rt_config.h"
 
-// IRQL = PASSIVE_LEVEL
-VOID RaiseClock(
-    IN	PRTMP_ADAPTER	pAd,
-    IN  UINT32 *x)
+int RtmpChipOpsEepromHook(struct rt_rtmp_adapter *pAd, int infType)
 {
-    *x = *x | EESK;
-    RTMP_IO_WRITE32(pAd, E2PROM_CSR, *x);
-    RTMPusecDelay(1);				// Max frequency = 1MHz in Spec. definition
-}
-
-// IRQL = PASSIVE_LEVEL
-VOID LowerClock(
-    IN	PRTMP_ADAPTER	pAd,
-    IN  UINT32 *x)
-{
-    *x = *x & ~EESK;
-    RTMP_IO_WRITE32(pAd, E2PROM_CSR, *x);
-    RTMPusecDelay(1);
-}
-
-// IRQL = PASSIVE_LEVEL
-USHORT ShiftInBits(
-    IN	PRTMP_ADAPTER	pAd)
-{
-    UINT32		x,i;
-	USHORT      data=0;
-
-    RTMP_IO_READ32(pAd, E2PROM_CSR, &x);
-
-    x &= ~( EEDO | EEDI);
-
-    for(i=0; i<16; i++)
-    {
-        data = data << 1;
-        RaiseClock(pAd, &x);
-
-        RTMP_IO_READ32(pAd, E2PROM_CSR, &x);
-
-	LowerClock(pAd, &x); /* prevent read failed */
-
-        x &= ~(EEDI);
-        if(x & EEDO)
-            data |= 1;
-    }
-
-    return data;
-}
-
-// IRQL = PASSIVE_LEVEL
-VOID ShiftOutBits(
-    IN	PRTMP_ADAPTER	pAd,
-    IN  USHORT data,
-    IN  USHORT count)
-{
-    UINT32       x,mask;
-
-    mask = 0x01 << (count - 1);
-    RTMP_IO_READ32(pAd, E2PROM_CSR, &x);
-
-    x &= ~(EEDO | EEDI);
-
-    do
-    {
-        x &= ~EEDI;
-        if(data & mask)		x |= EEDI;
-
-        RTMP_IO_WRITE32(pAd, E2PROM_CSR, x);
-
-        RaiseClock(pAd, &x);
-        LowerClock(pAd, &x);
-
-        mask = mask >> 1;
-    } while(mask);
-
-    x &= ~EEDI;
-    RTMP_IO_WRITE32(pAd, E2PROM_CSR, x);
-}
-
-// IRQL = PASSIVE_LEVEL
-VOID EEpromCleanup(
-    IN	PRTMP_ADAPTER	pAd)
-{
-    UINT32 x;
-
-    RTMP_IO_READ32(pAd, E2PROM_CSR, &x);
-
-    x &= ~(EECS | EEDI);
-    RTMP_IO_WRITE32(pAd, E2PROM_CSR, x);
-
-    RaiseClock(pAd, &x);
-    LowerClock(pAd, &x);
-}
-
-VOID EWEN(
-	IN	PRTMP_ADAPTER	pAd)
-{
-    UINT32	x;
-
-    // reset bits and set EECS
-    RTMP_IO_READ32(pAd, E2PROM_CSR, &x);
-    x &= ~(EEDI | EEDO | EESK);
-    x |= EECS;
-    RTMP_IO_WRITE32(pAd, E2PROM_CSR, x);
-
-	// kick a pulse
-	RaiseClock(pAd, &x);
-	LowerClock(pAd, &x);
-
-    // output the read_opcode and six pulse in that order
-    ShiftOutBits(pAd, EEPROM_EWEN_OPCODE, 5);
-    ShiftOutBits(pAd, 0, 6);
-
-    EEpromCleanup(pAd);
-}
-
-VOID EWDS(
-	IN	PRTMP_ADAPTER	pAd)
-{
-    UINT32	x;
-
-    // reset bits and set EECS
-    RTMP_IO_READ32(pAd, E2PROM_CSR, &x);
-    x &= ~(EEDI | EEDO | EESK);
-    x |= EECS;
-    RTMP_IO_WRITE32(pAd, E2PROM_CSR, x);
-
-	// kick a pulse
-	RaiseClock(pAd, &x);
-	LowerClock(pAd, &x);
-
-    // output the read_opcode and six pulse in that order
-    ShiftOutBits(pAd, EEPROM_EWDS_OPCODE, 5);
-    ShiftOutBits(pAd, 0, 6);
-
-    EEpromCleanup(pAd);
-}
-
-// IRQL = PASSIVE_LEVEL
-USHORT RTMP_EEPROM_READ16(
-    IN	PRTMP_ADAPTER	pAd,
-    IN  USHORT Offset)
-{
-    UINT32		x;
-    USHORT		data;
+	struct rt_rtmp_chip_op *pChipOps = &pAd->chipOps;
+#ifdef RT30xx
+#ifdef RTMP_EFUSE_SUPPORT
+	u32 eFuseCtrl, MacCsr0;
+	int index;
 
-#ifdef RT2870
-	if (pAd->NicConfig2.field.AntDiversity)
-    {
-    	pAd->EepromAccess = TRUE;
-    }
-#endif
-    Offset /= 2;
-    // reset bits and set EECS
-    RTMP_IO_READ32(pAd, E2PROM_CSR, &x);
-    x &= ~(EEDI | EEDO | EESK);
-    x |= EECS;
-    RTMP_IO_WRITE32(pAd, E2PROM_CSR, x);
+	index = 0;
+	do {
+		RTMP_IO_READ32(pAd, MAC_CSR0, &MacCsr0);
+		pAd->MACVersion = MacCsr0;
 
-	// patch can not access e-Fuse issue
-    if (!IS_RT3090(pAd))
-    {
-	// kick a pulse
-	RaiseClock(pAd, &x);
-	LowerClock(pAd, &x);
-    }
-
-    // output the read_opcode and register number in that order
-    ShiftOutBits(pAd, EEPROM_READ_OPCODE, 3);
-    ShiftOutBits(pAd, Offset, pAd->EEPROMAddressNum);
-
-    // Now read the data (16 bits) in from the selected EEPROM word
-    data = ShiftInBits(pAd);
-
-    EEpromCleanup(pAd);
-
-#ifdef RT2870
-	// Antenna and EEPROM access are both using EESK pin,
-    // Therefor we should avoid accessing EESK at the same time
-    // Then restore antenna after EEPROM access
-	if ((pAd->NicConfig2.field.AntDiversity) || (pAd->RfIcType == RFIC_3020))
-    {
-	    pAd->EepromAccess = FALSE;
-	    AsicSetRxAnt(pAd, pAd->RxAnt.Pair1PrimaryRxAnt);
-    }
-#endif
-    return data;
-}	//ReadEEprom
-
-VOID RTMP_EEPROM_WRITE16(
-    IN	PRTMP_ADAPTER	pAd,
-    IN  USHORT Offset,
-    IN  USHORT Data)
-{
-    UINT32 x;
-
-#ifdef RT2870
-	if (pAd->NicConfig2.field.AntDiversity)
-    {
-    	pAd->EepromAccess = TRUE;
-    }
-#endif
-	Offset /= 2;
-
-	EWEN(pAd);
-
-    // reset bits and set EECS
-    RTMP_IO_READ32(pAd, E2PROM_CSR, &x);
-    x &= ~(EEDI | EEDO | EESK);
-    x |= EECS;
-    RTMP_IO_WRITE32(pAd, E2PROM_CSR, x);
-
-	// patch can not access e-Fuse issue
-    if (!IS_RT3090(pAd))
-    {
-	// kick a pulse
-	RaiseClock(pAd, &x);
-	LowerClock(pAd, &x);
-    }
-
-    // output the read_opcode ,register number and data in that order
-    ShiftOutBits(pAd, EEPROM_WRITE_OPCODE, 3);
-    ShiftOutBits(pAd, Offset, pAd->EEPROMAddressNum);
-	ShiftOutBits(pAd, Data, 16);		// 16-bit access
-
-    // read DO status
-    RTMP_IO_READ32(pAd, E2PROM_CSR, &x);
-
-	EEpromCleanup(pAd);
-
-	RTMPusecDelay(10000);	//delay for twp(MAX)=10ms
-
-	EWDS(pAd);
-
-    EEpromCleanup(pAd);
-
-#ifdef RT2870
-	// Antenna and EEPROM access are both using EESK pin,
-    // Therefor we should avoid accessing EESK at the same time
-    // Then restore antenna after EEPROM access
-	if ((pAd->NicConfig2.field.AntDiversity) || (pAd->RfIcType == RFIC_3020))
-    {
-	    pAd->EepromAccess = FALSE;
-	    AsicSetRxAnt(pAd, pAd->RxAnt.Pair1PrimaryRxAnt);
-    }
-#endif
-}
-
-#ifdef RT2870
-/*
-	========================================================================
-
-	Routine Description:
-
-	Arguments:
-
-	Return Value:
-
-	IRQL =
-
-	Note:
-
-	========================================================================
-*/
-UCHAR eFuseReadRegisters(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	USHORT Offset,
-	IN	USHORT Length,
-	OUT	USHORT* pData)
-{
-	EFUSE_CTRL_STRUC		eFuseCtrlStruc;
-	int	i;
-	USHORT	efuseDataOffset;
-	UINT32	data;
-
-	RTMP_IO_READ32(pAd, EFUSE_CTRL, (PUINT32) &eFuseCtrlStruc);
-
-	//Step0. Write 10-bit of address to EFSROM_AIN (0x580, bit25:bit16). The address must be 16-byte alignment.
-	//Use the eeprom logical address and covert to address to block number
-	eFuseCtrlStruc.field.EFSROM_AIN = Offset & 0xfff0;
-
-	//Step1. Write EFSROM_MODE (0x580, bit7:bit6) to 0.
-	eFuseCtrlStruc.field.EFSROM_MODE = 0;
-
-	//Step2. Write EFSROM_KICK (0x580, bit30) to 1 to kick-off physical read procedure.
-	eFuseCtrlStruc.field.EFSROM_KICK = 1;
-
-	NdisMoveMemory(&data, &eFuseCtrlStruc, 4);
-	RTMP_IO_WRITE32(pAd, EFUSE_CTRL, data);
-
-	//Step3. Polling EFSROM_KICK(0x580, bit30) until it become 0 again.
-	i = 0;
-	while(i < 100)
-	{
-		//rtmp.HwMemoryReadDword(EFUSE_CTRL, (DWORD *) &eFuseCtrlStruc, 4);
-		RTMP_IO_READ32(pAd, EFUSE_CTRL, (PUINT32) &eFuseCtrlStruc);
-		if(eFuseCtrlStruc.field.EFSROM_KICK == 0)
-		{
+		if ((pAd->MACVersion != 0x00)
+		    && (pAd->MACVersion != 0xFFFFFFFF))
 			break;
-		}
-		RTMPusecDelay(2);
-		i++;
-	}
-
-	//if EFSROM_AOUT is not found in physical address, write 0xffff
-	if (eFuseCtrlStruc.field.EFSROM_AOUT == 0x3f)
-	{
-		for(i=0; i<Length/2; i++)
-			*(pData+2*i) = 0xffff;
-	}
-	else
-	{
-		//Step4. Read 16-byte of data from EFUSE_DATA0-3 (0x590-0x59C)
-		efuseDataOffset =  EFUSE_DATA3 - (Offset & 0xC)  ;
-		//data hold 4 bytes data.
-		//In RTMP_IO_READ32 will automatically execute 32-bytes swapping
-		RTMP_IO_READ32(pAd, efuseDataOffset, &data);
-		//Decide the upper 2 bytes or the bottom 2 bytes.
-		// Little-endian		S	|	S	Big-endian
-		// addr	3	2	1	0	|	0	1	2	3
-		// Ori-V	D	C	B	A	|	A	B	C	D
-		//After swapping
-		//		D	C	B	A	|	D	C	B	A
-		//Return 2-bytes
-		//The return byte statrs from S. Therefore, the little-endian will return BA, the Big-endian will return DC.
-		//For returning the bottom 2 bytes, the Big-endian should shift right 2-bytes.
-		data = data >> (8*(Offset & 0x3));
-
-		NdisMoveMemory(pData, &data, Length);
-	}
-
-	return (UCHAR) eFuseCtrlStruc.field.EFSROM_AOUT;
-
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-
-	Arguments:
-
-	Return Value:
-
-	IRQL =
-
-	Note:
-
-	========================================================================
-*/
-VOID eFusePhysicalReadRegisters(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	USHORT Offset,
-	IN	USHORT Length,
-	OUT	USHORT* pData)
-{
-	EFUSE_CTRL_STRUC		eFuseCtrlStruc;
-	int	i;
-	USHORT	efuseDataOffset;
-	UINT32	data;
-
-	RTMP_IO_READ32(pAd, EFUSE_CTRL, (PUINT32) &eFuseCtrlStruc);
-
-	//Step0. Write 10-bit of address to EFSROM_AIN (0x580, bit25:bit16). The address must be 16-byte alignment.
-	eFuseCtrlStruc.field.EFSROM_AIN = Offset & 0xfff0;
-
-	//Step1. Write EFSROM_MODE (0x580, bit7:bit6) to 1.
-	//Read in physical view
-	eFuseCtrlStruc.field.EFSROM_MODE = 1;
-
-	//Step2. Write EFSROM_KICK (0x580, bit30) to 1 to kick-off physical read procedure.
-	eFuseCtrlStruc.field.EFSROM_KICK = 1;
-
-	NdisMoveMemory(&data, &eFuseCtrlStruc, 4);
-	RTMP_IO_WRITE32(pAd, EFUSE_CTRL, data);
-
-	//Step3. Polling EFSROM_KICK(0x580, bit30) until it become 0 again.
-	i = 0;
-	while(i < 100)
-	{
-		RTMP_IO_READ32(pAd, EFUSE_CTRL, (PUINT32) &eFuseCtrlStruc);
-		if(eFuseCtrlStruc.field.EFSROM_KICK == 0)
-			break;
-		RTMPusecDelay(2);
-		i++;
-	}
-
-	//Step4. Read 16-byte of data from EFUSE_DATA0-3 (0x59C-0x590)
-	//Because the size of each EFUSE_DATA is 4 Bytes, the size of address of each is 2 bits.
-	//The previous 2 bits is the EFUSE_DATA number, the last 2 bits is used to decide which bytes
-	//Decide which EFUSE_DATA to read
-	//590:F E D C
-	//594:B A 9 8
-	//598:7 6 5 4
-	//59C:3 2 1 0
-	efuseDataOffset =  EFUSE_DATA3 - (Offset & 0xC)  ;
-
-	RTMP_IO_READ32(pAd, efuseDataOffset, &data);
-
-	data = data >> (8*(Offset & 0x3));
-
-	NdisMoveMemory(pData, &data, Length);
-
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-
-	Arguments:
-
-	Return Value:
-
-	IRQL =
-
-	Note:
-
-	========================================================================
-*/
-VOID eFuseReadPhysical(
-	IN	PRTMP_ADAPTER	pAd,
-  	IN	PUSHORT lpInBuffer,
-  	IN	ULONG nInBufferSize,
-  	OUT	PUSHORT lpOutBuffer,
-  	IN	ULONG nOutBufferSize
-)
-{
-	USHORT* pInBuf = (USHORT*)lpInBuffer;
-	USHORT* pOutBuf = (USHORT*)lpOutBuffer;
-
-	USHORT Offset = pInBuf[0];					//addr
-	USHORT Length = pInBuf[1];					//length
-	int 		i;
-
-	for(i=0; i<Length; i+=2)
-	{
-		eFusePhysicalReadRegisters(pAd,Offset+i, 2, &pOutBuf[i/2]);
-	}
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-
-	Arguments:
-
-	Return Value:
-
-	IRQL =
-
-	Note:
-
-	========================================================================
-*/
-NTSTATUS eFuseRead(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	USHORT			Offset,
-	OUT	PUCHAR			pData,
-	IN	USHORT			Length)
-{
-	USHORT* pOutBuf = (USHORT*)pData;
-	NTSTATUS	Status = STATUS_SUCCESS;
-	UCHAR	EFSROM_AOUT;
-	int	i;
-
-	for(i=0; i<Length; i+=2)
-	{
-		EFSROM_AOUT = eFuseReadRegisters(pAd, Offset+i, 2, &pOutBuf[i/2]);
-	}
-	return Status;
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-
-	Arguments:
-
-	Return Value:
-
-	IRQL =
-
-	Note:
-
-	========================================================================
-*/
-VOID eFusePhysicalWriteRegisters(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	USHORT Offset,
-	IN	USHORT Length,
-	OUT	USHORT* pData)
-{
-	EFUSE_CTRL_STRUC		eFuseCtrlStruc;
-	int	i;
-	USHORT	efuseDataOffset;
-	UINT32	data, eFuseDataBuffer[4];
-
-	//Step0. Write 16-byte of data to EFUSE_DATA0-3 (0x590-0x59C), where EFUSE_DATA0 is the LSB DW, EFUSE_DATA3 is the MSB DW.
-
-	/////////////////////////////////////////////////////////////////
-	//read current values of 16-byte block
-	RTMP_IO_READ32(pAd, EFUSE_CTRL, (PUINT32) &eFuseCtrlStruc);
-
-	//Step0. Write 10-bit of address to EFSROM_AIN (0x580, bit25:bit16). The address must be 16-byte alignment.
-	eFuseCtrlStruc.field.EFSROM_AIN = Offset & 0xfff0;
-
-	//Step1. Write EFSROM_MODE (0x580, bit7:bit6) to 1.
-	eFuseCtrlStruc.field.EFSROM_MODE = 1;
-
-	//Step2. Write EFSROM_KICK (0x580, bit30) to 1 to kick-off physical read procedure.
-	eFuseCtrlStruc.field.EFSROM_KICK = 1;
-
-	NdisMoveMemory(&data, &eFuseCtrlStruc, 4);
-	RTMP_IO_WRITE32(pAd, EFUSE_CTRL, data);
-
-	//Step3. Polling EFSROM_KICK(0x580, bit30) until it become 0 again.
-	i = 0;
-	while(i < 100)
-	{
-		RTMP_IO_READ32(pAd, EFUSE_CTRL, (PUINT32) &eFuseCtrlStruc);
-
-		if(eFuseCtrlStruc.field.EFSROM_KICK == 0)
-			break;
-		RTMPusecDelay(2);
-		i++;
-	}
-
-	//Step4. Read 16-byte of data from EFUSE_DATA0-3 (0x59C-0x590)
-	efuseDataOffset =  EFUSE_DATA3;
-	for(i=0; i< 4; i++)
-	{
-		RTMP_IO_READ32(pAd, efuseDataOffset, (PUINT32) &eFuseDataBuffer[i]);
-		efuseDataOffset -=  4;
-	}
-
-	//Update the value, the offset is multiple of 2, length is 2
-	efuseDataOffset = (Offset & 0xc) >> 2;
-	data = pData[0] & 0xffff;
-	//The offset should be 0x***10 or 0x***00
-	if((Offset % 4) != 0)
-	{
-		eFuseDataBuffer[efuseDataOffset] = (eFuseDataBuffer[efuseDataOffset] & 0xffff) | (data << 16);
-	}
-	else
-	{
-		eFuseDataBuffer[efuseDataOffset] = (eFuseDataBuffer[efuseDataOffset] & 0xffff0000) | data;
-	}
-
-	efuseDataOffset =  EFUSE_DATA3;
-	for(i=0; i< 4; i++)
-	{
-		RTMP_IO_WRITE32(pAd, efuseDataOffset, eFuseDataBuffer[i]);
-		efuseDataOffset -= 4;
-	}
-	/////////////////////////////////////////////////////////////////
-
-	//Step1. Write 10-bit of address to EFSROM_AIN (0x580, bit25:bit16). The address must be 16-byte alignment.
-	eFuseCtrlStruc.field.EFSROM_AIN = Offset & 0xfff0;
-
-	//Step2. Write EFSROM_MODE (0x580, bit7:bit6) to 3.
-	eFuseCtrlStruc.field.EFSROM_MODE = 3;
-
-	//Step3. Write EFSROM_KICK (0x580, bit30) to 1 to kick-off physical write procedure.
-	eFuseCtrlStruc.field.EFSROM_KICK = 1;
-
-	NdisMoveMemory(&data, &eFuseCtrlStruc, 4);
-	RTMP_IO_WRITE32(pAd, EFUSE_CTRL, data);
-
-	//Step4. Polling EFSROM_KICK(0x580, bit30) until it become 0 again. It��s done.
-	i = 0;
-	while(i < 100)
-	{
-		RTMP_IO_READ32(pAd, EFUSE_CTRL, (PUINT32) &eFuseCtrlStruc);
-
-		if(eFuseCtrlStruc.field.EFSROM_KICK == 0)
-			break;
-
-		RTMPusecDelay(2);
-		i++;
-	}
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-
-	Arguments:
-
-	Return Value:
-
-	IRQL =
-
-	Note:
-
-	========================================================================
-*/
-NTSTATUS eFuseWriteRegisters(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	USHORT Offset,
-	IN	USHORT Length,
-	IN	USHORT* pData)
-{
-	USHORT	i;
-	USHORT	eFuseData;
-	USHORT	LogicalAddress, BlkNum = 0xffff;
-	UCHAR	EFSROM_AOUT;
-
-	USHORT addr,tmpaddr, InBuf[3], tmpOffset;
-	USHORT buffer[8];
-	BOOLEAN		bWriteSuccess = TRUE;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("eFuseWriteRegisters Offset=%x, pData=%x\n", Offset, *pData));
-
-	//Step 0. find the entry in the mapping table
-	//The address of EEPROM is 2-bytes alignment.
-	//The last bit is used for alignment, so it must be 0.
-	tmpOffset = Offset & 0xfffe;
-	EFSROM_AOUT = eFuseReadRegisters(pAd, tmpOffset, 2, &eFuseData);
-
-	if( EFSROM_AOUT == 0x3f)
-	{	//find available logical address pointer
-		//the logical address does not exist, find an empty one
-		//from the first address of block 45=16*45=0x2d0 to the last address of block 47
-		//==>48*16-3(reserved)=2FC
-		for (i=EFUSE_USAGE_MAP_START; i<=EFUSE_USAGE_MAP_END; i+=2)
-		{
-			//Retrive the logical block nubmer form each logical address pointer
-			//It will access two logical address pointer each time.
-			eFusePhysicalReadRegisters(pAd, i, 2, &LogicalAddress);
-			if( (LogicalAddress & 0xff) == 0)
-			{//Not used logical address pointer
-				BlkNum = i-EFUSE_USAGE_MAP_START;
-				break;
-			}
-			else if(( (LogicalAddress >> 8) & 0xff) == 0)
-			{//Not used logical address pointer
-				if (i != EFUSE_USAGE_MAP_END)
-				{
-					BlkNum = i-EFUSE_USAGE_MAP_START+1;
-				}
-				break;
-			}
-		}
-	}
-	else
-	{
-		BlkNum = EFSROM_AOUT;
-	}
-
-	DBGPRINT(RT_DEBUG_TRACE, ("eFuseWriteRegisters BlkNum = %d \n", BlkNum));
-
-	if(BlkNum == 0xffff)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("eFuseWriteRegisters: out of free E-fuse space!!!\n"));
-		return FALSE;
-	}
-
-	//Step 1. Save data of this block	which is pointed by the avaible logical address pointer
-	// read and save the original block data
-	for(i =0; i<8; i++)
-	{
-		addr = BlkNum * 0x10 ;
-
-		InBuf[0] = addr+2*i;
-		InBuf[1] = 2;
-		InBuf[2] = 0x0;
-
-		eFuseReadPhysical(pAd, &InBuf[0], 4, &InBuf[2], 2);
-
-		buffer[i] = InBuf[2];
-	}
-
-	//Step 2. Update the data in buffer, and write the data to Efuse
-	buffer[ (Offset >> 1) % 8] = pData[0];
-
-	do
-	{
-		//Step 3. Write the data to Efuse
-		if(!bWriteSuccess)
-		{
-			for(i =0; i<8; i++)
-			{
-				addr = BlkNum * 0x10 ;
-
-				InBuf[0] = addr+2*i;
-				InBuf[1] = 2;
-				InBuf[2] = buffer[i];
-
-				eFuseWritePhysical(pAd, &InBuf[0], 6, NULL, 2);
-			}
-		}
-		else
-		{
-				addr = BlkNum * 0x10 ;
-
-				InBuf[0] = addr+(Offset % 16);
-				InBuf[1] = 2;
-				InBuf[2] = pData[0];
-
-				eFuseWritePhysical(pAd, &InBuf[0], 6, NULL, 2);
-		}
-
-		//Step 4. Write mapping table
-		addr = EFUSE_USAGE_MAP_START+BlkNum;
-
-		tmpaddr = addr;
-
-		if(addr % 2 != 0)
-			addr = addr -1;
-		InBuf[0] = addr;
-		InBuf[1] = 2;
-
-		//convert the address from 10 to 8 bit ( bit7, 6 = parity and bit5 ~ 0 = bit9~4), and write to logical map entry
-		tmpOffset = Offset;
-		tmpOffset >>= 4;
-		tmpOffset |= ((~((tmpOffset & 0x01) ^ ( tmpOffset >> 1 & 0x01) ^  (tmpOffset >> 2 & 0x01) ^  (tmpOffset >> 3 & 0x01))) << 6) & 0x40;
-		tmpOffset |= ((~( (tmpOffset >> 2 & 0x01) ^ (tmpOffset >> 3 & 0x01) ^ (tmpOffset >> 4 & 0x01) ^ ( tmpOffset >> 5 & 0x01))) << 7) & 0x80;
-
-		// write the logical address
-		if(tmpaddr%2 != 0)
-			InBuf[2] = tmpOffset<<8;
-		else
-			InBuf[2] = tmpOffset;
-
-		eFuseWritePhysical(pAd,&InBuf[0], 6, NULL, 0);
-
-		//Step 5. Compare data if not the same, invalidate the mapping entry, then re-write the data until E-fuse is exhausted
-		bWriteSuccess = TRUE;
-		for(i =0; i<8; i++)
-		{
-			addr = BlkNum * 0x10 ;
-
-			InBuf[0] = addr+2*i;
-			InBuf[1] = 2;
-			InBuf[2] = 0x0;
-
-			eFuseReadPhysical(pAd, &InBuf[0], 4, &InBuf[2], 2);
-
-			if(buffer[i] != InBuf[2])
-			{
-				bWriteSuccess = FALSE;
-				break;
-			}
-		}
-
-		//Step 6. invlidate mapping entry and find a free mapping entry if not succeed
-		if (!bWriteSuccess)
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("Not bWriteSuccess BlkNum = %d\n", BlkNum));
-
-			// the offset of current mapping entry
-			addr = EFUSE_USAGE_MAP_START+BlkNum;
-
-			//find a new mapping entry
-			BlkNum = 0xffff;
-			for (i=EFUSE_USAGE_MAP_START; i<=EFUSE_USAGE_MAP_END; i+=2)
-			{
-				eFusePhysicalReadRegisters(pAd, i, 2, &LogicalAddress);
-				if( (LogicalAddress & 0xff) == 0)
-				{
-					BlkNum = i-EFUSE_USAGE_MAP_START;
-					break;
-				}
-				else if(( (LogicalAddress >> 8) & 0xff) == 0)
-				{
-					if (i != EFUSE_USAGE_MAP_END)
-					{
-						BlkNum = i+1-EFUSE_USAGE_MAP_START;
-					}
-					break;
-				}
-			}
-			DBGPRINT(RT_DEBUG_TRACE, ("Not bWriteSuccess new BlkNum = %d\n", BlkNum));
-			if(BlkNum == 0xffff)
-			{
-				DBGPRINT(RT_DEBUG_TRACE, ("eFuseWriteRegisters: out of free E-fuse space!!!\n"));
-				return FALSE;
-			}
-
-			//invalidate the original mapping entry if new entry is not found
-			tmpaddr = addr;
-
-			if(addr % 2 != 0)
-				addr = addr -1;
-			InBuf[0] = addr;
-			InBuf[1] = 2;
-
-			eFuseReadPhysical(pAd, &InBuf[0], 4, &InBuf[2], 2);
-
-			// write the logical address
-			if(tmpaddr%2 != 0)
-			{
-				// Invalidate the high byte
-				for (i=8; i<15; i++)
-				{
-					if( ( (InBuf[2] >> i) & 0x01) == 0)
-					{
-						InBuf[2] |= (0x1 <<i);
-						break;
-					}
-				}
-			}
-			else
-			{
-				// invalidate the low byte
-				for (i=0; i<8; i++)
-				{
-					if( ( (InBuf[2] >> i) & 0x01) == 0)
-					{
-						InBuf[2] |= (0x1 <<i);
-						break;
-					}
-				}
-			}
-			eFuseWritePhysical(pAd, &InBuf[0], 6, NULL, 0);
-		}
-	}
-	while(!bWriteSuccess);
-
-	return TRUE;
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-
-	Arguments:
-
-	Return Value:
-
-	IRQL =
-
-	Note:
-
-	========================================================================
-*/
-VOID eFuseWritePhysical(
-	IN	PRTMP_ADAPTER	pAd,
-  	PUSHORT lpInBuffer,
-	ULONG nInBufferSize,
-  	PUCHAR lpOutBuffer,
-  	ULONG nOutBufferSize
-)
-{
-	USHORT* pInBuf = (USHORT*)lpInBuffer;
-	int 		i;
-	//USHORT* pOutBuf = (USHORT*)ioBuffer;
-
-	USHORT Offset = pInBuf[0];					//addr
-	USHORT Length = pInBuf[1];					//length
-	USHORT* pValueX = &pInBuf[2];				//value ...
-		// Little-endian		S	|	S	Big-endian
-		// addr	3	2	1	0	|	0	1	2	3
-		// Ori-V	D	C	B	A	|	A	B	C	D
-		//After swapping
-		//		D	C	B	A	|	D	C	B	A
-		//Both the little and big-endian use the same sequence to write  data.
-		//Therefore, we only need swap data when read the data.
-	for(i=0; i<Length; i+=2)
-	{
-		eFusePhysicalWriteRegisters(pAd, Offset+i, 2, &pValueX[i/2]);
-	}
-}
-
-
-/*
-	========================================================================
-
-	Routine Description:
-
-	Arguments:
-
-	Return Value:
-
-	IRQL =
-
-	Note:
-
-	========================================================================
-*/
-NTSTATUS eFuseWrite(
-   	IN	PRTMP_ADAPTER	pAd,
-	IN	USHORT			Offset,
-	IN	PUCHAR			pData,
-	IN	USHORT			length)
-{
-	int i;
-
-	USHORT* pValueX = (PUSHORT) pData;				//value ...
-		//The input value=3070 will be stored as following
- 		// Little-endian		S	|	S	Big-endian
-		// addr			1	0	|	0	1
-		// Ori-V			30	70	|	30	70
-		//After swapping
-		//				30	70	|	70	30
-		//Casting
-		//				3070	|	7030 (x)
-		//The swapping should be removed for big-endian
-	for(i=0; i<length; i+=2)
-	{
-		eFuseWriteRegisters(pAd, Offset+i, 2, &pValueX[i/2]);
-	}
-
-	return TRUE;
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-
-	Arguments:
-
-	Return Value:
-
-	IRQL =
-
-	Note:
-
-	========================================================================
-*/
-INT set_eFuseGetFreeBlockCount_Proc(
-   	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
-	USHORT i;
-	USHORT	LogicalAddress;
-	USHORT efusefreenum=0;
-	if(!pAd->bUseEfuse)
-		return FALSE;
-	for (i = EFUSE_USAGE_MAP_START; i <= EFUSE_USAGE_MAP_END; i+=2)
-	{
-		eFusePhysicalReadRegisters(pAd, i, 2, &LogicalAddress);
-		if( (LogicalAddress & 0xff) == 0)
-		{
-			efusefreenum= (UCHAR) (EFUSE_USAGE_MAP_END-i+1);
-			break;
-		}
-		else if(( (LogicalAddress >> 8) & 0xff) == 0)
-		{
-			efusefreenum = (UCHAR) (EFUSE_USAGE_MAP_END-i);
-			break;
-		}
-
-		if(i == EFUSE_USAGE_MAP_END)
-			efusefreenum = 0;
-	}
-	printk("efuseFreeNumber is %d\n",efusefreenum);
-	return TRUE;
-}
-INT set_eFusedump_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
-USHORT InBuf[3];
-	INT i=0;
-	if(!pAd->bUseEfuse)
-		return FALSE;
-	for(i =0; i<EFUSE_USAGE_MAP_END/2; i++)
-	{
-		InBuf[0] = 2*i;
-		InBuf[1] = 2;
-		InBuf[2] = 0x0;
-
-		eFuseReadPhysical(pAd, &InBuf[0], 4, &InBuf[2], 2);
-		if(i%4==0)
-		printk("\nBlock %x:",i/8);
-		printk("%04x ",InBuf[2]);
-	}
-	return TRUE;
-}
-INT	set_eFuseLoadFromBin_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
-	CHAR					*src;
-	struct file				*srcf;
-	INT 					retval;
-   	mm_segment_t			orgfs;
-	UCHAR					*buffer;
-	UCHAR					BinFileSize=0;
-	INT						i = 0,j=0,k=1;
-	USHORT					*PDATA;
-	USHORT					DATA;
-	BinFileSize=strlen("RT30xxEEPROM.bin");
-	src = kmalloc(128, MEM_ALLOC_FLAG);
-	NdisZeroMemory(src, 128);
-
- 	if(strlen(arg)>0)
-	{
-
-		NdisMoveMemory(src, arg, strlen(arg));
- 	}
-
-	else
-	{
-
-		NdisMoveMemory(src, "RT30xxEEPROM.bin", BinFileSize);
-	}
-
-	DBGPRINT(RT_DEBUG_TRACE, ("FileName=%s\n",src));
-	buffer = kmalloc(MAX_EEPROM_BIN_FILE_SIZE, MEM_ALLOC_FLAG);
-
-	if(buffer == NULL)
-	{
-		kfree(src);
-		 return FALSE;
-}
-	PDATA=kmalloc(sizeof(USHORT)*8,MEM_ALLOC_FLAG);
-
-	if(PDATA==NULL)
-	{
-		kfree(src);
-
-		kfree(buffer);
-		return FALSE;
-	}
-
-    	orgfs = get_fs();
-   	 set_fs(KERNEL_DS);
-
-	if (src && *src)
-	{
-		srcf = filp_open(src, O_RDONLY, 0);
-		if (IS_ERR(srcf))
-		{
-			DBGPRINT(RT_DEBUG_ERROR, ("--> Error %ld opening %s\n", -PTR_ERR(srcf),src));
-			return FALSE;
-		}
-		else
-		{
-			// The object must have a read method
-			if (srcf->f_op && srcf->f_op->read)
-			{
-				memset(buffer, 0x00, MAX_EEPROM_BIN_FILE_SIZE);
-				while(srcf->f_op->read(srcf, &buffer[i], 1, &srcf->f_pos)==1)
-				{
-					DBGPRINT(RT_DEBUG_TRACE, ("%02X ",buffer[i]));
-					if((i+1)%8==0)
-						DBGPRINT(RT_DEBUG_TRACE, ("\n"));
-              			i++;
-						if(i>=MAX_EEPROM_BIN_FILE_SIZE)
-							{
-								DBGPRINT(RT_DEBUG_ERROR, ("--> Error %ld reading %s, The file is too large[1024]\n", -PTR_ERR(srcf),src));
-								kfree(PDATA);
-								kfree(buffer);
-								kfree(src);
-								return FALSE;
-							}
-			       }
-			}
-			else
-			{
-						DBGPRINT(RT_DEBUG_ERROR, ("--> Error!! System doest not support read function\n"));
-						kfree(PDATA);
-						kfree(buffer);
-						kfree(src);
-						return FALSE;
-			}
-      		}
-
-
-	}
-	else
-		{
-					DBGPRINT(RT_DEBUG_ERROR, ("--> Error src  or srcf is null\n"));
-					kfree(PDATA);
-					kfree(buffer);
-					return FALSE;
-
-		}
-
-
-	retval=filp_close(srcf,NULL);
-
-	if (retval)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("--> Error %d closing %s\n", -retval, src));
-	}
-	set_fs(orgfs);
-
-	for(j=0;j<i;j++)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("%02X ",buffer[j]));
-		if((j+1)%2==0)
-			PDATA[j/2%8]=((buffer[j]<<8)&0xff00)|(buffer[j-1]&0xff);
-		if(j%16==0)
-		{
-			k=buffer[j];
-		}
-		else
-		{
-			k&=buffer[j];
-			if((j+1)%16==0)
-			{
-
-				DBGPRINT(RT_DEBUG_TRACE, (" result=%02X,blk=%02x\n",k,j/16));
-
-				if(k!=0xff)
-					eFuseWriteRegistersFromBin(pAd,(USHORT)j-15, 16, PDATA);
-				else
-					{
-						if(eFuseReadRegisters(pAd,j, 2,(PUSHORT)&DATA)!=0x3f)
-							eFuseWriteRegistersFromBin(pAd,(USHORT)j-15, 16, PDATA);
-					}
-				/*
-				for(l=0;l<8;l++)
-					printk("%04x ",PDATA[l]);
-				printk("\n");
-				*/
-				NdisZeroMemory(PDATA,16);
-
-
-			}
-		}
-
-
-	}
-
-
-	kfree(PDATA);
-	kfree(buffer);
-	kfree(src);
-	return TRUE;
-}
-NTSTATUS eFuseWriteRegistersFromBin(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	USHORT Offset,
-	IN	USHORT Length,
-	IN	USHORT* pData)
-{
-	USHORT	i;
-	USHORT	eFuseData;
-	USHORT	LogicalAddress, BlkNum = 0xffff;
-	UCHAR	EFSROM_AOUT,Loop=0;
-	EFUSE_CTRL_STRUC		eFuseCtrlStruc;
-	USHORT	efuseDataOffset;
-	UINT32	data,tempbuffer;
-	USHORT addr,tmpaddr, InBuf[3], tmpOffset;
-	UINT32 buffer[4];
-	BOOLEAN		bWriteSuccess = TRUE;
-	BOOLEAN		bNotWrite=TRUE;
-	BOOLEAN		bAllocateNewBlk=TRUE;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("eFuseWriteRegistersFromBin Offset=%x, pData=%04x:%04x:%04x:%04x\n", Offset, *pData,*(pData+1),*(pData+2),*(pData+3)));
-
-	do
-	{
-	//Step 0. find the entry in the mapping table
-	//The address of EEPROM is 2-bytes alignment.
-	//The last bit is used for alignment, so it must be 0.
-	Loop++;
-	tmpOffset = Offset & 0xfffe;
-	EFSROM_AOUT = eFuseReadRegisters(pAd, tmpOffset, 2, &eFuseData);
-
-	if( EFSROM_AOUT == 0x3f)
-	{	//find available logical address pointer
-		//the logical address does not exist, find an empty one
-		//from the first address of block 45=16*45=0x2d0 to the last address of block 47
-		//==>48*16-3(reserved)=2FC
-		bAllocateNewBlk=TRUE;
-		for (i=EFUSE_USAGE_MAP_START; i<=EFUSE_USAGE_MAP_END; i+=2)
-		{
-			//Retrive the logical block nubmer form each logical address pointer
-			//It will access two logical address pointer each time.
-			eFusePhysicalReadRegisters(pAd, i, 2, &LogicalAddress);
-			if( (LogicalAddress & 0xff) == 0)
-			{//Not used logical address pointer
-				BlkNum = i-EFUSE_USAGE_MAP_START;
-				break;
-			}
-			else if(( (LogicalAddress >> 8) & 0xff) == 0)
-			{//Not used logical address pointer
-				if (i != EFUSE_USAGE_MAP_END)
-				{
-					BlkNum = i-EFUSE_USAGE_MAP_START+1;
-				}
-				break;
-			}
-		}
-	}
-	else
-	{
-		bAllocateNewBlk=FALSE;
-		BlkNum = EFSROM_AOUT;
-	}
-
-	DBGPRINT(RT_DEBUG_TRACE, ("eFuseWriteRegisters BlkNum = %d \n", BlkNum));
-
-	if(BlkNum == 0xffff)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("eFuseWriteRegisters: out of free E-fuse space!!!\n"));
-		return FALSE;
-	}
-	//Step 1.1.0
-	//If the block is not existing in mapping table, create one
-	//and write down the 16-bytes data to the new block
-	if(bAllocateNewBlk)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("Allocate New Blk\n"));
-		efuseDataOffset =  EFUSE_DATA3;
-		for(i=0; i< 4; i++)
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("Allocate New Blk, Data%d=%04x%04x\n",3-i,pData[2*i+1],pData[2*i]));
-			tempbuffer=((pData[2*i+1]<<16)&0xffff0000)|pData[2*i];
-
-
-			RTMP_IO_WRITE32(pAd, efuseDataOffset,tempbuffer);
-			efuseDataOffset -= 4;
-
-		}
-		/////////////////////////////////////////////////////////////////
-
-		//Step1.1.1. Write 10-bit of address to EFSROM_AIN (0x580, bit25:bit16). The address must be 16-byte alignment.
-		eFuseCtrlStruc.field.EFSROM_AIN = BlkNum* 0x10 ;
-
-		//Step1.1.2. Write EFSROM_MODE (0x580, bit7:bit6) to 3.
-		eFuseCtrlStruc.field.EFSROM_MODE = 3;
-
-		//Step1.1.3. Write EFSROM_KICK (0x580, bit30) to 1 to kick-off physical write procedure.
-		eFuseCtrlStruc.field.EFSROM_KICK = 1;
-
-		NdisMoveMemory(&data, &eFuseCtrlStruc, 4);
-
-		RTMP_IO_WRITE32(pAd, EFUSE_CTRL, data);
-
-		//Step1.1.4. Polling EFSROM_KICK(0x580, bit30) until it become 0 again. It��s done.
-		i = 0;
-		while(i < 100)
-		{
-			RTMP_IO_READ32(pAd, EFUSE_CTRL, (PUINT32) &eFuseCtrlStruc);
-
-			if(eFuseCtrlStruc.field.EFSROM_KICK == 0)
-				break;
-
-			RTMPusecDelay(2);
-			i++;
-		}
-
-	}
-	else
-	{	//Step1.2.
-		//If the same logical number is existing, check if the writting data and the data
-		//saving in this block are the same.
-		/////////////////////////////////////////////////////////////////
-		//read current values of 16-byte block
-		RTMP_IO_READ32(pAd, EFUSE_CTRL, (PUINT32) &eFuseCtrlStruc);
-
-		//Step1.2.0. Write 10-bit of address to EFSROM_AIN (0x580, bit25:bit16). The address must be 16-byte alignment.
-		eFuseCtrlStruc.field.EFSROM_AIN = Offset & 0xfff0;
-
-		//Step1.2.1. Write EFSROM_MODE (0x580, bit7:bit6) to 1.
-		eFuseCtrlStruc.field.EFSROM_MODE = 0;
-
-		//Step1.2.2. Write EFSROM_KICK (0x580, bit30) to 1 to kick-off physical read procedure.
-		eFuseCtrlStruc.field.EFSROM_KICK = 1;
-
-		NdisMoveMemory(&data, &eFuseCtrlStruc, 4);
-		RTMP_IO_WRITE32(pAd, EFUSE_CTRL, data);
-
-		//Step1.2.3. Polling EFSROM_KICK(0x580, bit30) until it become 0 again.
-		i = 0;
-		while(i < 100)
-		{
-			RTMP_IO_READ32(pAd, EFUSE_CTRL, (PUINT32) &eFuseCtrlStruc);
-
-			if(eFuseCtrlStruc.field.EFSROM_KICK == 0)
-				break;
-			RTMPusecDelay(2);
-			i++;
-		}
-
-		//Step1.2.4. Read 16-byte of data from EFUSE_DATA0-3 (0x59C-0x590)
-		efuseDataOffset =  EFUSE_DATA3;
-		for(i=0; i< 4; i++)
-		{
-			RTMP_IO_READ32(pAd, efuseDataOffset, (PUINT32) &buffer[i]);
-			efuseDataOffset -=  4;
-		}
-		//Step1.2.5. Check if the data of efuse and the writing data are the same.
-		for(i =0; i<4; i++)
-		{
-			tempbuffer=((pData[2*i+1]<<16)&0xffff0000)|pData[2*i];
-			DBGPRINT(RT_DEBUG_TRACE, ("buffer[%d]=%x,pData[%d]=%x,pData[%d]=%x,tempbuffer=%x\n",i,buffer[i],2*i,pData[2*i],2*i+1,pData[2*i+1],tempbuffer));
-
-			if(((buffer[i]&0xffff0000)==(pData[2*i+1]<<16))&&((buffer[i]&0xffff)==pData[2*i]))
-				bNotWrite&=TRUE;
-			else
-			{
-				bNotWrite&=FALSE;
-				break;
-			}
-		}
-		if(!bNotWrite)
-		{
-		printk("The data is not the same\n");
-
-			for(i =0; i<8; i++)
-			{
-				addr = BlkNum * 0x10 ;
-
-				InBuf[0] = addr+2*i;
-				InBuf[1] = 2;
-				InBuf[2] = pData[i];
-
-				eFuseWritePhysical(pAd, &InBuf[0], 6, NULL, 2);
-			}
-
-		}
-		else
-			return TRUE;
-	     }
-
-
-
-		//Step 2. Write mapping table
-		addr = EFUSE_USAGE_MAP_START+BlkNum;
-
-		tmpaddr = addr;
-
-		if(addr % 2 != 0)
-			addr = addr -1;
-		InBuf[0] = addr;
-		InBuf[1] = 2;
-
-		//convert the address from 10 to 8 bit ( bit7, 6 = parity and bit5 ~ 0 = bit9~4), and write to logical map entry
-		tmpOffset = Offset;
-		tmpOffset >>= 4;
-		tmpOffset |= ((~((tmpOffset & 0x01) ^ ( tmpOffset >> 1 & 0x01) ^  (tmpOffset >> 2 & 0x01) ^  (tmpOffset >> 3 & 0x01))) << 6) & 0x40;
-		tmpOffset |= ((~( (tmpOffset >> 2 & 0x01) ^ (tmpOffset >> 3 & 0x01) ^ (tmpOffset >> 4 & 0x01) ^ ( tmpOffset >> 5 & 0x01))) << 7) & 0x80;
-
-		// write the logical address
-		if(tmpaddr%2 != 0)
-			InBuf[2] = tmpOffset<<8;
-		else
-			InBuf[2] = tmpOffset;
-
-		eFuseWritePhysical(pAd,&InBuf[0], 6, NULL, 0);
-
-		//Step 3. Compare data if not the same, invalidate the mapping entry, then re-write the data until E-fuse is exhausted
-		bWriteSuccess = TRUE;
-		for(i =0; i<8; i++)
-		{
-			addr = BlkNum * 0x10 ;
-
-			InBuf[0] = addr+2*i;
-			InBuf[1] = 2;
-			InBuf[2] = 0x0;
-
-			eFuseReadPhysical(pAd, &InBuf[0], 4, &InBuf[2], 2);
-			DBGPRINT(RT_DEBUG_TRACE, ("addr=%x, buffer[i]=%x,InBuf[2]=%x\n",InBuf[0],pData[i],InBuf[2]));
-			if(pData[i] != InBuf[2])
-			{
-				bWriteSuccess = FALSE;
-				break;
-			}
-		}
-
-		//Step 4. invlidate mapping entry and find a free mapping entry if not succeed
-
-		if (!bWriteSuccess&&Loop<2)
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("eFuseWriteRegistersFromBin::Not bWriteSuccess BlkNum = %d\n", BlkNum));
-
-			// the offset of current mapping entry
-			addr = EFUSE_USAGE_MAP_START+BlkNum;
-
-			//find a new mapping entry
-			BlkNum = 0xffff;
-			for (i=EFUSE_USAGE_MAP_START; i<=EFUSE_USAGE_MAP_END; i+=2)
-			{
-				eFusePhysicalReadRegisters(pAd, i, 2, &LogicalAddress);
-				if( (LogicalAddress & 0xff) == 0)
-				{
-					BlkNum = i-EFUSE_USAGE_MAP_START;
-					break;
-				}
-				else if(( (LogicalAddress >> 8) & 0xff) == 0)
-				{
-					if (i != EFUSE_USAGE_MAP_END)
-					{
-						BlkNum = i+1-EFUSE_USAGE_MAP_START;
-					}
-					break;
-				}
-			}
-			DBGPRINT(RT_DEBUG_TRACE, ("eFuseWriteRegistersFromBin::Not bWriteSuccess new BlkNum = %d\n", BlkNum));
-			if(BlkNum == 0xffff)
-			{
-				DBGPRINT(RT_DEBUG_TRACE, ("eFuseWriteRegistersFromBin: out of free E-fuse space!!!\n"));
-				return FALSE;
-			}
-
-			//invalidate the original mapping entry if new entry is not found
-			tmpaddr = addr;
-
-			if(addr % 2 != 0)
-				addr = addr -1;
-			InBuf[0] = addr;
-			InBuf[1] = 2;
-
-			eFuseReadPhysical(pAd, &InBuf[0], 4, &InBuf[2], 2);
-
-			// write the logical address
-			if(tmpaddr%2 != 0)
-			{
-				// Invalidate the high byte
-				for (i=8; i<15; i++)
-				{
-					if( ( (InBuf[2] >> i) & 0x01) == 0)
-					{
-						InBuf[2] |= (0x1 <<i);
-						break;
-					}
-				}
-			}
-			else
-			{
-				// invalidate the low byte
-				for (i=0; i<8; i++)
-				{
-					if( ( (InBuf[2] >> i) & 0x01) == 0)
-					{
-						InBuf[2] |= (0x1 <<i);
-						break;
-					}
-				}
-			}
-			eFuseWritePhysical(pAd, &InBuf[0], 6, NULL, 0);
-		}
-
-	}
-	while(!bWriteSuccess&&Loop<2);
 
-	return TRUE;
+		RTMPusecDelay(10);
+	} while (index++ < 100);
+
+	pAd->bUseEfuse = FALSE;
+	RTMP_IO_READ32(pAd, EFUSE_CTRL, &eFuseCtrl);
+	pAd->bUseEfuse = ((eFuseCtrl & 0x80000000) == 0x80000000) ? 1 : 0;
+	if (pAd->bUseEfuse) {
+		pChipOps->eeinit = eFuse_init;
+		pChipOps->eeread = rtmp_ee_efuse_read16;
+		return 0;
+	} else
+		DBGPRINT(RT_DEBUG_TRACE, ("NVM is EEPROM\n"));
+#endif /* RTMP_EFUSE_SUPPORT // */
+#endif /* RT30xx // */
+
+	switch (infType) {
+#ifdef RTMP_PCI_SUPPORT
+	case RTMP_DEV_INF_PCI:
+		pChipOps->eeinit = NULL;
+		pChipOps->eeread = rtmp_ee_prom_read16;
+		break;
+#endif /* RTMP_PCI_SUPPORT // */
+#ifdef RTMP_USB_SUPPORT
+	case RTMP_DEV_INF_USB:
+		pChipOps->eeinit = NULL;
+		pChipOps->eeread = RTUSBReadEEPROM16;
+		break;
+#endif /* RTMP_USB_SUPPORT // */
+
+	default:
+		DBGPRINT(RT_DEBUG_ERROR, ("RtmpChipOpsEepromHook() failed!\n"));
+		break;
+	}
+
+	return 0;
 }
-#endif
diff --git a/drivers/staging/rt2860/common/firmware.h b/drivers/staging/rt2860/common/firmware.h
index e72996f42c07..2fecd32f7600 100644
--- a/drivers/staging/rt2860/common/firmware.h
+++ b/drivers/staging/rt2860/common/firmware.h
@@ -43,7 +43,7 @@
 /* AUTO GEN PLEASE DO NOT MODIFY IT */
 
 
-UCHAR FirmwareImage [] = {
+u8 FirmwareImage_2860 [] = {
 0x02, 0x03, 0x5e, 0x02, 0x02, 0xb1, 0x22, 0x22, 0xff, 0xff, 0xff, 0x02, 0x01, 0x82, 0xff, 0xff,
 0xff, 0xff, 0xff, 0x02, 0x00, 0x1e, 0xff, 0xff, 0xff, 0xff, 0xff, 0x02, 0x01, 0x33, 0xc0, 0xe0,
 0xc0, 0xf0, 0xc0, 0x83, 0xc0, 0x82, 0xc0, 0xd0, 0x75, 0xd0, 0x18, 0xc2, 0xaf, 0x30, 0x45, 0x03,
diff --git a/drivers/staging/rt2860/common/firmware_3070.h b/drivers/staging/rt2860/common/firmware_3070.h
new file mode 100644
index 000000000000..b710d40bc046
--- /dev/null
+++ b/drivers/staging/rt2860/common/firmware_3070.h
@@ -0,0 +1,517 @@
+/* AUTO GEN PLEASE DO NOT MODIFY IT */
+/* AUTO GEN PLEASE DO NOT MODIFY IT */
+
+
+u8 FirmwareImage_3070 [] = {
+0xff, 0xff, 0xff, 0x02, 0x10, 0x28, 0x02, 0x10, 0x32, 0x02, 0x10, 0x78, 0x02, 0x13, 0x1f, 0x02,
+0x13, 0x20, 0x02, 0x13, 0x3f, 0x02, 0x13, 0x44, 0x12, 0x13, 0x40, 0x22, 0x02, 0x17, 0xae, 0x02,
+0x18, 0xd2, 0x02, 0x14, 0x3d, 0x02, 0x13, 0x78, 0x30, 0x05, 0x06, 0x20, 0x0d, 0x03, 0x12, 0x19,
+0x95, 0x22, 0x90, 0x01, 0x8c, 0xe0, 0x30, 0xe3, 0x1b, 0xe5, 0x4c, 0x30, 0xe0, 0x04, 0x7f, 0x40,
+0x80, 0x02, 0x7f, 0x00, 0x90, 0x10, 0x2f, 0xef, 0xf0, 0x90, 0x01, 0x8c, 0x74, 0x08, 0xf0, 0xe4,
+0x90, 0x01, 0xa7, 0xf0, 0x90, 0x01, 0x8c, 0xe0, 0x30, 0xe0, 0x1c, 0x90, 0x01, 0x80, 0xe0, 0xb4,
+0x02, 0x15, 0xa3, 0xe0, 0xb4, 0x01, 0x10, 0x90, 0x01, 0x84, 0xe0, 0xb4, 0x81, 0x09, 0x90, 0x01,
+0x8c, 0x74, 0x01, 0xf0, 0x12, 0x0d, 0xc8, 0x22, 0x90, 0x04, 0x14, 0xe0, 0x20, 0xe7, 0x03, 0x02,
+0x13, 0x1e, 0x90, 0x70, 0x12, 0xe0, 0xf5, 0x56, 0x90, 0x04, 0x04, 0xe0, 0x12, 0x0a, 0x9d, 0x10,
+0xd9, 0x31, 0x10, 0xbd, 0x36, 0x11, 0x02, 0x50, 0x11, 0x39, 0x51, 0x11, 0x42, 0x52, 0x11, 0x42,
+0x53, 0x11, 0x42, 0x54, 0x11, 0x83, 0x55, 0x11, 0xd2, 0x56, 0x12, 0x25, 0x70, 0x12, 0x50, 0x71,
+0x12, 0x7e, 0x72, 0x12, 0xd5, 0x73, 0x12, 0xf6, 0x80, 0x00, 0x00, 0x13, 0x1e, 0x90, 0x70, 0x11,
+0xe0, 0xf5, 0x3c, 0xe4, 0x90, 0x70, 0x13, 0xf0, 0x90, 0x04, 0x14, 0x74, 0x80, 0xf0, 0xe5, 0x56,
+0xf4, 0x70, 0x03, 0x02, 0x13, 0x1e, 0x02, 0x13, 0x17, 0x20, 0x02, 0x03, 0x30, 0x03, 0x1d, 0x7d,
+0x02, 0xaf, 0x56, 0x12, 0x0b, 0x91, 0x90, 0x04, 0x14, 0x74, 0x80, 0xf0, 0xe4, 0x90, 0x70, 0x13,
+0xf0, 0xe5, 0x56, 0xf4, 0x70, 0x03, 0x02, 0x13, 0x1e, 0x02, 0x13, 0x17, 0x85, 0x56, 0x41, 0xd2,
+0x02, 0x22, 0x90, 0x70, 0x10, 0xe0, 0x54, 0x7f, 0xff, 0xbf, 0x0a, 0x0d, 0x90, 0x70, 0x11, 0xe0,
+0xb4, 0x08, 0x06, 0x75, 0x4e, 0x01, 0x75, 0x4f, 0x84, 0x90, 0x70, 0x10, 0xe0, 0x54, 0x7f, 0xff,
+0xbf, 0x02, 0x12, 0x90, 0x70, 0x11, 0xe0, 0x64, 0x08, 0x60, 0x04, 0xe0, 0xb4, 0x20, 0x06, 0x75,
+0x4e, 0x03, 0x75, 0x4f, 0x20, 0xe4, 0xf5, 0x27, 0x22, 0x90, 0x70, 0x11, 0xe0, 0x24, 0xff, 0x92,
+0x47, 0x22, 0x90, 0x04, 0x04, 0xe0, 0x25, 0xe0, 0x24, 0x5d, 0xf5, 0x57, 0x90, 0x70, 0x10, 0xe0,
+0xff, 0x74, 0x47, 0x25, 0x57, 0xf8, 0xc6, 0xef, 0xc6, 0x90, 0x70, 0x11, 0xe0, 0xff, 0x74, 0x48,
+0x25, 0x57, 0xf8, 0xc6, 0xef, 0xc6, 0xe4, 0xfd, 0xaf, 0x56, 0x12, 0x0b, 0x91, 0x90, 0x04, 0x14,
+0x74, 0x80, 0xf0, 0xe4, 0x90, 0x70, 0x13, 0xf0, 0xe5, 0x56, 0xf4, 0x70, 0x03, 0x02, 0x13, 0x1e,
+0x02, 0x13, 0x17, 0xe5, 0x47, 0x64, 0x07, 0x60, 0x1d, 0xe5, 0x47, 0x64, 0x08, 0x60, 0x17, 0xe5,
+0x47, 0x64, 0x09, 0x60, 0x11, 0xe5, 0x47, 0x64, 0x0a, 0x60, 0x0b, 0xe5, 0x47, 0x64, 0x0b, 0x60,
+0x05, 0xe5, 0x47, 0xb4, 0x0c, 0x08, 0x90, 0x70, 0x11, 0xe0, 0x54, 0x0f, 0xf5, 0x3a, 0xe5, 0x47,
+0xb4, 0x09, 0x08, 0xe5, 0x3a, 0xb4, 0x03, 0x03, 0xe4, 0xf5, 0x46, 0xe5, 0x47, 0xb4, 0x0a, 0x08,
+0xe5, 0x3a, 0xb4, 0x01, 0x03, 0xe4, 0xf5, 0x46, 0xe4, 0xfd, 0xaf, 0x56, 0x12, 0x0b, 0x91, 0xd2,
+0x04, 0x22, 0x90, 0x70, 0x11, 0xe0, 0xf4, 0xff, 0x90, 0x70, 0x10, 0xe0, 0x5f, 0xff, 0x90, 0x70,
+0x11, 0xe0, 0x55, 0x27, 0x4f, 0x90, 0x70, 0x18, 0xf0, 0x90, 0x70, 0x11, 0xe0, 0x90, 0x70, 0x19,
+0xf0, 0xe4, 0xfd, 0xaf, 0x56, 0x12, 0x0b, 0x91, 0x30, 0x15, 0x03, 0xd2, 0x14, 0x22, 0x90, 0x70,
+0x18, 0xe0, 0xf5, 0x27, 0x90, 0x02, 0x29, 0xe0, 0xff, 0x90, 0x70, 0x19, 0xe0, 0xfe, 0xef, 0x5e,
+0x90, 0x02, 0x29, 0xf0, 0x30, 0x47, 0x04, 0xaf, 0x27, 0x80, 0x04, 0xe5, 0x27, 0xf4, 0xff, 0x90,
+0x02, 0x28, 0xef, 0xf0, 0x22, 0x90, 0x70, 0x10, 0xe0, 0xfe, 0x90, 0x70, 0x11, 0xe0, 0xfd, 0xed,
+0xf8, 0xe6, 0xf5, 0x57, 0xfd, 0xaf, 0x56, 0x12, 0x0b, 0x91, 0x90, 0x04, 0x14, 0x74, 0x80, 0xf0,
+0xe4, 0x90, 0x70, 0x13, 0xf0, 0xe5, 0x56, 0xf4, 0x70, 0x03, 0x02, 0x13, 0x1e, 0x02, 0x13, 0x17,
+0x90, 0x70, 0x10, 0xe0, 0xfe, 0x90, 0x70, 0x11, 0xe0, 0xfd, 0xed, 0xf5, 0x82, 0x8e, 0x83, 0xe0,
+0xf5, 0x57, 0xfd, 0xaf, 0x56, 0x12, 0x0b, 0x91, 0x90, 0x04, 0x14, 0x74, 0x80, 0xf0, 0xe4, 0x90,
+0x70, 0x13, 0xf0, 0xe5, 0x56, 0xf4, 0x70, 0x03, 0x02, 0x13, 0x1e, 0x02, 0x13, 0x17, 0x90, 0x10,
+0x00, 0xe0, 0xf5, 0x57, 0x90, 0x10, 0x02, 0xe0, 0xf5, 0x58, 0xa3, 0xe0, 0xf5, 0x59, 0xe5, 0x58,
+0xb4, 0x70, 0x1e, 0xe5, 0x59, 0xb4, 0x30, 0x19, 0x90, 0x05, 0x08, 0xe0, 0x44, 0x01, 0xf0, 0xfd,
+0x90, 0x05, 0x05, 0xe0, 0x54, 0xfb, 0xf0, 0x44, 0x04, 0xf0, 0xed, 0x54, 0xfe, 0x90, 0x05, 0x08,
+0xf0, 0xe4, 0xf5, 0x4e, 0xf5, 0x4f, 0x75, 0x3a, 0xff, 0x75, 0x3c, 0xff, 0xad, 0x57, 0xaf, 0x56,
+0x12, 0x0b, 0x91, 0x90, 0x04, 0x14, 0x74, 0x80, 0xf0, 0xe4, 0x90, 0x70, 0x13, 0xf0, 0xe5, 0x56,
+0xf4, 0x60, 0x4b, 0x80, 0x42, 0x90, 0x70, 0x10, 0xe0, 0x24, 0xff, 0x92, 0x93, 0xe4, 0xfd, 0xaf,
+0x56, 0x12, 0x0b, 0x91, 0x90, 0x04, 0x14, 0x74, 0x80, 0xf0, 0xe4, 0x90, 0x70, 0x13, 0xf0, 0xe5,
+0x56, 0xf4, 0x60, 0x2a, 0x80, 0x21, 0x90, 0x70, 0x10, 0xe0, 0x24, 0xff, 0x92, 0x4a, 0xd2, 0x05,
+0xad, 0x57, 0xaf, 0x56, 0x12, 0x0b, 0x91, 0x90, 0x04, 0x14, 0x74, 0x80, 0xf0, 0xe4, 0x90, 0x70,
+0x13, 0xf0, 0xe5, 0x56, 0xf4, 0x60, 0x07, 0x90, 0x70, 0x25, 0xe0, 0x44, 0x01, 0xf0, 0x22, 0x22,
+0xe5, 0x53, 0x70, 0x1a, 0x30, 0x60, 0x09, 0xb2, 0x4d, 0x30, 0x4d, 0x04, 0x05, 0x46, 0xc2, 0x04,
+0xe5, 0x4f, 0x45, 0x4e, 0x60, 0x08, 0xe5, 0x4f, 0x15, 0x4f, 0x70, 0x02, 0x15, 0x4e, 0x22, 0x22,
+0xc2, 0x42, 0xd3, 0x22, 0x30, 0x14, 0x30, 0x90, 0x70, 0x19, 0xe0, 0x55, 0x27, 0xff, 0x90, 0x70,
+0x18, 0xe0, 0x4f, 0xf5, 0x27, 0x90, 0x02, 0x29, 0xe0, 0xff, 0x90, 0x70, 0x19, 0xe0, 0xfe, 0xef,
+0x5e, 0x90, 0x02, 0x29, 0xf0, 0x30, 0x47, 0x04, 0xaf, 0x27, 0x80, 0x04, 0xe5, 0x27, 0xf4, 0xff,
+0x90, 0x02, 0x28, 0xef, 0xf0, 0xc2, 0x14, 0x22, 0xc2, 0x4b, 0xc2, 0x4c, 0xe5, 0x44, 0x12, 0x0a,
+0x9d, 0x13, 0x9a, 0x00, 0x14, 0x28, 0x04, 0x14, 0x24, 0x08, 0x14, 0x04, 0x10, 0x13, 0xae, 0x20,
+0x13, 0xce, 0x60, 0x13, 0xdf, 0xa0, 0x00, 0x00, 0x14, 0x2a, 0x85, 0x48, 0x43, 0x85, 0x4a, 0x42,
+0x85, 0x4c, 0x5e, 0xe5, 0x47, 0x64, 0x06, 0x60, 0x03, 0x02, 0x14, 0x2a, 0x80, 0x1b, 0xe5, 0x48,
+0xc4, 0x54, 0x0f, 0xf5, 0x43, 0xe5, 0x4a, 0xc4, 0x54, 0x0f, 0xf5, 0x42, 0xe5, 0x4c, 0xc4, 0x54,
+0x0f, 0xf5, 0x5e, 0xe5, 0x47, 0x64, 0x06, 0x70, 0x61, 0x53, 0x43, 0x0f, 0x80, 0x5c, 0x85, 0x49,
+0x43, 0x85, 0x4b, 0x42, 0x85, 0x4d, 0x5e, 0xe5, 0x47, 0x64, 0x06, 0x70, 0x4d, 0x80, 0x1b, 0xe5,
+0x49, 0xc4, 0x54, 0x0f, 0xf5, 0x43, 0xe5, 0x4b, 0xc4, 0x54, 0x0f, 0xf5, 0x42, 0xe5, 0x4d, 0xc4,
+0x54, 0x0f, 0xf5, 0x5e, 0xe5, 0x47, 0x64, 0x06, 0x70, 0x30, 0xe5, 0x43, 0x54, 0x0f, 0x44, 0x10,
+0xf5, 0x43, 0x80, 0x26, 0xe5, 0x47, 0x64, 0x04, 0x60, 0x05, 0xe5, 0x47, 0xb4, 0x05, 0x06, 0x43,
+0x5e, 0x04, 0x75, 0x42, 0x09, 0xe5, 0x47, 0xb4, 0x06, 0x10, 0xe5, 0x43, 0x54, 0x0f, 0x44, 0x30,
+0xf5, 0x43, 0x80, 0x06, 0xd2, 0x4b, 0x80, 0x02, 0xd2, 0x4c, 0xe4, 0xf5, 0x25, 0xe5, 0x42, 0xc4,
+0x54, 0xf0, 0xff, 0xe5, 0x43, 0x54, 0x0f, 0x4f, 0xf5, 0x5f, 0xd2, 0x60, 0x22, 0xd2, 0x15, 0xe5,
+0x47, 0x24, 0xf5, 0x60, 0x0b, 0x24, 0xcb, 0x60, 0x07, 0x24, 0x40, 0x70, 0x06, 0xc2, 0x15, 0x22,
+0x12, 0x17, 0x79, 0x12, 0x14, 0x5f, 0xc2, 0x15, 0xc2, 0xaf, 0xc2, 0x04, 0xd2, 0xaf, 0x22, 0xc2,
+0xaf, 0x90, 0x04, 0x14, 0xe0, 0x54, 0x0e, 0x60, 0x04, 0xd2, 0x18, 0x80, 0x08, 0xe5, 0x4e, 0x45,
+0x4f, 0x24, 0xff, 0x92, 0x18, 0xd2, 0xaf, 0x90, 0x04, 0x14, 0xe0, 0xa2, 0xe4, 0x92, 0x19, 0x74,
+0x1e, 0xf0, 0xe5, 0x5f, 0x54, 0x0f, 0xf5, 0x2d, 0xe5, 0x25, 0x70, 0x13, 0x30, 0x18, 0x05, 0xe5,
+0x5f, 0x20, 0xe5, 0x0b, 0x30, 0x19, 0x19, 0xe5, 0x5f, 0x54, 0x30, 0xff, 0xbf, 0x30, 0x11, 0xe5,
+0x25, 0x70, 0x05, 0x75, 0x25, 0x0c, 0x80, 0x02, 0x15, 0x25, 0xd2, 0x6c, 0xd2, 0x6d, 0x80, 0x0f,
+0xe5, 0x5f, 0x30, 0xe6, 0x06, 0xc2, 0x6c, 0xd2, 0x6d, 0x80, 0x04, 0xd2, 0x6c, 0xc2, 0x6d, 0xe5,
+0x47, 0x64, 0x03, 0x70, 0x21, 0x30, 0x4b, 0x06, 0xc2, 0x6c, 0xd2, 0x6d, 0x80, 0x18, 0xe5, 0x25,
+0x70, 0x03, 0x30, 0x4c, 0x11, 0xc2, 0x4c, 0xe5, 0x25, 0x70, 0x05, 0x75, 0x25, 0x07, 0x80, 0x02,
+0x15, 0x25, 0xd2, 0x6c, 0xd2, 0x6d, 0xe5, 0x47, 0xb4, 0x09, 0x14, 0xe5, 0x44, 0x20, 0xe3, 0x0b,
+0xe5, 0x3a, 0x64, 0x02, 0x60, 0x05, 0xe5, 0x3a, 0xb4, 0x03, 0x04, 0xc2, 0x6c, 0xd2, 0x6d, 0xe5,
+0x47, 0xb4, 0x0a, 0x13, 0xe5, 0x3a, 0xb4, 0x01, 0x06, 0xc2, 0x6c, 0xd2, 0x6d, 0x80, 0x08, 0xe5,
+0x3a, 0x70, 0x04, 0xd2, 0x6c, 0xc2, 0x6d, 0x20, 0x69, 0x07, 0xe5, 0x5e, 0x20, 0xe0, 0x02, 0xb2,
+0x68, 0x20, 0x6b, 0x07, 0xe5, 0x5e, 0x20, 0xe1, 0x02, 0xb2, 0x6a, 0x20, 0x6d, 0x07, 0xe5, 0x5e,
+0x20, 0xe2, 0x02, 0xb2, 0x6c, 0x75, 0x2e, 0x40, 0x20, 0x69, 0x04, 0xa2, 0x68, 0x80, 0x26, 0x30,
+0x68, 0x06, 0xe5, 0x46, 0xa2, 0xe2, 0x80, 0x1d, 0xe5, 0x5e, 0x20, 0xe2, 0x04, 0x7f, 0x01, 0x80,
+0x02, 0x7f, 0x00, 0xe5, 0x46, 0x54, 0xf0, 0xfe, 0xbe, 0xf0, 0x04, 0x7e, 0x01, 0x80, 0x02, 0x7e,
+0x00, 0xee, 0x6f, 0x24, 0xff, 0x92, 0x73, 0x92, 0x72, 0x20, 0x6b, 0x04, 0xa2, 0x6a, 0x80, 0x26,
+0x30, 0x6a, 0x06, 0xe5, 0x46, 0xa2, 0xe2, 0x80, 0x1d, 0xe5, 0x5e, 0x20, 0xe0, 0x04, 0x7f, 0x01,
+0x80, 0x02, 0x7f, 0x00, 0xe5, 0x46, 0x54, 0xf0, 0xfe, 0xbe, 0xf0, 0x04, 0x7e, 0x01, 0x80, 0x02,
+0x7e, 0x00, 0xee, 0x6f, 0x24, 0xff, 0x92, 0x75, 0x92, 0x74, 0x20, 0x6d, 0x04, 0xa2, 0x6c, 0x80,
+0x26, 0xe5, 0x47, 0x64, 0x0a, 0x70, 0x22, 0x30, 0x6c, 0x06, 0xe5, 0x46, 0xa2, 0xe3, 0x80, 0x17,
+0xe5, 0x3a, 0xb4, 0x01, 0x06, 0xe5, 0x46, 0xa2, 0xe3, 0x80, 0x34, 0xe5, 0x46, 0x20, 0xe4, 0x03,
+0x30, 0xe5, 0x03, 0xd3, 0x80, 0x01, 0xc3, 0x80, 0x26, 0x30, 0x6c, 0x06, 0xe5, 0x46, 0xa2, 0xe2,
+0x80, 0x1d, 0xe5, 0x5e, 0x20, 0xe1, 0x04, 0x7f, 0x01, 0x80, 0x02, 0x7f, 0x00, 0xe5, 0x46, 0x54,
+0xf0, 0xfe, 0xbe, 0xf0, 0x04, 0x7e, 0x01, 0x80, 0x02, 0x7e, 0x00, 0xee, 0x6f, 0x24, 0xff, 0x92,
+0x71, 0x92, 0x70, 0x90, 0x10, 0x00, 0xe0, 0x90, 0x10, 0x2c, 0xf0, 0x90, 0x10, 0x03, 0xe0, 0xc3,
+0x94, 0x30, 0x40, 0x14, 0xa2, 0x71, 0x92, 0x77, 0xa2, 0x70, 0x92, 0x76, 0xe5, 0x2e, 0x13, 0x13,
+0x54, 0x3f, 0xf5, 0x2e, 0xc2, 0x77, 0xd2, 0x76, 0x90, 0x10, 0x2f, 0xe5, 0x2e, 0xf0, 0xe5, 0x47,
+0x64, 0x06, 0x70, 0x39, 0x90, 0x02, 0x29, 0xe0, 0x54, 0xfe, 0xf0, 0xe5, 0x43, 0xc4, 0x54, 0x0f,
+0x14, 0x60, 0x0c, 0x24, 0xfe, 0x60, 0x0c, 0x24, 0x03, 0x70, 0x13, 0xc2, 0x38, 0x80, 0x0f, 0xd2,
+0x38, 0x80, 0x0b, 0xe5, 0x46, 0x30, 0xe2, 0x03, 0xd3, 0x80, 0x01, 0xc3, 0x92, 0x38, 0x30, 0x47,
+0x05, 0xaf, 0x27, 0x02, 0x17, 0x73, 0xe5, 0x27, 0xf4, 0xff, 0x02, 0x17, 0x73, 0xe5, 0x47, 0x64,
+0x07, 0x60, 0x0f, 0xe5, 0x47, 0x64, 0x08, 0x60, 0x09, 0xe5, 0x47, 0x64, 0x09, 0x60, 0x03, 0x02,
+0x16, 0xf2, 0x90, 0x02, 0x29, 0xe0, 0x54, 0xfc, 0xf0, 0xe5, 0x3a, 0x14, 0x60, 0x22, 0x14, 0x60,
+0x25, 0x14, 0x60, 0x2d, 0x24, 0xfc, 0x60, 0x49, 0x24, 0xf9, 0x60, 0x14, 0x24, 0x0e, 0x70, 0x50,
+0xe5, 0x46, 0x13, 0x13, 0x54, 0x3f, 0x75, 0xf0, 0x03, 0x84, 0xe5, 0xf0, 0x24, 0xff, 0x80, 0x3a,
+0xd2, 0x39, 0xc2, 0x38, 0x80, 0x3e, 0xe5, 0x46, 0x30, 0xe2, 0x03, 0xd3, 0x80, 0x1d, 0xc3, 0x80,
+0x1a, 0xe5, 0x46, 0x30, 0xe2, 0x0d, 0x54, 0x38, 0xc3, 0x94, 0x30, 0x50, 0x06, 0x7e, 0x00, 0x7f,
+0x01, 0x80, 0x04, 0x7e, 0x00, 0x7f, 0x00, 0xee, 0x4f, 0x24, 0xff, 0x92, 0x38, 0xc2, 0x39, 0x80,
+0x13, 0xe5, 0x46, 0x30, 0xe2, 0x03, 0xd3, 0x80, 0x01, 0xc3, 0x92, 0x39, 0xc2, 0x38, 0x80, 0x04,
+0xc2, 0x38, 0xc2, 0x39, 0x30, 0x47, 0x04, 0xaf, 0x27, 0x80, 0x04, 0xe5, 0x27, 0xf4, 0xff, 0x02,
+0x17, 0x73, 0xe5, 0x47, 0x64, 0x0c, 0x60, 0x06, 0xe5, 0x47, 0x64, 0x0b, 0x70, 0x7a, 0x90, 0x02,
+0x29, 0xe0, 0x54, 0xfd, 0xf0, 0xe5, 0x3a, 0x14, 0x60, 0x20, 0x14, 0x60, 0x21, 0x14, 0x60, 0x2b,
+0x24, 0xfc, 0x60, 0x45, 0x24, 0xf9, 0x60, 0x12, 0x24, 0x0e, 0x70, 0x4a, 0xe5, 0x46, 0x13, 0x13,
+0x54, 0x3f, 0x75, 0xf0, 0x03, 0x84, 0xe5, 0xf0, 0x80, 0x29, 0xd2, 0x39, 0x80, 0x3a, 0xe5, 0x46,
+0x30, 0xe2, 0x03, 0xd3, 0x80, 0x01, 0xc3, 0x92, 0x39, 0x80, 0x2d, 0xe5, 0x46, 0x30, 0xe2, 0x0d,
+0x54, 0x38, 0xc3, 0x94, 0x30, 0x50, 0x06, 0x7e, 0x00, 0x7f, 0x01, 0x80, 0x04, 0x7e, 0x00, 0x7f,
+0x00, 0xee, 0x4f, 0x24, 0xff, 0x92, 0x39, 0x80, 0x0f, 0xe5, 0x46, 0x30, 0xe2, 0x03, 0xd3, 0x80,
+0x01, 0xc3, 0x92, 0x39, 0x80, 0x02, 0xc2, 0x39, 0x30, 0x47, 0x04, 0xaf, 0x27, 0x80, 0x04, 0xe5,
+0x27, 0xf4, 0xff, 0x90, 0x02, 0x28, 0xef, 0xf0, 0x22, 0xe5, 0x47, 0xb4, 0x0b, 0x10, 0x90, 0x02,
+0x29, 0xe0, 0x54, 0xeb, 0xf0, 0xe5, 0x27, 0x54, 0xeb, 0x45, 0x45, 0xf5, 0x27, 0x22, 0xe4, 0x90,
+0x02, 0x29, 0xf0, 0x30, 0x47, 0x04, 0xaf, 0x45, 0x80, 0x04, 0xe5, 0x45, 0xf4, 0xff, 0x90, 0x02,
+0x28, 0xef, 0xf0, 0x22, 0x8f, 0x50, 0xd2, 0x59, 0x22, 0x8f, 0x54, 0xd2, 0x58, 0x22, 0xe4, 0xf5,
+0x62, 0xc2, 0xaf, 0xe5, 0x51, 0x14, 0x60, 0x48, 0x14, 0x60, 0x66, 0x24, 0x02, 0x60, 0x03, 0x02,
+0x18, 0xb6, 0xd2, 0x59, 0x75, 0x55, 0x01, 0x90, 0x02, 0xa2, 0xe0, 0x54, 0x7f, 0xf0, 0xa3, 0xe0,
+0x20, 0xe7, 0x23, 0x90, 0x04, 0x34, 0xe0, 0xb4, 0x02, 0x1c, 0xa3, 0xe0, 0xb4, 0x02, 0x17, 0xa3,
+0xe0, 0xb4, 0x02, 0x12, 0x7f, 0x20, 0x12, 0x17, 0xa4, 0x90, 0x10, 0x04, 0xe0, 0x54, 0xf3, 0xf0,
+0x75, 0x51, 0x01, 0x02, 0x18, 0xb6, 0xe5, 0x50, 0x70, 0x06, 0x75, 0x62, 0x03, 0x02, 0x18, 0xb6,
+0x90, 0x12, 0x00, 0xe0, 0x54, 0x03, 0x70, 0x12, 0x7f, 0x20, 0x12, 0x17, 0xa4, 0x90, 0x02, 0xa2,
+0xe0, 0x54, 0xbf, 0xf0, 0x75, 0x51, 0x02, 0x02, 0x18, 0xb6, 0xe5, 0x50, 0x70, 0x03, 0x02, 0x18,
+0xb1, 0x90, 0x02, 0xa3, 0xe0, 0x30, 0xe6, 0x03, 0x02, 0x18, 0xad, 0x90, 0x04, 0x37, 0xe0, 0x64,
+0x22, 0x70, 0x7a, 0x90, 0x01, 0x8a, 0x74, 0x7e, 0xf0, 0x90, 0x01, 0x96, 0xf0, 0x90, 0x12, 0x04,
+0x74, 0x0a, 0xf0, 0xe5, 0x58, 0xb4, 0x72, 0x15, 0xe5, 0x59, 0xb4, 0x35, 0x10, 0xe4, 0x90, 0x05,
+0x00, 0xf0, 0xa3, 0x74, 0x08, 0xf0, 0xa3, 0x74, 0x01, 0xf0, 0x74, 0x03, 0xf0, 0x7f, 0x01, 0x12,
+0x0d, 0x2a, 0x90, 0x13, 0x28, 0xe0, 0x54, 0xf0, 0xf0, 0xa3, 0xe0, 0x54, 0xf0, 0xf0, 0xe5, 0x59,
+0xb4, 0x35, 0x14, 0xe5, 0x3c, 0xf4, 0x60, 0x06, 0xa3, 0xe0, 0x54, 0xf3, 0x80, 0x14, 0x90, 0x13,
+0x2a, 0xe0, 0x54, 0xfb, 0xf0, 0x80, 0x14, 0xe5, 0x3c, 0xf4, 0x90, 0x13, 0x2a, 0x60, 0x08, 0xe0,
+0x54, 0xf2, 0x45, 0x3c, 0xf0, 0x80, 0x04, 0xe0, 0x54, 0xfa, 0xf0, 0x90, 0x04, 0x01, 0xe0, 0x54,
+0xfd, 0xf0, 0x75, 0x62, 0x01, 0x75, 0x55, 0x02, 0xe4, 0xf5, 0x51, 0x80, 0x09, 0xe5, 0x50, 0x70,
+0x05, 0x75, 0x62, 0x03, 0xf5, 0x51, 0xe5, 0x62, 0x60, 0x15, 0xc2, 0x01, 0xe4, 0xf5, 0x51, 0xc2,
+0x59, 0xad, 0x62, 0xaf, 0x40, 0x12, 0x19, 0x61, 0xe5, 0x62, 0xb4, 0x03, 0x02, 0xd2, 0x03, 0xd2,
+0xaf, 0x22, 0xc2, 0xaf, 0x30, 0x01, 0x12, 0xe4, 0x90, 0x01, 0x96, 0xf0, 0xf5, 0x51, 0xc2, 0x59,
+0xc2, 0x01, 0x7d, 0x02, 0xaf, 0x40, 0x12, 0x19, 0x61, 0xe5, 0x52, 0x14, 0x60, 0x09, 0x04, 0x70,
+0x6d, 0x75, 0x52, 0x01, 0x75, 0x55, 0x03, 0x90, 0x04, 0x01, 0xe0, 0x44, 0x0e, 0xf0, 0x90, 0x13,
+0x28, 0xe0, 0x44, 0x0f, 0xf0, 0xa3, 0xe0, 0x44, 0x0f, 0xf0, 0xa3, 0xe0, 0x44, 0x05, 0xf0, 0x90,
+0x12, 0x04, 0x74, 0x03, 0xf0, 0xe5, 0x58, 0xb4, 0x72, 0x16, 0xe5, 0x59, 0xb4, 0x35, 0x11, 0x90,
+0x05, 0x00, 0x74, 0xe2, 0xf0, 0xa3, 0x74, 0x08, 0xf0, 0xa3, 0x74, 0x01, 0xf0, 0x74, 0x03, 0xf0,
+0x7f, 0x01, 0x12, 0x0d, 0x2a, 0x90, 0x02, 0xa2, 0xe0, 0x44, 0xc0, 0xf0, 0x90, 0x10, 0x04, 0xe0,
+0x44, 0x0c, 0xf0, 0xe4, 0xf5, 0x52, 0xf5, 0x55, 0x30, 0x02, 0x09, 0xc2, 0x02, 0x7d, 0x01, 0xaf,
+0x41, 0x12, 0x19, 0x61, 0x30, 0x03, 0x02, 0xc2, 0x03, 0xe4, 0x90, 0x01, 0x96, 0xf0, 0xd2, 0xaf,
+0x22, 0xef, 0xf4, 0x60, 0x2d, 0xe4, 0xfe, 0x74, 0x14, 0x2e, 0xf5, 0x82, 0xe4, 0x34, 0x70, 0xf5,
+0x83, 0xe0, 0xb4, 0xff, 0x19, 0x74, 0x14, 0x2e, 0xf5, 0x82, 0xe4, 0x34, 0x70, 0xf5, 0x83, 0xef,
+0xf0, 0x74, 0x1c, 0x2e, 0xf5, 0x82, 0xe4, 0x34, 0x70, 0xf5, 0x83, 0xed, 0xf0, 0x22, 0x0e, 0xbe,
+0x04, 0xd5, 0x22, 0x22, 0x22, 0x90, 0x70, 0x2a, 0xe0, 0x30, 0xe1, 0x4d, 0xc2, 0xaf, 0x90, 0x70,
+0x28, 0xe0, 0x90, 0x10, 0x1c, 0xf0, 0x90, 0x70, 0x29, 0xe0, 0x90, 0x10, 0x1d, 0xf0, 0x90, 0x70,
+0x2a, 0xe0, 0x90, 0x10, 0x1e, 0xf0, 0x90, 0x10, 0x1c, 0xe0, 0xf5, 0x62, 0x90, 0x10, 0x1e, 0xe0,
+0x20, 0xe1, 0xf3, 0x90, 0x10, 0x1c, 0xe0, 0x90, 0x70, 0x28, 0xf0, 0x90, 0x10, 0x1d, 0xe0, 0x90,
+0x70, 0x29, 0xf0, 0x90, 0x10, 0x1e, 0xe0, 0x90, 0x70, 0x2a, 0xf0, 0x30, 0x4a, 0x07, 0x90, 0x70,
+0x24, 0xe0, 0x44, 0x01, 0xf0, 0xc2, 0x05, 0xd2, 0xaf, 0x22, 0x22, 0x22, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x11, 0x7b, 0xc4,
+0xff, 0xff, 0xff, 0x02, 0x10, 0x28, 0x02, 0x10, 0x32, 0x02, 0x10, 0x78, 0x02, 0x13, 0x1f, 0x02,
+0x13, 0x20, 0x02, 0x13, 0x3f, 0x02, 0x13, 0x44, 0x12, 0x13, 0x40, 0x22, 0x02, 0x17, 0xae, 0x02,
+0x18, 0xd2, 0x02, 0x14, 0x3d, 0x02, 0x13, 0x78, 0x30, 0x05, 0x06, 0x20, 0x0d, 0x03, 0x12, 0x19,
+0x95, 0x22, 0x90, 0x01, 0x8c, 0xe0, 0x30, 0xe3, 0x1b, 0xe5, 0x4c, 0x30, 0xe0, 0x04, 0x7f, 0x40,
+0x80, 0x02, 0x7f, 0x00, 0x90, 0x10, 0x2f, 0xef, 0xf0, 0x90, 0x01, 0x8c, 0x74, 0x08, 0xf0, 0xe4,
+0x90, 0x01, 0xa7, 0xf0, 0x90, 0x01, 0x8c, 0xe0, 0x30, 0xe0, 0x1c, 0x90, 0x01, 0x80, 0xe0, 0xb4,
+0x02, 0x15, 0xa3, 0xe0, 0xb4, 0x01, 0x10, 0x90, 0x01, 0x84, 0xe0, 0xb4, 0x81, 0x09, 0x90, 0x01,
+0x8c, 0x74, 0x01, 0xf0, 0x12, 0x0d, 0xdd, 0x22, 0x90, 0x04, 0x14, 0xe0, 0x20, 0xe7, 0x03, 0x02,
+0x13, 0x1e, 0x90, 0x70, 0x12, 0xe0, 0xf5, 0x56, 0x90, 0x04, 0x04, 0xe0, 0x12, 0x0a, 0xb6, 0x10,
+0xd9, 0x31, 0x10, 0xbd, 0x36, 0x11, 0x02, 0x50, 0x11, 0x39, 0x51, 0x11, 0x42, 0x52, 0x11, 0x42,
+0x53, 0x11, 0x42, 0x54, 0x11, 0x83, 0x55, 0x11, 0xd2, 0x56, 0x12, 0x25, 0x70, 0x12, 0x50, 0x71,
+0x12, 0x7e, 0x72, 0x12, 0xd5, 0x73, 0x12, 0xf6, 0x80, 0x00, 0x00, 0x13, 0x1e, 0x90, 0x70, 0x11,
+0xe0, 0xf5, 0x3c, 0xe4, 0x90, 0x70, 0x13, 0xf0, 0x90, 0x04, 0x14, 0x74, 0x80, 0xf0, 0xe5, 0x56,
+0xf4, 0x70, 0x03, 0x02, 0x13, 0x1e, 0x02, 0x13, 0x17, 0x20, 0x02, 0x03, 0x30, 0x03, 0x1d, 0x7d,
+0x02, 0xaf, 0x56, 0x12, 0x0b, 0xaa, 0x90, 0x04, 0x14, 0x74, 0x80, 0xf0, 0xe4, 0x90, 0x70, 0x13,
+0xf0, 0xe5, 0x56, 0xf4, 0x70, 0x03, 0x02, 0x13, 0x1e, 0x02, 0x13, 0x17, 0x85, 0x56, 0x41, 0xd2,
+0x02, 0x22, 0x90, 0x70, 0x10, 0xe0, 0x54, 0x7f, 0xff, 0xbf, 0x0a, 0x0d, 0x90, 0x70, 0x11, 0xe0,
+0xb4, 0x08, 0x06, 0x75, 0x4e, 0x01, 0x75, 0x4f, 0x84, 0x90, 0x70, 0x10, 0xe0, 0x54, 0x7f, 0xff,
+0xbf, 0x02, 0x12, 0x90, 0x70, 0x11, 0xe0, 0x64, 0x08, 0x60, 0x04, 0xe0, 0xb4, 0x20, 0x06, 0x75,
+0x4e, 0x03, 0x75, 0x4f, 0x20, 0xe4, 0xf5, 0x27, 0x22, 0x90, 0x70, 0x11, 0xe0, 0x24, 0xff, 0x92,
+0x47, 0x22, 0x90, 0x04, 0x04, 0xe0, 0x25, 0xe0, 0x24, 0x5d, 0xf5, 0x57, 0x90, 0x70, 0x10, 0xe0,
+0xff, 0x74, 0x47, 0x25, 0x57, 0xf8, 0xc6, 0xef, 0xc6, 0x90, 0x70, 0x11, 0xe0, 0xff, 0x74, 0x48,
+0x25, 0x57, 0xf8, 0xc6, 0xef, 0xc6, 0xe4, 0xfd, 0xaf, 0x56, 0x12, 0x0b, 0xaa, 0x90, 0x04, 0x14,
+0x74, 0x80, 0xf0, 0xe4, 0x90, 0x70, 0x13, 0xf0, 0xe5, 0x56, 0xf4, 0x70, 0x03, 0x02, 0x13, 0x1e,
+0x02, 0x13, 0x17, 0xe5, 0x47, 0x64, 0x07, 0x60, 0x1d, 0xe5, 0x47, 0x64, 0x08, 0x60, 0x17, 0xe5,
+0x47, 0x64, 0x09, 0x60, 0x11, 0xe5, 0x47, 0x64, 0x0a, 0x60, 0x0b, 0xe5, 0x47, 0x64, 0x0b, 0x60,
+0x05, 0xe5, 0x47, 0xb4, 0x0c, 0x08, 0x90, 0x70, 0x11, 0xe0, 0x54, 0x0f, 0xf5, 0x3a, 0xe5, 0x47,
+0xb4, 0x09, 0x08, 0xe5, 0x3a, 0xb4, 0x03, 0x03, 0xe4, 0xf5, 0x46, 0xe5, 0x47, 0xb4, 0x0a, 0x08,
+0xe5, 0x3a, 0xb4, 0x01, 0x03, 0xe4, 0xf5, 0x46, 0xe4, 0xfd, 0xaf, 0x56, 0x12, 0x0b, 0xaa, 0xd2,
+0x04, 0x22, 0x90, 0x70, 0x11, 0xe0, 0xf4, 0xff, 0x90, 0x70, 0x10, 0xe0, 0x5f, 0xff, 0x90, 0x70,
+0x11, 0xe0, 0x55, 0x27, 0x4f, 0x90, 0x70, 0x18, 0xf0, 0x90, 0x70, 0x11, 0xe0, 0x90, 0x70, 0x19,
+0xf0, 0xe4, 0xfd, 0xaf, 0x56, 0x12, 0x0b, 0xaa, 0x30, 0x15, 0x03, 0xd2, 0x14, 0x22, 0x90, 0x70,
+0x18, 0xe0, 0xf5, 0x27, 0x90, 0x02, 0x29, 0xe0, 0xff, 0x90, 0x70, 0x19, 0xe0, 0xfe, 0xef, 0x5e,
+0x90, 0x02, 0x29, 0xf0, 0x30, 0x47, 0x04, 0xaf, 0x27, 0x80, 0x04, 0xe5, 0x27, 0xf4, 0xff, 0x90,
+0x02, 0x28, 0xef, 0xf0, 0x22, 0x90, 0x70, 0x10, 0xe0, 0xfe, 0x90, 0x70, 0x11, 0xe0, 0xfd, 0xed,
+0xf8, 0xe6, 0xf5, 0x57, 0xfd, 0xaf, 0x56, 0x12, 0x0b, 0xaa, 0x90, 0x04, 0x14, 0x74, 0x80, 0xf0,
+0xe4, 0x90, 0x70, 0x13, 0xf0, 0xe5, 0x56, 0xf4, 0x70, 0x03, 0x02, 0x13, 0x1e, 0x02, 0x13, 0x17,
+0x90, 0x70, 0x10, 0xe0, 0xfe, 0x90, 0x70, 0x11, 0xe0, 0xfd, 0xed, 0xf5, 0x82, 0x8e, 0x83, 0xe0,
+0xf5, 0x57, 0xfd, 0xaf, 0x56, 0x12, 0x0b, 0xaa, 0x90, 0x04, 0x14, 0x74, 0x80, 0xf0, 0xe4, 0x90,
+0x70, 0x13, 0xf0, 0xe5, 0x56, 0xf4, 0x70, 0x03, 0x02, 0x13, 0x1e, 0x02, 0x13, 0x17, 0x90, 0x10,
+0x00, 0xe0, 0xf5, 0x57, 0x90, 0x10, 0x02, 0xe0, 0xf5, 0x58, 0xa3, 0xe0, 0xf5, 0x59, 0xe5, 0x58,
+0xb4, 0x70, 0x1e, 0xe5, 0x59, 0xb4, 0x30, 0x19, 0x90, 0x05, 0x08, 0xe0, 0x44, 0x01, 0xf0, 0xfd,
+0x90, 0x05, 0x05, 0xe0, 0x54, 0xfb, 0xf0, 0x44, 0x04, 0xf0, 0xed, 0x54, 0xfe, 0x90, 0x05, 0x08,
+0xf0, 0xe4, 0xf5, 0x4e, 0xf5, 0x4f, 0x75, 0x3a, 0xff, 0x75, 0x3c, 0xff, 0xad, 0x57, 0xaf, 0x56,
+0x12, 0x0b, 0xaa, 0x90, 0x04, 0x14, 0x74, 0x80, 0xf0, 0xe4, 0x90, 0x70, 0x13, 0xf0, 0xe5, 0x56,
+0xf4, 0x60, 0x4b, 0x80, 0x42, 0x90, 0x70, 0x10, 0xe0, 0x24, 0xff, 0x92, 0x93, 0xe4, 0xfd, 0xaf,
+0x56, 0x12, 0x0b, 0xaa, 0x90, 0x04, 0x14, 0x74, 0x80, 0xf0, 0xe4, 0x90, 0x70, 0x13, 0xf0, 0xe5,
+0x56, 0xf4, 0x60, 0x2a, 0x80, 0x21, 0x90, 0x70, 0x10, 0xe0, 0x24, 0xff, 0x92, 0x4a, 0xd2, 0x05,
+0xad, 0x57, 0xaf, 0x56, 0x12, 0x0b, 0xaa, 0x90, 0x04, 0x14, 0x74, 0x80, 0xf0, 0xe4, 0x90, 0x70,
+0x13, 0xf0, 0xe5, 0x56, 0xf4, 0x60, 0x07, 0x90, 0x70, 0x25, 0xe0, 0x44, 0x01, 0xf0, 0x22, 0x22,
+0xe5, 0x53, 0x70, 0x1a, 0x30, 0x60, 0x09, 0xb2, 0x4d, 0x30, 0x4d, 0x04, 0x05, 0x46, 0xc2, 0x04,
+0xe5, 0x4f, 0x45, 0x4e, 0x60, 0x08, 0xe5, 0x4f, 0x15, 0x4f, 0x70, 0x02, 0x15, 0x4e, 0x22, 0x22,
+0xc2, 0x42, 0xd3, 0x22, 0x30, 0x14, 0x30, 0x90, 0x70, 0x19, 0xe0, 0x55, 0x27, 0xff, 0x90, 0x70,
+0x18, 0xe0, 0x4f, 0xf5, 0x27, 0x90, 0x02, 0x29, 0xe0, 0xff, 0x90, 0x70, 0x19, 0xe0, 0xfe, 0xef,
+0x5e, 0x90, 0x02, 0x29, 0xf0, 0x30, 0x47, 0x04, 0xaf, 0x27, 0x80, 0x04, 0xe5, 0x27, 0xf4, 0xff,
+0x90, 0x02, 0x28, 0xef, 0xf0, 0xc2, 0x14, 0x22, 0xc2, 0x4b, 0xc2, 0x4c, 0xe5, 0x44, 0x12, 0x0a,
+0xb6, 0x13, 0x9a, 0x00, 0x14, 0x28, 0x04, 0x14, 0x24, 0x08, 0x14, 0x04, 0x10, 0x13, 0xae, 0x20,
+0x13, 0xce, 0x60, 0x13, 0xdf, 0xa0, 0x00, 0x00, 0x14, 0x2a, 0x85, 0x48, 0x43, 0x85, 0x4a, 0x42,
+0x85, 0x4c, 0x5e, 0xe5, 0x47, 0x64, 0x06, 0x60, 0x03, 0x02, 0x14, 0x2a, 0x80, 0x1b, 0xe5, 0x48,
+0xc4, 0x54, 0x0f, 0xf5, 0x43, 0xe5, 0x4a, 0xc4, 0x54, 0x0f, 0xf5, 0x42, 0xe5, 0x4c, 0xc4, 0x54,
+0x0f, 0xf5, 0x5e, 0xe5, 0x47, 0x64, 0x06, 0x70, 0x61, 0x53, 0x43, 0x0f, 0x80, 0x5c, 0x85, 0x49,
+0x43, 0x85, 0x4b, 0x42, 0x85, 0x4d, 0x5e, 0xe5, 0x47, 0x64, 0x06, 0x70, 0x4d, 0x80, 0x1b, 0xe5,
+0x49, 0xc4, 0x54, 0x0f, 0xf5, 0x43, 0xe5, 0x4b, 0xc4, 0x54, 0x0f, 0xf5, 0x42, 0xe5, 0x4d, 0xc4,
+0x54, 0x0f, 0xf5, 0x5e, 0xe5, 0x47, 0x64, 0x06, 0x70, 0x30, 0xe5, 0x43, 0x54, 0x0f, 0x44, 0x10,
+0xf5, 0x43, 0x80, 0x26, 0xe5, 0x47, 0x64, 0x04, 0x60, 0x05, 0xe5, 0x47, 0xb4, 0x05, 0x06, 0x43,
+0x5e, 0x04, 0x75, 0x42, 0x09, 0xe5, 0x47, 0xb4, 0x06, 0x10, 0xe5, 0x43, 0x54, 0x0f, 0x44, 0x30,
+0xf5, 0x43, 0x80, 0x06, 0xd2, 0x4b, 0x80, 0x02, 0xd2, 0x4c, 0xe4, 0xf5, 0x25, 0xe5, 0x42, 0xc4,
+0x54, 0xf0, 0xff, 0xe5, 0x43, 0x54, 0x0f, 0x4f, 0xf5, 0x5f, 0xd2, 0x60, 0x22, 0xd2, 0x15, 0xe5,
+0x47, 0x24, 0xf5, 0x60, 0x0b, 0x24, 0xcb, 0x60, 0x07, 0x24, 0x40, 0x70, 0x06, 0xc2, 0x15, 0x22,
+0x12, 0x17, 0x79, 0x12, 0x14, 0x5f, 0xc2, 0x15, 0xc2, 0xaf, 0xc2, 0x04, 0xd2, 0xaf, 0x22, 0xc2,
+0xaf, 0x90, 0x04, 0x14, 0xe0, 0x54, 0x0e, 0x60, 0x04, 0xd2, 0x18, 0x80, 0x08, 0xe5, 0x4e, 0x45,
+0x4f, 0x24, 0xff, 0x92, 0x18, 0xd2, 0xaf, 0x90, 0x04, 0x14, 0xe0, 0xa2, 0xe4, 0x92, 0x19, 0x74,
+0x1e, 0xf0, 0xe5, 0x5f, 0x54, 0x0f, 0xf5, 0x2d, 0xe5, 0x25, 0x70, 0x13, 0x30, 0x18, 0x05, 0xe5,
+0x5f, 0x20, 0xe5, 0x0b, 0x30, 0x19, 0x19, 0xe5, 0x5f, 0x54, 0x30, 0xff, 0xbf, 0x30, 0x11, 0xe5,
+0x25, 0x70, 0x05, 0x75, 0x25, 0x0c, 0x80, 0x02, 0x15, 0x25, 0xd2, 0x6c, 0xd2, 0x6d, 0x80, 0x0f,
+0xe5, 0x5f, 0x30, 0xe6, 0x06, 0xc2, 0x6c, 0xd2, 0x6d, 0x80, 0x04, 0xd2, 0x6c, 0xc2, 0x6d, 0xe5,
+0x47, 0x64, 0x03, 0x70, 0x21, 0x30, 0x4b, 0x06, 0xc2, 0x6c, 0xd2, 0x6d, 0x80, 0x18, 0xe5, 0x25,
+0x70, 0x03, 0x30, 0x4c, 0x11, 0xc2, 0x4c, 0xe5, 0x25, 0x70, 0x05, 0x75, 0x25, 0x07, 0x80, 0x02,
+0x15, 0x25, 0xd2, 0x6c, 0xd2, 0x6d, 0xe5, 0x47, 0xb4, 0x09, 0x14, 0xe5, 0x44, 0x20, 0xe3, 0x0b,
+0xe5, 0x3a, 0x64, 0x02, 0x60, 0x05, 0xe5, 0x3a, 0xb4, 0x03, 0x04, 0xc2, 0x6c, 0xd2, 0x6d, 0xe5,
+0x47, 0xb4, 0x0a, 0x13, 0xe5, 0x3a, 0xb4, 0x01, 0x06, 0xc2, 0x6c, 0xd2, 0x6d, 0x80, 0x08, 0xe5,
+0x3a, 0x70, 0x04, 0xd2, 0x6c, 0xc2, 0x6d, 0x20, 0x69, 0x07, 0xe5, 0x5e, 0x20, 0xe0, 0x02, 0xb2,
+0x68, 0x20, 0x6b, 0x07, 0xe5, 0x5e, 0x20, 0xe1, 0x02, 0xb2, 0x6a, 0x20, 0x6d, 0x07, 0xe5, 0x5e,
+0x20, 0xe2, 0x02, 0xb2, 0x6c, 0x75, 0x2e, 0x40, 0x20, 0x69, 0x04, 0xa2, 0x68, 0x80, 0x26, 0x30,
+0x68, 0x06, 0xe5, 0x46, 0xa2, 0xe2, 0x80, 0x1d, 0xe5, 0x5e, 0x20, 0xe2, 0x04, 0x7f, 0x01, 0x80,
+0x02, 0x7f, 0x00, 0xe5, 0x46, 0x54, 0xf0, 0xfe, 0xbe, 0xf0, 0x04, 0x7e, 0x01, 0x80, 0x02, 0x7e,
+0x00, 0xee, 0x6f, 0x24, 0xff, 0x92, 0x73, 0x92, 0x72, 0x20, 0x6b, 0x04, 0xa2, 0x6a, 0x80, 0x26,
+0x30, 0x6a, 0x06, 0xe5, 0x46, 0xa2, 0xe2, 0x80, 0x1d, 0xe5, 0x5e, 0x20, 0xe0, 0x04, 0x7f, 0x01,
+0x80, 0x02, 0x7f, 0x00, 0xe5, 0x46, 0x54, 0xf0, 0xfe, 0xbe, 0xf0, 0x04, 0x7e, 0x01, 0x80, 0x02,
+0x7e, 0x00, 0xee, 0x6f, 0x24, 0xff, 0x92, 0x75, 0x92, 0x74, 0x20, 0x6d, 0x04, 0xa2, 0x6c, 0x80,
+0x26, 0xe5, 0x47, 0x64, 0x0a, 0x70, 0x22, 0x30, 0x6c, 0x06, 0xe5, 0x46, 0xa2, 0xe3, 0x80, 0x17,
+0xe5, 0x3a, 0xb4, 0x01, 0x06, 0xe5, 0x46, 0xa2, 0xe3, 0x80, 0x34, 0xe5, 0x46, 0x20, 0xe4, 0x03,
+0x30, 0xe5, 0x03, 0xd3, 0x80, 0x01, 0xc3, 0x80, 0x26, 0x30, 0x6c, 0x06, 0xe5, 0x46, 0xa2, 0xe2,
+0x80, 0x1d, 0xe5, 0x5e, 0x20, 0xe1, 0x04, 0x7f, 0x01, 0x80, 0x02, 0x7f, 0x00, 0xe5, 0x46, 0x54,
+0xf0, 0xfe, 0xbe, 0xf0, 0x04, 0x7e, 0x01, 0x80, 0x02, 0x7e, 0x00, 0xee, 0x6f, 0x24, 0xff, 0x92,
+0x71, 0x92, 0x70, 0x90, 0x10, 0x00, 0xe0, 0x90, 0x10, 0x2c, 0xf0, 0x90, 0x10, 0x03, 0xe0, 0xc3,
+0x94, 0x30, 0x40, 0x14, 0xa2, 0x71, 0x92, 0x77, 0xa2, 0x70, 0x92, 0x76, 0xe5, 0x2e, 0x13, 0x13,
+0x54, 0x3f, 0xf5, 0x2e, 0xc2, 0x77, 0xd2, 0x76, 0x90, 0x10, 0x2f, 0xe5, 0x2e, 0xf0, 0xe5, 0x47,
+0x64, 0x06, 0x70, 0x39, 0x90, 0x02, 0x29, 0xe0, 0x54, 0xfe, 0xf0, 0xe5, 0x43, 0xc4, 0x54, 0x0f,
+0x14, 0x60, 0x0c, 0x24, 0xfe, 0x60, 0x0c, 0x24, 0x03, 0x70, 0x13, 0xc2, 0x38, 0x80, 0x0f, 0xd2,
+0x38, 0x80, 0x0b, 0xe5, 0x46, 0x30, 0xe2, 0x03, 0xd3, 0x80, 0x01, 0xc3, 0x92, 0x38, 0x30, 0x47,
+0x05, 0xaf, 0x27, 0x02, 0x17, 0x73, 0xe5, 0x27, 0xf4, 0xff, 0x02, 0x17, 0x73, 0xe5, 0x47, 0x64,
+0x07, 0x60, 0x0f, 0xe5, 0x47, 0x64, 0x08, 0x60, 0x09, 0xe5, 0x47, 0x64, 0x09, 0x60, 0x03, 0x02,
+0x16, 0xf2, 0x90, 0x02, 0x29, 0xe0, 0x54, 0xfc, 0xf0, 0xe5, 0x3a, 0x14, 0x60, 0x22, 0x14, 0x60,
+0x25, 0x14, 0x60, 0x2d, 0x24, 0xfc, 0x60, 0x49, 0x24, 0xf9, 0x60, 0x14, 0x24, 0x0e, 0x70, 0x50,
+0xe5, 0x46, 0x13, 0x13, 0x54, 0x3f, 0x75, 0xf0, 0x03, 0x84, 0xe5, 0xf0, 0x24, 0xff, 0x80, 0x3a,
+0xd2, 0x39, 0xc2, 0x38, 0x80, 0x3e, 0xe5, 0x46, 0x30, 0xe2, 0x03, 0xd3, 0x80, 0x1d, 0xc3, 0x80,
+0x1a, 0xe5, 0x46, 0x30, 0xe2, 0x0d, 0x54, 0x38, 0xc3, 0x94, 0x30, 0x50, 0x06, 0x7e, 0x00, 0x7f,
+0x01, 0x80, 0x04, 0x7e, 0x00, 0x7f, 0x00, 0xee, 0x4f, 0x24, 0xff, 0x92, 0x38, 0xc2, 0x39, 0x80,
+0x13, 0xe5, 0x46, 0x30, 0xe2, 0x03, 0xd3, 0x80, 0x01, 0xc3, 0x92, 0x39, 0xc2, 0x38, 0x80, 0x04,
+0xc2, 0x38, 0xc2, 0x39, 0x30, 0x47, 0x04, 0xaf, 0x27, 0x80, 0x04, 0xe5, 0x27, 0xf4, 0xff, 0x02,
+0x17, 0x73, 0xe5, 0x47, 0x64, 0x0c, 0x60, 0x06, 0xe5, 0x47, 0x64, 0x0b, 0x70, 0x7a, 0x90, 0x02,
+0x29, 0xe0, 0x54, 0xfd, 0xf0, 0xe5, 0x3a, 0x14, 0x60, 0x20, 0x14, 0x60, 0x21, 0x14, 0x60, 0x2b,
+0x24, 0xfc, 0x60, 0x45, 0x24, 0xf9, 0x60, 0x12, 0x24, 0x0e, 0x70, 0x4a, 0xe5, 0x46, 0x13, 0x13,
+0x54, 0x3f, 0x75, 0xf0, 0x03, 0x84, 0xe5, 0xf0, 0x80, 0x29, 0xd2, 0x39, 0x80, 0x3a, 0xe5, 0x46,
+0x30, 0xe2, 0x03, 0xd3, 0x80, 0x01, 0xc3, 0x92, 0x39, 0x80, 0x2d, 0xe5, 0x46, 0x30, 0xe2, 0x0d,
+0x54, 0x38, 0xc3, 0x94, 0x30, 0x50, 0x06, 0x7e, 0x00, 0x7f, 0x01, 0x80, 0x04, 0x7e, 0x00, 0x7f,
+0x00, 0xee, 0x4f, 0x24, 0xff, 0x92, 0x39, 0x80, 0x0f, 0xe5, 0x46, 0x30, 0xe2, 0x03, 0xd3, 0x80,
+0x01, 0xc3, 0x92, 0x39, 0x80, 0x02, 0xc2, 0x39, 0x30, 0x47, 0x04, 0xaf, 0x27, 0x80, 0x04, 0xe5,
+0x27, 0xf4, 0xff, 0x90, 0x02, 0x28, 0xef, 0xf0, 0x22, 0xe5, 0x47, 0xb4, 0x0b, 0x10, 0x90, 0x02,
+0x29, 0xe0, 0x54, 0xeb, 0xf0, 0xe5, 0x27, 0x54, 0xeb, 0x45, 0x45, 0xf5, 0x27, 0x22, 0xe4, 0x90,
+0x02, 0x29, 0xf0, 0x30, 0x47, 0x04, 0xaf, 0x45, 0x80, 0x04, 0xe5, 0x45, 0xf4, 0xff, 0x90, 0x02,
+0x28, 0xef, 0xf0, 0x22, 0x8f, 0x50, 0xd2, 0x59, 0x22, 0x8f, 0x54, 0xd2, 0x58, 0x22, 0xe4, 0xf5,
+0x62, 0xc2, 0xaf, 0xe5, 0x51, 0x14, 0x60, 0x48, 0x14, 0x60, 0x66, 0x24, 0x02, 0x60, 0x03, 0x02,
+0x18, 0xb6, 0xd2, 0x59, 0x75, 0x55, 0x01, 0x90, 0x02, 0xa2, 0xe0, 0x54, 0x7f, 0xf0, 0xa3, 0xe0,
+0x20, 0xe7, 0x23, 0x90, 0x04, 0x34, 0xe0, 0xb4, 0x02, 0x1c, 0xa3, 0xe0, 0xb4, 0x02, 0x17, 0xa3,
+0xe0, 0xb4, 0x02, 0x12, 0x7f, 0x20, 0x12, 0x17, 0xa4, 0x90, 0x10, 0x04, 0xe0, 0x54, 0xf3, 0xf0,
+0x75, 0x51, 0x01, 0x02, 0x18, 0xb6, 0xe5, 0x50, 0x70, 0x06, 0x75, 0x62, 0x03, 0x02, 0x18, 0xb6,
+0x90, 0x12, 0x00, 0xe0, 0x54, 0x03, 0x70, 0x12, 0x7f, 0x20, 0x12, 0x17, 0xa4, 0x90, 0x02, 0xa2,
+0xe0, 0x54, 0xbf, 0xf0, 0x75, 0x51, 0x02, 0x02, 0x18, 0xb6, 0xe5, 0x50, 0x70, 0x03, 0x02, 0x18,
+0xb1, 0x90, 0x02, 0xa3, 0xe0, 0x30, 0xe6, 0x03, 0x02, 0x18, 0xad, 0x90, 0x04, 0x37, 0xe0, 0x64,
+0x22, 0x70, 0x7a, 0x90, 0x01, 0x8a, 0x74, 0x7e, 0xf0, 0x90, 0x01, 0x96, 0xf0, 0x90, 0x12, 0x04,
+0x74, 0x0a, 0xf0, 0xe5, 0x58, 0xb4, 0x72, 0x15, 0xe5, 0x59, 0xb4, 0x35, 0x10, 0xe4, 0x90, 0x05,
+0x00, 0xf0, 0xa3, 0x74, 0x08, 0xf0, 0xa3, 0x74, 0x01, 0xf0, 0x74, 0x03, 0xf0, 0x7f, 0x01, 0x12,
+0x0d, 0x48, 0x90, 0x13, 0x28, 0xe0, 0x54, 0xf0, 0xf0, 0xa3, 0xe0, 0x54, 0xf0, 0xf0, 0xe5, 0x59,
+0xb4, 0x35, 0x14, 0xe5, 0x3c, 0xf4, 0x60, 0x06, 0xa3, 0xe0, 0x54, 0xf3, 0x80, 0x14, 0x90, 0x13,
+0x2a, 0xe0, 0x54, 0xfb, 0xf0, 0x80, 0x14, 0xe5, 0x3c, 0xf4, 0x90, 0x13, 0x2a, 0x60, 0x08, 0xe0,
+0x54, 0xf2, 0x45, 0x3c, 0xf0, 0x80, 0x04, 0xe0, 0x54, 0xfa, 0xf0, 0x90, 0x04, 0x01, 0xe0, 0x54,
+0xfd, 0xf0, 0x75, 0x62, 0x01, 0x75, 0x55, 0x02, 0xe4, 0xf5, 0x51, 0x80, 0x09, 0xe5, 0x50, 0x70,
+0x05, 0x75, 0x62, 0x03, 0xf5, 0x51, 0xe5, 0x62, 0x60, 0x15, 0xc2, 0x01, 0xe4, 0xf5, 0x51, 0xc2,
+0x59, 0xad, 0x62, 0xaf, 0x40, 0x12, 0x19, 0x61, 0xe5, 0x62, 0xb4, 0x03, 0x02, 0xd2, 0x03, 0xd2,
+0xaf, 0x22, 0xc2, 0xaf, 0x30, 0x01, 0x12, 0xe4, 0x90, 0x01, 0x96, 0xf0, 0xf5, 0x51, 0xc2, 0x59,
+0xc2, 0x01, 0x7d, 0x02, 0xaf, 0x40, 0x12, 0x19, 0x61, 0xe5, 0x52, 0x14, 0x60, 0x09, 0x04, 0x70,
+0x6d, 0x75, 0x52, 0x01, 0x75, 0x55, 0x03, 0x90, 0x04, 0x01, 0xe0, 0x44, 0x0e, 0xf0, 0x90, 0x13,
+0x28, 0xe0, 0x44, 0x0f, 0xf0, 0xa3, 0xe0, 0x44, 0x0f, 0xf0, 0xa3, 0xe0, 0x44, 0x05, 0xf0, 0x90,
+0x12, 0x04, 0x74, 0x03, 0xf0, 0xe5, 0x58, 0xb4, 0x72, 0x16, 0xe5, 0x59, 0xb4, 0x35, 0x11, 0x90,
+0x05, 0x00, 0x74, 0xe2, 0xf0, 0xa3, 0x74, 0x08, 0xf0, 0xa3, 0x74, 0x01, 0xf0, 0x74, 0x03, 0xf0,
+0x7f, 0x01, 0x12, 0x0d, 0x48, 0x90, 0x02, 0xa2, 0xe0, 0x44, 0xc0, 0xf0, 0x90, 0x10, 0x04, 0xe0,
+0x44, 0x0c, 0xf0, 0xe4, 0xf5, 0x52, 0xf5, 0x55, 0x30, 0x02, 0x09, 0xc2, 0x02, 0x7d, 0x01, 0xaf,
+0x41, 0x12, 0x19, 0x61, 0x30, 0x03, 0x02, 0xc2, 0x03, 0xe4, 0x90, 0x01, 0x96, 0xf0, 0xd2, 0xaf,
+0x22, 0xef, 0xf4, 0x60, 0x2d, 0xe4, 0xfe, 0x74, 0x14, 0x2e, 0xf5, 0x82, 0xe4, 0x34, 0x70, 0xf5,
+0x83, 0xe0, 0xb4, 0xff, 0x19, 0x74, 0x14, 0x2e, 0xf5, 0x82, 0xe4, 0x34, 0x70, 0xf5, 0x83, 0xef,
+0xf0, 0x74, 0x1c, 0x2e, 0xf5, 0x82, 0xe4, 0x34, 0x70, 0xf5, 0x83, 0xed, 0xf0, 0x22, 0x0e, 0xbe,
+0x04, 0xd5, 0x22, 0x22, 0x22, 0x90, 0x70, 0x2a, 0xe0, 0x30, 0xe1, 0x4d, 0xc2, 0xaf, 0x90, 0x70,
+0x28, 0xe0, 0x90, 0x10, 0x1c, 0xf0, 0x90, 0x70, 0x29, 0xe0, 0x90, 0x10, 0x1d, 0xf0, 0x90, 0x70,
+0x2a, 0xe0, 0x90, 0x10, 0x1e, 0xf0, 0x90, 0x10, 0x1c, 0xe0, 0xf5, 0x62, 0x90, 0x10, 0x1e, 0xe0,
+0x20, 0xe1, 0xf3, 0x90, 0x10, 0x1c, 0xe0, 0x90, 0x70, 0x28, 0xf0, 0x90, 0x10, 0x1d, 0xe0, 0x90,
+0x70, 0x29, 0xf0, 0x90, 0x10, 0x1e, 0xe0, 0x90, 0x70, 0x2a, 0xf0, 0x30, 0x4a, 0x07, 0x90, 0x70,
+0x24, 0xe0, 0x44, 0x01, 0xf0, 0xc2, 0x05, 0xd2, 0xaf, 0x22, 0x22, 0x22, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x11, 0x65, 0xd3, } ;
diff --git a/drivers/staging/rt2860/common/md5.c b/drivers/staging/rt2860/common/md5.c
deleted file mode 100644
index ad883ca2ffc8..000000000000
--- a/drivers/staging/rt2860/common/md5.c
+++ /dev/null
@@ -1,1415 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-    Module Name:
-    md5.c
-
-	Abstract:
-
-	Revision History:
-	Who			When			What
-	--------	----------		----------------------------------------------
-	Name		Date			Modification logs
-	jan			10-28-03		Initial
-	Rita    	11-23-04		Modify MD5 and SHA-1
-	Rita		10-14-05		Modify SHA-1 in big-endian platform
- */
-#include "../rt_config.h"
-
-/**
- * md5_mac:
- * @key: pointer to	the	key	used for MAC generation
- * @key_len: length	of the key in bytes
- * @data: pointer to the data area for which the MAC is	generated
- * @data_len: length of	the	data in	bytes
- * @mac: pointer to	the	buffer holding space for the MAC; the buffer should
- * have	space for 128-bit (16 bytes) MD5 hash value
- *
- * md5_mac() determines	the	message	authentication code	by using secure	hash
- * MD5(key | data |	key).
- */
-void md5_mac(u8 *key, size_t key_len, u8 *data, size_t data_len, u8 *mac)
-{
-	MD5_CTX	context;
-
-	MD5Init(&context);
-	MD5Update(&context,	key, key_len);
-	MD5Update(&context,	data, data_len);
-	MD5Update(&context,	key, key_len);
-	MD5Final(mac, &context);
-}
-
-/**
- * hmac_md5:
- * @key: pointer to	the	key	used for MAC generation
- * @key_len: length	of the key in bytes
- * @data: pointer to the data area for which the MAC is	generated
- * @data_len: length of	the	data in	bytes
- * @mac: pointer to	the	buffer holding space for the MAC; the buffer should
- * have	space for 128-bit (16 bytes) MD5 hash value
- *
- * hmac_md5() determines the message authentication	code using HMAC-MD5.
- * This	implementation is based	on the sample code presented in	RFC	2104.
- */
-void hmac_md5(u8 *key, size_t key_len, u8 *data, size_t data_len, u8 *mac)
-{
-	MD5_CTX	context;
-    u8 k_ipad[65]; /* inner padding - key XORd with ipad */
-    u8 k_opad[65]; /* outer padding - key XORd with opad */
-    u8 tk[16];
-	int	i;
-
-	//assert(key != NULL && data != NULL && mac != NULL);
-
-	/* if key is longer	than 64	bytes reset	it to key =	MD5(key) */
-	if (key_len	> 64) {
-		MD5_CTX	ttcontext;
-
-		MD5Init(&ttcontext);
-		MD5Update(&ttcontext, key, key_len);
-		MD5Final(tk, &ttcontext);
-		//key=(PUCHAR)ttcontext.buf;
-		key	= tk;
-		key_len	= 16;
-	}
-
-	/* the HMAC_MD5	transform looks	like:
-	 *
-	 * MD5(K XOR opad, MD5(K XOR ipad, text))
-	 *
-	 * where K is an n byte	key
-	 * ipad	is the byte	0x36 repeated 64 times
-	 * opad	is the byte	0x5c repeated 64 times
-	 * and text	is the data	being protected	*/
-
-	/* start out by	storing	key	in pads	*/
-	NdisZeroMemory(k_ipad, sizeof(k_ipad));
-	NdisZeroMemory(k_opad,	sizeof(k_opad));
-	//assert(key_len < sizeof(k_ipad));
-	NdisMoveMemory(k_ipad, key,	key_len);
-	NdisMoveMemory(k_opad, key,	key_len);
-
-	/* XOR key with	ipad and opad values */
-	for	(i = 0;	i <	64;	i++) {
-		k_ipad[i] ^= 0x36;
-		k_opad[i] ^= 0x5c;
-	}
-
-	/* perform inner MD5 */
-	MD5Init(&context);					 /*	init context for 1st pass */
-	MD5Update(&context,	k_ipad,	64);	 /*	start with inner pad */
-	MD5Update(&context,	data, data_len); /*	then text of datagram */
-	MD5Final(mac, &context);			 /*	finish up 1st pass */
-
-	/* perform outer MD5 */
-	MD5Init(&context);					 /*	init context for 2nd pass */
-	MD5Update(&context,	k_opad,	64);	 /*	start with outer pad */
-	MD5Update(&context,	mac, 16);		 /*	then results of	1st	hash */
-	MD5Final(mac, &context);			 /*	finish up 2nd pass */
-}
-
-#define byteReverse(buf, len)   /* Nothing */
-
-/* ==========================  MD5 implementation =========================== */
-// four base functions for MD5
-#define MD5_F1(x, y, z) (((x) & (y)) | ((~x) & (z)))
-#define MD5_F2(x, y, z) (((x) & (z)) | ((y) & (~z)))
-#define MD5_F3(x, y, z) ((x) ^ (y) ^ (z))
-#define MD5_F4(x, y, z) ((y) ^ ((x) | (~z)))
-#define CYCLIC_LEFT_SHIFT(w, s) (((w) << (s)) | ((w) >> (32-(s))))
-
-#define	MD5Step(f, w, x, y,	z, data, t, s)	\
-	( w	+= f(x,	y, z) +	data + t,  w = (CYCLIC_LEFT_SHIFT(w, s)) & 0xffffffff, w +=	x )
-
-
-/*
- *  Function Description:
- *      Initiate MD5 Context satisfied in RFC 1321
- *
- *  Arguments:
- *      pCtx        Pointer	to MD5 context
- *
- *  Return Value:
- *      None
- */
-VOID MD5Init(MD5_CTX *pCtx)
-{
-    pCtx->Buf[0]=0x67452301;
-    pCtx->Buf[1]=0xefcdab89;
-    pCtx->Buf[2]=0x98badcfe;
-    pCtx->Buf[3]=0x10325476;
-
-    pCtx->LenInBitCount[0]=0;
-    pCtx->LenInBitCount[1]=0;
-}
-
-
-/*
- *  Function Description:
- *      Update MD5 Context, allow of an arrary of octets as the next portion
- *      of the message
- *
- *  Arguments:
- *      pCtx		Pointer	to MD5 context
- * 	    pData       Pointer to input data
- *      LenInBytes  The length of input data (unit: byte)
- *
- *  Return Value:
- *      None
- *
- *  Note:
- *      Called after MD5Init or MD5Update(itself)
- */
-VOID MD5Update(MD5_CTX *pCtx, UCHAR *pData, UINT32 LenInBytes)
-{
-
-    UINT32 TfTimes;
-    UINT32 temp;
-	unsigned int i;
-
-    temp = pCtx->LenInBitCount[0];
-
-    pCtx->LenInBitCount[0] = (UINT32) (pCtx->LenInBitCount[0] + (LenInBytes << 3));
-
-    if (pCtx->LenInBitCount[0] < temp)
-        pCtx->LenInBitCount[1]++;   //carry in
-
-    pCtx->LenInBitCount[1] += LenInBytes >> 29;
-
-    // mod 64 bytes
-    temp = (temp >> 3) & 0x3f;
-
-    // process lacks of 64-byte data
-    if (temp)
-    {
-        UCHAR *pAds = (UCHAR *) pCtx->Input + temp;
-
-        if ((temp+LenInBytes) < 64)
-        {
-            NdisMoveMemory(pAds, (UCHAR *)pData, LenInBytes);
-            return;
-        }
-
-        NdisMoveMemory(pAds, (UCHAR *)pData, 64-temp);
-        byteReverse(pCtx->Input, 16);
-        MD5Transform(pCtx->Buf, (UINT32 *)pCtx->Input);
-
-        pData += 64-temp;
-        LenInBytes -= 64-temp;
-    } // end of if (temp)
-
-
-    TfTimes = (LenInBytes >> 6);
-
-    for (i=TfTimes; i>0; i--)
-    {
-        NdisMoveMemory(pCtx->Input, (UCHAR *)pData, 64);
-        byteReverse(pCtx->Input, 16);
-        MD5Transform(pCtx->Buf, (UINT32 *)pCtx->Input);
-        pData += 64;
-        LenInBytes -= 64;
-    } // end of for
-
-    // buffering lacks of 64-byte data
-    if(LenInBytes)
-        NdisMoveMemory(pCtx->Input, (UCHAR *)pData, LenInBytes);
-
-}
-
-
-/*
- *  Function Description:
- *      Append padding bits and length of original message in the tail
- *      The message digest has to be completed in the end
- *
- *  Arguments:
- *      Digest		Output of Digest-Message for MD5
- *  	pCtx        Pointer	to MD5 context
- *
- *  Return Value:
- *      None
- *
- *  Note:
- *      Called after MD5Update
- */
-VOID MD5Final(UCHAR Digest[16], MD5_CTX *pCtx)
-{
-    UCHAR Remainder;
-    UCHAR PadLenInBytes;
-    UCHAR *pAppend=0;
-    unsigned int i;
-
-    Remainder = (UCHAR)((pCtx->LenInBitCount[0] >> 3) & 0x3f);
-
-    PadLenInBytes = (Remainder < 56) ? (56-Remainder) : (120-Remainder);
-
-    pAppend = (UCHAR *)pCtx->Input + Remainder;
-
-    // padding bits without crossing block(64-byte based) boundary
-    if (Remainder < 56)
-    {
-        *pAppend = 0x80;
-        PadLenInBytes --;
-
-        NdisZeroMemory((UCHAR *)pCtx->Input + Remainder+1, PadLenInBytes);
-
-		// add data-length field, from low to high
-       	for (i=0; i<4; i++)
-        {
-        	pCtx->Input[56+i] = (UCHAR)((pCtx->LenInBitCount[0] >> (i << 3)) & 0xff);
-        	pCtx->Input[60+i] = (UCHAR)((pCtx->LenInBitCount[1] >> (i << 3)) & 0xff);
-      	}
-
-        byteReverse(pCtx->Input, 16);
-        MD5Transform(pCtx->Buf, (UINT32 *)pCtx->Input);
-    } // end of if
-
-    // padding bits with crossing block(64-byte based) boundary
-    else
-    {
-        // the first block ===
-        *pAppend = 0x80;
-        PadLenInBytes --;
-
-        NdisZeroMemory((UCHAR *)pCtx->Input + Remainder+1, (64-Remainder-1));
-        PadLenInBytes -= (64 - Remainder - 1);
-
-        byteReverse(pCtx->Input, 16);
-        MD5Transform(pCtx->Buf, (UINT32 *)pCtx->Input);
-
-
-        // the second block ===
-        NdisZeroMemory((UCHAR *)pCtx->Input, PadLenInBytes);
-
-        // add data-length field
-        for (i=0; i<4; i++)
-        {
-        	pCtx->Input[56+i] = (UCHAR)((pCtx->LenInBitCount[0] >> (i << 3)) & 0xff);
-        	pCtx->Input[60+i] = (UCHAR)((pCtx->LenInBitCount[1] >> (i << 3)) & 0xff);
-      	}
-
-        byteReverse(pCtx->Input, 16);
-        MD5Transform(pCtx->Buf, (UINT32 *)pCtx->Input);
-    } // end of else
-
-
-    NdisMoveMemory((UCHAR *)Digest, (UINT32 *)pCtx->Buf, 16); // output
-    byteReverse((UCHAR *)Digest, 4);
-    NdisZeroMemory(pCtx, sizeof(pCtx)); // memory free
-}
-
-
-/*
- *  Function Description:
- *      The central algorithm of MD5, consists of four rounds and sixteen
- *  	steps per round
- *
- *  Arguments:
- *      Buf     Buffers of four states (output: 16 bytes)
- * 	    Mes     Input data (input: 64 bytes)
- *
- *  Return Value:
- *      None
- *
- *  Note:
- *      Called by MD5Update or MD5Final
- */
-VOID MD5Transform(UINT32 Buf[4], UINT32 Mes[16])
-{
-    UINT32 Reg[4], Temp;
-	unsigned int i;
-
-    static UCHAR LShiftVal[16] =
-    {
-        7, 12, 17, 22,
-		5, 9 , 14, 20,
-		4, 11, 16, 23,
- 		6, 10, 15, 21,
- 	};
-
-
-	// [equal to 4294967296*abs(sin(index))]
-    static UINT32 MD5Table[64] =
-	{
-		0xd76aa478,	0xe8c7b756,	0x242070db,	0xc1bdceee,
-		0xf57c0faf,	0x4787c62a,	0xa8304613, 0xfd469501,
-		0x698098d8,	0x8b44f7af,	0xffff5bb1,	0x895cd7be,
-    	0x6b901122,	0xfd987193,	0xa679438e,	0x49b40821,
-
-    	0xf61e2562,	0xc040b340,	0x265e5a51,	0xe9b6c7aa,
-    	0xd62f105d,	0x02441453,	0xd8a1e681,	0xe7d3fbc8,
-    	0x21e1cde6,	0xc33707d6,	0xf4d50d87,	0x455a14ed,
-    	0xa9e3e905,	0xfcefa3f8,	0x676f02d9,	0x8d2a4c8a,
-
-    	0xfffa3942,	0x8771f681,	0x6d9d6122,	0xfde5380c,
-    	0xa4beea44,	0x4bdecfa9,	0xf6bb4b60,	0xbebfbc70,
-    	0x289b7ec6,	0xeaa127fa,	0xd4ef3085,	0x04881d05,
-    	0xd9d4d039,	0xe6db99e5,	0x1fa27cf8,	0xc4ac5665,
-
-    	0xf4292244,	0x432aff97,	0xab9423a7,	0xfc93a039,
-   		0x655b59c3,	0x8f0ccc92,	0xffeff47d,	0x85845dd1,
-    	0x6fa87e4f,	0xfe2ce6e0,	0xa3014314,	0x4e0811a1,
-    	0xf7537e82,	0xbd3af235,	0x2ad7d2bb,	0xeb86d391
-	};
-
-
-    for (i=0; i<4; i++)
-        Reg[i]=Buf[i];
-
-
-    // 64 steps in MD5 algorithm
-    for (i=0; i<16; i++)
-    {
-        MD5Step(MD5_F1, Reg[0], Reg[1], Reg[2], Reg[3], Mes[i],
-                MD5Table[i], LShiftVal[i & 0x3]);
-
-        // one-word right shift
-        Temp   = Reg[3];
-        Reg[3] = Reg[2];
-        Reg[2] = Reg[1];
-        Reg[1] = Reg[0];
-        Reg[0] = Temp;
-    }
-    for (i=16; i<32; i++)
-    {
-        MD5Step(MD5_F2, Reg[0], Reg[1], Reg[2], Reg[3], Mes[(5*(i & 0xf)+1) & 0xf],
-                MD5Table[i], LShiftVal[(0x1 << 2)+(i & 0x3)]);
-
-        // one-word right shift
-        Temp   = Reg[3];
-        Reg[3] = Reg[2];
-        Reg[2] = Reg[1];
-        Reg[1] = Reg[0];
-        Reg[0] = Temp;
-    }
-    for (i=32; i<48; i++)
-    {
-        MD5Step(MD5_F3, Reg[0], Reg[1], Reg[2], Reg[3], Mes[(3*(i & 0xf)+5) & 0xf],
-                MD5Table[i], LShiftVal[(0x1 << 3)+(i & 0x3)]);
-
-        // one-word right shift
-        Temp   = Reg[3];
-        Reg[3] = Reg[2];
-        Reg[2] = Reg[1];
-        Reg[1] = Reg[0];
-        Reg[0] = Temp;
-    }
-    for (i=48; i<64; i++)
-    {
-        MD5Step(MD5_F4, Reg[0], Reg[1], Reg[2], Reg[3], Mes[(7*(i & 0xf)) & 0xf],
-                MD5Table[i], LShiftVal[(0x3 << 2)+(i & 0x3)]);
-
-        // one-word right shift
-        Temp   = Reg[3];
-        Reg[3] = Reg[2];
-        Reg[2] = Reg[1];
-        Reg[1] = Reg[0];
-        Reg[0] = Temp;
-    }
-
-
-    // (temporary)output
-    for (i=0; i<4; i++)
-        Buf[i] += Reg[i];
-
-}
-
-
-
-/* =========================  SHA-1 implementation ========================== */
-// four base functions for SHA-1
-#define SHA1_F1(b, c, d)    (((b) & (c)) | ((~b) & (d)))
-#define SHA1_F2(b, c, d)    ((b) ^ (c) ^ (d))
-#define SHA1_F3(b, c, d)    (((b) & (c)) | ((b) & (d)) | ((c) & (d)))
-
-
-#define SHA1Step(f, a, b, c, d, e, w, k)    \
-    ( e	+= ( f(b, c, d) + w + k + CYCLIC_LEFT_SHIFT(a, 5)) & 0xffffffff, \
-      b = CYCLIC_LEFT_SHIFT(b, 30) )
-
-//Initiate SHA-1 Context satisfied in RFC 3174
-VOID SHAInit(SHA_CTX *pCtx)
-{
-    pCtx->Buf[0]=0x67452301;
-    pCtx->Buf[1]=0xefcdab89;
-    pCtx->Buf[2]=0x98badcfe;
-    pCtx->Buf[3]=0x10325476;
-    pCtx->Buf[4]=0xc3d2e1f0;
-
-    pCtx->LenInBitCount[0]=0;
-    pCtx->LenInBitCount[1]=0;
-}
-
-/*
- *  Function Description:
- *      Update SHA-1 Context, allow of an arrary of octets as the next
- *      portion of the message
- *
- *  Arguments:
- *      pCtx		Pointer	to SHA-1 context
- * 	    pData       Pointer to input data
- *      LenInBytes  The length of input data (unit: byte)
- *
- *  Return Value:
- *      error       indicate more than pow(2,64) bits of data
- *
- *  Note:
- *      Called after SHAInit or SHAUpdate(itself)
- */
-UCHAR SHAUpdate(SHA_CTX *pCtx, UCHAR *pData, UINT32 LenInBytes)
-{
-    UINT32 TfTimes;
-    UINT32 temp1,temp2;
-	unsigned int i;
-	UCHAR err=1;
-
-    temp1 = pCtx->LenInBitCount[0];
-    temp2 = pCtx->LenInBitCount[1];
-
-    pCtx->LenInBitCount[0] = (UINT32) (pCtx->LenInBitCount[0] + (LenInBytes << 3));
-    if (pCtx->LenInBitCount[0] < temp1)
-        pCtx->LenInBitCount[1]++;   //carry in
-
-
-    pCtx->LenInBitCount[1] = (UINT32) (pCtx->LenInBitCount[1] +(LenInBytes >> 29));
-    if (pCtx->LenInBitCount[1] < temp2)
-        return (err);   //check total length of original data
-
-
-    // mod 64 bytes
-    temp1 = (temp1 >> 3) & 0x3f;
-
-    // process lacks of 64-byte data
-    if (temp1)
-    {
-        UCHAR *pAds = (UCHAR *) pCtx->Input + temp1;
-
-        if ((temp1+LenInBytes) < 64)
-        {
-            NdisMoveMemory(pAds, (UCHAR *)pData, LenInBytes);
-            return (0);
-        }
-
-        NdisMoveMemory(pAds, (UCHAR *)pData, 64-temp1);
-        byteReverse((UCHAR *)pCtx->Input, 16);
-
-        NdisZeroMemory((UCHAR *)pCtx->Input + 64, 16);
-        SHATransform(pCtx->Buf, (UINT32 *)pCtx->Input);
-
-        pData += 64-temp1;
-        LenInBytes -= 64-temp1;
-    } // end of if (temp1)
-
-
-    TfTimes = (LenInBytes >> 6);
-
-    for (i=TfTimes; i>0; i--)
-    {
-        NdisMoveMemory(pCtx->Input, (UCHAR *)pData, 64);
-        byteReverse((UCHAR *)pCtx->Input, 16);
-
-        NdisZeroMemory((UCHAR *)pCtx->Input + 64, 16);
-        SHATransform(pCtx->Buf, (UINT32 *)pCtx->Input);
-        pData += 64;
-        LenInBytes -= 64;
-    } // end of for
-
-    // buffering lacks of 64-byte data
-    if(LenInBytes)
-        NdisMoveMemory(pCtx->Input, (UCHAR *)pData, LenInBytes);
-
-	return (0);
-
-}
-
-// Append padding bits and length of original message in the tail
-// The message digest has to be completed in the end
-VOID SHAFinal(SHA_CTX *pCtx, UCHAR Digest[20])
-{
-    UCHAR Remainder;
-    UCHAR PadLenInBytes;
-    UCHAR *pAppend=0;
-    unsigned int i;
-
-    Remainder = (UCHAR)((pCtx->LenInBitCount[0] >> 3) & 0x3f);
-
-    pAppend = (UCHAR *)pCtx->Input + Remainder;
-
-    PadLenInBytes = (Remainder < 56) ? (56-Remainder) : (120-Remainder);
-
-    // padding bits without crossing block(64-byte based) boundary
-    if (Remainder < 56)
-    {
-        *pAppend = 0x80;
-        PadLenInBytes --;
-
-        NdisZeroMemory((UCHAR *)pCtx->Input + Remainder+1, PadLenInBytes);
-
-		// add data-length field, from high to low
-        for (i=0; i<4; i++)
-        {
-        	pCtx->Input[56+i] = (UCHAR)((pCtx->LenInBitCount[1] >> ((3-i) << 3)) & 0xff);
-        	pCtx->Input[60+i] = (UCHAR)((pCtx->LenInBitCount[0] >> ((3-i) << 3)) & 0xff);
-      	}
-
-        byteReverse((UCHAR *)pCtx->Input, 16);
-        NdisZeroMemory((UCHAR *)pCtx->Input + 64, 14);
-        SHATransform(pCtx->Buf, (UINT32 *)pCtx->Input);
-    } // end of if
-
-    // padding bits with crossing block(64-byte based) boundary
-    else
-    {
-        // the first block ===
-        *pAppend = 0x80;
-        PadLenInBytes --;
-
-        NdisZeroMemory((UCHAR *)pCtx->Input + Remainder+1, (64-Remainder-1));
-        PadLenInBytes -= (64 - Remainder - 1);
-
-        byteReverse((UCHAR *)pCtx->Input, 16);
-        NdisZeroMemory((UCHAR *)pCtx->Input + 64, 16);
-        SHATransform(pCtx->Buf, (UINT32 *)pCtx->Input);
-
-
-        // the second block ===
-        NdisZeroMemory((UCHAR *)pCtx->Input, PadLenInBytes);
-
-		// add data-length field
-		for (i=0; i<4; i++)
-        {
-        	pCtx->Input[56+i] = (UCHAR)((pCtx->LenInBitCount[1] >> ((3-i) << 3)) & 0xff);
-        	pCtx->Input[60+i] = (UCHAR)((pCtx->LenInBitCount[0] >> ((3-i) << 3)) & 0xff);
-      	}
-
-        byteReverse((UCHAR *)pCtx->Input, 16);
-        NdisZeroMemory((UCHAR *)pCtx->Input + 64, 16);
-        SHATransform(pCtx->Buf, (UINT32 *)pCtx->Input);
-    } // end of else
-
-
-    //Output, bytereverse
-    for (i=0; i<20; i++)
-    {
-        Digest [i] = (UCHAR)(pCtx->Buf[i>>2] >> 8*(3-(i & 0x3)));
-    }
-
-    NdisZeroMemory(pCtx, sizeof(pCtx)); // memory free
-}
-
-
-// The central algorithm of SHA-1, consists of four rounds and
-// twenty steps per round
-VOID SHATransform(UINT32 Buf[5], UINT32 Mes[20])
-{
-    UINT32 Reg[5],Temp;
-	unsigned int i;
-    UINT32 W[80];
-
-    static UINT32 SHA1Table[4] = { 0x5a827999, 0x6ed9eba1,
-                                  0x8f1bbcdc, 0xca62c1d6 };
-
-    Reg[0]=Buf[0];
-	Reg[1]=Buf[1];
-	Reg[2]=Buf[2];
-	Reg[3]=Buf[3];
-	Reg[4]=Buf[4];
-
-    //the first octet of a word is stored in the 0th element, bytereverse
-	for(i = 0; i < 16; i++)
-    {
-    	W[i]  = (Mes[i] >> 24) & 0xff;
-        W[i] |= (Mes[i] >> 8 ) & 0xff00;
-        W[i] |= (Mes[i] << 8 ) & 0xff0000;
-        W[i] |= (Mes[i] << 24) & 0xff000000;
-    }
-
-
-    for	(i = 0; i < 64; i++)
-	    W[16+i] = CYCLIC_LEFT_SHIFT(W[i] ^ W[2+i] ^ W[8+i] ^ W[13+i], 1);
-
-
-    // 80 steps in SHA-1 algorithm
-    for (i=0; i<80; i++)
-    {
-        if (i<20)
-            SHA1Step(SHA1_F1, Reg[0], Reg[1], Reg[2], Reg[3], Reg[4],
-                     W[i], SHA1Table[0]);
-
-        else if (i>=20 && i<40)
-            SHA1Step(SHA1_F2, Reg[0], Reg[1], Reg[2], Reg[3], Reg[4],
-                     W[i], SHA1Table[1]);
-
-		else if (i>=40 && i<60)
-            SHA1Step(SHA1_F3, Reg[0], Reg[1], Reg[2], Reg[3], Reg[4],
-                      W[i], SHA1Table[2]);
-
-        else
-            SHA1Step(SHA1_F2, Reg[0], Reg[1], Reg[2], Reg[3], Reg[4],
-                     W[i], SHA1Table[3]);
-
-
-       // one-word right shift
-		Temp   = Reg[4];
-        Reg[4] = Reg[3];
-        Reg[3] = Reg[2];
-        Reg[2] = Reg[1];
-        Reg[1] = Reg[0];
-        Reg[0] = Temp;
-
-    } // end of for-loop
-
-
-    // (temporary)output
-    for (i=0; i<5; i++)
-        Buf[i] += Reg[i];
-
-}
-
-
-/* =========================  AES En/Decryption ========================== */
-
-/* forward S-box */
-static uint32 FSb[256] =
-{
-	0x63, 0x7C,	0x77, 0x7B,	0xF2, 0x6B,	0x6F, 0xC5,
-	0x30, 0x01,	0x67, 0x2B,	0xFE, 0xD7,	0xAB, 0x76,
-	0xCA, 0x82,	0xC9, 0x7D,	0xFA, 0x59,	0x47, 0xF0,
-	0xAD, 0xD4,	0xA2, 0xAF,	0x9C, 0xA4,	0x72, 0xC0,
-	0xB7, 0xFD,	0x93, 0x26,	0x36, 0x3F,	0xF7, 0xCC,
-	0x34, 0xA5,	0xE5, 0xF1,	0x71, 0xD8,	0x31, 0x15,
-	0x04, 0xC7,	0x23, 0xC3,	0x18, 0x96,	0x05, 0x9A,
-	0x07, 0x12,	0x80, 0xE2,	0xEB, 0x27,	0xB2, 0x75,
-	0x09, 0x83,	0x2C, 0x1A,	0x1B, 0x6E,	0x5A, 0xA0,
-	0x52, 0x3B,	0xD6, 0xB3,	0x29, 0xE3,	0x2F, 0x84,
-	0x53, 0xD1,	0x00, 0xED,	0x20, 0xFC,	0xB1, 0x5B,
-	0x6A, 0xCB,	0xBE, 0x39,	0x4A, 0x4C,	0x58, 0xCF,
-	0xD0, 0xEF,	0xAA, 0xFB,	0x43, 0x4D,	0x33, 0x85,
-	0x45, 0xF9,	0x02, 0x7F,	0x50, 0x3C,	0x9F, 0xA8,
-	0x51, 0xA3,	0x40, 0x8F,	0x92, 0x9D,	0x38, 0xF5,
-	0xBC, 0xB6,	0xDA, 0x21,	0x10, 0xFF,	0xF3, 0xD2,
-	0xCD, 0x0C,	0x13, 0xEC,	0x5F, 0x97,	0x44, 0x17,
-	0xC4, 0xA7,	0x7E, 0x3D,	0x64, 0x5D,	0x19, 0x73,
-	0x60, 0x81,	0x4F, 0xDC,	0x22, 0x2A,	0x90, 0x88,
-	0x46, 0xEE,	0xB8, 0x14,	0xDE, 0x5E,	0x0B, 0xDB,
-	0xE0, 0x32,	0x3A, 0x0A,	0x49, 0x06,	0x24, 0x5C,
-	0xC2, 0xD3,	0xAC, 0x62,	0x91, 0x95,	0xE4, 0x79,
-	0xE7, 0xC8,	0x37, 0x6D,	0x8D, 0xD5,	0x4E, 0xA9,
-	0x6C, 0x56,	0xF4, 0xEA,	0x65, 0x7A,	0xAE, 0x08,
-	0xBA, 0x78,	0x25, 0x2E,	0x1C, 0xA6,	0xB4, 0xC6,
-	0xE8, 0xDD,	0x74, 0x1F,	0x4B, 0xBD,	0x8B, 0x8A,
-	0x70, 0x3E,	0xB5, 0x66,	0x48, 0x03,	0xF6, 0x0E,
-	0x61, 0x35,	0x57, 0xB9,	0x86, 0xC1,	0x1D, 0x9E,
-	0xE1, 0xF8,	0x98, 0x11,	0x69, 0xD9,	0x8E, 0x94,
-	0x9B, 0x1E,	0x87, 0xE9,	0xCE, 0x55,	0x28, 0xDF,
-	0x8C, 0xA1,	0x89, 0x0D,	0xBF, 0xE6,	0x42, 0x68,
-	0x41, 0x99,	0x2D, 0x0F,	0xB0, 0x54,	0xBB, 0x16
-};
-
-/* forward table */
-#define	FT \
-\
-	V(C6,63,63,A5),	V(F8,7C,7C,84),	V(EE,77,77,99),	V(F6,7B,7B,8D),	\
-	V(FF,F2,F2,0D),	V(D6,6B,6B,BD),	V(DE,6F,6F,B1),	V(91,C5,C5,54),	\
-	V(60,30,30,50),	V(02,01,01,03),	V(CE,67,67,A9),	V(56,2B,2B,7D),	\
-	V(E7,FE,FE,19),	V(B5,D7,D7,62),	V(4D,AB,AB,E6),	V(EC,76,76,9A),	\
-	V(8F,CA,CA,45),	V(1F,82,82,9D),	V(89,C9,C9,40),	V(FA,7D,7D,87),	\
-	V(EF,FA,FA,15),	V(B2,59,59,EB),	V(8E,47,47,C9),	V(FB,F0,F0,0B),	\
-	V(41,AD,AD,EC),	V(B3,D4,D4,67),	V(5F,A2,A2,FD),	V(45,AF,AF,EA),	\
-	V(23,9C,9C,BF),	V(53,A4,A4,F7),	V(E4,72,72,96),	V(9B,C0,C0,5B),	\
-	V(75,B7,B7,C2),	V(E1,FD,FD,1C),	V(3D,93,93,AE),	V(4C,26,26,6A),	\
-	V(6C,36,36,5A),	V(7E,3F,3F,41),	V(F5,F7,F7,02),	V(83,CC,CC,4F),	\
-	V(68,34,34,5C),	V(51,A5,A5,F4),	V(D1,E5,E5,34),	V(F9,F1,F1,08),	\
-	V(E2,71,71,93),	V(AB,D8,D8,73),	V(62,31,31,53),	V(2A,15,15,3F),	\
-	V(08,04,04,0C),	V(95,C7,C7,52),	V(46,23,23,65),	V(9D,C3,C3,5E),	\
-	V(30,18,18,28),	V(37,96,96,A1),	V(0A,05,05,0F),	V(2F,9A,9A,B5),	\
-	V(0E,07,07,09),	V(24,12,12,36),	V(1B,80,80,9B),	V(DF,E2,E2,3D),	\
-	V(CD,EB,EB,26),	V(4E,27,27,69),	V(7F,B2,B2,CD),	V(EA,75,75,9F),	\
-	V(12,09,09,1B),	V(1D,83,83,9E),	V(58,2C,2C,74),	V(34,1A,1A,2E),	\
-	V(36,1B,1B,2D),	V(DC,6E,6E,B2),	V(B4,5A,5A,EE),	V(5B,A0,A0,FB),	\
-	V(A4,52,52,F6),	V(76,3B,3B,4D),	V(B7,D6,D6,61),	V(7D,B3,B3,CE),	\
-	V(52,29,29,7B),	V(DD,E3,E3,3E),	V(5E,2F,2F,71),	V(13,84,84,97),	\
-	V(A6,53,53,F5),	V(B9,D1,D1,68),	V(00,00,00,00),	V(C1,ED,ED,2C),	\
-	V(40,20,20,60),	V(E3,FC,FC,1F),	V(79,B1,B1,C8),	V(B6,5B,5B,ED),	\
-	V(D4,6A,6A,BE),	V(8D,CB,CB,46),	V(67,BE,BE,D9),	V(72,39,39,4B),	\
-	V(94,4A,4A,DE),	V(98,4C,4C,D4),	V(B0,58,58,E8),	V(85,CF,CF,4A),	\
-	V(BB,D0,D0,6B),	V(C5,EF,EF,2A),	V(4F,AA,AA,E5),	V(ED,FB,FB,16),	\
-	V(86,43,43,C5),	V(9A,4D,4D,D7),	V(66,33,33,55),	V(11,85,85,94),	\
-	V(8A,45,45,CF),	V(E9,F9,F9,10),	V(04,02,02,06),	V(FE,7F,7F,81),	\
-	V(A0,50,50,F0),	V(78,3C,3C,44),	V(25,9F,9F,BA),	V(4B,A8,A8,E3),	\
-	V(A2,51,51,F3),	V(5D,A3,A3,FE),	V(80,40,40,C0),	V(05,8F,8F,8A),	\
-	V(3F,92,92,AD),	V(21,9D,9D,BC),	V(70,38,38,48),	V(F1,F5,F5,04),	\
-	V(63,BC,BC,DF),	V(77,B6,B6,C1),	V(AF,DA,DA,75),	V(42,21,21,63),	\
-	V(20,10,10,30),	V(E5,FF,FF,1A),	V(FD,F3,F3,0E),	V(BF,D2,D2,6D),	\
-	V(81,CD,CD,4C),	V(18,0C,0C,14),	V(26,13,13,35),	V(C3,EC,EC,2F),	\
-	V(BE,5F,5F,E1),	V(35,97,97,A2),	V(88,44,44,CC),	V(2E,17,17,39),	\
-	V(93,C4,C4,57),	V(55,A7,A7,F2),	V(FC,7E,7E,82),	V(7A,3D,3D,47),	\
-	V(C8,64,64,AC),	V(BA,5D,5D,E7),	V(32,19,19,2B),	V(E6,73,73,95),	\
-	V(C0,60,60,A0),	V(19,81,81,98),	V(9E,4F,4F,D1),	V(A3,DC,DC,7F),	\
-	V(44,22,22,66),	V(54,2A,2A,7E),	V(3B,90,90,AB),	V(0B,88,88,83),	\
-	V(8C,46,46,CA),	V(C7,EE,EE,29),	V(6B,B8,B8,D3),	V(28,14,14,3C),	\
-	V(A7,DE,DE,79),	V(BC,5E,5E,E2),	V(16,0B,0B,1D),	V(AD,DB,DB,76),	\
-	V(DB,E0,E0,3B),	V(64,32,32,56),	V(74,3A,3A,4E),	V(14,0A,0A,1E),	\
-	V(92,49,49,DB),	V(0C,06,06,0A),	V(48,24,24,6C),	V(B8,5C,5C,E4),	\
-	V(9F,C2,C2,5D),	V(BD,D3,D3,6E),	V(43,AC,AC,EF),	V(C4,62,62,A6),	\
-	V(39,91,91,A8),	V(31,95,95,A4),	V(D3,E4,E4,37),	V(F2,79,79,8B),	\
-	V(D5,E7,E7,32),	V(8B,C8,C8,43),	V(6E,37,37,59),	V(DA,6D,6D,B7),	\
-	V(01,8D,8D,8C),	V(B1,D5,D5,64),	V(9C,4E,4E,D2),	V(49,A9,A9,E0),	\
-	V(D8,6C,6C,B4),	V(AC,56,56,FA),	V(F3,F4,F4,07),	V(CF,EA,EA,25),	\
-	V(CA,65,65,AF),	V(F4,7A,7A,8E),	V(47,AE,AE,E9),	V(10,08,08,18),	\
-	V(6F,BA,BA,D5),	V(F0,78,78,88),	V(4A,25,25,6F),	V(5C,2E,2E,72),	\
-	V(38,1C,1C,24),	V(57,A6,A6,F1),	V(73,B4,B4,C7),	V(97,C6,C6,51),	\
-	V(CB,E8,E8,23),	V(A1,DD,DD,7C),	V(E8,74,74,9C),	V(3E,1F,1F,21),	\
-	V(96,4B,4B,DD),	V(61,BD,BD,DC),	V(0D,8B,8B,86),	V(0F,8A,8A,85),	\
-	V(E0,70,70,90),	V(7C,3E,3E,42),	V(71,B5,B5,C4),	V(CC,66,66,AA),	\
-	V(90,48,48,D8),	V(06,03,03,05),	V(F7,F6,F6,01),	V(1C,0E,0E,12),	\
-	V(C2,61,61,A3),	V(6A,35,35,5F),	V(AE,57,57,F9),	V(69,B9,B9,D0),	\
-	V(17,86,86,91),	V(99,C1,C1,58),	V(3A,1D,1D,27),	V(27,9E,9E,B9),	\
-	V(D9,E1,E1,38),	V(EB,F8,F8,13),	V(2B,98,98,B3),	V(22,11,11,33),	\
-	V(D2,69,69,BB),	V(A9,D9,D9,70),	V(07,8E,8E,89),	V(33,94,94,A7),	\
-	V(2D,9B,9B,B6),	V(3C,1E,1E,22),	V(15,87,87,92),	V(C9,E9,E9,20),	\
-	V(87,CE,CE,49),	V(AA,55,55,FF),	V(50,28,28,78),	V(A5,DF,DF,7A),	\
-	V(03,8C,8C,8F),	V(59,A1,A1,F8),	V(09,89,89,80),	V(1A,0D,0D,17),	\
-	V(65,BF,BF,DA),	V(D7,E6,E6,31),	V(84,42,42,C6),	V(D0,68,68,B8),	\
-	V(82,41,41,C3),	V(29,99,99,B0),	V(5A,2D,2D,77),	V(1E,0F,0F,11),	\
-	V(7B,B0,B0,CB),	V(A8,54,54,FC),	V(6D,BB,BB,D6),	V(2C,16,16,3A)
-
-#define	V(a,b,c,d) 0x##a##b##c##d
-static uint32 FT0[256] = { FT };
-#undef V
-
-#define	V(a,b,c,d) 0x##d##a##b##c
-static uint32 FT1[256] = { FT };
-#undef V
-
-#define	V(a,b,c,d) 0x##c##d##a##b
-static uint32 FT2[256] = { FT };
-#undef V
-
-#define	V(a,b,c,d) 0x##b##c##d##a
-static uint32 FT3[256] = { FT };
-#undef V
-
-#undef FT
-
-/* reverse S-box */
-
-static uint32 RSb[256] =
-{
-	0x52, 0x09,	0x6A, 0xD5,	0x30, 0x36,	0xA5, 0x38,
-	0xBF, 0x40,	0xA3, 0x9E,	0x81, 0xF3,	0xD7, 0xFB,
-	0x7C, 0xE3,	0x39, 0x82,	0x9B, 0x2F,	0xFF, 0x87,
-	0x34, 0x8E,	0x43, 0x44,	0xC4, 0xDE,	0xE9, 0xCB,
-	0x54, 0x7B,	0x94, 0x32,	0xA6, 0xC2,	0x23, 0x3D,
-	0xEE, 0x4C,	0x95, 0x0B,	0x42, 0xFA,	0xC3, 0x4E,
-	0x08, 0x2E,	0xA1, 0x66,	0x28, 0xD9,	0x24, 0xB2,
-	0x76, 0x5B,	0xA2, 0x49,	0x6D, 0x8B,	0xD1, 0x25,
-	0x72, 0xF8,	0xF6, 0x64,	0x86, 0x68,	0x98, 0x16,
-	0xD4, 0xA4,	0x5C, 0xCC,	0x5D, 0x65,	0xB6, 0x92,
-	0x6C, 0x70,	0x48, 0x50,	0xFD, 0xED,	0xB9, 0xDA,
-	0x5E, 0x15,	0x46, 0x57,	0xA7, 0x8D,	0x9D, 0x84,
-	0x90, 0xD8,	0xAB, 0x00,	0x8C, 0xBC,	0xD3, 0x0A,
-	0xF7, 0xE4,	0x58, 0x05,	0xB8, 0xB3,	0x45, 0x06,
-	0xD0, 0x2C,	0x1E, 0x8F,	0xCA, 0x3F,	0x0F, 0x02,
-	0xC1, 0xAF,	0xBD, 0x03,	0x01, 0x13,	0x8A, 0x6B,
-	0x3A, 0x91,	0x11, 0x41,	0x4F, 0x67,	0xDC, 0xEA,
-	0x97, 0xF2,	0xCF, 0xCE,	0xF0, 0xB4,	0xE6, 0x73,
-	0x96, 0xAC,	0x74, 0x22,	0xE7, 0xAD,	0x35, 0x85,
-	0xE2, 0xF9,	0x37, 0xE8,	0x1C, 0x75,	0xDF, 0x6E,
-	0x47, 0xF1,	0x1A, 0x71,	0x1D, 0x29,	0xC5, 0x89,
-	0x6F, 0xB7,	0x62, 0x0E,	0xAA, 0x18,	0xBE, 0x1B,
-	0xFC, 0x56,	0x3E, 0x4B,	0xC6, 0xD2,	0x79, 0x20,
-	0x9A, 0xDB,	0xC0, 0xFE,	0x78, 0xCD,	0x5A, 0xF4,
-	0x1F, 0xDD,	0xA8, 0x33,	0x88, 0x07,	0xC7, 0x31,
-	0xB1, 0x12,	0x10, 0x59,	0x27, 0x80,	0xEC, 0x5F,
-	0x60, 0x51,	0x7F, 0xA9,	0x19, 0xB5,	0x4A, 0x0D,
-	0x2D, 0xE5,	0x7A, 0x9F,	0x93, 0xC9,	0x9C, 0xEF,
-	0xA0, 0xE0,	0x3B, 0x4D,	0xAE, 0x2A,	0xF5, 0xB0,
-	0xC8, 0xEB,	0xBB, 0x3C,	0x83, 0x53,	0x99, 0x61,
-	0x17, 0x2B,	0x04, 0x7E,	0xBA, 0x77,	0xD6, 0x26,
-	0xE1, 0x69,	0x14, 0x63,	0x55, 0x21,	0x0C, 0x7D
-};
-
-/* reverse table */
-
-#define	RT \
-\
-	V(51,F4,A7,50),	V(7E,41,65,53),	V(1A,17,A4,C3),	V(3A,27,5E,96),	\
-	V(3B,AB,6B,CB),	V(1F,9D,45,F1),	V(AC,FA,58,AB),	V(4B,E3,03,93),	\
-	V(20,30,FA,55),	V(AD,76,6D,F6),	V(88,CC,76,91),	V(F5,02,4C,25),	\
-	V(4F,E5,D7,FC),	V(C5,2A,CB,D7),	V(26,35,44,80),	V(B5,62,A3,8F),	\
-	V(DE,B1,5A,49),	V(25,BA,1B,67),	V(45,EA,0E,98),	V(5D,FE,C0,E1),	\
-	V(C3,2F,75,02),	V(81,4C,F0,12),	V(8D,46,97,A3),	V(6B,D3,F9,C6),	\
-	V(03,8F,5F,E7),	V(15,92,9C,95),	V(BF,6D,7A,EB),	V(95,52,59,DA),	\
-	V(D4,BE,83,2D),	V(58,74,21,D3),	V(49,E0,69,29),	V(8E,C9,C8,44),	\
-	V(75,C2,89,6A),	V(F4,8E,79,78),	V(99,58,3E,6B),	V(27,B9,71,DD),	\
-	V(BE,E1,4F,B6),	V(F0,88,AD,17),	V(C9,20,AC,66),	V(7D,CE,3A,B4),	\
-	V(63,DF,4A,18),	V(E5,1A,31,82),	V(97,51,33,60),	V(62,53,7F,45),	\
-	V(B1,64,77,E0),	V(BB,6B,AE,84),	V(FE,81,A0,1C),	V(F9,08,2B,94),	\
-	V(70,48,68,58),	V(8F,45,FD,19),	V(94,DE,6C,87),	V(52,7B,F8,B7),	\
-	V(AB,73,D3,23),	V(72,4B,02,E2),	V(E3,1F,8F,57),	V(66,55,AB,2A),	\
-	V(B2,EB,28,07),	V(2F,B5,C2,03),	V(86,C5,7B,9A),	V(D3,37,08,A5),	\
-	V(30,28,87,F2),	V(23,BF,A5,B2),	V(02,03,6A,BA),	V(ED,16,82,5C),	\
-	V(8A,CF,1C,2B),	V(A7,79,B4,92),	V(F3,07,F2,F0),	V(4E,69,E2,A1),	\
-	V(65,DA,F4,CD),	V(06,05,BE,D5),	V(D1,34,62,1F),	V(C4,A6,FE,8A),	\
-	V(34,2E,53,9D),	V(A2,F3,55,A0),	V(05,8A,E1,32),	V(A4,F6,EB,75),	\
-	V(0B,83,EC,39),	V(40,60,EF,AA),	V(5E,71,9F,06),	V(BD,6E,10,51),	\
-	V(3E,21,8A,F9),	V(96,DD,06,3D),	V(DD,3E,05,AE),	V(4D,E6,BD,46),	\
-	V(91,54,8D,B5),	V(71,C4,5D,05),	V(04,06,D4,6F),	V(60,50,15,FF),	\
-	V(19,98,FB,24),	V(D6,BD,E9,97),	V(89,40,43,CC),	V(67,D9,9E,77),	\
-	V(B0,E8,42,BD),	V(07,89,8B,88),	V(E7,19,5B,38),	V(79,C8,EE,DB),	\
-	V(A1,7C,0A,47),	V(7C,42,0F,E9),	V(F8,84,1E,C9),	V(00,00,00,00),	\
-	V(09,80,86,83),	V(32,2B,ED,48),	V(1E,11,70,AC),	V(6C,5A,72,4E),	\
-	V(FD,0E,FF,FB),	V(0F,85,38,56),	V(3D,AE,D5,1E),	V(36,2D,39,27),	\
-	V(0A,0F,D9,64),	V(68,5C,A6,21),	V(9B,5B,54,D1),	V(24,36,2E,3A),	\
-	V(0C,0A,67,B1),	V(93,57,E7,0F),	V(B4,EE,96,D2),	V(1B,9B,91,9E),	\
-	V(80,C0,C5,4F),	V(61,DC,20,A2),	V(5A,77,4B,69),	V(1C,12,1A,16),	\
-	V(E2,93,BA,0A),	V(C0,A0,2A,E5),	V(3C,22,E0,43),	V(12,1B,17,1D),	\
-	V(0E,09,0D,0B),	V(F2,8B,C7,AD),	V(2D,B6,A8,B9),	V(14,1E,A9,C8),	\
-	V(57,F1,19,85),	V(AF,75,07,4C),	V(EE,99,DD,BB),	V(A3,7F,60,FD),	\
-	V(F7,01,26,9F),	V(5C,72,F5,BC),	V(44,66,3B,C5),	V(5B,FB,7E,34),	\
-	V(8B,43,29,76),	V(CB,23,C6,DC),	V(B6,ED,FC,68),	V(B8,E4,F1,63),	\
-	V(D7,31,DC,CA),	V(42,63,85,10),	V(13,97,22,40),	V(84,C6,11,20),	\
-	V(85,4A,24,7D),	V(D2,BB,3D,F8),	V(AE,F9,32,11),	V(C7,29,A1,6D),	\
-	V(1D,9E,2F,4B),	V(DC,B2,30,F3),	V(0D,86,52,EC),	V(77,C1,E3,D0),	\
-	V(2B,B3,16,6C),	V(A9,70,B9,99),	V(11,94,48,FA),	V(47,E9,64,22),	\
-	V(A8,FC,8C,C4),	V(A0,F0,3F,1A),	V(56,7D,2C,D8),	V(22,33,90,EF),	\
-	V(87,49,4E,C7),	V(D9,38,D1,C1),	V(8C,CA,A2,FE),	V(98,D4,0B,36),	\
-	V(A6,F5,81,CF),	V(A5,7A,DE,28),	V(DA,B7,8E,26),	V(3F,AD,BF,A4),	\
-	V(2C,3A,9D,E4),	V(50,78,92,0D),	V(6A,5F,CC,9B),	V(54,7E,46,62),	\
-	V(F6,8D,13,C2),	V(90,D8,B8,E8),	V(2E,39,F7,5E),	V(82,C3,AF,F5),	\
-	V(9F,5D,80,BE),	V(69,D0,93,7C),	V(6F,D5,2D,A9),	V(CF,25,12,B3),	\
-	V(C8,AC,99,3B),	V(10,18,7D,A7),	V(E8,9C,63,6E),	V(DB,3B,BB,7B),	\
-	V(CD,26,78,09),	V(6E,59,18,F4),	V(EC,9A,B7,01),	V(83,4F,9A,A8),	\
-	V(E6,95,6E,65),	V(AA,FF,E6,7E),	V(21,BC,CF,08),	V(EF,15,E8,E6),	\
-	V(BA,E7,9B,D9),	V(4A,6F,36,CE),	V(EA,9F,09,D4),	V(29,B0,7C,D6),	\
-	V(31,A4,B2,AF),	V(2A,3F,23,31),	V(C6,A5,94,30),	V(35,A2,66,C0),	\
-	V(74,4E,BC,37),	V(FC,82,CA,A6),	V(E0,90,D0,B0),	V(33,A7,D8,15),	\
-	V(F1,04,98,4A),	V(41,EC,DA,F7),	V(7F,CD,50,0E),	V(17,91,F6,2F),	\
-	V(76,4D,D6,8D),	V(43,EF,B0,4D),	V(CC,AA,4D,54),	V(E4,96,04,DF),	\
-	V(9E,D1,B5,E3),	V(4C,6A,88,1B),	V(C1,2C,1F,B8),	V(46,65,51,7F),	\
-	V(9D,5E,EA,04),	V(01,8C,35,5D),	V(FA,87,74,73),	V(FB,0B,41,2E),	\
-	V(B3,67,1D,5A),	V(92,DB,D2,52),	V(E9,10,56,33),	V(6D,D6,47,13),	\
-	V(9A,D7,61,8C),	V(37,A1,0C,7A),	V(59,F8,14,8E),	V(EB,13,3C,89),	\
-	V(CE,A9,27,EE),	V(B7,61,C9,35),	V(E1,1C,E5,ED),	V(7A,47,B1,3C),	\
-	V(9C,D2,DF,59),	V(55,F2,73,3F),	V(18,14,CE,79),	V(73,C7,37,BF),	\
-	V(53,F7,CD,EA),	V(5F,FD,AA,5B),	V(DF,3D,6F,14),	V(78,44,DB,86),	\
-	V(CA,AF,F3,81),	V(B9,68,C4,3E),	V(38,24,34,2C),	V(C2,A3,40,5F),	\
-	V(16,1D,C3,72),	V(BC,E2,25,0C),	V(28,3C,49,8B),	V(FF,0D,95,41),	\
-	V(39,A8,01,71),	V(08,0C,B3,DE),	V(D8,B4,E4,9C),	V(64,56,C1,90),	\
-	V(7B,CB,84,61),	V(D5,32,B6,70),	V(48,6C,5C,74),	V(D0,B8,57,42)
-
-#define	V(a,b,c,d) 0x##a##b##c##d
-static uint32 RT0[256] = { RT };
-#undef V
-
-#define	V(a,b,c,d) 0x##d##a##b##c
-static uint32 RT1[256] = { RT };
-#undef V
-
-#define	V(a,b,c,d) 0x##c##d##a##b
-static uint32 RT2[256] = { RT };
-#undef V
-
-#define	V(a,b,c,d) 0x##b##c##d##a
-static uint32 RT3[256] = { RT };
-#undef V
-
-#undef RT
-
-/* round constants */
-
-static uint32 RCON[10] =
-{
-	0x01000000,	0x02000000,	0x04000000,	0x08000000,
-	0x10000000,	0x20000000,	0x40000000,	0x80000000,
-	0x1B000000,	0x36000000
-};
-
-/* key schedule	tables */
-
-static int KT_init = 1;
-
-static uint32 KT0[256];
-static uint32 KT1[256];
-static uint32 KT2[256];
-static uint32 KT3[256];
-
-/* platform-independant	32-bit integer manipulation	macros */
-
-#define	GET_UINT32(n,b,i)						\
-{												\
-	(n)	= (	(uint32) (b)[(i)	] << 24	)		\
-		| (	(uint32) (b)[(i) + 1] << 16	)		\
-		| (	(uint32) (b)[(i) + 2] <<  8	)		\
-		| (	(uint32) (b)[(i) + 3]		);		\
-}
-
-#define	PUT_UINT32(n,b,i)						\
-{												\
-	(b)[(i)	   ] = (uint8) ( (n) >>	24 );		\
-	(b)[(i)	+ 1] = (uint8) ( (n) >>	16 );		\
-	(b)[(i)	+ 2] = (uint8) ( (n) >>	 8 );		\
-	(b)[(i)	+ 3] = (uint8) ( (n)	   );		\
-}
-
-/* AES key scheduling routine */
-
-int	rtmp_aes_set_key( aes_context *ctx, uint8 *key, int nbits )
-{
-	int	i;
-	uint32 *RK,	*SK;
-
-	switch(	nbits )
-	{
-		case 128: ctx->nr =	10;	break;
-		case 192: ctx->nr =	12;	break;
-		case 256: ctx->nr =	14;	break;
-		default	: return( 1	);
-	}
-
-	RK = ctx->erk;
-
-	for( i = 0;	i <	(nbits >> 5); i++ )
-	{
-		GET_UINT32(	RK[i], key,	i *	4 );
-	}
-
-	/* setup encryption	round keys */
-
-	switch(	nbits )
-	{
-	case 128:
-
-		for( i = 0;	i <	10;	i++, RK	+= 4 )
-		{
-			RK[4]  = RK[0] ^ RCON[i] ^
-						( FSb[ (uint8) ( RK[3] >> 16 ) ] <<	24 ) ^
-						( FSb[ (uint8) ( RK[3] >>  8 ) ] <<	16 ) ^
-						( FSb[ (uint8) ( RK[3]		 ) ] <<	 8 ) ^
-						( FSb[ (uint8) ( RK[3] >> 24 ) ]	   );
-
-			RK[5]  = RK[1] ^ RK[4];
-			RK[6]  = RK[2] ^ RK[5];
-			RK[7]  = RK[3] ^ RK[6];
-		}
-		break;
-
-	case 192:
-
-		for( i = 0;	i <	8; i++,	RK += 6	)
-		{
-			RK[6]  = RK[0] ^ RCON[i] ^
-						( FSb[ (uint8) ( RK[5] >> 16 ) ] <<	24 ) ^
-						( FSb[ (uint8) ( RK[5] >>  8 ) ] <<	16 ) ^
-						( FSb[ (uint8) ( RK[5]		 ) ] <<	 8 ) ^
-						( FSb[ (uint8) ( RK[5] >> 24 ) ]	   );
-
-			RK[7]  = RK[1] ^ RK[6];
-			RK[8]  = RK[2] ^ RK[7];
-			RK[9]  = RK[3] ^ RK[8];
-			RK[10] = RK[4] ^ RK[9];
-			RK[11] = RK[5] ^ RK[10];
-		}
-		break;
-
-	case 256:
-
-		for( i = 0;	i <	7; i++,	RK += 8	)
-		{
-			RK[8]  = RK[0] ^ RCON[i] ^
-						( FSb[ (uint8) ( RK[7] >> 16 ) ] <<	24 ) ^
-						( FSb[ (uint8) ( RK[7] >>  8 ) ] <<	16 ) ^
-						( FSb[ (uint8) ( RK[7]		 ) ] <<	 8 ) ^
-						( FSb[ (uint8) ( RK[7] >> 24 ) ]	   );
-
-			RK[9]  = RK[1] ^ RK[8];
-			RK[10] = RK[2] ^ RK[9];
-			RK[11] = RK[3] ^ RK[10];
-
-			RK[12] = RK[4] ^
-						( FSb[ (uint8) ( RK[11]	>> 24 )	] << 24	) ^
-						( FSb[ (uint8) ( RK[11]	>> 16 )	] << 16	) ^
-						( FSb[ (uint8) ( RK[11]	>>	8 )	] <<  8	) ^
-						( FSb[ (uint8) ( RK[11]		  )	]		);
-
-			RK[13] = RK[5] ^ RK[12];
-			RK[14] = RK[6] ^ RK[13];
-			RK[15] = RK[7] ^ RK[14];
-		}
-		break;
-	}
-
-	/* setup decryption	round keys */
-
-	if(	KT_init	)
-	{
-		for( i = 0;	i <	256; i++ )
-		{
-			KT0[i] = RT0[ FSb[i] ];
-			KT1[i] = RT1[ FSb[i] ];
-			KT2[i] = RT2[ FSb[i] ];
-			KT3[i] = RT3[ FSb[i] ];
-		}
-
-		KT_init	= 0;
-	}
-
-	SK = ctx->drk;
-
-	*SK++ =	*RK++;
-	*SK++ =	*RK++;
-	*SK++ =	*RK++;
-	*SK++ =	*RK++;
-
-	for( i = 1;	i <	ctx->nr; i++ )
-	{
-		RK -= 8;
-
-		*SK++ =	KT0[ (uint8) ( *RK >> 24 ) ] ^
-				KT1[ (uint8) ( *RK >> 16 ) ] ^
-				KT2[ (uint8) ( *RK >>  8 ) ] ^
-				KT3[ (uint8) ( *RK		 ) ]; RK++;
-
-		*SK++ =	KT0[ (uint8) ( *RK >> 24 ) ] ^
-				KT1[ (uint8) ( *RK >> 16 ) ] ^
-				KT2[ (uint8) ( *RK >>  8 ) ] ^
-				KT3[ (uint8) ( *RK		 ) ]; RK++;
-
-		*SK++ =	KT0[ (uint8) ( *RK >> 24 ) ] ^
-				KT1[ (uint8) ( *RK >> 16 ) ] ^
-				KT2[ (uint8) ( *RK >>  8 ) ] ^
-				KT3[ (uint8) ( *RK		 ) ]; RK++;
-
-		*SK++ =	KT0[ (uint8) ( *RK >> 24 ) ] ^
-				KT1[ (uint8) ( *RK >> 16 ) ] ^
-				KT2[ (uint8) ( *RK >>  8 ) ] ^
-				KT3[ (uint8) ( *RK		 ) ]; RK++;
-	}
-
-	RK -= 8;
-
-	*SK++ =	*RK++;
-	*SK++ =	*RK++;
-	*SK++ =	*RK++;
-	*SK++ =	*RK++;
-
-	return(	0 );
-}
-
-/* AES 128-bit block encryption	routine	*/
-
-void rtmp_aes_encrypt(aes_context *ctx, uint8 input[16],	uint8 output[16] )
-{
-	uint32 *RK,	X0,	X1,	X2,	X3,	Y0,	Y1,	Y2,	Y3;
-
-	RK = ctx->erk;
-	GET_UINT32(	X0,	input,	0 ); X0	^= RK[0];
-	GET_UINT32(	X1,	input,	4 ); X1	^= RK[1];
-	GET_UINT32(	X2,	input,	8 ); X2	^= RK[2];
-	GET_UINT32(	X3,	input, 12 ); X3	^= RK[3];
-
-#define	AES_FROUND(X0,X1,X2,X3,Y0,Y1,Y2,Y3)		\
-{												\
-	RK += 4;									\
-												\
-	X0 = RK[0] ^ FT0[ (uint8) (	Y0 >> 24 ) ] ^	\
-				 FT1[ (uint8) (	Y1 >> 16 ) ] ^	\
-				 FT2[ (uint8) (	Y2 >>  8 ) ] ^	\
-				 FT3[ (uint8) (	Y3		 ) ];	\
-												\
-	X1 = RK[1] ^ FT0[ (uint8) (	Y1 >> 24 ) ] ^	\
-				 FT1[ (uint8) (	Y2 >> 16 ) ] ^	\
-				 FT2[ (uint8) (	Y3 >>  8 ) ] ^	\
-				 FT3[ (uint8) (	Y0		 ) ];	\
-												\
-	X2 = RK[2] ^ FT0[ (uint8) (	Y2 >> 24 ) ] ^	\
-				 FT1[ (uint8) (	Y3 >> 16 ) ] ^	\
-				 FT2[ (uint8) (	Y0 >>  8 ) ] ^	\
-				 FT3[ (uint8) (	Y1		 ) ];	\
-												\
-	X3 = RK[3] ^ FT0[ (uint8) (	Y3 >> 24 ) ] ^	\
-				 FT1[ (uint8) (	Y0 >> 16 ) ] ^	\
-				 FT2[ (uint8) (	Y1 >>  8 ) ] ^	\
-				 FT3[ (uint8) (	Y2		 ) ];	\
-}
-
-	AES_FROUND(	Y0,	Y1,	Y2,	Y3,	X0,	X1,	X2,	X3 );		/* round 1 */
-	AES_FROUND(	X0,	X1,	X2,	X3,	Y0,	Y1,	Y2,	Y3 );		/* round 2 */
-	AES_FROUND(	Y0,	Y1,	Y2,	Y3,	X0,	X1,	X2,	X3 );		/* round 3 */
-	AES_FROUND(	X0,	X1,	X2,	X3,	Y0,	Y1,	Y2,	Y3 );		/* round 4 */
-	AES_FROUND(	Y0,	Y1,	Y2,	Y3,	X0,	X1,	X2,	X3 );		/* round 5 */
-	AES_FROUND(	X0,	X1,	X2,	X3,	Y0,	Y1,	Y2,	Y3 );		/* round 6 */
-	AES_FROUND(	Y0,	Y1,	Y2,	Y3,	X0,	X1,	X2,	X3 );		/* round 7 */
-	AES_FROUND(	X0,	X1,	X2,	X3,	Y0,	Y1,	Y2,	Y3 );		/* round 8 */
-	AES_FROUND(	Y0,	Y1,	Y2,	Y3,	X0,	X1,	X2,	X3 );		/* round 9 */
-
-	if(	ctx->nr	> 10 )
-	{
-		AES_FROUND(	X0,	X1,	X2,	X3,	Y0,	Y1,	Y2,	Y3 );	/* round 10	*/
-		AES_FROUND(	Y0,	Y1,	Y2,	Y3,	X0,	X1,	X2,	X3 );	/* round 11	*/
-	}
-
-	if(	ctx->nr	> 12 )
-	{
-		AES_FROUND(	X0,	X1,	X2,	X3,	Y0,	Y1,	Y2,	Y3 );	/* round 12	*/
-		AES_FROUND(	Y0,	Y1,	Y2,	Y3,	X0,	X1,	X2,	X3 );	/* round 13	*/
-	}
-
-	/* last	round */
-
-	RK += 4;
-
-	X0 = RK[0] ^ ( FSb[	(uint8)	( Y0 >>	24 ) ] << 24 ) ^
-				 ( FSb[	(uint8)	( Y1 >>	16 ) ] << 16 ) ^
-				 ( FSb[	(uint8)	( Y2 >>	 8 ) ] <<  8 ) ^
-				 ( FSb[	(uint8)	( Y3	   ) ]		 );
-
-	X1 = RK[1] ^ ( FSb[	(uint8)	( Y1 >>	24 ) ] << 24 ) ^
-				 ( FSb[	(uint8)	( Y2 >>	16 ) ] << 16 ) ^
-				 ( FSb[	(uint8)	( Y3 >>	 8 ) ] <<  8 ) ^
-				 ( FSb[	(uint8)	( Y0	   ) ]		 );
-
-	X2 = RK[2] ^ ( FSb[	(uint8)	( Y2 >>	24 ) ] << 24 ) ^
-				 ( FSb[	(uint8)	( Y3 >>	16 ) ] << 16 ) ^
-				 ( FSb[	(uint8)	( Y0 >>	 8 ) ] <<  8 ) ^
-				 ( FSb[	(uint8)	( Y1	   ) ]		 );
-
-	X3 = RK[3] ^ ( FSb[	(uint8)	( Y3 >>	24 ) ] << 24 ) ^
-				 ( FSb[	(uint8)	( Y0 >>	16 ) ] << 16 ) ^
-				 ( FSb[	(uint8)	( Y1 >>	 8 ) ] <<  8 ) ^
-				 ( FSb[	(uint8)	( Y2	   ) ]		 );
-
-	PUT_UINT32(	X0,	output,	 0 );
-	PUT_UINT32(	X1,	output,	 4 );
-	PUT_UINT32(	X2,	output,	 8 );
-	PUT_UINT32(	X3,	output,	12 );
-}
-
-/* AES 128-bit block decryption	routine	*/
-
-void rtmp_aes_decrypt( aes_context *ctx,	uint8 input[16], uint8 output[16] )
-{
-	uint32 *RK,	X0,	X1,	X2,	X3,	Y0,	Y1,	Y2,	Y3;
-
-	RK = ctx->drk;
-
-	GET_UINT32(	X0,	input,	0 ); X0	^= RK[0];
-	GET_UINT32(	X1,	input,	4 ); X1	^= RK[1];
-	GET_UINT32(	X2,	input,	8 ); X2	^= RK[2];
-	GET_UINT32(	X3,	input, 12 ); X3	^= RK[3];
-
-#define	AES_RROUND(X0,X1,X2,X3,Y0,Y1,Y2,Y3)		\
-{												\
-	RK += 4;									\
-												\
-	X0 = RK[0] ^ RT0[ (uint8) (	Y0 >> 24 ) ] ^	\
-				 RT1[ (uint8) (	Y3 >> 16 ) ] ^	\
-				 RT2[ (uint8) (	Y2 >>  8 ) ] ^	\
-				 RT3[ (uint8) (	Y1		 ) ];	\
-												\
-	X1 = RK[1] ^ RT0[ (uint8) (	Y1 >> 24 ) ] ^	\
-				 RT1[ (uint8) (	Y0 >> 16 ) ] ^	\
-				 RT2[ (uint8) (	Y3 >>  8 ) ] ^	\
-				 RT3[ (uint8) (	Y2		 ) ];	\
-												\
-	X2 = RK[2] ^ RT0[ (uint8) (	Y2 >> 24 ) ] ^	\
-				 RT1[ (uint8) (	Y1 >> 16 ) ] ^	\
-				 RT2[ (uint8) (	Y0 >>  8 ) ] ^	\
-				 RT3[ (uint8) (	Y3		 ) ];	\
-												\
-	X3 = RK[3] ^ RT0[ (uint8) (	Y3 >> 24 ) ] ^	\
-				 RT1[ (uint8) (	Y2 >> 16 ) ] ^	\
-				 RT2[ (uint8) (	Y1 >>  8 ) ] ^	\
-				 RT3[ (uint8) (	Y0		 ) ];	\
-}
-
-	AES_RROUND(	Y0,	Y1,	Y2,	Y3,	X0,	X1,	X2,	X3 );		/* round 1 */
-	AES_RROUND(	X0,	X1,	X2,	X3,	Y0,	Y1,	Y2,	Y3 );		/* round 2 */
-	AES_RROUND(	Y0,	Y1,	Y2,	Y3,	X0,	X1,	X2,	X3 );		/* round 3 */
-	AES_RROUND(	X0,	X1,	X2,	X3,	Y0,	Y1,	Y2,	Y3 );		/* round 4 */
-	AES_RROUND(	Y0,	Y1,	Y2,	Y3,	X0,	X1,	X2,	X3 );		/* round 5 */
-	AES_RROUND(	X0,	X1,	X2,	X3,	Y0,	Y1,	Y2,	Y3 );		/* round 6 */
-	AES_RROUND(	Y0,	Y1,	Y2,	Y3,	X0,	X1,	X2,	X3 );		/* round 7 */
-	AES_RROUND(	X0,	X1,	X2,	X3,	Y0,	Y1,	Y2,	Y3 );		/* round 8 */
-	AES_RROUND(	Y0,	Y1,	Y2,	Y3,	X0,	X1,	X2,	X3 );		/* round 9 */
-
-	if(	ctx->nr	> 10 )
-	{
-		AES_RROUND(	X0,	X1,	X2,	X3,	Y0,	Y1,	Y2,	Y3 );	/* round 10	*/
-		AES_RROUND(	Y0,	Y1,	Y2,	Y3,	X0,	X1,	X2,	X3 );	/* round 11	*/
-	}
-
-	if(	ctx->nr	> 12 )
-	{
-		AES_RROUND(	X0,	X1,	X2,	X3,	Y0,	Y1,	Y2,	Y3 );	/* round 12	*/
-		AES_RROUND(	Y0,	Y1,	Y2,	Y3,	X0,	X1,	X2,	X3 );	/* round 13	*/
-	}
-
-	/* last	round */
-
-	RK += 4;
-
-	X0 = RK[0] ^ ( RSb[	(uint8)	( Y0 >>	24 ) ] << 24 ) ^
-				 ( RSb[	(uint8)	( Y3 >>	16 ) ] << 16 ) ^
-				 ( RSb[	(uint8)	( Y2 >>	 8 ) ] <<  8 ) ^
-				 ( RSb[	(uint8)	( Y1	   ) ]		 );
-
-	X1 = RK[1] ^ ( RSb[	(uint8)	( Y1 >>	24 ) ] << 24 ) ^
-				 ( RSb[	(uint8)	( Y0 >>	16 ) ] << 16 ) ^
-				 ( RSb[	(uint8)	( Y3 >>	 8 ) ] <<  8 ) ^
-				 ( RSb[	(uint8)	( Y2	   ) ]		 );
-
-	X2 = RK[2] ^ ( RSb[	(uint8)	( Y2 >>	24 ) ] << 24 ) ^
-				 ( RSb[	(uint8)	( Y1 >>	16 ) ] << 16 ) ^
-				 ( RSb[	(uint8)	( Y0 >>	 8 ) ] <<  8 ) ^
-				 ( RSb[	(uint8)	( Y3	   ) ]		 );
-
-	X3 = RK[3] ^ ( RSb[	(uint8)	( Y3 >>	24 ) ] << 24 ) ^
-				 ( RSb[	(uint8)	( Y2 >>	16 ) ] << 16 ) ^
-				 ( RSb[	(uint8)	( Y1 >>	 8 ) ] <<  8 ) ^
-				 ( RSb[	(uint8)	( Y0	   ) ]		 );
-
-	PUT_UINT32(	X0,	output,	 0 );
-	PUT_UINT32(	X1,	output,	 4 );
-	PUT_UINT32(	X2,	output,	 8 );
-	PUT_UINT32(	X3,	output,	12 );
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-		SHA1 function
-
-	Arguments:
-
-	Return Value:
-
-	Note:
-
-	========================================================================
-*/
-VOID	HMAC_SHA1(
-	IN	UCHAR	*text,
-	IN	UINT	text_len,
-	IN	UCHAR	*key,
-	IN	UINT	key_len,
-	IN	UCHAR	*digest)
-{
-	SHA_CTX	context;
-	UCHAR	k_ipad[65]; /* inner padding - key XORd with ipad	*/
-	UCHAR	k_opad[65]; /* outer padding - key XORd with opad	*/
-	INT		i;
-
-	// if key is longer	than 64	bytes reset	it to key=SHA1(key)
-	if (key_len	> 64)
-	{
-		SHA_CTX		 tctx;
-		SHAInit(&tctx);
-		SHAUpdate(&tctx, key, key_len);
-		SHAFinal(&tctx,	key);
-		key_len	= 20;
-	}
-	NdisZeroMemory(k_ipad, sizeof(k_ipad));
-	NdisZeroMemory(k_opad, sizeof(k_opad));
-	NdisMoveMemory(k_ipad, key,	key_len);
-	NdisMoveMemory(k_opad, key,	key_len);
-
-	// XOR key with	ipad and opad values
-	for	(i = 0;	i <	64;	i++)
-	{
-		k_ipad[i] ^= 0x36;
-		k_opad[i] ^= 0x5c;
-	}
-
-	// perform inner SHA1
-	SHAInit(&context); 						/* init context for 1st pass */
-	SHAUpdate(&context,	k_ipad,	64);		/*	start with inner pad */
-	SHAUpdate(&context,	text, text_len);	/*	then text of datagram */
-	SHAFinal(&context, digest);				/* finish up 1st pass */
-
-	//perform outer	SHA1
-	SHAInit(&context);					/* init context for 2nd pass */
-	SHAUpdate(&context,	k_opad,	64);	/*	start with outer pad */
-	SHAUpdate(&context,	digest,	20);	/*	then results of	1st	hash */
-	SHAFinal(&context, digest);			/* finish up 2nd pass */
-
-}
-
-/*
-* F(P, S, c, i) = U1 xor U2 xor ... Uc
-* U1 = PRF(P, S || Int(i))
-* U2 = PRF(P, U1)
-* Uc = PRF(P, Uc-1)
-*/
-
-void F(char *password, unsigned char *ssid, int ssidlength, int iterations, int count, unsigned char *output)
-{
-    unsigned char digest[36], digest1[SHA_DIGEST_LEN];
-    int i, j;
-
-    /* U1 = PRF(P, S || int(i)) */
-    memcpy(digest, ssid, ssidlength);
-    digest[ssidlength] = (unsigned char)((count>>24) & 0xff);
-    digest[ssidlength+1] = (unsigned char)((count>>16) & 0xff);
-    digest[ssidlength+2] = (unsigned char)((count>>8) & 0xff);
-    digest[ssidlength+3] = (unsigned char)(count & 0xff);
-    HMAC_SHA1(digest, ssidlength+4, (unsigned char*) password, (int) strlen(password), digest1); // for WPA update
-
-    /* output = U1 */
-    memcpy(output, digest1, SHA_DIGEST_LEN);
-
-    for (i = 1; i < iterations; i++)
-    {
-        /* Un = PRF(P, Un-1) */
-        HMAC_SHA1(digest1, SHA_DIGEST_LEN, (unsigned char*) password, (int) strlen(password), digest); // for WPA update
-        memcpy(digest1, digest, SHA_DIGEST_LEN);
-
-        /* output = output xor Un */
-        for (j = 0; j < SHA_DIGEST_LEN; j++)
-        {
-            output[j] ^= digest[j];
-        }
-    }
-}
-/*
-* password - ascii string up to 63 characters in length
-* ssid - octet string up to 32 octets
-* ssidlength - length of ssid in octets
-* output must be 40 octets in length and outputs 256 bits of key
-*/
-int PasswordHash(char *password, unsigned char *ssid, int ssidlength, unsigned char *output)
-{
-    if ((strlen(password) > 63) || (ssidlength > 32))
-        return 0;
-
-    F(password, ssid, ssidlength, 4096, 1, output);
-    F(password, ssid, ssidlength, 4096, 2, &output[SHA_DIGEST_LEN]);
-    return 1;
-}
-
-
diff --git a/drivers/staging/rt2860/common/mlme.c b/drivers/staging/rt2860/common/mlme.c
index 61a2a4eb7140..9fc34a8f2180 100644
--- a/drivers/staging/rt2860/common/mlme.c
+++ b/drivers/staging/rt2860/common/mlme.c
@@ -39,413 +39,309 @@
 #include "../rt_config.h"
 #include <stdarg.h>
 
-UCHAR	CISCO_OUI[] = {0x00, 0x40, 0x96};
-
-UCHAR	WPA_OUI[] = {0x00, 0x50, 0xf2, 0x01};
-UCHAR	RSN_OUI[] = {0x00, 0x0f, 0xac};
-UCHAR   WME_INFO_ELEM[]  = {0x00, 0x50, 0xf2, 0x02, 0x00, 0x01};
-UCHAR   WME_PARM_ELEM[] = {0x00, 0x50, 0xf2, 0x02, 0x01, 0x01};
-UCHAR	Ccx2QosInfo[] = {0x00, 0x40, 0x96, 0x04};
-UCHAR   RALINK_OUI[]  = {0x00, 0x0c, 0x43};
-UCHAR   BROADCOM_OUI[]  = {0x00, 0x90, 0x4c};
-UCHAR   WPS_OUI[] = {0x00, 0x50, 0xf2, 0x04};
-UCHAR	PRE_N_HT_OUI[]	= {0x00, 0x90, 0x4c};
-
-UCHAR RateSwitchTable[] = {
-// Item No.   Mode   Curr-MCS   TrainUp   TrainDown		// Mode- Bit0: STBC, Bit1: Short GI, Bit4,5: Mode(0:CCK, 1:OFDM, 2:HT Mix, 3:HT GF)
-    0x11, 0x00,  0,  0,  0,						// Initial used item after association
-    0x00, 0x00,  0, 40, 101,
-    0x01, 0x00,  1, 40, 50,
-    0x02, 0x00,  2, 35, 45,
-    0x03, 0x00,  3, 20, 45,
-    0x04, 0x21,  0, 30, 50,
-    0x05, 0x21,  1, 20, 50,
-    0x06, 0x21,  2, 20, 50,
-    0x07, 0x21,  3, 15, 50,
-    0x08, 0x21,  4, 15, 30,
-    0x09, 0x21,  5, 10, 25,
-    0x0a, 0x21,  6,  8, 25,
-    0x0b, 0x21,  7,  8, 25,
-    0x0c, 0x20, 12,  15, 30,
-    0x0d, 0x20, 13,  8, 20,
-    0x0e, 0x20, 14,  8, 20,
-    0x0f, 0x20, 15,  8, 25,
-    0x10, 0x22, 15,  8, 25,
-    0x11, 0x00,  0,  0,  0,
-    0x12, 0x00,  0,  0,  0,
-    0x13, 0x00,  0,  0,  0,
-    0x14, 0x00,  0,  0,  0,
-    0x15, 0x00,  0,  0,  0,
-    0x16, 0x00,  0,  0,  0,
-    0x17, 0x00,  0,  0,  0,
-    0x18, 0x00,  0,  0,  0,
-    0x19, 0x00,  0,  0,  0,
-    0x1a, 0x00,  0,  0,  0,
-    0x1b, 0x00,  0,  0,  0,
-    0x1c, 0x00,  0,  0,  0,
-    0x1d, 0x00,  0,  0,  0,
-    0x1e, 0x00,  0,  0,  0,
-    0x1f, 0x00,  0,  0,  0,
+u8 CISCO_OUI[] = { 0x00, 0x40, 0x96 };
+
+u8 WPA_OUI[] = { 0x00, 0x50, 0xf2, 0x01 };
+u8 RSN_OUI[] = { 0x00, 0x0f, 0xac };
+u8 WME_INFO_ELEM[] = { 0x00, 0x50, 0xf2, 0x02, 0x00, 0x01 };
+u8 WME_PARM_ELEM[] = { 0x00, 0x50, 0xf2, 0x02, 0x01, 0x01 };
+u8 Ccx2QosInfo[] = { 0x00, 0x40, 0x96, 0x04 };
+u8 RALINK_OUI[] = { 0x00, 0x0c, 0x43 };
+u8 BROADCOM_OUI[] = { 0x00, 0x90, 0x4c };
+u8 WPS_OUI[] = { 0x00, 0x50, 0xf2, 0x04 };
+u8 PRE_N_HT_OUI[] = { 0x00, 0x90, 0x4c };
+
+u8 RateSwitchTable[] = {
+/* Item No.   Mode   Curr-MCS   TrainUp   TrainDown             // Mode- Bit0: STBC, Bit1: Short GI, Bit4,5: Mode(0:CCK, 1:OFDM, 2:HT Mix, 3:HT GF) */
+	0x11, 0x00, 0, 0, 0,	/* Initial used item after association */
+	0x00, 0x00, 0, 40, 101,
+	0x01, 0x00, 1, 40, 50,
+	0x02, 0x00, 2, 35, 45,
+	0x03, 0x00, 3, 20, 45,
+	0x04, 0x21, 0, 30, 50,
+	0x05, 0x21, 1, 20, 50,
+	0x06, 0x21, 2, 20, 50,
+	0x07, 0x21, 3, 15, 50,
+	0x08, 0x21, 4, 15, 30,
+	0x09, 0x21, 5, 10, 25,
+	0x0a, 0x21, 6, 8, 25,
+	0x0b, 0x21, 7, 8, 25,
+	0x0c, 0x20, 12, 15, 30,
+	0x0d, 0x20, 13, 8, 20,
+	0x0e, 0x20, 14, 8, 20,
+	0x0f, 0x20, 15, 8, 25,
+	0x10, 0x22, 15, 8, 25,
+	0x11, 0x00, 0, 0, 0,
+	0x12, 0x00, 0, 0, 0,
+	0x13, 0x00, 0, 0, 0,
+	0x14, 0x00, 0, 0, 0,
+	0x15, 0x00, 0, 0, 0,
+	0x16, 0x00, 0, 0, 0,
+	0x17, 0x00, 0, 0, 0,
+	0x18, 0x00, 0, 0, 0,
+	0x19, 0x00, 0, 0, 0,
+	0x1a, 0x00, 0, 0, 0,
+	0x1b, 0x00, 0, 0, 0,
+	0x1c, 0x00, 0, 0, 0,
+	0x1d, 0x00, 0, 0, 0,
+	0x1e, 0x00, 0, 0, 0,
+	0x1f, 0x00, 0, 0, 0,
 };
 
-UCHAR RateSwitchTable11B[] = {
-// Item No.   Mode   Curr-MCS   TrainUp   TrainDown		// Mode- Bit0: STBC, Bit1: Short GI, Bit4,5: Mode(0:CCK, 1:OFDM, 2:HT Mix, 3:HT GF)
-    0x04, 0x03,  0,  0,  0,						// Initial used item after association
-    0x00, 0x00,  0, 40, 101,
-    0x01, 0x00,  1, 40, 50,
-    0x02, 0x00,  2, 35, 45,
-    0x03, 0x00,  3, 20, 45,
+u8 RateSwitchTable11B[] = {
+/* Item No.   Mode   Curr-MCS   TrainUp   TrainDown             // Mode- Bit0: STBC, Bit1: Short GI, Bit4,5: Mode(0:CCK, 1:OFDM, 2:HT Mix, 3:HT GF) */
+	0x04, 0x03, 0, 0, 0,	/* Initial used item after association */
+	0x00, 0x00, 0, 40, 101,
+	0x01, 0x00, 1, 40, 50,
+	0x02, 0x00, 2, 35, 45,
+	0x03, 0x00, 3, 20, 45,
 };
 
-UCHAR RateSwitchTable11BG[] = {
-// Item No.   Mode   Curr-MCS   TrainUp   TrainDown		// Mode- Bit0: STBC, Bit1: Short GI, Bit4,5: Mode(0:CCK, 1:OFDM, 2:HT Mix, 3:HT GF)
-    0x0a, 0x00,  0,  0,  0,						// Initial used item after association
-    0x00, 0x00,  0, 40, 101,
-    0x01, 0x00,  1, 40, 50,
-    0x02, 0x00,  2, 35, 45,
-    0x03, 0x00,  3, 20, 45,
-    0x04, 0x10,  2, 20, 35,
-    0x05, 0x10,  3, 16, 35,
-    0x06, 0x10,  4, 10, 25,
-    0x07, 0x10,  5, 16, 25,
-    0x08, 0x10,  6, 10, 25,
-    0x09, 0x10,  7, 10, 13,
+u8 RateSwitchTable11BG[] = {
+/* Item No.   Mode   Curr-MCS   TrainUp   TrainDown             // Mode- Bit0: STBC, Bit1: Short GI, Bit4,5: Mode(0:CCK, 1:OFDM, 2:HT Mix, 3:HT GF) */
+	0x0a, 0x00, 0, 0, 0,	/* Initial used item after association */
+	0x00, 0x00, 0, 40, 101,
+	0x01, 0x00, 1, 40, 50,
+	0x02, 0x00, 2, 35, 45,
+	0x03, 0x00, 3, 20, 45,
+	0x04, 0x10, 2, 20, 35,
+	0x05, 0x10, 3, 16, 35,
+	0x06, 0x10, 4, 10, 25,
+	0x07, 0x10, 5, 16, 25,
+	0x08, 0x10, 6, 10, 25,
+	0x09, 0x10, 7, 10, 13,
 };
 
-UCHAR RateSwitchTable11G[] = {
-// Item No.   Mode   Curr-MCS   TrainUp   TrainDown		// Mode- Bit0: STBC, Bit1: Short GI, Bit4,5: Mode(0:CCK, 1:OFDM, 2:HT Mix, 3:HT GF)
-    0x08, 0x00,  0,  0,  0,						// Initial used item after association
-    0x00, 0x10,  0, 20, 101,
-    0x01, 0x10,  1, 20, 35,
-    0x02, 0x10,  2, 20, 35,
-    0x03, 0x10,  3, 16, 35,
-    0x04, 0x10,  4, 10, 25,
-    0x05, 0x10,  5, 16, 25,
-    0x06, 0x10,  6, 10, 25,
-    0x07, 0x10,  7, 10, 13,
+u8 RateSwitchTable11G[] = {
+/* Item No.   Mode   Curr-MCS   TrainUp   TrainDown             // Mode- Bit0: STBC, Bit1: Short GI, Bit4,5: Mode(0:CCK, 1:OFDM, 2:HT Mix, 3:HT GF) */
+	0x08, 0x00, 0, 0, 0,	/* Initial used item after association */
+	0x00, 0x10, 0, 20, 101,
+	0x01, 0x10, 1, 20, 35,
+	0x02, 0x10, 2, 20, 35,
+	0x03, 0x10, 3, 16, 35,
+	0x04, 0x10, 4, 10, 25,
+	0x05, 0x10, 5, 16, 25,
+	0x06, 0x10, 6, 10, 25,
+	0x07, 0x10, 7, 10, 13,
 };
 
-UCHAR RateSwitchTable11N1S[] = {
-// Item No.   Mode   Curr-MCS   TrainUp   TrainDown		// Mode- Bit0: STBC, Bit1: Short GI, Bit4,5: Mode(0:CCK, 1:OFDM, 2:HT Mix, 3:HT GF)
-    0x09, 0x00,  0,  0,  0,						// Initial used item after association
-    0x00, 0x21,  0, 30, 101,
-    0x01, 0x21,  1, 20, 50,
-    0x02, 0x21,  2, 20, 50,
-    0x03, 0x21,  3, 15, 50,
-    0x04, 0x21,  4, 15, 30,
-    0x05, 0x21,  5, 10, 25,
-    0x06, 0x21,  6,  8, 14,
-    0x07, 0x21,  7,  8, 14,
-    0x08, 0x23,  7,  8, 14,
+u8 RateSwitchTable11N1S[] = {
+/* Item No.   Mode   Curr-MCS   TrainUp   TrainDown             // Mode- Bit0: STBC, Bit1: Short GI, Bit4,5: Mode(0:CCK, 1:OFDM, 2:HT Mix, 3:HT GF) */
+	0x0c, 0x0a, 0, 0, 0,	/* Initial used item after association */
+	0x00, 0x00, 0, 40, 101,
+	0x01, 0x00, 1, 40, 50,
+	0x02, 0x00, 2, 25, 45,
+	0x03, 0x21, 0, 20, 35,
+	0x04, 0x21, 1, 20, 35,
+	0x05, 0x21, 2, 20, 35,
+	0x06, 0x21, 3, 15, 35,
+	0x07, 0x21, 4, 15, 30,
+	0x08, 0x21, 5, 10, 25,
+	0x09, 0x21, 6, 8, 14,
+	0x0a, 0x21, 7, 8, 14,
+	0x0b, 0x23, 7, 8, 14,
 };
 
-UCHAR RateSwitchTable11N2S[] = {
-// Item No.   Mode   Curr-MCS   TrainUp   TrainDown		// Mode- Bit0: STBC, Bit1: Short GI, Bit4,5: Mode(0:CCK, 1:OFDM, 2:HT Mix, 3:HT GF)
-    0x0a, 0x00,  0,  0,  0,      // Initial used item after association
-    0x00, 0x21,  0, 30, 101,
-    0x01, 0x21,  1, 20, 50,
-    0x02, 0x21,  2, 20, 50,
-    0x03, 0x21,  3, 15, 50,
-    0x04, 0x21,  4, 15, 30,
-    0x05, 0x20, 12,  15, 30,
-    0x06, 0x20, 13,  8, 20,
-    0x07, 0x20, 14,  8, 20,
-    0x08, 0x20, 15,  8, 25,
-    0x09, 0x22, 15,  8, 25,
+u8 RateSwitchTable11N2S[] = {
+/* Item No.   Mode   Curr-MCS   TrainUp   TrainDown             // Mode- Bit0: STBC, Bit1: Short GI, Bit4,5: Mode(0:CCK, 1:OFDM, 2:HT Mix, 3:HT GF) */
+	0x0e, 0x0c, 0, 0, 0,	/* Initial used item after association */
+	0x00, 0x00, 0, 40, 101,
+	0x01, 0x00, 1, 40, 50,
+	0x02, 0x00, 2, 25, 45,
+	0x03, 0x21, 0, 20, 35,
+	0x04, 0x21, 1, 20, 35,
+	0x05, 0x21, 2, 20, 35,
+	0x06, 0x21, 3, 15, 35,
+	0x07, 0x21, 4, 15, 30,
+	0x08, 0x20, 11, 15, 30,
+	0x09, 0x20, 12, 15, 30,
+	0x0a, 0x20, 13, 8, 20,
+	0x0b, 0x20, 14, 8, 20,
+	0x0c, 0x20, 15, 8, 25,
+	0x0d, 0x22, 15, 8, 15,
 };
 
-UCHAR RateSwitchTable11N3S[] = {
-// Item No.	Mode	Curr-MCS	TrainUp	TrainDown	// Mode- Bit0: STBC, Bit1: Short GI, Bit4,5: Mode(0:CCK, 1:OFDM, 2:HT Mix, 3:HT GF)
-    0x0a, 0x00,  0,  0,  0,      // Initial used item after association
-    0x00, 0x21,  0, 30, 101,
-    0x01, 0x21,  1, 20, 50,
-    0x02, 0x21,  2, 20, 50,
-    0x03, 0x21,  3, 15, 50,
-    0x04, 0x21,  4, 15, 30,
-    0x05, 0x20, 12,  15, 30,
-    0x06, 0x20, 13,  8, 20,
-    0x07, 0x20, 14,  8, 20,
-    0x08, 0x20, 15,  8, 25,
-    0x09, 0x22, 15,  8, 25,
+u8 RateSwitchTable11N3S[] = {
+/* Item No.     Mode    Curr-MCS        TrainUp TrainDown       // Mode- Bit0: STBC, Bit1: Short GI, Bit4,5: Mode(0:CCK, 1:OFDM, 2:HT Mix, 3:HT GF) */
+	0x0b, 0x00, 0, 0, 0,	/* 0x0a, 0x00,  0,  0,  0,      // Initial used item after association */
+	0x00, 0x21, 0, 30, 101,
+	0x01, 0x21, 1, 20, 50,
+	0x02, 0x21, 2, 20, 50,
+	0x03, 0x21, 3, 15, 50,
+	0x04, 0x21, 4, 15, 30,
+	0x05, 0x20, 11, 15, 30,	/* Required by System-Alan @ 20080812 */
+	0x06, 0x20, 12, 15, 30,	/* 0x05, 0x20, 12, 15, 30, */
+	0x07, 0x20, 13, 8, 20,	/* 0x06, 0x20, 13,  8, 20, */
+	0x08, 0x20, 14, 8, 20,	/* 0x07, 0x20, 14,  8, 20, */
+	0x09, 0x20, 15, 8, 25,	/* 0x08, 0x20, 15,  8, 25, */
+	0x0a, 0x22, 15, 8, 25,	/* 0x09, 0x22, 15,  8, 25, */
 };
 
-UCHAR RateSwitchTable11N2SForABand[] = {
-// Item No.   Mode   Curr-MCS   TrainUp   TrainDown		// Mode- Bit0: STBC, Bit1: Short GI, Bit4,5: Mode(0:CCK, 1:OFDM, 2:HT Mix, 3:HT GF)
-    0x0b, 0x09,  0,  0,  0,						// Initial used item after association
-    0x00, 0x21,  0, 30, 101,
-    0x01, 0x21,  1, 20, 50,
-    0x02, 0x21,  2, 20, 50,
-    0x03, 0x21,  3, 15, 50,
-    0x04, 0x21,  4, 15, 30,
-    0x05, 0x21,  5, 15, 30,
-    0x06, 0x20, 12,  15, 30,
-    0x07, 0x20, 13,  8, 20,
-    0x08, 0x20, 14,  8, 20,
-    0x09, 0x20, 15,  8, 25,
-    0x0a, 0x22, 15,  8, 25,
+u8 RateSwitchTable11N2SForABand[] = {
+/* Item No.   Mode   Curr-MCS   TrainUp   TrainDown             // Mode- Bit0: STBC, Bit1: Short GI, Bit4,5: Mode(0:CCK, 1:OFDM, 2:HT Mix, 3:HT GF) */
+	0x0b, 0x09, 0, 0, 0,	/* Initial used item after association */
+	0x00, 0x21, 0, 30, 101,
+	0x01, 0x21, 1, 20, 50,
+	0x02, 0x21, 2, 20, 50,
+	0x03, 0x21, 3, 15, 50,
+	0x04, 0x21, 4, 15, 30,
+	0x05, 0x21, 5, 15, 30,
+	0x06, 0x20, 12, 15, 30,
+	0x07, 0x20, 13, 8, 20,
+	0x08, 0x20, 14, 8, 20,
+	0x09, 0x20, 15, 8, 25,
+	0x0a, 0x22, 15, 8, 25,
 };
 
-UCHAR RateSwitchTable11N3SForABand[] = { // 3*3
-// Item No.   Mode   Curr-MCS   TrainUp   TrainDown		// Mode- Bit0: STBC, Bit1: Short GI, Bit4,5: Mode(0:CCK, 1:OFDM, 2:HT Mix, 3:HT GF)
-    0x0b, 0x09,  0,  0,  0,						// Initial used item after association
-    0x00, 0x21,  0, 30, 101,
-    0x01, 0x21,  1, 20, 50,
-    0x02, 0x21,  2, 20, 50,
-    0x03, 0x21,  3, 15, 50,
-    0x04, 0x21,  4, 15, 30,
-    0x05, 0x21,  5, 15, 30,
-    0x06, 0x20, 12,  15, 30,
-    0x07, 0x20, 13,  8, 20,
-    0x08, 0x20, 14,  8, 20,
-    0x09, 0x20, 15,  8, 25,
-    0x0a, 0x22, 15,  8, 25,
+u8 RateSwitchTable11N3SForABand[] = {	/* 3*3 */
+/* Item No.   Mode   Curr-MCS   TrainUp   TrainDown             // Mode- Bit0: STBC, Bit1: Short GI, Bit4,5: Mode(0:CCK, 1:OFDM, 2:HT Mix, 3:HT GF) */
+	0x0b, 0x09, 0, 0, 0,	/* Initial used item after association */
+	0x00, 0x21, 0, 30, 101,
+	0x01, 0x21, 1, 20, 50,
+	0x02, 0x21, 2, 20, 50,
+	0x03, 0x21, 3, 15, 50,
+	0x04, 0x21, 4, 15, 30,
+	0x05, 0x21, 5, 15, 30,
+	0x06, 0x20, 12, 15, 30,
+	0x07, 0x20, 13, 8, 20,
+	0x08, 0x20, 14, 8, 20,
+	0x09, 0x20, 15, 8, 25,
+	0x0a, 0x22, 15, 8, 25,
 };
 
-UCHAR RateSwitchTable11BGN1S[] = {
-// Item No.   Mode   Curr-MCS   TrainUp   TrainDown		// Mode- Bit0: STBC, Bit1: Short GI, Bit4,5: Mode(0:CCK, 1:OFDM, 2:HT Mix, 3:HT GF)
-    0x0d, 0x00,  0,  0,  0,						// Initial used item after association
-    0x00, 0x00,  0, 40, 101,
-    0x01, 0x00,  1, 40, 50,
-    0x02, 0x00,  2, 35, 45,
-    0x03, 0x00,  3, 20, 45,
-    0x04, 0x21,  0, 30,101,	//50
-    0x05, 0x21,  1, 20, 50,
-    0x06, 0x21,  2, 20, 50,
-    0x07, 0x21,  3, 15, 50,
-    0x08, 0x21,  4, 15, 30,
-    0x09, 0x21,  5, 10, 25,
-    0x0a, 0x21,  6,  8, 14,
-    0x0b, 0x21,  7,  8, 14,
-	0x0c, 0x23,  7,  8, 14,
+u8 RateSwitchTable11BGN1S[] = {
+/* Item No.   Mode   Curr-MCS   TrainUp   TrainDown             // Mode- Bit0: STBC, Bit1: Short GI, Bit4,5: Mode(0:CCK, 1:OFDM, 2:HT Mix, 3:HT GF) */
+	0x0c, 0x0a, 0, 0, 0,	/* Initial used item after association */
+	0x00, 0x00, 0, 40, 101,
+	0x01, 0x00, 1, 40, 50,
+	0x02, 0x00, 2, 25, 45,
+	0x03, 0x21, 0, 20, 35,
+	0x04, 0x21, 1, 20, 35,
+	0x05, 0x21, 2, 20, 35,
+	0x06, 0x21, 3, 15, 35,
+	0x07, 0x21, 4, 15, 30,
+	0x08, 0x21, 5, 10, 25,
+	0x09, 0x21, 6, 8, 14,
+	0x0a, 0x21, 7, 8, 14,
+	0x0b, 0x23, 7, 8, 14,
 };
 
-UCHAR RateSwitchTable11BGN2S[] = {
-// Item No.   Mode   Curr-MCS   TrainUp   TrainDown		// Mode- Bit0: STBC, Bit1: Short GI, Bit4,5: Mode(0:CCK, 1:OFDM, 2:HT Mix, 3:HT GF)
-    0x0a, 0x00,  0,  0,  0,						// Initial used item after association
-    0x00, 0x21,  0, 30,101,	//50
-    0x01, 0x21,  1, 20, 50,
-    0x02, 0x21,  2, 20, 50,
-    0x03, 0x21,  3, 15, 50,
-    0x04, 0x21,  4, 15, 30,
-    0x05, 0x20, 12, 15, 30,
-    0x06, 0x20, 13,  8, 20,
-    0x07, 0x20, 14,  8, 20,
-    0x08, 0x20, 15,  8, 25,
-    0x09, 0x22, 15,  8, 25,
+u8 RateSwitchTable11BGN2S[] = {
+/* Item No.   Mode   Curr-MCS   TrainUp   TrainDown             // Mode- Bit0: STBC, Bit1: Short GI, Bit4,5: Mode(0:CCK, 1:OFDM, 2:HT Mix, 3:HT GF) */
+	0x0e, 0x0c, 0, 0, 0,	/* Initial used item after association */
+	0x00, 0x00, 0, 40, 101,
+	0x01, 0x00, 1, 40, 50,
+	0x02, 0x00, 2, 25, 45,
+	0x03, 0x21, 0, 20, 35,
+	0x04, 0x21, 1, 20, 35,
+	0x05, 0x21, 2, 20, 35,
+	0x06, 0x21, 3, 15, 35,
+	0x07, 0x21, 4, 15, 30,
+	0x08, 0x20, 11, 15, 30,
+	0x09, 0x20, 12, 15, 30,
+	0x0a, 0x20, 13, 8, 20,
+	0x0b, 0x20, 14, 8, 20,
+	0x0c, 0x20, 15, 8, 25,
+	0x0d, 0x22, 15, 8, 15,
 };
 
-UCHAR RateSwitchTable11BGN3S[] = { // 3*3
-// Item No.   Mode   Curr-MCS   TrainUp   TrainDown		// Mode- Bit0: STBC, Bit1: Short GI, Bit4,5: Mode(0:CCK, 1:OFDM, 2:HT Mix, 3:HT GF)
-    0x0a, 0x00,  0,  0,  0,						// Initial used item after association
-    0x00, 0x21,  0, 30,101,	//50
-    0x01, 0x21,  1, 20, 50,
-    0x02, 0x21,  2, 20, 50,
-    0x03, 0x21,  3, 20, 50,
-    0x04, 0x21,  4, 15, 50,
-    0x05, 0x20, 20, 15, 30,
-    0x06, 0x20, 21,  8, 20,
-    0x07, 0x20, 22,  8, 20,
-    0x08, 0x20, 23,  8, 25,
-    0x09, 0x22, 23,  8, 25,
+u8 RateSwitchTable11BGN3S[] = {	/* 3*3 */
+/* Item No.   Mode   Curr-MCS   TrainUp   TrainDown             // Mode- Bit0: STBC, Bit1: Short GI, Bit4,5: Mode(0:CCK, 1:OFDM, 2:HT Mix, 3:HT GF) */
+	0x0a, 0x00, 0, 0, 0,	/* Initial used item after association */
+	0x00, 0x21, 0, 30, 101,	/*50 */
+	0x01, 0x21, 1, 20, 50,
+	0x02, 0x21, 2, 20, 50,
+	0x03, 0x21, 3, 20, 50,
+	0x04, 0x21, 4, 15, 50,
+	0x05, 0x20, 20, 15, 30,
+	0x06, 0x20, 21, 8, 20,
+	0x07, 0x20, 22, 8, 20,
+	0x08, 0x20, 23, 8, 25,
+	0x09, 0x22, 23, 8, 25,
 };
 
-UCHAR RateSwitchTable11BGN2SForABand[] = {
-// Item No.   Mode   Curr-MCS   TrainUp   TrainDown		// Mode- Bit0: STBC, Bit1: Short GI, Bit4,5: Mode(0:CCK, 1:OFDM, 2:HT Mix, 3:HT GF)
-    0x0b, 0x09,  0,  0,  0,						// Initial used item after association
-    0x00, 0x21,  0, 30,101,	//50
-    0x01, 0x21,  1, 20, 50,
-    0x02, 0x21,  2, 20, 50,
-    0x03, 0x21,  3, 15, 50,
-    0x04, 0x21,  4, 15, 30,
-    0x05, 0x21,  5, 15, 30,
-    0x06, 0x20, 12, 15, 30,
-    0x07, 0x20, 13,  8, 20,
-    0x08, 0x20, 14,  8, 20,
-    0x09, 0x20, 15,  8, 25,
-    0x0a, 0x22, 15,  8, 25,
+u8 RateSwitchTable11BGN2SForABand[] = {
+/* Item No.   Mode   Curr-MCS   TrainUp   TrainDown             // Mode- Bit0: STBC, Bit1: Short GI, Bit4,5: Mode(0:CCK, 1:OFDM, 2:HT Mix, 3:HT GF) */
+	0x0b, 0x09, 0, 0, 0,	/* Initial used item after association */
+	0x00, 0x21, 0, 30, 101,	/*50 */
+	0x01, 0x21, 1, 20, 50,
+	0x02, 0x21, 2, 20, 50,
+	0x03, 0x21, 3, 15, 50,
+	0x04, 0x21, 4, 15, 30,
+	0x05, 0x21, 5, 15, 30,
+	0x06, 0x20, 12, 15, 30,
+	0x07, 0x20, 13, 8, 20,
+	0x08, 0x20, 14, 8, 20,
+	0x09, 0x20, 15, 8, 25,
+	0x0a, 0x22, 15, 8, 25,
 };
 
-UCHAR RateSwitchTable11BGN3SForABand[] = { // 3*3
-// Item No.   Mode   Curr-MCS   TrainUp   TrainDown		// Mode- Bit0: STBC, Bit1: Short GI, Bit4,5: Mode(0:CCK, 1:OFDM, 2:HT Mix, 3:HT GF)
-    0x0c, 0x09,  0,  0,  0,						// Initial used item after association
-    0x00, 0x21,  0, 30,101,	//50
-    0x01, 0x21,  1, 20, 50,
-    0x02, 0x21,  2, 20, 50,
-    0x03, 0x21,  3, 15, 50,
-    0x04, 0x21,  4, 15, 30,
-    0x05, 0x21,  5, 15, 30,
-    0x06, 0x21, 12, 15, 30,
-    0x07, 0x20, 20, 15, 30,
-    0x08, 0x20, 21,  8, 20,
-    0x09, 0x20, 22,  8, 20,
-    0x0a, 0x20, 23,  8, 25,
-    0x0b, 0x22, 23,  8, 25,
+u8 RateSwitchTable11BGN3SForABand[] = {	/* 3*3 */
+/* Item No.   Mode   Curr-MCS   TrainUp   TrainDown             // Mode- Bit0: STBC, Bit1: Short GI, Bit4,5: Mode(0:CCK, 1:OFDM, 2:HT Mix, 3:HT GF) */
+	0x0c, 0x09, 0, 0, 0,	/* Initial used item after association */
+	0x00, 0x21, 0, 30, 101,	/*50 */
+	0x01, 0x21, 1, 20, 50,
+	0x02, 0x21, 2, 20, 50,
+	0x03, 0x21, 3, 15, 50,
+	0x04, 0x21, 4, 15, 30,
+	0x05, 0x21, 5, 15, 30,
+	0x06, 0x21, 12, 15, 30,
+	0x07, 0x20, 20, 15, 30,
+	0x08, 0x20, 21, 8, 20,
+	0x09, 0x20, 22, 8, 20,
+	0x0a, 0x20, 23, 8, 25,
+	0x0b, 0x22, 23, 8, 25,
 };
 
-PUCHAR ReasonString[] = {
-	/* 0  */	 "Reserved",
-	/* 1  */	 "Unspecified Reason",
-	/* 2  */	 "Previous Auth no longer valid",
-	/* 3  */	 "STA is leaving / has left",
-	/* 4  */	 "DIS-ASSOC due to inactivity",
-	/* 5  */	 "AP unable to hanle all associations",
-	/* 6  */	 "class 2 error",
-	/* 7  */	 "class 3 error",
-	/* 8  */	 "STA is leaving / has left",
-	/* 9  */	 "require auth before assoc/re-assoc",
-	/* 10 */	 "Reserved",
-	/* 11 */	 "Reserved",
-	/* 12 */	 "Reserved",
-	/* 13 */	 "invalid IE",
-	/* 14 */	 "MIC error",
-	/* 15 */	 "4-way handshake timeout",
-	/* 16 */	 "2-way (group key) handshake timeout",
-	/* 17 */	 "4-way handshake IE diff among AssosReq/Rsp/Beacon",
-	/* 18 */
+extern u8 OfdmRateToRxwiMCS[];
+/* since RT61 has better RX sensibility, we have to limit TX ACK rate not to exceed our normal data TX rate. */
+/* otherwise the WLAN peer may not be able to receive the ACK thus downgrade its data TX rate */
+unsigned long BasicRateMask[12] =
+    { 0xfffff001 /* 1-Mbps */ , 0xfffff003 /* 2 Mbps */ , 0xfffff007 /* 5.5 */ ,
+0xfffff00f /* 11 */ ,
+	0xfffff01f /* 6 */ , 0xfffff03f /* 9 */ , 0xfffff07f /* 12 */ ,
+	    0xfffff0ff /* 18 */ ,
+	0xfffff1ff /* 24 */ , 0xfffff3ff /* 36 */ , 0xfffff7ff /* 48 */ ,
+	    0xffffffff /* 54 */
 };
 
-extern UCHAR	 OfdmRateToRxwiMCS[];
-// since RT61 has better RX sensibility, we have to limit TX ACK rate not to exceed our normal data TX rate.
-// otherwise the WLAN peer may not be able to receive the ACK thus downgrade its data TX rate
-ULONG BasicRateMask[12]				= {0xfffff001 /* 1-Mbps */, 0xfffff003 /* 2 Mbps */, 0xfffff007 /* 5.5 */, 0xfffff00f /* 11 */,
-									  0xfffff01f /* 6 */	 , 0xfffff03f /* 9 */	  , 0xfffff07f /* 12 */ , 0xfffff0ff /* 18 */,
-									  0xfffff1ff /* 24 */	 , 0xfffff3ff /* 36 */	  , 0xfffff7ff /* 48 */ , 0xffffffff /* 54 */};
-
-UCHAR MULTICAST_ADDR[MAC_ADDR_LEN] = {0x1,  0x00, 0x00, 0x00, 0x00, 0x00};
-UCHAR BROADCAST_ADDR[MAC_ADDR_LEN] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
-UCHAR ZERO_MAC_ADDR[MAC_ADDR_LEN]  = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
-
-// e.g. RssiSafeLevelForTxRate[RATE_36]" means if the current RSSI is greater than
-//		this value, then it's quaranteed capable of operating in 36 mbps TX rate in
-//		clean environment.
-//								  TxRate: 1   2   5.5	11	 6	  9    12	18	 24   36   48	54	 72  100
-CHAR RssiSafeLevelForTxRate[] ={  -92, -91, -90, -87, -88, -86, -85, -83, -81, -78, -72, -71, -40, -40 };
-
-UCHAR  RateIdToMbps[]	 = { 1, 2, 5, 11, 6, 9, 12, 18, 24, 36, 48, 54, 72, 100};
-USHORT RateIdTo500Kbps[] = { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108, 144, 200};
-
-UCHAR  SsidIe	 = IE_SSID;
-UCHAR  SupRateIe = IE_SUPP_RATES;
-UCHAR  ExtRateIe = IE_EXT_SUPP_RATES;
-UCHAR  HtCapIe = IE_HT_CAP;
-UCHAR  AddHtInfoIe = IE_ADD_HT;
-UCHAR  NewExtChanIe = IE_SECONDARY_CH_OFFSET;
-UCHAR  ErpIe	 = IE_ERP;
-UCHAR  DsIe 	 = IE_DS_PARM;
-UCHAR  TimIe	 = IE_TIM;
-UCHAR  WpaIe	 = IE_WPA;
-UCHAR  Wpa2Ie	 = IE_WPA2;
-UCHAR  IbssIe	 = IE_IBSS_PARM;
-UCHAR  Ccx2Ie	 = IE_CCX_V2;
-
-extern UCHAR	WPA_OUI[];
-
-UCHAR	SES_OUI[] = {0x00, 0x90, 0x4c};
-
-UCHAR	ZeroSsid[32] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
-	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
-
-// Reset the RFIC setting to new series
-RTMP_RF_REGS RF2850RegTable[] = {
-//		ch	 R1 		 R2 		 R3(TX0~4=0) R4
-		{1,  0x98402ecc, 0x984c0786, 0x9816b455, 0x9800510b},
-		{2,  0x98402ecc, 0x984c0786, 0x98168a55, 0x9800519f},
-		{3,  0x98402ecc, 0x984c078a, 0x98168a55, 0x9800518b},
-		{4,  0x98402ecc, 0x984c078a, 0x98168a55, 0x9800519f},
-		{5,  0x98402ecc, 0x984c078e, 0x98168a55, 0x9800518b},
-		{6,  0x98402ecc, 0x984c078e, 0x98168a55, 0x9800519f},
-		{7,  0x98402ecc, 0x984c0792, 0x98168a55, 0x9800518b},
-		{8,  0x98402ecc, 0x984c0792, 0x98168a55, 0x9800519f},
-		{9,  0x98402ecc, 0x984c0796, 0x98168a55, 0x9800518b},
-		{10, 0x98402ecc, 0x984c0796, 0x98168a55, 0x9800519f},
-		{11, 0x98402ecc, 0x984c079a, 0x98168a55, 0x9800518b},
-		{12, 0x98402ecc, 0x984c079a, 0x98168a55, 0x9800519f},
-		{13, 0x98402ecc, 0x984c079e, 0x98168a55, 0x9800518b},
-		{14, 0x98402ecc, 0x984c07a2, 0x98168a55, 0x98005193},
-
-		// 802.11 UNI / HyperLan 2
-		{36, 0x98402ecc, 0x984c099a, 0x98158a55, 0x980ed1a3},
-		{38, 0x98402ecc, 0x984c099e, 0x98158a55, 0x980ed193},
-		{40, 0x98402ec8, 0x984c0682, 0x98158a55, 0x980ed183},
-		{44, 0x98402ec8, 0x984c0682, 0x98158a55, 0x980ed1a3},
-		{46, 0x98402ec8, 0x984c0686, 0x98158a55, 0x980ed18b},
-		{48, 0x98402ec8, 0x984c0686, 0x98158a55, 0x980ed19b},
-		{52, 0x98402ec8, 0x984c068a, 0x98158a55, 0x980ed193},
-		{54, 0x98402ec8, 0x984c068a, 0x98158a55, 0x980ed1a3},
-		{56, 0x98402ec8, 0x984c068e, 0x98158a55, 0x980ed18b},
-		{60, 0x98402ec8, 0x984c0692, 0x98158a55, 0x980ed183},
-		{62, 0x98402ec8, 0x984c0692, 0x98158a55, 0x980ed193},
-		{64, 0x98402ec8, 0x984c0692, 0x98158a55, 0x980ed1a3}, // Plugfest#4, Day4, change RFR3 left4th 9->5.
-
-		// 802.11 HyperLan 2
-		{100, 0x98402ec8, 0x984c06b2, 0x98178a55, 0x980ed783},
-
-		// 2008.04.30 modified
-		// The system team has AN to improve the EVM value
-		// for channel 102 to 108 for the RT2850/RT2750 dual band solution.
-		{102, 0x98402ec8, 0x985c06b2, 0x98578a55, 0x980ed793},
-		{104, 0x98402ec8, 0x985c06b2, 0x98578a55, 0x980ed1a3},
-		{108, 0x98402ecc, 0x985c0a32, 0x98578a55, 0x980ed193},
-
-		{110, 0x98402ecc, 0x984c0a36, 0x98178a55, 0x980ed183},
-		{112, 0x98402ecc, 0x984c0a36, 0x98178a55, 0x980ed19b},
-		{116, 0x98402ecc, 0x984c0a3a, 0x98178a55, 0x980ed1a3},
-		{118, 0x98402ecc, 0x984c0a3e, 0x98178a55, 0x980ed193},
-		{120, 0x98402ec4, 0x984c0382, 0x98178a55, 0x980ed183},
-		{124, 0x98402ec4, 0x984c0382, 0x98178a55, 0x980ed193},
-		{126, 0x98402ec4, 0x984c0382, 0x98178a55, 0x980ed15b}, // 0x980ed1bb->0x980ed15b required by Rory 20070927
-		{128, 0x98402ec4, 0x984c0382, 0x98178a55, 0x980ed1a3},
-		{132, 0x98402ec4, 0x984c0386, 0x98178a55, 0x980ed18b},
-		{134, 0x98402ec4, 0x984c0386, 0x98178a55, 0x980ed193},
-		{136, 0x98402ec4, 0x984c0386, 0x98178a55, 0x980ed19b},
-		{140, 0x98402ec4, 0x984c038a, 0x98178a55, 0x980ed183},
-
-		// 802.11 UNII
-		{149, 0x98402ec4, 0x984c038a, 0x98178a55, 0x980ed1a7},
-		{151, 0x98402ec4, 0x984c038e, 0x98178a55, 0x980ed187},
-		{153, 0x98402ec4, 0x984c038e, 0x98178a55, 0x980ed18f},
-		{157, 0x98402ec4, 0x984c038e, 0x98178a55, 0x980ed19f},
-		{159, 0x98402ec4, 0x984c038e, 0x98178a55, 0x980ed1a7},
-		{161, 0x98402ec4, 0x984c0392, 0x98178a55, 0x980ed187},
-		{165, 0x98402ec4, 0x984c0392, 0x98178a55, 0x980ed197},
-
-		// Japan
-		{184, 0x95002ccc, 0x9500491e, 0x9509be55, 0x950c0a0b},
-		{188, 0x95002ccc, 0x95004922, 0x9509be55, 0x950c0a13},
-		{192, 0x95002ccc, 0x95004926, 0x9509be55, 0x950c0a1b},
-		{196, 0x95002ccc, 0x9500492a, 0x9509be55, 0x950c0a23},
-		{208, 0x95002ccc, 0x9500493a, 0x9509be55, 0x950c0a13},
-		{212, 0x95002ccc, 0x9500493e, 0x9509be55, 0x950c0a1b},
-		{216, 0x95002ccc, 0x95004982, 0x9509be55, 0x950c0a23},
-
-		// still lack of MMAC(Japan) ch 34,38,42,46
+u8 BROADCAST_ADDR[MAC_ADDR_LEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
+u8 ZERO_MAC_ADDR[MAC_ADDR_LEN] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
+
+/* e.g. RssiSafeLevelForTxRate[RATE_36]" means if the current RSSI is greater than */
+/*              this value, then it's quaranteed capable of operating in 36 mbps TX rate in */
+/*              clean environment. */
+/*                                                                TxRate: 1   2   5.5   11       6        9    12       18       24   36   48   54       72  100 */
+char RssiSafeLevelForTxRate[] =
+    { -92, -91, -90, -87, -88, -86, -85, -83, -81, -78, -72, -71, -40, -40 };
+
+u8 RateIdToMbps[] = { 1, 2, 5, 11, 6, 9, 12, 18, 24, 36, 48, 54, 72, 100 };
+u16 RateIdTo500Kbps[] =
+    { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108, 144, 200 };
+
+u8 SsidIe = IE_SSID;
+u8 SupRateIe = IE_SUPP_RATES;
+u8 ExtRateIe = IE_EXT_SUPP_RATES;
+u8 HtCapIe = IE_HT_CAP;
+u8 AddHtInfoIe = IE_ADD_HT;
+u8 NewExtChanIe = IE_SECONDARY_CH_OFFSET;
+u8 ErpIe = IE_ERP;
+u8 DsIe = IE_DS_PARM;
+u8 TimIe = IE_TIM;
+u8 WpaIe = IE_WPA;
+u8 Wpa2Ie = IE_WPA2;
+u8 IbssIe = IE_IBSS_PARM;
+
+extern u8 WPA_OUI[];
+
+u8 SES_OUI[] = { 0x00, 0x90, 0x4c };
+
+u8 ZeroSsid[32] =
+    { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	    0x00, 0x00, 0x00, 0x00
 };
-UCHAR	NUM_OF_2850_CHNL = (sizeof(RF2850RegTable) / sizeof(RTMP_RF_REGS));
-
-FREQUENCY_ITEM FreqItems3020[] =
-{
-	/**************************************************/
-	// ISM : 2.4 to 2.483 GHz                         //
-	/**************************************************/
-	// 11g
-	/**************************************************/
-	//-CH---N-------R---K-----------
-	{1,    241,  2,  2},
-	{2,    241,	 2,  7},
-	{3,    242,	 2,  2},
-	{4,    242,	 2,  7},
-	{5,    243,	 2,  2},
-	{6,    243,	 2,  7},
-	{7,    244,	 2,  2},
-	{8,    244,	 2,  7},
-	{9,    245,	 2,  2},
-	{10,   245,	 2,  7},
-	{11,   246,	 2,  2},
-	{12,   246,	 2,  7},
-	{13,   247,	 2,  2},
-	{14,   248,	 2,  4},
-};
-UCHAR	NUM_OF_3020_CHNL=(sizeof(FreqItems3020) / sizeof(FREQUENCY_ITEM));
 
 /*
 	==========================================================================
@@ -460,17 +356,15 @@ UCHAR	NUM_OF_3020_CHNL=(sizeof(FreqItems3020) / sizeof(FREQUENCY_ITEM));
 
 	==========================================================================
 */
-NDIS_STATUS MlmeInit(
-	IN PRTMP_ADAPTER pAd)
+int MlmeInit(struct rt_rtmp_adapter *pAd)
 {
-	NDIS_STATUS Status = NDIS_STATUS_SUCCESS;
+	int Status = NDIS_STATUS_SUCCESS;
 
 	DBGPRINT(RT_DEBUG_TRACE, ("--> MLME Initialize\n"));
 
-	do
-	{
+	do {
 		Status = MlmeQueueInit(&pAd->Mlme.Queue);
-		if(Status != NDIS_STATUS_SUCCESS)
+		if (Status != NDIS_STATUS_SUCCESS)
 			break;
 
 		pAd->Mlme.bRunning = FALSE;
@@ -479,40 +373,65 @@ NDIS_STATUS MlmeInit(
 		{
 			BssTableInit(&pAd->ScanTab);
 
-			// init STA state machines
-			AssocStateMachineInit(pAd, &pAd->Mlme.AssocMachine, pAd->Mlme.AssocFunc);
-			AuthStateMachineInit(pAd, &pAd->Mlme.AuthMachine, pAd->Mlme.AuthFunc);
-			AuthRspStateMachineInit(pAd, &pAd->Mlme.AuthRspMachine, pAd->Mlme.AuthRspFunc);
-			SyncStateMachineInit(pAd, &pAd->Mlme.SyncMachine, pAd->Mlme.SyncFunc);
-			WpaPskStateMachineInit(pAd, &pAd->Mlme.WpaPskMachine, pAd->Mlme.WpaPskFunc);
-			AironetStateMachineInit(pAd, &pAd->Mlme.AironetMachine, pAd->Mlme.AironetFunc);
-
-			// Since we are using switch/case to implement it, the init is different from the above
-			// state machine init
+			/* init STA state machines */
+			AssocStateMachineInit(pAd, &pAd->Mlme.AssocMachine,
+					      pAd->Mlme.AssocFunc);
+			AuthStateMachineInit(pAd, &pAd->Mlme.AuthMachine,
+					     pAd->Mlme.AuthFunc);
+			AuthRspStateMachineInit(pAd, &pAd->Mlme.AuthRspMachine,
+						pAd->Mlme.AuthRspFunc);
+			SyncStateMachineInit(pAd, &pAd->Mlme.SyncMachine,
+					     pAd->Mlme.SyncFunc);
+
+			/* Since we are using switch/case to implement it, the init is different from the above */
+			/* state machine init */
 			MlmeCntlInit(pAd, &pAd->Mlme.CntlMachine, NULL);
 		}
 
-		ActionStateMachineInit(pAd, &pAd->Mlme.ActMachine, pAd->Mlme.ActFunc);
+		WpaStateMachineInit(pAd, &pAd->Mlme.WpaMachine,
+				    pAd->Mlme.WpaFunc);
 
-		// Init mlme periodic timer
-		RTMPInitTimer(pAd, &pAd->Mlme.PeriodicTimer, GET_TIMER_FUNCTION(MlmePeriodicExec), pAd, TRUE);
+		ActionStateMachineInit(pAd, &pAd->Mlme.ActMachine,
+				       pAd->Mlme.ActFunc);
 
-		// Set mlme periodic timer
+		/* Init mlme periodic timer */
+		RTMPInitTimer(pAd, &pAd->Mlme.PeriodicTimer,
+			      GET_TIMER_FUNCTION(MlmePeriodicExec), pAd, TRUE);
+
+		/* Set mlme periodic timer */
 		RTMPSetTimer(&pAd->Mlme.PeriodicTimer, MLME_TASK_EXEC_INTV);
 
-		// software-based RX Antenna diversity
-		RTMPInitTimer(pAd, &pAd->Mlme.RxAntEvalTimer, GET_TIMER_FUNCTION(AsicRxAntEvalTimeout), pAd, FALSE);
+		/* software-based RX Antenna diversity */
+		RTMPInitTimer(pAd, &pAd->Mlme.RxAntEvalTimer,
+			      GET_TIMER_FUNCTION(AsicRxAntEvalTimeout), pAd,
+			      FALSE);
+
+		{
+#ifdef RTMP_PCI_SUPPORT
+			if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE)) {
+				/* only PCIe cards need these two timers */
+				RTMPInitTimer(pAd, &pAd->Mlme.PsPollTimer,
+					      GET_TIMER_FUNCTION
+					      (PsPollWakeExec), pAd, FALSE);
+				RTMPInitTimer(pAd, &pAd->Mlme.RadioOnOffTimer,
+					      GET_TIMER_FUNCTION(RadioOnExec),
+					      pAd, FALSE);
+			}
+#endif /* RTMP_PCI_SUPPORT // */
+
+			RTMPInitTimer(pAd, &pAd->Mlme.LinkDownTimer,
+				      GET_TIMER_FUNCTION(LinkDownExec), pAd,
+				      FALSE);
 
-#ifdef RT2860
-		{
-	        if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_ADVANCE_POWER_SAVE_PCIE_DEVICE))
-	        {
-	            // only PCIe cards need these two timers
-	    		RTMPInitTimer(pAd, &pAd->Mlme.PsPollTimer, GET_TIMER_FUNCTION(PsPollWakeExec), pAd, FALSE);
-	    		RTMPInitTimer(pAd, &pAd->Mlme.RadioOnOffTimer, GET_TIMER_FUNCTION(RadioOnExec), pAd, FALSE);
-	        }
+#ifdef RTMP_MAC_USB
+			RTMPInitTimer(pAd, &pAd->Mlme.AutoWakeupTimer,
+				      GET_TIMER_FUNCTION
+				      (RtmpUsbStaAsicForceWakeupTimeout), pAd,
+				      FALSE);
+			pAd->Mlme.AutoWakeupTimerRunning = FALSE;
+#endif /* RTMP_MAC_USB // */
 		}
-#endif
+
 	} while (FALSE);
 
 	DBGPRINT(RT_DEBUG_TRACE, ("<-- MLME Initialize\n"));
@@ -534,93 +453,102 @@ NDIS_STATUS MlmeInit(
 
 	==========================================================================
  */
-VOID MlmeHandler(
-	IN PRTMP_ADAPTER pAd)
+void MlmeHandler(struct rt_rtmp_adapter *pAd)
 {
-	MLME_QUEUE_ELEM 	   *Elem = NULL;
+	struct rt_mlme_queue_elem *Elem = NULL;
 
-	// Only accept MLME and Frame from peer side, no other (control/data) frame should
-	// get into this state machine
+	/* Only accept MLME and Frame from peer side, no other (control/data) frame should */
+	/* get into this state machine */
 
 	NdisAcquireSpinLock(&pAd->Mlme.TaskLock);
-	if(pAd->Mlme.bRunning)
-	{
+	if (pAd->Mlme.bRunning) {
 		NdisReleaseSpinLock(&pAd->Mlme.TaskLock);
 		return;
-	}
-	else
-	{
+	} else {
 		pAd->Mlme.bRunning = TRUE;
 	}
 	NdisReleaseSpinLock(&pAd->Mlme.TaskLock);
 
-	while (!MlmeQueueEmpty(&pAd->Mlme.Queue))
-	{
+	while (!MlmeQueueEmpty(&pAd->Mlme.Queue)) {
 		if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_MLME_RESET_IN_PROGRESS) ||
-			RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS) ||
-			RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST))
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("Device Halted or Removed or MlmeRest, exit MlmeHandler! (queue num = %ld)\n", pAd->Mlme.Queue.Num));
+		    RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS) ||
+		    RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)) {
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("Device Halted or Removed or MlmeRest, exit MlmeHandler! (queue num = %ld)\n",
+				  pAd->Mlme.Queue.Num));
 			break;
 		}
-
-		//From message type, determine which state machine I should drive
-		if (MlmeDequeue(&pAd->Mlme.Queue, &Elem))
-		{
-#ifdef RT2870
-			if (Elem->MsgType == MT2_RESET_CONF)
-			{
-				DBGPRINT_RAW(RT_DEBUG_TRACE, ("!!! reset MLME state machine !!!\n"));
+		/*From message type, determine which state machine I should drive */
+		if (MlmeDequeue(&pAd->Mlme.Queue, &Elem)) {
+#ifdef RTMP_MAC_USB
+			if (Elem->MsgType == MT2_RESET_CONF) {
+				DBGPRINT_RAW(RT_DEBUG_TRACE,
+					     ("reset MLME state machine!\n"));
 				MlmeRestartStateMachine(pAd);
 				Elem->Occupied = FALSE;
 				Elem->MsgLen = 0;
 				continue;
 			}
-#endif // RT2870 //
-
-			// if dequeue success
-			switch (Elem->Machine)
-			{
-				// STA state machines
-				case ASSOC_STATE_MACHINE:
-					StateMachinePerformAction(pAd, &pAd->Mlme.AssocMachine, Elem);
-					break;
-				case AUTH_STATE_MACHINE:
-					StateMachinePerformAction(pAd, &pAd->Mlme.AuthMachine, Elem);
-					break;
-				case AUTH_RSP_STATE_MACHINE:
-					StateMachinePerformAction(pAd, &pAd->Mlme.AuthRspMachine, Elem);
-					break;
-				case SYNC_STATE_MACHINE:
-					StateMachinePerformAction(pAd, &pAd->Mlme.SyncMachine, Elem);
-					break;
-				case MLME_CNTL_STATE_MACHINE:
-					MlmeCntlMachinePerformAction(pAd, &pAd->Mlme.CntlMachine, Elem);
-					break;
-				case WPA_PSK_STATE_MACHINE:
-					StateMachinePerformAction(pAd, &pAd->Mlme.WpaPskMachine, Elem);
-					break;
-				case AIRONET_STATE_MACHINE:
-					StateMachinePerformAction(pAd, &pAd->Mlme.AironetMachine, Elem);
-					break;
-				case ACTION_STATE_MACHINE:
-					StateMachinePerformAction(pAd, &pAd->Mlme.ActMachine, Elem);
-					break;
-
+#endif /* RTMP_MAC_USB // */
+
+			/* if dequeue success */
+			switch (Elem->Machine) {
+				/* STA state machines */
+			case ASSOC_STATE_MACHINE:
+				StateMachinePerformAction(pAd,
+							  &pAd->Mlme.
+							  AssocMachine, Elem);
+				break;
+			case AUTH_STATE_MACHINE:
+				StateMachinePerformAction(pAd,
+							  &pAd->Mlme.
+							  AuthMachine, Elem);
+				break;
+			case AUTH_RSP_STATE_MACHINE:
+				StateMachinePerformAction(pAd,
+							  &pAd->Mlme.
+							  AuthRspMachine, Elem);
+				break;
+			case SYNC_STATE_MACHINE:
+				StateMachinePerformAction(pAd,
+							  &pAd->Mlme.
+							  SyncMachine, Elem);
+				break;
+			case MLME_CNTL_STATE_MACHINE:
+				MlmeCntlMachinePerformAction(pAd,
+							     &pAd->Mlme.
+							     CntlMachine, Elem);
+				break;
+			case WPA_PSK_STATE_MACHINE:
+				StateMachinePerformAction(pAd,
+							  &pAd->Mlme.
+							  WpaPskMachine, Elem);
+				break;
 
+			case ACTION_STATE_MACHINE:
+				StateMachinePerformAction(pAd,
+							  &pAd->Mlme.ActMachine,
+							  Elem);
+				break;
 
+			case WPA_STATE_MACHINE:
+				StateMachinePerformAction(pAd,
+							  &pAd->Mlme.WpaMachine,
+							  Elem);
+				break;
 
-				default:
-					DBGPRINT(RT_DEBUG_TRACE, ("ERROR: Illegal machine %ld in MlmeHandler()\n", Elem->Machine));
-					break;
-			} // end of switch
+			default:
+				DBGPRINT(RT_DEBUG_TRACE,
+					 ("ERROR: Illegal machine %ld in MlmeHandler()\n",
+					  Elem->Machine));
+				break;
+			}	/* end of switch */
 
-			// free MLME element
+			/* free MLME element */
 			Elem->Occupied = FALSE;
 			Elem->MsgLen = 0;
 
-		}
-		else {
+		} else {
 			DBGPRINT_ERR(("MlmeHandler: MlmeQueue empty\n"));
 		}
 	}
@@ -643,73 +571,67 @@ VOID MlmeHandler(
 
 	==========================================================================
  */
-VOID MlmeHalt(
-	IN PRTMP_ADAPTER pAd)
+void MlmeHalt(struct rt_rtmp_adapter *pAd)
 {
-	BOOLEAN 	  Cancelled;
-#ifdef RT3070
-	UINT32		TxPinCfg = 0x00050F0F;
-#endif // RT3070 //
+	BOOLEAN Cancelled;
 
 	DBGPRINT(RT_DEBUG_TRACE, ("==> MlmeHalt\n"));
 
-	if (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST))
-	{
-		// disable BEACON generation and other BEACON related hardware timers
+	if (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)) {
+		/* disable BEACON generation and other BEACON related hardware timers */
 		AsicDisableSync(pAd);
 	}
 
 	{
-		// Cancel pending timers
-		RTMPCancelTimer(&pAd->MlmeAux.AssocTimer,		&Cancelled);
-		RTMPCancelTimer(&pAd->MlmeAux.ReassocTimer,		&Cancelled);
-		RTMPCancelTimer(&pAd->MlmeAux.DisassocTimer,	&Cancelled);
-		RTMPCancelTimer(&pAd->MlmeAux.AuthTimer,		&Cancelled);
-		RTMPCancelTimer(&pAd->MlmeAux.BeaconTimer,		&Cancelled);
-		RTMPCancelTimer(&pAd->MlmeAux.ScanTimer,		&Cancelled);
-#ifdef RT2860
-	    if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_ADVANCE_POWER_SAVE_PCIE_DEVICE))
-	    {
-	   	    RTMPCancelTimer(&pAd->Mlme.PsPollTimer,		&Cancelled);
-		    RTMPCancelTimer(&pAd->Mlme.RadioOnOffTimer,		&Cancelled);
+		/* Cancel pending timers */
+		RTMPCancelTimer(&pAd->MlmeAux.AssocTimer, &Cancelled);
+		RTMPCancelTimer(&pAd->MlmeAux.ReassocTimer, &Cancelled);
+		RTMPCancelTimer(&pAd->MlmeAux.DisassocTimer, &Cancelled);
+		RTMPCancelTimer(&pAd->MlmeAux.AuthTimer, &Cancelled);
+		RTMPCancelTimer(&pAd->MlmeAux.BeaconTimer, &Cancelled);
+		RTMPCancelTimer(&pAd->MlmeAux.ScanTimer, &Cancelled);
+
+#ifdef RTMP_MAC_PCI
+		if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE)
+		    && (pAd->StaCfg.PSControl.field.EnableNewPS == TRUE)) {
+			RTMPCancelTimer(&pAd->Mlme.PsPollTimer, &Cancelled);
+			RTMPCancelTimer(&pAd->Mlme.RadioOnOffTimer, &Cancelled);
 		}
-#endif
-	}
+#endif /* RTMP_MAC_PCI // */
 
-	RTMPCancelTimer(&pAd->Mlme.PeriodicTimer,		&Cancelled);
-	RTMPCancelTimer(&pAd->Mlme.RxAntEvalTimer,		&Cancelled);
+		RTMPCancelTimer(&pAd->Mlme.LinkDownTimer, &Cancelled);
 
+#ifdef RTMP_MAC_USB
+		RTMPCancelTimer(&pAd->Mlme.AutoWakeupTimer, &Cancelled);
+#endif /* RTMP_MAC_USB // */
+	}
 
+	RTMPCancelTimer(&pAd->Mlme.PeriodicTimer, &Cancelled);
+	RTMPCancelTimer(&pAd->Mlme.RxAntEvalTimer, &Cancelled);
 
-	if (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST))
-	{
-		// Set LED
+	if (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)) {
+		struct rt_rtmp_chip_op *pChipOps = &pAd->chipOps;
+
+		/* Set LED */
 		RTMPSetLED(pAd, LED_HALT);
-        RTMPSetSignalLED(pAd, -100);	// Force signal strength Led to be turned off, firmware is not done it.
-#ifdef RT2870
-        {
-            LED_CFG_STRUC LedCfg;
-            RTMP_IO_READ32(pAd, LED_CFG, &LedCfg.word);
-            LedCfg.field.LedPolar = 0;
-            LedCfg.field.RLedMode = 0;
-            LedCfg.field.GLedMode = 0;
-            LedCfg.field.YLedMode = 0;
-            RTMP_IO_WRITE32(pAd, LED_CFG, LedCfg.word);
-        }
-#endif // RT2870 //
-#ifdef RT3070
-		//
-		// Turn off LNA_PE
-		//
-		if (IS_RT3070(pAd) || IS_RT3071(pAd))
+		RTMPSetSignalLED(pAd, -100);	/* Force signal strength Led to be turned off, firmware is not done it. */
+#ifdef RTMP_MAC_USB
 		{
-			TxPinCfg &= 0xFFFFF0F0;
-			RTUSBWriteMACRegister(pAd, TX_PIN_CFG, TxPinCfg);
+			LED_CFG_STRUC LedCfg;
+			RTMP_IO_READ32(pAd, LED_CFG, &LedCfg.word);
+			LedCfg.field.LedPolar = 0;
+			LedCfg.field.RLedMode = 0;
+			LedCfg.field.GLedMode = 0;
+			LedCfg.field.YLedMode = 0;
+			RTMP_IO_WRITE32(pAd, LED_CFG, LedCfg.word);
 		}
-#endif // RT3070 //
+#endif /* RTMP_MAC_USB // */
+
+		if (pChipOps->AsicHaltAction)
+			pChipOps->AsicHaltAction(pAd);
 	}
 
-	RTMPusecDelay(5000);    //  5 msec to gurantee Ant Diversity timer canceled
+	RTMPusecDelay(5000);	/*  5 msec to gurantee Ant Diversity timer canceled */
 
 	MlmeQueueDestroy(&pAd->Mlme.Queue);
 	NdisFreeSpinLock(&pAd->Mlme.TaskLock);
@@ -717,11 +639,11 @@ VOID MlmeHalt(
 	DBGPRINT(RT_DEBUG_TRACE, ("<== MlmeHalt\n"));
 }
 
-VOID MlmeResetRalinkCounters(
-	IN  PRTMP_ADAPTER   pAd)
+void MlmeResetRalinkCounters(struct rt_rtmp_adapter *pAd)
 {
-	pAd->RalinkCounters.LastOneSecRxOkDataCnt = pAd->RalinkCounters.OneSecRxOkDataCnt;
-	// clear all OneSecxxx counters.
+	pAd->RalinkCounters.LastOneSecRxOkDataCnt =
+	    pAd->RalinkCounters.OneSecRxOkDataCnt;
+	/* clear all OneSecxxx counters. */
 	pAd->RalinkCounters.OneSecBeaconSentCnt = 0;
 	pAd->RalinkCounters.OneSecFalseCCACnt = 0;
 	pAd->RalinkCounters.OneSecRxFcsErrCnt = 0;
@@ -730,8 +652,10 @@ VOID MlmeResetRalinkCounters(
 	pAd->RalinkCounters.OneSecTxNoRetryOkCount = 0;
 	pAd->RalinkCounters.OneSecTxRetryOkCount = 0;
 	pAd->RalinkCounters.OneSecRxOkDataCnt = 0;
+	pAd->RalinkCounters.OneSecReceivedByteCount = 0;
+	pAd->RalinkCounters.OneSecTransmittedByteCount = 0;
 
-	// TODO: for debug only. to be removed
+	/* TODO: for debug only. to be removed */
 	pAd->RalinkCounters.OneSecOsTxCount[QID_AC_BE] = 0;
 	pAd->RalinkCounters.OneSecOsTxCount[QID_AC_BK] = 0;
 	pAd->RalinkCounters.OneSecOsTxCount[QID_AC_VI] = 0;
@@ -748,9 +672,6 @@ VOID MlmeResetRalinkCounters(
 	return;
 }
 
-unsigned long rx_AMSDU;
-unsigned long rx_Total;
-
 /*
 	==========================================================================
 	Description:
@@ -767,229 +688,188 @@ unsigned long rx_Total;
 
 	==========================================================================
  */
-#define ADHOC_BEACON_LOST_TIME		(8*OS_HZ)  // 8 sec
-VOID MlmePeriodicExec(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3)
+#define ADHOC_BEACON_LOST_TIME		(8*OS_HZ)	/* 8 sec */
+void MlmePeriodicExec(void *SystemSpecific1,
+		      void *FunctionContext,
+		      void *SystemSpecific2, void *SystemSpecific3)
 {
-	ULONG			TxTotalCnt;
-	PRTMP_ADAPTER	pAd = (RTMP_ADAPTER *)FunctionContext;
-
-#ifdef RT2860
-	//Baron 2008/07/10
-	//printk("Baron_Test:\t%s", RTMPGetRalinkEncryModeStr(pAd->StaCfg.WepStatus));
-	//If the STA security setting is OPEN or WEP, pAd->StaCfg.WpaSupplicantUP = 0.
-	//If the STA security setting is WPAPSK or WPA2PSK, pAd->StaCfg.WpaSupplicantUP = 1.
-	if(pAd->StaCfg.WepStatus<2)
-	{
-		pAd->StaCfg.WpaSupplicantUP = 0;
-	}
-	else
-	{
-		pAd->StaCfg.WpaSupplicantUP = 1;
-	}
-
-	{
-	    // If Hardware controlled Radio enabled, we have to check GPIO pin2 every 2 second.
-		// Move code to here, because following code will return when radio is off
-		if ((pAd->Mlme.PeriodicRound % (MLME_TASK_EXEC_MULTIPLE * 2) == 0) &&
-			(pAd->StaCfg.bHardwareRadio == TRUE) &&
-			(RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_START_UP)) &&
-			(!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)) &&
-			(!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS)))
-		{
-			UINT32				data = 0;
-
-			// Read GPIO pin2 as Hardware controlled radio state
-			RTMP_IO_FORCE_READ32(pAd, GPIO_CTRL_CFG, &data);
-			if (data & 0x04)
-			{
+	unsigned long TxTotalCnt;
+	struct rt_rtmp_adapter *pAd = (struct rt_rtmp_adapter *)FunctionContext;
+
+#ifdef RTMP_MAC_PCI
+	{
+		/* If Hardware controlled Radio enabled, we have to check GPIO pin2 every 2 second. */
+		/* Move code to here, because following code will return when radio is off */
+		if ((pAd->Mlme.PeriodicRound % (MLME_TASK_EXEC_MULTIPLE * 2) ==
+		     0) && (pAd->StaCfg.bHardwareRadio == TRUE)
+		    && (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST))
+		    && (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS))
+		    /*&&(pAd->bPCIclkOff == FALSE) */
+		    ) {
+			u32 data = 0;
+
+			/* Read GPIO pin2 as Hardware controlled radio state */
+#ifndef RT3090
+			RTMP_IO_READ32(pAd, GPIO_CTRL_CFG, &data);
+#endif /* RT3090 // */
+/*KH(PCIE PS):Added based on Jane<-- */
+#ifdef RT3090
+/* Read GPIO pin2 as Hardware controlled radio state */
+/* We need to Read GPIO if HW said so no mater what advance power saving */
+			if ((pAd->OpMode == OPMODE_STA) && (IDLE_ON(pAd))
+			    &&
+			    (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_IDLE_RADIO_OFF))
+			    && (pAd->StaCfg.PSControl.field.EnablePSinIdle ==
+				TRUE)) {
+				/* Want to make sure device goes to L0 state before reading register. */
+				RTMPPCIeLinkCtrlValueRestore(pAd, 0);
+				RTMP_IO_FORCE_READ32(pAd, GPIO_CTRL_CFG, &data);
+				RTMPPCIeLinkCtrlSetting(pAd, 3);
+			} else
+				RTMP_IO_FORCE_READ32(pAd, GPIO_CTRL_CFG, &data);
+#endif /* RT3090 // */
+/*KH(PCIE PS):Added based on Jane--> */
+
+			if (data & 0x04) {
 				pAd->StaCfg.bHwRadio = TRUE;
-			}
-			else
-			{
+			} else {
 				pAd->StaCfg.bHwRadio = FALSE;
 			}
-			if (pAd->StaCfg.bRadio != (pAd->StaCfg.bHwRadio && pAd->StaCfg.bSwRadio))
-			{
-				pAd->StaCfg.bRadio = (pAd->StaCfg.bHwRadio && pAd->StaCfg.bSwRadio);
-				if (pAd->StaCfg.bRadio == TRUE)
-				{
+			if (pAd->StaCfg.bRadio !=
+			    (pAd->StaCfg.bHwRadio && pAd->StaCfg.bSwRadio)) {
+				pAd->StaCfg.bRadio = (pAd->StaCfg.bHwRadio
+						      && pAd->StaCfg.bSwRadio);
+				if (pAd->StaCfg.bRadio == TRUE) {
 					MlmeRadioOn(pAd);
-					// Update extra information
+					/* Update extra information */
 					pAd->ExtraInfo = EXTRA_INFO_CLEAR;
-				}
-				else
-				{
+				} else {
 					MlmeRadioOff(pAd);
-					// Update extra information
+					/* Update extra information */
 					pAd->ExtraInfo = HW_RADIO_OFF;
 				}
 			}
 		}
 	}
-#endif /* RT2860 */
+#endif /* RTMP_MAC_PCI // */
 
-	// Do nothing if the driver is starting halt state.
-	// This might happen when timer already been fired before cancel timer with mlmehalt
+	/* Do nothing if the driver is starting halt state. */
+	/* This might happen when timer already been fired before cancel timer with mlmehalt */
 	if ((RTMP_TEST_FLAG(pAd, (fRTMP_ADAPTER_HALT_IN_PROGRESS |
-								fRTMP_ADAPTER_RADIO_OFF |
-								fRTMP_ADAPTER_RADIO_MEASUREMENT |
-								fRTMP_ADAPTER_RESET_IN_PROGRESS))))
+				  fRTMP_ADAPTER_RADIO_OFF |
+				  fRTMP_ADAPTER_RADIO_MEASUREMENT |
+				  fRTMP_ADAPTER_RESET_IN_PROGRESS))))
 		return;
 
-#ifdef RT2860
-	{
-		if ((pAd->RalinkCounters.LastReceivedByteCount == pAd->RalinkCounters.ReceivedByteCount) && (pAd->StaCfg.bRadio == TRUE))
-		{
-			// If ReceiveByteCount doesn't change,  increase SameRxByteCount by 1.
-			pAd->SameRxByteCount++;
-		}
-		else
-			pAd->SameRxByteCount = 0;
-
-		// If after BBP, still not work...need to check to reset PBF&MAC.
-		if (pAd->SameRxByteCount == 702)
-		{
-			pAd->SameRxByteCount = 0;
-			AsicResetPBF(pAd);
-			AsicResetMAC(pAd);
-		}
-
-		// If SameRxByteCount keeps happens for 2 second in infra mode, or for 60 seconds in idle mode.
-		if (((INFRA_ON(pAd)) && (pAd->SameRxByteCount > 20)) || ((IDLE_ON(pAd)) && (pAd->SameRxByteCount > 600)))
-		{
-			if ((pAd->StaCfg.bRadio == TRUE) && (pAd->SameRxByteCount < 700))
-			{
-				DBGPRINT(RT_DEBUG_TRACE, ("--->  SameRxByteCount = %lu !!!!!!!!!!!!!!! \n", pAd->SameRxByteCount));
-				pAd->SameRxByteCount = 700;
-				AsicResetBBP(pAd);
-			}
-		}
-
-		// Update lastReceiveByteCount.
-		pAd->RalinkCounters.LastReceivedByteCount = pAd->RalinkCounters.ReceivedByteCount;
-
-		if ((pAd->CheckDmaBusyCount > 3) && (IDLE_ON(pAd)))
-		{
-			pAd->CheckDmaBusyCount = 0;
-			AsicResetFromDMABusy(pAd);
-		}
-	}
-#endif /* RT2860 */
-	RT28XX_MLME_PRE_SANITY_CHECK(pAd);
+	RTMP_MLME_PRE_SANITY_CHECK(pAd);
 
 	{
-		// Do nothing if monitor mode is on
+		/* Do nothing if monitor mode is on */
 		if (MONITOR_ON(pAd))
 			return;
 
-		if (pAd->Mlme.PeriodicRound & 0x1)
-		{
-			// This is the fix for wifi 11n extension channel overlapping test case.  for 2860D
+		if (pAd->Mlme.PeriodicRound & 0x1) {
+			/* This is the fix for wifi 11n extension channel overlapping test case.  for 2860D */
 			if (((pAd->MACVersion & 0xffff) == 0x0101) &&
-				(STA_TGN_WIFI_ON(pAd)) &&
-				(pAd->CommonCfg.IOTestParm.bToggle == FALSE))
-
-				{
-					RTMP_IO_WRITE32(pAd, TXOP_CTRL_CFG, 0x24Bf);
-					pAd->CommonCfg.IOTestParm.bToggle = TRUE;
-				}
-				else if ((STA_TGN_WIFI_ON(pAd)) &&
-						((pAd->MACVersion & 0xffff) == 0x0101))
-				{
-					RTMP_IO_WRITE32(pAd, TXOP_CTRL_CFG, 0x243f);
-					pAd->CommonCfg.IOTestParm.bToggle = FALSE;
-				}
+			    (STA_TGN_WIFI_ON(pAd)) &&
+			    (pAd->CommonCfg.IOTestParm.bToggle == FALSE))
+			{
+				RTMP_IO_WRITE32(pAd, TXOP_CTRL_CFG, 0x24Bf);
+				pAd->CommonCfg.IOTestParm.bToggle = TRUE;
+			} else if ((STA_TGN_WIFI_ON(pAd)) &&
+				   ((pAd->MACVersion & 0xffff) == 0x0101)) {
+				RTMP_IO_WRITE32(pAd, TXOP_CTRL_CFG, 0x243f);
+				pAd->CommonCfg.IOTestParm.bToggle = FALSE;
+			}
 		}
 	}
 
 	pAd->bUpdateBcnCntDone = FALSE;
 
-//	RECBATimerTimeout(SystemSpecific1,FunctionContext,SystemSpecific2,SystemSpecific3);
-	pAd->Mlme.PeriodicRound ++;
+/*      RECBATimerTimeout(SystemSpecific1,FunctionContext,SystemSpecific2,SystemSpecific3); */
+	pAd->Mlme.PeriodicRound++;
 
-#ifdef RT3070
-	// execute every 100ms, update the Tx FIFO Cnt for update Tx Rate.
+#ifdef RTMP_MAC_USB
+	/* execute every 100ms, update the Tx FIFO Cnt for update Tx Rate. */
 	NICUpdateFifoStaCounters(pAd);
-#endif // RT3070 //
-	// execute every 500ms
-	if ((pAd->Mlme.PeriodicRound % 5 == 0) && RTMPAutoRateSwitchCheck(pAd)/*(OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_TX_RATE_SWITCH_ENABLED))*/)
+#endif /* RTMP_MAC_USB // */
+
+	/* execute every 500ms */
+	if ((pAd->Mlme.PeriodicRound % 5 == 0)
+	    && RTMPAutoRateSwitchCheck(pAd)
+	    /*(OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_TX_RATE_SWITCH_ENABLED)) */ )
 	{
-		// perform dynamic tx rate switching based on past TX history
+		/* perform dynamic tx rate switching based on past TX history */
 		{
-			if ((OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED)
-					)
-				&& (!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE)))
+			if ((OPSTATUS_TEST_FLAG
+			     (pAd, fOP_STATUS_MEDIA_STATE_CONNECTED)
+			    )
+			    && (!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE)))
 				MlmeDynamicTxRateSwitching(pAd);
 		}
 	}
+	/* Normal 1 second Mlme PeriodicExec. */
+	if (pAd->Mlme.PeriodicRound % MLME_TASK_EXEC_MULTIPLE == 0) {
+		pAd->Mlme.OneSecPeriodicRound++;
 
-	// Normal 1 second Mlme PeriodicExec.
-	if (pAd->Mlme.PeriodicRound %MLME_TASK_EXEC_MULTIPLE == 0)
-	{
-                pAd->Mlme.OneSecPeriodicRound ++;
-
-		if (rx_Total)
-		{
+		/*ORIBATimerTimeout(pAd); */
 
-			// reset counters
-			rx_AMSDU = 0;
-			rx_Total = 0;
-		}
-
-		// Media status changed, report to NDIS
-		if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_MEDIA_STATE_CHANGE))
-		{
+		/* Media status changed, report to NDIS */
+		if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_MEDIA_STATE_CHANGE)) {
 			RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_MEDIA_STATE_CHANGE);
-			if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED))
-			{
-				pAd->IndicateMediaState = NdisMediaStateConnected;
+			if (OPSTATUS_TEST_FLAG
+			    (pAd, fOP_STATUS_MEDIA_STATE_CONNECTED)) {
+				pAd->IndicateMediaState =
+				    NdisMediaStateConnected;
 				RTMP_IndicateMediaState(pAd);
 
-			}
-			else
-			{
-				pAd->IndicateMediaState = NdisMediaStateDisconnected;
+			} else {
+				pAd->IndicateMediaState =
+				    NdisMediaStateDisconnected;
 				RTMP_IndicateMediaState(pAd);
 			}
 		}
 
 		NdisGetSystemUpTime(&pAd->Mlme.Now32);
 
-		// add the most up-to-date h/w raw counters into software variable, so that
-		// the dynamic tuning mechanism below are based on most up-to-date information
+		/* add the most up-to-date h/w raw counters into software variable, so that */
+		/* the dynamic tuning mechanism below are based on most up-to-date information */
 		NICUpdateRawCounters(pAd);
 
-#ifdef RT2870
-		RT2870_WatchDog(pAd);
-#endif // RT2870 //
+#ifdef RTMP_MAC_USB
+		RTUSBWatchDog(pAd);
+#endif /* RTMP_MAC_USB // */
 
-   		// Need statistics after read counter. So put after NICUpdateRawCounters
+		/* Need statistics after read counter. So put after NICUpdateRawCounters */
 		ORIBATimerTimeout(pAd);
 
-		// The time period for checking antenna is according to traffic
-		if (pAd->Mlme.bEnableAutoAntennaCheck)
-		{
-			TxTotalCnt = pAd->RalinkCounters.OneSecTxNoRetryOkCount +
-							 pAd->RalinkCounters.OneSecTxRetryOkCount +
-							 pAd->RalinkCounters.OneSecTxFailCount;
-
-			// dynamic adjust antenna evaluation period according to the traffic
-			if (TxTotalCnt > 50)
-			{
-				if (pAd->Mlme.OneSecPeriodicRound % 10 == 0)
-				{
-					AsicEvaluateRxAnt(pAd);
-				}
-			}
-			else
-			{
-				if (pAd->Mlme.OneSecPeriodicRound % 3 == 0)
-				{
-					AsicEvaluateRxAnt(pAd);
+		/* if MGMT RING is full more than twice within 1 second, we consider there's */
+		/* a hardware problem stucking the TX path. In this case, try a hardware reset */
+		/* to recover the system */
+		/*      if (pAd->RalinkCounters.MgmtRingFullCount >= 2) */
+		/*              RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_HARDWARE_ERROR); */
+		/*      else */
+		/*              pAd->RalinkCounters.MgmtRingFullCount = 0; */
+
+		/* The time period for checking antenna is according to traffic */
+		{
+			if (pAd->Mlme.bEnableAutoAntennaCheck) {
+				TxTotalCnt =
+				    pAd->RalinkCounters.OneSecTxNoRetryOkCount +
+				    pAd->RalinkCounters.OneSecTxRetryOkCount +
+				    pAd->RalinkCounters.OneSecTxFailCount;
+
+				/* dynamic adjust antenna evaluation period according to the traffic */
+				if (TxTotalCnt > 50) {
+					if (pAd->Mlme.OneSecPeriodicRound %
+					    10 == 0) {
+						AsicEvaluateRxAnt(pAd);
+					}
+				} else {
+					if (pAd->Mlme.OneSecPeriodicRound % 3 ==
+					    0) {
+						AsicEvaluateRxAnt(pAd);
+					}
 				}
 			}
 		}
@@ -999,382 +879,40 @@ VOID MlmePeriodicExec(
 		MlmeResetRalinkCounters(pAd);
 
 		{
-#ifdef RT2860
-			if (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST) && (pAd->bPCIclkOff == FALSE))
-#endif
+#ifdef RTMP_MAC_PCI
+			if (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)
+			    && (pAd->bPCIclkOff == FALSE))
+#endif /* RTMP_MAC_PCI // */
 			{
-				// When Adhoc beacon is enabled and RTS/CTS is enabled, there is a chance that hardware MAC FSM will run into a deadlock
-				// and sending CTS-to-self over and over.
-				// Software Patch Solution:
-				// 1. Polling debug state register 0x10F4 every one second.
-				// 2. If in 0x10F4 the ((bit29==1) && (bit7==1)) OR ((bit29==1) && (bit5==1)), it means the deadlock has occurred.
-				// 3. If the deadlock occurred, reset MAC/BBP by setting 0x1004 to 0x0001 for a while then setting it back to 0x000C again.
+				/* When Adhoc beacon is enabled and RTS/CTS is enabled, there is a chance that hardware MAC FSM will run into a deadlock */
+				/* and sending CTS-to-self over and over. */
+				/* Software Patch Solution: */
+				/* 1. Polling debug state register 0x10F4 every one second. */
+				/* 2. If in 0x10F4 the ((bit29==1) && (bit7==1)) OR ((bit29==1) && (bit5==1)), it means the deadlock has occurred. */
+				/* 3. If the deadlock occurred, reset MAC/BBP by setting 0x1004 to 0x0001 for a while then setting it back to 0x000C again. */
 
-				UINT32	MacReg = 0;
+				u32 MacReg = 0;
 
 				RTMP_IO_READ32(pAd, 0x10F4, &MacReg);
-				if (((MacReg & 0x20000000) && (MacReg & 0x80)) || ((MacReg & 0x20000000) && (MacReg & 0x20)))
-				{
+				if (((MacReg & 0x20000000) && (MacReg & 0x80))
+				    || ((MacReg & 0x20000000)
+					&& (MacReg & 0x20))) {
 					RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, 0x1);
 					RTMPusecDelay(1);
 					RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, 0xC);
 
-					DBGPRINT(RT_DEBUG_WARN,("Warning, MAC specific condition occurs \n"));
+					DBGPRINT(RT_DEBUG_WARN,
+						 ("Warning, MAC specific condition occurs \n"));
 				}
 			}
 		}
 
-		RT28XX_MLME_HANDLER(pAd);
+		RTMP_MLME_HANDLER(pAd);
 	}
 
 	pAd->bUpdateBcnCntDone = FALSE;
 }
 
-VOID STAMlmePeriodicExec(
-	PRTMP_ADAPTER pAd)
-{
-#ifdef RT2860
-	ULONG			    TxTotalCnt;
-#endif
-#ifdef RT2870
-	ULONG	TxTotalCnt;
-	int 	i;
-#endif
-
-    if (pAd->StaCfg.WpaSupplicantUP == WPA_SUPPLICANT_DISABLE)
-    {
-    	// WPA MIC error should block association attempt for 60 seconds
-    	if (pAd->StaCfg.bBlockAssoc && (pAd->StaCfg.LastMicErrorTime + (60 * OS_HZ) < pAd->Mlme.Now32))
-    		pAd->StaCfg.bBlockAssoc = FALSE;
-    }
-
-#ifdef RT2860
-	//Baron 2008/07/10
-	//printk("Baron_Test:\t%s", RTMPGetRalinkEncryModeStr(pAd->StaCfg.WepStatus));
-	//If the STA security setting is OPEN or WEP, pAd->StaCfg.WpaSupplicantUP = 0.
-	//If the STA security setting is WPAPSK or WPA2PSK, pAd->StaCfg.WpaSupplicantUP = 1.
-	if(pAd->StaCfg.WepStatus<2)
-	{
-		pAd->StaCfg.WpaSupplicantUP = 0;
-	}
-	else
-	{
-		pAd->StaCfg.WpaSupplicantUP = 1;
-	}
-#endif
-
-    if ((pAd->PreMediaState != pAd->IndicateMediaState) && (pAd->CommonCfg.bWirelessEvent))
-	{
-		if (pAd->IndicateMediaState == NdisMediaStateConnected)
-		{
-			RTMPSendWirelessEvent(pAd, IW_STA_LINKUP_EVENT_FLAG, pAd->MacTab.Content[BSSID_WCID].Addr, BSS0, 0);
-		}
-		pAd->PreMediaState = pAd->IndicateMediaState;
-	}
-
-#ifdef RT2860
-	if ((pAd->OpMode == OPMODE_STA) && (IDLE_ON(pAd)) &&
-        (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_ADVANCE_POWER_SAVE_PCIE_DEVICE)) &&
-		(pAd->Mlme.SyncMachine.CurrState == SYNC_IDLE) &&
-		(pAd->Mlme.CntlMachine.CurrState == CNTL_IDLE) &&
-		(RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_START_UP)) &&
-		(!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_IDLE_RADIO_OFF)))
-	{
-		RT28xxPciAsicRadioOff(pAd, GUI_IDLE_POWER_SAVE, 0);
-	}
-#endif
-
-
-
-   	AsicStaBbpTuning(pAd);
-
-	TxTotalCnt = pAd->RalinkCounters.OneSecTxNoRetryOkCount +
-					 pAd->RalinkCounters.OneSecTxRetryOkCount +
-					 pAd->RalinkCounters.OneSecTxFailCount;
-
-	if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED))
-	{
-		// update channel quality for Roaming and UI LinkQuality display
-		MlmeCalculateChannelQuality(pAd, pAd->Mlme.Now32);
-	}
-
-	// must be AFTER MlmeDynamicTxRateSwitching() because it needs to know if
-	// Radio is currently in noisy environment
-	if (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS))
-		AsicAdjustTxPower(pAd);
-
-	if (INFRA_ON(pAd))
-	{
-		// Is PSM bit consistent with user power management policy?
-		// This is the only place that will set PSM bit ON.
-		if (!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE))
-		MlmeCheckPsmChange(pAd, pAd->Mlme.Now32);
-
-		pAd->RalinkCounters.LastOneSecTotalTxCount = TxTotalCnt;
-
-		if ((pAd->StaCfg.LastBeaconRxTime + 1*OS_HZ < pAd->Mlme.Now32) &&
-			(!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS)) &&
-			((TxTotalCnt + pAd->RalinkCounters.OneSecRxOkCnt < 600)))
-		{
-			RTMPSetAGCInitValue(pAd, BW_20);
-			DBGPRINT(RT_DEBUG_TRACE, ("MMCHK - No BEACON. restore R66 to the low bound(%d) \n", (0x2E + GET_LNA_GAIN(pAd))));
-		}
-
-        {
-    		if (pAd->CommonCfg.bAPSDCapable && pAd->CommonCfg.APEdcaParm.bAPSDCapable)
-    		{
-    		    // When APSD is enabled, the period changes as 20 sec
-    			if ((pAd->Mlme.OneSecPeriodicRound % 20) == 8)
-    				RTMPSendNullFrame(pAd, pAd->CommonCfg.TxRate, TRUE);
-    		}
-    		else
-    		{
-    		    // Send out a NULL frame every 10 sec to inform AP that STA is still alive (Avoid being age out)
-    			if ((pAd->Mlme.OneSecPeriodicRound % 10) == 8)
-                {
-                    if (pAd->CommonCfg.bWmmCapable)
-    					RTMPSendNullFrame(pAd, pAd->CommonCfg.TxRate, TRUE);
-                    else
-						RTMPSendNullFrame(pAd, pAd->CommonCfg.TxRate, FALSE);
-                }
-    		}
-        }
-
-		if (CQI_IS_DEAD(pAd->Mlme.ChannelQuality))
-			{
-			DBGPRINT(RT_DEBUG_TRACE, ("MMCHK - No BEACON. Dead CQI. Auto Recovery attempt #%ld\n", pAd->RalinkCounters.BadCQIAutoRecoveryCount));
-			pAd->StaCfg.CCXAdjacentAPReportFlag = TRUE;
-			pAd->StaCfg.CCXAdjacentAPLinkDownTime = pAd->StaCfg.LastBeaconRxTime;
-
-			// Lost AP, send disconnect & link down event
-			LinkDown(pAd, FALSE);
-
-            {
-                union iwreq_data    wrqu;
-                memset(wrqu.ap_addr.sa_data, 0, MAC_ADDR_LEN);
-                wireless_send_event(pAd->net_dev, SIOCGIWAP, &wrqu, NULL);
-            }
-
-			MlmeAutoReconnectLastSSID(pAd);
-		}
-		else if (CQI_IS_BAD(pAd->Mlme.ChannelQuality))
-		{
-			pAd->RalinkCounters.BadCQIAutoRecoveryCount ++;
-			DBGPRINT(RT_DEBUG_TRACE, ("MMCHK - Bad CQI. Auto Recovery attempt #%ld\n", pAd->RalinkCounters.BadCQIAutoRecoveryCount));
-			MlmeAutoReconnectLastSSID(pAd);
-		}
-
-		// Add auto seamless roaming
-		if (pAd->StaCfg.bFastRoaming)
-		{
-			SHORT	dBmToRoam = (SHORT)pAd->StaCfg.dBmToRoam;
-
-			DBGPRINT(RT_DEBUG_TRACE, ("Rssi=%d, dBmToRoam=%d\n", RTMPMaxRssi(pAd, pAd->StaCfg.RssiSample.LastRssi0, pAd->StaCfg.RssiSample.LastRssi1, pAd->StaCfg.RssiSample.LastRssi2), (CHAR)dBmToRoam));
-
-			if (RTMPMaxRssi(pAd, pAd->StaCfg.RssiSample.LastRssi0, pAd->StaCfg.RssiSample.LastRssi1, pAd->StaCfg.RssiSample.LastRssi2) <= (CHAR)dBmToRoam)
-			{
-				MlmeCheckForFastRoaming(pAd, pAd->Mlme.Now32);
-			}
-		}
-	}
-	else if (ADHOC_ON(pAd))
-	{
-#ifdef RT2860
-		// 2003-04-17 john. this is a patch that driver forces a BEACON out if ASIC fails
-		// the "TX BEACON competition" for the entire past 1 sec.
-		// So that even when ASIC's BEACONgen engine been blocked
-		// by peer's BEACON due to slower system clock, this STA still can send out
-		// minimum BEACON to tell the peer I'm alive.
-		// drawback is that this BEACON won't be well aligned at TBTT boundary.
-		// EnqueueBeaconFrame(pAd);			  // software send BEACON
-
-		// if all 11b peers leave this BSS more than 5 seconds, update Tx rate,
-		// restore outgoing BEACON to support B/G-mixed mode
-		if ((pAd->CommonCfg.Channel <= 14)			   &&
-			(pAd->CommonCfg.MaxTxRate <= RATE_11)	   &&
-			(pAd->CommonCfg.MaxDesiredRate > RATE_11)  &&
-			((pAd->StaCfg.Last11bBeaconRxTime + 5*OS_HZ) < pAd->Mlme.Now32))
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("MMCHK - last 11B peer left, update Tx rates\n"));
-			NdisMoveMemory(pAd->StaActive.SupRate, pAd->CommonCfg.SupRate, MAX_LEN_OF_SUPPORTED_RATES);
-			pAd->StaActive.SupRateLen = pAd->CommonCfg.SupRateLen;
-			MlmeUpdateTxRates(pAd, FALSE, 0);
-			MakeIbssBeacon(pAd);		// re-build BEACON frame
-			AsicEnableIbssSync(pAd);	// copy to on-chip memory
-			pAd->StaCfg.AdhocBOnlyJoined = FALSE;
-		}
-
-		if (pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED)
-		{
-			if ((pAd->StaCfg.AdhocBGJoined) &&
-				((pAd->StaCfg.Last11gBeaconRxTime + 5 * OS_HZ) < pAd->Mlme.Now32))
-			{
-				DBGPRINT(RT_DEBUG_TRACE, ("MMCHK - last 11G peer left\n"));
-				pAd->StaCfg.AdhocBGJoined = FALSE;
-			}
-
-			if ((pAd->StaCfg.Adhoc20NJoined) &&
-				((pAd->StaCfg.Last20NBeaconRxTime + 5 * OS_HZ) < pAd->Mlme.Now32))
-			{
-				DBGPRINT(RT_DEBUG_TRACE, ("MMCHK - last 20MHz N peer left\n"));
-				pAd->StaCfg.Adhoc20NJoined = FALSE;
-			}
-		}
-#endif /* RT2860 */
-
-		//radar detect
-		if ((pAd->CommonCfg.Channel > 14)
-			&& (pAd->CommonCfg.bIEEE80211H == 1)
-			&& RadarChannelCheck(pAd, pAd->CommonCfg.Channel))
-		{
-			RadarDetectPeriodic(pAd);
-		}
-
-		// If all peers leave, and this STA becomes the last one in this IBSS, then change MediaState
-		// to DISCONNECTED. But still holding this IBSS (i.e. sending BEACON) so that other STAs can
-		// join later.
-		if ((pAd->StaCfg.LastBeaconRxTime + ADHOC_BEACON_LOST_TIME < pAd->Mlme.Now32) &&
-			OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED))
-		{
-			MLME_START_REQ_STRUCT     StartReq;
-
-			DBGPRINT(RT_DEBUG_TRACE, ("MMCHK - excessive BEACON lost, last STA in this IBSS, MediaState=Disconnected\n"));
-			LinkDown(pAd, FALSE);
-
-			StartParmFill(pAd, &StartReq, pAd->MlmeAux.Ssid, pAd->MlmeAux.SsidLen);
-			MlmeEnqueue(pAd, SYNC_STATE_MACHINE, MT2_MLME_START_REQ, sizeof(MLME_START_REQ_STRUCT), &StartReq);
-			pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_START;
-		}
-
-#ifdef RT2870
-		for (i = 1; i < MAX_LEN_OF_MAC_TABLE; i++)
-		{
-			MAC_TABLE_ENTRY *pEntry = &pAd->MacTab.Content[i];
-
-			if (pEntry->ValidAsCLI == FALSE)
-				continue;
-
-			if (pEntry->LastBeaconRxTime + ADHOC_BEACON_LOST_TIME < pAd->Mlme.Now32)
-				MacTableDeleteEntry(pAd, pEntry->Aid, pEntry->Addr);
-		}
-#endif
-	}
-	else // no INFRA nor ADHOC connection
-	{
-
-		if (pAd->StaCfg.bScanReqIsFromWebUI &&
-            ((pAd->StaCfg.LastScanTime + 30 * OS_HZ) > pAd->Mlme.Now32))
-			goto SKIP_AUTO_SCAN_CONN;
-        else
-            pAd->StaCfg.bScanReqIsFromWebUI = FALSE;
-
-		if ((pAd->StaCfg.bAutoReconnect == TRUE)
-			&& RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_START_UP)
-			&& (MlmeValidateSSID(pAd->MlmeAux.AutoReconnectSsid, pAd->MlmeAux.AutoReconnectSsidLen) == TRUE))
-		{
-			if ((pAd->ScanTab.BssNr==0) && (pAd->Mlme.CntlMachine.CurrState == CNTL_IDLE))
-			{
-				MLME_SCAN_REQ_STRUCT	   ScanReq;
-
-				if ((pAd->StaCfg.LastScanTime + 10 * OS_HZ) < pAd->Mlme.Now32)
-				{
-					DBGPRINT(RT_DEBUG_TRACE, ("STAMlmePeriodicExec():CNTL - ScanTab.BssNr==0, start a new ACTIVE scan SSID[%s]\n", pAd->MlmeAux.AutoReconnectSsid));
-					ScanParmFill(pAd, &ScanReq, pAd->MlmeAux.AutoReconnectSsid, pAd->MlmeAux.AutoReconnectSsidLen, BSS_ANY, SCAN_ACTIVE);
-					MlmeEnqueue(pAd, SYNC_STATE_MACHINE, MT2_MLME_SCAN_REQ, sizeof(MLME_SCAN_REQ_STRUCT), &ScanReq);
-					pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_OID_LIST_SCAN;
-					// Reset Missed scan number
-					pAd->StaCfg.LastScanTime = pAd->Mlme.Now32;
-				}
-				else if (pAd->StaCfg.BssType == BSS_ADHOC)	// Quit the forever scan when in a very clean room
-					MlmeAutoReconnectLastSSID(pAd);
-			}
-			else if (pAd->Mlme.CntlMachine.CurrState == CNTL_IDLE)
-			{
-				if ((pAd->Mlme.OneSecPeriodicRound % 7) == 0)
-				{
-					MlmeAutoScan(pAd);
-					pAd->StaCfg.LastScanTime = pAd->Mlme.Now32;
-				}
-				else
-				{
-						MlmeAutoReconnectLastSSID(pAd);
-				}
-			}
-		}
-	}
-
-SKIP_AUTO_SCAN_CONN:
-
-    if ((pAd->MacTab.Content[BSSID_WCID].TXBAbitmap !=0) && (pAd->MacTab.fAnyBASession == FALSE))
-	{
-		pAd->MacTab.fAnyBASession = TRUE;
-		AsicUpdateProtect(pAd, HT_FORCERTSCTS,  ALLN_SETPROTECT, FALSE, FALSE);
-	}
-	else if ((pAd->MacTab.Content[BSSID_WCID].TXBAbitmap ==0) && (pAd->MacTab.fAnyBASession == TRUE))
-	{
-		pAd->MacTab.fAnyBASession = FALSE;
-		AsicUpdateProtect(pAd, pAd->MlmeAux.AddHtInfo.AddHtInfo2.OperaionMode,  ALLN_SETPROTECT, FALSE, FALSE);
-	}
-
-	return;
-}
-
-// Link down report
-VOID LinkDownExec(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3)
-{
-
-	RTMP_ADAPTER *pAd = (RTMP_ADAPTER *)FunctionContext;
-
-	pAd->IndicateMediaState = NdisMediaStateDisconnected;
-	RTMP_IndicateMediaState(pAd);
-    pAd->ExtraInfo = GENERAL_LINK_DOWN;
-}
-
-// IRQL = DISPATCH_LEVEL
-VOID MlmeAutoScan(
-	IN PRTMP_ADAPTER pAd)
-{
-	// check CntlMachine.CurrState to avoid collision with NDIS SetOID request
-	if (pAd->Mlme.CntlMachine.CurrState == CNTL_IDLE)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("MMCHK - Driver auto scan\n"));
-		MlmeEnqueue(pAd,
-					MLME_CNTL_STATE_MACHINE,
-					OID_802_11_BSSID_LIST_SCAN,
-					0,
-					NULL);
-		RT28XX_MLME_HANDLER(pAd);
-	}
-}
-
-// IRQL = DISPATCH_LEVEL
-VOID MlmeAutoReconnectLastSSID(
-	IN PRTMP_ADAPTER pAd)
-{
-
-
-	// check CntlMachine.CurrState to avoid collision with NDIS SetOID request
-	if ((pAd->Mlme.CntlMachine.CurrState == CNTL_IDLE) &&
-		(MlmeValidateSSID(pAd->MlmeAux.AutoReconnectSsid, pAd->MlmeAux.AutoReconnectSsidLen) == TRUE))
-	{
-		NDIS_802_11_SSID OidSsid;
-		OidSsid.SsidLength = pAd->MlmeAux.AutoReconnectSsidLen;
-		NdisMoveMemory(OidSsid.Ssid, pAd->MlmeAux.AutoReconnectSsid, pAd->MlmeAux.AutoReconnectSsidLen);
-
-		DBGPRINT(RT_DEBUG_TRACE, ("Driver auto reconnect to last OID_802_11_SSID setting - %s, len - %d\n", pAd->MlmeAux.AutoReconnectSsid, pAd->MlmeAux.AutoReconnectSsidLen));
-		MlmeEnqueue(pAd,
-					MLME_CNTL_STATE_MACHINE,
-					OID_802_11_SSID,
-					sizeof(NDIS_802_11_SSID),
-					&OidSsid);
-		RT28XX_MLME_HANDLER(pAd);
-	}
-}
-
 /*
 	==========================================================================
 	Validate SSID for connection try and rescan purpose
@@ -1383,38 +921,31 @@ VOID MlmeAutoReconnectLastSSID(
 	IRQL = DISPATCH_LEVEL
 	==========================================================================
  */
-BOOLEAN MlmeValidateSSID(
-	IN PUCHAR	pSsid,
-	IN UCHAR	SsidLen)
+BOOLEAN MlmeValidateSSID(u8 *pSsid, u8 SsidLen)
 {
-	int	index;
+	int index;
 
 	if (SsidLen > MAX_LEN_OF_SSID)
 		return (FALSE);
 
-	// Check each character value
-	for (index = 0; index < SsidLen; index++)
-	{
+	/* Check each character value */
+	for (index = 0; index < SsidLen; index++) {
 		if (pSsid[index] < 0x20)
 			return (FALSE);
 	}
 
-	// All checked
+	/* All checked */
 	return (TRUE);
 }
 
-VOID MlmeSelectTxRateTable(
-	IN PRTMP_ADAPTER		pAd,
-	IN PMAC_TABLE_ENTRY		pEntry,
-	IN PUCHAR				*ppTable,
-	IN PUCHAR				pTableSize,
-	IN PUCHAR				pInitTxRateIdx)
+void MlmeSelectTxRateTable(struct rt_rtmp_adapter *pAd,
+			   struct rt_mac_table_entry *pEntry,
+			   u8 ** ppTable,
+			   u8 *pTableSize, u8 *pInitTxRateIdx)
 {
-	do
-	{
-		// decide the rate table for tuning
-		if (pAd->CommonCfg.TxRateTableSize > 0)
-		{
+	do {
+		/* decide the rate table for tuning */
+		if (pAd->CommonCfg.TxRateTableSize > 0) {
 			*ppTable = RateSwitchTable;
 			*pTableSize = RateSwitchTable[0];
 			*pInitTxRateIdx = RateSwitchTable[1];
@@ -1422,84 +953,40 @@ VOID MlmeSelectTxRateTable(
 			break;
 		}
 
-		if ((pAd->OpMode == OPMODE_STA) && ADHOC_ON(pAd))
-		{
-			if ((pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED) &&
-#ifdef RT2860
-				!pAd->StaCfg.AdhocBOnlyJoined &&
-				!pAd->StaCfg.AdhocBGJoined &&
-				(pAd->StaActive.SupportedPhyInfo.MCSSet[0] == 0xff) &&
-				((pAd->StaActive.SupportedPhyInfo.MCSSet[1] == 0x00) || (pAd->Antenna.field.TxPath == 1)))
-#endif
-#ifdef RT2870
-				(pEntry->HTCapability.MCSSet[0] == 0xff) &&
-				((pEntry->HTCapability.MCSSet[1] == 0x00) || (pAd->Antenna.field.TxPath == 1)))
-#endif
-			{// 11N 1S Adhoc
+		if ((pAd->OpMode == OPMODE_STA) && ADHOC_ON(pAd)) {
+			if ((pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED) && (pEntry->HTCapability.MCSSet[0] == 0xff) && ((pEntry->HTCapability.MCSSet[1] == 0x00) || (pAd->Antenna.field.TxPath == 1))) {	/* 11N 1S Adhoc */
 				*ppTable = RateSwitchTable11N1S;
 				*pTableSize = RateSwitchTable11N1S[0];
 				*pInitTxRateIdx = RateSwitchTable11N1S[1];
 
-			}
-			else if ((pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED) &&
-#ifdef RT2860
-					!pAd->StaCfg.AdhocBOnlyJoined &&
-					!pAd->StaCfg.AdhocBGJoined &&
-					(pAd->StaActive.SupportedPhyInfo.MCSSet[0] == 0xff) &&
-					(pAd->StaActive.SupportedPhyInfo.MCSSet[1] == 0xff) &&
-#endif
-#ifdef RT2870
-					(pEntry->HTCapability.MCSSet[0] == 0xff) &&
-					(pEntry->HTCapability.MCSSet[1] == 0xff) &&
-#endif
-					(pAd->Antenna.field.TxPath == 2))
-			{// 11N 2S Adhoc
-				if (pAd->LatchRfRegs.Channel <= 14)
-				{
+			} else if ((pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED) && (pEntry->HTCapability.MCSSet[0] == 0xff) && (pEntry->HTCapability.MCSSet[1] == 0xff) && (pAd->Antenna.field.TxPath == 2)) {	/* 11N 2S Adhoc */
+				if (pAd->LatchRfRegs.Channel <= 14) {
 					*ppTable = RateSwitchTable11N2S;
 					*pTableSize = RateSwitchTable11N2S[0];
-					*pInitTxRateIdx = RateSwitchTable11N2S[1];
-				}
-				else
-				{
+					*pInitTxRateIdx =
+					    RateSwitchTable11N2S[1];
+				} else {
 					*ppTable = RateSwitchTable11N2SForABand;
-					*pTableSize = RateSwitchTable11N2SForABand[0];
-					*pInitTxRateIdx = RateSwitchTable11N2SForABand[1];
+					*pTableSize =
+					    RateSwitchTable11N2SForABand[0];
+					*pInitTxRateIdx =
+					    RateSwitchTable11N2SForABand[1];
 				}
 
-			}
-			else
-#ifdef RT2860
-				if (pAd->CommonCfg.PhyMode == PHY_11B)
-			{
-				*ppTable = RateSwitchTable11B;
-				*pTableSize = RateSwitchTable11B[0];
-				*pInitTxRateIdx = RateSwitchTable11B[1];
-
-			}
-	        else if((pAd->LatchRfRegs.Channel <= 14) && (pAd->StaCfg.AdhocBOnlyJoined == TRUE))
-#endif
-#ifdef RT2870
-				if ((pEntry->RateLen == 4)
-					&& (pEntry->HTCapability.MCSSet[0] == 0) && (pEntry->HTCapability.MCSSet[1] == 0)
-					)
-#endif
-			{
-				// USe B Table when Only b-only Station in my IBSS .
+			} else if ((pEntry->RateLen == 4)
+				   && (pEntry->HTCapability.MCSSet[0] == 0)
+				   && (pEntry->HTCapability.MCSSet[1] == 0)
+			    ) {
 				*ppTable = RateSwitchTable11B;
 				*pTableSize = RateSwitchTable11B[0];
 				*pInitTxRateIdx = RateSwitchTable11B[1];
 
-			}
-			else if (pAd->LatchRfRegs.Channel <= 14)
-			{
+			} else if (pAd->LatchRfRegs.Channel <= 14) {
 				*ppTable = RateSwitchTable11BG;
 				*pTableSize = RateSwitchTable11BG[0];
 				*pInitTxRateIdx = RateSwitchTable11BG[1];
 
-			}
-			else
-			{
+			} else {
 				*ppTable = RateSwitchTable11G;
 				*pTableSize = RateSwitchTable11G[0];
 				*pInitTxRateIdx = RateSwitchTable11G[1];
@@ -1507,91 +994,82 @@ VOID MlmeSelectTxRateTable(
 			}
 			break;
 		}
-
-		if ((pEntry->RateLen == 12) && (pEntry->HTCapability.MCSSet[0] == 0xff) &&
-			((pEntry->HTCapability.MCSSet[1] == 0x00) || (pAd->CommonCfg.TxStream == 1)))
-		{// 11BGN 1S AP
+		/*if ((pAd->StaActive.SupRateLen + pAd->StaActive.ExtRateLen == 12) && (pAd->StaActive.SupportedPhyInfo.MCSSet[0] == 0xff) && */
+		/*      ((pAd->StaActive.SupportedPhyInfo.MCSSet[1] == 0x00) || (pAd->Antenna.field.TxPath == 1))) */
+		if (((pEntry->RateLen == 12) || (pAd->OpMode == OPMODE_STA)) && (pEntry->HTCapability.MCSSet[0] == 0xff) && ((pEntry->HTCapability.MCSSet[1] == 0x00) || (pAd->CommonCfg.TxStream == 1))) {	/* 11BGN 1S AP */
 			*ppTable = RateSwitchTable11BGN1S;
 			*pTableSize = RateSwitchTable11BGN1S[0];
 			*pInitTxRateIdx = RateSwitchTable11BGN1S[1];
 
 			break;
 		}
-
-		if ((pEntry->RateLen == 12) && (pEntry->HTCapability.MCSSet[0] == 0xff) &&
-			(pEntry->HTCapability.MCSSet[1] == 0xff) && (pAd->CommonCfg.TxStream == 2))
-		{// 11BGN 2S AP
-			if (pAd->LatchRfRegs.Channel <= 14)
-			{
+		/*else if ((pAd->StaActive.SupRateLen + pAd->StaActive.ExtRateLen == 12) && (pAd->StaActive.SupportedPhyInfo.MCSSet[0] == 0xff) && */
+		/*      (pAd->StaActive.SupportedPhyInfo.MCSSet[1] == 0xff) && (pAd->Antenna.field.TxPath == 2)) */
+		if (((pEntry->RateLen == 12) || (pAd->OpMode == OPMODE_STA)) && (pEntry->HTCapability.MCSSet[0] == 0xff) && (pEntry->HTCapability.MCSSet[1] == 0xff) && (pAd->CommonCfg.TxStream == 2)) {	/* 11BGN 2S AP */
+			if (pAd->LatchRfRegs.Channel <= 14) {
 				*ppTable = RateSwitchTable11BGN2S;
 				*pTableSize = RateSwitchTable11BGN2S[0];
 				*pInitTxRateIdx = RateSwitchTable11BGN2S[1];
 
-			}
-			else
-			{
+			} else {
 				*ppTable = RateSwitchTable11BGN2SForABand;
 				*pTableSize = RateSwitchTable11BGN2SForABand[0];
-				*pInitTxRateIdx = RateSwitchTable11BGN2SForABand[1];
+				*pInitTxRateIdx =
+				    RateSwitchTable11BGN2SForABand[1];
 
 			}
 			break;
 		}
-
-		if ((pEntry->HTCapability.MCSSet[0] == 0xff) && ((pEntry->HTCapability.MCSSet[1] == 0x00) || (pAd->CommonCfg.TxStream == 1)))
-		{// 11N 1S AP
+		/*else if ((pAd->StaActive.SupportedPhyInfo.MCSSet[0] == 0xff) && ((pAd->StaActive.SupportedPhyInfo.MCSSet[1] == 0x00) || (pAd->Antenna.field.TxPath == 1))) */
+		if ((pEntry->HTCapability.MCSSet[0] == 0xff) && ((pEntry->HTCapability.MCSSet[1] == 0x00) || (pAd->CommonCfg.TxStream == 1))) {	/* 11N 1S AP */
 			*ppTable = RateSwitchTable11N1S;
 			*pTableSize = RateSwitchTable11N1S[0];
 			*pInitTxRateIdx = RateSwitchTable11N1S[1];
 
 			break;
 		}
-
-		if ((pEntry->HTCapability.MCSSet[0] == 0xff) && (pEntry->HTCapability.MCSSet[1] == 0xff) && (pAd->CommonCfg.TxStream == 2))
-		{// 11N 2S AP
-			if (pAd->LatchRfRegs.Channel <= 14)
-			{
-			*ppTable = RateSwitchTable11N2S;
-			*pTableSize = RateSwitchTable11N2S[0];
-			*pInitTxRateIdx = RateSwitchTable11N2S[1];
-            }
-			else
-			{
+		/*else if ((pAd->StaActive.SupportedPhyInfo.MCSSet[0] == 0xff) && (pAd->StaActive.SupportedPhyInfo.MCSSet[1] == 0xff) && (pAd->Antenna.field.TxPath == 2)) */
+		if ((pEntry->HTCapability.MCSSet[0] == 0xff) && (pEntry->HTCapability.MCSSet[1] == 0xff) && (pAd->CommonCfg.TxStream == 2)) {	/* 11N 2S AP */
+			if (pAd->LatchRfRegs.Channel <= 14) {
+				*ppTable = RateSwitchTable11N2S;
+				*pTableSize = RateSwitchTable11N2S[0];
+				*pInitTxRateIdx = RateSwitchTable11N2S[1];
+			} else {
 				*ppTable = RateSwitchTable11N2SForABand;
 				*pTableSize = RateSwitchTable11N2SForABand[0];
-				*pInitTxRateIdx = RateSwitchTable11N2SForABand[1];
+				*pInitTxRateIdx =
+				    RateSwitchTable11N2SForABand[1];
 			}
 
 			break;
 		}
-
-		//else if ((pAd->StaActive.SupRateLen == 4) && (pAd->StaActive.ExtRateLen == 0) && (pAd->StaActive.SupportedPhyInfo.MCSSet[0] == 0) && (pAd->StaActive.SupportedPhyInfo.MCSSet[1] == 0))
-		if (pEntry->RateLen == 4)
-		{// B only AP
+		/*else if ((pAd->StaActive.SupRateLen == 4) && (pAd->StaActive.ExtRateLen == 0) && (pAd->StaActive.SupportedPhyInfo.MCSSet[0] == 0) && (pAd->StaActive.SupportedPhyInfo.MCSSet[1] == 0)) */
+		if ((pEntry->RateLen == 4 || pAd->CommonCfg.PhyMode == PHY_11B)
+		    /*Iverson mark for Adhoc b mode,sta will use rate 54  Mbps when connect with sta b/g/n mode */
+		    /* && (pEntry->HTCapability.MCSSet[0] == 0) && (pEntry->HTCapability.MCSSet[1] == 0) */
+		    ) {		/* B only AP */
 			*ppTable = RateSwitchTable11B;
 			*pTableSize = RateSwitchTable11B[0];
 			*pInitTxRateIdx = RateSwitchTable11B[1];
 
 			break;
 		}
-
-		//else if ((pAd->StaActive.SupRateLen + pAd->StaActive.ExtRateLen > 8) && (pAd->StaActive.SupportedPhyInfo.MCSSet[0] == 0) && (pAd->StaActive.SupportedPhyInfo.MCSSet[1] == 0))
+		/*else if ((pAd->StaActive.SupRateLen + pAd->StaActive.ExtRateLen > 8) && (pAd->StaActive.SupportedPhyInfo.MCSSet[0] == 0) && (pAd->StaActive.SupportedPhyInfo.MCSSet[1] == 0)) */
 		if ((pEntry->RateLen > 8)
-			&& (pEntry->HTCapability.MCSSet[0] == 0) && (pEntry->HTCapability.MCSSet[1] == 0)
-			)
-		{// B/G  mixed AP
+		    && (pEntry->HTCapability.MCSSet[0] == 0)
+		    && (pEntry->HTCapability.MCSSet[1] == 0)
+		    ) {		/* B/G  mixed AP */
 			*ppTable = RateSwitchTable11BG;
 			*pTableSize = RateSwitchTable11BG[0];
 			*pInitTxRateIdx = RateSwitchTable11BG[1];
 
 			break;
 		}
-
-		//else if ((pAd->StaActive.SupRateLen + pAd->StaActive.ExtRateLen == 8) && (pAd->StaActive.SupportedPhyInfo.MCSSet[0] == 0) && (pAd->StaActive.SupportedPhyInfo.MCSSet[1] == 0))
+		/*else if ((pAd->StaActive.SupRateLen + pAd->StaActive.ExtRateLen == 8) && (pAd->StaActive.SupportedPhyInfo.MCSSet[0] == 0) && (pAd->StaActive.SupportedPhyInfo.MCSSet[1] == 0)) */
 		if ((pEntry->RateLen == 8)
-			&& (pEntry->HTCapability.MCSSet[0] == 0) && (pEntry->HTCapability.MCSSet[1] == 0)
-			)
-		{// G only AP
+		    && (pEntry->HTCapability.MCSSet[0] == 0)
+		    && (pEntry->HTCapability.MCSSet[1] == 0)
+		    ) {		/* G only AP */
 			*ppTable = RateSwitchTable11G;
 			*pTableSize = RateSwitchTable11G[0];
 			*pInitTxRateIdx = RateSwitchTable11G[1];
@@ -1600,70 +1078,496 @@ VOID MlmeSelectTxRateTable(
 		}
 
 		{
-			//else if ((pAd->StaActive.SupportedPhyInfo.MCSSet[0] == 0) && (pAd->StaActive.SupportedPhyInfo.MCSSet[1] == 0))
-			if ((pEntry->HTCapability.MCSSet[0] == 0) && (pEntry->HTCapability.MCSSet[1] == 0))
-			{	// Legacy mode
-				if (pAd->CommonCfg.MaxTxRate <= RATE_11)
-				{
+			/*else if ((pAd->StaActive.SupportedPhyInfo.MCSSet[0] == 0) && (pAd->StaActive.SupportedPhyInfo.MCSSet[1] == 0)) */
+			if ((pEntry->HTCapability.MCSSet[0] == 0) && (pEntry->HTCapability.MCSSet[1] == 0)) {	/* Legacy mode */
+				if (pAd->CommonCfg.MaxTxRate <= RATE_11) {
 					*ppTable = RateSwitchTable11B;
 					*pTableSize = RateSwitchTable11B[0];
 					*pInitTxRateIdx = RateSwitchTable11B[1];
-				}
-				else if ((pAd->CommonCfg.MaxTxRate > RATE_11) && (pAd->CommonCfg.MinTxRate > RATE_11))
-				{
+				} else if ((pAd->CommonCfg.MaxTxRate > RATE_11)
+					   && (pAd->CommonCfg.MinTxRate >
+					       RATE_11)) {
 					*ppTable = RateSwitchTable11G;
 					*pTableSize = RateSwitchTable11G[0];
 					*pInitTxRateIdx = RateSwitchTable11G[1];
 
-				}
-				else
-				{
+				} else {
 					*ppTable = RateSwitchTable11BG;
 					*pTableSize = RateSwitchTable11BG[0];
-					*pInitTxRateIdx = RateSwitchTable11BG[1];
+					*pInitTxRateIdx =
+					    RateSwitchTable11BG[1];
 				}
 				break;
 			}
-
-			if (pAd->LatchRfRegs.Channel <= 14)
-			{
-				if (pAd->CommonCfg.TxStream == 1)
-				{
+			if (pAd->LatchRfRegs.Channel <= 14) {
+				if (pAd->CommonCfg.TxStream == 1) {
 					*ppTable = RateSwitchTable11N1S;
 					*pTableSize = RateSwitchTable11N1S[0];
-					*pInitTxRateIdx = RateSwitchTable11N1S[1];
-					DBGPRINT_RAW(RT_DEBUG_ERROR,("DRS: unkown mode,default use 11N 1S AP \n"));
-				}
-				else
-				{
+					*pInitTxRateIdx =
+					    RateSwitchTable11N1S[1];
+					DBGPRINT_RAW(RT_DEBUG_ERROR,
+						     ("DRS: unkown mode,default use 11N 1S AP \n"));
+				} else {
 					*ppTable = RateSwitchTable11N2S;
 					*pTableSize = RateSwitchTable11N2S[0];
-					*pInitTxRateIdx = RateSwitchTable11N2S[1];
-					DBGPRINT_RAW(RT_DEBUG_ERROR,("DRS: unkown mode,default use 11N 2S AP \n"));
+					*pInitTxRateIdx =
+					    RateSwitchTable11N2S[1];
+					DBGPRINT_RAW(RT_DEBUG_ERROR,
+						     ("DRS: unkown mode,default use 11N 2S AP \n"));
 				}
-			}
-			else
-			{
-				if (pAd->CommonCfg.TxStream == 1)
-				{
+			} else {
+				if (pAd->CommonCfg.TxStream == 1) {
 					*ppTable = RateSwitchTable11N1S;
 					*pTableSize = RateSwitchTable11N1S[0];
-					*pInitTxRateIdx = RateSwitchTable11N1S[1];
-					DBGPRINT_RAW(RT_DEBUG_ERROR,("DRS: unkown mode,default use 11N 1S AP \n"));
-				}
-				else
-				{
+					*pInitTxRateIdx =
+					    RateSwitchTable11N1S[1];
+					DBGPRINT_RAW(RT_DEBUG_ERROR,
+						     ("DRS: unkown mode,default use 11N 1S AP \n"));
+				} else {
 					*ppTable = RateSwitchTable11N2SForABand;
-					*pTableSize = RateSwitchTable11N2SForABand[0];
-					*pInitTxRateIdx = RateSwitchTable11N2SForABand[1];
-					DBGPRINT_RAW(RT_DEBUG_ERROR,("DRS: unkown mode,default use 11N 2S AP \n"));
+					*pTableSize =
+					    RateSwitchTable11N2SForABand[0];
+					*pInitTxRateIdx =
+					    RateSwitchTable11N2SForABand[1];
+					DBGPRINT_RAW(RT_DEBUG_ERROR,
+						     ("DRS: unkown mode,default use 11N 2S AP \n"));
 				}
 			}
+			DBGPRINT_RAW(RT_DEBUG_ERROR,
+				     ("DRS: unkown mode (SupRateLen=%d, ExtRateLen=%d, MCSSet[0]=0x%x, MCSSet[1]=0x%x)\n",
+				      pAd->StaActive.SupRateLen,
+				      pAd->StaActive.ExtRateLen,
+				      pAd->StaActive.SupportedPhyInfo.MCSSet[0],
+				      pAd->StaActive.SupportedPhyInfo.
+				      MCSSet[1]));
+		}
+	} while (FALSE);
+}
 
-			DBGPRINT_RAW(RT_DEBUG_ERROR,("DRS: unkown mode (SupRateLen=%d, ExtRateLen=%d, MCSSet[0]=0x%x, MCSSet[1]=0x%x)\n",
-				pAd->StaActive.SupRateLen, pAd->StaActive.ExtRateLen, pAd->StaActive.SupportedPhyInfo.MCSSet[0], pAd->StaActive.SupportedPhyInfo.MCSSet[1]));
+void STAMlmePeriodicExec(struct rt_rtmp_adapter *pAd)
+{
+	unsigned long TxTotalCnt;
+	int i;
+
+	/*
+	   We return here in ATE mode, because the statistics
+	   that ATE need are not collected via this routine.
+	 */
+#if defined(RT305x)||defined(RT3070)
+	/* request by Gary, if Rssi0 > -42, BBP 82 need to be changed from 0x62 to 0x42, , bbp 67 need to be changed from 0x20 to 0x18 */
+	if (!pAd->CommonCfg.HighPowerPatchDisabled) {
+#ifdef RT3070
+		if ((IS_RT3070(pAd) && ((pAd->MACVersion & 0xffff) < 0x0201)))
+#endif /* RT3070 // */
+		{
+			if ((pAd->StaCfg.RssiSample.AvgRssi0 != 0)
+			    && (pAd->StaCfg.RssiSample.AvgRssi0 >
+				(pAd->BbpRssiToDbmDelta - 35))) {
+				RT30xxWriteRFRegister(pAd, RF_R27, 0x20);
+			} else {
+				RT30xxWriteRFRegister(pAd, RF_R27, 0x23);
+			}
+		}
+	}
+#endif
+#ifdef PCIE_PS_SUPPORT
+/* don't perform idle-power-save mechanism within 3 min after driver initialization. */
+/* This can make rebooter test more robust */
+	if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE)) {
+		if ((pAd->OpMode == OPMODE_STA) && (IDLE_ON(pAd))
+		    && (pAd->Mlme.SyncMachine.CurrState == SYNC_IDLE)
+		    && (pAd->Mlme.CntlMachine.CurrState == CNTL_IDLE)
+		    && (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_IDLE_RADIO_OFF))) {
+			if (IS_RT3090(pAd) || IS_RT3572(pAd) || IS_RT3390(pAd)) {
+				if (pAd->StaCfg.PSControl.field.EnableNewPS ==
+				    TRUE) {
+					DBGPRINT(RT_DEBUG_TRACE,
+						 ("%s\n", __func__));
+					RT28xxPciAsicRadioOff(pAd,
+							      GUI_IDLE_POWER_SAVE,
+							      0);
+				} else {
+					AsicSendCommandToMcu(pAd, 0x30,
+							     PowerSafeCID, 0xff,
+							     0x2);
+					/* Wait command success */
+					AsicCheckCommanOk(pAd, PowerSafeCID);
+					RTMP_SET_FLAG(pAd,
+						      fRTMP_ADAPTER_IDLE_RADIO_OFF);
+					DBGPRINT(RT_DEBUG_TRACE,
+						 ("PSM - rt30xx Issue Sleep command)\n"));
+				}
+			} else if (pAd->Mlme.OneSecPeriodicRound > 180) {
+				if (pAd->StaCfg.PSControl.field.EnableNewPS ==
+				    TRUE) {
+					DBGPRINT(RT_DEBUG_TRACE,
+						 ("%s\n", __func__));
+					RT28xxPciAsicRadioOff(pAd,
+							      GUI_IDLE_POWER_SAVE,
+							      0);
+				} else {
+					AsicSendCommandToMcu(pAd, 0x30,
+							     PowerSafeCID, 0xff,
+							     0x02);
+					/* Wait command success */
+					AsicCheckCommanOk(pAd, PowerSafeCID);
+					RTMP_SET_FLAG(pAd,
+						      fRTMP_ADAPTER_IDLE_RADIO_OFF);
+					DBGPRINT(RT_DEBUG_TRACE,
+						 ("PSM -  rt28xx Issue Sleep command)\n"));
+				}
+			}
+		} else {
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("STAMlmePeriodicExec MMCHK - CommonCfg.Ssid[%d]=%c%c%c%c... MlmeAux.Ssid[%d]=%c%c%c%c...\n",
+				  pAd->CommonCfg.SsidLen,
+				  pAd->CommonCfg.Ssid[0],
+				  pAd->CommonCfg.Ssid[1],
+				  pAd->CommonCfg.Ssid[2],
+				  pAd->CommonCfg.Ssid[3], pAd->MlmeAux.SsidLen,
+				  pAd->MlmeAux.Ssid[0], pAd->MlmeAux.Ssid[1],
+				  pAd->MlmeAux.Ssid[2], pAd->MlmeAux.Ssid[3]));
+		}
+	}
+#endif /* PCIE_PS_SUPPORT // */
+
+	if (pAd->StaCfg.WpaSupplicantUP == WPA_SUPPLICANT_DISABLE) {
+		/* WPA MIC error should block association attempt for 60 seconds */
+		if (pAd->StaCfg.bBlockAssoc &&
+		    RTMP_TIME_AFTER(pAd->Mlme.Now32,
+				    pAd->StaCfg.LastMicErrorTime +
+				    (60 * OS_HZ)))
+			pAd->StaCfg.bBlockAssoc = FALSE;
+	}
+
+	if ((pAd->PreMediaState != pAd->IndicateMediaState)
+	    && (pAd->CommonCfg.bWirelessEvent)) {
+		if (pAd->IndicateMediaState == NdisMediaStateConnected) {
+			RTMPSendWirelessEvent(pAd, IW_STA_LINKUP_EVENT_FLAG,
+					      pAd->MacTab.Content[BSSID_WCID].
+					      Addr, BSS0, 0);
 		}
-	} while(FALSE);
+		pAd->PreMediaState = pAd->IndicateMediaState;
+	}
+
+	if (pAd->CommonCfg.PSPXlink && ADHOC_ON(pAd)) {
+	} else {
+		AsicStaBbpTuning(pAd);
+	}
+
+	TxTotalCnt = pAd->RalinkCounters.OneSecTxNoRetryOkCount +
+	    pAd->RalinkCounters.OneSecTxRetryOkCount +
+	    pAd->RalinkCounters.OneSecTxFailCount;
+
+	if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED)) {
+		/* update channel quality for Roaming and UI LinkQuality display */
+		MlmeCalculateChannelQuality(pAd, NULL, pAd->Mlme.Now32);
+	}
+	/* must be AFTER MlmeDynamicTxRateSwitching() because it needs to know if */
+	/* Radio is currently in noisy environment */
+	if (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS))
+		AsicAdjustTxPower(pAd);
+
+	if (INFRA_ON(pAd)) {
+
+		/* Is PSM bit consistent with user power management policy? */
+		/* This is the only place that will set PSM bit ON. */
+		if (!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE))
+			MlmeCheckPsmChange(pAd, pAd->Mlme.Now32);
+
+		pAd->RalinkCounters.LastOneSecTotalTxCount = TxTotalCnt;
+
+		if ((RTMP_TIME_AFTER
+		     (pAd->Mlme.Now32,
+		      pAd->StaCfg.LastBeaconRxTime + (1 * OS_HZ)))
+		    &&
+		    (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS))
+		    &&
+		    (((TxTotalCnt + pAd->RalinkCounters.OneSecRxOkCnt) <
+		      600))) {
+			RTMPSetAGCInitValue(pAd, BW_20);
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("MMCHK - No BEACON. restore R66 to the low bound(%d) \n",
+				  (0x2E + GET_LNA_GAIN(pAd))));
+		}
+		/*if ((pAd->RalinkCounters.OneSecTxNoRetryOkCount == 0) && */
+		/*    (pAd->RalinkCounters.OneSecTxRetryOkCount == 0)) */
+		{
+			if (pAd->CommonCfg.bAPSDCapable
+			    && pAd->CommonCfg.APEdcaParm.bAPSDCapable) {
+				/* When APSD is enabled, the period changes as 20 sec */
+				if ((pAd->Mlme.OneSecPeriodicRound % 20) == 8)
+					RTMPSendNullFrame(pAd,
+							  pAd->CommonCfg.TxRate,
+							  TRUE);
+			} else {
+				/* Send out a NULL frame every 10 sec to inform AP that STA is still alive (Avoid being age out) */
+				if ((pAd->Mlme.OneSecPeriodicRound % 10) == 8) {
+					if (pAd->CommonCfg.bWmmCapable)
+						RTMPSendNullFrame(pAd,
+								  pAd->
+								  CommonCfg.
+								  TxRate, TRUE);
+					else
+						RTMPSendNullFrame(pAd,
+								  pAd->
+								  CommonCfg.
+								  TxRate,
+								  FALSE);
+				}
+			}
+		}
+
+		if (CQI_IS_DEAD(pAd->Mlme.ChannelQuality)) {
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("MMCHK - No BEACON. Dead CQI. Auto Recovery attempt #%ld\n",
+				  pAd->RalinkCounters.BadCQIAutoRecoveryCount));
+
+			/* Lost AP, send disconnect & link down event */
+			LinkDown(pAd, FALSE);
+
+			RtmpOSWrielessEventSend(pAd, SIOCGIWAP, -1, NULL, NULL,
+						0);
+
+			/* RTMPPatchMacBbpBug(pAd); */
+			MlmeAutoReconnectLastSSID(pAd);
+		} else if (CQI_IS_BAD(pAd->Mlme.ChannelQuality)) {
+			pAd->RalinkCounters.BadCQIAutoRecoveryCount++;
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("MMCHK - Bad CQI. Auto Recovery attempt #%ld\n",
+				  pAd->RalinkCounters.BadCQIAutoRecoveryCount));
+			MlmeAutoReconnectLastSSID(pAd);
+		}
+
+		if (pAd->StaCfg.bAutoRoaming) {
+			BOOLEAN rv = FALSE;
+			char dBmToRoam = pAd->StaCfg.dBmToRoam;
+			char MaxRssi = RTMPMaxRssi(pAd,
+						   pAd->StaCfg.RssiSample.
+						   LastRssi0,
+						   pAd->StaCfg.RssiSample.
+						   LastRssi1,
+						   pAd->StaCfg.RssiSample.
+						   LastRssi2);
+
+			/* Scanning, ignore Roaming */
+			if (!RTMP_TEST_FLAG
+			    (pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS)
+			    && (pAd->Mlme.SyncMachine.CurrState == SYNC_IDLE)
+			    && (MaxRssi <= dBmToRoam)) {
+				DBGPRINT(RT_DEBUG_TRACE,
+					 ("Rssi=%d, dBmToRoam=%d\n", MaxRssi,
+					  (char)dBmToRoam));
+
+				/* Add auto seamless roaming */
+				if (rv == FALSE)
+					rv = MlmeCheckForFastRoaming(pAd);
+
+				if (rv == FALSE) {
+					if ((pAd->StaCfg.LastScanTime +
+					     10 * OS_HZ) < pAd->Mlme.Now32) {
+						DBGPRINT(RT_DEBUG_TRACE,
+							 ("MMCHK - Roaming, No eligable entry, try new scan!\n"));
+						pAd->StaCfg.ScanCnt = 2;
+						pAd->StaCfg.LastScanTime =
+						    pAd->Mlme.Now32;
+						MlmeAutoScan(pAd);
+					}
+				}
+			}
+		}
+	} else if (ADHOC_ON(pAd)) {
+		/* If all peers leave, and this STA becomes the last one in this IBSS, then change MediaState */
+		/* to DISCONNECTED. But still holding this IBSS (i.e. sending BEACON) so that other STAs can */
+		/* join later. */
+		if (RTMP_TIME_AFTER
+		    (pAd->Mlme.Now32,
+		     pAd->StaCfg.LastBeaconRxTime + ADHOC_BEACON_LOST_TIME)
+		    && OPSTATUS_TEST_FLAG(pAd,
+					  fOP_STATUS_MEDIA_STATE_CONNECTED)) {
+			struct rt_mlme_start_req StartReq;
+
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("MMCHK - excessive BEACON lost, last STA in this IBSS, MediaState=Disconnected\n"));
+			LinkDown(pAd, FALSE);
+
+			StartParmFill(pAd, &StartReq,
+				      (char *) pAd->MlmeAux.Ssid,
+				      pAd->MlmeAux.SsidLen);
+			MlmeEnqueue(pAd, SYNC_STATE_MACHINE, MT2_MLME_START_REQ,
+				    sizeof(struct rt_mlme_start_req), &StartReq);
+			pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_START;
+		}
+
+		for (i = 1; i < MAX_LEN_OF_MAC_TABLE; i++) {
+			struct rt_mac_table_entry *pEntry = &pAd->MacTab.Content[i];
+
+			if (pEntry->ValidAsCLI == FALSE)
+				continue;
+
+			if (RTMP_TIME_AFTER
+			    (pAd->Mlme.Now32,
+			     pEntry->LastBeaconRxTime + ADHOC_BEACON_LOST_TIME))
+				MacTableDeleteEntry(pAd, pEntry->Aid,
+						    pEntry->Addr);
+		}
+	} else			/* no INFRA nor ADHOC connection */
+	{
+
+		if (pAd->StaCfg.bScanReqIsFromWebUI &&
+		    RTMP_TIME_BEFORE(pAd->Mlme.Now32,
+				     pAd->StaCfg.LastScanTime + (30 * OS_HZ)))
+			goto SKIP_AUTO_SCAN_CONN;
+		else
+			pAd->StaCfg.bScanReqIsFromWebUI = FALSE;
+
+		if ((pAd->StaCfg.bAutoReconnect == TRUE)
+		    && RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_START_UP)
+		    &&
+		    (MlmeValidateSSID
+		     (pAd->MlmeAux.AutoReconnectSsid,
+		      pAd->MlmeAux.AutoReconnectSsidLen) == TRUE)) {
+			if ((pAd->ScanTab.BssNr == 0)
+			    && (pAd->Mlme.CntlMachine.CurrState == CNTL_IDLE)) {
+				struct rt_mlme_scan_req ScanReq;
+
+				if (RTMP_TIME_AFTER
+				    (pAd->Mlme.Now32,
+				     pAd->StaCfg.LastScanTime + (10 * OS_HZ))) {
+					DBGPRINT(RT_DEBUG_TRACE,
+						 ("STAMlmePeriodicExec():CNTL - ScanTab.BssNr==0, start a new ACTIVE scan SSID[%s]\n",
+						  pAd->MlmeAux.
+						  AutoReconnectSsid));
+					ScanParmFill(pAd, &ScanReq,
+						     (char *)pAd->MlmeAux.
+						     AutoReconnectSsid,
+						     pAd->MlmeAux.
+						     AutoReconnectSsidLen,
+						     BSS_ANY, SCAN_ACTIVE);
+					MlmeEnqueue(pAd, SYNC_STATE_MACHINE,
+						    MT2_MLME_SCAN_REQ,
+						    sizeof
+						    (struct rt_mlme_scan_req),
+						    &ScanReq);
+					pAd->Mlme.CntlMachine.CurrState =
+					    CNTL_WAIT_OID_LIST_SCAN;
+					/* Reset Missed scan number */
+					pAd->StaCfg.LastScanTime =
+					    pAd->Mlme.Now32;
+				} else if (pAd->StaCfg.BssType == BSS_ADHOC)	/* Quit the forever scan when in a very clean room */
+					MlmeAutoReconnectLastSSID(pAd);
+			} else if (pAd->Mlme.CntlMachine.CurrState == CNTL_IDLE) {
+				if ((pAd->Mlme.OneSecPeriodicRound % 7) == 0) {
+					MlmeAutoScan(pAd);
+					pAd->StaCfg.LastScanTime =
+					    pAd->Mlme.Now32;
+				} else {
+					MlmeAutoReconnectLastSSID(pAd);
+				}
+			}
+		}
+	}
+
+SKIP_AUTO_SCAN_CONN:
+
+	if ((pAd->MacTab.Content[BSSID_WCID].TXBAbitmap != 0)
+	    && (pAd->MacTab.fAnyBASession == FALSE)) {
+		pAd->MacTab.fAnyBASession = TRUE;
+		AsicUpdateProtect(pAd, HT_FORCERTSCTS, ALLN_SETPROTECT, FALSE,
+				  FALSE);
+	} else if ((pAd->MacTab.Content[BSSID_WCID].TXBAbitmap == 0)
+		   && (pAd->MacTab.fAnyBASession == TRUE)) {
+		pAd->MacTab.fAnyBASession = FALSE;
+		AsicUpdateProtect(pAd,
+				  pAd->MlmeAux.AddHtInfo.AddHtInfo2.
+				  OperaionMode, ALLN_SETPROTECT, FALSE, FALSE);
+	}
+
+	return;
+}
+
+/* Link down report */
+void LinkDownExec(void *SystemSpecific1,
+		  void *FunctionContext,
+		  void *SystemSpecific2, void *SystemSpecific3)
+{
+	struct rt_rtmp_adapter *pAd = (struct rt_rtmp_adapter *)FunctionContext;
+
+	if (pAd != NULL) {
+		struct rt_mlme_disassoc_req DisassocReq;
+
+		if ((pAd->StaCfg.PortSecured == WPA_802_1X_PORT_NOT_SECURED) &&
+		    (INFRA_ON(pAd))) {
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("LinkDownExec(): disassociate with current AP...\n"));
+			DisassocParmFill(pAd, &DisassocReq,
+					 pAd->CommonCfg.Bssid,
+					 REASON_DISASSOC_STA_LEAVING);
+			MlmeEnqueue(pAd, ASSOC_STATE_MACHINE,
+				    MT2_MLME_DISASSOC_REQ,
+				    sizeof(struct rt_mlme_disassoc_req),
+				    &DisassocReq);
+			pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_DISASSOC;
+
+			pAd->IndicateMediaState = NdisMediaStateDisconnected;
+			RTMP_IndicateMediaState(pAd);
+			pAd->ExtraInfo = GENERAL_LINK_DOWN;
+		}
+	}
+}
+
+/* IRQL = DISPATCH_LEVEL */
+void MlmeAutoScan(struct rt_rtmp_adapter *pAd)
+{
+	/* check CntlMachine.CurrState to avoid collision with NDIS SetOID request */
+	if (pAd->Mlme.CntlMachine.CurrState == CNTL_IDLE) {
+		DBGPRINT(RT_DEBUG_TRACE, ("MMCHK - Driver auto scan\n"));
+		MlmeEnqueue(pAd,
+			    MLME_CNTL_STATE_MACHINE,
+			    OID_802_11_BSSID_LIST_SCAN,
+			    pAd->MlmeAux.AutoReconnectSsidLen,
+			    pAd->MlmeAux.AutoReconnectSsid);
+		RTMP_MLME_HANDLER(pAd);
+	}
+}
+
+/* IRQL = DISPATCH_LEVEL */
+void MlmeAutoReconnectLastSSID(struct rt_rtmp_adapter *pAd)
+{
+	if (pAd->StaCfg.bAutoConnectByBssid) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("Driver auto reconnect to last OID_802_11_BSSID setting - %02X:%02X:%02X:%02X:%02X:%02X\n",
+			  pAd->MlmeAux.Bssid[0], pAd->MlmeAux.Bssid[1],
+			  pAd->MlmeAux.Bssid[2], pAd->MlmeAux.Bssid[3],
+			  pAd->MlmeAux.Bssid[4], pAd->MlmeAux.Bssid[5]));
+
+		pAd->MlmeAux.Channel = pAd->CommonCfg.Channel;
+		MlmeEnqueue(pAd,
+			    MLME_CNTL_STATE_MACHINE,
+			    OID_802_11_BSSID, MAC_ADDR_LEN, pAd->MlmeAux.Bssid);
+
+		pAd->Mlme.CntlMachine.CurrState = CNTL_IDLE;
+
+		RTMP_MLME_HANDLER(pAd);
+	}
+	/* check CntlMachine.CurrState to avoid collision with NDIS SetOID request */
+	else if ((pAd->Mlme.CntlMachine.CurrState == CNTL_IDLE) &&
+		 (MlmeValidateSSID
+		  (pAd->MlmeAux.AutoReconnectSsid,
+		   pAd->MlmeAux.AutoReconnectSsidLen) == TRUE)) {
+		struct rt_ndis_802_11_ssid OidSsid;
+		OidSsid.SsidLength = pAd->MlmeAux.AutoReconnectSsidLen;
+		NdisMoveMemory(OidSsid.Ssid, pAd->MlmeAux.AutoReconnectSsid,
+			       pAd->MlmeAux.AutoReconnectSsidLen);
+
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("Driver auto reconnect to last OID_802_11_SSID setting - %s, len - %d\n",
+			  pAd->MlmeAux.AutoReconnectSsid,
+			  pAd->MlmeAux.AutoReconnectSsidLen));
+		MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, OID_802_11_SSID,
+			    sizeof(struct rt_ndis_802_11_ssid), &OidSsid);
+		RTMP_MLME_HANDLER(pAd);
+	}
 }
 
 /*
@@ -1678,47 +1582,50 @@ VOID MlmeSelectTxRateTable(
 	Output:
 	==========================================================================
  */
-VOID MlmeCheckForRoaming(
-	IN PRTMP_ADAPTER pAd,
-	IN ULONG	Now32)
+void MlmeCheckForRoaming(struct rt_rtmp_adapter *pAd, unsigned long Now32)
 {
-	USHORT	   i;
-	BSS_TABLE  *pRoamTab = &pAd->MlmeAux.RoamTab;
-	BSS_ENTRY  *pBss;
+	u16 i;
+	struct rt_bss_table *pRoamTab = &pAd->MlmeAux.RoamTab;
+	struct rt_bss_entry *pBss;
 
 	DBGPRINT(RT_DEBUG_TRACE, ("==> MlmeCheckForRoaming\n"));
-	// put all roaming candidates into RoamTab, and sort in RSSI order
+	/* put all roaming candidates into RoamTab, and sort in RSSI order */
 	BssTableInit(pRoamTab);
-	for (i = 0; i < pAd->ScanTab.BssNr; i++)
-	{
+	for (i = 0; i < pAd->ScanTab.BssNr; i++) {
 		pBss = &pAd->ScanTab.BssEntry[i];
 
-		if ((pBss->LastBeaconRxTime + BEACON_LOST_TIME) < Now32)
-			continue;	 // AP disappear
+		if ((pBss->LastBeaconRxTime + pAd->StaCfg.BeaconLostTime) <
+		    Now32)
+			continue;	/* AP disappear */
 		if (pBss->Rssi <= RSSI_THRESHOLD_FOR_ROAMING)
-			continue;	 // RSSI too weak. forget it.
+			continue;	/* RSSI too weak. forget it. */
 		if (MAC_ADDR_EQUAL(pBss->Bssid, pAd->CommonCfg.Bssid))
-			continue;	 // skip current AP
-		if (pBss->Rssi < (pAd->StaCfg.RssiSample.LastRssi0 + RSSI_DELTA))
-			continue;	 // only AP with stronger RSSI is eligible for roaming
-
-		// AP passing all above rules is put into roaming candidate table
-		NdisMoveMemory(&pRoamTab->BssEntry[pRoamTab->BssNr], pBss, sizeof(BSS_ENTRY));
+			continue;	/* skip current AP */
+		if (pBss->Rssi <
+		    (pAd->StaCfg.RssiSample.LastRssi0 + RSSI_DELTA))
+			continue;	/* only AP with stronger RSSI is eligible for roaming */
+
+		/* AP passing all above rules is put into roaming candidate table */
+		NdisMoveMemory(&pRoamTab->BssEntry[pRoamTab->BssNr], pBss,
+			       sizeof(struct rt_bss_entry));
 		pRoamTab->BssNr += 1;
 	}
 
-	if (pRoamTab->BssNr > 0)
-	{
-		// check CntlMachine.CurrState to avoid collision with NDIS SetOID request
-		if (pAd->Mlme.CntlMachine.CurrState == CNTL_IDLE)
-		{
-			pAd->RalinkCounters.PoorCQIRoamingCount ++;
-			DBGPRINT(RT_DEBUG_TRACE, ("MMCHK - Roaming attempt #%ld\n", pAd->RalinkCounters.PoorCQIRoamingCount));
-			MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_MLME_ROAMING_REQ, 0, NULL);
-			RT28XX_MLME_HANDLER(pAd);
+	if (pRoamTab->BssNr > 0) {
+		/* check CntlMachine.CurrState to avoid collision with NDIS SetOID request */
+		if (pAd->Mlme.CntlMachine.CurrState == CNTL_IDLE) {
+			pAd->RalinkCounters.PoorCQIRoamingCount++;
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("MMCHK - Roaming attempt #%ld\n",
+				  pAd->RalinkCounters.PoorCQIRoamingCount));
+			MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE,
+				    MT2_MLME_ROAMING_REQ, 0, NULL);
+			RTMP_MLME_HANDLER(pAd);
 		}
 	}
-	DBGPRINT(RT_DEBUG_TRACE, ("<== MlmeCheckForRoaming(# of candidate= %d)\n",pRoamTab->BssNr));
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("<== MlmeCheckForRoaming(# of candidate= %d)\n",
+		  pRoamTab->BssNr));
 }
 
 /*
@@ -1733,159 +1640,74 @@ VOID MlmeCheckForRoaming(
 	Output:
 	==========================================================================
  */
-VOID MlmeCheckForFastRoaming(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	ULONG			Now)
+BOOLEAN MlmeCheckForFastRoaming(struct rt_rtmp_adapter *pAd)
 {
-	USHORT		i;
-	BSS_TABLE	*pRoamTab = &pAd->MlmeAux.RoamTab;
-	BSS_ENTRY	*pBss;
+	u16 i;
+	struct rt_bss_table *pRoamTab = &pAd->MlmeAux.RoamTab;
+	struct rt_bss_entry *pBss;
 
 	DBGPRINT(RT_DEBUG_TRACE, ("==> MlmeCheckForFastRoaming\n"));
-	// put all roaming candidates into RoamTab, and sort in RSSI order
+	/* put all roaming candidates into RoamTab, and sort in RSSI order */
 	BssTableInit(pRoamTab);
-	for (i = 0; i < pAd->ScanTab.BssNr; i++)
-	{
+	for (i = 0; i < pAd->ScanTab.BssNr; i++) {
 		pBss = &pAd->ScanTab.BssEntry[i];
 
-        if ((pBss->Rssi <= -50) && (pBss->Channel == pAd->CommonCfg.Channel))
-			continue;	 // RSSI too weak. forget it.
+		if ((pBss->Rssi <= -50)
+		    && (pBss->Channel == pAd->CommonCfg.Channel))
+			continue;	/* RSSI too weak. forget it. */
 		if (MAC_ADDR_EQUAL(pBss->Bssid, pAd->CommonCfg.Bssid))
-			continue;	 // skip current AP
-		if (!SSID_EQUAL(pBss->Ssid, pBss->SsidLen, pAd->CommonCfg.Ssid, pAd->CommonCfg.SsidLen))
-			continue;	 // skip different SSID
-        if (pBss->Rssi < (RTMPMaxRssi(pAd, pAd->StaCfg.RssiSample.LastRssi0, pAd->StaCfg.RssiSample.LastRssi1, pAd->StaCfg.RssiSample.LastRssi2) + RSSI_DELTA))
-			continue;	 // skip AP without better RSSI
-
-        DBGPRINT(RT_DEBUG_TRACE, ("LastRssi0 = %d, pBss->Rssi = %d\n", RTMPMaxRssi(pAd, pAd->StaCfg.RssiSample.LastRssi0, pAd->StaCfg.RssiSample.LastRssi1, pAd->StaCfg.RssiSample.LastRssi2), pBss->Rssi));
-		// AP passing all above rules is put into roaming candidate table
-		NdisMoveMemory(&pRoamTab->BssEntry[pRoamTab->BssNr], pBss, sizeof(BSS_ENTRY));
+			continue;	/* skip current AP */
+		if (!SSID_EQUAL
+		    (pBss->Ssid, pBss->SsidLen, pAd->CommonCfg.Ssid,
+		     pAd->CommonCfg.SsidLen))
+			continue;	/* skip different SSID */
+		if (pBss->Rssi <
+		    (RTMPMaxRssi
+		     (pAd, pAd->StaCfg.RssiSample.LastRssi0,
+		      pAd->StaCfg.RssiSample.LastRssi1,
+		      pAd->StaCfg.RssiSample.LastRssi2) + RSSI_DELTA))
+			continue;	/* skip AP without better RSSI */
+
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("LastRssi0 = %d, pBss->Rssi = %d\n",
+			  RTMPMaxRssi(pAd, pAd->StaCfg.RssiSample.LastRssi0,
+				      pAd->StaCfg.RssiSample.LastRssi1,
+				      pAd->StaCfg.RssiSample.LastRssi2),
+			  pBss->Rssi));
+		/* AP passing all above rules is put into roaming candidate table */
+		NdisMoveMemory(&pRoamTab->BssEntry[pRoamTab->BssNr], pBss,
+			       sizeof(struct rt_bss_entry));
 		pRoamTab->BssNr += 1;
 	}
 
-	if (pRoamTab->BssNr > 0)
-	{
-		// check CntlMachine.CurrState to avoid collision with NDIS SetOID request
-		if (pAd->Mlme.CntlMachine.CurrState == CNTL_IDLE)
-		{
-			pAd->RalinkCounters.PoorCQIRoamingCount ++;
-			DBGPRINT(RT_DEBUG_TRACE, ("MMCHK - Roaming attempt #%ld\n", pAd->RalinkCounters.PoorCQIRoamingCount));
-			MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_MLME_ROAMING_REQ, 0, NULL);
-			RT28XX_MLME_HANDLER(pAd);
-		}
-	}
-	// Maybe site survey required
-	else
-	{
-		if ((pAd->StaCfg.LastScanTime + 10 * 1000) < Now)
-		{
-			// check CntlMachine.CurrState to avoid collision with NDIS SetOID request
-			DBGPRINT(RT_DEBUG_TRACE, ("MMCHK - Roaming, No eligable entry, try new scan!\n"));
-			pAd->StaCfg.ScanCnt = 2;
-			pAd->StaCfg.LastScanTime = Now;
-			MlmeAutoScan(pAd);
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("<== MlmeCheckForFastRoaming (BssNr=%d)\n", pRoamTab->BssNr));
+	if (pRoamTab->BssNr > 0) {
+		/* check CntlMachine.CurrState to avoid collision with NDIS SetOID request */
+		if (pAd->Mlme.CntlMachine.CurrState == CNTL_IDLE) {
+			pAd->RalinkCounters.PoorCQIRoamingCount++;
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("MMCHK - Roaming attempt #%ld\n",
+				  pAd->RalinkCounters.PoorCQIRoamingCount));
+			MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE,
+				    MT2_MLME_ROAMING_REQ, 0, NULL);
+			RTMP_MLME_HANDLER(pAd);
+			return TRUE;
 		}
 	}
 
-    DBGPRINT(RT_DEBUG_TRACE, ("<== MlmeCheckForFastRoaming (BssNr=%d)\n", pRoamTab->BssNr));
-}
-
-/*
-	==========================================================================
-	Description:
-		This routine calculates TxPER, RxPER of the past N-sec period. And
-		according to the calculation result, ChannelQuality is calculated here
-		to decide if current AP is still doing the job.
-
-		If ChannelQuality is not good, a ROAMing attempt may be tried later.
-	Output:
-		StaCfg.ChannelQuality - 0..100
-
-	IRQL = DISPATCH_LEVEL
-
-	NOTE: This routine decide channle quality based on RX CRC error ratio.
-		Caller should make sure a function call to NICUpdateRawCounters(pAd)
-		is performed right before this routine, so that this routine can decide
-		channel quality based on the most up-to-date information
-	==========================================================================
- */
-VOID MlmeCalculateChannelQuality(
-	IN PRTMP_ADAPTER pAd,
-	IN ULONG Now32)
-{
-	ULONG TxOkCnt, TxCnt, TxPER, TxPRR;
-	ULONG RxCnt, RxPER;
-	UCHAR NorRssi;
-	CHAR  MaxRssi;
-	ULONG BeaconLostTime = BEACON_LOST_TIME;
-
-	MaxRssi = RTMPMaxRssi(pAd, pAd->StaCfg.RssiSample.LastRssi0, pAd->StaCfg.RssiSample.LastRssi1, pAd->StaCfg.RssiSample.LastRssi2);
-
-	//
-	// calculate TX packet error ratio and TX retry ratio - if too few TX samples, skip TX related statistics
-	//
-	TxOkCnt = pAd->RalinkCounters.OneSecTxNoRetryOkCount + pAd->RalinkCounters.OneSecTxRetryOkCount;
-	TxCnt = TxOkCnt + pAd->RalinkCounters.OneSecTxFailCount;
-	if (TxCnt < 5)
-	{
-		TxPER = 0;
-		TxPRR = 0;
-	}
-	else
-	{
-		TxPER = (pAd->RalinkCounters.OneSecTxFailCount * 100) / TxCnt;
-		TxPRR = ((TxCnt - pAd->RalinkCounters.OneSecTxNoRetryOkCount) * 100) / TxCnt;
-	}
-
-	//
-	// calculate RX PER - don't take RxPER into consideration if too few sample
-	//
-	RxCnt = pAd->RalinkCounters.OneSecRxOkCnt + pAd->RalinkCounters.OneSecRxFcsErrCnt;
-	if (RxCnt < 5)
-		RxPER = 0;
-	else
-		RxPER = (pAd->RalinkCounters.OneSecRxFcsErrCnt * 100) / RxCnt;
-
-	//
-	// decide ChannelQuality based on: 1)last BEACON received time, 2)last RSSI, 3)TxPER, and 4)RxPER
-	//
-	if (INFRA_ON(pAd) &&
-		(pAd->RalinkCounters.OneSecTxNoRetryOkCount < 2) && // no heavy traffic
-		(pAd->StaCfg.LastBeaconRxTime + BeaconLostTime < Now32))
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("BEACON lost > %ld msec with TxOkCnt=%ld -> CQI=0\n", BeaconLostTime, TxOkCnt));
-		pAd->Mlme.ChannelQuality = 0;
-	}
-	else
-	{
-		// Normalize Rssi
-		if (MaxRssi > -40)
-			NorRssi = 100;
-		else if (MaxRssi < -90)
-			NorRssi = 0;
-		else
-			NorRssi = (MaxRssi + 90) * 2;
-
-		// ChannelQuality = W1*RSSI + W2*TxPRR + W3*RxPER	 (RSSI 0..100), (TxPER 100..0), (RxPER 100..0)
-		pAd->Mlme.ChannelQuality = (RSSI_WEIGHTING * NorRssi +
-								   TX_WEIGHTING * (100 - TxPRR) +
-								   RX_WEIGHTING* (100 - RxPER)) / 100;
-		if (pAd->Mlme.ChannelQuality >= 100)
-			pAd->Mlme.ChannelQuality = 100;
-	}
-
+	return FALSE;
 }
 
-VOID MlmeSetTxRate(
-	IN PRTMP_ADAPTER		pAd,
-	IN PMAC_TABLE_ENTRY		pEntry,
-	IN PRTMP_TX_RATE_SWITCH	pTxRate)
+void MlmeSetTxRate(struct rt_rtmp_adapter *pAd,
+		   struct rt_mac_table_entry *pEntry, struct rt_rtmp_tx_rate_switch * pTxRate)
 {
-	UCHAR	MaxMode = MODE_OFDM;
+	u8 MaxMode = MODE_OFDM;
 
 	MaxMode = MODE_HTGREENFIELD;
 
-	if (pTxRate->STBC && (pAd->StaCfg.MaxHTPhyMode.field.STBC) && (pAd->Antenna.field.TxPath == 2))
+	if (pTxRate->STBC && (pAd->StaCfg.MaxHTPhyMode.field.STBC)
+	    && (pAd->Antenna.field.TxPath == 2))
 		pAd->StaCfg.HTPhyMode.field.STBC = STBC_USE;
 	else
 		pAd->StaCfg.HTPhyMode.field.STBC = STBC_NONE;
@@ -1896,87 +1718,109 @@ VOID MlmeSetTxRate(
 	if (pAd->StaCfg.HTPhyMode.field.MCS > 7)
 		pAd->StaCfg.HTPhyMode.field.STBC = STBC_NONE;
 
-   	if (ADHOC_ON(pAd))
-	{
-		// If peer adhoc is b-only mode, we can't send 11g rate.
+	if (ADHOC_ON(pAd)) {
+		/* If peer adhoc is b-only mode, we can't send 11g rate. */
 		pAd->StaCfg.HTPhyMode.field.ShortGI = GI_800;
-		pEntry->HTPhyMode.field.STBC	= STBC_NONE;
+		pEntry->HTPhyMode.field.STBC = STBC_NONE;
 
-		//
-		// For Adhoc MODE_CCK, driver will use AdhocBOnlyJoined flag to roll back to B only if necessary
-		//
-		pEntry->HTPhyMode.field.MODE	= pTxRate->Mode;
-		pEntry->HTPhyMode.field.ShortGI	= pAd->StaCfg.HTPhyMode.field.ShortGI;
-		pEntry->HTPhyMode.field.MCS		= pAd->StaCfg.HTPhyMode.field.MCS;
+		/* */
+		/* For Adhoc MODE_CCK, driver will use AdhocBOnlyJoined flag to roll back to B only if necessary */
+		/* */
+		pEntry->HTPhyMode.field.MODE = pTxRate->Mode;
+		pEntry->HTPhyMode.field.ShortGI =
+		    pAd->StaCfg.HTPhyMode.field.ShortGI;
+		pEntry->HTPhyMode.field.MCS = pAd->StaCfg.HTPhyMode.field.MCS;
 
-		// Patch speed error in status page
+		/* Patch speed error in status page */
 		pAd->StaCfg.HTPhyMode.field.MODE = pEntry->HTPhyMode.field.MODE;
-	}
-	else
-	{
+	} else {
 		if (pTxRate->Mode <= MaxMode)
 			pAd->StaCfg.HTPhyMode.field.MODE = pTxRate->Mode;
 
-		if (pTxRate->ShortGI && (pAd->StaCfg.MaxHTPhyMode.field.ShortGI))
+		if (pTxRate->ShortGI
+		    && (pAd->StaCfg.MaxHTPhyMode.field.ShortGI))
 			pAd->StaCfg.HTPhyMode.field.ShortGI = GI_400;
 		else
 			pAd->StaCfg.HTPhyMode.field.ShortGI = GI_800;
 
-		// Reexam each bandwidth's SGI support.
-		if (pAd->StaCfg.HTPhyMode.field.ShortGI == GI_400)
-		{
-			if ((pEntry->HTPhyMode.field.BW == BW_20) && (!CLIENT_STATUS_TEST_FLAG(pEntry, fCLIENT_STATUS_SGI20_CAPABLE)))
+		/* Reexam each bandwidth's SGI support. */
+		if (pAd->StaCfg.HTPhyMode.field.ShortGI == GI_400) {
+			if ((pEntry->HTPhyMode.field.BW == BW_20)
+			    &&
+			    (!CLIENT_STATUS_TEST_FLAG
+			     (pEntry, fCLIENT_STATUS_SGI20_CAPABLE)))
 				pAd->StaCfg.HTPhyMode.field.ShortGI = GI_800;
-			if ((pEntry->HTPhyMode.field.BW == BW_40) && (!CLIENT_STATUS_TEST_FLAG(pEntry, fCLIENT_STATUS_SGI40_CAPABLE)))
+			if ((pEntry->HTPhyMode.field.BW == BW_40)
+			    &&
+			    (!CLIENT_STATUS_TEST_FLAG
+			     (pEntry, fCLIENT_STATUS_SGI40_CAPABLE)))
 				pAd->StaCfg.HTPhyMode.field.ShortGI = GI_800;
 		}
-
-		// Turn RTS/CTS rate to 6Mbps.
-		if ((pEntry->HTPhyMode.field.MCS == 0) && (pAd->StaCfg.HTPhyMode.field.MCS != 0))
-		{
-			pEntry->HTPhyMode.field.MCS		= pAd->StaCfg.HTPhyMode.field.MCS;
-			if (pAd->MacTab.fAnyBASession)
-			{
-				AsicUpdateProtect(pAd, HT_FORCERTSCTS, ALLN_SETPROTECT, TRUE, (BOOLEAN)pAd->MlmeAux.AddHtInfo.AddHtInfo2.NonGfPresent);
+		/* Turn RTS/CTS rate to 6Mbps. */
+		if ((pEntry->HTPhyMode.field.MCS == 0)
+		    && (pAd->StaCfg.HTPhyMode.field.MCS != 0)) {
+			pEntry->HTPhyMode.field.MCS =
+			    pAd->StaCfg.HTPhyMode.field.MCS;
+			if (pAd->MacTab.fAnyBASession) {
+				AsicUpdateProtect(pAd, HT_FORCERTSCTS,
+						  ALLN_SETPROTECT, TRUE,
+						  (BOOLEAN) pAd->MlmeAux.
+						  AddHtInfo.AddHtInfo2.
+						  NonGfPresent);
+			} else {
+				AsicUpdateProtect(pAd,
+						  pAd->MlmeAux.AddHtInfo.
+						  AddHtInfo2.OperaionMode,
+						  ALLN_SETPROTECT, TRUE,
+						  (BOOLEAN) pAd->MlmeAux.
+						  AddHtInfo.AddHtInfo2.
+						  NonGfPresent);
 			}
-			else
-			{
-				AsicUpdateProtect(pAd, pAd->MlmeAux.AddHtInfo.AddHtInfo2.OperaionMode, ALLN_SETPROTECT, TRUE, (BOOLEAN)pAd->MlmeAux.AddHtInfo.AddHtInfo2.NonGfPresent);
+		} else if ((pEntry->HTPhyMode.field.MCS == 8)
+			   && (pAd->StaCfg.HTPhyMode.field.MCS != 8)) {
+			pEntry->HTPhyMode.field.MCS =
+			    pAd->StaCfg.HTPhyMode.field.MCS;
+			if (pAd->MacTab.fAnyBASession) {
+				AsicUpdateProtect(pAd, HT_FORCERTSCTS,
+						  ALLN_SETPROTECT, TRUE,
+						  (BOOLEAN) pAd->MlmeAux.
+						  AddHtInfo.AddHtInfo2.
+						  NonGfPresent);
+			} else {
+				AsicUpdateProtect(pAd,
+						  pAd->MlmeAux.AddHtInfo.
+						  AddHtInfo2.OperaionMode,
+						  ALLN_SETPROTECT, TRUE,
+						  (BOOLEAN) pAd->MlmeAux.
+						  AddHtInfo.AddHtInfo2.
+						  NonGfPresent);
 			}
-		}
-		else if ((pEntry->HTPhyMode.field.MCS == 8) && (pAd->StaCfg.HTPhyMode.field.MCS != 8))
-		{
-			pEntry->HTPhyMode.field.MCS		= pAd->StaCfg.HTPhyMode.field.MCS;
-			if (pAd->MacTab.fAnyBASession)
-			{
-				AsicUpdateProtect(pAd, HT_FORCERTSCTS, ALLN_SETPROTECT, TRUE, (BOOLEAN)pAd->MlmeAux.AddHtInfo.AddHtInfo2.NonGfPresent);
-			}
-			else
-			{
-				AsicUpdateProtect(pAd, pAd->MlmeAux.AddHtInfo.AddHtInfo2.OperaionMode, ALLN_SETPROTECT, TRUE, (BOOLEAN)pAd->MlmeAux.AddHtInfo.AddHtInfo2.NonGfPresent);
-			}
-		}
-		else if ((pEntry->HTPhyMode.field.MCS != 0) && (pAd->StaCfg.HTPhyMode.field.MCS == 0))
-		{
-			AsicUpdateProtect(pAd, HT_RTSCTS_6M, ALLN_SETPROTECT, TRUE, (BOOLEAN)pAd->MlmeAux.AddHtInfo.AddHtInfo2.NonGfPresent);
-
-		}
-		else if ((pEntry->HTPhyMode.field.MCS != 8) && (pAd->StaCfg.HTPhyMode.field.MCS == 8))
-		{
-			AsicUpdateProtect(pAd, HT_RTSCTS_6M, ALLN_SETPROTECT, TRUE, (BOOLEAN)pAd->MlmeAux.AddHtInfo.AddHtInfo2.NonGfPresent);
-		}
-
-		pEntry->HTPhyMode.field.STBC	= pAd->StaCfg.HTPhyMode.field.STBC;
-		pEntry->HTPhyMode.field.ShortGI	= pAd->StaCfg.HTPhyMode.field.ShortGI;
-		pEntry->HTPhyMode.field.MCS		= pAd->StaCfg.HTPhyMode.field.MCS;
-		pEntry->HTPhyMode.field.MODE	= pAd->StaCfg.HTPhyMode.field.MODE;
-
-		if ((pAd->StaCfg.MaxHTPhyMode.field.MODE == MODE_HTGREENFIELD) &&
-		    pAd->WIFItestbed.bGreenField)
-		    pEntry->HTPhyMode.field.MODE = MODE_HTGREENFIELD;
-	}
-
-	pAd->LastTxRate = (USHORT)(pEntry->HTPhyMode.word);
+		} else if ((pEntry->HTPhyMode.field.MCS != 0)
+			   && (pAd->StaCfg.HTPhyMode.field.MCS == 0)) {
+			AsicUpdateProtect(pAd, HT_RTSCTS_6M, ALLN_SETPROTECT,
+					  TRUE,
+					  (BOOLEAN) pAd->MlmeAux.AddHtInfo.
+					  AddHtInfo2.NonGfPresent);
+
+		} else if ((pEntry->HTPhyMode.field.MCS != 8)
+			   && (pAd->StaCfg.HTPhyMode.field.MCS == 8)) {
+			AsicUpdateProtect(pAd, HT_RTSCTS_6M, ALLN_SETPROTECT,
+					  TRUE,
+					  (BOOLEAN) pAd->MlmeAux.AddHtInfo.
+					  AddHtInfo2.NonGfPresent);
+		}
+
+		pEntry->HTPhyMode.field.STBC = pAd->StaCfg.HTPhyMode.field.STBC;
+		pEntry->HTPhyMode.field.ShortGI =
+		    pAd->StaCfg.HTPhyMode.field.ShortGI;
+		pEntry->HTPhyMode.field.MCS = pAd->StaCfg.HTPhyMode.field.MCS;
+		pEntry->HTPhyMode.field.MODE = pAd->StaCfg.HTPhyMode.field.MODE;
+		if ((pAd->StaCfg.MaxHTPhyMode.field.MODE == MODE_HTGREENFIELD)
+		    && pAd->WIFItestbed.bGreenField)
+			pEntry->HTPhyMode.field.MODE = MODE_HTGREENFIELD;
+	}
+
+	pAd->LastTxRate = (u16)(pEntry->HTPhyMode.word);
 }
 
 /*
@@ -1996,47 +1840,39 @@ VOID MlmeSetTxRate(
 		call this routine every second
 	==========================================================================
  */
-VOID MlmeDynamicTxRateSwitching(
-	IN PRTMP_ADAPTER pAd)
+void MlmeDynamicTxRateSwitching(struct rt_rtmp_adapter *pAd)
 {
-	UCHAR					UpRateIdx = 0, DownRateIdx = 0, CurrRateIdx;
-	ULONG					i, AccuTxTotalCnt = 0, TxTotalCnt;
-	ULONG					TxErrorRatio = 0;
-	BOOLEAN					bTxRateChanged, bUpgradeQuality = FALSE;
-	PRTMP_TX_RATE_SWITCH	pCurrTxRate, pNextTxRate = NULL;
-	PUCHAR					pTable;
-	UCHAR					TableSize = 0;
-	UCHAR					InitTxRateIdx = 0, TrainUp, TrainDown;
-	CHAR					Rssi, RssiOffset = 0;
-	TX_STA_CNT1_STRUC		StaTx1;
-	TX_STA_CNT0_STRUC		TxStaCnt0;
-	ULONG					TxRetransmit = 0, TxSuccess = 0, TxFailCount = 0;
-	MAC_TABLE_ENTRY			*pEntry;
-
-	//
-	// walk through MAC table, see if need to change AP's TX rate toward each entry
-	//
-   	for (i = 1; i < MAX_LEN_OF_MAC_TABLE; i++)
-	{
+	u8 UpRateIdx = 0, DownRateIdx = 0, CurrRateIdx;
+	unsigned long i, AccuTxTotalCnt = 0, TxTotalCnt;
+	unsigned long TxErrorRatio = 0;
+	BOOLEAN bTxRateChanged = FALSE, bUpgradeQuality = FALSE;
+	struct rt_rtmp_tx_rate_switch *pCurrTxRate, *pNextTxRate = NULL;
+	u8 *pTable;
+	u8 TableSize = 0;
+	u8 InitTxRateIdx = 0, TrainUp, TrainDown;
+	char Rssi, RssiOffset = 0;
+	TX_STA_CNT1_STRUC StaTx1;
+	TX_STA_CNT0_STRUC TxStaCnt0;
+	unsigned long TxRetransmit = 0, TxSuccess = 0, TxFailCount = 0;
+	struct rt_mac_table_entry *pEntry;
+	struct rt_rssi_sample *pRssi = &pAd->StaCfg.RssiSample;
+
+	/* */
+	/* walk through MAC table, see if need to change AP's TX rate toward each entry */
+	/* */
+	for (i = 1; i < MAX_LEN_OF_MAC_TABLE; i++) {
 		pEntry = &pAd->MacTab.Content[i];
 
-		// check if this entry need to switch rate automatically
+		/* check if this entry need to switch rate automatically */
 		if (RTMPCheckEntryEnableAutoRateSwitch(pAd, pEntry) == FALSE)
 			continue;
 
-		if ((pAd->MacTab.Size == 1) || (pEntry->ValidAsDls))
-		{
-#ifdef RT2860
-			Rssi = RTMPMaxRssi(pAd, (CHAR)pAd->StaCfg.RssiSample.AvgRssi0, (CHAR)pAd->StaCfg.RssiSample.AvgRssi1, (CHAR)pAd->StaCfg.RssiSample.AvgRssi2);
-#endif
-#ifdef RT2870
+		if ((pAd->MacTab.Size == 1) || (pEntry->ValidAsDls)) {
 			Rssi = RTMPMaxRssi(pAd,
-							   pAd->StaCfg.RssiSample.AvgRssi0,
-							   pAd->StaCfg.RssiSample.AvgRssi1,
-							   pAd->StaCfg.RssiSample.AvgRssi2);
-#endif
+					   pRssi->AvgRssi0,
+					   pRssi->AvgRssi1, pRssi->AvgRssi2);
 
-			// Update statistic counter
+			/* Update statistic counter */
 			RTMP_IO_READ32(pAd, TX_STA_CNT0, &TxStaCnt0.word);
 			RTMP_IO_READ32(pAd, TX_STA_CNT1, &StaTx1.word);
 			pAd->bUpdateBcnCntDone = TRUE;
@@ -2045,291 +1881,293 @@ VOID MlmeDynamicTxRateSwitching(
 			TxFailCount = TxStaCnt0.field.TxFailCount;
 			TxTotalCnt = TxRetransmit + TxSuccess + TxFailCount;
 
-			pAd->RalinkCounters.OneSecTxRetryOkCount += StaTx1.field.TxRetransmit;
-			pAd->RalinkCounters.OneSecTxNoRetryOkCount += StaTx1.field.TxSuccess;
-			pAd->RalinkCounters.OneSecTxFailCount += TxStaCnt0.field.TxFailCount;
-			pAd->WlanCounters.TransmittedFragmentCount.u.LowPart += StaTx1.field.TxSuccess;
-			pAd->WlanCounters.RetryCount.u.LowPart += StaTx1.field.TxRetransmit;
-			pAd->WlanCounters.FailedCount.u.LowPart += TxStaCnt0.field.TxFailCount;
-
-			// if no traffic in the past 1-sec period, don't change TX rate,
-			// but clear all bad history. because the bad history may affect the next
-			// Chariot throughput test
-			AccuTxTotalCnt = pAd->RalinkCounters.OneSecTxNoRetryOkCount +
-						 pAd->RalinkCounters.OneSecTxRetryOkCount +
-						 pAd->RalinkCounters.OneSecTxFailCount;
+			pAd->RalinkCounters.OneSecTxRetryOkCount +=
+			    StaTx1.field.TxRetransmit;
+			pAd->RalinkCounters.OneSecTxNoRetryOkCount +=
+			    StaTx1.field.TxSuccess;
+			pAd->RalinkCounters.OneSecTxFailCount +=
+			    TxStaCnt0.field.TxFailCount;
+			pAd->WlanCounters.TransmittedFragmentCount.u.LowPart +=
+			    StaTx1.field.TxSuccess;
+			pAd->WlanCounters.RetryCount.u.LowPart +=
+			    StaTx1.field.TxRetransmit;
+			pAd->WlanCounters.FailedCount.u.LowPart +=
+			    TxStaCnt0.field.TxFailCount;
+
+			/* if no traffic in the past 1-sec period, don't change TX rate, */
+			/* but clear all bad history. because the bad history may affect the next */
+			/* Chariot throughput test */
+			AccuTxTotalCnt =
+			    pAd->RalinkCounters.OneSecTxNoRetryOkCount +
+			    pAd->RalinkCounters.OneSecTxRetryOkCount +
+			    pAd->RalinkCounters.OneSecTxFailCount;
 
 			if (TxTotalCnt)
-				TxErrorRatio = ((TxRetransmit + TxFailCount) * 100) / TxTotalCnt;
-		}
-		else
-		{
-#ifdef RT2860
-			Rssi = RTMPMaxRssi(pAd, (CHAR)pEntry->RssiSample.AvgRssi0, (CHAR)pEntry->RssiSample.AvgRssi1, (CHAR)pEntry->RssiSample.AvgRssi2);
-#endif
-#ifdef RT2870
+				TxErrorRatio =
+				    ((TxRetransmit +
+				      TxFailCount) * 100) / TxTotalCnt;
+		} else {
 			if (INFRA_ON(pAd) && (i == 1))
 				Rssi = RTMPMaxRssi(pAd,
-								   pAd->StaCfg.RssiSample.AvgRssi0,
-								   pAd->StaCfg.RssiSample.AvgRssi1,
-								   pAd->StaCfg.RssiSample.AvgRssi2);
+						   pRssi->AvgRssi0,
+						   pRssi->AvgRssi1,
+						   pRssi->AvgRssi2);
 			else
 				Rssi = RTMPMaxRssi(pAd,
-								   pEntry->RssiSample.AvgRssi0,
-								   pEntry->RssiSample.AvgRssi1,
-								   pEntry->RssiSample.AvgRssi2);
-#endif
+						   pEntry->RssiSample.AvgRssi0,
+						   pEntry->RssiSample.AvgRssi1,
+						   pEntry->RssiSample.AvgRssi2);
 
 			TxTotalCnt = pEntry->OneSecTxNoRetryOkCount +
-				 pEntry->OneSecTxRetryOkCount +
-				 pEntry->OneSecTxFailCount;
+			    pEntry->OneSecTxRetryOkCount +
+			    pEntry->OneSecTxFailCount;
 
 			if (TxTotalCnt)
-				TxErrorRatio = ((pEntry->OneSecTxRetryOkCount + pEntry->OneSecTxFailCount) * 100) / TxTotalCnt;
+				TxErrorRatio =
+				    ((pEntry->OneSecTxRetryOkCount +
+				      pEntry->OneSecTxFailCount) * 100) /
+				    TxTotalCnt;
+		}
+
+		if (TxTotalCnt) {
+			/*
+			   Three AdHoc connections can not work normally if one AdHoc connection is disappeared from a heavy traffic environment generated by ping tool
+			   We force to set LongRtyLimit and ShortRtyLimit to 0 to stop retransmitting packet, after a while, resoring original settings
+			 */
+			if (TxErrorRatio == 100) {
+				TX_RTY_CFG_STRUC TxRtyCfg, TxRtyCfgtmp;
+				unsigned long Index;
+				unsigned long MACValue;
+
+				RTMP_IO_READ32(pAd, TX_RTY_CFG, &TxRtyCfg.word);
+				TxRtyCfgtmp.word = TxRtyCfg.word;
+				TxRtyCfg.field.LongRtyLimit = 0x0;
+				TxRtyCfg.field.ShortRtyLimit = 0x0;
+				RTMP_IO_WRITE32(pAd, TX_RTY_CFG, TxRtyCfg.word);
+
+				RTMPusecDelay(1);
+
+				Index = 0;
+				MACValue = 0;
+				do {
+					RTMP_IO_READ32(pAd, TXRXQ_PCNT,
+						       &MACValue);
+					if ((MACValue & 0xffffff) == 0)
+						break;
+					Index++;
+					RTMPusecDelay(1000);
+				} while ((Index < 330)
+					 &&
+					 (!RTMP_TEST_FLAG
+					  (pAd,
+					   fRTMP_ADAPTER_HALT_IN_PROGRESS)));
+
+				RTMP_IO_READ32(pAd, TX_RTY_CFG, &TxRtyCfg.word);
+				TxRtyCfg.field.LongRtyLimit =
+				    TxRtyCfgtmp.field.LongRtyLimit;
+				TxRtyCfg.field.ShortRtyLimit =
+				    TxRtyCfgtmp.field.ShortRtyLimit;
+				RTMP_IO_WRITE32(pAd, TX_RTY_CFG, TxRtyCfg.word);
+			}
 		}
 
 		CurrRateIdx = pEntry->CurrTxRateIndex;
 
-		MlmeSelectTxRateTable(pAd, pEntry, &pTable, &TableSize, &InitTxRateIdx);
+		MlmeSelectTxRateTable(pAd, pEntry, &pTable, &TableSize,
+				      &InitTxRateIdx);
 
-		if (CurrRateIdx >= TableSize)
-		{
+		if (CurrRateIdx >= TableSize) {
 			CurrRateIdx = TableSize - 1;
 		}
-
-		// When switch from Fixed rate -> auto rate, the REAL TX rate might be different from pAd->CommonCfg.TxRateIndex.
-		// So need to sync here.
-		pCurrTxRate = (PRTMP_TX_RATE_SWITCH) &pTable[(CurrRateIdx+1)*5];
+		/* When switch from Fixed rate -> auto rate, the REAL TX rate might be different from pAd->CommonCfg.TxRateIndex. */
+		/* So need to sync here. */
+		pCurrTxRate =
+		    (struct rt_rtmp_tx_rate_switch *) & pTable[(CurrRateIdx + 1) * 5];
 		if ((pEntry->HTPhyMode.field.MCS != pCurrTxRate->CurrMCS)
-			//&& (pAd->StaCfg.bAutoTxRateSwitch == TRUE)
-			)
-		{
-
-			// Need to sync Real Tx rate and our record.
-			// Then return for next DRS.
-			pCurrTxRate = (PRTMP_TX_RATE_SWITCH) &pTable[(InitTxRateIdx+1)*5];
+		    /*&& (pAd->StaCfg.bAutoTxRateSwitch == TRUE) */
+		    ) {
+
+			/* Need to sync Real Tx rate and our record. */
+			/* Then return for next DRS. */
+			pCurrTxRate =
+			    (struct rt_rtmp_tx_rate_switch *) & pTable[(InitTxRateIdx + 1)
+							    * 5];
 			pEntry->CurrTxRateIndex = InitTxRateIdx;
 			MlmeSetTxRate(pAd, pEntry, pCurrTxRate);
 
-			// reset all OneSecTx counters
+			/* reset all OneSecTx counters */
 			RESET_ONE_SEC_TX_CNT(pEntry);
 			continue;
 		}
-
-		// decide the next upgrade rate and downgrade rate, if any
-		if ((CurrRateIdx > 0) && (CurrRateIdx < (TableSize - 1)))
-		{
+		/* decide the next upgrade rate and downgrade rate, if any */
+		if ((CurrRateIdx > 0) && (CurrRateIdx < (TableSize - 1))) {
 			UpRateIdx = CurrRateIdx + 1;
-			DownRateIdx = CurrRateIdx -1;
-		}
-		else if (CurrRateIdx == 0)
-		{
+			DownRateIdx = CurrRateIdx - 1;
+		} else if (CurrRateIdx == 0) {
 			UpRateIdx = CurrRateIdx + 1;
 			DownRateIdx = CurrRateIdx;
-		}
-		else if (CurrRateIdx == (TableSize - 1))
-		{
+		} else if (CurrRateIdx == (TableSize - 1)) {
 			UpRateIdx = CurrRateIdx;
 			DownRateIdx = CurrRateIdx - 1;
 		}
 
-		pCurrTxRate = (PRTMP_TX_RATE_SWITCH) &pTable[(CurrRateIdx+1)*5];
-
-		if ((Rssi > -65) && (pCurrTxRate->Mode >= MODE_HTMIX))
-		{
-			TrainUp		= (pCurrTxRate->TrainUp + (pCurrTxRate->TrainUp >> 1));
-			TrainDown	= (pCurrTxRate->TrainDown + (pCurrTxRate->TrainDown >> 1));
-		}
-		else
-		{
-			TrainUp		= pCurrTxRate->TrainUp;
-			TrainDown	= pCurrTxRate->TrainDown;
-		}
-
-		//pAd->DrsCounters.LastTimeTxRateChangeAction = pAd->DrsCounters.LastSecTxRateChangeAction;
-
-		//
-		// Keep the last time TxRateChangeAction status.
-		//
-		pEntry->LastTimeTxRateChangeAction = pEntry->LastSecTxRateChangeAction;
-
-
-
-		//
-		// CASE 1. when TX samples are fewer than 15, then decide TX rate solely on RSSI
-		//         (criteria copied from RT2500 for Netopia case)
-		//
-		if (TxTotalCnt <= 15)
-		{
-			CHAR	idx = 0;
-			UCHAR	TxRateIdx;
-			//UCHAR	MCS0 = 0, MCS1 = 0, MCS2 = 0, MCS3 = 0, MCS4 = 0, MCS7 = 0, MCS12 = 0, MCS13 = 0, MCS14 = 0, MCS15 = 0;
-			UCHAR	MCS0 = 0, MCS1 = 0, MCS2 = 0, MCS3 = 0, MCS4 = 0,  MCS5 =0, MCS6 = 0, MCS7 = 0;
-	        UCHAR	MCS12 = 0, MCS13 = 0, MCS14 = 0, MCS15 = 0;
-			UCHAR	MCS20 = 0, MCS21 = 0, MCS22 = 0, MCS23 = 0; // 3*3
-
-			// check the existence and index of each needed MCS
-			while (idx < pTable[0])
-			{
-				pCurrTxRate = (PRTMP_TX_RATE_SWITCH) &pTable[(idx+1)*5];
-
-				if (pCurrTxRate->CurrMCS == MCS_0)
-				{
+		pCurrTxRate =
+		    (struct rt_rtmp_tx_rate_switch *) & pTable[(CurrRateIdx + 1) * 5];
+
+		if ((Rssi > -65) && (pCurrTxRate->Mode >= MODE_HTMIX)) {
+			TrainUp =
+			    (pCurrTxRate->TrainUp +
+			     (pCurrTxRate->TrainUp >> 1));
+			TrainDown =
+			    (pCurrTxRate->TrainDown +
+			     (pCurrTxRate->TrainDown >> 1));
+		} else {
+			TrainUp = pCurrTxRate->TrainUp;
+			TrainDown = pCurrTxRate->TrainDown;
+		}
+
+		/*pAd->DrsCounters.LastTimeTxRateChangeAction = pAd->DrsCounters.LastSecTxRateChangeAction; */
+
+		/* */
+		/* Keep the last time TxRateChangeAction status. */
+		/* */
+		pEntry->LastTimeTxRateChangeAction =
+		    pEntry->LastSecTxRateChangeAction;
+
+		/* */
+		/* CASE 1. when TX samples are fewer than 15, then decide TX rate solely on RSSI */
+		/*         (criteria copied from RT2500 for Netopia case) */
+		/* */
+		if (TxTotalCnt <= 15) {
+			char idx = 0;
+			u8 TxRateIdx;
+			u8 MCS0 = 0, MCS1 = 0, MCS2 = 0, MCS3 = 0, MCS4 =
+			    0, MCS5 = 0, MCS6 = 0, MCS7 = 0;
+			u8 MCS12 = 0, MCS13 = 0, MCS14 = 0, MCS15 = 0;
+			u8 MCS20 = 0, MCS21 = 0, MCS22 = 0, MCS23 = 0;	/* 3*3 */
+
+			/* check the existence and index of each needed MCS */
+			while (idx < pTable[0]) {
+				pCurrTxRate =
+				    (struct rt_rtmp_tx_rate_switch *) & pTable[(idx + 1) *
+								    5];
+
+				if (pCurrTxRate->CurrMCS == MCS_0) {
 					MCS0 = idx;
-				}
-				else if (pCurrTxRate->CurrMCS == MCS_1)
-				{
+				} else if (pCurrTxRate->CurrMCS == MCS_1) {
 					MCS1 = idx;
-				}
-				else if (pCurrTxRate->CurrMCS == MCS_2)
-				{
+				} else if (pCurrTxRate->CurrMCS == MCS_2) {
 					MCS2 = idx;
-				}
-				else if (pCurrTxRate->CurrMCS == MCS_3)
-				{
+				} else if (pCurrTxRate->CurrMCS == MCS_3) {
 					MCS3 = idx;
-				}
-				else if (pCurrTxRate->CurrMCS == MCS_4)
-				{
+				} else if (pCurrTxRate->CurrMCS == MCS_4) {
 					MCS4 = idx;
+				} else if (pCurrTxRate->CurrMCS == MCS_5) {
+					MCS5 = idx;
+				} else if (pCurrTxRate->CurrMCS == MCS_6) {
+					MCS6 = idx;
 				}
-	            else if (pCurrTxRate->CurrMCS == MCS_5)
-	            {
-	                MCS5 = idx;
-	            }
-	            else if (pCurrTxRate->CurrMCS == MCS_6)
-	            {
-	                MCS6 = idx;
-	            }
-				//else if (pCurrTxRate->CurrMCS == MCS_7)
-				else if ((pCurrTxRate->CurrMCS == MCS_7) && (pCurrTxRate->ShortGI == GI_800))	// prevent the highest MCS using short GI when 1T and low throughput
+				/*else if (pCurrTxRate->CurrMCS == MCS_7) */
+				else if ((pCurrTxRate->CurrMCS == MCS_7) && (pCurrTxRate->ShortGI == GI_800))	/* prevent the highest MCS using short GI when 1T and low throughput */
 				{
 					MCS7 = idx;
-				}
-				else if (pCurrTxRate->CurrMCS == MCS_12)
-				{
+				} else if (pCurrTxRate->CurrMCS == MCS_12) {
 					MCS12 = idx;
-				}
-				else if (pCurrTxRate->CurrMCS == MCS_13)
-				{
+				} else if (pCurrTxRate->CurrMCS == MCS_13) {
 					MCS13 = idx;
-				}
-				else if (pCurrTxRate->CurrMCS == MCS_14)
-				{
+				} else if (pCurrTxRate->CurrMCS == MCS_14) {
 					MCS14 = idx;
 				}
-				else if ((pCurrTxRate->CurrMCS == MCS_15) && (pCurrTxRate->ShortGI == GI_800))	//we hope to use ShortGI as initial rate, however Atheros's chip has bugs when short GI
+				else if ((pCurrTxRate->CurrMCS == MCS_15) && (pCurrTxRate->ShortGI == GI_800))	/*we hope to use ShortGI as initial rate, however Atheros's chip has bugs when short GI */
 				{
 					MCS15 = idx;
-				}
-				else if (pCurrTxRate->CurrMCS == MCS_20) // 3*3
+				} else if (pCurrTxRate->CurrMCS == MCS_20)	/* 3*3 */
 				{
 					MCS20 = idx;
-				}
-				else if (pCurrTxRate->CurrMCS == MCS_21)
-				{
+				} else if (pCurrTxRate->CurrMCS == MCS_21) {
 					MCS21 = idx;
-				}
-				else if (pCurrTxRate->CurrMCS == MCS_22)
-				{
+				} else if (pCurrTxRate->CurrMCS == MCS_22) {
 					MCS22 = idx;
-				}
-				else if (pCurrTxRate->CurrMCS == MCS_23)
-				{
+				} else if (pCurrTxRate->CurrMCS == MCS_23) {
 					MCS23 = idx;
 				}
-				idx ++;
+				idx++;
 			}
 
-			if (pAd->LatchRfRegs.Channel <= 14)
-			{
-				if (pAd->NicConfig2.field.ExternalLNAForG)
-				{
+			if (pAd->LatchRfRegs.Channel <= 14) {
+				if (pAd->NicConfig2.field.ExternalLNAForG) {
 					RssiOffset = 2;
-				}
-				else
-				{
+				} else {
 					RssiOffset = 5;
 				}
-			}
-			else
-			{
-				if (pAd->NicConfig2.field.ExternalLNAForA)
-				{
+			} else {
+				if (pAd->NicConfig2.field.ExternalLNAForA) {
 					RssiOffset = 5;
-				}
-				else
-				{
+				} else {
 					RssiOffset = 8;
 				}
 			}
 
-			/*if (MCS15)*/
-			if ((pTable == RateSwitchTable11BGN3S) ||
-				(pTable == RateSwitchTable11N3S) ||
-				(pTable == RateSwitchTable))
-			{// N mode with 3 stream // 3*3
+			/*if (MCS15) */
+			if ((pTable == RateSwitchTable11BGN3S) || (pTable == RateSwitchTable11N3S) || (pTable == RateSwitchTable)) {	/* N mode with 3 stream // 3*3 */
 				if (MCS23 && (Rssi >= -70))
-					TxRateIdx = MCS15;
+					TxRateIdx = MCS23;
 				else if (MCS22 && (Rssi >= -72))
-					TxRateIdx = MCS14;
-        	    else if (MCS21 && (Rssi >= -76))
-					TxRateIdx = MCS13;
+					TxRateIdx = MCS22;
+				else if (MCS21 && (Rssi >= -76))
+					TxRateIdx = MCS21;
 				else if (MCS20 && (Rssi >= -78))
-					TxRateIdx = MCS12;
-			else if (MCS4 && (Rssi >= -82))
-				TxRateIdx = MCS4;
-			else if (MCS3 && (Rssi >= -84))
-				TxRateIdx = MCS3;
-			else if (MCS2 && (Rssi >= -86))
-				TxRateIdx = MCS2;
-			else if (MCS1 && (Rssi >= -88))
-				TxRateIdx = MCS1;
-			else
-				TxRateIdx = MCS0;
-		}
-		else if ((pTable == RateSwitchTable11BGN2S) || (pTable == RateSwitchTable11BGN2SForABand) ||(pTable == RateSwitchTable11N2S) ||(pTable == RateSwitchTable11N2SForABand)) // 3*3
-			{// N mode with 2 stream
-				if (MCS15 && (Rssi >= (-70+RssiOffset)))
+					TxRateIdx = MCS20;
+				else if (MCS4 && (Rssi >= -82))
+					TxRateIdx = MCS4;
+				else if (MCS3 && (Rssi >= -84))
+					TxRateIdx = MCS3;
+				else if (MCS2 && (Rssi >= -86))
+					TxRateIdx = MCS2;
+				else if (MCS1 && (Rssi >= -88))
+					TxRateIdx = MCS1;
+				else
+					TxRateIdx = MCS0;
+			}
+/*              else if ((pTable == RateSwitchTable11BGN2S) || (pTable == RateSwitchTable11BGN2SForABand) ||(pTable == RateSwitchTable11N2S) ||(pTable == RateSwitchTable11N2SForABand) || (pTable == RateSwitchTable)) */
+			else if ((pTable == RateSwitchTable11BGN2S) || (pTable == RateSwitchTable11BGN2SForABand) || (pTable == RateSwitchTable11N2S) || (pTable == RateSwitchTable11N2SForABand))	/* 3*3 */
+			{	/* N mode with 2 stream */
+				if (MCS15 && (Rssi >= (-70 + RssiOffset)))
 					TxRateIdx = MCS15;
-				else if (MCS14 && (Rssi >= (-72+RssiOffset)))
+				else if (MCS14 && (Rssi >= (-72 + RssiOffset)))
 					TxRateIdx = MCS14;
-				else if (MCS13 && (Rssi >= (-76+RssiOffset)))
+				else if (MCS13 && (Rssi >= (-76 + RssiOffset)))
 					TxRateIdx = MCS13;
-				else if (MCS12 && (Rssi >= (-78+RssiOffset)))
+				else if (MCS12 && (Rssi >= (-78 + RssiOffset)))
 					TxRateIdx = MCS12;
-				else if (MCS4 && (Rssi >= (-82+RssiOffset)))
+				else if (MCS4 && (Rssi >= (-82 + RssiOffset)))
 					TxRateIdx = MCS4;
-				else if (MCS3 && (Rssi >= (-84+RssiOffset)))
+				else if (MCS3 && (Rssi >= (-84 + RssiOffset)))
 					TxRateIdx = MCS3;
-				else if (MCS2 && (Rssi >= (-86+RssiOffset)))
+				else if (MCS2 && (Rssi >= (-86 + RssiOffset)))
 					TxRateIdx = MCS2;
-				else if (MCS1 && (Rssi >= (-88+RssiOffset)))
+				else if (MCS1 && (Rssi >= (-88 + RssiOffset)))
 					TxRateIdx = MCS1;
 				else
 					TxRateIdx = MCS0;
-			}
-			else if ((pTable == RateSwitchTable11BGN1S) || (pTable == RateSwitchTable11N1S))
-			{// N mode with 1 stream
-				if (MCS7 && (Rssi > (-72+RssiOffset)))
+			} else if ((pTable == RateSwitchTable11BGN1S) || (pTable == RateSwitchTable11N1S)) {	/* N mode with 1 stream */
+				if (MCS7 && (Rssi > (-72 + RssiOffset)))
 					TxRateIdx = MCS7;
-				else if (MCS6 && (Rssi > (-74+RssiOffset)))
+				else if (MCS6 && (Rssi > (-74 + RssiOffset)))
 					TxRateIdx = MCS6;
-				else if (MCS5 && (Rssi > (-77+RssiOffset)))
+				else if (MCS5 && (Rssi > (-77 + RssiOffset)))
 					TxRateIdx = MCS5;
-				else if (MCS4 && (Rssi > (-79+RssiOffset)))
+				else if (MCS4 && (Rssi > (-79 + RssiOffset)))
 					TxRateIdx = MCS4;
-				else if (MCS3 && (Rssi > (-81+RssiOffset)))
+				else if (MCS3 && (Rssi > (-81 + RssiOffset)))
 					TxRateIdx = MCS3;
-				else if (MCS2 && (Rssi > (-83+RssiOffset)))
+				else if (MCS2 && (Rssi > (-83 + RssiOffset)))
 					TxRateIdx = MCS2;
-				else if (MCS1 && (Rssi > (-86+RssiOffset)))
+				else if (MCS1 && (Rssi > (-86 + RssiOffset)))
 					TxRateIdx = MCS1;
 				else
 					TxRateIdx = MCS0;
-			}
-			else
-			{// Legacy mode
+			} else {	/* Legacy mode */
 				if (MCS7 && (Rssi > -70))
 					TxRateIdx = MCS7;
 				else if (MCS6 && (Rssi > -74))
@@ -2338,7 +2176,7 @@ VOID MlmeDynamicTxRateSwitching(
 					TxRateIdx = MCS5;
 				else if (MCS4 && (Rssi > -82))
 					TxRateIdx = MCS4;
-				else if (MCS4 == 0)	// for B-only mode
+				else if (MCS4 == 0)	/* for B-only mode */
 					TxRateIdx = MCS3;
 				else if (MCS3 && (Rssi > -85))
 					TxRateIdx = MCS3;
@@ -2350,129 +2188,158 @@ VOID MlmeDynamicTxRateSwitching(
 					TxRateIdx = MCS0;
 			}
 
+			/*              if (TxRateIdx != pAd->CommonCfg.TxRateIndex) */
 			{
 				pEntry->CurrTxRateIndex = TxRateIdx;
-				pNextTxRate = (PRTMP_TX_RATE_SWITCH) &pTable[(pEntry->CurrTxRateIndex+1)*5];
+				pNextTxRate =
+				    (struct rt_rtmp_tx_rate_switch *) &
+				    pTable[(pEntry->CurrTxRateIndex + 1) * 5];
 				MlmeSetTxRate(pAd, pEntry, pNextTxRate);
 			}
 
-			NdisZeroMemory(pEntry->TxQuality, sizeof(USHORT) * MAX_STEP_OF_TX_RATE_SWITCH);
-			NdisZeroMemory(pEntry->PER, sizeof(UCHAR) * MAX_STEP_OF_TX_RATE_SWITCH);
+			NdisZeroMemory(pEntry->TxQuality,
+				       sizeof(u16)*
+				       MAX_STEP_OF_TX_RATE_SWITCH);
+			NdisZeroMemory(pEntry->PER,
+				       sizeof(u8)*
+				       MAX_STEP_OF_TX_RATE_SWITCH);
 			pEntry->fLastSecAccordingRSSI = TRUE;
-			// reset all OneSecTx counters
+			/* reset all OneSecTx counters */
 			RESET_ONE_SEC_TX_CNT(pEntry);
 
 			continue;
 		}
 
-		if (pEntry->fLastSecAccordingRSSI == TRUE)
-		{
+		if (pEntry->fLastSecAccordingRSSI == TRUE) {
 			pEntry->fLastSecAccordingRSSI = FALSE;
 			pEntry->LastSecTxRateChangeAction = 0;
-			// reset all OneSecTx counters
+			/* reset all OneSecTx counters */
 			RESET_ONE_SEC_TX_CNT(pEntry);
 
 			continue;
 		}
 
-		do
-		{
-			BOOLEAN	bTrainUpDown = FALSE;
+		do {
+			BOOLEAN bTrainUpDown = FALSE;
 
-			pEntry->CurrTxRateStableTime ++;
+			pEntry->CurrTxRateStableTime++;
 
-			// downgrade TX quality if PER >= Rate-Down threshold
-			if (TxErrorRatio >= TrainDown)
-			{
+			/* downgrade TX quality if PER >= Rate-Down threshold */
+			if (TxErrorRatio >= TrainDown) {
 				bTrainUpDown = TRUE;
-				pEntry->TxQuality[CurrRateIdx] = DRS_TX_QUALITY_WORST_BOUND;
+				pEntry->TxQuality[CurrRateIdx] =
+				    DRS_TX_QUALITY_WORST_BOUND;
 			}
-			// upgrade TX quality if PER <= Rate-Up threshold
-			else if (TxErrorRatio <= TrainUp)
-			{
+			/* upgrade TX quality if PER <= Rate-Up threshold */
+			else if (TxErrorRatio <= TrainUp) {
 				bTrainUpDown = TRUE;
 				bUpgradeQuality = TRUE;
 				if (pEntry->TxQuality[CurrRateIdx])
-					pEntry->TxQuality[CurrRateIdx] --;  // quality very good in CurrRate
+					pEntry->TxQuality[CurrRateIdx]--;	/* quality very good in CurrRate */
 
 				if (pEntry->TxRateUpPenalty)
-					pEntry->TxRateUpPenalty --;
+					pEntry->TxRateUpPenalty--;
 				else if (pEntry->TxQuality[UpRateIdx])
-					pEntry->TxQuality[UpRateIdx] --;    // may improve next UP rate's quality
+					pEntry->TxQuality[UpRateIdx]--;	/* may improve next UP rate's quality */
 			}
 
-			pEntry->PER[CurrRateIdx] = (UCHAR)TxErrorRatio;
+			pEntry->PER[CurrRateIdx] = (u8)TxErrorRatio;
 
-			if (bTrainUpDown)
-			{
-				// perform DRS - consider TxRate Down first, then rate up.
-				if ((CurrRateIdx != DownRateIdx) && (pEntry->TxQuality[CurrRateIdx] >= DRS_TX_QUALITY_WORST_BOUND))
-				{
+			if (bTrainUpDown) {
+				/* perform DRS - consider TxRate Down first, then rate up. */
+				if ((CurrRateIdx != DownRateIdx)
+				    && (pEntry->TxQuality[CurrRateIdx] >=
+					DRS_TX_QUALITY_WORST_BOUND)) {
 					pEntry->CurrTxRateIndex = DownRateIdx;
-				}
-				else if ((CurrRateIdx != UpRateIdx) && (pEntry->TxQuality[UpRateIdx] <= 0))
-				{
+				} else if ((CurrRateIdx != UpRateIdx)
+					   && (pEntry->TxQuality[UpRateIdx] <=
+					       0)) {
 					pEntry->CurrTxRateIndex = UpRateIdx;
 				}
 			}
 		} while (FALSE);
 
-		// if rate-up happen, clear all bad history of all TX rates
-		if (pEntry->CurrTxRateIndex > CurrRateIdx)
-		{
+		/* if rate-up happen, clear all bad history of all TX rates */
+		if (pEntry->CurrTxRateIndex > CurrRateIdx) {
 			pEntry->CurrTxRateStableTime = 0;
 			pEntry->TxRateUpPenalty = 0;
-			pEntry->LastSecTxRateChangeAction = 1; // rate UP
-			NdisZeroMemory(pEntry->TxQuality, sizeof(USHORT) * MAX_STEP_OF_TX_RATE_SWITCH);
-			NdisZeroMemory(pEntry->PER, sizeof(UCHAR) * MAX_STEP_OF_TX_RATE_SWITCH);
-
-			//
-			// For TxRate fast train up
-			//
-			if (!pAd->StaCfg.StaQuickResponeForRateUpTimerRunning)
-			{
-				RTMPSetTimer(&pAd->StaCfg.StaQuickResponeForRateUpTimer, 100);
-
-				pAd->StaCfg.StaQuickResponeForRateUpTimerRunning = TRUE;
+			pEntry->LastSecTxRateChangeAction = 1;	/* rate UP */
+			NdisZeroMemory(pEntry->TxQuality,
+				       sizeof(u16)*
+				       MAX_STEP_OF_TX_RATE_SWITCH);
+			NdisZeroMemory(pEntry->PER,
+				       sizeof(u8)*
+				       MAX_STEP_OF_TX_RATE_SWITCH);
+
+			/* */
+			/* For TxRate fast train up */
+			/* */
+			if (!pAd->StaCfg.StaQuickResponeForRateUpTimerRunning) {
+				RTMPSetTimer(&pAd->StaCfg.
+					     StaQuickResponeForRateUpTimer,
+					     100);
+
+				pAd->StaCfg.
+				    StaQuickResponeForRateUpTimerRunning = TRUE;
 			}
 			bTxRateChanged = TRUE;
 		}
-		// if rate-down happen, only clear DownRate's bad history
-		else if (pEntry->CurrTxRateIndex < CurrRateIdx)
-		{
+		/* if rate-down happen, only clear DownRate's bad history */
+		else if (pEntry->CurrTxRateIndex < CurrRateIdx) {
 			pEntry->CurrTxRateStableTime = 0;
-			pEntry->TxRateUpPenalty = 0;           // no penalty
-			pEntry->LastSecTxRateChangeAction = 2; // rate DOWN
+			pEntry->TxRateUpPenalty = 0;	/* no penalty */
+			pEntry->LastSecTxRateChangeAction = 2;	/* rate DOWN */
 			pEntry->TxQuality[pEntry->CurrTxRateIndex] = 0;
 			pEntry->PER[pEntry->CurrTxRateIndex] = 0;
 
-			//
-			// For TxRate fast train down
-			//
-			if (!pAd->StaCfg.StaQuickResponeForRateUpTimerRunning)
-			{
-				RTMPSetTimer(&pAd->StaCfg.StaQuickResponeForRateUpTimer, 100);
+			/* */
+			/* For TxRate fast train down */
+			/* */
+			if (!pAd->StaCfg.StaQuickResponeForRateUpTimerRunning) {
+				RTMPSetTimer(&pAd->StaCfg.
+					     StaQuickResponeForRateUpTimer,
+					     100);
 
-				pAd->StaCfg.StaQuickResponeForRateUpTimerRunning = TRUE;
+				pAd->StaCfg.
+				    StaQuickResponeForRateUpTimerRunning = TRUE;
 			}
 			bTxRateChanged = TRUE;
-		}
-		else
-		{
-			pEntry->LastSecTxRateChangeAction = 0; // rate no change
+		} else {
+			pEntry->LastSecTxRateChangeAction = 0;	/* rate no change */
 			bTxRateChanged = FALSE;
 		}
 
 		pEntry->LastTxOkCount = TxSuccess;
-
-		// reset all OneSecTx counters
-		RESET_ONE_SEC_TX_CNT(pEntry);
-
-		pNextTxRate = (PRTMP_TX_RATE_SWITCH) &pTable[(pEntry->CurrTxRateIndex+1)*5];
-		if (bTxRateChanged && pNextTxRate)
 		{
+			u8 tmpTxRate;
+
+			/* to fix tcp ack issue */
+			if (!bTxRateChanged
+			    && (pAd->RalinkCounters.OneSecReceivedByteCount >
+				(pAd->RalinkCounters.
+				 OneSecTransmittedByteCount * 5))) {
+				tmpTxRate = DownRateIdx;
+				DBGPRINT_RAW(RT_DEBUG_TRACE,
+					     ("DRS: Rx(%d) is 5 times larger than Tx(%d), use low rate (curr=%d, tmp=%d)\n",
+					      pAd->RalinkCounters.
+					      OneSecReceivedByteCount,
+					      pAd->RalinkCounters.
+					      OneSecTransmittedByteCount,
+					      pEntry->CurrTxRateIndex,
+					      tmpTxRate));
+			} else {
+				tmpTxRate = pEntry->CurrTxRateIndex;
+			}
+
+			pNextTxRate =
+			    (struct rt_rtmp_tx_rate_switch *) & pTable[(tmpTxRate + 1) *
+							    5];
+		}
+		if (bTxRateChanged && pNextTxRate) {
 			MlmeSetTxRate(pAd, pEntry, pNextTxRate);
 		}
+		/* reset all OneSecTx counters */
+		RESET_ONE_SEC_TX_CNT(pEntry);
 	}
 }
 
@@ -2492,103 +2359,84 @@ VOID MlmeDynamicTxRateSwitching(
 
 	========================================================================
 */
-VOID StaQuickResponeForRateUpExec(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3)
+void StaQuickResponeForRateUpExec(void *SystemSpecific1,
+				  void *FunctionContext,
+				  void *SystemSpecific2,
+				  void *SystemSpecific3)
 {
-	PRTMP_ADAPTER			pAd = (PRTMP_ADAPTER)FunctionContext;
-	UCHAR					UpRateIdx = 0, DownRateIdx = 0, CurrRateIdx = 0;
-	ULONG					TxTotalCnt;
-	ULONG					TxErrorRatio = 0;
-#ifdef RT2860
-	BOOLEAN					bTxRateChanged = TRUE; //, bUpgradeQuality = FALSE;
-#endif
-#ifdef RT2870
-	BOOLEAN					bTxRateChanged; //, bUpgradeQuality = FALSE;
-#endif
-	PRTMP_TX_RATE_SWITCH	pCurrTxRate, pNextTxRate = NULL;
-	PUCHAR					pTable;
-	UCHAR					TableSize = 0;
-	UCHAR					InitTxRateIdx = 0, TrainUp, TrainDown;
-	TX_STA_CNT1_STRUC		StaTx1;
-	TX_STA_CNT0_STRUC		TxStaCnt0;
-	CHAR					Rssi, ratio;
-	ULONG					TxRetransmit = 0, TxSuccess = 0, TxFailCount = 0;
-	MAC_TABLE_ENTRY			*pEntry;
-	ULONG					i;
+	struct rt_rtmp_adapter *pAd = (struct rt_rtmp_adapter *)FunctionContext;
+	u8 UpRateIdx = 0, DownRateIdx = 0, CurrRateIdx = 0;
+	unsigned long TxTotalCnt;
+	unsigned long TxErrorRatio = 0;
+	BOOLEAN bTxRateChanged;	/*, bUpgradeQuality = FALSE; */
+	struct rt_rtmp_tx_rate_switch *pCurrTxRate, *pNextTxRate = NULL;
+	u8 *pTable;
+	u8 TableSize = 0;
+	u8 InitTxRateIdx = 0, TrainUp, TrainDown;
+	TX_STA_CNT1_STRUC StaTx1;
+	TX_STA_CNT0_STRUC TxStaCnt0;
+	char Rssi, ratio;
+	unsigned long TxRetransmit = 0, TxSuccess = 0, TxFailCount = 0;
+	struct rt_mac_table_entry *pEntry;
+	unsigned long i;
 
 	pAd->StaCfg.StaQuickResponeForRateUpTimerRunning = FALSE;
 
-    //
-    // walk through MAC table, see if need to change AP's TX rate toward each entry
-    //
-	for (i = 1; i < MAX_LEN_OF_MAC_TABLE; i++)
-	{
+	/* */
+	/* walk through MAC table, see if need to change AP's TX rate toward each entry */
+	/* */
+	for (i = 1; i < MAX_LEN_OF_MAC_TABLE; i++) {
 		pEntry = &pAd->MacTab.Content[i];
 
-		// check if this entry need to switch rate automatically
+		/* check if this entry need to switch rate automatically */
 		if (RTMPCheckEntryEnableAutoRateSwitch(pAd, pEntry) == FALSE)
 			continue;
 
-#ifdef RT2860
-		//Rssi = RTMPMaxRssi(pAd, (CHAR)pAd->StaCfg.AvgRssi0, (CHAR)pAd->StaCfg.AvgRssi1, (CHAR)pAd->StaCfg.AvgRssi2);
-	    if (pAd->Antenna.field.TxPath > 1)
-			Rssi = (pAd->StaCfg.RssiSample.AvgRssi0 + pAd->StaCfg.RssiSample.AvgRssi1) >> 1;
-		else
-			Rssi = pAd->StaCfg.RssiSample.AvgRssi0;
-#endif
-#ifdef RT2870
 		if (INFRA_ON(pAd) && (i == 1))
 			Rssi = RTMPMaxRssi(pAd,
-							   pAd->StaCfg.RssiSample.AvgRssi0,
-							   pAd->StaCfg.RssiSample.AvgRssi1,
-							   pAd->StaCfg.RssiSample.AvgRssi2);
+					   pAd->StaCfg.RssiSample.AvgRssi0,
+					   pAd->StaCfg.RssiSample.AvgRssi1,
+					   pAd->StaCfg.RssiSample.AvgRssi2);
 		else
 			Rssi = RTMPMaxRssi(pAd,
-							   pEntry->RssiSample.AvgRssi0,
-							   pEntry->RssiSample.AvgRssi1,
-							   pEntry->RssiSample.AvgRssi2);
-#endif
+					   pEntry->RssiSample.AvgRssi0,
+					   pEntry->RssiSample.AvgRssi1,
+					   pEntry->RssiSample.AvgRssi2);
 
 		CurrRateIdx = pAd->CommonCfg.TxRateIndex;
 
-			MlmeSelectTxRateTable(pAd, pEntry, &pTable, &TableSize, &InitTxRateIdx);
+		MlmeSelectTxRateTable(pAd, pEntry, &pTable, &TableSize,
+				      &InitTxRateIdx);
 
-		// decide the next upgrade rate and downgrade rate, if any
-		if ((CurrRateIdx > 0) && (CurrRateIdx < (TableSize - 1)))
-		{
+		/* decide the next upgrade rate and downgrade rate, if any */
+		if ((CurrRateIdx > 0) && (CurrRateIdx < (TableSize - 1))) {
 			UpRateIdx = CurrRateIdx + 1;
-			DownRateIdx = CurrRateIdx -1;
-		}
-		else if (CurrRateIdx == 0)
-		{
+			DownRateIdx = CurrRateIdx - 1;
+		} else if (CurrRateIdx == 0) {
 			UpRateIdx = CurrRateIdx + 1;
 			DownRateIdx = CurrRateIdx;
-		}
-		else if (CurrRateIdx == (TableSize - 1))
-		{
+		} else if (CurrRateIdx == (TableSize - 1)) {
 			UpRateIdx = CurrRateIdx;
 			DownRateIdx = CurrRateIdx - 1;
 		}
 
-		pCurrTxRate = (PRTMP_TX_RATE_SWITCH) &pTable[(CurrRateIdx+1)*5];
+		pCurrTxRate =
+		    (struct rt_rtmp_tx_rate_switch *) & pTable[(CurrRateIdx + 1) * 5];
 
-		if ((Rssi > -65) && (pCurrTxRate->Mode >= MODE_HTMIX))
-		{
-			TrainUp		= (pCurrTxRate->TrainUp + (pCurrTxRate->TrainUp >> 1));
-			TrainDown	= (pCurrTxRate->TrainDown + (pCurrTxRate->TrainDown >> 1));
-		}
-		else
-		{
-			TrainUp		= pCurrTxRate->TrainUp;
-			TrainDown	= pCurrTxRate->TrainDown;
+		if ((Rssi > -65) && (pCurrTxRate->Mode >= MODE_HTMIX)) {
+			TrainUp =
+			    (pCurrTxRate->TrainUp +
+			     (pCurrTxRate->TrainUp >> 1));
+			TrainDown =
+			    (pCurrTxRate->TrainDown +
+			     (pCurrTxRate->TrainDown >> 1));
+		} else {
+			TrainUp = pCurrTxRate->TrainUp;
+			TrainDown = pCurrTxRate->TrainDown;
 		}
 
-		if (pAd->MacTab.Size == 1)
-		{
-			// Update statistic counter
+		if (pAd->MacTab.Size == 1) {
+			/* Update statistic counter */
 			RTMP_IO_READ32(pAd, TX_STA_CNT0, &TxStaCnt0.word);
 			RTMP_IO_READ32(pAd, TX_STA_CNT1, &StaTx1.word);
 
@@ -2597,123 +2445,138 @@ VOID StaQuickResponeForRateUpExec(
 			TxFailCount = TxStaCnt0.field.TxFailCount;
 			TxTotalCnt = TxRetransmit + TxSuccess + TxFailCount;
 
-			pAd->RalinkCounters.OneSecTxRetryOkCount += StaTx1.field.TxRetransmit;
-			pAd->RalinkCounters.OneSecTxNoRetryOkCount += StaTx1.field.TxSuccess;
-			pAd->RalinkCounters.OneSecTxFailCount += TxStaCnt0.field.TxFailCount;
-			pAd->WlanCounters.TransmittedFragmentCount.u.LowPart += StaTx1.field.TxSuccess;
-			pAd->WlanCounters.RetryCount.u.LowPart += StaTx1.field.TxRetransmit;
-			pAd->WlanCounters.FailedCount.u.LowPart += TxStaCnt0.field.TxFailCount;
+			pAd->RalinkCounters.OneSecTxRetryOkCount +=
+			    StaTx1.field.TxRetransmit;
+			pAd->RalinkCounters.OneSecTxNoRetryOkCount +=
+			    StaTx1.field.TxSuccess;
+			pAd->RalinkCounters.OneSecTxFailCount +=
+			    TxStaCnt0.field.TxFailCount;
+			pAd->WlanCounters.TransmittedFragmentCount.u.LowPart +=
+			    StaTx1.field.TxSuccess;
+			pAd->WlanCounters.RetryCount.u.LowPart +=
+			    StaTx1.field.TxRetransmit;
+			pAd->WlanCounters.FailedCount.u.LowPart +=
+			    TxStaCnt0.field.TxFailCount;
 
 			if (TxTotalCnt)
-				TxErrorRatio = ((TxRetransmit + TxFailCount) * 100) / TxTotalCnt;
-		}
-		else
-		{
+				TxErrorRatio =
+				    ((TxRetransmit +
+				      TxFailCount) * 100) / TxTotalCnt;
+		} else {
 			TxTotalCnt = pEntry->OneSecTxNoRetryOkCount +
-				 pEntry->OneSecTxRetryOkCount +
-				 pEntry->OneSecTxFailCount;
+			    pEntry->OneSecTxRetryOkCount +
+			    pEntry->OneSecTxFailCount;
 
 			if (TxTotalCnt)
-				TxErrorRatio = ((pEntry->OneSecTxRetryOkCount + pEntry->OneSecTxFailCount) * 100) / TxTotalCnt;
-		}
-
-
-		//
-		// CASE 1. when TX samples are fewer than 15, then decide TX rate solely on RSSI
-		//         (criteria copied from RT2500 for Netopia case)
-		//
-		if (TxTotalCnt <= 12)
-		{
-			NdisZeroMemory(pAd->DrsCounters.TxQuality, sizeof(USHORT) * MAX_STEP_OF_TX_RATE_SWITCH);
-			NdisZeroMemory(pAd->DrsCounters.PER, sizeof(UCHAR) * MAX_STEP_OF_TX_RATE_SWITCH);
-
-			if ((pAd->DrsCounters.LastSecTxRateChangeAction == 1) && (CurrRateIdx != DownRateIdx))
-			{
+				TxErrorRatio =
+				    ((pEntry->OneSecTxRetryOkCount +
+				      pEntry->OneSecTxFailCount) * 100) /
+				    TxTotalCnt;
+		}
+
+		/* */
+		/* CASE 1. when TX samples are fewer than 15, then decide TX rate solely on RSSI */
+		/*         (criteria copied from RT2500 for Netopia case) */
+		/* */
+		if (TxTotalCnt <= 12) {
+			NdisZeroMemory(pAd->DrsCounters.TxQuality,
+				       sizeof(u16)*
+				       MAX_STEP_OF_TX_RATE_SWITCH);
+			NdisZeroMemory(pAd->DrsCounters.PER,
+				       sizeof(u8)*
+				       MAX_STEP_OF_TX_RATE_SWITCH);
+
+			if ((pAd->DrsCounters.LastSecTxRateChangeAction == 1)
+			    && (CurrRateIdx != DownRateIdx)) {
 				pAd->CommonCfg.TxRateIndex = DownRateIdx;
-				pAd->DrsCounters.TxQuality[CurrRateIdx] = DRS_TX_QUALITY_WORST_BOUND;
-			}
-			else if ((pAd->DrsCounters.LastSecTxRateChangeAction == 2) && (CurrRateIdx != UpRateIdx))
-			{
+				pAd->DrsCounters.TxQuality[CurrRateIdx] =
+				    DRS_TX_QUALITY_WORST_BOUND;
+			} else
+			    if ((pAd->DrsCounters.LastSecTxRateChangeAction ==
+				 2) && (CurrRateIdx != UpRateIdx)) {
 				pAd->CommonCfg.TxRateIndex = UpRateIdx;
 			}
 
-			DBGPRINT_RAW(RT_DEBUG_TRACE,("QuickDRS: TxTotalCnt <= 15, train back to original rate \n"));
+			DBGPRINT_RAW(RT_DEBUG_TRACE,
+				     ("QuickDRS: TxTotalCnt <= 15, train back to original rate \n"));
 			return;
 		}
 
-		do
-		{
-			ULONG OneSecTxNoRetryOKRationCount;
+		do {
+			unsigned long OneSecTxNoRetryOKRationCount;
 
 			if (pAd->DrsCounters.LastTimeTxRateChangeAction == 0)
 				ratio = 5;
 			else
 				ratio = 4;
 
-			// downgrade TX quality if PER >= Rate-Down threshold
-			if (TxErrorRatio >= TrainDown)
-			{
-				pAd->DrsCounters.TxQuality[CurrRateIdx] = DRS_TX_QUALITY_WORST_BOUND;
+			/* downgrade TX quality if PER >= Rate-Down threshold */
+			if (TxErrorRatio >= TrainDown) {
+				pAd->DrsCounters.TxQuality[CurrRateIdx] =
+				    DRS_TX_QUALITY_WORST_BOUND;
 			}
 
-			pAd->DrsCounters.PER[CurrRateIdx] = (UCHAR)TxErrorRatio;
+			pAd->DrsCounters.PER[CurrRateIdx] =
+			    (u8)TxErrorRatio;
 
 			OneSecTxNoRetryOKRationCount = (TxSuccess * ratio);
 
-			// perform DRS - consider TxRate Down first, then rate up.
-			if ((pAd->DrsCounters.LastSecTxRateChangeAction == 1) && (CurrRateIdx != DownRateIdx))
-			{
-				if ((pAd->DrsCounters.LastTxOkCount + 2) >= OneSecTxNoRetryOKRationCount)
-				{
-					pAd->CommonCfg.TxRateIndex = DownRateIdx;
-					pAd->DrsCounters.TxQuality[CurrRateIdx] = DRS_TX_QUALITY_WORST_BOUND;
+			/* perform DRS - consider TxRate Down first, then rate up. */
+			if ((pAd->DrsCounters.LastSecTxRateChangeAction == 1)
+			    && (CurrRateIdx != DownRateIdx)) {
+				if ((pAd->DrsCounters.LastTxOkCount + 2) >=
+				    OneSecTxNoRetryOKRationCount) {
+					pAd->CommonCfg.TxRateIndex =
+					    DownRateIdx;
+					pAd->DrsCounters.
+					    TxQuality[CurrRateIdx] =
+					    DRS_TX_QUALITY_WORST_BOUND;
 
 				}
 
-			}
-			else if ((pAd->DrsCounters.LastSecTxRateChangeAction == 2) && (CurrRateIdx != UpRateIdx))
-			{
-				if ((TxErrorRatio >= 50) || (TxErrorRatio >= TrainDown))
-				{
+			} else
+			    if ((pAd->DrsCounters.LastSecTxRateChangeAction ==
+				 2) && (CurrRateIdx != UpRateIdx)) {
+				if ((TxErrorRatio >= 50)
+				    || (TxErrorRatio >= TrainDown)) {
 
-				}
-				else if ((pAd->DrsCounters.LastTxOkCount + 2) >= OneSecTxNoRetryOKRationCount)
-				{
+				} else if ((pAd->DrsCounters.LastTxOkCount + 2)
+					   >= OneSecTxNoRetryOKRationCount) {
 					pAd->CommonCfg.TxRateIndex = UpRateIdx;
 				}
 			}
-		}while (FALSE);
+		} while (FALSE);
 
-		// if rate-up happen, clear all bad history of all TX rates
-		if (pAd->CommonCfg.TxRateIndex > CurrRateIdx)
-		{
+		/* if rate-up happen, clear all bad history of all TX rates */
+		if (pAd->CommonCfg.TxRateIndex > CurrRateIdx) {
 			pAd->DrsCounters.TxRateUpPenalty = 0;
-			NdisZeroMemory(pAd->DrsCounters.TxQuality, sizeof(USHORT) * MAX_STEP_OF_TX_RATE_SWITCH);
-			NdisZeroMemory(pAd->DrsCounters.PER, sizeof(UCHAR) * MAX_STEP_OF_TX_RATE_SWITCH);
-#ifdef RT2870
+			NdisZeroMemory(pAd->DrsCounters.TxQuality,
+				       sizeof(u16)*
+				       MAX_STEP_OF_TX_RATE_SWITCH);
+			NdisZeroMemory(pAd->DrsCounters.PER,
+				       sizeof(u8)*
+				       MAX_STEP_OF_TX_RATE_SWITCH);
 			bTxRateChanged = TRUE;
-#endif
 		}
-		// if rate-down happen, only clear DownRate's bad history
-		else if (pAd->CommonCfg.TxRateIndex < CurrRateIdx)
-		{
-			DBGPRINT_RAW(RT_DEBUG_TRACE,("QuickDRS: --TX rate from %d to %d \n", CurrRateIdx, pAd->CommonCfg.TxRateIndex));
+		/* if rate-down happen, only clear DownRate's bad history */
+		else if (pAd->CommonCfg.TxRateIndex < CurrRateIdx) {
+			DBGPRINT_RAW(RT_DEBUG_TRACE,
+				     ("QuickDRS: --TX rate from %d to %d \n",
+				      CurrRateIdx, pAd->CommonCfg.TxRateIndex));
 
-			pAd->DrsCounters.TxRateUpPenalty = 0;           // no penalty
-			pAd->DrsCounters.TxQuality[pAd->CommonCfg.TxRateIndex] = 0;
+			pAd->DrsCounters.TxRateUpPenalty = 0;	/* no penalty */
+			pAd->DrsCounters.TxQuality[pAd->CommonCfg.TxRateIndex] =
+			    0;
 			pAd->DrsCounters.PER[pAd->CommonCfg.TxRateIndex] = 0;
-#ifdef RT2870
 			bTxRateChanged = TRUE;
-#endif
-		}
-		else
-		{
+		} else {
 			bTxRateChanged = FALSE;
 		}
 
-		pNextTxRate = (PRTMP_TX_RATE_SWITCH) &pTable[(pAd->CommonCfg.TxRateIndex+1)*5];
-		if (bTxRateChanged && pNextTxRate)
-		{
+		pNextTxRate =
+		    (struct rt_rtmp_tx_rate_switch *) &
+		    pTable[(pAd->CommonCfg.TxRateIndex + 1) * 5];
+		if (bTxRateChanged && pNextTxRate) {
 			MlmeSetTxRate(pAd, pEntry, pNextTxRate);
 		}
 	}
@@ -2738,98 +2601,176 @@ VOID StaQuickResponeForRateUpExec(
 
 	==========================================================================
  */
-VOID MlmeCheckPsmChange(
-	IN PRTMP_ADAPTER pAd,
-	IN ULONG	Now32)
+void MlmeCheckPsmChange(struct rt_rtmp_adapter *pAd, unsigned long Now32)
 {
-	ULONG	PowerMode;
-
-	// condition -
-	// 1. Psm maybe ON only happen in INFRASTRUCTURE mode
-	// 2. user wants either MAX_PSP or FAST_PSP
-	// 3. but current psm is not in PWR_SAVE
-	// 4. CNTL state machine is not doing SCANning
-	// 5. no TX SUCCESS event for the past 1-sec period
-#ifdef NDIS51_MINIPORT
-	if (pAd->StaCfg.WindowsPowerProfile == NdisPowerProfileBattery)
-		PowerMode = pAd->StaCfg.WindowsBatteryPowerMode;
-	else
-#endif
-		PowerMode = pAd->StaCfg.WindowsPowerMode;
+	unsigned long PowerMode;
+
+	/* condition - */
+	/* 1. Psm maybe ON only happen in INFRASTRUCTURE mode */
+	/* 2. user wants either MAX_PSP or FAST_PSP */
+	/* 3. but current psm is not in PWR_SAVE */
+	/* 4. CNTL state machine is not doing SCANning */
+	/* 5. no TX SUCCESS event for the past 1-sec period */
+	PowerMode = pAd->StaCfg.WindowsPowerMode;
 
 	if (INFRA_ON(pAd) &&
-		(PowerMode != Ndis802_11PowerModeCAM) &&
-		(pAd->StaCfg.Psm == PWR_ACTIVE) &&
-#ifdef RT2860
-		RTMP_TEST_PSFLAG(pAd, fRTMP_PS_CAN_GO_SLEEP))
-#else
-		(pAd->Mlme.CntlMachine.CurrState == CNTL_IDLE))
-#endif
-	{
-		// add by johnli, use Rx OK data count per second to calculate throughput
-		// If Ttraffic is too high ( > 400 Rx per second), don't go to sleep mode. If tx rate is low, use low criteria
-		// Mode=CCK/MCS=3 => 11 Mbps, Mode=OFDM/MCS=3 => 18 Mbps
-		if (((pAd->StaCfg.HTPhyMode.field.MCS <= 3) &&
-				(pAd->RalinkCounters.OneSecRxOkDataCnt < (ULONG)100)) ||
-			((pAd->StaCfg.HTPhyMode.field.MCS > 3) &&
-			(pAd->RalinkCounters.OneSecRxOkDataCnt < (ULONG)400)))
-		{
-				// Get this time
-			NdisGetSystemUpTime(&pAd->Mlme.LastSendNULLpsmTime);
-			pAd->RalinkCounters.RxCountSinceLastNULL = 0;
-			MlmeSetPsmBit(pAd, PWR_SAVE);
-			if (!(pAd->CommonCfg.bAPSDCapable && pAd->CommonCfg.APEdcaParm.bAPSDCapable))
-			{
-				RTMPSendNullFrame(pAd, pAd->CommonCfg.TxRate, FALSE);
-			}
-			else
-			{
-				RTMPSendNullFrame(pAd, pAd->CommonCfg.TxRate, TRUE);
-			}
+	    (PowerMode != Ndis802_11PowerModeCAM) &&
+	    (pAd->StaCfg.Psm == PWR_ACTIVE) &&
+/*              (! RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS)) */
+	    (pAd->Mlme.CntlMachine.CurrState == CNTL_IDLE) &&
+	    RTMP_TEST_PSFLAG(pAd, fRTMP_PS_CAN_GO_SLEEP)
+	    /*&&
+	       (pAd->RalinkCounters.OneSecTxNoRetryOkCount == 0) &&
+	       (pAd->RalinkCounters.OneSecTxRetryOkCount == 0) */
+	    ) {
+		NdisGetSystemUpTime(&pAd->Mlme.LastSendNULLpsmTime);
+		pAd->RalinkCounters.RxCountSinceLastNULL = 0;
+		RTMP_SET_PSM_BIT(pAd, PWR_SAVE);
+		if (!
+		    (pAd->CommonCfg.bAPSDCapable
+		     && pAd->CommonCfg.APEdcaParm.bAPSDCapable)) {
+			RTMPSendNullFrame(pAd, pAd->CommonCfg.TxRate, FALSE);
+		} else {
+			RTMPSendNullFrame(pAd, pAd->CommonCfg.TxRate, TRUE);
 		}
 	}
 }
 
-// IRQL = PASSIVE_LEVEL
-// IRQL = DISPATCH_LEVEL
-VOID MlmeSetPsmBit(
-	IN PRTMP_ADAPTER pAd,
-	IN USHORT psm)
+/* IRQL = PASSIVE_LEVEL */
+/* IRQL = DISPATCH_LEVEL */
+void MlmeSetPsmBit(struct rt_rtmp_adapter *pAd, u16 psm)
 {
 	AUTO_RSP_CFG_STRUC csr4;
 
 	pAd->StaCfg.Psm = psm;
 	RTMP_IO_READ32(pAd, AUTO_RSP_CFG, &csr4.word);
-	csr4.field.AckCtsPsmBit = (psm == PWR_SAVE)? 1:0;
+	csr4.field.AckCtsPsmBit = (psm == PWR_SAVE) ? 1 : 0;
 	RTMP_IO_WRITE32(pAd, AUTO_RSP_CFG, csr4.word);
 
 	DBGPRINT(RT_DEBUG_TRACE, ("MlmeSetPsmBit = %d\n", psm));
 }
 
-// IRQL = DISPATCH_LEVEL
-VOID MlmeSetTxPreamble(
-	IN PRTMP_ADAPTER pAd,
-	IN USHORT TxPreamble)
+/*
+	==========================================================================
+	Description:
+		This routine calculates TxPER, RxPER of the past N-sec period. And
+		according to the calculation result, ChannelQuality is calculated here
+		to decide if current AP is still doing the job.
+
+		If ChannelQuality is not good, a ROAMing attempt may be tried later.
+	Output:
+		StaCfg.ChannelQuality - 0..100
+
+	IRQL = DISPATCH_LEVEL
+
+	NOTE: This routine decide channle quality based on RX CRC error ratio.
+		Caller should make sure a function call to NICUpdateRawCounters(pAd)
+		is performed right before this routine, so that this routine can decide
+		channel quality based on the most up-to-date information
+	==========================================================================
+ */
+void MlmeCalculateChannelQuality(struct rt_rtmp_adapter *pAd,
+				 struct rt_mac_table_entry *pMacEntry, unsigned long Now32)
+{
+	unsigned long TxOkCnt, TxCnt, TxPER, TxPRR;
+	unsigned long RxCnt, RxPER;
+	u8 NorRssi;
+	char MaxRssi;
+	struct rt_rssi_sample *pRssiSample = NULL;
+	u32 OneSecTxNoRetryOkCount = 0;
+	u32 OneSecTxRetryOkCount = 0;
+	u32 OneSecTxFailCount = 0;
+	u32 OneSecRxOkCnt = 0;
+	u32 OneSecRxFcsErrCnt = 0;
+	unsigned long ChannelQuality = 0;	/* 0..100, Channel Quality Indication for Roaming */
+	unsigned long BeaconLostTime = pAd->StaCfg.BeaconLostTime;
+
+	if (pAd->OpMode == OPMODE_STA) {
+		pRssiSample = &pAd->StaCfg.RssiSample;
+		OneSecTxNoRetryOkCount =
+		    pAd->RalinkCounters.OneSecTxNoRetryOkCount;
+		OneSecTxRetryOkCount = pAd->RalinkCounters.OneSecTxRetryOkCount;
+		OneSecTxFailCount = pAd->RalinkCounters.OneSecTxFailCount;
+		OneSecRxOkCnt = pAd->RalinkCounters.OneSecRxOkCnt;
+		OneSecRxFcsErrCnt = pAd->RalinkCounters.OneSecRxFcsErrCnt;
+	}
+
+	MaxRssi = RTMPMaxRssi(pAd, pRssiSample->LastRssi0,
+			      pRssiSample->LastRssi1, pRssiSample->LastRssi2);
+
+	/* */
+	/* calculate TX packet error ratio and TX retry ratio - if too few TX samples, skip TX related statistics */
+	/* */
+	TxOkCnt = OneSecTxNoRetryOkCount + OneSecTxRetryOkCount;
+	TxCnt = TxOkCnt + OneSecTxFailCount;
+	if (TxCnt < 5) {
+		TxPER = 0;
+		TxPRR = 0;
+	} else {
+		TxPER = (OneSecTxFailCount * 100) / TxCnt;
+		TxPRR = ((TxCnt - OneSecTxNoRetryOkCount) * 100) / TxCnt;
+	}
+
+	/* */
+	/* calculate RX PER - don't take RxPER into consideration if too few sample */
+	/* */
+	RxCnt = OneSecRxOkCnt + OneSecRxFcsErrCnt;
+	if (RxCnt < 5)
+		RxPER = 0;
+	else
+		RxPER = (OneSecRxFcsErrCnt * 100) / RxCnt;
+
+	/* */
+	/* decide ChannelQuality based on: 1)last BEACON received time, 2)last RSSI, 3)TxPER, and 4)RxPER */
+	/* */
+	if ((pAd->OpMode == OPMODE_STA) && INFRA_ON(pAd) && (OneSecTxNoRetryOkCount < 2) &&	/* no heavy traffic */
+	    ((pAd->StaCfg.LastBeaconRxTime + BeaconLostTime) < Now32)) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("BEACON lost > %ld msec with TxOkCnt=%ld -> CQI=0\n",
+			  BeaconLostTime, TxOkCnt));
+		ChannelQuality = 0;
+	} else {
+		/* Normalize Rssi */
+		if (MaxRssi > -40)
+			NorRssi = 100;
+		else if (MaxRssi < -90)
+			NorRssi = 0;
+		else
+			NorRssi = (MaxRssi + 90) * 2;
+
+		/* ChannelQuality = W1*RSSI + W2*TxPRR + W3*RxPER        (RSSI 0..100), (TxPER 100..0), (RxPER 100..0) */
+		ChannelQuality = (RSSI_WEIGHTING * NorRssi +
+				  TX_WEIGHTING * (100 - TxPRR) +
+				  RX_WEIGHTING * (100 - RxPER)) / 100;
+	}
+
+	if (pAd->OpMode == OPMODE_STA)
+		pAd->Mlme.ChannelQuality =
+		    (ChannelQuality > 100) ? 100 : ChannelQuality;
+
+}
+
+/* IRQL = DISPATCH_LEVEL */
+void MlmeSetTxPreamble(struct rt_rtmp_adapter *pAd, u16 TxPreamble)
 {
 	AUTO_RSP_CFG_STRUC csr4;
 
-	//
-	// Always use Long preamble before verifiation short preamble functionality works well.
-	// Todo: remove the following line if short preamble functionality works
-	//
-	//TxPreamble = Rt802_11PreambleLong;
+	/* */
+	/* Always use Long preamble before verifiation short preamble functionality works well. */
+	/* Todo: remove the following line if short preamble functionality works */
+	/* */
+	/*TxPreamble = Rt802_11PreambleLong; */
 
 	RTMP_IO_READ32(pAd, AUTO_RSP_CFG, &csr4.word);
-	if (TxPreamble == Rt802_11PreambleLong)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("MlmeSetTxPreamble (= LONG PREAMBLE)\n"));
+	if (TxPreamble == Rt802_11PreambleLong) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("MlmeSetTxPreamble (= long PREAMBLE)\n"));
 		OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_SHORT_PREAMBLE_INUSED);
 		csr4.field.AutoResponderPreamble = 0;
-	}
-	else
-	{
-		// NOTE: 1Mbps should always use long preamble
-		DBGPRINT(RT_DEBUG_TRACE, ("MlmeSetTxPreamble (= SHORT PREAMBLE)\n"));
+	} else {
+		/* NOTE: 1Mbps should always use long preamble */
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("MlmeSetTxPreamble (= short PREAMBLE)\n"));
 		OPSTATUS_SET_FLAG(pAd, fOP_STATUS_SHORT_PREAMBLE_INUSED);
 		csr4.field.AutoResponderPreamble = 1;
 	}
@@ -2844,117 +2785,140 @@ VOID MlmeSetTxPreamble(
     ==========================================================================
  */
 
-VOID UpdateBasicRateBitmap(
-    IN  PRTMP_ADAPTER   pAdapter)
+void UpdateBasicRateBitmap(struct rt_rtmp_adapter *pAdapter)
 {
-    INT  i, j;
-                  /* 1  2  5.5, 11,  6,  9, 12, 18, 24, 36, 48,  54 */
-    UCHAR rate[] = { 2, 4,  11, 22, 12, 18, 24, 36, 48, 72, 96, 108 };
-    UCHAR *sup_p = pAdapter->CommonCfg.SupRate;
-    UCHAR *ext_p = pAdapter->CommonCfg.ExtRate;
-    ULONG bitmap = pAdapter->CommonCfg.BasicRateBitmap;
-
-
-    /* if A mode, always use fix BasicRateBitMap */
-    //if (pAdapter->CommonCfg.Channel == PHY_11A)
+	int i, j;
+	/* 1  2  5.5, 11,  6,  9, 12, 18, 24, 36, 48,  54 */
+	u8 rate[] = { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 };
+	u8 *sup_p = pAdapter->CommonCfg.SupRate;
+	u8 *ext_p = pAdapter->CommonCfg.ExtRate;
+	unsigned long bitmap = pAdapter->CommonCfg.BasicRateBitmap;
+
+	/* if A mode, always use fix BasicRateBitMap */
+	/*if (pAdapter->CommonCfg.Channel == PHY_11A) */
 	if (pAdapter->CommonCfg.Channel > 14)
-        pAdapter->CommonCfg.BasicRateBitmap = 0x150; /* 6, 12, 24M */
-    /* End of if */
-
-    if (pAdapter->CommonCfg.BasicRateBitmap > 4095)
-    {
-        /* (2 ^ MAX_LEN_OF_SUPPORTED_RATES) -1 */
-        return;
-    } /* End of if */
-
-    for(i=0; i<MAX_LEN_OF_SUPPORTED_RATES; i++)
-    {
-        sup_p[i] &= 0x7f;
-        ext_p[i] &= 0x7f;
-    } /* End of for */
-
-    for(i=0; i<MAX_LEN_OF_SUPPORTED_RATES; i++)
-    {
-        if (bitmap & (1 << i))
-        {
-            for(j=0; j<MAX_LEN_OF_SUPPORTED_RATES; j++)
-            {
-                if (sup_p[j] == rate[i])
-                    sup_p[j] |= 0x80;
-                /* End of if */
-            } /* End of for */
-
-            for(j=0; j<MAX_LEN_OF_SUPPORTED_RATES; j++)
-            {
-                if (ext_p[j] == rate[i])
-                    ext_p[j] |= 0x80;
-                /* End of if */
-            } /* End of for */
-        } /* End of if */
-    } /* End of for */
-} /* End of UpdateBasicRateBitmap */
-
-// IRQL = PASSIVE_LEVEL
-// IRQL = DISPATCH_LEVEL
-// bLinkUp is to identify the inital link speed.
-// TRUE indicates the rate update at linkup, we should not try to set the rate at 54Mbps.
-VOID MlmeUpdateTxRates(
-	IN PRTMP_ADAPTER 		pAd,
-	IN 	BOOLEAN		 		bLinkUp,
-	IN	UCHAR				apidx)
+		pAdapter->CommonCfg.BasicRateBitmap = 0x150;	/* 6, 12, 24M */
+	/* End of if */
+
+	if (pAdapter->CommonCfg.BasicRateBitmap > 4095) {
+		/* (2 ^ MAX_LEN_OF_SUPPORTED_RATES) -1 */
+		return;
+	}
+	/* End of if */
+	for (i = 0; i < MAX_LEN_OF_SUPPORTED_RATES; i++) {
+		sup_p[i] &= 0x7f;
+		ext_p[i] &= 0x7f;
+	}			/* End of for */
+
+	for (i = 0; i < MAX_LEN_OF_SUPPORTED_RATES; i++) {
+		if (bitmap & (1 << i)) {
+			for (j = 0; j < MAX_LEN_OF_SUPPORTED_RATES; j++) {
+				if (sup_p[j] == rate[i])
+					sup_p[j] |= 0x80;
+				/* End of if */
+			}	/* End of for */
+
+			for (j = 0; j < MAX_LEN_OF_SUPPORTED_RATES; j++) {
+				if (ext_p[j] == rate[i])
+					ext_p[j] |= 0x80;
+				/* End of if */
+			}	/* End of for */
+		}		/* End of if */
+	}			/* End of for */
+}				/* End of UpdateBasicRateBitmap */
+
+/* IRQL = PASSIVE_LEVEL */
+/* IRQL = DISPATCH_LEVEL */
+/* bLinkUp is to identify the inital link speed. */
+/* TRUE indicates the rate update at linkup, we should not try to set the rate at 54Mbps. */
+void MlmeUpdateTxRates(struct rt_rtmp_adapter *pAd, IN BOOLEAN bLinkUp, u8 apidx)
 {
 	int i, num;
-	UCHAR Rate = RATE_6, MaxDesire = RATE_1, MaxSupport = RATE_1;
-	UCHAR MinSupport = RATE_54;
-	ULONG BasicRateBitmap = 0;
-	UCHAR CurrBasicRate = RATE_1;
-	UCHAR *pSupRate, SupRateLen, *pExtRate, ExtRateLen;
-	PHTTRANSMIT_SETTING		pHtPhy = NULL;
-	PHTTRANSMIT_SETTING		pMaxHtPhy = NULL;
-	PHTTRANSMIT_SETTING		pMinHtPhy = NULL;
-	BOOLEAN 				*auto_rate_cur_p;
-	UCHAR					HtMcs = MCS_AUTO;
-
-	// find max desired rate
+	u8 Rate = RATE_6, MaxDesire = RATE_1, MaxSupport = RATE_1;
+	u8 MinSupport = RATE_54;
+	unsigned long BasicRateBitmap = 0;
+	u8 CurrBasicRate = RATE_1;
+	u8 *pSupRate, SupRateLen, *pExtRate, ExtRateLen;
+	PHTTRANSMIT_SETTING pHtPhy = NULL;
+	PHTTRANSMIT_SETTING pMaxHtPhy = NULL;
+	PHTTRANSMIT_SETTING pMinHtPhy = NULL;
+	BOOLEAN *auto_rate_cur_p;
+	u8 HtMcs = MCS_AUTO;
+
+	/* find max desired rate */
 	UpdateBasicRateBitmap(pAd);
 
 	num = 0;
 	auto_rate_cur_p = NULL;
-	for (i=0; i<MAX_LEN_OF_SUPPORTED_RATES; i++)
-	{
-		switch (pAd->CommonCfg.DesireRate[i] & 0x7f)
-		{
-			case 2:  Rate = RATE_1;   num++;   break;
-			case 4:  Rate = RATE_2;   num++;   break;
-			case 11: Rate = RATE_5_5; num++;   break;
-			case 22: Rate = RATE_11;  num++;   break;
-			case 12: Rate = RATE_6;   num++;   break;
-			case 18: Rate = RATE_9;   num++;   break;
-			case 24: Rate = RATE_12;  num++;   break;
-			case 36: Rate = RATE_18;  num++;   break;
-			case 48: Rate = RATE_24;  num++;   break;
-			case 72: Rate = RATE_36;  num++;   break;
-			case 96: Rate = RATE_48;  num++;   break;
-			case 108: Rate = RATE_54; num++;   break;
-			//default: Rate = RATE_1;   break;
+	for (i = 0; i < MAX_LEN_OF_SUPPORTED_RATES; i++) {
+		switch (pAd->CommonCfg.DesireRate[i] & 0x7f) {
+		case 2:
+			Rate = RATE_1;
+			num++;
+			break;
+		case 4:
+			Rate = RATE_2;
+			num++;
+			break;
+		case 11:
+			Rate = RATE_5_5;
+			num++;
+			break;
+		case 22:
+			Rate = RATE_11;
+			num++;
+			break;
+		case 12:
+			Rate = RATE_6;
+			num++;
+			break;
+		case 18:
+			Rate = RATE_9;
+			num++;
+			break;
+		case 24:
+			Rate = RATE_12;
+			num++;
+			break;
+		case 36:
+			Rate = RATE_18;
+			num++;
+			break;
+		case 48:
+			Rate = RATE_24;
+			num++;
+			break;
+		case 72:
+			Rate = RATE_36;
+			num++;
+			break;
+		case 96:
+			Rate = RATE_48;
+			num++;
+			break;
+		case 108:
+			Rate = RATE_54;
+			num++;
+			break;
+			/*default: Rate = RATE_1;   break; */
 		}
-		if (MaxDesire < Rate)  MaxDesire = Rate;
+		if (MaxDesire < Rate)
+			MaxDesire = Rate;
 	}
 
-//===========================================================================
-//===========================================================================
+/*=========================================================================== */
+/*=========================================================================== */
 	{
-		pHtPhy 		= &pAd->StaCfg.HTPhyMode;
-		pMaxHtPhy	= &pAd->StaCfg.MaxHTPhyMode;
-		pMinHtPhy	= &pAd->StaCfg.MinHTPhyMode;
+		pHtPhy = &pAd->StaCfg.HTPhyMode;
+		pMaxHtPhy = &pAd->StaCfg.MaxHTPhyMode;
+		pMinHtPhy = &pAd->StaCfg.MinHTPhyMode;
 
 		auto_rate_cur_p = &pAd->StaCfg.bAutoTxRateSwitch;
-		HtMcs 		= pAd->StaCfg.DesiredTransmitSetting.field.MCS;
+		HtMcs = pAd->StaCfg.DesiredTransmitSetting.field.MCS;
 
 		if ((pAd->StaCfg.BssType == BSS_ADHOC) &&
-			(pAd->CommonCfg.PhyMode == PHY_11B) &&
-			(MaxDesire > RATE_11))
-		{
+		    (pAd->CommonCfg.PhyMode == PHY_11B) &&
+		    (MaxDesire > RATE_11)) {
 			MaxDesire = RATE_11;
 		}
 	}
@@ -2964,111 +2928,211 @@ VOID MlmeUpdateTxRates(
 	pMaxHtPhy->word = 0;
 	pHtPhy->word = 0;
 
-	// Auto rate switching is enabled only if more than one DESIRED RATES are
-	// specified; otherwise disabled
-	if (num <= 1)
-	{
+	/* Auto rate switching is enabled only if more than one DESIRED RATES are */
+	/* specified; otherwise disabled */
+	if (num <= 1) {
+		/*OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_TX_RATE_SWITCH_ENABLED); */
+		/*pAd->CommonCfg.bAutoTxRateSwitch      = FALSE; */
 		*auto_rate_cur_p = FALSE;
-	}
-	else
-	{
+	} else {
+		/*OPSTATUS_SET_FLAG(pAd, fOP_STATUS_TX_RATE_SWITCH_ENABLED); */
+		/*pAd->CommonCfg.bAutoTxRateSwitch      = TRUE; */
 		*auto_rate_cur_p = TRUE;
 	}
 
-#if 1
-	if (HtMcs != MCS_AUTO)
-	{
+	if (HtMcs != MCS_AUTO) {
+		/*OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_TX_RATE_SWITCH_ENABLED); */
+		/*pAd->CommonCfg.bAutoTxRateSwitch      = FALSE; */
 		*auto_rate_cur_p = FALSE;
-	}
-	else
-	{
+	} else {
+		/*OPSTATUS_SET_FLAG(pAd, fOP_STATUS_TX_RATE_SWITCH_ENABLED); */
+		/*pAd->CommonCfg.bAutoTxRateSwitch      = TRUE; */
 		*auto_rate_cur_p = TRUE;
 	}
-#endif
 
-	if ((ADHOC_ON(pAd) || INFRA_ON(pAd)) && (pAd->OpMode == OPMODE_STA))
-	{
+	if ((ADHOC_ON(pAd) || INFRA_ON(pAd)) && (pAd->OpMode == OPMODE_STA)) {
 		pSupRate = &pAd->StaActive.SupRate[0];
 		pExtRate = &pAd->StaActive.ExtRate[0];
 		SupRateLen = pAd->StaActive.SupRateLen;
 		ExtRateLen = pAd->StaActive.ExtRateLen;
-	}
-	else
-	{
+	} else {
 		pSupRate = &pAd->CommonCfg.SupRate[0];
 		pExtRate = &pAd->CommonCfg.ExtRate[0];
 		SupRateLen = pAd->CommonCfg.SupRateLen;
 		ExtRateLen = pAd->CommonCfg.ExtRateLen;
 	}
 
-	// find max supported rate
-	for (i=0; i<SupRateLen; i++)
-	{
-		switch (pSupRate[i] & 0x7f)
-		{
-			case 2:   Rate = RATE_1;	if (pSupRate[i] & 0x80) BasicRateBitmap |= 0x0001;	 break;
-			case 4:   Rate = RATE_2;	if (pSupRate[i] & 0x80) BasicRateBitmap |= 0x0002;	 break;
-			case 11:  Rate = RATE_5_5;	if (pSupRate[i] & 0x80) BasicRateBitmap |= 0x0004;	 break;
-			case 22:  Rate = RATE_11;	if (pSupRate[i] & 0x80) BasicRateBitmap |= 0x0008;	 break;
-			case 12:  Rate = RATE_6;	/*if (pSupRate[i] & 0x80)*/  BasicRateBitmap |= 0x0010;  break;
-			case 18:  Rate = RATE_9;	if (pSupRate[i] & 0x80) BasicRateBitmap |= 0x0020;	 break;
-			case 24:  Rate = RATE_12;	/*if (pSupRate[i] & 0x80)*/  BasicRateBitmap |= 0x0040;  break;
-			case 36:  Rate = RATE_18;	if (pSupRate[i] & 0x80) BasicRateBitmap |= 0x0080;	 break;
-			case 48:  Rate = RATE_24;	/*if (pSupRate[i] & 0x80)*/  BasicRateBitmap |= 0x0100;  break;
-			case 72:  Rate = RATE_36;	if (pSupRate[i] & 0x80) BasicRateBitmap |= 0x0200;	 break;
-			case 96:  Rate = RATE_48;	if (pSupRate[i] & 0x80) BasicRateBitmap |= 0x0400;	 break;
-			case 108: Rate = RATE_54;	if (pSupRate[i] & 0x80) BasicRateBitmap |= 0x0800;	 break;
-			default:  Rate = RATE_1;	break;
+	/* find max supported rate */
+	for (i = 0; i < SupRateLen; i++) {
+		switch (pSupRate[i] & 0x7f) {
+		case 2:
+			Rate = RATE_1;
+			if (pSupRate[i] & 0x80)
+				BasicRateBitmap |= 0x0001;
+			break;
+		case 4:
+			Rate = RATE_2;
+			if (pSupRate[i] & 0x80)
+				BasicRateBitmap |= 0x0002;
+			break;
+		case 11:
+			Rate = RATE_5_5;
+			if (pSupRate[i] & 0x80)
+				BasicRateBitmap |= 0x0004;
+			break;
+		case 22:
+			Rate = RATE_11;
+			if (pSupRate[i] & 0x80)
+				BasicRateBitmap |= 0x0008;
+			break;
+		case 12:
+			Rate = RATE_6;	/*if (pSupRate[i] & 0x80) */
+			BasicRateBitmap |= 0x0010;
+			break;
+		case 18:
+			Rate = RATE_9;
+			if (pSupRate[i] & 0x80)
+				BasicRateBitmap |= 0x0020;
+			break;
+		case 24:
+			Rate = RATE_12;	/*if (pSupRate[i] & 0x80) */
+			BasicRateBitmap |= 0x0040;
+			break;
+		case 36:
+			Rate = RATE_18;
+			if (pSupRate[i] & 0x80)
+				BasicRateBitmap |= 0x0080;
+			break;
+		case 48:
+			Rate = RATE_24;	/*if (pSupRate[i] & 0x80) */
+			BasicRateBitmap |= 0x0100;
+			break;
+		case 72:
+			Rate = RATE_36;
+			if (pSupRate[i] & 0x80)
+				BasicRateBitmap |= 0x0200;
+			break;
+		case 96:
+			Rate = RATE_48;
+			if (pSupRate[i] & 0x80)
+				BasicRateBitmap |= 0x0400;
+			break;
+		case 108:
+			Rate = RATE_54;
+			if (pSupRate[i] & 0x80)
+				BasicRateBitmap |= 0x0800;
+			break;
+		default:
+			Rate = RATE_1;
+			break;
 		}
-		if (MaxSupport < Rate)	MaxSupport = Rate;
+		if (MaxSupport < Rate)
+			MaxSupport = Rate;
 
-		if (MinSupport > Rate) MinSupport = Rate;
+		if (MinSupport > Rate)
+			MinSupport = Rate;
 	}
 
-	for (i=0; i<ExtRateLen; i++)
-	{
-		switch (pExtRate[i] & 0x7f)
-		{
-			case 2:   Rate = RATE_1;	if (pExtRate[i] & 0x80) BasicRateBitmap |= 0x0001;	 break;
-			case 4:   Rate = RATE_2;	if (pExtRate[i] & 0x80) BasicRateBitmap |= 0x0002;	 break;
-			case 11:  Rate = RATE_5_5;	if (pExtRate[i] & 0x80) BasicRateBitmap |= 0x0004;	 break;
-			case 22:  Rate = RATE_11;	if (pExtRate[i] & 0x80) BasicRateBitmap |= 0x0008;	 break;
-			case 12:  Rate = RATE_6;	/*if (pExtRate[i] & 0x80)*/  BasicRateBitmap |= 0x0010;  break;
-			case 18:  Rate = RATE_9;	if (pExtRate[i] & 0x80) BasicRateBitmap |= 0x0020;	 break;
-			case 24:  Rate = RATE_12;	/*if (pExtRate[i] & 0x80)*/  BasicRateBitmap |= 0x0040;  break;
-			case 36:  Rate = RATE_18;	if (pExtRate[i] & 0x80) BasicRateBitmap |= 0x0080;	 break;
-			case 48:  Rate = RATE_24;	/*if (pExtRate[i] & 0x80)*/  BasicRateBitmap |= 0x0100;  break;
-			case 72:  Rate = RATE_36;	if (pExtRate[i] & 0x80) BasicRateBitmap |= 0x0200;	 break;
-			case 96:  Rate = RATE_48;	if (pExtRate[i] & 0x80) BasicRateBitmap |= 0x0400;	 break;
-			case 108: Rate = RATE_54;	if (pExtRate[i] & 0x80) BasicRateBitmap |= 0x0800;	 break;
-			default:  Rate = RATE_1;	break;
+	for (i = 0; i < ExtRateLen; i++) {
+		switch (pExtRate[i] & 0x7f) {
+		case 2:
+			Rate = RATE_1;
+			if (pExtRate[i] & 0x80)
+				BasicRateBitmap |= 0x0001;
+			break;
+		case 4:
+			Rate = RATE_2;
+			if (pExtRate[i] & 0x80)
+				BasicRateBitmap |= 0x0002;
+			break;
+		case 11:
+			Rate = RATE_5_5;
+			if (pExtRate[i] & 0x80)
+				BasicRateBitmap |= 0x0004;
+			break;
+		case 22:
+			Rate = RATE_11;
+			if (pExtRate[i] & 0x80)
+				BasicRateBitmap |= 0x0008;
+			break;
+		case 12:
+			Rate = RATE_6;	/*if (pExtRate[i] & 0x80) */
+			BasicRateBitmap |= 0x0010;
+			break;
+		case 18:
+			Rate = RATE_9;
+			if (pExtRate[i] & 0x80)
+				BasicRateBitmap |= 0x0020;
+			break;
+		case 24:
+			Rate = RATE_12;	/*if (pExtRate[i] & 0x80) */
+			BasicRateBitmap |= 0x0040;
+			break;
+		case 36:
+			Rate = RATE_18;
+			if (pExtRate[i] & 0x80)
+				BasicRateBitmap |= 0x0080;
+			break;
+		case 48:
+			Rate = RATE_24;	/*if (pExtRate[i] & 0x80) */
+			BasicRateBitmap |= 0x0100;
+			break;
+		case 72:
+			Rate = RATE_36;
+			if (pExtRate[i] & 0x80)
+				BasicRateBitmap |= 0x0200;
+			break;
+		case 96:
+			Rate = RATE_48;
+			if (pExtRate[i] & 0x80)
+				BasicRateBitmap |= 0x0400;
+			break;
+		case 108:
+			Rate = RATE_54;
+			if (pExtRate[i] & 0x80)
+				BasicRateBitmap |= 0x0800;
+			break;
+		default:
+			Rate = RATE_1;
+			break;
 		}
-		if (MaxSupport < Rate)	MaxSupport = Rate;
+		if (MaxSupport < Rate)
+			MaxSupport = Rate;
 
-		if (MinSupport > Rate) MinSupport = Rate;
+		if (MinSupport > Rate)
+			MinSupport = Rate;
 	}
 
 	RTMP_IO_WRITE32(pAd, LEGACY_BASIC_RATE, BasicRateBitmap);
 
-	// calculate the exptected ACK rate for each TX rate. This info is used to caculate
-	// the DURATION field of outgoing uniicast DATA/MGMT frame
-	for (i=0; i<MAX_LEN_OF_SUPPORTED_RATES; i++)
-	{
+	/* bug fix */
+	/* pAd->CommonCfg.BasicRateBitmap = BasicRateBitmap; */
+
+	/* calculate the exptected ACK rate for each TX rate. This info is used to caculate */
+	/* the DURATION field of outgoing uniicast DATA/MGMT frame */
+	for (i = 0; i < MAX_LEN_OF_SUPPORTED_RATES; i++) {
 		if (BasicRateBitmap & (0x01 << i))
-			CurrBasicRate = (UCHAR)i;
+			CurrBasicRate = (u8)i;
 		pAd->CommonCfg.ExpectedACKRate[i] = CurrBasicRate;
 	}
 
-	DBGPRINT(RT_DEBUG_TRACE,("MlmeUpdateTxRates[MaxSupport = %d] = MaxDesire %d Mbps\n", RateIdToMbps[MaxSupport], RateIdToMbps[MaxDesire]));
-	// max tx rate = min {max desire rate, max supported rate}
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("MlmeUpdateTxRates[MaxSupport = %d] = MaxDesire %d Mbps\n",
+		  RateIdToMbps[MaxSupport], RateIdToMbps[MaxDesire]));
+	/* max tx rate = min {max desire rate, max supported rate} */
 	if (MaxSupport < MaxDesire)
 		pAd->CommonCfg.MaxTxRate = MaxSupport;
 	else
 		pAd->CommonCfg.MaxTxRate = MaxDesire;
 
 	pAd->CommonCfg.MinTxRate = MinSupport;
-	if (*auto_rate_cur_p)
-	{
+	/* 2003-07-31 john - 2500 doesn't have good sensitivity at high OFDM rates. to increase the success */
+	/* ratio of initial DHCP packet exchange, TX rate starts from a lower rate depending */
+	/* on average RSSI */
+	/*       1. RSSI >= -70db, start at 54 Mbps (short distance) */
+	/*       2. -70 > RSSI >= -75, start at 24 Mbps (mid distance) */
+	/*       3. -75 > RSSI, start at 11 Mbps (long distance) */
+	if (*auto_rate_cur_p) {
 		short dbm = 0;
 
 		dbm = pAd->StaCfg.RssiSample.AvgRssi0 - pAd->BbpRssiToDbmDelta;
@@ -3083,113 +3147,137 @@ VOID MlmeUpdateTxRates(
 		else if (dbm < -70)
 			pAd->CommonCfg.TxRate = RATE_24;
 
-		// should never exceed MaxTxRate (consider 11B-only mode)
+		/* should never exceed MaxTxRate (consider 11B-only mode) */
 		if (pAd->CommonCfg.TxRate > pAd->CommonCfg.MaxTxRate)
 			pAd->CommonCfg.TxRate = pAd->CommonCfg.MaxTxRate;
 
 		pAd->CommonCfg.TxRateIndex = 0;
-	}
-	else
-	{
+	} else {
 		pAd->CommonCfg.TxRate = pAd->CommonCfg.MaxTxRate;
-		pHtPhy->field.MCS	= (pAd->CommonCfg.MaxTxRate > 3) ? (pAd->CommonCfg.MaxTxRate - 4) : pAd->CommonCfg.MaxTxRate;
-		pHtPhy->field.MODE	= (pAd->CommonCfg.MaxTxRate > 3) ? MODE_OFDM : MODE_CCK;
-
-		pAd->MacTab.Content[BSSID_WCID].HTPhyMode.field.STBC	= pHtPhy->field.STBC;
-		pAd->MacTab.Content[BSSID_WCID].HTPhyMode.field.ShortGI	= pHtPhy->field.ShortGI;
-		pAd->MacTab.Content[BSSID_WCID].HTPhyMode.field.MCS		= pHtPhy->field.MCS;
-		pAd->MacTab.Content[BSSID_WCID].HTPhyMode.field.MODE	= pHtPhy->field.MODE;
-	}
-
-	if (pAd->CommonCfg.TxRate <= RATE_11)
-	{
+		pHtPhy->field.MCS =
+		    (pAd->CommonCfg.MaxTxRate >
+		     3) ? (pAd->CommonCfg.MaxTxRate -
+			   4) : pAd->CommonCfg.MaxTxRate;
+		pHtPhy->field.MODE =
+		    (pAd->CommonCfg.MaxTxRate > 3) ? MODE_OFDM : MODE_CCK;
+
+		pAd->MacTab.Content[BSSID_WCID].HTPhyMode.field.STBC =
+		    pHtPhy->field.STBC;
+		pAd->MacTab.Content[BSSID_WCID].HTPhyMode.field.ShortGI =
+		    pHtPhy->field.ShortGI;
+		pAd->MacTab.Content[BSSID_WCID].HTPhyMode.field.MCS =
+		    pHtPhy->field.MCS;
+		pAd->MacTab.Content[BSSID_WCID].HTPhyMode.field.MODE =
+		    pHtPhy->field.MODE;
+	}
+
+	if (pAd->CommonCfg.TxRate <= RATE_11) {
 		pMaxHtPhy->field.MODE = MODE_CCK;
 		pMaxHtPhy->field.MCS = pAd->CommonCfg.TxRate;
 		pMinHtPhy->field.MCS = pAd->CommonCfg.MinTxRate;
-	}
-	else
-	{
+	} else {
 		pMaxHtPhy->field.MODE = MODE_OFDM;
 		pMaxHtPhy->field.MCS = OfdmRateToRxwiMCS[pAd->CommonCfg.TxRate];
-		if (pAd->CommonCfg.MinTxRate >= RATE_6 && (pAd->CommonCfg.MinTxRate <= RATE_54))
-			{pMinHtPhy->field.MCS = OfdmRateToRxwiMCS[pAd->CommonCfg.MinTxRate];}
-		else
-			{pMinHtPhy->field.MCS = pAd->CommonCfg.MinTxRate;}
+		if (pAd->CommonCfg.MinTxRate >= RATE_6
+		    && (pAd->CommonCfg.MinTxRate <= RATE_54)) {
+			pMinHtPhy->field.MCS =
+			    OfdmRateToRxwiMCS[pAd->CommonCfg.MinTxRate];
+		} else {
+			pMinHtPhy->field.MCS = pAd->CommonCfg.MinTxRate;
+		}
 	}
 
 	pHtPhy->word = (pMaxHtPhy->word);
-	if (bLinkUp && (pAd->OpMode == OPMODE_STA))
-	{
-			pAd->MacTab.Content[BSSID_WCID].HTPhyMode.word = pHtPhy->word;
-			pAd->MacTab.Content[BSSID_WCID].MaxHTPhyMode.word = pMaxHtPhy->word;
-			pAd->MacTab.Content[BSSID_WCID].MinHTPhyMode.word = pMinHtPhy->word;
-	}
-	else
-	{
-		switch (pAd->CommonCfg.PhyMode)
-		{
-			case PHY_11BG_MIXED:
-			case PHY_11B:
-			case PHY_11BGN_MIXED:
+	if (bLinkUp && (pAd->OpMode == OPMODE_STA)) {
+		pAd->MacTab.Content[BSSID_WCID].HTPhyMode.word = pHtPhy->word;
+		pAd->MacTab.Content[BSSID_WCID].MaxHTPhyMode.word =
+		    pMaxHtPhy->word;
+		pAd->MacTab.Content[BSSID_WCID].MinHTPhyMode.word =
+		    pMinHtPhy->word;
+	} else {
+		switch (pAd->CommonCfg.PhyMode) {
+		case PHY_11BG_MIXED:
+		case PHY_11B:
+		case PHY_11BGN_MIXED:
+			pAd->CommonCfg.MlmeRate = RATE_1;
+			pAd->CommonCfg.MlmeTransmit.field.MODE = MODE_CCK;
+			pAd->CommonCfg.MlmeTransmit.field.MCS = RATE_1;
+
+/*#ifdef        WIFI_TEST */
+			pAd->CommonCfg.RtsRate = RATE_11;
+/*#else */
+/*                              pAd->CommonCfg.RtsRate = RATE_1; */
+/*#endif */
+			break;
+		case PHY_11G:
+		case PHY_11A:
+		case PHY_11AGN_MIXED:
+		case PHY_11GN_MIXED:
+		case PHY_11N_2_4G:
+		case PHY_11AN_MIXED:
+		case PHY_11N_5G:
+			pAd->CommonCfg.MlmeRate = RATE_6;
+			pAd->CommonCfg.RtsRate = RATE_6;
+			pAd->CommonCfg.MlmeTransmit.field.MODE = MODE_OFDM;
+			pAd->CommonCfg.MlmeTransmit.field.MCS =
+			    OfdmRateToRxwiMCS[pAd->CommonCfg.MlmeRate];
+			break;
+		case PHY_11ABG_MIXED:
+		case PHY_11ABGN_MIXED:
+			if (pAd->CommonCfg.Channel <= 14) {
 				pAd->CommonCfg.MlmeRate = RATE_1;
-				pAd->CommonCfg.MlmeTransmit.field.MODE = MODE_CCK;
+				pAd->CommonCfg.RtsRate = RATE_1;
+				pAd->CommonCfg.MlmeTransmit.field.MODE =
+				    MODE_CCK;
 				pAd->CommonCfg.MlmeTransmit.field.MCS = RATE_1;
-				pAd->CommonCfg.RtsRate = RATE_11;
-				break;
-			case PHY_11G:
-			case PHY_11A:
-			case PHY_11AGN_MIXED:
-			case PHY_11GN_MIXED:
-			case PHY_11N_2_4G:
-			case PHY_11AN_MIXED:
-			case PHY_11N_5G:
+			} else {
 				pAd->CommonCfg.MlmeRate = RATE_6;
 				pAd->CommonCfg.RtsRate = RATE_6;
-				pAd->CommonCfg.MlmeTransmit.field.MODE = MODE_OFDM;
-				pAd->CommonCfg.MlmeTransmit.field.MCS = OfdmRateToRxwiMCS[pAd->CommonCfg.MlmeRate];
-				break;
-			case PHY_11ABG_MIXED:
-			case PHY_11ABGN_MIXED:
-				if (pAd->CommonCfg.Channel <= 14)
-				{
-					pAd->CommonCfg.MlmeRate = RATE_1;
-					pAd->CommonCfg.RtsRate = RATE_1;
-					pAd->CommonCfg.MlmeTransmit.field.MODE = MODE_CCK;
-					pAd->CommonCfg.MlmeTransmit.field.MCS = RATE_1;
-				}
-				else
-				{
-					pAd->CommonCfg.MlmeRate = RATE_6;
-					pAd->CommonCfg.RtsRate = RATE_6;
-					pAd->CommonCfg.MlmeTransmit.field.MODE = MODE_OFDM;
-					pAd->CommonCfg.MlmeTransmit.field.MCS = OfdmRateToRxwiMCS[pAd->CommonCfg.MlmeRate];
-				}
-				break;
-			default: // error
-				pAd->CommonCfg.MlmeRate = RATE_6;
-                        	pAd->CommonCfg.MlmeTransmit.field.MODE = MODE_OFDM;
-				pAd->CommonCfg.MlmeTransmit.field.MCS = OfdmRateToRxwiMCS[pAd->CommonCfg.MlmeRate];
-				pAd->CommonCfg.RtsRate = RATE_1;
-				break;
+				pAd->CommonCfg.MlmeTransmit.field.MODE =
+				    MODE_OFDM;
+				pAd->CommonCfg.MlmeTransmit.field.MCS =
+				    OfdmRateToRxwiMCS[pAd->CommonCfg.MlmeRate];
+			}
+			break;
+		default:	/* error */
+			pAd->CommonCfg.MlmeRate = RATE_6;
+			pAd->CommonCfg.MlmeTransmit.field.MODE = MODE_OFDM;
+			pAd->CommonCfg.MlmeTransmit.field.MCS =
+			    OfdmRateToRxwiMCS[pAd->CommonCfg.MlmeRate];
+			pAd->CommonCfg.RtsRate = RATE_1;
+			break;
 		}
-		//
-		// Keep Basic Mlme Rate.
-		//
-		pAd->MacTab.Content[MCAST_WCID].HTPhyMode.word = pAd->CommonCfg.MlmeTransmit.word;
+		/* */
+		/* Keep Basic Mlme Rate. */
+		/* */
+		pAd->MacTab.Content[MCAST_WCID].HTPhyMode.word =
+		    pAd->CommonCfg.MlmeTransmit.word;
 		if (pAd->CommonCfg.MlmeTransmit.field.MODE == MODE_OFDM)
-			pAd->MacTab.Content[MCAST_WCID].HTPhyMode.field.MCS = OfdmRateToRxwiMCS[RATE_24];
+			pAd->MacTab.Content[MCAST_WCID].HTPhyMode.field.MCS =
+			    OfdmRateToRxwiMCS[RATE_24];
 		else
-			pAd->MacTab.Content[MCAST_WCID].HTPhyMode.field.MCS = RATE_1;
+			pAd->MacTab.Content[MCAST_WCID].HTPhyMode.field.MCS =
+			    RATE_1;
 		pAd->CommonCfg.BasicMlmeRate = pAd->CommonCfg.MlmeRate;
 	}
 
-	DBGPRINT(RT_DEBUG_TRACE, (" MlmeUpdateTxRates (MaxDesire=%d, MaxSupport=%d, MaxTxRate=%d, MinRate=%d, Rate Switching =%d)\n",
-			 RateIdToMbps[MaxDesire], RateIdToMbps[MaxSupport], RateIdToMbps[pAd->CommonCfg.MaxTxRate], RateIdToMbps[pAd->CommonCfg.MinTxRate],
-			 /*OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_TX_RATE_SWITCH_ENABLED)*/*auto_rate_cur_p));
-	DBGPRINT(RT_DEBUG_TRACE, (" MlmeUpdateTxRates (TxRate=%d, RtsRate=%d, BasicRateBitmap=0x%04lx)\n",
-			 RateIdToMbps[pAd->CommonCfg.TxRate], RateIdToMbps[pAd->CommonCfg.RtsRate], BasicRateBitmap));
-	DBGPRINT(RT_DEBUG_TRACE, ("MlmeUpdateTxRates (MlmeTransmit=0x%x, MinHTPhyMode=%x, MaxHTPhyMode=0x%x, HTPhyMode=0x%x)\n",
-			 pAd->CommonCfg.MlmeTransmit.word, pAd->MacTab.Content[BSSID_WCID].MinHTPhyMode.word ,pAd->MacTab.Content[BSSID_WCID].MaxHTPhyMode.word ,pAd->MacTab.Content[BSSID_WCID].HTPhyMode.word ));
+	DBGPRINT(RT_DEBUG_TRACE,
+		 (" MlmeUpdateTxRates (MaxDesire=%d, MaxSupport=%d, MaxTxRate=%d, MinRate=%d, Rate Switching =%d)\n",
+		  RateIdToMbps[MaxDesire], RateIdToMbps[MaxSupport],
+		  RateIdToMbps[pAd->CommonCfg.MaxTxRate],
+		  RateIdToMbps[pAd->CommonCfg.MinTxRate],
+		  /*OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_TX_RATE_SWITCH_ENABLED) */
+		  *auto_rate_cur_p));
+	DBGPRINT(RT_DEBUG_TRACE,
+		 (" MlmeUpdateTxRates (TxRate=%d, RtsRate=%d, BasicRateBitmap=0x%04lx)\n",
+		  RateIdToMbps[pAd->CommonCfg.TxRate],
+		  RateIdToMbps[pAd->CommonCfg.RtsRate], BasicRateBitmap));
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("MlmeUpdateTxRates (MlmeTransmit=0x%x, MinHTPhyMode=%x, MaxHTPhyMode=0x%x, HTPhyMode=0x%x)\n",
+		  pAd->CommonCfg.MlmeTransmit.word,
+		  pAd->MacTab.Content[BSSID_WCID].MinHTPhyMode.word,
+		  pAd->MacTab.Content[BSSID_WCID].MaxHTPhyMode.word,
+		  pAd->MacTab.Content[BSSID_WCID].HTPhyMode.word));
 }
 
 /*
@@ -3198,168 +3286,196 @@ VOID MlmeUpdateTxRates(
 		This function update HT Rate setting.
 		Input Wcid value is valid for 2 case :
 		1. it's used for Station in infra mode that copy AP rate to Mactable.
-		2. OR Station 	in adhoc mode to copy peer's HT rate to Mactable.
+		2. OR Station	in adhoc mode to copy peer's HT rate to Mactable.
 
-	IRQL = DISPATCH_LEVEL
+ IRQL = DISPATCH_LEVEL
 
 	==========================================================================
  */
-VOID MlmeUpdateHtTxRates(
-	IN PRTMP_ADAPTER 		pAd,
-	IN	UCHAR				apidx)
+void MlmeUpdateHtTxRates(struct rt_rtmp_adapter *pAd, u8 apidx)
 {
-	UCHAR	StbcMcs; //j, StbcMcs, bitmask;
-	CHAR 	i; // 3*3
-	RT_HT_CAPABILITY 	*pRtHtCap = NULL;
-	RT_HT_PHY_INFO		*pActiveHtPhy = NULL;
-	ULONG		BasicMCS;
-	UCHAR j, bitmask;
-	PRT_HT_PHY_INFO			pDesireHtPhy = NULL;
-	PHTTRANSMIT_SETTING		pHtPhy = NULL;
-	PHTTRANSMIT_SETTING		pMaxHtPhy = NULL;
-	PHTTRANSMIT_SETTING		pMinHtPhy = NULL;
-	BOOLEAN 				*auto_rate_cur_p;
-
-	DBGPRINT(RT_DEBUG_TRACE,("MlmeUpdateHtTxRates===> \n"));
+	u8 StbcMcs;		/*j, StbcMcs, bitmask; */
+	char i;			/* 3*3 */
+	struct rt_ht_capability *pRtHtCap = NULL;
+	struct rt_ht_phy_info *pActiveHtPhy = NULL;
+	unsigned long BasicMCS;
+	u8 j, bitmask;
+	struct rt_ht_phy_info *pDesireHtPhy = NULL;
+	PHTTRANSMIT_SETTING pHtPhy = NULL;
+	PHTTRANSMIT_SETTING pMaxHtPhy = NULL;
+	PHTTRANSMIT_SETTING pMinHtPhy = NULL;
+	BOOLEAN *auto_rate_cur_p;
+
+	DBGPRINT(RT_DEBUG_TRACE, ("MlmeUpdateHtTxRates===> \n"));
 
 	auto_rate_cur_p = NULL;
 
 	{
-		pDesireHtPhy	= &pAd->StaCfg.DesiredHtPhyInfo;
-		pActiveHtPhy	= &pAd->StaCfg.DesiredHtPhyInfo;
-		pHtPhy 		= &pAd->StaCfg.HTPhyMode;
-		pMaxHtPhy	= &pAd->StaCfg.MaxHTPhyMode;
-		pMinHtPhy	= &pAd->StaCfg.MinHTPhyMode;
+		pDesireHtPhy = &pAd->StaCfg.DesiredHtPhyInfo;
+		pActiveHtPhy = &pAd->StaCfg.DesiredHtPhyInfo;
+		pHtPhy = &pAd->StaCfg.HTPhyMode;
+		pMaxHtPhy = &pAd->StaCfg.MaxHTPhyMode;
+		pMinHtPhy = &pAd->StaCfg.MinHTPhyMode;
 
 		auto_rate_cur_p = &pAd->StaCfg.bAutoTxRateSwitch;
 	}
 
-	if ((ADHOC_ON(pAd) || INFRA_ON(pAd)) && (pAd->OpMode == OPMODE_STA))
-	{
+	if ((ADHOC_ON(pAd) || INFRA_ON(pAd)) && (pAd->OpMode == OPMODE_STA)) {
 		if (pAd->StaActive.SupportedPhyInfo.bHtEnable == FALSE)
 			return;
 
 		pRtHtCap = &pAd->StaActive.SupportedHtPhy;
 		pActiveHtPhy = &pAd->StaActive.SupportedPhyInfo;
-		StbcMcs = (UCHAR)pAd->MlmeAux.AddHtInfo.AddHtInfo3.StbcMcs;
-		BasicMCS =pAd->MlmeAux.AddHtInfo.MCSSet[0]+(pAd->MlmeAux.AddHtInfo.MCSSet[1]<<8)+(StbcMcs<<16);
-		if ((pAd->CommonCfg.DesiredHtPhy.TxSTBC) && (pRtHtCap->RxSTBC) && (pAd->Antenna.field.TxPath == 2))
+		StbcMcs = (u8)pAd->MlmeAux.AddHtInfo.AddHtInfo3.StbcMcs;
+		BasicMCS =
+		    pAd->MlmeAux.AddHtInfo.MCSSet[0] +
+		    (pAd->MlmeAux.AddHtInfo.MCSSet[1] << 8) + (StbcMcs << 16);
+		if ((pAd->CommonCfg.DesiredHtPhy.TxSTBC) && (pRtHtCap->RxSTBC)
+		    && (pAd->Antenna.field.TxPath == 2))
 			pMaxHtPhy->field.STBC = STBC_USE;
 		else
 			pMaxHtPhy->field.STBC = STBC_NONE;
-	}
-	else
-	{
+	} else {
 		if (pDesireHtPhy->bHtEnable == FALSE)
 			return;
 
 		pRtHtCap = &pAd->CommonCfg.DesiredHtPhy;
-		StbcMcs = (UCHAR)pAd->CommonCfg.AddHTInfo.AddHtInfo3.StbcMcs;
-		BasicMCS = pAd->CommonCfg.AddHTInfo.MCSSet[0]+(pAd->CommonCfg.AddHTInfo.MCSSet[1]<<8)+(StbcMcs<<16);
-		if ((pAd->CommonCfg.DesiredHtPhy.TxSTBC) && (pRtHtCap->RxSTBC) && (pAd->Antenna.field.TxPath == 2))
+		StbcMcs = (u8)pAd->CommonCfg.AddHTInfo.AddHtInfo3.StbcMcs;
+		BasicMCS =
+		    pAd->CommonCfg.AddHTInfo.MCSSet[0] +
+		    (pAd->CommonCfg.AddHTInfo.MCSSet[1] << 8) + (StbcMcs << 16);
+		if ((pAd->CommonCfg.DesiredHtPhy.TxSTBC) && (pRtHtCap->RxSTBC)
+		    && (pAd->Antenna.field.TxPath == 2))
 			pMaxHtPhy->field.STBC = STBC_USE;
 		else
 			pMaxHtPhy->field.STBC = STBC_NONE;
 	}
 
-	// Decide MAX ht rate.
+	/* Decide MAX ht rate. */
 	if ((pRtHtCap->GF) && (pAd->CommonCfg.DesiredHtPhy.GF))
 		pMaxHtPhy->field.MODE = MODE_HTGREENFIELD;
 	else
 		pMaxHtPhy->field.MODE = MODE_HTMIX;
 
-    if ((pAd->CommonCfg.DesiredHtPhy.ChannelWidth) && (pRtHtCap->ChannelWidth))
+	if ((pAd->CommonCfg.DesiredHtPhy.ChannelWidth)
+	    && (pRtHtCap->ChannelWidth))
 		pMaxHtPhy->field.BW = BW_40;
 	else
 		pMaxHtPhy->field.BW = BW_20;
 
-    if (pMaxHtPhy->field.BW == BW_20)
-		pMaxHtPhy->field.ShortGI = (pAd->CommonCfg.DesiredHtPhy.ShortGIfor20 & pRtHtCap->ShortGIfor20);
+	if (pMaxHtPhy->field.BW == BW_20)
+		pMaxHtPhy->field.ShortGI =
+		    (pAd->CommonCfg.DesiredHtPhy.ShortGIfor20 & pRtHtCap->
+		     ShortGIfor20);
 	else
-		pMaxHtPhy->field.ShortGI = (pAd->CommonCfg.DesiredHtPhy.ShortGIfor40 & pRtHtCap->ShortGIfor40);
+		pMaxHtPhy->field.ShortGI =
+		    (pAd->CommonCfg.DesiredHtPhy.ShortGIfor40 & pRtHtCap->
+		     ShortGIfor40);
 
-	for (i=23; i>=0; i--) // 3*3
+	if (pDesireHtPhy->MCSSet[4] != 0) {
+		pMaxHtPhy->field.MCS = 32;
+	}
+
+	for (i = 23; i >= 0; i--)	/* 3*3 */
 	{
-		j = i/8;
-		bitmask = (1<<(i-(j*8)));
+		j = i / 8;
+		bitmask = (1 << (i - (j * 8)));
 
-		if ((pActiveHtPhy->MCSSet[j] & bitmask) && (pDesireHtPhy->MCSSet[j] & bitmask))
-		{
+		if ((pActiveHtPhy->MCSSet[j] & bitmask)
+		    && (pDesireHtPhy->MCSSet[j] & bitmask)) {
 			pMaxHtPhy->field.MCS = i;
 			break;
 		}
 
-		if (i==0)
+		if (i == 0)
 			break;
 	}
 
-	// Copy MIN ht rate.  rt2860???
+	/* Copy MIN ht rate.  rt2860??? */
 	pMinHtPhy->field.BW = BW_20;
 	pMinHtPhy->field.MCS = 0;
 	pMinHtPhy->field.STBC = 0;
 	pMinHtPhy->field.ShortGI = 0;
-	//If STA assigns fixed rate. update to fixed here.
-	if ( (pAd->OpMode == OPMODE_STA) && (pDesireHtPhy->MCSSet[0] != 0xff))
-	{
-		if (pDesireHtPhy->MCSSet[4] != 0)
-		{
+	/*If STA assigns fixed rate. update to fixed here. */
+	if ((pAd->OpMode == OPMODE_STA) && (pDesireHtPhy->MCSSet[0] != 0xff)) {
+		if (pDesireHtPhy->MCSSet[4] != 0) {
 			pMaxHtPhy->field.MCS = 32;
 			pMinHtPhy->field.MCS = 32;
-			DBGPRINT(RT_DEBUG_TRACE,("MlmeUpdateHtTxRates<=== Use Fixed MCS = %d\n",pMinHtPhy->field.MCS));
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("MlmeUpdateHtTxRates<=== Use Fixed MCS = %d\n",
+				  pMinHtPhy->field.MCS));
 		}
 
-		for (i=23; (CHAR)i >= 0; i--) // 3*3
+		for (i = 23; (char)i >= 0; i--)	/* 3*3 */
 		{
-			j = i/8;
-			bitmask = (1<<(i-(j*8)));
-			if ( (pDesireHtPhy->MCSSet[j] & bitmask) && (pActiveHtPhy->MCSSet[j] & bitmask))
-			{
+			j = i / 8;
+			bitmask = (1 << (i - (j * 8)));
+			if ((pDesireHtPhy->MCSSet[j] & bitmask)
+			    && (pActiveHtPhy->MCSSet[j] & bitmask)) {
 				pMaxHtPhy->field.MCS = i;
 				pMinHtPhy->field.MCS = i;
 				break;
 			}
-			if (i==0)
+			if (i == 0)
 				break;
 		}
 	}
 
-	// Decide ht rate
+	/* Decide ht rate */
 	pHtPhy->field.STBC = pMaxHtPhy->field.STBC;
 	pHtPhy->field.BW = pMaxHtPhy->field.BW;
 	pHtPhy->field.MODE = pMaxHtPhy->field.MODE;
 	pHtPhy->field.MCS = pMaxHtPhy->field.MCS;
 	pHtPhy->field.ShortGI = pMaxHtPhy->field.ShortGI;
 
-	// use default now. rt2860
+	/* use default now. rt2860 */
 	if (pDesireHtPhy->MCSSet[0] != 0xff)
 		*auto_rate_cur_p = FALSE;
 	else
 		*auto_rate_cur_p = TRUE;
 
-	DBGPRINT(RT_DEBUG_TRACE, (" MlmeUpdateHtTxRates<---.AMsduSize = %d  \n", pAd->CommonCfg.DesiredHtPhy.AmsduSize ));
-	DBGPRINT(RT_DEBUG_TRACE,("TX: MCS[0] = %x (choose %d), BW = %d, ShortGI = %d, MODE = %d,  \n", pActiveHtPhy->MCSSet[0],pHtPhy->field.MCS,
-		pHtPhy->field.BW, pHtPhy->field.ShortGI, pHtPhy->field.MODE));
-	DBGPRINT(RT_DEBUG_TRACE,("MlmeUpdateHtTxRates<=== \n"));
+	DBGPRINT(RT_DEBUG_TRACE,
+		 (" MlmeUpdateHtTxRates<---.AMsduSize = %d  \n",
+		  pAd->CommonCfg.DesiredHtPhy.AmsduSize));
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("TX: MCS[0] = %x (choose %d), BW = %d, ShortGI = %d, MODE = %d,  \n",
+		  pActiveHtPhy->MCSSet[0], pHtPhy->field.MCS, pHtPhy->field.BW,
+		  pHtPhy->field.ShortGI, pHtPhy->field.MODE));
+	DBGPRINT(RT_DEBUG_TRACE, ("MlmeUpdateHtTxRates<=== \n"));
 }
 
-// IRQL = DISPATCH_LEVEL
-VOID MlmeRadioOff(
-	IN PRTMP_ADAPTER pAd)
+void BATableInit(struct rt_rtmp_adapter *pAd, struct rt_ba_table *Tab)
 {
-	RT28XX_MLME_RADIO_OFF(pAd);
+	int i;
+
+	Tab->numAsOriginator = 0;
+	Tab->numAsRecipient = 0;
+	Tab->numDoneOriginator = 0;
+	NdisAllocateSpinLock(&pAd->BATabLock);
+	for (i = 0; i < MAX_LEN_OF_BA_REC_TABLE; i++) {
+		Tab->BARecEntry[i].REC_BA_Status = Recipient_NONE;
+		NdisAllocateSpinLock(&(Tab->BARecEntry[i].RxReRingLock));
+	}
+	for (i = 0; i < MAX_LEN_OF_BA_ORI_TABLE; i++) {
+		Tab->BAOriEntry[i].ORI_BA_Status = Originator_NONE;
+	}
 }
 
-// IRQL = DISPATCH_LEVEL
-VOID MlmeRadioOn(
-	IN PRTMP_ADAPTER pAd)
+/* IRQL = DISPATCH_LEVEL */
+void MlmeRadioOff(struct rt_rtmp_adapter *pAd)
 {
-	RT28XX_MLME_RADIO_ON(pAd);
+	RTMP_MLME_RADIO_OFF(pAd);
 }
 
-// ===========================================================================================
-// bss_table.c
-// ===========================================================================================
+/* IRQL = DISPATCH_LEVEL */
+void MlmeRadioOn(struct rt_rtmp_adapter *pAd)
+{
+	RTMP_MLME_RADIO_ON(pAd);
+}
 
+/* =========================================================================================== */
+/* bss_table.c */
+/* =========================================================================================== */
 
 /*! \brief initialize BSS table
  *	\param p_tab pointer to the table
@@ -3371,37 +3487,15 @@ VOID MlmeRadioOn(
  IRQL = DISPATCH_LEVEL
 
  */
-VOID BssTableInit(
-	IN BSS_TABLE *Tab)
+void BssTableInit(struct rt_bss_table *Tab)
 {
 	int i;
 
 	Tab->BssNr = 0;
-    Tab->BssOverlapNr = 0;
-	for (i = 0; i < MAX_LEN_OF_BSS_TABLE; i++)
-	{
-		NdisZeroMemory(&Tab->BssEntry[i], sizeof(BSS_ENTRY));
-		Tab->BssEntry[i].Rssi = -127;	// initial the rssi as a minimum value
-	}
-}
-
-VOID BATableInit(
-	IN PRTMP_ADAPTER pAd,
-    IN BA_TABLE *Tab)
-{
-	int i;
-
-	Tab->numAsOriginator = 0;
-	Tab->numAsRecipient = 0;
-	NdisAllocateSpinLock(&pAd->BATabLock);
-	for (i = 0; i < MAX_LEN_OF_BA_REC_TABLE; i++)
-	{
-		Tab->BARecEntry[i].REC_BA_Status = Recipient_NONE;
-		NdisAllocateSpinLock(&(Tab->BARecEntry[i].RxReRingLock));
-	}
-	for (i = 0; i < MAX_LEN_OF_BA_ORI_TABLE; i++)
-	{
-		Tab->BAOriEntry[i].ORI_BA_Status = Originator_NONE;
+	Tab->BssOverlapNr = 0;
+	for (i = 0; i < MAX_LEN_OF_BSS_TABLE; i++) {
+		NdisZeroMemory(&Tab->BssEntry[i], sizeof(struct rt_bss_entry));
+		Tab->BssEntry[i].Rssi = -127;	/* initial the rssi as a minimum value */
 	}
 }
 
@@ -3416,97 +3510,102 @@ VOID BATableInit(
  IRQL = DISPATCH_LEVEL
 
  */
-ULONG BssTableSearch(
-	IN BSS_TABLE *Tab,
-	IN PUCHAR	 pBssid,
-	IN UCHAR	 Channel)
+unsigned long BssTableSearch(struct rt_bss_table *Tab, u8 *pBssid, u8 Channel)
 {
-	UCHAR i;
+	u8 i;
 
-	for (i = 0; i < Tab->BssNr; i++)
-	{
-		//
-		// Some AP that support A/B/G mode that may used the same BSSID on 11A and 11B/G.
-		// We should distinguish this case.
-		//
+	for (i = 0; i < Tab->BssNr; i++) {
+		/* */
+		/* Some AP that support A/B/G mode that may used the same BSSID on 11A and 11B/G. */
+		/* We should distinguish this case. */
+		/* */
 		if ((((Tab->BssEntry[i].Channel <= 14) && (Channel <= 14)) ||
-			 ((Tab->BssEntry[i].Channel > 14) && (Channel > 14))) &&
-			MAC_ADDR_EQUAL(Tab->BssEntry[i].Bssid, pBssid))
-		{
+		     ((Tab->BssEntry[i].Channel > 14) && (Channel > 14))) &&
+		    MAC_ADDR_EQUAL(Tab->BssEntry[i].Bssid, pBssid)) {
 			return i;
 		}
 	}
-	return (ULONG)BSS_NOT_FOUND;
+	return (unsigned long)BSS_NOT_FOUND;
 }
 
-ULONG BssSsidTableSearch(
-	IN BSS_TABLE *Tab,
-	IN PUCHAR	 pBssid,
-	IN PUCHAR	 pSsid,
-	IN UCHAR	 SsidLen,
-	IN UCHAR	 Channel)
+unsigned long BssSsidTableSearch(struct rt_bss_table *Tab,
+			 u8 *pBssid,
+			 u8 *pSsid, u8 SsidLen, u8 Channel)
 {
-	UCHAR i;
+	u8 i;
 
-	for (i = 0; i < Tab->BssNr; i++)
-	{
-		//
-		// Some AP that support A/B/G mode that may used the same BSSID on 11A and 11B/G.
-		// We should distinguish this case.
-		//
+	for (i = 0; i < Tab->BssNr; i++) {
+		/* */
+		/* Some AP that support A/B/G mode that may used the same BSSID on 11A and 11B/G. */
+		/* We should distinguish this case. */
+		/* */
 		if ((((Tab->BssEntry[i].Channel <= 14) && (Channel <= 14)) ||
-			 ((Tab->BssEntry[i].Channel > 14) && (Channel > 14))) &&
-			MAC_ADDR_EQUAL(Tab->BssEntry[i].Bssid, pBssid) &&
-			SSID_EQUAL(pSsid, SsidLen, Tab->BssEntry[i].Ssid, Tab->BssEntry[i].SsidLen))
-		{
+		     ((Tab->BssEntry[i].Channel > 14) && (Channel > 14))) &&
+		    MAC_ADDR_EQUAL(Tab->BssEntry[i].Bssid, pBssid) &&
+		    SSID_EQUAL(pSsid, SsidLen, Tab->BssEntry[i].Ssid,
+			       Tab->BssEntry[i].SsidLen)) {
 			return i;
 		}
 	}
-	return (ULONG)BSS_NOT_FOUND;
+	return (unsigned long)BSS_NOT_FOUND;
 }
 
-ULONG BssTableSearchWithSSID(
-	IN BSS_TABLE *Tab,
-	IN PUCHAR	 Bssid,
-	IN PUCHAR	 pSsid,
-	IN UCHAR	 SsidLen,
-	IN UCHAR	 Channel)
+unsigned long BssTableSearchWithSSID(struct rt_bss_table *Tab,
+			     u8 *Bssid,
+			     u8 *pSsid,
+			     u8 SsidLen, u8 Channel)
 {
-	UCHAR i;
+	u8 i;
 
-	for (i = 0; i < Tab->BssNr; i++)
-	{
+	for (i = 0; i < Tab->BssNr; i++) {
 		if ((((Tab->BssEntry[i].Channel <= 14) && (Channel <= 14)) ||
-			((Tab->BssEntry[i].Channel > 14) && (Channel > 14))) &&
-			MAC_ADDR_EQUAL(&(Tab->BssEntry[i].Bssid), Bssid) &&
-			(SSID_EQUAL(pSsid, SsidLen, Tab->BssEntry[i].Ssid, Tab->BssEntry[i].SsidLen) ||
-			(NdisEqualMemory(pSsid, ZeroSsid, SsidLen)) ||
-			(NdisEqualMemory(Tab->BssEntry[i].Ssid, ZeroSsid, Tab->BssEntry[i].SsidLen))))
-		{
+		     ((Tab->BssEntry[i].Channel > 14) && (Channel > 14))) &&
+		    MAC_ADDR_EQUAL(&(Tab->BssEntry[i].Bssid), Bssid) &&
+		    (SSID_EQUAL
+		     (pSsid, SsidLen, Tab->BssEntry[i].Ssid,
+		      Tab->BssEntry[i].SsidLen)
+		     || (NdisEqualMemory(pSsid, ZeroSsid, SsidLen))
+		     ||
+		     (NdisEqualMemory
+		      (Tab->BssEntry[i].Ssid, ZeroSsid,
+		       Tab->BssEntry[i].SsidLen)))) {
 			return i;
 		}
 	}
-	return (ULONG)BSS_NOT_FOUND;
+	return (unsigned long)BSS_NOT_FOUND;
 }
 
-// IRQL = DISPATCH_LEVEL
-VOID BssTableDeleteEntry(
-	IN OUT	BSS_TABLE *Tab,
-	IN		PUCHAR	  pBssid,
-	IN		UCHAR	  Channel)
+unsigned long BssSsidTableSearchBySSID(struct rt_bss_table *Tab,
+			       u8 *pSsid, u8 SsidLen)
 {
-	UCHAR i, j;
+	u8 i;
 
-	for (i = 0; i < Tab->BssNr; i++)
-	{
+	for (i = 0; i < Tab->BssNr; i++) {
+		if (SSID_EQUAL
+		    (pSsid, SsidLen, Tab->BssEntry[i].Ssid,
+		     Tab->BssEntry[i].SsidLen)) {
+			return i;
+		}
+	}
+	return (unsigned long)BSS_NOT_FOUND;
+}
+
+/* IRQL = DISPATCH_LEVEL */
+void BssTableDeleteEntry(struct rt_bss_table *Tab,
+			 u8 *pBssid, u8 Channel)
+{
+	u8 i, j;
+
+	for (i = 0; i < Tab->BssNr; i++) {
 		if ((Tab->BssEntry[i].Channel == Channel) &&
-			(MAC_ADDR_EQUAL(Tab->BssEntry[i].Bssid, pBssid)))
-		{
-			for (j = i; j < Tab->BssNr - 1; j++)
-			{
-				NdisMoveMemory(&(Tab->BssEntry[j]), &(Tab->BssEntry[j + 1]), sizeof(BSS_ENTRY));
+		    (MAC_ADDR_EQUAL(Tab->BssEntry[i].Bssid, pBssid))) {
+			for (j = i; j < Tab->BssNr - 1; j++) {
+				NdisMoveMemory(&(Tab->BssEntry[j]),
+					       &(Tab->BssEntry[j + 1]),
+					       sizeof(struct rt_bss_entry));
 			}
-			NdisZeroMemory(&(Tab->BssEntry[Tab->BssNr - 1]), sizeof(BSS_ENTRY));
+			NdisZeroMemory(&(Tab->BssEntry[Tab->BssNr - 1]),
+				       sizeof(struct rt_bss_entry));
 			Tab->BssNr -= 1;
 			return;
 		}
@@ -3522,25 +3621,24 @@ VOID BssTableDeleteEntry(
 	// IRQL = DISPATCH_LEVEL
 	========================================================================
 */
-VOID BATableDeleteORIEntry(
-	IN OUT	PRTMP_ADAPTER pAd,
-	IN		BA_ORI_ENTRY	*pBAORIEntry)
+void BATableDeleteORIEntry(struct rt_rtmp_adapter *pAd,
+			   struct rt_ba_ori_entry *pBAORIEntry)
 {
 
-	if (pBAORIEntry->ORI_BA_Status != Originator_NONE)
-	{
+	if (pBAORIEntry->ORI_BA_Status != Originator_NONE) {
 		NdisAcquireSpinLock(&pAd->BATabLock);
-		if (pBAORIEntry->ORI_BA_Status == Originator_Done)
-		{
+		if (pBAORIEntry->ORI_BA_Status == Originator_Done) {
 			pAd->BATable.numAsOriginator -= 1;
-			DBGPRINT(RT_DEBUG_TRACE, ("BATableDeleteORIEntry numAsOriginator= %ld\n", pAd->BATable.numAsRecipient));
-			// Erase Bitmap flag.
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("BATableDeleteORIEntry numAsOriginator= %ld\n",
+				  pAd->BATable.numAsRecipient));
+			/* Erase Bitmap flag. */
 		}
-		pAd->MacTab.Content[pBAORIEntry->Wcid].TXBAbitmap &= (~(1<<(pBAORIEntry->TID) ));	// If STA mode,  erase flag here
-		pAd->MacTab.Content[pBAORIEntry->Wcid].BAOriWcidArray[pBAORIEntry->TID] = 0;	// If STA mode,  erase flag here
+		pAd->MacTab.Content[pBAORIEntry->Wcid].TXBAbitmap &= (~(1 << (pBAORIEntry->TID)));	/* If STA mode,  erase flag here */
+		pAd->MacTab.Content[pBAORIEntry->Wcid].BAOriWcidArray[pBAORIEntry->TID] = 0;	/* If STA mode,  erase flag here */
 		pBAORIEntry->ORI_BA_Status = Originator_NONE;
 		pBAORIEntry->Token = 1;
-		// Not clear Sequence here.
+		/* Not clear Sequence here. */
 		NdisReleaseSpinLock(&pAd->BATabLock);
 	}
 }
@@ -3554,190 +3652,164 @@ VOID BATableDeleteORIEntry(
  IRQL = DISPATCH_LEVEL
 
  */
-VOID BssEntrySet(
-	IN PRTMP_ADAPTER	pAd,
-	OUT BSS_ENTRY *pBss,
-	IN PUCHAR pBssid,
-	IN CHAR Ssid[],
-	IN UCHAR SsidLen,
-	IN UCHAR BssType,
-	IN USHORT BeaconPeriod,
-	IN PCF_PARM pCfParm,
-	IN USHORT AtimWin,
-	IN USHORT CapabilityInfo,
-	IN UCHAR SupRate[],
-	IN UCHAR SupRateLen,
-	IN UCHAR ExtRate[],
-	IN UCHAR ExtRateLen,
-	IN HT_CAPABILITY_IE *pHtCapability,
-	IN ADD_HT_INFO_IE *pAddHtInfo,	// AP might use this additional ht info IE
-	IN UCHAR			HtCapabilityLen,
-	IN UCHAR			AddHtInfoLen,
-	IN UCHAR			NewExtChanOffset,
-	IN UCHAR Channel,
-	IN CHAR Rssi,
-	IN LARGE_INTEGER TimeStamp,
-	IN UCHAR CkipFlag,
-	IN PEDCA_PARM pEdcaParm,
-	IN PQOS_CAPABILITY_PARM pQosCapability,
-	IN PQBSS_LOAD_PARM pQbssLoad,
-	IN USHORT LengthVIE,
-	IN PNDIS_802_11_VARIABLE_IEs pVIE)
+void BssEntrySet(struct rt_rtmp_adapter *pAd, struct rt_bss_entry *pBss, u8 *pBssid, char Ssid[], u8 SsidLen, u8 BssType, u16 BeaconPeriod, struct rt_cf_parm * pCfParm, u16 AtimWin, u16 CapabilityInfo, u8 SupRate[], u8 SupRateLen, u8 ExtRate[], u8 ExtRateLen, struct rt_ht_capability_ie * pHtCapability, struct rt_add_ht_info_ie * pAddHtInfo,	/* AP might use this additional ht info IE */
+		 u8 HtCapabilityLen,
+		 u8 AddHtInfoLen,
+		 u8 NewExtChanOffset,
+		 u8 Channel,
+		 char Rssi,
+		 IN LARGE_INTEGER TimeStamp,
+		 u8 CkipFlag,
+		 struct rt_edca_parm *pEdcaParm,
+		 struct rt_qos_capability_parm *pQosCapability,
+		 struct rt_qbss_load_parm *pQbssLoad,
+		 u16 LengthVIE, struct rt_ndis_802_11_variable_ies *pVIE)
 {
 	COPY_MAC_ADDR(pBss->Bssid, pBssid);
-	// Default Hidden SSID to be TRUE, it will be turned to FALSE after coping SSID
+	/* Default Hidden SSID to be TRUE, it will be turned to FALSE after coping SSID */
 	pBss->Hidden = 1;
-	if (SsidLen > 0)
-	{
-		// For hidden SSID AP, it might send beacon with SSID len equal to 0
-		// Or send beacon /probe response with SSID len matching real SSID length,
-		// but SSID is all zero. such as "00-00-00-00" with length 4.
-		// We have to prevent this case overwrite correct table
-		if (NdisEqualMemory(Ssid, ZeroSsid, SsidLen) == 0)
-		{
-		    NdisZeroMemory(pBss->Ssid, MAX_LEN_OF_SSID);
+	if (SsidLen > 0) {
+		/* For hidden SSID AP, it might send beacon with SSID len equal to 0 */
+		/* Or send beacon /probe response with SSID len matching real SSID length, */
+		/* but SSID is all zero. such as "00-00-00-00" with length 4. */
+		/* We have to prevent this case overwrite correct table */
+		if (NdisEqualMemory(Ssid, ZeroSsid, SsidLen) == 0) {
+			NdisZeroMemory(pBss->Ssid, MAX_LEN_OF_SSID);
 			NdisMoveMemory(pBss->Ssid, Ssid, SsidLen);
 			pBss->SsidLen = SsidLen;
 			pBss->Hidden = 0;
 		}
-	}
-	else
+	} else
 		pBss->SsidLen = 0;
 	pBss->BssType = BssType;
 	pBss->BeaconPeriod = BeaconPeriod;
-	if (BssType == BSS_INFRA)
-	{
-		if (pCfParm->bValid)
-		{
+	if (BssType == BSS_INFRA) {
+		if (pCfParm->bValid) {
 			pBss->CfpCount = pCfParm->CfpCount;
 			pBss->CfpPeriod = pCfParm->CfpPeriod;
 			pBss->CfpMaxDuration = pCfParm->CfpMaxDuration;
 			pBss->CfpDurRemaining = pCfParm->CfpDurRemaining;
 		}
-	}
-	else
-	{
+	} else {
 		pBss->AtimWin = AtimWin;
 	}
 
 	pBss->CapabilityInfo = CapabilityInfo;
-	// The privacy bit indicate security is ON, it maight be WEP, TKIP or AES
-	// Combine with AuthMode, they will decide the connection methods.
+	/* The privacy bit indicate security is ON, it maight be WEP, TKIP or AES */
+	/* Combine with AuthMode, they will decide the connection methods. */
 	pBss->Privacy = CAP_IS_PRIVACY_ON(pBss->CapabilityInfo);
 	ASSERT(SupRateLen <= MAX_LEN_OF_SUPPORTED_RATES);
 	if (SupRateLen <= MAX_LEN_OF_SUPPORTED_RATES)
 		NdisMoveMemory(pBss->SupRate, SupRate, SupRateLen);
 	else
-		NdisMoveMemory(pBss->SupRate, SupRate, MAX_LEN_OF_SUPPORTED_RATES);
+		NdisMoveMemory(pBss->SupRate, SupRate,
+			       MAX_LEN_OF_SUPPORTED_RATES);
 	pBss->SupRateLen = SupRateLen;
 	ASSERT(ExtRateLen <= MAX_LEN_OF_SUPPORTED_RATES);
 	NdisMoveMemory(pBss->ExtRate, ExtRate, ExtRateLen);
-	NdisMoveMemory(&pBss->HtCapability, pHtCapability, HtCapabilityLen);
-	NdisMoveMemory(&pBss->AddHtInfo, pAddHtInfo, AddHtInfoLen);
 	pBss->NewExtChanOffset = NewExtChanOffset;
 	pBss->ExtRateLen = ExtRateLen;
 	pBss->Channel = Channel;
 	pBss->CentralChannel = Channel;
 	pBss->Rssi = Rssi;
-	// Update CkipFlag. if not exists, the value is 0x0
+	/* Update CkipFlag. if not exists, the value is 0x0 */
 	pBss->CkipFlag = CkipFlag;
 
-	// New for microsoft Fixed IEs
+	/* New for microsoft Fixed IEs */
 	NdisMoveMemory(pBss->FixIEs.Timestamp, &TimeStamp, 8);
 	pBss->FixIEs.BeaconInterval = BeaconPeriod;
 	pBss->FixIEs.Capabilities = CapabilityInfo;
 
-	// New for microsoft Variable IEs
-	if (LengthVIE != 0)
-	{
+	/* New for microsoft Variable IEs */
+	if (LengthVIE != 0) {
 		pBss->VarIELen = LengthVIE;
 		NdisMoveMemory(pBss->VarIEs, pVIE, pBss->VarIELen);
-	}
-	else
-	{
+	} else {
 		pBss->VarIELen = 0;
 	}
 
 	pBss->AddHtInfoLen = 0;
 	pBss->HtCapabilityLen = 0;
-
-	if (HtCapabilityLen> 0)
-	{
+	if (HtCapabilityLen > 0) {
 		pBss->HtCapabilityLen = HtCapabilityLen;
-		NdisMoveMemory(&pBss->HtCapability, pHtCapability, HtCapabilityLen);
-		if (AddHtInfoLen > 0)
-		{
+		NdisMoveMemory(&pBss->HtCapability, pHtCapability,
+			       HtCapabilityLen);
+		if (AddHtInfoLen > 0) {
 			pBss->AddHtInfoLen = AddHtInfoLen;
-			NdisMoveMemory(&pBss->AddHtInfo, pAddHtInfo, AddHtInfoLen);
-
-	 			if ((pAddHtInfo->ControlChan > 2)&& (pAddHtInfo->AddHtInfo.ExtChanOffset == EXTCHA_BELOW) && (pHtCapability->HtCapInfo.ChannelWidth == BW_40))
-	 			{
-	 				pBss->CentralChannel = pAddHtInfo->ControlChan - 2;
-	 			}
-	 			else if ((pAddHtInfo->AddHtInfo.ExtChanOffset == EXTCHA_ABOVE) && (pHtCapability->HtCapInfo.ChannelWidth == BW_40))
-				{
-		 				pBss->CentralChannel = pAddHtInfo->ControlChan + 2;
-				}
+			NdisMoveMemory(&pBss->AddHtInfo, pAddHtInfo,
+				       AddHtInfoLen);
+
+			if ((pAddHtInfo->ControlChan > 2)
+			    && (pAddHtInfo->AddHtInfo.ExtChanOffset ==
+				EXTCHA_BELOW)
+			    && (pHtCapability->HtCapInfo.ChannelWidth ==
+				BW_40)) {
+				pBss->CentralChannel =
+				    pAddHtInfo->ControlChan - 2;
+			} else
+			    if ((pAddHtInfo->AddHtInfo.ExtChanOffset ==
+				 EXTCHA_ABOVE)
+				&& (pHtCapability->HtCapInfo.ChannelWidth ==
+				    BW_40)) {
+				pBss->CentralChannel =
+				    pAddHtInfo->ControlChan + 2;
+			}
 		}
 	}
 
 	BssCipherParse(pBss);
 
-	// new for QOS
+	/* new for QOS */
 	if (pEdcaParm)
-		NdisMoveMemory(&pBss->EdcaParm, pEdcaParm, sizeof(EDCA_PARM));
+		NdisMoveMemory(&pBss->EdcaParm, pEdcaParm, sizeof(struct rt_edca_parm));
 	else
 		pBss->EdcaParm.bValid = FALSE;
 	if (pQosCapability)
-		NdisMoveMemory(&pBss->QosCapability, pQosCapability, sizeof(QOS_CAPABILITY_PARM));
+		NdisMoveMemory(&pBss->QosCapability, pQosCapability,
+			       sizeof(struct rt_qos_capability_parm));
 	else
 		pBss->QosCapability.bValid = FALSE;
 	if (pQbssLoad)
-		NdisMoveMemory(&pBss->QbssLoad, pQbssLoad, sizeof(QBSS_LOAD_PARM));
+		NdisMoveMemory(&pBss->QbssLoad, pQbssLoad,
+			       sizeof(struct rt_qbss_load_parm));
 	else
 		pBss->QbssLoad.bValid = FALSE;
 
 	{
-		PEID_STRUCT     pEid;
-		USHORT          Length = 0;
-
+		struct rt_eid * pEid;
+		u16 Length = 0;
 
 		NdisZeroMemory(&pBss->WpaIE.IE[0], MAX_CUSTOM_LEN);
 		NdisZeroMemory(&pBss->RsnIE.IE[0], MAX_CUSTOM_LEN);
-
-		pEid = (PEID_STRUCT) pVIE;
-
-		while ((Length + 2 + (USHORT)pEid->Len) <= LengthVIE)
-		{
-			switch(pEid->Eid)
-			{
-				case IE_WPA:
-					if (NdisEqualMemory(pEid->Octet, WPA_OUI, 4))
-					{
-						if ((pEid->Len + 2) > MAX_CUSTOM_LEN)
-						{
-							pBss->WpaIE.IELen = 0;
-							break;
-						}
-						pBss->WpaIE.IELen = pEid->Len + 2;
-						NdisMoveMemory(pBss->WpaIE.IE, pEid, pBss->WpaIE.IELen);
+		pEid = (struct rt_eid *) pVIE;
+		while ((Length + 2 + (u16)pEid->Len) <= LengthVIE) {
+			switch (pEid->Eid) {
+			case IE_WPA:
+				if (NdisEqualMemory(pEid->Octet, WPA_OUI, 4)) {
+					if ((pEid->Len + 2) > MAX_CUSTOM_LEN) {
+						pBss->WpaIE.IELen = 0;
+						break;
 					}
-					break;
-                case IE_RSN:
-                    if (NdisEqualMemory(pEid->Octet + 2, RSN_OUI, 3))
-					{
-						if ((pEid->Len + 2) > MAX_CUSTOM_LEN)
-						{
-							pBss->RsnIE.IELen = 0;
-							break;
-						}
-						pBss->RsnIE.IELen = pEid->Len + 2;
-						NdisMoveMemory(pBss->RsnIE.IE, pEid, pBss->RsnIE.IELen);
-			}
+					pBss->WpaIE.IELen = pEid->Len + 2;
+					NdisMoveMemory(pBss->WpaIE.IE, pEid,
+						       pBss->WpaIE.IELen);
+				}
 				break;
-            }
-			Length = Length + 2 + (USHORT)pEid->Len;  // Eid[1] + Len[1]+ content[Len]
-			pEid = (PEID_STRUCT)((UCHAR*)pEid + 2 + pEid->Len);
+			case IE_RSN:
+				if (NdisEqualMemory
+				    (pEid->Octet + 2, RSN_OUI, 3)) {
+					if ((pEid->Len + 2) > MAX_CUSTOM_LEN) {
+						pBss->RsnIE.IELen = 0;
+						break;
+					}
+					pBss->RsnIE.IELen = pEid->Len + 2;
+					NdisMoveMemory(pBss->RsnIE.IE, pEid,
+						       pBss->RsnIE.IELen);
+				}
+				break;
+			}
+			Length = Length + 2 + (u16)pEid->Len;	/* Eid[1] + Len[1]+ content[Len] */
+			pEid = (struct rt_eid *) ((u8 *) pEid + 2 + pEid->Len);
 		}
 	}
 }
@@ -3765,301 +3837,337 @@ VOID BssEntrySet(
  IRQL = DISPATCH_LEVEL
 
  */
-ULONG BssTableSetEntry(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT BSS_TABLE *Tab,
-	IN PUCHAR pBssid,
-	IN CHAR Ssid[],
-	IN UCHAR SsidLen,
-	IN UCHAR BssType,
-	IN USHORT BeaconPeriod,
-	IN CF_PARM *CfParm,
-	IN USHORT AtimWin,
-	IN USHORT CapabilityInfo,
-	IN UCHAR SupRate[],
-	IN UCHAR SupRateLen,
-	IN UCHAR ExtRate[],
-	IN UCHAR ExtRateLen,
-	IN HT_CAPABILITY_IE *pHtCapability,
-	IN ADD_HT_INFO_IE *pAddHtInfo,	// AP might use this additional ht info IE
-	IN UCHAR			HtCapabilityLen,
-	IN UCHAR			AddHtInfoLen,
-	IN UCHAR			NewExtChanOffset,
-	IN UCHAR ChannelNo,
-	IN CHAR Rssi,
-	IN LARGE_INTEGER TimeStamp,
-	IN UCHAR CkipFlag,
-	IN PEDCA_PARM pEdcaParm,
-	IN PQOS_CAPABILITY_PARM pQosCapability,
-	IN PQBSS_LOAD_PARM pQbssLoad,
-	IN USHORT LengthVIE,
-	IN PNDIS_802_11_VARIABLE_IEs pVIE)
+unsigned long BssTableSetEntry(struct rt_rtmp_adapter *pAd, struct rt_bss_table *Tab, u8 *pBssid, char Ssid[], u8 SsidLen, u8 BssType, u16 BeaconPeriod, struct rt_cf_parm * CfParm, u16 AtimWin, u16 CapabilityInfo, u8 SupRate[], u8 SupRateLen, u8 ExtRate[], u8 ExtRateLen, struct rt_ht_capability_ie * pHtCapability, struct rt_add_ht_info_ie * pAddHtInfo,	/* AP might use this additional ht info IE */
+		       u8 HtCapabilityLen,
+		       u8 AddHtInfoLen,
+		       u8 NewExtChanOffset,
+		       u8 ChannelNo,
+		       char Rssi,
+		       IN LARGE_INTEGER TimeStamp,
+		       u8 CkipFlag,
+		       struct rt_edca_parm *pEdcaParm,
+		       struct rt_qos_capability_parm *pQosCapability,
+		       struct rt_qbss_load_parm *pQbssLoad,
+		       u16 LengthVIE, struct rt_ndis_802_11_variable_ies *pVIE)
 {
-	ULONG	Idx;
-
-	Idx = BssTableSearchWithSSID(Tab, pBssid,  Ssid, SsidLen, ChannelNo);
-	if (Idx == BSS_NOT_FOUND)
-	{
-		if (Tab->BssNr >= MAX_LEN_OF_BSS_TABLE)
-	    {
-			//
-			// It may happen when BSS Table was full.
-			// The desired AP will not be added into BSS Table
-			// In this case, if we found the desired AP then overwrite BSS Table.
-			//
-			if(!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED))
-			{
-				if (MAC_ADDR_EQUAL(pAd->MlmeAux.Bssid, pBssid) ||
-					SSID_EQUAL(pAd->MlmeAux.Ssid, pAd->MlmeAux.SsidLen, Ssid, SsidLen))
-				{
+	unsigned long Idx;
+
+	Idx =
+	    BssTableSearchWithSSID(Tab, pBssid, (u8 *) Ssid, SsidLen,
+				   ChannelNo);
+	if (Idx == BSS_NOT_FOUND) {
+		if (Tab->BssNr >= MAX_LEN_OF_BSS_TABLE) {
+			/* */
+			/* It may happen when BSS Table was full. */
+			/* The desired AP will not be added into BSS Table */
+			/* In this case, if we found the desired AP then overwrite BSS Table. */
+			/* */
+			if (!OPSTATUS_TEST_FLAG
+			    (pAd, fOP_STATUS_MEDIA_STATE_CONNECTED)) {
+				if (MAC_ADDR_EQUAL(pAd->MlmeAux.Bssid, pBssid)
+				    || SSID_EQUAL(pAd->MlmeAux.Ssid,
+						  pAd->MlmeAux.SsidLen, Ssid,
+						  SsidLen)) {
 					Idx = Tab->BssOverlapNr;
-					BssEntrySet(pAd, &Tab->BssEntry[Idx], pBssid, Ssid, SsidLen, BssType, BeaconPeriod, CfParm, AtimWin,
-						CapabilityInfo, SupRate, SupRateLen, ExtRate, ExtRateLen,pHtCapability, pAddHtInfo,HtCapabilityLen, AddHtInfoLen,
-						NewExtChanOffset, ChannelNo, Rssi, TimeStamp, CkipFlag, pEdcaParm, pQosCapability, pQbssLoad, LengthVIE, pVIE);
-                    Tab->BssOverlapNr = (Tab->BssOverlapNr++) % MAX_LEN_OF_BSS_TABLE;
+					BssEntrySet(pAd, &Tab->BssEntry[Idx],
+						    pBssid, Ssid, SsidLen,
+						    BssType, BeaconPeriod,
+						    CfParm, AtimWin,
+						    CapabilityInfo, SupRate,
+						    SupRateLen, ExtRate,
+						    ExtRateLen, pHtCapability,
+						    pAddHtInfo, HtCapabilityLen,
+						    AddHtInfoLen,
+						    NewExtChanOffset, ChannelNo,
+						    Rssi, TimeStamp, CkipFlag,
+						    pEdcaParm, pQosCapability,
+						    pQbssLoad, LengthVIE, pVIE);
+					Tab->BssOverlapNr =
+					    (Tab->BssOverlapNr++) %
+					    MAX_LEN_OF_BSS_TABLE;
 				}
 				return Idx;
-			}
-			else
-			{
-			return BSS_NOT_FOUND;
+			} else {
+				return BSS_NOT_FOUND;
 			}
 		}
 		Idx = Tab->BssNr;
-		BssEntrySet(pAd, &Tab->BssEntry[Idx], pBssid, Ssid, SsidLen, BssType, BeaconPeriod, CfParm, AtimWin,
-					CapabilityInfo, SupRate, SupRateLen, ExtRate, ExtRateLen,pHtCapability, pAddHtInfo,HtCapabilityLen, AddHtInfoLen,
-					NewExtChanOffset, ChannelNo, Rssi, TimeStamp, CkipFlag, pEdcaParm, pQosCapability, pQbssLoad, LengthVIE, pVIE);
+		BssEntrySet(pAd, &Tab->BssEntry[Idx], pBssid, Ssid, SsidLen,
+			    BssType, BeaconPeriod, CfParm, AtimWin,
+			    CapabilityInfo, SupRate, SupRateLen, ExtRate,
+			    ExtRateLen, pHtCapability, pAddHtInfo,
+			    HtCapabilityLen, AddHtInfoLen, NewExtChanOffset,
+			    ChannelNo, Rssi, TimeStamp, CkipFlag, pEdcaParm,
+			    pQosCapability, pQbssLoad, LengthVIE, pVIE);
 		Tab->BssNr++;
-	}
-	else
-	{
+	} else {
 		/* avoid  Hidden SSID form beacon to overwirite correct SSID from probe response */
-		if ((SSID_EQUAL(Ssid, SsidLen, Tab->BssEntry[Idx].Ssid, Tab->BssEntry[Idx].SsidLen)) ||
-			(NdisEqualMemory(Tab->BssEntry[Idx].Ssid, ZeroSsid, Tab->BssEntry[Idx].SsidLen)))
-		{
-		BssEntrySet(pAd, &Tab->BssEntry[Idx], pBssid, Ssid, SsidLen, BssType, BeaconPeriod,CfParm, AtimWin,
-					CapabilityInfo, SupRate, SupRateLen, ExtRate, ExtRateLen,pHtCapability, pAddHtInfo,HtCapabilityLen, AddHtInfoLen,
-					NewExtChanOffset, ChannelNo, Rssi, TimeStamp, CkipFlag, pEdcaParm, pQosCapability, pQbssLoad, LengthVIE, pVIE);
+		if ((SSID_EQUAL
+		     (Ssid, SsidLen, Tab->BssEntry[Idx].Ssid,
+		      Tab->BssEntry[Idx].SsidLen))
+		    ||
+		    (NdisEqualMemory
+		     (Tab->BssEntry[Idx].Ssid, ZeroSsid,
+		      Tab->BssEntry[Idx].SsidLen))) {
+			BssEntrySet(pAd, &Tab->BssEntry[Idx], pBssid, Ssid,
+				    SsidLen, BssType, BeaconPeriod, CfParm,
+				    AtimWin, CapabilityInfo, SupRate,
+				    SupRateLen, ExtRate, ExtRateLen,
+				    pHtCapability, pAddHtInfo, HtCapabilityLen,
+				    AddHtInfoLen, NewExtChanOffset, ChannelNo,
+				    Rssi, TimeStamp, CkipFlag, pEdcaParm,
+				    pQosCapability, pQbssLoad, LengthVIE, pVIE);
 		}
 	}
 
 	return Idx;
 }
 
-// IRQL = DISPATCH_LEVEL
-VOID BssTableSsidSort(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT BSS_TABLE *OutTab,
-	IN	CHAR Ssid[],
-	IN	UCHAR SsidLen)
+/* IRQL = DISPATCH_LEVEL */
+void BssTableSsidSort(struct rt_rtmp_adapter *pAd,
+		      struct rt_bss_table *OutTab, char Ssid[], u8 SsidLen)
 {
-	INT i;
+	int i;
 	BssTableInit(OutTab);
 
-	for (i = 0; i < pAd->ScanTab.BssNr; i++)
-	{
-		BSS_ENTRY *pInBss = &pAd->ScanTab.BssEntry[i];
-		BOOLEAN	bIsHiddenApIncluded = FALSE;
+	for (i = 0; i < pAd->ScanTab.BssNr; i++) {
+		struct rt_bss_entry *pInBss = &pAd->ScanTab.BssEntry[i];
+		BOOLEAN bIsHiddenApIncluded = FALSE;
 
 		if (((pAd->CommonCfg.bIEEE80211H == 1) &&
-            (pAd->MlmeAux.Channel > 14) &&
-             RadarChannelCheck(pAd, pInBss->Channel))
-            )
-		{
+		     (pAd->MlmeAux.Channel > 14) &&
+		     RadarChannelCheck(pAd, pInBss->Channel))
+		    ) {
 			if (pInBss->Hidden)
 				bIsHiddenApIncluded = TRUE;
 		}
 
 		if ((pInBss->BssType == pAd->StaCfg.BssType) &&
-			(SSID_EQUAL(Ssid, SsidLen, pInBss->Ssid, pInBss->SsidLen) || bIsHiddenApIncluded))
-		{
-			BSS_ENTRY *pOutBss = &OutTab->BssEntry[OutTab->BssNr];
+		    (SSID_EQUAL(Ssid, SsidLen, pInBss->Ssid, pInBss->SsidLen)
+		     || bIsHiddenApIncluded)) {
+			struct rt_bss_entry *pOutBss = &OutTab->BssEntry[OutTab->BssNr];
 
-			// 2.4G/5G N only mode
+			/* 2.4G/5G N only mode */
 			if ((pInBss->HtCapabilityLen == 0) &&
-				((pAd->CommonCfg.PhyMode == PHY_11N_2_4G) || (pAd->CommonCfg.PhyMode == PHY_11N_5G)))
-			{
-				DBGPRINT(RT_DEBUG_TRACE,("STA is in N-only Mode, this AP don't have Ht capability in Beacon.\n"));
+			    ((pAd->CommonCfg.PhyMode == PHY_11N_2_4G)
+			     || (pAd->CommonCfg.PhyMode == PHY_11N_5G))) {
+				DBGPRINT(RT_DEBUG_TRACE,
+					 ("STA is in N-only Mode, this AP don't have Ht capability in Beacon.\n"));
 				continue;
 			}
-
-			// New for WPA2
-			// Check the Authmode first
-			if (pAd->StaCfg.AuthMode >= Ndis802_11AuthModeWPA)
-			{
-				// Check AuthMode and AuthModeAux for matching, in case AP support dual-mode
-				if ((pAd->StaCfg.AuthMode != pInBss->AuthMode) && (pAd->StaCfg.AuthMode != pInBss->AuthModeAux))
-					// None matched
+			/* New for WPA2 */
+			/* Check the Authmode first */
+			if (pAd->StaCfg.AuthMode >= Ndis802_11AuthModeWPA) {
+				/* Check AuthMode and AuthModeAux for matching, in case AP support dual-mode */
+				if ((pAd->StaCfg.AuthMode != pInBss->AuthMode)
+				    && (pAd->StaCfg.AuthMode !=
+					pInBss->AuthModeAux))
+					/* None matched */
 					continue;
 
-				// Check cipher suite, AP must have more secured cipher than station setting
-				if ((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA) || (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPAPSK))
-				{
-					// If it's not mixed mode, we should only let BSS pass with the same encryption
+				/* Check cipher suite, AP must have more secured cipher than station setting */
+				if ((pAd->StaCfg.AuthMode ==
+				     Ndis802_11AuthModeWPA)
+				    || (pAd->StaCfg.AuthMode ==
+					Ndis802_11AuthModeWPAPSK)) {
+					/* If it's not mixed mode, we should only let BSS pass with the same encryption */
 					if (pInBss->WPA.bMixMode == FALSE)
-						if (pAd->StaCfg.WepStatus != pInBss->WPA.GroupCipher)
+						if (pAd->StaCfg.WepStatus !=
+						    pInBss->WPA.GroupCipher)
 							continue;
 
-					// check group cipher
-					if (pInBss->WPA.GroupCipher != Ndis802_11GroupWEP40Enabled &&
-					    pInBss->WPA.GroupCipher != Ndis802_11GroupWEP104Enabled &&
-					    pAd->StaCfg.WepStatus < pInBss->WPA.GroupCipher)
+					/* check group cipher */
+					if ((pAd->StaCfg.WepStatus <
+					     pInBss->WPA.GroupCipher)
+					    && (pInBss->WPA.GroupCipher !=
+						Ndis802_11GroupWEP40Enabled)
+					    && (pInBss->WPA.GroupCipher !=
+						Ndis802_11GroupWEP104Enabled))
 						continue;
 
-					// check pairwise cipher, skip if none matched
-					// If profile set to AES, let it pass without question.
-					// If profile set to TKIP, we must find one mateched
-					if ((pAd->StaCfg.WepStatus == Ndis802_11Encryption2Enabled) &&
-						(pAd->StaCfg.WepStatus != pInBss->WPA.PairCipher) &&
-						(pAd->StaCfg.WepStatus != pInBss->WPA.PairCipherAux))
+					/* check pairwise cipher, skip if none matched */
+					/* If profile set to AES, let it pass without question. */
+					/* If profile set to TKIP, we must find one mateched */
+					if ((pAd->StaCfg.WepStatus ==
+					     Ndis802_11Encryption2Enabled)
+					    && (pAd->StaCfg.WepStatus !=
+						pInBss->WPA.PairCipher)
+					    && (pAd->StaCfg.WepStatus !=
+						pInBss->WPA.PairCipherAux))
 						continue;
-				}
-				else if ((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2) || (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK))
-				{
-					// If it's not mixed mode, we should only let BSS pass with the same encryption
+				} else
+				    if ((pAd->StaCfg.AuthMode ==
+					 Ndis802_11AuthModeWPA2)
+					|| (pAd->StaCfg.AuthMode ==
+					    Ndis802_11AuthModeWPA2PSK)) {
+					/* If it's not mixed mode, we should only let BSS pass with the same encryption */
 					if (pInBss->WPA2.bMixMode == FALSE)
-						if (pAd->StaCfg.WepStatus != pInBss->WPA2.GroupCipher)
+						if (pAd->StaCfg.WepStatus !=
+						    pInBss->WPA2.GroupCipher)
 							continue;
 
-					// check group cipher
-					if (pInBss->WPA2.GroupCipher != Ndis802_11GroupWEP40Enabled &&
-					    pInBss->WPA2.GroupCipher != Ndis802_11GroupWEP104Enabled &&
-					    pAd->StaCfg.WepStatus < pInBss->WPA2.GroupCipher)
+					/* check group cipher */
+					if ((pAd->StaCfg.WepStatus <
+					     pInBss->WPA.GroupCipher)
+					    && (pInBss->WPA2.GroupCipher !=
+						Ndis802_11GroupWEP40Enabled)
+					    && (pInBss->WPA2.GroupCipher !=
+						Ndis802_11GroupWEP104Enabled))
 						continue;
 
-					// check pairwise cipher, skip if none matched
-					// If profile set to AES, let it pass without question.
-					// If profile set to TKIP, we must find one mateched
-					if ((pAd->StaCfg.WepStatus == Ndis802_11Encryption2Enabled) &&
-						(pAd->StaCfg.WepStatus != pInBss->WPA2.PairCipher) &&
-						(pAd->StaCfg.WepStatus != pInBss->WPA2.PairCipherAux))
+					/* check pairwise cipher, skip if none matched */
+					/* If profile set to AES, let it pass without question. */
+					/* If profile set to TKIP, we must find one mateched */
+					if ((pAd->StaCfg.WepStatus ==
+					     Ndis802_11Encryption2Enabled)
+					    && (pAd->StaCfg.WepStatus !=
+						pInBss->WPA2.PairCipher)
+					    && (pAd->StaCfg.WepStatus !=
+						pInBss->WPA2.PairCipherAux))
 						continue;
 				}
 			}
-			// Bss Type matched, SSID matched.
-			// We will check wepstatus for qualification Bss
-			else if (pAd->StaCfg.WepStatus != pInBss->WepStatus)
-			{
-				DBGPRINT(RT_DEBUG_TRACE,("StaCfg.WepStatus=%d, while pInBss->WepStatus=%d\n", pAd->StaCfg.WepStatus, pInBss->WepStatus));
-				//
-				// For the SESv2 case, we will not qualify WepStatus.
-				//
+			/* Bss Type matched, SSID matched. */
+			/* We will check wepstatus for qualification Bss */
+			else if (pAd->StaCfg.WepStatus != pInBss->WepStatus) {
+				DBGPRINT(RT_DEBUG_TRACE,
+					 ("StaCfg.WepStatus=%d, while pInBss->WepStatus=%d\n",
+					  pAd->StaCfg.WepStatus,
+					  pInBss->WepStatus));
+				/* */
+				/* For the SESv2 case, we will not qualify WepStatus. */
+				/* */
 				if (!pInBss->bSES)
 					continue;
 			}
-
-			// Since the AP is using hidden SSID, and we are trying to connect to ANY
-			// It definitely will fail. So, skip it.
-			// CCX also require not even try to connect it!!
+			/* Since the AP is using hidden SSID, and we are trying to connect to ANY */
+			/* It definitely will fail. So, skip it. */
+			/* CCX also require not even try to connect it! */
 			if (SsidLen == 0)
 				continue;
 
-			// If both station and AP use 40MHz, still need to check if the 40MHZ band's legality in my country region
-			// If this 40MHz wideband is not allowed in my country list, use bandwidth 20MHZ instead,
+			/* If both station and AP use 40MHz, still need to check if the 40MHZ band's legality in my country region */
+			/* If this 40MHz wideband is not allowed in my country list, use bandwidth 20MHZ instead, */
 			if ((pInBss->CentralChannel != pInBss->Channel) &&
-				(pAd->CommonCfg.RegTransmitSetting.field.BW == BW_40))
-			{
-				if (RTMPCheckChannel(pAd, pInBss->CentralChannel, pInBss->Channel) == FALSE)
-				{
-					pAd->CommonCfg.RegTransmitSetting.field.BW = BW_20;
+			    (pAd->CommonCfg.RegTransmitSetting.field.BW ==
+			     BW_40)) {
+				if (RTMPCheckChannel
+				    (pAd, pInBss->CentralChannel,
+				     pInBss->Channel) == FALSE) {
+					pAd->CommonCfg.RegTransmitSetting.field.
+					    BW = BW_20;
 					SetCommonHT(pAd);
-					pAd->CommonCfg.RegTransmitSetting.field.BW = BW_40;
-				}
-				else
-				{
-					if (pAd->CommonCfg.DesiredHtPhy.ChannelWidth == BAND_WIDTH_20)
-					{
+					pAd->CommonCfg.RegTransmitSetting.field.
+					    BW = BW_40;
+				} else {
+					if (pAd->CommonCfg.DesiredHtPhy.
+					    ChannelWidth == BAND_WIDTH_20) {
 						SetCommonHT(pAd);
 					}
 				}
 			}
-
-			// copy matching BSS from InTab to OutTab
-			NdisMoveMemory(pOutBss, pInBss, sizeof(BSS_ENTRY));
+			/* copy matching BSS from InTab to OutTab */
+			NdisMoveMemory(pOutBss, pInBss, sizeof(struct rt_bss_entry));
 
 			OutTab->BssNr++;
-		}
-		else if ((pInBss->BssType == pAd->StaCfg.BssType) && (SsidLen == 0))
-		{
-			BSS_ENTRY *pOutBss = &OutTab->BssEntry[OutTab->BssNr];
+		} else if ((pInBss->BssType == pAd->StaCfg.BssType)
+			   && (SsidLen == 0)) {
+			struct rt_bss_entry *pOutBss = &OutTab->BssEntry[OutTab->BssNr];
 
-			// 2.4G/5G N only mode
+			/* 2.4G/5G N only mode */
 			if ((pInBss->HtCapabilityLen == 0) &&
-				((pAd->CommonCfg.PhyMode == PHY_11N_2_4G) || (pAd->CommonCfg.PhyMode == PHY_11N_5G)))
-			{
-				DBGPRINT(RT_DEBUG_TRACE,("STA is in N-only Mode, this AP don't have Ht capability in Beacon.\n"));
+			    ((pAd->CommonCfg.PhyMode == PHY_11N_2_4G)
+			     || (pAd->CommonCfg.PhyMode == PHY_11N_5G))) {
+				DBGPRINT(RT_DEBUG_TRACE,
+					 ("STA is in N-only Mode, this AP don't have Ht capability in Beacon.\n"));
 				continue;
 			}
-
-			// New for WPA2
-			// Check the Authmode first
-			if (pAd->StaCfg.AuthMode >= Ndis802_11AuthModeWPA)
-			{
-				// Check AuthMode and AuthModeAux for matching, in case AP support dual-mode
-				if ((pAd->StaCfg.AuthMode != pInBss->AuthMode) && (pAd->StaCfg.AuthMode != pInBss->AuthModeAux))
-					// None matched
+			/* New for WPA2 */
+			/* Check the Authmode first */
+			if (pAd->StaCfg.AuthMode >= Ndis802_11AuthModeWPA) {
+				/* Check AuthMode and AuthModeAux for matching, in case AP support dual-mode */
+				if ((pAd->StaCfg.AuthMode != pInBss->AuthMode)
+				    && (pAd->StaCfg.AuthMode !=
+					pInBss->AuthModeAux))
+					/* None matched */
 					continue;
 
-				// Check cipher suite, AP must have more secured cipher than station setting
-				if ((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA) || (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPAPSK))
-				{
-					// If it's not mixed mode, we should only let BSS pass with the same encryption
+				/* Check cipher suite, AP must have more secured cipher than station setting */
+				if ((pAd->StaCfg.AuthMode ==
+				     Ndis802_11AuthModeWPA)
+				    || (pAd->StaCfg.AuthMode ==
+					Ndis802_11AuthModeWPAPSK)) {
+					/* If it's not mixed mode, we should only let BSS pass with the same encryption */
 					if (pInBss->WPA.bMixMode == FALSE)
-						if (pAd->StaCfg.WepStatus != pInBss->WPA.GroupCipher)
+						if (pAd->StaCfg.WepStatus !=
+						    pInBss->WPA.GroupCipher)
 							continue;
 
-					// check group cipher
-					if (pAd->StaCfg.WepStatus < pInBss->WPA.GroupCipher)
+					/* check group cipher */
+					if (pAd->StaCfg.WepStatus <
+					    pInBss->WPA.GroupCipher)
 						continue;
 
-					// check pairwise cipher, skip if none matched
-					// If profile set to AES, let it pass without question.
-					// If profile set to TKIP, we must find one mateched
-					if ((pAd->StaCfg.WepStatus == Ndis802_11Encryption2Enabled) &&
-						(pAd->StaCfg.WepStatus != pInBss->WPA.PairCipher) &&
-						(pAd->StaCfg.WepStatus != pInBss->WPA.PairCipherAux))
+					/* check pairwise cipher, skip if none matched */
+					/* If profile set to AES, let it pass without question. */
+					/* If profile set to TKIP, we must find one mateched */
+					if ((pAd->StaCfg.WepStatus ==
+					     Ndis802_11Encryption2Enabled)
+					    && (pAd->StaCfg.WepStatus !=
+						pInBss->WPA.PairCipher)
+					    && (pAd->StaCfg.WepStatus !=
+						pInBss->WPA.PairCipherAux))
 						continue;
-				}
-				else if ((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2) || (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK))
-				{
-					// If it's not mixed mode, we should only let BSS pass with the same encryption
+				} else
+				    if ((pAd->StaCfg.AuthMode ==
+					 Ndis802_11AuthModeWPA2)
+					|| (pAd->StaCfg.AuthMode ==
+					    Ndis802_11AuthModeWPA2PSK)) {
+					/* If it's not mixed mode, we should only let BSS pass with the same encryption */
 					if (pInBss->WPA2.bMixMode == FALSE)
-						if (pAd->StaCfg.WepStatus != pInBss->WPA2.GroupCipher)
+						if (pAd->StaCfg.WepStatus !=
+						    pInBss->WPA2.GroupCipher)
 							continue;
 
-					// check group cipher
-					if (pAd->StaCfg.WepStatus < pInBss->WPA2.GroupCipher)
+					/* check group cipher */
+					if (pAd->StaCfg.WepStatus <
+					    pInBss->WPA2.GroupCipher)
 						continue;
 
-					// check pairwise cipher, skip if none matched
-					// If profile set to AES, let it pass without question.
-					// If profile set to TKIP, we must find one mateched
-					if ((pAd->StaCfg.WepStatus == Ndis802_11Encryption2Enabled) &&
-						(pAd->StaCfg.WepStatus != pInBss->WPA2.PairCipher) &&
-						(pAd->StaCfg.WepStatus != pInBss->WPA2.PairCipherAux))
+					/* check pairwise cipher, skip if none matched */
+					/* If profile set to AES, let it pass without question. */
+					/* If profile set to TKIP, we must find one mateched */
+					if ((pAd->StaCfg.WepStatus ==
+					     Ndis802_11Encryption2Enabled)
+					    && (pAd->StaCfg.WepStatus !=
+						pInBss->WPA2.PairCipher)
+					    && (pAd->StaCfg.WepStatus !=
+						pInBss->WPA2.PairCipherAux))
 						continue;
 				}
 			}
-			// Bss Type matched, SSID matched.
-			// We will check wepstatus for qualification Bss
+			/* Bss Type matched, SSID matched. */
+			/* We will check wepstatus for qualification Bss */
 			else if (pAd->StaCfg.WepStatus != pInBss->WepStatus)
-					continue;
+				continue;
 
-			// If both station and AP use 40MHz, still need to check if the 40MHZ band's legality in my country region
-			// If this 40MHz wideband is not allowed in my country list, use bandwidth 20MHZ instead,
+			/* If both station and AP use 40MHz, still need to check if the 40MHZ band's legality in my country region */
+			/* If this 40MHz wideband is not allowed in my country list, use bandwidth 20MHZ instead, */
 			if ((pInBss->CentralChannel != pInBss->Channel) &&
-				(pAd->CommonCfg.RegTransmitSetting.field.BW == BW_40))
-			{
-				if (RTMPCheckChannel(pAd, pInBss->CentralChannel, pInBss->Channel) == FALSE)
-				{
-					pAd->CommonCfg.RegTransmitSetting.field.BW = BW_20;
+			    (pAd->CommonCfg.RegTransmitSetting.field.BW ==
+			     BW_40)) {
+				if (RTMPCheckChannel
+				    (pAd, pInBss->CentralChannel,
+				     pInBss->Channel) == FALSE) {
+					pAd->CommonCfg.RegTransmitSetting.field.
+					    BW = BW_20;
 					SetCommonHT(pAd);
-					pAd->CommonCfg.RegTransmitSetting.field.BW = BW_40;
+					pAd->CommonCfg.RegTransmitSetting.field.
+					    BW = BW_40;
 				}
 			}
-
-			// copy matching BSS from InTab to OutTab
-			NdisMoveMemory(pOutBss, pInBss, sizeof(BSS_ENTRY));
+			/* copy matching BSS from InTab to OutTab */
+			NdisMoveMemory(pOutBss, pInBss, sizeof(struct rt_bss_entry));
 
 			OutTab->BssNr++;
 		}
@@ -4071,378 +4179,366 @@ VOID BssTableSsidSort(
 	BssTableSortByRssi(OutTab);
 }
 
-
-// IRQL = DISPATCH_LEVEL
-VOID BssTableSortByRssi(
-	IN OUT BSS_TABLE *OutTab)
+/* IRQL = DISPATCH_LEVEL */
+void BssTableSortByRssi(struct rt_bss_table *OutTab)
 {
-	INT 	  i, j;
-	BSS_ENTRY TmpBss;
-
-	for (i = 0; i < OutTab->BssNr - 1; i++)
-	{
-		for (j = i+1; j < OutTab->BssNr; j++)
-		{
-			if (OutTab->BssEntry[j].Rssi > OutTab->BssEntry[i].Rssi)
-			{
-				NdisMoveMemory(&TmpBss, &OutTab->BssEntry[j], sizeof(BSS_ENTRY));
-				NdisMoveMemory(&OutTab->BssEntry[j], &OutTab->BssEntry[i], sizeof(BSS_ENTRY));
-				NdisMoveMemory(&OutTab->BssEntry[i], &TmpBss, sizeof(BSS_ENTRY));
+	int i, j;
+	struct rt_bss_entry TmpBss;
+
+	for (i = 0; i < OutTab->BssNr - 1; i++) {
+		for (j = i + 1; j < OutTab->BssNr; j++) {
+			if (OutTab->BssEntry[j].Rssi > OutTab->BssEntry[i].Rssi) {
+				NdisMoveMemory(&TmpBss, &OutTab->BssEntry[j],
+					       sizeof(struct rt_bss_entry));
+				NdisMoveMemory(&OutTab->BssEntry[j],
+					       &OutTab->BssEntry[i],
+					       sizeof(struct rt_bss_entry));
+				NdisMoveMemory(&OutTab->BssEntry[i], &TmpBss,
+					       sizeof(struct rt_bss_entry));
 			}
 		}
 	}
 }
 
-VOID BssCipherParse(
-	IN OUT	PBSS_ENTRY	pBss)
+void BssCipherParse(struct rt_bss_entry *pBss)
 {
-	PEID_STRUCT 		 pEid;
-	PUCHAR				pTmp;
-	PRSN_IE_HEADER_STRUCT			pRsnHeader;
-	PCIPHER_SUITE_STRUCT			pCipher;
-	PAKM_SUITE_STRUCT				pAKM;
-	USHORT							Count;
-	INT								Length;
-	NDIS_802_11_ENCRYPTION_STATUS	TmpCipher;
-
-	//
-	// WepStatus will be reset later, if AP announce TKIP or AES on the beacon frame.
-	//
-	if (pBss->Privacy)
-	{
-		pBss->WepStatus 	= Ndis802_11WEPEnabled;
-	}
-	else
-	{
-		pBss->WepStatus 	= Ndis802_11WEPDisabled;
-	}
-	// Set default to disable & open authentication before parsing variable IE
-	pBss->AuthMode		= Ndis802_11AuthModeOpen;
-	pBss->AuthModeAux	= Ndis802_11AuthModeOpen;
-
-	// Init WPA setting
-	pBss->WPA.PairCipher	= Ndis802_11WEPDisabled;
+	struct rt_eid * pEid;
+	u8 *pTmp;
+	struct rt_rsn_ie_header * pRsnHeader;
+	struct rt_cipher_suite_struct * pCipher;
+	struct rt_akm_suite * pAKM;
+	u16 Count;
+	int Length;
+	NDIS_802_11_ENCRYPTION_STATUS TmpCipher;
+
+	/* */
+	/* WepStatus will be reset later, if AP announce TKIP or AES on the beacon frame. */
+	/* */
+	if (pBss->Privacy) {
+		pBss->WepStatus = Ndis802_11WEPEnabled;
+	} else {
+		pBss->WepStatus = Ndis802_11WEPDisabled;
+	}
+	/* Set default to disable & open authentication before parsing variable IE */
+	pBss->AuthMode = Ndis802_11AuthModeOpen;
+	pBss->AuthModeAux = Ndis802_11AuthModeOpen;
+
+	/* Init WPA setting */
+	pBss->WPA.PairCipher = Ndis802_11WEPDisabled;
 	pBss->WPA.PairCipherAux = Ndis802_11WEPDisabled;
-	pBss->WPA.GroupCipher	= Ndis802_11WEPDisabled;
+	pBss->WPA.GroupCipher = Ndis802_11WEPDisabled;
 	pBss->WPA.RsnCapability = 0;
-	pBss->WPA.bMixMode		= FALSE;
+	pBss->WPA.bMixMode = FALSE;
 
-	// Init WPA2 setting
-	pBss->WPA2.PairCipher	 = Ndis802_11WEPDisabled;
+	/* Init WPA2 setting */
+	pBss->WPA2.PairCipher = Ndis802_11WEPDisabled;
 	pBss->WPA2.PairCipherAux = Ndis802_11WEPDisabled;
-	pBss->WPA2.GroupCipher	 = Ndis802_11WEPDisabled;
+	pBss->WPA2.GroupCipher = Ndis802_11WEPDisabled;
 	pBss->WPA2.RsnCapability = 0;
-	pBss->WPA2.bMixMode 	 = FALSE;
-
-
-	Length = (INT) pBss->VarIELen;
-
-	while (Length > 0)
-	{
-		// Parse cipher suite base on WPA1 & WPA2, they should be parsed differently
-		pTmp = ((PUCHAR) pBss->VarIEs) + pBss->VarIELen - Length;
-		pEid = (PEID_STRUCT) pTmp;
-		switch (pEid->Eid)
-		{
-			case IE_WPA:
-				//Parse Cisco IE_WPA (LEAP, CCKM, etc.)
-				if ( NdisEqualMemory((pTmp+8), CISCO_OUI, 3))
-				{
-					pTmp   += 11;
-					switch (*pTmp)
-					{
-						case 1:
-						case 5:	// Although WEP is not allowed in WPA related auth mode, we parse it anyway
-							pBss->WepStatus = Ndis802_11Encryption1Enabled;
-							pBss->WPA.PairCipher = Ndis802_11Encryption1Enabled;
-							pBss->WPA.GroupCipher = Ndis802_11Encryption1Enabled;
-							break;
-						case 2:
-							pBss->WepStatus = Ndis802_11Encryption2Enabled;
-							pBss->WPA.PairCipher = Ndis802_11Encryption1Enabled;
-							pBss->WPA.GroupCipher = Ndis802_11Encryption1Enabled;
-							break;
-						case 4:
-							pBss->WepStatus = Ndis802_11Encryption3Enabled;
-							pBss->WPA.PairCipher = Ndis802_11Encryption1Enabled;
-							pBss->WPA.GroupCipher = Ndis802_11Encryption1Enabled;
-							break;
-						default:
-							break;
-					}
-
-					// if Cisco IE_WPA, break
+	pBss->WPA2.bMixMode = FALSE;
+
+	Length = (int)pBss->VarIELen;
+
+	while (Length > 0) {
+		/* Parse cipher suite base on WPA1 & WPA2, they should be parsed differently */
+		pTmp = ((u8 *)pBss->VarIEs) + pBss->VarIELen - Length;
+		pEid = (struct rt_eid *) pTmp;
+		switch (pEid->Eid) {
+		case IE_WPA:
+			if (NdisEqualMemory(pEid->Octet, SES_OUI, 3)
+			    && (pEid->Len == 7)) {
+				pBss->bSES = TRUE;
+				break;
+			} else if (NdisEqualMemory(pEid->Octet, WPA_OUI, 4) !=
+				   1) {
+				/* if unsupported vendor specific IE */
+				break;
+			}
+			/* Skip OUI, version, and multicast suite */
+			/* This part should be improved in the future when AP supported multiple cipher suite. */
+			/* For now, it's OK since almost all APs have fixed cipher suite supported. */
+			/* pTmp = (u8 *)pEid->Octet; */
+			pTmp += 11;
+
+			/* Cipher Suite Selectors from Spec P802.11i/D3.2 P26. */
+			/*      Value      Meaning */
+			/*      0                       None */
+			/*      1                       WEP-40 */
+			/*      2                       Tkip */
+			/*      3                       WRAP */
+			/*      4                       AES */
+			/*      5                       WEP-104 */
+			/* Parse group cipher */
+			switch (*pTmp) {
+			case 1:
+				pBss->WPA.GroupCipher =
+				    Ndis802_11GroupWEP40Enabled;
+				break;
+			case 5:
+				pBss->WPA.GroupCipher =
+				    Ndis802_11GroupWEP104Enabled;
+				break;
+			case 2:
+				pBss->WPA.GroupCipher =
+				    Ndis802_11Encryption2Enabled;
+				break;
+			case 4:
+				pBss->WPA.GroupCipher =
+				    Ndis802_11Encryption3Enabled;
+				break;
+			default:
+				break;
+			}
+			/* number of unicast suite */
+			pTmp += 1;
+
+			/* skip all unicast cipher suites */
+			/*Count = *(u16 *)pTmp; */
+			Count = (pTmp[1] << 8) + pTmp[0];
+			pTmp += sizeof(u16);
+
+			/* Parsing all unicast cipher suite */
+			while (Count > 0) {
+				/* Skip OUI */
+				pTmp += 3;
+				TmpCipher = Ndis802_11WEPDisabled;
+				switch (*pTmp) {
+				case 1:
+				case 5:	/* Although WEP is not allowed in WPA related auth mode, we parse it anyway */
+					TmpCipher =
+					    Ndis802_11Encryption1Enabled;
 					break;
-				}
-				else if (NdisEqualMemory(pEid->Octet, SES_OUI, 3) && (pEid->Len == 7))
-				{
-					pBss->bSES = TRUE;
+				case 2:
+					TmpCipher =
+					    Ndis802_11Encryption2Enabled;
 					break;
-				}
-				else if (NdisEqualMemory(pEid->Octet, WPA_OUI, 4) != 1)
-				{
-					// if unsupported vendor specific IE
+				case 4:
+					TmpCipher =
+					    Ndis802_11Encryption3Enabled;
+					break;
+				default:
 					break;
 				}
-				// Skip OUI, version, and multicast suite
-				// This part should be improved in the future when AP supported multiple cipher suite.
-				// For now, it's OK since almost all APs have fixed cipher suite supported.
-				// pTmp = (PUCHAR) pEid->Octet;
-				pTmp   += 11;
-
-				// Cipher Suite Selectors from Spec P802.11i/D3.2 P26.
-				//	Value	   Meaning
-				//	0			None
-				//	1			WEP-40
-				//	2			Tkip
-				//	3			WRAP
-				//	4			AES
-				//	5			WEP-104
-				// Parse group cipher
-				switch (*pTmp)
-				{
-					case 1:
-						pBss->WPA.GroupCipher = Ndis802_11GroupWEP40Enabled;
-						break;
-					case 5:
-						pBss->WPA.GroupCipher = Ndis802_11GroupWEP104Enabled;
-						break;
-					case 2:
-						pBss->WPA.GroupCipher = Ndis802_11Encryption2Enabled;
-						break;
-					case 4:
-						pBss->WPA.GroupCipher = Ndis802_11Encryption3Enabled;
-						break;
-					default:
-						break;
-				}
-				// number of unicast suite
-				pTmp   += 1;
-
-				// skip all unicast cipher suites
-				//Count = *(PUSHORT) pTmp;
-				Count = (pTmp[1]<<8) + pTmp[0];
-				pTmp   += sizeof(USHORT);
-
-				// Parsing all unicast cipher suite
-				while (Count > 0)
-				{
-					// Skip OUI
-					pTmp += 3;
-					TmpCipher = Ndis802_11WEPDisabled;
-					switch (*pTmp)
-					{
-						case 1:
-						case 5: // Although WEP is not allowed in WPA related auth mode, we parse it anyway
-							TmpCipher = Ndis802_11Encryption1Enabled;
-							break;
-						case 2:
-							TmpCipher = Ndis802_11Encryption2Enabled;
-							break;
-						case 4:
-							TmpCipher = Ndis802_11Encryption3Enabled;
-							break;
-						default:
-							break;
-					}
-					if (TmpCipher > pBss->WPA.PairCipher)
-					{
-						// Move the lower cipher suite to PairCipherAux
-						pBss->WPA.PairCipherAux = pBss->WPA.PairCipher;
-						pBss->WPA.PairCipher	= TmpCipher;
-					}
-					else
-					{
-						pBss->WPA.PairCipherAux = TmpCipher;
-					}
-					pTmp++;
-					Count--;
+				if (TmpCipher > pBss->WPA.PairCipher) {
+					/* Move the lower cipher suite to PairCipherAux */
+					pBss->WPA.PairCipherAux =
+					    pBss->WPA.PairCipher;
+					pBss->WPA.PairCipher = TmpCipher;
+				} else {
+					pBss->WPA.PairCipherAux = TmpCipher;
 				}
+				pTmp++;
+				Count--;
+			}
 
-				// 4. get AKM suite counts
-				//Count	= *(PUSHORT) pTmp;
-				Count = (pTmp[1]<<8) + pTmp[0];
-				pTmp   += sizeof(USHORT);
-				pTmp   += 3;
-
-				switch (*pTmp)
-				{
-					case 1:
-						// Set AP support WPA mode
-						if (pBss->AuthMode == Ndis802_11AuthModeOpen)
-							pBss->AuthMode = Ndis802_11AuthModeWPA;
-						else
-							pBss->AuthModeAux = Ndis802_11AuthModeWPA;
-						break;
-					case 2:
-						// Set AP support WPA mode
-						if (pBss->AuthMode == Ndis802_11AuthModeOpen)
-							pBss->AuthMode = Ndis802_11AuthModeWPAPSK;
-						else
-							pBss->AuthModeAux = Ndis802_11AuthModeWPAPSK;
-						break;
-					default:
-						break;
-				}
-				pTmp   += 1;
-
-				// Fixed for WPA-None
-				if (pBss->BssType == BSS_ADHOC)
-				{
-					pBss->AuthMode	  = Ndis802_11AuthModeWPANone;
-					pBss->AuthModeAux = Ndis802_11AuthModeWPANone;
-					pBss->WepStatus   = pBss->WPA.GroupCipher;
-					if (pBss->WPA.PairCipherAux == Ndis802_11WEPDisabled)
-						pBss->WPA.PairCipherAux = pBss->WPA.GroupCipher;
-				}
+			/* 4. get AKM suite counts */
+			/*Count = *(u16 *)pTmp; */
+			Count = (pTmp[1] << 8) + pTmp[0];
+			pTmp += sizeof(u16);
+			pTmp += 3;
+
+			switch (*pTmp) {
+			case 1:
+				/* Set AP support WPA-enterprise mode */
+				if (pBss->AuthMode == Ndis802_11AuthModeOpen)
+					pBss->AuthMode = Ndis802_11AuthModeWPA;
+				else
+					pBss->AuthModeAux =
+					    Ndis802_11AuthModeWPA;
+				break;
+			case 2:
+				/* Set AP support WPA-PSK mode */
+				if (pBss->AuthMode == Ndis802_11AuthModeOpen)
+					pBss->AuthMode =
+					    Ndis802_11AuthModeWPAPSK;
 				else
-					pBss->WepStatus   = pBss->WPA.PairCipher;
+					pBss->AuthModeAux =
+					    Ndis802_11AuthModeWPAPSK;
+				break;
+			default:
+				break;
+			}
+			pTmp += 1;
+
+			/* Fixed for WPA-None */
+			if (pBss->BssType == BSS_ADHOC) {
+				pBss->AuthMode = Ndis802_11AuthModeWPANone;
+				pBss->AuthModeAux = Ndis802_11AuthModeWPANone;
+				pBss->WepStatus = pBss->WPA.GroupCipher;
+				/* Patched bugs for old driver */
+				if (pBss->WPA.PairCipherAux ==
+				    Ndis802_11WEPDisabled)
+					pBss->WPA.PairCipherAux =
+					    pBss->WPA.GroupCipher;
+			} else
+				pBss->WepStatus = pBss->WPA.PairCipher;
+
+			/* Check the Pair & Group, if different, turn on mixed mode flag */
+			if (pBss->WPA.GroupCipher != pBss->WPA.PairCipher)
+				pBss->WPA.bMixMode = TRUE;
 
-				// Check the Pair & Group, if different, turn on mixed mode flag
-				if (pBss->WPA.GroupCipher != pBss->WPA.PairCipher)
-					pBss->WPA.bMixMode = TRUE;
+			break;
+
+		case IE_RSN:
+			pRsnHeader = (struct rt_rsn_ie_header *) pTmp;
 
+			/* 0. Version must be 1 */
+			if (le2cpu16(pRsnHeader->Version) != 1)
 				break;
+			pTmp += sizeof(struct rt_rsn_ie_header);
 
-			case IE_RSN:
-				pRsnHeader = (PRSN_IE_HEADER_STRUCT) pTmp;
+			/* 1. Check group cipher */
+			pCipher = (struct rt_cipher_suite_struct *) pTmp;
+			if (!RTMPEqualMemory(pTmp, RSN_OUI, 3))
+				break;
 
-				// 0. Version must be 1
-				if (le2cpu16(pRsnHeader->Version) != 1)
+			/* Parse group cipher */
+			switch (pCipher->Type) {
+			case 1:
+				pBss->WPA2.GroupCipher =
+				    Ndis802_11GroupWEP40Enabled;
+				break;
+			case 5:
+				pBss->WPA2.GroupCipher =
+				    Ndis802_11GroupWEP104Enabled;
+				break;
+			case 2:
+				pBss->WPA2.GroupCipher =
+				    Ndis802_11Encryption2Enabled;
+				break;
+			case 4:
+				pBss->WPA2.GroupCipher =
+				    Ndis802_11Encryption3Enabled;
+				break;
+			default:
+				break;
+			}
+			/* set to correct offset for next parsing */
+			pTmp += sizeof(struct rt_cipher_suite_struct);
+
+			/* 2. Get pairwise cipher counts */
+			/*Count = *(u16 *)pTmp; */
+			Count = (pTmp[1] << 8) + pTmp[0];
+			pTmp += sizeof(u16);
+
+			/* 3. Get pairwise cipher */
+			/* Parsing all unicast cipher suite */
+			while (Count > 0) {
+				/* Skip OUI */
+				pCipher = (struct rt_cipher_suite_struct *) pTmp;
+				TmpCipher = Ndis802_11WEPDisabled;
+				switch (pCipher->Type) {
+				case 1:
+				case 5:	/* Although WEP is not allowed in WPA related auth mode, we parse it anyway */
+					TmpCipher =
+					    Ndis802_11Encryption1Enabled;
 					break;
-				pTmp   += sizeof(RSN_IE_HEADER_STRUCT);
-
-				// 1. Check group cipher
-				pCipher = (PCIPHER_SUITE_STRUCT) pTmp;
-				if (!RTMPEqualMemory(pTmp, RSN_OUI, 3))
+				case 2:
+					TmpCipher =
+					    Ndis802_11Encryption2Enabled;
+					break;
+				case 4:
+					TmpCipher =
+					    Ndis802_11Encryption3Enabled;
+					break;
+				default:
 					break;
-
-				// Parse group cipher
-				switch (pCipher->Type)
-				{
-					case 1:
-						pBss->WPA2.GroupCipher = Ndis802_11GroupWEP40Enabled;
-						break;
-					case 5:
-						pBss->WPA2.GroupCipher = Ndis802_11GroupWEP104Enabled;
-						break;
-					case 2:
-						pBss->WPA2.GroupCipher = Ndis802_11Encryption2Enabled;
-						break;
-					case 4:
-						pBss->WPA2.GroupCipher = Ndis802_11Encryption3Enabled;
-						break;
-					default:
-						break;
 				}
-				// set to correct offset for next parsing
-				pTmp   += sizeof(CIPHER_SUITE_STRUCT);
-
-				// 2. Get pairwise cipher counts
-				//Count = *(PUSHORT) pTmp;
-				Count = (pTmp[1]<<8) + pTmp[0];
-				pTmp   += sizeof(USHORT);
-
-				// 3. Get pairwise cipher
-				// Parsing all unicast cipher suite
-				while (Count > 0)
-				{
-					// Skip OUI
-					pCipher = (PCIPHER_SUITE_STRUCT) pTmp;
-					TmpCipher = Ndis802_11WEPDisabled;
-					switch (pCipher->Type)
-					{
-						case 1:
-						case 5: // Although WEP is not allowed in WPA related auth mode, we parse it anyway
-							TmpCipher = Ndis802_11Encryption1Enabled;
-							break;
-						case 2:
-							TmpCipher = Ndis802_11Encryption2Enabled;
-							break;
-						case 4:
-							TmpCipher = Ndis802_11Encryption3Enabled;
-							break;
-						default:
-							break;
-					}
-					if (TmpCipher > pBss->WPA2.PairCipher)
-					{
-						// Move the lower cipher suite to PairCipherAux
-						pBss->WPA2.PairCipherAux = pBss->WPA2.PairCipher;
-						pBss->WPA2.PairCipher	 = TmpCipher;
-					}
-					else
-					{
-						pBss->WPA2.PairCipherAux = TmpCipher;
-					}
-					pTmp += sizeof(CIPHER_SUITE_STRUCT);
-					Count--;
+				if (TmpCipher > pBss->WPA2.PairCipher) {
+					/* Move the lower cipher suite to PairCipherAux */
+					pBss->WPA2.PairCipherAux =
+					    pBss->WPA2.PairCipher;
+					pBss->WPA2.PairCipher = TmpCipher;
+				} else {
+					pBss->WPA2.PairCipherAux = TmpCipher;
 				}
+				pTmp += sizeof(struct rt_cipher_suite_struct);
+				Count--;
+			}
 
-				// 4. get AKM suite counts
-				//Count	= *(PUSHORT) pTmp;
-				Count = (pTmp[1]<<8) + pTmp[0];
-				pTmp   += sizeof(USHORT);
+			/* 4. get AKM suite counts */
+			/*Count = *(u16 *)pTmp; */
+			Count = (pTmp[1] << 8) + pTmp[0];
+			pTmp += sizeof(u16);
 
-				// 5. Get AKM ciphers
-				pAKM = (PAKM_SUITE_STRUCT) pTmp;
+			/* 5. Get AKM ciphers */
+			/* Parsing all AKM ciphers */
+			while (Count > 0) {
+				pAKM = (struct rt_akm_suite *) pTmp;
 				if (!RTMPEqualMemory(pTmp, RSN_OUI, 3))
 					break;
 
-				switch (pAKM->Type)
-				{
-					case 1:
-						// Set AP support WPA mode
-						if (pBss->AuthMode == Ndis802_11AuthModeOpen)
-							pBss->AuthMode = Ndis802_11AuthModeWPA2;
-						else
-							pBss->AuthModeAux = Ndis802_11AuthModeWPA2;
-						break;
-					case 2:
-						// Set AP support WPA mode
-						if (pBss->AuthMode == Ndis802_11AuthModeOpen)
-							pBss->AuthMode = Ndis802_11AuthModeWPA2PSK;
-						else
-							pBss->AuthModeAux = Ndis802_11AuthModeWPA2PSK;
-						break;
-					default:
-						break;
+				switch (pAKM->Type) {
+				case 1:
+					/* Set AP support WPA-enterprise mode */
+					if (pBss->AuthMode ==
+					    Ndis802_11AuthModeOpen)
+						pBss->AuthMode =
+						    Ndis802_11AuthModeWPA2;
+					else
+						pBss->AuthModeAux =
+						    Ndis802_11AuthModeWPA2;
+					break;
+				case 2:
+					/* Set AP support WPA-PSK mode */
+					if (pBss->AuthMode ==
+					    Ndis802_11AuthModeOpen)
+						pBss->AuthMode =
+						    Ndis802_11AuthModeWPA2PSK;
+					else
+						pBss->AuthModeAux =
+						    Ndis802_11AuthModeWPA2PSK;
+					break;
+				default:
+					if (pBss->AuthMode ==
+					    Ndis802_11AuthModeOpen)
+						pBss->AuthMode =
+						    Ndis802_11AuthModeMax;
+					else
+						pBss->AuthModeAux =
+						    Ndis802_11AuthModeMax;
+					break;
 				}
-				pTmp   += (Count * sizeof(AKM_SUITE_STRUCT));
+				pTmp += (Count * sizeof(struct rt_akm_suite));
+				Count--;
+			}
 
-				// Fixed for WPA-None
-				if (pBss->BssType == BSS_ADHOC)
-				{
-					pBss->AuthMode = Ndis802_11AuthModeWPANone;
-					pBss->AuthModeAux = Ndis802_11AuthModeWPANone;
-					pBss->WPA.PairCipherAux = pBss->WPA2.PairCipherAux;
-					pBss->WPA.GroupCipher	= pBss->WPA2.GroupCipher;
-					pBss->WepStatus 		= pBss->WPA.GroupCipher;
-					if (pBss->WPA.PairCipherAux == Ndis802_11WEPDisabled)
-						pBss->WPA.PairCipherAux = pBss->WPA.GroupCipher;
-				}
-				pBss->WepStatus   = pBss->WPA2.PairCipher;
+			/* Fixed for WPA-None */
+			if (pBss->BssType == BSS_ADHOC) {
+				pBss->AuthMode = Ndis802_11AuthModeWPANone;
+				pBss->AuthModeAux = Ndis802_11AuthModeWPANone;
+				pBss->WPA.PairCipherAux =
+				    pBss->WPA2.PairCipherAux;
+				pBss->WPA.GroupCipher = pBss->WPA2.GroupCipher;
+				pBss->WepStatus = pBss->WPA.GroupCipher;
+				/* Patched bugs for old driver */
+				if (pBss->WPA.PairCipherAux ==
+				    Ndis802_11WEPDisabled)
+					pBss->WPA.PairCipherAux =
+					    pBss->WPA.GroupCipher;
+			}
+			pBss->WepStatus = pBss->WPA2.PairCipher;
 
-				// 6. Get RSN capability
-				//pBss->WPA2.RsnCapability = *(PUSHORT) pTmp;
-				pBss->WPA2.RsnCapability = (pTmp[1]<<8) + pTmp[0];
-				pTmp += sizeof(USHORT);
+			/* 6. Get RSN capability */
+			/*pBss->WPA2.RsnCapability = *(u16 *)pTmp; */
+			pBss->WPA2.RsnCapability = (pTmp[1] << 8) + pTmp[0];
+			pTmp += sizeof(u16);
 
-				// Check the Pair & Group, if different, turn on mixed mode flag
-				if (pBss->WPA2.GroupCipher != pBss->WPA2.PairCipher)
-					pBss->WPA2.bMixMode = TRUE;
+			/* Check the Pair & Group, if different, turn on mixed mode flag */
+			if (pBss->WPA2.GroupCipher != pBss->WPA2.PairCipher)
+				pBss->WPA2.bMixMode = TRUE;
 
-				break;
-			default:
-				break;
+			break;
+		default:
+			break;
 		}
 		Length -= (pEid->Len + 2);
 	}
 }
 
-// ===========================================================================================
-// mac_table.c
-// ===========================================================================================
+/* =========================================================================================== */
+/* mac_table.c */
+/* =========================================================================================== */
 
 /*! \brief generates a random mac address value for IBSS BSSID
  *	\param Addr the bssid location
@@ -4450,18 +4546,15 @@ VOID BssCipherParse(
  *	\pre
  *	\post
  */
-VOID MacAddrRandomBssid(
-	IN PRTMP_ADAPTER pAd,
-	OUT PUCHAR pAddr)
+void MacAddrRandomBssid(struct rt_rtmp_adapter *pAd, u8 *pAddr)
 {
-	INT i;
+	int i;
 
-	for (i = 0; i < MAC_ADDR_LEN; i++)
-	{
+	for (i = 0; i < MAC_ADDR_LEN; i++) {
 		pAddr[i] = RandomByte(pAd);
 	}
 
-	pAddr[0] = (pAddr[0] & 0xfe) | 0x02;  // the first 2 bits must be 01xxxxxxxx
+	pAddr[0] = (pAddr[0] & 0xfe) | 0x02;	/* the first 2 bits must be 01xxxxxxxx */
 }
 
 /*! \brief init the management mac frame header
@@ -4475,33 +4568,30 @@ VOID MacAddrRandomBssid(
  *	\post
  *	\note this function initializes the following field
 
- IRQL = PASSIVE_LEVEL
- IRQL = DISPATCH_LEVEL
+	IRQL = PASSIVE_LEVEL
+	IRQL = DISPATCH_LEVEL
 
  */
-VOID MgtMacHeaderInit(
-	IN	PRTMP_ADAPTER	pAd,
-	IN OUT PHEADER_802_11 pHdr80211,
-	IN UCHAR SubType,
-	IN UCHAR ToDs,
-	IN PUCHAR pDA,
-	IN PUCHAR pBssid)
+void MgtMacHeaderInit(struct rt_rtmp_adapter *pAd,
+		      struct rt_header_802_11 * pHdr80211,
+		      u8 SubType,
+		      u8 ToDs, u8 *pDA, u8 *pBssid)
 {
-	NdisZeroMemory(pHdr80211, sizeof(HEADER_802_11));
+	NdisZeroMemory(pHdr80211, sizeof(struct rt_header_802_11));
 
 	pHdr80211->FC.Type = BTYPE_MGMT;
 	pHdr80211->FC.SubType = SubType;
+/*      if (SubType == SUBTYPE_ACK)     // sample, no use, it will conflict with ACTION frame sub type */
+/*              pHdr80211->FC.Type = BTYPE_CNTL; */
 	pHdr80211->FC.ToDs = ToDs;
 	COPY_MAC_ADDR(pHdr80211->Addr1, pDA);
-
 	COPY_MAC_ADDR(pHdr80211->Addr2, pAd->CurrentAddress);
-
 	COPY_MAC_ADDR(pHdr80211->Addr3, pBssid);
 }
 
-// ===========================================================================================
-// mem_mgmt.c
-// ===========================================================================================
+/* =========================================================================================== */
+/* mem_mgmt.c */
+/* =========================================================================================== */
 
 /*!***************************************************************************
  * This routine build an outgoing frame, and fill all information specified
@@ -4510,49 +4600,45 @@ VOID MgtMacHeaderInit(
  * input params:
  *		Buffer - pointer to a pre-allocated memory segment
  *		args - a list of <int arg_size, arg> pairs.
- *		NOTE NOTE NOTE!!!! the last argument must be NULL, otherwise this
- *						   function will FAIL!!!
+ *		NOTE NOTE NOTE! the last argument must be NULL, otherwise this
+ *						   function will FAIL!
  * return:
  *		Size of the buffer
  * usage:
  *		MakeOutgoingFrame(Buffer, output_length, 2, &fc, 2, &dur, 6, p_addr1, 6,p_addr2, END_OF_ARGS);
 
  IRQL = PASSIVE_LEVEL
- IRQL = DISPATCH_LEVEL
+	IRQL = DISPATCH_LEVEL
 
  ****************************************************************************/
-ULONG MakeOutgoingFrame(
-	OUT CHAR *Buffer,
-	OUT ULONG *FrameLen, ...)
+unsigned long MakeOutgoingFrame(u8 * Buffer, unsigned long * FrameLen, ...)
 {
-	CHAR   *p;
-	int 	leng;
-	ULONG	TotLeng;
+	u8 *p;
+	int leng;
+	unsigned long TotLeng;
 	va_list Args;
 
-	// calculates the total length
+	/* calculates the total length */
 	TotLeng = 0;
 	va_start(Args, FrameLen);
-	do
-	{
+	do {
 		leng = va_arg(Args, int);
-		if (leng == END_OF_ARGS)
-		{
+		if (leng == END_OF_ARGS) {
 			break;
 		}
-		p = va_arg(Args, PVOID);
+		p = va_arg(Args, void *);
 		NdisMoveMemory(&Buffer[TotLeng], p, leng);
 		TotLeng = TotLeng + leng;
-	} while(TRUE);
+	} while (TRUE);
 
-	va_end(Args); /* clean up */
+	va_end(Args);		/* clean up */
 	*FrameLen = TotLeng;
 	return TotLeng;
 }
 
-// ===========================================================================================
-// mlme_queue.c
-// ===========================================================================================
+/* =========================================================================================== */
+/* mlme_queue.c */
+/* =========================================================================================== */
 
 /*! \brief	Initialize The MLME Queue, used by MLME Functions
  *	\param	*Queue	   The MLME Queue
@@ -4564,19 +4650,17 @@ ULONG MakeOutgoingFrame(
  IRQL = PASSIVE_LEVEL
 
  */
-NDIS_STATUS MlmeQueueInit(
-	IN MLME_QUEUE *Queue)
+int MlmeQueueInit(struct rt_mlme_queue *Queue)
 {
-	INT i;
+	int i;
 
 	NdisAllocateSpinLock(&Queue->Lock);
 
-	Queue->Num	= 0;
+	Queue->Num = 0;
 	Queue->Head = 0;
 	Queue->Tail = 0;
 
-	for (i = 0; i < MAX_LEN_OF_MLME_QUEUE; i++)
-	{
+	for (i = 0; i < MAX_LEN_OF_MLME_QUEUE; i++) {
 		Queue->Entry[i].Occupied = FALSE;
 		Queue->Entry[i].MsgLen = 0;
 		NdisZeroMemory(Queue->Entry[i].Msg, MGMT_DMA_BUFFER_SIZE);
@@ -4596,34 +4680,31 @@ NDIS_STATUS MlmeQueueInit(
  *	\post
  *	\note	 The message has to be initialized
 
- IRQL = PASSIVE_LEVEL
- IRQL = DISPATCH_LEVEL
+	IRQL = PASSIVE_LEVEL
+	IRQL = DISPATCH_LEVEL
 
  */
-BOOLEAN MlmeEnqueue(
-	IN	PRTMP_ADAPTER	pAd,
-	IN ULONG Machine,
-	IN ULONG MsgType,
-	IN ULONG MsgLen,
-	IN VOID *Msg)
+BOOLEAN MlmeEnqueue(struct rt_rtmp_adapter *pAd,
+		    unsigned long Machine,
+		    unsigned long MsgType, unsigned long MsgLen, void * Msg)
 {
-	INT Tail;
-	MLME_QUEUE	*Queue = (MLME_QUEUE *)&pAd->Mlme.Queue;
+	int Tail;
+	struct rt_mlme_queue *Queue = (struct rt_mlme_queue *)& pAd->Mlme.Queue;
 
-	// Do nothing if the driver is starting halt state.
-	// This might happen when timer already been fired before cancel timer with mlmehalt
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
+	/* Do nothing if the driver is starting halt state. */
+	/* This might happen when timer already been fired before cancel timer with mlmehalt */
+	if (RTMP_TEST_FLAG
+	    (pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
 		return FALSE;
 
-	// First check the size, it MUST not exceed the mlme queue size
-	if (MsgLen > MGMT_DMA_BUFFER_SIZE)
-	{
-		DBGPRINT_ERR(("MlmeEnqueue: msg too large, size = %ld \n", MsgLen));
+	/* First check the size, it MUST not exceed the mlme queue size */
+	if (MsgLen > MGMT_DMA_BUFFER_SIZE) {
+		DBGPRINT_ERR(("MlmeEnqueue: msg too large, size = %ld \n",
+			      MsgLen));
 		return FALSE;
 	}
 
-	if (MlmeQueueFull(Queue))
-	{
+	if (MlmeQueueFull(Queue)) {
 		return FALSE;
 	}
 
@@ -4631,8 +4712,7 @@ BOOLEAN MlmeEnqueue(
 	Tail = Queue->Tail;
 	Queue->Tail++;
 	Queue->Num++;
-	if (Queue->Tail == MAX_LEN_OF_MLME_QUEUE)
-	{
+	if (Queue->Tail == MAX_LEN_OF_MLME_QUEUE) {
 		Queue->Tail = 0;
 	}
 
@@ -4640,10 +4720,9 @@ BOOLEAN MlmeEnqueue(
 	Queue->Entry[Tail].Occupied = TRUE;
 	Queue->Entry[Tail].Machine = Machine;
 	Queue->Entry[Tail].MsgType = MsgType;
-	Queue->Entry[Tail].MsgLen  = MsgLen;
+	Queue->Entry[Tail].MsgLen = MsgLen;
 
-	if (Msg != NULL)
-	{
+	if (Msg != NULL) {
 		NdisMoveMemory(Queue->Entry[Tail].Msg, Msg, MsgLen);
 	}
 
@@ -4656,7 +4735,7 @@ BOOLEAN MlmeEnqueue(
  *	\param	 TimeStampHigh	 The upper 32 bit of timestamp
  *	\param	 TimeStampLow	 The lower 32 bit of timestamp
  *	\param	 Rssi			 The receiving RSSI strength
- *	\param	 MsgLen 		 The length of the message
+ *	\param	 MsgLen			 The length of the message
  *	\param	*Msg			 The message pointer
  *	\return  TRUE if everything ok, FALSE otherwise (like Queue Full)
  *	\pre
@@ -4665,87 +4744,78 @@ BOOLEAN MlmeEnqueue(
  IRQL = DISPATCH_LEVEL
 
  */
-BOOLEAN MlmeEnqueueForRecv(
-	IN	PRTMP_ADAPTER	pAd,
-	IN ULONG Wcid,
-	IN ULONG TimeStampHigh,
-	IN ULONG TimeStampLow,
-	IN UCHAR Rssi0,
-	IN UCHAR Rssi1,
-	IN UCHAR Rssi2,
-	IN ULONG MsgLen,
-	IN VOID *Msg,
-	IN UCHAR Signal)
+BOOLEAN MlmeEnqueueForRecv(struct rt_rtmp_adapter *pAd,
+			   unsigned long Wcid,
+			   unsigned long TimeStampHigh,
+			   unsigned long TimeStampLow,
+			   u8 Rssi0,
+			   u8 Rssi1,
+			   u8 Rssi2,
+			   unsigned long MsgLen, void * Msg, u8 Signal)
 {
-	INT 		 Tail, Machine;
-	PFRAME_802_11 pFrame = (PFRAME_802_11)Msg;
-	INT		 MsgType;
-	MLME_QUEUE	*Queue = (MLME_QUEUE *)&pAd->Mlme.Queue;
-
-	// Do nothing if the driver is starting halt state.
-	// This might happen when timer already been fired before cancel timer with mlmehalt
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
-	{
+	int Tail, Machine;
+	struct rt_frame_802_11 * pFrame = (struct rt_frame_802_11 *) Msg;
+	int MsgType;
+	struct rt_mlme_queue *Queue = (struct rt_mlme_queue *)& pAd->Mlme.Queue;
+
+	/* Do nothing if the driver is starting halt state. */
+	/* This might happen when timer already been fired before cancel timer with mlmehalt */
+	if (RTMP_TEST_FLAG
+	    (pAd,
+	     fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST)) {
 		DBGPRINT_ERR(("MlmeEnqueueForRecv: fRTMP_ADAPTER_HALT_IN_PROGRESS\n"));
 		return FALSE;
 	}
-
-	// First check the size, it MUST not exceed the mlme queue size
-	if (MsgLen > MGMT_DMA_BUFFER_SIZE)
-	{
+	/* First check the size, it MUST not exceed the mlme queue size */
+	if (MsgLen > MGMT_DMA_BUFFER_SIZE) {
 		DBGPRINT_ERR(("MlmeEnqueueForRecv: frame too large, size = %ld \n", MsgLen));
 		return FALSE;
 	}
 
-	if (MlmeQueueFull(Queue))
-	{
+	if (MlmeQueueFull(Queue)) {
 		return FALSE;
 	}
 
 	{
-		if (!MsgTypeSubst(pAd, pFrame, &Machine, &MsgType))
-		{
-			DBGPRINT_ERR(("MlmeEnqueueForRecv: un-recongnized mgmt->subtype=%d\n",pFrame->Hdr.FC.SubType));
+		if (!MsgTypeSubst(pAd, pFrame, &Machine, &MsgType)) {
+			DBGPRINT_ERR(("MlmeEnqueueForRecv: un-recongnized mgmt->subtype=%d\n", pFrame->Hdr.FC.SubType));
 			return FALSE;
 		}
 	}
 
-	// OK, we got all the informations, it is time to put things into queue
+	/* OK, we got all the informations, it is time to put things into queue */
 	NdisAcquireSpinLock(&(Queue->Lock));
 	Tail = Queue->Tail;
 	Queue->Tail++;
 	Queue->Num++;
-	if (Queue->Tail == MAX_LEN_OF_MLME_QUEUE)
-	{
+	if (Queue->Tail == MAX_LEN_OF_MLME_QUEUE) {
 		Queue->Tail = 0;
 	}
 	Queue->Entry[Tail].Occupied = TRUE;
 	Queue->Entry[Tail].Machine = Machine;
 	Queue->Entry[Tail].MsgType = MsgType;
-	Queue->Entry[Tail].MsgLen  = MsgLen;
+	Queue->Entry[Tail].MsgLen = MsgLen;
 	Queue->Entry[Tail].TimeStamp.u.LowPart = TimeStampLow;
 	Queue->Entry[Tail].TimeStamp.u.HighPart = TimeStampHigh;
 	Queue->Entry[Tail].Rssi0 = Rssi0;
 	Queue->Entry[Tail].Rssi1 = Rssi1;
 	Queue->Entry[Tail].Rssi2 = Rssi2;
 	Queue->Entry[Tail].Signal = Signal;
-	Queue->Entry[Tail].Wcid = (UCHAR)Wcid;
+	Queue->Entry[Tail].Wcid = (u8)Wcid;
 
 	Queue->Entry[Tail].Channel = pAd->LatchRfRegs.Channel;
 
-	if (Msg != NULL)
-	{
+	if (Msg != NULL) {
 		NdisMoveMemory(Queue->Entry[Tail].Msg, Msg, MsgLen);
 	}
 
 	NdisReleaseSpinLock(&(Queue->Lock));
 
-	RT28XX_MLME_HANDLER(pAd);
+	RTMP_MLME_HANDLER(pAd);
 
 	return TRUE;
 }
 
-
 /*! \brief	 Dequeue a message from the MLME Queue
  *	\param	*Queue	  The MLME Queue
  *	\param	*Elem	  The message dequeued from MLME Queue
@@ -4756,97 +4826,88 @@ BOOLEAN MlmeEnqueueForRecv(
  IRQL = DISPATCH_LEVEL
 
  */
-BOOLEAN MlmeDequeue(
-	IN MLME_QUEUE *Queue,
-	OUT MLME_QUEUE_ELEM **Elem)
+BOOLEAN MlmeDequeue(struct rt_mlme_queue *Queue, struct rt_mlme_queue_elem ** Elem)
 {
 	NdisAcquireSpinLock(&(Queue->Lock));
 	*Elem = &(Queue->Entry[Queue->Head]);
 	Queue->Num--;
 	Queue->Head++;
-	if (Queue->Head == MAX_LEN_OF_MLME_QUEUE)
-	{
+	if (Queue->Head == MAX_LEN_OF_MLME_QUEUE) {
 		Queue->Head = 0;
 	}
 	NdisReleaseSpinLock(&(Queue->Lock));
 	return TRUE;
 }
 
-// IRQL = DISPATCH_LEVEL
-VOID	MlmeRestartStateMachine(
-	IN	PRTMP_ADAPTER	pAd)
+/* IRQL = DISPATCH_LEVEL */
+void MlmeRestartStateMachine(struct rt_rtmp_adapter *pAd)
 {
-#ifdef RT2860
-	MLME_QUEUE_ELEM		*Elem = NULL;
-#endif
-	BOOLEAN				Cancelled;
+#ifdef RTMP_MAC_PCI
+	struct rt_mlme_queue_elem *Elem = NULL;
+#endif /* RTMP_MAC_PCI // */
+	BOOLEAN Cancelled;
 
 	DBGPRINT(RT_DEBUG_TRACE, ("MlmeRestartStateMachine \n"));
 
-#ifdef RT2860
+#ifdef RTMP_MAC_PCI
 	NdisAcquireSpinLock(&pAd->Mlme.TaskLock);
-	if(pAd->Mlme.bRunning)
-	{
+	if (pAd->Mlme.bRunning) {
 		NdisReleaseSpinLock(&pAd->Mlme.TaskLock);
 		return;
-	}
-	else
-	{
+	} else {
 		pAd->Mlme.bRunning = TRUE;
 	}
 	NdisReleaseSpinLock(&pAd->Mlme.TaskLock);
 
-	// Remove all Mlme queues elements
-	while (!MlmeQueueEmpty(&pAd->Mlme.Queue))
-	{
-		//From message type, determine which state machine I should drive
-		if (MlmeDequeue(&pAd->Mlme.Queue, &Elem))
-		{
-			// free MLME element
+	/* Remove all Mlme queues elements */
+	while (!MlmeQueueEmpty(&pAd->Mlme.Queue)) {
+		/*From message type, determine which state machine I should drive */
+		if (MlmeDequeue(&pAd->Mlme.Queue, &Elem)) {
+			/* free MLME element */
 			Elem->Occupied = FALSE;
 			Elem->MsgLen = 0;
 
-		}
-		else {
+		} else {
 			DBGPRINT_ERR(("MlmeRestartStateMachine: MlmeQueue empty\n"));
 		}
 	}
-#endif /* RT2860 */
+#endif /* RTMP_MAC_PCI // */
 
 	{
-		// Cancel all timer events
-		// Be careful to cancel new added timer
-		RTMPCancelTimer(&pAd->MlmeAux.AssocTimer,	  &Cancelled);
-		RTMPCancelTimer(&pAd->MlmeAux.ReassocTimer,   &Cancelled);
-		RTMPCancelTimer(&pAd->MlmeAux.DisassocTimer,  &Cancelled);
-		RTMPCancelTimer(&pAd->MlmeAux.AuthTimer,	   &Cancelled);
-		RTMPCancelTimer(&pAd->MlmeAux.BeaconTimer,	   &Cancelled);
-		RTMPCancelTimer(&pAd->MlmeAux.ScanTimer,	   &Cancelled);
+		/* Cancel all timer events */
+		/* Be careful to cancel new added timer */
+		RTMPCancelTimer(&pAd->MlmeAux.AssocTimer, &Cancelled);
+		RTMPCancelTimer(&pAd->MlmeAux.ReassocTimer, &Cancelled);
+		RTMPCancelTimer(&pAd->MlmeAux.DisassocTimer, &Cancelled);
+		RTMPCancelTimer(&pAd->MlmeAux.AuthTimer, &Cancelled);
+		RTMPCancelTimer(&pAd->MlmeAux.BeaconTimer, &Cancelled);
+		RTMPCancelTimer(&pAd->MlmeAux.ScanTimer, &Cancelled);
+
 	}
 
-	// Change back to original channel in case of doing scan
+	/* Change back to original channel in case of doing scan */
 	AsicSwitchChannel(pAd, pAd->CommonCfg.Channel, FALSE);
 	AsicLockChannel(pAd, pAd->CommonCfg.Channel);
 
-	// Resume MSDU which is turned off durning scan
+	/* Resume MSDU which is turned off durning scan */
 	RTMPResumeMsduTransmission(pAd);
 
 	{
-		// Set all state machines back IDLE
-		pAd->Mlme.CntlMachine.CurrState    = CNTL_IDLE;
-		pAd->Mlme.AssocMachine.CurrState   = ASSOC_IDLE;
-		pAd->Mlme.AuthMachine.CurrState    = AUTH_REQ_IDLE;
+		/* Set all state machines back IDLE */
+		pAd->Mlme.CntlMachine.CurrState = CNTL_IDLE;
+		pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
+		pAd->Mlme.AuthMachine.CurrState = AUTH_REQ_IDLE;
 		pAd->Mlme.AuthRspMachine.CurrState = AUTH_RSP_IDLE;
-		pAd->Mlme.SyncMachine.CurrState    = SYNC_IDLE;
-		pAd->Mlme.ActMachine.CurrState    = ACT_IDLE;
+		pAd->Mlme.SyncMachine.CurrState = SYNC_IDLE;
+		pAd->Mlme.ActMachine.CurrState = ACT_IDLE;
 	}
 
-#ifdef RT2860
-	// Remove running state
+#ifdef RTMP_MAC_PCI
+	/* Remove running state */
 	NdisAcquireSpinLock(&pAd->Mlme.TaskLock);
 	pAd->Mlme.bRunning = FALSE;
 	NdisReleaseSpinLock(&pAd->Mlme.TaskLock);
-#endif
+#endif /* RTMP_MAC_PCI // */
 }
 
 /*! \brief	test if the MLME Queue is empty
@@ -4858,8 +4919,7 @@ VOID	MlmeRestartStateMachine(
  IRQL = DISPATCH_LEVEL
 
  */
-BOOLEAN MlmeQueueEmpty(
-	IN MLME_QUEUE *Queue)
+BOOLEAN MlmeQueueEmpty(struct rt_mlme_queue *Queue)
 {
 	BOOLEAN Ans;
 
@@ -4871,7 +4931,7 @@ BOOLEAN MlmeQueueEmpty(
 }
 
 /*! \brief	 test if the MLME Queue is full
- *	\param	 *Queue 	 The MLME Queue
+ *	\param	 *Queue		 The MLME Queue
  *	\return  TRUE if the Queue is empty, FALSE otherwise
  *	\pre
  *	\post
@@ -4880,13 +4940,13 @@ BOOLEAN MlmeQueueEmpty(
  IRQL = DISPATCH_LEVEL
 
  */
-BOOLEAN MlmeQueueFull(
-	IN MLME_QUEUE *Queue)
+BOOLEAN MlmeQueueFull(struct rt_mlme_queue *Queue)
 {
 	BOOLEAN Ans;
 
 	NdisAcquireSpinLock(&(Queue->Lock));
-	Ans = (Queue->Num == MAX_LEN_OF_MLME_QUEUE || Queue->Entry[Queue->Tail].Occupied);
+	Ans = (Queue->Num == MAX_LEN_OF_MLME_QUEUE
+	       || Queue->Entry[Queue->Tail].Occupied);
 	NdisReleaseSpinLock(&(Queue->Lock));
 
 	return Ans;
@@ -4902,11 +4962,10 @@ BOOLEAN MlmeQueueFull(
  IRQL = PASSIVE_LEVEL
 
  */
-VOID MlmeQueueDestroy(
-	IN MLME_QUEUE *pQueue)
+void MlmeQueueDestroy(struct rt_mlme_queue *pQueue)
 {
 	NdisAcquireSpinLock(&(pQueue->Lock));
-	pQueue->Num  = 0;
+	pQueue->Num = 0;
 	pQueue->Head = 0;
 	pQueue->Tail = 0;
 	NdisReleaseSpinLock(&(pQueue->Lock));
@@ -4924,126 +4983,112 @@ VOID MlmeQueueDestroy(
  IRQL = DISPATCH_LEVEL
 
  */
-BOOLEAN MsgTypeSubst(
-	IN PRTMP_ADAPTER  pAd,
-	IN PFRAME_802_11 pFrame,
-	OUT INT *Machine,
-	OUT INT *MsgType)
+BOOLEAN MsgTypeSubst(struct rt_rtmp_adapter *pAd,
+		     struct rt_frame_802_11 * pFrame,
+		     int * Machine, int * MsgType)
 {
-	USHORT	Seq;
-	UCHAR	EAPType;
-	PUCHAR	pData;
-
-	// Pointer to start of data frames including SNAP header
-	pData = (PUCHAR) pFrame + LENGTH_802_11;
-
-	// The only data type will pass to this function is EAPOL frame
-	if (pFrame->Hdr.FC.Type == BTYPE_DATA)
-	{
-		if (NdisEqualMemory(SNAP_AIRONET, pData, LENGTH_802_1_H))
-		{
-			// Cisco Aironet SNAP header
-			*Machine = AIRONET_STATE_MACHINE;
-			*MsgType = MT2_AIRONET_MSG;
-			return (TRUE);
-		}
-		{
-			*Machine = WPA_PSK_STATE_MACHINE;
-			EAPType = *((UCHAR*)pFrame + LENGTH_802_11 + LENGTH_802_1_H + 1);
-			return(WpaMsgTypeSubst(EAPType, MsgType));
-		}
-	}
-
-	switch (pFrame->Hdr.FC.SubType)
-	{
-		case SUBTYPE_ASSOC_REQ:
-			*Machine = ASSOC_STATE_MACHINE;
-			*MsgType = MT2_PEER_ASSOC_REQ;
-			break;
-		case SUBTYPE_ASSOC_RSP:
-			*Machine = ASSOC_STATE_MACHINE;
-			*MsgType = MT2_PEER_ASSOC_RSP;
-			break;
-		case SUBTYPE_REASSOC_REQ:
-			*Machine = ASSOC_STATE_MACHINE;
-			*MsgType = MT2_PEER_REASSOC_REQ;
-			break;
-		case SUBTYPE_REASSOC_RSP:
-			*Machine = ASSOC_STATE_MACHINE;
-			*MsgType = MT2_PEER_REASSOC_RSP;
-			break;
-		case SUBTYPE_PROBE_REQ:
-			*Machine = SYNC_STATE_MACHINE;
-			*MsgType = MT2_PEER_PROBE_REQ;
-			break;
-		case SUBTYPE_PROBE_RSP:
-			*Machine = SYNC_STATE_MACHINE;
-			*MsgType = MT2_PEER_PROBE_RSP;
-			break;
-		case SUBTYPE_BEACON:
-			*Machine = SYNC_STATE_MACHINE;
-			*MsgType = MT2_PEER_BEACON;
-			break;
-		case SUBTYPE_ATIM:
-			*Machine = SYNC_STATE_MACHINE;
-			*MsgType = MT2_PEER_ATIM;
-			break;
-		case SUBTYPE_DISASSOC:
-			*Machine = ASSOC_STATE_MACHINE;
-			*MsgType = MT2_PEER_DISASSOC_REQ;
-			break;
-		case SUBTYPE_AUTH:
-			// get the sequence number from payload 24 Mac Header + 2 bytes algorithm
-			NdisMoveMemory(&Seq, &pFrame->Octet[2], sizeof(USHORT));
-			if (Seq == 1 || Seq == 3)
-			{
-				*Machine = AUTH_RSP_STATE_MACHINE;
-				*MsgType = MT2_PEER_AUTH_ODD;
-			}
-			else if (Seq == 2 || Seq == 4)
-			{
+	u16 Seq, Alg;
+	u8 EAPType;
+	u8 *pData;
+
+	/* Pointer to start of data frames including SNAP header */
+	pData = (u8 *)pFrame + LENGTH_802_11;
+
+	/* The only data type will pass to this function is EAPOL frame */
+	if (pFrame->Hdr.FC.Type == BTYPE_DATA) {
+		{
+			*Machine = WPA_STATE_MACHINE;
+			EAPType =
+			    *((u8 *) pFrame + LENGTH_802_11 +
+			      LENGTH_802_1_H + 1);
+			return (WpaMsgTypeSubst(EAPType, (int *) MsgType));
+		}
+	}
+
+	switch (pFrame->Hdr.FC.SubType) {
+	case SUBTYPE_ASSOC_REQ:
+		*Machine = ASSOC_STATE_MACHINE;
+		*MsgType = MT2_PEER_ASSOC_REQ;
+		break;
+	case SUBTYPE_ASSOC_RSP:
+		*Machine = ASSOC_STATE_MACHINE;
+		*MsgType = MT2_PEER_ASSOC_RSP;
+		break;
+	case SUBTYPE_REASSOC_REQ:
+		*Machine = ASSOC_STATE_MACHINE;
+		*MsgType = MT2_PEER_REASSOC_REQ;
+		break;
+	case SUBTYPE_REASSOC_RSP:
+		*Machine = ASSOC_STATE_MACHINE;
+		*MsgType = MT2_PEER_REASSOC_RSP;
+		break;
+	case SUBTYPE_PROBE_REQ:
+		*Machine = SYNC_STATE_MACHINE;
+		*MsgType = MT2_PEER_PROBE_REQ;
+		break;
+	case SUBTYPE_PROBE_RSP:
+		*Machine = SYNC_STATE_MACHINE;
+		*MsgType = MT2_PEER_PROBE_RSP;
+		break;
+	case SUBTYPE_BEACON:
+		*Machine = SYNC_STATE_MACHINE;
+		*MsgType = MT2_PEER_BEACON;
+		break;
+	case SUBTYPE_ATIM:
+		*Machine = SYNC_STATE_MACHINE;
+		*MsgType = MT2_PEER_ATIM;
+		break;
+	case SUBTYPE_DISASSOC:
+		*Machine = ASSOC_STATE_MACHINE;
+		*MsgType = MT2_PEER_DISASSOC_REQ;
+		break;
+	case SUBTYPE_AUTH:
+		/* get the sequence number from payload 24 Mac Header + 2 bytes algorithm */
+		NdisMoveMemory(&Seq, &pFrame->Octet[2], sizeof(u16));
+		NdisMoveMemory(&Alg, &pFrame->Octet[0], sizeof(u16));
+		if (Seq == 1 || Seq == 3) {
+			*Machine = AUTH_RSP_STATE_MACHINE;
+			*MsgType = MT2_PEER_AUTH_ODD;
+		} else if (Seq == 2 || Seq == 4) {
+			if (Alg == AUTH_MODE_OPEN || Alg == AUTH_MODE_KEY) {
 				*Machine = AUTH_STATE_MACHINE;
 				*MsgType = MT2_PEER_AUTH_EVEN;
 			}
-			else
-			{
-				return FALSE;
-			}
-			break;
-		case SUBTYPE_DEAUTH:
-			*Machine = AUTH_RSP_STATE_MACHINE;
-			*MsgType = MT2_PEER_DEAUTH;
-			break;
-		case SUBTYPE_ACTION:
-			*Machine = ACTION_STATE_MACHINE;
-			//  Sometimes Sta will return with category bytes with MSB = 1, if they receive catogory out of their support
-			if ((pFrame->Octet[0]&0x7F) > MAX_PEER_CATE_MSG)
-			{
-				*MsgType = MT2_ACT_INVALID;
-			}
-			else
-			{
-				*MsgType = (pFrame->Octet[0]&0x7F);
-			}
-			break;
-		default:
+		} else {
 			return FALSE;
-			break;
+		}
+		break;
+	case SUBTYPE_DEAUTH:
+		*Machine = AUTH_RSP_STATE_MACHINE;
+		*MsgType = MT2_PEER_DEAUTH;
+		break;
+	case SUBTYPE_ACTION:
+		*Machine = ACTION_STATE_MACHINE;
+		/*  Sometimes Sta will return with category bytes with MSB = 1, if they receive catogory out of their support */
+		if ((pFrame->Octet[0] & 0x7F) > MAX_PEER_CATE_MSG) {
+			*MsgType = MT2_ACT_INVALID;
+		} else {
+			*MsgType = (pFrame->Octet[0] & 0x7F);
+		}
+		break;
+	default:
+		return FALSE;
+		break;
 	}
 
 	return TRUE;
 }
 
-// ===========================================================================================
-// state_machine.c
-// ===========================================================================================
+/* =========================================================================================== */
+/* state_machine.c */
+/* =========================================================================================== */
 
 /*! \brief Initialize the state machine.
  *	\param *S			pointer to the state machine
  *	\param	Trans		State machine transition function
  *	\param	StNr		number of states
  *	\param	MsgNr		number of messages
- *	\param	DefFunc 	default function, when there is invalid state/message combination
+ *	\param	DefFunc		default function, when there is invalid state/message combination
  *	\param	InitState	initial state of the state machine
  *	\param	Base		StateMachine base, internal use only
  *	\pre p_sm should be a legal pointer
@@ -5052,34 +5097,30 @@ BOOLEAN MsgTypeSubst(
  IRQL = PASSIVE_LEVEL
 
  */
-VOID StateMachineInit(
-	IN STATE_MACHINE *S,
-	IN STATE_MACHINE_FUNC Trans[],
-	IN ULONG StNr,
-	IN ULONG MsgNr,
-	IN STATE_MACHINE_FUNC DefFunc,
-	IN ULONG InitState,
-	IN ULONG Base)
+void StateMachineInit(struct rt_state_machine *S,
+		      IN STATE_MACHINE_FUNC Trans[],
+		      unsigned long StNr,
+		      unsigned long MsgNr,
+		      IN STATE_MACHINE_FUNC DefFunc,
+		      unsigned long InitState, unsigned long Base)
 {
-	ULONG i, j;
+	unsigned long i, j;
 
-	// set number of states and messages
+	/* set number of states and messages */
 	S->NrState = StNr;
-	S->NrMsg   = MsgNr;
-	S->Base    = Base;
+	S->NrMsg = MsgNr;
+	S->Base = Base;
 
-	S->TransFunc  = Trans;
+	S->TransFunc = Trans;
 
-	// init all state transition to default function
-	for (i = 0; i < StNr; i++)
-	{
-		for (j = 0; j < MsgNr; j++)
-		{
+	/* init all state transition to default function */
+	for (i = 0; i < StNr; i++) {
+		for (j = 0; j < MsgNr; j++) {
 			S->TransFunc[i * MsgNr + j] = DefFunc;
 		}
 	}
 
-	// set the starting state
+	/* set the starting state */
 	S->CurrState = InitState;
 }
 
@@ -5094,38 +5135,34 @@ VOID StateMachineInit(
  IRQL = PASSIVE_LEVEL
 
  */
-VOID StateMachineSetAction(
-	IN STATE_MACHINE *S,
-	IN ULONG St,
-	IN ULONG Msg,
-	IN STATE_MACHINE_FUNC Func)
+void StateMachineSetAction(struct rt_state_machine *S,
+			   unsigned long St,
+			   unsigned long Msg, IN STATE_MACHINE_FUNC Func)
 {
-	ULONG MsgIdx;
+	unsigned long MsgIdx;
 
 	MsgIdx = Msg - S->Base;
 
-	if (St < S->NrState && MsgIdx < S->NrMsg)
-	{
-		// boundary checking before setting the action
+	if (St < S->NrState && MsgIdx < S->NrMsg) {
+		/* boundary checking before setting the action */
 		S->TransFunc[St * S->NrMsg + MsgIdx] = Func;
 	}
 }
 
 /*! \brief	 This function does the state transition
  *	\param	 *Adapter the NIC adapter pointer
- *	\param	 *S 	  the state machine
+ *	\param	 *S	  the state machine
  *	\param	 *Elem	  the message to be executed
  *	\return   None
 
  IRQL = DISPATCH_LEVEL
 
  */
-VOID StateMachinePerformAction(
-	IN	PRTMP_ADAPTER	pAd,
-	IN STATE_MACHINE *S,
-	IN MLME_QUEUE_ELEM *Elem)
+void StateMachinePerformAction(struct rt_rtmp_adapter *pAd,
+			       struct rt_state_machine *S, struct rt_mlme_queue_elem *Elem)
 {
-	(*(S->TransFunc[S->CurrState * S->NrMsg + Elem->MsgType - S->Base]))(pAd, Elem);
+	(*(S->TransFunc[S->CurrState * S->NrMsg + Elem->MsgType - S->Base]))
+	    (pAd, Elem);
 }
 
 /*
@@ -5136,15 +5173,13 @@ VOID StateMachinePerformAction(
 		StateMachinePerformAction()
 	==========================================================================
  */
-VOID Drop(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
+void Drop(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
 }
 
-// ===========================================================================================
-// lfsr.c
-// ===========================================================================================
+/* =========================================================================================== */
+/* lfsr.c */
+/* =========================================================================================== */
 
 /*
 	==========================================================================
@@ -5154,9 +5189,7 @@ VOID Drop(
 
 	==========================================================================
  */
-VOID LfsrInit(
-	IN PRTMP_ADAPTER pAd,
-	IN ULONG Seed)
+void LfsrInit(struct rt_rtmp_adapter *pAd, unsigned long Seed)
 {
 	if (Seed == 0)
 		pAd->Mlme.ShiftReg = 1;
@@ -5169,26 +5202,23 @@ VOID LfsrInit(
 	Description:
 	==========================================================================
  */
-UCHAR RandomByte(
-	IN PRTMP_ADAPTER pAd)
+u8 RandomByte(struct rt_rtmp_adapter *pAd)
 {
-	ULONG i;
-	UCHAR R, Result;
+	unsigned long i;
+	u8 R, Result;
 
 	R = 0;
 
 	if (pAd->Mlme.ShiftReg == 0)
-	NdisGetSystemUpTime((ULONG *)&pAd->Mlme.ShiftReg);
+		NdisGetSystemUpTime((unsigned long *) & pAd->Mlme.ShiftReg);
 
-	for (i = 0; i < 8; i++)
-	{
-		if (pAd->Mlme.ShiftReg & 0x00000001)
-		{
-			pAd->Mlme.ShiftReg = ((pAd->Mlme.ShiftReg ^ LFSR_MASK) >> 1) | 0x80000000;
+	for (i = 0; i < 8; i++) {
+		if (pAd->Mlme.ShiftReg & 0x00000001) {
+			pAd->Mlme.ShiftReg =
+			    ((pAd->Mlme.
+			      ShiftReg ^ LFSR_MASK) >> 1) | 0x80000000;
 			Result = 1;
-		}
-		else
-		{
+		} else {
 			pAd->Mlme.ShiftReg = pAd->Mlme.ShiftReg >> 1;
 			Result = 0;
 		}
@@ -5198,2454 +5228,6 @@ UCHAR RandomByte(
 	return R;
 }
 
-VOID AsicUpdateAutoFallBackTable(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			pRateTable)
-{
-	UCHAR					i;
-	HT_FBK_CFG0_STRUC		HtCfg0;
-	HT_FBK_CFG1_STRUC		HtCfg1;
-	LG_FBK_CFG0_STRUC		LgCfg0;
-	LG_FBK_CFG1_STRUC		LgCfg1;
-	PRTMP_TX_RATE_SWITCH	pCurrTxRate, pNextTxRate;
-
-	// set to initial value
-	HtCfg0.word = 0x65432100;
-	HtCfg1.word = 0xedcba988;
-	LgCfg0.word = 0xedcba988;
-	LgCfg1.word = 0x00002100;
-
-	pNextTxRate = (PRTMP_TX_RATE_SWITCH)pRateTable+1;
-	for (i = 1; i < *((PUCHAR) pRateTable); i++)
-	{
-		pCurrTxRate = (PRTMP_TX_RATE_SWITCH)pRateTable+1+i;
-		switch (pCurrTxRate->Mode)
-		{
-			case 0:		//CCK
-				break;
-			case 1:		//OFDM
-				{
-					switch(pCurrTxRate->CurrMCS)
-					{
-						case 0:
-							LgCfg0.field.OFDMMCS0FBK = (pNextTxRate->Mode == MODE_OFDM) ? (pNextTxRate->CurrMCS+8): pNextTxRate->CurrMCS;
-							break;
-						case 1:
-							LgCfg0.field.OFDMMCS1FBK = (pNextTxRate->Mode == MODE_OFDM) ? (pNextTxRate->CurrMCS+8): pNextTxRate->CurrMCS;
-							break;
-						case 2:
-							LgCfg0.field.OFDMMCS2FBK = (pNextTxRate->Mode == MODE_OFDM) ? (pNextTxRate->CurrMCS+8): pNextTxRate->CurrMCS;
-							break;
-						case 3:
-							LgCfg0.field.OFDMMCS3FBK = (pNextTxRate->Mode == MODE_OFDM) ? (pNextTxRate->CurrMCS+8): pNextTxRate->CurrMCS;
-							break;
-						case 4:
-							LgCfg0.field.OFDMMCS4FBK = (pNextTxRate->Mode == MODE_OFDM) ? (pNextTxRate->CurrMCS+8): pNextTxRate->CurrMCS;
-							break;
-						case 5:
-							LgCfg0.field.OFDMMCS5FBK = (pNextTxRate->Mode == MODE_OFDM) ? (pNextTxRate->CurrMCS+8): pNextTxRate->CurrMCS;
-							break;
-						case 6:
-							LgCfg0.field.OFDMMCS6FBK = (pNextTxRate->Mode == MODE_OFDM) ? (pNextTxRate->CurrMCS+8): pNextTxRate->CurrMCS;
-							break;
-						case 7:
-							LgCfg0.field.OFDMMCS7FBK = (pNextTxRate->Mode == MODE_OFDM) ? (pNextTxRate->CurrMCS+8): pNextTxRate->CurrMCS;
-							break;
-					}
-				}
-				break;
-			case 2:		//HT-MIX
-			case 3:		//HT-GF
-				{
-					if ((pNextTxRate->Mode >= MODE_HTMIX) && (pCurrTxRate->CurrMCS != pNextTxRate->CurrMCS))
-					{
-						switch(pCurrTxRate->CurrMCS)
-						{
-							case 0:
-								HtCfg0.field.HTMCS0FBK = pNextTxRate->CurrMCS;
-								break;
-							case 1:
-								HtCfg0.field.HTMCS1FBK = pNextTxRate->CurrMCS;
-								break;
-							case 2:
-								HtCfg0.field.HTMCS2FBK = pNextTxRate->CurrMCS;
-								break;
-							case 3:
-								HtCfg0.field.HTMCS3FBK = pNextTxRate->CurrMCS;
-								break;
-							case 4:
-								HtCfg0.field.HTMCS4FBK = pNextTxRate->CurrMCS;
-								break;
-							case 5:
-								HtCfg0.field.HTMCS5FBK = pNextTxRate->CurrMCS;
-								break;
-							case 6:
-								HtCfg0.field.HTMCS6FBK = pNextTxRate->CurrMCS;
-								break;
-							case 7:
-								HtCfg0.field.HTMCS7FBK = pNextTxRate->CurrMCS;
-								break;
-							case 8:
-								HtCfg1.field.HTMCS8FBK = pNextTxRate->CurrMCS;
-								break;
-							case 9:
-								HtCfg1.field.HTMCS9FBK = pNextTxRate->CurrMCS;
-								break;
-							case 10:
-								HtCfg1.field.HTMCS10FBK = pNextTxRate->CurrMCS;
-								break;
-							case 11:
-								HtCfg1.field.HTMCS11FBK = pNextTxRate->CurrMCS;
-								break;
-							case 12:
-								HtCfg1.field.HTMCS12FBK = pNextTxRate->CurrMCS;
-								break;
-							case 13:
-								HtCfg1.field.HTMCS13FBK = pNextTxRate->CurrMCS;
-								break;
-							case 14:
-								HtCfg1.field.HTMCS14FBK = pNextTxRate->CurrMCS;
-								break;
-							case 15:
-								HtCfg1.field.HTMCS15FBK = pNextTxRate->CurrMCS;
-								break;
-							default:
-								DBGPRINT(RT_DEBUG_ERROR, ("AsicUpdateAutoFallBackTable: not support CurrMCS=%d\n", pCurrTxRate->CurrMCS));
-						}
-					}
-				}
-				break;
-		}
-
-		pNextTxRate = pCurrTxRate;
-	}
-
-	RTMP_IO_WRITE32(pAd, HT_FBK_CFG0, HtCfg0.word);
-	RTMP_IO_WRITE32(pAd, HT_FBK_CFG1, HtCfg1.word);
-	RTMP_IO_WRITE32(pAd, LG_FBK_CFG0, LgCfg0.word);
-	RTMP_IO_WRITE32(pAd, LG_FBK_CFG1, LgCfg1.word);
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-		Set MAC register value according operation mode.
-		OperationMode AND bNonGFExist are for MM and GF Proteciton.
-		If MM or GF mask is not set, those passing argument doesn't not take effect.
-
-		Operation mode meaning:
-		= 0 : Pure HT, no preotection.
-		= 0x01; there may be non-HT devices in both the control and extension channel, protection is optional in BSS.
-		= 0x10: No Transmission in 40M is protected.
-		= 0x11: Transmission in both 40M and 20M shall be protected
-		if (bNonGFExist)
-			we should choose not to use GF. But still set correct ASIC registers.
-	========================================================================
-*/
-VOID 	AsicUpdateProtect(
-	IN		PRTMP_ADAPTER	pAd,
-	IN 		USHORT			OperationMode,
-	IN 		UCHAR			SetMask,
-	IN		BOOLEAN			bDisableBGProtect,
-	IN		BOOLEAN			bNonGFExist)
-{
-	PROT_CFG_STRUC	ProtCfg, ProtCfg4;
-	UINT32 Protect[6];
-	USHORT			offset;
-	UCHAR			i;
-	UINT32 MacReg = 0;
-
-	if (!(pAd->CommonCfg.bHTProtect) && (OperationMode != 8))
-	{
-		return;
-	}
-
-	if (pAd->BATable.numAsOriginator)
-	{
-		//
-		// enable the RTS/CTS to avoid channel collision
-		//
-		SetMask = ALLN_SETPROTECT;
-		OperationMode = 8;
-	}
-
-	// Config ASIC RTS threshold register
-	RTMP_IO_READ32(pAd, TX_RTS_CFG, &MacReg);
-	MacReg &= 0xFF0000FF;
-
-	// If the user want disable RtsThreshold and enable Amsdu/Ralink-Aggregation, set the RtsThreshold as 4096
-        if ((
-			(pAd->CommonCfg.BACapability.field.AmsduEnable) ||
-			(pAd->CommonCfg.bAggregationCapable == TRUE))
-            && pAd->CommonCfg.RtsThreshold == MAX_RTS_THRESHOLD)
-        {
-			MacReg |= (0x1000 << 8);
-        }
-        else
-        {
-			MacReg |= (pAd->CommonCfg.RtsThreshold << 8);
-        }
-
-	RTMP_IO_WRITE32(pAd, TX_RTS_CFG, MacReg);
-
-	// Initial common protection settings
-	RTMPZeroMemory(Protect, sizeof(Protect));
-	ProtCfg4.word = 0;
-	ProtCfg.word = 0;
-	ProtCfg.field.TxopAllowGF40 = 1;
-	ProtCfg.field.TxopAllowGF20 = 1;
-	ProtCfg.field.TxopAllowMM40 = 1;
-	ProtCfg.field.TxopAllowMM20 = 1;
-	ProtCfg.field.TxopAllowOfdm = 1;
-	ProtCfg.field.TxopAllowCck = 1;
-	ProtCfg.field.RTSThEn = 1;
-	ProtCfg.field.ProtectNav = ASIC_SHORTNAV;
-
-	// update PHY mode and rate
-	if (pAd->CommonCfg.Channel > 14)
-		ProtCfg.field.ProtectRate = 0x4000;
-	ProtCfg.field.ProtectRate |= pAd->CommonCfg.RtsRate;
-
-	// Handle legacy(B/G) protection
-	if (bDisableBGProtect)
-	{
-		//ProtCfg.field.ProtectRate = pAd->CommonCfg.RtsRate;
-		ProtCfg.field.ProtectCtrl = 0;
-		Protect[0] = ProtCfg.word;
-		Protect[1] = ProtCfg.word;
-	}
-	else
-	{
-		//ProtCfg.field.ProtectRate = pAd->CommonCfg.RtsRate;
-		ProtCfg.field.ProtectCtrl = 0;			// CCK do not need to be protected
-		Protect[0] = ProtCfg.word;
-		ProtCfg.field.ProtectCtrl = ASIC_CTS;	// OFDM needs using CCK to protect
-		Protect[1] = ProtCfg.word;
-	}
-
-	// Decide HT frame protection.
-	if ((SetMask & ALLN_SETPROTECT) != 0)
-	{
-		switch(OperationMode)
-		{
-			case 0x0:
-				// NO PROTECT
-				// 1.All STAs in the BSS are 20/40 MHz HT
-				// 2. in ai 20/40MHz BSS
-				// 3. all STAs are 20MHz in a 20MHz BSS
-				// Pure HT. no protection.
-
-				// MM20_PROT_CFG
-				//	Reserved (31:27)
-				// 	PROT_TXOP(25:20) -- 010111
-				//	PROT_NAV(19:18)  -- 01 (Short NAV protection)
-				//  PROT_CTRL(17:16) -- 00 (None)
-				// 	PROT_RATE(15:0)  -- 0x4004 (OFDM 24M)
-				Protect[2] = 0x01744004;
-
-				// MM40_PROT_CFG
-				//	Reserved (31:27)
-				// 	PROT_TXOP(25:20) -- 111111
-				//	PROT_NAV(19:18)  -- 01 (Short NAV protection)
-				//  PROT_CTRL(17:16) -- 00 (None)
-				// 	PROT_RATE(15:0)  -- 0x4084 (duplicate OFDM 24M)
-				Protect[3] = 0x03f44084;
-
-				// CF20_PROT_CFG
-				//	Reserved (31:27)
-				// 	PROT_TXOP(25:20) -- 010111
-				//	PROT_NAV(19:18)  -- 01 (Short NAV protection)
-				//  PROT_CTRL(17:16) -- 00 (None)
-				// 	PROT_RATE(15:0)  -- 0x4004 (OFDM 24M)
-				Protect[4] = 0x01744004;
-
-				// CF40_PROT_CFG
-				//	Reserved (31:27)
-				// 	PROT_TXOP(25:20) -- 111111
-				//	PROT_NAV(19:18)  -- 01 (Short NAV protection)
-				//  PROT_CTRL(17:16) -- 00 (None)
-				// 	PROT_RATE(15:0)  -- 0x4084 (duplicate OFDM 24M)
-				Protect[5] = 0x03f44084;
-
-				if (bNonGFExist)
-				{
-					// PROT_NAV(19:18)  -- 01 (Short NAV protectiion)
-					// PROT_CTRL(17:16) -- 01 (RTS/CTS)
-					Protect[4] = 0x01754004;
-					Protect[5] = 0x03f54084;
-				}
-				pAd->CommonCfg.IOTestParm.bRTSLongProtOn = FALSE;
-				break;
-
- 			case 1:
-				// This is "HT non-member protection mode."
-				// If there may be non-HT STAs my BSS
-				ProtCfg.word = 0x01744004;	// PROT_CTRL(17:16) : 0 (None)
-				ProtCfg4.word = 0x03f44084; // duplicaet legacy 24M. BW set 1.
-				if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_BG_PROTECTION_INUSED))
-				{
-					ProtCfg.word = 0x01740003;	//ERP use Protection bit is set, use protection rate at Clause 18..
-					ProtCfg4.word = 0x03f40003; // Don't duplicate RTS/CTS in CCK mode. 0x03f40083;
-				}
-				//Assign Protection method for 20&40 MHz packets
-				ProtCfg.field.ProtectCtrl = ASIC_RTS;
-				ProtCfg.field.ProtectNav = ASIC_SHORTNAV;
-				ProtCfg4.field.ProtectCtrl = ASIC_RTS;
-				ProtCfg4.field.ProtectNav = ASIC_SHORTNAV;
-				Protect[2] = ProtCfg.word;
-				Protect[3] = ProtCfg4.word;
-				Protect[4] = ProtCfg.word;
-				Protect[5] = ProtCfg4.word;
-				pAd->CommonCfg.IOTestParm.bRTSLongProtOn = TRUE;
-				break;
-
-			case 2:
-				// If only HT STAs are in BSS. at least one is 20MHz. Only protect 40MHz packets
-				ProtCfg.word = 0x01744004;  // PROT_CTRL(17:16) : 0 (None)
-				ProtCfg4.word = 0x03f44084; // duplicaet legacy 24M. BW set 1.
-
-				//Assign Protection method for 40MHz packets
-				ProtCfg4.field.ProtectCtrl = ASIC_RTS;
-				ProtCfg4.field.ProtectNav = ASIC_SHORTNAV;
-				Protect[2] = ProtCfg.word;
-				Protect[3] = ProtCfg4.word;
-				if (bNonGFExist)
-				{
-					ProtCfg.field.ProtectCtrl = ASIC_RTS;
-					ProtCfg.field.ProtectNav = ASIC_SHORTNAV;
-				}
-				Protect[4] = ProtCfg.word;
-				Protect[5] = ProtCfg4.word;
-
-				pAd->CommonCfg.IOTestParm.bRTSLongProtOn = FALSE;
-				break;
-
-			case 3:
-				// HT mixed mode.	 PROTECT ALL!
-				// Assign Rate
-				ProtCfg.word = 0x01744004;	//duplicaet legacy 24M. BW set 1.
-				ProtCfg4.word = 0x03f44084;
-				// both 20MHz and 40MHz are protected. Whether use RTS or CTS-to-self depends on the
-				if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_BG_PROTECTION_INUSED))
-				{
-					ProtCfg.word = 0x01740003;	//ERP use Protection bit is set, use protection rate at Clause 18..
-					ProtCfg4.word = 0x03f40003; // Don't duplicate RTS/CTS in CCK mode. 0x03f40083
-				}
-				//Assign Protection method for 20&40 MHz packets
-				ProtCfg.field.ProtectCtrl = ASIC_RTS;
-				ProtCfg.field.ProtectNav = ASIC_SHORTNAV;
-				ProtCfg4.field.ProtectCtrl = ASIC_RTS;
-				ProtCfg4.field.ProtectNav = ASIC_SHORTNAV;
-				Protect[2] = ProtCfg.word;
-				Protect[3] = ProtCfg4.word;
-				Protect[4] = ProtCfg.word;
-				Protect[5] = ProtCfg4.word;
-				pAd->CommonCfg.IOTestParm.bRTSLongProtOn = TRUE;
-				break;
-
-			case 8:
-				// Special on for Atheros problem n chip.
-				Protect[2] = 0x01754004;
-				Protect[3] = 0x03f54084;
-				Protect[4] = 0x01754004;
-				Protect[5] = 0x03f54084;
-				pAd->CommonCfg.IOTestParm.bRTSLongProtOn = TRUE;
-				break;
-		}
-	}
-
-	offset = CCK_PROT_CFG;
-	for (i = 0;i < 6;i++)
-	{
-		if ((SetMask & (1<< i)))
-		{
-			RTMP_IO_WRITE32(pAd, offset + i*4, Protect[i]);
-		}
-	}
-}
-
-#ifdef RT2870
-/*
-	==========================================================================
-	Description:
-
-	Load RF normal operation-mode setup
-
-	==========================================================================
- */
-VOID RT30xxLoadRFNormalModeSetup(
-	IN PRTMP_ADAPTER 	pAd)
-{
-	UCHAR RFValue;
-
-	// RX0_PD & TX0_PD, RF R1 register Bit 2 & Bit 3 to 0 and RF_BLOCK_en,RX1_PD & TX1_PD, Bit0, Bit 4 & Bit5 to 1
-	RT30xxReadRFRegister(pAd, RF_R01, &RFValue);
-	RFValue = (RFValue & (~0x0C)) | 0x31;
-	RT30xxWriteRFRegister(pAd, RF_R01, RFValue);
-
-	// TX_LO2_en, RF R15 register Bit 3 to 0
-	RT30xxReadRFRegister(pAd, RF_R15, &RFValue);
-	RFValue &= (~0x08);
-	RT30xxWriteRFRegister(pAd, RF_R15, RFValue);
-
-	// TX_LO1_en, RF R17 register Bit 3 to 0
-	RT30xxReadRFRegister(pAd, RF_R17, &RFValue);
-	RFValue &= (~0x08);
-	// to fix rx long range issue
-	if (((pAd->MACVersion & 0xffff) >= 0x0211) && (pAd->NicConfig2.field.ExternalLNAForG == 0))
-	{
-		RFValue |= 0x20;
-	}
-	RT30xxWriteRFRegister(pAd, RF_R17, RFValue);
-
-	// RX_LO1_en, RF R20 register Bit 3 to 0
-	RT30xxReadRFRegister(pAd, RF_R20, &RFValue);
-	RFValue &= (~0x08);
-	RT30xxWriteRFRegister(pAd, RF_R20, RFValue);
-
-	// RX_LO2_en, RF R21 register Bit 3 to 0
-	RT30xxReadRFRegister(pAd, RF_R21, &RFValue);
-	RFValue &= (~0x08);
-	RT30xxWriteRFRegister(pAd, RF_R21, RFValue);
-
-	// LDORF_VC, RF R27 register Bit 2 to 0
-	RT30xxReadRFRegister(pAd, RF_R27, &RFValue);
-	if ((pAd->MACVersion & 0xffff) < 0x0211)
-		RFValue = (RFValue & (~0x77)) | 0x3;
-	else
-		RFValue = (RFValue & (~0x77));
-	RT30xxWriteRFRegister(pAd, RF_R27, RFValue);
-	/* end johnli */
-}
-
-/*
-	==========================================================================
-	Description:
-
-	Load RF sleep-mode setup
-
-	==========================================================================
- */
-VOID RT30xxLoadRFSleepModeSetup(
-	IN PRTMP_ADAPTER 	pAd)
-{
-	UCHAR RFValue;
-	UINT32 MACValue;
-
-	// RF_BLOCK_en. RF R1 register Bit 0 to 0
-	RT30xxReadRFRegister(pAd, RF_R01, &RFValue);
-	RFValue &= (~0x01);
-	RT30xxWriteRFRegister(pAd, RF_R01, RFValue);
-
-	// VCO_IC, RF R7 register Bit 4 & Bit 5 to 0
-	RT30xxReadRFRegister(pAd, RF_R07, &RFValue);
-	RFValue &= (~0x30);
-	RT30xxWriteRFRegister(pAd, RF_R07, RFValue);
-
-	// Idoh, RF R9 register Bit 1, Bit 2 & Bit 3 to 0
-	RT30xxReadRFRegister(pAd, RF_R09, &RFValue);
-	RFValue &= (~0x0E);
-	RT30xxWriteRFRegister(pAd, RF_R09, RFValue);
-
-	// RX_CTB_en, RF R21 register Bit 7 to 0
-	RT30xxReadRFRegister(pAd, RF_R21, &RFValue);
-	RFValue &= (~0x80);
-	RT30xxWriteRFRegister(pAd, RF_R21, RFValue);
-
-	// LDORF_VC, RF R27 register Bit 0, Bit 1 & Bit 2 to 1
-	RT30xxReadRFRegister(pAd, RF_R27, &RFValue);
-	RFValue |= 0x77;
-	RT30xxWriteRFRegister(pAd, RF_R27, RFValue);
-
-	RTMP_IO_READ32(pAd, LDO_CFG0, &MACValue);
-	MACValue |= 0x1D000000;
-	RTMP_IO_WRITE32(pAd, LDO_CFG0, MACValue);
-}
-
-/*
-	==========================================================================
-	Description:
-
-	Reverse RF sleep-mode setup
-
-	==========================================================================
- */
-VOID RT30xxReverseRFSleepModeSetup(
-	IN PRTMP_ADAPTER 	pAd)
-{
-	UCHAR RFValue;
-	UINT32 MACValue;
-
-	// RF_BLOCK_en, RF R1 register Bit 0 to 1
-	RT30xxReadRFRegister(pAd, RF_R01, &RFValue);
-	RFValue |= 0x01;
-	RT30xxWriteRFRegister(pAd, RF_R01, RFValue);
-
-	// VCO_IC, RF R7 register Bit 4 & Bit 5 to 1
-	RT30xxReadRFRegister(pAd, RF_R07, &RFValue);
-	RFValue |= 0x30;
-	RT30xxWriteRFRegister(pAd, RF_R07, RFValue);
-
-	// Idoh, RF R9 register Bit 1, Bit 2 & Bit 3 to 1
-	RT30xxReadRFRegister(pAd, RF_R09, &RFValue);
-	RFValue |= 0x0E;
-	RT30xxWriteRFRegister(pAd, RF_R09, RFValue);
-
-	// RX_CTB_en, RF R21 register Bit 7 to 1
-	RT30xxReadRFRegister(pAd, RF_R21, &RFValue);
-	RFValue |= 0x80;
-	RT30xxWriteRFRegister(pAd, RF_R21, RFValue);
-
-	// LDORF_VC, RF R27 register Bit 2 to 0
-	RT30xxReadRFRegister(pAd, RF_R27, &RFValue);
-	if ((pAd->MACVersion & 0xffff) < 0x0211)
-		RFValue = (RFValue & (~0x77)) | 0x3;
-	else
-		RFValue = (RFValue & (~0x77));
-	RT30xxWriteRFRegister(pAd, RF_R27, RFValue);
-
-	// RT3071 version E has fixed this issue
-	if ((pAd->NicConfig2.field.DACTestBit == 1) && ((pAd->MACVersion & 0xffff) < 0x0211))
-	{
-		// patch tx EVM issue temporarily
-		RTMP_IO_READ32(pAd, LDO_CFG0, &MACValue);
-		MACValue = ((MACValue & 0xE0FFFFFF) | 0x0D000000);
-		RTMP_IO_WRITE32(pAd, LDO_CFG0, MACValue);
-	}
-	else
-	{
-		RTMP_IO_READ32(pAd, LDO_CFG0, &MACValue);
-		MACValue = ((MACValue & 0xE0FFFFFF) | 0x01000000);
-		RTMP_IO_WRITE32(pAd, LDO_CFG0, MACValue);
-	}
-}
-#endif
-
-/*
-	==========================================================================
-	Description:
-
-	IRQL = PASSIVE_LEVEL
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-VOID AsicSwitchChannel(
-					  IN PRTMP_ADAPTER pAd,
-	IN	UCHAR			Channel,
-	IN	BOOLEAN			bScan)
-{
-	ULONG			R2 = 0, R3 = DEFAULT_RF_TX_POWER, R4 = 0;
-	CHAR    TxPwer = 0, TxPwer2 = DEFAULT_RF_TX_POWER; //Bbp94 = BBPR94_DEFAULT, TxPwer2 = DEFAULT_RF_TX_POWER;
-	UCHAR	index;
-	UINT32 	Value = 0; //BbpReg, Value;
-	RTMP_RF_REGS *RFRegTable;
-
-	// Search Tx power value
-	// We can't use ChannelList to search channel, since some central channl's txpowr doesn't list
-	// in ChannelList, so use TxPower array instead.
-	//
-	for (index = 0; index < MAX_NUM_OF_CHANNELS; index++)
-	{
-		if (Channel == pAd->TxPower[index].Channel)
-	{
-			TxPwer = pAd->TxPower[index].Power;
-			TxPwer2 = pAd->TxPower[index].Power2;
-			break;
-		}
-	}
-
-	if (index == MAX_NUM_OF_CHANNELS)
-		DBGPRINT(RT_DEBUG_ERROR, ("AsicSwitchChannel: Can't find the Channel#%d \n", Channel));
-
-#ifdef RT2870
-	// The RF programming sequence is difference between 3xxx and 2xxx
-	if ((IS_RT3070(pAd) || IS_RT3090(pAd)) && (
-	     (pAd->RfIcType == RFIC_3022) || (pAd->RfIcType == RFIC_3021) ||
-	     (pAd->RfIcType == RFIC_3020) || (pAd->RfIcType == RFIC_2020)))
-	{
-		/* modify by WY for Read RF Reg. error */
-		UCHAR RFValue;
-
-		for (index = 0; index < NUM_OF_3020_CHNL; index++)
-		{
-			if (Channel == FreqItems3020[index].Channel)
-			{
-				// Programming channel parameters
-				RT30xxWriteRFRegister(pAd, RF_R02, FreqItems3020[index].N);
-				RT30xxWriteRFRegister(pAd, RF_R03, FreqItems3020[index].K);
-
-				RT30xxReadRFRegister(pAd, RF_R06, &RFValue);
-				RFValue = (RFValue & 0xFC) | FreqItems3020[index].R;
-				RT30xxWriteRFRegister(pAd, RF_R06, RFValue);
-
-				// Set Tx0 Power
-				RT30xxReadRFRegister(pAd, RF_R12, &RFValue);
-				RFValue = (RFValue & 0xE0) | TxPwer;
-				RT30xxWriteRFRegister(pAd, RF_R12, RFValue);
-
-				// Set Tx1 Power
-				RT30xxReadRFRegister(pAd, RF_R13, &RFValue);
-				RFValue = (RFValue & 0xE0) | TxPwer2;
-				RT30xxWriteRFRegister(pAd, RF_R13, RFValue);
-
-				// Tx/Rx Stream setting
-				RT30xxReadRFRegister(pAd, RF_R01, &RFValue);
-				//if (IS_RT3090(pAd))
-				//	RFValue |= 0x01; // Enable RF block.
-				RFValue &= 0x03;	//clear bit[7~2]
-				if (pAd->Antenna.field.TxPath == 1)
-					RFValue |= 0xA0;
-				else if (pAd->Antenna.field.TxPath == 2)
-					RFValue |= 0x80;
-				if (pAd->Antenna.field.RxPath == 1)
-					RFValue |= 0x50;
-				else if (pAd->Antenna.field.RxPath == 2)
-					RFValue |= 0x40;
-				RT30xxWriteRFRegister(pAd, RF_R01, RFValue);
-
-				// Set RF offset
-				RT30xxReadRFRegister(pAd, RF_R23, &RFValue);
-				RFValue = (RFValue & 0x80) | pAd->RfFreqOffset;
-				RT30xxWriteRFRegister(pAd, RF_R23, RFValue);
-
-				// Set BW
-				if (!bScan && (pAd->CommonCfg.BBPCurrentBW == BW_40))
-				{
-					RFValue = pAd->Mlme.CaliBW40RfR24;
-					//DISABLE_11N_CHECK(pAd);
-				}
-				else
-				{
-					RFValue = pAd->Mlme.CaliBW20RfR24;
-				}
-				RT30xxWriteRFRegister(pAd, RF_R24, RFValue);
-				RT30xxWriteRFRegister(pAd, RF_R31, RFValue);
-
-				// Enable RF tuning
-				RT30xxReadRFRegister(pAd, RF_R07, &RFValue);
-				RFValue = RFValue | 0x1;
-				RT30xxWriteRFRegister(pAd, RF_R07, RFValue);
-
-				// latch channel for future usage.
-				pAd->LatchRfRegs.Channel = Channel;
-
-				DBGPRINT(RT_DEBUG_TRACE, ("SwitchChannel#%d(RF=%d, Pwr0=%d, Pwr1=%d, %dT), N=0x%02X, K=0x%02X, R=0x%02X\n",
-					Channel,
-					pAd->RfIcType,
-					TxPwer,
-					TxPwer2,
-					pAd->Antenna.field.TxPath,
-					FreqItems3020[index].N,
-					FreqItems3020[index].K,
-					FreqItems3020[index].R));
-				break;
-			}
-		}
-
-		DBGPRINT(RT_DEBUG_TRACE, ("SwitchChannel#%d(RF=%d, Pwr0=%d, Pwr1=%d, %dT), N=0x%02X, K=0x%02X, R=0x%02X\n",
-			Channel,
-			pAd->RfIcType,
-			TxPwer,
-			TxPwer2,
-			pAd->Antenna.field.TxPath,
-			FreqItems3020[index].N,
-			FreqItems3020[index].K,
-			FreqItems3020[index].R));
-	}
-	else
-#endif // RT2870 //
-	{
-		RFRegTable = RF2850RegTable;
-
-		switch (pAd->RfIcType)
-		{
-			case RFIC_2820:
-			case RFIC_2850:
-			case RFIC_2720:
-			case RFIC_2750:
-
-			for (index = 0; index < NUM_OF_2850_CHNL; index++)
-			{
-				if (Channel == RFRegTable[index].Channel)
-				{
-					R2 = RFRegTable[index].R2;
-					if (pAd->Antenna.field.TxPath == 1)
-					{
-						R2 |= 0x4000;	// If TXpath is 1, bit 14 = 1;
-					}
-
-					if (pAd->Antenna.field.RxPath == 2)
-					{
-						R2 |= 0x40;	// write 1 to off Rxpath.
-					}
-					else if (pAd->Antenna.field.RxPath == 1)
-					{
-						R2 |= 0x20040;	// write 1 to off RxPath
-					}
-
-					if (Channel > 14)
-					{
-						// initialize R3, R4
-						R3 = (RFRegTable[index].R3 & 0xffffc1ff);
-						R4 = (RFRegTable[index].R4 & (~0x001f87c0)) | (pAd->RfFreqOffset << 15);
-
-						// 5G band power range: 0xF9~0X0F, TX0 Reg3 bit9/TX1 Reg4 bit6="0" means the TX power reduce 7dB
-						// R3
-						if ((TxPwer >= -7) && (TxPwer < 0))
-						{
-							TxPwer = (7+TxPwer);
-							TxPwer = (TxPwer > 0xF) ? (0xF) : (TxPwer);
-							R3 |= (TxPwer << 10);
-							DBGPRINT(RT_DEBUG_ERROR, ("AsicSwitchChannel: TxPwer=%d \n", TxPwer));
-						}
-						else
-						{
-							TxPwer = (TxPwer > 0xF) ? (0xF) : (TxPwer);
-							R3 |= (TxPwer << 10) | (1 << 9);
-						}
-
-						// R4
-						if ((TxPwer2 >= -7) && (TxPwer2 < 0))
-						{
-							TxPwer2 = (7+TxPwer2);
-							TxPwer2 = (TxPwer2 > 0xF) ? (0xF) : (TxPwer2);
-							R4 |= (TxPwer2 << 7);
-							DBGPRINT(RT_DEBUG_ERROR, ("AsicSwitchChannel: TxPwer2=%d \n", TxPwer2));
-						}
-						else
-						{
-							TxPwer2 = (TxPwer2 > 0xF) ? (0xF) : (TxPwer2);
-							R4 |= (TxPwer2 << 7) | (1 << 6);
-						}
-					}
-					else
-					{
-						R3 = (RFRegTable[index].R3 & 0xffffc1ff) | (TxPwer << 9); // set TX power0
-					R4 = (RFRegTable[index].R4 & (~0x001f87c0)) | (pAd->RfFreqOffset << 15) | (TxPwer2 <<6);// Set freq Offset & TxPwr1
-					}
-
-					// Based on BBP current mode before changing RF channel.
-					if (!bScan && (pAd->CommonCfg.BBPCurrentBW == BW_40))
-					{
-						R4 |=0x200000;
-					}
-
-					// Update variables
-					pAd->LatchRfRegs.Channel = Channel;
-					pAd->LatchRfRegs.R1 = RFRegTable[index].R1;
-					pAd->LatchRfRegs.R2 = R2;
-					pAd->LatchRfRegs.R3 = R3;
-					pAd->LatchRfRegs.R4 = R4;
-
-					// Set RF value 1's set R3[bit2] = [0]
-					RTMP_RF_IO_WRITE32(pAd, pAd->LatchRfRegs.R1);
-					RTMP_RF_IO_WRITE32(pAd, pAd->LatchRfRegs.R2);
-					RTMP_RF_IO_WRITE32(pAd, (pAd->LatchRfRegs.R3 & (~0x04)));
-					RTMP_RF_IO_WRITE32(pAd, pAd->LatchRfRegs.R4);
-
-					RTMPusecDelay(200);
-
-					// Set RF value 2's set R3[bit2] = [1]
-					RTMP_RF_IO_WRITE32(pAd, pAd->LatchRfRegs.R1);
-					RTMP_RF_IO_WRITE32(pAd, pAd->LatchRfRegs.R2);
-					RTMP_RF_IO_WRITE32(pAd, (pAd->LatchRfRegs.R3 | 0x04));
-					RTMP_RF_IO_WRITE32(pAd, pAd->LatchRfRegs.R4);
-
-					RTMPusecDelay(200);
-
-					// Set RF value 3's set R3[bit2] = [0]
-					RTMP_RF_IO_WRITE32(pAd, pAd->LatchRfRegs.R1);
-					RTMP_RF_IO_WRITE32(pAd, pAd->LatchRfRegs.R2);
-					RTMP_RF_IO_WRITE32(pAd, (pAd->LatchRfRegs.R3 & (~0x04)));
-					RTMP_RF_IO_WRITE32(pAd, pAd->LatchRfRegs.R4);
-
-					break;
-				}
-			}
-			break;
-
-			default:
-			break;
-		}
-	}
-
-	// Change BBP setting during siwtch from a->g, g->a
-	if (Channel <= 14)
-	{
-	    ULONG	TxPinCfg = 0x00050F0A;//Gary 2007/08/09 0x050A0A
-
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R62, (0x37 - GET_LNA_GAIN(pAd)));
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R63, (0x37 - GET_LNA_GAIN(pAd)));
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R64, (0x37 - GET_LNA_GAIN(pAd)));
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R86, 0);//(0x44 - GET_LNA_GAIN(pAd)));	// According the Rory's suggestion to solve the middle range issue.
-		//RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R82, 0x62);
-
-		// Rx High power VGA offset for LNA select
-	    if (pAd->NicConfig2.field.ExternalLNAForG)
-	    {
-	        RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R82, 0x62);
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R75, 0x46);
-	    }
-	    else
-	    {
-	        RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R82, 0x84);
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R75, 0x50);
-	    }
-
-		// 5G band selection PIN, bit1 and bit2 are complement
-		RTMP_IO_READ32(pAd, TX_BAND_CFG, &Value);
-		Value &= (~0x6);
-		Value |= (0x04);
-		RTMP_IO_WRITE32(pAd, TX_BAND_CFG, Value);
-
-        // Turn off unused PA or LNA when only 1T or 1R
-		if (pAd->Antenna.field.TxPath == 1)
-		{
-			TxPinCfg &= 0xFFFFFFF3;
-		}
-		if (pAd->Antenna.field.RxPath == 1)
-		{
-			TxPinCfg &= 0xFFFFF3FF;
-		}
-
-		RTMP_IO_WRITE32(pAd, TX_PIN_CFG, TxPinCfg);
-	}
-	else
-	{
-	    ULONG	TxPinCfg = 0x00050F05;//Gary 2007/8/9 0x050505
-
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R62, (0x37 - GET_LNA_GAIN(pAd)));
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R63, (0x37 - GET_LNA_GAIN(pAd)));
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R64, (0x37 - GET_LNA_GAIN(pAd)));
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R86, 0);//(0x44 - GET_LNA_GAIN(pAd)));   // According the Rory's suggestion to solve the middle range issue.
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R82, 0xF2);
-
-		// Rx High power VGA offset for LNA select
-		if (pAd->NicConfig2.field.ExternalLNAForA)
-		{
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R75, 0x46);
-		}
-		else
-		{
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R75, 0x50);
-		}
-
-		// 5G band selection PIN, bit1 and bit2 are complement
-		RTMP_IO_READ32(pAd, TX_BAND_CFG, &Value);
-		Value &= (~0x6);
-		Value |= (0x02);
-		RTMP_IO_WRITE32(pAd, TX_BAND_CFG, Value);
-
-        // Turn off unused PA or LNA when only 1T or 1R
-		if (pAd->Antenna.field.TxPath == 1)
-		{
-			TxPinCfg &= 0xFFFFFFF3;
-	}
-		if (pAd->Antenna.field.RxPath == 1)
-		{
-			TxPinCfg &= 0xFFFFF3FF;
-	}
-
-		RTMP_IO_WRITE32(pAd, TX_PIN_CFG, TxPinCfg);
-	}
-
-    // R66 should be set according to Channel and use 20MHz when scanning
-	//RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R66, (0x2E + GET_LNA_GAIN(pAd)));
-	if (bScan)
-		RTMPSetAGCInitValue(pAd, BW_20);
-	else
-		RTMPSetAGCInitValue(pAd, pAd->CommonCfg.BBPCurrentBW);
-
-	//
-	// On 11A, We should delay and wait RF/BBP to be stable
-	// and the appropriate time should be 1000 micro seconds
-	// 2005/06/05 - On 11G, We also need this delay time. Otherwise it's difficult to pass the WHQL.
-	//
-	RTMPusecDelay(1000);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("SwitchChannel#%d(RF=%d, Pwr0=%lu, Pwr1=%lu, %dT) to , R1=0x%08lx, R2=0x%08lx, R3=0x%08lx, R4=0x%08lx\n",
-							  Channel,
-							  pAd->RfIcType,
-							  (R3 & 0x00003e00) >> 9,
-							  (R4 & 0x000007c0) >> 6,
-							  pAd->Antenna.field.TxPath,
-							  pAd->LatchRfRegs.R1,
-							  pAd->LatchRfRegs.R2,
-							  pAd->LatchRfRegs.R3,
-							  pAd->LatchRfRegs.R4));
-}
-
-/*
-	==========================================================================
-	Description:
-		This function is required for 2421 only, and should not be used during
-		site survey. It's only required after NIC decided to stay at a channel
-		for a longer period.
-		When this function is called, it's always after AsicSwitchChannel().
-
-	IRQL = PASSIVE_LEVEL
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-VOID AsicLockChannel(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR Channel)
-{
-}
-
-VOID AsicRfTuningExec(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3)
-{
-}
-
-/*
-	==========================================================================
-	Description:
-		Gives CCK TX rate 2 more dB TX power.
-		This routine works only in LINK UP in INFRASTRUCTURE mode.
-
-		calculate desired Tx power in RF R3.Tx0~5,	should consider -
-		0. if current radio is a noisy environment (pAd->DrsCounters.fNoisyEnvironment)
-		1. TxPowerPercentage
-		2. auto calibration based on TSSI feedback
-		3. extra 2 db for CCK
-		4. -10 db upon very-short distance (AvgRSSI >= -40db) to AP
-
-	NOTE: Since this routine requires the value of (pAd->DrsCounters.fNoisyEnvironment),
-		it should be called AFTER MlmeDynamicTxRatSwitching()
-	==========================================================================
- */
-VOID AsicAdjustTxPower(
-	IN PRTMP_ADAPTER pAd)
-{
-	INT			i, j;
-	CHAR		DeltaPwr = 0;
-	BOOLEAN		bAutoTxAgc = FALSE;
-	UCHAR		TssiRef, *pTssiMinusBoundary, *pTssiPlusBoundary, TxAgcStep;
-	UCHAR		BbpR1 = 0, BbpR49 = 0, idx;
-	PCHAR		pTxAgcCompensate;
-	ULONG		TxPwr[5];
-	CHAR		Value;
-
-#ifdef RT2860
-	if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE)
-		|| (pAd->bPCIclkOff == TRUE)
-		|| RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_IDLE_RADIO_OFF)
-		|| RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS))
-		return;
-#endif
-
-	if (pAd->CommonCfg.BBPCurrentBW == BW_40)
-	{
-		if (pAd->CommonCfg.CentralChannel > 14)
-		{
-			TxPwr[0] = pAd->Tx40MPwrCfgABand[0];
-			TxPwr[1] = pAd->Tx40MPwrCfgABand[1];
-			TxPwr[2] = pAd->Tx40MPwrCfgABand[2];
-			TxPwr[3] = pAd->Tx40MPwrCfgABand[3];
-			TxPwr[4] = pAd->Tx40MPwrCfgABand[4];
-		}
-		else
-		{
-			TxPwr[0] = pAd->Tx40MPwrCfgGBand[0];
-			TxPwr[1] = pAd->Tx40MPwrCfgGBand[1];
-			TxPwr[2] = pAd->Tx40MPwrCfgGBand[2];
-			TxPwr[3] = pAd->Tx40MPwrCfgGBand[3];
-			TxPwr[4] = pAd->Tx40MPwrCfgGBand[4];
-		}
-	}
-	else
-	{
-		if (pAd->CommonCfg.Channel > 14)
-		{
-			TxPwr[0] = pAd->Tx20MPwrCfgABand[0];
-			TxPwr[1] = pAd->Tx20MPwrCfgABand[1];
-			TxPwr[2] = pAd->Tx20MPwrCfgABand[2];
-			TxPwr[3] = pAd->Tx20MPwrCfgABand[3];
-			TxPwr[4] = pAd->Tx20MPwrCfgABand[4];
-		}
-		else
-		{
-			TxPwr[0] = pAd->Tx20MPwrCfgGBand[0];
-			TxPwr[1] = pAd->Tx20MPwrCfgGBand[1];
-			TxPwr[2] = pAd->Tx20MPwrCfgGBand[2];
-			TxPwr[3] = pAd->Tx20MPwrCfgGBand[3];
-			TxPwr[4] = pAd->Tx20MPwrCfgGBand[4];
-		}
-	}
-
-	// TX power compensation for temperature variation based on TSSI. try every 4 second
-	if (pAd->Mlme.OneSecPeriodicRound % 4 == 0)
-	{
-		if (pAd->CommonCfg.Channel <= 14)
-		{
-			/* bg channel */
-			bAutoTxAgc         = pAd->bAutoTxAgcG;
-			TssiRef            = pAd->TssiRefG;
-			pTssiMinusBoundary = &pAd->TssiMinusBoundaryG[0];
-			pTssiPlusBoundary  = &pAd->TssiPlusBoundaryG[0];
-			TxAgcStep          = pAd->TxAgcStepG;
-			pTxAgcCompensate   = &pAd->TxAgcCompensateG;
-		}
-		else
-		{
-			/* a channel */
-			bAutoTxAgc         = pAd->bAutoTxAgcA;
-			TssiRef            = pAd->TssiRefA;
-			pTssiMinusBoundary = &pAd->TssiMinusBoundaryA[0];
-			pTssiPlusBoundary  = &pAd->TssiPlusBoundaryA[0];
-			TxAgcStep          = pAd->TxAgcStepA;
-			pTxAgcCompensate   = &pAd->TxAgcCompensateA;
-		}
-
-		if (bAutoTxAgc)
-		{
-			/* BbpR1 is unsigned char */
-			RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R49, &BbpR49);
-
-			/* (p) TssiPlusBoundaryG[0] = 0 = (m) TssiMinusBoundaryG[0] */
-			/* compensate: +4     +3   +2   +1    0   -1   -2   -3   -4 * steps */
-			/* step value is defined in pAd->TxAgcStepG for tx power value */
-
-			/* [4]+1+[4]   p4     p3   p2   p1   o1   m1   m2   m3   m4 */
-			/* ex:         0x00 0x15 0x25 0x45 0x88 0xA0 0xB5 0xD0 0xF0
-			   above value are examined in mass factory production */
-			/*             [4]    [3]  [2]  [1]  [0]  [1]  [2]  [3]  [4] */
-
-			/* plus (+) is 0x00 ~ 0x45, minus (-) is 0xa0 ~ 0xf0 */
-			/* if value is between p1 ~ o1 or o1 ~ s1, no need to adjust tx power */
-			/* if value is 0xa5, tx power will be -= TxAgcStep*(2-1) */
-
-			if (BbpR49 > pTssiMinusBoundary[1])
-			{
-				// Reading is larger than the reference value
-				// check for how large we need to decrease the Tx power
-				for (idx = 1; idx < 5; idx++)
-				{
-					if (BbpR49 <= pTssiMinusBoundary[idx])  // Found the range
-						break;
-				}
-				// The index is the step we should decrease, idx = 0 means there is nothing to compensate
-				*pTxAgcCompensate = -(TxAgcStep * (idx-1));
-
-				DeltaPwr += (*pTxAgcCompensate);
-				DBGPRINT(RT_DEBUG_TRACE, ("-- Tx Power, BBP R1=%x, TssiRef=%x, TxAgcStep=%x, step = -%d\n",
-					BbpR49, TssiRef, TxAgcStep, idx-1));
-			}
-			else if (BbpR49 < pTssiPlusBoundary[1])
-			{
-				// Reading is smaller than the reference value
-				// check for how large we need to increase the Tx power
-				for (idx = 1; idx < 5; idx++)
-				{
-					if (BbpR49 >= pTssiPlusBoundary[idx])   // Found the range
-						break;
-				}
-				// The index is the step we should increase, idx = 0 means there is nothing to compensate
-				*pTxAgcCompensate = TxAgcStep * (idx-1);
-				DeltaPwr += (*pTxAgcCompensate);
-				DBGPRINT(RT_DEBUG_TRACE, ("++ Tx Power, BBP R1=%x, TssiRef=%x, TxAgcStep=%x, step = +%d\n",
-					BbpR49, TssiRef, TxAgcStep, idx-1));
-			}
-			else
-			{
-				*pTxAgcCompensate = 0;
-				DBGPRINT(RT_DEBUG_TRACE, ("   Tx Power, BBP R49=%x, TssiRef=%x, TxAgcStep=%x, step = +%d\n",
-					BbpR49, TssiRef, TxAgcStep, 0));
-			}
-		}
-	}
-	else
-	{
-		if (pAd->CommonCfg.Channel <= 14)
-		{
-			bAutoTxAgc         = pAd->bAutoTxAgcG;
-			pTxAgcCompensate   = &pAd->TxAgcCompensateG;
-		}
-		else
-		{
-			bAutoTxAgc         = pAd->bAutoTxAgcA;
-			pTxAgcCompensate   = &pAd->TxAgcCompensateA;
-		}
-
-		if (bAutoTxAgc)
-			DeltaPwr += (*pTxAgcCompensate);
-	}
-
-	RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R1, &BbpR1);
-	BbpR1 &= 0xFC;
-
-	/* calculate delta power based on the percentage specified from UI */
-	// E2PROM setting is calibrated for maximum TX power (i.e. 100%)
-	// We lower TX power here according to the percentage specified from UI
-	if (pAd->CommonCfg.TxPowerPercentage == 0xffffffff)       // AUTO TX POWER control
-		;
-	else if (pAd->CommonCfg.TxPowerPercentage > 90)  // 91 ~ 100% & AUTO, treat as 100% in terms of mW
-		;
-	else if (pAd->CommonCfg.TxPowerPercentage > 60)  // 61 ~ 90%, treat as 75% in terms of mW		// DeltaPwr -= 1;
-	{
-		DeltaPwr -= 1;
-	}
-	else if (pAd->CommonCfg.TxPowerPercentage > 30)  // 31 ~ 60%, treat as 50% in terms of mW		// DeltaPwr -= 3;
-	{
-		DeltaPwr -= 3;
-	}
-	else if (pAd->CommonCfg.TxPowerPercentage > 15)  // 16 ~ 30%, treat as 25% in terms of mW		// DeltaPwr -= 6;
-	{
-		BbpR1 |= 0x01;
-	}
-	else if (pAd->CommonCfg.TxPowerPercentage > 9)   // 10 ~ 15%, treat as 12.5% in terms of mW		// DeltaPwr -= 9;
-	{
-		BbpR1 |= 0x01;
-		DeltaPwr -= 3;
-	}
-	else                                           // 0 ~ 9 %, treat as MIN(~3%) in terms of mW		// DeltaPwr -= 12;
-	{
-		BbpR1 |= 0x02;
-	}
-
-	RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R1, BbpR1);
-
-	/* reset different new tx power for different TX rate */
-	for(i=0; i<5; i++)
-	{
-		if (TxPwr[i] != 0xffffffff)
-		{
-			for (j=0; j<8; j++)
-			{
-				Value = (CHAR)((TxPwr[i] >> j*4) & 0x0F); /* 0 ~ 15 */
-
-				if ((Value + DeltaPwr) < 0)
-				{
-					Value = 0; /* min */
-				}
-				else if ((Value + DeltaPwr) > 0xF)
-				{
-					Value = 0xF; /* max */
-				}
-				else
-				{
-					Value += DeltaPwr; /* temperature compensation */
-				}
-
-				/* fill new value to CSR offset */
-				TxPwr[i] = (TxPwr[i] & ~(0x0000000F << j*4)) | (Value << j*4);
-			}
-
-			/* write tx power value to CSR */
-			/* TX_PWR_CFG_0 (8 tx rate) for	TX power for OFDM 12M/18M
-											TX power for OFDM 6M/9M
-											TX power for CCK5.5M/11M
-											TX power for CCK1M/2M */
-			/* TX_PWR_CFG_1 ~ TX_PWR_CFG_4 */
-			RTMP_IO_WRITE32(pAd, TX_PWR_CFG_0 + i*4, TxPwr[i]);
-		}
-	}
-
-}
-
-/*
-	==========================================================================
-	Description:
-		put PHY to sleep here, and set next wakeup timer. PHY doesn't not wakeup
-		automatically. Instead, MCU will issue a TwakeUpInterrupt to host after
-		the wakeup timer timeout. Driver has to issue a separate command to wake
-		PHY up.
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-VOID AsicSleepThenAutoWakeup(
-	IN PRTMP_ADAPTER pAd,
-	IN USHORT TbttNumToNextWakeUp)
-{
-    RT28XX_STA_SLEEP_THEN_AUTO_WAKEUP(pAd, TbttNumToNextWakeUp);
-}
-
-/*
-	==========================================================================
-	Description:
-		AsicForceWakeup() is used whenever manual wakeup is required
-		AsicForceSleep() should only be used when not in INFRA BSS. When
-		in INFRA BSS, we should use AsicSleepThenAutoWakeup() instead.
-	==========================================================================
- */
-VOID AsicForceSleep(
-	IN PRTMP_ADAPTER pAd)
-{
-
-}
-
-/*
-	==========================================================================
-	Description:
-		AsicForceWakeup() is used whenever Twakeup timer (set via AsicSleepThenAutoWakeup)
-		expired.
-
-	IRQL = PASSIVE_LEVEL
-	IRQL = DISPATCH_LEVEL
-	==========================================================================
- */
-VOID AsicForceWakeup(
-	IN PRTMP_ADAPTER pAd,
-#ifdef RT2860
-	IN UCHAR    	 Level)
-#endif
-#ifdef RT2870
-	IN BOOLEAN    bFromTx)
-#endif
-{
-    DBGPRINT(RT_DEBUG_TRACE, ("--> AsicForceWakeup \n"));
-#ifdef RT2860
-    RT28XX_STA_FORCE_WAKEUP(pAd, Level);
-#endif
-#ifdef RT2870
-    RT28XX_STA_FORCE_WAKEUP(pAd, bFromTx);
-#endif
-}
-
-/*
-	==========================================================================
-	Description:
-		Set My BSSID
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-VOID AsicSetBssid(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR pBssid)
-{
-	ULONG		  Addr4;
-	DBGPRINT(RT_DEBUG_TRACE, ("==============> AsicSetBssid %x:%x:%x:%x:%x:%x\n",
-		pBssid[0],pBssid[1],pBssid[2],pBssid[3], pBssid[4],pBssid[5]));
-
-	Addr4 = (ULONG)(pBssid[0])		 |
-			(ULONG)(pBssid[1] << 8)  |
-			(ULONG)(pBssid[2] << 16) |
-			(ULONG)(pBssid[3] << 24);
-	RTMP_IO_WRITE32(pAd, MAC_BSSID_DW0, Addr4);
-
-	Addr4 = 0;
-	// always one BSSID in STA mode
-	Addr4 = (ULONG)(pBssid[4]) | (ULONG)(pBssid[5] << 8);
-
-	RTMP_IO_WRITE32(pAd, MAC_BSSID_DW1, Addr4);
-}
-
-VOID AsicSetMcastWC(
-	IN PRTMP_ADAPTER pAd)
-{
-	MAC_TABLE_ENTRY *pEntry = &pAd->MacTab.Content[MCAST_WCID];
-	USHORT		offset;
-
-	pEntry->Sst        = SST_ASSOC;
-	pEntry->Aid        = MCAST_WCID;	// Softap supports 1 BSSID and use WCID=0 as multicast Wcid index
-	pEntry->PsMode     = PWR_ACTIVE;
-	pEntry->CurrTxRate = pAd->CommonCfg.MlmeRate;
-	offset = MAC_WCID_BASE + BSS0Mcast_WCID * HW_WCID_ENTRY_SIZE;
-}
-
-/*
-	==========================================================================
-	Description:
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-VOID AsicDelWcidTab(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR	Wcid)
-{
-	ULONG		  Addr0 = 0x0, Addr1 = 0x0;
-	ULONG 		offset;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("AsicDelWcidTab==>Wcid = 0x%x\n",Wcid));
-	offset = MAC_WCID_BASE + Wcid * HW_WCID_ENTRY_SIZE;
-	RTMP_IO_WRITE32(pAd, offset, Addr0);
-	offset += 4;
-	RTMP_IO_WRITE32(pAd, offset, Addr1);
-}
-
-/*
-	==========================================================================
-	Description:
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-VOID AsicEnableRDG(
-	IN PRTMP_ADAPTER pAd)
-{
-	TX_LINK_CFG_STRUC	TxLinkCfg;
-	UINT32				Data = 0;
-
-	RTMP_IO_READ32(pAd, TX_LINK_CFG, &TxLinkCfg.word);
-	TxLinkCfg.field.TxRDGEn = 1;
-	RTMP_IO_WRITE32(pAd, TX_LINK_CFG, TxLinkCfg.word);
-
-	RTMP_IO_READ32(pAd, EDCA_AC0_CFG, &Data);
-	Data  &= 0xFFFFFF00;
-	Data  |= 0x80;
-	RTMP_IO_WRITE32(pAd, EDCA_AC0_CFG, Data);
-
-	//OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_AGGREGATION_INUSED);
-}
-
-/*
-	==========================================================================
-	Description:
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-VOID AsicDisableRDG(
-	IN PRTMP_ADAPTER pAd)
-{
-	TX_LINK_CFG_STRUC	TxLinkCfg;
-	UINT32				Data = 0;
-
-
-	RTMP_IO_READ32(pAd, TX_LINK_CFG, &TxLinkCfg.word);
-	TxLinkCfg.field.TxRDGEn = 0;
-	RTMP_IO_WRITE32(pAd, TX_LINK_CFG, TxLinkCfg.word);
-
-	RTMP_IO_READ32(pAd, EDCA_AC0_CFG, &Data);
-
-	Data  &= 0xFFFFFF00;
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_DYNAMIC_BE_TXOP_ACTIVE)
-		&& (pAd->MacTab.fAnyStationMIMOPSDynamic == FALSE)
-	)
-	{
-		// For CWC test, change txop from 0x30 to 0x20 in TxBurst mode
-		if (pAd->CommonCfg.bEnableTxBurst)
-			Data |= 0x20;
-	}
-	RTMP_IO_WRITE32(pAd, EDCA_AC0_CFG, Data);
-}
-
-/*
-	==========================================================================
-	Description:
-
-	IRQL = PASSIVE_LEVEL
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-VOID AsicDisableSync(
-	IN PRTMP_ADAPTER pAd)
-{
-	BCN_TIME_CFG_STRUC csr;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("--->Disable TSF synchronization\n"));
-
-	// 2003-12-20 disable TSF and TBTT while NIC in power-saving have side effect
-	//			  that NIC will never wakes up because TSF stops and no more
-	//			  TBTT interrupts
-	pAd->TbttTickCount = 0;
-	RTMP_IO_READ32(pAd, BCN_TIME_CFG, &csr.word);
-	csr.field.bBeaconGen = 0;
-	csr.field.bTBTTEnable = 0;
-	csr.field.TsfSyncMode = 0;
-	csr.field.bTsfTicking = 0;
-	RTMP_IO_WRITE32(pAd, BCN_TIME_CFG, csr.word);
-
-}
-
-/*
-	==========================================================================
-	Description:
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-VOID AsicEnableBssSync(
-	IN PRTMP_ADAPTER pAd)
-{
-	BCN_TIME_CFG_STRUC csr;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("--->AsicEnableBssSync(INFRA mode)\n"));
-
-	RTMP_IO_READ32(pAd, BCN_TIME_CFG, &csr.word);
-
-	{
-		csr.field.BeaconInterval = pAd->CommonCfg.BeaconPeriod << 4; // ASIC register in units of 1/16 TU
-		csr.field.bTsfTicking = 1;
-		csr.field.TsfSyncMode = 1; // sync TSF in INFRASTRUCTURE mode
-		csr.field.bBeaconGen  = 0; // do NOT generate BEACON
-		csr.field.bTBTTEnable = 1;
-	}
-
-	RTMP_IO_WRITE32(pAd, BCN_TIME_CFG, csr.word);
-}
-
-/*
-	==========================================================================
-	Description:
-	Note:
-		BEACON frame in shared memory should be built ok before this routine
-		can be called. Otherwise, a garbage frame maybe transmitted out every
-		Beacon period.
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-VOID AsicEnableIbssSync(
-	IN PRTMP_ADAPTER pAd)
-{
-	BCN_TIME_CFG_STRUC csr9;
-	PUCHAR			ptr;
-	UINT i;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("--->AsicEnableIbssSync(ADHOC mode. MPDUtotalByteCount = %d)\n", pAd->BeaconTxWI.MPDUtotalByteCount));
-
-	RTMP_IO_READ32(pAd, BCN_TIME_CFG, &csr9.word);
-	csr9.field.bBeaconGen = 0;
-	csr9.field.bTBTTEnable = 0;
-	csr9.field.bTsfTicking = 0;
-	RTMP_IO_WRITE32(pAd, BCN_TIME_CFG, csr9.word);
-
-#ifdef RT2860
-	// move BEACON TXD and frame content to on-chip memory
-	ptr = (PUCHAR)&pAd->BeaconTxWI;
-	for (i=0; i<TXWI_SIZE; i+=4)  // 16-byte TXWI field
-	{
-		UINT32 longptr =  *ptr + (*(ptr+1)<<8) + (*(ptr+2)<<16) + (*(ptr+3)<<24);
-		RTMP_IO_WRITE32(pAd, HW_BEACON_BASE0 + i, longptr);
-		ptr += 4;
-	}
-
-	// start right after the 16-byte TXWI field
-	ptr = pAd->BeaconBuf;
-	for (i=0; i< pAd->BeaconTxWI.MPDUtotalByteCount; i+=4)
-	{
-		UINT32 longptr =  *ptr + (*(ptr+1)<<8) + (*(ptr+2)<<16) + (*(ptr+3)<<24);
-		RTMP_IO_WRITE32(pAd, HW_BEACON_BASE0 + TXWI_SIZE + i, longptr);
-		ptr +=4;
-	}
-#endif
-#ifdef RT2870
-	// move BEACON TXD and frame content to on-chip memory
-	ptr = (PUCHAR)&pAd->BeaconTxWI;
-	for (i=0; i<TXWI_SIZE; i+=2)  // 16-byte TXWI field
-	{
-		RTUSBMultiWrite(pAd, HW_BEACON_BASE0 + i, ptr, 2);
-		ptr += 2;
-	}
-
-	// start right after the 16-byte TXWI field
-	ptr = pAd->BeaconBuf;
-	for (i=0; i< pAd->BeaconTxWI.MPDUtotalByteCount; i+=2)
-	{
-		RTUSBMultiWrite(pAd, HW_BEACON_BASE0 + TXWI_SIZE + i, ptr, 2);
-		ptr +=2;
-	}
-#endif // RT2870 //
-
-	// start sending BEACON
-	csr9.field.BeaconInterval = pAd->CommonCfg.BeaconPeriod << 4; // ASIC register in units of 1/16 TU
-	csr9.field.bTsfTicking = 1;
-	csr9.field.TsfSyncMode = 2; // sync TSF in IBSS mode
-	csr9.field.bTBTTEnable = 1;
-	csr9.field.bBeaconGen = 1;
-	RTMP_IO_WRITE32(pAd, BCN_TIME_CFG, csr9.word);
-}
-
-/*
-	==========================================================================
-	Description:
-
-	IRQL = PASSIVE_LEVEL
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-VOID AsicSetEdcaParm(
-	IN PRTMP_ADAPTER pAd,
-	IN PEDCA_PARM	 pEdcaParm)
-{
-	EDCA_AC_CFG_STRUC   Ac0Cfg, Ac1Cfg, Ac2Cfg, Ac3Cfg;
-	AC_TXOP_CSR0_STRUC csr0;
-	AC_TXOP_CSR1_STRUC csr1;
-	AIFSN_CSR_STRUC    AifsnCsr;
-	CWMIN_CSR_STRUC    CwminCsr;
-	CWMAX_CSR_STRUC    CwmaxCsr;
-	int i;
-
-	Ac0Cfg.word = 0;
-	Ac1Cfg.word = 0;
-	Ac2Cfg.word = 0;
-	Ac3Cfg.word = 0;
-	if ((pEdcaParm == NULL) || (pEdcaParm->bValid == FALSE))
-	{
-		DBGPRINT(RT_DEBUG_TRACE,("AsicSetEdcaParm\n"));
-		OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_WMM_INUSED);
-		for (i=0; i<MAX_LEN_OF_MAC_TABLE; i++)
-		{
-			if (pAd->MacTab.Content[i].ValidAsCLI || pAd->MacTab.Content[i].ValidAsApCli)
-				CLIENT_STATUS_CLEAR_FLAG(&pAd->MacTab.Content[i], fCLIENT_STATUS_WMM_CAPABLE);
-		}
-
-		//========================================================
-		//      MAC Register has a copy .
-		//========================================================
-		if( pAd->CommonCfg.bEnableTxBurst )
-		{
-			// For CWC test, change txop from 0x30 to 0x20 in TxBurst mode
-			Ac0Cfg.field.AcTxop = 0x20; // Suggest by John for TxBurst in HT Mode
-		}
-		else
-			Ac0Cfg.field.AcTxop = 0;	// QID_AC_BE
-		Ac0Cfg.field.Cwmin = CW_MIN_IN_BITS;
-		Ac0Cfg.field.Cwmax = CW_MAX_IN_BITS;
-		Ac0Cfg.field.Aifsn = 2;
-		RTMP_IO_WRITE32(pAd, EDCA_AC0_CFG, Ac0Cfg.word);
-
-		Ac1Cfg.field.AcTxop = 0;	// QID_AC_BK
-		Ac1Cfg.field.Cwmin = CW_MIN_IN_BITS;
-		Ac1Cfg.field.Cwmax = CW_MAX_IN_BITS;
-		Ac1Cfg.field.Aifsn = 2;
-		RTMP_IO_WRITE32(pAd, EDCA_AC1_CFG, Ac1Cfg.word);
-
-		if (pAd->CommonCfg.PhyMode == PHY_11B)
-		{
-			Ac2Cfg.field.AcTxop = 192;	// AC_VI: 192*32us ~= 6ms
-			Ac3Cfg.field.AcTxop = 96;	// AC_VO: 96*32us  ~= 3ms
-		}
-		else
-		{
-			Ac2Cfg.field.AcTxop = 96;	// AC_VI: 96*32us ~= 3ms
-			Ac3Cfg.field.AcTxop = 48;	// AC_VO: 48*32us ~= 1.5ms
-		}
-		Ac2Cfg.field.Cwmin = CW_MIN_IN_BITS;
-		Ac2Cfg.field.Cwmax = CW_MAX_IN_BITS;
-		Ac2Cfg.field.Aifsn = 2;
-		RTMP_IO_WRITE32(pAd, EDCA_AC2_CFG, Ac2Cfg.word);
-		Ac3Cfg.field.Cwmin = CW_MIN_IN_BITS;
-		Ac3Cfg.field.Cwmax = CW_MAX_IN_BITS;
-		Ac3Cfg.field.Aifsn = 2;
-		RTMP_IO_WRITE32(pAd, EDCA_AC3_CFG, Ac3Cfg.word);
-
-		//========================================================
-		//      DMA Register has a copy too.
-		//========================================================
-		csr0.field.Ac0Txop = 0;		// QID_AC_BE
-		csr0.field.Ac1Txop = 0;		// QID_AC_BK
-		RTMP_IO_WRITE32(pAd, WMM_TXOP0_CFG, csr0.word);
-		if (pAd->CommonCfg.PhyMode == PHY_11B)
-		{
-			csr1.field.Ac2Txop = 192;		// AC_VI: 192*32us ~= 6ms
-			csr1.field.Ac3Txop = 96;		// AC_VO: 96*32us  ~= 3ms
-		}
-		else
-		{
-			csr1.field.Ac2Txop = 96;		// AC_VI: 96*32us ~= 3ms
-			csr1.field.Ac3Txop = 48;		// AC_VO: 48*32us ~= 1.5ms
-		}
-		RTMP_IO_WRITE32(pAd, WMM_TXOP1_CFG, csr1.word);
-
-		CwminCsr.word = 0;
-		CwminCsr.field.Cwmin0 = CW_MIN_IN_BITS;
-		CwminCsr.field.Cwmin1 = CW_MIN_IN_BITS;
-		CwminCsr.field.Cwmin2 = CW_MIN_IN_BITS;
-		CwminCsr.field.Cwmin3 = CW_MIN_IN_BITS;
-		RTMP_IO_WRITE32(pAd, WMM_CWMIN_CFG, CwminCsr.word);
-
-		CwmaxCsr.word = 0;
-		CwmaxCsr.field.Cwmax0 = CW_MAX_IN_BITS;
-		CwmaxCsr.field.Cwmax1 = CW_MAX_IN_BITS;
-		CwmaxCsr.field.Cwmax2 = CW_MAX_IN_BITS;
-		CwmaxCsr.field.Cwmax3 = CW_MAX_IN_BITS;
-		RTMP_IO_WRITE32(pAd, WMM_CWMAX_CFG, CwmaxCsr.word);
-
-		RTMP_IO_WRITE32(pAd, WMM_AIFSN_CFG, 0x00002222);
-
-		NdisZeroMemory(&pAd->CommonCfg.APEdcaParm, sizeof(EDCA_PARM));
-	}
-	else
-	{
-		OPSTATUS_SET_FLAG(pAd, fOP_STATUS_WMM_INUSED);
-		//========================================================
-		//      MAC Register has a copy.
-		//========================================================
-		//
-		// Modify Cwmin/Cwmax/Txop on queue[QID_AC_VI], Recommend by Jerry 2005/07/27
-		// To degrade our VIDO Queue's throughput for WiFi WMM S3T07 Issue.
-		//
-		//pEdcaParm->Txop[QID_AC_VI] = pEdcaParm->Txop[QID_AC_VI] * 7 / 10; // rt2860c need this
-
-		Ac0Cfg.field.AcTxop =  pEdcaParm->Txop[QID_AC_BE];
-		Ac0Cfg.field.Cwmin= pEdcaParm->Cwmin[QID_AC_BE];
-		Ac0Cfg.field.Cwmax = pEdcaParm->Cwmax[QID_AC_BE];
-		Ac0Cfg.field.Aifsn = pEdcaParm->Aifsn[QID_AC_BE]; //+1;
-
-		Ac1Cfg.field.AcTxop =  pEdcaParm->Txop[QID_AC_BK];
-		Ac1Cfg.field.Cwmin = pEdcaParm->Cwmin[QID_AC_BK]; //+2;
-		Ac1Cfg.field.Cwmax = pEdcaParm->Cwmax[QID_AC_BK];
-		Ac1Cfg.field.Aifsn = pEdcaParm->Aifsn[QID_AC_BK]; //+1;
-
-		Ac2Cfg.field.AcTxop = (pEdcaParm->Txop[QID_AC_VI] * 6) / 10;
-		Ac2Cfg.field.Cwmin = pEdcaParm->Cwmin[QID_AC_VI];
-		Ac2Cfg.field.Cwmax = pEdcaParm->Cwmax[QID_AC_VI];
-		Ac2Cfg.field.Aifsn = pEdcaParm->Aifsn[QID_AC_VI];
-
-		{
-			// Tuning for Wi-Fi WMM S06
-			if (pAd->CommonCfg.bWiFiTest &&
-				pEdcaParm->Aifsn[QID_AC_VI] == 10)
-				Ac2Cfg.field.Aifsn -= 1;
-
-			// Tuning for TGn Wi-Fi 5.2.32
-			// STA TestBed changes in this item: connexant legacy sta ==> broadcom 11n sta
-			if (STA_TGN_WIFI_ON(pAd) &&
-				pEdcaParm->Aifsn[QID_AC_VI] == 10)
-			{
-				Ac0Cfg.field.Aifsn = 3;
-				Ac2Cfg.field.AcTxop = 5;
-			}
-
-#ifdef RT2870
-			if (pAd->RfIcType == RFIC_3020 || pAd->RfIcType == RFIC_2020)
-			{
-				// Tuning for WiFi WMM S3-T07: connexant legacy sta ==> broadcom 11n sta.
-				Ac2Cfg.field.Aifsn = 5;
-			}
-#endif
-		}
-
-		Ac3Cfg.field.AcTxop = pEdcaParm->Txop[QID_AC_VO];
-		Ac3Cfg.field.Cwmin = pEdcaParm->Cwmin[QID_AC_VO];
-		Ac3Cfg.field.Cwmax = pEdcaParm->Cwmax[QID_AC_VO];
-		Ac3Cfg.field.Aifsn = pEdcaParm->Aifsn[QID_AC_VO];
-
-//#ifdef WIFI_TEST
-		if (pAd->CommonCfg.bWiFiTest)
-		{
-			if (Ac3Cfg.field.AcTxop == 102)
-			{
-			Ac0Cfg.field.AcTxop = pEdcaParm->Txop[QID_AC_BE] ? pEdcaParm->Txop[QID_AC_BE] : 10;
-				Ac0Cfg.field.Aifsn  = pEdcaParm->Aifsn[QID_AC_BE]-1; /* AIFSN must >= 1 */
-			Ac1Cfg.field.AcTxop = pEdcaParm->Txop[QID_AC_BK];
-				Ac1Cfg.field.Aifsn  = pEdcaParm->Aifsn[QID_AC_BK];
-			Ac2Cfg.field.AcTxop = pEdcaParm->Txop[QID_AC_VI];
-			} /* End of if */
-		}
-//#endif // WIFI_TEST //
-
-		RTMP_IO_WRITE32(pAd, EDCA_AC0_CFG, Ac0Cfg.word);
-		RTMP_IO_WRITE32(pAd, EDCA_AC1_CFG, Ac1Cfg.word);
-		RTMP_IO_WRITE32(pAd, EDCA_AC2_CFG, Ac2Cfg.word);
-		RTMP_IO_WRITE32(pAd, EDCA_AC3_CFG, Ac3Cfg.word);
-
-
-		//========================================================
-		//      DMA Register has a copy too.
-		//========================================================
-		csr0.field.Ac0Txop = Ac0Cfg.field.AcTxop;
-		csr0.field.Ac1Txop = Ac1Cfg.field.AcTxop;
-		RTMP_IO_WRITE32(pAd, WMM_TXOP0_CFG, csr0.word);
-
-		csr1.field.Ac2Txop = Ac2Cfg.field.AcTxop;
-		csr1.field.Ac3Txop = Ac3Cfg.field.AcTxop;
-		RTMP_IO_WRITE32(pAd, WMM_TXOP1_CFG, csr1.word);
-
-		CwminCsr.word = 0;
-		CwminCsr.field.Cwmin0 = pEdcaParm->Cwmin[QID_AC_BE];
-		CwminCsr.field.Cwmin1 = pEdcaParm->Cwmin[QID_AC_BK];
-		CwminCsr.field.Cwmin2 = pEdcaParm->Cwmin[QID_AC_VI];
-
-		CwminCsr.field.Cwmin3 = pEdcaParm->Cwmin[QID_AC_VO] - 1; //for TGn wifi test
-
-		RTMP_IO_WRITE32(pAd, WMM_CWMIN_CFG, CwminCsr.word);
-
-		CwmaxCsr.word = 0;
-		CwmaxCsr.field.Cwmax0 = pEdcaParm->Cwmax[QID_AC_BE];
-		CwmaxCsr.field.Cwmax1 = pEdcaParm->Cwmax[QID_AC_BK];
-		CwmaxCsr.field.Cwmax2 = pEdcaParm->Cwmax[QID_AC_VI];
-		CwmaxCsr.field.Cwmax3 = pEdcaParm->Cwmax[QID_AC_VO];
-		RTMP_IO_WRITE32(pAd, WMM_CWMAX_CFG, CwmaxCsr.word);
-
-		AifsnCsr.word = 0;
-		AifsnCsr.field.Aifsn0 = Ac0Cfg.field.Aifsn; //pEdcaParm->Aifsn[QID_AC_BE];
-		AifsnCsr.field.Aifsn1 = Ac1Cfg.field.Aifsn; //pEdcaParm->Aifsn[QID_AC_BK];
-		AifsnCsr.field.Aifsn2 = Ac2Cfg.field.Aifsn; //pEdcaParm->Aifsn[QID_AC_VI];
-
-		{
-			// Tuning for Wi-Fi WMM S06
-			if (pAd->CommonCfg.bWiFiTest &&
-				pEdcaParm->Aifsn[QID_AC_VI] == 10)
-				AifsnCsr.field.Aifsn2 = Ac2Cfg.field.Aifsn - 4;
-
-			// Tuning for TGn Wi-Fi 5.2.32
-			// STA TestBed changes in this item: connexant legacy sta ==> broadcom 11n sta
-			if (STA_TGN_WIFI_ON(pAd) &&
-				pEdcaParm->Aifsn[QID_AC_VI] == 10)
-			{
-				AifsnCsr.field.Aifsn0 = 3;
-				AifsnCsr.field.Aifsn2 = 7;
-			}
-#ifdef RT2870
-			if (INFRA_ON(pAd))
-				CLIENT_STATUS_SET_FLAG(&pAd->MacTab.Content[BSSID_WCID], fCLIENT_STATUS_WMM_CAPABLE);
-#endif
-		}
-
-		AifsnCsr.field.Aifsn3 = Ac3Cfg.field.Aifsn - 1; //pEdcaParm->Aifsn[QID_AC_VO]; //for TGn wifi test
-#ifdef RT2870
-		if (pAd->RfIcType == RFIC_3020 || pAd->RfIcType == RFIC_2020)
-			AifsnCsr.field.Aifsn2 = 0x2; //pEdcaParm->Aifsn[QID_AC_VI]; //for WiFi WMM S4-T04.
-#endif
-		RTMP_IO_WRITE32(pAd, WMM_AIFSN_CFG, AifsnCsr.word);
-
-		NdisMoveMemory(&pAd->CommonCfg.APEdcaParm, pEdcaParm, sizeof(EDCA_PARM));
-		if (!ADHOC_ON(pAd))
-		{
-			DBGPRINT(RT_DEBUG_TRACE,("EDCA [#%d]: AIFSN CWmin CWmax  TXOP(us)  ACM\n", pEdcaParm->EdcaUpdateCount));
-			DBGPRINT(RT_DEBUG_TRACE,("     AC_BE      %2d     %2d     %2d      %4d     %d\n",
-									 pEdcaParm->Aifsn[0],
-									 pEdcaParm->Cwmin[0],
-									 pEdcaParm->Cwmax[0],
-									 pEdcaParm->Txop[0]<<5,
-									 pEdcaParm->bACM[0]));
-			DBGPRINT(RT_DEBUG_TRACE,("     AC_BK      %2d     %2d     %2d      %4d     %d\n",
-									 pEdcaParm->Aifsn[1],
-									 pEdcaParm->Cwmin[1],
-									 pEdcaParm->Cwmax[1],
-									 pEdcaParm->Txop[1]<<5,
-									 pEdcaParm->bACM[1]));
-			DBGPRINT(RT_DEBUG_TRACE,("     AC_VI      %2d     %2d     %2d      %4d     %d\n",
-									 pEdcaParm->Aifsn[2],
-									 pEdcaParm->Cwmin[2],
-									 pEdcaParm->Cwmax[2],
-									 pEdcaParm->Txop[2]<<5,
-									 pEdcaParm->bACM[2]));
-			DBGPRINT(RT_DEBUG_TRACE,("     AC_VO      %2d     %2d     %2d      %4d     %d\n",
-									 pEdcaParm->Aifsn[3],
-									 pEdcaParm->Cwmin[3],
-									 pEdcaParm->Cwmax[3],
-									 pEdcaParm->Txop[3]<<5,
-									 pEdcaParm->bACM[3]));
-		}
-	}
-}
-
-/*
-	==========================================================================
-	Description:
-
-	IRQL = PASSIVE_LEVEL
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-VOID 	AsicSetSlotTime(
-	IN PRTMP_ADAPTER pAd,
-	IN BOOLEAN bUseShortSlotTime)
-{
-	ULONG	SlotTime;
-	UINT32	RegValue = 0;
-
-	if (pAd->CommonCfg.Channel > 14)
-		bUseShortSlotTime = TRUE;
-
-	if (bUseShortSlotTime)
-		OPSTATUS_SET_FLAG(pAd, fOP_STATUS_SHORT_SLOT_INUSED);
-	else
-		OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_SHORT_SLOT_INUSED);
-
-	SlotTime = (bUseShortSlotTime)? 9 : 20;
-
-	{
-		// force using short SLOT time for FAE to demo performance when TxBurst is ON
-		if (((pAd->StaActive.SupportedPhyInfo.bHtEnable == FALSE) && (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_WMM_INUSED)))
-			|| ((pAd->StaActive.SupportedPhyInfo.bHtEnable == TRUE) && (pAd->CommonCfg.BACapability.field.Policy == BA_NOTUSE))
-			)
-		{
-			// In this case, we will think it is doing Wi-Fi test
-			// And we will not set to short slot when bEnableTxBurst is TRUE.
-		}
-		else if (pAd->CommonCfg.bEnableTxBurst)
-			SlotTime = 9;
-	}
-
-	//
-	// For some reasons, always set it to short slot time.
-	//
-	// ToDo: Should consider capability with 11B
-	//
-	if (pAd->StaCfg.BssType == BSS_ADHOC)
-		SlotTime = 20;
-
-	RTMP_IO_READ32(pAd, BKOFF_SLOT_CFG, &RegValue);
-	RegValue = RegValue & 0xFFFFFF00;
-
-	RegValue |= SlotTime;
-
-	RTMP_IO_WRITE32(pAd, BKOFF_SLOT_CFG, RegValue);
-}
-
-/*
-	========================================================================
-	Description:
-		Add Shared key information into ASIC.
-		Update shared key, TxMic and RxMic to Asic Shared key table
-		Update its cipherAlg to Asic Shared key Mode.
-
-    Return:
-	========================================================================
-*/
-VOID AsicAddSharedKeyEntry(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR		 BssIndex,
-	IN UCHAR		 KeyIdx,
-	IN UCHAR		 CipherAlg,
-	IN PUCHAR		 pKey,
-	IN PUCHAR		 pTxMic,
-	IN PUCHAR		 pRxMic)
-{
-	ULONG offset; //, csr0;
-	SHAREDKEY_MODE_STRUC csr1;
-#ifdef RT2860
-	INT   i;
-#endif
-
-	DBGPRINT(RT_DEBUG_TRACE, ("AsicAddSharedKeyEntry BssIndex=%d, KeyIdx=%d\n", BssIndex,KeyIdx));
-//============================================================================================
-
-	DBGPRINT(RT_DEBUG_TRACE,("AsicAddSharedKeyEntry: %s key #%d\n", CipherName[CipherAlg], BssIndex*4 + KeyIdx));
-	DBGPRINT_RAW(RT_DEBUG_TRACE, (" 	Key = %02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x\n",
-		pKey[0],pKey[1],pKey[2],pKey[3],pKey[4],pKey[5],pKey[6],pKey[7],pKey[8],pKey[9],pKey[10],pKey[11],pKey[12],pKey[13],pKey[14],pKey[15]));
-	if (pRxMic)
-	{
-		DBGPRINT_RAW(RT_DEBUG_TRACE, (" 	Rx MIC Key = %02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x\n",
-			pRxMic[0],pRxMic[1],pRxMic[2],pRxMic[3],pRxMic[4],pRxMic[5],pRxMic[6],pRxMic[7]));
-	}
-	if (pTxMic)
-	{
-		DBGPRINT_RAW(RT_DEBUG_TRACE, (" 	Tx MIC Key = %02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x\n",
-			pTxMic[0],pTxMic[1],pTxMic[2],pTxMic[3],pTxMic[4],pTxMic[5],pTxMic[6],pTxMic[7]));
-	}
-//============================================================================================
-	//
-	// fill key material - key + TX MIC + RX MIC
-	//
-
-	offset = SHARED_KEY_TABLE_BASE + (4*BssIndex + KeyIdx)*HW_KEY_ENTRY_SIZE;
-#ifdef RT2860
-	for (i=0; i<MAX_LEN_OF_SHARE_KEY; i++)
-	{
-		RTMP_IO_WRITE8(pAd, offset + i, pKey[i]);
-	}
-#endif
-#ifdef RT2870
-	RTUSBMultiWrite(pAd, offset, pKey, MAX_LEN_OF_SHARE_KEY);
-#endif
-	offset += MAX_LEN_OF_SHARE_KEY;
-	if (pTxMic)
-	{
-#ifdef RT2860
-		for (i=0; i<8; i++)
-		{
-			RTMP_IO_WRITE8(pAd, offset + i, pTxMic[i]);
-		}
-#endif
-#ifdef RT2870
-		RTUSBMultiWrite(pAd, offset, pTxMic, 8);
-#endif
-	}
-
-	offset += 8;
-	if (pRxMic)
-	{
-#ifdef RT2860
-		for (i=0; i<8; i++)
-		{
-			RTMP_IO_WRITE8(pAd, offset + i, pRxMic[i]);
-		}
-#endif
-#ifdef RT2870
-		RTUSBMultiWrite(pAd, offset, pRxMic, 8);
-#endif
-	}
-
-
-	//
-	// Update cipher algorithm. WSTA always use BSS0
-	//
-	RTMP_IO_READ32(pAd, SHARED_KEY_MODE_BASE+4*(BssIndex/2), &csr1.word);
-	DBGPRINT(RT_DEBUG_TRACE,("Read: SHARED_KEY_MODE_BASE at this Bss[%d] KeyIdx[%d]= 0x%x \n", BssIndex,KeyIdx, csr1.word));
-	if ((BssIndex%2) == 0)
-	{
-		if (KeyIdx == 0)
-			csr1.field.Bss0Key0CipherAlg = CipherAlg;
-		else if (KeyIdx == 1)
-			csr1.field.Bss0Key1CipherAlg = CipherAlg;
-		else if (KeyIdx == 2)
-			csr1.field.Bss0Key2CipherAlg = CipherAlg;
-		else
-			csr1.field.Bss0Key3CipherAlg = CipherAlg;
-	}
-	else
-	{
-		if (KeyIdx == 0)
-			csr1.field.Bss1Key0CipherAlg = CipherAlg;
-		else if (KeyIdx == 1)
-			csr1.field.Bss1Key1CipherAlg = CipherAlg;
-		else if (KeyIdx == 2)
-			csr1.field.Bss1Key2CipherAlg = CipherAlg;
-		else
-			csr1.field.Bss1Key3CipherAlg = CipherAlg;
-	}
-	DBGPRINT(RT_DEBUG_TRACE,("Write: SHARED_KEY_MODE_BASE at this Bss[%d] = 0x%x \n", BssIndex, csr1.word));
-	RTMP_IO_WRITE32(pAd, SHARED_KEY_MODE_BASE+4*(BssIndex/2), csr1.word);
-
-}
-
-//	IRQL = DISPATCH_LEVEL
-VOID AsicRemoveSharedKeyEntry(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR		 BssIndex,
-	IN UCHAR		 KeyIdx)
-{
-	//ULONG SecCsr0;
-	SHAREDKEY_MODE_STRUC csr1;
-
-	DBGPRINT(RT_DEBUG_TRACE,("AsicRemoveSharedKeyEntry: #%d \n", BssIndex*4 + KeyIdx));
-
-	RTMP_IO_READ32(pAd, SHARED_KEY_MODE_BASE+4*(BssIndex/2), &csr1.word);
-	if ((BssIndex%2) == 0)
-	{
-		if (KeyIdx == 0)
-			csr1.field.Bss0Key0CipherAlg = 0;
-		else if (KeyIdx == 1)
-			csr1.field.Bss0Key1CipherAlg = 0;
-		else if (KeyIdx == 2)
-			csr1.field.Bss0Key2CipherAlg = 0;
-		else
-			csr1.field.Bss0Key3CipherAlg = 0;
-	}
-	else
-	{
-		if (KeyIdx == 0)
-			csr1.field.Bss1Key0CipherAlg = 0;
-		else if (KeyIdx == 1)
-			csr1.field.Bss1Key1CipherAlg = 0;
-		else if (KeyIdx == 2)
-			csr1.field.Bss1Key2CipherAlg = 0;
-		else
-			csr1.field.Bss1Key3CipherAlg = 0;
-	}
-	DBGPRINT(RT_DEBUG_TRACE,("Write: SHARED_KEY_MODE_BASE at this Bss[%d] = 0x%x \n", BssIndex, csr1.word));
-	RTMP_IO_WRITE32(pAd, SHARED_KEY_MODE_BASE+4*(BssIndex/2), csr1.word);
-	ASSERT(BssIndex < 4);
-	ASSERT(KeyIdx < 4);
-
-}
-
-
-VOID AsicUpdateWCIDAttribute(
-	IN PRTMP_ADAPTER pAd,
-	IN USHORT		WCID,
-	IN UCHAR		BssIndex,
-	IN UCHAR        CipherAlg,
-	IN BOOLEAN		bUsePairewiseKeyTable)
-{
-	ULONG   WCIDAttri = 0, offset;
-
-	//
-	// Update WCID attribute.
-	// Only TxKey could update WCID attribute.
-	//
-	offset = MAC_WCID_ATTRIBUTE_BASE + (WCID * HW_WCID_ATTRI_SIZE);
-	WCIDAttri = (BssIndex << 4) | (CipherAlg << 1) | (bUsePairewiseKeyTable);
-	RTMP_IO_WRITE32(pAd, offset, WCIDAttri);
-}
-
-VOID AsicUpdateWCIDIVEIV(
-	IN PRTMP_ADAPTER pAd,
-	IN USHORT		WCID,
-	IN ULONG        uIV,
-	IN ULONG        uEIV)
-{
-	ULONG	offset;
-
-	offset = MAC_IVEIV_TABLE_BASE + (WCID * HW_IVEIV_ENTRY_SIZE);
-
-	RTMP_IO_WRITE32(pAd, offset, uIV);
-	RTMP_IO_WRITE32(pAd, offset + 4, uEIV);
-}
-
-VOID AsicUpdateRxWCIDTable(
-	IN PRTMP_ADAPTER pAd,
-	IN USHORT		WCID,
-	IN PUCHAR        pAddr)
-{
-	ULONG offset;
-	ULONG Addr;
-
-	offset = MAC_WCID_BASE + (WCID * HW_WCID_ENTRY_SIZE);
-	Addr = pAddr[0] + (pAddr[1] << 8) +(pAddr[2] << 16) +(pAddr[3] << 24);
-	RTMP_IO_WRITE32(pAd, offset, Addr);
-	Addr = pAddr[4] + (pAddr[5] << 8);
-	RTMP_IO_WRITE32(pAd, offset + 4, Addr);
-}
-
-
-/*
-    ========================================================================
-
-    Routine Description:
-        Set Cipher Key, Cipher algorithm, IV/EIV to Asic
-
-    Arguments:
-        pAd                     Pointer to our adapter
-        WCID                    WCID Entry number.
-        BssIndex                BSSID index, station or none multiple BSSID support
-                                this value should be 0.
-        KeyIdx                  This KeyIdx will set to IV's KeyID if bTxKey enabled
-        pCipherKey              Pointer to Cipher Key.
-        bUsePairewiseKeyTable   TRUE means saved the key in SharedKey table,
-                                otherwise PairewiseKey table
-        bTxKey                  This is the transmit key if enabled.
-
-    Return Value:
-        None
-
-    Note:
-        This routine will set the relative key stuff to Asic including WCID attribute,
-        Cipher Key, Cipher algorithm and IV/EIV.
-
-        IV/EIV will be update if this CipherKey is the transmission key because
-        ASIC will base on IV's KeyID value to select Cipher Key.
-
-        If bTxKey sets to FALSE, this is not the TX key, but it could be
-        RX key
-
-    	For AP mode bTxKey must be always set to TRUE.
-    ========================================================================
-*/
-VOID AsicAddKeyEntry(
-	IN PRTMP_ADAPTER pAd,
-	IN USHORT		WCID,
-	IN UCHAR		BssIndex,
-	IN UCHAR		KeyIdx,
-	IN PCIPHER_KEY	pCipherKey,
-	IN BOOLEAN		bUsePairewiseKeyTable,
-	IN BOOLEAN		bTxKey)
-{
-	ULONG	offset;
-	UCHAR	IV4 = 0;
-	PUCHAR		pKey = pCipherKey->Key;
-	PUCHAR		pTxMic = pCipherKey->TxMic;
-	PUCHAR		pRxMic = pCipherKey->RxMic;
-	PUCHAR		pTxtsc = pCipherKey->TxTsc;
-	UCHAR		CipherAlg = pCipherKey->CipherAlg;
-	SHAREDKEY_MODE_STRUC csr1;
-#ifdef RT2860
-	UCHAR		i;
-#endif
-
-	DBGPRINT(RT_DEBUG_TRACE, ("==> AsicAddKeyEntry\n"));
-	//
-	// 1.) decide key table offset
-	//
-	if (bUsePairewiseKeyTable)
-		offset = PAIRWISE_KEY_TABLE_BASE + (WCID * HW_KEY_ENTRY_SIZE);
-	else
-		offset = SHARED_KEY_TABLE_BASE + (4 * BssIndex + KeyIdx) * HW_KEY_ENTRY_SIZE;
-
-	//
-	// 2.) Set Key to Asic
-	//
-	//for (i = 0; i < KeyLen; i++)
-#ifdef RT2860
-	for (i = 0; i < MAX_LEN_OF_PEER_KEY; i++)
-	{
-		RTMP_IO_WRITE8(pAd, offset + i, pKey[i]);
-	}
-#endif
-#ifdef RT2870
-	RTUSBMultiWrite(pAd, offset, pKey, MAX_LEN_OF_PEER_KEY);
-#endif
-	offset += MAX_LEN_OF_PEER_KEY;
-
-	//
-	// 3.) Set MIC key if available
-	//
-	if (pTxMic)
-	{
-#ifdef RT2860
-		for (i = 0; i < 8; i++)
-		{
-			RTMP_IO_WRITE8(pAd, offset + i, pTxMic[i]);
-		}
-#endif
-#ifdef RT2870
-		RTUSBMultiWrite(pAd, offset, pTxMic, 8);
-#endif
-	}
-	offset += LEN_TKIP_TXMICK;
-
-	if (pRxMic)
-	{
-#ifdef RT2860
-		for (i = 0; i < 8; i++)
-		{
-			RTMP_IO_WRITE8(pAd, offset + i, pRxMic[i]);
-		}
-#endif
-#ifdef RT2870
-		RTUSBMultiWrite(pAd, offset, pRxMic, 8);
-#endif
-	}
-
-
-	//
-	// 4.) Modify IV/EIV if needs
-	//     This will force Asic to use this key ID by setting IV.
-	//
-	if (bTxKey)
-	{
-#ifdef RT2860
-		offset = MAC_IVEIV_TABLE_BASE + (WCID * HW_IVEIV_ENTRY_SIZE);
-		//
-		// Write IV
-		//
-		RTMP_IO_WRITE8(pAd, offset, pTxtsc[1]);
-		RTMP_IO_WRITE8(pAd, offset + 1, ((pTxtsc[1] | 0x20) & 0x7f));
-		RTMP_IO_WRITE8(pAd, offset + 2, pTxtsc[0]);
-
-		IV4 = (KeyIdx << 6);
-		if ((CipherAlg == CIPHER_TKIP) || (CipherAlg == CIPHER_TKIP_NO_MIC) ||(CipherAlg == CIPHER_AES))
-			IV4 |= 0x20;  // turn on extension bit means EIV existence
-
-		RTMP_IO_WRITE8(pAd, offset + 3, IV4);
-
-		//
-		// Write EIV
-		//
-		offset += 4;
-		for (i = 0; i < 4; i++)
-		{
-			RTMP_IO_WRITE8(pAd, offset + i, pTxtsc[i + 2]);
-		}
-
-#endif
-#ifdef RT2870
-		UINT32 tmpVal;
-
-		//
-		// Write IV
-		//
-		IV4 = (KeyIdx << 6);
-		if ((CipherAlg == CIPHER_TKIP) || (CipherAlg == CIPHER_TKIP_NO_MIC) ||(CipherAlg == CIPHER_AES))
-			IV4 |= 0x20;  // turn on extension bit means EIV existence
-
-		tmpVal = pTxtsc[1] + (((pTxtsc[1] | 0x20) & 0x7f) << 8) + (pTxtsc[0] << 16) + (IV4 << 24);
-		RTMP_IO_WRITE32(pAd, offset, tmpVal);
-
-		//
-		// Write EIV
-		//
-		offset += 4;
-		RTMP_IO_WRITE32(pAd, offset, *(PUINT32)&pCipherKey->TxTsc[2]);
-#endif // RT2870 //
-		AsicUpdateWCIDAttribute(pAd, WCID, BssIndex, CipherAlg, bUsePairewiseKeyTable);
-	}
-
-	if (!bUsePairewiseKeyTable)
-	{
-		//
-		// Only update the shared key security mode
-		//
-		RTMP_IO_READ32(pAd, SHARED_KEY_MODE_BASE + 4 * (BssIndex / 2), &csr1.word);
-		if ((BssIndex % 2) == 0)
-		{
-			if (KeyIdx == 0)
-				csr1.field.Bss0Key0CipherAlg = CipherAlg;
-			else if (KeyIdx == 1)
-				csr1.field.Bss0Key1CipherAlg = CipherAlg;
-			else if (KeyIdx == 2)
-				csr1.field.Bss0Key2CipherAlg = CipherAlg;
-			else
-				csr1.field.Bss0Key3CipherAlg = CipherAlg;
-		}
-		else
-		{
-			if (KeyIdx == 0)
-				csr1.field.Bss1Key0CipherAlg = CipherAlg;
-			else if (KeyIdx == 1)
-				csr1.field.Bss1Key1CipherAlg = CipherAlg;
-			else if (KeyIdx == 2)
-				csr1.field.Bss1Key2CipherAlg = CipherAlg;
-			else
-				csr1.field.Bss1Key3CipherAlg = CipherAlg;
-		}
-		RTMP_IO_WRITE32(pAd, SHARED_KEY_MODE_BASE + 4 * (BssIndex / 2), csr1.word);
-	}
-
-	DBGPRINT(RT_DEBUG_TRACE, ("<== AsicAddKeyEntry\n"));
-}
-
-
-/*
-	========================================================================
-	Description:
-		Add Pair-wise key material into ASIC.
-		Update pairwise key, TxMic and RxMic to Asic Pair-wise key table
-
-    Return:
-	========================================================================
-*/
-VOID AsicAddPairwiseKeyEntry(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR        pAddr,
-	IN UCHAR		WCID,
-	IN CIPHER_KEY		 *pCipherKey)
-{
-	INT i;
-	ULONG 		offset;
-	PUCHAR		 pKey = pCipherKey->Key;
-	PUCHAR		 pTxMic = pCipherKey->TxMic;
-	PUCHAR		 pRxMic = pCipherKey->RxMic;
-#ifdef DBG
-	UCHAR		CipherAlg = pCipherKey->CipherAlg;
-#endif // DBG //
-
-	// EKEY
-	offset = PAIRWISE_KEY_TABLE_BASE + (WCID * HW_KEY_ENTRY_SIZE);
-#ifdef RT2860
-	for (i=0; i<MAX_LEN_OF_PEER_KEY; i++)
-	{
-		RTMP_IO_WRITE8(pAd, offset + i, pKey[i]);
-	}
-#endif
-#ifdef RT2870
-	RTUSBMultiWrite(pAd, offset, &pCipherKey->Key[0], MAX_LEN_OF_PEER_KEY);
-#endif // RT2870 //
-	for (i=0; i<MAX_LEN_OF_PEER_KEY; i+=4)
-	{
-		UINT32 Value;
-		RTMP_IO_READ32(pAd, offset + i, &Value);
-	}
-
-	offset += MAX_LEN_OF_PEER_KEY;
-
-	//  MIC KEY
-	if (pTxMic)
-	{
-#ifdef RT2860
-		for (i=0; i<8; i++)
-		{
-			RTMP_IO_WRITE8(pAd, offset+i, pTxMic[i]);
-		}
-#endif
-#ifdef RT2870
-		RTUSBMultiWrite(pAd, offset, &pCipherKey->TxMic[0], 8);
-#endif // RT2870 //
-	}
-	offset += 8;
-	if (pRxMic)
-	{
-#ifdef RT2860
-		for (i=0; i<8; i++)
-		{
-			RTMP_IO_WRITE8(pAd, offset+i, pRxMic[i]);
-		}
-#endif
-#ifdef RT2870
-		RTUSBMultiWrite(pAd, offset, &pCipherKey->RxMic[0], 8);
-#endif // RT2870 //
-	}
-
-	DBGPRINT(RT_DEBUG_TRACE,("AsicAddPairwiseKeyEntry: WCID #%d Alg=%s\n",WCID, CipherName[CipherAlg]));
-	DBGPRINT(RT_DEBUG_TRACE,("	Key = %02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x\n",
-		pKey[0],pKey[1],pKey[2],pKey[3],pKey[4],pKey[5],pKey[6],pKey[7],pKey[8],pKey[9],pKey[10],pKey[11],pKey[12],pKey[13],pKey[14],pKey[15]));
-	if (pRxMic)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("	Rx MIC Key = %02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x\n",
-			pRxMic[0],pRxMic[1],pRxMic[2],pRxMic[3],pRxMic[4],pRxMic[5],pRxMic[6],pRxMic[7]));
-	}
-	if (pTxMic)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("	Tx MIC Key = %02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x\n",
-			pTxMic[0],pTxMic[1],pTxMic[2],pTxMic[3],pTxMic[4],pTxMic[5],pTxMic[6],pTxMic[7]));
-	}
-}
-/*
-	========================================================================
-	Description:
-		Remove Pair-wise key material from ASIC.
-
-    Return:
-	========================================================================
-*/
-VOID AsicRemovePairwiseKeyEntry(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR		 BssIdx,
-	IN UCHAR		 Wcid)
-{
-	ULONG		WCIDAttri;
-	USHORT		offset;
-
-	// re-set the entry's WCID attribute as OPEN-NONE.
-	offset = MAC_WCID_ATTRIBUTE_BASE + (Wcid * HW_WCID_ATTRI_SIZE);
-	WCIDAttri = (BssIdx<<4) | PAIRWISEKEYTABLE;
-	RTMP_IO_WRITE32(pAd, offset, WCIDAttri);
-}
-
-BOOLEAN AsicSendCommandToMcu(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR		 Command,
-	IN UCHAR		 Token,
-	IN UCHAR		 Arg0,
-	IN UCHAR		 Arg1)
-{
-	HOST_CMD_CSR_STRUC	H2MCmd;
-	H2M_MAILBOX_STRUC	H2MMailbox;
-	ULONG				i = 0;
-
-	do
-	{
-		RTMP_IO_READ32(pAd, H2M_MAILBOX_CSR, &H2MMailbox.word);
-		if (H2MMailbox.field.Owner == 0)
-			break;
-
-		RTMPusecDelay(2);
-	} while(i++ < 100);
-
-	if (i > 100)
-	{
-		{
-#ifdef RT2860
-			UINT32 Data;
-
-			// Reset DMA
-			RTMP_IO_READ32(pAd, PBF_SYS_CTRL, &Data);
-			Data |= 0x2;
-			RTMP_IO_WRITE32(pAd, PBF_SYS_CTRL, Data);
-
-			// After Reset DMA, DMA index will become Zero. So Driver need to reset all ring indexs too.
-			// Reset DMA/CPU ring index
-			RTMPRingCleanUp(pAd, QID_AC_BK);
-			RTMPRingCleanUp(pAd, QID_AC_BE);
-			RTMPRingCleanUp(pAd, QID_AC_VI);
-			RTMPRingCleanUp(pAd, QID_AC_VO);
-			RTMPRingCleanUp(pAd, QID_HCCA);
-			RTMPRingCleanUp(pAd, QID_MGMT);
-			RTMPRingCleanUp(pAd, QID_RX);
-
-			// Clear Reset
-			RTMP_IO_READ32(pAd, PBF_SYS_CTRL, &Data);
-			Data &= 0xfffffffd;
-			RTMP_IO_WRITE32(pAd, PBF_SYS_CTRL, Data);
-#endif /* RT2860 */
-		DBGPRINT_ERR(("H2M_MAILBOX still hold by MCU. command fail\n"));
-		}
-		//return FALSE;
-#ifdef RT2870
-		return FALSE;
-#endif
-	}
-
-	H2MMailbox.field.Owner	  = 1;	   // pass ownership to MCU
-	H2MMailbox.field.CmdToken = Token;
-	H2MMailbox.field.HighByte = Arg1;
-	H2MMailbox.field.LowByte  = Arg0;
-	RTMP_IO_WRITE32(pAd, H2M_MAILBOX_CSR, H2MMailbox.word);
-
-	H2MCmd.word 			  = 0;
-	H2MCmd.field.HostCommand  = Command;
-	RTMP_IO_WRITE32(pAd, HOST_CMD_CSR, H2MCmd.word);
-
-	if (Command != 0x80)
-	{
-	}
-
-	return TRUE;
-}
-
-#ifdef RT2860
-BOOLEAN AsicCheckCommanOk(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR		 Command)
-{
-	UINT32	CmdStatus = 0, CID = 0, i;
-	UINT32	ThisCIDMask = 0;
-
-	i = 0;
-	do
-	{
-		RTMP_IO_READ32(pAd, H2M_MAILBOX_CID, &CID);
-		// Find where the command is. Because this is randomly specified by firmware.
-		if ((CID & CID0MASK) == Command)
-		{
-			ThisCIDMask = CID0MASK;
-			break;
-		}
-		else if ((((CID & CID1MASK)>>8) & 0xff) == Command)
-		{
-			ThisCIDMask = CID1MASK;
-			break;
-		}
-		else if ((((CID & CID2MASK)>>16) & 0xff) == Command)
-		{
-			ThisCIDMask = CID2MASK;
-			break;
-		}
-		else if ((((CID & CID3MASK)>>24) & 0xff) == Command)
-		{
-			ThisCIDMask = CID3MASK;
-			break;
-		}
-
-		RTMPusecDelay(100);
-		i++;
-	}while (i < 200);
-
-	// Get CommandStatus Value
-	RTMP_IO_READ32(pAd, H2M_MAILBOX_STATUS, &CmdStatus);
-
-	// This command's status is at the same position as command. So AND command position's bitmask to read status.
-	if (i < 200)
-	{
-		// If Status is 1, the comamnd is success.
-		if (((CmdStatus & ThisCIDMask) == 0x1) || ((CmdStatus & ThisCIDMask) == 0x100)
-			|| ((CmdStatus & ThisCIDMask) == 0x10000) || ((CmdStatus & ThisCIDMask) == 0x1000000))
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("--> AsicCheckCommanOk CID = 0x%x, CmdStatus= 0x%x \n", CID, CmdStatus));
-			RTMP_IO_WRITE32(pAd, H2M_MAILBOX_STATUS, 0xffffffff);
-			RTMP_IO_WRITE32(pAd, H2M_MAILBOX_CID, 0xffffffff);
-			return TRUE;
-		}
-		DBGPRINT(RT_DEBUG_TRACE, ("--> AsicCheckCommanFail1 CID = 0x%x, CmdStatus= 0x%x \n", CID, CmdStatus));
-	}
-	else
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("--> AsicCheckCommanFail2 Timeout Command = %d, CmdStatus= 0x%x \n", Command, CmdStatus));
-	}
-	// Clear Command and Status.
-	RTMP_IO_WRITE32(pAd, H2M_MAILBOX_STATUS, 0xffffffff);
-	RTMP_IO_WRITE32(pAd, H2M_MAILBOX_CID, 0xffffffff);
-
-	return FALSE;
-}
-#endif /* RT8260 */
-
 /*
 	========================================================================
 
@@ -7662,13 +5244,11 @@ BOOLEAN AsicCheckCommanOk(
 
 	========================================================================
 */
-VOID	RTMPCheckRates(
-	IN		PRTMP_ADAPTER	pAd,
-	IN OUT	UCHAR			SupRate[],
-	IN OUT	UCHAR			*SupRateLen)
+void RTMPCheckRates(struct rt_rtmp_adapter *pAd,
+		    IN u8 SupRate[], IN u8 * SupRateLen)
 {
-	UCHAR	RateIdx, i, j;
-	UCHAR	NewRate[12], NewRateLen;
+	u8 RateIdx, i, j;
+	u8 NewRate[12], NewRateLen;
 
 	NewRateLen = 0;
 
@@ -7677,7 +5257,7 @@ VOID	RTMPCheckRates(
 	else
 		RateIdx = 12;
 
-	// Check for support rates exclude basic rate bit
+	/* Check for support rates exclude basic rate bit */
 	for (i = 0; i < *SupRateLen; i++)
 		for (j = 0; j < RateIdx; j++)
 			if ((SupRate[i] & 0x7f) == RateIdTo500Kbps[j])
@@ -7687,43 +5267,37 @@ VOID	RTMPCheckRates(
 	NdisMoveMemory(SupRate, NewRate, NewRateLen);
 }
 
-BOOLEAN RTMPCheckChannel(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR		CentralChannel,
-	IN UCHAR		Channel)
+BOOLEAN RTMPCheckChannel(struct rt_rtmp_adapter *pAd,
+			 u8 CentralChannel, u8 Channel)
 {
-	UCHAR		k;
-	UCHAR		UpperChannel = 0, LowerChannel = 0;
-	UCHAR		NoEffectChannelinList = 0;
+	u8 k;
+	u8 UpperChannel = 0, LowerChannel = 0;
+	u8 NoEffectChannelinList = 0;
 
-	// Find upper and lower channel according to 40MHz current operation.
-	if (CentralChannel < Channel)
-	{
+	/* Find upper and lower channel according to 40MHz current operation. */
+	if (CentralChannel < Channel) {
 		UpperChannel = Channel;
 		if (CentralChannel > 2)
 			LowerChannel = CentralChannel - 2;
 		else
 			return FALSE;
-	}
-	else if (CentralChannel > Channel)
-	{
+	} else if (CentralChannel > Channel) {
 		UpperChannel = CentralChannel + 2;
 		LowerChannel = Channel;
 	}
 
-	for (k = 0;k < pAd->ChannelListNum;k++)
-	{
-		if (pAd->ChannelList[k].Channel == UpperChannel)
-		{
-			NoEffectChannelinList ++;
+	for (k = 0; k < pAd->ChannelListNum; k++) {
+		if (pAd->ChannelList[k].Channel == UpperChannel) {
+			NoEffectChannelinList++;
 		}
-		if (pAd->ChannelList[k].Channel == LowerChannel)
-		{
-			NoEffectChannelinList ++;
+		if (pAd->ChannelList[k].Channel == LowerChannel) {
+			NoEffectChannelinList++;
 		}
 	}
 
-	DBGPRINT(RT_DEBUG_TRACE,("Total Channel in Channel List = [%d]\n", NoEffectChannelinList));
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("Total Channel in Channel List = [%d]\n",
+		  NoEffectChannelinList));
 	if (NoEffectChannelinList == 2)
 		return TRUE;
 	else
@@ -7746,88 +5320,114 @@ BOOLEAN RTMPCheckChannel(
 
 	========================================================================
 */
-BOOLEAN 	RTMPCheckHt(
-	IN	PRTMP_ADAPTER			pAd,
-	IN	UCHAR					Wcid,
-	IN 	HT_CAPABILITY_IE		*pHtCapability,
-	IN 	ADD_HT_INFO_IE			*pAddHtInfo)
+BOOLEAN RTMPCheckHt(struct rt_rtmp_adapter *pAd,
+		    u8 Wcid,
+		    struct rt_ht_capability_ie * pHtCapability,
+		    struct rt_add_ht_info_ie * pAddHtInfo)
 {
 	if (Wcid >= MAX_LEN_OF_MAC_TABLE)
 		return FALSE;
 
-	// If use AMSDU, set flag.
+	/* If use AMSDU, set flag. */
 	if (pAd->CommonCfg.DesiredHtPhy.AmsduEnable)
-		CLIENT_STATUS_SET_FLAG(&pAd->MacTab.Content[Wcid], fCLIENT_STATUS_AMSDU_INUSED);
-	// Save Peer Capability
+		CLIENT_STATUS_SET_FLAG(&pAd->MacTab.Content[Wcid],
+				       fCLIENT_STATUS_AMSDU_INUSED);
+	/* Save Peer Capability */
 	if (pHtCapability->HtCapInfo.ShortGIfor20)
-		CLIENT_STATUS_SET_FLAG(&pAd->MacTab.Content[Wcid], fCLIENT_STATUS_SGI20_CAPABLE);
+		CLIENT_STATUS_SET_FLAG(&pAd->MacTab.Content[Wcid],
+				       fCLIENT_STATUS_SGI20_CAPABLE);
 	if (pHtCapability->HtCapInfo.ShortGIfor40)
-		CLIENT_STATUS_SET_FLAG(&pAd->MacTab.Content[Wcid], fCLIENT_STATUS_SGI40_CAPABLE);
+		CLIENT_STATUS_SET_FLAG(&pAd->MacTab.Content[Wcid],
+				       fCLIENT_STATUS_SGI40_CAPABLE);
 	if (pHtCapability->HtCapInfo.TxSTBC)
-		CLIENT_STATUS_SET_FLAG(&pAd->MacTab.Content[Wcid], fCLIENT_STATUS_TxSTBC_CAPABLE);
+		CLIENT_STATUS_SET_FLAG(&pAd->MacTab.Content[Wcid],
+				       fCLIENT_STATUS_TxSTBC_CAPABLE);
 	if (pHtCapability->HtCapInfo.RxSTBC)
-		CLIENT_STATUS_SET_FLAG(&pAd->MacTab.Content[Wcid], fCLIENT_STATUS_RxSTBC_CAPABLE);
-	if (pAd->CommonCfg.bRdg && pHtCapability->ExtHtCapInfo.RDGSupport)
-	{
-		CLIENT_STATUS_SET_FLAG(&pAd->MacTab.Content[Wcid], fCLIENT_STATUS_RDG_CAPABLE);
+		CLIENT_STATUS_SET_FLAG(&pAd->MacTab.Content[Wcid],
+				       fCLIENT_STATUS_RxSTBC_CAPABLE);
+	if (pAd->CommonCfg.bRdg && pHtCapability->ExtHtCapInfo.RDGSupport) {
+		CLIENT_STATUS_SET_FLAG(&pAd->MacTab.Content[Wcid],
+				       fCLIENT_STATUS_RDG_CAPABLE);
 	}
 
-	if (Wcid < MAX_LEN_OF_MAC_TABLE)
-	{
-		pAd->MacTab.Content[Wcid].MpduDensity = pHtCapability->HtCapParm.MpduDensity;
+	if (Wcid < MAX_LEN_OF_MAC_TABLE) {
+		pAd->MacTab.Content[Wcid].MpduDensity =
+		    pHtCapability->HtCapParm.MpduDensity;
 	}
-
-	// Will check ChannelWidth for MCSSet[4] below
+	/* Will check ChannelWidth for MCSSet[4] below */
 	pAd->MlmeAux.HtCapability.MCSSet[4] = 0x1;
-    switch (pAd->CommonCfg.RxStream)
-	{
-		case 1:
-			pAd->MlmeAux.HtCapability.MCSSet[0] = 0xff;
-			pAd->MlmeAux.HtCapability.MCSSet[1] = 0x00;
-            pAd->MlmeAux.HtCapability.MCSSet[2] = 0x00;
-            pAd->MlmeAux.HtCapability.MCSSet[3] = 0x00;
-			break;
-		case 2:
-			pAd->MlmeAux.HtCapability.MCSSet[0] = 0xff;
-			pAd->MlmeAux.HtCapability.MCSSet[1] = 0xff;
-            pAd->MlmeAux.HtCapability.MCSSet[2] = 0x00;
-            pAd->MlmeAux.HtCapability.MCSSet[3] = 0x00;
-			break;
-		case 3:
-			pAd->MlmeAux.HtCapability.MCSSet[0] = 0xff;
-			pAd->MlmeAux.HtCapability.MCSSet[1] = 0xff;
-            pAd->MlmeAux.HtCapability.MCSSet[2] = 0xff;
-            pAd->MlmeAux.HtCapability.MCSSet[3] = 0x00;
-			break;
-	}
-
-	pAd->MlmeAux.HtCapability.HtCapInfo.ChannelWidth = pAddHtInfo->AddHtInfo.RecomWidth & pAd->CommonCfg.DesiredHtPhy.ChannelWidth;
-
-    DBGPRINT(RT_DEBUG_TRACE, ("RTMPCheckHt:: HtCapInfo.ChannelWidth=%d, RecomWidth=%d, DesiredHtPhy.ChannelWidth=%d, BW40MAvailForA/G=%d/%d, PhyMode=%d \n",
-		pAd->MlmeAux.HtCapability.HtCapInfo.ChannelWidth, pAddHtInfo->AddHtInfo.RecomWidth, pAd->CommonCfg.DesiredHtPhy.ChannelWidth,
-		pAd->NicConfig2.field.BW40MAvailForA, pAd->NicConfig2.field.BW40MAvailForG, pAd->CommonCfg.PhyMode));
-
-	pAd->MlmeAux.HtCapability.HtCapInfo.GF =  pHtCapability->HtCapInfo.GF &pAd->CommonCfg.DesiredHtPhy.GF;
-
-	// Send Assoc Req with my HT capability.
-	pAd->MlmeAux.HtCapability.HtCapInfo.AMsduSize =  pAd->CommonCfg.DesiredHtPhy.AmsduSize;
-	pAd->MlmeAux.HtCapability.HtCapInfo.MimoPs =  pAd->CommonCfg.DesiredHtPhy.MimoPs;
-	pAd->MlmeAux.HtCapability.HtCapInfo.ShortGIfor20 =  (pAd->CommonCfg.DesiredHtPhy.ShortGIfor20) & (pHtCapability->HtCapInfo.ShortGIfor20);
-	pAd->MlmeAux.HtCapability.HtCapInfo.ShortGIfor40 =  (pAd->CommonCfg.DesiredHtPhy.ShortGIfor40) & (pHtCapability->HtCapInfo.ShortGIfor40);
-	pAd->MlmeAux.HtCapability.HtCapInfo.TxSTBC =  (pAd->CommonCfg.DesiredHtPhy.TxSTBC)&(pHtCapability->HtCapInfo.RxSTBC);
-	pAd->MlmeAux.HtCapability.HtCapInfo.RxSTBC =  (pAd->CommonCfg.DesiredHtPhy.RxSTBC)&(pHtCapability->HtCapInfo.TxSTBC);
-	pAd->MlmeAux.HtCapability.HtCapParm.MaxRAmpduFactor = pAd->CommonCfg.DesiredHtPhy.MaxRAmpduFactor;
-    pAd->MlmeAux.HtCapability.HtCapParm.MpduDensity = pAd->CommonCfg.HtCapability.HtCapParm.MpduDensity;
-	pAd->MlmeAux.HtCapability.ExtHtCapInfo.PlusHTC = pHtCapability->ExtHtCapInfo.PlusHTC;
-	pAd->MacTab.Content[Wcid].HTCapability.ExtHtCapInfo.PlusHTC = pHtCapability->ExtHtCapInfo.PlusHTC;
-	if (pAd->CommonCfg.bRdg)
-	{
-		pAd->MlmeAux.HtCapability.ExtHtCapInfo.RDGSupport = pHtCapability->ExtHtCapInfo.RDGSupport;
-        pAd->MlmeAux.HtCapability.ExtHtCapInfo.PlusHTC = 1;
-	}
-
-    if (pAd->MlmeAux.HtCapability.HtCapInfo.ChannelWidth == BW_20)
-        pAd->MlmeAux.HtCapability.MCSSet[4] = 0x0;  // BW20 can't transmit MCS32
+	switch (pAd->CommonCfg.RxStream) {
+	case 1:
+		pAd->MlmeAux.HtCapability.MCSSet[0] = 0xff;
+		pAd->MlmeAux.HtCapability.MCSSet[1] = 0x00;
+		pAd->MlmeAux.HtCapability.MCSSet[2] = 0x00;
+		pAd->MlmeAux.HtCapability.MCSSet[3] = 0x00;
+		break;
+	case 2:
+		pAd->MlmeAux.HtCapability.MCSSet[0] = 0xff;
+		pAd->MlmeAux.HtCapability.MCSSet[1] = 0xff;
+		pAd->MlmeAux.HtCapability.MCSSet[2] = 0x00;
+		pAd->MlmeAux.HtCapability.MCSSet[3] = 0x00;
+		break;
+	case 3:
+		pAd->MlmeAux.HtCapability.MCSSet[0] = 0xff;
+		pAd->MlmeAux.HtCapability.MCSSet[1] = 0xff;
+		pAd->MlmeAux.HtCapability.MCSSet[2] = 0xff;
+		pAd->MlmeAux.HtCapability.MCSSet[3] = 0x00;
+		break;
+	}
+
+	pAd->MlmeAux.HtCapability.HtCapInfo.ChannelWidth =
+	    pAddHtInfo->AddHtInfo.RecomWidth & pAd->CommonCfg.DesiredHtPhy.
+	    ChannelWidth;
+
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("RTMPCheckHt:: HtCapInfo.ChannelWidth=%d, RecomWidth=%d, DesiredHtPhy.ChannelWidth=%d, BW40MAvailForA/G=%d/%d, PhyMode=%d \n",
+		  pAd->MlmeAux.HtCapability.HtCapInfo.ChannelWidth,
+		  pAddHtInfo->AddHtInfo.RecomWidth,
+		  pAd->CommonCfg.DesiredHtPhy.ChannelWidth,
+		  pAd->NicConfig2.field.BW40MAvailForA,
+		  pAd->NicConfig2.field.BW40MAvailForG,
+		  pAd->CommonCfg.PhyMode));
+
+	pAd->MlmeAux.HtCapability.HtCapInfo.GF =
+	    pHtCapability->HtCapInfo.GF & pAd->CommonCfg.DesiredHtPhy.GF;
+
+	/* Send Assoc Req with my HT capability. */
+	pAd->MlmeAux.HtCapability.HtCapInfo.AMsduSize =
+	    pAd->CommonCfg.DesiredHtPhy.AmsduSize;
+	pAd->MlmeAux.HtCapability.HtCapInfo.MimoPs =
+	    pAd->CommonCfg.DesiredHtPhy.MimoPs;
+	pAd->MlmeAux.HtCapability.HtCapInfo.ShortGIfor20 =
+	    (pAd->CommonCfg.DesiredHtPhy.ShortGIfor20) & (pHtCapability->
+							  HtCapInfo.
+							  ShortGIfor20);
+	pAd->MlmeAux.HtCapability.HtCapInfo.ShortGIfor40 =
+	    (pAd->CommonCfg.DesiredHtPhy.ShortGIfor40) & (pHtCapability->
+							  HtCapInfo.
+							  ShortGIfor40);
+	pAd->MlmeAux.HtCapability.HtCapInfo.TxSTBC =
+	    (pAd->CommonCfg.DesiredHtPhy.TxSTBC) & (pHtCapability->HtCapInfo.
+						    RxSTBC);
+	pAd->MlmeAux.HtCapability.HtCapInfo.RxSTBC =
+	    (pAd->CommonCfg.DesiredHtPhy.RxSTBC) & (pHtCapability->HtCapInfo.
+						    TxSTBC);
+	pAd->MlmeAux.HtCapability.HtCapParm.MaxRAmpduFactor =
+	    pAd->CommonCfg.DesiredHtPhy.MaxRAmpduFactor;
+	pAd->MlmeAux.HtCapability.HtCapParm.MpduDensity =
+	    pAd->CommonCfg.HtCapability.HtCapParm.MpduDensity;
+	pAd->MlmeAux.HtCapability.ExtHtCapInfo.PlusHTC =
+	    pHtCapability->ExtHtCapInfo.PlusHTC;
+	pAd->MacTab.Content[Wcid].HTCapability.ExtHtCapInfo.PlusHTC =
+	    pHtCapability->ExtHtCapInfo.PlusHTC;
+	if (pAd->CommonCfg.bRdg) {
+		pAd->MlmeAux.HtCapability.ExtHtCapInfo.RDGSupport =
+		    pHtCapability->ExtHtCapInfo.RDGSupport;
+		pAd->MlmeAux.HtCapability.ExtHtCapInfo.PlusHTC = 1;
+	}
+
+	if (pAd->MlmeAux.HtCapability.HtCapInfo.ChannelWidth == BW_20)
+		pAd->MlmeAux.HtCapability.MCSSet[4] = 0x0;	/* BW20 can't transmit MCS32 */
 
 	COPY_AP_HTSETTINGS_FROM_BEACON(pAd, pHtCapability);
 	return TRUE;
@@ -7849,65 +5449,60 @@ BOOLEAN 	RTMPCheckHt(
 
 	========================================================================
 */
-VOID RTMPUpdateMlmeRate(
-	IN PRTMP_ADAPTER	pAd)
+void RTMPUpdateMlmeRate(struct rt_rtmp_adapter *pAd)
 {
-	UCHAR	MinimumRate;
-	UCHAR	ProperMlmeRate; //= RATE_54;
-	UCHAR	i, j, RateIdx = 12; //1, 2, 5.5, 11, 6, 9, 12, 18, 24, 36, 48, 54
-	BOOLEAN	bMatch = FALSE;
-
-	switch (pAd->CommonCfg.PhyMode)
-	{
-		case PHY_11B:
+	u8 MinimumRate;
+	u8 ProperMlmeRate;	/*= RATE_54; */
+	u8 i, j, RateIdx = 12;	/*1, 2, 5.5, 11, 6, 9, 12, 18, 24, 36, 48, 54 */
+	BOOLEAN bMatch = FALSE;
+
+	switch (pAd->CommonCfg.PhyMode) {
+	case PHY_11B:
+		ProperMlmeRate = RATE_11;
+		MinimumRate = RATE_1;
+		break;
+	case PHY_11BG_MIXED:
+	case PHY_11ABGN_MIXED:
+	case PHY_11BGN_MIXED:
+		if ((pAd->MlmeAux.SupRateLen == 4) &&
+		    (pAd->MlmeAux.ExtRateLen == 0))
+			/* B only AP */
 			ProperMlmeRate = RATE_11;
-			MinimumRate = RATE_1;
-			break;
-		case PHY_11BG_MIXED:
-		case PHY_11ABGN_MIXED:
-		case PHY_11BGN_MIXED:
-			if ((pAd->MlmeAux.SupRateLen == 4) &&
-				(pAd->MlmeAux.ExtRateLen == 0))
-				// B only AP
-				ProperMlmeRate = RATE_11;
-			else
-				ProperMlmeRate = RATE_24;
-
-			if (pAd->MlmeAux.Channel <= 14)
-				MinimumRate = RATE_1;
-			else
-				MinimumRate = RATE_6;
-			break;
-		case PHY_11A:
-		case PHY_11N_2_4G:	// rt2860 need to check mlmerate for 802.11n
-		case PHY_11GN_MIXED:
-		case PHY_11AGN_MIXED:
-		case PHY_11AN_MIXED:
-		case PHY_11N_5G:
+		else
 			ProperMlmeRate = RATE_24;
+
+		if (pAd->MlmeAux.Channel <= 14)
+			MinimumRate = RATE_1;
+		else
 			MinimumRate = RATE_6;
-			break;
-		case PHY_11ABG_MIXED:
-			ProperMlmeRate = RATE_24;
-			if (pAd->MlmeAux.Channel <= 14)
-			   MinimumRate = RATE_1;
-			else
-				MinimumRate = RATE_6;
-			break;
-		default: // error
-			ProperMlmeRate = RATE_1;
+		break;
+	case PHY_11A:
+	case PHY_11N_2_4G:	/* rt2860 need to check mlmerate for 802.11n */
+	case PHY_11GN_MIXED:
+	case PHY_11AGN_MIXED:
+	case PHY_11AN_MIXED:
+	case PHY_11N_5G:
+		ProperMlmeRate = RATE_24;
+		MinimumRate = RATE_6;
+		break;
+	case PHY_11ABG_MIXED:
+		ProperMlmeRate = RATE_24;
+		if (pAd->MlmeAux.Channel <= 14)
 			MinimumRate = RATE_1;
-			break;
-	}
-
-	for (i = 0; i < pAd->MlmeAux.SupRateLen; i++)
-	{
-		for (j = 0; j < RateIdx; j++)
-		{
-			if ((pAd->MlmeAux.SupRate[i] & 0x7f) == RateIdTo500Kbps[j])
-			{
-				if (j == ProperMlmeRate)
-				{
+		else
+			MinimumRate = RATE_6;
+		break;
+	default:		/* error */
+		ProperMlmeRate = RATE_1;
+		MinimumRate = RATE_1;
+		break;
+	}
+
+	for (i = 0; i < pAd->MlmeAux.SupRateLen; i++) {
+		for (j = 0; j < RateIdx; j++) {
+			if ((pAd->MlmeAux.SupRate[i] & 0x7f) ==
+			    RateIdTo500Kbps[j]) {
+				if (j == ProperMlmeRate) {
 					bMatch = TRUE;
 					break;
 				}
@@ -7918,16 +5513,12 @@ VOID RTMPUpdateMlmeRate(
 			break;
 	}
 
-	if (bMatch == FALSE)
-	{
-		for (i = 0; i < pAd->MlmeAux.ExtRateLen; i++)
-		{
-			for (j = 0; j < RateIdx; j++)
-			{
-				if ((pAd->MlmeAux.ExtRate[i] & 0x7f) == RateIdTo500Kbps[j])
-				{
-					if (j == ProperMlmeRate)
-					{
+	if (bMatch == FALSE) {
+		for (i = 0; i < pAd->MlmeAux.ExtRateLen; i++) {
+			for (j = 0; j < RateIdx; j++) {
+				if ((pAd->MlmeAux.ExtRate[i] & 0x7f) ==
+				    RateIdTo500Kbps[j]) {
+					if (j == ProperMlmeRate) {
 						bMatch = TRUE;
 						break;
 					}
@@ -7939,51 +5530,48 @@ VOID RTMPUpdateMlmeRate(
 		}
 	}
 
-	if (bMatch == FALSE)
-	{
+	if (bMatch == FALSE) {
 		ProperMlmeRate = MinimumRate;
 	}
 
 	pAd->CommonCfg.MlmeRate = MinimumRate;
 	pAd->CommonCfg.RtsRate = ProperMlmeRate;
-	if (pAd->CommonCfg.MlmeRate >= RATE_6)
-	{
+	if (pAd->CommonCfg.MlmeRate >= RATE_6) {
 		pAd->CommonCfg.MlmeTransmit.field.MODE = MODE_OFDM;
-		pAd->CommonCfg.MlmeTransmit.field.MCS = OfdmRateToRxwiMCS[pAd->CommonCfg.MlmeRate];
-		pAd->MacTab.Content[BSS0Mcast_WCID].HTPhyMode.field.MODE = MODE_OFDM;
-		pAd->MacTab.Content[BSS0Mcast_WCID].HTPhyMode.field.MCS = OfdmRateToRxwiMCS[pAd->CommonCfg.MlmeRate];
-	}
-	else
-	{
+		pAd->CommonCfg.MlmeTransmit.field.MCS =
+		    OfdmRateToRxwiMCS[pAd->CommonCfg.MlmeRate];
+		pAd->MacTab.Content[BSS0Mcast_WCID].HTPhyMode.field.MODE =
+		    MODE_OFDM;
+		pAd->MacTab.Content[BSS0Mcast_WCID].HTPhyMode.field.MCS =
+		    OfdmRateToRxwiMCS[pAd->CommonCfg.MlmeRate];
+	} else {
 		pAd->CommonCfg.MlmeTransmit.field.MODE = MODE_CCK;
 		pAd->CommonCfg.MlmeTransmit.field.MCS = pAd->CommonCfg.MlmeRate;
-		pAd->MacTab.Content[BSS0Mcast_WCID].HTPhyMode.field.MODE = MODE_CCK;
-		pAd->MacTab.Content[BSS0Mcast_WCID].HTPhyMode.field.MCS = pAd->CommonCfg.MlmeRate;
+		pAd->MacTab.Content[BSS0Mcast_WCID].HTPhyMode.field.MODE =
+		    MODE_CCK;
+		pAd->MacTab.Content[BSS0Mcast_WCID].HTPhyMode.field.MCS =
+		    pAd->CommonCfg.MlmeRate;
 	}
 
-	DBGPRINT(RT_DEBUG_TRACE, ("RTMPUpdateMlmeRate ==>   MlmeTransmit = 0x%x  \n" , pAd->CommonCfg.MlmeTransmit.word));
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("RTMPUpdateMlmeRate ==>   MlmeTransmit = 0x%x  \n",
+		  pAd->CommonCfg.MlmeTransmit.word));
 }
 
-CHAR RTMPMaxRssi(
-	IN PRTMP_ADAPTER	pAd,
-	IN CHAR				Rssi0,
-	IN CHAR				Rssi1,
-	IN CHAR				Rssi2)
+char RTMPMaxRssi(struct rt_rtmp_adapter *pAd,
+		 char Rssi0, char Rssi1, char Rssi2)
 {
-	CHAR	larger = -127;
+	char larger = -127;
 
-	if ((pAd->Antenna.field.RxPath == 1) && (Rssi0 != 0))
-	{
+	if ((pAd->Antenna.field.RxPath == 1) && (Rssi0 != 0)) {
 		larger = Rssi0;
 	}
 
-	if ((pAd->Antenna.field.RxPath >= 2) && (Rssi1 != 0))
-	{
+	if ((pAd->Antenna.field.RxPath >= 2) && (Rssi1 != 0)) {
 		larger = max(Rssi0, Rssi1);
 	}
 
-	if ((pAd->Antenna.field.RxPath == 3) && (Rssi2 != 0))
-	{
+	if ((pAd->Antenna.field.RxPath == 3) && (Rssi2 != 0)) {
 		larger = max(larger, Rssi2);
 	}
 
@@ -7993,56 +5581,6 @@ CHAR RTMPMaxRssi(
 	return larger;
 }
 
-#ifdef RT2870
-// Antenna divesity use GPIO3 and EESK pin for control
-// Antenna and EEPROM access are both using EESK pin,
-// Therefor we should avoid accessing EESK at the same time
-// Then restore antenna after EEPROM access
-VOID AsicSetRxAnt(
-	IN PRTMP_ADAPTER	pAd,
-	IN UCHAR			Ant)
-{
-	UINT32	Value;
-	UINT32	x;
-
-	if ((pAd->EepromAccess)										||
-		(RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RESET_IN_PROGRESS))	||
-		(RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS))	||
-		(RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RADIO_OFF))			||
-		(RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)))
-	{
-		return;
-	}
-
-	// the antenna selection is through firmware and MAC register(GPIO3)
-	if (Ant == 0)
-	{
-		// Main antenna
-		RTMP_IO_READ32(pAd, E2PROM_CSR, &x);
-		x |= (EESK);
-		RTMP_IO_WRITE32(pAd, E2PROM_CSR, x);
-
-		RTMP_IO_READ32(pAd, GPIO_CTRL_CFG, &Value);
-		Value &= ~(0x0808);
-		RTMP_IO_WRITE32(pAd, GPIO_CTRL_CFG, Value);
-		DBGPRINT_RAW(RT_DEBUG_TRACE, ("AsicSetRxAnt, switch to main antenna\n"));
-	}
-	else
-	{
-		// Aux antenna
-		RTMP_IO_READ32(pAd, E2PROM_CSR, &x);
-		x &= ~(EESK);
-		RTMP_IO_WRITE32(pAd, E2PROM_CSR, x);
-
-		RTMP_IO_READ32(pAd, GPIO_CTRL_CFG, &Value);
-		Value &= ~(0x0808);
-		Value |= 0x08;
-		RTMP_IO_WRITE32(pAd, GPIO_CTRL_CFG, Value);
-		DBGPRINT_RAW(RT_DEBUG_TRACE, ("AsicSetRxAnt, switch to aux antenna\n"));
-	}
-}
-#endif
-
 /*
     ========================================================================
     Routine Description:
@@ -8056,91 +5594,70 @@ VOID AsicSetRxAnt(
 
     ========================================================================
 */
-VOID AsicEvaluateRxAnt(
-	IN PRTMP_ADAPTER	pAd)
+void AsicEvaluateRxAnt(struct rt_rtmp_adapter *pAd)
 {
-	UCHAR	BBPR3 = 0;
+	u8 BBPR3 = 0;
 
 	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RESET_IN_PROGRESS |
-				fRTMP_ADAPTER_HALT_IN_PROGRESS |
-				fRTMP_ADAPTER_RADIO_OFF |
-				fRTMP_ADAPTER_NIC_NOT_EXIST |
-				fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS)
-				|| OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE)
-#ifdef RT2870
-				|| (pAd->EepromAccess)
-#endif
-				)
-			return;
-
+			   fRTMP_ADAPTER_HALT_IN_PROGRESS |
+			   fRTMP_ADAPTER_RADIO_OFF |
+			   fRTMP_ADAPTER_NIC_NOT_EXIST |
+			   fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS) ||
+	    OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE)
 #ifdef RT30xx
-	// two antenna selection mechanism- one is antenna diversity, the other is failed antenna remove
-	// one is antenna diversity:there is only one antenna can rx and tx
-	// the other is failed antenna remove:two physical antenna can rx and tx
-	if (pAd->NicConfig2.field.AntDiversity)
-	{
-		DBGPRINT(RT_DEBUG_TRACE,("AntDiv - before evaluate Pair1-Ant (%d,%d)\n",
-			pAd->RxAnt.Pair1PrimaryRxAnt, pAd->RxAnt.Pair1SecondaryRxAnt));
-
-		AsicSetRxAnt(pAd, pAd->RxAnt.Pair1SecondaryRxAnt);
-
-		pAd->RxAnt.EvaluatePeriod = 1; // 1:Means switch to SecondaryRxAnt, 0:Means switch to Pair1PrimaryRxAnt
-		pAd->RxAnt.FirstPktArrivedWhenEvaluate = FALSE;
-		pAd->RxAnt.RcvPktNumWhenEvaluate = 0;
+	    || (pAd->EepromAccess)
+#endif /* RT30xx // */
+#ifdef RT3090
+	    || (pAd->bPCIclkOff == TRUE)
+#endif /* RT3090 // */
+	    )
+		return;
 
-		// a one-shot timer to end the evalution
-		// dynamic adjust antenna evaluation period according to the traffic
-		if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED))
-			RTMPSetTimer(&pAd->Mlme.RxAntEvalTimer, 100);
-		else
-			RTMPSetTimer(&pAd->Mlme.RxAntEvalTimer, 300);
-	}
-	else
-#endif
 	{
-		if (pAd->StaCfg.Psm == PWR_SAVE)
-			return;
+		/*if (pAd->StaCfg.Psm == PWR_SAVE) */
+		/*      return; */
 
-		RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R3, &BBPR3);
-		BBPR3 &= (~0x18);
-		if(pAd->Antenna.field.RxPath == 3)
-		{
-			BBPR3 |= (0x10);
-		}
-		else if(pAd->Antenna.field.RxPath == 2)
-		{
-			BBPR3 |= (0x8);
-		}
-		else if(pAd->Antenna.field.RxPath == 1)
 		{
-			BBPR3 |= (0x0);
-		}
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R3, BBPR3);
-
-#ifdef RT2860
-		pAd->StaCfg.BBPR3 = BBPR3;
-#endif
-	}
 
-	if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED)
-		)
-	{
-		ULONG	TxTotalCnt = pAd->RalinkCounters.OneSecTxNoRetryOkCount +
-								pAd->RalinkCounters.OneSecTxRetryOkCount +
-								pAd->RalinkCounters.OneSecTxFailCount;
+			if (pAd->StaCfg.Psm == PWR_SAVE)
+				return;
 
-			// dynamic adjust antenna evaluation period according to the traffic
-		if (TxTotalCnt > 50)
-		{
-			RTMPSetTimer(&pAd->Mlme.RxAntEvalTimer, 20);
-			pAd->Mlme.bLowThroughput = FALSE;
-		}
-		else
-		{
-			RTMPSetTimer(&pAd->Mlme.RxAntEvalTimer, 300);
-			pAd->Mlme.bLowThroughput = TRUE;
+			RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R3, &BBPR3);
+			BBPR3 &= (~0x18);
+			if (pAd->Antenna.field.RxPath == 3) {
+				BBPR3 |= (0x10);
+			} else if (pAd->Antenna.field.RxPath == 2) {
+				BBPR3 |= (0x8);
+			} else if (pAd->Antenna.field.RxPath == 1) {
+				BBPR3 |= (0x0);
+			}
+			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R3, BBPR3);
+#ifdef RTMP_MAC_PCI
+			pAd->StaCfg.BBPR3 = BBPR3;
+#endif /* RTMP_MAC_PCI // */
+			if (OPSTATUS_TEST_FLAG
+			    (pAd, fOP_STATUS_MEDIA_STATE_CONNECTED)
+			    ) {
+				unsigned long TxTotalCnt =
+				    pAd->RalinkCounters.OneSecTxNoRetryOkCount +
+				    pAd->RalinkCounters.OneSecTxRetryOkCount +
+				    pAd->RalinkCounters.OneSecTxFailCount;
+
+				/* dynamic adjust antenna evaluation period according to the traffic */
+				if (TxTotalCnt > 50) {
+					RTMPSetTimer(&pAd->Mlme.RxAntEvalTimer,
+						     20);
+					pAd->Mlme.bLowThroughput = FALSE;
+				} else {
+					RTMPSetTimer(&pAd->Mlme.RxAntEvalTimer,
+						     300);
+					pAd->Mlme.bLowThroughput = TRUE;
+				}
+			}
 		}
+
 	}
+
 }
 
 /*
@@ -8156,90 +5673,54 @@ VOID AsicEvaluateRxAnt(
 
     ========================================================================
 */
-VOID AsicRxAntEvalTimeout(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3)
+void AsicRxAntEvalTimeout(void *SystemSpecific1,
+			  void *FunctionContext,
+			  void *SystemSpecific2, void *SystemSpecific3)
 {
-	RTMP_ADAPTER	*pAd = (RTMP_ADAPTER *)FunctionContext;
-	UCHAR			BBPR3 = 0;
-	CHAR			larger = -127, rssi0, rssi1, rssi2;
-
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RESET_IN_PROGRESS	|
-							fRTMP_ADAPTER_HALT_IN_PROGRESS	|
-							fRTMP_ADAPTER_RADIO_OFF			|
-							fRTMP_ADAPTER_NIC_NOT_EXIST)
-							|| OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE)
-#ifdef RT2870
-							|| (pAd->EepromAccess)
-#endif
-							)
-		return;
+	struct rt_rtmp_adapter *pAd = (struct rt_rtmp_adapter *)FunctionContext;
+	u8 BBPR3 = 0;
+	char larger = -127, rssi0, rssi1, rssi2;
 
-	{
+	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RESET_IN_PROGRESS |
+			   fRTMP_ADAPTER_HALT_IN_PROGRESS |
+			   fRTMP_ADAPTER_RADIO_OFF |
+			   fRTMP_ADAPTER_NIC_NOT_EXIST) ||
+	    OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE)
 #ifdef RT30xx
-		if (pAd->NicConfig2.field.AntDiversity)
-		{
-			if ((pAd->RxAnt.RcvPktNumWhenEvaluate != 0) && (pAd->RxAnt.Pair1AvgRssi[pAd->RxAnt.Pair1SecondaryRxAnt] >= pAd->RxAnt.Pair1AvgRssi[pAd->RxAnt.Pair1PrimaryRxAnt]))
-			{
-				UCHAR			temp;
-
-				//
-				// select PrimaryRxAntPair
-				//    Role change, Used Pair1SecondaryRxAnt as PrimaryRxAntPair.
-				//    Since Pair1SecondaryRxAnt Quality good than Pair1PrimaryRxAnt
-				//
-				temp = pAd->RxAnt.Pair1PrimaryRxAnt;
-				pAd->RxAnt.Pair1PrimaryRxAnt = pAd->RxAnt.Pair1SecondaryRxAnt;
-				pAd->RxAnt.Pair1SecondaryRxAnt = temp;
-
-				pAd->RxAnt.Pair1LastAvgRssi = (pAd->RxAnt.Pair1AvgRssi[pAd->RxAnt.Pair1SecondaryRxAnt] >> 3);
-				pAd->RxAnt.EvaluateStableCnt = 0;
-			}
-			else
-			{
-				// if the evaluated antenna is not better than original, switch back to original antenna
-				AsicSetRxAnt(pAd, pAd->RxAnt.Pair1PrimaryRxAnt);
-				pAd->RxAnt.EvaluateStableCnt ++;
-			}
-
-			pAd->RxAnt.EvaluatePeriod = 0; // 1:Means switch to SecondaryRxAnt, 0:Means switch to Pair1PrimaryRxAnt
+	    || (pAd->EepromAccess)
+#endif /* RT30xx // */
+#ifdef RT3090
+	    || (pAd->bPCIclkOff == TRUE)
+#endif /* RT3090 // */
+	    )
+		return;
 
-			DBGPRINT(RT_DEBUG_TRACE,("AsicRxAntEvalAction::After Eval(fix in #%d), <%d, %d>, RcvPktNumWhenEvaluate=%ld\n",
-					pAd->RxAnt.Pair1PrimaryRxAnt, (pAd->RxAnt.Pair1AvgRssi[0] >> 3), (pAd->RxAnt.Pair1AvgRssi[1] >> 3), pAd->RxAnt.RcvPktNumWhenEvaluate));
-		}
-		else
-#endif
+	{
+		/*if (pAd->StaCfg.Psm == PWR_SAVE) */
+		/*      return; */
 		{
 			if (pAd->StaCfg.Psm == PWR_SAVE)
 				return;
 
-			// if the traffic is low, use average rssi as the criteria
-			if (pAd->Mlme.bLowThroughput == TRUE)
-			{
+			/* if the traffic is low, use average rssi as the criteria */
+			if (pAd->Mlme.bLowThroughput == TRUE) {
 				rssi0 = pAd->StaCfg.RssiSample.LastRssi0;
 				rssi1 = pAd->StaCfg.RssiSample.LastRssi1;
 				rssi2 = pAd->StaCfg.RssiSample.LastRssi2;
-			}
-			else
-			{
+			} else {
 				rssi0 = pAd->StaCfg.RssiSample.AvgRssi0;
 				rssi1 = pAd->StaCfg.RssiSample.AvgRssi1;
 				rssi2 = pAd->StaCfg.RssiSample.AvgRssi2;
 			}
 
-			if(pAd->Antenna.field.RxPath == 3)
-			{
+			if (pAd->Antenna.field.RxPath == 3) {
 				larger = max(rssi0, rssi1);
 
 				if (larger > (rssi2 + 20))
 					pAd->Mlme.RealRxPath = 2;
 				else
 					pAd->Mlme.RealRxPath = 3;
-			}
-			else if(pAd->Antenna.field.RxPath == 2)
-			{
+			} else if (pAd->Antenna.field.RxPath == 2) {
 				if (rssi0 > (rssi1 + 20))
 					pAd->Mlme.RealRxPath = 1;
 				else
@@ -8248,39 +5729,45 @@ VOID AsicRxAntEvalTimeout(
 
 			RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R3, &BBPR3);
 			BBPR3 &= (~0x18);
-			if(pAd->Mlme.RealRxPath == 3)
-			{
+			if (pAd->Mlme.RealRxPath == 3) {
 				BBPR3 |= (0x10);
-			}
-			else if(pAd->Mlme.RealRxPath == 2)
-			{
+			} else if (pAd->Mlme.RealRxPath == 2) {
 				BBPR3 |= (0x8);
-			}
-			else if(pAd->Mlme.RealRxPath == 1)
-			{
+			} else if (pAd->Mlme.RealRxPath == 1) {
 				BBPR3 |= (0x0);
 			}
 			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R3, BBPR3);
-#ifdef RT2860
+#ifdef RTMP_MAC_PCI
 			pAd->StaCfg.BBPR3 = BBPR3;
-#endif
+#endif /* RTMP_MAC_PCI // */
 		}
 	}
+
 }
 
-VOID APSDPeriodicExec(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3)
+void APSDPeriodicExec(void *SystemSpecific1,
+		      void *FunctionContext,
+		      void *SystemSpecific2, void *SystemSpecific3)
 {
-	RTMP_ADAPTER *pAd = (RTMP_ADAPTER *)FunctionContext;
+	struct rt_rtmp_adapter *pAd = (struct rt_rtmp_adapter *)FunctionContext;
 
 	if (!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED))
 		return;
 
 	pAd->CommonCfg.TriggerTimerCount++;
 
+/* Driver should not send trigger frame, it should be send by application layer */
+/*
+	if (pAd->CommonCfg.bAPSDCapable && pAd->CommonCfg.APEdcaParm.bAPSDCapable
+		&& (pAd->CommonCfg.bNeedSendTriggerFrame ||
+		(((pAd->CommonCfg.TriggerTimerCount%20) == 19) && (!pAd->CommonCfg.bAPSDAC_BE || !pAd->CommonCfg.bAPSDAC_BK || !pAd->CommonCfg.bAPSDAC_VI || !pAd->CommonCfg.bAPSDAC_VO))))
+	{
+		DBGPRINT(RT_DEBUG_TRACE,("Sending trigger frame and enter service period when support APSD\n"));
+		RTMPSendNullFrame(pAd, pAd->CommonCfg.TxRate, TRUE);
+		pAd->CommonCfg.bNeedSendTriggerFrame = FALSE;
+		pAd->CommonCfg.TriggerTimerCount = 0;
+		pAd->CommonCfg.bInServicePeriod = TRUE;
+	}*/
 }
 
 /*
@@ -8297,11 +5784,9 @@ VOID APSDPeriodicExec(
 
     ========================================================================
 */
-VOID RTMPSetPiggyBack(
-    IN PRTMP_ADAPTER    pAd,
-    IN BOOLEAN          bPiggyBack)
+void RTMPSetPiggyBack(struct rt_rtmp_adapter *pAd, IN BOOLEAN bPiggyBack)
 {
-	TX_LINK_CFG_STRUC  TxLinkCfg;
+	TX_LINK_CFG_STRUC TxLinkCfg;
 
 	RTMP_IO_READ32(pAd, TX_LINK_CFG, &TxLinkCfg.word);
 
@@ -8324,36 +5809,32 @@ VOID RTMPSetPiggyBack(
 
     ========================================================================
 */
-BOOLEAN RTMPCheckEntryEnableAutoRateSwitch(
-	IN PRTMP_ADAPTER    pAd,
-	IN PMAC_TABLE_ENTRY	pEntry)
+BOOLEAN RTMPCheckEntryEnableAutoRateSwitch(struct rt_rtmp_adapter *pAd,
+					   struct rt_mac_table_entry *pEntry)
 {
-	BOOLEAN		result = TRUE;
+	BOOLEAN result = TRUE;
 
 	{
-		// only associated STA counts
-		if (pEntry && (pEntry->ValidAsCLI) && (pEntry->Sst == SST_ASSOC))
-		{
+		/* only associated STA counts */
+		if (pEntry && (pEntry->ValidAsCLI)
+		    && (pEntry->Sst == SST_ASSOC)) {
 			result = pAd->StaCfg.bAutoTxRateSwitch;
-		}
-		else
+		} else
 			result = FALSE;
 	}
 
 	return result;
 }
 
-
-BOOLEAN RTMPAutoRateSwitchCheck(
-	IN PRTMP_ADAPTER    pAd)
+BOOLEAN RTMPAutoRateSwitchCheck(struct rt_rtmp_adapter *pAd)
 {
-	if (pAd->StaCfg.bAutoTxRateSwitch)
-		return TRUE;
-
+	{
+		if (pAd->StaCfg.bAutoTxRateSwitch)
+			return TRUE;
+	}
 	return FALSE;
 }
 
-
 /*
     ========================================================================
     Routine Description:
@@ -8369,13 +5850,15 @@ BOOLEAN RTMPAutoRateSwitchCheck(
 
     ========================================================================
 */
-UCHAR RTMPStaFixedTxMode(
-	IN PRTMP_ADAPTER    pAd,
-	IN PMAC_TABLE_ENTRY	pEntry)
+u8 RTMPStaFixedTxMode(struct rt_rtmp_adapter *pAd, struct rt_mac_table_entry *pEntry)
 {
-	UCHAR	tx_mode = FIXED_TXMODE_HT;
+	u8 tx_mode = FIXED_TXMODE_HT;
 
-	tx_mode = (UCHAR)pAd->StaCfg.DesiredTransmitSetting.field.FixedTxMode;
+	{
+		tx_mode =
+		    (u8)pAd->StaCfg.DesiredTransmitSetting.field.
+		    FixedTxMode;
+	}
 
 	return tx_mode;
 }
@@ -8395,9 +5878,7 @@ UCHAR RTMPStaFixedTxMode(
 
     ========================================================================
 */
-VOID RTMPUpdateLegacyTxSetting(
-		UCHAR				fixed_tx_mode,
-		PMAC_TABLE_ENTRY	pEntry)
+void RTMPUpdateLegacyTxSetting(u8 fixed_tx_mode, struct rt_mac_table_entry *pEntry)
 {
 	HTTRANSMIT_SETTING TransmitSetting;
 
@@ -8409,26 +5890,24 @@ VOID RTMPUpdateLegacyTxSetting(
 	TransmitSetting.field.MODE = pEntry->HTPhyMode.field.MODE;
 	TransmitSetting.field.MCS = pEntry->HTPhyMode.field.MCS;
 
-	if (fixed_tx_mode == FIXED_TXMODE_CCK)
-	{
+	if (fixed_tx_mode == FIXED_TXMODE_CCK) {
 		TransmitSetting.field.MODE = MODE_CCK;
-		// CCK mode allow MCS 0~3
+		/* CCK mode allow MCS 0~3 */
 		if (TransmitSetting.field.MCS > MCS_3)
 			TransmitSetting.field.MCS = MCS_3;
-	}
-	else
-	{
+	} else {
 		TransmitSetting.field.MODE = MODE_OFDM;
-		// OFDM mode allow MCS 0~7
+		/* OFDM mode allow MCS 0~7 */
 		if (TransmitSetting.field.MCS > MCS_7)
 			TransmitSetting.field.MCS = MCS_7;
 	}
 
-	if (pEntry->HTPhyMode.field.MODE >= TransmitSetting.field.MODE)
-	{
+	if (pEntry->HTPhyMode.field.MODE >= TransmitSetting.field.MODE) {
 		pEntry->HTPhyMode.word = TransmitSetting.word;
-		DBGPRINT(RT_DEBUG_TRACE, ("RTMPUpdateLegacyTxSetting : wcid-%d, MODE=%s, MCS=%d \n",
-				pEntry->Aid, GetPhyMode(pEntry->HTPhyMode.field.MODE), pEntry->HTPhyMode.field.MCS));
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("RTMPUpdateLegacyTxSetting : wcid-%d, MODE=%s, MCS=%d \n",
+			  pEntry->Aid, GetPhyMode(pEntry->HTPhyMode.field.MODE),
+			  pEntry->HTPhyMode.field.MCS));
 	}
 }
 
@@ -8442,381 +5921,150 @@ VOID RTMPUpdateLegacyTxSetting(
 
 	==========================================================================
  */
-VOID AsicStaBbpTuning(
-	IN PRTMP_ADAPTER pAd)
+void AsicStaBbpTuning(struct rt_rtmp_adapter *pAd)
 {
-	UCHAR	OrigR66Value = 0, R66;//, R66UpperBound = 0x30, R66LowerBound = 0x30;
-	CHAR	Rssi;
+	u8 OrigR66Value = 0, R66;	/*, R66UpperBound = 0x30, R66LowerBound = 0x30; */
+	char Rssi;
 
-	// 2860C did not support Fase CCA, therefore can't tune
+	/* 2860C did not support Fase CCA, therefore can't tune */
 	if (pAd->MACVersion == 0x28600100)
 		return;
 
-	//
-	// work as a STA
-	//
-	if (pAd->Mlme.CntlMachine.CurrState != CNTL_IDLE)  // no R66 tuning when SCANNING
+	/* */
+	/* work as a STA */
+	/* */
+	if (pAd->Mlme.CntlMachine.CurrState != CNTL_IDLE)	/* no R66 tuning when SCANNING */
 		return;
 
 	if ((pAd->OpMode == OPMODE_STA)
-		&& (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED)
-			)
-		&& !(OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE))
-#ifdef RT2860
-		&& (pAd->bPCIclkOff == FALSE))
-#endif
-#ifdef RT2870
-		)
-#endif
-	{
+	    && (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED)
+	    )
+	    && !(OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE))
+#ifdef RTMP_MAC_PCI
+	    && (pAd->bPCIclkOff == FALSE)
+#endif /* RTMP_MAC_PCI // */
+	    ) {
 		RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R66, &OrigR66Value);
 		R66 = OrigR66Value;
 
 		if (pAd->Antenna.field.RxPath > 1)
-			Rssi = (pAd->StaCfg.RssiSample.AvgRssi0 + pAd->StaCfg.RssiSample.AvgRssi1) >> 1;
+			Rssi =
+			    (pAd->StaCfg.RssiSample.AvgRssi0 +
+			     pAd->StaCfg.RssiSample.AvgRssi1) >> 1;
 		else
 			Rssi = pAd->StaCfg.RssiSample.AvgRssi0;
 
-		if (pAd->LatchRfRegs.Channel <= 14)
-		{	//BG band
-#ifdef RT2870
-			// RT3070 is a no LNA solution, it should have different control regarding to AGC gain control
-			// Otherwise, it will have some throughput side effect when low RSSI
-			if (IS_RT30xx(pAd))
-			{
-				if (Rssi > RSSI_FOR_MID_LOW_SENSIBILITY)
-				{
-					R66 = 0x1C + 2*GET_LNA_GAIN(pAd) + 0x20;
-					if (OrigR66Value != R66)
-						RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R66, R66);
-				}
-				else
-				{
-					R66 = 0x1C + 2*GET_LNA_GAIN(pAd);
-					if (OrigR66Value != R66)
-						RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R66, R66);
+		if (pAd->LatchRfRegs.Channel <= 14) {	/*BG band */
+#ifdef RT30xx
+			/* RT3070 is a no LNA solution, it should have different control regarding to AGC gain control */
+			/* Otherwise, it will have some throughput side effect when low RSSI */
+
+			if (IS_RT3070(pAd) || IS_RT3090(pAd) || IS_RT3572(pAd)
+			    || IS_RT3390(pAd)) {
+				if (Rssi > RSSI_FOR_MID_LOW_SENSIBILITY) {
+					R66 =
+					    0x1C + 2 * GET_LNA_GAIN(pAd) + 0x20;
+					if (OrigR66Value != R66) {
+						RTMP_BBP_IO_WRITE8_BY_REG_ID
+						    (pAd, BBP_R66, R66);
+					}
+				} else {
+					R66 = 0x1C + 2 * GET_LNA_GAIN(pAd);
+					if (OrigR66Value != R66) {
+						RTMP_BBP_IO_WRITE8_BY_REG_ID
+						    (pAd, BBP_R66, R66);
+					}
 				}
-			}
-			else
-#endif // RT2870 //
+			} else
+#endif /* RT30xx // */
 			{
-				if (Rssi > RSSI_FOR_MID_LOW_SENSIBILITY)
-				{
+				if (Rssi > RSSI_FOR_MID_LOW_SENSIBILITY) {
 					R66 = (0x2E + GET_LNA_GAIN(pAd)) + 0x10;
-					if (OrigR66Value != R66)
-					{
-						RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R66, R66);
+					if (OrigR66Value != R66) {
+						RTMP_BBP_IO_WRITE8_BY_REG_ID
+						    (pAd, BBP_R66, R66);
 					}
-				}
-				else
-				{
+				} else {
 					R66 = 0x2E + GET_LNA_GAIN(pAd);
-					if (OrigR66Value != R66)
-					{
-						RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R66, R66);
+					if (OrigR66Value != R66) {
+						RTMP_BBP_IO_WRITE8_BY_REG_ID
+						    (pAd, BBP_R66, R66);
 					}
 				}
 			}
-		}
-		else
-		{	//A band
-			if (pAd->CommonCfg.BBPCurrentBW == BW_20)
-			{
-				if (Rssi > RSSI_FOR_MID_LOW_SENSIBILITY)
-				{
-					R66 = 0x32 + (GET_LNA_GAIN(pAd)*5)/3 + 0x10;
-					if (OrigR66Value != R66)
-					{
-						RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R66, R66);
+		} else {	/*A band */
+			if (pAd->CommonCfg.BBPCurrentBW == BW_20) {
+				if (Rssi > RSSI_FOR_MID_LOW_SENSIBILITY) {
+					R66 =
+					    0x32 + (GET_LNA_GAIN(pAd) * 5) / 3 +
+					    0x10;
+					if (OrigR66Value != R66) {
+						RTMP_BBP_IO_WRITE8_BY_REG_ID
+						    (pAd, BBP_R66, R66);
 					}
-				}
-				else
-				{
-					R66 = 0x32 + (GET_LNA_GAIN(pAd)*5)/3;
-					if (OrigR66Value != R66)
-					{
-						RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R66, R66);
+				} else {
+					R66 =
+					    0x32 + (GET_LNA_GAIN(pAd) * 5) / 3;
+					if (OrigR66Value != R66) {
+						RTMP_BBP_IO_WRITE8_BY_REG_ID
+						    (pAd, BBP_R66, R66);
 					}
 				}
-			}
-			else
-			{
-				if (Rssi > RSSI_FOR_MID_LOW_SENSIBILITY)
-				{
-					R66 = 0x3A + (GET_LNA_GAIN(pAd)*5)/3 + 0x10;
-					if (OrigR66Value != R66)
-					{
-						RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R66, R66);
+			} else {
+				if (Rssi > RSSI_FOR_MID_LOW_SENSIBILITY) {
+					R66 =
+					    0x3A + (GET_LNA_GAIN(pAd) * 5) / 3 +
+					    0x10;
+					if (OrigR66Value != R66) {
+						RTMP_BBP_IO_WRITE8_BY_REG_ID
+						    (pAd, BBP_R66, R66);
 					}
-				}
-				else
-				{
-					R66 = 0x3A + (GET_LNA_GAIN(pAd)*5)/3;
-					if (OrigR66Value != R66)
-					{
-						RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R66, R66);
+				} else {
+					R66 =
+					    0x3A + (GET_LNA_GAIN(pAd) * 5) / 3;
+					if (OrigR66Value != R66) {
+						RTMP_BBP_IO_WRITE8_BY_REG_ID
+						    (pAd, BBP_R66, R66);
 					}
 				}
 			}
 		}
 
-
 	}
 }
 
-#ifdef RT2860
-VOID AsicResetFromDMABusy(
-	IN PRTMP_ADAPTER pAd)
+void RTMPSetAGCInitValue(struct rt_rtmp_adapter *pAd, u8 BandWidth)
 {
-	UINT32		Data;
-	BOOLEAN		bCtrl = FALSE;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("--->  AsicResetFromDMABusy  !!!!!!!!!!!!!!!!!!!!!!! \n"));
+	u8 R66 = 0x30;
 
-	// Be sure restore link control value so we can write register.
-	RTMP_CLEAR_PSFLAG(pAd, fRTMP_PS_CAN_GO_SLEEP);
-	if (RTMP_TEST_PSFLAG(pAd, fRTMP_PS_SET_PCI_CLK_OFF_COMMAND))
-	{
-		DBGPRINT(RT_DEBUG_TRACE,("AsicResetFromDMABusy==>\n"));
-		RTMPPCIeLinkCtrlValueRestore(pAd, RESTORE_HALT);
-		RTMPusecDelay(6000);
-		pAd->bPCIclkOff = FALSE;
-		bCtrl = TRUE;
-	}
-	// Reset DMA
-	RTMP_IO_READ32(pAd, PBF_SYS_CTRL, &Data);
-	Data |= 0x2;
-	RTMP_IO_WRITE32(pAd, PBF_SYS_CTRL, Data);
-
-	// After Reset DMA, DMA index will become Zero. So Driver need to reset all ring indexs too.
-	// Reset DMA/CPU ring index
-	RTMPRingCleanUp(pAd, QID_AC_BK);
-	RTMPRingCleanUp(pAd, QID_AC_BE);
-	RTMPRingCleanUp(pAd, QID_AC_VI);
-	RTMPRingCleanUp(pAd, QID_AC_VO);
-	RTMPRingCleanUp(pAd, QID_HCCA);
-	RTMPRingCleanUp(pAd, QID_MGMT);
-	RTMPRingCleanUp(pAd, QID_RX);
-
-	// Clear Reset
-	RTMP_IO_READ32(pAd, PBF_SYS_CTRL, &Data);
-	Data &= 0xfffffffd;
-	RTMP_IO_WRITE32(pAd, PBF_SYS_CTRL, Data);
-
-	// If in Radio off, should call RTMPPCIePowerLinkCtrl again.
-	if ((bCtrl == TRUE) && (pAd->StaCfg.bRadio == FALSE))
-		RTMPPCIeLinkCtrlSetting(pAd, 3);
-
-	RTMP_SET_PSFLAG(pAd, fRTMP_PS_CAN_GO_SLEEP);
-	RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST | fRTMP_ADAPTER_HALT_IN_PROGRESS);
-	DBGPRINT(RT_DEBUG_TRACE, ("<---  AsicResetFromDMABusy !!!!!!!!!!!!!!!!!!!!!!!  \n"));
-}
-
-VOID AsicResetBBP(
-	IN PRTMP_ADAPTER pAd)
-{
-	DBGPRINT(RT_DEBUG_TRACE, ("--->  Asic HardReset BBP  !!!!!!!!!!!!!!!!!!!!!!! \n"));
-
-	RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, 0x0);
-	RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, 0x2);
-	RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, 0xc);
-
-	// After hard-reset BBP, initialize all BBP values.
-	NICRestoreBBPValue(pAd);
-	DBGPRINT(RT_DEBUG_TRACE, ("<---  Asic HardReset BBP !!!!!!!!!!!!!!!!!!!!!!!  \n"));
-}
-
-VOID AsicResetMAC(
-	IN PRTMP_ADAPTER pAd)
-{
-	ULONG		Data;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("--->  AsicResetMAC   !!!! \n"));
-	RTMP_IO_READ32(pAd, PBF_SYS_CTRL, &Data);
-	Data |= 0x4;
-	RTMP_IO_WRITE32(pAd, PBF_SYS_CTRL, Data);
-	Data &= 0xfffffffb;
-	RTMP_IO_WRITE32(pAd, PBF_SYS_CTRL, Data);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("<---  AsicResetMAC   !!!! \n"));
-}
-
-VOID AsicResetPBF(
-	IN PRTMP_ADAPTER pAd)
-{
-	ULONG		Value1, Value2;
-	ULONG		Data;
-
-	RTMP_IO_READ32(pAd, TXRXQ_PCNT, &Value1);
-	RTMP_IO_READ32(pAd, PBF_DBG, &Value2);
-
-	Value2 &= 0xff;
-	// sum should be equals to 0xff, which is the total buffer size.
-	if ((Value1 + Value2) < 0xff)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("--->  Asic HardReset PBF !!!! \n"));
-		RTMP_IO_READ32(pAd, PBF_SYS_CTRL, &Data);
-		Data |= 0x8;
-		RTMP_IO_WRITE32(pAd, PBF_SYS_CTRL, Data);
-		Data &= 0xfffffff7;
-		RTMP_IO_WRITE32(pAd, PBF_SYS_CTRL, Data);
-
-		DBGPRINT(RT_DEBUG_TRACE, ("<---  Asic HardReset PBF !!!! \n"));
-	}
-}
-#endif /* RT2860 */
-
-VOID RTMPSetAGCInitValue(
-	IN PRTMP_ADAPTER	pAd,
-	IN UCHAR			BandWidth)
-{
-	UCHAR	R66 = 0x30;
+	if (pAd->LatchRfRegs.Channel <= 14) {	/* BG band */
+#ifdef RT30xx
+		/* Gary was verified Amazon AP and find that RT307x has BBP_R66 invalid default value */
 
-	if (pAd->LatchRfRegs.Channel <= 14)
-	{	// BG band
-		R66 = 0x2E + GET_LNA_GAIN(pAd);
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R66, R66);
-	}
-	else
-	{	//A band
-		if (BandWidth == BW_20)
-		{
-			R66 = (UCHAR)(0x32 + (GET_LNA_GAIN(pAd)*5)/3);
+		if (IS_RT3070(pAd) || IS_RT3090(pAd) || IS_RT3572(pAd)
+		    || IS_RT3390(pAd)) {
+			R66 = 0x1C + 2 * GET_LNA_GAIN(pAd);
 			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R66, R66);
-		}
-		else
+		} else
+#endif /* RT30xx // */
 		{
-			R66 = (UCHAR)(0x3A + (GET_LNA_GAIN(pAd)*5)/3);
+			R66 = 0x2E + GET_LNA_GAIN(pAd);
 			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R66, R66);
 		}
-	}
-
-}
-
-VOID AsicTurnOffRFClk(
-	IN PRTMP_ADAPTER pAd,
-	IN	UCHAR		Channel)
-{
-
-	// RF R2 bit 18 = 0
-	UINT32			R1 = 0, R2 = 0, R3 = 0;
-	UCHAR			index;
-	RTMP_RF_REGS	*RFRegTable;
-
-	// The RF programming sequence is difference between 3xxx and 2xxx
-	if (IS_RT3090(pAd))
-	{
-		RT30xxLoadRFSleepModeSetup(pAd);  // add by johnli,  RF power sequence setup, load RF sleep-mode setup
-		return;
-	}
-
-	RFRegTable = RF2850RegTable;
-
-	switch (pAd->RfIcType)
-	{
-		case RFIC_2820:
-		case RFIC_2850:
-		case RFIC_2720:
-		case RFIC_2750:
-
-			for (index = 0; index < NUM_OF_2850_CHNL; index++)
-			{
-				if (Channel == RFRegTable[index].Channel)
-				{
-					R1 = RFRegTable[index].R1 & 0xffffdfff;
-					R2 = RFRegTable[index].R2 & 0xfffbffff;
-					R3 = RFRegTable[index].R3 & 0xfff3ffff;
-
-					RTMP_RF_IO_WRITE32(pAd, R1);
-					RTMP_RF_IO_WRITE32(pAd, R2);
-
-					// Program R1b13 to 1, R3/b18,19 to 0, R2b18 to 0.
-					// Set RF R2 bit18=0, R3 bit[18:19]=0
-					//if (pAd->StaCfg.bRadio == FALSE)
-					if (1)
-					{
-						RTMP_RF_IO_WRITE32(pAd, R3);
-
-						DBGPRINT(RT_DEBUG_TRACE, ("AsicTurnOffRFClk#%d(RF=%d, ) , R2=0x%08x,  R3 = 0x%08x \n",
-							Channel, pAd->RfIcType, R2, R3));
-					}
-					else
-						DBGPRINT(RT_DEBUG_TRACE, ("AsicTurnOffRFClk#%d(RF=%d, ) , R2=0x%08x \n",
-							Channel, pAd->RfIcType, R2));
-					break;
-				}
+	} else {		/*A band */
+		{
+			if (BandWidth == BW_20) {
+				R66 =
+				    (u8)(0x32 +
+					     (GET_LNA_GAIN(pAd) * 5) / 3);
+				RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R66, R66);
+			} else {
+				R66 =
+				    (u8)(0x3A +
+					     (GET_LNA_GAIN(pAd) * 5) / 3);
+				RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R66, R66);
 			}
-			break;
-
-		default:
-			break;
-	}
-}
-
-
-VOID AsicTurnOnRFClk(
-	IN PRTMP_ADAPTER pAd,
-	IN	UCHAR			Channel)
-{
-
-	// RF R2 bit 18 = 0
-	UINT32			R1 = 0, R2 = 0, R3 = 0;
-	UCHAR			index;
-	RTMP_RF_REGS	*RFRegTable;
-
-	// The RF programming sequence is difference between 3xxx and 2xxx
-	if (IS_RT3090(pAd))
-		return;
-
-	RFRegTable = RF2850RegTable;
-
-	switch (pAd->RfIcType)
-	{
-		case RFIC_2820:
-		case RFIC_2850:
-		case RFIC_2720:
-		case RFIC_2750:
-
-			for (index = 0; index < NUM_OF_2850_CHNL; index++)
-			{
-				if (Channel == RFRegTable[index].Channel)
-				{
-					R3 = pAd->LatchRfRegs.R3;
-					R3 &= 0xfff3ffff;
-					R3 |= 0x00080000;
-					RTMP_RF_IO_WRITE32(pAd, R3);
-
-					R1 = RFRegTable[index].R1;
-					RTMP_RF_IO_WRITE32(pAd, R1);
-
-					R2 = RFRegTable[index].R2;
-					if (pAd->Antenna.field.TxPath == 1)
-					{
-						R2 |= 0x4000;	// If TXpath is 1, bit 14 = 1;
-					}
-
-					if (pAd->Antenna.field.RxPath == 2)
-					{
-						R2 |= 0x40;	// write 1 to off Rxpath.
-					}
-					else if (pAd->Antenna.field.RxPath == 1)
-					{
-						R2 |= 0x20040;	// write 1 to off RxPath
-					}
-					RTMP_RF_IO_WRITE32(pAd, R2);
-
-					break;
-				}
-			}
-			break;
-
-		default:
-			break;
+		}
 	}
 
-	DBGPRINT(RT_DEBUG_TRACE, ("AsicTurnOnRFClk#%d(RF=%d, ) , R2=0x%08x\n",
-		Channel,
-		pAd->RfIcType,
-		R2));
 }
-
diff --git a/drivers/staging/rt2860/common/rt_channel.c b/drivers/staging/rt2860/common/rt_channel.c
new file mode 100644
index 000000000000..538798981177
--- /dev/null
+++ b/drivers/staging/rt2860/common/rt_channel.c
@@ -0,0 +1,1705 @@
+/*
+ *************************************************************************
+ * Ralink Tech Inc.
+ * 5F., No.36, Taiyuan St., Jhubei City,
+ * Hsinchu County 302,
+ * Taiwan, R.O.C.
+ *
+ * (c) Copyright 2002-2007, Ralink Technology, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify  *
+ * it under the terms of the GNU General Public License as published by  *
+ * the Free Software Foundation; either version 2 of the License, or     *
+ * (at your option) any later version.                                   *
+ *                                                                       *
+ * This program is distributed in the hope that it will be useful,       *
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
+ * GNU General Public License for more details.                          *
+ *                                                                       *
+ * You should have received a copy of the GNU General Public License     *
+ * along with this program; if not, write to the                         *
+ * Free Software Foundation, Inc.,                                       *
+ * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
+ *                                                                       *
+ *************************************************************************
+*/
+#include "../rt_config.h"
+
+struct rt_ch_freq_map CH_HZ_ID_MAP[] = {
+	{1, 2412}
+	,
+	{2, 2417}
+	,
+	{3, 2422}
+	,
+	{4, 2427}
+	,
+	{5, 2432}
+	,
+	{6, 2437}
+	,
+	{7, 2442}
+	,
+	{8, 2447}
+	,
+	{9, 2452}
+	,
+	{10, 2457}
+	,
+	{11, 2462}
+	,
+	{12, 2467}
+	,
+	{13, 2472}
+	,
+	{14, 2484}
+	,
+
+	/*  UNII */
+	{36, 5180}
+	,
+	{40, 5200}
+	,
+	{44, 5220}
+	,
+	{48, 5240}
+	,
+	{52, 5260}
+	,
+	{56, 5280}
+	,
+	{60, 5300}
+	,
+	{64, 5320}
+	,
+	{149, 5745}
+	,
+	{153, 5765}
+	,
+	{157, 5785}
+	,
+	{161, 5805}
+	,
+	{165, 5825}
+	,
+	{167, 5835}
+	,
+	{169, 5845}
+	,
+	{171, 5855}
+	,
+	{173, 5865}
+	,
+
+	/* HiperLAN2 */
+	{100, 5500}
+	,
+	{104, 5520}
+	,
+	{108, 5540}
+	,
+	{112, 5560}
+	,
+	{116, 5580}
+	,
+	{120, 5600}
+	,
+	{124, 5620}
+	,
+	{128, 5640}
+	,
+	{132, 5660}
+	,
+	{136, 5680}
+	,
+	{140, 5700}
+	,
+
+	/* Japan MMAC */
+	{34, 5170}
+	,
+	{38, 5190}
+	,
+	{42, 5210}
+	,
+	{46, 5230}
+	,
+
+	/*  Japan */
+	{184, 4920}
+	,
+	{188, 4940}
+	,
+	{192, 4960}
+	,
+	{196, 4980}
+	,
+
+	{208, 5040}
+	,			/* Japan, means J08 */
+	{212, 5060}
+	,			/* Japan, means J12 */
+	{216, 5080}
+	,			/* Japan, means J16 */
+};
+
+int CH_HZ_ID_MAP_NUM = (sizeof(CH_HZ_ID_MAP) / sizeof(struct rt_ch_freq_map));
+
+struct rt_ch_region ChRegion[] = {
+	{			/* Antigua and Berbuda */
+	 "AG",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 23, BOTH, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 23, BOTH, FALSE}
+	  ,			/* 5G, ch 52~64 */
+	  {100, 11, 30, BOTH, FALSE}
+	  ,			/* 5G, ch 100~140 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Argentina */
+	 "AR",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {52, 4, 24, BOTH, FALSE}
+	  ,			/* 5G, ch 52~64 */
+	  {149, 4, 30, BOTH, FALSE}
+	  ,			/* 5G, ch 149~161 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Aruba */
+	 "AW",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 23, BOTH, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 23, BOTH, FALSE}
+	  ,			/* 5G, ch 52~64 */
+	  {100, 11, 30, BOTH, FALSE}
+	  ,			/* 5G, ch 100~140 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Australia */
+	 "AU",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 23, BOTH, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 24, BOTH, FALSE}
+	  ,			/* 5G, ch 52~64 */
+	  {149, 5, 30, BOTH, FALSE}
+	  ,			/* 5G, ch 149~165 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Austria */
+	 "AT",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 23, IDOR, TRUE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 23, IDOR, TRUE}
+	  ,			/* 5G, ch 52~64 */
+	  {100, 11, 30, BOTH, TRUE}
+	  ,			/* 5G, ch 100~140 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Bahamas */
+	 "BS",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 23, BOTH, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 24, BOTH, FALSE}
+	  ,			/* 5G, ch 52~64 */
+	  {149, 5, 30, BOTH, FALSE}
+	  ,			/* 5G, ch 149~165 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Barbados */
+	 "BB",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 23, BOTH, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 24, BOTH, FALSE}
+	  ,			/* 5G, ch 52~64 */
+	  {100, 11, 30, BOTH, FALSE}
+	  ,			/* 5G, ch 100~140 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Bermuda */
+	 "BM",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 23, BOTH, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 24, BOTH, FALSE}
+	  ,			/* 5G, ch 52~64 */
+	  {100, 11, 30, BOTH, FALSE}
+	  ,			/* 5G, ch 100~140 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Brazil */
+	 "BR",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 23, BOTH, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 24, BOTH, FALSE}
+	  ,			/* 5G, ch 52~64 */
+	  {100, 11, 24, BOTH, FALSE}
+	  ,			/* 5G, ch 100~140 */
+	  {149, 5, 30, BOTH, FALSE}
+	  ,			/* 5G, ch 100~140 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Belgium */
+	 "BE",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 18, IDOR, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 18, IDOR, FALSE}
+	  ,			/* 5G, ch 52~64 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Bulgaria */
+	 "BG",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 23, IDOR, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 23, IDOR, TRUE}
+	  ,			/* 5G, ch 52~64 */
+	  {100, 11, 30, ODOR, TRUE}
+	  ,			/* 5G, ch 100~140 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Canada */
+	 "CA",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 23, BOTH, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 23, BOTH, FALSE}
+	  ,			/* 5G, ch 52~64 */
+	  {149, 5, 30, BOTH, FALSE}
+	  ,			/* 5G, ch 149~165 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Cayman IsLands */
+	 "KY",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 23, BOTH, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 24, BOTH, FALSE}
+	  ,			/* 5G, ch 52~64 */
+	  {100, 11, 30, BOTH, FALSE}
+	  ,			/* 5G, ch 100~140 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Chile */
+	 "CL",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 20, BOTH, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 20, BOTH, FALSE}
+	  ,			/* 5G, ch 52~64 */
+	  {149, 5, 20, BOTH, FALSE}
+	  ,			/* 5G, ch 149~165 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* China */
+	 "CN",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {149, 4, 27, BOTH, FALSE}
+	  ,			/* 5G, ch 149~161 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Colombia */
+	 "CO",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 17, BOTH, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 24, BOTH, FALSE}
+	  ,			/* 5G, ch 52~64 */
+	  {100, 11, 30, BOTH, FALSE}
+	  ,			/* 5G, ch 100~140 */
+	  {149, 5, 30, BOTH, FALSE}
+	  ,			/* 5G, ch 149~165 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Costa Rica */
+	 "CR",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 17, BOTH, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 24, BOTH, FALSE}
+	  ,			/* 5G, ch 52~64 */
+	  {149, 4, 30, BOTH, FALSE}
+	  ,			/* 5G, ch 149~161 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Cyprus */
+	 "CY",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 23, IDOR, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 24, IDOR, TRUE}
+	  ,			/* 5G, ch 52~64 */
+	  {100, 11, 30, BOTH, TRUE}
+	  ,			/* 5G, ch 100~140 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Czech_Republic */
+	 "CZ",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 23, IDOR, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 23, IDOR, TRUE}
+	  ,			/* 5G, ch 52~64 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Denmark */
+	 "DK",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 23, IDOR, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 23, IDOR, TRUE}
+	  ,			/* 5G, ch 52~64 */
+	  {100, 11, 30, BOTH, TRUE}
+	  ,			/* 5G, ch 100~140 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Dominican Republic */
+	 "DO",
+	 CE,
+	 {
+	  {1, 0, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 0 */
+	  {149, 4, 20, BOTH, FALSE}
+	  ,			/* 5G, ch 149~161 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Equador */
+	 "EC",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {100, 11, 27, BOTH, FALSE}
+	  ,			/* 5G, ch 100~140 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* El Salvador */
+	 "SV",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 23, IDOR, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 30, BOTH, TRUE}
+	  ,			/* 5G, ch 52~64 */
+	  {149, 4, 36, BOTH, TRUE}
+	  ,			/* 5G, ch 149~165 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Finland */
+	 "FI",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 23, IDOR, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 23, IDOR, TRUE}
+	  ,			/* 5G, ch 52~64 */
+	  {100, 11, 30, BOTH, TRUE}
+	  ,			/* 5G, ch 100~140 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* France */
+	 "FR",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 23, IDOR, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 23, IDOR, TRUE}
+	  ,			/* 5G, ch 52~64 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Germany */
+	 "DE",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 23, IDOR, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 23, IDOR, TRUE}
+	  ,			/* 5G, ch 52~64 */
+	  {100, 11, 30, BOTH, TRUE}
+	  ,			/* 5G, ch 100~140 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Greece */
+	 "GR",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 23, IDOR, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 23, IDOR, TRUE}
+	  ,			/* 5G, ch 52~64 */
+	  {100, 11, 30, ODOR, TRUE}
+	  ,			/* 5G, ch 100~140 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Guam */
+	 "GU",
+	 CE,
+	 {
+	  {1, 11, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~11 */
+	  {36, 4, 17, BOTH, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 24, BOTH, FALSE}
+	  ,			/* 5G, ch 52~64 */
+	  {100, 11, 30, BOTH, FALSE}
+	  ,			/* 5G, ch 100~140 */
+	  {149, 5, 30, BOTH, FALSE}
+	  ,			/* 5G, ch 149~165 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Guatemala */
+	 "GT",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 17, BOTH, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 24, BOTH, FALSE}
+	  ,			/* 5G, ch 52~64 */
+	  {149, 4, 30, BOTH, FALSE}
+	  ,			/* 5G, ch 149~161 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Haiti */
+	 "HT",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 17, BOTH, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 24, BOTH, FALSE}
+	  ,			/* 5G, ch 52~64 */
+	  {149, 4, 30, BOTH, FALSE}
+	  ,			/* 5G, ch 149~161 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Honduras */
+	 "HN",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {149, 4, 27, BOTH, FALSE}
+	  ,			/* 5G, ch 149~161 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Hong Kong */
+	 "HK",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 23, IDOR, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 23, IDOR, FALSE}
+	  ,			/* 5G, ch 52~64 */
+	  {149, 4, 30, BOTH, FALSE}
+	  ,			/* 5G, ch 149~161 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Hungary */
+	 "HU",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 23, IDOR, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 23, IDOR, TRUE}
+	  ,			/* 5G, ch 52~64 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Iceland */
+	 "IS",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 23, IDOR, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 23, IDOR, TRUE}
+	  ,			/* 5G, ch 52~64 */
+	  {100, 11, 30, BOTH, TRUE}
+	  ,			/* 5G, ch 100~140 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* India */
+	 "IN",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {149, 4, 24, IDOR, FALSE}
+	  ,			/* 5G, ch 149~161 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Indonesia */
+	 "ID",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {149, 4, 27, BOTH, FALSE}
+	  ,			/* 5G, ch 149~161 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Ireland */
+	 "IE",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 23, IDOR, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 23, IDOR, TRUE}
+	  ,			/* 5G, ch 52~64 */
+	  {100, 11, 30, ODOR, TRUE}
+	  ,			/* 5G, ch 100~140 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Israel */
+	 "IL",
+	 CE,
+	 {
+	  {1, 3, 20, IDOR, FALSE}
+	  ,			/* 2.4 G, ch 1~3 */
+	  {4, 6, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 4~9 */
+	  {10, 4, 20, IDOR, FALSE}
+	  ,			/* 2.4 G, ch 10~13 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Italy */
+	 "IT",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 23, IDOR, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 23, IDOR, TRUE}
+	  ,			/* 5G, ch 52~64 */
+	  {100, 11, 30, ODOR, TRUE}
+	  ,			/* 5G, ch 100~140 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Japan */
+	 "JP",
+	 JAP,
+	 {
+	  {1, 14, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~14 */
+	  {36, 4, 23, IDOR, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Jordan */
+	 "JO",
+	 CE,
+	 {
+	  {1, 13, 20, IDOR, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 23, IDOR, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {149, 4, 23, IDOR, FALSE}
+	  ,			/* 5G, ch 149~161 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Latvia */
+	 "LV",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 23, IDOR, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 23, IDOR, TRUE}
+	  ,			/* 5G, ch 52~64 */
+	  {100, 11, 30, BOTH, TRUE}
+	  ,			/* 5G, ch 100~140 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Liechtenstein */
+	 "LI",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {52, 4, 23, IDOR, TRUE}
+	  ,			/* 5G, ch 52~64 */
+	  {100, 11, 30, BOTH, TRUE}
+	  ,			/* 5G, ch 100~140 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Lithuania */
+	 "LT",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 23, IDOR, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 23, IDOR, TRUE}
+	  ,			/* 5G, ch 52~64 */
+	  {100, 11, 30, BOTH, TRUE}
+	  ,			/* 5G, ch 100~140 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Luxemburg */
+	 "LU",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 23, IDOR, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 23, IDOR, TRUE}
+	  ,			/* 5G, ch 52~64 */
+	  {100, 11, 30, BOTH, TRUE}
+	  ,			/* 5G, ch 100~140 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Malaysia */
+	 "MY",
+	 CE,
+	 {
+	  {36, 4, 23, BOTH, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 23, BOTH, FALSE}
+	  ,			/* 5G, ch 52~64 */
+	  {149, 5, 20, BOTH, FALSE}
+	  ,			/* 5G, ch 149~165 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Malta */
+	 "MT",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 23, IDOR, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 23, IDOR, TRUE}
+	  ,			/* 5G, ch 52~64 */
+	  {100, 11, 30, BOTH, TRUE}
+	  ,			/* 5G, ch 100~140 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Marocco */
+	 "MA",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 24, IDOR, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Mexico */
+	 "MX",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 23, BOTH, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 24, BOTH, FALSE}
+	  ,			/* 5G, ch 52~64 */
+	  {149, 5, 30, IDOR, FALSE}
+	  ,			/* 5G, ch 149~165 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Netherlands */
+	 "NL",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 23, IDOR, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 24, IDOR, TRUE}
+	  ,			/* 5G, ch 52~64 */
+	  {100, 11, 30, BOTH, TRUE}
+	  ,			/* 5G, ch 100~140 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* New Zealand */
+	 "NZ",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 24, BOTH, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 24, BOTH, FALSE}
+	  ,			/* 5G, ch 52~64 */
+	  {149, 4, 30, BOTH, FALSE}
+	  ,			/* 5G, ch 149~161 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Norway */
+	 "NO",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 24, IDOR, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 24, IDOR, TRUE}
+	  ,			/* 5G, ch 52~64 */
+	  {100, 11, 30, BOTH, TRUE}
+	  ,			/* 5G, ch 149~161 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Peru */
+	 "PE",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {149, 4, 27, BOTH, FALSE}
+	  ,			/* 5G, ch 149~161 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Portugal */
+	 "PT",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 23, IDOR, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 23, IDOR, TRUE}
+	  ,			/* 5G, ch 52~64 */
+	  {100, 11, 30, BOTH, TRUE}
+	  ,			/* 5G, ch 100~140 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Poland */
+	 "PL",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 23, IDOR, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 23, IDOR, TRUE}
+	  ,			/* 5G, ch 52~64 */
+	  {100, 11, 30, BOTH, TRUE}
+	  ,			/* 5G, ch 100~140 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Romania */
+	 "RO",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 23, IDOR, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 23, IDOR, TRUE}
+	  ,			/* 5G, ch 52~64 */
+	  {100, 11, 30, BOTH, TRUE}
+	  ,			/* 5G, ch 100~140 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Russia */
+	 "RU",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {149, 4, 20, IDOR, FALSE}
+	  ,			/* 5G, ch 149~161 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Saudi Arabia */
+	 "SA",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 23, BOTH, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 23, BOTH, FALSE}
+	  ,			/* 5G, ch 52~64 */
+	  {149, 4, 23, BOTH, FALSE}
+	  ,			/* 5G, ch 149~161 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Serbia_and_Montenegro */
+	 "CS",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Singapore */
+	 "SG",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 23, BOTH, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 23, BOTH, FALSE}
+	  ,			/* 5G, ch 52~64 */
+	  {149, 4, 20, BOTH, FALSE}
+	  ,			/* 5G, ch 149~161 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Slovakia */
+	 "SK",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 23, IDOR, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 23, IDOR, TRUE}
+	  ,			/* 5G, ch 52~64 */
+	  {100, 11, 30, BOTH, TRUE}
+	  ,			/* 5G, ch 100~140 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Slovenia */
+	 "SI",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 23, IDOR, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 23, IDOR, TRUE}
+	  ,			/* 5G, ch 52~64 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* South Africa */
+	 "ZA",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 23, BOTH, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 23, IDOR, FALSE}
+	  ,			/* 5G, ch 52~64 */
+	  {100, 11, 30, BOTH, TRUE}
+	  ,			/* 5G, ch 100~140 */
+	  {149, 4, 30, BOTH, FALSE}
+	  ,			/* 5G, ch 149~161 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* South Korea */
+	 "KR",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 20, BOTH, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 20, BOTH, FALSE}
+	  ,			/* 5G, ch 52~64 */
+	  {100, 8, 20, BOTH, FALSE}
+	  ,			/* 5G, ch 100~128 */
+	  {149, 4, 20, BOTH, FALSE}
+	  ,			/* 5G, ch 149~161 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Spain */
+	 "ES",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 17, IDOR, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 23, IDOR, TRUE}
+	  ,			/* 5G, ch 52~64 */
+	  {100, 11, 30, BOTH, TRUE}
+	  ,			/* 5G, ch 100~140 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Sweden */
+	 "SE",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 23, IDOR, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 23, IDOR, TRUE}
+	  ,			/* 5G, ch 52~64 */
+	  {100, 11, 30, BOTH, TRUE}
+	  ,			/* 5G, ch 100~140 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Switzerland */
+	 "CH",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~13 */
+	  {36, 4, 23, IDOR, TRUE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 23, IDOR, TRUE}
+	  ,			/* 5G, ch 52~64 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Taiwan */
+	 "TW",
+	 CE,
+	 {
+	  {1, 11, 30, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~11 */
+	  {52, 4, 23, IDOR, FALSE}
+	  ,			/* 5G, ch 52~64 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Turkey */
+	 "TR",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~11 */
+	  {36, 4, 23, BOTH, FALSE}
+	  ,			/* 5G, ch 36~48 */
+	  {52, 4, 23, BOTH, FALSE}
+	  ,			/* 5G, ch 52~64 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* UK */
+	 "GB",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~11 */
+	  {36, 4, 23, IDOR, FALSE}
+	  ,			/* 5G, ch 52~64 */
+	  {52, 4, 23, IDOR, TRUE}
+	  ,			/* 5G, ch 52~64 */
+	  {100, 11, 30, BOTH, TRUE}
+	  ,			/* 5G, ch 100~140 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Ukraine */
+	 "UA",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~11 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* United_Arab_Emirates */
+	 "AE",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~11 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* United_States */
+	 "US",
+	 CE,
+	 {
+	  {1, 11, 30, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~11 */
+	  {36, 4, 17, IDOR, FALSE}
+	  ,			/* 5G, ch 52~64 */
+	  {52, 4, 24, BOTH, TRUE}
+	  ,			/* 5G, ch 52~64 */
+	  {100, 11, 30, BOTH, TRUE}
+	  ,			/* 5G, ch 100~140 */
+	  {149, 5, 30, BOTH, FALSE}
+	  ,			/* 5G, ch 149~165 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Venezuela */
+	 "VE",
+	 CE,
+	 {
+	  {1, 13, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~11 */
+	  {149, 4, 27, BOTH, FALSE}
+	  ,			/* 5G, ch 149~161 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+
+	{			/* Default */
+	 "",
+	 CE,
+	 {
+	  {1, 11, 20, BOTH, FALSE}
+	  ,			/* 2.4 G, ch 1~11 */
+	  {36, 4, 20, BOTH, FALSE}
+	  ,			/* 5G, ch 52~64 */
+	  {52, 4, 20, BOTH, FALSE}
+	  ,			/* 5G, ch 52~64 */
+	  {100, 11, 20, BOTH, FALSE}
+	  ,			/* 5G, ch 100~140 */
+	  {149, 5, 20, BOTH, FALSE}
+	  ,			/* 5G, ch 149~165 */
+	  {0}
+	  ,			/* end */
+	  }
+	 }
+	,
+};
+
+static struct rt_ch_region *GetChRegion(u8 *CntryCode)
+{
+	int loop = 0;
+	struct rt_ch_region *pChRegion = NULL;
+
+	while (strcmp((char *)ChRegion[loop].CountReg, "") != 0) {
+		if (strncmp
+		    ((char *)ChRegion[loop].CountReg, (char *)CntryCode,
+		     2) == 0) {
+			pChRegion = &ChRegion[loop];
+			break;
+		}
+		loop++;
+	}
+
+	if (pChRegion == NULL)
+		pChRegion = &ChRegion[loop];
+	return pChRegion;
+}
+
+static void ChBandCheck(u8 PhyMode, u8 *pChType)
+{
+	switch (PhyMode) {
+	case PHY_11A:
+	case PHY_11AN_MIXED:
+		*pChType = BAND_5G;
+		break;
+	case PHY_11ABG_MIXED:
+	case PHY_11AGN_MIXED:
+	case PHY_11ABGN_MIXED:
+		*pChType = BAND_BOTH;
+		break;
+
+	default:
+		*pChType = BAND_24G;
+		break;
+	}
+}
+
+static u8 FillChList(struct rt_rtmp_adapter *pAd,
+			struct rt_ch_desp *pChDesp,
+			u8 Offset, u8 increment)
+{
+	int i, j, l;
+	u8 channel;
+
+	j = Offset;
+	for (i = 0; i < pChDesp->NumOfCh; i++) {
+		channel = pChDesp->FirstChannel + i * increment;
+		for (l = 0; l < MAX_NUM_OF_CHANNELS; l++) {
+			if (channel == pAd->TxPower[l].Channel) {
+				pAd->ChannelList[j].Power =
+				    pAd->TxPower[l].Power;
+				pAd->ChannelList[j].Power2 =
+				    pAd->TxPower[l].Power2;
+				break;
+			}
+		}
+		if (l == MAX_NUM_OF_CHANNELS)
+			continue;
+
+		pAd->ChannelList[j].Channel =
+		    pChDesp->FirstChannel + i * increment;
+		pAd->ChannelList[j].MaxTxPwr = pChDesp->MaxTxPwr;
+		pAd->ChannelList[j].DfsReq = pChDesp->DfsReq;
+		j++;
+	}
+	pAd->ChannelListNum = j;
+
+	return j;
+}
+
+static inline void CreateChList(struct rt_rtmp_adapter *pAd,
+				struct rt_ch_region *pChRegion, u8 Geography)
+{
+	int i;
+	u8 offset = 0;
+	struct rt_ch_desp *pChDesp;
+	u8 ChType;
+	u8 increment;
+
+	if (pChRegion == NULL)
+		return;
+
+	ChBandCheck(pAd->CommonCfg.PhyMode, &ChType);
+
+	for (i = 0; i < 10; i++) {
+		pChDesp = &pChRegion->ChDesp[i];
+		if (pChDesp->FirstChannel == 0)
+			break;
+
+		if (ChType == BAND_5G) {
+			if (pChDesp->FirstChannel <= 14)
+				continue;
+		} else if (ChType == BAND_24G) {
+			if (pChDesp->FirstChannel > 14)
+				continue;
+		}
+
+		if ((pChDesp->Geography == BOTH)
+		    || (pChDesp->Geography == Geography)) {
+			if (pChDesp->FirstChannel > 14)
+				increment = 4;
+			else
+				increment = 1;
+			offset = FillChList(pAd, pChDesp, offset, increment);
+		}
+	}
+}
+
+void BuildChannelListEx(struct rt_rtmp_adapter *pAd)
+{
+	struct rt_ch_region *pChReg;
+
+	pChReg = GetChRegion(pAd->CommonCfg.CountryCode);
+	CreateChList(pAd, pChReg, pAd->CommonCfg.Geography);
+}
+
+void BuildBeaconChList(struct rt_rtmp_adapter *pAd,
+		       u8 *pBuf, unsigned long *pBufLen)
+{
+	int i;
+	unsigned long TmpLen;
+	struct rt_ch_region *pChRegion;
+	struct rt_ch_desp *pChDesp;
+	u8 ChType;
+
+	pChRegion = GetChRegion(pAd->CommonCfg.CountryCode);
+
+	if (pChRegion == NULL)
+		return;
+
+	ChBandCheck(pAd->CommonCfg.PhyMode, &ChType);
+	*pBufLen = 0;
+
+	for (i = 0; i < 10; i++) {
+		pChDesp = &pChRegion->ChDesp[i];
+		if (pChDesp->FirstChannel == 0)
+			break;
+
+		if (ChType == BAND_5G) {
+			if (pChDesp->FirstChannel <= 14)
+				continue;
+		} else if (ChType == BAND_24G) {
+			if (pChDesp->FirstChannel > 14)
+				continue;
+		}
+
+		if ((pChDesp->Geography == BOTH)
+		    || (pChDesp->Geography == pAd->CommonCfg.Geography)) {
+			MakeOutgoingFrame(pBuf + *pBufLen, &TmpLen,
+					  1, &pChDesp->FirstChannel,
+					  1, &pChDesp->NumOfCh,
+					  1, &pChDesp->MaxTxPwr, END_OF_ARGS);
+			*pBufLen += TmpLen;
+		}
+	}
+}
+
+static BOOLEAN IsValidChannel(struct rt_rtmp_adapter *pAd, u8 channel)
+{
+	int i;
+
+	for (i = 0; i < pAd->ChannelListNum; i++) {
+		if (pAd->ChannelList[i].Channel == channel)
+			break;
+	}
+
+	if (i == pAd->ChannelListNum)
+		return FALSE;
+	else
+		return TRUE;
+}
+
+static u8 GetExtCh(u8 Channel, u8 Direction)
+{
+	char ExtCh;
+
+	if (Direction == EXTCHA_ABOVE)
+		ExtCh = Channel + 4;
+	else
+		ExtCh = (Channel - 4) > 0 ? (Channel - 4) : 0;
+
+	return ExtCh;
+}
+
+void N_ChannelCheck(struct rt_rtmp_adapter *pAd)
+{
+	/*u8 ChannelNum = pAd->ChannelListNum; */
+	u8 Channel = pAd->CommonCfg.Channel;
+
+	if ((pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED)
+	    && (pAd->CommonCfg.RegTransmitSetting.field.BW == BW_40)) {
+		if (Channel > 14) {
+			if ((Channel == 36) || (Channel == 44)
+			    || (Channel == 52) || (Channel == 60)
+			    || (Channel == 100) || (Channel == 108)
+			    || (Channel == 116) || (Channel == 124)
+			    || (Channel == 132) || (Channel == 149)
+			    || (Channel == 157)) {
+				pAd->CommonCfg.RegTransmitSetting.field.EXTCHA =
+				    EXTCHA_ABOVE;
+			} else if ((Channel == 40) || (Channel == 48)
+				   || (Channel == 56) || (Channel == 64)
+				   || (Channel == 104) || (Channel == 112)
+				   || (Channel == 120) || (Channel == 128)
+				   || (Channel == 136) || (Channel == 153)
+				   || (Channel == 161)) {
+				pAd->CommonCfg.RegTransmitSetting.field.EXTCHA =
+				    EXTCHA_BELOW;
+			} else {
+				pAd->CommonCfg.RegTransmitSetting.field.BW =
+				    BW_20;
+			}
+		} else {
+			do {
+				u8 ExtCh;
+				u8 Dir =
+				    pAd->CommonCfg.RegTransmitSetting.field.
+				    EXTCHA;
+				ExtCh = GetExtCh(Channel, Dir);
+				if (IsValidChannel(pAd, ExtCh))
+					break;
+
+				Dir =
+				    (Dir ==
+				     EXTCHA_ABOVE) ? EXTCHA_BELOW :
+				    EXTCHA_ABOVE;
+				ExtCh = GetExtCh(Channel, Dir);
+				if (IsValidChannel(pAd, ExtCh)) {
+					pAd->CommonCfg.RegTransmitSetting.field.
+					    EXTCHA = Dir;
+					break;
+				}
+				pAd->CommonCfg.RegTransmitSetting.field.BW =
+				    BW_20;
+			} while (FALSE);
+
+			if (Channel == 14) {
+				pAd->CommonCfg.RegTransmitSetting.field.BW =
+				    BW_20;
+				/*pAd->CommonCfg.RegTransmitSetting.field.EXTCHA = EXTCHA_NONE; // We didn't set the ExtCh as NONE due to it'll set in RTMPSetHT() */
+			}
+		}
+	}
+
+}
+
+void N_SetCenCh(struct rt_rtmp_adapter *pAd)
+{
+	if (pAd->CommonCfg.RegTransmitSetting.field.BW == BW_40) {
+		if (pAd->CommonCfg.RegTransmitSetting.field.EXTCHA ==
+		    EXTCHA_ABOVE) {
+			pAd->CommonCfg.CentralChannel =
+			    pAd->CommonCfg.Channel + 2;
+		} else {
+			if (pAd->CommonCfg.Channel == 14)
+				pAd->CommonCfg.CentralChannel =
+				    pAd->CommonCfg.Channel - 1;
+			else
+				pAd->CommonCfg.CentralChannel =
+				    pAd->CommonCfg.Channel - 2;
+		}
+	} else {
+		pAd->CommonCfg.CentralChannel = pAd->CommonCfg.Channel;
+	}
+}
+
+u8 GetCuntryMaxTxPwr(struct rt_rtmp_adapter *pAd, u8 channel)
+{
+	int i;
+	for (i = 0; i < pAd->ChannelListNum; i++) {
+		if (pAd->ChannelList[i].Channel == channel)
+			break;
+	}
+
+	if (i == pAd->ChannelListNum)
+		return 0xff;
+	else
+		return pAd->ChannelList[i].MaxTxPwr;
+}
diff --git a/drivers/staging/rt3090/common/rt_rf.c b/drivers/staging/rt2860/common/rt_rf.c
index 9d638f71dbe5..519121d81040 100644
--- a/drivers/staging/rt3090/common/rt_rf.c
+++ b/drivers/staging/rt2860/common/rt_rf.c
@@ -37,7 +37,6 @@
 
 #include "../rt_config.h"
 
-
 #ifdef RTMP_RF_RW_SUPPORT
 /*
 	========================================================================
@@ -54,27 +53,26 @@
 
 	========================================================================
 */
-NDIS_STATUS RT30xxWriteRFRegister(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			regID,
-	IN	UCHAR			value)
+int RT30xxWriteRFRegister(struct rt_rtmp_adapter *pAd,
+				  u8 regID, u8 value)
 {
-	RF_CSR_CFG_STRUC	rfcsr;
-	UINT				i = 0;
+	RF_CSR_CFG_STRUC rfcsr;
+	u32 i = 0;
 
-	do
-	{
+	do {
 		RTMP_IO_READ32(pAd, RF_CSR_CFG, &rfcsr.word);
 
 		if (!rfcsr.field.RF_CSR_KICK)
 			break;
 		i++;
 	}
-	while ((i < RETRY_LIMIT) && (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)));
+	while ((i < RETRY_LIMIT)
+	       && (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)));
 
-	if ((i == RETRY_LIMIT) || (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)))
-	{
-		DBGPRINT_RAW(RT_DEBUG_ERROR, ("Retry count exhausted or device removed!!!\n"));
+	if ((i == RETRY_LIMIT)
+	    || (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST))) {
+		DBGPRINT_RAW(RT_DEBUG_ERROR,
+			     ("Retry count exhausted or device removed!\n"));
 		return STATUS_UNSUCCESSFUL;
 	}
 
@@ -88,7 +86,6 @@ NDIS_STATUS RT30xxWriteRFRegister(
 	return NDIS_STATUS_SUCCESS;
 }
 
-
 /*
 	========================================================================
 
@@ -104,20 +101,16 @@ NDIS_STATUS RT30xxWriteRFRegister(
 
 	========================================================================
 */
-NDIS_STATUS RT30xxReadRFRegister(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			regID,
-	IN	PUCHAR			pValue)
+int RT30xxReadRFRegister(struct rt_rtmp_adapter *pAd,
+				 u8 regID, u8 *pValue)
 {
-	RF_CSR_CFG_STRUC	rfcsr;
-	UINT				i=0, k=0;
+	RF_CSR_CFG_STRUC rfcsr;
+	u32 i = 0, k = 0;
 
-	for (i=0; i<MAX_BUSY_COUNT; i++)
-	{
+	for (i = 0; i < MAX_BUSY_COUNT; i++) {
 		RTMP_IO_READ32(pAd, RF_CSR_CFG, &rfcsr.word);
 
-		if (rfcsr.field.RF_CSR_KICK == BUSY)
-		{
+		if (rfcsr.field.RF_CSR_KICK == BUSY) {
 			continue;
 		}
 		rfcsr.word = 0;
@@ -125,42 +118,36 @@ NDIS_STATUS RT30xxReadRFRegister(
 		rfcsr.field.RF_CSR_KICK = 1;
 		rfcsr.field.TESTCSR_RFACC_REGNUM = regID;
 		RTMP_IO_WRITE32(pAd, RF_CSR_CFG, rfcsr.word);
-		for (k=0; k<MAX_BUSY_COUNT; k++)
-		{
+		for (k = 0; k < MAX_BUSY_COUNT; k++) {
 			RTMP_IO_READ32(pAd, RF_CSR_CFG, &rfcsr.word);
 
 			if (rfcsr.field.RF_CSR_KICK == IDLE)
 				break;
 		}
 		if ((rfcsr.field.RF_CSR_KICK == IDLE) &&
-			(rfcsr.field.TESTCSR_RFACC_REGNUM == regID))
-		{
-			*pValue = (UCHAR)rfcsr.field.RF_CSR_DATA;
+		    (rfcsr.field.TESTCSR_RFACC_REGNUM == regID)) {
+			*pValue = (u8)rfcsr.field.RF_CSR_DATA;
 			break;
 		}
 	}
-	if (rfcsr.field.RF_CSR_KICK == BUSY)
-	{
-		DBGPRINT_ERR(("RF read R%d=0x%x fail, i[%d], k[%d]\n", regID, rfcsr.word,i,k));
+	if (rfcsr.field.RF_CSR_KICK == BUSY) {
+		DBGPRINT_ERR(("RF read R%d=0x%x fail, i[%d], k[%d]\n", regID,
+			      rfcsr.word, i, k));
 		return STATUS_UNSUCCESSFUL;
 	}
 
 	return STATUS_SUCCESS;
 }
 
-
-VOID NICInitRFRegisters(
-	IN RTMP_ADAPTER *pAd)
+void NICInitRFRegisters(struct rt_rtmp_adapter *pAd)
 {
 	if (pAd->chipOps.AsicRfInit)
 		pAd->chipOps.AsicRfInit(pAd);
 }
 
-
-VOID RtmpChipOpsRFHook(
-	IN RTMP_ADAPTER *pAd)
+void RtmpChipOpsRFHook(struct rt_rtmp_adapter *pAd)
 {
-	RTMP_CHIP_OP *pChipOps = &pAd->chipOps;
+	struct rt_rtmp_chip_op *pChipOps = &pAd->chipOps;
 
 	pChipOps->pRFRegTable = NULL;
 	pChipOps->AsicRfInit = NULL;
@@ -168,34 +155,34 @@ VOID RtmpChipOpsRFHook(
 	pChipOps->AsicRfTurnOff = NULL;
 	pChipOps->AsicReverseRfFromSleepMode = NULL;
 	pChipOps->AsicHaltAction = NULL;
-#ifdef RT33xx
-if (IS_RT3390(pAd) && (pAd->infType == RTMP_DEV_INF_PCI))
-		{
-			pChipOps->pRFRegTable = RFRegTableOverRT3390;
-			pChipOps->AsicHaltAction = RT33xxHaltAction;
-			pChipOps->AsicRfTurnOff = RT33xxLoadRFSleepModeSetup;
-			pChipOps->AsicRfInit = NICInitRT3390RFRegisters;
-			pChipOps->AsicReverseRfFromSleepMode = RT33xxReverseRFSleepModeSetup;
-		}
-#else // RT33xx //
 	/* We depends on RfICType and MACVersion to assign the corresponding operation callbacks. */
 
 #ifdef RT30xx
-	if (IS_RT30xx(pAd))
-	{
+	if (IS_RT30xx(pAd)) {
 		pChipOps->pRFRegTable = RT30xx_RFRegTable;
 		pChipOps->AsicHaltAction = RT30xxHaltAction;
+#ifdef RT3070
+		if ((IS_RT3070(pAd) || IS_RT3071(pAd))
+		    && (pAd->infType == RTMP_DEV_INF_USB)) {
+			pChipOps->AsicRfInit = NICInitRT3070RFRegisters;
+			if (IS_RT3071(pAd)) {
+				pChipOps->AsicRfTurnOff =
+				    RT30xxLoadRFSleepModeSetup;
+				pChipOps->AsicReverseRfFromSleepMode =
+				    RT30xxReverseRFSleepModeSetup;
+			}
+		}
+#endif /* RT3070 // */
 #ifdef RT3090
-		if (IS_RT3090(pAd) && (pAd->infType == RTMP_DEV_INF_PCI))
-		{
+		if (IS_RT3090(pAd) && (pAd->infType == RTMP_DEV_INF_PCI)) {
 			pChipOps->AsicRfTurnOff = RT30xxLoadRFSleepModeSetup;
 			pChipOps->AsicRfInit = NICInitRT3090RFRegisters;
-			pChipOps->AsicReverseRfFromSleepMode = RT30xxReverseRFSleepModeSetup;
+			pChipOps->AsicReverseRfFromSleepMode =
+			    RT30xxReverseRFSleepModeSetup;
 		}
-#endif // RT3090 //
+#endif /* RT3090 // */
 	}
-#endif // RT30xx //
-#endif // RT33xx //
+#endif /* RT30xx // */
 }
 
-#endif // RTMP_RF_RW_SUPPORT //
+#endif /* RTMP_RF_RW_SUPPORT // */
diff --git a/drivers/staging/rt2860/common/rtmp_init.c b/drivers/staging/rt2860/common/rtmp_init.c
index 20c2ce26bc9d..21a95ffdfb86 100644
--- a/drivers/staging/rt2860/common/rtmp_init.c
+++ b/drivers/staging/rt2860/common/rtmp_init.c
@@ -33,172 +33,111 @@
 	Revision History:
 	Who         When          What
 	--------    ----------    ----------------------------------------------
-	Paul Lin    2002-08-01    created
-    John Chang  2004-08-20    RT2561/2661 use scatter-gather scheme
-    Jan Lee  2006-09-15    RT2860. Change for 802.11n , EEPROM, Led, BA, HT.
 */
 #include "../rt_config.h"
-#ifdef RT2860
-#include "firmware.h"
-#include <linux/bitrev.h>
-#endif
-#ifdef RT2870
-/* New firmware handles both RT2870 and RT3070. */
-#include "../../rt3070/firmware.h"
-#endif
-
-UCHAR    BIT8[] = {0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80};
-ULONG    BIT32[] = {0x00000001, 0x00000002, 0x00000004, 0x00000008,
-					0x00000010, 0x00000020, 0x00000040, 0x00000080,
-					0x00000100, 0x00000200, 0x00000400, 0x00000800,
-					0x00001000, 0x00002000, 0x00004000, 0x00008000,
-					0x00010000, 0x00020000, 0x00040000, 0x00080000,
-					0x00100000, 0x00200000, 0x00400000, 0x00800000,
-					0x01000000, 0x02000000, 0x04000000, 0x08000000,
-					0x10000000, 0x20000000, 0x40000000, 0x80000000};
-
-char*   CipherName[] = {"none","wep64","wep128","TKIP","AES","CKIP64","CKIP128"};
-
-//
-// BBP register initialization set
-//
-REG_PAIR   BBPRegTable[] = {
-	{BBP_R65,		0x2C},		// fix rssi issue
-	{BBP_R66,		0x38},	// Also set this default value to pAd->BbpTuning.R66CurrentValue at initial
-	{BBP_R69,		0x12},
-	{BBP_R70,		0xa},	// BBP_R70 will change to 0x8 in ApStartUp and LinkUp for rt2860C, otherwise value is 0xa
-	{BBP_R73,		0x10},
-	{BBP_R81,		0x37},
-	{BBP_R82,		0x62},
-	{BBP_R83,		0x6A},
-	{BBP_R84,		0x99},	// 0x19 is for rt2860E and after. This is for extension channel overlapping IOT. 0x99 is for rt2860D and before
-	{BBP_R86,		0x00},	// middle range issue, Rory @2008-01-28
-	{BBP_R91,		0x04},	// middle range issue, Rory @2008-01-28
-	{BBP_R92,		0x00},	// middle range issue, Rory @2008-01-28
-	{BBP_R103,  	0x00}, 	// near range high-power issue, requested from Gary @2008-0528
-	{BBP_R105,		0x05},	// 0x05 is for rt2860E to turn on FEQ control. It is safe for rt2860D and before, because Bit 7:2 are reserved in rt2860D and before.
-};
-#define	NUM_BBP_REG_PARMS	(sizeof(BBPRegTable) / sizeof(REG_PAIR))
-
-//
-// RF register initialization set
-//
-#ifdef RT2870
-REG_PAIR   RT30xx_RFRegTable[] = {
-        {RF_R04,          0x40},
-        {RF_R05,          0x03},
-        {RF_R06,          0x02},
-        {RF_R07,          0x70},
-        {RF_R09,          0x0F},
-        {RF_R10,          0x41},
-        {RF_R11,          0x21},
-        {RF_R12,          0x7B},
-        {RF_R14,          0x90},
-        {RF_R15,          0x58},
-        {RF_R16,          0xB3},
-        {RF_R17,          0x92},
-        {RF_R18,          0x2C},
-        {RF_R19,          0x02},
-        {RF_R20,          0xBA},
-        {RF_R21,          0xDB},
-        {RF_R24,          0x16},
-        {RF_R25,          0x01},
-        {RF_R29,          0x1F},
+
+u8 BIT8[] = { 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80 };
+char *CipherName[] =
+    { "none", "wep64", "wep128", "TKIP", "AES", "CKIP64", "CKIP128" };
+
+/* */
+/* BBP register initialization set */
+/* */
+struct rt_reg_pair BBPRegTable[] = {
+	{BBP_R65, 0x2C},	/* fix rssi issue */
+	{BBP_R66, 0x38},	/* Also set this default value to pAd->BbpTuning.R66CurrentValue at initial */
+	{BBP_R69, 0x12},
+	{BBP_R70, 0xa},		/* BBP_R70 will change to 0x8 in ApStartUp and LinkUp for rt2860C, otherwise value is 0xa */
+	{BBP_R73, 0x10},
+	{BBP_R81, 0x37},
+	{BBP_R82, 0x62},
+	{BBP_R83, 0x6A},
+	{BBP_R84, 0x99},	/* 0x19 is for rt2860E and after. This is for extension channel overlapping IOT. 0x99 is for rt2860D and before */
+	{BBP_R86, 0x00},	/* middle range issue, Rory @2008-01-28 */
+	{BBP_R91, 0x04},	/* middle range issue, Rory @2008-01-28 */
+	{BBP_R92, 0x00},	/* middle range issue, Rory @2008-01-28 */
+	{BBP_R103, 0x00},	/* near range high-power issue, requested from Gary @2008-0528 */
+	{BBP_R105, 0x05},	/* 0x05 is for rt2860E to turn on FEQ control. It is safe for rt2860D and before, because Bit 7:2 are reserved in rt2860D and before. */
+	{BBP_R106, 0x35},	/* for ShortGI throughput */
 };
-#define	NUM_RF_REG_PARMS	(sizeof(RT30xx_RFRegTable) / sizeof(REG_PAIR))
-#endif // RT2870 //
 
-//
-// ASIC register initialization sets
-//
+#define	NUM_BBP_REG_PARMS	(sizeof(BBPRegTable) / sizeof(struct rt_reg_pair))
+
+/* */
+/* ASIC register initialization sets */
+/* */
 
-RTMP_REG_PAIR	MACRegTable[] =	{
+struct rt_rtmp_reg_pair MACRegTable[] = {
 #if defined(HW_BEACON_OFFSET) && (HW_BEACON_OFFSET == 0x200)
-	{BCN_OFFSET0,			0xf8f0e8e0}, /* 0x3800(e0), 0x3A00(e8), 0x3C00(f0), 0x3E00(f8), 512B for each beacon */
-	{BCN_OFFSET1,			0x6f77d0c8}, /* 0x3200(c8), 0x3400(d0), 0x1DC0(77), 0x1BC0(6f), 512B for each beacon */
+	{BCN_OFFSET0, 0xf8f0e8e0},	/* 0x3800(e0), 0x3A00(e8), 0x3C00(f0), 0x3E00(f8), 512B for each beacon */
+	{BCN_OFFSET1, 0x6f77d0c8},	/* 0x3200(c8), 0x3400(d0), 0x1DC0(77), 0x1BC0(6f), 512B for each beacon */
 #elif defined(HW_BEACON_OFFSET) && (HW_BEACON_OFFSET == 0x100)
-	{BCN_OFFSET0,			0xece8e4e0}, /* 0x3800, 0x3A00, 0x3C00, 0x3E00, 512B for each beacon */
-	{BCN_OFFSET1,			0xfcf8f4f0}, /* 0x3800, 0x3A00, 0x3C00, 0x3E00, 512B for each beacon */
+	{BCN_OFFSET0, 0xece8e4e0},	/* 0x3800, 0x3A00, 0x3C00, 0x3E00, 512B for each beacon */
+	{BCN_OFFSET1, 0xfcf8f4f0},	/* 0x3800, 0x3A00, 0x3C00, 0x3E00, 512B for each beacon */
 #else
-    #error You must re-calculate new value for BCN_OFFSET0 & BCN_OFFSET1 in MACRegTable[]!!!
-#endif // HW_BEACON_OFFSET //
-
-	{LEGACY_BASIC_RATE,		0x0000013f}, //  Basic rate set bitmap
-	{HT_BASIC_RATE,		0x00008003}, // Basic HT rate set , 20M, MCS=3, MM. Format is the same as in TXWI.
-	{MAC_SYS_CTRL,		0x00}, // 0x1004, , default Disable RX
-	{RX_FILTR_CFG,		0x17f97}, //0x1400  , RX filter control,
-	{BKOFF_SLOT_CFG,	0x209}, // default set short slot time, CC_DELAY_TIME should be 2
-	{TX_SW_CFG0,		0x0}, 		// Gary,2008-05-21 for CWC test
-	{TX_SW_CFG1,		0x80606}, // Gary,2006-08-23
-	{TX_LINK_CFG,		0x1020},		// Gary,2006-08-23
-	{TX_TIMEOUT_CFG,	0x000a2090},	// CCK has some problem. So increase timieout value. 2006-10-09// MArvek RT , Modify for 2860E ,2007-08-01
-	{MAX_LEN_CFG,		MAX_AGGREGATION_SIZE | 0x00001000},	// 0x3018, MAX frame length. Max PSDU = 16kbytes.
-	{LED_CFG,		0x7f031e46}, // Gary, 2006-08-23
-	{PBF_MAX_PCNT,			0x1F3FBF9F}, 	//0x1F3f7f9f},		//Jan, 2006/04/20
-	{TX_RTY_CFG,			0x47d01f0f},	// Jan, 2006/11/16, Set TxWI->ACK =0 in Probe Rsp Modify for 2860E ,2007-08-03
-	{AUTO_RSP_CFG,			0x00000013},	// Initial Auto_Responder, because QA will turn off Auto-Responder
-	{CCK_PROT_CFG,			0x05740003 /*0x01740003*/},	// Initial Auto_Responder, because QA will turn off Auto-Responder. And RTS threshold is enabled.
-	{OFDM_PROT_CFG,			0x05740003 /*0x01740003*/},	// Initial Auto_Responder, because QA will turn off Auto-Responder. And RTS threshold is enabled.
-//PS packets use Tx1Q (for HCCA) when dequeue from PS unicast queue (WiFi WPA2 MA9_DT1 for Marvell B STA)
-#ifdef RT2870
-	{PBF_CFG, 				0xf40006}, 		// Only enable Queue 2
-	{MM40_PROT_CFG,			0x3F44084},		// Initial Auto_Responder, because QA will turn off Auto-Responder
-	{WPDMA_GLO_CFG,			0x00000030},
-#endif // RT2870 //
-	{GF20_PROT_CFG,			0x01744004},    // set 19:18 --> Short NAV for MIMO PS
-	{GF40_PROT_CFG,			0x03F44084},
-	{MM20_PROT_CFG,			0x01744004},
-#ifdef RT2860
-	{MM40_PROT_CFG,			0x03F54084},
-#endif
-	{TXOP_CTRL_CFG,			0x0000583f, /*0x0000243f*/ /*0x000024bf*/},	//Extension channel backoff.
-	{TX_RTS_CFG,			0x00092b20},
-	{EXP_ACK_TIME,			0x002400ca},	// default value
-	{TXOP_HLDR_ET, 			0x00000002},
+#error You must re-calculate new value for BCN_OFFSET0 & BCN_OFFSET1 in MACRegTable[]!
+#endif /* HW_BEACON_OFFSET // */
+
+	{LEGACY_BASIC_RATE, 0x0000013f},	/*  Basic rate set bitmap */
+	{HT_BASIC_RATE, 0x00008003},	/* Basic HT rate set , 20M, MCS=3, MM. Format is the same as in TXWI. */
+	{MAC_SYS_CTRL, 0x00},	/* 0x1004, , default Disable RX */
+	{RX_FILTR_CFG, 0x17f97},	/*0x1400  , RX filter control, */
+	{BKOFF_SLOT_CFG, 0x209},	/* default set short slot time, CC_DELAY_TIME should be 2 */
+	/*{TX_SW_CFG0,          0x40a06}, // Gary,2006-08-23 */
+	{TX_SW_CFG0, 0x0},	/* Gary,2008-05-21 for CWC test */
+	{TX_SW_CFG1, 0x80606},	/* Gary,2006-08-23 */
+	{TX_LINK_CFG, 0x1020},	/* Gary,2006-08-23 */
+	/*{TX_TIMEOUT_CFG,      0x00182090},    // CCK has some problem. So increase timieout value. 2006-10-09// MArvek RT */
+	{TX_TIMEOUT_CFG, 0x000a2090},	/* CCK has some problem. So increase timieout value. 2006-10-09// MArvek RT , Modify for 2860E ,2007-08-01 */
+	{MAX_LEN_CFG, MAX_AGGREGATION_SIZE | 0x00001000},	/* 0x3018, MAX frame length. Max PSDU = 16kbytes. */
+	{LED_CFG, 0x7f031e46},	/* Gary, 2006-08-23 */
+
+	{PBF_MAX_PCNT, 0x1F3FBF9F},	/*0x1F3f7f9f},          //Jan, 2006/04/20 */
+
+	{TX_RTY_CFG, 0x47d01f0f},	/* Jan, 2006/11/16, Set TxWI->ACK =0 in Probe Rsp Modify for 2860E ,2007-08-03 */
+
+	{AUTO_RSP_CFG, 0x00000013},	/* Initial Auto_Responder, because QA will turn off Auto-Responder */
+	{CCK_PROT_CFG, 0x05740003 /*0x01740003 */ },	/* Initial Auto_Responder, because QA will turn off Auto-Responder. And RTS threshold is enabled. */
+	{OFDM_PROT_CFG, 0x05740003 /*0x01740003 */ },	/* Initial Auto_Responder, because QA will turn off Auto-Responder. And RTS threshold is enabled. */
+#ifdef RTMP_MAC_USB
+	{PBF_CFG, 0xf40006},	/* Only enable Queue 2 */
+	{MM40_PROT_CFG, 0x3F44084},	/* Initial Auto_Responder, because QA will turn off Auto-Responder */
+	{WPDMA_GLO_CFG, 0x00000030},
+#endif /* RTMP_MAC_USB // */
+	{GF20_PROT_CFG, 0x01744004},	/* set 19:18 --> Short NAV for MIMO PS */
+	{GF40_PROT_CFG, 0x03F44084},
+	{MM20_PROT_CFG, 0x01744004},
+#ifdef RTMP_MAC_PCI
+	{MM40_PROT_CFG, 0x03F54084},
+#endif /* RTMP_MAC_PCI // */
+	{TXOP_CTRL_CFG, 0x0000583f, /*0x0000243f *//*0x000024bf */ },	/*Extension channel backoff. */
+	{TX_RTS_CFG, 0x00092b20},
+	{EXP_ACK_TIME, 0x002400ca},	/* default value */
+
+	{TXOP_HLDR_ET, 0x00000002},
 
 	/* Jerry comments 2008/01/16: we use SIFS = 10us in CCK defaultly, but it seems that 10us
-		is too small for INTEL 2200bg card, so in MBSS mode, the delta time between beacon0
-		and beacon1 is SIFS (10us), so if INTEL 2200bg card connects to BSS0, the ping
-		will always lost. So we change the SIFS of CCK from 10us to 16us. */
-	{XIFS_TIME_CFG,			0x33a41010},
-	{PWR_PIN_CFG,			0x00000003},	// patch for 2880-E
+	   is too small for INTEL 2200bg card, so in MBSS mode, the delta time between beacon0
+	   and beacon1 is SIFS (10us), so if INTEL 2200bg card connects to BSS0, the ping
+	   will always lost. So we change the SIFS of CCK from 10us to 16us. */
+	{XIFS_TIME_CFG, 0x33a41010},
+	{PWR_PIN_CFG, 0x00000003},	/* patch for 2880-E */
 };
 
-RTMP_REG_PAIR	STAMACRegTable[] =	{
-	{WMM_AIFSN_CFG,		0x00002273},
-	{WMM_CWMIN_CFG,	0x00002344},
-	{WMM_CWMAX_CFG,	0x000034aa},
+struct rt_rtmp_reg_pair STAMACRegTable[] = {
+	{WMM_AIFSN_CFG, 0x00002273},
+	{WMM_CWMIN_CFG, 0x00002344},
+	{WMM_CWMAX_CFG, 0x000034aa},
 };
 
-#define	NUM_MAC_REG_PARMS		(sizeof(MACRegTable) / sizeof(RTMP_REG_PAIR))
-#define	NUM_STA_MAC_REG_PARMS	(sizeof(STAMACRegTable) / sizeof(RTMP_REG_PAIR))
-
-#ifdef RT2870
-//
-// RT2870 Firmware Spec only used 1 oct for version expression
-//
-#define FIRMWARE_MINOR_VERSION	7
-
-#endif // RT2870 //
-
-// New 8k byte firmware size for RT3071/RT3072
-#define FIRMWAREIMAGE_MAX_LENGTH	0x2000
-#define FIRMWAREIMAGE_LENGTH		(sizeof (FirmwareImage) / sizeof(UCHAR))
-#define FIRMWARE_MAJOR_VERSION	0
-
-#define FIRMWAREIMAGEV1_LENGTH	0x1000
-#define FIRMWAREIMAGEV2_LENGTH	0x1000
-
-#ifdef RT2860
-#define FIRMWARE_MINOR_VERSION	2
-#endif
-
+#define	NUM_MAC_REG_PARMS		(sizeof(MACRegTable) / sizeof(struct rt_rtmp_reg_pair))
+#define	NUM_STA_MAC_REG_PARMS	(sizeof(STAMACRegTable) / sizeof(struct rt_rtmp_reg_pair))
 
 /*
 	========================================================================
 
 	Routine Description:
-		Allocate RTMP_ADAPTER data block and do some initialization
+		Allocate struct rt_rtmp_adapter data block and do some initialization
 
 	Arguments:
 		Adapter		Pointer to our adapter
@@ -213,48 +152,48 @@ RTMP_REG_PAIR	STAMACRegTable[] =	{
 
 	========================================================================
 */
-NDIS_STATUS	RTMPAllocAdapterBlock(
-	IN  PVOID	handle,
-	OUT	PRTMP_ADAPTER	*ppAdapter)
+int RTMPAllocAdapterBlock(void *handle,
+				  struct rt_rtmp_adapter * * ppAdapter)
 {
-	PRTMP_ADAPTER	pAd;
-	NDIS_STATUS		Status;
-	INT 			index;
-	UCHAR			*pBeaconBuf = NULL;
+	struct rt_rtmp_adapter *pAd;
+	int Status;
+	int index;
+	u8 *pBeaconBuf = NULL;
 
 	DBGPRINT(RT_DEBUG_TRACE, ("--> RTMPAllocAdapterBlock\n"));
 
 	*ppAdapter = NULL;
 
-	do
-	{
-		// Allocate RTMP_ADAPTER memory block
+	do {
+		/* Allocate struct rt_rtmp_adapter memory block */
 		pBeaconBuf = kmalloc(MAX_BEACON_SIZE, MEM_ALLOC_FLAG);
-		if (pBeaconBuf == NULL)
-		{
+		if (pBeaconBuf == NULL) {
 			Status = NDIS_STATUS_FAILURE;
 			DBGPRINT_ERR(("Failed to allocate memory - BeaconBuf!\n"));
 			break;
 		}
+		NdisZeroMemory(pBeaconBuf, MAX_BEACON_SIZE);
 
-		Status = AdapterBlockAllocateMemory(handle, (PVOID *)&pAd);
-		if (Status != NDIS_STATUS_SUCCESS)
-		{
+		Status = AdapterBlockAllocateMemory(handle, (void **) & pAd);
+		if (Status != NDIS_STATUS_SUCCESS) {
 			DBGPRINT_ERR(("Failed to allocate memory - ADAPTER\n"));
 			break;
 		}
 		pAd->BeaconBuf = pBeaconBuf;
-		printk("\n\n=== pAd = %p, size = %d ===\n\n", pAd, (UINT32)sizeof(RTMP_ADAPTER));
-
+		DBGPRINT(RT_DEBUG_OFF,
+			 ("=== pAd = %p, size = %d ===\n", pAd,
+			  (u32)sizeof(struct rt_rtmp_adapter)));
 
-		// Init spin locks
+		/* Init spin locks */
 		NdisAllocateSpinLock(&pAd->MgmtRingLock);
-#ifdef RT2860
+#ifdef RTMP_MAC_PCI
 		NdisAllocateSpinLock(&pAd->RxRingLock);
-#endif
+#ifdef RT3090
+		NdisAllocateSpinLock(&pAd->McuCmdLock);
+#endif /* RT3090 // */
+#endif /* RTMP_MAC_PCI // */
 
-		for (index =0 ; index < NUM_OF_TX_RING; index++)
-		{
+		for (index = 0; index < NUM_OF_TX_RING; index++) {
 			NdisAllocateSpinLock(&pAd->TxSwQueueLock[index]);
 			NdisAllocateSpinLock(&pAd->DeQueueLock[index]);
 			pAd->DeQueueRunning[index] = FALSE;
@@ -291,518 +230,199 @@ NDIS_STATUS	RTMPAllocAdapterBlock(
 
 	========================================================================
 */
-VOID	RTMPReadTxPwrPerRate(
-	IN	PRTMP_ADAPTER	pAd)
+void RTMPReadTxPwrPerRate(struct rt_rtmp_adapter *pAd)
 {
-	ULONG		data, Adata, Gdata;
-	USHORT		i, value, value2;
-	INT			Apwrdelta, Gpwrdelta;
-	UCHAR		t1,t2,t3,t4;
-	BOOLEAN		bValid, bApwrdeltaMinus = TRUE, bGpwrdeltaMinus = TRUE;
-
-	//
-	// Get power delta for 20MHz and 40MHz.
-	//
+	unsigned long data, Adata, Gdata;
+	u16 i, value, value2;
+	int Apwrdelta, Gpwrdelta;
+	u8 t1, t2, t3, t4;
+	BOOLEAN bApwrdeltaMinus = TRUE, bGpwrdeltaMinus = TRUE;
+
+	/* */
+	/* Get power delta for 20MHz and 40MHz. */
+	/* */
 	DBGPRINT(RT_DEBUG_TRACE, ("Txpower per Rate\n"));
 	RT28xx_EEPROM_READ16(pAd, EEPROM_TXPOWER_DELTA, value2);
 	Apwrdelta = 0;
 	Gpwrdelta = 0;
 
-	if ((value2 & 0xff) != 0xff)
-	{
+	if ((value2 & 0xff) != 0xff) {
 		if ((value2 & 0x80))
-			Gpwrdelta = (value2&0xf);
+			Gpwrdelta = (value2 & 0xf);
 
 		if ((value2 & 0x40))
 			bGpwrdeltaMinus = FALSE;
 		else
 			bGpwrdeltaMinus = TRUE;
 	}
-	if ((value2 & 0xff00) != 0xff00)
-	{
+	if ((value2 & 0xff00) != 0xff00) {
 		if ((value2 & 0x8000))
-			Apwrdelta = ((value2&0xf00)>>8);
+			Apwrdelta = ((value2 & 0xf00) >> 8);
 
 		if ((value2 & 0x4000))
 			bApwrdeltaMinus = FALSE;
 		else
 			bApwrdeltaMinus = TRUE;
 	}
-	DBGPRINT(RT_DEBUG_TRACE, ("Gpwrdelta = %x, Apwrdelta = %x .\n", Gpwrdelta, Apwrdelta));
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("Gpwrdelta = %x, Apwrdelta = %x .\n", Gpwrdelta, Apwrdelta));
 
-	//
-	// Get Txpower per MCS for 20MHz in 2.4G.
-	//
-	for (i=0; i<5; i++)
-	{
-		RT28xx_EEPROM_READ16(pAd, EEPROM_TXPOWER_BYRATE_20MHZ_2_4G + i*4, value);
+	/* */
+	/* Get Txpower per MCS for 20MHz in 2.4G. */
+	/* */
+	for (i = 0; i < 5; i++) {
+		RT28xx_EEPROM_READ16(pAd,
+				     EEPROM_TXPOWER_BYRATE_20MHZ_2_4G + i * 4,
+				     value);
 		data = value;
-		if (bApwrdeltaMinus == FALSE)
-		{
-			t1 = (value&0xf)+(Apwrdelta);
+		if (bApwrdeltaMinus == FALSE) {
+			t1 = (value & 0xf) + (Apwrdelta);
 			if (t1 > 0xf)
 				t1 = 0xf;
-			t2 = ((value&0xf0)>>4)+(Apwrdelta);
+			t2 = ((value & 0xf0) >> 4) + (Apwrdelta);
 			if (t2 > 0xf)
 				t2 = 0xf;
-			t3 = ((value&0xf00)>>8)+(Apwrdelta);
+			t3 = ((value & 0xf00) >> 8) + (Apwrdelta);
 			if (t3 > 0xf)
 				t3 = 0xf;
-			t4 = ((value&0xf000)>>12)+(Apwrdelta);
+			t4 = ((value & 0xf000) >> 12) + (Apwrdelta);
 			if (t4 > 0xf)
 				t4 = 0xf;
-		}
-		else
-		{
-			if ((value&0xf) > Apwrdelta)
-				t1 = (value&0xf)-(Apwrdelta);
+		} else {
+			if ((value & 0xf) > Apwrdelta)
+				t1 = (value & 0xf) - (Apwrdelta);
 			else
 				t1 = 0;
-			if (((value&0xf0)>>4) > Apwrdelta)
-				t2 = ((value&0xf0)>>4)-(Apwrdelta);
+			if (((value & 0xf0) >> 4) > Apwrdelta)
+				t2 = ((value & 0xf0) >> 4) - (Apwrdelta);
 			else
 				t2 = 0;
-			if (((value&0xf00)>>8) > Apwrdelta)
-				t3 = ((value&0xf00)>>8)-(Apwrdelta);
+			if (((value & 0xf00) >> 8) > Apwrdelta)
+				t3 = ((value & 0xf00) >> 8) - (Apwrdelta);
 			else
 				t3 = 0;
-			if (((value&0xf000)>>12) > Apwrdelta)
-				t4 = ((value&0xf000)>>12)-(Apwrdelta);
+			if (((value & 0xf000) >> 12) > Apwrdelta)
+				t4 = ((value & 0xf000) >> 12) - (Apwrdelta);
 			else
 				t4 = 0;
 		}
-		Adata = t1 + (t2<<4) + (t3<<8) + (t4<<12);
-		if (bGpwrdeltaMinus == FALSE)
-		{
-			t1 = (value&0xf)+(Gpwrdelta);
+		Adata = t1 + (t2 << 4) + (t3 << 8) + (t4 << 12);
+		if (bGpwrdeltaMinus == FALSE) {
+			t1 = (value & 0xf) + (Gpwrdelta);
 			if (t1 > 0xf)
 				t1 = 0xf;
-			t2 = ((value&0xf0)>>4)+(Gpwrdelta);
+			t2 = ((value & 0xf0) >> 4) + (Gpwrdelta);
 			if (t2 > 0xf)
 				t2 = 0xf;
-			t3 = ((value&0xf00)>>8)+(Gpwrdelta);
+			t3 = ((value & 0xf00) >> 8) + (Gpwrdelta);
 			if (t3 > 0xf)
 				t3 = 0xf;
-			t4 = ((value&0xf000)>>12)+(Gpwrdelta);
+			t4 = ((value & 0xf000) >> 12) + (Gpwrdelta);
 			if (t4 > 0xf)
 				t4 = 0xf;
-		}
-		else
-		{
-			if ((value&0xf) > Gpwrdelta)
-				t1 = (value&0xf)-(Gpwrdelta);
+		} else {
+			if ((value & 0xf) > Gpwrdelta)
+				t1 = (value & 0xf) - (Gpwrdelta);
 			else
 				t1 = 0;
-			if (((value&0xf0)>>4) > Gpwrdelta)
-				t2 = ((value&0xf0)>>4)-(Gpwrdelta);
+			if (((value & 0xf0) >> 4) > Gpwrdelta)
+				t2 = ((value & 0xf0) >> 4) - (Gpwrdelta);
 			else
 				t2 = 0;
-			if (((value&0xf00)>>8) > Gpwrdelta)
-				t3 = ((value&0xf00)>>8)-(Gpwrdelta);
+			if (((value & 0xf00) >> 8) > Gpwrdelta)
+				t3 = ((value & 0xf00) >> 8) - (Gpwrdelta);
 			else
 				t3 = 0;
-			if (((value&0xf000)>>12) > Gpwrdelta)
-				t4 = ((value&0xf000)>>12)-(Gpwrdelta);
+			if (((value & 0xf000) >> 12) > Gpwrdelta)
+				t4 = ((value & 0xf000) >> 12) - (Gpwrdelta);
 			else
 				t4 = 0;
 		}
-		Gdata = t1 + (t2<<4) + (t3<<8) + (t4<<12);
+		Gdata = t1 + (t2 << 4) + (t3 << 8) + (t4 << 12);
 
-		RT28xx_EEPROM_READ16(pAd, EEPROM_TXPOWER_BYRATE_20MHZ_2_4G + i*4 + 2, value);
-		if (bApwrdeltaMinus == FALSE)
-		{
-			t1 = (value&0xf)+(Apwrdelta);
+		RT28xx_EEPROM_READ16(pAd,
+				     EEPROM_TXPOWER_BYRATE_20MHZ_2_4G + i * 4 +
+				     2, value);
+		if (bApwrdeltaMinus == FALSE) {
+			t1 = (value & 0xf) + (Apwrdelta);
 			if (t1 > 0xf)
 				t1 = 0xf;
-			t2 = ((value&0xf0)>>4)+(Apwrdelta);
+			t2 = ((value & 0xf0) >> 4) + (Apwrdelta);
 			if (t2 > 0xf)
 				t2 = 0xf;
-			t3 = ((value&0xf00)>>8)+(Apwrdelta);
+			t3 = ((value & 0xf00) >> 8) + (Apwrdelta);
 			if (t3 > 0xf)
 				t3 = 0xf;
-			t4 = ((value&0xf000)>>12)+(Apwrdelta);
+			t4 = ((value & 0xf000) >> 12) + (Apwrdelta);
 			if (t4 > 0xf)
 				t4 = 0xf;
-		}
-		else
-		{
-			if ((value&0xf) > Apwrdelta)
-				t1 = (value&0xf)-(Apwrdelta);
+		} else {
+			if ((value & 0xf) > Apwrdelta)
+				t1 = (value & 0xf) - (Apwrdelta);
 			else
 				t1 = 0;
-			if (((value&0xf0)>>4) > Apwrdelta)
-				t2 = ((value&0xf0)>>4)-(Apwrdelta);
+			if (((value & 0xf0) >> 4) > Apwrdelta)
+				t2 = ((value & 0xf0) >> 4) - (Apwrdelta);
 			else
 				t2 = 0;
-			if (((value&0xf00)>>8) > Apwrdelta)
-				t3 = ((value&0xf00)>>8)-(Apwrdelta);
+			if (((value & 0xf00) >> 8) > Apwrdelta)
+				t3 = ((value & 0xf00) >> 8) - (Apwrdelta);
 			else
 				t3 = 0;
-			if (((value&0xf000)>>12) > Apwrdelta)
-				t4 = ((value&0xf000)>>12)-(Apwrdelta);
+			if (((value & 0xf000) >> 12) > Apwrdelta)
+				t4 = ((value & 0xf000) >> 12) - (Apwrdelta);
 			else
 				t4 = 0;
 		}
-		Adata |= ((t1<<16) + (t2<<20) + (t3<<24) + (t4<<28));
-		if (bGpwrdeltaMinus == FALSE)
-		{
-			t1 = (value&0xf)+(Gpwrdelta);
+		Adata |= ((t1 << 16) + (t2 << 20) + (t3 << 24) + (t4 << 28));
+		if (bGpwrdeltaMinus == FALSE) {
+			t1 = (value & 0xf) + (Gpwrdelta);
 			if (t1 > 0xf)
 				t1 = 0xf;
-			t2 = ((value&0xf0)>>4)+(Gpwrdelta);
+			t2 = ((value & 0xf0) >> 4) + (Gpwrdelta);
 			if (t2 > 0xf)
 				t2 = 0xf;
-			t3 = ((value&0xf00)>>8)+(Gpwrdelta);
+			t3 = ((value & 0xf00) >> 8) + (Gpwrdelta);
 			if (t3 > 0xf)
 				t3 = 0xf;
-			t4 = ((value&0xf000)>>12)+(Gpwrdelta);
+			t4 = ((value & 0xf000) >> 12) + (Gpwrdelta);
 			if (t4 > 0xf)
 				t4 = 0xf;
-		}
-		else
-		{
-			if ((value&0xf) > Gpwrdelta)
-				t1 = (value&0xf)-(Gpwrdelta);
+		} else {
+			if ((value & 0xf) > Gpwrdelta)
+				t1 = (value & 0xf) - (Gpwrdelta);
 			else
 				t1 = 0;
-			if (((value&0xf0)>>4) > Gpwrdelta)
-				t2 = ((value&0xf0)>>4)-(Gpwrdelta);
+			if (((value & 0xf0) >> 4) > Gpwrdelta)
+				t2 = ((value & 0xf0) >> 4) - (Gpwrdelta);
 			else
 				t2 = 0;
-			if (((value&0xf00)>>8) > Gpwrdelta)
-				t3 = ((value&0xf00)>>8)-(Gpwrdelta);
+			if (((value & 0xf00) >> 8) > Gpwrdelta)
+				t3 = ((value & 0xf00) >> 8) - (Gpwrdelta);
 			else
 				t3 = 0;
-			if (((value&0xf000)>>12) > Gpwrdelta)
-				t4 = ((value&0xf000)>>12)-(Gpwrdelta);
+			if (((value & 0xf000) >> 12) > Gpwrdelta)
+				t4 = ((value & 0xf000) >> 12) - (Gpwrdelta);
 			else
 				t4 = 0;
 		}
-		Gdata |= ((t1<<16) + (t2<<20) + (t3<<24) + (t4<<28));
-		data |= (value<<16);
+		Gdata |= ((t1 << 16) + (t2 << 20) + (t3 << 24) + (t4 << 28));
+		data |= (value << 16);
 
-		pAd->Tx20MPwrCfgABand[i] = pAd->Tx40MPwrCfgABand[i] = Adata;
-		pAd->Tx20MPwrCfgGBand[i] = pAd->Tx40MPwrCfgGBand[i] = Gdata;
+		/* For 20M/40M Power Delta issue */
+		pAd->Tx20MPwrCfgABand[i] = data;
+		pAd->Tx20MPwrCfgGBand[i] = data;
+		pAd->Tx40MPwrCfgABand[i] = Adata;
+		pAd->Tx40MPwrCfgGBand[i] = Gdata;
 
 		if (data != 0xffffffff)
-			RTMP_IO_WRITE32(pAd, TX_PWR_CFG_0 + i*4, data);
-		DBGPRINT_RAW(RT_DEBUG_TRACE, ("20MHz BW, 2.4G band-%lx,  Adata = %lx,  Gdata = %lx \n", data, Adata, Gdata));
-	}
-
-	//
-	// Check this block is valid for 40MHz in 2.4G. If invalid, use parameter for 20MHz in 2.4G
-	//
-	bValid = TRUE;
-	for (i=0; i<6; i++)
-	{
-		RT28xx_EEPROM_READ16(pAd, EEPROM_TXPOWER_BYRATE_40MHZ_2_4G + 2 + i*2, value);
-		if (((value & 0x00FF) == 0x00FF) || ((value & 0xFF00) == 0xFF00))
-		{
-			bValid = FALSE;
-			break;
-		}
-	}
-
-	//
-	// Get Txpower per MCS for 40MHz in 2.4G.
-	//
-	if (bValid)
-	{
-		for (i=0; i<4; i++)
-		{
-			RT28xx_EEPROM_READ16(pAd, EEPROM_TXPOWER_BYRATE_40MHZ_2_4G + i*4, value);
-			if (bGpwrdeltaMinus == FALSE)
-			{
-				t1 = (value&0xf)+(Gpwrdelta);
-				if (t1 > 0xf)
-					t1 = 0xf;
-				t2 = ((value&0xf0)>>4)+(Gpwrdelta);
-				if (t2 > 0xf)
-					t2 = 0xf;
-				t3 = ((value&0xf00)>>8)+(Gpwrdelta);
-				if (t3 > 0xf)
-					t3 = 0xf;
-				t4 = ((value&0xf000)>>12)+(Gpwrdelta);
-				if (t4 > 0xf)
-					t4 = 0xf;
-			}
-			else
-			{
-				if ((value&0xf) > Gpwrdelta)
-					t1 = (value&0xf)-(Gpwrdelta);
-				else
-					t1 = 0;
-				if (((value&0xf0)>>4) > Gpwrdelta)
-					t2 = ((value&0xf0)>>4)-(Gpwrdelta);
-				else
-					t2 = 0;
-				if (((value&0xf00)>>8) > Gpwrdelta)
-					t3 = ((value&0xf00)>>8)-(Gpwrdelta);
-				else
-					t3 = 0;
-				if (((value&0xf000)>>12) > Gpwrdelta)
-					t4 = ((value&0xf000)>>12)-(Gpwrdelta);
-				else
-					t4 = 0;
-			}
-			Gdata = t1 + (t2<<4) + (t3<<8) + (t4<<12);
-
-			RT28xx_EEPROM_READ16(pAd, EEPROM_TXPOWER_BYRATE_40MHZ_2_4G + i*4 + 2, value);
-			if (bGpwrdeltaMinus == FALSE)
-			{
-				t1 = (value&0xf)+(Gpwrdelta);
-				if (t1 > 0xf)
-					t1 = 0xf;
-				t2 = ((value&0xf0)>>4)+(Gpwrdelta);
-				if (t2 > 0xf)
-					t2 = 0xf;
-				t3 = ((value&0xf00)>>8)+(Gpwrdelta);
-				if (t3 > 0xf)
-					t3 = 0xf;
-				t4 = ((value&0xf000)>>12)+(Gpwrdelta);
-				if (t4 > 0xf)
-					t4 = 0xf;
-			}
-			else
-			{
-				if ((value&0xf) > Gpwrdelta)
-					t1 = (value&0xf)-(Gpwrdelta);
-				else
-					t1 = 0;
-				if (((value&0xf0)>>4) > Gpwrdelta)
-					t2 = ((value&0xf0)>>4)-(Gpwrdelta);
-				else
-					t2 = 0;
-				if (((value&0xf00)>>8) > Gpwrdelta)
-					t3 = ((value&0xf00)>>8)-(Gpwrdelta);
-				else
-					t3 = 0;
-				if (((value&0xf000)>>12) > Gpwrdelta)
-					t4 = ((value&0xf000)>>12)-(Gpwrdelta);
-				else
-					t4 = 0;
-			}
-			Gdata |= ((t1<<16) + (t2<<20) + (t3<<24) + (t4<<28));
-
-			if (i == 0)
-				pAd->Tx40MPwrCfgGBand[i+1] = (pAd->Tx40MPwrCfgGBand[i+1] & 0x0000FFFF) | (Gdata & 0xFFFF0000);
-			else
-				pAd->Tx40MPwrCfgGBand[i+1] = Gdata;
-
-			DBGPRINT_RAW(RT_DEBUG_TRACE, ("40MHz BW, 2.4G band, Gdata = %lx \n", Gdata));
-		}
-	}
-
-	//
-	// Check this block is valid for 20MHz in 5G. If invalid, use parameter for 20MHz in 2.4G
-	//
-	bValid = TRUE;
-	for (i=0; i<8; i++)
-	{
-		RT28xx_EEPROM_READ16(pAd, EEPROM_TXPOWER_BYRATE_20MHZ_5G + 2 + i*2, value);
-		if (((value & 0x00FF) == 0x00FF) || ((value & 0xFF00) == 0xFF00))
-		{
-			bValid = FALSE;
-			break;
-		}
-	}
-
-	//
-	// Get Txpower per MCS for 20MHz in 5G.
-	//
-	if (bValid)
-	{
-		for (i=0; i<5; i++)
-		{
-			RT28xx_EEPROM_READ16(pAd, EEPROM_TXPOWER_BYRATE_20MHZ_5G + i*4, value);
-			if (bApwrdeltaMinus == FALSE)
-			{
-				t1 = (value&0xf)+(Apwrdelta);
-				if (t1 > 0xf)
-					t1 = 0xf;
-				t2 = ((value&0xf0)>>4)+(Apwrdelta);
-				if (t2 > 0xf)
-					t2 = 0xf;
-				t3 = ((value&0xf00)>>8)+(Apwrdelta);
-				if (t3 > 0xf)
-					t3 = 0xf;
-				t4 = ((value&0xf000)>>12)+(Apwrdelta);
-				if (t4 > 0xf)
-					t4 = 0xf;
-			}
-			else
-			{
-				if ((value&0xf) > Apwrdelta)
-					t1 = (value&0xf)-(Apwrdelta);
-				else
-					t1 = 0;
-				if (((value&0xf0)>>4) > Apwrdelta)
-					t2 = ((value&0xf0)>>4)-(Apwrdelta);
-				else
-					t2 = 0;
-				if (((value&0xf00)>>8) > Apwrdelta)
-					t3 = ((value&0xf00)>>8)-(Apwrdelta);
-				else
-					t3 = 0;
-				if (((value&0xf000)>>12) > Apwrdelta)
-					t4 = ((value&0xf000)>>12)-(Apwrdelta);
-				else
-					t4 = 0;
-			}
-			Adata = t1 + (t2<<4) + (t3<<8) + (t4<<12);
-
-			RT28xx_EEPROM_READ16(pAd, EEPROM_TXPOWER_BYRATE_20MHZ_5G + i*4 + 2, value);
-			if (bApwrdeltaMinus == FALSE)
-			{
-				t1 = (value&0xf)+(Apwrdelta);
-				if (t1 > 0xf)
-					t1 = 0xf;
-				t2 = ((value&0xf0)>>4)+(Apwrdelta);
-				if (t2 > 0xf)
-					t2 = 0xf;
-				t3 = ((value&0xf00)>>8)+(Apwrdelta);
-				if (t3 > 0xf)
-					t3 = 0xf;
-				t4 = ((value&0xf000)>>12)+(Apwrdelta);
-				if (t4 > 0xf)
-					t4 = 0xf;
-			}
-			else
-			{
-				if ((value&0xf) > Apwrdelta)
-					t1 = (value&0xf)-(Apwrdelta);
-				else
-					t1 = 0;
-				if (((value&0xf0)>>4) > Apwrdelta)
-					t2 = ((value&0xf0)>>4)-(Apwrdelta);
-				else
-					t2 = 0;
-				if (((value&0xf00)>>8) > Apwrdelta)
-					t3 = ((value&0xf00)>>8)-(Apwrdelta);
-				else
-					t3 = 0;
-				if (((value&0xf000)>>12) > Apwrdelta)
-					t4 = ((value&0xf000)>>12)-(Apwrdelta);
-				else
-					t4 = 0;
-			}
-			Adata |= ((t1<<16) + (t2<<20) + (t3<<24) + (t4<<28));
-
-			if (i == 0)
-				pAd->Tx20MPwrCfgABand[i] = (pAd->Tx20MPwrCfgABand[i] & 0x0000FFFF) | (Adata & 0xFFFF0000);
-			else
-				pAd->Tx20MPwrCfgABand[i] = Adata;
-
-			DBGPRINT_RAW(RT_DEBUG_TRACE, ("20MHz BW, 5GHz band, Adata = %lx \n", Adata));
-		}
-	}
-
-	//
-	// Check this block is valid for 40MHz in 5G. If invalid, use parameter for 20MHz in 2.4G
-	//
-	bValid = TRUE;
-	for (i=0; i<6; i++)
-	{
-		RT28xx_EEPROM_READ16(pAd, EEPROM_TXPOWER_BYRATE_40MHZ_5G + 2 + i*2, value);
-		if (((value & 0x00FF) == 0x00FF) || ((value & 0xFF00) == 0xFF00))
-		{
-			bValid = FALSE;
-			break;
-		}
-	}
-
-	//
-	// Get Txpower per MCS for 40MHz in 5G.
-	//
-	if (bValid)
-	{
-		for (i=0; i<4; i++)
-		{
-			RT28xx_EEPROM_READ16(pAd, EEPROM_TXPOWER_BYRATE_40MHZ_5G + i*4, value);
-			if (bApwrdeltaMinus == FALSE)
-			{
-				t1 = (value&0xf)+(Apwrdelta);
-				if (t1 > 0xf)
-					t1 = 0xf;
-				t2 = ((value&0xf0)>>4)+(Apwrdelta);
-				if (t2 > 0xf)
-					t2 = 0xf;
-				t3 = ((value&0xf00)>>8)+(Apwrdelta);
-				if (t3 > 0xf)
-					t3 = 0xf;
-				t4 = ((value&0xf000)>>12)+(Apwrdelta);
-				if (t4 > 0xf)
-					t4 = 0xf;
-			}
-			else
-			{
-				if ((value&0xf) > Apwrdelta)
-					t1 = (value&0xf)-(Apwrdelta);
-				else
-					t1 = 0;
-				if (((value&0xf0)>>4) > Apwrdelta)
-					t2 = ((value&0xf0)>>4)-(Apwrdelta);
-				else
-					t2 = 0;
-				if (((value&0xf00)>>8) > Apwrdelta)
-					t3 = ((value&0xf00)>>8)-(Apwrdelta);
-				else
-					t3 = 0;
-				if (((value&0xf000)>>12) > Apwrdelta)
-					t4 = ((value&0xf000)>>12)-(Apwrdelta);
-				else
-					t4 = 0;
-			}
-			Adata = t1 + (t2<<4) + (t3<<8) + (t4<<12);
-
-			RT28xx_EEPROM_READ16(pAd, EEPROM_TXPOWER_BYRATE_40MHZ_5G + i*4 + 2, value);
-			if (bApwrdeltaMinus == FALSE)
-			{
-				t1 = (value&0xf)+(Apwrdelta);
-				if (t1 > 0xf)
-					t1 = 0xf;
-				t2 = ((value&0xf0)>>4)+(Apwrdelta);
-				if (t2 > 0xf)
-					t2 = 0xf;
-				t3 = ((value&0xf00)>>8)+(Apwrdelta);
-				if (t3 > 0xf)
-					t3 = 0xf;
-				t4 = ((value&0xf000)>>12)+(Apwrdelta);
-				if (t4 > 0xf)
-					t4 = 0xf;
-			}
-			else
-			{
-				if ((value&0xf) > Apwrdelta)
-					t1 = (value&0xf)-(Apwrdelta);
-				else
-					t1 = 0;
-				if (((value&0xf0)>>4) > Apwrdelta)
-					t2 = ((value&0xf0)>>4)-(Apwrdelta);
-				else
-					t2 = 0;
-				if (((value&0xf00)>>8) > Apwrdelta)
-					t3 = ((value&0xf00)>>8)-(Apwrdelta);
-				else
-					t3 = 0;
-				if (((value&0xf000)>>12) > Apwrdelta)
-					t4 = ((value&0xf000)>>12)-(Apwrdelta);
-				else
-					t4 = 0;
-			}
-			Adata |= ((t1<<16) + (t2<<20) + (t3<<24) + (t4<<28));
-
-			if (i == 0)
-				pAd->Tx40MPwrCfgABand[i+1] = (pAd->Tx40MPwrCfgABand[i+1] & 0x0000FFFF) | (Adata & 0xFFFF0000);
-			else
-				pAd->Tx40MPwrCfgABand[i+1] = Adata;
-
-			DBGPRINT_RAW(RT_DEBUG_TRACE, ("40MHz BW, 5GHz band, Adata = %lx \n", Adata));
-		}
+			RTMP_IO_WRITE32(pAd, TX_PWR_CFG_0 + i * 4, data);
+		DBGPRINT_RAW(RT_DEBUG_TRACE,
+			     ("20MHz BW, 2.4G band-%lx,  Adata = %lx,  Gdata = %lx \n",
+			      data, Adata, Gdata));
 	}
 }
 
-
 /*
 	========================================================================
 
@@ -821,23 +441,23 @@ VOID	RTMPReadTxPwrPerRate(
 
 	========================================================================
 */
-VOID	RTMPReadChannelPwr(
-	IN	PRTMP_ADAPTER	pAd)
+void RTMPReadChannelPwr(struct rt_rtmp_adapter *pAd)
 {
-	UCHAR				i, choffset;
-	EEPROM_TX_PWR_STRUC	    Power;
-	EEPROM_TX_PWR_STRUC	    Power2;
-
-	// Read Tx power value for all channels
-	// Value from 1 - 0x7f. Default value is 24.
-	// Power value : 2.4G 0x00 (0) ~ 0x1F (31)
-	//             : 5.5G 0xF9 (-7) ~ 0x0F (15)
-
-	// 0. 11b/g, ch1 - ch 14
-	for (i = 0; i < 7; i++)
-	{
-		RT28xx_EEPROM_READ16(pAd, EEPROM_G_TX_PWR_OFFSET + i * 2, Power.word);
-		RT28xx_EEPROM_READ16(pAd, EEPROM_G_TX2_PWR_OFFSET + i * 2, Power2.word);
+	u8 i, choffset;
+	EEPROM_TX_PWR_STRUC Power;
+	EEPROM_TX_PWR_STRUC Power2;
+
+	/* Read Tx power value for all channels */
+	/* Value from 1 - 0x7f. Default value is 24. */
+	/* Power value : 2.4G 0x00 (0) ~ 0x1F (31) */
+	/*             : 5.5G 0xF9 (-7) ~ 0x0F (15) */
+
+	/* 0. 11b/g, ch1 - ch 14 */
+	for (i = 0; i < 7; i++) {
+		RT28xx_EEPROM_READ16(pAd, EEPROM_G_TX_PWR_OFFSET + i * 2,
+				     Power.word);
+		RT28xx_EEPROM_READ16(pAd, EEPROM_G_TX2_PWR_OFFSET + i * 2,
+				     Power2.word);
 		pAd->TxPower[i * 2].Channel = i * 2 + 1;
 		pAd->TxPower[i * 2 + 1].Channel = i * 2 + 2;
 
@@ -862,125 +482,149 @@ VOID	RTMPReadChannelPwr(
 			pAd->TxPower[i * 2 + 1].Power2 = Power2.field.Byte1;
 	}
 
-	// 1. U-NII lower/middle band: 36, 38, 40; 44, 46, 48; 52, 54, 56; 60, 62, 64 (including central frequency in BW 40MHz)
-	// 1.1 Fill up channel
+	/* 1. U-NII lower/middle band: 36, 38, 40; 44, 46, 48; 52, 54, 56; 60, 62, 64 (including central frequency in BW 40MHz) */
+	/* 1.1 Fill up channel */
 	choffset = 14;
-	for (i = 0; i < 4; i++)
-	{
-		pAd->TxPower[3 * i + choffset + 0].Channel	= 36 + i * 8 + 0;
-		pAd->TxPower[3 * i + choffset + 0].Power	= DEFAULT_RF_TX_POWER;
-		pAd->TxPower[3 * i + choffset + 0].Power2	= DEFAULT_RF_TX_POWER;
+	for (i = 0; i < 4; i++) {
+		pAd->TxPower[3 * i + choffset + 0].Channel = 36 + i * 8 + 0;
+		pAd->TxPower[3 * i + choffset + 0].Power = DEFAULT_RF_TX_POWER;
+		pAd->TxPower[3 * i + choffset + 0].Power2 = DEFAULT_RF_TX_POWER;
 
-		pAd->TxPower[3 * i + choffset + 1].Channel	= 36 + i * 8 + 2;
-		pAd->TxPower[3 * i + choffset + 1].Power	= DEFAULT_RF_TX_POWER;
-		pAd->TxPower[3 * i + choffset + 1].Power2	= DEFAULT_RF_TX_POWER;
+		pAd->TxPower[3 * i + choffset + 1].Channel = 36 + i * 8 + 2;
+		pAd->TxPower[3 * i + choffset + 1].Power = DEFAULT_RF_TX_POWER;
+		pAd->TxPower[3 * i + choffset + 1].Power2 = DEFAULT_RF_TX_POWER;
 
-		pAd->TxPower[3 * i + choffset + 2].Channel	= 36 + i * 8 + 4;
-		pAd->TxPower[3 * i + choffset + 2].Power	= DEFAULT_RF_TX_POWER;
-		pAd->TxPower[3 * i + choffset + 2].Power2	= DEFAULT_RF_TX_POWER;
+		pAd->TxPower[3 * i + choffset + 2].Channel = 36 + i * 8 + 4;
+		pAd->TxPower[3 * i + choffset + 2].Power = DEFAULT_RF_TX_POWER;
+		pAd->TxPower[3 * i + choffset + 2].Power2 = DEFAULT_RF_TX_POWER;
 	}
 
-	// 1.2 Fill up power
-	for (i = 0; i < 6; i++)
-	{
-		RT28xx_EEPROM_READ16(pAd, EEPROM_A_TX_PWR_OFFSET + i * 2, Power.word);
-		RT28xx_EEPROM_READ16(pAd, EEPROM_A_TX2_PWR_OFFSET + i * 2, Power2.word);
+	/* 1.2 Fill up power */
+	for (i = 0; i < 6; i++) {
+		RT28xx_EEPROM_READ16(pAd, EEPROM_A_TX_PWR_OFFSET + i * 2,
+				     Power.word);
+		RT28xx_EEPROM_READ16(pAd, EEPROM_A_TX2_PWR_OFFSET + i * 2,
+				     Power2.word);
 
 		if ((Power.field.Byte0 < 16) && (Power.field.Byte0 >= -7))
-			pAd->TxPower[i * 2 + choffset + 0].Power = Power.field.Byte0;
+			pAd->TxPower[i * 2 + choffset + 0].Power =
+			    Power.field.Byte0;
 
 		if ((Power.field.Byte1 < 16) && (Power.field.Byte1 >= -7))
-			pAd->TxPower[i * 2 + choffset + 1].Power = Power.field.Byte1;
+			pAd->TxPower[i * 2 + choffset + 1].Power =
+			    Power.field.Byte1;
 
 		if ((Power2.field.Byte0 < 16) && (Power2.field.Byte0 >= -7))
-			pAd->TxPower[i * 2 + choffset + 0].Power2 = Power2.field.Byte0;
+			pAd->TxPower[i * 2 + choffset + 0].Power2 =
+			    Power2.field.Byte0;
 
 		if ((Power2.field.Byte1 < 16) && (Power2.field.Byte1 >= -7))
-			pAd->TxPower[i * 2 + choffset + 1].Power2 = Power2.field.Byte1;
+			pAd->TxPower[i * 2 + choffset + 1].Power2 =
+			    Power2.field.Byte1;
 	}
 
-	// 2. HipperLAN 2 100, 102 ,104; 108, 110, 112; 116, 118, 120; 124, 126, 128; 132, 134, 136; 140 (including central frequency in BW 40MHz)
-	// 2.1 Fill up channel
+	/* 2. HipperLAN 2 100, 102 ,104; 108, 110, 112; 116, 118, 120; 124, 126, 128; 132, 134, 136; 140 (including central frequency in BW 40MHz) */
+	/* 2.1 Fill up channel */
 	choffset = 14 + 12;
-	for (i = 0; i < 5; i++)
-	{
-		pAd->TxPower[3 * i + choffset + 0].Channel	= 100 + i * 8 + 0;
-		pAd->TxPower[3 * i + choffset + 0].Power	= DEFAULT_RF_TX_POWER;
-		pAd->TxPower[3 * i + choffset + 0].Power2	= DEFAULT_RF_TX_POWER;
-
-		pAd->TxPower[3 * i + choffset + 1].Channel	= 100 + i * 8 + 2;
-		pAd->TxPower[3 * i + choffset + 1].Power	= DEFAULT_RF_TX_POWER;
-		pAd->TxPower[3 * i + choffset + 1].Power2	= DEFAULT_RF_TX_POWER;
-
-		pAd->TxPower[3 * i + choffset + 2].Channel	= 100 + i * 8 + 4;
-		pAd->TxPower[3 * i + choffset + 2].Power	= DEFAULT_RF_TX_POWER;
-		pAd->TxPower[3 * i + choffset + 2].Power2	= DEFAULT_RF_TX_POWER;
-	}
-	pAd->TxPower[3 * 5 + choffset + 0].Channel		= 140;
-	pAd->TxPower[3 * 5 + choffset + 0].Power		= DEFAULT_RF_TX_POWER;
-	pAd->TxPower[3 * 5 + choffset + 0].Power2		= DEFAULT_RF_TX_POWER;
-
-	// 2.2 Fill up power
-	for (i = 0; i < 8; i++)
-	{
-		RT28xx_EEPROM_READ16(pAd, EEPROM_A_TX_PWR_OFFSET + (choffset - 14) + i * 2, Power.word);
-		RT28xx_EEPROM_READ16(pAd, EEPROM_A_TX2_PWR_OFFSET + (choffset - 14) + i * 2, Power2.word);
+	for (i = 0; i < 5; i++) {
+		pAd->TxPower[3 * i + choffset + 0].Channel = 100 + i * 8 + 0;
+		pAd->TxPower[3 * i + choffset + 0].Power = DEFAULT_RF_TX_POWER;
+		pAd->TxPower[3 * i + choffset + 0].Power2 = DEFAULT_RF_TX_POWER;
+
+		pAd->TxPower[3 * i + choffset + 1].Channel = 100 + i * 8 + 2;
+		pAd->TxPower[3 * i + choffset + 1].Power = DEFAULT_RF_TX_POWER;
+		pAd->TxPower[3 * i + choffset + 1].Power2 = DEFAULT_RF_TX_POWER;
+
+		pAd->TxPower[3 * i + choffset + 2].Channel = 100 + i * 8 + 4;
+		pAd->TxPower[3 * i + choffset + 2].Power = DEFAULT_RF_TX_POWER;
+		pAd->TxPower[3 * i + choffset + 2].Power2 = DEFAULT_RF_TX_POWER;
+	}
+	pAd->TxPower[3 * 5 + choffset + 0].Channel = 140;
+	pAd->TxPower[3 * 5 + choffset + 0].Power = DEFAULT_RF_TX_POWER;
+	pAd->TxPower[3 * 5 + choffset + 0].Power2 = DEFAULT_RF_TX_POWER;
+
+	/* 2.2 Fill up power */
+	for (i = 0; i < 8; i++) {
+		RT28xx_EEPROM_READ16(pAd,
+				     EEPROM_A_TX_PWR_OFFSET + (choffset - 14) +
+				     i * 2, Power.word);
+		RT28xx_EEPROM_READ16(pAd,
+				     EEPROM_A_TX2_PWR_OFFSET + (choffset - 14) +
+				     i * 2, Power2.word);
 
 		if ((Power.field.Byte0 < 16) && (Power.field.Byte0 >= -7))
-			pAd->TxPower[i * 2 + choffset + 0].Power = Power.field.Byte0;
+			pAd->TxPower[i * 2 + choffset + 0].Power =
+			    Power.field.Byte0;
 
 		if ((Power.field.Byte1 < 16) && (Power.field.Byte1 >= -7))
-			pAd->TxPower[i * 2 + choffset + 1].Power = Power.field.Byte1;
+			pAd->TxPower[i * 2 + choffset + 1].Power =
+			    Power.field.Byte1;
 
 		if ((Power2.field.Byte0 < 16) && (Power2.field.Byte0 >= -7))
-			pAd->TxPower[i * 2 + choffset + 0].Power2 = Power2.field.Byte0;
+			pAd->TxPower[i * 2 + choffset + 0].Power2 =
+			    Power2.field.Byte0;
 
 		if ((Power2.field.Byte1 < 16) && (Power2.field.Byte1 >= -7))
-			pAd->TxPower[i * 2 + choffset + 1].Power2 = Power2.field.Byte1;
+			pAd->TxPower[i * 2 + choffset + 1].Power2 =
+			    Power2.field.Byte1;
 	}
 
-	// 3. U-NII upper band: 149, 151, 153; 157, 159, 161; 165 (including central frequency in BW 40MHz)
-	// 3.1 Fill up channel
+	/* 3. U-NII upper band: 149, 151, 153; 157, 159, 161; 165, 167, 169; 171, 173 (including central frequency in BW 40MHz) */
+	/* 3.1 Fill up channel */
 	choffset = 14 + 12 + 16;
-	for (i = 0; i < 2; i++)
-	{
-		pAd->TxPower[3 * i + choffset + 0].Channel	= 149 + i * 8 + 0;
-		pAd->TxPower[3 * i + choffset + 0].Power	= DEFAULT_RF_TX_POWER;
-		pAd->TxPower[3 * i + choffset + 0].Power2	= DEFAULT_RF_TX_POWER;
-
-		pAd->TxPower[3 * i + choffset + 1].Channel	= 149 + i * 8 + 2;
-		pAd->TxPower[3 * i + choffset + 1].Power	= DEFAULT_RF_TX_POWER;
-		pAd->TxPower[3 * i + choffset + 1].Power2	= DEFAULT_RF_TX_POWER;
-
-		pAd->TxPower[3 * i + choffset + 2].Channel	= 149 + i * 8 + 4;
-		pAd->TxPower[3 * i + choffset + 2].Power	= DEFAULT_RF_TX_POWER;
-		pAd->TxPower[3 * i + choffset + 2].Power2	= DEFAULT_RF_TX_POWER;
-	}
-	pAd->TxPower[3 * 2 + choffset + 0].Channel		= 165;
-	pAd->TxPower[3 * 2 + choffset + 0].Power		= DEFAULT_RF_TX_POWER;
-	pAd->TxPower[3 * 2 + choffset + 0].Power2		= DEFAULT_RF_TX_POWER;
-
-	// 3.2 Fill up power
-	for (i = 0; i < 4; i++)
-	{
-		RT28xx_EEPROM_READ16(pAd, EEPROM_A_TX_PWR_OFFSET + (choffset - 14) + i * 2, Power.word);
-		RT28xx_EEPROM_READ16(pAd, EEPROM_A_TX2_PWR_OFFSET + (choffset - 14) + i * 2, Power2.word);
+	/*for (i = 0; i < 2; i++) */
+	for (i = 0; i < 3; i++) {
+		pAd->TxPower[3 * i + choffset + 0].Channel = 149 + i * 8 + 0;
+		pAd->TxPower[3 * i + choffset + 0].Power = DEFAULT_RF_TX_POWER;
+		pAd->TxPower[3 * i + choffset + 0].Power2 = DEFAULT_RF_TX_POWER;
+
+		pAd->TxPower[3 * i + choffset + 1].Channel = 149 + i * 8 + 2;
+		pAd->TxPower[3 * i + choffset + 1].Power = DEFAULT_RF_TX_POWER;
+		pAd->TxPower[3 * i + choffset + 1].Power2 = DEFAULT_RF_TX_POWER;
+
+		pAd->TxPower[3 * i + choffset + 2].Channel = 149 + i * 8 + 4;
+		pAd->TxPower[3 * i + choffset + 2].Power = DEFAULT_RF_TX_POWER;
+		pAd->TxPower[3 * i + choffset + 2].Power2 = DEFAULT_RF_TX_POWER;
+	}
+	pAd->TxPower[3 * 3 + choffset + 0].Channel = 171;
+	pAd->TxPower[3 * 3 + choffset + 0].Power = DEFAULT_RF_TX_POWER;
+	pAd->TxPower[3 * 3 + choffset + 0].Power2 = DEFAULT_RF_TX_POWER;
+
+	pAd->TxPower[3 * 3 + choffset + 1].Channel = 173;
+	pAd->TxPower[3 * 3 + choffset + 1].Power = DEFAULT_RF_TX_POWER;
+	pAd->TxPower[3 * 3 + choffset + 1].Power2 = DEFAULT_RF_TX_POWER;
+
+	/* 3.2 Fill up power */
+	/*for (i = 0; i < 4; i++) */
+	for (i = 0; i < 6; i++) {
+		RT28xx_EEPROM_READ16(pAd,
+				     EEPROM_A_TX_PWR_OFFSET + (choffset - 14) +
+				     i * 2, Power.word);
+		RT28xx_EEPROM_READ16(pAd,
+				     EEPROM_A_TX2_PWR_OFFSET + (choffset - 14) +
+				     i * 2, Power2.word);
 
 		if ((Power.field.Byte0 < 16) && (Power.field.Byte0 >= -7))
-			pAd->TxPower[i * 2 + choffset + 0].Power = Power.field.Byte0;
+			pAd->TxPower[i * 2 + choffset + 0].Power =
+			    Power.field.Byte0;
 
 		if ((Power.field.Byte1 < 16) && (Power.field.Byte1 >= -7))
-			pAd->TxPower[i * 2 + choffset + 1].Power = Power.field.Byte1;
+			pAd->TxPower[i * 2 + choffset + 1].Power =
+			    Power.field.Byte1;
 
 		if ((Power2.field.Byte0 < 16) && (Power2.field.Byte0 >= -7))
-			pAd->TxPower[i * 2 + choffset + 0].Power2 = Power2.field.Byte0;
+			pAd->TxPower[i * 2 + choffset + 0].Power2 =
+			    Power2.field.Byte0;
 
 		if ((Power2.field.Byte1 < 16) && (Power2.field.Byte1 >= -7))
-			pAd->TxPower[i * 2 + choffset + 1].Power2 = Power2.field.Byte1;
+			pAd->TxPower[i * 2 + choffset + 1].Power2 =
+			    Power2.field.Byte1;
 	}
 
-	// 4. Print and Debug
-	choffset = 14 + 12 + 16 + 7;
+	/* 4. Print and Debug */
+	/*choffset = 14 + 12 + 16 + 7; */
+	choffset = 14 + 12 + 16 + 11;
+
 }
 
 /*
@@ -1006,278 +650,14 @@ VOID	RTMPReadChannelPwr(
 
 	========================================================================
 */
-NDIS_STATUS	NICReadRegParameters(
-	IN	PRTMP_ADAPTER		pAd,
-	IN	NDIS_HANDLE			WrapperConfigurationContext
-	)
+int NICReadRegParameters(struct rt_rtmp_adapter *pAd,
+				 void *WrapperConfigurationContext)
 {
-	NDIS_STATUS						Status = NDIS_STATUS_SUCCESS;
+	int Status = NDIS_STATUS_SUCCESS;
 	DBGPRINT_S(Status, ("<-- NICReadRegParameters, Status=%x\n", Status));
 	return Status;
 }
 
-
-#ifdef RT2870
-/*
-	========================================================================
-
-	Routine Description:
-		For RF filter calibration purpose
-
-	Arguments:
-		pAd                          Pointer to our adapter
-
-	Return Value:
-		None
-
-	IRQL = PASSIVE_LEVEL
-
-	========================================================================
-*/
-VOID RTMPFilterCalibration(
-	IN PRTMP_ADAPTER pAd)
-{
-	UCHAR	R55x = 0, value, FilterTarget = 0x1E, BBPValue=0;
-	UINT	loop = 0, count = 0, loopcnt = 0, ReTry = 0;
-	UCHAR	RF_R24_Value = 0;
-
-	// Give bbp filter initial value
-#ifndef RT2870
-	pAd->Mlme.CaliBW20RfR24 = 0x16;
-	pAd->Mlme.CaliBW40RfR24 = 0x36;  //Bit[5] must be 1 for BW 40
-#else
-	pAd->Mlme.CaliBW20RfR24 = 0x1F;
-	pAd->Mlme.CaliBW40RfR24 = 0x2F; //Bit[5] must be 1 for BW 40
-#endif
-	do
-	{
-		if (loop == 1)	//BandWidth = 40 MHz
-		{
-			// Write 0x27 to RF_R24 to program filter
-			RF_R24_Value = 0x27;
-			RT30xxWriteRFRegister(pAd, RF_R24, RF_R24_Value);
-			if (IS_RT3090(pAd))
-				FilterTarget = 0x15;
-			else
-				FilterTarget = 0x19;
-
-			// when calibrate BW40, BBP mask must set to BW40.
-			RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R4, &BBPValue);
-			BBPValue&= (~0x18);
-			BBPValue|= (0x10);
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R4, BBPValue);
-#ifdef RT2870
-			// set to BW40
-			RT30xxReadRFRegister(pAd, RF_R31, &value);
-			value |= 0x20;
-			RT30xxWriteRFRegister(pAd, RF_R31, value);
-#endif
-		}
-		else			//BandWidth = 20 MHz
-		{
-			// Write 0x07 to RF_R24 to program filter
-			RF_R24_Value = 0x07;
-			RT30xxWriteRFRegister(pAd, RF_R24, RF_R24_Value);
-			if (IS_RT3090(pAd))
-				FilterTarget = 0x13;
-			else
-				FilterTarget = 0x16;
-#ifdef RT2870
-			// set to BW20
-			RT30xxReadRFRegister(pAd, RF_R31, &value);
-			value &= (~0x20);
-			RT30xxWriteRFRegister(pAd, RF_R31, value);
-#endif
-		}
-
-		// Write 0x01 to RF_R22 to enable baseband loopback mode
-		RT30xxReadRFRegister(pAd, RF_R22, &value);
-		value |= 0x01;
-		RT30xxWriteRFRegister(pAd, RF_R22, value);
-
-		// Write 0x00 to BBP_R24 to set power & frequency of passband test tone
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R24, 0);
-
-		do
-		{
-			// Write 0x90 to BBP_R25 to transmit test tone
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R25, 0x90);
-
-			RTMPusecDelay(1000);
-			// Read BBP_R55[6:0] for received power, set R55x = BBP_R55[6:0]
-			RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R55, &value);
-			R55x = value & 0xFF;
-
-		} while ((ReTry++ < 100) && (R55x == 0));
-
-		// Write 0x06 to BBP_R24 to set power & frequency of stopband test tone
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R24, 0x06);
-
-		while(TRUE)
-		{
-			// Write 0x90 to BBP_R25 to transmit test tone
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R25, 0x90);
-
-			//We need to wait for calibration
-			RTMPusecDelay(1000);
-			RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R55, &value);
-			value &= 0xFF;
-			if ((R55x - value) < FilterTarget)
-			{
-				RF_R24_Value ++;
-			}
-			else if ((R55x - value) == FilterTarget)
-			{
-				RF_R24_Value ++;
-				count ++;
-			}
-			else
-			{
-				break;
-			}
-
-			// prevent infinite loop cause driver hang.
-			if (loopcnt++ > 100)
-			{
-				DBGPRINT(RT_DEBUG_ERROR, ("RTMPFilterCalibration - can't find a valid value, loopcnt=%d stop calibrating", loopcnt));
-				break;
-			}
-
-			// Write RF_R24 to program filter
-			RT30xxWriteRFRegister(pAd, RF_R24, RF_R24_Value);
-		}
-
-		if (count > 0)
-		{
-			RF_R24_Value = RF_R24_Value - ((count) ? (1) : (0));
-		}
-
-		// Store for future usage
-		if (loopcnt < 100)
-		{
-			if (loop++ == 0)
-			{
-				//BandWidth = 20 MHz
-				pAd->Mlme.CaliBW20RfR24 = (UCHAR)RF_R24_Value;
-			}
-			else
-			{
-				//BandWidth = 40 MHz
-				pAd->Mlme.CaliBW40RfR24 = (UCHAR)RF_R24_Value;
-				break;
-			}
-		}
-		else
-			break;
-
-		RT30xxWriteRFRegister(pAd, RF_R24, RF_R24_Value);
-
-		// reset count
-		count = 0;
-	} while(TRUE);
-
-	//
-	// Set back to initial state
-	//
-	RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R24, 0);
-
-	RT30xxReadRFRegister(pAd, RF_R22, &value);
-	value &= ~(0x01);
-	RT30xxWriteRFRegister(pAd, RF_R22, value);
-
-	// set BBP back to BW20
-	RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R4, &BBPValue);
-	BBPValue&= (~0x18);
-	RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R4, BBPValue);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("RTMPFilterCalibration - CaliBW20RfR24=0x%x, CaliBW40RfR24=0x%x\n", pAd->Mlme.CaliBW20RfR24, pAd->Mlme.CaliBW40RfR24));
-}
-
-VOID NICInitRT30xxRFRegisters(IN PRTMP_ADAPTER pAd)
-{
-	INT i;
-	// Driver must read EEPROM to get RfIcType before initial RF registers
-	// Initialize RF register to default value
-	if (IS_RT3070(pAd) || IS_RT3071(pAd))
-	{
-		// Init RF calibration
-		// Driver should toggle RF R30 bit7 before init RF registers
-		UINT32 RfReg = 0;
-		UINT32 data;
-
-		RT30xxReadRFRegister(pAd, RF_R30, (PUCHAR)&RfReg);
-		RfReg |= 0x80;
-		RT30xxWriteRFRegister(pAd, RF_R30, (UCHAR)RfReg);
-		RTMPusecDelay(1000);
-		RfReg &= 0x7F;
-		RT30xxWriteRFRegister(pAd, RF_R30, (UCHAR)RfReg);
-
-		// Initialize RF register to default value
-		for (i = 0; i < NUM_RF_REG_PARMS; i++)
-		{
-			RT30xxWriteRFRegister(pAd, RT30xx_RFRegTable[i].Register, RT30xx_RFRegTable[i].Value);
-		}
-
-		if (IS_RT3070(pAd))
-		{
-			//  Update MAC 0x05D4 from 01xxxxxx to 0Dxxxxxx (voltage 1.2V to 1.35V) for RT3070 to improve yield rate
-			RTUSBReadMACRegister(pAd, LDO_CFG0, &data);
-			data = ((data & 0xF0FFFFFF) | 0x0D000000);
-			RTUSBWriteMACRegister(pAd, LDO_CFG0, data);
-		}
-		else if (IS_RT3071(pAd))
-		{
-			// Driver should set RF R6 bit6 on before init RF registers
-			RT30xxReadRFRegister(pAd, RF_R06, (PUCHAR)&RfReg);
-			RfReg |= 0x40;
-			RT30xxWriteRFRegister(pAd, RF_R06, (UCHAR)RfReg);
-
-			// init R31
-			RT30xxWriteRFRegister(pAd, RF_R31, 0x14);
-
-			// RT3071 version E has fixed this issue
-			if ((pAd->NicConfig2.field.DACTestBit == 1) && ((pAd->MACVersion & 0xffff) < 0x0211))
-			{
-				// patch tx EVM issue temporarily
-				RTUSBReadMACRegister(pAd, LDO_CFG0, &data);
-				data = ((data & 0xE0FFFFFF) | 0x0D000000);
-				RTUSBWriteMACRegister(pAd, LDO_CFG0, data);
-			}
-			else
-			{
-				RTMP_IO_READ32(pAd, LDO_CFG0, &data);
-				data = ((data & 0xE0FFFFFF) | 0x01000000);
-				RTMP_IO_WRITE32(pAd, LDO_CFG0, data);
-			}
-
-			// patch LNA_PE_G1 failed issue
-			RTUSBReadMACRegister(pAd, GPIO_SWITCH, &data);
-			data &= ~(0x20);
-			RTUSBWriteMACRegister(pAd, GPIO_SWITCH, data);
-		}
-
-		//For RF filter Calibration
-		RTMPFilterCalibration(pAd);
-
-		// Initialize RF R27 register, set RF R27 must be behind RTMPFilterCalibration()
-		if ((pAd->MACVersion & 0xffff) < 0x0211)
-			RT30xxWriteRFRegister(pAd, RF_R27, 0x3);
-
-		// set led open drain enable
-		RTUSBReadMACRegister(pAd, OPT_14, &data);
-		data |= 0x01;
-		RTUSBWriteMACRegister(pAd, OPT_14, data);
-
-		if (IS_RT3071(pAd))
-		{
-			// add by johnli, RF power sequence setup, load RF normal operation-mode setup
-			RT30xxLoadRFNormalModeSetup(pAd);
-		}
-	}
-}
-#endif // RT2870 //
-
-
 /*
 	========================================================================
 
@@ -1296,88 +676,91 @@ VOID NICInitRT30xxRFRegisters(IN PRTMP_ADAPTER pAd)
 
 	========================================================================
 */
-VOID	NICReadEEPROMParameters(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			mac_addr)
+void NICReadEEPROMParameters(struct rt_rtmp_adapter *pAd, u8 *mac_addr)
 {
-	UINT32			data = 0;
-	USHORT			i, value, value2;
-	UCHAR			TmpPhy;
-	EEPROM_TX_PWR_STRUC	    Power;
-	EEPROM_VERSION_STRUC    Version;
-	EEPROM_ANTENNA_STRUC	Antenna;
-	EEPROM_NIC_CONFIG2_STRUC    NicConfig2;
+	u32 data = 0;
+	u16 i, value, value2;
+	u8 TmpPhy;
+	EEPROM_TX_PWR_STRUC Power;
+	EEPROM_VERSION_STRUC Version;
+	EEPROM_ANTENNA_STRUC Antenna;
+	EEPROM_NIC_CONFIG2_STRUC NicConfig2;
 
 	DBGPRINT(RT_DEBUG_TRACE, ("--> NICReadEEPROMParameters\n"));
 
-	// Init EEPROM Address Number, before access EEPROM; if 93c46, EEPROMAddressNum=6, else if 93c66, EEPROMAddressNum=8
+	if (pAd->chipOps.eeinit)
+		pAd->chipOps.eeinit(pAd);
+
+	/* Init EEPROM Address Number, before access EEPROM; if 93c46, EEPROMAddressNum=6, else if 93c66, EEPROMAddressNum=8 */
 	RTMP_IO_READ32(pAd, E2PROM_CSR, &data);
 	DBGPRINT(RT_DEBUG_TRACE, ("--> E2PROM_CSR = 0x%x\n", data));
 
-	if((data & 0x30) == 0)
-		pAd->EEPROMAddressNum = 6;		// 93C46
-	else if((data & 0x30) == 0x10)
-		pAd->EEPROMAddressNum = 8;     // 93C66
+	if ((data & 0x30) == 0)
+		pAd->EEPROMAddressNum = 6;	/* 93C46 */
+	else if ((data & 0x30) == 0x10)
+		pAd->EEPROMAddressNum = 8;	/* 93C66 */
 	else
-		pAd->EEPROMAddressNum = 8;     // 93C86
-	DBGPRINT(RT_DEBUG_TRACE, ("--> EEPROMAddressNum = %d\n", pAd->EEPROMAddressNum ));
+		pAd->EEPROMAddressNum = 8;	/* 93C86 */
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("--> EEPROMAddressNum = %d\n", pAd->EEPROMAddressNum));
 
-	// RT2860 MAC no longer auto load MAC address from E2PROM. Driver has to intialize
-	// MAC address registers according to E2PROM setting
+	/* RT2860 MAC no longer auto load MAC address from E2PROM. Driver has to intialize */
+	/* MAC address registers according to E2PROM setting */
 	if (mac_addr == NULL ||
-		strlen(mac_addr) != 17 ||
-		mac_addr[2] != ':'  || mac_addr[5] != ':'  || mac_addr[8] != ':' ||
-		mac_addr[11] != ':' || mac_addr[14] != ':')
-	{
-		USHORT  Addr01,Addr23,Addr45 ;
+	    strlen((char *)mac_addr) != 17 ||
+	    mac_addr[2] != ':' || mac_addr[5] != ':' || mac_addr[8] != ':' ||
+	    mac_addr[11] != ':' || mac_addr[14] != ':') {
+		u16 Addr01, Addr23, Addr45;
 
 		RT28xx_EEPROM_READ16(pAd, 0x04, Addr01);
 		RT28xx_EEPROM_READ16(pAd, 0x06, Addr23);
 		RT28xx_EEPROM_READ16(pAd, 0x08, Addr45);
 
-		pAd->PermanentAddress[0] = (UCHAR)(Addr01 & 0xff);
-		pAd->PermanentAddress[1] = (UCHAR)(Addr01 >> 8);
-		pAd->PermanentAddress[2] = (UCHAR)(Addr23 & 0xff);
-		pAd->PermanentAddress[3] = (UCHAR)(Addr23 >> 8);
-		pAd->PermanentAddress[4] = (UCHAR)(Addr45 & 0xff);
-		pAd->PermanentAddress[5] = (UCHAR)(Addr45 >> 8);
+		pAd->PermanentAddress[0] = (u8)(Addr01 & 0xff);
+		pAd->PermanentAddress[1] = (u8)(Addr01 >> 8);
+		pAd->PermanentAddress[2] = (u8)(Addr23 & 0xff);
+		pAd->PermanentAddress[3] = (u8)(Addr23 >> 8);
+		pAd->PermanentAddress[4] = (u8)(Addr45 & 0xff);
+		pAd->PermanentAddress[5] = (u8)(Addr45 >> 8);
 
-		DBGPRINT(RT_DEBUG_TRACE, ("Initialize MAC Address from E2PROM \n"));
-	}
-	else
-	{
-		INT		j;
-		PUCHAR	macptr;
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("Initialize MAC Address from E2PROM \n"));
+	} else {
+		int j;
+		char *macptr;
 
-		macptr = mac_addr;
+		macptr = (char *)mac_addr;
 
-		for (j=0; j<MAC_ADDR_LEN; j++)
-		{
+		for (j = 0; j < MAC_ADDR_LEN; j++) {
 			AtoH(macptr, &pAd->PermanentAddress[j], 1);
-			macptr=macptr+3;
+			macptr = macptr + 3;
 		}
 
-		DBGPRINT(RT_DEBUG_TRACE, ("Initialize MAC Address from module parameter \n"));
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("Initialize MAC Address from module parameter \n"));
 	}
 
-
 	{
-		//more conveninet to test mbssid, so ap's bssid &0xf1
+		/*more conveninet to test mbssid, so ap's bssid &0xf1 */
 		if (pAd->PermanentAddress[0] == 0xff)
-			pAd->PermanentAddress[0] = RandomByte(pAd)&0xf8;
-
-		//if (pAd->PermanentAddress[5] == 0xff)
-		//	pAd->PermanentAddress[5] = RandomByte(pAd)&0xf8;
-
-		DBGPRINT_RAW(RT_DEBUG_TRACE,("E2PROM MAC: =%02x:%02x:%02x:%02x:%02x:%02x\n",
-			pAd->PermanentAddress[0], pAd->PermanentAddress[1],
-			pAd->PermanentAddress[2], pAd->PermanentAddress[3],
-			pAd->PermanentAddress[4], pAd->PermanentAddress[5]));
-		if (pAd->bLocalAdminMAC == FALSE)
-		{
+			pAd->PermanentAddress[0] = RandomByte(pAd) & 0xf8;
+
+		/*if (pAd->PermanentAddress[5] == 0xff) */
+		/*      pAd->PermanentAddress[5] = RandomByte(pAd)&0xf8; */
+
+		DBGPRINT_RAW(RT_DEBUG_TRACE,
+			     ("E2PROM MAC: =%02x:%02x:%02x:%02x:%02x:%02x\n",
+			      pAd->PermanentAddress[0],
+			      pAd->PermanentAddress[1],
+			      pAd->PermanentAddress[2],
+			      pAd->PermanentAddress[3],
+			      pAd->PermanentAddress[4],
+			      pAd->PermanentAddress[5]));
+		if (pAd->bLocalAdminMAC == FALSE) {
 			MAC_DW0_STRUC csr2;
 			MAC_DW1_STRUC csr3;
-			COPY_MAC_ADDR(pAd->CurrentAddress, pAd->PermanentAddress);
+			COPY_MAC_ADDR(pAd->CurrentAddress,
+				      pAd->PermanentAddress);
 			csr2.field.Byte0 = pAd->CurrentAddress[0];
 			csr2.field.Byte1 = pAd->CurrentAddress[1];
 			csr2.field.Byte2 = pAd->CurrentAddress[2];
@@ -1388,118 +771,116 @@ VOID	NICReadEEPROMParameters(
 			csr3.field.Byte5 = pAd->CurrentAddress[5];
 			csr3.field.U2MeMask = 0xff;
 			RTMP_IO_WRITE32(pAd, MAC_ADDR_DW1, csr3.word);
-			DBGPRINT_RAW(RT_DEBUG_TRACE,("E2PROM MAC: =%02x:%02x:%02x:%02x:%02x:%02x\n",
-				pAd->PermanentAddress[0], pAd->PermanentAddress[1],
-				pAd->PermanentAddress[2], pAd->PermanentAddress[3],
-				pAd->PermanentAddress[4], pAd->PermanentAddress[5]));
+			DBGPRINT_RAW(RT_DEBUG_TRACE,
+				     ("E2PROM MAC: =%02x:%02x:%02x:%02x:%02x:%02x\n",
+				      PRINT_MAC(pAd->PermanentAddress)));
 		}
 	}
 
-	// if not return early. cause fail at emulation.
-	// Init the channel number for TX channel power
+	/* if not return early. cause fail at emulation. */
+	/* Init the channel number for TX channel power */
 	RTMPReadChannelPwr(pAd);
 
-	// if E2PROM version mismatch with driver's expectation, then skip
-	// all subsequent E2RPOM retieval and set a system error bit to notify GUI
+	/* if E2PROM version mismatch with driver's expectation, then skip */
+	/* all subsequent E2RPOM retieval and set a system error bit to notify GUI */
 	RT28xx_EEPROM_READ16(pAd, EEPROM_VERSION_OFFSET, Version.word);
-	pAd->EepromVersion = Version.field.Version + Version.field.FaeReleaseNumber * 256;
-	DBGPRINT(RT_DEBUG_TRACE, ("E2PROM: Version = %d, FAE release #%d\n", Version.field.Version, Version.field.FaeReleaseNumber));
-
-	if (Version.field.Version > VALID_EEPROM_VERSION)
-	{
-		DBGPRINT_ERR(("E2PROM: WRONG VERSION 0x%x, should be %d\n",Version.field.Version, VALID_EEPROM_VERSION));
+	pAd->EepromVersion =
+	    Version.field.Version + Version.field.FaeReleaseNumber * 256;
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("E2PROM: Version = %d, FAE release #%d\n",
+		  Version.field.Version, Version.field.FaeReleaseNumber));
+
+	if (Version.field.Version > VALID_EEPROM_VERSION) {
+		DBGPRINT_ERR(("E2PROM: WRONG VERSION 0x%x, should be %d\n",
+			      Version.field.Version, VALID_EEPROM_VERSION));
 		/*pAd->SystemErrorBitmap |= 0x00000001;
 
-		// hard-code default value when no proper E2PROM installed
-		pAd->bAutoTxAgcA = FALSE;
-		pAd->bAutoTxAgcG = FALSE;
+		   // hard-code default value when no proper E2PROM installed
+		   pAd->bAutoTxAgcA = FALSE;
+		   pAd->bAutoTxAgcG = FALSE;
 
-		// Default the channel power
-		for (i = 0; i < MAX_NUM_OF_CHANNELS; i++)
-			pAd->TxPower[i].Power = DEFAULT_RF_TX_POWER;
+		   // Default the channel power
+		   for (i = 0; i < MAX_NUM_OF_CHANNELS; i++)
+		   pAd->TxPower[i].Power = DEFAULT_RF_TX_POWER;
 
-		// Default the channel power
-		for (i = 0; i < MAX_NUM_OF_11JCHANNELS; i++)
-			pAd->TxPower11J[i].Power = DEFAULT_RF_TX_POWER;
+		   // Default the channel power
+		   for (i = 0; i < MAX_NUM_OF_11JCHANNELS; i++)
+		   pAd->TxPower11J[i].Power = DEFAULT_RF_TX_POWER;
 
-		for(i = 0; i < NUM_EEPROM_BBP_PARMS; i++)
-			pAd->EEPROMDefaultValue[i] = 0xffff;
-		return;  */
+		   for(i = 0; i < NUM_EEPROM_BBP_PARMS; i++)
+		   pAd->EEPROMDefaultValue[i] = 0xffff;
+		   return;  */
 	}
-
-	// Read BBP default value from EEPROM and store to array(EEPROMDefaultValue) in pAd
+	/* Read BBP default value from EEPROM and store to array(EEPROMDefaultValue) in pAd */
 	RT28xx_EEPROM_READ16(pAd, EEPROM_NIC1_OFFSET, value);
 	pAd->EEPROMDefaultValue[0] = value;
 
 	RT28xx_EEPROM_READ16(pAd, EEPROM_NIC2_OFFSET, value);
 	pAd->EEPROMDefaultValue[1] = value;
 
-	RT28xx_EEPROM_READ16(pAd, 0x38, value);	// Country Region
+	RT28xx_EEPROM_READ16(pAd, 0x38, value);	/* Country Region */
 	pAd->EEPROMDefaultValue[2] = value;
 
-	for(i = 0; i < 8; i++)
-	{
-		RT28xx_EEPROM_READ16(pAd, EEPROM_BBP_BASE_OFFSET + i*2, value);
-		pAd->EEPROMDefaultValue[i+3] = value;
+	for (i = 0; i < 8; i++) {
+		RT28xx_EEPROM_READ16(pAd, EEPROM_BBP_BASE_OFFSET + i * 2,
+				     value);
+		pAd->EEPROMDefaultValue[i + 3] = value;
 	}
 
-	// We have to parse NIC configuration 0 at here.
-	// If TSSI did not have preloaded value, it should reset the TxAutoAgc to false
-	// Therefore, we have to read TxAutoAgc control beforehand.
-	// Read Tx AGC control bit
+	/* We have to parse NIC configuration 0 at here. */
+	/* If TSSI did not have preloaded value, it should reset the TxAutoAgc to false */
+	/* Therefore, we have to read TxAutoAgc control beforehand. */
+	/* Read Tx AGC control bit */
 	Antenna.word = pAd->EEPROMDefaultValue[0];
-	if (Antenna.word == 0xFFFF)
-	{
-		if(IS_RT3090(pAd))
-		{
+	if (Antenna.word == 0xFFFF) {
+#ifdef RT30xx
+		if (IS_RT3090(pAd) || IS_RT3390(pAd)) {
 			Antenna.word = 0;
 			Antenna.field.RfIcType = RFIC_3020;
 			Antenna.field.TxPath = 1;
 			Antenna.field.RxPath = 1;
-		}
-		else
+		} else
+#endif /* RT30xx // */
 		{
-		Antenna.word = 0;
-		Antenna.field.RfIcType = RFIC_2820;
-		Antenna.field.TxPath = 1;
-		Antenna.field.RxPath = 2;
-		DBGPRINT(RT_DEBUG_WARN, ("E2PROM error, hard code as 0x%04x\n", Antenna.word));
+
+			Antenna.word = 0;
+			Antenna.field.RfIcType = RFIC_2820;
+			Antenna.field.TxPath = 1;
+			Antenna.field.RxPath = 2;
+			DBGPRINT(RT_DEBUG_WARN,
+				 ("E2PROM error, hard code as 0x%04x\n",
+				  Antenna.word));
 		}
 	}
-
-	// Choose the desired Tx&Rx stream.
-	if ((pAd->CommonCfg.TxStream == 0) || (pAd->CommonCfg.TxStream > Antenna.field.TxPath))
+	/* Choose the desired Tx&Rx stream. */
+	if ((pAd->CommonCfg.TxStream == 0)
+	    || (pAd->CommonCfg.TxStream > Antenna.field.TxPath))
 		pAd->CommonCfg.TxStream = Antenna.field.TxPath;
 
-	if ((pAd->CommonCfg.RxStream == 0) || (pAd->CommonCfg.RxStream > Antenna.field.RxPath))
-	{
+	if ((pAd->CommonCfg.RxStream == 0)
+	    || (pAd->CommonCfg.RxStream > Antenna.field.RxPath)) {
 		pAd->CommonCfg.RxStream = Antenna.field.RxPath;
 
 		if ((pAd->MACVersion < RALINK_2883_VERSION) &&
-			(pAd->CommonCfg.RxStream > 2))
-		{
-			// only 2 Rx streams for RT2860 series
+		    (pAd->CommonCfg.RxStream > 2)) {
+			/* only 2 Rx streams for RT2860 series */
 			pAd->CommonCfg.RxStream = 2;
 		}
 	}
-
-	// 3*3
-	// read value from EEPROM and set them to CSR174 ~ 177 in chain0 ~ chain2
-	// yet implement
-	for(i=0; i<3; i++)
-	{
+	/* 3*3 */
+	/* read value from EEPROM and set them to CSR174 ~ 177 in chain0 ~ chain2 */
+	/* yet implement */
+	for (i = 0; i < 3; i++) {
 	}
 
 	NicConfig2.word = pAd->EEPROMDefaultValue[1];
 
 	{
-		if ((NicConfig2.word & 0x00ff) == 0xff)
-		{
+		if ((NicConfig2.word & 0x00ff) == 0xff) {
 			NicConfig2.word &= 0xff00;
 		}
 
-		if ((NicConfig2.word >> 8) == 0xff)
-		{
+		if ((NicConfig2.word >> 8) == 0xff) {
 			NicConfig2.word &= 0x00ff;
 		}
 	}
@@ -1509,29 +890,43 @@ VOID	NICReadEEPROMParameters(
 	else
 		pAd->bAutoTxAgcA = pAd->bAutoTxAgcG = FALSE;
 
-	DBGPRINT_RAW(RT_DEBUG_TRACE, ("NICReadEEPROMParameters: RxPath = %d, TxPath = %d\n", Antenna.field.RxPath, Antenna.field.TxPath));
+	DBGPRINT_RAW(RT_DEBUG_TRACE,
+		     ("NICReadEEPROMParameters: RxPath = %d, TxPath = %d\n",
+		      Antenna.field.RxPath, Antenna.field.TxPath));
 
-	// Save the antenna for future use
+	/* Save the antenna for future use */
 	pAd->Antenna.word = Antenna.word;
 
-	//
-	// Reset PhyMode if we don't support 802.11a
-	// Only RFIC_2850 & RFIC_2750 support 802.11a
-	//
-	if ((Antenna.field.RfIcType != RFIC_2850) && (Antenna.field.RfIcType != RFIC_2750))
-	{
+	/* Set the RfICType here, then we can initialize RFIC related operation callbacks */
+	pAd->Mlme.RealRxPath = (u8)Antenna.field.RxPath;
+	pAd->RfIcType = (u8)Antenna.field.RfIcType;
+
+#ifdef RTMP_RF_RW_SUPPORT
+	RtmpChipOpsRFHook(pAd);
+#endif /* RTMP_RF_RW_SUPPORT // */
+
+#ifdef RTMP_MAC_PCI
+	sprintf((char *)pAd->nickname, "RT2860STA");
+#endif /* RTMP_MAC_PCI // */
+
+	/* */
+	/* Reset PhyMode if we don't support 802.11a */
+	/* Only RFIC_2850 & RFIC_2750 support 802.11a */
+	/* */
+	if ((Antenna.field.RfIcType != RFIC_2850)
+	    && (Antenna.field.RfIcType != RFIC_2750)
+	    && (Antenna.field.RfIcType != RFIC_3052)) {
 		if ((pAd->CommonCfg.PhyMode == PHY_11ABG_MIXED) ||
-			(pAd->CommonCfg.PhyMode == PHY_11A))
+		    (pAd->CommonCfg.PhyMode == PHY_11A))
 			pAd->CommonCfg.PhyMode = PHY_11BG_MIXED;
-		else if ((pAd->CommonCfg.PhyMode == PHY_11ABGN_MIXED)	||
-				 (pAd->CommonCfg.PhyMode == PHY_11AN_MIXED) 	||
-				 (pAd->CommonCfg.PhyMode == PHY_11AGN_MIXED) 	||
-				 (pAd->CommonCfg.PhyMode == PHY_11N_5G))
+		else if ((pAd->CommonCfg.PhyMode == PHY_11ABGN_MIXED) ||
+			 (pAd->CommonCfg.PhyMode == PHY_11AN_MIXED) ||
+			 (pAd->CommonCfg.PhyMode == PHY_11AGN_MIXED) ||
+			 (pAd->CommonCfg.PhyMode == PHY_11N_5G))
 			pAd->CommonCfg.PhyMode = PHY_11BGN_MIXED;
 	}
-
-	// Read TSSI reference and TSSI boundary for temperature compensation. This is ugly
-	// 0. 11b/g
+	/* Read TSSI reference and TSSI boundary for temperature compensation. This is ugly */
+	/* 0. 11b/g */
 	{
 		/* these are tempature reference value (0x00 ~ 0xFE)
 		   ex: 0x00 0x15 0x25 0x45 0x88 0xA0 0xB5 0xD0 0xF0
@@ -1544,7 +939,7 @@ VOID	NICReadEEPROMParameters(
 		pAd->TssiMinusBoundaryG[2] = Power.field.Byte0;
 		pAd->TssiMinusBoundaryG[1] = Power.field.Byte1;
 		RT28xx_EEPROM_READ16(pAd, 0x72, Power.word);
-		pAd->TssiRefG   = Power.field.Byte0; /* reference value [0] */
+		pAd->TssiRefG = Power.field.Byte0;	/* reference value [0] */
 		pAd->TssiPlusBoundaryG[1] = Power.field.Byte1;
 		RT28xx_EEPROM_READ16(pAd, 0x74, Power.word);
 		pAd->TssiPlusBoundaryG[2] = Power.field.Byte0;
@@ -1554,19 +949,23 @@ VOID	NICReadEEPROMParameters(
 		pAd->TxAgcStepG = Power.field.Byte1;
 		pAd->TxAgcCompensateG = 0;
 		pAd->TssiMinusBoundaryG[0] = pAd->TssiRefG;
-		pAd->TssiPlusBoundaryG[0]  = pAd->TssiRefG;
+		pAd->TssiPlusBoundaryG[0] = pAd->TssiRefG;
 
-		// Disable TxAgc if the based value is not right
+		/* Disable TxAgc if the based value is not right */
 		if (pAd->TssiRefG == 0xff)
 			pAd->bAutoTxAgcG = FALSE;
 
-		DBGPRINT(RT_DEBUG_TRACE,("E2PROM: G Tssi[-4 .. +4] = %d %d %d %d - %d -%d %d %d %d, step=%d, tuning=%d\n",
-			pAd->TssiMinusBoundaryG[4], pAd->TssiMinusBoundaryG[3], pAd->TssiMinusBoundaryG[2], pAd->TssiMinusBoundaryG[1],
-			pAd->TssiRefG,
-			pAd->TssiPlusBoundaryG[1], pAd->TssiPlusBoundaryG[2], pAd->TssiPlusBoundaryG[3], pAd->TssiPlusBoundaryG[4],
-			pAd->TxAgcStepG, pAd->bAutoTxAgcG));
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("E2PROM: G Tssi[-4 .. +4] = %d %d %d %d - %d -%d %d %d %d, step=%d, tuning=%d\n",
+			  pAd->TssiMinusBoundaryG[4],
+			  pAd->TssiMinusBoundaryG[3],
+			  pAd->TssiMinusBoundaryG[2],
+			  pAd->TssiMinusBoundaryG[1], pAd->TssiRefG,
+			  pAd->TssiPlusBoundaryG[1], pAd->TssiPlusBoundaryG[2],
+			  pAd->TssiPlusBoundaryG[3], pAd->TssiPlusBoundaryG[4],
+			  pAd->TxAgcStepG, pAd->bAutoTxAgcG));
 	}
-	// 1. 11a
+	/* 1. 11a */
 	{
 		RT28xx_EEPROM_READ16(pAd, 0xD4, Power.word);
 		pAd->TssiMinusBoundaryA[4] = Power.field.Byte0;
@@ -1575,7 +974,7 @@ VOID	NICReadEEPROMParameters(
 		pAd->TssiMinusBoundaryA[2] = Power.field.Byte0;
 		pAd->TssiMinusBoundaryA[1] = Power.field.Byte1;
 		RT28xx_EEPROM_READ16(pAd, 0xD8, Power.word);
-		pAd->TssiRefA   = Power.field.Byte0;
+		pAd->TssiRefA = Power.field.Byte0;
 		pAd->TssiPlusBoundaryA[1] = Power.field.Byte1;
 		RT28xx_EEPROM_READ16(pAd, 0xDA, Power.word);
 		pAd->TssiPlusBoundaryA[2] = Power.field.Byte0;
@@ -1585,97 +984,119 @@ VOID	NICReadEEPROMParameters(
 		pAd->TxAgcStepA = Power.field.Byte1;
 		pAd->TxAgcCompensateA = 0;
 		pAd->TssiMinusBoundaryA[0] = pAd->TssiRefA;
-		pAd->TssiPlusBoundaryA[0]  = pAd->TssiRefA;
+		pAd->TssiPlusBoundaryA[0] = pAd->TssiRefA;
 
-		// Disable TxAgc if the based value is not right
+		/* Disable TxAgc if the based value is not right */
 		if (pAd->TssiRefA == 0xff)
 			pAd->bAutoTxAgcA = FALSE;
 
-		DBGPRINT(RT_DEBUG_TRACE,("E2PROM: A Tssi[-4 .. +4] = %d %d %d %d - %d -%d %d %d %d, step=%d, tuning=%d\n",
-			pAd->TssiMinusBoundaryA[4], pAd->TssiMinusBoundaryA[3], pAd->TssiMinusBoundaryA[2], pAd->TssiMinusBoundaryA[1],
-			pAd->TssiRefA,
-			pAd->TssiPlusBoundaryA[1], pAd->TssiPlusBoundaryA[2], pAd->TssiPlusBoundaryA[3], pAd->TssiPlusBoundaryA[4],
-			pAd->TxAgcStepA, pAd->bAutoTxAgcA));
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("E2PROM: A Tssi[-4 .. +4] = %d %d %d %d - %d -%d %d %d %d, step=%d, tuning=%d\n",
+			  pAd->TssiMinusBoundaryA[4],
+			  pAd->TssiMinusBoundaryA[3],
+			  pAd->TssiMinusBoundaryA[2],
+			  pAd->TssiMinusBoundaryA[1], pAd->TssiRefA,
+			  pAd->TssiPlusBoundaryA[1], pAd->TssiPlusBoundaryA[2],
+			  pAd->TssiPlusBoundaryA[3], pAd->TssiPlusBoundaryA[4],
+			  pAd->TxAgcStepA, pAd->bAutoTxAgcA));
 	}
 	pAd->BbpRssiToDbmDelta = 0x0;
 
-	// Read frequency offset setting for RF
+	/* Read frequency offset setting for RF */
 	RT28xx_EEPROM_READ16(pAd, EEPROM_FREQ_OFFSET, value);
 	if ((value & 0x00FF) != 0x00FF)
-		pAd->RfFreqOffset = (ULONG) (value & 0x00FF);
+		pAd->RfFreqOffset = (unsigned long)(value & 0x00FF);
 	else
 		pAd->RfFreqOffset = 0;
-	DBGPRINT(RT_DEBUG_TRACE, ("E2PROM: RF FreqOffset=0x%lx \n", pAd->RfFreqOffset));
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("E2PROM: RF FreqOffset=0x%lx \n", pAd->RfFreqOffset));
 
-	//CountryRegion byte offset (38h)
-	value = pAd->EEPROMDefaultValue[2] >> 8;		// 2.4G band
-	value2 = pAd->EEPROMDefaultValue[2] & 0x00FF;	// 5G band
+	/*CountryRegion byte offset (38h) */
+	value = pAd->EEPROMDefaultValue[2] >> 8;	/* 2.4G band */
+	value2 = pAd->EEPROMDefaultValue[2] & 0x00FF;	/* 5G band */
 
-	if ((value <= REGION_MAXIMUM_BG_BAND) && (value2 <= REGION_MAXIMUM_A_BAND))
-	{
-		pAd->CommonCfg.CountryRegion = ((UCHAR) value) | 0x80;
-		pAd->CommonCfg.CountryRegionForABand = ((UCHAR) value2) | 0x80;
+	if ((value <= REGION_MAXIMUM_BG_BAND)
+	    && (value2 <= REGION_MAXIMUM_A_BAND)) {
+		pAd->CommonCfg.CountryRegion = ((u8)value) | 0x80;
+		pAd->CommonCfg.CountryRegionForABand = ((u8)value2) | 0x80;
 		TmpPhy = pAd->CommonCfg.PhyMode;
 		pAd->CommonCfg.PhyMode = 0xff;
 		RTMPSetPhyMode(pAd, TmpPhy);
 		SetCommonHT(pAd);
 	}
-
-	//
-	// Get RSSI Offset on EEPROM 0x9Ah & 0x9Ch.
-	// The valid value are (-10 ~ 10)
-	//
+	/* */
+	/* Get RSSI Offset on EEPROM 0x9Ah & 0x9Ch. */
+	/* The valid value are (-10 ~ 10) */
+	/* */
 	RT28xx_EEPROM_READ16(pAd, EEPROM_RSSI_BG_OFFSET, value);
 	pAd->BGRssiOffset0 = value & 0x00ff;
 	pAd->BGRssiOffset1 = (value >> 8);
-	RT28xx_EEPROM_READ16(pAd, EEPROM_RSSI_BG_OFFSET+2, value);
+	RT28xx_EEPROM_READ16(pAd, EEPROM_RSSI_BG_OFFSET + 2, value);
 	pAd->BGRssiOffset2 = value & 0x00ff;
 	pAd->ALNAGain1 = (value >> 8);
 	RT28xx_EEPROM_READ16(pAd, EEPROM_LNA_OFFSET, value);
 	pAd->BLNAGain = value & 0x00ff;
 	pAd->ALNAGain0 = (value >> 8);
 
-	// Validate 11b/g RSSI_0 offset.
+	/* Validate 11b/g RSSI_0 offset. */
 	if ((pAd->BGRssiOffset0 < -10) || (pAd->BGRssiOffset0 > 10))
 		pAd->BGRssiOffset0 = 0;
 
-	// Validate 11b/g RSSI_1 offset.
+	/* Validate 11b/g RSSI_1 offset. */
 	if ((pAd->BGRssiOffset1 < -10) || (pAd->BGRssiOffset1 > 10))
 		pAd->BGRssiOffset1 = 0;
 
-	// Validate 11b/g RSSI_2 offset.
+	/* Validate 11b/g RSSI_2 offset. */
 	if ((pAd->BGRssiOffset2 < -10) || (pAd->BGRssiOffset2 > 10))
 		pAd->BGRssiOffset2 = 0;
 
 	RT28xx_EEPROM_READ16(pAd, EEPROM_RSSI_A_OFFSET, value);
 	pAd->ARssiOffset0 = value & 0x00ff;
 	pAd->ARssiOffset1 = (value >> 8);
-	RT28xx_EEPROM_READ16(pAd, (EEPROM_RSSI_A_OFFSET+2), value);
+	RT28xx_EEPROM_READ16(pAd, (EEPROM_RSSI_A_OFFSET + 2), value);
 	pAd->ARssiOffset2 = value & 0x00ff;
 	pAd->ALNAGain2 = (value >> 8);
 
-	if (((UCHAR)pAd->ALNAGain1 == 0xFF) || (pAd->ALNAGain1 == 0x00))
+	if (((u8)pAd->ALNAGain1 == 0xFF) || (pAd->ALNAGain1 == 0x00))
 		pAd->ALNAGain1 = pAd->ALNAGain0;
-	if (((UCHAR)pAd->ALNAGain2 == 0xFF) || (pAd->ALNAGain2 == 0x00))
+	if (((u8)pAd->ALNAGain2 == 0xFF) || (pAd->ALNAGain2 == 0x00))
 		pAd->ALNAGain2 = pAd->ALNAGain0;
 
-	// Validate 11a RSSI_0 offset.
+	/* Validate 11a RSSI_0 offset. */
 	if ((pAd->ARssiOffset0 < -10) || (pAd->ARssiOffset0 > 10))
 		pAd->ARssiOffset0 = 0;
 
-	// Validate 11a RSSI_1 offset.
+	/* Validate 11a RSSI_1 offset. */
 	if ((pAd->ARssiOffset1 < -10) || (pAd->ARssiOffset1 > 10))
 		pAd->ARssiOffset1 = 0;
 
-	//Validate 11a RSSI_2 offset.
+	/*Validate 11a RSSI_2 offset. */
 	if ((pAd->ARssiOffset2 < -10) || (pAd->ARssiOffset2 > 10))
 		pAd->ARssiOffset2 = 0;
 
-	//
-	// Get LED Setting.
-	//
+#ifdef RT30xx
+	/* */
+	/* Get TX mixer gain setting */
+	/* 0xff are invalid value */
+	/* Note: RT30xX default value is 0x00 and will program to RF_R17 only when this value is not zero. */
+	/*       RT359X default value is 0x02 */
+	/* */
+	if (IS_RT30xx(pAd) || IS_RT3572(pAd)) {
+		RT28xx_EEPROM_READ16(pAd, EEPROM_TXMIXER_GAIN_2_4G, value);
+		pAd->TxMixerGain24G = 0;
+		value &= 0x00ff;
+		if (value != 0xff) {
+			value &= 0x07;
+			pAd->TxMixerGain24G = (u8)value;
+		}
+	}
+#endif /* RT30xx // */
+
+	/* */
+	/* Get LED Setting. */
+	/* */
 	RT28xx_EEPROM_READ16(pAd, 0x3a, value);
-	pAd->LedCntl.word = (value&0xff00) >> 8;
+	pAd->LedCntl.word = (value >> 8);
 	RT28xx_EEPROM_READ16(pAd, EEPROM_LED1_OFFSET, value);
 	pAd->Led1 = value;
 	RT28xx_EEPROM_READ16(pAd, EEPROM_LED2_OFFSET, value);
@@ -1685,6 +1106,12 @@ VOID	NICReadEEPROMParameters(
 
 	RTMPReadTxPwrPerRate(pAd);
 
+#ifdef RT30xx
+#ifdef RTMP_EFUSE_SUPPORT
+	RtmpEfuseSupportCheck(pAd);
+#endif /* RTMP_EFUSE_SUPPORT // */
+#endif /* RT30xx // */
+
 	DBGPRINT(RT_DEBUG_TRACE, ("<-- NICReadEEPROMParameters\n"));
 }
 
@@ -1706,170 +1133,218 @@ VOID	NICReadEEPROMParameters(
 
 	========================================================================
 */
-VOID	NICInitAsicFromEEPROM(
-	IN	PRTMP_ADAPTER	pAd)
+void NICInitAsicFromEEPROM(struct rt_rtmp_adapter *pAd)
 {
-	UINT32					data = 0;
-	UCHAR	BBPR1 = 0;
-	USHORT					i;
-	EEPROM_ANTENNA_STRUC	Antenna;
-	EEPROM_NIC_CONFIG2_STRUC    NicConfig2;
-	UCHAR	BBPR3 = 0;
+	u32 data = 0;
+	u8 BBPR1 = 0;
+	u16 i;
+/*      EEPROM_ANTENNA_STRUC    Antenna; */
+	EEPROM_NIC_CONFIG2_STRUC NicConfig2;
+	u8 BBPR3 = 0;
 
 	DBGPRINT(RT_DEBUG_TRACE, ("--> NICInitAsicFromEEPROM\n"));
-	for(i = 3; i < NUM_EEPROM_BBP_PARMS; i++)
-	{
-		UCHAR BbpRegIdx, BbpValue;
+	for (i = 3; i < NUM_EEPROM_BBP_PARMS; i++) {
+		u8 BbpRegIdx, BbpValue;
 
-		if ((pAd->EEPROMDefaultValue[i] != 0xFFFF) && (pAd->EEPROMDefaultValue[i] != 0))
-		{
-			BbpRegIdx = (UCHAR)(pAd->EEPROMDefaultValue[i] >> 8);
-			BbpValue  = (UCHAR)(pAd->EEPROMDefaultValue[i] & 0xff);
+		if ((pAd->EEPROMDefaultValue[i] != 0xFFFF)
+		    && (pAd->EEPROMDefaultValue[i] != 0)) {
+			BbpRegIdx = (u8)(pAd->EEPROMDefaultValue[i] >> 8);
+			BbpValue = (u8)(pAd->EEPROMDefaultValue[i] & 0xff);
 			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BbpRegIdx, BbpValue);
 		}
 	}
 
-#ifndef RT2870
-	Antenna.word = pAd->Antenna.word;
-#else
-	Antenna.word = pAd->EEPROMDefaultValue[0];
-	if (Antenna.word == 0xFFFF)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("E2PROM error, hard code as 0x%04x\n", Antenna.word));
-		BUG_ON(Antenna.word == 0xFFFF);
-	}
-#endif
-	pAd->Mlme.RealRxPath = (UCHAR) Antenna.field.RxPath;
-	pAd->RfIcType = (UCHAR) Antenna.field.RfIcType;
-
-#ifdef RT2870
-	DBGPRINT(RT_DEBUG_WARN, ("pAd->RfIcType = %d, RealRxPath=%d, TxPath = %d\n", pAd->RfIcType, pAd->Mlme.RealRxPath,Antenna.field.TxPath));
-
-	// Save the antenna for future use
-	pAd->Antenna.word = Antenna.word;
-#endif
 	NicConfig2.word = pAd->EEPROMDefaultValue[1];
 
-#ifdef RT2870
 	{
-		if ((NicConfig2.word & 0x00ff) == 0xff)
-		{
+		if ((NicConfig2.word & 0x00ff) == 0xff) {
 			NicConfig2.word &= 0xff00;
 		}
 
-		if ((NicConfig2.word >> 8) == 0xff)
-		{
+		if ((NicConfig2.word >> 8) == 0xff) {
 			NicConfig2.word &= 0x00ff;
 		}
 	}
-#endif
-	// Save the antenna for future use
+
+	/* Save the antenna for future use */
 	pAd->NicConfig2.word = NicConfig2.word;
 
-#ifdef RT2870
-	// set default antenna as main
+#ifdef RT30xx
+	/* set default antenna as main */
 	if (pAd->RfIcType == RFIC_3020)
 		AsicSetRxAnt(pAd, pAd->RxAnt.Pair1PrimaryRxAnt);
-#endif
-	//
-	// Send LED Setting to MCU.
-	//
-	if (pAd->LedCntl.word == 0xFF)
-	{
+#endif /* RT30xx // */
+
+	/* */
+	/* Send LED Setting to MCU. */
+	/* */
+	if (pAd->LedCntl.word == 0xFF) {
 		pAd->LedCntl.word = 0x01;
 		pAd->Led1 = 0x5555;
 		pAd->Led2 = 0x2221;
-#ifdef RT2860
-		pAd->Led3 = 0xA9F8;
-#endif
 
-#ifdef RT2870
+#ifdef RTMP_MAC_PCI
+		pAd->Led3 = 0xA9F8;
+#endif /* RTMP_MAC_PCI // */
+#ifdef RTMP_MAC_USB
 		pAd->Led3 = 0x5627;
-#endif // RT2870 //
+#endif /* RTMP_MAC_USB // */
 	}
 
-	AsicSendCommandToMcu(pAd, 0x52, 0xff, (UCHAR)pAd->Led1, (UCHAR)(pAd->Led1 >> 8));
-	AsicSendCommandToMcu(pAd, 0x53, 0xff, (UCHAR)pAd->Led2, (UCHAR)(pAd->Led2 >> 8));
-	AsicSendCommandToMcu(pAd, 0x54, 0xff, (UCHAR)pAd->Led3, (UCHAR)(pAd->Led3 >> 8));
-    pAd->LedIndicatorStregth = 0xFF;
-    RTMPSetSignalLED(pAd, -100);	// Force signal strength Led to be turned off, before link up
+	AsicSendCommandToMcu(pAd, 0x52, 0xff, (u8)pAd->Led1,
+			     (u8)(pAd->Led1 >> 8));
+	AsicSendCommandToMcu(pAd, 0x53, 0xff, (u8)pAd->Led2,
+			     (u8)(pAd->Led2 >> 8));
+	AsicSendCommandToMcu(pAd, 0x54, 0xff, (u8)pAd->Led3,
+			     (u8)(pAd->Led3 >> 8));
+	AsicSendCommandToMcu(pAd, 0x51, 0xff, 0, pAd->LedCntl.field.Polarity);
+
+	pAd->LedIndicatorStrength = 0xFF;
+	RTMPSetSignalLED(pAd, -100);	/* Force signal strength Led to be turned off, before link up */
 
 	{
-		// Read Hardware controlled Radio state enable bit
-		if (NicConfig2.field.HardwareRadioControl == 1)
-		{
+		/* Read Hardware controlled Radio state enable bit */
+		if (NicConfig2.field.HardwareRadioControl == 1) {
 			pAd->StaCfg.bHardwareRadio = TRUE;
 
-			// Read GPIO pin2 as Hardware controlled radio state
+			/* Read GPIO pin2 as Hardware controlled radio state */
 			RTMP_IO_READ32(pAd, GPIO_CTRL_CFG, &data);
-			if ((data & 0x04) == 0)
-			{
+			if ((data & 0x04) == 0) {
 				pAd->StaCfg.bHwRadio = FALSE;
 				pAd->StaCfg.bRadio = FALSE;
+/*                              RTMP_IO_WRITE32(pAd, PWR_PIN_CFG, 0x00001818); */
 				RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_RADIO_OFF);
 			}
-		}
-		else
+		} else
 			pAd->StaCfg.bHardwareRadio = FALSE;
 
-		if (pAd->StaCfg.bRadio == FALSE)
-		{
+		if (pAd->StaCfg.bRadio == FALSE) {
 			RTMPSetLED(pAd, LED_RADIO_OFF);
-		}
-		else
-		{
+		} else {
 			RTMPSetLED(pAd, LED_RADIO_ON);
-#ifdef RT2860
+#ifdef RTMP_MAC_PCI
+#ifdef RT3090
+			AsicSendCommandToMcu(pAd, 0x30, PowerRadioOffCID, 0xff,
+					     0x02);
+			AsicCheckCommanOk(pAd, PowerRadioOffCID);
+#endif /* RT3090 // */
+#ifndef RT3090
 			AsicSendCommandToMcu(pAd, 0x30, 0xff, 0xff, 0x02);
-			AsicSendCommandToMcu(pAd, 0x31, PowerWakeCID, 0x00, 0x00);
-			// 2-1. wait command ok.
+#endif /* RT3090 // */
+			AsicSendCommandToMcu(pAd, 0x31, PowerWakeCID, 0x00,
+					     0x00);
+			/* 2-1. wait command ok. */
 			AsicCheckCommanOk(pAd, PowerWakeCID);
-#endif
+#endif /* RTMP_MAC_PCI // */
 		}
 	}
 
-	// Turn off patching for cardbus controller
-	if (NicConfig2.field.CardbusAcceleration == 1)
-	{
+#ifdef RTMP_MAC_PCI
+#ifdef RT30xx
+	if (IS_RT3090(pAd) || IS_RT3572(pAd) || IS_RT3390(pAd)) {
+		struct rt_rtmp_chip_op *pChipOps = &pAd->chipOps;
+		if (pChipOps->AsicReverseRfFromSleepMode)
+			pChipOps->AsicReverseRfFromSleepMode(pAd);
+	}
+	/* 3090 MCU Wakeup command needs more time to be stable. */
+	/* Before stable, don't issue other MCU command to prevent from firmware error. */
+
+	if ((IS_RT3090(pAd) || IS_RT3572(pAd) || IS_RT3390(pAd))
+	    && IS_VERSION_AFTER_F(pAd)
+	    && (pAd->StaCfg.PSControl.field.rt30xxPowerMode == 3)
+	    && (pAd->StaCfg.PSControl.field.EnableNewPS == TRUE)) {
+		DBGPRINT(RT_DEBUG_TRACE, ("%s, release Mcu Lock\n", __func__));
+		RTMP_SEM_LOCK(&pAd->McuCmdLock);
+		pAd->brt30xxBanMcuCmd = FALSE;
+		RTMP_SEM_UNLOCK(&pAd->McuCmdLock);
+	}
+#endif /* RT30xx // */
+#endif /* RTMP_MAC_PCI // */
+
+	/* Turn off patching for cardbus controller */
+	if (NicConfig2.field.CardbusAcceleration == 1) {
+/*              pAd->bTest1 = TRUE; */
 	}
 
 	if (NicConfig2.field.DynamicTxAgcControl == 1)
 		pAd->bAutoTxAgcA = pAd->bAutoTxAgcG = TRUE;
 	else
 		pAd->bAutoTxAgcA = pAd->bAutoTxAgcG = FALSE;
-
-	/* BBP has been programmed so reset to UNKNOWN_BAND */
+	/* */
+	/* Since BBP has been progamed, to make sure BBP setting will be */
+	/* upate inside of AsicAntennaSelect, so reset to UNKNOWN_BAND! */
+	/* */
 	pAd->CommonCfg.BandState = UNKNOWN_BAND;
 
 	RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R3, &BBPR3);
 	BBPR3 &= (~0x18);
-	if(pAd->Antenna.field.RxPath == 3)
-	{
+	if (pAd->Antenna.field.RxPath == 3) {
 		BBPR3 |= (0x10);
-	}
-	else if(pAd->Antenna.field.RxPath == 2)
-	{
+	} else if (pAd->Antenna.field.RxPath == 2) {
 		BBPR3 |= (0x8);
-	}
-	else if(pAd->Antenna.field.RxPath == 1)
-	{
+	} else if (pAd->Antenna.field.RxPath == 1) {
 		BBPR3 |= (0x0);
 	}
 	RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R3, BBPR3);
 
 	{
-		// Handle the difference when 1T
+		/* Handle the difference when 1T */
 		RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R1, &BBPR1);
-		if(pAd->Antenna.field.TxPath == 1)
-		{
-		BBPR1 &= (~0x18);
+		if (pAd->Antenna.field.TxPath == 1) {
+			BBPR1 &= (~0x18);
 		}
 		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R1, BBPR1);
 
-		DBGPRINT(RT_DEBUG_TRACE, ("Use Hw Radio Control Pin=%d; if used Pin=%d;\n", pAd->CommonCfg.bHardwareRadio, pAd->CommonCfg.bHardwareRadio));
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("Use Hw Radio Control Pin=%d; if used Pin=%d;\n",
+			  pAd->CommonCfg.bHardwareRadio,
+			  pAd->CommonCfg.bHardwareRadio));
+	}
+
+#ifdef RTMP_MAC_USB
+#ifdef RT30xx
+	/* update registers from EEPROM for RT3071 or later(3572/3592). */
+
+	if (IS_RT3090(pAd) || IS_RT3572(pAd) || IS_RT3390(pAd)) {
+		u8 RegIdx, RegValue;
+		u16 value;
+
+		/* after RT3071, write BBP from EEPROM 0xF0 to 0x102 */
+		for (i = 0xF0; i <= 0x102; i = i + 2) {
+			value = 0xFFFF;
+			RT28xx_EEPROM_READ16(pAd, i, value);
+			if ((value != 0xFFFF) && (value != 0)) {
+				RegIdx = (u8)(value >> 8);
+				RegValue = (u8)(value & 0xff);
+				RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, RegIdx,
+							     RegValue);
+				DBGPRINT(RT_DEBUG_TRACE,
+					 ("Update BBP Registers from EEPROM(0x%0x), BBP(0x%x) = 0x%x\n",
+					  i, RegIdx, RegValue));
+			}
+		}
+
+		/* after RT3071, write RF from EEPROM 0x104 to 0x116 */
+		for (i = 0x104; i <= 0x116; i = i + 2) {
+			value = 0xFFFF;
+			RT28xx_EEPROM_READ16(pAd, i, value);
+			if ((value != 0xFFFF) && (value != 0)) {
+				RegIdx = (u8)(value >> 8);
+				RegValue = (u8)(value & 0xff);
+				RT30xxWriteRFRegister(pAd, RegIdx, RegValue);
+				DBGPRINT(RT_DEBUG_TRACE,
+					 ("Update RF Registers from EEPROM0x%x), BBP(0x%x) = 0x%x\n",
+					  i, RegIdx, RegValue));
+			}
+		}
 	}
+#endif /* RT30xx // */
+#endif /* RTMP_MAC_USB // */
 
-	DBGPRINT(RT_DEBUG_TRACE, ("TxPath = %d, RxPath = %d, RFIC=%d, Polar+LED mode=%x\n", pAd->Antenna.field.TxPath, pAd->Antenna.field.RxPath, pAd->RfIcType, pAd->LedCntl.word));
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("TxPath = %d, RxPath = %d, RFIC=%d, Polar+LED mode=%x\n",
+		  pAd->Antenna.field.TxPath, pAd->Antenna.field.RxPath,
+		  pAd->RfIcType, pAd->LedCntl.word));
 	DBGPRINT(RT_DEBUG_TRACE, ("<-- NICInitAsicFromEEPROM\n"));
 }
 
@@ -1891,39 +1366,39 @@ VOID	NICInitAsicFromEEPROM(
 
 	========================================================================
 */
-NDIS_STATUS	NICInitializeAdapter(
-	IN	PRTMP_ADAPTER	pAd,
-	IN   BOOLEAN    bHardReset)
+int NICInitializeAdapter(struct rt_rtmp_adapter *pAd, IN BOOLEAN bHardReset)
 {
-	NDIS_STATUS     Status = NDIS_STATUS_SUCCESS;
-	WPDMA_GLO_CFG_STRUC	GloCfg;
-#ifdef RT2860
-	UINT32			Value;
-	DELAY_INT_CFG_STRUC	IntCfg;
-#endif
-	ULONG	i =0, j=0;
-	AC_TXOP_CSR0_STRUC	csr0;
+	int Status = NDIS_STATUS_SUCCESS;
+	WPDMA_GLO_CFG_STRUC GloCfg;
+#ifdef RTMP_MAC_PCI
+	u32 Value;
+	DELAY_INT_CFG_STRUC IntCfg;
+#endif /* RTMP_MAC_PCI // */
+/*      INT_MASK_CSR_STRUC              IntMask; */
+	unsigned long i = 0, j = 0;
+	AC_TXOP_CSR0_STRUC csr0;
 
 	DBGPRINT(RT_DEBUG_TRACE, ("--> NICInitializeAdapter\n"));
 
-	// 3. Set DMA global configuration except TX_DMA_EN and RX_DMA_EN bits:
+	/* 3. Set DMA global configuration except TX_DMA_EN and RX_DMA_EN bits: */
 retry:
 	i = 0;
-	do
-	{
+	do {
 		RTMP_IO_READ32(pAd, WPDMA_GLO_CFG, &GloCfg.word);
-		if ((GloCfg.field.TxDMABusy == 0)  && (GloCfg.field.RxDMABusy == 0))
+		if ((GloCfg.field.TxDMABusy == 0)
+		    && (GloCfg.field.RxDMABusy == 0))
 			break;
 
 		RTMPusecDelay(1000);
 		i++;
-	}while ( i<100);
-	DBGPRINT(RT_DEBUG_TRACE, ("<== DMA offset 0x208 = 0x%x\n", GloCfg.word));
+	} while (i < 100);
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("<== DMA offset 0x208 = 0x%x\n", GloCfg.word));
 	GloCfg.word &= 0xff0;
-	GloCfg.field.EnTXWriteBackDDONE =1;
+	GloCfg.field.EnTXWriteBackDDONE = 1;
 	RTMP_IO_WRITE32(pAd, WPDMA_GLO_CFG, GloCfg.word);
 
-	// Record HW Beacon offset
+	/* Record HW Beacon offset */
 	pAd->BeaconOffset[0] = HW_BEACON_BASE0;
 	pAd->BeaconOffset[1] = HW_BEACON_BASE1;
 	pAd->BeaconOffset[2] = HW_BEACON_BASE2;
@@ -1933,91 +1408,87 @@ retry:
 	pAd->BeaconOffset[6] = HW_BEACON_BASE6;
 	pAd->BeaconOffset[7] = HW_BEACON_BASE7;
 
-	//
-	// write all shared Ring's base address into ASIC
-	//
+	/* */
+	/* write all shared Ring's base address into ASIC */
+	/* */
 
-	// asic simulation sequence put this ahead before loading firmware.
-	// pbf hardware reset
-#ifdef RT2860
-	RTMP_IO_WRITE32(pAd, WPDMA_RST_IDX, 0x1003f);	// 0x10000 for reset rx, 0x3f resets all 6 tx rings.
+	/* asic simulation sequence put this ahead before loading firmware. */
+	/* pbf hardware reset */
+#ifdef RTMP_MAC_PCI
+	RTMP_IO_WRITE32(pAd, WPDMA_RST_IDX, 0x1003f);	/* 0x10000 for reset rx, 0x3f resets all 6 tx rings. */
 	RTMP_IO_WRITE32(pAd, PBF_SYS_CTRL, 0xe1f);
 	RTMP_IO_WRITE32(pAd, PBF_SYS_CTRL, 0xe00);
-#endif
+#endif /* RTMP_MAC_PCI // */
 
-	// Initialze ASIC for TX & Rx operation
-	if (NICInitializeAsic(pAd , bHardReset) != NDIS_STATUS_SUCCESS)
-	{
-		if (j++ == 0)
-		{
+	/* Initialze ASIC for TX & Rx operation */
+	if (NICInitializeAsic(pAd, bHardReset) != NDIS_STATUS_SUCCESS) {
+		if (j++ == 0) {
 			NICLoadFirmware(pAd);
 			goto retry;
 		}
 		return NDIS_STATUS_FAILURE;
 	}
 
-
-#ifdef RT2860
-	// Write AC_BK base address register
-	Value = RTMP_GetPhysicalAddressLow(pAd->TxRing[QID_AC_BK].Cell[0].AllocPa);
+#ifdef RTMP_MAC_PCI
+	/* Write AC_BK base address register */
+	Value =
+	    RTMP_GetPhysicalAddressLow(pAd->TxRing[QID_AC_BK].Cell[0].AllocPa);
 	RTMP_IO_WRITE32(pAd, TX_BASE_PTR1, Value);
 	DBGPRINT(RT_DEBUG_TRACE, ("--> TX_BASE_PTR1 : 0x%x\n", Value));
 
-	// Write AC_BE base address register
-	Value = RTMP_GetPhysicalAddressLow(pAd->TxRing[QID_AC_BE].Cell[0].AllocPa);
+	/* Write AC_BE base address register */
+	Value =
+	    RTMP_GetPhysicalAddressLow(pAd->TxRing[QID_AC_BE].Cell[0].AllocPa);
 	RTMP_IO_WRITE32(pAd, TX_BASE_PTR0, Value);
 	DBGPRINT(RT_DEBUG_TRACE, ("--> TX_BASE_PTR0 : 0x%x\n", Value));
 
-	// Write AC_VI base address register
-	Value = RTMP_GetPhysicalAddressLow(pAd->TxRing[QID_AC_VI].Cell[0].AllocPa);
+	/* Write AC_VI base address register */
+	Value =
+	    RTMP_GetPhysicalAddressLow(pAd->TxRing[QID_AC_VI].Cell[0].AllocPa);
 	RTMP_IO_WRITE32(pAd, TX_BASE_PTR2, Value);
 	DBGPRINT(RT_DEBUG_TRACE, ("--> TX_BASE_PTR2 : 0x%x\n", Value));
 
-	// Write AC_VO base address register
-	Value = RTMP_GetPhysicalAddressLow(pAd->TxRing[QID_AC_VO].Cell[0].AllocPa);
+	/* Write AC_VO base address register */
+	Value =
+	    RTMP_GetPhysicalAddressLow(pAd->TxRing[QID_AC_VO].Cell[0].AllocPa);
 	RTMP_IO_WRITE32(pAd, TX_BASE_PTR3, Value);
 	DBGPRINT(RT_DEBUG_TRACE, ("--> TX_BASE_PTR3 : 0x%x\n", Value));
 
-	// Write HCCA base address register
-	  Value = RTMP_GetPhysicalAddressLow(pAd->TxRing[QID_HCCA].Cell[0].AllocPa);
-	  RTMP_IO_WRITE32(pAd, TX_BASE_PTR4, Value);
-	DBGPRINT(RT_DEBUG_TRACE, ("--> TX_BASE_PTR4 : 0x%x\n", Value));
-
-	// Write MGMT_BASE_CSR register
+	/* Write MGMT_BASE_CSR register */
 	Value = RTMP_GetPhysicalAddressLow(pAd->MgmtRing.Cell[0].AllocPa);
 	RTMP_IO_WRITE32(pAd, TX_BASE_PTR5, Value);
 	DBGPRINT(RT_DEBUG_TRACE, ("--> TX_BASE_PTR5 : 0x%x\n", Value));
 
-	// Write RX_BASE_CSR register
+	/* Write RX_BASE_CSR register */
 	Value = RTMP_GetPhysicalAddressLow(pAd->RxRing.Cell[0].AllocPa);
 	RTMP_IO_WRITE32(pAd, RX_BASE_PTR, Value);
 	DBGPRINT(RT_DEBUG_TRACE, ("--> RX_BASE_PTR : 0x%x\n", Value));
 
-	// Init RX Ring index pointer
+	/* Init RX Ring index pointer */
 	pAd->RxRing.RxSwReadIdx = 0;
-	pAd->RxRing.RxCpuIdx = RX_RING_SIZE-1;
+	pAd->RxRing.RxCpuIdx = RX_RING_SIZE - 1;
 	RTMP_IO_WRITE32(pAd, RX_CRX_IDX, pAd->RxRing.RxCpuIdx);
 
-	// Init TX rings index pointer
+	/* Init TX rings index pointer */
 	{
-		for (i=0; i<NUM_OF_TX_RING; i++)
-		{
+		for (i = 0; i < NUM_OF_TX_RING; i++) {
 			pAd->TxRing[i].TxSwFreeIdx = 0;
 			pAd->TxRing[i].TxCpuIdx = 0;
-			RTMP_IO_WRITE32(pAd, (TX_CTX_IDX0 + i * 0x10) ,  pAd->TxRing[i].TxCpuIdx);
+			RTMP_IO_WRITE32(pAd, (TX_CTX_IDX0 + i * 0x10),
+					pAd->TxRing[i].TxCpuIdx);
 		}
 	}
 
-	// init MGMT ring index pointer
+	/* init MGMT ring index pointer */
 	pAd->MgmtRing.TxSwFreeIdx = 0;
 	pAd->MgmtRing.TxCpuIdx = 0;
-	RTMP_IO_WRITE32(pAd, TX_MGMTCTX_IDX,  pAd->MgmtRing.TxCpuIdx);
+	RTMP_IO_WRITE32(pAd, TX_MGMTCTX_IDX, pAd->MgmtRing.TxCpuIdx);
 
-	//
-	// set each Ring's SIZE  into ASIC. Descriptor Size is fixed by design.
-	//
+	/* */
+	/* set each Ring's SIZE  into ASIC. Descriptor Size is fixed by design. */
+	/* */
 
-	// Write TX_RING_CSR0 register
+	/* Write TX_RING_CSR0 register */
 	Value = TX_RING_SIZE;
 	RTMP_IO_WRITE32(pAd, TX_MAX_CNT0, Value);
 	RTMP_IO_WRITE32(pAd, TX_MAX_CNT1, Value);
@@ -2027,53 +1498,47 @@ retry:
 	Value = MGMT_RING_SIZE;
 	RTMP_IO_WRITE32(pAd, TX_MGMTMAX_CNT, Value);
 
-	// Write RX_RING_CSR register
+	/* Write RX_RING_CSR register */
 	Value = RX_RING_SIZE;
 	RTMP_IO_WRITE32(pAd, RX_MAX_CNT, Value);
-#endif /* RT2860 */
+#endif /* RTMP_MAC_PCI // */
 
-
-	// WMM parameter
+	/* WMM parameter */
 	csr0.word = 0;
 	RTMP_IO_WRITE32(pAd, WMM_TXOP0_CFG, csr0.word);
-	if (pAd->CommonCfg.PhyMode == PHY_11B)
-	{
-		csr0.field.Ac0Txop = 192;	// AC_VI: 192*32us ~= 6ms
-		csr0.field.Ac1Txop = 96;	// AC_VO: 96*32us  ~= 3ms
-	}
-	else
-	{
-		csr0.field.Ac0Txop = 96;	// AC_VI: 96*32us ~= 3ms
-		csr0.field.Ac1Txop = 48;	// AC_VO: 48*32us ~= 1.5ms
+	if (pAd->CommonCfg.PhyMode == PHY_11B) {
+		csr0.field.Ac0Txop = 192;	/* AC_VI: 192*32us ~= 6ms */
+		csr0.field.Ac1Txop = 96;	/* AC_VO: 96*32us  ~= 3ms */
+	} else {
+		csr0.field.Ac0Txop = 96;	/* AC_VI: 96*32us ~= 3ms */
+		csr0.field.Ac1Txop = 48;	/* AC_VO: 48*32us ~= 1.5ms */
 	}
 	RTMP_IO_WRITE32(pAd, WMM_TXOP1_CFG, csr0.word);
 
-
-#ifdef RT2860
-	// 3. Set DMA global configuration except TX_DMA_EN and RX_DMA_EN bits:
+#ifdef RTMP_MAC_PCI
+	/* 3. Set DMA global configuration except TX_DMA_EN and RX_DMA_EN bits: */
 	i = 0;
-	do
-	{
+	do {
 		RTMP_IO_READ32(pAd, WPDMA_GLO_CFG, &GloCfg.word);
-		if ((GloCfg.field.TxDMABusy == 0)  && (GloCfg.field.RxDMABusy == 0))
+		if ((GloCfg.field.TxDMABusy == 0)
+		    && (GloCfg.field.RxDMABusy == 0))
 			break;
 
 		RTMPusecDelay(1000);
 		i++;
-	}while ( i < 100);
+	} while (i < 100);
 
 	GloCfg.word &= 0xff0;
-	GloCfg.field.EnTXWriteBackDDONE =1;
+	GloCfg.field.EnTXWriteBackDDONE = 1;
 	RTMP_IO_WRITE32(pAd, WPDMA_GLO_CFG, GloCfg.word);
 
 	IntCfg.word = 0;
 	RTMP_IO_WRITE32(pAd, DELAY_INT_CFG, IntCfg.word);
-#endif
-
+#endif /* RTMP_MAC_PCI // */
 
-	// reset action
-	// Load firmware
-	//  Status = NICLoadFirmware(pAd);
+	/* reset action */
+	/* Load firmware */
+	/*  Status = NICLoadFirmware(pAd); */
 
 	DBGPRINT(RT_DEBUG_TRACE, ("<-- NICInitializeAdapter\n"));
 	return Status;
@@ -2097,42 +1562,55 @@ retry:
 
 	========================================================================
 */
-NDIS_STATUS	NICInitializeAsic(
-	IN	PRTMP_ADAPTER	pAd,
-	IN  BOOLEAN		bHardReset)
+int NICInitializeAsic(struct rt_rtmp_adapter *pAd, IN BOOLEAN bHardReset)
 {
-	ULONG			Index = 0;
-	UCHAR			R0 = 0xff;
-	UINT32			MacCsr12 = 0, Counter = 0;
-#ifdef RT2870
-	UINT32			MacCsr0 = 0;
-	NTSTATUS		Status;
-	UCHAR			Value = 0xff;
-	UINT32			eFuseCtrl;
-#endif
-	USHORT			KeyIdx;
-	INT				i,apidx;
+	unsigned long Index = 0;
+	u8 R0 = 0xff;
+	u32 MacCsr12 = 0, Counter = 0;
+#ifdef RTMP_MAC_USB
+	u32 MacCsr0 = 0;
+	int Status;
+	u8 Value = 0xff;
+#endif /* RTMP_MAC_USB // */
+#ifdef RT30xx
+	u8 bbpreg = 0;
+	u8 RFValue = 0;
+#endif /* RT30xx // */
+	u16 KeyIdx;
+	int i, apidx;
 
 	DBGPRINT(RT_DEBUG_TRACE, ("--> NICInitializeAsic\n"));
 
-#ifdef RT2860
-	if (bHardReset == TRUE)
-	{
+#ifdef RTMP_MAC_PCI
+	RTMP_IO_WRITE32(pAd, PWR_PIN_CFG, 0x3);	/* To fix driver disable/enable hang issue when radio off */
+	if (bHardReset == TRUE) {
 		RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, 0x3);
-	}
-	else
+	} else
 		RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, 0x1);
-#endif
-#ifdef RT2870
-	//
-	// Make sure MAC gets ready after NICLoadFirmware().
-	//
-	Index = 0;
 
-	//To avoid hang-on issue when interface up in kernel 2.4,
-	//we use a local variable "MacCsr0" instead of using "pAd->MACVersion" directly.
-	do
+	RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, 0x0);
+	/* Initialize MAC register to default value */
+	for (Index = 0; Index < NUM_MAC_REG_PARMS; Index++) {
+		RTMP_IO_WRITE32(pAd, MACRegTable[Index].Register,
+				MACRegTable[Index].Value);
+	}
+
 	{
+		for (Index = 0; Index < NUM_STA_MAC_REG_PARMS; Index++) {
+			RTMP_IO_WRITE32(pAd, STAMACRegTable[Index].Register,
+					STAMACRegTable[Index].Value);
+		}
+	}
+#endif /* RTMP_MAC_PCI // */
+#ifdef RTMP_MAC_USB
+	/* */
+	/* Make sure MAC gets ready after NICLoadFirmware(). */
+	/* */
+	Index = 0;
+
+	/*To avoid hang-on issue when interface up in kernel 2.4, */
+	/*we use a local variable "MacCsr0" instead of using "pAd->MACVersion" directly. */
+	do {
 		RTMP_IO_READ32(pAd, MAC_CSR0, &MacCsr0);
 
 		if ((MacCsr0 != 0x00) && (MacCsr0 != 0xFFFFFFFF))
@@ -2142,8 +1620,9 @@ NDIS_STATUS	NICInitializeAsic(
 	} while (Index++ < 100);
 
 	pAd->MACVersion = MacCsr0;
-	DBGPRINT(RT_DEBUG_TRACE, ("MAC_CSR0  [ Ver:Rev=0x%08x]\n", pAd->MACVersion));
-	// turn on bit13 (set to zero) after rt2860D. This is to solve high-current issue.
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("MAC_CSR0  [ Ver:Rev=0x%08x]\n", pAd->MACVersion));
+	/* turn on bit13 (set to zero) after rt2860D. This is to solve high-current issue. */
 	RTMP_IO_READ32(pAd, PBF_SYS_CTRL, &MacCsr12);
 	MacCsr12 &= (~0x2000);
 	RTMP_IO_WRITE32(pAd, PBF_SYS_CTRL, MacCsr12);
@@ -2151,203 +1630,223 @@ NDIS_STATUS	NICInitializeAsic(
 	RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, 0x3);
 	RTMP_IO_WRITE32(pAd, USB_DMA_CFG, 0x0);
 	Status = RTUSBVenderReset(pAd);
-#endif
 
 	RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, 0x0);
 
-	// Initialize MAC register to default value
-#ifdef RT2860
-	for (Index = 0; Index < NUM_MAC_REG_PARMS; Index++)
-	{
-		RTMP_IO_WRITE32(pAd, MACRegTable[Index].Register, MACRegTable[Index].Value);
-	}
-#endif
-#ifdef RT2870
-	for(Index=0; Index<NUM_MAC_REG_PARMS; Index++)
-	{
-#ifdef RT3070
-		if ((MACRegTable[Index].Register == TX_SW_CFG0) && (IS_RT3070(pAd) || IS_RT3071(pAd)))
-		{
+	/* Initialize MAC register to default value */
+	for (Index = 0; Index < NUM_MAC_REG_PARMS; Index++) {
+#ifdef RT30xx
+		if ((MACRegTable[Index].Register == TX_SW_CFG0)
+		    && (IS_RT3070(pAd) || IS_RT3071(pAd) || IS_RT3572(pAd)
+			|| IS_RT3090(pAd) || IS_RT3390(pAd))) {
 			MACRegTable[Index].Value = 0x00000400;
 		}
-#endif // RT3070 //
-		RTMP_IO_WRITE32(pAd, (USHORT)MACRegTable[Index].Register, MACRegTable[Index].Value);
+#endif /* RT30xx // */
+		RTMP_IO_WRITE32(pAd, (u16)MACRegTable[Index].Register,
+				MACRegTable[Index].Value);
 	}
-#endif // RT2870 //
 
 	{
-		for (Index = 0; Index < NUM_STA_MAC_REG_PARMS; Index++)
-		{
-#ifdef RT2860
-			RTMP_IO_WRITE32(pAd, STAMACRegTable[Index].Register, STAMACRegTable[Index].Value);
-#endif
-#ifdef RT2870
-			RTMP_IO_WRITE32(pAd, (USHORT)STAMACRegTable[Index].Register, STAMACRegTable[Index].Value);
-#endif
+		for (Index = 0; Index < NUM_STA_MAC_REG_PARMS; Index++) {
+			RTMP_IO_WRITE32(pAd,
+					(u16)STAMACRegTable[Index].Register,
+					STAMACRegTable[Index].Value);
 		}
 	}
+#endif /* RTMP_MAC_USB // */
 
-	// Initialize RT3070 serial MAc registers which is different from RT2870 serial
-	if (IS_RT3090(pAd))
-	{
+#ifdef RT30xx
+	/* Initialize RT3070 serial MAC registers which is different from RT2870 serial */
+	if (IS_RT3090(pAd) || IS_RT3572(pAd) || IS_RT3390(pAd)) {
 		RTMP_IO_WRITE32(pAd, TX_SW_CFG1, 0);
 
-		// RT3071 version E has fixed this issue
-		if ((pAd->MACVersion & 0xffff) < 0x0211)
-		{
-			if (pAd->NicConfig2.field.DACTestBit == 1)
-			{
-				RTMP_IO_WRITE32(pAd, TX_SW_CFG2, 0x1F);	// To fix throughput drop drastically
+		/* RT3071 version E has fixed this issue */
+		if ((pAd->MACVersion & 0xffff) < 0x0211) {
+			if (pAd->NicConfig2.field.DACTestBit == 1) {
+				RTMP_IO_WRITE32(pAd, TX_SW_CFG2, 0x2C);	/* To fix throughput drop drastically */
+			} else {
+				RTMP_IO_WRITE32(pAd, TX_SW_CFG2, 0x0F);	/* To fix throughput drop drastically */
 			}
-			else
-			{
-				RTMP_IO_WRITE32(pAd, TX_SW_CFG2, 0x0F);	// To fix throughput drop drastically
-			}
-		}
-		else
-		{
+		} else {
 			RTMP_IO_WRITE32(pAd, TX_SW_CFG2, 0x0);
 		}
+	} else if (IS_RT3070(pAd)) {
+		if (((pAd->MACVersion & 0xffff) < 0x0201)) {
+			RTMP_IO_WRITE32(pAd, TX_SW_CFG1, 0);
+			RTMP_IO_WRITE32(pAd, TX_SW_CFG2, 0x2C);	/* To fix throughput drop drastically */
+		} else {
+			RTMP_IO_WRITE32(pAd, TX_SW_CFG2, 0);
+		}
 	}
-#ifdef RT2870
-	else if (IS_RT3070(pAd))
-	{
-		RTMP_IO_WRITE32(pAd, TX_SW_CFG1, 0);
-		RTMP_IO_WRITE32(pAd, TX_SW_CFG2, 0x1F);	// To fix throughput drop drastically
-	}
-#endif // RT30xx //
+#endif /* RT30xx // */
 
-	//
-	// Before program BBP, we need to wait BBP/RF get wake up.
-	//
+	/* */
+	/* Before program BBP, we need to wait BBP/RF get wake up. */
+	/* */
 	Index = 0;
-	do
-	{
+	do {
 		RTMP_IO_READ32(pAd, MAC_STATUS_CFG, &MacCsr12);
 
-		if ((MacCsr12 & 0x03) == 0)	// if BB.RF is stable
+		if ((MacCsr12 & 0x03) == 0)	/* if BB.RF is stable */
 			break;
 
-		DBGPRINT(RT_DEBUG_TRACE, ("Check MAC_STATUS_CFG  = Busy = %x\n", MacCsr12));
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("Check MAC_STATUS_CFG  = Busy = %x\n", MacCsr12));
 		RTMPusecDelay(1000);
 	} while (Index++ < 100);
 
-    // The commands to firmware should be after these commands, these commands will init firmware
-	// PCI and USB are not the same because PCI driver needs to wait for PCI bus ready
-	RTMP_IO_WRITE32(pAd, H2M_BBP_AGENT, 0);	// initialize BBP R/W access agent
+	/* The commands to firmware should be after these commands, these commands will init firmware */
+	/* PCI and USB are not the same because PCI driver needs to wait for PCI bus ready */
+	RTMP_IO_WRITE32(pAd, H2M_BBP_AGENT, 0);	/* initialize BBP R/W access agent */
 	RTMP_IO_WRITE32(pAd, H2M_MAILBOX_CSR, 0);
+#ifdef RT3090
+	/*2008/11/28:KH add to fix the dead rf frequency offset bug<-- */
+	AsicSendCommandToMcu(pAd, 0x72, 0, 0, 0);
+	/*2008/11/28:KH add to fix the dead rf frequency offset bug--> */
+#endif /* RT3090 // */
 	RTMPusecDelay(1000);
 
-	// Read BBP register, make sure BBP is up and running before write new data
+	/* Read BBP register, make sure BBP is up and running before write new data */
 	Index = 0;
-	do
-	{
+	do {
 		RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R0, &R0);
 		DBGPRINT(RT_DEBUG_TRACE, ("BBP version = %x\n", R0));
 	} while ((++Index < 20) && ((R0 == 0xff) || (R0 == 0x00)));
-	//ASSERT(Index < 20); //this will cause BSOD on Check-build driver
+	/*ASSERT(Index < 20); //this will cause BSOD on Check-build driver */
 
 	if ((R0 == 0xff) || (R0 == 0x00))
 		return NDIS_STATUS_FAILURE;
 
-	// Initialize BBP register to default value
-	for (Index = 0; Index < NUM_BBP_REG_PARMS; Index++)
-	{
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBPRegTable[Index].Register, BBPRegTable[Index].Value);
+	/* Initialize BBP register to default value */
+	for (Index = 0; Index < NUM_BBP_REG_PARMS; Index++) {
+		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBPRegTable[Index].Register,
+					     BBPRegTable[Index].Value);
 	}
 
-#ifndef RT2870
-	// for rt2860E and after, init BBP_R84 with 0x19. This is for extension channel overlapping IOT.
-	if ((pAd->MACVersion&0xffff) != 0x0101)
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R84, 0x19);
-#else
-	// for rt2860E and after, init BBP_R84 with 0x19. This is for extension channel overlapping IOT.
-	// RT3090 should not program BBP R84 to 0x19, otherwise TX will block.
-	if (((pAd->MACVersion&0xffff) != 0x0101) && (!IS_RT30xx(pAd)))
+#ifdef RTMP_MAC_PCI
+	/* TODO: shiang, check MACVersion, currently, rbus-based chip use this. */
+	if (pAd->MACVersion == 0x28720200) {
+		/*u8 value; */
+		unsigned long value2;
+
+		/*disable MLD by Bruce 20080704 */
+		/*BBP_IO_READ8_BY_REG_ID(pAd, BBP_R105, &value); */
+		/*BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R105, value | 4); */
+
+		/*Maximum PSDU length from 16K to 32K bytes */
+		RTMP_IO_READ32(pAd, MAX_LEN_CFG, &value2);
+		value2 &= ~(0x3 << 12);
+		value2 |= (0x2 << 12);
+		RTMP_IO_WRITE32(pAd, MAX_LEN_CFG, value2);
+	}
+#endif /* RTMP_MAC_PCI // */
+
+	/* for rt2860E and after, init BBP_R84 with 0x19. This is for extension channel overlapping IOT. */
+	/* RT3090 should not program BBP R84 to 0x19, otherwise TX will block. */
+	/*3070/71/72,3090,3090A( are included in RT30xx),3572,3390 */
+	if (((pAd->MACVersion & 0xffff) != 0x0101)
+	    && !(IS_RT30xx(pAd) || IS_RT3572(pAd) || IS_RT3390(pAd)))
 		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R84, 0x19);
 
-// add by johnli, RF power sequence setup
-	if (IS_RT30xx(pAd))
-	{	//update for RT3070/71/72/90/91/92.
+#ifdef RT30xx
+/* add by johnli, RF power sequence setup */
+	if (IS_RT30xx(pAd) || IS_RT3572(pAd) || IS_RT3390(pAd)) {	/*update for RT3070/71/72/90/91/92,3572,3390. */
 		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R79, 0x13);
 		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R80, 0x05);
 		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R81, 0x33);
 	}
 
-	if (IS_RT3090(pAd))
+	if (IS_RT3090(pAd) || IS_RT3390(pAd))	/* RT309x, RT3071/72 */
 	{
-		UCHAR		bbpreg=0;
-
-		// enable DC filter
-		if ((pAd->MACVersion & 0xffff) >= 0x0211)
-		{
+		/* enable DC filter */
+		if ((pAd->MACVersion & 0xffff) >= 0x0211) {
 			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R103, 0xc0);
 		}
-
-		// improve power consumption
+		/* improve power consumption */
 		RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R138, &bbpreg);
-		if (pAd->Antenna.field.TxPath == 1)
-		{
-			// turn off tx DAC_1
+		if (pAd->Antenna.field.TxPath == 1) {
+			/* turn off tx DAC_1 */
 			bbpreg = (bbpreg | 0x20);
 		}
 
-		if (pAd->Antenna.field.RxPath == 1)
-		{
-			// turn off tx ADC_1
+		if (pAd->Antenna.field.RxPath == 1) {
+			/* turn off tx ADC_1 */
 			bbpreg &= (~0x2);
 		}
 		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R138, bbpreg);
 
-		// improve power consumption in RT3071 Ver.E
-		if ((pAd->MACVersion & 0xffff) >= 0x0211)
-		{
+		/* improve power consumption in RT3071 Ver.E */
+		if ((pAd->MACVersion & 0xffff) >= 0x0211) {
+			RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R31, &bbpreg);
+			bbpreg &= (~0x3);
+			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R31, bbpreg);
+		}
+	} else if (IS_RT3070(pAd)) {
+		if ((pAd->MACVersion & 0xffff) >= 0x0201) {
+			/* enable DC filter */
+			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R103, 0xc0);
+
+			/* improve power consumption in RT3070 Ver.F */
 			RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R31, &bbpreg);
 			bbpreg &= (~0x3);
 			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R31, bbpreg);
 		}
+		/* TX_LO1_en, RF R17 register Bit 3 to 0 */
+		RT30xxReadRFRegister(pAd, RF_R17, &RFValue);
+		RFValue &= (~0x08);
+		/* to fix rx long range issue */
+		if (pAd->NicConfig2.field.ExternalLNAForG == 0) {
+			RFValue |= 0x20;
+		}
+		/* set RF_R17_bit[2:0] equal to EEPROM setting at 0x48h */
+		if (pAd->TxMixerGain24G >= 1) {
+			RFValue &= (~0x7);	/* clean bit [2:0] */
+			RFValue |= pAd->TxMixerGain24G;
+		}
+		RT30xxWriteRFRegister(pAd, RF_R17, RFValue);
 	}
-#endif
-	if (pAd->MACVersion == 0x28600100)
-	{
+/* end johnli */
+#endif /* RT30xx // */
+
+	if (pAd->MACVersion == 0x28600100) {
 		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R69, 0x16);
 		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R73, 0x12);
-    }
+	}
 
-	if (pAd->MACVersion >= RALINK_2880E_VERSION && pAd->MACVersion < RALINK_3070_VERSION) // 3*3
+	if (pAd->MACVersion >= RALINK_2880E_VERSION && pAd->MACVersion < RALINK_3070_VERSION)	/* 3*3 */
 	{
-		// enlarge MAX_LEN_CFG
-		UINT32 csr;
+		/* enlarge MAX_LEN_CFG */
+		u32 csr;
 		RTMP_IO_READ32(pAd, MAX_LEN_CFG, &csr);
 		csr &= 0xFFF;
 		csr |= 0x2000;
 		RTMP_IO_WRITE32(pAd, MAX_LEN_CFG, csr);
 	}
-
-#ifdef RT2870
-{
-	UCHAR	MAC_Value[]={0xff,0xff,0xff,0xff,0xff,0xff,0xff,0,0};
-
-	//Initialize WCID table
-	Value = 0xff;
-	for(Index =0 ;Index < 254;Index++)
+#ifdef RTMP_MAC_USB
 	{
-		RTUSBMultiWrite(pAd, (USHORT)(MAC_WCID_BASE + Index * 8), MAC_Value, 8);
+		u8 MAC_Value[] =
+		    { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0, 0 };
+
+		/*Initialize WCID table */
+		Value = 0xff;
+		for (Index = 0; Index < 254; Index++) {
+			RTUSBMultiWrite(pAd,
+					(u16)(MAC_WCID_BASE + Index * 8),
+					MAC_Value, 8);
+		}
 	}
-}
-#endif // RT2870 //
+#endif /* RTMP_MAC_USB // */
 
-	// Add radio off control
+	/* Add radio off control */
 	{
-		if (pAd->StaCfg.bRadio == FALSE)
-		{
-//			RTMP_IO_WRITE32(pAd, PWR_PIN_CFG, 0x00001818);
+		if (pAd->StaCfg.bRadio == FALSE) {
+/*                      RTMP_IO_WRITE32(pAd, PWR_PIN_CFG, 0x00001818); */
 			RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_RADIO_OFF);
 			DBGPRINT(RT_DEBUG_TRACE, ("Set Radio Off\n"));
 		}
 	}
 
-	// Clear raw counters
+	/* Clear raw counters */
 	RTMP_IO_READ32(pAd, RX_STA_CNT0, &Counter);
 	RTMP_IO_READ32(pAd, RX_STA_CNT1, &Counter);
 	RTMP_IO_READ32(pAd, RX_STA_CNT2, &Counter);
@@ -2355,65 +1854,55 @@ NDIS_STATUS	NICInitializeAsic(
 	RTMP_IO_READ32(pAd, TX_STA_CNT1, &Counter);
 	RTMP_IO_READ32(pAd, TX_STA_CNT2, &Counter);
 
-	// ASIC will keep garbage value after boot
-	// Clear all seared key table when initial
-	// This routine can be ignored in radio-ON/OFF operation.
-	if (bHardReset)
-	{
-		for (KeyIdx = 0; KeyIdx < 4; KeyIdx++)
-		{
-			RTMP_IO_WRITE32(pAd, SHARED_KEY_MODE_BASE + 4*KeyIdx, 0);
+	/* ASIC will keep garbage value after boot */
+	/* Clear all shared key table when initial */
+	/* This routine can be ignored in radio-ON/OFF operation. */
+	if (bHardReset) {
+		for (KeyIdx = 0; KeyIdx < 4; KeyIdx++) {
+			RTMP_IO_WRITE32(pAd, SHARED_KEY_MODE_BASE + 4 * KeyIdx,
+					0);
 		}
 
-		// Clear all pairwise key table when initial
-		for (KeyIdx = 0; KeyIdx < 256; KeyIdx++)
-		{
-			RTMP_IO_WRITE32(pAd, MAC_WCID_ATTRIBUTE_BASE + (KeyIdx * HW_WCID_ATTRI_SIZE), 1);
+		/* Clear all pairwise key table when initial */
+		for (KeyIdx = 0; KeyIdx < 256; KeyIdx++) {
+			RTMP_IO_WRITE32(pAd,
+					MAC_WCID_ATTRIBUTE_BASE +
+					(KeyIdx * HW_WCID_ATTRI_SIZE), 1);
 		}
 	}
+	/* assert HOST ready bit */
+/*  RTMP_IO_WRITE32(pAd, MAC_CSR1, 0x0); // 2004-09-14 asked by Mark */
+/*  RTMP_IO_WRITE32(pAd, MAC_CSR1, 0x4); */
 
-
-	// It isn't necessary to clear this space when not hard reset.
-	if (bHardReset == TRUE)
-	{
-		// clear all on-chip BEACON frame space
-		for (apidx = 0; apidx < HW_BEACON_MAX_COUNT; apidx++)
-		{
-			for (i = 0; i < HW_BEACON_OFFSET>>2; i+=4)
-				RTMP_IO_WRITE32(pAd, pAd->BeaconOffset[apidx] + i, 0x00);
+	/* It isn't necessary to clear this space when not hard reset. */
+	if (bHardReset == TRUE) {
+		/* clear all on-chip BEACON frame space */
+		for (apidx = 0; apidx < HW_BEACON_MAX_COUNT; apidx++) {
+			for (i = 0; i < HW_BEACON_OFFSET >> 2; i += 4)
+				RTMP_IO_WRITE32(pAd,
+						pAd->BeaconOffset[apidx] + i,
+						0x00);
 		}
 	}
-#ifdef RT2870
+#ifdef RTMP_MAC_USB
 	AsicDisableSync(pAd);
-	// Clear raw counters
+	/* Clear raw counters */
 	RTMP_IO_READ32(pAd, RX_STA_CNT0, &Counter);
 	RTMP_IO_READ32(pAd, RX_STA_CNT1, &Counter);
 	RTMP_IO_READ32(pAd, RX_STA_CNT2, &Counter);
 	RTMP_IO_READ32(pAd, TX_STA_CNT0, &Counter);
 	RTMP_IO_READ32(pAd, TX_STA_CNT1, &Counter);
 	RTMP_IO_READ32(pAd, TX_STA_CNT2, &Counter);
-	// Default PCI clock cycle per ms is different as default setting, which is based on PCI.
+	/* Default PCI clock cycle per ms is different as default setting, which is based on PCI. */
 	RTMP_IO_READ32(pAd, USB_CYC_CFG, &Counter);
-	Counter&=0xffffff00;
-	Counter|=0x000001e;
+	Counter &= 0xffffff00;
+	Counter |= 0x000001e;
 	RTMP_IO_WRITE32(pAd, USB_CYC_CFG, Counter);
+#endif /* RTMP_MAC_USB // */
 
-	pAd->bUseEfuse=FALSE;
-	RTMP_IO_READ32(pAd, EFUSE_CTRL, &eFuseCtrl);
-	pAd->bUseEfuse = ( (eFuseCtrl & 0x80000000) == 0x80000000) ? 1 : 0;
-	if(pAd->bUseEfuse)
-	{
-			DBGPRINT(RT_DEBUG_TRACE, ("NVM is Efuse\n"));
-	}
-	else
 	{
-			DBGPRINT(RT_DEBUG_TRACE, ("NVM is EEPROM\n"));
-	}
-#endif
-
-	{
-		// for rt2860E and after, init TXOP_CTRL_CFG with 0x583f. This is for extension channel overlapping IOT.
-		if ((pAd->MACVersion&0xffff) != 0x0101)
+		/* for rt2860E and after, init TXOP_CTRL_CFG with 0x583f. This is for extension channel overlapping IOT. */
+		if ((pAd->MACVersion & 0xffff) != 0x0101)
 			RTMP_IO_WRITE32(pAd, TXOP_CTRL_CFG, 0x583f);
 	}
 
@@ -2421,133 +1910,6 @@ NDIS_STATUS	NICInitializeAsic(
 	return NDIS_STATUS_SUCCESS;
 }
 
-
-#ifdef RT2860
-VOID NICRestoreBBPValue(
-	IN PRTMP_ADAPTER pAd)
-{
-	UCHAR		index;
-	UCHAR		Value = 0;
-	ULONG		Data;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("--->  NICRestoreBBPValue !!!!!!!!!!!!!!!!!!!!!!!  \n"));
-	// Initialize BBP register to default value (rtmp_init.c)
-	for (index = 0; index < NUM_BBP_REG_PARMS; index++)
-	{
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBPRegTable[index].Register, BBPRegTable[index].Value);
-	}
-	// copy from (rtmp_init.c)
-	if (pAd->MACVersion == 0x28600100)
-	{
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R69, 0x16);
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R73, 0x12);
-	}
-
-	// copy from (connect.c LinkUp function)
-	if (INFRA_ON(pAd))
-	{
-		// Change to AP channel
-		if ((pAd->CommonCfg.CentralChannel > pAd->CommonCfg.Channel) && (pAd->MlmeAux.HtCapability.HtCapInfo.ChannelWidth == BW_40))
-		{
-			// Must using 40MHz.
-			pAd->CommonCfg.BBPCurrentBW = BW_40;
-			AsicSwitchChannel(pAd, pAd->CommonCfg.CentralChannel, FALSE);
-			AsicLockChannel(pAd, pAd->CommonCfg.CentralChannel);
-
-			RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R4, &Value);
-			Value &= (~0x18);
-			Value |= 0x10;
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R4, Value);
-
-			//  RX : control channel at lower
-			RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R3, &Value);
-			Value &= (~0x20);
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R3, Value);
-			// Record BBPR3 setting, But don't keep R Antenna # information.
-			pAd->StaCfg.BBPR3 = Value;
-
-			RTMP_IO_READ32(pAd, TX_BAND_CFG, &Data);
-			Data &= 0xfffffffe;
-			RTMP_IO_WRITE32(pAd, TX_BAND_CFG, Data);
-
-			if (pAd->MACVersion == 0x28600100)
-			{
-				RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R69, 0x1A);
-				RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R70, 0x0A);
-				RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R73, 0x16);
-				DBGPRINT(RT_DEBUG_TRACE, ("!!!rt2860C !!! \n" ));
-			}
-
-			DBGPRINT(RT_DEBUG_TRACE, ("!!!40MHz Lower LINK UP !!! Control Channel at Below. Central = %d \n", pAd->CommonCfg.CentralChannel ));
-		}
-		else if ((pAd->CommonCfg.CentralChannel < pAd->CommonCfg.Channel) && (pAd->MlmeAux.HtCapability.HtCapInfo.ChannelWidth == BW_40))
-		{
-			// Must using 40MHz.
-			pAd->CommonCfg.BBPCurrentBW = BW_40;
-			AsicSwitchChannel(pAd, pAd->CommonCfg.CentralChannel, FALSE);
-			AsicLockChannel(pAd, pAd->CommonCfg.CentralChannel);
-
-			RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R4, &Value);
-			Value &= (~0x18);
-			Value |= 0x10;
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R4, Value);
-
-			RTMP_IO_READ32(pAd, TX_BAND_CFG, &Data);
-			Data |= 0x1;
-			RTMP_IO_WRITE32(pAd, TX_BAND_CFG, Data);
-
-			RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R3, &Value);
-			Value |= (0x20);
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R3, Value);
-			// Record BBPR3 setting, But don't keep R Antenna # information.
-			pAd->StaCfg.BBPR3 = Value;
-
-			if (pAd->MACVersion == 0x28600100)
-			{
-				RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R69, 0x1A);
-				RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R70, 0x0A);
-				RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R73, 0x16);
-				DBGPRINT(RT_DEBUG_TRACE, ("!!!rt2860C !!! \n" ));
-			}
-
-			DBGPRINT(RT_DEBUG_TRACE, ("!!!40MHz Upper LINK UP !!! Control Channel at UpperCentral = %d \n", pAd->CommonCfg.CentralChannel ));
-		}
-		else
-		{
-			pAd->CommonCfg.BBPCurrentBW = BW_20;
-			AsicSwitchChannel(pAd, pAd->CommonCfg.Channel, FALSE);
-			AsicLockChannel(pAd, pAd->CommonCfg.Channel);
-
-			RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R4, &Value);
-			Value &= (~0x18);
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R4, Value);
-
-			RTMP_IO_READ32(pAd, TX_BAND_CFG, &Data);
-			Data &= 0xfffffffe;
-			RTMP_IO_WRITE32(pAd, TX_BAND_CFG, Data);
-
-			RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R3, &Value);
-			Value &= (~0x20);
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R3, Value);
-			// Record BBPR3 setting, But don't keep R Antenna # information.
-			pAd->StaCfg.BBPR3 = Value;
-
-			if (pAd->MACVersion == 0x28600100)
-			{
-				RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R69, 0x16);
-				RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R70, 0x08);
-				RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R73, 0x11);
-				DBGPRINT(RT_DEBUG_TRACE, ("!!!rt2860C !!! \n" ));
-			}
-
-			DBGPRINT(RT_DEBUG_TRACE, ("!!!20MHz LINK UP !!! \n" ));
-		}
-	}
-
-	DBGPRINT(RT_DEBUG_TRACE, ("<---  NICRestoreBBPValue !!!!!!!!!!!!!!!!!!!!!!!  \n"));
-}
-#endif /* RT2860 */
-
 /*
 	========================================================================
 
@@ -2567,19 +1929,21 @@ VOID NICRestoreBBPValue(
 
 	========================================================================
 */
-VOID	NICIssueReset(
-	IN	PRTMP_ADAPTER	pAd)
+void NICIssueReset(struct rt_rtmp_adapter *pAd)
 {
-	UINT32	Value = 0;
+	u32 Value = 0;
 	DBGPRINT(RT_DEBUG_TRACE, ("--> NICIssueReset\n"));
 
-	// Disable Rx, register value supposed will remain after reset
+	/* Abort Tx, prevent ASIC from writing to Host memory */
+	/*RTMP_IO_WRITE32(pAd, TX_CNTL_CSR, 0x001f0000); */
+
+	/* Disable Rx, register value supposed will remain after reset */
 	RTMP_IO_READ32(pAd, MAC_SYS_CTRL, &Value);
 	Value &= (0xfffffff3);
 	RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, Value);
 
-	// Issue reset and clear from reset state
-	RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, 0x03); // 2004-09-17 change from 0x01
+	/* Issue reset and clear from reset state */
+	RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, 0x03);	/* 2004-09-17 change from 0x01 */
 	RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, 0x00);
 
 	DBGPRINT(RT_DEBUG_TRACE, ("<-- NICIssueReset\n"));
@@ -2601,134 +1965,115 @@ VOID	NICIssueReset(
 
 	========================================================================
 */
-BOOLEAN	NICCheckForHang(
-	IN	PRTMP_ADAPTER	pAd)
+BOOLEAN NICCheckForHang(struct rt_rtmp_adapter *pAd)
 {
 	return (FALSE);
 }
 
-VOID NICUpdateFifoStaCounters(
-	IN PRTMP_ADAPTER pAd)
+void NICUpdateFifoStaCounters(struct rt_rtmp_adapter *pAd)
 {
-	TX_STA_FIFO_STRUC	StaFifo;
-	MAC_TABLE_ENTRY		*pEntry;
-	UCHAR				i = 0;
-	UCHAR			pid = 0, wcid = 0;
-	CHAR				reTry;
-	UCHAR				succMCS;
-
-		do
-		{
-			RTMP_IO_READ32(pAd, TX_STA_FIFO, &StaFifo.word);
+	TX_STA_FIFO_STRUC StaFifo;
+	struct rt_mac_table_entry *pEntry;
+	u8 i = 0;
+	u8 pid = 0, wcid = 0;
+	char reTry;
+	u8 succMCS;
 
-			if (StaFifo.field.bValid == 0)
-				break;
+	do {
+		RTMP_IO_READ32(pAd, TX_STA_FIFO, &StaFifo.word);
 
-			wcid = (UCHAR)StaFifo.field.wcid;
+		if (StaFifo.field.bValid == 0)
+			break;
 
+		wcid = (u8)StaFifo.field.wcid;
 
 		/* ignore NoACK and MGMT frame use 0xFF as WCID */
-			if ((StaFifo.field.TxAckRequired == 0) || (wcid >= MAX_LEN_OF_MAC_TABLE))
-			{
-				i++;
-				continue;
-			}
-
-			/* PID store Tx MCS Rate */
-			pid = (UCHAR)StaFifo.field.PidType;
-
-			pEntry = &pAd->MacTab.Content[wcid];
+		if ((StaFifo.field.TxAckRequired == 0)
+		    || (wcid >= MAX_LEN_OF_MAC_TABLE)) {
+			i++;
+			continue;
+		}
 
-			pEntry->DebugFIFOCount++;
+		/* PID store Tx MCS Rate */
+		pid = (u8)StaFifo.field.PidType;
 
-			if (StaFifo.field.TxBF) // 3*3
-				pEntry->TxBFCount++;
+		pEntry = &pAd->MacTab.Content[wcid];
 
-#ifdef UAPSD_AP_SUPPORT
-			UAPSD_SP_AUE_Handle(pAd, pEntry, StaFifo.field.TxSuccess);
-#endif // UAPSD_AP_SUPPORT //
+		pEntry->DebugFIFOCount++;
 
-			if (!StaFifo.field.TxSuccess)
-			{
-				pEntry->FIFOCount++;
-				pEntry->OneSecTxFailCount++;
+		if (StaFifo.field.TxBF)	/* 3*3 */
+			pEntry->TxBFCount++;
 
-				if (pEntry->FIFOCount >= 1)
-				{
-					DBGPRINT(RT_DEBUG_TRACE, ("#"));
-					pEntry->NoBADataCountDown = 64;
+		if (!StaFifo.field.TxSuccess) {
+			pEntry->FIFOCount++;
+			pEntry->OneSecTxFailCount++;
 
-					if(pEntry->PsMode == PWR_ACTIVE)
-					{
-						int tid;
-						for (tid=0; tid<NUM_OF_TID; tid++)
-						{
-							BAOriSessionTearDown(pAd, pEntry->Aid,  tid, FALSE, FALSE);
-						}
+			if (pEntry->FIFOCount >= 1) {
+				DBGPRINT(RT_DEBUG_TRACE, ("#"));
+				pEntry->NoBADataCountDown = 64;
 
-						// Update the continuous transmission counter except PS mode
-						pEntry->ContinueTxFailCnt++;
-					}
-					else
-					{
-						// Clear the FIFOCount when sta in Power Save mode. Basically we assume
-						//     this tx error happened due to sta just go to sleep.
-						pEntry->FIFOCount = 0;
-						pEntry->ContinueTxFailCnt = 0;
+				if (pEntry->PsMode == PWR_ACTIVE) {
+					int tid;
+					for (tid = 0; tid < NUM_OF_TID; tid++) {
+						BAOriSessionTearDown(pAd,
+								     pEntry->
+								     Aid, tid,
+								     FALSE,
+								     FALSE);
 					}
+
+					/* Update the continuous transmission counter except PS mode */
+					pEntry->ContinueTxFailCnt++;
+				} else {
+					/* Clear the FIFOCount when sta in Power Save mode. Basically we assume */
+					/*     this tx error happened due to sta just go to sleep. */
+					pEntry->FIFOCount = 0;
+					pEntry->ContinueTxFailCnt = 0;
 				}
+				/*pEntry->FIFOCount = 0; */
 			}
-			else
-			{
-				if ((pEntry->PsMode != PWR_SAVE) && (pEntry->NoBADataCountDown > 0))
-				{
-					pEntry->NoBADataCountDown--;
-					if (pEntry->NoBADataCountDown==0)
-					{
-						DBGPRINT(RT_DEBUG_TRACE, ("@\n"));
-					}
+			/*pEntry->bSendBAR = TRUE; */
+		} else {
+			if ((pEntry->PsMode != PWR_SAVE)
+			    && (pEntry->NoBADataCountDown > 0)) {
+				pEntry->NoBADataCountDown--;
+				if (pEntry->NoBADataCountDown == 0) {
+					DBGPRINT(RT_DEBUG_TRACE, ("@\n"));
 				}
-
-				pEntry->FIFOCount = 0;
-				pEntry->OneSecTxNoRetryOkCount++;
-				// update NoDataIdleCount when sucessful send packet to STA.
-				pEntry->NoDataIdleCount = 0;
-				pEntry->ContinueTxFailCnt = 0;
 			}
 
-			succMCS = StaFifo.field.SuccessRate & 0x7F;
+			pEntry->FIFOCount = 0;
+			pEntry->OneSecTxNoRetryOkCount++;
+			/* update NoDataIdleCount when sucessful send packet to STA. */
+			pEntry->NoDataIdleCount = 0;
+			pEntry->ContinueTxFailCnt = 0;
+		}
 
-			reTry = pid - succMCS;
+		succMCS = StaFifo.field.SuccessRate & 0x7F;
 
-			if (StaFifo.field.TxSuccess)
-			{
-				pEntry->TXMCSExpected[pid]++;
-				if (pid == succMCS)
-				{
-					pEntry->TXMCSSuccessful[pid]++;
-				}
-				else
-				{
-					pEntry->TXMCSAutoFallBack[pid][succMCS]++;
-				}
-			}
-			else
-			{
-				pEntry->TXMCSFailed[pid]++;
+		reTry = pid - succMCS;
+
+		if (StaFifo.field.TxSuccess) {
+			pEntry->TXMCSExpected[pid]++;
+			if (pid == succMCS) {
+				pEntry->TXMCSSuccessful[pid]++;
+			} else {
+				pEntry->TXMCSAutoFallBack[pid][succMCS]++;
 			}
+		} else {
+			pEntry->TXMCSFailed[pid]++;
+		}
 
-			if (reTry > 0)
-			{
-				if ((pid >= 12) && succMCS <=7)
-				{
-					reTry -= 4;
-				}
-				pEntry->OneSecTxRetryOkCount += reTry;
+		if (reTry > 0) {
+			if ((pid >= 12) && succMCS <= 7) {
+				reTry -= 4;
 			}
+			pEntry->OneSecTxRetryOkCount += reTry;
+		}
 
-			i++;
-			// ASIC store 16 stack
-		} while ( i < (2*TX_RING_SIZE) );
+		i++;
+		/* ASIC store 16 stack */
+	} while (i < (2 * TX_RING_SIZE));
 
 }
 
@@ -2749,87 +2094,99 @@ VOID NICUpdateFifoStaCounters(
 
 	========================================================================
 */
-VOID NICUpdateRawCounters(
-	IN PRTMP_ADAPTER pAd)
+void NICUpdateRawCounters(struct rt_rtmp_adapter *pAd)
 {
-	UINT32	OldValue;
-	RX_STA_CNT0_STRUC	 RxStaCnt0;
-	RX_STA_CNT1_STRUC   RxStaCnt1;
-	RX_STA_CNT2_STRUC   RxStaCnt2;
-	TX_STA_CNT0_STRUC 	 TxStaCnt0;
-	TX_STA_CNT1_STRUC	 StaTx1;
-	TX_STA_CNT2_STRUC	 StaTx2;
-	TX_AGG_CNT_STRUC	TxAggCnt;
-	TX_AGG_CNT0_STRUC	TxAggCnt0;
-	TX_AGG_CNT1_STRUC	TxAggCnt1;
-	TX_AGG_CNT2_STRUC	TxAggCnt2;
-	TX_AGG_CNT3_STRUC	TxAggCnt3;
-	TX_AGG_CNT4_STRUC	TxAggCnt4;
-	TX_AGG_CNT5_STRUC	TxAggCnt5;
-	TX_AGG_CNT6_STRUC	TxAggCnt6;
-	TX_AGG_CNT7_STRUC	TxAggCnt7;
+	u32 OldValue;	/*, Value2; */
+	/*unsigned long PageSum, OneSecTransmitCount; */
+	/*unsigned long TxErrorRatio, Retry, Fail; */
+	RX_STA_CNT0_STRUC RxStaCnt0;
+	RX_STA_CNT1_STRUC RxStaCnt1;
+	RX_STA_CNT2_STRUC RxStaCnt2;
+	TX_STA_CNT0_STRUC TxStaCnt0;
+	TX_STA_CNT1_STRUC StaTx1;
+	TX_STA_CNT2_STRUC StaTx2;
+	TX_AGG_CNT_STRUC TxAggCnt;
+	TX_AGG_CNT0_STRUC TxAggCnt0;
+	TX_AGG_CNT1_STRUC TxAggCnt1;
+	TX_AGG_CNT2_STRUC TxAggCnt2;
+	TX_AGG_CNT3_STRUC TxAggCnt3;
+	TX_AGG_CNT4_STRUC TxAggCnt4;
+	TX_AGG_CNT5_STRUC TxAggCnt5;
+	TX_AGG_CNT6_STRUC TxAggCnt6;
+	TX_AGG_CNT7_STRUC TxAggCnt7;
+	struct rt_counter_ralink *pRalinkCounters;
+
+	pRalinkCounters = &pAd->RalinkCounters;
 
 	RTMP_IO_READ32(pAd, RX_STA_CNT0, &RxStaCnt0.word);
 	RTMP_IO_READ32(pAd, RX_STA_CNT2, &RxStaCnt2.word);
 
 	{
 		RTMP_IO_READ32(pAd, RX_STA_CNT1, &RxStaCnt1.word);
-	    // Update RX PLCP error counter
-	    pAd->PrivateInfo.PhyRxErrCnt += RxStaCnt1.field.PlcpErr;
-		// Update False CCA counter
-		pAd->RalinkCounters.OneSecFalseCCACnt += RxStaCnt1.field.FalseCca;
+		/* Update RX PLCP error counter */
+		pAd->PrivateInfo.PhyRxErrCnt += RxStaCnt1.field.PlcpErr;
+		/* Update False CCA counter */
+		pAd->RalinkCounters.OneSecFalseCCACnt +=
+		    RxStaCnt1.field.FalseCca;
 	}
 
-	// Update FCS counters
-	OldValue= pAd->WlanCounters.FCSErrorCount.u.LowPart;
-	pAd->WlanCounters.FCSErrorCount.u.LowPart += (RxStaCnt0.field.CrcErr); // >> 7);
+	/* Update FCS counters */
+	OldValue = pAd->WlanCounters.FCSErrorCount.u.LowPart;
+	pAd->WlanCounters.FCSErrorCount.u.LowPart += (RxStaCnt0.field.CrcErr);	/* >> 7); */
 	if (pAd->WlanCounters.FCSErrorCount.u.LowPart < OldValue)
 		pAd->WlanCounters.FCSErrorCount.u.HighPart++;
 
-	// Add FCS error count to private counters
-	pAd->RalinkCounters.OneSecRxFcsErrCnt += RxStaCnt0.field.CrcErr;
-	OldValue = pAd->RalinkCounters.RealFcsErrCount.u.LowPart;
-	pAd->RalinkCounters.RealFcsErrCount.u.LowPart += RxStaCnt0.field.CrcErr;
-	if (pAd->RalinkCounters.RealFcsErrCount.u.LowPart < OldValue)
-		pAd->RalinkCounters.RealFcsErrCount.u.HighPart++;
-
-	// Update Duplicate Rcv check
-	pAd->RalinkCounters.DuplicateRcv += RxStaCnt2.field.RxDupliCount;
-	pAd->WlanCounters.FrameDuplicateCount.u.LowPart += RxStaCnt2.field.RxDupliCount;
-	// Update RX Overflow counter
+	/* Add FCS error count to private counters */
+	pRalinkCounters->OneSecRxFcsErrCnt += RxStaCnt0.field.CrcErr;
+	OldValue = pRalinkCounters->RealFcsErrCount.u.LowPart;
+	pRalinkCounters->RealFcsErrCount.u.LowPart += RxStaCnt0.field.CrcErr;
+	if (pRalinkCounters->RealFcsErrCount.u.LowPart < OldValue)
+		pRalinkCounters->RealFcsErrCount.u.HighPart++;
+
+	/* Update Duplicate Rcv check */
+	pRalinkCounters->DuplicateRcv += RxStaCnt2.field.RxDupliCount;
+	pAd->WlanCounters.FrameDuplicateCount.u.LowPart +=
+	    RxStaCnt2.field.RxDupliCount;
+	/* Update RX Overflow counter */
 	pAd->Counters8023.RxNoBuffer += (RxStaCnt2.field.RxFifoOverflowCount);
 
-#ifdef RT2870
-	if (pAd->RalinkCounters.RxCount != pAd->watchDogRxCnt)
-	{
-		pAd->watchDogRxCnt = pAd->RalinkCounters.RxCount;
+	/*pAd->RalinkCounters.RxCount = 0; */
+#ifdef RTMP_MAC_USB
+	if (pRalinkCounters->RxCount != pAd->watchDogRxCnt) {
+		pAd->watchDogRxCnt = pRalinkCounters->RxCount;
 		pAd->watchDogRxOverFlowCnt = 0;
-	}
-	else
-	{
+	} else {
 		if (RxStaCnt2.field.RxFifoOverflowCount)
 			pAd->watchDogRxOverFlowCnt++;
 		else
 			pAd->watchDogRxOverFlowCnt = 0;
 	}
-#endif // RT2870 //
-
-
-	if (!pAd->bUpdateBcnCntDone)
-	{
-	// Update BEACON sent count
-	RTMP_IO_READ32(pAd, TX_STA_CNT0, &TxStaCnt0.word);
-	RTMP_IO_READ32(pAd, TX_STA_CNT1, &StaTx1.word);
-	RTMP_IO_READ32(pAd, TX_STA_CNT2, &StaTx2.word);
-	pAd->RalinkCounters.OneSecBeaconSentCnt += TxStaCnt0.field.TxBeaconCount;
-	pAd->RalinkCounters.OneSecTxRetryOkCount += StaTx1.field.TxRetransmit;
-	pAd->RalinkCounters.OneSecTxNoRetryOkCount += StaTx1.field.TxSuccess;
-	pAd->RalinkCounters.OneSecTxFailCount += TxStaCnt0.field.TxFailCount;
-	pAd->WlanCounters.TransmittedFragmentCount.u.LowPart += StaTx1.field.TxSuccess;
-	pAd->WlanCounters.RetryCount.u.LowPart += StaTx1.field.TxRetransmit;
-	pAd->WlanCounters.FailedCount.u.LowPart += TxStaCnt0.field.TxFailCount;
-	}
-
+#endif /* RTMP_MAC_USB // */
+
+	/*if (!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_TX_RATE_SWITCH_ENABLED) || */
+	/*      (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_TX_RATE_SWITCH_ENABLED) && (pAd->MacTab.Size != 1))) */
+	if (!pAd->bUpdateBcnCntDone) {
+		/* Update BEACON sent count */
+		RTMP_IO_READ32(pAd, TX_STA_CNT0, &TxStaCnt0.word);
+		RTMP_IO_READ32(pAd, TX_STA_CNT1, &StaTx1.word);
+		RTMP_IO_READ32(pAd, TX_STA_CNT2, &StaTx2.word);
+		pRalinkCounters->OneSecBeaconSentCnt +=
+		    TxStaCnt0.field.TxBeaconCount;
+		pRalinkCounters->OneSecTxRetryOkCount +=
+		    StaTx1.field.TxRetransmit;
+		pRalinkCounters->OneSecTxNoRetryOkCount +=
+		    StaTx1.field.TxSuccess;
+		pRalinkCounters->OneSecTxFailCount +=
+		    TxStaCnt0.field.TxFailCount;
+		pAd->WlanCounters.TransmittedFragmentCount.u.LowPart +=
+		    StaTx1.field.TxSuccess;
+		pAd->WlanCounters.RetryCount.u.LowPart +=
+		    StaTx1.field.TxRetransmit;
+		pAd->WlanCounters.FailedCount.u.LowPart +=
+		    TxStaCnt0.field.TxFailCount;
+	}
+
+	/*if (pAd->bStaFifoTest == TRUE) */
 	{
 		RTMP_IO_READ32(pAd, TX_AGG_CNT, &TxAggCnt.word);
 		RTMP_IO_READ32(pAd, TX_AGG_CNT0, &TxAggCnt0.word);
@@ -2840,60 +2197,89 @@ VOID NICUpdateRawCounters(
 		RTMP_IO_READ32(pAd, TX_AGG_CNT5, &TxAggCnt5.word);
 		RTMP_IO_READ32(pAd, TX_AGG_CNT6, &TxAggCnt6.word);
 		RTMP_IO_READ32(pAd, TX_AGG_CNT7, &TxAggCnt7.word);
-		pAd->RalinkCounters.TxAggCount += TxAggCnt.field.AggTxCount;
-		pAd->RalinkCounters.TxNonAggCount += TxAggCnt.field.NonAggTxCount;
-		pAd->RalinkCounters.TxAgg1MPDUCount += TxAggCnt0.field.AggSize1Count;
-		pAd->RalinkCounters.TxAgg2MPDUCount += TxAggCnt0.field.AggSize2Count;
-
-		pAd->RalinkCounters.TxAgg3MPDUCount += TxAggCnt1.field.AggSize3Count;
-		pAd->RalinkCounters.TxAgg4MPDUCount += TxAggCnt1.field.AggSize4Count;
-		pAd->RalinkCounters.TxAgg5MPDUCount += TxAggCnt2.field.AggSize5Count;
-		pAd->RalinkCounters.TxAgg6MPDUCount += TxAggCnt2.field.AggSize6Count;
-
-		pAd->RalinkCounters.TxAgg7MPDUCount += TxAggCnt3.field.AggSize7Count;
-		pAd->RalinkCounters.TxAgg8MPDUCount += TxAggCnt3.field.AggSize8Count;
-		pAd->RalinkCounters.TxAgg9MPDUCount += TxAggCnt4.field.AggSize9Count;
-		pAd->RalinkCounters.TxAgg10MPDUCount += TxAggCnt4.field.AggSize10Count;
-
-		pAd->RalinkCounters.TxAgg11MPDUCount += TxAggCnt5.field.AggSize11Count;
-		pAd->RalinkCounters.TxAgg12MPDUCount += TxAggCnt5.field.AggSize12Count;
-		pAd->RalinkCounters.TxAgg13MPDUCount += TxAggCnt6.field.AggSize13Count;
-		pAd->RalinkCounters.TxAgg14MPDUCount += TxAggCnt6.field.AggSize14Count;
-
-		pAd->RalinkCounters.TxAgg15MPDUCount += TxAggCnt7.field.AggSize15Count;
-		pAd->RalinkCounters.TxAgg16MPDUCount += TxAggCnt7.field.AggSize16Count;
-
-		// Calculate the transmitted A-MPDU count
-		pAd->RalinkCounters.TransmittedAMPDUCount.u.LowPart += TxAggCnt0.field.AggSize1Count;
-		pAd->RalinkCounters.TransmittedAMPDUCount.u.LowPart += (TxAggCnt0.field.AggSize2Count / 2);
-
-		pAd->RalinkCounters.TransmittedAMPDUCount.u.LowPart += (TxAggCnt1.field.AggSize3Count / 3);
-		pAd->RalinkCounters.TransmittedAMPDUCount.u.LowPart += (TxAggCnt1.field.AggSize4Count / 4);
-
-		pAd->RalinkCounters.TransmittedAMPDUCount.u.LowPart += (TxAggCnt2.field.AggSize5Count / 5);
-		pAd->RalinkCounters.TransmittedAMPDUCount.u.LowPart += (TxAggCnt2.field.AggSize6Count / 6);
-
-		pAd->RalinkCounters.TransmittedAMPDUCount.u.LowPart += (TxAggCnt3.field.AggSize7Count / 7);
-		pAd->RalinkCounters.TransmittedAMPDUCount.u.LowPart += (TxAggCnt3.field.AggSize8Count / 8);
-
-		pAd->RalinkCounters.TransmittedAMPDUCount.u.LowPart += (TxAggCnt4.field.AggSize9Count / 9);
-		pAd->RalinkCounters.TransmittedAMPDUCount.u.LowPart += (TxAggCnt4.field.AggSize10Count / 10);
-
-		pAd->RalinkCounters.TransmittedAMPDUCount.u.LowPart += (TxAggCnt5.field.AggSize11Count / 11);
-		pAd->RalinkCounters.TransmittedAMPDUCount.u.LowPart += (TxAggCnt5.field.AggSize12Count / 12);
-
-		pAd->RalinkCounters.TransmittedAMPDUCount.u.LowPart += (TxAggCnt6.field.AggSize13Count / 13);
-		pAd->RalinkCounters.TransmittedAMPDUCount.u.LowPart += (TxAggCnt6.field.AggSize14Count / 14);
-
-		pAd->RalinkCounters.TransmittedAMPDUCount.u.LowPart += (TxAggCnt7.field.AggSize15Count / 15);
-		pAd->RalinkCounters.TransmittedAMPDUCount.u.LowPart += (TxAggCnt7.field.AggSize16Count / 16);
+		pRalinkCounters->TxAggCount += TxAggCnt.field.AggTxCount;
+		pRalinkCounters->TxNonAggCount += TxAggCnt.field.NonAggTxCount;
+		pRalinkCounters->TxAgg1MPDUCount +=
+		    TxAggCnt0.field.AggSize1Count;
+		pRalinkCounters->TxAgg2MPDUCount +=
+		    TxAggCnt0.field.AggSize2Count;
+
+		pRalinkCounters->TxAgg3MPDUCount +=
+		    TxAggCnt1.field.AggSize3Count;
+		pRalinkCounters->TxAgg4MPDUCount +=
+		    TxAggCnt1.field.AggSize4Count;
+		pRalinkCounters->TxAgg5MPDUCount +=
+		    TxAggCnt2.field.AggSize5Count;
+		pRalinkCounters->TxAgg6MPDUCount +=
+		    TxAggCnt2.field.AggSize6Count;
+
+		pRalinkCounters->TxAgg7MPDUCount +=
+		    TxAggCnt3.field.AggSize7Count;
+		pRalinkCounters->TxAgg8MPDUCount +=
+		    TxAggCnt3.field.AggSize8Count;
+		pRalinkCounters->TxAgg9MPDUCount +=
+		    TxAggCnt4.field.AggSize9Count;
+		pRalinkCounters->TxAgg10MPDUCount +=
+		    TxAggCnt4.field.AggSize10Count;
+
+		pRalinkCounters->TxAgg11MPDUCount +=
+		    TxAggCnt5.field.AggSize11Count;
+		pRalinkCounters->TxAgg12MPDUCount +=
+		    TxAggCnt5.field.AggSize12Count;
+		pRalinkCounters->TxAgg13MPDUCount +=
+		    TxAggCnt6.field.AggSize13Count;
+		pRalinkCounters->TxAgg14MPDUCount +=
+		    TxAggCnt6.field.AggSize14Count;
+
+		pRalinkCounters->TxAgg15MPDUCount +=
+		    TxAggCnt7.field.AggSize15Count;
+		pRalinkCounters->TxAgg16MPDUCount +=
+		    TxAggCnt7.field.AggSize16Count;
+
+		/* Calculate the transmitted A-MPDU count */
+		pRalinkCounters->TransmittedAMPDUCount.u.LowPart +=
+		    TxAggCnt0.field.AggSize1Count;
+		pRalinkCounters->TransmittedAMPDUCount.u.LowPart +=
+		    (TxAggCnt0.field.AggSize2Count / 2);
+
+		pRalinkCounters->TransmittedAMPDUCount.u.LowPart +=
+		    (TxAggCnt1.field.AggSize3Count / 3);
+		pRalinkCounters->TransmittedAMPDUCount.u.LowPart +=
+		    (TxAggCnt1.field.AggSize4Count / 4);
+
+		pRalinkCounters->TransmittedAMPDUCount.u.LowPart +=
+		    (TxAggCnt2.field.AggSize5Count / 5);
+		pRalinkCounters->TransmittedAMPDUCount.u.LowPart +=
+		    (TxAggCnt2.field.AggSize6Count / 6);
+
+		pRalinkCounters->TransmittedAMPDUCount.u.LowPart +=
+		    (TxAggCnt3.field.AggSize7Count / 7);
+		pRalinkCounters->TransmittedAMPDUCount.u.LowPart +=
+		    (TxAggCnt3.field.AggSize8Count / 8);
+
+		pRalinkCounters->TransmittedAMPDUCount.u.LowPart +=
+		    (TxAggCnt4.field.AggSize9Count / 9);
+		pRalinkCounters->TransmittedAMPDUCount.u.LowPart +=
+		    (TxAggCnt4.field.AggSize10Count / 10);
+
+		pRalinkCounters->TransmittedAMPDUCount.u.LowPart +=
+		    (TxAggCnt5.field.AggSize11Count / 11);
+		pRalinkCounters->TransmittedAMPDUCount.u.LowPart +=
+		    (TxAggCnt5.field.AggSize12Count / 12);
+
+		pRalinkCounters->TransmittedAMPDUCount.u.LowPart +=
+		    (TxAggCnt6.field.AggSize13Count / 13);
+		pRalinkCounters->TransmittedAMPDUCount.u.LowPart +=
+		    (TxAggCnt6.field.AggSize14Count / 14);
+
+		pRalinkCounters->TransmittedAMPDUCount.u.LowPart +=
+		    (TxAggCnt7.field.AggSize15Count / 15);
+		pRalinkCounters->TransmittedAMPDUCount.u.LowPart +=
+		    (TxAggCnt7.field.AggSize16Count / 16);
 	}
 
-
-
 }
 
-
 /*
 	========================================================================
 
@@ -2913,132 +2299,52 @@ VOID NICUpdateRawCounters(
 
 	========================================================================
 */
-VOID	NICResetFromError(
-	IN	PRTMP_ADAPTER	pAd)
+void NICResetFromError(struct rt_rtmp_adapter *pAd)
 {
-	// Reset BBP (according to alex, reset ASIC will force reset BBP
-	// Therefore, skip the reset BBP
-	// RTMP_IO_WRITE32(pAd, MAC_CSR1, 0x2);
+	/* Reset BBP (according to alex, reset ASIC will force reset BBP */
+	/* Therefore, skip the reset BBP */
+	/* RTMP_IO_WRITE32(pAd, MAC_CSR1, 0x2); */
 
 	RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, 0x1);
-	// Remove ASIC from reset state
+	/* Remove ASIC from reset state */
 	RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, 0x0);
 
 	NICInitializeAdapter(pAd, FALSE);
 	NICInitAsicFromEEPROM(pAd);
 
-	// Switch to current channel, since during reset process, the connection should remains on.
+	/* Switch to current channel, since during reset process, the connection should remains on. */
 	AsicSwitchChannel(pAd, pAd->CommonCfg.CentralChannel, FALSE);
 	AsicLockChannel(pAd, pAd->CommonCfg.CentralChannel);
 }
 
-/*
-	========================================================================
-
-	Routine Description:
-		erase 8051 firmware image in MAC ASIC
-
-	Arguments:
-		Adapter						Pointer to our adapter
-
-	IRQL = PASSIVE_LEVEL
-
-	========================================================================
-*/
-VOID NICEraseFirmware(
-	IN PRTMP_ADAPTER pAd)
+int NICLoadFirmware(struct rt_rtmp_adapter *pAd)
 {
-	ULONG i;
-
-	for(i=0; i<MAX_FIRMWARE_IMAGE_SIZE; i+=4)
-		RTMP_IO_WRITE32(pAd, FIRMWARE_IMAGE_BASE + i, 0);
+	int status = NDIS_STATUS_SUCCESS;
+	if (pAd->chipOps.loadFirmware)
+		status = pAd->chipOps.loadFirmware(pAd);
 
-}/* End of NICEraseFirmware */
+	return status;
+}
 
 /*
 	========================================================================
 
 	Routine Description:
-		Load 8051 firmware RT2561.BIN file into MAC ASIC
+		erase 8051 firmware image in MAC ASIC
 
 	Arguments:
 		Adapter						Pointer to our adapter
 
-	Return Value:
-		NDIS_STATUS_SUCCESS         firmware image load ok
-		NDIS_STATUS_FAILURE         image not found
-
 	IRQL = PASSIVE_LEVEL
 
 	========================================================================
 */
-NDIS_STATUS NICLoadFirmware(
-	IN PRTMP_ADAPTER pAd)
+void NICEraseFirmware(struct rt_rtmp_adapter *pAd)
 {
-	NDIS_STATUS		Status = NDIS_STATUS_SUCCESS;
-	PUCHAR			pFirmwareImage;
-	ULONG			FileLength, Index;
-	//ULONG			firm;
-	UINT32			MacReg = 0;
-#ifdef RT2870
-	UINT32			Version = (pAd->MACVersion >> 16);
-#endif // RT2870 //
-
-	pFirmwareImage = FirmwareImage;
-	FileLength = sizeof(FirmwareImage);
-#ifdef RT2870
-	// New 8k byte firmware size for RT3071/RT3072
-	//printk("Usb Chip\n");
-	if (FIRMWAREIMAGE_LENGTH == FIRMWAREIMAGE_MAX_LENGTH)
-	//The firmware image consists of two parts. One is the origianl and the other is the new.
-	//Use Second Part
-	{
-		if ((Version != 0x2860) && (Version != 0x2872) && (Version != 0x3070))
-		{	// Use Firmware V2.
-			//printk("KH:Use New Version,part2\n");
-			pFirmwareImage = (PUCHAR)&FirmwareImage[FIRMWAREIMAGEV1_LENGTH];
-			FileLength = FIRMWAREIMAGEV2_LENGTH;
-		}
-		else
-		{
-			//printk("KH:Use New Version,part1\n");
-			pFirmwareImage = FirmwareImage;
-			FileLength = FIRMWAREIMAGEV1_LENGTH;
-		}
-	}
-	else
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("KH: bin file should be 8KB.\n"));
-		Status = NDIS_STATUS_FAILURE;
-	}
-
-#endif // RT2870 //
-
-	RT28XX_WRITE_FIRMWARE(pAd, pFirmwareImage, FileLength);
-
-	/* check if MCU is ready */
-	Index = 0;
-	do
-	{
-		RTMP_IO_READ32(pAd, PBF_SYS_CTRL, &MacReg);
-
-		if (MacReg & 0x80)
-			break;
-
-		RTMPusecDelay(1000);
-	} while (Index++ < 1000);
-
-    if (Index > 1000)
-	{
-		Status = NDIS_STATUS_FAILURE;
-		DBGPRINT(RT_DEBUG_ERROR, ("NICLoadFirmware: MCU is not ready\n\n\n"));
-	} /* End of if */
-
-    DBGPRINT(RT_DEBUG_TRACE,
-			 ("<=== %s (status=%d)\n", __func__, Status));
-    return Status;
-} /* End of NICLoadFirmware */
+	if (pAd->chipOps.eraseFirmware)
+		pAd->chipOps.eraseFirmware(pAd);
 
+}				/* End of NICEraseFirmware */
 
 /*
 	========================================================================
@@ -3061,8 +2367,7 @@ NDIS_STATUS NICLoadFirmware(
 
 	========================================================================
 */
-NDIS_STATUS NICLoadRateSwitchingParams(
-	IN PRTMP_ADAPTER pAd)
+int NICLoadRateSwitchingParams(struct rt_rtmp_adapter *pAd)
 {
 	return NDIS_STATUS_SUCCESS;
 }
@@ -3071,53 +2376,6 @@ NDIS_STATUS NICLoadRateSwitchingParams(
 	========================================================================
 
 	Routine Description:
-		if  pSrc1 all zero with length Length, return 0.
-		If not all zero, return 1
-
-	Arguments:
-		pSrc1
-
-	Return Value:
-		1:			not all zero
-		0:			all zero
-
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-ULONG	RTMPNotAllZero(
-	IN	PVOID	pSrc1,
-	IN	ULONG	Length)
-{
-	PUCHAR	pMem1;
-	ULONG	Index = 0;
-
-	pMem1 = (PUCHAR) pSrc1;
-
-	for (Index = 0; Index < Length; Index++)
-	{
-		if (pMem1[Index] != 0x0)
-		{
-			break;
-		}
-	}
-
-	if (Index == Length)
-	{
-		return (0);
-	}
-	else
-	{
-		return (1);
-	}
-}
-
-/*
-	========================================================================
-
-	Routine Description:
 		Compare two memory block
 
 	Arguments:
@@ -3135,27 +2393,23 @@ ULONG	RTMPNotAllZero(
 
 	========================================================================
 */
-ULONG	RTMPCompareMemory(
-	IN	PVOID	pSrc1,
-	IN	PVOID	pSrc2,
-	IN	ULONG	Length)
+unsigned long RTMPCompareMemory(void *pSrc1, void *pSrc2, unsigned long Length)
 {
-	PUCHAR	pMem1;
-	PUCHAR	pMem2;
-	ULONG	Index = 0;
+	u8 *pMem1;
+	u8 *pMem2;
+	unsigned long Index = 0;
 
-	pMem1 = (PUCHAR) pSrc1;
-	pMem2 = (PUCHAR) pSrc2;
+	pMem1 = (u8 *)pSrc1;
+	pMem2 = (u8 *)pSrc2;
 
-	for (Index = 0; Index < Length; Index++)
-	{
+	for (Index = 0; Index < Length; Index++) {
 		if (pMem1[Index] > pMem2[Index])
 			return (1);
 		else if (pMem1[Index] < pMem2[Index])
 			return (2);
 	}
 
-	// Equal
+	/* Equal */
 	return (0);
 }
 
@@ -3179,37 +2433,18 @@ ULONG	RTMPCompareMemory(
 
 	========================================================================
 */
-VOID	RTMPZeroMemory(
-	IN	PVOID	pSrc,
-	IN	ULONG	Length)
+void RTMPZeroMemory(void *pSrc, unsigned long Length)
 {
-	PUCHAR	pMem;
-	ULONG	Index = 0;
+	u8 *pMem;
+	unsigned long Index = 0;
 
-	pMem = (PUCHAR) pSrc;
+	pMem = (u8 *)pSrc;
 
-	for (Index = 0; Index < Length; Index++)
-	{
+	for (Index = 0; Index < Length; Index++) {
 		pMem[Index] = 0x00;
 	}
 }
 
-VOID	RTMPFillMemory(
-	IN	PVOID	pSrc,
-	IN	ULONG	Length,
-	IN	UCHAR	Fill)
-{
-	PUCHAR	pMem;
-	ULONG	Index = 0;
-
-	pMem = (PUCHAR) pSrc;
-
-	for (Index = 0; Index < Length; Index++)
-	{
-		pMem[Index] = Fill;
-	}
-}
-
 /*
 	========================================================================
 
@@ -3231,22 +2466,18 @@ VOID	RTMPFillMemory(
 
 	========================================================================
 */
-VOID	RTMPMoveMemory(
-	OUT	PVOID	pDest,
-	IN	PVOID	pSrc,
-	IN	ULONG	Length)
+void RTMPMoveMemory(void *pDest, void *pSrc, unsigned long Length)
 {
-	PUCHAR	pMem1;
-	PUCHAR	pMem2;
-	UINT	Index;
+	u8 *pMem1;
+	u8 *pMem2;
+	u32 Index;
 
-	ASSERT((Length==0) || (pDest && pSrc));
+	ASSERT((Length == 0) || (pDest && pSrc));
 
-	pMem1 = (PUCHAR) pDest;
-	pMem2 = (PUCHAR) pSrc;
+	pMem1 = (u8 *)pDest;
+	pMem2 = (u8 *)pSrc;
 
-	for (Index = 0; Index < Length; Index++)
-	{
+	for (Index = 0; Index < Length; Index++) {
 		pMem1[Index] = pMem2[Index];
 	}
 }
@@ -3269,17 +2500,16 @@ VOID	RTMPMoveMemory(
 
 	========================================================================
 */
-VOID	UserCfgInit(
-	IN	PRTMP_ADAPTER pAd)
+void UserCfgInit(struct rt_rtmp_adapter *pAd)
 {
-    UINT key_index, bss_index;
+	u32 key_index, bss_index;
 
 	DBGPRINT(RT_DEBUG_TRACE, ("--> UserCfgInit\n"));
 
-	//
-	//  part I. intialize common configuration
-	//
-#ifdef RT2870
+	/* */
+	/*  part I. intialize common configuration */
+	/* */
+#ifdef RTMP_MAC_USB
 	pAd->BulkOutReq = 0;
 
 	pAd->BulkOutComplete = 0;
@@ -3289,72 +2519,71 @@ VOID	UserCfgInit(
 	pAd->BulkInComplete = 0;
 	pAd->BulkInCompleteFail = 0;
 
-	//pAd->QuickTimerP = 100;
-	//pAd->TurnAggrBulkInCount = 0;
+	/*pAd->QuickTimerP = 100; */
+	/*pAd->TurnAggrBulkInCount = 0; */
 	pAd->bUsbTxBulkAggre = 0;
 
-	// init as unsed value to ensure driver will set to MCU once.
-	pAd->LedIndicatorStregth = 0xFF;
+	/* init as unsed value to ensure driver will set to MCU once. */
+	pAd->LedIndicatorStrength = 0xFF;
 
 	pAd->CommonCfg.MaxPktOneTxBulk = 2;
 	pAd->CommonCfg.TxBulkFactor = 1;
-	pAd->CommonCfg.RxBulkFactor =1;
+	pAd->CommonCfg.RxBulkFactor = 1;
 
-	pAd->CommonCfg.TxPower = 100; //mW
+	pAd->CommonCfg.TxPower = 100;	/*mW */
 
-	NdisZeroMemory(&pAd->CommonCfg.IOTestParm, sizeof(pAd->CommonCfg.IOTestParm));
-#endif // RT2870 //
+	NdisZeroMemory(&pAd->CommonCfg.IOTestParm,
+		       sizeof(pAd->CommonCfg.IOTestParm));
+#endif /* RTMP_MAC_USB // */
 
-	for(key_index=0; key_index<SHARE_KEY_NUM; key_index++)
-	{
-		for(bss_index = 0; bss_index < MAX_MBSSID_NUM; bss_index++)
-		{
+	for (key_index = 0; key_index < SHARE_KEY_NUM; key_index++) {
+		for (bss_index = 0; bss_index < MAX_MBSSID_NUM; bss_index++) {
 			pAd->SharedKey[bss_index][key_index].KeyLen = 0;
-			pAd->SharedKey[bss_index][key_index].CipherAlg = CIPHER_NONE;
+			pAd->SharedKey[bss_index][key_index].CipherAlg =
+			    CIPHER_NONE;
 		}
 	}
 
-#ifdef RT2870
 	pAd->EepromAccess = FALSE;
-#endif
+
 	pAd->Antenna.word = 0;
 	pAd->CommonCfg.BBPCurrentBW = BW_20;
 
 	pAd->LedCntl.word = 0;
-#ifdef RT2860
-	pAd->LedIndicatorStregth = 0;
+#ifdef RTMP_MAC_PCI
+	pAd->LedIndicatorStrength = 0;
 	pAd->RLnkCtrlOffset = 0;
 	pAd->HostLnkCtrlOffset = 0;
+	pAd->StaCfg.PSControl.field.EnableNewPS = TRUE;
 	pAd->CheckDmaBusyCount = 0;
-#endif
+#endif /* RTMP_MAC_PCI // */
 
-	pAd->bAutoTxAgcA = FALSE;			// Default is OFF
-	pAd->bAutoTxAgcG = FALSE;			// Default is OFF
+	pAd->bAutoTxAgcA = FALSE;	/* Default is OFF */
+	pAd->bAutoTxAgcG = FALSE;	/* Default is OFF */
 	pAd->RfIcType = RFIC_2820;
 
-	// Init timer for reset complete event
+	/* Init timer for reset complete event */
 	pAd->CommonCfg.CentralChannel = 1;
 	pAd->bForcePrintTX = FALSE;
 	pAd->bForcePrintRX = FALSE;
 	pAd->bStaFifoTest = FALSE;
 	pAd->bProtectionTest = FALSE;
-	pAd->bHCCATest = FALSE;
-	pAd->bGenOneHCCA = FALSE;
-	pAd->CommonCfg.Dsifs = 10;      // in units of usec
-	pAd->CommonCfg.TxPower = 100; //mW
-	pAd->CommonCfg.TxPowerPercentage = 0xffffffff; // AUTO
-	pAd->CommonCfg.TxPowerDefault = 0xffffffff; // AUTO
-	pAd->CommonCfg.TxPreamble = Rt802_11PreambleAuto; // use Long preamble on TX by defaut
+	pAd->CommonCfg.Dsifs = 10;	/* in units of usec */
+	pAd->CommonCfg.TxPower = 100;	/*mW */
+	pAd->CommonCfg.TxPowerPercentage = 0xffffffff;	/* AUTO */
+	pAd->CommonCfg.TxPowerDefault = 0xffffffff;	/* AUTO */
+	pAd->CommonCfg.TxPreamble = Rt802_11PreambleAuto;	/* use Long preamble on TX by defaut */
 	pAd->CommonCfg.bUseZeroToDisableFragment = FALSE;
 	pAd->CommonCfg.RtsThreshold = 2347;
 	pAd->CommonCfg.FragmentThreshold = 2346;
-	pAd->CommonCfg.UseBGProtection = 0;    // 0: AUTO
-	pAd->CommonCfg.bEnableTxBurst = TRUE; //0;
-	pAd->CommonCfg.PhyMode = 0xff;     // unknown
+	pAd->CommonCfg.UseBGProtection = 0;	/* 0: AUTO */
+	pAd->CommonCfg.bEnableTxBurst = TRUE;	/*0; */
+	pAd->CommonCfg.PhyMode = 0xff;	/* unknown */
 	pAd->CommonCfg.BandState = UNKNOWN_BAND;
 	pAd->CommonCfg.RadarDetect.CSPeriod = 10;
 	pAd->CommonCfg.RadarDetect.CSCount = 0;
 	pAd->CommonCfg.RadarDetect.RDMode = RD_NORMAL_MODE;
+
 	pAd->CommonCfg.RadarDetect.ChMovingTime = 65;
 	pAd->CommonCfg.RadarDetect.LongPulseRadarTh = 3;
 	pAd->CommonCfg.bAPSDCapable = FALSE;
@@ -3367,18 +2596,22 @@ VOID	UserCfgInit(
 
 	NdisZeroMemory(&pAd->BeaconTxWI, sizeof(pAd->BeaconTxWI));
 
-	NdisZeroMemory(&pAd->CommonCfg.HtCapability, sizeof(pAd->CommonCfg.HtCapability));
+	NdisZeroMemory(&pAd->CommonCfg.HtCapability,
+		       sizeof(pAd->CommonCfg.HtCapability));
 	pAd->HTCEnable = FALSE;
 	pAd->bBroadComHT = FALSE;
 	pAd->CommonCfg.bRdg = FALSE;
 
-	NdisZeroMemory(&pAd->CommonCfg.AddHTInfo, sizeof(pAd->CommonCfg.AddHTInfo));
+	NdisZeroMemory(&pAd->CommonCfg.AddHTInfo,
+		       sizeof(pAd->CommonCfg.AddHTInfo));
 	pAd->CommonCfg.BACapability.field.MMPSmode = MMPS_ENABLE;
 	pAd->CommonCfg.BACapability.field.MpduDensity = 0;
 	pAd->CommonCfg.BACapability.field.Policy = IMMED_BA;
-	pAd->CommonCfg.BACapability.field.RxBAWinLimit = 64; //32;
-	pAd->CommonCfg.BACapability.field.TxBAWinLimit = 64; //32;
-	DBGPRINT(RT_DEBUG_TRACE, ("--> UserCfgInit. BACapability = 0x%x\n", pAd->CommonCfg.BACapability.word));
+	pAd->CommonCfg.BACapability.field.RxBAWinLimit = 64;	/*32; */
+	pAd->CommonCfg.BACapability.field.TxBAWinLimit = 64;	/*32; */
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("--> UserCfgInit. BACapability = 0x%x\n",
+		  pAd->CommonCfg.BACapability.word));
 
 	pAd->CommonCfg.BACapability.field.AutoBA = FALSE;
 	BATableInit(pAd, &pAd->BATable);
@@ -3386,28 +2619,35 @@ VOID	UserCfgInit(
 	pAd->CommonCfg.bExtChannelSwitchAnnouncement = 1;
 	pAd->CommonCfg.bHTProtect = 1;
 	pAd->CommonCfg.bMIMOPSEnable = TRUE;
+	/*2008/11/05:KH add to support Antenna power-saving of AP<-- */
+	pAd->CommonCfg.bGreenAPEnable = FALSE;
+	/*2008/11/05:KH add to support Antenna power-saving of AP--> */
 	pAd->CommonCfg.bBADecline = FALSE;
 	pAd->CommonCfg.bDisableReordering = FALSE;
 
-	pAd->CommonCfg.TxBASize = 7;
+	if (pAd->MACVersion == 0x28720200) {
+		pAd->CommonCfg.TxBASize = 13;	/*by Jerry recommend */
+	} else {
+		pAd->CommonCfg.TxBASize = 7;
+	}
 
 	pAd->CommonCfg.REGBACapability.word = pAd->CommonCfg.BACapability.word;
 
-	//pAd->CommonCfg.HTPhyMode.field.BW = BW_20;
-	//pAd->CommonCfg.HTPhyMode.field.MCS = MCS_AUTO;
-	//pAd->CommonCfg.HTPhyMode.field.ShortGI = GI_800;
-	//pAd->CommonCfg.HTPhyMode.field.STBC = STBC_NONE;
+	/*pAd->CommonCfg.HTPhyMode.field.BW = BW_20; */
+	/*pAd->CommonCfg.HTPhyMode.field.MCS = MCS_AUTO; */
+	/*pAd->CommonCfg.HTPhyMode.field.ShortGI = GI_800; */
+	/*pAd->CommonCfg.HTPhyMode.field.STBC = STBC_NONE; */
 	pAd->CommonCfg.TxRate = RATE_6;
 
 	pAd->CommonCfg.MlmeTransmit.field.MCS = MCS_RATE_6;
 	pAd->CommonCfg.MlmeTransmit.field.BW = BW_20;
 	pAd->CommonCfg.MlmeTransmit.field.MODE = MODE_OFDM;
 
-	pAd->CommonCfg.BeaconPeriod = 100;     // in mSec
+	pAd->CommonCfg.BeaconPeriod = 100;	/* in mSec */
 
-	//
-	// part II. intialize STA specific configuration
-	//
+	/* */
+	/* part II. intialize STA specific configuration */
+	/* */
 	{
 		RX_FILTER_SET_FLAG(pAd, fRX_FILTER_ACCEPT_DIRECT);
 		RX_FILTER_CLEAR_FLAG(pAd, fRX_FILTER_ACCEPT_MULTICAST);
@@ -3422,22 +2662,23 @@ VOID	UserCfgInit(
 		pAd->StaCfg.bMixCipher = FALSE;
 		pAd->StaCfg.DefaultKeyId = 0;
 
-		// 802.1x port control
+		/* 802.1x port control */
 		pAd->StaCfg.PrivacyFilter = Ndis802_11PrivFilter8021xWEP;
 		pAd->StaCfg.PortSecured = WPA_802_1X_PORT_NOT_SECURED;
 		pAd->StaCfg.LastMicErrorTime = 0;
-		pAd->StaCfg.MicErrCnt        = 0;
-		pAd->StaCfg.bBlockAssoc      = FALSE;
-		pAd->StaCfg.WpaState         = SS_NOTUSE;
+		pAd->StaCfg.MicErrCnt = 0;
+		pAd->StaCfg.bBlockAssoc = FALSE;
+		pAd->StaCfg.WpaState = SS_NOTUSE;
 
-		pAd->CommonCfg.NdisRadioStateOff = FALSE;		// New to support microsoft disable radio with OID command
+		pAd->CommonCfg.NdisRadioStateOff = FALSE;	/* New to support microsoft disable radio with OID command */
 
 		pAd->StaCfg.RssiTrigger = 0;
-		NdisZeroMemory(&pAd->StaCfg.RssiSample, sizeof(RSSI_SAMPLE));
-		pAd->StaCfg.RssiTriggerMode = RSSI_TRIGGERED_UPON_BELOW_THRESHOLD;
+		NdisZeroMemory(&pAd->StaCfg.RssiSample, sizeof(struct rt_rssi_sample));
+		pAd->StaCfg.RssiTriggerMode =
+		    RSSI_TRIGGERED_UPON_BELOW_THRESHOLD;
 		pAd->StaCfg.AtimWin = 0;
-		pAd->StaCfg.DefaultListenCount = 3;//default listen count;
-		pAd->StaCfg.BssType = BSS_INFRA;  // BSS_INFRA or BSS_ADHOC or BSS_MONITOR
+		pAd->StaCfg.DefaultListenCount = 3;	/*default listen count; */
+		pAd->StaCfg.BssType = BSS_INFRA;	/* BSS_INFRA or BSS_ADHOC or BSS_MONITOR */
 		pAd->StaCfg.bScanReqIsFromWebUI = FALSE;
 		OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_DOZE);
 		OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_WAKEUP_NOW);
@@ -3446,158 +2687,174 @@ VOID	UserCfgInit(
 		pAd->StaCfg.DesiredTransmitSetting.field.MCS = MCS_AUTO;
 	}
 
-	// global variables mXXXX used in MAC protocol state machines
+#ifdef PCIE_PS_SUPPORT
+	pAd->brt30xxBanMcuCmd = FALSE;
+	pAd->b3090ESpecialChip = FALSE;
+/*KH Debug:the following must be removed */
+	pAd->StaCfg.PSControl.field.rt30xxPowerMode = 3;
+	pAd->StaCfg.PSControl.field.rt30xxForceASPMTest = 0;
+	pAd->StaCfg.PSControl.field.rt30xxFollowHostASPM = 1;
+#endif /* PCIE_PS_SUPPORT // */
+
+	/* global variables mXXXX used in MAC protocol state machines */
 	OPSTATUS_SET_FLAG(pAd, fOP_STATUS_RECEIVE_DTIM);
 	OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_ADHOC_ON);
 	OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_INFRA_ON);
 
-	// PHY specification
-	pAd->CommonCfg.PhyMode = PHY_11BG_MIXED;		// default PHY mode
-	OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_SHORT_PREAMBLE_INUSED);  // CCK use LONG preamble
+	/* PHY specification */
+	pAd->CommonCfg.PhyMode = PHY_11BG_MIXED;	/* default PHY mode */
+	OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_SHORT_PREAMBLE_INUSED);	/* CCK use long preamble */
 
 	{
-		// user desired power mode
+		/* user desired power mode */
 		pAd->StaCfg.WindowsPowerMode = Ndis802_11PowerModeCAM;
 		pAd->StaCfg.WindowsBatteryPowerMode = Ndis802_11PowerModeCAM;
 		pAd->StaCfg.bWindowsACCAMEnable = FALSE;
 
-		RTMPInitTimer(pAd, &pAd->StaCfg.StaQuickResponeForRateUpTimer, GET_TIMER_FUNCTION(StaQuickResponeForRateUpExec), pAd, FALSE);
+		RTMPInitTimer(pAd, &pAd->StaCfg.StaQuickResponeForRateUpTimer,
+			      GET_TIMER_FUNCTION(StaQuickResponeForRateUpExec),
+			      pAd, FALSE);
 		pAd->StaCfg.StaQuickResponeForRateUpTimerRunning = FALSE;
 
-		// Patch for Ndtest
+		/* Patch for Ndtest */
 		pAd->StaCfg.ScanCnt = 0;
 
-		// CCX 2.0 control flag init
-		pAd->StaCfg.CCXEnable = FALSE;
-		pAd->StaCfg.CCXReqType = MSRN_TYPE_UNUSED;
-		pAd->StaCfg.CCXQosECWMin	= 4;
-		pAd->StaCfg.CCXQosECWMax	= 10;
-
-		pAd->StaCfg.bHwRadio  = TRUE; // Default Hardware Radio status is On
-		pAd->StaCfg.bSwRadio  = TRUE; // Default Software Radio status is On
-		pAd->StaCfg.bRadio    = TRUE; // bHwRadio && bSwRadio
-		pAd->StaCfg.bHardwareRadio = FALSE;		// Default is OFF
-		pAd->StaCfg.bShowHiddenSSID = FALSE;		// Default no show
+		pAd->StaCfg.bHwRadio = TRUE;	/* Default Hardware Radio status is On */
+		pAd->StaCfg.bSwRadio = TRUE;	/* Default Software Radio status is On */
+		pAd->StaCfg.bRadio = TRUE;	/* bHwRadio && bSwRadio */
+		pAd->StaCfg.bHardwareRadio = FALSE;	/* Default is OFF */
+		pAd->StaCfg.bShowHiddenSSID = FALSE;	/* Default no show */
 
-		// Nitro mode control
+		/* Nitro mode control */
 		pAd->StaCfg.bAutoReconnect = TRUE;
 
-		// Save the init time as last scan time, the system should do scan after 2 seconds.
-		// This patch is for driver wake up from standby mode, system will do scan right away.
-		pAd->StaCfg.LastScanTime = 0;
-		NdisZeroMemory(pAd->nickname, IW_ESSID_MAX_SIZE+1);
-		sprintf(pAd->nickname, "%s", STA_NIC_DEVICE_NAME);
-		RTMPInitTimer(pAd, &pAd->StaCfg.WpaDisassocAndBlockAssocTimer, GET_TIMER_FUNCTION(WpaDisassocApAndBlockAssoc), pAd, FALSE);
+		/* Save the init time as last scan time, the system should do scan after 2 seconds. */
+		/* This patch is for driver wake up from standby mode, system will do scan right away. */
+		NdisGetSystemUpTime(&pAd->StaCfg.LastScanTime);
+		if (pAd->StaCfg.LastScanTime > 10 * OS_HZ)
+			pAd->StaCfg.LastScanTime -= (10 * OS_HZ);
+
+		NdisZeroMemory(pAd->nickname, IW_ESSID_MAX_SIZE + 1);
+#ifdef RTMP_MAC_PCI
+		sprintf((char *)pAd->nickname, "RT2860STA");
+#endif /* RTMP_MAC_PCI // */
+#ifdef RTMP_MAC_USB
+		sprintf((char *)pAd->nickname, "RT2870STA");
+#endif /* RTMP_MAC_USB // */
+		RTMPInitTimer(pAd, &pAd->StaCfg.WpaDisassocAndBlockAssocTimer,
+			      GET_TIMER_FUNCTION(WpaDisassocApAndBlockAssoc),
+			      pAd, FALSE);
 		pAd->StaCfg.IEEE8021X = FALSE;
 		pAd->StaCfg.IEEE8021x_required_keys = FALSE;
 		pAd->StaCfg.WpaSupplicantUP = WPA_SUPPLICANT_DISABLE;
+		pAd->StaCfg.bRSN_IE_FromWpaSupplicant = FALSE;
 		pAd->StaCfg.WpaSupplicantUP = WPA_SUPPLICANT_ENABLE;
+
+		NdisZeroMemory(pAd->StaCfg.ReplayCounter, 8);
+
+		pAd->StaCfg.bAutoConnectByBssid = FALSE;
+		pAd->StaCfg.BeaconLostTime = BEACON_LOST_TIME;
+		NdisZeroMemory(pAd->StaCfg.WpaPassPhrase, 64);
+		pAd->StaCfg.WpaPassPhraseLen = 0;
+		pAd->StaCfg.bAutoRoaming = FALSE;
+		pAd->StaCfg.bForceTxBurst = FALSE;
 	}
 
-	// Default for extra information is not valid
+	/* Default for extra information is not valid */
 	pAd->ExtraInfo = EXTRA_INFO_CLEAR;
 
-	// Default Config change flag
+	/* Default Config change flag */
 	pAd->bConfigChanged = FALSE;
 
-	//
-	// part III. AP configurations
-	//
+	/* */
+	/* part III. AP configurations */
+	/* */
 
-
-	//
-	// part IV. others
-	//
-	// dynamic BBP R66:sensibity tuning to overcome background noise
-	pAd->BbpTuning.bEnable                = TRUE;
+	/* */
+	/* part IV. others */
+	/* */
+	/* dynamic BBP R66:sensibity tuning to overcome background noise */
+	pAd->BbpTuning.bEnable = TRUE;
 	pAd->BbpTuning.FalseCcaLowerThreshold = 100;
 	pAd->BbpTuning.FalseCcaUpperThreshold = 512;
-	pAd->BbpTuning.R66Delta               = 4;
+	pAd->BbpTuning.R66Delta = 4;
 	pAd->Mlme.bEnableAutoAntennaCheck = TRUE;
 
-	//
-	// Also initial R66CurrentValue, RTUSBResumeMsduTransmission might use this value.
-	// if not initial this value, the default value will be 0.
-	//
+	/* */
+	/* Also initial R66CurrentValue, RTUSBResumeMsduTransmission might use this value. */
+	/* if not initial this value, the default value will be 0. */
+	/* */
 	pAd->BbpTuning.R66CurrentValue = 0x38;
 
 	pAd->Bbp94 = BBPR94_DEFAULT;
 	pAd->BbpForCCK = FALSE;
 
-	// initialize MAC table and allocate spin lock
-	NdisZeroMemory(&pAd->MacTab, sizeof(MAC_TABLE));
+	/* Default is FALSE for test bit 1 */
+	/*pAd->bTest1 = FALSE; */
+
+	/* initialize MAC table and allocate spin lock */
+	NdisZeroMemory(&pAd->MacTab, sizeof(struct rt_mac_table));
 	InitializeQueueHeader(&pAd->MacTab.McastPsQueue);
 	NdisAllocateSpinLock(&pAd->MacTabLock);
 
+	/*RTMPInitTimer(pAd, &pAd->RECBATimer, RECBATimerTimeout, pAd, TRUE); */
+	/*RTMPSetTimer(&pAd->RECBATimer, REORDER_EXEC_INTV); */
+
 	pAd->CommonCfg.bWiFiTest = FALSE;
-#ifdef RT2860
+#ifdef RTMP_MAC_PCI
 	pAd->bPCIclkOff = FALSE;
+#endif /* RTMP_MAC_PCI // */
 
 	RTMP_SET_PSFLAG(pAd, fRTMP_PS_CAN_GO_SLEEP);
-#endif
 	DBGPRINT(RT_DEBUG_TRACE, ("<-- UserCfgInit\n"));
 }
 
-// IRQL = PASSIVE_LEVEL
-UCHAR BtoH(char ch)
+/* IRQL = PASSIVE_LEVEL */
+u8 BtoH(char ch)
 {
-	if (ch >= '0' && ch <= '9') return (ch - '0');        // Handle numerals
-	if (ch >= 'A' && ch <= 'F') return (ch - 'A' + 0xA);  // Handle capitol hex digits
-	if (ch >= 'a' && ch <= 'f') return (ch - 'a' + 0xA);  // Handle small hex digits
-	return(255);
+	if (ch >= '0' && ch <= '9')
+		return (ch - '0');	/* Handle numerals */
+	if (ch >= 'A' && ch <= 'F')
+		return (ch - 'A' + 0xA);	/* Handle capitol hex digits */
+	if (ch >= 'a' && ch <= 'f')
+		return (ch - 'a' + 0xA);	/* Handle small hex digits */
+	return (255);
 }
 
-//
-//  FUNCTION: AtoH(char *, UCHAR *, int)
-//
-//  PURPOSE:  Converts ascii string to network order hex
-//
-//  PARAMETERS:
-//    src    - pointer to input ascii string
-//    dest   - pointer to output hex
-//    destlen - size of dest
-//
-//  COMMENTS:
-//
-//    2 ascii bytes make a hex byte so must put 1st ascii byte of pair
-//    into upper nibble and 2nd ascii byte of pair into lower nibble.
-//
-// IRQL = PASSIVE_LEVEL
-
-void AtoH(char * src, UCHAR * dest, int destlen)
+/* */
+/*  FUNCTION: AtoH(char *, u8 *, int) */
+/* */
+/*  PURPOSE:  Converts ascii string to network order hex */
+/* */
+/*  PARAMETERS: */
+/*    src    - pointer to input ascii string */
+/*    dest   - pointer to output hex */
+/*    destlen - size of dest */
+/* */
+/*  COMMENTS: */
+/* */
+/*    2 ascii bytes make a hex byte so must put 1st ascii byte of pair */
+/*    into upper nibble and 2nd ascii byte of pair into lower nibble. */
+/* */
+/* IRQL = PASSIVE_LEVEL */
+
+void AtoH(char *src, u8 *dest, int destlen)
 {
-	char * srcptr;
-	PUCHAR destTemp;
+	char *srcptr;
+	u8 *destTemp;
 
 	srcptr = src;
-	destTemp = (PUCHAR) dest;
+	destTemp = (u8 *)dest;
 
-	while(destlen--)
-	{
-		*destTemp = BtoH(*srcptr++) << 4;    // Put 1st ascii byte in upper nibble.
-		*destTemp += BtoH(*srcptr++);      // Add 2nd ascii byte to above.
+	while (destlen--) {
+		*destTemp = BtoH(*srcptr++) << 4;	/* Put 1st ascii byte in upper nibble. */
+		*destTemp += BtoH(*srcptr++);	/* Add 2nd ascii byte to above. */
 		destTemp++;
 	}
 }
 
-VOID	RTMPPatchMacBbpBug(
-	IN	PRTMP_ADAPTER	pAd)
-{
-	ULONG	Index;
-
-	// Initialize BBP register to default value
-	for (Index = 0; Index < NUM_BBP_REG_PARMS; Index++)
-	{
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBPRegTable[Index].Register, (UCHAR)BBPRegTable[Index].Value);
-	}
-
-	// Initialize RF register to default value
-	AsicSwitchChannel(pAd, pAd->CommonCfg.Channel, FALSE);
-	AsicLockChannel(pAd, pAd->CommonCfg.Channel);
-
-	// Re-init BBP register from EEPROM value
-	NICInitAsicFromEEPROM(pAd);
-}
+/*+++Mark by shiang, not use now, need to remove after confirm */
+/*---Mark by shiang, not use now, need to remove after confirm */
 
 /*
 	========================================================================
@@ -3618,29 +2875,26 @@ VOID	RTMPPatchMacBbpBug(
 
 	========================================================================
 */
-VOID	RTMPInitTimer(
-	IN	PRTMP_ADAPTER			pAd,
-	IN	PRALINK_TIMER_STRUCT	pTimer,
-	IN	PVOID					pTimerFunc,
-	IN	PVOID					pData,
-	IN	BOOLEAN					Repeat)
+void RTMPInitTimer(struct rt_rtmp_adapter *pAd,
+		   struct rt_ralink_timer *pTimer,
+		   void *pTimerFunc, void *pData, IN BOOLEAN Repeat)
 {
-	//
-	// Set Valid to TRUE for later used.
-	// It will crash if we cancel a timer or set a timer
-	// that we haven't initialize before.
-	//
-	pTimer->Valid      = TRUE;
+	/* */
+	/* Set Valid to TRUE for later used. */
+	/* It will crash if we cancel a timer or set a timer */
+	/* that we haven't initialize before. */
+	/* */
+	pTimer->Valid = TRUE;
 
 	pTimer->PeriodicType = Repeat;
-	pTimer->State      = FALSE;
-	pTimer->cookie = (ULONG) pData;
+	pTimer->State = FALSE;
+	pTimer->cookie = (unsigned long)pData;
 
-#ifdef RT2870
+#ifdef RTMP_TIMER_TASK_SUPPORT
 	pTimer->pAd = pAd;
-#endif // RT2870 //
+#endif /* RTMP_TIMER_TASK_SUPPORT // */
 
-	RTMP_OS_Init_Timer(pAd,	&pTimer->TimerObj,	pTimerFunc, (PVOID) pTimer);
+	RTMP_OS_Init_Timer(pAd, &pTimer->TimerObj, pTimerFunc, (void *)pTimer);
 }
 
 /*
@@ -3661,32 +2915,23 @@ VOID	RTMPInitTimer(
 
 	========================================================================
 */
-VOID	RTMPSetTimer(
-	IN	PRALINK_TIMER_STRUCT	pTimer,
-	IN	ULONG					Value)
+void RTMPSetTimer(struct rt_ralink_timer *pTimer, unsigned long Value)
 {
-	if (pTimer->Valid)
-	{
+	if (pTimer->Valid) {
 		pTimer->TimerValue = Value;
-		pTimer->State      = FALSE;
-		if (pTimer->PeriodicType == TRUE)
-		{
+		pTimer->State = FALSE;
+		if (pTimer->PeriodicType == TRUE) {
 			pTimer->Repeat = TRUE;
 			RTMP_SetPeriodicTimer(&pTimer->TimerObj, Value);
-		}
-		else
-		{
+		} else {
 			pTimer->Repeat = FALSE;
 			RTMP_OS_Add_Timer(&pTimer->TimerObj, Value);
 		}
-	}
-	else
-	{
+	} else {
 		DBGPRINT_ERR(("RTMPSetTimer failed, Timer hasn't been initialize!\n"));
 	}
 }
 
-
 /*
 	========================================================================
 
@@ -3705,28 +2950,20 @@ VOID	RTMPSetTimer(
 
 	========================================================================
 */
-VOID	RTMPModTimer(
-	IN	PRALINK_TIMER_STRUCT	pTimer,
-	IN	ULONG					Value)
+void RTMPModTimer(struct rt_ralink_timer *pTimer, unsigned long Value)
 {
-	BOOLEAN	Cancel;
+	BOOLEAN Cancel;
 
-	if (pTimer->Valid)
-	{
+	if (pTimer->Valid) {
 		pTimer->TimerValue = Value;
-		pTimer->State      = FALSE;
-		if (pTimer->PeriodicType == TRUE)
-		{
+		pTimer->State = FALSE;
+		if (pTimer->PeriodicType == TRUE) {
 			RTMPCancelTimer(pTimer, &Cancel);
 			RTMPSetTimer(pTimer, Value);
-		}
-		else
-		{
+		} else {
 			RTMP_OS_Mod_Timer(&pTimer->TimerObj, Value);
 		}
-	}
-	else
-	{
+	} else {
 		DBGPRINT_ERR(("RTMPModTimer failed, Timer hasn't been initialize!\n"));
 	}
 }
@@ -3752,32 +2989,23 @@ VOID	RTMPModTimer(
 
 	========================================================================
 */
-VOID	RTMPCancelTimer(
-	IN	PRALINK_TIMER_STRUCT	pTimer,
-	OUT	BOOLEAN					*pCancelled)
+void RTMPCancelTimer(struct rt_ralink_timer *pTimer, OUT BOOLEAN * pCancelled)
 {
-	if (pTimer->Valid)
-	{
+	if (pTimer->Valid) {
 		if (pTimer->State == FALSE)
 			pTimer->Repeat = FALSE;
-			RTMP_OS_Del_Timer(&pTimer->TimerObj, pCancelled);
+
+		RTMP_OS_Del_Timer(&pTimer->TimerObj, pCancelled);
 
 		if (*pCancelled == TRUE)
 			pTimer->State = TRUE;
 
-#ifdef RT2870
-		// We need to go-through the TimerQ to findout this timer handler and remove it if
-		//		it's still waiting for execution.
-
-		RT2870_TimerQ_Remove(pTimer->pAd, pTimer);
-#endif // RT2870 //
-	}
-	else
-	{
-		//
-		// NdisMCancelTimer just canced the timer and not mean release the timer.
-		// And don't set the "Valid" to False. So that we can use this timer again.
-		//
+#ifdef RTMP_TIMER_TASK_SUPPORT
+		/* We need to go-through the TimerQ to findout this timer handler and remove it if */
+		/*              it's still waiting for execution. */
+		RtmpTimerQRemove(pTimer->pAd, pTimer);
+#endif /* RTMP_TIMER_TASK_SUPPORT // */
+	} else {
 		DBGPRINT_ERR(("RTMPCancelTimer failed, Timer hasn't been initialize!\n"));
 	}
 }
@@ -3802,64 +3030,64 @@ VOID	RTMPCancelTimer(
 
 	========================================================================
 */
-VOID RTMPSetLED(
-	IN PRTMP_ADAPTER 	pAd,
-	IN UCHAR			Status)
+void RTMPSetLED(struct rt_rtmp_adapter *pAd, u8 Status)
 {
-	//ULONG			data;
-	UCHAR			HighByte = 0;
-	UCHAR			LowByte;
-
-	LowByte = pAd->LedCntl.field.LedMode&0x7f;
-	switch (Status)
-	{
-		case LED_LINK_DOWN:
-			HighByte = 0x20;
-			AsicSendCommandToMcu(pAd, 0x50, 0xff, LowByte, HighByte);
-			pAd->LedIndicatorStregth = 0;
-			break;
-		case LED_LINK_UP:
-			if (pAd->CommonCfg.Channel > 14)
-				HighByte = 0xa0;
-			else
-				HighByte = 0x60;
-			AsicSendCommandToMcu(pAd, 0x50, 0xff, LowByte, HighByte);
-			break;
-		case LED_RADIO_ON:
-			HighByte = 0x20;
-			AsicSendCommandToMcu(pAd, 0x50, 0xff, LowByte, HighByte);
-			break;
-		case LED_HALT:
-			LowByte = 0; // Driver sets MAC register and MAC controls LED
-		case LED_RADIO_OFF:
-			HighByte = 0;
-			AsicSendCommandToMcu(pAd, 0x50, 0xff, LowByte, HighByte);
-			break;
-        case LED_WPS:
-			HighByte = 0x10;
-			AsicSendCommandToMcu(pAd, 0x50, 0xff, LowByte, HighByte);
-			break;
-		case LED_ON_SITE_SURVEY:
-			HighByte = 0x08;
-			AsicSendCommandToMcu(pAd, 0x50, 0xff, LowByte, HighByte);
-			break;
-		case LED_POWER_UP:
-			HighByte = 0x04;
-			AsicSendCommandToMcu(pAd, 0x50, 0xff, LowByte, HighByte);
-			break;
-		default:
-			DBGPRINT(RT_DEBUG_WARN, ("RTMPSetLED::Unknown Status %d\n", Status));
-			break;
-	}
-
-    //
-	// Keep LED status for LED SiteSurvey mode.
-	// After SiteSurvey, we will set the LED mode to previous status.
-	//
+	/*unsigned long                 data; */
+	u8 HighByte = 0;
+	u8 LowByte;
+
+	LowByte = pAd->LedCntl.field.LedMode & 0x7f;
+	switch (Status) {
+	case LED_LINK_DOWN:
+		HighByte = 0x20;
+		AsicSendCommandToMcu(pAd, 0x50, 0xff, LowByte, HighByte);
+		pAd->LedIndicatorStrength = 0;
+		break;
+	case LED_LINK_UP:
+		if (pAd->CommonCfg.Channel > 14)
+			HighByte = 0xa0;
+		else
+			HighByte = 0x60;
+		AsicSendCommandToMcu(pAd, 0x50, 0xff, LowByte, HighByte);
+		break;
+	case LED_RADIO_ON:
+		HighByte = 0x20;
+		AsicSendCommandToMcu(pAd, 0x50, 0xff, LowByte, HighByte);
+		break;
+	case LED_HALT:
+		LowByte = 0;	/* Driver sets MAC register and MAC controls LED */
+	case LED_RADIO_OFF:
+		HighByte = 0;
+		AsicSendCommandToMcu(pAd, 0x50, 0xff, LowByte, HighByte);
+		break;
+	case LED_WPS:
+		HighByte = 0x10;
+		AsicSendCommandToMcu(pAd, 0x50, 0xff, LowByte, HighByte);
+		break;
+	case LED_ON_SITE_SURVEY:
+		HighByte = 0x08;
+		AsicSendCommandToMcu(pAd, 0x50, 0xff, LowByte, HighByte);
+		break;
+	case LED_POWER_UP:
+		HighByte = 0x04;
+		AsicSendCommandToMcu(pAd, 0x50, 0xff, LowByte, HighByte);
+		break;
+	default:
+		DBGPRINT(RT_DEBUG_WARN,
+			 ("RTMPSetLED::Unknown Status %d\n", Status));
+		break;
+	}
+
+	/* */
+	/* Keep LED status for LED SiteSurvey mode. */
+	/* After SiteSurvey, we will set the LED mode to previous status. */
+	/* */
 	if ((Status != LED_ON_SITE_SURVEY) && (Status != LED_POWER_UP))
 		pAd->LedStatus = Status;
 
-	DBGPRINT(RT_DEBUG_TRACE, ("RTMPSetLED::Mode=%d,HighByte=0x%02x,LowByte=0x%02x\n", pAd->LedCntl.field.LedMode, HighByte, LowByte));
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("RTMPSetLED::Mode=%d,HighByte=0x%02x,LowByte=0x%02x\n",
+		  pAd->LedCntl.field.LedMode, HighByte, LowByte));
 }
 
 /*
@@ -3889,40 +3117,32 @@ VOID RTMPSetLED(
 		 > -57  Excellent
 	========================================================================
 */
-VOID RTMPSetSignalLED(
-	IN PRTMP_ADAPTER 	pAd,
-	IN NDIS_802_11_RSSI Dbm)
+void RTMPSetSignalLED(struct rt_rtmp_adapter *pAd, IN NDIS_802_11_RSSI Dbm)
 {
-	UCHAR		nLed = 0;
-
-	//
-	// if not Signal Stregth, then do nothing.
-	//
-	if (pAd->LedCntl.field.LedMode != LED_MODE_SIGNAL_STREGTH)
-	{
-		return;
-	}
-
-	if (Dbm <= -90)
-		nLed = 0;
-	else if (Dbm <= -81)
-		nLed = 1;
-	else if (Dbm <= -71)
-		nLed = 3;
-	else if (Dbm <= -67)
-		nLed = 7;
-	else if (Dbm <= -57)
-		nLed = 15;
-	else
-		nLed = 31;
+	u8 nLed = 0;
+
+	if (pAd->LedCntl.field.LedMode == LED_MODE_SIGNAL_STREGTH) {
+		if (Dbm <= -90)
+			nLed = 0;
+		else if (Dbm <= -81)
+			nLed = 1;
+		else if (Dbm <= -71)
+			nLed = 3;
+		else if (Dbm <= -67)
+			nLed = 7;
+		else if (Dbm <= -57)
+			nLed = 15;
+		else
+			nLed = 31;
 
-	//
-	// Update Signal Stregth to firmware if changed.
-	//
-	if (pAd->LedIndicatorStregth != nLed)
-	{
-		AsicSendCommandToMcu(pAd, 0x51, 0xff, nLed, pAd->LedCntl.field.Polarity);
-		pAd->LedIndicatorStregth = nLed;
+		/* */
+		/* Update Signal Stregth to firmware if changed. */
+		/* */
+		if (pAd->LedIndicatorStrength != nLed) {
+			AsicSendCommandToMcu(pAd, 0x51, 0xff, nLed,
+					     pAd->LedCntl.field.Polarity);
+			pAd->LedIndicatorStrength = nLed;
+		}
 	}
 }
 
@@ -3944,29 +3164,394 @@ VOID RTMPSetSignalLED(
 		Before Enable RX, make sure you have enabled Interrupt.
 	========================================================================
 */
-VOID RTMPEnableRxTx(
-	IN PRTMP_ADAPTER	pAd)
+void RTMPEnableRxTx(struct rt_rtmp_adapter *pAd)
 {
+/*      WPDMA_GLO_CFG_STRUC     GloCfg; */
+/*      unsigned long   i = 0; */
+	u32 rx_filter_flag;
+
 	DBGPRINT(RT_DEBUG_TRACE, ("==> RTMPEnableRxTx\n"));
 
-	// Enable Rx DMA.
+	/* Enable Rx DMA. */
 	RT28XXDMAEnable(pAd);
 
-	// enable RX of MAC block
-	if (pAd->OpMode == OPMODE_AP)
+	/* enable RX of MAC block */
+	if (pAd->OpMode == OPMODE_AP) {
+		rx_filter_flag = APNORMAL;
+
+		RTMP_IO_WRITE32(pAd, RX_FILTR_CFG, rx_filter_flag);	/* enable RX of DMA block */
+	} else {
+		if (pAd->CommonCfg.PSPXlink)
+			rx_filter_flag = PSPXLINK;
+		else
+			rx_filter_flag = STANORMAL;	/* Staion not drop control frame will fail WiFi Certification. */
+		RTMP_IO_WRITE32(pAd, RX_FILTR_CFG, rx_filter_flag);
+	}
+
+	RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, 0xc);
+	DBGPRINT(RT_DEBUG_TRACE, ("<== RTMPEnableRxTx\n"));
+}
+
+/*+++Add by shiang, move from os/linux/rt_main_dev.c */
+void CfgInitHook(struct rt_rtmp_adapter *pAd)
+{
+	pAd->bBroadComHT = TRUE;
+}
+
+int rt28xx_init(struct rt_rtmp_adapter *pAd,
+		char *pDefaultMac, char *pHostName)
+{
+	u32 index;
+	u8 TmpPhy;
+	int Status;
+	u32 MacCsr0 = 0;
+
+#ifdef RTMP_MAC_PCI
 	{
-		UINT32 rx_filter_flag = APNORMAL;
+		/* If dirver doesn't wake up firmware here, */
+		/* NICLoadFirmware will hang forever when interface is up again. */
+		/* RT2860 PCI */
+		if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE) &&
+		    OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE)) {
+			AUTO_WAKEUP_STRUC AutoWakeupCfg;
+			AsicForceWakeup(pAd, TRUE);
+			AutoWakeupCfg.word = 0;
+			RTMP_IO_WRITE32(pAd, AUTO_WAKEUP_CFG,
+					AutoWakeupCfg.word);
+			OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_DOZE);
+		}
+	}
+#endif /* RTMP_MAC_PCI // */
+
+	/* reset Adapter flags */
+	RTMP_CLEAR_FLAGS(pAd);
+
+	/* Init BssTab & ChannelInfo tabbles for auto channel select. */
+
+	/* Allocate BA Reordering memory */
+	ba_reordering_resource_init(pAd, MAX_REORDERING_MPDU_NUM);
+
+	/* Make sure MAC gets ready. */
+	index = 0;
+	do {
+		RTMP_IO_READ32(pAd, MAC_CSR0, &MacCsr0);
+		pAd->MACVersion = MacCsr0;
+
+		if ((pAd->MACVersion != 0x00)
+		    && (pAd->MACVersion != 0xFFFFFFFF))
+			break;
+
+		RTMPusecDelay(10);
+	} while (index++ < 100);
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("MAC_CSR0  [ Ver:Rev=0x%08x]\n", pAd->MACVersion));
+
+#ifdef RTMP_MAC_PCI
+#ifdef PCIE_PS_SUPPORT
+	/*Iverson patch PCIE L1 issue to make sure that driver can be read,write ,BBP and RF register  at pcie L.1 level */
+	if ((IS_RT3090(pAd) || IS_RT3572(pAd) || IS_RT3390(pAd))
+	    && OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE)) {
+		RTMP_IO_READ32(pAd, AUX_CTRL, &MacCsr0);
+		MacCsr0 |= 0x402;
+		RTMP_IO_WRITE32(pAd, AUX_CTRL, MacCsr0);
+		DBGPRINT(RT_DEBUG_TRACE, ("AUX_CTRL = 0x%x\n", MacCsr0));
+	}
+#endif /* PCIE_PS_SUPPORT // */
+
+	/* To fix driver disable/enable hang issue when radio off */
+	RTMP_IO_WRITE32(pAd, PWR_PIN_CFG, 0x2);
+#endif /* RTMP_MAC_PCI // */
+
+	/* Disable DMA */
+	RT28XXDMADisable(pAd);
+
+	/* Load 8051 firmware */
+	Status = NICLoadFirmware(pAd);
+	if (Status != NDIS_STATUS_SUCCESS) {
+		DBGPRINT_ERR(("NICLoadFirmware failed, Status[=0x%08x]\n",
+			      Status));
+		goto err1;
+	}
+
+	NICLoadRateSwitchingParams(pAd);
+
+	/* Disable interrupts here which is as soon as possible */
+	/* This statement should never be true. We might consider to remove it later */
+#ifdef RTMP_MAC_PCI
+	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_INTERRUPT_ACTIVE)) {
+		RTMP_ASIC_INTERRUPT_DISABLE(pAd);
+	}
+#endif /* RTMP_MAC_PCI // */
+
+	Status = RTMPAllocTxRxRingMemory(pAd);
+	if (Status != NDIS_STATUS_SUCCESS) {
+		DBGPRINT_ERR(("RTMPAllocDMAMemory failed, Status[=0x%08x]\n",
+			      Status));
+		goto err1;
+	}
+
+	RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_INTERRUPT_IN_USE);
+
+	/* initialize MLME */
+	/* */
+
+	Status = RtmpMgmtTaskInit(pAd);
+	if (Status != NDIS_STATUS_SUCCESS)
+		goto err2;
+
+	Status = MlmeInit(pAd);
+	if (Status != NDIS_STATUS_SUCCESS) {
+		DBGPRINT_ERR(("MlmeInit failed, Status[=0x%08x]\n", Status));
+		goto err2;
+	}
+	/* Initialize pAd->StaCfg, pAd->ApCfg, pAd->CommonCfg to manufacture default */
+	/* */
+	UserCfgInit(pAd);
+	Status = RtmpNetTaskInit(pAd);
+	if (Status != NDIS_STATUS_SUCCESS)
+		goto err3;
 
+/*      COPY_MAC_ADDR(pAd->ApCfg.MBSSID[apidx].Bssid, netif->hwaddr); */
+/*      pAd->bForcePrintTX = TRUE; */
 
-		RTMP_IO_WRITE32(pAd, RX_FILTR_CFG, rx_filter_flag);     // enable RX of DMA block
+	CfgInitHook(pAd);
+
+	NdisAllocateSpinLock(&pAd->MacTabLock);
+
+	MeasureReqTabInit(pAd);
+	TpcReqTabInit(pAd);
+
+	/* */
+	/* Init the hardware, we need to init asic before read registry, otherwise mac register will be reset */
+	/* */
+	Status = NICInitializeAdapter(pAd, TRUE);
+	if (Status != NDIS_STATUS_SUCCESS) {
+		DBGPRINT_ERR(("NICInitializeAdapter failed, Status[=0x%08x]\n",
+			      Status));
+		if (Status != NDIS_STATUS_SUCCESS)
+			goto err3;
 	}
+
+	DBGPRINT(RT_DEBUG_OFF, ("1. Phy Mode = %d\n", pAd->CommonCfg.PhyMode));
+
+#ifdef RTMP_MAC_USB
+	pAd->CommonCfg.bMultipleIRP = FALSE;
+
+	if (pAd->CommonCfg.bMultipleIRP)
+		pAd->CommonCfg.NumOfBulkInIRP = RX_RING_SIZE;
 	else
-	{
-		RTMP_IO_WRITE32(pAd, RX_FILTR_CFG, STANORMAL);     // Staion not drop control frame will fail WiFi Certification.
+		pAd->CommonCfg.NumOfBulkInIRP = 1;
+#endif /* RTMP_MAC_USB // */
+
+	/*Init Ba Capability parameters. */
+/*      RT28XX_BA_INIT(pAd); */
+	pAd->CommonCfg.DesiredHtPhy.MpduDensity =
+	    (u8)pAd->CommonCfg.BACapability.field.MpduDensity;
+	pAd->CommonCfg.DesiredHtPhy.AmsduEnable =
+	    (u16)pAd->CommonCfg.BACapability.field.AmsduEnable;
+	pAd->CommonCfg.DesiredHtPhy.AmsduSize =
+	    (u16)pAd->CommonCfg.BACapability.field.AmsduSize;
+	pAd->CommonCfg.DesiredHtPhy.MimoPs =
+	    (u16)pAd->CommonCfg.BACapability.field.MMPSmode;
+	/* UPdata to HT IE */
+	pAd->CommonCfg.HtCapability.HtCapInfo.MimoPs =
+	    (u16)pAd->CommonCfg.BACapability.field.MMPSmode;
+	pAd->CommonCfg.HtCapability.HtCapInfo.AMsduSize =
+	    (u16)pAd->CommonCfg.BACapability.field.AmsduSize;
+	pAd->CommonCfg.HtCapability.HtCapParm.MpduDensity =
+	    (u8)pAd->CommonCfg.BACapability.field.MpduDensity;
+
+	/* after reading Registry, we now know if in AP mode or STA mode */
+
+	/* Load 8051 firmware; crash when FW image not existent */
+	/* Status = NICLoadFirmware(pAd); */
+	/* if (Status != NDIS_STATUS_SUCCESS) */
+	/*    break; */
+
+	DBGPRINT(RT_DEBUG_OFF, ("2. Phy Mode = %d\n", pAd->CommonCfg.PhyMode));
+
+	/* We should read EEPROM for all cases.  rt2860b */
+	NICReadEEPROMParameters(pAd, (u8 *)pDefaultMac);
+
+	DBGPRINT(RT_DEBUG_OFF, ("3. Phy Mode = %d\n", pAd->CommonCfg.PhyMode));
+
+	NICInitAsicFromEEPROM(pAd);	/*rt2860b */
+
+	/* Set PHY to appropriate mode */
+	TmpPhy = pAd->CommonCfg.PhyMode;
+	pAd->CommonCfg.PhyMode = 0xff;
+	RTMPSetPhyMode(pAd, TmpPhy);
+	SetCommonHT(pAd);
+
+	/* No valid channels. */
+	if (pAd->ChannelListNum == 0) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("Wrong configuration. No valid channel found. Check \"ContryCode\" and \"ChannelGeography\" setting.\n"));
+		goto err4;
+	}
+
+	DBGPRINT(RT_DEBUG_OFF,
+		 ("MCS Set = %02x %02x %02x %02x %02x\n",
+		  pAd->CommonCfg.HtCapability.MCSSet[0],
+		  pAd->CommonCfg.HtCapability.MCSSet[1],
+		  pAd->CommonCfg.HtCapability.MCSSet[2],
+		  pAd->CommonCfg.HtCapability.MCSSet[3],
+		  pAd->CommonCfg.HtCapability.MCSSet[4]));
+
+#ifdef RTMP_RF_RW_SUPPORT
+	/*Init RT30xx RFRegisters after read RFIC type from EEPROM */
+	NICInitRFRegisters(pAd);
+#endif /* RTMP_RF_RW_SUPPORT // */
+
+/*              APInitialize(pAd); */
+
+	/* */
+	/* Initialize RF register to default value */
+	/* */
+	AsicSwitchChannel(pAd, pAd->CommonCfg.Channel, FALSE);
+	AsicLockChannel(pAd, pAd->CommonCfg.Channel);
+
+	/* 8051 firmware require the signal during booting time. */
+	/*2008/11/28:KH marked the following codes to patch Frequency offset bug */
+	/*AsicSendCommandToMcu(pAd, 0x72, 0xFF, 0x00, 0x00); */
+
+	if (pAd && (Status != NDIS_STATUS_SUCCESS)) {
+		/* */
+		/* Undo everything if it failed */
+		/* */
+		if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_INTERRUPT_IN_USE)) {
+/*                      NdisMDeregisterInterrupt(&pAd->Interrupt); */
+			RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_INTERRUPT_IN_USE);
+		}
+/*              RTMPFreeAdapter(pAd); // we will free it in disconnect() */
+	} else if (pAd) {
+		/* Microsoft HCT require driver send a disconnect event after driver initialization. */
+		OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED);
+/*              pAd->IndicateMediaState = NdisMediaStateDisconnected; */
+		RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_MEDIA_STATE_CHANGE);
+
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("NDIS_STATUS_MEDIA_DISCONNECT Event B!\n"));
+
+#ifdef RTMP_MAC_USB
+		RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_RESET_IN_PROGRESS);
+		RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_REMOVE_IN_PROGRESS);
+
+		/* */
+		/* Support multiple BulkIn IRP, */
+		/* the value on pAd->CommonCfg.NumOfBulkInIRP may be large than 1. */
+		/* */
+		for (index = 0; index < pAd->CommonCfg.NumOfBulkInIRP; index++) {
+			RTUSBBulkReceive(pAd);
+			DBGPRINT(RT_DEBUG_TRACE, ("RTUSBBulkReceive!\n"));
+		}
+#endif /* RTMP_MAC_USB // */
+	}			/* end of else */
+
+	/* Set up the Mac address */
+	RtmpOSNetDevAddrSet(pAd->net_dev, &pAd->CurrentAddress[0]);
+
+	DBGPRINT_S(Status, ("<==== rt28xx_init, Status=%x\n", Status));
+
+	return TRUE;
+
+err4:
+err3:
+	MlmeHalt(pAd);
+err2:
+	RTMPFreeTxRxRingMemory(pAd);
+err1:
+
+	os_free_mem(pAd, pAd->mpdu_blk_pool.mem);	/* free BA pool */
+
+	/* shall not set priv to NULL here because the priv didn't been free yet. */
+	/*net_dev->ml_priv = 0; */
+#ifdef ST
+err0:
+#endif /* ST // */
+
+	DBGPRINT(RT_DEBUG_ERROR, ("rt28xx Initialized fail!\n"));
+	return FALSE;
+}
+
+/*---Add by shiang, move from os/linux/rt_main_dev.c */
+
+static int RtmpChipOpsRegister(struct rt_rtmp_adapter *pAd, int infType)
+{
+	struct rt_rtmp_chip_op *pChipOps = &pAd->chipOps;
+	int status;
+
+	memset(pChipOps, 0, sizeof(struct rt_rtmp_chip_op));
+
+	/* set eeprom related hook functions */
+	status = RtmpChipOpsEepromHook(pAd, infType);
+
+	/* set mcu related hook functions */
+	switch (infType) {
+#ifdef RTMP_PCI_SUPPORT
+	case RTMP_DEV_INF_PCI:
+		pChipOps->loadFirmware = RtmpAsicLoadFirmware;
+		pChipOps->eraseFirmware = RtmpAsicEraseFirmware;
+		pChipOps->sendCommandToMcu = RtmpAsicSendCommandToMcu;
+		break;
+#endif /* RTMP_PCI_SUPPORT // */
+#ifdef RTMP_USB_SUPPORT
+	case RTMP_DEV_INF_USB:
+		pChipOps->loadFirmware = RtmpAsicLoadFirmware;
+		pChipOps->sendCommandToMcu = RtmpAsicSendCommandToMcu;
+		break;
+#endif /* RTMP_USB_SUPPORT // */
+	default:
+		break;
+	}
+
+	return status;
+}
+
+int RtmpRaDevCtrlInit(struct rt_rtmp_adapter *pAd, IN RTMP_INF_TYPE infType)
+{
+	/*void  *handle; */
+
+	/* Assign the interface type. We need use it when do register/EEPROM access. */
+	pAd->infType = infType;
+
+	pAd->OpMode = OPMODE_STA;
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("STA Driver version-%s\n", STA_DRIVER_VERSION));
+
+#ifdef RTMP_MAC_USB
+	init_MUTEX(&(pAd->UsbVendorReq_semaphore));
+	os_alloc_mem(pAd, (u8 **) & pAd->UsbVendorReqBuf,
+		     MAX_PARAM_BUFFER_SIZE - 1);
+	if (pAd->UsbVendorReqBuf == NULL) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("Allocate vendor request temp buffer failed!\n"));
+		return FALSE;
 	}
+#endif /* RTMP_MAC_USB // */
 
-	RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, 0xc);
-	DBGPRINT(RT_DEBUG_TRACE, ("<== RTMPEnableRxTx\n"));
+	RtmpChipOpsRegister(pAd, infType);
+
+	return 0;
 }
 
+BOOLEAN RtmpRaDevCtrlExit(struct rt_rtmp_adapter *pAd)
+{
+
+	RTMPFreeAdapter(pAd);
+
+	return TRUE;
+}
+
+/* not yet support MBSS */
+struct net_device *get_netdev_from_bssid(struct rt_rtmp_adapter *pAd, u8 FromWhichBSSID)
+{
+	struct net_device *dev_p = NULL;
 
+	{
+		dev_p = pAd->net_dev;
+	}
+
+	ASSERT(dev_p);
+	return dev_p;		/* return one of MBSS */
+}
diff --git a/drivers/staging/rt2860/common/rtmp_mcu.c b/drivers/staging/rt2860/common/rtmp_mcu.c
new file mode 100644
index 000000000000..9f03901433bb
--- /dev/null
+++ b/drivers/staging/rt2860/common/rtmp_mcu.c
@@ -0,0 +1,291 @@
+/*
+ *************************************************************************
+ * Ralink Tech Inc.
+ * 5F., No.36, Taiyuan St., Jhubei City,
+ * Hsinchu County 302,
+ * Taiwan, R.O.C.
+ *
+ * (c) Copyright 2002-2007, Ralink Technology, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify  *
+ * it under the terms of the GNU General Public License as published by  *
+ * the Free Software Foundation; either version 2 of the License, or     *
+ * (at your option) any later version.                                   *
+ *                                                                       *
+ * This program is distributed in the hope that it will be useful,       *
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
+ * GNU General Public License for more details.                          *
+ *                                                                       *
+ * You should have received a copy of the GNU General Public License     *
+ * along with this program; if not, write to the                         *
+ * Free Software Foundation, Inc.,                                       *
+ * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
+ *                                                                       *
+ *************************************************************************
+
+	Module Name:
+	rtmp_mcu.c
+
+	Abstract:
+	Miniport generic portion header file
+
+	Revision History:
+	Who         When          What
+	--------    ----------    ----------------------------------------------
+*/
+
+#include	"../rt_config.h"
+
+#if defined(RT2860) || defined(RT3090)
+#include "firmware.h"
+#include "../../rt3090/firmware.h"
+#endif
+#ifdef RT2870
+#include "../../rt3070/firmware.h"
+#include "firmware_3070.h"
+#endif
+
+#include <linux/bitrev.h>
+
+#ifdef RTMP_MAC_USB
+/* */
+/* RT2870 Firmware Spec only used 1 oct for version expression */
+/* */
+#define FIRMWARE_MINOR_VERSION	7
+#endif /* RTMP_MAC_USB // */
+
+/* New 8k byte firmware size for RT3071/RT3072 */
+#define FIRMWAREIMAGE_MAX_LENGTH	0x2000
+#define FIRMWAREIMAGE_LENGTH			(sizeof (FirmwareImage) / sizeof(u8))
+#define FIRMWARE_MAJOR_VERSION		0
+
+#define FIRMWAREIMAGEV1_LENGTH		0x1000
+#define FIRMWAREIMAGEV2_LENGTH		0x1000
+
+#ifdef RTMP_MAC_PCI
+#define FIRMWARE_MINOR_VERSION		2
+#endif /* RTMP_MAC_PCI // */
+
+/*
+	========================================================================
+
+	Routine Description:
+		erase 8051 firmware image in MAC ASIC
+
+	Arguments:
+		Adapter						Pointer to our adapter
+
+	IRQL = PASSIVE_LEVEL
+
+	========================================================================
+*/
+int RtmpAsicEraseFirmware(struct rt_rtmp_adapter *pAd)
+{
+	unsigned long i;
+
+	for (i = 0; i < MAX_FIRMWARE_IMAGE_SIZE; i += 4)
+		RTMP_IO_WRITE32(pAd, FIRMWARE_IMAGE_BASE + i, 0);
+
+	return 0;
+}
+
+/*
+	========================================================================
+
+	Routine Description:
+		Load 8051 firmware file into MAC ASIC
+
+	Arguments:
+		Adapter						Pointer to our adapter
+
+	Return Value:
+		NDIS_STATUS_SUCCESS         firmware image load ok
+		NDIS_STATUS_FAILURE         image not found
+
+	IRQL = PASSIVE_LEVEL
+
+	========================================================================
+*/
+int RtmpAsicLoadFirmware(struct rt_rtmp_adapter *pAd)
+{
+
+	int Status = NDIS_STATUS_SUCCESS;
+	u8 *pFirmwareImage = NULL;
+	unsigned long FileLength, Index;
+	u32 MacReg = 0;
+#ifdef RTMP_MAC_USB
+	u32 Version = (pAd->MACVersion >> 16);
+#endif
+
+	/* New 8k byte firmware size for RT3071/RT3072 */
+	{
+#ifdef RTMP_MAC_PCI
+		if (IS_RT3090(pAd) || IS_RT3390(pAd)) {
+			pFirmwareImage = FirmwareImage_3090;
+			FileLength = FIRMWAREIMAGE_MAX_LENGTH;
+		} else {
+			pFirmwareImage = FirmwareImage_2860;
+			FileLength = FIRMWAREIMAGE_MAX_LENGTH;
+		}
+#endif /* RTMP_MAC_PCI // */
+#ifdef RTMP_MAC_USB
+		/* the firmware image consists of two parts */
+		if ((Version != 0x2860) && (Version != 0x2872) && (Version != 0x3070)) {	/* use the second part */
+			/*printk("KH:Use New Version,part2\n"); */
+			pFirmwareImage =
+			    (u8 *)&
+			    FirmwareImage_3070[FIRMWAREIMAGEV1_LENGTH];
+			FileLength = FIRMWAREIMAGEV2_LENGTH;
+		} else {
+			/*printk("KH:Use New Version,part1\n"); */
+			if (Version == 0x3070)
+				pFirmwareImage = FirmwareImage_3070;
+			else
+				pFirmwareImage = FirmwareImage_2870;
+			FileLength = FIRMWAREIMAGEV1_LENGTH;
+		}
+#endif /* RTMP_MAC_USB // */
+	}
+
+	RTMP_WRITE_FIRMWARE(pAd, pFirmwareImage, FileLength);
+
+	/* check if MCU is ready */
+	Index = 0;
+	do {
+		RTMP_IO_READ32(pAd, PBF_SYS_CTRL, &MacReg);
+
+		if (MacReg & 0x80)
+			break;
+
+		RTMPusecDelay(1000);
+	} while (Index++ < 1000);
+
+	if (Index > 1000) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("NICLoadFirmware: MCU is not ready\n"));
+		Status = NDIS_STATUS_FAILURE;
+	}
+
+	DBGPRINT(RT_DEBUG_TRACE, ("<=== %s (status=%d)\n", __func__, Status));
+
+	return Status;
+}
+
+int RtmpAsicSendCommandToMcu(struct rt_rtmp_adapter *pAd,
+			     u8 Command,
+			     u8 Token, u8 Arg0, u8 Arg1)
+{
+	HOST_CMD_CSR_STRUC H2MCmd;
+	H2M_MAILBOX_STRUC H2MMailbox;
+	unsigned long i = 0;
+
+#ifdef PCIE_PS_SUPPORT
+	/* 3090F power solution 3 has hw limitation that needs to ban all mcu command */
+	/* when firmware is in radio state.  For other chip doesn't have this limitation. */
+	if (((IS_RT3090(pAd) || IS_RT3572(pAd) || IS_RT3390(pAd))
+	     && IS_VERSION_AFTER_F(pAd)) && IS_VERSION_AFTER_F(pAd)
+	    && (pAd->StaCfg.PSControl.field.rt30xxPowerMode == 3)
+	    && (pAd->StaCfg.PSControl.field.EnableNewPS == TRUE)) {
+		RTMP_SEM_LOCK(&pAd->McuCmdLock);
+		if ((pAd->brt30xxBanMcuCmd == TRUE)
+		    && (Command != WAKE_MCU_CMD) && (Command != RFOFF_MCU_CMD)) {
+			RTMP_SEM_UNLOCK(&pAd->McuCmdLock);
+			DBGPRINT(RT_DEBUG_TRACE,
+				 (" Ban Mcu Cmd %x in sleep mode\n", Command));
+			return FALSE;
+		} else if ((Command == SLEEP_MCU_CMD)
+			   || (Command == RFOFF_MCU_CMD)) {
+			pAd->brt30xxBanMcuCmd = TRUE;
+		} else if (Command != WAKE_MCU_CMD) {
+			pAd->brt30xxBanMcuCmd = FALSE;
+		}
+
+		RTMP_SEM_UNLOCK(&pAd->McuCmdLock);
+
+	}
+	if (((IS_RT3090(pAd) || IS_RT3572(pAd) || IS_RT3390(pAd))
+	     && IS_VERSION_AFTER_F(pAd)) && IS_VERSION_AFTER_F(pAd)
+	    && (pAd->StaCfg.PSControl.field.rt30xxPowerMode == 3)
+	    && (pAd->StaCfg.PSControl.field.EnableNewPS == TRUE)
+	    && (Command == WAKE_MCU_CMD)) {
+
+		do {
+			RTMP_IO_FORCE_READ32(pAd, H2M_MAILBOX_CSR,
+					     &H2MMailbox.word);
+			if (H2MMailbox.field.Owner == 0)
+				break;
+
+			RTMPusecDelay(2);
+			DBGPRINT(RT_DEBUG_INFO,
+				 ("AsicSendCommanToMcu::Mail box is busy\n"));
+		} while (i++ < 100);
+
+		if (i >= 100) {
+			DBGPRINT_ERR(("H2M_MAILBOX still hold by MCU. command fail\n"));
+			return FALSE;
+		}
+
+		H2MMailbox.field.Owner = 1;	/* pass ownership to MCU */
+		H2MMailbox.field.CmdToken = Token;
+		H2MMailbox.field.HighByte = Arg1;
+		H2MMailbox.field.LowByte = Arg0;
+		RTMP_IO_FORCE_WRITE32(pAd, H2M_MAILBOX_CSR, H2MMailbox.word);
+
+		H2MCmd.word = 0;
+		H2MCmd.field.HostCommand = Command;
+		RTMP_IO_FORCE_WRITE32(pAd, HOST_CMD_CSR, H2MCmd.word);
+
+	} else
+#endif /* PCIE_PS_SUPPORT // */
+	{
+		do {
+			RTMP_IO_READ32(pAd, H2M_MAILBOX_CSR, &H2MMailbox.word);
+			if (H2MMailbox.field.Owner == 0)
+				break;
+
+			RTMPusecDelay(2);
+		} while (i++ < 100);
+
+		if (i > 100) {
+#ifdef RTMP_MAC_PCI
+#endif /* RTMP_MAC_PCI // */
+			{
+				DBGPRINT_ERR(("H2M_MAILBOX still hold by MCU. command fail\n"));
+			}
+			return FALSE;
+		}
+#ifdef RTMP_MAC_PCI
+#endif /* RTMP_MAC_PCI // */
+
+		H2MMailbox.field.Owner = 1;	/* pass ownership to MCU */
+		H2MMailbox.field.CmdToken = Token;
+		H2MMailbox.field.HighByte = Arg1;
+		H2MMailbox.field.LowByte = Arg0;
+		RTMP_IO_WRITE32(pAd, H2M_MAILBOX_CSR, H2MMailbox.word);
+
+		H2MCmd.word = 0;
+		H2MCmd.field.HostCommand = Command;
+		RTMP_IO_WRITE32(pAd, HOST_CMD_CSR, H2MCmd.word);
+
+		if (Command != 0x80) {
+		}
+	}
+#ifdef PCIE_PS_SUPPORT
+	/* 3090 MCU Wakeup command needs more time to be stable. */
+	/* Before stable, don't issue other MCU command to prevent from firmware error. */
+	if (((IS_RT3090(pAd) || IS_RT3572(pAd) || IS_RT3390(pAd))
+	     && IS_VERSION_AFTER_F(pAd)) && IS_VERSION_AFTER_F(pAd)
+	    && (pAd->StaCfg.PSControl.field.rt30xxPowerMode == 3)
+	    && (pAd->StaCfg.PSControl.field.EnableNewPS == TRUE)
+	    && (Command == WAKE_MCU_CMD)) {
+		RTMPusecDelay(2000);
+		/*Put this is after RF programming. */
+		/*NdisAcquireSpinLock(&pAd->McuCmdLock); */
+		/*pAd->brt30xxBanMcuCmd = FALSE; */
+		/*NdisReleaseSpinLock(&pAd->McuCmdLock); */
+	}
+#endif /* PCIE_PS_SUPPORT // */
+
+	return TRUE;
+}
diff --git a/drivers/staging/rt3090/common/rtmp_timer.c b/drivers/staging/rt2860/common/rtmp_timer.c
index 5253e8768145..42e47d9dc2c9 100644
--- a/drivers/staging/rt3090/common/rtmp_timer.c
+++ b/drivers/staging/rt2860/common/rtmp_timer.c
@@ -40,15 +40,15 @@
 
 #include "../rt_config.h"
 
-
 BUILD_TIMER_FUNCTION(MlmePeriodicExec);
-//BUILD_TIMER_FUNCTION(MlmeRssiReportExec);
+/*BUILD_TIMER_FUNCTION(MlmeRssiReportExec); */
 BUILD_TIMER_FUNCTION(AsicRxAntEvalTimeout);
 BUILD_TIMER_FUNCTION(APSDPeriodicExec);
 BUILD_TIMER_FUNCTION(AsicRfTuningExec);
+#ifdef RTMP_MAC_USB
+BUILD_TIMER_FUNCTION(BeaconUpdateExec);
+#endif /* RTMP_MAC_USB // */
 
-
-#ifdef CONFIG_STA_SUPPORT
 BUILD_TIMER_FUNCTION(BeaconTimeout);
 BUILD_TIMER_FUNCTION(ScanTimeout);
 BUILD_TIMER_FUNCTION(AuthTimeout);
@@ -61,41 +61,31 @@ BUILD_TIMER_FUNCTION(WpaDisassocApAndBlockAssoc);
 #ifdef RTMP_MAC_PCI
 BUILD_TIMER_FUNCTION(PsPollWakeExec);
 BUILD_TIMER_FUNCTION(RadioOnExec);
-#endif // RTMP_MAC_PCI //
-#ifdef QOS_DLS_SUPPORT
-BUILD_TIMER_FUNCTION(DlsTimeoutAction);
-#endif // QOS_DLS_SUPPORT //
-
-
-#endif // CONFIG_STA_SUPPORT //
-
-
+#endif /* RTMP_MAC_PCI // */
+#ifdef RTMP_MAC_USB
+BUILD_TIMER_FUNCTION(RtmpUsbStaAsicForceWakeupTimeout);
+#endif /* RTMP_MAC_USB // */
 
 #if defined(AP_LED) || defined(STA_LED)
-extern void LedCtrlMain(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3);
+extern void LedCtrlMain(void *SystemSpecific1,
+			void *FunctionContext,
+			void *SystemSpecific2, void *SystemSpecific3);
 BUILD_TIMER_FUNCTION(LedCtrlMain);
 #endif
 
-
 #ifdef RTMP_TIMER_TASK_SUPPORT
-static void RtmpTimerQHandle(RTMP_ADAPTER *pAd)
+static void RtmpTimerQHandle(struct rt_rtmp_adapter *pAd)
 {
 #ifndef KTHREAD_SUPPORT
 	int status;
 #endif
-	RALINK_TIMER_STRUCT	*pTimer;
-	RTMP_TIMER_TASK_ENTRY	*pEntry;
-	unsigned long	irqFlag;
-	RTMP_OS_TASK *pTask;
-
+	struct rt_ralink_timer *pTimer;
+	struct rt_rtmp_timer_task_entry *pEntry;
+	unsigned long irqFlag;
+	struct rt_rtmp_os_task *pTask;
 
 	pTask = &pAd->timerTask;
-	while(!pTask->task_killed)
-	{
+	while (!pTask->task_killed) {
 		pTimer = NULL;
 
 #ifdef KTHREAD_SUPPORT
@@ -107,38 +97,39 @@ static void RtmpTimerQHandle(RTMP_ADAPTER *pAd)
 		if (pAd->TimerQ.status == RTMP_TASK_STAT_STOPED)
 			break;
 
-		// event happened.
-		while(pAd->TimerQ.pQHead)
-		{
+		/* event happened. */
+		while (pAd->TimerQ.pQHead) {
 			RTMP_INT_LOCK(&pAd->TimerQLock, irqFlag);
 			pEntry = pAd->TimerQ.pQHead;
-			if (pEntry)
-			{
+			if (pEntry) {
 				pTimer = pEntry->pRaTimer;
 
-				// update pQHead
+				/* update pQHead */
 				pAd->TimerQ.pQHead = pEntry->pNext;
 				if (pEntry == pAd->TimerQ.pQTail)
 					pAd->TimerQ.pQTail = NULL;
 
-				// return this queue entry to timerQFreeList.
+				/* return this queue entry to timerQFreeList. */
 				pEntry->pNext = pAd->TimerQ.pQPollFreeList;
 				pAd->TimerQ.pQPollFreeList = pEntry;
 			}
 			RTMP_INT_UNLOCK(&pAd->TimerQLock, irqFlag);
 
-			if (pTimer)
-			{
-				if ((pTimer->handle != NULL) && (!pAd->PM_FlgSuspend))
-					pTimer->handle(NULL, (PVOID) pTimer->cookie, NULL, pTimer);
-				if ((pTimer->Repeat) && (pTimer->State == FALSE))
-					RTMP_OS_Add_Timer(&pTimer->TimerObj, pTimer->TimerValue);
+			if (pTimer) {
+				if ((pTimer->handle != NULL)
+				    && (!pAd->PM_FlgSuspend))
+					pTimer->handle(NULL,
+						       (void *)pTimer->cookie,
+						       NULL, pTimer);
+				if ((pTimer->Repeat)
+				    && (pTimer->State == FALSE))
+					RTMP_OS_Add_Timer(&pTimer->TimerObj,
+							  pTimer->TimerValue);
 			}
 		}
 
 #ifndef KTHREAD_SUPPORT
-		if (status != 0)
-		{
+		if (status != 0) {
 			pAd->TimerQ.status = RTMP_TASK_STAT_STOPED;
 			RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS);
 			break;
@@ -147,22 +138,19 @@ static void RtmpTimerQHandle(RTMP_ADAPTER *pAd)
 	}
 }
 
-
-INT RtmpTimerQThread(
-	IN OUT PVOID Context)
+int RtmpTimerQThread(IN void *Context)
 {
-	RTMP_OS_TASK	*pTask;
-	PRTMP_ADAPTER	pAd;
+	struct rt_rtmp_os_task *pTask;
+	struct rt_rtmp_adapter *pAd;
 
-
-	pTask = (RTMP_OS_TASK *)Context;
-	pAd = (PRTMP_ADAPTER)pTask->priv;
+	pTask = (struct rt_rtmp_os_task *)Context;
+	pAd = (struct rt_rtmp_adapter *)pTask->priv;
 
 	RtmpOSTaskCustomize(pTask);
 
 	RtmpTimerQHandle(pAd);
 
-	DBGPRINT(RT_DEBUG_TRACE,( "<---%s\n",__FUNCTION__));
+	DBGPRINT(RT_DEBUG_TRACE, ("<---%s\n", __func__));
 #ifndef KTHREAD_SUPPORT
 	pTask->taskPID = THREAD_PID_INIT_VALUE;
 #endif
@@ -186,20 +174,16 @@ INT RtmpTimerQThread(
 
 }
 
-
-RTMP_TIMER_TASK_ENTRY *RtmpTimerQInsert(
-	IN RTMP_ADAPTER *pAd,
-	IN RALINK_TIMER_STRUCT *pTimer)
+struct rt_rtmp_timer_task_entry *RtmpTimerQInsert(struct rt_rtmp_adapter *pAd,
+					struct rt_ralink_timer *pTimer)
 {
-	RTMP_TIMER_TASK_ENTRY *pQNode = NULL, *pQTail;
+	struct rt_rtmp_timer_task_entry *pQNode = NULL, *pQTail;
 	unsigned long irqFlags;
-	RTMP_OS_TASK	*pTask = &pAd->timerTask;
+	struct rt_rtmp_os_task *pTask = &pAd->timerTask;
 
 	RTMP_INT_LOCK(&pAd->TimerQLock, irqFlags);
-	if (pAd->TimerQ.status & RTMP_TASK_CAN_DO_INSERT)
-	{
-		if(pAd->TimerQ.pQPollFreeList)
-		{
+	if (pAd->TimerQ.status & RTMP_TASK_CAN_DO_INSERT) {
+		if (pAd->TimerQ.pQPollFreeList) {
 			pQNode = pAd->TimerQ.pQPollFreeList;
 			pAd->TimerQ.pQPollFreeList = pQNode->pNext;
 
@@ -216,8 +200,7 @@ RTMP_TIMER_TASK_ENTRY *RtmpTimerQInsert(
 	}
 	RTMP_INT_UNLOCK(&pAd->TimerQLock, irqFlags);
 
-	if (pQNode)
-	{
+	if (pQNode) {
 #ifdef KTHREAD_SUPPORT
 		WAKE_UP(pTask);
 #else
@@ -228,29 +211,23 @@ RTMP_TIMER_TASK_ENTRY *RtmpTimerQInsert(
 	return pQNode;
 }
 
-
-BOOLEAN RtmpTimerQRemove(
-	IN RTMP_ADAPTER *pAd,
-	IN RALINK_TIMER_STRUCT *pTimer)
+BOOLEAN RtmpTimerQRemove(struct rt_rtmp_adapter *pAd, struct rt_ralink_timer *pTimer)
 {
-	RTMP_TIMER_TASK_ENTRY *pNode, *pPrev = NULL;
+	struct rt_rtmp_timer_task_entry *pNode, *pPrev = NULL;
 	unsigned long irqFlags;
 
 	RTMP_INT_LOCK(&pAd->TimerQLock, irqFlags);
-	if (pAd->TimerQ.status >= RTMP_TASK_STAT_INITED)
-	{
+	if (pAd->TimerQ.status >= RTMP_TASK_STAT_INITED) {
 		pNode = pAd->TimerQ.pQHead;
-		while (pNode)
-		{
+		while (pNode) {
 			if (pNode->pRaTimer == pTimer)
 				break;
 			pPrev = pNode;
 			pNode = pNode->pNext;
 		}
 
-		// Now move it to freeList queue.
-		if (pNode)
-		{
+		/* Now move it to freeList queue. */
+		if (pNode) {
 			if (pNode == pAd->TimerQ.pQHead)
 				pAd->TimerQ.pQHead = pNode->pNext;
 			if (pNode == pAd->TimerQ.pQTail)
@@ -258,7 +235,7 @@ BOOLEAN RtmpTimerQRemove(
 			if (pPrev != NULL)
 				pPrev->pNext = pNode->pNext;
 
-			// return this queue entry to timerQFreeList.
+			/* return this queue entry to timerQFreeList. */
 			pNode->pNext = pAd->TimerQ.pQPollFreeList;
 			pAd->TimerQ.pQPollFreeList = pNode;
 		}
@@ -268,18 +245,16 @@ BOOLEAN RtmpTimerQRemove(
 	return TRUE;
 }
 
-
-void RtmpTimerQExit(RTMP_ADAPTER *pAd)
+void RtmpTimerQExit(struct rt_rtmp_adapter *pAd)
 {
-	RTMP_TIMER_TASK_ENTRY *pTimerQ;
+	struct rt_rtmp_timer_task_entry *pTimerQ;
 	unsigned long irqFlags;
 
 	RTMP_INT_LOCK(&pAd->TimerQLock, irqFlags);
-	while (pAd->TimerQ.pQHead)
-	{
+	while (pAd->TimerQ.pQHead) {
 		pTimerQ = pAd->TimerQ.pQHead;
 		pAd->TimerQ.pQHead = pTimerQ->pNext;
-		// remove the timeQ
+		/* remove the timeQ */
 	}
 	pAd->TimerQ.pQPollFreeList = NULL;
 	os_free_mem(pAd, pAd->TimerQ.pTimerQPoll);
@@ -292,27 +267,27 @@ void RtmpTimerQExit(RTMP_ADAPTER *pAd)
 
 }
 
-
-void RtmpTimerQInit(RTMP_ADAPTER *pAd)
+void RtmpTimerQInit(struct rt_rtmp_adapter *pAd)
 {
-	int	i;
-	RTMP_TIMER_TASK_ENTRY *pQNode, *pEntry;
+	int i;
+	struct rt_rtmp_timer_task_entry *pQNode, *pEntry;
 	unsigned long irqFlags;
 
 	NdisAllocateSpinLock(&pAd->TimerQLock);
 
 	NdisZeroMemory(&pAd->TimerQ, sizeof(pAd->TimerQ));
 
-	os_alloc_mem(pAd, &pAd->TimerQ.pTimerQPoll, sizeof(RTMP_TIMER_TASK_ENTRY) * TIMER_QUEUE_SIZE_MAX);
-	if (pAd->TimerQ.pTimerQPoll)
-	{
+	os_alloc_mem(pAd, &pAd->TimerQ.pTimerQPoll,
+		     sizeof(struct rt_rtmp_timer_task_entry) * TIMER_QUEUE_SIZE_MAX);
+	if (pAd->TimerQ.pTimerQPoll) {
 		pEntry = NULL;
-		pQNode = (RTMP_TIMER_TASK_ENTRY *)pAd->TimerQ.pTimerQPoll;
-		NdisZeroMemory(pAd->TimerQ.pTimerQPoll, sizeof(RTMP_TIMER_TASK_ENTRY) * TIMER_QUEUE_SIZE_MAX);
+		pQNode = (struct rt_rtmp_timer_task_entry *)pAd->TimerQ.pTimerQPoll;
+		NdisZeroMemory(pAd->TimerQ.pTimerQPoll,
+			       sizeof(struct rt_rtmp_timer_task_entry) *
+			       TIMER_QUEUE_SIZE_MAX);
 
 		RTMP_INT_LOCK(&pAd->TimerQLock, irqFlags);
-		for (i = 0 ;i <TIMER_QUEUE_SIZE_MAX; i++)
-		{
+		for (i = 0; i < TIMER_QUEUE_SIZE_MAX; i++) {
 			pQNode->pNext = pEntry;
 			pEntry = pQNode;
 			pQNode++;
@@ -324,4 +299,4 @@ void RtmpTimerQInit(RTMP_ADAPTER *pAd)
 		RTMP_INT_UNLOCK(&pAd->TimerQLock, irqFlags);
 	}
 }
-#endif // RTMP_TIMER_TASK_SUPPORT //
+#endif /* RTMP_TIMER_TASK_SUPPORT // */
diff --git a/drivers/staging/rt2860/common/rtmp_tkip.c b/drivers/staging/rt2860/common/rtmp_tkip.c
deleted file mode 100644
index 4a7fda69f9b4..000000000000
--- a/drivers/staging/rt2860/common/rtmp_tkip.c
+++ /dev/null
@@ -1,1586 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-	Module Name:
-	rtmp_tkip.c
-
-	Abstract:
-
-	Revision History:
-	Who			When			What
-	--------	----------		----------------------------------------------
-	Paul Wu		02-25-02		Initial
-*/
-
-#include "../rt_config.h"
-
-// Rotation functions on 32 bit values
-#define ROL32( A, n ) \
-	( ((A) << (n)) | ( ((A)>>(32-(n))) & ( (1UL << (n)) - 1 ) ) )
-#define ROR32( A, n ) ROL32( (A), 32-(n) )
-
-UINT Tkip_Sbox_Lower[256] =
-{
-	0xA5,0x84,0x99,0x8D,0x0D,0xBD,0xB1,0x54,
-	0x50,0x03,0xA9,0x7D,0x19,0x62,0xE6,0x9A,
-	0x45,0x9D,0x40,0x87,0x15,0xEB,0xC9,0x0B,
-	0xEC,0x67,0xFD,0xEA,0xBF,0xF7,0x96,0x5B,
-	0xC2,0x1C,0xAE,0x6A,0x5A,0x41,0x02,0x4F,
-	0x5C,0xF4,0x34,0x08,0x93,0x73,0x53,0x3F,
-	0x0C,0x52,0x65,0x5E,0x28,0xA1,0x0F,0xB5,
-	0x09,0x36,0x9B,0x3D,0x26,0x69,0xCD,0x9F,
-	0x1B,0x9E,0x74,0x2E,0x2D,0xB2,0xEE,0xFB,
-	0xF6,0x4D,0x61,0xCE,0x7B,0x3E,0x71,0x97,
-	0xF5,0x68,0x00,0x2C,0x60,0x1F,0xC8,0xED,
-	0xBE,0x46,0xD9,0x4B,0xDE,0xD4,0xE8,0x4A,
-	0x6B,0x2A,0xE5,0x16,0xC5,0xD7,0x55,0x94,
-	0xCF,0x10,0x06,0x81,0xF0,0x44,0xBA,0xE3,
-	0xF3,0xFE,0xC0,0x8A,0xAD,0xBC,0x48,0x04,
-	0xDF,0xC1,0x75,0x63,0x30,0x1A,0x0E,0x6D,
-	0x4C,0x14,0x35,0x2F,0xE1,0xA2,0xCC,0x39,
-	0x57,0xF2,0x82,0x47,0xAC,0xE7,0x2B,0x95,
-	0xA0,0x98,0xD1,0x7F,0x66,0x7E,0xAB,0x83,
-	0xCA,0x29,0xD3,0x3C,0x79,0xE2,0x1D,0x76,
-	0x3B,0x56,0x4E,0x1E,0xDB,0x0A,0x6C,0xE4,
-	0x5D,0x6E,0xEF,0xA6,0xA8,0xA4,0x37,0x8B,
-	0x32,0x43,0x59,0xB7,0x8C,0x64,0xD2,0xE0,
-	0xB4,0xFA,0x07,0x25,0xAF,0x8E,0xE9,0x18,
-	0xD5,0x88,0x6F,0x72,0x24,0xF1,0xC7,0x51,
-	0x23,0x7C,0x9C,0x21,0xDD,0xDC,0x86,0x85,
-	0x90,0x42,0xC4,0xAA,0xD8,0x05,0x01,0x12,
-	0xA3,0x5F,0xF9,0xD0,0x91,0x58,0x27,0xB9,
-	0x38,0x13,0xB3,0x33,0xBB,0x70,0x89,0xA7,
-	0xB6,0x22,0x92,0x20,0x49,0xFF,0x78,0x7A,
-	0x8F,0xF8,0x80,0x17,0xDA,0x31,0xC6,0xB8,
-	0xC3,0xB0,0x77,0x11,0xCB,0xFC,0xD6,0x3A
-};
-
-UINT Tkip_Sbox_Upper[256] =
-{
-	0xC6,0xF8,0xEE,0xF6,0xFF,0xD6,0xDE,0x91,
-	0x60,0x02,0xCE,0x56,0xE7,0xB5,0x4D,0xEC,
-	0x8F,0x1F,0x89,0xFA,0xEF,0xB2,0x8E,0xFB,
-	0x41,0xB3,0x5F,0x45,0x23,0x53,0xE4,0x9B,
-	0x75,0xE1,0x3D,0x4C,0x6C,0x7E,0xF5,0x83,
-	0x68,0x51,0xD1,0xF9,0xE2,0xAB,0x62,0x2A,
-	0x08,0x95,0x46,0x9D,0x30,0x37,0x0A,0x2F,
-	0x0E,0x24,0x1B,0xDF,0xCD,0x4E,0x7F,0xEA,
-	0x12,0x1D,0x58,0x34,0x36,0xDC,0xB4,0x5B,
-	0xA4,0x76,0xB7,0x7D,0x52,0xDD,0x5E,0x13,
-	0xA6,0xB9,0x00,0xC1,0x40,0xE3,0x79,0xB6,
-	0xD4,0x8D,0x67,0x72,0x94,0x98,0xB0,0x85,
-	0xBB,0xC5,0x4F,0xED,0x86,0x9A,0x66,0x11,
-	0x8A,0xE9,0x04,0xFE,0xA0,0x78,0x25,0x4B,
-	0xA2,0x5D,0x80,0x05,0x3F,0x21,0x70,0xF1,
-	0x63,0x77,0xAF,0x42,0x20,0xE5,0xFD,0xBF,
-	0x81,0x18,0x26,0xC3,0xBE,0x35,0x88,0x2E,
-	0x93,0x55,0xFC,0x7A,0xC8,0xBA,0x32,0xE6,
-	0xC0,0x19,0x9E,0xA3,0x44,0x54,0x3B,0x0B,
-	0x8C,0xC7,0x6B,0x28,0xA7,0xBC,0x16,0xAD,
-	0xDB,0x64,0x74,0x14,0x92,0x0C,0x48,0xB8,
-	0x9F,0xBD,0x43,0xC4,0x39,0x31,0xD3,0xF2,
-	0xD5,0x8B,0x6E,0xDA,0x01,0xB1,0x9C,0x49,
-	0xD8,0xAC,0xF3,0xCF,0xCA,0xF4,0x47,0x10,
-	0x6F,0xF0,0x4A,0x5C,0x38,0x57,0x73,0x97,
-	0xCB,0xA1,0xE8,0x3E,0x96,0x61,0x0D,0x0F,
-	0xE0,0x7C,0x71,0xCC,0x90,0x06,0xF7,0x1C,
-	0xC2,0x6A,0xAE,0x69,0x17,0x99,0x3A,0x27,
-	0xD9,0xEB,0x2B,0x22,0xD2,0xA9,0x07,0x33,
-	0x2D,0x3C,0x15,0xC9,0x87,0xAA,0x50,0xA5,
-	0x03,0x59,0x09,0x1A,0x65,0xD7,0x84,0xD0,
-	0x82,0x29,0x5A,0x1E,0x7B,0xA8,0x6D,0x2C
-};
-
-/*****************************/
-/******** SBOX Table *********/
-/*****************************/
-
-UCHAR SboxTable[256] =
-{
-	0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5,
-	0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7, 0xab, 0x76,
-	0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0,
-	0xad, 0xd4, 0xa2, 0xaf, 0x9c, 0xa4, 0x72, 0xc0,
-	0xb7, 0xfd, 0x93, 0x26, 0x36, 0x3f, 0xf7, 0xcc,
-	0x34, 0xa5, 0xe5, 0xf1, 0x71, 0xd8, 0x31, 0x15,
-	0x04, 0xc7, 0x23, 0xc3, 0x18, 0x96, 0x05, 0x9a,
-	0x07, 0x12, 0x80, 0xe2, 0xeb, 0x27, 0xb2, 0x75,
-	0x09, 0x83, 0x2c, 0x1a, 0x1b, 0x6e, 0x5a, 0xa0,
-	0x52, 0x3b, 0xd6, 0xb3, 0x29, 0xe3, 0x2f, 0x84,
-	0x53, 0xd1, 0x00, 0xed, 0x20, 0xfc, 0xb1, 0x5b,
-	0x6a, 0xcb, 0xbe, 0x39, 0x4a, 0x4c, 0x58, 0xcf,
-	0xd0, 0xef, 0xaa, 0xfb, 0x43, 0x4d, 0x33, 0x85,
-	0x45, 0xf9, 0x02, 0x7f, 0x50, 0x3c, 0x9f, 0xa8,
-	0x51, 0xa3, 0x40, 0x8f, 0x92, 0x9d, 0x38, 0xf5,
-	0xbc, 0xb6, 0xda, 0x21, 0x10, 0xff, 0xf3, 0xd2,
-	0xcd, 0x0c, 0x13, 0xec, 0x5f, 0x97, 0x44, 0x17,
-	0xc4, 0xa7, 0x7e, 0x3d, 0x64, 0x5d, 0x19, 0x73,
-	0x60, 0x81, 0x4f, 0xdc, 0x22, 0x2a, 0x90, 0x88,
-	0x46, 0xee, 0xb8, 0x14, 0xde, 0x5e, 0x0b, 0xdb,
-	0xe0, 0x32, 0x3a, 0x0a, 0x49, 0x06, 0x24, 0x5c,
-	0xc2, 0xd3, 0xac, 0x62, 0x91, 0x95, 0xe4, 0x79,
-	0xe7, 0xc8, 0x37, 0x6d, 0x8d, 0xd5, 0x4e, 0xa9,
-	0x6c, 0x56, 0xf4, 0xea, 0x65, 0x7a, 0xae, 0x08,
-	0xba, 0x78, 0x25, 0x2e, 0x1c, 0xa6, 0xb4, 0xc6,
-	0xe8, 0xdd, 0x74, 0x1f, 0x4b, 0xbd, 0x8b, 0x8a,
-	0x70, 0x3e, 0xb5, 0x66, 0x48, 0x03, 0xf6, 0x0e,
-	0x61, 0x35, 0x57, 0xb9, 0x86, 0xc1, 0x1d, 0x9e,
-	0xe1, 0xf8, 0x98, 0x11, 0x69, 0xd9, 0x8e, 0x94,
-	0x9b, 0x1e, 0x87, 0xe9, 0xce, 0x55, 0x28, 0xdf,
-	0x8c, 0xa1, 0x89, 0x0d, 0xbf, 0xe6, 0x42, 0x68,
-	0x41, 0x99, 0x2d, 0x0f, 0xb0, 0x54, 0xbb, 0x16
-};
-
-VOID xor_32(
-	IN  PUCHAR              a,
-	IN  PUCHAR              b,
-	OUT PUCHAR              out);
-
-VOID xor_128(
-	IN  PUCHAR              a,
-	IN  PUCHAR              b,
-	OUT PUCHAR              out);
-
-VOID next_key(
-	IN  PUCHAR              key,
-	IN  INT                 round);
-
-VOID byte_sub(
-	IN  PUCHAR              in,
-	OUT PUCHAR              out);
-
-VOID shift_row(
-	IN  PUCHAR              in,
-	OUT PUCHAR              out);
-
-VOID mix_column(
-	IN  PUCHAR              in,
-	OUT PUCHAR              out);
-
-UCHAR RTMPCkipSbox(
-	IN  UCHAR               a);
-//
-// Expanded IV for TKIP function.
-//
-typedef	struct	PACKED _IV_CONTROL_
-{
-	union PACKED
-	{
-		struct PACKED
-		{
-			UCHAR		rc0;
-			UCHAR		rc1;
-			UCHAR		rc2;
-
-			union PACKED
-			{
-				struct PACKED
-				{
-					UCHAR	Rsvd:5;
-					UCHAR	ExtIV:1;
-					UCHAR	KeyID:2;
-				}	field;
-				UCHAR		Byte;
-			}	CONTROL;
-		}	field;
-
-		ULONG	word;
-	}	IV16;
-
-	ULONG	IV32;
-}	TKIP_IV, *PTKIP_IV;
-
-
-/*
-	========================================================================
-
-	Routine	Description:
-		Convert from UCHAR[] to ULONG in a portable way
-
-	Arguments:
-      pMICKey		pointer to MIC Key
-
-	Return Value:
-		None
-
-	Note:
-
-	========================================================================
-*/
-ULONG	RTMPTkipGetUInt32(
-	IN	PUCHAR	pMICKey)
-{
-	ULONG	res = 0;
-	INT		i;
-
-	for (i = 0; i < 4; i++)
-	{
-		res |= (*pMICKey++) << (8 * i);
-	}
-
-	return res;
-}
-
-/*
-	========================================================================
-
-	Routine	Description:
-		Convert from ULONG to UCHAR[] in a portable way
-
-	Arguments:
-      pDst			pointer to destination for convert ULONG to UCHAR[]
-      val			the value for convert
-
-	Return Value:
-		None
-
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-VOID	RTMPTkipPutUInt32(
-	IN OUT	PUCHAR		pDst,
-	IN		ULONG		val)
-{
-	INT i;
-
-	for(i = 0; i < 4; i++)
-	{
-		*pDst++ = (UCHAR) (val & 0xff);
-		val >>= 8;
-	}
-}
-
-/*
-	========================================================================
-
-	Routine	Description:
-		Set the MIC Key.
-
-	Arguments:
-      pAd		Pointer to our adapter
-      pMICKey		pointer to MIC Key
-
-	Return Value:
-		None
-
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-VOID RTMPTkipSetMICKey(
-	IN	PTKIP_KEY_INFO	pTkip,
-	IN	PUCHAR			pMICKey)
-{
-	// Set the key
-	pTkip->K0 = RTMPTkipGetUInt32(pMICKey);
-	pTkip->K1 = RTMPTkipGetUInt32(pMICKey + 4);
-	// and reset the message
-	pTkip->L = pTkip->K0;
-	pTkip->R = pTkip->K1;
-	pTkip->nBytesInM = 0;
-	pTkip->M = 0;
-}
-
-/*
-	========================================================================
-
-	Routine	Description:
-		Calculate the MIC Value.
-
-	Arguments:
-      pAd		Pointer to our adapter
-      uChar			Append this uChar
-
-	Return Value:
-		None
-
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-VOID	RTMPTkipAppendByte(
-	IN	PTKIP_KEY_INFO	pTkip,
-	IN	UCHAR 			uChar)
-{
-	// Append the byte to our word-sized buffer
-	pTkip->M |= (uChar << (8* pTkip->nBytesInM));
-	pTkip->nBytesInM++;
-	// Process the word if it is full.
-	if( pTkip->nBytesInM >= 4 )
-	{
-		pTkip->L ^= pTkip->M;
-		pTkip->R ^= ROL32( pTkip->L, 17 );
-		pTkip->L += pTkip->R;
-		pTkip->R ^= ((pTkip->L & 0xff00ff00) >> 8) | ((pTkip->L & 0x00ff00ff) << 8);
-		pTkip->L += pTkip->R;
-		pTkip->R ^= ROL32( pTkip->L, 3 );
-		pTkip->L += pTkip->R;
-		pTkip->R ^= ROR32( pTkip->L, 2 );
-		pTkip->L += pTkip->R;
-		// Clear the buffer
-		pTkip->M = 0;
-		pTkip->nBytesInM = 0;
-	}
-}
-
-/*
-	========================================================================
-
-	Routine	Description:
-		Calculate the MIC Value.
-
-	Arguments:
-      pAd		Pointer to our adapter
-      pSrc			Pointer to source data for Calculate MIC Value
-      Len			Indicate the length of the source data
-
-	Return Value:
-		None
-
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-VOID	RTMPTkipAppend(
-	IN	PTKIP_KEY_INFO	pTkip,
-	IN	PUCHAR			pSrc,
-	IN	UINT			nBytes)
-{
-	// This is simple
-	while(nBytes > 0)
-	{
-		RTMPTkipAppendByte(pTkip, *pSrc++);
-		nBytes--;
-	}
-}
-
-/*
-	========================================================================
-
-	Routine	Description:
-		Get the MIC Value.
-
-	Arguments:
-      pAd		Pointer to our adapter
-
-	Return Value:
-		None
-
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-		the MIC Value is store in pAd->PrivateInfo.MIC
-	========================================================================
-*/
-VOID	RTMPTkipGetMIC(
-	IN	PTKIP_KEY_INFO	pTkip)
-{
-	// Append the minimum padding
-	RTMPTkipAppendByte(pTkip, 0x5a );
-	RTMPTkipAppendByte(pTkip, 0 );
-	RTMPTkipAppendByte(pTkip, 0 );
-	RTMPTkipAppendByte(pTkip, 0 );
-	RTMPTkipAppendByte(pTkip, 0 );
-	// and then zeroes until the length is a multiple of 4
-	while( pTkip->nBytesInM != 0 )
-	{
-		RTMPTkipAppendByte(pTkip, 0 );
-	}
-	// The appendByte function has already computed the result.
-	RTMPTkipPutUInt32(pTkip->MIC, pTkip->L);
-	RTMPTkipPutUInt32(pTkip->MIC + 4, pTkip->R);
-}
-
-/*
-	========================================================================
-
-	Routine	Description:
-		Init Tkip function.
-
-	Arguments:
-      pAd		Pointer to our adapter
-		pTKey       Pointer to the Temporal Key (TK), TK shall be 128bits.
-		KeyId		TK Key ID
-		pTA			Pointer to transmitter address
-		pMICKey		pointer to MIC Key
-
-	Return Value:
-		None
-
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-VOID	RTMPInitTkipEngine(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			pKey,
-	IN	UCHAR			KeyId,
-	IN	PUCHAR			pTA,
-	IN	PUCHAR			pMICKey,
-	IN	PUCHAR			pTSC,
-	OUT	PULONG			pIV16,
-	OUT	PULONG			pIV32)
-{
-	TKIP_IV	tkipIv;
-
-	// Prepare 8 bytes TKIP encapsulation for MPDU
-	NdisZeroMemory(&tkipIv, sizeof(TKIP_IV));
-	tkipIv.IV16.field.rc0 = *(pTSC + 1);
-	tkipIv.IV16.field.rc1 = (tkipIv.IV16.field.rc0 | 0x20) & 0x7f;
-	tkipIv.IV16.field.rc2 = *pTSC;
-	tkipIv.IV16.field.CONTROL.field.ExtIV = 1;  // 0: non-extended IV, 1: an extended IV
-	tkipIv.IV16.field.CONTROL.field.KeyID = KeyId;
-	NdisMoveMemory(&tkipIv.IV32, (pTSC + 2), 4);   // Copy IV
-
-	*pIV16 = tkipIv.IV16.word;
-	*pIV32 = tkipIv.IV32;
-}
-
-/*
-	========================================================================
-
-	Routine	Description:
-		Init MIC Value calculation function which include set MIC key &
-		calculate first 16 bytes (DA + SA + priority +  0)
-
-	Arguments:
-      pAd		Pointer to our adapter
-		pTKey       Pointer to the Temporal Key (TK), TK shall be 128bits.
-		pDA			Pointer to DA address
-		pSA			Pointer to SA address
-		pMICKey		pointer to MIC Key
-
-	Return Value:
-		None
-
-	Note:
-
-	========================================================================
-*/
-VOID	RTMPInitMICEngine(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			pKey,
-	IN	PUCHAR			pDA,
-	IN	PUCHAR			pSA,
-	IN  UCHAR           UserPriority,
-	IN	PUCHAR			pMICKey)
-{
-	ULONG Priority = UserPriority;
-
-	// Init MIC value calculation
-	RTMPTkipSetMICKey(&pAd->PrivateInfo.Tx, pMICKey);
-	// DA
-	RTMPTkipAppend(&pAd->PrivateInfo.Tx, pDA, MAC_ADDR_LEN);
-	// SA
-	RTMPTkipAppend(&pAd->PrivateInfo.Tx, pSA, MAC_ADDR_LEN);
-	// Priority + 3 bytes of 0
-	RTMPTkipAppend(&pAd->PrivateInfo.Tx, (PUCHAR)&Priority, 4);
-}
-
-/*
-	========================================================================
-
-	Routine	Description:
-		Compare MIC value of received MSDU
-
-	Arguments:
-		pAd	Pointer to our adapter
-		pSrc        Pointer to the received Plain text data
-		pDA			Pointer to DA address
-		pSA			Pointer to SA address
-		pMICKey		pointer to MIC Key
-		Len         the length of the received plain text data exclude MIC value
-
-	Return Value:
-		TRUE        MIC value matched
-		FALSE       MIC value mismatched
-
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-BOOLEAN	RTMPTkipCompareMICValue(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			pSrc,
-	IN	PUCHAR			pDA,
-	IN	PUCHAR			pSA,
-	IN	PUCHAR			pMICKey,
-	IN	UCHAR			UserPriority,
-	IN	UINT			Len)
-{
-	UCHAR	OldMic[8];
-	ULONG	Priority = UserPriority;
-
-	// Init MIC value calculation
-	RTMPTkipSetMICKey(&pAd->PrivateInfo.Rx, pMICKey);
-	// DA
-	RTMPTkipAppend(&pAd->PrivateInfo.Rx, pDA, MAC_ADDR_LEN);
-	// SA
-	RTMPTkipAppend(&pAd->PrivateInfo.Rx, pSA, MAC_ADDR_LEN);
-	// Priority + 3 bytes of 0
-	RTMPTkipAppend(&pAd->PrivateInfo.Rx, (PUCHAR)&Priority, 4);
-
-	// Calculate MIC value from plain text data
-	RTMPTkipAppend(&pAd->PrivateInfo.Rx, pSrc, Len);
-
-	// Get MIC valude from received frame
-	NdisMoveMemory(OldMic, pSrc + Len, 8);
-
-	// Get MIC value from decrypted plain data
-	RTMPTkipGetMIC(&pAd->PrivateInfo.Rx);
-
-	// Move MIC value from MSDU, this steps should move to data path.
-	// Since the MIC value might cross MPDUs.
-	if(!NdisEqualMemory(pAd->PrivateInfo.Rx.MIC, OldMic, 8))
-	{
-		DBGPRINT_RAW(RT_DEBUG_ERROR, ("RTMPTkipCompareMICValue(): TKIP MIC Error !\n"));  //MIC error.
-
-
-		return (FALSE);
-	}
-	return (TRUE);
-}
-
-/*
-	========================================================================
-
-	Routine	Description:
-		Compare MIC value of received MSDU
-
-	Arguments:
-		pAd	Pointer to our adapter
-		pLLC		LLC header
-		pSrc        Pointer to the received Plain text data
-		pDA			Pointer to DA address
-		pSA			Pointer to SA address
-		pMICKey		pointer to MIC Key
-		Len         the length of the received plain text data exclude MIC value
-
-	Return Value:
-		TRUE        MIC value matched
-		FALSE       MIC value mismatched
-
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-BOOLEAN	RTMPTkipCompareMICValueWithLLC(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			pLLC,
-	IN	PUCHAR			pSrc,
-	IN	PUCHAR			pDA,
-	IN	PUCHAR			pSA,
-	IN	PUCHAR			pMICKey,
-	IN	UINT			Len)
-{
-	UCHAR	OldMic[8];
-	ULONG	Priority = 0;
-
-	// Init MIC value calculation
-	RTMPTkipSetMICKey(&pAd->PrivateInfo.Rx, pMICKey);
-	// DA
-	RTMPTkipAppend(&pAd->PrivateInfo.Rx, pDA, MAC_ADDR_LEN);
-	// SA
-	RTMPTkipAppend(&pAd->PrivateInfo.Rx, pSA, MAC_ADDR_LEN);
-	// Priority + 3 bytes of 0
-	RTMPTkipAppend(&pAd->PrivateInfo.Rx, (PUCHAR)&Priority, 4);
-
-	// Start with LLC header
-	RTMPTkipAppend(&pAd->PrivateInfo.Rx, pLLC, 8);
-
-	// Calculate MIC value from plain text data
-	RTMPTkipAppend(&pAd->PrivateInfo.Rx, pSrc, Len);
-
-	// Get MIC valude from received frame
-	NdisMoveMemory(OldMic, pSrc + Len, 8);
-
-	// Get MIC value from decrypted plain data
-	RTMPTkipGetMIC(&pAd->PrivateInfo.Rx);
-
-	// Move MIC value from MSDU, this steps should move to data path.
-	// Since the MIC value might cross MPDUs.
-	if(!NdisEqualMemory(pAd->PrivateInfo.Rx.MIC, OldMic, 8))
-	{
-		DBGPRINT_RAW(RT_DEBUG_ERROR, ("RTMPTkipCompareMICValueWithLLC(): TKIP MIC Error !\n"));  //MIC error.
-
-
-		return (FALSE);
-	}
-	return (TRUE);
-}
-/*
-	========================================================================
-
-	Routine	Description:
-		Copy frame from waiting queue into relative ring buffer and set
-	appropriate ASIC register to kick hardware transmit function
-
-	Arguments:
-		pAd		Pointer	to our adapter
-		PNDIS_PACKET	Pointer to Ndis Packet for MIC calculation
-		pEncap			Pointer to LLC encap data
-		LenEncap		Total encap length, might be 0 which indicates no encap
-
-	Return Value:
-		None
-
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-VOID	RTMPCalculateMICValue(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PNDIS_PACKET	pPacket,
-	IN	PUCHAR			pEncap,
-	IN	PCIPHER_KEY		pKey,
-	IN	UCHAR			apidx)
-{
-	PACKET_INFO		PacketInfo;
-	PUCHAR			pSrcBufVA;
-	UINT			SrcBufLen;
-	PUCHAR			pSrc;
-    UCHAR           UserPriority;
-	UCHAR			vlan_offset = 0;
-
-	RTMP_QueryPacketInfo(pPacket, &PacketInfo, &pSrcBufVA, &SrcBufLen);
-
-	UserPriority = RTMP_GET_PACKET_UP(pPacket);
-	pSrc = pSrcBufVA;
-
-	// determine if this is a vlan packet
-	if (((*(pSrc + 12) << 8) + *(pSrc + 13)) == 0x8100)
-		vlan_offset = 4;
-
-	{
-		RTMPInitMICEngine(
-			pAd,
-			pKey->Key,
-			pSrc,
-			pSrc + 6,
-			UserPriority,
-			pKey->TxMic);
-	}
-
-
-	if (pEncap != NULL)
-	{
-		// LLC encapsulation
-		RTMPTkipAppend(&pAd->PrivateInfo.Tx, pEncap, 6);
-		// Protocol Type
-		RTMPTkipAppend(&pAd->PrivateInfo.Tx, pSrc + 12 + vlan_offset, 2);
-	}
-	SrcBufLen -= (14 + vlan_offset);
-	pSrc += (14 + vlan_offset);
-	do
-	{
-		if (SrcBufLen > 0)
-		{
-			RTMPTkipAppend(&pAd->PrivateInfo.Tx, pSrc, SrcBufLen);
-		}
-
-		break;	// No need handle next packet
-
-	}	while (TRUE);		// End of copying payload
-
-	// Compute the final MIC Value
-	RTMPTkipGetMIC(&pAd->PrivateInfo.Tx);
-}
-
-
-/************************************************************/
-/* tkip_sbox()																*/
-/* Returns a 16 bit value from a 64K entry table. The Table */
-/* is synthesized from two 256 entry byte wide tables.		*/
-/************************************************************/
-
-UINT tkip_sbox(UINT index)
-{
-	UINT index_low;
-	UINT index_high;
-	UINT left, right;
-
-	index_low = (index % 256);
-	index_high = ((index >> 8) % 256);
-
-	left = Tkip_Sbox_Lower[index_low] + (Tkip_Sbox_Upper[index_low] * 256);
-	right = Tkip_Sbox_Upper[index_high] + (Tkip_Sbox_Lower[index_high] * 256);
-
-	return (left ^ right);
-}
-
-UINT rotr1(UINT a)
-{
-	unsigned int b;
-
-	if ((a & 0x01) == 0x01)
-	{
-		b = (a >> 1) | 0x8000;
-	}
-	else
-	{
-		b = (a >> 1) & 0x7fff;
-	}
-	b = b % 65536;
-	return b;
-}
-
-VOID RTMPTkipMixKey(
-	UCHAR *key,
-	UCHAR *ta,
-	ULONG pnl, /* Least significant 16 bits of PN */
-	ULONG pnh, /* Most significant 32 bits of PN */
-	UCHAR *rc4key,
-	UINT *p1k)
-{
-
-	UINT tsc0;
-	UINT tsc1;
-	UINT tsc2;
-
-	UINT ppk0;
-	UINT ppk1;
-	UINT ppk2;
-	UINT ppk3;
-	UINT ppk4;
-	UINT ppk5;
-
-	INT i;
-	INT j;
-
-	tsc0 = (unsigned int)((pnh >> 16) % 65536); /* msb */
-	tsc1 = (unsigned int)(pnh % 65536);
-	tsc2 = (unsigned int)(pnl % 65536); /* lsb */
-
-	/* Phase 1, step 1 */
-	p1k[0] = tsc1;
-	p1k[1] = tsc0;
-	p1k[2] = (UINT)(ta[0] + (ta[1]*256));
-	p1k[3] = (UINT)(ta[2] + (ta[3]*256));
-	p1k[4] = (UINT)(ta[4] + (ta[5]*256));
-
-	/* Phase 1, step 2 */
-	for (i=0; i<8; i++)
-	{
-		j = 2*(i & 1);
-		p1k[0] = (p1k[0] + tkip_sbox( (p1k[4] ^ ((256*key[1+j]) + key[j])) % 65536 )) % 65536;
-		p1k[1] = (p1k[1] + tkip_sbox( (p1k[0] ^ ((256*key[5+j]) + key[4+j])) % 65536 )) % 65536;
-		p1k[2] = (p1k[2] + tkip_sbox( (p1k[1] ^ ((256*key[9+j]) + key[8+j])) % 65536 )) % 65536;
-		p1k[3] = (p1k[3] + tkip_sbox( (p1k[2] ^ ((256*key[13+j]) + key[12+j])) % 65536 )) % 65536;
-		p1k[4] = (p1k[4] + tkip_sbox( (p1k[3] ^ (((256*key[1+j]) + key[j]))) % 65536 )) % 65536;
-		p1k[4] = (p1k[4] + i) % 65536;
-	}
-
-	/* Phase 2, Step 1 */
-	ppk0 = p1k[0];
-	ppk1 = p1k[1];
-	ppk2 = p1k[2];
-	ppk3 = p1k[3];
-	ppk4 = p1k[4];
-	ppk5 = (p1k[4] + tsc2) % 65536;
-
-	/* Phase2, Step 2 */
-	ppk0 = ppk0 + tkip_sbox( (ppk5 ^ ((256*key[1]) + key[0])) % 65536);
-	ppk1 = ppk1 + tkip_sbox( (ppk0 ^ ((256*key[3]) + key[2])) % 65536);
-	ppk2 = ppk2 + tkip_sbox( (ppk1 ^ ((256*key[5]) + key[4])) % 65536);
-	ppk3 = ppk3 + tkip_sbox( (ppk2 ^ ((256*key[7]) + key[6])) % 65536);
-	ppk4 = ppk4 + tkip_sbox( (ppk3 ^ ((256*key[9]) + key[8])) % 65536);
-	ppk5 = ppk5 + tkip_sbox( (ppk4 ^ ((256*key[11]) + key[10])) % 65536);
-
-	ppk0 = ppk0 + rotr1(ppk5 ^ ((256*key[13]) + key[12]));
-	ppk1 = ppk1 + rotr1(ppk0 ^ ((256*key[15]) + key[14]));
-	ppk2 = ppk2 + rotr1(ppk1);
-	ppk3 = ppk3 + rotr1(ppk2);
-	ppk4 = ppk4 + rotr1(ppk3);
-	ppk5 = ppk5 + rotr1(ppk4);
-
-	/* Phase 2, Step 3 */
-    /* Phase 2, Step 3 */
-
-	tsc0 = (unsigned int)((pnh >> 16) % 65536); /* msb */
-	tsc1 = (unsigned int)(pnh % 65536);
-	tsc2 = (unsigned int)(pnl % 65536); /* lsb */
-
-	rc4key[0] = (tsc2 >> 8) % 256;
-	rc4key[1] = (((tsc2 >> 8) % 256) | 0x20) & 0x7f;
-	rc4key[2] = tsc2 % 256;
-	rc4key[3] = ((ppk5 ^ ((256*key[1]) + key[0])) >> 1) % 256;
-
-	rc4key[4] = ppk0 % 256;
-	rc4key[5] = (ppk0 >> 8) % 256;
-
-	rc4key[6] = ppk1 % 256;
-	rc4key[7] = (ppk1 >> 8) % 256;
-
-	rc4key[8] = ppk2 % 256;
-	rc4key[9] = (ppk2 >> 8) % 256;
-
-	rc4key[10] = ppk3 % 256;
-	rc4key[11] = (ppk3 >> 8) % 256;
-
-	rc4key[12] = ppk4 % 256;
-	rc4key[13] = (ppk4 >> 8) % 256;
-
-	rc4key[14] = ppk5 % 256;
-	rc4key[15] = (ppk5 >> 8) % 256;
-}
-
-
-/************************************************/
-/* construct_mic_header1()                      */
-/* Builds the first MIC header block from       */
-/* header fields.                               */
-/************************************************/
-
-void construct_mic_header1(
-	unsigned char *mic_header1,
-	int header_length,
-	unsigned char *mpdu)
-{
-	mic_header1[0] = (unsigned char)((header_length - 2) / 256);
-	mic_header1[1] = (unsigned char)((header_length - 2) % 256);
-	mic_header1[2] = mpdu[0] & 0xcf;    /* Mute CF poll & CF ack bits */
-	mic_header1[3] = mpdu[1] & 0xc7;    /* Mute retry, more data and pwr mgt bits */
-	mic_header1[4] = mpdu[4];       /* A1 */
-	mic_header1[5] = mpdu[5];
-	mic_header1[6] = mpdu[6];
-	mic_header1[7] = mpdu[7];
-	mic_header1[8] = mpdu[8];
-	mic_header1[9] = mpdu[9];
-	mic_header1[10] = mpdu[10];     /* A2 */
-	mic_header1[11] = mpdu[11];
-	mic_header1[12] = mpdu[12];
-	mic_header1[13] = mpdu[13];
-	mic_header1[14] = mpdu[14];
-	mic_header1[15] = mpdu[15];
-}
-
-/************************************************/
-/* construct_mic_header2()                      */
-/* Builds the last MIC header block from        */
-/* header fields.                               */
-/************************************************/
-
-void construct_mic_header2(
-	unsigned char *mic_header2,
-	unsigned char *mpdu,
-	int a4_exists,
-	int qc_exists)
-{
-	int i;
-
-	for (i = 0; i<16; i++) mic_header2[i]=0x00;
-
-	mic_header2[0] = mpdu[16];    /* A3 */
-	mic_header2[1] = mpdu[17];
-	mic_header2[2] = mpdu[18];
-	mic_header2[3] = mpdu[19];
-	mic_header2[4] = mpdu[20];
-	mic_header2[5] = mpdu[21];
-
-	// In Sequence Control field, mute sequence numer bits (12-bit)
-	mic_header2[6] = mpdu[22] & 0x0f;   /* SC */
-	mic_header2[7] = 0x00; /* mpdu[23]; */
-
-	if ((!qc_exists) & a4_exists)
-	{
-		for (i=0;i<6;i++) mic_header2[8+i] = mpdu[24+i];   /* A4 */
-
-	}
-
-	if (qc_exists && (!a4_exists))
-	{
-		mic_header2[8] = mpdu[24] & 0x0f; /* mute bits 15 - 4 */
-		mic_header2[9] = mpdu[25] & 0x00;
-	}
-
-	if (qc_exists && a4_exists)
-	{
-		for (i=0;i<6;i++) mic_header2[8+i] = mpdu[24+i];   /* A4 */
-
-		mic_header2[14] = mpdu[30] & 0x0f;
-		mic_header2[15] = mpdu[31] & 0x00;
-	}
-}
-
-
-/************************************************/
-/* construct_mic_iv()                           */
-/* Builds the MIC IV from header fields and PN  */
-/************************************************/
-
-void construct_mic_iv(
-	unsigned char *mic_iv,
-	int qc_exists,
-	int a4_exists,
-	unsigned char *mpdu,
-	unsigned int payload_length,
-	unsigned char *pn_vector)
-{
-	int i;
-
-	mic_iv[0] = 0x59;
-	if (qc_exists && a4_exists)
-		mic_iv[1] = mpdu[30] & 0x0f;    /* QoS_TC           */
-	if (qc_exists && !a4_exists)
-		mic_iv[1] = mpdu[24] & 0x0f;   /* mute bits 7-4    */
-	if (!qc_exists)
-		mic_iv[1] = 0x00;
-	for (i = 2; i < 8; i++)
-		mic_iv[i] = mpdu[i + 8];                    /* mic_iv[2:7] = A2[0:5] = mpdu[10:15] */
-#ifdef CONSISTENT_PN_ORDER
-		for (i = 8; i < 14; i++)
-			mic_iv[i] = pn_vector[i - 8];           /* mic_iv[8:13] = PN[0:5] */
-#else
-		for (i = 8; i < 14; i++)
-			mic_iv[i] = pn_vector[13 - i];          /* mic_iv[8:13] = PN[5:0] */
-#endif
-	i = (payload_length / 256);
-	i = (payload_length % 256);
-	mic_iv[14] = (unsigned char) (payload_length / 256);
-	mic_iv[15] = (unsigned char) (payload_length % 256);
-
-}
-
-
-
-/************************************/
-/* bitwise_xor()                    */
-/* A 128 bit, bitwise exclusive or  */
-/************************************/
-
-void bitwise_xor(unsigned char *ina, unsigned char *inb, unsigned char *out)
-{
-	int i;
-	for (i=0; i<16; i++)
-	{
-		out[i] = ina[i] ^ inb[i];
-	}
-}
-
-
-void aes128k128d(unsigned char *key, unsigned char *data, unsigned char *ciphertext)
-{
-	int round;
-	int i;
-	unsigned char intermediatea[16];
-	unsigned char intermediateb[16];
-	unsigned char round_key[16];
-
-	for(i=0; i<16; i++) round_key[i] = key[i];
-
-	for (round = 0; round < 11; round++)
-	{
-		if (round == 0)
-		{
-			xor_128(round_key, data, ciphertext);
-			next_key(round_key, round);
-		}
-		else if (round == 10)
-		{
-			byte_sub(ciphertext, intermediatea);
-			shift_row(intermediatea, intermediateb);
-			xor_128(intermediateb, round_key, ciphertext);
-		}
-		else    /* 1 - 9 */
-		{
-			byte_sub(ciphertext, intermediatea);
-			shift_row(intermediatea, intermediateb);
-			mix_column(&intermediateb[0], &intermediatea[0]);
-			mix_column(&intermediateb[4], &intermediatea[4]);
-			mix_column(&intermediateb[8], &intermediatea[8]);
-			mix_column(&intermediateb[12], &intermediatea[12]);
-			xor_128(intermediatea, round_key, ciphertext);
-			next_key(round_key, round);
-		}
-	}
-
-}
-
-void construct_ctr_preload(
-	unsigned char *ctr_preload,
-	int a4_exists,
-	int qc_exists,
-	unsigned char *mpdu,
-	unsigned char *pn_vector,
-	int c)
-{
-
-	int i = 0;
-	for (i=0; i<16; i++) ctr_preload[i] = 0x00;
-	i = 0;
-
-	ctr_preload[0] = 0x01;                                  /* flag */
-	if (qc_exists && a4_exists) ctr_preload[1] = mpdu[30] & 0x0f;   /* QoC_Control  */
-	if (qc_exists && !a4_exists) ctr_preload[1] = mpdu[24] & 0x0f;
-
-	for (i = 2; i < 8; i++)
-		ctr_preload[i] = mpdu[i + 8];                       /* ctr_preload[2:7] = A2[0:5] = mpdu[10:15] */
-#ifdef CONSISTENT_PN_ORDER
-	  for (i = 8; i < 14; i++)
-			ctr_preload[i] =    pn_vector[i - 8];           /* ctr_preload[8:13] = PN[0:5] */
-#else
-	  for (i = 8; i < 14; i++)
-			ctr_preload[i] =    pn_vector[13 - i];          /* ctr_preload[8:13] = PN[5:0] */
-#endif
-	ctr_preload[14] =  (unsigned char) (c / 256); // Ctr
-	ctr_preload[15] =  (unsigned char) (c % 256);
-
-}
-
-
-//
-// TRUE: Success!
-// FALSE: Decrypt Error!
-//
-BOOLEAN RTMPSoftDecryptTKIP(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR	pData,
-	IN ULONG	DataByteCnt,
-	IN UCHAR    UserPriority,
-	IN PCIPHER_KEY	pWpaKey)
-{
-	UCHAR			KeyID;
-	UINT			HeaderLen;
-    UCHAR			fc0;
-	UCHAR			fc1;
-	USHORT			fc;
-	UINT			frame_type;
-	UINT			frame_subtype;
-    UINT			from_ds;
-    UINT			to_ds;
-	INT				a4_exists;
-	INT				qc_exists;
-	USHORT			duration;
-	USHORT			seq_control;
-	USHORT			qos_control;
-	UCHAR			TA[MAC_ADDR_LEN];
-	UCHAR			DA[MAC_ADDR_LEN];
-	UCHAR			SA[MAC_ADDR_LEN];
-	UCHAR			RC4Key[16];
-	UINT			p1k[5]; //for mix_key;
-	ULONG			pnl;/* Least significant 16 bits of PN */
-	ULONG			pnh;/* Most significant 32 bits of PN */
-	UINT			num_blocks;
-	UINT			payload_remainder;
-	ARCFOURCONTEXT 	ArcFourContext;
-	UINT			crc32 = 0;
-	UINT			trailfcs = 0;
-	UCHAR			MIC[8];
-	UCHAR			TrailMIC[8];
-
-	fc0 = *pData;
-	fc1 = *(pData + 1);
-
-	fc = *((PUSHORT)pData);
-
-	frame_type = ((fc0 >> 2) & 0x03);
-	frame_subtype = ((fc0 >> 4) & 0x0f);
-
-    from_ds = (fc1 & 0x2) >> 1;
-    to_ds = (fc1 & 0x1);
-
-    a4_exists = (from_ds & to_ds);
-    qc_exists = ((frame_subtype == 0x08) ||    /* Assumed QoS subtypes */
-                  (frame_subtype == 0x09) ||   /* Likely to change.    */
-                  (frame_subtype == 0x0a) ||
-                  (frame_subtype == 0x0b)
-                 );
-
-	HeaderLen = 24;
-	if (a4_exists)
-		HeaderLen += 6;
-
-	KeyID = *((PUCHAR)(pData+ HeaderLen + 3));
-	KeyID = KeyID >> 6;
-
-	if (pWpaKey[KeyID].KeyLen == 0)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("RTMPSoftDecryptTKIP failed!(KeyID[%d] Length can not be 0)\n", KeyID));
-		return FALSE;
-	}
-
-	duration = *((PUSHORT)(pData+2));
-
-	seq_control = *((PUSHORT)(pData+22));
-
-	if (qc_exists)
-	{
-		if (a4_exists)
-		{
-			qos_control = *((PUSHORT)(pData+30));
-		}
-		else
-		{
-			qos_control = *((PUSHORT)(pData+24));
-		}
-	}
-
-	if (to_ds == 0 && from_ds == 1)
-	{
-		NdisMoveMemory(DA, pData+4, MAC_ADDR_LEN);
-		NdisMoveMemory(SA, pData+16, MAC_ADDR_LEN);
-		NdisMoveMemory(TA, pData+10, MAC_ADDR_LEN);  //BSSID
-	}
-	else if (to_ds == 0 && from_ds == 0 )
-	{
-		NdisMoveMemory(TA, pData+10, MAC_ADDR_LEN);
-		NdisMoveMemory(DA, pData+4, MAC_ADDR_LEN);
-		NdisMoveMemory(SA, pData+10, MAC_ADDR_LEN);
-	}
-	else if (to_ds == 1 && from_ds == 0)
-	{
-		NdisMoveMemory(SA, pData+10, MAC_ADDR_LEN);
-		NdisMoveMemory(TA, pData+10, MAC_ADDR_LEN);
-		NdisMoveMemory(DA, pData+16, MAC_ADDR_LEN);
-	}
-	else if (to_ds == 1 && from_ds == 1)
-	{
-		NdisMoveMemory(TA, pData+10, MAC_ADDR_LEN);
-		NdisMoveMemory(DA, pData+16, MAC_ADDR_LEN);
-		NdisMoveMemory(SA, pData+22, MAC_ADDR_LEN);
-	}
-
-	num_blocks = (DataByteCnt - 16) / 16;
-	payload_remainder = (DataByteCnt - 16) % 16;
-
-	pnl = (*(pData + HeaderLen)) * 256 + *(pData + HeaderLen + 2);
-	pnh = *((PULONG)(pData + HeaderLen + 4));
-	pnh = cpu2le32(pnh);
-	RTMPTkipMixKey(pWpaKey[KeyID].Key, TA, pnl, pnh, RC4Key, p1k);
-
-	ARCFOUR_INIT(&ArcFourContext, RC4Key, 16);
-
-	ARCFOUR_DECRYPT(&ArcFourContext, pData + HeaderLen, pData + HeaderLen + 8, DataByteCnt - HeaderLen - 8);
-	NdisMoveMemory(&trailfcs, pData + DataByteCnt - 8 - 4, 4);
-	crc32 = RTMP_CALC_FCS32(PPPINITFCS32, pData + HeaderLen, DataByteCnt - HeaderLen - 8 - 4);  //Skip IV+EIV 8 bytes & Skip last 4 bytes(FCS).
-	crc32 ^= 0xffffffff;             /* complement */
-
-    if(crc32 != cpu2le32(trailfcs))
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("RTMPSoftDecryptTKIP, WEP Data ICV Error !\n"));	 //ICV error.
-
-		return (FALSE);
-	}
-
-	NdisMoveMemory(TrailMIC, pData + DataByteCnt - 8 - 8 - 4, 8);
-	RTMPInitMICEngine(pAd, pWpaKey[KeyID].Key, DA, SA, UserPriority, pWpaKey[KeyID].RxMic);
-	RTMPTkipAppend(&pAd->PrivateInfo.Tx, pData + HeaderLen, DataByteCnt - HeaderLen - 8 - 12);
-	RTMPTkipGetMIC(&pAd->PrivateInfo.Tx);
-	NdisMoveMemory(MIC, pAd->PrivateInfo.Tx.MIC, 8);
-
-	if (!NdisEqualMemory(MIC, TrailMIC, 8))
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("RTMPSoftDecryptTKIP, WEP Data MIC Error !\n"));	 //MIC error.
-		return (FALSE);
-	}
-
-	return TRUE;
-}
-
-
-
-
-BOOLEAN RTMPSoftDecryptAES(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR	pData,
-	IN ULONG	DataByteCnt,
-	IN PCIPHER_KEY	pWpaKey)
-{
-	UCHAR			KeyID;
-	UINT			HeaderLen;
-	UCHAR			PN[6];
-	UINT			payload_len;
-	UINT			num_blocks;
-	UINT			payload_remainder;
-	USHORT			fc;
-	UCHAR			fc0;
-	UCHAR			fc1;
-	UINT			frame_type;
-	UINT			frame_subtype;
-	UINT			from_ds;
-	UINT			to_ds;
-	INT				a4_exists;
-	INT				qc_exists;
-	UCHAR			aes_out[16];
-	int 			payload_index;
-	UINT 			i;
-	UCHAR 			ctr_preload[16];
-	UCHAR 			chain_buffer[16];
-	UCHAR 			padded_buffer[16];
-	UCHAR 			mic_iv[16];
-	UCHAR 			mic_header1[16];
-	UCHAR 			mic_header2[16];
-	UCHAR			MIC[8];
-	UCHAR			TrailMIC[8];
-
-	fc0 = *pData;
-	fc1 = *(pData + 1);
-
-	fc = *((PUSHORT)pData);
-
-	frame_type = ((fc0 >> 2) & 0x03);
-	frame_subtype = ((fc0 >> 4) & 0x0f);
-
-	from_ds = (fc1 & 0x2) >> 1;
-	to_ds = (fc1 & 0x1);
-
-	a4_exists = (from_ds & to_ds);
-	qc_exists = ((frame_subtype == 0x08) ||    /* Assumed QoS subtypes */
-				  (frame_subtype == 0x09) ||   /* Likely to change.    */
-				  (frame_subtype == 0x0a) ||
-				  (frame_subtype == 0x0b)
-				 );
-
-	HeaderLen = 24;
-	if (a4_exists)
-		HeaderLen += 6;
-
-	KeyID = *((PUCHAR)(pData+ HeaderLen + 3));
-	KeyID = KeyID >> 6;
-
-	if (pWpaKey[KeyID].KeyLen == 0)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("RTMPSoftDecryptAES failed!(KeyID[%d] Length can not be 0)\n", KeyID));
-		return FALSE;
-	}
-
-	PN[0] = *(pData+ HeaderLen);
-	PN[1] = *(pData+ HeaderLen + 1);
-	PN[2] = *(pData+ HeaderLen + 4);
-	PN[3] = *(pData+ HeaderLen + 5);
-	PN[4] = *(pData+ HeaderLen + 6);
-	PN[5] = *(pData+ HeaderLen + 7);
-
-	payload_len = DataByteCnt - HeaderLen - 8 - 8;	// 8 bytes for CCMP header , 8 bytes for MIC
-	payload_remainder = (payload_len) % 16;
-	num_blocks = (payload_len) / 16;
-
-
-
-	// Find start of payload
-	payload_index = HeaderLen + 8; //IV+EIV
-
-	for (i=0; i< num_blocks; i++)
-	{
-		construct_ctr_preload(ctr_preload,
-								a4_exists,
-								qc_exists,
-								pData,
-								PN,
-								i+1 );
-
-		aes128k128d(pWpaKey[KeyID].Key, ctr_preload, aes_out);
-
-		bitwise_xor(aes_out, pData + payload_index, chain_buffer);
-		NdisMoveMemory(pData + payload_index - 8, chain_buffer, 16);
-		payload_index += 16;
-	}
-
-	//
-	// If there is a short final block, then pad it
-	// encrypt it and copy the unpadded part back
-	//
-	if (payload_remainder > 0)
-	{
-		construct_ctr_preload(ctr_preload,
-								a4_exists,
-								qc_exists,
-								pData,
-								PN,
-								num_blocks + 1);
-
-		NdisZeroMemory(padded_buffer, 16);
-		NdisMoveMemory(padded_buffer, pData + payload_index, payload_remainder);
-
-		aes128k128d(pWpaKey[KeyID].Key, ctr_preload, aes_out);
-
-		bitwise_xor(aes_out, padded_buffer, chain_buffer);
-		NdisMoveMemory(pData + payload_index - 8, chain_buffer, payload_remainder);
-		payload_index += payload_remainder;
-	}
-
-	//
-	// Descrypt the MIC
-	//
-	construct_ctr_preload(ctr_preload,
-							a4_exists,
-							qc_exists,
-							pData,
-							PN,
-							0);
-	NdisZeroMemory(padded_buffer, 16);
-	NdisMoveMemory(padded_buffer, pData + payload_index, 8);
-
-	aes128k128d(pWpaKey[KeyID].Key, ctr_preload, aes_out);
-
-	bitwise_xor(aes_out, padded_buffer, chain_buffer);
-
-	NdisMoveMemory(TrailMIC, chain_buffer, 8);
-
-	//
-	// Calculate MIC
-	//
-
-	//Force the protected frame bit on
-	*(pData + 1) = *(pData + 1) | 0x40;
-
-	// Find start of payload
-	// Because the CCMP header has been removed
-	payload_index = HeaderLen;
-
-	construct_mic_iv(
-					mic_iv,
-					qc_exists,
-					a4_exists,
-					pData,
-					payload_len,
-					PN);
-
-	construct_mic_header1(
-						mic_header1,
-						HeaderLen,
-						pData);
-
-	construct_mic_header2(
-						mic_header2,
-						pData,
-						a4_exists,
-						qc_exists);
-
-	aes128k128d(pWpaKey[KeyID].Key, mic_iv, aes_out);
-	bitwise_xor(aes_out, mic_header1, chain_buffer);
-	aes128k128d(pWpaKey[KeyID].Key, chain_buffer, aes_out);
-	bitwise_xor(aes_out, mic_header2, chain_buffer);
-	aes128k128d(pWpaKey[KeyID].Key, chain_buffer, aes_out);
-
-	// iterate through each 16 byte payload block
-	for (i = 0; i < num_blocks; i++)
-	{
-		bitwise_xor(aes_out, pData + payload_index, chain_buffer);
-		payload_index += 16;
-		aes128k128d(pWpaKey[KeyID].Key, chain_buffer, aes_out);
-	}
-
-	// Add on the final payload block if it needs padding
-	if (payload_remainder > 0)
-	{
-		NdisZeroMemory(padded_buffer, 16);
-		NdisMoveMemory(padded_buffer, pData + payload_index, payload_remainder);
-
-		bitwise_xor(aes_out, padded_buffer, chain_buffer);
-		aes128k128d(pWpaKey[KeyID].Key, chain_buffer, aes_out);
-	}
-	// aes_out contains padded mic, discard most significant
-	// 8 bytes to generate 64 bit MIC
-	for (i = 0 ; i < 8; i++) MIC[i] = aes_out[i];
-
-	if (!NdisEqualMemory(MIC, TrailMIC, 8))
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("RTMPSoftDecryptAES, MIC Error !\n"));	 //MIC error.
-		return FALSE;
-	}
-
-	return TRUE;
-}
-
-/****************************************/
-/* aes128k128d()                        */
-/* Performs a 128 bit AES encrypt with  */
-/* 128 bit data.                        */
-/****************************************/
-VOID xor_128(
-	IN  PUCHAR  a,
-	IN  PUCHAR  b,
-	OUT PUCHAR  out)
-{
-	INT i;
-
-	for (i=0;i<16; i++)
-	{
-		out[i] = a[i] ^ b[i];
-	}
-}
-
-VOID next_key(
-	IN  PUCHAR  key,
-	IN  INT     round)
-{
-	UCHAR       rcon;
-	UCHAR       sbox_key[4];
-	UCHAR       rcon_table[12] =
-	{
-		0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80,
-		0x1b, 0x36, 0x36, 0x36
-	};
-
-	sbox_key[0] = RTMPCkipSbox(key[13]);
-	sbox_key[1] = RTMPCkipSbox(key[14]);
-	sbox_key[2] = RTMPCkipSbox(key[15]);
-	sbox_key[3] = RTMPCkipSbox(key[12]);
-
-	rcon = rcon_table[round];
-
-	xor_32(&key[0], sbox_key, &key[0]);
-	key[0] = key[0] ^ rcon;
-
-	xor_32(&key[4], &key[0], &key[4]);
-	xor_32(&key[8], &key[4], &key[8]);
-	xor_32(&key[12], &key[8], &key[12]);
-}
-
-VOID xor_32(
-	IN  PUCHAR  a,
-	IN  PUCHAR  b,
-	OUT PUCHAR  out)
-{
-	INT i;
-
-	for (i=0;i<4; i++)
-	{
-		out[i] = a[i] ^ b[i];
-	}
-}
-
-VOID byte_sub(
-	IN  PUCHAR  in,
-	OUT PUCHAR  out)
-{
-	INT i;
-
-	for (i=0; i< 16; i++)
-	{
-		out[i] = RTMPCkipSbox(in[i]);
-	}
-}
-
-UCHAR RTMPCkipSbox(
-	IN  UCHAR   a)
-{
-	return SboxTable[(int)a];
-}
-
-VOID shift_row(
-	IN  PUCHAR  in,
-	OUT PUCHAR  out)
-{
-	out[0] =  in[0];
-	out[1] =  in[5];
-	out[2] =  in[10];
-	out[3] =  in[15];
-	out[4] =  in[4];
-	out[5] =  in[9];
-	out[6] =  in[14];
-	out[7] =  in[3];
-	out[8] =  in[8];
-	out[9] =  in[13];
-	out[10] = in[2];
-	out[11] = in[7];
-	out[12] = in[12];
-	out[13] = in[1];
-	out[14] = in[6];
-	out[15] = in[11];
-}
-
-VOID mix_column(
-	IN  PUCHAR  in,
-	OUT PUCHAR  out)
-{
-	INT         i;
-	UCHAR       add1b[4];
-	UCHAR       add1bf7[4];
-	UCHAR       rotl[4];
-	UCHAR       swap_halfs[4];
-	UCHAR       andf7[4];
-	UCHAR       rotr[4];
-	UCHAR       temp[4];
-	UCHAR       tempb[4];
-
-	for (i=0 ; i<4; i++)
-	{
-		if ((in[i] & 0x80)== 0x80)
-			add1b[i] = 0x1b;
-		else
-			add1b[i] = 0x00;
-	}
-
-	swap_halfs[0] = in[2];    /* Swap halfs */
-	swap_halfs[1] = in[3];
-	swap_halfs[2] = in[0];
-	swap_halfs[3] = in[1];
-
-	rotl[0] = in[3];        /* Rotate left 8 bits */
-	rotl[1] = in[0];
-	rotl[2] = in[1];
-	rotl[3] = in[2];
-
-	andf7[0] = in[0] & 0x7f;
-	andf7[1] = in[1] & 0x7f;
-	andf7[2] = in[2] & 0x7f;
-	andf7[3] = in[3] & 0x7f;
-
-	for (i = 3; i>0; i--)    /* logical shift left 1 bit */
-	{
-		andf7[i] = andf7[i] << 1;
-		if ((andf7[i-1] & 0x80) == 0x80)
-		{
-			andf7[i] = (andf7[i] | 0x01);
-		}
-	}
-	andf7[0] = andf7[0] << 1;
-	andf7[0] = andf7[0] & 0xfe;
-
-	xor_32(add1b, andf7, add1bf7);
-
-	xor_32(in, add1bf7, rotr);
-
-	temp[0] = rotr[0];         /* Rotate right 8 bits */
-	rotr[0] = rotr[1];
-	rotr[1] = rotr[2];
-	rotr[2] = rotr[3];
-	rotr[3] = temp[0];
-
-	xor_32(add1bf7, rotr, temp);
-	xor_32(swap_halfs, rotl,tempb);
-	xor_32(temp, tempb, out);
-}
-
diff --git a/drivers/staging/rt2860/common/rtmp_wep.c b/drivers/staging/rt2860/common/rtmp_wep.c
deleted file mode 100644
index 8e833e7011bd..000000000000
--- a/drivers/staging/rt2860/common/rtmp_wep.c
+++ /dev/null
@@ -1,497 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-	Module Name:
-	rtmp_wep.c
-
-	Abstract:
-
-	Revision History:
-	Who			When			What
-	--------	----------		----------------------------------------------
-	Paul Wu		10-28-02		Initial
-*/
-
-#include "../rt_config.h"
-
-UINT FCSTAB_32[256] =
-{
-	0x00000000, 0x77073096, 0xee0e612c, 0x990951ba,
-	0x076dc419, 0x706af48f, 0xe963a535, 0x9e6495a3,
-	0x0edb8832, 0x79dcb8a4, 0xe0d5e91e, 0x97d2d988,
-	0x09b64c2b, 0x7eb17cbd, 0xe7b82d07, 0x90bf1d91,
-	0x1db71064, 0x6ab020f2, 0xf3b97148, 0x84be41de,
-	0x1adad47d, 0x6ddde4eb, 0xf4d4b551, 0x83d385c7,
-	0x136c9856, 0x646ba8c0, 0xfd62f97a, 0x8a65c9ec,
-	0x14015c4f, 0x63066cd9, 0xfa0f3d63, 0x8d080df5,
-	0x3b6e20c8, 0x4c69105e, 0xd56041e4, 0xa2677172,
-	0x3c03e4d1, 0x4b04d447, 0xd20d85fd, 0xa50ab56b,
-	0x35b5a8fa, 0x42b2986c, 0xdbbbc9d6, 0xacbcf940,
-	0x32d86ce3, 0x45df5c75, 0xdcd60dcf, 0xabd13d59,
-	0x26d930ac, 0x51de003a, 0xc8d75180, 0xbfd06116,
-	0x21b4f4b5, 0x56b3c423, 0xcfba9599, 0xb8bda50f,
-	0x2802b89e, 0x5f058808, 0xc60cd9b2, 0xb10be924,
-	0x2f6f7c87, 0x58684c11, 0xc1611dab, 0xb6662d3d,
-	0x76dc4190, 0x01db7106, 0x98d220bc, 0xefd5102a,
-	0x71b18589, 0x06b6b51f, 0x9fbfe4a5, 0xe8b8d433,
-	0x7807c9a2, 0x0f00f934, 0x9609a88e, 0xe10e9818,
-	0x7f6a0dbb, 0x086d3d2d, 0x91646c97, 0xe6635c01,
-	0x6b6b51f4, 0x1c6c6162, 0x856530d8, 0xf262004e,
-	0x6c0695ed, 0x1b01a57b, 0x8208f4c1, 0xf50fc457,
-	0x65b0d9c6, 0x12b7e950, 0x8bbeb8ea, 0xfcb9887c,
-	0x62dd1ddf, 0x15da2d49, 0x8cd37cf3, 0xfbd44c65,
-	0x4db26158, 0x3ab551ce, 0xa3bc0074, 0xd4bb30e2,
-	0x4adfa541, 0x3dd895d7, 0xa4d1c46d, 0xd3d6f4fb,
-	0x4369e96a, 0x346ed9fc, 0xad678846, 0xda60b8d0,
-	0x44042d73, 0x33031de5, 0xaa0a4c5f, 0xdd0d7cc9,
-	0x5005713c, 0x270241aa, 0xbe0b1010, 0xc90c2086,
-	0x5768b525, 0x206f85b3, 0xb966d409, 0xce61e49f,
-	0x5edef90e, 0x29d9c998, 0xb0d09822, 0xc7d7a8b4,
-	0x59b33d17, 0x2eb40d81, 0xb7bd5c3b, 0xc0ba6cad,
-	0xedb88320, 0x9abfb3b6, 0x03b6e20c, 0x74b1d29a,
-	0xead54739, 0x9dd277af, 0x04db2615, 0x73dc1683,
-	0xe3630b12, 0x94643b84, 0x0d6d6a3e, 0x7a6a5aa8,
-	0xe40ecf0b, 0x9309ff9d, 0x0a00ae27, 0x7d079eb1,
-	0xf00f9344, 0x8708a3d2, 0x1e01f268, 0x6906c2fe,
-	0xf762575d, 0x806567cb, 0x196c3671, 0x6e6b06e7,
-	0xfed41b76, 0x89d32be0, 0x10da7a5a, 0x67dd4acc,
-	0xf9b9df6f, 0x8ebeeff9, 0x17b7be43, 0x60b08ed5,
-	0xd6d6a3e8, 0xa1d1937e, 0x38d8c2c4, 0x4fdff252,
-	0xd1bb67f1, 0xa6bc5767, 0x3fb506dd, 0x48b2364b,
-	0xd80d2bda, 0xaf0a1b4c, 0x36034af6, 0x41047a60,
-	0xdf60efc3, 0xa867df55, 0x316e8eef, 0x4669be79,
-	0xcb61b38c, 0xbc66831a, 0x256fd2a0, 0x5268e236,
-	0xcc0c7795, 0xbb0b4703, 0x220216b9, 0x5505262f,
-	0xc5ba3bbe, 0xb2bd0b28, 0x2bb45a92, 0x5cb36a04,
-	0xc2d7ffa7, 0xb5d0cf31, 0x2cd99e8b, 0x5bdeae1d,
-	0x9b64c2b0, 0xec63f226, 0x756aa39c, 0x026d930a,
-	0x9c0906a9, 0xeb0e363f, 0x72076785, 0x05005713,
-	0x95bf4a82, 0xe2b87a14, 0x7bb12bae, 0x0cb61b38,
-	0x92d28e9b, 0xe5d5be0d, 0x7cdcefb7, 0x0bdbdf21,
-	0x86d3d2d4, 0xf1d4e242, 0x68ddb3f8, 0x1fda836e,
-	0x81be16cd, 0xf6b9265b, 0x6fb077e1, 0x18b74777,
-	0x88085ae6, 0xff0f6a70, 0x66063bca, 0x11010b5c,
-	0x8f659eff, 0xf862ae69, 0x616bffd3, 0x166ccf45,
-	0xa00ae278, 0xd70dd2ee, 0x4e048354, 0x3903b3c2,
-	0xa7672661, 0xd06016f7, 0x4969474d, 0x3e6e77db,
-	0xaed16a4a, 0xd9d65adc, 0x40df0b66, 0x37d83bf0,
-	0xa9bcae53, 0xdebb9ec5, 0x47b2cf7f, 0x30b5ffe9,
-	0xbdbdf21c, 0xcabac28a, 0x53b39330, 0x24b4a3a6,
-	0xbad03605, 0xcdd70693, 0x54de5729, 0x23d967bf,
-	0xb3667a2e, 0xc4614ab8, 0x5d681b02, 0x2a6f2b94,
-	0xb40bbe37, 0xc30c8ea1, 0x5a05df1b, 0x2d02ef8d
-};
-
-/*
-	========================================================================
-
-	Routine	Description:
-		Init WEP function.
-
-	Arguments:
-      pAd		Pointer to our adapter
-		pKey        Pointer to the WEP KEY
-		KeyId		   WEP Key ID
-		KeyLen      the length of WEP KEY
-		pDest       Pointer to the destination which Encryption data will store in.
-
-	Return Value:
-		None
-
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-VOID	RTMPInitWepEngine(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			pKey,
-	IN	UCHAR			KeyId,
-	IN	UCHAR			KeyLen,
-	IN OUT	PUCHAR		pDest)
-{
-	UINT i;
-	UCHAR   WEPKEY[] = {
-		//IV
-		0x00, 0x11, 0x22,
-		//WEP KEY
-		0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99, 0xAA, 0xBB, 0xCC
-	};
-
-	pAd->PrivateInfo.FCSCRC32 = PPPINITFCS32;   //Init crc32.
-
-    if (pAd->StaCfg.bCkipOn && (pAd->StaCfg.CkipFlag & 0x10) && (pAd->OpMode == OPMODE_STA))
-    {
-        ARCFOUR_INIT(&pAd->PrivateInfo.WEPCONTEXT, pKey, KeyLen);  //INIT SBOX, KEYLEN+3(IV)
-        NdisMoveMemory(pDest, pKey, 3);  //Append Init Vector
-    }
-    else
-    {
-		NdisMoveMemory(WEPKEY + 3, pKey, KeyLen);
-
-        for(i = 0; i < 3; i++)
-			WEPKEY[i] = RandomByte(pAd);   //Call mlme RandomByte() function.
-		ARCFOUR_INIT(&pAd->PrivateInfo.WEPCONTEXT, WEPKEY, KeyLen + 3);  //INIT SBOX, KEYLEN+3(IV)
-
-		NdisMoveMemory(pDest, WEPKEY, 3);  //Append Init Vector
-    }
-	*(pDest+3) = (KeyId << 6);       //Append KEYID
-
-}
-
-/*
-	========================================================================
-
-	Routine	Description:
-		Encrypt transimitted data
-
-	Arguments:
-      pAd		Pointer to our adapter
-      pSrc        Pointer to the transimitted source data that will be encrypt
-      pDest       Pointer to the destination where entryption data will be store in.
-      Len			Indicate the length of the source data
-
-	Return Value:
-      None
-
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-VOID	RTMPEncryptData(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			pSrc,
-	IN	PUCHAR			pDest,
-	IN	UINT			Len)
-{
-	pAd->PrivateInfo.FCSCRC32 = RTMP_CALC_FCS32(pAd->PrivateInfo.FCSCRC32, pSrc, Len);
-	ARCFOUR_ENCRYPT(&pAd->PrivateInfo.WEPCONTEXT, pDest, pSrc, Len);
-}
-
-
-/*
-	========================================================================
-
-	Routine	Description:
-		Decrypt received WEP data
-
-	Arguments:
-		pAdapter		Pointer to our adapter
-		pSrc        Pointer to the received data
-		Len         the length of the received data
-
-	Return Value:
-		TRUE        Decrypt WEP data success
-		FALSE       Decrypt WEP data failed
-
-	Note:
-
-	========================================================================
-*/
-BOOLEAN	RTMPSoftDecryptWEP(
-	IN PRTMP_ADAPTER 	pAd,
-	IN PUCHAR			pData,
-	IN ULONG			DataByteCnt,
-	IN PCIPHER_KEY		pGroupKey)
-{
-	UINT	trailfcs;
-	UINT    crc32;
-	UCHAR	KeyIdx;
-	UCHAR   WEPKEY[] = {
-		//IV
-		0x00, 0x11, 0x22,
-		//WEP KEY
-		0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99, 0xAA, 0xBB, 0xCC
-	};
-	UCHAR 	*pPayload = (UCHAR *)pData + LENGTH_802_11;
-	ULONG	payload_len = DataByteCnt - LENGTH_802_11;
-
-	NdisMoveMemory(WEPKEY, pPayload, 3);    //Get WEP IV
-
-	KeyIdx = (*(pPayload + 3) & 0xc0) >> 6;
-	if (pGroupKey[KeyIdx].KeyLen == 0)
-		return (FALSE);
-
-	NdisMoveMemory(WEPKEY + 3, pGroupKey[KeyIdx].Key, pGroupKey[KeyIdx].KeyLen);
-	ARCFOUR_INIT(&pAd->PrivateInfo.WEPCONTEXT, WEPKEY, pGroupKey[KeyIdx].KeyLen + 3);
-	ARCFOUR_DECRYPT(&pAd->PrivateInfo.WEPCONTEXT, pPayload, pPayload + 4, payload_len - 4);
-	NdisMoveMemory(&trailfcs, pPayload + payload_len - 8, 4);
-	crc32 = RTMP_CALC_FCS32(PPPINITFCS32, pPayload, payload_len - 8);  //Skip last 4 bytes(FCS).
-	crc32 ^= 0xffffffff;             /* complement */
-
-    if(crc32 != cpu2le32(trailfcs))
-    {
-		DBGPRINT(RT_DEBUG_TRACE, ("! WEP Data CRC Error !\n"));	 //CRC error.
-		return (FALSE);
-	}
-	return (TRUE);
-}
-
-/*
-	========================================================================
-
-	Routine	Description:
-		The Stream Cipher Encryption Algorithm "ARCFOUR" initialize
-
-	Arguments:
-	   Ctx         Pointer to ARCFOUR CONTEXT (SBOX)
-		pKey        Pointer to the WEP KEY
-		KeyLen      Indicate the length fo the WEP KEY
-
-	Return Value:
-	   None
-
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-VOID	ARCFOUR_INIT(
-	IN	PARCFOURCONTEXT	Ctx,
-	IN	PUCHAR			pKey,
-	IN	UINT			KeyLen)
-{
-	UCHAR	t, u;
-	UINT	keyindex;
-	UINT	stateindex;
-	PUCHAR	state;
-	UINT	counter;
-
-	state = Ctx->STATE;
-	Ctx->X = 0;
-	Ctx->Y = 0;
-	for (counter = 0; counter < 256; counter++)
-		state[counter] = (UCHAR)counter;
-	keyindex = 0;
-	stateindex = 0;
-	for (counter = 0; counter < 256; counter++)
-	{
-		t = state[counter];
-		stateindex = (stateindex + pKey[keyindex] + t) & 0xff;
-		u = state[stateindex];
-		state[stateindex] = t;
-		state[counter] = u;
-		if (++keyindex >= KeyLen)
-			keyindex = 0;
-	}
-}
-
-/*
-	========================================================================
-
-	Routine	Description:
-		Get bytes from ARCFOUR CONTEXT (S-BOX)
-
-	Arguments:
-	   Ctx         Pointer to ARCFOUR CONTEXT (SBOX)
-
-	Return Value:
-	   UCHAR  - the value of the ARCFOUR CONTEXT (S-BOX)
-
-	Note:
-
-	========================================================================
-*/
-UCHAR	ARCFOUR_BYTE(
-	IN	PARCFOURCONTEXT		Ctx)
-{
-  UINT x;
-  UINT y;
-  UCHAR sx, sy;
-  PUCHAR state;
-
-  state = Ctx->STATE;
-  x = (Ctx->X + 1) & 0xff;
-  sx = state[x];
-  y = (sx + Ctx->Y) & 0xff;
-  sy = state[y];
-  Ctx->X = x;
-  Ctx->Y = y;
-  state[y] = sx;
-  state[x] = sy;
-
-  return(state[(sx + sy) & 0xff]);
-
-}
-
-/*
-	========================================================================
-
-	Routine	Description:
-		The Stream Cipher Decryption Algorithm
-
-	Arguments:
-		Ctx         Pointer to ARCFOUR CONTEXT (SBOX)
-		pDest			Pointer to the Destination
-		pSrc        Pointer to the Source data
-		Len         Indicate the length of the Source data
-
-	Return Value:
-		None
-
-	Note:
-
-	========================================================================
-*/
-VOID	ARCFOUR_DECRYPT(
-	IN	PARCFOURCONTEXT	Ctx,
-	IN	PUCHAR			pDest,
-	IN	PUCHAR			pSrc,
-	IN	UINT			Len)
-{
-	UINT i;
-
-	for (i = 0; i < Len; i++)
-		pDest[i] = pSrc[i] ^ ARCFOUR_BYTE(Ctx);
-}
-
-/*
-	========================================================================
-
-	Routine	Description:
-		The Stream Cipher Encryption Algorithm
-
-	Arguments:
-		Ctx         Pointer to ARCFOUR CONTEXT (SBOX)
-		pDest			Pointer to the Destination
-		pSrc        Pointer to the Source data
-		Len         Indicate the length of the Source dta
-
-	Return Value:
-		None
-
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-VOID	ARCFOUR_ENCRYPT(
-	IN	PARCFOURCONTEXT	Ctx,
-	IN	PUCHAR			pDest,
-	IN	PUCHAR			pSrc,
-	IN	UINT			Len)
-{
-	UINT i;
-
-	for (i = 0; i < Len; i++)
-		pDest[i] = pSrc[i] ^ ARCFOUR_BYTE(Ctx);
-}
-
-/*
-	========================================================================
-
-	Routine	Description:
-		The Stream Cipher Encryption Algorithm which conform to the special requirement to encrypt  GTK.
-
-	Arguments:
-		Ctx         Pointer to ARCFOUR CONTEXT (SBOX)
-		pDest			Pointer to the Destination
-		pSrc        Pointer to the Source data
-		Len         Indicate the length of the Source dta
-
-
-	========================================================================
-*/
-
-VOID	WPAARCFOUR_ENCRYPT(
-	IN	PARCFOURCONTEXT	Ctx,
-	IN	PUCHAR			pDest,
-	IN	PUCHAR			pSrc,
-	IN	UINT			Len)
-{
-	UINT i;
-        //discard first 256 bytes
-	for (i = 0; i < 256; i++)
-            ARCFOUR_BYTE(Ctx);
-
-	for (i = 0; i < Len; i++)
-		pDest[i] = pSrc[i] ^ ARCFOUR_BYTE(Ctx);
-}
-
-
-/*
-	========================================================================
-
-	Routine	Description:
-		Calculate a new FCS given the current FCS and the new data.
-
-	Arguments:
-		Fcs	      the original FCS value
-		Cp          pointer to the data which will be calculate the FCS
-		Len         the length of the data
-
-	Return Value:
-		UINT - FCS 32 bits
-
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-UINT	RTMP_CALC_FCS32(
-	IN	UINT	Fcs,
-	IN	PUCHAR	Cp,
-	IN	INT		Len)
-{
-	while (Len--)
-	   Fcs = (((Fcs) >> 8) ^ FCSTAB_32[((Fcs) ^ (*Cp++)) & 0xff]);
-
-	return (Fcs);
-}
-
-
-/*
-	========================================================================
-
-	Routine	Description:
-		Get last FCS and encrypt it to the destination
-
-	Arguments:
-		pDest			Pointer to the Destination
-
-	Return Value:
-		None
-
-	Note:
-
-	========================================================================
-*/
-VOID	RTMPSetICV(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR	pDest)
-{
-	pAd->PrivateInfo.FCSCRC32 ^= 0xffffffff;             /* complement */
-	pAd->PrivateInfo.FCSCRC32 = cpu2le32(pAd->PrivateInfo.FCSCRC32);
-
-	ARCFOUR_ENCRYPT(&pAd->PrivateInfo.WEPCONTEXT, pDest, (PUCHAR) &pAd->PrivateInfo.FCSCRC32, 4);
-}
-
diff --git a/drivers/staging/rt2860/common/spectrum.c b/drivers/staging/rt2860/common/spectrum.c
index c658bf3082c3..51e38d809333 100644
--- a/drivers/staging/rt2860/common/spectrum.c
+++ b/drivers/staging/rt2860/common/spectrum.c
@@ -24,7 +24,6 @@
  *                                                                       *
  *************************************************************************
 
-
     Module Name:
 	action.c
 
@@ -40,24 +39,382 @@
 #include "../rt_config.h"
 #include "action.h"
 
-VOID MeasureReqTabInit(
-	IN PRTMP_ADAPTER pAd)
+/* The regulatory information in the USA (US) */
+struct rt_dot11_regulatory_information USARegulatoryInfo[] = {
+/*  "regulatory class"  "number of channels"  "Max Tx Pwr"  "channel list" */
+	{0, {0, 0, {0}
+	     }
+	 }
+	,			/* Invlid entry */
+	{1, {4, 16, {36, 40, 44, 48}
+	     }
+	 }
+	,
+	{2, {4, 23, {52, 56, 60, 64}
+	     }
+	 }
+	,
+	{3, {4, 29, {149, 153, 157, 161}
+	     }
+	 }
+	,
+	{4, {11, 23, {100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140}
+	     }
+	 }
+	,
+	{5, {5, 30, {149, 153, 157, 161, 165}
+	     }
+	 }
+	,
+	{6, {10, 14, {1, 2, 3, 4, 5, 6, 7, 8, 9, 10}
+	     }
+	 }
+	,
+	{7, {10, 27, {1, 2, 3, 4, 5, 6, 7, 8, 9, 10}
+	     }
+	 }
+	,
+	{8, {5, 17, {11, 13, 15, 17, 19}
+	     }
+	 }
+	,
+	{9, {5, 30, {11, 13, 15, 17, 19}
+	     }
+	 }
+	,
+	{10, {2, 20, {21, 25}
+	      }
+	 }
+	,
+	{11, {2, 33, {21, 25}
+	      }
+	 }
+	,
+	{12, {11, 30, {1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11}
+	      }
+	 }
+};
+
+#define USA_REGULATORY_INFO_SIZE (sizeof(USARegulatoryInfo) / sizeof(struct rt_dot11_regulatory_information))
+
+/* The regulatory information in Europe */
+struct rt_dot11_regulatory_information EuropeRegulatoryInfo[] = {
+/*  "regulatory class"  "number of channels"  "Max Tx Pwr"  "channel list" */
+	{0, {0, 0, {0}
+	     }
+	 }
+	,			/* Invalid entry */
+	{1, {4, 20, {36, 40, 44, 48}
+	     }
+	 }
+	,
+	{2, {4, 20, {52, 56, 60, 64}
+	     }
+	 }
+	,
+	{3, {11, 30, {100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140}
+	     }
+	 }
+	,
+	{4, {13, 20, {1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13}
+	     }
+	 }
+};
+
+#define EU_REGULATORY_INFO_SIZE (sizeof(EuropeRegulatoryInfo) / sizeof(struct rt_dot11_regulatory_information))
+
+/* The regulatory information in Japan */
+struct rt_dot11_regulatory_information JapanRegulatoryInfo[] = {
+/*  "regulatory class"  "number of channels"  "Max Tx Pwr"  "channel list" */
+	{0, {0, 0, {0}
+	     }
+	 }
+	,			/* Invalid entry */
+	{1, {4, 22, {34, 38, 42, 46}
+	     }
+	 }
+	,
+	{2, {3, 24, {8, 12, 16}
+	     }
+	 }
+	,
+	{3, {3, 24, {8, 12, 16}
+	     }
+	 }
+	,
+	{4, {3, 24, {8, 12, 16}
+	     }
+	 }
+	,
+	{5, {3, 24, {8, 12, 16}
+	     }
+	 }
+	,
+	{6, {3, 22, {8, 12, 16}
+	     }
+	 }
+	,
+	{7, {4, 24, {184, 188, 192, 196}
+	     }
+	 }
+	,
+	{8, {4, 24, {184, 188, 192, 196}
+	     }
+	 }
+	,
+	{9, {4, 24, {184, 188, 192, 196}
+	     }
+	 }
+	,
+	{10, {4, 24, {184, 188, 192, 196}
+	      }
+	 }
+	,
+	{11, {4, 22, {184, 188, 192, 196}
+	      }
+	 }
+	,
+	{12, {4, 24, {7, 8, 9, 11}
+	      }
+	 }
+	,
+	{13, {4, 24, {7, 8, 9, 11}
+	      }
+	 }
+	,
+	{14, {4, 24, {7, 8, 9, 11}
+	      }
+	 }
+	,
+	{15, {4, 24, {7, 8, 9, 11}
+	      }
+	 }
+	,
+	{16, {6, 24, {183, 184, 185, 187, 188, 189}
+	      }
+	 }
+	,
+	{17, {6, 24, {183, 184, 185, 187, 188, 189}
+	      }
+	 }
+	,
+	{18, {6, 24, {183, 184, 185, 187, 188, 189}
+	      }
+	 }
+	,
+	{19, {6, 24, {183, 184, 185, 187, 188, 189}
+	      }
+	 }
+	,
+	{20, {6, 17, {183, 184, 185, 187, 188, 189}
+	      }
+	 }
+	,
+	{21, {6, 24, {6, 7, 8, 9, 10, 11}
+	      }
+	 }
+	,
+	{22, {6, 24, {6, 7, 8, 9, 10, 11}
+	      }
+	 }
+	,
+	{23, {6, 24, {6, 7, 8, 9, 10, 11}
+	      }
+	 }
+	,
+	{24, {6, 24, {6, 7, 8, 9, 10, 11}
+	      }
+	 }
+	,
+	{25, {8, 24, {182, 183, 184, 185, 186, 187, 188, 189}
+	      }
+	 }
+	,
+	{26, {8, 24, {182, 183, 184, 185, 186, 187, 188, 189}
+	      }
+	 }
+	,
+	{27, {8, 24, {182, 183, 184, 185, 186, 187, 188, 189}
+	      }
+	 }
+	,
+	{28, {8, 24, {182, 183, 184, 185, 186, 187, 188, 189}
+	      }
+	 }
+	,
+	{29, {8, 17, {182, 183, 184, 185, 186, 187, 188, 189}
+	      }
+	 }
+	,
+	{30, {13, 23, {1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13}
+	      }
+	 }
+	,
+	{31, {1, 23, {14}
+	      }
+	 }
+	,
+	{32, {4, 22, {52, 56, 60, 64}
+	      }
+	 }
+};
+
+#define JP_REGULATORY_INFO_SIZE (sizeof(JapanRegulatoryInfo) / sizeof(struct rt_dot11_regulatory_information))
+
+char RTMP_GetTxPwr(struct rt_rtmp_adapter *pAd, IN HTTRANSMIT_SETTING HTTxMode)
+{
+	struct tx_pwr_cfg {
+		u8 Mode;
+		u8 MCS;
+		u16 req;
+		u8 shift;
+		u32 BitMask;
+	};
+
+	u32 Value;
+	int Idx;
+	u8 PhyMode;
+	char CurTxPwr;
+	u8 TxPwrRef = 0;
+	char DaltaPwr;
+	unsigned long TxPwr[5];
+
+	struct tx_pwr_cfg TxPwrCfg[] = {
+		{MODE_CCK, 0, 0, 4, 0x000000f0},
+		{MODE_CCK, 1, 0, 0, 0x0000000f},
+		{MODE_CCK, 2, 0, 12, 0x0000f000},
+		{MODE_CCK, 3, 0, 8, 0x00000f00},
+
+		{MODE_OFDM, 0, 0, 20, 0x00f00000},
+		{MODE_OFDM, 1, 0, 16, 0x000f0000},
+		{MODE_OFDM, 2, 0, 28, 0xf0000000},
+		{MODE_OFDM, 3, 0, 24, 0x0f000000},
+		{MODE_OFDM, 4, 1, 4, 0x000000f0},
+		{MODE_OFDM, 5, 1, 0, 0x0000000f},
+		{MODE_OFDM, 6, 1, 12, 0x0000f000},
+		{MODE_OFDM, 7, 1, 8, 0x00000f00}
+		, {MODE_HTMIX, 0, 1, 20, 0x00f00000},
+		{MODE_HTMIX, 1, 1, 16, 0x000f0000},
+		{MODE_HTMIX, 2, 1, 28, 0xf0000000},
+		{MODE_HTMIX, 3, 1, 24, 0x0f000000},
+		{MODE_HTMIX, 4, 2, 4, 0x000000f0},
+		{MODE_HTMIX, 5, 2, 0, 0x0000000f},
+		{MODE_HTMIX, 6, 2, 12, 0x0000f000},
+		{MODE_HTMIX, 7, 2, 8, 0x00000f00},
+		{MODE_HTMIX, 8, 2, 20, 0x00f00000},
+		{MODE_HTMIX, 9, 2, 16, 0x000f0000},
+		{MODE_HTMIX, 10, 2, 28, 0xf0000000},
+		{MODE_HTMIX, 11, 2, 24, 0x0f000000},
+		{MODE_HTMIX, 12, 3, 4, 0x000000f0},
+		{MODE_HTMIX, 13, 3, 0, 0x0000000f},
+		{MODE_HTMIX, 14, 3, 12, 0x0000f000},
+		{MODE_HTMIX, 15, 3, 8, 0x00000f00}
+	};
+#define MAX_TXPWR_TAB_SIZE (sizeof(TxPwrCfg) / sizeof(struct tx_pwr_cfg))
+
+	CurTxPwr = 19;
+
+	/* check Tx Power setting from UI. */
+	if (pAd->CommonCfg.TxPowerPercentage > 90) ;
+	else if (pAd->CommonCfg.TxPowerPercentage > 60)	/* reduce Pwr for 1 dB. */
+		CurTxPwr -= 1;
+	else if (pAd->CommonCfg.TxPowerPercentage > 30)	/* reduce Pwr for 3 dB. */
+		CurTxPwr -= 3;
+	else if (pAd->CommonCfg.TxPowerPercentage > 15)	/* reduce Pwr for 6 dB. */
+		CurTxPwr -= 6;
+	else if (pAd->CommonCfg.TxPowerPercentage > 9)	/* reduce Pwr for 9 dB. */
+		CurTxPwr -= 9;
+	else			/* reduce Pwr for 12 dB. */
+		CurTxPwr -= 12;
+
+	if (pAd->CommonCfg.BBPCurrentBW == BW_40) {
+		if (pAd->CommonCfg.CentralChannel > 14) {
+			TxPwr[0] = pAd->Tx40MPwrCfgABand[0];
+			TxPwr[1] = pAd->Tx40MPwrCfgABand[1];
+			TxPwr[2] = pAd->Tx40MPwrCfgABand[2];
+			TxPwr[3] = pAd->Tx40MPwrCfgABand[3];
+			TxPwr[4] = pAd->Tx40MPwrCfgABand[4];
+		} else {
+			TxPwr[0] = pAd->Tx40MPwrCfgGBand[0];
+			TxPwr[1] = pAd->Tx40MPwrCfgGBand[1];
+			TxPwr[2] = pAd->Tx40MPwrCfgGBand[2];
+			TxPwr[3] = pAd->Tx40MPwrCfgGBand[3];
+			TxPwr[4] = pAd->Tx40MPwrCfgGBand[4];
+		}
+	} else {
+		if (pAd->CommonCfg.Channel > 14) {
+			TxPwr[0] = pAd->Tx20MPwrCfgABand[0];
+			TxPwr[1] = pAd->Tx20MPwrCfgABand[1];
+			TxPwr[2] = pAd->Tx20MPwrCfgABand[2];
+			TxPwr[3] = pAd->Tx20MPwrCfgABand[3];
+			TxPwr[4] = pAd->Tx20MPwrCfgABand[4];
+		} else {
+			TxPwr[0] = pAd->Tx20MPwrCfgGBand[0];
+			TxPwr[1] = pAd->Tx20MPwrCfgGBand[1];
+			TxPwr[2] = pAd->Tx20MPwrCfgGBand[2];
+			TxPwr[3] = pAd->Tx20MPwrCfgGBand[3];
+			TxPwr[4] = pAd->Tx20MPwrCfgGBand[4];
+		}
+	}
+
+	switch (HTTxMode.field.MODE) {
+	case MODE_CCK:
+	case MODE_OFDM:
+		Value = TxPwr[1];
+		TxPwrRef = (Value & 0x00000f00) >> 8;
+
+		break;
+
+	case MODE_HTMIX:
+	case MODE_HTGREENFIELD:
+		if (pAd->CommonCfg.TxStream == 1) {
+			Value = TxPwr[2];
+			TxPwrRef = (Value & 0x00000f00) >> 8;
+		} else if (pAd->CommonCfg.TxStream == 2) {
+			Value = TxPwr[3];
+			TxPwrRef = (Value & 0x00000f00) >> 8;
+		}
+		break;
+	}
+
+	PhyMode = (HTTxMode.field.MODE == MODE_HTGREENFIELD)
+	    ? MODE_HTMIX : HTTxMode.field.MODE;
+
+	for (Idx = 0; Idx < MAX_TXPWR_TAB_SIZE; Idx++) {
+		if ((TxPwrCfg[Idx].Mode == PhyMode)
+		    && (TxPwrCfg[Idx].MCS == HTTxMode.field.MCS)) {
+			Value = TxPwr[TxPwrCfg[Idx].req];
+			DaltaPwr =
+			    TxPwrRef - (char)((Value & TxPwrCfg[Idx].BitMask)
+					       >> TxPwrCfg[Idx].shift);
+			CurTxPwr -= DaltaPwr;
+			break;
+		}
+	}
+
+	return CurTxPwr;
+}
+
+void MeasureReqTabInit(struct rt_rtmp_adapter *pAd)
 {
 	NdisAllocateSpinLock(&pAd->CommonCfg.MeasureReqTabLock);
 
-	pAd->CommonCfg.pMeasureReqTab = kmalloc(sizeof(MEASURE_REQ_TAB), GFP_ATOMIC);
+	pAd->CommonCfg.pMeasureReqTab =
+	    kmalloc(sizeof(struct rt_measure_req_tab), GFP_ATOMIC);
 	if (pAd->CommonCfg.pMeasureReqTab)
-		NdisZeroMemory(pAd->CommonCfg.pMeasureReqTab, sizeof(MEASURE_REQ_TAB));
+		NdisZeroMemory(pAd->CommonCfg.pMeasureReqTab,
+			       sizeof(struct rt_measure_req_tab));
 	else
-		DBGPRINT(RT_DEBUG_ERROR, ("%s Fail to alloc memory for pAd->CommonCfg.pMeasureReqTab.\n", __func__));
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("%s Fail to alloc memory for pAd->CommonCfg.pMeasureReqTab.\n",
+			  __func__));
 
 	return;
 }
 
-VOID MeasureReqTabExit(
-	IN PRTMP_ADAPTER pAd)
+void MeasureReqTabExit(struct rt_rtmp_adapter *pAd)
 {
-	NdisFreeSpinLock(pAd->CommonCfg.MeasureReqTabLock);
+	NdisFreeSpinLock(&pAd->CommonCfg.MeasureReqTabLock);
 
 	if (pAd->CommonCfg.pMeasureReqTab)
 		kfree(pAd->CommonCfg.pMeasureReqTab);
@@ -66,18 +423,16 @@ VOID MeasureReqTabExit(
 	return;
 }
 
-static PMEASURE_REQ_ENTRY MeasureReqLookUp(
-	IN PRTMP_ADAPTER	pAd,
-	IN UINT8			DialogToken)
+struct rt_measure_req_entry *MeasureReqLookUp(struct rt_rtmp_adapter *pAd, u8 DialogToken)
 {
-	UINT HashIdx;
-	PMEASURE_REQ_TAB pTab = pAd->CommonCfg.pMeasureReqTab;
-	PMEASURE_REQ_ENTRY pEntry = NULL;
-	PMEASURE_REQ_ENTRY pPrevEntry = NULL;
-
-	if (pTab == NULL)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("%s: pMeasureReqTab doesn't exist.\n", __func__));
+	u32 HashIdx;
+	struct rt_measure_req_tab *pTab = pAd->CommonCfg.pMeasureReqTab;
+	struct rt_measure_req_entry *pEntry = NULL;
+	struct rt_measure_req_entry *pPrevEntry = NULL;
+
+	if (pTab == NULL) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("%s: pMeasureReqTab doesn't exist.\n", __func__));
 		return NULL;
 	}
 
@@ -86,12 +441,10 @@ static PMEASURE_REQ_ENTRY MeasureReqLookUp(
 	HashIdx = MQ_DIALOGTOKEN_HASH_INDEX(DialogToken);
 	pEntry = pTab->Hash[HashIdx];
 
-	while (pEntry)
-	{
+	while (pEntry) {
 		if (pEntry->DialogToken == DialogToken)
 			break;
-		else
-		{
+		else {
 			pPrevEntry = pEntry;
 			pEntry = pEntry->pNext;
 		}
@@ -102,50 +455,49 @@ static PMEASURE_REQ_ENTRY MeasureReqLookUp(
 	return pEntry;
 }
 
-static PMEASURE_REQ_ENTRY MeasureReqInsert(
-	IN PRTMP_ADAPTER	pAd,
-	IN UINT8			DialogToken)
+struct rt_measure_req_entry *MeasureReqInsert(struct rt_rtmp_adapter *pAd, u8 DialogToken)
 {
-	INT i;
-	ULONG HashIdx;
-	PMEASURE_REQ_TAB pTab = pAd->CommonCfg.pMeasureReqTab;
-	PMEASURE_REQ_ENTRY pEntry = NULL, pCurrEntry;
-	ULONG Now;
-
-	if(pTab == NULL)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("%s: pMeasureReqTab doesn't exist.\n", __func__));
+	int i;
+	unsigned long HashIdx;
+	struct rt_measure_req_tab *pTab = pAd->CommonCfg.pMeasureReqTab;
+	struct rt_measure_req_entry *pEntry = NULL, *pCurrEntry;
+	unsigned long Now;
+
+	if (pTab == NULL) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("%s: pMeasureReqTab doesn't exist.\n", __func__));
 		return NULL;
 	}
 
 	pEntry = MeasureReqLookUp(pAd, DialogToken);
-	if (pEntry == NULL)
-	{
+	if (pEntry == NULL) {
 		RTMP_SEM_LOCK(&pAd->CommonCfg.MeasureReqTabLock);
-		for (i = 0; i < MAX_MEASURE_REQ_TAB_SIZE; i++)
-		{
+		for (i = 0; i < MAX_MEASURE_REQ_TAB_SIZE; i++) {
 			NdisGetSystemUpTime(&Now);
 			pEntry = &pTab->Content[i];
 
 			if ((pEntry->Valid == TRUE)
-				&& RTMP_TIME_AFTER((unsigned long)Now, (unsigned long)(pEntry->lastTime + MQ_REQ_AGE_OUT)))
+			    && RTMP_TIME_AFTER((unsigned long)Now,
+					       (unsigned long)(pEntry->
+							       lastTime +
+							       MQ_REQ_AGE_OUT)))
 			{
-				PMEASURE_REQ_ENTRY pPrevEntry = NULL;
-				ULONG HashIdx = MQ_DIALOGTOKEN_HASH_INDEX(pEntry->DialogToken);
-				PMEASURE_REQ_ENTRY pProbeEntry = pTab->Hash[HashIdx];
-
-				// update Hash list
-				do
-				{
-					if (pProbeEntry == pEntry)
-					{
-						if (pPrevEntry == NULL)
-						{
-							pTab->Hash[HashIdx] = pEntry->pNext;
-						}
-						else
-						{
-							pPrevEntry->pNext = pEntry->pNext;
+				struct rt_measure_req_entry *pPrevEntry = NULL;
+				unsigned long HashIdx =
+				    MQ_DIALOGTOKEN_HASH_INDEX(pEntry->
+							      DialogToken);
+				struct rt_measure_req_entry *pProbeEntry =
+				    pTab->Hash[HashIdx];
+
+				/* update Hash list */
+				do {
+					if (pProbeEntry == pEntry) {
+						if (pPrevEntry == NULL) {
+							pTab->Hash[HashIdx] =
+							    pEntry->pNext;
+						} else {
+							pPrevEntry->pNext =
+							    pEntry->pNext;
 						}
 						break;
 					}
@@ -154,7 +506,8 @@ static PMEASURE_REQ_ENTRY MeasureReqInsert(
 					pProbeEntry = pProbeEntry->pNext;
 				} while (pProbeEntry);
 
-				NdisZeroMemory(pEntry, sizeof(MEASURE_REQ_ENTRY));
+				NdisZeroMemory(pEntry,
+					       sizeof(struct rt_measure_req_entry));
 				pTab->Size--;
 
 				break;
@@ -164,30 +517,24 @@ static PMEASURE_REQ_ENTRY MeasureReqInsert(
 				break;
 		}
 
-		if (i < MAX_MEASURE_REQ_TAB_SIZE)
-		{
+		if (i < MAX_MEASURE_REQ_TAB_SIZE) {
 			NdisGetSystemUpTime(&Now);
 			pEntry->lastTime = Now;
 			pEntry->Valid = TRUE;
 			pEntry->DialogToken = DialogToken;
 			pTab->Size++;
-		}
-		else
-		{
+		} else {
 			pEntry = NULL;
-			DBGPRINT(RT_DEBUG_ERROR, ("%s: pMeasureReqTab tab full.\n", __func__));
+			DBGPRINT(RT_DEBUG_ERROR,
+				 ("%s: pMeasureReqTab tab full.\n", __func__));
 		}
 
-		// add this Neighbor entry into HASH table
-		if (pEntry)
-		{
+		/* add this Neighbor entry into HASH table */
+		if (pEntry) {
 			HashIdx = MQ_DIALOGTOKEN_HASH_INDEX(DialogToken);
-			if (pTab->Hash[HashIdx] == NULL)
-			{
+			if (pTab->Hash[HashIdx] == NULL) {
 				pTab->Hash[HashIdx] = pEntry;
-			}
-			else
-			{
+			} else {
 				pCurrEntry = pTab->Hash[HashIdx];
 				while (pCurrEntry->pNext != NULL)
 					pCurrEntry = pCurrEntry->pNext;
@@ -201,45 +548,35 @@ static PMEASURE_REQ_ENTRY MeasureReqInsert(
 	return pEntry;
 }
 
-static VOID MeasureReqDelete(
-	IN PRTMP_ADAPTER	pAd,
-	IN UINT8			DialogToken)
+void MeasureReqDelete(struct rt_rtmp_adapter *pAd, u8 DialogToken)
 {
-	PMEASURE_REQ_TAB pTab = pAd->CommonCfg.pMeasureReqTab;
-	PMEASURE_REQ_ENTRY pEntry = NULL;
+	struct rt_measure_req_tab *pTab = pAd->CommonCfg.pMeasureReqTab;
+	struct rt_measure_req_entry *pEntry = NULL;
 
-	if(pTab == NULL)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("%s: pMeasureReqTab doesn't exist.\n", __func__));
+	if (pTab == NULL) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("%s: pMeasureReqTab doesn't exist.\n", __func__));
 		return;
 	}
-
-	// if empty, return
-	if (pTab->Size == 0)
-	{
+	/* if empty, return */
+	if (pTab->Size == 0) {
 		DBGPRINT(RT_DEBUG_ERROR, ("pMeasureReqTab empty.\n"));
 		return;
 	}
 
 	pEntry = MeasureReqLookUp(pAd, DialogToken);
-	if (pEntry != NULL)
-	{
-		PMEASURE_REQ_ENTRY pPrevEntry = NULL;
-		ULONG HashIdx = MQ_DIALOGTOKEN_HASH_INDEX(pEntry->DialogToken);
-		PMEASURE_REQ_ENTRY pProbeEntry = pTab->Hash[HashIdx];
+	if (pEntry != NULL) {
+		struct rt_measure_req_entry *pPrevEntry = NULL;
+		unsigned long HashIdx = MQ_DIALOGTOKEN_HASH_INDEX(pEntry->DialogToken);
+		struct rt_measure_req_entry *pProbeEntry = pTab->Hash[HashIdx];
 
 		RTMP_SEM_LOCK(&pAd->CommonCfg.MeasureReqTabLock);
-		// update Hash list
-		do
-		{
-			if (pProbeEntry == pEntry)
-			{
-				if (pPrevEntry == NULL)
-				{
+		/* update Hash list */
+		do {
+			if (pProbeEntry == pEntry) {
+				if (pPrevEntry == NULL) {
 					pTab->Hash[HashIdx] = pEntry->pNext;
-				}
-				else
-				{
+				} else {
 					pPrevEntry->pNext = pEntry->pNext;
 				}
 				break;
@@ -249,7 +586,7 @@ static VOID MeasureReqDelete(
 			pProbeEntry = pProbeEntry->pNext;
 		} while (pProbeEntry);
 
-		NdisZeroMemory(pEntry, sizeof(MEASURE_REQ_ENTRY));
+		NdisZeroMemory(pEntry, sizeof(struct rt_measure_req_entry));
 		pTab->Size--;
 
 		RTMP_SEM_UNLOCK(&pAd->CommonCfg.MeasureReqTabLock);
@@ -258,24 +595,24 @@ static VOID MeasureReqDelete(
 	return;
 }
 
-VOID TpcReqTabInit(
-	IN PRTMP_ADAPTER pAd)
+void TpcReqTabInit(struct rt_rtmp_adapter *pAd)
 {
 	NdisAllocateSpinLock(&pAd->CommonCfg.TpcReqTabLock);
 
-	pAd->CommonCfg.pTpcReqTab = kmalloc(sizeof(TPC_REQ_TAB), GFP_ATOMIC);
+	pAd->CommonCfg.pTpcReqTab = kmalloc(sizeof(struct rt_tpc_req_tab), GFP_ATOMIC);
 	if (pAd->CommonCfg.pTpcReqTab)
-		NdisZeroMemory(pAd->CommonCfg.pTpcReqTab, sizeof(TPC_REQ_TAB));
+		NdisZeroMemory(pAd->CommonCfg.pTpcReqTab, sizeof(struct rt_tpc_req_tab));
 	else
-		DBGPRINT(RT_DEBUG_ERROR, ("%s Fail to alloc memory for pAd->CommonCfg.pTpcReqTab.\n", __func__));
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("%s Fail to alloc memory for pAd->CommonCfg.pTpcReqTab.\n",
+			  __func__));
 
 	return;
 }
 
-VOID TpcReqTabExit(
-	IN PRTMP_ADAPTER pAd)
+void TpcReqTabExit(struct rt_rtmp_adapter *pAd)
 {
-	NdisFreeSpinLock(pAd->CommonCfg.TpcReqTabLock);
+	NdisFreeSpinLock(&pAd->CommonCfg.TpcReqTabLock);
 
 	if (pAd->CommonCfg.pTpcReqTab)
 		kfree(pAd->CommonCfg.pTpcReqTab);
@@ -284,18 +621,16 @@ VOID TpcReqTabExit(
 	return;
 }
 
-static PTPC_REQ_ENTRY TpcReqLookUp(
-	IN PRTMP_ADAPTER	pAd,
-	IN UINT8			DialogToken)
+static struct rt_tpc_req_entry *TpcReqLookUp(struct rt_rtmp_adapter *pAd, u8 DialogToken)
 {
-	UINT HashIdx;
-	PTPC_REQ_TAB pTab = pAd->CommonCfg.pTpcReqTab;
-	PTPC_REQ_ENTRY pEntry = NULL;
-	PTPC_REQ_ENTRY pPrevEntry = NULL;
-
-	if (pTab == NULL)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("%s: pTpcReqTab doesn't exist.\n", __func__));
+	u32 HashIdx;
+	struct rt_tpc_req_tab *pTab = pAd->CommonCfg.pTpcReqTab;
+	struct rt_tpc_req_entry *pEntry = NULL;
+	struct rt_tpc_req_entry *pPrevEntry = NULL;
+
+	if (pTab == NULL) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("%s: pTpcReqTab doesn't exist.\n", __func__));
 		return NULL;
 	}
 
@@ -304,12 +639,10 @@ static PTPC_REQ_ENTRY TpcReqLookUp(
 	HashIdx = TPC_DIALOGTOKEN_HASH_INDEX(DialogToken);
 	pEntry = pTab->Hash[HashIdx];
 
-	while (pEntry)
-	{
+	while (pEntry) {
 		if (pEntry->DialogToken == DialogToken)
 			break;
-		else
-		{
+		else {
 			pPrevEntry = pEntry;
 			pEntry = pEntry->pNext;
 		}
@@ -320,51 +653,49 @@ static PTPC_REQ_ENTRY TpcReqLookUp(
 	return pEntry;
 }
 
-
-static PTPC_REQ_ENTRY TpcReqInsert(
-	IN PRTMP_ADAPTER	pAd,
-	IN UINT8			DialogToken)
+static struct rt_tpc_req_entry *TpcReqInsert(struct rt_rtmp_adapter *pAd, u8 DialogToken)
 {
-	INT i;
-	ULONG HashIdx;
-	PTPC_REQ_TAB pTab = pAd->CommonCfg.pTpcReqTab;
-	PTPC_REQ_ENTRY pEntry = NULL, pCurrEntry;
-	ULONG Now;
-
-	if(pTab == NULL)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("%s: pTpcReqTab doesn't exist.\n", __func__));
+	int i;
+	unsigned long HashIdx;
+	struct rt_tpc_req_tab *pTab = pAd->CommonCfg.pTpcReqTab;
+	struct rt_tpc_req_entry *pEntry = NULL, *pCurrEntry;
+	unsigned long Now;
+
+	if (pTab == NULL) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("%s: pTpcReqTab doesn't exist.\n", __func__));
 		return NULL;
 	}
 
 	pEntry = TpcReqLookUp(pAd, DialogToken);
-	if (pEntry == NULL)
-	{
+	if (pEntry == NULL) {
 		RTMP_SEM_LOCK(&pAd->CommonCfg.TpcReqTabLock);
-		for (i = 0; i < MAX_TPC_REQ_TAB_SIZE; i++)
-		{
+		for (i = 0; i < MAX_TPC_REQ_TAB_SIZE; i++) {
 			NdisGetSystemUpTime(&Now);
 			pEntry = &pTab->Content[i];
 
 			if ((pEntry->Valid == TRUE)
-				&& RTMP_TIME_AFTER((unsigned long)Now, (unsigned long)(pEntry->lastTime + TPC_REQ_AGE_OUT)))
+			    && RTMP_TIME_AFTER((unsigned long)Now,
+					       (unsigned long)(pEntry->
+							       lastTime +
+							       TPC_REQ_AGE_OUT)))
 			{
-				PTPC_REQ_ENTRY pPrevEntry = NULL;
-				ULONG HashIdx = TPC_DIALOGTOKEN_HASH_INDEX(pEntry->DialogToken);
-				PTPC_REQ_ENTRY pProbeEntry = pTab->Hash[HashIdx];
-
-				// update Hash list
-				do
-				{
-					if (pProbeEntry == pEntry)
-					{
-						if (pPrevEntry == NULL)
-						{
-							pTab->Hash[HashIdx] = pEntry->pNext;
-						}
-						else
-						{
-							pPrevEntry->pNext = pEntry->pNext;
+				struct rt_tpc_req_entry *pPrevEntry = NULL;
+				unsigned long HashIdx =
+				    TPC_DIALOGTOKEN_HASH_INDEX(pEntry->
+							       DialogToken);
+				struct rt_tpc_req_entry *pProbeEntry =
+				    pTab->Hash[HashIdx];
+
+				/* update Hash list */
+				do {
+					if (pProbeEntry == pEntry) {
+						if (pPrevEntry == NULL) {
+							pTab->Hash[HashIdx] =
+							    pEntry->pNext;
+						} else {
+							pPrevEntry->pNext =
+							    pEntry->pNext;
 						}
 						break;
 					}
@@ -373,7 +704,7 @@ static PTPC_REQ_ENTRY TpcReqInsert(
 					pProbeEntry = pProbeEntry->pNext;
 				} while (pProbeEntry);
 
-				NdisZeroMemory(pEntry, sizeof(TPC_REQ_ENTRY));
+				NdisZeroMemory(pEntry, sizeof(struct rt_tpc_req_entry));
 				pTab->Size--;
 
 				break;
@@ -383,30 +714,24 @@ static PTPC_REQ_ENTRY TpcReqInsert(
 				break;
 		}
 
-		if (i < MAX_TPC_REQ_TAB_SIZE)
-		{
+		if (i < MAX_TPC_REQ_TAB_SIZE) {
 			NdisGetSystemUpTime(&Now);
 			pEntry->lastTime = Now;
 			pEntry->Valid = TRUE;
 			pEntry->DialogToken = DialogToken;
 			pTab->Size++;
-		}
-		else
-		{
+		} else {
 			pEntry = NULL;
-			DBGPRINT(RT_DEBUG_ERROR, ("%s: pTpcReqTab tab full.\n", __func__));
+			DBGPRINT(RT_DEBUG_ERROR,
+				 ("%s: pTpcReqTab tab full.\n", __func__));
 		}
 
-		// add this Neighbor entry into HASH table
-		if (pEntry)
-		{
+		/* add this Neighbor entry into HASH table */
+		if (pEntry) {
 			HashIdx = TPC_DIALOGTOKEN_HASH_INDEX(DialogToken);
-			if (pTab->Hash[HashIdx] == NULL)
-			{
+			if (pTab->Hash[HashIdx] == NULL) {
 				pTab->Hash[HashIdx] = pEntry;
-			}
-			else
-			{
+			} else {
 				pCurrEntry = pTab->Hash[HashIdx];
 				while (pCurrEntry->pNext != NULL)
 					pCurrEntry = pCurrEntry->pNext;
@@ -420,45 +745,35 @@ static PTPC_REQ_ENTRY TpcReqInsert(
 	return pEntry;
 }
 
-static VOID TpcReqDelete(
-	IN PRTMP_ADAPTER	pAd,
-	IN UINT8			DialogToken)
+static void TpcReqDelete(struct rt_rtmp_adapter *pAd, u8 DialogToken)
 {
-	PTPC_REQ_TAB pTab = pAd->CommonCfg.pTpcReqTab;
-	PTPC_REQ_ENTRY pEntry = NULL;
+	struct rt_tpc_req_tab *pTab = pAd->CommonCfg.pTpcReqTab;
+	struct rt_tpc_req_entry *pEntry = NULL;
 
-	if(pTab == NULL)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("%s: pTpcReqTab doesn't exist.\n", __func__));
+	if (pTab == NULL) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("%s: pTpcReqTab doesn't exist.\n", __func__));
 		return;
 	}
-
-	// if empty, return
-	if (pTab->Size == 0)
-	{
+	/* if empty, return */
+	if (pTab->Size == 0) {
 		DBGPRINT(RT_DEBUG_ERROR, ("pTpcReqTab empty.\n"));
 		return;
 	}
 
 	pEntry = TpcReqLookUp(pAd, DialogToken);
-	if (pEntry != NULL)
-	{
-		PTPC_REQ_ENTRY pPrevEntry = NULL;
-		ULONG HashIdx = TPC_DIALOGTOKEN_HASH_INDEX(pEntry->DialogToken);
-		PTPC_REQ_ENTRY pProbeEntry = pTab->Hash[HashIdx];
+	if (pEntry != NULL) {
+		struct rt_tpc_req_entry *pPrevEntry = NULL;
+		unsigned long HashIdx = TPC_DIALOGTOKEN_HASH_INDEX(pEntry->DialogToken);
+		struct rt_tpc_req_entry *pProbeEntry = pTab->Hash[HashIdx];
 
 		RTMP_SEM_LOCK(&pAd->CommonCfg.TpcReqTabLock);
-		// update Hash list
-		do
-		{
-			if (pProbeEntry == pEntry)
-			{
-				if (pPrevEntry == NULL)
-				{
+		/* update Hash list */
+		do {
+			if (pProbeEntry == pEntry) {
+				if (pPrevEntry == NULL) {
 					pTab->Hash[HashIdx] = pEntry->pNext;
-				}
-				else
-				{
+				} else {
 					pPrevEntry->pNext = pEntry->pNext;
 				}
 				break;
@@ -468,7 +783,7 @@ static VOID TpcReqDelete(
 			pProbeEntry = pProbeEntry->pNext;
 		} while (pProbeEntry);
 
-		NdisZeroMemory(pEntry, sizeof(TPC_REQ_ENTRY));
+		NdisZeroMemory(pEntry, sizeof(struct rt_tpc_req_entry));
 		pTab->Size--;
 
 		RTMP_SEM_UNLOCK(&pAd->CommonCfg.TpcReqTabLock);
@@ -487,10 +802,9 @@ static VOID TpcReqDelete(
 	Return	: Current Time Stamp.
 	==========================================================================
  */
-static UINT64 GetCurrentTimeStamp(
-	IN PRTMP_ADAPTER pAd)
+static u64 GetCurrentTimeStamp(struct rt_rtmp_adapter *pAd)
 {
-	// get current time stamp.
+	/* get current time stamp. */
 	return 0;
 }
 
@@ -504,11 +818,73 @@ static UINT64 GetCurrentTimeStamp(
 	Return	: Current Time Stamp.
 	==========================================================================
  */
-static UINT8 GetCurTxPwr(
-	IN PRTMP_ADAPTER pAd,
-	IN UINT8 Wcid)
+static u8 GetCurTxPwr(struct rt_rtmp_adapter *pAd, u8 Wcid)
+{
+	return 16;		/* 16 dBm */
+}
+
+/*
+	==========================================================================
+	Description:
+		Get Current Transmit Power.
+
+	Parametrs:
+
+	Return	: Current Time Stamp.
+	==========================================================================
+ */
+void InsertChannelRepIE(struct rt_rtmp_adapter *pAd,
+			u8 *pFrameBuf,
+			unsigned long *pFrameLen,
+			char *pCountry, u8 RegulatoryClass)
 {
-	return 16; /* 16 dBm */
+	unsigned long TempLen;
+	u8 Len;
+	u8 IEId = IE_AP_CHANNEL_REPORT;
+	u8 *pChListPtr = NULL;
+
+	Len = 1;
+	if (strncmp(pCountry, "US", 2) == 0) {
+		if (RegulatoryClass >= USA_REGULATORY_INFO_SIZE) {
+			DBGPRINT(RT_DEBUG_ERROR,
+				 ("%s: USA Unknow Requlatory class (%d)\n",
+				  __func__, RegulatoryClass));
+			return;
+		}
+
+		Len +=
+		    USARegulatoryInfo[RegulatoryClass].ChannelSet.
+		    NumberOfChannels;
+		pChListPtr =
+		    USARegulatoryInfo[RegulatoryClass].ChannelSet.ChannelList;
+	} else if (strncmp(pCountry, "JP", 2) == 0) {
+		if (RegulatoryClass >= JP_REGULATORY_INFO_SIZE) {
+			DBGPRINT(RT_DEBUG_ERROR,
+				 ("%s: JP Unknow Requlatory class (%d)\n",
+				  __func__, RegulatoryClass));
+			return;
+		}
+
+		Len +=
+		    JapanRegulatoryInfo[RegulatoryClass].ChannelSet.
+		    NumberOfChannels;
+		pChListPtr =
+		    JapanRegulatoryInfo[RegulatoryClass].ChannelSet.ChannelList;
+	} else {
+		DBGPRINT(RT_DEBUG_ERROR, ("%s: Unknow Country (%s)\n",
+					  __func__, pCountry));
+		return;
+	}
+
+	MakeOutgoingFrame(pFrameBuf, &TempLen,
+			  1, &IEId,
+			  1, &Len,
+			  1, &RegulatoryClass,
+			  Len - 1, pChListPtr, END_OF_ARGS);
+
+	*pFrameLen = *pFrameLen + TempLen;
+
+	return;
 }
 
 /*
@@ -524,16 +900,12 @@ static UINT8 GetCurTxPwr(
 	Return	: None.
 	==========================================================================
  */
-static VOID InsertDialogToken(
-	IN PRTMP_ADAPTER pAd,
-	OUT PUCHAR pFrameBuf,
-	OUT PULONG pFrameLen,
-	IN UINT8 DialogToken)
+void InsertDialogToken(struct rt_rtmp_adapter *pAd,
+		       u8 *pFrameBuf,
+		       unsigned long *pFrameLen, u8 DialogToken)
 {
-	ULONG TempLen;
-	MakeOutgoingFrame(pFrameBuf,	&TempLen,
-					1,				&DialogToken,
-					END_OF_ARGS);
+	unsigned long TempLen;
+	MakeOutgoingFrame(pFrameBuf, &TempLen, 1, &DialogToken, END_OF_ARGS);
 
 	*pFrameLen = *pFrameLen + TempLen;
 
@@ -552,19 +924,15 @@ static VOID InsertDialogToken(
 	Return	: None.
 	==========================================================================
  */
- static VOID InsertTpcReqIE(
-	IN PRTMP_ADAPTER pAd,
-	OUT PUCHAR pFrameBuf,
-	OUT PULONG pFrameLen)
+static void InsertTpcReqIE(struct rt_rtmp_adapter *pAd,
+			   u8 *pFrameBuf, unsigned long *pFrameLen)
 {
-	ULONG TempLen;
-	ULONG Len = 0;
-	UINT8 ElementID = IE_TPC_REQUEST;
+	unsigned long TempLen;
+	unsigned long Len = 0;
+	u8 ElementID = IE_TPC_REQUEST;
 
-	MakeOutgoingFrame(pFrameBuf,					&TempLen,
-						1,							&ElementID,
-						1,							&Len,
-						END_OF_ARGS);
+	MakeOutgoingFrame(pFrameBuf, &TempLen,
+			  1, &ElementID, 1, &Len, END_OF_ARGS);
 
 	*pFrameLen = *pFrameLen + TempLen;
 
@@ -585,30 +953,25 @@ static VOID InsertDialogToken(
 	Return	: None.
 	==========================================================================
  */
- static VOID InsertTpcReportIE(
-	IN PRTMP_ADAPTER pAd,
-	OUT PUCHAR pFrameBuf,
-	OUT PULONG pFrameLen,
-	IN UINT8 TxPwr,
-	IN UINT8 LinkMargin)
+void InsertTpcReportIE(struct rt_rtmp_adapter *pAd,
+		       u8 *pFrameBuf,
+		       unsigned long *pFrameLen,
+		       u8 TxPwr, u8 LinkMargin)
 {
-	ULONG TempLen;
-	ULONG Len = sizeof(TPC_REPORT_INFO);
-	UINT8 ElementID = IE_TPC_REPORT;
-	TPC_REPORT_INFO TpcReportIE;
+	unsigned long TempLen;
+	unsigned long Len = sizeof(struct rt_tpc_report_info);
+	u8 ElementID = IE_TPC_REPORT;
+	struct rt_tpc_report_info TpcReportIE;
 
 	TpcReportIE.TxPwr = TxPwr;
 	TpcReportIE.LinkMargin = LinkMargin;
 
-	MakeOutgoingFrame(pFrameBuf,					&TempLen,
-						1,							&ElementID,
-						1,							&Len,
-						Len,						&TpcReportIE,
-						END_OF_ARGS);
+	MakeOutgoingFrame(pFrameBuf, &TempLen,
+			  1, &ElementID,
+			  1, &Len, Len, &TpcReportIE, END_OF_ARGS);
 
 	*pFrameLen = *pFrameLen + TempLen;
 
-
 	return;
 }
 
@@ -627,32 +990,26 @@ static VOID InsertDialogToken(
 	Return	: None.
 	==========================================================================
  */
-static VOID InsertChSwAnnIE(
-	IN PRTMP_ADAPTER pAd,
-	OUT PUCHAR pFrameBuf,
-	OUT PULONG pFrameLen,
-	IN UINT8 ChSwMode,
-	IN UINT8 NewChannel,
-	IN UINT8 ChSwCnt)
+static void InsertChSwAnnIE(struct rt_rtmp_adapter *pAd,
+			    u8 *pFrameBuf,
+			    unsigned long *pFrameLen,
+			    u8 ChSwMode,
+			    u8 NewChannel, u8 ChSwCnt)
 {
-	ULONG TempLen;
-	ULONG Len = sizeof(CH_SW_ANN_INFO);
-	UINT8 ElementID = IE_CHANNEL_SWITCH_ANNOUNCEMENT;
-	CH_SW_ANN_INFO ChSwAnnIE;
+	unsigned long TempLen;
+	unsigned long Len = sizeof(struct rt_ch_sw_ann_info);
+	u8 ElementID = IE_CHANNEL_SWITCH_ANNOUNCEMENT;
+	struct rt_ch_sw_ann_info ChSwAnnIE;
 
 	ChSwAnnIE.ChSwMode = ChSwMode;
 	ChSwAnnIE.Channel = NewChannel;
 	ChSwAnnIE.ChSwCnt = ChSwCnt;
 
-	MakeOutgoingFrame(pFrameBuf,				&TempLen,
-						1,						&ElementID,
-						1,						&Len,
-						Len,					&ChSwAnnIE,
-						END_OF_ARGS);
+	MakeOutgoingFrame(pFrameBuf, &TempLen,
+			  1, &ElementID, 1, &Len, Len, &ChSwAnnIE, END_OF_ARGS);
 
 	*pFrameLen = *pFrameLen + TempLen;
 
-
 	return;
 }
 
@@ -671,25 +1028,21 @@ static VOID InsertChSwAnnIE(
 		7. Measure Start time.
 		8. Measure Duration.
 
-
 	Return	: None.
 	==========================================================================
  */
-static VOID InsertMeasureReqIE(
-	IN PRTMP_ADAPTER pAd,
-	OUT PUCHAR pFrameBuf,
-	OUT PULONG pFrameLen,
-	IN PMEASURE_REQ_INFO pMeasureReqIE)
+static void InsertMeasureReqIE(struct rt_rtmp_adapter *pAd,
+			       u8 *pFrameBuf,
+			       unsigned long *pFrameLen,
+			       u8 Len, struct rt_measure_req_info * pMeasureReqIE)
 {
-	ULONG TempLen;
-	UINT8 Len = sizeof(MEASURE_REQ_INFO);
-	UINT8 ElementID = IE_MEASUREMENT_REQUEST;
+	unsigned long TempLen;
+	u8 ElementID = IE_MEASUREMENT_REQUEST;
 
-	MakeOutgoingFrame(pFrameBuf,					&TempLen,
-						1,							&ElementID,
-						1,							&Len,
-						Len,						pMeasureReqIE,
-						END_OF_ARGS);
+	MakeOutgoingFrame(pFrameBuf, &TempLen,
+			  1, &ElementID,
+			  1, &Len,
+			  sizeof(struct rt_measure_req_info), pMeasureReqIE, END_OF_ARGS);
 
 	*pFrameLen = *pFrameLen + TempLen;
 
@@ -713,33 +1066,27 @@ static VOID InsertMeasureReqIE(
 	Return	: None.
 	==========================================================================
  */
-static VOID InsertMeasureReportIE(
-	IN PRTMP_ADAPTER pAd,
-	OUT PUCHAR pFrameBuf,
-	OUT PULONG pFrameLen,
-	IN PMEASURE_REPORT_INFO pMeasureReportIE,
-	IN UINT8 ReportLnfoLen,
-	IN PUINT8 pReportInfo)
+static void InsertMeasureReportIE(struct rt_rtmp_adapter *pAd,
+				  u8 *pFrameBuf,
+				  unsigned long *pFrameLen,
+				  struct rt_measure_report_info * pMeasureReportIE,
+				  u8 ReportLnfoLen, u8 *pReportInfo)
 {
-	ULONG TempLen;
-	ULONG Len;
-	UINT8 ElementID = IE_MEASUREMENT_REPORT;
+	unsigned long TempLen;
+	unsigned long Len;
+	u8 ElementID = IE_MEASUREMENT_REPORT;
 
-	Len = sizeof(MEASURE_REPORT_INFO) + ReportLnfoLen;
+	Len = sizeof(struct rt_measure_report_info) + ReportLnfoLen;
 
-	MakeOutgoingFrame(pFrameBuf,					&TempLen,
-						1,							&ElementID,
-						1,							&Len,
-						Len,						pMeasureReportIE,
-						END_OF_ARGS);
+	MakeOutgoingFrame(pFrameBuf, &TempLen,
+			  1, &ElementID,
+			  1, &Len, Len, pMeasureReportIE, END_OF_ARGS);
 
 	*pFrameLen = *pFrameLen + TempLen;
 
-	if ((ReportLnfoLen > 0) && (pReportInfo != NULL))
-	{
-		MakeOutgoingFrame(pFrameBuf + *pFrameLen,		&TempLen,
-							ReportLnfoLen,				pReportInfo,
-							END_OF_ARGS);
+	if ((ReportLnfoLen > 0) && (pReportInfo != NULL)) {
+		MakeOutgoingFrame(pFrameBuf + *pFrameLen, &TempLen,
+				  ReportLnfoLen, pReportInfo, END_OF_ARGS);
 
 		*pFrameLen = *pFrameLen + TempLen;
 	}
@@ -758,53 +1105,40 @@ static VOID InsertMeasureReportIE(
 	Return	: None.
 	==========================================================================
  */
-VOID EnqueueMeasurementReq(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR pDA,
-	IN UINT8 MeasureToken,
-	IN UINT8 MeasureReqMode,
-	IN UINT8 MeasureReqType,
-	IN UINT8 MeasureCh,
-	IN UINT16 MeasureDuration)
+void MakeMeasurementReqFrame(struct rt_rtmp_adapter *pAd,
+			     u8 *pOutBuffer,
+			     unsigned long *pFrameLen,
+			     u8 TotalLen,
+			     u8 Category,
+			     u8 Action,
+			     u8 MeasureToken,
+			     u8 MeasureReqMode,
+			     u8 MeasureReqType, u8 NumOfRepetitions)
 {
-	PUCHAR pOutBuffer = NULL;
-	NDIS_STATUS NStatus;
-	ULONG FrameLen;
-	HEADER_802_11 ActHdr;
-	MEASURE_REQ_INFO MeasureReqIE;
-	UINT8 RmReqDailogToken = RandomByte(pAd);
-	UINT64 MeasureStartTime = GetCurrentTimeStamp(pAd);
-
-	// build action frame header.
-	MgtMacHeaderInit(pAd, &ActHdr, SUBTYPE_ACTION, 0, pDA,
-						pAd->CurrentAddress);
+	unsigned long TempLen;
+	struct rt_measure_req_info MeasureReqIE;
 
-	NStatus = MlmeAllocateMemory(pAd, (PVOID)&pOutBuffer);  //Get an unused nonpaged memory
-	if(NStatus != NDIS_STATUS_SUCCESS)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("%s() allocate memory failed \n", __func__));
-		return;
-	}
-	NdisMoveMemory(pOutBuffer, (PCHAR)&ActHdr, sizeof(HEADER_802_11));
-	FrameLen = sizeof(HEADER_802_11);
+	InsertActField(pAd, (pOutBuffer + *pFrameLen), pFrameLen, Category,
+		       Action);
 
-	InsertActField(pAd, (pOutBuffer + FrameLen), &FrameLen, CATEGORY_SPECTRUM, SPEC_MRQ);
+	/* fill Dialog Token */
+	InsertDialogToken(pAd, (pOutBuffer + *pFrameLen), pFrameLen,
+			  MeasureToken);
 
-	// fill Dialog Token
-	InsertDialogToken(pAd, (pOutBuffer + FrameLen), &FrameLen, MeasureToken);
+	/* fill Number of repetitions. */
+	if (Category == CATEGORY_RM) {
+		MakeOutgoingFrame((pOutBuffer + *pFrameLen), &TempLen,
+				  2, &NumOfRepetitions, END_OF_ARGS);
 
-	// prepare Measurement IE.
-	NdisZeroMemory(&MeasureReqIE, sizeof(MEASURE_REQ_INFO));
-	MeasureReqIE.Token = RmReqDailogToken;
+		*pFrameLen += TempLen;
+	}
+	/* prepare Measurement IE. */
+	NdisZeroMemory(&MeasureReqIE, sizeof(struct rt_measure_req_info));
+	MeasureReqIE.Token = MeasureToken;
 	MeasureReqIE.ReqMode.word = MeasureReqMode;
 	MeasureReqIE.ReqType = MeasureReqType;
-	MeasureReqIE.MeasureReq.ChNum = MeasureCh;
-	MeasureReqIE.MeasureReq.MeasureStartTime = cpu2le64(MeasureStartTime);
-	MeasureReqIE.MeasureReq.MeasureDuration = cpu2le16(MeasureDuration);
-	InsertMeasureReqIE(pAd, (pOutBuffer + FrameLen), &FrameLen, &MeasureReqIE);
-
-	MiniportMMRequest(pAd, QID_AC_BE, pOutBuffer, FrameLen);
-	MlmeFreeMemory(pAd, pOutBuffer);
+	InsertMeasureReqIE(pAd, (pOutBuffer + *pFrameLen), pFrameLen,
+			   TotalLen, &MeasureReqIE);
 
 	return;
 }
@@ -821,46 +1155,46 @@ VOID EnqueueMeasurementReq(
 	Return	: None.
 	==========================================================================
  */
-VOID EnqueueMeasurementRep(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR pDA,
-	IN UINT8 DialogToken,
-	IN UINT8 MeasureToken,
-	IN UINT8 MeasureReqMode,
-	IN UINT8 MeasureReqType,
-	IN UINT8 ReportInfoLen,
-	IN PUINT8 pReportInfo)
+void EnqueueMeasurementRep(struct rt_rtmp_adapter *pAd,
+			   u8 *pDA,
+			   u8 DialogToken,
+			   u8 MeasureToken,
+			   u8 MeasureReqMode,
+			   u8 MeasureReqType,
+			   u8 ReportInfoLen, u8 *pReportInfo)
 {
-	PUCHAR pOutBuffer = NULL;
-	NDIS_STATUS NStatus;
-	ULONG FrameLen;
-	HEADER_802_11 ActHdr;
-	MEASURE_REPORT_INFO MeasureRepIE;
+	u8 *pOutBuffer = NULL;
+	int NStatus;
+	unsigned long FrameLen;
+	struct rt_header_802_11 ActHdr;
+	struct rt_measure_report_info MeasureRepIE;
 
-	// build action frame header.
+	/* build action frame header. */
 	MgtMacHeaderInit(pAd, &ActHdr, SUBTYPE_ACTION, 0, pDA,
-						pAd->CurrentAddress);
+			 pAd->CurrentAddress);
 
-	NStatus = MlmeAllocateMemory(pAd, (PVOID)&pOutBuffer);  //Get an unused nonpaged memory
-	if(NStatus != NDIS_STATUS_SUCCESS)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("%s() allocate memory failed \n", __func__));
+	NStatus = MlmeAllocateMemory(pAd, (void *)& pOutBuffer);	/*Get an unused nonpaged memory */
+	if (NStatus != NDIS_STATUS_SUCCESS) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("%s() allocate memory failed \n", __func__));
 		return;
 	}
-	NdisMoveMemory(pOutBuffer, (PCHAR)&ActHdr, sizeof(HEADER_802_11));
-	FrameLen = sizeof(HEADER_802_11);
+	NdisMoveMemory(pOutBuffer, (char *)& ActHdr, sizeof(struct rt_header_802_11));
+	FrameLen = sizeof(struct rt_header_802_11);
 
-	InsertActField(pAd, (pOutBuffer + FrameLen), &FrameLen, CATEGORY_SPECTRUM, SPEC_MRP);
+	InsertActField(pAd, (pOutBuffer + FrameLen), &FrameLen,
+		       CATEGORY_SPECTRUM, SPEC_MRP);
 
-	// fill Dialog Token
+	/* fill Dialog Token */
 	InsertDialogToken(pAd, (pOutBuffer + FrameLen), &FrameLen, DialogToken);
 
-	// prepare Measurement IE.
-	NdisZeroMemory(&MeasureRepIE, sizeof(MEASURE_REPORT_INFO));
+	/* prepare Measurement IE. */
+	NdisZeroMemory(&MeasureRepIE, sizeof(struct rt_measure_report_info));
 	MeasureRepIE.Token = MeasureToken;
-	MeasureRepIE.ReportMode.word = MeasureReqMode;
+	MeasureRepIE.ReportMode = MeasureReqMode;
 	MeasureRepIE.ReportType = MeasureReqType;
-	InsertMeasureReportIE(pAd, (pOutBuffer + FrameLen), &FrameLen, &MeasureRepIE, ReportInfoLen, pReportInfo);
+	InsertMeasureReportIE(pAd, (pOutBuffer + FrameLen), &FrameLen,
+			      &MeasureRepIE, ReportInfoLen, pReportInfo);
 
 	MiniportMMRequest(pAd, QID_AC_BE, pOutBuffer, FrameLen);
 	MlmeFreeMemory(pAd, pOutBuffer);
@@ -880,36 +1214,34 @@ VOID EnqueueMeasurementRep(
 	Return	: None.
 	==========================================================================
  */
-VOID EnqueueTPCReq(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR pDA,
-	IN UCHAR DialogToken)
+void EnqueueTPCReq(struct rt_rtmp_adapter *pAd, u8 *pDA, u8 DialogToken)
 {
-	PUCHAR pOutBuffer = NULL;
-	NDIS_STATUS NStatus;
-	ULONG FrameLen;
+	u8 *pOutBuffer = NULL;
+	int NStatus;
+	unsigned long FrameLen;
 
-	HEADER_802_11 ActHdr;
+	struct rt_header_802_11 ActHdr;
 
-	// build action frame header.
+	/* build action frame header. */
 	MgtMacHeaderInit(pAd, &ActHdr, SUBTYPE_ACTION, 0, pDA,
-						pAd->CurrentAddress);
+			 pAd->CurrentAddress);
 
-	NStatus = MlmeAllocateMemory(pAd, (PVOID)&pOutBuffer);  //Get an unused nonpaged memory
-	if(NStatus != NDIS_STATUS_SUCCESS)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("%s() allocate memory failed \n", __func__));
+	NStatus = MlmeAllocateMemory(pAd, (void *)& pOutBuffer);	/*Get an unused nonpaged memory */
+	if (NStatus != NDIS_STATUS_SUCCESS) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("%s() allocate memory failed \n", __func__));
 		return;
 	}
-	NdisMoveMemory(pOutBuffer, (PCHAR)&ActHdr, sizeof(HEADER_802_11));
-	FrameLen = sizeof(HEADER_802_11);
+	NdisMoveMemory(pOutBuffer, (char *)& ActHdr, sizeof(struct rt_header_802_11));
+	FrameLen = sizeof(struct rt_header_802_11);
 
-	InsertActField(pAd, (pOutBuffer + FrameLen), &FrameLen, CATEGORY_SPECTRUM, SPEC_TPCRQ);
+	InsertActField(pAd, (pOutBuffer + FrameLen), &FrameLen,
+		       CATEGORY_SPECTRUM, SPEC_TPCRQ);
 
-	// fill Dialog Token
+	/* fill Dialog Token */
 	InsertDialogToken(pAd, (pOutBuffer + FrameLen), &FrameLen, DialogToken);
 
-	// Insert TPC Request IE.
+	/* Insert TPC Request IE. */
 	InsertTpcReqIE(pAd, (pOutBuffer + FrameLen), &FrameLen);
 
 	MiniportMMRequest(pAd, QID_AC_BE, pOutBuffer, FrameLen);
@@ -930,39 +1262,38 @@ VOID EnqueueTPCReq(
 	Return	: None.
 	==========================================================================
  */
-VOID EnqueueTPCRep(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR pDA,
-	IN UINT8 DialogToken,
-	IN UINT8 TxPwr,
-	IN UINT8 LinkMargin)
+void EnqueueTPCRep(struct rt_rtmp_adapter *pAd,
+		   u8 *pDA,
+		   u8 DialogToken, u8 TxPwr, u8 LinkMargin)
 {
-	PUCHAR pOutBuffer = NULL;
-	NDIS_STATUS NStatus;
-	ULONG FrameLen;
+	u8 *pOutBuffer = NULL;
+	int NStatus;
+	unsigned long FrameLen;
 
-	HEADER_802_11 ActHdr;
+	struct rt_header_802_11 ActHdr;
 
-	// build action frame header.
+	/* build action frame header. */
 	MgtMacHeaderInit(pAd, &ActHdr, SUBTYPE_ACTION, 0, pDA,
-						pAd->CurrentAddress);
+			 pAd->CurrentAddress);
 
-	NStatus = MlmeAllocateMemory(pAd, (PVOID)&pOutBuffer);  //Get an unused nonpaged memory
-	if(NStatus != NDIS_STATUS_SUCCESS)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("%s() allocate memory failed \n", __func__));
+	NStatus = MlmeAllocateMemory(pAd, (void *)& pOutBuffer);	/*Get an unused nonpaged memory */
+	if (NStatus != NDIS_STATUS_SUCCESS) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("%s() allocate memory failed \n", __func__));
 		return;
 	}
-	NdisMoveMemory(pOutBuffer, (PCHAR)&ActHdr, sizeof(HEADER_802_11));
-	FrameLen = sizeof(HEADER_802_11);
+	NdisMoveMemory(pOutBuffer, (char *)& ActHdr, sizeof(struct rt_header_802_11));
+	FrameLen = sizeof(struct rt_header_802_11);
 
-	InsertActField(pAd, (pOutBuffer + FrameLen), &FrameLen, CATEGORY_SPECTRUM, SPEC_TPCRP);
+	InsertActField(pAd, (pOutBuffer + FrameLen), &FrameLen,
+		       CATEGORY_SPECTRUM, SPEC_TPCRP);
 
-	// fill Dialog Token
+	/* fill Dialog Token */
 	InsertDialogToken(pAd, (pOutBuffer + FrameLen), &FrameLen, DialogToken);
 
-	// Insert TPC Request IE.
-	InsertTpcReportIE(pAd, (pOutBuffer + FrameLen), &FrameLen, TxPwr, LinkMargin);
+	/* Insert TPC Request IE. */
+	InsertTpcReportIE(pAd, (pOutBuffer + FrameLen), &FrameLen, TxPwr,
+			  LinkMargin);
 
 	MiniportMMRequest(pAd, QID_AC_BE, pOutBuffer, FrameLen);
 	MlmeFreeMemory(pAd, pOutBuffer);
@@ -984,34 +1315,33 @@ VOID EnqueueTPCRep(
 	Return	: None.
 	==========================================================================
  */
-VOID EnqueueChSwAnn(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR pDA,
-	IN UINT8 ChSwMode,
-	IN UINT8 NewCh)
+void EnqueueChSwAnn(struct rt_rtmp_adapter *pAd,
+		    u8 *pDA, u8 ChSwMode, u8 NewCh)
 {
-	PUCHAR pOutBuffer = NULL;
-	NDIS_STATUS NStatus;
-	ULONG FrameLen;
+	u8 *pOutBuffer = NULL;
+	int NStatus;
+	unsigned long FrameLen;
 
-	HEADER_802_11 ActHdr;
+	struct rt_header_802_11 ActHdr;
 
-	// build action frame header.
+	/* build action frame header. */
 	MgtMacHeaderInit(pAd, &ActHdr, SUBTYPE_ACTION, 0, pDA,
-						pAd->CurrentAddress);
+			 pAd->CurrentAddress);
 
-	NStatus = MlmeAllocateMemory(pAd, (PVOID)&pOutBuffer);  //Get an unused nonpaged memory
-	if(NStatus != NDIS_STATUS_SUCCESS)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("%s() allocate memory failed \n", __func__));
+	NStatus = MlmeAllocateMemory(pAd, (void *)& pOutBuffer);	/*Get an unused nonpaged memory */
+	if (NStatus != NDIS_STATUS_SUCCESS) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("%s() allocate memory failed \n", __func__));
 		return;
 	}
-	NdisMoveMemory(pOutBuffer, (PCHAR)&ActHdr, sizeof(HEADER_802_11));
-	FrameLen = sizeof(HEADER_802_11);
+	NdisMoveMemory(pOutBuffer, (char *)& ActHdr, sizeof(struct rt_header_802_11));
+	FrameLen = sizeof(struct rt_header_802_11);
 
-	InsertActField(pAd, (pOutBuffer + FrameLen), &FrameLen, CATEGORY_SPECTRUM, SPEC_CHANNEL_SWITCH);
+	InsertActField(pAd, (pOutBuffer + FrameLen), &FrameLen,
+		       CATEGORY_SPECTRUM, SPEC_CHANNEL_SWITCH);
 
-	InsertChSwAnnIE(pAd, (pOutBuffer + FrameLen), &FrameLen, ChSwMode, NewCh, 0);
+	InsertChSwAnnIE(pAd, (pOutBuffer + FrameLen), &FrameLen, ChSwMode,
+			NewCh, 0);
 
 	MiniportMMRequest(pAd, QID_AC_BE, pOutBuffer, FrameLen);
 	MlmeFreeMemory(pAd, pOutBuffer);
@@ -1019,55 +1349,43 @@ VOID EnqueueChSwAnn(
 	return;
 }
 
-static BOOLEAN DfsRequirementCheck(
-	IN PRTMP_ADAPTER pAd,
-	IN UINT8 Channel)
+static BOOLEAN DfsRequirementCheck(struct rt_rtmp_adapter *pAd, u8 Channel)
 {
 	BOOLEAN Result = FALSE;
-	INT i;
+	int i;
 
-	do
-	{
-		// check DFS procedure is running.
-		// make sure DFS procedure won't start twice.
-		if (pAd->CommonCfg.RadarDetect.RDMode != RD_NORMAL_MODE)
-		{
+	do {
+		/* check DFS procedure is running. */
+		/* make sure DFS procedure won't start twice. */
+		if (pAd->CommonCfg.RadarDetect.RDMode != RD_NORMAL_MODE) {
 			Result = FALSE;
 			break;
 		}
-
-		// check the new channel carried from Channel Switch Announcemnet is valid.
-		for (i=0; i<pAd->ChannelListNum; i++)
-		{
+		/* check the new channel carried from Channel Switch Announcemnet is valid. */
+		for (i = 0; i < pAd->ChannelListNum; i++) {
 			if ((Channel == pAd->ChannelList[i].Channel)
-				&&(pAd->ChannelList[i].RemainingTimeForUse == 0))
-			{
-				// found radar signal in the channel. the channel can't use at least for 30 minutes.
-				pAd->ChannelList[i].RemainingTimeForUse = 1800;//30 min = 1800 sec
+			    && (pAd->ChannelList[i].RemainingTimeForUse == 0)) {
+				/* found radar signal in the channel. the channel can't use at least for 30 minutes. */
+				pAd->ChannelList[i].RemainingTimeForUse = 1800;	/*30 min = 1800 sec */
 				Result = TRUE;
 				break;
 			}
 		}
-	} while(FALSE);
+	} while (FALSE);
 
 	return Result;
 }
 
-VOID NotifyChSwAnnToPeerAPs(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR pRA,
-	IN PUCHAR pTA,
-	IN UINT8 ChSwMode,
-	IN UINT8 Channel)
+void NotifyChSwAnnToPeerAPs(struct rt_rtmp_adapter *pAd,
+			    u8 *pRA,
+			    u8 *pTA, u8 ChSwMode, u8 Channel)
 {
 }
 
-static VOID StartDFSProcedure(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR Channel,
-	IN UINT8 ChSwMode)
+static void StartDFSProcedure(struct rt_rtmp_adapter *pAd,
+			      u8 Channel, u8 ChSwMode)
 {
-	// start DFS procedure
+	/* start DFS procedure */
 	pAd->CommonCfg.Channel = Channel;
 
 	N_ChannelCheck(pAd);
@@ -1086,7 +1404,6 @@ static VOID StartDFSProcedure(
 		2. message length.
 		3. Channel switch announcement infomation buffer.
 
-
 	Return	: None.
 	==========================================================================
  */
@@ -1098,44 +1415,45 @@ static VOID StartDFSProcedure(
   +----+-----+-----------+------------+-----------+
     1    1        1           1            1
 */
-static BOOLEAN PeerChSwAnnSanity(
-	IN PRTMP_ADAPTER pAd,
-	IN VOID *pMsg,
-	IN ULONG MsgLen,
-	OUT PCH_SW_ANN_INFO pChSwAnnInfo)
+static BOOLEAN PeerChSwAnnSanity(struct rt_rtmp_adapter *pAd,
+				 void * pMsg,
+				 unsigned long MsgLen,
+				 struct rt_ch_sw_ann_info * pChSwAnnInfo)
 {
-	PFRAME_802_11 Fr = (PFRAME_802_11)pMsg;
-	PUCHAR pFramePtr = Fr->Octet;
+	struct rt_frame_802_11 * Fr = (struct rt_frame_802_11 *) pMsg;
+	u8 *pFramePtr = Fr->Octet;
 	BOOLEAN result = FALSE;
-	PEID_STRUCT eid_ptr;
+	struct rt_eid * eid_ptr;
 
-	// skip 802.11 header.
-	MsgLen -= sizeof(HEADER_802_11);
+	/* skip 802.11 header. */
+	MsgLen -= sizeof(struct rt_header_802_11);
 
-	// skip category and action code.
+	/* skip category and action code. */
 	pFramePtr += 2;
 	MsgLen -= 2;
 
 	if (pChSwAnnInfo == NULL)
 		return result;
 
-	eid_ptr = (PEID_STRUCT)pFramePtr;
-	while (((UCHAR*)eid_ptr + eid_ptr->Len + 1) < ((PUCHAR)pFramePtr + MsgLen))
-	{
-		switch(eid_ptr->Eid)
-		{
-			case IE_CHANNEL_SWITCH_ANNOUNCEMENT:
-				NdisMoveMemory(&pChSwAnnInfo->ChSwMode, eid_ptr->Octet, 1);
-				NdisMoveMemory(&pChSwAnnInfo->Channel, eid_ptr->Octet + 1, 1);
-				NdisMoveMemory(&pChSwAnnInfo->ChSwCnt, eid_ptr->Octet + 2, 1);
-
-				result = TRUE;
-                break;
+	eid_ptr = (struct rt_eid *) pFramePtr;
+	while (((u8 *) eid_ptr + eid_ptr->Len + 1) <
+	       ((u8 *)pFramePtr + MsgLen)) {
+		switch (eid_ptr->Eid) {
+		case IE_CHANNEL_SWITCH_ANNOUNCEMENT:
+			NdisMoveMemory(&pChSwAnnInfo->ChSwMode, eid_ptr->Octet,
+				       1);
+			NdisMoveMemory(&pChSwAnnInfo->Channel,
+				       eid_ptr->Octet + 1, 1);
+			NdisMoveMemory(&pChSwAnnInfo->ChSwCnt,
+				       eid_ptr->Octet + 2, 1);
+
+			result = TRUE;
+			break;
 
-			default:
-				break;
+		default:
+			break;
 		}
-		eid_ptr = (PEID_STRUCT)((UCHAR*)eid_ptr + 2 + eid_ptr->Len);
+		eid_ptr = (struct rt_eid *) ((u8 *) eid_ptr + 2 + eid_ptr->Len);
 	}
 
 	return result;
@@ -1154,25 +1472,25 @@ static BOOLEAN PeerChSwAnnSanity(
 	Return	: None.
 	==========================================================================
  */
-static BOOLEAN PeerMeasureReqSanity(
-	IN PRTMP_ADAPTER pAd,
-	IN VOID *pMsg,
-	IN ULONG MsgLen,
-	OUT PUINT8 pDialogToken,
-	OUT PMEASURE_REQ_INFO pMeasureReqInfo)
+static BOOLEAN PeerMeasureReqSanity(struct rt_rtmp_adapter *pAd,
+				    void * pMsg,
+				    unsigned long MsgLen,
+				    u8 *pDialogToken,
+				    struct rt_measure_req_info * pMeasureReqInfo,
+				    struct rt_measure_req * pMeasureReq)
 {
-	PFRAME_802_11 Fr = (PFRAME_802_11)pMsg;
-	PUCHAR pFramePtr = Fr->Octet;
+	struct rt_frame_802_11 * Fr = (struct rt_frame_802_11 *) pMsg;
+	u8 *pFramePtr = Fr->Octet;
 	BOOLEAN result = FALSE;
-	PEID_STRUCT eid_ptr;
-	PUCHAR ptr;
-	UINT64 MeasureStartTime;
-	UINT16 MeasureDuration;
+	struct rt_eid * eid_ptr;
+	u8 *ptr;
+	u64 MeasureStartTime;
+	u16 MeasureDuration;
 
-	// skip 802.11 header.
-	MsgLen -= sizeof(HEADER_802_11);
+	/* skip 802.11 header. */
+	MsgLen -= sizeof(struct rt_header_802_11);
 
-	// skip category and action code.
+	/* skip category and action code. */
 	pFramePtr += 2;
 	MsgLen -= 2;
 
@@ -1183,29 +1501,32 @@ static BOOLEAN PeerMeasureReqSanity(
 	pFramePtr += 1;
 	MsgLen -= 1;
 
-	eid_ptr = (PEID_STRUCT)pFramePtr;
-	while (((UCHAR*)eid_ptr + eid_ptr->Len + 1) < ((PUCHAR)pFramePtr + MsgLen))
-	{
-		switch(eid_ptr->Eid)
-		{
-			case IE_MEASUREMENT_REQUEST:
-				NdisMoveMemory(&pMeasureReqInfo->Token, eid_ptr->Octet, 1);
-				NdisMoveMemory(&pMeasureReqInfo->ReqMode.word, eid_ptr->Octet + 1, 1);
-				NdisMoveMemory(&pMeasureReqInfo->ReqType, eid_ptr->Octet + 2, 1);
-				ptr = eid_ptr->Octet + 3;
-				NdisMoveMemory(&pMeasureReqInfo->MeasureReq.ChNum, ptr, 1);
-				NdisMoveMemory(&MeasureStartTime, ptr + 1, 8);
-				pMeasureReqInfo->MeasureReq.MeasureStartTime = SWAP64(MeasureStartTime);
-				NdisMoveMemory(&MeasureDuration, ptr + 9, 2);
-				pMeasureReqInfo->MeasureReq.MeasureDuration = SWAP16(MeasureDuration);
-
-				result = TRUE;
-				break;
+	eid_ptr = (struct rt_eid *) pFramePtr;
+	while (((u8 *) eid_ptr + eid_ptr->Len + 1) <
+	       ((u8 *)pFramePtr + MsgLen)) {
+		switch (eid_ptr->Eid) {
+		case IE_MEASUREMENT_REQUEST:
+			NdisMoveMemory(&pMeasureReqInfo->Token, eid_ptr->Octet,
+				       1);
+			NdisMoveMemory(&pMeasureReqInfo->ReqMode.word,
+				       eid_ptr->Octet + 1, 1);
+			NdisMoveMemory(&pMeasureReqInfo->ReqType,
+				       eid_ptr->Octet + 2, 1);
+			ptr = (u8 *)(eid_ptr->Octet + 3);
+			NdisMoveMemory(&pMeasureReq->ChNum, ptr, 1);
+			NdisMoveMemory(&MeasureStartTime, ptr + 1, 8);
+			pMeasureReq->MeasureStartTime =
+			    SWAP64(MeasureStartTime);
+			NdisMoveMemory(&MeasureDuration, ptr + 9, 2);
+			pMeasureReq->MeasureDuration = SWAP16(MeasureDuration);
+
+			result = TRUE;
+			break;
 
-			default:
-				break;
+		default:
+			break;
 		}
-		eid_ptr = (PEID_STRUCT)((UCHAR*)eid_ptr + 2 + eid_ptr->Len);
+		eid_ptr = (struct rt_eid *) ((u8 *) eid_ptr + 2 + eid_ptr->Len);
 	}
 
 	return result;
@@ -1245,24 +1566,24 @@ static BOOLEAN PeerMeasureReqSanity(
   +-----+---------------+---------------------+-------+------------+----------+
      0          1                  2              3         4          5-7
 */
-static BOOLEAN PeerMeasureReportSanity(
-	IN PRTMP_ADAPTER pAd,
-	IN VOID *pMsg,
-	IN ULONG MsgLen,
-	OUT PUINT8 pDialogToken,
-	OUT PMEASURE_REPORT_INFO pMeasureReportInfo,
-	OUT PUINT8 pReportBuf)
+static BOOLEAN PeerMeasureReportSanity(struct rt_rtmp_adapter *pAd,
+				       void * pMsg,
+				       unsigned long MsgLen,
+				       u8 *pDialogToken,
+				       struct rt_measure_report_info *
+				       pMeasureReportInfo,
+				       u8 *pReportBuf)
 {
-	PFRAME_802_11 Fr = (PFRAME_802_11)pMsg;
-	PUCHAR pFramePtr = Fr->Octet;
+	struct rt_frame_802_11 * Fr = (struct rt_frame_802_11 *) pMsg;
+	u8 *pFramePtr = Fr->Octet;
 	BOOLEAN result = FALSE;
-	PEID_STRUCT eid_ptr;
-	PUCHAR ptr;
+	struct rt_eid * eid_ptr;
+	u8 *ptr;
 
-	// skip 802.11 header.
-	MsgLen -= sizeof(HEADER_802_11);
+	/* skip 802.11 header. */
+	MsgLen -= sizeof(struct rt_header_802_11);
 
-	// skip category and action code.
+	/* skip category and action code. */
 	pFramePtr += 2;
 	MsgLen -= 2;
 
@@ -1273,51 +1594,60 @@ static BOOLEAN PeerMeasureReportSanity(
 	pFramePtr += 1;
 	MsgLen -= 1;
 
-	eid_ptr = (PEID_STRUCT)pFramePtr;
-	while (((UCHAR*)eid_ptr + eid_ptr->Len + 1) < ((PUCHAR)pFramePtr + MsgLen))
-	{
-		switch(eid_ptr->Eid)
-		{
-			case IE_MEASUREMENT_REPORT:
-				NdisMoveMemory(&pMeasureReportInfo->Token, eid_ptr->Octet, 1);
-				NdisMoveMemory(&pMeasureReportInfo->ReportMode, eid_ptr->Octet + 1, 1);
-				NdisMoveMemory(&pMeasureReportInfo->ReportType, eid_ptr->Octet + 2, 1);
-				if (pMeasureReportInfo->ReportType == RM_BASIC)
-				{
-					PMEASURE_BASIC_REPORT pReport = (PMEASURE_BASIC_REPORT)pReportBuf;
-					ptr = eid_ptr->Octet + 3;
-					NdisMoveMemory(&pReport->ChNum, ptr, 1);
-					NdisMoveMemory(&pReport->MeasureStartTime, ptr + 1, 8);
-					NdisMoveMemory(&pReport->MeasureDuration, ptr + 9, 2);
-					NdisMoveMemory(&pReport->Map, ptr + 11, 1);
-
-				}
-				else if (pMeasureReportInfo->ReportType == RM_CCA)
-				{
-					PMEASURE_CCA_REPORT pReport = (PMEASURE_CCA_REPORT)pReportBuf;
-					ptr = eid_ptr->Octet + 3;
-					NdisMoveMemory(&pReport->ChNum, ptr, 1);
-					NdisMoveMemory(&pReport->MeasureStartTime, ptr + 1, 8);
-					NdisMoveMemory(&pReport->MeasureDuration, ptr + 9, 2);
-					NdisMoveMemory(&pReport->CCA_Busy_Fraction, ptr + 11, 1);
-
-				}
-				else if (pMeasureReportInfo->ReportType == RM_RPI_HISTOGRAM)
-				{
-					PMEASURE_RPI_REPORT pReport = (PMEASURE_RPI_REPORT)pReportBuf;
-					ptr = eid_ptr->Octet + 3;
-					NdisMoveMemory(&pReport->ChNum, ptr, 1);
-					NdisMoveMemory(&pReport->MeasureStartTime, ptr + 1, 8);
-					NdisMoveMemory(&pReport->MeasureDuration, ptr + 9, 2);
-					NdisMoveMemory(&pReport->RPI_Density, ptr + 11, 8);
-				}
-				result = TRUE;
-                break;
+	eid_ptr = (struct rt_eid *) pFramePtr;
+	while (((u8 *) eid_ptr + eid_ptr->Len + 1) <
+	       ((u8 *)pFramePtr + MsgLen)) {
+		switch (eid_ptr->Eid) {
+		case IE_MEASUREMENT_REPORT:
+			NdisMoveMemory(&pMeasureReportInfo->Token,
+				       eid_ptr->Octet, 1);
+			NdisMoveMemory(&pMeasureReportInfo->ReportMode,
+				       eid_ptr->Octet + 1, 1);
+			NdisMoveMemory(&pMeasureReportInfo->ReportType,
+				       eid_ptr->Octet + 2, 1);
+			if (pMeasureReportInfo->ReportType == RM_BASIC) {
+				struct rt_measure_basic_report * pReport =
+				    (struct rt_measure_basic_report *) pReportBuf;
+				ptr = (u8 *)(eid_ptr->Octet + 3);
+				NdisMoveMemory(&pReport->ChNum, ptr, 1);
+				NdisMoveMemory(&pReport->MeasureStartTime,
+					       ptr + 1, 8);
+				NdisMoveMemory(&pReport->MeasureDuration,
+					       ptr + 9, 2);
+				NdisMoveMemory(&pReport->Map, ptr + 11, 1);
+
+			} else if (pMeasureReportInfo->ReportType == RM_CCA) {
+				struct rt_measure_cca_report * pReport =
+				    (struct rt_measure_cca_report *) pReportBuf;
+				ptr = (u8 *)(eid_ptr->Octet + 3);
+				NdisMoveMemory(&pReport->ChNum, ptr, 1);
+				NdisMoveMemory(&pReport->MeasureStartTime,
+					       ptr + 1, 8);
+				NdisMoveMemory(&pReport->MeasureDuration,
+					       ptr + 9, 2);
+				NdisMoveMemory(&pReport->CCA_Busy_Fraction,
+					       ptr + 11, 1);
+
+			} else if (pMeasureReportInfo->ReportType ==
+				   RM_RPI_HISTOGRAM) {
+				struct rt_measure_rpi_report * pReport =
+				    (struct rt_measure_rpi_report *) pReportBuf;
+				ptr = (u8 *)(eid_ptr->Octet + 3);
+				NdisMoveMemory(&pReport->ChNum, ptr, 1);
+				NdisMoveMemory(&pReport->MeasureStartTime,
+					       ptr + 1, 8);
+				NdisMoveMemory(&pReport->MeasureDuration,
+					       ptr + 9, 2);
+				NdisMoveMemory(&pReport->RPI_Density, ptr + 11,
+					       8);
+			}
+			result = TRUE;
+			break;
 
-			default:
-				break;
+		default:
+			break;
 		}
-		eid_ptr = (PEID_STRUCT)((UCHAR*)eid_ptr + 2 + eid_ptr->Len);
+		eid_ptr = (struct rt_eid *) ((u8 *) eid_ptr + 2 + eid_ptr->Len);
 	}
 
 	return result;
@@ -1336,20 +1666,18 @@ static BOOLEAN PeerMeasureReportSanity(
 	Return	: None.
 	==========================================================================
  */
-static BOOLEAN PeerTpcReqSanity(
-	IN PRTMP_ADAPTER pAd,
-	IN VOID *pMsg,
-	IN ULONG MsgLen,
-	OUT PUINT8 pDialogToken)
+static BOOLEAN PeerTpcReqSanity(struct rt_rtmp_adapter *pAd,
+				void * pMsg,
+				unsigned long MsgLen, u8 *pDialogToken)
 {
-	PFRAME_802_11 Fr = (PFRAME_802_11)pMsg;
-	PUCHAR pFramePtr = Fr->Octet;
+	struct rt_frame_802_11 * Fr = (struct rt_frame_802_11 *) pMsg;
+	u8 *pFramePtr = Fr->Octet;
 	BOOLEAN result = FALSE;
-	PEID_STRUCT eid_ptr;
+	struct rt_eid * eid_ptr;
 
-	MsgLen -= sizeof(HEADER_802_11);
+	MsgLen -= sizeof(struct rt_header_802_11);
 
-	// skip category and action code.
+	/* skip category and action code. */
 	pFramePtr += 2;
 	MsgLen -= 2;
 
@@ -1360,19 +1688,18 @@ static BOOLEAN PeerTpcReqSanity(
 	pFramePtr += 1;
 	MsgLen -= 1;
 
-	eid_ptr = (PEID_STRUCT)pFramePtr;
-	while (((UCHAR*)eid_ptr + eid_ptr->Len + 1) < ((PUCHAR)pFramePtr + MsgLen))
-	{
-		switch(eid_ptr->Eid)
-		{
-			case IE_TPC_REQUEST:
-				result = TRUE;
-                break;
+	eid_ptr = (struct rt_eid *) pFramePtr;
+	while (((u8 *) eid_ptr + eid_ptr->Len + 1) <
+	       ((u8 *)pFramePtr + MsgLen)) {
+		switch (eid_ptr->Eid) {
+		case IE_TPC_REQUEST:
+			result = TRUE;
+			break;
 
-			default:
-				break;
+		default:
+			break;
 		}
-		eid_ptr = (PEID_STRUCT)((UCHAR*)eid_ptr + 2 + eid_ptr->Len);
+		eid_ptr = (struct rt_eid *) ((u8 *) eid_ptr + 2 + eid_ptr->Len);
 	}
 
 	return result;
@@ -1392,21 +1719,20 @@ static BOOLEAN PeerTpcReqSanity(
 	Return	: None.
 	==========================================================================
  */
-static BOOLEAN PeerTpcRepSanity(
-	IN PRTMP_ADAPTER pAd,
-	IN VOID *pMsg,
-	IN ULONG MsgLen,
-	OUT PUINT8 pDialogToken,
-	OUT PTPC_REPORT_INFO pTpcRepInfo)
+static BOOLEAN PeerTpcRepSanity(struct rt_rtmp_adapter *pAd,
+				void * pMsg,
+				unsigned long MsgLen,
+				u8 *pDialogToken,
+				struct rt_tpc_report_info * pTpcRepInfo)
 {
-	PFRAME_802_11 Fr = (PFRAME_802_11)pMsg;
-	PUCHAR pFramePtr = Fr->Octet;
+	struct rt_frame_802_11 * Fr = (struct rt_frame_802_11 *) pMsg;
+	u8 *pFramePtr = Fr->Octet;
 	BOOLEAN result = FALSE;
-	PEID_STRUCT eid_ptr;
+	struct rt_eid * eid_ptr;
 
-	MsgLen -= sizeof(HEADER_802_11);
+	MsgLen -= sizeof(struct rt_header_802_11);
 
-	// skip category and action code.
+	/* skip category and action code. */
 	pFramePtr += 2;
 	MsgLen -= 2;
 
@@ -1417,21 +1743,21 @@ static BOOLEAN PeerTpcRepSanity(
 	pFramePtr += 1;
 	MsgLen -= 1;
 
-	eid_ptr = (PEID_STRUCT)pFramePtr;
-	while (((UCHAR*)eid_ptr + eid_ptr->Len + 1) < ((PUCHAR)pFramePtr + MsgLen))
-	{
-		switch(eid_ptr->Eid)
-		{
-			case IE_TPC_REPORT:
-				NdisMoveMemory(&pTpcRepInfo->TxPwr, eid_ptr->Octet, 1);
-				NdisMoveMemory(&pTpcRepInfo->LinkMargin, eid_ptr->Octet + 1, 1);
-				result = TRUE;
-                break;
-
-			default:
-				break;
+	eid_ptr = (struct rt_eid *) pFramePtr;
+	while (((u8 *) eid_ptr + eid_ptr->Len + 1) <
+	       ((u8 *)pFramePtr + MsgLen)) {
+		switch (eid_ptr->Eid) {
+		case IE_TPC_REPORT:
+			NdisMoveMemory(&pTpcRepInfo->TxPwr, eid_ptr->Octet, 1);
+			NdisMoveMemory(&pTpcRepInfo->LinkMargin,
+				       eid_ptr->Octet + 1, 1);
+			result = TRUE;
+			break;
+
+		default:
+			break;
 		}
-		eid_ptr = (PEID_STRUCT)((UCHAR*)eid_ptr + 2 + eid_ptr->Len);
+		eid_ptr = (struct rt_eid *) ((u8 *) eid_ptr + 2 + eid_ptr->Len);
 	}
 
 	return result;
@@ -1448,64 +1774,69 @@ static BOOLEAN PeerTpcRepSanity(
 	Return	: None.
 	==========================================================================
  */
-static VOID PeerChSwAnnAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
+static void PeerChSwAnnAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-	CH_SW_ANN_INFO ChSwAnnInfo;
-	PFRAME_802_11 pFr = (PFRAME_802_11)Elem->Msg;
-	UCHAR index = 0, Channel = 0, NewChannel = 0;
-	ULONG Bssidx = 0;
-
-	NdisZeroMemory(&ChSwAnnInfo, sizeof(CH_SW_ANN_INFO));
-	if (! PeerChSwAnnSanity(pAd, Elem->Msg, Elem->MsgLen, &ChSwAnnInfo))
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("Invalid Channel Switch Action Frame.\n"));
+	struct rt_ch_sw_ann_info ChSwAnnInfo;
+	struct rt_frame_802_11 * pFr = (struct rt_frame_802_11 *) Elem->Msg;
+	u8 index = 0, Channel = 0, NewChannel = 0;
+	unsigned long Bssidx = 0;
+
+	NdisZeroMemory(&ChSwAnnInfo, sizeof(struct rt_ch_sw_ann_info));
+	if (!PeerChSwAnnSanity(pAd, Elem->Msg, Elem->MsgLen, &ChSwAnnInfo)) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("Invalid Channel Switch Action Frame.\n"));
 		return;
 	}
 
-	if (pAd->OpMode == OPMODE_STA)
-	{
-		Bssidx = BssTableSearch(&pAd->ScanTab, pFr->Hdr.Addr3, pAd->CommonCfg.Channel);
-		if (Bssidx == BSS_NOT_FOUND)
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("PeerChSwAnnAction - Bssidx is not found\n"));
+	if (pAd->OpMode == OPMODE_STA) {
+		Bssidx =
+		    BssTableSearch(&pAd->ScanTab, pFr->Hdr.Addr3,
+				   pAd->CommonCfg.Channel);
+		if (Bssidx == BSS_NOT_FOUND) {
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("PeerChSwAnnAction - Bssidx is not found\n"));
 			return;
 		}
 
-		DBGPRINT(RT_DEBUG_TRACE, ("\n****Bssidx is %d, Channel = %d\n", index, pAd->ScanTab.BssEntry[Bssidx].Channel));
-		hex_dump("SSID",pAd->ScanTab.BssEntry[Bssidx].Bssid ,6);
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("\n****Bssidx is %d, Channel = %d\n", index,
+			  pAd->ScanTab.BssEntry[Bssidx].Channel));
+		hex_dump("SSID", pAd->ScanTab.BssEntry[Bssidx].Bssid, 6);
 
 		Channel = pAd->CommonCfg.Channel;
 		NewChannel = ChSwAnnInfo.Channel;
 
-		if ((pAd->CommonCfg.bIEEE80211H == 1) && (NewChannel != 0) && (Channel != NewChannel))
-		{
-			// Switching to channel 1 can prevent from rescanning the current channel immediately (by auto reconnection).
-			// In addition, clear the MLME queue and the scan table to discard the RX packets and previous scanning results.
+		if ((pAd->CommonCfg.bIEEE80211H == 1) && (NewChannel != 0)
+		    && (Channel != NewChannel)) {
+			/* Switching to channel 1 can prevent from rescanning the current channel immediately (by auto reconnection). */
+			/* In addition, clear the MLME queue and the scan table to discard the RX packets and previous scanning results. */
 			AsicSwitchChannel(pAd, 1, FALSE);
 			AsicLockChannel(pAd, 1);
-		    LinkDown(pAd, FALSE);
+			LinkDown(pAd, FALSE);
 			MlmeQueueInit(&pAd->Mlme.Queue);
 			BssTableInit(&pAd->ScanTab);
-		    RTMPusecDelay(1000000);		// use delay to prevent STA do reassoc
-
-			// channel sanity check
-			for (index = 0 ; index < pAd->ChannelListNum; index++)
-			{
-				if (pAd->ChannelList[index].Channel == NewChannel)
-				{
-					pAd->ScanTab.BssEntry[Bssidx].Channel = NewChannel;
+			RTMPusecDelay(1000000);	/* use delay to prevent STA do reassoc */
+
+			/* channel sanity check */
+			for (index = 0; index < pAd->ChannelListNum; index++) {
+				if (pAd->ChannelList[index].Channel ==
+				    NewChannel) {
+					pAd->ScanTab.BssEntry[Bssidx].Channel =
+					    NewChannel;
 					pAd->CommonCfg.Channel = NewChannel;
-					AsicSwitchChannel(pAd, pAd->CommonCfg.Channel, FALSE);
-					AsicLockChannel(pAd, pAd->CommonCfg.Channel);
-					DBGPRINT(RT_DEBUG_TRACE, ("&&&&&&&&&&&&&&&&PeerChSwAnnAction - STA receive channel switch announcement IE (New Channel =%d)\n", NewChannel));
+					AsicSwitchChannel(pAd,
+							  pAd->CommonCfg.
+							  Channel, FALSE);
+					AsicLockChannel(pAd,
+							pAd->CommonCfg.Channel);
+					DBGPRINT(RT_DEBUG_TRACE,
+						 ("&&&&&&&&&&&&&&&&PeerChSwAnnAction - STA receive channel switch announcement IE (New Channel =%d)\n",
+						  NewChannel));
 					break;
 				}
 			}
 
-			if (index >= pAd->ChannelListNum)
-			{
+			if (index >= pAd->ChannelListNum) {
 				DBGPRINT_ERR(("&&&&&&&&&&&&&&&&&&&&&&&&&&PeerChSwAnnAction(can not find New Channel=%d in ChannelList[%d]\n", pAd->CommonCfg.Channel, pAd->ChannelListNum));
 			}
 		}
@@ -1514,7 +1845,6 @@ static VOID PeerChSwAnnAction(
 	return;
 }
 
-
 /*
 	==========================================================================
 	Description:
@@ -1526,20 +1856,23 @@ static VOID PeerChSwAnnAction(
 	Return	: None.
 	==========================================================================
  */
-static VOID PeerMeasureReqAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
+static void PeerMeasureReqAction(struct rt_rtmp_adapter *pAd,
+				 struct rt_mlme_queue_elem *Elem)
 {
-	PFRAME_802_11 pFr = (PFRAME_802_11)Elem->Msg;
-	UINT8 DialogToken;
-	MEASURE_REQ_INFO MeasureReqInfo;
+	struct rt_frame_802_11 * pFr = (struct rt_frame_802_11 *) Elem->Msg;
+	u8 DialogToken;
+	struct rt_measure_req_info MeasureReqInfo;
+	struct rt_measure_req MeasureReq;
 	MEASURE_REPORT_MODE ReportMode;
 
-	if(PeerMeasureReqSanity(pAd, Elem->Msg, Elem->MsgLen, &DialogToken, &MeasureReqInfo))
-	{
+	if (PeerMeasureReqSanity
+	    (pAd, Elem->Msg, Elem->MsgLen, &DialogToken, &MeasureReqInfo,
+	     &MeasureReq)) {
 		ReportMode.word = 0;
 		ReportMode.field.Incapable = 1;
-		EnqueueMeasurementRep(pAd, pFr->Hdr.Addr2, DialogToken, MeasureReqInfo.Token, ReportMode.word, MeasureReqInfo.ReqType, 0, NULL);
+		EnqueueMeasurementRep(pAd, pFr->Hdr.Addr2, DialogToken,
+				      MeasureReqInfo.Token, ReportMode.word,
+				      MeasureReqInfo.ReqType, 0, NULL);
 	}
 
 	return;
@@ -1556,54 +1889,65 @@ static VOID PeerMeasureReqAction(
 	Return	: None.
 	==========================================================================
  */
-static VOID PeerMeasureReportAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
+static void PeerMeasureReportAction(struct rt_rtmp_adapter *pAd,
+				    struct rt_mlme_queue_elem *Elem)
 {
-	MEASURE_REPORT_INFO MeasureReportInfo;
-	PFRAME_802_11 pFr = (PFRAME_802_11)Elem->Msg;
-	UINT8 DialogToken;
-	PUINT8 pMeasureReportInfo;
-
-//	if (pAd->CommonCfg.bIEEE80211H != TRUE)
-//		return;
-
-	if ((pMeasureReportInfo = kmalloc(sizeof(MEASURE_RPI_REPORT), GFP_ATOMIC)) == NULL)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("%s unable to alloc memory for measure report buffer (size=%zu).\n", __func__, sizeof(MEASURE_RPI_REPORT)));
+	struct rt_measure_report_info MeasureReportInfo;
+	struct rt_frame_802_11 * pFr = (struct rt_frame_802_11 *) Elem->Msg;
+	u8 DialogToken;
+	u8 *pMeasureReportInfo;
+
+/*      if (pAd->CommonCfg.bIEEE80211H != TRUE) */
+/*              return; */
+
+	if ((pMeasureReportInfo =
+	     kmalloc(sizeof(struct rt_measure_rpi_report), GFP_ATOMIC)) == NULL) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("%s unable to alloc memory for measure report buffer (size=%zu).\n",
+			  __func__, sizeof(struct rt_measure_rpi_report)));
 		return;
 	}
 
-	NdisZeroMemory(&MeasureReportInfo, sizeof(MEASURE_REPORT_INFO));
-	NdisZeroMemory(pMeasureReportInfo, sizeof(MEASURE_RPI_REPORT));
-	if (PeerMeasureReportSanity(pAd, Elem->Msg, Elem->MsgLen, &DialogToken, &MeasureReportInfo, pMeasureReportInfo))
-	{
+	NdisZeroMemory(&MeasureReportInfo, sizeof(struct rt_measure_report_info));
+	NdisZeroMemory(pMeasureReportInfo, sizeof(struct rt_measure_rpi_report));
+	if (PeerMeasureReportSanity
+	    (pAd, Elem->Msg, Elem->MsgLen, &DialogToken, &MeasureReportInfo,
+	     pMeasureReportInfo)) {
 		do {
-			PMEASURE_REQ_ENTRY pEntry = NULL;
+			struct rt_measure_req_entry *pEntry = NULL;
 
-			// Not a autonomous measure report.
-			// check the dialog token field. drop it if the dialog token doesn't match.
+			/* Not a autonomous measure report. */
+			/* check the dialog token field. drop it if the dialog token doesn't match. */
 			if ((DialogToken != 0)
-				&& ((pEntry = MeasureReqLookUp(pAd, DialogToken)) == NULL))
+			    && ((pEntry = MeasureReqLookUp(pAd, DialogToken)) ==
+				NULL))
 				break;
 
 			if (pEntry != NULL)
 				MeasureReqDelete(pAd, pEntry->DialogToken);
 
-			if (MeasureReportInfo.ReportType == RM_BASIC)
-			{
-				PMEASURE_BASIC_REPORT pBasicReport = (PMEASURE_BASIC_REPORT)pMeasureReportInfo;
+			if (MeasureReportInfo.ReportType == RM_BASIC) {
+				struct rt_measure_basic_report * pBasicReport =
+				    (struct rt_measure_basic_report *) pMeasureReportInfo;
 				if ((pBasicReport->Map.field.Radar)
-					&& (DfsRequirementCheck(pAd, pBasicReport->ChNum) == TRUE))
-				{
-					NotifyChSwAnnToPeerAPs(pAd, pFr->Hdr.Addr1, pFr->Hdr.Addr2, 1, pBasicReport->ChNum);
-					StartDFSProcedure(pAd, pBasicReport->ChNum, 1);
+				    &&
+				    (DfsRequirementCheck
+				     (pAd, pBasicReport->ChNum) == TRUE)) {
+					NotifyChSwAnnToPeerAPs(pAd,
+							       pFr->Hdr.Addr1,
+							       pFr->Hdr.Addr2,
+							       1,
+							       pBasicReport->
+							       ChNum);
+					StartDFSProcedure(pAd,
+							  pBasicReport->ChNum,
+							  1);
 				}
 			}
 		} while (FALSE);
-	}
-	else
-		DBGPRINT(RT_DEBUG_TRACE, ("Invalid Measurement Report Frame.\n"));
+	} else
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("Invalid Measurement Report Frame.\n"));
 
 	kfree(pMeasureReportInfo);
 
@@ -1621,34 +1965,33 @@ static VOID PeerMeasureReportAction(
 	Return	: None.
 	==========================================================================
  */
-static VOID PeerTpcReqAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
+static void PeerTpcReqAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-	PFRAME_802_11 pFr = (PFRAME_802_11)Elem->Msg;
-	PUCHAR pFramePtr = pFr->Octet;
-	UINT8 DialogToken;
-	UINT8 TxPwr = GetCurTxPwr(pAd, Elem->Wcid);
-	UINT8 LinkMargin = 0;
-	CHAR RealRssi;
+	struct rt_frame_802_11 * pFr = (struct rt_frame_802_11 *) Elem->Msg;
+	u8 *pFramePtr = pFr->Octet;
+	u8 DialogToken;
+	u8 TxPwr = GetCurTxPwr(pAd, Elem->Wcid);
+	u8 LinkMargin = 0;
+	char RealRssi;
 
-	// link margin: Ratio of the received signal power to the minimum desired by the station (STA). The
-	//				STA may incorporate rate information and channel conditions, including interference, into its computation
-	//				of link margin.
+	/* link margin: Ratio of the received signal power to the minimum desired by the station (STA). The */
+	/*                              STA may incorporate rate information and channel conditions, including interference, into its computation */
+	/*                              of link margin. */
 
 	RealRssi = RTMPMaxRssi(pAd, ConvertToRssi(pAd, Elem->Rssi0, RSSI_0),
-								ConvertToRssi(pAd, Elem->Rssi1, RSSI_1),
-								ConvertToRssi(pAd, Elem->Rssi2, RSSI_2));
+			       ConvertToRssi(pAd, Elem->Rssi1, RSSI_1),
+			       ConvertToRssi(pAd, Elem->Rssi2, RSSI_2));
 
-	// skip Category and action code.
+	/* skip Category and action code. */
 	pFramePtr += 2;
 
-	// Dialog token.
+	/* Dialog token. */
 	NdisMoveMemory(&DialogToken, pFramePtr, 1);
 
 	LinkMargin = (RealRssi / MIN_RCV_PWR);
 	if (PeerTpcReqSanity(pAd, Elem->Msg, Elem->MsgLen, &DialogToken))
-		EnqueueTPCRep(pAd, pFr->Hdr.Addr2, DialogToken, TxPwr, LinkMargin);
+		EnqueueTPCRep(pAd, pFr->Hdr.Addr2, DialogToken, TxPwr,
+			      LinkMargin);
 
 	return;
 }
@@ -1664,22 +2007,21 @@ static VOID PeerTpcReqAction(
 	Return	: None.
 	==========================================================================
  */
-static VOID PeerTpcRepAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
+static void PeerTpcRepAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-	UINT8 DialogToken;
-	TPC_REPORT_INFO TpcRepInfo;
-	PTPC_REQ_ENTRY pEntry = NULL;
-
-	NdisZeroMemory(&TpcRepInfo, sizeof(TPC_REPORT_INFO));
-	if (PeerTpcRepSanity(pAd, Elem->Msg, Elem->MsgLen, &DialogToken, &TpcRepInfo))
-	{
-		if ((pEntry = TpcReqLookUp(pAd, DialogToken)) != NULL)
-		{
+	u8 DialogToken;
+	struct rt_tpc_report_info TpcRepInfo;
+	struct rt_tpc_req_entry *pEntry = NULL;
+
+	NdisZeroMemory(&TpcRepInfo, sizeof(struct rt_tpc_report_info));
+	if (PeerTpcRepSanity
+	    (pAd, Elem->Msg, Elem->MsgLen, &DialogToken, &TpcRepInfo)) {
+		if ((pEntry = TpcReqLookUp(pAd, DialogToken)) != NULL) {
 			TpcReqDelete(pAd, pEntry->DialogToken);
-			DBGPRINT(RT_DEBUG_TRACE, ("%s: DialogToken=%x, TxPwr=%d, LinkMargin=%d\n",
-				__func__, DialogToken, TpcRepInfo.TxPwr, TpcRepInfo.LinkMargin));
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("%s: DialogToken=%x, TxPwr=%d, LinkMargin=%d\n",
+				  __func__, DialogToken, TpcRepInfo.TxPwr,
+				  TpcRepInfo.LinkMargin));
 		}
 	}
 
@@ -1698,41 +2040,37 @@ static VOID PeerTpcRepAction(
 	Return	: None.
 	==========================================================================
  */
-VOID PeerSpectrumAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
+void PeerSpectrumAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
 
-	UCHAR	Action = Elem->Msg[LENGTH_802_11+1];
+	u8 Action = Elem->Msg[LENGTH_802_11 + 1];
 
 	if (pAd->CommonCfg.bIEEE80211H != TRUE)
 		return;
 
-	switch(Action)
-	{
-		case SPEC_MRQ:
-			// current rt2860 unable do such measure specified in Measurement Request.
-			// reject all measurement request.
-			PeerMeasureReqAction(pAd, Elem);
-			break;
+	switch (Action) {
+	case SPEC_MRQ:
+		/* current rt2860 unable do such measure specified in Measurement Request. */
+		/* reject all measurement request. */
+		PeerMeasureReqAction(pAd, Elem);
+		break;
 
-		case SPEC_MRP:
-			PeerMeasureReportAction(pAd, Elem);
-			break;
+	case SPEC_MRP:
+		PeerMeasureReportAction(pAd, Elem);
+		break;
 
-		case SPEC_TPCRQ:
-			PeerTpcReqAction(pAd, Elem);
-			break;
+	case SPEC_TPCRQ:
+		PeerTpcReqAction(pAd, Elem);
+		break;
 
-		case SPEC_TPCRP:
-			PeerTpcRepAction(pAd, Elem);
-			break;
+	case SPEC_TPCRP:
+		PeerTpcRepAction(pAd, Elem);
+		break;
 
-		case SPEC_CHANNEL_SWITCH:
-{
-}
-			PeerChSwAnnAction(pAd, Elem);
-			break;
+	case SPEC_CHANNEL_SWITCH:
+
+		PeerChSwAnnAction(pAd, Elem);
+		break;
 	}
 
 	return;
@@ -1747,49 +2085,63 @@ VOID PeerSpectrumAction(
 	Return	: None.
 	==========================================================================
  */
-INT Set_MeasureReq_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
+int Set_MeasureReq_Proc(struct rt_rtmp_adapter *pAd, char *arg)
 {
-	UINT Aid = 1;
-	UINT ArgIdx;
-	PUCHAR thisChar;
+	u32 Aid = 1;
+	u32 ArgIdx;
+	char *thisChar;
 
 	MEASURE_REQ_MODE MeasureReqMode;
-	UINT8 MeasureReqToken = RandomByte(pAd);
-	UINT8 MeasureReqType = RM_BASIC;
-	UINT8 MeasureCh = 1;
+	u8 MeasureReqToken = RandomByte(pAd);
+	u8 MeasureReqType = RM_BASIC;
+	u8 MeasureCh = 1;
+	u64 MeasureStartTime = GetCurrentTimeStamp(pAd);
+	struct rt_measure_req MeasureReq;
+	u8 TotalLen;
+
+	struct rt_header_802_11 ActHdr;
+	u8 *pOutBuffer = NULL;
+	int NStatus;
+	unsigned long FrameLen;
+
+	NStatus = MlmeAllocateMemory(pAd, (void *)& pOutBuffer);	/*Get an unused nonpaged memory */
+	if (NStatus != NDIS_STATUS_SUCCESS) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("%s() allocate memory failed \n", __func__));
+		goto END_OF_MEASURE_REQ;
+	}
 
 	ArgIdx = 1;
-	while ((thisChar = strsep((char **)&arg, "-")) != NULL)
-	{
-		switch(ArgIdx)
-		{
-			case 1:	// Aid.
-				Aid = simple_strtol(thisChar, 0, 16);
-				break;
+	while ((thisChar = strsep((char **)&arg, "-")) != NULL) {
+		switch (ArgIdx) {
+		case 1:	/* Aid. */
+			Aid = (u8)simple_strtol(thisChar, 0, 16);
+			break;
 
-			case 2: // Measurement Request Type.
-				MeasureReqType = simple_strtol(thisChar, 0, 16);
-				if (MeasureReqType > 3)
-				{
-					DBGPRINT(RT_DEBUG_ERROR, ("%s: unknow MeasureReqType(%d)\n", __func__, MeasureReqType));
-					return TRUE;
-				}
-				break;
+		case 2:	/* Measurement Request Type. */
+			MeasureReqType = simple_strtol(thisChar, 0, 16);
+			if (MeasureReqType > 3) {
+				DBGPRINT(RT_DEBUG_ERROR,
+					 ("%s: unknow MeasureReqType(%d)\n",
+					  __func__, MeasureReqType));
+				goto END_OF_MEASURE_REQ;
+			}
+			break;
 
-			case 3: // Measurement channel.
-				MeasureCh = simple_strtol(thisChar, 0, 16);
-				break;
+		case 3:	/* Measurement channel. */
+			MeasureCh = (u8)simple_strtol(thisChar, 0, 16);
+			break;
 		}
 		ArgIdx++;
 	}
 
-	DBGPRINT(RT_DEBUG_TRACE, ("%s::Aid = %d, MeasureReqType=%d MeasureCh=%d\n", __func__, Aid, MeasureReqType, MeasureCh));
-	if (!VALID_WCID(Aid))
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("%s: unknow sta of Aid(%d)\n", __func__, Aid));
-		return TRUE;
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("%s::Aid = %d, MeasureReqType=%d MeasureCh=%d\n", __func__,
+		  Aid, MeasureReqType, MeasureCh));
+	if (!VALID_WCID(Aid)) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("%s: unknow sta of Aid(%d)\n", __func__, Aid));
+		goto END_OF_MEASURE_REQ;
 	}
 
 	MeasureReqMode.word = 0;
@@ -1797,26 +2149,52 @@ INT Set_MeasureReq_Proc(
 
 	MeasureReqInsert(pAd, MeasureReqToken);
 
-	EnqueueMeasurementReq(pAd, pAd->MacTab.Content[Aid].Addr,
-		MeasureReqToken, MeasureReqMode.word, MeasureReqType, MeasureCh, 2000);
+	/* build action frame header. */
+	MgtMacHeaderInit(pAd, &ActHdr, SUBTYPE_ACTION, 0,
+			 pAd->MacTab.Content[Aid].Addr, pAd->CurrentAddress);
+
+	NdisMoveMemory(pOutBuffer, (char *)& ActHdr, sizeof(struct rt_header_802_11));
+	FrameLen = sizeof(struct rt_header_802_11);
+
+	TotalLen = sizeof(struct rt_measure_req_info) + sizeof(struct rt_measure_req);
+
+	MakeMeasurementReqFrame(pAd, pOutBuffer, &FrameLen,
+				sizeof(struct rt_measure_req_info), CATEGORY_RM, RM_BASIC,
+				MeasureReqToken, MeasureReqMode.word,
+				MeasureReqType, 0);
+
+	MeasureReq.ChNum = MeasureCh;
+	MeasureReq.MeasureStartTime = cpu2le64(MeasureStartTime);
+	MeasureReq.MeasureDuration = cpu2le16(2000);
+
+	{
+		unsigned long TempLen;
+		MakeOutgoingFrame(pOutBuffer + FrameLen, &TempLen,
+				  sizeof(struct rt_measure_req), &MeasureReq,
+				  END_OF_ARGS);
+		FrameLen += TempLen;
+	}
+
+	MiniportMMRequest(pAd, QID_AC_BE, pOutBuffer, (u32)FrameLen);
+
+END_OF_MEASURE_REQ:
+	MlmeFreeMemory(pAd, pOutBuffer);
 
 	return TRUE;
 }
 
-INT Set_TpcReq_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
+int Set_TpcReq_Proc(struct rt_rtmp_adapter *pAd, char *arg)
 {
-	UINT Aid;
+	u32 Aid;
 
-	UINT8 TpcReqToken = RandomByte(pAd);
+	u8 TpcReqToken = RandomByte(pAd);
 
-	Aid = simple_strtol(arg, 0, 16);
+	Aid = (u32)simple_strtol(arg, 0, 16);
 
 	DBGPRINT(RT_DEBUG_TRACE, ("%s::Aid = %d\n", __func__, Aid));
-	if (!VALID_WCID(Aid))
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("%s: unknow sta of Aid(%d)\n", __func__, Aid));
+	if (!VALID_WCID(Aid)) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("%s: unknow sta of Aid(%d)\n", __func__, Aid));
 		return TRUE;
 	}
 
@@ -1826,4 +2204,3 @@ INT Set_TpcReq_Proc(
 
 	return TRUE;
 }
-
diff --git a/drivers/staging/rt2860/config.mk b/drivers/staging/rt2860/config.mk
deleted file mode 100644
index 25bd55a7aab3..000000000000
--- a/drivers/staging/rt2860/config.mk
+++ /dev/null
@@ -1,241 +0,0 @@
-# Support ATE function
-HAS_ATE=n
-
-# Support 28xx QA ATE function
-HAS_28xx_QA=n
-
-# Support Wpa_Supplicant
-HAS_WPA_SUPPLICANT=n
-
-# Support Native WpaSupplicant for Network Maganger
-HAS_NATIVE_WPA_SUPPLICANT_SUPPORT=n
-
-#Support Net interface block while Tx-Sw queue full
-HAS_BLOCK_NET_IF=n
-
-#Support DFS function
-HAS_DFS_SUPPORT=n
-
-#Support Carrier-Sense function
-HAS_CS_SUPPORT=n
-
-#ifdef MULTI_CARD
-# Support for Multiple Cards
-HAS_MC_SUPPORT=n
-#endif // MULTI_CARD //
-
-#Support for IEEE802.11e DLS
-HAS_QOS_DLS_SUPPORT=n
-
-#Support for EXT_CHANNEL
-HAS_EXT_BUILD_CHANNEL_LIST=n
-
-#Support for Net-SNMP
-HAS_SNMP_SUPPORT=n
-
-#Support features of Single SKU.
-HAS_SINGLE_SKU_SUPPORT=n
-
-#Support features of 802.11n
-HAS_DOT11_N_SUPPORT=y
-
-
-#################################################
-
-CC := $(CROSS_COMPILE)gcc
-LD := $(CROSS_COMPILE)ld
-
-WFLAGS := -DAGGREGATION_SUPPORT -DPIGGYBACK_SUPPORT -DWMM_SUPPORT  -DLINUX -Wall -Wstrict-prototypes -Wno-trigraphs
-
-
-#################################################
-
-#ifdef CONFIG_STA_SUPPORT
-# config for STA mode
-
-ifeq ($(RT28xx_MODE),STA)
-WFLAGS += -DCONFIG_STA_SUPPORT -DDBG
-
-ifeq ($(HAS_WPA_SUPPLICANT),y)
-WFLAGS += -DWPA_SUPPLICANT_SUPPORT
-endif
-
-ifeq ($(HAS_NATIVE_WPA_SUPPLICANT_SUPPORT),y)
-WFLAGS += -DNATIVE_WPA_SUPPLICANT_SUPPORT
-endif
-
-ifeq ($(HAS_ATE),y)
-WFLAGS += -DRALINK_ATE
-ifeq ($(HAS_28xx_QA),y)
-WFLAGS += -DRALINK_28xx_QA
-endif
-endif
-
-ifeq ($(HAS_SNMP_SUPPORT),y)
-WFLAGS += -DSNMP_SUPPORT
-endif
-
-ifeq ($(HAS_QOS_DLS_SUPPORT),y)
-WFLAGS += -DQOS_DLS_SUPPORT
-endif
-
-ifeq ($(HAS_DOT11_N_SUPPORT),y)
-WFLAGS += -DDOT11_N_SUPPORT
-endif
-
-ifeq ($(HAS_CS_SUPPORT),y)
-WFLAGS += -DCARRIER_DETECTION_SUPPORT
-endif
-
-ifeq ($(HAS_SINGLE_SKU_SUPPORT),y)
-WFLAGS += -DSINGLE_SKU
-endif
-
-endif
-# endif of ifeq ($(RT28xx_MODE),STA)
-#endif // CONFIG_STA_SUPPORT //
-
-#################################################
-
-#################################################
-
-#
-# Common compiler flag
-#
-
-
-ifeq ($(HAS_EXT_BUILD_CHANNEL_LIST),y)
-WFLAGS += -DEXT_BUILD_CHANNEL_LIST
-endif
-
-ifeq ($(CHIPSET),2870)
-WFLAGS +=-DRT2870
-endif
-
-ifeq ($(PLATFORM),5VT)
-#WFLAGS += -DCONFIG_5VT_ENHANCE
-endif
-
-ifeq ($(HAS_BLOCK_NET_IF),y)
-WFLAGS += -DBLOCK_NET_IF
-endif
-
-ifeq ($(HAS_DFS_SUPPORT),y)
-WFLAGS += -DDFS_SUPPORT
-endif
-
-#ifdef MULTI_CARD
-ifeq ($(HAS_MC_SUPPORT),y)
-WFLAGS += -DMULTIPLE_CARD_SUPPORT
-endif
-#endif // MULTI_CARD //
-
-ifeq ($(HAS_LLTD),y)
-WFLAGS += -DLLTD_SUPPORT
-endif
-
-ifeq ($(PLATFORM),IXP)
-WFLAGS += -DRT_BIG_ENDIAN
-endif
-
-ifeq ($(PLATFORM),IKANOS_V160)
-WFLAGS += -DRT_BIG_ENDIAN -DIKANOS_VX_1X0
-endif
-
-ifeq ($(PLATFORM),IKANOS_V180)
-WFLAGS += -DRT_BIG_ENDIAN -DIKANOS_VX_1X0
-endif
-
-ifeq ($(PLATFORM),INF_TWINPASS)
-WFLAGS += -DRT_BIG_ENDIAN -DINF_TWINPASS
-endif
-
-ifeq ($(PLATFORM),INF_DANUBE)
-WFLAGS += -DINF_DANUBE -DRT_BIG_ENDIAN
-endif
-
-ifeq ($(PLATFORM),CAVM_OCTEON)
-WFLAGS += -DRT_BIG_ENDIAN
-endif
-
-ifeq ($(PLATFORM),BRCM_6358)
-WFLAGS += -DRT_BIG_ENDIAN
-endif
-
-ifeq ($(PLATFORM),INF_AMAZON_SE)
-#WFLAGS += -DRT_BIG_ENDIAN -DINF_AMAZON_SE -DBG_FT_SUPPORT
-WFLAGS += -DRT_BIG_ENDIAN -DINF_AMAZON_SE
-endif
-
-#kernel build options for 2.4
-# move to Makefile outside LINUX_SRC := /opt/star/kernel/linux-2.4.27-star
-
-ifeq ($(PLATFORM),STAR)
-CFLAGS := -D__KERNEL__ -I$(LINUX_SRC)/include -I$(RT28xx_DIR)/include -Wall -Wstrict-prototypes -Wno-trigraphs -O2 -fno-strict-aliasing -fno-common -Uarm -fno-common -pipe -mapcs-32 -D__LINUX_ARM_ARCH__=4 -march=armv4  -mshort-load-bytes -msoft-float -Uarm -DMODULE -DMODVERSIONS -include $(LINUX_SRC)/include/linux/modversions.h $(WFLAGS)
-
-export CFLAGS
-endif
-
-ifeq ($(PLATFORM),SIGMA)
-CFLAGS := -D__KERNEL__ -I$(RT28xx_DIR)/include -I$(LINUX_SRC)/include -I$(LINUX_SRC)/include/asm/gcc -I$(LINUX_SRC)/include/asm-mips/mach-tango2 -I$(LINUX_SRC)/include/asm-mips/mach-tango2 -DEM86XX_CHIP=EM86XX_CHIPID_TANGO2 -DEM86XX_REVISION=6 -I$(LINUX_SRC)/include/asm-mips/mach-generic -I$(RT2860_DIR)/include -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs -fno-strict-aliasing -fno-common -ffreestanding -O2     -fomit-frame-pointer -G 0 -mno-abicalls -fno-pic -pipe  -mabi=32 -march=mips32r2 -Wa,-32 -Wa,-march=mips32r2 -Wa,-mips32r2 -Wa,--trap -DMODULE $(WFLAGS)
-
-export CFLAGS
-endif
-
-ifeq ($(PLATFORM),SIGMA_8622)
-CFLAGS := -D__KERNEL__ -I$(CROSS_COMPILE_INCLUDE)/include -I$(LINUX_SRC)/include -I$(RT28xx_DIR)/include -Wall -Wstrict-prototypes -Wno-trigraphs -O2 -fno-strict-aliasing -fno-common -fno-common -pipe -fno-builtin -D__linux__ -DNO_MM -mapcs-32 -march=armv4 -mtune=arm7tdmi -msoft-float -DMODULE -mshort-load-bytes -nostdinc -iwithprefix -DMODULE $(WFLAGS)
-export CFLAGS
-endif
-
-ifeq ($(PLATFORM),5VT)
-CFLAGS := -D__KERNEL__ -I$(LINUX_SRC)/include -I$(RT28xx_DIR)/include -mlittle-endian -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs -fno-strict-aliasing -fno-common -O3 -fno-omit-frame-pointer -fno-optimize-sibling-calls -fno-omit-frame-pointer -mapcs -mno-sched-prolog -mabi=apcs-gnu -mno-thumb-interwork -D__LINUX_ARM_ARCH__=5 -march=armv5te -mtune=arm926ej-s --param max-inline-insns-single=40000  -Uarm -Wdeclaration-after-statement -Wno-pointer-sign -DMODULE $(WFLAGS)
-
-export CFLAGS
-endif
-
-ifeq ($(PLATFORM),IKANOS_V160)
-CFLAGS := -D__KERNEL__ -I$(LINUX_SRC)/include -I$(LINUX_SRC)/include/asm/gcc -I$(LINUX_SRC)/include/asm-mips/mach-tango2 -I$(LINUX_SRC)/include/asm-mips/mach-tango2 -I$(LINUX_SRC)/include/asm-mips/mach-generic -I$(RT28xx_DIR)/include -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs -fno-strict-aliasing -fno-common -ffreestanding -O2 -fomit-frame-pointer -G 0 -mno-abicalls -fno-pic -pipe -march=lx4189 -Wa, -DMODULE $(WFLAGS)
-export CFLAGS
-endif
-
-ifeq ($(PLATFORM),IKANOS_V180)
-CFLAGS := -D__KERNEL__ -I$(LINUX_SRC)/include -I$(LINUX_SRC)/include/asm/gcc -I$(LINUX_SRC)/include/asm-mips/mach-tango2 -I$(LINUX_SRC)/include/asm-mips/mach-tango2 -I$(LINUX_SRC)/include/asm-mips/mach-generic -I$(RT28xx_DIR)/include -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs -fno-strict-aliasing -fno-common -ffreestanding -O2 -fomit-frame-pointer -G 0 -mno-abicalls -fno-pic -pipe -mips32r2 -Wa, -DMODULE $(WFLAGS)
-export CFLAGS
-endif
-
-ifeq ($(PLATFORM),INF_TWINPASS)
-CFLAGS := -D__KERNEL__ -DMODULE -I$(LINUX_SRC)/include -I$(RT28xx_DIR)/include -Wall -Wstrict-prototypes -Wno-trigraphs -O2 -fomit-frame-pointer -fno-strict-aliasing -fno-common -G 0 -mno-abicalls -fno-pic -march=4kc -mips32 -Wa,--trap -pipe -mlong-calls $(WFLAGS)
-export CFLAGS
-endif
-
-ifeq ($(PLATFORM),INF_DANUBE)
-CFLAGS := -I$(RT28xx_DIR)/include $(WFLAGS) -Wundef -fno-strict-aliasing -fno-common -ffreestanding -Os -fomit-frame-pointer -G 0 -mno-abicalls -fno-pic -pipe -msoft-float  -mabi=32 -march=mips32 -Wa,-32 -Wa,-march=mips32 -Wa,-mips32 -Wa,--trap -I$(LINUX_SRC)/include/asm-mips/mach-generic
-export CFLAGS
-endif
-
-ifeq ($(PLATFORM),BRCM_6358)
-CFLAGS := $(WFLAGS) -I$(RT28xx_DIR)/include -nostdinc -iwithprefix include -D__KERNEL__ -Wall -Wstrict-prototypes -Wno-trigraphs -fno-strict-aliasing -fno-common -I $(LINUX_SRC)/include/asm/gcc -G 0 -mno-abicalls -fno-pic -pipe  -finline-limit=100000 -mabi=32 -march=mips32 -Wa,-32 -Wa,-march=mips32 -Wa,-mips32 -Wa,--trap -I$(LINUX_SRC)/include/asm-mips/mach-bcm963xx -I$(LINUX_SRC)/include/asm-mips/mach-generic  -Os -fomit-frame-pointer -Wdeclaration-after-statement  -DMODULE -mlong-calls
-export CFLAGS
-endif
-
-ifeq ($(PLATFORM),PC)
-    ifneq (,$(findstring 2.4,$(LINUX_SRC)))
-	# Linux 2.4
-	CFLAGS := -D__KERNEL__ -I$(LINUX_SRC)/include -I$(RT28xx_DIR)/include -O2 -fomit-frame-pointer -fno-strict-aliasing -fno-common -pipe -mpreferred-stack-boundary=2 -march=i686 -DMODULE -DMODVERSIONS -include $(LINUX_SRC)/include/linux/modversions.h $(WFLAGS)
-	export CFLAGS
-    else
-	# Linux 2.6
-	EXTRA_CFLAGS := $(WFLAGS) -I$(RT28xx_DIR)/include
-    endif
-endif
-
-ifeq ($(PLATFORM),IXP)
-        EXTRA_CFLAGS := -v $(WFLAGS) -I$(RT28xx_DIR)/include -mbig-endian
-endif
-
-ifeq ($(PLATFORM),CAVM_OCTEON)
-	EXTRA_CFLAGS := $(WFLAGS) -I$(RT28xx_DIR)/include \
-				    -mabi=64 $(WFLAGS)
-export CFLAGS
-endif
-
diff --git a/drivers/staging/rt3090/crypt_hmac.h b/drivers/staging/rt2860/crypt_hmac.h
index 557ca733d398..7a56515d7266 100644
--- a/drivers/staging/rt3090/crypt_hmac.h
+++ b/drivers/staging/rt2860/crypt_hmac.h
@@ -23,19 +23,20 @@
  * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
  *                                                                       *
  *************************************************************************
+ */
 
+/****************************************************************************
     Module Name:
-    crypt_hmac.h
+    HMAC
 
     Abstract:
-    Miniport generic portion header file
+    FIPS 198: The Keyed-Hash Message Authentication Code (HMAC)
 
     Revision History:
-    Who         When          What
-    --------    ----------    ----------------------------------------------
+    Who         When            What
+    --------    ----------      ------------------------------------------
     Eddy        2008/11/24      Create HMAC-SHA1, HMAC-SHA256
-*/
-
+***************************************************************************/
 #ifndef __CRYPT_HMAC_H__
 #define __CRYPT_HMAC_H__
 
@@ -47,35 +48,18 @@
 
 #ifdef SHA1_SUPPORT
 #define HMAC_SHA1_SUPPORT
-VOID HMAC_SHA1 (
-    IN  const UINT8 Key[],
-    IN  UINT KeyLen,
-    IN  const UINT8 Message[],
-    IN  UINT MessageLen,
-    OUT UINT8 MAC[],
-    IN  UINT MACLen);
+void HMAC_SHA1(IN const u8 Key[],
+	       u32 KeyLen,
+	       IN const u8 Message[],
+	       u32 MessageLen, u8 MAC[], u32 MACLen);
 #endif /* SHA1_SUPPORT */
 
-#ifdef SHA256_SUPPORT
-#define HMAC_SHA256_SUPPORT
-VOID HMAC_SHA256 (
-    IN  const UINT8 Key[],
-    IN  UINT KeyLen,
-    IN  const UINT8 Message[],
-    IN  UINT MessageLen,
-    OUT UINT8 MAC[],
-    IN  UINT MACLen);
-#endif /* SHA256_SUPPORT */
-
 #ifdef MD5_SUPPORT
 #define HMAC_MD5_SUPPORT
-VOID HMAC_MD5 (
-    IN  const UINT8 Key[],
-    IN  UINT KeyLen,
-    IN  const UINT8 Message[],
-    IN  UINT MessageLen,
-    OUT UINT8 MAC[],
-    IN  UINT MACLen);
+void HMAC_MD5(IN const u8 Key[],
+	      u32 KeyLen,
+	      IN const u8 Message[],
+	      u32 MessageLen, u8 MAC[], u32 MACLen);
 #endif /* MD5_SUPPORT */
 
 #endif /* __CRYPT_HMAC_H__ */
diff --git a/drivers/staging/rt3090/crypt_md5.h b/drivers/staging/rt2860/crypt_md5.h
index 7ee3f4233fad..26f974554b26 100644
--- a/drivers/staging/rt3090/crypt_md5.h
+++ b/drivers/staging/rt2860/crypt_md5.h
@@ -23,18 +23,20 @@
  * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
  *                                                                       *
  *************************************************************************
+ */
 
+/****************************************************************************
     Module Name:
-    crypt_md5.h
+    MD5
 
     Abstract:
-    Miniport generic portion header file
+    RFC1321: The MD5 Message-Digest Algorithm
 
     Revision History:
-    Who         When          What
-    --------    ----------    ----------------------------------------------
+    Who         When            What
+    --------    ----------      ------------------------------------------
     Eddy        2008/11/24      Create md5
-*/
+***************************************************************************/
 
 #ifndef __CRYPT_MD5_H__
 #define __CRYPT_MD5_H__
@@ -49,30 +51,23 @@
 #define MD5_SUPPORT
 
 #ifdef MD5_SUPPORT
-#define MD5_BLOCK_SIZE    64 /* 512 bits = 64 bytes */
-#define MD5_DIGEST_SIZE   16 /* 128 bits = 16 bytes */
-typedef struct {
-    UINT32 HashValue[4];
-    UINT64 MessageLen;
-    UINT8  Block[MD5_BLOCK_SIZE];
-    UINT   BlockLen;
-} MD5_CTX_STRUC, *PMD5_CTX_STRUC;
+#define MD5_BLOCK_SIZE    64	/* 512 bits = 64 bytes */
+#define MD5_DIGEST_SIZE   16	/* 128 bits = 16 bytes */
 
-VOID MD5_Init (
-    IN  MD5_CTX_STRUC *pMD5_CTX);
-VOID MD5_Hash (
-    IN  MD5_CTX_STRUC *pMD5_CTX);
-VOID MD5_Append (
-    IN  MD5_CTX_STRUC *pMD5_CTX,
-    IN  const UINT8 Message[],
-    IN  UINT MessageLen);
-VOID MD5_End (
-    IN  MD5_CTX_STRUC *pMD5_CTX,
-    OUT UINT8 DigestMessage[]);
-VOID RT_MD5 (
-    IN  const UINT8 Message[],
-    IN  UINT MessageLen,
-    OUT UINT8 DigestMessage[]);
+struct rt_md5_ctx_struc {
+	u32 HashValue[4];
+	u64 MessageLen;
+	u8 Block[MD5_BLOCK_SIZE];
+	u32 BlockLen;
+};
+
+void MD5_Init(struct rt_md5_ctx_struc *pMD5_CTX);
+void MD5_Hash(struct rt_md5_ctx_struc *pMD5_CTX);
+void MD5_Append(struct rt_md5_ctx_struc *pMD5_CTX,
+		IN const u8 Message[], u32 MessageLen);
+void MD5_End(struct rt_md5_ctx_struc *pMD5_CTX, u8 DigestMessage[]);
+void RT_MD5(IN const u8 Message[],
+	    u32 MessageLen, u8 DigestMessage[]);
 #endif /* MD5_SUPPORT */
 
 #endif /* __CRYPT_MD5_H__ */
diff --git a/drivers/staging/rt3090/vr_ikans.h b/drivers/staging/rt2860/crypt_sha2.h
index 16bff3bec43b..20d11ab865c1 100644
--- a/drivers/staging/rt3090/vr_ikans.h
+++ b/drivers/staging/rt2860/crypt_sha2.h
@@ -23,49 +23,51 @@
  * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
  *                                                                       *
  *************************************************************************
+ */
 
+/****************************************************************************
     Module Name:
-	vr_ikans.h
+    SHA2
 
     Abstract:
-    Handle association related requests either from WSTA or from local MLME
+    FIPS 180-2: Secure Hash Standard (SHS)
 
     Revision History:
-    Who          When          What
-    ---------    ----------    ----------------------------------------------
-    Sample Lin	01-28-2008    Created
- */
+    Who         When            What
+    --------    ----------      ------------------------------------------
+    Eddy        2008/11/24      Create SHA1
+    Eddy        2008/07/23      Create SHA256
+***************************************************************************/
 
-#ifndef __VR_IKANS_H__
-#define __VR_IKANS_H__
+#ifndef __CRYPT_SHA2_H__
+#define __CRYPT_SHA2_H__
 
-#ifndef MODULE_IKANOS
-#define IKANOS_EXTERN	extern
+#ifdef CRYPT_TESTPLAN
+#include "crypt_testplan.h"
 #else
-#define IKANOS_EXTERN
-#endif // MODULE_IKANOS //
-
-#ifdef IKANOS_VX_1X0
-	typedef void (*IkanosWlanTxCbFuncP)(void *, void *);
-
-	struct IKANOS_TX_INFO
-	{
-		struct net_device *netdev;
-		IkanosWlanTxCbFuncP *fp;
-	};
-#endif // IKANOS_VX_1X0 //
-
-
-IKANOS_EXTERN void VR_IKANOS_FP_Init(UINT8 BssNum, UINT8 *pApMac);
+#include "rt_config.h"
+#endif /* CRYPT_TESTPLAN */
 
-IKANOS_EXTERN INT32 IKANOS_DataFramesTx(struct sk_buff *pSkb,
-										struct net_device *pNetDev);
+/* Algorithm options */
+#define SHA1_SUPPORT
 
-IKANOS_EXTERN void IKANOS_DataFrameRx(PRTMP_ADAPTER pAd,
-										void *pRxParam,
-										struct sk_buff *pSkb,
-										UINT32 Length);
+#ifdef SHA1_SUPPORT
+#define SHA1_BLOCK_SIZE    64	/* 512 bits = 64 bytes */
+#define SHA1_DIGEST_SIZE   20	/* 160 bits = 20 bytes */
+struct rt_sha1_ctx {
+	u32 HashValue[5];	/* 5 = (SHA1_DIGEST_SIZE / 32) */
+	u64 MessageLen;	/* total size */
+	u8 Block[SHA1_BLOCK_SIZE];
+	u32 BlockLen;
+};
 
-#endif // __VR_IKANS_H__ //
+void RT_SHA1_Init(struct rt_sha1_ctx *pSHA_CTX);
+void SHA1_Hash(struct rt_sha1_ctx *pSHA_CTX);
+void SHA1_Append(struct rt_sha1_ctx *pSHA_CTX,
+		 IN const u8 Message[], u32 MessageLen);
+void SHA1_End(struct rt_sha1_ctx *pSHA_CTX, u8 DigestMessage[]);
+void RT_SHA1(IN const u8 Message[],
+	     u32 MessageLen, u8 DigestMessage[]);
+#endif /* SHA1_SUPPORT */
 
-/* End of vr_ikans.h */
+#endif /* __CRYPT_SHA2_H__ */
diff --git a/drivers/staging/rt2860/dfs.h b/drivers/staging/rt2860/dfs.h
index f34f6183625c..5fbab259acae 100644
--- a/drivers/staging/rt2860/dfs.h
+++ b/drivers/staging/rt2860/dfs.h
@@ -36,53 +36,4 @@
     Fonchi    03-12-2007      created
 */
 
-#define RADAR_PULSE 1
-#define RADAR_WIDTH 2
-
-#define WIDTH_RD_IDLE 0
-#define WIDTH_RD_CHECK 1
-
-
-VOID BbpRadarDetectionStart(
-	IN PRTMP_ADAPTER pAd);
-
-VOID BbpRadarDetectionStop(
-	IN PRTMP_ADAPTER pAd);
-
-VOID RadarDetectionStart(
-	IN PRTMP_ADAPTER pAd,
-	IN BOOLEAN CTS_Protect,
-	IN UINT8 CTSPeriod);
-
-VOID RadarDetectionStop(
-	IN PRTMP_ADAPTER	pAd);
-
-VOID RadarDetectPeriodic(
-	IN PRTMP_ADAPTER	pAd);
-
-
-BOOLEAN RadarChannelCheck(
-	IN PRTMP_ADAPTER	pAd,
-	IN UCHAR			Ch);
-
-ULONG JapRadarType(
-	IN PRTMP_ADAPTER pAd);
-
-ULONG RTMPBbpReadRadarDuration(
-	IN PRTMP_ADAPTER	pAd);
-
-ULONG RTMPReadRadarDuration(
-	IN PRTMP_ADAPTER	pAd);
-
-VOID RTMPCleanRadarDuration(
-	IN PRTMP_ADAPTER	pAd);
-
-INT Set_ChMovingTime_Proc(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR arg);
-
-INT Set_LongPulseRadarTh_Proc(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR arg);
-
-
+BOOLEAN RadarChannelCheck(struct rt_rtmp_adapter *pAd, u8 Ch);
diff --git a/drivers/staging/rt3090/eeprom.h b/drivers/staging/rt2860/eeprom.h
index ee0e807decb4..039801a97099 100644
--- a/drivers/staging/rt3090/eeprom.h
+++ b/drivers/staging/rt2860/eeprom.h
@@ -24,59 +24,44 @@
  *                                                                       *
  *************************************************************************
 
-    Module Name:
-    eeprom.h
+	Module Name:
+	eeprom.h
 
-    Abstract:
-    Miniport generic portion header file
+	Abstract:
+	Miniport header file for eeprom related information
 
-    Revision History:
-    Who         When          What
-    --------    ----------    ----------------------------------------------
+	Revision History:
+	Who         When          What
+	--------    ----------    ----------------------------------------------
 */
 #ifndef __EEPROM_H__
 #define __EEPROM_H__
 
-
-
 #ifdef RTMP_PCI_SUPPORT
 /*************************************************************************
   *	Public function declarations for prom-based chipset
   ************************************************************************/
-int rtmp_ee_prom_read16(
-	IN PRTMP_ADAPTER	pAd,
-	IN USHORT			Offset,
-	OUT USHORT			*pValue);
-
-int rtmp_ee_prom_write16(
-	IN PRTMP_ADAPTER	pAd,
-	IN USHORT			Offset,
-	IN USHORT			value);
-#endif // RTMP_PCI_SUPPORT //
-
-
-
-
+int rtmp_ee_prom_read16(struct rt_rtmp_adapter *pAd,
+			u16 Offset, u16 * pValue);
+#endif /* RTMP_PCI_SUPPORT // */
+#ifdef RTMP_USB_SUPPORT
+/*************************************************************************
+  *	Public function declarations for usb-based prom chipset
+  ************************************************************************/
+int RTUSBReadEEPROM16(struct rt_rtmp_adapter *pAd,
+			   u16 offset, u16 *pData);
+#endif /* RTMP_USB_SUPPORT // */
 
 #ifdef RT30xx
 #ifdef RTMP_EFUSE_SUPPORT
-int rtmp_ee_efuse_read16(
-	IN RTMP_ADAPTER *pAd,
-	IN USHORT Offset,
-	OUT USHORT *pValue);
-
-int rtmp_ee_efuse_write16(
-	IN RTMP_ADAPTER *pAd,
-	IN USHORT Offset,
-	IN USHORT data);
-#endif // RTMP_EFUSE_SUPPORT //
-#endif // RT30xx //
+int rtmp_ee_efuse_read16(struct rt_rtmp_adapter *pAd,
+			 u16 Offset, u16 * pValue);
+#endif /* RTMP_EFUSE_SUPPORT // */
+#endif /* RT30xx // */
 
 /*************************************************************************
   *	Public function declarations for prom operation callback functions setting
   ************************************************************************/
-INT RtmpChipOpsEepromHook(
-	IN RTMP_ADAPTER *pAd,
-	IN INT			infType);
+int RtmpChipOpsEepromHook(struct rt_rtmp_adapter *pAd, int infType);
 
-#endif // __EEPROM_H__ //
+#endif /* __EEPROM_H__ // */
diff --git a/drivers/staging/rt3090/rtmp_pci.h b/drivers/staging/rt2860/iface/rtmp_pci.h
index c2fed29058f4..7759d56a3043 100644
--- a/drivers/staging/rt3090/rtmp_pci.h
+++ b/drivers/staging/rt2860/iface/rtmp_pci.h
@@ -25,13 +25,11 @@
  *************************************************************************
 */
 
-
 #ifndef __RTMP_PCI_H__
 #define __RTMP_PCI_H__
 
 #define RT28XX_HANDLE_DEV_ASSIGN(handle, dev_p)				\
-	((POS_COOKIE)handle)->pci_dev = dev_p;
-
+	((struct os_cookie *)handle)->pci_dev = dev_p;
 
 #ifdef LINUX
 // set driver data
@@ -39,26 +37,25 @@
 
 #define RT28XX_PUT_DEVICE(dev_p)
 
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,24)
 #define SA_SHIRQ IRQF_SHARED
-#endif
 
 #ifdef PCI_MSI_SUPPORT
 #define RTMP_MSI_ENABLE(_pAd) \
-{	POS_COOKIE _pObj = (POS_COOKIE)(_pAd->OS_Cookie); \
-	(_pAd)->HaveMsi =	pci_enable_msi(_pObj->pci_dev) == 0 ? TRUE : FALSE; }
+	{     struct os_cookie *_pObj = (struct os_cookie *)(_pAd->OS_Cookie); \
+		(_pAd)->HaveMsi = pci_enable_msi(_pObj->pci_dev) == 0 ? TRUE : FALSE; \
+	}
 
 #define RTMP_MSI_DISABLE(_pAd) \
-{	POS_COOKIE _pObj = (POS_COOKIE)(_pAd->OS_Cookie); \
-	if (_pAd->HaveMsi == TRUE) \
-		pci_disable_msi(_pObj->pci_dev); \
-	_pAd->HaveMsi = FALSE;	}
+	{     struct os_cookie *_pObj = (struct os_cookie *)(_pAd->OS_Cookie); \
+		if (_pAd->HaveMsi == TRUE) \
+			pci_disable_msi(_pObj->pci_dev); \
+		_pAd->HaveMsi = FALSE;  \
+	}
 #else
-#define RTMP_MSI_ENABLE(_pAd)
-#define RTMP_MSI_DISABLE(_pAd)
+#define RTMP_MSI_ENABLE(_pAd)		do{}while(0)
+#define RTMP_MSI_DISABLE(_pAd)		do{}while(0)
 #endif // PCI_MSI_SUPPORT //
 
-
 #define RTMP_PCI_DEV_UNMAP()										\
 {	if (net_dev->base_addr)	{								\
 		iounmap((void *)(net_dev->base_addr));				\
@@ -66,32 +63,6 @@
 							pci_resource_len(dev_p, 0)); }	\
 	if (net_dev->irq) pci_release_regions(dev_p); }
 
-
-#define RTMP_IRQ_REQUEST(net_dev)							\
-{	PRTMP_ADAPTER _pAd = (PRTMP_ADAPTER)(RTMP_OS_NETDEV_GET_PRIV(net_dev));	\
-	POS_COOKIE _pObj = (POS_COOKIE)(_pAd->OS_Cookie);		\
-	RTMP_MSI_ENABLE(_pAd);									\
-	if ((retval = request_irq(_pObj->pci_dev->irq,		\
-							rt2860_interrupt, SA_SHIRQ,		\
-							(net_dev)->name, (net_dev)))) {	\
-		DBGPRINT(RT_DEBUG_ERROR, ("request_irq  error(%d)\n", retval));	\
-	return retval; } }
-
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,5,0)
-#define RTMP_IRQ_RELEASE(net_dev)								\
-{	PRTMP_ADAPTER _pAd = (PRTMP_ADAPTER)(RTMP_OS_NETDEV_GET_PRIV(net_dev));		\
-	POS_COOKIE _pObj = (POS_COOKIE)(_pAd->OS_Cookie);			\
-	synchronize_irq(_pObj->pci_dev->irq);						\
-	free_irq(_pObj->pci_dev->irq, (net_dev));					\
-	RTMP_MSI_DISABLE(_pAd); }
-#else
-#define RTMP_IRQ_RELEASE(net_dev)								\
-{	PRTMP_ADAPTER _pAd = (PRTMP_ADAPTER)(RTMP_OS_NETDEV_GET_PRIV(net_dev));		\
-	POS_COOKIE _pObj = (POS_COOKIE)(_pAd->OS_Cookie);			\
-	free_irq(_pObj->pci_dev->irq, (net_dev));					\
-	RTMP_MSI_DISABLE(_pAd); }
-#endif
-
 #define PCI_REG_READ_WORD(pci_dev, offset, Configuration)   \
     if (pci_read_config_word(pci_dev, offset, &reg16) == 0)     \
         Configuration = le2cpu16(reg16);                        \
@@ -100,11 +71,8 @@
 
 #define PCI_REG_WIRTE_WORD(pci_dev, offset, Configuration)  \
     reg16 = cpu2le16(Configuration);                        \
-    pci_write_config_word(pci_dev, offset, reg16);          \
+    pci_write_config_word(pci_dev, offset, reg16);
 
 #endif // LINUX //
 
-
-
-
 #endif // __RTMP_PCI_H__ //
diff --git a/drivers/staging/rt2860/iface/rtmp_usb.h b/drivers/staging/rt2860/iface/rtmp_usb.h
new file mode 100644
index 000000000000..6bb384a74660
--- /dev/null
+++ b/drivers/staging/rt2860/iface/rtmp_usb.h
@@ -0,0 +1,182 @@
+/*
+ *************************************************************************
+ * Ralink Tech Inc.
+ * 5F., No.36, Taiyuan St., Jhubei City,
+ * Hsinchu County 302,
+ * Taiwan, R.O.C.
+ *
+ * (c) Copyright 2002-2007, Ralink Technology, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify  *
+ * it under the terms of the GNU General Public License as published by  *
+ * the Free Software Foundation; either version 2 of the License, or     *
+ * (at your option) any later version.                                   *
+ *                                                                       *
+ * This program is distributed in the hope that it will be useful,       *
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
+ * GNU General Public License for more details.                          *
+ *                                                                       *
+ * You should have received a copy of the GNU General Public License     *
+ * along with this program; if not, write to the                         *
+ * Free Software Foundation, Inc.,                                       *
+ * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
+ *                                                                       *
+ *************************************************************************
+*/
+
+#ifndef __RTMP_USB_H__
+#define __RTMP_USB_H__
+
+#include "../rtusb_io.h"
+
+#ifdef LINUX
+#include <linux/usb.h>
+#endif // LINUX //
+
+extern u8 EpToQueue[6];
+
+#define RXBULKAGGRE_ZISE			12
+#define MAX_TXBULK_LIMIT			(LOCAL_TXBUF_SIZE*(BULKAGGRE_ZISE-1))
+#define MAX_TXBULK_SIZE			(LOCAL_TXBUF_SIZE*BULKAGGRE_ZISE)
+#define MAX_RXBULK_SIZE			(LOCAL_TXBUF_SIZE*RXBULKAGGRE_ZISE)
+#define MAX_MLME_HANDLER_MEMORY 20
+
+// Flags for Bulkflags control for bulk out data
+//
+#define	fRTUSB_BULK_OUT_DATA_NULL				0x00000001
+#define	fRTUSB_BULK_OUT_RTS						0x00000002
+#define	fRTUSB_BULK_OUT_MLME						0x00000004
+
+#define	fRTUSB_BULK_OUT_PSPOLL					0x00000010
+#define	fRTUSB_BULK_OUT_DATA_FRAG				0x00000020
+#define	fRTUSB_BULK_OUT_DATA_FRAG_2				0x00000040
+#define	fRTUSB_BULK_OUT_DATA_FRAG_3				0x00000080
+#define	fRTUSB_BULK_OUT_DATA_FRAG_4				0x00000100
+
+#define	fRTUSB_BULK_OUT_DATA_NORMAL				0x00010000
+#define	fRTUSB_BULK_OUT_DATA_NORMAL_2			0x00020000
+#define	fRTUSB_BULK_OUT_DATA_NORMAL_3			0x00040000
+#define	fRTUSB_BULK_OUT_DATA_NORMAL_4			0x00080000
+
+// TODO:move to ./ate/include/iface/ate_usb.h
+
+#define FREE_HTTX_RING(_pCookie, _pipeId, _txContext)			\
+{										\
+	if ((_txContext)->ENextBulkOutPosition == (_txContext)->CurWritePosition)	\
+	{																	\
+		(_txContext)->bRingEmpty = TRUE;			\
+	}																	\
+	/*NdisInterlockedDecrement(&(_p)->TxCount); */\
+}
+
+/******************************************************************************
+
+	USB Bulk operation related definitions
+
+******************************************************************************/
+
+#ifdef LINUX
+#define BULKAGGRE_ZISE          100
+#define RT28XX_PUT_DEVICE							usb_put_dev
+#define RTUSB_ALLOC_URB(iso)							usb_alloc_urb(iso, GFP_ATOMIC)
+#define RTUSB_SUBMIT_URB(pUrb)							usb_submit_urb(pUrb, GFP_ATOMIC)
+#define RTUSB_URB_ALLOC_BUFFER(pUsb_Dev, BufSize, pDma_addr)			usb_buffer_alloc(pUsb_Dev, BufSize, GFP_ATOMIC, pDma_addr)
+#define RTUSB_URB_FREE_BUFFER(pUsb_Dev, BufSize, pTransferBuf, Dma_addr)	usb_buffer_free(pUsb_Dev, BufSize, pTransferBuf, Dma_addr)
+
+#define RTUSB_FREE_URB(pUrb)	usb_free_urb(pUrb)
+
+// unlink urb
+#define RTUSB_UNLINK_URB(pUrb)		usb_kill_urb(pUrb)
+
+extern void dump_urb(struct urb *purb);
+
+#define InterlockedIncrement		atomic_inc
+#define NdisInterlockedIncrement	atomic_inc
+#define InterlockedDecrement		atomic_dec
+#define NdisInterlockedDecrement	atomic_dec
+#define InterlockedExchange		atomic_set
+
+#endif // LINUX //
+
+#define NT_SUCCESS(status)			(((status) >=0) ? (TRUE):(FALSE))
+
+#define USBD_TRANSFER_DIRECTION_OUT		0
+#define USBD_TRANSFER_DIRECTION_IN		0
+#define USBD_SHORT_TRANSFER_OK			0
+#define PURB			struct urb *
+
+#define PIRP		void *
+#define NDIS_OID	u32
+#ifndef USB_ST_NOERROR
+#define USB_ST_NOERROR     0
+#endif
+
+// vendor-specific control operations
+#define CONTROL_TIMEOUT_JIFFIES ( (100 * OS_HZ) / 1000)
+#define UNLINK_TIMEOUT_MS		3
+
+void RTUSBBulkOutDataPacketComplete(struct urb *purb, struct pt_regs *pt_regs);
+void RTUSBBulkOutMLMEPacketComplete(struct urb *pUrb, struct pt_regs *pt_regs);
+void RTUSBBulkOutNullFrameComplete(struct urb *pUrb, struct pt_regs *pt_regs);
+void RTUSBBulkOutRTSFrameComplete(struct urb *pUrb, struct pt_regs *pt_regs);
+void RTUSBBulkOutPsPollComplete(struct urb *pUrb, struct pt_regs *pt_regs);
+void RTUSBBulkRxComplete(struct urb *pUrb, struct pt_regs *pt_regs);
+
+#ifdef KTHREAD_SUPPORT
+#define RTUSBMlmeUp(pAd) \
+	do{								    \
+		struct rt_rtmp_os_task *_pTask = &((pAd)->mlmeTask);\
+		if (_pTask->kthread_task) \
+        { \
+			_pTask->kthread_running = TRUE; \
+	        wake_up(&_pTask->kthread_q); \
+		} \
+	}while(0)
+#else
+#define RTUSBMlmeUp(pAd)	        \
+	do{								    \
+		struct rt_rtmp_os_task *_pTask = &((pAd)->mlmeTask);\
+		CHECK_PID_LEGALITY(_pTask->taskPID)		    \
+		{ \
+			RTMP_SEM_EVENT_UP(&(_pTask->taskSema)); \
+		}\
+	}while(0)
+#endif
+
+#ifdef KTHREAD_SUPPORT
+#define RTUSBCMDUp(pAd) \
+	do{	\
+		struct rt_rtmp_os_task *_pTask = &((pAd)->cmdQTask);	\
+		{ \
+			_pTask->kthread_running = TRUE; \
+	        wake_up(&_pTask->kthread_q); \
+		} \
+	}while(0)
+
+#else
+#define RTUSBCMDUp(pAd)	                \
+	do{									    \
+		struct rt_rtmp_os_task *_pTask = &((pAd)->cmdQTask);	\
+		CHECK_PID_LEGALITY(_pTask->taskPID)	    \
+		{\
+			RTMP_SEM_EVENT_UP(&(_pTask->taskSema)); \
+		}\
+	}while(0)
+#endif
+
+#define DEVICE_VENDOR_REQUEST_OUT       0x40
+#define DEVICE_VENDOR_REQUEST_IN        0xc0
+//#define INTERFACE_VENDOR_REQUEST_OUT    0x41
+//#define INTERFACE_VENDOR_REQUEST_IN     0xc1
+
+#define BULKOUT_MGMT_RESET_FLAG		0x80
+
+#define RTUSB_SET_BULK_FLAG(_M, _F)	((_M)->BulkFlags |= (_F))
+#define RTUSB_CLEAR_BULK_FLAG(_M, _F)	((_M)->BulkFlags &= ~(_F))
+#define RTUSB_TEST_BULK_FLAG(_M, _F)	(((_M)->BulkFlags & (_F)) != 0)
+
+#define RTMP_IRQ_REQUEST(net_dev)		do{}while(0)
+#define RTMP_IRQ_RELEASE(net_dev)		do{}while(0)
+
+#endif // __RTMP_USB_H__ //
diff --git a/drivers/staging/rt2860/md5.h b/drivers/staging/rt2860/md5.h
deleted file mode 100644
index d85db12170d5..000000000000
--- a/drivers/staging/rt2860/md5.h
+++ /dev/null
@@ -1,107 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-	Module Name:
-	md5.h
-
-	Abstract:
-
-	Revision History:
-	Who			When			What
-	--------	----------		----------------------------------------------
-	Name		Date			Modification logs
-	jan			10-28-03		Initial
-	Rita    	11-23-04		Modify MD5 and SHA-1
-*/
-
-#ifndef	uint8
-#define	uint8  unsigned	char
-#endif
-
-#ifndef	uint32
-#define	uint32 unsigned	long int
-#endif
-
-
-#ifndef	__MD5_H__
-#define	__MD5_H__
-
-#define MD5_MAC_LEN 16
-
-typedef struct _MD5_CTX {
-    UINT32   Buf[4];             // buffers of four states
-	UCHAR   Input[64];          // input message
-	UINT32   LenInBitCount[2];   // length counter for input message, 0 up to 64 bits
-}   MD5_CTX;
-
-VOID MD5Init(MD5_CTX *pCtx);
-VOID MD5Update(MD5_CTX *pCtx, UCHAR *pData, UINT32 LenInBytes);
-VOID MD5Final(UCHAR Digest[16], MD5_CTX *pCtx);
-VOID MD5Transform(UINT32 Buf[4], UINT32 Mes[16]);
-
-void md5_mac(u8 *key, size_t key_len, u8 *data, size_t data_len, u8 *mac);
-void hmac_md5(u8 *key, size_t key_len, u8 *data, size_t data_len, u8 *mac);
-
-//
-// SHA context
-//
-typedef	struct _SHA_CTX
-{
-	UINT32   Buf[5];             // buffers of five states
-	UCHAR   Input[80];          // input message
-	UINT32   LenInBitCount[2];   // length counter for input message, 0 up to 64 bits
-
-}	SHA_CTX;
-
-VOID SHAInit(SHA_CTX *pCtx);
-UCHAR SHAUpdate(SHA_CTX *pCtx, UCHAR *pData, UINT32 LenInBytes);
-VOID SHAFinal(SHA_CTX *pCtx, UCHAR Digest[20]);
-VOID SHATransform(UINT32 Buf[5], UINT32 Mes[20]);
-
-#define SHA_DIGEST_LEN 20
-#endif // __MD5_H__
-
-/******************************************************************************/
-#ifndef	_AES_H
-#define	_AES_H
-
-typedef	struct
-{
-	uint32 erk[64];		/* encryption round	keys */
-	uint32 drk[64];		/* decryption round	keys */
-	int	nr;				/* number of rounds	*/
-}
-aes_context;
-
-int	 rtmp_aes_set_key( aes_context *ctx,	uint8 *key,	int	nbits );
-void rtmp_aes_encrypt( aes_context *ctx,	uint8 input[16], uint8 output[16] );
-void rtmp_aes_decrypt( aes_context *ctx,	uint8 input[16], uint8 output[16] );
-
-void F(char *password, unsigned char *ssid, int ssidlength, int iterations, int count, unsigned char *output);
-int PasswordHash(char *password, unsigned char *ssid, int ssidlength, unsigned char *output);
-
-#endif /* aes.h	*/
-
diff --git a/drivers/staging/rt2860/mlme.h b/drivers/staging/rt2860/mlme.h
index 3d1a8284fbd4..11434132f93b 100644
--- a/drivers/staging/rt2860/mlme.h
+++ b/drivers/staging/rt2860/mlme.h
@@ -39,18 +39,20 @@
 #ifndef __MLME_H__
 #define __MLME_H__
 
-// maximum supported capability information -
-// ESS, IBSS, Privacy, Short Preamble, Spectrum mgmt, Short Slot
+#include "rtmp_dot11.h"
+
+/* maximum supported capability information - */
+/* ESS, IBSS, Privacy, Short Preamble, Spectrum mgmt, Short Slot */
 #define SUPPORTED_CAPABILITY_INFO   0x0533
 
 #define END_OF_ARGS                 -1
 #define LFSR_MASK                   0x80000057
-#define MLME_TASK_EXEC_INTV         100/*200*/       //
+#define MLME_TASK_EXEC_INTV         100/*200*/	/* */
 #define LEAD_TIME                   5
-#define MLME_TASK_EXEC_MULTIPLE       10  /*5*/       // MLME_TASK_EXEC_MULTIPLE * MLME_TASK_EXEC_INTV = 1 sec
-#define REORDER_EXEC_INTV         	100       // 0.1 sec
+#define MLME_TASK_EXEC_MULTIPLE       10  /*5*/	/* MLME_TASK_EXEC_MULTIPLE * MLME_TASK_EXEC_INTV = 1 sec */
+#define REORDER_EXEC_INTV         	100	/* 0.1 sec */
 
-// The definition of Radar detection duration region
+/* The definition of Radar detection duration region */
 #define CE		0
 #define FCC		1
 #define JAP		2
@@ -58,62 +60,61 @@
 #define JAP_W56	4
 #define MAX_RD_REGION 5
 
-#ifdef	NDIS51_MINIPORT
-#define BEACON_LOST_TIME            4000       // 2048 msec = 2 sec
-#else
-#define BEACON_LOST_TIME            4 * OS_HZ    // 2048 msec = 2 sec
-#endif
-
-#define DLS_TIMEOUT                 1200      // unit: msec
-#define AUTH_TIMEOUT                300       // unit: msec
-#define ASSOC_TIMEOUT               300       // unit: msec
-#define JOIN_TIMEOUT                2 * OS_HZ      // unit: msec
-#define SHORT_CHANNEL_TIME          90        // unit: msec
-#define MIN_CHANNEL_TIME            110        // unit: msec, for dual band scan
-#define MAX_CHANNEL_TIME            140       // unit: msec, for single band scan
-#define	FAST_ACTIVE_SCAN_TIME	    30 		  // Active scan waiting for probe response time
-#define CW_MIN_IN_BITS              4         // actual CwMin = 2^CW_MIN_IN_BITS - 1
-#define CW_MAX_IN_BITS              10        // actual CwMax = 2^CW_MAX_IN_BITS - 1
-
-// Note: RSSI_TO_DBM_OFFSET has been changed to variable for new RF (2004-0720).
-// SHould not refer to this constant anymore
-//#define RSSI_TO_DBM_OFFSET          120 // for RT2530 RSSI-115 = dBm
-#define RSSI_FOR_MID_TX_POWER       -55  // -55 db is considered mid-distance
-#define RSSI_FOR_LOW_TX_POWER       -45  // -45 db is considered very short distance and
-                                        // eligible to use a lower TX power
+#define BEACON_LOST_TIME            4 * OS_HZ	/* 2048 msec = 2 sec */
+
+#define DLS_TIMEOUT                 1200	/* unit: msec */
+#define AUTH_TIMEOUT                300	/* unit: msec */
+#define ASSOC_TIMEOUT               300	/* unit: msec */
+#define JOIN_TIMEOUT                2000	/* unit: msec */
+#define SHORT_CHANNEL_TIME          90	/* unit: msec */
+#define MIN_CHANNEL_TIME            110	/* unit: msec, for dual band scan */
+#define MAX_CHANNEL_TIME            140	/* unit: msec, for single band scan */
+#define	FAST_ACTIVE_SCAN_TIME	    30	/* Active scan waiting for probe response time */
+#define CW_MIN_IN_BITS              4	/* actual CwMin = 2^CW_MIN_IN_BITS - 1 */
+#define LINK_DOWN_TIMEOUT           20000	/* unit: msec */
+#define AUTO_WAKEUP_TIMEOUT			70	/*unit: msec */
+
+#define CW_MAX_IN_BITS              10	/* actual CwMax = 2^CW_MAX_IN_BITS - 1 */
+
+/* Note: RSSI_TO_DBM_OFFSET has been changed to variable for new RF (2004-0720). */
+/* SHould not refer to this constant anymore */
+/*#define RSSI_TO_DBM_OFFSET          120 // for RT2530 RSSI-115 = dBm */
+#define RSSI_FOR_MID_TX_POWER       -55	/* -55 db is considered mid-distance */
+#define RSSI_FOR_LOW_TX_POWER       -45	/* -45 db is considered very short distance and */
+					/* eligible to use a lower TX power */
 #define RSSI_FOR_LOWEST_TX_POWER    -30
-//#define MID_TX_POWER_DELTA          0   // 0 db from full TX power upon mid-distance to AP
-#define LOW_TX_POWER_DELTA          6    // -3 db from full TX power upon very short distance. 1 grade is 0.5 db
-#define LOWEST_TX_POWER_DELTA       16   // -8 db from full TX power upon shortest distance. 1 grade is 0.5 db
+/*#define MID_TX_POWER_DELTA          0   // 0 db from full TX power upon mid-distance to AP */
+#define LOW_TX_POWER_DELTA          6	/* -3 db from full TX power upon very short distance. 1 grade is 0.5 db */
+#define LOWEST_TX_POWER_DELTA       16	/* -8 db from full TX power upon shortest distance. 1 grade is 0.5 db */
 
 #define RSSI_TRIGGERED_UPON_BELOW_THRESHOLD     0
 #define RSSI_TRIGGERED_UPON_EXCCEED_THRESHOLD   1
 #define RSSI_THRESHOLD_FOR_ROAMING              25
 #define RSSI_DELTA                              5
 
-// Channel Quality Indication
+/* Channel Quality Indication */
 #define CQI_IS_GOOD(cqi)            ((cqi) >= 50)
-//#define CQI_IS_FAIR(cqi)          (((cqi) >= 20) && ((cqi) < 50))
-#define CQI_IS_POOR(cqi)            (cqi < 50)  //(((cqi) >= 5) && ((cqi) < 20))
+/*#define CQI_IS_FAIR(cqi)          (((cqi) >= 20) && ((cqi) < 50)) */
+#define CQI_IS_POOR(cqi)            (cqi < 50)	/*(((cqi) >= 5) && ((cqi) < 20)) */
 #define CQI_IS_BAD(cqi)             (cqi < 5)
 #define CQI_IS_DEAD(cqi)            (cqi == 0)
 
-// weighting factor to calculate Channel quality, total should be 100%
+/* weighting factor to calculate Channel quality, total should be 100% */
 #define RSSI_WEIGHTING                   50
 #define TX_WEIGHTING                     30
 #define RX_WEIGHTING                     20
 
 #define BSS_NOT_FOUND                    0xFFFFFFFF
 
-#define MAX_LEN_OF_MLME_QUEUE            40 //10
+#define MAX_LEN_OF_MLME_QUEUE            40	/*10 */
 
-#define SCAN_PASSIVE                     18		// scan with no probe request, only wait beacon and probe response
-#define SCAN_ACTIVE                      19		// scan with probe request, and wait beacon and probe response
-#define	SCAN_CISCO_PASSIVE				 20		// Single channel passive scan
-#define	SCAN_CISCO_ACTIVE				 21		// Single channel active scan
-#define	SCAN_CISCO_NOISE				 22		// Single channel passive scan for noise histogram collection
-#define	SCAN_CISCO_CHANNEL_LOAD			 23		// Single channel passive scan for channel load collection
-#define FAST_SCAN_ACTIVE                 24		// scan with probe request, and wait beacon and probe response
+#define SCAN_PASSIVE                     18	/* scan with no probe request, only wait beacon and probe response */
+#define SCAN_ACTIVE                      19	/* scan with probe request, and wait beacon and probe response */
+#define	SCAN_CISCO_PASSIVE				 20	/* Single channel passive scan */
+#define	SCAN_CISCO_ACTIVE				 21	/* Single channel active scan */
+#define	SCAN_CISCO_NOISE				 22	/* Single channel passive scan for noise histogram collection */
+#define	SCAN_CISCO_CHANNEL_LOAD			 23	/* Single channel passive scan for channel load collection */
+#define FAST_SCAN_ACTIVE                 24	/* scan with probe request, and wait beacon and probe response */
 
 #define MAC_ADDR_IS_GROUP(Addr)       (((Addr[0]) & 0x01))
 #define MAC_ADDR_HASH(Addr)            (Addr[0] ^ Addr[1] ^ Addr[2] ^ Addr[3] ^ Addr[4] ^ Addr[5])
@@ -121,13 +122,13 @@
 #define TID_MAC_HASH(Addr,TID)            (TID^Addr[0] ^ Addr[1] ^ Addr[2] ^ Addr[3] ^ Addr[4] ^ Addr[5])
 #define TID_MAC_HASH_INDEX(Addr,TID)      (TID_MAC_HASH(Addr,TID) % HASH_TABLE_SIZE)
 
-// LED Control
-// assoiation ON. one LED ON. another blinking when TX, OFF when idle
-// no association, both LED off
+/* LED Control */
+/* assoiation ON. one LED ON. another blinking when TX, OFF when idle */
+/* no association, both LED off */
 #define ASIC_LED_ACT_ON(pAd)        RTMP_IO_WRITE32(pAd, MAC_CSR14, 0x00031e46)
 #define ASIC_LED_ACT_OFF(pAd)       RTMP_IO_WRITE32(pAd, MAC_CSR14, 0x00001e46)
 
-// bit definition of the 2-byte pBEACON->Capability field
+/* bit definition of the 2-byte pBEACON->Capability field */
 #define CAP_IS_ESS_ON(x)                 (((x) & 0x0001) != 0)
 #define CAP_IS_IBSS_ON(x)                (((x) & 0x0002) != 0)
 #define CAP_IS_CF_POLLABLE_ON(x)         (((x) & 0x0004) != 0)
@@ -136,44 +137,44 @@
 #define CAP_IS_SHORT_PREAMBLE_ON(x)      (((x) & 0x0020) != 0)
 #define CAP_IS_PBCC_ON(x)                (((x) & 0x0040) != 0)
 #define CAP_IS_AGILITY_ON(x)             (((x) & 0x0080) != 0)
-#define CAP_IS_SPECTRUM_MGMT(x)          (((x) & 0x0100) != 0)  // 802.11e d9
-#define CAP_IS_QOS(x)                    (((x) & 0x0200) != 0)  // 802.11e d9
+#define CAP_IS_SPECTRUM_MGMT(x)          (((x) & 0x0100) != 0)	/* 802.11e d9 */
+#define CAP_IS_QOS(x)                    (((x) & 0x0200) != 0)	/* 802.11e d9 */
 #define CAP_IS_SHORT_SLOT(x)             (((x) & 0x0400) != 0)
-#define CAP_IS_APSD(x)                   (((x) & 0x0800) != 0)  // 802.11e d9
-#define CAP_IS_IMMED_BA(x)               (((x) & 0x1000) != 0)  // 802.11e d9
+#define CAP_IS_APSD(x)                   (((x) & 0x0800) != 0)	/* 802.11e d9 */
+#define CAP_IS_IMMED_BA(x)               (((x) & 0x1000) != 0)	/* 802.11e d9 */
 #define CAP_IS_DSSS_OFDM(x)              (((x) & 0x2000) != 0)
-#define CAP_IS_DELAY_BA(x)               (((x) & 0x4000) != 0)  // 802.11e d9
+#define CAP_IS_DELAY_BA(x)               (((x) & 0x4000) != 0)	/* 802.11e d9 */
 
 #define CAP_GENERATE(ess,ibss,priv,s_pre,s_slot,spectrum)  (((ess) ? 0x0001 : 0x0000) | ((ibss) ? 0x0002 : 0x0000) | ((priv) ? 0x0010 : 0x0000) | ((s_pre) ? 0x0020 : 0x0000) | ((s_slot) ? 0x0400 : 0x0000) | ((spectrum) ? 0x0100 : 0x0000))
 
-#define ERP_IS_NON_ERP_PRESENT(x)        (((x) & 0x01) != 0)    // 802.11g
-#define ERP_IS_USE_PROTECTION(x)         (((x) & 0x02) != 0)    // 802.11g
-#define ERP_IS_USE_BARKER_PREAMBLE(x)    (((x) & 0x04) != 0)    // 802.11g
+#define ERP_IS_NON_ERP_PRESENT(x)        (((x) & 0x01) != 0)	/* 802.11g */
+#define ERP_IS_USE_PROTECTION(x)         (((x) & 0x02) != 0)	/* 802.11g */
+#define ERP_IS_USE_BARKER_PREAMBLE(x)    (((x) & 0x04) != 0)	/* 802.11g */
 
-#define DRS_TX_QUALITY_WORST_BOUND       8// 3  // just test by gary
+#define DRS_TX_QUALITY_WORST_BOUND       8	/* 3  // just test by gary */
 #define DRS_PENALTY                      8
 
 #define BA_NOTUSE 	2
-//BA Policy subfiled value in ADDBA frame
+/*BA Policy subfiled value in ADDBA frame */
 #define IMMED_BA 	1
 #define DELAY_BA	0
 
-// BA Initiator subfield in DELBA frame
+/* BA Initiator subfield in DELBA frame */
 #define ORIGINATOR	1
 #define RECIPIENT	0
 
-// ADDBA Status Code
+/* ADDBA Status Code */
 #define ADDBA_RESULTCODE_SUCCESS					0
 #define ADDBA_RESULTCODE_REFUSED					37
 #define ADDBA_RESULTCODE_INVALID_PARAMETERS			38
 
-// DELBA Reason Code
+/* DELBA Reason Code */
 #define DELBA_REASONCODE_QSTA_LEAVING				36
 #define DELBA_REASONCODE_END_BA						37
 #define DELBA_REASONCODE_UNKNOWN_BA					38
 #define DELBA_REASONCODE_TIMEOUT					39
 
-// reset all OneSecTx counters
+/* reset all OneSecTx counters */
 #define RESET_ONE_SEC_TX_CNT(__pEntry) \
 if (((__pEntry)) != NULL) \
 { \
@@ -182,957 +183,868 @@ if (((__pEntry)) != NULL) \
 	(__pEntry)->OneSecTxNoRetryOkCount = 0; \
 }
 
-//
-// 802.11 frame formats
-//
-//  HT Capability INFO field in HT Cap IE .
-typedef struct PACKED {
-	USHORT	AdvCoding:1;
-	USHORT	ChannelWidth:1;
-	USHORT	MimoPs:2;//momi power safe
-	USHORT	GF:1;	//green field
-	USHORT	ShortGIfor20:1;
-	USHORT	ShortGIfor40:1;	//for40MHz
-	USHORT	TxSTBC:1;
-	USHORT	RxSTBC:2;
-	USHORT	DelayedBA:1;	//rt2860c not support
-	USHORT	AMsduSize:1;	// only support as zero
-	USHORT	CCKmodein40:1;
-	USHORT	PSMP:1;
-	USHORT	Forty_Mhz_Intolerant:1;
-	USHORT	LSIGTxopProSup:1;
-} HT_CAP_INFO, *PHT_CAP_INFO;
-
-//  HT Capability INFO field in HT Cap IE .
-typedef struct PACKED {
-	UCHAR	MaxRAmpduFactor:2;
-	UCHAR	MpduDensity:3;
-	UCHAR	rsv:3;//momi power safe
-} HT_CAP_PARM, *PHT_CAP_PARM;
-
-//  HT Capability INFO field in HT Cap IE .
-typedef struct PACKED {
-	UCHAR	MCSSet[10];
-	UCHAR	SupRate[2];  // unit : 1Mbps
-	UCHAR	TxMCSSetDefined:1;
-	UCHAR	TxRxNotEqual:1;
-	UCHAR	TxStream:2;
-	UCHAR	MpduDensity:1;
-	UCHAR	rsv:3;
-	UCHAR	rsv3[3];
-} HT_MCS_SET, *PHT_MCS_SET;
-
-//  HT Capability INFO field in HT Cap IE .
-typedef struct PACKED {
-	USHORT	Pco:1;
-	USHORT	TranTime:2;
-	USHORT	rsv:5;//momi power safe
-	USHORT	MCSFeedback:2;	//0:no MCS feedback, 2:unsolicited MCS feedback, 3:Full MCS feedback,  1:rsv.
-	USHORT	PlusHTC:1;	//+HTC control field support
-	USHORT	RDGSupport:1;	//reverse Direction Grant  support
-	USHORT	rsv2:4;
-} EXT_HT_CAP_INFO, *PEXT_HT_CAP_INFO;
-
-//  HT Beamforming field in HT Cap IE .
-typedef struct PACKED _HT_BF_CAP{
-	ULONG	TxBFRecCapable:1;
-	ULONG	RxSoundCapable:1;
-	ULONG	TxSoundCapable:1;
-	ULONG	RxNDPCapable:1;
-	ULONG	TxNDPCapable:1;
-	ULONG	ImpTxBFCapable:1;
-	ULONG	Calibration:2;
-	ULONG	ExpCSICapable:1;
-	ULONG	ExpNoComSteerCapable:1;
-	ULONG	ExpComSteerCapable:1;
-	ULONG	ExpCSIFbk:2;
-	ULONG	ExpNoComBF:2;
-	ULONG	ExpComBF:2;
-	ULONG	MinGrouping:2;
-	ULONG	CSIBFAntSup:2;
-	ULONG	NoComSteerBFAntSup:2;
-	ULONG	ComSteerBFAntSup:2;
-	ULONG	CSIRowBFSup:2;
-	ULONG	ChanEstimation:2;
-	ULONG	rsv:3;
-} HT_BF_CAP, *PHT_BF_CAP;
-
-//  HT antenna selection field in HT Cap IE .
-typedef struct PACKED _HT_AS_CAP{
-	UCHAR	AntSelect:1;
-	UCHAR	ExpCSIFbkTxASEL:1;
-	UCHAR	AntIndFbkTxASEL:1;
-	UCHAR	ExpCSIFbk:1;
-	UCHAR	AntIndFbk:1;
-	UCHAR	RxASel:1;
-	UCHAR	TxSoundPPDU:1;
-	UCHAR	rsv:1;
-} HT_AS_CAP, *PHT_AS_CAP;
-
-// Draft 1.0 set IE length 26, but is extensible..
+/* */
+/* 802.11 frame formats */
+/* */
+/*  HT Capability INFO field in HT Cap IE . */
+struct PACKED rt_ht_cap_info {
+	u16 AdvCoding:1;
+	u16 ChannelWidth:1;
+	u16 MimoPs:2;	/*momi power safe */
+	u16 GF:1;		/*green field */
+	u16 ShortGIfor20:1;
+	u16 ShortGIfor40:1;	/*for40MHz */
+	u16 TxSTBC:1;
+	u16 RxSTBC:2;
+	u16 DelayedBA:1;	/*rt2860c not support */
+	u16 AMsduSize:1;	/* only support as zero */
+	u16 CCKmodein40:1;
+	u16 PSMP:1;
+	u16 Forty_Mhz_Intolerant:1;
+	u16 LSIGTxopProSup:1;
+};
+
+/*  HT Capability INFO field in HT Cap IE . */
+struct PACKED rt_ht_cap_parm {
+	u8 MaxRAmpduFactor:2;
+	u8 MpduDensity:3;
+	u8 rsv:3;		/*momi power safe */
+};
+
+/*  HT Capability INFO field in HT Cap IE . */
+struct PACKED rt_ht_mcs_set {
+	u8 MCSSet[10];
+	u8 SupRate[2];	/* unit : 1Mbps */
+	u8 TxMCSSetDefined:1;
+	u8 TxRxNotEqual:1;
+	u8 TxStream:2;
+	u8 MpduDensity:1;
+	u8 rsv:3;
+	u8 rsv3[3];
+};
+
+/*  HT Capability INFO field in HT Cap IE . */
+struct PACKED rt_ext_ht_cap_info {
+	u16 Pco:1;
+	u16 TranTime:2;
+	u16 rsv:5;		/*momi power safe */
+	u16 MCSFeedback:2;	/*0:no MCS feedback, 2:unsolicited MCS feedback, 3:Full MCS feedback,  1:rsv. */
+	u16 PlusHTC:1;	/*+HTC control field support */
+	u16 RDGSupport:1;	/*reverse Direction Grant  support */
+	u16 rsv2:4;
+};
+
+/*  HT Beamforming field in HT Cap IE . */
+struct PACKED rt_ht_bf_cap {
+	unsigned long TxBFRecCapable:1;
+	unsigned long RxSoundCapable:1;
+	unsigned long TxSoundCapable:1;
+	unsigned long RxNDPCapable:1;
+	unsigned long TxNDPCapable:1;
+	unsigned long ImpTxBFCapable:1;
+	unsigned long Calibration:2;
+	unsigned long ExpCSICapable:1;
+	unsigned long ExpNoComSteerCapable:1;
+	unsigned long ExpComSteerCapable:1;
+	unsigned long ExpCSIFbk:2;
+	unsigned long ExpNoComBF:2;
+	unsigned long ExpComBF:2;
+	unsigned long MinGrouping:2;
+	unsigned long CSIBFAntSup:2;
+	unsigned long NoComSteerBFAntSup:2;
+	unsigned long ComSteerBFAntSup:2;
+	unsigned long CSIRowBFSup:2;
+	unsigned long ChanEstimation:2;
+	unsigned long rsv:3;
+};
+
+/*  HT antenna selection field in HT Cap IE . */
+struct PACKED rt_ht_as_cap {
+	u8 AntSelect:1;
+	u8 ExpCSIFbkTxASEL:1;
+	u8 AntIndFbkTxASEL:1;
+	u8 ExpCSIFbk:1;
+	u8 AntIndFbk:1;
+	u8 RxASel:1;
+	u8 TxSoundPPDU:1;
+	u8 rsv:1;
+};
+
+/* Draft 1.0 set IE length 26, but is extensible.. */
 #define SIZE_HT_CAP_IE		26
-// The structure for HT Capability IE.
-typedef struct PACKED _HT_CAPABILITY_IE{
-	HT_CAP_INFO		HtCapInfo;
-	HT_CAP_PARM		HtCapParm;
-//	HT_MCS_SET		HtMCSSet;
-	UCHAR			MCSSet[16];
-	EXT_HT_CAP_INFO	ExtHtCapInfo;
-	HT_BF_CAP		TxBFCap;	// beamforming cap. rt2860c not support beamforming.
-	HT_AS_CAP		ASCap;	//antenna selection.
-} HT_CAPABILITY_IE, *PHT_CAPABILITY_IE;
-
-
-// 802.11n draft3 related structure definitions.
-// 7.3.2.60
-#define dot11OBSSScanPassiveDwell							20	// in TU. min amount of time that the STA continously scans each channel when performing an active OBSS scan.
-#define dot11OBSSScanActiveDwell							10	// in TU.min amount of time that the STA continously scans each channel when performing an passive OBSS scan.
-#define dot11BSSWidthTriggerScanInterval					300  // in sec. max interval between scan operations to be performed to detect BSS channel width trigger events.
-#define dot11OBSSScanPassiveTotalPerChannel					200	// in TU. min total amount of time that the STA scans each channel when performing a passive OBSS scan.
-#define dot11OBSSScanActiveTotalPerChannel					20	//in TU. min total amount of time that the STA scans each channel when performing a active OBSS scan
-#define dot11BSSWidthChannelTransactionDelayFactor			5	// min ratio between the delay time in performing a switch from 20MHz BSS to 20/40 BSS operation and the maxima
-																//	interval between overlapping BSS scan operations.
-#define dot11BSSScanActivityThreshold						25	// in %%, max total time that a STA may be active on the medium during a period of
-																//	(dot11BSSWidthChannelTransactionDelayFactor * dot11BSSWidthTriggerScanInterval) seconds without
-																//	being obligated to perform OBSS Scan operations. default is 25(== 0.25%)
-
-typedef struct PACKED _OVERLAP_BSS_SCAN_IE{
-	USHORT		ScanPassiveDwell;
-	USHORT		ScanActiveDwell;
-	USHORT		TriggerScanInt;				// Trigger scan interval
-	USHORT		PassiveTalPerChannel;		// passive total per channel
-	USHORT		ActiveTalPerChannel;		// active total per channel
-	USHORT		DelayFactor;				// BSS width channel transition delay factor
-	USHORT		ScanActThre;				// Scan Activity threshold
-}OVERLAP_BSS_SCAN_IE, *POVERLAP_BSS_SCAN_IE;
-
-
-//  7.3.2.56. 20/40 Coexistence element used in  Element ID = 72 = IE_2040_BSS_COEXIST
-typedef union PACKED _BSS_2040_COEXIST_IE{
- struct PACKED {
-	UCHAR	InfoReq:1;
-	UCHAR	Intolerant40:1;			// Inter-BSS. set 1 when prohibits a receiving BSS from operating as a 20/40 Mhz BSS.
-	UCHAR	BSS20WidthReq:1;		// Intra-BSS set 1 when prohibits a receiving AP from operating its BSS as a 20/40MHz BSS.
-	UCHAR	rsv:5;
-    } field;
- UCHAR   word;
+/* The structure for HT Capability IE. */
+struct PACKED rt_ht_capability_ie {
+	struct rt_ht_cap_info HtCapInfo;
+	struct rt_ht_cap_parm HtCapParm;
+/*      struct rt_ht_mcs_set              HtMCSSet; */
+	u8 MCSSet[16];
+	struct rt_ext_ht_cap_info ExtHtCapInfo;
+	struct rt_ht_bf_cap TxBFCap;	/* beamforming cap. rt2860c not support beamforming. */
+	struct rt_ht_as_cap ASCap;	/*antenna selection. */
+};
+
+/* 802.11n draft3 related structure definitions. */
+/* 7.3.2.60 */
+#define dot11OBSSScanPassiveDwell							20	/* in TU. min amount of time that the STA continously scans each channel when performing an active OBSS scan. */
+#define dot11OBSSScanActiveDwell							10	/* in TU.min amount of time that the STA continously scans each channel when performing an passive OBSS scan. */
+#define dot11BSSWidthTriggerScanInterval					300	/* in sec. max interval between scan operations to be performed to detect BSS channel width trigger events. */
+#define dot11OBSSScanPassiveTotalPerChannel					200	/* in TU. min total amount of time that the STA scans each channel when performing a passive OBSS scan. */
+#define dot11OBSSScanActiveTotalPerChannel					20	/*in TU. min total amount of time that the STA scans each channel when performing a active OBSS scan */
+#define dot11BSSWidthChannelTransactionDelayFactor			5	/* min ratio between the delay time in performing a switch from 20MHz BSS to 20/40 BSS operation and the maximum */
+																/*      interval between overlapping BSS scan operations. */
+#define dot11BSSScanActivityThreshold						25	/* in %%, max total time that a STA may be active on the medium during a period of */
+																/*      (dot11BSSWidthChannelTransactionDelayFactor * dot11BSSWidthTriggerScanInterval) seconds without */
+																/*      being obligated to perform OBSS Scan operations. default is 25(== 0.25%) */
+
+struct PACKED rt_overlap_bss_scan_ie {
+	u16 ScanPassiveDwell;
+	u16 ScanActiveDwell;
+	u16 TriggerScanInt;	/* Trigger scan interval */
+	u16 PassiveTalPerChannel;	/* passive total per channel */
+	u16 ActiveTalPerChannel;	/* active total per channel */
+	u16 DelayFactor;	/* BSS width channel transition delay factor */
+	u16 ScanActThre;	/* Scan Activity threshold */
+};
+
+/*  7.3.2.56. 20/40 Coexistence element used in  Element ID = 72 = IE_2040_BSS_COEXIST */
+typedef union PACKED _BSS_2040_COEXIST_IE {
+	struct PACKED {
+		u8 InfoReq:1;
+		u8 Intolerant40:1;	/* Inter-BSS. set 1 when prohibits a receiving BSS from operating as a 20/40 Mhz BSS. */
+		u8 BSS20WidthReq:1;	/* Intra-BSS set 1 when prohibits a receiving AP from operating its BSS as a 20/40MHz BSS. */
+		u8 rsv:5;
+	} field;
+	u8 word;
 } BSS_2040_COEXIST_IE, *PBSS_2040_COEXIST_IE;
 
+struct rt_trigger_eventa {
+	BOOLEAN bValid;
+	u8 BSSID[6];
+	u8 RegClass;		/* Regulatory Class */
+	u16 Channel;
+	unsigned long CDCounter;	/* Maintain a seperate count down counter for each Event A. */
+};
 
-typedef struct  _TRIGGER_EVENTA{
-	BOOLEAN			bValid;
-	UCHAR	BSSID[6];
-	UCHAR	RegClass;	// Regulatory Class
-	USHORT	Channel;
-	ULONG	CDCounter;   // Maintain a seperate count down counter for each Event A.
-} TRIGGER_EVENTA, *PTRIGGER_EVENTA;
-
-// 20/40 trigger event table
-// If one Event A delete or created, or if Event B is detected or not detected, STA should send 2040BSSCoexistence to AP.
+/* 20/40 trigger event table */
+/* If one Event A delete or created, or if Event B is detected or not detected, STA should send 2040BSSCoexistence to AP. */
 #define MAX_TRIGGER_EVENT		64
-typedef struct  _TRIGGER_EVENT_TAB{
-	UCHAR	EventANo;
-	TRIGGER_EVENTA	EventA[MAX_TRIGGER_EVENT];
-	ULONG			EventBCountDown;	// Count down counter for Event B.
-} TRIGGER_EVENT_TAB, *PTRIGGER_EVENT_TAB;
-
-// 7.3.27 20/40 Bss Coexistence Mgmt capability used in extended capabilities information IE( ID = 127 = IE_EXT_CAPABILITY).
-//	This is the first octet and was defined in 802.11n D3.03 and 802.11yD9.0
-typedef struct PACKED _EXT_CAP_INFO_ELEMENT{
-	UCHAR	BssCoexistMgmtSupport:1;
-	UCHAR	rsv:1;
-	UCHAR	ExtendChannelSwitch:1;
-	UCHAR	rsv2:5;
-}EXT_CAP_INFO_ELEMENT, *PEXT_CAP_INFO_ELEMENT;
-
-
-// 802.11n 7.3.2.61
-typedef struct PACKED _BSS_2040_COEXIST_ELEMENT{
-	UCHAR					ElementID;		// ID = IE_2040_BSS_COEXIST = 72
-	UCHAR					Len;
-	BSS_2040_COEXIST_IE		BssCoexistIe;
-}BSS_2040_COEXIST_ELEMENT, *PBSS_2040_COEXIST_ELEMENT;
-
-
-//802.11n 7.3.2.59
-typedef struct PACKED _BSS_2040_INTOLERANT_CH_REPORT{
-	UCHAR				ElementID;		// ID = IE_2040_BSS_INTOLERANT_REPORT = 73
-	UCHAR				Len;
-	UCHAR				RegulatoryClass;
-	UCHAR				ChList[0];
-}BSS_2040_INTOLERANT_CH_REPORT, *PBSS_2040_INTOLERANT_CH_REPORT;
-
-
-// The structure for channel switch annoucement IE. This is in 802.11n D3.03
-typedef struct PACKED _CHA_SWITCH_ANNOUNCE_IE{
-	UCHAR			SwitchMode;	//channel switch mode
-	UCHAR			NewChannel;	//
-	UCHAR			SwitchCount;	//
-} CHA_SWITCH_ANNOUNCE_IE, *PCHA_SWITCH_ANNOUNCE_IE;
-
-
-// The structure for channel switch annoucement IE. This is in 802.11n D3.03
-typedef struct PACKED _SEC_CHA_OFFSET_IE{
-	UCHAR			SecondaryChannelOffset;	 // 1: Secondary above, 3: Secondary below, 0: no Secondary
-} SEC_CHA_OFFSET_IE, *PSEC_CHA_OFFSET_IE;
-
-
-// This structure is extracted from struct RT_HT_CAPABILITY
-typedef struct {
-	BOOLEAN			bHtEnable;	 // If we should use ht rate.
-	BOOLEAN			bPreNHt;	 // If we should use ht rate.
-	//Substract from HT Capability IE
-	UCHAR			MCSSet[16];	//only supoort MCS=0-15,32 ,
-} RT_HT_PHY_INFO, *PRT_HT_PHY_INFO;
-
-//This structure substracts ralink supports from all 802.11n-related features.
-//Features not listed here but contained in 802.11n spec are not supported in rt2860.
-typedef struct {
-	USHORT	ChannelWidth:1;
-	USHORT	MimoPs:2;//mimo power safe MMPS_
-	USHORT	GF:1;	//green field
-	USHORT	ShortGIfor20:1;
-	USHORT	ShortGIfor40:1;	//for40MHz
-	USHORT	TxSTBC:1;
-	USHORT	RxSTBC:2;	// 2 bits
-	USHORT	AmsduEnable:1;	// Enable to transmit A-MSDU. Suggest disable. We should use A-MPDU to gain best benifit of 802.11n
-	USHORT	AmsduSize:1;	// Max receiving A-MSDU size
-	USHORT	rsv:5;
-
-	//Substract from Addiont HT INFO IE
-	UCHAR	MaxRAmpduFactor:2;
-	UCHAR	MpduDensity:3;
-	UCHAR	ExtChanOffset:2;	// Please not the difference with following 	UCHAR	NewExtChannelOffset; from 802.11n
-	UCHAR	RecomWidth:1;
-
-	USHORT	OperaionMode:2;
-	USHORT	NonGfPresent:1;
-	USHORT	rsv3:1;
-	USHORT	OBSS_NonHTExist:1;
-	USHORT	rsv2:11;
-
-	// New Extension Channel Offset IE
-	UCHAR	NewExtChannelOffset;
-	// Extension Capability IE = 127
-	UCHAR	BSSCoexist2040;
-} RT_HT_CAPABILITY, *PRT_HT_CAPABILITY;
-
-//   field in Addtional HT Information IE .
-typedef struct PACKED {
-	UCHAR	ExtChanOffset:2;
-	UCHAR	RecomWidth:1;
-	UCHAR	RifsMode:1;
-	UCHAR	S_PSMPSup:1;	 //Indicate support for scheduled PSMP
-	UCHAR	SerInterGranu:3;	 //service interval granularity
-} ADD_HTINFO, *PADD_HTINFO;
-
-typedef struct PACKED{
-	USHORT	OperaionMode:2;
-	USHORT	NonGfPresent:1;
-	USHORT	rsv:1;
-	USHORT	OBSS_NonHTExist:1;
-	USHORT	rsv2:11;
-} ADD_HTINFO2, *PADD_HTINFO2;
-
-
-// TODO: Need sync with spec about the definition of StbcMcs. In Draft 3.03, it's reserved.
-typedef struct PACKED{
-	USHORT	StbcMcs:6;
-	USHORT	DualBeacon:1;
-	USHORT	DualCTSProtect:1;
-	USHORT	STBCBeacon:1;
-	USHORT	LsigTxopProt:1;	// L-SIG TXOP protection full support
-	USHORT	PcoActive:1;
-	USHORT	PcoPhase:1;
-	USHORT	rsv:4;
-} ADD_HTINFO3, *PADD_HTINFO3;
+struct rt_trigger_event_tab {
+	u8 EventANo;
+	struct rt_trigger_eventa EventA[MAX_TRIGGER_EVENT];
+	unsigned long EventBCountDown;	/* Count down counter for Event B. */
+};
+
+/* 7.3.27 20/40 Bss Coexistence Mgmt capability used in extended capabilities information IE( ID = 127 = IE_EXT_CAPABILITY). */
+/*      This is the first octet and was defined in 802.11n D3.03 and 802.11yD9.0 */
+struct PACKED rt_ext_cap_info_element {
+	u8 BssCoexistMgmtSupport:1;
+	u8 rsv:1;
+	u8 ExtendChannelSwitch:1;
+	u8 rsv2:5;
+};
+
+/* 802.11n 7.3.2.61 */
+struct PACKED rt_bss_2040_coexist_element {
+	u8 ElementID;	/* ID = IE_2040_BSS_COEXIST = 72 */
+	u8 Len;
+	BSS_2040_COEXIST_IE BssCoexistIe;
+};
+
+/*802.11n 7.3.2.59 */
+struct PACKED rt_bss_2040_intolerant_ch_report {
+	u8 ElementID;	/* ID = IE_2040_BSS_INTOLERANT_REPORT = 73 */
+	u8 Len;
+	u8 RegulatoryClass;
+	u8 ChList[0];
+};
+
+/* The structure for channel switch annoucement IE. This is in 802.11n D3.03 */
+struct PACKED rt_cha_switch_announce_ie {
+	u8 SwitchMode;	/*channel switch mode */
+	u8 NewChannel;	/* */
+	u8 SwitchCount;	/* */
+};
+
+/* The structure for channel switch annoucement IE. This is in 802.11n D3.03 */
+struct PACKED rt_sec_cha_offset_ie {
+	u8 SecondaryChannelOffset;	/* 1: Secondary above, 3: Secondary below, 0: no Secondary */
+};
+
+/* This structure is extracted from struct struct rt_ht_capability */
+struct rt_ht_phy_info {
+	BOOLEAN bHtEnable;	/* If we should use ht rate. */
+	BOOLEAN bPreNHt;	/* If we should use ht rate. */
+	/*Substract from HT Capability IE */
+	u8 MCSSet[16];
+};
+
+/*This structure substracts ralink supports from all 802.11n-related features. */
+/*Features not listed here but contained in 802.11n spec are not supported in rt2860. */
+struct rt_ht_capability {
+	u16 ChannelWidth:1;
+	u16 MimoPs:2;	/*mimo power safe MMPS_ */
+	u16 GF:1;		/*green field */
+	u16 ShortGIfor20:1;
+	u16 ShortGIfor40:1;	/*for40MHz */
+	u16 TxSTBC:1;
+	u16 RxSTBC:2;	/* 2 bits */
+	u16 AmsduEnable:1;	/* Enable to transmit A-MSDU. Suggest disable. We should use A-MPDU to gain best benifit of 802.11n */
+	u16 AmsduSize:1;	/* Max receiving A-MSDU size */
+	u16 rsv:5;
+
+	/*Substract from Addiont HT INFO IE */
+	u8 MaxRAmpduFactor:2;
+	u8 MpduDensity:3;
+	u8 ExtChanOffset:2;	/* Please not the difference with following     u8   NewExtChannelOffset; from 802.11n */
+	u8 RecomWidth:1;
+
+	u16 OperaionMode:2;
+	u16 NonGfPresent:1;
+	u16 rsv3:1;
+	u16 OBSS_NonHTExist:1;
+	u16 rsv2:11;
+
+	/* New Extension Channel Offset IE */
+	u8 NewExtChannelOffset;
+	/* Extension Capability IE = 127 */
+	u8 BSSCoexist2040;
+};
+
+/*   field in Addtional HT Information IE . */
+struct PACKED rt_add_htinfo {
+	u8 ExtChanOffset:2;
+	u8 RecomWidth:1;
+	u8 RifsMode:1;
+	u8 S_PSMPSup:1;	/*Indicate support for scheduled PSMP */
+	u8 SerInterGranu:3;	/*service interval granularity */
+};
+
+struct PACKED rt_add_htinfo2 {
+	u16 OperaionMode:2;
+	u16 NonGfPresent:1;
+	u16 rsv:1;
+	u16 OBSS_NonHTExist:1;
+	u16 rsv2:11;
+};
+
+/* TODO: Need sync with spec about the definition of StbcMcs. In Draft 3.03, it's reserved. */
+struct PACKED rt_add_htinfo3 {
+	u16 StbcMcs:6;
+	u16 DualBeacon:1;
+	u16 DualCTSProtect:1;
+	u16 STBCBeacon:1;
+	u16 LsigTxopProt:1;	/* L-SIG TXOP protection full support */
+	u16 PcoActive:1;
+	u16 PcoPhase:1;
+	u16 rsv:4;
+};
 
 #define SIZE_ADD_HT_INFO_IE		22
-typedef struct  PACKED{
-	UCHAR				ControlChan;
-	ADD_HTINFO			AddHtInfo;
-	ADD_HTINFO2			AddHtInfo2;
-	ADD_HTINFO3			AddHtInfo3;
-	UCHAR				MCSSet[16];		// Basic MCS set
-} ADD_HT_INFO_IE, *PADD_HT_INFO_IE;
-
-typedef struct  PACKED{
-	UCHAR				NewExtChanOffset;
-} NEW_EXT_CHAN_IE, *PNEW_EXT_CHAN_IE;
-
-
-// 4-byte HTC field.  maybe included in any frame except non-QOS data frame.  The Order bit must set 1.
-typedef struct PACKED {
-    UINT32		MA:1;	//management action payload exist in (QoS Null+HTC)
-    UINT32		TRQ:1;	//sounding request
-    UINT32		MRQ:1;	//MCS feedback. Request for a MCS feedback
-    UINT32		MRSorASI:3;	// MRQ Sequence identifier. unchanged during entire procedure. 0x000-0x110.
-    UINT32		MFS:3;	//SET to the received value of MRS. 0x111 for unsolicited MFB.
-    UINT32		MFBorASC:7;	//Link adaptation feedback containing recommended MCS. 0x7f for no feedback or not available
-    UINT32		CalPos:2;	// calibration position
-    UINT32		CalSeq:2;  //calibration sequence
-    UINT32		FBKReq:2;	//feedback request
-    UINT32		CSISTEERING:2;	//CSI/ STEERING
-    UINT32		ZLFAnnouce:1;	// ZLF announcement
-    UINT32		rsv:5;  //calibration sequence
-    UINT32		ACConstraint:1;	//feedback request
-    UINT32		RDG:1;	//RDG / More PPDU
-} HT_CONTROL, *PHT_CONTROL;
-
-// 2-byte QOS CONTROL field
-typedef struct PACKED {
-    USHORT      TID:4;
-    USHORT      EOSP:1;
-    USHORT      AckPolicy:2;  //0: normal ACK 1:No ACK 2:scheduled under MTBA/PSMP  3: BA
-    USHORT      AMsduPresent:1;
-    USHORT      Txop_QueueSize:8;
-} QOS_CONTROL, *PQOS_CONTROL;
-
-// 2-byte Frame control field
-typedef	struct	PACKED {
-	USHORT		Ver:2;				// Protocol version
-	USHORT		Type:2;				// MSDU type
-	USHORT		SubType:4;			// MSDU subtype
-	USHORT		ToDs:1;				// To DS indication
-	USHORT		FrDs:1;				// From DS indication
-	USHORT		MoreFrag:1;			// More fragment bit
-	USHORT		Retry:1;			// Retry status bit
-	USHORT		PwrMgmt:1;			// Power management bit
-	USHORT		MoreData:1;			// More data bit
-	USHORT		Wep:1;				// Wep data
-	USHORT		Order:1;			// Strict order expected
-} FRAME_CONTROL, *PFRAME_CONTROL;
-
-typedef	struct	PACKED _HEADER_802_11	{
-    FRAME_CONTROL   FC;
-    USHORT          Duration;
-    UCHAR           Addr1[MAC_ADDR_LEN];
-    UCHAR           Addr2[MAC_ADDR_LEN];
-	UCHAR			Addr3[MAC_ADDR_LEN];
-	USHORT			Frag:4;
-	USHORT			Sequence:12;
-	UCHAR			Octet[0];
-}	HEADER_802_11, *PHEADER_802_11;
-
-typedef struct PACKED _FRAME_802_11 {
-    HEADER_802_11   Hdr;
-    UCHAR            Octet[1];
-}   FRAME_802_11, *PFRAME_802_11;
-
-// QoSNull embedding of management action. When HT Control MA field set to 1.
-typedef struct PACKED _MA_BODY {
-    UCHAR            Category;
-    UCHAR            Action;
-    UCHAR            Octet[1];
-}   MA_BODY, *PMA_BODY;
-
-typedef	struct	PACKED _HEADER_802_3	{
-    UCHAR           DAAddr1[MAC_ADDR_LEN];
-    UCHAR           SAAddr2[MAC_ADDR_LEN];
-    UCHAR           Octet[2];
-}	HEADER_802_3, *PHEADER_802_3;
-////Block ACK related format
-// 2-byte BA Parameter  field  in 	DELBA frames to terminate an already set up bA
-typedef struct PACKED{
-    USHORT      Rsv:11;	// always set to 0
-    USHORT      Initiator:1;	// 1: originator    0:recipient
-    USHORT      TID:4;	// value of TC os TS
-} DELBA_PARM, *PDELBA_PARM;
-
-// 2-byte BA Parameter Set field  in ADDBA frames to signal parm for setting up a BA
-typedef struct PACKED {
-    USHORT      AMSDUSupported:1;	// 0: not permitted		1: permitted
-    USHORT      BAPolicy:1;	// 1: immediately BA    0:delayed BA
-    USHORT      TID:4;	// value of TC os TS
-    USHORT      BufSize:10;	// number of buffe of size 2304 octetsr
-} BA_PARM, *PBA_PARM;
-
-// 2-byte BA Starting Seq CONTROL field
-typedef union PACKED {
-    struct PACKED {
-    USHORT      FragNum:4;	// always set to 0
-	USHORT      StartSeq:12;   // sequence number of the 1st MSDU for which this BAR is sent
-    }   field;
-    USHORT           word;
+struct PACKED rt_add_ht_info_ie {
+	u8 ControlChan;
+	struct rt_add_htinfo AddHtInfo;
+	struct rt_add_htinfo2 AddHtInfo2;
+	struct rt_add_htinfo3 AddHtInfo3;
+	u8 MCSSet[16];	/* Basic MCS set */
+};
+
+struct PACKED rt_new_ext_chan_ie {
+	u8 NewExtChanOffset;
+};
+
+struct PACKED rt_frame_802_11 {
+	struct rt_header_802_11 Hdr;
+	u8 Octet[1];
+};
+
+/* QoSNull embedding of management action. When HT Control MA field set to 1. */
+struct PACKED rt_ma_body {
+	u8 Category;
+	u8 Action;
+	u8 Octet[1];
+};
+
+struct PACKED rt_header_802_3 {
+	u8 DAAddr1[MAC_ADDR_LEN];
+	u8 SAAddr2[MAC_ADDR_LEN];
+	u8 Octet[2];
+};
+/*//Block ACK related format */
+/* 2-byte BA Parameter  field  in       DELBA frames to terminate an already set up bA */
+struct PACKED rt_delba_parm {
+	u16 Rsv:11;		/* always set to 0 */
+	u16 Initiator:1;	/* 1: originator    0:recipient */
+	u16 TID:4;		/* value of TC os TS */
+};
+
+/* 2-byte BA Parameter Set field  in ADDBA frames to signal parm for setting up a BA */
+struct PACKED rt_ba_parm {
+	u16 AMSDUSupported:1;	/* 0: not permitted             1: permitted */
+	u16 BAPolicy:1;	/* 1: immediately BA    0:delayed BA */
+	u16 TID:4;		/* value of TC os TS */
+	u16 BufSize:10;	/* number of buffe of size 2304 octetsr */
+};
+
+/* 2-byte BA Starting Seq CONTROL field */
+typedef union PACKED _BASEQ_CONTROL {
+	struct PACKED {
+		u16 FragNum:4;	/* always set to 0 */
+		u16 StartSeq:12;	/* sequence number of the 1st MSDU for which this BAR is sent */
+	} field;
+	u16 word;
 } BASEQ_CONTROL, *PBASEQ_CONTROL;
 
-//BAControl and BARControl are the same
-// 2-byte BA CONTROL field in BA frame
-typedef struct PACKED {
-    USHORT      ACKPolicy:1; // only related to N-Delayed BA. But not support in RT2860b. 0:NormalACK  1:No ACK
-    USHORT      MTID:1;		//EWC V1.24
-    USHORT      Compressed:1;
-    USHORT      Rsv:9;
-    USHORT      TID:4;
-} BA_CONTROL, *PBA_CONTROL;
-
-// 2-byte BAR CONTROL field in BAR frame
-typedef struct PACKED {
-    USHORT      ACKPolicy:1; // 0:normal ack,  1:no ack.
-    USHORT      MTID:1;		//if this bit1, use  FRAME_MTBA_REQ,  if 0, use FRAME_BA_REQ
-    USHORT      Compressed:1;
-    USHORT      Rsv1:9;
-    USHORT      TID:4;
-} BAR_CONTROL, *PBAR_CONTROL;
-
-// BARControl in MTBAR frame
-typedef struct PACKED {
-    USHORT      ACKPolicy:1;
-    USHORT      MTID:1;
-    USHORT      Compressed:1;
-    USHORT      Rsv1:9;
-    USHORT      NumTID:4;
-} MTBAR_CONTROL, *PMTBAR_CONTROL;
-
-typedef struct PACKED {
-    USHORT      Rsv1:12;
-    USHORT      TID:4;
-} PER_TID_INFO, *PPER_TID_INFO;
-
-typedef struct {
-	PER_TID_INFO      PerTID;
-	BASEQ_CONTROL 	 BAStartingSeq;
-} EACH_TID, *PEACH_TID;
-
-
-typedef struct PACKED _PSPOLL_FRAME {
-    FRAME_CONTROL   FC;
-    USHORT          Aid;
-    UCHAR           Bssid[MAC_ADDR_LEN];
-    UCHAR           Ta[MAC_ADDR_LEN];
-}   PSPOLL_FRAME, *PPSPOLL_FRAME;
-
-typedef	struct	PACKED _RTS_FRAME	{
-    FRAME_CONTROL   FC;
-    USHORT          Duration;
-    UCHAR           Addr1[MAC_ADDR_LEN];
-    UCHAR           Addr2[MAC_ADDR_LEN];
-}RTS_FRAME, *PRTS_FRAME;
-
-// BAREQ AND MTBAREQ have the same subtype BAR, 802.11n BAR use compressed bitmap.
-typedef struct PACKED _FRAME_BA_REQ {
-	FRAME_CONTROL   FC;
-	USHORT          Duration;
-	UCHAR           Addr1[MAC_ADDR_LEN];
-	UCHAR           Addr2[MAC_ADDR_LEN];
-	BAR_CONTROL  BARControl;
-	BASEQ_CONTROL 	 BAStartingSeq;
-}   FRAME_BA_REQ, *PFRAME_BA_REQ;
-
-typedef struct PACKED _FRAME_MTBA_REQ {
-	FRAME_CONTROL   FC;
-	USHORT          Duration;
-	UCHAR           Addr1[MAC_ADDR_LEN];
-	UCHAR           Addr2[MAC_ADDR_LEN];
-	MTBAR_CONTROL  MTBARControl;
-	PER_TID_INFO	PerTIDInfo;
-	BASEQ_CONTROL 	 BAStartingSeq;
-}   FRAME_MTBA_REQ, *PFRAME_MTBA_REQ;
-
-// Compressed format is mandantory in HT STA
-typedef struct PACKED _FRAME_MTBA {
-	FRAME_CONTROL   FC;
-	USHORT          Duration;
-	UCHAR           Addr1[MAC_ADDR_LEN];
-	UCHAR           Addr2[MAC_ADDR_LEN];
-	BA_CONTROL  BAControl;
-	BASEQ_CONTROL 	 BAStartingSeq;
-	UCHAR		BitMap[8];
-}   FRAME_MTBA, *PFRAME_MTBA;
-
-typedef struct PACKED _FRAME_PSMP_ACTION {
-	HEADER_802_11   Hdr;
-	UCHAR	Category;
-	UCHAR	Action;
-	UCHAR	Psmp;	// 7.3.1.25
-}   FRAME_PSMP_ACTION, *PFRAME_PSMP_ACTION;
-
-typedef struct PACKED _FRAME_ACTION_HDR {
-	HEADER_802_11   Hdr;
-	UCHAR	Category;
-	UCHAR	Action;
-}   FRAME_ACTION_HDR, *PFRAME_ACTION_HDR;
-
-//Action Frame
-//Action Frame  Category:Spectrum,  Action:Channel Switch. 7.3.2.20
-typedef struct PACKED _CHAN_SWITCH_ANNOUNCE {
-	UCHAR					ElementID;	// ID = IE_CHANNEL_SWITCH_ANNOUNCEMENT = 37
-	UCHAR					Len;
-	CHA_SWITCH_ANNOUNCE_IE	CSAnnounceIe;
-}   CHAN_SWITCH_ANNOUNCE, *PCHAN_SWITCH_ANNOUNCE;
-
-
-//802.11n : 7.3.2.20a
-typedef struct PACKED _SECOND_CHAN_OFFSET {
-	UCHAR				ElementID;		// ID = IE_SECONDARY_CH_OFFSET = 62
-	UCHAR				Len;
-	SEC_CHA_OFFSET_IE	SecChOffsetIe;
-}   SECOND_CHAN_OFFSET, *PSECOND_CHAN_OFFSET;
-
-
-typedef struct PACKED _FRAME_SPETRUM_CS {
-	HEADER_802_11   Hdr;
-	UCHAR	Category;
-	UCHAR	Action;
-	CHAN_SWITCH_ANNOUNCE	CSAnnounce;
-	SECOND_CHAN_OFFSET		SecondChannel;
-}   FRAME_SPETRUM_CS, *PFRAME_SPETRUM_CS;
-
-
-typedef struct PACKED _FRAME_ADDBA_REQ {
-	HEADER_802_11   Hdr;
-	UCHAR	Category;
-	UCHAR	Action;
-	UCHAR	Token;	// 1
-	BA_PARM		BaParm;	      //  2 - 10
-	USHORT		TimeOutValue;	// 0 - 0
-	BASEQ_CONTROL	BaStartSeq; // 0-0
-}   FRAME_ADDBA_REQ, *PFRAME_ADDBA_REQ;
-
-typedef struct PACKED _FRAME_ADDBA_RSP {
-	HEADER_802_11   Hdr;
-	UCHAR	Category;
-	UCHAR	Action;
-	UCHAR	Token;
-	USHORT	StatusCode;
-	BA_PARM		BaParm; //0 - 2
-	USHORT		TimeOutValue;
-}   FRAME_ADDBA_RSP, *PFRAME_ADDBA_RSP;
-
-typedef struct PACKED _FRAME_DELBA_REQ {
-	HEADER_802_11   Hdr;
-	UCHAR	Category;
-	UCHAR	Action;
-	DELBA_PARM		DelbaParm;
-	USHORT	ReasonCode;
-}   FRAME_DELBA_REQ, *PFRAME_DELBA_REQ;
-
-
-//7.2.1.7
-typedef struct PACKED _FRAME_BAR {
-	FRAME_CONTROL   FC;
-	USHORT          Duration;
-	UCHAR           Addr1[MAC_ADDR_LEN];
-	UCHAR           Addr2[MAC_ADDR_LEN];
-	BAR_CONTROL		BarControl;
-	BASEQ_CONTROL	StartingSeq;
-}   FRAME_BAR, *PFRAME_BAR;
-
-//7.2.1.7
-typedef struct PACKED _FRAME_BA {
-	FRAME_CONTROL   FC;
-	USHORT          Duration;
-	UCHAR           Addr1[MAC_ADDR_LEN];
-	UCHAR           Addr2[MAC_ADDR_LEN];
-	BAR_CONTROL		BarControl;
-	BASEQ_CONTROL	StartingSeq;
-	UCHAR		bitmask[8];
-}   FRAME_BA, *PFRAME_BA;
-
-
-// Radio Measuement Request Frame Format
-typedef struct PACKED _FRAME_RM_REQ_ACTION {
-	HEADER_802_11   Hdr;
-	UCHAR	Category;
-	UCHAR	Action;
-	UCHAR	Token;
-	USHORT	Repetition;
-	UCHAR   data[0];
-}   FRAME_RM_REQ_ACTION, *PFRAME_RM_REQ_ACTION;
-
-typedef struct PACKED {
-	UCHAR		ID;
-	UCHAR		Length;
-	UCHAR		ChannelSwitchMode;
-	UCHAR		NewRegClass;
-	UCHAR		NewChannelNum;
-	UCHAR		ChannelSwitchCount;
-} HT_EXT_CHANNEL_SWITCH_ANNOUNCEMENT_IE, *PHT_EXT_CHANNEL_SWITCH_ANNOUNCEMENT_IE;
-
-
-//
-// _Limit must be the 2**n - 1
-// _SEQ1 , _SEQ2 must be within 0 ~ _Limit
-//
+/*BAControl and BARControl are the same */
+/* 2-byte BA CONTROL field in BA frame */
+struct PACKED rt_ba_control {
+	u16 ACKPolicy:1;	/* only related to N-Delayed BA. But not support in RT2860b. 0:NormalACK  1:No ACK */
+	u16 MTID:1;		/*EWC V1.24 */
+	u16 Compressed:1;
+	u16 Rsv:9;
+	u16 TID:4;
+};
+
+/* 2-byte BAR CONTROL field in BAR frame */
+struct PACKED rt_bar_control {
+	u16 ACKPolicy:1;	/* 0:normal ack,  1:no ack. */
+	u16 MTID:1;		/*if this bit1, use  struct rt_frame_mtba_req,  if 0, use struct rt_frame_ba_req */
+	u16 Compressed:1;
+	u16 Rsv1:9;
+	u16 TID:4;
+};
+
+/* BARControl in MTBAR frame */
+struct PACKED rt_mtbar_control {
+	u16 ACKPolicy:1;
+	u16 MTID:1;
+	u16 Compressed:1;
+	u16 Rsv1:9;
+	u16 NumTID:4;
+};
+
+struct PACKED rt_per_tid_info {
+	u16 Rsv1:12;
+	u16 TID:4;
+};
+
+struct rt_each_tid {
+	struct rt_per_tid_info PerTID;
+	BASEQ_CONTROL BAStartingSeq;
+};
+
+/* BAREQ AND MTBAREQ have the same subtype BAR, 802.11n BAR use compressed bitmap. */
+struct PACKED rt_frame_ba_req {
+	struct rt_frame_control FC;
+	u16 Duration;
+	u8 Addr1[MAC_ADDR_LEN];
+	u8 Addr2[MAC_ADDR_LEN];
+	struct rt_bar_control BARControl;
+	BASEQ_CONTROL BAStartingSeq;
+};
+
+struct PACKED rt_frame_mtba_req {
+	struct rt_frame_control FC;
+	u16 Duration;
+	u8 Addr1[MAC_ADDR_LEN];
+	u8 Addr2[MAC_ADDR_LEN];
+	struct rt_mtbar_control MTBARControl;
+	struct rt_per_tid_info PerTIDInfo;
+	BASEQ_CONTROL BAStartingSeq;
+};
+
+/* Compressed format is mandantory in HT STA */
+struct PACKED rt_frame_mtba {
+	struct rt_frame_control FC;
+	u16 Duration;
+	u8 Addr1[MAC_ADDR_LEN];
+	u8 Addr2[MAC_ADDR_LEN];
+	struct rt_ba_control BAControl;
+	BASEQ_CONTROL BAStartingSeq;
+	u8 BitMap[8];
+};
+
+struct PACKED rt_frame_psmp_action {
+	struct rt_header_802_11 Hdr;
+	u8 Category;
+	u8 Action;
+	u8 Psmp;		/* 7.3.1.25 */
+};
+
+struct PACKED rt_frame_action_hdr {
+	struct rt_header_802_11 Hdr;
+	u8 Category;
+	u8 Action;
+};
+
+/*Action Frame */
+/*Action Frame  Category:Spectrum,  Action:Channel Switch. 7.3.2.20 */
+struct PACKED rt_chan_switch_announce {
+	u8 ElementID;	/* ID = IE_CHANNEL_SWITCH_ANNOUNCEMENT = 37 */
+	u8 Len;
+	struct rt_cha_switch_announce_ie CSAnnounceIe;
+};
+
+/*802.11n : 7.3.2.20a */
+struct PACKED rt_second_chan_offset {
+	u8 ElementID;	/* ID = IE_SECONDARY_CH_OFFSET = 62 */
+	u8 Len;
+	struct rt_sec_cha_offset_ie SecChOffsetIe;
+};
+
+struct PACKED rt_frame_spetrum_cs {
+	struct rt_header_802_11 Hdr;
+	u8 Category;
+	u8 Action;
+	struct rt_chan_switch_announce CSAnnounce;
+	struct rt_second_chan_offset SecondChannel;
+};
+
+struct PACKED rt_frame_addba_req {
+	struct rt_header_802_11 Hdr;
+	u8 Category;
+	u8 Action;
+	u8 Token;		/* 1 */
+	struct rt_ba_parm BaParm;		/*  2 - 10 */
+	u16 TimeOutValue;	/* 0 - 0 */
+	BASEQ_CONTROL BaStartSeq;	/* 0-0 */
+};
+
+struct PACKED rt_frame_addba_rsp {
+	struct rt_header_802_11 Hdr;
+	u8 Category;
+	u8 Action;
+	u8 Token;
+	u16 StatusCode;
+	struct rt_ba_parm BaParm;		/*0 - 2 */
+	u16 TimeOutValue;
+};
+
+struct PACKED rt_frame_delba_req {
+	struct rt_header_802_11 Hdr;
+	u8 Category;
+	u8 Action;
+	struct rt_delba_parm DelbaParm;
+	u16 ReasonCode;
+};
+
+/*7.2.1.7 */
+struct PACKED rt_frame_bar {
+	struct rt_frame_control FC;
+	u16 Duration;
+	u8 Addr1[MAC_ADDR_LEN];
+	u8 Addr2[MAC_ADDR_LEN];
+	struct rt_bar_control BarControl;
+	BASEQ_CONTROL StartingSeq;
+};
+
+/*7.2.1.7 */
+struct PACKED rt_frame_ba {
+	struct rt_frame_control FC;
+	u16 Duration;
+	u8 Addr1[MAC_ADDR_LEN];
+	u8 Addr2[MAC_ADDR_LEN];
+	struct rt_bar_control BarControl;
+	BASEQ_CONTROL StartingSeq;
+	u8 bitmask[8];
+};
+
+/* Radio Measuement Request Frame Format */
+struct PACKED rt_frame_rm_req_action {
+	struct rt_header_802_11 Hdr;
+	u8 Category;
+	u8 Action;
+	u8 Token;
+	u16 Repetition;
+	u8 data[0];
+};
+
+struct PACKED rt_ht_ext_channel_switch_announcement_ie {
+	u8 ID;
+	u8 Length;
+	u8 ChannelSwitchMode;
+	u8 NewRegClass;
+	u8 NewChannelNum;
+	u8 ChannelSwitchCount;
+};
+
+/* */
+/* _Limit must be the 2**n - 1 */
+/* _SEQ1 , _SEQ2 must be within 0 ~ _Limit */
+/* */
 #define SEQ_STEPONE(_SEQ1, _SEQ2, _Limit)	((_SEQ1 == ((_SEQ2+1) & _Limit)))
 #define SEQ_SMALLER(_SEQ1, _SEQ2, _Limit)	(((_SEQ1-_SEQ2) & ((_Limit+1)>>1)))
 #define SEQ_LARGER(_SEQ1, _SEQ2, _Limit)	((_SEQ1 != _SEQ2) && !(((_SEQ1-_SEQ2) & ((_Limit+1)>>1))))
 #define SEQ_WITHIN_WIN(_SEQ1, _SEQ2, _WIN, _Limit) (SEQ_LARGER(_SEQ1, _SEQ2, _Limit) &&  \
 												SEQ_SMALLER(_SEQ1, ((_SEQ2+_WIN+1)&_Limit), _Limit))
 
-//
-// Contention-free parameter (without ID and Length)
-//
-typedef struct PACKED {
-    BOOLEAN     bValid;         // 1: variable contains valid value
-    UCHAR       CfpCount;
-    UCHAR       CfpPeriod;
-    USHORT      CfpMaxDuration;
-    USHORT      CfpDurRemaining;
-} CF_PARM, *PCF_PARM;
-
-typedef	struct	_CIPHER_SUITE	{
-	NDIS_802_11_ENCRYPTION_STATUS	PairCipher;		// Unicast cipher 1, this one has more secured cipher suite
-	NDIS_802_11_ENCRYPTION_STATUS	PairCipherAux;	// Unicast cipher 2 if AP announce two unicast cipher suite
-	NDIS_802_11_ENCRYPTION_STATUS	GroupCipher;	// Group cipher
-	USHORT							RsnCapability;	// RSN capability from beacon
-	BOOLEAN							bMixMode;		// Indicate Pair & Group cipher might be different
-}	CIPHER_SUITE, *PCIPHER_SUITE;
-
-// EDCA configuration from AP's BEACON/ProbeRsp
-typedef struct {
-    BOOLEAN     bValid;         // 1: variable contains valid value
-    BOOLEAN     bAdd;         // 1: variable contains valid value
-    BOOLEAN     bQAck;
-    BOOLEAN     bQueueRequest;
-    BOOLEAN     bTxopRequest;
-    BOOLEAN     bAPSDCapable;
-//  BOOLEAN     bMoreDataAck;
-    UCHAR       EdcaUpdateCount;
-    UCHAR       Aifsn[4];       // 0:AC_BK, 1:AC_BE, 2:AC_VI, 3:AC_VO
-    UCHAR       Cwmin[4];
-    UCHAR       Cwmax[4];
-    USHORT      Txop[4];      // in unit of 32-us
-    BOOLEAN     bACM[4];      // 1: Admission Control of AC_BK is mandattory
-} EDCA_PARM, *PEDCA_PARM;
-
-// QBSS LOAD information from QAP's BEACON/ProbeRsp
-typedef struct {
-    BOOLEAN     bValid;                     // 1: variable contains valid value
-    USHORT      StaNum;
-    UCHAR       ChannelUtilization;
-    USHORT      RemainingAdmissionControl;  // in unit of 32-us
-} QBSS_LOAD_PARM, *PQBSS_LOAD_PARM;
-
-// QBSS Info field in QSTA's assoc req
-typedef struct PACKED {
-    UCHAR		UAPSD_AC_VO:1;
-	UCHAR		UAPSD_AC_VI:1;
-	UCHAR		UAPSD_AC_BK:1;
-	UCHAR		UAPSD_AC_BE:1;
-	UCHAR		Rsv1:1;
-	UCHAR		MaxSPLength:2;
-	UCHAR		Rsv2:1;
-} QBSS_STA_INFO_PARM, *PQBSS_STA_INFO_PARM;
-
-// QBSS Info field in QAP's Beacon/ProbeRsp
-typedef struct PACKED {
-    UCHAR		ParamSetCount:4;
-	UCHAR		Rsv:3;
-	UCHAR		UAPSD:1;
-} QBSS_AP_INFO_PARM, *PQBSS_AP_INFO_PARM;
-
-// QOS Capability reported in QAP's BEACON/ProbeRsp
-// QOS Capability sent out in QSTA's AssociateReq/ReAssociateReq
-typedef struct {
-    BOOLEAN     bValid;                     // 1: variable contains valid value
-    BOOLEAN     bQAck;
-    BOOLEAN     bQueueRequest;
-    BOOLEAN     bTxopRequest;
-//  BOOLEAN     bMoreDataAck;
-    UCHAR       EdcaUpdateCount;
-} QOS_CAPABILITY_PARM, *PQOS_CAPABILITY_PARM;
-
-typedef struct {
-    UCHAR       IELen;
-    UCHAR       IE[MAX_CUSTOM_LEN];
-} WPA_IE_;
-
-typedef struct {
-    UCHAR   Bssid[MAC_ADDR_LEN];
-    UCHAR   Channel;
-	UCHAR   CentralChannel;	//Store the wide-band central channel for 40MHz.  .used in 40MHz AP. Or this is the same as Channel.
-    UCHAR   BssType;
-    USHORT  AtimWin;
-    USHORT  BeaconPeriod;
-
-    UCHAR   SupRate[MAX_LEN_OF_SUPPORTED_RATES];
-    UCHAR   SupRateLen;
-    UCHAR   ExtRate[MAX_LEN_OF_SUPPORTED_RATES];
-    UCHAR   ExtRateLen;
-	HT_CAPABILITY_IE HtCapability;
-	UCHAR			HtCapabilityLen;
-	ADD_HT_INFO_IE AddHtInfo;	// AP might use this additional ht info IE
-	UCHAR			AddHtInfoLen;
-	UCHAR			NewExtChanOffset;
-	CHAR    Rssi;
-    UCHAR   Privacy;			// Indicate security function ON/OFF. Don't mess up with auth mode.
-	UCHAR	Hidden;
-
-    USHORT  DtimPeriod;
-    USHORT  CapabilityInfo;
-
-    USHORT  CfpCount;
-    USHORT  CfpPeriod;
-    USHORT  CfpMaxDuration;
-    USHORT  CfpDurRemaining;
-    UCHAR   SsidLen;
-    CHAR    Ssid[MAX_LEN_OF_SSID];
-
-    ULONG   LastBeaconRxTime; // OS's timestamp
-
-	BOOLEAN	bSES;
-
-	// New for WPA2
-	CIPHER_SUITE					WPA;			// AP announced WPA cipher suite
-	CIPHER_SUITE					WPA2;			// AP announced WPA2 cipher suite
-
-	// New for microsoft WPA support
-	NDIS_802_11_FIXED_IEs	FixIEs;
-	NDIS_802_11_AUTHENTICATION_MODE	AuthModeAux;	// Addition mode for WPA2 / WPA capable AP
-	NDIS_802_11_AUTHENTICATION_MODE	AuthMode;
-	NDIS_802_11_WEP_STATUS	WepStatus;				// Unicast Encryption Algorithm extract from VAR_IE
-	USHORT					VarIELen;				// Length of next VIE include EID & Length
-	UCHAR					VarIEs[MAX_VIE_LEN];
-
-	// CCX Ckip information
-    UCHAR   CkipFlag;
-
-	// CCX 2 TSF
-	UCHAR	PTSF[4];		// Parent TSF
-	UCHAR	TTSF[8];		// Target TSF
-
-    // 802.11e d9, and WMM
-	EDCA_PARM           EdcaParm;
-	QOS_CAPABILITY_PARM QosCapability;
-	QBSS_LOAD_PARM      QbssLoad;
-    WPA_IE_     WpaIE;
-    WPA_IE_     RsnIE;
-} BSS_ENTRY, *PBSS_ENTRY;
-
-typedef struct {
-    UCHAR           BssNr;
-    UCHAR           BssOverlapNr;
-    BSS_ENTRY       BssEntry[MAX_LEN_OF_BSS_TABLE];
-} BSS_TABLE, *PBSS_TABLE;
-
-
-typedef struct _MLME_QUEUE_ELEM {
-    ULONG             Machine;
-    ULONG             MsgType;
-    ULONG             MsgLen;
-    UCHAR             Msg[MGMT_DMA_BUFFER_SIZE];
-    LARGE_INTEGER     TimeStamp;
-    UCHAR             Rssi0;
-    UCHAR             Rssi1;
-    UCHAR             Rssi2;
-    UCHAR             Signal;
-    UCHAR             Channel;
-    UCHAR             Wcid;
-    BOOLEAN           Occupied;
-} MLME_QUEUE_ELEM, *PMLME_QUEUE_ELEM;
-
-typedef struct _MLME_QUEUE {
-    ULONG             Num;
-    ULONG             Head;
-    ULONG             Tail;
-    NDIS_SPIN_LOCK   Lock;
-    MLME_QUEUE_ELEM  Entry[MAX_LEN_OF_MLME_QUEUE];
-} MLME_QUEUE, *PMLME_QUEUE;
-
-typedef VOID (*STATE_MACHINE_FUNC)(VOID *Adaptor, MLME_QUEUE_ELEM *Elem);
-
-typedef struct _STATE_MACHINE {
-    ULONG                           Base;
-    ULONG                           NrState;
-    ULONG                           NrMsg;
-    ULONG                           CurrState;
-    STATE_MACHINE_FUNC             *TransFunc;
-} STATE_MACHINE, *PSTATE_MACHINE;
-
-
-// MLME AUX data structure that hold temporarliy settings during a connection attempt.
-// Once this attemp succeeds, all settings will be copy to pAd->StaActive.
-// A connection attempt (user set OID, roaming, CCX fast roaming,..) consists of
-// several steps (JOIN, AUTH, ASSOC or REASSOC) and may fail at any step. We purposely
-// separate this under-trial settings away from pAd->StaActive so that once
-// this new attempt failed, driver can auto-recover back to the active settings.
-typedef struct _MLME_AUX {
-    UCHAR               BssType;
-    UCHAR               Ssid[MAX_LEN_OF_SSID];
-    UCHAR               SsidLen;
-    UCHAR               Bssid[MAC_ADDR_LEN];
-	UCHAR				AutoReconnectSsid[MAX_LEN_OF_SSID];
-	UCHAR				AutoReconnectSsidLen;
-    USHORT              Alg;
-    UCHAR               ScanType;
-    UCHAR               Channel;
-	UCHAR               CentralChannel;
-    USHORT              Aid;
-    USHORT              CapabilityInfo;
-    USHORT              BeaconPeriod;
-    USHORT              CfpMaxDuration;
-    USHORT              CfpPeriod;
-    USHORT              AtimWin;
-
-	// Copy supported rate from desired AP's beacon. We are trying to match
-	// AP's supported and extended rate settings.
-	UCHAR		        SupRate[MAX_LEN_OF_SUPPORTED_RATES];
-	UCHAR		        ExtRate[MAX_LEN_OF_SUPPORTED_RATES];
-	UCHAR		        SupRateLen;
-	UCHAR		        ExtRateLen;
-	HT_CAPABILITY_IE		HtCapability;
-	UCHAR		        	HtCapabilityLen;
-	ADD_HT_INFO_IE		AddHtInfo;	// AP might use this additional ht info IE
-	UCHAR			NewExtChannelOffset;
-	//RT_HT_CAPABILITY	SupportedHtPhy;
-
-    // new for QOS
-    QOS_CAPABILITY_PARM APQosCapability;    // QOS capability of the current associated AP
-    EDCA_PARM           APEdcaParm;         // EDCA parameters of the current associated AP
-    QBSS_LOAD_PARM      APQbssLoad;         // QBSS load of the current associated AP
-
-    // new to keep Ralink specific feature
-    ULONG               APRalinkIe;
-
-    BSS_TABLE           SsidBssTab;     // AP list for the same SSID
-    BSS_TABLE           RoamTab;        // AP list eligible for roaming
-    ULONG               BssIdx;
-    ULONG               RoamIdx;
-
-	BOOLEAN				CurrReqIsFromNdis;
-
-    RALINK_TIMER_STRUCT BeaconTimer, ScanTimer;
-    RALINK_TIMER_STRUCT AuthTimer;
-    RALINK_TIMER_STRUCT AssocTimer, ReassocTimer, DisassocTimer;
-} MLME_AUX, *PMLME_AUX;
-
-typedef struct _MLME_ADDBA_REQ_STRUCT{
-	UCHAR   Wcid;	//
-	UCHAR   pAddr[MAC_ADDR_LEN];
-	UCHAR   BaBufSize;
-	USHORT	TimeOutValue;
-	UCHAR   TID;
-	UCHAR   Token;
-	USHORT	BaStartSeq;
-} MLME_ADDBA_REQ_STRUCT, *PMLME_ADDBA_REQ_STRUCT;
-
-
-typedef struct _MLME_DELBA_REQ_STRUCT{
-	UCHAR   Wcid;	//
-	UCHAR     Addr[MAC_ADDR_LEN];
-	UCHAR   TID;
-	UCHAR	Initiator;
-} MLME_DELBA_REQ_STRUCT, *PMLME_DELBA_REQ_STRUCT;
-
-// assoc struct is equal to reassoc
-typedef struct _MLME_ASSOC_REQ_STRUCT{
-    UCHAR     Addr[MAC_ADDR_LEN];
-    USHORT    CapabilityInfo;
-    USHORT    ListenIntv;
-    ULONG     Timeout;
-} MLME_ASSOC_REQ_STRUCT, *PMLME_ASSOC_REQ_STRUCT, MLME_REASSOC_REQ_STRUCT, *PMLME_REASSOC_REQ_STRUCT;
-
-typedef struct _MLME_DISASSOC_REQ_STRUCT{
-    UCHAR     Addr[MAC_ADDR_LEN];
-    USHORT    Reason;
-} MLME_DISASSOC_REQ_STRUCT, *PMLME_DISASSOC_REQ_STRUCT;
-
-typedef struct _MLME_AUTH_REQ_STRUCT {
-    UCHAR        Addr[MAC_ADDR_LEN];
-    USHORT       Alg;
-    ULONG        Timeout;
-} MLME_AUTH_REQ_STRUCT, *PMLME_AUTH_REQ_STRUCT;
-
-typedef struct _MLME_DEAUTH_REQ_STRUCT {
-    UCHAR        Addr[MAC_ADDR_LEN];
-    USHORT       Reason;
-} MLME_DEAUTH_REQ_STRUCT, *PMLME_DEAUTH_REQ_STRUCT;
-
-typedef struct {
-    ULONG      BssIdx;
-} MLME_JOIN_REQ_STRUCT;
-
-typedef struct _MLME_SCAN_REQ_STRUCT {
-    UCHAR      Bssid[MAC_ADDR_LEN];
-    UCHAR      BssType;
-    UCHAR      ScanType;
-    UCHAR      SsidLen;
-    CHAR       Ssid[MAX_LEN_OF_SSID];
-} MLME_SCAN_REQ_STRUCT, *PMLME_SCAN_REQ_STRUCT;
-
-typedef struct _MLME_START_REQ_STRUCT {
-    CHAR        Ssid[MAX_LEN_OF_SSID];
-    UCHAR       SsidLen;
-} MLME_START_REQ_STRUCT, *PMLME_START_REQ_STRUCT;
-
-typedef struct PACKED {
-    UCHAR   Eid;
-    UCHAR   Len;
-    CHAR   Octet[1];
-} EID_STRUCT,*PEID_STRUCT, BEACON_EID_STRUCT, *PBEACON_EID_STRUCT;
-
-typedef struct PACKED _RTMP_TX_RATE_SWITCH
-{
-	UCHAR   ItemNo;
-	UCHAR	STBC:1;
-	UCHAR	ShortGI:1;
-	UCHAR	BW:1;
-	UCHAR	Rsv1:1;
-	UCHAR	Mode:2;
-	UCHAR	Rsv2:2;
-	UCHAR   CurrMCS;
-	UCHAR   TrainUp;
-	UCHAR   TrainDown;
-} RRTMP_TX_RATE_SWITCH, *PRTMP_TX_RATE_SWITCH;
-
-// ========================== AP mlme.h ===============================
-#define TBTT_PRELOAD_TIME       384        // usec. LomgPreamble + 24-byte at 1Mbps
+/* */
+/* Contention-free parameter (without ID and Length) */
+/* */
+struct PACKED rt_cf_parm {
+	BOOLEAN bValid;		/* 1: variable contains valid value */
+	u8 CfpCount;
+	u8 CfpPeriod;
+	u16 CfpMaxDuration;
+	u16 CfpDurRemaining;
+};
+
+struct rt_cipher_suite {
+	NDIS_802_11_ENCRYPTION_STATUS PairCipher;	/* Unicast cipher 1, this one has more secured cipher suite */
+	NDIS_802_11_ENCRYPTION_STATUS PairCipherAux;	/* Unicast cipher 2 if AP announce two unicast cipher suite */
+	NDIS_802_11_ENCRYPTION_STATUS GroupCipher;	/* Group cipher */
+	u16 RsnCapability;	/* RSN capability from beacon */
+	BOOLEAN bMixMode;	/* Indicate Pair & Group cipher might be different */
+};
+
+/* EDCA configuration from AP's BEACON/ProbeRsp */
+struct rt_edca_parm {
+	BOOLEAN bValid;		/* 1: variable contains valid value */
+	BOOLEAN bAdd;		/* 1: variable contains valid value */
+	BOOLEAN bQAck;
+	BOOLEAN bQueueRequest;
+	BOOLEAN bTxopRequest;
+	BOOLEAN bAPSDCapable;
+/*  BOOLEAN     bMoreDataAck; */
+	u8 EdcaUpdateCount;
+	u8 Aifsn[4];		/* 0:AC_BK, 1:AC_BE, 2:AC_VI, 3:AC_VO */
+	u8 Cwmin[4];
+	u8 Cwmax[4];
+	u16 Txop[4];		/* in unit of 32-us */
+	BOOLEAN bACM[4];	/* 1: Admission Control of AC_BK is mandattory */
+};
+
+/* QBSS LOAD information from QAP's BEACON/ProbeRsp */
+struct rt_qbss_load_parm {
+	BOOLEAN bValid;		/* 1: variable contains valid value */
+	u16 StaNum;
+	u8 ChannelUtilization;
+	u16 RemainingAdmissionControl;	/* in unit of 32-us */
+};
+
+/* QBSS Info field in QSTA's assoc req */
+struct PACKED rt_qbss_sta_info_parm {
+	u8 UAPSD_AC_VO:1;
+	u8 UAPSD_AC_VI:1;
+	u8 UAPSD_AC_BK:1;
+	u8 UAPSD_AC_BE:1;
+	u8 Rsv1:1;
+	u8 MaxSPLength:2;
+	u8 Rsv2:1;
+};
+
+/* QBSS Info field in QAP's Beacon/ProbeRsp */
+struct PACKED rt_qbss_ap_info_parm {
+	u8 ParamSetCount:4;
+	u8 Rsv:3;
+	u8 UAPSD:1;
+};
+
+/* QOS Capability reported in QAP's BEACON/ProbeRsp */
+/* QOS Capability sent out in QSTA's AssociateReq/ReAssociateReq */
+struct rt_qos_capability_parm {
+	BOOLEAN bValid;		/* 1: variable contains valid value */
+	BOOLEAN bQAck;
+	BOOLEAN bQueueRequest;
+	BOOLEAN bTxopRequest;
+/*  BOOLEAN     bMoreDataAck; */
+	u8 EdcaUpdateCount;
+};
+
+struct rt_wpa_ie {
+	u8 IELen;
+	u8 IE[MAX_CUSTOM_LEN];
+};
+
+struct rt_bss_entry {
+	u8 Bssid[MAC_ADDR_LEN];
+	u8 Channel;
+	u8 CentralChannel;	/*Store the wide-band central channel for 40MHz.  .used in 40MHz AP. Or this is the same as Channel. */
+	u8 BssType;
+	u16 AtimWin;
+	u16 BeaconPeriod;
+
+	u8 SupRate[MAX_LEN_OF_SUPPORTED_RATES];
+	u8 SupRateLen;
+	u8 ExtRate[MAX_LEN_OF_SUPPORTED_RATES];
+	u8 ExtRateLen;
+	struct rt_ht_capability_ie HtCapability;
+	u8 HtCapabilityLen;
+	struct rt_add_ht_info_ie AddHtInfo;	/* AP might use this additional ht info IE */
+	u8 AddHtInfoLen;
+	u8 NewExtChanOffset;
+	char Rssi;
+	u8 Privacy;		/* Indicate security function ON/OFF. Don't mess up with auth mode. */
+	u8 Hidden;
+
+	u16 DtimPeriod;
+	u16 CapabilityInfo;
+
+	u16 CfpCount;
+	u16 CfpPeriod;
+	u16 CfpMaxDuration;
+	u16 CfpDurRemaining;
+	u8 SsidLen;
+	char Ssid[MAX_LEN_OF_SSID];
+
+	unsigned long LastBeaconRxTime;	/* OS's timestamp */
+
+	BOOLEAN bSES;
+
+	/* New for WPA2 */
+	struct rt_cipher_suite WPA;	/* AP announced WPA cipher suite */
+	struct rt_cipher_suite WPA2;	/* AP announced WPA2 cipher suite */
+
+	/* New for microsoft WPA support */
+	struct rt_ndis_802_11_fixed_ies FixIEs;
+	NDIS_802_11_AUTHENTICATION_MODE AuthModeAux;	/* Addition mode for WPA2 / WPA capable AP */
+	NDIS_802_11_AUTHENTICATION_MODE AuthMode;
+	NDIS_802_11_WEP_STATUS WepStatus;	/* Unicast Encryption Algorithm extract from VAR_IE */
+	u16 VarIELen;	/* Length of next VIE include EID & Length */
+	u8 VarIEs[MAX_VIE_LEN];
+
+	/* CCX Ckip information */
+	u8 CkipFlag;
+
+	/* CCX 2 TSF */
+	u8 PTSF[4];		/* Parent TSF */
+	u8 TTSF[8];		/* Target TSF */
+
+	/* 802.11e d9, and WMM */
+	struct rt_edca_parm EdcaParm;
+	struct rt_qos_capability_parm QosCapability;
+	struct rt_qbss_load_parm QbssLoad;
+	struct rt_wpa_ie WpaIE;
+	struct rt_wpa_ie RsnIE;
+};
+
+struct rt_bss_table {
+	u8 BssNr;
+	u8 BssOverlapNr;
+	struct rt_bss_entry BssEntry[MAX_LEN_OF_BSS_TABLE];
+};
+
+struct rt_mlme_queue_elem {
+	unsigned long Machine;
+	unsigned long MsgType;
+	unsigned long MsgLen;
+	u8 Msg[MGMT_DMA_BUFFER_SIZE];
+	LARGE_INTEGER TimeStamp;
+	u8 Rssi0;
+	u8 Rssi1;
+	u8 Rssi2;
+	u8 Signal;
+	u8 Channel;
+	u8 Wcid;
+	BOOLEAN Occupied;
+};
+
+struct rt_mlme_queue {
+	unsigned long Num;
+	unsigned long Head;
+	unsigned long Tail;
+	spinlock_t Lock;
+	struct rt_mlme_queue_elem Entry[MAX_LEN_OF_MLME_QUEUE];
+};
+
+typedef void(*STATE_MACHINE_FUNC) (void * Adaptor, struct rt_mlme_queue_elem *Elem);
+
+struct rt_state_machine {
+	unsigned long Base;
+	unsigned long NrState;
+	unsigned long NrMsg;
+	unsigned long CurrState;
+	STATE_MACHINE_FUNC *TransFunc;
+};
+
+/* MLME AUX data structure that hold temporarliy settings during a connection attempt. */
+/* Once this attemp succeeds, all settings will be copy to pAd->StaActive. */
+/* A connection attempt (user set OID, roaming, CCX fast roaming,..) consists of */
+/* several steps (JOIN, AUTH, ASSOC or REASSOC) and may fail at any step. We purposely */
+/* separate this under-trial settings away from pAd->StaActive so that once */
+/* this new attempt failed, driver can auto-recover back to the active settings. */
+struct rt_mlme_aux {
+	u8 BssType;
+	u8 Ssid[MAX_LEN_OF_SSID];
+	u8 SsidLen;
+	u8 Bssid[MAC_ADDR_LEN];
+	u8 AutoReconnectSsid[MAX_LEN_OF_SSID];
+	u8 AutoReconnectSsidLen;
+	u16 Alg;
+	u8 ScanType;
+	u8 Channel;
+	u8 CentralChannel;
+	u16 Aid;
+	u16 CapabilityInfo;
+	u16 BeaconPeriod;
+	u16 CfpMaxDuration;
+	u16 CfpPeriod;
+	u16 AtimWin;
+
+	/* Copy supported rate from desired AP's beacon. We are trying to match */
+	/* AP's supported and extended rate settings. */
+	u8 SupRate[MAX_LEN_OF_SUPPORTED_RATES];
+	u8 ExtRate[MAX_LEN_OF_SUPPORTED_RATES];
+	u8 SupRateLen;
+	u8 ExtRateLen;
+	struct rt_ht_capability_ie HtCapability;
+	u8 HtCapabilityLen;
+	struct rt_add_ht_info_ie AddHtInfo;	/* AP might use this additional ht info IE */
+	u8 NewExtChannelOffset;
+	/*struct rt_ht_capability      SupportedHtPhy; */
+
+	/* new for QOS */
+	struct rt_qos_capability_parm APQosCapability;	/* QOS capability of the current associated AP */
+	struct rt_edca_parm APEdcaParm;	/* EDCA parameters of the current associated AP */
+	struct rt_qbss_load_parm APQbssLoad;	/* QBSS load of the current associated AP */
+
+	/* new to keep Ralink specific feature */
+	unsigned long APRalinkIe;
+
+	struct rt_bss_table SsidBssTab;	/* AP list for the same SSID */
+	struct rt_bss_table RoamTab;	/* AP list eligible for roaming */
+	unsigned long BssIdx;
+	unsigned long RoamIdx;
+
+	BOOLEAN CurrReqIsFromNdis;
+
+	struct rt_ralink_timer BeaconTimer, ScanTimer;
+	struct rt_ralink_timer AuthTimer;
+	struct rt_ralink_timer AssocTimer, ReassocTimer, DisassocTimer;
+};
+
+struct rt_mlme_addba_req {
+	u8 Wcid;		/* */
+	u8 pAddr[MAC_ADDR_LEN];
+	u8 BaBufSize;
+	u16 TimeOutValue;
+	u8 TID;
+	u8 Token;
+	u16 BaStartSeq;
+};
+
+struct rt_mlme_delba_req {
+	u8 Wcid;		/* */
+	u8 Addr[MAC_ADDR_LEN];
+	u8 TID;
+	u8 Initiator;
+};
+
+/* assoc struct is equal to reassoc */
+struct rt_mlme_assoc_req {
+	u8 Addr[MAC_ADDR_LEN];
+	u16 CapabilityInfo;
+	u16 ListenIntv;
+	unsigned long Timeout;
+};
+
+struct rt_mlme_disassoc_req {
+	u8 Addr[MAC_ADDR_LEN];
+	u16 Reason;
+};
+
+struct rt_mlme_auth_req {
+	u8 Addr[MAC_ADDR_LEN];
+	u16 Alg;
+	unsigned long Timeout;
+};
+
+struct rt_mlme_deauth_req {
+	u8 Addr[MAC_ADDR_LEN];
+	u16 Reason;
+};
+
+struct rt_mlme_join_req {
+	unsigned long BssIdx;
+};
+
+struct rt_mlme_scan_req {
+	u8 Bssid[MAC_ADDR_LEN];
+	u8 BssType;
+	u8 ScanType;
+	u8 SsidLen;
+	char Ssid[MAX_LEN_OF_SSID];
+};
+
+struct rt_mlme_start_req {
+	char Ssid[MAX_LEN_OF_SSID];
+	u8 SsidLen;
+};
+
+struct PACKED rt_eid {
+	u8 Eid;
+	u8 Len;
+	u8 Octet[1];
+};
+
+struct PACKED rt_rtmp_tx_rate_switch {
+	u8 ItemNo;
+	u8 STBC:1;
+	u8 ShortGI:1;
+	u8 BW:1;
+	u8 Rsv1:1;
+	u8 Mode:2;
+	u8 Rsv2:2;
+	u8 CurrMCS;
+	u8 TrainUp;
+	u8 TrainDown;
+};
+
+/* ========================== AP mlme.h =============================== */
+#define TBTT_PRELOAD_TIME       384	/* usec. LomgPreamble + 24-byte at 1Mbps */
 #define DEFAULT_DTIM_PERIOD     1
 
-#define MAC_TABLE_AGEOUT_TIME			300			// unit: sec
-#define MAC_TABLE_ASSOC_TIMEOUT			5			// unit: sec
+#define MAC_TABLE_AGEOUT_TIME			300	/* unit: sec */
+#define MAC_TABLE_ASSOC_TIMEOUT			5	/* unit: sec */
 #define MAC_TABLE_FULL(Tab)				((Tab).size == MAX_LEN_OF_MAC_TABLE)
 
-// AP shall drop the sta if contine Tx fail count reach it.
-#define MAC_ENTRY_LIFE_CHECK_CNT		20			// packet cnt.
+/* AP shall drop the sta if contine Tx fail count reach it. */
+#define MAC_ENTRY_LIFE_CHECK_CNT		20	/* packet cnt. */
 
-// Value domain of pMacEntry->Sst
+/* Value domain of pMacEntry->Sst */
 typedef enum _Sst {
-    SST_NOT_AUTH,   // 0: equivalent to IEEE 802.11/1999 state 1
-    SST_AUTH,       // 1: equivalent to IEEE 802.11/1999 state 2
-    SST_ASSOC       // 2: equivalent to IEEE 802.11/1999 state 3
+	SST_NOT_AUTH,		/* 0: equivalent to IEEE 802.11/1999 state 1 */
+	SST_AUTH,		/* 1: equivalent to IEEE 802.11/1999 state 2 */
+	SST_ASSOC		/* 2: equivalent to IEEE 802.11/1999 state 3 */
 } SST;
 
-// value domain of pMacEntry->AuthState
+/* value domain of pMacEntry->AuthState */
 typedef enum _AuthState {
-    AS_NOT_AUTH,
-    AS_AUTH_OPEN,       // STA has been authenticated using OPEN SYSTEM
-    AS_AUTH_KEY,        // STA has been authenticated using SHARED KEY
-    AS_AUTHENTICATING   // STA is waiting for AUTH seq#3 using SHARED KEY
+	AS_NOT_AUTH,
+	AS_AUTH_OPEN,		/* STA has been authenticated using OPEN SYSTEM */
+	AS_AUTH_KEY,		/* STA has been authenticated using SHARED KEY */
+	AS_AUTHENTICATING	/* STA is waiting for AUTH seq#3 using SHARED KEY */
 } AUTH_STATE;
 
-//for-wpa value domain of pMacEntry->WpaState  802.1i D3   p.114
+/*for-wpa value domain of pMacEntry->WpaState  802.1i D3   p.114 */
 typedef enum _ApWpaState {
-    AS_NOTUSE,              // 0
-    AS_DISCONNECT,          // 1
-    AS_DISCONNECTED,        // 2
-    AS_INITIALIZE,          // 3
-    AS_AUTHENTICATION,      // 4
-    AS_AUTHENTICATION2,     // 5
-    AS_INITPMK,             // 6
-    AS_INITPSK,             // 7
-    AS_PTKSTART,            // 8
-    AS_PTKINIT_NEGOTIATING, // 9
-    AS_PTKINITDONE,         // 10
-    AS_UPDATEKEYS,          // 11
-    AS_INTEGRITY_FAILURE,   // 12
-    AS_KEYUPDATE,           // 13
+	AS_NOTUSE,		/* 0 */
+	AS_DISCONNECT,		/* 1 */
+	AS_DISCONNECTED,	/* 2 */
+	AS_INITIALIZE,		/* 3 */
+	AS_AUTHENTICATION,	/* 4 */
+	AS_AUTHENTICATION2,	/* 5 */
+	AS_INITPMK,		/* 6 */
+	AS_INITPSK,		/* 7 */
+	AS_PTKSTART,		/* 8 */
+	AS_PTKINIT_NEGOTIATING,	/* 9 */
+	AS_PTKINITDONE,		/* 10 */
+	AS_UPDATEKEYS,		/* 11 */
+	AS_INTEGRITY_FAILURE,	/* 12 */
+	AS_KEYUPDATE,		/* 13 */
 } AP_WPA_STATE;
 
-// for-wpa value domain of pMacEntry->WpaState  802.1i D3   p.114
+/* for-wpa value domain of pMacEntry->WpaState  802.1i D3   p.114 */
 typedef enum _GTKState {
-    REKEY_NEGOTIATING,
-    REKEY_ESTABLISHED,
-    KEYERROR,
+	REKEY_NEGOTIATING,
+	REKEY_ESTABLISHED,
+	KEYERROR,
 } GTK_STATE;
 
-//  for-wpa  value domain of pMacEntry->WpaState  802.1i D3   p.114
+/*  for-wpa  value domain of pMacEntry->WpaState  802.1i D3   p.114 */
 typedef enum _WpaGTKState {
-    SETKEYS,
-    SETKEYS_DONE,
+	SETKEYS,
+	SETKEYS_DONE,
 } WPA_GTK_STATE;
-// ====================== end of AP mlme.h ============================
-
+/* ====================== end of AP mlme.h ============================ */
 
-#endif	// MLME_H__
+#endif /* MLME_H__ */
diff --git a/drivers/staging/rt2860/oid.h b/drivers/staging/rt2860/oid.h
index 0227c4a38f9f..fd1c14192451 100644
--- a/drivers/staging/rt2860/oid.h
+++ b/drivers/staging/rt2860/oid.h
@@ -37,32 +37,37 @@
 #ifndef _OID_H_
 #define _OID_H_
 
+/*#include <linux/wireless.h> */
 
+#ifndef TRUE
 #define TRUE				1
+#endif
+#ifndef FALSE
 #define FALSE				0
-//
-// IEEE 802.11 Structures and definitions
-//
-#define MAX_TX_POWER_LEVEL              100   /* mW */
-#define MAX_RSSI_TRIGGER                -10    /* dBm */
-#define MIN_RSSI_TRIGGER                -200   /* dBm */
-#define MAX_FRAG_THRESHOLD              2346  /* byte count */
-#define MIN_FRAG_THRESHOLD              256   /* byte count */
-#define MAX_RTS_THRESHOLD               2347  /* byte count */
-
-// new types for Media Specific Indications
-// Extension channel offset
+#endif
+/* */
+/* IEEE 802.11 Structures and definitions */
+/* */
+#define MAX_TX_POWER_LEVEL              100	/* mW */
+#define MAX_RSSI_TRIGGER                -10	/* dBm */
+#define MIN_RSSI_TRIGGER                -200	/* dBm */
+#define MAX_FRAG_THRESHOLD              2346	/* byte count */
+#define MIN_FRAG_THRESHOLD              256	/* byte count */
+#define MAX_RTS_THRESHOLD               2347	/* byte count */
+
+/* new types for Media Specific Indications */
+/* Extension channel offset */
 #define EXTCHA_NONE			0
 #define EXTCHA_ABOVE		0x1
 #define EXTCHA_BELOW		0x3
 
-// BW
+/* BW */
 #define BAND_WIDTH_20		0
 #define BAND_WIDTH_40		1
 #define BAND_WIDTH_BOTH		2
-#define BAND_WIDTH_10		3	// 802.11j has 10MHz. This definition is for internal usage. doesn't fill in the IE or other field.
-// SHORTGI
-#define GAP_INTERVAL_400	1	// only support in HT mode
+#define BAND_WIDTH_10		3	/* 802.11j has 10MHz. This definition is for internal usage. doesn't fill in the IE or other field. */
+/* SHORTGI */
+#define GAP_INTERVAL_400	1	/* only support in HT mode */
 #define GAP_INTERVAL_800	0
 #define GAP_INTERVAL_BOTH	2
 
@@ -73,24 +78,24 @@
 #define NDIS_802_11_LENGTH_RATES        8
 #define NDIS_802_11_LENGTH_RATES_EX     16
 #define MAC_ADDR_LENGTH                 6
-#define MAX_NUM_OF_CHS					49 // 14 channels @2.4G +  12@UNII + 4 @MMAC + 11 @HiperLAN2 + 7 @Japan + 1 as NULL terminationc
-#define MAX_NUMBER_OF_EVENT				10  // entry # in EVENT table
-#define MAX_NUMBER_OF_MAC				32 // if MAX_MBSSID_NUM is 8, this value can't be larger than 211
+/*#define MAX_NUM_OF_CHS                                        49 // 14 channels @2.4G +  12@UNII + 4 @MMAC + 11 @HiperLAN2 + 7 @Japan + 1 as NULL terminationc */
+#define MAX_NUM_OF_CHS				54	/* 14 channels @2.4G +  12@UNII(lower/middle) + 16@HiperLAN2 + 11@UNII(upper) + 0 @Japan + 1 as NULL termination */
+#define MAX_NUMBER_OF_EVENT				10	/* entry # in EVENT table */
+#define MAX_NUMBER_OF_MAC				32	/* if MAX_MBSSID_NUM is 8, this value can't be larger than 211 */
 #define MAX_NUMBER_OF_ACL				64
-#define MAX_LENGTH_OF_SUPPORT_RATES		12    // 1, 2, 5.5, 11, 6, 9, 12, 18, 24, 36, 48, 54
+#define MAX_LENGTH_OF_SUPPORT_RATES		12	/* 1, 2, 5.5, 11, 6, 9, 12, 18, 24, 36, 48, 54 */
 #define MAX_NUMBER_OF_DLS_ENTRY			4
 
-#define OID_GEN_MACHINE_NAME               0x0001021A
-
 #define RT_QUERY_SIGNAL_CONTEXT				0x0402
 #define RT_SET_IAPP_PID                 	0x0404
 #define RT_SET_APD_PID						0x0405
 #define RT_SET_DEL_MAC_ENTRY				0x0406
-
-//
-// IEEE 802.11 OIDs
-//
+#define RT_QUERY_EVENT_TABLE			0x0407
+/* */
+/* IEEE 802.11 OIDs */
+/* */
 #define	OID_GET_SET_TOGGLE			0x8000
+#define	OID_GET_SET_FROM_UI			0x4000
 
 #define OID_802_11_ADD_WEP			0x0112
 #define OID_802_11_DISASSOCIATE			0x0114
@@ -101,38 +106,42 @@
 
 #define	RT_OID_DEVICE_NAME							0x0607
 #define	RT_OID_VERSION_INFO							0x0608
+#define	OID_802_11_BSSID_LIST						0x0609
+#define	OID_802_3_CURRENT_ADDRESS					0x060A
 #define	OID_GEN_MEDIA_CONNECT_STATUS				0x060B
+#define	RT_OID_802_11_QUERY_LINK_STATUS				0x060C
+#define	OID_802_11_RSSI								0x060D
+#define	OID_802_11_STATISTICS						0x060E
 #define	OID_GEN_RCV_OK								0x060F
 #define	OID_GEN_RCV_NO_BUFFER						0x0610
-
+#define	RT_OID_802_11_QUERY_EEPROM_VERSION			0x0611
+#define	RT_OID_802_11_QUERY_FIRMWARE_VERSION		0x0612
+#define	RT_OID_802_11_QUERY_LAST_RX_RATE			0x0613
+#define	RT_OID_802_11_TX_POWER_LEVEL_1				0x0614
+#define	RT_OID_802_11_QUERY_PIDVID					0x0615
+/*for WPA_SUPPLICANT_SUPPORT */
 #define OID_SET_COUNTERMEASURES                     0x0616
 #define RT_OID_WPA_SUPPLICANT_SUPPORT               0x0621
 #define RT_OID_WE_VERSION_COMPILED                  0x0622
 #define RT_OID_NEW_DRIVER                           0x0623
 
-//rt2860 , kathy
 #define RT_OID_DRIVER_DEVICE_NAME                   0x0645
 #define RT_OID_QUERY_MULTIPLE_CARD_SUPPORT          0x0647
 
-// Ralink defined OIDs
-// Dennis Lee move to platform specific
-
-typedef enum _NDIS_802_11_STATUS_TYPE
-{
-    Ndis802_11StatusType_Authentication,
-    Ndis802_11StatusType_MediaStreamMode,
-    Ndis802_11StatusType_PMKID_CandidateList,
-    Ndis802_11StatusTypeMax    // not a real type, defined as an upper bound
+typedef enum _NDIS_802_11_STATUS_TYPE {
+	Ndis802_11StatusType_Authentication,
+	Ndis802_11StatusType_MediaStreamMode,
+	Ndis802_11StatusType_PMKID_CandidateList,
+	Ndis802_11StatusTypeMax	/* not a real type, defined as an upper bound */
 } NDIS_802_11_STATUS_TYPE, *PNDIS_802_11_STATUS_TYPE;
 
-typedef UCHAR   NDIS_802_11_MAC_ADDRESS[6];
+typedef u8 NDIS_802_11_MAC_ADDRESS[6];
 
-typedef struct _NDIS_802_11_STATUS_INDICATION
-{
-    NDIS_802_11_STATUS_TYPE StatusType;
-} NDIS_802_11_STATUS_INDICATION, *PNDIS_802_11_STATUS_INDICATION;
+struct rt_ndis_802_11_status_indication {
+	NDIS_802_11_STATUS_TYPE StatusType;
+};
 
-// mask for authentication/integrity fields
+/* mask for authentication/integrity fields */
 #define NDIS_802_11_AUTH_REQUEST_AUTH_FIELDS        0x0f
 
 #define NDIS_802_11_AUTH_REQUEST_REAUTH             0x01
@@ -140,304 +149,283 @@ typedef struct _NDIS_802_11_STATUS_INDICATION
 #define NDIS_802_11_AUTH_REQUEST_PAIRWISE_ERROR     0x06
 #define NDIS_802_11_AUTH_REQUEST_GROUP_ERROR        0x0E
 
-typedef struct _NDIS_802_11_AUTHENTICATION_REQUEST
-{
-    ULONG Length;            // Length of structure
-    NDIS_802_11_MAC_ADDRESS Bssid;
-    ULONG Flags;
-} NDIS_802_11_AUTHENTICATION_REQUEST, *PNDIS_802_11_AUTHENTICATION_REQUEST;
-
-//Added new types for PMKID Candidate lists.
-typedef struct _PMKID_CANDIDATE {
-    NDIS_802_11_MAC_ADDRESS BSSID;
-    ULONG Flags;
-} PMKID_CANDIDATE, *PPMKID_CANDIDATE;
-
-typedef struct _NDIS_802_11_PMKID_CANDIDATE_LIST
-{
-    ULONG Version;       // Version of the structure
-    ULONG NumCandidates; // No. of pmkid candidates
-    PMKID_CANDIDATE CandidateList[1];
-} NDIS_802_11_PMKID_CANDIDATE_LIST, *PNDIS_802_11_PMKID_CANDIDATE_LIST;
-
-//Flags for PMKID Candidate list structure
+struct rt_ndis_802_11_authentication_request {
+	unsigned long Length;		/* Length of structure */
+	NDIS_802_11_MAC_ADDRESS Bssid;
+	unsigned long Flags;
+};
+
+/*Added new types for PMKID Candidate lists. */
+struct rt_pmkid_candidate {
+	NDIS_802_11_MAC_ADDRESS BSSID;
+	unsigned long Flags;
+};
+
+struct rt_ndis_802_11_pmkid_candidate_list {
+	unsigned long Version;		/* Version of the structure */
+	unsigned long NumCandidates;	/* No. of pmkid candidates */
+	struct rt_pmkid_candidate CandidateList[1];
+};
+
+/*Flags for PMKID Candidate list structure */
 #define NDIS_802_11_PMKID_CANDIDATE_PREAUTH_ENABLED	0x01
 
-// Added new types for OFDM 5G and 2.4G
-typedef enum _NDIS_802_11_NETWORK_TYPE
-{
-   Ndis802_11FH,
-   Ndis802_11DS,
-    Ndis802_11OFDM5,
-    Ndis802_11OFDM5_N,
-    Ndis802_11OFDM24,
-    Ndis802_11OFDM24_N,
-   Ndis802_11Automode,
-    Ndis802_11NetworkTypeMax    // not a real type, defined as an upper bound
+/* Added new types for OFDM 5G and 2.4G */
+typedef enum _NDIS_802_11_NETWORK_TYPE {
+	Ndis802_11FH,
+	Ndis802_11DS,
+	Ndis802_11OFDM5,
+	Ndis802_11OFDM24,
+	Ndis802_11Automode,
+	Ndis802_11OFDM5_N,
+	Ndis802_11OFDM24_N,
+	Ndis802_11NetworkTypeMax	/* not a real type, defined as an upper bound */
 } NDIS_802_11_NETWORK_TYPE, *PNDIS_802_11_NETWORK_TYPE;
 
-typedef struct _NDIS_802_11_NETWORK_TYPE_LIST
-{
-    UINT                       NumberOfItems;  // in list below, at least 1
-   NDIS_802_11_NETWORK_TYPE    NetworkType [1];
-} NDIS_802_11_NETWORK_TYPE_LIST, *PNDIS_802_11_NETWORK_TYPE_LIST;
-
-typedef enum _NDIS_802_11_POWER_MODE
-{
-    Ndis802_11PowerModeCAM,
-    Ndis802_11PowerModeMAX_PSP,
-    Ndis802_11PowerModeFast_PSP,
-    Ndis802_11PowerModeLegacy_PSP,
-    Ndis802_11PowerModeMax      // not a real mode, defined as an upper bound
+struct rt_ndis_802_11_network_type_list {
+	u32 NumberOfItems;	/* in list below, at least 1 */
+	NDIS_802_11_NETWORK_TYPE NetworkType[1];
+};
+
+typedef enum _NDIS_802_11_POWER_MODE {
+	Ndis802_11PowerModeCAM,
+	Ndis802_11PowerModeMAX_PSP,
+	Ndis802_11PowerModeFast_PSP,
+	Ndis802_11PowerModeLegacy_PSP,
+	Ndis802_11PowerModeMax	/* not a real mode, defined as an upper bound */
 } NDIS_802_11_POWER_MODE, *PNDIS_802_11_POWER_MODE;
 
-typedef ULONG   NDIS_802_11_TX_POWER_LEVEL; // in milliwatts
-
-//
-// Received Signal Strength Indication
-//
-typedef LONG    NDIS_802_11_RSSI;           // in dBm
-
-typedef struct _NDIS_802_11_CONFIGURATION_FH
-{
-   ULONG           Length;            // Length of structure
-   ULONG           HopPattern;        // As defined by 802.11, MSB set
-   ULONG           HopSet;            // to one if non-802.11
-   ULONG           DwellTime;         // units are Kusec
-} NDIS_802_11_CONFIGURATION_FH, *PNDIS_802_11_CONFIGURATION_FH;
-
-typedef struct _NDIS_802_11_CONFIGURATION
-{
-   ULONG                           Length;             // Length of structure
-   ULONG                           BeaconPeriod;       // units are Kusec
-   ULONG                           ATIMWindow;         // units are Kusec
-   ULONG                           DSConfig;           // Frequency, units are kHz
-   NDIS_802_11_CONFIGURATION_FH    FHConfig;
-} NDIS_802_11_CONFIGURATION, *PNDIS_802_11_CONFIGURATION;
-
-typedef struct _NDIS_802_11_STATISTICS
-{
-   ULONG           Length;             // Length of structure
-   LARGE_INTEGER   TransmittedFragmentCount;
-   LARGE_INTEGER   MulticastTransmittedFrameCount;
-   LARGE_INTEGER   FailedCount;
-   LARGE_INTEGER   RetryCount;
-   LARGE_INTEGER   MultipleRetryCount;
-   LARGE_INTEGER   RTSSuccessCount;
-   LARGE_INTEGER   RTSFailureCount;
-   LARGE_INTEGER   ACKFailureCount;
-   LARGE_INTEGER   FrameDuplicateCount;
-   LARGE_INTEGER   ReceivedFragmentCount;
-   LARGE_INTEGER   MulticastReceivedFrameCount;
-   LARGE_INTEGER   FCSErrorCount;
-   LARGE_INTEGER   TKIPLocalMICFailures;
-   LARGE_INTEGER   TKIPRemoteMICErrors;
-   LARGE_INTEGER   TKIPICVErrors;
-   LARGE_INTEGER   TKIPCounterMeasuresInvoked;
-   LARGE_INTEGER   TKIPReplays;
-   LARGE_INTEGER   CCMPFormatErrors;
-   LARGE_INTEGER   CCMPReplays;
-   LARGE_INTEGER   CCMPDecryptErrors;
-   LARGE_INTEGER   FourWayHandshakeFailures;
-} NDIS_802_11_STATISTICS, *PNDIS_802_11_STATISTICS;
-
-typedef  ULONG  NDIS_802_11_KEY_INDEX;
-typedef ULONGLONG   NDIS_802_11_KEY_RSC;
-
-#define MAX_RADIUS_SRV_NUM			2	  // 802.1x failover number
-
-typedef struct PACKED _RADIUS_SRV_INFO {
-	UINT32			radius_ip;
-	UINT32			radius_port;
-	UCHAR			radius_key[64];
-	UCHAR			radius_key_len;
-} RADIUS_SRV_INFO, *PRADIUS_SRV_INFO;
-
-typedef struct PACKED _RADIUS_KEY_INFO
-{
-	UCHAR			radius_srv_num;
-	RADIUS_SRV_INFO	radius_srv_info[MAX_RADIUS_SRV_NUM];
-	UCHAR			ieee8021xWEP;		 // dynamic WEP
-    UCHAR           key_index;
-    UCHAR           key_length;          // length of key in bytes
-    UCHAR           key_material[13];
-} RADIUS_KEY_INFO, *PRADIUS_KEY_INFO;
-
-// It's used by 802.1x daemon to require relative configuration
-typedef struct PACKED _RADIUS_CONF
-{
-    UINT32          Length;             // Length of this structure
-    UCHAR			mbss_num;			// indicate multiple BSS number
-	UINT32			own_ip_addr;
-	UINT32			retry_interval;
-	UINT32			session_timeout_interval;
-	UCHAR			EAPifname[IFNAMSIZ];
-	UCHAR			EAPifname_len;
-	UCHAR 			PreAuthifname[IFNAMSIZ];
-	UCHAR			PreAuthifname_len;
-	RADIUS_KEY_INFO	RadiusInfo[8/*MAX_MBSSID_NUM*/];
-} RADIUS_CONF, *PRADIUS_CONF;
-
-// Key mapping keys require a BSSID
-typedef struct _NDIS_802_11_KEY
-{
-    UINT           Length;             // Length of this structure
-    UINT           KeyIndex;
-    UINT           KeyLength;          // length of key in bytes
-    NDIS_802_11_MAC_ADDRESS BSSID;
-    NDIS_802_11_KEY_RSC KeyRSC;
-    UCHAR           KeyMaterial[1];     // variable length depending on above field
-} NDIS_802_11_KEY, *PNDIS_802_11_KEY;
-
-typedef struct _NDIS_802_11_REMOVE_KEY
-{
-    UINT           Length;             // Length of this structure
-    UINT           KeyIndex;
-    NDIS_802_11_MAC_ADDRESS BSSID;
-} NDIS_802_11_REMOVE_KEY, *PNDIS_802_11_REMOVE_KEY;
-
-typedef struct _NDIS_802_11_WEP
-{
-   UINT     Length;        // Length of this structure
-   UINT     KeyIndex;           // 0 is the per-client key, 1-N are the
-                                        // global keys
-   UINT     KeyLength;     // length of key in bytes
-   UCHAR     KeyMaterial[1];// variable length depending on above field
-} NDIS_802_11_WEP, *PNDIS_802_11_WEP;
-
-
-typedef enum _NDIS_802_11_NETWORK_INFRASTRUCTURE
-{
-   Ndis802_11IBSS,
-   Ndis802_11Infrastructure,
-   Ndis802_11AutoUnknown,
-   Ndis802_11Monitor,
-   Ndis802_11InfrastructureMax     // Not a real value, defined as upper bound
+typedef unsigned long NDIS_802_11_TX_POWER_LEVEL;	/* in milliwatts */
+
+/* */
+/* Received Signal Strength Indication */
+/* */
+typedef long NDIS_802_11_RSSI;	/* in dBm */
+
+struct rt_ndis_802_11_configuration_fh {
+	unsigned long Length;		/* Length of structure */
+	unsigned long HopPattern;	/* As defined by 802.11, MSB set */
+	unsigned long HopSet;		/* to one if non-802.11 */
+	unsigned long DwellTime;	/* units are Kusec */
+};
+
+struct rt_ndis_802_11_configuration {
+	unsigned long Length;		/* Length of structure */
+	unsigned long BeaconPeriod;	/* units are Kusec */
+	unsigned long ATIMWindow;	/* units are Kusec */
+	unsigned long DSConfig;		/* Frequency, units are kHz */
+	struct rt_ndis_802_11_configuration_fh FHConfig;
+};
+
+struct rt_ndis_802_11_statistics {
+	unsigned long Length;		/* Length of structure */
+	LARGE_INTEGER TransmittedFragmentCount;
+	LARGE_INTEGER MulticastTransmittedFrameCount;
+	LARGE_INTEGER FailedCount;
+	LARGE_INTEGER RetryCount;
+	LARGE_INTEGER MultipleRetryCount;
+	LARGE_INTEGER RTSSuccessCount;
+	LARGE_INTEGER RTSFailureCount;
+	LARGE_INTEGER ACKFailureCount;
+	LARGE_INTEGER FrameDuplicateCount;
+	LARGE_INTEGER ReceivedFragmentCount;
+	LARGE_INTEGER MulticastReceivedFrameCount;
+	LARGE_INTEGER FCSErrorCount;
+	LARGE_INTEGER TKIPLocalMICFailures;
+	LARGE_INTEGER TKIPRemoteMICErrors;
+	LARGE_INTEGER TKIPICVErrors;
+	LARGE_INTEGER TKIPCounterMeasuresInvoked;
+	LARGE_INTEGER TKIPReplays;
+	LARGE_INTEGER CCMPFormatErrors;
+	LARGE_INTEGER CCMPReplays;
+	LARGE_INTEGER CCMPDecryptErrors;
+	LARGE_INTEGER FourWayHandshakeFailures;
+};
+
+typedef unsigned long NDIS_802_11_KEY_INDEX;
+typedef unsigned long long NDIS_802_11_KEY_RSC;
+
+#define MAX_RADIUS_SRV_NUM			2	/* 802.1x failover number */
+
+struct PACKED rt_radius_srv_info {
+	u32 radius_ip;
+	u32 radius_port;
+	u8 radius_key[64];
+	u8 radius_key_len;
+};
+
+struct PACKED rt_radius_key_info {
+	u8 radius_srv_num;
+	struct rt_radius_srv_info radius_srv_info[MAX_RADIUS_SRV_NUM];
+	u8 ieee8021xWEP;	/* dynamic WEP */
+	u8 key_index;
+	u8 key_length;	/* length of key in bytes */
+	u8 key_material[13];
+};
+
+/* It's used by 802.1x daemon to require relative configuration */
+struct PACKED rt_radius_conf {
+	u32 Length;		/* Length of this structure */
+	u8 mbss_num;		/* indicate multiple BSS number */
+	u32 own_ip_addr;
+	u32 retry_interval;
+	u32 session_timeout_interval;
+	u8 EAPifname[8][IFNAMSIZ];
+	u8 EAPifname_len[8];
+	u8 PreAuthifname[8][IFNAMSIZ];
+	u8 PreAuthifname_len[8];
+	struct rt_radius_key_info RadiusInfo[8];
+};
+
+/* Key mapping keys require a BSSID */
+struct rt_ndis_802_11_key {
+	u32 Length;		/* Length of this structure */
+	u32 KeyIndex;
+	u32 KeyLength;		/* length of key in bytes */
+	NDIS_802_11_MAC_ADDRESS BSSID;
+	NDIS_802_11_KEY_RSC KeyRSC;
+	u8 KeyMaterial[1];	/* variable length depending on above field */
+};
+
+struct rt_ndis_802_11_passphrase {
+	u32 KeyLength;		/* length of key in bytes */
+	NDIS_802_11_MAC_ADDRESS BSSID;
+	u8 KeyMaterial[1];	/* variable length depending on above field */
+};
+
+struct rt_ndis_802_11_remove_key {
+	u32 Length;		/* Length of this structure */
+	u32 KeyIndex;
+	NDIS_802_11_MAC_ADDRESS BSSID;
+};
+
+struct rt_ndis_802_11_wep {
+	u32 Length;		/* Length of this structure */
+	u32 KeyIndex;		/* 0 is the per-client key, 1-N are the */
+	/* global keys */
+	u32 KeyLength;		/* length of key in bytes */
+	u8 KeyMaterial[1];	/* variable length depending on above field */
+};
+
+typedef enum _NDIS_802_11_NETWORK_INFRASTRUCTURE {
+	Ndis802_11IBSS,
+	Ndis802_11Infrastructure,
+	Ndis802_11AutoUnknown,
+	Ndis802_11Monitor,
+	Ndis802_11InfrastructureMax	/* Not a real value, defined as upper bound */
 } NDIS_802_11_NETWORK_INFRASTRUCTURE, *PNDIS_802_11_NETWORK_INFRASTRUCTURE;
 
-// Add new authentication modes
-typedef enum _NDIS_802_11_AUTHENTICATION_MODE
-{
-   Ndis802_11AuthModeOpen,
-   Ndis802_11AuthModeShared,
-   Ndis802_11AuthModeAutoSwitch,
-    Ndis802_11AuthModeWPA,
-    Ndis802_11AuthModeWPAPSK,
-    Ndis802_11AuthModeWPANone,
-   Ndis802_11AuthModeWPA2,
-   Ndis802_11AuthModeWPA2PSK,
-   	Ndis802_11AuthModeWPA1WPA2,
+/* Add new authentication modes */
+typedef enum _NDIS_802_11_AUTHENTICATION_MODE {
+	Ndis802_11AuthModeOpen,
+	Ndis802_11AuthModeShared,
+	Ndis802_11AuthModeAutoSwitch,
+	Ndis802_11AuthModeWPA,
+	Ndis802_11AuthModeWPAPSK,
+	Ndis802_11AuthModeWPANone,
+	Ndis802_11AuthModeWPA2,
+	Ndis802_11AuthModeWPA2PSK,
+	Ndis802_11AuthModeWPA1WPA2,
 	Ndis802_11AuthModeWPA1PSKWPA2PSK,
-   Ndis802_11AuthModeMax           // Not a real mode, defined as upper bound
+	Ndis802_11AuthModeMax	/* Not a real mode, defined as upper bound */
 } NDIS_802_11_AUTHENTICATION_MODE, *PNDIS_802_11_AUTHENTICATION_MODE;
 
-typedef UCHAR   NDIS_802_11_RATES[NDIS_802_11_LENGTH_RATES];        // Set of 8 data rates
-typedef UCHAR   NDIS_802_11_RATES_EX[NDIS_802_11_LENGTH_RATES_EX];  // Set of 16 data rates
-
-typedef struct PACKED _NDIS_802_11_SSID
-{
-    UINT   SsidLength;         // length of SSID field below, in bytes;
-                                // this can be zero.
-    UCHAR   Ssid[NDIS_802_11_LENGTH_SSID];           // SSID information field
-} NDIS_802_11_SSID, *PNDIS_802_11_SSID;
-
-
-typedef struct PACKED _NDIS_WLAN_BSSID
-{
-   ULONG                               Length;     // Length of this structure
-   NDIS_802_11_MAC_ADDRESS             MacAddress; // BSSID
-   UCHAR                               Reserved[2];
-   NDIS_802_11_SSID                    Ssid;       // SSID
-   ULONG                               Privacy;    // WEP encryption requirement
-   NDIS_802_11_RSSI                    Rssi;       // receive signal strength in dBm
-   NDIS_802_11_NETWORK_TYPE            NetworkTypeInUse;
-   NDIS_802_11_CONFIGURATION           Configuration;
-   NDIS_802_11_NETWORK_INFRASTRUCTURE  InfrastructureMode;
-   NDIS_802_11_RATES                   SupportedRates;
-} NDIS_WLAN_BSSID, *PNDIS_WLAN_BSSID;
-
-typedef struct PACKED _NDIS_802_11_BSSID_LIST
-{
-   UINT           NumberOfItems;      // in list below, at least 1
-   NDIS_WLAN_BSSID Bssid[1];
-} NDIS_802_11_BSSID_LIST, *PNDIS_802_11_BSSID_LIST;
-
-// Added Capabilities, IELength and IEs for each BSSID
-typedef struct PACKED _NDIS_WLAN_BSSID_EX
-{
-    ULONG                               Length;             // Length of this structure
-    NDIS_802_11_MAC_ADDRESS             MacAddress;         // BSSID
-    UCHAR                               Reserved[2];
-    NDIS_802_11_SSID                    Ssid;               // SSID
-    UINT                                Privacy;            // WEP encryption requirement
-    NDIS_802_11_RSSI                    Rssi;               // receive signal
-                                                            // strength in dBm
-    NDIS_802_11_NETWORK_TYPE            NetworkTypeInUse;
-    NDIS_802_11_CONFIGURATION           Configuration;
-    NDIS_802_11_NETWORK_INFRASTRUCTURE  InfrastructureMode;
-    NDIS_802_11_RATES_EX                SupportedRates;
-    ULONG                               IELength;
-    UCHAR                               IEs[1];
-} NDIS_WLAN_BSSID_EX, *PNDIS_WLAN_BSSID_EX;
-
-typedef struct PACKED _NDIS_802_11_BSSID_LIST_EX
-{
-    UINT                   NumberOfItems;      // in list below, at least 1
-    NDIS_WLAN_BSSID_EX      Bssid[1];
-} NDIS_802_11_BSSID_LIST_EX, *PNDIS_802_11_BSSID_LIST_EX;
-
-typedef struct PACKED _NDIS_802_11_FIXED_IEs
-{
-    UCHAR Timestamp[8];
-    USHORT BeaconInterval;
-    USHORT Capabilities;
-} NDIS_802_11_FIXED_IEs, *PNDIS_802_11_FIXED_IEs;
-
-typedef struct _NDIS_802_11_VARIABLE_IEs
-{
-    UCHAR ElementID;
-    UCHAR Length;    // Number of bytes in data field
-    UCHAR data[1];
-} NDIS_802_11_VARIABLE_IEs, *PNDIS_802_11_VARIABLE_IEs;
-
-typedef  ULONG   NDIS_802_11_FRAGMENTATION_THRESHOLD;
-
-typedef  ULONG   NDIS_802_11_RTS_THRESHOLD;
-
-typedef  ULONG   NDIS_802_11_ANTENNA;
-
-typedef enum _NDIS_802_11_PRIVACY_FILTER
-{
-   Ndis802_11PrivFilterAcceptAll,
-   Ndis802_11PrivFilter8021xWEP
+typedef u8 NDIS_802_11_RATES[NDIS_802_11_LENGTH_RATES];	/* Set of 8 data rates */
+typedef u8 NDIS_802_11_RATES_EX[NDIS_802_11_LENGTH_RATES_EX];	/* Set of 16 data rates */
+
+struct PACKED rt_ndis_802_11_ssid {
+	u32 SsidLength;	/* length of SSID field below, in bytes; */
+	/* this can be zero. */
+	u8 Ssid[NDIS_802_11_LENGTH_SSID];	/* SSID information field */
+};
+
+struct PACKED rt_ndis_wlan_bssid {
+	unsigned long Length;		/* Length of this structure */
+	NDIS_802_11_MAC_ADDRESS MacAddress;	/* BSSID */
+	u8 Reserved[2];
+	struct rt_ndis_802_11_ssid Ssid;	/* SSID */
+	unsigned long Privacy;		/* WEP encryption requirement */
+	NDIS_802_11_RSSI Rssi;	/* receive signal strength in dBm */
+	NDIS_802_11_NETWORK_TYPE NetworkTypeInUse;
+	struct rt_ndis_802_11_configuration Configuration;
+	NDIS_802_11_NETWORK_INFRASTRUCTURE InfrastructureMode;
+	NDIS_802_11_RATES SupportedRates;
+};
+
+struct PACKED rt_ndis_802_11_bssid_list {
+	u32 NumberOfItems;	/* in list below, at least 1 */
+	struct rt_ndis_wlan_bssid Bssid[1];
+};
+
+/* Added Capabilities, IELength and IEs for each BSSID */
+struct PACKED rt_ndis_wlan_bssid_ex {
+	unsigned long Length;		/* Length of this structure */
+	NDIS_802_11_MAC_ADDRESS MacAddress;	/* BSSID */
+	u8 Reserved[2];
+	struct rt_ndis_802_11_ssid Ssid;	/* SSID */
+	u32 Privacy;		/* WEP encryption requirement */
+	NDIS_802_11_RSSI Rssi;	/* receive signal */
+	/* strength in dBm */
+	NDIS_802_11_NETWORK_TYPE NetworkTypeInUse;
+	struct rt_ndis_802_11_configuration Configuration;
+	NDIS_802_11_NETWORK_INFRASTRUCTURE InfrastructureMode;
+	NDIS_802_11_RATES_EX SupportedRates;
+	unsigned long IELength;
+	u8 IEs[1];
+};
+
+struct PACKED rt_ndis_802_11_bssid_list_ex {
+	u32 NumberOfItems;	/* in list below, at least 1 */
+	struct rt_ndis_wlan_bssid_ex Bssid[1];
+};
+
+struct PACKED rt_ndis_802_11_fixed_ies {
+	u8 Timestamp[8];
+	u16 BeaconInterval;
+	u16 Capabilities;
+};
+
+struct rt_ndis_802_11_variable_ies {
+	u8 ElementID;
+	u8 Length;		/* Number of bytes in data field */
+	u8 data[1];
+};
+
+typedef unsigned long NDIS_802_11_FRAGMENTATION_THRESHOLD;
+
+typedef unsigned long NDIS_802_11_RTS_THRESHOLD;
+
+typedef unsigned long NDIS_802_11_ANTENNA;
+
+typedef enum _NDIS_802_11_PRIVACY_FILTER {
+	Ndis802_11PrivFilterAcceptAll,
+	Ndis802_11PrivFilter8021xWEP
 } NDIS_802_11_PRIVACY_FILTER, *PNDIS_802_11_PRIVACY_FILTER;
 
-// Added new encryption types
-// Also aliased typedef to new name
-typedef enum _NDIS_802_11_WEP_STATUS
-{
-   Ndis802_11WEPEnabled,
-    Ndis802_11Encryption1Enabled = Ndis802_11WEPEnabled,
-   Ndis802_11WEPDisabled,
-    Ndis802_11EncryptionDisabled = Ndis802_11WEPDisabled,
-   Ndis802_11WEPKeyAbsent,
-    Ndis802_11Encryption1KeyAbsent = Ndis802_11WEPKeyAbsent,
-   Ndis802_11WEPNotSupported,
-    Ndis802_11EncryptionNotSupported = Ndis802_11WEPNotSupported,
-    Ndis802_11Encryption2Enabled,
-    Ndis802_11Encryption2KeyAbsent,
-    Ndis802_11Encryption3Enabled,
-    Ndis802_11Encryption3KeyAbsent,
-    Ndis802_11Encryption4Enabled,	// TKIP or AES mix
-    Ndis802_11Encryption4KeyAbsent,
-    Ndis802_11GroupWEP40Enabled,
+/* Added new encryption types */
+/* Also aliased typedef to new name */
+typedef enum _NDIS_802_11_WEP_STATUS {
+	Ndis802_11WEPEnabled,
+	Ndis802_11Encryption1Enabled = Ndis802_11WEPEnabled,
+	Ndis802_11WEPDisabled,
+	Ndis802_11EncryptionDisabled = Ndis802_11WEPDisabled,
+	Ndis802_11WEPKeyAbsent,
+	Ndis802_11Encryption1KeyAbsent = Ndis802_11WEPKeyAbsent,
+	Ndis802_11WEPNotSupported,
+	Ndis802_11EncryptionNotSupported = Ndis802_11WEPNotSupported,
+	Ndis802_11Encryption2Enabled,
+	Ndis802_11Encryption2KeyAbsent,
+	Ndis802_11Encryption3Enabled,
+	Ndis802_11Encryption3KeyAbsent,
+	Ndis802_11Encryption4Enabled,	/* TKIP or AES mix */
+	Ndis802_11Encryption4KeyAbsent,
+	Ndis802_11GroupWEP40Enabled,
 	Ndis802_11GroupWEP104Enabled,
 } NDIS_802_11_WEP_STATUS, *PNDIS_802_11_WEP_STATUS,
-  NDIS_802_11_ENCRYPTION_STATUS, *PNDIS_802_11_ENCRYPTION_STATUS;
+    NDIS_802_11_ENCRYPTION_STATUS, *PNDIS_802_11_ENCRYPTION_STATUS;
 
-typedef enum _NDIS_802_11_RELOAD_DEFAULTS
-{
-   Ndis802_11ReloadWEPKeys
+typedef enum _NDIS_802_11_RELOAD_DEFAULTS {
+	Ndis802_11ReloadWEPKeys
 } NDIS_802_11_RELOAD_DEFAULTS, *PNDIS_802_11_RELOAD_DEFAULTS;
 
 #define NDIS_802_11_AI_REQFI_CAPABILITIES      1
@@ -448,351 +436,343 @@ typedef enum _NDIS_802_11_RELOAD_DEFAULTS
 #define NDIS_802_11_AI_RESFI_STATUSCODE        2
 #define NDIS_802_11_AI_RESFI_ASSOCIATIONID     4
 
-typedef struct _NDIS_802_11_AI_REQFI
-{
-    USHORT Capabilities;
-    USHORT ListenInterval;
-    NDIS_802_11_MAC_ADDRESS  CurrentAPAddress;
-} NDIS_802_11_AI_REQFI, *PNDIS_802_11_AI_REQFI;
-
-typedef struct _NDIS_802_11_AI_RESFI
-{
-    USHORT Capabilities;
-    USHORT StatusCode;
-    USHORT AssociationId;
-} NDIS_802_11_AI_RESFI, *PNDIS_802_11_AI_RESFI;
-
-typedef struct _NDIS_802_11_ASSOCIATION_INFORMATION
-{
-    ULONG                   Length;
-    USHORT                  AvailableRequestFixedIEs;
-    NDIS_802_11_AI_REQFI    RequestFixedIEs;
-    ULONG                   RequestIELength;
-    ULONG                   OffsetRequestIEs;
-    USHORT                  AvailableResponseFixedIEs;
-    NDIS_802_11_AI_RESFI    ResponseFixedIEs;
-    ULONG                   ResponseIELength;
-    ULONG                   OffsetResponseIEs;
-} NDIS_802_11_ASSOCIATION_INFORMATION, *PNDIS_802_11_ASSOCIATION_INFORMATION;
-
-typedef struct _NDIS_802_11_AUTHENTICATION_EVENT
-{
-    NDIS_802_11_STATUS_INDICATION       Status;
-    NDIS_802_11_AUTHENTICATION_REQUEST  Request[1];
-} NDIS_802_11_AUTHENTICATION_EVENT, *PNDIS_802_11_AUTHENTICATION_EVENT;
-
-// 802.11 Media stream constraints, associated with OID_802_11_MEDIA_STREAM_MODE
-typedef enum _NDIS_802_11_MEDIA_STREAM_MODE
-{
-    Ndis802_11MediaStreamOff,
-    Ndis802_11MediaStreamOn,
+struct rt_ndis_802_11_ai_reqfi {
+	u16 Capabilities;
+	u16 ListenInterval;
+	NDIS_802_11_MAC_ADDRESS CurrentAPAddress;
+};
+
+struct rt_ndis_802_11_ai_resfi {
+	u16 Capabilities;
+	u16 StatusCode;
+	u16 AssociationId;
+};
+
+struct rt_ndis_802_11_association_information {
+	unsigned long Length;
+	u16 AvailableRequestFixedIEs;
+	struct rt_ndis_802_11_ai_reqfi RequestFixedIEs;
+	unsigned long RequestIELength;
+	unsigned long OffsetRequestIEs;
+	u16 AvailableResponseFixedIEs;
+	struct rt_ndis_802_11_ai_resfi ResponseFixedIEs;
+	unsigned long ResponseIELength;
+	unsigned long OffsetResponseIEs;
+};
+
+struct rt_ndis_802_11_authentication_event {
+	struct rt_ndis_802_11_status_indication Status;
+	struct rt_ndis_802_11_authentication_request Request[1];
+};
+
+/* 802.11 Media stream constraints, associated with OID_802_11_MEDIA_STREAM_MODE */
+typedef enum _NDIS_802_11_MEDIA_STREAM_MODE {
+	Ndis802_11MediaStreamOff,
+	Ndis802_11MediaStreamOn,
 } NDIS_802_11_MEDIA_STREAM_MODE, *PNDIS_802_11_MEDIA_STREAM_MODE;
 
-// PMKID Structures
-typedef UCHAR   NDIS_802_11_PMKID_VALUE[16];
-
-typedef struct _BSSID_INFO
-{
-    NDIS_802_11_MAC_ADDRESS BSSID;
-    NDIS_802_11_PMKID_VALUE PMKID;
-} BSSID_INFO, *PBSSID_INFO;
-
-typedef struct _NDIS_802_11_PMKID
-{
-    UINT    Length;
-    UINT    BSSIDInfoCount;
-    BSSID_INFO BSSIDInfo[1];
-} NDIS_802_11_PMKID, *PNDIS_802_11_PMKID;
-
-typedef struct _NDIS_802_11_AUTHENTICATION_ENCRYPTION
-{
-    NDIS_802_11_AUTHENTICATION_MODE AuthModeSupported;
-    NDIS_802_11_ENCRYPTION_STATUS EncryptStatusSupported;
-} NDIS_802_11_AUTHENTICATION_ENCRYPTION, *PNDIS_802_11_AUTHENTICATION_ENCRYPTION;
-
-typedef struct _NDIS_802_11_CAPABILITY
-{
-     ULONG Length;
-     ULONG Version;
-     ULONG NoOfPMKIDs;
-     ULONG NoOfAuthEncryptPairsSupported;
-     NDIS_802_11_AUTHENTICATION_ENCRYPTION AuthenticationEncryptionSupported[1];
-} NDIS_802_11_CAPABILITY, *PNDIS_802_11_CAPABILITY;
-
-#define RT_PRIV_IOCTL_EXT							(SIOCIWFIRSTPRIV + 0x01) // Sync. with AP for wsc upnp daemon
+/* PMKID Structures */
+typedef u8 NDIS_802_11_PMKID_VALUE[16];
+
+struct rt_bssid_info {
+	NDIS_802_11_MAC_ADDRESS BSSID;
+	NDIS_802_11_PMKID_VALUE PMKID;
+};
+
+struct rt_ndis_802_11_pmkid {
+	u32 Length;
+	u32 BSSIDInfoCount;
+	struct rt_bssid_info BSSIDInfo[1];
+};
+
+struct rt_ndis_802_11_authentication_encryption {
+	NDIS_802_11_AUTHENTICATION_MODE AuthModeSupported;
+	NDIS_802_11_ENCRYPTION_STATUS EncryptStatusSupported;
+};
+
+struct rt_ndis_802_11_capability {
+	unsigned long Length;
+	unsigned long Version;
+	unsigned long NoOfPMKIDs;
+	unsigned long NoOfAuthEncryptPairsSupported;
+	struct rt_ndis_802_11_authentication_encryption
+	    AuthenticationEncryptionSupported[1];
+};
+
+#define RT_PRIV_IOCTL							(SIOCIWFIRSTPRIV + 0x01)	/* Sync. with AP for wsc upnp daemon */
 #define RTPRIV_IOCTL_SET							(SIOCIWFIRSTPRIV + 0x02)
 
 #define RTPRIV_IOCTL_STATISTICS                     (SIOCIWFIRSTPRIV + 0x09)
 #define RTPRIV_IOCTL_ADD_PMKID_CACHE                (SIOCIWFIRSTPRIV + 0x0A)
 #define RTPRIV_IOCTL_RADIUS_DATA                    (SIOCIWFIRSTPRIV + 0x0C)
 #define RTPRIV_IOCTL_GSITESURVEY					(SIOCIWFIRSTPRIV + 0x0D)
-#define RT_PRIV_IOCTL								(SIOCIWFIRSTPRIV + 0x0E) // Sync. with RT61 (for wpa_supplicant)
+#define RT_PRIV_IOCTL_EXT							(SIOCIWFIRSTPRIV + 0x0E)	/* Sync. with RT61 (for wpa_supplicant) */
 #define RTPRIV_IOCTL_GET_MAC_TABLE					(SIOCIWFIRSTPRIV + 0x0F)
 
 #define RTPRIV_IOCTL_SHOW							(SIOCIWFIRSTPRIV + 0x11)
 enum {
-    SHOW_CONN_STATUS = 4,
-    SHOW_DRVIER_VERION = 5,
-    SHOW_BA_INFO = 6,
+	SHOW_CONN_STATUS = 4,
+	SHOW_DRVIER_VERION = 5,
+	SHOW_BA_INFO = 6,
 	SHOW_DESC_INFO = 7,
-#ifdef RT2870
+#ifdef RTMP_MAC_USB
 	SHOW_RXBULK_INFO = 8,
 	SHOW_TXBULK_INFO = 9,
-#endif // RT2870 //
-    RAIO_OFF = 10,
-    RAIO_ON = 11,
+#endif /* RTMP_MAC_USB // */
+	RAIO_OFF = 10,
+	RAIO_ON = 11,
 	SHOW_CFG_VALUE = 20,
-#if !defined(RT2860)
 	SHOW_ADHOC_ENTRY_INFO = 21,
-#endif
 };
 
-#ifdef LLTD_SUPPORT
-// for consistency with RT61
-#define RT_OID_GET_PHY_MODE                         0x761
-#endif // LLTD_SUPPORT //
-
-#if defined(RT2860) || defined(RT30xx)
-// New for MeetingHouse Api support
+#define OID_802_11_BUILD_CHANNEL_EX				0x0714
+#define OID_802_11_GET_CH_LIST					0x0715
+#define OID_802_11_GET_COUNTRY_CODE				0x0716
+#define OID_802_11_GET_CHANNEL_GEOGRAPHY		0x0717
+
+#define RT_OID_WSC_SET_PASSPHRASE                   0x0740	/* passphrase for wpa(2)-psk */
+#define RT_OID_WSC_DRIVER_AUTO_CONNECT              0x0741
+#define RT_OID_WSC_QUERY_DEFAULT_PROFILE            0x0742
+#define RT_OID_WSC_SET_CONN_BY_PROFILE_INDEX        0x0743
+#define RT_OID_WSC_SET_ACTION                       0x0744
+#define RT_OID_WSC_SET_SSID                         0x0745
+#define RT_OID_WSC_SET_PIN_CODE                     0x0746
+#define RT_OID_WSC_SET_MODE                         0x0747	/* PIN or PBC */
+#define RT_OID_WSC_SET_CONF_MODE                    0x0748	/* Enrollee or Registrar */
+#define RT_OID_WSC_SET_PROFILE                      0x0749
+#define	RT_OID_WSC_CONFIG_STATUS					0x074F
+#define RT_OID_802_11_WSC_QUERY_PROFILE				0x0750
+/* for consistency with RT61 */
+#define RT_OID_WSC_QUERY_STATUS						0x0751
+#define RT_OID_WSC_PIN_CODE							0x0752
+#define RT_OID_WSC_UUID								0x0753
+#define RT_OID_WSC_SET_SELECTED_REGISTRAR			0x0754
+#define RT_OID_WSC_EAPMSG							0x0755
+#define RT_OID_WSC_MANUFACTURER						0x0756
+#define RT_OID_WSC_MODEL_NAME						0x0757
+#define RT_OID_WSC_MODEL_NO							0x0758
+#define RT_OID_WSC_SERIAL_NO						0x0759
+#define RT_OID_WSC_MAC_ADDRESS						0x0760
+
+/* New for MeetingHouse Api support */
 #define OID_MH_802_1X_SUPPORTED               0xFFEDC100
-#endif
 
-// MIMO Tx parameter, ShortGI, MCS, STBC, etc.  these are fields in TXWI. Don't change this definition!!!
-typedef union  _HTTRANSMIT_SETTING {
-	struct	{
-	USHORT   	MCS:7;                 // MCS
-	USHORT		BW:1;	//channel bandwidth 20MHz or 40 MHz
-	USHORT		ShortGI:1;
-	USHORT		STBC:2;	//SPACE
-	USHORT		rsv:2;
-	USHORT		TxBF:1;
-	USHORT		MODE:2;	// Use definition MODE_xxx.
-	}	field;
-	USHORT		word;
- } HTTRANSMIT_SETTING, *PHTTRANSMIT_SETTING;
+/* MIMO Tx parameter, ShortGI, MCS, STBC, etc.  these are fields in TXWI. Don't change this definition! */
+typedef union _HTTRANSMIT_SETTING {
+	struct {
+		u16 MCS:7;	/* MCS */
+		u16 BW:1;	/*channel bandwidth 20MHz or 40 MHz */
+		u16 ShortGI:1;
+		u16 STBC:2;	/*SPACE */
+/*      u16          rsv:3; */
+		u16 rsv:2;
+		u16 TxBF:1;
+		u16 MODE:2;	/* Use definition MODE_xxx. */
+	} field;
+	u16 word;
+} HTTRANSMIT_SETTING, *PHTTRANSMIT_SETTING;
 
 typedef enum _RT_802_11_PREAMBLE {
-    Rt802_11PreambleLong,
-    Rt802_11PreambleShort,
-    Rt802_11PreambleAuto
+	Rt802_11PreambleLong,
+	Rt802_11PreambleShort,
+	Rt802_11PreambleAuto
 } RT_802_11_PREAMBLE, *PRT_802_11_PREAMBLE;
 
-// Only for STA, need to sync with AP
 typedef enum _RT_802_11_PHY_MODE {
 	PHY_11BG_MIXED = 0,
 	PHY_11B,
 	PHY_11A,
 	PHY_11ABG_MIXED,
 	PHY_11G,
-	PHY_11ABGN_MIXED,	// both band   5
-	PHY_11N_2_4G,		// 11n-only with 2.4G band   	6
-	PHY_11GN_MIXED,	// 2.4G band      7
-	PHY_11AN_MIXED,	// 5G  band       8
-	PHY_11BGN_MIXED,	// if check 802.11b.      9
-	PHY_11AGN_MIXED,	// if check 802.11b.      10
-	PHY_11N_5G,			// 11n-only with 5G band		11
+	PHY_11ABGN_MIXED,	/* both band   5 */
+	PHY_11N_2_4G,		/* 11n-only with 2.4G band      6 */
+	PHY_11GN_MIXED,		/* 2.4G band      7 */
+	PHY_11AN_MIXED,		/* 5G  band       8 */
+	PHY_11BGN_MIXED,	/* if check 802.11b.      9 */
+	PHY_11AGN_MIXED,	/* if check 802.11b.      10 */
+	PHY_11N_5G,		/* 11n-only with 5G band                11 */
 } RT_802_11_PHY_MODE;
 
-// put all proprietery for-query objects here to reduce # of Query_OID
-typedef struct _RT_802_11_LINK_STATUS {
-    ULONG   CurrTxRate;         // in units of 0.5Mbps
-    ULONG   ChannelQuality;     // 0..100 %
-    ULONG   TxByteCount;        // both ok and fail
-    ULONG   RxByteCount;        // both ok and fail
-    ULONG	CentralChannel;		// 40MHz central channel number
-} RT_802_11_LINK_STATUS, *PRT_802_11_LINK_STATUS;
-
-typedef struct _RT_802_11_EVENT_LOG {
-    LARGE_INTEGER   SystemTime;  // timestammp via NdisGetCurrentSystemTime()
-    UCHAR           Addr[MAC_ADDR_LENGTH];
-    USHORT          Event;       // EVENT_xxx
-} RT_802_11_EVENT_LOG, *PRT_802_11_EVENT_LOG;
-
-typedef struct _RT_802_11_EVENT_TABLE {
-    ULONG       Num;
-    ULONG       Rsv;     // to align Log[] at LARGE_INEGER boundary
-    RT_802_11_EVENT_LOG   Log[MAX_NUMBER_OF_EVENT];
-} RT_802_11_EVENT_TABLE, PRT_802_11_EVENT_TABLE;
-
-// MIMO Tx parameter, ShortGI, MCS, STBC, etc.  these are fields in TXWI. Don't change this definition!!!
-typedef union  _MACHTTRANSMIT_SETTING {
-	struct	{
-	USHORT   	MCS:7;                 // MCS
-	USHORT		BW:1;	//channel bandwidth 20MHz or 40 MHz
-	USHORT		ShortGI:1;
-	USHORT		STBC:2;	//SPACE
-	USHORT		rsv:3;
-	USHORT		MODE:2;	// Use definition MODE_xxx.
-	}	field;
-	USHORT		word;
- } MACHTTRANSMIT_SETTING, *PMACHTTRANSMIT_SETTING;
-
-typedef struct _RT_802_11_MAC_ENTRY {
-    UCHAR       Addr[MAC_ADDR_LENGTH];
-    UCHAR       Aid;
-    UCHAR       Psm;     // 0:PWR_ACTIVE, 1:PWR_SAVE
-    UCHAR		MimoPs;  // 0:MMPS_STATIC, 1:MMPS_DYNAMIC, 3:MMPS_Enabled
-    CHAR		AvgRssi0;
-	CHAR		AvgRssi1;
-	CHAR		AvgRssi2;
-	UINT32		ConnectedTime;
-    MACHTTRANSMIT_SETTING	TxRate;
-} RT_802_11_MAC_ENTRY, *PRT_802_11_MAC_ENTRY;
-
-typedef struct _RT_802_11_MAC_TABLE {
-    ULONG       Num;
-    RT_802_11_MAC_ENTRY Entry[MAX_NUMBER_OF_MAC];
-} RT_802_11_MAC_TABLE, *PRT_802_11_MAC_TABLE;
-
-// structure for query/set hardware register - MAC, BBP, RF register
-typedef struct _RT_802_11_HARDWARE_REGISTER {
-    ULONG   HardwareType;       // 0:MAC, 1:BBP, 2:RF register, 3:EEPROM
-    ULONG   Offset;             // Q/S register offset addr
-    ULONG   Data;               // R/W data buffer
-} RT_802_11_HARDWARE_REGISTER, *PRT_802_11_HARDWARE_REGISTER;
-
-typedef struct _RT_802_11_AP_CONFIG {
-    ULONG   EnableTxBurst;      // 0-disable, 1-enable
-    ULONG   EnableTurboRate;    // 0-disable, 1-enable 72/100mbps turbo rate
-    ULONG   IsolateInterStaTraffic;     // 0-disable, 1-enable isolation
-    ULONG   HideSsid;           // 0-disable, 1-enable hiding
-    ULONG   UseBGProtection;    // 0-AUTO, 1-always ON, 2-always OFF
-    ULONG   UseShortSlotTime;   // 0-no use, 1-use 9-us short slot time
-    ULONG   Rsv1;               // must be 0
-    ULONG   SystemErrorBitmap;  // ignore upon SET, return system error upon QUERY
-} RT_802_11_AP_CONFIG, *PRT_802_11_AP_CONFIG;
-
-// structure to query/set STA_CONFIG
-typedef struct _RT_802_11_STA_CONFIG {
-    ULONG   EnableTxBurst;      // 0-disable, 1-enable
-    ULONG   EnableTurboRate;    // 0-disable, 1-enable 72/100mbps turbo rate
-    ULONG   UseBGProtection;    // 0-AUTO, 1-always ON, 2-always OFF
-    ULONG   UseShortSlotTime;   // 0-no use, 1-use 9-us short slot time when applicable
-    ULONG   AdhocMode; 			// 0-11b rates only (WIFI spec), 1 - b/g mixed, 2 - g only
-    ULONG   HwRadioStatus;      // 0-OFF, 1-ON, default is 1, Read-Only
-    ULONG   Rsv1;               // must be 0
-    ULONG   SystemErrorBitmap;  // ignore upon SET, return system error upon QUERY
-} RT_802_11_STA_CONFIG, *PRT_802_11_STA_CONFIG;
-
-//
-//  For OID Query or Set about BA structure
-//
-typedef	struct	_OID_BACAP_STRUC	{
-		UCHAR		RxBAWinLimit;
-		UCHAR		TxBAWinLimit;
-		UCHAR		Policy;	// 0: DELAY_BA 1:IMMED_BA  (//BA Policy subfiled value in ADDBA frame)   2:BA-not use. other value invalid
-		UCHAR		MpduDensity;	// 0: DELAY_BA 1:IMMED_BA  (//BA Policy subfiled value in ADDBA frame)   2:BA-not use. other value invalid
-		UCHAR       	AmsduEnable;	//Enable AMSDU transmisstion
-		UCHAR       	AmsduSize;	// 0:3839, 1:7935 bytes. UINT  MSDUSizeToBytes[]	= { 3839, 7935};
-		UCHAR       	MMPSmode;	// MIMO power save more, 0:static, 1:dynamic, 2:rsv, 3:mimo enable
-		BOOLEAN		AutoBA;	// Auto BA will automatically
-} OID_BACAP_STRUC, *POID_BACAP_STRUC;
-
-typedef struct _RT_802_11_ACL_ENTRY {
-    UCHAR   Addr[MAC_ADDR_LENGTH];
-    USHORT  Rsv;
-} RT_802_11_ACL_ENTRY, *PRT_802_11_ACL_ENTRY;
-
-typedef struct PACKED _RT_802_11_ACL {
-    ULONG   Policy;             // 0-disable, 1-positive list, 2-negative list
-    ULONG   Num;
-    RT_802_11_ACL_ENTRY Entry[MAX_NUMBER_OF_ACL];
-} RT_802_11_ACL, *PRT_802_11_ACL;
-
-typedef struct _RT_802_11_WDS {
-    ULONG						Num;
-    NDIS_802_11_MAC_ADDRESS		Entry[24/*MAX_NUM_OF_WDS_LINK*/];
-	ULONG						KeyLength;
-	UCHAR						KeyMaterial[32];
-} RT_802_11_WDS, *PRT_802_11_WDS;
-
-typedef struct _RT_802_11_TX_RATES_ {
-    UCHAR       SupRateLen;
-    UCHAR       SupRate[MAX_LENGTH_OF_SUPPORT_RATES];
-    UCHAR       ExtRateLen;
-    UCHAR       ExtRate[MAX_LENGTH_OF_SUPPORT_RATES];
-} RT_802_11_TX_RATES, *PRT_802_11_TX_RATES;
-
-
-// Definition of extra information code
-#define	GENERAL_LINK_UP			0x0			// Link is Up
-#define	GENERAL_LINK_DOWN		0x1			// Link is Down
-#define	HW_RADIO_OFF			0x2			// Hardware radio off
-#define	SW_RADIO_OFF			0x3			// Software radio off
-#define	AUTH_FAIL				0x4			// Open authentication fail
-#define	AUTH_FAIL_KEYS			0x5			// Shared authentication fail
-#define	ASSOC_FAIL				0x6			// Association failed
-#define	EAP_MIC_FAILURE			0x7			// Deauthencation because MIC failure
-#define	EAP_4WAY_TIMEOUT		0x8			// Deauthencation on 4-way handshake timeout
-#define	EAP_GROUP_KEY_TIMEOUT	0x9			// Deauthencation on group key handshake timeout
-#define	EAP_SUCCESS				0xa			// EAP succeed
-#define	DETECT_RADAR_SIGNAL		0xb         // Radar signal occur in current channel
-#define EXTRA_INFO_MAX			0xb			// Indicate Last OID
+/* put all proprietery for-query objects here to reduce # of Query_OID */
+struct rt_802_11_link_status {
+	unsigned long CurrTxRate;	/* in units of 0.5Mbps */
+	unsigned long ChannelQuality;	/* 0..100 % */
+	unsigned long TxByteCount;	/* both ok and fail */
+	unsigned long RxByteCount;	/* both ok and fail */
+	unsigned long CentralChannel;	/* 40MHz central channel number */
+};
+
+struct rt_802_11_event_log {
+	LARGE_INTEGER SystemTime;	/* timestammp via NdisGetCurrentSystemTime() */
+	u8 Addr[MAC_ADDR_LENGTH];
+	u16 Event;		/* EVENT_xxx */
+};
+
+struct rt_802_11_event_table {
+	unsigned long Num;
+	unsigned long Rsv;		/* to align Log[] at LARGE_INEGER boundary */
+	struct rt_802_11_event_log Log[MAX_NUMBER_OF_EVENT];
+};
+
+/* MIMO Tx parameter, ShortGI, MCS, STBC, etc.  these are fields in TXWI. Don't change this definition! */
+typedef union _MACHTTRANSMIT_SETTING {
+	struct {
+		u16 MCS:7;	/* MCS */
+		u16 BW:1;	/*channel bandwidth 20MHz or 40 MHz */
+		u16 ShortGI:1;
+		u16 STBC:2;	/*SPACE */
+		u16 rsv:3;
+		u16 MODE:2;	/* Use definition MODE_xxx. */
+	} field;
+	u16 word;
+} MACHTTRANSMIT_SETTING, *PMACHTTRANSMIT_SETTING;
+
+struct rt_802_11_mac_entry {
+	u8 Addr[MAC_ADDR_LENGTH];
+	u8 Aid;
+	u8 Psm;		/* 0:PWR_ACTIVE, 1:PWR_SAVE */
+	u8 MimoPs;		/* 0:MMPS_STATIC, 1:MMPS_DYNAMIC, 3:MMPS_Enabled */
+	char AvgRssi0;
+	char AvgRssi1;
+	char AvgRssi2;
+	u32 ConnectedTime;
+	MACHTTRANSMIT_SETTING TxRate;
+};
+
+struct rt_802_11_mac_table {
+	unsigned long Num;
+	struct rt_802_11_mac_entry Entry[MAX_NUMBER_OF_MAC];
+};
+
+/* structure for query/set hardware register - MAC, BBP, RF register */
+struct rt_802_11_hardware_register {
+	unsigned long HardwareType;	/* 0:MAC, 1:BBP, 2:RF register, 3:EEPROM */
+	unsigned long Offset;		/* Q/S register offset addr */
+	unsigned long Data;		/* R/W data buffer */
+};
+
+struct rt_802_11_ap_config {
+	unsigned long EnableTxBurst;	/* 0-disable, 1-enable */
+	unsigned long EnableTurboRate;	/* 0-disable, 1-enable 72/100mbps turbo rate */
+	unsigned long IsolateInterStaTraffic;	/* 0-disable, 1-enable isolation */
+	unsigned long HideSsid;		/* 0-disable, 1-enable hiding */
+	unsigned long UseBGProtection;	/* 0-AUTO, 1-always ON, 2-always OFF */
+	unsigned long UseShortSlotTime;	/* 0-no use, 1-use 9-us short slot time */
+	unsigned long Rsv1;		/* must be 0 */
+	unsigned long SystemErrorBitmap;	/* ignore upon SET, return system error upon QUERY */
+};
+
+/* structure to query/set STA_CONFIG */
+struct rt_802_11_sta_config {
+	unsigned long EnableTxBurst;	/* 0-disable, 1-enable */
+	unsigned long EnableTurboRate;	/* 0-disable, 1-enable 72/100mbps turbo rate */
+	unsigned long UseBGProtection;	/* 0-AUTO, 1-always ON, 2-always OFF */
+	unsigned long UseShortSlotTime;	/* 0-no use, 1-use 9-us short slot time when applicable */
+	unsigned long AdhocMode;	/* 0-11b rates only (WIFI spec), 1 - b/g mixed, 2 - g only */
+	unsigned long HwRadioStatus;	/* 0-OFF, 1-ON, default is 1, Read-Only */
+	unsigned long Rsv1;		/* must be 0 */
+	unsigned long SystemErrorBitmap;	/* ignore upon SET, return system error upon QUERY */
+};
+
+/* */
+/*  For OID Query or Set about BA structure */
+/* */
+struct rt_oid_bacap {
+	u8 RxBAWinLimit;
+	u8 TxBAWinLimit;
+	u8 Policy;		/* 0: DELAY_BA 1:IMMED_BA  (//BA Policy subfiled value in ADDBA frame)   2:BA-not use. other value invalid */
+	u8 MpduDensity;	/* 0: DELAY_BA 1:IMMED_BA  (//BA Policy subfiled value in ADDBA frame)   2:BA-not use. other value invalid */
+	u8 AmsduEnable;	/*Enable AMSDU transmisstion */
+	u8 AmsduSize;	/* 0:3839, 1:7935 bytes. u32  MSDUSizeToBytes[]        = { 3839, 7935}; */
+	u8 MMPSmode;		/* MIMO power save more, 0:static, 1:dynamic, 2:rsv, 3:mimo enable */
+	BOOLEAN AutoBA;		/* Auto BA will automatically */
+};
+
+struct rt_802_11_acl_entry {
+	u8 Addr[MAC_ADDR_LENGTH];
+	u16 Rsv;
+};
+
+struct PACKED rt_rt_802_11_acl {
+	unsigned long Policy;		/* 0-disable, 1-positive list, 2-negative list */
+	unsigned long Num;
+	struct rt_802_11_acl_entry Entry[MAX_NUMBER_OF_ACL];
+};
+
+struct rt_802_11_wds {
+	unsigned long Num;
+	NDIS_802_11_MAC_ADDRESS Entry[24 /*MAX_NUM_OF_WDS_LINK */ ];
+	unsigned long KeyLength;
+	u8 KeyMaterial[32];
+};
+
+struct rt_802_11_tx_rates {
+	u8 SupRateLen;
+	u8 SupRate[MAX_LENGTH_OF_SUPPORT_RATES];
+	u8 ExtRateLen;
+	u8 ExtRate[MAX_LENGTH_OF_SUPPORT_RATES];
+};
+
+/* Definition of extra information code */
+#define	GENERAL_LINK_UP			0x0	/* Link is Up */
+#define	GENERAL_LINK_DOWN		0x1	/* Link is Down */
+#define	HW_RADIO_OFF			0x2	/* Hardware radio off */
+#define	SW_RADIO_OFF			0x3	/* Software radio off */
+#define	AUTH_FAIL				0x4	/* Open authentication fail */
+#define	AUTH_FAIL_KEYS			0x5	/* Shared authentication fail */
+#define	ASSOC_FAIL				0x6	/* Association failed */
+#define	EAP_MIC_FAILURE			0x7	/* Deauthencation because MIC failure */
+#define	EAP_4WAY_TIMEOUT		0x8	/* Deauthencation on 4-way handshake timeout */
+#define	EAP_GROUP_KEY_TIMEOUT	0x9	/* Deauthencation on group key handshake timeout */
+#define	EAP_SUCCESS				0xa	/* EAP succeed */
+#define	DETECT_RADAR_SIGNAL		0xb	/* Radar signal occur in current channel */
+#define EXTRA_INFO_MAX			0xb	/* Indicate Last OID */
 
 #define EXTRA_INFO_CLEAR		0xffffffff
 
-// This is OID setting structure. So only GF or MM as Mode. This is valid when our wirelss mode has 802.11n in use.
-typedef struct {
-	RT_802_11_PHY_MODE		PhyMode; 	//
-	UCHAR		TransmitNo;
-	UCHAR		HtMode; 	//HTMODE_GF or HTMODE_MM
-	UCHAR		ExtOffset;	//extension channel above or below
-	UCHAR		MCS;
-	UCHAR   	BW;
-	UCHAR		STBC;
-	UCHAR		SHORTGI;
-	UCHAR		rsv;
-} OID_SET_HT_PHYMODE, *POID_SET_HT_PHYMODE;
-
-#ifdef LLTD_SUPPORT
-typedef struct _RT_LLTD_ASSOICATION_ENTRY {
-    UCHAR           Addr[ETH_LENGTH_OF_ADDRESS];
-    unsigned short  MOR;        // maximum operational rate
-    UCHAR           phyMode;
-} RT_LLTD_ASSOICATION_ENTRY, *PRT_LLTD_ASSOICATION_ENTRY;
-
-typedef struct _RT_LLTD_ASSOICATION_TABLE {
-    unsigned int                Num;
-    RT_LLTD_ASSOICATION_ENTRY   Entry[MAX_NUMBER_OF_MAC];
-} RT_LLTD_ASSOICATION_TABLE, *PRT_LLTD_ASSOICATION_TABLE;
-#endif // LLTD_SUPPORT //
+/* This is OID setting structure. So only GF or MM as Mode. This is valid when our wirelss mode has 802.11n in use. */
+struct rt_oid_set_ht_phymode {
+	RT_802_11_PHY_MODE PhyMode;	/* */
+	u8 TransmitNo;
+	u8 HtMode;		/*HTMODE_GF or HTMODE_MM */
+	u8 ExtOffset;	/*extension channel above or below */
+	u8 MCS;
+	u8 BW;
+	u8 STBC;
+	u8 SHORTGI;
+	u8 rsv;
+};
 
 #define MAX_CUSTOM_LEN 128
 
-typedef enum _RT_802_11_D_CLIENT_MODE
-{
-   Rt802_11_D_None,
-   Rt802_11_D_Flexible,
-   Rt802_11_D_Strict,
+typedef enum _RT_802_11_D_CLIENT_MODE {
+	Rt802_11_D_None,
+	Rt802_11_D_Flexible,
+	Rt802_11_D_Strict,
 } RT_802_11_D_CLIENT_MODE, *PRT_802_11_D_CLIENT_MODE;
 
-typedef struct _RT_CHANNEL_LIST_INFO
-{
-	UCHAR ChannelList[MAX_NUM_OF_CHS];   // list all supported channels for site survey
-	UCHAR ChannelListNum; // number of channel in ChannelList[]
-} RT_CHANNEL_LIST_INFO, *PRT_CHANNEL_LIST_INFO;
-
-#ifdef RT2870
-// WSC configured credential
-typedef	struct	_WSC_CREDENTIAL
-{
-	NDIS_802_11_SSID	SSID;				// mandatory
-	USHORT				AuthType;			// mandatory, 1: open, 2: wpa-psk, 4: shared, 8:wpa, 0x10: wpa2, 0x20: wpa2-psk
-	USHORT				EncrType;			// mandatory, 1: none, 2: wep, 4: tkip, 8: aes
-	UCHAR				Key[64];			// mandatory, Maximum 64 byte
-	USHORT				KeyLength;
-	UCHAR				MacAddr[6];			// mandatory, AP MAC address
-	UCHAR				KeyIndex;			// optional, default is 1
-	UCHAR				Rsvd[3];			// Make alignment
-}	WSC_CREDENTIAL, *PWSC_CREDENTIAL;
-
-// WSC configured profiles
-typedef	struct	_WSC_PROFILE
-{
-	UINT			ProfileCnt;
-	WSC_CREDENTIAL	Profile[8];				// Support up to 8 profiles
-}	WSC_PROFILE, *PWSC_PROFILE;
-#endif
+struct rt_channel_list_info {
+	u8 ChannelList[MAX_NUM_OF_CHS];	/* list all supported channels for site survey */
+	u8 ChannelListNum;	/* number of channel in ChannelList[] */
+};
 
-#endif // _OID_H_
+/* WSC configured credential */
+struct rt_wsc_credential {
+	struct rt_ndis_802_11_ssid SSID;	/* mandatory */
+	u16 AuthType;	/* mandatory, 1: open, 2: wpa-psk, 4: shared, 8:wpa, 0x10: wpa2, 0x20: wpa2-psk */
+	u16 EncrType;	/* mandatory, 1: none, 2: wep, 4: tkip, 8: aes */
+	u8 Key[64];		/* mandatory, Maximum 64 byte */
+	u16 KeyLength;
+	u8 MacAddr[6];	/* mandatory, AP MAC address */
+	u8 KeyIndex;		/* optional, default is 1 */
+	u8 Rsvd[3];		/* Make alignment */
+};
+
+/* WSC configured profiles */
+struct rt_wsc_profile {
+	u32 ProfileCnt;
+	u32 ApplyProfileIdx;	/* add by johnli, fix WPS test plan 5.1.1 */
+	struct rt_wsc_credential Profile[8];	/* Support up to 8 profiles */
+};
 
+#endif /* _OID_H_ */
diff --git a/drivers/staging/rt2860/pci_main_dev.c b/drivers/staging/rt2860/pci_main_dev.c
new file mode 100644
index 000000000000..6af430419070
--- /dev/null
+++ b/drivers/staging/rt2860/pci_main_dev.c
@@ -0,0 +1,1190 @@
+/*
+ *************************************************************************
+ * Ralink Tech Inc.
+ * 5F., No.36, Taiyuan St., Jhubei City,
+ * Hsinchu County 302,
+ * Taiwan, R.O.C.
+ *
+ * (c) Copyright 2002-2007, Ralink Technology, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify  *
+ * it under the terms of the GNU General Public License as published by  *
+ * the Free Software Foundation; either version 2 of the License, or     *
+ * (at your option) any later version.                                   *
+ *                                                                       *
+ * This program is distributed in the hope that it will be useful,       *
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
+ * GNU General Public License for more details.                          *
+ *                                                                       *
+ * You should have received a copy of the GNU General Public License     *
+ * along with this program; if not, write to the                         *
+ * Free Software Foundation, Inc.,                                       *
+ * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
+ *                                                                       *
+ *************************************************************************
+
+    Module Name:
+    pci_main_dev.c
+
+    Abstract:
+    Create and register network interface for PCI based chipsets in Linux platform.
+
+    Revision History:
+    Who         When            What
+    --------    ----------      ----------------------------------------------
+*/
+
+#include "rt_config.h"
+#include <linux/pci.h>
+
+/* Following information will be show when you run 'modinfo' */
+/* *** If you have a solution for the bug in current version of driver, please mail to me. */
+/* Otherwise post to forum in ralinktech's web site(www.ralinktech.com) and let all users help you. *** */
+MODULE_AUTHOR("Jett Chen <jett_chen@ralinktech.com>");
+MODULE_DESCRIPTION("RT2860/RT3090 Wireless Lan Linux Driver");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("rt3090sta");
+
+/* */
+/* Function declarations */
+/* */
+extern int rt28xx_close(IN struct net_device *net_dev);
+extern int rt28xx_open(struct net_device *net_dev);
+
+static void __devexit rt2860_remove_one(struct pci_dev *pci_dev);
+static int __devinit rt2860_probe(struct pci_dev *pci_dev,
+				  const struct pci_device_id *ent);
+static void __exit rt2860_cleanup_module(void);
+static int __init rt2860_init_module(void);
+
+static void RTMPInitPCIeDevice(IN struct pci_dev *pci_dev,
+			       struct rt_rtmp_adapter *pAd);
+
+#ifdef CONFIG_PM
+static int rt2860_suspend(struct pci_dev *pci_dev, pm_message_t state);
+static int rt2860_resume(struct pci_dev *pci_dev);
+#endif /* CONFIG_PM // */
+
+/* */
+/* Ralink PCI device table, include all supported chipsets */
+/* */
+static struct pci_device_id rt2860_pci_tbl[] __devinitdata = {
+#ifdef RT2860
+	{PCI_DEVICE(NIC_PCI_VENDOR_ID, NIC2860_PCI_DEVICE_ID)},	/*RT28602.4G */
+	{PCI_DEVICE(NIC_PCI_VENDOR_ID, NIC2860_PCIe_DEVICE_ID)},
+	{PCI_DEVICE(NIC_PCI_VENDOR_ID, NIC2760_PCI_DEVICE_ID)},
+	{PCI_DEVICE(NIC_PCI_VENDOR_ID, NIC2790_PCIe_DEVICE_ID)},
+	{PCI_DEVICE(VEN_AWT_PCI_VENDOR_ID, VEN_AWT_PCIe_DEVICE_ID)},
+	{PCI_DEVICE(EDIMAX_PCI_VENDOR_ID, 0x7708)},
+	{PCI_DEVICE(EDIMAX_PCI_VENDOR_ID, 0x7728)},
+	{PCI_DEVICE(EDIMAX_PCI_VENDOR_ID, 0x7758)},
+	{PCI_DEVICE(EDIMAX_PCI_VENDOR_ID, 0x7727)},
+	{PCI_DEVICE(EDIMAX_PCI_VENDOR_ID, 0x7738)},
+	{PCI_DEVICE(EDIMAX_PCI_VENDOR_ID, 0x7748)},
+	{PCI_DEVICE(EDIMAX_PCI_VENDOR_ID, 0x7768)},
+#endif
+#ifdef RT3090
+	{PCI_DEVICE(NIC_PCI_VENDOR_ID, NIC3090_PCIe_DEVICE_ID)},
+	{PCI_DEVICE(NIC_PCI_VENDOR_ID, NIC3091_PCIe_DEVICE_ID)},
+	{PCI_DEVICE(NIC_PCI_VENDOR_ID, NIC3092_PCIe_DEVICE_ID)},
+#endif /* RT3090 // */
+#ifdef RT3390
+	{PCI_DEVICE(NIC_PCI_VENDOR_ID, NIC3390_PCIe_DEVICE_ID)},
+	{PCI_DEVICE(NIC_PCI_VENDOR_ID, NIC3391_PCIe_DEVICE_ID)},
+	{PCI_DEVICE(NIC_PCI_VENDOR_ID, NIC3392_PCIe_DEVICE_ID)},
+#endif /* RT3390 // */
+	{0,}			/* terminate list */
+};
+
+MODULE_DEVICE_TABLE(pci, rt2860_pci_tbl);
+#ifdef MODULE_VERSION
+MODULE_VERSION(STA_DRIVER_VERSION);
+#endif
+
+/* */
+/* Our PCI driver structure */
+/* */
+static struct pci_driver rt2860_driver = {
+name:	"rt2860",
+id_table:rt2860_pci_tbl,
+probe:	rt2860_probe,
+remove:__devexit_p(rt2860_remove_one),
+#ifdef CONFIG_PM
+suspend:rt2860_suspend,
+resume:rt2860_resume,
+#endif
+};
+
+/***************************************************************************
+ *
+ *	PCI device initialization related procedures.
+ *
+ ***************************************************************************/
+#ifdef CONFIG_PM
+
+void RT2860RejectPendingPackets(struct rt_rtmp_adapter *pAd)
+{
+	/* clear PS packets */
+	/* clear TxSw packets */
+}
+
+static int rt2860_suspend(struct pci_dev *pci_dev, pm_message_t state)
+{
+	struct net_device *net_dev = pci_get_drvdata(pci_dev);
+	struct rt_rtmp_adapter *pAd = (struct rt_rtmp_adapter *)NULL;
+	int retval = 0;
+
+	DBGPRINT(RT_DEBUG_TRACE, ("===> rt2860_suspend()\n"));
+
+	if (net_dev == NULL) {
+		DBGPRINT(RT_DEBUG_ERROR, ("net_dev == NULL!\n"));
+	} else {
+		GET_PAD_FROM_NET_DEV(pAd, net_dev);
+
+		/* we can not use IFF_UP because ra0 down but ra1 up */
+		/* and 1 suspend/resume function for 1 module, not for each interface */
+		/* so Linux will call suspend/resume function once */
+		if (VIRTUAL_IF_NUM(pAd) > 0) {
+			/* avoid users do suspend after interface is down */
+
+			/* stop interface */
+			netif_carrier_off(net_dev);
+			netif_stop_queue(net_dev);
+
+			/* mark device as removed from system and therefore no longer available */
+			netif_device_detach(net_dev);
+
+			/* mark halt flag */
+			RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS);
+			RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_RADIO_OFF);
+
+			/* take down the device */
+			rt28xx_close((struct net_device *)net_dev);
+
+			RT_MOD_DEC_USE_COUNT();
+		}
+	}
+
+	/* reference to http://vovo2000.com/type-lab/linux/kernel-api/linux-kernel-api.html */
+	/* enable device to generate PME# when suspended */
+	/* pci_choose_state(): Choose the power state of a PCI device to be suspended */
+	retval = pci_enable_wake(pci_dev, pci_choose_state(pci_dev, state), 1);
+	/* save the PCI configuration space of a device before suspending */
+	pci_save_state(pci_dev);
+	/* disable PCI device after use */
+	pci_disable_device(pci_dev);
+
+	retval = pci_set_power_state(pci_dev, pci_choose_state(pci_dev, state));
+
+	DBGPRINT(RT_DEBUG_TRACE, ("<=== rt2860_suspend()\n"));
+	return retval;
+}
+
+static int rt2860_resume(struct pci_dev *pci_dev)
+{
+	struct net_device *net_dev = pci_get_drvdata(pci_dev);
+	struct rt_rtmp_adapter *pAd = (struct rt_rtmp_adapter *)NULL;
+	int retval;
+
+	/* set the power state of a PCI device */
+	/* PCI has 4 power states, DO (normal) ~ D3(less power) */
+	/* in include/linux/pci.h, you can find that */
+	/* #define PCI_D0          ((pci_power_t __force) 0) */
+	/* #define PCI_D1          ((pci_power_t __force) 1) */
+	/* #define PCI_D2          ((pci_power_t __force) 2) */
+	/* #define PCI_D3hot       ((pci_power_t __force) 3) */
+	/* #define PCI_D3cold      ((pci_power_t __force) 4) */
+	/* #define PCI_UNKNOWN     ((pci_power_t __force) 5) */
+	/* #define PCI_POWER_ERROR ((pci_power_t __force) -1) */
+	retval = pci_set_power_state(pci_dev, PCI_D0);
+
+	/* restore the saved state of a PCI device */
+	pci_restore_state(pci_dev);
+
+	/* initialize device before it's used by a driver */
+	if (pci_enable_device(pci_dev)) {
+		printk("pci enable fail!\n");
+		return 0;
+	}
+
+	DBGPRINT(RT_DEBUG_TRACE, ("===> rt2860_resume()\n"));
+
+	if (net_dev == NULL) {
+		DBGPRINT(RT_DEBUG_ERROR, ("net_dev == NULL!\n"));
+	} else
+		GET_PAD_FROM_NET_DEV(pAd, net_dev);
+
+	if (pAd != NULL) {
+		/* we can not use IFF_UP because ra0 down but ra1 up */
+		/* and 1 suspend/resume function for 1 module, not for each interface */
+		/* so Linux will call suspend/resume function once */
+		if (VIRTUAL_IF_NUM(pAd) > 0) {
+			/* mark device as attached from system and restart if needed */
+			netif_device_attach(net_dev);
+
+			if (rt28xx_open((struct net_device *)net_dev) != 0) {
+				/* open fail */
+				DBGPRINT(RT_DEBUG_TRACE,
+					 ("<=== rt2860_resume()\n"));
+				return 0;
+			}
+			/* increase MODULE use count */
+			RT_MOD_INC_USE_COUNT();
+
+			RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS);
+			RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_RADIO_OFF);
+
+			netif_start_queue(net_dev);
+			netif_carrier_on(net_dev);
+			netif_wake_queue(net_dev);
+		}
+	}
+
+	DBGPRINT(RT_DEBUG_TRACE, ("<=== rt2860_resume()\n"));
+	return 0;
+}
+#endif /* CONFIG_PM // */
+
+static int __init rt2860_init_module(void)
+{
+	return pci_register_driver(&rt2860_driver);
+}
+
+/* */
+/* Driver module unload function */
+/* */
+static void __exit rt2860_cleanup_module(void)
+{
+	pci_unregister_driver(&rt2860_driver);
+}
+
+module_init(rt2860_init_module);
+module_exit(rt2860_cleanup_module);
+
+/* */
+/* PCI device probe & initialization function */
+/* */
+static int __devinit rt2860_probe(IN struct pci_dev *pci_dev,
+				  IN const struct pci_device_id *pci_id)
+{
+	struct rt_rtmp_adapter *pAd = (struct rt_rtmp_adapter *)NULL;
+	struct net_device *net_dev;
+	void *handle;
+	char *print_name;
+	unsigned long csr_addr;
+	int rv = 0;
+	struct rt_rtmp_os_netdev_op_hook netDevHook;
+
+	DBGPRINT(RT_DEBUG_TRACE, ("===> rt2860_probe\n"));
+
+/*PCIDevInit============================================== */
+	/* wake up and enable device */
+	if ((rv = pci_enable_device(pci_dev)) != 0) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("Enable PCI device failed, errno=%d!\n", rv));
+		return rv;
+	}
+
+	print_name = (char *)pci_name(pci_dev);
+
+	if ((rv = pci_request_regions(pci_dev, print_name)) != 0) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("Request PCI resource failed, errno=%d!\n", rv));
+		goto err_out;
+	}
+	/* map physical address to virtual address for accessing register */
+	csr_addr =
+	    (unsigned long)ioremap(pci_resource_start(pci_dev, 0),
+				   pci_resource_len(pci_dev, 0));
+	if (!csr_addr) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("ioremap failed for device %s, region 0x%lX @ 0x%lX\n",
+			  print_name, (unsigned long)pci_resource_len(pci_dev, 0),
+			  (unsigned long)pci_resource_start(pci_dev, 0)));
+		goto err_out_free_res;
+	} else {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("%s: at 0x%lx, VA 0x%lx, IRQ %d. \n", print_name,
+			  (unsigned long)pci_resource_start(pci_dev, 0),
+			  (unsigned long)csr_addr, pci_dev->irq));
+	}
+
+	/* Set DMA master */
+	pci_set_master(pci_dev);
+
+/*RtmpDevInit============================================== */
+	/* Allocate struct rt_rtmp_adapter adapter structure */
+	handle = kmalloc(sizeof(struct os_cookie), GFP_KERNEL);
+	if (handle == NULL) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("%s(): Allocate memory for os handle failed!\n",
+			  __func__));
+		goto err_out_iounmap;
+	}
+
+	((struct os_cookie *)handle)->pci_dev = pci_dev;
+
+	rv = RTMPAllocAdapterBlock(handle, &pAd);	/*shiang: we may need the pci_dev for allocate structure of "struct rt_rtmp_adapter" */
+	if (rv != NDIS_STATUS_SUCCESS)
+		goto err_out_iounmap;
+	/* Here are the struct rt_rtmp_adapter structure with pci-bus specific parameters. */
+	pAd->CSRBaseAddress = (u8 *)csr_addr;
+	DBGPRINT(RT_DEBUG_ERROR,
+		 ("pAd->CSRBaseAddress =0x%lx, csr_addr=0x%lx!\n",
+		  (unsigned long)pAd->CSRBaseAddress, csr_addr));
+	RtmpRaDevCtrlInit(pAd, RTMP_DEV_INF_PCI);
+
+/*NetDevInit============================================== */
+	net_dev = RtmpPhyNetDevInit(pAd, &netDevHook);
+	if (net_dev == NULL)
+		goto err_out_free_radev;
+
+	/* Here are the net_device structure with pci-bus specific parameters. */
+	net_dev->irq = pci_dev->irq;	/* Interrupt IRQ number */
+	net_dev->base_addr = csr_addr;	/* Save CSR virtual address and irq to device structure */
+	pci_set_drvdata(pci_dev, net_dev);	/* Set driver data */
+
+/* for supporting Network Manager */
+	/* Set the sysfs physical device reference for the network logical device
+	 * if set prior to registration will cause a symlink during initialization.
+	 */
+	SET_NETDEV_DEV(net_dev, &(pci_dev->dev));
+
+/*All done, it's time to register the net device to linux kernel. */
+	/* Register this device */
+	rv = RtmpOSNetDevAttach(net_dev, &netDevHook);
+	if (rv)
+		goto err_out_free_netdev;
+
+	pAd->StaCfg.OriDevType = net_dev->type;
+	RTMPInitPCIeDevice(pci_dev, pAd);
+
+	DBGPRINT(RT_DEBUG_TRACE, ("<=== rt2860_probe\n"));
+
+	return 0;		/* probe ok */
+
+	/* --------------------------- ERROR HANDLE --------------------------- */
+err_out_free_netdev:
+	RtmpOSNetDevFree(net_dev);
+
+err_out_free_radev:
+	/* free struct rt_rtmp_adapter strcuture and os_cookie */
+	RTMPFreeAdapter(pAd);
+
+err_out_iounmap:
+	iounmap((void *)(csr_addr));
+	release_mem_region(pci_resource_start(pci_dev, 0),
+			   pci_resource_len(pci_dev, 0));
+
+err_out_free_res:
+	pci_release_regions(pci_dev);
+
+err_out:
+	pci_disable_device(pci_dev);
+
+	DBGPRINT(RT_DEBUG_ERROR,
+		 ("<=== rt2860_probe failed with rv = %d!\n", rv));
+
+	return -ENODEV;		/* probe fail */
+}
+
+static void __devexit rt2860_remove_one(IN struct pci_dev *pci_dev)
+{
+	struct net_device *net_dev = pci_get_drvdata(pci_dev);
+	struct rt_rtmp_adapter *pAd = NULL;
+	unsigned long csr_addr = net_dev->base_addr;	/* pAd->CSRBaseAddress; */
+
+	GET_PAD_FROM_NET_DEV(pAd, net_dev);
+
+	DBGPRINT(RT_DEBUG_TRACE, ("===> rt2860_remove_one\n"));
+
+	if (pAd != NULL) {
+		/* Unregister/Free all allocated net_device. */
+		RtmpPhyNetDevExit(pAd, net_dev);
+
+		/* Unmap CSR base address */
+		iounmap((char *)(csr_addr));
+
+		/* release memory region */
+		release_mem_region(pci_resource_start(pci_dev, 0),
+				   pci_resource_len(pci_dev, 0));
+
+		/* Free struct rt_rtmp_adapter related structures. */
+		RtmpRaDevCtrlExit(pAd);
+
+	} else {
+		/* Unregister network device */
+		RtmpOSNetDevDetach(net_dev);
+
+		/* Unmap CSR base address */
+		iounmap((char *)(net_dev->base_addr));
+
+		/* release memory region */
+		release_mem_region(pci_resource_start(pci_dev, 0),
+				   pci_resource_len(pci_dev, 0));
+	}
+
+	/* Free the root net_device */
+	RtmpOSNetDevFree(net_dev);
+
+}
+
+/*
+========================================================================
+Routine Description:
+    Check the chipset vendor/product ID.
+
+Arguments:
+    _dev_p				Point to the PCI or USB device
+
+Return Value:
+    TRUE				Check ok
+	FALSE				Check fail
+
+Note:
+========================================================================
+*/
+BOOLEAN RT28XXChipsetCheck(IN void *_dev_p)
+{
+	/* always TRUE */
+	return TRUE;
+}
+
+/***************************************************************************
+ *
+ *	PCIe device initialization related procedures.
+ *
+ ***************************************************************************/
+static void RTMPInitPCIeDevice(struct pci_dev *pci_dev, struct rt_rtmp_adapter *pAd)
+{
+	u16 device_id;
+	struct os_cookie *pObj;
+
+	pObj = (struct os_cookie *)pAd->OS_Cookie;
+	pci_read_config_word(pci_dev, PCI_DEVICE_ID, &device_id);
+	device_id = le2cpu16(device_id);
+	pObj->DeviceID = device_id;
+	if (
+#ifdef RT2860
+		   (device_id == NIC2860_PCIe_DEVICE_ID) ||
+		   (device_id == NIC2790_PCIe_DEVICE_ID) ||
+		   (device_id == VEN_AWT_PCIe_DEVICE_ID) ||
+#endif
+#ifdef RT3090
+		   (device_id == NIC3090_PCIe_DEVICE_ID) ||
+		   (device_id == NIC3091_PCIe_DEVICE_ID) ||
+		   (device_id == NIC3092_PCIe_DEVICE_ID) ||
+#endif /* RT3090 // */
+		   0) {
+		u32 MacCsr0 = 0, Index = 0;
+		do {
+			RTMP_IO_READ32(pAd, MAC_CSR0, &MacCsr0);
+
+			if ((MacCsr0 != 0x00) && (MacCsr0 != 0xFFFFFFFF))
+				break;
+
+			RTMPusecDelay(10);
+		} while (Index++ < 100);
+
+		/* Support advanced power save after 2892/2790. */
+		/* MAC version at offset 0x1000 is 0x2872XXXX/0x2870XXXX(PCIe, USB, SDIO). */
+		if ((MacCsr0 & 0xffff0000) != 0x28600000) {
+			OPSTATUS_SET_FLAG(pAd, fOP_STATUS_PCIE_DEVICE);
+		}
+	}
+}
+
+void RTMPInitPCIeLinkCtrlValue(struct rt_rtmp_adapter *pAd)
+{
+	int pos;
+	u16 reg16, data2, PCIePowerSaveLevel, Configuration;
+	u32 MacValue;
+	BOOLEAN bFindIntel = FALSE;
+	struct os_cookie *pObj;
+
+	pObj = (struct os_cookie *)pAd->OS_Cookie;
+
+	if (!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE))
+		return;
+
+	DBGPRINT(RT_DEBUG_TRACE, ("%s.===>\n", __func__));
+	/* Init EEPROM, and save settings */
+	if (!(IS_RT3090(pAd) || IS_RT3572(pAd) || IS_RT3390(pAd))) {
+		RT28xx_EEPROM_READ16(pAd, 0x22, PCIePowerSaveLevel);
+		pAd->PCIePowerSaveLevel = PCIePowerSaveLevel & 0xff;
+
+		pAd->LnkCtrlBitMask = 0;
+		if ((PCIePowerSaveLevel & 0xff) == 0xff) {
+			OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_PCIE_DEVICE);
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("====> PCIePowerSaveLevel = 0x%x.\n",
+				  PCIePowerSaveLevel));
+			return;
+		} else {
+			PCIePowerSaveLevel &= 0x3;
+			RT28xx_EEPROM_READ16(pAd, 0x24, data2);
+
+			if (!
+			    (((data2 & 0xff00) == 0x9200)
+			     && ((data2 & 0x80) != 0))) {
+				if (PCIePowerSaveLevel > 1)
+					PCIePowerSaveLevel = 1;
+			}
+
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("====> Write 0x83 = 0x%x.\n",
+				  PCIePowerSaveLevel));
+			AsicSendCommandToMcu(pAd, 0x83, 0xff,
+					     (u8)PCIePowerSaveLevel, 0x00);
+			RT28xx_EEPROM_READ16(pAd, 0x22, PCIePowerSaveLevel);
+			PCIePowerSaveLevel &= 0xff;
+			PCIePowerSaveLevel = PCIePowerSaveLevel >> 6;
+			switch (PCIePowerSaveLevel) {
+			case 0:	/* Only support L0 */
+				pAd->LnkCtrlBitMask = 0;
+				break;
+			case 1:	/* Only enable L0s */
+				pAd->LnkCtrlBitMask = 1;
+				break;
+			case 2:	/* enable L1, L0s */
+				pAd->LnkCtrlBitMask = 3;
+				break;
+			case 3:	/* sync with host clk and enable L1, L0s */
+				pAd->LnkCtrlBitMask = 0x103;
+				break;
+			}
+			RT28xx_EEPROM_READ16(pAd, 0x24, data2);
+			if ((PCIePowerSaveLevel & 0xff) != 0xff) {
+				PCIePowerSaveLevel &= 0x3;
+
+				if (!
+				    (((data2 & 0xff00) == 0x9200)
+				     && ((data2 & 0x80) != 0))) {
+					if (PCIePowerSaveLevel > 1)
+						PCIePowerSaveLevel = 1;
+				}
+
+				DBGPRINT(RT_DEBUG_TRACE,
+					 ("====> rt28xx Write 0x83 Command = 0x%x.\n",
+					  PCIePowerSaveLevel));
+
+				AsicSendCommandToMcu(pAd, 0x83, 0xff,
+						     (u8)PCIePowerSaveLevel,
+						     0x00);
+			}
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("====> LnkCtrlBitMask = 0x%x.\n",
+				  pAd->LnkCtrlBitMask));
+		}
+	} else if (IS_RT3090(pAd) || IS_RT3572(pAd) || IS_RT3390(pAd)) {
+		u8 LinkCtrlSetting = 0;
+
+		/* Check 3090E special setting chip. */
+		RT28xx_EEPROM_READ16(pAd, 0x24, data2);
+		if ((data2 == 0x9280) && ((pAd->MACVersion & 0xffff) == 0x0211)) {
+			pAd->b3090ESpecialChip = TRUE;
+			DBGPRINT_RAW(RT_DEBUG_ERROR, ("Special 3090E chip \n"));
+		}
+
+		RTMP_IO_READ32(pAd, AUX_CTRL, &MacValue);
+		/*enable WAKE_PCIE function, which forces to enable PCIE clock when mpu interrupt asserting. */
+		/*Force PCIE 125MHz CLK to toggle */
+		MacValue |= 0x402;
+		RTMP_IO_WRITE32(pAd, AUX_CTRL, MacValue);
+		DBGPRINT_RAW(RT_DEBUG_ERROR,
+			     (" AUX_CTRL = 0x%32x\n", MacValue));
+
+		/* for RT30xx F and after, PCIe infterface, and for power solution 3 */
+		if ((IS_VERSION_AFTER_F(pAd))
+		    && (pAd->StaCfg.PSControl.field.rt30xxPowerMode >= 2)
+		    && (pAd->StaCfg.PSControl.field.rt30xxPowerMode <= 3)) {
+			RTMP_IO_READ32(pAd, AUX_CTRL, &MacValue);
+			DBGPRINT_RAW(RT_DEBUG_ERROR,
+				     (" Read AUX_CTRL = 0x%x\n", MacValue));
+			/* turn on bit 12. */
+			/*enable 32KHz clock mode for power saving */
+			MacValue |= 0x1000;
+			if (MacValue != 0xffffffff) {
+				RTMP_IO_WRITE32(pAd, AUX_CTRL, MacValue);
+				DBGPRINT_RAW(RT_DEBUG_ERROR,
+					     (" Write AUX_CTRL = 0x%x\n",
+					      MacValue));
+				/* 1. if use PCIePowerSetting is 2 or 3, need to program OSC_CTRL to 0x3ff11. */
+				MacValue = 0x3ff11;
+				RTMP_IO_WRITE32(pAd, OSC_CTRL, MacValue);
+				DBGPRINT_RAW(RT_DEBUG_ERROR,
+					     (" OSC_CTRL = 0x%x\n", MacValue));
+				/* 2. Write PCI register Clk ref bit */
+				RTMPrt3xSetPCIePowerLinkCtrl(pAd);
+			} else {
+				/* Error read Aux_Ctrl value.  Force to use solution 1 */
+				DBGPRINT(RT_DEBUG_ERROR,
+					 (" Error Value in AUX_CTRL = 0x%x\n",
+					  MacValue));
+				pAd->StaCfg.PSControl.field.rt30xxPowerMode = 1;
+				DBGPRINT(RT_DEBUG_ERROR,
+					 (" Force to use power solution1 \n"));
+			}
+		}
+		/* 1. read setting from inf file. */
+
+		PCIePowerSaveLevel =
+		    (u16)pAd->StaCfg.PSControl.field.rt30xxPowerMode;
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("====> rt30xx Read PowerLevelMode =  0x%x.\n",
+			  PCIePowerSaveLevel));
+		/* 2. Check EnableNewPS. */
+		if (pAd->StaCfg.PSControl.field.EnableNewPS == FALSE)
+			PCIePowerSaveLevel = 1;
+
+		if (IS_VERSION_BEFORE_F(pAd)
+		    && (pAd->b3090ESpecialChip == FALSE)) {
+			/* Chip Version E only allow 1, So force set 1. */
+			PCIePowerSaveLevel &= 0x1;
+			pAd->PCIePowerSaveLevel = (u16)PCIePowerSaveLevel;
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("====> rt30xx E Write 0x83 Command = 0x%x.\n",
+				  PCIePowerSaveLevel));
+
+			AsicSendCommandToMcu(pAd, 0x83, 0xff,
+					     (u8)PCIePowerSaveLevel, 0x00);
+		} else {
+			/* Chip Version F and after only allow 1 or 2 or 3. This might be modified after new chip version come out. */
+			if (!
+			    ((PCIePowerSaveLevel == 1)
+			     || (PCIePowerSaveLevel == 3)))
+				PCIePowerSaveLevel = 1;
+			DBGPRINT(RT_DEBUG_ERROR,
+				 ("====> rt30xx F Write 0x83 Command = 0x%x.\n",
+				  PCIePowerSaveLevel));
+			pAd->PCIePowerSaveLevel = (u16)PCIePowerSaveLevel;
+			/* for 3090F , we need to add high-byte arg for 0x83 command to indicate the link control setting in */
+			/* PCI Configuration Space. Because firmware can't read PCI Configuration Space */
+			if ((pAd->Rt3xxRalinkLinkCtrl & 0x2)
+			    && (pAd->Rt3xxHostLinkCtrl & 0x2)) {
+				LinkCtrlSetting = 1;
+			}
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("====> rt30xxF LinkCtrlSetting = 0x%x.\n",
+				  LinkCtrlSetting));
+			AsicSendCommandToMcu(pAd, 0x83, 0xff,
+					     (u8)PCIePowerSaveLevel,
+					     LinkCtrlSetting);
+		}
+	}
+	/* Find Ralink PCIe Device's Express Capability Offset */
+	pos = pci_find_capability(pObj->pci_dev, PCI_CAP_ID_EXP);
+
+	if (pos != 0) {
+		/* Ralink PCIe Device's Link Control Register Offset */
+		pAd->RLnkCtrlOffset = pos + PCI_EXP_LNKCTL;
+		pci_read_config_word(pObj->pci_dev, pAd->RLnkCtrlOffset,
+				     &reg16);
+		Configuration = le2cpu16(reg16);
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("Read (Ralink PCIe Link Control Register) offset 0x%x = 0x%x\n",
+			  pAd->RLnkCtrlOffset, Configuration));
+		pAd->RLnkCtrlConfiguration = (Configuration & 0x103);
+		Configuration &= 0xfefc;
+		Configuration |= (0x0);
+#ifdef RT2860
+		if ((pObj->DeviceID == NIC2860_PCIe_DEVICE_ID)
+		    || (pObj->DeviceID == NIC2790_PCIe_DEVICE_ID)) {
+			reg16 = cpu2le16(Configuration);
+			pci_write_config_word(pObj->pci_dev,
+					      pAd->RLnkCtrlOffset, reg16);
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("Write (Ralink PCIe Link Control Register)  offset 0x%x = 0x%x\n",
+				  pos + PCI_EXP_LNKCTL, Configuration));
+		}
+#endif /* RT2860 // */
+
+		RTMPFindHostPCIDev(pAd);
+		if (pObj->parent_pci_dev) {
+			u16 vendor_id;
+
+			pci_read_config_word(pObj->parent_pci_dev,
+					     PCI_VENDOR_ID, &vendor_id);
+			vendor_id = le2cpu16(vendor_id);
+			if (vendor_id == PCIBUS_INTEL_VENDOR) {
+				bFindIntel = TRUE;
+				RTMP_SET_PSFLAG(pAd, fRTMP_PS_TOGGLE_L1);
+			}
+			/* Find PCI-to-PCI Bridge Express Capability Offset */
+			pos =
+			    pci_find_capability(pObj->parent_pci_dev,
+						PCI_CAP_ID_EXP);
+
+			if (pos != 0) {
+				BOOLEAN bChange = FALSE;
+				/* PCI-to-PCI Bridge Link Control Register Offset */
+				pAd->HostLnkCtrlOffset = pos + PCI_EXP_LNKCTL;
+				pci_read_config_word(pObj->parent_pci_dev,
+						     pAd->HostLnkCtrlOffset,
+						     &reg16);
+				Configuration = le2cpu16(reg16);
+				DBGPRINT(RT_DEBUG_TRACE,
+					 ("Read (Host PCI-to-PCI Bridge Link Control Register) offset 0x%x = 0x%x\n",
+					  pAd->HostLnkCtrlOffset,
+					  Configuration));
+				pAd->HostLnkCtrlConfiguration =
+				    (Configuration & 0x103);
+				Configuration &= 0xfefc;
+				Configuration |= (0x0);
+
+				switch (pObj->DeviceID) {
+#ifdef RT2860
+				case NIC2860_PCIe_DEVICE_ID:
+				case NIC2790_PCIe_DEVICE_ID:
+					bChange = TRUE;
+					break;
+#endif /* RT2860 // */
+#ifdef RT3090
+				case NIC3090_PCIe_DEVICE_ID:
+				case NIC3091_PCIe_DEVICE_ID:
+				case NIC3092_PCIe_DEVICE_ID:
+					if (bFindIntel == FALSE)
+						bChange = TRUE;
+					break;
+#endif /* RT3090 // */
+				default:
+					break;
+				}
+
+				if (bChange) {
+					reg16 = cpu2le16(Configuration);
+					pci_write_config_word(pObj->
+							      parent_pci_dev,
+							      pAd->
+							      HostLnkCtrlOffset,
+							      reg16);
+					DBGPRINT(RT_DEBUG_TRACE,
+						 ("Write (Host PCI-to-PCI Bridge Link Control Register) offset 0x%x = 0x%x\n",
+						  pAd->HostLnkCtrlOffset,
+						  Configuration));
+				}
+			} else {
+				pAd->HostLnkCtrlOffset = 0;
+				DBGPRINT(RT_DEBUG_ERROR,
+					 ("%s: cannot find PCI-to-PCI Bridge PCI Express Capability!\n",
+					  __func__));
+			}
+		}
+	} else {
+		pAd->RLnkCtrlOffset = 0;
+		pAd->HostLnkCtrlOffset = 0;
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("%s: cannot find Ralink PCIe Device's PCI Express Capability!\n",
+			  __func__));
+	}
+
+	if (bFindIntel == FALSE) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("Doesn't find Intel PCI host controller. \n"));
+		/* Doesn't switch L0, L1, So set PCIePowerSaveLevel to 0xff */
+		pAd->PCIePowerSaveLevel = 0xff;
+		if ((pAd->RLnkCtrlOffset != 0)
+#ifdef RT3090
+		    && ((pObj->DeviceID == NIC3090_PCIe_DEVICE_ID)
+			|| (pObj->DeviceID == NIC3091_PCIe_DEVICE_ID)
+			|| (pObj->DeviceID == NIC3092_PCIe_DEVICE_ID))
+#endif /* RT3090 // */
+		    ) {
+			pci_read_config_word(pObj->pci_dev, pAd->RLnkCtrlOffset,
+					     &reg16);
+			Configuration = le2cpu16(reg16);
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("Read (Ralink 30xx PCIe Link Control Register) offset 0x%x = 0x%x\n",
+				  pAd->RLnkCtrlOffset, Configuration));
+			pAd->RLnkCtrlConfiguration = (Configuration & 0x103);
+			Configuration &= 0xfefc;
+			Configuration |= (0x0);
+			reg16 = cpu2le16(Configuration);
+			pci_write_config_word(pObj->pci_dev,
+					      pAd->RLnkCtrlOffset, reg16);
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("Write (Ralink PCIe Link Control Register)  offset 0x%x = 0x%x\n",
+				  pos + PCI_EXP_LNKCTL, Configuration));
+		}
+	}
+}
+
+void RTMPFindHostPCIDev(struct rt_rtmp_adapter *pAd)
+{
+	u16 reg16;
+	u8 reg8;
+	u32 DevFn;
+	struct pci_dev *pPci_dev;
+	struct os_cookie *pObj;
+
+	pObj = (struct os_cookie *)pAd->OS_Cookie;
+
+	if (!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE))
+		return;
+
+	DBGPRINT(RT_DEBUG_TRACE, ("%s.===>\n", __func__));
+
+	pObj->parent_pci_dev = NULL;
+	if (pObj->pci_dev->bus->parent) {
+		for (DevFn = 0; DevFn < 255; DevFn++) {
+			pPci_dev =
+			    pci_get_slot(pObj->pci_dev->bus->parent, DevFn);
+			if (pPci_dev) {
+				pci_read_config_word(pPci_dev, PCI_CLASS_DEVICE,
+						     &reg16);
+				reg16 = le2cpu16(reg16);
+				pci_read_config_byte(pPci_dev, PCI_CB_CARD_BUS,
+						     &reg8);
+				if ((reg16 == PCI_CLASS_BRIDGE_PCI)
+				    && (reg8 == pObj->pci_dev->bus->number)) {
+					pObj->parent_pci_dev = pPci_dev;
+				}
+			}
+		}
+	}
+}
+
+/*
+	========================================================================
+
+	Routine Description:
+
+	Arguments:
+		Level = RESTORE_HALT : Restore PCI host and Ralink PCIe Link Control field to its default value.
+		Level = Other Value : Restore from dot11 power save or radio off status. And force PCI host Link Control fields to 0x1
+
+	========================================================================
+*/
+void RTMPPCIeLinkCtrlValueRestore(struct rt_rtmp_adapter *pAd, u8 Level)
+{
+	u16 PCIePowerSaveLevel, reg16;
+	u16 Configuration;
+	struct os_cookie *pObj;
+
+	pObj = (struct os_cookie *)pAd->OS_Cookie;
+
+	if (!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE))
+		return;
+
+#ifdef RT2860
+	if (!((pObj->DeviceID == NIC2860_PCIe_DEVICE_ID)
+	      || (pObj->DeviceID == NIC2790_PCIe_DEVICE_ID)))
+		return;
+#endif /* RT2860 // */
+	/* Check PSControl Configuration */
+	if (pAd->StaCfg.PSControl.field.EnableNewPS == FALSE)
+		return;
+
+	/*3090 will not execute the following codes. */
+	/* Check interface : If not PCIe interface, return. */
+
+#ifdef RT3090
+	if ((pObj->DeviceID == NIC3090_PCIe_DEVICE_ID)
+	    || (pObj->DeviceID == NIC3091_PCIe_DEVICE_ID)
+	    || (pObj->DeviceID == NIC3092_PCIe_DEVICE_ID))
+		return;
+#endif /* RT3090 // */
+
+	DBGPRINT(RT_DEBUG_TRACE, ("%s.===>\n", __func__));
+	PCIePowerSaveLevel = pAd->PCIePowerSaveLevel;
+	if ((PCIePowerSaveLevel & 0xff) == 0xff) {
+		DBGPRINT(RT_DEBUG_TRACE, ("return  \n"));
+		return;
+	}
+
+	if (pObj->parent_pci_dev && (pAd->HostLnkCtrlOffset != 0)) {
+		PCI_REG_READ_WORD(pObj->parent_pci_dev, pAd->HostLnkCtrlOffset,
+				  Configuration);
+		if ((Configuration != 0) && (Configuration != 0xFFFF)) {
+			Configuration &= 0xfefc;
+			/* If call from interface down, restore to orginial setting. */
+			if (Level == RESTORE_CLOSE) {
+				Configuration |= pAd->HostLnkCtrlConfiguration;
+			} else
+				Configuration |= 0x0;
+			PCI_REG_WIRTE_WORD(pObj->parent_pci_dev,
+					   pAd->HostLnkCtrlOffset,
+					   Configuration);
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("Restore PCI host : offset 0x%x = 0x%x\n",
+				  pAd->HostLnkCtrlOffset, Configuration));
+		} else
+			DBGPRINT(RT_DEBUG_ERROR,
+				 ("Restore PCI host : PCI_REG_READ_WORD failed (Configuration = 0x%x)\n",
+				  Configuration));
+	}
+
+	if (pObj->pci_dev && (pAd->RLnkCtrlOffset != 0)) {
+		PCI_REG_READ_WORD(pObj->pci_dev, pAd->RLnkCtrlOffset,
+				  Configuration);
+		if ((Configuration != 0) && (Configuration != 0xFFFF)) {
+			Configuration &= 0xfefc;
+			/* If call from interface down, restore to orginial setting. */
+			if (Level == RESTORE_CLOSE)
+				Configuration |= pAd->RLnkCtrlConfiguration;
+			else
+				Configuration |= 0x0;
+			PCI_REG_WIRTE_WORD(pObj->pci_dev, pAd->RLnkCtrlOffset,
+					   Configuration);
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("Restore Ralink : offset 0x%x = 0x%x\n",
+				  pAd->RLnkCtrlOffset, Configuration));
+		} else
+			DBGPRINT(RT_DEBUG_ERROR,
+				 ("Restore Ralink : PCI_REG_READ_WORD failed (Configuration = 0x%x)\n",
+				  Configuration));
+	}
+
+	DBGPRINT(RT_DEBUG_TRACE, ("%s <===\n", __func__));
+}
+
+/*
+	========================================================================
+
+	Routine Description:
+
+	Arguments:
+		Max : limit Host PCI and Ralink PCIe device's LINK CONTROL field's value.
+		Because now frequently set our device to mode 1 or mode 3 will cause problem.
+
+	========================================================================
+*/
+void RTMPPCIeLinkCtrlSetting(struct rt_rtmp_adapter *pAd, u16 Max)
+{
+	u16 PCIePowerSaveLevel, reg16;
+	u16 Configuration;
+	struct os_cookie *pObj;
+
+	pObj = (struct os_cookie *)pAd->OS_Cookie;
+
+	if (!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE))
+		return;
+
+#ifdef RT2860
+	if (!((pObj->DeviceID == NIC2860_PCIe_DEVICE_ID)
+	      || (pObj->DeviceID == NIC2790_PCIe_DEVICE_ID)))
+		return;
+#endif /* RT2860 // */
+	/* Check PSControl Configuration */
+	if (pAd->StaCfg.PSControl.field.EnableNewPS == FALSE)
+		return;
+
+	/* Check interface : If not PCIe interface, return. */
+	/*Block 3090 to enter the following function */
+
+#ifdef RT3090
+	if ((pObj->DeviceID == NIC3090_PCIe_DEVICE_ID)
+	    || (pObj->DeviceID == NIC3091_PCIe_DEVICE_ID)
+	    || (pObj->DeviceID == NIC3092_PCIe_DEVICE_ID))
+		return;
+#endif /* RT3090 // */
+	if (!RTMP_TEST_PSFLAG(pAd, fRTMP_PS_CAN_GO_SLEEP)) {
+		DBGPRINT(RT_DEBUG_INFO,
+			 ("RTMPPCIePowerLinkCtrl return on fRTMP_PS_CAN_GO_SLEEP flag\n"));
+		return;
+	}
+
+	DBGPRINT(RT_DEBUG_TRACE, ("%s===>\n", __func__));
+	PCIePowerSaveLevel = pAd->PCIePowerSaveLevel;
+	if ((PCIePowerSaveLevel & 0xff) == 0xff) {
+		DBGPRINT(RT_DEBUG_TRACE, ("return  \n"));
+		return;
+	}
+	PCIePowerSaveLevel = PCIePowerSaveLevel >> 6;
+
+	/* Skip non-exist deice right away */
+	if (pObj->parent_pci_dev && (pAd->HostLnkCtrlOffset != 0)) {
+		PCI_REG_READ_WORD(pObj->parent_pci_dev, pAd->HostLnkCtrlOffset,
+				  Configuration);
+		switch (PCIePowerSaveLevel) {
+		case 0:
+			/* Set b0 and b1 of LinkControl (both 2892 and PCIe bridge) to 00 */
+			Configuration &= 0xfefc;
+			break;
+		case 1:
+			/* Set b0 and b1 of LinkControl (both 2892 and PCIe bridge) to 01 */
+			Configuration &= 0xfefc;
+			Configuration |= 0x1;
+			break;
+		case 2:
+			/*  Set b0 and b1 of LinkControl (both 2892 and PCIe bridge) to 11 */
+			Configuration &= 0xfefc;
+			Configuration |= 0x3;
+			break;
+		case 3:
+			/* Set b0 and b1 of LinkControl (both 2892 and PCIe bridge) to 11 and bit 8 of LinkControl of 2892 to 1 */
+			Configuration &= 0xfefc;
+			Configuration |= 0x103;
+			break;
+		}
+		PCI_REG_WIRTE_WORD(pObj->parent_pci_dev, pAd->HostLnkCtrlOffset,
+				   Configuration);
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("Write PCI host offset 0x%x = 0x%x\n",
+			  pAd->HostLnkCtrlOffset, Configuration));
+	}
+
+	if (pObj->pci_dev && (pAd->RLnkCtrlOffset != 0)) {
+		/* first 2892 chip not allow to frequently set mode 3. will cause hang problem. */
+		if (PCIePowerSaveLevel > Max)
+			PCIePowerSaveLevel = Max;
+
+		PCI_REG_READ_WORD(pObj->pci_dev, pAd->RLnkCtrlOffset,
+				  Configuration);
+		switch (PCIePowerSaveLevel) {
+		case 0:
+			/* No PCI power safe */
+			/* Set b0 and b1 of LinkControl (both 2892 and PCIe bridge) to 00 . */
+			Configuration &= 0xfefc;
+			break;
+		case 1:
+			/*  L0 */
+			/* Set b0 and b1 of LinkControl (both 2892 and PCIe bridge) to 01 . */
+			Configuration &= 0xfefc;
+			Configuration |= 0x1;
+			break;
+		case 2:
+			/* L0 and L1 */
+			/*  Set b0 and b1 of LinkControl (both 2892 and PCIe bridge) to 11 */
+			Configuration &= 0xfefc;
+			Configuration |= 0x3;
+			break;
+		case 3:
+			/* L0 , L1 and clock management. */
+			/* Set b0 and b1 of LinkControl (both 2892 and PCIe bridge) to 11 and bit 8 of LinkControl of 2892 to 1 */
+			Configuration &= 0xfefc;
+			Configuration |= 0x103;
+			pAd->bPCIclkOff = TRUE;
+			break;
+		}
+		PCI_REG_WIRTE_WORD(pObj->pci_dev, pAd->RLnkCtrlOffset,
+				   Configuration);
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("Write Ralink device : offset 0x%x = 0x%x\n",
+			  pAd->RLnkCtrlOffset, Configuration));
+	}
+
+	DBGPRINT(RT_DEBUG_TRACE, ("RTMPPCIePowerLinkCtrl <==============\n"));
+}
+
+/*
+	========================================================================
+
+	Routine Description:
+		1. Write a PCI register for rt30xx power solution 3
+
+	========================================================================
+*/
+void RTMPrt3xSetPCIePowerLinkCtrl(struct rt_rtmp_adapter *pAd)
+{
+
+	unsigned long HostConfiguration = 0;
+	unsigned long Configuration;
+	struct os_cookie *pObj;
+	int pos;
+	u16 reg16;
+
+	pObj = (struct os_cookie *)pAd->OS_Cookie;
+
+	DBGPRINT(RT_DEBUG_INFO,
+		 ("RTMPrt3xSetPCIePowerLinkCtrl.===> %lx\n",
+		  pAd->StaCfg.PSControl.word));
+
+	/* Check PSControl Configuration */
+	if (pAd->StaCfg.PSControl.field.EnableNewPS == FALSE)
+		return;
+	RTMPFindHostPCIDev(pAd);
+	if (pObj->parent_pci_dev) {
+		/* Find PCI-to-PCI Bridge Express Capability Offset */
+		pos = pci_find_capability(pObj->parent_pci_dev, PCI_CAP_ID_EXP);
+
+		if (pos != 0) {
+			pAd->HostLnkCtrlOffset = pos + PCI_EXP_LNKCTL;
+		}
+		/* If configurared to turn on L1. */
+		HostConfiguration = 0;
+		if (pAd->StaCfg.PSControl.field.rt30xxForceASPMTest == 1) {
+			DBGPRINT(RT_DEBUG_TRACE, ("Enter,PSM : Force ASPM \n"));
+
+			/* Skip non-exist deice right away */
+			if ((pAd->HostLnkCtrlOffset != 0)) {
+				PCI_REG_READ_WORD(pObj->parent_pci_dev,
+						  pAd->HostLnkCtrlOffset,
+						  HostConfiguration);
+				/* Prepare Configuration to write to Host */
+				HostConfiguration |= 0x3;
+				PCI_REG_WIRTE_WORD(pObj->parent_pci_dev,
+						   pAd->HostLnkCtrlOffset,
+						   HostConfiguration);
+				pAd->Rt3xxHostLinkCtrl = HostConfiguration;
+				/* Because in rt30xxForceASPMTest Mode, Force turn on L0s, L1. */
+				/* Fix HostConfiguration bit0:1 = 0x3 for later use. */
+				HostConfiguration = 0x3;
+				DBGPRINT(RT_DEBUG_TRACE,
+					 ("PSM : Force ASPM : "
+					  "Host device L1/L0s Value =  0x%lx\n",
+					  HostConfiguration));
+			}
+		} else if (pAd->StaCfg.PSControl.field.rt30xxFollowHostASPM ==
+			   1) {
+
+			/* Skip non-exist deice right away */
+			if ((pAd->HostLnkCtrlOffset != 0)) {
+				PCI_REG_READ_WORD(pObj->parent_pci_dev,
+						  pAd->HostLnkCtrlOffset,
+						  HostConfiguration);
+				pAd->Rt3xxHostLinkCtrl = HostConfiguration;
+				HostConfiguration &= 0x3;
+				DBGPRINT(RT_DEBUG_TRACE,
+					 ("PSM : Follow Host ASPM : "
+					  "Host device L1/L0s Value =  0x%lx\n",
+					  HostConfiguration));
+			}
+		}
+	}
+	/* Prepare to write Ralink setting. */
+	/* Find Ralink PCIe Device's Express Capability Offset */
+	pos = pci_find_capability(pObj->pci_dev, PCI_CAP_ID_EXP);
+
+	if (pos != 0) {
+		/* Ralink PCIe Device's Link Control Register Offset */
+		pAd->RLnkCtrlOffset = pos + PCI_EXP_LNKCTL;
+		pci_read_config_word(pObj->pci_dev, pAd->RLnkCtrlOffset,
+				     &reg16);
+		Configuration = le2cpu16(reg16);
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("Read (Ralink PCIe Link Control Register) "
+			  "offset 0x%x = 0x%lx\n",
+			  pAd->RLnkCtrlOffset, Configuration));
+		Configuration |= 0x100;
+		if ((pAd->StaCfg.PSControl.field.rt30xxFollowHostASPM == 1)
+		    || (pAd->StaCfg.PSControl.field.rt30xxForceASPMTest == 1)) {
+			switch (HostConfiguration) {
+			case 0:
+				Configuration &= 0xffffffc;
+				break;
+			case 1:
+				Configuration &= 0xffffffc;
+				Configuration |= 0x1;
+				break;
+			case 2:
+				Configuration &= 0xffffffc;
+				Configuration |= 0x2;
+				break;
+			case 3:
+				Configuration |= 0x3;
+				break;
+			}
+		}
+		reg16 = cpu2le16(Configuration);
+		pci_write_config_word(pObj->pci_dev, pAd->RLnkCtrlOffset,
+				      reg16);
+		pAd->Rt3xxRalinkLinkCtrl = Configuration;
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("PSM :Write Ralink device L1/L0s Value =  0x%lx\n",
+			  Configuration));
+	}
+	DBGPRINT(RT_DEBUG_INFO,
+		 ("PSM :RTMPrt3xSetPCIePowerLinkCtrl <==============\n"));
+}
diff --git a/drivers/staging/rt2860/rt2860.h b/drivers/staging/rt2860/rt2860.h
deleted file mode 100644
index ed28fe5757c9..000000000000
--- a/drivers/staging/rt2860/rt2860.h
+++ /dev/null
@@ -1,333 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
- */
-
-#ifndef __RT2860_H__
-#define __RT2860_H__
-
-#define RT28xx_CHIP_NAME	"RT2860"
-
-#define TXINFO_SIZE               0
-#define TXPADDING_SIZE      	  0
-
-/* ----------------- EEPROM Related MACRO ----------------- */
-#define RT28xx_EEPROM_READ16(pAd, offset, var)		\
-	var = RTMP_EEPROM_READ16(pAd, offset)
-
-#define RT28xx_EEPROM_WRITE16(pAd, offset, var)		\
-	RTMP_EEPROM_WRITE16(pAd, offset, var)
-
-/* ----------------- TASK/THREAD Related MACRO ----------------- */
-#define RT28XX_TASK_THREAD_INIT(pAd, Status)		\
-	init_thread_task(pAd); NICInitTxRxRingAndBacklogQueue(pAd);	\
-	Status = NDIS_STATUS_SUCCESS;
-
-/* function declarations */
-#define IRQ_HANDLE_TYPE  irqreturn_t
-
-IRQ_HANDLE_TYPE
-rt2860_interrupt(int irq, void *dev_instance);
-
-/* ----------------- Frimware Related MACRO ----------------- */
-#define RT28XX_WRITE_FIRMWARE(_pAd, _pFwImage, _FwLen)				\
-	do{																\
-		ULONG	_i, _firm;											\
-		RTMP_IO_WRITE32(_pAd, PBF_SYS_CTRL, 0x10000);				\
-																	\
-		for(_i=0; _i<_FwLen; _i+=4)									\
-		{															\
-			_firm = _pFwImage[_i] +									\
-			   (_pFwImage[_i+3] << 24) +							\
-			   (_pFwImage[_i+2] << 16) +							\
-			   (_pFwImage[_i+1] << 8);								\
-			RTMP_IO_WRITE32(_pAd, FIRMWARE_IMAGE_BASE + _i, _firm);	\
-		}															\
-		RTMP_IO_WRITE32(_pAd, PBF_SYS_CTRL, 0x00000);				\
-		RTMP_IO_WRITE32(_pAd, PBF_SYS_CTRL, 0x00001);				\
-																	\
-		/* initialize BBP R/W access agent */						\
-		RTMP_IO_WRITE32(_pAd, H2M_BBP_AGENT, 0);					\
-		RTMP_IO_WRITE32(_pAd, H2M_MAILBOX_CSR, 0);					\
-	}while(0)
-
-/* ----------------- TX Related MACRO ----------------- */
-#define RT28XX_START_DEQUEUE(pAd, QueIdx, irqFlags)		do{}while(0)
-#define RT28XX_STOP_DEQUEUE(pAd, QueIdx, irqFlags)		do{}while(0)
-
-
-#define RT28XX_HAS_ENOUGH_FREE_DESC(pAd, pTxBlk, freeNum, pPacket) \
-		((freeNum) >= (ULONG)(pTxBlk->TotalFragNum + RTMP_GET_PACKET_FRAGMENTS(pPacket) + 3)) /* rough estimate we will use 3 more descriptor. */
-#define RT28XX_RELEASE_DESC_RESOURCE(pAd, QueIdx)					\
-		do{}while(0)
-
-#define NEED_QUEUE_BACK_FOR_AGG(pAd, QueIdx, freeNum, _TxFrameType) \
-		(((freeNum != (TX_RING_SIZE-1)) && (pAd->TxSwQueue[QueIdx].Number == 0)) || (freeNum<3))
-		//(((freeNum) != (TX_RING_SIZE-1)) && (pAd->TxSwQueue[QueIdx].Number == 1 /*0*/))
-
-
-#define HAL_KickOutMgmtTx(_pAd, _QueIdx, _pPacket, _pSrcBufVA, _SrcBufLen)	\
-			RtmpPCIMgmtKickOut(_pAd, _QueIdx, _pPacket, _pSrcBufVA, _SrcBufLen)
-
-#define RTMP_PKT_TAIL_PADDING 0
-
-#define fRTMP_ADAPTER_NEED_STOP_TX	0
-
-#define HAL_WriteSubTxResource(pAd, pTxBlk, bIsLast, pFreeNumber)	\
-		/* RtmpPCI_WriteSubTxResource(pAd, pTxBlk, bIsLast, pFreeNumber)*/
-
-#define HAL_WriteTxResource(pAd, pTxBlk,bIsLast, pFreeNumber)	\
-			RtmpPCI_WriteSingleTxResource(pAd, pTxBlk, bIsLast, pFreeNumber)
-
-#define HAL_WriteFragTxResource(pAd, pTxBlk, fragNum, pFreeNumber) \
-			RtmpPCI_WriteFragTxResource(pAd, pTxBlk, fragNum, pFreeNumber)
-
-#define HAL_WriteMultiTxResource(pAd, pTxBlk,frameNum, pFreeNumber)	\
-			RtmpPCI_WriteMultiTxResource(pAd, pTxBlk, frameNum, pFreeNumber)
-
-#define HAL_FinalWriteTxResource(_pAd, _pTxBlk, _TotalMPDUSize, _FirstTxIdx)	\
-			RtmpPCI_FinalWriteTxResource(_pAd, _pTxBlk, _TotalMPDUSize, _FirstTxIdx)
-
-#define HAL_LastTxIdx(_pAd, _QueIdx,_LastTxIdx) \
-			/*RtmpPCIDataLastTxIdx(_pAd, _QueIdx,_LastTxIdx)*/
-
-#define HAL_KickOutTx(_pAd, _pTxBlk, _QueIdx)	\
-			RTMP_IO_WRITE32((_pAd), TX_CTX_IDX0+((_QueIdx)*0x10), (_pAd)->TxRing[(_QueIdx)].TxCpuIdx)
-/*			RtmpPCIDataKickOut(_pAd, _pTxBlk, _QueIdx)*/
-
-#define HAL_KickOutNullFrameTx(_pAd, _QueIdx, _pNullFrame, _frameLen)	\
-			MiniportMMRequest(_pAd, _QueIdx, _pNullFrame, _frameLen)
-
-#define GET_TXRING_FREENO(_pAd, _QueIdx) \
-	(_pAd->TxRing[_QueIdx].TxSwFreeIdx > _pAd->TxRing[_QueIdx].TxCpuIdx)	? \
-			(_pAd->TxRing[_QueIdx].TxSwFreeIdx - _pAd->TxRing[_QueIdx].TxCpuIdx - 1) \
-			 :	\
-			(_pAd->TxRing[_QueIdx].TxSwFreeIdx + TX_RING_SIZE - _pAd->TxRing[_QueIdx].TxCpuIdx - 1);
-
-
-#define GET_MGMTRING_FREENO(_pAd) \
-	(_pAd->MgmtRing.TxSwFreeIdx > _pAd->MgmtRing.TxCpuIdx)	? \
-			(_pAd->MgmtRing.TxSwFreeIdx - _pAd->MgmtRing.TxCpuIdx - 1) \
-			 :	\
-			(_pAd->MgmtRing.TxSwFreeIdx + MGMT_RING_SIZE - _pAd->MgmtRing.TxCpuIdx - 1);
-
-
-/* ----------------- RX Related MACRO ----------------- */
-
-// no use
-#define RT28XX_RCV_PKT_GET_INIT(pAd)
-#define RT28XX_RV_A_BUF_END
-//#define RT28XX_RV_ALL_BUF_END
-
-
-/* ----------------- ASIC Related MACRO ----------------- */
-// no use
-#define RT28XX_DMA_POST_WRITE(pAd)
-
-// reset MAC of a station entry to 0x000000000000
-#define RT28XX_STA_ENTRY_MAC_RESET(pAd, Wcid)						\
-	AsicDelWcidTab(pAd, Wcid);
-
-// add this entry into ASIC RX WCID search table
-#define RT28XX_STA_ENTRY_ADD(pAd, pEntry)							\
-	AsicUpdateRxWCIDTable(pAd, pEntry->Aid, pEntry->Addr);
-
-// remove Pair-wise key material from ASIC
-#define RT28XX_STA_ENTRY_KEY_DEL(pAd, BssIdx, Wcid)					\
-	AsicRemovePairwiseKeyEntry(pAd, BssIdx, (UCHAR)Wcid);
-
-// add Client security information into ASIC WCID table and IVEIV table
-#define RT28XX_STA_SECURITY_INFO_ADD(pAd, apidx, KeyID, pEntry)		\
-	RTMPAddWcidAttributeEntry(pAd, apidx, KeyID, 					\
-							pAd->SharedKey[apidx][KeyID].CipherAlg, pEntry);
-
-#define RT28XX_SECURITY_KEY_ADD(pAd, apidx, KeyID, pEntry)				\
-	{	/* update pairwise key information to ASIC Shared Key Table */	\
-		AsicAddSharedKeyEntry(pAd, apidx, KeyID,						\
-						  pAd->SharedKey[apidx][KeyID].CipherAlg,		\
-						  pAd->SharedKey[apidx][KeyID].Key,				\
-						  pAd->SharedKey[apidx][KeyID].TxMic,			\
-						  pAd->SharedKey[apidx][KeyID].RxMic);			\
-		/* update ASIC WCID attribute table and IVEIV table */			\
-		RTMPAddWcidAttributeEntry(pAd, apidx, KeyID,					\
-						  pAd->SharedKey[apidx][KeyID].CipherAlg,		\
-						  pEntry); }
-
-
-// Insert the BA bitmap to ASIC for the Wcid entry
-#define RT28XX_ADD_BA_SESSION_TO_ASIC(_pAd, _Aid, _TID)					\
-		do{																\
-			UINT32	_Value = 0, _Offset;									\
-			_Offset = MAC_WCID_BASE + (_Aid) * HW_WCID_ENTRY_SIZE + 4;	\
-			RTMP_IO_READ32((_pAd), _Offset, &_Value);					\
-			_Value |= (0x10000<<(_TID));								\
-			RTMP_IO_WRITE32((_pAd), _Offset, _Value);					\
-		}while(0)
-
-
-// Remove the BA bitmap from ASIC for the Wcid entry
-//		bitmap field starts at 0x10000 in ASIC WCID table
-#define RT28XX_DEL_BA_SESSION_FROM_ASIC(_pAd, _Wcid, _TID)				\
-		do{																\
-			UINT32	_Value = 0, _Offset;									\
-			_Offset = MAC_WCID_BASE + (_Wcid) * HW_WCID_ENTRY_SIZE + 4;	\
-			RTMP_IO_READ32((_pAd), _Offset, &_Value);					\
-			_Value &= (~(0x10000 << (_TID)));							\
-			RTMP_IO_WRITE32((_pAd), _Offset, _Value);			\
-		}while(0)
-
-
-/* ----------------- PCI/USB Related MACRO ----------------- */
-
-#define RT28XX_HANDLE_DEV_ASSIGN(handle, dev_p)				\
-	((POS_COOKIE)handle)->pci_dev = dev_p;
-
-// set driver data
-#define RT28XX_DRVDATA_SET(_a)			pci_set_drvdata(_a, net_dev);
-
-#define RT28XX_UNMAP()										\
-{	if (net_dev->base_addr)	{								\
-		iounmap((void *)(net_dev->base_addr));				\
-		release_mem_region(pci_resource_start(dev_p, 0),	\
-							pci_resource_len(dev_p, 0)); }	\
-	if (net_dev->irq) pci_release_regions(dev_p); }
-
-#ifdef PCI_MSI_SUPPORT
-#define RTMP_MSI_ENABLE(_pAd) \
-{ 	POS_COOKIE _pObj = (POS_COOKIE)(_pAd->OS_Cookie); \
-	(_pAd)->HaveMsi =	pci_enable_msi(_pObj->pci_dev) == 0 ? TRUE : FALSE; }
-
-#define RTMP_MSI_DISABLE(_pAd) \
-{ 	POS_COOKIE _pObj = (POS_COOKIE)(_pAd->OS_Cookie); \
-	if (_pAd->HaveMsi == TRUE) \
-		pci_disable_msi(_pObj->pci_dev); \
-	_pAd->HaveMsi = FALSE;	}
-#else
-#define RTMP_MSI_ENABLE(_pAd)
-#define RTMP_MSI_DISABLE(_pAd)
-#endif // PCI_MSI_SUPPORT //
-
-#define SA_SHIRQ IRQF_SHARED
-
-#define RT28XX_IRQ_REQUEST(net_dev)							\
-{	PRTMP_ADAPTER _pAd = (PRTMP_ADAPTER)((net_dev)->ml_priv);	\
-	POS_COOKIE _pObj = (POS_COOKIE)(_pAd->OS_Cookie);		\
-	RTMP_MSI_ENABLE(_pAd);									\
-	if ((retval = request_irq(_pObj->pci_dev->irq, 		\
-							rt2860_interrupt, SA_SHIRQ,		\
-							(net_dev)->name, (net_dev)))) {	\
-		printk("RT2860: request_irq  ERROR(%d)\n", retval);	\
-	return retval; } }
-
-#define RT28XX_IRQ_RELEASE(net_dev)								\
-{	PRTMP_ADAPTER _pAd = (PRTMP_ADAPTER)((net_dev)->ml_priv);		\
-	POS_COOKIE _pObj = (POS_COOKIE)(_pAd->OS_Cookie);			\
-	synchronize_irq(_pObj->pci_dev->irq);						\
-	free_irq(_pObj->pci_dev->irq, (net_dev));					\
-	RTMP_MSI_DISABLE(_pAd); }
-
-#define RT28XX_IRQ_INIT(pAd)										\
-	{	pAd->int_enable_reg = ((DELAYINTMASK) |						\
-							(RxINT|TxDataInt|TxMgmtInt)) & ~(0x03);	\
-		pAd->int_disable_mask = 0;									\
-		pAd->int_pending = 0; }
-
-#define RT28XX_IRQ_ENABLE(pAd)									\
-	{	/* clear garbage ints */								\
-		RTMP_IO_WRITE32(pAd, INT_SOURCE_CSR, 0xffffffff);		\
-		NICEnableInterrupt(pAd); }
-
-#define RT28XX_PUT_DEVICE(dev_p)
-
-
-/* ----------------- MLME Related MACRO ----------------- */
-#define RT28XX_MLME_HANDLER(pAd)			MlmeHandler(pAd)
-
-#define RT28XX_MLME_PRE_SANITY_CHECK(pAd)
-
-#define RT28XX_MLME_STA_QUICK_RSP_WAKE_UP(pAd)	\
-	RTMPSetTimer(&pAd->StaCfg.StaQuickResponeForRateUpTimer, 100);
-
-#define RT28XX_MLME_RESET_STATE_MACHINE(pAd)	\
-		MlmeRestartStateMachine(pAd)
-
-#define RT28XX_HANDLE_COUNTER_MEASURE(_pAd, _pEntry)		\
-		HandleCounterMeasure(_pAd, _pEntry)
-
-/* ----------------- Power Save Related MACRO ----------------- */
-#define RT28XX_PS_POLL_ENQUEUE(pAd)				EnqueuePsPoll(pAd)
-
-//
-// Device ID & Vendor ID, these values should match EEPROM value
-//
-#define NIC2860_PCI_DEVICE_ID   0x0601
-#define NIC2860_PCIe_DEVICE_ID  0x0681
-#define NIC2760_PCI_DEVICE_ID   0x0701		// 1T/2R Cardbus ???
-#define NIC2790_PCIe_DEVICE_ID  0x0781	    // 1T/2R miniCard
-
-#define NIC_PCI_VENDOR_ID       0x1814
-
-#define VEN_AWT_PCIe_DEVICE_ID	0x1059
-#define VEN_AWT_PCI_VENDOR_ID	0x1A3B
-
-#define EDIMAX_PCI_VENDOR_ID	0x1432
-
-// For RTMPPCIePowerLinkCtrlRestore () function
-#define RESTORE_HALT		    1
-#define RESTORE_WAKEUP		    2
-#define RESTORE_CLOSE           3
-
-#define PowerSafeCID		1
-#define PowerRadioOffCID		2
-#define PowerWakeCID		3
-#define CID0MASK		0x000000ff
-#define CID1MASK		0x0000ff00
-#define CID2MASK		0x00ff0000
-#define CID3MASK		0xff000000
-
-#define PCI_REG_READ_WORD(pci_dev, offset, Configuration)   \
-    if (pci_read_config_word(pci_dev, offset, &reg16) == 0)     \
-        Configuration = le2cpu16(reg16);                        \
-    else                                                        \
-        Configuration = 0;
-
-#define PCI_REG_WIRTE_WORD(pci_dev, offset, Configuration)  \
-    reg16 = cpu2le16(Configuration);                        \
-    pci_write_config_word(pci_dev, offset, reg16);          \
-
-#define RT28XX_STA_FORCE_WAKEUP(pAd, Level) \
-    RT28xxPciStaAsicForceWakeup(pAd, Level);
-
-#define RT28XX_STA_SLEEP_THEN_AUTO_WAKEUP(pAd, TbttNumToNextWakeUp) \
-    RT28xxPciStaAsicSleepThenAutoWakeup(pAd, TbttNumToNextWakeUp);
-
-#define RT28XX_MLME_RADIO_ON(pAd) \
-    RT28xxPciMlmeRadioOn(pAd);
-
-#define RT28XX_MLME_RADIO_OFF(pAd) \
-    RT28xxPciMlmeRadioOFF(pAd);
-
-#endif //__RT2860_H__
-
diff --git a/drivers/staging/rt2860/rt28xx.h b/drivers/staging/rt2860/rt28xx.h
deleted file mode 100644
index c08525002cc2..000000000000
--- a/drivers/staging/rt2860/rt28xx.h
+++ /dev/null
@@ -1,1688 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-	Module Name:
-	rt28xx.h
-
-	Abstract:
-	RT28xx ASIC related definition & structures
-
-	Revision History:
-	Who			When		  What
-	--------	----------	  ----------------------------------------------
-       Jan Lee           Jan-3-2006     created for RT2860c
-*/
-
-#ifndef	__RT28XX_H__
-#define	__RT28XX_H__
-
-
-//
-// PCI registers - base address 0x0000
-//
-#define PCI_CFG			0x0000
-#define PCI_EECTRL			0x0004
-#define PCI_MCUCTRL			0x0008
-
-typedef int NTSTATUS;
-
-#define	OPT_14			0x114
-
-//
-// SCH/DMA registers - base address 0x0200
-//
-// INT_SOURCE_CSR: Interrupt source register. Write one to clear corresponding bit
-//
-#define DMA_CSR0      0x200
-#define INT_SOURCE_CSR      0x200
-typedef	union	_INT_SOURCE_CSR_STRUC	{
-	struct	{
-		UINT32		RxDelayINT:1;
-		UINT32		TxDelayINT:1;
-		UINT32		RxDone:1;
-		UINT32		Ac0DmaDone:1;//4
-		UINT32       	Ac1DmaDone:1;
-		UINT32       	Ac2DmaDone:1;
-		UINT32       	Ac3DmaDone:1;
-		UINT32       	HccaDmaDone:1; // bit7
-		UINT32       	MgmtDmaDone:1;
-		UINT32       	MCUCommandINT:1;//bit 9
-		UINT32       	RxTxCoherent:1;
-		UINT32       	TBTTInt:1;
-		UINT32       	PreTBTT:1;
-		UINT32       	TXFifoStatusInt:1;//FIFO Statistics is full, sw should read 0x171c
-		UINT32       	AutoWakeup:1;//bit14
-		UINT32       	GPTimer:1;
-		UINT32       	RxCoherent:1;//bit16
-		UINT32       	TxCoherent:1;
-		UINT32       	:14;
-	}	field;
-	UINT32			word;
-} INT_SOURCE_CSR_STRUC, *PINT_SOURCE_CSR_STRUC;
-
-//
-// INT_MASK_CSR:   Interrupt MASK register.   1: the interrupt is mask OFF
-//
-#define INT_MASK_CSR        0x204
-typedef	union	_INT_MASK_CSR_STRUC	{
-	struct	{
-		UINT32		RXDelay_INT_MSK:1;
-		UINT32		TxDelay:1;
-		UINT32		RxDone:1;
-		UINT32		Ac0DmaDone:1;
-		UINT32       	Ac1DmaDone:1;
-		UINT32       	Ac2DmaDone:1;
-		UINT32       	Ac3DmaDone:1;
-		UINT32       	HccaDmaDone:1;
-		UINT32       	MgmtDmaDone:1;
-		UINT32       	MCUCommandINT:1;
-		UINT32       	:20;
-		UINT32       	RxCoherent:1;
-		UINT32       	TxCoherent:1;
-	}	field;
-	UINT32			word;
-} INT_MASK_CSR_STRUC, *PINT_MASK_CSR_STRUC;
-
-#define WPDMA_GLO_CFG 	0x208
-typedef	union	_WPDMA_GLO_CFG_STRUC	{
-	struct	{
-		UINT32		EnableTxDMA:1;
-		UINT32		TxDMABusy:1;
-		UINT32		EnableRxDMA:1;
-		UINT32		RxDMABusy:1;
-		UINT32       	WPDMABurstSIZE:2;
-		UINT32       	EnTXWriteBackDDONE:1;
-		UINT32       	BigEndian:1;
-		UINT32       	RXHdrScater:8;
-		UINT32       	HDR_SEG_LEN:16;
-	}	field;
-	UINT32			word;
-} WPDMA_GLO_CFG_STRUC, *PWPDMA_GLO_CFG_STRUC;
-
-#define WPDMA_RST_IDX 	0x20c
-typedef	union	_WPDMA_RST_IDX_STRUC	{
-	struct	{
-		UINT32		RST_DTX_IDX0:1;
-		UINT32		RST_DTX_IDX1:1;
-		UINT32		RST_DTX_IDX2:1;
-		UINT32		RST_DTX_IDX3:1;
-		UINT32       	RST_DTX_IDX4:1;
-		UINT32       	RST_DTX_IDX5:1;
-		UINT32       	rsv:10;
-		UINT32       	RST_DRX_IDX0:1;
-		UINT32       	:15;
-	}	field;
-	UINT32			word;
-} WPDMA_RST_IDX_STRUC, *PWPDMA_RST_IDX_STRUC;
-
-#define DELAY_INT_CFG  0x0210
-typedef	union	_DELAY_INT_CFG_STRUC	{
-	struct	{
-		UINT32		RXMAX_PTIME:8;
-		UINT32       	RXMAX_PINT:7;
-		UINT32       	RXDLY_INT_EN:1;
-		UINT32       	TXMAX_PTIME:8;
-		UINT32       	TXMAX_PINT:7;
-		UINT32       	TXDLY_INT_EN:1;
-	}	field;
-	UINT32			word;
-} DELAY_INT_CFG_STRUC, *PDELAY_INT_CFG_STRUC;
-
-#define WMM_AIFSN_CFG   0x0214
-typedef	union	_AIFSN_CSR_STRUC	{
-	struct	{
-	    UINT32   Aifsn0:4;       // for AC_BE
-	    UINT32   Aifsn1:4;       // for AC_BK
-	    UINT32   Aifsn2:4;       // for AC_VI
-	    UINT32   Aifsn3:4;       // for AC_VO
-	    UINT32   Rsv:16;
-	}	field;
-	UINT32			word;
-}	AIFSN_CSR_STRUC, *PAIFSN_CSR_STRUC;
-
-//
-// CWMIN_CSR: CWmin for each EDCA AC
-//
-#define WMM_CWMIN_CFG   0x0218
-typedef	union	_CWMIN_CSR_STRUC	{
-	struct	{
-	    UINT32   Cwmin0:4;       // for AC_BE
-	    UINT32   Cwmin1:4;       // for AC_BK
-	    UINT32   Cwmin2:4;       // for AC_VI
-	    UINT32   Cwmin3:4;       // for AC_VO
-	    UINT32   Rsv:16;
-	}	field;
-	UINT32			word;
-}	CWMIN_CSR_STRUC, *PCWMIN_CSR_STRUC;
-
-//
-// CWMAX_CSR: CWmin for each EDCA AC
-//
-#define WMM_CWMAX_CFG   0x021c
-typedef	union	_CWMAX_CSR_STRUC	{
-	struct	{
-	    UINT32   Cwmax0:4;       // for AC_BE
-	    UINT32   Cwmax1:4;       // for AC_BK
-	    UINT32   Cwmax2:4;       // for AC_VI
-	    UINT32   Cwmax3:4;       // for AC_VO
-	    UINT32   Rsv:16;
-	}	field;
-	UINT32			word;
-}	CWMAX_CSR_STRUC, *PCWMAX_CSR_STRUC;
-
-//
-// AC_TXOP_CSR0: AC_BK/AC_BE TXOP register
-//
-#define WMM_TXOP0_CFG    0x0220
-typedef	union	_AC_TXOP_CSR0_STRUC	{
-	struct	{
-	    USHORT  Ac0Txop;        // for AC_BK, in unit of 32us
-	    USHORT  Ac1Txop;        // for AC_BE, in unit of 32us
-	}	field;
-	UINT32			word;
-}	AC_TXOP_CSR0_STRUC, *PAC_TXOP_CSR0_STRUC;
-
-//
-// AC_TXOP_CSR1: AC_VO/AC_VI TXOP register
-//
-#define WMM_TXOP1_CFG    0x0224
-typedef	union	_AC_TXOP_CSR1_STRUC	{
-	struct	{
-	    USHORT  Ac2Txop;        // for AC_VI, in unit of 32us
-	    USHORT  Ac3Txop;        // for AC_VO, in unit of 32us
-	}	field;
-	UINT32			word;
-}	AC_TXOP_CSR1_STRUC, *PAC_TXOP_CSR1_STRUC;
-
-#define RINGREG_DIFF			0x10
-#define GPIO_CTRL_CFG    0x0228	//MAC_CSR13
-#define MCU_CMD_CFG    0x022c
-#define TX_BASE_PTR0     0x0230	//AC_BK base address
-#define TX_MAX_CNT0      0x0234
-#define TX_CTX_IDX0       0x0238
-#define TX_DTX_IDX0      0x023c
-#define TX_BASE_PTR1     0x0240 	//AC_BE base address
-#define TX_MAX_CNT1      0x0244
-#define TX_CTX_IDX1       0x0248
-#define TX_DTX_IDX1      0x024c
-#define TX_BASE_PTR2     0x0250 	//AC_VI base address
-#define TX_MAX_CNT2      0x0254
-#define TX_CTX_IDX2       0x0258
-#define TX_DTX_IDX2      0x025c
-#define TX_BASE_PTR3     0x0260 	//AC_VO base address
-#define TX_MAX_CNT3      0x0264
-#define TX_CTX_IDX3       0x0268
-#define TX_DTX_IDX3      0x026c
-#define TX_BASE_PTR4     0x0270 	//HCCA base address
-#define TX_MAX_CNT4      0x0274
-#define TX_CTX_IDX4       0x0278
-#define TX_DTX_IDX4      0x027c
-#define TX_BASE_PTR5     0x0280 	//MGMT base address
-#define  TX_MAX_CNT5     0x0284
-#define TX_CTX_IDX5       0x0288
-#define TX_DTX_IDX5      0x028c
-#define TX_MGMTMAX_CNT      TX_MAX_CNT5
-#define TX_MGMTCTX_IDX       TX_CTX_IDX5
-#define TX_MGMTDTX_IDX      TX_DTX_IDX5
-#define RX_BASE_PTR     0x0290 	//RX base address
-#define RX_MAX_CNT      0x0294
-#define RX_CRX_IDX       0x0298
-#define RX_DRX_IDX      0x029c
-#define USB_DMA_CFG      0x02a0
-
-typedef	union	_USB_DMA_CFG_STRUC	{
-	struct	{
-	    UINT32  RxBulkAggTOut:8;        //Rx Bulk Aggregation TimeOut  in unit of 33ns
-	    UINT32  RxBulkAggLmt:8;        //Rx Bulk Aggregation Limit  in unit of 256 bytes
-	    UINT32  phyclear:1;        		//phy watch dog enable. write 1
-	    UINT32  rsv:2;
-	    UINT32  TxClear:1;        //Clear USB DMA TX path
-	    UINT32  TxopHalt:1;        //Halt TXOP count down when TX buffer is full.
-	    UINT32  RxBulkAggEn:1;        //Enable Rx Bulk Aggregation
-	    UINT32  RxBulkEn:1;        //Enable USB DMA Rx
-	    UINT32  TxBulkEn:1;        //Enable USB DMA Tx
-	    UINT32  EpoutValid:6;        //OUT endpoint data valid
-	    UINT32  RxBusy:1;        //USB DMA RX FSM busy
-	    UINT32  TxBusy:1;   	//USB DMA TX FSM busy
-	}	field;
-	UINT32			word;
-}	USB_DMA_CFG_STRUC, *PUSB_DMA_CFG_STRUC;
-
-//
-//  3  PBF  registers
-//
-//
-// Most are for debug. Driver doesn't touch PBF register.
-#define 	PBF_SYS_CTRL 	 0x0400
-#define     PBF_CFG                 0x0408
-#define 	PBF_MAX_PCNT 	 0x040C
-#define 	PBF_CTRL	 	0x0410
-#define 	PBF_INT_STA	 0x0414
-#define 	PBF_INT_ENA	 0x0418
-#define 	TXRXQ_PCNT  	 0x0438
-#define 	PBF_DBG 	 	 0x043c
-#define     PBF_CAP_CTRL     0x0440
-
-// eFuse registers
-#define EFUSE_CTRL              0x0580
-#define EFUSE_DATA0             0x0590
-#define EFUSE_DATA1             0x0594
-#define EFUSE_DATA2             0x0598
-#define EFUSE_DATA3             0x059c
-#define EFUSE_USAGE_MAP_START   0x2d0
-#define EFUSE_USAGE_MAP_END     0x2fc
-#define EFUSE_TAG               0x2fe
-#define EFUSE_USAGE_MAP_SIZE    45
-
-typedef	union	_EFUSE_CTRL_STRUC {
-	struct	{
-		UINT32            EFSROM_AOUT:6;
-		UINT32            EFSROM_MODE:2;
-		UINT32            EFSROM_LDO_OFF_TIME:6;
-		UINT32            EFSROM_LDO_ON_TIME:2;
-		UINT32            EFSROM_AIN:10;
-		UINT32            RESERVED:4;
-		UINT32            EFSROM_KICK:1;
-		UINT32            SEL_EFUSE:1;
-	}	field;
-	UINT32			word;
-}	EFUSE_CTRL_STRUC, *PEFUSE_CTRL_STRUC;
-
-#define LDO_CFG0 				0x05d4
-#define GPIO_SWITCH				0x05dc
-
-//
-//  4  MAC  registers
-//
-//
-//  4.1 MAC SYSTEM  configuration registers (offset:0x1000)
-//
-#define MAC_CSR0            0x1000
-typedef	union	_ASIC_VER_ID_STRUC	{
-	struct	{
-	    USHORT  ASICRev;        // reversion  : 0
-	    USHORT  ASICVer;        // version : 2860
-	}	field;
-	UINT32			word;
-}	ASIC_VER_ID_STRUC, *PASIC_VER_ID_STRUC;
-
-#define MAC_SYS_CTRL            0x1004		//MAC_CSR1
-#define MAC_ADDR_DW0            		0x1008		// MAC ADDR DW0
-#define MAC_ADDR_DW1           		 0x100c		// MAC ADDR DW1
-//
-// MAC_CSR2: STA MAC register 0
-//
-typedef	union	_MAC_DW0_STRUC	{
-	struct	{
-		UCHAR		Byte0;		// MAC address byte 0
-		UCHAR		Byte1;		// MAC address byte 1
-		UCHAR		Byte2;		// MAC address byte 2
-		UCHAR		Byte3;		// MAC address byte 3
-	}	field;
-	UINT32			word;
-}	MAC_DW0_STRUC, *PMAC_DW0_STRUC;
-
-//
-// MAC_CSR3: STA MAC register 1
-//
-typedef	union	_MAC_DW1_STRUC	{
-	struct	{
-		UCHAR		Byte4;		// MAC address byte 4
-		UCHAR		Byte5;		// MAC address byte 5
-		UCHAR		U2MeMask;
-		UCHAR		Rsvd1;
-	}	field;
-	UINT32			word;
-}	MAC_DW1_STRUC, *PMAC_DW1_STRUC;
-
-#define MAC_BSSID_DW0            		0x1010		// MAC BSSID DW0
-#define MAC_BSSID_DW1            		0x1014		// MAC BSSID DW1
-
-//
-// MAC_CSR5: BSSID register 1
-//
-typedef	union	_MAC_CSR5_STRUC	{
-	struct	{
-		UCHAR		Byte4;		 // BSSID byte 4
-		UCHAR		Byte5;		 // BSSID byte 5
-		USHORT      	BssIdMask:2; // 0: one BSSID, 10: 4 BSSID,  01: 2 BSSID , 11: 8BSSID
-		USHORT		MBssBcnNum:3;
-		USHORT		Rsvd:11;
-	}	field;
-	UINT32			word;
-}	MAC_CSR5_STRUC, *PMAC_CSR5_STRUC;
-
-#define MAX_LEN_CFG              0x1018		// rt2860b max 16k bytes. bit12:13 Maximum PSDU length (power factor) 0:2^13, 1:2^14, 2:2^15, 3:2^16
-#define BBP_CSR_CFG            		0x101c		//
-//
-// BBP_CSR_CFG: BBP serial control register
-//
-typedef	union	_BBP_CSR_CFG_STRUC	{
-	struct	{
-		UINT32		Value:8;			// Register	value to program into BBP
-		UINT32		RegNum:8;			// Selected	BBP	register
-		UINT32		fRead:1;		    // 0: Write	BBP, 1:	Read BBP
-		UINT32		Busy:1;				// 1: ASIC is busy execute BBP programming.
-		UINT32		BBP_PAR_DUR:1;		     // 0: 4 MAC clock cycles  1: 8 MAC clock cycles
-		UINT32		BBP_RW_MODE:1;		// 0: use serial mode  1:parallel
-		UINT32		:12;
-	}	field;
-	UINT32			word;
-}	BBP_CSR_CFG_STRUC, *PBBP_CSR_CFG_STRUC;
-
-#define RF_CSR_CFG0            		0x1020
-//
-// RF_CSR_CFG: RF control register
-//
-typedef	union	_RF_CSR_CFG0_STRUC	{
-	struct	{
-		UINT32		RegIdAndContent:24;			// Register	value to program into BBP
-		UINT32		bitwidth:5;			// Selected	BBP	register
-		UINT32		StandbyMode:1;		    // 0: high when stand by 1:	low when standby
-		UINT32		Sel:1;				// 0:RF_LE0 activate  1:RF_LE1 activate
-		UINT32		Busy:1;		    // 0: idle 1: 8busy
-	}	field;
-	UINT32			word;
-}	RF_CSR_CFG0_STRUC, *PRF_CSR_CFG0_STRUC;
-
-#define RF_CSR_CFG1           		0x1024
-typedef	union	_RF_CSR_CFG1_STRUC	{
-	struct	{
-		UINT32		RegIdAndContent:24;			// Register	value to program into BBP
-		UINT32		RFGap:5;			// Gap between BB_CONTROL_RF and RF_LE. 0: 3 system clock cycle (37.5usec) 1: 5 system clock cycle (62.5usec)
-		UINT32		rsv:7;		    // 0: idle 1: 8busy
-	}	field;
-	UINT32			word;
-}	RF_CSR_CFG1_STRUC, *PRF_CSR_CFG1_STRUC;
-
-#define RF_CSR_CFG2           		0x1028		//
-typedef	union	_RF_CSR_CFG2_STRUC	{
-	struct	{
-		UINT32		RegIdAndContent:24;			// Register	value to program into BBP
-		UINT32		rsv:8;		    // 0: idle 1: 8busy
-	}	field;
-	UINT32			word;
-}	RF_CSR_CFG2_STRUC, *PRF_CSR_CFG2_STRUC;
-
-#define LED_CFG           		0x102c		//  MAC_CSR14
-typedef	union	_LED_CFG_STRUC	{
-	struct	{
-		UINT32		OnPeriod:8;			// blinking on period unit 1ms
-		UINT32		OffPeriod:8;			// blinking off period unit 1ms
-		UINT32		SlowBlinkPeriod:6;			// slow blinking period. unit:1ms
-		UINT32		rsv:2;
-		UINT32		RLedMode:2;			// red Led Mode    0: off1: blinking upon TX2: periodic slow blinking3: always on
-		UINT32		GLedMode:2;			// green Led Mode
-		UINT32		YLedMode:2;			// yellow Led Mode
-		UINT32		LedPolar:1;			// Led Polarity.  0: active low1: active high
-		UINT32		:1;
-	}	field;
-	UINT32			word;
-}	LED_CFG_STRUC, *PLED_CFG_STRUC;
-
-//
-//  4.2 MAC TIMING  configuration registers (offset:0x1100)
-//
-#define XIFS_TIME_CFG             0x1100		 // MAC_CSR8  MAC_CSR9
-typedef	union	_IFS_SLOT_CFG_STRUC	{
-	struct	{
-	    UINT32  CckmSifsTime:8;        //  unit 1us. Applied after CCK RX/TX
-	    UINT32  OfdmSifsTime:8;        //  unit 1us. Applied after OFDM RX/TX
-	    UINT32  OfdmXifsTime:4;        //OFDM SIFS. unit 1us. Applied after OFDM RX when MAC doesn't reference BBP signal BBRXEND
-	    UINT32  EIFS:9;        //  unit 1us
-	    UINT32  BBRxendEnable:1;        //  reference RXEND signal to begin XIFS defer
-	    UINT32  rsv:2;
-	}	field;
-	UINT32			word;
-}	IFS_SLOT_CFG_STRUC, *PIFS_SLOT_CFG_STRUC;
-
-#define BKOFF_SLOT_CFG             0x1104		 //  mac_csr9 last 8 bits
-#define NAV_TIME_CFG             0x1108		 // NAV  (MAC_CSR15)
-#define CH_TIME_CFG             0x110C		 	// Count as channel busy
-#define PBF_LIFE_TIMER             0x1110		 //TX/RX MPDU timestamp timer (free run)Unit: 1us
-#define BCN_TIME_CFG             0x1114		 // TXRX_CSR9
-
-#define BCN_OFFSET0				0x042C
-#define BCN_OFFSET1				0x0430
-
-//
-// BCN_TIME_CFG : Synchronization control register
-//
-typedef	union	_BCN_TIME_CFG_STRUC	{
-	struct	{
-		UINT32       BeaconInterval:16;  // in unit of 1/16 TU
-		UINT32		bTsfTicking:1;		// Enable TSF auto counting
-		UINT32		TsfSyncMode:2;		// Enable TSF sync, 00: disable, 01: infra mode, 10: ad-hoc mode
-        UINT32       bTBTTEnable:1;
-		UINT32		bBeaconGen:1;		// Enable beacon generator
-        UINT32       :3;
-		UINT32		TxTimestampCompensate:8;
-	}	field;
-	UINT32			word;
-}	BCN_TIME_CFG_STRUC, *PBCN_TIME_CFG_STRUC;
-
-#define TBTT_SYNC_CFG            0x1118  		// txrx_csr10
-#define TSF_TIMER_DW0             0x111C  		// Local TSF timer lsb 32 bits. Read-only
-#define TSF_TIMER_DW1             0x1120  		// msb 32 bits. Read-only.
-#define TBTT_TIMER             	0x1124  		// TImer remains till next TBTT. Read-only.  TXRX_CSR14
-#define INT_TIMER_CFG              	0x1128  		//
-#define INT_TIMER_EN             	0x112c  		//  GP-timer and pre-tbtt Int enable
-#define CH_IDLE_STA              	0x1130  		//  channel idle time
-#define CH_BUSY_STA              	0x1134  		//  channle busy time
-//
-//  4.2 MAC POWER  configuration registers (offset:0x1200)
-//
-#define MAC_STATUS_CFG             0x1200		 // old MAC_CSR12
-#define PWR_PIN_CFG             0x1204		 // old MAC_CSR12
-#define AUTO_WAKEUP_CFG             0x1208		 // old MAC_CSR10
-//
-// AUTO_WAKEUP_CFG: Manual power control / status register
-//
-typedef	union	_AUTO_WAKEUP_STRUC	{
-	struct	{
-		UINT32       AutoLeadTime:8;
-		UINT32       NumofSleepingTbtt:7;          // ForceWake has high privilege than PutToSleep when both set
-		UINT32		EnableAutoWakeup:1;	// 0:sleep, 1:awake
-		UINT32		:16;
-	}	field;
-	UINT32			word;
-}	AUTO_WAKEUP_STRUC, *PAUTO_WAKEUP_STRUC;
-
-//
-//  4.3 MAC TX  configuration registers (offset:0x1300)
-//
-
-#define EDCA_AC0_CFG	0x1300		//AC_TXOP_CSR0 0x3474
-#define EDCA_AC1_CFG	0x1304
-#define EDCA_AC2_CFG	0x1308
-#define EDCA_AC3_CFG	0x130c
-typedef	union	_EDCA_AC_CFG_STRUC	{
-	struct	{
-	    UINT32  AcTxop:8;        //  in unit of 32us
-	    UINT32  Aifsn:4;        // # of slot time
-	    UINT32  Cwmin:4;        //
-	    UINT32  Cwmax:4;        //unit power of 2
-	    UINT32  :12;       //
-	}	field;
-	UINT32			word;
-}	EDCA_AC_CFG_STRUC, *PEDCA_AC_CFG_STRUC;
-
-#define EDCA_TID_AC_MAP	0x1310
-#define TX_PWR_CFG_0	0x1314
-#define TX_PWR_CFG_1	0x1318
-#define TX_PWR_CFG_2	0x131C
-#define TX_PWR_CFG_3	0x1320
-#define TX_PWR_CFG_4	0x1324
-#define TX_PIN_CFG		0x1328
-#define TX_BAND_CFG	0x132c		// 0x1 use upper 20MHz. 0 juse lower 20MHz
-#define TX_SW_CFG0		0x1330
-#define TX_SW_CFG1		0x1334
-#define TX_SW_CFG2		0x1338
-#define TXOP_THRES_CFG		0x133c
-#define TXOP_CTRL_CFG		0x1340
-#define TX_RTS_CFG		0x1344
-
-typedef	union	_TX_RTS_CFG_STRUC	{
-	struct	{
-	    UINT32       AutoRtsRetryLimit:8;
-	    UINT32       RtsThres:16;    // unit:byte
-	    UINT32       RtsFbkEn:1;    // enable rts rate fallback
-	    UINT32       rsv:7;     // 1: HT non-STBC control frame enable
-	}	field;
-	UINT32			word;
-}	TX_RTS_CFG_STRUC, *PTX_RTS_CFG_STRUC;
-
-#define TX_TIMEOUT_CFG	0x1348
-typedef	union	_TX_TIMEOUT_CFG_STRUC	{
-	struct	{
-	    UINT32       rsv:4;
-	    UINT32       MpduLifeTime:4;    //  expiration time = 2^(9+MPDU LIFE TIME)  us
-	    UINT32       RxAckTimeout:8;	// unit:slot. Used for TX precedure
-	    UINT32       TxopTimeout:8;	//TXOP timeout value for TXOP truncation.  It is recommended that (SLOT_TIME) > (TX_OP_TIMEOUT) > (RX_ACK_TIMEOUT)
-	    UINT32       rsv2:8;     // 1: HT non-STBC control frame enable
-	}	field;
-	UINT32			word;
-}	TX_TIMEOUT_CFG_STRUC, *PTX_TIMEOUT_CFG_STRUC;
-
-#define TX_RTY_CFG	0x134c
-typedef	union PACKED _TX_RTY_CFG_STRUC	{
-	struct	{
-	    UINT32       ShortRtyLimit:8;	//  short retry limit
-	    UINT32       LongRtyLimit:8;	//long retry limit
-	    UINT32       LongRtyThre:12;	// Long retry threshoold
-	    UINT32       NonAggRtyMode:1;	// Non-Aggregate MPDU retry mode.  0:expired by retry limit, 1: expired by mpdu life timer
-	    UINT32       AggRtyMode:1;	// Aggregate MPDU retry mode.  0:expired by retry limit, 1: expired by mpdu life timer
-	    UINT32       TxautoFBEnable:1;    // Tx retry PHY rate auto fallback enable
-	    UINT32       rsv:1;     // 1: HT non-STBC control frame enable
-	}	field;
-	UINT32			word;
-}	TX_RTY_CFG_STRUC, *PTX_RTY_CFG_STRUC;
-
-#define TX_LINK_CFG	0x1350
-typedef	union	PACKED _TX_LINK_CFG_STRUC	{
-	struct PACKED {
-	    UINT32       RemoteMFBLifeTime:8;	//remote MFB life time. unit : 32us
-	    UINT32       MFBEnable:1;	//  TX apply remote MFB 1:enable
-	    UINT32       RemoteUMFSEnable:1;	//  remote unsolicit  MFB enable.  0: not apply remote remote unsolicit (MFS=7)
-	    UINT32       TxMRQEn:1;	//  MCS request TX enable
-	    UINT32       TxRDGEn:1;	// RDG TX enable
-	    UINT32       TxCFAckEn:1;	//   Piggyback CF-ACK enable
-	    UINT32       rsv:3;	//
-	    UINT32       RemotMFB:8;    //  remote MCS feedback
-	    UINT32       RemotMFS:8;	//remote MCS feedback sequence number
-	}	field;
-	UINT32			word;
-}	TX_LINK_CFG_STRUC, *PTX_LINK_CFG_STRUC;
-
-#define HT_FBK_CFG0	0x1354
-typedef	union PACKED _HT_FBK_CFG0_STRUC	{
-	struct	{
-	    UINT32       HTMCS0FBK:4;
-	    UINT32       HTMCS1FBK:4;
-	    UINT32       HTMCS2FBK:4;
-	    UINT32       HTMCS3FBK:4;
-	    UINT32       HTMCS4FBK:4;
-	    UINT32       HTMCS5FBK:4;
-	    UINT32       HTMCS6FBK:4;
-	    UINT32       HTMCS7FBK:4;
-	}	field;
-	UINT32			word;
-}	HT_FBK_CFG0_STRUC, *PHT_FBK_CFG0_STRUC;
-
-#define HT_FBK_CFG1	0x1358
-typedef	union	_HT_FBK_CFG1_STRUC	{
-	struct	{
-	    UINT32       HTMCS8FBK:4;
-	    UINT32       HTMCS9FBK:4;
-	    UINT32       HTMCS10FBK:4;
-	    UINT32       HTMCS11FBK:4;
-	    UINT32       HTMCS12FBK:4;
-	    UINT32       HTMCS13FBK:4;
-	    UINT32       HTMCS14FBK:4;
-	    UINT32       HTMCS15FBK:4;
-	}	field;
-	UINT32			word;
-}	HT_FBK_CFG1_STRUC, *PHT_FBK_CFG1_STRUC;
-
-#define LG_FBK_CFG0	0x135c
-typedef	union	_LG_FBK_CFG0_STRUC	{
-	struct	{
-	    UINT32       OFDMMCS0FBK:4;	//initial value is 0
-	    UINT32       OFDMMCS1FBK:4;	//initial value is 0
-	    UINT32       OFDMMCS2FBK:4;	//initial value is 1
-	    UINT32       OFDMMCS3FBK:4;	//initial value is 2
-	    UINT32       OFDMMCS4FBK:4;	//initial value is 3
-	    UINT32       OFDMMCS5FBK:4;	//initial value is 4
-	    UINT32       OFDMMCS6FBK:4;	//initial value is 5
-	    UINT32       OFDMMCS7FBK:4;	//initial value is 6
-	}	field;
-	UINT32			word;
-}	LG_FBK_CFG0_STRUC, *PLG_FBK_CFG0_STRUC;
-
-#define LG_FBK_CFG1		0x1360
-typedef	union	_LG_FBK_CFG1_STRUC	{
-	struct	{
-	    UINT32       CCKMCS0FBK:4;	//initial value is 0
-	    UINT32       CCKMCS1FBK:4;	//initial value is 0
-	    UINT32       CCKMCS2FBK:4;	//initial value is 1
-	    UINT32       CCKMCS3FBK:4;	//initial value is 2
-	    UINT32       rsv:16;
-	}	field;
-	UINT32			word;
-}	LG_FBK_CFG1_STRUC, *PLG_FBK_CFG1_STRUC;
-
-//=======================================================
-//================ Protection Paramater================================
-//=======================================================
-#define CCK_PROT_CFG	0x1364		//CCK Protection
-#define ASIC_SHORTNAV		1
-#define ASIC_LONGNAV		2
-#define ASIC_RTS		1
-#define ASIC_CTS		2
-typedef	union	_PROT_CFG_STRUC	{
-	struct	{
-	    UINT32       ProtectRate:16;	//Protection control frame rate for CCK TX(RTS/CTS/CFEnd).
-	    UINT32       ProtectCtrl:2;	//Protection control frame type for CCK TX. 1:RTS/CTS, 2:CTS-to-self, 0:None, 3:rsv
-	    UINT32       ProtectNav:2;	//TXOP protection type for CCK TX. 0:None, 1:ShortNAVprotect,  2:LongNAVProtect, 3:rsv
-	    UINT32       TxopAllowCck:1;	//CCK TXOP allowance.0:disallow.
-	    UINT32       TxopAllowOfdm:1;	//CCK TXOP allowance.0:disallow.
-	    UINT32       TxopAllowMM20:1;	//CCK TXOP allowance. 0:disallow.
-	    UINT32       TxopAllowMM40:1;	//CCK TXOP allowance.0:disallow.
-	    UINT32       TxopAllowGF20:1;	//CCK TXOP allowance.0:disallow.
-	    UINT32       TxopAllowGF40:1;	//CCK TXOP allowance.0:disallow.
-	    UINT32       RTSThEn:1;	//RTS threshold enable on CCK TX
-	    UINT32       rsv:5;
-	}	field;
-	UINT32			word;
-}	PROT_CFG_STRUC, *PPROT_CFG_STRUC;
-
-#define OFDM_PROT_CFG	0x1368		//OFDM Protection
-#define MM20_PROT_CFG	0x136C		//MM20 Protection
-#define MM40_PROT_CFG	0x1370		//MM40 Protection
-#define GF20_PROT_CFG	0x1374		//GF20 Protection
-#define GF40_PROT_CFG	0x1378		//GR40 Protection
-#define EXP_CTS_TIME	0x137C		//
-#define EXP_ACK_TIME	0x1380		//
-
-//
-//  4.4 MAC RX configuration registers (offset:0x1400)
-//
-#define RX_FILTR_CFG	0x1400			//TXRX_CSR0
-#define AUTO_RSP_CFG	0x1404			//TXRX_CSR4
-//
-// TXRX_CSR4: Auto-Responder/
-//
-typedef union _AUTO_RSP_CFG_STRUC {
- struct {
-     UINT32       AutoResponderEnable:1;
-     UINT32       BACAckPolicyEnable:1;    // 0:long, 1:short preamble
-     UINT32       CTS40MMode:1;  // Response CTS 40MHz duplicate mode
-     UINT32       CTS40MRef:1;  // Response CTS 40MHz duplicate mode
-     UINT32       AutoResponderPreamble:1;    // 0:long, 1:short preamble
-     UINT32       rsv:1;   // Power bit value in conrtrol frame
-     UINT32       DualCTSEn:1;   // Power bit value in conrtrol frame
-     UINT32       AckCtsPsmBit:1;   // Power bit value in conrtrol frame
-     UINT32        :24;
- } field;
- UINT32   word;
-} AUTO_RSP_CFG_STRUC, *PAUTO_RSP_CFG_STRUC;
-
-#define LEGACY_BASIC_RATE	0x1408	//  TXRX_CSR5           0x3054
-#define HT_BASIC_RATE		0x140c
-#define HT_CTRL_CFG		0x1410
-#define SIFS_COST_CFG		0x1414
-#define RX_PARSER_CFG		0x1418	//Set NAV for all received frames
-
-//
-//  4.5 MAC Security configuration (offset:0x1500)
-//
-#define TX_SEC_CNT0		0x1500		//
-#define RX_SEC_CNT0		0x1504		//
-#define CCMP_FC_MUTE		0x1508		//
-//
-//  4.6 HCCA/PSMP (offset:0x1600)
-//
-#define TXOP_HLDR_ADDR0		0x1600
-#define TXOP_HLDR_ADDR1		0x1604
-#define TXOP_HLDR_ET		0x1608
-#define QOS_CFPOLL_RA_DW0		0x160c
-#define QOS_CFPOLL_A1_DW1		0x1610
-#define QOS_CFPOLL_QC		0x1614
-//
-//  4.7 MAC Statistis registers (offset:0x1700)
-//
-#define RX_STA_CNT0		0x1700		//
-#define RX_STA_CNT1		0x1704		//
-#define RX_STA_CNT2		0x1708		//
-
-//
-// RX_STA_CNT0_STRUC: RX PLCP error count & RX CRC error count
-//
-typedef	union	_RX_STA_CNT0_STRUC	{
-	struct	{
-	    USHORT  CrcErr;
-	    USHORT  PhyErr;
-	}	field;
-	UINT32			word;
-}	RX_STA_CNT0_STRUC, *PRX_STA_CNT0_STRUC;
-
-//
-// RX_STA_CNT1_STRUC: RX False CCA count & RX LONG frame count
-//
-typedef	union	_RX_STA_CNT1_STRUC	{
-	struct	{
-	    USHORT  FalseCca;
-	    USHORT  PlcpErr;
-	}	field;
-	UINT32			word;
-}	RX_STA_CNT1_STRUC, *PRX_STA_CNT1_STRUC;
-
-//
-// RX_STA_CNT2_STRUC:
-//
-typedef	union	_RX_STA_CNT2_STRUC	{
-	struct	{
-	    USHORT  RxDupliCount;
-	    USHORT  RxFifoOverflowCount;
-	}	field;
-	UINT32			word;
-}	RX_STA_CNT2_STRUC, *PRX_STA_CNT2_STRUC;
-
-#define TX_STA_CNT0		0x170C		//
-//
-// STA_CSR3: TX Beacon count
-//
-typedef	union	_TX_STA_CNT0_STRUC	{
-	struct	{
-	    USHORT  TxFailCount;
-	    USHORT  TxBeaconCount;
-	}	field;
-	UINT32			word;
-}	TX_STA_CNT0_STRUC, *PTX_STA_CNT0_STRUC;
-
-#define TX_STA_CNT1		0x1710		//
-//
-// TX_STA_CNT1: TX tx count
-//
-typedef	union	_TX_STA_CNT1_STRUC	{
-	struct	{
-	    USHORT  TxSuccess;
-	    USHORT  TxRetransmit;
-	}	field;
-	UINT32			word;
-}	TX_STA_CNT1_STRUC, *PTX_STA_CNT1_STRUC;
-
-#define TX_STA_CNT2		0x1714		//
-//
-// TX_STA_CNT2: TX tx count
-//
-typedef	union	_TX_STA_CNT2_STRUC	{
-	struct	{
-	    USHORT  TxZeroLenCount;
-	    USHORT  TxUnderFlowCount;
-	}	field;
-	UINT32			word;
-}	TX_STA_CNT2_STRUC, *PTX_STA_CNT2_STRUC;
-
-#define TX_STA_FIFO		0x1718		//
-//
-// TX_STA_FIFO_STRUC: TX Result for specific PID status fifo register
-//
-typedef	union PACKED _TX_STA_FIFO_STRUC	{
-	struct	{
-		UINT32       	bValid:1;   // 1:This register contains a valid TX result
-		UINT32       	PidType:4;
-		UINT32       	TxSuccess:1;   // Tx No retry success
-		UINT32       	TxAggre:1;    // Tx Retry Success
-		UINT32       	TxAckRequired:1;    // Tx fail
-		UINT32		wcid:8;		//wireless client index
-//		UINT32		SuccessRate:16;	//include MCS, mode ,shortGI, BW settingSame format as TXWI Word 0 Bit 31-16.
-		UINT32		SuccessRate:13;	//include MCS, mode ,shortGI, BW settingSame format as TXWI Word 0 Bit 31-16.
-		UINT32		TxBF:1;
-		UINT32		Reserve:2;
-	}	field;
-	UINT32			word;
-}	TX_STA_FIFO_STRUC, *PTX_STA_FIFO_STRUC;
-
-// Debug counter
-#define TX_AGG_CNT	0x171c
-typedef	union	_TX_AGG_CNT_STRUC	{
-	struct	{
-	    USHORT  NonAggTxCount;
-	    USHORT  AggTxCount;
-	}	field;
-	UINT32			word;
-}	TX_AGG_CNT_STRUC, *PTX_AGG_CNT_STRUC;
-
-// Debug counter
-#define TX_AGG_CNT0	0x1720
-typedef	union	_TX_AGG_CNT0_STRUC	{
-	struct	{
-	    USHORT  AggSize1Count;
-	    USHORT  AggSize2Count;
-	}	field;
-	UINT32			word;
-}	TX_AGG_CNT0_STRUC, *PTX_AGG_CNT0_STRUC;
-
-// Debug counter
-#define TX_AGG_CNT1	0x1724
-typedef	union	_TX_AGG_CNT1_STRUC	{
-	struct	{
-	    USHORT  AggSize3Count;
-	    USHORT  AggSize4Count;
-	}	field;
-	UINT32			word;
-}	TX_AGG_CNT1_STRUC, *PTX_AGG_CNT1_STRUC;
-
-#define TX_AGG_CNT2	0x1728
-typedef	union	_TX_AGG_CNT2_STRUC	{
-	struct	{
-	    USHORT  AggSize5Count;
-	    USHORT  AggSize6Count;
-	}	field;
-	UINT32			word;
-}	TX_AGG_CNT2_STRUC, *PTX_AGG_CNT2_STRUC;
-
-// Debug counter
-#define TX_AGG_CNT3	0x172c
-typedef	union	_TX_AGG_CNT3_STRUC	{
-	struct	{
-	    USHORT  AggSize7Count;
-	    USHORT  AggSize8Count;
-	}	field;
-	UINT32			word;
-}	TX_AGG_CNT3_STRUC, *PTX_AGG_CNT3_STRUC;
-
-// Debug counter
-#define TX_AGG_CNT4	0x1730
-typedef	union	_TX_AGG_CNT4_STRUC	{
-	struct	{
-	    USHORT  AggSize9Count;
-	    USHORT  AggSize10Count;
-	}	field;
-	UINT32			word;
-}	TX_AGG_CNT4_STRUC, *PTX_AGG_CNT4_STRUC;
-
-#define TX_AGG_CNT5	0x1734
-typedef	union	_TX_AGG_CNT5_STRUC	{
-	struct	{
-	    USHORT  AggSize11Count;
-	    USHORT  AggSize12Count;
-	}	field;
-	UINT32			word;
-}	TX_AGG_CNT5_STRUC, *PTX_AGG_CNT5_STRUC;
-
-#define TX_AGG_CNT6		0x1738
-typedef	union	_TX_AGG_CNT6_STRUC	{
-	struct	{
-	    USHORT  AggSize13Count;
-	    USHORT  AggSize14Count;
-	}	field;
-	UINT32			word;
-}	TX_AGG_CNT6_STRUC, *PTX_AGG_CNT6_STRUC;
-
-#define TX_AGG_CNT7		0x173c
-typedef	union	_TX_AGG_CNT7_STRUC	{
-	struct	{
-	    USHORT  AggSize15Count;
-	    USHORT  AggSize16Count;
-	}	field;
-	UINT32			word;
-}	TX_AGG_CNT7_STRUC, *PTX_AGG_CNT7_STRUC;
-
-#define MPDU_DENSITY_CNT		0x1740
-typedef	union	_MPDU_DEN_CNT_STRUC	{
-	struct	{
-	    USHORT  TXZeroDelCount;	//TX zero length delimiter count
-	    USHORT  RXZeroDelCount;	//RX zero length delimiter count
-	}	field;
-	UINT32			word;
-}	MPDU_DEN_CNT_STRUC, *PMPDU_DEN_CNT_STRUC;
-
-//
-// TXRX control registers - base address 0x3000
-//
-// rt2860b  UNKNOWN reg use R/O Reg Addr 0x77d0 first..
-#define TXRX_CSR1           0x77d0
-
-//
-// Security key table memory, base address = 0x1000
-//
-#define MAC_WCID_BASE		0x1800 //8-bytes(use only 6-bytes) * 256 entry =
-#define HW_WCID_ENTRY_SIZE   8
-#define PAIRWISE_KEY_TABLE_BASE     0x4000      // 32-byte * 256-entry =  -byte
-#define HW_KEY_ENTRY_SIZE           0x20
-#define PAIRWISE_IVEIV_TABLE_BASE     0x6000      // 8-byte * 256-entry =  -byte
-#define MAC_IVEIV_TABLE_BASE     0x6000      // 8-byte * 256-entry =  -byte
-#define HW_IVEIV_ENTRY_SIZE   8
-#define MAC_WCID_ATTRIBUTE_BASE     0x6800      // 4-byte * 256-entry =  -byte
-#define HW_WCID_ATTRI_SIZE   4
-#define WCID_RESERVED          		0x6bfc
-#define SHARED_KEY_TABLE_BASE       0x6c00      // 32-byte * 16-entry = 512-byte
-#define SHARED_KEY_MODE_BASE       0x7000      // 32-byte * 16-entry = 512-byte
-#define HW_SHARED_KEY_MODE_SIZE   4
-#define SHAREDKEYTABLE			0
-#define PAIRWISEKEYTABLE			1
-
-typedef	union	_SHAREDKEY_MODE_STRUC	{
-	struct	{
-		UINT32       Bss0Key0CipherAlg:3;
-		UINT32       :1;
-		UINT32       Bss0Key1CipherAlg:3;
-		UINT32       :1;
-		UINT32       Bss0Key2CipherAlg:3;
-		UINT32       :1;
-		UINT32       Bss0Key3CipherAlg:3;
-		UINT32       :1;
-		UINT32       Bss1Key0CipherAlg:3;
-		UINT32       :1;
-		UINT32       Bss1Key1CipherAlg:3;
-		UINT32       :1;
-		UINT32       Bss1Key2CipherAlg:3;
-		UINT32       :1;
-		UINT32       Bss1Key3CipherAlg:3;
-		UINT32       :1;
-	}	field;
-	UINT32			word;
-}	SHAREDKEY_MODE_STRUC, *PSHAREDKEY_MODE_STRUC;
-
-// 64-entry for pairwise key table
-typedef struct _HW_WCID_ENTRY {  // 8-byte per entry
-    UCHAR   Address[6];
-    UCHAR   Rsv[2];
-} HW_WCID_ENTRY, PHW_WCID_ENTRY;
-
-
-
-//
-// Other on-chip shared memory space, base = 0x2000
-//
-
-// CIS space - base address = 0x2000
-#define HW_CIS_BASE             0x2000
-
-// Carrier-sense CTS frame base address. It's where mac stores carrier-sense frame for carrier-sense function.
-#define HW_CS_CTS_BASE			0x7700
-// DFS CTS frame base address. It's where mac stores CTS frame for DFS.
-#define HW_DFS_CTS_BASE			0x7780
-#define HW_CTS_FRAME_SIZE		0x80
-
-// 2004-11-08 john - since NULL frame won't be that long (256 byte). We steal 16 tail bytes
-// to save debugging settings
-#define HW_DEBUG_SETTING_BASE   0x77f0  // 0x77f0~0x77ff total 16 bytes
-#define HW_DEBUG_SETTING_BASE2   0x7770  // 0x77f0~0x77ff total 16 bytes
-
-// In order to support maximum 8 MBSS and its maximum length is 512 for each beacon
-// Three section discontinue memory segments will be used.
-// 1. The original region for BCN 0~3
-// 2. Extract memory from FCE table for BCN 4~5
-// 3. Extract memory from Pair-wise key table for BCN 6~7
-//	  It occupied those memory of wcid 238~253 for BCN 6
-//						      and wcid 222~237 for BCN 7
-#define HW_BEACON_MAX_SIZE      0x1000 /* unit: byte */
-#define HW_BEACON_BASE0         0x7800
-#define HW_BEACON_BASE1         0x7A00
-#define HW_BEACON_BASE2         0x7C00
-#define HW_BEACON_BASE3         0x7E00
-#define HW_BEACON_BASE4         0x7200
-#define HW_BEACON_BASE5         0x7400
-#define HW_BEACON_BASE6         0x5DC0
-#define HW_BEACON_BASE7         0x5BC0
-
-#define HW_BEACON_MAX_COUNT     8
-#define HW_BEACON_OFFSET		0x0200
-#define HW_BEACON_CONTENT_LEN	(HW_BEACON_OFFSET - TXWI_SIZE)
-
-// HOST-MCU shared memory - base address = 0x2100
-#define HOST_CMD_CSR		0x404
-#define H2M_MAILBOX_CSR         0x7010
-#define H2M_MAILBOX_CID         0x7014
-#define H2M_MAILBOX_STATUS      0x701c
-#define H2M_INT_SRC             0x7024
-#define H2M_BBP_AGENT           0x7028
-#define M2H_CMD_DONE_CSR        0x000c
-#define MCU_TXOP_ARRAY_BASE     0x000c   // TODO: to be provided by Albert
-#define MCU_TXOP_ENTRY_SIZE     32       // TODO: to be provided by Albert
-#define MAX_NUM_OF_TXOP_ENTRY   16       // TODO: must be same with 8051 firmware
-#define MCU_MBOX_VERSION        0x01     // TODO: to be confirmed by Albert
-#define MCU_MBOX_VERSION_OFFSET 5        // TODO: to be provided by Albert
-
-//
-// Host DMA registers - base address 0x200 .  TX0-3=EDCAQid0-3, TX4=HCCA, TX5=MGMT,
-//
-//
-//  DMA RING DESCRIPTOR
-//
-#define E2PROM_CSR          0x0004
-#define IO_CNTL_CSR         0x77d0
-
-#ifdef RT2860
-// 8051 firmware image for RT2860 - base address = 0x4000
-#define FIRMWARE_IMAGE_BASE     0x2000
-#define MAX_FIRMWARE_IMAGE_SIZE 0x2000    // 8kbyte
-#endif
-#ifdef RT2870
-// 8051 firmware image for usb - use last-half base address = 0x3000
-#define FIRMWARE_IMAGE_BASE     0x3000
-#define MAX_FIRMWARE_IMAGE_SIZE 0x1000    // 4kbyte
-#endif // RT2870 //
-
-// ================================================================
-// Tx /	Rx / Mgmt ring descriptor definition
-// ================================================================
-
-// the following PID values are used to mark outgoing frame type in TXD->PID so that
-// proper TX statistics can be collected based on these categories
-// b3-2 of PID field -
-#define PID_MGMT			0x05
-#define PID_BEACON			0x0c
-#define PID_DATA_NORMALUCAST	 	0x02
-#define PID_DATA_AMPDU	 	0x04
-#define PID_DATA_NO_ACK    	0x08
-#define PID_DATA_NOT_NORM_ACK	 	0x03
-// value domain of pTxD->HostQId (4-bit: 0~15)
-#define QID_AC_BK               1   // meet ACI definition in 802.11e
-#define QID_AC_BE               0   // meet ACI definition in 802.11e
-#define QID_AC_VI               2
-#define QID_AC_VO               3
-#define QID_HCCA                4
-#define NUM_OF_TX_RING          5
-#define QID_MGMT                13
-#define QID_RX                  14
-#define QID_OTHER               15
-
-
-// ------------------------------------------------------
-// BBP & RF	definition
-// ------------------------------------------------------
-#define	BUSY		                1
-#define	IDLE		                0
-
-#define	RF_R00					    0
-#define	RF_R01					    1
-#define	RF_R02					    2
-#define	RF_R03					    3
-#define	RF_R04					    4
-#define	RF_R05					    5
-#define	RF_R06					    6
-#define	RF_R07					    7
-#define	RF_R08					    8
-#define	RF_R09					    9
-#define	RF_R10					    10
-#define	RF_R11					    11
-#define	RF_R12					    12
-#define	RF_R13					    13
-#define	RF_R14					    14
-#define	RF_R15					    15
-#define	RF_R16					    16
-#define	RF_R17					    17
-#define	RF_R18					    18
-#define	RF_R19					    19
-#define	RF_R20					    20
-#define	RF_R21					    21
-#define	RF_R22					    22
-#define	RF_R23					    23
-#define	RF_R24					    24
-#define	RF_R25					    25
-#define	RF_R26					    26
-#define	RF_R27					    27
-#define	RF_R28					    28
-#define	RF_R29					    29
-#define	RF_R30					    30
-#define	RF_R31					    31
-
-#define	BBP_R0					    0  // version
-#define	BBP_R1				        1  // TSSI
-#define	BBP_R2          			2  // TX configure
-#define BBP_R3                      3
-#define BBP_R4                      4
-#define BBP_R5                      5
-#define BBP_R6                      6
-#define	BBP_R14			            14 // RX configure
-#define BBP_R16                     16
-#define BBP_R17                     17 // RX sensibility
-#define BBP_R18                     18
-#define BBP_R21                     21
-#define BBP_R22                     22
-#define BBP_R24                     24
-#define BBP_R25                     25
-#define BBP_R31                     31
-#define BBP_R49                     49 //TSSI
-#define BBP_R50                     50
-#define BBP_R51                     51
-#define BBP_R52                     52
-#define BBP_R55                     55
-#define BBP_R62                     62 // Rx SQ0 Threshold HIGH
-#define BBP_R63                     63
-#define BBP_R64                     64
-#define BBP_R65                     65
-#define BBP_R66                     66
-#define BBP_R67                     67
-#define BBP_R68                     68
-#define BBP_R69                     69
-#define BBP_R70                     70 // Rx AGC SQ CCK Xcorr threshold
-#define BBP_R73                     73
-#define BBP_R75						75
-#define BBP_R77                     77
-#define BBP_R79                     79
-#define BBP_R80                     80
-#define BBP_R81                     81
-#define BBP_R82                     82
-#define BBP_R83                     83
-#define BBP_R84                     84
-#define BBP_R86						86
-#define BBP_R91						91
-#define BBP_R92						92
-#define BBP_R94                     94 // Tx Gain Control
-#define BBP_R103                    103
-#define BBP_R105                    105
-#define BBP_R113                    113
-#define BBP_R114                    114
-#define BBP_R115                    115
-#define BBP_R116                    116
-#define BBP_R117                    117
-#define BBP_R118                    118
-#define BBP_R119                    119
-#define BBP_R120                    120
-#define BBP_R121                    121
-#define BBP_R122                    122
-#define BBP_R123                    123
-#define BBP_R138                    138 // add by johnli, RF power sequence setup, ADC dynamic on/off control
-
-
-#define BBPR94_DEFAULT              0x06 // Add 1 value will gain 1db
-
-#define RSSI_FOR_VERY_LOW_SENSIBILITY -35
-#define RSSI_FOR_LOW_SENSIBILITY      -58
-#define RSSI_FOR_MID_LOW_SENSIBILITY  -80
-#define RSSI_FOR_MID_SENSIBILITY      -90
-
-//-------------------------------------------------------------------------
-// EEPROM definition
-//-------------------------------------------------------------------------
-#define EEDO                        0x08
-#define EEDI                        0x04
-#define EECS                        0x02
-#define EESK                        0x01
-#define EERL                        0x80
-
-#define EEPROM_WRITE_OPCODE         0x05
-#define EEPROM_READ_OPCODE          0x06
-#define EEPROM_EWDS_OPCODE          0x10
-#define EEPROM_EWEN_OPCODE          0x13
-
-#define	NUM_EEPROM_BBP_PARMS		19			// Include NIC Config 0, 1, CR, TX ALC step, BBPs
-#define	NUM_EEPROM_TX_G_PARMS		7
-#define	EEPROM_NIC1_OFFSET          0x34		// The address is from NIC config 0, not BBP register ID
-#define	EEPROM_NIC2_OFFSET          0x36		// The address is from NIC config 0, not BBP register ID
-#define	EEPROM_BBP_BASE_OFFSET		0xf0		// The address is from NIC config 0, not BBP register ID
-#define	EEPROM_G_TX_PWR_OFFSET		0x52
-#define	EEPROM_G_TX2_PWR_OFFSET		0x60
-#define EEPROM_LED1_OFFSET			0x3c
-#define EEPROM_LED2_OFFSET			0x3e
-#define EEPROM_LED3_OFFSET			0x40
-#define EEPROM_LNA_OFFSET			0x44
-#define EEPROM_RSSI_BG_OFFSET		0x46
-#define EEPROM_RSSI_A_OFFSET		0x4a
-#define EEPROM_DEFINE_MAX_TXPWR		0x4e
-#define EEPROM_TXPOWER_BYRATE_20MHZ_2_4G	0xde	// 20MHZ 2.4G tx power.
-#define EEPROM_TXPOWER_BYRATE_40MHZ_2_4G	0xee	// 40MHZ 2.4G tx power.
-#define EEPROM_TXPOWER_BYRATE_20MHZ_5G		0xfa	// 20MHZ 5G tx power.
-#define EEPROM_TXPOWER_BYRATE_40MHZ_5G		0x10a	// 40MHZ 5G tx power.
-#define EEPROM_A_TX_PWR_OFFSET      0x78
-#define EEPROM_A_TX2_PWR_OFFSET      0xa6
-#define EEPROM_VERSION_OFFSET       0x02
-#define	EEPROM_FREQ_OFFSET			0x3a
-#define EEPROM_TXPOWER_BYRATE 	0xde	// 20MHZ power.
-#define EEPROM_TXPOWER_DELTA		0x50	// 20MHZ AND 40 MHZ use different power. This is delta in 40MHZ.
-#define VALID_EEPROM_VERSION        1
-
-// PairKeyMode definition
-#define PKMODE_NONE                 0
-#define PKMODE_WEP64                1
-#define PKMODE_WEP128               2
-#define PKMODE_TKIP                 3
-#define PKMODE_AES                  4
-#define PKMODE_CKIP64               5
-#define PKMODE_CKIP128              6
-#define PKMODE_TKIP_NO_MIC          7       // MIC appended by driver: not a valid value in hardware key table
-
-// =================================================================================
-// WCID  format
-// =================================================================================
-//7.1	WCID  ENTRY  format  : 8bytes
-typedef	struct	_WCID_ENTRY_STRUC {
-	UCHAR		RXBABitmap7;    // bit0 for TID8, bit7 for TID 15
-	UCHAR		RXBABitmap0;    // bit0 for TID0, bit7 for TID 7
-	UCHAR		MAC[6];	// 0 for shared key table.  1 for pairwise key table
-}	WCID_ENTRY_STRUC, *PWCID_ENTRY_STRUC;
-
-//8.1.1	SECURITY  KEY  format  : 8DW
-// 32-byte per entry, total 16-entry for shared key table, 64-entry for pairwise key table
-typedef struct _HW_KEY_ENTRY {          // 32-byte per entry
-    UCHAR   Key[16];
-    UCHAR   TxMic[8];
-    UCHAR   RxMic[8];
-} HW_KEY_ENTRY, *PHW_KEY_ENTRY;
-
-//8.1.2	IV/EIV  format  : 2DW
-
-//8.1.3	RX attribute entry format  : 1DW
-typedef	struct	_MAC_ATTRIBUTE_STRUC {
-	UINT32		KeyTab:1;	// 0 for shared key table.  1 for pairwise key table
-	UINT32		PairKeyMode:3;
-	UINT32		BSSIDIdx:3; //multipleBSS index for the WCID
-	UINT32		RXWIUDF:3;
-	UINT32		rsv:22;
-}	MAC_ATTRIBUTE_STRUC, *PMAC_ATTRIBUTE_STRUC;
-
-// =================================================================================
-// TX / RX ring descriptor format
-// =================================================================================
-
-// the first 24-byte in TXD is called TXINFO and will be DMAed to MAC block through TXFIFO.
-// MAC block use this TXINFO to control the transmission behavior of this frame.
-#define FIFO_MGMT                 0
-#define FIFO_HCCA                 1
-#define FIFO_EDCA                 2
-
-//
-// TX descriptor format, Tx	ring, Mgmt Ring
-//
-typedef	struct	PACKED _TXD_STRUC {
-	// Word	0
-	UINT32		SDPtr0;
-	// Word	1
-	UINT32		SDLen1:14;
-	UINT32		LastSec1:1;
-	UINT32		Burst:1;
-	UINT32		SDLen0:14;
-	UINT32		LastSec0:1;
-	UINT32		DMADONE:1;
-	//Word2
-	UINT32		SDPtr1;
-	//Word3
-	UINT32		rsv2:24;
-	UINT32		WIV:1;	// Wireless Info Valid. 1 if Driver already fill WI,  o if DMA needs to copy WI to correctposition
-	UINT32		QSEL:2;	// select on-chip FIFO ID for 2nd-stage output scheduler.0:MGMT, 1:HCCA 2:EDCA
-	UINT32		rsv:2;
-	UINT32		TCO:1;	//
-	UINT32		UCO:1;	//
-	UINT32		ICO:1;	//
-}	TXD_STRUC, *PTXD_STRUC;
-
-//
-// TXD Wireless Information format for Tx ring and Mgmt Ring
-//
-//txop : for txop mode
-// 0:txop for the MPDU frame will be handles by ASIC by register
-// 1/2/3:the MPDU frame is send after PIFS/backoff/SIFS
-typedef	struct	PACKED _TXWI_STRUC {
-	// Word	0
-	UINT32		FRAG:1;		// 1 to inform TKIP engine this is a fragment.
-	UINT32		MIMOps:1;	// the remote peer is in dynamic MIMO-PS mode
-	UINT32		CFACK:1;
-	UINT32		TS:1;
-
-	UINT32		AMPDU:1;
-	UINT32		MpduDensity:3;
-	UINT32		txop:2;	//FOR "THIS" frame. 0:HT TXOP rule , 1:PIFS TX ,2:Backoff, 3:sifs only when previous frame exchange is successful.
-	UINT32		rsv:6;
-
-	UINT32		MCS:7;
-	UINT32		BW:1;	//channel bandwidth 20MHz or 40 MHz
-	UINT32		ShortGI:1;
-	UINT32		STBC:2;	// 1: STBC support MCS =0-7,   2,3 : RESERVE
-	UINT32		Ifs:1;	//
-	UINT32		rsv2:1;
-	UINT32		TxBF:1;	// 3*3
-	UINT32		PHYMODE:2;
-	// Word	1
-	UINT32		ACK:1;
-	UINT32		NSEQ:1;
-	UINT32		BAWinSize:6;
-	UINT32		WirelessCliID:8;
-	UINT32		MPDUtotalByteCount:12;
-	UINT32		PacketId:4;
-	//Word2
-	UINT32		IV;
-	//Word3
-	UINT32		EIV;
-}	TXWI_STRUC, *PTXWI_STRUC;
-
-//
-// Rx descriptor format, Rx	Ring
-//
-#ifdef RT2860
-typedef	struct	PACKED _RXD_STRUC	{
-	// Word	0
-	UINT32		SDP0;
-	// Word	1
-	UINT32		SDL1:14;
-	UINT32		Rsv:2;
-	UINT32		SDL0:14;
-	UINT32		LS0:1;
-	UINT32		DDONE:1;
-	// Word	2
-	UINT32		SDP1;
-	// Word	3
-	UINT32		BA:1;
-	UINT32		DATA:1;
-	UINT32		NULLDATA:1;
-	UINT32		FRAG:1;
-	UINT32		U2M:1;              // 1: this RX frame is unicast to me
-	UINT32		Mcast:1;            // 1: this is a multicast frame
-	UINT32		Bcast:1;            // 1: this is a broadcast frame
-	UINT32		MyBss:1;  	// 1: this frame belongs to the same BSSID
-	UINT32		Crc:1;              // 1: CRC error
-	UINT32		CipherErr:2;        // 0: decryption okay, 1:ICV error, 2:MIC error, 3:KEY not valid
-	UINT32		AMSDU:1;		// rx with 802.3 header, not 802.11 header.
-	UINT32		HTC:1;
-	UINT32		RSSI:1;
-	UINT32		L2PAD:1;
-	UINT32		AMPDU:1;
-	UINT32		Decrypted:1;	// this frame is being decrypted.
-	UINT32		PlcpSignal:1;		// To be moved
-	UINT32		PlcpRssil:1;// To be moved
-	UINT32		Rsv1:13;
-}	RXD_STRUC, *PRXD_STRUC, RT28XX_RXD_STRUC, *PRT28XX_RXD_STRUC;
-#endif /* RT2860 */
-
-//
-// RXWI wireless information format, in PBF. invisible in driver.
-//
-typedef	struct	PACKED _RXWI_STRUC {
-	// Word	0
-	UINT32		WirelessCliID:8;
-	UINT32		KeyIndex:2;
-	UINT32		BSSID:3;
-	UINT32		UDF:3;
-	UINT32		MPDUtotalByteCount:12;
-	UINT32		TID:4;
-	// Word	1
-	UINT32		FRAG:4;
-	UINT32		SEQUENCE:12;
-	UINT32		MCS:7;
-	UINT32		BW:1;
-	UINT32		ShortGI:1;
-	UINT32		STBC:2;
-	UINT32		rsv:3;
-	UINT32		PHYMODE:2;              // 1: this RX frame is unicast to me
-	//Word2
-	UINT32		RSSI0:8;
-	UINT32		RSSI1:8;
-	UINT32		RSSI2:8;
-	UINT32		rsv1:8;
-	//Word3
-	UINT32		SNR0:8;
-	UINT32		SNR1:8;
-	UINT32		rsv2:16;
-}	RXWI_STRUC, *PRXWI_STRUC;
-
-// =================================================================================
-// HOST-MCU communication data structure
-// =================================================================================
-
-//
-// H2M_MAILBOX_CSR: Host-to-MCU Mailbox
-//
-typedef union  _H2M_MAILBOX_STRUC {
-    struct {
-        UINT32       LowByte:8;
-        UINT32       HighByte:8;
-        UINT32       CmdToken:8;
-        UINT32       Owner:8;
-    }   field;
-    UINT32           word;
-} H2M_MAILBOX_STRUC, *PH2M_MAILBOX_STRUC;
-
-//
-// M2H_CMD_DONE_CSR: MCU-to-Host command complete indication
-//
-typedef union _M2H_CMD_DONE_STRUC {
-    struct  {
-        UINT32       CmdToken0;
-        UINT32       CmdToken1;
-        UINT32       CmdToken2;
-        UINT32       CmdToken3;
-    } field;
-    UINT32           word;
-} M2H_CMD_DONE_STRUC, *PM2H_CMD_DONE_STRUC;
-
-//
-// MCU_LEDCS: MCU LED Control Setting.
-//
-typedef union  _MCU_LEDCS_STRUC {
-	struct	{
-		UCHAR		LedMode:7;
-		UCHAR		Polarity:1;
-	} field;
-	UCHAR			word;
-} MCU_LEDCS_STRUC, *PMCU_LEDCS_STRUC;
-
-// =================================================================================
-// Register format
-// =================================================================================
-
-
-
-//NAV_TIME_CFG :NAV
-typedef	union	_NAV_TIME_CFG_STRUC	{
-	struct	{
-		UCHAR		Sifs;               // in unit of 1-us
-		UCHAR       SlotTime;    // in unit of 1-us
-		USHORT		Eifs:9;               // in unit of 1-us
-		USHORT		ZeroSifs:1;               // Applied zero SIFS timer after OFDM RX 0: disable
-		USHORT		rsv:6;
-	}	field;
-	UINT32			word;
-}	NAV_TIME_CFG_STRUC, *PNAV_TIME_CFG_STRUC;
-
-//
-// RX_FILTR_CFG:  /RX configuration register
-//
-typedef	union	_RX_FILTR_CFG_STRUC	{
-	struct	{
-		UINT32		DropCRCErr:1;		// Drop CRC error
-		UINT32		DropPhyErr:1;		// Drop physical error
-		UINT32		DropNotToMe:1;		// Drop not to me unicast frame
-		UINT32		DropNotMyBSSID:1;			// Drop fram ToDs bit is true
-
-		UINT32		DropVerErr:1;	    // Drop version error frame
-		UINT32		DropMcast:1;		// Drop multicast frames
-		UINT32		DropBcast:1;		// Drop broadcast frames
-		UINT32		DropDuplicate:1;		// Drop duplicate frame
-
-		UINT32		DropCFEndAck:1;		// Drop Ps-Poll
-		UINT32		DropCFEnd:1;		// Drop Ps-Poll
-		UINT32		DropAck:1;		// Drop Ps-Poll
-		UINT32		DropCts:1;		// Drop Ps-Poll
-
-		UINT32		DropRts:1;		// Drop Ps-Poll
-		UINT32		DropPsPoll:1;		// Drop Ps-Poll
-		UINT32		DropBA:1;		//
-        	UINT32       	DropBAR:1;       //
-
-		UINT32       	DropRsvCntlType:1;
-		UINT32		:15;
-	}	field;
-	UINT32			word;
-}	RX_FILTR_CFG_STRUC, *PRX_FILTR_CFG_STRUC;
-
-//
-// PHY_CSR4: RF serial control register
-//
-typedef	union	_PHY_CSR4_STRUC	{
-	struct	{
-		UINT32		RFRegValue:24;		// Register	value (include register	id)	serial out to RF/IF	chip.
-		UINT32		NumberOfBits:5;		// Number of bits used in RFRegValue (I:20,	RFMD:22)
-		UINT32		IFSelect:1;			// 1: select IF	to program,	0: select RF to	program
-		UINT32		PLL_LD:1;			// RF PLL_LD status
-		UINT32		Busy:1;				// 1: ASIC is busy execute RF programming.
-	}	field;
-	UINT32			word;
-}	PHY_CSR4_STRUC, *PPHY_CSR4_STRUC;
-
-//
-// SEC_CSR5: shared key table security mode register
-//
-typedef	union	_SEC_CSR5_STRUC	{
-	struct	{
-        UINT32       Bss2Key0CipherAlg:3;
-        UINT32       :1;
-        UINT32       Bss2Key1CipherAlg:3;
-        UINT32       :1;
-        UINT32       Bss2Key2CipherAlg:3;
-        UINT32       :1;
-        UINT32       Bss2Key3CipherAlg:3;
-        UINT32       :1;
-        UINT32       Bss3Key0CipherAlg:3;
-        UINT32       :1;
-        UINT32       Bss3Key1CipherAlg:3;
-        UINT32       :1;
-        UINT32       Bss3Key2CipherAlg:3;
-        UINT32       :1;
-        UINT32       Bss3Key3CipherAlg:3;
-        UINT32       :1;
-	}	field;
-	UINT32			word;
-}	SEC_CSR5_STRUC, *PSEC_CSR5_STRUC;
-
-//
-// HOST_CMD_CSR: For HOST to interrupt embedded processor
-//
-typedef	union	_HOST_CMD_CSR_STRUC	{
-	struct	{
-	    UINT32   HostCommand:8;
-	    UINT32   Rsv:24;
-	}	field;
-	UINT32			word;
-}	HOST_CMD_CSR_STRUC, *PHOST_CMD_CSR_STRUC;
-
-//
-// AIFSN_CSR: AIFSN for each EDCA AC
-//
-
-
-
-//
-// E2PROM_CSR: EEPROM control register
-//
-typedef	union	_E2PROM_CSR_STRUC	{
-	struct	{
-		UINT32		Reload:1;		// Reload EEPROM content, write one to reload, self-cleared.
-		UINT32		EepromSK:1;
-		UINT32		EepromCS:1;
-		UINT32		EepromDI:1;
-		UINT32		EepromDO:1;
-		UINT32		Type:1;			// 1: 93C46, 0:93C66
-		UINT32       LoadStatus:1;   // 1:loading, 0:done
-		UINT32		Rsvd:25;
-	}	field;
-	UINT32			word;
-}	E2PROM_CSR_STRUC, *PE2PROM_CSR_STRUC;
-
-// -------------------------------------------------------------------
-//  E2PROM data layout
-// -------------------------------------------------------------------
-
-//
-// EEPROM antenna select format
-//
-typedef	union	_EEPROM_ANTENNA_STRUC	{
-	struct	{
-		USHORT		RxPath:4;	// 1: 1R, 2: 2R, 3: 3R
-		USHORT		TxPath:4;	// 1: 1T, 2: 2T
-		USHORT      RfIcType:4;             // see E2PROM document
-		USHORT      Rsv:4;
-	}	field;
-	USHORT			word;
-}	EEPROM_ANTENNA_STRUC, *PEEPROM_ANTENNA_STRUC;
-
-typedef	union _EEPROM_NIC_CINFIG2_STRUC	{
-	struct {
-		USHORT		HardwareRadioControl:1;	// 1:enable, 0:disable
-		USHORT		DynamicTxAgcControl:1;			//
-		USHORT		ExternalLNAForG:1;				//
-		USHORT		ExternalLNAForA:1;			// external LNA enable for 2.4G
-		USHORT		CardbusAcceleration:1;	// !!! NOTE: 0 - enable, 1 - disable
-		USHORT		BW40MSidebandForG:1;
-		USHORT		BW40MSidebandForA:1;
-		USHORT		EnableWPSPBC:1;                 // WPS PBC Control bit
-		USHORT		BW40MAvailForG:1;			// 0:enable, 1:disable
-		USHORT		BW40MAvailForA:1;			// 0:enable, 1:disable
-		USHORT		Rsv1:1;					// must be 0
-		USHORT		AntDiversity:1;			// Antenna diversity
-		USHORT		Rsv2:3;					// must be 0
-		USHORT		DACTestBit:1;			// control if driver should patch the DAC issue
-	}	field;
-	USHORT			word;
-}	EEPROM_NIC_CONFIG2_STRUC, *PEEPROM_NIC_CONFIG2_STRUC;
-
-//
-// TX_PWR Value valid range 0xFA(-6) ~ 0x24(36)
-//
-typedef	union	_EEPROM_TX_PWR_STRUC	{
-	struct	{
-		CHAR	Byte0;				// Low Byte
-		CHAR	Byte1;				// High Byte
-	}	field;
-	USHORT	word;
-}	EEPROM_TX_PWR_STRUC, *PEEPROM_TX_PWR_STRUC;
-
-typedef	union	_EEPROM_VERSION_STRUC	{
-	struct	{
-		UCHAR	FaeReleaseNumber;	// Low Byte
-		UCHAR	Version;			// High Byte
-	}	field;
-	USHORT	word;
-}	EEPROM_VERSION_STRUC, *PEEPROM_VERSION_STRUC;
-
-typedef	union	_EEPROM_LED_STRUC	{
-	struct	{
-		USHORT	PolarityRDY_G:1;		// Polarity RDY_G setting.
-		USHORT	PolarityRDY_A:1;		// Polarity RDY_A setting.
-		USHORT	PolarityACT:1;		// Polarity ACT setting.
-		USHORT	PolarityGPIO_0:1;	// Polarity GPIO#0 setting.
-		USHORT	PolarityGPIO_1:1;	// Polarity GPIO#1 setting.
-		USHORT	PolarityGPIO_2:1;	// Polarity GPIO#2 setting.
-		USHORT	PolarityGPIO_3:1;	// Polarity GPIO#3 setting.
-		USHORT	PolarityGPIO_4:1;	// Polarity GPIO#4 setting.
-		USHORT	LedMode:5;			// Led mode.
-		USHORT	Rsvd:3;				// Reserved
-	}	field;
-	USHORT	word;
-}	EEPROM_LED_STRUC, *PEEPROM_LED_STRUC;
-
-typedef	union	_EEPROM_TXPOWER_DELTA_STRUC	{
-	struct	{
-		UCHAR	DeltaValue:6;	// Tx Power dalta value (MAX=4)
-		UCHAR	Type:1;			// 1: plus the delta value, 0: minus the delta value
-		UCHAR	TxPowerEnable:1;// Enable
-	}	field;
-	UCHAR	value;
-}	EEPROM_TXPOWER_DELTA_STRUC, *PEEPROM_TXPOWER_DELTA_STRUC;
-
-//
-// QOS_CSR0: TXOP holder address0 register
-//
-typedef	union	_QOS_CSR0_STRUC	{
-	struct	{
-		UCHAR		Byte0;		// MAC address byte 0
-		UCHAR		Byte1;		// MAC address byte 1
-		UCHAR		Byte2;		// MAC address byte 2
-		UCHAR		Byte3;		// MAC address byte 3
-	}	field;
-	UINT32			word;
-}	QOS_CSR0_STRUC, *PQOS_CSR0_STRUC;
-
-//
-// QOS_CSR1: TXOP holder address1 register
-//
-typedef	union	_QOS_CSR1_STRUC	{
-	struct	{
-		UCHAR		Byte4;		// MAC address byte 4
-		UCHAR		Byte5;		// MAC address byte 5
-		UCHAR		Rsvd0;
-		UCHAR		Rsvd1;
-	}	field;
-	UINT32			word;
-}	QOS_CSR1_STRUC, *PQOS_CSR1_STRUC;
-
-#define	RF_CSR_CFG	0x500
-typedef	union	_RF_CSR_CFG_STRUC	{
-	struct	{
-		UINT	RF_CSR_DATA:8;			// DATA
-		UINT	TESTCSR_RFACC_REGNUM:5;	// RF register ID
-		UINT	Rsvd2:3;				// Reserved
-		UINT	RF_CSR_WR:1;			// 0: read  1: write
-		UINT	RF_CSR_KICK:1;			// kick RF register read/write
-		UINT	Rsvd1:14;				// Reserved
-	}	field;
-	UINT	word;
-}	RF_CSR_CFG_STRUC, *PRF_CSR_CFG_STRUC;
-
-#endif	// __RT28XX_H__
diff --git a/drivers/staging/rt2860/rt_config.h b/drivers/staging/rt2860/rt_config.h
index 2093a80b19df..d1adef8948af 100644
--- a/drivers/staging/rt2860/rt_config.h
+++ b/drivers/staging/rt2860/rt_config.h
@@ -41,32 +41,31 @@
 #define	__RT_CONFIG_H__
 
 #include    "rtmp_type.h"
-#ifdef LINUX
-#include	"rt_linux.h"
-#endif
-#include    "rtmp_def.h"
-#include    "rt28xx.h"
+#include "rtmp_os.h"
 
-#ifdef RT2860
-#include	"rt2860.h"
-#endif
-#ifdef RT2870
-#include	"../rt2870/rt2870.h"
-#endif // RT2870 //
+#include "rtmp_def.h"
+#include "rtmp_chip.h"
+#include "rtmp_timer.h"
 
 #include    "oid.h"
 #include    "mlme.h"
 #include    "wpa.h"
-#include    "md5.h"
+#include "crypt_md5.h"
+#include "crypt_sha2.h"
+#include "crypt_hmac.h"
 #include    "rtmp.h"
 #include	"ap.h"
 #include	"dfs.h"
 #include	"chlist.h"
 #include	"spectrum.h"
 
+#include "eeprom.h"
+#if defined(RTMP_PCI_SUPPORT) || defined(RTMP_USB_SUPPORT)
+#include "rtmp_mcu.h"
+#endif
+
 #ifdef IGMP_SNOOP_SUPPORT
 #include "igmp_snoop.h"
-#endif // IGMP_SNOOP_SUPPORT //
-
-#endif	// __RT_CONFIG_H__
+#endif /* IGMP_SNOOP_SUPPORT // */
 
+#endif /* __RT_CONFIG_H__ */
diff --git a/drivers/staging/rt2860/rt_linux.c b/drivers/staging/rt2860/rt_linux.c
index ed27b8545a1b..9357fb26cc2a 100644
--- a/drivers/staging/rt2860/rt_linux.c
+++ b/drivers/staging/rt2860/rt_linux.c
@@ -28,149 +28,114 @@
 #include <linux/sched.h>
 #include "rt_config.h"
 
-ULONG	RTDebugLevel = RT_DEBUG_ERROR;
-
-BUILD_TIMER_FUNCTION(MlmePeriodicExec);
-BUILD_TIMER_FUNCTION(AsicRxAntEvalTimeout);
-BUILD_TIMER_FUNCTION(APSDPeriodicExec);
-BUILD_TIMER_FUNCTION(AsicRfTuningExec);
-#ifdef RT2870
-BUILD_TIMER_FUNCTION(BeaconUpdateExec);
-#endif // RT2870 //
-
-BUILD_TIMER_FUNCTION(BeaconTimeout);
-BUILD_TIMER_FUNCTION(ScanTimeout);
-BUILD_TIMER_FUNCTION(AuthTimeout);
-BUILD_TIMER_FUNCTION(AssocTimeout);
-BUILD_TIMER_FUNCTION(ReassocTimeout);
-BUILD_TIMER_FUNCTION(DisassocTimeout);
-BUILD_TIMER_FUNCTION(LinkDownExec);
-BUILD_TIMER_FUNCTION(StaQuickResponeForRateUpExec);
-BUILD_TIMER_FUNCTION(WpaDisassocApAndBlockAssoc);
-#ifdef RT2860
-BUILD_TIMER_FUNCTION(PsPollWakeExec);
-BUILD_TIMER_FUNCTION(RadioOnExec);
-#endif
+unsigned long RTDebugLevel = RT_DEBUG_ERROR;
 
-// for wireless system event message
+/* for wireless system event message */
 char const *pWirelessSysEventText[IW_SYS_EVENT_TYPE_NUM] = {
-	// system status event
-    "had associated successfully",							/* IW_ASSOC_EVENT_FLAG */
-    "had disassociated",									/* IW_DISASSOC_EVENT_FLAG */
-    "had deauthenticated",									/* IW_DEAUTH_EVENT_FLAG */
-    "had been aged-out and disassociated",					/* IW_AGEOUT_EVENT_FLAG */
-    "occurred CounterMeasures attack",						/* IW_COUNTER_MEASURES_EVENT_FLAG */
-    "occurred replay counter different in Key Handshaking",	/* IW_REPLAY_COUNTER_DIFF_EVENT_FLAG */
-    "occurred RSNIE different in Key Handshaking",			/* IW_RSNIE_DIFF_EVENT_FLAG */
-    "occurred MIC different in Key Handshaking",			/* IW_MIC_DIFF_EVENT_FLAG */
-    "occurred ICV error in RX",								/* IW_ICV_ERROR_EVENT_FLAG */
-    "occurred MIC error in RX",								/* IW_MIC_ERROR_EVENT_FLAG */
-	"Group Key Handshaking timeout",						/* IW_GROUP_HS_TIMEOUT_EVENT_FLAG */
-	"Pairwise Key Handshaking timeout",						/* IW_PAIRWISE_HS_TIMEOUT_EVENT_FLAG */
-	"RSN IE sanity check failure",							/* IW_RSNIE_SANITY_FAIL_EVENT_FLAG */
-	"set key done in WPA/WPAPSK",							/* IW_SET_KEY_DONE_WPA1_EVENT_FLAG */
-	"set key done in WPA2/WPA2PSK",                         /* IW_SET_KEY_DONE_WPA2_EVENT_FLAG */
-	"connects with our wireless client",                    /* IW_STA_LINKUP_EVENT_FLAG */
-	"disconnects with our wireless client",                 /* IW_STA_LINKDOWN_EVENT_FLAG */
-	"scan completed"										/* IW_SCAN_COMPLETED_EVENT_FLAG */
-	"scan terminate!! Busy!! Enqueue fail!!"				/* IW_SCAN_ENQUEUE_FAIL_EVENT_FLAG */
-	};
-
-// for wireless IDS_spoof_attack event message
+	/* system status event */
+	"had associated successfully",	/* IW_ASSOC_EVENT_FLAG */
+	"had disassociated",	/* IW_DISASSOC_EVENT_FLAG */
+	"had deauthenticated",	/* IW_DEAUTH_EVENT_FLAG */
+	"had been aged-out and disassociated",	/* IW_AGEOUT_EVENT_FLAG */
+	"occurred CounterMeasures attack",	/* IW_COUNTER_MEASURES_EVENT_FLAG */
+	"occurred replay counter different in Key Handshaking",	/* IW_REPLAY_COUNTER_DIFF_EVENT_FLAG */
+	"occurred RSNIE different in Key Handshaking",	/* IW_RSNIE_DIFF_EVENT_FLAG */
+	"occurred MIC different in Key Handshaking",	/* IW_MIC_DIFF_EVENT_FLAG */
+	"occurred ICV error in RX",	/* IW_ICV_ERROR_EVENT_FLAG */
+	"occurred MIC error in RX",	/* IW_MIC_ERROR_EVENT_FLAG */
+	"Group Key Handshaking timeout",	/* IW_GROUP_HS_TIMEOUT_EVENT_FLAG */
+	"Pairwise Key Handshaking timeout",	/* IW_PAIRWISE_HS_TIMEOUT_EVENT_FLAG */
+	"RSN IE sanity check failure",	/* IW_RSNIE_SANITY_FAIL_EVENT_FLAG */
+	"set key done in WPA/WPAPSK",	/* IW_SET_KEY_DONE_WPA1_EVENT_FLAG */
+	"set key done in WPA2/WPA2PSK",	/* IW_SET_KEY_DONE_WPA2_EVENT_FLAG */
+	"connects with our wireless client",	/* IW_STA_LINKUP_EVENT_FLAG */
+	"disconnects with our wireless client",	/* IW_STA_LINKDOWN_EVENT_FLAG */
+	"scan completed"	/* IW_SCAN_COMPLETED_EVENT_FLAG */
+	    "scan terminate! Busy! Enqueue fail!"	/* IW_SCAN_ENQUEUE_FAIL_EVENT_FLAG */
+};
+
+/* for wireless IDS_spoof_attack event message */
 char const *pWirelessSpoofEventText[IW_SPOOF_EVENT_TYPE_NUM] = {
-    "detected conflict SSID",								/* IW_CONFLICT_SSID_EVENT_FLAG */
-    "detected spoofed association response",				/* IW_SPOOF_ASSOC_RESP_EVENT_FLAG */
-    "detected spoofed reassociation responses",				/* IW_SPOOF_REASSOC_RESP_EVENT_FLAG */
-    "detected spoofed probe response",						/* IW_SPOOF_PROBE_RESP_EVENT_FLAG */
-    "detected spoofed beacon",								/* IW_SPOOF_BEACON_EVENT_FLAG */
-    "detected spoofed disassociation",						/* IW_SPOOF_DISASSOC_EVENT_FLAG */
-    "detected spoofed authentication",						/* IW_SPOOF_AUTH_EVENT_FLAG */
-    "detected spoofed deauthentication",					/* IW_SPOOF_DEAUTH_EVENT_FLAG */
-    "detected spoofed unknown management frame",			/* IW_SPOOF_UNKNOWN_MGMT_EVENT_FLAG */
-	"detected replay attack"								/* IW_REPLAY_ATTACK_EVENT_FLAG */
-	};
-
-// for wireless IDS_flooding_attack event message
+	"detected conflict SSID",	/* IW_CONFLICT_SSID_EVENT_FLAG */
+	"detected spoofed association response",	/* IW_SPOOF_ASSOC_RESP_EVENT_FLAG */
+	"detected spoofed reassociation responses",	/* IW_SPOOF_REASSOC_RESP_EVENT_FLAG */
+	"detected spoofed probe response",	/* IW_SPOOF_PROBE_RESP_EVENT_FLAG */
+	"detected spoofed beacon",	/* IW_SPOOF_BEACON_EVENT_FLAG */
+	"detected spoofed disassociation",	/* IW_SPOOF_DISASSOC_EVENT_FLAG */
+	"detected spoofed authentication",	/* IW_SPOOF_AUTH_EVENT_FLAG */
+	"detected spoofed deauthentication",	/* IW_SPOOF_DEAUTH_EVENT_FLAG */
+	"detected spoofed unknown management frame",	/* IW_SPOOF_UNKNOWN_MGMT_EVENT_FLAG */
+	"detected replay attack"	/* IW_REPLAY_ATTACK_EVENT_FLAG */
+};
+
+/* for wireless IDS_flooding_attack event message */
 char const *pWirelessFloodEventText[IW_FLOOD_EVENT_TYPE_NUM] = {
-	"detected authentication flooding",						/* IW_FLOOD_AUTH_EVENT_FLAG */
-    "detected association request flooding",				/* IW_FLOOD_ASSOC_REQ_EVENT_FLAG */
-    "detected reassociation request flooding",				/* IW_FLOOD_REASSOC_REQ_EVENT_FLAG */
-    "detected probe request flooding",						/* IW_FLOOD_PROBE_REQ_EVENT_FLAG */
-    "detected disassociation flooding",						/* IW_FLOOD_DISASSOC_EVENT_FLAG */
-    "detected deauthentication flooding",					/* IW_FLOOD_DEAUTH_EVENT_FLAG */
-    "detected 802.1x eap-request flooding"					/* IW_FLOOD_EAP_REQ_EVENT_FLAG */
-	};
+	"detected authentication flooding",	/* IW_FLOOD_AUTH_EVENT_FLAG */
+	"detected association request flooding",	/* IW_FLOOD_ASSOC_REQ_EVENT_FLAG */
+	"detected reassociation request flooding",	/* IW_FLOOD_REASSOC_REQ_EVENT_FLAG */
+	"detected probe request flooding",	/* IW_FLOOD_PROBE_REQ_EVENT_FLAG */
+	"detected disassociation flooding",	/* IW_FLOOD_DISASSOC_EVENT_FLAG */
+	"detected deauthentication flooding",	/* IW_FLOOD_DEAUTH_EVENT_FLAG */
+	"detected 802.1x eap-request flooding"	/* IW_FLOOD_EAP_REQ_EVENT_FLAG */
+};
 
 /* timeout -- ms */
-VOID RTMP_SetPeriodicTimer(
-	IN	NDIS_MINIPORT_TIMER *pTimer,
-	IN	unsigned long timeout)
+void RTMP_SetPeriodicTimer(struct timer_list * pTimer,
+			   IN unsigned long timeout)
 {
-	timeout = ((timeout*HZ) / 1000);
+	timeout = ((timeout * OS_HZ) / 1000);
 	pTimer->expires = jiffies + timeout;
 	add_timer(pTimer);
 }
 
 /* convert NdisMInitializeTimer --> RTMP_OS_Init_Timer */
-VOID RTMP_OS_Init_Timer(
-	IN	PRTMP_ADAPTER pAd,
-	IN	NDIS_MINIPORT_TIMER *pTimer,
-	IN	TIMER_FUNCTION function,
-	IN	PVOID data)
+void RTMP_OS_Init_Timer(struct rt_rtmp_adapter *pAd,
+			struct timer_list * pTimer,
+			IN TIMER_FUNCTION function, void *data)
 {
 	init_timer(pTimer);
-    pTimer->data = (unsigned long)data;
-    pTimer->function = function;
+	pTimer->data = (unsigned long)data;
+	pTimer->function = function;
 }
 
-
-VOID RTMP_OS_Add_Timer(
-	IN	NDIS_MINIPORT_TIMER		*pTimer,
-	IN	unsigned long timeout)
+void RTMP_OS_Add_Timer(struct timer_list * pTimer,
+		       IN unsigned long timeout)
 {
 	if (timer_pending(pTimer))
 		return;
 
-	timeout = ((timeout*HZ) / 1000);
+	timeout = ((timeout * OS_HZ) / 1000);
 	pTimer->expires = jiffies + timeout;
 	add_timer(pTimer);
 }
 
-VOID RTMP_OS_Mod_Timer(
-	IN	NDIS_MINIPORT_TIMER		*pTimer,
-	IN	unsigned long timeout)
+void RTMP_OS_Mod_Timer(struct timer_list * pTimer,
+		       IN unsigned long timeout)
 {
-	timeout = ((timeout*HZ) / 1000);
+	timeout = ((timeout * OS_HZ) / 1000);
 	mod_timer(pTimer, jiffies + timeout);
 }
 
-VOID RTMP_OS_Del_Timer(
-	IN	NDIS_MINIPORT_TIMER		*pTimer,
-	OUT	BOOLEAN					*pCancelled)
+void RTMP_OS_Del_Timer(struct timer_list * pTimer,
+		       OUT BOOLEAN * pCancelled)
 {
-	if (timer_pending(pTimer))
-	{
+	if (timer_pending(pTimer)) {
 		*pCancelled = del_timer_sync(pTimer);
-	}
-	else
-	{
+	} else {
 		*pCancelled = TRUE;
 	}
 
 }
 
-VOID RTMP_OS_Release_Packet(
-	IN	PRTMP_ADAPTER pAd,
-	IN	PQUEUE_ENTRY  pEntry)
+void RTMP_OS_Release_Packet(struct rt_rtmp_adapter *pAd, struct rt_queue_entry *pEntry)
 {
-	//RTMPFreeNdisPacket(pAd, (struct sk_buff *)pEntry);
+	/*RTMPFreeNdisPacket(pAd, (struct sk_buff *)pEntry); */
 }
 
-// Unify all delay routine by using udelay
-VOID RTMPusecDelay(
-	IN	ULONG	usec)
+/* Unify all delay routine by using udelay */
+void RTMPusecDelay(unsigned long usec)
 {
-	ULONG	i;
+	unsigned long i;
 
 	for (i = 0; i < (usec / 50); i++)
 		udelay(50);
@@ -179,28 +144,23 @@ VOID RTMPusecDelay(
 		udelay(usec % 50);
 }
 
-void RTMP_GetCurrentSystemTime(LARGE_INTEGER *time)
+void RTMP_GetCurrentSystemTime(LARGE_INTEGER * time)
 {
 	time->u.LowPart = jiffies;
 }
 
-// pAd MUST allow to be NULL
-NDIS_STATUS os_alloc_mem(
-	IN	PRTMP_ADAPTER pAd,
-	OUT	PUCHAR *mem,
-	IN	ULONG  size)
+/* pAd MUST allow to be NULL */
+int os_alloc_mem(struct rt_rtmp_adapter *pAd, u8 ** mem, unsigned long size)
 {
-	*mem = (PUCHAR) kmalloc(size, GFP_ATOMIC);
+	*mem = (u8 *)kmalloc(size, GFP_ATOMIC);
 	if (*mem)
 		return (NDIS_STATUS_SUCCESS);
 	else
 		return (NDIS_STATUS_FAILURE);
 }
 
-// pAd MUST allow to be NULL
-NDIS_STATUS os_free_mem(
-	IN	PRTMP_ADAPTER pAd,
-	IN	PUCHAR mem)
+/* pAd MUST allow to be NULL */
+int os_free_mem(struct rt_rtmp_adapter *pAd, void *mem)
 {
 
 	ASSERT(mem);
@@ -208,66 +168,64 @@ NDIS_STATUS os_free_mem(
 	return (NDIS_STATUS_SUCCESS);
 }
 
+void *RtmpOSNetPktAlloc(struct rt_rtmp_adapter *pAd, IN int size)
+{
+	struct sk_buff *skb;
+	/* Add 2 more bytes for ip header alignment */
+	skb = dev_alloc_skb(size + 2);
+
+	return ((void *)skb);
+}
 
-PNDIS_PACKET RTMP_AllocateFragPacketBuffer(
-	IN	PRTMP_ADAPTER pAd,
-	IN	ULONG	Length)
+void *RTMP_AllocateFragPacketBuffer(struct rt_rtmp_adapter *pAd,
+					   unsigned long Length)
 {
 	struct sk_buff *pkt;
 
 	pkt = dev_alloc_skb(Length);
 
-	if (pkt == NULL)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("can't allocate frag rx %ld size packet\n",Length));
+	if (pkt == NULL) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("can't allocate frag rx %ld size packet\n", Length));
 	}
 
-	if (pkt)
-	{
+	if (pkt) {
 		RTMP_SET_PACKET_SOURCE(OSPKT_TO_RTPKT(pkt), PKTSRC_NDIS);
 	}
 
-	return (PNDIS_PACKET) pkt;
+	return (void *)pkt;
 }
 
-
-PNDIS_PACKET RTMP_AllocateTxPacketBuffer(
-	IN	PRTMP_ADAPTER pAd,
-	IN	ULONG	Length,
-	IN	BOOLEAN	Cached,
-	OUT	PVOID	*VirtualAddress)
+void *RTMP_AllocateTxPacketBuffer(struct rt_rtmp_adapter *pAd,
+					 unsigned long Length,
+					 IN BOOLEAN Cached,
+					 void ** VirtualAddress)
 {
 	struct sk_buff *pkt;
 
 	pkt = dev_alloc_skb(Length);
 
-	if (pkt == NULL)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("can't allocate tx %ld size packet\n",Length));
+	if (pkt == NULL) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("can't allocate tx %ld size packet\n", Length));
 	}
 
-	if (pkt)
-	{
+	if (pkt) {
 		RTMP_SET_PACKET_SOURCE(OSPKT_TO_RTPKT(pkt), PKTSRC_NDIS);
-		*VirtualAddress = (PVOID) pkt->data;
-	}
-	else
-	{
-		*VirtualAddress = (PVOID) NULL;
+		*VirtualAddress = (void *)pkt->data;
+	} else {
+		*VirtualAddress = (void *)NULL;
 	}
 
-	return (PNDIS_PACKET) pkt;
+	return (void *)pkt;
 }
 
-
-VOID build_tx_packet(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PNDIS_PACKET	pPacket,
-	IN	PUCHAR	pFrame,
-	IN	ULONG	FrameLen)
+void build_tx_packet(struct rt_rtmp_adapter *pAd,
+		     void *pPacket,
+		     u8 *pFrame, unsigned long FrameLen)
 {
 
-	struct sk_buff	*pTxPkt;
+	struct sk_buff *pTxPkt;
 
 	ASSERT(pPacket);
 	pTxPkt = RTPKT_TO_OSPKT(pPacket);
@@ -275,32 +233,36 @@ VOID build_tx_packet(
 	NdisMoveMemory(skb_put(pTxPkt, FrameLen), pFrame, FrameLen);
 }
 
-VOID	RTMPFreeAdapter(
-	IN	PRTMP_ADAPTER	pAd)
+void RTMPFreeAdapter(struct rt_rtmp_adapter *pAd)
 {
-    POS_COOKIE os_cookie;
+	struct os_cookie *os_cookie;
 	int index;
 
-	os_cookie=(POS_COOKIE)pAd->OS_Cookie;
-
-	kfree(pAd->BeaconBuf);
+	os_cookie = (struct os_cookie *)pAd->OS_Cookie;
 
+	if (pAd->BeaconBuf)
+		kfree(pAd->BeaconBuf);
 
 	NdisFreeSpinLock(&pAd->MgmtRingLock);
-#ifdef RT2860
+
+#ifdef RTMP_MAC_PCI
 	NdisFreeSpinLock(&pAd->RxRingLock);
-#endif
-	for (index =0 ; index < NUM_OF_TX_RING; index++)
-	{
-    	NdisFreeSpinLock(&pAd->TxSwQueueLock[index]);
+#ifdef RT3090
+	NdisFreeSpinLock(&pAd->McuCmdLock);
+#endif /* RT3090 // */
+#endif /* RTMP_MAC_PCI // */
+
+	for (index = 0; index < NUM_OF_TX_RING; index++) {
+		NdisFreeSpinLock(&pAd->TxSwQueueLock[index]);
 		NdisFreeSpinLock(&pAd->DeQueueLock[index]);
 		pAd->DeQueueRunning[index] = FALSE;
 	}
 
 	NdisFreeSpinLock(&pAd->irq_lock);
 
-	vfree(pAd); // pci_free_consistent(os_cookie->pci_dev,sizeof(RTMP_ADAPTER),pAd,os_cookie->pAd_pa);
-	kfree(os_cookie);
+	vfree(pAd);		/* pci_free_consistent(os_cookie->pci_dev,sizeof(struct rt_rtmp_adapter),pAd,os_cookie->pAd_pa); */
+	if (os_cookie)
+		kfree(os_cookie);
 }
 
 BOOLEAN OS_Need_Clone_Packet(void)
@@ -308,8 +270,6 @@ BOOLEAN OS_Need_Clone_Packet(void)
 	return (FALSE);
 }
 
-
-
 /*
 	========================================================================
 
@@ -317,7 +277,7 @@ BOOLEAN OS_Need_Clone_Packet(void)
 		clone an input NDIS PACKET to another one. The new internally created NDIS PACKET
 		must have only one NDIS BUFFER
 		return - byte copied. 0 means can't create NDIS PACKET
-		NOTE: internally created NDIS_PACKET should be destroyed by RTMPFreeNdisPacket
+		NOTE: internally created char should be destroyed by RTMPFreeNdisPacket
 
 	Arguments:
 		pAd 	Pointer to our adapter
@@ -332,11 +292,10 @@ BOOLEAN OS_Need_Clone_Packet(void)
 
 	========================================================================
 */
-NDIS_STATUS RTMPCloneNdisPacket(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	BOOLEAN			pInsAMSDUHdr,
-	IN	PNDIS_PACKET	pInPacket,
-	OUT PNDIS_PACKET   *ppOutPacket)
+int RTMPCloneNdisPacket(struct rt_rtmp_adapter *pAd,
+				IN BOOLEAN pInsAMSDUHdr,
+				void *pInPacket,
+				void ** ppOutPacket)
 {
 
 	struct sk_buff *pkt;
@@ -344,19 +303,18 @@ NDIS_STATUS RTMPCloneNdisPacket(
 	ASSERT(pInPacket);
 	ASSERT(ppOutPacket);
 
-	// 1. Allocate a packet
+	/* 1. Allocate a packet */
 	pkt = dev_alloc_skb(2048);
 
-	if (pkt == NULL)
-	{
+	if (pkt == NULL) {
 		return NDIS_STATUS_FAILURE;
 	}
 
- 	skb_put(pkt, GET_OS_PKT_LEN(pInPacket));
-	NdisMoveMemory(pkt->data, GET_OS_PKT_DATAPTR(pInPacket), GET_OS_PKT_LEN(pInPacket));
+	skb_put(pkt, GET_OS_PKT_LEN(pInPacket));
+	NdisMoveMemory(pkt->data, GET_OS_PKT_DATAPTR(pInPacket),
+		       GET_OS_PKT_LEN(pInPacket));
 	*ppOutPacket = OSPKT_TO_RTPKT(pkt);
 
-
 	RTMP_SET_PACKET_SOURCE(OSPKT_TO_RTPKT(pkt), PKTSRC_NDIS);
 
 	printk("###Clone###\n");
@@ -364,42 +322,40 @@ NDIS_STATUS RTMPCloneNdisPacket(
 	return NDIS_STATUS_SUCCESS;
 }
 
-
-// the allocated NDIS PACKET must be freed via RTMPFreeNdisPacket()
-NDIS_STATUS RTMPAllocateNdisPacket(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT PNDIS_PACKET   *ppPacket,
-	IN	PUCHAR			pHeader,
-	IN	UINT			HeaderLen,
-	IN	PUCHAR			pData,
-	IN	UINT			DataLen)
+/* the allocated NDIS PACKET must be freed via RTMPFreeNdisPacket() */
+int RTMPAllocateNdisPacket(struct rt_rtmp_adapter *pAd,
+				   void ** ppPacket,
+				   u8 *pHeader,
+				   u32 HeaderLen,
+				   u8 *pData, u32 DataLen)
 {
-	PNDIS_PACKET	pPacket;
+	void *pPacket;
 	ASSERT(pData);
 	ASSERT(DataLen);
 
-	// 1. Allocate a packet
-	pPacket = (PNDIS_PACKET *) dev_alloc_skb(HeaderLen + DataLen + TXPADDING_SIZE);
-	if (pPacket == NULL)
- 	{
+	/* 1. Allocate a packet */
+	pPacket =
+	    (void **) dev_alloc_skb(HeaderLen + DataLen +
+					   RTMP_PKT_TAIL_PADDING);
+	if (pPacket == NULL) {
 		*ppPacket = NULL;
 #ifdef DEBUG
-		printk("RTMPAllocateNdisPacket Fail\n\n");
+		printk("RTMPAllocateNdisPacket Fail\n");
 #endif
 		return NDIS_STATUS_FAILURE;
 	}
-
-	// 2. clone the frame content
+	/* 2. clone the frame content */
 	if (HeaderLen > 0)
 		NdisMoveMemory(GET_OS_PKT_DATAPTR(pPacket), pHeader, HeaderLen);
 	if (DataLen > 0)
-		NdisMoveMemory(GET_OS_PKT_DATAPTR(pPacket) + HeaderLen, pData, DataLen);
+		NdisMoveMemory(GET_OS_PKT_DATAPTR(pPacket) + HeaderLen, pData,
+			       DataLen);
 
-	// 3. update length of packet
- 	skb_put(GET_OS_PKT_TYPE(pPacket), HeaderLen+DataLen);
+	/* 3. update length of packet */
+	skb_put(GET_OS_PKT_TYPE(pPacket), HeaderLen + DataLen);
 
 	RTMP_SET_PACKET_SOURCE(pPacket, PKTSRC_NDIS);
-//	printk("%s : pPacket = %p, len = %d\n", __func__, pPacket, GET_OS_PKT_LEN(pPacket));
+/*      printk("%s : pPacket = %p, len = %d\n", __func__, pPacket, GET_OS_PKT_LEN(pPacket)); */
 	*ppPacket = pPacket;
 	return NDIS_STATUS_SUCCESS;
 }
@@ -407,42 +363,34 @@ NDIS_STATUS RTMPAllocateNdisPacket(
 /*
   ========================================================================
   Description:
-	This routine frees a miniport internally allocated NDIS_PACKET and its
+	This routine frees a miniport internally allocated char and its
 	corresponding NDIS_BUFFER and allocated memory.
   ========================================================================
 */
-VOID RTMPFreeNdisPacket(
-	IN PRTMP_ADAPTER pAd,
-	IN PNDIS_PACKET  pPacket)
+void RTMPFreeNdisPacket(struct rt_rtmp_adapter *pAd, void *pPacket)
 {
 	dev_kfree_skb_any(RTPKT_TO_OSPKT(pPacket));
 }
 
-
-// IRQL = DISPATCH_LEVEL
-// NOTE: we do have an assumption here, that Byte0 and Byte1 always reasid at the same
-//			 scatter gather buffer
-NDIS_STATUS Sniff2BytesFromNdisBuffer(
-	IN	PNDIS_BUFFER	pFirstBuffer,
-	IN	UCHAR			DesiredOffset,
-	OUT PUCHAR			pByte0,
-	OUT PUCHAR			pByte1)
+/* IRQL = DISPATCH_LEVEL */
+/* NOTE: we do have an assumption here, that Byte0 and Byte1 always reasid at the same */
+/*                       scatter gather buffer */
+int Sniff2BytesFromNdisBuffer(char *pFirstBuffer,
+				      u8 DesiredOffset,
+				      u8 *pByte0, u8 *pByte1)
 {
-    *pByte0 = *(PUCHAR)(pFirstBuffer + DesiredOffset);
-    *pByte1 = *(PUCHAR)(pFirstBuffer + DesiredOffset + 1);
+	*pByte0 = *(u8 *)(pFirstBuffer + DesiredOffset);
+	*pByte1 = *(u8 *)(pFirstBuffer + DesiredOffset + 1);
 
 	return NDIS_STATUS_SUCCESS;
 }
 
-
-void RTMP_QueryPacketInfo(
-	IN  PNDIS_PACKET pPacket,
-	OUT PACKET_INFO  *pPacketInfo,
-	OUT PUCHAR		 *pSrcBufVA,
-	OUT	UINT		 *pSrcBufLen)
+void RTMP_QueryPacketInfo(void *pPacket,
+			  struct rt_packet_info *pPacketInfo,
+			  u8 ** pSrcBufVA, u32 * pSrcBufLen)
 {
 	pPacketInfo->BufferCount = 1;
-	pPacketInfo->pFirstBuffer = GET_OS_PKT_DATAPTR(pPacket);
+	pPacketInfo->pFirstBuffer = (char *)GET_OS_PKT_DATAPTR(pPacket);
 	pPacketInfo->PhysicalBufferCount = 1;
 	pPacketInfo->TotalPacketLength = GET_OS_PKT_LEN(pPacket);
 
@@ -450,30 +398,26 @@ void RTMP_QueryPacketInfo(
 	*pSrcBufLen = GET_OS_PKT_LEN(pPacket);
 }
 
-void RTMP_QueryNextPacketInfo(
-	IN  PNDIS_PACKET *ppPacket,
-	OUT PACKET_INFO  *pPacketInfo,
-	OUT PUCHAR		 *pSrcBufVA,
-	OUT	UINT		 *pSrcBufLen)
+void RTMP_QueryNextPacketInfo(void ** ppPacket,
+			      struct rt_packet_info *pPacketInfo,
+			      u8 ** pSrcBufVA, u32 * pSrcBufLen)
 {
-	PNDIS_PACKET pPacket = NULL;
+	void *pPacket = NULL;
 
 	if (*ppPacket)
 		pPacket = GET_OS_PKT_NEXT(*ppPacket);
 
-	if (pPacket)
-	{
+	if (pPacket) {
 		pPacketInfo->BufferCount = 1;
-		pPacketInfo->pFirstBuffer = GET_OS_PKT_DATAPTR(pPacket);
+		pPacketInfo->pFirstBuffer =
+		    (char *)GET_OS_PKT_DATAPTR(pPacket);
 		pPacketInfo->PhysicalBufferCount = 1;
 		pPacketInfo->TotalPacketLength = GET_OS_PKT_LEN(pPacket);
 
 		*pSrcBufVA = GET_OS_PKT_DATAPTR(pPacket);
 		*pSrcBufLen = GET_OS_PKT_LEN(pPacket);
 		*ppPacket = GET_OS_PKT_NEXT(pPacket);
-	}
-	else
-	{
+	} else {
 		pPacketInfo->BufferCount = 0;
 		pPacketInfo->pFirstBuffer = NULL;
 		pPacketInfo->PhysicalBufferCount = 0;
@@ -485,36 +429,19 @@ void RTMP_QueryNextPacketInfo(
 	}
 }
 
-// not yet support MBSS
-PNET_DEV get_netdev_from_bssid(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			FromWhichBSSID)
-{
-    PNET_DEV dev_p = NULL;
-
-	dev_p = pAd->net_dev;
-
-	ASSERT(dev_p);
-	return dev_p; /* return one of MBSS */
-}
-
-PNDIS_PACKET DuplicatePacket(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PNDIS_PACKET	pPacket,
-	IN	UCHAR			FromWhichBSSID)
+void *DuplicatePacket(struct rt_rtmp_adapter *pAd,
+			     void *pPacket, u8 FromWhichBSSID)
 {
-	struct sk_buff	*skb;
-	PNDIS_PACKET	pRetPacket = NULL;
-	USHORT			DataSize;
-	UCHAR			*pData;
-
-	DataSize = (USHORT) GET_OS_PKT_LEN(pPacket);
-	pData = (PUCHAR) GET_OS_PKT_DATAPTR(pPacket);
+	struct sk_buff *skb;
+	void *pRetPacket = NULL;
+	u16 DataSize;
+	u8 *pData;
 
+	DataSize = (u16)GET_OS_PKT_LEN(pPacket);
+	pData = (u8 *)GET_OS_PKT_DATAPTR(pPacket);
 
 	skb = skb_clone(RTPKT_TO_OSPKT(pPacket), MEM_ALLOC_FLAG);
-	if (skb)
-	{
+	if (skb) {
 		skb->dev = get_netdev_from_bssid(pAd, FromWhichBSSID);
 		pRetPacket = OSPKT_TO_RTPKT(skb);
 	}
@@ -523,24 +450,21 @@ PNDIS_PACKET DuplicatePacket(
 
 }
 
-PNDIS_PACKET duplicate_pkt(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			pHeader802_3,
-    IN  UINT            HdrLen,
-	IN	PUCHAR			pData,
-	IN	ULONG			DataSize,
-	IN	UCHAR			FromWhichBSSID)
+void *duplicate_pkt(struct rt_rtmp_adapter *pAd,
+			   u8 *pHeader802_3,
+			   u32 HdrLen,
+			   u8 *pData,
+			   unsigned long DataSize, u8 FromWhichBSSID)
 {
-	struct sk_buff	*skb;
-	PNDIS_PACKET	pPacket = NULL;
-
+	struct sk_buff *skb;
+	void *pPacket = NULL;
 
-	if ((skb = __dev_alloc_skb(HdrLen + DataSize + 2, MEM_ALLOC_FLAG)) != NULL)
-	{
+	if ((skb =
+	     __dev_alloc_skb(HdrLen + DataSize + 2, MEM_ALLOC_FLAG)) != NULL) {
 		skb_reserve(skb, 2);
-		NdisMoveMemory(skb_tail_pointer(skb), pHeader802_3, HdrLen);
+		NdisMoveMemory(skb->tail, pHeader802_3, HdrLen);
 		skb_put(skb, HdrLen);
-		NdisMoveMemory(skb_tail_pointer(skb), pData, DataSize);
+		NdisMoveMemory(skb->tail, pData, DataSize);
 		skb_put(skb, DataSize);
 		skb->dev = get_netdev_from_bssid(pAd, FromWhichBSSID);
 		pPacket = OSPKT_TO_RTPKT(skb);
@@ -549,24 +473,22 @@ PNDIS_PACKET duplicate_pkt(
 	return pPacket;
 }
 
-
 #define TKIP_TX_MIC_SIZE		8
-PNDIS_PACKET duplicate_pkt_with_TKIP_MIC(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PNDIS_PACKET	pPacket)
+void *duplicate_pkt_with_TKIP_MIC(struct rt_rtmp_adapter *pAd,
+					 void *pPacket)
 {
-	struct sk_buff	*skb, *newskb;
-
+	struct sk_buff *skb, *newskb;
 
 	skb = RTPKT_TO_OSPKT(pPacket);
-	if (skb_tailroom(skb) < TKIP_TX_MIC_SIZE)
-	{
-		// alloc a new skb and copy the packet
-		newskb = skb_copy_expand(skb, skb_headroom(skb), TKIP_TX_MIC_SIZE, GFP_ATOMIC);
+	if (skb_tailroom(skb) < TKIP_TX_MIC_SIZE) {
+		/* alloc a new skb and copy the packet */
+		newskb =
+		    skb_copy_expand(skb, skb_headroom(skb), TKIP_TX_MIC_SIZE,
+				    GFP_ATOMIC);
 		dev_kfree_skb_any(skb);
-		if (newskb == NULL)
-		{
-			DBGPRINT(RT_DEBUG_ERROR, ("Extend Tx.MIC for packet failed!, dropping packet!\n"));
+		if (newskb == NULL) {
+			DBGPRINT(RT_DEBUG_ERROR,
+				 ("Extend Tx.MIC for packet failed!, dropping packet!\n"));
 			return NULL;
 		}
 		skb = newskb;
@@ -575,45 +497,37 @@ PNDIS_PACKET duplicate_pkt_with_TKIP_MIC(
 	return OSPKT_TO_RTPKT(skb);
 }
 
-
-
-
-PNDIS_PACKET ClonePacket(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PNDIS_PACKET	pPacket,
-	IN	PUCHAR			pData,
-	IN	ULONG			DataSize)
+void *ClonePacket(struct rt_rtmp_adapter *pAd,
+			 void *pPacket,
+			 u8 *pData, unsigned long DataSize)
 {
-	struct sk_buff	*pRxPkt;
-	struct sk_buff	*pClonedPkt;
+	struct sk_buff *pRxPkt;
+	struct sk_buff *pClonedPkt;
 
 	ASSERT(pPacket);
 	pRxPkt = RTPKT_TO_OSPKT(pPacket);
 
-	// clone the packet
+	/* clone the packet */
 	pClonedPkt = skb_clone(pRxPkt, MEM_ALLOC_FLAG);
 
-	if (pClonedPkt)
-	{
-    	// set the correct dataptr and data len
-    	pClonedPkt->dev = pRxPkt->dev;
-    	pClonedPkt->data = pData;
-    	pClonedPkt->len = DataSize;
-    	pClonedPkt->tail = pClonedPkt->data + pClonedPkt->len;
+	if (pClonedPkt) {
+		/* set the correct dataptr and data len */
+		pClonedPkt->dev = pRxPkt->dev;
+		pClonedPkt->data = pData;
+		pClonedPkt->len = DataSize;
+		pClonedPkt->tail = pClonedPkt->data + pClonedPkt->len;
 		ASSERT(DataSize < 1530);
 	}
 	return pClonedPkt;
 }
 
-//
-// change OS packet DataPtr and DataLen
-//
-void  update_os_packet_info(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	RX_BLK			*pRxBlk,
-	IN  UCHAR			FromWhichBSSID)
+/* */
+/* change OS packet DataPtr and DataLen */
+/* */
+void update_os_packet_info(struct rt_rtmp_adapter *pAd,
+			   struct rt_rx_blk *pRxBlk, u8 FromWhichBSSID)
 {
-	struct sk_buff	*pOSPkt;
+	struct sk_buff *pOSPkt;
 
 	ASSERT(pRxBlk->pRxPacket);
 	pOSPkt = RTPKT_TO_OSPKT(pRxBlk->pRxPacket);
@@ -624,14 +538,12 @@ void  update_os_packet_info(
 	pOSPkt->tail = pOSPkt->data + pOSPkt->len;
 }
 
-
-void wlan_802_11_to_802_3_packet(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	RX_BLK			*pRxBlk,
-	IN	PUCHAR			pHeader802_3,
-	IN  UCHAR			FromWhichBSSID)
+void wlan_802_11_to_802_3_packet(struct rt_rtmp_adapter *pAd,
+				 struct rt_rx_blk *pRxBlk,
+				 u8 *pHeader802_3,
+				 u8 FromWhichBSSID)
 {
-	struct sk_buff	*pOSPkt;
+	struct sk_buff *pOSPkt;
 
 	ASSERT(pRxBlk->pRxPacket);
 	ASSERT(pHeader802_3);
@@ -643,37 +555,35 @@ void wlan_802_11_to_802_3_packet(
 	pOSPkt->len = pRxBlk->DataSize;
 	pOSPkt->tail = pOSPkt->data + pOSPkt->len;
 
-	//
-	// copy 802.3 header
-	//
-	//
+	/* */
+	/* copy 802.3 header */
+	/* */
+	/* */
 
-	NdisMoveMemory(skb_push(pOSPkt, LENGTH_802_3), pHeader802_3, LENGTH_802_3);
+	NdisMoveMemory(skb_push(pOSPkt, LENGTH_802_3), pHeader802_3,
+		       LENGTH_802_3);
 }
 
-void announce_802_3_packet(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PNDIS_PACKET	pPacket)
+void announce_802_3_packet(struct rt_rtmp_adapter *pAd, void *pPacket)
 {
 
-	struct sk_buff	*pRxPkt;
+	struct sk_buff *pRxPkt;
 
 	ASSERT(pPacket);
 
 	pRxPkt = RTPKT_TO_OSPKT(pPacket);
 
-    /* Push up the protocol stack */
+	/* Push up the protocol stack */
 	pRxPkt->protocol = eth_type_trans(pRxPkt, pRxPkt->dev);
 
 	netif_rx(pRxPkt);
 }
 
-
-PRTMP_SCATTER_GATHER_LIST
-rt_get_sg_list_from_packet(PNDIS_PACKET pPacket, RTMP_SCATTER_GATHER_LIST *sg)
+struct rt_rtmp_sg_list *
+rt_get_sg_list_from_packet(void *pPacket, struct rt_rtmp_sg_list *sg)
 {
 	sg->NumberOfElements = 1;
-	sg->Elements[0].Address =  GET_OS_PKT_DATAPTR(pPacket);
+	sg->Elements[0].Address = GET_OS_PKT_DATAPTR(pPacket);
 	sg->Elements[0].Length = GET_OS_PKT_LEN(pPacket);
 	return (sg);
 }
@@ -687,13 +597,13 @@ void hex_dump(char *str, unsigned char *pSrcBufVA, unsigned int SrcBufLen)
 		return;
 
 	pt = pSrcBufVA;
-	printk("%s: %p, len = %d\n",str,  pSrcBufVA, SrcBufLen);
-	for (x=0; x<SrcBufLen; x++)
-	{
+	printk("%s: %p, len = %d\n", str, pSrcBufVA, SrcBufLen);
+	for (x = 0; x < SrcBufLen; x++) {
 		if (x % 16 == 0)
 			printk("0x%04x : ", x);
 		printk("%02x ", ((unsigned char)pt[x]));
-		if (x%16 == 15) printk("\n");
+		if (x % 16 == 15)
+			printk("\n");
 	}
 	printk("\n");
 }
@@ -718,187 +628,197 @@ void hex_dump(char *str, unsigned char *pSrcBufVA, unsigned int SrcBufLen)
 
 	========================================================================
 */
-VOID RTMPSendWirelessEvent(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	USHORT			Event_flag,
-	IN	PUCHAR 			pAddr,
-	IN	UCHAR			BssIdx,
-	IN	CHAR			Rssi)
+void RTMPSendWirelessEvent(struct rt_rtmp_adapter *pAd,
+			   u16 Event_flag,
+			   u8 *pAddr, u8 BssIdx, char Rssi)
 {
 
-	union 	iwreq_data      wrqu;
-	PUCHAR 	pBuf = NULL, pBufPtr = NULL;
-	USHORT	event, type, BufLen;
-	UCHAR	event_table_len = 0;
+	/*union         iwreq_data      wrqu; */
+	char *pBuf = NULL, *pBufPtr = NULL;
+	u16 event, type, BufLen;
+	u8 event_table_len = 0;
 
 	type = Event_flag & 0xFF00;
 	event = Event_flag & 0x00FF;
 
-	switch (type)
-	{
-		case IW_SYS_EVENT_FLAG_START:
-			event_table_len = IW_SYS_EVENT_TYPE_NUM;
-			break;
+	switch (type) {
+	case IW_SYS_EVENT_FLAG_START:
+		event_table_len = IW_SYS_EVENT_TYPE_NUM;
+		break;
 
-		case IW_SPOOF_EVENT_FLAG_START:
-			event_table_len = IW_SPOOF_EVENT_TYPE_NUM;
-			break;
+	case IW_SPOOF_EVENT_FLAG_START:
+		event_table_len = IW_SPOOF_EVENT_TYPE_NUM;
+		break;
 
-		case IW_FLOOD_EVENT_FLAG_START:
-			event_table_len = IW_FLOOD_EVENT_TYPE_NUM;
-			break;
+	case IW_FLOOD_EVENT_FLAG_START:
+		event_table_len = IW_FLOOD_EVENT_TYPE_NUM;
+		break;
 	}
 
-	if (event_table_len == 0)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("%s : The type(%0x02x) is not valid.\n", __func__, type));
+	if (event_table_len == 0) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("%s : The type(%0x02x) is not valid.\n", __func__,
+			  type));
 		return;
 	}
 
-	if (event >= event_table_len)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("%s : The event(%0x02x) is not valid.\n", __func__, event));
+	if (event >= event_table_len) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("%s : The event(%0x02x) is not valid.\n", __func__,
+			  event));
 		return;
 	}
-
-	//Allocate memory and copy the msg.
-	if((pBuf = kmalloc(IW_CUSTOM_MAX_LEN, GFP_ATOMIC)) != NULL)
-	{
-		//Prepare the payload
+	/*Allocate memory and copy the msg. */
+	if ((pBuf = kmalloc(IW_CUSTOM_MAX_LEN, GFP_ATOMIC)) != NULL) {
+		/*Prepare the payload */
 		memset(pBuf, 0, IW_CUSTOM_MAX_LEN);
 
 		pBufPtr = pBuf;
 
 		if (pAddr)
-			pBufPtr += sprintf(pBufPtr, "(RT2860) STA(%02x:%02x:%02x:%02x:%02x:%02x) ", PRINT_MAC(pAddr));
+			pBufPtr +=
+			    sprintf(pBufPtr,
+				    "(RT2860) STA(%02x:%02x:%02x:%02x:%02x:%02x) ",
+				    PRINT_MAC(pAddr));
 		else if (BssIdx < MAX_MBSSID_NUM)
-			pBufPtr += sprintf(pBufPtr, "(RT2860) BSS(wlan%d) ", BssIdx);
+			pBufPtr +=
+			    sprintf(pBufPtr, "(RT2860) BSS(wlan%d) ", BssIdx);
 		else
 			pBufPtr += sprintf(pBufPtr, "(RT2860) ");
 
 		if (type == IW_SYS_EVENT_FLAG_START)
-			pBufPtr += sprintf(pBufPtr, "%s", pWirelessSysEventText[event]);
+			pBufPtr +=
+			    sprintf(pBufPtr, "%s",
+				    pWirelessSysEventText[event]);
 		else if (type == IW_SPOOF_EVENT_FLAG_START)
-			pBufPtr += sprintf(pBufPtr, "%s (RSSI=%d)", pWirelessSpoofEventText[event], Rssi);
+			pBufPtr +=
+			    sprintf(pBufPtr, "%s (RSSI=%d)",
+				    pWirelessSpoofEventText[event], Rssi);
 		else if (type == IW_FLOOD_EVENT_FLAG_START)
-			pBufPtr += sprintf(pBufPtr, "%s", pWirelessFloodEventText[event]);
+			pBufPtr +=
+			    sprintf(pBufPtr, "%s",
+				    pWirelessFloodEventText[event]);
 		else
 			pBufPtr += sprintf(pBufPtr, "%s", "unknown event");
 
 		pBufPtr[pBufPtr - pBuf] = '\0';
 		BufLen = pBufPtr - pBuf;
 
-		memset(&wrqu, 0, sizeof(wrqu));
-	    wrqu.data.flags = Event_flag;
-		wrqu.data.length = BufLen;
-
-		//send wireless event
-	    wireless_send_event(pAd->net_dev, IWEVCUSTOM, &wrqu, pBuf);
-
-		//DBGPRINT(RT_DEBUG_TRACE, ("%s : %s\n", __func__, pBuf));
+		RtmpOSWrielessEventSend(pAd, IWEVCUSTOM, Event_flag, NULL,
+					(u8 *)pBuf, BufLen);
+		/*DBGPRINT(RT_DEBUG_TRACE, ("%s : %s\n", __func__, pBuf)); */
 
 		kfree(pBuf);
-	}
-	else
-		DBGPRINT(RT_DEBUG_ERROR, ("%s : Can't allocate memory for wireless event.\n", __func__));
+	} else
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("%s : Can't allocate memory for wireless event.\n",
+			  __func__));
 }
 
-void send_monitor_packets(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	RX_BLK			*pRxBlk)
+void send_monitor_packets(struct rt_rtmp_adapter *pAd, struct rt_rx_blk *pRxBlk)
 {
-    struct sk_buff	*pOSPkt;
-    wlan_ng_prism2_header *ph;
-    int rate_index = 0;
-    USHORT header_len = 0;
-    UCHAR temp_header[40] = {0};
-
-    u_int32_t ralinkrate[256] = {2,4,11,22, 12,18,24,36,48,72,96,  108,   109, 110, 111, 112, 13, 26, 39, 52,78,104, 117, 130, 26, 52, 78,104, 156, 208, 234, 260, 27, 54,81,108,162, 216, 243, 270, // Last 38
-	54, 108, 162, 216, 324, 432, 486, 540,  14, 29, 43, 57, 87, 115, 130, 144, 29, 59,87,115, 173, 230,260, 288, 30, 60,90,120,180,240,270,300,60,120,180,240,360,480,540,600, 0,1,2,3,4,5,6,7,8,9,10,
-	11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80};
-
+	struct sk_buff *pOSPkt;
+	struct rt_wlan_ng_prism2_header *ph;
+	int rate_index = 0;
+	u16 header_len = 0;
+	u8 temp_header[40] = { 0 };
+
+	u_int32_t ralinkrate[256] = { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108, 109, 110, 111, 112, 13, 26, 39, 52, 78, 104, 117, 130, 26, 52, 78, 104, 156, 208, 234, 260, 27, 54, 81, 108, 162, 216, 243, 270,	/* Last 38 */
+		54, 108, 162, 216, 324, 432, 486, 540, 14, 29, 43, 57, 87, 115,
+		    130, 144, 29, 59, 87, 115, 173, 230, 260, 288, 30, 60, 90,
+		    120, 180, 240, 270, 300, 60, 120, 180, 240, 360, 480, 540,
+		    600, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10,
+		11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26,
+		    27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41,
+		    42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56,
+		    57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71,
+		    72, 73, 74, 75, 76, 77, 78, 79, 80
+	};
 
-    ASSERT(pRxBlk->pRxPacket);
-    if (pRxBlk->DataSize < 10)
-    {
-        DBGPRINT(RT_DEBUG_ERROR, ("%s : Size is too small! (%d)\n", __func__, pRxBlk->DataSize));
+	ASSERT(pRxBlk->pRxPacket);
+	if (pRxBlk->DataSize < 10) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("%s : Size is too small! (%d)\n", __func__,
+			  pRxBlk->DataSize));
 		goto err_free_sk_buff;
-    }
+	}
 
-    if (pRxBlk->DataSize + sizeof(wlan_ng_prism2_header) > RX_BUFFER_AGGRESIZE)
-    {
-        DBGPRINT(RT_DEBUG_ERROR, ("%s : Size is too large! (%zu)\n", __func__, pRxBlk->DataSize + sizeof(wlan_ng_prism2_header)));
+	if (pRxBlk->DataSize + sizeof(struct rt_wlan_ng_prism2_header) >
+	    RX_BUFFER_AGGRESIZE) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("%s : Size is too large! (%zu)\n", __func__,
+			  pRxBlk->DataSize + sizeof(struct rt_wlan_ng_prism2_header)));
 		goto err_free_sk_buff;
-    }
+	}
 
-    pOSPkt = RTPKT_TO_OSPKT(pRxBlk->pRxPacket);
+	pOSPkt = RTPKT_TO_OSPKT(pRxBlk->pRxPacket);
 	pOSPkt->dev = get_netdev_from_bssid(pAd, BSS0);
-    if (pRxBlk->pHeader->FC.Type == BTYPE_DATA)
-    {
-        pRxBlk->DataSize -= LENGTH_802_11;
-        if ((pRxBlk->pHeader->FC.ToDs == 1) &&
-            (pRxBlk->pHeader->FC.FrDs == 1))
-            header_len = LENGTH_802_11_WITH_ADDR4;
-        else
-            header_len = LENGTH_802_11;
-
-        // QOS
-    	if (pRxBlk->pHeader->FC.SubType & 0x08)
-    	{
-    	    header_len += 2;
-    		// Data skip QOS contorl field
-    		pRxBlk->DataSize -=2;
-    	}
-
-    	// Order bit: A-Ralink or HTC+
-    	if (pRxBlk->pHeader->FC.Order)
-    	{
-    	    header_len += 4;
-			// Data skip HTC contorl field
-			pRxBlk->DataSize -= 4;
-    	}
-
-        // Copy Header
-        if (header_len <= 40)
-            NdisMoveMemory(temp_header, pRxBlk->pData, header_len);
+	if (pRxBlk->pHeader->FC.Type == BTYPE_DATA) {
+		pRxBlk->DataSize -= LENGTH_802_11;
+		if ((pRxBlk->pHeader->FC.ToDs == 1) &&
+		    (pRxBlk->pHeader->FC.FrDs == 1))
+			header_len = LENGTH_802_11_WITH_ADDR4;
+		else
+			header_len = LENGTH_802_11;
 
-        // skip HW padding
-    	if (pRxBlk->RxD.L2PAD)
-    	    pRxBlk->pData += (header_len + 2);
-        else
-            pRxBlk->pData += header_len;
-    } //end if
+		/* QOS */
+		if (pRxBlk->pHeader->FC.SubType & 0x08) {
+			header_len += 2;
+			/* Data skip QOS contorl field */
+			pRxBlk->DataSize -= 2;
+		}
+		/* Order bit: A-Ralink or HTC+ */
+		if (pRxBlk->pHeader->FC.Order) {
+			header_len += 4;
+			/* Data skip HTC contorl field */
+			pRxBlk->DataSize -= 4;
+		}
+		/* Copy Header */
+		if (header_len <= 40)
+			NdisMoveMemory(temp_header, pRxBlk->pData, header_len);
 
+		/* skip HW padding */
+		if (pRxBlk->RxD.L2PAD)
+			pRxBlk->pData += (header_len + 2);
+		else
+			pRxBlk->pData += header_len;
+	}			/*end if */
 
 	if (pRxBlk->DataSize < pOSPkt->len) {
-        skb_trim(pOSPkt,pRxBlk->DataSize);
-    } else {
-        skb_put(pOSPkt,(pRxBlk->DataSize - pOSPkt->len));
-    } //end if
-
-    if ((pRxBlk->pData - pOSPkt->data) > 0) {
-	    skb_put(pOSPkt,(pRxBlk->pData - pOSPkt->data));
-	    skb_pull(pOSPkt,(pRxBlk->pData - pOSPkt->data));
-    } //end if
-
-    if (skb_headroom(pOSPkt) < (sizeof(wlan_ng_prism2_header)+ header_len)) {
-        if (pskb_expand_head(pOSPkt, (sizeof(wlan_ng_prism2_header) + header_len), 0, GFP_ATOMIC)) {
-	        DBGPRINT(RT_DEBUG_ERROR, ("%s : Reallocate header size of sk_buff fail!\n", __func__));
+		skb_trim(pOSPkt, pRxBlk->DataSize);
+	} else {
+		skb_put(pOSPkt, (pRxBlk->DataSize - pOSPkt->len));
+	}			/*end if */
+
+	if ((pRxBlk->pData - pOSPkt->data) > 0) {
+		skb_put(pOSPkt, (pRxBlk->pData - pOSPkt->data));
+		skb_pull(pOSPkt, (pRxBlk->pData - pOSPkt->data));
+	}			/*end if */
+
+	if (skb_headroom(pOSPkt) < (sizeof(struct rt_wlan_ng_prism2_header) + header_len)) {
+		if (pskb_expand_head
+		    (pOSPkt, (sizeof(struct rt_wlan_ng_prism2_header) + header_len), 0,
+		     GFP_ATOMIC)) {
+			DBGPRINT(RT_DEBUG_ERROR,
+				 ("%s : Reallocate header size of sk_buff fail!\n",
+				  __func__));
 			goto err_free_sk_buff;
-	    } //end if
-    } //end if
+		}		/*end if */
+	}			/*end if */
 
-    if (header_len > 0)
-        NdisMoveMemory(skb_push(pOSPkt, header_len), temp_header, header_len);
+	if (header_len > 0)
+		NdisMoveMemory(skb_push(pOSPkt, header_len), temp_header,
+			       header_len);
 
-    ph = (wlan_ng_prism2_header *) skb_push(pOSPkt, sizeof(wlan_ng_prism2_header));
-	NdisZeroMemory(ph, sizeof(wlan_ng_prism2_header));
+	ph = (struct rt_wlan_ng_prism2_header *)skb_push(pOSPkt,
+						sizeof(struct rt_wlan_ng_prism2_header));
+	NdisZeroMemory(ph, sizeof(struct rt_wlan_ng_prism2_header));
 
-    ph->msgcode		    = DIDmsg_lnxind_wlansniffrm;
-	ph->msglen		    = sizeof(wlan_ng_prism2_header);
-	strcpy(ph->devname, pAd->net_dev->name);
+	ph->msgcode = DIDmsg_lnxind_wlansniffrm;
+	ph->msglen = sizeof(struct rt_wlan_ng_prism2_header);
+	strcpy((char *)ph->devname, (char *)pAd->net_dev->name);
 
-    ph->hosttime.did = DIDmsg_lnxind_wlansniffrm_hosttime;
+	ph->hosttime.did = DIDmsg_lnxind_wlansniffrm_hosttime;
 	ph->hosttime.status = 0;
 	ph->hosttime.len = 4;
 	ph->hosttime.data = jiffies;
@@ -908,63 +828,71 @@ void send_monitor_packets(
 	ph->mactime.len = 0;
 	ph->mactime.data = 0;
 
-    ph->istx.did = DIDmsg_lnxind_wlansniffrm_istx;
+	ph->istx.did = DIDmsg_lnxind_wlansniffrm_istx;
 	ph->istx.status = 0;
 	ph->istx.len = 0;
 	ph->istx.data = 0;
 
-    ph->channel.did = DIDmsg_lnxind_wlansniffrm_channel;
+	ph->channel.did = DIDmsg_lnxind_wlansniffrm_channel;
 	ph->channel.status = 0;
 	ph->channel.len = 4;
 
-    ph->channel.data = (u_int32_t)pAd->CommonCfg.Channel;
+	ph->channel.data = (u_int32_t) pAd->CommonCfg.Channel;
 
-    ph->rssi.did = DIDmsg_lnxind_wlansniffrm_rssi;
+	ph->rssi.did = DIDmsg_lnxind_wlansniffrm_rssi;
 	ph->rssi.status = 0;
 	ph->rssi.len = 4;
-    ph->rssi.data = (u_int32_t)RTMPMaxRssi(pAd, ConvertToRssi(pAd, pRxBlk->pRxWI->RSSI0, RSSI_0), ConvertToRssi(pAd, pRxBlk->pRxWI->RSSI1, RSSI_1), ConvertToRssi(pAd, pRxBlk->pRxWI->RSSI2, RSSI_2));;
+	ph->rssi.data =
+	    (u_int32_t) RTMPMaxRssi(pAd,
+				    ConvertToRssi(pAd, pRxBlk->pRxWI->RSSI0,
+						  RSSI_0), ConvertToRssi(pAd,
+									 pRxBlk->
+									 pRxWI->
+									 RSSI1,
+									 RSSI_1),
+				    ConvertToRssi(pAd, pRxBlk->pRxWI->RSSI2,
+						  RSSI_2));;
 
 	ph->signal.did = DIDmsg_lnxind_wlansniffrm_signal;
 	ph->signal.status = 0;
 	ph->signal.len = 4;
-	ph->signal.data = 0; //rssi + noise;
+	ph->signal.data = 0;	/*rssi + noise; */
 
 	ph->noise.did = DIDmsg_lnxind_wlansniffrm_noise;
 	ph->noise.status = 0;
 	ph->noise.len = 4;
 	ph->noise.data = 0;
 
-    if (pRxBlk->pRxWI->PHYMODE >= MODE_HTMIX)
-    {
-    	rate_index = 16 + ((UCHAR)pRxBlk->pRxWI->BW *16) + ((UCHAR)pRxBlk->pRxWI->ShortGI *32) + ((UCHAR)pRxBlk->pRxWI->MCS);
-    }
-    else
-	if (pRxBlk->pRxWI->PHYMODE == MODE_OFDM)
-    	rate_index = (UCHAR)(pRxBlk->pRxWI->MCS) + 4;
-    else
-    	rate_index = (UCHAR)(pRxBlk->pRxWI->MCS);
-    if (rate_index < 0)
-        rate_index = 0;
-    if (rate_index > 255)
-        rate_index = 255;
+	if (pRxBlk->pRxWI->PHYMODE >= MODE_HTMIX) {
+		rate_index =
+		    16 + ((u8)pRxBlk->pRxWI->BW * 16) +
+		    ((u8)pRxBlk->pRxWI->ShortGI * 32) +
+		    ((u8)pRxBlk->pRxWI->MCS);
+	} else if (pRxBlk->pRxWI->PHYMODE == MODE_OFDM)
+		rate_index = (u8)(pRxBlk->pRxWI->MCS) + 4;
+	else
+		rate_index = (u8)(pRxBlk->pRxWI->MCS);
+	if (rate_index < 0)
+		rate_index = 0;
+	if (rate_index > 255)
+		rate_index = 255;
 
 	ph->rate.did = DIDmsg_lnxind_wlansniffrm_rate;
 	ph->rate.status = 0;
 	ph->rate.len = 4;
-    ph->rate.data = ralinkrate[rate_index];
+	ph->rate.data = ralinkrate[rate_index];
 
 	ph->frmlen.did = DIDmsg_lnxind_wlansniffrm_frmlen;
-    ph->frmlen.status = 0;
+	ph->frmlen.status = 0;
 	ph->frmlen.len = 4;
-	ph->frmlen.data	= (u_int32_t)pRxBlk->DataSize;
-
+	ph->frmlen.data = (u_int32_t) pRxBlk->DataSize;
 
-    pOSPkt->pkt_type = PACKET_OTHERHOST;
-    pOSPkt->protocol = eth_type_trans(pOSPkt, pOSPkt->dev);
-    pOSPkt->ip_summed = CHECKSUM_NONE;
-    netif_rx(pOSPkt);
+	pOSPkt->pkt_type = PACKET_OTHERHOST;
+	pOSPkt->protocol = eth_type_trans(pOSPkt, pOSPkt->dev);
+	pOSPkt->ip_summed = CHECKSUM_NONE;
+	netif_rx(pOSPkt);
 
-    return;
+	return;
 
 err_free_sk_buff:
 	RELEASE_NDIS_PACKET(pAd, pRxBlk->pRxPacket, NDIS_STATUS_FAILURE);
@@ -972,31 +900,470 @@ err_free_sk_buff:
 
 }
 
-void rtmp_os_thread_init(PUCHAR pThreadName, PVOID pNotify)
+/*******************************************************************************
+
+	Device IRQ related functions.
+
+ *******************************************************************************/
+int RtmpOSIRQRequest(struct net_device *pNetDev)
+{
+#ifdef RTMP_PCI_SUPPORT
+	struct net_device *net_dev = pNetDev;
+	struct rt_rtmp_adapter *pAd = NULL;
+	int retval = 0;
+
+	GET_PAD_FROM_NET_DEV(pAd, pNetDev);
+
+	ASSERT(pAd);
+
+	if (pAd->infType == RTMP_DEV_INF_PCI) {
+		struct os_cookie *_pObj = (struct os_cookie *)(pAd->OS_Cookie);
+		RTMP_MSI_ENABLE(pAd);
+		retval =
+		    request_irq(_pObj->pci_dev->irq, rt2860_interrupt, SA_SHIRQ,
+				(net_dev)->name, (net_dev));
+		if (retval != 0)
+			printk("RT2860: request_irq  ERROR(%d)\n", retval);
+	}
+
+	return retval;
+#else
+	return 0;
+#endif
+}
+
+int RtmpOSIRQRelease(struct net_device *pNetDev)
+{
+	struct net_device *net_dev = pNetDev;
+	struct rt_rtmp_adapter *pAd = NULL;
+
+	GET_PAD_FROM_NET_DEV(pAd, net_dev);
+
+	ASSERT(pAd);
+
+#ifdef RTMP_PCI_SUPPORT
+	if (pAd->infType == RTMP_DEV_INF_PCI) {
+		struct os_cookie *pObj = (struct os_cookie *)(pAd->OS_Cookie);
+		synchronize_irq(pObj->pci_dev->irq);
+		free_irq(pObj->pci_dev->irq, (net_dev));
+		RTMP_MSI_DISABLE(pAd);
+	}
+#endif /* RTMP_PCI_SUPPORT // */
+
+	return 0;
+}
+
+/*******************************************************************************
+
+	File open/close related functions.
+
+ *******************************************************************************/
+struct file *RtmpOSFileOpen(char *pPath, int flag, int mode)
 {
-	daemonize(pThreadName /*"%s",pAd->net_dev->name*/);
+	struct file *filePtr;
+
+	filePtr = filp_open(pPath, flag, 0);
+	if (IS_ERR(filePtr)) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("%s(): Error %ld opening %s\n", __func__,
+			  -PTR_ERR(filePtr), pPath));
+	}
+
+	return (struct file *)filePtr;
+}
+
+int RtmpOSFileClose(struct file *osfd)
+{
+	filp_close(osfd, NULL);
+	return 0;
+}
+
+void RtmpOSFileSeek(struct file *osfd, int offset)
+{
+	osfd->f_pos = offset;
+}
+
+int RtmpOSFileRead(struct file *osfd, char *pDataPtr, int readLen)
+{
+	/* The object must have a read method */
+	if (osfd->f_op && osfd->f_op->read) {
+		return osfd->f_op->read(osfd, pDataPtr, readLen, &osfd->f_pos);
+	} else {
+		DBGPRINT(RT_DEBUG_ERROR, ("no file read method\n"));
+		return -1;
+	}
+}
+
+int RtmpOSFileWrite(struct file *osfd, char *pDataPtr, int writeLen)
+{
+	return osfd->f_op->write(osfd, pDataPtr, (size_t) writeLen,
+				 &osfd->f_pos);
+}
+
+/*******************************************************************************
+
+	Task create/management/kill related functions.
+
+ *******************************************************************************/
+int RtmpOSTaskKill(struct rt_rtmp_os_task *pTask)
+{
+	struct rt_rtmp_adapter *pAd;
+	int ret = NDIS_STATUS_FAILURE;
+
+	pAd = (struct rt_rtmp_adapter *)pTask->priv;
+
+#ifdef KTHREAD_SUPPORT
+	if (pTask->kthread_task) {
+		kthread_stop(pTask->kthread_task);
+		ret = NDIS_STATUS_SUCCESS;
+	}
+#else
+	CHECK_PID_LEGALITY(pTask->taskPID) {
+		printk("Terminate the task(%s) with pid(%d)!\n",
+		       pTask->taskName, GET_PID_NUMBER(pTask->taskPID));
+		mb();
+		pTask->task_killed = 1;
+		mb();
+		ret = KILL_THREAD_PID(pTask->taskPID, SIGTERM, 1);
+		if (ret) {
+			printk(KERN_WARNING
+			       "kill task(%s) with pid(%d) failed(retVal=%d)!\n",
+			       pTask->taskName, GET_PID_NUMBER(pTask->taskPID),
+			       ret);
+		} else {
+			wait_for_completion(&pTask->taskComplete);
+			pTask->taskPID = THREAD_PID_INIT_VALUE;
+			pTask->task_killed = 0;
+			ret = NDIS_STATUS_SUCCESS;
+		}
+	}
+#endif
+
+	return ret;
+
+}
+
+int RtmpOSTaskNotifyToExit(struct rt_rtmp_os_task *pTask)
+{
+
+#ifndef KTHREAD_SUPPORT
+	complete_and_exit(&pTask->taskComplete, 0);
+#endif
+
+	return 0;
+}
+
+void RtmpOSTaskCustomize(struct rt_rtmp_os_task *pTask)
+{
+
+#ifndef KTHREAD_SUPPORT
+
+	daemonize((char *)& pTask->taskName[0] /*"%s",pAd->net_dev->name */ );
 
 	allow_signal(SIGTERM);
 	allow_signal(SIGKILL);
 	current->flags |= PF_NOFREEZE;
 
 	/* signal that we've started the thread */
-	complete(pNotify);
+	complete(&pTask->taskComplete);
+
+#endif
 }
 
-void RTMP_IndicateMediaState(
-	IN	PRTMP_ADAPTER	pAd)
+int RtmpOSTaskAttach(struct rt_rtmp_os_task *pTask,
+			     IN int (*fn) (void *), IN void *arg)
 {
-	if (pAd->CommonCfg.bWirelessEvent)
-	{
-		if (pAd->IndicateMediaState == NdisMediaStateConnected)
-		{
-			RTMPSendWirelessEvent(pAd, IW_STA_LINKUP_EVENT_FLAG, pAd->MacTab.Content[BSSID_WCID].Addr, BSS0, 0);
+	int status = NDIS_STATUS_SUCCESS;
+
+#ifdef KTHREAD_SUPPORT
+	pTask->task_killed = 0;
+	pTask->kthread_task = NULL;
+	pTask->kthread_task = kthread_run(fn, arg, pTask->taskName);
+	if (IS_ERR(pTask->kthread_task))
+		status = NDIS_STATUS_FAILURE;
+#else
+	pid_number = kernel_thread(fn, arg, RTMP_OS_MGMT_TASK_FLAGS);
+	if (pid_number < 0) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("Attach task(%s) failed!\n", pTask->taskName));
+		status = NDIS_STATUS_FAILURE;
+	} else {
+		pTask->taskPID = GET_PID(pid_number);
+
+		/* Wait for the thread to start */
+		wait_for_completion(&pTask->taskComplete);
+		status = NDIS_STATUS_SUCCESS;
+	}
+#endif
+	return status;
+}
+
+int RtmpOSTaskInit(struct rt_rtmp_os_task *pTask,
+			   char *pTaskName, void * pPriv)
+{
+	int len;
+
+	ASSERT(pTask);
+
+#ifndef KTHREAD_SUPPORT
+	NdisZeroMemory((u8 *)(pTask), sizeof(struct rt_rtmp_os_task));
+#endif
+
+	len = strlen(pTaskName);
+	len =
+	    len >
+	    (RTMP_OS_TASK_NAME_LEN - 1) ? (RTMP_OS_TASK_NAME_LEN - 1) : len;
+	NdisMoveMemory(&pTask->taskName[0], pTaskName, len);
+	pTask->priv = pPriv;
+
+#ifndef KTHREAD_SUPPORT
+	RTMP_SEM_EVENT_INIT_LOCKED(&(pTask->taskSema));
+	pTask->taskPID = THREAD_PID_INIT_VALUE;
+
+	init_completion(&pTask->taskComplete);
+#endif
+
+	return NDIS_STATUS_SUCCESS;
+}
+
+void RTMP_IndicateMediaState(struct rt_rtmp_adapter *pAd)
+{
+	if (pAd->CommonCfg.bWirelessEvent) {
+		if (pAd->IndicateMediaState == NdisMediaStateConnected) {
+			RTMPSendWirelessEvent(pAd, IW_STA_LINKUP_EVENT_FLAG,
+					      pAd->MacTab.Content[BSSID_WCID].
+					      Addr, BSS0, 0);
+		} else {
+			RTMPSendWirelessEvent(pAd, IW_STA_LINKDOWN_EVENT_FLAG,
+					      pAd->MacTab.Content[BSSID_WCID].
+					      Addr, BSS0, 0);
 		}
+	}
+}
+
+int RtmpOSWrielessEventSend(struct rt_rtmp_adapter *pAd,
+			    u32 eventType,
+			    int flags,
+			    u8 *pSrcMac,
+			    u8 *pData, u32 dataLen)
+{
+	union iwreq_data wrqu;
+
+	memset(&wrqu, 0, sizeof(wrqu));
+
+	if (flags > -1)
+		wrqu.data.flags = flags;
+
+	if (pSrcMac)
+		memcpy(wrqu.ap_addr.sa_data, pSrcMac, MAC_ADDR_LEN);
+
+	if ((pData != NULL) && (dataLen > 0))
+		wrqu.data.length = dataLen;
+
+	wireless_send_event(pAd->net_dev, eventType, &wrqu, (char *)pData);
+	return 0;
+}
+
+int RtmpOSNetDevAddrSet(struct net_device *pNetDev, u8 *pMacAddr)
+{
+	struct net_device *net_dev;
+	struct rt_rtmp_adapter *pAd;
+
+	net_dev = pNetDev;
+	GET_PAD_FROM_NET_DEV(pAd, net_dev);
+
+	/* work-around for the SuSE due to it has it's own interface name management system. */
+	{
+		NdisZeroMemory(pAd->StaCfg.dev_name, 16);
+		NdisMoveMemory(pAd->StaCfg.dev_name, net_dev->name,
+			       strlen(net_dev->name));
+	}
+
+	NdisMoveMemory(net_dev->dev_addr, pMacAddr, 6);
+
+	return 0;
+}
+
+/*
+  *	Assign the network dev name for created Ralink WiFi interface.
+  */
+static int RtmpOSNetDevRequestName(struct rt_rtmp_adapter *pAd,
+				   struct net_device *dev,
+				   char *pPrefixStr, int devIdx)
+{
+	struct net_device *existNetDev;
+	char suffixName[IFNAMSIZ];
+	char desiredName[IFNAMSIZ];
+	int ifNameIdx, prefixLen, slotNameLen;
+	int Status;
+
+	prefixLen = strlen(pPrefixStr);
+	ASSERT((prefixLen < IFNAMSIZ));
+
+	for (ifNameIdx = devIdx; ifNameIdx < 32; ifNameIdx++) {
+		memset(suffixName, 0, IFNAMSIZ);
+		memset(desiredName, 0, IFNAMSIZ);
+		strncpy(&desiredName[0], pPrefixStr, prefixLen);
+
+		sprintf(suffixName, "%d", ifNameIdx);
+
+		slotNameLen = strlen(suffixName);
+		ASSERT(((slotNameLen + prefixLen) < IFNAMSIZ));
+		strcat(desiredName, suffixName);
+
+		existNetDev = RtmpOSNetDevGetByName(dev, &desiredName[0]);
+		if (existNetDev == NULL)
+			break;
 		else
-		{
-			RTMPSendWirelessEvent(pAd, IW_STA_LINKDOWN_EVENT_FLAG, pAd->MacTab.Content[BSSID_WCID].Addr, BSS0, 0);
+			RtmpOSNetDeviceRefPut(existNetDev);
+	}
+
+	if (ifNameIdx < 32) {
+		strcpy(&dev->name[0], &desiredName[0]);
+		Status = NDIS_STATUS_SUCCESS;
+	} else {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("Cannot request DevName with preifx(%s) and in range(0~32) as suffix from OS!\n",
+			  pPrefixStr));
+		Status = NDIS_STATUS_FAILURE;
+	}
+
+	return Status;
+}
+
+void RtmpOSNetDevClose(struct net_device *pNetDev)
+{
+	dev_close(pNetDev);
+}
+
+void RtmpOSNetDevFree(struct net_device *pNetDev)
+{
+	ASSERT(pNetDev);
+
+	free_netdev(pNetDev);
+}
+
+int RtmpOSNetDevAlloc(struct net_device ** new_dev_p, u32 privDataSize)
+{
+	/* assign it as null first. */
+	*new_dev_p = NULL;
+
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("Allocate a net device with private data size=%d!\n",
+		  privDataSize));
+	*new_dev_p = alloc_etherdev(privDataSize);
+	if (*new_dev_p)
+		return NDIS_STATUS_SUCCESS;
+	else
+		return NDIS_STATUS_FAILURE;
+}
+
+struct net_device *RtmpOSNetDevGetByName(struct net_device *pNetDev, char *pDevName)
+{
+	struct net_device *pTargetNetDev = NULL;
+
+	pTargetNetDev = dev_get_by_name(dev_net(pNetDev), pDevName);
+
+	return pTargetNetDev;
+}
+
+void RtmpOSNetDeviceRefPut(struct net_device *pNetDev)
+{
+	/*
+	   every time dev_get_by_name is called, and it has returned a valid struct
+	   net_device*, dev_put should be called afterwards, because otherwise the
+	   machine hangs when the device is unregistered (since dev->refcnt > 1).
+	 */
+	if (pNetDev)
+		dev_put(pNetDev);
+}
+
+int RtmpOSNetDevDestory(struct rt_rtmp_adapter *pAd, struct net_device *pNetDev)
+{
+
+	/* TODO: Need to fix this */
+	printk("WARNING: This function(%s) not implement yet!\n", __func__);
+	return 0;
+}
+
+void RtmpOSNetDevDetach(struct net_device *pNetDev)
+{
+	unregister_netdev(pNetDev);
+}
+
+int RtmpOSNetDevAttach(struct net_device *pNetDev,
+		       struct rt_rtmp_os_netdev_op_hook *pDevOpHook)
+{
+	int ret, rtnl_locked = FALSE;
+
+	DBGPRINT(RT_DEBUG_TRACE, ("RtmpOSNetDevAttach()--->\n"));
+	/* If we need hook some callback function to the net device structrue, now do it. */
+	if (pDevOpHook) {
+		struct rt_rtmp_adapter *pAd = NULL;
+
+		GET_PAD_FROM_NET_DEV(pAd, pNetDev);
+
+		pNetDev->netdev_ops = pDevOpHook->netdev_ops;
+
+		/* OS specific flags, here we used to indicate if we are virtual interface */
+		pNetDev->priv_flags = pDevOpHook->priv_flags;
+
+		if (pAd->OpMode == OPMODE_STA) {
+			pNetDev->wireless_handlers = &rt28xx_iw_handler_def;
 		}
+
+		/* copy the net device mac address to the net_device structure. */
+		NdisMoveMemory(pNetDev->dev_addr, &pDevOpHook->devAddr[0],
+			       MAC_ADDR_LEN);
+
+		rtnl_locked = pDevOpHook->needProtcted;
 	}
+
+	if (rtnl_locked)
+		ret = register_netdevice(pNetDev);
+	else
+		ret = register_netdev(pNetDev);
+
+	DBGPRINT(RT_DEBUG_TRACE, ("<---RtmpOSNetDevAttach(), ret=%d\n", ret));
+	if (ret == 0)
+		return NDIS_STATUS_SUCCESS;
+	else
+		return NDIS_STATUS_FAILURE;
 }
 
+struct net_device *RtmpOSNetDevCreate(struct rt_rtmp_adapter *pAd,
+			    int devType,
+			    int devNum,
+			    int privMemSize, char *pNamePrefix)
+{
+	struct net_device *pNetDev = NULL;
+	int status;
+
+	/* allocate a new network device */
+	status = RtmpOSNetDevAlloc(&pNetDev, 0 /*privMemSize */ );
+	if (status != NDIS_STATUS_SUCCESS) {
+		/* allocation fail, exit */
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("Allocate network device fail (%s)...\n",
+			  pNamePrefix));
+		return NULL;
+	}
+
+	/* find a available interface name, max 32 interfaces */
+	status = RtmpOSNetDevRequestName(pAd, pNetDev, pNamePrefix, devNum);
+	if (status != NDIS_STATUS_SUCCESS) {
+		/* error! no any available ra name can be used! */
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("Assign interface name (%s with suffix 0~32) failed...\n",
+			  pNamePrefix));
+		RtmpOSNetDevFree(pNetDev);
+
+		return NULL;
+	} else {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("The name of the new %s interface is %s...\n",
+			  pNamePrefix, pNetDev->name));
+	}
+
+	return pNetDev;
+}
diff --git a/drivers/staging/rt2860/rt_linux.h b/drivers/staging/rt2860/rt_linux.h
index e8d64c30b906..f85508d9d5a9 100644
--- a/drivers/staging/rt2860/rt_linux.h
+++ b/drivers/staging/rt2860/rt_linux.h
@@ -23,27 +23,22 @@
  * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
  *                                                                       *
  *************************************************************************
- */
 
-/***********************************************************************/
-/*                                                                     */
-/*   Program:    rt_linux.c                                            */
-/*   Created:    4/21/2006 1:17:38 PM                                  */
-/*   Author:     Wu Xi-Kun                                             */
-/*   Comments:   `description`                                         */
-/*                                                                     */
-/*---------------------------------------------------------------------*/
-/*                                                                     */
-/* History:                                                            */
-/*    Revision 1.1 4/21/2006 1:17:38 PM  xsikun                        */
-/*    Initial revision                                                 */
-/*                                                                     */
-/***********************************************************************/
-
-#include "rtmp_type.h"
+    Module Name:
+	rt_linux.h
+
+    Abstract:
+
+    Revision History:
+    Who          When          What
+    ---------    ----------    ----------------------------------------------
+*/
+
+#ifndef __RT_LINUX_H__
+#define __RT_LINUX_H__
+
 #include <linux/module.h>
 #include <linux/kernel.h>
-
 #include <linux/spinlock.h>
 #include <linux/init.h>
 #include <linux/string.h>
@@ -65,64 +60,57 @@
 
 #include <net/iw_handler.h>
 
-// load firmware
+/* load firmware */
 #define __KERNEL_SYSCALLS__
 #include <linux/unistd.h>
 #include <asm/uaccess.h>
-
-
-#define MEM_ALLOC_FLAG      (GFP_ATOMIC) //(GFP_DMA | GFP_ATOMIC)
-
-#ifndef IFNAMSIZ
-#define IFNAMSIZ 16
-#endif
-
-//#define CONFIG_CKIP_SUPPORT
-
+#include <asm/types.h>
+#include <asm/unaligned.h>	/* for get_unaligned() */
+
+#define KTHREAD_SUPPORT 1
+/* RT2870 2.1.0.0 has it disabled */
+
+#ifdef KTHREAD_SUPPORT
+#include <linux/err.h>
+#include <linux/kthread.h>
+#endif /* KTHREAD_SUPPORT // */
+
+/***********************************************************************************
+ *	Profile related sections
+ ***********************************************************************************/
+
+#ifdef RTMP_MAC_PCI
+#define STA_DRIVER_VERSION			"2.1.0.0"
+#endif /* RTMP_MAC_PCI // */
+#ifdef RTMP_MAC_USB
+#define STA_DRIVER_VERSION			"2.1.0.0"
+/* RT3070 version: 2.1.1.0 */
+#endif /* RTMP_MAC_USB // */
+
+extern const struct iw_handler_def rt28xx_iw_handler_def;
+
+/***********************************************************************************
+ *	Compiler related definitions
+ ***********************************************************************************/
 #undef __inline
 #define __inline	   static inline
+#define IN
+#define OUT
+#define INOUT
 
-typedef int (*HARD_START_XMIT_FUNC)(struct sk_buff *skb, struct net_device *net_dev);
-
-// add by kathy
-
-/* order of "if defined()" is important, because for 3070 driver
-   both RT2870 and RT3070 are defined */
-#if defined(RT2860)
- #define STA_PROFILE_PATH			"/etc/Wireless/RT2860STA/RT2860STA.dat"
- #define STA_RTMP_FIRMWARE_FILE_NAME "/etc/Wireless/RT2860STA/RT2860STA.bin"
- #define STA_NIC_DEVICE_NAME			"RT2860STA"
- #define STA_DRIVER_VERSION			"1.8.1.1"
-#elif defined(RT3070)
- #define STA_PROFILE_PATH			"/etc/Wireless/RT3070STA/RT3070STA.dat"
- #define STA_RT2870_IMAGE_FILE_NAME  "/etc/Wireless/RT3070STA/rt2870.bin"
- #define STA_NIC_DEVICE_NAME			"RT3070STA"
- #define STA_DRIVER_VERSION			"2.0.1.0"
-#elif defined(RT2870)
- #define STA_PROFILE_PATH			"/etc/Wireless/RT2870STA/RT2870STA.dat"
- #define STA_RT2870_IMAGE_FILE_NAME  "/etc/Wireless/RT2870STA/rt2870.bin"
- #define STA_NIC_DEVICE_NAME			"RT2870STA"
- #define STA_DRIVER_VERSION			"1.4.0.0"
-#endif
+/***********************************************************************************
+ *	OS Specific definitions and data structures
+ ***********************************************************************************/
+typedef int (*HARD_START_XMIT_FUNC) (struct sk_buff * skb,
+				     struct net_device * net_dev);
 
-#ifdef RT2860
+#ifdef RTMP_MAC_PCI
 #ifndef PCI_DEVICE
 #define PCI_DEVICE(vend,dev) \
 	.vendor = (vend), .device = (dev), \
 	.subvendor = PCI_ANY_ID, .subdevice = PCI_ANY_ID
-#endif // PCI_DEVICE //
-#endif
-
-#define RTMP_TIME_AFTER(a,b)		\
-	(typecheck(unsigned long, (unsigned long)a) && \
-	 typecheck(unsigned long, (unsigned long)b) && \
-	 ((long)(b) - (long)(a) < 0))
-
-#define RTMP_TIME_AFTER_EQ(a,b)	\
-	(typecheck(unsigned long, (unsigned long)a) && \
-	 typecheck(unsigned long, (unsigned long)b) && \
-	 ((long)(a) - (long)(b) >= 0))
-#define RTMP_TIME_BEFORE(a,b)	RTMP_TIME_AFTER_EQ(b,a)
+#endif /* PCI_DEVICE // */
+#endif /* RTMP_MAC_PCI // */
 
 #define RT_MOD_INC_USE_COUNT() \
 	if (!try_module_get(THIS_MODULE)) \
@@ -133,227 +121,313 @@ typedef int (*HARD_START_XMIT_FUNC)(struct sk_buff *skb, struct net_device *net_
 
 #define RT_MOD_DEC_USE_COUNT() module_put(THIS_MODULE);
 
-#define OS_HZ			HZ
+#define RTMP_INC_REF(_A)		0
+#define RTMP_DEC_REF(_A)		0
+#define RTMP_GET_REF(_A)		0
 
-#define ETH_LENGTH_OF_ADDRESS	6
+/* This function will be called when query /proc */
+struct iw_statistics *rt28xx_get_wireless_stats(IN struct net_device *net_dev);
 
-#define IN
-#define OUT
+/***********************************************************************************
+ *	Network related constant definitions
+ ***********************************************************************************/
+#ifndef IFNAMSIZ
+#define IFNAMSIZ 16
+#endif
+
+#define ETH_LENGTH_OF_ADDRESS	6
 
-#define NDIS_STATUS                             INT
 #define NDIS_STATUS_SUCCESS                     0x00
 #define NDIS_STATUS_FAILURE                     0x01
 #define NDIS_STATUS_INVALID_DATA				0x02
 #define NDIS_STATUS_RESOURCES                   0x03
 
-#define MIN_NET_DEVICE_FOR_AID			0x00		//0x00~0x3f
-#define MIN_NET_DEVICE_FOR_MBSSID		0x00		//0x00,0x10,0x20,0x30
-#define MIN_NET_DEVICE_FOR_WDS			0x10		//0x40,0x50,0x60,0x70
+#define NDIS_SET_PACKET_STATUS(_p, _status)			do{} while(0)
+#define NdisWriteErrorLogEntry(_a, _b, _c, _d)		do{} while(0)
+
+/* statistics counter */
+#define STATS_INC_RX_PACKETS(_pAd, _dev)
+#define STATS_INC_TX_PACKETS(_pAd, _dev)
+
+#define STATS_INC_RX_BYTESS(_pAd, _dev, len)
+#define STATS_INC_TX_BYTESS(_pAd, _dev, len)
+
+#define STATS_INC_RX_ERRORS(_pAd, _dev)
+#define STATS_INC_TX_ERRORS(_pAd, _dev)
+
+#define STATS_INC_RX_DROPPED(_pAd, _dev)
+#define STATS_INC_TX_DROPPED(_pAd, _dev)
+
+/***********************************************************************************
+ *	Ralink Specific network related constant definitions
+ ***********************************************************************************/
+#define MIN_NET_DEVICE_FOR_AID			0x00	/*0x00~0x3f */
+#define MIN_NET_DEVICE_FOR_MBSSID		0x00	/*0x00,0x10,0x20,0x30 */
+#define MIN_NET_DEVICE_FOR_WDS			0x10	/*0x40,0x50,0x60,0x70 */
 #define MIN_NET_DEVICE_FOR_APCLI		0x20
 #define MIN_NET_DEVICE_FOR_MESH			0x30
 #define MIN_NET_DEVICE_FOR_DLS			0x40
+#define NET_DEVICE_REAL_IDX_MASK		0x0f	/* for each operation mode, we maximum support 15 entities. */
 
 #define NDIS_PACKET_TYPE_DIRECTED		0
 #define NDIS_PACKET_TYPE_MULTICAST		1
 #define NDIS_PACKET_TYPE_BROADCAST		2
 #define NDIS_PACKET_TYPE_ALL_MULTICAST	3
-
-struct os_lock  {
-	spinlock_t		lock;
-	unsigned long  	flags;
+#define NDIS_PACKET_TYPE_PROMISCUOUS	4
+
+/***********************************************************************************
+ *	OS signaling related constant definitions
+ ***********************************************************************************/
+
+/***********************************************************************************
+ *	OS file operation related data structure definitions
+ ***********************************************************************************/
+struct rt_rtmp_os_fs_info {
+	int fsuid;
+	int fsgid;
+	mm_segment_t fs;
 };
 
+#define IS_FILE_OPEN_ERR(_fd)	IS_ERR((_fd))
 
-struct os_cookie {
-#ifdef RT2860
-	struct pci_dev 			*pci_dev;
-	struct pci_dev 			*parent_pci_dev;
-	dma_addr_t		  		pAd_pa;
-#endif
-#ifdef RT2870
-	struct usb_device		*pUsb_Dev;
-
-	struct pid	*MLMEThr_pid;
-	struct pid	*RTUSBCmdThr_pid;
-	struct pid	*TimerQThr_pid;
-#endif // RT2870 //
-
-	struct tasklet_struct 	rx_done_task;
-	struct tasklet_struct 	mgmt_dma_done_task;
-	struct tasklet_struct 	ac0_dma_done_task;
-	struct tasklet_struct 	ac1_dma_done_task;
-	struct tasklet_struct 	ac2_dma_done_task;
-	struct tasklet_struct 	ac3_dma_done_task;
-	struct tasklet_struct 	hcca_dma_done_task;
-	struct tasklet_struct	tbtt_task;
-#ifdef RT2860
-	struct tasklet_struct	fifo_statistic_full_task;
-#endif
-#ifdef RT2870
-	struct tasklet_struct	null_frame_complete_task;
-	struct tasklet_struct	rts_frame_complete_task;
-	struct tasklet_struct	pspoll_frame_complete_task;
-#endif // RT2870 //
-
-	unsigned long			apd_pid; //802.1x daemon pid
-	INT						ioctl_if_type;
-	INT 					ioctl_if;
+/***********************************************************************************
+ *	OS semaphore related data structure and definitions
+ ***********************************************************************************/
+struct os_lock {
+	spinlock_t lock;
+	unsigned long flags;
 };
 
-#undef  ASSERT
-#define ASSERT(x)
-
-typedef struct os_cookie	* POS_COOKIE;
-typedef struct pci_dev 		* PPCI_DEV;
-typedef struct net_device	* PNET_DEV;
-typedef void				* PNDIS_PACKET;
-typedef char				NDIS_PACKET;
-typedef PNDIS_PACKET		* PPNDIS_PACKET;
-typedef	dma_addr_t			NDIS_PHYSICAL_ADDRESS;
-typedef	dma_addr_t			* PNDIS_PHYSICAL_ADDRESS;
-typedef spinlock_t			NDIS_SPIN_LOCK;
-typedef struct timer_list	NDIS_MINIPORT_TIMER;
-typedef void				* NDIS_HANDLE;
-typedef char 				* PNDIS_BUFFER;
-
-
-
-void hex_dump(char *str, unsigned char *pSrcBufVA, unsigned int SrcBufLen);
+/* */
+/*  spin_lock enhanced for Nested spin lock */
+/* */
+#define NdisAllocateSpinLock(__lock)      \
+{                                       \
+    spin_lock_init((spinlock_t *)(__lock));               \
+}
 
-dma_addr_t linux_pci_map_single(void *handle, void *ptr, size_t size, int sd_idx, int direction);
-void linux_pci_unmap_single(void *handle, dma_addr_t dma_addr, size_t size, int direction);
+#define NdisFreeSpinLock(lock)          \
+	do{}while(0)
 
+#define RTMP_SEM_LOCK(__lock)					\
+{												\
+	spin_lock_bh((spinlock_t *)(__lock));		\
+}
 
-////////////////////////////////////////
-// MOVE TO rtmp.h ?
-/////////////////////////////////////////
-#define PKTSRC_NDIS             0x7f
-#define PKTSRC_DRIVER           0x0f
-#define PRINT_MAC(addr)	\
-	addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]
+#define RTMP_SEM_UNLOCK(__lock)					\
+{												\
+	spin_unlock_bh((spinlock_t *)(__lock));		\
+}
 
+/* sample, use semaphore lock to replace IRQ lock, 2007/11/15 */
+#define RTMP_IRQ_LOCK(__lock, __irqflags)			\
+{													\
+	__irqflags = 0;									\
+	spin_lock_bh((spinlock_t *)(__lock));			\
+	pAd->irq_disabled |= 1; \
+}
 
-#define RT2860_PCI_DEVICE_ID		0x0601
+#define RTMP_IRQ_UNLOCK(__lock, __irqflag)			\
+{													\
+	pAd->irq_disabled &= 0;							\
+	spin_unlock_bh((spinlock_t *)(__lock));			\
+}
 
-#ifdef RT2860
-#define PCI_MAP_SINGLE(_handle, _ptr, _size, _sd_idx, _dir) \
-	linux_pci_map_single(_handle, _ptr, _size, _sd_idx, _dir)
+#define RTMP_INT_LOCK(__lock, __irqflags)			\
+{													\
+	spin_lock_irqsave((spinlock_t *)__lock, __irqflags);	\
+}
 
-#define PCI_UNMAP_SINGLE(_handle, _ptr, _size, _dir) \
-	linux_pci_unmap_single(_handle, _ptr, _size, _dir)
+#define RTMP_INT_UNLOCK(__lock, __irqflag)			\
+{													\
+	spin_unlock_irqrestore((spinlock_t *)(__lock), ((unsigned long)__irqflag));	\
+}
 
-#define PCI_ALLOC_CONSISTENT(_pci_dev, _size, _ptr) \
-	pci_alloc_consistent(_pci_dev, _size, _ptr)
+#define NdisAcquireSpinLock		RTMP_SEM_LOCK
+#define NdisReleaseSpinLock		RTMP_SEM_UNLOCK
 
-#define PCI_FREE_CONSISTENT(_pci_dev, _size, _virtual_addr, _physical_addr) \
-	pci_free_consistent(_pci_dev, _size, _virtual_addr, _physical_addr)
+#ifndef wait_event_interruptible_timeout
+#define __wait_event_interruptible_timeout(wq, condition, ret) \
+do { \
+        wait_queue_t __wait; \
+        init_waitqueue_entry(&__wait, current); \
+        add_wait_queue(&wq, &__wait); \
+        for (;;) { \
+                set_current_state(TASK_INTERRUPTIBLE); \
+                if (condition) \
+                        break; \
+                if (!signal_pending(current)) { \
+                        ret = schedule_timeout(ret); \
+                        if (!ret) \
+                                break; \
+                        continue; \
+                } \
+                ret = -ERESTARTSYS; \
+                break; \
+        } \
+        current->state = TASK_RUNNING; \
+        remove_wait_queue(&wq, &__wait); \
+} while (0)
 
-#define DEV_ALLOC_SKB(_length) \
-	dev_alloc_skb(_length)
+#define wait_event_interruptible_timeout(wq, condition, timeout) \
+({ \
+        long __ret = timeout; \
+        if (!(condition)) \
+                __wait_event_interruptible_timeout(wq, condition, __ret); \
+        __ret; \
+})
 #endif
-#ifdef RT2870
-#define PCI_MAP_SINGLE(_handle, _ptr, _size, _dir) (ULONG)0
-
-#define PCI_UNMAP_SINGLE(_handle, _ptr, _size, _dir)
-#endif // RT2870 //
-
-
-#define BEACON_FRAME_DMA_CACHE_WBACK(_ptr, _size)	\
-	dma_cache_wback(_ptr, _size)
-
 
-//////////////////////////////////////////
-//
-//////////////////////////////////////////
+#define RTMP_SEM_EVENT_INIT_LOCKED(_pSema)	sema_init((_pSema), 0)
+#define RTMP_SEM_EVENT_INIT(_pSema)			sema_init((_pSema), 1)
+#define RTMP_SEM_EVENT_WAIT(_pSema, _status)	((_status) = down_interruptible((_pSema)))
+#define RTMP_SEM_EVENT_UP(_pSema)			up(_pSema)
+
+#ifdef KTHREAD_SUPPORT
+#define RTMP_WAIT_EVENT_INTERRUPTIBLE(_pAd, _pTask) \
+{ \
+		wait_event_interruptible(_pTask->kthread_q, \
+								 _pTask->kthread_running || kthread_should_stop()); \
+		_pTask->kthread_running = FALSE; \
+		if (kthread_should_stop()) \
+		{ \
+			RTMP_SET_FLAG(_pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS); \
+			break; \
+		} \
+}
+#endif
 
+#ifdef KTHREAD_SUPPORT
+#define WAKE_UP(_pTask) \
+	do{ \
+		if ((_pTask)->kthread_task) \
+        { \
+			(_pTask)->kthread_running = TRUE; \
+	        wake_up(&(_pTask)->kthread_q); \
+		} \
+	}while(0)
+#endif
 
-#define NdisMIndicateStatus(_w, _x, _y, _z)
+/***********************************************************************************
+ *	OS Memory Access related data structure and definitions
+ ***********************************************************************************/
+#define MEM_ALLOC_FLAG      (GFP_ATOMIC)	/*(GFP_DMA | GFP_ATOMIC) */
 
-typedef struct timer_list	RTMP_OS_TIMER;
+#define NdisMoveMemory(Destination, Source, Length) memmove(Destination, Source, Length)
+#define NdisCopyMemory(Destination, Source, Length) memcpy(Destination, Source, Length)
+#define NdisZeroMemory(Destination, Length)         memset(Destination, 0, Length)
+#define NdisFillMemory(Destination, Length, Fill)   memset(Destination, Fill, Length)
+#define NdisCmpMemory(Destination, Source, Length)  memcmp(Destination, Source, Length)
+#define NdisEqualMemory(Source1, Source2, Length)   (!memcmp(Source1, Source2, Length))
+#define RTMPEqualMemory(Source1, Source2, Length)	(!memcmp(Source1, Source2, Length))
 
-#ifdef RT2870
-/* ----------------- Timer Related MARCO ---------------*/
-// In RT2870, we have a lot of timer functions and will read/write register, it's
-//	not allowed in Linux USB sub-system to do it ( because of sleep issue when submit
-//  to ctrl pipe). So we need a wrapper function to take care it.
+#define MlmeAllocateMemory(_pAd, _ppVA)		os_alloc_mem(_pAd, _ppVA, MGMT_DMA_BUFFER_SIZE)
+#define MlmeFreeMemory(_pAd, _pVA)			os_free_mem(_pAd, _pVA)
 
-typedef VOID (*RT2870_TIMER_HANDLE)(
-	IN  PVOID   SystemSpecific1,
-	IN  PVOID   FunctionContext,
-	IN  PVOID   SystemSpecific2,
-	IN  PVOID   SystemSpecific3);
-#endif // RT2870 //
+#define COPY_MAC_ADDR(Addr1, Addr2)             memcpy((Addr1), (Addr2), MAC_ADDR_LEN)
 
+/***********************************************************************************
+ *	OS task related data structure and definitions
+ ***********************************************************************************/
+#define RTMP_OS_MGMT_TASK_FLAGS	CLONE_VM
 
-typedef struct  _RALINK_TIMER_STRUCT    {
-    RTMP_OS_TIMER		TimerObj;       // Ndis Timer object
-	BOOLEAN				Valid;			// Set to True when call RTMPInitTimer
-    BOOLEAN             State;          // True if timer cancelled
-    BOOLEAN	      		PeriodicType;	// True if timer is periodic timer
-    BOOLEAN             Repeat;         // True if periodic timer
-    ULONG               TimerValue;     // Timer value in milliseconds
-	ULONG				cookie;			// os specific object
-#ifdef RT2870
-	RT2870_TIMER_HANDLE	handle;
-	void				*pAd;
-#endif // RT2870 //
-}   RALINK_TIMER_STRUCT, *PRALINK_TIMER_STRUCT;
+#define	THREAD_PID_INIT_VALUE	NULL
+#define	GET_PID(_v)	find_get_pid((_v))
+#define	GET_PID_NUMBER(_v)	pid_nr((_v))
+#define CHECK_PID_LEGALITY(_pid)	if (pid_nr((_pid)) > 0)
+#define KILL_THREAD_PID(_A, _B, _C)	kill_pid((_A), (_B), (_C))
 
+/***********************************************************************************
+ * Timer related definitions and data structures.
+ **********************************************************************************/
+#define OS_HZ			HZ
 
-#ifdef RT2870
+typedef void (*TIMER_FUNCTION) (unsigned long);
 
-typedef enum _RT2870_KERNEL_THREAD_STATUS_
-{
-	RT2870_THREAD_UNKNOWN = 0,
-	RT2870_THREAD_INITED = 1,
-	RT2870_THREAD_RUNNING = 2,
-	RT2870_THREAD_STOPED = 4,
-}RT2870_KERNEL_THREAD_STATUS;
+#define OS_WAIT(_time) \
+{	int _i; \
+	long _loop = ((_time)/(1000/OS_HZ)) > 0 ? ((_time)/(1000/OS_HZ)) : 1;\
+	wait_queue_head_t _wait; \
+	init_waitqueue_head(&_wait); \
+	for (_i=0; _i<(_loop); _i++) \
+		wait_event_interruptible_timeout(_wait, 0, ONE_TICK); }
 
-#define RT2870_THREAD_CAN_DO_INSERT		(RT2870_THREAD_INITED |RT2870_THREAD_RUNNING)
+#define RTMP_TIME_AFTER(a,b)		\
+	(typecheck(unsigned long, (unsigned long)a) && \
+	 typecheck(unsigned long, (unsigned long)b) && \
+	 ((long)(b) - (long)(a) < 0))
 
-typedef struct _RT2870_TIMER_ENTRY_
-{
-	RALINK_TIMER_STRUCT 			*pRaTimer;
-	struct _RT2870_TIMER_ENTRY_ 	*pNext;
-}RT2870_TIMER_ENTRY;
+#define RTMP_TIME_AFTER_EQ(a,b)	\
+	(typecheck(unsigned long, (unsigned long)a) && \
+	 typecheck(unsigned long, (unsigned long)b) && \
+	 ((long)(a) - (long)(b) >= 0))
+#define RTMP_TIME_BEFORE(a,b)	RTMP_TIME_AFTER_EQ(b,a)
 
+#define ONE_TICK 1
 
-#define TIMER_QUEUE_SIZE_MAX	128
-typedef struct _RT2870_TIMER_QUEUE_
+static inline void NdisGetSystemUpTime(unsigned long * time)
 {
-	unsigned int		status;
-	UCHAR				*pTimerQPoll;
-	RT2870_TIMER_ENTRY	*pQPollFreeList;
-	RT2870_TIMER_ENTRY 	*pQHead;
-	RT2870_TIMER_ENTRY 	*pQTail;
-}RT2870_TIMER_QUEUE;
-#endif // RT2870 //
+	*time = jiffies;
+}
 
+/***********************************************************************************
+ *	OS specific cookie data structure binding to struct rt_rtmp_adapter
+ ***********************************************************************************/
 
-//#define DBG	1
+struct os_cookie {
+#ifdef RTMP_MAC_PCI
+	struct pci_dev *pci_dev;
+	struct pci_dev *parent_pci_dev;
+	u16 DeviceID;
+	dma_addr_t pAd_pa;
+#endif				/* RTMP_MAC_PCI // */
+#ifdef RTMP_MAC_USB
+	struct usb_device *pUsb_Dev;
+#endif				/* RTMP_MAC_USB // */
+
+	struct tasklet_struct rx_done_task;
+	struct tasklet_struct mgmt_dma_done_task;
+	struct tasklet_struct ac0_dma_done_task;
+	struct tasklet_struct ac1_dma_done_task;
+	struct tasklet_struct ac2_dma_done_task;
+	struct tasklet_struct ac3_dma_done_task;
+	struct tasklet_struct tbtt_task;
+#ifdef RTMP_MAC_PCI
+	struct tasklet_struct fifo_statistic_full_task;
+#endif				/* RTMP_MAC_PCI // */
+#ifdef RTMP_MAC_USB
+	struct tasklet_struct null_frame_complete_task;
+	struct tasklet_struct rts_frame_complete_task;
+	struct tasklet_struct pspoll_frame_complete_task;
+#endif				/* RTMP_MAC_USB // */
+
+	unsigned long apd_pid;	/*802.1x daemon pid */
+	int ioctl_if_type;
+	int ioctl_if;
+};
 
-//
-//  MACRO for debugging information
-//
+/***********************************************************************************
+ *	OS debugging and printing related definitions and data structure
+ ***********************************************************************************/
+#define PRINT_MAC(addr)	\
+	addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]
 
 #ifdef DBG
-extern ULONG    RTDebugLevel;
+extern unsigned long RTDebugLevel;
 
 #define DBGPRINT_RAW(Level, Fmt)    \
-{                                   \
+do{                                   \
     if (Level <= RTDebugLevel)      \
     {                               \
         printk Fmt;               \
     }                               \
-}
+}while(0)
 
 #define DBGPRINT(Level, Fmt)    DBGPRINT_RAW(Level, Fmt)
 
-
 #define DBGPRINT_ERR(Fmt)           \
 {                                   \
-    printk("ERROR!!! ");          \
+    printk("ERROR! ");          \
     printk Fmt;                  \
 }
 
@@ -362,7 +436,6 @@ extern ULONG    RTDebugLevel;
 	printk Fmt;					\
 }
 
-
 #else
 #define DBGPRINT(Level, Fmt)
 #define DBGPRINT_RAW(Level, Fmt)
@@ -370,56 +443,82 @@ extern ULONG    RTDebugLevel;
 #define DBGPRINT_ERR(Fmt)
 #endif
 
+#define ASSERT(x)
 
-//
-//  spin_lock enhanced for Nested spin lock
-//
-#define NdisAllocateSpinLock(__lock)      \
-{                                       \
-    spin_lock_init((spinlock_t *)(__lock));               \
-}
+void hex_dump(char *str, unsigned char *pSrcBufVA, unsigned int SrcBufLen);
 
-#define NdisFreeSpinLock(lock)          \
-{                                       \
-}
+/*********************************************************************************************************
+	The following code are not revised, temporary put it here.
+  *********************************************************************************************************/
 
+/***********************************************************************************
+ * Device DMA Access related definitions and data structures.
+ **********************************************************************************/
+#ifdef RTMP_MAC_PCI
+dma_addr_t linux_pci_map_single(void *handle, void *ptr, size_t size,
+				int sd_idx, int direction);
+void linux_pci_unmap_single(void *handle, dma_addr_t dma_addr, size_t size,
+			    int direction);
 
-#define RTMP_SEM_LOCK(__lock)					\
-{												\
-	spin_lock_bh((spinlock_t *)(__lock));				\
-}
+#define PCI_MAP_SINGLE(_handle, _ptr, _size, _sd_idx, _dir) \
+	linux_pci_map_single(_handle, _ptr, _size, _sd_idx, _dir)
 
-#define RTMP_SEM_UNLOCK(__lock)					\
-{												\
-	spin_unlock_bh((spinlock_t *)(__lock));				\
-}
+#define PCI_UNMAP_SINGLE(_handle, _ptr, _size, _dir) \
+	linux_pci_unmap_single(_handle, _ptr, _size, _dir)
 
-// sample, use semaphore lock to replace IRQ lock, 2007/11/15
-#define RTMP_IRQ_LOCK(__lock, __irqflags)			\
-{													\
-	__irqflags = 0;									\
-	spin_lock_bh((spinlock_t *)(__lock));			\
-	pAd->irq_disabled |= 1; \
-}
+#define PCI_ALLOC_CONSISTENT(_pci_dev, _size, _ptr) \
+	pci_alloc_consistent(_pci_dev, _size, _ptr)
 
-#define RTMP_IRQ_UNLOCK(__lock, __irqflag)			\
-{													\
-	pAd->irq_disabled &= 0; \
-	spin_unlock_bh((spinlock_t *)(__lock));			\
-}
+#define PCI_FREE_CONSISTENT(_pci_dev, _size, _virtual_addr, _physical_addr) \
+	pci_free_consistent(_pci_dev, _size, _virtual_addr, _physical_addr)
 
-#define RTMP_INT_LOCK(__lock, __irqflags)			\
-{													\
-	spin_lock_irqsave((spinlock_t *)__lock, __irqflags);	\
-}
+#define DEV_ALLOC_SKB(_length) \
+	dev_alloc_skb(_length)
+#endif /* RTMP_MAC_PCI // */
+#ifdef RTMP_MAC_USB
+#define PCI_MAP_SINGLE(_handle, _ptr, _size, _dir) (unsigned long)0
 
-#define RTMP_INT_UNLOCK(__lock, __irqflag)			\
-{													\
-	spin_unlock_irqrestore((spinlock_t *)(__lock), ((unsigned long)__irqflag));	\
-}
+#define PCI_UNMAP_SINGLE(_handle, _ptr, _size, _dir)
+#endif /* RTMP_MAC_USB // */
+
+/*
+ * unsigned long
+ * RTMP_GetPhysicalAddressLow(
+ *   dma_addr_t  PhysicalAddress);
+ */
+#define RTMP_GetPhysicalAddressLow(PhysicalAddress)		(PhysicalAddress)
+
+/*
+ * unsigned long
+ * RTMP_GetPhysicalAddressHigh(
+ *   dma_addr_t  PhysicalAddress);
+ */
+#define RTMP_GetPhysicalAddressHigh(PhysicalAddress)		(0)
+
+/*
+ * void
+ * RTMP_SetPhysicalAddressLow(
+ *   dma_addr_t  PhysicalAddress,
+ *   unsigned long  Value);
+ */
+#define RTMP_SetPhysicalAddressLow(PhysicalAddress, Value)	\
+			PhysicalAddress = Value;
+
+/*
+ * void
+ * RTMP_SetPhysicalAddressHigh(
+ *   dma_addr_t  PhysicalAddress,
+ *   unsigned long  Value);
+ */
+#define RTMP_SetPhysicalAddressHigh(PhysicalAddress, Value)
+
+#define NdisMIndicateStatus(_w, _x, _y, _z)
 
-#ifdef RT2860
-//Patch for ASIC turst read/write bug, needs to remove after metel fix
+/***********************************************************************************
+ * Device Register I/O Access related definitions and data structures.
+ **********************************************************************************/
+#ifdef RTMP_MAC_PCI
+/*Patch for ASIC turst read/write bug, needs to remove after metel fix */
 #define RTMP_IO_READ32(_A, _R, _pV)								\
 {																\
     if ((_A)->bPCIclkOff == FALSE)                                  \
@@ -430,11 +529,13 @@ extern ULONG    RTDebugLevel;
     else															\
 		*_pV = 0;													\
 }
+
 #define RTMP_IO_FORCE_READ32(_A, _R, _pV)							\
 {																	\
 	(*_pV = readl((void *)((_A)->CSRBaseAddress + MAC_CSR0)));		\
 	(*_pV = readl((void *)((_A)->CSRBaseAddress + (_R))));			\
 }
+
 #define RTMP_IO_READ8(_A, _R, _pV)								\
 {																\
 	(*_pV = readl((void *)((_A)->CSRBaseAddress + MAC_CSR0)));			\
@@ -444,155 +545,99 @@ extern ULONG    RTDebugLevel;
 {																				\
     if ((_A)->bPCIclkOff == FALSE)                                  \
     {                                                               \
-	UINT	Val;																\
+	u32 Val;																\
 	Val = readl((void *)((_A)->CSRBaseAddress + MAC_CSR0));			\
-	writel(_V, (void *)((_A)->CSRBaseAddress + (_R)));								\
+	writel((_V), (void *)((_A)->CSRBaseAddress + (_R)));								\
     }                                                               \
 }
+
+#define RTMP_IO_FORCE_WRITE32(_A, _R, _V)												\
+{																				\
+	u32 Val;																\
+	Val = readl((void *)((_A)->CSRBaseAddress + MAC_CSR0));			\
+	writel(_V, (void *)((_A)->CSRBaseAddress + (_R)));								\
+}
+
+#if defined(RALINK_2880) || defined(RALINK_3052)
+#define RTMP_IO_WRITE8(_A, _R, _V)            \
+{                    \
+	unsigned long Val;                \
+	u8 _i;                \
+	_i = ((_R) & 0x3);             \
+	Val = readl((void *)((_A)->CSRBaseAddress + ((_R) - _i)));   \
+	Val = Val & (~(0x000000ff << ((_i)*8)));         \
+	Val = Val | ((unsigned long)(_V) << ((_i)*8));         \
+	writel((Val), (void *)((_A)->CSRBaseAddress + ((_R) - _i)));    \
+}
+#else
 #define RTMP_IO_WRITE8(_A, _R, _V)												\
 {																				\
-	UINT	Val;																\
+	u32 Val;																\
 	Val = readl((void *)((_A)->CSRBaseAddress + MAC_CSR0));			\
-	writeb((_V), (PUCHAR)((_A)->CSRBaseAddress + (_R)));		\
+	writeb((_V), (u8 *)((_A)->CSRBaseAddress + (_R)));		\
 }
+#endif /* #if defined(BRCM_6358) || defined(RALINK_2880) // */
+
 #define RTMP_IO_WRITE16(_A, _R, _V)												\
 {																				\
-	UINT	Val;																\
+	u32 Val;																\
 	Val = readl((void *)((_A)->CSRBaseAddress + MAC_CSR0));			\
-	writew((_V), (PUSHORT)((_A)->CSRBaseAddress + (_R)));	\
+	writew((_V), (u16 *)((_A)->CSRBaseAddress + (_R)));	\
 }
-#endif /* RT2860 */
-#ifdef RT2870
-//Patch for ASIC turst read/write bug, needs to remove after metel fix
+#endif /* RTMP_MAC_PCI // */
+#ifdef RTMP_MAC_USB
+/*Patch for ASIC turst read/write bug, needs to remove after metel fix */
 #define RTMP_IO_READ32(_A, _R, _pV)								\
-	RTUSBReadMACRegister(_A, _R, _pV)
+	RTUSBReadMACRegister((_A), (_R), (u32 *)(_pV))
 
 #define RTMP_IO_READ8(_A, _R, _pV)								\
 {																\
 }
 
 #define RTMP_IO_WRITE32(_A, _R, _V)								\
-	RTUSBWriteMACRegister(_A, _R, _V)
-
+	RTUSBWriteMACRegister((_A), (_R), (u32)(_V))
 
 #define RTMP_IO_WRITE8(_A, _R, _V)								\
 {																\
-	USHORT	_Val = _V;											\
-	RTUSBSingleWrite(_A, _R, _Val);								\
+	u16	_Val = _V;											\
+	RTUSBSingleWrite((_A), (_R), (u16)(_Val));								\
 }
 
-
 #define RTMP_IO_WRITE16(_A, _R, _V)								\
 {																\
-	RTUSBSingleWrite(_A, _R, _V);								\
+	RTUSBSingleWrite((_A), (_R), (u16)(_V));								\
 }
-#endif // RT2870 //
+#endif /* RTMP_MAC_USB // */
 
-#ifndef wait_event_interruptible_timeout
-#define __wait_event_interruptible_timeout(wq, condition, ret) \
-do { \
-        wait_queue_t __wait; \
-        init_waitqueue_entry(&__wait, current); \
-        add_wait_queue(&wq, &__wait); \
-        for (;;) { \
-                set_current_state(TASK_INTERRUPTIBLE); \
-                if (condition) \
-                        break; \
-                if (!signal_pending(current)) { \
-                        ret = schedule_timeout(ret); \
-                        if (!ret) \
-                                break; \
-                        continue; \
-                } \
-                ret = -ERESTARTSYS; \
-                break; \
-        } \
-        current->state = TASK_RUNNING; \
-        remove_wait_queue(&wq, &__wait); \
-} while (0)
+/***********************************************************************************
+ *	Network Related data structure and marco definitions
+ ***********************************************************************************/
+#define PKTSRC_NDIS             0x7f
+#define PKTSRC_DRIVER           0x0f
 
-#define wait_event_interruptible_timeout(wq, condition, timeout) \
-({ \
-        long __ret = timeout; \
-        if (!(condition)) \
-                __wait_event_interruptible_timeout(wq, condition, __ret); \
-        __ret; \
-})
-#endif
-#define ONE_TICK 1
-#define OS_WAIT(_time) \
-{	int _i; \
-	long _loop = ((_time)/(1000/OS_HZ)) > 0 ? ((_time)/(1000/OS_HZ)) : 1;\
-	wait_queue_head_t _wait; \
-	init_waitqueue_head(&_wait); \
-	for (_i=0; _i<(_loop); _i++) \
-		wait_event_interruptible_timeout(_wait, 0, ONE_TICK); }
+#define RTMP_OS_NETDEV_SET_PRIV(_pNetDev, _pPriv)	((_pNetDev)->ml_priv = (_pPriv))
+#define RTMP_OS_NETDEV_GET_PRIV(_pNetDev)		((_pNetDev)->ml_priv)
+#define RTMP_OS_NETDEV_GET_DEVNAME(_pNetDev)	((_pNetDev)->name)
+#define RTMP_OS_NETDEV_GET_PHYADDR(_PNETDEV)	((_PNETDEV)->dev_addr)
 
+#define RTMP_OS_NETDEV_START_QUEUE(_pNetDev)	netif_start_queue((_pNetDev))
+#define RTMP_OS_NETDEV_STOP_QUEUE(_pNetDev)	netif_stop_queue((_pNetDev))
+#define RTMP_OS_NETDEV_WAKE_QUEUE(_pNetDev)	netif_wake_queue((_pNetDev))
+#define RTMP_OS_NETDEV_CARRIER_OFF(_pNetDev)	netif_carrier_off((_pNetDev))
 
-typedef void (*TIMER_FUNCTION)(unsigned long);
+#define QUEUE_ENTRY_TO_PACKET(pEntry) \
+	(void *)(pEntry)
 
-#define COPY_MAC_ADDR(Addr1, Addr2)             memcpy((Addr1), (Addr2), MAC_ADDR_LEN)
+#define PACKET_TO_QUEUE_ENTRY(pPacket) \
+	(struct rt_queue_entry *)(pPacket)
 
-#define MlmeAllocateMemory(_pAd, _ppVA) os_alloc_mem(_pAd, _ppVA, MGMT_DMA_BUFFER_SIZE)
-#define MlmeFreeMemory(_pAd, _pVA)     os_free_mem(_pAd, _pVA)
+#define GET_SG_LIST_FROM_PACKET(_p, _sc)	\
+    rt_get_sg_list_from_packet(_p, _sc)
 
-#ifdef RT2860
-#define BUILD_TIMER_FUNCTION(_func)												\
-void linux_##_func(unsigned long data)											\
-{																				\
-	PRALINK_TIMER_STRUCT	pTimer = (PRALINK_TIMER_STRUCT) data;				\
-																				\
-	_func(NULL, (PVOID) pTimer->cookie, NULL, pTimer); 							\
-	if (pTimer->Repeat)															\
-		RTMP_OS_Add_Timer(&pTimer->TimerObj, pTimer->TimerValue);				\
-}
-#endif
-#ifdef RT2870
-#define BUILD_TIMER_FUNCTION(_func)													\
-void linux_##_func(unsigned long data)												\
-{																					\
-	PRALINK_TIMER_STRUCT	_pTimer = (PRALINK_TIMER_STRUCT)data;					\
-	RT2870_TIMER_ENTRY		*_pQNode;												\
-	RTMP_ADAPTER			*_pAd;													\
-																				\
-	_pTimer->handle = _func;															\
-	_pAd = (RTMP_ADAPTER *)_pTimer->pAd;												\
-	_pQNode = RT2870_TimerQ_Insert(_pAd, _pTimer); 									\
-	if ((_pQNode == NULL) && (_pAd->TimerQ.status & RT2870_THREAD_CAN_DO_INSERT))	\
-		RTMP_OS_Add_Timer(&_pTimer->TimerObj, HZ);               					\
+#define RELEASE_NDIS_PACKET(_pAd, _pPacket, _Status)                    \
+{                                                                       \
+        RTMPFreeNdisPacket(_pAd, _pPacket);                             \
 }
-#endif // RT2870 //
-
-
-#define DECLARE_TIMER_FUNCTION(_func)			\
-void linux_##_func(unsigned long data)
-
-#define GET_TIMER_FUNCTION(_func)				\
-		linux_##_func
-
-DECLARE_TIMER_FUNCTION(MlmePeriodicExec);
-DECLARE_TIMER_FUNCTION(MlmeRssiReportExec);
-DECLARE_TIMER_FUNCTION(AsicRxAntEvalTimeout);
-DECLARE_TIMER_FUNCTION(APSDPeriodicExec);
-DECLARE_TIMER_FUNCTION(AsicRfTuningExec);
-#ifdef RT2870
-DECLARE_TIMER_FUNCTION(BeaconUpdateExec);
-#endif // RT2870 //
-
-DECLARE_TIMER_FUNCTION(BeaconTimeout);
-DECLARE_TIMER_FUNCTION(ScanTimeout);
-DECLARE_TIMER_FUNCTION(AuthTimeout);
-DECLARE_TIMER_FUNCTION(AssocTimeout);
-DECLARE_TIMER_FUNCTION(ReassocTimeout);
-DECLARE_TIMER_FUNCTION(DisassocTimeout);
-DECLARE_TIMER_FUNCTION(LinkDownExec);
-DECLARE_TIMER_FUNCTION(StaQuickResponeForRateUpExec);
-DECLARE_TIMER_FUNCTION(WpaDisassocApAndBlockAssoc);
-DECLARE_TIMER_FUNCTION(PsPollWakeExec);
-DECLARE_TIMER_FUNCTION(RadioOnExec);
-
-void RTMP_GetCurrentSystemTime(LARGE_INTEGER *time);
-
 
 /*
  * packet helper
@@ -600,16 +645,22 @@ void RTMP_GetCurrentSystemTime(LARGE_INTEGER *time);
  *             os packet to rt packet
  */
 #define RTPKT_TO_OSPKT(_p)		((struct sk_buff *)(_p))
-#define OSPKT_TO_RTPKT(_p)		((PNDIS_PACKET)(_p))
+#define OSPKT_TO_RTPKT(_p)		((void *)(_p))
 
 #define GET_OS_PKT_DATAPTR(_pkt) \
 		(RTPKT_TO_OSPKT(_pkt)->data)
+#define SET_OS_PKT_DATAPTR(_pkt, _dataPtr)	\
+		(RTPKT_TO_OSPKT(_pkt)->data) = (_dataPtr)
 
 #define GET_OS_PKT_LEN(_pkt) \
 		(RTPKT_TO_OSPKT(_pkt)->len)
+#define SET_OS_PKT_LEN(_pkt, _len)	\
+		(RTPKT_TO_OSPKT(_pkt)->len) = (_len)
 
 #define GET_OS_PKT_DATATAIL(_pkt) \
 		(RTPKT_TO_OSPKT(_pkt)->tail)
+#define SET_OS_PKT_DATATAIL(_pkt, _start, _len)	\
+		((RTPKT_TO_OSPKT(_pkt))->tail) = (u8 *)((_start) + (_len))
 
 #define GET_OS_PKT_HEAD(_pkt) \
 		(RTPKT_TO_OSPKT(_pkt)->head)
@@ -619,6 +670,8 @@ void RTMP_GetCurrentSystemTime(LARGE_INTEGER *time);
 
 #define GET_OS_PKT_NETDEV(_pkt) \
 		(RTPKT_TO_OSPKT(_pkt)->dev)
+#define SET_OS_PKT_NETDEV(_pkt, _pNetDev)	\
+		(RTPKT_TO_OSPKT(_pkt)->dev) = (_pNetDev)
 
 #define GET_OS_PKT_TYPE(_pkt) \
 		(RTPKT_TO_OSPKT(_pkt))
@@ -626,6 +679,7 @@ void RTMP_GetCurrentSystemTime(LARGE_INTEGER *time);
 #define GET_OS_PKT_NEXT(_pkt) \
 		(RTPKT_TO_OSPKT(_pkt)->next)
 
+#define OS_PKT_CLONED(_pkt)		skb_cloned(RTPKT_TO_OSPKT(_pkt))
 
 #define OS_NTOHS(_Val) \
 		(ntohs(_Val))
@@ -636,55 +690,36 @@ void RTMP_GetCurrentSystemTime(LARGE_INTEGER *time);
 #define OS_HTONL(_Val) \
 		(htonl(_Val))
 
-/* statistics counter */
-#define STATS_INC_RX_PACKETS(_pAd, _dev)
-#define STATS_INC_TX_PACKETS(_pAd, _dev)
-
-#define STATS_INC_RX_BYTESS(_pAd, _dev, len)
-#define STATS_INC_TX_BYTESS(_pAd, _dev, len)
-
-#define STATS_INC_RX_ERRORS(_pAd, _dev)
-#define STATS_INC_TX_ERRORS(_pAd, _dev)
-
-#define STATS_INC_RX_DROPPED(_pAd, _dev)
-#define STATS_INC_TX_DROPPED(_pAd, _dev)
-
-
 #define CB_OFF  10
 
-
-//   check DDK NDIS_PACKET data structure and find out only MiniportReservedEx[0..7] can be used by our driver without
-//   ambiguity. Fields after pPacket->MiniportReservedEx[8] may be used by other wrapper layer thus crashes the driver
-//
-
-// User Priority
+/* User Priority */
 #define RTMP_SET_PACKET_UP(_p, _prio)			(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+0] = _prio)
 #define RTMP_GET_PACKET_UP(_p)					(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+0])
 
-// Fragment #
+/* Fragment # */
 #define RTMP_SET_PACKET_FRAGMENTS(_p, _num)		(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+1] = _num)
 #define RTMP_GET_PACKET_FRAGMENTS(_p)			(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+1])
 
-// 0x0 ~0x7f: TX to AP's own BSS which has the specified AID. if AID>127, set bit 7 in RTMP_SET_PACKET_EMACTAB too.
-//(this value also as MAC(on-chip WCID) table index)
-// 0x80~0xff: TX to a WDS link. b0~6: WDS index
+/* 0x0 ~0x7f: TX to AP's own BSS which has the specified AID. if AID>127, set bit 7 in RTMP_SET_PACKET_EMACTAB too. */
+/*(this value also as MAC(on-chip WCID) table index) */
+/* 0x80~0xff: TX to a WDS link. b0~6: WDS index */
 #define RTMP_SET_PACKET_WCID(_p, _wdsidx)		(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+2] = _wdsidx)
-#define RTMP_GET_PACKET_WCID(_p)          		((UCHAR)(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+2]))
+#define RTMP_GET_PACKET_WCID(_p)          		((u8)(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+2]))
 
-// 0xff: PKTSRC_NDIS, others: local TX buffer index. This value affects how to a packet
+/* 0xff: PKTSRC_NDIS, others: local TX buffer index. This value affects how to a packet */
 #define RTMP_SET_PACKET_SOURCE(_p, _pktsrc)		(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+3] = _pktsrc)
 #define RTMP_GET_PACKET_SOURCE(_p)       		(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+3])
 
-// RTS/CTS-to-self protection method
+/* RTS/CTS-to-self protection method */
 #define RTMP_SET_PACKET_RTS(_p, _num)      		(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+4] = _num)
 #define RTMP_GET_PACKET_RTS(_p)          		(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+4])
-// see RTMP_S(G)ET_PACKET_EMACTAB
+/* see RTMP_S(G)ET_PACKET_EMACTAB */
 
-// TX rate index
+/* TX rate index */
 #define RTMP_SET_PACKET_TXRATE(_p, _rate)		(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+5] = _rate)
 #define RTMP_GET_PACKET_TXRATE(_p)		  		(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+5])
 
-// From which Interface
+/* From which Interface */
 #define RTMP_SET_PACKET_IF(_p, _ifdx)		(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+6] = _ifdx)
 #define RTMP_GET_PACKET_IF(_p)		  		(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+6])
 #define RTMP_SET_PACKET_NET_DEVICE_MBSSID(_p, _bss)		RTMP_SET_PACKET_IF((_p), (_bss))
@@ -697,10 +732,9 @@ void RTMP_GetCurrentSystemTime(LARGE_INTEGER *time);
 #define RTMP_SET_PACKET_MOREDATA(_p, _morebit)		(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+7] = _morebit)
 #define RTMP_GET_PACKET_MOREDATA(_p)				(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+7])
 
-
-//
-//	Sepcific Pakcet Type definition
-//
+/* */
+/*      Sepcific Pakcet Type definition */
+/* */
 #define RTMP_PACKET_SPECIFIC_CB_OFFSET	11
 
 #define RTMP_PACKET_SPECIFIC_DHCP		0x01
@@ -710,10 +744,10 @@ void RTMP_GetCurrentSystemTime(LARGE_INTEGER *time);
 #define RTMP_PACKET_SPECIFIC_VLAN		0x10
 #define RTMP_PACKET_SPECIFIC_LLCSNAP	0x20
 
-//Specific
+/*Specific */
 #define RTMP_SET_PACKET_SPECIFIC(_p, _flg)	   	(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+11] = _flg)
 
-//DHCP
+/*DHCP */
 #define RTMP_SET_PACKET_DHCP(_p, _flg)   													\
 			do{																				\
 				if (_flg)																	\
@@ -723,7 +757,7 @@ void RTMP_GetCurrentSystemTime(LARGE_INTEGER *time);
 			}while(0)
 #define RTMP_GET_PACKET_DHCP(_p)		(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+11] & RTMP_PACKET_SPECIFIC_DHCP)
 
-//EAPOL
+/*EAPOL */
 #define RTMP_SET_PACKET_EAPOL(_p, _flg)   													\
 			do{																				\
 				if (_flg)																	\
@@ -733,7 +767,7 @@ void RTMP_GetCurrentSystemTime(LARGE_INTEGER *time);
 			}while(0)
 #define RTMP_GET_PACKET_EAPOL(_p)		(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+11] & RTMP_PACKET_SPECIFIC_EAPOL)
 
-//WAI
+/*WAI */
 #define RTMP_SET_PACKET_WAI(_p, _flg)   													\
 			do{																				\
 				if (_flg)																	\
@@ -745,7 +779,7 @@ void RTMP_GetCurrentSystemTime(LARGE_INTEGER *time);
 
 #define RTMP_GET_PACKET_LOWRATE(_p)		(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+11] & (RTMP_PACKET_SPECIFIC_EAPOL | RTMP_PACKET_SPECIFIC_DHCP | RTMP_PACKET_SPECIFIC_WAI))
 
-//VLAN
+/*VLAN */
 #define RTMP_SET_PACKET_VLAN(_p, _flg)   													\
 			do{																				\
 				if (_flg)																	\
@@ -755,7 +789,7 @@ void RTMP_GetCurrentSystemTime(LARGE_INTEGER *time);
 			}while(0)
 #define RTMP_GET_PACKET_VLAN(_p)		(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+11] & RTMP_PACKET_SPECIFIC_VLAN)
 
-//LLC/SNAP
+/*LLC/SNAP */
 #define RTMP_SET_PACKET_LLCSNAP(_p, _flg)   													\
 			do{																				\
 				if (_flg)																	\
@@ -766,7 +800,7 @@ void RTMP_GetCurrentSystemTime(LARGE_INTEGER *time);
 
 #define RTMP_GET_PACKET_LLCSNAP(_p)		(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+11] & RTMP_PACKET_SPECIFIC_LLCSNAP)
 
-// IP
+/* IP */
 #define RTMP_SET_PACKET_IPV4(_p, _flg)														\
 			do{																				\
 				if (_flg)																	\
@@ -777,142 +811,35 @@ void RTMP_GetCurrentSystemTime(LARGE_INTEGER *time);
 
 #define RTMP_GET_PACKET_IPV4(_p)		(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+11] & RTMP_PACKET_SPECIFIC_IPV4)
 
-
-// If this flag is set, it indicates that this EAPoL frame MUST be clear.
+/* If this flag is set, it indicates that this EAPoL frame MUST be clear. */
 #define RTMP_SET_PACKET_CLEAR_EAP_FRAME(_p, _flg)   (RTPKT_TO_OSPKT(_p)->cb[CB_OFF+12] = _flg)
 #define RTMP_GET_PACKET_CLEAR_EAP_FRAME(_p)         (RTPKT_TO_OSPKT(_p)->cb[CB_OFF+12])
 
+/* use bit3 of cb[CB_OFF+16] */
+
 #define RTMP_SET_PACKET_5VT(_p, _flg)   (RTPKT_TO_OSPKT(_p)->cb[CB_OFF+22] = _flg)
 #define RTMP_GET_PACKET_5VT(_p)         (RTPKT_TO_OSPKT(_p)->cb[CB_OFF+22])
 
-#ifdef CONFIG_5VT_ENHANCE
-#define BRIDGE_TAG 0x35564252    // depends on 5VT define in br_input.c
-#endif
-
-
-#define NDIS_SET_PACKET_STATUS(_p, _status)
-
-
-#define GET_SG_LIST_FROM_PACKET(_p, _sc)	\
-    rt_get_sg_list_from_packet(_p, _sc)
-
-#define NdisMoveMemory(Destination, Source, Length) memmove(Destination, Source, Length)
-#define NdisZeroMemory(Destination, Length)         memset(Destination, 0, Length)
-#define NdisFillMemory(Destination, Length, Fill)   memset(Destination, Fill, Length)
-#define NdisEqualMemory(Source1, Source2, Length)   (!memcmp(Source1, Source2, Length))
-#define RTMPEqualMemory(Source1, Source2, Length)	(!memcmp(Source1, Source2, Length))
-
-
-#define RTMP_INC_REF(_A)		0
-#define RTMP_DEC_REF(_A)		0
-#define RTMP_GET_REF(_A)		0
-
-
-
-/*
- * ULONG
- * RTMP_GetPhysicalAddressLow(
- *   IN NDIS_PHYSICAL_ADDRESS  PhysicalAddress);
- */
-#define RTMP_GetPhysicalAddressLow(PhysicalAddress)		(PhysicalAddress)
-
-/*
- * ULONG
- * RTMP_GetPhysicalAddressHigh(
- *   IN NDIS_PHYSICAL_ADDRESS  PhysicalAddress);
- */
-#define RTMP_GetPhysicalAddressHigh(PhysicalAddress)		(0)
-
-/*
- * VOID
- * RTMP_SetPhysicalAddressLow(
- *   IN NDIS_PHYSICAL_ADDRESS  PhysicalAddress,
- *   IN ULONG  Value);
- */
-#define RTMP_SetPhysicalAddressLow(PhysicalAddress, Value)	\
-			PhysicalAddress = Value;
-
-/*
- * VOID
- * RTMP_SetPhysicalAddressHigh(
- *   IN NDIS_PHYSICAL_ADDRESS  PhysicalAddress,
- *   IN ULONG  Value);
- */
-#define RTMP_SetPhysicalAddressHigh(PhysicalAddress, Value)
-
-
-//CONTAINING_RECORD(pEntry, NDIS_PACKET, MiniportReservedEx);
-#define QUEUE_ENTRY_TO_PACKET(pEntry) \
-	(PNDIS_PACKET)(pEntry)
-
-#define PACKET_TO_QUEUE_ENTRY(pPacket) \
-	(PQUEUE_ENTRY)(pPacket)
-
-
-#ifndef CONTAINING_RECORD
-#define CONTAINING_RECORD(address, type, field)			\
-((type *)((PCHAR)(address) - offsetof(type, field)))
-#endif
-
-
-#define RELEASE_NDIS_PACKET(_pAd, _pPacket, _Status)                    \
-{                                                                       \
-        RTMPFreeNdisPacket(_pAd, _pPacket);                             \
-}
-
-
-#define SWITCH_PhyAB(_pAA, _pBB)    \
-{                                                                           \
-    ULONG	AABasePaHigh;                           \
-    ULONG	AABasePaLow;                           \
-    ULONG	BBBasePaHigh;                           \
-    ULONG	BBBasePaLow;                           \
-    BBBasePaHigh = RTMP_GetPhysicalAddressHigh(_pBB);                                                 \
-    BBBasePaLow = RTMP_GetPhysicalAddressLow(_pBB);                                                 \
-    AABasePaHigh = RTMP_GetPhysicalAddressHigh(_pAA);                                                 \
-    AABasePaLow = RTMP_GetPhysicalAddressLow(_pAA);                                                 \
-    RTMP_SetPhysicalAddressHigh(_pAA, BBBasePaHigh);                                                 \
-    RTMP_SetPhysicalAddressLow(_pAA, BBBasePaLow);                                                 \
-    RTMP_SetPhysicalAddressHigh(_pBB, AABasePaHigh);                                                 \
-    RTMP_SetPhysicalAddressLow(_pBB, AABasePaLow);                                                 \
-}
-
-
-#define NdisWriteErrorLogEntry(_a, _b, _c, _d)
-#define NdisMAllocateMapRegisters(_a, _b, _c, _d, _e)		NDIS_STATUS_SUCCESS
-
-
-#define NdisAcquireSpinLock		RTMP_SEM_LOCK
-#define NdisReleaseSpinLock		RTMP_SEM_UNLOCK
-
-static inline void NdisGetSystemUpTime(ULONG *time)
-{
-	*time = jiffies;
-}
-
-//pPacket = CONTAINING_RECORD(pEntry, NDIS_PACKET, MiniportReservedEx);
-#define QUEUE_ENTRY_TO_PKT(pEntry) \
-		((PNDIS_PACKET) (pEntry))
+/* Max skb->cb = 48B = [CB_OFF+38] */
 
+/***********************************************************************************
+ *	Other function prototypes definitions
+ ***********************************************************************************/
+void RTMP_GetCurrentSystemTime(LARGE_INTEGER * time);
 int rt28xx_packet_xmit(struct sk_buff *skb);
 
+#ifdef RTMP_MAC_PCI
+/* function declarations */
+#define IRQ_HANDLE_TYPE  irqreturn_t
 
+IRQ_HANDLE_TYPE rt2860_interrupt(int irq, void *dev_instance);
+#endif /* RTMP_MAC_PCI // */
 
-void rtmp_os_thread_init(PUCHAR pThreadName, PVOID pNotify);
+int rt28xx_sta_ioctl(struct net_device *net_dev, IN OUT struct ifreq *rq, int cmd);
 
-#ifdef RT2860
-#if !defined(PCI_CAP_ID_EXP)
-#define PCI_CAP_ID_EXP			    0x10
-#endif
-
-#if !defined(PCI_EXP_LNKCTL)
-#define PCI_EXP_LNKCTL			    0x10
-#endif
+extern int ra_mtd_write(int num, loff_t to, size_t len, const u_char * buf);
+extern int ra_mtd_read(int num, loff_t from, size_t len, u_char * buf);
 
-#if !defined(PCI_CLASS_BRIDGE_PCI)
-#define PCI_CLASS_BRIDGE_PCI		0x0604
-#endif
-
-#define PCIBUS_INTEL_VENDOR         0x8086
-#endif
+#define GET_PAD_FROM_NET_DEV(_pAd, _net_dev)	(_pAd) = (struct rt_rtmp_adapter *)(_net_dev)->ml_priv;
 
+#endif /* __RT_LINUX_H__ // */
diff --git a/drivers/staging/rt2860/rt_main_dev.c b/drivers/staging/rt2860/rt_main_dev.c
index 22f37cfbefbe..c3d92802d0c9 100644
--- a/drivers/staging/rt2860/rt_main_dev.c
+++ b/drivers/staging/rt2860/rt_main_dev.c
@@ -33,53 +33,33 @@
     Revision History:
     Who         When            What
     --------    ----------      ----------------------------------------------
-	Sample		Mar/21/07		Merge RT2870 and RT2860 drivers.
 */
 
 #include "rt_config.h"
 
-#define FORTY_MHZ_INTOLERANT_INTERVAL	(60*1000) // 1 min
-
 /*---------------------------------------------------------------------*/
 /* Private Variables Used                                              */
 /*---------------------------------------------------------------------*/
-//static RALINK_TIMER_STRUCT     PeriodicTimer;
-
-char *mac = "";		   // default 00:00:00:00:00:00
-char *hostname = "";		   // default CMPC
-module_param (mac, charp, 0);
-MODULE_PARM_DESC (mac, "rt28xx: wireless mac addr");
 
+char *mac = "";		/* default 00:00:00:00:00:00 */
+char *hostname = "";		/* default CMPC */
+module_param(mac, charp, 0);
+MODULE_PARM_DESC(mac, "rt28xx: wireless mac addr");
 
 /*---------------------------------------------------------------------*/
 /* Prototypes of Functions Used                                        */
 /*---------------------------------------------------------------------*/
-extern BOOLEAN ba_reordering_resource_init(PRTMP_ADAPTER pAd, int num);
-extern void ba_reordering_resource_release(PRTMP_ADAPTER pAd);
-extern NDIS_STATUS NICLoadRateSwitchingParams(IN PRTMP_ADAPTER pAd);
-
-#ifdef RT2860
-extern void init_thread_task(PRTMP_ADAPTER pAd);
-#endif
-
-// public function prototype
-INT __devinit rt28xx_probe(IN void *_dev_p, IN void *_dev_id_p,
-							IN UINT argc, OUT PRTMP_ADAPTER *ppAd);
 
-// private function prototype
-static int rt28xx_init(IN struct net_device *net_dev);
-INT rt28xx_send_packets(IN struct sk_buff *skb_p, IN struct net_device *net_dev);
+/* public function prototype */
+int rt28xx_close(IN struct net_device *net_dev);
+int rt28xx_open(struct net_device *net_dev);
 
-static void CfgInitHook(PRTMP_ADAPTER pAd);
+/* private function prototype */
+static int rt28xx_send_packets(IN struct sk_buff *skb_p,
+			       IN struct net_device *net_dev);
 
-extern	const struct iw_handler_def rt28xx_iw_handler_def;
-
-// This function will be called when query /proc
-struct iw_statistics *rt28xx_get_wireless_stats(
-    IN struct net_device *net_dev);
-
-struct net_device_stats *RT28xx_get_ether_stats(
-    IN  struct net_device *net_dev);
+static struct net_device_stats *RT28xx_get_ether_stats(IN struct net_device
+						       *net_dev);
 
 /*
 ========================================================================
@@ -103,21 +83,66 @@ Note:
 */
 int MainVirtualIF_close(IN struct net_device *net_dev)
 {
-    RTMP_ADAPTER *pAd = net_dev->ml_priv;
+	struct rt_rtmp_adapter *pAd = NULL;
 
-	// Sanity check for pAd
+	GET_PAD_FROM_NET_DEV(pAd, net_dev);
+
+	/* Sanity check for pAd */
 	if (pAd == NULL)
-		return 0; // close ok
+		return 0;	/* close ok */
 
 	netif_carrier_off(pAd->net_dev);
 	netif_stop_queue(pAd->net_dev);
 
+	{
+		BOOLEAN Cancelled;
+
+		if (INFRA_ON(pAd) &&
+		    (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST))) {
+			struct rt_mlme_disassoc_req DisReq;
+			struct rt_mlme_queue_elem *MsgElem =
+			    (struct rt_mlme_queue_elem *)kmalloc(sizeof(struct rt_mlme_queue_elem),
+							MEM_ALLOC_FLAG);
+
+			if (MsgElem) {
+				COPY_MAC_ADDR(DisReq.Addr,
+					      pAd->CommonCfg.Bssid);
+				DisReq.Reason = REASON_DEAUTH_STA_LEAVING;
+
+				MsgElem->Machine = ASSOC_STATE_MACHINE;
+				MsgElem->MsgType = MT2_MLME_DISASSOC_REQ;
+				MsgElem->MsgLen =
+				    sizeof(struct rt_mlme_disassoc_req);
+				NdisMoveMemory(MsgElem->Msg, &DisReq,
+					       sizeof
+					       (struct rt_mlme_disassoc_req));
+
+				/* Prevent to connect AP again in STAMlmePeriodicExec */
+				pAd->MlmeAux.AutoReconnectSsidLen = 32;
+				NdisZeroMemory(pAd->MlmeAux.AutoReconnectSsid,
+					       pAd->MlmeAux.
+					       AutoReconnectSsidLen);
+
+				pAd->Mlme.CntlMachine.CurrState =
+				    CNTL_WAIT_OID_DISASSOC;
+				MlmeDisassocReqAction(pAd, MsgElem);
+				kfree(MsgElem);
+			}
+
+			RTMPusecDelay(1000);
+		}
+
+		RTMPCancelTimer(&pAd->StaCfg.StaQuickResponeForRateUpTimer,
+				&Cancelled);
+		RTMPCancelTimer(&pAd->StaCfg.WpaDisassocAndBlockAssocTimer,
+				&Cancelled);
+	}
 
 	VIRTUAL_IF_DOWN(pAd);
 
 	RT_MOD_DEC_USE_COUNT();
 
-	return 0; // close ok
+	return 0;		/* close ok */
 }
 
 /*
@@ -142,16 +167,18 @@ Note:
 */
 int MainVirtualIF_open(IN struct net_device *net_dev)
 {
-    RTMP_ADAPTER *pAd = net_dev->ml_priv;
+	struct rt_rtmp_adapter *pAd = NULL;
 
-	// Sanity check for pAd
+	GET_PAD_FROM_NET_DEV(pAd, net_dev);
+
+	/* Sanity check for pAd */
 	if (pAd == NULL)
-		return 0; // close ok
+		return 0;	/* close ok */
 
 	if (VIRTUAL_IF_UP(pAd) != 0)
 		return -1;
 
-	// increase MODULE use count
+	/* increase MODULE use count */
 	RT_MOD_INC_USE_COUNT();
 
 	netif_start_queue(net_dev);
@@ -181,409 +208,160 @@ Note:
 		(3) BA Reordering: 				ba_reordering_resource_release()
 ========================================================================
 */
-int rt28xx_close(IN PNET_DEV dev)
+int rt28xx_close(struct net_device *dev)
 {
-	struct net_device * net_dev = (struct net_device *)dev;
-    RTMP_ADAPTER	*pAd = net_dev->ml_priv;
-	BOOLEAN 		Cancelled = FALSE;
-	UINT32			i = 0;
-#ifdef RT2870
-	DECLARE_WAIT_QUEUE_HEAD_ONSTACK(unlink_wakeup);
-	DECLARE_WAITQUEUE(wait, current);
+	struct net_device *net_dev = (struct net_device *)dev;
+	struct rt_rtmp_adapter *pAd = NULL;
+	BOOLEAN Cancelled;
+	u32 i = 0;
 
-	//RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_REMOVE_IN_PROGRESS);
-#endif // RT2870 //
+#ifdef RTMP_MAC_USB
+	DECLARE_WAIT_QUEUE_HEAD(unlink_wakeup);
+	DECLARE_WAITQUEUE(wait, current);
+#endif /* RTMP_MAC_USB // */
 
+	GET_PAD_FROM_NET_DEV(pAd, net_dev);
 
-    DBGPRINT(RT_DEBUG_TRACE, ("===> rt28xx_close\n"));
+	DBGPRINT(RT_DEBUG_TRACE, ("===> rt28xx_close\n"));
 
-	// Sanity check for pAd
+	Cancelled = FALSE;
+	/* Sanity check for pAd */
 	if (pAd == NULL)
-		return 0; // close ok
+		return 0;	/* close ok */
 
 	{
-		// If dirver doesn't wake up firmware here,
-		// NICLoadFirmware will hang forever when interface is up again.
-#ifdef RT2860
-		if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE) ||
-			RTMP_SET_PSFLAG(pAd, fRTMP_PS_SET_PCI_CLK_OFF_COMMAND) ||
-			RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_IDLE_RADIO_OFF))
-#endif
-#ifdef RT2870
-		if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE))
-#endif
-        {
-#ifdef RT2860
-		    AsicForceWakeup(pAd, RTMP_HALT);
-#endif
-#ifdef RT2870
-		    AsicForceWakeup(pAd, TRUE);
-#endif
-        }
-
-		if (INFRA_ON(pAd) &&
-			(!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)))
-		{
-			MLME_DISASSOC_REQ_STRUCT	DisReq;
-			MLME_QUEUE_ELEM *MsgElem = (MLME_QUEUE_ELEM *) kmalloc(sizeof(MLME_QUEUE_ELEM), MEM_ALLOC_FLAG);
-
-			COPY_MAC_ADDR(DisReq.Addr, pAd->CommonCfg.Bssid);
-			DisReq.Reason =  REASON_DEAUTH_STA_LEAVING;
-
-			MsgElem->Machine = ASSOC_STATE_MACHINE;
-			MsgElem->MsgType = MT2_MLME_DISASSOC_REQ;
-			MsgElem->MsgLen = sizeof(MLME_DISASSOC_REQ_STRUCT);
-			NdisMoveMemory(MsgElem->Msg, &DisReq, sizeof(MLME_DISASSOC_REQ_STRUCT));
-
-			// Prevent to connect AP again in STAMlmePeriodicExec
-			pAd->MlmeAux.AutoReconnectSsidLen= 32;
-			NdisZeroMemory(pAd->MlmeAux.AutoReconnectSsid, pAd->MlmeAux.AutoReconnectSsidLen);
-
-			pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_OID_DISASSOC;
-			MlmeDisassocReqAction(pAd, MsgElem);
-			kfree(MsgElem);
-
-			RTMPusecDelay(1000);
+#ifdef RTMP_MAC_PCI
+		RTMPPCIeLinkCtrlValueRestore(pAd, RESTORE_CLOSE);
+#endif /* RTMP_MAC_PCI // */
+
+		/* If dirver doesn't wake up firmware here, */
+		/* NICLoadFirmware will hang forever when interface is up again. */
+		if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE)) {
+			AsicForceWakeup(pAd, TRUE);
 		}
-
-#ifdef RT2870
-	RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_REMOVE_IN_PROGRESS);
-#endif // RT2870 //
-
-#ifdef CCX_SUPPORT
-		RTMPCancelTimer(&pAd->StaCfg.LeapAuthTimer, &Cancelled);
-#endif
-
-		RTMPCancelTimer(&pAd->StaCfg.StaQuickResponeForRateUpTimer, &Cancelled);
-		RTMPCancelTimer(&pAd->StaCfg.WpaDisassocAndBlockAssocTimer, &Cancelled);
+#ifdef RTMP_MAC_USB
+		RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_REMOVE_IN_PROGRESS);
+#endif /* RTMP_MAC_USB // */
 
 		MlmeRadioOff(pAd);
-#ifdef RT2860
+#ifdef RTMP_MAC_PCI
 		pAd->bPCIclkOff = FALSE;
-#endif
+#endif /* RTMP_MAC_PCI // */
 	}
 
 	RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS);
 
-	for (i = 0 ; i < NUM_OF_TX_RING; i++)
-	{
-		while (pAd->DeQueueRunning[i] == TRUE)
-		{
-			printk("Waiting for TxQueue[%d] done..........\n", i);
+	for (i = 0; i < NUM_OF_TX_RING; i++) {
+		while (pAd->DeQueueRunning[i] == TRUE) {
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("Waiting for TxQueue[%d] done..........\n",
+				  i));
 			RTMPusecDelay(1000);
 		}
 	}
 
-#ifdef RT2870
-	// ensure there are no more active urbs.
-	add_wait_queue (&unlink_wakeup, &wait);
+#ifdef RTMP_MAC_USB
+	/* ensure there are no more active urbs. */
+	add_wait_queue(&unlink_wakeup, &wait);
 	pAd->wait = &unlink_wakeup;
 
-	// maybe wait for deletions to finish.
+	/* maybe wait for deletions to finish. */
 	i = 0;
-	//while((i < 25) && atomic_read(&pAd->PendingRx) > 0)
-	while(i < 25)
-	{
+	/*while((i < 25) && atomic_read(&pAd->PendingRx) > 0) */
+	while (i < 25) {
 		unsigned long IrqFlags;
 
 		RTMP_IRQ_LOCK(&pAd->BulkInLock, IrqFlags);
-		if (pAd->PendingRx == 0)
-		{
+		if (pAd->PendingRx == 0) {
 			RTMP_IRQ_UNLOCK(&pAd->BulkInLock, IrqFlags);
 			break;
 		}
 		RTMP_IRQ_UNLOCK(&pAd->BulkInLock, IrqFlags);
 
-		msleep(UNLINK_TIMEOUT_MS);	//Time in millisecond
+		msleep(UNLINK_TIMEOUT_MS);	/*Time in millisecond */
 		i++;
 	}
 	pAd->wait = NULL;
-	remove_wait_queue (&unlink_wakeup, &wait);
-#endif // RT2870 //
+	remove_wait_queue(&unlink_wakeup, &wait);
+#endif /* RTMP_MAC_USB // */
 
-#ifdef RT2870
-	// We need clear timerQ related structure before exits of the timer thread.
-	RT2870_TimerQ_Exit(pAd);
-	// Close kernel threads or tasklets
-	RT28xxThreadTerminate(pAd);
-#endif // RT2870 //
-
-	// Stop Mlme state machine
+	/* Stop Mlme state machine */
 	MlmeHalt(pAd);
 
-	// Close kernel threads or tasklets
-	kill_thread_task(pAd);
-
-	MacTableReset(pAd);
-
-	MeasureReqTabExit(pAd);
-	TpcReqTabExit(pAd);
-
-#ifdef RT2860
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_INTERRUPT_ACTIVE))
-	{
-		NICDisableInterrupt(pAd);
-	}
-
-	// Disable Rx, register value supposed will remain after reset
-	NICIssueReset(pAd);
+	/* Close net tasklets */
+	RtmpNetTaskExit(pAd);
 
-	// Free IRQ
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_INTERRUPT_IN_USE))
 	{
-		// Deregister interrupt function
-		RT28XX_IRQ_RELEASE(net_dev)
-		RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_INTERRUPT_IN_USE);
+		MacTableReset(pAd);
 	}
-#endif
-
-	// Free Ring or USB buffers
-	RTMPFreeTxRxRingMemory(pAd);
-
-	RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS);
-
-	// Free BA reorder resource
-	ba_reordering_resource_release(pAd);
 
-	RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_START_UP);
+	MeasureReqTabExit(pAd);
+	TpcReqTabExit(pAd);
 
-	return 0; // close ok
-} /* End of rt28xx_close */
+	/* Close kernel threads */
+	RtmpMgmtTaskExit(pAd);
 
-static int rt28xx_init(IN struct net_device *net_dev)
-{
-#ifdef RT2860
-	PRTMP_ADAPTER 			pAd = (PRTMP_ADAPTER)net_dev->ml_priv;
-#endif
-#ifdef RT2870
-	PRTMP_ADAPTER 			pAd = net_dev->ml_priv;
-#endif
-	UINT					index;
-	UCHAR					TmpPhy;
-	NDIS_STATUS				Status;
-	UINT32 		MacCsr0 = 0;
-
-	// Allocate BA Reordering memory
-	ba_reordering_resource_init(pAd, MAX_REORDERING_MPDU_NUM);
-
-	// Make sure MAC gets ready.
-	index = 0;
-	do
+#ifdef RTMP_MAC_PCI
 	{
-		RTMP_IO_READ32(pAd, MAC_CSR0, &MacCsr0);
-		pAd->MACVersion = MacCsr0;
+		BOOLEAN brc;
+		/*      unsigned long                   Value; */
 
-		if ((pAd->MACVersion != 0x00) && (pAd->MACVersion != 0xFFFFFFFF))
-			break;
-
-		RTMPusecDelay(10);
-	} while (index++ < 100);
+		if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_INTERRUPT_ACTIVE)) {
+			RTMP_ASIC_INTERRUPT_DISABLE(pAd);
+		}
+		/* Receive packets to clear DMA index after disable interrupt. */
+		/*RTMPHandleRxDoneInterrupt(pAd); */
+		/* put to radio off to save power when driver unload.  After radiooff, can't write /read register.  So need to finish all */
+		/* register access before Radio off. */
 
-	DBGPRINT(RT_DEBUG_TRACE, ("MAC_CSR0  [ Ver:Rev=0x%08x]\n", pAd->MACVersion));
-/*Iverson patch PCIE L1 issue */
+		brc = RT28xxPciAsicRadioOff(pAd, RTMP_HALT, 0);
 
-	// Disable DMA
-	RT28XXDMADisable(pAd);
+/*In  solution 3 of 3090F, the bPCIclkOff will be set to TRUE after calling RT28xxPciAsicRadioOff */
+		pAd->bPCIclkOff = FALSE;
 
-	// Load 8051 firmware
-	Status = NICLoadFirmware(pAd);
-	if (Status != NDIS_STATUS_SUCCESS)
-	{
-		DBGPRINT_ERR(("NICLoadFirmware failed, Status[=0x%08x]\n", Status));
-		goto err1;
+		if (brc == FALSE) {
+			DBGPRINT(RT_DEBUG_ERROR,
+				 ("%s call RT28xxPciAsicRadioOff fail!\n",
+				  __func__));
+		}
 	}
 
-	NICLoadRateSwitchingParams(pAd);
-
-	// Disable interrupts here which is as soon as possible
-	// This statement should never be true. We might consider to remove it later
-#ifdef RT2860
+/*
 	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_INTERRUPT_ACTIVE))
 	{
-		NICDisableInterrupt(pAd);
-	}
-#endif
-
-	Status = RTMPAllocTxRxRingMemory(pAd);
-	if (Status != NDIS_STATUS_SUCCESS)
-	{
-		DBGPRINT_ERR(("RTMPAllocDMAMemory failed, Status[=0x%08x]\n", Status));
-		goto err1;
+		RTMP_ASIC_INTERRUPT_DISABLE(pAd);
 	}
 
-	RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_INTERRUPT_IN_USE);
-
-	// initialize MLME
-	//
-
-	Status = MlmeInit(pAd);
-	if (Status != NDIS_STATUS_SUCCESS)
-	{
-		DBGPRINT_ERR(("MlmeInit failed, Status[=0x%08x]\n", Status));
-		goto err2;
-	}
-
-	// Initialize pAd->StaCfg, pAd->ApCfg, pAd->CommonCfg to manufacture default
-	//
-	UserCfgInit(pAd);
-
-#ifdef RT2870
-	// We need init timerQ related structure before create the timer thread.
-	RT2870_TimerQ_Init(pAd);
-#endif // RT2870 //
-
-	RT28XX_TASK_THREAD_INIT(pAd, Status);
-	if (Status != NDIS_STATUS_SUCCESS)
-		goto err1;
-
-	CfgInitHook(pAd);
-
-	NdisAllocateSpinLock(&pAd->MacTabLock);
-
-	MeasureReqTabInit(pAd);
-	TpcReqTabInit(pAd);
-
-	//
-	// Init the hardware, we need to init asic before read registry, otherwise mac register will be reset
-	//
-	Status = NICInitializeAdapter(pAd, TRUE);
-	if (Status != NDIS_STATUS_SUCCESS)
-	{
-		DBGPRINT_ERR(("NICInitializeAdapter failed, Status[=0x%08x]\n", Status));
-		if (Status != NDIS_STATUS_SUCCESS)
-		goto err3;
-	}
-
-	// Read parameters from Config File
-	Status = RTMPReadParametersHook(pAd);
-
-	printk("1. Phy Mode = %d\n", pAd->CommonCfg.PhyMode);
-	if (Status != NDIS_STATUS_SUCCESS)
-	{
-		DBGPRINT_ERR(("NICReadRegParameters failed, Status[=0x%08x]\n",Status));
-		goto err4;
-	}
-
-#ifdef RT2870
-	pAd->CommonCfg.bMultipleIRP = FALSE;
-
-	if (pAd->CommonCfg.bMultipleIRP)
-		pAd->CommonCfg.NumOfBulkInIRP = RX_RING_SIZE;
-	else
-		pAd->CommonCfg.NumOfBulkInIRP = 1;
-#endif // RT2870 //
-
-
-   	//Init Ba Capability parameters.
-	pAd->CommonCfg.DesiredHtPhy.MpduDensity = (UCHAR)pAd->CommonCfg.BACapability.field.MpduDensity;
-	pAd->CommonCfg.DesiredHtPhy.AmsduEnable = (USHORT)pAd->CommonCfg.BACapability.field.AmsduEnable;
-	pAd->CommonCfg.DesiredHtPhy.AmsduSize = (USHORT)pAd->CommonCfg.BACapability.field.AmsduSize;
-	pAd->CommonCfg.DesiredHtPhy.MimoPs = (USHORT)pAd->CommonCfg.BACapability.field.MMPSmode;
-	// UPdata to HT IE
-	pAd->CommonCfg.HtCapability.HtCapInfo.MimoPs = (USHORT)pAd->CommonCfg.BACapability.field.MMPSmode;
-	pAd->CommonCfg.HtCapability.HtCapInfo.AMsduSize = (USHORT)pAd->CommonCfg.BACapability.field.AmsduSize;
-	pAd->CommonCfg.HtCapability.HtCapParm.MpduDensity = (UCHAR)pAd->CommonCfg.BACapability.field.MpduDensity;
-
-	printk("2. Phy Mode = %d\n", pAd->CommonCfg.PhyMode);
-
-	// We should read EEPROM for all cases.  rt2860b
-	NICReadEEPROMParameters(pAd, mac);
-
-	printk("3. Phy Mode = %d\n", pAd->CommonCfg.PhyMode);
-
-	NICInitAsicFromEEPROM(pAd); //rt2860b
-
-	// Set PHY to appropriate mode
-	TmpPhy = pAd->CommonCfg.PhyMode;
-	pAd->CommonCfg.PhyMode = 0xff;
-	RTMPSetPhyMode(pAd, TmpPhy);
-	SetCommonHT(pAd);
-
-	// No valid channels.
-	if (pAd->ChannelListNum == 0)
-	{
-		printk("Wrong configuration. No valid channel found. Check \"ContryCode\" and \"ChannelGeography\" setting.\n");
-		goto err4;
+	// Disable Rx, register value supposed will remain after reset
+	NICIssueReset(pAd);
+*/
+#endif /* RTMP_MAC_PCI // */
+
+	/* Free IRQ */
+	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_INTERRUPT_IN_USE)) {
+#ifdef RTMP_MAC_PCI
+		/* Deregister interrupt function */
+		RtmpOSIRQRelease(net_dev);
+#endif /* RTMP_MAC_PCI // */
+		RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_INTERRUPT_IN_USE);
 	}
+	/* Free Ring or USB buffers */
+	RTMPFreeTxRxRingMemory(pAd);
 
-	printk("MCS Set = %02x %02x %02x %02x %02x\n", pAd->CommonCfg.HtCapability.MCSSet[0],
-           pAd->CommonCfg.HtCapability.MCSSet[1], pAd->CommonCfg.HtCapability.MCSSet[2],
-           pAd->CommonCfg.HtCapability.MCSSet[3], pAd->CommonCfg.HtCapability.MCSSet[4]);
-
-#ifdef RT2870
-    //Init RT30xx RFRegisters after read RFIC type from EEPROM
-	NICInitRT30xxRFRegisters(pAd);
-#endif // RT2870 //
-
+	RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS);
 
-		//
-	// Initialize RF register to default value
-	//
-	AsicSwitchChannel(pAd, pAd->CommonCfg.Channel, FALSE);
-	AsicLockChannel(pAd, pAd->CommonCfg.Channel);
+	/* Free BA reorder resource */
+	ba_reordering_resource_release(pAd);
 
-#ifndef RT2870
-	// 8051 firmware require the signal during booting time.
-	AsicSendCommandToMcu(pAd, 0x72, 0xFF, 0x00, 0x00);
-#endif
+	RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_START_UP);
 
-	if (pAd && (Status != NDIS_STATUS_SUCCESS))
+/*+++Modify by woody to solve the bulk fail+++*/
 	{
-		//
-		// Undo everything if it failed
-		//
-		if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_INTERRUPT_IN_USE))
-		{
-			RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_INTERRUPT_IN_USE);
-		}
 	}
-	else if (pAd)
-	{
-		// Microsoft HCT require driver send a disconnect event after driver initialization.
-		OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED);
-		RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_MEDIA_STATE_CHANGE);
-
-		DBGPRINT(RT_DEBUG_TRACE, ("NDIS_STATUS_MEDIA_DISCONNECT Event B!\n"));
-
-
-#ifdef RT2870
-		RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_RESET_IN_PROGRESS);
-		RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_REMOVE_IN_PROGRESS);
-
-		//
-		// Support multiple BulkIn IRP,
-		// the value on pAd->CommonCfg.NumOfBulkInIRP may be large than 1.
-		//
-		for(index=0; index<pAd->CommonCfg.NumOfBulkInIRP; index++)
-		{
-			RTUSBBulkReceive(pAd);
-			DBGPRINT(RT_DEBUG_TRACE, ("RTUSBBulkReceive!\n" ));
-		}
-#endif // RT2870 //
-	}// end of else
-
-
-	DBGPRINT_S(Status, ("<==== RTMPInitialize, Status=%x\n", Status));
-
-	return TRUE;
-
-
-err4:
-err3:
-	MlmeHalt(pAd);
-err2:
-	RTMPFreeTxRxRingMemory(pAd);
-err1:
-	os_free_mem(pAd, pAd->mpdu_blk_pool.mem); // free BA pool
-	RT28XX_IRQ_RELEASE(net_dev);
-
-	// shall not set ml_priv to NULL here because the ml_priv didn't been free yet.
-	//net_dev->ml_priv = 0;
-
-	printk("!!! %s Initialized fail !!!\n", RT28xx_CHIP_NAME);
-	return FALSE;
-} /* End of rt28xx_init */
 
+	DBGPRINT(RT_DEBUG_TRACE, ("<=== rt28xx_close\n"));
+	return 0;		/* close ok */
+}				/* End of rt28xx_close */
 
 /*
 ========================================================================
@@ -600,234 +378,116 @@ Return Value:
 Note:
 ========================================================================
 */
-int rt28xx_open(IN PNET_DEV dev)
+int rt28xx_open(struct net_device *dev)
 {
-	struct net_device * net_dev = (struct net_device *)dev;
-	PRTMP_ADAPTER pAd = net_dev->ml_priv;
+	struct net_device *net_dev = (struct net_device *)dev;
+	struct rt_rtmp_adapter *pAd = NULL;
 	int retval = 0;
- 	POS_COOKIE pObj;
+	/*struct os_cookie *pObj; */
 
+	GET_PAD_FROM_NET_DEV(pAd, net_dev);
 
-	// Sanity check for pAd
-	if (pAd == NULL)
-	{
+	/* Sanity check for pAd */
+	if (pAd == NULL) {
 		/* if 1st open fail, pAd will be free;
 		   So the net_dev->ml_priv will be NULL in 2rd open */
 		return -1;
 	}
 
-	// Init
- 	pObj = (POS_COOKIE)pAd->OS_Cookie;
-
-	// reset Adapter flags
-	RTMP_CLEAR_FLAGS(pAd);
-
-	// Request interrupt service routine for PCI device
-	// register the interrupt routine with the os
-	RT28XX_IRQ_REQUEST(net_dev);
-
-
-	// Init BssTab & ChannelInfo tabbles for auto channel select.
+	if (net_dev->priv_flags == INT_MAIN) {
+		if (pAd->OpMode == OPMODE_STA)
+			net_dev->wireless_handlers =
+			    (struct iw_handler_def *)&rt28xx_iw_handler_def;
+	}
+	/* Request interrupt service routine for PCI device */
+	/* register the interrupt routine with the os */
+	RtmpOSIRQRequest(net_dev);
 
+	/* Init IRQ parameters stored in pAd */
+	RTMP_IRQ_INIT(pAd);
 
-	// Chip & other init
-	if (rt28xx_init(net_dev) == FALSE)
+	/* Chip & other init */
+	if (rt28xx_init(pAd, mac, hostname) == FALSE)
 		goto err;
 
-	NdisZeroMemory(pAd->StaCfg.dev_name, 16);
-	NdisMoveMemory(pAd->StaCfg.dev_name, net_dev->name, strlen(net_dev->name));
+	/* Enable Interrupt */
+	RTMP_IRQ_ENABLE(pAd);
 
-	// Set up the Mac address
-	NdisMoveMemory(net_dev->dev_addr, (void *) pAd->CurrentAddress, 6);
+	/* Now Enable RxTx */
+	RTMPEnableRxTx(pAd);
+	RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_START_UP);
 
-	// Init IRQ parameters
-	RT28XX_IRQ_INIT(pAd);
+	{
+		u32 reg = 0;
+		RTMP_IO_READ32(pAd, 0x1300, &reg);	/* clear garbage interrupts */
+		printk("0x1300 = %08x\n", reg);
+	}
 
-	// Various AP function init
+	{
+/*      u32 reg; */
+/*      u8  byte; */
+/*      u16 tmp; */
 
-	// Enable Interrupt
-	RT28XX_IRQ_ENABLE(pAd);
+/*      RTMP_IO_READ32(pAd, XIFS_TIME_CFG, &reg); */
 
-	// Now Enable RxTx
-	RTMPEnableRxTx(pAd);
-	RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_START_UP);
+/*      tmp = 0x0805; */
+/*      reg  = (reg & 0xffff0000) | tmp; */
+/*      RTMP_IO_WRITE32(pAd, XIFS_TIME_CFG, reg); */
 
-	{
-	UINT32 reg = 0;
-	RTMP_IO_READ32(pAd, 0x1300, &reg);  // clear garbage interrupts
-	printk("0x1300 = %08x\n", reg);
 	}
+#ifdef RTMP_MAC_PCI
+	RTMPInitPCIeLinkCtrlValue(pAd);
+#endif /* RTMP_MAC_PCI // */
 
-#ifdef RT2860
-        RTMPInitPCIeLinkCtrlValue(pAd);
-#endif
 	return (retval);
 
 err:
+/*+++Add by shiang, move from rt28xx_init() to here. */
+	RtmpOSIRQRelease(net_dev);
+/*---Add by shiang, move from rt28xx_init() to here. */
 	return (-1);
-} /* End of rt28xx_open */
+}				/* End of rt28xx_open */
 
 static const struct net_device_ops rt2860_netdev_ops = {
-	.ndo_open		= MainVirtualIF_open,
-	.ndo_stop		= MainVirtualIF_close,
-	.ndo_do_ioctl		= rt28xx_sta_ioctl,
-	.ndo_get_stats		= RT28xx_get_ether_stats,
-	.ndo_validate_addr	= NULL,
-	.ndo_set_mac_address	= eth_mac_addr,
-	.ndo_change_mtu		= eth_change_mtu,
-	.ndo_start_xmit		= rt28xx_send_packets,
+	.ndo_open = MainVirtualIF_open,
+	.ndo_stop = MainVirtualIF_close,
+	.ndo_do_ioctl = rt28xx_sta_ioctl,
+	.ndo_get_stats = RT28xx_get_ether_stats,
+	.ndo_validate_addr = NULL,
+	.ndo_set_mac_address = eth_mac_addr,
+	.ndo_change_mtu = eth_change_mtu,
+	.ndo_start_xmit = rt28xx_send_packets,
 };
 
-/* Must not be called for mdev and apdev */
-static NDIS_STATUS rt_ieee80211_if_setup(struct net_device *dev, PRTMP_ADAPTER pAd)
+struct net_device *RtmpPhyNetDevInit(struct rt_rtmp_adapter *pAd,
+			   struct rt_rtmp_os_netdev_op_hook *pNetDevHook)
 {
-	NDIS_STATUS Status;
-	INT     i=0;
-	CHAR    slot_name[IFNAMSIZ];
-	struct net_device   *device;
-
-	if (pAd->OpMode == OPMODE_STA)
-	{
-		dev->wireless_handlers = &rt28xx_iw_handler_def;
+	struct net_device *net_dev = NULL;
+/*      int             Status; */
+
+	net_dev =
+	    RtmpOSNetDevCreate(pAd, INT_MAIN, 0, sizeof(struct rt_rtmp_adapter *),
+			       INF_MAIN_DEV_NAME);
+	if (net_dev == NULL) {
+		printk
+		    ("RtmpPhyNetDevInit(): creation failed for main physical net device!\n");
+		return NULL;
 	}
 
-	dev->priv_flags = INT_MAIN;
-	dev->netdev_ops = &rt2860_netdev_ops;
-	// find available device name
-	for (i = 0; i < 8; i++)
-	{
-		sprintf(slot_name, "wlan%d", i);
+	NdisZeroMemory((unsigned char *)pNetDevHook,
+		       sizeof(struct rt_rtmp_os_netdev_op_hook));
+	pNetDevHook->netdev_ops = &rt2860_netdev_ops;
+	pNetDevHook->priv_flags = INT_MAIN;
+	pNetDevHook->needProtcted = FALSE;
 
-		device = dev_get_by_name(dev_net(dev), slot_name);
-		if (device != NULL)
-			dev_put(device);
-
-		if (device == NULL)
-			break;
-	}
-
-	if(i == 8)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("No available slot name\n"));
-		Status = NDIS_STATUS_FAILURE;
-	}
-	else
-	{
-		sprintf(dev->name, "wlan%d", i);
-		Status = NDIS_STATUS_SUCCESS;
-	}
-
-	return Status;
-
-}
-
-/*
-========================================================================
-Routine Description:
-    Probe RT28XX chipset.
-
-Arguments:
-    _dev_p				Point to the PCI or USB device
-	_dev_id_p			Point to the PCI or USB device ID
-
-Return Value:
-    0					Probe OK
-	-ENODEV				Probe Fail
-
-Note:
-========================================================================
-*/
-INT __devinit   rt28xx_probe(
-    IN  void *_dev_p,
-    IN  void *_dev_id_p,
-	IN  UINT argc,
-	OUT PRTMP_ADAPTER *ppAd)
-{
-    struct  net_device	*net_dev;
-    PRTMP_ADAPTER       pAd = (PRTMP_ADAPTER) NULL;
-    INT                 status;
-	PVOID				handle;
-#ifdef RT2860
-	struct pci_dev *dev_p = (struct pci_dev *)_dev_p;
-#endif
-#ifdef RT2870
-	struct usb_interface *intf = (struct usb_interface *)_dev_p;
-	struct usb_device *dev_p = interface_to_usbdev(intf);
-
-	dev_p = usb_get_dev(dev_p);
-#endif // RT2870 //
-
-    DBGPRINT(RT_DEBUG_TRACE, ("STA Driver version-%s\n", STA_DRIVER_VERSION));
-
-    net_dev = alloc_etherdev(sizeof(PRTMP_ADAPTER));
-    if (net_dev == NULL)
-    {
-        printk("alloc_netdev failed\n");
-
-        goto err_out;
-    }
+	net_dev->ml_priv = (void *)pAd;
+	pAd->net_dev = net_dev;
 
 	netif_stop_queue(net_dev);
 
-/* for supporting Network Manager */
-/* Set the sysfs physical device reference for the network logical device
- * if set prior to registration will cause a symlink during initialization.
- */
-    SET_NETDEV_DEV(net_dev, &(dev_p->dev));
-
-	// Allocate RTMP_ADAPTER miniport adapter structure
-	handle = kmalloc(sizeof(struct os_cookie), GFP_KERNEL);
-	if (handle == NULL)
-		goto err_out_free_netdev;;
-	RT28XX_HANDLE_DEV_ASSIGN(handle, dev_p);
-
-	status = RTMPAllocAdapterBlock(handle, &pAd);
-	if (status != NDIS_STATUS_SUCCESS)
-		goto err_out_free_netdev;
-
-	net_dev->ml_priv = (PVOID)pAd;
-    pAd->net_dev = net_dev; // must be before RT28XXNetDevInit()
-
-	RT28XXNetDevInit(_dev_p, net_dev, pAd);
-
-    pAd->StaCfg.OriDevType = net_dev->type;
-
-	// Post config
-	if (RT28XXProbePostConfig(_dev_p, pAd, 0) == FALSE)
-		goto err_out_unmap;
-
-	pAd->OpMode = OPMODE_STA;
-
-	// sample move
-	if (rt_ieee80211_if_setup(net_dev, pAd) != NDIS_STATUS_SUCCESS)
-		goto err_out_unmap;
-
-    // Register this device
-    status = register_netdev(net_dev);
-    if (status)
-        goto err_out_unmap;
-
-    // Set driver data
-	RT28XX_DRVDATA_SET(_dev_p);
-
-	*ppAd = pAd;
-    return 0; // probe ok
-
-
-	/* --------------------------- ERROR HANDLE --------------------------- */
-err_out_unmap:
-	RTMPFreeAdapter(pAd);
-	RT28XX_UNMAP();
-
-err_out_free_netdev:
-	free_netdev(net_dev);
-
-err_out:
-	RT28XX_PUT_DEVICE(dev_p);
-
-	return -ENODEV; /* probe fail */
-} /* End of rt28xx_probe */
+	return net_dev;
 
+}
 
 /*
 ========================================================================
@@ -849,36 +509,32 @@ Note:
 int rt28xx_packet_xmit(struct sk_buff *skb)
 {
 	struct net_device *net_dev = skb->dev;
-	PRTMP_ADAPTER pAd = net_dev->ml_priv;
+	struct rt_rtmp_adapter *pAd = NULL;
 	int status = NETDEV_TX_OK;
-	PNDIS_PACKET pPacket = (PNDIS_PACKET) skb;
+	void *pPacket = (void *)skb;
+
+	GET_PAD_FROM_NET_DEV(pAd, net_dev);
+
+	/* RT2870STA does this in RTMPSendPackets() */
 
 	{
-		// Drop send request since we are in monitor mode
-		if (MONITOR_ON(pAd))
-		{
+		/* Drop send request since we are in monitor mode */
+		if (MONITOR_ON(pAd)) {
 			RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_FAILURE);
 			goto done;
 		}
 	}
 
-        // EapolStart size is 18
-	if (skb->len < 14)
-	{
-		//printk("bad packet size: %d\n", pkt->len);
+	/* EapolStart size is 18 */
+	if (skb->len < 14) {
+		/*printk("bad packet size: %d\n", pkt->len); */
 		hex_dump("bad packet", skb->data, skb->len);
 		RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_FAILURE);
 		goto done;
 	}
 
 	RTMP_SET_PACKET_5VT(pPacket, 0);
-#ifdef CONFIG_5VT_ENHANCE
-    if (*(int*)(skb->cb) == BRIDGE_TAG) {
-		RTMP_SET_PACKET_5VT(pPacket, 1);
-    }
-#endif
-
-	STASendPackets((NDIS_HANDLE)pAd, (PPNDIS_PACKET) &pPacket, 1);
+	STASendPackets((void *)pAd, (void **)& pPacket, 1);
 
 	status = NETDEV_TX_OK;
 done:
@@ -886,7 +542,6 @@ done:
 	return status;
 }
 
-
 /*
 ========================================================================
 Routine Description:
@@ -903,72 +558,69 @@ Return Value:
 Note:
 ========================================================================
 */
-INT rt28xx_send_packets(
-	IN struct sk_buff 		*skb_p,
-	IN struct net_device 	*net_dev)
+static int rt28xx_send_packets(IN struct sk_buff *skb_p,
+			       IN struct net_device *net_dev)
 {
-    RTMP_ADAPTER *pAd = net_dev->ml_priv;
-	if (!(net_dev->flags & IFF_UP))
-	{
-		RELEASE_NDIS_PACKET(pAd, (PNDIS_PACKET)skb_p, NDIS_STATUS_FAILURE);
+	struct rt_rtmp_adapter *pAd = NULL;
+
+	GET_PAD_FROM_NET_DEV(pAd, net_dev);
+
+	if (!(net_dev->flags & IFF_UP)) {
+		RELEASE_NDIS_PACKET(pAd, (void *)skb_p,
+				    NDIS_STATUS_FAILURE);
 		return NETDEV_TX_OK;
 	}
 
-	NdisZeroMemory((PUCHAR)&skb_p->cb[CB_OFF], 15);
+	NdisZeroMemory((u8 *)& skb_p->cb[CB_OFF], 15);
 	RTMP_SET_PACKET_NET_DEVICE_MBSSID(skb_p, MAIN_MBSSID);
 
 	return rt28xx_packet_xmit(skb_p);
+}
 
-} /* End of MBSS_VirtualIF_PacketSend */
-
-
-
-
-void CfgInitHook(PRTMP_ADAPTER pAd)
-{
-	pAd->bBroadComHT = TRUE;
-} /* End of CfgInitHook */
-
-
-// This function will be called when query /proc
-struct iw_statistics *rt28xx_get_wireless_stats(
-    IN struct net_device *net_dev)
+/* This function will be called when query /proc */
+struct iw_statistics *rt28xx_get_wireless_stats(IN struct net_device *net_dev)
 {
-	PRTMP_ADAPTER pAd = net_dev->ml_priv;
+	struct rt_rtmp_adapter *pAd = NULL;
 
+	GET_PAD_FROM_NET_DEV(pAd, net_dev);
 
 	DBGPRINT(RT_DEBUG_TRACE, ("rt28xx_get_wireless_stats --->\n"));
 
-	pAd->iw_stats.status = 0; // Status - device dependent for now
+	pAd->iw_stats.status = 0;	/* Status - device dependent for now */
 
-	// link quality
-	pAd->iw_stats.qual.qual = ((pAd->Mlme.ChannelQuality * 12)/10 + 10);
-	if(pAd->iw_stats.qual.qual > 100)
+	/* link quality */
+	if (pAd->OpMode == OPMODE_STA)
+		pAd->iw_stats.qual.qual =
+		    ((pAd->Mlme.ChannelQuality * 12) / 10 + 10);
+
+	if (pAd->iw_stats.qual.qual > 100)
 		pAd->iw_stats.qual.qual = 100;
 
-	if (pAd->OpMode == OPMODE_STA)
-		pAd->iw_stats.qual.level = RTMPMaxRssi(pAd, pAd->StaCfg.RssiSample.LastRssi0, pAd->StaCfg.RssiSample.LastRssi1, pAd->StaCfg.RssiSample.LastRssi2);
+	if (pAd->OpMode == OPMODE_STA) {
+		pAd->iw_stats.qual.level =
+		    RTMPMaxRssi(pAd, pAd->StaCfg.RssiSample.LastRssi0,
+				pAd->StaCfg.RssiSample.LastRssi1,
+				pAd->StaCfg.RssiSample.LastRssi2);
+	}
 
-	pAd->iw_stats.qual.noise = pAd->BbpWriteLatch[66]; // noise level (dBm)
+	pAd->iw_stats.qual.noise = pAd->BbpWriteLatch[66];	/* noise level (dBm) */
 
 	pAd->iw_stats.qual.noise += 256 - 143;
-	pAd->iw_stats.qual.updated = 1;     // Flags to know if updated
+	pAd->iw_stats.qual.updated = 1;	/* Flags to know if updated */
 #ifdef IW_QUAL_DBM
-	pAd->iw_stats.qual.updated |= IW_QUAL_DBM;	// Level + Noise are dBm
-#endif // IW_QUAL_DBM //
+	pAd->iw_stats.qual.updated |= IW_QUAL_DBM;	/* Level + Noise are dBm */
+#endif /* IW_QUAL_DBM // */
 
-	pAd->iw_stats.discard.nwid = 0;     // Rx : Wrong nwid/essid
-	pAd->iw_stats.miss.beacon = 0;      // Missed beacons/superframe
+	pAd->iw_stats.discard.nwid = 0;	/* Rx : Wrong nwid/essid */
+	pAd->iw_stats.miss.beacon = 0;	/* Missed beacons/superframe */
 
 	DBGPRINT(RT_DEBUG_TRACE, ("<--- rt28xx_get_wireless_stats\n"));
 	return &pAd->iw_stats;
-} /* End of rt28xx_get_wireless_stats */
-
-
+}
 
 void tbtt_tasklet(unsigned long data)
 {
-#define MAX_TX_IN_TBTT		(16)
+/*#define MAX_TX_IN_TBTT                (16) */
 
 }
 
@@ -988,19 +640,20 @@ void tbtt_tasklet(unsigned long data)
 
     ========================================================================
 */
-struct net_device_stats *RT28xx_get_ether_stats(
-    IN  struct net_device *net_dev)
+static struct net_device_stats *RT28xx_get_ether_stats(IN struct net_device
+						       *net_dev)
 {
-    RTMP_ADAPTER *pAd = NULL;
+	struct rt_rtmp_adapter *pAd = NULL;
 
 	if (net_dev)
-		pAd = net_dev->ml_priv;
+		GET_PAD_FROM_NET_DEV(pAd, net_dev);
 
-	if (pAd)
-	{
+	if (pAd) {
 
-		pAd->stats.rx_packets = pAd->WlanCounters.ReceivedFragmentCount.QuadPart;
-		pAd->stats.tx_packets = pAd->WlanCounters.TransmittedFragmentCount.QuadPart;
+		pAd->stats.rx_packets =
+		    pAd->WlanCounters.ReceivedFragmentCount.QuadPart;
+		pAd->stats.tx_packets =
+		    pAd->WlanCounters.TransmittedFragmentCount.QuadPart;
 
 		pAd->stats.rx_bytes = pAd->RalinkCounters.ReceivedByteCount;
 		pAd->stats.tx_bytes = pAd->RalinkCounters.TransmittedByteCount;
@@ -1011,30 +664,73 @@ struct net_device_stats *RT28xx_get_ether_stats(
 		pAd->stats.rx_dropped = 0;
 		pAd->stats.tx_dropped = 0;
 
-	    pAd->stats.multicast = pAd->WlanCounters.MulticastReceivedFrameCount.QuadPart;   // multicast packets received
-	    pAd->stats.collisions = pAd->Counters8023.OneCollision + pAd->Counters8023.MoreCollisions;  // Collision packets
+		pAd->stats.multicast = pAd->WlanCounters.MulticastReceivedFrameCount.QuadPart;	/* multicast packets received */
+		pAd->stats.collisions = pAd->Counters8023.OneCollision + pAd->Counters8023.MoreCollisions;	/* Collision packets */
 
-	    pAd->stats.rx_length_errors = 0;
-	    pAd->stats.rx_over_errors = pAd->Counters8023.RxNoBuffer;                   // receiver ring buff overflow
-	    pAd->stats.rx_crc_errors = 0;//pAd->WlanCounters.FCSErrorCount;     // recved pkt with crc error
-	    pAd->stats.rx_frame_errors = pAd->Counters8023.RcvAlignmentErrors;          // recv'd frame alignment error
-	    pAd->stats.rx_fifo_errors = pAd->Counters8023.RxNoBuffer;                   // recv'r fifo overrun
-	    pAd->stats.rx_missed_errors = 0;                                            // receiver missed packet
+		pAd->stats.rx_length_errors = 0;
+		pAd->stats.rx_over_errors = pAd->Counters8023.RxNoBuffer;	/* receiver ring buff overflow */
+		pAd->stats.rx_crc_errors = 0;	/*pAd->WlanCounters.FCSErrorCount;     // recved pkt with crc error */
+		pAd->stats.rx_frame_errors = pAd->Counters8023.RcvAlignmentErrors;	/* recv'd frame alignment error */
+		pAd->stats.rx_fifo_errors = pAd->Counters8023.RxNoBuffer;	/* recv'r fifo overrun */
+		pAd->stats.rx_missed_errors = 0;	/* receiver missed packet */
 
-	    // detailed tx_errors
-	    pAd->stats.tx_aborted_errors = 0;
-	    pAd->stats.tx_carrier_errors = 0;
-	    pAd->stats.tx_fifo_errors = 0;
-	    pAd->stats.tx_heartbeat_errors = 0;
-	    pAd->stats.tx_window_errors = 0;
+		/* detailed tx_errors */
+		pAd->stats.tx_aborted_errors = 0;
+		pAd->stats.tx_carrier_errors = 0;
+		pAd->stats.tx_fifo_errors = 0;
+		pAd->stats.tx_heartbeat_errors = 0;
+		pAd->stats.tx_window_errors = 0;
 
-	    // for cslip etc
-	    pAd->stats.rx_compressed = 0;
-	    pAd->stats.tx_compressed = 0;
+		/* for cslip etc */
+		pAd->stats.rx_compressed = 0;
+		pAd->stats.tx_compressed = 0;
 
 		return &pAd->stats;
+	} else
+		return NULL;
+}
+
+BOOLEAN RtmpPhyNetDevExit(struct rt_rtmp_adapter *pAd, struct net_device *net_dev)
+{
+
+	/* Unregister network device */
+	if (net_dev != NULL) {
+		printk
+		    ("RtmpOSNetDevDetach(): RtmpOSNetDeviceDetach(), dev->name=%s!\n",
+		     net_dev->name);
+		RtmpOSNetDevDetach(net_dev);
 	}
-	else
-    	return NULL;
+
+	return TRUE;
+
 }
 
+/*
+========================================================================
+Routine Description:
+    Allocate memory for adapter control block.
+
+Arguments:
+    pAd					Pointer to our adapter
+
+Return Value:
+	NDIS_STATUS_SUCCESS
+	NDIS_STATUS_FAILURE
+	NDIS_STATUS_RESOURCES
+
+Note:
+========================================================================
+*/
+int AdapterBlockAllocateMemory(void *handle, void ** ppAd)
+{
+
+	*ppAd = (void *)vmalloc(sizeof(struct rt_rtmp_adapter));	/*pci_alloc_consistent(pci_dev, sizeof(struct rt_rtmp_adapter), phy_addr); */
+
+	if (*ppAd) {
+		NdisZeroMemory(*ppAd, sizeof(struct rt_rtmp_adapter));
+		((struct rt_rtmp_adapter *)* ppAd)->OS_Cookie = handle;
+		return (NDIS_STATUS_SUCCESS);
+	} else {
+		return (NDIS_STATUS_FAILURE);
+	}
+}
diff --git a/drivers/staging/rt2860/rt_pci_rbus.c b/drivers/staging/rt2860/rt_pci_rbus.c
new file mode 100644
index 000000000000..e0a0aeeb17a2
--- /dev/null
+++ b/drivers/staging/rt2860/rt_pci_rbus.c
@@ -0,0 +1,840 @@
+/*
+ *************************************************************************
+ * Ralink Tech Inc.
+ * 5F., No.36, Taiyuan St., Jhubei City,
+ * Hsinchu County 302,
+ * Taiwan, R.O.C.
+ *
+ * (c) Copyright 2002-2007, Ralink Technology, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify  *
+ * it under the terms of the GNU General Public License as published by  *
+ * the Free Software Foundation; either version 2 of the License, or     *
+ * (at your option) any later version.                                   *
+ *                                                                       *
+ * This program is distributed in the hope that it will be useful,       *
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
+ * GNU General Public License for more details.                          *
+ *                                                                       *
+ * You should have received a copy of the GNU General Public License     *
+ * along with this program; if not, write to the                         *
+ * Free Software Foundation, Inc.,                                       *
+ * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
+ *                                                                       *
+ *************************************************************************
+
+    Module Name:
+    rt_pci_rbus.c
+
+    Abstract:
+    Create and register network interface.
+
+    Revision History:
+    Who         When            What
+    --------    ----------      ----------------------------------------------
+*/
+
+#include "rt_config.h"
+#include <linux/pci.h>
+
+IRQ_HANDLE_TYPE rt2860_interrupt(int irq, void *dev_instance);
+
+static void rx_done_tasklet(unsigned long data);
+static void mgmt_dma_done_tasklet(unsigned long data);
+static void ac0_dma_done_tasklet(unsigned long data);
+static void ac1_dma_done_tasklet(unsigned long data);
+static void ac2_dma_done_tasklet(unsigned long data);
+static void ac3_dma_done_tasklet(unsigned long data);
+static void fifo_statistic_full_tasklet(unsigned long data);
+
+/*---------------------------------------------------------------------*/
+/* Symbol & Macro Definitions                                          */
+/*---------------------------------------------------------------------*/
+#define RT2860_INT_RX_DLY				(1<<0)	/* bit 0 */
+#define RT2860_INT_TX_DLY				(1<<1)	/* bit 1 */
+#define RT2860_INT_RX_DONE				(1<<2)	/* bit 2 */
+#define RT2860_INT_AC0_DMA_DONE			(1<<3)	/* bit 3 */
+#define RT2860_INT_AC1_DMA_DONE			(1<<4)	/* bit 4 */
+#define RT2860_INT_AC2_DMA_DONE			(1<<5)	/* bit 5 */
+#define RT2860_INT_AC3_DMA_DONE			(1<<6)	/* bit 6 */
+#define RT2860_INT_HCCA_DMA_DONE		(1<<7)	/* bit 7 */
+#define RT2860_INT_MGMT_DONE			(1<<8)	/* bit 8 */
+
+#define INT_RX			RT2860_INT_RX_DONE
+
+#define INT_AC0_DLY		(RT2860_INT_AC0_DMA_DONE)	/*| RT2860_INT_TX_DLY) */
+#define INT_AC1_DLY		(RT2860_INT_AC1_DMA_DONE)	/*| RT2860_INT_TX_DLY) */
+#define INT_AC2_DLY		(RT2860_INT_AC2_DMA_DONE)	/*| RT2860_INT_TX_DLY) */
+#define INT_AC3_DLY		(RT2860_INT_AC3_DMA_DONE)	/*| RT2860_INT_TX_DLY) */
+#define INT_HCCA_DLY	(RT2860_INT_HCCA_DMA_DONE)	/*| RT2860_INT_TX_DLY) */
+#define INT_MGMT_DLY	RT2860_INT_MGMT_DONE
+
+/***************************************************************************
+  *
+  *	Interface-depended memory allocation/Free related procedures.
+  *		Mainly for Hardware TxDesc/RxDesc/MgmtDesc, DMA Memory for TxData/RxData, etc.,
+  *
+  **************************************************************************/
+/* Function for TxDesc Memory allocation. */
+void RTMP_AllocateTxDescMemory(struct rt_rtmp_adapter *pAd,
+			       u32 Index,
+			       unsigned long Length,
+			       IN BOOLEAN Cached,
+			       void ** VirtualAddress,
+			       dma_addr_t *PhysicalAddress)
+{
+	struct os_cookie *pObj = (struct os_cookie *)pAd->OS_Cookie;
+
+	*VirtualAddress =
+	    (void *)pci_alloc_consistent(pObj->pci_dev, sizeof(char) * Length,
+					 PhysicalAddress);
+
+}
+
+/* Function for MgmtDesc Memory allocation. */
+void RTMP_AllocateMgmtDescMemory(struct rt_rtmp_adapter *pAd,
+				 unsigned long Length,
+				 IN BOOLEAN Cached,
+				 void ** VirtualAddress,
+				 dma_addr_t *PhysicalAddress)
+{
+	struct os_cookie *pObj = (struct os_cookie *)pAd->OS_Cookie;
+
+	*VirtualAddress =
+	    (void *)pci_alloc_consistent(pObj->pci_dev, sizeof(char) * Length,
+					 PhysicalAddress);
+
+}
+
+/* Function for RxDesc Memory allocation. */
+void RTMP_AllocateRxDescMemory(struct rt_rtmp_adapter *pAd,
+			       unsigned long Length,
+			       IN BOOLEAN Cached,
+			       void ** VirtualAddress,
+			       dma_addr_t *PhysicalAddress)
+{
+	struct os_cookie *pObj = (struct os_cookie *)pAd->OS_Cookie;
+
+	*VirtualAddress =
+	    (void *)pci_alloc_consistent(pObj->pci_dev, sizeof(char) * Length,
+					 PhysicalAddress);
+
+}
+
+/* Function for free allocated Desc Memory. */
+void RTMP_FreeDescMemory(struct rt_rtmp_adapter *pAd,
+			 unsigned long Length,
+			 void *VirtualAddress,
+			 dma_addr_t PhysicalAddress)
+{
+	struct os_cookie *pObj = (struct os_cookie *)pAd->OS_Cookie;
+
+	pci_free_consistent(pObj->pci_dev, Length, VirtualAddress,
+			    PhysicalAddress);
+}
+
+/* Function for TxData DMA Memory allocation. */
+void RTMP_AllocateFirstTxBuffer(struct rt_rtmp_adapter *pAd,
+				u32 Index,
+				unsigned long Length,
+				IN BOOLEAN Cached,
+				void ** VirtualAddress,
+				dma_addr_t *PhysicalAddress)
+{
+	struct os_cookie *pObj = (struct os_cookie *)pAd->OS_Cookie;
+
+	*VirtualAddress =
+	    (void *)pci_alloc_consistent(pObj->pci_dev, sizeof(char) * Length,
+					 PhysicalAddress);
+}
+
+void RTMP_FreeFirstTxBuffer(struct rt_rtmp_adapter *pAd,
+			    unsigned long Length,
+			    IN BOOLEAN Cached,
+			    void *VirtualAddress,
+			    dma_addr_t PhysicalAddress)
+{
+	struct os_cookie *pObj = (struct os_cookie *)pAd->OS_Cookie;
+
+	pci_free_consistent(pObj->pci_dev, Length, VirtualAddress,
+			    PhysicalAddress);
+}
+
+/*
+ * FUNCTION: Allocate a common buffer for DMA
+ * ARGUMENTS:
+ *     AdapterHandle:  AdapterHandle
+ *     Length:  Number of bytes to allocate
+ *     Cached:  Whether or not the memory can be cached
+ *     VirtualAddress:  Pointer to memory is returned here
+ *     PhysicalAddress:  Physical address corresponding to virtual address
+ */
+void RTMP_AllocateSharedMemory(struct rt_rtmp_adapter *pAd,
+			       unsigned long Length,
+			       IN BOOLEAN Cached,
+			       void ** VirtualAddress,
+			       dma_addr_t *PhysicalAddress)
+{
+	struct os_cookie *pObj = (struct os_cookie *)pAd->OS_Cookie;
+
+	*VirtualAddress =
+	    (void *)pci_alloc_consistent(pObj->pci_dev, sizeof(char) * Length,
+					 PhysicalAddress);
+}
+
+/*
+ * FUNCTION: Allocate a packet buffer for DMA
+ * ARGUMENTS:
+ *     AdapterHandle:  AdapterHandle
+ *     Length:  Number of bytes to allocate
+ *     Cached:  Whether or not the memory can be cached
+ *     VirtualAddress:  Pointer to memory is returned here
+ *     PhysicalAddress:  Physical address corresponding to virtual address
+ * Notes:
+ *     Cached is ignored: always cached memory
+ */
+void *RTMP_AllocateRxPacketBuffer(struct rt_rtmp_adapter *pAd,
+					 unsigned long Length,
+					 IN BOOLEAN Cached,
+					 void ** VirtualAddress,
+					 OUT dma_addr_t *
+					 PhysicalAddress)
+{
+	struct sk_buff *pkt;
+
+	pkt = dev_alloc_skb(Length);
+
+	if (pkt == NULL) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("can't allocate rx %ld size packet\n", Length));
+	}
+
+	if (pkt) {
+		RTMP_SET_PACKET_SOURCE(OSPKT_TO_RTPKT(pkt), PKTSRC_NDIS);
+		*VirtualAddress = (void *)pkt->data;
+		*PhysicalAddress =
+		    PCI_MAP_SINGLE(pAd, *VirtualAddress, Length, -1,
+				   PCI_DMA_FROMDEVICE);
+	} else {
+		*VirtualAddress = (void *)NULL;
+		*PhysicalAddress = (dma_addr_t)NULL;
+	}
+
+	return (void *)pkt;
+}
+
+void Invalid_Remaining_Packet(struct rt_rtmp_adapter *pAd, unsigned long VirtualAddress)
+{
+	dma_addr_t PhysicalAddress;
+
+	PhysicalAddress =
+	    PCI_MAP_SINGLE(pAd, (void *)(VirtualAddress + 1600),
+			   RX_BUFFER_NORMSIZE - 1600, -1, PCI_DMA_FROMDEVICE);
+}
+
+int RtmpNetTaskInit(struct rt_rtmp_adapter *pAd)
+{
+	struct os_cookie *pObj;
+
+	pObj = (struct os_cookie *)pAd->OS_Cookie;
+
+	tasklet_init(&pObj->rx_done_task, rx_done_tasklet, (unsigned long)pAd);
+	tasklet_init(&pObj->mgmt_dma_done_task, mgmt_dma_done_tasklet,
+		     (unsigned long)pAd);
+	tasklet_init(&pObj->ac0_dma_done_task, ac0_dma_done_tasklet,
+		     (unsigned long)pAd);
+	tasklet_init(&pObj->ac1_dma_done_task, ac1_dma_done_tasklet,
+		     (unsigned long)pAd);
+	tasklet_init(&pObj->ac2_dma_done_task, ac2_dma_done_tasklet,
+		     (unsigned long)pAd);
+	tasklet_init(&pObj->ac3_dma_done_task, ac3_dma_done_tasklet,
+		     (unsigned long)pAd);
+	tasklet_init(&pObj->tbtt_task, tbtt_tasklet, (unsigned long)pAd);
+	tasklet_init(&pObj->fifo_statistic_full_task,
+		     fifo_statistic_full_tasklet, (unsigned long)pAd);
+
+	return NDIS_STATUS_SUCCESS;
+}
+
+void RtmpNetTaskExit(struct rt_rtmp_adapter *pAd)
+{
+	struct os_cookie *pObj;
+
+	pObj = (struct os_cookie *)pAd->OS_Cookie;
+
+	tasklet_kill(&pObj->rx_done_task);
+	tasklet_kill(&pObj->mgmt_dma_done_task);
+	tasklet_kill(&pObj->ac0_dma_done_task);
+	tasklet_kill(&pObj->ac1_dma_done_task);
+	tasklet_kill(&pObj->ac2_dma_done_task);
+	tasklet_kill(&pObj->ac3_dma_done_task);
+	tasklet_kill(&pObj->tbtt_task);
+	tasklet_kill(&pObj->fifo_statistic_full_task);
+}
+
+int RtmpMgmtTaskInit(struct rt_rtmp_adapter *pAd)
+{
+
+	return NDIS_STATUS_SUCCESS;
+}
+
+/*
+========================================================================
+Routine Description:
+    Close kernel threads.
+
+Arguments:
+	*pAd				the raxx interface data pointer
+
+Return Value:
+    NONE
+
+Note:
+========================================================================
+*/
+void RtmpMgmtTaskExit(struct rt_rtmp_adapter *pAd)
+{
+
+	return;
+}
+
+static inline void rt2860_int_enable(struct rt_rtmp_adapter *pAd, unsigned int mode)
+{
+	u32 regValue;
+
+	pAd->int_disable_mask &= ~(mode);
+	regValue = pAd->int_enable_reg & ~(pAd->int_disable_mask);
+	/*if (!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE)) */
+	{
+		RTMP_IO_WRITE32(pAd, INT_MASK_CSR, regValue);	/* 1:enable */
+	}
+	/*else */
+	/*      DBGPRINT(RT_DEBUG_TRACE, ("fOP_STATUS_DOZE !\n")); */
+
+	if (regValue != 0)
+		RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_INTERRUPT_ACTIVE);
+}
+
+static inline void rt2860_int_disable(struct rt_rtmp_adapter *pAd, unsigned int mode)
+{
+	u32 regValue;
+
+	pAd->int_disable_mask |= mode;
+	regValue = pAd->int_enable_reg & ~(pAd->int_disable_mask);
+	RTMP_IO_WRITE32(pAd, INT_MASK_CSR, regValue);	/* 0: disable */
+
+	if (regValue == 0) {
+		RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_INTERRUPT_ACTIVE);
+	}
+}
+
+/***************************************************************************
+  *
+  *	tasklet related procedures.
+  *
+  **************************************************************************/
+static void mgmt_dma_done_tasklet(unsigned long data)
+{
+	unsigned long flags;
+	struct rt_rtmp_adapter *pAd = (struct rt_rtmp_adapter *)data;
+	INT_SOURCE_CSR_STRUC IntSource;
+	struct os_cookie *pObj;
+
+	/* Do nothing if the driver is starting halt state. */
+	/* This might happen when timer already been fired before cancel timer with mlmehalt */
+	if (RTMP_TEST_FLAG
+	    (pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
+		return;
+
+	pObj = (struct os_cookie *)pAd->OS_Cookie;
+
+/*      printk("mgmt_dma_done_process\n"); */
+	IntSource.word = 0;
+	IntSource.field.MgmtDmaDone = 1;
+	pAd->int_pending &= ~INT_MGMT_DLY;
+
+	RTMPHandleMgmtRingDmaDoneInterrupt(pAd);
+
+	/* if you use RTMP_SEM_LOCK, sometimes kernel will hang up, no any */
+	/* bug report output */
+	RTMP_INT_LOCK(&pAd->irq_lock, flags);
+	/*
+	 * double check to avoid lose of interrupts
+	 */
+	if (pAd->int_pending & INT_MGMT_DLY) {
+		tasklet_hi_schedule(&pObj->mgmt_dma_done_task);
+		RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
+		return;
+	}
+
+	/* enable TxDataInt again */
+	rt2860_int_enable(pAd, INT_MGMT_DLY);
+	RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
+}
+
+static void rx_done_tasklet(unsigned long data)
+{
+	unsigned long flags;
+	struct rt_rtmp_adapter *pAd = (struct rt_rtmp_adapter *)data;
+	BOOLEAN bReschedule = 0;
+	struct os_cookie *pObj;
+
+	/* Do nothing if the driver is starting halt state. */
+	/* This might happen when timer already been fired before cancel timer with mlmehalt */
+	if (RTMP_TEST_FLAG
+	    (pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
+		return;
+
+	pObj = (struct os_cookie *)pAd->OS_Cookie;
+
+	pAd->int_pending &= ~(INT_RX);
+	bReschedule = STARxDoneInterruptHandle(pAd, 0);
+
+	RTMP_INT_LOCK(&pAd->irq_lock, flags);
+	/*
+	 * double check to avoid rotting packet
+	 */
+	if (pAd->int_pending & INT_RX || bReschedule) {
+		tasklet_hi_schedule(&pObj->rx_done_task);
+		RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
+		return;
+	}
+
+	/* enable Rxint again */
+	rt2860_int_enable(pAd, INT_RX);
+	RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
+
+}
+
+void fifo_statistic_full_tasklet(unsigned long data)
+{
+	unsigned long flags;
+	struct rt_rtmp_adapter *pAd = (struct rt_rtmp_adapter *)data;
+	struct os_cookie *pObj;
+
+	/* Do nothing if the driver is starting halt state. */
+	/* This might happen when timer already been fired before cancel timer with mlmehalt */
+	if (RTMP_TEST_FLAG
+	    (pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
+		return;
+
+	pObj = (struct os_cookie *)pAd->OS_Cookie;
+
+	pAd->int_pending &= ~(FifoStaFullInt);
+	NICUpdateFifoStaCounters(pAd);
+
+	RTMP_INT_LOCK(&pAd->irq_lock, flags);
+	/*
+	 * double check to avoid rotting packet
+	 */
+	if (pAd->int_pending & FifoStaFullInt) {
+		tasklet_hi_schedule(&pObj->fifo_statistic_full_task);
+		RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
+		return;
+	}
+
+	/* enable Rxint again */
+
+	rt2860_int_enable(pAd, FifoStaFullInt);
+	RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
+
+}
+
+static void ac3_dma_done_tasklet(unsigned long data)
+{
+	unsigned long flags;
+	struct rt_rtmp_adapter *pAd = (struct rt_rtmp_adapter *)data;
+	INT_SOURCE_CSR_STRUC IntSource;
+	struct os_cookie *pObj;
+	BOOLEAN bReschedule = 0;
+
+	/* Do nothing if the driver is starting halt state. */
+	/* This might happen when timer already been fired before cancel timer with mlmehalt */
+	if (RTMP_TEST_FLAG
+	    (pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
+		return;
+
+	pObj = (struct os_cookie *)pAd->OS_Cookie;
+
+/*      printk("ac0_dma_done_process\n"); */
+	IntSource.word = 0;
+	IntSource.field.Ac3DmaDone = 1;
+	pAd->int_pending &= ~INT_AC3_DLY;
+
+	bReschedule = RTMPHandleTxRingDmaDoneInterrupt(pAd, IntSource);
+
+	RTMP_INT_LOCK(&pAd->irq_lock, flags);
+	/*
+	 * double check to avoid lose of interrupts
+	 */
+	if ((pAd->int_pending & INT_AC3_DLY) || bReschedule) {
+		tasklet_hi_schedule(&pObj->ac3_dma_done_task);
+		RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
+		return;
+	}
+
+	/* enable TxDataInt again */
+	rt2860_int_enable(pAd, INT_AC3_DLY);
+	RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
+}
+
+static void ac2_dma_done_tasklet(unsigned long data)
+{
+	unsigned long flags;
+	struct rt_rtmp_adapter *pAd = (struct rt_rtmp_adapter *)data;
+	INT_SOURCE_CSR_STRUC IntSource;
+	struct os_cookie *pObj;
+	BOOLEAN bReschedule = 0;
+
+	/* Do nothing if the driver is starting halt state. */
+	/* This might happen when timer already been fired before cancel timer with mlmehalt */
+	if (RTMP_TEST_FLAG
+	    (pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
+		return;
+
+	pObj = (struct os_cookie *)pAd->OS_Cookie;
+
+	IntSource.word = 0;
+	IntSource.field.Ac2DmaDone = 1;
+	pAd->int_pending &= ~INT_AC2_DLY;
+
+	bReschedule = RTMPHandleTxRingDmaDoneInterrupt(pAd, IntSource);
+
+	RTMP_INT_LOCK(&pAd->irq_lock, flags);
+
+	/*
+	 * double check to avoid lose of interrupts
+	 */
+	if ((pAd->int_pending & INT_AC2_DLY) || bReschedule) {
+		tasklet_hi_schedule(&pObj->ac2_dma_done_task);
+		RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
+		return;
+	}
+
+	/* enable TxDataInt again */
+	rt2860_int_enable(pAd, INT_AC2_DLY);
+	RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
+}
+
+static void ac1_dma_done_tasklet(unsigned long data)
+{
+	unsigned long flags;
+	struct rt_rtmp_adapter *pAd = (struct rt_rtmp_adapter *)data;
+	INT_SOURCE_CSR_STRUC IntSource;
+	struct os_cookie *pObj;
+	BOOLEAN bReschedule = 0;
+
+	/* Do nothing if the driver is starting halt state. */
+	/* This might happen when timer already been fired before cancel timer with mlmehalt */
+	if (RTMP_TEST_FLAG
+	    (pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
+		return;
+
+	pObj = (struct os_cookie *)pAd->OS_Cookie;
+
+/*      printk("ac0_dma_done_process\n"); */
+	IntSource.word = 0;
+	IntSource.field.Ac1DmaDone = 1;
+	pAd->int_pending &= ~INT_AC1_DLY;
+
+	bReschedule = RTMPHandleTxRingDmaDoneInterrupt(pAd, IntSource);
+
+	RTMP_INT_LOCK(&pAd->irq_lock, flags);
+	/*
+	 * double check to avoid lose of interrupts
+	 */
+	if ((pAd->int_pending & INT_AC1_DLY) || bReschedule) {
+		tasklet_hi_schedule(&pObj->ac1_dma_done_task);
+		RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
+		return;
+	}
+
+	/* enable TxDataInt again */
+	rt2860_int_enable(pAd, INT_AC1_DLY);
+	RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
+}
+
+static void ac0_dma_done_tasklet(unsigned long data)
+{
+	unsigned long flags;
+	struct rt_rtmp_adapter *pAd = (struct rt_rtmp_adapter *)data;
+	INT_SOURCE_CSR_STRUC IntSource;
+	struct os_cookie *pObj;
+	BOOLEAN bReschedule = 0;
+
+	/* Do nothing if the driver is starting halt state. */
+	/* This might happen when timer already been fired before cancel timer with mlmehalt */
+	if (RTMP_TEST_FLAG
+	    (pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
+		return;
+
+	pObj = (struct os_cookie *)pAd->OS_Cookie;
+
+/*      printk("ac0_dma_done_process\n"); */
+	IntSource.word = 0;
+	IntSource.field.Ac0DmaDone = 1;
+	pAd->int_pending &= ~INT_AC0_DLY;
+
+/*      RTMPHandleMgmtRingDmaDoneInterrupt(pAd); */
+	bReschedule = RTMPHandleTxRingDmaDoneInterrupt(pAd, IntSource);
+
+	RTMP_INT_LOCK(&pAd->irq_lock, flags);
+	/*
+	 * double check to avoid lose of interrupts
+	 */
+	if ((pAd->int_pending & INT_AC0_DLY) || bReschedule) {
+		tasklet_hi_schedule(&pObj->ac0_dma_done_task);
+		RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
+		return;
+	}
+
+	/* enable TxDataInt again */
+	rt2860_int_enable(pAd, INT_AC0_DLY);
+	RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
+}
+
+/***************************************************************************
+  *
+  *	interrupt handler related procedures.
+  *
+  **************************************************************************/
+int print_int_count;
+
+IRQ_HANDLE_TYPE rt2860_interrupt(int irq, void *dev_instance)
+{
+	struct net_device *net_dev = (struct net_device *)dev_instance;
+	struct rt_rtmp_adapter *pAd = NULL;
+	INT_SOURCE_CSR_STRUC IntSource;
+	struct os_cookie *pObj;
+
+	GET_PAD_FROM_NET_DEV(pAd, net_dev);
+
+	pObj = (struct os_cookie *)pAd->OS_Cookie;
+
+	/* Note 03312008: we can not return here before
+	   RTMP_IO_READ32(pAd, INT_SOURCE_CSR, &IntSource.word);
+	   RTMP_IO_WRITE32(pAd, INT_SOURCE_CSR, IntSource.word);
+	   Or kernel will panic after ifconfig ra0 down sometimes */
+
+	/* */
+	/* Inital the Interrupt source. */
+	/* */
+	IntSource.word = 0x00000000L;
+/*      McuIntSource.word = 0x00000000L; */
+
+	/* */
+	/* Get the interrupt sources & saved to local variable */
+	/* */
+	/*RTMP_IO_READ32(pAd, where, &McuIntSource.word); */
+	/*RTMP_IO_WRITE32(pAd, , McuIntSource.word); */
+
+	/* */
+	/* Flag fOP_STATUS_DOZE On, means ASIC put to sleep, elase means ASICK WakeUp */
+	/* And at the same time, clock maybe turned off that say there is no DMA service. */
+	/* when ASIC get to sleep. */
+	/* To prevent system hang on power saving. */
+	/* We need to check it before handle the INT_SOURCE_CSR, ASIC must be wake up. */
+	/* */
+	/* RT2661 => when ASIC is sleeping, MAC register cannot be read and written. */
+	/* RT2860 => when ASIC is sleeping, MAC register can be read and written. */
+/*      if (!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE)) */
+	{
+		RTMP_IO_READ32(pAd, INT_SOURCE_CSR, &IntSource.word);
+		RTMP_IO_WRITE32(pAd, INT_SOURCE_CSR, IntSource.word);	/* write 1 to clear */
+	}
+/*      else */
+/*              DBGPRINT(RT_DEBUG_TRACE, (">>>fOP_STATUS_DOZE<<<\n")); */
+
+/*      RTMP_IO_READ32(pAd, INT_SOURCE_CSR, &IsrAfterClear); */
+/*      RTMP_IO_READ32(pAd, MCU_INT_SOURCE_CSR, &McuIsrAfterClear); */
+/*      DBGPRINT(RT_DEBUG_INFO, ("====> RTMPHandleInterrupt(ISR=%08x,Mcu ISR=%08x, After clear ISR=%08x, MCU ISR=%08x)\n", */
+/*                      IntSource.word, McuIntSource.word, IsrAfterClear, McuIsrAfterClear)); */
+
+	/* Do nothing if Reset in progress */
+	if (RTMP_TEST_FLAG
+	    (pAd,
+	     (fRTMP_ADAPTER_RESET_IN_PROGRESS |
+	      fRTMP_ADAPTER_HALT_IN_PROGRESS))) {
+		return IRQ_HANDLED;
+	}
+	/* */
+	/* Handle interrupt, walk through all bits */
+	/* Should start from highest priority interrupt */
+	/* The priority can be adjust by altering processing if statement */
+	/* */
+
+#ifdef DBG
+
+#endif
+
+	pAd->bPCIclkOff = FALSE;
+
+	/* If required spinlock, each interrupt service routine has to acquire */
+	/* and release itself. */
+	/* */
+
+	/* Do nothing if NIC doesn't exist */
+	if (IntSource.word == 0xffffffff) {
+		RTMP_SET_FLAG(pAd,
+			      (fRTMP_ADAPTER_NIC_NOT_EXIST |
+			       fRTMP_ADAPTER_HALT_IN_PROGRESS));
+		return IRQ_HANDLED;
+	}
+
+	if (IntSource.word & TxCoherent) {
+		DBGPRINT(RT_DEBUG_ERROR, (">>>TxCoherent<<<\n"));
+		RTMPHandleRxCoherentInterrupt(pAd);
+	}
+
+	if (IntSource.word & RxCoherent) {
+		DBGPRINT(RT_DEBUG_ERROR, (">>>RxCoherent<<<\n"));
+		RTMPHandleRxCoherentInterrupt(pAd);
+	}
+
+	if (IntSource.word & FifoStaFullInt) {
+		if ((pAd->int_disable_mask & FifoStaFullInt) == 0) {
+			/* mask FifoStaFullInt */
+			rt2860_int_disable(pAd, FifoStaFullInt);
+			tasklet_hi_schedule(&pObj->fifo_statistic_full_task);
+		}
+		pAd->int_pending |= FifoStaFullInt;
+	}
+
+	if (IntSource.word & INT_MGMT_DLY) {
+		if ((pAd->int_disable_mask & INT_MGMT_DLY) == 0) {
+			rt2860_int_disable(pAd, INT_MGMT_DLY);
+			tasklet_hi_schedule(&pObj->mgmt_dma_done_task);
+		}
+		pAd->int_pending |= INT_MGMT_DLY;
+	}
+
+	if (IntSource.word & INT_RX) {
+		if ((pAd->int_disable_mask & INT_RX) == 0) {
+
+			/* mask Rxint */
+			rt2860_int_disable(pAd, INT_RX);
+			tasklet_hi_schedule(&pObj->rx_done_task);
+		}
+		pAd->int_pending |= INT_RX;
+	}
+
+	if (IntSource.word & INT_AC3_DLY) {
+
+		if ((pAd->int_disable_mask & INT_AC3_DLY) == 0) {
+			/* mask TxDataInt */
+			rt2860_int_disable(pAd, INT_AC3_DLY);
+			tasklet_hi_schedule(&pObj->ac3_dma_done_task);
+		}
+		pAd->int_pending |= INT_AC3_DLY;
+	}
+
+	if (IntSource.word & INT_AC2_DLY) {
+
+		if ((pAd->int_disable_mask & INT_AC2_DLY) == 0) {
+			/* mask TxDataInt */
+			rt2860_int_disable(pAd, INT_AC2_DLY);
+			tasklet_hi_schedule(&pObj->ac2_dma_done_task);
+		}
+		pAd->int_pending |= INT_AC2_DLY;
+	}
+
+	if (IntSource.word & INT_AC1_DLY) {
+
+		pAd->int_pending |= INT_AC1_DLY;
+
+		if ((pAd->int_disable_mask & INT_AC1_DLY) == 0) {
+			/* mask TxDataInt */
+			rt2860_int_disable(pAd, INT_AC1_DLY);
+			tasklet_hi_schedule(&pObj->ac1_dma_done_task);
+		}
+
+	}
+
+	if (IntSource.word & INT_AC0_DLY) {
+
+/*
+		if (IntSource.word & 0x2) {
+			u32 reg;
+			RTMP_IO_READ32(pAd, DELAY_INT_CFG, &reg);
+			printk("IntSource.word = %08x, DELAY_REG = %08x\n", IntSource.word, reg);
+		}
+*/
+		pAd->int_pending |= INT_AC0_DLY;
+
+		if ((pAd->int_disable_mask & INT_AC0_DLY) == 0) {
+			/* mask TxDataInt */
+			rt2860_int_disable(pAd, INT_AC0_DLY);
+			tasklet_hi_schedule(&pObj->ac0_dma_done_task);
+		}
+
+	}
+
+	if (IntSource.word & PreTBTTInt) {
+		RTMPHandlePreTBTTInterrupt(pAd);
+	}
+
+	if (IntSource.word & TBTTInt) {
+		RTMPHandleTBTTInterrupt(pAd);
+	}
+
+	{
+		if (IntSource.word & AutoWakeupInt)
+			RTMPHandleTwakeupInterrupt(pAd);
+	}
+
+	return IRQ_HANDLED;
+}
+
+/*
+ * invaild or writeback cache
+ * and convert virtual address to physical address
+ */
+dma_addr_t linux_pci_map_single(void *handle, void *ptr, size_t size,
+				int sd_idx, int direction)
+{
+	struct rt_rtmp_adapter *pAd;
+	struct os_cookie *pObj;
+
+	/*
+	   ------ Porting Information ------
+	   > For Tx Alloc:
+	   mgmt packets => sd_idx = 0
+	   SwIdx: pAd->MgmtRing.TxCpuIdx
+	   pTxD : pAd->MgmtRing.Cell[SwIdx].AllocVa;
+
+	   data packets => sd_idx = 1
+	   TxIdx : pAd->TxRing[pTxBlk->QueIdx].TxCpuIdx
+	   QueIdx: pTxBlk->QueIdx
+	   pTxD  : pAd->TxRing[pTxBlk->QueIdx].Cell[TxIdx].AllocVa;
+
+	   > For Rx Alloc:
+	   sd_idx = -1
+	 */
+
+	pAd = (struct rt_rtmp_adapter *)handle;
+	pObj = (struct os_cookie *)pAd->OS_Cookie;
+
+	if (sd_idx == 1) {
+		struct rt_tx_blk *pTxBlk;
+		pTxBlk = (struct rt_tx_blk *)ptr;
+		return pci_map_single(pObj->pci_dev, pTxBlk->pSrcBufData,
+				      pTxBlk->SrcBufLen, direction);
+	} else {
+		return pci_map_single(pObj->pci_dev, ptr, size, direction);
+	}
+
+}
+
+void linux_pci_unmap_single(void *handle, dma_addr_t dma_addr, size_t size,
+			    int direction)
+{
+	struct rt_rtmp_adapter *pAd;
+	struct os_cookie *pObj;
+
+	pAd = (struct rt_rtmp_adapter *)handle;
+	pObj = (struct os_cookie *)pAd->OS_Cookie;
+
+	pci_unmap_single(pObj->pci_dev, dma_addr, size, direction);
+
+}
diff --git a/drivers/staging/rt2860/rt_profile.c b/drivers/staging/rt2860/rt_profile.c
deleted file mode 100644
index 3bc41f83f624..000000000000
--- a/drivers/staging/rt2860/rt_profile.c
+++ /dev/null
@@ -1,1862 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
- */
-
-#include "rt_config.h"
-
-static void HTParametersHook(
-	IN	PRTMP_ADAPTER pAd,
-	IN	CHAR		  *pValueStr,
-	IN	CHAR		  *pInput);
-
-#define ETH_MAC_ADDR_STR_LEN 17  // in format of xx:xx:xx:xx:xx:xx
-
-// We assume the s1 is a sting, s2 is a memory space with 6 bytes. and content of s1 will be changed.
-BOOLEAN rtstrmactohex(char *s1, char *s2)
-{
-	int i = 0;
-	char *ptokS = s1, *ptokE = s1;
-
-	if (strlen(s1) != ETH_MAC_ADDR_STR_LEN)
-		return FALSE;
-
-	while((*ptokS) != '\0')
-	{
-		if((ptokE = strchr(ptokS, ':')) != NULL)
-			*ptokE++ = '\0';
-		if ((strlen(ptokS) != 2) || (!isxdigit(*ptokS)) || (!isxdigit(*(ptokS+1))))
-			break; // fail
-		AtoH(ptokS, &s2[i++], 1);
-		ptokS = ptokE;
-		if (i == 6)
-			break; // parsing finished
-	}
-
-	return ( i == 6 ? TRUE : FALSE);
-
-}
-
-
-// we assume the s1 and s2 both are strings.
-BOOLEAN rtstrcasecmp(char *s1, char *s2)
-{
-	char *p1 = s1, *p2 = s2;
-
-	if (strlen(s1) != strlen(s2))
-		return FALSE;
-
-	while(*p1 != '\0')
-	{
-		if((*p1 != *p2) && ((*p1 ^ *p2) != 0x20))
-			return FALSE;
-		p1++;
-		p2++;
-	}
-
-	return TRUE;
-}
-
-// we assume the s1 (buffer) and s2 (key) both are strings.
-char * rtstrstruncasecmp(char * s1, char * s2)
-{
-	INT l1, l2, i;
-	char temp1, temp2;
-
-	l2 = strlen(s2);
-	if (!l2)
-		return (char *) s1;
-
-	l1 = strlen(s1);
-
-	while (l1 >= l2)
-	{
-		l1--;
-
-		for(i=0; i<l2; i++)
-		{
-			temp1 = *(s1+i);
-			temp2 = *(s2+i);
-
-			if (('a' <= temp1) && (temp1 <= 'z'))
-				temp1 = 'A'+(temp1-'a');
-			if (('a' <= temp2) && (temp2 <= 'z'))
-				temp2 = 'A'+(temp2-'a');
-
-			if (temp1 != temp2)
-				break;
-		}
-
-		if (i == l2)
-			return (char *) s1;
-
-		s1++;
-	}
-
-	return NULL; // not found
-}
-
-//add by kathy
-
- /**
-  * strstr - Find the first substring in a %NUL terminated string
-  * @s1: The string to be searched
-  * @s2: The string to search for
-  */
-char * rtstrstr(const char * s1,const char * s2)
-{
-	INT l1, l2;
-
-	l2 = strlen(s2);
-	if (!l2)
-		return (char *) s1;
-
-	l1 = strlen(s1);
-
-	while (l1 >= l2)
-	{
-		l1--;
-		if (!memcmp(s1,s2,l2))
-			return (char *) s1;
-		s1++;
-	}
-
-	return NULL;
-}
-
-/**
- * rstrtok - Split a string into tokens
- * @s: The string to be searched
- * @ct: The characters to search for
- * * WARNING: strtok is deprecated, use strsep instead. However strsep is not compatible with old architecture.
- */
-char * __rstrtok;
-char * rstrtok(char * s,const char * ct)
-{
-	char *sbegin, *send;
-
-	sbegin  = s ? s : __rstrtok;
-	if (!sbegin)
-	{
-		return NULL;
-	}
-
-	sbegin += strspn(sbegin,ct);
-	if (*sbegin == '\0')
-	{
-		__rstrtok = NULL;
-		return( NULL );
-	}
-
-	send = strpbrk( sbegin, ct);
-	if (send && *send != '\0')
-		*send++ = '\0';
-
-	__rstrtok = send;
-
-	return (sbegin);
-}
-
-/**
- * delimitcnt - return the count of a given delimiter in a given string.
- * @s: The string to be searched.
- * @ct: The delimiter to search for.
- * Notice : We suppose the delimiter is a single-char string(for example : ";").
- */
-INT delimitcnt(char * s,const char * ct)
-{
-	INT count = 0;
-	/* point to the beginning of the line */
-	const char *token = s;
-
-	for ( ;; )
-	{
-		token = strpbrk(token, ct); /* search for delimiters */
-
-        if ( token == NULL )
-		{
-			/* advanced to the terminating null character */
-			break;
-		}
-		/* skip the delimiter */
-	    ++token;
-
-		/*
-		 * Print the found text: use len with %.*s to specify field width.
-		 */
-
-		/* accumulate delimiter count */
-	    ++count;
-	}
-    return count;
-}
-
-/*
-  * converts the Internet host address from the standard numbers-and-dots notation
-  * into binary data.
-  * returns nonzero if the address is valid, zero if not.
-  */
-int rtinet_aton(const char *cp, unsigned int *addr)
-{
-	unsigned int 	val;
-	int         	base, n;
-	char        	c;
-	unsigned int    parts[4];
-	unsigned int    *pp = parts;
-
-	for (;;)
-    {
-         /*
-          * Collect number up to ``.''.
-          * Values are specified as for C:
-          *	0x=hex, 0=octal, other=decimal.
-          */
-         val = 0;
-         base = 10;
-         if (*cp == '0')
-         {
-             if (*++cp == 'x' || *cp == 'X')
-                 base = 16, cp++;
-             else
-                 base = 8;
-         }
-         while ((c = *cp) != '\0')
-         {
-             if (isdigit((unsigned char) c))
-             {
-                 val = (val * base) + (c - '0');
-                 cp++;
-                 continue;
-             }
-             if (base == 16 && isxdigit((unsigned char) c))
-             {
-                 val = (val << 4) +
-                     (c + 10 - (islower((unsigned char) c) ? 'a' : 'A'));
-                 cp++;
-                 continue;
-             }
-             break;
-         }
-         if (*cp == '.')
-         {
-             /*
-              * Internet format: a.b.c.d a.b.c   (with c treated as 16-bits)
-              * a.b     (with b treated as 24 bits)
-              */
-             if (pp >= parts + 3 || val > 0xff)
-                 return 0;
-             *pp++ = val, cp++;
-         }
-         else
-             break;
-     }
-
-     /*
-      * Check for trailing junk.
-      */
-     while (*cp)
-         if (!isspace((unsigned char) *cp++))
-             return 0;
-
-     /*
-      * Concoct the address according to the number of parts specified.
-      */
-     n = pp - parts + 1;
-     switch (n)
-     {
-
-         case 1:         /* a -- 32 bits */
-             break;
-
-         case 2:         /* a.b -- 8.24 bits */
-             if (val > 0xffffff)
-                 return 0;
-             val |= parts[0] << 24;
-             break;
-
-         case 3:         /* a.b.c -- 8.8.16 bits */
-             if (val > 0xffff)
-                 return 0;
-             val |= (parts[0] << 24) | (parts[1] << 16);
-             break;
-
-         case 4:         /* a.b.c.d -- 8.8.8.8 bits */
-             if (val > 0xff)
-                 return 0;
-             val |= (parts[0] << 24) | (parts[1] << 16) | (parts[2] << 8);
-             break;
-     }
-
-     *addr = htonl(val);
-     return 1;
-
-}
-
-/*
-    ========================================================================
-
-    Routine Description:
-        Find key section for Get key parameter.
-
-    Arguments:
-        buffer                      Pointer to the buffer to start find the key section
-        section                     the key of the secion to be find
-
-    Return Value:
-        NULL                        Fail
-        Others                      Success
-    ========================================================================
-*/
-PUCHAR  RTMPFindSection(
-    IN  PCHAR   buffer)
-{
-    CHAR temp_buf[32];
-    PUCHAR  ptr;
-
-    strcpy(temp_buf, "Default");
-
-    if((ptr = rtstrstr(buffer, temp_buf)) != NULL)
-            return (ptr+strlen("\n"));
-        else
-            return NULL;
-}
-
-/*
-    ========================================================================
-
-    Routine Description:
-        Get key parameter.
-
-    Arguments:
-        key                         Pointer to key string
-        dest                        Pointer to destination
-        destsize                    The datasize of the destination
-        buffer                      Pointer to the buffer to start find the key
-
-    Return Value:
-        TRUE                        Success
-        FALSE                       Fail
-
-    Note:
-        This routine get the value with the matched key (case case-sensitive)
-    ========================================================================
-*/
-INT RTMPGetKeyParameter(
-    IN  PCHAR   key,
-    OUT PCHAR   dest,
-    IN  INT     destsize,
-    IN  PCHAR   buffer)
-{
-    UCHAR *temp_buf1 = NULL;
-    UCHAR *temp_buf2 = NULL;
-    CHAR *start_ptr;
-    CHAR *end_ptr;
-    CHAR *ptr;
-    CHAR *offset = 0;
-    INT  len;
-
-	//temp_buf1 = kmalloc(MAX_PARAM_BUFFER_SIZE, MEM_ALLOC_FLAG);
-	os_alloc_mem(NULL, &temp_buf1, MAX_PARAM_BUFFER_SIZE);
-
-	if(temp_buf1 == NULL)
-        return (FALSE);
-
-	//temp_buf2 = kmalloc(MAX_PARAM_BUFFER_SIZE, MEM_ALLOC_FLAG);
-	os_alloc_mem(NULL, &temp_buf2, MAX_PARAM_BUFFER_SIZE);
-	if(temp_buf2 == NULL)
-	{
-		os_free_mem(NULL, temp_buf1);
-        return (FALSE);
-	}
-
-    //find section
-    if((offset = RTMPFindSection(buffer)) == NULL)
-    {
-    	os_free_mem(NULL, temp_buf1);
-    	os_free_mem(NULL, temp_buf2);
-        return (FALSE);
-    }
-
-    strcpy(temp_buf1, "\n");
-    strcat(temp_buf1, key);
-    strcat(temp_buf1, "=");
-
-    //search key
-    if((start_ptr=rtstrstr(offset, temp_buf1))==NULL)
-    {
-		os_free_mem(NULL, temp_buf1);
-    	os_free_mem(NULL, temp_buf2);
-        return (FALSE);
-    }
-
-    start_ptr+=strlen("\n");
-    if((end_ptr=rtstrstr(start_ptr, "\n"))==NULL)
-       end_ptr=start_ptr+strlen(start_ptr);
-
-    if (end_ptr<start_ptr)
-    {
-		os_free_mem(NULL, temp_buf1);
-    	os_free_mem(NULL, temp_buf2);
-        return (FALSE);
-    }
-
-    NdisMoveMemory(temp_buf2, start_ptr, end_ptr-start_ptr);
-    temp_buf2[end_ptr-start_ptr]='\0';
-    len = strlen(temp_buf2);
-    strcpy(temp_buf1, temp_buf2);
-    if((start_ptr=rtstrstr(temp_buf1, "=")) == NULL)
-    {
-		os_free_mem(NULL, temp_buf1);
-    	os_free_mem(NULL, temp_buf2);
-        return (FALSE);
-    }
-
-    strcpy(temp_buf2, start_ptr+1);
-    ptr = temp_buf2;
-    //trim space or tab
-    while(*ptr != 0x00)
-    {
-        if( (*ptr == ' ') || (*ptr == '\t') )
-            ptr++;
-        else
-           break;
-    }
-
-    len = strlen(ptr);
-    memset(dest, 0x00, destsize);
-    strncpy(dest, ptr, len >= destsize ?  destsize: len);
-
-	os_free_mem(NULL, temp_buf1);
-    os_free_mem(NULL, temp_buf2);
-    return TRUE;
-}
-
-/*
-    ========================================================================
-
-    Routine Description:
-        Get key parameter.
-
-    Arguments:
-        key                         Pointer to key string
-        dest                        Pointer to destination
-        destsize                    The datasize of the destination
-        buffer                      Pointer to the buffer to start find the key
-
-    Return Value:
-        TRUE                        Success
-        FALSE                       Fail
-
-    Note:
-        This routine get the value with the matched key (case case-sensitive).
-        It is called for parsing SSID and any key string.
-    ========================================================================
-*/
-INT RTMPGetCriticalParameter(
-    IN  PCHAR   key,
-    OUT PCHAR   dest,
-    IN  INT     destsize,
-    IN  PCHAR   buffer)
-{
-    UCHAR *temp_buf1 = NULL;
-    UCHAR *temp_buf2 = NULL;
-    CHAR *start_ptr;
-    CHAR *end_ptr;
-    CHAR *ptr;
-    CHAR *offset = 0;
-    INT  len;
-
-	//temp_buf1 = kmalloc(MAX_PARAM_BUFFER_SIZE, MEM_ALLOC_FLAG);
-	os_alloc_mem(NULL, &temp_buf1, MAX_PARAM_BUFFER_SIZE);
-
-	if(temp_buf1 == NULL)
-        return (FALSE);
-
-	//temp_buf2 = kmalloc(MAX_PARAM_BUFFER_SIZE, MEM_ALLOC_FLAG);
-	os_alloc_mem(NULL, &temp_buf2, MAX_PARAM_BUFFER_SIZE);
-	if(temp_buf2 == NULL)
-	{
-		os_free_mem(NULL, temp_buf1);
-        return (FALSE);
-	}
-
-    //find section
-    if((offset = RTMPFindSection(buffer)) == NULL)
-    {
-    	os_free_mem(NULL, temp_buf1);
-    	os_free_mem(NULL, temp_buf2);
-        return (FALSE);
-    }
-
-    strcpy(temp_buf1, "\n");
-    strcat(temp_buf1, key);
-    strcat(temp_buf1, "=");
-
-    //search key
-    if((start_ptr=rtstrstr(offset, temp_buf1))==NULL)
-    {
-		os_free_mem(NULL, temp_buf1);
-    	os_free_mem(NULL, temp_buf2);
-        return (FALSE);
-    }
-
-    start_ptr+=strlen("\n");
-    if((end_ptr=rtstrstr(start_ptr, "\n"))==NULL)
-       end_ptr=start_ptr+strlen(start_ptr);
-
-    if (end_ptr<start_ptr)
-    {
-		os_free_mem(NULL, temp_buf1);
-    	os_free_mem(NULL, temp_buf2);
-        return (FALSE);
-    }
-
-    NdisMoveMemory(temp_buf2, start_ptr, end_ptr-start_ptr);
-    temp_buf2[end_ptr-start_ptr]='\0';
-    len = strlen(temp_buf2);
-    strcpy(temp_buf1, temp_buf2);
-    if((start_ptr=rtstrstr(temp_buf1, "=")) == NULL)
-    {
-		os_free_mem(NULL, temp_buf1);
-    	os_free_mem(NULL, temp_buf2);
-        return (FALSE);
-    }
-
-    strcpy(temp_buf2, start_ptr+1);
-    ptr = temp_buf2;
-
-    //trim tab
-    /* We cannot trim space(' ') for SSID and key string. */
-    while(*ptr != 0x00)
-    {
-        //if( (*ptr == ' ') || (*ptr == '\t') )
-        if( (*ptr == '\t') )
-            ptr++;
-        else
-           break;
-    }
-
-    len = strlen(ptr);
-    memset(dest, 0x00, destsize);
-    strncpy(dest, ptr, len >= destsize ?  destsize: len);
-
-	os_free_mem(NULL, temp_buf1);
-    os_free_mem(NULL, temp_buf2);
-    return TRUE;
-}
-
-/*
-    ========================================================================
-
-    Routine Description:
-        Get multiple key parameter.
-
-    Arguments:
-        key                         Pointer to key string
-        dest                        Pointer to destination
-        destsize                    The datasize of the destination
-        buffer                      Pointer to the buffer to start find the key
-
-    Return Value:
-        TRUE                        Success
-        FALSE                       Fail
-
-    Note:
-        This routine get the value with the matched key (case case-sensitive)
-    ========================================================================
-*/
-INT RTMPGetKeyParameterWithOffset(
-    IN  PCHAR   key,
-    OUT PCHAR   dest,
-    OUT	USHORT	*end_offset,
-    IN  INT     destsize,
-    IN  PCHAR   buffer,
-    IN	BOOLEAN	bTrimSpace)
-{
-    UCHAR *temp_buf1 = NULL;
-    UCHAR *temp_buf2 = NULL;
-    CHAR *start_ptr;
-    CHAR *end_ptr;
-    CHAR *ptr;
-    CHAR *offset = 0;
-    INT  len;
-
-	if (*end_offset >= MAX_INI_BUFFER_SIZE)
-		return (FALSE);
-
-	os_alloc_mem(NULL, &temp_buf1, MAX_PARAM_BUFFER_SIZE);
-
-	if(temp_buf1 == NULL)
-        return (FALSE);
-
-	os_alloc_mem(NULL, &temp_buf2, MAX_PARAM_BUFFER_SIZE);
-	if(temp_buf2 == NULL)
-	{
-		os_free_mem(NULL, temp_buf1);
-        return (FALSE);
-	}
-
-    //find section
-	if(*end_offset == 0)
-    {
-		if ((offset = RTMPFindSection(buffer)) == NULL)
-		{
-			os_free_mem(NULL, temp_buf1);
-	    	os_free_mem(NULL, temp_buf2);
-    	    return (FALSE);
-		}
-    }
-	else
-		offset = buffer + (*end_offset);
-
-    strcpy(temp_buf1, "\n");
-    strcat(temp_buf1, key);
-    strcat(temp_buf1, "=");
-
-    //search key
-    if((start_ptr=rtstrstr(offset, temp_buf1))==NULL)
-    {
-		os_free_mem(NULL, temp_buf1);
-    	os_free_mem(NULL, temp_buf2);
-        return (FALSE);
-    }
-
-    start_ptr+=strlen("\n");
-    if((end_ptr=rtstrstr(start_ptr, "\n"))==NULL)
-       end_ptr=start_ptr+strlen(start_ptr);
-
-    if (end_ptr<start_ptr)
-    {
-		os_free_mem(NULL, temp_buf1);
-    	os_free_mem(NULL, temp_buf2);
-        return (FALSE);
-    }
-
-	*end_offset = end_ptr - buffer;
-
-    NdisMoveMemory(temp_buf2, start_ptr, end_ptr-start_ptr);
-    temp_buf2[end_ptr-start_ptr]='\0';
-    len = strlen(temp_buf2);
-    strcpy(temp_buf1, temp_buf2);
-    if((start_ptr=rtstrstr(temp_buf1, "=")) == NULL)
-    {
-		os_free_mem(NULL, temp_buf1);
-    	os_free_mem(NULL, temp_buf2);
-        return (FALSE);
-    }
-
-    strcpy(temp_buf2, start_ptr+1);
-    ptr = temp_buf2;
-    //trim space or tab
-    while(*ptr != 0x00)
-    {
-        if((bTrimSpace && (*ptr == ' ')) || (*ptr == '\t') )
-            ptr++;
-        else
-           break;
-    }
-
-    len = strlen(ptr);
-    memset(dest, 0x00, destsize);
-    strncpy(dest, ptr, len >= destsize ?  destsize: len);
-
-	os_free_mem(NULL, temp_buf1);
-    os_free_mem(NULL, temp_buf2);
-    return TRUE;
-}
-
-
-static int rtmp_parse_key_buffer_from_file(IN  PRTMP_ADAPTER pAd,IN  char *buffer,IN  ULONG KeyType,IN  INT BSSIdx,IN  INT KeyIdx)
-{
-	PUCHAR		keybuff;
-	INT			i = BSSIdx, idx = KeyIdx;
-	ULONG		KeyLen;
-	UCHAR		CipherAlg = CIPHER_WEP64;
-
-	keybuff = buffer;
-	KeyLen = strlen(keybuff);
-
-	if (KeyType == 1)
-	{//Ascii
-		if( (KeyLen == 5) || (KeyLen == 13))
-		{
-			pAd->SharedKey[i][idx].KeyLen = KeyLen;
-			NdisMoveMemory(pAd->SharedKey[i][idx].Key, keybuff, KeyLen);
-			if (KeyLen == 5)
-				CipherAlg = CIPHER_WEP64;
-			else
-				CipherAlg = CIPHER_WEP128;
-			pAd->SharedKey[i][idx].CipherAlg = CipherAlg;
-
-			DBGPRINT(RT_DEBUG_TRACE, ("I/F(wlan%d) Key%dStr=%s and type=%s\n", i, idx+1, keybuff, (KeyType == 0) ? "Hex":"Ascii"));
-			return 1;
-		}
-		else
-		{//Invalid key length
-			DBGPRINT(RT_DEBUG_ERROR, ("Key%dStr is Invalid key length! KeyLen = %ld!\n", idx+1, KeyLen));
-			return 0;
-		}
-	}
-	else
-	{//Hex type
-		if( (KeyLen == 10) || (KeyLen == 26))
-		{
-			pAd->SharedKey[i][idx].KeyLen = KeyLen / 2;
-			AtoH(keybuff, pAd->SharedKey[i][idx].Key, KeyLen / 2);
-			if (KeyLen == 10)
-				CipherAlg = CIPHER_WEP64;
-			else
-				CipherAlg = CIPHER_WEP128;
-			pAd->SharedKey[i][idx].CipherAlg = CipherAlg;
-
-			DBGPRINT(RT_DEBUG_TRACE, ("I/F(wlan%d) Key%dStr=%s and type=%s\n", i, idx+1, keybuff, (KeyType == 0) ? "Hex":"Ascii"));
-			return 1;
-		}
-		else
-		{//Invalid key length
-			DBGPRINT(RT_DEBUG_ERROR, ("I/F(wlan%d) Key%dStr is Invalid key length! KeyLen = %ld!\n", i, idx+1, KeyLen));
-			return 0;
-		}
-	}
-}
-static void rtmp_read_key_parms_from_file(IN  PRTMP_ADAPTER pAd, char *tmpbuf, char *buffer)
-{
-	char		tok_str[16];
-	PUCHAR		macptr;
-	INT			i = 0, idx;
-	ULONG		KeyType[MAX_MBSSID_NUM];
-	ULONG		KeyIdx;
-
-	NdisZeroMemory(KeyType, MAX_MBSSID_NUM);
-
-	//DefaultKeyID
-	if(RTMPGetKeyParameter("DefaultKeyID", tmpbuf, 25, buffer))
-	{
-		{
-			KeyIdx = simple_strtol(tmpbuf, 0, 10);
-			if((KeyIdx >= 1 ) && (KeyIdx <= 4))
-				pAd->StaCfg.DefaultKeyId = (UCHAR) (KeyIdx - 1);
-			else
-				pAd->StaCfg.DefaultKeyId = 0;
-
-			DBGPRINT(RT_DEBUG_TRACE, ("DefaultKeyID(0~3)=%d\n", pAd->StaCfg.DefaultKeyId));
-		}
-	}
-
-
-	for (idx = 0; idx < 4; idx++)
-	{
-		sprintf(tok_str, "Key%dType", idx + 1);
-		//Key1Type
-		if (RTMPGetKeyParameter(tok_str, tmpbuf, 128, buffer))
-		{
-		    for (i = 0, macptr = rstrtok(tmpbuf,";"); macptr; macptr = rstrtok(NULL,";"), i++)
-		    {
-			    KeyType[i] = simple_strtol(macptr, 0, 10);
-		    }
-
-			{
-				sprintf(tok_str, "Key%dStr", idx + 1);
-				if (RTMPGetCriticalParameter(tok_str, tmpbuf, 128, buffer))
-				{
-					rtmp_parse_key_buffer_from_file(pAd, tmpbuf, KeyType[BSS0], BSS0, idx);
-				}
-			}
-		}
-	}
-}
-
-static void rtmp_read_sta_wmm_parms_from_file(IN  PRTMP_ADAPTER pAd, char *tmpbuf, char *buffer)
-{
-	PUCHAR					macptr;
-	INT						i=0;
-	BOOLEAN					bWmmEnable = FALSE;
-
-	//WmmCapable
-	if(RTMPGetKeyParameter("WmmCapable", tmpbuf, 32, buffer))
-	{
-		if(simple_strtol(tmpbuf, 0, 10) != 0) //Enable
-		{
-			pAd->CommonCfg.bWmmCapable = TRUE;
-			bWmmEnable = TRUE;
-		}
-		else //Disable
-		{
-			pAd->CommonCfg.bWmmCapable = FALSE;
-		}
-
-		DBGPRINT(RT_DEBUG_TRACE, ("WmmCapable=%d\n", pAd->CommonCfg.bWmmCapable));
-	}
-
-	//AckPolicy for AC_BK, AC_BE, AC_VI, AC_VO
-	if(RTMPGetKeyParameter("AckPolicy", tmpbuf, 32, buffer))
-	{
-		for (i = 0, macptr = rstrtok(tmpbuf,";"); macptr; macptr = rstrtok(NULL,";"), i++)
-		{
-			pAd->CommonCfg.AckPolicy[i] = (UCHAR)simple_strtol(macptr, 0, 10);
-
-			DBGPRINT(RT_DEBUG_TRACE, ("AckPolicy[%d]=%d\n", i, pAd->CommonCfg.AckPolicy[i]));
-		}
-	}
-
-	if (bWmmEnable)
-	{
-		//APSDCapable
-		if(RTMPGetKeyParameter("APSDCapable", tmpbuf, 10, buffer))
-		{
-			if(simple_strtol(tmpbuf, 0, 10) != 0)  //Enable
-				pAd->CommonCfg.bAPSDCapable = TRUE;
-			else
-				pAd->CommonCfg.bAPSDCapable = FALSE;
-
-			DBGPRINT(RT_DEBUG_TRACE, ("APSDCapable=%d\n", pAd->CommonCfg.bAPSDCapable));
-		}
-
-		//APSDAC for AC_BE, AC_BK, AC_VI, AC_VO
-		if(RTMPGetKeyParameter("APSDAC", tmpbuf, 32, buffer))
-		{
-			BOOLEAN apsd_ac[4];
-
-			for (i = 0, macptr = rstrtok(tmpbuf,";"); macptr; macptr = rstrtok(NULL,";"), i++)
-			{
-				apsd_ac[i] = (BOOLEAN)simple_strtol(macptr, 0, 10);
-
-				DBGPRINT(RT_DEBUG_TRACE, ("APSDAC%d  %d\n", i,  apsd_ac[i]));
-			}
-
-			pAd->CommonCfg.bAPSDAC_BE = apsd_ac[0];
-			pAd->CommonCfg.bAPSDAC_BK = apsd_ac[1];
-			pAd->CommonCfg.bAPSDAC_VI = apsd_ac[2];
-			pAd->CommonCfg.bAPSDAC_VO = apsd_ac[3];
-		}
-	}
-
-}
-
-NDIS_STATUS	RTMPReadParametersHook(
-	IN	PRTMP_ADAPTER pAd)
-{
-	PUCHAR					src = NULL;
-	struct file				*srcf;
-	INT 					retval;
-   	mm_segment_t			orgfs;
-	CHAR					*buffer;
-	CHAR					*tmpbuf;
-	ULONG					RtsThresh;
-	ULONG					FragThresh;
-	UCHAR	                keyMaterial[40];
-
-	PUCHAR					macptr;
-	INT						i = 0;
-
-	buffer = kmalloc(MAX_INI_BUFFER_SIZE, MEM_ALLOC_FLAG);
-	if(buffer == NULL)
-        return NDIS_STATUS_FAILURE;
-
-	tmpbuf = kmalloc(MAX_PARAM_BUFFER_SIZE, MEM_ALLOC_FLAG);
-	if(tmpbuf == NULL)
-	{
-		kfree(buffer);
-        return NDIS_STATUS_FAILURE;
-	}
-
-	src = STA_PROFILE_PATH;
-
-    orgfs = get_fs();
-    set_fs(KERNEL_DS);
-
-	if (src && *src)
-	{
-		srcf = filp_open(src, O_RDONLY, 0);
-		if (IS_ERR(srcf))
-		{
-			DBGPRINT(RT_DEBUG_ERROR, ("--> Error %ld opening %s\n", -PTR_ERR(srcf),src));
-		}
-		else
-		{
-			// The object must have a read method
-			if (srcf->f_op && srcf->f_op->read)
-			{
-				memset(buffer, 0x00, MAX_INI_BUFFER_SIZE);
-				retval=srcf->f_op->read(srcf, buffer, MAX_INI_BUFFER_SIZE, &srcf->f_pos);
-				if (retval < 0)
-				{
-					DBGPRINT(RT_DEBUG_TRACE, ("--> Read %s error %d\n", src, -retval));
-				}
-				else
-				{
-					// set file parameter to portcfg
-					//CountryRegion
-					if(RTMPGetKeyParameter("CountryRegion", tmpbuf, 25, buffer))
-					{
-						pAd->CommonCfg.CountryRegion = (UCHAR) simple_strtol(tmpbuf, 0, 10);
-						DBGPRINT(RT_DEBUG_TRACE, ("CountryRegion=%d\n", pAd->CommonCfg.CountryRegion));
-					}
-					//CountryRegionABand
-					if(RTMPGetKeyParameter("CountryRegionABand", tmpbuf, 25, buffer))
-					{
-						pAd->CommonCfg.CountryRegionForABand= (UCHAR) simple_strtol(tmpbuf, 0, 10);
-						DBGPRINT(RT_DEBUG_TRACE, ("CountryRegionABand=%d\n", pAd->CommonCfg.CountryRegionForABand));
-					}
-					//CountryCode
-					if(RTMPGetKeyParameter("CountryCode", tmpbuf, 25, buffer))
-					{
-						NdisMoveMemory(pAd->CommonCfg.CountryCode, tmpbuf , 2);
-
-						if (strlen(pAd->CommonCfg.CountryCode) != 0)
-						{
-							pAd->CommonCfg.bCountryFlag = TRUE;
-						}
-						DBGPRINT(RT_DEBUG_TRACE, ("CountryCode=%s\n", pAd->CommonCfg.CountryCode));
-					}
-					//ChannelGeography
-					if(RTMPGetKeyParameter("ChannelGeography", tmpbuf, 25, buffer))
-					{
-						UCHAR Geography = (UCHAR) simple_strtol(tmpbuf, 0, 10);
-						if (Geography <= BOTH)
-						{
-							pAd->CommonCfg.Geography = Geography;
-							pAd->CommonCfg.CountryCode[2] =
-								(pAd->CommonCfg.Geography == BOTH) ? ' ' : ((pAd->CommonCfg.Geography == IDOR) ? 'I' : 'O');
-							DBGPRINT(RT_DEBUG_TRACE, ("ChannelGeography=%d\n", pAd->CommonCfg.Geography));
-						}
-					}
-					else
-					{
-						pAd->CommonCfg.Geography = BOTH;
-						pAd->CommonCfg.CountryCode[2] = ' ';
-					}
-
-					{
-						//SSID
-						if (RTMPGetCriticalParameter("SSID", tmpbuf, 256, buffer))
-						{
-							if (strlen(tmpbuf) <= 32)
-							{
-			 					pAd->CommonCfg.SsidLen = (UCHAR) strlen(tmpbuf);
-								NdisZeroMemory(pAd->CommonCfg.Ssid, NDIS_802_11_LENGTH_SSID);
-								NdisMoveMemory(pAd->CommonCfg.Ssid, tmpbuf, pAd->CommonCfg.SsidLen);
-								pAd->MlmeAux.AutoReconnectSsidLen = pAd->CommonCfg.SsidLen;
-								NdisZeroMemory(pAd->MlmeAux.AutoReconnectSsid, NDIS_802_11_LENGTH_SSID);
-								NdisMoveMemory(pAd->MlmeAux.AutoReconnectSsid, tmpbuf, pAd->MlmeAux.AutoReconnectSsidLen);
-								pAd->MlmeAux.SsidLen = pAd->CommonCfg.SsidLen;
-								NdisZeroMemory(pAd->MlmeAux.Ssid, NDIS_802_11_LENGTH_SSID);
-								NdisMoveMemory(pAd->MlmeAux.Ssid, tmpbuf, pAd->MlmeAux.SsidLen);
-								DBGPRINT(RT_DEBUG_TRACE, ("%s::(SSID=%s)\n", __func__, tmpbuf));
-							}
-						}
-					}
-
-					{
-						//NetworkType
-						if (RTMPGetKeyParameter("NetworkType", tmpbuf, 25, buffer))
-						{
-							pAd->bConfigChanged = TRUE;
-							if (strcmp(tmpbuf, "Adhoc") == 0)
-								pAd->StaCfg.BssType = BSS_ADHOC;
-							else //Default Infrastructure mode
-								pAd->StaCfg.BssType = BSS_INFRA;
-							// Reset Ralink supplicant to not use, it will be set to start when UI set PMK key
-							pAd->StaCfg.WpaState = SS_NOTUSE;
-							DBGPRINT(RT_DEBUG_TRACE, ("%s::(NetworkType=%d)\n", __func__, pAd->StaCfg.BssType));
-						}
-					}
-
-					//Channel
-					if(RTMPGetKeyParameter("Channel", tmpbuf, 10, buffer))
-					{
-						pAd->CommonCfg.Channel = (UCHAR) simple_strtol(tmpbuf, 0, 10);
-						DBGPRINT(RT_DEBUG_TRACE, ("Channel=%d\n", pAd->CommonCfg.Channel));
-					}
-					//WirelessMode
-					if(RTMPGetKeyParameter("WirelessMode", tmpbuf, 10, buffer))
-					{
-						int value  = 0, maxPhyMode = PHY_11G;
-
-						maxPhyMode = PHY_11N_5G;
-
-						value = simple_strtol(tmpbuf, 0, 10);
-
-						if (value <= maxPhyMode)
-						{
-							pAd->CommonCfg.PhyMode = value;
-						}
-						DBGPRINT(RT_DEBUG_TRACE, ("PhyMode=%d\n", pAd->CommonCfg.PhyMode));
-					}
-                    //BasicRate
-					if(RTMPGetKeyParameter("BasicRate", tmpbuf, 10, buffer))
-					{
-						pAd->CommonCfg.BasicRateBitmap = (ULONG) simple_strtol(tmpbuf, 0, 10);
-						DBGPRINT(RT_DEBUG_TRACE, ("BasicRate=%ld\n", pAd->CommonCfg.BasicRateBitmap));
-					}
-					//BeaconPeriod
-					if(RTMPGetKeyParameter("BeaconPeriod", tmpbuf, 10, buffer))
-					{
-						pAd->CommonCfg.BeaconPeriod = (USHORT) simple_strtol(tmpbuf, 0, 10);
-						DBGPRINT(RT_DEBUG_TRACE, ("BeaconPeriod=%d\n", pAd->CommonCfg.BeaconPeriod));
-					}
-                    //TxPower
-					if(RTMPGetKeyParameter("TxPower", tmpbuf, 10, buffer))
-					{
-						pAd->CommonCfg.TxPowerPercentage = (ULONG) simple_strtol(tmpbuf, 0, 10);
-
-						pAd->CommonCfg.TxPowerDefault = pAd->CommonCfg.TxPowerPercentage;
-
-						DBGPRINT(RT_DEBUG_TRACE, ("TxPower=%ld\n", pAd->CommonCfg.TxPowerPercentage));
-					}
-					//BGProtection
-					if(RTMPGetKeyParameter("BGProtection", tmpbuf, 10, buffer))
-					{
-						switch (simple_strtol(tmpbuf, 0, 10))
-						{
-							case 1: //Always On
-								pAd->CommonCfg.UseBGProtection = 1;
-								break;
-							case 2: //Always OFF
-								pAd->CommonCfg.UseBGProtection = 2;
-								break;
-							case 0: //AUTO
-							default:
-								pAd->CommonCfg.UseBGProtection = 0;
-								break;
-						}
-						DBGPRINT(RT_DEBUG_TRACE, ("BGProtection=%ld\n", pAd->CommonCfg.UseBGProtection));
-					}
-					//OLBCDetection
-					if(RTMPGetKeyParameter("DisableOLBC", tmpbuf, 10, buffer))
-					{
-						switch (simple_strtol(tmpbuf, 0, 10))
-						{
-							case 1: //disable OLBC Detection
-								pAd->CommonCfg.DisableOLBCDetect = 1;
-								break;
-							case 0: //enable OLBC Detection
-								pAd->CommonCfg.DisableOLBCDetect = 0;
-								break;
-							default:
-								pAd->CommonCfg.DisableOLBCDetect= 0;
-								break;
-						}
-						DBGPRINT(RT_DEBUG_TRACE, ("OLBCDetection=%ld\n", pAd->CommonCfg.DisableOLBCDetect));
-					}
-					//TxPreamble
-					if(RTMPGetKeyParameter("TxPreamble", tmpbuf, 10, buffer))
-					{
-						switch (simple_strtol(tmpbuf, 0, 10))
-						{
-							case Rt802_11PreambleShort:
-								pAd->CommonCfg.TxPreamble = Rt802_11PreambleShort;
-								break;
-							case Rt802_11PreambleLong:
-							default:
-								pAd->CommonCfg.TxPreamble = Rt802_11PreambleLong;
-								break;
-						}
-						DBGPRINT(RT_DEBUG_TRACE, ("TxPreamble=%ld\n", pAd->CommonCfg.TxPreamble));
-					}
-					//RTSThreshold
-					if(RTMPGetKeyParameter("RTSThreshold", tmpbuf, 10, buffer))
-					{
-						RtsThresh = simple_strtol(tmpbuf, 0, 10);
-						if( (RtsThresh >= 1) && (RtsThresh <= MAX_RTS_THRESHOLD) )
-							pAd->CommonCfg.RtsThreshold  = (USHORT)RtsThresh;
-						else
-							pAd->CommonCfg.RtsThreshold = MAX_RTS_THRESHOLD;
-
-						DBGPRINT(RT_DEBUG_TRACE, ("RTSThreshold=%d\n", pAd->CommonCfg.RtsThreshold));
-					}
-					//FragThreshold
-					if(RTMPGetKeyParameter("FragThreshold", tmpbuf, 10, buffer))
-					{
-						FragThresh = simple_strtol(tmpbuf, 0, 10);
-						pAd->CommonCfg.bUseZeroToDisableFragment = FALSE;
-
-						if (FragThresh > MAX_FRAG_THRESHOLD || FragThresh < MIN_FRAG_THRESHOLD)
-						{ //illegal FragThresh so we set it to default
-							pAd->CommonCfg.FragmentThreshold = MAX_FRAG_THRESHOLD;
-							pAd->CommonCfg.bUseZeroToDisableFragment = TRUE;
-						}
-						else if (FragThresh % 2 == 1)
-						{
-							// The length of each fragment shall always be an even number of octets, except for the last fragment
-							// of an MSDU or MMPDU, which may be either an even or an odd number of octets.
-							pAd->CommonCfg.FragmentThreshold = (USHORT)(FragThresh - 1);
-						}
-						else
-						{
-							pAd->CommonCfg.FragmentThreshold = (USHORT)FragThresh;
-						}
-						//pAd->CommonCfg.AllowFragSize = (pAd->CommonCfg.FragmentThreshold) - LENGTH_802_11 - LENGTH_CRC;
-						DBGPRINT(RT_DEBUG_TRACE, ("FragThreshold=%d\n", pAd->CommonCfg.FragmentThreshold));
-					}
-					//TxBurst
-					if(RTMPGetKeyParameter("TxBurst", tmpbuf, 10, buffer))
-					{
-						if(simple_strtol(tmpbuf, 0, 10) != 0)  //Enable
-							pAd->CommonCfg.bEnableTxBurst = TRUE;
-						else //Disable
-							pAd->CommonCfg.bEnableTxBurst = FALSE;
-						DBGPRINT(RT_DEBUG_TRACE, ("TxBurst=%d\n", pAd->CommonCfg.bEnableTxBurst));
-					}
-
-#ifdef AGGREGATION_SUPPORT
-					//PktAggregate
-					if(RTMPGetKeyParameter("PktAggregate", tmpbuf, 10, buffer))
-					{
-						if(simple_strtol(tmpbuf, 0, 10) != 0)  //Enable
-							pAd->CommonCfg.bAggregationCapable = TRUE;
-						else //Disable
-							pAd->CommonCfg.bAggregationCapable = FALSE;
-#ifdef PIGGYBACK_SUPPORT
-						pAd->CommonCfg.bPiggyBackCapable = pAd->CommonCfg.bAggregationCapable;
-#endif // PIGGYBACK_SUPPORT //
-						DBGPRINT(RT_DEBUG_TRACE, ("PktAggregate=%d\n", pAd->CommonCfg.bAggregationCapable));
-					}
-#else
-					pAd->CommonCfg.bAggregationCapable = FALSE;
-					pAd->CommonCfg.bPiggyBackCapable = FALSE;
-#endif // AGGREGATION_SUPPORT //
-
-					// WmmCapable
-					rtmp_read_sta_wmm_parms_from_file(pAd, tmpbuf, buffer);
-
-					//ShortSlot
-					if(RTMPGetKeyParameter("ShortSlot", tmpbuf, 10, buffer))
-					{
-						if(simple_strtol(tmpbuf, 0, 10) != 0)  //Enable
-							pAd->CommonCfg.bUseShortSlotTime = TRUE;
-						else //Disable
-							pAd->CommonCfg.bUseShortSlotTime = FALSE;
-
-						DBGPRINT(RT_DEBUG_TRACE, ("ShortSlot=%d\n", pAd->CommonCfg.bUseShortSlotTime));
-					}
-					//IEEE80211H
-					if(RTMPGetKeyParameter("IEEE80211H", tmpbuf, 10, buffer))
-					{
-					    for (i = 0, macptr = rstrtok(tmpbuf,";"); macptr; macptr = rstrtok(NULL,";"), i++)
-					    {
-    						if(simple_strtol(macptr, 0, 10) != 0)  //Enable
-    							pAd->CommonCfg.bIEEE80211H = TRUE;
-    						else //Disable
-    							pAd->CommonCfg.bIEEE80211H = FALSE;
-
-    						DBGPRINT(RT_DEBUG_TRACE, ("IEEE80211H=%d\n", pAd->CommonCfg.bIEEE80211H));
-					    }
-					}
-					//CSPeriod
-					if(RTMPGetKeyParameter("CSPeriod", tmpbuf, 10, buffer))
-					{
-					    if(simple_strtol(tmpbuf, 0, 10) != 0)
-							pAd->CommonCfg.RadarDetect.CSPeriod = simple_strtol(tmpbuf, 0, 10);
-						else
-							pAd->CommonCfg.RadarDetect.CSPeriod = 0;
-
-   						DBGPRINT(RT_DEBUG_TRACE, ("CSPeriod=%d\n", pAd->CommonCfg.RadarDetect.CSPeriod));
-					}
-
-					//RDRegion
-					if(RTMPGetKeyParameter("RDRegion", tmpbuf, 128, buffer))
-					{
-						if ((strncmp(tmpbuf, "JAP_W53", 7) == 0) || (strncmp(tmpbuf, "jap_w53", 7) == 0))
-						{
-							pAd->CommonCfg.RadarDetect.RDDurRegion = JAP_W53;
-							pAd->CommonCfg.RadarDetect.DfsSessionTime = 15;
-						}
-						else if ((strncmp(tmpbuf, "JAP_W56", 7) == 0) || (strncmp(tmpbuf, "jap_w56", 7) == 0))
-						{
-							pAd->CommonCfg.RadarDetect.RDDurRegion = JAP_W56;
-							pAd->CommonCfg.RadarDetect.DfsSessionTime = 13;
-						}
-						else if ((strncmp(tmpbuf, "JAP", 3) == 0) || (strncmp(tmpbuf, "jap", 3) == 0))
-						{
-							pAd->CommonCfg.RadarDetect.RDDurRegion = JAP;
-							pAd->CommonCfg.RadarDetect.DfsSessionTime = 5;
-						}
-						else  if ((strncmp(tmpbuf, "FCC", 3) == 0) || (strncmp(tmpbuf, "fcc", 3) == 0))
-						{
-							pAd->CommonCfg.RadarDetect.RDDurRegion = FCC;
-							pAd->CommonCfg.RadarDetect.DfsSessionTime = 5;
-						}
-						else if ((strncmp(tmpbuf, "CE", 2) == 0) || (strncmp(tmpbuf, "ce", 2) == 0))
-						{
-							pAd->CommonCfg.RadarDetect.RDDurRegion = CE;
-							pAd->CommonCfg.RadarDetect.DfsSessionTime = 13;
-						}
-						else
-						{
-							pAd->CommonCfg.RadarDetect.RDDurRegion = CE;
-							pAd->CommonCfg.RadarDetect.DfsSessionTime = 13;
-						}
-
-						DBGPRINT(RT_DEBUG_TRACE, ("RDRegion=%d\n", pAd->CommonCfg.RadarDetect.RDDurRegion));
-					}
-					else
-					{
-						pAd->CommonCfg.RadarDetect.RDDurRegion = CE;
-						pAd->CommonCfg.RadarDetect.DfsSessionTime = 13;
-					}
-
-					//WirelessEvent
-					if(RTMPGetKeyParameter("WirelessEvent", tmpbuf, 10, buffer))
-					{
-					    if(simple_strtol(tmpbuf, 0, 10) != 0)
-							pAd->CommonCfg.bWirelessEvent = simple_strtol(tmpbuf, 0, 10);
-						else
-							pAd->CommonCfg.bWirelessEvent = 0;	// disable
-   						DBGPRINT(RT_DEBUG_TRACE, ("WirelessEvent=%d\n", pAd->CommonCfg.bWirelessEvent));
-					}
-					if(RTMPGetKeyParameter("WiFiTest", tmpbuf, 10, buffer))
-					{
-					    if(simple_strtol(tmpbuf, 0, 10) != 0)
-							pAd->CommonCfg.bWiFiTest= simple_strtol(tmpbuf, 0, 10);
-						else
-							pAd->CommonCfg.bWiFiTest = 0;	// disable
-
-   						DBGPRINT(RT_DEBUG_TRACE, ("WiFiTest=%d\n", pAd->CommonCfg.bWiFiTest));
-					}
-					//AuthMode
-					if(RTMPGetKeyParameter("AuthMode", tmpbuf, 128, buffer))
-					{
-						{
-							if ((strcmp(tmpbuf, "WEPAUTO") == 0) || (strcmp(tmpbuf, "wepauto") == 0))
-							    pAd->StaCfg.AuthMode = Ndis802_11AuthModeAutoSwitch;
-							else if ((strcmp(tmpbuf, "SHARED") == 0) || (strcmp(tmpbuf, "shared") == 0))
-							    pAd->StaCfg.AuthMode = Ndis802_11AuthModeShared;
-							else if ((strcmp(tmpbuf, "WPAPSK") == 0) || (strcmp(tmpbuf, "wpapsk") == 0))
-							    pAd->StaCfg.AuthMode = Ndis802_11AuthModeWPAPSK;
-							else if ((strcmp(tmpbuf, "WPANONE") == 0) || (strcmp(tmpbuf, "wpanone") == 0))
-							    pAd->StaCfg.AuthMode = Ndis802_11AuthModeWPANone;
-							else if ((strcmp(tmpbuf, "WPA2PSK") == 0) || (strcmp(tmpbuf, "wpa2psk") == 0))
-							    pAd->StaCfg.AuthMode = Ndis802_11AuthModeWPA2PSK;
-							else if ((strcmp(tmpbuf, "WPA") == 0) || (strcmp(tmpbuf, "wpa") == 0))
-							    pAd->StaCfg.AuthMode = Ndis802_11AuthModeWPA;
-							else if ((strcmp(tmpbuf, "WPA2") == 0) || (strcmp(tmpbuf, "wpa2") == 0))
-							    pAd->StaCfg.AuthMode = Ndis802_11AuthModeWPA2;
-				                        else
-				                            pAd->StaCfg.AuthMode = Ndis802_11AuthModeOpen;
-
-				                        pAd->StaCfg.PortSecured = WPA_802_1X_PORT_NOT_SECURED;
-
-							DBGPRINT(RT_DEBUG_TRACE, ("%s::(EncrypType=%d)\n", __func__, pAd->StaCfg.WepStatus));
-						}
-					}
-					//EncrypType
-					if(RTMPGetKeyParameter("EncrypType", tmpbuf, 128, buffer))
-					{
-						{
-							if ((strcmp(tmpbuf, "WEP") == 0) || (strcmp(tmpbuf, "wep") == 0))
-								pAd->StaCfg.WepStatus	= Ndis802_11WEPEnabled;
-							else if ((strcmp(tmpbuf, "TKIP") == 0) || (strcmp(tmpbuf, "tkip") == 0))
-								pAd->StaCfg.WepStatus	= Ndis802_11Encryption2Enabled;
-							else if ((strcmp(tmpbuf, "AES") == 0) || (strcmp(tmpbuf, "aes") == 0))
-								pAd->StaCfg.WepStatus	= Ndis802_11Encryption3Enabled;
-							else
-								pAd->StaCfg.WepStatus	= Ndis802_11WEPDisabled;
-
-							// Update all wepstatus related
-							pAd->StaCfg.PairCipher		= pAd->StaCfg.WepStatus;
-							pAd->StaCfg.GroupCipher 	= pAd->StaCfg.WepStatus;
-							pAd->StaCfg.OrigWepStatus 	= pAd->StaCfg.WepStatus;
-							pAd->StaCfg.bMixCipher 		= FALSE;
-
-							DBGPRINT(RT_DEBUG_TRACE, ("%s::(EncrypType=%d)\n", __func__, pAd->StaCfg.WepStatus));
-						}
-					}
-
-					{
-						if(RTMPGetCriticalParameter("WPAPSK", tmpbuf, 512, buffer))
-						{
-							int     err=0;
-
-							tmpbuf[strlen(tmpbuf)] = '\0'; // make STA can process .$^& for WPAPSK input
-
-							if ((pAd->StaCfg.AuthMode != Ndis802_11AuthModeWPAPSK) &&
-								(pAd->StaCfg.AuthMode != Ndis802_11AuthModeWPA2PSK) &&
-								(pAd->StaCfg.AuthMode != Ndis802_11AuthModeWPANone)
-								)
-							{
-								err = 1;
-							}
-							else if ((strlen(tmpbuf) >= 8) && (strlen(tmpbuf) < 64))
-							{
-								PasswordHash((char *)tmpbuf, pAd->CommonCfg.Ssid, pAd->CommonCfg.SsidLen, keyMaterial);
-								NdisMoveMemory(pAd->StaCfg.PMK, keyMaterial, 32);
-
-							}
-							else if (strlen(tmpbuf) == 64)
-							{
-								AtoH(tmpbuf, keyMaterial, 32);
-								NdisMoveMemory(pAd->StaCfg.PMK, keyMaterial, 32);
-							}
-							else
-							{
-								err = 1;
-								DBGPRINT(RT_DEBUG_ERROR, ("%s::(WPAPSK key-string required 8 ~ 64 characters!)\n", __func__));
-							}
-
-							if (err == 0)
-	                        			{
-	                        				if ((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPAPSK) ||
-									(pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK))
-								{
-									// Start STA supplicant state machine
-									pAd->StaCfg.WpaState = SS_START;
-								}
-								else if (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPANone)
-								{
-									pAd->StaCfg.WpaState = SS_NOTUSE;
-								}
-
-								DBGPRINT(RT_DEBUG_TRACE, ("%s::(WPAPSK=%s)\n", __func__, tmpbuf));
-							}
-						}
-					}
-
-					//DefaultKeyID, KeyType, KeyStr
-					rtmp_read_key_parms_from_file(pAd, tmpbuf, buffer);
-
-					HTParametersHook(pAd, tmpbuf, buffer);
-
-					{
-						//PSMode
-#ifdef RT2860
-						if (RTMPGetKeyParameter("PSMode", tmpbuf, 32, buffer))
-#endif
-#ifdef RT2870
-						if (RTMPGetKeyParameter("PSMode", tmpbuf, 10, buffer))
-#endif
-						{
-							if (pAd->StaCfg.BssType == BSS_INFRA)
-							{
-								if ((strcmp(tmpbuf, "MAX_PSP") == 0) || (strcmp(tmpbuf, "max_psp") == 0))
-								{
-									// do NOT turn on PSM bit here, wait until MlmeCheckForPsmChange()
-									// to exclude certain situations.
-									//	   MlmeSetPsm(pAd, PWR_SAVE);
-									OPSTATUS_SET_FLAG(pAd, fOP_STATUS_RECEIVE_DTIM);
-									if (pAd->StaCfg.bWindowsACCAMEnable == FALSE)
-										pAd->StaCfg.WindowsPowerMode = Ndis802_11PowerModeMAX_PSP;
-									pAd->StaCfg.WindowsBatteryPowerMode = Ndis802_11PowerModeMAX_PSP;
-									pAd->StaCfg.DefaultListenCount = 5;
-								}
-								else if ((strcmp(tmpbuf, "Fast_PSP") == 0) || (strcmp(tmpbuf, "fast_psp") == 0)
-									|| (strcmp(tmpbuf, "FAST_PSP") == 0))
-								{
-									// do NOT turn on PSM bit here, wait until MlmeCheckForPsmChange()
-									// to exclude certain situations.
-									//	   MlmeSetPsmBit(pAd, PWR_SAVE);
-									OPSTATUS_SET_FLAG(pAd, fOP_STATUS_RECEIVE_DTIM);
-									if (pAd->StaCfg.bWindowsACCAMEnable == FALSE)
-										pAd->StaCfg.WindowsPowerMode = Ndis802_11PowerModeFast_PSP;
-									pAd->StaCfg.WindowsBatteryPowerMode = Ndis802_11PowerModeFast_PSP;
-									pAd->StaCfg.DefaultListenCount = 3;
-								}
-								else if ((strcmp(tmpbuf, "Legacy_PSP") == 0) || (strcmp(tmpbuf, "legacy_psp") == 0)
-									|| (strcmp(tmpbuf, "LEGACY_PSP") == 0))
-								{
-									// do NOT turn on PSM bit here, wait until MlmeCheckForPsmChange()
-									// to exclude certain situations.
-									//	   MlmeSetPsmBit(pAd, PWR_SAVE);
-									OPSTATUS_SET_FLAG(pAd, fOP_STATUS_RECEIVE_DTIM);
-									if (pAd->StaCfg.bWindowsACCAMEnable == FALSE)
-										pAd->StaCfg.WindowsPowerMode = Ndis802_11PowerModeLegacy_PSP;
-									pAd->StaCfg.WindowsBatteryPowerMode = Ndis802_11PowerModeLegacy_PSP;
-									pAd->StaCfg.DefaultListenCount = 3;
-								}
-								else
-								{ //Default Ndis802_11PowerModeCAM
-									// clear PSM bit immediately
-									MlmeSetPsmBit(pAd, PWR_ACTIVE);
-									OPSTATUS_SET_FLAG(pAd, fOP_STATUS_RECEIVE_DTIM);
-									if (pAd->StaCfg.bWindowsACCAMEnable == FALSE)
-										pAd->StaCfg.WindowsPowerMode = Ndis802_11PowerModeCAM;
-									pAd->StaCfg.WindowsBatteryPowerMode = Ndis802_11PowerModeCAM;
-								}
-								DBGPRINT(RT_DEBUG_TRACE, ("PSMode=%ld\n", pAd->StaCfg.WindowsPowerMode));
-							}
-						}
-						// FastRoaming
-						if (RTMPGetKeyParameter("FastRoaming", tmpbuf, 32, buffer))
-						{
-							if (simple_strtol(tmpbuf, 0, 10) == 0)
-								pAd->StaCfg.bFastRoaming = FALSE;
-							else
-								pAd->StaCfg.bFastRoaming = TRUE;
-
-							DBGPRINT(RT_DEBUG_TRACE, ("FastRoaming=%d\n", pAd->StaCfg.bFastRoaming));
-						}
-						// RoamThreshold
-						if (RTMPGetKeyParameter("RoamThreshold", tmpbuf, 32, buffer))
-						{
-							long lInfo = simple_strtol(tmpbuf, 0, 10);
-
-							if (lInfo > 90 || lInfo < 60)
-								pAd->StaCfg.dBmToRoam = -70;
-							else
-								pAd->StaCfg.dBmToRoam = (CHAR)(-1)*lInfo;
-
-							DBGPRINT(RT_DEBUG_TRACE, ("RoamThreshold=%d  dBm\n", pAd->StaCfg.dBmToRoam));
-						}
-
-						if(RTMPGetKeyParameter("TGnWifiTest", tmpbuf, 10, buffer))
-						{
-							if(simple_strtol(tmpbuf, 0, 10) == 0)
-								pAd->StaCfg.bTGnWifiTest = FALSE;
-							else
-								pAd->StaCfg.bTGnWifiTest = TRUE;
-								DBGPRINT(RT_DEBUG_TRACE, ("TGnWifiTest=%d\n", pAd->StaCfg.bTGnWifiTest));
-						}
-					}
-				}
-			}
-			else
-			{
-				DBGPRINT(RT_DEBUG_TRACE, ("--> %s does not have a write method\n", src));
-			}
-
-			retval=filp_close(srcf,NULL);
-
-			if (retval)
-			{
-				DBGPRINT(RT_DEBUG_TRACE, ("--> Error %d closing %s\n", -retval, src));
-			}
-		}
-	}
-
-	set_fs(orgfs);
-
-	kfree(buffer);
-	kfree(tmpbuf);
-
-	return (NDIS_STATUS_SUCCESS);
-}
-
-static void	HTParametersHook(
-	IN	PRTMP_ADAPTER pAd,
-	IN	CHAR		  *pValueStr,
-	IN	CHAR		  *pInput)
-{
-
-	INT Value;
-
-    if (RTMPGetKeyParameter("HT_PROTECT", pValueStr, 25, pInput))
-    {
-        Value = simple_strtol(pValueStr, 0, 10);
-        if (Value == 0)
-        {
-            pAd->CommonCfg.bHTProtect = FALSE;
-        }
-        else
-        {
-            pAd->CommonCfg.bHTProtect = TRUE;
-        }
-        DBGPRINT(RT_DEBUG_TRACE, ("HT: Protection  = %s\n", (Value==0) ? "Disable" : "Enable"));
-    }
-
-    if (RTMPGetKeyParameter("HT_MIMOPSEnable", pValueStr, 25, pInput))
-    {
-        Value = simple_strtol(pValueStr, 0, 10);
-        if (Value == 0)
-        {
-            pAd->CommonCfg.bMIMOPSEnable = FALSE;
-        }
-        else
-        {
-            pAd->CommonCfg.bMIMOPSEnable = TRUE;
-        }
-        DBGPRINT(RT_DEBUG_TRACE, ("HT: MIMOPSEnable  = %s\n", (Value==0) ? "Disable" : "Enable"));
-    }
-
-
-    if (RTMPGetKeyParameter("HT_MIMOPSMode", pValueStr, 25, pInput))
-    {
-        Value = simple_strtol(pValueStr, 0, 10);
-        if (Value > MMPS_ENABLE)
-        {
-			pAd->CommonCfg.BACapability.field.MMPSmode = MMPS_ENABLE;
-        }
-        else
-        {
-            //TODO: add mimo power saving mechanism
-            pAd->CommonCfg.BACapability.field.MMPSmode = MMPS_ENABLE;
-			//pAd->CommonCfg.BACapability.field.MMPSmode = Value;
-        }
-        DBGPRINT(RT_DEBUG_TRACE, ("HT: MIMOPS Mode  = %d\n", Value));
-    }
-
-    if (RTMPGetKeyParameter("HT_BADecline", pValueStr, 25, pInput))
-    {
-        Value = simple_strtol(pValueStr, 0, 10);
-        if (Value == 0)
-        {
-            pAd->CommonCfg.bBADecline = FALSE;
-        }
-        else
-        {
-            pAd->CommonCfg.bBADecline = TRUE;
-        }
-        DBGPRINT(RT_DEBUG_TRACE, ("HT: BA Decline  = %s\n", (Value==0) ? "Disable" : "Enable"));
-    }
-
-
-    if (RTMPGetKeyParameter("HT_DisableReordering", pValueStr, 25, pInput))
-    {
-        Value = simple_strtol(pValueStr, 0, 10);
-        if (Value == 0)
-        {
-            pAd->CommonCfg.bDisableReordering = FALSE;
-        }
-        else
-        {
-            pAd->CommonCfg.bDisableReordering = TRUE;
-        }
-        DBGPRINT(RT_DEBUG_TRACE, ("HT: DisableReordering  = %s\n", (Value==0) ? "Disable" : "Enable"));
-    }
-
-    if (RTMPGetKeyParameter("HT_AutoBA", pValueStr, 25, pInput))
-    {
-        Value = simple_strtol(pValueStr, 0, 10);
-        if (Value == 0)
-        {
-            pAd->CommonCfg.BACapability.field.AutoBA = FALSE;
-	    pAd->CommonCfg.BACapability.field.Policy = BA_NOTUSE;
-        }
-        else
-        {
-            pAd->CommonCfg.BACapability.field.AutoBA = TRUE;
-	    pAd->CommonCfg.BACapability.field.Policy = IMMED_BA;
-        }
-        pAd->CommonCfg.REGBACapability.field.AutoBA = pAd->CommonCfg.BACapability.field.AutoBA;
-	pAd->CommonCfg.REGBACapability.field.Policy = pAd->CommonCfg.BACapability.field.Policy;
-        DBGPRINT(RT_DEBUG_TRACE, ("HT: Auto BA  = %s\n", (Value==0) ? "Disable" : "Enable"));
-    }
-
-	// Tx_+HTC frame
-    if (RTMPGetKeyParameter("HT_HTC", pValueStr, 25, pInput))
-	{
-		Value = simple_strtol(pValueStr, 0, 10);
-		if (Value == 0)
-		{
-			pAd->HTCEnable = FALSE;
-		}
-		else
-		{
-            		pAd->HTCEnable = TRUE;
-		}
-		DBGPRINT(RT_DEBUG_TRACE, ("HT: Tx +HTC frame = %s\n", (Value==0) ? "Disable" : "Enable"));
-	}
-
-	// Enable HT Link Adaptation Control
-	if (RTMPGetKeyParameter("HT_LinkAdapt", pValueStr, 25, pInput))
-	{
-		Value = simple_strtol(pValueStr, 0, 10);
-		if (Value == 0)
-		{
-			pAd->bLinkAdapt = FALSE;
-		}
-		else
-		{
-			pAd->HTCEnable = TRUE;
-			pAd->bLinkAdapt = TRUE;
-		}
-		DBGPRINT(RT_DEBUG_TRACE, ("HT: Link Adaptation Control = %s\n", (Value==0) ? "Disable" : "Enable(+HTC)"));
-	}
-
-	// Reverse Direction Mechanism
-    if (RTMPGetKeyParameter("HT_RDG", pValueStr, 25, pInput))
-	{
-		Value = simple_strtol(pValueStr, 0, 10);
-		if (Value == 0)
-		{
-			pAd->CommonCfg.bRdg = FALSE;
-		}
-		else
-		{
-			pAd->HTCEnable = TRUE;
-            pAd->CommonCfg.bRdg = TRUE;
-		}
-		DBGPRINT(RT_DEBUG_TRACE, ("HT: RDG = %s\n", (Value==0) ? "Disable" : "Enable(+HTC)"));
-	}
-
-
-
-
-	// Tx A-MSUD ?
-    if (RTMPGetKeyParameter("HT_AMSDU", pValueStr, 25, pInput))
-	{
-		Value = simple_strtol(pValueStr, 0, 10);
-		if (Value == 0)
-		{
-			pAd->CommonCfg.BACapability.field.AmsduEnable = FALSE;
-		}
-		else
-		{
-            pAd->CommonCfg.BACapability.field.AmsduEnable = TRUE;
-		}
-		DBGPRINT(RT_DEBUG_TRACE, ("HT: Tx A-MSDU = %s\n", (Value==0) ? "Disable" : "Enable"));
-	}
-
-	// MPDU Density
-    if (RTMPGetKeyParameter("HT_MpduDensity", pValueStr, 25, pInput))
-	{
-		Value = simple_strtol(pValueStr, 0, 10);
-		if (Value <=7 && Value >= 0)
-		{
-			pAd->CommonCfg.BACapability.field.MpduDensity = Value;
-			DBGPRINT(RT_DEBUG_TRACE, ("HT: MPDU Density = %d\n", Value));
-		}
-		else
-		{
-			pAd->CommonCfg.BACapability.field.MpduDensity = 4;
-			DBGPRINT(RT_DEBUG_TRACE, ("HT: MPDU Density = %d (Default)\n", 4));
-		}
-	}
-
-	// Max Rx BA Window Size
-    if (RTMPGetKeyParameter("HT_BAWinSize", pValueStr, 25, pInput))
-	{
-		Value = simple_strtol(pValueStr, 0, 10);
-
-		if (Value >=1 && Value <= 64)
-		{
-			pAd->CommonCfg.REGBACapability.field.RxBAWinLimit = Value;
-			pAd->CommonCfg.BACapability.field.RxBAWinLimit = Value;
-			DBGPRINT(RT_DEBUG_TRACE, ("HT: BA Windw Size = %d\n", Value));
-		}
-		else
-		{
-            pAd->CommonCfg.REGBACapability.field.RxBAWinLimit = 64;
-			pAd->CommonCfg.BACapability.field.RxBAWinLimit = 64;
-			DBGPRINT(RT_DEBUG_TRACE, ("HT: BA Windw Size = 64 (Defualt)\n"));
-		}
-
-	}
-
-	// Guard Interval
-	if (RTMPGetKeyParameter("HT_GI", pValueStr, 25, pInput))
-	{
-		Value = simple_strtol(pValueStr, 0, 10);
-
-		if (Value == GI_400)
-		{
-			pAd->CommonCfg.RegTransmitSetting.field.ShortGI = GI_400;
-		}
-		else
-		{
-			pAd->CommonCfg.RegTransmitSetting.field.ShortGI = GI_800;
-		}
-
-		DBGPRINT(RT_DEBUG_TRACE, ("HT: Guard Interval = %s\n", (Value==GI_400) ? "400" : "800" ));
-	}
-
-	// HT Operation Mode : Mixed Mode , Green Field
-	if (RTMPGetKeyParameter("HT_OpMode", pValueStr, 25, pInput))
-	{
-		Value = simple_strtol(pValueStr, 0, 10);
-
-		if (Value == HTMODE_GF)
-		{
-
-			pAd->CommonCfg.RegTransmitSetting.field.HTMODE  = HTMODE_GF;
-		}
-		else
-		{
-			pAd->CommonCfg.RegTransmitSetting.field.HTMODE  = HTMODE_MM;
-		}
-
-		DBGPRINT(RT_DEBUG_TRACE, ("HT: Operate Mode = %s\n", (Value==HTMODE_GF) ? "Green Field" : "Mixed Mode" ));
-	}
-
-	// Fixed Tx mode : CCK, OFDM
-	if (RTMPGetKeyParameter("FixedTxMode", pValueStr, 25, pInput))
-	{
-		UCHAR	fix_tx_mode;
-
-		{
-			fix_tx_mode = FIXED_TXMODE_HT;
-
-			if (strcmp(pValueStr, "OFDM") == 0 || strcmp(pValueStr, "ofdm") == 0)
-			{
-				fix_tx_mode = FIXED_TXMODE_OFDM;
-			}
-			else if (strcmp(pValueStr, "CCK") == 0 || strcmp(pValueStr, "cck") == 0)
-			{
-		        fix_tx_mode = FIXED_TXMODE_CCK;
-			}
-			else if (strcmp(pValueStr, "HT") == 0 || strcmp(pValueStr, "ht") == 0)
-			{
-		        fix_tx_mode = FIXED_TXMODE_HT;
-		}
-		else
-		{
-				Value = simple_strtol(pValueStr, 0, 10);
-				// 1 : CCK
-				// 2 : OFDM
-				// otherwise : HT
-				if (Value == FIXED_TXMODE_CCK || Value == FIXED_TXMODE_OFDM)
-					fix_tx_mode = Value;
-				else
-					fix_tx_mode = FIXED_TXMODE_HT;
-		}
-
-			pAd->StaCfg.DesiredTransmitSetting.field.FixedTxMode = fix_tx_mode;
-			DBGPRINT(RT_DEBUG_TRACE, ("Fixed Tx Mode = %d\n", fix_tx_mode));
-
-		}
-	}
-
-
-	// Channel Width
-	if (RTMPGetKeyParameter("HT_BW", pValueStr, 25, pInput))
-	{
-		Value = simple_strtol(pValueStr, 0, 10);
-
-		if (Value == BW_40)
-		{
-			pAd->CommonCfg.RegTransmitSetting.field.BW  = BW_40;
-		}
-		else
-		{
-            pAd->CommonCfg.RegTransmitSetting.field.BW  = BW_20;
-		}
-
-#ifdef MCAST_RATE_SPECIFIC
-		pAd->CommonCfg.MCastPhyMode.field.BW = pAd->CommonCfg.RegTransmitSetting.field.BW;
-#endif // MCAST_RATE_SPECIFIC //
-
-		DBGPRINT(RT_DEBUG_TRACE, ("HT: Channel Width = %s\n", (Value==BW_40) ? "40 MHz" : "20 MHz" ));
-	}
-
-	if (RTMPGetKeyParameter("HT_EXTCHA", pValueStr, 25, pInput))
-	{
-		Value = simple_strtol(pValueStr, 0, 10);
-
-		if (Value == 0)
-		{
-
-			pAd->CommonCfg.RegTransmitSetting.field.EXTCHA  = EXTCHA_BELOW;
-		}
-		else
-		{
-            pAd->CommonCfg.RegTransmitSetting.field.EXTCHA = EXTCHA_ABOVE;
-		}
-
-		DBGPRINT(RT_DEBUG_TRACE, ("HT: Ext Channel = %s\n", (Value==0) ? "BELOW" : "ABOVE" ));
-	}
-
-	// MSC
-	if (RTMPGetKeyParameter("HT_MCS", pValueStr, 50, pInput))
-	{
-		{
-			Value = simple_strtol(pValueStr, 0, 10);
-
-			if ((Value >= 0 && Value <= 23) || (Value == 32)) // 3*3
-		{
-				pAd->StaCfg.DesiredTransmitSetting.field.MCS  = Value;
-				pAd->StaCfg.bAutoTxRateSwitch = FALSE;
-				DBGPRINT(RT_DEBUG_TRACE, ("HT: MCS = %d\n", pAd->StaCfg.DesiredTransmitSetting.field.MCS));
-		}
-		else
-		{
-				pAd->StaCfg.DesiredTransmitSetting.field.MCS  = MCS_AUTO;
-				pAd->StaCfg.bAutoTxRateSwitch = TRUE;
-				DBGPRINT(RT_DEBUG_TRACE, ("HT: MCS = AUTO\n"));
-		}
-	}
-	}
-
-	// STBC
-    if (RTMPGetKeyParameter("HT_STBC", pValueStr, 25, pInput))
-	{
-		Value = simple_strtol(pValueStr, 0, 10);
-		if (Value == STBC_USE)
-		{
-			pAd->CommonCfg.RegTransmitSetting.field.STBC = STBC_USE;
-		}
-		else
-		{
-			pAd->CommonCfg.RegTransmitSetting.field.STBC = STBC_NONE;
-		}
-		DBGPRINT(RT_DEBUG_TRACE, ("HT: STBC = %d\n", pAd->CommonCfg.RegTransmitSetting.field.STBC));
-	}
-
-	// 40_Mhz_Intolerant
-	if (RTMPGetKeyParameter("HT_40MHZ_INTOLERANT", pValueStr, 25, pInput))
-	{
-		Value = simple_strtol(pValueStr, 0, 10);
-		if (Value == 0)
-		{
-			pAd->CommonCfg.bForty_Mhz_Intolerant = FALSE;
-		}
-		else
-		{
-			pAd->CommonCfg.bForty_Mhz_Intolerant = TRUE;
-		}
-		DBGPRINT(RT_DEBUG_TRACE, ("HT: 40MHZ INTOLERANT = %d\n", pAd->CommonCfg.bForty_Mhz_Intolerant));
-	}
-	//HT_TxStream
-	if(RTMPGetKeyParameter("HT_TxStream", pValueStr, 10, pInput))
-	{
-		switch (simple_strtol(pValueStr, 0, 10))
-		{
-			case 1:
-				pAd->CommonCfg.TxStream = 1;
-				break;
-			case 2:
-				pAd->CommonCfg.TxStream = 2;
-				break;
-			case 3: // 3*3
-			default:
-				pAd->CommonCfg.TxStream = 3;
-
-				if (pAd->MACVersion < RALINK_2883_VERSION)
-					pAd->CommonCfg.TxStream = 2; // only 2 tx streams for RT2860 series
-				break;
-		}
-		DBGPRINT(RT_DEBUG_TRACE, ("HT: Tx Stream = %d\n", pAd->CommonCfg.TxStream));
-	}
-	//HT_RxStream
-	if(RTMPGetKeyParameter("HT_RxStream", pValueStr, 10, pInput))
-	{
-		switch (simple_strtol(pValueStr, 0, 10))
-		{
-			case 1:
-				pAd->CommonCfg.RxStream = 1;
-				break;
-			case 2:
-				pAd->CommonCfg.RxStream = 2;
-				break;
-			case 3:
-			default:
-				pAd->CommonCfg.RxStream = 3;
-
-				if (pAd->MACVersion < RALINK_2883_VERSION)
-					pAd->CommonCfg.RxStream = 2; // only 2 rx streams for RT2860 series
-				break;
-		}
-		DBGPRINT(RT_DEBUG_TRACE, ("HT: Rx Stream = %d\n", pAd->CommonCfg.RxStream));
-	}
-
-}
diff --git a/drivers/staging/rt2860/rt_usb.c b/drivers/staging/rt2860/rt_usb.c
new file mode 100644
index 000000000000..01a7eb4e8ba8
--- /dev/null
+++ b/drivers/staging/rt2860/rt_usb.c
@@ -0,0 +1,799 @@
+/*
+ *************************************************************************
+ * Ralink Tech Inc.
+ * 5F., No.36, Taiyuan St., Jhubei City,
+ * Hsinchu County 302,
+ * Taiwan, R.O.C.
+ *
+ * (c) Copyright 2002-2007, Ralink Technology, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify  *
+ * it under the terms of the GNU General Public License as published by  *
+ * the Free Software Foundation; either version 2 of the License, or     *
+ * (at your option) any later version.                                   *
+ *                                                                       *
+ * This program is distributed in the hope that it will be useful,       *
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
+ * GNU General Public License for more details.                          *
+ *                                                                       *
+ * You should have received a copy of the GNU General Public License     *
+ * along with this program; if not, write to the                         *
+ * Free Software Foundation, Inc.,                                       *
+ * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
+ *                                                                       *
+ *************************************************************************
+
+	Module Name:
+	rtusb_bulk.c
+
+	Abstract:
+
+	Revision History:
+	Who			When		What
+	--------	----------	----------------------------------------------
+	Name		Date		Modification logs
+
+*/
+
+#include "rt_config.h"
+
+void dump_urb(struct urb *purb)
+{
+	printk("urb                  :0x%08lx\n", (unsigned long)purb);
+	printk("\tdev                   :0x%08lx\n", (unsigned long)purb->dev);
+	printk("\t\tdev->state          :0x%d\n", purb->dev->state);
+	printk("\tpipe                  :0x%08x\n", purb->pipe);
+	printk("\tstatus                :%d\n", purb->status);
+	printk("\ttransfer_flags        :0x%08x\n", purb->transfer_flags);
+	printk("\ttransfer_buffer       :0x%08lx\n",
+	       (unsigned long)purb->transfer_buffer);
+	printk("\ttransfer_buffer_length:%d\n", purb->transfer_buffer_length);
+	printk("\tactual_length         :%d\n", purb->actual_length);
+	printk("\tsetup_packet          :0x%08lx\n",
+	       (unsigned long)purb->setup_packet);
+	printk("\tstart_frame           :%d\n", purb->start_frame);
+	printk("\tnumber_of_packets     :%d\n", purb->number_of_packets);
+	printk("\tinterval              :%d\n", purb->interval);
+	printk("\terror_count           :%d\n", purb->error_count);
+	printk("\tcontext               :0x%08lx\n",
+	       (unsigned long)purb->context);
+	printk("\tcomplete              :0x%08lx\n\n",
+	       (unsigned long)purb->complete);
+}
+
+/*
+========================================================================
+Routine Description:
+    Create kernel threads & tasklets.
+
+Arguments:
+    *net_dev			Pointer to wireless net device interface
+
+Return Value:
+	NDIS_STATUS_SUCCESS
+	NDIS_STATUS_FAILURE
+
+Note:
+========================================================================
+*/
+int RtmpMgmtTaskInit(struct rt_rtmp_adapter *pAd)
+{
+	struct rt_rtmp_os_task *pTask;
+	int status;
+
+	/*
+	   Creat TimerQ Thread, We need init timerQ related structure before create the timer thread.
+	 */
+	RtmpTimerQInit(pAd);
+
+	pTask = &pAd->timerTask;
+	RtmpOSTaskInit(pTask, "RtmpTimerTask", pAd);
+	status = RtmpOSTaskAttach(pTask, RtmpTimerQThread, pTask);
+	if (status == NDIS_STATUS_FAILURE) {
+		printk(KERN_WARNING "%s: unable to start RtmpTimerQThread\n",
+		       RTMP_OS_NETDEV_GET_DEVNAME(pAd->net_dev));
+		return NDIS_STATUS_FAILURE;
+	}
+
+	/* Creat MLME Thread */
+	pTask = &pAd->mlmeTask;
+	RtmpOSTaskInit(pTask, "RtmpMlmeTask", pAd);
+	status = RtmpOSTaskAttach(pTask, MlmeThread, pTask);
+	if (status == NDIS_STATUS_FAILURE) {
+		printk(KERN_WARNING "%s: unable to start MlmeThread\n",
+		       RTMP_OS_NETDEV_GET_DEVNAME(pAd->net_dev));
+		return NDIS_STATUS_FAILURE;
+	}
+
+	/* Creat Command Thread */
+	pTask = &pAd->cmdQTask;
+	RtmpOSTaskInit(pTask, "RtmpCmdQTask", pAd);
+	status = RtmpOSTaskAttach(pTask, RTUSBCmdThread, pTask);
+	if (status == NDIS_STATUS_FAILURE) {
+		printk(KERN_WARNING "%s: unable to start RTUSBCmdThread\n",
+		       RTMP_OS_NETDEV_GET_DEVNAME(pAd->net_dev));
+		return NDIS_STATUS_FAILURE;
+	}
+
+	return NDIS_STATUS_SUCCESS;
+}
+
+/*
+========================================================================
+Routine Description:
+    Close kernel threads.
+
+Arguments:
+	*pAd				the raxx interface data pointer
+
+Return Value:
+    NONE
+
+Note:
+========================================================================
+*/
+void RtmpMgmtTaskExit(struct rt_rtmp_adapter *pAd)
+{
+	int ret;
+	struct rt_rtmp_os_task *pTask;
+
+	/* Sleep 50 milliseconds so pending io might finish normally */
+	RTMPusecDelay(50000);
+
+	/* We want to wait until all pending receives and sends to the */
+	/* device object. We cancel any */
+	/* irps. Wait until sends and receives have stopped. */
+	RTUSBCancelPendingIRPs(pAd);
+
+	/* We need clear timerQ related structure before exits of the timer thread. */
+	RtmpTimerQExit(pAd);
+
+	/* Terminate Mlme Thread */
+	pTask = &pAd->mlmeTask;
+	ret = RtmpOSTaskKill(pTask);
+	if (ret == NDIS_STATUS_FAILURE) {
+		DBGPRINT(RT_DEBUG_ERROR, ("%s: kill task(%s) failed!\n",
+					  RTMP_OS_NETDEV_GET_DEVNAME(pAd->
+								     net_dev),
+					  pTask->taskName));
+	}
+
+	/* Terminate cmdQ thread */
+	pTask = &pAd->cmdQTask;
+#ifdef KTHREAD_SUPPORT
+	if (pTask->kthread_task)
+#else
+	CHECK_PID_LEGALITY(pTask->taskPID)
+#endif
+	{
+		mb();
+		NdisAcquireSpinLock(&pAd->CmdQLock);
+		pAd->CmdQ.CmdQState = RTMP_TASK_STAT_STOPED;
+		NdisReleaseSpinLock(&pAd->CmdQLock);
+		mb();
+		/*RTUSBCMDUp(pAd); */
+		ret = RtmpOSTaskKill(pTask);
+		if (ret == NDIS_STATUS_FAILURE) {
+			DBGPRINT(RT_DEBUG_ERROR, ("%s: kill task(%s) failed!\n",
+						  RTMP_OS_NETDEV_GET_DEVNAME
+						  (pAd->net_dev),
+						  pTask->taskName));
+		}
+		pAd->CmdQ.CmdQState = RTMP_TASK_STAT_UNKNOWN;
+	}
+
+	/* Terminate timer thread */
+	pTask = &pAd->timerTask;
+	ret = RtmpOSTaskKill(pTask);
+	if (ret == NDIS_STATUS_FAILURE) {
+		DBGPRINT(RT_DEBUG_ERROR, ("%s: kill task(%s) failed!\n",
+					  RTMP_OS_NETDEV_GET_DEVNAME(pAd->
+								     net_dev),
+					  pTask->taskName));
+	}
+
+}
+
+static void rtusb_dataout_complete(unsigned long data)
+{
+	struct rt_rtmp_adapter *pAd;
+	struct urb *pUrb;
+	struct os_cookie *pObj;
+	struct rt_ht_tx_context *pHTTXContext;
+	u8 BulkOutPipeId;
+	int Status;
+	unsigned long IrqFlags;
+
+	pUrb = (struct urb *)data;
+	pHTTXContext = (struct rt_ht_tx_context *)pUrb->context;
+	pAd = pHTTXContext->pAd;
+	pObj = (struct os_cookie *)pAd->OS_Cookie;
+	Status = pUrb->status;
+
+	/* Store BulkOut PipeId */
+	BulkOutPipeId = pHTTXContext->BulkOutPipeId;
+	pAd->BulkOutDataOneSecCount++;
+
+	/*DBGPRINT(RT_DEBUG_LOUD, ("Done-B(%d):I=0x%lx, CWPos=%ld, NBPos=%ld, ENBPos=%ld, bCopy=%d!\n", BulkOutPipeId, in_interrupt(), pHTTXContext->CurWritePosition, */
+	/*              pHTTXContext->NextBulkOutPosition, pHTTXContext->ENextBulkOutPosition, pHTTXContext->bCopySavePad)); */
+
+	RTMP_IRQ_LOCK(&pAd->BulkOutLock[BulkOutPipeId], IrqFlags);
+	pAd->BulkOutPending[BulkOutPipeId] = FALSE;
+	pHTTXContext->IRPPending = FALSE;
+	pAd->watchDogTxPendingCnt[BulkOutPipeId] = 0;
+
+	if (Status == USB_ST_NOERROR) {
+		pAd->BulkOutComplete++;
+
+		RTMP_IRQ_UNLOCK(&pAd->BulkOutLock[BulkOutPipeId], IrqFlags);
+
+		pAd->Counters8023.GoodTransmits++;
+		/*RTMP_IRQ_LOCK(&pAd->TxContextQueueLock[BulkOutPipeId], IrqFlags); */
+		FREE_HTTX_RING(pAd, BulkOutPipeId, pHTTXContext);
+		/*RTMP_IRQ_UNLOCK(&pAd->TxContextQueueLock[BulkOutPipeId], IrqFlags); */
+
+	} else			/* STATUS_OTHER */
+	{
+		u8 *pBuf;
+
+		pAd->BulkOutCompleteOther++;
+
+		pBuf =
+		    &pHTTXContext->TransferBuffer->field.
+		    WirelessPacket[pHTTXContext->NextBulkOutPosition];
+
+		if (!RTMP_TEST_FLAG(pAd, (fRTMP_ADAPTER_RESET_IN_PROGRESS |
+					  fRTMP_ADAPTER_HALT_IN_PROGRESS |
+					  fRTMP_ADAPTER_NIC_NOT_EXIST |
+					  fRTMP_ADAPTER_BULKOUT_RESET))) {
+			RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_BULKOUT_RESET);
+			pAd->bulkResetPipeid = BulkOutPipeId;
+			pAd->bulkResetReq[BulkOutPipeId] = pAd->BulkOutReq;
+		}
+		RTMP_IRQ_UNLOCK(&pAd->BulkOutLock[BulkOutPipeId], IrqFlags);
+
+		DBGPRINT_RAW(RT_DEBUG_ERROR,
+			     ("BulkOutDataPacket failed: ReasonCode=%d!\n",
+			      Status));
+		DBGPRINT_RAW(RT_DEBUG_ERROR,
+			     ("\t>>BulkOut Req=0x%lx, Complete=0x%lx, Other=0x%lx\n",
+			      pAd->BulkOutReq, pAd->BulkOutComplete,
+			      pAd->BulkOutCompleteOther));
+		DBGPRINT_RAW(RT_DEBUG_ERROR,
+			     ("\t>>BulkOut Header:%x %x %x %x %x %x %x %x\n",
+			      pBuf[0], pBuf[1], pBuf[2], pBuf[3], pBuf[4],
+			      pBuf[5], pBuf[6], pBuf[7]));
+		/*DBGPRINT_RAW(RT_DEBUG_ERROR, (">>BulkOutCompleteCancel=0x%x, BulkOutCompleteOther=0x%x\n", pAd->BulkOutCompleteCancel, pAd->BulkOutCompleteOther)); */
+
+	}
+
+	/* */
+	/* bInUse = TRUE, means some process are filling TX data, after that must turn on bWaitingBulkOut */
+	/* bWaitingBulkOut = TRUE, means the TX data are waiting for bulk out. */
+	/* */
+	/*RTMP_IRQ_LOCK(&pAd->TxContextQueueLock[BulkOutPipeId], IrqFlags); */
+	if ((pHTTXContext->ENextBulkOutPosition !=
+	     pHTTXContext->CurWritePosition)
+	    && (pHTTXContext->ENextBulkOutPosition !=
+		(pHTTXContext->CurWritePosition + 8))
+	    && !RTUSB_TEST_BULK_FLAG(pAd,
+				     (fRTUSB_BULK_OUT_DATA_FRAG <<
+				      BulkOutPipeId))) {
+		/* Indicate There is data avaliable */
+		RTUSB_SET_BULK_FLAG(pAd,
+				    (fRTUSB_BULK_OUT_DATA_NORMAL <<
+				     BulkOutPipeId));
+	}
+	/*RTMP_IRQ_UNLOCK(&pAd->TxContextQueueLock[BulkOutPipeId], IrqFlags); */
+
+	/* Always call Bulk routine, even reset bulk. */
+	/* The protection of rest bulk should be in BulkOut routine */
+	RTUSBKickBulkOut(pAd);
+}
+
+static void rtusb_null_frame_done_tasklet(unsigned long data)
+{
+	struct rt_rtmp_adapter *pAd;
+	struct rt_tx_context *pNullContext;
+	struct urb *pUrb;
+	int Status;
+	unsigned long irqFlag;
+
+	pUrb = (struct urb *)data;
+	pNullContext = (struct rt_tx_context *)pUrb->context;
+	pAd = pNullContext->pAd;
+	Status = pUrb->status;
+
+	/* Reset Null frame context flags */
+	RTMP_IRQ_LOCK(&pAd->BulkOutLock[0], irqFlag);
+	pNullContext->IRPPending = FALSE;
+	pNullContext->InUse = FALSE;
+	pAd->BulkOutPending[0] = FALSE;
+	pAd->watchDogTxPendingCnt[0] = 0;
+
+	if (Status == USB_ST_NOERROR) {
+		RTMP_IRQ_UNLOCK(&pAd->BulkOutLock[0], irqFlag);
+
+		RTMPDeQueuePacket(pAd, FALSE, NUM_OF_TX_RING, MAX_TX_PROCESS);
+	} else			/* STATUS_OTHER */
+	{
+		if ((!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RESET_IN_PROGRESS)) &&
+		    (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS)) &&
+		    (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)) &&
+		    (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BULKOUT_RESET))) {
+			DBGPRINT_RAW(RT_DEBUG_ERROR,
+				     ("Bulk Out Null Frame Failed, ReasonCode=%d!\n",
+				      Status));
+			RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_BULKOUT_RESET);
+			pAd->bulkResetPipeid =
+			    (MGMTPIPEIDX | BULKOUT_MGMT_RESET_FLAG);
+			RTMP_IRQ_UNLOCK(&pAd->BulkOutLock[0], irqFlag);
+			RTUSBEnqueueInternalCmd(pAd, CMDTHREAD_RESET_BULK_OUT,
+						NULL, 0);
+		} else {
+			RTMP_IRQ_UNLOCK(&pAd->BulkOutLock[0], irqFlag);
+		}
+	}
+
+	/* Always call Bulk routine, even reset bulk. */
+	/* The protectioon of rest bulk should be in BulkOut routine */
+	RTUSBKickBulkOut(pAd);
+}
+
+static void rtusb_rts_frame_done_tasklet(unsigned long data)
+{
+	struct rt_rtmp_adapter *pAd;
+	struct rt_tx_context *pRTSContext;
+	struct urb *pUrb;
+	int Status;
+	unsigned long irqFlag;
+
+	pUrb = (struct urb *)data;
+	pRTSContext = (struct rt_tx_context *)pUrb->context;
+	pAd = pRTSContext->pAd;
+	Status = pUrb->status;
+
+	/* Reset RTS frame context flags */
+	RTMP_IRQ_LOCK(&pAd->BulkOutLock[0], irqFlag);
+	pRTSContext->IRPPending = FALSE;
+	pRTSContext->InUse = FALSE;
+
+	if (Status == USB_ST_NOERROR) {
+		RTMP_IRQ_UNLOCK(&pAd->BulkOutLock[0], irqFlag);
+		RTMPDeQueuePacket(pAd, FALSE, NUM_OF_TX_RING, MAX_TX_PROCESS);
+	} else			/* STATUS_OTHER */
+	{
+		if ((!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RESET_IN_PROGRESS)) &&
+		    (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS)) &&
+		    (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)) &&
+		    (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BULKOUT_RESET))) {
+			DBGPRINT_RAW(RT_DEBUG_ERROR,
+				     ("Bulk Out RTS Frame Failed\n"));
+			RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_BULKOUT_RESET);
+			pAd->bulkResetPipeid =
+			    (MGMTPIPEIDX | BULKOUT_MGMT_RESET_FLAG);
+			RTMP_IRQ_UNLOCK(&pAd->BulkOutLock[0], irqFlag);
+			RTUSBEnqueueInternalCmd(pAd, CMDTHREAD_RESET_BULK_OUT,
+						NULL, 0);
+		} else {
+			RTMP_IRQ_UNLOCK(&pAd->BulkOutLock[0], irqFlag);
+		}
+	}
+
+	RTMP_SEM_LOCK(&pAd->BulkOutLock[pRTSContext->BulkOutPipeId]);
+	pAd->BulkOutPending[pRTSContext->BulkOutPipeId] = FALSE;
+	RTMP_SEM_UNLOCK(&pAd->BulkOutLock[pRTSContext->BulkOutPipeId]);
+
+	/* Always call Bulk routine, even reset bulk. */
+	/* The protectioon of rest bulk should be in BulkOut routine */
+	RTUSBKickBulkOut(pAd);
+
+}
+
+static void rtusb_pspoll_frame_done_tasklet(unsigned long data)
+{
+	struct rt_rtmp_adapter *pAd;
+	struct rt_tx_context *pPsPollContext;
+	struct urb *pUrb;
+	int Status;
+
+	pUrb = (struct urb *)data;
+	pPsPollContext = (struct rt_tx_context *)pUrb->context;
+	pAd = pPsPollContext->pAd;
+	Status = pUrb->status;
+
+	/* Reset PsPoll context flags */
+	pPsPollContext->IRPPending = FALSE;
+	pPsPollContext->InUse = FALSE;
+	pAd->watchDogTxPendingCnt[0] = 0;
+
+	if (Status == USB_ST_NOERROR) {
+		RTMPDeQueuePacket(pAd, FALSE, NUM_OF_TX_RING, MAX_TX_PROCESS);
+	} else			/* STATUS_OTHER */
+	{
+		if ((!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RESET_IN_PROGRESS)) &&
+		    (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS)) &&
+		    (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)) &&
+		    (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BULKOUT_RESET))) {
+			DBGPRINT_RAW(RT_DEBUG_ERROR,
+				     ("Bulk Out PSPoll Failed\n"));
+			RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_BULKOUT_RESET);
+			pAd->bulkResetPipeid =
+			    (MGMTPIPEIDX | BULKOUT_MGMT_RESET_FLAG);
+			RTUSBEnqueueInternalCmd(pAd, CMDTHREAD_RESET_BULK_OUT,
+						NULL, 0);
+		}
+	}
+
+	RTMP_SEM_LOCK(&pAd->BulkOutLock[0]);
+	pAd->BulkOutPending[0] = FALSE;
+	RTMP_SEM_UNLOCK(&pAd->BulkOutLock[0]);
+
+	/* Always call Bulk routine, even reset bulk. */
+	/* The protectioon of rest bulk should be in BulkOut routine */
+	RTUSBKickBulkOut(pAd);
+
+}
+
+/*
+========================================================================
+Routine Description:
+    Handle received packets.
+
+Arguments:
+	data				- URB information pointer
+
+Return Value:
+    None
+
+Note:
+========================================================================
+*/
+static void rx_done_tasklet(unsigned long data)
+{
+	struct urb *pUrb;
+	struct rt_rx_context *pRxContext;
+	struct rt_rtmp_adapter *pAd;
+	int Status;
+	unsigned int IrqFlags;
+
+	pUrb = (struct urb *)data;
+	pRxContext = (struct rt_rx_context *)pUrb->context;
+	pAd = pRxContext->pAd;
+	Status = pUrb->status;
+
+	RTMP_IRQ_LOCK(&pAd->BulkInLock, IrqFlags);
+	pRxContext->InUse = FALSE;
+	pRxContext->IRPPending = FALSE;
+	pRxContext->BulkInOffset += pUrb->actual_length;
+	/*NdisInterlockedDecrement(&pAd->PendingRx); */
+	pAd->PendingRx--;
+
+	if (Status == USB_ST_NOERROR) {
+		pAd->BulkInComplete++;
+		pAd->NextRxBulkInPosition = 0;
+		if (pRxContext->BulkInOffset)	/* As jan's comment, it may bulk-in success but size is zero. */
+		{
+			pRxContext->Readable = TRUE;
+			INC_RING_INDEX(pAd->NextRxBulkInIndex, RX_RING_SIZE);
+		}
+		RTMP_IRQ_UNLOCK(&pAd->BulkInLock, IrqFlags);
+	} else			/* STATUS_OTHER */
+	{
+		pAd->BulkInCompleteFail++;
+		/* Still read this packet although it may comtain wrong bytes. */
+		pRxContext->Readable = FALSE;
+		RTMP_IRQ_UNLOCK(&pAd->BulkInLock, IrqFlags);
+
+		/* Parsing all packets. because after reset, the index will reset to all zero. */
+		if ((!RTMP_TEST_FLAG(pAd, (fRTMP_ADAPTER_RESET_IN_PROGRESS |
+					   fRTMP_ADAPTER_BULKIN_RESET |
+					   fRTMP_ADAPTER_HALT_IN_PROGRESS |
+					   fRTMP_ADAPTER_NIC_NOT_EXIST)))) {
+
+			DBGPRINT_RAW(RT_DEBUG_ERROR,
+				     ("Bulk In Failed. Status=%d, BIIdx=0x%x, BIRIdx=0x%x, actual_length= 0x%x\n",
+				      Status, pAd->NextRxBulkInIndex,
+				      pAd->NextRxBulkInReadIndex,
+				      pRxContext->pUrb->actual_length));
+
+			RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_BULKIN_RESET);
+			RTUSBEnqueueInternalCmd(pAd, CMDTHREAD_RESET_BULK_IN,
+						NULL, 0);
+		}
+	}
+
+	ASSERT((pRxContext->InUse == pRxContext->IRPPending));
+
+	RTUSBBulkReceive(pAd);
+
+	return;
+
+}
+
+static void rtusb_mgmt_dma_done_tasklet(unsigned long data)
+{
+	struct rt_rtmp_adapter *pAd;
+	struct rt_tx_context *pMLMEContext;
+	int index;
+	void *pPacket;
+	struct urb *pUrb;
+	int Status;
+	unsigned long IrqFlags;
+
+	pUrb = (struct urb *)data;
+	pMLMEContext = (struct rt_tx_context *)pUrb->context;
+	pAd = pMLMEContext->pAd;
+	Status = pUrb->status;
+	index = pMLMEContext->SelfIdx;
+
+	ASSERT((pAd->MgmtRing.TxDmaIdx == index));
+
+	RTMP_IRQ_LOCK(&pAd->BulkOutLock[MGMTPIPEIDX], IrqFlags);
+
+	if (Status != USB_ST_NOERROR) {
+		/*Bulk-Out fail status handle */
+		if ((!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RESET_IN_PROGRESS)) &&
+		    (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS)) &&
+		    (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)) &&
+		    (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BULKOUT_RESET))) {
+			DBGPRINT_RAW(RT_DEBUG_ERROR,
+				     ("Bulk Out MLME Failed, Status=%d!\n",
+				      Status));
+			/* TODO: How to handle about the MLMEBulkOut failed issue. Need to resend the mgmt pkt? */
+			RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_BULKOUT_RESET);
+			pAd->bulkResetPipeid =
+			    (MGMTPIPEIDX | BULKOUT_MGMT_RESET_FLAG);
+		}
+	}
+
+	pAd->BulkOutPending[MGMTPIPEIDX] = FALSE;
+	RTMP_IRQ_UNLOCK(&pAd->BulkOutLock[MGMTPIPEIDX], IrqFlags);
+
+	RTMP_IRQ_LOCK(&pAd->MLMEBulkOutLock, IrqFlags);
+	/* Reset MLME context flags */
+	pMLMEContext->IRPPending = FALSE;
+	pMLMEContext->InUse = FALSE;
+	pMLMEContext->bWaitingBulkOut = FALSE;
+	pMLMEContext->BulkOutSize = 0;
+
+	pPacket = pAd->MgmtRing.Cell[index].pNdisPacket;
+	pAd->MgmtRing.Cell[index].pNdisPacket = NULL;
+
+	/* Increase MgmtRing Index */
+	INC_RING_INDEX(pAd->MgmtRing.TxDmaIdx, MGMT_RING_SIZE);
+	pAd->MgmtRing.TxSwFreeIdx++;
+	RTMP_IRQ_UNLOCK(&pAd->MLMEBulkOutLock, IrqFlags);
+
+	/* No-matter success or fail, we free the mgmt packet. */
+	if (pPacket)
+		RTMPFreeNdisPacket(pAd, pPacket);
+
+	if ((RTMP_TEST_FLAG(pAd, (fRTMP_ADAPTER_RESET_IN_PROGRESS |
+				  fRTMP_ADAPTER_HALT_IN_PROGRESS |
+				  fRTMP_ADAPTER_NIC_NOT_EXIST)))) {
+		/* do nothing and return directly. */
+	} else {
+		if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BULKOUT_RESET) && ((pAd->bulkResetPipeid & BULKOUT_MGMT_RESET_FLAG) == BULKOUT_MGMT_RESET_FLAG)) {	/* For Mgmt Bulk-Out failed, ignore it now. */
+			RTUSBEnqueueInternalCmd(pAd, CMDTHREAD_RESET_BULK_OUT,
+						NULL, 0);
+		} else {
+
+			/* Always call Bulk routine, even reset bulk. */
+			/* The protectioon of rest bulk should be in BulkOut routine */
+			if (pAd->MgmtRing.TxSwFreeIdx <
+			    MGMT_RING_SIZE
+			    /* pMLMEContext->bWaitingBulkOut == TRUE */ ) {
+				RTUSB_SET_BULK_FLAG(pAd, fRTUSB_BULK_OUT_MLME);
+			}
+			RTUSBKickBulkOut(pAd);
+		}
+	}
+
+}
+
+static void rtusb_ac3_dma_done_tasklet(unsigned long data)
+{
+	struct rt_rtmp_adapter *pAd;
+	struct rt_ht_tx_context *pHTTXContext;
+	u8 BulkOutPipeId = 3;
+	struct urb *pUrb;
+
+	pUrb = (struct urb *)data;
+	pHTTXContext = (struct rt_ht_tx_context *)pUrb->context;
+	pAd = pHTTXContext->pAd;
+
+	rtusb_dataout_complete((unsigned long)pUrb);
+
+	if ((RTMP_TEST_FLAG(pAd, (fRTMP_ADAPTER_RESET_IN_PROGRESS |
+				  fRTMP_ADAPTER_HALT_IN_PROGRESS |
+				  fRTMP_ADAPTER_NIC_NOT_EXIST)))) {
+		/* do nothing and return directly. */
+	} else {
+		if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BULKOUT_RESET)) {
+			RTUSBEnqueueInternalCmd(pAd, CMDTHREAD_RESET_BULK_OUT,
+						NULL, 0);
+		} else {
+			pHTTXContext = &pAd->TxContext[BulkOutPipeId];
+			if ((pAd->TxSwQueue[BulkOutPipeId].Number > 0) &&
+			    /*((pHTTXContext->CurWritePosition > (pHTTXContext->NextBulkOutPosition + 0x6000)) || (pHTTXContext->NextBulkOutPosition > pHTTXContext->CurWritePosition + 0x6000)) && */
+			    (pAd->DeQueueRunning[BulkOutPipeId] == FALSE) &&
+			    (pHTTXContext->bCurWriting == FALSE)) {
+				RTMPDeQueuePacket(pAd, FALSE, BulkOutPipeId,
+						  MAX_TX_PROCESS);
+			}
+
+			RTUSB_SET_BULK_FLAG(pAd,
+					    fRTUSB_BULK_OUT_DATA_NORMAL << 3);
+			RTUSBKickBulkOut(pAd);
+		}
+	}
+
+	return;
+}
+
+static void rtusb_ac2_dma_done_tasklet(unsigned long data)
+{
+	struct rt_rtmp_adapter *pAd;
+	struct rt_ht_tx_context *pHTTXContext;
+	u8 BulkOutPipeId = 2;
+	struct urb *pUrb;
+
+	pUrb = (struct urb *)data;
+	pHTTXContext = (struct rt_ht_tx_context *)pUrb->context;
+	pAd = pHTTXContext->pAd;
+
+	rtusb_dataout_complete((unsigned long)pUrb);
+
+	if ((RTMP_TEST_FLAG(pAd, (fRTMP_ADAPTER_RESET_IN_PROGRESS |
+				  fRTMP_ADAPTER_HALT_IN_PROGRESS |
+				  fRTMP_ADAPTER_NIC_NOT_EXIST)))) {
+		/* do nothing and return directly. */
+	} else {
+		if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BULKOUT_RESET)) {
+			RTUSBEnqueueInternalCmd(pAd, CMDTHREAD_RESET_BULK_OUT,
+						NULL, 0);
+		} else {
+			pHTTXContext = &pAd->TxContext[BulkOutPipeId];
+			if ((pAd->TxSwQueue[BulkOutPipeId].Number > 0) &&
+			    /*((pHTTXContext->CurWritePosition > (pHTTXContext->NextBulkOutPosition + 0x6000)) || (pHTTXContext->NextBulkOutPosition > pHTTXContext->CurWritePosition + 0x6000)) && */
+			    (pAd->DeQueueRunning[BulkOutPipeId] == FALSE) &&
+			    (pHTTXContext->bCurWriting == FALSE)) {
+				RTMPDeQueuePacket(pAd, FALSE, BulkOutPipeId,
+						  MAX_TX_PROCESS);
+			}
+
+			RTUSB_SET_BULK_FLAG(pAd,
+					    fRTUSB_BULK_OUT_DATA_NORMAL << 2);
+			RTUSBKickBulkOut(pAd);
+		}
+	}
+
+	return;
+}
+
+static void rtusb_ac1_dma_done_tasklet(unsigned long data)
+{
+	struct rt_rtmp_adapter *pAd;
+	struct rt_ht_tx_context *pHTTXContext;
+	u8 BulkOutPipeId = 1;
+	struct urb *pUrb;
+
+	pUrb = (struct urb *)data;
+	pHTTXContext = (struct rt_ht_tx_context *)pUrb->context;
+	pAd = pHTTXContext->pAd;
+
+	rtusb_dataout_complete((unsigned long)pUrb);
+
+	if ((RTMP_TEST_FLAG(pAd, (fRTMP_ADAPTER_RESET_IN_PROGRESS |
+				  fRTMP_ADAPTER_HALT_IN_PROGRESS |
+				  fRTMP_ADAPTER_NIC_NOT_EXIST)))) {
+		/* do nothing and return directly. */
+	} else {
+		if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BULKOUT_RESET)) {
+			RTUSBEnqueueInternalCmd(pAd, CMDTHREAD_RESET_BULK_OUT,
+						NULL, 0);
+		} else {
+			pHTTXContext = &pAd->TxContext[BulkOutPipeId];
+			if ((pAd->TxSwQueue[BulkOutPipeId].Number > 0) &&
+			    /*((pHTTXContext->CurWritePosition > (pHTTXContext->NextBulkOutPosition + 0x6000)) || (pHTTXContext->NextBulkOutPosition > pHTTXContext->CurWritePosition + 0x6000)) && */
+			    (pAd->DeQueueRunning[BulkOutPipeId] == FALSE) &&
+			    (pHTTXContext->bCurWriting == FALSE)) {
+				RTMPDeQueuePacket(pAd, FALSE, BulkOutPipeId,
+						  MAX_TX_PROCESS);
+			}
+
+			RTUSB_SET_BULK_FLAG(pAd,
+					    fRTUSB_BULK_OUT_DATA_NORMAL << 1);
+			RTUSBKickBulkOut(pAd);
+		}
+	}
+	return;
+
+}
+
+static void rtusb_ac0_dma_done_tasklet(unsigned long data)
+{
+	struct rt_rtmp_adapter *pAd;
+	struct rt_ht_tx_context *pHTTXContext;
+	u8 BulkOutPipeId = 0;
+	struct urb *pUrb;
+
+	pUrb = (struct urb *)data;
+	pHTTXContext = (struct rt_ht_tx_context *)pUrb->context;
+	pAd = pHTTXContext->pAd;
+
+	rtusb_dataout_complete((unsigned long)pUrb);
+
+	if ((RTMP_TEST_FLAG(pAd, (fRTMP_ADAPTER_RESET_IN_PROGRESS |
+				  fRTMP_ADAPTER_HALT_IN_PROGRESS |
+				  fRTMP_ADAPTER_NIC_NOT_EXIST)))) {
+		/* do nothing and return directly. */
+	} else {
+		if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BULKOUT_RESET)) {
+			RTUSBEnqueueInternalCmd(pAd, CMDTHREAD_RESET_BULK_OUT,
+						NULL, 0);
+		} else {
+			pHTTXContext = &pAd->TxContext[BulkOutPipeId];
+			if ((pAd->TxSwQueue[BulkOutPipeId].Number > 0) &&
+			    /*  ((pHTTXContext->CurWritePosition > (pHTTXContext->NextBulkOutPosition + 0x6000)) || (pHTTXContext->NextBulkOutPosition > pHTTXContext->CurWritePosition + 0x6000)) && */
+			    (pAd->DeQueueRunning[BulkOutPipeId] == FALSE) &&
+			    (pHTTXContext->bCurWriting == FALSE)) {
+				RTMPDeQueuePacket(pAd, FALSE, BulkOutPipeId,
+						  MAX_TX_PROCESS);
+			}
+
+			RTUSB_SET_BULK_FLAG(pAd, fRTUSB_BULK_OUT_DATA_NORMAL);
+			RTUSBKickBulkOut(pAd);
+		}
+	}
+
+	return;
+
+}
+
+int RtmpNetTaskInit(struct rt_rtmp_adapter *pAd)
+{
+	struct os_cookie *pObj = (struct os_cookie *)pAd->OS_Cookie;
+
+	/* Create receive tasklet */
+	tasklet_init(&pObj->rx_done_task, rx_done_tasklet, (unsigned long)pAd);
+	tasklet_init(&pObj->mgmt_dma_done_task, rtusb_mgmt_dma_done_tasklet,
+		     (unsigned long)pAd);
+	tasklet_init(&pObj->ac0_dma_done_task, rtusb_ac0_dma_done_tasklet,
+		     (unsigned long)pAd);
+	tasklet_init(&pObj->ac1_dma_done_task, rtusb_ac1_dma_done_tasklet,
+		     (unsigned long)pAd);
+	tasklet_init(&pObj->ac2_dma_done_task, rtusb_ac2_dma_done_tasklet,
+		     (unsigned long)pAd);
+	tasklet_init(&pObj->ac3_dma_done_task, rtusb_ac3_dma_done_tasklet,
+		     (unsigned long)pAd);
+	tasklet_init(&pObj->tbtt_task, tbtt_tasklet, (unsigned long)pAd);
+	tasklet_init(&pObj->null_frame_complete_task,
+		     rtusb_null_frame_done_tasklet, (unsigned long)pAd);
+	tasklet_init(&pObj->rts_frame_complete_task,
+		     rtusb_rts_frame_done_tasklet, (unsigned long)pAd);
+	tasklet_init(&pObj->pspoll_frame_complete_task,
+		     rtusb_pspoll_frame_done_tasklet, (unsigned long)pAd);
+
+	return NDIS_STATUS_SUCCESS;
+}
+
+void RtmpNetTaskExit(struct rt_rtmp_adapter *pAd)
+{
+	struct os_cookie *pObj;
+
+	pObj = (struct os_cookie *)pAd->OS_Cookie;
+
+	tasklet_kill(&pObj->rx_done_task);
+	tasklet_kill(&pObj->mgmt_dma_done_task);
+	tasklet_kill(&pObj->ac0_dma_done_task);
+	tasklet_kill(&pObj->ac1_dma_done_task);
+	tasklet_kill(&pObj->ac2_dma_done_task);
+	tasklet_kill(&pObj->ac3_dma_done_task);
+	tasklet_kill(&pObj->tbtt_task);
+	tasklet_kill(&pObj->null_frame_complete_task);
+	tasklet_kill(&pObj->rts_frame_complete_task);
+	tasklet_kill(&pObj->pspoll_frame_complete_task);
+}
diff --git a/drivers/staging/rt2860/rtmp.h b/drivers/staging/rt2860/rtmp.h
index 90fd40f24734..c50abf4b8068 100644
--- a/drivers/staging/rt2860/rtmp.h
+++ b/drivers/staging/rt2860/rtmp.h
@@ -41,269 +41,135 @@
 #define __RTMP_H__
 
 #include "spectrum_def.h"
+#include "rtmp_dot11.h"
+#include "rtmp_chip.h"
 
-#include "aironet.h"
+struct rt_rtmp_adapter;
 
-#define VIRTUAL_IF_INC(__pAd) ((__pAd)->VirtualIfCnt++)
-#define VIRTUAL_IF_DEC(__pAd) ((__pAd)->VirtualIfCnt--)
-#define VIRTUAL_IF_NUM(__pAd) ((__pAd)->VirtualIfCnt)
-
-#ifdef RT2870
-////////////////////////////////////////////////////////////////////////////
-// The TX_BUFFER structure forms the transmitted USB packet to the device
-////////////////////////////////////////////////////////////////////////////
-typedef struct __TX_BUFFER{
-	union	{
-		UCHAR			WirelessPacket[TX_BUFFER_NORMSIZE];
-		HEADER_802_11	NullFrame;
-		PSPOLL_FRAME	PsPollPacket;
-		RTS_FRAME		RTSFrame;
-	}field;
-	UCHAR			Aggregation[4];  //Buffer for save Aggregation size.
-} TX_BUFFER, *PTX_BUFFER;
-
-typedef struct __HTTX_BUFFER{
-	union	{
-		UCHAR			WirelessPacket[MAX_TXBULK_SIZE];
-		HEADER_802_11	NullFrame;
-		PSPOLL_FRAME	PsPollPacket;
-		RTS_FRAME		RTSFrame;
-	}field;
-	UCHAR			Aggregation[4];  //Buffer for save Aggregation size.
-} HTTX_BUFFER, *PHTTX_BUFFER;
-
-
-// used to track driver-generated write irps
-typedef struct _TX_CONTEXT
-{
-	PVOID			pAd;		//Initialized in MiniportInitialize
-	PURB			pUrb;			//Initialized in MiniportInitialize
-	PIRP			pIrp;			//used to cancel pending bulk out.
-									//Initialized in MiniportInitialize
-	PTX_BUFFER		TransferBuffer;	//Initialized in MiniportInitialize
-	ULONG			BulkOutSize;
-	UCHAR			BulkOutPipeId;
-	UCHAR			SelfIdx;
-	BOOLEAN			InUse;
-	BOOLEAN			bWaitingBulkOut; // at least one packet is in this TxContext, ready for making IRP anytime.
-	BOOLEAN			bFullForBulkOut; // all tx buffer are full , so waiting for tx bulkout.
-	BOOLEAN			IRPPending;
-	BOOLEAN			LastOne;
-	BOOLEAN			bAggregatible;
-	UCHAR			Header_802_3[LENGTH_802_3];
-	UCHAR			Rsv[2];
-	ULONG			DataOffset;
-	UINT			TxRate;
-	dma_addr_t		data_dma;		// urb dma on linux
-
-}	TX_CONTEXT, *PTX_CONTEXT, **PPTX_CONTEXT;
-
-
-// used to track driver-generated write irps
-typedef struct _HT_TX_CONTEXT
-{
-	PVOID			pAd;		//Initialized in MiniportInitialize
-	PURB			pUrb;			//Initialized in MiniportInitialize
-	PIRP			pIrp;			//used to cancel pending bulk out.
-									//Initialized in MiniportInitialize
-	PHTTX_BUFFER	TransferBuffer;	//Initialized in MiniportInitialize
-	ULONG			BulkOutSize;	// Indicate the total bulk-out size in bytes in one bulk-transmission
-	UCHAR			BulkOutPipeId;
-	BOOLEAN			IRPPending;
-	BOOLEAN			LastOne;
-	BOOLEAN			bCurWriting;
-	BOOLEAN			bRingEmpty;
-	BOOLEAN			bCopySavePad;
-	UCHAR			SavedPad[8];
-	UCHAR			Header_802_3[LENGTH_802_3];
-	ULONG			CurWritePosition;		// Indicate the buffer offset which packet will be inserted start from.
-	ULONG			CurWriteRealPos;		// Indicate the buffer offset which packet now are writing to.
-	ULONG			NextBulkOutPosition;	// Indicate the buffer start offset of a bulk-transmission
-	ULONG			ENextBulkOutPosition;	// Indicate the buffer end offset of a bulk-transmission
-	UINT			TxRate;
-	dma_addr_t		data_dma;		// urb dma on linux
-}	HT_TX_CONTEXT, *PHT_TX_CONTEXT, **PPHT_TX_CONTEXT;
-
-
-//
-// Structure to keep track of receive packets and buffers to indicate
-// receive data to the protocol.
-//
-typedef struct _RX_CONTEXT
-{
-	PUCHAR				TransferBuffer;
-	PVOID				pAd;
-	PIRP				pIrp;//used to cancel pending bulk in.
-	PURB				pUrb;
-	//These 2 Boolean shouldn't both be 1 at the same time.
-	ULONG				BulkInOffset;	// number of packets waiting for reordering .
-	BOOLEAN				bRxHandling;	// Notify this packet is being process now.
-	BOOLEAN				InUse;			// USB Hardware Occupied. Wait for USB HW to put packet.
-	BOOLEAN				Readable;		// Receive Complete back. OK for driver to indicate receiving packet.
-	BOOLEAN				IRPPending;		// TODO: To be removed
-	atomic_t			IrpLock;
-	NDIS_SPIN_LOCK		RxContextLock;
-	dma_addr_t			data_dma;		// urb dma on linux
-}	RX_CONTEXT, *PRX_CONTEXT;
-#endif // RT2870 //
-
-
-//
-//  NDIS Version definitions
-//
-#ifdef  NDIS50_MINIPORT
-#define RTMP_NDIS_MAJOR_VERSION     5
-#define RTMP_NDIS_MINOR_VERSION     0
-#endif
+/*#define DBG           1 */
 
-#ifdef  NDIS51_MINIPORT
-#define RTMP_NDIS_MAJOR_VERSION     5
-#define RTMP_NDIS_MINOR_VERSION     1
-#endif
+/*#define DBG_DIAGNOSE          1 */
 
-extern  char    NIC_VENDOR_DESC[];
-extern  int     NIC_VENDOR_DESC_LEN;
-
-extern  unsigned char   SNAP_AIRONET[];
-extern  unsigned char   CipherSuiteCiscoCCKM[];
-extern  unsigned char   CipherSuiteCiscoCCKMLen;
-extern	unsigned char	CipherSuiteCiscoCCKM24[];
-extern	unsigned char	CipherSuiteCiscoCCKM24Len;
-extern  unsigned char   CipherSuiteCCXTkip[];
-extern  unsigned char   CipherSuiteCCXTkipLen;
-extern  unsigned char   CISCO_OUI[];
-extern  UCHAR	BaSizeArray[4];
-
-extern UCHAR BROADCAST_ADDR[MAC_ADDR_LEN];
-extern UCHAR MULTICAST_ADDR[MAC_ADDR_LEN];
-extern UCHAR ZERO_MAC_ADDR[MAC_ADDR_LEN];
-extern ULONG BIT32[32];
-extern UCHAR BIT8[8];
-extern char* CipherName[];
-extern char* MCSToMbps[];
-extern UCHAR	 RxwiMCSToOfdmRate[12];
-extern UCHAR SNAP_802_1H[6];
-extern UCHAR SNAP_BRIDGE_TUNNEL[6];
-extern UCHAR SNAP_AIRONET[8];
-extern UCHAR CKIP_LLC_SNAP[8];
-extern UCHAR EAPOL_LLC_SNAP[8];
-extern UCHAR EAPOL[2];
-extern UCHAR IPX[2];
-extern UCHAR APPLE_TALK[2];
-extern UCHAR RateIdToPlcpSignal[12]; // see IEEE802.11a-1999 p.14
-extern UCHAR	 OfdmRateToRxwiMCS[];
-extern UCHAR OfdmSignalToRateId[16] ;
-extern UCHAR default_cwmin[4];
-extern UCHAR default_cwmax[4];
-extern UCHAR default_sta_aifsn[4];
-extern UCHAR MapUserPriorityToAccessCategory[8];
-
-extern USHORT RateUpPER[];
-extern USHORT RateDownPER[];
-extern UCHAR  Phy11BNextRateDownward[];
-extern UCHAR  Phy11BNextRateUpward[];
-extern UCHAR  Phy11BGNextRateDownward[];
-extern UCHAR  Phy11BGNextRateUpward[];
-extern UCHAR  Phy11ANextRateDownward[];
-extern UCHAR  Phy11ANextRateUpward[];
-extern CHAR   RssiSafeLevelForTxRate[];
-extern UCHAR  RateIdToMbps[];
-extern USHORT RateIdTo500Kbps[];
-
-extern UCHAR  CipherSuiteWpaNoneTkip[];
-extern UCHAR  CipherSuiteWpaNoneTkipLen;
-
-extern UCHAR  CipherSuiteWpaNoneAes[];
-extern UCHAR  CipherSuiteWpaNoneAesLen;
-
-extern UCHAR  SsidIe;
-extern UCHAR  SupRateIe;
-extern UCHAR  ExtRateIe;
-
-extern UCHAR  HtCapIe;
-extern UCHAR  AddHtInfoIe;
-extern UCHAR  NewExtChanIe;
-
-extern UCHAR  ErpIe;
-extern UCHAR  DsIe;
-extern UCHAR  TimIe;
-extern UCHAR  WpaIe;
-extern UCHAR  Wpa2Ie;
-extern UCHAR  IbssIe;
-extern UCHAR  Ccx2Ie;
-
-extern UCHAR  WPA_OUI[];
-extern UCHAR  RSN_OUI[];
-extern UCHAR  WME_INFO_ELEM[];
-extern UCHAR  WME_PARM_ELEM[];
-extern UCHAR  Ccx2QosInfo[];
-extern UCHAR  Ccx2IeInfo[];
-extern UCHAR  RALINK_OUI[];
-extern UCHAR  PowerConstraintIE[];
-
-
-extern UCHAR  RateSwitchTable[];
-extern UCHAR  RateSwitchTable11B[];
-extern UCHAR  RateSwitchTable11G[];
-extern UCHAR  RateSwitchTable11BG[];
-
-extern UCHAR  RateSwitchTable11BGN1S[];
-extern UCHAR  RateSwitchTable11BGN2S[];
-extern UCHAR  RateSwitchTable11BGN2SForABand[];
-extern UCHAR  RateSwitchTable11N1S[];
-extern UCHAR  RateSwitchTable11N2S[];
-extern UCHAR  RateSwitchTable11N2SForABand[];
-
-extern UCHAR  PRE_N_HT_OUI[];
+/*+++Add by shiang for merge MiniportMMRequest() and MiniportDataMMRequest() into one function */
+#define MAX_DATAMM_RETRY	3
+#define MGMT_USE_QUEUE_FLAG	0x80
+/*---Add by shiang for merge MiniportMMRequest() and MiniportDataMMRequest() into one function */
 
 #define	MAXSEQ		(0xFFF)
 
-struct reordering_mpdu
-{
-	struct reordering_mpdu	*next;
-	PNDIS_PACKET			pPacket;		/* coverted to 802.3 frame */
-	int						Sequence;		/* sequence number of MPDU */
-	BOOLEAN					bAMSDU;
+extern unsigned char SNAP_AIRONET[];
+extern unsigned char CISCO_OUI[];
+extern u8 BaSizeArray[4];
+
+extern u8 BROADCAST_ADDR[MAC_ADDR_LEN];
+extern u8 ZERO_MAC_ADDR[MAC_ADDR_LEN];
+extern unsigned long BIT32[32];
+extern u8 BIT8[8];
+extern char *CipherName[];
+extern char *MCSToMbps[];
+extern u8 RxwiMCSToOfdmRate[12];
+extern u8 SNAP_802_1H[6];
+extern u8 SNAP_BRIDGE_TUNNEL[6];
+extern u8 SNAP_AIRONET[8];
+extern u8 CKIP_LLC_SNAP[8];
+extern u8 EAPOL_LLC_SNAP[8];
+extern u8 EAPOL[2];
+extern u8 IPX[2];
+extern u8 APPLE_TALK[2];
+extern u8 RateIdToPlcpSignal[12];	/* see IEEE802.11a-1999 p.14 */
+extern u8 OfdmRateToRxwiMCS[];
+extern u8 OfdmSignalToRateId[16];
+extern u8 default_cwmin[4];
+extern u8 default_cwmax[4];
+extern u8 default_sta_aifsn[4];
+extern u8 MapUserPriorityToAccessCategory[8];
+
+extern u16 RateUpPER[];
+extern u16 RateDownPER[];
+extern u8 Phy11BNextRateDownward[];
+extern u8 Phy11BNextRateUpward[];
+extern u8 Phy11BGNextRateDownward[];
+extern u8 Phy11BGNextRateUpward[];
+extern u8 Phy11ANextRateDownward[];
+extern u8 Phy11ANextRateUpward[];
+extern char RssiSafeLevelForTxRate[];
+extern u8 RateIdToMbps[];
+extern u16 RateIdTo500Kbps[];
+
+extern u8 CipherSuiteWpaNoneTkip[];
+extern u8 CipherSuiteWpaNoneTkipLen;
+
+extern u8 CipherSuiteWpaNoneAes[];
+extern u8 CipherSuiteWpaNoneAesLen;
+
+extern u8 SsidIe;
+extern u8 SupRateIe;
+extern u8 ExtRateIe;
+
+extern u8 HtCapIe;
+extern u8 AddHtInfoIe;
+extern u8 NewExtChanIe;
+
+extern u8 ErpIe;
+extern u8 DsIe;
+extern u8 TimIe;
+extern u8 WpaIe;
+extern u8 Wpa2Ie;
+extern u8 IbssIe;
+extern u8 Ccx2Ie;
+extern u8 WapiIe;
+
+extern u8 WPA_OUI[];
+extern u8 RSN_OUI[];
+extern u8 WAPI_OUI[];
+extern u8 WME_INFO_ELEM[];
+extern u8 WME_PARM_ELEM[];
+extern u8 Ccx2QosInfo[];
+extern u8 Ccx2IeInfo[];
+extern u8 RALINK_OUI[];
+extern u8 PowerConstraintIE[];
+
+extern u8 RateSwitchTable[];
+extern u8 RateSwitchTable11B[];
+extern u8 RateSwitchTable11G[];
+extern u8 RateSwitchTable11BG[];
+
+extern u8 RateSwitchTable11BGN1S[];
+extern u8 RateSwitchTable11BGN2S[];
+extern u8 RateSwitchTable11BGN2SForABand[];
+extern u8 RateSwitchTable11N1S[];
+extern u8 RateSwitchTable11N2S[];
+extern u8 RateSwitchTable11N2SForABand[];
+
+extern u8 PRE_N_HT_OUI[];
+
+struct rt_rssi_sample {
+	char LastRssi0;		/* last received RSSI */
+	char LastRssi1;		/* last received RSSI */
+	char LastRssi2;		/* last received RSSI */
+	char AvgRssi0;
+	char AvgRssi1;
+	char AvgRssi2;
+	short AvgRssi0X8;
+	short AvgRssi1X8;
+	short AvgRssi2X8;
 };
 
-struct reordering_list
-{
-	struct reordering_mpdu *next;
-	int 	qlen;
-};
+/* */
+/*  Queue structure and macros */
+/* */
+struct rt_queue_entry;
 
-struct reordering_mpdu_pool
-{
-	PVOID					mem;
-	NDIS_SPIN_LOCK			lock;
-	struct reordering_list 	freelist;
+struct rt_queue_entry {
+	struct rt_queue_entry *Next;
 };
 
-typedef struct 	_RSSI_SAMPLE {
-	CHAR			LastRssi0;             // last received RSSI
-	CHAR			LastRssi1;             // last received RSSI
-	CHAR			LastRssi2;             // last received RSSI
-	CHAR			AvgRssi0;
-	CHAR			AvgRssi1;
-	CHAR			AvgRssi2;
-	SHORT			AvgRssi0X8;
-	SHORT			AvgRssi1X8;
-	SHORT			AvgRssi2X8;
-} RSSI_SAMPLE;
-
-//
-//  Queue structure and macros
-//
-typedef struct  _QUEUE_ENTRY    {
-	struct _QUEUE_ENTRY     *Next;
-}   QUEUE_ENTRY, *PQUEUE_ENTRY;
-
-// Queue structure
-typedef struct  _QUEUE_HEADER   {
-	PQUEUE_ENTRY    Head;
-	PQUEUE_ENTRY    Tail;
-	ULONG           Number;
-}   QUEUE_HEADER, *PQUEUE_HEADER;
+/* Queue structure */
+struct rt_queue_header {
+	struct rt_queue_entry *Head;
+	struct rt_queue_entry *Tail;
+	unsigned long Number;
+};
 
 #define InitializeQueueHeader(QueueHeader)              \
 {                                                       \
@@ -314,10 +180,11 @@ typedef struct  _QUEUE_HEADER   {
 #define RemoveHeadQueue(QueueHeader)                \
 (QueueHeader)->Head;                                \
 {                                                   \
-	PQUEUE_ENTRY pNext;                             \
+	struct rt_queue_entry *pNext;                             \
 	if ((QueueHeader)->Head != NULL)				\
 	{												\
 		pNext = (QueueHeader)->Head->Next;          \
+		(QueueHeader)->Head->Next = NULL;		\
 		(QueueHeader)->Head = pNext;                \
 		if (pNext == NULL)                          \
 			(QueueHeader)->Tail = NULL;             \
@@ -327,41 +194,49 @@ typedef struct  _QUEUE_HEADER   {
 
 #define InsertHeadQueue(QueueHeader, QueueEntry)            \
 {                                                           \
-		((PQUEUE_ENTRY)QueueEntry)->Next = (QueueHeader)->Head; \
-		(QueueHeader)->Head = (PQUEUE_ENTRY)(QueueEntry);       \
+		((struct rt_queue_entry *)QueueEntry)->Next = (QueueHeader)->Head; \
+		(QueueHeader)->Head = (struct rt_queue_entry *)(QueueEntry);       \
 		if ((QueueHeader)->Tail == NULL)                        \
-			(QueueHeader)->Tail = (PQUEUE_ENTRY)(QueueEntry);   \
+			(QueueHeader)->Tail = (struct rt_queue_entry *)(QueueEntry);   \
 		(QueueHeader)->Number++;                                \
 }
 
 #define InsertTailQueue(QueueHeader, QueueEntry)                \
 {                                                               \
-	((PQUEUE_ENTRY)QueueEntry)->Next = NULL;                    \
+	((struct rt_queue_entry *)QueueEntry)->Next = NULL;                    \
 	if ((QueueHeader)->Tail)                                    \
-		(QueueHeader)->Tail->Next = (PQUEUE_ENTRY)(QueueEntry); \
+		(QueueHeader)->Tail->Next = (struct rt_queue_entry *)(QueueEntry); \
 	else                                                        \
-		(QueueHeader)->Head = (PQUEUE_ENTRY)(QueueEntry);       \
-	(QueueHeader)->Tail = (PQUEUE_ENTRY)(QueueEntry);           \
+		(QueueHeader)->Head = (struct rt_queue_entry *)(QueueEntry);       \
+	(QueueHeader)->Tail = (struct rt_queue_entry *)(QueueEntry);           \
 	(QueueHeader)->Number++;                                    \
 }
 
-//
-//  Macros for flag and ref count operations
-//
+#define InsertTailQueueAc(pAd, pEntry, QueueHeader, QueueEntry)			\
+{																		\
+	((struct rt_queue_entry *)QueueEntry)->Next = NULL;							\
+	if ((QueueHeader)->Tail)											\
+		(QueueHeader)->Tail->Next = (struct rt_queue_entry *)(QueueEntry);			\
+	else																\
+		(QueueHeader)->Head = (struct rt_queue_entry *)(QueueEntry);				\
+	(QueueHeader)->Tail = (struct rt_queue_entry *)(QueueEntry);					\
+	(QueueHeader)->Number++;											\
+}
+
+/* */
+/*  Macros for flag and ref count operations */
+/* */
 #define RTMP_SET_FLAG(_M, _F)       ((_M)->Flags |= (_F))
 #define RTMP_CLEAR_FLAG(_M, _F)     ((_M)->Flags &= ~(_F))
 #define RTMP_CLEAR_FLAGS(_M)        ((_M)->Flags = 0)
 #define RTMP_TEST_FLAG(_M, _F)      (((_M)->Flags & (_F)) != 0)
 #define RTMP_TEST_FLAGS(_M, _F)     (((_M)->Flags & (_F)) == (_F))
-
-#ifdef RT2860
-// Macro for power save flag.
+/* Macro for power save flag. */
 #define RTMP_SET_PSFLAG(_M, _F)       ((_M)->PSFlags |= (_F))
 #define RTMP_CLEAR_PSFLAG(_M, _F)     ((_M)->PSFlags &= ~(_F))
 #define RTMP_CLEAR_PSFLAGS(_M)        ((_M)->PSFlags = 0)
 #define RTMP_TEST_PSFLAG(_M, _F)      (((_M)->PSFlags & (_F)) != 0)
 #define RTMP_TEST_PSFLAGS(_M, _F)     (((_M)->PSFlags & (_F)) == (_F))
-#endif
 
 #define OPSTATUS_SET_FLAG(_pAd, _F)     ((_pAd)->CommonCfg.OpStatusFlags |= (_F))
 #define OPSTATUS_CLEAR_FLAG(_pAd, _F)   ((_pAd)->CommonCfg.OpStatusFlags &= ~(_F))
@@ -385,59 +260,12 @@ typedef struct  _QUEUE_HEADER   {
 #define CKIP_KP_ON(_p)				((((_p)->StaCfg.CkipFlag) & 0x10) && ((_p)->StaCfg.bCkipCmicOn == TRUE))
 #define CKIP_CMIC_ON(_p)			((((_p)->StaCfg.CkipFlag) & 0x08) && ((_p)->StaCfg.bCkipCmicOn == TRUE))
 
-
 #define INC_RING_INDEX(_idx, _RingSize)    \
 {                                          \
     (_idx) = (_idx+1) % (_RingSize);       \
 }
 
-#ifdef RT2870
-// We will have a cost down version which mac version is 0x3090xxxx
-#define IS_RT3090(_pAd)				((((_pAd)->MACVersion & 0xffff0000) == 0x30710000) || (((_pAd)->MACVersion & 0xffff0000) == 0x30900000))
-#else
-#define IS_RT3090(_pAd)				0
-#endif
-#define IS_RT3070(_pAd)				(((_pAd)->MACVersion & 0xffff0000) == 0x30700000)
-#ifdef RT2870
-#define IS_RT3071(_pAd)				(((_pAd)->MACVersion & 0xffff0000) == 0x30710000)
-#define IS_RT30xx(_pAd)				(((_pAd)->MACVersion & 0xfff00000) == 0x30700000)
-#endif
-
-#define RING_PACKET_INIT(_TxRing, _idx)    \
-{                                          \
-    _TxRing->Cell[_idx].pNdisPacket = NULL;                              \
-    _TxRing->Cell[_idx].pNextNdisPacket = NULL;                              \
-}
-
-#define TXDT_INIT(_TxD)    \
-{                                          \
-	NdisZeroMemory(_TxD, TXD_SIZE);	\
-	_TxD->DMADONE = 1;                              \
-}
-
-//Set last data segment
-#define RING_SET_LASTDS(_TxD, _IsSD0)    \
-{                                          \
-    if (_IsSD0) {_TxD->LastSec0 = 1;}     \
-    else {_TxD->LastSec1 = 1;}     \
-}
-
-// Increase TxTsc value for next transmission
-// TODO:
-// When i==6, means TSC has done one full cycle, do re-keying stuff follow specs
-// Should send a special event microsoft defined to request re-key
-#define INC_TX_TSC(_tsc)                                \
-{                                                       \
-    int i=0;                                            \
-    while (++_tsc[i] == 0x0)                            \
-    {                                                   \
-        i++;                                            \
-        if (i == 6)                                     \
-            break;                                      \
-    }                                                   \
-}
-
-// StaActive.SupportedHtPhy.MCSSet is copied from AP beacon.  Don't need to update here.
+/* StaActive.SupportedHtPhy.MCSSet is copied from AP beacon.  Don't need to update here. */
 #define COPY_HTSETTINGS_FROM_MLME_AUX_TO_ACTIVE_CFG(_pAd)                                 \
 {                                                                                       \
 	_pAd->StaActive.SupportedHtPhy.ChannelWidth = _pAd->MlmeAux.HtCapability.HtCapInfo.ChannelWidth;      \
@@ -451,343 +279,52 @@ typedef struct  _QUEUE_HEADER   {
 	_pAd->StaActive.SupportedHtPhy.RecomWidth = _pAd->MlmeAux.AddHtInfo.AddHtInfo.RecomWidth;      \
 	_pAd->StaActive.SupportedHtPhy.OperaionMode = _pAd->MlmeAux.AddHtInfo.AddHtInfo2.OperaionMode;      \
 	_pAd->StaActive.SupportedHtPhy.NonGfPresent = _pAd->MlmeAux.AddHtInfo.AddHtInfo2.NonGfPresent;      \
-	NdisMoveMemory((_pAd)->MacTab.Content[BSSID_WCID].HTCapability.MCSSet, (_pAd)->StaActive.SupportedPhyInfo.MCSSet, sizeof(UCHAR) * 16);\
+	NdisMoveMemory((_pAd)->MacTab.Content[BSSID_WCID].HTCapability.MCSSet, (_pAd)->StaActive.SupportedPhyInfo.MCSSet, sizeof(u8)* 16);\
 }
 
 #define COPY_AP_HTSETTINGS_FROM_BEACON(_pAd, _pHtCapability)                                 \
 {                                                                                       \
-	_pAd->MacTab.Content[BSSID_WCID].AMsduSize = (UCHAR)(_pHtCapability->HtCapInfo.AMsduSize);	\
-	_pAd->MacTab.Content[BSSID_WCID].MmpsMode= (UCHAR)(_pHtCapability->HtCapInfo.MimoPs);	\
-	_pAd->MacTab.Content[BSSID_WCID].MaxRAmpduFactor = (UCHAR)(_pHtCapability->HtCapParm.MaxRAmpduFactor);	\
-}
-
-//
-// MACRO for 32-bit PCI register read / write
-//
-// Usage : RTMP_IO_READ32(
-//              PRTMP_ADAPTER pAd,
-//              ULONG Register_Offset,
-//              PULONG  pValue)
-//
-//         RTMP_IO_WRITE32(
-//              PRTMP_ADAPTER pAd,
-//              ULONG Register_Offset,
-//              ULONG Value)
-//
-
-//
-// BBP & RF are using indirect access. Before write any value into it.
-// We have to make sure there is no outstanding command pending via checking busy bit.
-//
-#define MAX_BUSY_COUNT  100         // Number of retry before failing access BBP & RF indirect register
-//
-#ifdef RT2860
-#define RTMP_RF_IO_WRITE32(_A, _V)                  \
-{                                                   \
-    PHY_CSR4_STRUC  Value;                          \
-    ULONG           BusyCnt = 0;                    \
-    if ((_A)->bPCIclkOff) 	                \
-    {												\
-        return;										\
-    }                                               \
-    do {                                            \
-        RTMP_IO_READ32(_A, RF_CSR_CFG0, &Value.word);  \
-        if (Value.field.Busy == IDLE)               \
-            break;                                  \
-        BusyCnt++;                                  \
-    }   while (BusyCnt < MAX_BUSY_COUNT);           \
-    if (BusyCnt < MAX_BUSY_COUNT)                   \
-    {                                               \
-        RTMP_IO_WRITE32(_A, RF_CSR_CFG0, _V);          \
-    }                                               \
-}
-
-#define BBP_IO_READ8_BY_REG_ID(_A, _I, _pV)        \
-{                                                       \
-    BBP_CSR_CFG_STRUC  BbpCsr;                             \
-    int             i, k;                               \
-    for (i=0; i<MAX_BUSY_COUNT; i++)                    \
-    {                                                   \
-        RTMP_IO_READ32(_A, BBP_CSR_CFG, &BbpCsr.word);     \
-        if (BbpCsr.field.Busy == BUSY)                  \
-        {                                               \
-            continue;                                   \
-        }                                               \
-        BbpCsr.word = 0;                                \
-        BbpCsr.field.fRead = 1;                         \
-        BbpCsr.field.BBP_RW_MODE = 1;                         \
-        BbpCsr.field.Busy = 1;                          \
-        BbpCsr.field.RegNum = _I;                       \
-        RTMP_IO_WRITE32(_A, BBP_CSR_CFG, BbpCsr.word);     \
-        for (k=0; k<MAX_BUSY_COUNT; k++)                \
-        {                                               \
-            RTMP_IO_READ32(_A, BBP_CSR_CFG, &BbpCsr.word); \
-            if (BbpCsr.field.Busy == IDLE)              \
-                break;                                  \
-        }                                               \
-        if ((BbpCsr.field.Busy == IDLE) &&              \
-            (BbpCsr.field.RegNum == _I))                \
-        {                                               \
-            *(_pV) = (UCHAR)BbpCsr.field.Value;         \
-            break;                                      \
-        }                                               \
-    }                                                   \
-    if (BbpCsr.field.Busy == BUSY)                      \
-    {                                                   \
-        DBGPRINT_ERR(("DFS BBP read R%d fail\n", _I));      \
-        *(_pV) = (_A)->BbpWriteLatch[_I];               \
-    }                                                   \
-}
-
-//#define RTMP_BBP_IO_READ8_BY_REG_ID(_A, _I, _pV)    {}
-// Read BBP register by register's ID. Generate PER to test BA
-#define RTMP_BBP_IO_READ8_BY_REG_ID(_A, _I, _pV)        \
-{                                                       \
-    BBP_CSR_CFG_STRUC  BbpCsr;                             \
-    int             i, k;                               \
-    if ((_A)->bPCIclkOff == FALSE)                     \
-    {                                                   \
-    for (i=0; i<MAX_BUSY_COUNT; i++)                    \
-    {                                                   \
-		RTMP_IO_READ32(_A, H2M_BBP_AGENT, &BbpCsr.word);				\
-        if (BbpCsr.field.Busy == BUSY)                  \
-        {                                               \
-            continue;                                   \
-        }                                               \
-        BbpCsr.word = 0;                                \
-        BbpCsr.field.fRead = 1;                         \
-        BbpCsr.field.BBP_RW_MODE = 1;                         \
-        BbpCsr.field.Busy = 1;                          \
-        BbpCsr.field.RegNum = _I;                       \
-		RTMP_IO_WRITE32(_A, H2M_BBP_AGENT, BbpCsr.word);				\
-		AsicSendCommandToMcu(_A, 0x80, 0xff, 0x0, 0x0);					\
-		RTMPusecDelay(1000);							\
-        for (k=0; k<MAX_BUSY_COUNT; k++)                \
-        {                                               \
-			RTMP_IO_READ32(_A, H2M_BBP_AGENT, &BbpCsr.word);			\
-            if (BbpCsr.field.Busy == IDLE)              \
-                break;                                  \
-        }                                               \
-        if ((BbpCsr.field.Busy == IDLE) &&              \
-            (BbpCsr.field.RegNum == _I))                \
-        {                                               \
-            *(_pV) = (UCHAR)BbpCsr.field.Value;         \
-            break;                                      \
-        }                                               \
-    }                                                   \
-    if (BbpCsr.field.Busy == BUSY)                      \
-    {                                                   \
-		DBGPRINT_ERR(("BBP read R%d=0x%x fail\n", _I, BbpCsr.word));	\
-        *(_pV) = (_A)->BbpWriteLatch[_I];               \
-		RTMP_IO_READ32(_A, H2M_BBP_AGENT, &BbpCsr.word);				\
-		BbpCsr.field.Busy = 0;                          \
-		RTMP_IO_WRITE32(_A, H2M_BBP_AGENT, BbpCsr.word);				\
-    }                                                   \
-    }                   \
-}
-
-#define BBP_IO_WRITE8_BY_REG_ID(_A, _I, _V)        \
-{                                                       \
-    BBP_CSR_CFG_STRUC  BbpCsr;                             \
-    int             BusyCnt;                            \
-    for (BusyCnt=0; BusyCnt<MAX_BUSY_COUNT; BusyCnt++)  \
-    {                                                   \
-        RTMP_IO_READ32(_A, BBP_CSR_CFG, &BbpCsr.word);     \
-        if (BbpCsr.field.Busy == BUSY)                  \
-            continue;                                   \
-        BbpCsr.word = 0;                                \
-        BbpCsr.field.fRead = 0;                         \
-        BbpCsr.field.BBP_RW_MODE = 1;                         \
-        BbpCsr.field.Busy = 1;                          \
-        BbpCsr.field.Value = _V;                        \
-        BbpCsr.field.RegNum = _I;                       \
-        RTMP_IO_WRITE32(_A, BBP_CSR_CFG, BbpCsr.word);     \
-        (_A)->BbpWriteLatch[_I] = _V;                   \
-        break;                                          \
-    }                                                   \
-    if (BusyCnt == MAX_BUSY_COUNT)                      \
-    {                                                   \
-        DBGPRINT_ERR(("BBP write R%d fail\n", _I));     \
-    }                                                   \
+	_pAd->MacTab.Content[BSSID_WCID].AMsduSize = (u8)(_pHtCapability->HtCapInfo.AMsduSize);	\
+	_pAd->MacTab.Content[BSSID_WCID].MmpsMode= (u8)(_pHtCapability->HtCapInfo.MimoPs);	\
+	_pAd->MacTab.Content[BSSID_WCID].MaxRAmpduFactor = (u8)(_pHtCapability->HtCapParm.MaxRAmpduFactor);	\
 }
 
-// Write BBP register by register's ID & value
-#define RTMP_BBP_IO_WRITE8_BY_REG_ID(_A, _I, _V)        \
-{                                                       \
-    BBP_CSR_CFG_STRUC  BbpCsr;                             \
-    int             BusyCnt;                            \
-    if ((_A)->bPCIclkOff == FALSE)                     \
-    {                                                   \
-    for (BusyCnt=0; BusyCnt<MAX_BUSY_COUNT; BusyCnt++)  \
-    {                                                   \
-		RTMP_IO_READ32(_A, H2M_BBP_AGENT, &BbpCsr.word);				\
-        if (BbpCsr.field.Busy == BUSY)                  \
-            continue;                                   \
-        BbpCsr.word = 0;                                \
-        BbpCsr.field.fRead = 0;                         \
-        BbpCsr.field.BBP_RW_MODE = 1;                         \
-        BbpCsr.field.Busy = 1;                          \
-        BbpCsr.field.Value = _V;                        \
-        BbpCsr.field.RegNum = _I;                       \
-		RTMP_IO_WRITE32(_A, H2M_BBP_AGENT, BbpCsr.word);				\
-		AsicSendCommandToMcu(_A, 0x80, 0xff, 0x0, 0x0);					\
-            if (_A->OpMode == OPMODE_AP)                    \
-		RTMPusecDelay(1000);							\
-        (_A)->BbpWriteLatch[_I] = _V;                   \
-        break;                                          \
-    }                                                   \
-    if (BusyCnt == MAX_BUSY_COUNT)                      \
-    {                                                   \
-		DBGPRINT_ERR(("BBP write R%d=0x%x fail\n", _I, BbpCsr.word));	\
-		RTMP_IO_READ32(_A, H2M_BBP_AGENT, &BbpCsr.word);				\
-		BbpCsr.field.Busy = 0;                          \
-		RTMP_IO_WRITE32(_A, H2M_BBP_AGENT, BbpCsr.word);				\
-    }                                                   \
-    }                                                   \
-}
-#endif /* RT2860 */
-#ifdef RT2870
-#define RTMP_RF_IO_WRITE32(_A, _V)                 RTUSBWriteRFRegister(_A, _V)
-#define RTMP_BBP_IO_READ8_BY_REG_ID(_A, _I, _pV)   RTUSBReadBBPRegister(_A, _I, _pV)
-#define RTMP_BBP_IO_WRITE8_BY_REG_ID(_A, _I, _V)   RTUSBWriteBBPRegister(_A, _I, _V)
-
-#define BBP_IO_WRITE8_BY_REG_ID(_A, _I, _V)			RTUSBWriteBBPRegister(_A, _I, _V)
-#define BBP_IO_READ8_BY_REG_ID(_A, _I, _pV)   		RTUSBReadBBPRegister(_A, _I, _pV)
-#endif // RT2870 //
-
-#define     MAP_CHANNEL_ID_TO_KHZ(ch, khz)  {               \
-                switch (ch)                                 \
-                {                                           \
-                    case 1:     khz = 2412000;   break;     \
-                    case 2:     khz = 2417000;   break;     \
-                    case 3:     khz = 2422000;   break;     \
-                    case 4:     khz = 2427000;   break;     \
-                    case 5:     khz = 2432000;   break;     \
-                    case 6:     khz = 2437000;   break;     \
-                    case 7:     khz = 2442000;   break;     \
-                    case 8:     khz = 2447000;   break;     \
-                    case 9:     khz = 2452000;   break;     \
-                    case 10:    khz = 2457000;   break;     \
-                    case 11:    khz = 2462000;   break;     \
-                    case 12:    khz = 2467000;   break;     \
-                    case 13:    khz = 2472000;   break;     \
-                    case 14:    khz = 2484000;   break;     \
-                    case 36:  /* UNII */  khz = 5180000;   break;     \
-                    case 40:  /* UNII */  khz = 5200000;   break;     \
-                    case 44:  /* UNII */  khz = 5220000;   break;     \
-                    case 48:  /* UNII */  khz = 5240000;   break;     \
-                    case 52:  /* UNII */  khz = 5260000;   break;     \
-                    case 56:  /* UNII */  khz = 5280000;   break;     \
-                    case 60:  /* UNII */  khz = 5300000;   break;     \
-                    case 64:  /* UNII */  khz = 5320000;   break;     \
-                    case 149: /* UNII */  khz = 5745000;   break;     \
-                    case 153: /* UNII */  khz = 5765000;   break;     \
-                    case 157: /* UNII */  khz = 5785000;   break;     \
-                    case 161: /* UNII */  khz = 5805000;   break;     \
-                    case 165: /* UNII */  khz = 5825000;   break;     \
-                    case 100: /* HiperLAN2 */  khz = 5500000;   break;     \
-                    case 104: /* HiperLAN2 */  khz = 5520000;   break;     \
-                    case 108: /* HiperLAN2 */  khz = 5540000;   break;     \
-                    case 112: /* HiperLAN2 */  khz = 5560000;   break;     \
-                    case 116: /* HiperLAN2 */  khz = 5580000;   break;     \
-                    case 120: /* HiperLAN2 */  khz = 5600000;   break;     \
-                    case 124: /* HiperLAN2 */  khz = 5620000;   break;     \
-                    case 128: /* HiperLAN2 */  khz = 5640000;   break;     \
-                    case 132: /* HiperLAN2 */  khz = 5660000;   break;     \
-                    case 136: /* HiperLAN2 */  khz = 5680000;   break;     \
-                    case 140: /* HiperLAN2 */  khz = 5700000;   break;     \
-                    case 34:  /* Japan MMAC */   khz = 5170000;   break;   \
-                    case 38:  /* Japan MMAC */   khz = 5190000;   break;   \
-                    case 42:  /* Japan MMAC */   khz = 5210000;   break;   \
-                    case 46:  /* Japan MMAC */   khz = 5230000;   break;   \
-                    case 184: /* Japan */   khz = 4920000;   break;   \
-                    case 188: /* Japan */   khz = 4940000;   break;   \
-                    case 192: /* Japan */   khz = 4960000;   break;   \
-                    case 196: /* Japan */   khz = 4980000;   break;   \
-                    case 208: /* Japan, means J08 */   khz = 5040000;   break;   \
-                    case 212: /* Japan, means J12 */   khz = 5060000;   break;   \
-                    case 216: /* Japan, means J16 */   khz = 5080000;   break;   \
-                    default:    khz = 2412000;   break;     \
-                }                                           \
-            }
-
-#define     MAP_KHZ_TO_CHANNEL_ID(khz, ch)  {               \
-                switch (khz)                                \
-                {                                           \
-                    case 2412000:    ch = 1;     break;     \
-                    case 2417000:    ch = 2;     break;     \
-                    case 2422000:    ch = 3;     break;     \
-                    case 2427000:    ch = 4;     break;     \
-                    case 2432000:    ch = 5;     break;     \
-                    case 2437000:    ch = 6;     break;     \
-                    case 2442000:    ch = 7;     break;     \
-                    case 2447000:    ch = 8;     break;     \
-                    case 2452000:    ch = 9;     break;     \
-                    case 2457000:    ch = 10;    break;     \
-                    case 2462000:    ch = 11;    break;     \
-                    case 2467000:    ch = 12;    break;     \
-                    case 2472000:    ch = 13;    break;     \
-                    case 2484000:    ch = 14;    break;     \
-                    case 5180000:    ch = 36;  /* UNII */  break;     \
-                    case 5200000:    ch = 40;  /* UNII */  break;     \
-                    case 5220000:    ch = 44;  /* UNII */  break;     \
-                    case 5240000:    ch = 48;  /* UNII */  break;     \
-                    case 5260000:    ch = 52;  /* UNII */  break;     \
-                    case 5280000:    ch = 56;  /* UNII */  break;     \
-                    case 5300000:    ch = 60;  /* UNII */  break;     \
-                    case 5320000:    ch = 64;  /* UNII */  break;     \
-                    case 5745000:    ch = 149; /* UNII */  break;     \
-                    case 5765000:    ch = 153; /* UNII */  break;     \
-                    case 5785000:    ch = 157; /* UNII */  break;     \
-                    case 5805000:    ch = 161; /* UNII */  break;     \
-                    case 5825000:    ch = 165; /* UNII */  break;     \
-                    case 5500000:    ch = 100; /* HiperLAN2 */  break;     \
-                    case 5520000:    ch = 104; /* HiperLAN2 */  break;     \
-                    case 5540000:    ch = 108; /* HiperLAN2 */  break;     \
-                    case 5560000:    ch = 112; /* HiperLAN2 */  break;     \
-                    case 5580000:    ch = 116; /* HiperLAN2 */  break;     \
-                    case 5600000:    ch = 120; /* HiperLAN2 */  break;     \
-                    case 5620000:    ch = 124; /* HiperLAN2 */  break;     \
-                    case 5640000:    ch = 128; /* HiperLAN2 */  break;     \
-                    case 5660000:    ch = 132; /* HiperLAN2 */  break;     \
-                    case 5680000:    ch = 136; /* HiperLAN2 */  break;     \
-                    case 5700000:    ch = 140; /* HiperLAN2 */  break;     \
-                    case 5170000:    ch = 34;  /* Japan MMAC */   break;   \
-                    case 5190000:    ch = 38;  /* Japan MMAC */   break;   \
-                    case 5210000:    ch = 42;  /* Japan MMAC */   break;   \
-                    case 5230000:    ch = 46;  /* Japan MMAC */   break;   \
-                    case 4920000:    ch = 184; /* Japan */  break;   \
-                    case 4940000:    ch = 188; /* Japan */  break;   \
-                    case 4960000:    ch = 192; /* Japan */  break;   \
-                    case 4980000:    ch = 196; /* Japan */  break;   \
-                    case 5040000:    ch = 208; /* Japan, means J08 */  break;   \
-                    case 5060000:    ch = 212; /* Japan, means J12 */  break;   \
-                    case 5080000:    ch = 216; /* Japan, means J16 */  break;   \
-                    default:         ch = 1;     break;     \
-                }                                           \
-            }
-
-//
-// Common fragment list structure -  Identical to the scatter gather frag list structure
-//
+/* */
+/* MACRO for 32-bit PCI register read / write */
+/* */
+/* Usage : RTMP_IO_READ32( */
+/*              struct rt_rtmp_adapter *pAd, */
+/*              unsigned long Register_Offset, */
+/*              unsigned long * pValue) */
+/* */
+/*         RTMP_IO_WRITE32( */
+/*              struct rt_rtmp_adapter *pAd, */
+/*              unsigned long Register_Offset, */
+/*              unsigned long Value) */
+/* */
+
+/* */
+/* Common fragment list structure -  Identical to the scatter gather frag list structure */
+/* */
+/*#define struct rt_rtmp_sg_element         SCATTER_GATHER_ELEMENT */
+/*#define struct rt_rtmp_sg_element *PSCATTER_GATHER_ELEMENT */
 #define NIC_MAX_PHYS_BUF_COUNT              8
 
-typedef struct _RTMP_SCATTER_GATHER_ELEMENT {
-    PVOID		Address;
-    ULONG		Length;
-    PULONG		Reserved;
-} RTMP_SCATTER_GATHER_ELEMENT, *PRTMP_SCATTER_GATHER_ELEMENT;
-
+struct rt_rtmp_sg_element {
+	void *Address;
+	unsigned long Length;
+	unsigned long *Reserved;
+};
 
-typedef struct _RTMP_SCATTER_GATHER_LIST {
-    ULONG  NumberOfElements;
-    PULONG Reserved;
-    RTMP_SCATTER_GATHER_ELEMENT Elements[NIC_MAX_PHYS_BUF_COUNT];
-} RTMP_SCATTER_GATHER_LIST, *PRTMP_SCATTER_GATHER_LIST;
+struct rt_rtmp_sg_list {
+	unsigned long NumberOfElements;
+	unsigned long *Reserved;
+	struct rt_rtmp_sg_element Elements[NIC_MAX_PHYS_BUF_COUNT];
+};
 
-//
-//  Some utility macros
-//
+/* */
+/*  Some utility macros */
+/* */
 #ifndef min
 #define min(_a, _b)     (((_a) < (_b)) ? (_a) : (_b))
 #endif
@@ -805,11 +342,11 @@ typedef struct _RTMP_SCATTER_GATHER_LIST {
 #define MONITOR_ON(_p)              (((_p)->StaCfg.BssType) == BSS_MONITOR)
 #define IDLE_ON(_p)                 (!INFRA_ON(_p) && !ADHOC_ON(_p))
 
-// Check LEAP & CCKM flags
+/* Check LEAP & CCKM flags */
 #define LEAP_ON(_p)                 (((_p)->StaCfg.LeapAuthMode) == CISCO_AuthModeLEAP)
 #define LEAP_CCKM_ON(_p)            ((((_p)->StaCfg.LeapAuthMode) == CISCO_AuthModeLEAP) && ((_p)->StaCfg.LeapAuthInfo.CCKM == TRUE))
 
-// if orginal Ethernet frame contains no LLC/SNAP, then an extra LLC/SNAP encap is required
+/* if orginal Ethernet frame contains no LLC/SNAP, then an extra LLC/SNAP encap is required */
 #define EXTRA_LLCSNAP_ENCAP_FROM_PKT_START(_pBufVA, _pExtraLlcSnapEncap)		\
 {																\
 	if (((*(_pBufVA + 12) << 8) + *(_pBufVA + 13)) > 1500)		\
@@ -827,7 +364,7 @@ typedef struct _RTMP_SCATTER_GATHER_LIST {
 	}															\
 }
 
-// New Define for new Tx Path.
+/* New Define for new Tx Path. */
 #define EXTRA_LLCSNAP_ENCAP_FROM_PKT_OFFSET(_pBufVA, _pExtraLlcSnapEncap)	\
 {																\
 	if (((*(_pBufVA) << 8) + *(_pBufVA + 1)) > 1500)			\
@@ -845,7 +382,6 @@ typedef struct _RTMP_SCATTER_GATHER_LIST {
 	}															\
 }
 
-
 #define MAKE_802_3_HEADER(_p, _pMac1, _pMac2, _pType)                   \
 {                                                                       \
     NdisMoveMemory(_p, _pMac1, MAC_ADDR_LEN);                           \
@@ -853,13 +389,13 @@ typedef struct _RTMP_SCATTER_GATHER_LIST {
     NdisMoveMemory((_p + MAC_ADDR_LEN * 2), _pType, LENGTH_802_3_TYPE); \
 }
 
-// if pData has no LLC/SNAP (neither RFC1042 nor Bridge tunnel), keep it that way.
-// else if the received frame is LLC/SNAP-encaped IPX or APPLETALK, preserve the LLC/SNAP field
-// else remove the LLC/SNAP field from the result Ethernet frame
-// Patch for WHQL only, which did not turn on Netbios but use IPX within its payload
-// Note:
-//     _pData & _DataSize may be altered (remove 8-byte LLC/SNAP) by this MACRO
-//     _pRemovedLLCSNAP: pointer to removed LLC/SNAP; NULL is not removed
+/* if pData has no LLC/SNAP (neither RFC1042 nor Bridge tunnel), keep it that way. */
+/* else if the received frame is LLC/SNAP-encaped IPX or APPLETALK, preserve the LLC/SNAP field */
+/* else remove the LLC/SNAP field from the result Ethernet frame */
+/* Patch for WHQL only, which did not turn on Netbios but use IPX within its payload */
+/* Note: */
+/*     _pData & _DataSize may be altered (remove 8-byte LLC/SNAP) by this MACRO */
+/*     _pRemovedLLCSNAP: pointer to removed LLC/SNAP; NULL is not removed */
 #define CONVERT_TO_802_3(_p8023hdr, _pDA, _pSA, _pData, _DataSize, _pRemovedLLCSNAP)      \
 {                                                                       \
     char LLC_Len[2];                                                    \
@@ -868,13 +404,13 @@ typedef struct _RTMP_SCATTER_GATHER_LIST {
     if (NdisEqualMemory(SNAP_802_1H, _pData, 6)  ||                     \
         NdisEqualMemory(SNAP_BRIDGE_TUNNEL, _pData, 6))                 \
     {                                                                   \
-        PUCHAR pProto = _pData + 6;                                     \
+        u8 *pProto = _pData + 6;                                     \
                                                                         \
         if ((NdisEqualMemory(IPX, pProto, 2) || NdisEqualMemory(APPLE_TALK, pProto, 2)) &&  \
             NdisEqualMemory(SNAP_802_1H, _pData, 6))                    \
         {                                                               \
-            LLC_Len[0] = (UCHAR)(_DataSize / 256);                      \
-            LLC_Len[1] = (UCHAR)(_DataSize % 256);                      \
+            LLC_Len[0] = (u8)(_DataSize / 256);                      \
+            LLC_Len[1] = (u8)(_DataSize % 256);                      \
             MAKE_802_3_HEADER(_p8023hdr, _pDA, _pSA, LLC_Len);          \
         }                                                               \
         else                                                            \
@@ -887,2113 +423,1764 @@ typedef struct _RTMP_SCATTER_GATHER_LIST {
     }                                                                   \
     else                                                                \
     {                                                                   \
-        LLC_Len[0] = (UCHAR)(_DataSize / 256);                          \
-        LLC_Len[1] = (UCHAR)(_DataSize % 256);                          \
+        LLC_Len[0] = (u8)(_DataSize / 256);                          \
+        LLC_Len[1] = (u8)(_DataSize % 256);                          \
         MAKE_802_3_HEADER(_p8023hdr, _pDA, _pSA, LLC_Len);              \
     }                                                                   \
 }
 
-#define SWITCH_AB( _pAA, _pBB)    \
-{                                                                           \
-    PVOID pCC;                                                          \
-    pCC = _pBB;                                                 \
-    _pBB = _pAA;                                                 \
-    _pAA = pCC;                                                 \
-}
-
-// Enqueue this frame to MLME engine
-// We need to enqueue the whole frame because MLME need to pass data type
-// information from 802.11 header
-#ifdef RT2860
+/* Enqueue this frame to MLME engine */
+/* We need to enqueue the whole frame because MLME need to pass data type */
+/* information from 802.11 header */
+#ifdef RTMP_MAC_PCI
 #define REPORT_MGMT_FRAME_TO_MLME(_pAd, Wcid, _pFrame, _FrameSize, _Rssi0, _Rssi1, _Rssi2, _PlcpSignal)        \
 {                                                                                       \
-    UINT32 High32TSF, Low32TSF;                                                          \
+    u32 High32TSF, Low32TSF;                                                          \
     RTMP_IO_READ32(_pAd, TSF_TIMER_DW1, &High32TSF);                                       \
     RTMP_IO_READ32(_pAd, TSF_TIMER_DW0, &Low32TSF);                                        \
-    MlmeEnqueueForRecv(_pAd, Wcid, High32TSF, Low32TSF, (UCHAR)_Rssi0, (UCHAR)_Rssi1,(UCHAR)_Rssi2,_FrameSize, _pFrame, (UCHAR)_PlcpSignal);   \
+    MlmeEnqueueForRecv(_pAd, Wcid, High32TSF, Low32TSF, (u8)_Rssi0, (u8)_Rssi1,(u8)_Rssi2,_FrameSize, _pFrame, (u8)_PlcpSignal);   \
 }
-#endif
-#ifdef RT2870
+#endif /* RTMP_MAC_PCI // */
+#ifdef RTMP_MAC_USB
 #define REPORT_MGMT_FRAME_TO_MLME(_pAd, Wcid, _pFrame, _FrameSize, _Rssi0, _Rssi1, _Rssi2, _PlcpSignal)        \
 {                                                                                       \
-    UINT32 High32TSF=0, Low32TSF=0;                                                          \
-    MlmeEnqueueForRecv(_pAd, Wcid, High32TSF, Low32TSF, (UCHAR)_Rssi0, (UCHAR)_Rssi1,(UCHAR)_Rssi2,_FrameSize, _pFrame, (UCHAR)_PlcpSignal);   \
-}
-#endif // RT2870 //
-
-//Need to collect each ant's rssi concurrently
-//rssi1 is report to pair2 Ant and rss2 is reprot to pair1 Ant when 4 Ant
-#define COLLECT_RX_ANTENNA_AVERAGE_RSSI(_pAd, _rssi1, _rssi2)					\
-{																				\
-	SHORT	AvgRssi;															\
-	UCHAR	UsedAnt;															\
-	if (_pAd->RxAnt.EvaluatePeriod == 0)									\
-	{																		\
-		UsedAnt = _pAd->RxAnt.Pair1PrimaryRxAnt;							\
-		AvgRssi = _pAd->RxAnt.Pair1AvgRssi[UsedAnt];						\
-		if (AvgRssi < 0)													\
-			AvgRssi = AvgRssi - (AvgRssi >> 3) + _rssi1;					\
-		else																\
-			AvgRssi = _rssi1 << 3;											\
-		_pAd->RxAnt.Pair1AvgRssi[UsedAnt] = AvgRssi;						\
-	}																		\
-	else																	\
-	{																		\
-		UsedAnt = _pAd->RxAnt.Pair1SecondaryRxAnt;							\
-		AvgRssi = _pAd->RxAnt.Pair1AvgRssi[UsedAnt];						\
-		if ((AvgRssi < 0) && (_pAd->RxAnt.FirstPktArrivedWhenEvaluate))		\
-			AvgRssi = AvgRssi - (AvgRssi >> 3) + _rssi1;					\
-		else																\
-		{																	\
-			_pAd->RxAnt.FirstPktArrivedWhenEvaluate = TRUE;					\
-			AvgRssi = _rssi1 << 3;											\
-		}																	\
-		_pAd->RxAnt.Pair1AvgRssi[UsedAnt] = AvgRssi;						\
-		_pAd->RxAnt.RcvPktNumWhenEvaluate++;								\
-	}																		\
+    u32 High32TSF=0, Low32TSF=0;                                                          \
+    MlmeEnqueueForRecv(_pAd, Wcid, High32TSF, Low32TSF, (u8)_Rssi0, (u8)_Rssi1,(u8)_Rssi2,_FrameSize, _pFrame, (u8)_PlcpSignal);   \
 }
+#endif /* RTMP_MAC_USB // */
 
-#define NDIS_QUERY_BUFFER(_NdisBuf, _ppVA, _pBufLen)                    \
-    NdisQueryBuffer(_NdisBuf, _ppVA, _pBufLen)
-
-#define MAC_ADDR_EQUAL(pAddr1,pAddr2)           RTMPEqualMemory((PVOID)(pAddr1), (PVOID)(pAddr2), MAC_ADDR_LEN)
+#define MAC_ADDR_EQUAL(pAddr1,pAddr2)           RTMPEqualMemory((void *)(pAddr1), (void *)(pAddr2), MAC_ADDR_LEN)
 #define SSID_EQUAL(ssid1, len1, ssid2, len2)    ((len1==len2) && (RTMPEqualMemory(ssid1, ssid2, len1)))
 
-//
-// Check if it is Japan W53(ch52,56,60,64) channel.
-//
+/* */
+/* Check if it is Japan W53(ch52,56,60,64) channel. */
+/* */
 #define JapanChannelCheck(channel)  ((channel == 52) || (channel == 56) || (channel == 60) || (channel == 64))
 
-#ifdef RT2860
+#define STA_EXTRA_SETTING(_pAd)
+
 #define STA_PORT_SECURED(_pAd) \
 { \
-	_pAd->StaCfg.PortSecured = WPA_802_1X_PORT_SECURED; \
-	RTMP_SET_PSFLAG(_pAd, fRTMP_PS_CAN_GO_SLEEP); \
-	NdisAcquireSpinLock(&(_pAd)->MacTabLock); \
-	_pAd->MacTab.Content[BSSID_WCID].PortSecured = _pAd->StaCfg.PortSecured; \
+	BOOLEAN	Cancelled; \
+	(_pAd)->StaCfg.PortSecured = WPA_802_1X_PORT_SECURED; \
+	NdisAcquireSpinLock(&((_pAd)->MacTabLock)); \
+	(_pAd)->MacTab.Content[BSSID_WCID].PortSecured = (_pAd)->StaCfg.PortSecured; \
+	(_pAd)->MacTab.Content[BSSID_WCID].PrivacyFilter = Ndis802_11PrivFilterAcceptAll;\
 	NdisReleaseSpinLock(&(_pAd)->MacTabLock); \
+	RTMPCancelTimer(&((_pAd)->Mlme.LinkDownTimer), &Cancelled);\
+	STA_EXTRA_SETTING(_pAd); \
 }
-#endif
-#ifdef RT2870
-#define STA_PORT_SECURED(_pAd) \
-{ \
-	_pAd->StaCfg.PortSecured = WPA_802_1X_PORT_SECURED; \
-	NdisAcquireSpinLock(&_pAd->MacTabLock); \
-	_pAd->MacTab.Content[BSSID_WCID].PortSecured = _pAd->StaCfg.PortSecured; \
-	NdisReleaseSpinLock(&_pAd->MacTabLock); \
-}
-#endif
 
-//
-// Register set pair for initialzation register set definition
-//
-typedef struct  _RTMP_REG_PAIR
-{
-	ULONG   Register;
-	ULONG   Value;
-} RTMP_REG_PAIR, *PRTMP_REG_PAIR;
+/* */
+/*  Data buffer for DMA operation, the buffer must be contiguous physical memory */
+/*  Both DMA to / from CPU use the same structure. */
+/* */
+struct rt_rtmp_dmabuf {
+	unsigned long AllocSize;
+	void *AllocVa;		/* TxBuf virtual address */
+	dma_addr_t AllocPa;	/* TxBuf physical address */
+};
 
-typedef struct  _REG_PAIR
-{
-	UCHAR   Register;
-	UCHAR   Value;
-} REG_PAIR, *PREG_PAIR;
-
-//
-// Register set pair for initialzation register set definition
-//
-typedef struct  _RTMP_RF_REGS
-{
-	UCHAR   Channel;
-	ULONG   R1;
-	ULONG   R2;
-	ULONG   R3;
-	ULONG   R4;
-} RTMP_RF_REGS, *PRTMP_RF_REGS;
-
-typedef struct _FREQUENCY_ITEM {
-	UCHAR	Channel;
-	UCHAR	N;
-	UCHAR	R;
-	UCHAR	K;
-} FREQUENCY_ITEM, *PFREQUENCY_ITEM;
-
-//
-//  Data buffer for DMA operation, the buffer must be contiguous physical memory
-//  Both DMA to / from CPU use the same structure.
-//
-typedef struct  _RTMP_DMABUF
-{
-	ULONG                   AllocSize;
-	PVOID                   AllocVa;            // TxBuf virtual address
-	NDIS_PHYSICAL_ADDRESS   AllocPa;            // TxBuf physical address
-} RTMP_DMABUF, *PRTMP_DMABUF;
-
-
-typedef	union	_HEADER_802_11_SEQ{
-    struct {
-	USHORT			Frag:4;
-	USHORT			Sequence:12;
-    }   field;
-    USHORT           value;
-}	HEADER_802_11_SEQ, *PHEADER_802_11_SEQ;
-
-//
-//  Data buffer for DMA operation, the buffer must be contiguous physical memory
-//  Both DMA to / from CPU use the same structure.
-//
-typedef struct  _RTMP_REORDERBUF
-{
-	BOOLEAN			IsFull;
-	PVOID                   AllocVa;            // TxBuf virtual address
-	UCHAR			Header802_3[14];
-	HEADER_802_11_SEQ			Sequence;	//support compressed bitmap BA, so no consider fragment in BA
-	UCHAR 		DataOffset;
-	USHORT 		Datasize;
-	ULONG                   AllocSize;
-#ifdef RT2860
-	NDIS_PHYSICAL_ADDRESS   AllocPa;            // TxBuf physical address
-#endif
-#ifdef RT2870
-	PUCHAR					AllocPa;
-#endif // RT2870 //
-}   RTMP_REORDERBUF, *PRTMP_REORDERBUF;
-
-//
-// Control block (Descriptor) for all ring descriptor DMA operation, buffer must be
-// contiguous physical memory. NDIS_PACKET stored the binding Rx packet descriptor
-// which won't be released, driver has to wait until upper layer return the packet
-// before giveing up this rx ring descriptor to ASIC. NDIS_BUFFER is assocaited pair
-// to describe the packet buffer. For Tx, NDIS_PACKET stored the tx packet descriptor
-// which driver should ACK upper layer when the tx is physically done or failed.
-//
-typedef struct _RTMP_DMACB
-{
-	ULONG                   AllocSize;          // Control block size
-	PVOID                   AllocVa;            // Control block virtual address
-	NDIS_PHYSICAL_ADDRESS   AllocPa;            // Control block physical address
-	PNDIS_PACKET pNdisPacket;
-	PNDIS_PACKET pNextNdisPacket;
+/* */
+/* Control block (Descriptor) for all ring descriptor DMA operation, buffer must be */
+/* contiguous physical memory. char stored the binding Rx packet descriptor */
+/* which won't be released, driver has to wait until upper layer return the packet */
+/* before giveing up this rx ring descriptor to ASIC. NDIS_BUFFER is assocaited pair */
+/* to describe the packet buffer. For Tx, char stored the tx packet descriptor */
+/* which driver should ACK upper layer when the tx is physically done or failed. */
+/* */
+struct rt_rtmp_dmacb {
+	unsigned long AllocSize;	/* Control block size */
+	void *AllocVa;		/* Control block virtual address */
+	dma_addr_t AllocPa;	/* Control block physical address */
+	void *pNdisPacket;
+	void *pNextNdisPacket;
+
+	struct rt_rtmp_dmabuf DmaBuf;	/* Associated DMA buffer structure */
+};
 
-	RTMP_DMABUF             DmaBuf;             // Associated DMA buffer structure
-} RTMP_DMACB, *PRTMP_DMACB;
+struct rt_rtmp_tx_ring {
+	struct rt_rtmp_dmacb Cell[TX_RING_SIZE];
+	u32 TxCpuIdx;
+	u32 TxDmaIdx;
+	u32 TxSwFreeIdx;	/* software next free tx index */
+};
 
-typedef struct _RTMP_TX_BUF
-{
-	PQUEUE_ENTRY    Next;
-	UCHAR           Index;
-	ULONG                   AllocSize;          // Control block size
-	PVOID                   AllocVa;            // Control block virtual address
-	NDIS_PHYSICAL_ADDRESS   AllocPa;            // Control block physical address
-} RTMP_TXBUF, *PRTMP_TXBUF;
-
-typedef struct _RTMP_RX_BUF
-{
-	BOOLEAN           InUse;
-	ULONG           	ByBaRecIndex;
-	RTMP_REORDERBUF	MAP_RXBuf[MAX_RX_REORDERBUF];
-} RTMP_RXBUF, *PRTMP_RXBUF;
-typedef struct _RTMP_TX_RING
-{
-	RTMP_DMACB  Cell[TX_RING_SIZE];
-	UINT32		TxCpuIdx;
-	UINT32		TxDmaIdx;
-	UINT32		TxSwFreeIdx; 	// software next free tx index
-} RTMP_TX_RING, *PRTMP_TX_RING;
+struct rt_rtmp_rx_ring {
+	struct rt_rtmp_dmacb Cell[RX_RING_SIZE];
+	u32 RxCpuIdx;
+	u32 RxDmaIdx;
+	int RxSwReadIdx;	/* software next read index */
+};
 
-typedef struct _RTMP_RX_RING
-{
-	RTMP_DMACB  Cell[RX_RING_SIZE];
-	UINT32		RxCpuIdx;
-	UINT32		RxDmaIdx;
-	INT32		RxSwReadIdx; 	// software next read index
-} RTMP_RX_RING, *PRTMP_RX_RING;
+struct rt_rtmp_mgmt_ring {
+	struct rt_rtmp_dmacb Cell[MGMT_RING_SIZE];
+	u32 TxCpuIdx;
+	u32 TxDmaIdx;
+	u32 TxSwFreeIdx;	/* software next free tx index */
+};
 
-typedef struct _RTMP_MGMT_RING
-{
-	RTMP_DMACB  Cell[MGMT_RING_SIZE];
-	UINT32		TxCpuIdx;
-	UINT32		TxDmaIdx;
-	UINT32		TxSwFreeIdx; // software next free tx index
-} RTMP_MGMT_RING, *PRTMP_MGMT_RING;
-
-//
-//  Statistic counter structure
-//
-typedef struct _COUNTER_802_3
-{
-	// General Stats
-	ULONG       GoodTransmits;
-	ULONG       GoodReceives;
-	ULONG       TxErrors;
-	ULONG       RxErrors;
-	ULONG       RxNoBuffer;
-
-	// Ethernet Stats
-	ULONG       RcvAlignmentErrors;
-	ULONG       OneCollision;
-	ULONG       MoreCollisions;
-
-} COUNTER_802_3, *PCOUNTER_802_3;
-
-typedef struct _COUNTER_802_11 {
-	ULONG           Length;
-	LARGE_INTEGER   LastTransmittedFragmentCount;
-	LARGE_INTEGER   TransmittedFragmentCount;
-	LARGE_INTEGER   MulticastTransmittedFrameCount;
-	LARGE_INTEGER   FailedCount;
-	LARGE_INTEGER   RetryCount;
-	LARGE_INTEGER   MultipleRetryCount;
-	LARGE_INTEGER   RTSSuccessCount;
-	LARGE_INTEGER   RTSFailureCount;
-	LARGE_INTEGER   ACKFailureCount;
-	LARGE_INTEGER   FrameDuplicateCount;
-	LARGE_INTEGER   ReceivedFragmentCount;
-	LARGE_INTEGER   MulticastReceivedFrameCount;
-	LARGE_INTEGER   FCSErrorCount;
-} COUNTER_802_11, *PCOUNTER_802_11;
-
-typedef struct _COUNTER_RALINK {
-	ULONG           TransmittedByteCount;   // both successful and failure, used to calculate TX throughput
-#ifdef RT2860
-	ULONG           LastReceivedByteCount;
-#endif
-	ULONG           ReceivedByteCount;      // both CRC okay and CRC error, used to calculate RX throughput
-	ULONG           BeenDisassociatedCount;
-	ULONG           BadCQIAutoRecoveryCount;
-	ULONG           PoorCQIRoamingCount;
-	ULONG           MgmtRingFullCount;
-	ULONG           RxCountSinceLastNULL;
-	ULONG           RxCount;
-	ULONG           RxRingErrCount;
-	ULONG           KickTxCount;
-	ULONG           TxRingErrCount;
-	LARGE_INTEGER   RealFcsErrCount;
-	ULONG           PendingNdisPacketCount;
-
-	ULONG           OneSecOsTxCount[NUM_OF_TX_RING];
-	ULONG           OneSecDmaDoneCount[NUM_OF_TX_RING];
-	UINT32          OneSecTxDoneCount;
-	ULONG           OneSecRxCount;
-	UINT32          OneSecTxAggregationCount;
-	UINT32          OneSecRxAggregationCount;
-
-	UINT32   		OneSecFrameDuplicateCount;
-
-#ifdef RT2870
-	ULONG           OneSecTransmittedByteCount;   // both successful and failure, used to calculate TX throughput
-#endif // RT2870 //
-
-	UINT32          OneSecTxNoRetryOkCount;
-	UINT32          OneSecTxRetryOkCount;
-	UINT32          OneSecTxFailCount;
-	UINT32          OneSecFalseCCACnt;      // CCA error count, for debug purpose, might move to global counter
-	UINT32          OneSecRxOkCnt;          // RX without error
-	UINT32          OneSecRxOkDataCnt;      // unicast-to-me DATA frame count
-	UINT32          OneSecRxFcsErrCnt;      // CRC error
-	UINT32          OneSecBeaconSentCnt;
-	UINT32          LastOneSecTotalTxCount; // OneSecTxNoRetryOkCount + OneSecTxRetryOkCount + OneSecTxFailCount
-	UINT32          LastOneSecRxOkDataCnt;  // OneSecRxOkDataCnt
-	ULONG		DuplicateRcv;
-	ULONG		TxAggCount;
-	ULONG		TxNonAggCount;
-	ULONG		TxAgg1MPDUCount;
-	ULONG		TxAgg2MPDUCount;
-	ULONG		TxAgg3MPDUCount;
-	ULONG		TxAgg4MPDUCount;
-	ULONG		TxAgg5MPDUCount;
-	ULONG		TxAgg6MPDUCount;
-	ULONG		TxAgg7MPDUCount;
-	ULONG		TxAgg8MPDUCount;
-	ULONG		TxAgg9MPDUCount;
-	ULONG		TxAgg10MPDUCount;
-	ULONG		TxAgg11MPDUCount;
-	ULONG		TxAgg12MPDUCount;
-	ULONG		TxAgg13MPDUCount;
-	ULONG		TxAgg14MPDUCount;
-	ULONG		TxAgg15MPDUCount;
-	ULONG		TxAgg16MPDUCount;
-
-	LARGE_INTEGER       TransmittedOctetsInAMSDU;
-	LARGE_INTEGER       TransmittedAMSDUCount;
-	LARGE_INTEGER       ReceivedOctesInAMSDUCount;
-	LARGE_INTEGER       ReceivedAMSDUCount;
-	LARGE_INTEGER       TransmittedAMPDUCount;
-	LARGE_INTEGER       TransmittedMPDUsInAMPDUCount;
-	LARGE_INTEGER       TransmittedOctetsInAMPDUCount;
-	LARGE_INTEGER       MPDUInReceivedAMPDUCount;
-} COUNTER_RALINK, *PCOUNTER_RALINK;
-
-typedef struct _PID_COUNTER {
-	ULONG           TxAckRequiredCount;      // CRC error
-	ULONG           TxAggreCount;
-	ULONG           TxSuccessCount; // OneSecTxNoRetryOkCount + OneSecTxRetryOkCount + OneSecTxFailCount
-	ULONG		LastSuccessRate;
-} PID_COUNTER, *PPID_COUNTER;
-
-typedef struct _COUNTER_DRS {
-	// to record the each TX rate's quality. 0 is best, the bigger the worse.
-	USHORT          TxQuality[MAX_STEP_OF_TX_RATE_SWITCH];
-	UCHAR           PER[MAX_STEP_OF_TX_RATE_SWITCH];
-	UCHAR           TxRateUpPenalty;      // extra # of second penalty due to last unstable condition
-	ULONG           CurrTxRateStableTime; // # of second in current TX rate
-	BOOLEAN         fNoisyEnvironment;
-	BOOLEAN         fLastSecAccordingRSSI;
-	UCHAR           LastSecTxRateChangeAction; // 0: no change, 1:rate UP, 2:rate down
-	UCHAR			LastTimeTxRateChangeAction; //Keep last time value of LastSecTxRateChangeAction
-	ULONG			LastTxOkCount;
-} COUNTER_DRS, *PCOUNTER_DRS;
-
-//
-//  Arcfour Structure Added by PaulWu
-//
-typedef struct  _ARCFOUR
-{
-	UINT            X;
-	UINT            Y;
-	UCHAR           STATE[256];
-} ARCFOURCONTEXT, *PARCFOURCONTEXT;
-
-// MIMO Tx parameter, ShortGI, MCS, STBC, etc.  these are fields in TXWI too. just copy to TXWI.
-typedef struct  _RECEIVE_SETTING {
-	USHORT   	NumOfRX:2;                 // MIMO. WE HAVE 3R
-	USHORT		Mode:2;	//channel bandwidth 20MHz or 40 MHz
-	USHORT		ShortGI:1;
-	USHORT		STBC:2;	//SPACE
-	USHORT		rsv:3;
-	USHORT		OFDM:1;
-	USHORT		MIMO:1;
- } RECEIVE_SETTING, *PRECEIVE_SETTING;
-
-// Shared key data structure
-typedef struct  _WEP_KEY {
-	UCHAR   KeyLen;                     // Key length for each key, 0: entry is invalid
-	UCHAR   Key[MAX_LEN_OF_KEY];        // right now we implement 4 keys, 128 bits max
-} WEP_KEY, *PWEP_KEY;
-
-typedef struct _CIPHER_KEY {
-	UCHAR   Key[16];            // right now we implement 4 keys, 128 bits max
-	UCHAR   RxMic[8];			// make alignment
-	UCHAR   TxMic[8];
-	UCHAR   TxTsc[6];           // 48bit TSC value
-	UCHAR   RxTsc[6];           // 48bit TSC value
-	UCHAR   CipherAlg;          // 0-none, 1:WEP64, 2:WEP128, 3:TKIP, 4:AES, 5:CKIP64, 6:CKIP128
-	UCHAR   KeyLen;
-	UCHAR   BssId[6];
-            // Key length for each key, 0: entry is invalid
-	UCHAR   Type;               // Indicate Pairwise/Group when reporting MIC error
-} CIPHER_KEY, *PCIPHER_KEY;
-
-typedef struct _BBP_TUNING_STRUCT {
-	BOOLEAN     Enable;
-	UCHAR       FalseCcaCountUpperBound;  // 100 per sec
-	UCHAR       FalseCcaCountLowerBound;  // 10 per sec
-	UCHAR       R17LowerBound;            // specified in E2PROM
-	UCHAR       R17UpperBound;            // 0x68 according to David Tung
-	UCHAR       CurrentR17Value;
-} BBP_TUNING, *PBBP_TUNING;
-
-typedef struct _SOFT_RX_ANT_DIVERSITY_STRUCT {
-	UCHAR     EvaluatePeriod;		 // 0:not evalute status, 1: evaluate status, 2: switching status
-#ifdef RT2870
-	UCHAR     EvaluateStableCnt;
-#endif
-	UCHAR     Pair1PrimaryRxAnt;     // 0:Ant-E1, 1:Ant-E2
-	UCHAR     Pair1SecondaryRxAnt;   // 0:Ant-E1, 1:Ant-E2
-	UCHAR     Pair2PrimaryRxAnt;     // 0:Ant-E3, 1:Ant-E4
-	UCHAR     Pair2SecondaryRxAnt;   // 0:Ant-E3, 1:Ant-E4
-	SHORT     Pair1AvgRssi[2];       // AvgRssi[0]:E1, AvgRssi[1]:E2
-	SHORT     Pair2AvgRssi[2];       // AvgRssi[0]:E3, AvgRssi[1]:E4
-	SHORT     Pair1LastAvgRssi;      //
-	SHORT     Pair2LastAvgRssi;      //
-	ULONG     RcvPktNumWhenEvaluate;
-	BOOLEAN   FirstPktArrivedWhenEvaluate;
-	RALINK_TIMER_STRUCT    RxAntDiversityTimer;
-} SOFT_RX_ANT_DIVERSITY, *PSOFT_RX_ANT_DIVERSITY;
-
-typedef struct _LEAP_AUTH_INFO {
-	BOOLEAN         Enabled;        //Ture: Enable LEAP Authentication
-	BOOLEAN         CCKM;           //Ture: Use Fast Reauthentication with CCKM
-	UCHAR           Reserve[2];
-	UCHAR           UserName[256];  //LEAP, User name
-	ULONG           UserNameLen;
-	UCHAR           Password[256];  //LEAP, User Password
-	ULONG           PasswordLen;
-} LEAP_AUTH_INFO, *PLEAP_AUTH_INFO;
-
-typedef struct {
-	UCHAR        Addr[MAC_ADDR_LEN];
-	UCHAR        ErrorCode[2];  //00 01-Invalid authentication type
-								//00 02-Authentication timeout
-								//00 03-Challenge from AP failed
-								//00 04-Challenge to AP failed
-	BOOLEAN      Reported;
-} ROGUEAP_ENTRY, *PROGUEAP_ENTRY;
-
-typedef struct {
-	UCHAR               RogueApNr;
-	ROGUEAP_ENTRY       RogueApEntry[MAX_LEN_OF_BSS_TABLE];
-} ROGUEAP_TABLE, *PROGUEAP_TABLE;
-
-typedef struct {
-	BOOLEAN     Enable;
-	UCHAR       Delta;
-	BOOLEAN     PlusSign;
-} CCK_TX_POWER_CALIBRATE, *PCCK_TX_POWER_CALIBRATE;
-
-//
-// Receive Tuple Cache Format
-//
-typedef struct  _TUPLE_CACHE    {
-	BOOLEAN         Valid;
-	UCHAR           MacAddress[MAC_ADDR_LEN];
-	USHORT          Sequence;
-	USHORT          Frag;
-} TUPLE_CACHE, *PTUPLE_CACHE;
-
-//
-// Fragment Frame structure
-//
-typedef struct  _FRAGMENT_FRAME {
-	PNDIS_PACKET    pFragPacket;
-	ULONG       RxSize;
-	USHORT      Sequence;
-	USHORT      LastFrag;
-	ULONG       Flags;          // Some extra frame information. bit 0: LLC presented
-} FRAGMENT_FRAME, *PFRAGMENT_FRAME;
-
-
-//
-// Packet information for NdisQueryPacket
-//
-typedef struct  _PACKET_INFO    {
-	UINT            PhysicalBufferCount;    // Physical breaks of buffer descripor chained
-	UINT            BufferCount ;           // Number of Buffer descriptor chained
-	UINT            TotalPacketLength ;     // Self explained
-	PNDIS_BUFFER    pFirstBuffer;           // Pointer to first buffer descriptor
-} PACKET_INFO, *PPACKET_INFO;
-
-//
-// Tkip Key structure which RC4 key & MIC calculation
-//
-typedef struct  _TKIP_KEY_INFO  {
-	UINT        nBytesInM;  // # bytes in M for MICKEY
-	ULONG       IV16;
-	ULONG       IV32;
-	ULONG       K0;         // for MICKEY Low
-	ULONG       K1;         // for MICKEY Hig
-	ULONG       L;          // Current state for MICKEY
-	ULONG       R;          // Current state for MICKEY
-	ULONG       M;          // Message accumulator for MICKEY
-	UCHAR       RC4KEY[16];
-	UCHAR       MIC[8];
-} TKIP_KEY_INFO, *PTKIP_KEY_INFO;
-
-//
-// Private / Misc data, counters for driver internal use
-//
-typedef struct  __PRIVATE_STRUC {
-	UINT       SystemResetCnt;         // System reset counter
-	UINT       TxRingFullCnt;          // Tx ring full occurrance number
-	UINT       PhyRxErrCnt;            // PHY Rx error count, for debug purpose, might move to global counter
-	// Variables for WEP encryption / decryption in rtmp_wep.c
-	UINT       FCSCRC32;
-	ARCFOURCONTEXT  WEPCONTEXT;
-	// Tkip stuff
-	TKIP_KEY_INFO   Tx;
-	TKIP_KEY_INFO   Rx;
-} PRIVATE_STRUC, *PPRIVATE_STRUC;
-
-// structure to tune BBP R66 (BBP TUNING)
-typedef struct _BBP_R66_TUNING {
-	BOOLEAN     bEnable;
-	USHORT      FalseCcaLowerThreshold;  // default 100
-	USHORT      FalseCcaUpperThreshold;  // default 512
-	UCHAR       R66Delta;
-	UCHAR       R66CurrentValue;
-	BOOLEAN		R66LowerUpperSelect; //Before LinkUp, Used LowerBound or UpperBound as R66 value.
-} BBP_R66_TUNING, *PBBP_R66_TUNING;
-
-// structure to store channel TX power
-typedef struct _CHANNEL_TX_POWER {
-	USHORT     RemainingTimeForUse;		//unit: sec
-	UCHAR      Channel;
-	CHAR       Power;
-	CHAR       Power2;
-	UCHAR      MaxTxPwr;
-	UCHAR      DfsReq;
-} CHANNEL_TX_POWER, *PCHANNEL_TX_POWER;
-
-// structure to store 802.11j channel TX power
-typedef struct _CHANNEL_11J_TX_POWER {
-	UCHAR      Channel;
-	UCHAR      BW;	// BW_10 or BW_20
-	CHAR       Power;
-	CHAR       Power2;
-	USHORT     RemainingTimeForUse;		//unit: sec
-} CHANNEL_11J_TX_POWER, *PCHANNEL_11J_TX_POWER;
+/* */
+/*  Statistic counter structure */
+/* */
+struct rt_counter_802_3 {
+	/* General Stats */
+	unsigned long GoodTransmits;
+	unsigned long GoodReceives;
+	unsigned long TxErrors;
+	unsigned long RxErrors;
+	unsigned long RxNoBuffer;
+
+	/* Ethernet Stats */
+	unsigned long RcvAlignmentErrors;
+	unsigned long OneCollision;
+	unsigned long MoreCollisions;
 
-typedef enum _ABGBAND_STATE_ {
-	UNKNOWN_BAND,
-	BG_BAND,
-	A_BAND,
-} ABGBAND_STATE;
+};
 
-typedef struct _MLME_STRUCT {
-	// STA state machines
-	STATE_MACHINE           CntlMachine;
-	STATE_MACHINE           AssocMachine;
-	STATE_MACHINE           AuthMachine;
-	STATE_MACHINE           AuthRspMachine;
-	STATE_MACHINE           SyncMachine;
-	STATE_MACHINE           WpaPskMachine;
-	STATE_MACHINE           LeapMachine;
-	STATE_MACHINE           AironetMachine;
-	STATE_MACHINE_FUNC      AssocFunc[ASSOC_FUNC_SIZE];
-	STATE_MACHINE_FUNC      AuthFunc[AUTH_FUNC_SIZE];
-	STATE_MACHINE_FUNC      AuthRspFunc[AUTH_RSP_FUNC_SIZE];
-	STATE_MACHINE_FUNC      SyncFunc[SYNC_FUNC_SIZE];
-	STATE_MACHINE_FUNC      WpaPskFunc[WPA_PSK_FUNC_SIZE];
-	STATE_MACHINE_FUNC      AironetFunc[AIRONET_FUNC_SIZE];
-	STATE_MACHINE_FUNC      ActFunc[ACT_FUNC_SIZE];
-	// Action
-	STATE_MACHINE           ActMachine;
-
-	ULONG                   ChannelQuality;  // 0..100, Channel Quality Indication for Roaming
-	ULONG                   Now32;           // latch the value of NdisGetSystemUpTime()
-	ULONG                   LastSendNULLpsmTime;
-
-	BOOLEAN                 bRunning;
-	NDIS_SPIN_LOCK          TaskLock;
-	MLME_QUEUE              Queue;
-
-	UINT                    ShiftReg;
-
-	RALINK_TIMER_STRUCT     PeriodicTimer;
-	RALINK_TIMER_STRUCT     APSDPeriodicTimer;
-	RALINK_TIMER_STRUCT     LinkDownTimer;
-	RALINK_TIMER_STRUCT     LinkUpTimer;
-#ifdef RT2860
-    UCHAR                   bPsPollTimerRunning;
-    RALINK_TIMER_STRUCT     PsPollTimer;
-	RALINK_TIMER_STRUCT     RadioOnOffTimer;
-#endif
-	ULONG                   PeriodicRound;
-	ULONG                   OneSecPeriodicRound;
-
-	UCHAR					RealRxPath;
-	BOOLEAN					bLowThroughput;
-	BOOLEAN					bEnableAutoAntennaCheck;
-	RALINK_TIMER_STRUCT		RxAntEvalTimer;
-
-#ifdef RT2870
-	UCHAR CaliBW40RfR24;
-	UCHAR CaliBW20RfR24;
-#endif // RT2870 //
-} MLME_STRUCT, *PMLME_STRUCT;
-
-// structure for radar detection and channel switch
-typedef struct _RADAR_DETECT_STRUCT {
-	UCHAR		CSCount;			//Channel switch counter
-	UCHAR		CSPeriod;			//Channel switch period (beacon count)
-	UCHAR		RDCount;			//Radar detection counter
-	UCHAR		RDMode;				//Radar Detection mode
-	UCHAR		RDDurRegion;		//Radar detection duration region
-	UCHAR		BBPR16;
-	UCHAR		BBPR17;
-	UCHAR		BBPR18;
-	UCHAR		BBPR21;
-	UCHAR		BBPR22;
-	UCHAR		BBPR64;
-	ULONG		InServiceMonitorCount; // unit: sec
-	UINT8		DfsSessionTime;
-	BOOLEAN		bFastDfs;
-	UINT8		ChMovingTime;
-	UINT8		LongPulseRadarTh;
-} RADAR_DETECT_STRUCT, *PRADAR_DETECT_STRUCT;
-
-typedef enum _REC_BLOCKACK_STATUS
-{
-    Recipient_NONE=0,
-	Recipient_USED,
-	Recipient_HandleRes,
-    Recipient_Accept
-} REC_BLOCKACK_STATUS, *PREC_BLOCKACK_STATUS;
+struct rt_counter_802_11 {
+	unsigned long Length;
+	LARGE_INTEGER LastTransmittedFragmentCount;
+	LARGE_INTEGER TransmittedFragmentCount;
+	LARGE_INTEGER MulticastTransmittedFrameCount;
+	LARGE_INTEGER FailedCount;
+	LARGE_INTEGER RetryCount;
+	LARGE_INTEGER MultipleRetryCount;
+	LARGE_INTEGER RTSSuccessCount;
+	LARGE_INTEGER RTSFailureCount;
+	LARGE_INTEGER ACKFailureCount;
+	LARGE_INTEGER FrameDuplicateCount;
+	LARGE_INTEGER ReceivedFragmentCount;
+	LARGE_INTEGER MulticastReceivedFrameCount;
+	LARGE_INTEGER FCSErrorCount;
+};
 
-typedef enum _ORI_BLOCKACK_STATUS
-{
-    Originator_NONE=0,
-	Originator_USED,
-    Originator_WaitRes,
-    Originator_Done
-} ORI_BLOCKACK_STATUS, *PORI_BLOCKACK_STATUS;
+struct rt_counter_ralink {
+	unsigned long TransmittedByteCount;	/* both successful and failure, used to calculate TX throughput */
+	unsigned long ReceivedByteCount;	/* both CRC okay and CRC error, used to calculate RX throughput */
+	unsigned long BeenDisassociatedCount;
+	unsigned long BadCQIAutoRecoveryCount;
+	unsigned long PoorCQIRoamingCount;
+	unsigned long MgmtRingFullCount;
+	unsigned long RxCountSinceLastNULL;
+	unsigned long RxCount;
+	unsigned long RxRingErrCount;
+	unsigned long KickTxCount;
+	unsigned long TxRingErrCount;
+	LARGE_INTEGER RealFcsErrCount;
+	unsigned long PendingNdisPacketCount;
+
+	unsigned long OneSecOsTxCount[NUM_OF_TX_RING];
+	unsigned long OneSecDmaDoneCount[NUM_OF_TX_RING];
+	u32 OneSecTxDoneCount;
+	unsigned long OneSecRxCount;
+	u32 OneSecTxAggregationCount;
+	u32 OneSecRxAggregationCount;
+	u32 OneSecReceivedByteCount;
+	u32 OneSecFrameDuplicateCount;
+
+	u32 OneSecTransmittedByteCount;	/* both successful and failure, used to calculate TX throughput */
+	u32 OneSecTxNoRetryOkCount;
+	u32 OneSecTxRetryOkCount;
+	u32 OneSecTxFailCount;
+	u32 OneSecFalseCCACnt;	/* CCA error count, for debug purpose, might move to global counter */
+	u32 OneSecRxOkCnt;	/* RX without error */
+	u32 OneSecRxOkDataCnt;	/* unicast-to-me DATA frame count */
+	u32 OneSecRxFcsErrCnt;	/* CRC error */
+	u32 OneSecBeaconSentCnt;
+	u32 LastOneSecTotalTxCount;	/* OneSecTxNoRetryOkCount + OneSecTxRetryOkCount + OneSecTxFailCount */
+	u32 LastOneSecRxOkDataCnt;	/* OneSecRxOkDataCnt */
+	unsigned long DuplicateRcv;
+	unsigned long TxAggCount;
+	unsigned long TxNonAggCount;
+	unsigned long TxAgg1MPDUCount;
+	unsigned long TxAgg2MPDUCount;
+	unsigned long TxAgg3MPDUCount;
+	unsigned long TxAgg4MPDUCount;
+	unsigned long TxAgg5MPDUCount;
+	unsigned long TxAgg6MPDUCount;
+	unsigned long TxAgg7MPDUCount;
+	unsigned long TxAgg8MPDUCount;
+	unsigned long TxAgg9MPDUCount;
+	unsigned long TxAgg10MPDUCount;
+	unsigned long TxAgg11MPDUCount;
+	unsigned long TxAgg12MPDUCount;
+	unsigned long TxAgg13MPDUCount;
+	unsigned long TxAgg14MPDUCount;
+	unsigned long TxAgg15MPDUCount;
+	unsigned long TxAgg16MPDUCount;
+
+	LARGE_INTEGER TransmittedOctetsInAMSDU;
+	LARGE_INTEGER TransmittedAMSDUCount;
+	LARGE_INTEGER ReceivedOctesInAMSDUCount;
+	LARGE_INTEGER ReceivedAMSDUCount;
+	LARGE_INTEGER TransmittedAMPDUCount;
+	LARGE_INTEGER TransmittedMPDUsInAMPDUCount;
+	LARGE_INTEGER TransmittedOctetsInAMPDUCount;
+	LARGE_INTEGER MPDUInReceivedAMPDUCount;
+};
 
-typedef struct _BA_ORI_ENTRY{
-	UCHAR   Wcid;
-	UCHAR   TID;
-	UCHAR   BAWinSize;
-	UCHAR   Token;
-// Sequence is to fill every outgoing QoS DATA frame's sequence field in 802.11 header.
-	USHORT	Sequence;
-	USHORT	TimeOutValue;
-	ORI_BLOCKACK_STATUS  ORI_BA_Status;
-	RALINK_TIMER_STRUCT ORIBATimer;
-	PVOID	pAdapter;
-} BA_ORI_ENTRY, *PBA_ORI_ENTRY;
-
-typedef struct _BA_REC_ENTRY {
-	UCHAR   Wcid;
-	UCHAR   TID;
-	UCHAR   BAWinSize;	// 7.3.1.14. each buffer is capable of holding a max AMSDU or MSDU.
-	USHORT		LastIndSeq;
-	USHORT		TimeOutValue;
-	RALINK_TIMER_STRUCT RECBATimer;
-	ULONG		LastIndSeqAtTimer;
-	ULONG		nDropPacket;
-	ULONG		rcvSeq;
-	REC_BLOCKACK_STATUS  REC_BA_Status;
-	NDIS_SPIN_LOCK          RxReRingLock;                 // Rx Ring spinlock
-	PVOID	pAdapter;
-	struct reordering_list	list;
-} BA_REC_ENTRY, *PBA_REC_ENTRY;
-
-
-typedef struct {
-	ULONG		numAsRecipient;		// I am recipient of numAsRecipient clients. These client are in the BARecEntry[]
-	ULONG		numAsOriginator;	// I am originator of 	numAsOriginator clients. These clients are in the BAOriEntry[]
-	BA_ORI_ENTRY       BAOriEntry[MAX_LEN_OF_BA_ORI_TABLE];
-	BA_REC_ENTRY       BARecEntry[MAX_LEN_OF_BA_REC_TABLE];
-} BA_TABLE, *PBA_TABLE;
-
-//For QureyBATableOID use;
-typedef struct  PACKED _OID_BA_REC_ENTRY{
-	UCHAR   MACAddr[MAC_ADDR_LEN];
-	UCHAR   BaBitmap;   // if (BaBitmap&(1<<TID)), this session with{MACAddr, TID}exists, so read BufSize[TID] for BufferSize
-	UCHAR   rsv;
-	UCHAR   BufSize[8];
-	REC_BLOCKACK_STATUS	REC_BA_Status[8];
-} OID_BA_REC_ENTRY, *POID_BA_REC_ENTRY;
-
-//For QureyBATableOID use;
-typedef struct  PACKED _OID_BA_ORI_ENTRY{
-	UCHAR   MACAddr[MAC_ADDR_LEN];
-	UCHAR   BaBitmap;  // if (BaBitmap&(1<<TID)), this session with{MACAddr, TID}exists, so read BufSize[TID] for BufferSize, read ORI_BA_Status[TID] for status
-	UCHAR   rsv;
-	UCHAR   BufSize[8];
-	ORI_BLOCKACK_STATUS  ORI_BA_Status[8];
-} OID_BA_ORI_ENTRY, *POID_BA_ORI_ENTRY;
-
-typedef struct _QUERYBA_TABLE{
-	OID_BA_ORI_ENTRY       BAOriEntry[32];
-	OID_BA_REC_ENTRY       BARecEntry[32];
-	UCHAR   OriNum;// Number of below BAOriEntry
-	UCHAR   RecNum;// Number of below BARecEntry
-} QUERYBA_TABLE, *PQUERYBA_TABLE;
-
-typedef	union	_BACAP_STRUC	{
-	struct	{
-		UINT32		RxBAWinLimit:8;
-		UINT32		TxBAWinLimit:8;
-		UINT32		AutoBA:1;	// automatically BA
-		UINT32		Policy:2;	// 0: DELAY_BA 1:IMMED_BA  (//BA Policy subfiled value in ADDBA frame)   2:BA-not use
-		UINT32		MpduDensity:3;
-		UINT32       	AmsduEnable:1;	//Enable AMSDU transmisstion
-		UINT32       	AmsduSize:1;	// 0:3839, 1:7935 bytes. UINT  MSDUSizeToBytes[]	= { 3839, 7935};
-		UINT32       	MMPSmode:2;	// MIMO power save more, 0:static, 1:dynamic, 2:rsv, 3:mimo enable
-		UINT32       	bHtAdhoc:1;			// adhoc can use ht rate.
-		UINT32       	b2040CoexistScanSup:1;		//As Sta, support do 2040 coexistence scan for AP. As Ap, support monitor trigger event to check if can use BW 40MHz.
-		UINT32       	:4;
-	}	field;
-	UINT32			word;
-} BACAP_STRUC, *PBACAP_STRUC;
+struct rt_counter_drs {
+	/* to record the each TX rate's quality. 0 is best, the bigger the worse. */
+	u16 TxQuality[MAX_STEP_OF_TX_RATE_SWITCH];
+	u8 PER[MAX_STEP_OF_TX_RATE_SWITCH];
+	u8 TxRateUpPenalty;	/* extra # of second penalty due to last unstable condition */
+	unsigned long CurrTxRateStableTime;	/* # of second in current TX rate */
+	BOOLEAN fNoisyEnvironment;
+	BOOLEAN fLastSecAccordingRSSI;
+	u8 LastSecTxRateChangeAction;	/* 0: no change, 1:rate UP, 2:rate down */
+	u8 LastTimeTxRateChangeAction;	/*Keep last time value of LastSecTxRateChangeAction */
+	unsigned long LastTxOkCount;
+};
 
-//This structure is for all 802.11n card InterOptibilityTest action. Reset all Num every n second.  (Details see MLMEPeriodic)
-typedef	struct	_IOT_STRUC	{
-	UCHAR			Threshold[2];
-	UCHAR			ReorderTimeOutNum[MAX_LEN_OF_BA_REC_TABLE];	// compare with threshold[0]
-	UCHAR			RefreshNum[MAX_LEN_OF_BA_REC_TABLE];	// compare with threshold[1]
-	ULONG			OneSecInWindowCount;
-	ULONG			OneSecFrameDuplicateCount;
-	ULONG			OneSecOutWindowCount;
-	UCHAR			DelOriAct;
-	UCHAR			DelRecAct;
-	UCHAR			RTSShortProt;
-	UCHAR			RTSLongProt;
-	BOOLEAN			bRTSLongProtOn;
-	BOOLEAN			bLastAtheros;
-    BOOLEAN			bCurrentAtheros;
-    BOOLEAN         bNowAtherosBurstOn;
-	BOOLEAN			bNextDisableRxBA;
-    BOOLEAN			bToggle;
-} IOT_STRUC, *PIOT_STRUC;
-
-// This is the registry setting for 802.11n transmit setting.  Used in advanced page.
-typedef union _REG_TRANSMIT_SETTING {
- struct {
-		 UINT32  rsv0:10;
-		 UINT32  TxBF:1;
-         UINT32  BW:1; //channel bandwidth 20MHz or 40 MHz
-         UINT32  ShortGI:1;
-         UINT32  STBC:1; //SPACE
-         UINT32  TRANSNO:2;
-         UINT32  HTMODE:1;
-         UINT32  EXTCHA:2;
-         UINT32  rsv:13;
-    } field;
- UINT32   word;
-} REG_TRANSMIT_SETTING, *PREG_TRANSMIT_SETTING;
+/***************************************************************************
+  *	security key related data structure
+  **************************************************************************/
+struct rt_cipher_key {
+	u8 Key[16];		/* right now we implement 4 keys, 128 bits max */
+	u8 RxMic[8];		/* make alignment */
+	u8 TxMic[8];
+	u8 TxTsc[6];		/* 48bit TSC value */
+	u8 RxTsc[6];		/* 48bit TSC value */
+	u8 CipherAlg;	/* 0-none, 1:WEP64, 2:WEP128, 3:TKIP, 4:AES, 5:CKIP64, 6:CKIP128 */
+	u8 KeyLen;
+	u8 BssId[6];
+	/* Key length for each key, 0: entry is invalid */
+	u8 Type;		/* Indicate Pairwise/Group when reporting MIC error */
+};
 
-typedef union  _DESIRED_TRANSMIT_SETTING {
-	struct	{
-			USHORT   	MCS:7;                 	// MCS
-			USHORT		PhyMode:4;
-			USHORT	 	FixedTxMode:2;			// If MCS isn't AUTO, fix rate in CCK, OFDM or HT mode.
-			USHORT		rsv:3;
-	}	field;
-	USHORT		word;
- } DESIRED_TRANSMIT_SETTING, *PDESIRED_TRANSMIT_SETTING;
-
-typedef struct {
-	BOOLEAN		IsRecipient;
-	UCHAR   MACAddr[MAC_ADDR_LEN];
-	UCHAR   TID;
-	UCHAR   nMSDU;
-	USHORT   TimeOut;
-	BOOLEAN bAllTid;  // If True, delete all TID for BA sessions with this MACaddr.
-} OID_ADD_BA_ENTRY, *POID_ADD_BA_ENTRY;
-
-//
-// Multiple SSID structure
-//
-#define WLAN_MAX_NUM_OF_TIM			((MAX_LEN_OF_MAC_TABLE >> 3) + 1) /* /8 + 1 */
-#define WLAN_CT_TIM_BCMC_OFFSET		0 /* unit: 32B */
+/* structure to define WPA Group Key Rekey Interval */
+struct PACKED rt_802_11_wpa_rekey {
+	unsigned long ReKeyMethod;	/* mechanism for rekeying: 0:disable, 1: time-based, 2: packet-based */
+	unsigned long ReKeyInterval;	/* time-based: seconds, packet-based: kilo-packets */
+};
 
-/* clear bcmc TIM bit */
-#define WLAN_MR_TIM_BCMC_CLEAR(apidx) \
-	pAd->ApCfg.MBSSID[apidx].TimBitmaps[WLAN_CT_TIM_BCMC_OFFSET] &= ~BIT8[0];
+#ifdef RTMP_MAC_USB
+/***************************************************************************
+  *	RTUSB I/O related data structure
+  **************************************************************************/
+struct rt_set_asic_wcid {
+	unsigned long WCID;		/* mechanism for rekeying: 0:disable, 1: time-based, 2: packet-based */
+	unsigned long SetTid;		/* time-based: seconds, packet-based: kilo-packets */
+	unsigned long DeleteTid;	/* time-based: seconds, packet-based: kilo-packets */
+	u8 Addr[MAC_ADDR_LEN];	/* avoid in interrupt when write key */
+};
 
-/* set bcmc TIM bit */
-#define WLAN_MR_TIM_BCMC_SET(apidx) \
-	pAd->ApCfg.MBSSID[apidx].TimBitmaps[WLAN_CT_TIM_BCMC_OFFSET] |= BIT8[0];
+struct rt_set_asic_wcid_attri {
+	unsigned long WCID;		/* mechanism for rekeying: 0:disable, 1: time-based, 2: packet-based */
+	unsigned long Cipher;		/* ASIC Cipher definition */
+	u8 Addr[ETH_LENGTH_OF_ADDRESS];
+};
 
-/* clear a station PS TIM bit */
-#define WLAN_MR_TIM_BIT_CLEAR(ad_p, apidx, wcid) \
-	{	UCHAR tim_offset = wcid >> 3; \
-		UCHAR bit_offset = wcid & 0x7; \
-		ad_p->ApCfg.MBSSID[apidx].TimBitmaps[tim_offset] &= (~BIT8[bit_offset]); }
+/* for USB interface, avoid in interrupt when write key */
+struct rt_add_pairwise_key_entry {
+	u8 MacAddr[6];
+	u16 MacTabMatchWCID;	/* ASIC */
+	struct rt_cipher_key CipherKey;
+};
 
-/* set a station PS TIM bit */
-#define WLAN_MR_TIM_BIT_SET(ad_p, apidx, wcid) \
-	{	UCHAR tim_offset = wcid >> 3; \
-		UCHAR bit_offset = wcid & 0x7; \
-		ad_p->ApCfg.MBSSID[apidx].TimBitmaps[tim_offset] |= BIT8[bit_offset]; }
+/* Cipher suite type for mixed mode group cipher, P802.11i-2004 */
+typedef enum _RT_802_11_CIPHER_SUITE_TYPE {
+	Cipher_Type_NONE,
+	Cipher_Type_WEP40,
+	Cipher_Type_TKIP,
+	Cipher_Type_RSVD,
+	Cipher_Type_CCMP,
+	Cipher_Type_WEP104
+} RT_802_11_CIPHER_SUITE_TYPE, *PRT_802_11_CIPHER_SUITE_TYPE;
+#endif /* RTMP_MAC_USB // */
+
+struct rt_rogueap_entry {
+	u8 Addr[MAC_ADDR_LEN];
+	u8 ErrorCode[2];	/*00 01-Invalid authentication type */
+	/*00 02-Authentication timeout */
+	/*00 03-Challenge from AP failed */
+	/*00 04-Challenge to AP failed */
+	BOOLEAN Reported;
+};
 
-#ifdef RT2870
-#define BEACON_BITMAP_MASK		0xff
-typedef struct _BEACON_SYNC_STRUCT_
-{
-	UCHAR        			BeaconBuf[HW_BEACON_MAX_COUNT][HW_BEACON_OFFSET];
-	UCHAR					BeaconTxWI[HW_BEACON_MAX_COUNT][TXWI_SIZE];
-	ULONG 					TimIELocationInBeacon[HW_BEACON_MAX_COUNT];
-	ULONG					CapabilityInfoLocationInBeacon[HW_BEACON_MAX_COUNT];
-	BOOLEAN					EnableBeacon;		// trigger to enable beacon transmission.
-	UCHAR					BeaconBitMap;		// NOTE: If the MAX_MBSSID_NUM is larger than 8, this parameter need to change.
-	UCHAR					DtimBitOn;			// NOTE: If the MAX_MBSSID_NUM is larger than 8, this parameter need to change.
-}BEACON_SYNC_STRUCT;
-#endif // RT2870 //
-
-typedef struct _MULTISSID_STRUCT {
-	UCHAR								Bssid[MAC_ADDR_LEN];
-    UCHAR                               SsidLen;
-    CHAR                                Ssid[MAX_LEN_OF_SSID];
-    USHORT                              CapabilityInfo;
-
-    PNET_DEV                   			MSSIDDev;
-
-	NDIS_802_11_AUTHENTICATION_MODE     AuthMode;
-	NDIS_802_11_WEP_STATUS              WepStatus;
-	NDIS_802_11_WEP_STATUS				GroupKeyWepStatus;
-	WPA_MIX_PAIR_CIPHER					WpaMixPairCipher;
-
-	ULONG								TxCount;
-	ULONG								RxCount;
-	ULONG								ReceivedByteCount;
-	ULONG								TransmittedByteCount;
-	ULONG								RxErrorCount;
-	ULONG								RxDropCount;
-
-	HTTRANSMIT_SETTING					HTPhyMode, MaxHTPhyMode, MinHTPhyMode;// For transmit phy setting in TXWI.
-	RT_HT_PHY_INFO						DesiredHtPhyInfo;
-	DESIRED_TRANSMIT_SETTING        	DesiredTransmitSetting; // Desired transmit setting. this is for reading registry setting only. not useful.
-	BOOLEAN								bAutoTxRateSwitch;
-
-	UCHAR                               DefaultKeyId;
-
-	UCHAR								TxRate;       // RATE_1, RATE_2, RATE_5_5, RATE_11, ...
-	UCHAR     							DesiredRates[MAX_LEN_OF_SUPPORTED_RATES];// OID_802_11_DESIRED_RATES
-	UCHAR								DesiredRatesIndex;
-	UCHAR     							MaxTxRate;            // RATE_1, RATE_2, RATE_5_5, RATE_11
-
-	UCHAR								TimBitmaps[WLAN_MAX_NUM_OF_TIM];
-
-    // WPA
-    UCHAR                               GMK[32];
-    UCHAR                               PMK[32];
-	UCHAR								GTK[32];
-    BOOLEAN                             IEEE8021X;
-    BOOLEAN                             PreAuth;
-    UCHAR                               GNonce[32];
-    UCHAR                               PortSecured;
-    NDIS_802_11_PRIVACY_FILTER          PrivacyFilter;
-    UCHAR                               BANClass3Data;
-    ULONG                               IsolateInterStaTraffic;
-
-    UCHAR                               RSNIE_Len[2];
-    UCHAR                               RSN_IE[2][MAX_LEN_OF_RSNIE];
-
-
-    UCHAR                   			TimIELocationInBeacon;
-    UCHAR                   			CapabilityInfoLocationInBeacon;
-    // outgoing BEACON frame buffer and corresponding TXWI
-	// PTXWI_STRUC                           BeaconTxWI; //
-    CHAR                                BeaconBuf[MAX_BEACON_SIZE]; // NOTE: BeaconBuf should be 4-byte aligned
-
-    BOOLEAN                             bHideSsid;
-	UINT16								StationKeepAliveTime; // unit: second
-
-    USHORT                              VLAN_VID;
-    USHORT                              VLAN_Priority;
-
-    RT_802_11_ACL						AccessControlList;
-
-	// EDCA Qos
-    BOOLEAN								bWmmCapable;	// 0:disable WMM, 1:enable WMM
-    BOOLEAN								bDLSCapable;	// 0:disable DLS, 1:enable DLS
-
-	UCHAR           					DlsPTK[64];		// Due to windows dirver count on meetinghouse to handle 4-way shake
-
-	// For 802.1x daemon setting per BSS
-	UCHAR								radius_srv_num;
-	RADIUS_SRV_INFO						radius_srv_info[MAX_RADIUS_SRV_NUM];
-
-#ifdef RTL865X_SOC
-	unsigned int						mylinkid;
-#endif
+struct rt_rogueap_table {
+	u8 RogueApNr;
+	struct rt_rogueap_entry RogueApEntry[MAX_LEN_OF_BSS_TABLE];
+};
 
+/* */
+/* Cisco IAPP format */
+/* */
+struct rt_cisco_iapp_content {
+	u16 Length;		/*IAPP Length */
+	u8 MessageType;	/*IAPP type */
+	u8 FunctionCode;	/*IAPP function type */
+	u8 DestinaionMAC[MAC_ADDR_LEN];
+	u8 SourceMAC[MAC_ADDR_LEN];
+	u16 Tag;		/*Tag(element IE) - Adjacent AP report */
+	u16 TagLength;	/*Length of element not including 4 byte header */
+	u8 OUI[4];		/*0x00, 0x40, 0x96, 0x00 */
+	u8 PreviousAP[MAC_ADDR_LEN];	/*MAC Address of access point */
+	u16 Channel;
+	u16 SsidLen;
+	u8 Ssid[MAX_LEN_OF_SSID];
+	u16 Seconds;		/*Seconds that the client has been disassociated. */
+};
 
-	UINT32					RcvdConflictSsidCount;
-	UINT32					RcvdSpoofedAssocRespCount;
-	UINT32					RcvdSpoofedReassocRespCount;
-	UINT32					RcvdSpoofedProbeRespCount;
-	UINT32					RcvdSpoofedBeaconCount;
-	UINT32					RcvdSpoofedDisassocCount;
-	UINT32					RcvdSpoofedAuthCount;
-	UINT32					RcvdSpoofedDeauthCount;
-	UINT32					RcvdSpoofedUnknownMgmtCount;
-	UINT32					RcvdReplayAttackCount;
-
-	CHAR					RssiOfRcvdConflictSsid;
-	CHAR					RssiOfRcvdSpoofedAssocResp;
-	CHAR					RssiOfRcvdSpoofedReassocResp;
-	CHAR					RssiOfRcvdSpoofedProbeResp;
-	CHAR					RssiOfRcvdSpoofedBeacon;
-	CHAR					RssiOfRcvdSpoofedDisassoc;
-	CHAR					RssiOfRcvdSpoofedAuth;
-	CHAR					RssiOfRcvdSpoofedDeauth;
-	CHAR					RssiOfRcvdSpoofedUnknownMgmt;
-	CHAR					RssiOfRcvdReplayAttack;
-
-	BOOLEAN					bBcnSntReq;
-	UCHAR					BcnBufIdx;
-} MULTISSID_STRUCT, *PMULTISSID_STRUCT;
-
-// configuration common to OPMODE_AP as well as OPMODE_STA
-typedef struct _COMMON_CONFIG {
-
-	BOOLEAN		bCountryFlag;
-	UCHAR		CountryCode[3];
-	UCHAR		Geography;
-	UCHAR       CountryRegion;      // Enum of country region, 0:FCC, 1:IC, 2:ETSI, 3:SPAIN, 4:France, 5:MKK, 6:MKK1, 7:Israel
-	UCHAR       CountryRegionForABand;	// Enum of country region for A band
-	UCHAR       PhyMode;            // PHY_11A, PHY_11B, PHY_11BG_MIXED, PHY_ABG_MIXED
-	USHORT      Dsifs;              // in units of usec
-	ULONG       PacketFilter;       // Packet filter for receiving
-
-	CHAR        Ssid[MAX_LEN_OF_SSID]; // NOT NULL-terminated
-	UCHAR       SsidLen;               // the actual ssid length in used
-	UCHAR       LastSsidLen;               // the actual ssid length in used
-	CHAR        LastSsid[MAX_LEN_OF_SSID]; // NOT NULL-terminated
-	UCHAR		LastBssid[MAC_ADDR_LEN];
-
-	UCHAR       Bssid[MAC_ADDR_LEN];
-	USHORT      BeaconPeriod;
-	UCHAR       Channel;
-	UCHAR       CentralChannel;    	// Central Channel when using 40MHz is indicating. not real channel.
-
-	UCHAR       SupRate[MAX_LEN_OF_SUPPORTED_RATES];
-	UCHAR       SupRateLen;
-	UCHAR       ExtRate[MAX_LEN_OF_SUPPORTED_RATES];
-	UCHAR       ExtRateLen;
-	UCHAR       DesireRate[MAX_LEN_OF_SUPPORTED_RATES];      // OID_802_11_DESIRED_RATES
-	UCHAR       MaxDesiredRate;
-	UCHAR       ExpectedACKRate[MAX_LEN_OF_SUPPORTED_RATES];
-
-	ULONG       BasicRateBitmap;        // backup basic ratebitmap
-
-	BOOLEAN		bAPSDCapable;
-	BOOLEAN		bInServicePeriod;
-	BOOLEAN		bAPSDAC_BE;
-	BOOLEAN		bAPSDAC_BK;
-	BOOLEAN		bAPSDAC_VI;
-	BOOLEAN		bAPSDAC_VO;
-	BOOLEAN		bNeedSendTriggerFrame;
-	BOOLEAN		bAPSDForcePowerSave;	// Force power save mode, should only use in APSD-STAUT
-	ULONG		TriggerTimerCount;
-	UCHAR		MaxSPLength;
-	UCHAR		BBPCurrentBW;	// BW_10, 	BW_20, BW_40
-	REG_TRANSMIT_SETTING        RegTransmitSetting; //registry transmit setting. this is for reading registry setting only. not useful.
-	UCHAR       TxRate;                 // Same value to fill in TXD. TxRate is 6-bit
-	UCHAR       MaxTxRate;              // RATE_1, RATE_2, RATE_5_5, RATE_11
-	UCHAR       TxRateIndex;            // Tx rate index in RateSwitchTable
-	UCHAR       TxRateTableSize;        // Valid Tx rate table size in RateSwitchTable
-	UCHAR       MinTxRate;              // RATE_1, RATE_2, RATE_5_5, RATE_11
-	UCHAR       RtsRate;                // RATE_xxx
-	HTTRANSMIT_SETTING	MlmeTransmit;   // MGMT frame PHY rate setting when operatin at Ht rate.
-	UCHAR       MlmeRate;               // RATE_xxx, used to send MLME frames
-	UCHAR       BasicMlmeRate;          // Default Rate for sending MLME frames
-
-	USHORT      RtsThreshold;           // in unit of BYTE
-	USHORT      FragmentThreshold;      // in unit of BYTE
-
-	UCHAR       TxPower;                // in unit of mW
-	ULONG       TxPowerPercentage;      // 0~100 %
-	ULONG       TxPowerDefault;         // keep for TxPowerPercentage
-
-	BACAP_STRUC        BACapability; //   NO USE = 0XFF  ;  IMMED_BA =1  ;  DELAY_BA=0
-	BACAP_STRUC        REGBACapability; //   NO USE = 0XFF  ;  IMMED_BA =1  ;  DELAY_BA=0
-
-	IOT_STRUC		IOTestParm;	// 802.11n InterOpbility Test Parameter;
-	ULONG       TxPreamble;             // Rt802_11PreambleLong, Rt802_11PreambleShort, Rt802_11PreambleAuto
-	BOOLEAN     bUseZeroToDisableFragment;     // Microsoft use 0 as disable
-	ULONG       UseBGProtection;        // 0: auto, 1: always use, 2: always not use
-	BOOLEAN     bUseShortSlotTime;      // 0: disable, 1 - use short slot (9us)
-	BOOLEAN     bEnableTxBurst;         // 1: enble TX PACKET BURST, 0: disable TX PACKET BURST
-	BOOLEAN     bAggregationCapable;      // 1: enable TX aggregation when the peer supports it
-	BOOLEAN     bPiggyBackCapable;		// 1: enable TX piggy-back according MAC's version
-	BOOLEAN     bIEEE80211H;			// 1: enable IEEE802.11h spec.
-	ULONG		DisableOLBCDetect;		// 0: enable OLBC detect; 1 disable OLBC detect
-
-	BOOLEAN				bRdg;
-
-	BOOLEAN             bWmmCapable;        // 0:disable WMM, 1:enable WMM
-	QOS_CAPABILITY_PARM APQosCapability;    // QOS capability of the current associated AP
-	EDCA_PARM           APEdcaParm;         // EDCA parameters of the current associated AP
-	QBSS_LOAD_PARM      APQbssLoad;         // QBSS load of the current associated AP
-	UCHAR               AckPolicy[4];       // ACK policy of the specified AC. see ACK_xxx
-	BOOLEAN				bDLSCapable;		// 0:disable DLS, 1:enable DLS
-	// a bitmap of BOOLEAN flags. each bit represent an operation status of a particular
-	// BOOLEAN control, either ON or OFF. These flags should always be accessed via
-	// OPSTATUS_TEST_FLAG(), OPSTATUS_SET_FLAG(), OP_STATUS_CLEAR_FLAG() macros.
-	// see fOP_STATUS_xxx in RTMP_DEF.C for detail bit definition
-	ULONG               OpStatusFlags;
-
-	BOOLEAN				NdisRadioStateOff; //For HCT 12.0, set this flag to TRUE instead of called MlmeRadioOff.
-	ABGBAND_STATE		BandState;		// For setting BBP used on B/G or A mode.
-
-	// IEEE802.11H--DFS.
-	RADAR_DETECT_STRUCT	RadarDetect;
-
-	// HT
-	UCHAR			BASize;		// USer desired BAWindowSize. Should not exceed our max capability
-	//RT_HT_CAPABILITY	SupportedHtPhy;
-	RT_HT_CAPABILITY	DesiredHtPhy;
-	HT_CAPABILITY_IE		HtCapability;
-	ADD_HT_INFO_IE		AddHTInfo;	// Useful as AP.
-	//This IE is used with channel switch announcement element when changing to a new 40MHz.
-	//This IE is included in channel switch ammouncement frames 7.4.1.5, beacons, probe Rsp.
-	NEW_EXT_CHAN_IE	NewExtChanOffset;	//7.3.2.20A, 1 if extension channel is above the control channel, 3 if below, 0 if not present
-
-    BOOLEAN                 bHTProtect;
-    BOOLEAN                 bMIMOPSEnable;
-    BOOLEAN					bBADecline;
-	BOOLEAN					bDisableReordering;
-	BOOLEAN					bForty_Mhz_Intolerant;
-	BOOLEAN					bExtChannelSwitchAnnouncement;
-	BOOLEAN					bRcvBSSWidthTriggerEvents;
-	ULONG					LastRcvBSSWidthTriggerEventsTime;
-
-	UCHAR					TxBASize;
-
-	// Enable wireless event
-	BOOLEAN				bWirelessEvent;
-	BOOLEAN				bWiFiTest;				// Enable this parameter for WiFi test
-
-	// Tx & Rx Stream number selection
-	UCHAR				TxStream;
-	UCHAR				RxStream;
-
-	// transmit phy mode, trasmit rate for Multicast.
-#ifdef MCAST_RATE_SPECIFIC
-	UCHAR				McastTransmitMcs;
-	UCHAR				McastTransmitPhyMode;
-#endif // MCAST_RATE_SPECIFIC //
-
-	BOOLEAN     		bHardwareRadio;     // Hardware controlled Radio enabled
-
-#ifdef RT2870
-	BOOLEAN     		bMultipleIRP;       // Multiple Bulk IN flag
-	UCHAR       		NumOfBulkInIRP;     // if bMultipleIRP == TRUE, NumOfBulkInIRP will be 4 otherwise be 1
- 	RT_HT_CAPABILITY	SupportedHtPhy;
-	ULONG				MaxPktOneTxBulk;
-	UCHAR				TxBulkFactor;
-	UCHAR				RxBulkFactor;
-
-	BEACON_SYNC_STRUCT	*pBeaconSync;
-	RALINK_TIMER_STRUCT	BeaconUpdateTimer;
-	UINT32				BeaconAdjust;
-	UINT32				BeaconFactor;
-	UINT32				BeaconRemain;
-#endif // RT2870 //
-
-
- 	NDIS_SPIN_LOCK			MeasureReqTabLock;
-	PMEASURE_REQ_TAB		pMeasureReqTab;
-
-	NDIS_SPIN_LOCK			TpcReqTabLock;
-	PTPC_REQ_TAB			pTpcReqTab;
-
-	// transmit phy mode, trasmit rate for Multicast.
-#ifdef MCAST_RATE_SPECIFIC
-	HTTRANSMIT_SETTING		MCastPhyMode;
-#endif // MCAST_RATE_SPECIFIC //
-} COMMON_CONFIG, *PCOMMON_CONFIG;
+/*
+  *	Fragment Frame structure
+  */
+struct rt_fragment_frame {
+	void *pFragPacket;
+	unsigned long RxSize;
+	u16 Sequence;
+	u16 LastFrag;
+	unsigned long Flags;		/* Some extra frame information. bit 0: LLC presented */
+};
 
-/* Modified by Wu Xi-Kun 4/21/2006 */
-// STA configuration and status
-typedef struct _STA_ADMIN_CONFIG {
-	// GROUP 1 -
-	//   User configuration loaded from Registry, E2PROM or OID_xxx. These settings describe
-	//   the user intended configuration, but not necessary fully equal to the final
-	//   settings in ACTIVE BSS after negotiation/compromize with the BSS holder (either
-	//   AP or IBSS holder).
-	//   Once initialized, user configuration can only be changed via OID_xxx
-	UCHAR       BssType;              // BSS_INFRA or BSS_ADHOC
-	USHORT      AtimWin;          // used when starting a new IBSS
-
-	// GROUP 2 -
-	//   User configuration loaded from Registry, E2PROM or OID_xxx. These settings describe
-	//   the user intended configuration, and should be always applied to the final
-	//   settings in ACTIVE BSS without compromising with the BSS holder.
-	//   Once initialized, user configuration can only be changed via OID_xxx
-	UCHAR       RssiTrigger;
-	UCHAR       RssiTriggerMode;      // RSSI_TRIGGERED_UPON_BELOW_THRESHOLD or RSSI_TRIGGERED_UPON_EXCCEED_THRESHOLD
-	USHORT      DefaultListenCount;   // default listen count;
-	ULONG       WindowsPowerMode;           // Power mode for AC power
-	ULONG       WindowsBatteryPowerMode;    // Power mode for battery if exists
-	BOOLEAN     bWindowsACCAMEnable;        // Enable CAM power mode when AC on
-	BOOLEAN     bAutoReconnect;         // Set to TRUE when setting OID_802_11_SSID with no matching BSSID
-	ULONG       WindowsPowerProfile;    // Windows power profile, for NDIS5.1 PnP
-
-	// MIB:ieee802dot11.dot11smt(1).dot11StationConfigTable(1)
-	USHORT      Psm;                  // power management mode   (PWR_ACTIVE|PWR_SAVE)
-	USHORT      DisassocReason;
-	UCHAR       DisassocSta[MAC_ADDR_LEN];
-	USHORT      DeauthReason;
-	UCHAR       DeauthSta[MAC_ADDR_LEN];
-	USHORT      AuthFailReason;
-	UCHAR       AuthFailSta[MAC_ADDR_LEN];
-
-	NDIS_802_11_PRIVACY_FILTER          PrivacyFilter;  // PrivacyFilter enum for 802.1X
-	NDIS_802_11_AUTHENTICATION_MODE     AuthMode;       // This should match to whatever microsoft defined
-	NDIS_802_11_WEP_STATUS              WepStatus;
-	NDIS_802_11_WEP_STATUS				OrigWepStatus;	// Original wep status set from OID
-
-	// Add to support different cipher suite for WPA2/WPA mode
-	NDIS_802_11_ENCRYPTION_STATUS		GroupCipher;		// Multicast cipher suite
-	NDIS_802_11_ENCRYPTION_STATUS		PairCipher;			// Unicast cipher suite
-	BOOLEAN								bMixCipher;			// Indicate current Pair & Group use different cipher suites
-	USHORT								RsnCapability;
-
-	NDIS_802_11_WEP_STATUS              GroupKeyWepStatus;
-
-	UCHAR		PMK[32];                // WPA PSK mode PMK
-	UCHAR       PTK[64];                // WPA PSK mode PTK
-	UCHAR		GTK[32];				// GTK from authenticator
-	BSSID_INFO	SavedPMK[PMKID_NO];
-	UINT		SavedPMKNum;			// Saved PMKID number
-
-	UCHAR		DefaultKeyId;
-
-
-	// WPA 802.1x port control, WPA_802_1X_PORT_SECURED, WPA_802_1X_PORT_NOT_SECURED
-	UCHAR       PortSecured;
-
-	// For WPA countermeasures
-	ULONG       LastMicErrorTime;   // record last MIC error time
-	ULONG       MicErrCnt;          // Should be 0, 1, 2, then reset to zero (after disassoiciation).
-	BOOLEAN     bBlockAssoc;        // Block associate attempt for 60 seconds after counter measure occurred.
-	// For WPA-PSK supplicant state
-	WPA_STATE   WpaState;           // Default is SS_NOTUSE and handled by microsoft 802.1x
-	UCHAR       ReplayCounter[8];
-	UCHAR       ANonce[32];         // ANonce for WPA-PSK from aurhenticator
-	UCHAR       SNonce[32];         // SNonce for WPA-PSK
-
-	UCHAR       LastSNR0;             // last received BEACON's SNR
-	UCHAR       LastSNR1;            // last received BEACON's SNR for 2nd  antenna
-	RSSI_SAMPLE RssiSample;
-	ULONG       NumOfAvgRssiSample;
-
-	ULONG       LastBeaconRxTime;     // OS's timestamp of the last BEACON RX time
-	ULONG       Last11bBeaconRxTime;  // OS's timestamp of the last 11B BEACON RX time
-	ULONG		Last11gBeaconRxTime;	// OS's timestamp of the last 11G BEACON RX time
-	ULONG		Last20NBeaconRxTime;	// OS's timestamp of the last 20MHz N BEACON RX time
-
-	ULONG       LastScanTime;       // Record last scan time for issue BSSID_SCAN_LIST
-	ULONG       ScanCnt;            // Scan counts since most recent SSID, BSSID, SCAN OID request
-	BOOLEAN     bSwRadio;           // Software controlled Radio On/Off, TRUE: On
-	BOOLEAN     bHwRadio;           // Hardware controlled Radio On/Off, TRUE: On
-	BOOLEAN     bRadio;             // Radio state, And of Sw & Hw radio state
-	BOOLEAN     bHardwareRadio;     // Hardware controlled Radio enabled
-	BOOLEAN     bShowHiddenSSID;    // Show all known SSID in SSID list get operation
-#ifdef RT2860
-    BOOLEAN		AdhocBOnlyJoined;	// Indicate Adhoc B Join.
-    BOOLEAN		AdhocBGJoined;		// Indicate Adhoc B/G Join.
-    BOOLEAN		Adhoc20NJoined;		// Indicate Adhoc 20MHz N Join.
-#endif
-	// New for WPA, windows want us to keep association information and
-	// Fixed IEs from last association response
-	NDIS_802_11_ASSOCIATION_INFORMATION     AssocInfo;
-	USHORT       ReqVarIELen;                // Length of next VIE include EID & Length
-	UCHAR       ReqVarIEs[MAX_VIE_LEN];		// The content saved here should be little-endian format.
-	USHORT       ResVarIELen;                // Length of next VIE include EID & Length
-	UCHAR       ResVarIEs[MAX_VIE_LEN];
-
-	UCHAR       RSNIE_Len;
-	UCHAR       RSN_IE[MAX_LEN_OF_RSNIE];	// The content saved here should be little-endian format.
-
-	// New variables used for CCX 1.0
-	BOOLEAN             bCkipOn;
-	BOOLEAN             bCkipCmicOn;
-	UCHAR               CkipFlag;
-	UCHAR               GIV[3];  //for CCX iv
-	UCHAR               RxSEQ[4];
-	UCHAR               TxSEQ[4];
-	UCHAR               CKIPMIC[4];
-	UCHAR               LeapAuthMode;
-	LEAP_AUTH_INFO      LeapAuthInfo;
-	UCHAR               HashPwd[16];
-	UCHAR               NetworkChallenge[8];
-	UCHAR               NetworkChallengeResponse[24];
-	UCHAR               PeerChallenge[8];
-
-	UCHAR               PeerChallengeResponse[24];
-	UCHAR               SessionKey[16]; //Network session keys (NSK)
-	RALINK_TIMER_STRUCT LeapAuthTimer;
-	ROGUEAP_TABLE       RogueApTab;   //Cisco CCX1 Rogue AP Detection
-
-	// New control flags for CCX
-	CCX_CONTROL         CCXControl;                 // Master administration state
-	BOOLEAN             CCXEnable;                  // Actual CCX state
-	UCHAR               CCXScanChannel;             // Selected channel for CCX beacon request
-	USHORT              CCXScanTime;                // Time out to wait for beacon and probe response
-	UCHAR               CCXReqType;                 // Current processing CCX request type
-	BSS_TABLE           CCXBssTab;                  // BSS Table
-	UCHAR               FrameReportBuf[2048];       // Buffer for creating frame report
-	USHORT              FrameReportLen;             // Current Frame report length
-	ULONG               CLBusyBytes;                // Save the total bytes received durning channel load scan time
-	USHORT              RPIDensity[8];              // Array for RPI density collection
-	// Start address of each BSS table within FrameReportBuf
-	// It's important to update the RxPower of the corresponding Bss
-	USHORT              BssReportOffset[MAX_LEN_OF_BSS_TABLE];
-	USHORT              BeaconToken;                // Token for beacon report
-	ULONG               LastBssIndex;               // Most current reported Bss index
-	RM_REQUEST_ACTION   MeasurementRequest[16];     // Saved measurement request
-	UCHAR               RMReqCnt;                   // Number of measurement request saved.
-	UCHAR               CurrentRMReqIdx;            // Number of measurement request saved.
-	BOOLEAN             ParallelReq;                // Parallel measurement, only one request performed,
-													// It must be the same channel with maximum duration
-	USHORT              ParallelDuration;           // Maximum duration for parallel measurement
-	UCHAR               ParallelChannel;            // Only one channel with parallel measurement
-	USHORT              IAPPToken;                  // IAPP dialog token
-	UCHAR               CCXQosECWMin;               // Cisco QOS ECWMin for AC 0
-	UCHAR               CCXQosECWMax;               // Cisco QOS ECWMax for AC 0
-	// Hack for channel load and noise histogram parameters
-	UCHAR               NHFactor;                   // Parameter for Noise histogram
-	UCHAR               CLFactor;                   // Parameter for channel load
-
-	UCHAR               KRK[16];        //Key Refresh Key.
-	UCHAR               BTK[32];        //Base Transient Key
-	BOOLEAN             CCKMLinkUpFlag;
-	ULONG               CCKMRN;    //(Re)Association request number.
-	LARGE_INTEGER       CCKMBeaconAtJoinTimeStamp;  //TSF timer for Re-assocaite to the new AP
-	UCHAR               AironetCellPowerLimit;      //in dBm
-	UCHAR               AironetIPAddress[4];        //eg. 192.168.1.1
-	BOOLEAN             CCXAdjacentAPReportFlag;    //flag for determining report Assoc Lost time
-	CHAR                CCXAdjacentAPSsid[MAX_LEN_OF_SSID]; //Adjacent AP's SSID report
-	UCHAR               CCXAdjacentAPSsidLen;               // the actual ssid length in used
-	UCHAR               CCXAdjacentAPBssid[MAC_ADDR_LEN];         //Adjacent AP's BSSID report
-	USHORT              CCXAdjacentAPChannel;
-	ULONG               CCXAdjacentAPLinkDownTime;  //for Spec S32.
-
-	RALINK_TIMER_STRUCT	StaQuickResponeForRateUpTimer;
-	BOOLEAN				StaQuickResponeForRateUpTimerRunning;
-
-	UCHAR           	DtimCount;      // 0.. DtimPeriod-1
-	UCHAR           	DtimPeriod;     // default = 3
-
-	////////////////////////////////////////////////////////////////////////////////////////
-	// This is only for WHQL test.
-	BOOLEAN				WhqlTest;
-	////////////////////////////////////////////////////////////////////////////////////////
-
-    RALINK_TIMER_STRUCT WpaDisassocAndBlockAssocTimer;
-    // Fast Roaming
-	BOOLEAN		        bFastRoaming;       // 0:disable fast roaming, 1:enable fast roaming
-	CHAR		        dBmToRoam;          // the condition to roam when receiving Rssi less than this value. It's negative value.
-
-    BOOLEAN             IEEE8021X;
-    BOOLEAN             IEEE8021x_required_keys;
-    CIPHER_KEY	        DesireSharedKey[4];	// Record user desired WEP keys
-    UCHAR               DesireSharedKeyId;
-
-    // 0: driver ignores wpa_supplicant
-    // 1: wpa_supplicant initiates scanning and AP selection
-    // 2: driver takes care of scanning, AP selection, and IEEE 802.11 association parameters
-    UCHAR               WpaSupplicantUP;
-	UCHAR				WpaSupplicantScanCount;
-
-    CHAR                dev_name[16];
-    USHORT              OriDevType;
-
-    BOOLEAN             bTGnWifiTest;
-	BOOLEAN			    bScanReqIsFromWebUI;
-
-	HTTRANSMIT_SETTING				HTPhyMode, MaxHTPhyMode, MinHTPhyMode;// For transmit phy setting in TXWI.
-	DESIRED_TRANSMIT_SETTING       	DesiredTransmitSetting;
-	RT_HT_PHY_INFO					DesiredHtPhyInfo;
-	BOOLEAN							bAutoTxRateSwitch;
-
-#ifdef RT2860
-    UCHAR       BBPR3;
-#endif
-} STA_ADMIN_CONFIG, *PSTA_ADMIN_CONFIG;
-
-// This data structure keep the current active BSS/IBSS's configuration that this STA
-// had agreed upon joining the network. Which means these parameters are usually decided
-// by the BSS/IBSS creator instead of user configuration. Data in this data structurre
-// is valid only when either ADHOC_ON(pAd) or INFRA_ON(pAd) is TRUE.
-// Normally, after SCAN or failed roaming attempts, we need to recover back to
-// the current active settings.
-typedef struct _STA_ACTIVE_CONFIG {
-	USHORT      Aid;
-	USHORT      AtimWin;                // in kusec; IBSS parameter set element
-	USHORT      CapabilityInfo;
-	USHORT      CfpMaxDuration;
-	USHORT      CfpPeriod;
-
-	// Copy supported rate from desired AP's beacon. We are trying to match
-	// AP's supported and extended rate settings.
-	UCHAR       SupRate[MAX_LEN_OF_SUPPORTED_RATES];
-	UCHAR       ExtRate[MAX_LEN_OF_SUPPORTED_RATES];
-	UCHAR       SupRateLen;
-	UCHAR       ExtRateLen;
-	// Copy supported ht from desired AP's beacon. We are trying to match
-	RT_HT_PHY_INFO		SupportedPhyInfo;
-	RT_HT_CAPABILITY	SupportedHtPhy;
-} STA_ACTIVE_CONFIG, *PSTA_ACTIVE_CONFIG;
-
-#ifdef RT2870
-// for USB interface, avoid in interrupt when write key
-typedef struct   RT_ADD_PAIRWISE_KEY_ENTRY {
-        NDIS_802_11_MAC_ADDRESS         MacAddr;
-        USHORT                          MacTabMatchWCID;        // ASIC
-        CIPHER_KEY                      CipherKey;
-} RT_ADD_PAIRWISE_KEY_ENTRY,*PRT_ADD_PAIRWISE_KEY_ENTRY;
-#endif // RT2870 //
-
-// ----------- start of AP --------------------------
-// AUTH-RSP State Machine Aux data structure
-typedef struct _AP_MLME_AUX {
-	UCHAR               Addr[MAC_ADDR_LEN];
-	USHORT              Alg;
-	CHAR                Challenge[CIPHER_TEXT_LEN];
-} AP_MLME_AUX, *PAP_MLME_AUX;
-
-// structure to define WPA Group Key Rekey Interval
-typedef struct PACKED _RT_802_11_WPA_REKEY {
-	ULONG ReKeyMethod;          // mechanism for rekeying: 0:disable, 1: time-based, 2: packet-based
-	ULONG ReKeyInterval;        // time-based: seconds, packet-based: kilo-packets
-} RT_WPA_REKEY,*PRT_WPA_REKEY, RT_802_11_WPA_REKEY, *PRT_802_11_WPA_REKEY;
-
-typedef struct _MAC_TABLE_ENTRY {
-	//Choose 1 from ValidAsWDS and ValidAsCLI  to validize.
-	BOOLEAN		ValidAsCLI;		// Sta mode, set this TRUE after Linkup,too.
-	BOOLEAN		ValidAsWDS;	// This is WDS Entry. only for AP mode.
-	BOOLEAN		ValidAsApCli;   //This is a AP-Client entry, only for AP mode which enable AP-Client functions.
-	BOOLEAN		ValidAsMesh;
-	BOOLEAN		ValidAsDls;	// This is DLS Entry. only for STA mode.
-	BOOLEAN		isCached;
-	BOOLEAN		bIAmBadAtheros;	// Flag if this is Atheros chip that has IOT problem.  We need to turn on RTS/CTS protection.
-
-	UCHAR         	EnqueueEapolStartTimerRunning;  // Enqueue EAPoL-Start for triggering EAP SM
-	//jan for wpa
-	// record which entry revoke MIC Failure , if it leaves the BSS itself, AP won't update aMICFailTime MIB
-	UCHAR           CMTimerRunning;
-	UCHAR           apidx;			// MBSS number
-	UCHAR           RSNIE_Len;
-	UCHAR           RSN_IE[MAX_LEN_OF_RSNIE];
-	UCHAR           ANonce[LEN_KEY_DESC_NONCE];
-	UCHAR           R_Counter[LEN_KEY_DESC_REPLAY];
-	UCHAR           PTK[64];
-	UCHAR           ReTryCounter;
-	RALINK_TIMER_STRUCT                 RetryTimer;
-	RALINK_TIMER_STRUCT					EnqueueStartForPSKTimer;	// A timer which enqueue EAPoL-Start for triggering PSK SM
-	NDIS_802_11_AUTHENTICATION_MODE     AuthMode;   // This should match to whatever microsoft defined
-	NDIS_802_11_WEP_STATUS              WepStatus;
-	AP_WPA_STATE    WpaState;
-	GTK_STATE       GTKState;
-	USHORT          PortSecured;
-	NDIS_802_11_PRIVACY_FILTER  PrivacyFilter;      // PrivacyFilter enum for 802.1X
-	CIPHER_KEY      PairwiseKey;
-	PVOID           pAd;
-    INT				PMKID_CacheIdx;
-    UCHAR			PMKID[LEN_PMKID];
-
-
-	UCHAR           Addr[MAC_ADDR_LEN];
-	UCHAR           PsMode;
-	SST             Sst;
-	AUTH_STATE      AuthState; // for SHARED KEY authentication state machine used only
-	BOOLEAN			IsReassocSta;	// Indicate whether this is a reassociation procedure
-	USHORT          Aid;
-	USHORT          CapabilityInfo;
-	UCHAR           LastRssi;
-	ULONG           NoDataIdleCount;
-	UINT16			StationKeepAliveCount; // unit: second
-	ULONG           PsQIdleCount;
-	QUEUE_HEADER    PsQueue;
-
-	UINT32			StaConnectTime;		// the live time of this station since associated with AP
-
-	BOOLEAN			bSendBAR;
-	USHORT			NoBADataCountDown;
-
-	UINT32   		CachedBuf[16];		// UINT (4 bytes) for alignment
-	UINT			TxBFCount; // 3*3
-	UINT			FIFOCount;
-	UINT			DebugFIFOCount;
-	UINT			DebugTxCount;
-    BOOLEAN			bDlsInit;
-
-
-//====================================================
-//WDS entry needs these
-// rt2860 add this. if ValidAsWDS==TRUE, MatchWDSTabIdx is the index in WdsTab.MacTab
-	UINT			MatchWDSTabIdx;
-	UCHAR           MaxSupportedRate;
-	UCHAR           CurrTxRate;
-	UCHAR           CurrTxRateIndex;
-	// to record the each TX rate's quality. 0 is best, the bigger the worse.
-	USHORT          TxQuality[MAX_STEP_OF_TX_RATE_SWITCH];
-	UINT32			OneSecTxNoRetryOkCount;
-	UINT32          OneSecTxRetryOkCount;
-	UINT32          OneSecTxFailCount;
-	UINT32			ContinueTxFailCnt;
-	UINT32          CurrTxRateStableTime; // # of second in current TX rate
-	UCHAR           TxRateUpPenalty;      // extra # of second penalty due to last unstable condition
-//====================================================
-
-	BOOLEAN         fNoisyEnvironment;
-	BOOLEAN			fLastSecAccordingRSSI;
-	UCHAR           LastSecTxRateChangeAction; // 0: no change, 1:rate UP, 2:rate down
-	CHAR			LastTimeTxRateChangeAction; //Keep last time value of LastSecTxRateChangeAction
-	ULONG			LastTxOkCount;
-	UCHAR           PER[MAX_STEP_OF_TX_RATE_SWITCH];
-
-	// a bitmap of BOOLEAN flags. each bit represent an operation status of a particular
-	// BOOLEAN control, either ON or OFF. These flags should always be accessed via
-	// CLIENT_STATUS_TEST_FLAG(), CLIENT_STATUS_SET_FLAG(), CLIENT_STATUS_CLEAR_FLAG() macros.
-	// see fOP_STATUS_xxx in RTMP_DEF.C for detail bit definition. fCLIENT_STATUS_AMSDU_INUSED
-	ULONG           ClientStatusFlags;
-
-	HTTRANSMIT_SETTING	HTPhyMode, MaxHTPhyMode, MinHTPhyMode;// For transmit phy setting in TXWI.
-
-	// HT EWC MIMO-N used parameters
-	USHORT		RXBAbitmap;	// fill to on-chip  RXWI_BA_BITMASK in 8.1.3RX attribute entry format
-	USHORT		TXBAbitmap;	// This bitmap as originator, only keep in software used to mark AMPDU bit in TXWI
-	USHORT		TXAutoBAbitmap;
-	USHORT		BADeclineBitmap;
-	USHORT		BARecWcidArray[NUM_OF_TID];	// The mapping wcid of recipient session. if RXBAbitmap bit is masked
-	USHORT		BAOriWcidArray[NUM_OF_TID]; // The mapping wcid of originator session. if TXBAbitmap bit is masked
-	USHORT		BAOriSequence[NUM_OF_TID]; // The mapping wcid of originator session. if TXBAbitmap bit is masked
-
-	// 802.11n features.
-	UCHAR		MpduDensity;
-	UCHAR		MaxRAmpduFactor;
-	UCHAR		AMsduSize;
-	UCHAR		MmpsMode;	// MIMO power save more.
-
-	HT_CAPABILITY_IE		HTCapability;
-
-	BOOLEAN		bAutoTxRateSwitch;
-
-	UCHAR       RateLen;
-	struct _MAC_TABLE_ENTRY *pNext;
-    USHORT      TxSeq[NUM_OF_TID];
-	USHORT		NonQosDataSeq;
-
-	RSSI_SAMPLE	RssiSample;
-
-	UINT32			TXMCSExpected[16];
-	UINT32			TXMCSSuccessful[16];
-	UINT32			TXMCSFailed[16];
-	UINT32			TXMCSAutoFallBack[16][16];
-#ifdef RT2870
-	ULONG   		LastBeaconRxTime;
-#endif
-} MAC_TABLE_ENTRY, *PMAC_TABLE_ENTRY;
-
-typedef struct _MAC_TABLE {
-	USHORT			Size;
-	MAC_TABLE_ENTRY *Hash[HASH_TABLE_SIZE];
-	MAC_TABLE_ENTRY Content[MAX_LEN_OF_MAC_TABLE];
-	QUEUE_HEADER    McastPsQueue;
-	ULONG           PsQIdleCount;
-	BOOLEAN         fAnyStationInPsm;
-	BOOLEAN         fAnyStationBadAtheros;	// Check if any Station is atheros 802.11n Chip.  We need to use RTS/CTS with Atheros 802,.11n chip.
-	BOOLEAN			fAnyTxOPForceDisable;	// Check if it is necessary to disable BE TxOP
-#ifdef RT2870
-	BOOLEAN			fAllStationAsRalink; 	// Check if all stations are ralink-chipset
-#endif
-	BOOLEAN         fAnyStationIsLegacy;	// Check if I use legacy rate to transmit to my BSS Station/
-	BOOLEAN         fAnyStationNonGF;		// Check if any Station can't support GF.
-	BOOLEAN         fAnyStation20Only;		// Check if any Station can't support GF.
-	BOOLEAN			fAnyStationMIMOPSDynamic; // Check if any Station is MIMO Dynamic
-	BOOLEAN         fAnyBASession;   // Check if there is BA session.  Force turn on RTS/CTS
-} MAC_TABLE, *PMAC_TABLE;
+/* */
+/* Packet information for NdisQueryPacket */
+/* */
+struct rt_packet_info {
+	u32 PhysicalBufferCount;	/* Physical breaks of buffer descripor chained */
+	u32 BufferCount;	/* Number of Buffer descriptor chained */
+	u32 TotalPacketLength;	/* Self explained */
+	char *pFirstBuffer;	/* Pointer to first buffer descriptor */
+};
 
-#define IS_HT_STA(_pMacEntry)	\
-	(_pMacEntry->MaxHTPhyMode.field.MODE >= MODE_HTMIX)
+/* */
+/*  Arcfour Structure Added by PaulWu */
+/* */
+struct rt_arcfourcontext {
+	u32 X;
+	u32 Y;
+	u8 STATE[256];
+};
 
-#define IS_HT_RATE(_pMacEntry)	\
-	(_pMacEntry->HTPhyMode.field.MODE >= MODE_HTMIX)
+/* */
+/* Tkip Key structure which RC4 key & MIC calculation */
+/* */
+struct rt_tkip_key_info {
+	u32 nBytesInM;		/* # bytes in M for MICKEY */
+	unsigned long IV16;
+	unsigned long IV32;
+	unsigned long K0;		/* for MICKEY Low */
+	unsigned long K1;		/* for MICKEY Hig */
+	unsigned long L;		/* Current state for MICKEY */
+	unsigned long R;		/* Current state for MICKEY */
+	unsigned long M;		/* Message accumulator for MICKEY */
+	u8 RC4KEY[16];
+	u8 MIC[8];
+};
 
-#define PEER_IS_HT_RATE(_pMacEntry)	\
-	(_pMacEntry->HTPhyMode.field.MODE >= MODE_HTMIX)
+/* */
+/* Private / Misc data, counters for driver internal use */
+/* */
+struct rt_private {
+	u32 SystemResetCnt;	/* System reset counter */
+	u32 TxRingFullCnt;	/* Tx ring full occurrance number */
+	u32 PhyRxErrCnt;	/* PHY Rx error count, for debug purpose, might move to global counter */
+	/* Variables for WEP encryption / decryption in rtmp_wep.c */
+	u32 FCSCRC32;
+	struct rt_arcfourcontext WEPCONTEXT;
+	/* Tkip stuff */
+	struct rt_tkip_key_info Tx;
+	struct rt_tkip_key_info Rx;
+};
 
-typedef struct _WDS_ENTRY {
-	BOOLEAN         Valid;
-	UCHAR           Addr[MAC_ADDR_LEN];
-	ULONG           NoDataIdleCount;
-	struct _WDS_ENTRY *pNext;
-} WDS_ENTRY, *PWDS_ENTRY;
-
-typedef struct  _WDS_TABLE_ENTRY {
-	USHORT			Size;
-	UCHAR           WdsAddr[MAC_ADDR_LEN];
-	WDS_ENTRY       *Hash[HASH_TABLE_SIZE];
-	WDS_ENTRY       Content[MAX_LEN_OF_MAC_TABLE];
-	UCHAR           MaxSupportedRate;
-	UCHAR           CurrTxRate;
-	USHORT          TxQuality[MAX_LEN_OF_SUPPORTED_RATES];
-	USHORT          OneSecTxOkCount;
-	USHORT          OneSecTxRetryOkCount;
-	USHORT          OneSecTxFailCount;
-	ULONG           CurrTxRateStableTime; // # of second in current TX rate
-	UCHAR           TxRateUpPenalty;      // extra # of second penalty due to last unstable condition
-} WDS_TABLE_ENTRY, *PWDS_TABLE_ENTRY;
-
-typedef struct _RT_802_11_WDS_ENTRY {
-	PNET_DEV			dev;
-	UCHAR				Valid;
-	UCHAR				PhyMode;
-	UCHAR				PeerWdsAddr[MAC_ADDR_LEN];
-	UCHAR				MacTabMatchWCID;	// ASIC
-	NDIS_802_11_WEP_STATUS  WepStatus;
-	UCHAR					KeyIdx;
-	CIPHER_KEY          	WdsKey;
-	HTTRANSMIT_SETTING				HTPhyMode, MaxHTPhyMode, MinHTPhyMode;
-	RT_HT_PHY_INFO					DesiredHtPhyInfo;
-	BOOLEAN							bAutoTxRateSwitch;
-	DESIRED_TRANSMIT_SETTING       	DesiredTransmitSetting; // Desired transmit setting.
-} RT_802_11_WDS_ENTRY, *PRT_802_11_WDS_ENTRY;
-
-typedef struct _WDS_TABLE {
-	UCHAR               Mode;
-	ULONG               Size;
-	RT_802_11_WDS_ENTRY	WdsEntry[MAX_WDS_ENTRY];
-} WDS_TABLE, *PWDS_TABLE;
-
-typedef struct _APCLI_STRUCT {
-	PNET_DEV				dev;
-#ifdef RTL865X_SOC
-	unsigned int            mylinkid;
-#endif
-	BOOLEAN                 Enable;	// Set it as 1 if the apcli interface was configured to "1"  or by iwpriv cmd "ApCliEnable"
-	BOOLEAN                 Valid;	// Set it as 1 if the apcli interface associated success to remote AP.
-	UCHAR					MacTabWCID;	//WCID value, which point to the entry of ASIC Mac table.
-	UCHAR                   SsidLen;
-	CHAR                    Ssid[MAX_LEN_OF_SSID];
+/***************************************************************************
+  *	Channel and BBP related data structures
+  **************************************************************************/
+/* structure to tune BBP R66 (BBP TUNING) */
+struct rt_bbp_r66_tuning {
+	BOOLEAN bEnable;
+	u16 FalseCcaLowerThreshold;	/* default 100 */
+	u16 FalseCcaUpperThreshold;	/* default 512 */
+	u8 R66Delta;
+	u8 R66CurrentValue;
+	BOOLEAN R66LowerUpperSelect;	/*Before LinkUp, Used LowerBound or UpperBound as R66 value. */
+};
 
-	UCHAR                   CfgSsidLen;
-	CHAR                    CfgSsid[MAX_LEN_OF_SSID];
-	UCHAR                   CfgApCliBssid[ETH_LENGTH_OF_ADDRESS];
-	UCHAR                   CurrentAddress[ETH_LENGTH_OF_ADDRESS];
+/* structure to store channel TX power */
+struct rt_channel_tx_power {
+	u16 RemainingTimeForUse;	/*unit: sec */
+	u8 Channel;
+	char Power;
+	char Power2;
+	u8 MaxTxPwr;
+	u8 DfsReq;
+};
 
-	ULONG                   ApCliRcvBeaconTime;
+/* structure to store 802.11j channel TX power */
+struct rt_channel_11j_tx_power {
+	u8 Channel;
+	u8 BW;		/* BW_10 or BW_20 */
+	char Power;
+	char Power2;
+	u16 RemainingTimeForUse;	/*unit: sec */
+};
 
-	ULONG                   CtrlCurrState;
-	ULONG                   SyncCurrState;
-	ULONG                   AuthCurrState;
-	ULONG                   AssocCurrState;
-	ULONG					WpaPskCurrState;
+struct rt_soft_rx_ant_diversity {
+	u8 EvaluatePeriod;	/* 0:not evalute status, 1: evaluate status, 2: switching status */
+	u8 EvaluateStableCnt;
+	u8 Pair1PrimaryRxAnt;	/* 0:Ant-E1, 1:Ant-E2 */
+	u8 Pair1SecondaryRxAnt;	/* 0:Ant-E1, 1:Ant-E2 */
+	u8 Pair2PrimaryRxAnt;	/* 0:Ant-E3, 1:Ant-E4 */
+	u8 Pair2SecondaryRxAnt;	/* 0:Ant-E3, 1:Ant-E4 */
+	short Pair1AvgRssi[2];	/* AvgRssi[0]:E1, AvgRssi[1]:E2 */
+	short Pair2AvgRssi[2];	/* AvgRssi[0]:E3, AvgRssi[1]:E4 */
+	short Pair1LastAvgRssi;	/* */
+	short Pair2LastAvgRssi;	/* */
+	unsigned long RcvPktNumWhenEvaluate;
+	BOOLEAN FirstPktArrivedWhenEvaluate;
+	struct rt_ralink_timer RxAntDiversityTimer;
+};
 
-	USHORT                  AuthReqCnt;
-	USHORT                  AssocReqCnt;
+/***************************************************************************
+  *	structure for radar detection and channel switch
+  **************************************************************************/
+struct rt_radar_detect {
+	/*BOOLEAN           IEEE80211H;                     // 0: disable, 1: enable IEEE802.11h */
+	u8 CSCount;		/*Channel switch counter */
+	u8 CSPeriod;		/*Channel switch period (beacon count) */
+	u8 RDCount;		/*Radar detection counter */
+	u8 RDMode;		/*Radar Detection mode */
+	u8 RDDurRegion;	/*Radar detection duration region */
+	u8 BBPR16;
+	u8 BBPR17;
+	u8 BBPR18;
+	u8 BBPR21;
+	u8 BBPR22;
+	u8 BBPR64;
+	unsigned long InServiceMonitorCount;	/* unit: sec */
+	u8 DfsSessionTime;
+	BOOLEAN bFastDfs;
+	u8 ChMovingTime;
+	u8 LongPulseRadarTh;
+};
 
-	ULONG                   ClientStatusFlags;
-	UCHAR                   MpduDensity;
+typedef enum _ABGBAND_STATE_ {
+	UNKNOWN_BAND,
+	BG_BAND,
+	A_BAND,
+} ABGBAND_STATE;
 
-	NDIS_802_11_AUTHENTICATION_MODE     AuthMode;   // This should match to whatever microsoft defined
-	NDIS_802_11_WEP_STATUS              WepStatus;
+#ifdef RTMP_MAC_PCI
+/* Power save method control */
+typedef union _PS_CONTROL {
+	struct {
+		unsigned long EnablePSinIdle:1;	/* Enable radio off when not connect to AP. radio on only when sitesurvey, */
+		unsigned long EnableNewPS:1;	/* Enable new  Chip power save fucntion . New method can only be applied in chip version after 2872. and PCIe. */
+		unsigned long rt30xxPowerMode:2;	/* Power Level Mode for rt30xx chip */
+		unsigned long rt30xxFollowHostASPM:1;	/* Card Follows Host's setting for rt30xx chip. */
+		unsigned long rt30xxForceASPMTest:1;	/* Force enable L1 for rt30xx chip. This has higher priority than rt30xxFollowHostASPM Mode. */
+		unsigned long rsv:26;	/* Radio Measurement Enable */
+	} field;
+	unsigned long word;
+} PS_CONTROL, *PPS_CONTROL;
+#endif /* RTMP_MAC_PCI // */
+
+/***************************************************************************
+  *	structure for MLME state machine
+  **************************************************************************/
+struct rt_mlme {
+	/* STA state machines */
+	struct rt_state_machine CntlMachine;
+	struct rt_state_machine AssocMachine;
+	struct rt_state_machine AuthMachine;
+	struct rt_state_machine AuthRspMachine;
+	struct rt_state_machine SyncMachine;
+	struct rt_state_machine WpaPskMachine;
+	struct rt_state_machine LeapMachine;
+	STATE_MACHINE_FUNC AssocFunc[ASSOC_FUNC_SIZE];
+	STATE_MACHINE_FUNC AuthFunc[AUTH_FUNC_SIZE];
+	STATE_MACHINE_FUNC AuthRspFunc[AUTH_RSP_FUNC_SIZE];
+	STATE_MACHINE_FUNC SyncFunc[SYNC_FUNC_SIZE];
+	STATE_MACHINE_FUNC ActFunc[ACT_FUNC_SIZE];
+	/* Action */
+	struct rt_state_machine ActMachine;
+
+	/* common WPA state machine */
+	struct rt_state_machine WpaMachine;
+	STATE_MACHINE_FUNC WpaFunc[WPA_FUNC_SIZE];
+
+	unsigned long ChannelQuality;	/* 0..100, Channel Quality Indication for Roaming */
+	unsigned long Now32;		/* latch the value of NdisGetSystemUpTime() */
+	unsigned long LastSendNULLpsmTime;
+
+	BOOLEAN bRunning;
+	spinlock_t TaskLock;
+	struct rt_mlme_queue Queue;
+
+	u32 ShiftReg;
+
+	struct rt_ralink_timer PeriodicTimer;
+	struct rt_ralink_timer APSDPeriodicTimer;
+	struct rt_ralink_timer LinkDownTimer;
+	struct rt_ralink_timer LinkUpTimer;
+#ifdef RTMP_MAC_PCI
+	u8 bPsPollTimerRunning;
+	struct rt_ralink_timer PsPollTimer;
+	struct rt_ralink_timer RadioOnOffTimer;
+#endif				/* RTMP_MAC_PCI // */
+	unsigned long PeriodicRound;
+	unsigned long OneSecPeriodicRound;
+
+	u8 RealRxPath;
+	BOOLEAN bLowThroughput;
+	BOOLEAN bEnableAutoAntennaCheck;
+	struct rt_ralink_timer RxAntEvalTimer;
+
+#ifdef RT30xx
+	u8 CaliBW40RfR24;
+	u8 CaliBW20RfR24;
+#endif				/* RT30xx // */
+
+#ifdef RTMP_MAC_USB
+	struct rt_ralink_timer AutoWakeupTimer;
+	BOOLEAN AutoWakeupTimerRunning;
+#endif				/* RTMP_MAC_USB // */
+};
 
-	// Add to support different cipher suite for WPA2/WPA mode
-	NDIS_802_11_ENCRYPTION_STATUS		GroupCipher;		// Multicast cipher suite
-	NDIS_802_11_ENCRYPTION_STATUS		PairCipher;			// Unicast cipher suite
-	BOOLEAN								bMixCipher;			// Indicate current Pair & Group use different cipher suites
-	USHORT								RsnCapability;
+/***************************************************************************
+  *	802.11 N related data structures
+  **************************************************************************/
+struct reordering_mpdu {
+	struct reordering_mpdu *next;
+	void *pPacket;	/* coverted to 802.3 frame */
+	int Sequence;		/* sequence number of MPDU */
+	BOOLEAN bAMSDU;
+};
 
-	UCHAR		PSK[100];				// reserve PSK key material
-	UCHAR       PSKLen;
-	UCHAR       PMK[32];                // WPA PSK mode PMK
-	UCHAR		GTK[32];				// GTK from authenticator
+struct reordering_list {
+	struct reordering_mpdu *next;
+	int qlen;
+};
 
-	CIPHER_KEY      SharedKey[SHARE_KEY_NUM];
-	UCHAR           DefaultKeyId;
+struct reordering_mpdu_pool {
+	void *mem;
+	spinlock_t lock;
+	struct reordering_list freelist;
+};
 
-	// store RSN_IE built by driver
-	UCHAR		RSN_IE[MAX_LEN_OF_RSNIE];  // The content saved here should be convert to little-endian format.
-	UCHAR		RSNIE_Len;
+typedef enum _REC_BLOCKACK_STATUS {
+	Recipient_NONE = 0,
+	Recipient_USED,
+	Recipient_HandleRes,
+	Recipient_Accept
+} REC_BLOCKACK_STATUS, *PREC_BLOCKACK_STATUS;
 
-	// For WPA countermeasures
-	ULONG       LastMicErrorTime;   // record last MIC error time
-	BOOLEAN                 bBlockAssoc; // Block associate attempt for 60 seconds after counter measure occurred.
+typedef enum _ORI_BLOCKACK_STATUS {
+	Originator_NONE = 0,
+	Originator_USED,
+	Originator_WaitRes,
+	Originator_Done
+} ORI_BLOCKACK_STATUS, *PORI_BLOCKACK_STATUS;
 
-	// For WPA-PSK supplicant state
-	UCHAR       	SNonce[32];         // SNonce for WPA-PSK
-	UCHAR			GNonce[32];			// GNonce for WPA-PSK from authenticator
+struct rt_ba_ori_entry {
+	u8 Wcid;
+	u8 TID;
+	u8 BAWinSize;
+	u8 Token;
+/* Sequence is to fill every outgoing QoS DATA frame's sequence field in 802.11 header. */
+	u16 Sequence;
+	u16 TimeOutValue;
+	ORI_BLOCKACK_STATUS ORI_BA_Status;
+	struct rt_ralink_timer ORIBATimer;
+	void *pAdapter;
+};
 
-	HTTRANSMIT_SETTING				HTPhyMode, MaxHTPhyMode, MinHTPhyMode;
-	RT_HT_PHY_INFO					DesiredHtPhyInfo;
-	BOOLEAN							bAutoTxRateSwitch;
-	DESIRED_TRANSMIT_SETTING       	DesiredTransmitSetting; // Desired transmit setting.
-} APCLI_STRUCT, *PAPCLI_STRUCT;
+struct rt_ba_rec_entry {
+	u8 Wcid;
+	u8 TID;
+	u8 BAWinSize;	/* 7.3.1.14. each buffer is capable of holding a max AMSDU or MSDU. */
+	/*u8 NumOfRxPkt; */
+	/*u8    Curindidx; // the head in the RX reordering buffer */
+	u16 LastIndSeq;
+/*      u16          LastIndSeqAtTimer; */
+	u16 TimeOutValue;
+	struct rt_ralink_timer RECBATimer;
+	unsigned long LastIndSeqAtTimer;
+	unsigned long nDropPacket;
+	unsigned long rcvSeq;
+	REC_BLOCKACK_STATUS REC_BA_Status;
+/*      u8   RxBufIdxUsed; */
+	/* corresponding virtual address for RX reordering packet storage. */
+	/*RTMP_REORDERDMABUF MAP_RXBuf[MAX_RX_REORDERBUF]; */
+	spinlock_t RxReRingLock;	/* Rx Ring spinlock */
+/*      struct _BA_REC_ENTRY *pNext; */
+	void *pAdapter;
+	struct reordering_list list;
+};
 
-// ----------- end of AP ----------------------------
+struct rt_ba_table {
+	unsigned long numAsRecipient;	/* I am recipient of numAsRecipient clients. These client are in the BARecEntry[] */
+	unsigned long numAsOriginator;	/* I am originator of   numAsOriginator clients. These clients are in the BAOriEntry[] */
+	unsigned long numDoneOriginator;	/* count Done Originator sessions */
+	struct rt_ba_ori_entry BAOriEntry[MAX_LEN_OF_BA_ORI_TABLE];
+	struct rt_ba_rec_entry BARecEntry[MAX_LEN_OF_BA_REC_TABLE];
+};
 
-struct wificonf
-{
-	BOOLEAN	bShortGI;
-	BOOLEAN bGreenField;
+/*For QureyBATableOID use; */
+struct PACKED rt_oid_ba_rec_entry {
+	u8 MACAddr[MAC_ADDR_LEN];
+	u8 BaBitmap;		/* if (BaBitmap&(1<<TID)), this session with{MACAddr, TID}exists, so read BufSize[TID] for BufferSize */
+	u8 rsv;
+	u8 BufSize[8];
+	REC_BLOCKACK_STATUS REC_BA_Status[8];
 };
 
+/*For QureyBATableOID use; */
+struct PACKED rt_oid_ba_ori_entry {
+	u8 MACAddr[MAC_ADDR_LEN];
+	u8 BaBitmap;		/* if (BaBitmap&(1<<TID)), this session with{MACAddr, TID}exists, so read BufSize[TID] for BufferSize, read ORI_BA_Status[TID] for status */
+	u8 rsv;
+	u8 BufSize[8];
+	ORI_BLOCKACK_STATUS ORI_BA_Status[8];
+};
 
+struct rt_queryba_table {
+	struct rt_oid_ba_ori_entry BAOriEntry[32];
+	struct rt_oid_ba_rec_entry BARecEntry[32];
+	u8 OriNum;		/* Number of below BAOriEntry */
+	u8 RecNum;		/* Number of below BARecEntry */
+};
 
+typedef union _BACAP_STRUC {
+	struct {
+		u32 RxBAWinLimit:8;
+		u32 TxBAWinLimit:8;
+		u32 AutoBA:1;	/* automatically BA */
+		u32 Policy:2;	/* 0: DELAY_BA 1:IMMED_BA  (//BA Policy subfiled value in ADDBA frame)   2:BA-not use */
+		u32 MpduDensity:3;
+		u32 AmsduEnable:1;	/*Enable AMSDU transmisstion */
+		u32 AmsduSize:1;	/* 0:3839, 1:7935 bytes. u32  MSDUSizeToBytes[]        = { 3839, 7935}; */
+		u32 MMPSmode:2;	/* MIMO power save more, 0:static, 1:dynamic, 2:rsv, 3:mimo enable */
+		u32 bHtAdhoc:1;	/* adhoc can use ht rate. */
+		u32 b2040CoexistScanSup:1;	/*As Sta, support do 2040 coexistence scan for AP. As Ap, support monitor trigger event to check if can use BW 40MHz. */
+		u32 : 4;
+	} field;
+	u32 word;
+} BACAP_STRUC, *PBACAP_STRUC;
 
-typedef struct _INF_PCI_CONFIG
-{
-	PUCHAR                  CSRBaseAddress;     // PCI MMIO Base Address, all access will use
-}INF_PCI_CONFIG;
+struct rt_oid_add_ba_entry {
+	BOOLEAN IsRecipient;
+	u8 MACAddr[MAC_ADDR_LEN];
+	u8 TID;
+	u8 nMSDU;
+	u16 TimeOut;
+	BOOLEAN bAllTid;	/* If True, delete all TID for BA sessions with this MACaddr. */
+};
 
-typedef struct _INF_USB_CONFIG
-{
-	UINT                BulkInEpAddr;		// bulk-in endpoint address
-	UINT                BulkOutEpAddr[6];	// bulk-out endpoint address
+#define IS_HT_STA(_pMacEntry)	\
+	(_pMacEntry->MaxHTPhyMode.field.MODE >= MODE_HTMIX)
 
-}INF_USB_CONFIG;
+#define IS_HT_RATE(_pMacEntry)	\
+	(_pMacEntry->HTPhyMode.field.MODE >= MODE_HTMIX)
 
+#define PEER_IS_HT_RATE(_pMacEntry)	\
+	(_pMacEntry->HTPhyMode.field.MODE >= MODE_HTMIX)
 
+/*This structure is for all 802.11n card InterOptibilityTest action. Reset all Num every n second.  (Details see MLMEPeriodic) */
+struct rt_iot {
+	u8 Threshold[2];
+	u8 ReorderTimeOutNum[MAX_LEN_OF_BA_REC_TABLE];	/* compare with threshold[0] */
+	u8 RefreshNum[MAX_LEN_OF_BA_REC_TABLE];	/* compare with threshold[1] */
+	unsigned long OneSecInWindowCount;
+	unsigned long OneSecFrameDuplicateCount;
+	unsigned long OneSecOutWindowCount;
+	u8 DelOriAct;
+	u8 DelRecAct;
+	u8 RTSShortProt;
+	u8 RTSLongProt;
+	BOOLEAN bRTSLongProtOn;
+	BOOLEAN bLastAtheros;
+	BOOLEAN bCurrentAtheros;
+	BOOLEAN bNowAtherosBurstOn;
+	BOOLEAN bNextDisableRxBA;
+	BOOLEAN bToggle;
+};
 
-//
-//  The miniport adapter structure
-//
-typedef struct _RTMP_ADAPTER
-{
-	PVOID					OS_Cookie;	// save specific structure relative to OS
-	PNET_DEV				net_dev;
-	ULONG					VirtualIfCnt;
-
-#ifdef RT2860
-    USHORT		            LnkCtrlBitMask;
-    USHORT		            RLnkCtrlConfiguration;
-    USHORT                  RLnkCtrlOffset;
-    USHORT		            HostLnkCtrlConfiguration;
-    USHORT                  HostLnkCtrlOffset;
-	USHORT		            PCIePowerSaveLevel;
-   	BOOLEAN					bPCIclkOff;						// flag that indicate if the PICE power status in Configuration SPace..
-   	ULONG					CheckDmaBusyCount;  // Check Interrupt Status Register Count.
-   	USHORT					ThisTbttNumToNextWakeUp;
-	ULONG					SameRxByteCount;
+/* This is the registry setting for 802.11n transmit setting.  Used in advanced page. */
+typedef union _REG_TRANSMIT_SETTING {
+	struct {
+		/*u32  PhyMode:4; */
+		/*u32  MCS:7;                 // MCS */
+		u32 rsv0:10;
+		u32 TxBF:1;
+		u32 BW:1;	/*channel bandwidth 20MHz or 40 MHz */
+		u32 ShortGI:1;
+		u32 STBC:1;	/*SPACE */
+		u32 TRANSNO:2;
+		u32 HTMODE:1;
+		u32 EXTCHA:2;
+		u32 rsv:13;
+	} field;
+	u32 word;
+} REG_TRANSMIT_SETTING, *PREG_TRANSMIT_SETTING;
 
+typedef union _DESIRED_TRANSMIT_SETTING {
+	struct {
+		u16 MCS:7;	/* MCS */
+		u16 PhyMode:4;
+		u16 FixedTxMode:2;	/* If MCS isn't AUTO, fix rate in CCK, OFDM or HT mode. */
+		u16 rsv:3;
+	} field;
+	u16 word;
+} DESIRED_TRANSMIT_SETTING, *PDESIRED_TRANSMIT_SETTING;
+
+#ifdef RTMP_MAC_USB
+/***************************************************************************
+  *	USB-based chip Beacon related data structures
+  **************************************************************************/
+#define BEACON_BITMAP_MASK		0xff
+struct rt_beacon_sync {
+	u8 BeaconBuf[HW_BEACON_MAX_COUNT][HW_BEACON_OFFSET];
+	u8 BeaconTxWI[HW_BEACON_MAX_COUNT][TXWI_SIZE];
+	unsigned long TimIELocationInBeacon[HW_BEACON_MAX_COUNT];
+	unsigned long CapabilityInfoLocationInBeacon[HW_BEACON_MAX_COUNT];
+	BOOLEAN EnableBeacon;	/* trigger to enable beacon transmission. */
+	u8 BeaconBitMap;	/* NOTE: If the MAX_MBSSID_NUM is larger than 8, this parameter need to change. */
+	u8 DtimBitOn;	/* NOTE: If the MAX_MBSSID_NUM is larger than 8, this parameter need to change. */
+};
+#endif /* RTMP_MAC_USB // */
 
-/*****************************************************************************************/
-/*      PCI related parameters                                                           */
-/*****************************************************************************************/
-	PUCHAR                  CSRBaseAddress;     // PCI MMIO Base Address, all access will use
+/***************************************************************************
+  *	Multiple SSID related data structures
+  **************************************************************************/
+#define WLAN_MAX_NUM_OF_TIM			((MAX_LEN_OF_MAC_TABLE >> 3) + 1)	/* /8 + 1 */
+#define WLAN_CT_TIM_BCMC_OFFSET		0	/* unit: 32B */
+
+/* clear bcmc TIM bit */
+#define WLAN_MR_TIM_BCMC_CLEAR(apidx) \
+	pAd->ApCfg.MBSSID[apidx].TimBitmaps[WLAN_CT_TIM_BCMC_OFFSET] &= ~BIT8[0];
+
+/* set bcmc TIM bit */
+#define WLAN_MR_TIM_BCMC_SET(apidx) \
+	pAd->ApCfg.MBSSID[apidx].TimBitmaps[WLAN_CT_TIM_BCMC_OFFSET] |= BIT8[0];
 
-	UINT					int_enable_reg;
-	UINT					int_disable_mask;
-	UINT					int_pending;
+/* clear a station PS TIM bit */
+#define WLAN_MR_TIM_BIT_CLEAR(ad_p, apidx, wcid) \
+	{	u8 tim_offset = wcid >> 3; \
+		u8 bit_offset = wcid & 0x7; \
+		ad_p->ApCfg.MBSSID[apidx].TimBitmaps[tim_offset] &= (~BIT8[bit_offset]); }
 
+/* set a station PS TIM bit */
+#define WLAN_MR_TIM_BIT_SET(ad_p, apidx, wcid) \
+	{	u8 tim_offset = wcid >> 3; \
+		u8 bit_offset = wcid & 0x7; \
+		ad_p->ApCfg.MBSSID[apidx].TimBitmaps[tim_offset] |= BIT8[bit_offset]; }
 
-	RTMP_DMABUF             TxBufSpace[NUM_OF_TX_RING]; // Shared memory of all 1st pre-allocated TxBuf associated with each TXD
-	RTMP_DMABUF             RxDescRing;                 // Shared memory for RX descriptors
-	RTMP_DMABUF             TxDescRing[NUM_OF_TX_RING]; 	// Shared memory for Tx descriptors
-	RTMP_TX_RING            TxRing[NUM_OF_TX_RING];     	// AC0~4 + HCCA
+/* configuration common to OPMODE_AP as well as OPMODE_STA */
+struct rt_common_config {
+
+	BOOLEAN bCountryFlag;
+	u8 CountryCode[3];
+	u8 Geography;
+	u8 CountryRegion;	/* Enum of country region, 0:FCC, 1:IC, 2:ETSI, 3:SPAIN, 4:France, 5:MKK, 6:MKK1, 7:Israel */
+	u8 CountryRegionForABand;	/* Enum of country region for A band */
+	u8 PhyMode;		/* PHY_11A, PHY_11B, PHY_11BG_MIXED, PHY_ABG_MIXED */
+	u16 Dsifs;		/* in units of usec */
+	unsigned long PacketFilter;	/* Packet filter for receiving */
+	u8 RegulatoryClass;
+
+	char Ssid[MAX_LEN_OF_SSID];	/* NOT NULL-terminated */
+	u8 SsidLen;		/* the actual ssid length in used */
+	u8 LastSsidLen;	/* the actual ssid length in used */
+	char LastSsid[MAX_LEN_OF_SSID];	/* NOT NULL-terminated */
+	u8 LastBssid[MAC_ADDR_LEN];
+
+	u8 Bssid[MAC_ADDR_LEN];
+	u16 BeaconPeriod;
+	u8 Channel;
+	u8 CentralChannel;	/* Central Channel when using 40MHz is indicating. not real channel. */
+
+	u8 SupRate[MAX_LEN_OF_SUPPORTED_RATES];
+	u8 SupRateLen;
+	u8 ExtRate[MAX_LEN_OF_SUPPORTED_RATES];
+	u8 ExtRateLen;
+	u8 DesireRate[MAX_LEN_OF_SUPPORTED_RATES];	/* OID_802_11_DESIRED_RATES */
+	u8 MaxDesiredRate;
+	u8 ExpectedACKRate[MAX_LEN_OF_SUPPORTED_RATES];
+
+	unsigned long BasicRateBitmap;	/* backup basic ratebitmap */
+
+	BOOLEAN bAPSDCapable;
+	BOOLEAN bInServicePeriod;
+	BOOLEAN bAPSDAC_BE;
+	BOOLEAN bAPSDAC_BK;
+	BOOLEAN bAPSDAC_VI;
+	BOOLEAN bAPSDAC_VO;
+
+	/* because TSPEC can modify the APSD flag, we need to keep the APSD flag
+	   requested in association stage from the station;
+	   we need to recover the APSD flag after the TSPEC is deleted. */
+	BOOLEAN bACMAPSDBackup[4];	/* for delivery-enabled & trigger-enabled both */
+	BOOLEAN bACMAPSDTr[4];	/* no use */
+
+	BOOLEAN bNeedSendTriggerFrame;
+	BOOLEAN bAPSDForcePowerSave;	/* Force power save mode, should only use in APSD-STAUT */
+	unsigned long TriggerTimerCount;
+	u8 MaxSPLength;
+	u8 BBPCurrentBW;	/* BW_10,       BW_20, BW_40 */
+	/* move to MULTISSID_STRUCT for MBSS */
+	/*HTTRANSMIT_SETTING    HTPhyMode, MaxHTPhyMode, MinHTPhyMode;// For transmit phy setting in TXWI. */
+	REG_TRANSMIT_SETTING RegTransmitSetting;	/*registry transmit setting. this is for reading registry setting only. not useful. */
+	/*u8       FixedTxMode;              // Fixed Tx Mode (CCK, OFDM), for HT fixed tx mode (GF, MIX) , refer to RegTransmitSetting.field.HTMode */
+	u8 TxRate;		/* Same value to fill in TXD. TxRate is 6-bit */
+	u8 MaxTxRate;	/* RATE_1, RATE_2, RATE_5_5, RATE_11 */
+	u8 TxRateIndex;	/* Tx rate index in RateSwitchTable */
+	u8 TxRateTableSize;	/* Valid Tx rate table size in RateSwitchTable */
+	/*BOOLEAN               bAutoTxRateSwitch; */
+	u8 MinTxRate;	/* RATE_1, RATE_2, RATE_5_5, RATE_11 */
+	u8 RtsRate;		/* RATE_xxx */
+	HTTRANSMIT_SETTING MlmeTransmit;	/* MGMT frame PHY rate setting when operatin at Ht rate. */
+	u8 MlmeRate;		/* RATE_xxx, used to send MLME frames */
+	u8 BasicMlmeRate;	/* Default Rate for sending MLME frames */
+
+	u16 RtsThreshold;	/* in unit of BYTE */
+	u16 FragmentThreshold;	/* in unit of BYTE */
+
+	u8 TxPower;		/* in unit of mW */
+	unsigned long TxPowerPercentage;	/* 0~100 % */
+	unsigned long TxPowerDefault;	/* keep for TxPowerPercentage */
+	u8 PwrConstraint;
+
+	BACAP_STRUC BACapability;	/*   NO USE = 0XFF  ;  IMMED_BA =1  ;  DELAY_BA=0 */
+	BACAP_STRUC REGBACapability;	/*   NO USE = 0XFF  ;  IMMED_BA =1  ;  DELAY_BA=0 */
+
+	struct rt_iot IOTestParm;	/* 802.11n InterOpbility Test Parameter; */
+	unsigned long TxPreamble;	/* Rt802_11PreambleLong, Rt802_11PreambleShort, Rt802_11PreambleAuto */
+	BOOLEAN bUseZeroToDisableFragment;	/* Microsoft use 0 as disable */
+	unsigned long UseBGProtection;	/* 0: auto, 1: always use, 2: always not use */
+	BOOLEAN bUseShortSlotTime;	/* 0: disable, 1 - use short slot (9us) */
+	BOOLEAN bEnableTxBurst;	/* 1: enble TX PACKET BURST (when BA is established or AP is not a legacy WMM AP), 0: disable TX PACKET BURST */
+	BOOLEAN bAggregationCapable;	/* 1: enable TX aggregation when the peer supports it */
+	BOOLEAN bPiggyBackCapable;	/* 1: enable TX piggy-back according MAC's version */
+	BOOLEAN bIEEE80211H;	/* 1: enable IEEE802.11h spec. */
+	unsigned long DisableOLBCDetect;	/* 0: enable OLBC detect; 1 disable OLBC detect */
+
+	BOOLEAN bRdg;
+
+	BOOLEAN bWmmCapable;	/* 0:disable WMM, 1:enable WMM */
+	struct rt_qos_capability_parm APQosCapability;	/* QOS capability of the current associated AP */
+	struct rt_edca_parm APEdcaParm;	/* EDCA parameters of the current associated AP */
+	struct rt_qbss_load_parm APQbssLoad;	/* QBSS load of the current associated AP */
+	u8 AckPolicy[4];	/* ACK policy of the specified AC. see ACK_xxx */
+	BOOLEAN bDLSCapable;	/* 0:disable DLS, 1:enable DLS */
+	/* a bitmap of BOOLEAN flags. each bit represent an operation status of a particular */
+	/* BOOLEAN control, either ON or OFF. These flags should always be accessed via */
+	/* OPSTATUS_TEST_FLAG(), OPSTATUS_SET_FLAG(), OP_STATUS_CLEAR_FLAG() macros. */
+	/* see fOP_STATUS_xxx in RTMP_DEF.C for detail bit definition */
+	unsigned long OpStatusFlags;
+
+	BOOLEAN NdisRadioStateOff;	/*For HCT 12.0, set this flag to TRUE instead of called MlmeRadioOff. */
+	ABGBAND_STATE BandState;	/* For setting BBP used on B/G or A mode. */
+
+	/* IEEE802.11H--DFS. */
+	struct rt_radar_detect RadarDetect;
+
+	/* HT */
+	u8 BASize;		/* USer desired BAWindowSize. Should not exceed our max capability */
+	/*struct rt_ht_capability      SupportedHtPhy; */
+	struct rt_ht_capability DesiredHtPhy;
+	struct rt_ht_capability_ie HtCapability;
+	struct rt_add_ht_info_ie AddHTInfo;	/* Useful as AP. */
+	/*This IE is used with channel switch announcement element when changing to a new 40MHz. */
+	/*This IE is included in channel switch ammouncement frames 7.4.1.5, beacons, probe Rsp. */
+	struct rt_new_ext_chan_ie NewExtChanOffset;	/*7.3.2.20A, 1 if extension channel is above the control channel, 3 if below, 0 if not present */
+
+	BOOLEAN bHTProtect;
+	BOOLEAN bMIMOPSEnable;
+	BOOLEAN bBADecline;
+/*2008/11/05: KH add to support Antenna power-saving of AP<-- */
+	BOOLEAN bGreenAPEnable;
+/*2008/11/05: KH add to support Antenna power-saving of AP--> */
+	BOOLEAN bDisableReordering;
+	BOOLEAN bForty_Mhz_Intolerant;
+	BOOLEAN bExtChannelSwitchAnnouncement;
+	BOOLEAN bRcvBSSWidthTriggerEvents;
+	unsigned long LastRcvBSSWidthTriggerEventsTime;
+
+	u8 TxBASize;
+
+	/* Enable wireless event */
+	BOOLEAN bWirelessEvent;
+	BOOLEAN bWiFiTest;	/* Enable this parameter for WiFi test */
+
+	/* Tx & Rx Stream number selection */
+	u8 TxStream;
+	u8 RxStream;
+
+	BOOLEAN bHardwareRadio;	/* Hardware controlled Radio enabled */
+
+#ifdef RTMP_MAC_USB
+	BOOLEAN bMultipleIRP;	/* Multiple Bulk IN flag */
+	u8 NumOfBulkInIRP;	/* if bMultipleIRP == TRUE, NumOfBulkInIRP will be 4 otherwise be 1 */
+	struct rt_ht_capability SupportedHtPhy;
+	unsigned long MaxPktOneTxBulk;
+	u8 TxBulkFactor;
+	u8 RxBulkFactor;
+
+	BOOLEAN IsUpdateBeacon;
+	struct rt_beacon_sync *pBeaconSync;
+	struct rt_ralink_timer BeaconUpdateTimer;
+	u32 BeaconAdjust;
+	u32 BeaconFactor;
+	u32 BeaconRemain;
+#endif				/* RTMP_MAC_USB // */
+
+	spinlock_t MeasureReqTabLock;
+	struct rt_measure_req_tab *pMeasureReqTab;
+
+	spinlock_t TpcReqTabLock;
+	struct rt_tpc_req_tab *pTpcReqTab;
+
+	BOOLEAN PSPXlink;	/* 0: Disable. 1: Enable */
+
+#if defined(RT305x)||defined(RT30xx)
+	/* request by Gary, for High Power issue */
+	u8 HighPowerPatchDisabled;
 #endif
 
-	NDIS_SPIN_LOCK          irq_lock;
-	UCHAR                   irq_disabled;
+	BOOLEAN HT_DisallowTKIP;	/* Restrict the encryption type in 11n HT mode */
+};
 
-#ifdef RT2870
-/*****************************************************************************************/
-/*      USB related parameters                                                           */
-/*****************************************************************************************/
-	struct usb_config_descriptor		*config;
-	UINT								BulkInEpAddr;		// bulk-in endpoint address
-	UINT								BulkOutEpAddr[6];	// bulk-out endpoint address
+/* Modified by Wu Xi-Kun 4/21/2006 */
+/* STA configuration and status */
+struct rt_sta_admin_config {
+	/* GROUP 1 - */
+	/*   User configuration loaded from Registry, E2PROM or OID_xxx. These settings describe */
+	/*   the user intended configuration, but not necessary fully equal to the final */
+	/*   settings in ACTIVE BSS after negotiation/compromize with the BSS holder (either */
+	/*   AP or IBSS holder). */
+	/*   Once initialized, user configuration can only be changed via OID_xxx */
+	u8 BssType;		/* BSS_INFRA or BSS_ADHOC */
+	u16 AtimWin;		/* used when starting a new IBSS */
+
+	/* GROUP 2 - */
+	/*   User configuration loaded from Registry, E2PROM or OID_xxx. These settings describe */
+	/*   the user intended configuration, and should be always applied to the final */
+	/*   settings in ACTIVE BSS without compromising with the BSS holder. */
+	/*   Once initialized, user configuration can only be changed via OID_xxx */
+	u8 RssiTrigger;
+	u8 RssiTriggerMode;	/* RSSI_TRIGGERED_UPON_BELOW_THRESHOLD or RSSI_TRIGGERED_UPON_EXCCEED_THRESHOLD */
+	u16 DefaultListenCount;	/* default listen count; */
+	unsigned long WindowsPowerMode;	/* Power mode for AC power */
+	unsigned long WindowsBatteryPowerMode;	/* Power mode for battery if exists */
+	BOOLEAN bWindowsACCAMEnable;	/* Enable CAM power mode when AC on */
+	BOOLEAN bAutoReconnect;	/* Set to TRUE when setting OID_802_11_SSID with no matching BSSID */
+	unsigned long WindowsPowerProfile;	/* Windows power profile, for NDIS5.1 PnP */
+
+	/* MIB:ieee802dot11.dot11smt(1).dot11StationConfigTable(1) */
+	u16 Psm;		/* power management mode   (PWR_ACTIVE|PWR_SAVE) */
+	u16 DisassocReason;
+	u8 DisassocSta[MAC_ADDR_LEN];
+	u16 DeauthReason;
+	u8 DeauthSta[MAC_ADDR_LEN];
+	u16 AuthFailReason;
+	u8 AuthFailSta[MAC_ADDR_LEN];
+
+	NDIS_802_11_PRIVACY_FILTER PrivacyFilter;	/* PrivacyFilter enum for 802.1X */
+	NDIS_802_11_AUTHENTICATION_MODE AuthMode;	/* This should match to whatever microsoft defined */
+	NDIS_802_11_WEP_STATUS WepStatus;
+	NDIS_802_11_WEP_STATUS OrigWepStatus;	/* Original wep status set from OID */
+
+	/* Add to support different cipher suite for WPA2/WPA mode */
+	NDIS_802_11_ENCRYPTION_STATUS GroupCipher;	/* Multicast cipher suite */
+	NDIS_802_11_ENCRYPTION_STATUS PairCipher;	/* Unicast cipher suite */
+	BOOLEAN bMixCipher;	/* Indicate current Pair & Group use different cipher suites */
+	u16 RsnCapability;
+
+	NDIS_802_11_WEP_STATUS GroupKeyWepStatus;
+
+	u8 WpaPassPhrase[64];	/* WPA PSK pass phrase */
+	u32 WpaPassPhraseLen;	/* the length of WPA PSK pass phrase */
+	u8 PMK[32];		/* WPA PSK mode PMK */
+	u8 PTK[64];		/* WPA PSK mode PTK */
+	u8 GTK[32];		/* GTK from authenticator */
+	struct rt_bssid_info SavedPMK[PMKID_NO];
+	u32 SavedPMKNum;	/* Saved PMKID number */
+
+	u8 DefaultKeyId;
+
+	/* WPA 802.1x port control, WPA_802_1X_PORT_SECURED, WPA_802_1X_PORT_NOT_SECURED */
+	u8 PortSecured;
+
+	/* For WPA countermeasures */
+	unsigned long LastMicErrorTime;	/* record last MIC error time */
+	unsigned long MicErrCnt;	/* Should be 0, 1, 2, then reset to zero (after disassoiciation). */
+	BOOLEAN bBlockAssoc;	/* Block associate attempt for 60 seconds after counter measure occurred. */
+	/* For WPA-PSK supplicant state */
+	WPA_STATE WpaState;	/* Default is SS_NOTUSE and handled by microsoft 802.1x */
+	u8 ReplayCounter[8];
+	u8 ANonce[32];	/* ANonce for WPA-PSK from aurhenticator */
+	u8 SNonce[32];	/* SNonce for WPA-PSK */
+
+	u8 LastSNR0;		/* last received BEACON's SNR */
+	u8 LastSNR1;		/* last received BEACON's SNR for 2nd  antenna */
+	struct rt_rssi_sample RssiSample;
+	unsigned long NumOfAvgRssiSample;
+
+	unsigned long LastBeaconRxTime;	/* OS's timestamp of the last BEACON RX time */
+	unsigned long Last11bBeaconRxTime;	/* OS's timestamp of the last 11B BEACON RX time */
+	unsigned long Last11gBeaconRxTime;	/* OS's timestamp of the last 11G BEACON RX time */
+	unsigned long Last20NBeaconRxTime;	/* OS's timestamp of the last 20MHz N BEACON RX time */
+
+	unsigned long LastScanTime;	/* Record last scan time for issue BSSID_SCAN_LIST */
+	unsigned long ScanCnt;		/* Scan counts since most recent SSID, BSSID, SCAN OID request */
+	BOOLEAN bSwRadio;	/* Software controlled Radio On/Off, TRUE: On */
+	BOOLEAN bHwRadio;	/* Hardware controlled Radio On/Off, TRUE: On */
+	BOOLEAN bRadio;		/* Radio state, And of Sw & Hw radio state */
+	BOOLEAN bHardwareRadio;	/* Hardware controlled Radio enabled */
+	BOOLEAN bShowHiddenSSID;	/* Show all known SSID in SSID list get operation */
+
+	/* New for WPA, windows want us to keep association information and */
+	/* Fixed IEs from last association response */
+	struct rt_ndis_802_11_association_information AssocInfo;
+	u16 ReqVarIELen;	/* Length of next VIE include EID & Length */
+	u8 ReqVarIEs[MAX_VIE_LEN];	/* The content saved here should be little-endian format. */
+	u16 ResVarIELen;	/* Length of next VIE include EID & Length */
+	u8 ResVarIEs[MAX_VIE_LEN];
+
+	u8 RSNIE_Len;
+	u8 RSN_IE[MAX_LEN_OF_RSNIE];	/* The content saved here should be little-endian format. */
+
+	unsigned long CLBusyBytes;	/* Save the total bytes received durning channel load scan time */
+	u16 RPIDensity[8];	/* Array for RPI density collection */
+
+	u8 RMReqCnt;		/* Number of measurement request saved. */
+	u8 CurrentRMReqIdx;	/* Number of measurement request saved. */
+	BOOLEAN ParallelReq;	/* Parallel measurement, only one request performed, */
+	/* It must be the same channel with maximum duration */
+	u16 ParallelDuration;	/* Maximum duration for parallel measurement */
+	u8 ParallelChannel;	/* Only one channel with parallel measurement */
+	u16 IAPPToken;	/* IAPP dialog token */
+	/* Hack for channel load and noise histogram parameters */
+	u8 NHFactor;		/* Parameter for Noise histogram */
+	u8 CLFactor;		/* Parameter for channel load */
+
+	struct rt_ralink_timer StaQuickResponeForRateUpTimer;
+	BOOLEAN StaQuickResponeForRateUpTimerRunning;
+
+	u8 DtimCount;	/* 0.. DtimPeriod-1 */
+	u8 DtimPeriod;	/* default = 3 */
+
+	/*////////////////////////////////////////////////////////////////////////////////////// */
+	/* This is only for WHQL test. */
+	BOOLEAN WhqlTest;
+	/*////////////////////////////////////////////////////////////////////////////////////// */
+
+	struct rt_ralink_timer WpaDisassocAndBlockAssocTimer;
+	/* Fast Roaming */
+	BOOLEAN bAutoRoaming;	/* 0:disable auto roaming by RSSI, 1:enable auto roaming by RSSI */
+	char dBmToRoam;		/* the condition to roam when receiving Rssi less than this value. It's negative value. */
+
+	BOOLEAN IEEE8021X;
+	BOOLEAN IEEE8021x_required_keys;
+	struct rt_cipher_key DesireSharedKey[4];	/* Record user desired WEP keys */
+	u8 DesireSharedKeyId;
+
+	/* 0: driver ignores wpa_supplicant */
+	/* 1: wpa_supplicant initiates scanning and AP selection */
+	/* 2: driver takes care of scanning, AP selection, and IEEE 802.11 association parameters */
+	u8 WpaSupplicantUP;
+	u8 WpaSupplicantScanCount;
+	BOOLEAN bRSN_IE_FromWpaSupplicant;
+
+	char dev_name[16];
+	u16 OriDevType;
+
+	BOOLEAN bTGnWifiTest;
+	BOOLEAN bScanReqIsFromWebUI;
+
+	HTTRANSMIT_SETTING HTPhyMode, MaxHTPhyMode, MinHTPhyMode;	/* For transmit phy setting in TXWI. */
+	DESIRED_TRANSMIT_SETTING DesiredTransmitSetting;
+	struct rt_ht_phy_info DesiredHtPhyInfo;
+	BOOLEAN bAutoTxRateSwitch;
+
+#ifdef RTMP_MAC_PCI
+	u8 BBPR3;
+	/* PS Control has 2 meanings for advanced power save function. */
+	/* 1. EnablePSinIdle : When no connection, always radio off except need to do site survey. */
+	/* 2. EnableNewPS  : will save more current in sleep or radio off mode. */
+	PS_CONTROL PSControl;
+#endif				/* RTMP_MAC_PCI // */
+
+	BOOLEAN bAutoConnectByBssid;
+	unsigned long BeaconLostTime;	/* seconds */
+	BOOLEAN bForceTxBurst;	/* 1: force enble TX PACKET BURST, 0: disable */
+};
 
-	UINT								NumberOfPipes;
-	USHORT								BulkOutMaxPacketSize;
-	USHORT								BulkInMaxPacketSize;
+/* This data structure keep the current active BSS/IBSS's configuration that this STA */
+/* had agreed upon joining the network. Which means these parameters are usually decided */
+/* by the BSS/IBSS creator instead of user configuration. Data in this data structurre */
+/* is valid only when either ADHOC_ON(pAd) or INFRA_ON(pAd) is TRUE. */
+/* Normally, after SCAN or failed roaming attempts, we need to recover back to */
+/* the current active settings. */
+struct rt_sta_active_config {
+	u16 Aid;
+	u16 AtimWin;		/* in kusec; IBSS parameter set element */
+	u16 CapabilityInfo;
+	u16 CfpMaxDuration;
+	u16 CfpPeriod;
+
+	/* Copy supported rate from desired AP's beacon. We are trying to match */
+	/* AP's supported and extended rate settings. */
+	u8 SupRate[MAX_LEN_OF_SUPPORTED_RATES];
+	u8 ExtRate[MAX_LEN_OF_SUPPORTED_RATES];
+	u8 SupRateLen;
+	u8 ExtRateLen;
+	/* Copy supported ht from desired AP's beacon. We are trying to match */
+	struct rt_ht_phy_info SupportedPhyInfo;
+	struct rt_ht_capability SupportedHtPhy;
+};
 
-	//======Control Flags
-	LONG                    	PendingIoCount;
-	ULONG						BulkFlags;
-	BOOLEAN                     bUsbTxBulkAggre;	// Flags for bulk out data priority
+struct rt_mac_table_entry;
+
+struct rt_mac_table_entry {
+	/*Choose 1 from ValidAsWDS and ValidAsCLI  to validize. */
+	BOOLEAN ValidAsCLI;	/* Sta mode, set this TRUE after Linkup,too. */
+	BOOLEAN ValidAsWDS;	/* This is WDS Entry. only for AP mode. */
+	BOOLEAN ValidAsApCli;	/*This is a AP-Client entry, only for AP mode which enable AP-Client functions. */
+	BOOLEAN ValidAsMesh;
+	BOOLEAN ValidAsDls;	/* This is DLS Entry. only for STA mode. */
+	BOOLEAN isCached;
+	BOOLEAN bIAmBadAtheros;	/* Flag if this is Atheros chip that has IOT problem.  We need to turn on RTS/CTS protection. */
+
+	u8 EnqueueEapolStartTimerRunning;	/* Enqueue EAPoL-Start for triggering EAP SM */
+	/*jan for wpa */
+	/* record which entry revoke MIC Failure , if it leaves the BSS itself, AP won't update aMICFailTime MIB */
+	u8 CMTimerRunning;
+	u8 apidx;		/* MBSS number */
+	u8 RSNIE_Len;
+	u8 RSN_IE[MAX_LEN_OF_RSNIE];
+	u8 ANonce[LEN_KEY_DESC_NONCE];
+	u8 SNonce[LEN_KEY_DESC_NONCE];
+	u8 R_Counter[LEN_KEY_DESC_REPLAY];
+	u8 PTK[64];
+	u8 ReTryCounter;
+	struct rt_ralink_timer RetryTimer;
+	struct rt_ralink_timer EnqueueStartForPSKTimer;	/* A timer which enqueue EAPoL-Start for triggering PSK SM */
+	NDIS_802_11_AUTHENTICATION_MODE AuthMode;	/* This should match to whatever microsoft defined */
+	NDIS_802_11_WEP_STATUS WepStatus;
+	NDIS_802_11_WEP_STATUS GroupKeyWepStatus;
+	AP_WPA_STATE WpaState;
+	GTK_STATE GTKState;
+	u16 PortSecured;
+	NDIS_802_11_PRIVACY_FILTER PrivacyFilter;	/* PrivacyFilter enum for 802.1X */
+	struct rt_cipher_key PairwiseKey;
+	void *pAd;
+	int PMKID_CacheIdx;
+	u8 PMKID[LEN_PMKID];
+
+	u8 Addr[MAC_ADDR_LEN];
+	u8 PsMode;
+	SST Sst;
+	AUTH_STATE AuthState;	/* for SHARED KEY authentication state machine used only */
+	BOOLEAN IsReassocSta;	/* Indicate whether this is a reassociation procedure */
+	u16 Aid;
+	u16 CapabilityInfo;
+	u8 LastRssi;
+	unsigned long NoDataIdleCount;
+	u16 StationKeepAliveCount;	/* unit: second */
+	unsigned long PsQIdleCount;
+	struct rt_queue_header PsQueue;
+
+	u32 StaConnectTime;	/* the live time of this station since associated with AP */
+
+	BOOLEAN bSendBAR;
+	u16 NoBADataCountDown;
+
+	u32 CachedBuf[16];	/* u32 (4 bytes) for alignment */
+	u32 TxBFCount;		/* 3*3 */
+	u32 FIFOCount;
+	u32 DebugFIFOCount;
+	u32 DebugTxCount;
+	BOOLEAN bDlsInit;
+
+/*==================================================== */
+/*WDS entry needs these */
+/* if ValidAsWDS==TRUE, MatchWDSTabIdx is the index in WdsTab.MacTab */
+	u32 MatchWDSTabIdx;
+	u8 MaxSupportedRate;
+	u8 CurrTxRate;
+	u8 CurrTxRateIndex;
+	/* to record the each TX rate's quality. 0 is best, the bigger the worse. */
+	u16 TxQuality[MAX_STEP_OF_TX_RATE_SWITCH];
+/*      u16          OneSecTxOkCount; */
+	u32 OneSecTxNoRetryOkCount;
+	u32 OneSecTxRetryOkCount;
+	u32 OneSecTxFailCount;
+	u32 ContinueTxFailCnt;
+	u32 CurrTxRateStableTime;	/* # of second in current TX rate */
+	u8 TxRateUpPenalty;	/* extra # of second penalty due to last unstable condition */
+/*==================================================== */
+
+	BOOLEAN fNoisyEnvironment;
+	BOOLEAN fLastSecAccordingRSSI;
+	u8 LastSecTxRateChangeAction;	/* 0: no change, 1:rate UP, 2:rate down */
+	char LastTimeTxRateChangeAction;	/*Keep last time value of LastSecTxRateChangeAction */
+	unsigned long LastTxOkCount;
+	u8 PER[MAX_STEP_OF_TX_RATE_SWITCH];
+
+	/* a bitmap of BOOLEAN flags. each bit represent an operation status of a particular */
+	/* BOOLEAN control, either ON or OFF. These flags should always be accessed via */
+	/* CLIENT_STATUS_TEST_FLAG(), CLIENT_STATUS_SET_FLAG(), CLIENT_STATUS_CLEAR_FLAG() macros. */
+	/* see fOP_STATUS_xxx in RTMP_DEF.C for detail bit definition. fCLIENT_STATUS_AMSDU_INUSED */
+	unsigned long ClientStatusFlags;
+
+	HTTRANSMIT_SETTING HTPhyMode, MaxHTPhyMode, MinHTPhyMode;	/* For transmit phy setting in TXWI. */
+
+	/* HT EWC MIMO-N used parameters */
+	u16 RXBAbitmap;	/* fill to on-chip  RXWI_BA_BITMASK in 8.1.3RX attribute entry format */
+	u16 TXBAbitmap;	/* This bitmap as originator, only keep in software used to mark AMPDU bit in TXWI */
+	u16 TXAutoBAbitmap;
+	u16 BADeclineBitmap;
+	u16 BARecWcidArray[NUM_OF_TID];	/* The mapping wcid of recipient session. if RXBAbitmap bit is masked */
+	u16 BAOriWcidArray[NUM_OF_TID];	/* The mapping wcid of originator session. if TXBAbitmap bit is masked */
+	u16 BAOriSequence[NUM_OF_TID];	/* The mapping wcid of originator session. if TXBAbitmap bit is masked */
+
+	/* 802.11n features. */
+	u8 MpduDensity;
+	u8 MaxRAmpduFactor;
+	u8 AMsduSize;
+	u8 MmpsMode;		/* MIMO power save more. */
+
+	struct rt_ht_capability_ie HTCapability;
+
+	BOOLEAN bAutoTxRateSwitch;
+
+	u8 RateLen;
+	struct rt_mac_table_entry *pNext;
+	u16 TxSeq[NUM_OF_TID];
+	u16 NonQosDataSeq;
+
+	struct rt_rssi_sample RssiSample;
+
+	u32 TXMCSExpected[16];
+	u32 TXMCSSuccessful[16];
+	u32 TXMCSFailed[16];
+	u32 TXMCSAutoFallBack[16][16];
+
+	unsigned long LastBeaconRxTime;
+
+	unsigned long AssocDeadLine;
+};
 
+struct rt_mac_table {
+	u16 Size;
+	struct rt_mac_table_entry *Hash[HASH_TABLE_SIZE];
+	struct rt_mac_table_entry Content[MAX_LEN_OF_MAC_TABLE];
+	struct rt_queue_header McastPsQueue;
+	unsigned long PsQIdleCount;
+	BOOLEAN fAnyStationInPsm;
+	BOOLEAN fAnyStationBadAtheros;	/* Check if any Station is atheros 802.11n Chip.  We need to use RTS/CTS with Atheros 802,.11n chip. */
+	BOOLEAN fAnyTxOPForceDisable;	/* Check if it is necessary to disable BE TxOP */
+	BOOLEAN fAllStationAsRalink;	/* Check if all stations are ralink-chipset */
+	BOOLEAN fAnyStationIsLegacy;	/* Check if I use legacy rate to transmit to my BSS Station/ */
+	BOOLEAN fAnyStationNonGF;	/* Check if any Station can't support GF. */
+	BOOLEAN fAnyStation20Only;	/* Check if any Station can't support GF. */
+	BOOLEAN fAnyStationMIMOPSDynamic;	/* Check if any Station is MIMO Dynamic */
+	BOOLEAN fAnyBASession;	/* Check if there is BA session.  Force turn on RTS/CTS */
+/*2008/10/28: KH add to support Antenna power-saving of AP<-- */
+/*2008/10/28: KH add to support Antenna power-saving of AP--> */
+};
 
-	//======Timer Thread
-	RT2870_TIMER_QUEUE		TimerQ;
-	NDIS_SPIN_LOCK			TimerQLock;
+struct wificonf {
+	BOOLEAN bShortGI;
+	BOOLEAN bGreenField;
+};
 
+struct rt_rtmp_dev_info {
+	u8 chipName[16];
+	RTMP_INF_TYPE infType;
+};
 
-	//======Cmd Thread
-	CmdQ					CmdQ;
-	NDIS_SPIN_LOCK			CmdQLock;				// CmdQLock spinlock
+struct rt_rtmp_chip_op {
+	/*  Calibration access related callback functions */
+	int (*eeinit) (struct rt_rtmp_adapter *pAd);	/* int (*eeinit)(struct rt_rtmp_adapter *pAd); */
+	int (*eeread) (struct rt_rtmp_adapter *pAd, u16 offset, u16 *pValue);	/* int (*eeread)(struct rt_rtmp_adapter *pAd, int offset, u16 *pValue); */
+
+	/* MCU related callback functions */
+	int (*loadFirmware) (struct rt_rtmp_adapter *pAd);	/* int (*loadFirmware)(struct rt_rtmp_adapter *pAd); */
+	int (*eraseFirmware) (struct rt_rtmp_adapter *pAd);	/* int (*eraseFirmware)(struct rt_rtmp_adapter *pAd); */
+	int (*sendCommandToMcu) (struct rt_rtmp_adapter *pAd, u8 cmd, u8 token, u8 arg0, u8 arg1);;	/* int (*sendCommandToMcu)(struct rt_rtmp_adapter *pAd, u8 cmd, u8 token, u8 arg0, u8 arg1); */
+
+	/* RF access related callback functions */
+	struct rt_reg_pair *pRFRegTable;
+	void (*AsicRfInit) (struct rt_rtmp_adapter *pAd);
+	void (*AsicRfTurnOn) (struct rt_rtmp_adapter *pAd);
+	void (*AsicRfTurnOff) (struct rt_rtmp_adapter *pAd);
+	void (*AsicReverseRfFromSleepMode) (struct rt_rtmp_adapter *pAd);
+	void (*AsicHaltAction) (struct rt_rtmp_adapter *pAd);
+};
 
-	BOOLEAN					TimerFunc_kill;
-	BOOLEAN					mlme_kill;
+/* */
+/*  The miniport adapter structure */
+/* */
+struct rt_rtmp_adapter {
+	void *OS_Cookie;	/* save specific structure relative to OS */
+	struct net_device *net_dev;
+	unsigned long VirtualIfCnt;
 
+	struct rt_rtmp_chip_op chipOps;
+	u16 ThisTbttNumToNextWakeUp;
 
-	//======Semaphores (event)
-	struct semaphore			mlme_semaphore;			/* to sleep thread on	*/
-	struct semaphore			RTUSBCmd_semaphore;		/* to sleep thread on	*/
-	struct semaphore			RTUSBTimer_semaphore;
-	struct completion			TimerQComplete;
-	struct completion			mlmeComplete;
-	struct completion			CmdQComplete;
-	wait_queue_head_t			*wait;
-#endif // RT2870 //
+#ifdef RTMP_MAC_PCI
+/*****************************************************************************************/
+/*      PCI related parameters																  */
+/*****************************************************************************************/
+	u8 *CSRBaseAddress;	/* PCI MMIO Base Address, all access will use */
+	unsigned int irq_num;
+
+	u16 LnkCtrlBitMask;
+	u16 RLnkCtrlConfiguration;
+	u16 RLnkCtrlOffset;
+	u16 HostLnkCtrlConfiguration;
+	u16 HostLnkCtrlOffset;
+	u16 PCIePowerSaveLevel;
+	unsigned long Rt3xxHostLinkCtrl;	/* USed for 3090F chip */
+	unsigned long Rt3xxRalinkLinkCtrl;	/* USed for 3090F chip */
+	u16 DeviceID;	/* Read from PCI config */
+	unsigned long AccessBBPFailCount;
+	BOOLEAN bPCIclkOff;	/* flag that indicate if the PICE power status in Configuration SPace.. */
+	BOOLEAN bPCIclkOffDisableTx;	/* */
+
+	BOOLEAN brt30xxBanMcuCmd;	/*when = 0xff means all commands are ok to set . */
+	BOOLEAN b3090ESpecialChip;	/*3090E special chip that write EEPROM 0x24=0x9280. */
+	unsigned long CheckDmaBusyCount;	/* Check Interrupt Status Register Count. */
+
+	u32 int_enable_reg;
+	u32 int_disable_mask;
+	u32 int_pending;
+
+	struct rt_rtmp_dmabuf TxBufSpace[NUM_OF_TX_RING];	/* Shared memory of all 1st pre-allocated TxBuf associated with each TXD */
+	struct rt_rtmp_dmabuf RxDescRing;	/* Shared memory for RX descriptors */
+	struct rt_rtmp_dmabuf TxDescRing[NUM_OF_TX_RING];	/* Shared memory for Tx descriptors */
+	struct rt_rtmp_tx_ring TxRing[NUM_OF_TX_RING];	/* AC0~4 + HCCA */
+#endif				/* RTMP_MAC_PCI // */
+
+	spinlock_t irq_lock;
+	u8 irq_disabled;
+
+#ifdef RTMP_MAC_USB
+/*****************************************************************************************/
+/*      USB related parameters                                                           */
+/*****************************************************************************************/
+	struct usb_config_descriptor *config;
+	u32 BulkInEpAddr;	/* bulk-in endpoint address */
+	u32 BulkOutEpAddr[6];	/* bulk-out endpoint address */
+
+	u32 NumberOfPipes;
+	u16 BulkOutMaxPacketSize;
+	u16 BulkInMaxPacketSize;
+
+	/*======Control Flags */
+	long PendingIoCount;
+	unsigned long BulkFlags;
+	BOOLEAN bUsbTxBulkAggre;	/* Flags for bulk out data priority */
+
+	/*======Cmd Thread */
+	struct rt_cmdq CmdQ;
+	spinlock_t CmdQLock;	/* CmdQLock spinlock */
+	struct rt_rtmp_os_task cmdQTask;
+
+	/*======Semaphores (event) */
+	struct semaphore UsbVendorReq_semaphore;
+	void *UsbVendorReqBuf;
+	wait_queue_head_t *wait;
+#endif				/* RTMP_MAC_USB // */
 
+/*****************************************************************************************/
+/*      RBUS related parameters																  */
+/*****************************************************************************************/
 
 /*****************************************************************************************/
-	/*      Both PCI/USB related parameters                                                  */
+/*      Both PCI/USB related parameters														  */
 /*****************************************************************************************/
+	/*struct rt_rtmp_dev_info                 chipInfo; */
+	RTMP_INF_TYPE infType;
 
+/*****************************************************************************************/
+/*      Driver Mgmt related parameters														  */
+/*****************************************************************************************/
+	struct rt_rtmp_os_task mlmeTask;
+#ifdef RTMP_TIMER_TASK_SUPPORT
+	/* If you want use timer task to handle the timer related jobs, enable this. */
+	struct rt_rtmp_timer_task_queue TimerQ;
+	spinlock_t TimerQLock;
+	struct rt_rtmp_os_task timerTask;
+#endif				/* RTMP_TIMER_TASK_SUPPORT // */
 
 /*****************************************************************************************/
 /*      Tx related parameters                                                           */
 /*****************************************************************************************/
-	BOOLEAN                 DeQueueRunning[NUM_OF_TX_RING];  // for ensuring RTUSBDeQueuePacket get call once
-	NDIS_SPIN_LOCK          DeQueueLock[NUM_OF_TX_RING];
+	BOOLEAN DeQueueRunning[NUM_OF_TX_RING];	/* for ensuring RTUSBDeQueuePacket get call once */
+	spinlock_t DeQueueLock[NUM_OF_TX_RING];
 
-#ifdef RT2870
-	// Data related context and AC specified, 4 AC supported
-	NDIS_SPIN_LOCK			BulkOutLock[6];			// BulkOut spinlock for 4 ACs
-	NDIS_SPIN_LOCK			MLMEBulkOutLock;	// MLME BulkOut lock
+#ifdef RTMP_MAC_USB
+	/* Data related context and AC specified, 4 AC supported */
+	spinlock_t BulkOutLock[6];	/* BulkOut spinlock for 4 ACs */
+	spinlock_t MLMEBulkOutLock;	/* MLME BulkOut lock */
 
-	HT_TX_CONTEXT			TxContext[NUM_OF_TX_RING];
-	NDIS_SPIN_LOCK			TxContextQueueLock[NUM_OF_TX_RING];		// TxContextQueue spinlock
+	struct rt_ht_tx_context TxContext[NUM_OF_TX_RING];
+	spinlock_t TxContextQueueLock[NUM_OF_TX_RING];	/* TxContextQueue spinlock */
 
-	// 4 sets of Bulk Out index and pending flag
-	UCHAR					NextBulkOutIndex[4];	// only used for 4 EDCA bulkout pipe
+	/* 4 sets of Bulk Out index and pending flag */
+	u8 NextBulkOutIndex[4];	/* only used for 4 EDCA bulkout pipe */
 
-	BOOLEAN					BulkOutPending[6];	// used for total 6 bulkout pipe
-	UCHAR					bulkResetPipeid;
-	BOOLEAN					MgmtBulkPending;
-	ULONG					bulkResetReq[6];
-#endif // RT2870 //
+	BOOLEAN BulkOutPending[6];	/* used for total 6 bulkout pipe */
+	u8 bulkResetPipeid;
+	BOOLEAN MgmtBulkPending;
+	unsigned long bulkResetReq[6];
+#endif				/* RTMP_MAC_USB // */
 
-	// resource for software backlog queues
-	QUEUE_HEADER            TxSwQueue[NUM_OF_TX_RING];  // 4 AC + 1 HCCA
-	NDIS_SPIN_LOCK          TxSwQueueLock[NUM_OF_TX_RING];	// TxSwQueue spinlock
-
-	RTMP_DMABUF             MgmtDescRing;               	// Shared memory for MGMT descriptors
-	RTMP_MGMT_RING          MgmtRing;
-	NDIS_SPIN_LOCK          MgmtRingLock;               	// Prio Ring spinlock
+	/* resource for software backlog queues */
+	struct rt_queue_header TxSwQueue[NUM_OF_TX_RING];	/* 4 AC + 1 HCCA */
+	spinlock_t TxSwQueueLock[NUM_OF_TX_RING];	/* TxSwQueue spinlock */
 
+	struct rt_rtmp_dmabuf MgmtDescRing;	/* Shared memory for MGMT descriptors */
+	struct rt_rtmp_mgmt_ring MgmtRing;
+	spinlock_t MgmtRingLock;	/* Prio Ring spinlock */
 
 /*****************************************************************************************/
 /*      Rx related parameters                                                           */
 /*****************************************************************************************/
-#ifdef RT2860
-	RTMP_RX_RING            RxRing;
-	NDIS_SPIN_LOCK          RxRingLock;                 // Rx Ring spinlock
-#endif
-#ifdef RT2870
-	RX_CONTEXT				RxContext[RX_RING_SIZE];  // 1 for redundant multiple IRP bulk in.
-	NDIS_SPIN_LOCK			BulkInLock;				// BulkIn spinlock for 4 ACs
-	UCHAR					PendingRx;				// The Maxima pending Rx value should be 	RX_RING_SIZE.
-	UCHAR					NextRxBulkInIndex;		// Indicate the current RxContext Index which hold by Host controller.
-	UCHAR					NextRxBulkInReadIndex;	// Indicate the current RxContext Index which driver can read & process it.
-	ULONG					NextRxBulkInPosition;   // Want to contatenate 2 URB buffer while 1st is bulkin failed URB. This Position is 1st URB TransferLength.
-	ULONG					TransferBufferLength;	// current length of the packet buffer
-	ULONG					ReadPosition;			// current read position in a packet buffer
-#endif // RT2870 //
 
+#ifdef RTMP_MAC_PCI
+	struct rt_rtmp_rx_ring RxRing;
+	spinlock_t RxRingLock;	/* Rx Ring spinlock */
+#ifdef RT3090
+	spinlock_t McuCmdLock;	/*MCU Command Queue spinlock */
+#endif				/* RT3090 // */
+#endif				/* RTMP_MAC_PCI // */
+#ifdef RTMP_MAC_USB
+	struct rt_rx_context RxContext[RX_RING_SIZE];	/* 1 for redundant multiple IRP bulk in. */
+	spinlock_t BulkInLock;	/* BulkIn spinlock for 4 ACs */
+	u8 PendingRx;	/* The Maximum pending Rx value should be       RX_RING_SIZE. */
+	u8 NextRxBulkInIndex;	/* Indicate the current RxContext Index which hold by Host controller. */
+	u8 NextRxBulkInReadIndex;	/* Indicate the current RxContext Index which driver can read & process it. */
+	unsigned long NextRxBulkInPosition;	/* Want to contatenate 2 URB buffer while 1st is bulkin failed URB. This Position is 1st URB TransferLength. */
+	unsigned long TransferBufferLength;	/* current length of the packet buffer */
+	unsigned long ReadPosition;	/* current read position in a packet buffer */
+#endif				/* RTMP_MAC_USB // */
 
 /*****************************************************************************************/
 /*      ASIC related parameters                                                          */
 /*****************************************************************************************/
-	UINT32               	MACVersion;      	// MAC version. Record rt2860C(0x28600100) or rt2860D (0x28600101)..
-
-	// ---------------------------
-	// E2PROM
-	// ---------------------------
-	ULONG                   EepromVersion;          // byte 0: version, byte 1: revision, byte 2~3: unused
-	UCHAR                   EEPROMAddressNum;       // 93c46=6  93c66=8
-	USHORT                  EEPROMDefaultValue[NUM_EEPROM_BBP_PARMS];
-#ifdef RT2870
-	BOOLEAN                 EepromAccess;
-#endif
-	ULONG                   FirmwareVersion;        // byte 0: Minor version, byte 1: Major version, otherwise unused.
-
-	// ---------------------------
-	// BBP Control
-	// ---------------------------
-	UCHAR                   BbpWriteLatch[140];     // record last BBP register value written via BBP_IO_WRITE/BBP_IO_WRITE_VY_REG_ID
-	UCHAR                   BbpRssiToDbmDelta;
-	BBP_R66_TUNING          BbpTuning;
-
-	// ----------------------------
-	// RFIC control
-	// ----------------------------
-	UCHAR                   RfIcType;       // RFIC_xxx
-	ULONG                   RfFreqOffset;   // Frequency offset for channel switching
-	RTMP_RF_REGS            LatchRfRegs;    // latch th latest RF programming value since RF IC doesn't support READ
-
-	EEPROM_ANTENNA_STRUC    Antenna;                            // Since ANtenna definition is different for a & g. We need to save it for future reference.
-	EEPROM_NIC_CONFIG2_STRUC    NicConfig2;
-
-	// This soft Rx Antenna Diversity mechanism is used only when user set
-	// RX Antenna = DIVERSITY ON
-	SOFT_RX_ANT_DIVERSITY   RxAnt;
-
-	UCHAR                   RFProgSeq;
-	CHANNEL_TX_POWER        TxPower[MAX_NUM_OF_CHANNELS];       // Store Tx power value for all channels.
-	CHANNEL_TX_POWER        ChannelList[MAX_NUM_OF_CHANNELS];   // list all supported channels for site survey
-	CHANNEL_11J_TX_POWER    TxPower11J[MAX_NUM_OF_11JCHANNELS];       // 802.11j channel and bw
-	CHANNEL_11J_TX_POWER    ChannelList11J[MAX_NUM_OF_11JCHANNELS];   // list all supported channels for site survey
-
-	UCHAR                   ChannelListNum;                     // number of channel in ChannelList[]
-	UCHAR					Bbp94;
-	BOOLEAN					BbpForCCK;
-	ULONG		Tx20MPwrCfgABand[5];
-	ULONG		Tx20MPwrCfgGBand[5];
-	ULONG		Tx40MPwrCfgABand[5];
-	ULONG		Tx40MPwrCfgGBand[5];
-
-	BOOLEAN     bAutoTxAgcA;                // Enable driver auto Tx Agc control
-	UCHAR	    TssiRefA;					// Store Tssi reference value as 25 temperature.
-	UCHAR	    TssiPlusBoundaryA[5];		// Tssi boundary for increase Tx power to compensate.
-	UCHAR	    TssiMinusBoundaryA[5];		// Tssi boundary for decrease Tx power to compensate.
-	UCHAR	    TxAgcStepA;					// Store Tx TSSI delta increment / decrement value
-	CHAR		TxAgcCompensateA;			// Store the compensation (TxAgcStep * (idx-1))
-
-	BOOLEAN     bAutoTxAgcG;                // Enable driver auto Tx Agc control
-	UCHAR	    TssiRefG;					// Store Tssi reference value as 25 temperature.
-	UCHAR	    TssiPlusBoundaryG[5];		// Tssi boundary for increase Tx power to compensate.
-	UCHAR	    TssiMinusBoundaryG[5];		// Tssi boundary for decrease Tx power to compensate.
-	UCHAR	    TxAgcStepG;					// Store Tx TSSI delta increment / decrement value
-	CHAR		TxAgcCompensateG;			// Store the compensation (TxAgcStep * (idx-1))
-
-	//+++For RT2870, the parameteres is start from BGRssiOffset1 ~ BGRssiOffset3
-	CHAR		BGRssiOffset0;				// Store B/G RSSI#0 Offset value on EEPROM 0x46h
-	CHAR		BGRssiOffset1;				// Store B/G RSSI#1 Offset value
-	CHAR		BGRssiOffset2;				// Store B/G RSSI#2 Offset value
-	//---
-
-	//+++For RT2870, the parameteres is start from ARssiOffset1 ~ ARssiOffset3
-	CHAR		ARssiOffset0;				// Store A RSSI#0 Offset value on EEPROM 0x4Ah
-	CHAR		ARssiOffset1;				// Store A RSSI#1 Offset value
-	CHAR		ARssiOffset2;				// Store A RSSI#2 Offset value
-	//---
-
-	CHAR		BLNAGain;					// Store B/G external LNA#0 value on EEPROM 0x44h
-	CHAR		ALNAGain0;					// Store A external LNA#0 value for ch36~64
-	CHAR		ALNAGain1;					// Store A external LNA#1 value for ch100~128
-	CHAR		ALNAGain2;					// Store A external LNA#2 value for ch132~165
-
-	// ----------------------------
-	// LED control
-	// ----------------------------
-	MCU_LEDCS_STRUC		LedCntl;
-	USHORT				Led1;	// read from EEPROM 0x3c
-	USHORT				Led2;	// EEPROM 0x3e
-	USHORT				Led3;	// EEPROM 0x40
-	UCHAR				LedIndicatorStregth;
-	UCHAR				RssiSingalstrengthOffet;
-    BOOLEAN				bLedOnScanning;
-	UCHAR				LedStatus;
+	u32 MACVersion;	/* MAC version. Record rt2860C(0x28600100) or rt2860D (0x28600101).. */
+
+	/* --------------------------- */
+	/* E2PROM */
+	/* --------------------------- */
+	unsigned long EepromVersion;	/* byte 0: version, byte 1: revision, byte 2~3: unused */
+	unsigned long FirmwareVersion;	/* byte 0: Minor version, byte 1: Major version, otherwise unused. */
+	u16 EEPROMDefaultValue[NUM_EEPROM_BBP_PARMS];
+	u8 EEPROMAddressNum;	/* 93c46=6  93c66=8 */
+	BOOLEAN EepromAccess;
+	u8 EFuseTag;
+
+	/* --------------------------- */
+	/* BBP Control */
+	/* --------------------------- */
+	u8 BbpWriteLatch[140];	/* record last BBP register value written via BBP_IO_WRITE/BBP_IO_WRITE_VY_REG_ID */
+	char BbpRssiToDbmDelta;	/* change from u8 to char for high power */
+	struct rt_bbp_r66_tuning BbpTuning;
+
+	/* ---------------------------- */
+	/* RFIC control */
+	/* ---------------------------- */
+	u8 RfIcType;		/* RFIC_xxx */
+	unsigned long RfFreqOffset;	/* Frequency offset for channel switching */
+	struct rt_rtmp_rf_regs LatchRfRegs;	/* latch th latest RF programming value since RF IC doesn't support READ */
+
+	EEPROM_ANTENNA_STRUC Antenna;	/* Since ANtenna definition is different for a & g. We need to save it for future reference. */
+	EEPROM_NIC_CONFIG2_STRUC NicConfig2;
+
+	/* This soft Rx Antenna Diversity mechanism is used only when user set */
+	/* RX Antenna = DIVERSITY ON */
+	struct rt_soft_rx_ant_diversity RxAnt;
+
+	u8 RFProgSeq;
+	struct rt_channel_tx_power TxPower[MAX_NUM_OF_CHANNELS];	/* Store Tx power value for all channels. */
+	struct rt_channel_tx_power ChannelList[MAX_NUM_OF_CHANNELS];	/* list all supported channels for site survey */
+	struct rt_channel_11j_tx_power TxPower11J[MAX_NUM_OF_11JCHANNELS];	/* 802.11j channel and bw */
+	struct rt_channel_11j_tx_power ChannelList11J[MAX_NUM_OF_11JCHANNELS];	/* list all supported channels for site survey */
+
+	u8 ChannelListNum;	/* number of channel in ChannelList[] */
+	u8 Bbp94;
+	BOOLEAN BbpForCCK;
+	unsigned long Tx20MPwrCfgABand[5];
+	unsigned long Tx20MPwrCfgGBand[5];
+	unsigned long Tx40MPwrCfgABand[5];
+	unsigned long Tx40MPwrCfgGBand[5];
+
+	BOOLEAN bAutoTxAgcA;	/* Enable driver auto Tx Agc control */
+	u8 TssiRefA;		/* Store Tssi reference value as 25 temperature. */
+	u8 TssiPlusBoundaryA[5];	/* Tssi boundary for increase Tx power to compensate. */
+	u8 TssiMinusBoundaryA[5];	/* Tssi boundary for decrease Tx power to compensate. */
+	u8 TxAgcStepA;	/* Store Tx TSSI delta increment / decrement value */
+	char TxAgcCompensateA;	/* Store the compensation (TxAgcStep * (idx-1)) */
+
+	BOOLEAN bAutoTxAgcG;	/* Enable driver auto Tx Agc control */
+	u8 TssiRefG;		/* Store Tssi reference value as 25 temperature. */
+	u8 TssiPlusBoundaryG[5];	/* Tssi boundary for increase Tx power to compensate. */
+	u8 TssiMinusBoundaryG[5];	/* Tssi boundary for decrease Tx power to compensate. */
+	u8 TxAgcStepG;	/* Store Tx TSSI delta increment / decrement value */
+	char TxAgcCompensateG;	/* Store the compensation (TxAgcStep * (idx-1)) */
+
+	char BGRssiOffset0;	/* Store B/G RSSI#0 Offset value on EEPROM 0x46h */
+	char BGRssiOffset1;	/* Store B/G RSSI#1 Offset value */
+	char BGRssiOffset2;	/* Store B/G RSSI#2 Offset value */
+
+	char ARssiOffset0;	/* Store A RSSI#0 Offset value on EEPROM 0x4Ah */
+	char ARssiOffset1;	/* Store A RSSI#1 Offset value */
+	char ARssiOffset2;	/* Store A RSSI#2 Offset value */
+
+	char BLNAGain;		/* Store B/G external LNA#0 value on EEPROM 0x44h */
+	char ALNAGain0;		/* Store A external LNA#0 value for ch36~64 */
+	char ALNAGain1;		/* Store A external LNA#1 value for ch100~128 */
+	char ALNAGain2;		/* Store A external LNA#2 value for ch132~165 */
+#ifdef RT30xx
+	/* for 3572 */
+	u8 Bbp25;
+	u8 Bbp26;
+
+	u8 TxMixerGain24G;	/* Tx mixer gain value from EEPROM to improve Tx EVM / Tx DAC, 2.4G */
+	u8 TxMixerGain5G;
+#endif				/* RT30xx // */
+	/* ---------------------------- */
+	/* LED control */
+	/* ---------------------------- */
+	MCU_LEDCS_STRUC LedCntl;
+	u16 Led1;		/* read from EEPROM 0x3c */
+	u16 Led2;		/* EEPROM 0x3e */
+	u16 Led3;		/* EEPROM 0x40 */
+	u8 LedIndicatorStrength;
+	u8 RssiSingalstrengthOffet;
+	BOOLEAN bLedOnScanning;
+	u8 LedStatus;
 
 /*****************************************************************************************/
 /*      802.11 related parameters                                                        */
 /*****************************************************************************************/
-	// outgoing BEACON frame buffer and corresponding TXD
-	TXWI_STRUC              	BeaconTxWI;
-	PUCHAR						BeaconBuf;
-	USHORT						BeaconOffset[HW_BEACON_MAX_COUNT];
-
-	// pre-build PS-POLL and NULL frame upon link up. for efficiency purpose.
-	PSPOLL_FRAME            	PsPollFrame;
-	HEADER_802_11           	NullFrame;
-
-#ifdef RT2870
-	TX_CONTEXT				BeaconContext[BEACON_RING_SIZE];
-	TX_CONTEXT				NullContext;
-	TX_CONTEXT				PsPollContext;
-	TX_CONTEXT				RTSContext;
-#endif // RT2870 //
-
-
-
-//=========AP===========
-
-
-//=======STA===========
-/* Modified by Wu Xi-Kun 4/21/2006 */
-	// -----------------------------------------------
-	// STA specific configuration & operation status
-	// used only when pAd->OpMode == OPMODE_STA
-	// -----------------------------------------------
-	STA_ADMIN_CONFIG        StaCfg;           // user desired settings
-	STA_ACTIVE_CONFIG       StaActive;         // valid only when ADHOC_ON(pAd) || INFRA_ON(pAd)
-	CHAR                    nickname[IW_ESSID_MAX_SIZE+1]; // nickname, only used in the iwconfig i/f
-	NDIS_MEDIA_STATE        PreMediaState;
-
-//=======Common===========
-	// OP mode: either AP or STA
-	UCHAR                   OpMode;                     // OPMODE_STA, OPMODE_AP
-
-	NDIS_MEDIA_STATE        IndicateMediaState;			// Base on Indication state, default is NdisMediaStateDisConnected
-
-
-	// configuration: read from Registry & E2PROM
-	BOOLEAN                 bLocalAdminMAC;             // Use user changed MAC
-	UCHAR                   PermanentAddress[MAC_ADDR_LEN];    // Factory default MAC address
-	UCHAR                   CurrentAddress[MAC_ADDR_LEN];      // User changed MAC address
-
-	// ------------------------------------------------------
-	// common configuration to both OPMODE_STA and OPMODE_AP
-	// ------------------------------------------------------
-	COMMON_CONFIG           CommonCfg;
-	MLME_STRUCT             Mlme;
-
-	// AP needs those vaiables for site survey feature.
-	MLME_AUX                MlmeAux;           // temporary settings used during MLME state machine
-	BSS_TABLE               ScanTab;           // store the latest SCAN result
-
-	//About MacTab, the sta driver will use #0 and #1 for multicast and AP.
-	MAC_TABLE                 MacTab;     // ASIC on-chip WCID entry table.  At TX, ASIC always use key according to this on-chip table.
-	NDIS_SPIN_LOCK          MacTabLock;
-
-	BA_TABLE			BATable;
-
-	NDIS_SPIN_LOCK          BATabLock;
-	RALINK_TIMER_STRUCT RECBATimer;
-
-	// encryption/decryption KEY tables
-	CIPHER_KEY              SharedKey[MAX_MBSSID_NUM][4]; // STA always use SharedKey[BSS0][0..3]
-
-		// RX re-assembly buffer for fragmentation
-	FRAGMENT_FRAME          FragFrame;                  // Frame storage for fragment frame
-
-	// various Counters
-	COUNTER_802_3           Counters8023;               // 802.3 counters
-	COUNTER_802_11          WlanCounters;               // 802.11 MIB counters
-	COUNTER_RALINK          RalinkCounters;             // Ralink propriety counters
-	COUNTER_DRS             DrsCounters;                // counters for Dynamic TX Rate Switching
-	PRIVATE_STRUC           PrivateInfo;                // Private information & counters
-
-	// flags, see fRTMP_ADAPTER_xxx flags
-	ULONG                   Flags;                      // Represent current device status
-#ifdef RT2860
-	ULONG                   PSFlags;                    // Power Save operation flag.
-#endif
-
-	// current TX sequence #
-	USHORT                  Sequence;
-
-	// Control disconnect / connect event generation
-	//+++Didn't used anymore
-	ULONG                   LinkDownTime;
-	//---
-	ULONG                   LastRxRate;
-	ULONG                   LastTxRate;
-	//+++Used only for Station
-	BOOLEAN                 bConfigChanged;         // Config Change flag for the same SSID setting
-	//---
-
-	ULONG                   ExtraInfo;              // Extra information for displaying status
-	ULONG                   SystemErrorBitmap;      // b0: E2PROM version error
-
-	//+++Didn't used anymore
-	ULONG                   MacIcVersion;           // MAC/BBP serial interface issue solved after ver.D
-	//---
-
-	// ---------------------------
-	// System event log
-	// ---------------------------
-	RT_802_11_EVENT_TABLE   EventTab;
-
-
-	BOOLEAN		HTCEnable;
+	/* outgoing BEACON frame buffer and corresponding TXD */
+	struct rt_txwi BeaconTxWI;
+	u8 *BeaconBuf;
+	u16 BeaconOffset[HW_BEACON_MAX_COUNT];
+
+	/* pre-build PS-POLL and NULL frame upon link up. for efficiency purpose. */
+	struct rt_pspoll_frame PsPollFrame;
+	struct rt_header_802_11 NullFrame;
+
+#ifdef RTMP_MAC_USB
+	struct rt_tx_context BeaconContext[BEACON_RING_SIZE];
+	struct rt_tx_context NullContext;
+	struct rt_tx_context PsPollContext;
+	struct rt_tx_context RTSContext;
+#endif				/* RTMP_MAC_USB // */
+
+/*=========AP=========== */
+
+/*=======STA=========== */
+	/* ----------------------------------------------- */
+	/* STA specific configuration & operation status */
+	/* used only when pAd->OpMode == OPMODE_STA */
+	/* ----------------------------------------------- */
+	struct rt_sta_admin_config StaCfg;	/* user desired settings */
+	struct rt_sta_active_config StaActive;	/* valid only when ADHOC_ON(pAd) || INFRA_ON(pAd) */
+	char nickname[IW_ESSID_MAX_SIZE + 1];	/* nickname, only used in the iwconfig i/f */
+	int PreMediaState;
+
+/*=======Common=========== */
+	/* OP mode: either AP or STA */
+	u8 OpMode;		/* OPMODE_STA, OPMODE_AP */
+
+	int IndicateMediaState;	/* Base on Indication state, default is NdisMediaStateDisConnected */
+
+	/* MAT related parameters */
+
+	/* configuration: read from Registry & E2PROM */
+	BOOLEAN bLocalAdminMAC;	/* Use user changed MAC */
+	u8 PermanentAddress[MAC_ADDR_LEN];	/* Factory default MAC address */
+	u8 CurrentAddress[MAC_ADDR_LEN];	/* User changed MAC address */
+
+	/* ------------------------------------------------------ */
+	/* common configuration to both OPMODE_STA and OPMODE_AP */
+	/* ------------------------------------------------------ */
+	struct rt_common_config CommonCfg;
+	struct rt_mlme Mlme;
+
+	/* AP needs those vaiables for site survey feature. */
+	struct rt_mlme_aux MlmeAux;	/* temporary settings used during MLME state machine */
+	struct rt_bss_table ScanTab;	/* store the latest SCAN result */
+
+	/*About MacTab, the sta driver will use #0 and #1 for multicast and AP. */
+	struct rt_mac_table MacTab;	/* ASIC on-chip WCID entry table.  At TX, ASIC always use key according to this on-chip table. */
+	spinlock_t MacTabLock;
+
+	struct rt_ba_table BATable;
+
+	spinlock_t BATabLock;
+	struct rt_ralink_timer RECBATimer;
+
+	/* encryption/decryption KEY tables */
+	struct rt_cipher_key SharedKey[MAX_MBSSID_NUM][4];	/* STA always use SharedKey[BSS0][0..3] */
+
+	/* RX re-assembly buffer for fragmentation */
+	struct rt_fragment_frame FragFrame;	/* Frame storage for fragment frame */
+
+	/* various Counters */
+	struct rt_counter_802_3 Counters8023;	/* 802.3 counters */
+	struct rt_counter_802_11 WlanCounters;	/* 802.11 MIB counters */
+	struct rt_counter_ralink RalinkCounters;	/* Ralink propriety counters */
+	struct rt_counter_drs DrsCounters;	/* counters for Dynamic TX Rate Switching */
+	struct rt_private PrivateInfo;	/* Private information & counters */
+
+	/* flags, see fRTMP_ADAPTER_xxx flags */
+	unsigned long Flags;		/* Represent current device status */
+	unsigned long PSFlags;		/* Power Save operation flag. */
+
+	/* current TX sequence # */
+	u16 Sequence;
+
+	/* Control disconnect / connect event generation */
+	/*+++Didn't used anymore */
+	unsigned long LinkDownTime;
+	/*--- */
+	unsigned long LastRxRate;
+	unsigned long LastTxRate;
+	/*+++Used only for Station */
+	BOOLEAN bConfigChanged;	/* Config Change flag for the same SSID setting */
+	/*--- */
+
+	unsigned long ExtraInfo;	/* Extra information for displaying status */
+	unsigned long SystemErrorBitmap;	/* b0: E2PROM version error */
+
+	/*+++Didn't used anymore */
+	unsigned long MacIcVersion;	/* MAC/BBP serial interface issue solved after ver.D */
+	/*--- */
+
+	/* --------------------------- */
+	/* System event log */
+	/* --------------------------- */
+	struct rt_802_11_event_table EventTab;
+
+	BOOLEAN HTCEnable;
 
 	/*****************************************************************************************/
 	/*      Statistic related parameters                                                     */
 	/*****************************************************************************************/
-#ifdef RT2870
-	ULONG						BulkOutDataOneSecCount;
-	ULONG						BulkInDataOneSecCount;
-	ULONG						BulkLastOneSecCount; // BulkOutDataOneSecCount + BulkInDataOneSecCount
-	ULONG						watchDogRxCnt;
-	ULONG						watchDogRxOverFlowCnt;
-	ULONG						watchDogTxPendingCnt[NUM_OF_TX_RING];
-#endif // RT2870 //
-
-	BOOLEAN						bUpdateBcnCntDone;
-	ULONG						watchDogMacDeadlock;	// prevent MAC/BBP into deadlock condition
-	// ----------------------------
-	// DEBUG paramerts
-	// ----------------------------
-	BOOLEAN		bBanAllBaSetup;
-	BOOLEAN		bPromiscuous;
-
-	// ----------------------------
-	// rt2860c emulation-use Parameters
-	// ----------------------------
-	ULONG		rtsaccu[30];
-	ULONG		ctsaccu[30];
-	ULONG		cfendaccu[30];
-	ULONG		bacontent[16];
-	ULONG		rxint[RX_RING_SIZE+1];
-	UCHAR		rcvba[60];
-	BOOLEAN		bLinkAdapt;
-	BOOLEAN		bForcePrintTX;
-	BOOLEAN		bForcePrintRX;
-	BOOLEAN		bDisablescanning;		//defined in RT2870 USB
-	BOOLEAN		bStaFifoTest;
-	BOOLEAN		bProtectionTest;
-	BOOLEAN		bHCCATest;
-	BOOLEAN		bGenOneHCCA;
-	BOOLEAN		bBroadComHT;
-	//+++Following add from RT2870 USB.
-	ULONG		BulkOutReq;
-	ULONG		BulkOutComplete;
-	ULONG		BulkOutCompleteOther;
-	ULONG		BulkOutCompleteCancel;	// seems not use now?
-	ULONG		BulkInReq;
-	ULONG		BulkInComplete;
-	ULONG		BulkInCompleteFail;
-	//---
-
-    struct wificonf			WIFItestbed;
+#ifdef RTMP_MAC_USB
+	unsigned long BulkOutDataOneSecCount;
+	unsigned long BulkInDataOneSecCount;
+	unsigned long BulkLastOneSecCount;	/* BulkOutDataOneSecCount + BulkInDataOneSecCount */
+	unsigned long watchDogRxCnt;
+	unsigned long watchDogRxOverFlowCnt;
+	unsigned long watchDogTxPendingCnt[NUM_OF_TX_RING];
+	int TransferedLength[NUM_OF_TX_RING];
+#endif				/* RTMP_MAC_USB // */
+
+	BOOLEAN bUpdateBcnCntDone;
+	unsigned long watchDogMacDeadlock;	/* prevent MAC/BBP into deadlock condition */
+	/* ---------------------------- */
+	/* DEBUG paramerts */
+	/* ---------------------------- */
+	/*unsigned long         DebugSetting[4]; */
+	BOOLEAN bBanAllBaSetup;
+	BOOLEAN bPromiscuous;
+
+	/* ---------------------------- */
+	/* rt2860c emulation-use Parameters */
+	/* ---------------------------- */
+	/*unsigned long         rtsaccu[30]; */
+	/*unsigned long         ctsaccu[30]; */
+	/*unsigned long         cfendaccu[30]; */
+	/*unsigned long         bacontent[16]; */
+	/*unsigned long         rxint[RX_RING_SIZE+1]; */
+	/*u8         rcvba[60]; */
+	BOOLEAN bLinkAdapt;
+	BOOLEAN bForcePrintTX;
+	BOOLEAN bForcePrintRX;
+	/*BOOLEAN               bDisablescanning;               //defined in RT2870 USB */
+	BOOLEAN bStaFifoTest;
+	BOOLEAN bProtectionTest;
+	BOOLEAN bBroadComHT;
+	/*+++Following add from RT2870 USB. */
+	unsigned long BulkOutReq;
+	unsigned long BulkOutComplete;
+	unsigned long BulkOutCompleteOther;
+	unsigned long BulkOutCompleteCancel;	/* seems not use now? */
+	unsigned long BulkInReq;
+	unsigned long BulkInComplete;
+	unsigned long BulkInCompleteFail;
+	/*--- */
+
+	struct wificonf WIFItestbed;
 
 	struct reordering_mpdu_pool mpdu_blk_pool;
 
-	ULONG					OneSecondnonBEpackets;		// record non BE packets per second
+	unsigned long OneSecondnonBEpackets;	/* record non BE packets per second */
 
-    struct iw_statistics    iw_stats;
+#ifdef LINUX
+	struct iw_statistics iw_stats;
 
-	struct net_device_stats	stats;
+	struct net_device_stats stats;
+#endif				/* LINUX // */
 
-	ULONG					TbttTickCount;
+	unsigned long TbttTickCount;
 #ifdef PCI_MSI_SUPPORT
-	BOOLEAN					HaveMsi;
-#endif // PCI_MSI_SUPPORT //
-
+	BOOLEAN HaveMsi;
+#endif				/* PCI_MSI_SUPPORT // */
 
-	UCHAR					is_on;
+	u8 is_on;
 
 #define TIME_BASE			(1000000/OS_HZ)
 #define TIME_ONE_SECOND		(1000000/TIME_BASE)
-	UCHAR					flg_be_adjust;
-	ULONG					be_adjust_last_time;
-
-
-
-	UINT8					PM_FlgSuspend;
-
-#ifdef RT2870
-	BOOLEAN		bUseEfuse;
-#endif
-} RTMP_ADAPTER, *PRTMP_ADAPTER;
-
-//
-// Cisco IAPP format
-//
-typedef struct  _CISCO_IAPP_CONTENT_
-{
-	USHORT     Length;        //IAPP Length
-	UCHAR      MessageType;      //IAPP type
-	UCHAR      FunctionCode;     //IAPP function type
-	UCHAR      DestinaionMAC[MAC_ADDR_LEN];
-	UCHAR      SourceMAC[MAC_ADDR_LEN];
-	USHORT     Tag;           //Tag(element IE) - Adjacent AP report
-	USHORT     TagLength;     //Length of element not including 4 byte header
-	UCHAR      OUI[4];           //0x00, 0x40, 0x96, 0x00
-	UCHAR      PreviousAP[MAC_ADDR_LEN];       //MAC Address of access point
-	USHORT     Channel;
-	USHORT     SsidLen;
-	UCHAR      Ssid[MAX_LEN_OF_SSID];
-	USHORT     Seconds;          //Seconds that the client has been disassociated.
-} CISCO_IAPP_CONTENT, *PCISCO_IAPP_CONTENT;
+	u8 flg_be_adjust;
+	unsigned long be_adjust_last_time;
+
+	u8 FlgCtsEnabled;
+	u8 PM_FlgSuspend;
+
+#ifdef RT30xx
+#ifdef RTMP_EFUSE_SUPPORT
+	BOOLEAN bUseEfuse;
+	u8 EEPROMImage[1024];
+#endif				/* RTMP_EFUSE_SUPPORT // */
+#endif				/* RT30xx // */
+};
 
 #define DELAYINTMASK		0x0003fffb
 #define INTMASK				0x0003fffb
 #define IndMask				0x0003fffc
-#define RxINT				0x00000005	// Delayed Rx or indivi rx
-#define TxDataInt			0x000000fa	// Delayed Tx or indivi tx
-#define TxMgmtInt			0x00000102	// Delayed Tx or indivi tx
-#define TxCoherent			0x00020000	// tx coherent
-#define RxCoherent			0x00010000	// rx coherent
-#define McuCommand			0x00000200	// mcu
-#define PreTBTTInt			0x00001000	// Pre-TBTT interrupt
-#define TBTTInt				0x00000800		// TBTT interrupt
-#define GPTimeOutInt			0x00008000		// GPtimeout interrupt
-#define AutoWakeupInt		0x00004000		// AutoWakeupInt interrupt
-#define FifoStaFullInt			0x00002000	//  fifo statistics full interrupt
-
-
-typedef struct _RX_BLK_
-{
-	RT28XX_RXD_STRUC	RxD;
-	PRXWI_STRUC			pRxWI;
-	PHEADER_802_11		pHeader;
-	PNDIS_PACKET		pRxPacket;
-	UCHAR				*pData;
-	USHORT				DataSize;
-	USHORT				Flags;
-	UCHAR				UserPriority;	// for calculate TKIP MIC using
-} RX_BLK;
-
+#define RxINT				0x00000005	/* Delayed Rx or indivi rx */
+#define TxDataInt			0x000000fa	/* Delayed Tx or indivi tx */
+#define TxMgmtInt			0x00000102	/* Delayed Tx or indivi tx */
+#define TxCoherent			0x00020000	/* tx coherent */
+#define RxCoherent			0x00010000	/* rx coherent */
+#define McuCommand			0x00000200	/* mcu */
+#define PreTBTTInt			0x00001000	/* Pre-TBTT interrupt */
+#define TBTTInt				0x00000800	/* TBTT interrupt */
+#define GPTimeOutInt			0x00008000	/* GPtimeout interrupt */
+#define AutoWakeupInt		0x00004000	/* AutoWakeupInt interrupt */
+#define FifoStaFullInt			0x00002000	/*  fifo statistics full interrupt */
+
+/***************************************************************************
+  *	Rx Path software control block related data structures
+  **************************************************************************/
+struct rt_rx_blk {
+	RT28XX_RXD_STRUC RxD;
+	struct rt_rxwi * pRxWI;
+	struct rt_header_802_11 * pHeader;
+	void *pRxPacket;
+	u8 *pData;
+	u16 DataSize;
+	u16 Flags;
+	u8 UserPriority;	/* for calculate TKIP MIC using */
+};
 
 #define RX_BLK_SET_FLAG(_pRxBlk, _flag)		(_pRxBlk->Flags |= _flag)
 #define RX_BLK_TEST_FLAG(_pRxBlk, _flag)	(_pRxBlk->Flags & _flag)
 #define RX_BLK_CLEAR_FLAG(_pRxBlk, _flag)	(_pRxBlk->Flags &= ~(_flag))
 
-
 #define fRX_WDS			0x0001
 #define fRX_AMSDU       0x0002
 #define fRX_ARALINK     0x0004
@@ -3012,6 +2199,9 @@ typedef struct _RX_BLK_
 #define LENGTH_ARALINK_SUBFRAMEHEAD	14
 #define LENGTH_ARALINK_HEADER_FIELD	 2
 
+/***************************************************************************
+  *	Tx Path software control block related data structures
+  **************************************************************************/
 #define TX_UNKOWN_FRAME			0x00
 #define TX_MCAST_FRAME			0x01
 #define TX_LEGACY_FRAME			0x02
@@ -3020,114 +2210,65 @@ typedef struct _RX_BLK_
 #define TX_RALINK_FRAME			0x10
 #define TX_FRAG_FRAME			0x20
 
+/*      Currently the sizeof(struct rt_tx_blk) is 148 bytes. */
+struct rt_tx_blk {
+	u8 QueIdx;
+	u8 TxFrameType;	/* Indicate the Transmission type of the all frames in one batch */
+	u8 TotalFrameNum;	/* Total frame number want to send-out in one batch */
+	u16 TotalFragNum;	/* Total frame fragments required in one batch */
+	u16 TotalFrameLen;	/* Total length of all frames want to send-out in one batch */
+
+	struct rt_queue_header TxPacketList;
+	struct rt_mac_table_entry *pMacEntry;	/* NULL: packet with 802.11 RA field is multicast/broadcast address */
+	HTTRANSMIT_SETTING *pTransmit;
+
+	/* Following structure used for the characteristics of a specific packet. */
+	void *pPacket;
+	u8 *pSrcBufHeader;	/* Reference to the head of sk_buff->data */
+	u8 *pSrcBufData;	/* Reference to the sk_buff->data, will changed depends on hanlding progresss */
+	u32 SrcBufLen;		/* Length of packet payload which not including Layer 2 header */
+	u8 *pExtraLlcSnapEncap;	/* NULL means no extra LLC/SNAP is required */
+	u8 HeaderBuf[128];	/* TempBuffer for TX_INFO + TX_WI + 802.11 Header + padding + AMSDU SubHeader + LLC/SNAP */
+	/*RT2870 2.1.0.0 uses only 80 bytes */
+	/*RT3070 2.1.1.0 uses only 96 bytes */
+	/*RT3090 2.1.0.0 uses only 96 bytes */
+	u8 MpduHeaderLen;	/* 802.11 header length NOT including the padding */
+	u8 HdrPadLen;	/* recording Header Padding Length; */
+	u8 apidx;		/* The interface associated to this packet */
+	u8 Wcid;		/* The MAC entry associated to this packet */
+	u8 UserPriority;	/* priority class of packet */
+	u8 FrameGap;		/* what kind of IFS this packet use */
+	u8 MpduReqNum;	/* number of fragments of this frame */
+	u8 TxRate;		/* TODO: Obsoleted? Should change to MCS? */
+	u8 CipherAlg;	/* cipher alogrithm */
+	struct rt_cipher_key *pKey;
+
+	u16 Flags;		/*See following definitions for detail. */
+
+	/*YOU SHOULD NOT TOUCH IT! Following parameters are used for hardware-depended layer. */
+	unsigned long Priv;		/* Hardware specific value saved in here. */
+};
 
-//	Currently the sizeof(TX_BLK) is 148 bytes.
-typedef struct _TX_BLK_
-{
-	UCHAR				QueIdx;
-	UCHAR				TxFrameType;				// Indicate the Transmission type of the all frames in one batch
-	UCHAR				TotalFrameNum;				// Total frame number want to send-out in one batch
-	USHORT				TotalFragNum;				// Total frame fragments required in one batch
-	USHORT				TotalFrameLen;				// Total length of all frames want to send-out in one batch
-
-	QUEUE_HEADER		TxPacketList;
-	MAC_TABLE_ENTRY		*pMacEntry;					// NULL: packet with 802.11 RA field is multicast/broadcast address
-	HTTRANSMIT_SETTING	*pTransmit;
-
-	// Following structure used for the characteristics of a specific packet.
-	PNDIS_PACKET		pPacket;
-	PUCHAR				pSrcBufHeader;				// Reference to the head of sk_buff->data
-	PUCHAR				pSrcBufData;				// Reference to the sk_buff->data, will changed depends on hanlding progresss
-	UINT				SrcBufLen;					// Length of packet payload which not including Layer 2 header
-	PUCHAR				pExtraLlcSnapEncap;			// NULL means no extra LLC/SNAP is required
-	UCHAR				HeaderBuf[80];				// TempBuffer for TX_INFO + TX_WI + 802.11 Header + padding + AMSDU SubHeader + LLC/SNAP
-	UCHAR				MpduHeaderLen;				// 802.11 header length NOT including the padding
-	UCHAR				HdrPadLen;					// recording Header Padding Length;
-	UCHAR				apidx;						// The interface associated to this packet
-	UCHAR				Wcid;						// The MAC entry associated to this packet
-	UCHAR				UserPriority;				// priority class of packet
-	UCHAR				FrameGap;					// what kind of IFS this packet use
-	UCHAR				MpduReqNum;					// number of fragments of this frame
-	UCHAR				TxRate;						// TODO: Obsoleted? Should change to MCS?
-	UCHAR				CipherAlg;					// cipher alogrithm
-	PCIPHER_KEY			pKey;
-
-
-
-	USHORT				Flags;						//See following definitions for detail.
-
-	//YOU SHOULD NOT TOUCH IT! Following parameters are used for hardware-depended layer.
-	ULONG				Priv;						// Hardware specific value saved in here.
-} TX_BLK, *PTX_BLK;
-
-
-#define fTX_bRtsRequired		0x0001	// Indicate if need send RTS frame for protection. Not used in RT2860/RT2870.
-#define fTX_bAckRequired       	0x0002	// the packet need ack response
-#define fTX_bPiggyBack     		0x0004	// Legacy device use Piggback or not
-#define fTX_bHTRate         	0x0008	// allow to use HT rate
-#define fTX_bForceNonQoS       	0x0010	// force to transmit frame without WMM-QoS in HT mode
-#define fTX_bAllowFrag       	0x0020	// allow to fragment the packet, A-MPDU, A-MSDU, A-Ralink is not allowed to fragment
-#define fTX_bMoreData			0x0040	// there are more data packets in PowerSave Queue
-#define fTX_bWMM				0x0080	// QOS Data
-
+#define fTX_bRtsRequired		0x0001	/* Indicate if need send RTS frame for protection. Not used in RT2860/RT2870. */
+#define fTX_bAckRequired       	0x0002	/* the packet need ack response */
+#define fTX_bPiggyBack     		0x0004	/* Legacy device use Piggback or not */
+#define fTX_bHTRate         	0x0008	/* allow to use HT rate */
+#define fTX_bForceNonQoS       	0x0010	/* force to transmit frame without WMM-QoS in HT mode */
+#define fTX_bAllowFrag       	0x0020	/* allow to fragment the packet, A-MPDU, A-MSDU, A-Ralink is not allowed to fragment */
+#define fTX_bMoreData			0x0040	/* there are more data packets in PowerSave Queue */
+#define fTX_bWMM				0x0080	/* QOS Data */
 #define fTX_bClearEAPFrame		0x0100
 
-#define TX_BLK_ASSIGN_FLAG(_pTxBlk, _flag, value)	\
-		do {										\
-			if (value) 								\
-				(_pTxBlk->Flags |= _flag) 			\
-			else 									\
-				(_pTxBlk->Flags &= ~(_flag))		\
-		}while(0)
-
 #define TX_BLK_SET_FLAG(_pTxBlk, _flag)		(_pTxBlk->Flags |= _flag)
 #define TX_BLK_TEST_FLAG(_pTxBlk, _flag)	(((_pTxBlk->Flags & _flag) == _flag) ? 1 : 0)
 #define TX_BLK_CLEAR_FLAG(_pTxBlk, _flag)	(_pTxBlk->Flags &= ~(_flag))
 
-
-
-
-
-//------------------------------------------------------------------------------------------
-
-#ifdef RT2860
-//
-// Enable & Disable NIC interrupt via writing interrupt mask register
-// Since it use ADAPTER structure, it have to be put after structure definition.
-//
-__inline    VOID    NICDisableInterrupt(
-    IN  PRTMP_ADAPTER   pAd)
-{
-	RTMP_IO_WRITE32(pAd, INT_MASK_CSR, 0x0);     // 0: disable
-	//RTMP_IO_WRITE32(pAd, PBF_INT_ENA, 0x0);	 	// 0x418 is for firmware . SW doesn't handle here.
-	RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_INTERRUPT_ACTIVE);
-}
-
-__inline    VOID    NICEnableInterrupt(
-    IN  PRTMP_ADAPTER   pAd)
-{
-	//
-	// Flag "fOP_STATUS_DOZE" On, means ASIC put to sleep, else means ASIC WakeUp
-	// To prevent System hang, we should enalbe the interrupt when
-	// ASIC is already Wake Up.
-	//
-    // RT2661 => when ASIC is sleeping, MAC register cannot be read and written.
-	// RT2860 => when ASIC is sleeping, MAC register can be read and written.
-	//if (!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE))
-	{
-		RTMP_IO_WRITE32(pAd, INT_MASK_CSR, pAd->int_enable_reg /*DELAYINTMASK*/);     // 1:enable
-	}
-	//else
-	//	DBGPRINT(RT_DEBUG_TRACE, ("fOP_STATUS_DOZE !\n"));
-
-	//RTMP_IO_WRITE32(pAd, PBF_INT_ENA, 0x00000030); // 1 : enable
-	RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_INTERRUPT_ACTIVE);
-}
-
-static inline VOID ConvertMulticastIP2MAC(
-	IN PUCHAR pIpAddr,
-	IN PUCHAR *ppMacAddr,
-	IN UINT16 ProtoType)
+/***************************************************************************
+  *	Other static inline function definitions
+  **************************************************************************/
+static inline void ConvertMulticastIP2MAC(u8 *pIpAddr,
+					  u8 ** ppMacAddr,
+					  u16 ProtoType)
 {
 	if (pIpAddr == NULL)
 		return;
@@ -3135,2414 +2276,1450 @@ static inline VOID ConvertMulticastIP2MAC(
 	if (ppMacAddr == NULL || *ppMacAddr == NULL)
 		return;
 
-	switch (ProtoType)
-	{
-		case ETH_P_IPV6:
-//			memset(*ppMacAddr, 0, ETH_LENGTH_OF_ADDRESS);
-			*(*ppMacAddr) = 0x33;
-			*(*ppMacAddr + 1) = 0x33;
-			*(*ppMacAddr + 2) = pIpAddr[12];
-			*(*ppMacAddr + 3) = pIpAddr[13];
-			*(*ppMacAddr + 4) = pIpAddr[14];
-			*(*ppMacAddr + 5) = pIpAddr[15];
-			break;
-
-		case ETH_P_IP:
-		default:
-//			memset(*ppMacAddr, 0, ETH_LENGTH_OF_ADDRESS);
-			*(*ppMacAddr) = 0x01;
-			*(*ppMacAddr + 1) = 0x00;
-			*(*ppMacAddr + 2) = 0x5e;
-			*(*ppMacAddr + 3) = pIpAddr[1] & 0x7f;
-			*(*ppMacAddr + 4) = pIpAddr[2];
-			*(*ppMacAddr + 5) = pIpAddr[3];
-			break;
+	switch (ProtoType) {
+	case ETH_P_IPV6:
+/*                      memset(*ppMacAddr, 0, ETH_LENGTH_OF_ADDRESS); */
+		*(*ppMacAddr) = 0x33;
+		*(*ppMacAddr + 1) = 0x33;
+		*(*ppMacAddr + 2) = pIpAddr[12];
+		*(*ppMacAddr + 3) = pIpAddr[13];
+		*(*ppMacAddr + 4) = pIpAddr[14];
+		*(*ppMacAddr + 5) = pIpAddr[15];
+		break;
+
+	case ETH_P_IP:
+	default:
+/*                      memset(*ppMacAddr, 0, ETH_LENGTH_OF_ADDRESS); */
+		*(*ppMacAddr) = 0x01;
+		*(*ppMacAddr + 1) = 0x00;
+		*(*ppMacAddr + 2) = 0x5e;
+		*(*ppMacAddr + 3) = pIpAddr[1] & 0x7f;
+		*(*ppMacAddr + 4) = pIpAddr[2];
+		*(*ppMacAddr + 5) = pIpAddr[3];
+		break;
 	}
 
 	return;
 }
-#endif /* RT2860 */
-
-//
-//  Private routines in rtmp_init.c
-//
-NDIS_STATUS RTMPAllocAdapterBlock(
-	IN PVOID			handle,
-	OUT PRTMP_ADAPTER   *ppAdapter
-	);
-
-NDIS_STATUS RTMPAllocTxRxRingMemory(
-	IN  PRTMP_ADAPTER   pAd
-	);
-
-NDIS_STATUS	RTMPReadParametersHook(
-	IN	PRTMP_ADAPTER pAd
-	);
-
-VOID RTMPFreeAdapter(
-	IN  PRTMP_ADAPTER   pAd
-	);
-
-NDIS_STATUS NICReadRegParameters(
-	IN  PRTMP_ADAPTER       pAd,
-	IN  NDIS_HANDLE         WrapperConfigurationContext
-	);
-
-#ifdef RT2870
-VOID NICInitRT30xxRFRegisters(
-	IN PRTMP_ADAPTER pAd);
-#endif // RT2870 //
-
-VOID NICReadEEPROMParameters(
-	IN  PRTMP_ADAPTER       pAd,
-	IN	PUCHAR				mac_addr);
-
-VOID NICInitAsicFromEEPROM(
-	IN  PRTMP_ADAPTER       pAd);
-
-VOID NICInitTxRxRingAndBacklogQueue(
-	IN  PRTMP_ADAPTER   pAd);
-
-NDIS_STATUS NICInitializeAdapter(
-	IN  PRTMP_ADAPTER   pAd,
-	IN   BOOLEAN    bHardReset);
-
-NDIS_STATUS NICInitializeAsic(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  BOOLEAN		bHardReset);
-#ifdef RT2860
-VOID NICRestoreBBPValue(
-	IN PRTMP_ADAPTER pAd);
-#endif
-VOID NICIssueReset(
-	IN  PRTMP_ADAPTER   pAd);
 
-VOID RTMPRingCleanUp(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  UCHAR           RingType);
+char *GetPhyMode(int Mode);
+char *GetBW(int BW);
 
-VOID UserCfgInit(
-	IN  PRTMP_ADAPTER   pAd);
+/* */
+/*  Private routines in rtmp_init.c */
+/* */
+int RTMPAllocAdapterBlock(void *handle,
+				  struct rt_rtmp_adapter * * ppAdapter);
 
-VOID NICResetFromError(
-	IN  PRTMP_ADAPTER   pAd);
+int RTMPAllocTxRxRingMemory(struct rt_rtmp_adapter *pAd);
 
-VOID NICEraseFirmware(
-	IN PRTMP_ADAPTER pAd);
+void RTMPFreeAdapter(struct rt_rtmp_adapter *pAd);
 
-NDIS_STATUS NICLoadFirmware(
-	IN  PRTMP_ADAPTER   pAd);
+int NICReadRegParameters(struct rt_rtmp_adapter *pAd,
+				 void *WrapperConfigurationContext);
 
-NDIS_STATUS NICLoadRateSwitchingParams(
-	IN PRTMP_ADAPTER pAd);
+#ifdef RTMP_RF_RW_SUPPORT
+void NICInitRFRegisters(struct rt_rtmp_adapter *pAd);
 
-BOOLEAN NICCheckForHang(
-	IN  PRTMP_ADAPTER   pAd);
+void RtmpChipOpsRFHook(struct rt_rtmp_adapter *pAd);
 
-VOID NICUpdateFifoStaCounters(
-	IN PRTMP_ADAPTER pAd);
+int RT30xxWriteRFRegister(struct rt_rtmp_adapter *pAd,
+				  u8 regID, u8 value);
 
-VOID NICUpdateRawCounters(
-	IN  PRTMP_ADAPTER   pAd);
+int RT30xxReadRFRegister(struct rt_rtmp_adapter *pAd,
+				 u8 regID, u8 *pValue);
+#endif /* RTMP_RF_RW_SUPPORT // */
 
-ULONG	RTMPNotAllZero(
-	IN	PVOID	pSrc1,
-	IN	ULONG	Length);
+void NICReadEEPROMParameters(struct rt_rtmp_adapter *pAd, u8 *mac_addr);
 
-VOID RTMPZeroMemory(
-	IN  PVOID   pSrc,
-	IN  ULONG   Length);
+void NICInitAsicFromEEPROM(struct rt_rtmp_adapter *pAd);
 
-ULONG RTMPCompareMemory(
-	IN  PVOID   pSrc1,
-	IN  PVOID   pSrc2,
-	IN  ULONG   Length);
+int NICInitializeAdapter(struct rt_rtmp_adapter *pAd, IN BOOLEAN bHardReset);
 
-VOID RTMPMoveMemory(
-	OUT PVOID   pDest,
-	IN  PVOID   pSrc,
-	IN  ULONG   Length);
+int NICInitializeAsic(struct rt_rtmp_adapter *pAd, IN BOOLEAN bHardReset);
 
-VOID AtoH(
-	char	*src,
-	UCHAR	*dest,
-	int		destlen);
+void NICIssueReset(struct rt_rtmp_adapter *pAd);
 
-UCHAR BtoH(
-	char ch);
+void RTMPRingCleanUp(struct rt_rtmp_adapter *pAd, u8 RingType);
 
-VOID RTMPPatchMacBbpBug(
-	IN  PRTMP_ADAPTER   pAd);
+void UserCfgInit(struct rt_rtmp_adapter *pAd);
 
-VOID RTMPInitTimer(
-	IN  PRTMP_ADAPTER           pAd,
-	IN  PRALINK_TIMER_STRUCT    pTimer,
-	IN  PVOID                   pTimerFunc,
-	IN	PVOID					pData,
-	IN  BOOLEAN                 Repeat);
+void NICResetFromError(struct rt_rtmp_adapter *pAd);
 
-VOID RTMPSetTimer(
-	IN  PRALINK_TIMER_STRUCT    pTimer,
-	IN  ULONG                   Value);
+int NICLoadFirmware(struct rt_rtmp_adapter *pAd);
 
+void NICEraseFirmware(struct rt_rtmp_adapter *pAd);
 
-VOID RTMPModTimer(
-	IN	PRALINK_TIMER_STRUCT	pTimer,
-	IN	ULONG					Value);
+int NICLoadRateSwitchingParams(struct rt_rtmp_adapter *pAd);
 
-VOID RTMPCancelTimer(
-	IN  PRALINK_TIMER_STRUCT    pTimer,
-	OUT BOOLEAN                 *pCancelled);
-
-VOID RTMPSetLED(
-	IN PRTMP_ADAPTER 	pAd,
-	IN UCHAR			Status);
-
-VOID RTMPSetSignalLED(
-	IN PRTMP_ADAPTER 	pAd,
-	IN NDIS_802_11_RSSI Dbm);
-
-VOID RTMPEnableRxTx(
-	IN PRTMP_ADAPTER	pAd);
-
-//
-// prototype in action.c
-//
-VOID ActionStateMachineInit(
-    IN	PRTMP_ADAPTER	pAd,
-    IN  STATE_MACHINE *S,
-    OUT STATE_MACHINE_FUNC Trans[]);
-
-VOID MlmeADDBAAction(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem);
-
-VOID MlmeDELBAAction(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem);
-
-VOID MlmeDLSAction(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem);
-
-VOID MlmeInvalidAction(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem);
-
-VOID MlmeQOSAction(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem);
-
-VOID PeerAddBAReqAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem);
-
-VOID PeerAddBARspAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem);
-
-VOID PeerDelBAAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem);
-
-VOID PeerBAAction(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem);
-
-VOID SendPSMPAction(
-	IN PRTMP_ADAPTER	pAd,
-	IN UCHAR			Wcid,
-	IN UCHAR			Psmp);
-
-VOID PeerRMAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem);
-
-VOID PeerPublicAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem);
-
-VOID PeerHTAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem);
-
-VOID PeerQOSAction(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem);
-
-VOID RECBATimerTimeout(
-    IN PVOID SystemSpecific1,
-    IN PVOID FunctionContext,
-    IN PVOID SystemSpecific2,
-    IN PVOID SystemSpecific3);
-
-VOID ORIBATimerTimeout(
-	IN	PRTMP_ADAPTER	pAd);
-
-VOID SendRefreshBAR(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	MAC_TABLE_ENTRY	*pEntry);
-
-VOID ActHeaderInit(
-    IN	PRTMP_ADAPTER	pAd,
-    IN OUT PHEADER_802_11 pHdr80211,
-    IN PUCHAR Addr1,
-    IN PUCHAR Addr2,
-    IN PUCHAR Addr3);
-
-VOID BarHeaderInit(
-	IN	PRTMP_ADAPTER	pAd,
-	IN OUT PFRAME_BAR pCntlBar,
-	IN PUCHAR pDA,
-	IN PUCHAR pSA);
-
-VOID InsertActField(
-	IN PRTMP_ADAPTER pAd,
-	OUT PUCHAR pFrameBuf,
-	OUT PULONG pFrameLen,
-	IN UINT8 Category,
-	IN UINT8 ActCode);
-
-BOOLEAN CntlEnqueueForRecv(
-    IN	PRTMP_ADAPTER	pAd,
-	IN ULONG Wcid,
-    IN ULONG MsgLen,
-	IN PFRAME_BA_REQ pMsg);
-
-//
-// Private routines in rtmp_data.c
-//
-BOOLEAN RTMPHandleRxDoneInterrupt(
-	IN  PRTMP_ADAPTER   pAd);
-
-BOOLEAN RTMPHandleTxRingDmaDoneInterrupt(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  INT_SOURCE_CSR_STRUC TxRingBitmap);
-
-VOID RTMPHandleMgmtRingDmaDoneInterrupt(
-	IN  PRTMP_ADAPTER   pAd);
-
-VOID RTMPHandleTBTTInterrupt(
-	IN  PRTMP_ADAPTER   pAd);
-
-VOID RTMPHandlePreTBTTInterrupt(
-	IN  PRTMP_ADAPTER   pAd);
-
-void RTMPHandleTwakeupInterrupt(
-	IN PRTMP_ADAPTER pAd);
-
-VOID	RTMPHandleRxCoherentInterrupt(
-	IN	PRTMP_ADAPTER	pAd);
-
-BOOLEAN TxFrameIsAggregatible(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PUCHAR          pPrevAddr1,
-	IN  PUCHAR          p8023hdr);
-
-BOOLEAN PeerIsAggreOn(
-    IN  PRTMP_ADAPTER   pAd,
-    IN  ULONG          TxRate,
-    IN  PMAC_TABLE_ENTRY pMacEntry);
-
-NDIS_STATUS Sniff2BytesFromNdisBuffer(
-	IN  PNDIS_BUFFER    pFirstBuffer,
-	IN  UCHAR           DesiredOffset,
-	OUT PUCHAR          pByte0,
-	OUT PUCHAR          pByte1);
-
-NDIS_STATUS STASendPacket(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PNDIS_PACKET    pPacket);
-
-VOID STASendPackets(
-	IN  NDIS_HANDLE     MiniportAdapterContext,
-	IN  PPNDIS_PACKET   ppPacketArray,
-	IN  UINT            NumberOfPackets);
-
-VOID RTMPDeQueuePacket(
-	IN  PRTMP_ADAPTER   pAd,
-   	IN	BOOLEAN			bIntContext,
-	IN  UCHAR			QueIdx,
-	IN	UCHAR			Max_Tx_Packets);
-
-NDIS_STATUS	RTMPHardTransmit(
-	IN PRTMP_ADAPTER	pAd,
-	IN PNDIS_PACKET		pPacket,
-	IN  UCHAR			QueIdx,
-	OUT	PULONG			pFreeTXDLeft);
-
-NDIS_STATUS	STAHardTransmit(
-	IN PRTMP_ADAPTER	pAd,
-	IN TX_BLK			*pTxBlk,
-	IN  UCHAR			QueIdx);
-
-VOID STARxEAPOLFrameIndicate(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	MAC_TABLE_ENTRY	*pEntry,
-	IN	RX_BLK			*pRxBlk,
-	IN	UCHAR			FromWhichBSSID);
-
-NDIS_STATUS RTMPFreeTXDRequest(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  UCHAR           RingType,
-	IN  UCHAR           NumberRequired,
-	IN 	PUCHAR          FreeNumberIs);
-
-NDIS_STATUS MlmeHardTransmit(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  UCHAR	QueIdx,
-	IN  PNDIS_PACKET    pPacket);
-
-NDIS_STATUS MlmeHardTransmitMgmtRing(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  UCHAR	QueIdx,
-	IN  PNDIS_PACKET    pPacket);
-
-NDIS_STATUS MlmeHardTransmitTxRing(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  UCHAR	QueIdx,
-	IN  PNDIS_PACKET    pPacket);
-
-USHORT  RTMPCalcDuration(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  UCHAR           Rate,
-	IN  ULONG           Size);
-
-VOID RTMPWriteTxWI(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PTXWI_STRUC		pTxWI,
-	IN  BOOLEAN    		FRAG,
-	IN  BOOLEAN    		CFACK,
-	IN  BOOLEAN    		InsTimestamp,
-	IN	BOOLEAN			AMPDU,
-	IN	BOOLEAN			Ack,
-	IN	BOOLEAN			NSeq,		// HW new a sequence.
-	IN	UCHAR			BASize,
-	IN	UCHAR			WCID,
-	IN	ULONG			Length,
-	IN  UCHAR      		PID,
-	IN	UCHAR			TID,
-	IN	UCHAR			TxRate,
-	IN	UCHAR			Txopmode,
-	IN	BOOLEAN			CfAck,
-	IN	HTTRANSMIT_SETTING	*pTransmit);
-
-
-VOID RTMPWriteTxWI_Data(
-	IN	PRTMP_ADAPTER		pAd,
-	IN	OUT PTXWI_STRUC		pTxWI,
-	IN	TX_BLK				*pTxBlk);
-
-
-VOID RTMPWriteTxWI_Cache(
-	IN	PRTMP_ADAPTER		pAd,
-	IN	OUT PTXWI_STRUC		pTxWI,
-	IN	TX_BLK				*pTxBlk);
-
-VOID RTMPWriteTxDescriptor(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PTXD_STRUC		pTxD,
-	IN	BOOLEAN			bWIV,
-	IN	UCHAR			QSEL);
-
-VOID RTMPSuspendMsduTransmission(
-	IN  PRTMP_ADAPTER   pAd);
-
-VOID RTMPResumeMsduTransmission(
-	IN  PRTMP_ADAPTER   pAd);
-
-NDIS_STATUS MiniportMMRequest(
-	IN  PRTMP_ADAPTER   pAd,
-	IN	UCHAR			QueIdx,
-	IN	PUCHAR			pData,
-	IN  UINT            Length);
-
-VOID RTMPSendNullFrame(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  UCHAR           TxRate,
-	IN	BOOLEAN			bQosNull);
-
-VOID RTMPSendDisassociationFrame(
-	IN	PRTMP_ADAPTER	pAd);
-
-VOID RTMPSendRTSFrame(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PUCHAR          pDA,
-	IN	unsigned int	NextMpduSize,
-	IN  UCHAR           TxRate,
-	IN  UCHAR           RTSRate,
-	IN  USHORT          AckDuration,
-	IN  UCHAR           QueIdx,
-	IN  UCHAR			FrameGap);
-
-PQUEUE_HEADER   RTMPCheckTxSwQueue(
-	IN  PRTMP_ADAPTER   pAd,
-	OUT UCHAR           *QueIdx);
-
-VOID RTMPReportMicError(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PCIPHER_KEY     pWpaKey);
-
-VOID	WpaMicFailureReportFrame(
-	IN  PRTMP_ADAPTER    pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID    WpaDisassocApAndBlockAssoc(
-    IN  PVOID SystemSpecific1,
-    IN  PVOID FunctionContext,
-    IN  PVOID SystemSpecific2,
-    IN  PVOID SystemSpecific3);
-
-NDIS_STATUS RTMPCloneNdisPacket(
-	IN  PRTMP_ADAPTER   pAd,
-	IN	BOOLEAN    pInsAMSDUHdr,
-	IN  PNDIS_PACKET    pInPacket,
-	OUT PNDIS_PACKET   *ppOutPacket);
-
-NDIS_STATUS RTMPAllocateNdisPacket(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PNDIS_PACKET    *pPacket,
-	IN  PUCHAR          pHeader,
-	IN  UINT            HeaderLen,
-	IN  PUCHAR          pData,
-	IN  UINT            DataLen);
-
-VOID RTMPFreeNdisPacket(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PNDIS_PACKET    pPacket);
-
-BOOLEAN RTMPFreeTXDUponTxDmaDone(
-	IN PRTMP_ADAPTER    pAd,
-	IN UCHAR            QueIdx);
-
-BOOLEAN RTMPCheckDHCPFrame(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PNDIS_PACKET	pPacket);
-
-
-BOOLEAN RTMPCheckEtherType(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PNDIS_PACKET	pPacket);
-
-
-//
-// Private routines in rtmp_wep.c
-//
-VOID RTMPInitWepEngine(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PUCHAR          pKey,
-	IN  UCHAR           KeyId,
-	IN  UCHAR           KeyLen,
-	IN  PUCHAR          pDest);
-
-VOID RTMPEncryptData(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PUCHAR          pSrc,
-	IN  PUCHAR          pDest,
-	IN  UINT            Len);
-
-BOOLEAN	RTMPSoftDecryptWEP(
-	IN PRTMP_ADAPTER 	pAd,
-	IN PUCHAR			pData,
-	IN ULONG			DataByteCnt,
-	IN PCIPHER_KEY		pGroupKey);
-
-VOID RTMPSetICV(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PUCHAR          pDest);
-
-VOID ARCFOUR_INIT(
-	IN  PARCFOURCONTEXT Ctx,
-	IN  PUCHAR          pKey,
-	IN  UINT            KeyLen);
-
-UCHAR   ARCFOUR_BYTE(
-	IN  PARCFOURCONTEXT     Ctx);
-
-VOID ARCFOUR_DECRYPT(
-	IN  PARCFOURCONTEXT Ctx,
-	IN  PUCHAR          pDest,
-	IN  PUCHAR          pSrc,
-	IN  UINT            Len);
-
-VOID ARCFOUR_ENCRYPT(
-	IN  PARCFOURCONTEXT Ctx,
-	IN  PUCHAR          pDest,
-	IN  PUCHAR          pSrc,
-	IN  UINT            Len);
-
-VOID WPAARCFOUR_ENCRYPT(
-	IN  PARCFOURCONTEXT Ctx,
-	IN  PUCHAR          pDest,
-	IN  PUCHAR          pSrc,
-	IN  UINT            Len);
-
-UINT RTMP_CALC_FCS32(
-	IN  UINT   Fcs,
-	IN  PUCHAR  Cp,
-	IN  INT     Len);
-
-//
-// MLME routines
-//
-
-// Asic/RF/BBP related functions
-
-VOID AsicAdjustTxPower(
-	IN PRTMP_ADAPTER pAd);
-
-VOID 	AsicUpdateProtect(
-	IN		PRTMP_ADAPTER	pAd,
-	IN 		USHORT			OperaionMode,
-	IN 		UCHAR			SetMask,
-	IN		BOOLEAN			bDisableBGProtect,
-	IN		BOOLEAN			bNonGFExist);
-
-VOID AsicSwitchChannel(
-	IN  PRTMP_ADAPTER   pAd,
-	IN	UCHAR			Channel,
-	IN	BOOLEAN			bScan);
-
-VOID AsicLockChannel(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR Channel) ;
-
-VOID AsicRfTuningExec(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3);
-
-VOID AsicSleepThenAutoWakeup(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  USHORT TbttNumToNextWakeUp);
-
-VOID AsicForceSleep(
-	IN PRTMP_ADAPTER pAd);
-
-VOID AsicForceWakeup(
-	IN PRTMP_ADAPTER pAd,
-#ifdef RT2860
-	IN UCHAR    	 Level);
-#endif
-#ifdef RT2870
-	IN BOOLEAN    bFromTx);
-#endif
+BOOLEAN NICCheckForHang(struct rt_rtmp_adapter *pAd);
 
-VOID AsicSetBssid(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PUCHAR pBssid);
-
-VOID AsicSetMcastWC(
-	IN PRTMP_ADAPTER pAd);
-
-VOID AsicDelWcidTab(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR	Wcid);
-
-VOID AsicEnableRDG(
-	IN PRTMP_ADAPTER pAd);
-
-VOID AsicDisableRDG(
-	IN PRTMP_ADAPTER pAd);
-
-VOID AsicDisableSync(
-	IN  PRTMP_ADAPTER   pAd);
-
-VOID AsicEnableBssSync(
-	IN  PRTMP_ADAPTER   pAd);
-
-VOID AsicEnableIbssSync(
-	IN  PRTMP_ADAPTER   pAd);
-
-VOID AsicSetEdcaParm(
-	IN PRTMP_ADAPTER pAd,
-	IN PEDCA_PARM    pEdcaParm);
-
-VOID AsicSetSlotTime(
-	IN PRTMP_ADAPTER pAd,
-	IN BOOLEAN bUseShortSlotTime);
-
-VOID AsicAddSharedKeyEntry(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR         BssIndex,
-	IN UCHAR         KeyIdx,
-	IN UCHAR         CipherAlg,
-	IN PUCHAR        pKey,
-	IN PUCHAR        pTxMic,
-	IN PUCHAR        pRxMic);
-
-VOID AsicRemoveSharedKeyEntry(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR         BssIndex,
-	IN UCHAR         KeyIdx);
-
-VOID AsicUpdateWCIDAttribute(
-	IN PRTMP_ADAPTER pAd,
-	IN USHORT		WCID,
-	IN UCHAR		BssIndex,
-	IN UCHAR        CipherAlg,
-	IN BOOLEAN		bUsePairewiseKeyTable);
-
-VOID AsicUpdateWCIDIVEIV(
-	IN PRTMP_ADAPTER pAd,
-	IN USHORT		WCID,
-	IN ULONG        uIV,
-	IN ULONG        uEIV);
-
-VOID AsicUpdateRxWCIDTable(
-	IN PRTMP_ADAPTER pAd,
-	IN USHORT		WCID,
-	IN PUCHAR        pAddr);
-
-VOID AsicAddKeyEntry(
-	IN PRTMP_ADAPTER pAd,
-	IN USHORT		WCID,
-	IN UCHAR		BssIndex,
-	IN UCHAR		KeyIdx,
-	IN PCIPHER_KEY	pCipherKey,
-	IN BOOLEAN		bUsePairewiseKeyTable,
-	IN BOOLEAN		bTxKey);
-
-VOID AsicAddPairwiseKeyEntry(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR        pAddr,
-	IN UCHAR		WCID,
-	IN CIPHER_KEY		 *pCipherKey);
-
-VOID AsicRemovePairwiseKeyEntry(
-	IN PRTMP_ADAPTER  pAd,
-	IN UCHAR		 BssIdx,
-	IN UCHAR		 Wcid);
-
-BOOLEAN AsicSendCommandToMcu(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR         Command,
-	IN UCHAR         Token,
-	IN UCHAR         Arg0,
-	IN UCHAR         Arg1);
-#ifdef RT2860
-BOOLEAN AsicCheckCommanOk(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR		 Command);
-#endif
-VOID MacAddrRandomBssid(
-	IN  PRTMP_ADAPTER   pAd,
-	OUT PUCHAR pAddr);
-
-VOID MgtMacHeaderInit(
-	IN  PRTMP_ADAPTER     pAd,
-	IN OUT PHEADER_802_11 pHdr80211,
-	IN UCHAR SubType,
-	IN UCHAR ToDs,
-	IN PUCHAR pDA,
-	IN PUCHAR pBssid);
-
-VOID MlmeRadioOff(
-	IN PRTMP_ADAPTER pAd);
-
-VOID MlmeRadioOn(
-	IN PRTMP_ADAPTER pAd);
-
-
-VOID BssTableInit(
-	IN BSS_TABLE *Tab);
-
-VOID BATableInit(
-	IN PRTMP_ADAPTER pAd,
-    IN BA_TABLE *Tab);
-
-ULONG BssTableSearch(
-	IN BSS_TABLE *Tab,
-	IN PUCHAR pBssid,
-	IN UCHAR Channel);
-
-ULONG BssSsidTableSearch(
-	IN BSS_TABLE *Tab,
-	IN PUCHAR    pBssid,
-	IN PUCHAR    pSsid,
-	IN UCHAR     SsidLen,
-	IN UCHAR     Channel);
-
-ULONG BssTableSearchWithSSID(
-	IN BSS_TABLE *Tab,
-	IN PUCHAR    Bssid,
-	IN PUCHAR    pSsid,
-	IN UCHAR     SsidLen,
-	IN UCHAR     Channel);
-
-VOID BssTableDeleteEntry(
-	IN OUT  PBSS_TABLE pTab,
-	IN      PUCHAR pBssid,
-	IN      UCHAR Channel);
-
-VOID BATableDeleteORIEntry(
-	IN OUT	PRTMP_ADAPTER pAd,
-	IN		BA_ORI_ENTRY	*pBAORIEntry);
-
-VOID  BssEntrySet(
-	IN  PRTMP_ADAPTER   pAd,
-	OUT PBSS_ENTRY pBss,
-	IN PUCHAR pBssid,
-	IN CHAR Ssid[],
-	IN UCHAR SsidLen,
-	IN UCHAR BssType,
-	IN USHORT BeaconPeriod,
-	IN PCF_PARM CfParm,
-	IN USHORT AtimWin,
-	IN USHORT CapabilityInfo,
-	IN UCHAR SupRate[],
-	IN UCHAR SupRateLen,
-	IN UCHAR ExtRate[],
-	IN UCHAR ExtRateLen,
-	IN HT_CAPABILITY_IE *pHtCapability,
-	IN ADD_HT_INFO_IE *pAddHtInfo,	// AP might use this additional ht info IE
-	IN UCHAR			HtCapabilityLen,
-	IN UCHAR			AddHtInfoLen,
-	IN UCHAR			NewExtChanOffset,
-	IN UCHAR Channel,
-	IN CHAR Rssi,
-	IN LARGE_INTEGER TimeStamp,
-	IN UCHAR CkipFlag,
-	IN PEDCA_PARM pEdcaParm,
-	IN PQOS_CAPABILITY_PARM pQosCapability,
-	IN PQBSS_LOAD_PARM pQbssLoad,
-	IN USHORT LengthVIE,
-	IN PNDIS_802_11_VARIABLE_IEs pVIE);
-
-ULONG  BssTableSetEntry(
-	IN  PRTMP_ADAPTER   pAd,
-	OUT PBSS_TABLE pTab,
-	IN PUCHAR pBssid,
-	IN CHAR Ssid[],
-	IN UCHAR SsidLen,
-	IN UCHAR BssType,
-	IN USHORT BeaconPeriod,
-	IN CF_PARM *CfParm,
-	IN USHORT AtimWin,
-	IN USHORT CapabilityInfo,
-	IN UCHAR SupRate[],
-	IN UCHAR SupRateLen,
-	IN UCHAR ExtRate[],
-	IN UCHAR ExtRateLen,
-	IN HT_CAPABILITY_IE *pHtCapability,
-	IN ADD_HT_INFO_IE *pAddHtInfo,	// AP might use this additional ht info IE
-	IN UCHAR			HtCapabilityLen,
-	IN UCHAR			AddHtInfoLen,
-	IN UCHAR			NewExtChanOffset,
-	IN UCHAR Channel,
-	IN CHAR Rssi,
-	IN LARGE_INTEGER TimeStamp,
-	IN UCHAR CkipFlag,
-	IN PEDCA_PARM pEdcaParm,
-	IN PQOS_CAPABILITY_PARM pQosCapability,
-	IN PQBSS_LOAD_PARM pQbssLoad,
-	IN USHORT LengthVIE,
-	IN PNDIS_802_11_VARIABLE_IEs pVIE);
-
-VOID BATableInsertEntry(
-    IN	PRTMP_ADAPTER	pAd,
-	IN USHORT Aid,
-    IN USHORT		TimeOutValue,
-	IN USHORT		StartingSeq,
-    IN UCHAR TID,
-	IN UCHAR BAWinSize,
-	IN UCHAR OriginatorStatus,
-    IN BOOLEAN IsRecipient);
-
-VOID BssTableSsidSort(
-	IN  PRTMP_ADAPTER   pAd,
-	OUT BSS_TABLE *OutTab,
-	IN  CHAR Ssid[],
-	IN  UCHAR SsidLen);
-
-VOID  BssTableSortByRssi(
-	IN OUT BSS_TABLE *OutTab);
-
-VOID BssCipherParse(
-	IN OUT  PBSS_ENTRY  pBss);
-
-NDIS_STATUS  MlmeQueueInit(
-	IN MLME_QUEUE *Queue);
-
-VOID  MlmeQueueDestroy(
-	IN MLME_QUEUE *Queue);
-
-BOOLEAN MlmeEnqueue(
-	IN PRTMP_ADAPTER pAd,
-	IN ULONG Machine,
-	IN ULONG MsgType,
-	IN ULONG MsgLen,
-	IN VOID *Msg);
-
-BOOLEAN MlmeEnqueueForRecv(
-	IN  PRTMP_ADAPTER   pAd,
-	IN ULONG Wcid,
-	IN ULONG TimeStampHigh,
-	IN ULONG TimeStampLow,
-	IN UCHAR Rssi0,
-	IN UCHAR Rssi1,
-	IN UCHAR Rssi2,
-	IN ULONG MsgLen,
-	IN PVOID Msg,
-	IN UCHAR Signal);
-
-
-BOOLEAN MlmeDequeue(
-	IN MLME_QUEUE *Queue,
-	OUT MLME_QUEUE_ELEM **Elem);
-
-VOID    MlmeRestartStateMachine(
-	IN  PRTMP_ADAPTER   pAd);
-
-BOOLEAN  MlmeQueueEmpty(
-	IN MLME_QUEUE *Queue);
-
-BOOLEAN  MlmeQueueFull(
-	IN MLME_QUEUE *Queue);
-
-BOOLEAN  MsgTypeSubst(
-	IN PRTMP_ADAPTER pAd,
-	IN PFRAME_802_11 pFrame,
-	OUT INT *Machine,
-	OUT INT *MsgType);
-
-VOID StateMachineInit(
-	IN STATE_MACHINE *Sm,
-	IN STATE_MACHINE_FUNC Trans[],
-	IN ULONG StNr,
-	IN ULONG MsgNr,
-	IN STATE_MACHINE_FUNC DefFunc,
-	IN ULONG InitState,
-	IN ULONG Base);
-
-VOID StateMachineSetAction(
-	IN STATE_MACHINE *S,
-	IN ULONG St,
-	ULONG Msg,
-	IN STATE_MACHINE_FUNC F);
-
-VOID StateMachinePerformAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN STATE_MACHINE *S,
-	IN MLME_QUEUE_ELEM *Elem);
-
-VOID Drop(
-	IN  PRTMP_ADAPTER   pAd,
-	IN MLME_QUEUE_ELEM *Elem);
-
-VOID AssocStateMachineInit(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  STATE_MACHINE *Sm,
-	OUT STATE_MACHINE_FUNC Trans[]);
-
-VOID ReassocTimeout(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3);
-
-VOID AssocTimeout(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3);
-
-VOID DisassocTimeout(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3);
-
-//----------------------------------------------
-VOID MlmeAssocReqAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID MlmeReassocReqAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID MlmeDisassocReqAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID PeerAssocRspAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID PeerReassocRspAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID PeerDisassocAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID DisassocTimeoutAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID AssocTimeoutAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID  ReassocTimeoutAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID  Cls3errAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PUCHAR pAddr);
-
-VOID SwitchBetweenWepAndCkip(
-	IN PRTMP_ADAPTER pAd);
-
-VOID  InvalidStateWhenAssoc(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID  InvalidStateWhenReassoc(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID InvalidStateWhenDisassociate(
-	IN  PRTMP_ADAPTER pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-#ifdef RT2870
-VOID MlmeCntlConfirm(
-	IN PRTMP_ADAPTER pAd,
-	IN ULONG MsgType,
-	IN USHORT Msg);
-#endif // RT2870 //
-
-VOID  ComposePsPoll(
-	IN  PRTMP_ADAPTER   pAd);
-
-VOID  ComposeNullFrame(
-	IN  PRTMP_ADAPTER pAd);
-
-VOID  AssocPostProc(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PUCHAR pAddr2,
-	IN  USHORT CapabilityInfo,
-	IN  USHORT Aid,
-	IN  UCHAR SupRate[],
-	IN  UCHAR SupRateLen,
-	IN  UCHAR ExtRate[],
-	IN  UCHAR ExtRateLen,
-	IN PEDCA_PARM pEdcaParm,
-	IN HT_CAPABILITY_IE		*pHtCapability,
-	IN  UCHAR HtCapabilityLen,
-	IN ADD_HT_INFO_IE		*pAddHtInfo);
-
-VOID AuthStateMachineInit(
-	IN  PRTMP_ADAPTER   pAd,
-	IN PSTATE_MACHINE sm,
-	OUT STATE_MACHINE_FUNC Trans[]);
-
-VOID AuthTimeout(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3);
-
-VOID MlmeAuthReqAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID PeerAuthRspAtSeq2Action(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID PeerAuthRspAtSeq4Action(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID AuthTimeoutAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID Cls2errAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PUCHAR pAddr);
-
-VOID MlmeDeauthReqAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID InvalidStateWhenAuth(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-//=============================================
-
-VOID AuthRspStateMachineInit(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PSTATE_MACHINE Sm,
-	IN  STATE_MACHINE_FUNC Trans[]);
-
-VOID PeerDeauthAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem);
-
-VOID PeerAuthSimpleRspGenAndSend(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PHEADER_802_11  pHdr80211,
-	IN  USHORT Alg,
-	IN  USHORT Seq,
-	IN  USHORT Reason,
-	IN  USHORT Status);
-
-//
-// Private routines in dls.c
-//
-
-//========================================
-
-VOID SyncStateMachineInit(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  STATE_MACHINE *Sm,
-	OUT STATE_MACHINE_FUNC Trans[]);
-
-VOID BeaconTimeout(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3);
-
-VOID ScanTimeout(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3);
-
-VOID InvalidStateWhenScan(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID InvalidStateWhenJoin(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID InvalidStateWhenStart(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID EnqueueProbeRequest(
-	IN PRTMP_ADAPTER pAd);
-
-BOOLEAN ScanRunning(
-		IN PRTMP_ADAPTER pAd);
-//=========================================
-
-VOID MlmeCntlInit(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  STATE_MACHINE *S,
-	OUT STATE_MACHINE_FUNC Trans[]);
-
-VOID MlmeCntlMachinePerformAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  STATE_MACHINE *S,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID CntlIdleProc(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID CntlOidScanProc(
-	IN  PRTMP_ADAPTER pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID CntlOidSsidProc(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM * Elem);
-
-VOID CntlOidRTBssidProc(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM * Elem);
-
-VOID CntlMlmeRoamingProc(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM * Elem);
-
-VOID CntlWaitDisassocProc(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID CntlWaitJoinProc(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID CntlWaitReassocProc(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID CntlWaitStartProc(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID CntlWaitAuthProc(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID CntlWaitAuthProc2(
-	IN  PRTMP_ADAPTER pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID CntlWaitAssocProc(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID LinkUp(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  UCHAR BssType);
-
-VOID LinkDown(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  BOOLEAN         IsReqFromAP);
-
-VOID IterateOnBssTab(
-	IN  PRTMP_ADAPTER   pAd);
-
-VOID IterateOnBssTab2(
-	IN  PRTMP_ADAPTER   pAd);;
-
-VOID JoinParmFill(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  OUT MLME_JOIN_REQ_STRUCT *JoinReq,
-	IN  ULONG BssIdx);
-
-VOID AssocParmFill(
-	IN  PRTMP_ADAPTER   pAd,
-	IN OUT MLME_ASSOC_REQ_STRUCT *AssocReq,
-	IN  PUCHAR pAddr,
-	IN  USHORT CapabilityInfo,
-	IN  ULONG Timeout,
-	IN  USHORT ListenIntv);
-
-VOID ScanParmFill(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  OUT MLME_SCAN_REQ_STRUCT *ScanReq,
-	IN  CHAR Ssid[],
-	IN  UCHAR SsidLen,
-	IN  UCHAR BssType,
-	IN  UCHAR ScanType);
-
-VOID DisassocParmFill(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  OUT MLME_DISASSOC_REQ_STRUCT *DisassocReq,
-	IN  PUCHAR pAddr,
-	IN  USHORT Reason);
-
-VOID StartParmFill(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  OUT MLME_START_REQ_STRUCT *StartReq,
-	IN  CHAR Ssid[],
-	IN  UCHAR SsidLen);
-
-VOID AuthParmFill(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  OUT MLME_AUTH_REQ_STRUCT *AuthReq,
-	IN  PUCHAR pAddr,
-	IN  USHORT Alg);
-
-VOID EnqueuePsPoll(
-	IN  PRTMP_ADAPTER   pAd);
-
-VOID EnqueueBeaconFrame(
-	IN  PRTMP_ADAPTER   pAd);
-
-VOID MlmeJoinReqAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID MlmeScanReqAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID MlmeStartReqAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID ScanTimeoutAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID BeaconTimeoutAtJoinAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID PeerBeaconAtScanAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID PeerBeaconAtJoinAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID PeerBeacon(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID PeerProbeReqAction(
-	IN  PRTMP_ADAPTER pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID ScanNextChannel(
-	IN  PRTMP_ADAPTER   pAd);
-
-ULONG MakeIbssBeacon(
-	IN  PRTMP_ADAPTER   pAd);
-
-VOID CCXAdjacentAPReport(
-	IN  PRTMP_ADAPTER   pAd);
-
-BOOLEAN MlmeScanReqSanity(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  VOID *Msg,
-	IN  ULONG MsgLen,
-	OUT UCHAR *BssType,
-	OUT CHAR ssid[],
-	OUT UCHAR *SsidLen,
-	OUT UCHAR *ScanType);
-
-BOOLEAN PeerBeaconAndProbeRspSanity(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  VOID *Msg,
-	IN  ULONG MsgLen,
-	IN  UCHAR MsgChannel,
-	OUT PUCHAR pAddr2,
-	OUT PUCHAR pBssid,
-	OUT CHAR Ssid[],
-	OUT UCHAR *pSsidLen,
-	OUT UCHAR *pBssType,
-	OUT USHORT *pBeaconPeriod,
-	OUT UCHAR *pChannel,
-	OUT UCHAR *pNewChannel,
-	OUT LARGE_INTEGER *pTimestamp,
-	OUT CF_PARM *pCfParm,
-	OUT USHORT *pAtimWin,
-	OUT USHORT *pCapabilityInfo,
-	OUT UCHAR *pErp,
-	OUT UCHAR *pDtimCount,
-	OUT UCHAR *pDtimPeriod,
-	OUT UCHAR *pBcastFlag,
-	OUT UCHAR *pMessageToMe,
-	OUT UCHAR SupRate[],
-	OUT UCHAR *pSupRateLen,
-	OUT UCHAR ExtRate[],
-	OUT UCHAR *pExtRateLen,
-	OUT	UCHAR *pCkipFlag,
-	OUT	UCHAR *pAironetCellPowerLimit,
-	OUT PEDCA_PARM       pEdcaParm,
-	OUT PQBSS_LOAD_PARM  pQbssLoad,
-	OUT PQOS_CAPABILITY_PARM pQosCapability,
-	OUT ULONG *pRalinkIe,
-	OUT UCHAR		 *pHtCapabilityLen,
-	OUT UCHAR		 *pPreNHtCapabilityLen,
-	OUT HT_CAPABILITY_IE *pHtCapability,
-	OUT UCHAR		 *AddHtInfoLen,
-	OUT ADD_HT_INFO_IE *AddHtInfo,
-	OUT UCHAR *NewExtChannel,
-	OUT USHORT *LengthVIE,
-	OUT PNDIS_802_11_VARIABLE_IEs pVIE);
-
-BOOLEAN PeerAddBAReqActionSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN VOID *pMsg,
-    IN ULONG MsgLen,
-	OUT PUCHAR pAddr2);
-
-BOOLEAN PeerAddBARspActionSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN VOID *pMsg,
-    IN ULONG MsgLen);
-
-BOOLEAN PeerDelBAActionSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN UCHAR Wcid,
-    IN VOID *pMsg,
-    IN ULONG MsgLen);
-
-BOOLEAN MlmeAssocReqSanity(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  VOID *Msg,
-	IN  ULONG MsgLen,
-	OUT PUCHAR pApAddr,
-	OUT USHORT *CapabilityInfo,
-	OUT ULONG *Timeout,
-	OUT USHORT *ListenIntv);
-
-BOOLEAN MlmeAuthReqSanity(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  VOID *Msg,
-	IN  ULONG MsgLen,
-	OUT PUCHAR pAddr,
-	OUT ULONG *Timeout,
-	OUT USHORT *Alg);
-
-BOOLEAN MlmeStartReqSanity(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  VOID *Msg,
-	IN  ULONG MsgLen,
-	OUT CHAR Ssid[],
-	OUT UCHAR *Ssidlen);
-
-BOOLEAN PeerAuthSanity(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  VOID *Msg,
-	IN  ULONG MsgLen,
-	OUT PUCHAR pAddr,
-	OUT USHORT *Alg,
-	OUT USHORT *Seq,
-	OUT USHORT *Status,
-	OUT CHAR ChlgText[]);
-
-BOOLEAN PeerAssocRspSanity(
-	IN  PRTMP_ADAPTER   pAd,
-    IN VOID *pMsg,
-	IN  ULONG MsgLen,
-	OUT PUCHAR pAddr2,
-	OUT USHORT *pCapabilityInfo,
-	OUT USHORT *pStatus,
-	OUT USHORT *pAid,
-	OUT UCHAR SupRate[],
-	OUT UCHAR *pSupRateLen,
-	OUT UCHAR ExtRate[],
-	OUT UCHAR *pExtRateLen,
-    OUT HT_CAPABILITY_IE		*pHtCapability,
-    OUT ADD_HT_INFO_IE		*pAddHtInfo,	// AP might use this additional ht info IE
-    OUT UCHAR			*pHtCapabilityLen,
-    OUT UCHAR			*pAddHtInfoLen,
-    OUT UCHAR			*pNewExtChannelOffset,
-	OUT PEDCA_PARM pEdcaParm,
-	OUT UCHAR *pCkipFlag);
-
-BOOLEAN PeerDisassocSanity(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  VOID *Msg,
-	IN  ULONG MsgLen,
-	OUT PUCHAR pAddr2,
-	OUT USHORT *Reason);
-
-BOOLEAN PeerDeauthSanity(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  VOID *Msg,
-	IN  ULONG MsgLen,
-	OUT PUCHAR pAddr2,
-	OUT USHORT *Reason);
-
-BOOLEAN PeerProbeReqSanity(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  VOID *Msg,
-	IN  ULONG MsgLen,
-	OUT PUCHAR pAddr2,
-	OUT CHAR Ssid[],
-	OUT UCHAR *pSsidLen);
-
-BOOLEAN GetTimBit(
-	IN  CHAR *Ptr,
-	IN  USHORT Aid,
-	OUT UCHAR *TimLen,
-	OUT UCHAR *BcastFlag,
-	OUT UCHAR *DtimCount,
-	OUT UCHAR *DtimPeriod,
-	OUT UCHAR *MessageToMe);
-
-UCHAR ChannelSanity(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR channel);
-
-NDIS_802_11_NETWORK_TYPE NetworkTypeInUseSanity(
-	IN PBSS_ENTRY pBss);
-
-BOOLEAN MlmeDelBAReqSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN VOID *Msg,
-    IN ULONG MsgLen);
-
-BOOLEAN MlmeAddBAReqSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN VOID *Msg,
-    IN ULONG MsgLen,
-    OUT PUCHAR pAddr2);
-
-ULONG MakeOutgoingFrame(
-	OUT CHAR *Buffer,
-	OUT ULONG *Length, ...);
-
-VOID  LfsrInit(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  ULONG Seed);
-
-UCHAR RandomByte(
-	IN  PRTMP_ADAPTER   pAd);
-
-VOID AsicUpdateAutoFallBackTable(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			pTxRate);
-
-VOID  MlmePeriodicExec(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3);
-
-VOID LinkDownExec(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3);
-
-VOID STAMlmePeriodicExec(
-	PRTMP_ADAPTER pAd);
-
-VOID MlmeAutoScan(
-	IN PRTMP_ADAPTER pAd);
-
-VOID MlmeAutoReconnectLastSSID(
-	IN PRTMP_ADAPTER pAd);
-
-BOOLEAN MlmeValidateSSID(
-	IN PUCHAR pSsid,
-	IN UCHAR  SsidLen);
-
-VOID MlmeCheckForRoaming(
-	IN PRTMP_ADAPTER pAd,
-	IN ULONG    Now32);
-
-VOID MlmeCheckForFastRoaming(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  ULONG           Now);
-
-VOID MlmeDynamicTxRateSwitching(
-	IN PRTMP_ADAPTER pAd);
-
-VOID MlmeSetTxRate(
-	IN PRTMP_ADAPTER		pAd,
-	IN PMAC_TABLE_ENTRY		pEntry,
-	IN PRTMP_TX_RATE_SWITCH	pTxRate);
-
-VOID MlmeSelectTxRateTable(
-	IN PRTMP_ADAPTER		pAd,
-	IN PMAC_TABLE_ENTRY		pEntry,
-	IN PUCHAR				*ppTable,
-	IN PUCHAR				pTableSize,
-	IN PUCHAR				pInitTxRateIdx);
-
-VOID MlmeCalculateChannelQuality(
-	IN PRTMP_ADAPTER pAd,
-	IN ULONG Now);
-
-VOID MlmeCheckPsmChange(
-	IN PRTMP_ADAPTER pAd,
-	IN ULONG    Now32);
-
-VOID MlmeSetPsmBit(
-	IN PRTMP_ADAPTER pAd,
-	IN USHORT psm);
-
-VOID MlmeSetTxPreamble(
-	IN PRTMP_ADAPTER pAd,
-	IN USHORT TxPreamble);
-
-VOID UpdateBasicRateBitmap(
-	IN	PRTMP_ADAPTER	pAd);
-
-VOID MlmeUpdateTxRates(
-	IN PRTMP_ADAPTER 	pAd,
-	IN 	BOOLEAN		 	bLinkUp,
-	IN	UCHAR			apidx);
-
-VOID MlmeUpdateHtTxRates(
-	IN PRTMP_ADAPTER 		pAd,
-	IN	UCHAR				apidx);
-
-VOID    RTMPCheckRates(
-	IN      PRTMP_ADAPTER   pAd,
-	IN OUT  UCHAR           SupRate[],
-	IN OUT  UCHAR           *SupRateLen);
-
-BOOLEAN RTMPCheckChannel(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR		CentralChannel,
-	IN UCHAR		Channel);
-
-BOOLEAN 	RTMPCheckHt(
-	IN		PRTMP_ADAPTER	pAd,
-	IN		UCHAR	Wcid,
-	IN OUT	HT_CAPABILITY_IE			*pHtCapability,
-	IN OUT	ADD_HT_INFO_IE			*pAddHtInfo);
-
-VOID StaQuickResponeForRateUpExec(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3);
-
-VOID RTMPUpdateMlmeRate(
-	IN PRTMP_ADAPTER	pAd);
-
-CHAR RTMPMaxRssi(
-	IN PRTMP_ADAPTER	pAd,
-	IN CHAR				Rssi0,
-	IN CHAR				Rssi1,
-	IN CHAR				Rssi2);
-
-VOID AsicSetRxAnt(
-	IN PRTMP_ADAPTER	pAd,
-	IN UCHAR			Ant);
-
-VOID AsicEvaluateRxAnt(
-	IN PRTMP_ADAPTER	pAd);
-
-VOID AsicRxAntEvalTimeout(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3);
-
-VOID APSDPeriodicExec(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3);
-
-BOOLEAN RTMPCheckEntryEnableAutoRateSwitch(
-	IN PRTMP_ADAPTER    pAd,
-	IN PMAC_TABLE_ENTRY	pEntry);
-
-UCHAR RTMPStaFixedTxMode(
-	IN PRTMP_ADAPTER    pAd,
-	IN PMAC_TABLE_ENTRY	pEntry);
-
-VOID RTMPUpdateLegacyTxSetting(
-		UCHAR				fixed_tx_mode,
-		PMAC_TABLE_ENTRY	pEntry);
-
-BOOLEAN RTMPAutoRateSwitchCheck(
-	IN PRTMP_ADAPTER    pAd);
-
-NDIS_STATUS MlmeInit(
-	IN  PRTMP_ADAPTER   pAd);
-
-VOID MlmeHandler(
-	IN  PRTMP_ADAPTER   pAd);
-
-VOID MlmeHalt(
-	IN  PRTMP_ADAPTER   pAd);
-
-VOID MlmeResetRalinkCounters(
-	IN  PRTMP_ADAPTER   pAd);
-
-VOID BuildChannelList(
-	IN PRTMP_ADAPTER pAd);
-
-UCHAR FirstChannel(
-	IN  PRTMP_ADAPTER   pAd);
-
-UCHAR NextChannel(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  UCHAR channel);
-
-VOID ChangeToCellPowerLimit(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR         AironetCellPowerLimit);
-
-USHORT RTMP_EEPROM_READ16(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  USHORT Offset);
-
-VOID RTMP_EEPROM_WRITE16(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  USHORT Offset,
-	IN  USHORT Data);
-
-//
-// Prototypes of function definition in rtmp_tkip.c
-//
-VOID    RTMPInitTkipEngine(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PUCHAR          pTKey,
-	IN  UCHAR           KeyId,
-	IN  PUCHAR          pTA,
-	IN  PUCHAR          pMICKey,
-	IN  PUCHAR          pTSC,
-	OUT PULONG          pIV16,
-	OUT PULONG          pIV32);
-
-VOID    RTMPInitMICEngine(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PUCHAR          pKey,
-	IN  PUCHAR          pDA,
-	IN  PUCHAR          pSA,
-	IN  UCHAR           UserPriority,
-	IN  PUCHAR          pMICKey);
-
-BOOLEAN RTMPTkipCompareMICValue(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PUCHAR          pSrc,
-	IN  PUCHAR          pDA,
-	IN  PUCHAR          pSA,
-	IN  PUCHAR          pMICKey,
-	IN	UCHAR			UserPriority,
-	IN  UINT            Len);
-
-VOID    RTMPCalculateMICValue(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PNDIS_PACKET    pPacket,
-	IN  PUCHAR          pEncap,
-	IN  PCIPHER_KEY     pKey,
-	IN	UCHAR			apidx);
-
-BOOLEAN RTMPTkipCompareMICValueWithLLC(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PUCHAR          pLLC,
-	IN  PUCHAR          pSrc,
-	IN  PUCHAR          pDA,
-	IN  PUCHAR          pSA,
-	IN  PUCHAR          pMICKey,
-	IN  UINT            Len);
-
-VOID    RTMPTkipAppendByte(
-	IN  PTKIP_KEY_INFO  pTkip,
-	IN  UCHAR           uChar);
-
-VOID    RTMPTkipAppend(
-	IN  PTKIP_KEY_INFO  pTkip,
-	IN  PUCHAR          pSrc,
-	IN  UINT            nBytes);
-
-VOID    RTMPTkipGetMIC(
-	IN  PTKIP_KEY_INFO  pTkip);
-
-BOOLEAN RTMPSoftDecryptTKIP(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR	pData,
-	IN ULONG	DataByteCnt,
-	IN UCHAR    UserPriority,
-	IN PCIPHER_KEY	pWpaKey);
-
-BOOLEAN RTMPSoftDecryptAES(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR	pData,
-	IN ULONG	DataByteCnt,
-	IN PCIPHER_KEY	pWpaKey);
-
-//
-// Prototypes of function definition in cmm_info.c
-//
-NDIS_STATUS RTMPWPARemoveKeyProc(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PVOID           pBuf);
-
-VOID    RTMPWPARemoveAllKeys(
-	IN  PRTMP_ADAPTER   pAd);
-
-BOOLEAN RTMPCheckStrPrintAble(
-    IN  CHAR *pInPutStr,
-    IN  UCHAR strLen);
-
-VOID    RTMPSetPhyMode(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  ULONG phymode);
-
-VOID	RTMPUpdateHTIE(
-	IN	RT_HT_CAPABILITY	*pRtHt,
-	IN		UCHAR				*pMcsSet,
-	OUT		HT_CAPABILITY_IE *pHtCapability,
-	OUT		ADD_HT_INFO_IE		*pAddHtInfo);
-
-VOID	RTMPAddWcidAttributeEntry(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			BssIdx,
-	IN 	UCHAR		 	KeyIdx,
-	IN 	UCHAR		 	CipherAlg,
-	IN 	MAC_TABLE_ENTRY *pEntry);
-
-CHAR *GetEncryptType(
-	CHAR enc);
-
-CHAR *GetAuthMode(
-	CHAR auth);
-
-VOID RTMPIoctlGetSiteSurvey(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq);
-
-VOID RTMPIoctlGetMacTable(
-	IN PRTMP_ADAPTER pAd,
-	IN struct iwreq *wrq);
-
-VOID    RTMPAddBSSIDCipher(
-    IN  PRTMP_ADAPTER   pAd,
-	IN	UCHAR	Aid,
-    IN  PNDIS_802_11_KEY    pKey,
-    IN  UCHAR   CipherAlg);
-
-VOID	RTMPSetHT(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	OID_SET_HT_PHYMODE *pHTPhyMode);
-
-VOID	RTMPSetIndividualHT(
-	IN	PRTMP_ADAPTER		pAd,
-	IN	UCHAR				apidx);
-
-VOID RTMPSendWirelessEvent(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	USHORT			Event_flag,
-	IN	PUCHAR 			pAddr,
-	IN  UCHAR			BssIdx,
-	IN	CHAR			Rssi);
-
-//
-// prototype in wpa.c
-//
-BOOLEAN WpaMsgTypeSubst(
-	IN  UCHAR   EAPType,
-	OUT INT		*MsgType);
-
-VOID WpaPskStateMachineInit(
-	IN  PRTMP_ADAPTER       pAd,
-	IN  STATE_MACHINE       *S,
-	OUT STATE_MACHINE_FUNC Trans[]);
-
-VOID WpaEAPOLKeyAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID    WpaPairMsg1Action(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID    WpaPairMsg3Action(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID    WpaGroupMsg1Action(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID    WpaMacHeaderInit(
-	IN      PRTMP_ADAPTER   pAd,
-	IN OUT  PHEADER_802_11  pHdr80211,
-	IN      UCHAR           wep,
-	IN      PUCHAR          pAddr1);
-
-VOID    Wpa2PairMsg1Action(
-    IN  PRTMP_ADAPTER   pAd,
-    IN  MLME_QUEUE_ELEM *Elem);
-
-VOID    Wpa2PairMsg3Action(
-    IN  PRTMP_ADAPTER   pAd,
-    IN  MLME_QUEUE_ELEM *Elem);
-
-BOOLEAN ParseKeyData(
-    IN  PRTMP_ADAPTER   pAd,
-    IN  PUCHAR          pKeyData,
-    IN  UCHAR           KeyDataLen,
-	IN	UCHAR			bPairewise);
-
-VOID    RTMPToWirelessSta(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PUCHAR          pHeader802_3,
-    IN  UINT            HdrLen,
-	IN  PUCHAR          pData,
-    IN  UINT            DataLen,
-    IN	BOOLEAN			is4wayFrame);
-
-VOID    HMAC_SHA1(
-	IN  UCHAR   *text,
-	IN  UINT    text_len,
-	IN  UCHAR   *key,
-	IN  UINT    key_len,
-	IN  UCHAR   *digest);
-
-VOID    PRF(
-	IN  UCHAR   *key,
-	IN  INT     key_len,
-	IN  UCHAR   *prefix,
-	IN  INT     prefix_len,
-	IN  UCHAR   *data,
-	IN  INT     data_len,
-	OUT UCHAR   *output,
-	IN  INT     len);
-
-VOID    CCKMPRF(
-	IN  UCHAR   *key,
-	IN  INT     key_len,
-	IN  UCHAR   *data,
-	IN  INT     data_len,
-	OUT UCHAR   *output,
-	IN  INT     len);
-
-VOID WpaCountPTK(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  UCHAR   *PMK,
-	IN  UCHAR   *ANonce,
-	IN  UCHAR   *AA,
-	IN  UCHAR   *SNonce,
-	IN  UCHAR   *SA,
-	OUT UCHAR   *output,
-	IN  UINT    len);
-
-VOID    GenRandom(
-	IN  PRTMP_ADAPTER   pAd,
-	IN	UCHAR			*macAddr,
-	OUT	UCHAR			*random);
-
-//
-// prototype in aironet.c
-//
-VOID    AironetStateMachineInit(
-	IN  PRTMP_ADAPTER       pAd,
-	IN  STATE_MACHINE       *S,
-	OUT STATE_MACHINE_FUNC  Trans[]);
-
-VOID    AironetMsgAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID    AironetRequestAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID    ChannelLoadRequestAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  UCHAR           Index);
-
-VOID    NoiseHistRequestAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  UCHAR           Index);
-
-VOID    BeaconRequestAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  UCHAR           Index);
-
-VOID    AironetReportAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID    ChannelLoadReportAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  UCHAR           Index);
-
-VOID    NoiseHistReportAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  UCHAR           Index);
-
-VOID    AironetFinalReportAction(
-	IN  PRTMP_ADAPTER   pAd);
-
-VOID    BeaconReportAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  UCHAR           Index);
-
-VOID    AironetAddBeaconReport(
-	IN  PRTMP_ADAPTER       pAd,
-	IN  ULONG               Index,
-	IN  PMLME_QUEUE_ELEM    pElem);
-
-VOID    AironetCreateBeaconReportFromBssTable(
-	IN  PRTMP_ADAPTER       pAd);
-
-CHAR    ConvertToRssi(
-	IN PRTMP_ADAPTER  pAd,
-	IN CHAR				Rssi,
-	IN UCHAR    RssiNumber);
-
-//
-// function prototype in cmm_wpa.c
-//
-BOOLEAN RTMPCheckWPAframe(
-	IN PRTMP_ADAPTER pAd,
-	IN PMAC_TABLE_ENTRY	pEntry,
-	IN PUCHAR 			pData,
-	IN ULONG 			DataByteCount,
-	IN UCHAR			FromWhichBSSID);
-
-VOID AES_GTK_KEY_UNWRAP(
-	IN  UCHAR   *key,
-	OUT UCHAR   *plaintext,
-	IN	UCHAR	c_len,
-	IN  UCHAR   *ciphertext);
-
-VOID RTMPMakeRSNIE(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  UINT            AuthMode,
-	IN  UINT            WepStatus,
-	IN	UCHAR			apidx);
-
-//
-// function prototype in ap_wpa.c
-//
-
-VOID HandleCounterMeasure(
-	IN PRTMP_ADAPTER pAd,
-	IN MAC_TABLE_ENTRY  *pEntry);
+void NICUpdateFifoStaCounters(struct rt_rtmp_adapter *pAd);
+
+void NICUpdateRawCounters(struct rt_rtmp_adapter *pAd);
+
+void RTMPZeroMemory(void *pSrc, unsigned long Length);
+
+unsigned long RTMPCompareMemory(void *pSrc1, void *pSrc2, unsigned long Length);
+
+void RTMPMoveMemory(void *pDest, void *pSrc, unsigned long Length);
+
+void AtoH(char *src, u8 *dest, int destlen);
+
+u8 BtoH(char ch);
+
+void RTMPPatchMacBbpBug(struct rt_rtmp_adapter *pAd);
+
+void RTMPInitTimer(struct rt_rtmp_adapter *pAd,
+		   struct rt_ralink_timer *pTimer,
+		   void *pTimerFunc, void *pData, IN BOOLEAN Repeat);
+
+void RTMPSetTimer(struct rt_ralink_timer *pTimer, unsigned long Value);
+
+void RTMPModTimer(struct rt_ralink_timer *pTimer, unsigned long Value);
+
+void RTMPCancelTimer(struct rt_ralink_timer *pTimer, OUT BOOLEAN * pCancelled);
+
+void RTMPSetLED(struct rt_rtmp_adapter *pAd, u8 Status);
+
+void RTMPSetSignalLED(struct rt_rtmp_adapter *pAd, IN NDIS_802_11_RSSI Dbm);
+
+void RTMPEnableRxTx(struct rt_rtmp_adapter *pAd);
+
+/* */
+/* prototype in action.c */
+/* */
+void ActionStateMachineInit(struct rt_rtmp_adapter *pAd,
+			    struct rt_state_machine *S,
+			    OUT STATE_MACHINE_FUNC Trans[]);
+
+void MlmeADDBAAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void MlmeDELBAAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void MlmeDLSAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void MlmeInvalidAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void MlmeQOSAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void PeerAddBAReqAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void PeerAddBARspAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void PeerDelBAAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void PeerBAAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void SendPSMPAction(struct rt_rtmp_adapter *pAd, u8 Wcid, u8 Psmp);
+
+void PeerRMAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void PeerPublicAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void PeerHTAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void PeerQOSAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void RECBATimerTimeout(void *SystemSpecific1,
+		       void *FunctionContext,
+		       void *SystemSpecific2, void *SystemSpecific3);
+
+void ORIBATimerTimeout(struct rt_rtmp_adapter *pAd);
+
+void SendRefreshBAR(struct rt_rtmp_adapter *pAd, struct rt_mac_table_entry *pEntry);
+
+void ActHeaderInit(struct rt_rtmp_adapter *pAd,
+		   struct rt_header_802_11 * pHdr80211,
+		   u8 *Addr1, u8 *Addr2, u8 *Addr3);
+
+void BarHeaderInit(struct rt_rtmp_adapter *pAd,
+		   struct rt_frame_bar * pCntlBar, u8 *pDA, u8 *pSA);
+
+void InsertActField(struct rt_rtmp_adapter *pAd,
+		    u8 *pFrameBuf,
+		    unsigned long *pFrameLen, u8 Category, u8 ActCode);
+
+BOOLEAN CntlEnqueueForRecv(struct rt_rtmp_adapter *pAd,
+			   unsigned long Wcid,
+			   unsigned long MsgLen, struct rt_frame_ba_req * pMsg);
+
+/* */
+/* Private routines in rtmp_data.c */
+/* */
+BOOLEAN RTMPHandleRxDoneInterrupt(struct rt_rtmp_adapter *pAd);
+
+BOOLEAN RTMPHandleTxRingDmaDoneInterrupt(struct rt_rtmp_adapter *pAd,
+					 INT_SOURCE_CSR_STRUC TxRingBitmap);
+
+void RTMPHandleMgmtRingDmaDoneInterrupt(struct rt_rtmp_adapter *pAd);
+
+void RTMPHandleTBTTInterrupt(struct rt_rtmp_adapter *pAd);
+
+void RTMPHandlePreTBTTInterrupt(struct rt_rtmp_adapter *pAd);
+
+void RTMPHandleTwakeupInterrupt(struct rt_rtmp_adapter *pAd);
+
+void RTMPHandleRxCoherentInterrupt(struct rt_rtmp_adapter *pAd);
+
+BOOLEAN TxFrameIsAggregatible(struct rt_rtmp_adapter *pAd,
+			      u8 *pPrevAddr1, u8 *p8023hdr);
+
+BOOLEAN PeerIsAggreOn(struct rt_rtmp_adapter *pAd,
+		      unsigned long TxRate, struct rt_mac_table_entry *pMacEntry);
+
+int Sniff2BytesFromNdisBuffer(char *pFirstBuffer,
+				      u8 DesiredOffset,
+				      u8 *pByte0, u8 *pByte1);
+
+int STASendPacket(struct rt_rtmp_adapter *pAd, void *pPacket);
+
+void STASendPackets(void *MiniportAdapterContext,
+		    void **ppPacketArray, u32 NumberOfPackets);
+
+void RTMPDeQueuePacket(struct rt_rtmp_adapter *pAd,
+		       IN BOOLEAN bIntContext,
+		       u8 QueIdx, u8 Max_Tx_Packets);
+
+int RTMPHardTransmit(struct rt_rtmp_adapter *pAd,
+			     void *pPacket,
+			     u8 QueIdx, unsigned long *pFreeTXDLeft);
+
+int STAHardTransmit(struct rt_rtmp_adapter *pAd,
+			    struct rt_tx_blk *pTxBlk, u8 QueIdx);
+
+void STARxEAPOLFrameIndicate(struct rt_rtmp_adapter *pAd,
+			     struct rt_mac_table_entry *pEntry,
+			     struct rt_rx_blk *pRxBlk, u8 FromWhichBSSID);
+
+int RTMPFreeTXDRequest(struct rt_rtmp_adapter *pAd,
+			       u8 RingType,
+			       u8 NumberRequired, u8 *FreeNumberIs);
+
+int MlmeHardTransmit(struct rt_rtmp_adapter *pAd,
+			     u8 QueIdx, void *pPacket);
+
+int MlmeHardTransmitMgmtRing(struct rt_rtmp_adapter *pAd,
+				     u8 QueIdx, void *pPacket);
+
+#ifdef RTMP_MAC_PCI
+int MlmeHardTransmitTxRing(struct rt_rtmp_adapter *pAd,
+				   u8 QueIdx, void *pPacket);
+
+int MlmeDataHardTransmit(struct rt_rtmp_adapter *pAd,
+				 u8 QueIdx, void *pPacket);
+
+void RTMPWriteTxDescriptor(struct rt_rtmp_adapter *pAd,
+			   struct rt_txd * pTxD, IN BOOLEAN bWIV, u8 QSEL);
+#endif /* RTMP_MAC_PCI // */
+
+u16 RTMPCalcDuration(struct rt_rtmp_adapter *pAd, u8 Rate, unsigned long Size);
+
+void RTMPWriteTxWI(struct rt_rtmp_adapter *pAd, struct rt_txwi * pTxWI, IN BOOLEAN FRAG, IN BOOLEAN CFACK, IN BOOLEAN InsTimestamp, IN BOOLEAN AMPDU, IN BOOLEAN Ack, IN BOOLEAN NSeq,	/* HW new a sequence. */
+		   u8 BASize,
+		   u8 WCID,
+		   unsigned long Length,
+		   u8 PID,
+		   u8 TID,
+		   u8 TxRate,
+		   u8 Txopmode,
+		   IN BOOLEAN CfAck, IN HTTRANSMIT_SETTING * pTransmit);
+
+void RTMPWriteTxWI_Data(struct rt_rtmp_adapter *pAd,
+			struct rt_txwi * pTxWI, struct rt_tx_blk *pTxBlk);
+
+void RTMPWriteTxWI_Cache(struct rt_rtmp_adapter *pAd,
+			 struct rt_txwi * pTxWI, struct rt_tx_blk *pTxBlk);
+
+void RTMPSuspendMsduTransmission(struct rt_rtmp_adapter *pAd);
+
+void RTMPResumeMsduTransmission(struct rt_rtmp_adapter *pAd);
+
+int MiniportMMRequest(struct rt_rtmp_adapter *pAd,
+			      u8 QueIdx, u8 *pData, u32 Length);
+
+/*+++mark by shiang, now this function merge to MiniportMMRequest() */
+/*---mark by shiang, now this function merge to MiniportMMRequest() */
+
+void RTMPSendNullFrame(struct rt_rtmp_adapter *pAd,
+		       u8 TxRate, IN BOOLEAN bQosNull);
+
+void RTMPSendDisassociationFrame(struct rt_rtmp_adapter *pAd);
+
+void RTMPSendRTSFrame(struct rt_rtmp_adapter *pAd,
+		      u8 *pDA,
+		      IN unsigned int NextMpduSize,
+		      u8 TxRate,
+		      u8 RTSRate,
+		      u16 AckDuration,
+		      u8 QueIdx, u8 FrameGap);
+
+struct rt_queue_header *RTMPCheckTxSwQueue(struct rt_rtmp_adapter *pAd, u8 * QueIdx);
+
+void RTMPReportMicError(struct rt_rtmp_adapter *pAd, struct rt_cipher_key *pWpaKey);
+
+void WpaMicFailureReportFrame(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void WpaDisassocApAndBlockAssoc(void *SystemSpecific1,
+				void *FunctionContext,
+				void *SystemSpecific2,
+				void *SystemSpecific3);
+
+void WpaStaPairwiseKeySetting(struct rt_rtmp_adapter *pAd);
+
+void WpaStaGroupKeySetting(struct rt_rtmp_adapter *pAd);
+
+int RTMPCloneNdisPacket(struct rt_rtmp_adapter *pAd,
+				IN BOOLEAN pInsAMSDUHdr,
+				void *pInPacket,
+				void ** ppOutPacket);
+
+int RTMPAllocateNdisPacket(struct rt_rtmp_adapter *pAd,
+				   void ** pPacket,
+				   u8 *pHeader,
+				   u32 HeaderLen,
+				   u8 *pData, u32 DataLen);
+
+void RTMPFreeNdisPacket(struct rt_rtmp_adapter *pAd, void *pPacket);
+
+BOOLEAN RTMPFreeTXDUponTxDmaDone(struct rt_rtmp_adapter *pAd, u8 QueIdx);
+
+BOOLEAN RTMPCheckDHCPFrame(struct rt_rtmp_adapter *pAd, void *pPacket);
+
+BOOLEAN RTMPCheckEtherType(struct rt_rtmp_adapter *pAd, void *pPacket);
+
+/* */
+/* Private routines in rtmp_wep.c */
+/* */
+void RTMPInitWepEngine(struct rt_rtmp_adapter *pAd,
+		       u8 *pKey,
+		       u8 KeyId, u8 KeyLen, u8 *pDest);
+
+void RTMPEncryptData(struct rt_rtmp_adapter *pAd,
+		     u8 *pSrc, u8 *pDest, u32 Len);
+
+BOOLEAN RTMPSoftDecryptWEP(struct rt_rtmp_adapter *pAd,
+			   u8 *pData,
+			   unsigned long DataByteCnt, struct rt_cipher_key *pGroupKey);
+
+void RTMPSetICV(struct rt_rtmp_adapter *pAd, u8 *pDest);
+
+void ARCFOUR_INIT(struct rt_arcfourcontext *Ctx, u8 *pKey, u32 KeyLen);
+
+u8 ARCFOUR_BYTE(struct rt_arcfourcontext *Ctx);
+
+void ARCFOUR_DECRYPT(struct rt_arcfourcontext *Ctx,
+		     u8 *pDest, u8 *pSrc, u32 Len);
+
+void ARCFOUR_ENCRYPT(struct rt_arcfourcontext *Ctx,
+		     u8 *pDest, u8 *pSrc, u32 Len);
+
+void WPAARCFOUR_ENCRYPT(struct rt_arcfourcontext *Ctx,
+			u8 *pDest, u8 *pSrc, u32 Len);
+
+u32 RTMP_CALC_FCS32(u32 Fcs, u8 *Cp, int Len);
+
+/* */
+/* MLME routines */
+/* */
+
+/* Asic/RF/BBP related functions */
+
+void AsicAdjustTxPower(struct rt_rtmp_adapter *pAd);
+
+void AsicUpdateProtect(struct rt_rtmp_adapter *pAd,
+		       u16 OperaionMode,
+		       u8 SetMask,
+		       IN BOOLEAN bDisableBGProtect, IN BOOLEAN bNonGFExist);
+
+void AsicSwitchChannel(struct rt_rtmp_adapter *pAd,
+		       u8 Channel, IN BOOLEAN bScan);
+
+void AsicLockChannel(struct rt_rtmp_adapter *pAd, u8 Channel);
+
+void AsicRfTuningExec(void *SystemSpecific1,
+		      void *FunctionContext,
+		      void *SystemSpecific2, void *SystemSpecific3);
+
+void AsicResetBBPAgent(struct rt_rtmp_adapter *pAd);
+
+void AsicSleepThenAutoWakeup(struct rt_rtmp_adapter *pAd,
+			     u16 TbttNumToNextWakeUp);
+
+void AsicForceSleep(struct rt_rtmp_adapter *pAd);
+
+void AsicForceWakeup(struct rt_rtmp_adapter *pAd, IN BOOLEAN bFromTx);
+
+void AsicSetBssid(struct rt_rtmp_adapter *pAd, u8 *pBssid);
+
+void AsicSetMcastWC(struct rt_rtmp_adapter *pAd);
+
+void AsicDelWcidTab(struct rt_rtmp_adapter *pAd, u8 Wcid);
+
+void AsicEnableRDG(struct rt_rtmp_adapter *pAd);
+
+void AsicDisableRDG(struct rt_rtmp_adapter *pAd);
+
+void AsicDisableSync(struct rt_rtmp_adapter *pAd);
+
+void AsicEnableBssSync(struct rt_rtmp_adapter *pAd);
+
+void AsicEnableIbssSync(struct rt_rtmp_adapter *pAd);
+
+void AsicSetEdcaParm(struct rt_rtmp_adapter *pAd, struct rt_edca_parm *pEdcaParm);
+
+void AsicSetSlotTime(struct rt_rtmp_adapter *pAd, IN BOOLEAN bUseShortSlotTime);
+
+void AsicAddSharedKeyEntry(struct rt_rtmp_adapter *pAd,
+			   u8 BssIndex,
+			   u8 KeyIdx,
+			   u8 CipherAlg,
+			   u8 *pKey, u8 *pTxMic, u8 *pRxMic);
+
+void AsicRemoveSharedKeyEntry(struct rt_rtmp_adapter *pAd,
+			      u8 BssIndex, u8 KeyIdx);
+
+void AsicUpdateWCIDAttribute(struct rt_rtmp_adapter *pAd,
+			     u16 WCID,
+			     u8 BssIndex,
+			     u8 CipherAlg,
+			     IN BOOLEAN bUsePairewiseKeyTable);
+
+void AsicUpdateWCIDIVEIV(struct rt_rtmp_adapter *pAd,
+			 u16 WCID, unsigned long uIV, unsigned long uEIV);
+
+void AsicUpdateRxWCIDTable(struct rt_rtmp_adapter *pAd,
+			   u16 WCID, u8 *pAddr);
+
+void AsicAddKeyEntry(struct rt_rtmp_adapter *pAd,
+		     u16 WCID,
+		     u8 BssIndex,
+		     u8 KeyIdx,
+		     struct rt_cipher_key *pCipherKey,
+		     IN BOOLEAN bUsePairewiseKeyTable, IN BOOLEAN bTxKey);
+
+void AsicAddPairwiseKeyEntry(struct rt_rtmp_adapter *pAd,
+			     u8 *pAddr,
+			     u8 WCID, struct rt_cipher_key *pCipherKey);
+
+void AsicRemovePairwiseKeyEntry(struct rt_rtmp_adapter *pAd,
+				u8 BssIdx, u8 Wcid);
+
+BOOLEAN AsicSendCommandToMcu(struct rt_rtmp_adapter *pAd,
+			     u8 Command,
+			     u8 Token, u8 Arg0, u8 Arg1);
+
+#ifdef RTMP_MAC_PCI
+BOOLEAN AsicCheckCommanOk(struct rt_rtmp_adapter *pAd, u8 Command);
+#endif /* RTMP_MAC_PCI // */
+
+void MacAddrRandomBssid(struct rt_rtmp_adapter *pAd, u8 *pAddr);
+
+void MgtMacHeaderInit(struct rt_rtmp_adapter *pAd,
+		      struct rt_header_802_11 * pHdr80211,
+		      u8 SubType,
+		      u8 ToDs, u8 *pDA, u8 *pBssid);
+
+void MlmeRadioOff(struct rt_rtmp_adapter *pAd);
+
+void MlmeRadioOn(struct rt_rtmp_adapter *pAd);
+
+void BssTableInit(struct rt_bss_table *Tab);
+
+void BATableInit(struct rt_rtmp_adapter *pAd, struct rt_ba_table *Tab);
+
+unsigned long BssTableSearch(struct rt_bss_table *Tab, u8 *pBssid, u8 Channel);
+
+unsigned long BssSsidTableSearch(struct rt_bss_table *Tab,
+			 u8 *pBssid,
+			 u8 *pSsid, u8 SsidLen, u8 Channel);
+
+unsigned long BssTableSearchWithSSID(struct rt_bss_table *Tab,
+			     u8 *Bssid,
+			     u8 *pSsid,
+			     u8 SsidLen, u8 Channel);
+
+unsigned long BssSsidTableSearchBySSID(struct rt_bss_table *Tab,
+			       u8 *pSsid, u8 SsidLen);
+
+void BssTableDeleteEntry(struct rt_bss_table *pTab,
+			 u8 *pBssid, u8 Channel);
+
+void BATableDeleteORIEntry(struct rt_rtmp_adapter *pAd,
+			   struct rt_ba_ori_entry *pBAORIEntry);
+
+void BssEntrySet(struct rt_rtmp_adapter *pAd, struct rt_bss_entry *pBss, u8 *pBssid, char Ssid[], u8 SsidLen, u8 BssType, u16 BeaconPeriod, struct rt_cf_parm * CfParm, u16 AtimWin, u16 CapabilityInfo, u8 SupRate[], u8 SupRateLen, u8 ExtRate[], u8 ExtRateLen, struct rt_ht_capability_ie * pHtCapability, struct rt_add_ht_info_ie * pAddHtInfo,	/* AP might use this additional ht info IE */
+		 u8 HtCapabilityLen,
+		 u8 AddHtInfoLen,
+		 u8 NewExtChanOffset,
+		 u8 Channel,
+		 char Rssi,
+		 IN LARGE_INTEGER TimeStamp,
+		 u8 CkipFlag,
+		 struct rt_edca_parm *pEdcaParm,
+		 struct rt_qos_capability_parm *pQosCapability,
+		 struct rt_qbss_load_parm *pQbssLoad,
+		 u16 LengthVIE, struct rt_ndis_802_11_variable_ies *pVIE);
+
+unsigned long BssTableSetEntry(struct rt_rtmp_adapter *pAd, struct rt_bss_table *pTab, u8 *pBssid, char Ssid[], u8 SsidLen, u8 BssType, u16 BeaconPeriod, struct rt_cf_parm * CfParm, u16 AtimWin, u16 CapabilityInfo, u8 SupRate[], u8 SupRateLen, u8 ExtRate[], u8 ExtRateLen, struct rt_ht_capability_ie * pHtCapability, struct rt_add_ht_info_ie * pAddHtInfo,	/* AP might use this additional ht info IE */
+		       u8 HtCapabilityLen,
+		       u8 AddHtInfoLen,
+		       u8 NewExtChanOffset,
+		       u8 Channel,
+		       char Rssi,
+		       IN LARGE_INTEGER TimeStamp,
+		       u8 CkipFlag,
+		       struct rt_edca_parm *pEdcaParm,
+		       struct rt_qos_capability_parm *pQosCapability,
+		       struct rt_qbss_load_parm *pQbssLoad,
+		       u16 LengthVIE, struct rt_ndis_802_11_variable_ies *pVIE);
+
+void BATableInsertEntry(struct rt_rtmp_adapter *pAd,
+			u16 Aid,
+			u16 TimeOutValue,
+			u16 StartingSeq,
+			u8 TID,
+			u8 BAWinSize,
+			u8 OriginatorStatus, IN BOOLEAN IsRecipient);
+
+void BssTableSsidSort(struct rt_rtmp_adapter *pAd,
+		      struct rt_bss_table *OutTab, char Ssid[], u8 SsidLen);
+
+void BssTableSortByRssi(struct rt_bss_table *OutTab);
+
+void BssCipherParse(struct rt_bss_entry *pBss);
+
+int MlmeQueueInit(struct rt_mlme_queue *Queue);
+
+void MlmeQueueDestroy(struct rt_mlme_queue *Queue);
+
+BOOLEAN MlmeEnqueue(struct rt_rtmp_adapter *pAd,
+		    unsigned long Machine,
+		    unsigned long MsgType, unsigned long MsgLen, void * Msg);
+
+BOOLEAN MlmeEnqueueForRecv(struct rt_rtmp_adapter *pAd,
+			   unsigned long Wcid,
+			   unsigned long TimeStampHigh,
+			   unsigned long TimeStampLow,
+			   u8 Rssi0,
+			   u8 Rssi1,
+			   u8 Rssi2,
+			   unsigned long MsgLen, void *Msg, u8 Signal);
+
+BOOLEAN MlmeDequeue(struct rt_mlme_queue *Queue, struct rt_mlme_queue_elem ** Elem);
+
+void MlmeRestartStateMachine(struct rt_rtmp_adapter *pAd);
+
+BOOLEAN MlmeQueueEmpty(struct rt_mlme_queue *Queue);
+
+BOOLEAN MlmeQueueFull(struct rt_mlme_queue *Queue);
+
+BOOLEAN MsgTypeSubst(struct rt_rtmp_adapter *pAd,
+		     struct rt_frame_802_11 * pFrame,
+		     int * Machine, int * MsgType);
+
+void StateMachineInit(struct rt_state_machine *Sm,
+		      IN STATE_MACHINE_FUNC Trans[],
+		      unsigned long StNr,
+		      unsigned long MsgNr,
+		      IN STATE_MACHINE_FUNC DefFunc,
+		      unsigned long InitState, unsigned long Base);
+
+void StateMachineSetAction(struct rt_state_machine *S,
+			   unsigned long St, unsigned long Msg, IN STATE_MACHINE_FUNC F);
+
+void StateMachinePerformAction(struct rt_rtmp_adapter *pAd,
+			       struct rt_state_machine *S, struct rt_mlme_queue_elem *Elem);
+
+void Drop(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void AssocStateMachineInit(struct rt_rtmp_adapter *pAd,
+			   struct rt_state_machine *Sm,
+			   OUT STATE_MACHINE_FUNC Trans[]);
+
+void ReassocTimeout(void *SystemSpecific1,
+		    void *FunctionContext,
+		    void *SystemSpecific2, void *SystemSpecific3);
+
+void AssocTimeout(void *SystemSpecific1,
+		  void *FunctionContext,
+		  void *SystemSpecific2, void *SystemSpecific3);
+
+void DisassocTimeout(void *SystemSpecific1,
+		     void *FunctionContext,
+		     void *SystemSpecific2, void *SystemSpecific3);
+
+/*---------------------------------------------- */
+void MlmeAssocReqAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void MlmeReassocReqAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void MlmeDisassocReqAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void PeerAssocRspAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void PeerReassocRspAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void PeerDisassocAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void DisassocTimeoutAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void AssocTimeoutAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void ReassocTimeoutAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void Cls3errAction(struct rt_rtmp_adapter *pAd, u8 *pAddr);
+
+void InvalidStateWhenAssoc(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void InvalidStateWhenReassoc(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void InvalidStateWhenDisassociate(struct rt_rtmp_adapter *pAd,
+				  struct rt_mlme_queue_elem *Elem);
+
+#ifdef RTMP_MAC_USB
+void MlmeCntlConfirm(struct rt_rtmp_adapter *pAd, unsigned long MsgType, u16 Msg);
+#endif /* RTMP_MAC_USB // */
+
+void ComposePsPoll(struct rt_rtmp_adapter *pAd);
+
+void ComposeNullFrame(struct rt_rtmp_adapter *pAd);
+
+void AssocPostProc(struct rt_rtmp_adapter *pAd,
+		   u8 *pAddr2,
+		   u16 CapabilityInfo,
+		   u16 Aid,
+		   u8 SupRate[],
+		   u8 SupRateLen,
+		   u8 ExtRate[],
+		   u8 ExtRateLen,
+		   struct rt_edca_parm *pEdcaParm,
+		   struct rt_ht_capability_ie * pHtCapability,
+		   u8 HtCapabilityLen, struct rt_add_ht_info_ie * pAddHtInfo);
+
+void AuthStateMachineInit(struct rt_rtmp_adapter *pAd,
+			  struct rt_state_machine *sm, OUT STATE_MACHINE_FUNC Trans[]);
+
+void AuthTimeout(void *SystemSpecific1,
+		 void *FunctionContext,
+		 void *SystemSpecific2, void *SystemSpecific3);
+
+void MlmeAuthReqAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void PeerAuthRspAtSeq2Action(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void PeerAuthRspAtSeq4Action(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void AuthTimeoutAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void Cls2errAction(struct rt_rtmp_adapter *pAd, u8 *pAddr);
+
+void MlmeDeauthReqAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void InvalidStateWhenAuth(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+/*============================================= */
+
+void AuthRspStateMachineInit(struct rt_rtmp_adapter *pAd,
+			     struct rt_state_machine *Sm,
+			     IN STATE_MACHINE_FUNC Trans[]);
+
+void PeerDeauthAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void PeerAuthSimpleRspGenAndSend(struct rt_rtmp_adapter *pAd,
+				 struct rt_header_802_11 * pHdr80211,
+				 u16 Alg,
+				 u16 Seq,
+				 u16 Reason, u16 Status);
+
+/* */
+/* Private routines in dls.c */
+/* */
+
+/*======================================== */
+
+void SyncStateMachineInit(struct rt_rtmp_adapter *pAd,
+			  struct rt_state_machine *Sm,
+			  OUT STATE_MACHINE_FUNC Trans[]);
+
+void BeaconTimeout(void *SystemSpecific1,
+		   void *FunctionContext,
+		   void *SystemSpecific2, void *SystemSpecific3);
+
+void ScanTimeout(void *SystemSpecific1,
+		 void *FunctionContext,
+		 void *SystemSpecific2, void *SystemSpecific3);
+
+void InvalidStateWhenScan(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void InvalidStateWhenJoin(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void InvalidStateWhenStart(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void EnqueueProbeRequest(struct rt_rtmp_adapter *pAd);
+
+BOOLEAN ScanRunning(struct rt_rtmp_adapter *pAd);
+/*========================================= */
+
+void MlmeCntlInit(struct rt_rtmp_adapter *pAd,
+		  struct rt_state_machine *S, OUT STATE_MACHINE_FUNC Trans[]);
+
+void MlmeCntlMachinePerformAction(struct rt_rtmp_adapter *pAd,
+				  struct rt_state_machine *S,
+				  struct rt_mlme_queue_elem *Elem);
+
+void CntlIdleProc(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void CntlOidScanProc(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void CntlOidSsidProc(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void CntlOidRTBssidProc(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void CntlMlmeRoamingProc(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void CntlWaitDisassocProc(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void CntlWaitJoinProc(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void CntlWaitReassocProc(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void CntlWaitStartProc(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void CntlWaitAuthProc(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void CntlWaitAuthProc2(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void CntlWaitAssocProc(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void LinkUp(struct rt_rtmp_adapter *pAd, u8 BssType);
+
+void LinkDown(struct rt_rtmp_adapter *pAd, IN BOOLEAN IsReqFromAP);
+
+void IterateOnBssTab(struct rt_rtmp_adapter *pAd);
+
+void IterateOnBssTab2(struct rt_rtmp_adapter *pAd);;
+
+void JoinParmFill(struct rt_rtmp_adapter *pAd,
+		  struct rt_mlme_join_req *JoinReq, unsigned long BssIdx);
+
+void AssocParmFill(struct rt_rtmp_adapter *pAd,
+		   struct rt_mlme_assoc_req *AssocReq,
+		   u8 *pAddr,
+		   u16 CapabilityInfo,
+		   unsigned long Timeout, u16 ListenIntv);
+
+void ScanParmFill(struct rt_rtmp_adapter *pAd,
+		  struct rt_mlme_scan_req *ScanReq,
+		  char Ssid[],
+		  u8 SsidLen, u8 BssType, u8 ScanType);
+
+void DisassocParmFill(struct rt_rtmp_adapter *pAd,
+		      struct rt_mlme_disassoc_req *DisassocReq,
+		      u8 *pAddr, u16 Reason);
+
+void StartParmFill(struct rt_rtmp_adapter *pAd,
+		   struct rt_mlme_start_req *StartReq,
+		   char Ssid[], u8 SsidLen);
+
+void AuthParmFill(struct rt_rtmp_adapter *pAd,
+		  struct rt_mlme_auth_req *AuthReq,
+		  u8 *pAddr, u16 Alg);
+
+void EnqueuePsPoll(struct rt_rtmp_adapter *pAd);
+
+void EnqueueBeaconFrame(struct rt_rtmp_adapter *pAd);
+
+void MlmeJoinReqAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void MlmeScanReqAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void MlmeStartReqAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void ScanTimeoutAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void BeaconTimeoutAtJoinAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void PeerBeaconAtScanAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void PeerBeaconAtJoinAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void PeerBeacon(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void PeerProbeReqAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
+
+void ScanNextChannel(struct rt_rtmp_adapter *pAd);
+
+unsigned long MakeIbssBeacon(struct rt_rtmp_adapter *pAd);
+
+BOOLEAN MlmeScanReqSanity(struct rt_rtmp_adapter *pAd,
+			  void * Msg,
+			  unsigned long MsgLen,
+			  u8 * BssType,
+			  char ssid[],
+			  u8 * SsidLen, u8 * ScanType);
+
+BOOLEAN PeerBeaconAndProbeRspSanity(struct rt_rtmp_adapter *pAd,
+				    void * Msg,
+				    unsigned long MsgLen,
+				    u8 MsgChannel,
+				    u8 *pAddr2,
+				    u8 *pBssid,
+				    char Ssid[],
+				    u8 * pSsidLen,
+				    u8 * pBssType,
+				    u16 * pBeaconPeriod,
+				    u8 * pChannel,
+				    u8 * pNewChannel,
+				    OUT LARGE_INTEGER * pTimestamp,
+				    struct rt_cf_parm * pCfParm,
+				    u16 * pAtimWin,
+				    u16 * pCapabilityInfo,
+				    u8 * pErp,
+				    u8 * pDtimCount,
+				    u8 * pDtimPeriod,
+				    u8 * pBcastFlag,
+				    u8 * pMessageToMe,
+				    u8 SupRate[],
+				    u8 * pSupRateLen,
+				    u8 ExtRate[],
+				    u8 * pExtRateLen,
+				    u8 * pCkipFlag,
+				    u8 * pAironetCellPowerLimit,
+				    struct rt_edca_parm *pEdcaParm,
+				    struct rt_qbss_load_parm *pQbssLoad,
+				    struct rt_qos_capability_parm *pQosCapability,
+				    unsigned long * pRalinkIe,
+				    u8 * pHtCapabilityLen,
+				    u8 * pPreNHtCapabilityLen,
+				    struct rt_ht_capability_ie * pHtCapability,
+				    u8 * AddHtInfoLen,
+				    struct rt_add_ht_info_ie * AddHtInfo,
+				    u8 * NewExtChannel,
+				    u16 * LengthVIE,
+				    struct rt_ndis_802_11_variable_ies *pVIE);
+
+BOOLEAN PeerAddBAReqActionSanity(struct rt_rtmp_adapter *pAd,
+				 void * pMsg,
+				 unsigned long MsgLen, u8 *pAddr2);
+
+BOOLEAN PeerAddBARspActionSanity(struct rt_rtmp_adapter *pAd,
+				 void * pMsg, unsigned long MsgLen);
+
+BOOLEAN PeerDelBAActionSanity(struct rt_rtmp_adapter *pAd,
+			      u8 Wcid, void * pMsg, unsigned long MsgLen);
+
+BOOLEAN MlmeAssocReqSanity(struct rt_rtmp_adapter *pAd,
+			   void * Msg,
+			   unsigned long MsgLen,
+			   u8 *pApAddr,
+			   u16 * CapabilityInfo,
+			   unsigned long * Timeout, u16 * ListenIntv);
+
+BOOLEAN MlmeAuthReqSanity(struct rt_rtmp_adapter *pAd,
+			  void * Msg,
+			  unsigned long MsgLen,
+			  u8 *pAddr,
+			  unsigned long * Timeout, u16 * Alg);
+
+BOOLEAN MlmeStartReqSanity(struct rt_rtmp_adapter *pAd,
+			   void * Msg,
+			   unsigned long MsgLen,
+			   char Ssid[], u8 * Ssidlen);
+
+BOOLEAN PeerAuthSanity(struct rt_rtmp_adapter *pAd,
+		       void * Msg,
+		       unsigned long MsgLen,
+		       u8 *pAddr,
+		       u16 * Alg,
+		       u16 * Seq,
+		       u16 * Status, char ChlgText[]);
+
+BOOLEAN PeerAssocRspSanity(struct rt_rtmp_adapter *pAd, void * pMsg, unsigned long MsgLen, u8 *pAddr2, u16 * pCapabilityInfo, u16 * pStatus, u16 * pAid, u8 SupRate[], u8 * pSupRateLen, u8 ExtRate[], u8 * pExtRateLen, struct rt_ht_capability_ie * pHtCapability, struct rt_add_ht_info_ie * pAddHtInfo,	/* AP might use this additional ht info IE */
+			   u8 * pHtCapabilityLen,
+			   u8 * pAddHtInfoLen,
+			   u8 * pNewExtChannelOffset,
+			   struct rt_edca_parm *pEdcaParm, u8 * pCkipFlag);
+
+BOOLEAN PeerDisassocSanity(struct rt_rtmp_adapter *pAd,
+			   void * Msg,
+			   unsigned long MsgLen,
+			   u8 *pAddr2, u16 * Reason);
+
+BOOLEAN PeerWpaMessageSanity(struct rt_rtmp_adapter *pAd,
+			     struct rt_eapol_packet * pMsg,
+			     unsigned long MsgLen,
+			     u8 MsgType, struct rt_mac_table_entry *pEntry);
+
+BOOLEAN PeerDeauthSanity(struct rt_rtmp_adapter *pAd,
+			 void * Msg,
+			 unsigned long MsgLen,
+			 u8 *pAddr2, u16 * Reason);
+
+BOOLEAN PeerProbeReqSanity(struct rt_rtmp_adapter *pAd,
+			   void * Msg,
+			   unsigned long MsgLen,
+			   u8 *pAddr2,
+			   char Ssid[], u8 * pSsidLen);
+
+BOOLEAN GetTimBit(char * Ptr,
+		  u16 Aid,
+		  u8 * TimLen,
+		  u8 * BcastFlag,
+		  u8 * DtimCount,
+		  u8 * DtimPeriod, u8 * MessageToMe);
+
+u8 ChannelSanity(struct rt_rtmp_adapter *pAd, u8 channel);
+
+NDIS_802_11_NETWORK_TYPE NetworkTypeInUseSanity(struct rt_bss_entry *pBss);
+
+BOOLEAN MlmeDelBAReqSanity(struct rt_rtmp_adapter *pAd,
+			   void * Msg, unsigned long MsgLen);
+
+BOOLEAN MlmeAddBAReqSanity(struct rt_rtmp_adapter *pAd,
+			   void * Msg, unsigned long MsgLen, u8 *pAddr2);
+
+unsigned long MakeOutgoingFrame(u8 * Buffer, unsigned long * Length, ...);
+
+void LfsrInit(struct rt_rtmp_adapter *pAd, unsigned long Seed);
+
+u8 RandomByte(struct rt_rtmp_adapter *pAd);
+
+void AsicUpdateAutoFallBackTable(struct rt_rtmp_adapter *pAd, u8 *pTxRate);
+
+void MlmePeriodicExec(void *SystemSpecific1,
+		      void *FunctionContext,
+		      void *SystemSpecific2, void *SystemSpecific3);
+
+void LinkDownExec(void *SystemSpecific1,
+		  void *FunctionContext,
+		  void *SystemSpecific2, void *SystemSpecific3);
+
+void STAMlmePeriodicExec(struct rt_rtmp_adapter *pAd);
+
+void MlmeAutoScan(struct rt_rtmp_adapter *pAd);
+
+void MlmeAutoReconnectLastSSID(struct rt_rtmp_adapter *pAd);
+
+BOOLEAN MlmeValidateSSID(u8 *pSsid, u8 SsidLen);
+
+void MlmeCheckForRoaming(struct rt_rtmp_adapter *pAd, unsigned long Now32);
+
+BOOLEAN MlmeCheckForFastRoaming(struct rt_rtmp_adapter *pAd);
+
+void MlmeDynamicTxRateSwitching(struct rt_rtmp_adapter *pAd);
+
+void MlmeSetTxRate(struct rt_rtmp_adapter *pAd,
+		   struct rt_mac_table_entry *pEntry, struct rt_rtmp_tx_rate_switch * pTxRate);
+
+void MlmeSelectTxRateTable(struct rt_rtmp_adapter *pAd,
+			   struct rt_mac_table_entry *pEntry,
+			   u8 ** ppTable,
+			   u8 *pTableSize, u8 *pInitTxRateIdx);
+
+void MlmeCalculateChannelQuality(struct rt_rtmp_adapter *pAd,
+				 struct rt_mac_table_entry *pMacEntry, unsigned long Now);
+
+void MlmeCheckPsmChange(struct rt_rtmp_adapter *pAd, unsigned long Now32);
+
+void MlmeSetPsmBit(struct rt_rtmp_adapter *pAd, u16 psm);
+
+void MlmeSetTxPreamble(struct rt_rtmp_adapter *pAd, u16 TxPreamble);
+
+void UpdateBasicRateBitmap(struct rt_rtmp_adapter *pAd);
+
+void MlmeUpdateTxRates(struct rt_rtmp_adapter *pAd,
+		       IN BOOLEAN bLinkUp, u8 apidx);
+
+void MlmeUpdateHtTxRates(struct rt_rtmp_adapter *pAd, u8 apidx);
+
+void RTMPCheckRates(struct rt_rtmp_adapter *pAd,
+		    IN u8 SupRate[], IN u8 * SupRateLen);
+
+BOOLEAN RTMPCheckChannel(struct rt_rtmp_adapter *pAd,
+			 u8 CentralChannel, u8 Channel);
+
+BOOLEAN RTMPCheckHt(struct rt_rtmp_adapter *pAd,
+		    u8 Wcid,
+		    struct rt_ht_capability_ie * pHtCapability,
+		    struct rt_add_ht_info_ie * pAddHtInfo);
+
+void StaQuickResponeForRateUpExec(void *SystemSpecific1,
+				  void *FunctionContext,
+				  void *SystemSpecific2,
+				  void *SystemSpecific3);
+
+void RTMPUpdateMlmeRate(struct rt_rtmp_adapter *pAd);
+
+char RTMPMaxRssi(struct rt_rtmp_adapter *pAd,
+		 char Rssi0, char Rssi1, char Rssi2);
+
+#ifdef RT30xx
+void AsicSetRxAnt(struct rt_rtmp_adapter *pAd, u8 Ant);
+
+void RTMPFilterCalibration(struct rt_rtmp_adapter *pAd);
+
+#ifdef RTMP_EFUSE_SUPPORT
+/*2008/09/11:KH add to support efuse<-- */
+int set_eFuseGetFreeBlockCount_Proc(struct rt_rtmp_adapter *pAd, char *arg);
+
+int set_eFusedump_Proc(struct rt_rtmp_adapter *pAd, char *arg);
+
+void eFusePhysicalReadRegisters(struct rt_rtmp_adapter *pAd,
+				u16 Offset,
+				u16 Length, u16 * pData);
+
+int RtmpEfuseSupportCheck(struct rt_rtmp_adapter *pAd);
+
+void eFuseGetFreeBlockCount(struct rt_rtmp_adapter *pAd, u32 *EfuseFreeBlock);
+
+int eFuse_init(struct rt_rtmp_adapter *pAd);
+/*2008/09/11:KH add to support efuse--> */
+#endif /* RTMP_EFUSE_SUPPORT // */
+
+/* add by johnli, RF power sequence setup */
+void RT30xxLoadRFNormalModeSetup(struct rt_rtmp_adapter *pAd);
+
+void RT30xxLoadRFSleepModeSetup(struct rt_rtmp_adapter *pAd);
+
+void RT30xxReverseRFSleepModeSetup(struct rt_rtmp_adapter *pAd);
+/* end johnli */
+
+#ifdef RT3070
+void NICInitRT3070RFRegisters(struct rt_rtmp_adapter *pAd);
+#endif /* RT3070 // */
+#ifdef RT3090
+void NICInitRT3090RFRegisters(struct rt_rtmp_adapter *pAd);
+#endif /* RT3090 // */
+
+void RT30xxHaltAction(struct rt_rtmp_adapter *pAd);
+
+void RT30xxSetRxAnt(struct rt_rtmp_adapter *pAd, u8 Ant);
+#endif /* RT30xx // */
+
+void AsicEvaluateRxAnt(struct rt_rtmp_adapter *pAd);
+
+void AsicRxAntEvalTimeout(void *SystemSpecific1,
+			  void *FunctionContext,
+			  void *SystemSpecific2, void *SystemSpecific3);
+
+void APSDPeriodicExec(void *SystemSpecific1,
+		      void *FunctionContext,
+		      void *SystemSpecific2, void *SystemSpecific3);
+
+BOOLEAN RTMPCheckEntryEnableAutoRateSwitch(struct rt_rtmp_adapter *pAd,
+					   struct rt_mac_table_entry *pEntry);
+
+u8 RTMPStaFixedTxMode(struct rt_rtmp_adapter *pAd, struct rt_mac_table_entry *pEntry);
+
+void RTMPUpdateLegacyTxSetting(u8 fixed_tx_mode, struct rt_mac_table_entry *pEntry);
+
+BOOLEAN RTMPAutoRateSwitchCheck(struct rt_rtmp_adapter *pAd);
+
+int MlmeInit(struct rt_rtmp_adapter *pAd);
+
+void MlmeHandler(struct rt_rtmp_adapter *pAd);
+
+void MlmeHalt(struct rt_rtmp_adapter *pAd);
+
+void MlmeResetRalinkCounters(struct rt_rtmp_adapter *pAd);
+
+void BuildChannelList(struct rt_rtmp_adapter *pAd);
+
+u8 FirstChannel(struct rt_rtmp_adapter *pAd);
+
+u8 NextChannel(struct rt_rtmp_adapter *pAd, u8 channel);
+
+void ChangeToCellPowerLimit(struct rt_rtmp_adapter *pAd,
+			    u8 AironetCellPowerLimit);
+
+/* */
+/* Prototypes of function definition in rtmp_tkip.c */
+/* */
+void RTMPInitTkipEngine(struct rt_rtmp_adapter *pAd,
+			u8 *pTKey,
+			u8 KeyId,
+			u8 *pTA,
+			u8 *pMICKey,
+			u8 *pTSC, unsigned long *pIV16, unsigned long *pIV32);
+
+void RTMPInitMICEngine(struct rt_rtmp_adapter *pAd,
+		       u8 *pKey,
+		       u8 *pDA,
+		       u8 *pSA, u8 UserPriority, u8 *pMICKey);
+
+BOOLEAN RTMPTkipCompareMICValue(struct rt_rtmp_adapter *pAd,
+				u8 *pSrc,
+				u8 *pDA,
+				u8 *pSA,
+				u8 *pMICKey,
+				u8 UserPriority, u32 Len);
+
+void RTMPCalculateMICValue(struct rt_rtmp_adapter *pAd,
+			   void *pPacket,
+			   u8 *pEncap,
+			   struct rt_cipher_key *pKey, u8 apidx);
+
+void RTMPTkipAppendByte(struct rt_tkip_key_info *pTkip, u8 uChar);
+
+void RTMPTkipAppend(struct rt_tkip_key_info *pTkip, u8 *pSrc, u32 nBytes);
+
+void RTMPTkipGetMIC(struct rt_tkip_key_info *pTkip);
+
+BOOLEAN RTMPSoftDecryptTKIP(struct rt_rtmp_adapter *pAd,
+			    u8 *pData,
+			    unsigned long DataByteCnt,
+			    u8 UserPriority, struct rt_cipher_key *pWpaKey);
+
+BOOLEAN RTMPSoftDecryptAES(struct rt_rtmp_adapter *pAd,
+			   u8 *pData,
+			   unsigned long DataByteCnt, struct rt_cipher_key *pWpaKey);
+
+/* */
+/* Prototypes of function definition in cmm_info.c */
+/* */
+int RT_CfgSetCountryRegion(struct rt_rtmp_adapter *pAd, char *arg, int band);
+
+int RT_CfgSetWirelessMode(struct rt_rtmp_adapter *pAd, char *arg);
+
+int RT_CfgSetShortSlot(struct rt_rtmp_adapter *pAd, char *arg);
+
+int RT_CfgSetWepKey(struct rt_rtmp_adapter *pAd,
+		    char *keyString,
+		    struct rt_cipher_key *pSharedKey, int keyIdx);
+
+int RT_CfgSetWPAPSKKey(struct rt_rtmp_adapter *pAd,
+		       char *keyString,
+		       u8 * pHashStr,
+		       int hashStrLen, u8 *pPMKBuf);
+
+/* */
+/* Prototypes of function definition in cmm_info.c */
+/* */
+void RTMPWPARemoveAllKeys(struct rt_rtmp_adapter *pAd);
+
+void RTMPSetPhyMode(struct rt_rtmp_adapter *pAd, unsigned long phymode);
+
+void RTMPUpdateHTIE(struct rt_ht_capability *pRtHt,
+		    u8 * pMcsSet,
+		    struct rt_ht_capability_ie * pHtCapability,
+		    struct rt_add_ht_info_ie * pAddHtInfo);
+
+void RTMPAddWcidAttributeEntry(struct rt_rtmp_adapter *pAd,
+			       u8 BssIdx,
+			       u8 KeyIdx,
+			       u8 CipherAlg, struct rt_mac_table_entry *pEntry);
+
+char *GetEncryptType(char enc);
+
+char *GetAuthMode(char auth);
+
+void RTMPSetHT(struct rt_rtmp_adapter *pAd, struct rt_oid_set_ht_phymode *pHTPhyMode);
+
+void RTMPSetIndividualHT(struct rt_rtmp_adapter *pAd, u8 apidx);
+
+void RTMPSendWirelessEvent(struct rt_rtmp_adapter *pAd,
+			   u16 Event_flag,
+			   u8 *pAddr, u8 BssIdx, char Rssi);
+
+char ConvertToRssi(struct rt_rtmp_adapter *pAd, char Rssi, u8 RssiNumber);
+
+/*===================================
+	Function prototype in cmm_wpa.c
+  =================================== */
+void RTMPToWirelessSta(struct rt_rtmp_adapter *pAd,
+		       struct rt_mac_table_entry *pEntry,
+		       u8 *pHeader802_3,
+		       u32 HdrLen,
+		       u8 *pData,
+		       u32 DataLen, IN BOOLEAN bClearFrame);
+
+void WpaDerivePTK(struct rt_rtmp_adapter *pAd,
+		  u8 * PMK,
+		  u8 * ANonce,
+		  u8 * AA,
+		  u8 * SNonce,
+		  u8 * SA, u8 * output, u32 len);
+
+void GenRandom(struct rt_rtmp_adapter *pAd, u8 * macAddr, u8 * random);
+
+BOOLEAN RTMPCheckWPAframe(struct rt_rtmp_adapter *pAd,
+			  struct rt_mac_table_entry *pEntry,
+			  u8 *pData,
+			  unsigned long DataByteCount, u8 FromWhichBSSID);
+
+void AES_GTK_KEY_UNWRAP(u8 * key,
+			u8 * plaintext,
+			u32 c_len, u8 * ciphertext);
+
+BOOLEAN RTMPParseEapolKeyData(struct rt_rtmp_adapter *pAd,
+			      u8 *pKeyData,
+			      u8 KeyDataLen,
+			      u8 GroupKeyIndex,
+			      u8 MsgType,
+			      IN BOOLEAN bWPA2, struct rt_mac_table_entry *pEntry);
+
+void ConstructEapolMsg(struct rt_mac_table_entry *pEntry,
+		       u8 GroupKeyWepStatus,
+		       u8 MsgType,
+		       u8 DefaultKeyIdx,
+		       u8 * KeyNonce,
+		       u8 * TxRSC,
+		       u8 * GTK,
+		       u8 * RSNIE,
+		       u8 RSNIE_Len, struct rt_eapol_packet * pMsg);
+
+int RTMPSoftDecryptBroadCastData(struct rt_rtmp_adapter *pAd,
+					 struct rt_rx_blk *pRxBlk,
+					 IN NDIS_802_11_ENCRYPTION_STATUS
+					 GroupCipher,
+					 struct rt_cipher_key *pShard_key);
+
+void RTMPMakeRSNIE(struct rt_rtmp_adapter *pAd,
+		   u32 AuthMode, u32 WepStatus, u8 apidx);
+
+/* */
+/* function prototype in ap_wpa.c */
+/* */
+void RTMPGetTxTscFromAsic(struct rt_rtmp_adapter *pAd,
+			  u8 apidx, u8 *pTxTsc);
+
+void APInstallPairwiseKey(struct rt_rtmp_adapter *pAd, struct rt_mac_table_entry *pEntry);
+
+u32 APValidateRSNIE(struct rt_rtmp_adapter *pAd,
+		     struct rt_mac_table_entry *pEntry,
+		     u8 *pRsnIe, u8 rsnie_len);
+
+void HandleCounterMeasure(struct rt_rtmp_adapter *pAd, struct rt_mac_table_entry *pEntry);
+
+void WPAStart4WayHS(struct rt_rtmp_adapter *pAd,
+		    struct rt_mac_table_entry *pEntry, unsigned long TimeInterval);
+
+void WPAStart2WayGroupHS(struct rt_rtmp_adapter *pAd, struct rt_mac_table_entry *pEntry);
+
+void PeerPairMsg1Action(struct rt_rtmp_adapter *pAd,
+			struct rt_mac_table_entry *pEntry, struct rt_mlme_queue_elem *Elem);
+
+void PeerPairMsg2Action(struct rt_rtmp_adapter *pAd,
+			struct rt_mac_table_entry *pEntry, struct rt_mlme_queue_elem *Elem);
+
+void PeerPairMsg3Action(struct rt_rtmp_adapter *pAd,
+			struct rt_mac_table_entry *pEntry, struct rt_mlme_queue_elem *Elem);
+
+void PeerPairMsg4Action(struct rt_rtmp_adapter *pAd,
+			struct rt_mac_table_entry *pEntry, struct rt_mlme_queue_elem *Elem);
+
+void PeerGroupMsg1Action(struct rt_rtmp_adapter *pAd,
+			 struct rt_mac_table_entry *pEntry, struct rt_mlme_queue_elem *Elem);
+
+void PeerGroupMsg2Action(struct rt_rtmp_adapter *pAd,
+			 struct rt_mac_table_entry *pEntry,
+			 void * Msg, u32 MsgLen);
+
+void WpaDeriveGTK(u8 * PMK,
+		  u8 * GNonce,
+		  u8 * AA, u8 * output, u32 len);
+
+void AES_GTK_KEY_WRAP(u8 * key,
+		      u8 * plaintext,
+		      u32 p_len, u8 * ciphertext);
+
+/*typedef void (*TIMER_FUNCTION)(unsigned long); */
 
 /* timeout -- ms */
-VOID RTMP_SetPeriodicTimer(
-	IN	NDIS_MINIPORT_TIMER *pTimer,
-	IN	unsigned long timeout);
-
-VOID RTMP_OS_Init_Timer(
-	IN	PRTMP_ADAPTER pAd,
-	IN	NDIS_MINIPORT_TIMER *pTimer,
-	IN	TIMER_FUNCTION function,
-	IN	PVOID data);
-
-VOID RTMP_OS_Add_Timer(
-	IN	NDIS_MINIPORT_TIMER	*pTimer,
-	IN	unsigned long timeout);
-
-VOID RTMP_OS_Mod_Timer(
-	IN	NDIS_MINIPORT_TIMER	*pTimer,
-	IN	unsigned long timeout);
-
-
-VOID RTMP_OS_Del_Timer(
-	IN	NDIS_MINIPORT_TIMER	*pTimer,
-	OUT	BOOLEAN				 *pCancelled);
-
-
-VOID RTMP_OS_Release_Packet(
-	IN	PRTMP_ADAPTER pAd,
-	IN	PQUEUE_ENTRY  pEntry);
-
-VOID RTMPusecDelay(
-	IN	ULONG	usec);
-
-NDIS_STATUS os_alloc_mem(
-	IN	PRTMP_ADAPTER pAd,
-	OUT	PUCHAR *mem,
-	IN	ULONG  size);
-
-NDIS_STATUS os_free_mem(
-	IN	PRTMP_ADAPTER pAd,
-	IN	PUCHAR mem);
-
-
-void RTMP_AllocateSharedMemory(
-	IN	PRTMP_ADAPTER pAd,
-	IN	ULONG	Length,
-	IN	BOOLEAN	Cached,
-	OUT	PVOID	*VirtualAddress,
-	OUT	PNDIS_PHYSICAL_ADDRESS PhysicalAddress);
-
-VOID RTMPFreeTxRxRingMemory(
-    IN  PRTMP_ADAPTER   pAd);
+void RTMP_SetPeriodicTimer(struct timer_list * pTimer,
+			   IN unsigned long timeout);
 
-NDIS_STATUS AdapterBlockAllocateMemory(
-	IN PVOID	handle,
-	OUT	PVOID	*ppAd);
-
-void RTMP_AllocateTxDescMemory(
-	IN	PRTMP_ADAPTER pAd,
-	IN	UINT	Index,
-	IN	ULONG	Length,
-	IN	BOOLEAN	Cached,
-	OUT	PVOID	*VirtualAddress,
-	OUT	PNDIS_PHYSICAL_ADDRESS PhysicalAddress);
-
-void RTMP_AllocateFirstTxBuffer(
-	IN	PRTMP_ADAPTER pAd,
-	IN	UINT	Index,
-	IN	ULONG	Length,
-	IN	BOOLEAN	Cached,
-	OUT	PVOID	*VirtualAddress,
-	OUT	PNDIS_PHYSICAL_ADDRESS PhysicalAddress);
-
-void RTMP_AllocateMgmtDescMemory(
-	IN	PRTMP_ADAPTER pAd,
-	IN	ULONG	Length,
-	IN	BOOLEAN	Cached,
-	OUT	PVOID	*VirtualAddress,
-	OUT	PNDIS_PHYSICAL_ADDRESS PhysicalAddress);
-
-void RTMP_AllocateRxDescMemory(
-	IN	PRTMP_ADAPTER pAd,
-	IN	ULONG	Length,
-	IN	BOOLEAN	Cached,
-	OUT	PVOID	*VirtualAddress,
-	OUT	PNDIS_PHYSICAL_ADDRESS PhysicalAddress);
-
-PNDIS_PACKET RTMP_AllocateRxPacketBuffer(
-	IN	PRTMP_ADAPTER pAd,
-	IN	ULONG	Length,
-	IN	BOOLEAN	Cached,
-	OUT	PVOID	*VirtualAddress,
-	OUT	PNDIS_PHYSICAL_ADDRESS PhysicalAddress);
-
-PNDIS_PACKET RTMP_AllocateTxPacketBuffer(
-	IN	PRTMP_ADAPTER pAd,
-	IN	ULONG	Length,
-	IN	BOOLEAN	Cached,
-	OUT	PVOID	*VirtualAddress);
-
-PNDIS_PACKET RTMP_AllocateFragPacketBuffer(
-	IN	PRTMP_ADAPTER pAd,
-	IN	ULONG	Length);
-
-void RTMP_QueryPacketInfo(
-	IN  PNDIS_PACKET pPacket,
-	OUT PACKET_INFO  *pPacketInfo,
-	OUT PUCHAR		 *pSrcBufVA,
-	OUT	UINT		 *pSrcBufLen);
+void RTMP_OS_Init_Timer(struct rt_rtmp_adapter *pAd,
+			struct timer_list * pTimer,
+			IN TIMER_FUNCTION function, void *data);
 
-void RTMP_QueryNextPacketInfo(
-	IN  PNDIS_PACKET *ppPacket,
-	OUT PACKET_INFO  *pPacketInfo,
-	OUT PUCHAR		 *pSrcBufVA,
-	OUT	UINT		 *pSrcBufLen);
+void RTMP_OS_Add_Timer(struct timer_list * pTimer,
+		       IN unsigned long timeout);
 
+void RTMP_OS_Mod_Timer(struct timer_list * pTimer,
+		       IN unsigned long timeout);
 
-BOOLEAN RTMP_FillTxBlkInfo(
-	IN RTMP_ADAPTER *pAd,
-	IN TX_BLK *pTxBlk);
+void RTMP_OS_Del_Timer(struct timer_list * pTimer,
+		       OUT BOOLEAN * pCancelled);
 
+void RTMP_OS_Release_Packet(struct rt_rtmp_adapter *pAd, struct rt_queue_entry *pEntry);
 
-PRTMP_SCATTER_GATHER_LIST
-rt_get_sg_list_from_packet(PNDIS_PACKET pPacket, RTMP_SCATTER_GATHER_LIST *sg);
-
-
- void announce_802_3_packet(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PNDIS_PACKET	pPacket);
-
-
-UINT BA_Reorder_AMSDU_Annnounce(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PNDIS_PACKET	pPacket);
-
-PNET_DEV get_netdev_from_bssid(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			FromWhichBSSID);
-
-
-PNDIS_PACKET duplicate_pkt(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			pHeader802_3,
-    IN  UINT            HdrLen,
-	IN	PUCHAR			pData,
-	IN	ULONG			DataSize,
-	IN	UCHAR			FromWhichBSSID);
-
-
-PNDIS_PACKET duplicate_pkt_with_TKIP_MIC(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PNDIS_PACKET	pOldPkt);
-
-void ba_flush_reordering_timeout_mpdus(
-	IN PRTMP_ADAPTER	pAd,
-	IN PBA_REC_ENTRY	pBAEntry,
-	IN ULONG			Now32);
-
-
-VOID BAOriSessionSetUp(
-			IN PRTMP_ADAPTER    pAd,
-			IN MAC_TABLE_ENTRY	*pEntry,
-			IN UCHAR			TID,
-			IN USHORT			TimeOut,
-			IN ULONG			DelayTime,
-			IN BOOLEAN		isForced);
-
-VOID BASessionTearDownALL(
-	IN OUT	PRTMP_ADAPTER pAd,
-	IN		UCHAR Wcid);
+void RTMPusecDelay(unsigned long usec);
 
-BOOLEAN OS_Need_Clone_Packet(void);
+int os_alloc_mem(struct rt_rtmp_adapter *pAd,
+			 u8 ** mem, unsigned long size);
 
+int os_free_mem(struct rt_rtmp_adapter *pAd, void *mem);
 
-VOID build_tx_packet(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PNDIS_PACKET	pPacket,
-	IN	PUCHAR	pFrame,
-	IN	ULONG	FrameLen);
+void RTMP_AllocateSharedMemory(struct rt_rtmp_adapter *pAd,
+			       unsigned long Length,
+			       IN BOOLEAN Cached,
+			       void ** VirtualAddress,
+			       dma_addr_t *PhysicalAddress);
 
+void RTMPFreeTxRxRingMemory(struct rt_rtmp_adapter *pAd);
 
-VOID BAOriSessionTearDown(
-	IN OUT	PRTMP_ADAPTER	pAd,
-	IN		UCHAR			Wcid,
-	IN		UCHAR			TID,
-	IN		BOOLEAN			bPassive,
-	IN		BOOLEAN			bForceSend);
+int AdapterBlockAllocateMemory(void *handle, void ** ppAd);
 
-VOID BARecSessionTearDown(
-	IN OUT	PRTMP_ADAPTER	pAd,
-	IN		UCHAR			Wcid,
-	IN		UCHAR			TID,
-	IN		BOOLEAN			bPassive);
+void RTMP_AllocateTxDescMemory(struct rt_rtmp_adapter *pAd,
+			       u32 Index,
+			       unsigned long Length,
+			       IN BOOLEAN Cached,
+			       void ** VirtualAddress,
+			       dma_addr_t *PhysicalAddress);
 
-BOOLEAN ba_reordering_resource_init(PRTMP_ADAPTER pAd, int num);
-void ba_reordering_resource_release(PRTMP_ADAPTER pAd);
+void RTMP_AllocateFirstTxBuffer(struct rt_rtmp_adapter *pAd,
+				u32 Index,
+				unsigned long Length,
+				IN BOOLEAN Cached,
+				void ** VirtualAddress,
+				dma_addr_t *PhysicalAddress);
 
-BOOLEAN rtstrmactohex(
-	IN char *s1,
-	IN char *s2);
+void RTMP_FreeFirstTxBuffer(struct rt_rtmp_adapter *pAd,
+			    unsigned long Length,
+			    IN BOOLEAN Cached,
+			    void *VirtualAddress,
+			    dma_addr_t PhysicalAddress);
 
-BOOLEAN rtstrcasecmp(
-	IN char *s1,
-	IN char *s2);
+void RTMP_AllocateMgmtDescMemory(struct rt_rtmp_adapter *pAd,
+				 unsigned long Length,
+				 IN BOOLEAN Cached,
+				 void ** VirtualAddress,
+				 dma_addr_t *PhysicalAddress);
 
-char *rtstrstruncasecmp(
-	IN char *s1,
-	IN char *s2);
+void RTMP_AllocateRxDescMemory(struct rt_rtmp_adapter *pAd,
+			       unsigned long Length,
+			       IN BOOLEAN Cached,
+			       void ** VirtualAddress,
+			       dma_addr_t *PhysicalAddress);
 
-char    *rtstrstr(
-	IN	const char * s1,
-	IN	const char * s2);
+void RTMP_FreeDescMemory(struct rt_rtmp_adapter *pAd,
+			 unsigned long Length,
+			 void *VirtualAddress,
+			 dma_addr_t PhysicalAddress);
 
-char *rstrtok(
-	IN char * s,
-	IN const char * ct);
+void *RtmpOSNetPktAlloc(struct rt_rtmp_adapter *pAd, IN int size);
 
-int rtinet_aton(
-	const char *cp,
-	unsigned int *addr);
+void *RTMP_AllocateRxPacketBuffer(struct rt_rtmp_adapter *pAd,
+					 unsigned long Length,
+					 IN BOOLEAN Cached,
+					 void ** VirtualAddress,
+					 OUT dma_addr_t *
+					 PhysicalAddress);
 
-////////// common ioctl functions //////////
-INT Set_DriverVersion_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg);
+void *RTMP_AllocateTxPacketBuffer(struct rt_rtmp_adapter *pAd,
+					 unsigned long Length,
+					 IN BOOLEAN Cached,
+					 void ** VirtualAddress);
 
-INT Set_CountryRegion_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg);
+void *RTMP_AllocateFragPacketBuffer(struct rt_rtmp_adapter *pAd,
+					   unsigned long Length);
 
-INT Set_CountryRegionABand_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg);
+void RTMP_QueryPacketInfo(void *pPacket,
+			  struct rt_packet_info *pPacketInfo,
+			  u8 ** pSrcBufVA, u32 * pSrcBufLen);
 
-INT Set_WirelessMode_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg);
+void RTMP_QueryNextPacketInfo(void ** ppPacket,
+			      struct rt_packet_info *pPacketInfo,
+			      u8 ** pSrcBufVA, u32 * pSrcBufLen);
 
-INT Set_Channel_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg);
+BOOLEAN RTMP_FillTxBlkInfo(struct rt_rtmp_adapter *pAd, struct rt_tx_blk *pTxBlk);
 
-INT	Set_ShortSlot_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg);
+struct rt_rtmp_sg_list *
+rt_get_sg_list_from_packet(void *pPacket, struct rt_rtmp_sg_list *sg);
 
-INT	Set_TxPower_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg);
+void announce_802_3_packet(struct rt_rtmp_adapter *pAd, void *pPacket);
 
-INT Set_BGProtection_Proc(
-	IN  PRTMP_ADAPTER		pAd,
-	IN  PUCHAR			arg);
+u32 BA_Reorder_AMSDU_Annnounce(struct rt_rtmp_adapter *pAd, void *pPacket);
 
-INT Set_TxPreamble_Proc(
-	IN  PRTMP_ADAPTER		pAd,
-	IN  PUCHAR			arg);
+struct net_device *get_netdev_from_bssid(struct rt_rtmp_adapter *pAd, u8 FromWhichBSSID);
 
-INT Set_RTSThreshold_Proc(
-	IN  PRTMP_ADAPTER		pAd,
-	IN  PUCHAR			arg);
+void *duplicate_pkt(struct rt_rtmp_adapter *pAd,
+			   u8 *pHeader802_3,
+			   u32 HdrLen,
+			   u8 *pData,
+			   unsigned long DataSize, u8 FromWhichBSSID);
 
-INT Set_FragThreshold_Proc(
-	IN  PRTMP_ADAPTER		pAd,
-	IN  PUCHAR			arg);
+void *duplicate_pkt_with_TKIP_MIC(struct rt_rtmp_adapter *pAd,
+					 void *pOldPkt);
 
-INT Set_TxBurst_Proc(
-	IN  PRTMP_ADAPTER		pAd,
-	IN  PUCHAR			arg);
+void ba_flush_reordering_timeout_mpdus(struct rt_rtmp_adapter *pAd,
+				       struct rt_ba_rec_entry *pBAEntry,
+				       unsigned long Now32);
 
-#ifdef AGGREGATION_SUPPORT
-INT	Set_PktAggregate_Proc(
-	IN  PRTMP_ADAPTER		pAd,
-	IN  PUCHAR			arg);
-#endif
+void BAOriSessionSetUp(struct rt_rtmp_adapter *pAd,
+		       struct rt_mac_table_entry *pEntry,
+		       u8 TID,
+		       u16 TimeOut,
+		       unsigned long DelayTime, IN BOOLEAN isForced);
 
-INT	Set_IEEE80211H_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg);
+void BASessionTearDownALL(struct rt_rtmp_adapter *pAd, u8 Wcid);
 
-#ifdef DBG
-INT	Set_Debug_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg);
-#endif
+BOOLEAN OS_Need_Clone_Packet(void);
+
+void build_tx_packet(struct rt_rtmp_adapter *pAd,
+		     void *pPacket,
+		     u8 *pFrame, unsigned long FrameLen);
 
-INT	Show_DescInfo_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg);
+void BAOriSessionTearDown(struct rt_rtmp_adapter *pAd,
+			  u8 Wcid,
+			  u8 TID,
+			  IN BOOLEAN bPassive, IN BOOLEAN bForceSend);
 
-INT	Set_ResetStatCounter_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg);
+void BARecSessionTearDown(struct rt_rtmp_adapter *pAd,
+			  u8 Wcid, u8 TID, IN BOOLEAN bPassive);
 
-INT	Set_BASetup_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg);
+BOOLEAN ba_reordering_resource_init(struct rt_rtmp_adapter *pAd, int num);
+void ba_reordering_resource_release(struct rt_rtmp_adapter *pAd);
 
-INT	Set_BADecline_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg);
+char *rstrtok(char *s, IN const char *ct);
 
-INT	Set_BAOriTearDown_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg);
+/*//////// common ioctl functions ////////// */
+int SetCommonHT(struct rt_rtmp_adapter *pAd);
 
-INT	Set_BARecTearDown_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg);
+int WpaCheckEapCode(struct rt_rtmp_adapter *pAd,
+		    u8 *pFrame, u16 FrameLen, u16 OffSet);
 
-INT	Set_HtBw_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg);
+void WpaSendMicFailureToWpaSupplicant(struct rt_rtmp_adapter *pAd,
+				      IN BOOLEAN bUnicast);
 
-INT	Set_HtMcs_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg);
+int wext_notify_event_assoc(struct rt_rtmp_adapter *pAd);
 
-INT	Set_HtGi_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg);
+BOOLEAN STARxDoneInterruptHandle(struct rt_rtmp_adapter *pAd, IN BOOLEAN argc);
 
-INT	Set_HtOpMode_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg);
+/* AMPDU packet indication */
+void Indicate_AMPDU_Packet(struct rt_rtmp_adapter *pAd,
+			   struct rt_rx_blk *pRxBlk, u8 FromWhichBSSID);
 
-INT	Set_HtStbc_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg);
+/* AMSDU packet indication */
+void Indicate_AMSDU_Packet(struct rt_rtmp_adapter *pAd,
+			   struct rt_rx_blk *pRxBlk, u8 FromWhichBSSID);
 
-INT	Set_HtHtc_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg);
+/* Normal legacy Rx packet indication */
+void Indicate_Legacy_Packet(struct rt_rtmp_adapter *pAd,
+			    struct rt_rx_blk *pRxBlk, u8 FromWhichBSSID);
 
-INT	Set_HtExtcha_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg);
+void Indicate_EAPOL_Packet(struct rt_rtmp_adapter *pAd,
+			   struct rt_rx_blk *pRxBlk, u8 FromWhichBSSID);
 
-INT	Set_HtMpduDensity_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg);
+void update_os_packet_info(struct rt_rtmp_adapter *pAd,
+			   struct rt_rx_blk *pRxBlk, u8 FromWhichBSSID);
 
-INT	Set_HtBaWinSize_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg);
+void wlan_802_11_to_802_3_packet(struct rt_rtmp_adapter *pAd,
+				 struct rt_rx_blk *pRxBlk,
+				 u8 *pHeader802_3,
+				 u8 FromWhichBSSID);
 
-INT	Set_HtRdg_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg);
-
-INT	Set_HtLinkAdapt_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg);
-
-INT	Set_HtAmsdu_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg);
-
-INT	Set_HtAutoBa_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg);
-
-INT	Set_HtProtect_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg);
-
-INT	Set_HtMimoPs_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg);
-
-
-INT	Set_ForceShortGI_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg);
-
-INT	Set_ForceGF_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg);
-
-INT	SetCommonHT(
-	IN	PRTMP_ADAPTER	pAd);
-
-INT	Set_SendPSMPAction_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg);
-
-INT	Set_HtMIMOPSmode_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg);
-
-
-INT	Set_HtTxBASize_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg);
-
-INT	    WpaCheckEapCode(
-	IN  PRTMP_ADAPTER   	pAd,
-	IN  PUCHAR				pFrame,
-	IN  USHORT				FrameLen,
-	IN  USHORT				OffSet);
-
-VOID    WpaSendMicFailureToWpaSupplicant(
-    IN  PRTMP_ADAPTER       pAd,
-    IN  BOOLEAN             bUnicast);
-
-int wext_notify_event_assoc(
-	IN  RTMP_ADAPTER *pAd);
-
-BOOLEAN STARxDoneInterruptHandle(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	BOOLEAN			argc);
-
-// AMPDU packet indication
-VOID Indicate_AMPDU_Packet(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	RX_BLK			*pRxBlk,
-	IN	UCHAR			FromWhichBSSID);
-
-// AMSDU packet indication
-VOID Indicate_AMSDU_Packet(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	RX_BLK			*pRxBlk,
-	IN	UCHAR			FromWhichBSSID);
-
-// Normal legacy Rx packet indication
-VOID Indicate_Legacy_Packet(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	RX_BLK			*pRxBlk,
-	IN	UCHAR			FromWhichBSSID);
-
-VOID Indicate_EAPOL_Packet(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	RX_BLK			*pRxBlk,
-	IN	UCHAR			FromWhichBSSID);
-
-void  update_os_packet_info(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	RX_BLK			*pRxBlk,
-	IN	UCHAR			FromWhichBSSID);
-
-void wlan_802_11_to_802_3_packet(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	RX_BLK			*pRxBlk,
-	IN	PUCHAR			pHeader802_3,
-	IN  UCHAR			FromWhichBSSID);
-
-UINT deaggregate_AMSDU_announce(
-	IN	PRTMP_ADAPTER	pAd,
-	PNDIS_PACKET		pPacket,
-	IN	PUCHAR			pData,
-	IN	ULONG			DataSize);
-
-// remove LLC and get 802_3 Header
+/* remove LLC and get 802_3 Header */
 #define  RTMP_802_11_REMOVE_LLC_AND_CONVERT_TO_802_3(_pRxBlk, _pHeader802_3)	\
 {																				\
-	PUCHAR _pRemovedLLCSNAP = NULL, _pDA, _pSA;                                 \
+	u8 *_pRemovedLLCSNAP = NULL, *_pDA, *_pSA;                                 \
 																				\
 	if (RX_BLK_TEST_FLAG(_pRxBlk, fRX_MESH))                                    \
 	{                                                                           \
 		_pDA = _pRxBlk->pHeader->Addr3;                                         \
-		_pSA = (PUCHAR)_pRxBlk->pHeader + sizeof(HEADER_802_11);                \
+		_pSA = (u8 *)_pRxBlk->pHeader + sizeof(struct rt_header_802_11);                \
 	}                                                                           \
 	else                                                                        \
 	{                                                                           \
@@ -5565,133 +3742,122 @@ UINT deaggregate_AMSDU_announce(
 		_pRxBlk->DataSize, _pRemovedLLCSNAP);                                   \
 }
 
-VOID Sta_Announce_or_Forward_802_3_Packet(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PNDIS_PACKET	pPacket,
-	IN	UCHAR			FromWhichBSSID);
+void Sta_Announce_or_Forward_802_3_Packet(struct rt_rtmp_adapter *pAd,
+					  void *pPacket,
+					  u8 FromWhichBSSID);
 
 #define ANNOUNCE_OR_FORWARD_802_3_PACKET(_pAd, _pPacket, _FromWhichBSS)\
 			Sta_Announce_or_Forward_802_3_Packet(_pAd, _pPacket, _FromWhichBSS);
-			//announce_802_3_packet(_pAd, _pPacket);
-
-PNDIS_PACKET DuplicatePacket(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PNDIS_PACKET	pPacket,
-	IN	UCHAR			FromWhichBSSID);
+			/*announce_802_3_packet(_pAd, _pPacket); */
 
+void *DuplicatePacket(struct rt_rtmp_adapter *pAd,
+			     void *pPacket, u8 FromWhichBSSID);
 
-PNDIS_PACKET ClonePacket(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PNDIS_PACKET	pPacket,
-	IN	PUCHAR			pData,
-	IN	ULONG			DataSize);
+void *ClonePacket(struct rt_rtmp_adapter *pAd,
+			 void *pPacket,
+			 u8 *pData, unsigned long DataSize);
 
+/* Normal, AMPDU or AMSDU */
+void CmmRxnonRalinkFrameIndicate(struct rt_rtmp_adapter *pAd,
+				 struct rt_rx_blk *pRxBlk, u8 FromWhichBSSID);
 
-// Normal, AMPDU or AMSDU
-VOID CmmRxnonRalinkFrameIndicate(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	RX_BLK			*pRxBlk,
-	IN	UCHAR			FromWhichBSSID);
+void CmmRxRalinkFrameIndicate(struct rt_rtmp_adapter *pAd,
+			      struct rt_mac_table_entry *pEntry,
+			      struct rt_rx_blk *pRxBlk, u8 FromWhichBSSID);
 
-VOID CmmRxRalinkFrameIndicate(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	MAC_TABLE_ENTRY	*pEntry,
-	IN	RX_BLK			*pRxBlk,
-	IN	UCHAR			FromWhichBSSID);
+void Update_Rssi_Sample(struct rt_rtmp_adapter *pAd,
+			struct rt_rssi_sample *pRssi, struct rt_rxwi * pRxWI);
 
-VOID Update_Rssi_Sample(
-	IN PRTMP_ADAPTER	pAd,
-	IN RSSI_SAMPLE		*pRssi,
-	IN PRXWI_STRUC		pRxWI);
+void *GetPacketFromRxRing(struct rt_rtmp_adapter *pAd,
+				 OUT PRT28XX_RXD_STRUC pSaveRxD,
+				 OUT BOOLEAN * pbReschedule,
+				 IN u32 * pRxPending);
 
-PNDIS_PACKET RTMPDeFragmentDataFrame(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	RX_BLK			*pRxBlk);
+void *RTMPDeFragmentDataFrame(struct rt_rtmp_adapter *pAd, struct rt_rx_blk *pRxBlk);
 
-////////////////////////////////////////
 enum {
-	DIDmsg_lnxind_wlansniffrm		= 0x00000044,
-	DIDmsg_lnxind_wlansniffrm_hosttime	= 0x00010044,
-	DIDmsg_lnxind_wlansniffrm_mactime	= 0x00020044,
-	DIDmsg_lnxind_wlansniffrm_channel	= 0x00030044,
-	DIDmsg_lnxind_wlansniffrm_rssi		= 0x00040044,
-	DIDmsg_lnxind_wlansniffrm_sq		= 0x00050044,
-	DIDmsg_lnxind_wlansniffrm_signal	= 0x00060044,
-	DIDmsg_lnxind_wlansniffrm_noise		= 0x00070044,
-	DIDmsg_lnxind_wlansniffrm_rate		= 0x00080044,
-	DIDmsg_lnxind_wlansniffrm_istx		= 0x00090044,
-	DIDmsg_lnxind_wlansniffrm_frmlen	= 0x000A0044
+	DIDmsg_lnxind_wlansniffrm = 0x00000044,
+	DIDmsg_lnxind_wlansniffrm_hosttime = 0x00010044,
+	DIDmsg_lnxind_wlansniffrm_mactime = 0x00020044,
+	DIDmsg_lnxind_wlansniffrm_channel = 0x00030044,
+	DIDmsg_lnxind_wlansniffrm_rssi = 0x00040044,
+	DIDmsg_lnxind_wlansniffrm_sq = 0x00050044,
+	DIDmsg_lnxind_wlansniffrm_signal = 0x00060044,
+	DIDmsg_lnxind_wlansniffrm_noise = 0x00070044,
+	DIDmsg_lnxind_wlansniffrm_rate = 0x00080044,
+	DIDmsg_lnxind_wlansniffrm_istx = 0x00090044,
+	DIDmsg_lnxind_wlansniffrm_frmlen = 0x000A0044
 };
 enum {
-	P80211ENUM_msgitem_status_no_value	= 0x00
+	P80211ENUM_msgitem_status_no_value = 0x00
 };
 enum {
-	P80211ENUM_truth_false			= 0x00,
-	P80211ENUM_truth_true			= 0x01
+	P80211ENUM_truth_false = 0x00,
+	P80211ENUM_truth_true = 0x01
 };
 
 /* Definition from madwifi */
-typedef struct {
-        UINT32 did;
-        UINT16 status;
-        UINT16 len;
-        UINT32 data;
-} p80211item_uint32_t;
-
-typedef struct {
-        UINT32 msgcode;
-        UINT32 msglen;
+struct rt_p80211item_uint32 {
+	u32 did;
+	u16 status;
+	u16 len;
+	u32 data;
+};
+
+struct rt_wlan_ng_prism2_header {
+	u32 msgcode;
+	u32 msglen;
 #define WLAN_DEVNAMELEN_MAX 16
-        UINT8 devname[WLAN_DEVNAMELEN_MAX];
-        p80211item_uint32_t hosttime;
-        p80211item_uint32_t mactime;
-        p80211item_uint32_t channel;
-        p80211item_uint32_t rssi;
-        p80211item_uint32_t sq;
-        p80211item_uint32_t signal;
-        p80211item_uint32_t noise;
-        p80211item_uint32_t rate;
-        p80211item_uint32_t istx;
-        p80211item_uint32_t frmlen;
-} wlan_ng_prism2_header;
+	u8 devname[WLAN_DEVNAMELEN_MAX];
+	struct rt_p80211item_uint32 hosttime;
+	struct rt_p80211item_uint32 mactime;
+	struct rt_p80211item_uint32 channel;
+	struct rt_p80211item_uint32 rssi;
+	struct rt_p80211item_uint32 sq;
+	struct rt_p80211item_uint32 signal;
+	struct rt_p80211item_uint32 noise;
+	struct rt_p80211item_uint32 rate;
+	struct rt_p80211item_uint32 istx;
+	struct rt_p80211item_uint32 frmlen;
+};
 
 /* The radio capture header precedes the 802.11 header. */
-typedef struct PACKED _ieee80211_radiotap_header {
-    UINT8	it_version;	/* Version 0. Only increases
+struct PACKED rt_ieee80211_radiotap_header {
+	u8 it_version;	/* Version 0. Only increases
 				 * for drastic changes,
 				 * introduction of compatible
 				 * new fields does not count.
 				 */
-    UINT8	it_pad;
-    UINT16     it_len;         /* length of the whole
+	u8 it_pad;
+	u16 it_len;		/* length of the whole
 				 * header in bytes, including
 				 * it_version, it_pad,
 				 * it_len, and data fields.
 				 */
-    UINT32   it_present;	/* A bitmap telling which
-					 * fields are present. Set bit 31
-					 * (0x80000000) to extend the
-					 * bitmap by another 32 bits.
-					 * Additional extensions are made
-					 * by setting bit 31.
-					 */
-}ieee80211_radiotap_header ;
+	u32 it_present;	/* A bitmap telling which
+				 * fields are present. Set bit 31
+				 * (0x80000000) to extend the
+				 * bitmap by another 32 bits.
+				 * Additional extensions are made
+				 * by setting bit 31.
+				 */
+};
 
 enum ieee80211_radiotap_type {
-    IEEE80211_RADIOTAP_TSFT = 0,
-    IEEE80211_RADIOTAP_FLAGS = 1,
-    IEEE80211_RADIOTAP_RATE = 2,
-    IEEE80211_RADIOTAP_CHANNEL = 3,
-    IEEE80211_RADIOTAP_FHSS = 4,
-    IEEE80211_RADIOTAP_DBM_ANTSIGNAL = 5,
-    IEEE80211_RADIOTAP_DBM_ANTNOISE = 6,
-    IEEE80211_RADIOTAP_LOCK_QUALITY = 7,
-    IEEE80211_RADIOTAP_TX_ATTENUATION = 8,
-    IEEE80211_RADIOTAP_DB_TX_ATTENUATION = 9,
-    IEEE80211_RADIOTAP_DBM_TX_POWER = 10,
-    IEEE80211_RADIOTAP_ANTENNA = 11,
-    IEEE80211_RADIOTAP_DB_ANTSIGNAL = 12,
-    IEEE80211_RADIOTAP_DB_ANTNOISE = 13
+	IEEE80211_RADIOTAP_TSFT = 0,
+	IEEE80211_RADIOTAP_FLAGS = 1,
+	IEEE80211_RADIOTAP_RATE = 2,
+	IEEE80211_RADIOTAP_CHANNEL = 3,
+	IEEE80211_RADIOTAP_FHSS = 4,
+	IEEE80211_RADIOTAP_DBM_ANTSIGNAL = 5,
+	IEEE80211_RADIOTAP_DBM_ANTNOISE = 6,
+	IEEE80211_RADIOTAP_LOCK_QUALITY = 7,
+	IEEE80211_RADIOTAP_TX_ATTENUATION = 8,
+	IEEE80211_RADIOTAP_DB_TX_ATTENUATION = 9,
+	IEEE80211_RADIOTAP_DBM_TX_POWER = 10,
+	IEEE80211_RADIOTAP_ANTENNA = 11,
+	IEEE80211_RADIOTAP_DB_ANTSIGNAL = 12,
+	IEEE80211_RADIOTAP_DB_ANTNOISE = 13
 };
 
 #define WLAN_RADIOTAP_PRESENT (			\
@@ -5700,737 +3866,491 @@ enum ieee80211_radiotap_type {
 	(1 << IEEE80211_RADIOTAP_RATE)  | 	\
 	 0)
 
-typedef struct _wlan_radiotap_header {
-	ieee80211_radiotap_header wt_ihdr;
-	INT64 wt_tsft;
-	UINT8 wt_flags;
-	UINT8 wt_rate;
-} wlan_radiotap_header;
+struct rt_wlan_radiotap_header {
+	struct rt_ieee80211_radiotap_header wt_ihdr;
+	long long wt_tsft;
+	u8 wt_flags;
+	u8 wt_rate;
+};
 /* Definition from madwifi */
 
-void send_monitor_packets(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	RX_BLK			*pRxBlk);
+void send_monitor_packets(struct rt_rtmp_adapter *pAd, struct rt_rx_blk *pRxBlk);
 
-// This function will be called when query /proc
-struct iw_statistics *rt28xx_get_wireless_stats(
-    IN struct net_device *net_dev);
+void RTMPSetDesiredRates(struct rt_rtmp_adapter *pAdapter, long Rates);
 
-VOID    RTMPSetDesiredRates(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  LONG            Rates);
+int Set_FixedTxMode_Proc(struct rt_rtmp_adapter *pAd, char *arg);
 
-INT	Set_FixedTxMode_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg);
+BOOLEAN RT28XXChipsetCheck(IN void *_dev_p);
 
-static inline char* GetPhyMode(
-	int Mode)
-{
-	switch(Mode)
-	{
-		case MODE_CCK:
-			return "CCK";
-
-		case MODE_OFDM:
-			return "OFDM";
-		case MODE_HTMIX:
-			return "HTMIX";
-
-		case MODE_HTGREENFIELD:
-			return "GREEN";
-		default:
-			return "N/A";
-	}
-}
+void RT28XXDMADisable(struct rt_rtmp_adapter *pAd);
 
+void RT28XXDMAEnable(struct rt_rtmp_adapter *pAd);
 
-static inline char* GetBW(
-	int BW)
-{
-	switch(BW)
-	{
-		case BW_10:
-			return "10M";
-
-		case BW_20:
-			return "20M";
-		case BW_40:
-			return "40M";
-		default:
-			return "N/A";
-	}
-}
+void RT28xx_UpdateBeaconToAsic(struct rt_rtmp_adapter *pAd,
+			       int apidx,
+			       unsigned long BeaconLen, unsigned long UpdatePos);
 
+int rt28xx_init(struct rt_rtmp_adapter *pAd,
+		char *pDefaultMac, char *pHostName);
 
-VOID RT28xxThreadTerminate(
-	IN RTMP_ADAPTER *pAd);
+int RtmpNetTaskInit(struct rt_rtmp_adapter *pAd);
 
-BOOLEAN RT28XXChipsetCheck(
-	IN void *_dev_p);
+void RtmpNetTaskExit(struct rt_rtmp_adapter *pAd);
 
-BOOLEAN RT28XXNetDevInit(
-	IN void 				*_dev_p,
-	IN struct  net_device	*net_dev,
-	IN RTMP_ADAPTER 		*pAd);
+int RtmpMgmtTaskInit(struct rt_rtmp_adapter *pAd);
 
-BOOLEAN RT28XXProbePostConfig(
-	IN void 				*_dev_p,
-	IN RTMP_ADAPTER 		*pAd,
-	IN INT32				argc);
+void RtmpMgmtTaskExit(struct rt_rtmp_adapter *pAd);
 
-VOID RT28XXDMADisable(
-	IN RTMP_ADAPTER 		*pAd);
+void tbtt_tasklet(unsigned long data);
 
-VOID RT28XXDMAEnable(
-	IN RTMP_ADAPTER 		*pAd);
+struct net_device *RtmpPhyNetDevInit(struct rt_rtmp_adapter *pAd,
+			   struct rt_rtmp_os_netdev_op_hook *pNetHook);
 
-VOID RT28xx_UpdateBeaconToAsic(
-	IN RTMP_ADAPTER * pAd,
-	IN INT apidx,
-	IN ULONG BeaconLen,
-	IN ULONG UpdatePos);
+BOOLEAN RtmpPhyNetDevExit(struct rt_rtmp_adapter *pAd, struct net_device *net_dev);
 
-INT rt28xx_sta_ioctl(
-	IN	struct net_device	*net_dev,
-	IN	OUT	struct ifreq	*rq,
-	IN	INT			cmd);
+int RtmpRaDevCtrlInit(struct rt_rtmp_adapter *pAd, IN RTMP_INF_TYPE infType);
 
-////////////////////////////////////////
-PNDIS_PACKET GetPacketFromRxRing(
-	IN		PRTMP_ADAPTER	pAd,
-	OUT		PRT28XX_RXD_STRUC	pSaveRxD,
-	OUT		BOOLEAN			*pbReschedule,
-	IN OUT	UINT32			*pRxPending);
+BOOLEAN RtmpRaDevCtrlExit(struct rt_rtmp_adapter *pAd);
 
+#ifdef RTMP_MAC_PCI
+/* */
+/* Function Prototype in cmm_data_pci.c */
+/* */
+u16 RtmpPCI_WriteTxResource(struct rt_rtmp_adapter *pAd,
+			       struct rt_tx_blk *pTxBlk,
+			       IN BOOLEAN bIsLast, u16 * FreeNumber);
 
-void kill_thread_task(PRTMP_ADAPTER pAd);
+u16 RtmpPCI_WriteSingleTxResource(struct rt_rtmp_adapter *pAd,
+				     struct rt_tx_blk *pTxBlk,
+				     IN BOOLEAN bIsLast,
+				     u16 * FreeNumber);
 
-void tbtt_tasklet(unsigned long data);
+u16 RtmpPCI_WriteMultiTxResource(struct rt_rtmp_adapter *pAd,
+				    struct rt_tx_blk *pTxBlk,
+				    u8 frameNum, u16 * FreeNumber);
 
-#ifdef RT2860
-//
-// Function Prototype in cmm_data_2860.c
-//
-USHORT RtmpPCI_WriteTxResource(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	TX_BLK			*pTxBlk,
-	IN	BOOLEAN			bIsLast,
-	OUT	USHORT			*FreeNumber);
-
-USHORT RtmpPCI_WriteSingleTxResource(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	TX_BLK			*pTxBlk,
-	IN	BOOLEAN			bIsLast,
-	OUT	USHORT			*FreeNumber);
-
-USHORT RtmpPCI_WriteMultiTxResource(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	TX_BLK			*pTxBlk,
-	IN	UCHAR			frameNum,
-	OUT	USHORT			*FreeNumber);
-
-USHORT	RtmpPCI_WriteFragTxResource(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	TX_BLK			*pTxBlk,
-	IN	UCHAR			fragNum,
-	OUT	USHORT			*FreeNumber);
-
-USHORT RtmpPCI_WriteSubTxResource(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	TX_BLK			*pTxBlk,
-	IN	BOOLEAN			bIsLast,
-	OUT	USHORT			*FreeNumber);
-
-VOID RtmpPCI_FinalWriteTxResource(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	TX_BLK			*pTxBlk,
-	IN	USHORT			totalMPDUSize,
-	IN	USHORT			FirstTxIdx);
-
-VOID RtmpPCIDataLastTxIdx(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			QueIdx,
-	IN	USHORT			LastTxIdx);
-
-VOID RtmpPCIDataKickOut(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	TX_BLK			*pTxBlk,
-	IN	UCHAR			QueIdx);
-
-
-int RtmpPCIMgmtKickOut(
-	IN RTMP_ADAPTER 	*pAd,
-	IN UCHAR 			QueIdx,
-	IN PNDIS_PACKET		pPacket,
-	IN PUCHAR			pSrcBufVA,
-	IN UINT 			SrcBufLen);
-
-
-NDIS_STATUS RTMPCheckRxError(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PHEADER_802_11  pHeader,
-	IN	PRXWI_STRUC	pRxWI,
-	IN  PRT28XX_RXD_STRUC      pRxD);
-
-VOID RTMPInitPCIeLinkCtrlValue(
-	IN	PRTMP_ADAPTER	pAd);
-
-VOID RTMPFindHostPCIDev(
-    IN	PRTMP_ADAPTER	pAd);
-
-VOID RTMPPCIeLinkCtrlValueRestore(
-	IN	PRTMP_ADAPTER	pAd,
-	IN   UCHAR		Level);
-
-VOID RTMPPCIeLinkCtrlSetting(
-	IN	PRTMP_ADAPTER	pAd,
-	IN 	USHORT		Max);
-
-VOID RT28xxPciAsicRadioOff(
-	IN PRTMP_ADAPTER    pAd,
-	IN UCHAR            Level,
-	IN USHORT           TbttNumToNextWakeUp);
-
-BOOLEAN RT28xxPciAsicRadioOn(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR     Level);
-
-VOID RT28xxPciStaAsicForceWakeup(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR    	 Level);
-
-VOID RT28xxPciStaAsicSleepThenAutoWakeup(
-	IN PRTMP_ADAPTER pAd,
-	IN USHORT TbttNumToNextWakeUp);
-
-VOID PsPollWakeExec(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3);
-
-VOID  RadioOnExec(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3);
-
-VOID RT28xxPciMlmeRadioOn(
-	IN PRTMP_ADAPTER pAd);
-
-VOID RT28xxPciMlmeRadioOFF(
-	IN PRTMP_ADAPTER pAd);
-#endif /* RT2860 */
-
-VOID AsicTurnOffRFClk(
-	IN PRTMP_ADAPTER    pAd,
-	IN	UCHAR           Channel);
-
-VOID AsicTurnOnRFClk(
-	IN PRTMP_ADAPTER 	pAd,
-	IN	UCHAR			Channel);
-
-NTSTATUS RT30xxWriteRFRegister(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			RegID,
-	IN	UCHAR			Value);
-
-NTSTATUS RT30xxReadRFRegister(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			RegID,
-	IN	PUCHAR			pValue);
-
-UCHAR eFuseReadRegisters(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	USHORT Offset,
-	IN	USHORT Length,
-	OUT	USHORT* pData);
-
-VOID eFuseReadPhysical(
-	IN	PRTMP_ADAPTER	pAd,
-  	IN	PUSHORT lpInBuffer,
-  	IN	ULONG nInBufferSize,
-  	OUT	PUSHORT lpOutBuffer,
-  	IN	ULONG nOutBufferSize
-);
-
-NTSTATUS eFuseRead(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	USHORT			Offset,
-	OUT	PUCHAR			pData,
-	IN	USHORT			Length);
-
-VOID eFusePhysicalWriteRegisters(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	USHORT Offset,
-	IN	USHORT Length,
-	OUT	USHORT* pData);
-
-NTSTATUS eFuseWriteRegisters(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	USHORT Offset,
-	IN	USHORT Length,
-	IN	USHORT* pData);
-
-VOID eFuseWritePhysical(
-	IN	PRTMP_ADAPTER	pAd,
-  	PUSHORT lpInBuffer,
-	ULONG nInBufferSize,
-  	PUCHAR lpOutBuffer,
-  	ULONG nOutBufferSize
-);
-
-NTSTATUS eFuseWrite(
-   	IN	PRTMP_ADAPTER	pAd,
-	IN	USHORT			Offset,
-	IN	PUCHAR			pData,
-	IN	USHORT			length);
-
-INT set_eFuseGetFreeBlockCount_Proc(
-   	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg);
-
-INT set_eFusedump_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg);
-
-INT set_eFuseLoadFromBin_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg);
-
-NTSTATUS eFuseWriteRegistersFromBin(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	USHORT Offset,
-	IN	USHORT Length,
-	IN	USHORT* pData);
-
-VOID eFusePhysicalReadRegisters(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	USHORT Offset,
-	IN	USHORT Length,
-	OUT	USHORT* pData);
-
-VOID RT30xxLoadRFNormalModeSetup(
-	IN PRTMP_ADAPTER 	pAd);
-
-VOID RT30xxLoadRFSleepModeSetup(
-	IN PRTMP_ADAPTER 	pAd);
-
-VOID RT30xxReverseRFSleepModeSetup(
-	IN PRTMP_ADAPTER 	pAd);
-
-#ifdef RT2870
-//
-// Function Prototype in rtusb_bulk.c
-//
-VOID	RTUSBInitTxDesc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PTX_CONTEXT		pTxContext,
-	IN	UCHAR			BulkOutPipeId,
-	IN	usb_complete_t	Func);
-
-VOID	RTUSBInitHTTxDesc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PHT_TX_CONTEXT	pTxContext,
-	IN	UCHAR			BulkOutPipeId,
-	IN	ULONG			BulkOutSize,
-	IN	usb_complete_t	Func);
-
-VOID RTUSBCleanUpDataBulkOutQueue(
-	IN	PRTMP_ADAPTER	pAd);
-
-VOID RTUSBCancelPendingBulkOutIRP(
-	IN	PRTMP_ADAPTER	pAd);
-
-VOID RTUSBBulkOutDataPacket(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			BulkOutPipeId,
-	IN	UCHAR			Index);
-
-VOID RTUSBBulkOutNullFrame(
-	IN	PRTMP_ADAPTER	pAd);
-
-VOID RTUSBBulkOutRTSFrame(
-	IN	PRTMP_ADAPTER	pAd);
-
-VOID RTUSBCancelPendingBulkInIRP(
-	IN	PRTMP_ADAPTER	pAd);
-
-VOID RTUSBCancelPendingIRPs(
-	IN	PRTMP_ADAPTER	pAd);
-
-VOID RTUSBBulkOutMLMEPacket(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			Index);
-
-VOID RTUSBBulkOutPsPoll(
-	IN	PRTMP_ADAPTER	pAd);
-
-VOID RTUSBCleanUpMLMEBulkOutQueue(
-	IN	PRTMP_ADAPTER	pAd);
-
-VOID RTUSBKickBulkOut(
-	IN	PRTMP_ADAPTER pAd);
-
-VOID	RTUSBBulkReceive(
-	IN	PRTMP_ADAPTER	pAd);
-
-VOID DoBulkIn(
-	IN RTMP_ADAPTER *pAd);
-
-VOID RTUSBInitRxDesc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN  PRX_CONTEXT		pRxContext);
-
-//
-// Function Prototype in rtusb_io.c
-//
-NTSTATUS RTUSBMultiRead(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	USHORT			Offset,
-	OUT	PUCHAR			pData,
-	IN	USHORT			length);
-
-NTSTATUS RTUSBMultiWrite(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	USHORT			Offset,
-	IN	PUCHAR			pData,
-	IN	USHORT			length);
-
-NTSTATUS RTUSBMultiWrite_OneByte(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	USHORT			Offset,
-	IN	PUCHAR			pData);
-
-NTSTATUS RTUSBReadBBPRegister(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			Id,
-	IN	PUCHAR			pValue);
-
-NTSTATUS RTUSBWriteBBPRegister(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			Id,
-	IN	UCHAR			Value);
-
-NTSTATUS RTUSBWriteRFRegister(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UINT32			Value);
-
-NTSTATUS RTUSB_VendorRequest(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UINT32			TransferFlags,
-	IN	UCHAR			ReservedBits,
-	IN	UCHAR			Request,
-	IN	USHORT			Value,
-	IN	USHORT			Index,
-	IN	PVOID			TransferBuffer,
-	IN	UINT32			TransferBufferLength);
-
-NTSTATUS RTUSBReadEEPROM(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	USHORT			Offset,
-	OUT	PUCHAR			pData,
-	IN	USHORT			length);
-
-NTSTATUS RTUSBWriteEEPROM(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	USHORT			Offset,
-	IN	PUCHAR			pData,
-	IN	USHORT			length);
+u16 RtmpPCI_WriteFragTxResource(struct rt_rtmp_adapter *pAd,
+				   struct rt_tx_blk *pTxBlk,
+				   u8 fragNum, u16 * FreeNumber);
 
-VOID RTUSBPutToSleep(
-	IN	PRTMP_ADAPTER	pAd);
+u16 RtmpPCI_WriteSubTxResource(struct rt_rtmp_adapter *pAd,
+				  struct rt_tx_blk *pTxBlk,
+				  IN BOOLEAN bIsLast, u16 * FreeNumber);
 
-NTSTATUS RTUSBWakeUp(
-	IN	PRTMP_ADAPTER	pAd);
+void RtmpPCI_FinalWriteTxResource(struct rt_rtmp_adapter *pAd,
+				  struct rt_tx_blk *pTxBlk,
+				  u16 totalMPDUSize,
+				  u16 FirstTxIdx);
 
-VOID RTUSBInitializeCmdQ(
-	IN	PCmdQ	cmdq);
+void RtmpPCIDataLastTxIdx(struct rt_rtmp_adapter *pAd,
+			  u8 QueIdx, u16 LastTxIdx);
 
-NDIS_STATUS	RTUSBEnqueueCmdFromNdis(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	NDIS_OID		Oid,
-	IN	BOOLEAN			SetInformation,
-	IN	PVOID			pInformationBuffer,
-	IN	UINT32			InformationBufferLength);
+void RtmpPCIDataKickOut(struct rt_rtmp_adapter *pAd,
+			struct rt_tx_blk *pTxBlk, u8 QueIdx);
 
-NDIS_STATUS RTUSBEnqueueInternalCmd(
-	IN	PRTMP_ADAPTER	pAd,
-	IN NDIS_OID			Oid,
-	IN PVOID			pInformationBuffer,
-	IN UINT32			InformationBufferLength);
+int RtmpPCIMgmtKickOut(struct rt_rtmp_adapter *pAd,
+		       u8 QueIdx,
+		       void *pPacket,
+		       u8 *pSrcBufVA, u32 SrcBufLen);
 
-VOID RTUSBDequeueCmd(
-	IN	PCmdQ		cmdq,
-	OUT	PCmdQElmt	*pcmdqelmt);
-
-INT RTUSBCmdThread(
-	IN OUT PVOID Context);
-
-INT TimerQThread(
-	IN OUT PVOID Context);
-
-RT2870_TIMER_ENTRY *RT2870_TimerQ_Insert(
-	IN RTMP_ADAPTER *pAd,
-	IN RALINK_TIMER_STRUCT *pTimer);
+int RTMPCheckRxError(struct rt_rtmp_adapter *pAd,
+			     struct rt_header_802_11 * pHeader,
+			     struct rt_rxwi * pRxWI, IN PRT28XX_RXD_STRUC pRxD);
 
-BOOLEAN RT2870_TimerQ_Remove(
-	IN RTMP_ADAPTER *pAd,
-	IN RALINK_TIMER_STRUCT *pTimer);
-
-void RT2870_TimerQ_Exit(
-	IN RTMP_ADAPTER *pAd);
-
-void RT2870_TimerQ_Init(
-	IN RTMP_ADAPTER *pAd);
-
-VOID RT2870_BssBeaconExit(
-	IN RTMP_ADAPTER *pAd);
-
-VOID RT2870_BssBeaconStop(
-	IN RTMP_ADAPTER *pAd);
-
-VOID RT2870_BssBeaconStart(
-	IN RTMP_ADAPTER * pAd);
-
-VOID RT2870_BssBeaconInit(
-	IN RTMP_ADAPTER *pAd);
-
-VOID RT2870_WatchDog(
-	IN RTMP_ADAPTER *pAd);
-
-NTSTATUS RTUSBWriteMACRegister(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	USHORT			Offset,
-	IN	UINT32			Value);
-
-NTSTATUS RTUSBReadMACRegister(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	USHORT			Offset,
-	OUT	PUINT32			pValue);
-
-NTSTATUS RTUSBSingleWrite(
-	IN 	RTMP_ADAPTER 	*pAd,
-	IN	USHORT			Offset,
-	IN	USHORT			Value);
-
-NTSTATUS RTUSBFirmwareRun(
-	IN	PRTMP_ADAPTER	pAd);
-
-NTSTATUS RTUSBFirmwareWrite(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR		pFwImage,
-	IN ULONG		FwLen);
-
-NTSTATUS	RTUSBFirmwareOpmode(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUINT32			pValue);
-
-NTSTATUS	RTUSBVenderReset(
-	IN	PRTMP_ADAPTER	pAd);
-
-VOID CMDHandler(
-    IN PRTMP_ADAPTER pAd);
-
-
-NDIS_STATUS	 CreateThreads(
-	IN	struct net_device *net_dev );
-
-
-VOID MacTableInitialize(
-	IN  PRTMP_ADAPTER   pAd);
-
-VOID MlmeSetPsm(
-	IN PRTMP_ADAPTER pAd,
-	IN USHORT psm);
-
-NDIS_STATUS RTMPWPAAddKeyProc(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PVOID           pBuf);
-
-VOID AsicRxAntEvalAction(
-	IN PRTMP_ADAPTER pAd);
-
-NDIS_STATUS	RTMPCheckRxError(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PHEADER_802_11	pHeader,
-	IN	PRXWI_STRUC	pRxWI,
-	IN	PRT28XX_RXD_STRUC	pRxINFO);
-
-INT MlmeThread(
-	IN PVOID Context);
-
-//
-// Function Prototype in rtusb_data.c
-//
-NDIS_STATUS	RTUSBFreeDescriptorRequest(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			BulkOutPipeId,
-	IN	UINT32			NumberRequired);
-
-
-BOOLEAN	RTUSBNeedQueueBackForAgg(
-	IN RTMP_ADAPTER *pAd,
-	IN UCHAR		BulkOutPipeId);
+BOOLEAN RT28xxPciAsicRadioOff(struct rt_rtmp_adapter *pAd,
+			      u8 Level, u16 TbttNumToNextWakeUp);
 
+BOOLEAN RT28xxPciAsicRadioOn(struct rt_rtmp_adapter *pAd, u8 Level);
 
-VOID RTMPWriteTxInfo(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PTXINFO_STRUC 	pTxInfo,
-	IN	  USHORT		USBDMApktLen,
-	IN	  BOOLEAN		bWiv,
-	IN	  UCHAR			QueueSel,
-	IN	  UCHAR			NextValid,
-	IN	  UCHAR			TxBurst);
-
-//
-// Function Prototype in cmm_data_2870.c
-//
-USHORT RtmpUSB_WriteSubTxResource(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	TX_BLK			*pTxBlk,
-	IN	BOOLEAN			bIsLast,
-	OUT	USHORT			*FreeNumber);
-
-USHORT RtmpUSB_WriteSingleTxResource(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	TX_BLK			*pTxBlk,
-	IN	BOOLEAN			bIsLast,
-	OUT	USHORT			*FreeNumber);
-
-USHORT	RtmpUSB_WriteFragTxResource(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	TX_BLK			*pTxBlk,
-	IN	UCHAR			fragNum,
-	OUT	USHORT			*FreeNumber);
-
-USHORT RtmpUSB_WriteMultiTxResource(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	TX_BLK			*pTxBlk,
-	IN	UCHAR			frameNum,
-	OUT	USHORT			*FreeNumber);
-
-VOID RtmpUSB_FinalWriteTxResource(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	TX_BLK			*pTxBlk,
-	IN	USHORT			totalMPDUSize,
-#ifdef RT2860
-	IN	USHORT			FirstTxIdx);
-#endif
-	IN	USHORT			TxIdx);
+void RTMPInitPCIeLinkCtrlValue(struct rt_rtmp_adapter *pAd);
 
-VOID RtmpUSBDataLastTxIdx(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			QueIdx,
-	IN	USHORT			TxIdx);
+void RTMPFindHostPCIDev(struct rt_rtmp_adapter *pAd);
 
-VOID RtmpUSBDataKickOut(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	TX_BLK			*pTxBlk,
-	IN	UCHAR			QueIdx);
+void RTMPPCIeLinkCtrlValueRestore(struct rt_rtmp_adapter *pAd, u8 Level);
 
+void RTMPPCIeLinkCtrlSetting(struct rt_rtmp_adapter *pAd, u16 Max);
 
-int RtmpUSBMgmtKickOut(
-	IN RTMP_ADAPTER 	*pAd,
-	IN UCHAR 			QueIdx,
-	IN PNDIS_PACKET		pPacket,
-	IN PUCHAR			pSrcBufVA,
-	IN UINT 			SrcBufLen);
+void RTMPrt3xSetPCIePowerLinkCtrl(struct rt_rtmp_adapter *pAd);
 
-VOID RtmpUSBNullFrameKickOut(
-	IN RTMP_ADAPTER *pAd,
-	IN UCHAR		QueIdx,
-	IN UCHAR		*pNullFrame,
-	IN UINT32		frameLen);
+void PsPollWakeExec(void *SystemSpecific1,
+		    void *FunctionContext,
+		    void *SystemSpecific2, void *SystemSpecific3);
 
-VOID RT28xxUsbStaAsicForceWakeup(
-	IN PRTMP_ADAPTER pAd,
-	IN BOOLEAN       bFromTx);
+void RadioOnExec(void *SystemSpecific1,
+		 void *FunctionContext,
+		 void *SystemSpecific2, void *SystemSpecific3);
 
-VOID RT28xxUsbStaAsicSleepThenAutoWakeup(
-	IN PRTMP_ADAPTER pAd,
-	IN USHORT TbttNumToNextWakeUp);
+void RT28xxPciStaAsicForceWakeup(struct rt_rtmp_adapter *pAd, IN BOOLEAN bFromTx);
 
-VOID RT28xxUsbMlmeRadioOn(
-	IN PRTMP_ADAPTER pAd);
+void RT28xxPciStaAsicSleepThenAutoWakeup(struct rt_rtmp_adapter *pAd,
+					 u16 TbttNumToNextWakeUp);
 
-VOID RT28xxUsbMlmeRadioOFF(
-	IN PRTMP_ADAPTER pAd);
-#endif // RT2870 //
+void RT28xxPciMlmeRadioOn(struct rt_rtmp_adapter *pAd);
 
-INT RTMPShowCfgValue(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			pName,
-	IN	PUCHAR			pBuf);
+void RT28xxPciMlmeRadioOFF(struct rt_rtmp_adapter *pAd);
+#endif /* RTMP_MAC_PCI // */
 
-PCHAR   RTMPGetRalinkAuthModeStr(
-    IN  NDIS_802_11_AUTHENTICATION_MODE authMode);
+#ifdef RTMP_MAC_USB
+/* */
+/* Function Prototype in rtusb_bulk.c */
+/* */
+void RTUSBInitTxDesc(struct rt_rtmp_adapter *pAd,
+		     struct rt_tx_context *pTxContext,
+		     u8 BulkOutPipeId, IN usb_complete_t Func);
 
-PCHAR   RTMPGetRalinkEncryModeStr(
-    IN  USHORT encryMode);
+void RTUSBInitHTTxDesc(struct rt_rtmp_adapter *pAd,
+		       struct rt_ht_tx_context *pTxContext,
+		       u8 BulkOutPipeId,
+		       unsigned long BulkOutSize, IN usb_complete_t Func);
 
-VOID AsicStaBbpTuning(
-	IN PRTMP_ADAPTER pAd);
+void RTUSBInitRxDesc(struct rt_rtmp_adapter *pAd, struct rt_rx_context *pRxContext);
 
-#ifdef RT2860
-VOID AsicResetFromDMABusy(
-	IN PRTMP_ADAPTER pAd);
+void RTUSBCleanUpDataBulkOutQueue(struct rt_rtmp_adapter *pAd);
 
-VOID AsicResetBBP(
-	IN PRTMP_ADAPTER pAd);
+void RTUSBCancelPendingBulkOutIRP(struct rt_rtmp_adapter *pAd);
 
-VOID AsicResetMAC(
-	IN PRTMP_ADAPTER pAd);
+void RTUSBBulkOutDataPacket(struct rt_rtmp_adapter *pAd,
+			    u8 BulkOutPipeId, u8 Index);
 
-VOID AsicResetPBF(
-	IN PRTMP_ADAPTER pAd);
-#endif
-#ifdef RT2870
-BOOLEAN StaAddMacTableEntry(
-	IN  PRTMP_ADAPTER		pAd,
-	IN  PMAC_TABLE_ENTRY	pEntry,
-	IN  UCHAR				MaxSupportedRateIn500Kbps,
-	IN  HT_CAPABILITY_IE	*pHtCapability,
-	IN  UCHAR				HtCapabilityLen,
-	IN  USHORT        		CapabilityInfo);
-#endif
+void RTUSBBulkOutNullFrame(struct rt_rtmp_adapter *pAd);
+
+void RTUSBBulkOutRTSFrame(struct rt_rtmp_adapter *pAd);
+
+void RTUSBCancelPendingBulkInIRP(struct rt_rtmp_adapter *pAd);
+
+void RTUSBCancelPendingIRPs(struct rt_rtmp_adapter *pAd);
+
+void RTUSBBulkOutMLMEPacket(struct rt_rtmp_adapter *pAd, u8 Index);
+
+void RTUSBBulkOutPsPoll(struct rt_rtmp_adapter *pAd);
+
+void RTUSBCleanUpMLMEBulkOutQueue(struct rt_rtmp_adapter *pAd);
+
+void RTUSBKickBulkOut(struct rt_rtmp_adapter *pAd);
+
+void RTUSBBulkReceive(struct rt_rtmp_adapter *pAd);
+
+void DoBulkIn(struct rt_rtmp_adapter *pAd);
+
+void RTUSBInitRxDesc(struct rt_rtmp_adapter *pAd, struct rt_rx_context *pRxContext);
+
+void RTUSBBulkRxHandle(IN unsigned long data);
+
+/* */
+/* Function Prototype in rtusb_io.c */
+/* */
+int RTUSBMultiRead(struct rt_rtmp_adapter *pAd,
+			u16 Offset, u8 *pData, u16 length);
 
-void RTMP_IndicateMediaState(
-	IN	PRTMP_ADAPTER	pAd);
+int RTUSBMultiWrite(struct rt_rtmp_adapter *pAd,
+			 u16 Offset, u8 *pData, u16 length);
 
-VOID ReSyncBeaconTime(
-	IN  PRTMP_ADAPTER   pAd);
+int RTUSBMultiWrite_OneByte(struct rt_rtmp_adapter *pAd,
+				 u16 Offset, u8 *pData);
 
-VOID RTMPSetAGCInitValue(
-	IN PRTMP_ADAPTER	pAd,
-	IN UCHAR			BandWidth);
+int RTUSBReadBBPRegister(struct rt_rtmp_adapter *pAd,
+			      u8 Id, u8 *pValue);
 
-int rt28xx_close(IN PNET_DEV dev);
-int rt28xx_open(IN PNET_DEV dev);
+int RTUSBWriteBBPRegister(struct rt_rtmp_adapter *pAd,
+			       u8 Id, u8 Value);
 
-__inline INT VIRTUAL_IF_UP(PRTMP_ADAPTER pAd)
+int RTUSBWriteRFRegister(struct rt_rtmp_adapter *pAd, u32 Value);
+
+int RTUSB_VendorRequest(struct rt_rtmp_adapter *pAd,
+			     u32 TransferFlags,
+			     u8 ReservedBits,
+			     u8 Request,
+			     u16 Value,
+			     u16 Index,
+			     void *TransferBuffer,
+			     u32 TransferBufferLength);
+
+int RTUSBReadEEPROM(struct rt_rtmp_adapter *pAd,
+			 u16 Offset, u8 *pData, u16 length);
+
+int RTUSBWriteEEPROM(struct rt_rtmp_adapter *pAd,
+			  u16 Offset, u8 *pData, u16 length);
+
+void RTUSBPutToSleep(struct rt_rtmp_adapter *pAd);
+
+int RTUSBWakeUp(struct rt_rtmp_adapter *pAd);
+
+void RTUSBInitializeCmdQ(struct rt_cmdq *cmdq);
+
+int RTUSBEnqueueCmdFromNdis(struct rt_rtmp_adapter *pAd,
+				    IN NDIS_OID Oid,
+				    IN BOOLEAN SetInformation,
+				    void *pInformationBuffer,
+				    u32 InformationBufferLength);
+
+int RTUSBEnqueueInternalCmd(struct rt_rtmp_adapter *pAd,
+				    IN NDIS_OID Oid,
+				    void *pInformationBuffer,
+				    u32 InformationBufferLength);
+
+void RTUSBDequeueCmd(struct rt_cmdq *cmdq, struct rt_cmdqelmt * * pcmdqelmt);
+
+int RTUSBCmdThread(IN void *Context);
+
+void RTUSBBssBeaconExit(struct rt_rtmp_adapter *pAd);
+
+void RTUSBBssBeaconStop(struct rt_rtmp_adapter *pAd);
+
+void RTUSBBssBeaconStart(struct rt_rtmp_adapter *pAd);
+
+void RTUSBBssBeaconInit(struct rt_rtmp_adapter *pAd);
+
+void RTUSBWatchDog(struct rt_rtmp_adapter *pAd);
+
+int RTUSBWriteMACRegister(struct rt_rtmp_adapter *pAd,
+			       u16 Offset, u32 Value);
+
+int RTUSBReadMACRegister(struct rt_rtmp_adapter *pAd,
+			      u16 Offset, u32 *pValue);
+
+int RTUSBSingleWrite(struct rt_rtmp_adapter *pAd,
+			  u16 Offset, u16 Value);
+
+int RTUSBFirmwareWrite(struct rt_rtmp_adapter *pAd,
+			    u8 *pFwImage, unsigned long FwLen);
+
+int RTUSBVenderReset(struct rt_rtmp_adapter *pAd);
+
+int RTUSBSetHardWareRegister(struct rt_rtmp_adapter *pAdapter, void *pBuf);
+
+int RTUSBQueryHardWareRegister(struct rt_rtmp_adapter *pAdapter,
+				       void *pBuf);
+
+void CMDHandler(struct rt_rtmp_adapter *pAd);
+
+int RTUSBWriteHWMACAddress(struct rt_rtmp_adapter *pAdapter);
+
+void MacTableInitialize(struct rt_rtmp_adapter *pAd);
+
+void MlmeSetPsm(struct rt_rtmp_adapter *pAd, u16 psm);
+
+int RTMPWPAAddKeyProc(struct rt_rtmp_adapter *pAd, void *pBuf);
+
+void AsicRxAntEvalAction(struct rt_rtmp_adapter *pAd);
+
+void append_pkt(struct rt_rtmp_adapter *pAd,
+		u8 *pHeader802_3,
+		u32 HdrLen,
+		u8 *pData,
+		unsigned long DataSize, void ** ppPacket);
+
+u32 deaggregate_AMSDU_announce(struct rt_rtmp_adapter *pAd,
+				void *pPacket,
+				u8 *pData, unsigned long DataSize);
+
+int RTMPCheckRxError(struct rt_rtmp_adapter *pAd,
+			     struct rt_header_802_11 * pHeader,
+			     struct rt_rxwi * pRxWI,
+			     IN PRT28XX_RXD_STRUC pRxINFO);
+
+void RTUSBMlmeHardTransmit(struct rt_rtmp_adapter *pAd, struct rt_mgmt *pMgmt);
+
+int MlmeThread(void *Context);
+
+/* */
+/* Function Prototype in rtusb_data.c */
+/* */
+int RTUSBFreeDescriptorRequest(struct rt_rtmp_adapter *pAd,
+				       u8 BulkOutPipeId,
+				       u32 NumberRequired);
+
+BOOLEAN RTUSBNeedQueueBackForAgg(struct rt_rtmp_adapter *pAd, u8 BulkOutPipeId);
+
+void RTMPWriteTxInfo(struct rt_rtmp_adapter *pAd,
+		     struct rt_txinfo *pTxInfo,
+		     u16 USBDMApktLen,
+		     IN BOOLEAN bWiv,
+		     u8 QueueSel, u8 NextValid, u8 TxBurst);
+
+/* */
+/* Function Prototype in cmm_data_usb.c */
+/* */
+u16 RtmpUSB_WriteSubTxResource(struct rt_rtmp_adapter *pAd,
+				  struct rt_tx_blk *pTxBlk,
+				  IN BOOLEAN bIsLast, u16 * FreeNumber);
+
+u16 RtmpUSB_WriteSingleTxResource(struct rt_rtmp_adapter *pAd,
+				     struct rt_tx_blk *pTxBlk,
+				     IN BOOLEAN bIsLast,
+				     u16 * FreeNumber);
+
+u16 RtmpUSB_WriteFragTxResource(struct rt_rtmp_adapter *pAd,
+				   struct rt_tx_blk *pTxBlk,
+				   u8 fragNum, u16 * FreeNumber);
+
+u16 RtmpUSB_WriteMultiTxResource(struct rt_rtmp_adapter *pAd,
+				    struct rt_tx_blk *pTxBlk,
+				    u8 frameNum, u16 * FreeNumber);
+
+void RtmpUSB_FinalWriteTxResource(struct rt_rtmp_adapter *pAd,
+				  struct rt_tx_blk *pTxBlk,
+				  u16 totalMPDUSize, u16 TxIdx);
+
+void RtmpUSBDataLastTxIdx(struct rt_rtmp_adapter *pAd,
+			  u8 QueIdx, u16 TxIdx);
+
+void RtmpUSBDataKickOut(struct rt_rtmp_adapter *pAd,
+			struct rt_tx_blk *pTxBlk, u8 QueIdx);
+
+int RtmpUSBMgmtKickOut(struct rt_rtmp_adapter *pAd,
+		       u8 QueIdx,
+		       void *pPacket,
+		       u8 *pSrcBufVA, u32 SrcBufLen);
+
+void RtmpUSBNullFrameKickOut(struct rt_rtmp_adapter *pAd,
+			     u8 QueIdx,
+			     u8 * pNullFrame, u32 frameLen);
+
+void RtmpUsbStaAsicForceWakeupTimeout(void *SystemSpecific1,
+				      void *FunctionContext,
+				      void *SystemSpecific2,
+				      void *SystemSpecific3);
+
+void RT28xxUsbStaAsicForceWakeup(struct rt_rtmp_adapter *pAd, IN BOOLEAN bFromTx);
+
+void RT28xxUsbStaAsicSleepThenAutoWakeup(struct rt_rtmp_adapter *pAd,
+					 u16 TbttNumToNextWakeUp);
+
+void RT28xxUsbMlmeRadioOn(struct rt_rtmp_adapter *pAd);
+
+void RT28xxUsbMlmeRadioOFF(struct rt_rtmp_adapter *pAd);
+#endif /* RTMP_MAC_USB // */
+
+void AsicTurnOffRFClk(struct rt_rtmp_adapter *pAd, u8 Channel);
+
+void AsicTurnOnRFClk(struct rt_rtmp_adapter *pAd, u8 Channel);
+
+#ifdef RTMP_TIMER_TASK_SUPPORT
+int RtmpTimerQThread(IN void *Context);
+
+struct rt_rtmp_timer_task_entry *RtmpTimerQInsert(struct rt_rtmp_adapter *pAd,
+					struct rt_ralink_timer *pTimer);
+
+BOOLEAN RtmpTimerQRemove(struct rt_rtmp_adapter *pAd,
+			 struct rt_ralink_timer *pTimer);
+
+void RtmpTimerQExit(struct rt_rtmp_adapter *pAd);
+
+void RtmpTimerQInit(struct rt_rtmp_adapter *pAd);
+#endif /* RTMP_TIMER_TASK_SUPPORT // */
+
+void AsicStaBbpTuning(struct rt_rtmp_adapter *pAd);
+
+BOOLEAN StaAddMacTableEntry(struct rt_rtmp_adapter *pAd,
+			    struct rt_mac_table_entry *pEntry,
+			    u8 MaxSupportedRateIn500Kbps,
+			    struct rt_ht_capability_ie * pHtCapability,
+			    u8 HtCapabilityLen,
+			    struct rt_add_ht_info_ie * pAddHtInfo,
+			    u8 AddHtInfoLen, u16 CapabilityInfo);
+
+BOOLEAN AUTH_ReqSend(struct rt_rtmp_adapter *pAd,
+		     struct rt_mlme_queue_elem *pElem,
+		     struct rt_ralink_timer *pAuthTimer,
+		     char *pSMName,
+		     u16 SeqNo,
+		     u8 *pNewElement, unsigned long ElementLen);
+
+void RTMP_IndicateMediaState(struct rt_rtmp_adapter *pAd);
+
+void ReSyncBeaconTime(struct rt_rtmp_adapter *pAd);
+
+void RTMPSetAGCInitValue(struct rt_rtmp_adapter *pAd, u8 BandWidth);
+
+int rt28xx_close(struct net_device *dev);
+int rt28xx_open(struct net_device *dev);
+
+#define VIRTUAL_IF_INC(__pAd) ((__pAd)->VirtualIfCnt++)
+#define VIRTUAL_IF_DEC(__pAd) ((__pAd)->VirtualIfCnt--)
+#define VIRTUAL_IF_NUM(__pAd) ((__pAd)->VirtualIfCnt)
+
+#ifdef LINUX
+__inline int VIRTUAL_IF_UP(struct rt_rtmp_adapter *pAd)
 {
-	if (VIRTUAL_IF_NUM(pAd) == 0)
-	{
-		if (rt28xx_open(pAd->net_dev) != 0)
+	if (VIRTUAL_IF_NUM(pAd) == 0) {
+		if (rt28xx_open(pAd->net_dev) != 0) {
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("rt28xx_open return fail!\n"));
 			return -1;
-	}
-	else
-	{
+		}
+	} else {
 	}
 	VIRTUAL_IF_INC(pAd);
 	return 0;
 }
 
-__inline VOID VIRTUAL_IF_DOWN(PRTMP_ADAPTER pAd)
+__inline void VIRTUAL_IF_DOWN(struct rt_rtmp_adapter *pAd)
 {
 	VIRTUAL_IF_DEC(pAd);
 	if (VIRTUAL_IF_NUM(pAd) == 0)
 		rt28xx_close(pAd->net_dev);
 	return;
 }
+#endif /* LINUX // */
+
+/*
+	OS Related funciton prototype definitions.
+	TODO: Maybe we need to move these function prototypes to other proper place.
+*/
+int RtmpOSWrielessEventSend(struct rt_rtmp_adapter *pAd,
+			    u32 eventType,
+			    int flags,
+			    u8 *pSrcMac,
+			    u8 *pData, u32 dataLen);
+
+int RtmpOSNetDevAddrSet(struct net_device *pNetDev, u8 *pMacAddr);
+
+int RtmpOSNetDevAttach(struct net_device *pNetDev,
+		       struct rt_rtmp_os_netdev_op_hook *pDevOpHook);
+
+void RtmpOSNetDevClose(struct net_device *pNetDev);
+
+void RtmpOSNetDevDetach(struct net_device *pNetDev);
+
+int RtmpOSNetDevAlloc(struct net_device ** pNewNetDev, u32 privDataSize);
+
+void RtmpOSNetDevFree(struct net_device *pNetDev);
+
+struct net_device *RtmpOSNetDevGetByName(struct net_device *pNetDev, char *pDevName);
+
+void RtmpOSNetDeviceRefPut(struct net_device *pNetDev);
+
+struct net_device *RtmpOSNetDevCreate(struct rt_rtmp_adapter *pAd,
+			    int devType,
+			    int devNum,
+			    int privMemSize, char *pNamePrefix);
+
+/*
+	Task operation related function prototypes
+*/
+void RtmpOSTaskCustomize(struct rt_rtmp_os_task *pTask);
+
+int RtmpOSTaskNotifyToExit(struct rt_rtmp_os_task *pTask);
+
+int RtmpOSTaskKill(struct rt_rtmp_os_task *pTask);
+
+int RtmpOSTaskInit(struct rt_rtmp_os_task *pTask,
+			   char *pTaskName, void * pPriv);
+
+int RtmpOSTaskAttach(struct rt_rtmp_os_task *pTask,
+			     IN int (*fn) (void *), IN void *arg);
+
+/*
+	File operation related function prototypes
+*/
+struct file *RtmpOSFileOpen(IN char *pPath, IN int flag, IN int mode);
+
+int RtmpOSFileClose(struct file *osfd);
+
+void RtmpOSFileSeek(struct file *osfd, IN int offset);
 
+int RtmpOSFileRead(struct file *osfd, IN char *pDataPtr, IN int readLen);
 
-#endif  // __RTMP_H__
+int RtmpOSFileWrite(struct file *osfd, IN char *pDataPtr, IN int writeLen);
 
+#endif /* __RTMP_H__ */
diff --git a/drivers/staging/rt2860/rtmp_chip.h b/drivers/staging/rt2860/rtmp_chip.h
new file mode 100644
index 000000000000..0adf2cd2deb7
--- /dev/null
+++ b/drivers/staging/rt2860/rtmp_chip.h
@@ -0,0 +1,258 @@
+/*
+ *************************************************************************
+ * Ralink Tech Inc.
+ * 5F., No.36, Taiyuan St., Jhubei City,
+ * Hsinchu County 302,
+ * Taiwan, R.O.C.
+ *
+ * (c) Copyright 2002-2007, Ralink Technology, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify  *
+ * it under the terms of the GNU General Public License as published by  *
+ * the Free Software Foundation; either version 2 of the License, or     *
+ * (at your option) any later version.                                   *
+ *                                                                       *
+ * This program is distributed in the hope that it will be useful,       *
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
+ * GNU General Public License for more details.                          *
+ *                                                                       *
+ * You should have received a copy of the GNU General Public License     *
+ * along with this program; if not, write to the                         *
+ * Free Software Foundation, Inc.,                                       *
+ * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
+ *                                                                       *
+ *************************************************************************
+
+	Module Name:
+	rtmp_chip.h
+
+	Abstract:
+	Ralink Wireless Chip related definition & structures
+
+	Revision History:
+	Who			When		  What
+	--------	----------	  ----------------------------------------------
+*/
+
+#ifndef	__RTMP_CHIP_H__
+#define	__RTMP_CHIP_H__
+
+#include "rtmp_type.h"
+
+#ifdef RT2860
+#include "chip/rt2860.h"
+#endif /* RT2860 // */
+#ifdef RT2870
+#include "chip/rt2870.h"
+#endif /* RT2870 // */
+#ifdef RT3070
+#include "chip/rt3070.h"
+#endif /* RT3070 // */
+#ifdef RT3090
+#include "chip/rt3090.h"
+#endif /* RT3090 // */
+
+/* We will have a cost down version which mac version is 0x3090xxxx */
+/* */
+/* RT3090A facts */
+/* */
+/* a) 2.4 GHz */
+/* b) Replacement for RT3090 */
+/* c) Internal LNA */
+/* d) Interference over channel #14 */
+/* e) New BBP features (e.g., SIG re-modulation) */
+/* */
+#define IS_RT3090A(_pAd)				((((_pAd)->MACVersion & 0xffff0000) == 0x30900000))
+
+/* We will have a cost down version which mac version is 0x3090xxxx */
+#define IS_RT3090(_pAd)				((((_pAd)->MACVersion & 0xffff0000) == 0x30710000) || (IS_RT3090A(_pAd)))
+
+#define IS_RT3070(_pAd)		(((_pAd)->MACVersion & 0xffff0000) == 0x30700000)
+#define IS_RT3071(_pAd)		(((_pAd)->MACVersion & 0xffff0000) == 0x30710000)
+#define IS_RT2070(_pAd)		(((_pAd)->RfIcType == RFIC_2020) || ((_pAd)->EFuseTag == 0x27))
+
+#define IS_RT30xx(_pAd)		(((_pAd)->MACVersion & 0xfff00000) == 0x30700000||IS_RT3090A(_pAd))
+/*#define IS_RT305X(_pAd)               ((_pAd)->MACVersion == 0x28720200) */
+
+/* RT3572, 3592, 3562, 3062 share the same MAC version */
+#define IS_RT3572(_pAd)		(((_pAd)->MACVersion & 0xffff0000) == 0x35720000)
+#define IS_VERSION_BEFORE_F(_pAd)			(((_pAd)->MACVersion&0xffff) <= 0x0211)
+/* F version is 0x0212, E version is 0x0211. 309x can save more power after F version. */
+#define IS_VERSION_AFTER_F(_pAd)			((((_pAd)->MACVersion&0xffff) >= 0x0212) || (((_pAd)->b3090ESpecialChip == TRUE)))
+/* */
+/* RT3390 facts */
+/* */
+/* a) Base on RT3090 (RF IC: RT3020) */
+/* b) 2.4 GHz */
+/* c) 1x1 */
+/* d) Single chip */
+/* e) Internal components: PA and LNA */
+/* */
+/*RT3390,RT3370 */
+#define IS_RT3390(_pAd)				(((_pAd)->MACVersion & 0xFFFF0000) == 0x33900000)
+
+/* ------------------------------------------------------ */
+/* PCI registers - base address 0x0000 */
+/* ------------------------------------------------------ */
+#define CHIP_PCI_CFG		0x0000
+#define CHIP_PCI_EECTRL		0x0004
+#define CHIP_PCI_MCUCTRL	0x0008
+
+#define OPT_14			0x114
+
+#define RETRY_LIMIT		10
+
+/* ------------------------------------------------------ */
+/* BBP & RF     definition */
+/* ------------------------------------------------------ */
+#define	BUSY		                1
+#define	IDLE		                0
+
+/*------------------------------------------------------------------------- */
+/* EEPROM definition */
+/*------------------------------------------------------------------------- */
+#define EEDO                        0x08
+#define EEDI                        0x04
+#define EECS                        0x02
+#define EESK                        0x01
+#define EERL                        0x80
+
+#define EEPROM_WRITE_OPCODE         0x05
+#define EEPROM_READ_OPCODE          0x06
+#define EEPROM_EWDS_OPCODE          0x10
+#define EEPROM_EWEN_OPCODE          0x13
+
+#define NUM_EEPROM_BBP_PARMS		19	/* Include NIC Config 0, 1, CR, TX ALC step, BBPs */
+#define NUM_EEPROM_TX_G_PARMS		7
+#define EEPROM_NIC1_OFFSET          0x34	/* The address is from NIC config 0, not BBP register ID */
+#define EEPROM_NIC2_OFFSET          0x36	/* The address is from NIC config 0, not BBP register ID */
+#define EEPROM_BBP_BASE_OFFSET		0xf0	/* The address is from NIC config 0, not BBP register ID */
+#define EEPROM_G_TX_PWR_OFFSET		0x52
+#define EEPROM_G_TX2_PWR_OFFSET		0x60
+#define EEPROM_LED1_OFFSET			0x3c
+#define EEPROM_LED2_OFFSET			0x3e
+#define EEPROM_LED3_OFFSET			0x40
+#define EEPROM_LNA_OFFSET			0x44
+#define EEPROM_RSSI_BG_OFFSET		0x46
+#define EEPROM_TXMIXER_GAIN_2_4G	0x48
+#define EEPROM_RSSI_A_OFFSET		0x4a
+#define EEPROM_TXMIXER_GAIN_5G		0x4c
+#define EEPROM_DEFINE_MAX_TXPWR		0x4e
+#define EEPROM_TXPOWER_BYRATE_20MHZ_2_4G	0xde	/* 20MHZ 2.4G tx power. */
+#define EEPROM_TXPOWER_BYRATE_40MHZ_2_4G	0xee	/* 40MHZ 2.4G tx power. */
+#define EEPROM_TXPOWER_BYRATE_20MHZ_5G		0xfa	/* 20MHZ 5G tx power. */
+#define EEPROM_TXPOWER_BYRATE_40MHZ_5G		0x10a	/* 40MHZ 5G tx power. */
+#define EEPROM_A_TX_PWR_OFFSET      0x78
+#define EEPROM_A_TX2_PWR_OFFSET      0xa6
+/*#define EEPROM_Japan_TX_PWR_OFFSET      0x90 // 802.11j */
+/*#define EEPROM_Japan_TX2_PWR_OFFSET      0xbe */
+/*#define EEPROM_TSSI_REF_OFFSET        0x54 */
+/*#define EEPROM_TSSI_DELTA_OFFSET      0x24 */
+/*#define EEPROM_CCK_TX_PWR_OFFSET  0x62 */
+/*#define EEPROM_CALIBRATE_OFFSET       0x7c */
+#define EEPROM_VERSION_OFFSET       0x02
+#define EEPROM_FREQ_OFFSET			0x3a
+#define EEPROM_TXPOWER_BYRATE	0xde	/* 20MHZ power. */
+#define EEPROM_TXPOWER_DELTA		0x50	/* 20MHZ AND 40 MHZ use different power. This is delta in 40MHZ. */
+#define VALID_EEPROM_VERSION        1
+
+/*
+  *   EEPROM operation related marcos
+  */
+#define RT28xx_EEPROM_READ16(_pAd, _offset, _value)			\
+	(_pAd)->chipOps.eeread((struct rt_rtmp_adapter *)(_pAd), (u16)(_offset), (u16 *)&(_value))
+
+/* ------------------------------------------------------------------- */
+/*  E2PROM data layout */
+/* ------------------------------------------------------------------- */
+
+/* */
+/* MCU_LEDCS: MCU LED Control Setting. */
+/* */
+typedef union _MCU_LEDCS_STRUC {
+	struct {
+		u8 LedMode:7;
+		u8 Polarity:1;
+	} field;
+	u8 word;
+} MCU_LEDCS_STRUC, *PMCU_LEDCS_STRUC;
+
+/* */
+/* EEPROM antenna select format */
+/* */
+typedef union _EEPROM_ANTENNA_STRUC {
+	struct {
+		u16 RxPath:4;	/* 1: 1R, 2: 2R, 3: 3R */
+		u16 TxPath:4;	/* 1: 1T, 2: 2T */
+		u16 RfIcType:4;	/* see E2PROM document */
+		u16 Rsv:4;
+	} field;
+	u16 word;
+} EEPROM_ANTENNA_STRUC, *PEEPROM_ANTENNA_STRUC;
+
+typedef union _EEPROM_NIC_CINFIG2_STRUC {
+	struct {
+		u16 HardwareRadioControl:1;	/* 1:enable, 0:disable */
+		u16 DynamicTxAgcControl:1;	/* */
+		u16 ExternalLNAForG:1;	/* */
+		u16 ExternalLNAForA:1;	/* external LNA enable for 2.4G */
+		u16 CardbusAcceleration:1;	/* ! NOTE: 0 - enable, 1 - disable */
+		u16 BW40MSidebandForG:1;
+		u16 BW40MSidebandForA:1;
+		u16 EnableWPSPBC:1;	/* WPS PBC Control bit */
+		u16 BW40MAvailForG:1;	/* 0:enable, 1:disable */
+		u16 BW40MAvailForA:1;	/* 0:enable, 1:disable */
+		u16 Rsv1:1;	/* must be 0 */
+		u16 AntDiversity:1;	/* Antenna diversity */
+		u16 Rsv2:3;	/* must be 0 */
+		u16 DACTestBit:1;	/* control if driver should patch the DAC issue */
+	} field;
+	u16 word;
+} EEPROM_NIC_CONFIG2_STRUC, *PEEPROM_NIC_CONFIG2_STRUC;
+
+/* */
+/* TX_PWR Value valid range 0xFA(-6) ~ 0x24(36) */
+/* */
+typedef union _EEPROM_TX_PWR_STRUC {
+	struct {
+		char Byte0;	/* Low Byte */
+		char Byte1;	/* High Byte */
+	} field;
+	u16 word;
+} EEPROM_TX_PWR_STRUC, *PEEPROM_TX_PWR_STRUC;
+
+typedef union _EEPROM_VERSION_STRUC {
+	struct {
+		u8 FaeReleaseNumber;	/* Low Byte */
+		u8 Version;	/* High Byte */
+	} field;
+	u16 word;
+} EEPROM_VERSION_STRUC, *PEEPROM_VERSION_STRUC;
+
+typedef union _EEPROM_LED_STRUC {
+	struct {
+		u16 PolarityRDY_G:1;	/* Polarity RDY_G setting. */
+		u16 PolarityRDY_A:1;	/* Polarity RDY_A setting. */
+		u16 PolarityACT:1;	/* Polarity ACT setting. */
+		u16 PolarityGPIO_0:1;	/* Polarity GPIO#0 setting. */
+		u16 PolarityGPIO_1:1;	/* Polarity GPIO#1 setting. */
+		u16 PolarityGPIO_2:1;	/* Polarity GPIO#2 setting. */
+		u16 PolarityGPIO_3:1;	/* Polarity GPIO#3 setting. */
+		u16 PolarityGPIO_4:1;	/* Polarity GPIO#4 setting. */
+		u16 LedMode:5;	/* Led mode. */
+		u16 Rsvd:3;	/* Reserved */
+	} field;
+	u16 word;
+} EEPROM_LED_STRUC, *PEEPROM_LED_STRUC;
+
+typedef union _EEPROM_TXPOWER_DELTA_STRUC {
+	struct {
+		u8 DeltaValue:6;	/* Tx Power dalta value (MAX=4) */
+		u8 Type:1;	/* 1: plus the delta value, 0: minus the delta value */
+		u8 TxPowerEnable:1;	/* Enable */
+	} field;
+	u8 value;
+} EEPROM_TXPOWER_DELTA_STRUC, *PEEPROM_TXPOWER_DELTA_STRUC;
+
+#endif /* __RTMP_CHIP_H__ // */
diff --git a/drivers/staging/rt2860/rtmp_ckipmic.h b/drivers/staging/rt2860/rtmp_ckipmic.h
index 39955b914de7..6ff935dd3dd1 100644
--- a/drivers/staging/rt2860/rtmp_ckipmic.h
+++ b/drivers/staging/rt2860/rtmp_ckipmic.h
@@ -37,42 +37,27 @@
 #ifndef	__RTMP_CKIPMIC_H__
 #define	__RTMP_CKIPMIC_H__
 
-typedef	struct	_MIC_CONTEXT	{
+struct rt_mic_context {
 	/* --- MMH context                            */
-	UCHAR		CK[16];				/* the key                                    */
-	UCHAR		coefficient[16];	/* current aes counter mode coefficients      */
-	ULONGLONG	accum;				/* accumulated mic, reduced to u32 in final() */
-	UINT		position;			/* current position (byte offset) in message  */
-	UCHAR		part[4];			/* for conversion of message to u32 for mmh   */
-}	MIC_CONTEXT, *PMIC_CONTEXT;
+	u8 CK[16];		/* the key                                    */
+	u8 coefficient[16];	/* current aes counter mode coefficients      */
+	unsigned long long accum;	/* accumulated mic, reduced to u32 in final() */
+	u32 position;		/* current position (byte offset) in message  */
+	u8 part[4];		/* for conversion of message to u32 for mmh   */
+};
 
-VOID xor_128(
-    IN  PUCHAR              a,
-    IN  PUCHAR              b,
-    OUT PUCHAR              out);
+void xor_128(u8 *a, u8 *b, u8 *out);
 
-UCHAR RTMPCkipSbox(
-    IN  UCHAR               a);
+u8 RTMPCkipSbox(u8 a);
 
-VOID xor_32(
-    IN  PUCHAR              a,
-    IN  PUCHAR              b,
-    OUT PUCHAR              out);
+void xor_32(u8 *a, u8 *b, u8 *out);
 
-VOID next_key(
-    IN  PUCHAR              key,
-    IN  INT                 round);
+void next_key(u8 *key, int round);
 
-VOID byte_sub(
-    IN  PUCHAR              in,
-    OUT PUCHAR              out);
+void byte_sub(u8 *in, u8 *out);
 
-VOID shift_row(
-    IN  PUCHAR              in,
-    OUT PUCHAR              out);
+void shift_row(u8 *in, u8 *out);
 
-VOID mix_column(
-    IN  PUCHAR              in,
-    OUT PUCHAR              out);
+void mix_column(u8 *in, u8 *out);
 
-#endif //__RTMP_CKIPMIC_H__
+#endif /*__RTMP_CKIPMIC_H__ */
diff --git a/drivers/staging/rt2860/rtmp_def.h b/drivers/staging/rt2860/rtmp_def.h
index f5fee57fbe3e..9c54bacb845b 100644
--- a/drivers/staging/rt2860/rtmp_def.h
+++ b/drivers/staging/rt2860/rtmp_def.h
@@ -41,9 +41,9 @@
 
 #include "oid.h"
 
-//
-//  Debug information verbosity: lower values indicate higher urgency
-//
+/* */
+/*  Debug information verbosity: lower values indicate higher urgency */
+/* */
 #define RT_DEBUG_OFF        0
 #define RT_DEBUG_ERROR      1
 #define RT_DEBUG_WARN       2
@@ -51,111 +51,101 @@
 #define RT_DEBUG_INFO       4
 #define RT_DEBUG_LOUD       5
 
-#define NIC_TAG             ((ULONG)'0682')
-#define NIC_DBG_STRING      ("**RT28xx**")
+#define NIC_TAG             ((unsigned long)'0682')
+#define NIC_DBG_char      ("**RT28xx**")
 
-#define RALINK_2883_VERSION		((UINT32)0x28830300)
-#define RALINK_2880E_VERSION	((UINT32)0x28720200)
-#define RALINK_3070_VERSION		((UINT32)0x30700200)
+#ifdef RTMP_MAC_USB
+#define TX_RING_SIZE            8	/* 1 */
+#define PRIO_RING_SIZE          8
+#define MGMT_RING_SIZE		32	/* PRIO_RING_SIZE */
+#define RX_RING_SIZE            8
+#define MAX_TX_PROCESS          4
+#define LOCAL_TXBUF_SIZE        2048
+#endif /* RTMP_MAC_USB // */
 
-//
-// NDIS version in use by the NIC driver.
-// The high byte is the major version. The low byte is the minor version.
-//
-#ifdef  NDIS51_MINIPORT
-#define NIC_DRIVER_VERSION      0x0501
-#else
-#define NIC_DRIVER_VERSION      0x0500
-#endif
+/*#define PACKED */
 
-//
-// NDIS media type, current is ethernet, change if native wireless supported
-//
-#define NIC_MEDIA_TYPE          NdisMedium802_3
-#define NIC_PCI_HDR_LENGTH      0xe2
-#define NIC_MAX_PACKET_SIZE     2304
-#define NIC_HEADER_SIZE         14
-#define MAX_MAP_REGISTERS_NEEDED 32
-#define MIN_MAP_REGISTERS_NEEDED 2   //Todo: should consider fragment issue.
-
-//
-// interface type, we use PCI
-//
-#define NIC_INTERFACE_TYPE      NdisInterfacePci
-#define NIC_INTERRUPT_MODE      NdisInterruptLevelSensitive
-
-//
-// buffer size passed in NdisMQueryAdapterResources
-// We should only need three adapter resources (IO, interrupt and memory),
-// Some devices get extra resources, so have room for 10 resources
-//                    UF_SIZE   (sizeof(NDIS_RESOURCE_LIST) + (10*sizeof(CM_PARTIAL_RESOURCE_DESCRIPTOR)))
-
-
-#define NIC_RESOURCE_B//
-// IO space length
-//
-#define NIC_MAP_IOSPACE_LENGTH  sizeof(CSR_STRUC)
+#define RALINK_2883_VERSION		((u32)0x28830300)
+#define RALINK_2880E_VERSION	((u32)0x28720200)
+#define RALINK_3070_VERSION		((u32)0x30700200)
 
 #define MAX_RX_PKT_LEN	1520
 
-//
-// Entry number for each DMA descriptor ring
-//
+/* */
+/* Entry number for each DMA descriptor ring */
+/* */
 
-#ifdef RT2860
-#define TX_RING_SIZE            64 //64
+#ifdef RTMP_MAC_PCI
+#define TX_RING_SIZE            64	/*64 */
 #define MGMT_RING_SIZE          128
-#define RX_RING_SIZE            128 //64
-#define MAX_TX_PROCESS          TX_RING_SIZE //8
+#define RX_RING_SIZE            128	/*64 */
+#define MAX_TX_PROCESS          TX_RING_SIZE	/*8 */
 #define MAX_DMA_DONE_PROCESS    TX_RING_SIZE
-#define MAX_TX_DONE_PROCESS     TX_RING_SIZE //8
+#define MAX_TX_DONE_PROCESS     TX_RING_SIZE	/*8 */
 #define LOCAL_TXBUF_SIZE        2
-#endif
-#ifdef RT2870
-#define TX_RING_SIZE            8 // 1
-#define PRIO_RING_SIZE          8
-#define MGMT_RING_SIZE       32 // PRIO_RING_SIZE
-#define RX_RING_SIZE            8
-#define MAX_TX_PROCESS          4
-#define LOCAL_TXBUF_SIZE        2048
-#endif // RT2870 //
+#endif /* RTMP_MAC_PCI // */
 
-#define MAX_RX_PROCESS          128 //64 //32
+#define MAX_RX_PROCESS          128	/*64 //32 */
 #define NUM_OF_LOCAL_TXBUF      2
 #define TXD_SIZE                16
 #define TXWI_SIZE               16
 #define RXD_SIZE               	16
 #define RXWI_SIZE             	16
-// TXINFO_SIZE + TXWI_SIZE + 802.11 Header Size + AMSDU sub frame header
-#define TX_DMA_1ST_BUFFER_SIZE  96    // only the 1st physical buffer is pre-allocated
-#define MGMT_DMA_BUFFER_SIZE    1536 //2048
-#define RX_BUFFER_AGGRESIZE     3840 //3904 //3968 //4096 //2048 //4096
-#define RX_BUFFER_NORMSIZE      3840 //3904 //3968 //4096 //2048 //4096
+/* TXINFO_SIZE + TXWI_SIZE + 802.11 Header Size + AMSDU sub frame header */
+#define TX_DMA_1ST_BUFFER_SIZE  96	/* only the 1st physical buffer is pre-allocated */
+#define MGMT_DMA_BUFFER_SIZE    1536	/*2048 */
+#define RX_BUFFER_AGGRESIZE     3840	/*3904 //3968 //4096 //2048 //4096 */
+#define RX_BUFFER_NORMSIZE      3840	/*3904 //3968 //4096 //2048 //4096 */
 #define TX_BUFFER_NORMSIZE		RX_BUFFER_NORMSIZE
-#define MAX_FRAME_SIZE          2346                    // Maximum 802.11 frame size
-#define MAX_AGGREGATION_SIZE    3840 //3904 //3968 //4096
+#define MAX_FRAME_SIZE          2346	/* Maximum 802.11 frame size */
+#define MAX_AGGREGATION_SIZE    3840	/*3904 //3968 //4096 */
 #define MAX_NUM_OF_TUPLE_CACHE  2
 #define MAX_MCAST_LIST_SIZE     32
 #define MAX_LEN_OF_VENDOR_DESC  64
-//#define MAX_SIZE_OF_MCAST_PSQ   (NUM_OF_LOCAL_TXBUF >> 2) // AP won't spend more than 1/4 of total buffers on M/BCAST PSQ
+/*#define MAX_SIZE_OF_MCAST_PSQ   (NUM_OF_LOCAL_TXBUF >> 2) // AP won't spend more than 1/4 of total buffers on M/BCAST PSQ */
 #define MAX_SIZE_OF_MCAST_PSQ               32
 
 #define MAX_RX_PROCESS_CNT	(RX_RING_SIZE)
 
+/*
+	WMM Note: If memory of your system is not much, please reduce the definition;
+	or when you do WMM test, the queue for low priority AC will be full, i.e.
+	TX_RING_SIZE + MAX_PACKETS_IN_QUEUE packets for the AC will be buffered in
+	WLAN, maybe no any packet buffer can be got in Ethernet driver.
+
+	Sometimes no packet buffer can be got in Ethernet driver, the system will
+	send flow control packet to the sender to slow down its sending rate.
+	So no WMM can be saw in the air.
+*/
+
+/*
+	Need to use 64 in vxworks for test case WMM A5-T07
+	Two dnlink (10Mbps) from a WMM station to a non-WMM station.
+	If use 256, queue is not enough.
+	And in rt_main_end.c, clConfig.clNum = RX_RING_SIZE * 3; is changed to
+	clConfig.clNum = RX_RING_SIZE * 4;
+*/
+/* TODO: For VxWorks the size is 256. Shall we cahnge the value as 256 for all OS????? */
+#define MAX_PACKETS_IN_QUEUE				(512)	/*(512)    // to pass WMM A5-WPAPSK */
 
-#define MAX_PACKETS_IN_QUEUE				(512) //(512)    // to pass WMM A5-WPAPSK
 #define MAX_PACKETS_IN_MCAST_PS_QUEUE		32
-#define MAX_PACKETS_IN_PS_QUEUE				128	//32
-#define WMM_NUM_OF_AC                       4  /* AC0, AC1, AC2, and AC3 */
+#define MAX_PACKETS_IN_PS_QUEUE				128	/*32 */
+#define WMM_NUM_OF_AC                       4	/* AC0, AC1, AC2, and AC3 */
 
+#ifdef RTMP_EFUSE_SUPPORT
+/*2008/09/11:KH add to support efuse<-- */
 #define MAX_EEPROM_BIN_FILE_SIZE					1024
+#define EFUSE_BUFFER_PATH						"/tmp/RT30xxEEPROM.bin"
+/*2008/09/11:KH add to support efuse--> */
+#endif /* RTMP_EFUSE_SUPPORT // */
 
-// RxFilter
+/* RxFilter */
 #define STANORMAL	 0x17f97
 #define APNORMAL	 0x15f97
-//
-//  RTMP_ADAPTER flags
-//
+#define PSPXLINK	 0x17f93
+/* */
+/*  struct rt_rtmp_adapter flags */
+/* */
 #define fRTMP_ADAPTER_MAP_REGISTER          0x00000001
 #define fRTMP_ADAPTER_INTERRUPT_IN_USE      0x00000002
 #define fRTMP_ADAPTER_HARDWARE_ERROR        0x00000004
@@ -181,13 +171,13 @@
 #define fRTMP_ADAPTER_SCAN_2040 			0x04000000
 #define	fRTMP_ADAPTER_RADIO_MEASUREMENT		0x08000000
 
-#define fRTMP_ADAPTER_START_UP         		0x10000000	//Devive already initialized and enabled Tx/Rx.
+#define fRTMP_ADAPTER_START_UP         		0x10000000	/*Devive already initialized and enabled Tx/Rx. */
 #define fRTMP_ADAPTER_MEDIA_STATE_CHANGE    0x20000000
 #define fRTMP_ADAPTER_IDLE_RADIO_OFF        0x40000000
 
-//
-//  STA operation status flags
-//
+/* */
+/*  STA operation status flags */
+/* */
 #define fOP_STATUS_INFRA_ON                 0x00000001
 #define fOP_STATUS_ADHOC_ON                 0x00000002
 #define fOP_STATUS_BG_PROTECTION_INUSED     0x00000004
@@ -197,28 +187,34 @@
 #define fOP_STATUS_MEDIA_STATE_CONNECTED    0x00000080
 #define fOP_STATUS_WMM_INUSED               0x00000100
 #define fOP_STATUS_AGGREGATION_INUSED       0x00000200
-#define fOP_STATUS_DOZE                     0x00000400  // debug purpose
-#define fOP_STATUS_PIGGYBACK_INUSED         0x00000800  // piggy-back, and aggregation
+#define fOP_STATUS_DOZE                     0x00000400	/* debug purpose */
+#define fOP_STATUS_PIGGYBACK_INUSED         0x00000800	/* piggy-back, and aggregation */
 #define fOP_STATUS_APSD_INUSED				0x00001000
 #define fOP_STATUS_TX_AMSDU_INUSED			0x00002000
 #define fOP_STATUS_MAX_RETRY_ENABLED		0x00004000
 #define fOP_STATUS_WAKEUP_NOW               0x00008000
-#define fOP_STATUS_ADVANCE_POWER_SAVE_PCIE_DEVICE       0x00020000
+#define fOP_STATUS_PCIE_DEVICE       0x00020000
+#define fOP_STATUS_ADVANCE_POWER_SAVE_PCIE_DEVICE fOP_STATUS_PCIE_DEVICE
 
-#ifdef RT2860
-//
-//  RTMP_ADAPTER PSFlags : related to advanced power save.
-//
-// Indicate whether driver can go to sleep mode from now. This flag is useful AFTER link up
+/* */
+/*  struct rt_rtmp_adapter PSFlags : related to advanced power save. */
+/* */
+/* Indicate whether driver can go to sleep mode from now. This flag is useful AFTER link up */
 #define fRTMP_PS_CAN_GO_SLEEP          0x00000001
-// Indicate whether driver has issue a LinkControl command to PCIe L1
+/* Indicate whether driver has issue a LinkControl command to PCIe L1 */
 #define fRTMP_PS_SET_PCI_CLK_OFF_COMMAND          0x00000002
-// Indicate driver should disable kick off hardware to send packets from now.
+/* Indicate driver should disable kick off hardware to send packets from now. */
 #define fRTMP_PS_DISABLE_TX         0x00000004
-// Indicate driver should IMMEDIATELY fo to sleep after receiving AP's beacon in which  doesn't indicate unicate nor multicast packets for me
-//. This flag is used ONLY in RTMPHandleRxDoneInterrupt routine.
+/* Indicate driver should IMMEDIATELY fo to sleep after receiving AP's beacon in which  doesn't indicate unicate nor multicast packets for me */
+/*. This flag is used ONLY in RTMPHandleRxDoneInterrupt routine. */
 #define fRTMP_PS_GO_TO_SLEEP_NOW         0x00000008
-#endif
+#define fRTMP_PS_TOGGLE_L1		0x00000010	/* Use Toggle L1 mechanism for rt28xx PCIe */
+
+#ifdef RT3090
+#define WAKE_MCU_CMD				0x31
+#define SLEEP_MCU_CMD					0x30
+#define RFOFF_MCU_CMD				0x35
+#endif /* RT3090 // */
 
 #define CCKSETPROTECT		0x1
 #define OFDMSETPROTECT		0x2
@@ -228,12 +224,12 @@
 #define GR40SETPROTECT		0x20
 #define ALLN_SETPROTECT		(GR40SETPROTECT | GF20SETPROTECT | MM40SETPROTECT | MM20SETPROTECT)
 
-//
-//  AP's client table operation status flags
-//
-#define fCLIENT_STATUS_WMM_CAPABLE          0x00000001  // CLIENT can parse QOS DATA frame
-#define fCLIENT_STATUS_AGGREGATION_CAPABLE  0x00000002  // CLIENT can receive Ralink's proprietary TX aggregation frame
-#define fCLIENT_STATUS_PIGGYBACK_CAPABLE    0x00000004  // CLIENT support piggy-back
+/* */
+/*  AP's client table operation status flags */
+/* */
+#define fCLIENT_STATUS_WMM_CAPABLE          0x00000001	/* CLIENT can parse QOS DATA frame */
+#define fCLIENT_STATUS_AGGREGATION_CAPABLE  0x00000002	/* CLIENT can receive Ralink's proprietary TX aggregation frame */
+#define fCLIENT_STATUS_PIGGYBACK_CAPABLE    0x00000004	/* CLIENT support piggy-back */
 #define fCLIENT_STATUS_AMSDU_INUSED			0x00000008
 #define fCLIENT_STATUS_SGI20_CAPABLE		0x00000010
 #define fCLIENT_STATUS_SGI40_CAPABLE		0x00000020
@@ -242,47 +238,48 @@
 #define fCLIENT_STATUS_HTC_CAPABLE			0x00000100
 #define fCLIENT_STATUS_RDG_CAPABLE			0x00000200
 #define fCLIENT_STATUS_MCSFEEDBACK_CAPABLE  0x00000400
-#define fCLIENT_STATUS_APSD_CAPABLE         0x00000800  /* UAPSD STATION */
+#define fCLIENT_STATUS_APSD_CAPABLE         0x00000800	/* UAPSD STATION */
 
 #define fCLIENT_STATUS_RALINK_CHIPSET		0x00100000
-//
-//  STA configuration flags
-//
+/* */
+/*  STA configuration flags */
+/* */
 
-// 802.11n Operating Mode Definition. 0-3 also used in ASICUPdateProtect switch case
+/* 802.11n Operating Mode Definition. 0-3 also used in ASICUPdateProtect switch case */
 #define HT_NO_PROTECT	0
 #define HT_LEGACY_PROTECT	1
 #define HT_40_PROTECT	2
 #define HT_2040_PROTECT	3
 #define HT_RTSCTS_6M	7
-//following is our own definition in order to turn on our ASIC protection register in INFRASTRUCTURE.
-#define HT_ATHEROS	8	// rt2860c has problem with atheros chip. we need to turn on RTS/CTS .
-#define HT_FORCERTSCTS	9	// Force turn on RTS/CTS first. then go to evaluate if this force RTS is necessary.
+/*following is our own definition in order to turn on our ASIC protection register in INFRASTRUCTURE. */
+#define HT_ATHEROS	8	/* rt2860c has problem with atheros chip. we need to turn on RTS/CTS . */
+#define HT_FORCERTSCTS	9	/* Force turn on RTS/CTS first. then go to evaluate if this force RTS is necessary. */
 
-//
-// RX Packet Filter control flags. Apply on pAd->PacketFilter
-//
+/* */
+/* RX Packet Filter control flags. Apply on pAd->PacketFilter */
+/* */
 #define fRX_FILTER_ACCEPT_DIRECT            NDIS_PACKET_TYPE_DIRECTED
 #define fRX_FILTER_ACCEPT_MULTICAST         NDIS_PACKET_TYPE_MULTICAST
 #define fRX_FILTER_ACCEPT_BROADCAST         NDIS_PACKET_TYPE_BROADCAST
 #define fRX_FILTER_ACCEPT_ALL_MULTICAST     NDIS_PACKET_TYPE_ALL_MULTICAST
+#define fRX_FILTER_ACCEPT_PROMISCUOUS       NDIS_PACKET_TYPE_PROMISCUOUS
 
-//
-// Error code section
-//
-// NDIS_ERROR_CODE_ADAPTER_NOT_FOUND
+/* */
+/* Error code section */
+/* */
+/* NDIS_ERROR_CODE_ADAPTER_NOT_FOUND */
 #define ERRLOG_READ_PCI_SLOT_FAILED     0x00000101L
 #define ERRLOG_WRITE_PCI_SLOT_FAILED    0x00000102L
 #define ERRLOG_VENDOR_DEVICE_NOMATCH    0x00000103L
 
-// NDIS_ERROR_CODE_ADAPTER_DISABLED
+/* NDIS_ERROR_CODE_ADAPTER_DISABLED */
 #define ERRLOG_BUS_MASTER_DISABLED      0x00000201L
 
-// NDIS_ERROR_CODE_UNSUPPORTED_CONFIGURATION
+/* NDIS_ERROR_CODE_UNSUPPORTED_CONFIGURATION */
 #define ERRLOG_INVALID_SPEED_DUPLEX     0x00000301L
 #define ERRLOG_SET_SECONDARY_FAILED     0x00000302L
 
-// NDIS_ERROR_CODE_OUT_OF_RESOURCES
+/* NDIS_ERROR_CODE_OUT_OF_RESOURCES */
 #define ERRLOG_OUT_OF_MEMORY            0x00000401L
 #define ERRLOG_OUT_OF_SHARED_MEMORY     0x00000402L
 #define ERRLOG_OUT_OF_MAP_REGISTERS     0x00000403L
@@ -292,22 +289,21 @@
 #define ERRLOG_OUT_OF_NDIS_PACKET       0x00000407L
 #define ERRLOG_OUT_OF_LOOKASIDE_MEMORY  0x00000408L
 
-// NDIS_ERROR_CODE_HARDWARE_FAILURE
+/* NDIS_ERROR_CODE_HARDWARE_FAILURE */
 #define ERRLOG_SELFTEST_FAILED          0x00000501L
 #define ERRLOG_INITIALIZE_ADAPTER       0x00000502L
 #define ERRLOG_REMOVE_MINIPORT          0x00000503L
 
-// NDIS_ERROR_CODE_RESOURCE_CONFLICT
+/* NDIS_ERROR_CODE_RESOURCE_CONFLICT */
 #define ERRLOG_MAP_IO_SPACE             0x00000601L
 #define ERRLOG_QUERY_ADAPTER_RESOURCES  0x00000602L
 #define ERRLOG_NO_IO_RESOURCE           0x00000603L
 #define ERRLOG_NO_INTERRUPT_RESOURCE    0x00000604L
 #define ERRLOG_NO_MEMORY_RESOURCE       0x00000605L
 
-
-// WDS definition
+/* WDS definition */
 #define	MAX_WDS_ENTRY               4
-#define WDS_PAIRWISE_KEY_OFFSET     60    // WDS links uses pairwise key#60 ~ 63 in ASIC pairwise key table
+#define WDS_PAIRWISE_KEY_OFFSET     60	/* WDS links uses pairwise key#60 ~ 63 in ASIC pairwise key table */
 
 #define	WDS_DISABLE_MODE            0
 #define	WDS_RESTRICT_MODE           1
@@ -315,23 +311,20 @@
 #define	WDS_REPEATER_MODE           3
 #define	WDS_LAZY_MODE               4
 
-
 #define MAX_MESH_NUM				0
 
 #define MAX_APCLI_NUM				0
 
 #define MAX_MBSSID_NUM				1
-#if defined(RT2860) || defined(RT30xx)
 #ifdef MBSS_SUPPORT
 #undef	MAX_MBSSID_NUM
 #define MAX_MBSSID_NUM				(8 - MAX_MESH_NUM - MAX_APCLI_NUM)
-#endif // MBSS_SUPPORT //
-#endif
+#endif /* MBSS_SUPPORT // */
 
 /* sanity check for apidx */
 #define MBSS_MR_APIDX_SANITY_CHECK(apidx) \
     { if (apidx > MAX_MBSSID_NUM) { \
-          printk("%s> Error! apidx = %d > MAX_MBSSID_NUM!\n", __func__, apidx); \
+          DBGPRINT(RT_DEBUG_ERROR, ("%s> Error! apidx = %d > MAX_MBSSID_NUM!\n", __func__, apidx)); \
 	  apidx = MAIN_MBSSID; } }
 
 #define VALID_WCID(_wcid)	((_wcid) > 0 && (_wcid) < MAX_LEN_OF_MAC_TABLE )
@@ -339,12 +332,11 @@
 #define MAIN_MBSSID                 0
 #define FIRST_MBSSID                1
 
-
 #define MAX_BEACON_SIZE				512
-// If the MAX_MBSSID_NUM is larger than 6,
-// it shall reserve some WCID space(wcid 222~253) for beacon frames.
-// -	these wcid 238~253 are reserved for beacon#6(ra6).
-// -	these wcid 222~237 are reserved for beacon#7(ra7).
+/* If the MAX_MBSSID_NUM is larger than 6, */
+/* it shall reserve some WCID space(wcid 222~253) for beacon frames. */
+/* -    these wcid 238~253 are reserved for beacon#6(ra6). */
+/* -    these wcid 222~237 are reserved for beacon#7(ra7). */
 #if defined(MAX_MBSSID_NUM) && (MAX_MBSSID_NUM == 8)
 #define HW_RESERVED_WCID	222
 #elif defined(MAX_MBSSID_NUM) && (MAX_MBSSID_NUM == 7)
@@ -353,17 +345,17 @@
 #define HW_RESERVED_WCID	255
 #endif
 
-// Then dedicate wcid of DFS and Carrier-Sense.
+/* Then dedicate wcid of DFS and Carrier-Sense. */
 #define DFS_CTS_WCID 		(HW_RESERVED_WCID - 1)
 #define CS_CTS_WCID 		(HW_RESERVED_WCID - 2)
 #define LAST_SPECIFIC_WCID	(HW_RESERVED_WCID - 2)
 
-// If MAX_MBSSID_NUM is 8, the maximum available wcid for the associated STA is 211.
-// If MAX_MBSSID_NUM is 7, the maximum available wcid for the associated STA is 228.
+/* If MAX_MBSSID_NUM is 8, the maximum available wcid for the associated STA is 211. */
+/* If MAX_MBSSID_NUM is 7, the maximum available wcid for the associated STA is 228. */
 #define MAX_AVAILABLE_CLIENT_WCID	(LAST_SPECIFIC_WCID - MAX_MBSSID_NUM - 1)
 
-// TX need WCID to find Cipher Key
-// these wcid 212 ~ 219 are reserved for bc/mc packets if MAX_MBSSID_NUM is 8.
+/* TX need WCID to find Cipher Key */
+/* these wcid 212 ~ 219 are reserved for bc/mc packets if MAX_MBSSID_NUM is 8. */
 #define GET_GroupKey_WCID(__wcid, __bssidx) \
 	{										\
 		__wcid = LAST_SPECIFIC_WCID - (MAX_MBSSID_NUM) + __bssidx;	\
@@ -371,8 +363,7 @@
 
 #define IsGroupKeyWCID(__wcid) (((__wcid) < LAST_SPECIFIC_WCID) && ((__wcid) >= (LAST_SPECIFIC_WCID - (MAX_MBSSID_NUM))))
 
-
-// definition to support multiple BSSID
+/* definition to support multiple BSSID */
 #define BSS0                            0
 #define BSS1                            1
 #define BSS2                            2
@@ -382,26 +373,26 @@
 #define BSS6                            6
 #define BSS7                            7
 
-
-//============================================================
-// Length definitions
+/*============================================================ */
+/* Length definitions */
 #define PEER_KEY_NO                     2
 #define MAC_ADDR_LEN                    6
 #define TIMESTAMP_LEN                   8
-#define MAX_LEN_OF_SUPPORTED_RATES      MAX_LENGTH_OF_SUPPORT_RATES // 1, 2, 5.5, 11, 6, 9, 12, 18, 24, 36, 48, 54
-#define MAX_LEN_OF_KEY                  32      // 32 octets == 256 bits, Redefine for WPA
-#define MAX_NUM_OF_CHANNELS             MAX_NUM_OF_CHS      // 14 channels @2.4G +  12@UNII + 4 @MMAC + 11 @HiperLAN2 + 7 @Japan + 1 as NULL termination
-#define MAX_NUM_OF_11JCHANNELS             20      // 14 channels @2.4G +  12@UNII + 4 @MMAC + 11 @HiperLAN2 + 7 @Japan + 1 as NULL termination
+#define MAX_LEN_OF_SUPPORTED_RATES      MAX_LENGTH_OF_SUPPORT_RATES	/* 1, 2, 5.5, 11, 6, 9, 12, 18, 24, 36, 48, 54 */
+#define MAX_LEN_OF_KEY                  32	/* 32 octets == 256 bits, Redefine for WPA */
+#define MAX_NUM_OF_CHANNELS             MAX_NUM_OF_CHS	/* 14 channels @2.4G +  12@UNII + 4 @MMAC + 11 @HiperLAN2 + 7 @Japan + 1 as NULL termination */
+#define MAX_NUM_OF_11JCHANNELS             20	/* 14 channels @2.4G +  12@UNII + 4 @MMAC + 11 @HiperLAN2 + 7 @Japan + 1 as NULL termination */
 #define MAX_LEN_OF_SSID                 32
 #define CIPHER_TEXT_LEN                 128
 #define HASH_TABLE_SIZE                 256
-#define MAX_VIE_LEN                     1024   // New for WPA cipher suite variable IE sizes.
+#define MAX_VIE_LEN                     1024	/* New for WPA cipher suite variable IE sizes. */
 #define MAX_SUPPORT_MCS             32
+#define MAX_NUM_OF_BBP_LATCH             140
 
-//============================================================
-// ASIC WCID Table definition.
-//============================================================
-#define BSSID_WCID		1	// in infra mode, always put bssid with this WCID
+/*============================================================ */
+/* ASIC WCID Table definition. */
+/*============================================================ */
+#define BSSID_WCID		1	/* in infra mode, always put bssid with this WCID */
 #define MCAST_WCID	0x0
 #define BSS0Mcast_WCID	0x0
 #define BSS1Mcast_WCID	0xf8
@@ -415,10 +406,10 @@
 
 #define MAX_NUM_OF_ACL_LIST				MAX_NUMBER_OF_ACL
 
-#define MAX_LEN_OF_MAC_TABLE            MAX_NUMBER_OF_MAC // if MAX_MBSSID_NUM is 8, this value can't be larger than 211
+#define MAX_LEN_OF_MAC_TABLE            MAX_NUMBER_OF_MAC	/* if MAX_MBSSID_NUM is 8, this value can't be larger than 211 */
 
 #if MAX_LEN_OF_MAC_TABLE>MAX_AVAILABLE_CLIENT_WCID
-#error MAX_LEN_OF_MAC_TABLE can not be larger than MAX_AVAILABLE_CLIENT_WCID!!!!
+#error MAX_LEN_OF_MAC_TABLE can not be larger than MAX_AVAILABLE_CLIENT_WCID!
 #endif
 
 #define MAX_NUM_OF_WDS_LINK_PERBSSID	            3
@@ -428,42 +419,41 @@
 
 #define NUM_OF_TID			8
 #define MAX_AID_BA                    4
-#define MAX_LEN_OF_BA_REC_TABLE          ((NUM_OF_TID * MAX_LEN_OF_MAC_TABLE)/2)//   (NUM_OF_TID*MAX_AID_BA + 32)	 //Block ACK recipient
-#define MAX_LEN_OF_BA_ORI_TABLE          ((NUM_OF_TID * MAX_LEN_OF_MAC_TABLE)/2)//   (NUM_OF_TID*MAX_AID_BA + 32)   // Block ACK originator
+#define MAX_LEN_OF_BA_REC_TABLE          ((NUM_OF_TID * MAX_LEN_OF_MAC_TABLE)/2)	/*   (NUM_OF_TID*MAX_AID_BA + 32)        //Block ACK recipient */
+#define MAX_LEN_OF_BA_ORI_TABLE          ((NUM_OF_TID * MAX_LEN_OF_MAC_TABLE)/2)	/*   (NUM_OF_TID*MAX_AID_BA + 32)   // Block ACK originator */
 #define MAX_LEN_OF_BSS_TABLE             64
 #define MAX_REORDERING_MPDU_NUM			 512
 
-// key related definitions
+/* key related definitions */
 #define SHARE_KEY_NUM                   4
-#define MAX_LEN_OF_SHARE_KEY            16    // byte count
-#define MAX_LEN_OF_PEER_KEY             16    // byte count
-#define PAIRWISE_KEY_NUM                64    // in MAC ASIC pairwise key table
+#define MAX_LEN_OF_SHARE_KEY            16	/* byte count */
+#define MAX_LEN_OF_PEER_KEY             16	/* byte count */
+#define PAIRWISE_KEY_NUM                64	/* in MAC ASIC pairwise key table */
 #define GROUP_KEY_NUM                   4
 #define PMK_LEN                         32
-#define WDS_PAIRWISE_KEY_OFFSET         60    // WDS links uses pairwise key#60 ~ 63 in ASIC pairwise key table
-#define	PMKID_NO                        4     // Number of PMKID saved supported
+#define WDS_PAIRWISE_KEY_OFFSET         60	/* WDS links uses pairwise key#60 ~ 63 in ASIC pairwise key table */
+#define	PMKID_NO                        4	/* Number of PMKID saved supported */
 #define MAX_LEN_OF_MLME_BUFFER          2048
 
-// power status related definitions
+/* power status related definitions */
 #define PWR_ACTIVE                      0
 #define PWR_SAVE                        1
-#define PWR_MMPS                        2			//MIMO power save
+#define PWR_MMPS                        2	/*MIMO power save */
 
-// Auth and Assoc mode related definitions
+/* Auth and Assoc mode related definitions */
 #define AUTH_MODE_OPEN                  0x00
 #define AUTH_MODE_KEY                   0x01
 
-// BSS Type definitions
-#define BSS_ADHOC                       0  // = Ndis802_11IBSS
-#define BSS_INFRA                       1  // = Ndis802_11Infrastructure
-#define BSS_ANY                         2  // = Ndis802_11AutoUnknown
-#define BSS_MONITOR			            3  // = Ndis802_11Monitor
-
+/* BSS Type definitions */
+#define BSS_ADHOC                       0	/* = Ndis802_11IBSS */
+#define BSS_INFRA                       1	/* = Ndis802_11Infrastructure */
+#define BSS_ANY                         2	/* = Ndis802_11AutoUnknown */
+#define BSS_MONITOR			            3	/* = Ndis802_11Monitor */
 
-// Reason code definitions
+/* Reason code definitions */
 #define REASON_RESERVED                 0
 #define REASON_UNSPECIFY                1
-#define REASON_NO_LONGER_VALID          2
+#define REASON_NO_longER_VALID          2
 #define REASON_DEAUTH_STA_LEAVING       3
 #define REASON_DISASSOC_INACTIVE        4
 #define REASON_DISASSPC_AP_UNABLE       5
@@ -495,7 +485,7 @@
 #define REASON_QOS_REQUEST_TIMEOUT        39
 #define REASON_QOS_CIPHER_NOT_SUPPORT     45
 
-// Status code definitions
+/* Status code definitions */
 #define MLME_SUCCESS                    0
 #define MLME_UNSPECIFY_FAIL             1
 #define MLME_CANNOT_SUPPORT_CAP         10
@@ -515,6 +505,9 @@
 #define MLME_QOS_UNSPECIFY                32
 #define MLME_REQUEST_DECLINED             37
 #define MLME_REQUEST_WITH_INVALID_PARAM   38
+#define MLME_INVALID_GROUP_CIPHER	  41
+#define MLME_INVALID_PAIRWISE_CIPHER	  42
+#define MLME_INVALID_AKMP			  43
 #define MLME_DLS_NOT_ALLOW_IN_QBSS        48
 #define MLME_DEST_STA_NOT_IN_QBSS         49
 #define MLME_DEST_STA_IS_NOT_A_QSTA       50
@@ -524,7 +517,7 @@
 #define MLME_STATE_MACHINE_REJECT       0x53
 #define MLME_MAC_TABLE_FAIL             0x54
 
-// IE code
+/* IE code */
 #define IE_SSID                         0
 #define IE_SUPP_RATES                   1
 #define IE_FH_PARM                      2
@@ -532,94 +525,95 @@
 #define IE_CF_PARM                      4
 #define IE_TIM                          5
 #define IE_IBSS_PARM                    6
-#define IE_COUNTRY                      7     // 802.11d
-#define IE_802_11D_REQUEST              10    // 802.11d
-#define IE_QBSS_LOAD                    11    // 802.11e d9
-#define IE_EDCA_PARAMETER               12    // 802.11e d9
-#define IE_TSPEC                        13    // 802.11e d9
-#define IE_TCLAS                        14    // 802.11e d9
-#define IE_SCHEDULE                     15    // 802.11e d9
+#define IE_COUNTRY                      7	/* 802.11d */
+#define IE_802_11D_REQUEST              10	/* 802.11d */
+#define IE_QBSS_LOAD                    11	/* 802.11e d9 */
+#define IE_EDCA_PARAMETER               12	/* 802.11e d9 */
+#define IE_TSPEC                        13	/* 802.11e d9 */
+#define IE_TCLAS                        14	/* 802.11e d9 */
+#define IE_SCHEDULE                     15	/* 802.11e d9 */
 #define IE_CHALLENGE_TEXT               16
-#define IE_POWER_CONSTRAINT             32    // 802.11h d3.3
-#define IE_POWER_CAPABILITY             33    // 802.11h d3.3
-#define IE_TPC_REQUEST                  34    // 802.11h d3.3
-#define IE_TPC_REPORT                   35    // 802.11h d3.3
-#define IE_SUPP_CHANNELS                36    // 802.11h d3.3
-#define IE_CHANNEL_SWITCH_ANNOUNCEMENT  37    // 802.11h d3.3
-#define IE_MEASUREMENT_REQUEST          38    // 802.11h d3.3
-#define IE_MEASUREMENT_REPORT           39    // 802.11h d3.3
-#define IE_QUIET                        40    // 802.11h d3.3
-#define IE_IBSS_DFS                     41    // 802.11h d3.3
-#define IE_ERP                          42    // 802.11g
-#define IE_TS_DELAY                     43    // 802.11e d9
-#define IE_TCLAS_PROCESSING             44    // 802.11e d9
-#define IE_QOS_CAPABILITY               46    // 802.11e d6
-#define IE_HT_CAP                       45    // 802.11n d1. HT CAPABILITY. ELEMENT ID TBD
-#define IE_AP_CHANNEL_REPORT			51    // 802.11k d6
-#define IE_HT_CAP2                         52    // 802.11n d1. HT CAPABILITY. ELEMENT ID TBD
-#define IE_RSN                          48    // 802.11i d3.0
-#define IE_WPA2                         48    // WPA2
-#define IE_EXT_SUPP_RATES               50    // 802.11g
-#define IE_SUPP_REG_CLASS               59    // 802.11y. Supported regulatory classes.
-#define IE_EXT_CHANNEL_SWITCH_ANNOUNCEMENT	60	// 802.11n
-#define IE_ADD_HT                         61    // 802.11n d1. ADDITIONAL HT CAPABILITY. ELEMENT ID TBD
-#define IE_ADD_HT2                        53    // 802.11n d1. ADDITIONAL HT CAPABILITY. ELEMENT ID TBD
-
-
-// For 802.11n D3.03
-//#define IE_NEW_EXT_CHA_OFFSET             62    // 802.11n d1. New extension channel offset elemet
-#define IE_SECONDARY_CH_OFFSET		62	// 802.11n D3.03	Secondary Channel Offset element
-#define IE_2040_BSS_COEXIST               72    // 802.11n D3.0.3
-#define IE_2040_BSS_INTOLERANT_REPORT     73    // 802.11n D3.03
-#define IE_OVERLAPBSS_SCAN_PARM           74    // 802.11n D3.03
-#define IE_EXT_CAPABILITY                127   // 802.11n D3.03
-
-
-#define IE_WPA                          221   // WPA
-#define IE_VENDOR_SPECIFIC              221   // Wifi WMM (WME)
-
-#define OUI_BROADCOM_HT              51   //
-#define OUI_BROADCOM_HTADD              52   //
-#define OUI_PREN_HT_CAP              51   //
-#define OUI_PREN_ADD_HT              52   //
-
-// CCX information
-#define IE_AIRONET_CKIP                 133   // CCX1.0 ID 85H for CKIP
-#define IE_AP_TX_POWER                  150   // CCX 2.0 for AP transmit power
-#define IE_MEASUREMENT_CAPABILITY       221   // CCX 2.0
+#define IE_POWER_CONSTRAint             32	/* 802.11h d3.3 */
+#define IE_POWER_CAPABILITY             33	/* 802.11h d3.3 */
+#define IE_TPC_REQUEST                  34	/* 802.11h d3.3 */
+#define IE_TPC_REPORT                   35	/* 802.11h d3.3 */
+#define IE_SUPP_CHANNELS                36	/* 802.11h d3.3 */
+#define IE_CHANNEL_SWITCH_ANNOUNCEMENT  37	/* 802.11h d3.3 */
+#define IE_MEASUREMENT_REQUEST          38	/* 802.11h d3.3 */
+#define IE_MEASUREMENT_REPORT           39	/* 802.11h d3.3 */
+#define IE_QUIET                        40	/* 802.11h d3.3 */
+#define IE_IBSS_DFS                     41	/* 802.11h d3.3 */
+#define IE_ERP                          42	/* 802.11g */
+#define IE_TS_DELAY                     43	/* 802.11e d9 */
+#define IE_TCLAS_PROCESSING             44	/* 802.11e d9 */
+#define IE_QOS_CAPABILITY               46	/* 802.11e d6 */
+#define IE_HT_CAP                       45	/* 802.11n d1. HT CAPABILITY. ELEMENT ID TBD */
+#define IE_AP_CHANNEL_REPORT			51	/* 802.11k d6 */
+#define IE_HT_CAP2                         52	/* 802.11n d1. HT CAPABILITY. ELEMENT ID TBD */
+#define IE_RSN                          48	/* 802.11i d3.0 */
+#define IE_WPA2                         48	/* WPA2 */
+#define IE_EXT_SUPP_RATES               50	/* 802.11g */
+#define IE_SUPP_REG_CLASS               59	/* 802.11y. Supported regulatory classes. */
+#define IE_EXT_CHANNEL_SWITCH_ANNOUNCEMENT	60	/* 802.11n */
+#define IE_ADD_HT                         61	/* 802.11n d1. ADDITIONAL HT CAPABILITY. ELEMENT ID TBD */
+#define IE_ADD_HT2                        53	/* 802.11n d1. ADDITIONAL HT CAPABILITY. ELEMENT ID TBD */
+
+/* For 802.11n D3.03 */
+/*#define IE_NEW_EXT_CHA_OFFSET             62    // 802.11n d1. New extension channel offset elemet */
+#define IE_SECONDARY_CH_OFFSET		62	/* 802.11n D3.03        Secondary Channel Offset element */
+#define IE_WAPI							68	/* WAPI information element */
+#define IE_2040_BSS_COEXIST               72	/* 802.11n D3.0.3 */
+#define IE_2040_BSS_INTOLERANT_REPORT     73	/* 802.11n D3.03 */
+#define IE_OVERLAPBSS_SCAN_PARM           74	/* 802.11n D3.03 */
+#define IE_EXT_CAPABILITY                127	/* 802.11n D3.03 */
+
+#define IE_WPA                          221	/* WPA */
+#define IE_VENDOR_SPECIFIC              221	/* Wifi WMM (WME) */
+
+#define OUI_BROADCOM_HT              51	/* */
+#define OUI_BROADCOM_HTADD              52	/* */
+#define OUI_PREN_HT_CAP              51	/* */
+#define OUI_PREN_ADD_HT              52	/* */
+
+/* CCX information */
+#define IE_AIRONET_CKIP                 133	/* CCX1.0 ID 85H for CKIP */
+#define IE_AP_TX_POWER                  150	/* CCX 2.0 for AP transmit power */
+#define IE_MEASUREMENT_CAPABILITY       221	/* CCX 2.0 */
 #define IE_CCX_V2                       221
-#define IE_AIRONET_IPADDRESS            149   // CCX ID 95H for IP Address
-#define IE_AIRONET_CCKMREASSOC          156   // CCX ID 9CH for CCKM Reassociation Request element
+#define IE_AIRONET_IPADDRESS            149	/* CCX ID 95H for IP Address */
+#define IE_AIRONET_CCKMREASSOC          156	/* CCX ID 9CH for CCKM Reassociation Request element */
 #define CKIP_NEGOTIATION_LENGTH         30
 #define AIRONET_IPADDRESS_LENGTH        10
 #define AIRONET_CCKMREASSOC_LENGTH      24
 
-// ========================================================
-// MLME state machine definition
-// ========================================================
+/* ======================================================== */
+/* MLME state machine definition */
+/* ======================================================== */
 
-// STA MLME state mahcines
+/* STA MLME state mahcines */
 #define ASSOC_STATE_MACHINE             1
 #define AUTH_STATE_MACHINE              2
 #define AUTH_RSP_STATE_MACHINE          3
 #define SYNC_STATE_MACHINE              4
 #define MLME_CNTL_STATE_MACHINE         5
 #define WPA_PSK_STATE_MACHINE           6
-#define LEAP_STATE_MACHINE              7
+/*#define LEAP_STATE_MACHINE              7 */
 #define AIRONET_STATE_MACHINE           8
 #define ACTION_STATE_MACHINE           9
 
-// AP MLME state machines
+/* AP MLME state machines */
 #define AP_ASSOC_STATE_MACHINE          11
 #define AP_AUTH_STATE_MACHINE           12
-#define AP_AUTH_RSP_STATE_MACHINE       13
 #define AP_SYNC_STATE_MACHINE           14
 #define AP_CNTL_STATE_MACHINE           15
-#define AP_WPA_STATE_MACHINE            16
+#define WSC_STATE_MACHINE            17
+#define WSC_UPNP_STATE_MACHINE		    18
+
+#define WPA_STATE_MACHINE			23
 
-//
-// STA's CONTROL/CONNECT state machine: states, events, total function #
-//
+/* */
+/* STA's CONTROL/CONNECT state machine: states, events, total function # */
+/* */
 #define CNTL_IDLE                       0
 #define CNTL_WAIT_DISASSOC              1
 #define CNTL_WAIT_JOIN                  2
@@ -630,9 +624,9 @@
 #define CNTL_WAIT_AUTH2                 7
 #define CNTL_WAIT_OID_LIST_SCAN         8
 #define CNTL_WAIT_OID_DISASSOC          9
-#ifdef RT2870
+#ifdef RTMP_MAC_USB
 #define CNTL_WAIT_SCAN_FOR_CONNECT      10
-#endif // RT2870 //
+#endif /* RTMP_MAC_USB // */
 
 #define MT2_ASSOC_CONF                  34
 #define MT2_AUTH_CONF                   35
@@ -646,13 +640,14 @@
 #define MT2_GET_CONF                    43
 #define MT2_SET_CONF                    44
 #define MT2_RESET_CONF                  45
+#define MT2_FT_OTD_CONF					46
 #define MT2_MLME_ROAMING_REQ            52
 
 #define CNTL_FUNC_SIZE                  1
 
-//
-// STA's ASSOC state machine: states, events, total function #
-//
+/* */
+/* STA's ASSOC state machine: states, events, total function # */
+/* */
 #define ASSOC_IDLE                      0
 #define ASSOC_WAIT_RSP                  1
 #define REASSOC_WAIT_RSP                2
@@ -675,24 +670,26 @@
 
 #define ASSOC_FUNC_SIZE                 (MAX_ASSOC_STATE * MAX_ASSOC_MSG)
 
-//
-// ACT state machine: states, events, total function #
-//
+/* */
+/* ACT state machine: states, events, total function # */
+/* */
 #define ACT_IDLE                      0
 #define MAX_ACT_STATE                 1
 
 #define ACT_MACHINE_BASE              0
 
-//Those PEER_xx_CATE number is based on real Categary value in IEEE spec. Please don'es modify it by your self.
-//Category
+/*Those PEER_xx_CATE number is based on real Categary value in IEEE spec. Please don'es modify it by your self. */
+/*Category */
 #define MT2_PEER_SPECTRUM_CATE              0
 #define MT2_PEER_QOS_CATE              1
 #define MT2_PEER_DLS_CATE             2
 #define MT2_PEER_BA_CATE             3
 #define MT2_PEER_PUBLIC_CATE             4
 #define MT2_PEER_RM_CATE             5
-#define MT2_PEER_HT_CATE             7	//	7.4.7
+/* "FT_CATEGORY_BSS_TRANSITION equal to 6" is defined file of "dot11r_ft.h" */
+#define MT2_PEER_HT_CATE             7	/*      7.4.7 */
 #define MAX_PEER_CATE_MSG                   7
+
 #define MT2_MLME_ADD_BA_CATE             8
 #define MT2_MLME_ORI_DELBA_CATE             9
 #define MT2_MLME_REC_DELBA_CATE             10
@@ -701,7 +698,7 @@
 #define MT2_ACT_INVALID             13
 #define MAX_ACT_MSG                   14
 
-//Category field
+/*Category field */
 #define CATEGORY_SPECTRUM		0
 #define CATEGORY_QOS			1
 #define CATEGORY_DLS			2
@@ -710,38 +707,35 @@
 #define CATEGORY_RM			5
 #define CATEGORY_HT			7
 
-
-// DLS Action frame definition
+/* DLS Action frame definition */
 #define ACTION_DLS_REQUEST			0
 #define ACTION_DLS_RESPONSE			1
 #define ACTION_DLS_TEARDOWN			2
 
-//Spectrum  Action field value 802.11h 7.4.1
-#define SPEC_MRQ	0	// Request
-#define SPEC_MRP	1	//Report
+/*Spectrum  Action field value 802.11h 7.4.1 */
+#define SPEC_MRQ	0	/* Request */
+#define SPEC_MRP	1	/*Report */
 #define SPEC_TPCRQ	2
 #define SPEC_TPCRP	3
 #define SPEC_CHANNEL_SWITCH	4
 
-
-//BA  Action field value
+/*BA  Action field value */
 #define ADDBA_REQ	0
 #define ADDBA_RESP	1
 #define DELBA   2
 
-//Public's  Action field value in Public Category.  Some in 802.11y and some in 11n
-#define ACTION_BSS_2040_COEXIST				0	// 11n
-#define ACTION_DSE_ENABLEMENT					1	// 11y D9.0
-#define ACTION_DSE_DEENABLEMENT				2	// 11y D9.0
-#define ACTION_DSE_REG_LOCATION_ANNOUNCE	3	// 11y D9.0
-#define ACTION_EXT_CH_SWITCH_ANNOUNCE		4	// 11y D9.0
-#define ACTION_DSE_MEASUREMENT_REQ			5	// 11y D9.0
-#define ACTION_DSE_MEASUREMENT_REPORT		6	// 11y D9.0
-#define ACTION_MEASUREMENT_PILOT_ACTION		7  	// 11y D9.0
-#define ACTION_DSE_POWER_CONSTRAINT			8	// 11y D9.0
-
-
-//HT  Action field value
+/*Public's  Action field value in Public Category.  Some in 802.11y and some in 11n */
+#define ACTION_BSS_2040_COEXIST				0	/* 11n */
+#define ACTION_DSE_ENABLEMENT					1	/* 11y D9.0 */
+#define ACTION_DSE_DEENABLEMENT				2	/* 11y D9.0 */
+#define ACTION_DSE_REG_LOCATION_ANNOUNCE	3	/* 11y D9.0 */
+#define ACTION_EXT_CH_SWITCH_ANNOUNCE		4	/* 11y D9.0 */
+#define ACTION_DSE_MEASUREMENT_REQ			5	/* 11y D9.0 */
+#define ACTION_DSE_MEASUREMENT_REPORT		6	/* 11y D9.0 */
+#define ACTION_MEASUREMENT_PILOT_ACTION		7	/* 11y D9.0 */
+#define ACTION_DSE_POWER_CONSTRAINT			8	/* 11y D9.0 */
+
+/*HT  Action field value */
 #define NOTIFY_BW_ACTION				0
 #define SMPS_ACTION						1
 #define PSMP_ACTION   					2
@@ -753,9 +747,9 @@
 #define HT_INFO_EXCHANGE				8
 
 #define ACT_FUNC_SIZE                 (MAX_ACT_STATE * MAX_ACT_MSG)
-//
-// STA's AUTHENTICATION state machine: states, evvents, total function #
-//
+/* */
+/* STA's AUTHENTICATION state machine: states, evvents, total function # */
+/* */
 #define AUTH_REQ_IDLE                   0
 #define AUTH_WAIT_SEQ2                  1
 #define AUTH_WAIT_SEQ4                  2
@@ -769,9 +763,9 @@
 
 #define AUTH_FUNC_SIZE                  (MAX_AUTH_STATE * MAX_AUTH_MSG)
 
-//
-// STA's AUTH_RSP state machine: states, events, total function #
-//
+/* */
+/* STA's AUTH_RSP state machine: states, events, total function # */
+/* */
 #define AUTH_RSP_IDLE                   0
 #define AUTH_RSP_WAIT_CHAL              1
 #define MAX_AUTH_RSP_STATE              2
@@ -784,10 +778,10 @@
 
 #define AUTH_RSP_FUNC_SIZE              (MAX_AUTH_RSP_STATE * MAX_AUTH_RSP_MSG)
 
-//
-// STA's SYNC state machine: states, events, total function #
-//
-#define SYNC_IDLE                       0  // merge NO_BSS,IBSS_IDLE,IBSS_ACTIVE and BSS in to 1 state
+/* */
+/* STA's SYNC state machine: states, events, total function # */
+/* */
+#define SYNC_IDLE                       0	/* merge NO_BSS,IBSS_IDLE,IBSS_ACTIVE and BSS in to 1 state */
 #define JOIN_WAIT_BEACON                1
 #define SCAN_LISTEN                     2
 #define MAX_SYNC_STATE                  3
@@ -807,7 +801,7 @@
 
 #define SYNC_FUNC_SIZE                  (MAX_SYNC_STATE * MAX_SYNC_MSG)
 
-//Messages for the DLS state machine
+/*Messages for the DLS state machine */
 #define DLS_IDLE						0
 #define MAX_DLS_STATE					1
 
@@ -821,45 +815,18 @@
 
 #define DLS_FUNC_SIZE					(MAX_DLS_STATE * MAX_DLS_MSG)
 
-//
-// STA's WPA-PSK State machine: states, events, total function #
-//
-#define WPA_PSK_IDLE					0
-#define MAX_WPA_PSK_STATE				1
-
-#define WPA_MACHINE_BASE                0
-#define MT2_EAPPacket                   0
-#define MT2_EAPOLStart                  1
-#define MT2_EAPOLLogoff                 2
-#define MT2_EAPOLKey                    3
-#define MT2_EAPOLASFAlert               4
-#define MAX_WPA_PSK_MSG                 5
-
-#define	WPA_PSK_FUNC_SIZE				(MAX_WPA_PSK_STATE * MAX_WPA_PSK_MSG)
-
-//
-// STA's CISCO-AIRONET State machine: states, events, total function #
-//
-#define AIRONET_IDLE					0
-#define	AIRONET_SCANNING				1
-#define MAX_AIRONET_STATE				2
-
-#define AIRONET_MACHINE_BASE		    0
-#define MT2_AIRONET_MSG				    0
-#define MT2_AIRONET_SCAN_REQ		    1
-#define MT2_AIRONET_SCAN_DONE		    2
-#define MAX_AIRONET_MSG				    3
-
-#define	AIRONET_FUNC_SIZE				(MAX_AIRONET_STATE * MAX_AIRONET_MSG)
-
-//
-// AP's CONTROL/CONNECT state machine: states, events, total function #
-//
+/* */
+/* WSC State machine: states, events, total function # */
+/* */
+
+/* */
+/* AP's CONTROL/CONNECT state machine: states, events, total function # */
+/* */
 #define AP_CNTL_FUNC_SIZE               1
 
-//
-// AP's ASSOC state machine: states, events, total function #
-//
+/* */
+/* AP's ASSOC state machine: states, events, total function # */
+/* */
 #define AP_ASSOC_IDLE                   0
 #define AP_MAX_ASSOC_STATE              1
 
@@ -873,36 +840,25 @@
 
 #define AP_ASSOC_FUNC_SIZE              (AP_MAX_ASSOC_STATE * AP_MAX_ASSOC_MSG)
 
-//
-// AP's AUTHENTICATION state machine: states, events, total function #
-//
+/* */
+/* AP's AUTHENTICATION state machine: states, events, total function # */
+/* */
 #define AP_AUTH_REQ_IDLE                0
 #define AP_MAX_AUTH_STATE               1
 
 #define AP_AUTH_MACHINE_BASE            0
 #define APMT2_MLME_DEAUTH_REQ           0
 #define APMT2_CLS2ERR                   1
-#define AP_MAX_AUTH_MSG                 2
-
-#define AP_AUTH_FUNC_SIZE               (AP_MAX_AUTH_STATE * AP_MAX_AUTH_MSG)
-
-//
-// AP's AUTH-RSP state machine: states, events, total function #
-//
-#define AP_AUTH_RSP_IDLE                0
-#define AP_MAX_AUTH_RSP_STATE           1
-
-#define AP_AUTH_RSP_MACHINE_BASE        0
-#define APMT2_AUTH_CHALLENGE_TIMEOUT    0
-#define APMT2_PEER_AUTH_ODD             1
 #define APMT2_PEER_DEAUTH               2
-#define AP_MAX_AUTH_RSP_MSG             3
+#define APMT2_PEER_AUTH_REQ				3
+#define APMT2_PEER_AUTH_CONFIRM			4
+#define AP_MAX_AUTH_MSG                 5
 
-#define AP_AUTH_RSP_FUNC_SIZE           (AP_MAX_AUTH_RSP_STATE * AP_MAX_AUTH_RSP_MSG)
+#define AP_AUTH_FUNC_SIZE               (AP_MAX_AUTH_STATE * AP_MAX_AUTH_MSG)
 
-//
-// AP's SYNC state machine: states, events, total function #
-//
+/* */
+/* AP's SYNC state machine: states, events, total function # */
+/* */
 #define AP_SYNC_IDLE                    0
 #define AP_SCAN_LISTEN					1
 #define AP_MAX_SYNC_STATE               2
@@ -918,30 +874,30 @@
 
 #define AP_SYNC_FUNC_SIZE               (AP_MAX_SYNC_STATE * AP_MAX_SYNC_MSG)
 
-//
-// AP's WPA state machine: states, events, total function #
-//
-#define AP_WPA_PTK                      0
-#define AP_MAX_WPA_PTK_STATE            1
+/* */
+/* Common WPA state machine: states, events, total function # */
+/* */
+#define WPA_PTK                      0
+#define MAX_WPA_PTK_STATE            1
 
-#define AP_WPA_MACHINE_BASE             0
-#define APMT2_EAPPacket                 0
-#define APMT2_EAPOLStart                1
-#define APMT2_EAPOLLogoff               2
-#define APMT2_EAPOLKey                  3
-#define APMT2_EAPOLASFAlert             4
-#define AP_MAX_WPA_MSG                  5
+#define WPA_MACHINE_BASE             0
+#define MT2_EAPPacket                0
+#define MT2_EAPOLStart               1
+#define MT2_EAPOLLogoff              2
+#define MT2_EAPOLKey                 3
+#define MT2_EAPOLASFAlert            4
+#define MAX_WPA_MSG                  5
 
-#define AP_WPA_FUNC_SIZE                (AP_MAX_WPA_PTK_STATE * AP_MAX_WPA_MSG)
+#define WPA_FUNC_SIZE                (MAX_WPA_PTK_STATE * MAX_WPA_MSG)
 
-// =============================================================================
+/* ============================================================================= */
 
-// value domain of 802.11 header FC.Tyte, which is b3..b2 of the 1st-byte of MAC header
+/* value domain of 802.11 header FC.Tyte, which is b3..b2 of the 1st-byte of MAC header */
 #define BTYPE_MGMT                  0
 #define BTYPE_CNTL                  1
 #define BTYPE_DATA                  2
 
-// value domain of 802.11 MGMT frame's FC.subtype, which is b7..4 of the 1st-byte of MAC header
+/* value domain of 802.11 MGMT frame's FC.subtype, which is b7..4 of the 1st-byte of MAC header */
 #define SUBTYPE_ASSOC_REQ           0
 #define SUBTYPE_ASSOC_RSP           1
 #define SUBTYPE_REASSOC_REQ         2
@@ -956,7 +912,7 @@
 #define SUBTYPE_ACTION              13
 #define SUBTYPE_ACTION_NO_ACK              14
 
-// value domain of 802.11 CNTL frame's FC.subtype, which is b7..4 of the 1st-byte of MAC header
+/* value domain of 802.11 CNTL frame's FC.subtype, which is b7..4 of the 1st-byte of MAC header */
 #define SUBTYPE_WRAPPER       	7
 #define SUBTYPE_BLOCK_ACK_REQ       8
 #define SUBTYPE_BLOCK_ACK           9
@@ -967,7 +923,7 @@
 #define SUBTYPE_CFEND               14
 #define SUBTYPE_CFEND_CFACK         15
 
-// value domain of 802.11 DATA frame's FC.subtype, which is b7..4 of the 1st-byte of MAC header
+/* value domain of 802.11 DATA frame's FC.subtype, which is b7..4 of the 1st-byte of MAC header */
 #define SUBTYPE_DATA                0
 #define SUBTYPE_DATA_CFACK          1
 #define SUBTYPE_DATA_CFPOLL         2
@@ -985,15 +941,15 @@
 #define SUBTYPE_QOS_CFPOLL          14
 #define SUBTYPE_QOS_CFACK_CFPOLL    15
 
-// ACK policy of QOS Control field bit 6:5
-#define NORMAL_ACK                  0x00  // b6:5 = 00
-#define NO_ACK                      0x20  // b6:5 = 01
-#define NO_EXPLICIT_ACK             0x40  // b6:5 = 10
-#define BLOCK_ACK                   0x60  // b6:5 = 11
+/* ACK policy of QOS Control field bit 6:5 */
+#define NORMAL_ACK                  0x00	/* b6:5 = 00 */
+#define NO_ACK                      0x20	/* b6:5 = 01 */
+#define NO_EXPLICIT_ACK             0x40	/* b6:5 = 10 */
+#define BLOCK_ACK                   0x60	/* b6:5 = 11 */
 
-//
-// rtmp_data.c use these definition
-//
+/* */
+/* rtmp_data.c use these definition */
+/* */
 #define LENGTH_802_11               24
 #define LENGTH_802_11_AND_H         30
 #define LENGTH_802_11_CRC_H         34
@@ -1007,42 +963,42 @@
 #define LENGTH_CRC                  4
 #define MAX_SEQ_NUMBER              0x0fff
 #define LENGTH_802_3_NO_TYPE		12
-#define LENGTH_802_1Q				4 /* VLAN related */
+#define LENGTH_802_1Q				4	/* VLAN related */
 
-// STA_CSR4.field.TxResult
+/* STA_CSR4.field.TxResult */
 #define TX_RESULT_SUCCESS           0
 #define TX_RESULT_ZERO_LENGTH       1
 #define TX_RESULT_UNDER_RUN         2
 #define TX_RESULT_OHY_ERROR         4
 #define TX_RESULT_RETRY_FAIL        6
 
-// All PHY rate summary in TXD
-// Preamble MODE in TxD
+/* All PHY rate summary in TXD */
+/* Preamble MODE in TxD */
 #define MODE_CCK	0
 #define MODE_OFDM   1
 #define MODE_HTMIX	2
 #define MODE_HTGREENFIELD	3
 
-// MCS for CCK.  BW.SGI.STBC are reserved
-#define MCS_LONGP_RATE_1                      0	 // long preamble CCK 1Mbps
-#define MCS_LONGP_RATE_2                      1	// long preamble CCK 1Mbps
-#define MCS_LONGP_RATE_5_5                    2
-#define MCS_LONGP_RATE_11                     3
-#define MCS_SHORTP_RATE_1                      4	 // long preamble CCK 1Mbps. short is forbidden in 1Mbps
-#define MCS_SHORTP_RATE_2                      5	// short preamble CCK 2Mbps
+/* MCS for CCK.  BW.SGI.STBC are reserved */
+#define MCS_longP_RATE_1                      0	/* long preamble CCK 1Mbps */
+#define MCS_longP_RATE_2                      1	/* long preamble CCK 1Mbps */
+#define MCS_longP_RATE_5_5                    2
+#define MCS_longP_RATE_11                     3
+#define MCS_SHORTP_RATE_1                      4	/* long preamble CCK 1Mbps. short is forbidden in 1Mbps */
+#define MCS_SHORTP_RATE_2                      5	/* short preamble CCK 2Mbps */
 #define MCS_SHORTP_RATE_5_5                    6
 #define MCS_SHORTP_RATE_11                     7
-// To send duplicate legacy OFDM. set BW=BW_40.  SGI.STBC are reserved
-#define MCS_RATE_6                      0   // legacy OFDM
-#define MCS_RATE_9                      1   // OFDM
-#define MCS_RATE_12                     2   // OFDM
-#define MCS_RATE_18                     3   // OFDM
-#define MCS_RATE_24                     4  // OFDM
-#define MCS_RATE_36                     5   // OFDM
-#define MCS_RATE_48                     6  // OFDM
-#define MCS_RATE_54                     7 // OFDM
-// HT
-#define MCS_0		0	// 1S
+/* To send duplicate legacy OFDM. set BW=BW_40.  SGI.STBC are reserved */
+#define MCS_RATE_6                      0	/* legacy OFDM */
+#define MCS_RATE_9                      1	/* OFDM */
+#define MCS_RATE_12                     2	/* OFDM */
+#define MCS_RATE_18                     3	/* OFDM */
+#define MCS_RATE_24                     4	/* OFDM */
+#define MCS_RATE_36                     5	/* OFDM */
+#define MCS_RATE_48                     6	/* OFDM */
+#define MCS_RATE_54                     7	/* OFDM */
+/* HT */
+#define MCS_0		0	/* 1S */
 #define MCS_1		1
 #define MCS_2		2
 #define MCS_3		3
@@ -1050,7 +1006,7 @@
 #define MCS_5		5
 #define MCS_6		6
 #define MCS_7		7
-#define MCS_8		8	// 2S
+#define MCS_8		8	/* 2S */
 #define MCS_9		9
 #define MCS_10		10
 #define MCS_11		11
@@ -1058,7 +1014,7 @@
 #define MCS_13		13
 #define MCS_14		14
 #define MCS_15		15
-#define MCS_16		16	// 3*3
+#define MCS_16		16	/* 3*3 */
 #define MCS_17		17
 #define MCS_18		18
 #define MCS_19		19
@@ -1069,49 +1025,48 @@
 #define MCS_32		32
 #define MCS_AUTO		33
 
-// OID_HTPHYMODE
-// MODE
+/* OID_HTPHYMODE */
+/* MODE */
 #define HTMODE_MM	0
 #define HTMODE_GF	1
 
-// Fixed Tx MODE - HT, CCK or OFDM
+/* Fixed Tx MODE - HT, CCK or OFDM */
 #define FIXED_TXMODE_HT		0
 #define FIXED_TXMODE_CCK	1
 #define FIXED_TXMODE_OFDM 	2
-// BW
+/* BW */
 #define BW_20		BAND_WIDTH_20
 #define BW_40		BAND_WIDTH_40
 #define BW_BOTH		BAND_WIDTH_BOTH
-#define BW_10		BAND_WIDTH_10	// 802.11j has 10MHz. This definition is for internal usage. doesn't fill in the IE or other field.
+#define BW_10		BAND_WIDTH_10	/* 802.11j has 10MHz. This definition is for internal usage. doesn't fill in the IE or other field. */
 
-// SHORTGI
-#define GI_400		GAP_INTERVAL_400	// only support in HT mode
+/* SHORTGI */
+#define GI_400		GAP_INTERVAL_400	/* only support in HT mode */
 #define GI_BOTH		GAP_INTERVAL_BOTH
 #define GI_800		GAP_INTERVAL_800
-// STBC
+/* STBC */
 #define STBC_NONE	0
-#define STBC_USE	1	// limited use in rt2860b phy
-#define RXSTBC_ONE	1	// rx support of one spatial stream
-#define RXSTBC_TWO	2	// rx support of 1 and 2 spatial stream
-#define RXSTBC_THR	3	// rx support of 1~3 spatial stream
-// MCS FEEDBACK
-#define MCSFBK_NONE	0  // not support mcs feedback /
-#define MCSFBK_RSV	1	// reserved
-#define MCSFBK_UNSOLICIT	2	// only support unsolict mcs feedback
-#define MCSFBK_MRQ	3	// response to both MRQ and unsolict mcs feedback
-
-// MIMO power safe
+#define STBC_USE	1	/* limited use in rt2860b phy */
+#define RXSTBC_ONE	1	/* rx support of one spatial stream */
+#define RXSTBC_TWO	2	/* rx support of 1 and 2 spatial stream */
+#define RXSTBC_THR	3	/* rx support of 1~3 spatial stream */
+/* MCS FEEDBACK */
+#define MCSFBK_NONE	0	/* not support mcs feedback / */
+#define MCSFBK_RSV	1	/* reserved */
+#define MCSFBK_UNSOLICIT	2	/* only support unsolict mcs feedback */
+#define MCSFBK_MRQ	3	/* response to both MRQ and unsolict mcs feedback */
+
+/* MIMO power safe */
 #define	MMPS_STATIC	0
 #define	MMPS_DYNAMIC		1
 #define   MMPS_RSV		2
 #define MMPS_ENABLE		3
 
-
-// A-MSDU size
+/* A-MSDU size */
 #define	AMSDU_0	0
 #define	AMSDU_1		1
 
-// MCS use 7 bits
+/* MCS use 7 bits */
 #define TXRATEMIMO		0x80
 #define TXRATEMCS		0x7F
 #define TXRATEOFDM		0x7F
@@ -1119,73 +1074,77 @@
 #define RATE_2                      1
 #define RATE_5_5                    2
 #define RATE_11                     3
-#define RATE_6                      4   // OFDM
-#define RATE_9                      5   // OFDM
-#define RATE_12                     6   // OFDM
-#define RATE_18                     7   // OFDM
-#define RATE_24                     8   // OFDM
-#define RATE_36                     9   // OFDM
-#define RATE_48                     10  // OFDM
-#define RATE_54                     11  // OFDM
+#define RATE_6                      4	/* OFDM */
+#define RATE_9                      5	/* OFDM */
+#define RATE_12                     6	/* OFDM */
+#define RATE_18                     7	/* OFDM */
+#define RATE_24                     8	/* OFDM */
+#define RATE_36                     9	/* OFDM */
+#define RATE_48                     10	/* OFDM */
+#define RATE_54                     11	/* OFDM */
 #define RATE_FIRST_OFDM_RATE        RATE_6
 #define RATE_LAST_OFDM_RATE        	RATE_54
-#define RATE_6_5                    12  // HT mix
-#define RATE_13                     13  // HT mix
-#define RATE_19_5                   14  // HT mix
-#define RATE_26                     15  // HT mix
-#define RATE_39                     16  // HT mix
-#define RATE_52                     17  // HT mix
-#define RATE_58_5                   18  // HT mix
-#define RATE_65                     19  // HT mix
-#define RATE_78                     20  // HT mix
-#define RATE_104                    21  // HT mix
-#define RATE_117                    22  // HT mix
-#define RATE_130                    23  // HT mix
-//#define RATE_AUTO_SWITCH            255 // for StaCfg.FixedTxRate only
+#define RATE_6_5                    12	/* HT mix */
+#define RATE_13                     13	/* HT mix */
+#define RATE_19_5                   14	/* HT mix */
+#define RATE_26                     15	/* HT mix */
+#define RATE_39                     16	/* HT mix */
+#define RATE_52                     17	/* HT mix */
+#define RATE_58_5                   18	/* HT mix */
+#define RATE_65                     19	/* HT mix */
+#define RATE_78                     20	/* HT mix */
+#define RATE_104                    21	/* HT mix */
+#define RATE_117                    22	/* HT mix */
+#define RATE_130                    23	/* HT mix */
+/*#define RATE_AUTO_SWITCH            255 // for StaCfg.FixedTxRate only */
 #define HTRATE_0                      12
 #define RATE_FIRST_MM_RATE        HTRATE_0
 #define RATE_FIRST_HT_RATE        HTRATE_0
 #define RATE_LAST_HT_RATE        HTRATE_0
 
-// pTxWI->txop
-#define IFS_HTTXOP                 0	// The txop will be handles by ASIC.
+/* pTxWI->txop */
+#define IFS_HTTXOP                 0	/* The txop will be handles by ASIC. */
 #define IFS_PIFS                    1
 #define IFS_SIFS                    2
 #define IFS_BACKOFF                 3
 
-// pTxD->RetryMode
-#define LONG_RETRY                  1
+/* pTxD->RetryMode */
+#define long_RETRY                  1
 #define SHORT_RETRY                 0
 
-// Country Region definition
+/* Country Region definition */
 #define REGION_MINIMUM_BG_BAND            0
-#define REGION_0_BG_BAND                  0       // 1-11
-#define REGION_1_BG_BAND                  1       // 1-13
-#define REGION_2_BG_BAND                  2       // 10-11
-#define REGION_3_BG_BAND                  3       // 10-13
-#define REGION_4_BG_BAND                  4       // 14
-#define REGION_5_BG_BAND                  5       // 1-14
-#define REGION_6_BG_BAND                  6       // 3-9
-#define REGION_7_BG_BAND                  7       // 5-13
-#define REGION_31_BG_BAND                 31       // 5-13
+#define REGION_0_BG_BAND                  0	/* 1-11 */
+#define REGION_1_BG_BAND                  1	/* 1-13 */
+#define REGION_2_BG_BAND                  2	/* 10-11 */
+#define REGION_3_BG_BAND                  3	/* 10-13 */
+#define REGION_4_BG_BAND                  4	/* 14 */
+#define REGION_5_BG_BAND                  5	/* 1-14 */
+#define REGION_6_BG_BAND                  6	/* 3-9 */
+#define REGION_7_BG_BAND                  7	/* 5-13 */
+#define REGION_31_BG_BAND                 31	/* 5-13 */
 #define REGION_MAXIMUM_BG_BAND            7
 
 #define REGION_MINIMUM_A_BAND             0
-#define REGION_0_A_BAND                   0       // 36, 40, 44, 48, 52, 56, 60, 64, 149, 153, 157, 161, 165
-#define REGION_1_A_BAND                   1       // 36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140
-#define REGION_2_A_BAND                   2       // 36, 40, 44, 48, 52, 56, 60, 64
-#define REGION_3_A_BAND                   3       // 52, 56, 60, 64, 149, 153, 157, 161
-#define REGION_4_A_BAND                   4       // 149, 153, 157, 161, 165
-#define REGION_5_A_BAND                   5       // 149, 153, 157, 161
-#define REGION_6_A_BAND                   6       // 36, 40, 44, 48
-#define REGION_7_A_BAND                   7       // 36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 149, 153, 157, 161, 165
-#define REGION_8_A_BAND                   8       // 52, 56, 60, 64
-#define REGION_9_A_BAND                   9       // 36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 132, 136, 140, 149, 153, 157, 161, 165
-#define REGION_10_A_BAND                  10	  // 36, 40, 44, 48, 149, 153, 157, 161, 165
-#define REGION_11_A_BAND                  11	  // 36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 149, 153, 157, 161
-#define REGION_MAXIMUM_A_BAND             11
-
-// pTxD->CipherAlg
+#define REGION_0_A_BAND                   0	/* 36, 40, 44, 48, 52, 56, 60, 64, 149, 153, 157, 161, 165 */
+#define REGION_1_A_BAND                   1	/* 36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140 */
+#define REGION_2_A_BAND                   2	/* 36, 40, 44, 48, 52, 56, 60, 64 */
+#define REGION_3_A_BAND                   3	/* 52, 56, 60, 64, 149, 153, 157, 161 */
+#define REGION_4_A_BAND                   4	/* 149, 153, 157, 161, 165 */
+#define REGION_5_A_BAND                   5	/* 149, 153, 157, 161 */
+#define REGION_6_A_BAND                   6	/* 36, 40, 44, 48 */
+#define REGION_7_A_BAND                   7	/* 36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 149, 153, 157, 161, 165, 169, 173 */
+#define REGION_8_A_BAND                   8	/* 52, 56, 60, 64 */
+#define REGION_9_A_BAND                   9	/* 36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 132, 136, 140, 149, 153, 157, 161, 165 */
+#define REGION_10_A_BAND                  10	/* 36, 40, 44, 48, 149, 153, 157, 161, 165 */
+#define REGION_11_A_BAND                  11	/* 36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 149, 153, 157, 161 */
+#define REGION_12_A_BAND                  12	/* 36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140 */
+#define REGION_13_A_BAND                  13	/* 52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 149, 153, 157, 161 */
+#define REGION_14_A_BAND                  14	/* 36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 136, 140, 149, 153, 157, 161, 165 */
+#define REGION_15_A_BAND                  15	/* 149, 153, 157, 161, 165, 169, 173 */
+#define REGION_MAXIMUM_A_BAND             15
+
+/* pTxD->CipherAlg */
 #define CIPHER_NONE                 0
 #define CIPHER_WEP64                1
 #define CIPHER_WEP128               2
@@ -1193,20 +1152,10 @@
 #define CIPHER_AES                  4
 #define CIPHER_CKIP64               5
 #define CIPHER_CKIP128              6
-#define CIPHER_TKIP_NO_MIC          7       // MIC appended by driver: not a valid value in hardware key table
+#define CIPHER_TKIP_NO_MIC          7	/* MIC appended by driver: not a valid value in hardware key table */
 #define CIPHER_SMS4					8
 
-// value domain of pAd->RfIcType
-#define RFIC_2820                   1       // 2.4G 2T3R
-#define RFIC_2850                   2       // 2.4G/5G 2T3R
-#define RFIC_2720                   3       // 2.4G 1T2R
-#define RFIC_2750                   4       // 2.4G/5G 1T2R
-#define RFIC_3020                   5       // 2.4G 1T1R
-#define RFIC_2020                   6       // 2.4G B/G
-#define RFIC_3021                   7       // 2.4G 1T2R
-#define RFIC_3022                   8       // 2.4G 2T2R
-
-// LED Status.
+/* LED Status. */
 #define LED_LINK_DOWN               0
 #define LED_LINK_UP                 1
 #define LED_RADIO_OFF               2
@@ -1216,35 +1165,35 @@
 #define LED_ON_SITE_SURVEY          6
 #define LED_POWER_UP                7
 
-// value domain of pAd->LedCntl.LedMode and E2PROM
+/* value domain of pAd->LedCntl.LedMode and E2PROM */
 #define LED_MODE_DEFAULT            0
 #define LED_MODE_TWO_LED			1
-#define LED_MODE_SIGNAL_STREGTH		8  // EEPROM define =8
+/*#define LED_MODE_SIGNAL_STREGTH               8  // EEPROM define =8 */
+#define LED_MODE_SIGNAL_STREGTH		0x40	/* EEPROM define = 64 */
 
-// RC4 init value, used fro WEP & TKIP
-#define PPPINITFCS32                0xffffffff   /* Initial FCS value */
+/* RC4 init value, used fro WEP & TKIP */
+#define PPPINITFCS32                0xffffffff	/* Initial FCS value */
 
-// value domain of pAd->StaCfg.PortSecured. 802.1X controlled port definition
+/* value domain of pAd->StaCfg.PortSecured. 802.1X controlled port definition */
 #define WPA_802_1X_PORT_SECURED     1
 #define WPA_802_1X_PORT_NOT_SECURED 2
 
 #define PAIRWISE_KEY                1
 #define GROUP_KEY                   2
 
-//definition of DRS
+/*definition of DRS */
 #define MAX_STEP_OF_TX_RATE_SWITCH	32
 
-
-// pre-allocated free NDIS PACKET/BUFFER poll for internal usage
+/* pre-allocated free NDIS PACKET/BUFFER poll for internal usage */
 #define MAX_NUM_OF_FREE_NDIS_PACKET 128
 
-//Block ACK
+/*Block ACK */
 #define MAX_TX_REORDERBUF   64
 #define MAX_RX_REORDERBUF   64
 #define DEFAULT_TX_TIMEOUT   30
 #define DEFAULT_RX_TIMEOUT   30
 
-// definition of Recipient or Originator
+/* definition of Recipient or Originator */
 #define I_RECIPIENT                  TRUE
 #define I_ORIGINATOR                   FALSE
 
@@ -1252,46 +1201,45 @@
 #define DEFAULT_RF_TX_POWER         5
 
 #define MAX_INI_BUFFER_SIZE			4096
-#define MAX_PARAM_BUFFER_SIZE		(2048) // enough for ACL (18*64)
-											//18 : the length of Mac address acceptable format "01:02:03:04:05:06;")
-											//64 : MAX_NUM_OF_ACL_LIST
-// definition of pAd->OpMode
+#define MAX_PARAM_BUFFER_SIZE		(2048)	/* enough for ACL (18*64) */
+											/*18 : the length of Mac address acceptable format "01:02:03:04:05:06;") */
+											/*64 : MAX_NUM_OF_ACL_LIST */
+/* definition of pAd->OpMode */
 #define OPMODE_STA                  0
 #define OPMODE_AP                   1
-//#define OPMODE_L3_BRG               2       // as AP and STA at the same time
-
-// ========================= AP rtmp_def.h ===========================
-// value domain for pAd->EventTab.Log[].Event
-#define EVENT_RESET_ACCESS_POINT    0 // Log = "hh:mm:ss   Restart Access Point"
-#define EVENT_ASSOCIATED            1 // Log = "hh:mm:ss   STA 00:01:02:03:04:05 associated"
-#define EVENT_DISASSOCIATED         2 // Log = "hh:mm:ss   STA 00:01:02:03:04:05 left this BSS"
-#define EVENT_AGED_OUT              3 // Log = "hh:mm:ss   STA 00:01:02:03:04:05 was aged-out and removed from this BSS"
+/*#define OPMODE_L3_BRG               2       // as AP and STA at the same time */
+
+/* ========================= AP rtmp_def.h =========================== */
+/* value domain for pAd->EventTab.Log[].Event */
+#define EVENT_RESET_ACCESS_POint    0	/* Log = "hh:mm:ss   Restart Access Point" */
+#define EVENT_ASSOCIATED            1	/* Log = "hh:mm:ss   STA 00:01:02:03:04:05 associated" */
+#define EVENT_DISASSOCIATED         2	/* Log = "hh:mm:ss   STA 00:01:02:03:04:05 left this BSS" */
+#define EVENT_AGED_OUT              3	/* Log = "hh:mm:ss   STA 00:01:02:03:04:05 was aged-out and removed from this BSS" */
 #define EVENT_COUNTER_M             4
 #define EVENT_INVALID_PSK           5
 #define EVENT_MAX_EVENT_TYPE        6
-// ==== end of AP rtmp_def.h ============
+/* ==== end of AP rtmp_def.h ============ */
 
-// definition RSSI Number
+/* definition RSSI Number */
 #define RSSI_0					0
 #define RSSI_1					1
 #define RSSI_2					2
 
-// definition of radar detection
-#define RD_NORMAL_MODE				0	// Not found radar signal
-#define RD_SWITCHING_MODE			1	// Found radar signal, and doing channel switch
-#define RD_SILENCE_MODE				2	// After channel switch, need to be silence a while to ensure radar not found
+/* definition of radar detection */
+#define RD_NORMAL_MODE				0	/* Not found radar signal */
+#define RD_SWITCHING_MODE			1	/* Found radar signal, and doing channel switch */
+#define RD_SILENCE_MODE				2	/* After channel switch, need to be silence a while to ensure radar not found */
 
-//Driver defined cid for mapping status and command.
+/*Driver defined cid for mapping status and command. */
 #define  SLEEPCID	0x11
 #define  WAKECID	0x22
 #define  QUERYPOWERCID	0x33
 #define  OWNERMCU	0x1
 #define  OWNERCPU	0x0
 
-// MBSSID definition
+/* MBSSID definition */
 #define ENTRY_NOT_FOUND             0xFF
 
-
 /* After Linux 2.6.9,
  * VLAN module use Private (from user) interface flags (netdevice->priv_flags).
  * #define IFF_802_1Q_VLAN 0x1         --    802.1Q VLAN device.  in if.h
@@ -1305,19 +1253,21 @@
 #define INT_APCLI                   0x0400
 #define INT_MESH                   	0x0500
 
-// Use bitmap to allow coexist of ATE_TXFRAME and ATE_RXFRAME(i.e.,to support LoopBack mode)
+#define INF_MAIN_DEV_NAME		"wlan"
+#define INF_MBSSID_DEV_NAME		"ra"
+#define INF_WDS_DEV_NAME		"wds"
+#define INF_APCLI_DEV_NAME		"apcli"
+#define INF_MESH_DEV_NAME		"mesh"
 
-// WEP Key TYPE
+/* WEP Key TYPE */
 #define WEP_HEXADECIMAL_TYPE    0
 #define WEP_ASCII_TYPE          1
 
-
-
-// WIRELESS EVENTS definition
+/* WIRELESS EVENTS definition */
 /* Max number of char in custom event, refer to wireless_tools.28/wireless.20.h */
 #define IW_CUSTOM_MAX_LEN				  			255	/* In bytes */
 
-// For system event - start
+/* For system event - start */
 #define	IW_SYS_EVENT_FLAG_START                     0x0200
 #define	IW_ASSOC_EVENT_FLAG                         0x0200
 #define	IW_DISASSOC_EVENT_FLAG                      0x0201
@@ -1338,12 +1288,12 @@
 #define IW_STA_LINKDOWN_EVENT_FLAG					0x0210
 #define IW_SCAN_COMPLETED_EVENT_FLAG				0x0211
 #define IW_SCAN_ENQUEUE_FAIL_EVENT_FLAG				0x0212
-// if add new system event flag, please upadte the IW_SYS_EVENT_FLAG_END
+/* if add new system event flag, please upadte the IW_SYS_EVENT_FLAG_END */
 #define	IW_SYS_EVENT_FLAG_END                       0x0212
 #define	IW_SYS_EVENT_TYPE_NUM						(IW_SYS_EVENT_FLAG_END - IW_SYS_EVENT_FLAG_START + 1)
-// For system event - end
+/* For system event - end */
 
-// For spoof attack event - start
+/* For spoof attack event - start */
 #define	IW_SPOOF_EVENT_FLAG_START                   0x0300
 #define IW_CONFLICT_SSID_EVENT_FLAG					0x0300
 #define IW_SPOOF_ASSOC_RESP_EVENT_FLAG				0x0301
@@ -1355,12 +1305,12 @@
 #define IW_SPOOF_DEAUTH_EVENT_FLAG					0x0307
 #define IW_SPOOF_UNKNOWN_MGMT_EVENT_FLAG			0x0308
 #define IW_REPLAY_ATTACK_EVENT_FLAG					0x0309
-// if add new spoof attack event flag, please upadte the IW_SPOOF_EVENT_FLAG_END
+/* if add new spoof attack event flag, please upadte the IW_SPOOF_EVENT_FLAG_END */
 #define	IW_SPOOF_EVENT_FLAG_END                     0x0309
 #define	IW_SPOOF_EVENT_TYPE_NUM						(IW_SPOOF_EVENT_FLAG_END - IW_SPOOF_EVENT_FLAG_START + 1)
-// For spoof attack event - end
+/* For spoof attack event - end */
 
-// For flooding attack event - start
+/* For flooding attack event - start */
 #define	IW_FLOOD_EVENT_FLAG_START                   0x0400
 #define IW_FLOOD_AUTH_EVENT_FLAG					0x0400
 #define IW_FLOOD_ASSOC_REQ_EVENT_FLAG				0x0401
@@ -1369,18 +1319,18 @@
 #define IW_FLOOD_DISASSOC_EVENT_FLAG				0x0404
 #define IW_FLOOD_DEAUTH_EVENT_FLAG					0x0405
 #define IW_FLOOD_EAP_REQ_EVENT_FLAG					0x0406
-// if add new flooding attack event flag, please upadte the IW_FLOOD_EVENT_FLAG_END
+/* if add new flooding attack event flag, please upadte the IW_FLOOD_EVENT_FLAG_END */
 #define	IW_FLOOD_EVENT_FLAG_END                   	0x0406
 #define	IW_FLOOD_EVENT_TYPE_NUM						(IW_FLOOD_EVENT_FLAG_END - IW_FLOOD_EVENT_FLAG_START + 1)
-// For flooding attack - end
+/* For flooding attack - end */
 
-// End - WIRELESS EVENTS definition
+/* End - WIRELESS EVENTS definition */
 
-// definition for DLS, kathy
+/* definition for DLS, kathy */
 #define	MAX_NUM_OF_INIT_DLS_ENTRY   1
 #define	MAX_NUM_OF_DLS_ENTRY        MAX_NUMBER_OF_DLS_ENTRY
 
-//Block ACK , rt2860, kathy
+/*Block ACK, kathy */
 #define MAX_TX_REORDERBUF		64
 #define MAX_RX_REORDERBUF		64
 #define DEFAULT_TX_TIMEOUT		30
@@ -1392,65 +1342,48 @@
 #define IW_ESSID_MAX_SIZE   		32
 #endif
 
-#ifdef MCAST_RATE_SPECIFIC
-#define MCAST_DISABLE	0
-#define MCAST_CCK		1
-#define MCAST_OFDM		2
-#define MCAST_HTMIX		3
-#endif // MCAST_RATE_SPECIFIC //
-
-#ifdef RT2860
-// For AsicRadioOff/AsicRadioOn/AsicForceWakeup function
-// This is to indicate from where to call this function.
-#define DOT11POWERSAVE		0	// TO do .11 power save sleep
-#define GUIRADIO_OFF		1	// To perform Radio OFf command from GUI
-#define RTMP_HALT			2	// Called from Halt handler.
-#define GUI_IDLE_POWER_SAVE	3	// Call to sleep before link up with AP
-#define FROM_TX				4	// Force wake up from Tx packet.
-#endif
-#ifdef RT2870
-// For AsicRadioOff/AsicRadioOn function
+/* For AsicRadioOff/AsicRadioOn function */
 #define DOT11POWERSAVE		0
 #define GUIRADIO_OFF		1
 #define RTMP_HALT		    2
 #define GUI_IDLE_POWER_SAVE		3
-#endif
+/* -- */
 
-// definition for WpaSupport flag
+/* definition for WpaSupport flag */
 #define WPA_SUPPLICANT_DISABLE				0
 #define WPA_SUPPLICANT_ENABLE				1
 #define	WPA_SUPPLICANT_ENABLE_WITH_WEB_UI	2
 
-// Endian byte swapping codes
+/* Endian byte swapping codes */
 #define SWAP16(x) \
-    ((UINT16)( \
-    (((UINT16)(x) & (UINT16) 0x00ffU) << 8) | \
-    (((UINT16)(x) & (UINT16) 0xff00U) >> 8) ))
+    ((u16)( \
+    (((u16)(x) & (u16)0x00ffU) << 8) | \
+    (((u16)(x) & (u16)0xff00U) >> 8) ))
 
 #define SWAP32(x) \
-    ((UINT32)( \
-    (((UINT32)(x) & (UINT32) 0x000000ffUL) << 24) | \
-    (((UINT32)(x) & (UINT32) 0x0000ff00UL) <<  8) | \
-    (((UINT32)(x) & (UINT32) 0x00ff0000UL) >>  8) | \
-    (((UINT32)(x) & (UINT32) 0xff000000UL) >> 24) ))
+    ((u32)( \
+    (((u32)(x) & (u32)0x000000ffUL) << 24) | \
+    (((u32)(x) & (u32)0x0000ff00UL) <<  8) | \
+    (((u32)(x) & (u32)0x00ff0000UL) >>  8) | \
+    (((u32)(x) & (u32)0xff000000UL) >> 24) ))
 
 #define SWAP64(x) \
-    ((UINT64)( \
-    (UINT64)(((UINT64)(x) & (UINT64) 0x00000000000000ffULL) << 56) | \
-    (UINT64)(((UINT64)(x) & (UINT64) 0x000000000000ff00ULL) << 40) | \
-    (UINT64)(((UINT64)(x) & (UINT64) 0x0000000000ff0000ULL) << 24) | \
-    (UINT64)(((UINT64)(x) & (UINT64) 0x00000000ff000000ULL) <<  8) | \
-    (UINT64)(((UINT64)(x) & (UINT64) 0x000000ff00000000ULL) >>  8) | \
-    (UINT64)(((UINT64)(x) & (UINT64) 0x0000ff0000000000ULL) >> 24) | \
-    (UINT64)(((UINT64)(x) & (UINT64) 0x00ff000000000000ULL) >> 40) | \
-    (UINT64)(((UINT64)(x) & (UINT64) 0xff00000000000000ULL) >> 56) ))
-
-#define cpu2le64(x) ((UINT64)(x))
-#define le2cpu64(x) ((UINT64)(x))
-#define cpu2le32(x) ((UINT32)(x))
-#define le2cpu32(x) ((UINT32)(x))
-#define cpu2le16(x) ((UINT16)(x))
-#define le2cpu16(x) ((UINT16)(x))
+    ((u64)( \
+    (u64)(((u64)(x) & (u64)0x00000000000000ffULL) << 56) | \
+    (u64)(((u64)(x) & (u64)0x000000000000ff00ULL) << 40) | \
+    (u64)(((u64)(x) & (u64)0x0000000000ff0000ULL) << 24) | \
+    (u64)(((u64)(x) & (u64)0x00000000ff000000ULL) <<  8) | \
+    (u64)(((u64)(x) & (u64)0x000000ff00000000ULL) >>  8) | \
+    (u64)(((u64)(x) & (u64)0x0000ff0000000000ULL) >> 24) | \
+    (u64)(((u64)(x) & (u64)0x00ff000000000000ULL) >> 40) | \
+    (u64)(((u64)(x) & (u64)0xff00000000000000ULL) >> 56) ))
+
+#define cpu2le64(x) ((u64)(x))
+#define le2cpu64(x) ((u64)(x))
+#define cpu2le32(x) ((u32)(x))
+#define le2cpu32(x) ((u32)(x))
+#define cpu2le16(x) ((u16)(x))
+#define le2cpu16(x) ((u16)(x))
 #define cpu2be64(x) SWAP64((x))
 #define be2cpu64(x) SWAP64((x))
 #define cpu2be32(x) SWAP32((x))
@@ -1458,6 +1391,36 @@
 #define cpu2be16(x) SWAP16((x))
 #define be2cpu16(x) SWAP16((x))
 
-#endif  // __RTMP_DEF_H__
-
-
+#define ABS(_x, _y) ((_x) > (_y)) ? ((_x) -(_y)) : ((_y) -(_x))
+
+#define A2Dec(_X, _p)				\
+{									\
+	u8 *p;						\
+	_X = 0;							\
+	p = _p;							\
+	while (((*p >= '0') && (*p <= '9')))		\
+	{												\
+		if ((*p >= '0') && (*p <= '9'))		\
+			_X = _X * 10 + *p - 48;					\
+		p++;										\
+	}												\
+}
+
+#define A2Hex(_X, _p)				\
+do{									\
+	char *__p;						\
+	(_X) = 0;							\
+	__p = (char *)(_p);							\
+	while (((*__p >= 'a') && (*__p <= 'f')) || ((*__p >= 'A') && (*__p <= 'F')) || ((*__p >= '0') && (*__p <= '9')))		\
+	{												\
+		if ((*__p >= 'a') && (*__p <= 'f'))				\
+			(_X) = (_X) * 16 + *__p - 87;					\
+		else if ((*__p >= 'A') && (*__p <= 'F'))		\
+			(_X) = (_X) * 16 + *__p - 55;					\
+		else if ((*__p >= '0') && (*__p <= '9'))		\
+			(_X) = (_X) * 16 + *__p - 48;					\
+		__p++;										\
+	}												\
+}while(0)
+
+#endif /* __RTMP_DEF_H__ */
diff --git a/drivers/staging/rt2860/rtmp_dot11.h b/drivers/staging/rt2860/rtmp_dot11.h
new file mode 100644
index 000000000000..4f8abd77ada5
--- /dev/null
+++ b/drivers/staging/rt2860/rtmp_dot11.h
@@ -0,0 +1,100 @@
+/*
+ *************************************************************************
+ * Ralink Tech Inc.
+ * 5F., No.36, Taiyuan St., Jhubei City,
+ * Hsinchu County 302,
+ * Taiwan, R.O.C.
+ *
+ * (c) Copyright 2002-2007, Ralink Technology, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify  *
+ * it under the terms of the GNU General Public License as published by  *
+ * the Free Software Foundation; either version 2 of the License, or     *
+ * (at your option) any later version.                                   *
+ *                                                                       *
+ * This program is distributed in the hope that it will be useful,       *
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
+ * GNU General Public License for more details.                          *
+ *                                                                       *
+ * You should have received a copy of the GNU General Public License     *
+ * along with this program; if not, write to the                         *
+ * Free Software Foundation, Inc.,                                       *
+ * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
+ *                                                                       *
+ *************************************************************************
+*/
+
+#ifndef __DOT11_BASE_H__
+#define __DOT11_BASE_H__
+
+#include "rtmp_type.h"
+
+/* 4-byte HTC field.  maybe included in any frame except non-QOS data frame.  The Order bit must set 1. */
+struct PACKED rt_ht_control {
+	u32 MA:1;		/*management action payload exist in (QoS Null+HTC) */
+	u32 TRQ:1;		/*sounding request */
+	u32 MRQ:1;		/*MCS feedback. Request for a MCS feedback */
+	u32 MRSorASI:3;	/* MRQ Sequence identifier. unchanged during entire procedure. 0x000-0x110. */
+	u32 MFS:3;		/*SET to the received value of MRS. 0x111 for unsolicited MFB. */
+	u32 MFBorASC:7;	/*Link adaptation feedback containing recommended MCS. 0x7f for no feedback or not available */
+	u32 CalPos:2;	/* calibration position */
+	u32 CalSeq:2;	/*calibration sequence */
+	u32 FBKReq:2;	/*feedback request */
+	u32 CSISTEERING:2;	/*CSI/ STEERING */
+	u32 ZLFAnnouce:1;	/* ZLF announcement */
+	u32 rsv:5;		/*calibration sequence */
+	u32 ACConstraint:1;	/*feedback request */
+	u32 RDG:1;		/*RDG / More PPDU */
+};
+
+/* 2-byte QOS CONTROL field */
+struct PACKED rt_qos_control {
+	u16 TID:4;
+	u16 EOSP:1;
+	u16 AckPolicy:2;	/*0: normal ACK 1:No ACK 2:scheduled under MTBA/PSMP  3: BA */
+	u16 AMsduPresent:1;
+	u16 Txop_QueueSize:8;
+};
+
+/* 2-byte Frame control field */
+struct PACKED rt_frame_control {
+	u16 Ver:2;		/* Protocol version */
+	u16 Type:2;		/* MSDU type */
+	u16 SubType:4;	/* MSDU subtype */
+	u16 ToDs:1;		/* To DS indication */
+	u16 FrDs:1;		/* From DS indication */
+	u16 MoreFrag:1;	/* More fragment bit */
+	u16 Retry:1;		/* Retry status bit */
+	u16 PwrMgmt:1;	/* Power management bit */
+	u16 MoreData:1;	/* More data bit */
+	u16 Wep:1;		/* Wep data */
+	u16 Order:1;		/* Strict order expected */
+};
+
+struct PACKED rt_header_802_11 {
+	struct rt_frame_control FC;
+	u16 Duration;
+	u8 Addr1[MAC_ADDR_LEN];
+	u8 Addr2[MAC_ADDR_LEN];
+	u8 Addr3[MAC_ADDR_LEN];
+	u16 Frag:4;
+	u16 Sequence:12;
+	u8 Octet[0];
+};
+
+struct PACKED rt_pspoll_frame {
+	struct rt_frame_control FC;
+	u16 Aid;
+	u8 Bssid[MAC_ADDR_LEN];
+	u8 Ta[MAC_ADDR_LEN];
+};
+
+struct PACKED rt_rts_frame {
+	struct rt_frame_control FC;
+	u16 Duration;
+	u8 Addr1[MAC_ADDR_LEN];
+	u8 Addr2[MAC_ADDR_LEN];
+};
+
+#endif /* __DOT11_BASE_H__ // */
diff --git a/drivers/staging/rt3090/rtmp_iface.h b/drivers/staging/rt2860/rtmp_iface.h
index 168d0797fb6a..808c05529848 100644
--- a/drivers/staging/rt3090/rtmp_iface.h
+++ b/drivers/staging/rt2860/rtmp_iface.h
@@ -38,44 +38,38 @@
 #define __RTMP_IFACE_H__
 
 #ifdef RTMP_PCI_SUPPORT
-#include "rtmp_pci.h"
-#endif // RTMP_PCI_SUPPORT //
-
-
-typedef struct _INF_PCI_CONFIG_
-{
-	unsigned long	CSRBaseAddress;     // PCI MMIO Base Address, all access will use
-	unsigned int	irq_num;
-}INF_PCI_CONFIG;
-
-
-typedef struct _INF_USB_CONFIG_
-{
-	UINT8                BulkInEpAddr;		// bulk-in endpoint address
-	UINT8                BulkOutEpAddr[6];	// bulk-out endpoint address
-}INF_USB_CONFIG;
-
-
-typedef struct _INF_RBUS_CONFIG_
-{
-	unsigned long		csr_addr;
-	unsigned int		irq;
-}INF_RBUS_CONFIG;
-
-
-typedef enum _RTMP_INF_TYPE_
-{
+#include "iface/rtmp_pci.h"
+#endif /* RTMP_PCI_SUPPORT // */
+#ifdef RTMP_USB_SUPPORT
+#include "iface/rtmp_usb.h"
+#endif /* RTMP_USB_SUPPORT // */
+
+struct rt_inf_pci_config {
+	unsigned long CSRBaseAddress;	/* PCI MMIO Base Address, all access will use */
+	unsigned int irq_num;
+};
+
+struct rt_inf_usb_config {
+	u8 BulkInEpAddr;	/* bulk-in endpoint address */
+	u8 BulkOutEpAddr[6];	/* bulk-out endpoint address */
+};
+
+struct rt_inf_rbus_config {
+	unsigned long csr_addr;
+	unsigned int irq;
+};
+
+typedef enum _RTMP_INF_TYPE_ {
 	RTMP_DEV_INF_UNKNOWN = 0,
 	RTMP_DEV_INF_PCI = 1,
 	RTMP_DEV_INF_USB = 2,
 	RTMP_DEV_INF_RBUS = 4,
-}RTMP_INF_TYPE;
-
+} RTMP_INF_TYPE;
 
-typedef union _RTMP_INF_CONFIG_{
-	struct _INF_PCI_CONFIG_			pciConfig;
-	struct _INF_USB_CONFIG_			usbConfig;
-	struct _INF_RBUS_CONFIG_		rbusConfig;
-}RTMP_INF_CONFIG;
+typedef union _RTMP_INF_CONFIG_ {
+	struct rt_inf_pci_config pciConfig;
+	struct rt_inf_usb_config usbConfig;
+	struct rt_inf_rbus_config rbusConfig;
+} RTMP_INF_CONFIG;
 
-#endif // __RTMP_IFACE_H__ //
+#endif /* __RTMP_IFACE_H__ // */
diff --git a/drivers/staging/rt3090/rtmp_mcu.h b/drivers/staging/rt2860/rtmp_mcu.h
index e1b2fee9e105..d0987e55cdad 100644
--- a/drivers/staging/rt3090/rtmp_mcu.h
+++ b/drivers/staging/rt2860/rtmp_mcu.h
@@ -38,18 +38,12 @@
 #ifndef __RTMP_MCU_H__
 #define __RTMP_MCU_H__
 
+int RtmpAsicEraseFirmware(struct rt_rtmp_adapter *pAd);
 
-INT RtmpAsicEraseFirmware(
-	IN PRTMP_ADAPTER pAd);
+int RtmpAsicLoadFirmware(struct rt_rtmp_adapter *pAd);
 
-NDIS_STATUS RtmpAsicLoadFirmware(
-	IN PRTMP_ADAPTER pAd);
+int RtmpAsicSendCommandToMcu(struct rt_rtmp_adapter *pAd,
+			     u8 Command,
+			     u8 Token, u8 Arg0, u8 Arg1);
 
-INT RtmpAsicSendCommandToMcu(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR		 Command,
-	IN UCHAR		 Token,
-	IN UCHAR		 Arg0,
-	IN UCHAR		 Arg1);
-
-#endif // __RTMP_MCU_H__ //
+#endif /* __RTMP_MCU_H__ // */
diff --git a/drivers/staging/rt3090/rtmp_os.h b/drivers/staging/rt2860/rtmp_os.h
index 5646b2dfd6a8..94c30c8ca662 100644
--- a/drivers/staging/rt3090/rtmp_os.h
+++ b/drivers/staging/rt2860/rtmp_os.h
@@ -34,14 +34,12 @@
     ---------    ----------    ----------------------------------------------
  */
 
-
 #ifndef __RTMP_OS_H__
 #define __RTMP_OS_H__
 
 #ifdef LINUX
 #include "rt_linux.h"
-#endif // LINUX //
-
+#endif /* LINUX // */
 
 /*
 	This data structure mainly strip some callback function defined in
@@ -50,44 +48,43 @@
 	The definition of this data structure may various depends on different
 	OS. Use it carefully.
 */
-typedef struct _RTMP_OS_NETDEV_OP_HOOK_
-{
+struct rt_rtmp_os_netdev_op_hook {
 	const struct net_device_ops *netdev_ops;
-	void			*priv;
-	int			priv_flags;
+	void *priv;
+	int priv_flags;
 	unsigned char devAddr[6];
-	unsigned char	devName[16];
-	unsigned char	needProtcted;
-}RTMP_OS_NETDEV_OP_HOOK, *PRTMP_OS_NETDEV_OP_HOOK;
+	unsigned char devName[16];
+	unsigned char needProtcted;
+};
 
-
-typedef enum _RTMP_TASK_STATUS_
-{
+typedef enum _RTMP_TASK_STATUS_ {
 	RTMP_TASK_STAT_UNKNOWN = 0,
 	RTMP_TASK_STAT_INITED = 1,
 	RTMP_TASK_STAT_RUNNING = 2,
 	RTMP_TASK_STAT_STOPED = 4,
-}RTMP_TASK_STATUS;
+} RTMP_TASK_STATUS;
 #define RTMP_TASK_CAN_DO_INSERT		(RTMP_TASK_STAT_INITED |RTMP_TASK_STAT_RUNNING)
 
 #define RTMP_OS_TASK_NAME_LEN	16
-typedef struct _RTMP_OS_TASK_
-{
-	char					taskName[RTMP_OS_TASK_NAME_LEN];
-	void					*priv;
-	//unsigned long		taskFlags;
-	RTMP_TASK_STATUS	taskStatus;
+struct rt_rtmp_os_task {
+	char taskName[RTMP_OS_TASK_NAME_LEN];
+	void *priv;
+	/*unsigned long         taskFlags; */
+	RTMP_TASK_STATUS taskStatus;
 #ifndef KTHREAD_SUPPORT
-	RTMP_OS_SEM			taskSema;
-	RTMP_OS_PID			taskPID;
-	struct completion		taskComplete;
+	struct semaphore taskSema;
+	struct pid *taskPID;
+	struct completion taskComplete;
 #endif
-	unsigned char			task_killed;
+	unsigned char task_killed;
 #ifdef KTHREAD_SUPPORT
-	struct task_struct	*kthread_task;
-	wait_queue_head_t		kthread_q;
-	BOOLEAN					kthread_running;
+	struct task_struct *kthread_task;
+	wait_queue_head_t kthread_q;
+	BOOLEAN kthread_running;
 #endif
-}RTMP_OS_TASK;
+};
+
+int RtmpOSIRQRequest(struct net_device *pNetDev);
+int RtmpOSIRQRelease(struct net_device *pNetDev);
 
-#endif // __RMTP_OS_H__ //
+#endif /* __RMTP_OS_H__ // */
diff --git a/drivers/staging/rt3090/rtmp_timer.h b/drivers/staging/rt2860/rtmp_timer.h
index dfac124ebf14..28b8ac6e8352 100644
--- a/drivers/staging/rt3090/rtmp_timer.h
+++ b/drivers/staging/rt2860/rtmp_timer.h
@@ -43,69 +43,62 @@
 
 #include "rtmp_os.h"
 
-
 #define DECLARE_TIMER_FUNCTION(_func)			\
 	void rtmp_timer_##_func(unsigned long data)
 
 #define GET_TIMER_FUNCTION(_func)				\
 	rtmp_timer_##_func
 
-
 /* ----------------- Timer Related MARCO ---------------*/
-// In some os or chipset, we have a lot of timer functions and will read/write register,
-//   it's not allowed in Linux USB sub-system to do it ( because of sleep issue when
-//  submit to ctrl pipe). So we need a wrapper function to take care it.
+/* In some os or chipset, we have a lot of timer functions and will read/write register, */
+/*   it's not allowed in Linux USB sub-system to do it ( because of sleep issue when */
+/*  submit to ctrl pipe). So we need a wrapper function to take care it. */
 
 #ifdef RTMP_TIMER_TASK_SUPPORT
-typedef VOID (*RTMP_TIMER_TASK_HANDLE)(
-	IN  PVOID   SystemSpecific1,
-	IN  PVOID   FunctionContext,
-	IN  PVOID   SystemSpecific2,
-	IN  PVOID   SystemSpecific3);
-#endif // RTMP_TIMER_TASK_SUPPORT //
-
-typedef struct  _RALINK_TIMER_STRUCT    {
-	RTMP_OS_TIMER		TimerObj;       // Ndis Timer object
-	BOOLEAN				Valid;			// Set to True when call RTMPInitTimer
-	BOOLEAN				State;          // True if timer cancelled
-	BOOLEAN				PeriodicType;	// True if timer is periodic timer
-	BOOLEAN				Repeat;         // True if periodic timer
-	ULONG				TimerValue;     // Timer value in milliseconds
-	ULONG				cookie;			// os specific object
+typedef void(*RTMP_TIMER_TASK_HANDLE) (void *SystemSpecific1,
+				       void *FunctionContext,
+				       void *SystemSpecific2,
+				       void *SystemSpecific3);
+#endif /* RTMP_TIMER_TASK_SUPPORT // */
+
+struct rt_ralink_timer {
+	struct timer_list TimerObj;	/* Ndis Timer object */
+	BOOLEAN Valid;		/* Set to True when call RTMPInitTimer */
+	BOOLEAN State;		/* True if timer cancelled */
+	BOOLEAN PeriodicType;	/* True if timer is periodic timer */
+	BOOLEAN Repeat;		/* True if periodic timer */
+	unsigned long TimerValue;	/* Timer value in milliseconds */
+	unsigned long cookie;		/* os specific object */
 #ifdef RTMP_TIMER_TASK_SUPPORT
-	RTMP_TIMER_TASK_HANDLE	handle;
-	void					*pAd;
-#endif // RTMP_TIMER_TASK_SUPPORT //
-}RALINK_TIMER_STRUCT, *PRALINK_TIMER_STRUCT;
-
+	RTMP_TIMER_TASK_HANDLE handle;
+	void *pAd;
+#endif				/* RTMP_TIMER_TASK_SUPPORT // */
+};
 
 #ifdef RTMP_TIMER_TASK_SUPPORT
-typedef struct _RTMP_TIMER_TASK_ENTRY_
-{
-	RALINK_TIMER_STRUCT			*pRaTimer;
-	struct _RTMP_TIMER_TASK_ENTRY_	*pNext;
-}RTMP_TIMER_TASK_ENTRY;
-
+struct rt_rtmp_timer_task_entry {
+	struct rt_ralink_timer *pRaTimer;
+	struct rt_rtmp_timer_task_entry *pNext;
+};
 
 #define TIMER_QUEUE_SIZE_MAX	128
-typedef struct _RTMP_TIMER_TASK_QUEUE_
-{
-	unsigned int				status;
-	unsigned char				*pTimerQPoll;
-	RTMP_TIMER_TASK_ENTRY	*pQPollFreeList;
-	RTMP_TIMER_TASK_ENTRY	*pQHead;
-	RTMP_TIMER_TASK_ENTRY	*pQTail;
-}RTMP_TIMER_TASK_QUEUE;
+struct rt_rtmp_timer_task_queue {
+	unsigned int status;
+	unsigned char *pTimerQPoll;
+	struct rt_rtmp_timer_task_entry *pQPollFreeList;
+	struct rt_rtmp_timer_task_entry *pQHead;
+	struct rt_rtmp_timer_task_entry *pQTail;
+};
 
 #define BUILD_TIMER_FUNCTION(_func)										\
 void rtmp_timer_##_func(unsigned long data)										\
 {																			\
-	PRALINK_TIMER_STRUCT	_pTimer = (PRALINK_TIMER_STRUCT)data;				\
-	RTMP_TIMER_TASK_ENTRY	*_pQNode;										\
-	RTMP_ADAPTER			*_pAd;											\
+	struct rt_ralink_timer *_pTimer = (struct rt_ralink_timer *)data;				\
+	struct rt_rtmp_timer_task_entry *_pQNode;										\
+	struct rt_rtmp_adapter *_pAd;											\
 																			\
 	_pTimer->handle = _func;													\
-	_pAd = (RTMP_ADAPTER *)_pTimer->pAd;										\
+	_pAd = (struct rt_rtmp_adapter *)_pTimer->pAd;										\
 	_pQNode = RtmpTimerQInsert(_pAd, _pTimer);								\
 	if ((_pQNode == NULL) && (_pAd->TimerQ.status & RTMP_TASK_CAN_DO_INSERT))	\
 		RTMP_OS_Add_Timer(&_pTimer->TimerObj, OS_HZ);							\
@@ -114,23 +107,23 @@ void rtmp_timer_##_func(unsigned long data)										\
 #define BUILD_TIMER_FUNCTION(_func)										\
 void rtmp_timer_##_func(unsigned long data)										\
 {																			\
-	PRALINK_TIMER_STRUCT	pTimer = (PRALINK_TIMER_STRUCT) data;				\
+	struct rt_ralink_timer *pTimer = (struct rt_ralink_timer *)data;				\
 																			\
-	_func(NULL, (PVOID) pTimer->cookie, NULL, pTimer);							\
+	_func(NULL, (void *)pTimer->cookie, NULL, pTimer);							\
 	if (pTimer->Repeat)														\
 		RTMP_OS_Add_Timer(&pTimer->TimerObj, pTimer->TimerValue);			\
 }
-#endif // RTMP_TIMER_TASK_SUPPORT //
-
+#endif /* RTMP_TIMER_TASK_SUPPORT // */
 
 DECLARE_TIMER_FUNCTION(MlmePeriodicExec);
 DECLARE_TIMER_FUNCTION(MlmeRssiReportExec);
 DECLARE_TIMER_FUNCTION(AsicRxAntEvalTimeout);
 DECLARE_TIMER_FUNCTION(APSDPeriodicExec);
 DECLARE_TIMER_FUNCTION(AsicRfTuningExec);
+#ifdef RTMP_MAC_USB
+DECLARE_TIMER_FUNCTION(BeaconUpdateExec);
+#endif /* RTMP_MAC_USB // */
 
-
-#ifdef CONFIG_STA_SUPPORT
 DECLARE_TIMER_FUNCTION(BeaconTimeout);
 DECLARE_TIMER_FUNCTION(ScanTimeout);
 DECLARE_TIMER_FUNCTION(AuthTimeout);
@@ -143,20 +136,12 @@ DECLARE_TIMER_FUNCTION(WpaDisassocApAndBlockAssoc);
 DECLARE_TIMER_FUNCTION(PsPollWakeExec);
 DECLARE_TIMER_FUNCTION(RadioOnExec);
 
-#ifdef QOS_DLS_SUPPORT
-DECLARE_TIMER_FUNCTION(DlsTimeoutAction);
-#endif // QOS_DLS_SUPPORT //
-
-
-#endif // CONFIG_STA_SUPPORT //
-
-
-
+#ifdef RTMP_MAC_USB
+DECLARE_TIMER_FUNCTION(RtmpUsbStaAsicForceWakeupTimeout);
+#endif /* RTMP_MAC_USB // */
 
 #if defined(AP_LED) || defined(STA_LED)
 DECLARE_TIMER_FUNCTION(LedCtrlMain);
 #endif
 
-
-
-#endif // __RTMP_TIMER_H__ //
+#endif /* __RTMP_TIMER_H__ // */
diff --git a/drivers/staging/rt2860/rtmp_type.h b/drivers/staging/rt2860/rtmp_type.h
index 1fd7df1e1791..d9bb2d64c8b8 100644
--- a/drivers/staging/rt2860/rtmp_type.h
+++ b/drivers/staging/rt2860/rtmp_type.h
@@ -38,57 +38,52 @@
 #ifndef __RTMP_TYPE_H__
 #define __RTMP_TYPE_H__
 
-#define PACKED  __attribute__ ((packed))
-
-// Put platform dependent declaration here
-// For example, linux type definition
-typedef unsigned char		UINT8;
-typedef unsigned short		UINT16;
-typedef unsigned int		UINT32;
-typedef unsigned long long	UINT64;
-typedef int					INT32;
-typedef long long 			INT64;
+#include <linux/types.h>
 
-typedef unsigned char *			PUINT8;
-typedef unsigned short *		PUINT16;
-typedef unsigned int *			PUINT32;
-typedef unsigned long long *	PUINT64;
-typedef int	*					PINT32;
-typedef long long * 			PINT64;
-
-typedef signed char			CHAR;
-typedef signed short		SHORT;
-typedef signed int			INT;
-typedef signed long			LONG;
-typedef signed long long	LONGLONG;
+#define PACKED  __attribute__ ((packed))
 
+typedef unsigned char BOOLEAN;
 
-typedef unsigned char		UCHAR;
-typedef unsigned short		USHORT;
-typedef unsigned int		UINT;
-typedef unsigned long		ULONG;
-typedef unsigned long long	ULONGLONG;
+typedef union _LARGE_INTEGER {
+	struct {
+		u32 LowPart;
+		int HighPart;
+	} u;
+	long long QuadPart;
+} LARGE_INTEGER;
 
-typedef unsigned char		BOOLEAN;
-typedef void				VOID;
+/* */
+/* Register set pair for initialzation register set definition */
+/* */
+struct rt_rtmp_reg_pair {
+	unsigned long Register;
+	unsigned long Value;
+};
 
-typedef VOID *				PVOID;
-typedef CHAR *				PCHAR;
-typedef UCHAR * 			PUCHAR;
-typedef USHORT *			PUSHORT;
-typedef LONG *				PLONG;
-typedef ULONG *				PULONG;
-typedef UINT *				PUINT;
+struct rt_reg_pair {
+	u8 Register;
+	u8 Value;
+};
 
-typedef unsigned int	NDIS_MEDIA_STATE;
+/* */
+/* Register set pair for initialzation register set definition */
+/* */
+struct rt_rtmp_rf_regs {
+	u8 Channel;
+	unsigned long R1;
+	unsigned long R2;
+	unsigned long R3;
+	unsigned long R4;
+};
 
-typedef union _LARGE_INTEGER {
-    struct {
-        UINT LowPart;
-        INT32 HighPart;
-    } u;
-    INT64 QuadPart;
-} LARGE_INTEGER;
+struct rt_frequency_item {
+	u8 Channel;
+	u8 N;
+	u8 R;
+	u8 K;
+};
 
-#endif  // __RTMP_TYPE_H__
+#define STATUS_SUCCESS				0x00
+#define STATUS_UNSUCCESSFUL		0x01
 
+#endif /* __RTMP_TYPE_H__ // */
diff --git a/drivers/staging/rt2860/rtusb_io.h b/drivers/staging/rt2860/rtusb_io.h
new file mode 100644
index 000000000000..64a2fe435284
--- /dev/null
+++ b/drivers/staging/rt2860/rtusb_io.h
@@ -0,0 +1,185 @@
+/*
+ *************************************************************************
+ * Ralink Tech Inc.
+ * 5F., No.36, Taiyuan St., Jhubei City,
+ * Hsinchu County 302,
+ * Taiwan, R.O.C.
+ *
+ * (c) Copyright 2002-2007, Ralink Technology, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify  *
+ * it under the terms of the GNU General Public License as published by  *
+ * the Free Software Foundation; either version 2 of the License, or     *
+ * (at your option) any later version.                                   *
+ *                                                                       *
+ * This program is distributed in the hope that it will be useful,       *
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
+ * GNU General Public License for more details.                          *
+ *                                                                       *
+ * You should have received a copy of the GNU General Public License     *
+ * along with this program; if not, write to the                         *
+ * Free Software Foundation, Inc.,                                       *
+ * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
+ *                                                                       *
+ *************************************************************************
+*/
+
+#ifndef __RTUSB_IO_H__
+#define __RTUSB_IO_H__
+
+#include "rtmp_type.h"
+
+/* New for MeetingHouse Api support */
+#define CMDTHREAD_VENDOR_RESET                      0x0D730101	/* cmd */
+#define CMDTHREAD_VENDOR_UNPLUG                     0x0D730102	/* cmd */
+#define CMDTHREAD_VENDOR_SWITCH_FUNCTION            0x0D730103	/* cmd */
+#define CMDTHREAD_MULTI_WRITE_MAC                   0x0D730107	/* cmd */
+#define CMDTHREAD_MULTI_READ_MAC                    0x0D730108	/* cmd */
+#define CMDTHREAD_VENDOR_EEPROM_WRITE               0x0D73010A	/* cmd */
+#define CMDTHREAD_VENDOR_EEPROM_READ                0x0D73010B	/* cmd */
+#define CMDTHREAD_VENDOR_ENTER_TESTMODE             0x0D73010C	/* cmd */
+#define CMDTHREAD_VENDOR_EXIT_TESTMODE              0x0D73010D	/* cmd */
+#define CMDTHREAD_VENDOR_WRITE_BBP                  0x0D730119	/* cmd */
+#define CMDTHREAD_VENDOR_READ_BBP                   0x0D730118	/* cmd */
+#define CMDTHREAD_VENDOR_WRITE_RF                   0x0D73011A	/* cmd */
+#define CMDTHREAD_VENDOR_FLIP_IQ                    0x0D73011D	/* cmd */
+#define CMDTHREAD_RESET_BULK_OUT                    0x0D730210	/* cmd */
+#define CMDTHREAD_RESET_BULK_IN                     0x0D730211	/* cmd */
+#define CMDTHREAD_SET_PSM_BIT				0x0D730212	/* cmd */
+#define CMDTHREAD_SET_RADIO                         0x0D730214	/* cmd */
+#define CMDTHREAD_UPDATE_TX_RATE                    0x0D730216	/* cmd */
+#define CMDTHREAD_802_11_ADD_KEY_WEP                0x0D730218	/* cmd */
+#define CMDTHREAD_RESET_FROM_ERROR                  0x0D73021A	/* cmd */
+#define CMDTHREAD_LINK_DOWN                         0x0D73021B	/* cmd */
+#define CMDTHREAD_RESET_FROM_NDIS                   0x0D73021C	/* cmd */
+#define CMDTHREAD_CHECK_GPIO                        0x0D730215	/* cmd */
+#define CMDTHREAD_FORCE_WAKE_UP                     0x0D730222	/* cmd */
+#define CMDTHREAD_SET_BW                            0x0D730225	/* cmd */
+#define CMDTHREAD_SET_ASIC_WCID                     0x0D730226	/* cmd */
+#define CMDTHREAD_SET_ASIC_WCID_CIPHER              0x0D730227	/* cmd */
+#define CMDTHREAD_QKERIODIC_EXECUT                  0x0D73023D	/* cmd */
+#define RT_CMD_SET_KEY_TABLE                        0x0D730228	/* cmd */
+#define RT_CMD_SET_RX_WCID_TABLE                    0x0D730229	/* cmd */
+#define CMDTHREAD_SET_CLIENT_MAC_ENTRY              0x0D73023E	/* cmd */
+#define CMDTHREAD_SET_GROUP_KEY						0x0D73023F	/* cmd */
+#define CMDTHREAD_SET_PAIRWISE_KEY					0x0D730240	/* cmd */
+
+#define CMDTHREAD_802_11_QUERY_HARDWARE_REGISTER    0x0D710105	/* cmd */
+#define CMDTHREAD_802_11_SET_PHY_MODE               0x0D79010C	/* cmd */
+#define CMDTHREAD_802_11_SET_STA_CONFIG             0x0D790111	/* cmd */
+#define CMDTHREAD_802_11_SET_PREAMBLE               0x0D790101	/* cmd */
+#define CMDTHREAD_802_11_COUNTER_MEASURE			0x0D790102	/* cmd */
+/* add by johnli, fix "in_interrupt" error when call "MacTableDeleteEntry" in Rx tasklet */
+#define CMDTHREAD_UPDATE_PROTECT					0x0D790103	/* cmd */
+/* end johnli */
+
+/*CMDTHREAD_MULTI_READ_MAC */
+/*CMDTHREAD_MULTI_WRITE_MAC */
+/*CMDTHREAD_VENDOR_EEPROM_READ */
+/*CMDTHREAD_VENDOR_EEPROM_WRITE */
+struct rt_cmdhandler_tlv {
+	u16 Offset;
+	u16 Length;
+	u8 DataFirst;
+};
+
+struct rt_cmdqelmt;
+
+struct rt_cmdqelmt {
+	u32 command;
+	void *buffer;
+	unsigned long bufferlength;
+	BOOLEAN CmdFromNdis;
+	BOOLEAN SetOperation;
+	struct rt_cmdqelmt *next;
+};
+
+struct rt_cmdq {
+	u32 size;
+	struct rt_cmdqelmt *head;
+	struct rt_cmdqelmt *tail;
+	u32 CmdQState;
+};
+
+#define EnqueueCmd(cmdq, cmdqelmt)		\
+{										\
+	if (cmdq->size == 0)				\
+		cmdq->head = cmdqelmt;			\
+	else								\
+		cmdq->tail->next = cmdqelmt;	\
+	cmdq->tail = cmdqelmt;				\
+	cmdqelmt->next = NULL;				\
+	cmdq->size++;						\
+}
+
+/******************************************************************************
+
+	USB Cmd to ASIC Related MACRO
+
+******************************************************************************/
+/* reset MAC of a station entry to 0xFFFFFFFFFFFF */
+#define RTMP_STA_ENTRY_MAC_RESET(pAd, Wcid)					\
+	{	struct rt_set_asic_wcid	SetAsicWcid;						\
+		SetAsicWcid.WCID = Wcid;								\
+		SetAsicWcid.SetTid = 0xffffffff;						\
+		SetAsicWcid.DeleteTid = 0xffffffff;						\
+		RTUSBEnqueueInternalCmd(pAd, CMDTHREAD_SET_ASIC_WCID,	\
+				&SetAsicWcid, sizeof(struct rt_set_asic_wcid));	}
+
+/* add this entry into ASIC RX WCID search table */
+#define RTMP_STA_ENTRY_ADD(pAd, pEntry)							\
+	RTUSBEnqueueInternalCmd(pAd, CMDTHREAD_SET_CLIENT_MAC_ENTRY,	\
+							pEntry, sizeof(struct rt_mac_table_entry));
+
+/* add by johnli, fix "in_interrupt" error when call "MacTableDeleteEntry" in Rx tasklet */
+/* Set MAC register value according operation mode */
+#define RTMP_UPDATE_PROTECT(pAd)	\
+	RTUSBEnqueueInternalCmd(pAd, CMDTHREAD_UPDATE_PROTECT, NULL, 0);
+/* end johnli */
+
+/* remove Pair-wise key material from ASIC */
+/* yet implement */
+#define RTMP_STA_ENTRY_KEY_DEL(pAd, BssIdx, Wcid)
+
+/* add Client security information into ASIC WCID table and IVEIV table */
+#define RTMP_STA_SECURITY_INFO_ADD(pAd, apidx, KeyID, pEntry)						\
+	{	RTMP_STA_ENTRY_MAC_RESET(pAd, pEntry->Aid);								\
+		if (pEntry->Aid >= 1) {														\
+			struct rt_set_asic_wcid_attri	SetAsicWcidAttri;								\
+			SetAsicWcidAttri.WCID = pEntry->Aid;									\
+			if ((pEntry->AuthMode <= Ndis802_11AuthModeAutoSwitch) &&				\
+				(pEntry->WepStatus == Ndis802_11Encryption1Enabled))				\
+			{																		\
+				SetAsicWcidAttri.Cipher = pAd->SharedKey[apidx][KeyID].CipherAlg;	\
+			}																		\
+			else if (pEntry->AuthMode == Ndis802_11AuthModeWPANone)					\
+			{																		\
+				SetAsicWcidAttri.Cipher = pAd->SharedKey[apidx][KeyID].CipherAlg;	\
+			}																		\
+			else SetAsicWcidAttri.Cipher = 0;										\
+            DBGPRINT(RT_DEBUG_TRACE, ("aid cipher = %ld\n",SetAsicWcidAttri.Cipher));       \
+			RTUSBEnqueueInternalCmd(pAd, CMDTHREAD_SET_ASIC_WCID_CIPHER,			\
+							&SetAsicWcidAttri, sizeof(struct rt_set_asic_wcid_attri)); } }
+
+/* Insert the BA bitmap to ASIC for the Wcid entry */
+#define RTMP_ADD_BA_SESSION_TO_ASIC(_pAd, _Aid, _TID)					\
+		do{																\
+			struct rt_set_asic_wcid	SetAsicWcid;							\
+			SetAsicWcid.WCID = (_Aid);									\
+			SetAsicWcid.SetTid = (0x10000<<(_TID));						\
+			SetAsicWcid.DeleteTid = 0xffffffff;							\
+			RTUSBEnqueueInternalCmd((_pAd), CMDTHREAD_SET_ASIC_WCID, &SetAsicWcid, sizeof(struct rt_set_asic_wcid));	\
+		}while(0)
+
+/* Remove the BA bitmap from ASIC for the Wcid entry */
+#define RTMP_DEL_BA_SESSION_FROM_ASIC(_pAd, _Wcid, _TID)				\
+		do{																\
+			struct rt_set_asic_wcid	SetAsicWcid;							\
+			SetAsicWcid.WCID = (_Wcid);									\
+			SetAsicWcid.SetTid = (0xffffffff);							\
+			SetAsicWcid.DeleteTid = (0x10000<<(_TID) );					\
+			RTUSBEnqueueInternalCmd((_pAd), CMDTHREAD_SET_ASIC_WCID, &SetAsicWcid, sizeof(struct rt_set_asic_wcid));	\
+		}while(0)
+
+#endif /* __RTUSB_IO_H__ // */
diff --git a/drivers/staging/rt2860/spectrum.h b/drivers/staging/rt2860/spectrum.h
index 0a878ba81b48..648fd632b606 100644
--- a/drivers/staging/rt2860/spectrum.h
+++ b/drivers/staging/rt2860/spectrum.h
@@ -23,7 +23,7 @@
  * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
  *                                                                       *
  *************************************************************************
-*/
+ */
 
 #ifndef __SPECTRUM_H__
 #define __SPECTRUM_H__
@@ -31,112 +31,7 @@
 #include "rtmp_type.h"
 #include "spectrum_def.h"
 
-typedef struct PACKED _TPC_REPORT_INFO
-{
-	UINT8 TxPwr;
-	UINT8 LinkMargin;
-} TPC_REPORT_INFO, *PTPC_REPORT_INFO;
-
-typedef struct PACKED _CH_SW_ANN_INFO
-{
-	UINT8 ChSwMode;
-	UINT8 Channel;
-	UINT8 ChSwCnt;
-} CH_SW_ANN_INFO, *PCH_SW_ANN_INFO;
-
-typedef union PACKED _MEASURE_REQ_MODE
-{
-	struct PACKED
-	{
-		UINT8 Rev0:1;
-		UINT8 Enable:1;
-		UINT8 Request:1;
-		UINT8 Report:1;
-		UINT8 Rev1:4;
-	} field;
-	UINT8 word;
-} MEASURE_REQ_MODE, *PMEASURE_REQ_MODE;
-
-typedef struct PACKED _MEASURE_REQ
-{
-	UINT8 ChNum;
-	UINT64 MeasureStartTime;
-	UINT16 MeasureDuration;
-} MEASURE_REQ, *PMEASURE_REQ;
-
-typedef struct PACKED _MEASURE_REQ_INFO
-{
-	UINT8 Token;
-	MEASURE_REQ_MODE ReqMode;
-	UINT8 ReqType;
-	MEASURE_REQ MeasureReq;
-} MEASURE_REQ_INFO, *PMEASURE_REQ_INFO;
-
-typedef union PACKED _MEASURE_BASIC_REPORT_MAP
-{
-	struct PACKED
-	{
-		UINT8 BSS:1;
-		UINT8 OfdmPreamble:1;
-		UINT8 UnidentifiedSignal:1;
-		UINT8 Radar:1;
-		UINT8 Unmeasure:1;
-		UINT8 Rev:3;
-	} field;
-	UINT8 word;
-} MEASURE_BASIC_REPORT_MAP, *PMEASURE_BASIC_REPORT_MAP;
-
-typedef struct PACKED _MEASURE_BASIC_REPORT
-{
-	UINT8 ChNum;
-	UINT64 MeasureStartTime;
-	UINT16 MeasureDuration;
-	MEASURE_BASIC_REPORT_MAP Map;
-} MEASURE_BASIC_REPORT, *PMEASURE_BASIC_REPORT;
-
-typedef struct PACKED _MEASURE_CCA_REPORT
-{
-	UINT8 ChNum;
-	UINT64 MeasureStartTime;
-	UINT16 MeasureDuration;
-	UINT8 CCA_Busy_Fraction;
-} MEASURE_CCA_REPORT, *PMEASURE_CCA_REPORT;
-
-typedef struct PACKED _MEASURE_RPI_REPORT
-{
-	UINT8 ChNum;
-	UINT64 MeasureStartTime;
-	UINT16 MeasureDuration;
-	UINT8 RPI_Density[8];
-} MEASURE_RPI_REPORT, *PMEASURE_RPI_REPORT;
-
-typedef union PACKED _MEASURE_REPORT_MODE
-{
-	struct PACKED
-	{
-		UINT8 Late:1;
-		UINT8 Incapable:1;
-		UINT8 Refused:1;
-		UINT8 Rev:5;
-	} field;
-	UINT8 word;
-} MEASURE_REPORT_MODE, *PMEASURE_REPORT_MODE;
-
-typedef struct PACKED _MEASURE_REPORT_INFO
-{
-	UINT8 Token;
-	MEASURE_REPORT_MODE ReportMode;
-	UINT8 ReportType;
-	UINT8 Octect[0];
-} MEASURE_REPORT_INFO, *PMEASURE_REPORT_INFO;
-
-typedef struct PACKED _QUIET_INFO
-{
-	UINT8 QuietCnt;
-	UINT8 QuietPeriod;
-	UINT8 QuietDuration;
-	UINT8 QuietOffset;
-} QUIET_INFO, *PQUIET_INFO;
+char RTMP_GetTxPwr(struct rt_rtmp_adapter *pAd, IN HTTRANSMIT_SETTING HTTxMode);
 
 /*
 	==========================================================================
@@ -150,14 +45,16 @@ typedef struct PACKED _QUIET_INFO
 	Return	: None.
 	==========================================================================
  */
-VOID EnqueueMeasurementReq(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR pDA,
-	IN UINT8 MeasureToken,
-	IN UINT8 MeasureReqMode,
-	IN UINT8 MeasureReqType,
-	IN UINT8 MeasureCh,
-	IN UINT16 MeasureDuration);
+void MakeMeasurementReqFrame(struct rt_rtmp_adapter *pAd,
+			     u8 *pOutBuffer,
+			     unsigned long *pFrameLen,
+			     u8 TotalLen,
+			     u8 Category,
+			     u8 Action,
+			     u8 MeasureToken,
+			     u8 MeasureReqMode,
+			     u8 MeasureReqType,
+			     u8 NumOfRepetitions);
 
 /*
 	==========================================================================
@@ -171,15 +68,13 @@ VOID EnqueueMeasurementReq(
 	Return	: None.
 	==========================================================================
  */
-VOID EnqueueMeasurementRep(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR pDA,
-	IN UINT8 DialogToken,
-	IN UINT8 MeasureToken,
-	IN UINT8 MeasureReqMode,
-	IN UINT8 MeasureReqType,
-	IN UINT8 ReportInfoLen,
-	IN PUINT8 pReportInfo);
+void EnqueueMeasurementRep(struct rt_rtmp_adapter *pAd,
+			   u8 *pDA,
+			   u8 DialogToken,
+			   u8 MeasureToken,
+			   u8 MeasureReqMode,
+			   u8 MeasureReqType,
+			   u8 ReportInfoLen, u8 *pReportInfo);
 
 /*
 	==========================================================================
@@ -193,10 +88,7 @@ VOID EnqueueMeasurementRep(
 	Return	: None.
 	==========================================================================
  */
-VOID EnqueueTPCReq(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR pDA,
-	IN UCHAR DialogToken);
+void EnqueueTPCReq(struct rt_rtmp_adapter *pAd, u8 *pDA, u8 DialogToken);
 
 /*
 	==========================================================================
@@ -210,12 +102,9 @@ VOID EnqueueTPCReq(
 	Return	: None.
 	==========================================================================
  */
-VOID EnqueueTPCRep(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR pDA,
-	IN UINT8 DialogToken,
-	IN UINT8 TxPwr,
-	IN UINT8 LinkMargin);
+void EnqueueTPCRep(struct rt_rtmp_adapter *pAd,
+		   u8 *pDA,
+		   u8 DialogToken, u8 TxPwr, u8 LinkMargin);
 
 /*
 	==========================================================================
@@ -231,11 +120,8 @@ VOID EnqueueTPCRep(
 	Return	: None.
 	==========================================================================
  */
-VOID EnqueueChSwAnn(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR pDA,
-	IN UINT8 ChSwMode,
-	IN UINT8 NewCh);
+void EnqueueChSwAnn(struct rt_rtmp_adapter *pAd,
+		    u8 *pDA, u8 ChSwMode, u8 NewCh);
 
 /*
 	==========================================================================
@@ -249,9 +135,7 @@ VOID EnqueueChSwAnn(
 	Return	: None.
 	==========================================================================
  */
-VOID PeerSpectrumAction(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem);
+void PeerSpectrumAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem);
 
 /*
 	==========================================================================
@@ -262,31 +146,44 @@ VOID PeerSpectrumAction(
 	Return	: None.
 	==========================================================================
  */
-INT Set_MeasureReq_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg);
+int Set_MeasureReq_Proc(struct rt_rtmp_adapter *pAd, char *arg);
+
+int Set_TpcReq_Proc(struct rt_rtmp_adapter *pAd, char *arg);
+
+int Set_PwrConstraint(struct rt_rtmp_adapter *pAd, char *arg);
+
+void MeasureReqTabInit(struct rt_rtmp_adapter *pAd);
+
+void MeasureReqTabExit(struct rt_rtmp_adapter *pAd);
+
+struct rt_measure_req_entry *MeasureReqLookUp(struct rt_rtmp_adapter *pAd, u8 DialogToken);
+
+struct rt_measure_req_entry *MeasureReqInsert(struct rt_rtmp_adapter *pAd, u8 DialogToken);
+
+void MeasureReqDelete(struct rt_rtmp_adapter *pAd, u8 DialogToken);
 
-INT Set_TpcReq_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg);
+void InsertChannelRepIE(struct rt_rtmp_adapter *pAd,
+			u8 *pFrameBuf,
+			unsigned long *pFrameLen,
+			char *pCountry, u8 RegulatoryClass);
 
-VOID MeasureReqTabInit(
-	IN PRTMP_ADAPTER pAd);
+void InsertTpcReportIE(struct rt_rtmp_adapter *pAd,
+		       u8 *pFrameBuf,
+		       unsigned long *pFrameLen,
+		       u8 TxPwr, u8 LinkMargin);
 
-VOID MeasureReqTabExit(
-	IN PRTMP_ADAPTER pAd);
+void InsertDialogToken(struct rt_rtmp_adapter *pAd,
+		       u8 *pFrameBuf,
+		       unsigned long *pFrameLen, u8 DialogToken);
 
-VOID TpcReqTabInit(
-	IN PRTMP_ADAPTER pAd);
+void TpcReqTabInit(struct rt_rtmp_adapter *pAd);
 
-VOID TpcReqTabExit(
-	IN PRTMP_ADAPTER pAd);
+void TpcReqTabExit(struct rt_rtmp_adapter *pAd);
 
-VOID NotifyChSwAnnToPeerAPs(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR pRA,
-	IN PUCHAR pTA,
-	IN UINT8 ChSwMode,
-	IN UINT8 Channel);
-#endif // __SPECTRUM_H__ //
+void NotifyChSwAnnToPeerAPs(struct rt_rtmp_adapter *pAd,
+			    u8 *pRA,
+			    u8 *pTA, u8 ChSwMode, u8 Channel);
 
+void RguClass_BuildBcnChList(struct rt_rtmp_adapter *pAd,
+			     u8 *pBuf, unsigned long *pBufLen);
+#endif /* __SPECTRUM_H__ // */
diff --git a/drivers/staging/rt2860/spectrum_def.h b/drivers/staging/rt2860/spectrum_def.h
index 4ca4817bba05..8ffcfb0d04f8 100644
--- a/drivers/staging/rt2860/spectrum_def.h
+++ b/drivers/staging/rt2860/spectrum_def.h
@@ -39,57 +39,164 @@
 #ifndef __SPECTRUM_DEF_H__
 #define __SPECTRUM_DEF_H__
 
-#define MAX_MEASURE_REQ_TAB_SIZE		3
+#define MAX_MEASURE_REQ_TAB_SIZE		32
 #define MAX_HASH_MEASURE_REQ_TAB_SIZE	MAX_MEASURE_REQ_TAB_SIZE
 
-#define MAX_TPC_REQ_TAB_SIZE			3
+#define MAX_TPC_REQ_TAB_SIZE			32
 #define MAX_HASH_TPC_REQ_TAB_SIZE		MAX_TPC_REQ_TAB_SIZE
 
-#define MIN_RCV_PWR				100		/* Negative value ((dBm) */
+#define MIN_RCV_PWR				100	/* Negative value ((dBm) */
 
-#define RM_TPC_REQ				0
-#define RM_MEASURE_REQ			1
-
-#define RM_BASIC				0
-#define RM_CCA					1
-#define RM_RPI_HISTOGRAM		2
-
-#define TPC_REQ_AGE_OUT			500		/* ms */
-#define MQ_REQ_AGE_OUT			500		/* ms */
+#define TPC_REQ_AGE_OUT			500	/* ms */
+#define MQ_REQ_AGE_OUT			500	/* ms */
 
 #define TPC_DIALOGTOKEN_HASH_INDEX(_DialogToken)	((_DialogToken) % MAX_HASH_TPC_REQ_TAB_SIZE)
 #define MQ_DIALOGTOKEN_HASH_INDEX(_DialogToken)		((_DialogToken) % MAX_MEASURE_REQ_TAB_SIZE)
 
-typedef struct _MEASURE_REQ_ENTRY
-{
-	struct _MEASURE_REQ_ENTRY *pNext;
-	ULONG lastTime;
-	BOOLEAN	Valid;
-	UINT8 DialogToken;
-	UINT8 MeasureDialogToken[3];	// 0:basic measure, 1: CCA measure, 2: RPI_Histogram measure.
-} MEASURE_REQ_ENTRY, *PMEASURE_REQ_ENTRY;
-
-typedef struct _MEASURE_REQ_TAB
-{
-	UCHAR Size;
-	PMEASURE_REQ_ENTRY Hash[MAX_HASH_MEASURE_REQ_TAB_SIZE];
-	MEASURE_REQ_ENTRY Content[MAX_MEASURE_REQ_TAB_SIZE];
-} MEASURE_REQ_TAB, *PMEASURE_REQ_TAB;
-
-typedef struct _TPC_REQ_ENTRY
-{
-	struct _TPC_REQ_ENTRY *pNext;
-	ULONG lastTime;
+struct rt_measure_req_entry;
+
+struct rt_measure_req_entry {
+	struct rt_measure_req_entry *pNext;
+	unsigned long lastTime;
 	BOOLEAN Valid;
-	UINT8 DialogToken;
-} TPC_REQ_ENTRY, *PTPC_REQ_ENTRY;
+	u8 DialogToken;
+	u8 MeasureDialogToken[3];	/* 0:basic measure, 1: CCA measure, 2: RPI_Histogram measure. */
+};
 
-typedef struct _TPC_REQ_TAB
-{
-	UCHAR Size;
-	PTPC_REQ_ENTRY Hash[MAX_HASH_TPC_REQ_TAB_SIZE];
-	TPC_REQ_ENTRY Content[MAX_TPC_REQ_TAB_SIZE];
-} TPC_REQ_TAB, *PTPC_REQ_TAB;
+struct rt_measure_req_tab {
+	u8 Size;
+	struct rt_measure_req_entry *Hash[MAX_HASH_MEASURE_REQ_TAB_SIZE];
+	struct rt_measure_req_entry Content[MAX_MEASURE_REQ_TAB_SIZE];
+};
 
-#endif // __SPECTRUM_DEF_H__ //
+struct rt_tpc_req_entry;
 
+struct rt_tpc_req_entry {
+	struct rt_tpc_req_entry *pNext;
+	unsigned long lastTime;
+	BOOLEAN Valid;
+	u8 DialogToken;
+};
+
+struct rt_tpc_req_tab {
+	u8 Size;
+	struct rt_tpc_req_entry *Hash[MAX_HASH_TPC_REQ_TAB_SIZE];
+	struct rt_tpc_req_entry Content[MAX_TPC_REQ_TAB_SIZE];
+};
+
+/* The regulatory information */
+struct rt_dot11_channel_set {
+	u8 NumberOfChannels;
+	u8 MaxTxPwr;
+	u8 ChannelList[16];
+};
+
+struct rt_dot11_regulatory_information {
+	u8 RegulatoryClass;
+	struct rt_dot11_channel_set ChannelSet;
+};
+
+#define RM_TPC_REQ				0
+#define RM_MEASURE_REQ			1
+
+#define RM_BASIC				0
+#define RM_CCA					1
+#define RM_RPI_HISTOGRAM		2
+#define RM_CH_LOAD				3
+#define RM_NOISE_HISTOGRAM		4
+
+struct PACKED rt_tpc_report_info {
+	u8 TxPwr;
+	u8 LinkMargin;
+};
+
+struct PACKED rt_ch_sw_ann_info {
+	u8 ChSwMode;
+	u8 Channel;
+	u8 ChSwCnt;
+};
+
+typedef union PACKED _MEASURE_REQ_MODE {
+	struct PACKED {
+		u8 Parallel:1;
+		u8 Enable:1;
+		u8 Request:1;
+		u8 Report:1;
+		u8 DurationMandatory:1;
+		 u8:3;
+	} field;
+	u8 word;
+} MEASURE_REQ_MODE, *PMEASURE_REQ_MODE;
+
+struct PACKED rt_measure_req {
+	u8 ChNum;
+	u64 MeasureStartTime;
+	u16 MeasureDuration;
+};
+
+struct PACKED rt_measure_req_info {
+	u8 Token;
+	MEASURE_REQ_MODE ReqMode;
+	u8 ReqType;
+	u8 Oct[0];
+};
+
+typedef union PACKED _MEASURE_BASIC_REPORT_MAP {
+	struct PACKED {
+		u8 BSS:1;
+
+		u8 OfdmPreamble:1;
+		u8 UnidentifiedSignal:1;
+		u8 Radar:1;
+		u8 Unmeasure:1;
+		u8 Rev:3;
+	} field;
+	u8 word;
+} MEASURE_BASIC_REPORT_MAP, *PMEASURE_BASIC_REPORT_MAP;
+
+struct PACKED rt_measure_basic_report {
+	u8 ChNum;
+	u64 MeasureStartTime;
+	u16 MeasureDuration;
+	MEASURE_BASIC_REPORT_MAP Map;
+};
+
+struct PACKED rt_measure_cca_report {
+	u8 ChNum;
+	u64 MeasureStartTime;
+	u16 MeasureDuration;
+	u8 CCA_Busy_Fraction;
+};
+
+struct PACKED rt_measure_rpi_report {
+	u8 ChNum;
+	u64 MeasureStartTime;
+	u16 MeasureDuration;
+	u8 RPI_Density[8];
+};
+
+typedef union PACKED _MEASURE_REPORT_MODE {
+	struct PACKED {
+		u8 Late:1;
+		u8 Incapable:1;
+		u8 Refused:1;
+		u8 Rev:5;
+	} field;
+	u8 word;
+} MEASURE_REPORT_MODE, *PMEASURE_REPORT_MODE;
+
+struct PACKED rt_measure_report_info {
+	u8 Token;
+	u8 ReportMode;
+	u8 ReportType;
+	u8 Octect[0];
+};
+
+struct PACKED rt_quiet_info {
+	u8 QuietCnt;
+	u8 QuietPeriod;
+	u16 QuietDuration;
+	u16 QuietOffset;
+};
+
+#endif /* __SPECTRUM_DEF_H__ // */
diff --git a/drivers/staging/rt2860/sta/aironet.c b/drivers/staging/rt2860/sta/aironet.c
deleted file mode 100644
index 4af4a1906181..000000000000
--- a/drivers/staging/rt2860/sta/aironet.c
+++ /dev/null
@@ -1,1312 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-	Module Name:
-	aironet.c
-
-	Abstract:
-
-	Revision History:
-	Who			When			What
-	--------	----------		----------------------------------------------
-	Paul Lin	04-06-15		Initial
-*/
-#include "../rt_config.h"
-
-/*
-	==========================================================================
-	Description:
-		association	state machine init,	including state	transition and timer init
-	Parameters:
-		S -	pointer	to the association state machine
-	==========================================================================
- */
-VOID	AironetStateMachineInit(
-	IN	PRTMP_ADAPTER		pAd,
-	IN	STATE_MACHINE		*S,
-	OUT	STATE_MACHINE_FUNC	Trans[])
-{
-	StateMachineInit(S,	Trans, MAX_AIRONET_STATE, MAX_AIRONET_MSG, (STATE_MACHINE_FUNC)Drop, AIRONET_IDLE, AIRONET_MACHINE_BASE);
-	StateMachineSetAction(S, AIRONET_IDLE, MT2_AIRONET_MSG, (STATE_MACHINE_FUNC)AironetMsgAction);
-	StateMachineSetAction(S, AIRONET_IDLE, MT2_AIRONET_SCAN_REQ, (STATE_MACHINE_FUNC)AironetRequestAction);
-	StateMachineSetAction(S, AIRONET_SCANNING, MT2_AIRONET_SCAN_DONE, (STATE_MACHINE_FUNC)AironetReportAction);
-}
-
-/*
-	==========================================================================
-	Description:
-		This is	state machine function.
-		When receiving EAPOL packets which is  for 802.1x key management.
-		Use	both in	WPA, and WPAPSK	case.
-		In this	function, further dispatch to different	functions according	to the received	packet.	 3 categories are :
-		  1.  normal 4-way pairwisekey and 2-way groupkey handshake
-		  2.  MIC error	(Countermeasures attack)  report packet	from STA.
-		  3.  Request for pairwise/group key update	from STA
-	Return:
-	==========================================================================
-*/
-VOID	AironetMsgAction(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	MLME_QUEUE_ELEM	*Elem)
-{
-	USHORT							Length;
-	UCHAR							Index, i;
-	PUCHAR							pData;
-	PAIRONET_RM_REQUEST_FRAME		pRMReq;
-	PRM_REQUEST_ACTION				pReqElem;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("-----> AironetMsgAction\n"));
-
-	// 0. Get Aironet IAPP header first
-	pRMReq = (PAIRONET_RM_REQUEST_FRAME) &Elem->Msg[LENGTH_802_11];
-	pData  = (PUCHAR) &Elem->Msg[LENGTH_802_11];
-
-	// 1. Change endian format form network to little endian
-	Length = be2cpu16(pRMReq->IAPP.Length);
-
-	// 2.0 Sanity check, this should only happen when CCX 2.0 support is enabled
-	if (pAd->StaCfg.CCXEnable != TRUE)
-		return;
-
-	// 2.1 Radio measurement must be on
-	if (pAd->StaCfg.CCXControl.field.RMEnable != 1)
-		return;
-
-	// 2.2. Debug print all bit information
-	DBGPRINT(RT_DEBUG_TRACE, ("IAPP ID & Length %d\n", Length));
-	DBGPRINT(RT_DEBUG_TRACE, ("IAPP Type %x\n", pRMReq->IAPP.Type));
-	DBGPRINT(RT_DEBUG_TRACE, ("IAPP SubType %x\n", pRMReq->IAPP.SubType));
-	DBGPRINT(RT_DEBUG_TRACE, ("IAPP Dialog Token %x\n", pRMReq->IAPP.Token));
-	DBGPRINT(RT_DEBUG_TRACE, ("IAPP Activation Delay %x\n", pRMReq->Delay));
-	DBGPRINT(RT_DEBUG_TRACE, ("IAPP Measurement Offset %x\n", pRMReq->Offset));
-
-	// 3. Check IAPP frame type, it must be 0x32 for Cisco Aironet extension
-	if (pRMReq->IAPP.Type != AIRONET_IAPP_TYPE)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("Wrong IAPP type for Cisco Aironet extension\n"));
-		return;
-	}
-
-	// 4. Check IAPP frame subtype, it must be 0x01 for Cisco Aironet extension request.
-	//    Since we are acting as client only, we will disregards reply subtype.
-	if (pRMReq->IAPP.SubType != AIRONET_IAPP_SUBTYPE_REQUEST)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("Wrong IAPP subtype for Cisco Aironet extension\n"));
-		return;
-	}
-
-	// 5. Verify Destination MAC and Source MAC, both should be all zeros.
-	if (! MAC_ADDR_EQUAL(pRMReq->IAPP.DA, ZERO_MAC_ADDR))
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("Wrong IAPP DA for Cisco Aironet extension, it's not Zero\n"));
-		return;
-	}
-
-	if (! MAC_ADDR_EQUAL(pRMReq->IAPP.SA, ZERO_MAC_ADDR))
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("Wrong IAPP SA for Cisco Aironet extension, it's not Zero\n"));
-		return;
-	}
-
-	// 6. Reinit all report related fields
-	NdisZeroMemory(pAd->StaCfg.FrameReportBuf, 2048);
-	NdisZeroMemory(pAd->StaCfg.BssReportOffset, sizeof(USHORT) * MAX_LEN_OF_BSS_TABLE);
-	NdisZeroMemory(pAd->StaCfg.MeasurementRequest, sizeof(RM_REQUEST_ACTION) * 4);
-
-	// 7. Point to the start of first element report element
-	pAd->StaCfg.FrameReportLen   = LENGTH_802_11 + sizeof(AIRONET_IAPP_HEADER);
-	DBGPRINT(RT_DEBUG_TRACE, ("FR len = %d\n", pAd->StaCfg.FrameReportLen));
-	pAd->StaCfg.LastBssIndex     = 0xff;
-	pAd->StaCfg.RMReqCnt         = 0;
-	pAd->StaCfg.ParallelReq      = FALSE;
-	pAd->StaCfg.ParallelDuration = 0;
-	pAd->StaCfg.ParallelChannel  = 0;
-	pAd->StaCfg.IAPPToken        = pRMReq->IAPP.Token;
-	pAd->StaCfg.CurrentRMReqIdx  = 0;
-	pAd->StaCfg.CLBusyBytes      = 0;
-	// Reset the statistics
-	for (i = 0; i < 8; i++)
-		pAd->StaCfg.RPIDensity[i] = 0;
-
-	Index = 0;
-
-	// 8. Save dialog token for report
-	pAd->StaCfg.IAPPToken = pRMReq->IAPP.Token;
-
-	// Save Activation delay & measurement offset, Not really needed
-
-	// 9. Point to the first request element
-	pData += sizeof(AIRONET_RM_REQUEST_FRAME);
-	//    Length should exclude the CISCO Aironet SNAP header
-	Length -= (sizeof(AIRONET_RM_REQUEST_FRAME) - LENGTH_802_1_H);
-
-	// 10. Start Parsing the Measurement elements.
-	//    Be careful about multiple MR elements within one frames.
-	while (Length > 0)
-	{
-		pReqElem = (PRM_REQUEST_ACTION) pData;
-		switch (pReqElem->ReqElem.Eid)
-		{
-			case IE_MEASUREMENT_REQUEST:
-				// From the example, it seems we only need to support one request in one frame
-				// There is no multiple request in one frame.
-				// Besides, looks like we need to take care the measurement request only.
-				// The measurement request is always 4 bytes.
-
-				// Start parsing this type of request.
-				// 0. Eid is IE_MEASUREMENT_REQUEST
-				// 1. Length didn't include Eid and Length field, it always be 8.
-				// 2. Measurement Token, we nned to save it for the corresponding report.
-				// 3. Measurement Mode, Although there are definitions, but we din't see value other than
-				//    0 from test specs examples.
-				// 4. Measurement Type, this is what we need to do.
-				switch (pReqElem->ReqElem.Type)
-				{
-					case MSRN_TYPE_CHANNEL_LOAD_REQ:
-					case MSRN_TYPE_NOISE_HIST_REQ:
-					case MSRN_TYPE_BEACON_REQ:
-						// Check the Enable non-serving channel measurement control
-						if (pAd->StaCfg.CCXControl.field.DCRMEnable == 0)
-						{
-							// Check channel before enqueue the action
-							if (pReqElem->Measurement.Channel != pAd->CommonCfg.Channel)
-								break;
-						}
-						else
-						{
-							// If off channel measurement, check the TU duration limit
-							if (pReqElem->Measurement.Channel != pAd->CommonCfg.Channel)
-								if (pReqElem->Measurement.Duration > pAd->StaCfg.CCXControl.field.TuLimit)
-									break;
-						}
-
-						// Save requests and execute actions later
-						NdisMoveMemory(&pAd->StaCfg.MeasurementRequest[Index], pReqElem, sizeof(RM_REQUEST_ACTION));
-						Index += 1;
-						break;
-
-					case MSRN_TYPE_FRAME_REQ:
-						// Since it's option, we will support later
-						// FrameRequestAction(pAd, pData);
-						break;
-
-					default:
-						break;
-				}
-
-				// Point to next Measurement request
-				pData  += sizeof(RM_REQUEST_ACTION);
-				Length -= sizeof(RM_REQUEST_ACTION);
-				break;
-
-			// We accept request only, all others are dropped
-			case IE_MEASUREMENT_REPORT:
-			case IE_AP_TX_POWER:
-			case IE_MEASUREMENT_CAPABILITY:
-			default:
-				return;
-		}
-	}
-
-	// 11. Update some flags and index
-	pAd->StaCfg.RMReqCnt = Index;
-
-	if (Index)
-	{
-		MlmeEnqueue(pAd, AIRONET_STATE_MACHINE, MT2_AIRONET_SCAN_REQ, 0, NULL);
-		RT28XX_MLME_HANDLER(pAd);
-	}
-
-	DBGPRINT(RT_DEBUG_TRACE, ("<----- AironetMsgAction\n"));
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-
-	Arguments:
-
-	Return Value:
-		None
-
-	Note:
-
-	========================================================================
-*/
-VOID	AironetRequestAction(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	MLME_QUEUE_ELEM	*Elem)
-{
-	PRM_REQUEST_ACTION	pReq;
-
-	// 1. Point to next request element
-	pReq = (PRM_REQUEST_ACTION) &pAd->StaCfg.MeasurementRequest[pAd->StaCfg.CurrentRMReqIdx];
-
-	// 2. Parse measurement type and call appropriate functions
-	if (pReq->ReqElem.Type == MSRN_TYPE_CHANNEL_LOAD_REQ)
-		// Channel Load measurement request
-		ChannelLoadRequestAction(pAd, pAd->StaCfg.CurrentRMReqIdx);
-	else if (pReq->ReqElem.Type == MSRN_TYPE_NOISE_HIST_REQ)
-		// Noise Histogram measurement request
-		NoiseHistRequestAction(pAd, pAd->StaCfg.CurrentRMReqIdx);
-	else if (pReq->ReqElem.Type == MSRN_TYPE_BEACON_REQ)
-		// Beacon measurement request
-		BeaconRequestAction(pAd, pAd->StaCfg.CurrentRMReqIdx);
-	else
-		// Unknown. Do nothing and return, this should never happen
-		return;
-
-	// 3. Peek into the next request, if it's parallel, we will update the scan time to the largest one
-	if ((pAd->StaCfg.CurrentRMReqIdx + 1) < pAd->StaCfg.RMReqCnt)
-	{
-		pReq = (PRM_REQUEST_ACTION) &pAd->StaCfg.MeasurementRequest[pAd->StaCfg.CurrentRMReqIdx + 1];
-		// Check for parallel bit
-		if ((pReq->ReqElem.Mode & 0x01) && (pReq->Measurement.Channel == pAd->StaCfg.CCXScanChannel))
-		{
-			// Update parallel mode request information
-			pAd->StaCfg.ParallelReq = TRUE;
-			pAd->StaCfg.CCXScanTime = ((pReq->Measurement.Duration > pAd->StaCfg.CCXScanTime) ?
-			(pReq->Measurement.Duration) : (pAd->StaCfg.CCXScanTime));
-		}
-	}
-
-	// 4. Call RT28XX_MLME_HANDLER to execute the request mlme commands, Scan request is the only one used
-	RT28XX_MLME_HANDLER(pAd);
-
-}
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		Prepare channel load report action, special scan operation added
-		to support
-
-	Arguments:
-		pAd	Pointer	to our adapter
-		pData		Start from element ID
-
-	Return Value:
-		None
-
-	Note:
-
-	========================================================================
-*/
-VOID	ChannelLoadRequestAction(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			Index)
-{
-	PRM_REQUEST_ACTION				pReq;
-	MLME_SCAN_REQ_STRUCT			ScanReq;
-	UCHAR							ZeroSsid[32];
-	NDIS_STATUS						NStatus;
-	PUCHAR							pOutBuffer = NULL;
-	PHEADER_802_11					pNullFrame;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("ChannelLoadRequestAction ----->\n"));
-
-	pReq = (PRM_REQUEST_ACTION) &pAd->StaCfg.MeasurementRequest[Index];
-	NdisZeroMemory(ZeroSsid, 32);
-
-	// Prepare for special scan request
-	// The scan definition is different with our Active, Passive scan definition.
-	// For CCX2, Active means send out probe request with broadcast BSSID.
-	// Passive means no probe request sent, only listen to the beacons.
-	// The channel scanned is fixed as specified, no need to scan all channels.
-	// The scan wait time is specified in the request too.
-	// Passive scan Mode
-
-	// Control state machine is not idle, reject the request
-	if ((pAd->Mlme.CntlMachine.CurrState != CNTL_IDLE) && (Index == 0))
-		return;
-
-	// Fill out stuff for scan request
-	ScanParmFill(pAd, &ScanReq, ZeroSsid, 0, BSS_ANY, SCAN_CISCO_CHANNEL_LOAD);
-	MlmeEnqueue(pAd, SYNC_STATE_MACHINE, MT2_MLME_SCAN_REQ, sizeof(MLME_SCAN_REQ_STRUCT), &ScanReq);
-	pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_OID_LIST_SCAN;
-
-	// Reset some internal control flags to make sure this scan works.
-	BssTableInit(&pAd->StaCfg.CCXBssTab);
-	pAd->StaCfg.ScanCnt        = 0;
-	pAd->StaCfg.CCXScanChannel = pReq->Measurement.Channel;
-	pAd->StaCfg.CCXScanTime    = pReq->Measurement.Duration;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Duration %d, Channel %d!\n", pReq->Measurement.Duration, pReq->Measurement.Channel));
-
-	// If it's non serving channel scan, send out a null frame with PSM bit on.
-	if (pAd->StaCfg.CCXScanChannel != pAd->CommonCfg.Channel)
-	{
-		// Use MLME enqueue method
-		NStatus = MlmeAllocateMemory(pAd, (PVOID)&pOutBuffer);  //Get an unused nonpaged memory
-		if (NStatus	!= NDIS_STATUS_SUCCESS)
-			return;
-
-		pNullFrame = (PHEADER_802_11) pOutBuffer;;
-		// Make the power save Null frame with PSM bit on
-		MgtMacHeaderInit(pAd, pNullFrame, SUBTYPE_NULL_FUNC, 1, pAd->CommonCfg.Bssid, pAd->CommonCfg.Bssid);
-		pNullFrame->Duration 	= 0;
-		pNullFrame->FC.Type 	= BTYPE_DATA;
-		pNullFrame->FC.PwrMgmt	= PWR_SAVE;
-
-		// Send using priority queue
-		MiniportMMRequest(pAd, 0, pOutBuffer, sizeof(HEADER_802_11));
-		MlmeFreeMemory(pAd, pOutBuffer);
-		DBGPRINT(RT_DEBUG_TRACE, ("Send PSM Data frame for off channel RM\n"));
-		RTMPusecDelay(5000);
-	}
-
-	pAd->StaCfg.CCXReqType     = MSRN_TYPE_CHANNEL_LOAD_REQ;
-	pAd->StaCfg.CLBusyBytes    = 0;
-	// Enable Rx with promiscuous reception
-	RTMP_IO_WRITE32(pAd, RX_FILTR_CFG, 0x1010);
-
-	// Set channel load measurement flag
-	RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_RADIO_MEASUREMENT);
-
-	pAd->Mlme.AironetMachine.CurrState = AIRONET_SCANNING;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("ChannelLoadRequestAction <-----\n"));
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-		Prepare noise histogram report action, special scan operation added
-		to support
-
-	Arguments:
-		pAd	Pointer	to our adapter
-		pData		Start from element ID
-
-	Return Value:
-		None
-
-	Note:
-
-	========================================================================
-*/
-VOID	NoiseHistRequestAction(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			Index)
-{
-	PRM_REQUEST_ACTION				pReq;
-	MLME_SCAN_REQ_STRUCT			ScanReq;
-	UCHAR							ZeroSsid[32], i;
-	NDIS_STATUS						NStatus;
-	PUCHAR							pOutBuffer = NULL;
-	PHEADER_802_11					pNullFrame;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("NoiseHistRequestAction ----->\n"));
-
-	pReq = (PRM_REQUEST_ACTION) &pAd->StaCfg.MeasurementRequest[Index];
-	NdisZeroMemory(ZeroSsid, 32);
-
-	// Prepare for special scan request
-	// The scan definition is different with our Active, Passive scan definition.
-	// For CCX2, Active means send out probe request with broadcast BSSID.
-	// Passive means no probe request sent, only listen to the beacons.
-	// The channel scanned is fixed as specified, no need to scan all channels.
-	// The scan wait time is specified in the request too.
-	// Passive scan Mode
-
-	// Control state machine is not idle, reject the request
-	if ((pAd->Mlme.CntlMachine.CurrState != CNTL_IDLE) && (Index == 0))
-		return;
-
-	// Fill out stuff for scan request
-	ScanParmFill(pAd, &ScanReq, ZeroSsid, 0, BSS_ANY, SCAN_CISCO_NOISE);
-	MlmeEnqueue(pAd, SYNC_STATE_MACHINE, MT2_MLME_SCAN_REQ, sizeof(MLME_SCAN_REQ_STRUCT), &ScanReq);
-	pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_OID_LIST_SCAN;
-
-	// Reset some internal control flags to make sure this scan works.
-	BssTableInit(&pAd->StaCfg.CCXBssTab);
-	pAd->StaCfg.ScanCnt        = 0;
-	pAd->StaCfg.CCXScanChannel = pReq->Measurement.Channel;
-	pAd->StaCfg.CCXScanTime    = pReq->Measurement.Duration;
-	pAd->StaCfg.CCXReqType     = MSRN_TYPE_NOISE_HIST_REQ;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Duration %d, Channel %d!\n", pReq->Measurement.Duration, pReq->Measurement.Channel));
-
-	// If it's non serving channel scan, send out a null frame with PSM bit on.
-	if (pAd->StaCfg.CCXScanChannel != pAd->CommonCfg.Channel)
-	{
-		// Use MLME enqueue method
-		NStatus = MlmeAllocateMemory(pAd, (PVOID)&pOutBuffer);  //Get an unused nonpaged memory
-		if (NStatus	!= NDIS_STATUS_SUCCESS)
-			return;
-
-		pNullFrame = (PHEADER_802_11) pOutBuffer;
-		// Make the power save Null frame with PSM bit on
-		MgtMacHeaderInit(pAd, pNullFrame, SUBTYPE_NULL_FUNC, 1, pAd->CommonCfg.Bssid, pAd->CommonCfg.Bssid);
-		pNullFrame->Duration 	= 0;
-		pNullFrame->FC.Type  	= BTYPE_DATA;
-		pNullFrame->FC.PwrMgmt	= PWR_SAVE;
-
-		// Send using priority queue
-		MiniportMMRequest(pAd, 0, pOutBuffer, sizeof(HEADER_802_11));
-		MlmeFreeMemory(pAd, pOutBuffer);
-		DBGPRINT(RT_DEBUG_TRACE, ("Send PSM Data frame for off channel RM\n"));
-		RTMPusecDelay(5000);
-	}
-
-	// Reset the statistics
-	for (i = 0; i < 8; i++)
-		pAd->StaCfg.RPIDensity[i] = 0;
-
-	// Enable Rx with promiscuous reception
-	RTMP_IO_WRITE32(pAd, RX_FILTR_CFG, 0x1010);
-
-	// Set channel load measurement flag
-	RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_RADIO_MEASUREMENT);
-
-	pAd->Mlme.AironetMachine.CurrState = AIRONET_SCANNING;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("NoiseHistRequestAction <-----\n"));
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-		Prepare Beacon report action, special scan operation added
-		to support
-
-	Arguments:
-		pAd	Pointer	to our adapter
-		pData		Start from element ID
-
-	Return Value:
-		None
-
-	Note:
-
-	========================================================================
-*/
-VOID	BeaconRequestAction(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			Index)
-{
-	PRM_REQUEST_ACTION				pReq;
-	NDIS_STATUS						NStatus;
-	PUCHAR							pOutBuffer = NULL;
-	PHEADER_802_11					pNullFrame;
-	MLME_SCAN_REQ_STRUCT			ScanReq;
-	UCHAR							ZeroSsid[32];
-
-	DBGPRINT(RT_DEBUG_TRACE, ("BeaconRequestAction ----->\n"));
-
-	pReq = (PRM_REQUEST_ACTION) &pAd->StaCfg.MeasurementRequest[Index];
-	NdisZeroMemory(ZeroSsid, 32);
-
-	// Prepare for special scan request
-	// The scan definition is different with our Active, Passive scan definition.
-	// For CCX2, Active means send out probe request with broadcast BSSID.
-	// Passive means no probe request sent, only listen to the beacons.
-	// The channel scanned is fixed as specified, no need to scan all channels.
-	// The scan wait time is specified in the request too.
-	if (pReq->Measurement.ScanMode == MSRN_SCAN_MODE_PASSIVE)
-	{
-		// Passive scan Mode
-		DBGPRINT(RT_DEBUG_TRACE, ("Passive Scan Mode!\n"));
-
-		// Control state machine is not idle, reject the request
-		if ((pAd->Mlme.CntlMachine.CurrState != CNTL_IDLE) && (Index == 0))
-			return;
-
-		// Fill out stuff for scan request
-		ScanParmFill(pAd, &ScanReq, ZeroSsid, 0, BSS_ANY, SCAN_CISCO_PASSIVE);
-		MlmeEnqueue(pAd, SYNC_STATE_MACHINE, MT2_MLME_SCAN_REQ, sizeof(MLME_SCAN_REQ_STRUCT), &ScanReq);
-		pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_OID_LIST_SCAN;
-
-		// Reset some internal control flags to make sure this scan works.
-		BssTableInit(&pAd->StaCfg.CCXBssTab);
-		pAd->StaCfg.ScanCnt        = 0;
-		pAd->StaCfg.CCXScanChannel = pReq->Measurement.Channel;
-		pAd->StaCfg.CCXScanTime    = pReq->Measurement.Duration;
-		pAd->StaCfg.CCXReqType     = MSRN_TYPE_BEACON_REQ;
-		DBGPRINT(RT_DEBUG_TRACE, ("Duration %d!\n", pReq->Measurement.Duration));
-
-		// If it's non serving channel scan, send out a null frame with PSM bit on.
-		if (pAd->StaCfg.CCXScanChannel != pAd->CommonCfg.Channel)
-		{
-			// Use MLME enqueue method
-			NStatus = MlmeAllocateMemory(pAd, (PVOID)&pOutBuffer);  //Get an unused nonpaged memory
-			if (NStatus	!= NDIS_STATUS_SUCCESS)
-				return;
-
-			pNullFrame = (PHEADER_802_11) pOutBuffer;
-			// Make the power save Null frame with PSM bit on
-			MgtMacHeaderInit(pAd, pNullFrame, SUBTYPE_NULL_FUNC, 1, pAd->CommonCfg.Bssid, pAd->CommonCfg.Bssid);
-			pNullFrame->Duration 	= 0;
-			pNullFrame->FC.Type     = BTYPE_DATA;
-			pNullFrame->FC.PwrMgmt  = PWR_SAVE;
-
-			// Send using priority queue
-			MiniportMMRequest(pAd, 0, pOutBuffer, sizeof(HEADER_802_11));
-			MlmeFreeMemory(pAd, pOutBuffer);
-			DBGPRINT(RT_DEBUG_TRACE, ("Send PSM Data frame for off channel RM\n"));
-			RTMPusecDelay(5000);
-		}
-
-		pAd->Mlme.AironetMachine.CurrState = AIRONET_SCANNING;
-	}
-	else if (pReq->Measurement.ScanMode == MSRN_SCAN_MODE_ACTIVE)
-	{
-		// Active scan Mode
-		DBGPRINT(RT_DEBUG_TRACE, ("Active Scan Mode!\n"));
-
-		// Control state machine is not idle, reject the request
-		if (pAd->Mlme.CntlMachine.CurrState != CNTL_IDLE)
-			return;
-
-		// Fill out stuff for scan request
-		ScanParmFill(pAd, &ScanReq, ZeroSsid, 0, BSS_ANY, SCAN_CISCO_ACTIVE);
-		MlmeEnqueue(pAd, SYNC_STATE_MACHINE, MT2_MLME_SCAN_REQ, sizeof(MLME_SCAN_REQ_STRUCT), &ScanReq);
-		pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_OID_LIST_SCAN;
-
-		// Reset some internal control flags to make sure this scan works.
-		BssTableInit(&pAd->StaCfg.CCXBssTab);
-		pAd->StaCfg.ScanCnt        = 0;
-		pAd->StaCfg.CCXScanChannel = pReq->Measurement.Channel;
-		pAd->StaCfg.CCXScanTime    = pReq->Measurement.Duration;
-		pAd->StaCfg.CCXReqType     = MSRN_TYPE_BEACON_REQ;
-		DBGPRINT(RT_DEBUG_TRACE, ("Duration %d!\n", pReq->Measurement.Duration));
-
-		// If it's non serving channel scan, send out a null frame with PSM bit on.
-		if (pAd->StaCfg.CCXScanChannel != pAd->CommonCfg.Channel)
-		{
-			// Use MLME enqueue method
-			NStatus = MlmeAllocateMemory(pAd, (PVOID)&pOutBuffer);  //Get an unused nonpaged memory
-			if (NStatus	!= NDIS_STATUS_SUCCESS)
-				return;
-
-			pNullFrame = (PHEADER_802_11) pOutBuffer;
-			// Make the power save Null frame with PSM bit on
-			MgtMacHeaderInit(pAd, pNullFrame, SUBTYPE_NULL_FUNC, 1, pAd->CommonCfg.Bssid, pAd->CommonCfg.Bssid);
-			pNullFrame->Duration 	= 0;
-			pNullFrame->FC.Type     = BTYPE_DATA;
-			pNullFrame->FC.PwrMgmt  = PWR_SAVE;
-
-			// Send using priority queue
-			MiniportMMRequest(pAd, 0, pOutBuffer, sizeof(HEADER_802_11));
-			MlmeFreeMemory(pAd, pOutBuffer);
-			DBGPRINT(RT_DEBUG_TRACE, ("Send PSM Data frame for off channel RM\n"));
-			RTMPusecDelay(5000);
-		}
-
-		pAd->Mlme.AironetMachine.CurrState = AIRONET_SCANNING;
-	}
-	else if (pReq->Measurement.ScanMode == MSRN_SCAN_MODE_BEACON_TABLE)
-	{
-		// Beacon report Mode, report all the APS in current bss table
-		DBGPRINT(RT_DEBUG_TRACE, ("Beacon Report Mode!\n"));
-
-		// Copy current BSS table to CCX table, we can omit this step later on.
-		NdisMoveMemory(&pAd->StaCfg.CCXBssTab, &pAd->ScanTab, sizeof(BSS_TABLE));
-
-		// Create beacon report from Bss table
-		AironetCreateBeaconReportFromBssTable(pAd);
-
-		// Set state to scanning
-		pAd->Mlme.AironetMachine.CurrState = AIRONET_SCANNING;
-
-		// Enqueue report request
-		// Cisco scan request is finished, prepare beacon report
-		MlmeEnqueue(pAd, AIRONET_STATE_MACHINE, MT2_AIRONET_SCAN_DONE, 0, NULL);
-	}
-	else
-	{
-		// Wrong scan Mode
-		DBGPRINT(RT_DEBUG_TRACE, ("Wrong Scan Mode!\n"));
-	}
-
-	DBGPRINT(RT_DEBUG_TRACE, ("BeaconRequestAction <-----\n"));
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-
-	Arguments:
-
-	Return Value:
-		None
-
-	Note:
-
-	========================================================================
-*/
-VOID	AironetReportAction(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	MLME_QUEUE_ELEM	*Elem)
-{
-	PRM_REQUEST_ACTION	pReq;
-	ULONG				Now32;
-
-    NdisGetSystemUpTime(&Now32);
-	pAd->StaCfg.LastBeaconRxTime = Now32;
-
-	pReq = (PRM_REQUEST_ACTION) &pAd->StaCfg.MeasurementRequest[pAd->StaCfg.CurrentRMReqIdx];
-
-	DBGPRINT(RT_DEBUG_TRACE, ("AironetReportAction ----->\n"));
-
-	// 1. Parse measurement type and call appropriate functions
-	if (pReq->ReqElem.Type == MSRN_TYPE_CHANNEL_LOAD_REQ)
-		// Channel Load measurement request
-		ChannelLoadReportAction(pAd, pAd->StaCfg.CurrentRMReqIdx);
-	else if (pReq->ReqElem.Type == MSRN_TYPE_NOISE_HIST_REQ)
-		// Noise Histogram measurement request
-		NoiseHistReportAction(pAd, pAd->StaCfg.CurrentRMReqIdx);
-	else if (pReq->ReqElem.Type == MSRN_TYPE_BEACON_REQ)
-		// Beacon measurement request
-		BeaconReportAction(pAd, pAd->StaCfg.CurrentRMReqIdx);
-	else
-		// Unknown. Do nothing and return
-		;
-
-	// 2. Point to the correct index of action element, start from 0
-	pAd->StaCfg.CurrentRMReqIdx++;
-
-	// 3. Check for parallel actions
-	if (pAd->StaCfg.ParallelReq == TRUE)
-	{
-		pReq = (PRM_REQUEST_ACTION) &pAd->StaCfg.MeasurementRequest[pAd->StaCfg.CurrentRMReqIdx];
-
-		// Process next action right away
-		if (pReq->ReqElem.Type == MSRN_TYPE_CHANNEL_LOAD_REQ)
-			// Channel Load measurement request
-			ChannelLoadReportAction(pAd, pAd->StaCfg.CurrentRMReqIdx);
-		else if (pReq->ReqElem.Type == MSRN_TYPE_NOISE_HIST_REQ)
-			// Noise Histogram measurement request
-			NoiseHistReportAction(pAd, pAd->StaCfg.CurrentRMReqIdx);
-
-		pAd->StaCfg.ParallelReq = FALSE;
-		pAd->StaCfg.CurrentRMReqIdx++;
-	}
-
-	if (pAd->StaCfg.CurrentRMReqIdx >= pAd->StaCfg.RMReqCnt)
-	{
-		// 4. There is no more unprocessed measurement request, go for transmit this report
-		AironetFinalReportAction(pAd);
-		pAd->Mlme.AironetMachine.CurrState = AIRONET_IDLE;
-	}
-	else
-	{
-		pReq = (PRM_REQUEST_ACTION) &pAd->StaCfg.MeasurementRequest[pAd->StaCfg.CurrentRMReqIdx];
-
-		if (pReq->Measurement.Channel != pAd->CommonCfg.Channel)
-		{
-			RTMPusecDelay(100000);
-		}
-
-		// 5. There are more requests to be measure
-		MlmeEnqueue(pAd, AIRONET_STATE_MACHINE, MT2_AIRONET_SCAN_REQ, 0, NULL);
-		RT28XX_MLME_HANDLER(pAd);
-	}
-
-	DBGPRINT(RT_DEBUG_TRACE, ("AironetReportAction <-----\n"));
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-
-	Arguments:
-
-	Return Value:
-		None
-
-	Note:
-
-	========================================================================
-*/
-VOID	AironetFinalReportAction(
-	IN	PRTMP_ADAPTER	pAd)
-{
-	PUCHAR					pDest;
-	PAIRONET_IAPP_HEADER	pIAPP;
-	PHEADER_802_11			pHeader;
-	UCHAR					AckRate = RATE_2;
-	USHORT					AckDuration = 0;
-	NDIS_STATUS				NStatus;
-	PUCHAR					pOutBuffer = NULL;
-	ULONG					FrameLen = 0;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("AironetFinalReportAction ----->\n"));
-
-	// 0. Set up the frame pointer, Frame was inited at the end of message action
-	pDest = &pAd->StaCfg.FrameReportBuf[LENGTH_802_11];
-
-	// 1. Update report IAPP fields
-	pIAPP = (PAIRONET_IAPP_HEADER) pDest;
-
-	// 2. Copy Cisco SNAP header
-	NdisMoveMemory(pIAPP->CiscoSnapHeader, SNAP_AIRONET, LENGTH_802_1_H);
-
-	// 3. network order for this 16bit length
-	pIAPP->Length  = cpu2be16(pAd->StaCfg.FrameReportLen - LENGTH_802_11 - LENGTH_802_1_H);
-
-	// 3.1 sanity check the report length, ignore it if there is nothing to report
-	if (be2cpu16(pIAPP->Length) <= 18)
-		return;
-
-	// 4. Type must be 0x32
-	pIAPP->Type    = AIRONET_IAPP_TYPE;
-
-	// 5. SubType for report must be 0x81
-	pIAPP->SubType = AIRONET_IAPP_SUBTYPE_REPORT;
-
-	// 6. DA is not used and must be zero, although the whole frame was cleared at the start of function
-	//    We will do it again here. We can use BSSID instead
-	COPY_MAC_ADDR(pIAPP->DA, pAd->CommonCfg.Bssid);
-
-	// 7. SA is the client reporting which must be our MAC
-	COPY_MAC_ADDR(pIAPP->SA, pAd->CurrentAddress);
-
-	// 8. Copy the saved dialog token
-	pIAPP->Token = pAd->StaCfg.IAPPToken;
-
-	// 9. Make the Report frame 802.11 header
-	//    Reuse function in wpa.c
-	pHeader = (PHEADER_802_11) pAd->StaCfg.FrameReportBuf;
-	pAd->Sequence ++;
-	WpaMacHeaderInit(pAd, pHeader, 0, pAd->CommonCfg.Bssid);
-
-	// ACK size	is 14 include CRC, and its rate	is based on real time information
-	AckRate     = pAd->CommonCfg.ExpectedACKRate[pAd->CommonCfg.MlmeRate];
-	AckDuration = RTMPCalcDuration(pAd, AckRate, 14);
-	pHeader->Duration = pAd->CommonCfg.Dsifs + AckDuration;
-
-	// Use MLME enqueue method
-	NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);  //Get an unused nonpaged memory
-	if (NStatus	!= NDIS_STATUS_SUCCESS)
-		return;
-
-	// 10. Prepare report frame with dynamic outbuffer. Just simply copy everything.
-	MakeOutgoingFrame(pOutBuffer,                       &FrameLen,
-	                  pAd->StaCfg.FrameReportLen, pAd->StaCfg.FrameReportBuf,
-		              END_OF_ARGS);
-
-	// 11. Send using priority queue
-	MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
-	MlmeFreeMemory(pAd, pOutBuffer);
-
-	pAd->StaCfg.CCXReqType = MSRN_TYPE_UNUSED;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("AironetFinalReportAction <-----\n"));
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-
-	Arguments:
-
-	Return Value:
-		None
-
-	Note:
-
-	========================================================================
-*/
-VOID	ChannelLoadReportAction(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			Index)
-{
-	PMEASUREMENT_REPORT_ELEMENT	pReport;
-	PCHANNEL_LOAD_REPORT		pLoad;
-	PUCHAR						pDest;
-	UCHAR						CCABusyFraction;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("ChannelLoadReportAction ----->\n"));
-
-	// Disable Rx with promiscuous reception, make it back to normal
-	RTMP_IO_WRITE32(pAd, RX_FILTR_CFG, STANORMAL); // Staion not drop control frame will fail WiFi Certification.
-
-	// 0. Setup pointer for processing beacon & probe response
-	pDest = (PUCHAR) &pAd->StaCfg.FrameReportBuf[pAd->StaCfg.FrameReportLen];
-	pReport = (PMEASUREMENT_REPORT_ELEMENT) pDest;
-
-	// 1. Fill Measurement report element field.
-	pReport->Eid    = IE_MEASUREMENT_REPORT;
-	// Fixed Length at 9, not include Eid and length fields
-	pReport->Length = 9;
-	pReport->Token  = pAd->StaCfg.MeasurementRequest[Index].ReqElem.Token;
-	pReport->Mode   = pAd->StaCfg.MeasurementRequest[Index].ReqElem.Mode;
-	pReport->Type   = MSRN_TYPE_CHANNEL_LOAD_REQ;
-
-	// 2. Fill channel report measurement data
-	pDest += sizeof(MEASUREMENT_REPORT_ELEMENT);
-	pLoad  = (PCHANNEL_LOAD_REPORT) pDest;
-	pLoad->Channel  = pAd->StaCfg.MeasurementRequest[Index].Measurement.Channel;
-	pLoad->Spare    = 0;
-	pLoad->Duration = pAd->StaCfg.MeasurementRequest[Index].Measurement.Duration;
-
-	// 3. Calculate the CCA Busy Fraction
-	//    (Bytes + ACK size) * 8 / Tx speed * 255 / 1000 / measurement duration, use 24 us Tx speed
-	//     =  (Bytes + ACK) / 12 / duration
-	//     9 is the good value for pAd->StaCfg.CLFactor
-	// CCABusyFraction = (UCHAR) (pAd->StaCfg.CLBusyBytes / 9 / pLoad->Duration);
-	CCABusyFraction = (UCHAR) (pAd->StaCfg.CLBusyBytes / pAd->StaCfg.CLFactor / pLoad->Duration);
-	if (CCABusyFraction < 10)
-			CCABusyFraction = (UCHAR) (pAd->StaCfg.CLBusyBytes / 3 / pLoad->Duration) + 1;
-
-	pLoad->CCABusy = CCABusyFraction;
-	DBGPRINT(RT_DEBUG_TRACE, ("CLBusyByte %ld, Duration %d, Result, %d\n", pAd->StaCfg.CLBusyBytes, pLoad->Duration, CCABusyFraction));
-
-	DBGPRINT(RT_DEBUG_TRACE, ("FrameReportLen %d\n", pAd->StaCfg.FrameReportLen));
-	pAd->StaCfg.FrameReportLen += (sizeof(MEASUREMENT_REPORT_ELEMENT) + sizeof(CHANNEL_LOAD_REPORT));
-	DBGPRINT(RT_DEBUG_TRACE, ("FrameReportLen %d\n", pAd->StaCfg.FrameReportLen));
-
-	// 4. Clear channel load measurement flag
-	RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_RADIO_MEASUREMENT);
-
-	// 5. reset to idle state
-	pAd->Mlme.AironetMachine.CurrState = AIRONET_IDLE;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("ChannelLoadReportAction <-----\n"));
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-
-	Arguments:
-
-	Return Value:
-		None
-
-	Note:
-
-	========================================================================
-*/
-VOID	NoiseHistReportAction(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			Index)
-{
-	PMEASUREMENT_REPORT_ELEMENT	pReport;
-	PNOISE_HIST_REPORT			pNoise;
-	PUCHAR						pDest;
-	UCHAR						i,NoiseCnt;
-	USHORT						TotalRPICnt, TotalRPISum;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("NoiseHistReportAction ----->\n"));
-
-	// 0. Disable Rx with promiscuous reception, make it back to normal
-	RTMP_IO_WRITE32(pAd, RX_FILTR_CFG, STANORMAL); // Staion not drop control frame will fail WiFi Certification.
-	// 1. Setup pointer for processing beacon & probe response
-	pDest = (PUCHAR) &pAd->StaCfg.FrameReportBuf[pAd->StaCfg.FrameReportLen];
-	pReport = (PMEASUREMENT_REPORT_ELEMENT) pDest;
-
-	// 2. Fill Measurement report element field.
-	pReport->Eid    = IE_MEASUREMENT_REPORT;
-	// Fixed Length at 16, not include Eid and length fields
-	pReport->Length = 16;
-	pReport->Token  = pAd->StaCfg.MeasurementRequest[Index].ReqElem.Token;
-	pReport->Mode   = pAd->StaCfg.MeasurementRequest[Index].ReqElem.Mode;
-	pReport->Type   = MSRN_TYPE_NOISE_HIST_REQ;
-
-	// 3. Fill noise histogram report measurement data
-	pDest += sizeof(MEASUREMENT_REPORT_ELEMENT);
-	pNoise  = (PNOISE_HIST_REPORT) pDest;
-	pNoise->Channel  = pAd->StaCfg.MeasurementRequest[Index].Measurement.Channel;
-	pNoise->Spare    = 0;
-	pNoise->Duration = pAd->StaCfg.MeasurementRequest[Index].Measurement.Duration;
-	// 4. Fill Noise histogram, the total RPI counts should be 0.4 * TU
-	//    We estimate 4000 normal packets received durning 10 seconds test.
-	//    Adjust it if required.
-	// 3 is a good value for pAd->StaCfg.NHFactor
-	// TotalRPICnt = pNoise->Duration * 3 / 10;
-	TotalRPICnt = pNoise->Duration * pAd->StaCfg.NHFactor / 10;
-	TotalRPISum = 0;
-
-	for (i = 0; i < 8; i++)
-	{
-		TotalRPISum += pAd->StaCfg.RPIDensity[i];
-		DBGPRINT(RT_DEBUG_TRACE, ("RPI %d Conuts %d\n", i, pAd->StaCfg.RPIDensity[i]));
-	}
-
-	// Double check if the counter is larger than our expectation.
-	// We will replace it with the total number plus a fraction.
-	if (TotalRPISum > TotalRPICnt)
-		TotalRPICnt = TotalRPISum + pNoise->Duration / 20;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Total RPI Conuts %d\n", TotalRPICnt));
-
-	// 5. Initialize noise count for the total summation of 0xff
-	NoiseCnt = 0;
-	for (i = 1; i < 8; i++)
-	{
-		pNoise->Density[i] = (UCHAR) (pAd->StaCfg.RPIDensity[i] * 255 / TotalRPICnt);
-		if ((pNoise->Density[i] == 0) && (pAd->StaCfg.RPIDensity[i] != 0))
-			pNoise->Density[i]++;
-		NoiseCnt += pNoise->Density[i];
-		DBGPRINT(RT_DEBUG_TRACE, ("Reported RPI[%d]  = 0x%02x\n", i, pNoise->Density[i]));
-	}
-
-	// 6. RPI[0] represents the rest of counts
-	pNoise->Density[0] = 0xff - NoiseCnt;
-	DBGPRINT(RT_DEBUG_TRACE, ("Reported RPI[0]  = 0x%02x\n", pNoise->Density[0]));
-
-	pAd->StaCfg.FrameReportLen += (sizeof(MEASUREMENT_REPORT_ELEMENT) + sizeof(NOISE_HIST_REPORT));
-
-	// 7. Clear channel load measurement flag
-	RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_RADIO_MEASUREMENT);
-
-	// 8. reset to idle state
-	pAd->Mlme.AironetMachine.CurrState = AIRONET_IDLE;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("NoiseHistReportAction <-----\n"));
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-		Prepare Beacon report action,
-
-	Arguments:
-		pAd	Pointer	to our adapter
-
-	Return Value:
-		None
-
-	Note:
-
-	========================================================================
-*/
-VOID	BeaconReportAction(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			Index)
-{
-	DBGPRINT(RT_DEBUG_TRACE, ("BeaconReportAction ----->\n"));
-
-	// Looks like we don't have anything thing need to do here.
-	// All measurement report already finished in AddBeaconReport
-	// The length is in the FrameReportLen
-
-	// reset Beacon index for next beacon request
-	pAd->StaCfg.LastBssIndex = 0xff;
-
-	// reset to idle state
-	pAd->Mlme.AironetMachine.CurrState = AIRONET_IDLE;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("BeaconReportAction <-----\n"));
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-
-	Arguments:
-		Index		Current BSSID in CCXBsstab entry index
-
-	Return Value:
-
-	Note:
-
-	========================================================================
-*/
-VOID	AironetAddBeaconReport(
-	IN	PRTMP_ADAPTER		pAd,
-	IN	ULONG				Index,
-	IN	PMLME_QUEUE_ELEM	pElem)
-{
-	PVOID						pMsg;
-	PUCHAR						pSrc, pDest;
-	UCHAR						ReqIdx;
-	ULONG						MsgLen;
-	USHORT						Length;
-	PFRAME_802_11				pFrame;
-	PMEASUREMENT_REPORT_ELEMENT	pReport;
-	PEID_STRUCT			        pEid;
-	PBEACON_REPORT				pBeaconReport;
-	PBSS_ENTRY					pBss;
-
-	// 0. Setup pointer for processing beacon & probe response
-	pMsg   = pElem->Msg;
-	MsgLen = pElem->MsgLen;
-	pFrame = (PFRAME_802_11) pMsg;
-	pSrc   = pFrame->Octet;				// Start from AP TSF
-	pBss   = (PBSS_ENTRY) &pAd->StaCfg.CCXBssTab.BssEntry[Index];
-	ReqIdx = pAd->StaCfg.CurrentRMReqIdx;
-
-	// 1 Check the Index, if we already create this entry, only update the average RSSI
-	if ((Index <= pAd->StaCfg.LastBssIndex) && (pAd->StaCfg.LastBssIndex != 0xff))
-	{
-		pDest  = (PUCHAR) &pAd->StaCfg.FrameReportBuf[pAd->StaCfg.BssReportOffset[Index]];
-		// Point to bss report information
-		pDest += sizeof(MEASUREMENT_REPORT_ELEMENT);
-		pBeaconReport = (PBEACON_REPORT) pDest;
-
-		// Update Rx power, in dBm
-		// Get the original RSSI readback from BBP
-		pBeaconReport->RxPower += pAd->BbpRssiToDbmDelta;
-		// Average the Rssi reading
-		pBeaconReport->RxPower  = (pBeaconReport->RxPower + pBss->Rssi) / 2;
-		// Get to dBm format
-		pBeaconReport->RxPower -= pAd->BbpRssiToDbmDelta;
-
-		DBGPRINT(RT_DEBUG_TRACE, ("Bssid %02x:%02x:%02x:%02x:%02x:%02x ",
-			pBss->Bssid[0], pBss->Bssid[1], pBss->Bssid[2],
-			pBss->Bssid[3], pBss->Bssid[4], pBss->Bssid[5]));
-		DBGPRINT(RT_DEBUG_TRACE, ("RxPower[%ld] Rssi %d, Avg Rssi %d\n", Index, (pBss->Rssi - pAd->BbpRssiToDbmDelta), pBeaconReport->RxPower - 256));
-		DBGPRINT(RT_DEBUG_TRACE, ("FrameReportLen = %d\n", pAd->StaCfg.BssReportOffset[Index]));
-
-		// Update other information here
-
-		// Done
-		return;
-	}
-
-	// 2. Update reported Index
-	pAd->StaCfg.LastBssIndex = Index;
-
-	// 3. Setup the buffer address for copying this BSSID into reporting frame
-	//    The offset should start after 802.11 header and report frame header.
-	pDest = (PUCHAR) &pAd->StaCfg.FrameReportBuf[pAd->StaCfg.FrameReportLen];
-
-	// 4. Save the start offset of each Bss in report frame
-	pAd->StaCfg.BssReportOffset[Index] = pAd->StaCfg.FrameReportLen;
-
-	// 5. Fill Measurement report fields
-	pReport = (PMEASUREMENT_REPORT_ELEMENT) pDest;
-	pReport->Eid = IE_MEASUREMENT_REPORT;
-	pReport->Length = 0;
-	pReport->Token  = pAd->StaCfg.MeasurementRequest[ReqIdx].ReqElem.Token;
-	pReport->Mode   = pAd->StaCfg.MeasurementRequest[ReqIdx].ReqElem.Mode;
-	pReport->Type   = MSRN_TYPE_BEACON_REQ;
-	Length          = sizeof(MEASUREMENT_REPORT_ELEMENT);
-	pDest          += sizeof(MEASUREMENT_REPORT_ELEMENT);
-
-	// 6. Start thebeacon report format
-	pBeaconReport = (PBEACON_REPORT) pDest;
-	pDest        += sizeof(BEACON_REPORT);
-	Length       += sizeof(BEACON_REPORT);
-
-	// 7. Copy Channel number
-	pBeaconReport->Channel        = pBss->Channel;
-	pBeaconReport->Spare          = 0;
-	pBeaconReport->Duration       = pAd->StaCfg.MeasurementRequest[ReqIdx].Measurement.Duration;
-	pBeaconReport->PhyType        = ((pBss->SupRateLen+pBss->ExtRateLen > 4) ? PHY_ERP : PHY_DSS);
-	// 8. Rx power, in dBm
-	pBeaconReport->RxPower        = pBss->Rssi - pAd->BbpRssiToDbmDelta;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Bssid %02x:%02x:%02x:%02x:%02x:%02x ",
-		pBss->Bssid[0], pBss->Bssid[1], pBss->Bssid[2],
-		pBss->Bssid[3], pBss->Bssid[4], pBss->Bssid[5]));
-	DBGPRINT(RT_DEBUG_TRACE, ("RxPower[%ld], Rssi %d\n", Index, pBeaconReport->RxPower - 256));
-	DBGPRINT(RT_DEBUG_TRACE, ("FrameReportLen = %d\n", pAd->StaCfg.FrameReportLen));
-
-	pBeaconReport->BeaconInterval = pBss->BeaconPeriod;
-	COPY_MAC_ADDR(pBeaconReport->BSSID, pFrame->Hdr.Addr3);
-	NdisMoveMemory(pBeaconReport->ParentTSF, pSrc, 4);
-	NdisMoveMemory(pBeaconReport->TargetTSF, &pElem->TimeStamp.u.LowPart, 4);
-	NdisMoveMemory(&pBeaconReport->TargetTSF[4], &pElem->TimeStamp.u.HighPart, 4);
-
-	// 9. Skip the beacon frame and offset to start of capabilityinfo since we already processed capabilityinfo
-	pSrc += (TIMESTAMP_LEN + 2);
-	pBeaconReport->CapabilityInfo = *(USHORT *)pSrc;
-
-	// 10. Point to start of element ID
-	pSrc += 2;
-	pEid = (PEID_STRUCT) pSrc;
-
-	// 11. Start process all variable Eid oayload and add the appropriate to the frame report
-	while (((PUCHAR) pEid + pEid->Len + 1) < ((PUCHAR) pFrame + MsgLen))
-	{
-		// Only limited EID are required to report for CCX 2. It includes SSID, Supported rate,
-		// FH paramenter set, DS parameter set, CF parameter set, IBSS parameter set,
-		// TIM (report first 4 bytes only, radio measurement capability
-		switch (pEid->Eid)
-		{
-			case IE_SSID:
-			case IE_SUPP_RATES:
-			case IE_FH_PARM:
-			case IE_DS_PARM:
-			case IE_CF_PARM:
-			case IE_IBSS_PARM:
-				NdisMoveMemory(pDest, pEid, pEid->Len + 2);
-				pDest  += (pEid->Len + 2);
-				Length += (pEid->Len + 2);
-				break;
-
-			case IE_MEASUREMENT_CAPABILITY:
-				// Since this IE is duplicated with WPA security IE, we has to do sanity check before
-				// recognize it.
-				// 1. It also has fixed 6 bytes IE length.
-				if (pEid->Len != 6)
-					break;
-				// 2. Check the Cisco Aironet OUI
-				if (NdisEqualMemory(CISCO_OUI, (pSrc + 2), 3))
-				{
-					// Matched, this is what we want
-					NdisMoveMemory(pDest, pEid, pEid->Len + 2);
-					pDest  += (pEid->Len + 2);
-					Length += (pEid->Len + 2);
-				}
-				break;
-
-			case IE_TIM:
-				if (pEid->Len > 4)
-				{
-					// May truncate and report the first 4 bytes only, with the eid & len, total should be 6
-					NdisMoveMemory(pDest, pEid, 6);
-					pDest  += 6;
-					Length += 6;
-				}
-				else
-				{
-					NdisMoveMemory(pDest, pEid, pEid->Len + 2);
-					pDest  += (pEid->Len + 2);
-					Length += (pEid->Len + 2);
-				}
-				break;
-
-			default:
-				break;
-		}
-		// 12. Move to next element ID
-		pSrc += (2 + pEid->Len);
-		pEid = (PEID_STRUCT) pSrc;
-	}
-
-	// 13. Update the length in the header, not include EID and length
-	pReport->Length = Length - 4;
-
-	// 14. Update the frame report buffer data length
-	pAd->StaCfg.FrameReportLen += Length;
-	DBGPRINT(RT_DEBUG_TRACE, ("FR len = %d\n", pAd->StaCfg.FrameReportLen));
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-
-	Arguments:
-		Index		Current BSSID in CCXBsstab entry index
-
-	Return Value:
-
-	Note:
-
-	========================================================================
-*/
-VOID	AironetCreateBeaconReportFromBssTable(
-	IN	PRTMP_ADAPTER		pAd)
-{
-	PMEASUREMENT_REPORT_ELEMENT	pReport;
-	PBEACON_REPORT				pBeaconReport;
-	UCHAR						Index, ReqIdx;
-	USHORT						Length;
-	PUCHAR						pDest;
-	PBSS_ENTRY					pBss;
-
-	// 0. setup base pointer
-	ReqIdx = pAd->StaCfg.CurrentRMReqIdx;
-
-	for (Index = 0; Index < pAd->StaCfg.CCXBssTab.BssNr; Index++)
-	{
-		// 1. Setup the buffer address for copying this BSSID into reporting frame
-		//    The offset should start after 802.11 header and report frame header.
-		pDest  = (PUCHAR) &pAd->StaCfg.FrameReportBuf[pAd->StaCfg.FrameReportLen];
-		pBss   = (PBSS_ENTRY) &pAd->StaCfg.CCXBssTab.BssEntry[Index];
-		Length = 0;
-
-		// 2. Fill Measurement report fields
-		pReport         = (PMEASUREMENT_REPORT_ELEMENT) pDest;
-		pReport->Eid    = IE_MEASUREMENT_REPORT;
-		pReport->Length = 0;
-		pReport->Token  = pAd->StaCfg.MeasurementRequest[ReqIdx].ReqElem.Token;
-		pReport->Mode   = pAd->StaCfg.MeasurementRequest[ReqIdx].ReqElem.Mode;
-		pReport->Type   = MSRN_TYPE_BEACON_REQ;
-		Length          = sizeof(MEASUREMENT_REPORT_ELEMENT);
-		pDest          += sizeof(MEASUREMENT_REPORT_ELEMENT);
-
-		// 3. Start the beacon report format
-		pBeaconReport = (PBEACON_REPORT) pDest;
-		pDest        += sizeof(BEACON_REPORT);
-		Length       += sizeof(BEACON_REPORT);
-
-		// 4. Copy Channel number
-		pBeaconReport->Channel        = pBss->Channel;
-		pBeaconReport->Spare          = 0;
-		pBeaconReport->Duration       = pAd->StaCfg.MeasurementRequest[ReqIdx].Measurement.Duration;
-		pBeaconReport->PhyType        = ((pBss->SupRateLen+pBss->ExtRateLen > 4) ? PHY_ERP : PHY_DSS);
-		pBeaconReport->RxPower        = pBss->Rssi - pAd->BbpRssiToDbmDelta;
-		pBeaconReport->BeaconInterval = pBss->BeaconPeriod;
-		pBeaconReport->CapabilityInfo = pBss->CapabilityInfo;
-		COPY_MAC_ADDR(pBeaconReport->BSSID, pBss->Bssid);
-		NdisMoveMemory(pBeaconReport->ParentTSF, pBss->PTSF, 4);
-		NdisMoveMemory(pBeaconReport->TargetTSF, pBss->TTSF, 8);
-
-		// 5. Create SSID
-		*pDest++ = 0x00;
-		*pDest++ = pBss->SsidLen;
-		NdisMoveMemory(pDest, pBss->Ssid, pBss->SsidLen);
-		pDest  += pBss->SsidLen;
-		Length += (2 + pBss->SsidLen);
-
-		// 6. Create SupportRates
-		*pDest++ = 0x01;
-		*pDest++ = pBss->SupRateLen;
-		NdisMoveMemory(pDest, pBss->SupRate, pBss->SupRateLen);
-		pDest  += pBss->SupRateLen;
-		Length += (2 + pBss->SupRateLen);
-
-		// 7. DS Parameter
-		*pDest++ = 0x03;
-		*pDest++ = 1;
-		*pDest++ = pBss->Channel;
-		Length  += 3;
-
-		// 8. IBSS parameter if presents
-		if (pBss->BssType == BSS_ADHOC)
-		{
-			*pDest++ = 0x06;
-			*pDest++ = 2;
-			*(PUSHORT) pDest = pBss->AtimWin;
-			pDest   += 2;
-			Length  += 4;
-		}
-
-		// 9. Update length field, not include EID and length
-		pReport->Length = Length - 4;
-
-		// 10. Update total frame size
-		pAd->StaCfg.FrameReportLen += Length;
-	}
-}
diff --git a/drivers/staging/rt2860/sta/assoc.c b/drivers/staging/rt2860/sta/assoc.c
index 1a587153c75e..7055f229e511 100644
--- a/drivers/staging/rt2860/sta/assoc.c
+++ b/drivers/staging/rt2860/sta/assoc.c
@@ -36,31 +36,31 @@
 */
 #include "../rt_config.h"
 
-UCHAR	CipherWpaTemplate[] = {
-		0xdd, 					// WPA IE
-		0x16,					// Length
-		0x00, 0x50, 0xf2, 0x01,	// oui
-		0x01, 0x00,				// Version
-		0x00, 0x50, 0xf2, 0x02,	// Multicast
-		0x01, 0x00,				// Number of unicast
-		0x00, 0x50, 0xf2, 0x02,	// unicast
-		0x01, 0x00,				// number of authentication method
-		0x00, 0x50, 0xf2, 0x01	// authentication
-		};
-
-UCHAR	CipherWpa2Template[] = {
-		0x30,					// RSN IE
-		0x14,					// Length
-		0x01, 0x00,				// Version
-		0x00, 0x0f, 0xac, 0x02,	// group cipher, TKIP
-		0x01, 0x00,				// number of pairwise
-		0x00, 0x0f, 0xac, 0x02,	// unicast
-		0x01, 0x00,				// number of authentication method
-		0x00, 0x0f, 0xac, 0x02,	// authentication
-		0x00, 0x00,				// RSN capability
-		};
-
-UCHAR	Ccx2IeInfo[] = { 0x00, 0x40, 0x96, 0x03, 0x02};
+u8 CipherWpaTemplate[] = {
+	0xdd,			/* WPA IE */
+	0x16,			/* Length */
+	0x00, 0x50, 0xf2, 0x01,	/* oui */
+	0x01, 0x00,		/* Version */
+	0x00, 0x50, 0xf2, 0x02,	/* Multicast */
+	0x01, 0x00,		/* Number of unicast */
+	0x00, 0x50, 0xf2, 0x02,	/* unicast */
+	0x01, 0x00,		/* number of authentication method */
+	0x00, 0x50, 0xf2, 0x01	/* authentication */
+};
+
+u8 CipherWpa2Template[] = {
+	0x30,			/* RSN IE */
+	0x14,			/* Length */
+	0x01, 0x00,		/* Version */
+	0x00, 0x0f, 0xac, 0x02,	/* group cipher, TKIP */
+	0x01, 0x00,		/* number of pairwise */
+	0x00, 0x0f, 0xac, 0x02,	/* unicast */
+	0x01, 0x00,		/* number of authentication method */
+	0x00, 0x0f, 0xac, 0x02,	/* authentication */
+	0x00, 0x00,		/* RSN capability */
+};
+
+u8 Ccx2IeInfo[] = { 0x00, 0x40, 0x96, 0x03, 0x02 };
 
 /*
 	==========================================================================
@@ -73,55 +73,84 @@ UCHAR	Ccx2IeInfo[] = { 0x00, 0x40, 0x96, 0x03, 0x02};
 
 	==========================================================================
  */
-VOID AssocStateMachineInit(
-	IN	PRTMP_ADAPTER	pAd,
-	IN  STATE_MACHINE *S,
-	OUT STATE_MACHINE_FUNC Trans[])
+void AssocStateMachineInit(struct rt_rtmp_adapter *pAd,
+			   struct rt_state_machine *S, OUT STATE_MACHINE_FUNC Trans[])
 {
-	StateMachineInit(S, Trans, MAX_ASSOC_STATE, MAX_ASSOC_MSG, (STATE_MACHINE_FUNC)Drop, ASSOC_IDLE, ASSOC_MACHINE_BASE);
-
-	// first column
-	StateMachineSetAction(S, ASSOC_IDLE, MT2_MLME_ASSOC_REQ, (STATE_MACHINE_FUNC)MlmeAssocReqAction);
-	StateMachineSetAction(S, ASSOC_IDLE, MT2_MLME_REASSOC_REQ, (STATE_MACHINE_FUNC)MlmeReassocReqAction);
-	StateMachineSetAction(S, ASSOC_IDLE, MT2_MLME_DISASSOC_REQ, (STATE_MACHINE_FUNC)MlmeDisassocReqAction);
-	StateMachineSetAction(S, ASSOC_IDLE, MT2_PEER_DISASSOC_REQ, (STATE_MACHINE_FUNC)PeerDisassocAction);
-
-	// second column
-	StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_MLME_ASSOC_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenAssoc);
-	StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_MLME_REASSOC_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenReassoc);
-	StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_MLME_DISASSOC_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenDisassociate);
-	StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_PEER_DISASSOC_REQ, (STATE_MACHINE_FUNC)PeerDisassocAction);
-	StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_PEER_ASSOC_RSP, (STATE_MACHINE_FUNC)PeerAssocRspAction);
-	//
-	// Patch 3Com AP MOde:3CRWE454G72
-	// We send Assoc request frame to this AP, it always send Reassoc Rsp not Associate Rsp.
-	//
-	StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_PEER_REASSOC_RSP, (STATE_MACHINE_FUNC)PeerAssocRspAction);
-	StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_ASSOC_TIMEOUT, (STATE_MACHINE_FUNC)AssocTimeoutAction);
-
-	// third column
-	StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_MLME_ASSOC_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenAssoc);
-	StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_MLME_REASSOC_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenReassoc);
-	StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_MLME_DISASSOC_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenDisassociate);
-	StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_PEER_DISASSOC_REQ, (STATE_MACHINE_FUNC)PeerDisassocAction);
-	StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_PEER_REASSOC_RSP, (STATE_MACHINE_FUNC)PeerReassocRspAction);
-	//
-	// Patch, AP doesn't send Reassociate Rsp frame to Station.
-	//
-	StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_PEER_ASSOC_RSP, (STATE_MACHINE_FUNC)PeerReassocRspAction);
-	StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_REASSOC_TIMEOUT, (STATE_MACHINE_FUNC)ReassocTimeoutAction);
-
-	// fourth column
-	StateMachineSetAction(S, DISASSOC_WAIT_RSP, MT2_MLME_ASSOC_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenAssoc);
-	StateMachineSetAction(S, DISASSOC_WAIT_RSP, MT2_MLME_REASSOC_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenReassoc);
-	StateMachineSetAction(S, DISASSOC_WAIT_RSP, MT2_MLME_DISASSOC_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenDisassociate);
-	StateMachineSetAction(S, DISASSOC_WAIT_RSP, MT2_PEER_DISASSOC_REQ, (STATE_MACHINE_FUNC)PeerDisassocAction);
-	StateMachineSetAction(S, DISASSOC_WAIT_RSP, MT2_DISASSOC_TIMEOUT, (STATE_MACHINE_FUNC)DisassocTimeoutAction);
-
-	// initialize the timer
-	RTMPInitTimer(pAd, &pAd->MlmeAux.AssocTimer, GET_TIMER_FUNCTION(AssocTimeout), pAd, FALSE);
-	RTMPInitTimer(pAd, &pAd->MlmeAux.ReassocTimer, GET_TIMER_FUNCTION(ReassocTimeout), pAd, FALSE);
-	RTMPInitTimer(pAd, &pAd->MlmeAux.DisassocTimer, GET_TIMER_FUNCTION(DisassocTimeout), pAd, FALSE);
+	StateMachineInit(S, Trans, MAX_ASSOC_STATE, MAX_ASSOC_MSG,
+			 (STATE_MACHINE_FUNC) Drop, ASSOC_IDLE,
+			 ASSOC_MACHINE_BASE);
+
+	/* first column */
+	StateMachineSetAction(S, ASSOC_IDLE, MT2_MLME_ASSOC_REQ,
+			      (STATE_MACHINE_FUNC) MlmeAssocReqAction);
+	StateMachineSetAction(S, ASSOC_IDLE, MT2_MLME_REASSOC_REQ,
+			      (STATE_MACHINE_FUNC) MlmeReassocReqAction);
+	StateMachineSetAction(S, ASSOC_IDLE, MT2_MLME_DISASSOC_REQ,
+			      (STATE_MACHINE_FUNC) MlmeDisassocReqAction);
+	StateMachineSetAction(S, ASSOC_IDLE, MT2_PEER_DISASSOC_REQ,
+			      (STATE_MACHINE_FUNC) PeerDisassocAction);
+
+	/* second column */
+	StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_MLME_ASSOC_REQ,
+			      (STATE_MACHINE_FUNC) InvalidStateWhenAssoc);
+	StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_MLME_REASSOC_REQ,
+			      (STATE_MACHINE_FUNC) InvalidStateWhenReassoc);
+	StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_MLME_DISASSOC_REQ,
+			      (STATE_MACHINE_FUNC)
+			      InvalidStateWhenDisassociate);
+	StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_PEER_DISASSOC_REQ,
+			      (STATE_MACHINE_FUNC) PeerDisassocAction);
+	StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_PEER_ASSOC_RSP,
+			      (STATE_MACHINE_FUNC) PeerAssocRspAction);
+	/* */
+	/* Patch 3Com AP MOde:3CRWE454G72 */
+	/* We send Assoc request frame to this AP, it always send Reassoc Rsp not Associate Rsp. */
+	/* */
+	StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_PEER_REASSOC_RSP,
+			      (STATE_MACHINE_FUNC) PeerAssocRspAction);
+	StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_ASSOC_TIMEOUT,
+			      (STATE_MACHINE_FUNC) AssocTimeoutAction);
+
+	/* third column */
+	StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_MLME_ASSOC_REQ,
+			      (STATE_MACHINE_FUNC) InvalidStateWhenAssoc);
+	StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_MLME_REASSOC_REQ,
+			      (STATE_MACHINE_FUNC) InvalidStateWhenReassoc);
+	StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_MLME_DISASSOC_REQ,
+			      (STATE_MACHINE_FUNC)
+			      InvalidStateWhenDisassociate);
+	StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_PEER_DISASSOC_REQ,
+			      (STATE_MACHINE_FUNC) PeerDisassocAction);
+	StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_PEER_REASSOC_RSP,
+			      (STATE_MACHINE_FUNC) PeerReassocRspAction);
+	/* */
+	/* Patch, AP doesn't send Reassociate Rsp frame to Station. */
+	/* */
+	StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_PEER_ASSOC_RSP,
+			      (STATE_MACHINE_FUNC) PeerReassocRspAction);
+	StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_REASSOC_TIMEOUT,
+			      (STATE_MACHINE_FUNC) ReassocTimeoutAction);
+
+	/* fourth column */
+	StateMachineSetAction(S, DISASSOC_WAIT_RSP, MT2_MLME_ASSOC_REQ,
+			      (STATE_MACHINE_FUNC) InvalidStateWhenAssoc);
+	StateMachineSetAction(S, DISASSOC_WAIT_RSP, MT2_MLME_REASSOC_REQ,
+			      (STATE_MACHINE_FUNC) InvalidStateWhenReassoc);
+	StateMachineSetAction(S, DISASSOC_WAIT_RSP, MT2_MLME_DISASSOC_REQ,
+			      (STATE_MACHINE_FUNC)
+			      InvalidStateWhenDisassociate);
+	StateMachineSetAction(S, DISASSOC_WAIT_RSP, MT2_PEER_DISASSOC_REQ,
+			      (STATE_MACHINE_FUNC) PeerDisassocAction);
+	StateMachineSetAction(S, DISASSOC_WAIT_RSP, MT2_DISASSOC_TIMEOUT,
+			      (STATE_MACHINE_FUNC) DisassocTimeoutAction);
+
+	/* initialize the timer */
+	RTMPInitTimer(pAd, &pAd->MlmeAux.AssocTimer,
+		      GET_TIMER_FUNCTION(AssocTimeout), pAd, FALSE);
+	RTMPInitTimer(pAd, &pAd->MlmeAux.ReassocTimer,
+		      GET_TIMER_FUNCTION(ReassocTimeout), pAd, FALSE);
+	RTMPInitTimer(pAd, &pAd->MlmeAux.DisassocTimer,
+		      GET_TIMER_FUNCTION(DisassocTimeout), pAd, FALSE);
 }
 
 /*
@@ -136,20 +165,20 @@ VOID AssocStateMachineInit(
 
 	==========================================================================
  */
-VOID AssocTimeout(IN PVOID SystemSpecific1,
-				 IN PVOID FunctionContext,
-				 IN PVOID SystemSpecific2,
-				 IN PVOID SystemSpecific3)
+void AssocTimeout(void *SystemSpecific1,
+		  void *FunctionContext,
+		  void *SystemSpecific2, void *SystemSpecific3)
 {
-	RTMP_ADAPTER *pAd = (RTMP_ADAPTER *)FunctionContext;
+	struct rt_rtmp_adapter *pAd = (struct rt_rtmp_adapter *)FunctionContext;
 
-	// Do nothing if the driver is starting halt state.
-	// This might happen when timer already been fired before cancel timer with mlmehalt
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
+	/* Do nothing if the driver is starting halt state. */
+	/* This might happen when timer already been fired before cancel timer with mlmehalt */
+	if (RTMP_TEST_FLAG
+	    (pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
 		return;
 
 	MlmeEnqueue(pAd, ASSOC_STATE_MACHINE, MT2_ASSOC_TIMEOUT, 0, NULL);
-	RT28XX_MLME_HANDLER(pAd);
+	RTMP_MLME_HANDLER(pAd);
 }
 
 /*
@@ -164,20 +193,20 @@ VOID AssocTimeout(IN PVOID SystemSpecific1,
 
 	==========================================================================
  */
-VOID ReassocTimeout(IN PVOID SystemSpecific1,
-					IN PVOID FunctionContext,
-					IN PVOID SystemSpecific2,
-					IN PVOID SystemSpecific3)
+void ReassocTimeout(void *SystemSpecific1,
+		    void *FunctionContext,
+		    void *SystemSpecific2, void *SystemSpecific3)
 {
-	RTMP_ADAPTER *pAd = (RTMP_ADAPTER *)FunctionContext;
+	struct rt_rtmp_adapter *pAd = (struct rt_rtmp_adapter *)FunctionContext;
 
-	// Do nothing if the driver is starting halt state.
-	// This might happen when timer already been fired before cancel timer with mlmehalt
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
+	/* Do nothing if the driver is starting halt state. */
+	/* This might happen when timer already been fired before cancel timer with mlmehalt */
+	if (RTMP_TEST_FLAG
+	    (pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
 		return;
 
 	MlmeEnqueue(pAd, ASSOC_STATE_MACHINE, MT2_REASSOC_TIMEOUT, 0, NULL);
-	RT28XX_MLME_HANDLER(pAd);
+	RTMP_MLME_HANDLER(pAd);
 }
 
 /*
@@ -192,20 +221,20 @@ VOID ReassocTimeout(IN PVOID SystemSpecific1,
 
 	==========================================================================
  */
-VOID DisassocTimeout(IN PVOID SystemSpecific1,
-					IN PVOID FunctionContext,
-					IN PVOID SystemSpecific2,
-					IN PVOID SystemSpecific3)
+void DisassocTimeout(void *SystemSpecific1,
+		     void *FunctionContext,
+		     void *SystemSpecific2, void *SystemSpecific3)
 {
-	RTMP_ADAPTER *pAd = (RTMP_ADAPTER *)FunctionContext;
+	struct rt_rtmp_adapter *pAd = (struct rt_rtmp_adapter *)FunctionContext;
 
-	// Do nothing if the driver is starting halt state.
-	// This might happen when timer already been fired before cancel timer with mlmehalt
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
+	/* Do nothing if the driver is starting halt state. */
+	/* This might happen when timer already been fired before cancel timer with mlmehalt */
+	if (RTMP_TEST_FLAG
+	    (pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
 		return;
 
 	MlmeEnqueue(pAd, ASSOC_STATE_MACHINE, MT2_DISASSOC_TIMEOUT, 0, NULL);
-	RT28XX_MLME_HANDLER(pAd);
+	RTMP_MLME_HANDLER(pAd);
 }
 
 /*
@@ -230,349 +259,315 @@ VOID DisassocTimeout(IN PVOID SystemSpecific1,
 
 	==========================================================================
  */
-VOID MlmeAssocReqAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
+void MlmeAssocReqAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-	UCHAR			ApAddr[6];
-	HEADER_802_11	AssocHdr;
-	UCHAR			Ccx2Len = 5;
-	UCHAR			WmeIe[9] = {IE_VENDOR_SPECIFIC, 0x07, 0x00, 0x50, 0xf2, 0x02, 0x00, 0x01, 0x00};
-	USHORT			ListenIntv;
-	ULONG			Timeout;
-	USHORT			CapabilityInfo;
-	BOOLEAN			TimerCancelled;
-	PUCHAR			pOutBuffer = NULL;
-	NDIS_STATUS		NStatus;
-	ULONG			FrameLen = 0;
-	ULONG			tmp;
-	USHORT			VarIesOffset;
-	UCHAR			CkipFlag;
-	UCHAR			CkipNegotiationBuffer[CKIP_NEGOTIATION_LENGTH];
-	UCHAR			AironetCkipIe = IE_AIRONET_CKIP;
-	UCHAR			AironetCkipLen = CKIP_NEGOTIATION_LENGTH;
-	UCHAR			AironetIPAddressIE = IE_AIRONET_IPADDRESS;
-	UCHAR			AironetIPAddressLen = AIRONET_IPADDRESS_LENGTH;
-	UCHAR			AironetIPAddressBuffer[AIRONET_IPADDRESS_LENGTH] = {0x00, 0x40, 0x96, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00};
-	USHORT			Status;
-
-	// Block all authentication request durning WPA block period
-	if (pAd->StaCfg.bBlockAssoc == TRUE)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - Block Assoc request durning WPA block period!\n"));
+	u8 ApAddr[6];
+	struct rt_header_802_11 AssocHdr;
+	u8 WmeIe[9] =
+	    { IE_VENDOR_SPECIFIC, 0x07, 0x00, 0x50, 0xf2, 0x02, 0x00, 0x01,
+       0x00 };
+	u16 ListenIntv;
+	unsigned long Timeout;
+	u16 CapabilityInfo;
+	BOOLEAN TimerCancelled;
+	u8 *pOutBuffer = NULL;
+	int NStatus;
+	unsigned long FrameLen = 0;
+	unsigned long tmp;
+	u16 VarIesOffset;
+	u16 Status;
+
+	/* Block all authentication request durning WPA block period */
+	if (pAd->StaCfg.bBlockAssoc == TRUE) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("ASSOC - Block Assoc request durning WPA block period!\n"));
 		pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
 		Status = MLME_STATE_MACHINE_REJECT;
-		MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_ASSOC_CONF, 2, &Status);
+		MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_ASSOC_CONF, 2,
+			    &Status);
 	}
-	// check sanity first
-	else if (MlmeAssocReqSanity(pAd, Elem->Msg, Elem->MsgLen, ApAddr, &CapabilityInfo, &Timeout, &ListenIntv))
-	{
+	/* check sanity first */
+	else if (MlmeAssocReqSanity
+		 (pAd, Elem->Msg, Elem->MsgLen, ApAddr, &CapabilityInfo,
+		  &Timeout, &ListenIntv)) {
 		RTMPCancelTimer(&pAd->MlmeAux.AssocTimer, &TimerCancelled);
 		COPY_MAC_ADDR(pAd->MlmeAux.Bssid, ApAddr);
 
-		// Get an unused nonpaged memory
+		/* Get an unused nonpaged memory */
 		NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);
-		if (NStatus != NDIS_STATUS_SUCCESS)
-		{
-			DBGPRINT(RT_DEBUG_TRACE,("ASSOC - MlmeAssocReqAction() allocate memory failed \n"));
+		if (NStatus != NDIS_STATUS_SUCCESS) {
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("ASSOC - MlmeAssocReqAction() allocate memory failed \n"));
 			pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
 			Status = MLME_FAIL_NO_RESOURCE;
-			MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_ASSOC_CONF, 2, &Status);
+			MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE,
+				    MT2_ASSOC_CONF, 2, &Status);
 			return;
 		}
-
-		// Add by James 03/06/27
-		pAd->StaCfg.AssocInfo.Length = sizeof(NDIS_802_11_ASSOCIATION_INFORMATION);
-		// Association don't need to report MAC address
+		/* Add by James 03/06/27 */
+		pAd->StaCfg.AssocInfo.Length =
+		    sizeof(struct rt_ndis_802_11_association_information);
+		/* Association don't need to report MAC address */
 		pAd->StaCfg.AssocInfo.AvailableRequestFixedIEs =
-			NDIS_802_11_AI_REQFI_CAPABILITIES | NDIS_802_11_AI_REQFI_LISTENINTERVAL;
-		pAd->StaCfg.AssocInfo.RequestFixedIEs.Capabilities = CapabilityInfo;
-		pAd->StaCfg.AssocInfo.RequestFixedIEs.ListenInterval = ListenIntv;
-		// Only reassociate need this
-		//COPY_MAC_ADDR(pAd->StaCfg.AssocInfo.RequestFixedIEs.CurrentAPAddress, ApAddr);
-		pAd->StaCfg.AssocInfo.OffsetRequestIEs = sizeof(NDIS_802_11_ASSOCIATION_INFORMATION);
-
-        NdisZeroMemory(pAd->StaCfg.ReqVarIEs, MAX_VIE_LEN);
-		// First add SSID
+		    NDIS_802_11_AI_REQFI_CAPABILITIES |
+		    NDIS_802_11_AI_REQFI_LISTENINTERVAL;
+		pAd->StaCfg.AssocInfo.RequestFixedIEs.Capabilities =
+		    CapabilityInfo;
+		pAd->StaCfg.AssocInfo.RequestFixedIEs.ListenInterval =
+		    ListenIntv;
+		/* Only reassociate need this */
+		/*COPY_MAC_ADDR(pAd->StaCfg.AssocInfo.RequestFixedIEs.CurrentAPAddress, ApAddr); */
+		pAd->StaCfg.AssocInfo.OffsetRequestIEs =
+		    sizeof(struct rt_ndis_802_11_association_information);
+
+		NdisZeroMemory(pAd->StaCfg.ReqVarIEs, MAX_VIE_LEN);
+		/* First add SSID */
 		VarIesOffset = 0;
-		NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, &SsidIe, 1);
+		NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, &SsidIe,
+			       1);
 		VarIesOffset += 1;
-		NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, &pAd->MlmeAux.SsidLen, 1);
+		NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset,
+			       &pAd->MlmeAux.SsidLen, 1);
 		VarIesOffset += 1;
-		NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, pAd->MlmeAux.Ssid, pAd->MlmeAux.SsidLen);
+		NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset,
+			       pAd->MlmeAux.Ssid, pAd->MlmeAux.SsidLen);
 		VarIesOffset += pAd->MlmeAux.SsidLen;
 
-		// Second add Supported rates
-		NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, &SupRateIe, 1);
+		/* Second add Supported rates */
+		NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, &SupRateIe,
+			       1);
 		VarIesOffset += 1;
-		NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, &pAd->MlmeAux.SupRateLen, 1);
+		NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset,
+			       &pAd->MlmeAux.SupRateLen, 1);
 		VarIesOffset += 1;
-		NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, pAd->MlmeAux.SupRate, pAd->MlmeAux.SupRateLen);
+		NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset,
+			       pAd->MlmeAux.SupRate, pAd->MlmeAux.SupRateLen);
 		VarIesOffset += pAd->MlmeAux.SupRateLen;
-		// End Add by James
+		/* End Add by James */
 
-        if ((pAd->CommonCfg.Channel > 14) &&
-            (pAd->CommonCfg.bIEEE80211H == TRUE))
-            CapabilityInfo |= 0x0100;
+		if ((pAd->CommonCfg.Channel > 14) &&
+		    (pAd->CommonCfg.bIEEE80211H == TRUE))
+			CapabilityInfo |= 0x0100;
 
 		DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - Send ASSOC request...\n"));
-		MgtMacHeaderInit(pAd, &AssocHdr, SUBTYPE_ASSOC_REQ, 0, ApAddr, ApAddr);
-
-		// Build basic frame first
-		MakeOutgoingFrame(pOutBuffer,				&FrameLen,
-						  sizeof(HEADER_802_11),	&AssocHdr,
-						  2,						&CapabilityInfo,
-						  2,						&ListenIntv,
-						  1,						&SsidIe,
-						  1,						&pAd->MlmeAux.SsidLen,
-						  pAd->MlmeAux.SsidLen, 	pAd->MlmeAux.Ssid,
-						  1,						&SupRateIe,
-						  1,						&pAd->MlmeAux.SupRateLen,
-						  pAd->MlmeAux.SupRateLen,  pAd->MlmeAux.SupRate,
-						  END_OF_ARGS);
-
-		if (pAd->MlmeAux.ExtRateLen != 0)
-		{
-			MakeOutgoingFrame(pOutBuffer + FrameLen,    &tmp,
-							  1,                        &ExtRateIe,
-							  1,                        &pAd->MlmeAux.ExtRateLen,
-							  pAd->MlmeAux.ExtRateLen,  pAd->MlmeAux.ExtRate,
-							  END_OF_ARGS);
+		MgtMacHeaderInit(pAd, &AssocHdr, SUBTYPE_ASSOC_REQ, 0, ApAddr,
+				 ApAddr);
+
+		/* Build basic frame first */
+		MakeOutgoingFrame(pOutBuffer, &FrameLen,
+				  sizeof(struct rt_header_802_11), &AssocHdr,
+				  2, &CapabilityInfo,
+				  2, &ListenIntv,
+				  1, &SsidIe,
+				  1, &pAd->MlmeAux.SsidLen,
+				  pAd->MlmeAux.SsidLen, pAd->MlmeAux.Ssid,
+				  1, &SupRateIe,
+				  1, &pAd->MlmeAux.SupRateLen,
+				  pAd->MlmeAux.SupRateLen, pAd->MlmeAux.SupRate,
+				  END_OF_ARGS);
+
+		if (pAd->MlmeAux.ExtRateLen != 0) {
+			MakeOutgoingFrame(pOutBuffer + FrameLen, &tmp,
+					  1, &ExtRateIe,
+					  1, &pAd->MlmeAux.ExtRateLen,
+					  pAd->MlmeAux.ExtRateLen,
+					  pAd->MlmeAux.ExtRate, END_OF_ARGS);
 			FrameLen += tmp;
 		}
-
-		// HT
-		if ((pAd->MlmeAux.HtCapabilityLen > 0) && (pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED))
-		{
-			ULONG TmpLen;
-			UCHAR HtLen;
-			UCHAR BROADCOM[4] = {0x0, 0x90, 0x4c, 0x33};
-			if (pAd->StaActive.SupportedPhyInfo.bPreNHt == TRUE)
-			{
+		/* HT */
+		if ((pAd->MlmeAux.HtCapabilityLen > 0)
+		    && (pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED)) {
+			unsigned long TmpLen;
+			u8 HtLen;
+			u8 BROADCOM[4] = { 0x0, 0x90, 0x4c, 0x33 };
+			if (pAd->StaActive.SupportedPhyInfo.bPreNHt == TRUE) {
 				HtLen = SIZE_HT_CAP_IE + 4;
-				MakeOutgoingFrame(pOutBuffer + FrameLen,            &TmpLen,
-							  1,                                &WpaIe,
-							  1,                                &HtLen,
-							  4,                                &BROADCOM[0],
-							 pAd->MlmeAux.HtCapabilityLen,          &pAd->MlmeAux.HtCapability,
-							  END_OF_ARGS);
-			}
-			else
-			{
-				MakeOutgoingFrame(pOutBuffer + FrameLen,            &TmpLen,
-							  1,                                &HtCapIe,
-							  1,                                &pAd->MlmeAux.HtCapabilityLen,
-							 pAd->MlmeAux.HtCapabilityLen,          &pAd->MlmeAux.HtCapability,
-							  END_OF_ARGS);
+				MakeOutgoingFrame(pOutBuffer + FrameLen,
+						  &TmpLen, 1, &WpaIe, 1, &HtLen,
+						  4, &BROADCOM[0],
+						  pAd->MlmeAux.HtCapabilityLen,
+						  &pAd->MlmeAux.HtCapability,
+						  END_OF_ARGS);
+			} else {
+				MakeOutgoingFrame(pOutBuffer + FrameLen,
+						  &TmpLen, 1, &HtCapIe, 1,
+						  &pAd->MlmeAux.HtCapabilityLen,
+						  pAd->MlmeAux.HtCapabilityLen,
+						  &pAd->MlmeAux.HtCapability,
+						  END_OF_ARGS);
 			}
 			FrameLen += TmpLen;
 		}
-
-		// add Ralink proprietary IE to inform AP this STA is going to use AGGREGATION or PIGGY-BACK+AGGREGATION
-		// Case I: (Aggregation + Piggy-Back)
-		// 1. user enable aggregation, AND
-		// 2. Mac support piggy-back
-		// 3. AP annouces it's PIGGY-BACK+AGGREGATION-capable in BEACON
-		// Case II: (Aggregation)
-		// 1. user enable aggregation, AND
-		// 2. AP annouces it's AGGREGATION-capable in BEACON
-		if (pAd->CommonCfg.bAggregationCapable)
-		{
-			if ((pAd->CommonCfg.bPiggyBackCapable) && ((pAd->MlmeAux.APRalinkIe & 0x00000003) == 3))
-			{
-				ULONG TmpLen;
-				UCHAR RalinkIe[9] = {IE_VENDOR_SPECIFIC, 7, 0x00, 0x0c, 0x43, 0x03, 0x00, 0x00, 0x00};
-				MakeOutgoingFrame(pOutBuffer+FrameLen,           &TmpLen,
-								  9,                             RalinkIe,
-								  END_OF_ARGS);
+		/* add Ralink proprietary IE to inform AP this STA is going to use AGGREGATION or PIGGY-BACK+AGGREGATION */
+		/* Case I: (Aggregation + Piggy-Back) */
+		/* 1. user enable aggregation, AND */
+		/* 2. Mac support piggy-back */
+		/* 3. AP annouces it's PIGGY-BACK+AGGREGATION-capable in BEACON */
+		/* Case II: (Aggregation) */
+		/* 1. user enable aggregation, AND */
+		/* 2. AP annouces it's AGGREGATION-capable in BEACON */
+		if (pAd->CommonCfg.bAggregationCapable) {
+			if ((pAd->CommonCfg.bPiggyBackCapable)
+			    && ((pAd->MlmeAux.APRalinkIe & 0x00000003) == 3)) {
+				unsigned long TmpLen;
+				u8 RalinkIe[9] =
+				    { IE_VENDOR_SPECIFIC, 7, 0x00, 0x0c, 0x43,
+			    0x03, 0x00, 0x00, 0x00 };
+				MakeOutgoingFrame(pOutBuffer + FrameLen,
+						  &TmpLen, 9, RalinkIe,
+						  END_OF_ARGS);
 				FrameLen += TmpLen;
-			}
-			else if (pAd->MlmeAux.APRalinkIe & 0x00000001)
-			{
-				ULONG TmpLen;
-				UCHAR RalinkIe[9] = {IE_VENDOR_SPECIFIC, 7, 0x00, 0x0c, 0x43, 0x01, 0x00, 0x00, 0x00};
-				MakeOutgoingFrame(pOutBuffer+FrameLen,           &TmpLen,
-								  9,                             RalinkIe,
-								  END_OF_ARGS);
+			} else if (pAd->MlmeAux.APRalinkIe & 0x00000001) {
+				unsigned long TmpLen;
+				u8 RalinkIe[9] =
+				    { IE_VENDOR_SPECIFIC, 7, 0x00, 0x0c, 0x43,
+			    0x01, 0x00, 0x00, 0x00 };
+				MakeOutgoingFrame(pOutBuffer + FrameLen,
+						  &TmpLen, 9, RalinkIe,
+						  END_OF_ARGS);
 				FrameLen += TmpLen;
 			}
-		}
-		else
-		{
-			ULONG TmpLen;
-			UCHAR RalinkIe[9] = {IE_VENDOR_SPECIFIC, 7, 0x00, 0x0c, 0x43, 0x06, 0x00, 0x00, 0x00};
-			MakeOutgoingFrame(pOutBuffer+FrameLen,		 &TmpLen,
-							  9,						 RalinkIe,
-							  END_OF_ARGS);
+		} else {
+			unsigned long TmpLen;
+			u8 RalinkIe[9] =
+			    { IE_VENDOR_SPECIFIC, 7, 0x00, 0x0c, 0x43, 0x06,
+		    0x00, 0x00, 0x00 };
+			MakeOutgoingFrame(pOutBuffer + FrameLen, &TmpLen, 9,
+					  RalinkIe, END_OF_ARGS);
 			FrameLen += TmpLen;
 		}
 
-		if (pAd->MlmeAux.APEdcaParm.bValid)
-		{
-			if (pAd->CommonCfg.bAPSDCapable && pAd->MlmeAux.APEdcaParm.bAPSDCapable)
-			{
-				QBSS_STA_INFO_PARM QosInfo;
+		if (pAd->MlmeAux.APEdcaParm.bValid) {
+			if (pAd->CommonCfg.bAPSDCapable
+			    && pAd->MlmeAux.APEdcaParm.bAPSDCapable) {
+				struct rt_qbss_sta_info_parm QosInfo;
 
-				NdisZeroMemory(&QosInfo, sizeof(QBSS_STA_INFO_PARM));
+				NdisZeroMemory(&QosInfo,
+					       sizeof(struct rt_qbss_sta_info_parm));
 				QosInfo.UAPSD_AC_BE = pAd->CommonCfg.bAPSDAC_BE;
 				QosInfo.UAPSD_AC_BK = pAd->CommonCfg.bAPSDAC_BK;
 				QosInfo.UAPSD_AC_VI = pAd->CommonCfg.bAPSDAC_VI;
 				QosInfo.UAPSD_AC_VO = pAd->CommonCfg.bAPSDAC_VO;
-				QosInfo.MaxSPLength = pAd->CommonCfg.MaxSPLength;
-				WmeIe[8] |= *(PUCHAR)&QosInfo;
-			}
-			else
-			{
-                // The Parameter Set Count is set to ¡§0¡¨ in the association request frames
-                // WmeIe[8] |= (pAd->MlmeAux.APEdcaParm.EdcaUpdateCount & 0x0f);
+				QosInfo.MaxSPLength =
+				    pAd->CommonCfg.MaxSPLength;
+				WmeIe[8] |= *(u8 *)& QosInfo;
+			} else {
+				/* The Parameter Set Count is set to ¡§0¡¨ in the association request frames */
+				/* WmeIe[8] |= (pAd->MlmeAux.APEdcaParm.EdcaUpdateCount & 0x0f); */
 			}
 
-			MakeOutgoingFrame(pOutBuffer + FrameLen,    &tmp,
-							  9,                        &WmeIe[0],
-							  END_OF_ARGS);
+			MakeOutgoingFrame(pOutBuffer + FrameLen, &tmp,
+					  9, &WmeIe[0], END_OF_ARGS);
 			FrameLen += tmp;
 		}
-
-		//
-		// Let WPA(#221) Element ID on the end of this association frame.
-		// Otherwise some AP will fail on parsing Element ID and set status fail on Assoc Rsp.
-		// For example: Put Vendor Specific IE on the front of WPA IE.
-		// This happens on AP (Model No:Linksys WRK54G)
-		//
+		/* */
+		/* Let WPA(#221) Element ID on the end of this association frame. */
+		/* Otherwise some AP will fail on parsing Element ID and set status fail on Assoc Rsp. */
+		/* For example: Put Vendor Specific IE on the front of WPA IE. */
+		/* This happens on AP (Model No:Linksys WRK54G) */
+		/* */
 		if (((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPAPSK) ||
-            (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK) ||
-            (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA) ||
-            (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2)
-			)
-            )
-		{
-			UCHAR RSNIe = IE_WPA;
-
-			if ((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK) ||
-                (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2))
-			{
+		     (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK) ||
+		     (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA) ||
+		     (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2)
+		    )
+		    ) {
+			u8 RSNIe = IE_WPA;
+
+			if ((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK)
+			    || (pAd->StaCfg.AuthMode ==
+				Ndis802_11AuthModeWPA2)) {
 				RSNIe = IE_WPA2;
 			}
 
-			if (pAd->StaCfg.WpaSupplicantUP != 1)
-            RTMPMakeRSNIE(pAd, pAd->StaCfg.AuthMode, pAd->StaCfg.WepStatus, BSS0);
-
-            // Check for WPA PMK cache list
-			if (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2)
-			{
-			    INT     idx;
-                BOOLEAN FoundPMK = FALSE;
-				// Search chched PMKID, append it if existed
-				for (idx = 0; idx < PMKID_NO; idx++)
-				{
-					if (NdisEqualMemory(ApAddr, &pAd->StaCfg.SavedPMK[idx].BSSID, 6))
-					{
+			if ((pAd->StaCfg.WpaSupplicantUP !=
+			     WPA_SUPPLICANT_ENABLE)
+			    && (pAd->StaCfg.bRSN_IE_FromWpaSupplicant == FALSE))
+				RTMPMakeRSNIE(pAd, pAd->StaCfg.AuthMode,
+					      pAd->StaCfg.WepStatus, BSS0);
+
+			/* Check for WPA PMK cache list */
+			if (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2) {
+				int idx;
+				BOOLEAN FoundPMK = FALSE;
+				/* Search chched PMKID, append it if existed */
+				for (idx = 0; idx < PMKID_NO; idx++) {
+					if (NdisEqualMemory
+					    (ApAddr,
+					     &pAd->StaCfg.SavedPMK[idx].BSSID,
+					     6)) {
 						FoundPMK = TRUE;
 						break;
 					}
 				}
-
-				if (FoundPMK)
-				{
-					// Set PMK number
-					*(PUSHORT) &pAd->StaCfg.RSN_IE[pAd->StaCfg.RSNIE_Len] = 1;
-					NdisMoveMemory(&pAd->StaCfg.RSN_IE[pAd->StaCfg.RSNIE_Len + 2], &pAd->StaCfg.SavedPMK[idx].PMKID, 16);
-                    pAd->StaCfg.RSNIE_Len += 18;
+				if (FoundPMK) {
+					/* Set PMK number */
+					*(u16 *)& pAd->StaCfg.RSN_IE[pAd->
+									StaCfg.
+									RSNIE_Len]
+					    = 1;
+					NdisMoveMemory(&pAd->StaCfg.
+						       RSN_IE[pAd->StaCfg.
+							      RSNIE_Len + 2],
+						       &pAd->StaCfg.
+						       SavedPMK[idx].PMKID, 16);
+					pAd->StaCfg.RSNIE_Len += 18;
 				}
 			}
 
-			if (pAd->StaCfg.WpaSupplicantUP == 1)
-			{
-				MakeOutgoingFrame(pOutBuffer + FrameLen,    		&tmp,
-		                        	pAd->StaCfg.RSNIE_Len,			pAd->StaCfg.RSN_IE,
-		                        	END_OF_ARGS);
-			}
-			else
-			{
-				MakeOutgoingFrame(pOutBuffer + FrameLen,    		&tmp,
-				              		1,                              &RSNIe,
-		                        	1,                              &pAd->StaCfg.RSNIE_Len,
-		                        	pAd->StaCfg.RSNIE_Len,			pAd->StaCfg.RSN_IE,
-		                        	END_OF_ARGS);
+			if ((pAd->StaCfg.WpaSupplicantUP ==
+			     WPA_SUPPLICANT_ENABLE)
+			    && (pAd->StaCfg.bRSN_IE_FromWpaSupplicant ==
+				TRUE)) {
+				MakeOutgoingFrame(pOutBuffer + FrameLen, &tmp,
+						  pAd->StaCfg.RSNIE_Len,
+						  pAd->StaCfg.RSN_IE,
+						  END_OF_ARGS);
+			} else {
+				MakeOutgoingFrame(pOutBuffer + FrameLen, &tmp,
+						  1, &RSNIe,
+						  1, &pAd->StaCfg.RSNIE_Len,
+						  pAd->StaCfg.RSNIE_Len,
+						  pAd->StaCfg.RSN_IE,
+						  END_OF_ARGS);
 			}
 
 			FrameLen += tmp;
 
-			if (pAd->StaCfg.WpaSupplicantUP != 1)
-			{
-	            // Append Variable IE
-	            NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, &RSNIe, 1);
-	            VarIesOffset += 1;
-	            NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, &pAd->StaCfg.RSNIE_Len, 1);
-	            VarIesOffset += 1;
+			if ((pAd->StaCfg.WpaSupplicantUP !=
+			     WPA_SUPPLICANT_ENABLE)
+			    || (pAd->StaCfg.bRSN_IE_FromWpaSupplicant ==
+				FALSE)) {
+				/* Append Variable IE */
+				NdisMoveMemory(pAd->StaCfg.ReqVarIEs +
+					       VarIesOffset, &RSNIe, 1);
+				VarIesOffset += 1;
+				NdisMoveMemory(pAd->StaCfg.ReqVarIEs +
+					       VarIesOffset,
+					       &pAd->StaCfg.RSNIE_Len, 1);
+				VarIesOffset += 1;
 			}
-			NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, pAd->StaCfg.RSN_IE, pAd->StaCfg.RSNIE_Len);
+			NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset,
+				       pAd->StaCfg.RSN_IE,
+				       pAd->StaCfg.RSNIE_Len);
 			VarIesOffset += pAd->StaCfg.RSNIE_Len;
 
-			// Set Variable IEs Length
-			pAd->StaCfg.ReqVarIELen = VarIesOffset;
-		}
-
-		// We have update that at PeerBeaconAtJoinRequest()
-		CkipFlag = pAd->StaCfg.CkipFlag;
-		if (CkipFlag != 0)
-		{
-			NdisZeroMemory(CkipNegotiationBuffer, CKIP_NEGOTIATION_LENGTH);
-			CkipNegotiationBuffer[2] = 0x66;
-			// Make it try KP & MIC, since we have to follow the result from AssocRsp
-			CkipNegotiationBuffer[8] = 0x18;
-			CkipNegotiationBuffer[CKIP_NEGOTIATION_LENGTH - 1] = 0x22;
-			CkipFlag = 0x18;
-
-			MakeOutgoingFrame(pOutBuffer + FrameLen, 	&tmp,
-						1,						  		&AironetCkipIe,
-						1,						  		&AironetCkipLen,
-						AironetCkipLen, 		  		CkipNegotiationBuffer,
-						END_OF_ARGS);
-			FrameLen += tmp;
-		}
-
-		// Add CCX v2 request if CCX2 admin state is on
-		if (pAd->StaCfg.CCXControl.field.Enable == 1)
-		{
-
-			//
-			// Add AironetIPAddressIE for Cisco CCX 2.X
-			// Add CCX Version
-			//
-			MakeOutgoingFrame(pOutBuffer + FrameLen, &tmp,
-						1,							&AironetIPAddressIE,
-						1,							&AironetIPAddressLen,
-						AironetIPAddressLen,		AironetIPAddressBuffer,
-						1,							&Ccx2Ie,
-						1,							&Ccx2Len,
-						Ccx2Len,				    Ccx2IeInfo,
-						END_OF_ARGS);
-			FrameLen += tmp;
-
-			// Add by James 03/06/27
-			// Set Variable IEs Length
+			/* Set Variable IEs Length */
 			pAd->StaCfg.ReqVarIELen = VarIesOffset;
-			pAd->StaCfg.AssocInfo.RequestIELength = VarIesOffset;
-
-			// OffsetResponseIEs follow ReqVarIE
-			pAd->StaCfg.AssocInfo.OffsetResponseIEs = sizeof(NDIS_802_11_ASSOCIATION_INFORMATION) + pAd->StaCfg.ReqVarIELen;
-			// End Add by James
 		}
 
-
 		MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
 		MlmeFreeMemory(pAd, pOutBuffer);
 
 		RTMPSetTimer(&pAd->MlmeAux.AssocTimer, Timeout);
 		pAd->Mlme.AssocMachine.CurrState = ASSOC_WAIT_RSP;
-	}
-	else
-	{
-		DBGPRINT(RT_DEBUG_TRACE,("ASSOC - MlmeAssocReqAction() sanity check failed. BUG!!!!!! \n"));
+	} else {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("ASSOC - MlmeAssocReqAction() sanity check failed. BUG!\n"));
 		pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
 		Status = MLME_INVALID_FORMAT;
-		MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_ASSOC_CONF, 2, &Status);
+		MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_ASSOC_CONF, 2,
+			    &Status);
 	}
 
 }
@@ -594,187 +589,168 @@ VOID MlmeAssocReqAction(
 
 	==========================================================================
  */
-VOID MlmeReassocReqAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
+void MlmeReassocReqAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-	UCHAR			ApAddr[6];
-	HEADER_802_11	ReassocHdr;
-	UCHAR			Ccx2Len = 5;
-	UCHAR			WmeIe[9] = {IE_VENDOR_SPECIFIC, 0x07, 0x00, 0x50, 0xf2, 0x02, 0x00, 0x01, 0x00};
-	USHORT			CapabilityInfo, ListenIntv;
-	ULONG			Timeout;
-	ULONG			FrameLen = 0;
-	BOOLEAN			TimerCancelled;
-	NDIS_STATUS		NStatus;
-	ULONG			tmp;
-	PUCHAR			pOutBuffer = NULL;
-	USHORT			Status;
-
-	// Block all authentication request durning WPA block period
-	if (pAd->StaCfg.bBlockAssoc == TRUE)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - Block ReAssoc request durning WPA block period!\n"));
+	u8 ApAddr[6];
+	struct rt_header_802_11 ReassocHdr;
+	u8 WmeIe[9] =
+	    { IE_VENDOR_SPECIFIC, 0x07, 0x00, 0x50, 0xf2, 0x02, 0x00, 0x01,
+       0x00 };
+	u16 CapabilityInfo, ListenIntv;
+	unsigned long Timeout;
+	unsigned long FrameLen = 0;
+	BOOLEAN TimerCancelled;
+	int NStatus;
+	unsigned long tmp;
+	u8 *pOutBuffer = NULL;
+	u16 Status;
+
+	/* Block all authentication request durning WPA block period */
+	if (pAd->StaCfg.bBlockAssoc == TRUE) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("ASSOC - Block ReAssoc request durning WPA block period!\n"));
 		pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
 		Status = MLME_STATE_MACHINE_REJECT;
-		MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_REASSOC_CONF, 2, &Status);
+		MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_REASSOC_CONF, 2,
+			    &Status);
 	}
-	// the parameters are the same as the association
-	else if(MlmeAssocReqSanity(pAd, Elem->Msg, Elem->MsgLen, ApAddr, &CapabilityInfo, &Timeout, &ListenIntv))
-	{
+	/* the parameters are the same as the association */
+	else if (MlmeAssocReqSanity
+		 (pAd, Elem->Msg, Elem->MsgLen, ApAddr, &CapabilityInfo,
+		  &Timeout, &ListenIntv)) {
 		RTMPCancelTimer(&pAd->MlmeAux.ReassocTimer, &TimerCancelled);
 
-		NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);  //Get an unused nonpaged memory
-		if(NStatus != NDIS_STATUS_SUCCESS)
-		{
-			DBGPRINT(RT_DEBUG_TRACE,("ASSOC - MlmeReassocReqAction() allocate memory failed \n"));
+		NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);	/*Get an unused nonpaged memory */
+		if (NStatus != NDIS_STATUS_SUCCESS) {
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("ASSOC - MlmeReassocReqAction() allocate memory failed \n"));
 			pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
 			Status = MLME_FAIL_NO_RESOURCE;
-			MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_REASSOC_CONF, 2, &Status);
+			MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE,
+				    MT2_REASSOC_CONF, 2, &Status);
 			return;
 		}
 
 		COPY_MAC_ADDR(pAd->MlmeAux.Bssid, ApAddr);
 
-		// make frame, use bssid as the AP address??
-		DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - Send RE-ASSOC request...\n"));
-		MgtMacHeaderInit(pAd, &ReassocHdr, SUBTYPE_REASSOC_REQ, 0, ApAddr, ApAddr);
-		MakeOutgoingFrame(pOutBuffer,               &FrameLen,
-						  sizeof(HEADER_802_11),    &ReassocHdr,
-						  2,                        &CapabilityInfo,
-						  2,                        &ListenIntv,
-						  MAC_ADDR_LEN,             ApAddr,
-						  1,                        &SsidIe,
-						  1,                        &pAd->MlmeAux.SsidLen,
-						  pAd->MlmeAux.SsidLen,     pAd->MlmeAux.Ssid,
-						  1,                        &SupRateIe,
-						  1,						&pAd->MlmeAux.SupRateLen,
-						  pAd->MlmeAux.SupRateLen,  pAd->MlmeAux.SupRate,
-						  END_OF_ARGS);
-
-		if (pAd->MlmeAux.ExtRateLen != 0)
-		{
-			MakeOutgoingFrame(pOutBuffer + FrameLen,        &tmp,
-							  1,                            &ExtRateIe,
-							  1,                            &pAd->MlmeAux.ExtRateLen,
-							  pAd->MlmeAux.ExtRateLen,	    pAd->MlmeAux.ExtRate,
-							  END_OF_ARGS);
+		/* make frame, use bssid as the AP address?? */
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("ASSOC - Send RE-ASSOC request...\n"));
+		MgtMacHeaderInit(pAd, &ReassocHdr, SUBTYPE_REASSOC_REQ, 0,
+				 ApAddr, ApAddr);
+		MakeOutgoingFrame(pOutBuffer, &FrameLen, sizeof(struct rt_header_802_11),
+				  &ReassocHdr, 2, &CapabilityInfo, 2,
+				  &ListenIntv, MAC_ADDR_LEN, ApAddr, 1, &SsidIe,
+				  1, &pAd->MlmeAux.SsidLen,
+				  pAd->MlmeAux.SsidLen, pAd->MlmeAux.Ssid, 1,
+				  &SupRateIe, 1, &pAd->MlmeAux.SupRateLen,
+				  pAd->MlmeAux.SupRateLen, pAd->MlmeAux.SupRate,
+				  END_OF_ARGS);
+
+		if (pAd->MlmeAux.ExtRateLen != 0) {
+			MakeOutgoingFrame(pOutBuffer + FrameLen, &tmp,
+					  1, &ExtRateIe,
+					  1, &pAd->MlmeAux.ExtRateLen,
+					  pAd->MlmeAux.ExtRateLen,
+					  pAd->MlmeAux.ExtRate, END_OF_ARGS);
 			FrameLen += tmp;
 		}
 
-		if (pAd->MlmeAux.APEdcaParm.bValid)
-		{
-			if (pAd->CommonCfg.bAPSDCapable && pAd->MlmeAux.APEdcaParm.bAPSDCapable)
-			{
-				QBSS_STA_INFO_PARM QosInfo;
+		if (pAd->MlmeAux.APEdcaParm.bValid) {
+			if (pAd->CommonCfg.bAPSDCapable
+			    && pAd->MlmeAux.APEdcaParm.bAPSDCapable) {
+				struct rt_qbss_sta_info_parm QosInfo;
 
-				NdisZeroMemory(&QosInfo, sizeof(QBSS_STA_INFO_PARM));
+				NdisZeroMemory(&QosInfo,
+					       sizeof(struct rt_qbss_sta_info_parm));
 				QosInfo.UAPSD_AC_BE = pAd->CommonCfg.bAPSDAC_BE;
 				QosInfo.UAPSD_AC_BK = pAd->CommonCfg.bAPSDAC_BK;
 				QosInfo.UAPSD_AC_VI = pAd->CommonCfg.bAPSDAC_VI;
 				QosInfo.UAPSD_AC_VO = pAd->CommonCfg.bAPSDAC_VO;
-				QosInfo.MaxSPLength = pAd->CommonCfg.MaxSPLength;
-				WmeIe[8] |= *(PUCHAR)&QosInfo;
+				QosInfo.MaxSPLength =
+				    pAd->CommonCfg.MaxSPLength;
+				WmeIe[8] |= *(u8 *)& QosInfo;
 			}
 
-			MakeOutgoingFrame(pOutBuffer + FrameLen,    &tmp,
-							  9,                        &WmeIe[0],
-							  END_OF_ARGS);
+			MakeOutgoingFrame(pOutBuffer + FrameLen, &tmp,
+					  9, &WmeIe[0], END_OF_ARGS);
 			FrameLen += tmp;
 		}
-
-		// HT
-		if ((pAd->MlmeAux.HtCapabilityLen > 0) && (pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED))
-		{
-			ULONG TmpLen;
-			UCHAR HtLen;
-			UCHAR BROADCOM[4] = {0x0, 0x90, 0x4c, 0x33};
-			if (pAd->StaActive.SupportedPhyInfo.bPreNHt == TRUE)
-			{
+		/* HT */
+		if ((pAd->MlmeAux.HtCapabilityLen > 0)
+		    && (pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED)) {
+			unsigned long TmpLen;
+			u8 HtLen;
+			u8 BROADCOM[4] = { 0x0, 0x90, 0x4c, 0x33 };
+			if (pAd->StaActive.SupportedPhyInfo.bPreNHt == TRUE) {
 				HtLen = SIZE_HT_CAP_IE + 4;
-				MakeOutgoingFrame(pOutBuffer + FrameLen,            &TmpLen,
-							  1,                                &WpaIe,
-							  1,                                &HtLen,
-							  4,                                &BROADCOM[0],
-							 pAd->MlmeAux.HtCapabilityLen,          &pAd->MlmeAux.HtCapability,
-							  END_OF_ARGS);
-			}
-			else
-			{
-				MakeOutgoingFrame(pOutBuffer + FrameLen,            &TmpLen,
-							  1,                                &HtCapIe,
-							  1,                                &pAd->MlmeAux.HtCapabilityLen,
-							 pAd->MlmeAux.HtCapabilityLen,          &pAd->MlmeAux.HtCapability,
-							  END_OF_ARGS);
+				MakeOutgoingFrame(pOutBuffer + FrameLen,
+						  &TmpLen, 1, &WpaIe, 1, &HtLen,
+						  4, &BROADCOM[0],
+						  pAd->MlmeAux.HtCapabilityLen,
+						  &pAd->MlmeAux.HtCapability,
+						  END_OF_ARGS);
+			} else {
+				MakeOutgoingFrame(pOutBuffer + FrameLen,
+						  &TmpLen, 1, &HtCapIe, 1,
+						  &pAd->MlmeAux.HtCapabilityLen,
+						  pAd->MlmeAux.HtCapabilityLen,
+						  &pAd->MlmeAux.HtCapability,
+						  END_OF_ARGS);
 			}
 			FrameLen += TmpLen;
 		}
-
-		// add Ralink proprietary IE to inform AP this STA is going to use AGGREGATION or PIGGY-BACK+AGGREGATION
-		// Case I: (Aggregation + Piggy-Back)
-		// 1. user enable aggregation, AND
-		// 2. Mac support piggy-back
-		// 3. AP annouces it's PIGGY-BACK+AGGREGATION-capable in BEACON
-		// Case II: (Aggregation)
-		// 1. user enable aggregation, AND
-		// 2. AP annouces it's AGGREGATION-capable in BEACON
-		if (pAd->CommonCfg.bAggregationCapable)
-		{
-			if ((pAd->CommonCfg.bPiggyBackCapable) && ((pAd->MlmeAux.APRalinkIe & 0x00000003) == 3))
-			{
-				ULONG TmpLen;
-				UCHAR RalinkIe[9] = {IE_VENDOR_SPECIFIC, 7, 0x00, 0x0c, 0x43, 0x03, 0x00, 0x00, 0x00};
-				MakeOutgoingFrame(pOutBuffer+FrameLen,           &TmpLen,
-								  9,                             RalinkIe,
-								  END_OF_ARGS);
+		/* add Ralink proprietary IE to inform AP this STA is going to use AGGREGATION or PIGGY-BACK+AGGREGATION */
+		/* Case I: (Aggregation + Piggy-Back) */
+		/* 1. user enable aggregation, AND */
+		/* 2. Mac support piggy-back */
+		/* 3. AP annouces it's PIGGY-BACK+AGGREGATION-capable in BEACON */
+		/* Case II: (Aggregation) */
+		/* 1. user enable aggregation, AND */
+		/* 2. AP annouces it's AGGREGATION-capable in BEACON */
+		if (pAd->CommonCfg.bAggregationCapable) {
+			if ((pAd->CommonCfg.bPiggyBackCapable)
+			    && ((pAd->MlmeAux.APRalinkIe & 0x00000003) == 3)) {
+				unsigned long TmpLen;
+				u8 RalinkIe[9] =
+				    { IE_VENDOR_SPECIFIC, 7, 0x00, 0x0c, 0x43,
+			    0x03, 0x00, 0x00, 0x00 };
+				MakeOutgoingFrame(pOutBuffer + FrameLen,
+						  &TmpLen, 9, RalinkIe,
+						  END_OF_ARGS);
 				FrameLen += TmpLen;
-			}
-			else if (pAd->MlmeAux.APRalinkIe & 0x00000001)
-			{
-				ULONG TmpLen;
-				UCHAR RalinkIe[9] = {IE_VENDOR_SPECIFIC, 7, 0x00, 0x0c, 0x43, 0x01, 0x00, 0x00, 0x00};
-				MakeOutgoingFrame(pOutBuffer+FrameLen,           &TmpLen,
-								  9,                             RalinkIe,
-								  END_OF_ARGS);
+			} else if (pAd->MlmeAux.APRalinkIe & 0x00000001) {
+				unsigned long TmpLen;
+				u8 RalinkIe[9] =
+				    { IE_VENDOR_SPECIFIC, 7, 0x00, 0x0c, 0x43,
+			    0x01, 0x00, 0x00, 0x00 };
+				MakeOutgoingFrame(pOutBuffer + FrameLen,
+						  &TmpLen, 9, RalinkIe,
+						  END_OF_ARGS);
 				FrameLen += TmpLen;
 			}
-		}
-		else
-		{
-			ULONG TmpLen;
-			UCHAR RalinkIe[9] = {IE_VENDOR_SPECIFIC, 7, 0x00, 0x0c, 0x43, 0x04, 0x00, 0x00, 0x00};
-			MakeOutgoingFrame(pOutBuffer+FrameLen,		 &TmpLen,
-							  9,						 RalinkIe,
-							  END_OF_ARGS);
+		} else {
+			unsigned long TmpLen;
+			u8 RalinkIe[9] =
+			    { IE_VENDOR_SPECIFIC, 7, 0x00, 0x0c, 0x43, 0x04,
+		    0x00, 0x00, 0x00 };
+			MakeOutgoingFrame(pOutBuffer + FrameLen, &TmpLen, 9,
+					  RalinkIe, END_OF_ARGS);
 			FrameLen += TmpLen;
 		}
 
-		// Add CCX v2 request if CCX2 admin state is on
-		if (pAd->StaCfg.CCXControl.field.Enable == 1)
-		{
-			//
-			// Add CCX Version
-			//
-			MakeOutgoingFrame(pOutBuffer + FrameLen, &tmp,
-						1,							&Ccx2Ie,
-						1,							&Ccx2Len,
-						Ccx2Len,				    Ccx2IeInfo,
-						END_OF_ARGS);
-			FrameLen += tmp;
-		}
-
 		MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
 		MlmeFreeMemory(pAd, pOutBuffer);
 
-		RTMPSetTimer(&pAd->MlmeAux.ReassocTimer, Timeout); /* in mSec */
+		RTMPSetTimer(&pAd->MlmeAux.ReassocTimer, Timeout);	/* in mSec */
 		pAd->Mlme.AssocMachine.CurrState = REASSOC_WAIT_RSP;
-	}
-	else
-	{
-		DBGPRINT(RT_DEBUG_TRACE,("ASSOC - MlmeReassocReqAction() sanity check failed. BUG!!!! \n"));
+	} else {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("ASSOC - MlmeReassocReqAction() sanity check failed. BUG!\n"));
 		pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
 		Status = MLME_INVALID_FORMAT;
-		MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_REASSOC_CONF, 2, &Status);
+		MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_REASSOC_CONF, 2,
+			    &Status);
 	}
 }
 
@@ -789,51 +765,50 @@ VOID MlmeReassocReqAction(
 
 	==========================================================================
  */
-VOID MlmeDisassocReqAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
+void MlmeDisassocReqAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-	PMLME_DISASSOC_REQ_STRUCT pDisassocReq;
-	HEADER_802_11         DisassocHdr;
-	PHEADER_802_11        pDisassocHdr;
-	PUCHAR                pOutBuffer = NULL;
-	ULONG                 FrameLen = 0;
-	NDIS_STATUS           NStatus;
-	BOOLEAN               TimerCancelled;
-	ULONG                 Timeout = 0;
-	USHORT                Status;
-
-	// skip sanity check
-	pDisassocReq = (PMLME_DISASSOC_REQ_STRUCT)(Elem->Msg);
-
-	NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);  //Get an unused nonpaged memory
-	if (NStatus != NDIS_STATUS_SUCCESS)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - MlmeDisassocReqAction() allocate memory failed\n"));
+	struct rt_mlme_disassoc_req *pDisassocReq;
+	struct rt_header_802_11 DisassocHdr;
+	struct rt_header_802_11 * pDisassocHdr;
+	u8 *pOutBuffer = NULL;
+	unsigned long FrameLen = 0;
+	int NStatus;
+	BOOLEAN TimerCancelled;
+	unsigned long Timeout = 500;
+	u16 Status;
+
+	/* skip sanity check */
+	pDisassocReq = (struct rt_mlme_disassoc_req *)(Elem->Msg);
+
+	NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);	/*Get an unused nonpaged memory */
+	if (NStatus != NDIS_STATUS_SUCCESS) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("ASSOC - MlmeDisassocReqAction() allocate memory failed\n"));
 		pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
 		Status = MLME_FAIL_NO_RESOURCE;
-		MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_DISASSOC_CONF, 2, &Status);
+		MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_DISASSOC_CONF, 2,
+			    &Status);
 		return;
 	}
 
-
-
 	RTMPCancelTimer(&pAd->MlmeAux.DisassocTimer, &TimerCancelled);
 
-	DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - Send DISASSOC request[BSSID::%02x:%02x:%02x:%02x:%02x:%02x (Reason=%d)\n",
-				pDisassocReq->Addr[0], pDisassocReq->Addr[1], pDisassocReq->Addr[2],
-				pDisassocReq->Addr[3], pDisassocReq->Addr[4], pDisassocReq->Addr[5], pDisassocReq->Reason));
-	MgtMacHeaderInit(pAd, &DisassocHdr, SUBTYPE_DISASSOC, 0, pDisassocReq->Addr, pDisassocReq->Addr);	// patch peap ttls switching issue
-	MakeOutgoingFrame(pOutBuffer,           &FrameLen,
-					  sizeof(HEADER_802_11),&DisassocHdr,
-					  2,                    &pDisassocReq->Reason,
-					  END_OF_ARGS);
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("ASSOC - Send DISASSOC request[BSSID::%02x:%02x:%02x:%02x:%02x:%02x (Reason=%d)\n",
+		  pDisassocReq->Addr[0], pDisassocReq->Addr[1],
+		  pDisassocReq->Addr[2], pDisassocReq->Addr[3],
+		  pDisassocReq->Addr[4], pDisassocReq->Addr[5],
+		  pDisassocReq->Reason));
+	MgtMacHeaderInit(pAd, &DisassocHdr, SUBTYPE_DISASSOC, 0, pDisassocReq->Addr, pDisassocReq->Addr);	/* patch peap ttls switching issue */
+	MakeOutgoingFrame(pOutBuffer, &FrameLen,
+			  sizeof(struct rt_header_802_11), &DisassocHdr,
+			  2, &pDisassocReq->Reason, END_OF_ARGS);
 	MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
 
-	// To patch Instance and Buffalo(N) AP
-	// Driver has to send deauth to Instance AP, but Buffalo(N) needs to send disassoc to reset Authenticator's state machine
-	// Therefore, we send both of them.
-	pDisassocHdr = (PHEADER_802_11)pOutBuffer;
+	/* To patch Instance and Buffalo(N) AP */
+	/* Driver has to send deauth to Instance AP, but Buffalo(N) needs to send disassoc to reset Authenticator's state machine */
+	/* Therefore, we send both of them. */
+	pDisassocHdr = (struct rt_header_802_11 *) pOutBuffer;
 	pDisassocHdr->FC.SubType = SUBTYPE_DEAUTH;
 	MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
 
@@ -842,14 +817,11 @@ VOID MlmeDisassocReqAction(
 	pAd->StaCfg.DisassocReason = REASON_DISASSOC_STA_LEAVING;
 	COPY_MAC_ADDR(pAd->StaCfg.DisassocSta, pDisassocReq->Addr);
 
-	RTMPSetTimer(&pAd->MlmeAux.DisassocTimer, Timeout); /* in mSec */
+	RTMPSetTimer(&pAd->MlmeAux.DisassocTimer, Timeout);	/* in mSec */
 	pAd->Mlme.AssocMachine.CurrState = DISASSOC_WAIT_RSP;
 
-    {
-        union iwreq_data    wrqu;
-        memset(wrqu.ap_addr.sa_data, 0, MAC_ADDR_LEN);
-        wireless_send_event(pAd->net_dev, SIOCGIWAP, &wrqu, NULL);
-    }
+	RtmpOSWrielessEventSend(pAd, SIOCGIWAP, -1, NULL, NULL, 0);
+
 }
 
 /*
@@ -863,94 +835,81 @@ VOID MlmeDisassocReqAction(
 
 	==========================================================================
  */
-VOID PeerAssocRspAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
+void PeerAssocRspAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-	USHORT        CapabilityInfo, Status, Aid;
-	UCHAR         SupRate[MAX_LEN_OF_SUPPORTED_RATES], SupRateLen;
-	UCHAR         ExtRate[MAX_LEN_OF_SUPPORTED_RATES], ExtRateLen;
-	UCHAR         Addr2[MAC_ADDR_LEN];
-	BOOLEAN       TimerCancelled;
-	UCHAR         CkipFlag;
-	EDCA_PARM     EdcaParm;
-	HT_CAPABILITY_IE		HtCapability;
-	ADD_HT_INFO_IE		AddHtInfo;	// AP might use this additional ht info IE
-	UCHAR			HtCapabilityLen;
-	UCHAR			AddHtInfoLen;
-	UCHAR			NewExtChannelOffset = 0xff;
-
-	if (PeerAssocRspSanity(pAd, Elem->Msg, Elem->MsgLen, Addr2, &CapabilityInfo, &Status, &Aid, SupRate, &SupRateLen, ExtRate, &ExtRateLen,
-		&HtCapability,&AddHtInfo, &HtCapabilityLen,&AddHtInfoLen,&NewExtChannelOffset, &EdcaParm, &CkipFlag))
-	{
-		// The frame is for me ?
-		if(MAC_ADDR_EQUAL(Addr2, pAd->MlmeAux.Bssid))
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("PeerAssocRspAction():ASSOC - receive ASSOC_RSP to me (status=%d)\n", Status));
-			DBGPRINT(RT_DEBUG_TRACE, ("PeerAssocRspAction():MacTable [%d].AMsduSize = %d. ClientStatusFlags = 0x%lx \n",Elem->Wcid, pAd->MacTab.Content[BSSID_WCID].AMsduSize, pAd->MacTab.Content[BSSID_WCID].ClientStatusFlags));
-			RTMPCancelTimer(&pAd->MlmeAux.AssocTimer, &TimerCancelled);
-			if(Status == MLME_SUCCESS)
-			{
-#ifdef RT2860
-				// go to procedure listed on page 376
-				AssocPostProc(pAd, Addr2, CapabilityInfo, Aid, SupRate, SupRateLen, ExtRate, ExtRateLen,
-					&EdcaParm, &HtCapability, HtCapabilityLen, &AddHtInfo);
-
-                {
-                    union iwreq_data    wrqu;
-                    wext_notify_event_assoc(pAd);
-
-                    memset(wrqu.ap_addr.sa_data, 0, MAC_ADDR_LEN);
-                    memcpy(wrqu.ap_addr.sa_data, pAd->MlmeAux.Bssid, MAC_ADDR_LEN);
-                    wireless_send_event(pAd->net_dev, SIOCGIWAP, &wrqu, NULL);
-
-                }
-#endif
-#ifdef RT2870
-				UCHAR			MaxSupportedRateIn500Kbps = 0;
-				UCHAR			idx;
-
-				// supported rates array may not be sorted. sort it and find the maximum rate
-			    for (idx=0; idx<SupRateLen; idx++)
-                {
-			        if (MaxSupportedRateIn500Kbps < (SupRate[idx] & 0x7f))
-			            MaxSupportedRateIn500Kbps = SupRate[idx] & 0x7f;
-			    }
-
-				for (idx=0; idx<ExtRateLen; idx++)
-			    {
-			        if (MaxSupportedRateIn500Kbps < (ExtRate[idx] & 0x7f))
-			            MaxSupportedRateIn500Kbps = ExtRate[idx] & 0x7f;
-                }
-				// go to procedure listed on page 376
-				AssocPostProc(pAd, Addr2, CapabilityInfo, Aid, SupRate, SupRateLen, ExtRate, ExtRateLen,
-					&EdcaParm, &HtCapability, HtCapabilityLen, &AddHtInfo);
-
-				StaAddMacTableEntry(pAd, &pAd->MacTab.Content[BSSID_WCID], MaxSupportedRateIn500Kbps, &HtCapability, HtCapabilityLen, CapabilityInfo);
-#endif
-				pAd->StaCfg.CkipFlag = CkipFlag;
-				if (CkipFlag & 0x18)
-				{
-					NdisZeroMemory(pAd->StaCfg.TxSEQ, 4);
-					NdisZeroMemory(pAd->StaCfg.RxSEQ, 4);
-					NdisZeroMemory(pAd->StaCfg.CKIPMIC, 4);
-					pAd->StaCfg.GIV[0] = RandomByte(pAd);
-					pAd->StaCfg.GIV[1] = RandomByte(pAd);
-					pAd->StaCfg.GIV[2] = RandomByte(pAd);
-					pAd->StaCfg.bCkipOn = TRUE;
-					DBGPRINT(RT_DEBUG_TRACE, ("<CCX> pAd->StaCfg.CkipFlag = 0x%02x\n", pAd->StaCfg.CkipFlag));
+	u16 CapabilityInfo, Status, Aid;
+	u8 SupRate[MAX_LEN_OF_SUPPORTED_RATES], SupRateLen;
+	u8 ExtRate[MAX_LEN_OF_SUPPORTED_RATES], ExtRateLen;
+	u8 Addr2[MAC_ADDR_LEN];
+	BOOLEAN TimerCancelled;
+	u8 CkipFlag;
+	struct rt_edca_parm EdcaParm;
+	struct rt_ht_capability_ie HtCapability;
+	struct rt_add_ht_info_ie AddHtInfo;	/* AP might use this additional ht info IE */
+	u8 HtCapabilityLen = 0;
+	u8 AddHtInfoLen;
+	u8 NewExtChannelOffset = 0xff;
+
+	if (PeerAssocRspSanity
+	    (pAd, Elem->Msg, Elem->MsgLen, Addr2, &CapabilityInfo, &Status,
+	     &Aid, SupRate, &SupRateLen, ExtRate, &ExtRateLen, &HtCapability,
+	     &AddHtInfo, &HtCapabilityLen, &AddHtInfoLen, &NewExtChannelOffset,
+	     &EdcaParm, &CkipFlag)) {
+		/* The frame is for me ? */
+		if (MAC_ADDR_EQUAL(Addr2, pAd->MlmeAux.Bssid)) {
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("PeerAssocRspAction():ASSOC - receive ASSOC_RSP to me (status=%d)\n",
+				  Status));
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("PeerAssocRspAction():MacTable [%d].AMsduSize = %d. ClientStatusFlags = 0x%lx \n",
+				  Elem->Wcid,
+				  pAd->MacTab.Content[BSSID_WCID].AMsduSize,
+				  pAd->MacTab.Content[BSSID_WCID].
+				  ClientStatusFlags));
+			RTMPCancelTimer(&pAd->MlmeAux.AssocTimer,
+					&TimerCancelled);
+
+			if (Status == MLME_SUCCESS) {
+				u8 MaxSupportedRateIn500Kbps = 0;
+				u8 idx;
+
+				/* supported rates array may not be sorted. sort it and find the maximum rate */
+				for (idx = 0; idx < SupRateLen; idx++) {
+					if (MaxSupportedRateIn500Kbps <
+					    (SupRate[idx] & 0x7f))
+						MaxSupportedRateIn500Kbps =
+						    SupRate[idx] & 0x7f;
 				}
-			}
-			else
-			{
+
+				for (idx = 0; idx < ExtRateLen; idx++) {
+					if (MaxSupportedRateIn500Kbps <
+					    (ExtRate[idx] & 0x7f))
+						MaxSupportedRateIn500Kbps =
+						    ExtRate[idx] & 0x7f;
+				}
+				/* go to procedure listed on page 376 */
+				AssocPostProc(pAd, Addr2, CapabilityInfo, Aid,
+					      SupRate, SupRateLen, ExtRate,
+					      ExtRateLen, &EdcaParm,
+					      &HtCapability, HtCapabilityLen,
+					      &AddHtInfo);
+
+				StaAddMacTableEntry(pAd,
+						    &pAd->MacTab.
+						    Content[BSSID_WCID],
+						    MaxSupportedRateIn500Kbps,
+						    &HtCapability,
+						    HtCapabilityLen, &AddHtInfo,
+						    AddHtInfoLen,
+						    CapabilityInfo);
 			}
 			pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
-			MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_ASSOC_CONF, 2, &Status);
+			MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE,
+				    MT2_ASSOC_CONF, 2, &Status);
 		}
-	}
-	else
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - PeerAssocRspAction() sanity check fail\n"));
+	} else {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("ASSOC - PeerAssocRspAction() sanity check fail\n"));
 	}
 }
 
@@ -965,61 +924,62 @@ VOID PeerAssocRspAction(
 
 	==========================================================================
  */
-VOID PeerReassocRspAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
+void PeerReassocRspAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-	USHORT      CapabilityInfo;
-	USHORT      Status;
-	USHORT      Aid;
-	UCHAR       SupRate[MAX_LEN_OF_SUPPORTED_RATES], SupRateLen;
-	UCHAR       ExtRate[MAX_LEN_OF_SUPPORTED_RATES], ExtRateLen;
-	UCHAR       Addr2[MAC_ADDR_LEN];
-	UCHAR       CkipFlag;
-	BOOLEAN     TimerCancelled;
-	EDCA_PARM   EdcaParm;
-	HT_CAPABILITY_IE		HtCapability;
-	ADD_HT_INFO_IE		AddHtInfo;	// AP might use this additional ht info IE
-	UCHAR			HtCapabilityLen;
-	UCHAR			AddHtInfoLen;
-	UCHAR			NewExtChannelOffset = 0xff;
-
-	if(PeerAssocRspSanity(pAd, Elem->Msg, Elem->MsgLen, Addr2, &CapabilityInfo, &Status, &Aid, SupRate, &SupRateLen, ExtRate, &ExtRateLen,
-								&HtCapability,	&AddHtInfo, &HtCapabilityLen, &AddHtInfoLen,&NewExtChannelOffset, &EdcaParm, &CkipFlag))
-	{
-		if(MAC_ADDR_EQUAL(Addr2, pAd->MlmeAux.Bssid)) // The frame is for me ?
+	u16 CapabilityInfo;
+	u16 Status;
+	u16 Aid;
+	u8 SupRate[MAX_LEN_OF_SUPPORTED_RATES], SupRateLen;
+	u8 ExtRate[MAX_LEN_OF_SUPPORTED_RATES], ExtRateLen;
+	u8 Addr2[MAC_ADDR_LEN];
+	u8 CkipFlag;
+	BOOLEAN TimerCancelled;
+	struct rt_edca_parm EdcaParm;
+	struct rt_ht_capability_ie HtCapability;
+	struct rt_add_ht_info_ie AddHtInfo;	/* AP might use this additional ht info IE */
+	u8 HtCapabilityLen;
+	u8 AddHtInfoLen;
+	u8 NewExtChannelOffset = 0xff;
+
+	if (PeerAssocRspSanity
+	    (pAd, Elem->Msg, Elem->MsgLen, Addr2, &CapabilityInfo, &Status,
+	     &Aid, SupRate, &SupRateLen, ExtRate, &ExtRateLen, &HtCapability,
+	     &AddHtInfo, &HtCapabilityLen, &AddHtInfoLen, &NewExtChannelOffset,
+	     &EdcaParm, &CkipFlag)) {
+		if (MAC_ADDR_EQUAL(Addr2, pAd->MlmeAux.Bssid))	/* The frame is for me ? */
 		{
-			DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - receive REASSOC_RSP to me (status=%d)\n", Status));
-			RTMPCancelTimer(&pAd->MlmeAux.ReassocTimer, &TimerCancelled);
-
-			if(Status == MLME_SUCCESS)
-			{
-				// go to procedure listed on page 376
-				AssocPostProc(pAd, Addr2, CapabilityInfo, Aid, SupRate, SupRateLen, ExtRate, ExtRateLen,
-					 &EdcaParm, &HtCapability, HtCapabilityLen, &AddHtInfo);
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("ASSOC - receive REASSOC_RSP to me (status=%d)\n",
+				  Status));
+			RTMPCancelTimer(&pAd->MlmeAux.ReassocTimer,
+					&TimerCancelled);
+
+			if (Status == MLME_SUCCESS) {
+				/* go to procedure listed on page 376 */
+				AssocPostProc(pAd, Addr2, CapabilityInfo, Aid,
+					      SupRate, SupRateLen, ExtRate,
+					      ExtRateLen, &EdcaParm,
+					      &HtCapability, HtCapabilityLen,
+					      &AddHtInfo);
 
-                {
-                    union iwreq_data    wrqu;
-                    wext_notify_event_assoc(pAd);
-
-                    memset(wrqu.ap_addr.sa_data, 0, MAC_ADDR_LEN);
-                    memcpy(wrqu.ap_addr.sa_data, pAd->MlmeAux.Bssid, MAC_ADDR_LEN);
-                    wireless_send_event(pAd->net_dev, SIOCGIWAP, &wrqu, NULL);
-
-                }
-
-			}
+				{
+					wext_notify_event_assoc(pAd);
+					RtmpOSWrielessEventSend(pAd, SIOCGIWAP,
+								-1,
+								&pAd->MlmeAux.
+								Bssid[0], NULL,
+								0);
+				}
 
-			{
-				// CkipFlag is no use for reassociate
-				pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
-				MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_REASSOC_CONF, 2, &Status);
 			}
+			/* CkipFlag is no use for reassociate */
+			pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
+			MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE,
+				    MT2_REASSOC_CONF, 2, &Status);
 		}
-	}
-	else
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - PeerReassocRspAction() sanity check fail\n"));
+	} else {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("ASSOC - PeerReassocRspAction() sanity check fail\n"));
 	}
 
 }
@@ -1034,30 +994,18 @@ VOID PeerReassocRspAction(
 
 	==========================================================================
  */
-VOID AssocPostProc(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR pAddr2,
-	IN USHORT CapabilityInfo,
-	IN USHORT Aid,
-	IN UCHAR SupRate[],
-	IN UCHAR SupRateLen,
-	IN UCHAR ExtRate[],
-	IN UCHAR ExtRateLen,
-	IN PEDCA_PARM pEdcaParm,
-	IN HT_CAPABILITY_IE		*pHtCapability,
-	IN UCHAR HtCapabilityLen,
-	IN ADD_HT_INFO_IE		*pAddHtInfo)	// AP might use this additional ht info IE
+void AssocPostProc(struct rt_rtmp_adapter *pAd, u8 *pAddr2, u16 CapabilityInfo, u16 Aid, u8 SupRate[], u8 SupRateLen, u8 ExtRate[], u8 ExtRateLen, struct rt_edca_parm *pEdcaParm, struct rt_ht_capability_ie * pHtCapability, u8 HtCapabilityLen, struct rt_add_ht_info_ie * pAddHtInfo)	/* AP might use this additional ht info IE */
 {
-	ULONG Idx;
+	unsigned long Idx;
 
 	pAd->MlmeAux.BssType = BSS_INFRA;
 	COPY_MAC_ADDR(pAd->MlmeAux.Bssid, pAddr2);
 	pAd->MlmeAux.Aid = Aid;
-	pAd->MlmeAux.CapabilityInfo = CapabilityInfo & SUPPORTED_CAPABILITY_INFO;
+	pAd->MlmeAux.CapabilityInfo =
+	    CapabilityInfo & SUPPORTED_CAPABILITY_INFO;
 
-	// Some HT AP might lost WMM IE. We add WMM ourselves. beacuase HT requires QoS on.
-	if ((HtCapabilityLen > 0) && (pEdcaParm->bValid == FALSE))
-	{
+	/* Some HT AP might lost WMM IE. We add WMM ourselves. beacuase HT requires QoS on. */
+	if ((HtCapabilityLen > 0) && (pEdcaParm->bValid == FALSE)) {
 		pEdcaParm->bValid = TRUE;
 		pEdcaParm->Aifsn[0] = 3;
 		pEdcaParm->Aifsn[1] = 7;
@@ -1074,88 +1022,113 @@ VOID AssocPostProc(
 		pEdcaParm->Cwmax[2] = 4;
 		pEdcaParm->Cwmax[3] = 3;
 
-		pEdcaParm->Txop[0]  = 0;
-		pEdcaParm->Txop[1]  = 0;
-		pEdcaParm->Txop[2]  = 96;
-		pEdcaParm->Txop[3]  = 48;
+		pEdcaParm->Txop[0] = 0;
+		pEdcaParm->Txop[1] = 0;
+		pEdcaParm->Txop[2] = 96;
+		pEdcaParm->Txop[3] = 48;
 
 	}
 
-	NdisMoveMemory(&pAd->MlmeAux.APEdcaParm, pEdcaParm, sizeof(EDCA_PARM));
+	NdisMoveMemory(&pAd->MlmeAux.APEdcaParm, pEdcaParm, sizeof(struct rt_edca_parm));
 
-	// filter out un-supported rates
+	/* filter out un-supported rates */
 	pAd->MlmeAux.SupRateLen = SupRateLen;
 	NdisMoveMemory(pAd->MlmeAux.SupRate, SupRate, SupRateLen);
 	RTMPCheckRates(pAd, pAd->MlmeAux.SupRate, &pAd->MlmeAux.SupRateLen);
 
-	// filter out un-supported rates
+	/* filter out un-supported rates */
 	pAd->MlmeAux.ExtRateLen = ExtRateLen;
 	NdisMoveMemory(pAd->MlmeAux.ExtRate, ExtRate, ExtRateLen);
 	RTMPCheckRates(pAd, pAd->MlmeAux.ExtRate, &pAd->MlmeAux.ExtRateLen);
 
-	if (HtCapabilityLen > 0)
-	{
+	if (HtCapabilityLen > 0) {
 		RTMPCheckHt(pAd, BSSID_WCID, pHtCapability, pAddHtInfo);
 	}
-	DBGPRINT(RT_DEBUG_TRACE, ("AssocPostProc===>  AP.AMsduSize = %d. ClientStatusFlags = 0x%lx \n", pAd->MacTab.Content[BSSID_WCID].AMsduSize, pAd->MacTab.Content[BSSID_WCID].ClientStatusFlags));
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("AssocPostProc===>  AP.AMsduSize = %d. ClientStatusFlags = 0x%lx \n",
+		  pAd->MacTab.Content[BSSID_WCID].AMsduSize,
+		  pAd->MacTab.Content[BSSID_WCID].ClientStatusFlags));
 
-	DBGPRINT(RT_DEBUG_TRACE, ("AssocPostProc===>    (Mmps=%d, AmsduSize=%d, )\n",
-		pAd->MacTab.Content[BSSID_WCID].MmpsMode, pAd->MacTab.Content[BSSID_WCID].AMsduSize));
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("AssocPostProc===>    (Mmps=%d, AmsduSize=%d, )\n",
+		  pAd->MacTab.Content[BSSID_WCID].MmpsMode,
+		  pAd->MacTab.Content[BSSID_WCID].AMsduSize));
 
-	// Set New WPA information
+	/* Set New WPA information */
 	Idx = BssTableSearch(&pAd->ScanTab, pAddr2, pAd->MlmeAux.Channel);
-	if (Idx == BSS_NOT_FOUND)
-	{
+	if (Idx == BSS_NOT_FOUND) {
 		DBGPRINT_ERR(("ASSOC - Can't find BSS after receiving Assoc response\n"));
-	}
-	else
-	{
-		// Init variable
+	} else {
+		/* Init variable */
 		pAd->MacTab.Content[BSSID_WCID].RSNIE_Len = 0;
-		NdisZeroMemory(pAd->MacTab.Content[BSSID_WCID].RSN_IE, MAX_LEN_OF_RSNIE);
+		NdisZeroMemory(pAd->MacTab.Content[BSSID_WCID].RSN_IE,
+			       MAX_LEN_OF_RSNIE);
 
-		// Store appropriate RSN_IE for WPA SM negotiation later
-		if ((pAd->StaCfg.AuthMode >= Ndis802_11AuthModeWPA) && (pAd->ScanTab.BssEntry[Idx].VarIELen != 0))
-		{
-			PUCHAR              pVIE;
-			USHORT              len;
-			PEID_STRUCT         pEid;
+		/* Store appropriate RSN_IE for WPA SM negotiation later */
+		if ((pAd->StaCfg.AuthMode >= Ndis802_11AuthModeWPA)
+		    && (pAd->ScanTab.BssEntry[Idx].VarIELen != 0)) {
+			u8 *pVIE;
+			u16 len;
+			struct rt_eid * pEid;
 
 			pVIE = pAd->ScanTab.BssEntry[Idx].VarIEs;
-			len	 = pAd->ScanTab.BssEntry[Idx].VarIELen;
-
-			while (len > 0)
-			{
-				pEid = (PEID_STRUCT) pVIE;
-				// For WPA/WPAPSK
-				if ((pEid->Eid == IE_WPA) && (NdisEqualMemory(pEid->Octet, WPA_OUI, 4))
-					&& (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA || pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPAPSK))
-				{
-					NdisMoveMemory(pAd->MacTab.Content[BSSID_WCID].RSN_IE, pVIE, (pEid->Len + 2));
-					pAd->MacTab.Content[BSSID_WCID].RSNIE_Len = (pEid->Len + 2);
-					DBGPRINT(RT_DEBUG_TRACE, ("AssocPostProc===> Store RSN_IE for WPA SM negotiation \n"));
+			len = pAd->ScanTab.BssEntry[Idx].VarIELen;
+			/*KH need to check again */
+			/* Don't allow to go to sleep mode if authmode is WPA-related. */
+			/*This can make Authentication process more smoothly. */
+			RTMP_CLEAR_PSFLAG(pAd, fRTMP_PS_CAN_GO_SLEEP);
+
+			while (len > 0) {
+				pEid = (struct rt_eid *) pVIE;
+				/* For WPA/WPAPSK */
+				if ((pEid->Eid == IE_WPA)
+				    &&
+				    (NdisEqualMemory(pEid->Octet, WPA_OUI, 4))
+				    && (pAd->StaCfg.AuthMode ==
+					Ndis802_11AuthModeWPA
+					|| pAd->StaCfg.AuthMode ==
+					Ndis802_11AuthModeWPAPSK)) {
+					NdisMoveMemory(pAd->MacTab.
+						       Content[BSSID_WCID].
+						       RSN_IE, pVIE,
+						       (pEid->Len + 2));
+					pAd->MacTab.Content[BSSID_WCID].
+					    RSNIE_Len = (pEid->Len + 2);
+					DBGPRINT(RT_DEBUG_TRACE,
+						 ("AssocPostProc===> Store RSN_IE for WPA SM negotiation \n"));
 				}
-				// For WPA2/WPA2PSK
-				else if ((pEid->Eid == IE_RSN) && (NdisEqualMemory(pEid->Octet + 2, RSN_OUI, 3))
-					&& (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2 || pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK))
-				{
-					NdisMoveMemory(pAd->MacTab.Content[BSSID_WCID].RSN_IE, pVIE, (pEid->Len + 2));
-					pAd->MacTab.Content[BSSID_WCID].RSNIE_Len = (pEid->Len + 2);
-					DBGPRINT(RT_DEBUG_TRACE, ("AssocPostProc===> Store RSN_IE for WPA2 SM negotiation \n"));
+				/* For WPA2/WPA2PSK */
+				else if ((pEid->Eid == IE_RSN)
+					 &&
+					 (NdisEqualMemory
+					  (pEid->Octet + 2, RSN_OUI, 3))
+					 && (pAd->StaCfg.AuthMode ==
+					     Ndis802_11AuthModeWPA2
+					     || pAd->StaCfg.AuthMode ==
+					     Ndis802_11AuthModeWPA2PSK)) {
+					NdisMoveMemory(pAd->MacTab.
+						       Content[BSSID_WCID].
+						       RSN_IE, pVIE,
+						       (pEid->Len + 2));
+					pAd->MacTab.Content[BSSID_WCID].
+					    RSNIE_Len = (pEid->Len + 2);
+					DBGPRINT(RT_DEBUG_TRACE,
+						 ("AssocPostProc===> Store RSN_IE for WPA2 SM negotiation \n"));
 				}
 
 				pVIE += (pEid->Len + 2);
-				len  -= (pEid->Len + 2);
+				len -= (pEid->Len + 2);
 			}
-		}
 
-		if (pAd->MacTab.Content[BSSID_WCID].RSNIE_Len == 0)
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("AssocPostProc===> no RSN_IE \n"));
 		}
-		else
-		{
-			hex_dump("RSN_IE", pAd->MacTab.Content[BSSID_WCID].RSN_IE, pAd->MacTab.Content[BSSID_WCID].RSNIE_Len);
+
+		if (pAd->MacTab.Content[BSSID_WCID].RSNIE_Len == 0) {
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("AssocPostProc===> no RSN_IE \n"));
+		} else {
+			hex_dump("RSN_IE",
+				 pAd->MacTab.Content[BSSID_WCID].RSN_IE,
+				 pAd->MacTab.Content[BSSID_WCID].RSNIE_Len);
 		}
 	}
 }
@@ -1171,43 +1144,36 @@ VOID AssocPostProc(
 
 	==========================================================================
  */
-VOID PeerDisassocAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
+void PeerDisassocAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-	UCHAR         Addr2[MAC_ADDR_LEN];
-	USHORT        Reason;
+	u8 Addr2[MAC_ADDR_LEN];
+	u16 Reason;
 
 	DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - PeerDisassocAction()\n"));
-	if(PeerDisassocSanity(pAd, Elem->Msg, Elem->MsgLen, Addr2, &Reason))
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - PeerDisassocAction() Reason = %d\n", Reason));
-		if (INFRA_ON(pAd) && MAC_ADDR_EQUAL(pAd->CommonCfg.Bssid, Addr2))
-		{
-
-			if (pAd->CommonCfg.bWirelessEvent)
-			{
-				RTMPSendWirelessEvent(pAd, IW_DISASSOC_EVENT_FLAG, pAd->MacTab.Content[BSSID_WCID].Addr, BSS0, 0);
+	if (PeerDisassocSanity(pAd, Elem->Msg, Elem->MsgLen, Addr2, &Reason)) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("ASSOC - PeerDisassocAction() Reason = %d\n",
+			  Reason));
+		if (INFRA_ON(pAd)
+		    && MAC_ADDR_EQUAL(pAd->CommonCfg.Bssid, Addr2)) {
+
+			if (pAd->CommonCfg.bWirelessEvent) {
+				RTMPSendWirelessEvent(pAd,
+						      IW_DISASSOC_EVENT_FLAG,
+						      pAd->MacTab.
+						      Content[BSSID_WCID].Addr,
+						      BSS0, 0);
 			}
 
-			//
-			// Get Current System time and Turn on AdjacentAPReport
-			//
-			NdisGetSystemUpTime(&pAd->StaCfg.CCXAdjacentAPLinkDownTime);
-			pAd->StaCfg.CCXAdjacentAPReportFlag = TRUE;
 			LinkDown(pAd, TRUE);
 			pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
 
-            {
-                union iwreq_data    wrqu;
-                memset(wrqu.ap_addr.sa_data, 0, MAC_ADDR_LEN);
-                wireless_send_event(pAd->net_dev, SIOCGIWAP, &wrqu, NULL);
-            }
+			RtmpOSWrielessEventSend(pAd, SIOCGIWAP, -1, NULL, NULL,
+						0);
 		}
-	}
-	else
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - PeerDisassocAction() sanity check fail\n"));
+	} else {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("ASSOC - PeerDisassocAction() sanity check fail\n"));
 	}
 
 }
@@ -1223,11 +1189,9 @@ VOID PeerDisassocAction(
 
 	==========================================================================
  */
-VOID AssocTimeoutAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
+void AssocTimeoutAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-	USHORT  Status;
+	u16 Status;
 	DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - AssocTimeoutAction\n"));
 	pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
 	Status = MLME_REJ_TIMEOUT;
@@ -1243,11 +1207,9 @@ VOID AssocTimeoutAction(
 
 	==========================================================================
  */
-VOID ReassocTimeoutAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
+void ReassocTimeoutAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-	USHORT  Status;
+	u16 Status;
 	DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - ReassocTimeoutAction\n"));
 	pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
 	Status = MLME_REJ_TIMEOUT;
@@ -1263,51 +1225,49 @@ VOID ReassocTimeoutAction(
 
 	==========================================================================
  */
-VOID DisassocTimeoutAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
+void DisassocTimeoutAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-	USHORT  Status;
+	u16 Status;
 	DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - DisassocTimeoutAction\n"));
 	pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
 	Status = MLME_SUCCESS;
-	MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_DISASSOC_CONF, 2, &Status);
+	MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_DISASSOC_CONF, 2,
+		    &Status);
 }
 
-VOID InvalidStateWhenAssoc(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
+void InvalidStateWhenAssoc(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-	USHORT  Status;
-	DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - InvalidStateWhenAssoc(state=%ld), reset ASSOC state machine\n",
-		pAd->Mlme.AssocMachine.CurrState));
+	u16 Status;
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("ASSOC - InvalidStateWhenAssoc(state=%ld), reset ASSOC state machine\n",
+		  pAd->Mlme.AssocMachine.CurrState));
 	pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
 	Status = MLME_STATE_MACHINE_REJECT;
 	MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_ASSOC_CONF, 2, &Status);
 }
 
-VOID InvalidStateWhenReassoc(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
+void InvalidStateWhenReassoc(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-	USHORT Status;
-	DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - InvalidStateWhenReassoc(state=%ld), reset ASSOC state machine\n",
-		pAd->Mlme.AssocMachine.CurrState));
+	u16 Status;
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("ASSOC - InvalidStateWhenReassoc(state=%ld), reset ASSOC state machine\n",
+		  pAd->Mlme.AssocMachine.CurrState));
 	pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
 	Status = MLME_STATE_MACHINE_REJECT;
 	MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_REASSOC_CONF, 2, &Status);
 }
 
-VOID InvalidStateWhenDisassociate(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
+void InvalidStateWhenDisassociate(struct rt_rtmp_adapter *pAd,
+				  struct rt_mlme_queue_elem *Elem)
 {
-	USHORT Status;
-	DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - InvalidStateWhenDisassoc(state=%ld), reset ASSOC state machine\n",
-		pAd->Mlme.AssocMachine.CurrState));
+	u16 Status;
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("ASSOC - InvalidStateWhenDisassoc(state=%ld), reset ASSOC state machine\n",
+		  pAd->Mlme.AssocMachine.CurrState));
 	pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
 	Status = MLME_STATE_MACHINE_REJECT;
-	MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_DISASSOC_CONF, 2, &Status);
+	MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_DISASSOC_CONF, 2,
+		    &Status);
 }
 
 /*
@@ -1323,33 +1283,31 @@ VOID InvalidStateWhenDisassociate(
 
 	==========================================================================
  */
-VOID Cls3errAction(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR        pAddr)
+void Cls3errAction(struct rt_rtmp_adapter *pAd, u8 *pAddr)
 {
-	HEADER_802_11         DisassocHdr;
-	PHEADER_802_11        pDisassocHdr;
-	PUCHAR                pOutBuffer = NULL;
-	ULONG                 FrameLen = 0;
-	NDIS_STATUS           NStatus;
-	USHORT                Reason = REASON_CLS3ERR;
-
-	NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);  //Get an unused nonpaged memory
+	struct rt_header_802_11 DisassocHdr;
+	struct rt_header_802_11 * pDisassocHdr;
+	u8 *pOutBuffer = NULL;
+	unsigned long FrameLen = 0;
+	int NStatus;
+	u16 Reason = REASON_CLS3ERR;
+
+	NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);	/*Get an unused nonpaged memory */
 	if (NStatus != NDIS_STATUS_SUCCESS)
 		return;
 
-	DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - Class 3 Error, Send DISASSOC frame\n"));
-	MgtMacHeaderInit(pAd, &DisassocHdr, SUBTYPE_DISASSOC, 0, pAddr, pAd->CommonCfg.Bssid);	// patch peap ttls switching issue
-	MakeOutgoingFrame(pOutBuffer,           &FrameLen,
-					  sizeof(HEADER_802_11),&DisassocHdr,
-					  2,                    &Reason,
-					  END_OF_ARGS);
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("ASSOC - Class 3 Error, Send DISASSOC frame\n"));
+	MgtMacHeaderInit(pAd, &DisassocHdr, SUBTYPE_DISASSOC, 0, pAddr, pAd->CommonCfg.Bssid);	/* patch peap ttls switching issue */
+	MakeOutgoingFrame(pOutBuffer, &FrameLen,
+			  sizeof(struct rt_header_802_11), &DisassocHdr,
+			  2, &Reason, END_OF_ARGS);
 	MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
 
-	// To patch Instance and Buffalo(N) AP
-	// Driver has to send deauth to Instance AP, but Buffalo(N) needs to send disassoc to reset Authenticator's state machine
-	// Therefore, we send both of them.
-	pDisassocHdr = (PHEADER_802_11)pOutBuffer;
+	/* To patch Instance and Buffalo(N) AP */
+	/* Driver has to send deauth to Instance AP, but Buffalo(N) needs to send disassoc to reset Authenticator's state machine */
+	/* Therefore, we send both of them. */
+	pDisassocHdr = (struct rt_header_802_11 *) pOutBuffer;
 	pDisassocHdr->FC.SubType = SUBTYPE_DEAUTH;
 	MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
 
@@ -1359,352 +1317,271 @@ VOID Cls3errAction(
 	COPY_MAC_ADDR(pAd->StaCfg.DisassocSta, pAddr);
 }
 
- /*
-	 ==========================================================================
-	 Description:
-		 Switch between WEP and CKIP upon new association up.
-	 Parameters:
-
-	 IRQL = DISPATCH_LEVEL
-
-	 ==========================================================================
-  */
-VOID SwitchBetweenWepAndCkip(
-	IN PRTMP_ADAPTER pAd)
+int wext_notify_event_assoc(struct rt_rtmp_adapter *pAd)
 {
-	int            i;
-	SHAREDKEY_MODE_STRUC  csr1;
-
-	// if KP is required. change the CipherAlg in hardware shard key table from WEP
-	// to CKIP. else remain as WEP
-	if (pAd->StaCfg.bCkipOn && (pAd->StaCfg.CkipFlag & 0x10))
-	{
-		// modify hardware key table so that MAC use correct algorithm to decrypt RX
-		RTMP_IO_READ32(pAd, SHARED_KEY_MODE_BASE, &csr1.word);
-		if (csr1.field.Bss0Key0CipherAlg == CIPHER_WEP64)
-			csr1.field.Bss0Key0CipherAlg = CIPHER_CKIP64;
-		else if (csr1.field.Bss0Key0CipherAlg == CIPHER_WEP128)
-			csr1.field.Bss0Key0CipherAlg = CIPHER_CKIP128;
-
-		if (csr1.field.Bss0Key1CipherAlg == CIPHER_WEP64)
-			csr1.field.Bss0Key1CipherAlg = CIPHER_CKIP64;
-		else if (csr1.field.Bss0Key1CipherAlg == CIPHER_WEP128)
-			csr1.field.Bss0Key1CipherAlg = CIPHER_CKIP128;
-
-		if (csr1.field.Bss0Key2CipherAlg == CIPHER_WEP64)
-			csr1.field.Bss0Key2CipherAlg = CIPHER_CKIP64;
-		else if (csr1.field.Bss0Key2CipherAlg == CIPHER_WEP128)
-			csr1.field.Bss0Key2CipherAlg = CIPHER_CKIP128;
-
-		if (csr1.field.Bss0Key3CipherAlg == CIPHER_WEP64)
-			csr1.field.Bss0Key3CipherAlg = CIPHER_CKIP64;
-		else if (csr1.field.Bss0Key3CipherAlg == CIPHER_WEP128)
-			csr1.field.Bss0Key3CipherAlg = CIPHER_CKIP128;
-		RTMP_IO_WRITE32(pAd, SHARED_KEY_MODE_BASE, csr1.word);
-		DBGPRINT(RT_DEBUG_TRACE, ("SwitchBetweenWepAndCkip: modify BSS0 cipher to %s\n", CipherName[csr1.field.Bss0Key0CipherAlg]));
-
-		// modify software key table so that driver can specify correct algorithm in TXD upon TX
-		for (i=0; i<SHARE_KEY_NUM; i++)
-		{
-			if (pAd->SharedKey[BSS0][i].CipherAlg == CIPHER_WEP64)
-				pAd->SharedKey[BSS0][i].CipherAlg = CIPHER_CKIP64;
-			else if (pAd->SharedKey[BSS0][i].CipherAlg == CIPHER_WEP128)
-				pAd->SharedKey[BSS0][i].CipherAlg = CIPHER_CKIP128;
-		}
-	}
-
-	// else if KP NOT inused. change the CipherAlg in hardware shard key table from CKIP
-	// to WEP.
-	else
-	{
-		// modify hardware key table so that MAC use correct algorithm to decrypt RX
-		RTMP_IO_READ32(pAd, SHARED_KEY_MODE_BASE, &csr1.word);
-		if (csr1.field.Bss0Key0CipherAlg == CIPHER_CKIP64)
-			csr1.field.Bss0Key0CipherAlg = CIPHER_WEP64;
-		else if (csr1.field.Bss0Key0CipherAlg == CIPHER_CKIP128)
-			csr1.field.Bss0Key0CipherAlg = CIPHER_WEP128;
-
-		if (csr1.field.Bss0Key1CipherAlg == CIPHER_CKIP64)
-			csr1.field.Bss0Key1CipherAlg = CIPHER_WEP64;
-		else if (csr1.field.Bss0Key1CipherAlg == CIPHER_CKIP128)
-			csr1.field.Bss0Key1CipherAlg = CIPHER_WEP128;
-
-		if (csr1.field.Bss0Key2CipherAlg == CIPHER_CKIP64)
-			csr1.field.Bss0Key2CipherAlg = CIPHER_WEP64;
-		else if (csr1.field.Bss0Key2CipherAlg == CIPHER_CKIP128)
-			csr1.field.Bss0Key2CipherAlg = CIPHER_WEP128;
-
-		if (csr1.field.Bss0Key3CipherAlg == CIPHER_CKIP64)
-			csr1.field.Bss0Key3CipherAlg = CIPHER_WEP64;
-		else if (csr1.field.Bss0Key3CipherAlg == CIPHER_CKIP128)
-			csr1.field.Bss0Key3CipherAlg = CIPHER_WEP128;
-
-		// modify software key table so that driver can specify correct algorithm in TXD upon TX
-		for (i=0; i<SHARE_KEY_NUM; i++)
-		{
-			if (pAd->SharedKey[BSS0][i].CipherAlg == CIPHER_CKIP64)
-				pAd->SharedKey[BSS0][i].CipherAlg = CIPHER_WEP64;
-			else if (pAd->SharedKey[BSS0][i].CipherAlg == CIPHER_CKIP128)
-				pAd->SharedKey[BSS0][i].CipherAlg = CIPHER_WEP128;
-		}
+	char custom[IW_CUSTOM_MAX] = { 0 };
 
-		//
-		// On WPA-NONE, must update CipherAlg.
-		// Because the OID_802_11_WEP_STATUS was been set after OID_802_11_ADD_KEY
-		// and CipherAlg will be CIPHER_NONE by Windows ZeroConfig.
-		// So we need to update CipherAlg after connect.
-		//
-		if (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPANone)
-		{
-			for (i = 0; i < SHARE_KEY_NUM; i++)
-			{
-				if (pAd->SharedKey[BSS0][i].KeyLen != 0)
-				{
-					if (pAd->StaCfg.WepStatus == Ndis802_11Encryption2Enabled)
-					{
-						pAd->SharedKey[BSS0][i].CipherAlg = CIPHER_TKIP;
-					}
-					else if (pAd->StaCfg.WepStatus == Ndis802_11Encryption3Enabled)
-					{
-						pAd->SharedKey[BSS0][i].CipherAlg = CIPHER_AES;
-					}
-				}
-				else
-				{
-					pAd->SharedKey[BSS0][i].CipherAlg = CIPHER_NONE;
-				}
-			}
-
-			csr1.field.Bss0Key0CipherAlg = pAd->SharedKey[BSS0][0].CipherAlg;
-			csr1.field.Bss0Key1CipherAlg = pAd->SharedKey[BSS0][1].CipherAlg;
-			csr1.field.Bss0Key2CipherAlg = pAd->SharedKey[BSS0][2].CipherAlg;
-			csr1.field.Bss0Key3CipherAlg = pAd->SharedKey[BSS0][3].CipherAlg;
-		}
-		RTMP_IO_WRITE32(pAd, SHARED_KEY_MODE_BASE, csr1.word);
-		DBGPRINT(RT_DEBUG_TRACE, ("SwitchBetweenWepAndCkip: modify BSS0 cipher to %s\n", CipherName[csr1.field.Bss0Key0CipherAlg]));
-	}
-}
-
-int wext_notify_event_assoc(
-	IN  RTMP_ADAPTER *pAd)
-{
-    union iwreq_data    wrqu;
-    char custom[IW_CUSTOM_MAX] = {0};
-
-    if (pAd->StaCfg.ReqVarIELen <= IW_CUSTOM_MAX)
-    {
-        wrqu.data.length = pAd->StaCfg.ReqVarIELen;
-        memcpy(custom, pAd->StaCfg.ReqVarIEs, pAd->StaCfg.ReqVarIELen);
-        wireless_send_event(pAd->net_dev, IWEVASSOCREQIE, &wrqu, custom);
-    }
-    else
-        DBGPRINT(RT_DEBUG_TRACE, ("pAd->StaCfg.ReqVarIELen > MAX_CUSTOM_LEN\n"));
+	if (pAd->StaCfg.ReqVarIELen <= IW_CUSTOM_MAX) {
+		NdisMoveMemory(custom, pAd->StaCfg.ReqVarIEs,
+			       pAd->StaCfg.ReqVarIELen);
+		RtmpOSWrielessEventSend(pAd, IWEVASSOCREQIE, -1, NULL, custom,
+					pAd->StaCfg.ReqVarIELen);
+	} else
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("pAd->StaCfg.ReqVarIELen > MAX_CUSTOM_LEN\n"));
 
 	return 0;
 
 }
 
-#ifdef RT2870
-BOOLEAN StaAddMacTableEntry(
-	IN  PRTMP_ADAPTER		pAd,
-	IN  PMAC_TABLE_ENTRY	pEntry,
-	IN  UCHAR				MaxSupportedRateIn500Kbps,
-	IN  HT_CAPABILITY_IE	*pHtCapability,
-	IN  UCHAR				HtCapabilityLen,
-	IN  USHORT        		CapabilityInfo)
+BOOLEAN StaAddMacTableEntry(struct rt_rtmp_adapter *pAd,
+			    struct rt_mac_table_entry *pEntry,
+			    u8 MaxSupportedRateIn500Kbps,
+			    struct rt_ht_capability_ie * pHtCapability,
+			    u8 HtCapabilityLen,
+			    struct rt_add_ht_info_ie * pAddHtInfo,
+			    u8 AddHtInfoLen, u16 CapabilityInfo)
 {
-	UCHAR            MaxSupportedRate = RATE_11;
+	u8 MaxSupportedRate = RATE_11;
 
 	if (ADHOC_ON(pAd))
 		CLIENT_STATUS_CLEAR_FLAG(pEntry, fCLIENT_STATUS_WMM_CAPABLE);
 
-	switch (MaxSupportedRateIn500Kbps)
-    {
-        case 108: MaxSupportedRate = RATE_54;   break;
-        case 96:  MaxSupportedRate = RATE_48;   break;
-        case 72:  MaxSupportedRate = RATE_36;   break;
-        case 48:  MaxSupportedRate = RATE_24;   break;
-        case 36:  MaxSupportedRate = RATE_18;   break;
-        case 24:  MaxSupportedRate = RATE_12;   break;
-        case 18:  MaxSupportedRate = RATE_9;    break;
-        case 12:  MaxSupportedRate = RATE_6;    break;
-        case 22:  MaxSupportedRate = RATE_11;   break;
-        case 11:  MaxSupportedRate = RATE_5_5;  break;
-        case 4:   MaxSupportedRate = RATE_2;    break;
-        case 2:   MaxSupportedRate = RATE_1;    break;
-        default:  MaxSupportedRate = RATE_11;   break;
-    }
-
-    if ((pAd->CommonCfg.PhyMode == PHY_11G) && (MaxSupportedRate < RATE_FIRST_OFDM_RATE))
-        return FALSE;
-
-	// 11n only
-	if (((pAd->CommonCfg.PhyMode == PHY_11N_2_4G) || (pAd->CommonCfg.PhyMode == PHY_11N_5G))&& (HtCapabilityLen == 0))
+	switch (MaxSupportedRateIn500Kbps) {
+	case 108:
+		MaxSupportedRate = RATE_54;
+		break;
+	case 96:
+		MaxSupportedRate = RATE_48;
+		break;
+	case 72:
+		MaxSupportedRate = RATE_36;
+		break;
+	case 48:
+		MaxSupportedRate = RATE_24;
+		break;
+	case 36:
+		MaxSupportedRate = RATE_18;
+		break;
+	case 24:
+		MaxSupportedRate = RATE_12;
+		break;
+	case 18:
+		MaxSupportedRate = RATE_9;
+		break;
+	case 12:
+		MaxSupportedRate = RATE_6;
+		break;
+	case 22:
+		MaxSupportedRate = RATE_11;
+		break;
+	case 11:
+		MaxSupportedRate = RATE_5_5;
+		break;
+	case 4:
+		MaxSupportedRate = RATE_2;
+		break;
+	case 2:
+		MaxSupportedRate = RATE_1;
+		break;
+	default:
+		MaxSupportedRate = RATE_11;
+		break;
+	}
+
+	if ((pAd->CommonCfg.PhyMode == PHY_11G)
+	    && (MaxSupportedRate < RATE_FIRST_OFDM_RATE))
+		return FALSE;
+
+	/* 11n only */
+	if (((pAd->CommonCfg.PhyMode == PHY_11N_2_4G)
+	     || (pAd->CommonCfg.PhyMode == PHY_11N_5G))
+	    && (HtCapabilityLen == 0))
 		return FALSE;
 
 	if (!pEntry)
-        return FALSE;
+		return FALSE;
 
 	NdisAcquireSpinLock(&pAd->MacTabLock);
-	if (pEntry)
-	{
+	if (pEntry) {
 		pEntry->PortSecured = WPA_802_1X_PORT_SECURED;
 		if ((MaxSupportedRate < RATE_FIRST_OFDM_RATE) ||
-			(pAd->CommonCfg.PhyMode == PHY_11B))
-		{
+		    (pAd->CommonCfg.PhyMode == PHY_11B)) {
 			pEntry->RateLen = 4;
 			if (MaxSupportedRate >= RATE_FIRST_OFDM_RATE)
 				MaxSupportedRate = RATE_11;
-		}
-		else
+		} else
 			pEntry->RateLen = 12;
 
 		pEntry->MaxHTPhyMode.word = 0;
 		pEntry->MinHTPhyMode.word = 0;
 		pEntry->HTPhyMode.word = 0;
 		pEntry->MaxSupportedRate = MaxSupportedRate;
-		if (pEntry->MaxSupportedRate < RATE_FIRST_OFDM_RATE)
-		{
+		if (pEntry->MaxSupportedRate < RATE_FIRST_OFDM_RATE) {
 			pEntry->MaxHTPhyMode.field.MODE = MODE_CCK;
-			pEntry->MaxHTPhyMode.field.MCS = pEntry->MaxSupportedRate;
+			pEntry->MaxHTPhyMode.field.MCS =
+			    pEntry->MaxSupportedRate;
 			pEntry->MinHTPhyMode.field.MODE = MODE_CCK;
-			pEntry->MinHTPhyMode.field.MCS = pEntry->MaxSupportedRate;
+			pEntry->MinHTPhyMode.field.MCS =
+			    pEntry->MaxSupportedRate;
 			pEntry->HTPhyMode.field.MODE = MODE_CCK;
 			pEntry->HTPhyMode.field.MCS = pEntry->MaxSupportedRate;
-		}
-		else
-		{
+		} else {
 			pEntry->MaxHTPhyMode.field.MODE = MODE_OFDM;
-			pEntry->MaxHTPhyMode.field.MCS = OfdmRateToRxwiMCS[pEntry->MaxSupportedRate];
+			pEntry->MaxHTPhyMode.field.MCS =
+			    OfdmRateToRxwiMCS[pEntry->MaxSupportedRate];
 			pEntry->MinHTPhyMode.field.MODE = MODE_OFDM;
-			pEntry->MinHTPhyMode.field.MCS = OfdmRateToRxwiMCS[pEntry->MaxSupportedRate];
+			pEntry->MinHTPhyMode.field.MCS =
+			    OfdmRateToRxwiMCS[pEntry->MaxSupportedRate];
 			pEntry->HTPhyMode.field.MODE = MODE_OFDM;
-			pEntry->HTPhyMode.field.MCS = OfdmRateToRxwiMCS[pEntry->MaxSupportedRate];
+			pEntry->HTPhyMode.field.MCS =
+			    OfdmRateToRxwiMCS[pEntry->MaxSupportedRate];
 		}
 		pEntry->CapabilityInfo = CapabilityInfo;
-		CLIENT_STATUS_CLEAR_FLAG(pEntry, fCLIENT_STATUS_AGGREGATION_CAPABLE);
-		CLIENT_STATUS_CLEAR_FLAG(pEntry, fCLIENT_STATUS_PIGGYBACK_CAPABLE);
+		CLIENT_STATUS_CLEAR_FLAG(pEntry,
+					 fCLIENT_STATUS_AGGREGATION_CAPABLE);
+		CLIENT_STATUS_CLEAR_FLAG(pEntry,
+					 fCLIENT_STATUS_PIGGYBACK_CAPABLE);
 	}
 
-	// If this Entry supports 802.11n, upgrade to HT rate.
-	if ((HtCapabilityLen != 0) && (pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED))
-	{
-		UCHAR	j, bitmask; //k,bitmask;
-		CHAR    i;
+	NdisZeroMemory(&pEntry->HTCapability, sizeof(pEntry->HTCapability));
+	/* If this Entry supports 802.11n, upgrade to HT rate. */
+	if ((HtCapabilityLen != 0)
+	    && (pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED)) {
+		u8 j, bitmask;	/*k,bitmask; */
+		char i;
 
 		if (ADHOC_ON(pAd))
-			CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_WMM_CAPABLE);
-		if ((pHtCapability->HtCapInfo.GF) && (pAd->CommonCfg.DesiredHtPhy.GF))
-		{
+			CLIENT_STATUS_SET_FLAG(pEntry,
+					       fCLIENT_STATUS_WMM_CAPABLE);
+		if ((pHtCapability->HtCapInfo.GF)
+		    && (pAd->CommonCfg.DesiredHtPhy.GF)) {
 			pEntry->MaxHTPhyMode.field.MODE = MODE_HTGREENFIELD;
-		}
-		else
-		{
+		} else {
 			pEntry->MaxHTPhyMode.field.MODE = MODE_HTMIX;
 			pAd->MacTab.fAnyStationNonGF = TRUE;
 			pAd->CommonCfg.AddHTInfo.AddHtInfo2.NonGfPresent = 1;
 		}
 
-		if ((pHtCapability->HtCapInfo.ChannelWidth) && (pAd->CommonCfg.DesiredHtPhy.ChannelWidth))
-		{
-			pEntry->MaxHTPhyMode.field.BW= BW_40;
-			pEntry->MaxHTPhyMode.field.ShortGI = ((pAd->CommonCfg.DesiredHtPhy.ShortGIfor40)&(pHtCapability->HtCapInfo.ShortGIfor40));
-		}
-		else
-		{
+		if ((pHtCapability->HtCapInfo.ChannelWidth) &&
+		    (pAd->CommonCfg.DesiredHtPhy.ChannelWidth) &&
+		    ((pAd->StaCfg.BssType == BSS_INFRA)
+		     || ((pAd->StaCfg.BssType == BSS_ADHOC)
+			 && (pAddHtInfo->AddHtInfo.ExtChanOffset ==
+			     pAd->CommonCfg.AddHTInfo.AddHtInfo.
+			     ExtChanOffset)))) {
+			pEntry->MaxHTPhyMode.field.BW = BW_40;
+			pEntry->MaxHTPhyMode.field.ShortGI =
+			    ((pAd->CommonCfg.DesiredHtPhy.
+			      ShortGIfor40) & (pHtCapability->HtCapInfo.
+					       ShortGIfor40));
+		} else {
 			pEntry->MaxHTPhyMode.field.BW = BW_20;
-			pEntry->MaxHTPhyMode.field.ShortGI = ((pAd->CommonCfg.DesiredHtPhy.ShortGIfor20)&(pHtCapability->HtCapInfo.ShortGIfor20));
+			pEntry->MaxHTPhyMode.field.ShortGI =
+			    ((pAd->CommonCfg.DesiredHtPhy.
+			      ShortGIfor20) & (pHtCapability->HtCapInfo.
+					       ShortGIfor20));
 			pAd->MacTab.fAnyStation20Only = TRUE;
 		}
 
-		// 3*3
-		if (pAd->MACVersion >= RALINK_2883_VERSION && pAd->MACVersion < RALINK_3070_VERSION)
-			pEntry->MaxHTPhyMode.field.TxBF = pAd->CommonCfg.RegTransmitSetting.field.TxBF;
+		/* 3*3 */
+		if (pAd->MACVersion >= RALINK_2883_VERSION
+		    && pAd->MACVersion < RALINK_3070_VERSION)
+			pEntry->MaxHTPhyMode.field.TxBF =
+			    pAd->CommonCfg.RegTransmitSetting.field.TxBF;
 
-		// find max fixed rate
-		for (i=23; i>=0; i--) // 3*3
+		/* find max fixed rate */
+		for (i = 23; i >= 0; i--)	/* 3*3 */
 		{
-			j = i/8;
-			bitmask = (1<<(i-(j*8)));
-			if ((pAd->StaCfg.DesiredHtPhyInfo.MCSSet[j] & bitmask) && (pHtCapability->MCSSet[j] & bitmask))
-			{
+			j = i / 8;
+			bitmask = (1 << (i - (j * 8)));
+			if ((pAd->StaCfg.DesiredHtPhyInfo.MCSSet[j] & bitmask)
+			    && (pHtCapability->MCSSet[j] & bitmask)) {
 				pEntry->MaxHTPhyMode.field.MCS = i;
 				break;
 			}
-			if (i==0)
+			if (i == 0)
 				break;
 		}
 
-
-		if (pAd->StaCfg.DesiredTransmitSetting.field.MCS != MCS_AUTO)
-		{
-			if (pAd->StaCfg.DesiredTransmitSetting.field.MCS == 32)
-			{
-				// Fix MCS as HT Duplicated Mode
+		if (pAd->StaCfg.DesiredTransmitSetting.field.MCS != MCS_AUTO) {
+			if (pAd->StaCfg.DesiredTransmitSetting.field.MCS == 32) {
+				/* Fix MCS as HT Duplicated Mode */
 				pEntry->MaxHTPhyMode.field.BW = 1;
 				pEntry->MaxHTPhyMode.field.MODE = MODE_HTMIX;
 				pEntry->MaxHTPhyMode.field.STBC = 0;
 				pEntry->MaxHTPhyMode.field.ShortGI = 0;
 				pEntry->MaxHTPhyMode.field.MCS = 32;
-			}
-			else if (pEntry->MaxHTPhyMode.field.MCS > pAd->StaCfg.HTPhyMode.field.MCS)
-			{
-				// STA supports fixed MCS
-				pEntry->MaxHTPhyMode.field.MCS = pAd->StaCfg.HTPhyMode.field.MCS;
+			} else if (pEntry->MaxHTPhyMode.field.MCS >
+				   pAd->StaCfg.HTPhyMode.field.MCS) {
+				/* STA supports fixed MCS */
+				pEntry->MaxHTPhyMode.field.MCS =
+				    pAd->StaCfg.HTPhyMode.field.MCS;
 			}
 		}
 
-		pEntry->MaxHTPhyMode.field.STBC = (pHtCapability->HtCapInfo.RxSTBC & (pAd->CommonCfg.DesiredHtPhy.TxSTBC));
+		pEntry->MaxHTPhyMode.field.STBC =
+		    (pHtCapability->HtCapInfo.
+		     RxSTBC & (pAd->CommonCfg.DesiredHtPhy.TxSTBC));
 		pEntry->MpduDensity = pHtCapability->HtCapParm.MpduDensity;
-		pEntry->MaxRAmpduFactor = pHtCapability->HtCapParm.MaxRAmpduFactor;
-		pEntry->MmpsMode = (UCHAR)pHtCapability->HtCapInfo.MimoPs;
-		pEntry->AMsduSize = (UCHAR)pHtCapability->HtCapInfo.AMsduSize;
+		pEntry->MaxRAmpduFactor =
+		    pHtCapability->HtCapParm.MaxRAmpduFactor;
+		pEntry->MmpsMode = (u8)pHtCapability->HtCapInfo.MimoPs;
+		pEntry->AMsduSize = (u8)pHtCapability->HtCapInfo.AMsduSize;
 		pEntry->HTPhyMode.word = pEntry->MaxHTPhyMode.word;
 
-		if (pAd->CommonCfg.DesiredHtPhy.AmsduEnable && (pAd->CommonCfg.REGBACapability.field.AutoBA == FALSE))
-			CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_AMSDU_INUSED);
+		if (pAd->CommonCfg.DesiredHtPhy.AmsduEnable
+		    && (pAd->CommonCfg.REGBACapability.field.AutoBA == FALSE))
+			CLIENT_STATUS_SET_FLAG(pEntry,
+					       fCLIENT_STATUS_AMSDU_INUSED);
 		if (pHtCapability->HtCapInfo.ShortGIfor20)
-			CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_SGI20_CAPABLE);
+			CLIENT_STATUS_SET_FLAG(pEntry,
+					       fCLIENT_STATUS_SGI20_CAPABLE);
 		if (pHtCapability->HtCapInfo.ShortGIfor40)
-			CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_SGI40_CAPABLE);
+			CLIENT_STATUS_SET_FLAG(pEntry,
+					       fCLIENT_STATUS_SGI40_CAPABLE);
 		if (pHtCapability->HtCapInfo.TxSTBC)
-			CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_TxSTBC_CAPABLE);
+			CLIENT_STATUS_SET_FLAG(pEntry,
+					       fCLIENT_STATUS_TxSTBC_CAPABLE);
 		if (pHtCapability->HtCapInfo.RxSTBC)
-			CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_RxSTBC_CAPABLE);
+			CLIENT_STATUS_SET_FLAG(pEntry,
+					       fCLIENT_STATUS_RxSTBC_CAPABLE);
 		if (pHtCapability->ExtHtCapInfo.PlusHTC)
-			CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_HTC_CAPABLE);
-		if (pAd->CommonCfg.bRdg && pHtCapability->ExtHtCapInfo.RDGSupport)
-			CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_RDG_CAPABLE);
+			CLIENT_STATUS_SET_FLAG(pEntry,
+					       fCLIENT_STATUS_HTC_CAPABLE);
+		if (pAd->CommonCfg.bRdg
+		    && pHtCapability->ExtHtCapInfo.RDGSupport)
+			CLIENT_STATUS_SET_FLAG(pEntry,
+					       fCLIENT_STATUS_RDG_CAPABLE);
 		if (pHtCapability->ExtHtCapInfo.MCSFeedback == 0x03)
-			CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_MCSFEEDBACK_CAPABLE);
-	}
-	else
-	{
+			CLIENT_STATUS_SET_FLAG(pEntry,
+					       fCLIENT_STATUS_MCSFEEDBACK_CAPABLE);
+		NdisMoveMemory(&pEntry->HTCapability, pHtCapability,
+			       HtCapabilityLen);
+	} else {
 		pAd->MacTab.fAnyStationIsLegacy = TRUE;
 	}
 
-	NdisMoveMemory(&pEntry->HTCapability, pHtCapability, sizeof(HT_CAPABILITY_IE));
-
 	pEntry->HTPhyMode.word = pEntry->MaxHTPhyMode.word;
 	pEntry->CurrTxRate = pEntry->MaxSupportedRate;
 
-	// Set asic auto fall back
-	if (pAd->StaCfg.bAutoTxRateSwitch == TRUE)
-	{
-		PUCHAR					pTable;
-		UCHAR					TableSize = 0;
+	/* Set asic auto fall back */
+	if (pAd->StaCfg.bAutoTxRateSwitch == TRUE) {
+		u8 *pTable;
+		u8 TableSize = 0;
 
-		MlmeSelectTxRateTable(pAd, pEntry, &pTable, &TableSize, &pEntry->CurrTxRateIndex);
+		MlmeSelectTxRateTable(pAd, pEntry, &pTable, &TableSize,
+				      &pEntry->CurrTxRateIndex);
 		pEntry->bAutoTxRateSwitch = TRUE;
-	}
-	else
-	{
-		pEntry->HTPhyMode.field.MODE	= pAd->StaCfg.HTPhyMode.field.MODE;
-		pEntry->HTPhyMode.field.MCS	= pAd->StaCfg.HTPhyMode.field.MCS;
+	} else {
+		pEntry->HTPhyMode.field.MODE = pAd->StaCfg.HTPhyMode.field.MODE;
+		pEntry->HTPhyMode.field.MCS = pAd->StaCfg.HTPhyMode.field.MCS;
 		pEntry->bAutoTxRateSwitch = FALSE;
 
-		// If the legacy mode is set, overwrite the transmit setting of this entry.
-		RTMPUpdateLegacyTxSetting((UCHAR)pAd->StaCfg.DesiredTransmitSetting.field.FixedTxMode, pEntry);
+		/* If the legacy mode is set, overwrite the transmit setting of this entry. */
+		RTMPUpdateLegacyTxSetting((u8)pAd->StaCfg.
+					  DesiredTransmitSetting.field.
+					  FixedTxMode, pEntry);
 	}
 
 	pEntry->PortSecured = WPA_802_1X_PORT_SECURED;
@@ -1715,15 +1592,14 @@ BOOLEAN StaAddMacTableEntry(
 
 	NdisReleaseSpinLock(&pAd->MacTabLock);
 
-    {
-        union iwreq_data    wrqu;
-        wext_notify_event_assoc(pAd);
+	{
+		union iwreq_data wrqu;
+		wext_notify_event_assoc(pAd);
 
-        memset(wrqu.ap_addr.sa_data, 0, MAC_ADDR_LEN);
-        memcpy(wrqu.ap_addr.sa_data, pAd->MlmeAux.Bssid, MAC_ADDR_LEN);
-        wireless_send_event(pAd->net_dev, SIOCGIWAP, &wrqu, NULL);
+		memset(wrqu.ap_addr.sa_data, 0, MAC_ADDR_LEN);
+		memcpy(wrqu.ap_addr.sa_data, pAd->MlmeAux.Bssid, MAC_ADDR_LEN);
+		wireless_send_event(pAd->net_dev, SIOCGIWAP, &wrqu, NULL);
 
-    }
+	}
 	return TRUE;
 }
-#endif /* RT2870 */
diff --git a/drivers/staging/rt2860/sta/auth.c b/drivers/staging/rt2860/sta/auth.c
index d8414eac42f8..404bd220679d 100644
--- a/drivers/staging/rt2860/sta/auth.c
+++ b/drivers/staging/rt2860/sta/auth.c
@@ -55,27 +55,35 @@
     ==========================================================================
  */
 
-void AuthStateMachineInit(
-    IN PRTMP_ADAPTER pAd,
-    IN STATE_MACHINE *Sm,
-    OUT STATE_MACHINE_FUNC Trans[])
+void AuthStateMachineInit(struct rt_rtmp_adapter *pAd,
+			  struct rt_state_machine *Sm, OUT STATE_MACHINE_FUNC Trans[])
 {
-    StateMachineInit(Sm, Trans, MAX_AUTH_STATE, MAX_AUTH_MSG, (STATE_MACHINE_FUNC)Drop, AUTH_REQ_IDLE, AUTH_MACHINE_BASE);
-
-    // the first column
-    StateMachineSetAction(Sm, AUTH_REQ_IDLE, MT2_MLME_AUTH_REQ, (STATE_MACHINE_FUNC)MlmeAuthReqAction);
-
-    // the second column
-    StateMachineSetAction(Sm, AUTH_WAIT_SEQ2, MT2_MLME_AUTH_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenAuth);
-    StateMachineSetAction(Sm, AUTH_WAIT_SEQ2, MT2_PEER_AUTH_EVEN, (STATE_MACHINE_FUNC)PeerAuthRspAtSeq2Action);
-    StateMachineSetAction(Sm, AUTH_WAIT_SEQ2, MT2_AUTH_TIMEOUT, (STATE_MACHINE_FUNC)AuthTimeoutAction);
-
-    // the third column
-    StateMachineSetAction(Sm, AUTH_WAIT_SEQ4, MT2_MLME_AUTH_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenAuth);
-    StateMachineSetAction(Sm, AUTH_WAIT_SEQ4, MT2_PEER_AUTH_EVEN, (STATE_MACHINE_FUNC)PeerAuthRspAtSeq4Action);
-    StateMachineSetAction(Sm, AUTH_WAIT_SEQ4, MT2_AUTH_TIMEOUT, (STATE_MACHINE_FUNC)AuthTimeoutAction);
-
-	RTMPInitTimer(pAd, &pAd->MlmeAux.AuthTimer, GET_TIMER_FUNCTION(AuthTimeout), pAd, FALSE);
+	StateMachineInit(Sm, Trans, MAX_AUTH_STATE, MAX_AUTH_MSG,
+			 (STATE_MACHINE_FUNC) Drop, AUTH_REQ_IDLE,
+			 AUTH_MACHINE_BASE);
+
+	/* the first column */
+	StateMachineSetAction(Sm, AUTH_REQ_IDLE, MT2_MLME_AUTH_REQ,
+			      (STATE_MACHINE_FUNC) MlmeAuthReqAction);
+
+	/* the second column */
+	StateMachineSetAction(Sm, AUTH_WAIT_SEQ2, MT2_MLME_AUTH_REQ,
+			      (STATE_MACHINE_FUNC) InvalidStateWhenAuth);
+	StateMachineSetAction(Sm, AUTH_WAIT_SEQ2, MT2_PEER_AUTH_EVEN,
+			      (STATE_MACHINE_FUNC) PeerAuthRspAtSeq2Action);
+	StateMachineSetAction(Sm, AUTH_WAIT_SEQ2, MT2_AUTH_TIMEOUT,
+			      (STATE_MACHINE_FUNC) AuthTimeoutAction);
+
+	/* the third column */
+	StateMachineSetAction(Sm, AUTH_WAIT_SEQ4, MT2_MLME_AUTH_REQ,
+			      (STATE_MACHINE_FUNC) InvalidStateWhenAuth);
+	StateMachineSetAction(Sm, AUTH_WAIT_SEQ4, MT2_PEER_AUTH_EVEN,
+			      (STATE_MACHINE_FUNC) PeerAuthRspAtSeq4Action);
+	StateMachineSetAction(Sm, AUTH_WAIT_SEQ4, MT2_AUTH_TIMEOUT,
+			      (STATE_MACHINE_FUNC) AuthTimeoutAction);
+
+	RTMPInitTimer(pAd, &pAd->MlmeAux.AuthTimer,
+		      GET_TIMER_FUNCTION(AuthTimeout), pAd, FALSE);
 }
 
 /*
@@ -87,31 +95,28 @@ void AuthStateMachineInit(
 
     ==========================================================================
  */
-VOID AuthTimeout(
-    IN PVOID SystemSpecific1,
-    IN PVOID FunctionContext,
-    IN PVOID SystemSpecific2,
-    IN PVOID SystemSpecific3)
+void AuthTimeout(void *SystemSpecific1,
+		 void *FunctionContext,
+		 void *SystemSpecific2, void *SystemSpecific3)
 {
-    RTMP_ADAPTER *pAd = (RTMP_ADAPTER *)FunctionContext;
+	struct rt_rtmp_adapter *pAd = (struct rt_rtmp_adapter *)FunctionContext;
 
-    DBGPRINT(RT_DEBUG_TRACE,("AUTH - AuthTimeout\n"));
+	DBGPRINT(RT_DEBUG_TRACE, ("AUTH - AuthTimeout\n"));
 
-	// Do nothing if the driver is starting halt state.
-	// This might happen when timer already been fired before cancel timer with mlmehalt
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
+	/* Do nothing if the driver is starting halt state. */
+	/* This might happen when timer already been fired before cancel timer with mlmehalt */
+	if (RTMP_TEST_FLAG
+	    (pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
 		return;
 
-	// send a de-auth to reset AP's state machine (Patch AP-Dir635)
+	/* send a de-auth to reset AP's state machine (Patch AP-Dir635) */
 	if (pAd->Mlme.AuthMachine.CurrState == AUTH_WAIT_SEQ2)
 		Cls2errAction(pAd, pAd->MlmeAux.Bssid);
 
-
-    MlmeEnqueue(pAd, AUTH_STATE_MACHINE, MT2_AUTH_TIMEOUT, 0, NULL);
-    RT28XX_MLME_HANDLER(pAd);
+	MlmeEnqueue(pAd, AUTH_STATE_MACHINE, MT2_AUTH_TIMEOUT, 0, NULL);
+	RTMP_MLME_HANDLER(pAd);
 }
 
-
 /*
     ==========================================================================
     Description:
@@ -120,67 +125,19 @@ VOID AuthTimeout(
 
     ==========================================================================
  */
-VOID MlmeAuthReqAction(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem)
+void MlmeAuthReqAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-    UCHAR              Addr[6];
-    USHORT             Alg, Seq, Status;
-    ULONG              Timeout;
-    HEADER_802_11      AuthHdr;
-    BOOLEAN            TimerCancelled;
-    NDIS_STATUS        NStatus;
-    PUCHAR             pOutBuffer = NULL;
-    ULONG              FrameLen = 0;
-
-	// Block all authentication request durning WPA block period
-	if (pAd->StaCfg.bBlockAssoc == TRUE)
-	{
-        DBGPRINT(RT_DEBUG_TRACE, ("AUTH - Block Auth request durning WPA block period!\n"));
-        pAd->Mlme.AuthMachine.CurrState = AUTH_REQ_IDLE;
-        Status = MLME_STATE_MACHINE_REJECT;
-        MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_AUTH_CONF, 2, &Status);
+	if (AUTH_ReqSend
+	    (pAd, Elem, &pAd->MlmeAux.AuthTimer, "AUTH", 1, NULL, 0))
+		pAd->Mlme.AuthMachine.CurrState = AUTH_WAIT_SEQ2;
+	else {
+		u16 Status;
+
+		pAd->Mlme.AuthMachine.CurrState = AUTH_REQ_IDLE;
+		Status = MLME_INVALID_FORMAT;
+		MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_AUTH_CONF, 2,
+			    &Status);
 	}
-    else if(MlmeAuthReqSanity(pAd, Elem->Msg, Elem->MsgLen, Addr, &Timeout, &Alg))
-    {
-        // reset timer
-        RTMPCancelTimer(&pAd->MlmeAux.AuthTimer, &TimerCancelled);
-        COPY_MAC_ADDR(pAd->MlmeAux.Bssid, Addr);
-        pAd->MlmeAux.Alg  = Alg;
-        Seq = 1;
-        Status = MLME_SUCCESS;
-
-        NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);  //Get an unused nonpaged memory
-        if(NStatus != NDIS_STATUS_SUCCESS)
-        {
-            DBGPRINT(RT_DEBUG_TRACE, ("AUTH - MlmeAuthReqAction(Alg:%d) allocate memory failed\n", Alg));
-            pAd->Mlme.AuthMachine.CurrState = AUTH_REQ_IDLE;
-            Status = MLME_FAIL_NO_RESOURCE;
-            MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_AUTH_CONF, 2, &Status);
-            return;
-        }
-
-        DBGPRINT(RT_DEBUG_TRACE, ("AUTH - Send AUTH request seq#1 (Alg=%d)...\n", Alg));
-        MgtMacHeaderInit(pAd, &AuthHdr, SUBTYPE_AUTH, 0, Addr, pAd->MlmeAux.Bssid);
-        MakeOutgoingFrame(pOutBuffer,           &FrameLen,
-                          sizeof(HEADER_802_11),&AuthHdr,
-                          2,                    &Alg,
-                          2,                    &Seq,
-                          2,                    &Status,
-                          END_OF_ARGS);
-        MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
-    	MlmeFreeMemory(pAd, pOutBuffer);
-
-        RTMPSetTimer(&pAd->MlmeAux.AuthTimer, Timeout);
-        pAd->Mlme.AuthMachine.CurrState = AUTH_WAIT_SEQ2;
-    }
-    else
-    {
-        DBGPRINT_ERR(("AUTH - MlmeAuthReqAction() sanity check failed\n"));
-        pAd->Mlme.AuthMachine.CurrState = AUTH_REQ_IDLE;
-        Status = MLME_INVALID_FORMAT;
-        MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_AUTH_CONF, 2, &Status);
-    }
 }
 
 /*
@@ -191,102 +148,130 @@ VOID MlmeAuthReqAction(
 
     ==========================================================================
  */
-VOID PeerAuthRspAtSeq2Action(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem)
+void PeerAuthRspAtSeq2Action(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-    UCHAR         Addr2[MAC_ADDR_LEN];
-    USHORT        Seq, Status, RemoteStatus, Alg;
-    UCHAR         ChlgText[CIPHER_TEXT_LEN];
-    UCHAR         CyperChlgText[CIPHER_TEXT_LEN + 8 + 8];
-    UCHAR         Element[2];
-    HEADER_802_11 AuthHdr;
-    BOOLEAN       TimerCancelled;
-    PUCHAR        pOutBuffer = NULL;
-    NDIS_STATUS   NStatus;
-    ULONG         FrameLen = 0;
-    USHORT        Status2;
-
-    if (PeerAuthSanity(pAd, Elem->Msg, Elem->MsgLen, Addr2, &Alg, &Seq, &Status, ChlgText))
-    {
-        if (MAC_ADDR_EQUAL(pAd->MlmeAux.Bssid, Addr2) && Seq == 2)
-        {
-            DBGPRINT(RT_DEBUG_TRACE, ("AUTH - Receive AUTH_RSP seq#2 to me (Alg=%d, Status=%d)\n", Alg, Status));
-            RTMPCancelTimer(&pAd->MlmeAux.AuthTimer, &TimerCancelled);
-
-            if (Status == MLME_SUCCESS)
-            {
-                // Authentication Mode "LEAP" has allow for CCX 1.X
-                if ((pAd->MlmeAux.Alg == Ndis802_11AuthModeOpen)
-				)
-                {
-                    pAd->Mlme.AuthMachine.CurrState = AUTH_REQ_IDLE;
-                    MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_AUTH_CONF, 2, &Status);
-                }
-                else
-                {
-                    // 2. shared key, need to be challenged
-                    Seq++;
-                    RemoteStatus = MLME_SUCCESS;
-
-					// Get an unused nonpaged memory
-                    NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);
-                    if(NStatus != NDIS_STATUS_SUCCESS)
-                    {
-                        DBGPRINT(RT_DEBUG_TRACE, ("AUTH - PeerAuthRspAtSeq2Action() allocate memory fail\n"));
-                        pAd->Mlme.AuthMachine.CurrState = AUTH_REQ_IDLE;
-                        Status2 = MLME_FAIL_NO_RESOURCE;
-                        MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_AUTH_CONF, 2, &Status2);
-                        return;
-                    }
-
-                    DBGPRINT(RT_DEBUG_TRACE, ("AUTH - Send AUTH request seq#3...\n"));
-                    MgtMacHeaderInit(pAd, &AuthHdr, SUBTYPE_AUTH, 0, Addr2, pAd->MlmeAux.Bssid);
-                    AuthHdr.FC.Wep = 1;
-                    // Encrypt challenge text & auth information
-                    RTMPInitWepEngine(
-                    	pAd,
-                    	pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].Key,
-                    	pAd->StaCfg.DefaultKeyId,
-                    	pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].KeyLen,
-                    	CyperChlgText);
-
-					Alg = cpu2le16(*(USHORT *)&Alg);
-					Seq = cpu2le16(*(USHORT *)&Seq);
-					RemoteStatus= cpu2le16(*(USHORT *)&RemoteStatus);
-
-					RTMPEncryptData(pAd, (PUCHAR) &Alg, CyperChlgText + 4, 2);
-					RTMPEncryptData(pAd, (PUCHAR) &Seq, CyperChlgText + 6, 2);
-					RTMPEncryptData(pAd, (PUCHAR) &RemoteStatus, CyperChlgText + 8, 2);
+	u8 Addr2[MAC_ADDR_LEN];
+	u16 Seq, Status, RemoteStatus, Alg;
+	u8 ChlgText[CIPHER_TEXT_LEN];
+	u8 CyperChlgText[CIPHER_TEXT_LEN + 8 + 8];
+	u8 Element[2];
+	struct rt_header_802_11 AuthHdr;
+	BOOLEAN TimerCancelled;
+	u8 *pOutBuffer = NULL;
+	int NStatus;
+	unsigned long FrameLen = 0;
+	u16 Status2;
+
+	if (PeerAuthSanity
+	    (pAd, Elem->Msg, Elem->MsgLen, Addr2, &Alg, &Seq, &Status,
+	     (char *)ChlgText)) {
+		if (MAC_ADDR_EQUAL(pAd->MlmeAux.Bssid, Addr2) && Seq == 2) {
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("AUTH - Receive AUTH_RSP seq#2 to me (Alg=%d, Status=%d)\n",
+				  Alg, Status));
+			RTMPCancelTimer(&pAd->MlmeAux.AuthTimer,
+					&TimerCancelled);
+
+			if (Status == MLME_SUCCESS) {
+				/* Authentication Mode "LEAP" has allow for CCX 1.X */
+				if (pAd->MlmeAux.Alg == Ndis802_11AuthModeOpen) {
+					pAd->Mlme.AuthMachine.CurrState =
+					    AUTH_REQ_IDLE;
+					MlmeEnqueue(pAd,
+						    MLME_CNTL_STATE_MACHINE,
+						    MT2_AUTH_CONF, 2, &Status);
+				} else {
+					/* 2. shared key, need to be challenged */
+					Seq++;
+					RemoteStatus = MLME_SUCCESS;
+
+					/* Get an unused nonpaged memory */
+					NStatus =
+					    MlmeAllocateMemory(pAd,
+							       &pOutBuffer);
+					if (NStatus != NDIS_STATUS_SUCCESS) {
+						DBGPRINT(RT_DEBUG_TRACE,
+							 ("AUTH - PeerAuthRspAtSeq2Action() allocate memory fail\n"));
+						pAd->Mlme.AuthMachine.
+						    CurrState = AUTH_REQ_IDLE;
+						Status2 = MLME_FAIL_NO_RESOURCE;
+						MlmeEnqueue(pAd,
+							    MLME_CNTL_STATE_MACHINE,
+							    MT2_AUTH_CONF, 2,
+							    &Status2);
+						return;
+					}
+
+					DBGPRINT(RT_DEBUG_TRACE,
+						 ("AUTH - Send AUTH request seq#3...\n"));
+					MgtMacHeaderInit(pAd, &AuthHdr,
+							 SUBTYPE_AUTH, 0, Addr2,
+							 pAd->MlmeAux.Bssid);
+					AuthHdr.FC.Wep = 1;
+					/* Encrypt challenge text & auth information */
+					RTMPInitWepEngine(pAd,
+							  pAd->
+							  SharedKey[BSS0][pAd->
+									  StaCfg.
+									  DefaultKeyId].
+							  Key,
+							  pAd->StaCfg.
+							  DefaultKeyId,
+							  pAd->
+							  SharedKey[BSS0][pAd->
+									  StaCfg.
+									  DefaultKeyId].
+							  KeyLen,
+							  CyperChlgText);
+
+					Alg = cpu2le16(*(u16 *) & Alg);
+					Seq = cpu2le16(*(u16 *) & Seq);
+					RemoteStatus =
+					    cpu2le16(*(u16 *) &
+						     RemoteStatus);
+
+					RTMPEncryptData(pAd, (u8 *)& Alg,
+							CyperChlgText + 4, 2);
+					RTMPEncryptData(pAd, (u8 *)& Seq,
+							CyperChlgText + 6, 2);
+					RTMPEncryptData(pAd,
+							(u8 *)& RemoteStatus,
+							CyperChlgText + 8, 2);
 					Element[0] = 16;
 					Element[1] = 128;
-					RTMPEncryptData(pAd, Element, CyperChlgText + 10, 2);
-					RTMPEncryptData(pAd, ChlgText, CyperChlgText + 12, 128);
+					RTMPEncryptData(pAd, Element,
+							CyperChlgText + 10, 2);
+					RTMPEncryptData(pAd, ChlgText,
+							CyperChlgText + 12,
+							128);
 					RTMPSetICV(pAd, CyperChlgText + 140);
-                    MakeOutgoingFrame(pOutBuffer,               &FrameLen,
-                                      sizeof(HEADER_802_11),    &AuthHdr,
-                                      CIPHER_TEXT_LEN + 16,     CyperChlgText,
-                                      END_OF_ARGS);
-                    MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
-                	MlmeFreeMemory(pAd, pOutBuffer);
-
-                    RTMPSetTimer(&pAd->MlmeAux.AuthTimer, AUTH_TIMEOUT);
-                    pAd->Mlme.AuthMachine.CurrState = AUTH_WAIT_SEQ4;
-                }
-            }
-            else
-            {
-                pAd->StaCfg.AuthFailReason = Status;
-                COPY_MAC_ADDR(pAd->StaCfg.AuthFailSta, Addr2);
-                pAd->Mlme.AuthMachine.CurrState = AUTH_REQ_IDLE;
-                MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_AUTH_CONF, 2, &Status);
-            }
-        }
-    }
-    else
-    {
-        DBGPRINT(RT_DEBUG_TRACE, ("AUTH - PeerAuthSanity() sanity check fail\n"));
-    }
+					MakeOutgoingFrame(pOutBuffer, &FrameLen,
+							  sizeof(struct rt_header_802_11),
+							  &AuthHdr,
+							  CIPHER_TEXT_LEN + 16,
+							  CyperChlgText,
+							  END_OF_ARGS);
+					MiniportMMRequest(pAd, 0, pOutBuffer,
+							  FrameLen);
+					MlmeFreeMemory(pAd, pOutBuffer);
+
+					RTMPSetTimer(&pAd->MlmeAux.AuthTimer,
+						     AUTH_TIMEOUT);
+					pAd->Mlme.AuthMachine.CurrState =
+					    AUTH_WAIT_SEQ4;
+				}
+			} else {
+				pAd->StaCfg.AuthFailReason = Status;
+				COPY_MAC_ADDR(pAd->StaCfg.AuthFailSta, Addr2);
+				pAd->Mlme.AuthMachine.CurrState = AUTH_REQ_IDLE;
+				MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE,
+					    MT2_AUTH_CONF, 2, &Status);
+			}
+		}
+	} else {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("AUTH - PeerAuthSanity() sanity check fail\n"));
+	}
 }
 
 /*
@@ -297,36 +282,35 @@ VOID PeerAuthRspAtSeq2Action(
 
     ==========================================================================
  */
-VOID PeerAuthRspAtSeq4Action(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem)
+void PeerAuthRspAtSeq4Action(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-    UCHAR         Addr2[MAC_ADDR_LEN];
-    USHORT        Alg, Seq, Status;
-    CHAR          ChlgText[CIPHER_TEXT_LEN];
-    BOOLEAN       TimerCancelled;
-
-    if(PeerAuthSanity(pAd, Elem->Msg, Elem->MsgLen, Addr2, &Alg, &Seq, &Status, ChlgText))
-    {
-        if(MAC_ADDR_EQUAL(pAd->MlmeAux.Bssid, Addr2) && Seq == 4)
-        {
-            DBGPRINT(RT_DEBUG_TRACE, ("AUTH - Receive AUTH_RSP seq#4 to me\n"));
-            RTMPCancelTimer(&pAd->MlmeAux.AuthTimer, &TimerCancelled);
-
-            if (Status != MLME_SUCCESS)
-            {
-                pAd->StaCfg.AuthFailReason = Status;
-                COPY_MAC_ADDR(pAd->StaCfg.AuthFailSta, Addr2);
-            }
-
-            pAd->Mlme.AuthMachine.CurrState = AUTH_REQ_IDLE;
-            MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_AUTH_CONF, 2, &Status);
-        }
-    }
-    else
-    {
-        DBGPRINT(RT_DEBUG_TRACE, ("AUTH - PeerAuthRspAtSeq4Action() sanity check fail\n"));
-    }
+	u8 Addr2[MAC_ADDR_LEN];
+	u16 Alg, Seq, Status;
+	char ChlgText[CIPHER_TEXT_LEN];
+	BOOLEAN TimerCancelled;
+
+	if (PeerAuthSanity
+	    (pAd, Elem->Msg, Elem->MsgLen, Addr2, &Alg, &Seq, &Status,
+	     ChlgText)) {
+		if (MAC_ADDR_EQUAL(pAd->MlmeAux.Bssid, Addr2) && Seq == 4) {
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("AUTH - Receive AUTH_RSP seq#4 to me\n"));
+			RTMPCancelTimer(&pAd->MlmeAux.AuthTimer,
+					&TimerCancelled);
+
+			if (Status != MLME_SUCCESS) {
+				pAd->StaCfg.AuthFailReason = Status;
+				COPY_MAC_ADDR(pAd->StaCfg.AuthFailSta, Addr2);
+			}
+
+			pAd->Mlme.AuthMachine.CurrState = AUTH_REQ_IDLE;
+			MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_AUTH_CONF,
+				    2, &Status);
+		}
+	} else {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("AUTH - PeerAuthRspAtSeq4Action() sanity check fail\n"));
+	}
 }
 
 /*
@@ -337,47 +321,49 @@ VOID PeerAuthRspAtSeq4Action(
 
     ==========================================================================
  */
-VOID MlmeDeauthReqAction(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem)
+void MlmeDeauthReqAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-    MLME_DEAUTH_REQ_STRUCT *pInfo;
-    HEADER_802_11 DeauthHdr;
-    PUCHAR        pOutBuffer = NULL;
-    NDIS_STATUS   NStatus;
-    ULONG         FrameLen = 0;
-    USHORT        Status;
-
-    pInfo = (MLME_DEAUTH_REQ_STRUCT *)Elem->Msg;
-
-    NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);  //Get an unused nonpaged memory
-    if (NStatus != NDIS_STATUS_SUCCESS)
-    {
-        DBGPRINT(RT_DEBUG_TRACE, ("AUTH - MlmeDeauthReqAction() allocate memory fail\n"));
-        pAd->Mlme.AuthMachine.CurrState = AUTH_REQ_IDLE;
-        Status = MLME_FAIL_NO_RESOURCE;
-        MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_DEAUTH_CONF, 2, &Status);
-        return;
-    }
-
-    DBGPRINT(RT_DEBUG_TRACE, ("AUTH - Send DE-AUTH request (Reason=%d)...\n", pInfo->Reason));
-    MgtMacHeaderInit(pAd, &DeauthHdr, SUBTYPE_DEAUTH, 0, pInfo->Addr, pAd->MlmeAux.Bssid);
-    MakeOutgoingFrame(pOutBuffer,           &FrameLen,
-                      sizeof(HEADER_802_11),&DeauthHdr,
-                      2,                    &pInfo->Reason,
-                      END_OF_ARGS);
-    MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
+	struct rt_mlme_deauth_req *pInfo;
+	struct rt_header_802_11 DeauthHdr;
+	u8 *pOutBuffer = NULL;
+	int NStatus;
+	unsigned long FrameLen = 0;
+	u16 Status;
+
+	pInfo = (struct rt_mlme_deauth_req *)Elem->Msg;
+
+	NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);	/*Get an unused nonpaged memory */
+	if (NStatus != NDIS_STATUS_SUCCESS) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("AUTH - MlmeDeauthReqAction() allocate memory fail\n"));
+		pAd->Mlme.AuthMachine.CurrState = AUTH_REQ_IDLE;
+		Status = MLME_FAIL_NO_RESOURCE;
+		MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_DEAUTH_CONF, 2,
+			    &Status);
+		return;
+	}
+
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("AUTH - Send DE-AUTH request (Reason=%d)...\n",
+		  pInfo->Reason));
+	MgtMacHeaderInit(pAd, &DeauthHdr, SUBTYPE_DEAUTH, 0, pInfo->Addr,
+			 pAd->MlmeAux.Bssid);
+	MakeOutgoingFrame(pOutBuffer, &FrameLen, sizeof(struct rt_header_802_11),
+			  &DeauthHdr, 2, &pInfo->Reason, END_OF_ARGS);
+	MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
 	MlmeFreeMemory(pAd, pOutBuffer);
 
-    pAd->StaCfg.DeauthReason = pInfo->Reason;
-    COPY_MAC_ADDR(pAd->StaCfg.DeauthSta, pInfo->Addr);
-    pAd->Mlme.AuthMachine.CurrState = AUTH_REQ_IDLE;
-    Status = MLME_SUCCESS;
-    MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_DEAUTH_CONF, 2, &Status);
+	pAd->StaCfg.DeauthReason = pInfo->Reason;
+	COPY_MAC_ADDR(pAd->StaCfg.DeauthSta, pInfo->Addr);
+	pAd->Mlme.AuthMachine.CurrState = AUTH_REQ_IDLE;
+	Status = MLME_SUCCESS;
+	MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_DEAUTH_CONF, 2, &Status);
 
-	// send wireless event - for deauthentication
+	/* send wireless event - for deauthentication */
 	if (pAd->CommonCfg.bWirelessEvent)
-		RTMPSendWirelessEvent(pAd, IW_DEAUTH_EVENT_FLAG, pAd->MacTab.Content[BSSID_WCID].Addr, BSS0, 0);
+		RTMPSendWirelessEvent(pAd, IW_DEAUTH_EVENT_FLAG,
+				      pAd->MacTab.Content[BSSID_WCID].Addr,
+				      BSS0, 0);
 }
 
 /*
@@ -388,15 +374,13 @@ VOID MlmeDeauthReqAction(
 
     ==========================================================================
  */
-VOID AuthTimeoutAction(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem)
+void AuthTimeoutAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-    USHORT Status;
-    DBGPRINT(RT_DEBUG_TRACE, ("AUTH - AuthTimeoutAction\n"));
-    pAd->Mlme.AuthMachine.CurrState = AUTH_REQ_IDLE;
-    Status = MLME_REJ_TIMEOUT;
-    MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_AUTH_CONF, 2, &Status);
+	u16 Status;
+	DBGPRINT(RT_DEBUG_TRACE, ("AUTH - AuthTimeoutAction\n"));
+	pAd->Mlme.AuthMachine.CurrState = AUTH_REQ_IDLE;
+	Status = MLME_REJ_TIMEOUT;
+	MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_AUTH_CONF, 2, &Status);
 }
 
 /*
@@ -407,15 +391,15 @@ VOID AuthTimeoutAction(
 
     ==========================================================================
  */
-VOID InvalidStateWhenAuth(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem)
+void InvalidStateWhenAuth(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-    USHORT Status;
-    DBGPRINT(RT_DEBUG_TRACE, ("AUTH - InvalidStateWhenAuth (state=%ld), reset AUTH state machine\n", pAd->Mlme.AuthMachine.CurrState));
-    pAd->Mlme.AuthMachine.CurrState = AUTH_REQ_IDLE;
-    Status = MLME_STATE_MACHINE_REJECT;
-    MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_AUTH_CONF, 2, &Status);
+	u16 Status;
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("AUTH - InvalidStateWhenAuth (state=%ld), reset AUTH state machine\n",
+		  pAd->Mlme.AuthMachine.CurrState));
+	pAd->Mlme.AuthMachine.CurrState = AUTH_REQ_IDLE;
+	Status = MLME_STATE_MACHINE_REJECT;
+	MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_AUTH_CONF, 2, &Status);
 }
 
 /*
@@ -430,31 +414,104 @@ VOID InvalidStateWhenAuth(
 
     ==========================================================================
  */
-VOID Cls2errAction(
-    IN PRTMP_ADAPTER pAd,
-    IN PUCHAR pAddr)
+void Cls2errAction(struct rt_rtmp_adapter *pAd, u8 *pAddr)
 {
-    HEADER_802_11 DeauthHdr;
-    PUCHAR        pOutBuffer = NULL;
-    NDIS_STATUS   NStatus;
-    ULONG         FrameLen = 0;
-    USHORT        Reason = REASON_CLS2ERR;
-
-    NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);  //Get an unused nonpaged memory
-    if (NStatus != NDIS_STATUS_SUCCESS)
-        return;
-
-    DBGPRINT(RT_DEBUG_TRACE, ("AUTH - Class 2 error, Send DEAUTH frame...\n"));
-    MgtMacHeaderInit(pAd, &DeauthHdr, SUBTYPE_DEAUTH, 0, pAddr, pAd->MlmeAux.Bssid);
-    MakeOutgoingFrame(pOutBuffer,           &FrameLen,
-                      sizeof(HEADER_802_11),&DeauthHdr,
-                      2,                    &Reason,
-                      END_OF_ARGS);
-    MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
+	struct rt_header_802_11 DeauthHdr;
+	u8 *pOutBuffer = NULL;
+	int NStatus;
+	unsigned long FrameLen = 0;
+	u16 Reason = REASON_CLS2ERR;
+
+	NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);	/*Get an unused nonpaged memory */
+	if (NStatus != NDIS_STATUS_SUCCESS)
+		return;
+
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("AUTH - Class 2 error, Send DEAUTH frame...\n"));
+	MgtMacHeaderInit(pAd, &DeauthHdr, SUBTYPE_DEAUTH, 0, pAddr,
+			 pAd->MlmeAux.Bssid);
+	MakeOutgoingFrame(pOutBuffer, &FrameLen, sizeof(struct rt_header_802_11),
+			  &DeauthHdr, 2, &Reason, END_OF_ARGS);
+	MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
 	MlmeFreeMemory(pAd, pOutBuffer);
 
-    pAd->StaCfg.DeauthReason = Reason;
-    COPY_MAC_ADDR(pAd->StaCfg.DeauthSta, pAddr);
+	pAd->StaCfg.DeauthReason = Reason;
+	COPY_MAC_ADDR(pAd->StaCfg.DeauthSta, pAddr);
 }
 
+BOOLEAN AUTH_ReqSend(struct rt_rtmp_adapter *pAd,
+		     struct rt_mlme_queue_elem *pElem,
+		     struct rt_ralink_timer *pAuthTimer,
+		     char *pSMName,
+		     u16 SeqNo,
+		     u8 *pNewElement, unsigned long ElementLen)
+{
+	u16 Alg, Seq, Status;
+	u8 Addr[6];
+	unsigned long Timeout;
+	struct rt_header_802_11 AuthHdr;
+	BOOLEAN TimerCancelled;
+	int NStatus;
+	u8 *pOutBuffer = NULL;
+	unsigned long FrameLen = 0, tmp = 0;
+
+	/* Block all authentication request durning WPA block period */
+	if (pAd->StaCfg.bBlockAssoc == TRUE) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("%s - Block Auth request durning WPA block period!\n",
+			  pSMName));
+		pAd->Mlme.AuthMachine.CurrState = AUTH_REQ_IDLE;
+		Status = MLME_STATE_MACHINE_REJECT;
+		MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_AUTH_CONF, 2,
+			    &Status);
+	} else
+	    if (MlmeAuthReqSanity
+		(pAd, pElem->Msg, pElem->MsgLen, Addr, &Timeout, &Alg)) {
+		/* reset timer */
+		RTMPCancelTimer(pAuthTimer, &TimerCancelled);
+
+		COPY_MAC_ADDR(pAd->MlmeAux.Bssid, Addr);
+		pAd->MlmeAux.Alg = Alg;
+		Seq = SeqNo;
+		Status = MLME_SUCCESS;
+
+		NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);	/*Get an unused nonpaged memory */
+		if (NStatus != NDIS_STATUS_SUCCESS) {
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("%s - MlmeAuthReqAction(Alg:%d) allocate memory failed\n",
+				  pSMName, Alg));
+			pAd->Mlme.AuthMachine.CurrState = AUTH_REQ_IDLE;
+			Status = MLME_FAIL_NO_RESOURCE;
+			MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_AUTH_CONF,
+				    2, &Status);
+			return FALSE;
+		}
+
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("%s - Send AUTH request seq#1 (Alg=%d)...\n", pSMName,
+			  Alg));
+		MgtMacHeaderInit(pAd, &AuthHdr, SUBTYPE_AUTH, 0, Addr,
+				 pAd->MlmeAux.Bssid);
+		MakeOutgoingFrame(pOutBuffer, &FrameLen, sizeof(struct rt_header_802_11),
+				  &AuthHdr, 2, &Alg, 2, &Seq, 2, &Status,
+				  END_OF_ARGS);
+
+		if (pNewElement && ElementLen) {
+			MakeOutgoingFrame(pOutBuffer + FrameLen, &tmp,
+					  ElementLen, pNewElement, END_OF_ARGS);
+			FrameLen += tmp;
+		}
+
+		MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
+		MlmeFreeMemory(pAd, pOutBuffer);
+
+		RTMPSetTimer(pAuthTimer, Timeout);
+		return TRUE;
+	} else {
+		DBGPRINT_ERR(("%s - MlmeAuthReqAction() sanity check failed\n",
+			      pSMName));
+		return FALSE;
+	}
 
+	return TRUE;
+}
diff --git a/drivers/staging/rt2860/sta/auth_rsp.c b/drivers/staging/rt2860/sta/auth_rsp.c
index cc639b1c6c13..5b018b757308 100644
--- a/drivers/staging/rt2860/sta/auth_rsp.c
+++ b/drivers/staging/rt2860/sta/auth_rsp.c
@@ -47,18 +47,21 @@
 
     ==========================================================================
  */
-VOID AuthRspStateMachineInit(
-    IN PRTMP_ADAPTER pAd,
-    IN PSTATE_MACHINE Sm,
-    IN STATE_MACHINE_FUNC Trans[])
+void AuthRspStateMachineInit(struct rt_rtmp_adapter *pAd,
+			     struct rt_state_machine *Sm,
+			     IN STATE_MACHINE_FUNC Trans[])
 {
-    StateMachineInit(Sm, Trans, MAX_AUTH_RSP_STATE, MAX_AUTH_RSP_MSG, (STATE_MACHINE_FUNC)Drop, AUTH_RSP_IDLE, AUTH_RSP_MACHINE_BASE);
+	StateMachineInit(Sm, Trans, MAX_AUTH_RSP_STATE, MAX_AUTH_RSP_MSG,
+			 (STATE_MACHINE_FUNC) Drop, AUTH_RSP_IDLE,
+			 AUTH_RSP_MACHINE_BASE);
 
-    // column 1
-    StateMachineSetAction(Sm, AUTH_RSP_IDLE, MT2_PEER_DEAUTH, (STATE_MACHINE_FUNC)PeerDeauthAction);
+	/* column 1 */
+	StateMachineSetAction(Sm, AUTH_RSP_IDLE, MT2_PEER_DEAUTH,
+			      (STATE_MACHINE_FUNC) PeerDeauthAction);
 
-    // column 2
-    StateMachineSetAction(Sm, AUTH_RSP_WAIT_CHAL, MT2_PEER_DEAUTH, (STATE_MACHINE_FUNC)PeerDeauthAction);
+	/* column 2 */
+	StateMachineSetAction(Sm, AUTH_RSP_WAIT_CHAL, MT2_PEER_DEAUTH,
+			      (STATE_MACHINE_FUNC) PeerDeauthAction);
 
 }
 
@@ -70,39 +73,32 @@ VOID AuthRspStateMachineInit(
 
     ==========================================================================
 */
-VOID PeerAuthSimpleRspGenAndSend(
-    IN PRTMP_ADAPTER pAd,
-    IN PHEADER_802_11 pHdr80211,
-    IN USHORT Alg,
-    IN USHORT Seq,
-    IN USHORT Reason,
-    IN USHORT Status)
+void PeerAuthSimpleRspGenAndSend(struct rt_rtmp_adapter *pAd,
+				 struct rt_header_802_11 * pHdr80211,
+				 u16 Alg,
+				 u16 Seq,
+				 u16 Reason, u16 Status)
 {
-    HEADER_802_11     AuthHdr;
-    ULONG             FrameLen = 0;
-    PUCHAR            pOutBuffer = NULL;
-    NDIS_STATUS       NStatus;
-
-    if (Reason != MLME_SUCCESS)
-    {
-        DBGPRINT(RT_DEBUG_TRACE, ("Peer AUTH fail...\n"));
-        return;
-    }
-
-	//Get an unused nonpaged memory
-    NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);
-    if (NStatus != NDIS_STATUS_SUCCESS)
-        return;
-
-    DBGPRINT(RT_DEBUG_TRACE, ("Send AUTH response (seq#2)...\n"));
-    MgtMacHeaderInit(pAd, &AuthHdr, SUBTYPE_AUTH, 0, pHdr80211->Addr2, pAd->MlmeAux.Bssid);
-    MakeOutgoingFrame(pOutBuffer,               &FrameLen,
-                      sizeof(HEADER_802_11),    &AuthHdr,
-                      2,                        &Alg,
-                      2,                        &Seq,
-                      2,                        &Reason,
-                      END_OF_ARGS);
-    MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
+	struct rt_header_802_11 AuthHdr;
+	unsigned long FrameLen = 0;
+	u8 *pOutBuffer = NULL;
+	int NStatus;
+
+	if (Reason != MLME_SUCCESS) {
+		DBGPRINT(RT_DEBUG_TRACE, ("Peer AUTH fail...\n"));
+		return;
+	}
+	/*Get an unused nonpaged memory */
+	NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);
+	if (NStatus != NDIS_STATUS_SUCCESS)
+		return;
+
+	DBGPRINT(RT_DEBUG_TRACE, ("Send AUTH response (seq#2)...\n"));
+	MgtMacHeaderInit(pAd, &AuthHdr, SUBTYPE_AUTH, 0, pHdr80211->Addr2,
+			 pAd->MlmeAux.Bssid);
+	MakeOutgoingFrame(pOutBuffer, &FrameLen, sizeof(struct rt_header_802_11),
+			  &AuthHdr, 2, &Alg, 2, &Seq, 2, &Reason, END_OF_ARGS);
+	MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
 	MlmeFreeMemory(pAd, pOutBuffer);
 }
 
@@ -114,35 +110,33 @@ VOID PeerAuthSimpleRspGenAndSend(
 
     ==========================================================================
 */
-VOID PeerDeauthAction(
-    IN PRTMP_ADAPTER pAd,
-    IN PMLME_QUEUE_ELEM Elem)
+void PeerDeauthAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-    UCHAR       Addr2[MAC_ADDR_LEN];
-    USHORT      Reason;
-
-    if (PeerDeauthSanity(pAd, Elem->Msg, Elem->MsgLen, Addr2, &Reason))
-    {
-        if (INFRA_ON(pAd) && MAC_ADDR_EQUAL(Addr2, pAd->CommonCfg.Bssid))
-        {
-            DBGPRINT(RT_DEBUG_TRACE,("AUTH_RSP - receive DE-AUTH from our AP (Reason=%d)\n", Reason));
-
-            {
-                union iwreq_data    wrqu;
-                memset(wrqu.ap_addr.sa_data, 0, MAC_ADDR_LEN);
-                wireless_send_event(pAd->net_dev, SIOCGIWAP, &wrqu, NULL);
-            }
-
-			// send wireless event - for deauthentication
+	u8 Addr2[MAC_ADDR_LEN];
+	u16 Reason;
+
+	if (PeerDeauthSanity(pAd, Elem->Msg, Elem->MsgLen, Addr2, &Reason)) {
+		if (INFRA_ON(pAd)
+		    && MAC_ADDR_EQUAL(Addr2, pAd->CommonCfg.Bssid)
+		    ) {
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("AUTH_RSP - receive DE-AUTH from our AP (Reason=%d)\n",
+				  Reason));
+
+			RtmpOSWrielessEventSend(pAd, SIOCGIWAP, -1, NULL, NULL,
+						0);
+
+			/* send wireless event - for deauthentication */
 			if (pAd->CommonCfg.bWirelessEvent)
-				RTMPSendWirelessEvent(pAd, IW_DEAUTH_EVENT_FLAG, pAd->MacTab.Content[BSSID_WCID].Addr, BSS0, 0);
-
-            LinkDown(pAd, TRUE);
-        }
-    }
-    else
-    {
-        DBGPRINT(RT_DEBUG_TRACE,("AUTH_RSP - PeerDeauthAction() sanity check fail\n"));
-    }
+				RTMPSendWirelessEvent(pAd, IW_DEAUTH_EVENT_FLAG,
+						      pAd->MacTab.
+						      Content[BSSID_WCID].Addr,
+						      BSS0, 0);
+
+			LinkDown(pAd, TRUE);
+		}
+	} else {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("AUTH_RSP - PeerDeauthAction() sanity check fail\n"));
+	}
 }
-
diff --git a/drivers/staging/rt2860/sta/connect.c b/drivers/staging/rt2860/sta/connect.c
index 7bc75ab971f9..17e59ba3d807 100644
--- a/drivers/staging/rt2860/sta/connect.c
+++ b/drivers/staging/rt2860/sta/connect.c
@@ -36,34 +36,39 @@
 */
 #include "../rt_config.h"
 
-UCHAR	CipherSuiteWpaNoneTkip[] = {
-		0x00, 0x50, 0xf2, 0x01,	// oui
-		0x01, 0x00,				// Version
-		0x00, 0x50, 0xf2, 0x02,	// Multicast
-		0x01, 0x00,				// Number of unicast
-		0x00, 0x50, 0xf2, 0x02,	// unicast
-		0x01, 0x00,				// number of authentication method
-		0x00, 0x50, 0xf2, 0x00	// authentication
-		};
-UCHAR	CipherSuiteWpaNoneTkipLen = (sizeof(CipherSuiteWpaNoneTkip) / sizeof(UCHAR));
-
-UCHAR	CipherSuiteWpaNoneAes[] = {
-		0x00, 0x50, 0xf2, 0x01,	// oui
-		0x01, 0x00,				// Version
-		0x00, 0x50, 0xf2, 0x04,	// Multicast
-		0x01, 0x00,				// Number of unicast
-		0x00, 0x50, 0xf2, 0x04,	// unicast
-		0x01, 0x00,				// number of authentication method
-		0x00, 0x50, 0xf2, 0x00	// authentication
-		};
-UCHAR	CipherSuiteWpaNoneAesLen = (sizeof(CipherSuiteWpaNoneAes) / sizeof(UCHAR));
-
-// The following MACRO is called after 1. starting an new IBSS, 2. succesfully JOIN an IBSS,
-// or 3. succesfully ASSOCIATE to a BSS, 4. successfully RE_ASSOCIATE to a BSS
-// All settings successfuly negotiated furing MLME state machines become final settings
-// and are copied to pAd->StaActive
+u8 CipherSuiteWpaNoneTkip[] = {
+	0x00, 0x50, 0xf2, 0x01,	/* oui */
+	0x01, 0x00,		/* Version */
+	0x00, 0x50, 0xf2, 0x02,	/* Multicast */
+	0x01, 0x00,		/* Number of unicast */
+	0x00, 0x50, 0xf2, 0x02,	/* unicast */
+	0x01, 0x00,		/* number of authentication method */
+	0x00, 0x50, 0xf2, 0x00	/* authentication */
+};
+
+u8 CipherSuiteWpaNoneTkipLen =
+    (sizeof(CipherSuiteWpaNoneTkip) / sizeof(u8));
+
+u8 CipherSuiteWpaNoneAes[] = {
+	0x00, 0x50, 0xf2, 0x01,	/* oui */
+	0x01, 0x00,		/* Version */
+	0x00, 0x50, 0xf2, 0x04,	/* Multicast */
+	0x01, 0x00,		/* Number of unicast */
+	0x00, 0x50, 0xf2, 0x04,	/* unicast */
+	0x01, 0x00,		/* number of authentication method */
+	0x00, 0x50, 0xf2, 0x00	/* authentication */
+};
+
+u8 CipherSuiteWpaNoneAesLen =
+    (sizeof(CipherSuiteWpaNoneAes) / sizeof(u8));
+
+/* The following MACRO is called after 1. starting an new IBSS, 2. succesfully JOIN an IBSS, */
+/* or 3. succesfully ASSOCIATE to a BSS, 4. successfully RE_ASSOCIATE to a BSS */
+/* All settings successfuly negotiated furing MLME state machines become final settings */
+/* and are copied to pAd->StaActive */
 #define COPY_SETTINGS_FROM_MLME_AUX_TO_ACTIVE_CFG(_pAd)                                 \
 {                                                                                       \
+	NdisZeroMemory((_pAd)->CommonCfg.Ssid, MAX_LEN_OF_SSID);							\
 	(_pAd)->CommonCfg.SsidLen = (_pAd)->MlmeAux.SsidLen;                                \
 	NdisMoveMemory((_pAd)->CommonCfg.Ssid, (_pAd)->MlmeAux.Ssid, (_pAd)->MlmeAux.SsidLen); \
 	COPY_MAC_ADDR((_pAd)->CommonCfg.Bssid, (_pAd)->MlmeAux.Bssid);                      \
@@ -79,9 +84,9 @@ UCHAR	CipherSuiteWpaNoneAesLen = (sizeof(CipherSuiteWpaNoneAes) / sizeof(UCHAR))
 	NdisMoveMemory((_pAd)->StaActive.SupRate, (_pAd)->MlmeAux.SupRate, (_pAd)->MlmeAux.SupRateLen);\
 	(_pAd)->StaActive.ExtRateLen = (_pAd)->MlmeAux.ExtRateLen;                          \
 	NdisMoveMemory((_pAd)->StaActive.ExtRate, (_pAd)->MlmeAux.ExtRate, (_pAd)->MlmeAux.ExtRateLen);\
-	NdisMoveMemory(&(_pAd)->CommonCfg.APEdcaParm, &(_pAd)->MlmeAux.APEdcaParm, sizeof(EDCA_PARM));\
-	NdisMoveMemory(&(_pAd)->CommonCfg.APQosCapability, &(_pAd)->MlmeAux.APQosCapability, sizeof(QOS_CAPABILITY_PARM));\
-	NdisMoveMemory(&(_pAd)->CommonCfg.APQbssLoad, &(_pAd)->MlmeAux.APQbssLoad, sizeof(QBSS_LOAD_PARM));\
+	NdisMoveMemory(&(_pAd)->CommonCfg.APEdcaParm, &(_pAd)->MlmeAux.APEdcaParm, sizeof(struct rt_edca_parm));\
+	NdisMoveMemory(&(_pAd)->CommonCfg.APQosCapability, &(_pAd)->MlmeAux.APQosCapability, sizeof(struct rt_qos_capability_parm));\
+	NdisMoveMemory(&(_pAd)->CommonCfg.APQbssLoad, &(_pAd)->MlmeAux.APQbssLoad, sizeof(struct rt_qbss_load_parm));\
 	COPY_MAC_ADDR((_pAd)->MacTab.Content[BSSID_WCID].Addr, (_pAd)->MlmeAux.Bssid);      \
 	(_pAd)->MacTab.Content[BSSID_WCID].Aid = (_pAd)->MlmeAux.Aid;                       \
 	(_pAd)->MacTab.Content[BSSID_WCID].PairwiseKey.CipherAlg = (_pAd)->StaCfg.PairCipher;\
@@ -97,13 +102,11 @@ UCHAR	CipherSuiteWpaNoneAesLen = (sizeof(CipherSuiteWpaNoneAes) / sizeof(UCHAR))
 
 	==========================================================================
 */
-VOID MlmeCntlInit(
-	IN PRTMP_ADAPTER pAd,
-	IN STATE_MACHINE *S,
-	OUT STATE_MACHINE_FUNC Trans[])
+void MlmeCntlInit(struct rt_rtmp_adapter *pAd,
+		  struct rt_state_machine *S, OUT STATE_MACHINE_FUNC Trans[])
 {
-	// Control state machine differs from other state machines, the interface
-	// follows the standard interface
+	/* Control state machine differs from other state machines, the interface */
+	/* follows the standard interface */
 	pAd->Mlme.CntlMachine.CurrState = CNTL_IDLE;
 }
 
@@ -115,118 +118,108 @@ VOID MlmeCntlInit(
 
 	==========================================================================
 */
-VOID MlmeCntlMachinePerformAction(
-	IN PRTMP_ADAPTER pAd,
-	IN STATE_MACHINE *S,
-	IN MLME_QUEUE_ELEM *Elem)
+void MlmeCntlMachinePerformAction(struct rt_rtmp_adapter *pAd,
+				  struct rt_state_machine *S,
+				  struct rt_mlme_queue_elem *Elem)
 {
-	switch(pAd->Mlme.CntlMachine.CurrState)
-	{
-		case CNTL_IDLE:
-			{
-				CntlIdleProc(pAd, Elem);
-			}
-			break;
-		case CNTL_WAIT_DISASSOC:
-			CntlWaitDisassocProc(pAd, Elem);
-			break;
-		case CNTL_WAIT_JOIN:
-			CntlWaitJoinProc(pAd, Elem);
-			break;
-
-		// CNTL_WAIT_REASSOC is the only state in CNTL machine that does
-		// not triggered directly or indirectly by "RTMPSetInformation(OID_xxx)".
-		// Therefore not protected by NDIS's "only one outstanding OID request"
-		// rule. Which means NDIS may SET OID in the middle of ROAMing attempts.
-		// Current approach is to block new SET request at RTMPSetInformation()
-		// when CntlMachine.CurrState is not CNTL_IDLE
-		case CNTL_WAIT_REASSOC:
-			CntlWaitReassocProc(pAd, Elem);
-			break;
-
-		case CNTL_WAIT_START:
-			CntlWaitStartProc(pAd, Elem);
-			break;
-		case CNTL_WAIT_AUTH:
-			CntlWaitAuthProc(pAd, Elem);
-			break;
-		case CNTL_WAIT_AUTH2:
-			CntlWaitAuthProc2(pAd, Elem);
-			break;
-		case CNTL_WAIT_ASSOC:
-			CntlWaitAssocProc(pAd, Elem);
-			break;
+	switch (pAd->Mlme.CntlMachine.CurrState) {
+	case CNTL_IDLE:
+		CntlIdleProc(pAd, Elem);
+		break;
+	case CNTL_WAIT_DISASSOC:
+		CntlWaitDisassocProc(pAd, Elem);
+		break;
+	case CNTL_WAIT_JOIN:
+		CntlWaitJoinProc(pAd, Elem);
+		break;
+
+		/* CNTL_WAIT_REASSOC is the only state in CNTL machine that does */
+		/* not triggered directly or indirectly by "RTMPSetInformation(OID_xxx)". */
+		/* Therefore not protected by NDIS's "only one outstanding OID request" */
+		/* rule. Which means NDIS may SET OID in the middle of ROAMing attempts. */
+		/* Current approach is to block new SET request at RTMPSetInformation() */
+		/* when CntlMachine.CurrState is not CNTL_IDLE */
+	case CNTL_WAIT_REASSOC:
+		CntlWaitReassocProc(pAd, Elem);
+		break;
+
+	case CNTL_WAIT_START:
+		CntlWaitStartProc(pAd, Elem);
+		break;
+	case CNTL_WAIT_AUTH:
+		CntlWaitAuthProc(pAd, Elem);
+		break;
+	case CNTL_WAIT_AUTH2:
+		CntlWaitAuthProc2(pAd, Elem);
+		break;
+	case CNTL_WAIT_ASSOC:
+		CntlWaitAssocProc(pAd, Elem);
+		break;
+
+	case CNTL_WAIT_OID_LIST_SCAN:
+		if (Elem->MsgType == MT2_SCAN_CONF) {
+			/* Resume TxRing after SCANING complete. We hope the out-of-service time */
+			/* won't be too long to let upper layer time-out the waiting frames */
+			RTMPResumeMsduTransmission(pAd);
 
-		case CNTL_WAIT_OID_LIST_SCAN:
-			if(Elem->MsgType == MT2_SCAN_CONF)
-			{
-				// Resume TxRing after SCANING complete. We hope the out-of-service time
-				// won't be too long to let upper layer time-out the waiting frames
-				RTMPResumeMsduTransmission(pAd);
-				if (pAd->StaCfg.CCXReqType != MSRN_TYPE_UNUSED)
-				{
-					// Cisco scan request is finished, prepare beacon report
-					MlmeEnqueue(pAd, AIRONET_STATE_MACHINE, MT2_AIRONET_SCAN_DONE, 0, NULL);
-				}
-				pAd->Mlme.CntlMachine.CurrState = CNTL_IDLE;
+			pAd->Mlme.CntlMachine.CurrState = CNTL_IDLE;
 
-                //
-				// Set LED status to previous status.
-				//
-				if (pAd->bLedOnScanning)
-				{
-					pAd->bLedOnScanning = FALSE;
-					RTMPSetLED(pAd, pAd->LedStatus);
-				}
+			/* */
+			/* Set LED status to previous status. */
+			/* */
+			if (pAd->bLedOnScanning) {
+				pAd->bLedOnScanning = FALSE;
+				RTMPSetLED(pAd, pAd->LedStatus);
 			}
-			break;
+		}
+		break;
 
-		case CNTL_WAIT_OID_DISASSOC:
-			if (Elem->MsgType == MT2_DISASSOC_CONF)
-			{
-				LinkDown(pAd, FALSE);
-				pAd->Mlme.CntlMachine.CurrState = CNTL_IDLE;
-			}
-			break;
-#ifdef RT2870
-		//
-		// This state is for that we want to connect to an AP but
-		// it didn't find on BSS List table. So we need to scan the air first,
-		// after that we can try to connect to the desired AP if available.
-		//
-		case CNTL_WAIT_SCAN_FOR_CONNECT:
-			if(Elem->MsgType == MT2_SCAN_CONF)
-			{
-				// Resume TxRing after SCANING complete. We hope the out-of-service time
-				// won't be too long to let upper layer time-out the waiting frames
-				RTMPResumeMsduTransmission(pAd);
+	case CNTL_WAIT_OID_DISASSOC:
+		if (Elem->MsgType == MT2_DISASSOC_CONF) {
+			LinkDown(pAd, FALSE);
+			pAd->Mlme.CntlMachine.CurrState = CNTL_IDLE;
+		}
+		break;
+#ifdef RTMP_MAC_USB
+		/* */
+		/* This state is for that we want to connect to an AP but */
+		/* it didn't find on BSS List table. So we need to scan the air first, */
+		/* after that we can try to connect to the desired AP if available. */
+		/* */
+	case CNTL_WAIT_SCAN_FOR_CONNECT:
+		if (Elem->MsgType == MT2_SCAN_CONF) {
+			/* Resume TxRing after SCANING complete. We hope the out-of-service time */
+			/* won't be too long to let upper layer time-out the waiting frames */
+			RTMPResumeMsduTransmission(pAd);
 #ifdef CCX_SUPPORT
-				if (pAd->StaCfg.CCXReqType != MSRN_TYPE_UNUSED)
-				{
-					// Cisco scan request is finished, prepare beacon report
-					MlmeEnqueue(pAd, AIRONET_STATE_MACHINE, MT2_AIRONET_SCAN_DONE, 0, NULL);
-				}
-#endif // CCX_SUPPORT //
-				pAd->Mlme.CntlMachine.CurrState = CNTL_IDLE;
+			if (pAd->StaCfg.CCXReqType != MSRN_TYPE_UNUSED) {
+				/* Cisco scan request is finished, prepare beacon report */
+				MlmeEnqueue(pAd, AIRONET_STATE_MACHINE,
+					    MT2_AIRONET_SCAN_DONE, 0, NULL);
+			}
+#endif /* CCX_SUPPORT // */
+			pAd->Mlme.CntlMachine.CurrState = CNTL_IDLE;
 
-				//
-				// Check if we can connect to.
-				//
-				BssTableSsidSort(pAd, &pAd->MlmeAux.SsidBssTab, pAd->MlmeAux.AutoReconnectSsid, pAd->MlmeAux.AutoReconnectSsidLen);
-				if (pAd->MlmeAux.SsidBssTab.BssNr > 0)
-				{
-					MlmeAutoReconnectLastSSID(pAd);
-				}
+			/* */
+			/* Check if we can connect to. */
+			/* */
+			BssTableSsidSort(pAd, &pAd->MlmeAux.SsidBssTab,
+					 (char *) pAd->MlmeAux.
+					 AutoReconnectSsid,
+					 pAd->MlmeAux.AutoReconnectSsidLen);
+			if (pAd->MlmeAux.SsidBssTab.BssNr > 0) {
+				MlmeAutoReconnectLastSSID(pAd);
 			}
-			break;
-#endif // RT2870 //
-		default:
-			DBGPRINT_ERR(("!ERROR! CNTL - Illegal message type(=%ld)", Elem->MsgType));
-			break;
+		}
+		break;
+#endif /* RTMP_MAC_USB // */
+	default:
+		DBGPRINT_ERR(("ERROR! CNTL - Illegal message type(=%ld)",
+			      Elem->MsgType));
+		break;
 	}
 }
 
-
 /*
 	==========================================================================
 	Description:
@@ -235,92 +228,95 @@ VOID MlmeCntlMachinePerformAction(
 
 	==========================================================================
 */
-VOID CntlIdleProc(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
+void CntlIdleProc(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-	MLME_DISASSOC_REQ_STRUCT   DisassocReq;
+	struct rt_mlme_disassoc_req DisassocReq;
 
 	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RADIO_OFF))
 		return;
 
-	switch(Elem->MsgType)
-	{
-		case OID_802_11_SSID:
-			CntlOidSsidProc(pAd, Elem);
-			break;
+	switch (Elem->MsgType) {
+	case OID_802_11_SSID:
+		CntlOidSsidProc(pAd, Elem);
+		break;
 
-		case OID_802_11_BSSID:
-			CntlOidRTBssidProc(pAd,Elem);
-			break;
+	case OID_802_11_BSSID:
+		CntlOidRTBssidProc(pAd, Elem);
+		break;
 
-		case OID_802_11_BSSID_LIST_SCAN:
-			CntlOidScanProc(pAd,Elem);
-			break;
+	case OID_802_11_BSSID_LIST_SCAN:
+		CntlOidScanProc(pAd, Elem);
+		break;
 
-		case OID_802_11_DISASSOCIATE:
-			DisassocParmFill(pAd, &DisassocReq, pAd->CommonCfg.Bssid, REASON_DISASSOC_STA_LEAVING);
-			MlmeEnqueue(pAd, ASSOC_STATE_MACHINE, MT2_MLME_DISASSOC_REQ, sizeof(MLME_DISASSOC_REQ_STRUCT), &DisassocReq);
-			pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_OID_DISASSOC;
-
-            if (pAd->StaCfg.WpaSupplicantUP != WPA_SUPPLICANT_ENABLE_WITH_WEB_UI)
-            {
-    			// Set the AutoReconnectSsid to prevent it reconnect to old SSID
-    			// Since calling this indicate user don't want to connect to that SSID anymore.
-    			pAd->MlmeAux.AutoReconnectSsidLen= 32;
-    			NdisZeroMemory(pAd->MlmeAux.AutoReconnectSsid, pAd->MlmeAux.AutoReconnectSsidLen);
-            }
-			break;
+	case OID_802_11_DISASSOCIATE:
+		DisassocParmFill(pAd, &DisassocReq, pAd->CommonCfg.Bssid,
+				 REASON_DISASSOC_STA_LEAVING);
+		MlmeEnqueue(pAd, ASSOC_STATE_MACHINE, MT2_MLME_DISASSOC_REQ,
+			    sizeof(struct rt_mlme_disassoc_req), &DisassocReq);
+		pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_OID_DISASSOC;
+
+		if (pAd->StaCfg.WpaSupplicantUP !=
+		    WPA_SUPPLICANT_ENABLE_WITH_WEB_UI) {
+			/* Set the AutoReconnectSsid to prevent it reconnect to old SSID */
+			/* Since calling this indicate user don't want to connect to that SSID anymore. */
+			pAd->MlmeAux.AutoReconnectSsidLen = 32;
+			NdisZeroMemory(pAd->MlmeAux.AutoReconnectSsid,
+				       pAd->MlmeAux.AutoReconnectSsidLen);
+		}
+		break;
 
-		case MT2_MLME_ROAMING_REQ:
-			CntlMlmeRoamingProc(pAd, Elem);
-			break;
+	case MT2_MLME_ROAMING_REQ:
+		CntlMlmeRoamingProc(pAd, Elem);
+		break;
 
-        case OID_802_11_MIC_FAILURE_REPORT_FRAME:
-            WpaMicFailureReportFrame(pAd, Elem);
-            break;
+	case OID_802_11_MIC_FAILURE_REPORT_FRAME:
+		WpaMicFailureReportFrame(pAd, Elem);
+		break;
 
-		default:
-			DBGPRINT(RT_DEBUG_TRACE, ("CNTL - Illegal message in CntlIdleProc(MsgType=%ld)\n",Elem->MsgType));
-			break;
+	default:
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("CNTL - Illegal message in CntlIdleProc(MsgType=%ld)\n",
+			  Elem->MsgType));
+		break;
 	}
 }
 
-VOID CntlOidScanProc(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
+void CntlOidScanProc(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-	MLME_SCAN_REQ_STRUCT       ScanReq;
-	ULONG                      BssIdx = BSS_NOT_FOUND;
-	BSS_ENTRY                  CurrBss;
-
-	// record current BSS if network is connected.
-	// 2003-2-13 do not include current IBSS if this is the only STA in this IBSS.
-	if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED))
-	{
-		BssIdx = BssSsidTableSearch(&pAd->ScanTab, pAd->CommonCfg.Bssid, pAd->CommonCfg.Ssid, pAd->CommonCfg.SsidLen, pAd->CommonCfg.Channel);
-		if (BssIdx != BSS_NOT_FOUND)
-		{
-			NdisMoveMemory(&CurrBss, &pAd->ScanTab.BssEntry[BssIdx], sizeof(BSS_ENTRY));
+	struct rt_mlme_scan_req ScanReq;
+	unsigned long BssIdx = BSS_NOT_FOUND;
+	struct rt_bss_entry CurrBss;
+
+	/* record current BSS if network is connected. */
+	/* 2003-2-13 do not include current IBSS if this is the only STA in this IBSS. */
+	if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED)) {
+		BssIdx =
+		    BssSsidTableSearch(&pAd->ScanTab, pAd->CommonCfg.Bssid,
+				       (u8 *)pAd->CommonCfg.Ssid,
+				       pAd->CommonCfg.SsidLen,
+				       pAd->CommonCfg.Channel);
+		if (BssIdx != BSS_NOT_FOUND) {
+			NdisMoveMemory(&CurrBss, &pAd->ScanTab.BssEntry[BssIdx],
+				       sizeof(struct rt_bss_entry));
 		}
 	}
-
-	// clean up previous SCAN result, add current BSS back to table if any
+	/* clean up previous SCAN result, add current BSS back to table if any */
 	BssTableInit(&pAd->ScanTab);
-	if (BssIdx != BSS_NOT_FOUND)
-	{
-		// DDK Note: If the NIC is associated with a particular BSSID and SSID
-		//    that are not contained in the list of BSSIDs generated by this scan, the
-		//    BSSID description of the currently associated BSSID and SSID should be
-		//    appended to the list of BSSIDs in the NIC's database.
-		// To ensure this, we append this BSS as the first entry in SCAN result
-		NdisMoveMemory(&pAd->ScanTab.BssEntry[0], &CurrBss, sizeof(BSS_ENTRY));
+	if (BssIdx != BSS_NOT_FOUND) {
+		/* DDK Note: If the NIC is associated with a particular BSSID and SSID */
+		/*    that are not contained in the list of BSSIDs generated by this scan, the */
+		/*    BSSID description of the currently associated BSSID and SSID should be */
+		/*    appended to the list of BSSIDs in the NIC's database. */
+		/* To ensure this, we append this BSS as the first entry in SCAN result */
+		NdisMoveMemory(&pAd->ScanTab.BssEntry[0], &CurrBss,
+			       sizeof(struct rt_bss_entry));
 		pAd->ScanTab.BssNr = 1;
 	}
 
-	ScanParmFill(pAd, &ScanReq, "", 0, BSS_ANY, SCAN_ACTIVE);
+	ScanParmFill(pAd, &ScanReq, (char *)Elem->Msg, Elem->MsgLen, BSS_ANY,
+		     SCAN_ACTIVE);
 	MlmeEnqueue(pAd, SYNC_STATE_MACHINE, MT2_MLME_SCAN_REQ,
-		sizeof(MLME_SCAN_REQ_STRUCT), &ScanReq);
+		    sizeof(struct rt_mlme_scan_req), &ScanReq);
 	pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_OID_LIST_SCAN;
 }
 
@@ -333,171 +329,174 @@ VOID CntlOidScanProc(
 
 	==========================================================================
 */
-VOID CntlOidSsidProc(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM * Elem)
+void CntlOidSsidProc(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-	PNDIS_802_11_SSID          pOidSsid = (NDIS_802_11_SSID *)Elem->Msg;
-	MLME_DISASSOC_REQ_STRUCT   DisassocReq;
-	ULONG					   Now;
-
-#ifdef RT2860
-	// BBP and RF are not accessible in PS mode, we has to wake them up first
-	if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE))
-		AsicForceWakeup(pAd, RTMP_HALT);
-#endif
+	struct rt_ndis_802_11_ssid * pOidSsid = (struct rt_ndis_802_11_ssid *) Elem->Msg;
+	struct rt_mlme_disassoc_req DisassocReq;
+	unsigned long Now;
 
-	// Step 1. record the desired user settings to MlmeAux
+	/* Step 1. record the desired user settings to MlmeAux */
 	NdisZeroMemory(pAd->MlmeAux.Ssid, MAX_LEN_OF_SSID);
 	NdisMoveMemory(pAd->MlmeAux.Ssid, pOidSsid->Ssid, pOidSsid->SsidLength);
-	pAd->MlmeAux.SsidLen = (UCHAR)pOidSsid->SsidLength;
+	pAd->MlmeAux.SsidLen = (u8)pOidSsid->SsidLength;
 	NdisZeroMemory(pAd->MlmeAux.Bssid, MAC_ADDR_LEN);
 	pAd->MlmeAux.BssType = pAd->StaCfg.BssType;
 
+	pAd->StaCfg.bAutoConnectByBssid = FALSE;
 
-	//
-	// Update Reconnect Ssid, that user desired to connect.
-	//
+	/* */
+	/* Update Reconnect Ssid, that user desired to connect. */
+	/* */
 	NdisZeroMemory(pAd->MlmeAux.AutoReconnectSsid, MAX_LEN_OF_SSID);
-	NdisMoveMemory(pAd->MlmeAux.AutoReconnectSsid, pAd->MlmeAux.Ssid, pAd->MlmeAux.SsidLen);
+	NdisMoveMemory(pAd->MlmeAux.AutoReconnectSsid, pAd->MlmeAux.Ssid,
+		       pAd->MlmeAux.SsidLen);
 	pAd->MlmeAux.AutoReconnectSsidLen = pAd->MlmeAux.SsidLen;
 
-	// step 2. find all matching BSS in the lastest SCAN result (inBssTab)
-	//    & log them into MlmeAux.SsidBssTab for later-on iteration. Sort by RSSI order
-	BssTableSsidSort(pAd, &pAd->MlmeAux.SsidBssTab, pAd->MlmeAux.Ssid, pAd->MlmeAux.SsidLen);
+	/* step 2. find all matching BSS in the lastest SCAN result (inBssTab) */
+	/*    & log them into MlmeAux.SsidBssTab for later-on iteration. Sort by RSSI order */
+	BssTableSsidSort(pAd, &pAd->MlmeAux.SsidBssTab,
+			 (char *)pAd->MlmeAux.Ssid, pAd->MlmeAux.SsidLen);
 
-	DBGPRINT(RT_DEBUG_TRACE, ("CntlOidSsidProc():CNTL - %d BSS of %d BSS match the desire (%d)SSID - %s\n",
-			pAd->MlmeAux.SsidBssTab.BssNr, pAd->ScanTab.BssNr, pAd->MlmeAux.SsidLen, pAd->MlmeAux.Ssid));
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("CntlOidSsidProc():CNTL - %d BSS of %d BSS match the desire (%d)SSID - %s\n",
+		  pAd->MlmeAux.SsidBssTab.BssNr, pAd->ScanTab.BssNr,
+		  pAd->MlmeAux.SsidLen, pAd->MlmeAux.Ssid));
 	NdisGetSystemUpTime(&Now);
 
 	if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED) &&
-		(pAd->CommonCfg.SsidLen == pAd->MlmeAux.SsidBssTab.BssEntry[0].SsidLen) &&
-		NdisEqualMemory(pAd->CommonCfg.Ssid, pAd->MlmeAux.SsidBssTab.BssEntry[0].Ssid, pAd->CommonCfg.SsidLen) &&
-		MAC_ADDR_EQUAL(pAd->CommonCfg.Bssid, pAd->MlmeAux.SsidBssTab.BssEntry[0].Bssid))
-	{
-		// Case 1. already connected with an AP who has the desired SSID
-		//         with highest RSSI
-
-		// Add checking Mode "LEAP" for CCX 1.0
+	    (pAd->CommonCfg.SsidLen ==
+	     pAd->MlmeAux.SsidBssTab.BssEntry[0].SsidLen)
+	    && NdisEqualMemory(pAd->CommonCfg.Ssid,
+			       pAd->MlmeAux.SsidBssTab.BssEntry[0].Ssid,
+			       pAd->CommonCfg.SsidLen)
+	    && MAC_ADDR_EQUAL(pAd->CommonCfg.Bssid,
+			      pAd->MlmeAux.SsidBssTab.BssEntry[0].Bssid)) {
+		/* Case 1. already connected with an AP who has the desired SSID */
+		/*         with highest RSSI */
+
+		/* Add checking Mode "LEAP" for CCX 1.0 */
 		if (((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA) ||
-			 (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPAPSK) ||
-			 (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2) ||
-			 (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK)
-			 ) &&
-			(pAd->StaCfg.PortSecured == WPA_802_1X_PORT_NOT_SECURED))
-		{
-			// case 1.1 For WPA, WPA-PSK, if the 1x port is not secured, we have to redo
-			//          connection process
-			DBGPRINT(RT_DEBUG_TRACE, ("CntlOidSsidProc():CNTL - disassociate with current AP...\n"));
-			DisassocParmFill(pAd, &DisassocReq, pAd->CommonCfg.Bssid, REASON_DISASSOC_STA_LEAVING);
-			MlmeEnqueue(pAd, ASSOC_STATE_MACHINE, MT2_MLME_DISASSOC_REQ,
-						sizeof(MLME_DISASSOC_REQ_STRUCT), &DisassocReq);
+		     (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPAPSK) ||
+		     (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2) ||
+		     (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK)
+		    ) &&
+		    (pAd->StaCfg.PortSecured == WPA_802_1X_PORT_NOT_SECURED)) {
+			/* case 1.1 For WPA, WPA-PSK, if the 1x port is not secured, we have to redo */
+			/*          connection process */
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("CntlOidSsidProc():CNTL - disassociate with current AP...\n"));
+			DisassocParmFill(pAd, &DisassocReq,
+					 pAd->CommonCfg.Bssid,
+					 REASON_DISASSOC_STA_LEAVING);
+			MlmeEnqueue(pAd, ASSOC_STATE_MACHINE,
+				    MT2_MLME_DISASSOC_REQ,
+				    sizeof(struct rt_mlme_disassoc_req),
+				    &DisassocReq);
 			pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_DISASSOC;
-		}
-		else if (pAd->bConfigChanged == TRUE)
-		{
-			// case 1.2 Important Config has changed, we have to reconnect to the same AP
-			DBGPRINT(RT_DEBUG_TRACE, ("CntlOidSsidProc():CNTL - disassociate with current AP Because config changed...\n"));
-			DisassocParmFill(pAd, &DisassocReq, pAd->CommonCfg.Bssid, REASON_DISASSOC_STA_LEAVING);
-			MlmeEnqueue(pAd, ASSOC_STATE_MACHINE, MT2_MLME_DISASSOC_REQ,
-						sizeof(MLME_DISASSOC_REQ_STRUCT), &DisassocReq);
+		} else if (pAd->bConfigChanged == TRUE) {
+			/* case 1.2 Important Config has changed, we have to reconnect to the same AP */
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("CntlOidSsidProc():CNTL - disassociate with current AP Because config changed...\n"));
+			DisassocParmFill(pAd, &DisassocReq,
+					 pAd->CommonCfg.Bssid,
+					 REASON_DISASSOC_STA_LEAVING);
+			MlmeEnqueue(pAd, ASSOC_STATE_MACHINE,
+				    MT2_MLME_DISASSOC_REQ,
+				    sizeof(struct rt_mlme_disassoc_req),
+				    &DisassocReq);
 			pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_DISASSOC;
-		}
-		else
-		{
-			// case 1.3. already connected to the SSID with highest RSSI.
-			DBGPRINT(RT_DEBUG_TRACE, ("CntlOidSsidProc():CNTL - already with this BSSID. ignore this SET_SSID request\n"));
-			//
-			// (HCT 12.1) 1c_wlan_mediaevents required
-			// media connect events are indicated when associating with the same AP
-			//
-			if (INFRA_ON(pAd))
-			{
-				//
-				// Since MediaState already is NdisMediaStateConnected
-				// We just indicate the connect event again to meet the WHQL required.
-				//
-				pAd->IndicateMediaState = NdisMediaStateConnected;
+		} else {
+			/* case 1.3. already connected to the SSID with highest RSSI. */
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("CntlOidSsidProc():CNTL - already with this BSSID. ignore this SET_SSID request\n"));
+			/* */
+			/* (HCT 12.1) 1c_wlan_mediaevents required */
+			/* media connect events are indicated when associating with the same AP */
+			/* */
+			if (INFRA_ON(pAd)) {
+				/* */
+				/* Since MediaState already is NdisMediaStateConnected */
+				/* We just indicate the connect event again to meet the WHQL required. */
+				/* */
+				pAd->IndicateMediaState =
+				    NdisMediaStateConnected;
 				RTMP_IndicateMediaState(pAd);
-                pAd->ExtraInfo = GENERAL_LINK_UP;   // Update extra information to link is up
+				pAd->ExtraInfo = GENERAL_LINK_UP;	/* Update extra information to link is up */
 			}
 
 			pAd->Mlme.CntlMachine.CurrState = CNTL_IDLE;
-
-            {
-                union iwreq_data    wrqu;
-
-                memset(wrqu.ap_addr.sa_data, 0, MAC_ADDR_LEN);
-                memcpy(wrqu.ap_addr.sa_data, pAd->MlmeAux.Bssid, MAC_ADDR_LEN);
-                wireless_send_event(pAd->net_dev, SIOCGIWAP, &wrqu, NULL);
-
-            }
+			RtmpOSWrielessEventSend(pAd, SIOCGIWAP, -1,
+						&pAd->MlmeAux.Bssid[0], NULL,
+						0);
 		}
-	}
-	else if (INFRA_ON(pAd))
-	{
-		//
-		// For RT61
-		// [88888] OID_802_11_SSID should have returned NDTEST_WEP_AP2(Returned: )
-		// RT61 may lost SSID, and not connect to NDTEST_WEP_AP2 and will connect to NDTEST_WEP_AP2 by Autoreconnect
-		// But media status is connected, so the SSID not report correctly.
-		//
-		if (!SSID_EQUAL(pAd->CommonCfg.Ssid, pAd->CommonCfg.SsidLen, pAd->MlmeAux.Ssid, pAd->MlmeAux.SsidLen))
-		{
-			//
-			// Different SSID means not Roaming case, so we let LinkDown() to Indicate a disconnect event.
-			//
+	} else if (INFRA_ON(pAd)) {
+		/* */
+		/* For RT61 */
+		/* [88888] OID_802_11_SSID should have returned NDTEST_WEP_AP2(Returned: ) */
+		/* RT61 may lost SSID, and not connect to NDTEST_WEP_AP2 and will connect to NDTEST_WEP_AP2 by Autoreconnect */
+		/* But media status is connected, so the SSID not report correctly. */
+		/* */
+		if (!SSID_EQUAL
+		    (pAd->CommonCfg.Ssid, pAd->CommonCfg.SsidLen,
+		     pAd->MlmeAux.Ssid, pAd->MlmeAux.SsidLen)) {
+			/* */
+			/* Different SSID means not Roaming case, so we let LinkDown() to Indicate a disconnect event. */
+			/* */
 			pAd->MlmeAux.CurrReqIsFromNdis = TRUE;
 		}
-		// case 2. active INFRA association existent
-		//    roaming is done within miniport driver, nothing to do with configuration
-		//    utility. so upon a new SET(OID_802_11_SSID) is received, we just
-		//    disassociate with the current associated AP,
-		//    then perform a new association with this new SSID, no matter the
-		//    new/old SSID are the same or not.
-		DBGPRINT(RT_DEBUG_TRACE, ("CntlOidSsidProc():CNTL - disassociate with current AP...\n"));
-		DisassocParmFill(pAd, &DisassocReq, pAd->CommonCfg.Bssid, REASON_DISASSOC_STA_LEAVING);
+		/* case 2. active INFRA association existent */
+		/*    roaming is done within miniport driver, nothing to do with configuration */
+		/*    utility. so upon a new SET(OID_802_11_SSID) is received, we just */
+		/*    disassociate with the current associated AP, */
+		/*    then perform a new association with this new SSID, no matter the */
+		/*    new/old SSID are the same or not. */
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("CntlOidSsidProc():CNTL - disassociate with current AP...\n"));
+		DisassocParmFill(pAd, &DisassocReq, pAd->CommonCfg.Bssid,
+				 REASON_DISASSOC_STA_LEAVING);
 		MlmeEnqueue(pAd, ASSOC_STATE_MACHINE, MT2_MLME_DISASSOC_REQ,
-					sizeof(MLME_DISASSOC_REQ_STRUCT), &DisassocReq);
+			    sizeof(struct rt_mlme_disassoc_req), &DisassocReq);
 		pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_DISASSOC;
-	}
-	else
-	{
-		if (ADHOC_ON(pAd))
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("CntlOidSsidProc():CNTL - drop current ADHOC\n"));
+	} else {
+		if (ADHOC_ON(pAd)) {
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("CntlOidSsidProc():CNTL - drop current ADHOC\n"));
 			LinkDown(pAd, FALSE);
-			OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED);
+			OPSTATUS_CLEAR_FLAG(pAd,
+					    fOP_STATUS_MEDIA_STATE_CONNECTED);
 			pAd->IndicateMediaState = NdisMediaStateDisconnected;
 			RTMP_IndicateMediaState(pAd);
-            pAd->ExtraInfo = GENERAL_LINK_DOWN;
-			DBGPRINT(RT_DEBUG_TRACE, ("CntlOidSsidProc():NDIS_STATUS_MEDIA_DISCONNECT Event C!\n"));
+			pAd->ExtraInfo = GENERAL_LINK_DOWN;
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("CntlOidSsidProc():NDIS_STATUS_MEDIA_DISCONNECT Event C!\n"));
 		}
 
 		if ((pAd->MlmeAux.SsidBssTab.BssNr == 0) &&
-			(pAd->StaCfg.bAutoReconnect == TRUE) &&
-			(pAd->MlmeAux.BssType == BSS_INFRA) &&
-			(MlmeValidateSSID(pAd->MlmeAux.Ssid, pAd->MlmeAux.SsidLen) == TRUE)
-			)
-		{
-			MLME_SCAN_REQ_STRUCT       ScanReq;
-
-			DBGPRINT(RT_DEBUG_TRACE, ("CntlOidSsidProc():CNTL - No matching BSS, start a new scan\n"));
-			ScanParmFill(pAd, &ScanReq, pAd->MlmeAux.Ssid, pAd->MlmeAux.SsidLen, BSS_ANY, SCAN_ACTIVE);
-			MlmeEnqueue(pAd, SYNC_STATE_MACHINE, MT2_MLME_SCAN_REQ, sizeof(MLME_SCAN_REQ_STRUCT), &ScanReq);
-			pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_OID_LIST_SCAN;
-			// Reset Missed scan number
+		    (pAd->StaCfg.bAutoReconnect == TRUE) &&
+		    (pAd->MlmeAux.BssType == BSS_INFRA) &&
+		    (MlmeValidateSSID(pAd->MlmeAux.Ssid, pAd->MlmeAux.SsidLen)
+		     == TRUE)
+		    ) {
+			struct rt_mlme_scan_req ScanReq;
+
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("CntlOidSsidProc():CNTL - No matching BSS, start a new scan\n"));
+			ScanParmFill(pAd, &ScanReq, (char *)pAd->MlmeAux.Ssid,
+				     pAd->MlmeAux.SsidLen, BSS_ANY,
+				     SCAN_ACTIVE);
+			MlmeEnqueue(pAd, SYNC_STATE_MACHINE, MT2_MLME_SCAN_REQ,
+				    sizeof(struct rt_mlme_scan_req), &ScanReq);
+			pAd->Mlme.CntlMachine.CurrState =
+			    CNTL_WAIT_OID_LIST_SCAN;
+			/* Reset Missed scan number */
 			pAd->StaCfg.LastScanTime = Now;
-		}
-		else
-		{
+		} else {
 			pAd->MlmeAux.BssIdx = 0;
 			IterateOnBssTab(pAd);
 		}
 	}
 }
 
-
 /*
 	==========================================================================
 	Description:
@@ -506,165 +505,196 @@ VOID CntlOidSsidProc(
 
 	==========================================================================
 */
-VOID CntlOidRTBssidProc(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM * Elem)
+void CntlOidRTBssidProc(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-	ULONG       BssIdx;
-	PUCHAR      pOidBssid = (PUCHAR)Elem->Msg;
-	MLME_DISASSOC_REQ_STRUCT    DisassocReq;
-	MLME_JOIN_REQ_STRUCT        JoinReq;
+	unsigned long BssIdx;
+	u8 *pOidBssid = (u8 *)Elem->Msg;
+	struct rt_mlme_disassoc_req DisassocReq;
+	struct rt_mlme_join_req JoinReq;
 
-	// record user desired settings
+	/* record user desired settings */
 	COPY_MAC_ADDR(pAd->MlmeAux.Bssid, pOidBssid);
 	pAd->MlmeAux.BssType = pAd->StaCfg.BssType;
 
-	//
-	// Update Reconnect Ssid, that user desired to connect.
-	//
-	NdisZeroMemory(pAd->MlmeAux.AutoReconnectSsid, MAX_LEN_OF_SSID);
-	pAd->MlmeAux.AutoReconnectSsidLen = pAd->MlmeAux.SsidLen;
-	NdisMoveMemory(pAd->MlmeAux.AutoReconnectSsid, pAd->MlmeAux.Ssid, pAd->MlmeAux.SsidLen);
-
-	// find the desired BSS in the latest SCAN result table
+	/* find the desired BSS in the latest SCAN result table */
 	BssIdx = BssTableSearch(&pAd->ScanTab, pOidBssid, pAd->MlmeAux.Channel);
-	if (BssIdx == BSS_NOT_FOUND)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("CNTL - BSSID not found. reply NDIS_STATUS_NOT_ACCEPTED\n"));
-		pAd->Mlme.CntlMachine.CurrState = CNTL_IDLE;
+	if (BssIdx == BSS_NOT_FOUND) {
+		struct rt_mlme_scan_req ScanReq;
+
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("CNTL - BSSID not found. reply NDIS_STATUS_NOT_ACCEPTED\n"));
+		/*pAd->Mlme.CntlMachine.CurrState = CNTL_IDLE; */
+
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("CNTL - BSSID not found. start a new scan\n"));
+		ScanParmFill(pAd, &ScanReq, (char *)pAd->MlmeAux.Ssid,
+			     pAd->MlmeAux.SsidLen, BSS_ANY, SCAN_ACTIVE);
+		MlmeEnqueue(pAd, SYNC_STATE_MACHINE, MT2_MLME_SCAN_REQ,
+			    sizeof(struct rt_mlme_scan_req), &ScanReq);
+		pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_OID_LIST_SCAN;
+		/* Reset Missed scan number */
+		NdisGetSystemUpTime(&pAd->StaCfg.LastScanTime);
 		return;
 	}
-
-	// copy the matched BSS entry from ScanTab to MlmeAux.SsidBssTab. Why?
-	// Because we need this entry to become the JOIN target in later on SYNC state machine
+	/* */
+	/* Update Reconnect Ssid, that user desired to connect. */
+	/* */
+	NdisZeroMemory(pAd->MlmeAux.AutoReconnectSsid, MAX_LEN_OF_SSID);
+	pAd->MlmeAux.AutoReconnectSsidLen =
+	    pAd->ScanTab.BssEntry[BssIdx].SsidLen;
+	NdisMoveMemory(pAd->MlmeAux.AutoReconnectSsid,
+		       pAd->ScanTab.BssEntry[BssIdx].Ssid,
+		       pAd->ScanTab.BssEntry[BssIdx].SsidLen);
+
+	/* copy the matched BSS entry from ScanTab to MlmeAux.SsidBssTab. Why? */
+	/* Because we need this entry to become the JOIN target in later on SYNC state machine */
 	pAd->MlmeAux.BssIdx = 0;
 	pAd->MlmeAux.SsidBssTab.BssNr = 1;
-	NdisMoveMemory(&pAd->MlmeAux.SsidBssTab.BssEntry[0], &pAd->ScanTab.BssEntry[BssIdx], sizeof(BSS_ENTRY));
-
-	// 2002-11-26 skip the following checking. i.e. if user wants to re-connect to same AP
-	//   we just follow normal procedure. The reason of user doing this may because he/she changed
-	//   AP to another channel, but we still received BEACON from it thus don't claim Link Down.
-	//   Since user knows he's changed AP channel, he'll re-connect again. By skipping the following
-	//   checking, we'll disassociate then re-do normal association with this AP at the new channel.
-	// 2003-1-6 Re-enable this feature based on microsoft requirement which prefer not to re-do
-	//   connection when setting the same BSSID.
-	if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED) &&
-		MAC_ADDR_EQUAL(pAd->CommonCfg.Bssid, pOidBssid))
-	{
-		// already connected to the same BSSID, go back to idle state directly
-		DBGPRINT(RT_DEBUG_TRACE, ("CNTL - already in this BSSID. ignore this SET_BSSID request\n"));
-		pAd->Mlme.CntlMachine.CurrState = CNTL_IDLE;
-
-            {
-                union iwreq_data    wrqu;
-
-                memset(wrqu.ap_addr.sa_data, 0, MAC_ADDR_LEN);
-                memcpy(wrqu.ap_addr.sa_data, pAd->MlmeAux.Bssid, MAC_ADDR_LEN);
-                wireless_send_event(pAd->net_dev, SIOCGIWAP, &wrqu, NULL);
-
-            }
-	}
-	else
-	{
-		if (INFRA_ON(pAd))
-		{
-			// disassoc from current AP first
-			DBGPRINT(RT_DEBUG_TRACE, ("CNTL - disassociate with current AP ...\n"));
-			DisassocParmFill(pAd, &DisassocReq, pAd->CommonCfg.Bssid, REASON_DISASSOC_STA_LEAVING);
-			MlmeEnqueue(pAd, ASSOC_STATE_MACHINE, MT2_MLME_DISASSOC_REQ,
-						sizeof(MLME_DISASSOC_REQ_STRUCT), &DisassocReq);
+	NdisMoveMemory(&pAd->MlmeAux.SsidBssTab.BssEntry[0],
+		       &pAd->ScanTab.BssEntry[BssIdx], sizeof(struct rt_bss_entry));
+
+	/* Add SSID into MlmeAux for site surey joining hidden SSID */
+	pAd->MlmeAux.SsidLen = pAd->ScanTab.BssEntry[BssIdx].SsidLen;
+	NdisMoveMemory(pAd->MlmeAux.Ssid, pAd->ScanTab.BssEntry[BssIdx].Ssid,
+		       pAd->MlmeAux.SsidLen);
+
+	{
+		if (INFRA_ON(pAd)) {
+			/* disassoc from current AP first */
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("CNTL - disassociate with current AP ...\n"));
+			DisassocParmFill(pAd, &DisassocReq,
+					 pAd->CommonCfg.Bssid,
+					 REASON_DISASSOC_STA_LEAVING);
+			MlmeEnqueue(pAd, ASSOC_STATE_MACHINE,
+				    MT2_MLME_DISASSOC_REQ,
+				    sizeof(struct rt_mlme_disassoc_req),
+				    &DisassocReq);
 
 			pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_DISASSOC;
-		}
-		else
-		{
-			if (ADHOC_ON(pAd))
-			{
-				DBGPRINT(RT_DEBUG_TRACE, ("CNTL - drop current ADHOC\n"));
+		} else {
+			if (ADHOC_ON(pAd)) {
+				DBGPRINT(RT_DEBUG_TRACE,
+					 ("CNTL - drop current ADHOC\n"));
 				LinkDown(pAd, FALSE);
-				OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED);
-				pAd->IndicateMediaState = NdisMediaStateDisconnected;
+				OPSTATUS_CLEAR_FLAG(pAd,
+						    fOP_STATUS_MEDIA_STATE_CONNECTED);
+				pAd->IndicateMediaState =
+				    NdisMediaStateDisconnected;
 				RTMP_IndicateMediaState(pAd);
-                pAd->ExtraInfo = GENERAL_LINK_DOWN;
-				DBGPRINT(RT_DEBUG_TRACE, ("NDIS_STATUS_MEDIA_DISCONNECT Event C!\n"));
+				pAd->ExtraInfo = GENERAL_LINK_DOWN;
+				DBGPRINT(RT_DEBUG_TRACE,
+					 ("NDIS_STATUS_MEDIA_DISCONNECT Event C!\n"));
 			}
-
-			// Change the wepstatus to original wepstatus
-			pAd->StaCfg.WepStatus   = pAd->StaCfg.OrigWepStatus;
-			pAd->StaCfg.PairCipher  = pAd->StaCfg.OrigWepStatus;
+			/* Change the wepstatus to original wepstatus */
+			pAd->StaCfg.WepStatus = pAd->StaCfg.OrigWepStatus;
+			pAd->StaCfg.PairCipher = pAd->StaCfg.OrigWepStatus;
 			pAd->StaCfg.GroupCipher = pAd->StaCfg.OrigWepStatus;
 
-			// Check cipher suite, AP must have more secured cipher than station setting
-			// Set the Pairwise and Group cipher to match the intended AP setting
-			// We can only connect to AP with less secured cipher setting
-			if ((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA) || (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPAPSK))
-			{
-				pAd->StaCfg.GroupCipher = pAd->ScanTab.BssEntry[BssIdx].WPA.GroupCipher;
-
-				if (pAd->StaCfg.WepStatus == pAd->ScanTab.BssEntry[BssIdx].WPA.PairCipher)
-					pAd->StaCfg.PairCipher = pAd->ScanTab.BssEntry[BssIdx].WPA.PairCipher;
-				else if (pAd->ScanTab.BssEntry[BssIdx].WPA.PairCipherAux != Ndis802_11WEPDisabled)
-					pAd->StaCfg.PairCipher = pAd->ScanTab.BssEntry[BssIdx].WPA.PairCipherAux;
-				else	// There is no PairCipher Aux, downgrade our capability to TKIP
-					pAd->StaCfg.PairCipher = Ndis802_11Encryption2Enabled;
+			/* Check cipher suite, AP must have more secured cipher than station setting */
+			/* Set the Pairwise and Group cipher to match the intended AP setting */
+			/* We can only connect to AP with less secured cipher setting */
+			if ((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA)
+			    || (pAd->StaCfg.AuthMode ==
+				Ndis802_11AuthModeWPAPSK)) {
+				pAd->StaCfg.GroupCipher =
+				    pAd->ScanTab.BssEntry[BssIdx].WPA.
+				    GroupCipher;
+
+				if (pAd->StaCfg.WepStatus ==
+				    pAd->ScanTab.BssEntry[BssIdx].WPA.
+				    PairCipher)
+					pAd->StaCfg.PairCipher =
+					    pAd->ScanTab.BssEntry[BssIdx].WPA.
+					    PairCipher;
+				else if (pAd->ScanTab.BssEntry[BssIdx].WPA.
+					 PairCipherAux != Ndis802_11WEPDisabled)
+					pAd->StaCfg.PairCipher =
+					    pAd->ScanTab.BssEntry[BssIdx].WPA.
+					    PairCipherAux;
+				else	/* There is no PairCipher Aux, downgrade our capability to TKIP */
+					pAd->StaCfg.PairCipher =
+					    Ndis802_11Encryption2Enabled;
+			} else
+			    if ((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2)
+				|| (pAd->StaCfg.AuthMode ==
+				    Ndis802_11AuthModeWPA2PSK)) {
+				pAd->StaCfg.GroupCipher =
+				    pAd->ScanTab.BssEntry[BssIdx].WPA2.
+				    GroupCipher;
+
+				if (pAd->StaCfg.WepStatus ==
+				    pAd->ScanTab.BssEntry[BssIdx].WPA2.
+				    PairCipher)
+					pAd->StaCfg.PairCipher =
+					    pAd->ScanTab.BssEntry[BssIdx].WPA2.
+					    PairCipher;
+				else if (pAd->ScanTab.BssEntry[BssIdx].WPA2.
+					 PairCipherAux != Ndis802_11WEPDisabled)
+					pAd->StaCfg.PairCipher =
+					    pAd->ScanTab.BssEntry[BssIdx].WPA2.
+					    PairCipherAux;
+				else	/* There is no PairCipher Aux, downgrade our capability to TKIP */
+					pAd->StaCfg.PairCipher =
+					    Ndis802_11Encryption2Enabled;
+
+				/* RSN capability */
+				pAd->StaCfg.RsnCapability =
+				    pAd->ScanTab.BssEntry[BssIdx].WPA2.
+				    RsnCapability;
 			}
-			else if ((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2) || (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK))
-			{
-				pAd->StaCfg.GroupCipher = pAd->ScanTab.BssEntry[BssIdx].WPA2.GroupCipher;
-
-				if (pAd->StaCfg.WepStatus == pAd->ScanTab.BssEntry[BssIdx].WPA2.PairCipher)
-					pAd->StaCfg.PairCipher = pAd->ScanTab.BssEntry[BssIdx].WPA2.PairCipher;
-				else if (pAd->ScanTab.BssEntry[BssIdx].WPA2.PairCipherAux != Ndis802_11WEPDisabled)
-					pAd->StaCfg.PairCipher = pAd->ScanTab.BssEntry[BssIdx].WPA2.PairCipherAux;
-				else	// There is no PairCipher Aux, downgrade our capability to TKIP
-					pAd->StaCfg.PairCipher = Ndis802_11Encryption2Enabled;
-
-				// RSN capability
-				pAd->StaCfg.RsnCapability = pAd->ScanTab.BssEntry[BssIdx].WPA2.RsnCapability;
-			}
-
-			// Set Mix cipher flag
-			pAd->StaCfg.bMixCipher = (pAd->StaCfg.PairCipher == pAd->StaCfg.GroupCipher) ? FALSE : TRUE;
-			if (pAd->StaCfg.bMixCipher == TRUE)
-			{
-				// If mix cipher, re-build RSNIE
-				RTMPMakeRSNIE(pAd, pAd->StaCfg.AuthMode, pAd->StaCfg.WepStatus, 0);
-			}
-			// No active association, join the BSS immediately
-			DBGPRINT(RT_DEBUG_TRACE, ("CNTL - joining %02x:%02x:%02x:%02x:%02x:%02x ...\n",
-				pOidBssid[0],pOidBssid[1],pOidBssid[2],pOidBssid[3],pOidBssid[4],pOidBssid[5]));
+			/* Set Mix cipher flag */
+			pAd->StaCfg.bMixCipher =
+			    (pAd->StaCfg.PairCipher ==
+			     pAd->StaCfg.GroupCipher) ? FALSE : TRUE;
+			/*if (pAd->StaCfg.bMixCipher == TRUE)
+			   {
+			   // If mix cipher, re-build RSNIE
+			   RTMPMakeRSNIE(pAd, pAd->StaCfg.AuthMode, pAd->StaCfg.WepStatus, 0);
+			   } */
+			/* No active association, join the BSS immediately */
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("CNTL - joining %02x:%02x:%02x:%02x:%02x:%02x ...\n",
+				  pOidBssid[0], pOidBssid[1], pOidBssid[2],
+				  pOidBssid[3], pOidBssid[4], pOidBssid[5]));
 
 			JoinParmFill(pAd, &JoinReq, pAd->MlmeAux.BssIdx);
-			MlmeEnqueue(pAd, SYNC_STATE_MACHINE, MT2_MLME_JOIN_REQ, sizeof(MLME_JOIN_REQ_STRUCT), &JoinReq);
+			MlmeEnqueue(pAd, SYNC_STATE_MACHINE, MT2_MLME_JOIN_REQ,
+				    sizeof(struct rt_mlme_join_req), &JoinReq);
 
 			pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_JOIN;
 		}
 	}
 }
 
-// Roaming is the only external request triggering CNTL state machine
-// despite of other "SET OID" operation. All "SET OID" related oerations
-// happen in sequence, because no other SET OID will be sent to this device
-// until the the previous SET operation is complete (successful o failed).
-// So, how do we quarantee this ROAMING request won't corrupt other "SET OID"?
-// or been corrupted by other "SET OID"?
-//
-// IRQL = DISPATCH_LEVEL
-VOID CntlMlmeRoamingProc(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
+/* Roaming is the only external request triggering CNTL state machine */
+/* despite of other "SET OID" operation. All "SET OID" related oerations */
+/* happen in sequence, because no other SET OID will be sent to this device */
+/* until the the previous SET operation is complete (successful o failed). */
+/* So, how do we quarantee this ROAMING request won't corrupt other "SET OID"? */
+/* or been corrupted by other "SET OID"? */
+/* */
+/* IRQL = DISPATCH_LEVEL */
+void CntlMlmeRoamingProc(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-	// TODO:
-	// AP in different channel may show lower RSSI than actual value??
-	// should we add a weighting factor to compensate it?
-	DBGPRINT(RT_DEBUG_TRACE,("CNTL - Roaming in MlmeAux.RoamTab...\n"));
+	u8 BBPValue = 0;
 
-	NdisMoveMemory(&pAd->MlmeAux.SsidBssTab, &pAd->MlmeAux.RoamTab, sizeof(pAd->MlmeAux.RoamTab));
-	pAd->MlmeAux.SsidBssTab.BssNr = pAd->MlmeAux.RoamTab.BssNr;
+	DBGPRINT(RT_DEBUG_TRACE, ("CNTL - Roaming in MlmeAux.RoamTab...\n"));
 
-	BssTableSortByRssi(&pAd->MlmeAux.SsidBssTab);
-	pAd->MlmeAux.BssIdx = 0;
-	IterateOnBssTab(pAd);
+	{
+		/*Let BBP register at 20MHz to do (fast) roaming. */
+		RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R4, &BBPValue);
+		BBPValue &= (~0x18);
+		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R4, BBPValue);
+
+		NdisMoveMemory(&pAd->MlmeAux.SsidBssTab, &pAd->MlmeAux.RoamTab,
+			       sizeof(pAd->MlmeAux.RoamTab));
+		pAd->MlmeAux.SsidBssTab.BssNr = pAd->MlmeAux.RoamTab.BssNr;
+
+		BssTableSortByRssi(&pAd->MlmeAux.SsidBssTab);
+		pAd->MlmeAux.BssIdx = 0;
+		IterateOnBssTab(pAd);
+	}
 }
 
 /*
@@ -675,34 +705,35 @@ VOID CntlMlmeRoamingProc(
 
 	==========================================================================
 */
-VOID CntlWaitDisassocProc(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
+void CntlWaitDisassocProc(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-	MLME_START_REQ_STRUCT     StartReq;
+	struct rt_mlme_start_req StartReq;
 
-	if (Elem->MsgType == MT2_DISASSOC_CONF)
-	{
+	if (Elem->MsgType == MT2_DISASSOC_CONF) {
 		DBGPRINT(RT_DEBUG_TRACE, ("CNTL - Dis-associate successful\n"));
 
-	    if (pAd->CommonCfg.bWirelessEvent)
-		{
-			RTMPSendWirelessEvent(pAd, IW_DISASSOC_EVENT_FLAG, pAd->MacTab.Content[BSSID_WCID].Addr, BSS0, 0);
+		if (pAd->CommonCfg.bWirelessEvent) {
+			RTMPSendWirelessEvent(pAd, IW_DISASSOC_EVENT_FLAG,
+					      pAd->MacTab.Content[BSSID_WCID].
+					      Addr, BSS0, 0);
 		}
 
 		LinkDown(pAd, FALSE);
 
-		// case 1. no matching BSS, and user wants ADHOC, so we just start a new one
-		if ((pAd->MlmeAux.SsidBssTab.BssNr==0) && (pAd->StaCfg.BssType == BSS_ADHOC))
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("CNTL - No matching BSS, start a new ADHOC (Ssid=%s)...\n",pAd->MlmeAux.Ssid));
-			StartParmFill(pAd, &StartReq, pAd->MlmeAux.Ssid, pAd->MlmeAux.SsidLen);
-			MlmeEnqueue(pAd, SYNC_STATE_MACHINE, MT2_MLME_START_REQ, sizeof(MLME_START_REQ_STRUCT), &StartReq);
+		/* case 1. no matching BSS, and user wants ADHOC, so we just start a new one */
+		if ((pAd->MlmeAux.SsidBssTab.BssNr == 0)
+		    && (pAd->StaCfg.BssType == BSS_ADHOC)) {
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("CNTL - No matching BSS, start a new ADHOC (Ssid=%s)...\n",
+				  pAd->MlmeAux.Ssid));
+			StartParmFill(pAd, &StartReq, (char *)pAd->MlmeAux.Ssid,
+				      pAd->MlmeAux.SsidLen);
+			MlmeEnqueue(pAd, SYNC_STATE_MACHINE, MT2_MLME_START_REQ,
+				    sizeof(struct rt_mlme_start_req), &StartReq);
 			pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_START;
 		}
-		// case 2. try each matched BSS
-		else
-		{
+		/* case 2. try each matched BSS */
+		else {
 			pAd->MlmeAux.BssIdx = 0;
 
 			IterateOnBssTab(pAd);
@@ -718,74 +749,81 @@ VOID CntlWaitDisassocProc(
 
 	==========================================================================
 */
-VOID CntlWaitJoinProc(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
+void CntlWaitJoinProc(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-	USHORT                      Reason;
-	MLME_AUTH_REQ_STRUCT        AuthReq;
-
-	if (Elem->MsgType == MT2_JOIN_CONF)
-	{
-		NdisMoveMemory(&Reason, Elem->Msg, sizeof(USHORT));
-		if (Reason == MLME_SUCCESS)
-		{
-			// 1. joined an IBSS, we are pretty much done here
-			if (pAd->MlmeAux.BssType == BSS_ADHOC)
-			{
-			    //
-				// 5G bands rules of Japan:
-				// Ad hoc must be disabled in W53(ch52,56,60,64) channels.
-				//
-				if ( (pAd->CommonCfg.bIEEE80211H == 1) &&
-                      RadarChannelCheck(pAd, pAd->CommonCfg.Channel)
-				   )
-				{
-					pAd->Mlme.CntlMachine.CurrState = CNTL_IDLE;
-					DBGPRINT(RT_DEBUG_TRACE, ("CNTL - Channel=%d, Join adhoc on W53(52,56,60,64) Channels are not accepted\n", pAd->CommonCfg.Channel));
+	u16 Reason;
+	struct rt_mlme_auth_req AuthReq;
+
+	if (Elem->MsgType == MT2_JOIN_CONF) {
+		NdisMoveMemory(&Reason, Elem->Msg, sizeof(u16));
+		if (Reason == MLME_SUCCESS) {
+			/* 1. joined an IBSS, we are pretty much done here */
+			if (pAd->MlmeAux.BssType == BSS_ADHOC) {
+				/* */
+				/* 5G bands rules of Japan: */
+				/* Ad hoc must be disabled in W53(ch52,56,60,64) channels. */
+				/* */
+				if ((pAd->CommonCfg.bIEEE80211H == 1) &&
+				    RadarChannelCheck(pAd,
+						      pAd->CommonCfg.Channel)
+				    ) {
+					pAd->Mlme.CntlMachine.CurrState =
+					    CNTL_IDLE;
+					DBGPRINT(RT_DEBUG_TRACE,
+						 ("CNTL - Channel=%d, Join adhoc on W53(52,56,60,64) Channels are not accepted\n",
+						  pAd->CommonCfg.Channel));
 					return;
 				}
 
 				LinkUp(pAd, BSS_ADHOC);
 				pAd->Mlme.CntlMachine.CurrState = CNTL_IDLE;
-				DBGPRINT(RT_DEBUG_TRACE, ("CNTL - join the IBSS = %02x:%02x:%02x:%02x:%02x:%02x ...\n",
-				pAd->CommonCfg.Bssid[0],pAd->CommonCfg.Bssid[1],pAd->CommonCfg.Bssid[2],
-				pAd->CommonCfg.Bssid[3],pAd->CommonCfg.Bssid[4],pAd->CommonCfg.Bssid[5]));
-
-                pAd->IndicateMediaState = NdisMediaStateConnected;
-                pAd->ExtraInfo = GENERAL_LINK_UP;
+				DBGPRINT(RT_DEBUG_TRACE,
+					 ("CNTL - join the IBSS = %02x:%02x:%02x:%02x:%02x:%02x ...\n",
+					  pAd->CommonCfg.Bssid[0],
+					  pAd->CommonCfg.Bssid[1],
+					  pAd->CommonCfg.Bssid[2],
+					  pAd->CommonCfg.Bssid[3],
+					  pAd->CommonCfg.Bssid[4],
+					  pAd->CommonCfg.Bssid[5]));
+
+				pAd->IndicateMediaState =
+				    NdisMediaStateConnected;
+				pAd->ExtraInfo = GENERAL_LINK_UP;
 			}
-			// 2. joined a new INFRA network, start from authentication
-			else
-			{
+			/* 2. joined a new INFRA network, start from authentication */
+			else {
 				{
-					// either Ndis802_11AuthModeShared or Ndis802_11AuthModeAutoSwitch, try shared key first
-					if ((pAd->StaCfg.AuthMode == Ndis802_11AuthModeShared) ||
-						(pAd->StaCfg.AuthMode == Ndis802_11AuthModeAutoSwitch))
-					{
-						AuthParmFill(pAd, &AuthReq, pAd->MlmeAux.Bssid, Ndis802_11AuthModeShared);
-					}
-					else
-					{
-						AuthParmFill(pAd, &AuthReq, pAd->MlmeAux.Bssid, Ndis802_11AuthModeOpen);
+					/* either Ndis802_11AuthModeShared or Ndis802_11AuthModeAutoSwitch, try shared key first */
+					if ((pAd->StaCfg.AuthMode ==
+					     Ndis802_11AuthModeShared)
+					    || (pAd->StaCfg.AuthMode ==
+						Ndis802_11AuthModeAutoSwitch)) {
+						AuthParmFill(pAd, &AuthReq,
+							     pAd->MlmeAux.Bssid,
+							     AUTH_MODE_KEY);
+					} else {
+						AuthParmFill(pAd, &AuthReq,
+							     pAd->MlmeAux.Bssid,
+							     AUTH_MODE_OPEN);
 					}
+					MlmeEnqueue(pAd, AUTH_STATE_MACHINE,
+						    MT2_MLME_AUTH_REQ,
+						    sizeof
+						    (struct rt_mlme_auth_req),
+						    &AuthReq);
 				}
-				MlmeEnqueue(pAd, AUTH_STATE_MACHINE, MT2_MLME_AUTH_REQ,
-							sizeof(MLME_AUTH_REQ_STRUCT), &AuthReq);
 
-				pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_AUTH;
+				pAd->Mlme.CntlMachine.CurrState =
+				    CNTL_WAIT_AUTH;
 			}
-		}
-		else
-		{
-			// 3. failed, try next BSS
+		} else {
+			/* 3. failed, try next BSS */
 			pAd->MlmeAux.BssIdx++;
 			IterateOnBssTab(pAd);
 		}
 	}
 }
 
-
 /*
 	==========================================================================
 	Description:
@@ -794,74 +832,86 @@ VOID CntlWaitJoinProc(
 
 	==========================================================================
 */
-VOID CntlWaitStartProc(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
+void CntlWaitStartProc(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-	USHORT      Result;
-
-	if (Elem->MsgType == MT2_START_CONF)
-	{
-		NdisMoveMemory(&Result, Elem->Msg, sizeof(USHORT));
-		if (Result == MLME_SUCCESS)
-		{
-		    //
-			// 5G bands rules of Japan:
-			// Ad hoc must be disabled in W53(ch52,56,60,64) channels.
-			//
-			if ( (pAd->CommonCfg.bIEEE80211H == 1) &&
-                  RadarChannelCheck(pAd, pAd->CommonCfg.Channel)
-			   )
-			{
+	u16 Result;
+
+	if (Elem->MsgType == MT2_START_CONF) {
+		NdisMoveMemory(&Result, Elem->Msg, sizeof(u16));
+		if (Result == MLME_SUCCESS) {
+			/* */
+			/* 5G bands rules of Japan: */
+			/* Ad hoc must be disabled in W53(ch52,56,60,64) channels. */
+			/* */
+			if ((pAd->CommonCfg.bIEEE80211H == 1) &&
+			    RadarChannelCheck(pAd, pAd->CommonCfg.Channel)
+			    ) {
 				pAd->Mlme.CntlMachine.CurrState = CNTL_IDLE;
-				DBGPRINT(RT_DEBUG_TRACE, ("CNTL - Channel=%d, Start adhoc on W53(52,56,60,64) Channels are not accepted\n", pAd->CommonCfg.Channel));
+				DBGPRINT(RT_DEBUG_TRACE,
+					 ("CNTL - Channel=%d, Start adhoc on W53(52,56,60,64) Channels are not accepted\n",
+					  pAd->CommonCfg.Channel));
 				return;
 			}
-
-			if (pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED)
-			{
+			NdisZeroMemory(&pAd->StaActive.SupportedPhyInfo.
+				       MCSSet[0], 16);
+			if (pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED) {
 				N_ChannelCheck(pAd);
 				SetCommonHT(pAd);
-				NdisMoveMemory(&pAd->MlmeAux.AddHtInfo, &pAd->CommonCfg.AddHTInfo, sizeof(ADD_HT_INFO_IE));
-				RTMPCheckHt(pAd, BSSID_WCID, &pAd->CommonCfg.HtCapability, &pAd->CommonCfg.AddHTInfo);
-				pAd->StaActive.SupportedPhyInfo.bHtEnable = TRUE;
-				NdisZeroMemory(&pAd->StaActive.SupportedPhyInfo.MCSSet[0], 16);
-				NdisMoveMemory(&pAd->StaActive.SupportedPhyInfo.MCSSet[0], &pAd->CommonCfg.HtCapability.MCSSet[0], 16);
-				COPY_HTSETTINGS_FROM_MLME_AUX_TO_ACTIVE_CFG(pAd);
-
-				if ((pAd->CommonCfg.HtCapability.HtCapInfo.ChannelWidth  == BW_40) &&
-					(pAd->CommonCfg.AddHTInfo.AddHtInfo.ExtChanOffset == EXTCHA_ABOVE))
-				{
-					pAd->MlmeAux.CentralChannel = pAd->CommonCfg.Channel + 2;
-				}
-				else if ((pAd->CommonCfg.HtCapability.HtCapInfo.ChannelWidth  == BW_40) &&
-						 (pAd->CommonCfg.AddHTInfo.AddHtInfo.ExtChanOffset == EXTCHA_BELOW))
-				{
-					pAd->MlmeAux.CentralChannel = pAd->CommonCfg.Channel - 2;
+				NdisMoveMemory(&pAd->MlmeAux.AddHtInfo,
+					       &pAd->CommonCfg.AddHTInfo,
+					       sizeof(struct rt_add_ht_info_ie));
+				RTMPCheckHt(pAd, BSSID_WCID,
+					    &pAd->CommonCfg.HtCapability,
+					    &pAd->CommonCfg.AddHTInfo);
+				pAd->StaActive.SupportedPhyInfo.bHtEnable =
+				    TRUE;
+				NdisMoveMemory(&pAd->StaActive.SupportedPhyInfo.
+					       MCSSet[0],
+					       &pAd->CommonCfg.HtCapability.
+					       MCSSet[0], 16);
+				COPY_HTSETTINGS_FROM_MLME_AUX_TO_ACTIVE_CFG
+				    (pAd);
+
+				if ((pAd->CommonCfg.HtCapability.HtCapInfo.
+				     ChannelWidth == BW_40)
+				    && (pAd->CommonCfg.AddHTInfo.AddHtInfo.
+					ExtChanOffset == EXTCHA_ABOVE)) {
+					pAd->MlmeAux.CentralChannel =
+					    pAd->CommonCfg.Channel + 2;
+				} else
+				    if ((pAd->CommonCfg.HtCapability.HtCapInfo.
+					 ChannelWidth == BW_40)
+					&& (pAd->CommonCfg.AddHTInfo.AddHtInfo.
+					    ExtChanOffset == EXTCHA_BELOW)) {
+					pAd->MlmeAux.CentralChannel =
+					    pAd->CommonCfg.Channel - 2;
 				}
-			}
-			else
-			{
-				pAd->StaActive.SupportedPhyInfo.bHtEnable = FALSE;
+			} else {
+				pAd->StaActive.SupportedPhyInfo.bHtEnable =
+				    FALSE;
 			}
 			LinkUp(pAd, BSS_ADHOC);
 			pAd->Mlme.CntlMachine.CurrState = CNTL_IDLE;
-			// Before send beacon, driver need do radar detection
-			if ((pAd->CommonCfg.Channel > 14 )
-				&& (pAd->CommonCfg.bIEEE80211H == 1)
-				&& RadarChannelCheck(pAd, pAd->CommonCfg.Channel))
-			{
-				pAd->CommonCfg.RadarDetect.RDMode = RD_SILENCE_MODE;
+			/* Before send beacon, driver need do radar detection */
+			if ((pAd->CommonCfg.Channel > 14)
+			    && (pAd->CommonCfg.bIEEE80211H == 1)
+			    && RadarChannelCheck(pAd, pAd->CommonCfg.Channel)) {
+				pAd->CommonCfg.RadarDetect.RDMode =
+				    RD_SILENCE_MODE;
 				pAd->CommonCfg.RadarDetect.RDCount = 0;
 			}
 
-			DBGPRINT(RT_DEBUG_TRACE, ("CNTL - start a new IBSS = %02x:%02x:%02x:%02x:%02x:%02x ...\n",
-				pAd->CommonCfg.Bssid[0],pAd->CommonCfg.Bssid[1],pAd->CommonCfg.Bssid[2],
-				pAd->CommonCfg.Bssid[3],pAd->CommonCfg.Bssid[4],pAd->CommonCfg.Bssid[5]));
-		}
-		else
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("CNTL - Start IBSS fail. BUG!!!!!\n"));
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("CNTL - start a new IBSS = %02x:%02x:%02x:%02x:%02x:%02x ...\n",
+				  pAd->CommonCfg.Bssid[0],
+				  pAd->CommonCfg.Bssid[1],
+				  pAd->CommonCfg.Bssid[2],
+				  pAd->CommonCfg.Bssid[3],
+				  pAd->CommonCfg.Bssid[4],
+				  pAd->CommonCfg.Bssid[5]));
+		} else {
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("CNTL - Start IBSS fail. BUG!\n"));
 			pAd->Mlme.CntlMachine.CurrState = CNTL_IDLE;
 		}
 	}
@@ -875,52 +925,57 @@ VOID CntlWaitStartProc(
 
 	==========================================================================
 */
-VOID CntlWaitAuthProc(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
+void CntlWaitAuthProc(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-	USHORT                       Reason;
-	MLME_ASSOC_REQ_STRUCT        AssocReq;
-	MLME_AUTH_REQ_STRUCT         AuthReq;
+	u16 Reason;
+	struct rt_mlme_assoc_req AssocReq;
+	struct rt_mlme_auth_req AuthReq;
 
-	if (Elem->MsgType == MT2_AUTH_CONF)
-	{
-		NdisMoveMemory(&Reason, Elem->Msg, sizeof(USHORT));
-		if (Reason == MLME_SUCCESS)
-		{
+	if (Elem->MsgType == MT2_AUTH_CONF) {
+		NdisMoveMemory(&Reason, Elem->Msg, sizeof(u16));
+		if (Reason == MLME_SUCCESS) {
 			DBGPRINT(RT_DEBUG_TRACE, ("CNTL - AUTH OK\n"));
-			AssocParmFill(pAd, &AssocReq, pAd->MlmeAux.Bssid, pAd->MlmeAux.CapabilityInfo,
-						  ASSOC_TIMEOUT, pAd->StaCfg.DefaultListenCount);
+			AssocParmFill(pAd, &AssocReq, pAd->MlmeAux.Bssid,
+				      pAd->MlmeAux.CapabilityInfo,
+				      ASSOC_TIMEOUT,
+				      pAd->StaCfg.DefaultListenCount);
 
 			{
-				MlmeEnqueue(pAd, ASSOC_STATE_MACHINE, MT2_MLME_ASSOC_REQ,
-							sizeof(MLME_ASSOC_REQ_STRUCT), &AssocReq);
+				MlmeEnqueue(pAd, ASSOC_STATE_MACHINE,
+					    MT2_MLME_ASSOC_REQ,
+					    sizeof(struct rt_mlme_assoc_req),
+					    &AssocReq);
 
-				pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_ASSOC;
+				pAd->Mlme.CntlMachine.CurrState =
+				    CNTL_WAIT_ASSOC;
 			}
-		}
-		else
-		{
-			// This fail may because of the AP already keep us in its MAC table without
-			// ageing-out. The previous authentication attempt must have let it remove us.
-			// so try Authentication again may help. For D-Link DWL-900AP+ compatibility.
-			DBGPRINT(RT_DEBUG_TRACE, ("CNTL - AUTH FAIL, try again...\n"));
+		} else {
+			/* This fail may because of the AP already keep us in its MAC table without */
+			/* ageing-out. The previous authentication attempt must have let it remove us. */
+			/* so try Authentication again may help. For D-Link DWL-900AP+ compatibility. */
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("CNTL - AUTH FAIL, try again...\n"));
 
 			{
-				if ((pAd->StaCfg.AuthMode == Ndis802_11AuthModeShared) ||
-					(pAd->StaCfg.AuthMode == Ndis802_11AuthModeAutoSwitch))
-				{
-					// either Ndis802_11AuthModeShared or Ndis802_11AuthModeAutoSwitch, try shared key first
-					AuthParmFill(pAd, &AuthReq, pAd->MlmeAux.Bssid, Ndis802_11AuthModeShared);
+				if ((pAd->StaCfg.AuthMode ==
+				     Ndis802_11AuthModeShared)
+				    || (pAd->StaCfg.AuthMode ==
+					Ndis802_11AuthModeAutoSwitch)) {
+					/* either Ndis802_11AuthModeShared or Ndis802_11AuthModeAutoSwitch, try shared key first */
+					AuthParmFill(pAd, &AuthReq,
+						     pAd->MlmeAux.Bssid,
+						     AUTH_MODE_KEY);
+				} else {
+					AuthParmFill(pAd, &AuthReq,
+						     pAd->MlmeAux.Bssid,
+						     AUTH_MODE_OPEN);
 				}
-				else
-				{
-					AuthParmFill(pAd, &AuthReq, pAd->MlmeAux.Bssid, Ndis802_11AuthModeOpen);
-				}
-			}
-			MlmeEnqueue(pAd, AUTH_STATE_MACHINE, MT2_MLME_AUTH_REQ,
-						sizeof(MLME_AUTH_REQ_STRUCT), &AuthReq);
+				MlmeEnqueue(pAd, AUTH_STATE_MACHINE,
+					    MT2_MLME_AUTH_REQ,
+					    sizeof(struct rt_mlme_auth_req),
+					    &AuthReq);
 
+			}
 			pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_AUTH2;
 		}
 	}
@@ -934,44 +989,49 @@ VOID CntlWaitAuthProc(
 
 	==========================================================================
 */
-VOID CntlWaitAuthProc2(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
+void CntlWaitAuthProc2(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-	USHORT                       Reason;
-	MLME_ASSOC_REQ_STRUCT        AssocReq;
-	MLME_AUTH_REQ_STRUCT         AuthReq;
+	u16 Reason;
+	struct rt_mlme_assoc_req AssocReq;
+	struct rt_mlme_auth_req AuthReq;
 
-	if (Elem->MsgType == MT2_AUTH_CONF)
-	{
-		NdisMoveMemory(&Reason, Elem->Msg, sizeof(USHORT));
-		if (Reason == MLME_SUCCESS)
-		{
+	if (Elem->MsgType == MT2_AUTH_CONF) {
+		NdisMoveMemory(&Reason, Elem->Msg, sizeof(u16));
+		if (Reason == MLME_SUCCESS) {
 			DBGPRINT(RT_DEBUG_TRACE, ("CNTL - AUTH OK\n"));
-			AssocParmFill(pAd, &AssocReq, pAd->MlmeAux.Bssid, pAd->MlmeAux.CapabilityInfo,
-						  ASSOC_TIMEOUT, pAd->StaCfg.DefaultListenCount);
-			MlmeEnqueue(pAd, ASSOC_STATE_MACHINE, MT2_MLME_ASSOC_REQ,
-						sizeof(MLME_ASSOC_REQ_STRUCT), &AssocReq);
-
-			pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_ASSOC;
-		}
-		else
-		{
-			if ((pAd->StaCfg.AuthMode == Ndis802_11AuthModeAutoSwitch) &&
-				 (pAd->MlmeAux.Alg == Ndis802_11AuthModeShared))
+			AssocParmFill(pAd, &AssocReq, pAd->MlmeAux.Bssid,
+				      pAd->MlmeAux.CapabilityInfo,
+				      ASSOC_TIMEOUT,
+				      pAd->StaCfg.DefaultListenCount);
 			{
-				DBGPRINT(RT_DEBUG_TRACE, ("CNTL - AUTH FAIL, try OPEN system...\n"));
-				AuthParmFill(pAd, &AuthReq, pAd->MlmeAux.Bssid, Ndis802_11AuthModeOpen);
-				MlmeEnqueue(pAd, AUTH_STATE_MACHINE, MT2_MLME_AUTH_REQ,
-							sizeof(MLME_AUTH_REQ_STRUCT), &AuthReq);
+				MlmeEnqueue(pAd, ASSOC_STATE_MACHINE,
+					    MT2_MLME_ASSOC_REQ,
+					    sizeof(struct rt_mlme_assoc_req),
+					    &AssocReq);
 
-				pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_AUTH2;
+				pAd->Mlme.CntlMachine.CurrState =
+				    CNTL_WAIT_ASSOC;
 			}
-			else
-			{
-				// not success, try next BSS
-				DBGPRINT(RT_DEBUG_TRACE, ("CNTL - AUTH FAIL, give up; try next BSS\n"));
-				pAd->Mlme.CntlMachine.CurrState = CNTL_IDLE; //???????
+		} else {
+			if ((pAd->StaCfg.AuthMode ==
+			     Ndis802_11AuthModeAutoSwitch)
+			    && (pAd->MlmeAux.Alg == Ndis802_11AuthModeShared)) {
+				DBGPRINT(RT_DEBUG_TRACE,
+					 ("CNTL - AUTH FAIL, try OPEN system...\n"));
+				AuthParmFill(pAd, &AuthReq, pAd->MlmeAux.Bssid,
+					     Ndis802_11AuthModeOpen);
+				MlmeEnqueue(pAd, AUTH_STATE_MACHINE,
+					    MT2_MLME_AUTH_REQ,
+					    sizeof(struct rt_mlme_auth_req),
+					    &AuthReq);
+
+				pAd->Mlme.CntlMachine.CurrState =
+				    CNTL_WAIT_AUTH2;
+			} else {
+				/* not success, try next BSS */
+				DBGPRINT(RT_DEBUG_TRACE,
+					 ("CNTL - AUTH FAIL, give up; try next BSS\n"));
+				pAd->Mlme.CntlMachine.CurrState = CNTL_IDLE;	/*??????? */
 				pAd->MlmeAux.BssIdx++;
 				IterateOnBssTab(pAd);
 			}
@@ -987,30 +1047,30 @@ VOID CntlWaitAuthProc2(
 
 	==========================================================================
 */
-VOID CntlWaitAssocProc(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
+void CntlWaitAssocProc(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-	USHORT      Reason;
+	u16 Reason;
+
+	if (Elem->MsgType == MT2_ASSOC_CONF) {
+		NdisMoveMemory(&Reason, Elem->Msg, sizeof(u16));
+		if (Reason == MLME_SUCCESS) {
+			if (pAd->CommonCfg.bWirelessEvent) {
+				RTMPSendWirelessEvent(pAd, IW_ASSOC_EVENT_FLAG,
+						      pAd->MacTab.
+						      Content[BSSID_WCID].Addr,
+						      BSS0, 0);
+			}
 
-	if (Elem->MsgType == MT2_ASSOC_CONF)
-	{
-		NdisMoveMemory(&Reason, Elem->Msg, sizeof(USHORT));
-		if (Reason == MLME_SUCCESS)
-		{
 			LinkUp(pAd, BSS_INFRA);
 			pAd->Mlme.CntlMachine.CurrState = CNTL_IDLE;
-			DBGPRINT(RT_DEBUG_TRACE, ("CNTL - Association successful on BSS #%ld\n",pAd->MlmeAux.BssIdx));
-
-			if (pAd->CommonCfg.bWirelessEvent)
-			{
-				RTMPSendWirelessEvent(pAd, IW_ASSOC_EVENT_FLAG, pAd->MacTab.Content[BSSID_WCID].Addr, BSS0, 0);
-			}
-		}
-		else
-		{
-			// not success, try next BSS
-			DBGPRINT(RT_DEBUG_TRACE, ("CNTL - Association fails on BSS #%ld\n",pAd->MlmeAux.BssIdx));
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("CNTL - Association successful on BSS #%ld\n",
+				  pAd->MlmeAux.BssIdx));
+		} else {
+			/* not success, try next BSS */
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("CNTL - Association fails on BSS #%ld\n",
+				  pAd->MlmeAux.BssIdx));
 			pAd->MlmeAux.BssIdx++;
 			IterateOnBssTab(pAd);
 		}
@@ -1025,52 +1085,51 @@ VOID CntlWaitAssocProc(
 
 	==========================================================================
 */
-VOID CntlWaitReassocProc(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
+void CntlWaitReassocProc(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-	USHORT      Result;
-
-	if (Elem->MsgType == MT2_REASSOC_CONF)
-	{
-		NdisMoveMemory(&Result, Elem->Msg, sizeof(USHORT));
-		if (Result == MLME_SUCCESS)
-		{
-			//
-			// NDIS requires a new Link UP indication but no Link Down for RE-ASSOC
-			//
-			LinkUp(pAd, BSS_INFRA);
+	u16 Result;
 
-			// send wireless event - for association
+	if (Elem->MsgType == MT2_REASSOC_CONF) {
+		NdisMoveMemory(&Result, Elem->Msg, sizeof(u16));
+		if (Result == MLME_SUCCESS) {
+			/* send wireless event - for association */
 			if (pAd->CommonCfg.bWirelessEvent)
-				RTMPSendWirelessEvent(pAd, IW_ASSOC_EVENT_FLAG, pAd->MacTab.Content[BSSID_WCID].Addr, BSS0, 0);
+				RTMPSendWirelessEvent(pAd, IW_ASSOC_EVENT_FLAG,
+						      pAd->MacTab.
+						      Content[BSSID_WCID].Addr,
+						      BSS0, 0);
+
+			/* */
+			/* NDIS requires a new Link UP indication but no Link Down for RE-ASSOC */
+			/* */
+			LinkUp(pAd, BSS_INFRA);
 
 			pAd->Mlme.CntlMachine.CurrState = CNTL_IDLE;
-			DBGPRINT(RT_DEBUG_TRACE, ("CNTL - Re-assocition successful on BSS #%ld\n", pAd->MlmeAux.RoamIdx));
-		}
-		else
-		{
-			// reassoc failed, try to pick next BSS in the BSS Table
-			DBGPRINT(RT_DEBUG_TRACE, ("CNTL - Re-assocition fails on BSS #%ld\n", pAd->MlmeAux.RoamIdx));
-			pAd->MlmeAux.RoamIdx++;
-			IterateOnBssTab2(pAd);
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("CNTL - Re-assocition successful on BSS #%ld\n",
+				  pAd->MlmeAux.RoamIdx));
+		} else {
+			/* reassoc failed, try to pick next BSS in the BSS Table */
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("CNTL - Re-assocition fails on BSS #%ld\n",
+				  pAd->MlmeAux.RoamIdx));
+			{
+				pAd->MlmeAux.RoamIdx++;
+				IterateOnBssTab2(pAd);
+			}
 		}
 	}
 }
 
-
-#ifdef RT2870
-VOID	AdhocTurnOnQos(
-	IN  PRTMP_ADAPTER pAd)
+void AdhocTurnOnQos(struct rt_rtmp_adapter *pAd)
 {
 #define AC0_DEF_TXOP		0
 #define AC1_DEF_TXOP		0
 #define AC2_DEF_TXOP		94
 #define AC3_DEF_TXOP		47
 
-	// Turn on QOs if use HT rate.
-	if (pAd->CommonCfg.APEdcaParm.bValid == FALSE)
-	{
+	/* Turn on QOs if use HT rate. */
+	if (pAd->CommonCfg.APEdcaParm.bValid == FALSE) {
 		pAd->CommonCfg.APEdcaParm.bValid = TRUE;
 		pAd->CommonCfg.APEdcaParm.Aifsn[0] = 3;
 		pAd->CommonCfg.APEdcaParm.Aifsn[1] = 7;
@@ -1087,14 +1146,13 @@ VOID	AdhocTurnOnQos(
 		pAd->CommonCfg.APEdcaParm.Cwmax[2] = 4;
 		pAd->CommonCfg.APEdcaParm.Cwmax[3] = 3;
 
-		pAd->CommonCfg.APEdcaParm.Txop[0]  = 0;
-		pAd->CommonCfg.APEdcaParm.Txop[1]  = 0;
-		pAd->CommonCfg.APEdcaParm.Txop[2]  = AC2_DEF_TXOP;
-		pAd->CommonCfg.APEdcaParm.Txop[3]  = AC3_DEF_TXOP;
+		pAd->CommonCfg.APEdcaParm.Txop[0] = 0;
+		pAd->CommonCfg.APEdcaParm.Txop[1] = 0;
+		pAd->CommonCfg.APEdcaParm.Txop[2] = AC2_DEF_TXOP;
+		pAd->CommonCfg.APEdcaParm.Txop[3] = AC3_DEF_TXOP;
 	}
 	AsicSetEdcaParm(pAd, &pAd->CommonCfg.APEdcaParm);
 }
-#endif /* RT2870 */
 
 /*
 	==========================================================================
@@ -1104,110 +1162,81 @@ VOID	AdhocTurnOnQos(
 
 	==========================================================================
 */
-VOID LinkUp(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR BssType)
+void LinkUp(struct rt_rtmp_adapter *pAd, u8 BssType)
 {
-	ULONG	Now;
-	UINT32	Data;
-	BOOLEAN	Cancelled;
-	UCHAR	Value = 0, idx;
-	MAC_TABLE_ENTRY *pEntry = NULL, *pCurrEntry;
-
-#ifdef RT2860
-	if (RTMP_TEST_PSFLAG(pAd, fRTMP_PS_SET_PCI_CLK_OFF_COMMAND))
-	{
-		RTMPPCIeLinkCtrlValueRestore(pAd, RESTORE_HALT);
-		RTMPusecDelay(6000);
-		pAd->bPCIclkOff = FALSE;
+	unsigned long Now;
+	u32 Data;
+	BOOLEAN Cancelled;
+	u8 Value = 0, idx = 0, HashIdx = 0;
+	struct rt_mac_table_entry *pEntry = NULL, *pCurrEntry = NULL;
+
+	/* Init ChannelQuality to prevent DEAD_CQI at initial LinkUp */
+	pAd->Mlme.ChannelQuality = 50;
+
+	pEntry = MacTableLookup(pAd, pAd->CommonCfg.Bssid);
+	if (pEntry) {
+		MacTableDeleteEntry(pAd, pEntry->Aid, pEntry->Addr);
+		pEntry = NULL;
 	}
-#endif
 
 	pEntry = &pAd->MacTab.Content[BSSID_WCID];
 
-	//
-	// ASSOC - DisassocTimeoutAction
-	// CNTL - Dis-associate successful
-	// !!! LINK DOWN !!!
-	// [88888] OID_802_11_SSID should have returned NDTEST_WEP_AP2(Returned: )
-	//
-	// To prevent DisassocTimeoutAction to call Link down after we link up,
-	// cancel the DisassocTimer no matter what it start or not.
-	//
-	RTMPCancelTimer(&pAd->MlmeAux.DisassocTimer,  &Cancelled);
+	/* */
+	/* ASSOC - DisassocTimeoutAction */
+	/* CNTL - Dis-associate successful */
+	/* ! LINK DOWN ! */
+	/* [88888] OID_802_11_SSID should have returned NDTEST_WEP_AP2(Returned: ) */
+	/* */
+	/* To prevent DisassocTimeoutAction to call Link down after we link up, */
+	/* cancel the DisassocTimer no matter what it start or not. */
+	/* */
+	RTMPCancelTimer(&pAd->MlmeAux.DisassocTimer, &Cancelled);
 
 	COPY_SETTINGS_FROM_MLME_AUX_TO_ACTIVE_CFG(pAd);
 
 	COPY_HTSETTINGS_FROM_MLME_AUX_TO_ACTIVE_CFG(pAd);
 
-	// It's quite difficult to tell if a newly added KEY is WEP or CKIP until a new BSS
-	// is formed (either ASSOC/RE-ASSOC done or IBSS started. LinkUP should be a safe place
-	// to examine if cipher algorithm switching is required.
-	//rt2860b. Don't know why need this
-	SwitchBetweenWepAndCkip(pAd);
-
-#ifdef RT2860
-	// Before power save before link up function, We will force use 1R.
-	// So after link up, check Rx antenna # again.
+#ifdef RTMP_MAC_PCI
+	/* Before power save before link up function, We will force use 1R. */
+	/* So after link up, check Rx antenna # again. */
 	RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R3, &Value);
-	if(pAd->Antenna.field.RxPath == 3)
-	{
+	if (pAd->Antenna.field.RxPath == 3) {
 		Value |= (0x10);
-	}
-	else if(pAd->Antenna.field.RxPath == 2)
-	{
+	} else if (pAd->Antenna.field.RxPath == 2) {
 		Value |= (0x8);
-	}
-	else if(pAd->Antenna.field.RxPath == 1)
-	{
+	} else if (pAd->Antenna.field.RxPath == 1) {
 		Value |= (0x0);
 	}
 	RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R3, Value);
 	pAd->StaCfg.BBPR3 = Value;
-#endif /* RT2860 */
+#endif /* RTMP_MAC_PCI // */
 
-	if (BssType == BSS_ADHOC)
-	{
+	if (BssType == BSS_ADHOC) {
 		OPSTATUS_SET_FLAG(pAd, fOP_STATUS_ADHOC_ON);
 		OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_INFRA_ON);
 
-		if ((pAd->CommonCfg.HtCapability.HtCapInfo.ChannelWidth  == BW_40) &&
-			(pAd->CommonCfg.AddHTInfo.AddHtInfo.ExtChanOffset == EXTCHA_ABOVE))
-		{
-			pAd->CommonCfg.CentralChannel = pAd->CommonCfg.Channel + 2;
-		}
-		else if ((pAd->CommonCfg.Channel > 2) &&
-				 (pAd->CommonCfg.HtCapability.HtCapInfo.ChannelWidth  == BW_40) &&
-				 (pAd->CommonCfg.AddHTInfo.AddHtInfo.ExtChanOffset == EXTCHA_BELOW))
-		{
-			pAd->CommonCfg.CentralChannel = pAd->CommonCfg.Channel - 2;
-		}
-#ifdef RT2870
 		if (pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED)
 			AdhocTurnOnQos(pAd);
-#endif
 
-		DBGPRINT(RT_DEBUG_TRACE, ("!!!Adhoc LINK UP !!! \n" ));
-	}
-	else
-	{
+		DBGPRINT(RT_DEBUG_TRACE, ("Adhoc LINK UP!\n"));
+	} else {
 		OPSTATUS_SET_FLAG(pAd, fOP_STATUS_INFRA_ON);
 		OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_ADHOC_ON);
 
-		DBGPRINT(RT_DEBUG_TRACE, ("!!!Infra LINK UP !!! \n" ));
+		DBGPRINT(RT_DEBUG_TRACE, ("Infra LINK UP!\n"));
 	}
 
-	// 3*3
-	// reset Tx beamforming bit
+	/* 3*3 */
+	/* reset Tx beamforming bit */
 	RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R4, &Value);
 	Value &= (~0x01);
 	Value |= pAd->CommonCfg.RegTransmitSetting.field.TxBF;
 	RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R4, Value);
 
-	// Change to AP channel
-    if ((pAd->CommonCfg.CentralChannel > pAd->CommonCfg.Channel) && (pAd->MlmeAux.HtCapability.HtCapInfo.ChannelWidth == BW_40))
-	{
-		// Must using 40MHz.
+	/* Change to AP channel */
+	if ((pAd->CommonCfg.CentralChannel > pAd->CommonCfg.Channel)
+	    && (pAd->MlmeAux.HtCapability.HtCapInfo.ChannelWidth == BW_40)) {
+		/* Must using 40MHz. */
 		pAd->CommonCfg.BBPCurrentBW = BW_40;
 		AsicSwitchChannel(pAd, pAd->CommonCfg.CentralChannel, FALSE);
 		AsicLockChannel(pAd, pAd->CommonCfg.CentralChannel);
@@ -1217,34 +1246,35 @@ VOID LinkUp(
 		Value |= 0x10;
 		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R4, Value);
 
-		//  RX : control channel at lower
+		/*  RX : control channel at lower */
 		RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R3, &Value);
 		Value &= (~0x20);
 		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R3, Value);
-#ifdef RT2860
-        pAd->StaCfg.BBPR3 = Value;
-#endif
+#ifdef RTMP_MAC_PCI
+		pAd->StaCfg.BBPR3 = Value;
+#endif /* RTMP_MAC_PCI // */
 
 		RTMP_IO_READ32(pAd, TX_BAND_CFG, &Data);
 		Data &= 0xfffffffe;
 		RTMP_IO_WRITE32(pAd, TX_BAND_CFG, Data);
 
-		if (pAd->MACVersion == 0x28600100)
-		{
+		if (pAd->MACVersion == 0x28600100) {
 			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R69, 0x1A);
 			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R70, 0x0A);
 			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R73, 0x16);
-            DBGPRINT(RT_DEBUG_TRACE, ("!!!rt2860C !!! \n" ));
+			DBGPRINT(RT_DEBUG_TRACE, ("rt2860C !\n"));
 		}
 
-		DBGPRINT(RT_DEBUG_TRACE, ("!!!40MHz Lower LINK UP !!! Control Channel at Below. Central = %d \n", pAd->CommonCfg.CentralChannel ));
-	}
-	else if ((pAd->CommonCfg.CentralChannel < pAd->CommonCfg.Channel) && (pAd->MlmeAux.HtCapability.HtCapInfo.ChannelWidth == BW_40))
-    {
-	    // Must using 40MHz.
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("40MHz Lower LINK UP! Control Channel at Below. Central = %d \n",
+			  pAd->CommonCfg.CentralChannel));
+	} else if ((pAd->CommonCfg.CentralChannel < pAd->CommonCfg.Channel)
+		   && (pAd->MlmeAux.HtCapability.HtCapInfo.ChannelWidth ==
+		       BW_40)) {
+		/* Must using 40MHz. */
 		pAd->CommonCfg.BBPCurrentBW = BW_40;
 		AsicSwitchChannel(pAd, pAd->CommonCfg.CentralChannel, FALSE);
-	    AsicLockChannel(pAd, pAd->CommonCfg.CentralChannel);
+		AsicLockChannel(pAd, pAd->CommonCfg.CentralChannel);
 
 		RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R4, &Value);
 		Value &= (~0x18);
@@ -1256,25 +1286,24 @@ VOID LinkUp(
 		RTMP_IO_WRITE32(pAd, TX_BAND_CFG, Data);
 
 		RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R3, &Value);
-	    Value |= (0x20);
+		Value |= (0x20);
 		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R3, Value);
-#ifdef RT2860
-        pAd->StaCfg.BBPR3 = Value;
-#endif
+#ifdef RTMP_MAC_PCI
+		pAd->StaCfg.BBPR3 = Value;
+#endif /* RTMP_MAC_PCI // */
 
-		if (pAd->MACVersion == 0x28600100)
-		{
+		if (pAd->MACVersion == 0x28600100) {
 			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R69, 0x1A);
 			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R70, 0x0A);
 			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R73, 0x16);
-			    DBGPRINT(RT_DEBUG_TRACE, ("!!!rt2860C !!! \n" ));
+			DBGPRINT(RT_DEBUG_TRACE, ("rt2860C !\n"));
 		}
 
-	    DBGPRINT(RT_DEBUG_TRACE, ("!!! 40MHz Upper LINK UP !!! Control Channel at UpperCentral = %d \n", pAd->CommonCfg.CentralChannel ));
-    }
-    else
-    {
-	    pAd->CommonCfg.BBPCurrentBW = BW_20;
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("40MHz Upper LINK UP! Control Channel at UpperCentral = %d \n",
+			  pAd->CommonCfg.CentralChannel));
+	} else {
+		pAd->CommonCfg.BBPCurrentBW = BW_20;
 		pAd->CommonCfg.CentralChannel = pAd->CommonCfg.Channel;
 		AsicSwitchChannel(pAd, pAd->CommonCfg.Channel, FALSE);
 		AsicLockChannel(pAd, pAd->CommonCfg.Channel);
@@ -1290,511 +1319,533 @@ VOID LinkUp(
 		RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R3, &Value);
 		Value &= (~0x20);
 		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R3, Value);
-#ifdef RT2860
-        pAd->StaCfg.BBPR3 = Value;
-#endif
+#ifdef RTMP_MAC_PCI
+		pAd->StaCfg.BBPR3 = Value;
+#endif /* RTMP_MAC_PCI // */
 
-		if (pAd->MACVersion == 0x28600100)
-		{
+		if (pAd->MACVersion == 0x28600100) {
 			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R69, 0x16);
 			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R70, 0x08);
 			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R73, 0x11);
-            DBGPRINT(RT_DEBUG_TRACE, ("!!!rt2860C !!! \n" ));
+			DBGPRINT(RT_DEBUG_TRACE, ("rt2860C !\n"));
 		}
 
-	    DBGPRINT(RT_DEBUG_TRACE, ("!!! 20MHz LINK UP !!! \n" ));
-    }
+		DBGPRINT(RT_DEBUG_TRACE, ("20MHz LINK UP!\n"));
+	}
 
 	RTMPSetAGCInitValue(pAd, pAd->CommonCfg.BBPCurrentBW);
-	//
-	// Save BBP_R66 value, it will be used in RTUSBResumeMsduTransmission
-	//
-	RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R66, &pAd->BbpTuning.R66CurrentValue);
 
-	DBGPRINT(RT_DEBUG_TRACE, ("!!! LINK UP !!! (BssType=%d, AID=%d, ssid=%s, Channel=%d, CentralChannel = %d)\n",
-		BssType, pAd->StaActive.Aid, pAd->CommonCfg.Ssid, pAd->CommonCfg.Channel, pAd->CommonCfg.CentralChannel));
+	/* */
+	/* Save BBP_R66 value, it will be used in RTUSBResumeMsduTransmission */
+	/* */
+	RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R66,
+				    &pAd->BbpTuning.R66CurrentValue);
 
-	DBGPRINT(RT_DEBUG_TRACE, ("!!! LINK UP !!! (Density =%d, )\n", pAd->MacTab.Content[BSSID_WCID].MpduDensity));
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("LINK UP! (BssType=%d, AID=%d, ssid=%s, Channel=%d, CentralChannel = %d)\n",
+		  BssType, pAd->StaActive.Aid, pAd->CommonCfg.Ssid,
+		  pAd->CommonCfg.Channel, pAd->CommonCfg.CentralChannel));
 
-		AsicSetBssid(pAd, pAd->CommonCfg.Bssid);
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("LINK UP! (Density =%d, )\n",
+		  pAd->MacTab.Content[BSSID_WCID].MpduDensity));
+
+	AsicSetBssid(pAd, pAd->CommonCfg.Bssid);
 
 	AsicSetSlotTime(pAd, TRUE);
 	AsicSetEdcaParm(pAd, &pAd->CommonCfg.APEdcaParm);
 
-	// Call this for RTS protectionfor legacy rate, we will always enable RTS threshold, but normally it will not hit
-	AsicUpdateProtect(pAd, 0, (OFDMSETPROTECT | CCKSETPROTECT), TRUE, FALSE);
+	/* Call this for RTS protectionfor legacy rate, we will always enable RTS threshold, but normally it will not hit */
+	AsicUpdateProtect(pAd, 0, (OFDMSETPROTECT | CCKSETPROTECT), TRUE,
+			  FALSE);
 
-	if ((pAd->StaActive.SupportedPhyInfo.bHtEnable == TRUE))
-	{
-		// Update HT protectionfor based on AP's operating mode.
-    	if (pAd->MlmeAux.AddHtInfo.AddHtInfo2.NonGfPresent == 1)
-    	{
-    		AsicUpdateProtect(pAd, pAd->MlmeAux.AddHtInfo.AddHtInfo2.OperaionMode,  ALLN_SETPROTECT, FALSE, TRUE);
-    	}
-    	else
-   			AsicUpdateProtect(pAd, pAd->MlmeAux.AddHtInfo.AddHtInfo2.OperaionMode,  ALLN_SETPROTECT, FALSE, FALSE);
+	if ((pAd->StaActive.SupportedPhyInfo.bHtEnable == TRUE)) {
+		/* Update HT protectionfor based on AP's operating mode. */
+		if (pAd->MlmeAux.AddHtInfo.AddHtInfo2.NonGfPresent == 1) {
+			AsicUpdateProtect(pAd,
+					  pAd->MlmeAux.AddHtInfo.AddHtInfo2.
+					  OperaionMode, ALLN_SETPROTECT, FALSE,
+					  TRUE);
+		} else
+			AsicUpdateProtect(pAd,
+					  pAd->MlmeAux.AddHtInfo.AddHtInfo2.
+					  OperaionMode, ALLN_SETPROTECT, FALSE,
+					  FALSE);
 	}
 
-	NdisZeroMemory(&pAd->DrsCounters, sizeof(COUNTER_DRS));
+	NdisZeroMemory(&pAd->DrsCounters, sizeof(struct rt_counter_drs));
 
 	NdisGetSystemUpTime(&Now);
-	pAd->StaCfg.LastBeaconRxTime = Now;   // last RX timestamp
+	pAd->StaCfg.LastBeaconRxTime = Now;	/* last RX timestamp */
 
 	if ((pAd->CommonCfg.TxPreamble != Rt802_11PreambleLong) &&
-		CAP_IS_SHORT_PREAMBLE_ON(pAd->StaActive.CapabilityInfo))
-	{
+	    CAP_IS_SHORT_PREAMBLE_ON(pAd->StaActive.CapabilityInfo)) {
 		MlmeSetTxPreamble(pAd, Rt802_11PreambleShort);
 	}
 
 	OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_AGGREGATION_INUSED);
 
-	if (pAd->CommonCfg.RadarDetect.RDMode == RD_SILENCE_MODE)
-	{
+	if (pAd->CommonCfg.RadarDetect.RDMode == RD_SILENCE_MODE) {
 	}
 	pAd->CommonCfg.RadarDetect.RDMode = RD_NORMAL_MODE;
 
-	if (BssType == BSS_ADHOC)
-	{
+	if (BssType == BSS_ADHOC) {
 		MakeIbssBeacon(pAd);
 		if ((pAd->CommonCfg.Channel > 14)
-			&& (pAd->CommonCfg.bIEEE80211H == 1)
-			&& RadarChannelCheck(pAd, pAd->CommonCfg.Channel))
-		{
-			; //Do nothing
-		}
-		else
-		{
+		    && (pAd->CommonCfg.bIEEE80211H == 1)
+		    && RadarChannelCheck(pAd, pAd->CommonCfg.Channel)) {
+			;	/*Do nothing */
+		} else {
 			AsicEnableIbssSync(pAd);
 		}
 
-		// In ad hoc mode, use MAC table from index 1.
-		// p.s ASIC use all 0xff as termination of WCID table search.To prevent it's 0xff-ff-ff-ff-ff-ff, Write 0 here.
+		/* In ad hoc mode, use MAC table from index 1. */
+		/* p.s ASIC use all 0xff as termination of WCID table search.To prevent it's 0xff-ff-ff-ff-ff-ff, Write 0 here. */
 		RTMP_IO_WRITE32(pAd, MAC_WCID_BASE, 0x00);
 		RTMP_IO_WRITE32(pAd, 0x1808, 0x00);
 
-		// If WEP is enabled, add key material and cipherAlg into Asic
-		// Fill in Shared Key Table(offset: 0x6c00) and Shared Key Mode(offset: 0x7000)
+		/* If WEP is enabled, add key material and cipherAlg into Asic */
+		/* Fill in Shared Key Table(offset: 0x6c00) and Shared Key Mode(offset: 0x7000) */
 
-		if (pAd->StaCfg.WepStatus == Ndis802_11WEPEnabled)
-		{
-			PUCHAR	Key;
-			UCHAR 	CipherAlg;
+		if (pAd->StaCfg.WepStatus == Ndis802_11WEPEnabled) {
+			u8 *Key;
+			u8 CipherAlg;
 
-			for (idx=0; idx < SHARE_KEY_NUM; idx++)
-        	{
+			for (idx = 0; idx < SHARE_KEY_NUM; idx++) {
 				CipherAlg = pAd->SharedKey[BSS0][idx].CipherAlg;
-    			Key = pAd->SharedKey[BSS0][idx].Key;
-
-				if (pAd->SharedKey[BSS0][idx].KeyLen > 0)
-				{
-					// Set key material and cipherAlg to Asic
-    				AsicAddSharedKeyEntry(pAd, BSS0, idx, CipherAlg, Key, NULL, NULL);
-
-                    if (idx == pAd->StaCfg.DefaultKeyId)
-					{
-						// Update WCID attribute table and IVEIV table for this group key table
-						RTMPAddWcidAttributeEntry(pAd, BSS0, idx, CipherAlg, NULL);
+				Key = pAd->SharedKey[BSS0][idx].Key;
+
+				if (pAd->SharedKey[BSS0][idx].KeyLen > 0) {
+					/* Set key material and cipherAlg to Asic */
+					AsicAddSharedKeyEntry(pAd, BSS0, idx,
+							      CipherAlg, Key,
+							      NULL, NULL);
+
+					if (idx == pAd->StaCfg.DefaultKeyId) {
+						/* Update WCID attribute table and IVEIV table for this group key table */
+						RTMPAddWcidAttributeEntry(pAd,
+									  BSS0,
+									  idx,
+									  CipherAlg,
+									  NULL);
 					}
 				}
 
-
 			}
 		}
-		// If WPANone is enabled, add key material and cipherAlg into Asic
-		// Fill in Shared Key Table(offset: 0x6c00) and Shared Key Mode(offset: 0x7000)
-		else if (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPANone)
-		{
-			pAd->StaCfg.DefaultKeyId = 0;	// always be zero
-
-            NdisZeroMemory(&pAd->SharedKey[BSS0][0], sizeof(CIPHER_KEY));
-							pAd->SharedKey[BSS0][0].KeyLen = LEN_TKIP_EK;
-			NdisMoveMemory(pAd->SharedKey[BSS0][0].Key, pAd->StaCfg.PMK, LEN_TKIP_EK);
-
-            if (pAd->StaCfg.PairCipher == Ndis802_11Encryption2Enabled)
-            {
-    			NdisMoveMemory(pAd->SharedKey[BSS0][0].RxMic, &pAd->StaCfg.PMK[16], LEN_TKIP_RXMICK);
-    			NdisMoveMemory(pAd->SharedKey[BSS0][0].TxMic, &pAd->StaCfg.PMK[16], LEN_TKIP_TXMICK);
-            }
-
-			// Decide its ChiperAlg
-			if (pAd->StaCfg.PairCipher == Ndis802_11Encryption2Enabled)
+		/* If WPANone is enabled, add key material and cipherAlg into Asic */
+		/* Fill in Shared Key Table(offset: 0x6c00) and Shared Key Mode(offset: 0x7000) */
+		else if (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPANone) {
+			pAd->StaCfg.DefaultKeyId = 0;	/* always be zero */
+
+			NdisZeroMemory(&pAd->SharedKey[BSS0][0],
+				       sizeof(struct rt_cipher_key));
+			pAd->SharedKey[BSS0][0].KeyLen = LEN_TKIP_EK;
+			NdisMoveMemory(pAd->SharedKey[BSS0][0].Key,
+				       pAd->StaCfg.PMK, LEN_TKIP_EK);
+
+			if (pAd->StaCfg.PairCipher ==
+			    Ndis802_11Encryption2Enabled) {
+				NdisMoveMemory(pAd->SharedKey[BSS0][0].RxMic,
+					       &pAd->StaCfg.PMK[16],
+					       LEN_TKIP_RXMICK);
+				NdisMoveMemory(pAd->SharedKey[BSS0][0].TxMic,
+					       &pAd->StaCfg.PMK[16],
+					       LEN_TKIP_TXMICK);
+			}
+			/* Decide its ChiperAlg */
+			if (pAd->StaCfg.PairCipher ==
+			    Ndis802_11Encryption2Enabled)
 				pAd->SharedKey[BSS0][0].CipherAlg = CIPHER_TKIP;
-			else if (pAd->StaCfg.PairCipher == Ndis802_11Encryption3Enabled)
+			else if (pAd->StaCfg.PairCipher ==
+				 Ndis802_11Encryption3Enabled)
 				pAd->SharedKey[BSS0][0].CipherAlg = CIPHER_AES;
-			else
-            {
-                DBGPRINT(RT_DEBUG_TRACE, ("Unknow Cipher (=%d), set Cipher to AES\n", pAd->StaCfg.PairCipher));
+			else {
+				DBGPRINT(RT_DEBUG_TRACE,
+					 ("Unknow Cipher (=%d), set Cipher to AES\n",
+					  pAd->StaCfg.PairCipher));
 				pAd->SharedKey[BSS0][0].CipherAlg = CIPHER_AES;
-            }
+			}
 
-			// Set key material and cipherAlg to Asic
+			/* Set key material and cipherAlg to Asic */
 			AsicAddSharedKeyEntry(pAd,
-								  BSS0,
-								  0,
-								  pAd->SharedKey[BSS0][0].CipherAlg,
-								  pAd->SharedKey[BSS0][0].Key,
-								  pAd->SharedKey[BSS0][0].TxMic,
-								  pAd->SharedKey[BSS0][0].RxMic);
-
-            // Update WCID attribute table and IVEIV table for this group key table
-			RTMPAddWcidAttributeEntry(pAd, BSS0, 0, pAd->SharedKey[BSS0][0].CipherAlg, NULL);
+					      BSS0,
+					      0,
+					      pAd->SharedKey[BSS0][0].CipherAlg,
+					      pAd->SharedKey[BSS0][0].Key,
+					      pAd->SharedKey[BSS0][0].TxMic,
+					      pAd->SharedKey[BSS0][0].RxMic);
+
+			/* Update WCID attribute table and IVEIV table for this group key table */
+			RTMPAddWcidAttributeEntry(pAd, BSS0, 0,
+						  pAd->SharedKey[BSS0][0].
+						  CipherAlg, NULL);
 
 		}
 
-	}
-	else // BSS_INFRA
-	{
-		// Check the new SSID with last SSID
-		while (Cancelled == TRUE)
-		{
-			if (pAd->CommonCfg.LastSsidLen == pAd->CommonCfg.SsidLen)
-			{
-				if (RTMPCompareMemory(pAd->CommonCfg.LastSsid, pAd->CommonCfg.Ssid, pAd->CommonCfg.LastSsidLen) == 0)
-				{
-					// Link to the old one no linkdown is required.
+	} else			/* BSS_INFRA */
+	{
+		/* Check the new SSID with last SSID */
+		while (Cancelled == TRUE) {
+			if (pAd->CommonCfg.LastSsidLen ==
+			    pAd->CommonCfg.SsidLen) {
+				if (RTMPCompareMemory
+				    (pAd->CommonCfg.LastSsid,
+				     pAd->CommonCfg.Ssid,
+				     pAd->CommonCfg.LastSsidLen) == 0) {
+					/* Link to the old one no linkdown is required. */
 					break;
 				}
 			}
-			// Send link down event before set to link up
+			/* Send link down event before set to link up */
 			pAd->IndicateMediaState = NdisMediaStateDisconnected;
 			RTMP_IndicateMediaState(pAd);
-            pAd->ExtraInfo = GENERAL_LINK_DOWN;
-			DBGPRINT(RT_DEBUG_TRACE, ("NDIS_STATUS_MEDIA_DISCONNECT Event AA!\n"));
+			pAd->ExtraInfo = GENERAL_LINK_DOWN;
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("NDIS_STATUS_MEDIA_DISCONNECT Event AA!\n"));
 			break;
 		}
 
-		//
-		// On WPA mode, Remove All Keys if not connect to the last BSSID
-		// Key will be set after 4-way handshake.
-		//
-		if ((pAd->StaCfg.AuthMode >= Ndis802_11AuthModeWPA))
-		{
-			ULONG 		IV;
+		/* */
+		/* On WPA mode, Remove All Keys if not connect to the last BSSID */
+		/* Key will be set after 4-way handshake. */
+		/* */
+		if (pAd->StaCfg.AuthMode >= Ndis802_11AuthModeWPA) {
+			unsigned long IV;
 
-			// Remove all WPA keys
+			/* Remove all WPA keys */
+			RTMP_CLEAR_PSFLAG(pAd, fRTMP_PS_CAN_GO_SLEEP);
 			RTMPWPARemoveAllKeys(pAd);
 			pAd->StaCfg.PortSecured = WPA_802_1X_PORT_NOT_SECURED;
-			pAd->StaCfg.PrivacyFilter = Ndis802_11PrivFilter8021xWEP;
+			pAd->StaCfg.PrivacyFilter =
+			    Ndis802_11PrivFilter8021xWEP;
 
-			// Fixed connection failed with Range Maximizer - 515 AP (Marvell Chip) when security is WPAPSK/TKIP
-			// If IV related values are too large in GroupMsg2, AP would ignore this message.
-			IV = 0;
+			/* Fixed connection failed with Range Maximizer - 515 AP (Marvell Chip) when security is WPAPSK/TKIP */
+			/* If IV related values are too large in GroupMsg2, AP would ignore this message. */
+			IV = 1;
 			IV |= (pAd->StaCfg.DefaultKeyId << 30);
 			AsicUpdateWCIDIVEIV(pAd, BSSID_WCID, IV, 0);
-
-#ifdef RT2860
-			RTMP_CLEAR_PSFLAG(pAd, fRTMP_PS_CAN_GO_SLEEP);
-#endif
 		}
-		// NOTE:
-		// the decision of using "short slot time" or not may change dynamically due to
-		// new STA association to the AP. so we have to decide that upon parsing BEACON, not here
+		/* NOTE: */
+		/* the decision of using "short slot time" or not may change dynamically due to */
+		/* new STA association to the AP. so we have to decide that upon parsing BEACON, not here */
 
-		// NOTE:
-		// the decision to use "RTC/CTS" or "CTS-to-self" protection or not may change dynamically
-		// due to new STA association to the AP. so we have to decide that upon parsing BEACON, not here
+		/* NOTE: */
+		/* the decision to use "RTC/CTS" or "CTS-to-self" protection or not may change dynamically */
+		/* due to new STA association to the AP. so we have to decide that upon parsing BEACON, not here */
 
 		ComposePsPoll(pAd);
 		ComposeNullFrame(pAd);
 
-			AsicEnableBssSync(pAd);
+		AsicEnableBssSync(pAd);
 
-		// Add BSSID to WCID search table
+		/* Add BSSID to WCID search table */
 		AsicUpdateRxWCIDTable(pAd, BSSID_WCID, pAd->CommonCfg.Bssid);
 
-		NdisAcquireSpinLock(&pAd->MacTabLock);
-		// add this BSSID entry into HASH table
-		{
-			UCHAR HashIdx;
+		/* If WEP is enabled, add paiewise and shared key */
+		if (((pAd->StaCfg.WpaSupplicantUP) &&
+		     (pAd->StaCfg.WepStatus == Ndis802_11WEPEnabled) &&
+		     (pAd->StaCfg.PortSecured == WPA_802_1X_PORT_SECURED)) ||
+		    ((pAd->StaCfg.WpaSupplicantUP == WPA_SUPPLICANT_DISABLE) &&
+		     (pAd->StaCfg.WepStatus == Ndis802_11WEPEnabled))) {
+			u8 *Key;
+			u8 CipherAlg;
 
-			//pEntry = &pAd->MacTab.Content[BSSID_WCID];
-			HashIdx = MAC_ADDR_HASH_INDEX(pAd->CommonCfg.Bssid);
-			if (pAd->MacTab.Hash[HashIdx] == NULL)
-			{
-				pAd->MacTab.Hash[HashIdx] = pEntry;
-			}
-			else
-			{
-				pCurrEntry = pAd->MacTab.Hash[HashIdx];
-				while (pCurrEntry->pNext != NULL)
-					pCurrEntry = pCurrEntry->pNext;
-				pCurrEntry->pNext = pEntry;
-			}
-		}
-		NdisReleaseSpinLock(&pAd->MacTabLock);
-
-
-		// If WEP is enabled, add paiewise and shared key
-        if (((pAd->StaCfg.WpaSupplicantUP)&&
-             (pAd->StaCfg.WepStatus == Ndis802_11WEPEnabled)&&
-             (pAd->StaCfg.PortSecured == WPA_802_1X_PORT_SECURED)) ||
-            ((pAd->StaCfg.WpaSupplicantUP == WPA_SUPPLICANT_DISABLE)&&
-              (pAd->StaCfg.WepStatus == Ndis802_11WEPEnabled)))
-		{
-			PUCHAR	Key;
-			UCHAR 	CipherAlg;
-
-			for (idx=0; idx < SHARE_KEY_NUM; idx++)
-        	{
+			for (idx = 0; idx < SHARE_KEY_NUM; idx++) {
 				CipherAlg = pAd->SharedKey[BSS0][idx].CipherAlg;
-    			Key = pAd->SharedKey[BSS0][idx].Key;
-
-				if (pAd->SharedKey[BSS0][idx].KeyLen > 0)
-				{
-					// Set key material and cipherAlg to Asic
-    				AsicAddSharedKeyEntry(pAd, BSS0, idx, CipherAlg, Key, NULL, NULL);
-
-					if (idx == pAd->StaCfg.DefaultKeyId)
-					{
-						// Assign group key info
-						RTMPAddWcidAttributeEntry(pAd, BSS0, idx, CipherAlg, NULL);
-
-						// Assign pairwise key info
-						RTMPAddWcidAttributeEntry(pAd, BSS0, idx, CipherAlg, pEntry);
+				Key = pAd->SharedKey[BSS0][idx].Key;
+
+				if (pAd->SharedKey[BSS0][idx].KeyLen > 0) {
+					/* Set key material and cipherAlg to Asic */
+					AsicAddSharedKeyEntry(pAd, BSS0, idx,
+							      CipherAlg, Key,
+							      NULL, NULL);
+
+					if (idx == pAd->StaCfg.DefaultKeyId) {
+						/* Assign group key info */
+						RTMPAddWcidAttributeEntry(pAd,
+									  BSS0,
+									  idx,
+									  CipherAlg,
+									  NULL);
+
+						pEntry->Aid = BSSID_WCID;
+						/* Assign pairwise key info */
+						RTMPAddWcidAttributeEntry(pAd,
+									  BSS0,
+									  idx,
+									  CipherAlg,
+									  pEntry);
 					}
 				}
 			}
 		}
-
-		// only INFRASTRUCTURE mode need to indicate connectivity immediately; ADHOC mode
-		// should wait until at least 2 active nodes in this BSSID.
+		/* only INFRASTRUCTURE mode need to indicate connectivity immediately; ADHOC mode */
+		/* should wait until at least 2 active nodes in this BSSID. */
 		OPSTATUS_SET_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED);
 
-        // For GUI ++
-		if (pAd->StaCfg.AuthMode < Ndis802_11AuthModeWPA)
-		{
+		/* For GUI ++ */
+		if (pAd->StaCfg.AuthMode < Ndis802_11AuthModeWPA) {
 			pAd->IndicateMediaState = NdisMediaStateConnected;
 			pAd->ExtraInfo = GENERAL_LINK_UP;
-#ifdef RT2870
 			RTMP_IndicateMediaState(pAd);
-#endif
+		} else if ((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPAPSK) ||
+			   (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK))
+		{
+			if (pAd->StaCfg.WpaSupplicantUP ==
+			    WPA_SUPPLICANT_DISABLE)
+				RTMPSetTimer(&pAd->Mlme.LinkDownTimer,
+					     LINK_DOWN_TIMEOUT);
 		}
-        // --
-#ifdef RT2860
-		RTMP_IndicateMediaState(pAd);
-#endif
-
-		// Add BSSID in my MAC Table.
-        NdisAcquireSpinLock(&pAd->MacTabLock);
-		RTMPMoveMemory(pAd->MacTab.Content[BSSID_WCID].Addr, pAd->CommonCfg.Bssid, MAC_ADDR_LEN);
-		pAd->MacTab.Content[BSSID_WCID].Aid = BSSID_WCID;
-		pAd->MacTab.Content[BSSID_WCID].pAd = pAd;
-		pAd->MacTab.Content[BSSID_WCID].ValidAsCLI = TRUE;	//Although this is bssid..still set ValidAsCl
-		pAd->MacTab.Size = 1;	// infra mode always set MACtab size =1.
-		pAd->MacTab.Content[BSSID_WCID].Sst = SST_ASSOC;
-		pAd->MacTab.Content[BSSID_WCID].AuthState = SST_ASSOC;
-		pAd->MacTab.Content[BSSID_WCID].AuthMode = pAd->StaCfg.AuthMode;
-		pAd->MacTab.Content[BSSID_WCID].WepStatus = pAd->StaCfg.WepStatus;
-        NdisReleaseSpinLock(&pAd->MacTabLock);
-
-		DBGPRINT(RT_DEBUG_TRACE, ("!!! LINK UP !!!  ClientStatusFlags=%lx)\n",
-			pAd->MacTab.Content[BSSID_WCID].ClientStatusFlags));
+		/* -- */
 
-		MlmeUpdateTxRates(pAd, TRUE, BSS0);
-		MlmeUpdateHtTxRates(pAd, BSS0);
-		DBGPRINT(RT_DEBUG_TRACE, ("!!! LINK UP !! (StaActive.bHtEnable =%d, )\n", pAd->StaActive.SupportedPhyInfo.bHtEnable));
+		/* Add BSSID in my MAC Table. */
+		NdisAcquireSpinLock(&pAd->MacTabLock);
+		/* add this MAC entry into HASH table */
+		if (pEntry) {
+			HashIdx = MAC_ADDR_HASH_INDEX(pAd->CommonCfg.Bssid);
+			if (pAd->MacTab.Hash[HashIdx] == NULL) {
+				pAd->MacTab.Hash[HashIdx] = pEntry;
+			} else {
+				pCurrEntry = pAd->MacTab.Hash[HashIdx];
+				while (pCurrEntry->pNext != NULL) {
+					pCurrEntry = pCurrEntry->pNext;
+				}
+				pCurrEntry->pNext = pEntry;
+			}
+		}
+		RTMPMoveMemory(pEntry->Addr, pAd->CommonCfg.Bssid,
+			       MAC_ADDR_LEN);
+		pEntry->Aid = BSSID_WCID;
+		pEntry->pAd = pAd;
+		pEntry->ValidAsCLI = TRUE;	/*Although this is bssid..still set ValidAsCl */
+		pAd->MacTab.Size = 1;	/* infra mode always set MACtab size =1. */
+		pEntry->Sst = SST_ASSOC;
+		pEntry->AuthState = SST_ASSOC;
+		pEntry->AuthMode = pAd->StaCfg.AuthMode;
+		pEntry->WepStatus = pAd->StaCfg.WepStatus;
+		if (pEntry->AuthMode < Ndis802_11AuthModeWPA) {
+			pEntry->WpaState = AS_NOTUSE;
+			pEntry->PrivacyFilter = Ndis802_11PrivFilterAcceptAll;
+		} else {
+			pEntry->WpaState = AS_PTKSTART;
+			pEntry->PrivacyFilter = Ndis802_11PrivFilter8021xWEP;
+		}
+		NdisReleaseSpinLock(&pAd->MacTabLock);
 
-		if (pAd->CommonCfg.bAggregationCapable)
-		{
-			if ((pAd->CommonCfg.bPiggyBackCapable) && (pAd->MlmeAux.APRalinkIe & 0x00000003) == 3)
-			{
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("LINK UP!  ClientStatusFlags=%lx)\n",
+			  pAd->MacTab.Content[BSSID_WCID].ClientStatusFlags));
 
-				OPSTATUS_SET_FLAG(pAd, fOP_STATUS_PIGGYBACK_INUSED);
-				OPSTATUS_SET_FLAG(pAd, fOP_STATUS_AGGREGATION_INUSED);
-                RTMPSetPiggyBack(pAd, TRUE);
-				DBGPRINT(RT_DEBUG_TRACE, ("Turn on Piggy-Back\n"));
-			}
-			else if (pAd->MlmeAux.APRalinkIe & 0x00000001)
-			{
-				OPSTATUS_SET_FLAG(pAd, fOP_STATUS_AGGREGATION_INUSED);
+		MlmeUpdateTxRates(pAd, TRUE, BSS0);
+		MlmeUpdateHtTxRates(pAd, BSS0);
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("LINK UP! (StaActive.bHtEnable =%d, )\n",
+			  pAd->StaActive.SupportedPhyInfo.bHtEnable));
+
+		if (pAd->CommonCfg.bAggregationCapable) {
+			if ((pAd->CommonCfg.bPiggyBackCapable)
+			    && (pAd->MlmeAux.APRalinkIe & 0x00000003) == 3) {
+				OPSTATUS_SET_FLAG(pAd,
+						  fOP_STATUS_PIGGYBACK_INUSED);
+				OPSTATUS_SET_FLAG(pAd,
+						  fOP_STATUS_AGGREGATION_INUSED);
+				CLIENT_STATUS_SET_FLAG(pEntry,
+						       fCLIENT_STATUS_AGGREGATION_CAPABLE);
+				CLIENT_STATUS_SET_FLAG(pEntry,
+						       fCLIENT_STATUS_PIGGYBACK_CAPABLE);
+				RTMPSetPiggyBack(pAd, TRUE);
+				DBGPRINT(RT_DEBUG_TRACE,
+					 ("Turn on Piggy-Back\n"));
+			} else if (pAd->MlmeAux.APRalinkIe & 0x00000001) {
+				OPSTATUS_SET_FLAG(pAd,
+						  fOP_STATUS_AGGREGATION_INUSED);
+				CLIENT_STATUS_SET_FLAG(pEntry,
+						       fCLIENT_STATUS_AGGREGATION_CAPABLE);
+				DBGPRINT(RT_DEBUG_TRACE,
+					 ("Ralink Aggregation\n"));
 			}
 		}
 
-		if (pAd->MlmeAux.APRalinkIe != 0x0)
-		{
-			if (CLIENT_STATUS_TEST_FLAG(&pAd->MacTab.Content[BSSID_WCID], fCLIENT_STATUS_RDG_CAPABLE))
-			{
+		if (pAd->MlmeAux.APRalinkIe != 0x0) {
+			if (CLIENT_STATUS_TEST_FLAG
+			    (pEntry, fCLIENT_STATUS_RDG_CAPABLE)) {
 				AsicEnableRDG(pAd);
 			}
-
 			OPSTATUS_SET_FLAG(pAd, fCLIENT_STATUS_RALINK_CHIPSET);
-			CLIENT_STATUS_SET_FLAG(&pAd->MacTab.Content[BSSID_WCID], fCLIENT_STATUS_RALINK_CHIPSET);
-		}
-		else
-		{
+			CLIENT_STATUS_SET_FLAG(pEntry,
+					       fCLIENT_STATUS_RALINK_CHIPSET);
+		} else {
 			OPSTATUS_CLEAR_FLAG(pAd, fCLIENT_STATUS_RALINK_CHIPSET);
-			CLIENT_STATUS_CLEAR_FLAG(&pAd->MacTab.Content[BSSID_WCID], fCLIENT_STATUS_RALINK_CHIPSET);
+			CLIENT_STATUS_CLEAR_FLAG(pEntry,
+						 fCLIENT_STATUS_RALINK_CHIPSET);
 		}
 	}
 
-	DBGPRINT(RT_DEBUG_TRACE, ("NDIS_STATUS_MEDIA_CONNECT Event B!.BACapability = %x. ClientStatusFlags = %lx\n", pAd->CommonCfg.BACapability.word, pAd->MacTab.Content[BSSID_WCID].ClientStatusFlags));
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("NDIS_STATUS_MEDIA_CONNECT Event B!.BACapability = %x. ClientStatusFlags = %lx\n",
+		  pAd->CommonCfg.BACapability.word,
+		  pAd->MacTab.Content[BSSID_WCID].ClientStatusFlags));
 
-	// Set LED
+	/* Set LED */
 	RTMPSetLED(pAd, LED_LINK_UP);
 
 	pAd->Mlme.PeriodicRound = 0;
 	pAd->Mlme.OneSecPeriodicRound = 0;
-	pAd->bConfigChanged = FALSE;        // Reset config flag
-	pAd->ExtraInfo = GENERAL_LINK_UP;   // Update extra information to link is up
+	pAd->bConfigChanged = FALSE;	/* Reset config flag */
+	pAd->ExtraInfo = GENERAL_LINK_UP;	/* Update extra information to link is up */
 
-	// Set asic auto fall back
+	/* Set asic auto fall back */
 	{
-		PUCHAR					pTable;
-		UCHAR					TableSize = 0;
+		u8 *pTable;
+		u8 TableSize = 0;
 
-		MlmeSelectTxRateTable(pAd, &pAd->MacTab.Content[BSSID_WCID], &pTable, &TableSize, &pAd->CommonCfg.TxRateIndex);
+		MlmeSelectTxRateTable(pAd, &pAd->MacTab.Content[BSSID_WCID],
+				      &pTable, &TableSize,
+				      &pAd->CommonCfg.TxRateIndex);
 		AsicUpdateAutoFallBackTable(pAd, pTable);
 	}
 
 	NdisAcquireSpinLock(&pAd->MacTabLock);
-    pEntry->HTPhyMode.word = pAd->StaCfg.HTPhyMode.word;
-    pEntry->MaxHTPhyMode.word = pAd->StaCfg.HTPhyMode.word;
-	if (pAd->StaCfg.bAutoTxRateSwitch == FALSE)
-	{
+	pEntry->HTPhyMode.word = pAd->StaCfg.HTPhyMode.word;
+	pEntry->MaxHTPhyMode.word = pAd->StaCfg.HTPhyMode.word;
+	if (pAd->StaCfg.bAutoTxRateSwitch == FALSE) {
 		pEntry->bAutoTxRateSwitch = FALSE;
 
 		if (pEntry->HTPhyMode.field.MCS == 32)
 			pEntry->HTPhyMode.field.ShortGI = GI_800;
 
-		if ((pEntry->HTPhyMode.field.MCS > MCS_7) || (pEntry->HTPhyMode.field.MCS == 32))
+		if ((pEntry->HTPhyMode.field.MCS > MCS_7)
+		    || (pEntry->HTPhyMode.field.MCS == 32))
 			pEntry->HTPhyMode.field.STBC = STBC_NONE;
 
-		// If the legacy mode is set, overwrite the transmit setting of this entry.
+		/* If the legacy mode is set, overwrite the transmit setting of this entry. */
 		if (pEntry->HTPhyMode.field.MODE <= MODE_OFDM)
-			RTMPUpdateLegacyTxSetting((UCHAR)pAd->StaCfg.DesiredTransmitSetting.field.FixedTxMode, pEntry);
-	}
-	else
+			RTMPUpdateLegacyTxSetting((u8)pAd->StaCfg.
+						  DesiredTransmitSetting.field.
+						  FixedTxMode, pEntry);
+	} else
 		pEntry->bAutoTxRateSwitch = TRUE;
 	NdisReleaseSpinLock(&pAd->MacTabLock);
 
-	//  Let Link Status Page display first initial rate.
-	pAd->LastTxRate = (USHORT)(pEntry->HTPhyMode.word);
-	// Select DAC according to HT or Legacy
-	if (pAd->StaActive.SupportedPhyInfo.MCSSet[0] != 0x00)
-	{
+	/*  Let Link Status Page display first initial rate. */
+	pAd->LastTxRate = (u16)(pEntry->HTPhyMode.word);
+	/* Select DAC according to HT or Legacy */
+	if (pAd->StaActive.SupportedPhyInfo.MCSSet[0] != 0x00) {
 		RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R1, &Value);
 		Value &= (~0x18);
-		if (pAd->Antenna.field.TxPath == 2)
-		{
-		    Value |= 0x10;
+		if (pAd->Antenna.field.TxPath == 2) {
+			Value |= 0x10;
 		}
 		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R1, Value);
-	}
-	else
-	{
+	} else {
 		RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R1, &Value);
 		Value &= (~0x18);
 		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R1, Value);
 	}
 
-	if (pAd->StaActive.SupportedPhyInfo.bHtEnable == FALSE)
-	{
-	}
-	else if (pEntry->MaxRAmpduFactor == 0)
-	{
-	    // If HT AP doesn't support MaxRAmpduFactor = 1, we need to set max PSDU to 0.
-	    // Because our Init value is 1 at MACRegTable.
+	if (pAd->StaActive.SupportedPhyInfo.bHtEnable == FALSE) {
+	} else if (pEntry->MaxRAmpduFactor == 0) {
+		/* If HT AP doesn't support MaxRAmpduFactor = 1, we need to set max PSDU to 0. */
+		/* Because our Init value is 1 at MACRegTable. */
 		RTMP_IO_WRITE32(pAd, MAX_LEN_CFG, 0x0fff);
 	}
-
-	// Patch for Marvel AP to gain high throughput
-	// Need to set as following,
-	// 1. Set txop in register-EDCA_AC0_CFG as 0x60
-	// 2. Set EnTXWriteBackDDONE in register-WPDMA_GLO_CFG as zero
-	// 3. PBF_MAX_PCNT as 0x1F3FBF9F
-	// 4. kick per two packets when dequeue
-	//
-	// Txop can only be modified when RDG is off, WMM is disable and TxBurst is enable
-	//
-	// if 1. Legacy AP WMM on,  or 2. 11n AP, AMPDU disable.  Force turn off burst no matter what bEnableTxBurst is.
-	if (
-		!(pAd->CommonCfg.RxStream == 1 && pAd->CommonCfg.TxStream == 1) &&
-		(((pAd->StaActive.SupportedPhyInfo.bHtEnable == FALSE) && OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_WMM_INUSED))
-		|| ((pAd->StaActive.SupportedPhyInfo.bHtEnable == TRUE) && (pAd->CommonCfg.BACapability.field.Policy == BA_NOTUSE))))
-	{
+	/* Patch for Marvel AP to gain high throughput */
+	/* Need to set as following, */
+	/* 1. Set txop in register-EDCA_AC0_CFG as 0x60 */
+	/* 2. Set EnTXWriteBackDDONE in register-WPDMA_GLO_CFG as zero */
+	/* 3. PBF_MAX_PCNT as 0x1F3FBF9F */
+	/* 4. kick per two packets when dequeue */
+	/* */
+	/* Txop can only be modified when RDG is off, WMM is disable and TxBurst is enable */
+	/* */
+	/* if 1. Legacy AP WMM on,  or 2. 11n AP, AMPDU disable.  Force turn off burst no matter what bEnableTxBurst is. */
+	if (!((pAd->CommonCfg.RxStream == 1) && (pAd->CommonCfg.TxStream == 1))
+	    && (pAd->StaCfg.bForceTxBurst == FALSE)
+	    &&
+	    (((pAd->StaActive.SupportedPhyInfo.bHtEnable == FALSE)
+	      && OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_WMM_INUSED))
+	     || ((pAd->StaActive.SupportedPhyInfo.bHtEnable == TRUE)
+		 && (pAd->CommonCfg.BACapability.field.Policy == BA_NOTUSE)))) {
 		RTMP_IO_READ32(pAd, EDCA_AC0_CFG, &Data);
-		Data  &= 0xFFFFFF00;
+		Data &= 0xFFFFFF00;
 		RTMP_IO_WRITE32(pAd, EDCA_AC0_CFG, Data);
 
 		RTMP_IO_WRITE32(pAd, PBF_MAX_PCNT, 0x1F3F7F9F);
 		DBGPRINT(RT_DEBUG_TRACE, ("Txburst 1\n"));
-	}
-	else
-	if (pAd->CommonCfg.bEnableTxBurst)
-	{
+	} else if (pAd->CommonCfg.bEnableTxBurst) {
 		RTMP_IO_READ32(pAd, EDCA_AC0_CFG, &Data);
-		Data  &= 0xFFFFFF00;
-		Data  |= 0x60;
+		Data &= 0xFFFFFF00;
+		Data |= 0x60;
 		RTMP_IO_WRITE32(pAd, EDCA_AC0_CFG, Data);
 		pAd->CommonCfg.IOTestParm.bNowAtherosBurstOn = TRUE;
 
 		RTMP_IO_WRITE32(pAd, PBF_MAX_PCNT, 0x1F3FBF9F);
 		DBGPRINT(RT_DEBUG_TRACE, ("Txburst 2\n"));
-	}
-	else
-	{
+	} else {
 		RTMP_IO_READ32(pAd, EDCA_AC0_CFG, &Data);
-		Data  &= 0xFFFFFF00;
+		Data &= 0xFFFFFF00;
 		RTMP_IO_WRITE32(pAd, EDCA_AC0_CFG, Data);
 
 		RTMP_IO_WRITE32(pAd, PBF_MAX_PCNT, 0x1F3F7F9F);
 		DBGPRINT(RT_DEBUG_TRACE, ("Txburst 3\n"));
 	}
 
-	// Re-check to turn on TX burst or not.
-	if ((pAd->CommonCfg.IOTestParm.bLastAtheros == TRUE) && ((STA_WEP_ON(pAd))||(STA_TKIP_ON(pAd))))
-	{
+	/* Re-check to turn on TX burst or not. */
+	if ((pAd->CommonCfg.IOTestParm.bLastAtheros == TRUE)
+	    && ((STA_WEP_ON(pAd)) || (STA_TKIP_ON(pAd)))) {
 		pAd->CommonCfg.IOTestParm.bNextDisableRxBA = TRUE;
-		if (pAd->CommonCfg.bEnableTxBurst)
-		{
-		    UINT32 MACValue = 0;
-			// Force disable  TXOP value in this case. The same action in MLMEUpdateProtect too.
-			// I didn't change PBF_MAX_PCNT setting.
+		if (pAd->CommonCfg.bEnableTxBurst) {
+			u32 MACValue = 0;
+			/* Force disable  TXOP value in this case. The same action in MLMEUpdateProtect too. */
+			/* I didn't change PBF_MAX_PCNT setting. */
 			RTMP_IO_READ32(pAd, EDCA_AC0_CFG, &MACValue);
-			MACValue  &= 0xFFFFFF00;
+			MACValue &= 0xFFFFFF00;
 			RTMP_IO_WRITE32(pAd, EDCA_AC0_CFG, MACValue);
 			pAd->CommonCfg.IOTestParm.bNowAtherosBurstOn = FALSE;
 		}
-	}
-	else
-	{
+	} else {
 		pAd->CommonCfg.IOTestParm.bNextDisableRxBA = FALSE;
 	}
 
 	pAd->CommonCfg.IOTestParm.bLastAtheros = FALSE;
 	COPY_MAC_ADDR(pAd->CommonCfg.LastBssid, pAd->CommonCfg.Bssid);
-	DBGPRINT(RT_DEBUG_TRACE, ("!!!pAd->bNextDisableRxBA= %d \n", pAd->CommonCfg.IOTestParm.bNextDisableRxBA));
-	// BSSID add in one MAC entry too.  Because in Tx, ASIC need to check Cipher and IV/EIV, BAbitmap
-	// Pther information in MACTab.Content[BSSID_WCID] is not necessary for driver.
-	// Note: As STA, The MACTab.Content[BSSID_WCID]. PairwiseKey and Shared Key for BSS0 are the same.
-
-    if (pAd->StaCfg.WepStatus <= Ndis802_11WEPDisabled)
-    {
-        pAd->StaCfg.PortSecured = WPA_802_1X_PORT_SECURED;
-		pAd->StaCfg.PrivacyFilter = Ndis802_11PrivFilterAcceptAll;
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("pAd->bNextDisableRxBA= %d \n",
+		  pAd->CommonCfg.IOTestParm.bNextDisableRxBA));
+	/* BSSID add in one MAC entry too.  Because in Tx, ASIC need to check Cipher and IV/EIV, BAbitmap */
+	/* Pther information in MACTab.Content[BSSID_WCID] is not necessary for driver. */
+	/* Note: As STA, The MACTab.Content[BSSID_WCID]. PairwiseKey and Shared Key for BSS0 are the same. */
+
+	if (pAd->StaCfg.WepStatus <= Ndis802_11WEPDisabled) {
+		if (pAd->StaCfg.WpaSupplicantUP &&
+		    (pAd->StaCfg.WepStatus == Ndis802_11WEPEnabled) &&
+		    (pAd->StaCfg.IEEE8021X == TRUE)) ;
+		else {
+			pAd->StaCfg.PortSecured = WPA_802_1X_PORT_SECURED;
+			pAd->StaCfg.PrivacyFilter =
+			    Ndis802_11PrivFilterAcceptAll;
+		}
 	}
 
 	NdisAcquireSpinLock(&pAd->MacTabLock);
 	pEntry->PortSecured = pAd->StaCfg.PortSecured;
 	NdisReleaseSpinLock(&pAd->MacTabLock);
 
-    //
-	// Patch Atheros AP TX will breakdown issue.
-	// AP Model: DLink DWL-8200AP
-	//
-	if (INFRA_ON(pAd) && OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_WMM_INUSED) && STA_TKIP_ON(pAd))
-	{
+	/* */
+	/* Patch Atheros AP TX will breakdown issue. */
+	/* AP Model: DLink DWL-8200AP */
+	/* */
+	if (INFRA_ON(pAd) && OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_WMM_INUSED)
+	    && STA_TKIP_ON(pAd)) {
 		RTMP_IO_WRITE32(pAd, RX_PARSER_CFG, 0x01);
-	}
-	else
-	{
+	} else {
 		RTMP_IO_WRITE32(pAd, RX_PARSER_CFG, 0x00);
 	}
 
 	RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS);
-#ifdef RT2860
+
 	RTMP_CLEAR_PSFLAG(pAd, fRTMP_PS_GO_TO_SLEEP_NOW);
-#endif
 }
 
 /*
@@ -1822,220 +1873,190 @@ VOID LinkUp(
 
 	==========================================================================
 */
-VOID LinkDown(
-	IN PRTMP_ADAPTER pAd,
-	IN  BOOLEAN      IsReqFromAP)
+void LinkDown(struct rt_rtmp_adapter *pAd, IN BOOLEAN IsReqFromAP)
 {
-	UCHAR			    i, ByteValue = 0;
-#ifdef RT2860
-	BOOLEAN		Cancelled;
-#endif
+	u8 i, ByteValue = 0;
 
-	// Do nothing if monitor mode is on
+	/* Do nothing if monitor mode is on */
 	if (MONITOR_ON(pAd))
 		return;
 
-#ifdef RT2860
 	RTMP_CLEAR_PSFLAG(pAd, fRTMP_PS_GO_TO_SLEEP_NOW);
-	RTMPCancelTimer(&pAd->Mlme.PsPollTimer,		&Cancelled);
-
-	// Not allow go to sleep within linkdown function.
+	/*Comment the codes, beasue the line 2291 call the same function. */
+	/*RTMPCancelTimer(&pAd->Mlme.PsPollTimer,               &Cancelled); */
+	/* Not allow go to sleep within linkdown function. */
 	RTMP_CLEAR_PSFLAG(pAd, fRTMP_PS_CAN_GO_SLEEP);
-#endif
 
-    if (pAd->CommonCfg.bWirelessEvent)
-	{
-		RTMPSendWirelessEvent(pAd, IW_STA_LINKDOWN_EVENT_FLAG, pAd->MacTab.Content[BSSID_WCID].Addr, BSS0, 0);
+	if (pAd->CommonCfg.bWirelessEvent) {
+		RTMPSendWirelessEvent(pAd, IW_STA_LINKDOWN_EVENT_FLAG,
+				      pAd->MacTab.Content[BSSID_WCID].Addr,
+				      BSS0, 0);
 	}
 
-	DBGPRINT(RT_DEBUG_TRACE, ("!!! LINK DOWN !!!\n"));
+	DBGPRINT(RT_DEBUG_TRACE, ("LINK DOWN!\n"));
 	OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_AGGREGATION_INUSED);
 
-#ifdef RT2860
-    if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_ADVANCE_POWER_SAVE_PCIE_DEVICE))
-    {
-	    BOOLEAN Cancelled;
-        pAd->Mlme.bPsPollTimerRunning = FALSE;
-        RTMPCancelTimer(&pAd->Mlme.PsPollTimer,	&Cancelled);
-    }
-
-    if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE) ||
-		RTMP_TEST_PSFLAG(pAd, fRTMP_PS_SET_PCI_CLK_OFF_COMMAND) ||
-		RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_IDLE_RADIO_OFF))
-    {
-		AsicForceWakeup(pAd, RTMP_HALT);
-        OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_DOZE);
-    }
-
-    pAd->bPCIclkOff = FALSE;
-#endif
-	if (ADHOC_ON(pAd))		// Adhoc mode link down
+#ifdef RTMP_MAC_PCI
+	if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE)) {
+		BOOLEAN Cancelled;
+		pAd->Mlme.bPsPollTimerRunning = FALSE;
+		RTMPCancelTimer(&pAd->Mlme.PsPollTimer, &Cancelled);
+	}
+
+	pAd->bPCIclkOff = FALSE;
+#endif /* RTMP_MAC_PCI // */
+
+	if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE)
+	    || RTMP_TEST_PSFLAG(pAd, fRTMP_PS_SET_PCI_CLK_OFF_COMMAND)
+	    || RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_IDLE_RADIO_OFF)) {
+		AUTO_WAKEUP_STRUC AutoWakeupCfg;
+		AsicForceWakeup(pAd, TRUE);
+		AutoWakeupCfg.word = 0;
+		RTMP_IO_WRITE32(pAd, AUTO_WAKEUP_CFG, AutoWakeupCfg.word);
+		OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_DOZE);
+	}
+#ifdef RTMP_MAC_PCI
+	pAd->bPCIclkOff = FALSE;
+#endif /* RTMP_MAC_PCI // */
+
+	if (ADHOC_ON(pAd))	/* Adhoc mode link down */
 	{
-		DBGPRINT(RT_DEBUG_TRACE, ("!!! LINK DOWN 1!!!\n"));
+		DBGPRINT(RT_DEBUG_TRACE, ("LINK DOWN 1!\n"));
 
 		OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_ADHOC_ON);
 		OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED);
 		pAd->IndicateMediaState = NdisMediaStateDisconnected;
 		RTMP_IndicateMediaState(pAd);
-        pAd->ExtraInfo = GENERAL_LINK_DOWN;
-		BssTableDeleteEntry(&pAd->ScanTab, pAd->CommonCfg.Bssid, pAd->CommonCfg.Channel);
-		DBGPRINT(RT_DEBUG_TRACE, ("!!! MacTab.Size=%d !!!\n", pAd->MacTab.Size));
-	}
-	else					// Infra structure mode
+		pAd->ExtraInfo = GENERAL_LINK_DOWN;
+		BssTableDeleteEntry(&pAd->ScanTab, pAd->CommonCfg.Bssid,
+				    pAd->CommonCfg.Channel);
+		DBGPRINT(RT_DEBUG_TRACE,
+			 (" MacTab.Size=%d !\n", pAd->MacTab.Size));
+	} else			/* Infra structure mode */
 	{
-		DBGPRINT(RT_DEBUG_TRACE, ("!!! LINK DOWN 2!!!\n"));
+		DBGPRINT(RT_DEBUG_TRACE, ("LINK DOWN 2!\n"));
 
 		OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_INFRA_ON);
 		OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED);
 
-		// Saved last SSID for linkup comparison
+		/* Saved last SSID for linkup comparison */
 		pAd->CommonCfg.LastSsidLen = pAd->CommonCfg.SsidLen;
-		NdisMoveMemory(pAd->CommonCfg.LastSsid, pAd->CommonCfg.Ssid, pAd->CommonCfg.LastSsidLen);
+		NdisMoveMemory(pAd->CommonCfg.LastSsid, pAd->CommonCfg.Ssid,
+			       pAd->CommonCfg.LastSsidLen);
 		COPY_MAC_ADDR(pAd->CommonCfg.LastBssid, pAd->CommonCfg.Bssid);
-		if (pAd->MlmeAux.CurrReqIsFromNdis == TRUE)
-		{
+		if (pAd->MlmeAux.CurrReqIsFromNdis == TRUE) {
 			pAd->IndicateMediaState = NdisMediaStateDisconnected;
 			RTMP_IndicateMediaState(pAd);
-            pAd->ExtraInfo = GENERAL_LINK_DOWN;
-			DBGPRINT(RT_DEBUG_TRACE, ("NDIS_STATUS_MEDIA_DISCONNECT Event A!\n"));
+			pAd->ExtraInfo = GENERAL_LINK_DOWN;
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("NDIS_STATUS_MEDIA_DISCONNECT Event A!\n"));
 			pAd->MlmeAux.CurrReqIsFromNdis = FALSE;
-		}
-		else
-		{
-            //
-			// If disassociation request is from NDIS, then we don't need to delete BSSID from entry.
-			// Otherwise lost beacon or receive De-Authentication from AP,
-			// then we should delete BSSID from BssTable.
-			// If we don't delete from entry, roaming will fail.
-			//
-			BssTableDeleteEntry(&pAd->ScanTab, pAd->CommonCfg.Bssid, pAd->CommonCfg.Channel);
+		} else {
+			/* */
+			/* If disassociation request is from NDIS, then we don't need to delete BSSID from entry. */
+			/* Otherwise lost beacon or receive De-Authentication from AP, */
+			/* then we should delete BSSID from BssTable. */
+			/* If we don't delete from entry, roaming will fail. */
+			/* */
+			BssTableDeleteEntry(&pAd->ScanTab, pAd->CommonCfg.Bssid,
+					    pAd->CommonCfg.Channel);
 		}
 
-		// restore back to -
-		//      1. long slot (20 us) or short slot (9 us) time
-		//      2. turn on/off RTS/CTS and/or CTS-to-self protection
-		//      3. short preamble
+		/* restore back to - */
+		/*      1. long slot (20 us) or short slot (9 us) time */
+		/*      2. turn on/off RTS/CTS and/or CTS-to-self protection */
+		/*      3. short preamble */
 		OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_BG_PROTECTION_INUSED);
 
-		if (pAd->StaCfg.CCXAdjacentAPReportFlag == TRUE)
-		{
-			//
-			// Record current AP's information.
-			// for later used reporting Adjacent AP report.
-			//
-			pAd->StaCfg.CCXAdjacentAPChannel = pAd->CommonCfg.Channel;
-			pAd->StaCfg.CCXAdjacentAPSsidLen = pAd->CommonCfg.SsidLen;
-			NdisMoveMemory(pAd->StaCfg.CCXAdjacentAPSsid, pAd->CommonCfg.Ssid, pAd->StaCfg.CCXAdjacentAPSsidLen);
-			COPY_MAC_ADDR(pAd->StaCfg.CCXAdjacentAPBssid, pAd->CommonCfg.Bssid);
-		}
 	}
 
-	for (i=1; i<MAX_LEN_OF_MAC_TABLE; i++)
-	{
+	for (i = 1; i < MAX_LEN_OF_MAC_TABLE; i++) {
 		if (pAd->MacTab.Content[i].ValidAsCLI == TRUE)
-			MacTableDeleteEntry(pAd, pAd->MacTab.Content[i].Aid, pAd->MacTab.Content[i].Addr);
+			MacTableDeleteEntry(pAd, pAd->MacTab.Content[i].Aid,
+					    pAd->MacTab.Content[i].Addr);
 	}
 
-	pAd->StaCfg.CCXQosECWMin	= 4;
-	pAd->StaCfg.CCXQosECWMax	= 10;
-
-	AsicSetSlotTime(pAd, TRUE); //FALSE);
+	AsicSetSlotTime(pAd, TRUE);	/*FALSE); */
 	AsicSetEdcaParm(pAd, NULL);
 
-	// Set LED
+	/* Set LED */
 	RTMPSetLED(pAd, LED_LINK_DOWN);
-    pAd->LedIndicatorStregth = 0xF0;
-    RTMPSetSignalLED(pAd, -100);	// Force signal strength Led to be turned off, firmware is not done it.
+	pAd->LedIndicatorStrength = 0xF0;
+	RTMPSetSignalLED(pAd, -100);	/* Force signal strength Led to be turned off, firmware is not done it. */
 
-		AsicDisableSync(pAd);
+	AsicDisableSync(pAd);
 
 	pAd->Mlme.PeriodicRound = 0;
 	pAd->Mlme.OneSecPeriodicRound = 0;
 
-	if (pAd->StaCfg.BssType == BSS_INFRA)
-	{
-		// Remove StaCfg Information after link down
+	if (pAd->StaCfg.BssType == BSS_INFRA) {
+		/* Remove StaCfg Information after link down */
 		NdisZeroMemory(pAd->CommonCfg.Bssid, MAC_ADDR_LEN);
 		NdisZeroMemory(pAd->CommonCfg.Ssid, MAX_LEN_OF_SSID);
 		pAd->CommonCfg.SsidLen = 0;
 	}
 
-	NdisZeroMemory(&pAd->MlmeAux.HtCapability, sizeof(HT_CAPABILITY_IE));
-	NdisZeroMemory(&pAd->MlmeAux.AddHtInfo, sizeof(ADD_HT_INFO_IE));
+	NdisZeroMemory(&pAd->MlmeAux.HtCapability, sizeof(struct rt_ht_capability_ie));
+	NdisZeroMemory(&pAd->MlmeAux.AddHtInfo, sizeof(struct rt_add_ht_info_ie));
 	pAd->MlmeAux.HtCapabilityLen = 0;
 	pAd->MlmeAux.NewExtChannelOffset = 0xff;
 
-	// Reset WPA-PSK state. Only reset when supplicant enabled
-	if (pAd->StaCfg.WpaState != SS_NOTUSE)
-	{
+	/* Reset WPA-PSK state. Only reset when supplicant enabled */
+	if (pAd->StaCfg.WpaState != SS_NOTUSE) {
 		pAd->StaCfg.WpaState = SS_START;
-		// Clear Replay counter
+		/* Clear Replay counter */
 		NdisZeroMemory(pAd->StaCfg.ReplayCounter, 8);
-	}
-
 
-	//
-	// if link down come from AP, we need to remove all WPA keys on WPA mode.
-	// otherwise will cause 4-way handshaking failed, since the WPA key not empty.
-	//
-	if ((IsReqFromAP) && (pAd->StaCfg.AuthMode >= Ndis802_11AuthModeWPA))
-	{
-		// Remove all WPA keys
+	}
+	/* */
+	/* if link down come from AP, we need to remove all WPA keys on WPA mode. */
+	/* otherwise will cause 4-way handshaking failed, since the WPA key not empty. */
+	/* */
+	if ((IsReqFromAP) && (pAd->StaCfg.AuthMode >= Ndis802_11AuthModeWPA)) {
+		/* Remove all WPA keys */
 		RTMPWPARemoveAllKeys(pAd);
 	}
+	/* 802.1x port control */
 
-	// 802.1x port control
-
-	// Prevent clear PortSecured here with static WEP
-	// NetworkManger set security policy first then set SSID to connect AP.
+	/* Prevent clear PortSecured here with static WEP */
+	/* NetworkManger set security policy first then set SSID to connect AP. */
 	if (pAd->StaCfg.WpaSupplicantUP &&
-		(pAd->StaCfg.WepStatus == Ndis802_11WEPEnabled) &&
-		(pAd->StaCfg.IEEE8021X == FALSE))
-	{
+	    (pAd->StaCfg.WepStatus == Ndis802_11WEPEnabled) &&
+	    (pAd->StaCfg.IEEE8021X == FALSE)) {
 		pAd->StaCfg.PortSecured = WPA_802_1X_PORT_SECURED;
-	}
-	else
-	{
+	} else {
 		pAd->StaCfg.PortSecured = WPA_802_1X_PORT_NOT_SECURED;
 		pAd->StaCfg.PrivacyFilter = Ndis802_11PrivFilter8021xWEP;
 	}
 
 	NdisAcquireSpinLock(&pAd->MacTabLock);
+	NdisZeroMemory(&pAd->MacTab, sizeof(struct rt_mac_table));
 	pAd->MacTab.Content[BSSID_WCID].PortSecured = pAd->StaCfg.PortSecured;
 	NdisReleaseSpinLock(&pAd->MacTabLock);
 
 	pAd->StaCfg.MicErrCnt = 0;
 
-	// Turn off Ckip control flag
-	pAd->StaCfg.bCkipOn = FALSE;
-	pAd->StaCfg.CCXEnable = FALSE;
-
-    pAd->IndicateMediaState = NdisMediaStateDisconnected;
-	// Update extra information to link is up
+	pAd->IndicateMediaState = NdisMediaStateDisconnected;
+	/* Update extra information to link is up */
 	pAd->ExtraInfo = GENERAL_LINK_DOWN;
 
-#ifdef RT2860
-    pAd->StaCfg.AdhocBOnlyJoined = FALSE;
-	pAd->StaCfg.AdhocBGJoined = FALSE;
-	pAd->StaCfg.Adhoc20NJoined = FALSE;
-#endif
-    pAd->StaActive.SupportedPhyInfo.bHtEnable = FALSE;
+	pAd->StaActive.SupportedPhyInfo.bHtEnable = FALSE;
 
-	// Reset the Current AP's IP address
-	NdisZeroMemory(pAd->StaCfg.AironetIPAddress, 4);
-#ifdef RT2870
+#ifdef RTMP_MAC_USB
 	pAd->bUsbTxBulkAggre = FALSE;
-#endif // RT2870 //
+#endif /* RTMP_MAC_USB // */
 
-	// Clean association information
-	NdisZeroMemory(&pAd->StaCfg.AssocInfo, sizeof(NDIS_802_11_ASSOCIATION_INFORMATION));
-	pAd->StaCfg.AssocInfo.Length = sizeof(NDIS_802_11_ASSOCIATION_INFORMATION);
+	/* Clean association information */
+	NdisZeroMemory(&pAd->StaCfg.AssocInfo,
+		       sizeof(struct rt_ndis_802_11_association_information));
+	pAd->StaCfg.AssocInfo.Length =
+	    sizeof(struct rt_ndis_802_11_association_information);
 	pAd->StaCfg.ReqVarIELen = 0;
 	pAd->StaCfg.ResVarIELen = 0;
 
-	//
-	// Reset RSSI value after link down
-	//
+	/* */
+	/* Reset RSSI value after link down */
+	/* */
 	pAd->StaCfg.RssiSample.AvgRssi0 = 0;
 	pAd->StaCfg.RssiSample.AvgRssi0X8 = 0;
 	pAd->StaCfg.RssiSample.AvgRssi1 = 0;
@@ -2043,37 +2064,36 @@ VOID LinkDown(
 	pAd->StaCfg.RssiSample.AvgRssi2 = 0;
 	pAd->StaCfg.RssiSample.AvgRssi2X8 = 0;
 
-	// Restore MlmeRate
+	/* Restore MlmeRate */
 	pAd->CommonCfg.MlmeRate = pAd->CommonCfg.BasicMlmeRate;
 	pAd->CommonCfg.RtsRate = pAd->CommonCfg.BasicMlmeRate;
 
-	//
-	// After Link down, reset piggy-back setting in ASIC. Disable RDG.
-	//
-	if (pAd->CommonCfg.BBPCurrentBW == BW_40)
-	{
+	/* */
+	/* After Link down, reset piggy-back setting in ASIC. Disable RDG. */
+	/* */
+	if (pAd->CommonCfg.BBPCurrentBW == BW_40) {
 		pAd->CommonCfg.BBPCurrentBW = BW_20;
 		RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R4, &ByteValue);
 		ByteValue &= (~0x18);
 		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R4, ByteValue);
 	}
-
-	// Reset DAC
+	/* Reset DAC */
 	RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R1, &ByteValue);
 	ByteValue &= (~0x18);
-	if (pAd->Antenna.field.TxPath == 2)
-	{
+	if (pAd->Antenna.field.TxPath == 2) {
 		ByteValue |= 0x10;
 	}
 	RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R1, ByteValue);
 
-	RTMPSetPiggyBack(pAd,FALSE);
+	RTMPSetPiggyBack(pAd, FALSE);
 	OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_PIGGYBACK_INUSED);
 
 	pAd->CommonCfg.BACapability.word = pAd->CommonCfg.REGBACapability.word;
 
-	// Restore all settings in the following.
-	AsicUpdateProtect(pAd, 0, (ALLN_SETPROTECT|CCKSETPROTECT|OFDMSETPROTECT), TRUE, FALSE);
+	/* Restore all settings in the following. */
+	AsicUpdateProtect(pAd, 0,
+			  (ALLN_SETPROTECT | CCKSETPROTECT | OFDMSETPROTECT),
+			  TRUE, FALSE);
 	AsicDisableRDG(pAd);
 	pAd->CommonCfg.IOTestParm.bCurrentAtheros = FALSE;
 	pAd->CommonCfg.IOTestParm.bNowAtherosBurstOn = FALSE;
@@ -2081,30 +2101,17 @@ VOID LinkDown(
 	RTMP_IO_WRITE32(pAd, MAX_LEN_CFG, 0x1fff);
 	RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS);
 
-#ifdef RT2860
-	// Allow go to sleep after linkdown steps.
+/* Allow go to sleep after linkdown steps. */
 	RTMP_SET_PSFLAG(pAd, fRTMP_PS_CAN_GO_SLEEP);
-#endif
 
-	{
-		union iwreq_data    wrqu;
-		memset(wrqu.ap_addr.sa_data, 0, MAC_ADDR_LEN);
-		wireless_send_event(pAd->net_dev, SIOCGIWAP, &wrqu, NULL);
-	}
+	RtmpOSWrielessEventSend(pAd, SIOCGIWAP, -1, NULL, NULL, 0);
 
-	if (IS_RT3090(pAd))
-	{
-		UINT32				macdata;
-		// disable MMPS BBP control register
-		RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R3, &ByteValue);
-		ByteValue &= ~(0x04);	//bit 2
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R3, ByteValue);
-
-		// disable MMPS MAC control register
-		RTMP_IO_READ32(pAd, 0x1210, &macdata);
-		macdata &= ~(0x09);	//bit 0, 3
-		RTMP_IO_WRITE32(pAd, 0x1210, macdata);
+#ifdef RT30xx
+	if ((IS_RT30xx(pAd) || IS_RT3090(pAd) || IS_RT3390(pAd))
+	    && (pAd->Antenna.field.RxPath > 1 || pAd->Antenna.field.TxPath > 1)) {
+		RTMP_ASIC_MMPS_DISABLE(pAd);
 	}
+#endif /* RT30xx // */
 }
 
 /*
@@ -2115,112 +2122,148 @@ VOID LinkDown(
 
 	==========================================================================
 */
-VOID IterateOnBssTab(
-	IN PRTMP_ADAPTER pAd)
+void IterateOnBssTab(struct rt_rtmp_adapter *pAd)
 {
-	MLME_START_REQ_STRUCT   StartReq;
-	MLME_JOIN_REQ_STRUCT    JoinReq;
-	ULONG                   BssIdx;
+	struct rt_mlme_start_req StartReq;
+	struct rt_mlme_join_req JoinReq;
+	unsigned long BssIdx;
 
-	// Change the wepstatus to original wepstatus
-	pAd->StaCfg.WepStatus   = pAd->StaCfg.OrigWepStatus;
-	pAd->StaCfg.PairCipher  = pAd->StaCfg.OrigWepStatus;
+	/* Change the wepstatus to original wepstatus */
+	pAd->StaCfg.WepStatus = pAd->StaCfg.OrigWepStatus;
+	pAd->StaCfg.PairCipher = pAd->StaCfg.OrigWepStatus;
 	pAd->StaCfg.GroupCipher = pAd->StaCfg.OrigWepStatus;
 
 	BssIdx = pAd->MlmeAux.BssIdx;
-	if (BssIdx < pAd->MlmeAux.SsidBssTab.BssNr)
-	{
-		// Check cipher suite, AP must have more secured cipher than station setting
-		// Set the Pairwise and Group cipher to match the intended AP setting
-		// We can only connect to AP with less secured cipher setting
-		if ((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA) || (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPAPSK))
-		{
-			pAd->StaCfg.GroupCipher = pAd->MlmeAux.SsidBssTab.BssEntry[BssIdx].WPA.GroupCipher;
-
-			if (pAd->StaCfg.WepStatus == pAd->MlmeAux.SsidBssTab.BssEntry[BssIdx].WPA.PairCipher)
-				pAd->StaCfg.PairCipher = pAd->MlmeAux.SsidBssTab.BssEntry[BssIdx].WPA.PairCipher;
-			else if (pAd->MlmeAux.SsidBssTab.BssEntry[BssIdx].WPA.PairCipherAux != Ndis802_11WEPDisabled)
-				pAd->StaCfg.PairCipher = pAd->MlmeAux.SsidBssTab.BssEntry[BssIdx].WPA.PairCipherAux;
-			else	// There is no PairCipher Aux, downgrade our capability to TKIP
-				pAd->StaCfg.PairCipher = Ndis802_11Encryption2Enabled;
-		}
-		else if ((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2) || (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK))
-		{
-			pAd->StaCfg.GroupCipher = pAd->MlmeAux.SsidBssTab.BssEntry[BssIdx].WPA2.GroupCipher;
-
-			if (pAd->StaCfg.WepStatus == pAd->MlmeAux.SsidBssTab.BssEntry[BssIdx].WPA2.PairCipher)
-				pAd->StaCfg.PairCipher = pAd->MlmeAux.SsidBssTab.BssEntry[BssIdx].WPA2.PairCipher;
-			else if (pAd->MlmeAux.SsidBssTab.BssEntry[BssIdx].WPA2.PairCipherAux != Ndis802_11WEPDisabled)
-				pAd->StaCfg.PairCipher = pAd->MlmeAux.SsidBssTab.BssEntry[BssIdx].WPA2.PairCipherAux;
-			else	// There is no PairCipher Aux, downgrade our capability to TKIP
-				pAd->StaCfg.PairCipher = Ndis802_11Encryption2Enabled;
-
-			// RSN capability
-			pAd->StaCfg.RsnCapability = pAd->MlmeAux.SsidBssTab.BssEntry[BssIdx].WPA2.RsnCapability;
-		}
-
-		// Set Mix cipher flag
-		pAd->StaCfg.bMixCipher = (pAd->StaCfg.PairCipher == pAd->StaCfg.GroupCipher) ? FALSE : TRUE;
-		if (pAd->StaCfg.bMixCipher == TRUE)
-		{
-			// If mix cipher, re-build RSNIE
-			RTMPMakeRSNIE(pAd, pAd->StaCfg.AuthMode, pAd->StaCfg.WepStatus, 0);
+	if (BssIdx < pAd->MlmeAux.SsidBssTab.BssNr) {
+		/* Check cipher suite, AP must have more secured cipher than station setting */
+		/* Set the Pairwise and Group cipher to match the intended AP setting */
+		/* We can only connect to AP with less secured cipher setting */
+		if ((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA)
+		    || (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPAPSK)) {
+			pAd->StaCfg.GroupCipher =
+			    pAd->MlmeAux.SsidBssTab.BssEntry[BssIdx].WPA.
+			    GroupCipher;
+
+			if (pAd->StaCfg.WepStatus ==
+			    pAd->MlmeAux.SsidBssTab.BssEntry[BssIdx].WPA.
+			    PairCipher)
+				pAd->StaCfg.PairCipher =
+				    pAd->MlmeAux.SsidBssTab.BssEntry[BssIdx].
+				    WPA.PairCipher;
+			else if (pAd->MlmeAux.SsidBssTab.BssEntry[BssIdx].WPA.
+				 PairCipherAux != Ndis802_11WEPDisabled)
+				pAd->StaCfg.PairCipher =
+				    pAd->MlmeAux.SsidBssTab.BssEntry[BssIdx].
+				    WPA.PairCipherAux;
+			else	/* There is no PairCipher Aux, downgrade our capability to TKIP */
+				pAd->StaCfg.PairCipher =
+				    Ndis802_11Encryption2Enabled;
+		} else if ((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2)
+			   || (pAd->StaCfg.AuthMode ==
+			       Ndis802_11AuthModeWPA2PSK)) {
+			pAd->StaCfg.GroupCipher =
+			    pAd->MlmeAux.SsidBssTab.BssEntry[BssIdx].WPA2.
+			    GroupCipher;
+
+			if (pAd->StaCfg.WepStatus ==
+			    pAd->MlmeAux.SsidBssTab.BssEntry[BssIdx].WPA2.
+			    PairCipher)
+				pAd->StaCfg.PairCipher =
+				    pAd->MlmeAux.SsidBssTab.BssEntry[BssIdx].
+				    WPA2.PairCipher;
+			else if (pAd->MlmeAux.SsidBssTab.BssEntry[BssIdx].WPA2.
+				 PairCipherAux != Ndis802_11WEPDisabled)
+				pAd->StaCfg.PairCipher =
+				    pAd->MlmeAux.SsidBssTab.BssEntry[BssIdx].
+				    WPA2.PairCipherAux;
+			else	/* There is no PairCipher Aux, downgrade our capability to TKIP */
+				pAd->StaCfg.PairCipher =
+				    Ndis802_11Encryption2Enabled;
+
+			/* RSN capability */
+			pAd->StaCfg.RsnCapability =
+			    pAd->MlmeAux.SsidBssTab.BssEntry[BssIdx].WPA2.
+			    RsnCapability;
 		}
-
-		DBGPRINT(RT_DEBUG_TRACE, ("CNTL - iterate BSS %ld of %d\n", BssIdx, pAd->MlmeAux.SsidBssTab.BssNr));
+		/* Set Mix cipher flag */
+		pAd->StaCfg.bMixCipher =
+		    (pAd->StaCfg.PairCipher ==
+		     pAd->StaCfg.GroupCipher) ? FALSE : TRUE;
+		/*if (pAd->StaCfg.bMixCipher == TRUE)
+		   {
+		   // If mix cipher, re-build RSNIE
+		   RTMPMakeRSNIE(pAd, pAd->StaCfg.AuthMode, pAd->StaCfg.WepStatus, 0);
+		   } */
+
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("CNTL - iterate BSS %ld of %d\n", BssIdx,
+			  pAd->MlmeAux.SsidBssTab.BssNr));
 		JoinParmFill(pAd, &JoinReq, BssIdx);
-		MlmeEnqueue(pAd, SYNC_STATE_MACHINE, MT2_MLME_JOIN_REQ, sizeof(MLME_JOIN_REQ_STRUCT),
-					&JoinReq);
+		MlmeEnqueue(pAd, SYNC_STATE_MACHINE, MT2_MLME_JOIN_REQ,
+			    sizeof(struct rt_mlme_join_req), &JoinReq);
 		pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_JOIN;
-	}
-	else if (pAd->StaCfg.BssType == BSS_ADHOC)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("CNTL - All BSS fail; start a new ADHOC (Ssid=%s)...\n",pAd->MlmeAux.Ssid));
-		StartParmFill(pAd, &StartReq, pAd->MlmeAux.Ssid, pAd->MlmeAux.SsidLen);
-		MlmeEnqueue(pAd, SYNC_STATE_MACHINE, MT2_MLME_START_REQ, sizeof(MLME_START_REQ_STRUCT), &StartReq);
+	} else if (pAd->StaCfg.BssType == BSS_ADHOC) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("CNTL - All BSS fail; start a new ADHOC (Ssid=%s)...\n",
+			  pAd->MlmeAux.Ssid));
+		StartParmFill(pAd, &StartReq, (char *)pAd->MlmeAux.Ssid,
+			      pAd->MlmeAux.SsidLen);
+		MlmeEnqueue(pAd, SYNC_STATE_MACHINE, MT2_MLME_START_REQ,
+			    sizeof(struct rt_mlme_start_req), &StartReq);
 		pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_START;
-	}
-	else // no more BSS
+	} else			/* no more BSS */
 	{
-		DBGPRINT(RT_DEBUG_TRACE, ("CNTL - All roaming failed, stay @ ch #%d\n", pAd->CommonCfg.Channel));
-		AsicSwitchChannel(pAd, pAd->CommonCfg.Channel, FALSE);
-		AsicLockChannel(pAd, pAd->CommonCfg.Channel);
+
+		{
+			AsicSwitchChannel(pAd, pAd->CommonCfg.Channel, FALSE);
+			AsicLockChannel(pAd, pAd->CommonCfg.Channel);
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("CNTL - All roaming failed, restore to channel %d, Total BSS[%02d]\n",
+				  pAd->CommonCfg.Channel, pAd->ScanTab.BssNr));
+		}
+
 		pAd->Mlme.CntlMachine.CurrState = CNTL_IDLE;
 	}
 }
 
-// for re-association only
-// IRQL = DISPATCH_LEVEL
-VOID IterateOnBssTab2(
-	IN PRTMP_ADAPTER pAd)
+/* for re-association only */
+/* IRQL = DISPATCH_LEVEL */
+void IterateOnBssTab2(struct rt_rtmp_adapter *pAd)
 {
-	MLME_REASSOC_REQ_STRUCT ReassocReq;
-	ULONG                   BssIdx;
-	BSS_ENTRY               *pBss;
+	struct rt_mlme_assoc_req ReassocReq;
+	unsigned long BssIdx;
+	struct rt_bss_entry *pBss;
 
 	BssIdx = pAd->MlmeAux.RoamIdx;
 	pBss = &pAd->MlmeAux.RoamTab.BssEntry[BssIdx];
 
-	if (BssIdx < pAd->MlmeAux.RoamTab.BssNr)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("CNTL - iterate BSS %ld of %d\n", BssIdx, pAd->MlmeAux.RoamTab.BssNr));
+	if (BssIdx < pAd->MlmeAux.RoamTab.BssNr) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("CNTL - iterate BSS %ld of %d\n", BssIdx,
+			  pAd->MlmeAux.RoamTab.BssNr));
 
 		AsicSwitchChannel(pAd, pBss->Channel, FALSE);
 		AsicLockChannel(pAd, pBss->Channel);
 
-		// reassociate message has the same structure as associate message
-		AssocParmFill(pAd, &ReassocReq, pBss->Bssid, pBss->CapabilityInfo,
-					  ASSOC_TIMEOUT, pAd->StaCfg.DefaultListenCount);
+		/* reassociate message has the same structure as associate message */
+		AssocParmFill(pAd, &ReassocReq, pBss->Bssid,
+			      pBss->CapabilityInfo, ASSOC_TIMEOUT,
+			      pAd->StaCfg.DefaultListenCount);
 		MlmeEnqueue(pAd, ASSOC_STATE_MACHINE, MT2_MLME_REASSOC_REQ,
-					sizeof(MLME_REASSOC_REQ_STRUCT), &ReassocReq);
+			    sizeof(struct rt_mlme_assoc_req), &ReassocReq);
 
 		pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_REASSOC;
-	}
-	else // no more BSS
+	} else			/* no more BSS */
 	{
-		DBGPRINT(RT_DEBUG_TRACE, ("CNTL - All fast roaming failed, back to ch #%d\n",pAd->CommonCfg.Channel));
-		AsicSwitchChannel(pAd, pAd->CommonCfg.Channel, FALSE);
-		AsicLockChannel(pAd, pAd->CommonCfg.Channel);
+
+		{
+			AsicSwitchChannel(pAd, pAd->CommonCfg.Channel, FALSE);
+			AsicLockChannel(pAd, pAd->CommonCfg.Channel);
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("CNTL - All roaming failed, restore to channel %d, Total BSS[%02d]\n",
+				  pAd->CommonCfg.Channel, pAd->ScanTab.BssNr));
+		}
+
 		pAd->Mlme.CntlMachine.CurrState = CNTL_IDLE;
 	}
 }
@@ -2233,10 +2276,8 @@ VOID IterateOnBssTab2(
 
 	==========================================================================
 */
-VOID JoinParmFill(
-	IN PRTMP_ADAPTER pAd,
-	IN OUT MLME_JOIN_REQ_STRUCT *JoinReq,
-	IN ULONG BssIdx)
+void JoinParmFill(struct rt_rtmp_adapter *pAd,
+		  struct rt_mlme_join_req *JoinReq, unsigned long BssIdx)
 {
 	JoinReq->BssIdx = BssIdx;
 }
@@ -2249,15 +2290,12 @@ VOID JoinParmFill(
 
 	==========================================================================
 */
-VOID ScanParmFill(
-	IN PRTMP_ADAPTER pAd,
-	IN OUT MLME_SCAN_REQ_STRUCT *ScanReq,
-	IN CHAR Ssid[],
-	IN UCHAR SsidLen,
-	IN UCHAR BssType,
-	IN UCHAR ScanType)
+void ScanParmFill(struct rt_rtmp_adapter *pAd,
+		  struct rt_mlme_scan_req *ScanReq,
+		  char Ssid[],
+		  u8 SsidLen, u8 BssType, u8 ScanType)
 {
-    NdisZeroMemory(ScanReq->Ssid, MAX_LEN_OF_SSID);
+	NdisZeroMemory(ScanReq->Ssid, MAX_LEN_OF_SSID);
 	ScanReq->SsidLen = SsidLen;
 	NdisMoveMemory(ScanReq->Ssid, Ssid, SsidLen);
 	ScanReq->BssType = BssType;
@@ -2272,11 +2310,9 @@ VOID ScanParmFill(
 
 	==========================================================================
 */
-VOID StartParmFill(
-	IN PRTMP_ADAPTER pAd,
-	IN OUT MLME_START_REQ_STRUCT *StartReq,
-	IN CHAR Ssid[],
-	IN UCHAR SsidLen)
+void StartParmFill(struct rt_rtmp_adapter *pAd,
+		   struct rt_mlme_start_req *StartReq,
+		   char Ssid[], u8 SsidLen)
 {
 	ASSERT(SsidLen <= MAX_LEN_OF_SSID);
 	NdisMoveMemory(StartReq->Ssid, Ssid, SsidLen);
@@ -2291,11 +2327,9 @@ VOID StartParmFill(
 
 	==========================================================================
 */
-VOID AuthParmFill(
-	IN PRTMP_ADAPTER pAd,
-	IN OUT MLME_AUTH_REQ_STRUCT *AuthReq,
-	IN PUCHAR pAddr,
-	IN USHORT Alg)
+void AuthParmFill(struct rt_rtmp_adapter *pAd,
+		  struct rt_mlme_auth_req *AuthReq,
+		  u8 *pAddr, u16 Alg)
 {
 	COPY_MAC_ADDR(AuthReq->Addr, pAddr);
 	AuthReq->Alg = Alg;
@@ -2310,82 +2344,109 @@ VOID AuthParmFill(
 
 	==========================================================================
  */
+#ifdef RTMP_MAC_PCI
+void ComposePsPoll(struct rt_rtmp_adapter *pAd)
+{
+	NdisZeroMemory(&pAd->PsPollFrame, sizeof(struct rt_pspoll_frame));
+	pAd->PsPollFrame.FC.Type = BTYPE_CNTL;
+	pAd->PsPollFrame.FC.SubType = SUBTYPE_PS_POLL;
+	pAd->PsPollFrame.Aid = pAd->StaActive.Aid | 0xC000;
+	COPY_MAC_ADDR(pAd->PsPollFrame.Bssid, pAd->CommonCfg.Bssid);
+	COPY_MAC_ADDR(pAd->PsPollFrame.Ta, pAd->CurrentAddress);
+}
 
-
-#ifdef RT2870
-
-VOID MlmeCntlConfirm(
-	IN PRTMP_ADAPTER pAd,
-	IN ULONG MsgType,
-	IN USHORT Msg)
+/* IRQL = DISPATCH_LEVEL */
+void ComposeNullFrame(struct rt_rtmp_adapter *pAd)
 {
-	MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MsgType, sizeof(USHORT), &Msg);
+	NdisZeroMemory(&pAd->NullFrame, sizeof(struct rt_header_802_11));
+	pAd->NullFrame.FC.Type = BTYPE_DATA;
+	pAd->NullFrame.FC.SubType = SUBTYPE_NULL_FUNC;
+	pAd->NullFrame.FC.ToDs = 1;
+	COPY_MAC_ADDR(pAd->NullFrame.Addr1, pAd->CommonCfg.Bssid);
+	COPY_MAC_ADDR(pAd->NullFrame.Addr2, pAd->CurrentAddress);
+	COPY_MAC_ADDR(pAd->NullFrame.Addr3, pAd->CommonCfg.Bssid);
+}
+#endif /* RTMP_MAC_PCI // */
+#ifdef RTMP_MAC_USB
+void MlmeCntlConfirm(struct rt_rtmp_adapter *pAd, unsigned long MsgType, u16 Msg)
+{
+	MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MsgType, sizeof(u16),
+		    &Msg);
 }
-#endif
 
-VOID ComposePsPoll(
-	IN PRTMP_ADAPTER pAd)
+void ComposePsPoll(struct rt_rtmp_adapter *pAd)
 {
-#ifdef RT2870
-	PTXINFO_STRUC		pTxInfo;
-	PTXWI_STRUC		pTxWI;
+	struct rt_txinfo *pTxInfo;
+	struct rt_txwi * pTxWI;
 
 	DBGPRINT(RT_DEBUG_TRACE, ("ComposePsPoll\n"));
-#endif
-	NdisZeroMemory(&pAd->PsPollFrame, sizeof(PSPOLL_FRAME));
+	NdisZeroMemory(&pAd->PsPollFrame, sizeof(struct rt_pspoll_frame));
 
-#ifdef RT2870
 	pAd->PsPollFrame.FC.PwrMgmt = 0;
-#endif
 	pAd->PsPollFrame.FC.Type = BTYPE_CNTL;
 	pAd->PsPollFrame.FC.SubType = SUBTYPE_PS_POLL;
 	pAd->PsPollFrame.Aid = pAd->StaActive.Aid | 0xC000;
 	COPY_MAC_ADDR(pAd->PsPollFrame.Bssid, pAd->CommonCfg.Bssid);
 	COPY_MAC_ADDR(pAd->PsPollFrame.Ta, pAd->CurrentAddress);
 
-#ifdef RT2870
-	RTMPZeroMemory(&pAd->PsPollContext.TransferBuffer->field.WirelessPacket[0], 100);
-	pTxInfo = (PTXINFO_STRUC)&pAd->PsPollContext.TransferBuffer->field.WirelessPacket[0];
-	RTMPWriteTxInfo(pAd, pTxInfo, (USHORT)(sizeof(PSPOLL_FRAME)+TXWI_SIZE), TRUE, EpToQueue[MGMTPIPEIDX], FALSE,  FALSE);
-	pTxWI = (PTXWI_STRUC)&pAd->PsPollContext.TransferBuffer->field.WirelessPacket[TXINFO_SIZE];
-	RTMPWriteTxWI(pAd, pTxWI, FALSE, FALSE, FALSE, FALSE, TRUE, FALSE, 0, BSSID_WCID, (sizeof(PSPOLL_FRAME)),
-		0,  0, (UCHAR)pAd->CommonCfg.MlmeTransmit.field.MCS, IFS_BACKOFF, FALSE, &pAd->CommonCfg.MlmeTransmit);
-	RTMPMoveMemory(&pAd->PsPollContext.TransferBuffer->field.WirelessPacket[TXWI_SIZE+TXINFO_SIZE], &pAd->PsPollFrame, sizeof(PSPOLL_FRAME));
-	// Append 4 extra zero bytes.
-	pAd->PsPollContext.BulkOutSize =  TXINFO_SIZE + TXWI_SIZE + sizeof(PSPOLL_FRAME) + 4;
-#endif
+	RTMPZeroMemory(&pAd->PsPollContext.TransferBuffer->field.
+		       WirelessPacket[0], 100);
+	pTxInfo =
+	    (struct rt_txinfo *)& pAd->PsPollContext.TransferBuffer->field.
+	    WirelessPacket[0];
+	RTMPWriteTxInfo(pAd, pTxInfo,
+			(u16)(sizeof(struct rt_pspoll_frame) + TXWI_SIZE), TRUE,
+			EpToQueue[MGMTPIPEIDX], FALSE, FALSE);
+	pTxWI =
+	    (struct rt_txwi *) & pAd->PsPollContext.TransferBuffer->field.
+	    WirelessPacket[TXINFO_SIZE];
+	RTMPWriteTxWI(pAd, pTxWI, FALSE, FALSE, FALSE, FALSE, TRUE, FALSE, 0,
+		      BSSID_WCID, (sizeof(struct rt_pspoll_frame)), 0, 0,
+		      (u8)pAd->CommonCfg.MlmeTransmit.field.MCS,
+		      IFS_BACKOFF, FALSE, &pAd->CommonCfg.MlmeTransmit);
+	RTMPMoveMemory(&pAd->PsPollContext.TransferBuffer->field.
+		       WirelessPacket[TXWI_SIZE + TXINFO_SIZE],
+		       &pAd->PsPollFrame, sizeof(struct rt_pspoll_frame));
+	/* Append 4 extra zero bytes. */
+	pAd->PsPollContext.BulkOutSize =
+	    TXINFO_SIZE + TXWI_SIZE + sizeof(struct rt_pspoll_frame) + 4;
 }
 
-// IRQL = DISPATCH_LEVEL
-VOID ComposeNullFrame(
-	IN PRTMP_ADAPTER pAd)
+/* IRQL = DISPATCH_LEVEL */
+void ComposeNullFrame(struct rt_rtmp_adapter *pAd)
 {
-#ifdef RT2870
-	PTXINFO_STRUC		pTxInfo;
-	PTXWI_STRUC		pTxWI;
-#endif
+	struct rt_txinfo *pTxInfo;
+	struct rt_txwi * pTxWI;
 
-	NdisZeroMemory(&pAd->NullFrame, sizeof(HEADER_802_11));
+	NdisZeroMemory(&pAd->NullFrame, sizeof(struct rt_header_802_11));
 	pAd->NullFrame.FC.Type = BTYPE_DATA;
 	pAd->NullFrame.FC.SubType = SUBTYPE_NULL_FUNC;
 	pAd->NullFrame.FC.ToDs = 1;
 	COPY_MAC_ADDR(pAd->NullFrame.Addr1, pAd->CommonCfg.Bssid);
 	COPY_MAC_ADDR(pAd->NullFrame.Addr2, pAd->CurrentAddress);
 	COPY_MAC_ADDR(pAd->NullFrame.Addr3, pAd->CommonCfg.Bssid);
-#ifdef RT2870
-	RTMPZeroMemory(&pAd->NullContext.TransferBuffer->field.WirelessPacket[0], 100);
-	pTxInfo = (PTXINFO_STRUC)&pAd->NullContext.TransferBuffer->field.WirelessPacket[0];
-	RTMPWriteTxInfo(pAd, pTxInfo, (USHORT)(sizeof(HEADER_802_11)+TXWI_SIZE), TRUE, EpToQueue[MGMTPIPEIDX], FALSE,  FALSE);
-	pTxWI = (PTXWI_STRUC)&pAd->NullContext.TransferBuffer->field.WirelessPacket[TXINFO_SIZE];
-	RTMPWriteTxWI(pAd, pTxWI, FALSE, FALSE, FALSE, FALSE, TRUE, FALSE, 0, BSSID_WCID, (sizeof(HEADER_802_11)),
-		0, 0, (UCHAR)pAd->CommonCfg.MlmeTransmit.field.MCS, IFS_BACKOFF, FALSE, &pAd->CommonCfg.MlmeTransmit);
-	RTMPMoveMemory(&pAd->NullContext.TransferBuffer->field.WirelessPacket[TXWI_SIZE+TXINFO_SIZE], &pAd->NullFrame, sizeof(HEADER_802_11));
-	pAd->NullContext.BulkOutSize =  TXINFO_SIZE + TXWI_SIZE + sizeof(pAd->NullFrame) + 4;
-#endif
+	RTMPZeroMemory(&pAd->NullContext.TransferBuffer->field.
+		       WirelessPacket[0], 100);
+	pTxInfo =
+	    (struct rt_txinfo *)& pAd->NullContext.TransferBuffer->field.
+	    WirelessPacket[0];
+	RTMPWriteTxInfo(pAd, pTxInfo,
+			(u16)(sizeof(struct rt_header_802_11) + TXWI_SIZE), TRUE,
+			EpToQueue[MGMTPIPEIDX], FALSE, FALSE);
+	pTxWI =
+	    (struct rt_txwi *) & pAd->NullContext.TransferBuffer->field.
+	    WirelessPacket[TXINFO_SIZE];
+	RTMPWriteTxWI(pAd, pTxWI, FALSE, FALSE, FALSE, FALSE, TRUE, FALSE, 0,
+		      BSSID_WCID, (sizeof(struct rt_header_802_11)), 0, 0,
+		      (u8)pAd->CommonCfg.MlmeTransmit.field.MCS,
+		      IFS_BACKOFF, FALSE, &pAd->CommonCfg.MlmeTransmit);
+	RTMPMoveMemory(&pAd->NullContext.TransferBuffer->field.
+		       WirelessPacket[TXWI_SIZE + TXINFO_SIZE], &pAd->NullFrame,
+		       sizeof(struct rt_header_802_11));
+	pAd->NullContext.BulkOutSize =
+	    TXINFO_SIZE + TXWI_SIZE + sizeof(pAd->NullFrame) + 4;
 }
-
-
-
+#endif /* RTMP_MAC_USB // */
 
 /*
 	==========================================================================
@@ -2397,73 +2458,71 @@ VOID ComposeNullFrame(
 
 	==========================================================================
 */
-ULONG MakeIbssBeacon(
-	IN PRTMP_ADAPTER pAd)
+unsigned long MakeIbssBeacon(struct rt_rtmp_adapter *pAd)
 {
-	UCHAR         DsLen = 1, IbssLen = 2;
-	UCHAR         LocalErpIe[3] = {IE_ERP, 1, 0x04};
-	HEADER_802_11 BcnHdr;
-	USHORT        CapabilityInfo;
+	u8 DsLen = 1, IbssLen = 2;
+	u8 LocalErpIe[3] = { IE_ERP, 1, 0x04 };
+	struct rt_header_802_11 BcnHdr;
+	u16 CapabilityInfo;
 	LARGE_INTEGER FakeTimestamp;
-	ULONG         FrameLen = 0;
-	PTXWI_STRUC	  pTxWI = &pAd->BeaconTxWI;
-	CHAR         *pBeaconFrame = pAd->BeaconBuf;
-	BOOLEAN       Privacy;
-	UCHAR         SupRate[MAX_LEN_OF_SUPPORTED_RATES];
-	UCHAR         SupRateLen = 0;
-	UCHAR         ExtRate[MAX_LEN_OF_SUPPORTED_RATES];
-	UCHAR         ExtRateLen = 0;
-	UCHAR         RSNIe = IE_WPA;
-
-	if ((pAd->CommonCfg.PhyMode == PHY_11B) && (pAd->CommonCfg.Channel <= 14))
-	{
-		SupRate[0] = 0x82; // 1 mbps
-		SupRate[1] = 0x84; // 2 mbps
-		SupRate[2] = 0x8b; // 5.5 mbps
-		SupRate[3] = 0x96; // 11 mbps
+	unsigned long FrameLen = 0;
+	struct rt_txwi * pTxWI = &pAd->BeaconTxWI;
+	u8 *pBeaconFrame = pAd->BeaconBuf;
+	BOOLEAN Privacy;
+	u8 SupRate[MAX_LEN_OF_SUPPORTED_RATES];
+	u8 SupRateLen = 0;
+	u8 ExtRate[MAX_LEN_OF_SUPPORTED_RATES];
+	u8 ExtRateLen = 0;
+	u8 RSNIe = IE_WPA;
+
+	if ((pAd->CommonCfg.PhyMode == PHY_11B)
+	    && (pAd->CommonCfg.Channel <= 14)) {
+		SupRate[0] = 0x82;	/* 1 mbps */
+		SupRate[1] = 0x84;	/* 2 mbps */
+		SupRate[2] = 0x8b;	/* 5.5 mbps */
+		SupRate[3] = 0x96;	/* 11 mbps */
 		SupRateLen = 4;
 		ExtRateLen = 0;
-	}
-	else if (pAd->CommonCfg.Channel > 14)
-	{
-		SupRate[0]  = 0x8C;    // 6 mbps, in units of 0.5 Mbps, basic rate
-		SupRate[1]  = 0x12;    // 9 mbps, in units of 0.5 Mbps
-		SupRate[2]  = 0x98;    // 12 mbps, in units of 0.5 Mbps, basic rate
-		SupRate[3]  = 0x24;    // 18 mbps, in units of 0.5 Mbps
-		SupRate[4]  = 0xb0;    // 24 mbps, in units of 0.5 Mbps, basic rate
-		SupRate[5]  = 0x48;    // 36 mbps, in units of 0.5 Mbps
-		SupRate[6]  = 0x60;    // 48 mbps, in units of 0.5 Mbps
-		SupRate[7]  = 0x6c;    // 54 mbps, in units of 0.5 Mbps
-		SupRateLen  = 8;
-		ExtRateLen  = 0;
-
-		//
-		// Also Update MlmeRate & RtsRate for G only & A only
-		//
+	} else if (pAd->CommonCfg.Channel > 14) {
+		SupRate[0] = 0x8C;	/* 6 mbps, in units of 0.5 Mbps, basic rate */
+		SupRate[1] = 0x12;	/* 9 mbps, in units of 0.5 Mbps */
+		SupRate[2] = 0x98;	/* 12 mbps, in units of 0.5 Mbps, basic rate */
+		SupRate[3] = 0x24;	/* 18 mbps, in units of 0.5 Mbps */
+		SupRate[4] = 0xb0;	/* 24 mbps, in units of 0.5 Mbps, basic rate */
+		SupRate[5] = 0x48;	/* 36 mbps, in units of 0.5 Mbps */
+		SupRate[6] = 0x60;	/* 48 mbps, in units of 0.5 Mbps */
+		SupRate[7] = 0x6c;	/* 54 mbps, in units of 0.5 Mbps */
+		SupRateLen = 8;
+		ExtRateLen = 0;
+
+		/* */
+		/* Also Update MlmeRate & RtsRate for G only & A only */
+		/* */
 		pAd->CommonCfg.MlmeRate = RATE_6;
 		pAd->CommonCfg.RtsRate = RATE_6;
 		pAd->CommonCfg.MlmeTransmit.field.MODE = MODE_OFDM;
-		pAd->CommonCfg.MlmeTransmit.field.MCS = OfdmRateToRxwiMCS[pAd->CommonCfg.MlmeRate];
-		pAd->MacTab.Content[BSS0Mcast_WCID].HTPhyMode.field.MODE = MODE_OFDM;
-		pAd->MacTab.Content[BSS0Mcast_WCID].HTPhyMode.field.MCS = OfdmRateToRxwiMCS[pAd->CommonCfg.MlmeRate];
-	}
-	else
-	{
-		SupRate[0] = 0x82; // 1 mbps
-		SupRate[1] = 0x84; // 2 mbps
-		SupRate[2] = 0x8b; // 5.5 mbps
-		SupRate[3] = 0x96; // 11 mbps
+		pAd->CommonCfg.MlmeTransmit.field.MCS =
+		    OfdmRateToRxwiMCS[pAd->CommonCfg.MlmeRate];
+		pAd->MacTab.Content[BSS0Mcast_WCID].HTPhyMode.field.MODE =
+		    MODE_OFDM;
+		pAd->MacTab.Content[BSS0Mcast_WCID].HTPhyMode.field.MCS =
+		    OfdmRateToRxwiMCS[pAd->CommonCfg.MlmeRate];
+	} else {
+		SupRate[0] = 0x82;	/* 1 mbps */
+		SupRate[1] = 0x84;	/* 2 mbps */
+		SupRate[2] = 0x8b;	/* 5.5 mbps */
+		SupRate[3] = 0x96;	/* 11 mbps */
 		SupRateLen = 4;
 
-		ExtRate[0]  = 0x0C;    // 6 mbps, in units of 0.5 Mbps,
-		ExtRate[1]  = 0x12;    // 9 mbps, in units of 0.5 Mbps
-		ExtRate[2]  = 0x18;    // 12 mbps, in units of 0.5 Mbps,
-		ExtRate[3]  = 0x24;    // 18 mbps, in units of 0.5 Mbps
-		ExtRate[4]  = 0x30;    // 24 mbps, in units of 0.5 Mbps,
-		ExtRate[5]  = 0x48;    // 36 mbps, in units of 0.5 Mbps
-		ExtRate[6]  = 0x60;    // 48 mbps, in units of 0.5 Mbps
-		ExtRate[7]  = 0x6c;    // 54 mbps, in units of 0.5 Mbps
-		ExtRateLen  = 8;
+		ExtRate[0] = 0x0C;	/* 6 mbps, in units of 0.5 Mbps, */
+		ExtRate[1] = 0x12;	/* 9 mbps, in units of 0.5 Mbps */
+		ExtRate[2] = 0x18;	/* 12 mbps, in units of 0.5 Mbps, */
+		ExtRate[3] = 0x24;	/* 18 mbps, in units of 0.5 Mbps */
+		ExtRate[4] = 0x30;	/* 24 mbps, in units of 0.5 Mbps, */
+		ExtRate[5] = 0x48;	/* 36 mbps, in units of 0.5 Mbps */
+		ExtRate[6] = 0x60;	/* 48 mbps, in units of 0.5 Mbps */
+		ExtRate[7] = 0x6c;	/* 54 mbps, in units of 0.5 Mbps */
+		ExtRateLen = 8;
 	}
 
 	pAd->StaActive.SupRateLen = SupRateLen;
@@ -2471,99 +2530,96 @@ ULONG MakeIbssBeacon(
 	pAd->StaActive.ExtRateLen = ExtRateLen;
 	NdisMoveMemory(pAd->StaActive.ExtRate, ExtRate, ExtRateLen);
 
-	// compose IBSS beacon frame
-	MgtMacHeaderInit(pAd, &BcnHdr, SUBTYPE_BEACON, 0, BROADCAST_ADDR, pAd->CommonCfg.Bssid);
-	Privacy = (pAd->StaCfg.WepStatus == Ndis802_11Encryption1Enabled) ||
-			  (pAd->StaCfg.WepStatus == Ndis802_11Encryption2Enabled) ||
-			  (pAd->StaCfg.WepStatus == Ndis802_11Encryption3Enabled);
-	CapabilityInfo = CAP_GENERATE(0, 1, Privacy, (pAd->CommonCfg.TxPreamble == Rt802_11PreambleShort), 0, 0);
-
-	MakeOutgoingFrame(pBeaconFrame,                &FrameLen,
-					  sizeof(HEADER_802_11),           &BcnHdr,
-					  TIMESTAMP_LEN,                   &FakeTimestamp,
-					  2,                               &pAd->CommonCfg.BeaconPeriod,
-					  2,                               &CapabilityInfo,
-					  1,                               &SsidIe,
-					  1,                               &pAd->CommonCfg.SsidLen,
-					  pAd->CommonCfg.SsidLen,          pAd->CommonCfg.Ssid,
-					  1,                               &SupRateIe,
-					  1,                               &SupRateLen,
-					  SupRateLen,                      SupRate,
-					  1,                               &DsIe,
-					  1,                               &DsLen,
-					  1,                               &pAd->CommonCfg.Channel,
-					  1,                               &IbssIe,
-					  1,                               &IbssLen,
-					  2,                               &pAd->StaActive.AtimWin,
-					  END_OF_ARGS);
-
-	// add ERP_IE and EXT_RAE IE of in 802.11g
-	if (ExtRateLen)
-	{
-		ULONG	tmp;
-
-		MakeOutgoingFrame(pBeaconFrame + FrameLen,         &tmp,
-						  3,                               LocalErpIe,
-						  1,                               &ExtRateIe,
-						  1,                               &ExtRateLen,
-						  ExtRateLen,                      ExtRate,
-						  END_OF_ARGS);
+	/* compose IBSS beacon frame */
+	MgtMacHeaderInit(pAd, &BcnHdr, SUBTYPE_BEACON, 0, BROADCAST_ADDR,
+			 pAd->CommonCfg.Bssid);
+	Privacy = (pAd->StaCfg.WepStatus == Ndis802_11Encryption1Enabled)
+	    || (pAd->StaCfg.WepStatus == Ndis802_11Encryption2Enabled)
+	    || (pAd->StaCfg.WepStatus == Ndis802_11Encryption3Enabled);
+	CapabilityInfo =
+	    CAP_GENERATE(0, 1, Privacy,
+			 (pAd->CommonCfg.TxPreamble == Rt802_11PreambleShort),
+			 0, 0);
+
+	MakeOutgoingFrame(pBeaconFrame, &FrameLen,
+			  sizeof(struct rt_header_802_11), &BcnHdr,
+			  TIMESTAMP_LEN, &FakeTimestamp,
+			  2, &pAd->CommonCfg.BeaconPeriod,
+			  2, &CapabilityInfo,
+			  1, &SsidIe,
+			  1, &pAd->CommonCfg.SsidLen,
+			  pAd->CommonCfg.SsidLen, pAd->CommonCfg.Ssid,
+			  1, &SupRateIe,
+			  1, &SupRateLen,
+			  SupRateLen, SupRate,
+			  1, &DsIe,
+			  1, &DsLen,
+			  1, &pAd->CommonCfg.Channel,
+			  1, &IbssIe,
+			  1, &IbssLen, 2, &pAd->StaActive.AtimWin, END_OF_ARGS);
+
+	/* add ERP_IE and EXT_RAE IE of in 802.11g */
+	if (ExtRateLen) {
+		unsigned long tmp;
+
+		MakeOutgoingFrame(pBeaconFrame + FrameLen, &tmp,
+				  3, LocalErpIe,
+				  1, &ExtRateIe,
+				  1, &ExtRateLen,
+				  ExtRateLen, ExtRate, END_OF_ARGS);
 		FrameLen += tmp;
 	}
-
-	// If adhoc secruity is set for WPA-None, append the cipher suite IE
-	if (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPANone)
-	{
-		ULONG tmp;
-        RTMPMakeRSNIE(pAd, pAd->StaCfg.AuthMode, pAd->StaCfg.WepStatus, BSS0);
-
-		MakeOutgoingFrame(pBeaconFrame + FrameLen,        	&tmp,
-						  1,                              	&RSNIe,
-						  1,                            	&pAd->StaCfg.RSNIE_Len,
-						  pAd->StaCfg.RSNIE_Len,      		pAd->StaCfg.RSN_IE,
-						  END_OF_ARGS);
+	/* If adhoc secruity is set for WPA-None, append the cipher suite IE */
+	if (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPANone) {
+		unsigned long tmp;
+		RTMPMakeRSNIE(pAd, pAd->StaCfg.AuthMode, pAd->StaCfg.WepStatus,
+			      BSS0);
+
+		MakeOutgoingFrame(pBeaconFrame + FrameLen, &tmp,
+				  1, &RSNIe,
+				  1, &pAd->StaCfg.RSNIE_Len,
+				  pAd->StaCfg.RSNIE_Len, pAd->StaCfg.RSN_IE,
+				  END_OF_ARGS);
 		FrameLen += tmp;
 	}
 
-	if ((pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED))
-	{
-		ULONG TmpLen;
-		UCHAR HtLen, HtLen1;
+	if ((pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED)) {
+		unsigned long TmpLen;
+		u8 HtLen, HtLen1;
 
-		// add HT Capability IE
+		/* add HT Capability IE */
 		HtLen = sizeof(pAd->CommonCfg.HtCapability);
 		HtLen1 = sizeof(pAd->CommonCfg.AddHTInfo);
 
-		MakeOutgoingFrame(pBeaconFrame+FrameLen,	&TmpLen,
-						  1,						&HtCapIe,
-						  1,						&HtLen,
-						  HtLen,					&pAd->CommonCfg.HtCapability,
-						  1,						&AddHtInfoIe,
-						  1,						&HtLen1,
-						  HtLen1,					&pAd->CommonCfg.AddHTInfo,
-						  END_OF_ARGS);
+		MakeOutgoingFrame(pBeaconFrame + FrameLen, &TmpLen,
+				  1, &HtCapIe,
+				  1, &HtLen,
+				  HtLen, &pAd->CommonCfg.HtCapability,
+				  1, &AddHtInfoIe,
+				  1, &HtLen1,
+				  HtLen1, &pAd->CommonCfg.AddHTInfo,
+				  END_OF_ARGS);
 
 		FrameLen += TmpLen;
 	}
-
-	//beacon use reserved WCID 0xff
-    if (pAd->CommonCfg.Channel > 14)
-    {
-	RTMPWriteTxWI(pAd, pTxWI, FALSE, FALSE,  TRUE, FALSE, FALSE, TRUE, 0, 0xff, FrameLen,
-		PID_MGMT, PID_BEACON, RATE_1, IFS_HTTXOP, FALSE, &pAd->CommonCfg.MlmeTransmit);
-    }
-    else
-    {
-        // Set to use 1Mbps for Adhoc beacon.
+	/*beacon use reserved WCID 0xff */
+	if (pAd->CommonCfg.Channel > 14) {
+		RTMPWriteTxWI(pAd, pTxWI, FALSE, FALSE, TRUE, FALSE, FALSE,
+			      TRUE, 0, 0xff, FrameLen, PID_MGMT, PID_BEACON,
+			      RATE_1, IFS_HTTXOP, FALSE,
+			      &pAd->CommonCfg.MlmeTransmit);
+	} else {
+		/* Set to use 1Mbps for Adhoc beacon. */
 		HTTRANSMIT_SETTING Transmit;
-        Transmit.word = 0;
-        RTMPWriteTxWI(pAd, pTxWI, FALSE, FALSE,  TRUE, FALSE, FALSE, TRUE, 0, 0xff, FrameLen,
-    		PID_MGMT, PID_BEACON, RATE_1, IFS_HTTXOP, FALSE, &Transmit);
-    }
+		Transmit.word = 0;
+		RTMPWriteTxWI(pAd, pTxWI, FALSE, FALSE, TRUE, FALSE, FALSE,
+			      TRUE, 0, 0xff, FrameLen, PID_MGMT, PID_BEACON,
+			      RATE_1, IFS_HTTXOP, FALSE, &Transmit);
+	}
 
-    DBGPRINT(RT_DEBUG_TRACE, ("MakeIbssBeacon (len=%ld), SupRateLen=%d, ExtRateLen=%d, Channel=%d, PhyMode=%d\n",
-					FrameLen, SupRateLen, ExtRateLen, pAd->CommonCfg.Channel, pAd->CommonCfg.PhyMode));
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("MakeIbssBeacon (len=%ld), SupRateLen=%d, ExtRateLen=%d, Channel=%d, PhyMode=%d\n",
+		  FrameLen, SupRateLen, ExtRateLen, pAd->CommonCfg.Channel,
+		  pAd->CommonCfg.PhyMode));
 	return FrameLen;
 }
-
-
diff --git a/drivers/staging/rt2860/sta/rtmp_data.c b/drivers/staging/rt2860/sta/rtmp_data.c
index f751ab61c438..5d348e9d9b79 100644
--- a/drivers/staging/rt2860/sta/rtmp_data.c
+++ b/drivers/staging/rt2860/sta/rtmp_data.c
@@ -33,111 +33,167 @@
 	Revision History:
 	Who 		When			What
 	--------	----------		----------------------------------------------
-	John		      Aug/17/04		major modification for RT2561/2661
-	Jan Lee	      Mar/17/06		major modification for RT2860 New Ring Design
 */
 #include "../rt_config.h"
 
-
-
-VOID STARxEAPOLFrameIndicate(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	MAC_TABLE_ENTRY	*pEntry,
-	IN	RX_BLK			*pRxBlk,
-	IN	UCHAR			FromWhichBSSID)
+void STARxEAPOLFrameIndicate(struct rt_rtmp_adapter *pAd,
+			     struct rt_mac_table_entry *pEntry,
+			     struct rt_rx_blk *pRxBlk, u8 FromWhichBSSID)
 {
-	PRT28XX_RXD_STRUC	pRxD = &(pRxBlk->RxD);
-	PRXWI_STRUC		pRxWI = pRxBlk->pRxWI;
-	UCHAR			*pTmpBuf;
-
-	if (pAd->StaCfg.WpaSupplicantUP)
-	{
-		// All EAPoL frames have to pass to upper layer (ex. WPA_SUPPLICANT daemon)
-		// TBD : process fragmented EAPol frames
-		{
-			// In 802.1x mode, if the received frame is EAP-SUCCESS packet, turn on the PortSecured variable
-			if ( pAd->StaCfg.IEEE8021X == TRUE &&
-				 (EAP_CODE_SUCCESS == WpaCheckEapCode(pAd, pRxBlk->pData, pRxBlk->DataSize, LENGTH_802_1_H)))
-			{
-				PUCHAR	Key;
-				UCHAR 	CipherAlg;
-				int     idx = 0;
-
-				DBGPRINT_RAW(RT_DEBUG_TRACE, ("Receive EAP-SUCCESS Packet\n"));
+	PRT28XX_RXD_STRUC pRxD = &(pRxBlk->RxD);
+	struct rt_rxwi * pRxWI = pRxBlk->pRxWI;
+	u8 *pTmpBuf;
+
+	if (pAd->StaCfg.WpaSupplicantUP) {
+		/* All EAPoL frames have to pass to upper layer (ex. WPA_SUPPLICANT daemon) */
+		/* TBD : process fragmented EAPol frames */
+		{
+			/* In 802.1x mode, if the received frame is EAP-SUCCESS packet, turn on the PortSecured variable */
+			if (pAd->StaCfg.IEEE8021X == TRUE &&
+			    (EAP_CODE_SUCCESS ==
+			     WpaCheckEapCode(pAd, pRxBlk->pData,
+					     pRxBlk->DataSize,
+					     LENGTH_802_1_H))) {
+				u8 *Key;
+				u8 CipherAlg;
+				int idx = 0;
+
+				DBGPRINT_RAW(RT_DEBUG_TRACE,
+					     ("Receive EAP-SUCCESS Packet\n"));
+				/*pAd->StaCfg.PortSecured = WPA_802_1X_PORT_SECURED; */
 				STA_PORT_SECURED(pAd);
 
-                if (pAd->StaCfg.IEEE8021x_required_keys == FALSE)
-                {
-                    idx = pAd->StaCfg.DesireSharedKeyId;
-                    CipherAlg = pAd->StaCfg.DesireSharedKey[idx].CipherAlg;
-					Key = pAd->StaCfg.DesireSharedKey[idx].Key;
-
-                    if (pAd->StaCfg.DesireSharedKey[idx].KeyLen > 0)
-    				{
-#ifdef RT2860
-						MAC_TABLE_ENTRY *pEntry = &pAd->MacTab.Content[BSSID_WCID];
-
-						// Set key material and cipherAlg to Asic
-						AsicAddSharedKeyEntry(pAd, BSS0, idx, CipherAlg, Key, NULL, NULL);
-
-						// Assign group key info
-						RTMPAddWcidAttributeEntry(pAd, BSS0, idx, CipherAlg, NULL);
-
-						// Assign pairwise key info
-						RTMPAddWcidAttributeEntry(pAd, BSS0, idx, CipherAlg, pEntry);
-
-                        pAd->IndicateMediaState = NdisMediaStateConnected;
-                        pAd->ExtraInfo = GENERAL_LINK_UP;
-#endif
-#ifdef RT2870
-						union
-						{
-							char buf[sizeof(NDIS_802_11_WEP)+MAX_LEN_OF_KEY- 1];
-							NDIS_802_11_WEP keyinfo;
-						}  WepKey;
+				if (pAd->StaCfg.IEEE8021x_required_keys ==
+				    FALSE) {
+					idx = pAd->StaCfg.DesireSharedKeyId;
+					CipherAlg =
+					    pAd->StaCfg.DesireSharedKey[idx].
+					    CipherAlg;
+					Key =
+					    pAd->StaCfg.DesireSharedKey[idx].
+					    Key;
+
+					if (pAd->StaCfg.DesireSharedKey[idx].
+					    KeyLen > 0) {
+#ifdef RTMP_MAC_PCI
+						struct rt_mac_table_entry *pEntry =
+						    &pAd->MacTab.
+						    Content[BSSID_WCID];
+
+						/* Set key material and cipherAlg to Asic */
+						AsicAddSharedKeyEntry(pAd, BSS0,
+								      idx,
+								      CipherAlg,
+								      Key, NULL,
+								      NULL);
+
+						/* Assign group key info */
+						RTMPAddWcidAttributeEntry(pAd,
+									  BSS0,
+									  idx,
+									  CipherAlg,
+									  NULL);
+
+						/* Assign pairwise key info */
+						RTMPAddWcidAttributeEntry(pAd,
+									  BSS0,
+									  idx,
+									  CipherAlg,
+									  pEntry);
+
+						pAd->IndicateMediaState =
+						    NdisMediaStateConnected;
+						pAd->ExtraInfo =
+						    GENERAL_LINK_UP;
+#endif /* RTMP_MAC_PCI // */
+#ifdef RTMP_MAC_USB
+						union {
+							char buf[sizeof
+								 (struct rt_ndis_802_11_wep)
+								 +
+								 MAX_LEN_OF_KEY
+								 - 1];
+							struct rt_ndis_802_11_wep keyinfo;
+						}
+						WepKey;
 						int len;
 
-
-						NdisZeroMemory(&WepKey, sizeof(WepKey));
-						len =pAd->StaCfg.DesireSharedKey[idx].KeyLen;
-
-						NdisMoveMemory(WepKey.keyinfo.KeyMaterial,
-							pAd->StaCfg.DesireSharedKey[idx].Key,
-							pAd->StaCfg.DesireSharedKey[idx].KeyLen);
-
-						WepKey.keyinfo.KeyIndex = 0x80000000 + idx;
+						NdisZeroMemory(&WepKey,
+							       sizeof(WepKey));
+						len =
+						    pAd->StaCfg.
+						    DesireSharedKey[idx].KeyLen;
+
+						NdisMoveMemory(WepKey.keyinfo.
+							       KeyMaterial,
+							       pAd->StaCfg.
+							       DesireSharedKey
+							       [idx].Key,
+							       pAd->StaCfg.
+							       DesireSharedKey
+							       [idx].KeyLen);
+
+						WepKey.keyinfo.KeyIndex =
+						    0x80000000 + idx;
 						WepKey.keyinfo.KeyLength = len;
-						pAd->SharedKey[BSS0][idx].KeyLen =(UCHAR) (len <= 5 ? 5 : 13);
-
-						pAd->IndicateMediaState = NdisMediaStateConnected;
-						pAd->ExtraInfo = GENERAL_LINK_UP;
-						// need to enqueue cmd to thread
-						RTUSBEnqueueCmdFromNdis(pAd, OID_802_11_ADD_WEP, TRUE, &WepKey, sizeof(WepKey.keyinfo) + len - 1);
-#endif // RT2870 //
-						// For Preventing ShardKey Table is cleared by remove key procedure.
-    					pAd->SharedKey[BSS0][idx].CipherAlg = CipherAlg;
-						pAd->SharedKey[BSS0][idx].KeyLen = pAd->StaCfg.DesireSharedKey[idx].KeyLen;
-						NdisMoveMemory(pAd->SharedKey[BSS0][idx].Key,
-									   pAd->StaCfg.DesireSharedKey[idx].Key,
-									   pAd->StaCfg.DesireSharedKey[idx].KeyLen);
-    				}
+						pAd->SharedKey[BSS0][idx].
+						    KeyLen =
+						    (u8)(len <= 5 ? 5 : 13);
+
+						pAd->IndicateMediaState =
+						    NdisMediaStateConnected;
+						pAd->ExtraInfo =
+						    GENERAL_LINK_UP;
+						/* need to enqueue cmd to thread */
+						RTUSBEnqueueCmdFromNdis(pAd,
+									OID_802_11_ADD_WEP,
+									TRUE,
+									&WepKey,
+									sizeof
+									(WepKey.
+									 keyinfo)
+									+ len -
+									1);
+#endif /* RTMP_MAC_USB // */
+						/* For Preventing ShardKey Table is cleared by remove key procedure. */
+						pAd->SharedKey[BSS0][idx].
+						    CipherAlg = CipherAlg;
+						pAd->SharedKey[BSS0][idx].
+						    KeyLen =
+						    pAd->StaCfg.
+						    DesireSharedKey[idx].KeyLen;
+						NdisMoveMemory(pAd->
+							       SharedKey[BSS0]
+							       [idx].Key,
+							       pAd->StaCfg.
+							       DesireSharedKey
+							       [idx].Key,
+							       pAd->StaCfg.
+							       DesireSharedKey
+							       [idx].KeyLen);
+					}
 				}
 			}
 
 			Indicate_Legacy_Packet(pAd, pRxBlk, FromWhichBSSID);
 			return;
 		}
-	}
-	else
-	{
-		// Special DATA frame that has to pass to MLME
-		//	 1. Cisco Aironet frames for CCX2. We need pass it to MLME for special process
-		//	 2. EAPOL handshaking frames when driver supplicant enabled, pass to MLME for special process
+	} else {
+		/* Special DATA frame that has to pass to MLME */
+		/*       1. Cisco Aironet frames for CCX2. We need pass it to MLME for special process */
+		/*       2. EAPOL handshaking frames when driver supplicant enabled, pass to MLME for special process */
 		{
 			pTmpBuf = pRxBlk->pData - LENGTH_802_11;
 			NdisMoveMemory(pTmpBuf, pRxBlk->pHeader, LENGTH_802_11);
-			REPORT_MGMT_FRAME_TO_MLME(pAd, pRxWI->WirelessCliID, pTmpBuf, pRxBlk->DataSize + LENGTH_802_11, pRxWI->RSSI0, pRxWI->RSSI1, pRxWI->RSSI2, pRxD->PlcpSignal);
-			DBGPRINT_RAW(RT_DEBUG_TRACE, ("!!! report EAPOL/AIRONET DATA to MLME (len=%d) !!!\n", pRxBlk->DataSize));
+			REPORT_MGMT_FRAME_TO_MLME(pAd, pRxWI->WirelessCliID,
+						  pTmpBuf,
+						  pRxBlk->DataSize +
+						  LENGTH_802_11, pRxWI->RSSI0,
+						  pRxWI->RSSI1, pRxWI->RSSI2,
+						  pRxD->PlcpSignal);
+			DBGPRINT_RAW(RT_DEBUG_TRACE,
+				     ("report EAPOL/AIRONET DATA to MLME (len=%d) !\n",
+				      pRxBlk->DataSize));
 		}
 	}
 
@@ -146,495 +202,483 @@ VOID STARxEAPOLFrameIndicate(
 
 }
 
-VOID STARxDataFrameAnnounce(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	MAC_TABLE_ENTRY	*pEntry,
-	IN	RX_BLK			*pRxBlk,
-	IN	UCHAR			FromWhichBSSID)
+void STARxDataFrameAnnounce(struct rt_rtmp_adapter *pAd,
+			    struct rt_mac_table_entry *pEntry,
+			    struct rt_rx_blk *pRxBlk, u8 FromWhichBSSID)
 {
 
-	// non-EAP frame
-	if (!RTMPCheckWPAframe(pAd, pEntry, pRxBlk->pData, pRxBlk->DataSize, FromWhichBSSID))
-	{
-		{
-			// drop all non-EAP DATA frame before
-			// this client's Port-Access-Control is secured
-			if (pRxBlk->pHeader->FC.Wep)
-			{
-				// unsupported cipher suite
-				if (pAd->StaCfg.WepStatus == Ndis802_11EncryptionDisabled)
-				{
-					// release packet
-					RELEASE_NDIS_PACKET(pAd, pRxBlk->pRxPacket, NDIS_STATUS_FAILURE);
+	/* non-EAP frame */
+	if (!RTMPCheckWPAframe
+	    (pAd, pEntry, pRxBlk->pData, pRxBlk->DataSize, FromWhichBSSID)) {
+
+		{
+			/* drop all non-EAP DATA frame before */
+			/* this client's Port-Access-Control is secured */
+			if (pRxBlk->pHeader->FC.Wep) {
+				/* unsupported cipher suite */
+				if (pAd->StaCfg.WepStatus ==
+				    Ndis802_11EncryptionDisabled) {
+					/* release packet */
+					RELEASE_NDIS_PACKET(pAd,
+							    pRxBlk->pRxPacket,
+							    NDIS_STATUS_FAILURE);
 					return;
 				}
-			}
-			else
-			{
-				// encryption in-use but receive a non-EAPOL clear text frame, drop it
-				if ((pAd->StaCfg.WepStatus != Ndis802_11EncryptionDisabled) &&
-					(pAd->StaCfg.PortSecured == WPA_802_1X_PORT_NOT_SECURED))
-				{
-					// release packet
-					RELEASE_NDIS_PACKET(pAd, pRxBlk->pRxPacket, NDIS_STATUS_FAILURE);
+			} else {
+				/* encryption in-use but receive a non-EAPOL clear text frame, drop it */
+				if ((pAd->StaCfg.WepStatus !=
+				     Ndis802_11EncryptionDisabled)
+				    && (pAd->StaCfg.PortSecured ==
+					WPA_802_1X_PORT_NOT_SECURED)) {
+					/* release packet */
+					RELEASE_NDIS_PACKET(pAd,
+							    pRxBlk->pRxPacket,
+							    NDIS_STATUS_FAILURE);
 					return;
 				}
 			}
 		}
 		RX_BLK_CLEAR_FLAG(pRxBlk, fRX_EAP);
-		if (!RX_BLK_TEST_FLAG(pRxBlk, fRX_ARALINK))
-		{
-			// Normal legacy, AMPDU or AMSDU
-			CmmRxnonRalinkFrameIndicate(pAd, pRxBlk, FromWhichBSSID);
+		if (!RX_BLK_TEST_FLAG(pRxBlk, fRX_ARALINK)) {
+			/* Normal legacy, AMPDU or AMSDU */
+			CmmRxnonRalinkFrameIndicate(pAd, pRxBlk,
+						    FromWhichBSSID);
 
+		} else {
+			/* ARALINK */
+			CmmRxRalinkFrameIndicate(pAd, pEntry, pRxBlk,
+						 FromWhichBSSID);
 		}
-		else
-		{
-			// ARALINK
-			CmmRxRalinkFrameIndicate(pAd, pEntry, pRxBlk, FromWhichBSSID);
-		}
-	}
-	else
-	{
+	} else {
 		RX_BLK_SET_FLAG(pRxBlk, fRX_EAP);
 
-		if (RX_BLK_TEST_FLAG(pRxBlk, fRX_AMPDU) && (pAd->CommonCfg.bDisableReordering == 0))
-		{
+		if (RX_BLK_TEST_FLAG(pRxBlk, fRX_AMPDU)
+		    && (pAd->CommonCfg.bDisableReordering == 0)) {
 			Indicate_AMPDU_Packet(pAd, pRxBlk, FromWhichBSSID);
-		}
-		else
-		{
-			// Determin the destination of the EAP frame
-			//  to WPA state machine or upper layer
-			STARxEAPOLFrameIndicate(pAd, pEntry, pRxBlk, FromWhichBSSID);
+		} else {
+			/* Determin the destination of the EAP frame */
+			/*  to WPA state machine or upper layer */
+			STARxEAPOLFrameIndicate(pAd, pEntry, pRxBlk,
+						FromWhichBSSID);
 		}
 	}
 }
 
-
-// For TKIP frame, calculate the MIC value
-BOOLEAN STACheckTkipMICValue(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	MAC_TABLE_ENTRY	*pEntry,
-	IN	RX_BLK			*pRxBlk)
+/* For TKIP frame, calculate the MIC value */
+BOOLEAN STACheckTkipMICValue(struct rt_rtmp_adapter *pAd,
+			     struct rt_mac_table_entry *pEntry, struct rt_rx_blk *pRxBlk)
 {
-	PHEADER_802_11	pHeader = pRxBlk->pHeader;
-	UCHAR			*pData = pRxBlk->pData;
-	USHORT			DataSize = pRxBlk->DataSize;
-	UCHAR			UserPriority = pRxBlk->UserPriority;
-	PCIPHER_KEY		pWpaKey;
-	UCHAR			*pDA, *pSA;
+	struct rt_header_802_11 * pHeader = pRxBlk->pHeader;
+	u8 *pData = pRxBlk->pData;
+	u16 DataSize = pRxBlk->DataSize;
+	u8 UserPriority = pRxBlk->UserPriority;
+	struct rt_cipher_key *pWpaKey;
+	u8 *pDA, *pSA;
 
 	pWpaKey = &pAd->SharedKey[BSS0][pRxBlk->pRxWI->KeyIndex];
 
 	pDA = pHeader->Addr1;
-	if (RX_BLK_TEST_FLAG(pRxBlk, fRX_INFRA))
-	{
+	if (RX_BLK_TEST_FLAG(pRxBlk, fRX_INFRA)) {
 		pSA = pHeader->Addr3;
-	}
-	else
-	{
+	} else {
 		pSA = pHeader->Addr2;
 	}
 
 	if (RTMPTkipCompareMICValue(pAd,
-								pData,
-								pDA,
-								pSA,
-								pWpaKey->RxMic,
-								UserPriority,
-								DataSize) == FALSE)
-	{
-		DBGPRINT_RAW(RT_DEBUG_ERROR,("Rx MIC Value error 2\n"));
-
-		if (pAd->StaCfg.WpaSupplicantUP)
-		{
-			WpaSendMicFailureToWpaSupplicant(pAd, (pWpaKey->Type == PAIRWISEKEY) ? TRUE : FALSE);
-		}
-		else
-		{
+				    pData,
+				    pDA,
+				    pSA,
+				    pWpaKey->RxMic,
+				    UserPriority, DataSize) == FALSE) {
+		DBGPRINT_RAW(RT_DEBUG_ERROR, ("Rx MIC Value error 2\n"));
+
+		if (pAd->StaCfg.WpaSupplicantUP) {
+			WpaSendMicFailureToWpaSupplicant(pAd,
+							 (pWpaKey->Type ==
+							  PAIRWISEKEY) ? TRUE :
+							 FALSE);
+		} else {
 			RTMPReportMicError(pAd, pWpaKey);
 		}
 
-		// release packet
-		RELEASE_NDIS_PACKET(pAd, pRxBlk->pRxPacket, NDIS_STATUS_FAILURE);
+		/* release packet */
+		RELEASE_NDIS_PACKET(pAd, pRxBlk->pRxPacket,
+				    NDIS_STATUS_FAILURE);
 		return FALSE;
 	}
 
 	return TRUE;
 }
 
-
-//
-// All Rx routines use RX_BLK structure to hande rx events
-// It is very important to build pRxBlk attributes
-//  1. pHeader pointer to 802.11 Header
-//  2. pData pointer to payload including LLC (just skip Header)
-//  3. set payload size including LLC to DataSize
-//  4. set some flags with RX_BLK_SET_FLAG()
-//
-VOID STAHandleRxDataFrame(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	RX_BLK			*pRxBlk)
+/* */
+/* All Rx routines use struct rt_rx_blk structure to hande rx events */
+/* It is very important to build pRxBlk attributes */
+/*  1. pHeader pointer to 802.11 Header */
+/*  2. pData pointer to payload including LLC (just skip Header) */
+/*  3. set payload size including LLC to DataSize */
+/*  4. set some flags with RX_BLK_SET_FLAG() */
+/* */
+void STAHandleRxDataFrame(struct rt_rtmp_adapter *pAd, struct rt_rx_blk *pRxBlk)
 {
-	PRT28XX_RXD_STRUC				pRxD = &(pRxBlk->RxD);
-	PRXWI_STRUC						pRxWI = pRxBlk->pRxWI;
-	PHEADER_802_11					pHeader = pRxBlk->pHeader;
-	PNDIS_PACKET					pRxPacket = pRxBlk->pRxPacket;
-	BOOLEAN 						bFragment = FALSE;
-	MAC_TABLE_ENTRY	    			*pEntry = NULL;
-	UCHAR							FromWhichBSSID = BSS0;
-	UCHAR                           UserPriority = 0;
+	PRT28XX_RXD_STRUC pRxD = &(pRxBlk->RxD);
+	struct rt_rxwi * pRxWI = pRxBlk->pRxWI;
+	struct rt_header_802_11 * pHeader = pRxBlk->pHeader;
+	void *pRxPacket = pRxBlk->pRxPacket;
+	BOOLEAN bFragment = FALSE;
+	struct rt_mac_table_entry *pEntry = NULL;
+	u8 FromWhichBSSID = BSS0;
+	u8 UserPriority = 0;
 
 	{
-		// before LINK UP, all DATA frames are rejected
-		if (!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED))
-		{
-			// release packet
-			RELEASE_NDIS_PACKET(pAd, pRxPacket, NDIS_STATUS_FAILURE);
+		/* before LINK UP, all DATA frames are rejected */
+		if (!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED)) {
+			/* release packet */
+			RELEASE_NDIS_PACKET(pAd, pRxPacket,
+					    NDIS_STATUS_FAILURE);
 			return;
 		}
-
-		// Drop not my BSS frames
-		if (pRxD->MyBss == 0)
-		{
+		/* Drop not my BSS frames */
+		if (pRxD->MyBss == 0) {
 			{
-				// release packet
-				RELEASE_NDIS_PACKET(pAd, pRxPacket, NDIS_STATUS_FAILURE);
+				/* release packet */
+				RELEASE_NDIS_PACKET(pAd, pRxPacket,
+						    NDIS_STATUS_FAILURE);
 				return;
 			}
 		}
 
 		pAd->RalinkCounters.RxCountSinceLastNULL++;
-		if (pAd->CommonCfg.bAPSDCapable && pAd->CommonCfg.APEdcaParm.bAPSDCapable && (pHeader->FC.SubType & 0x08))
-		{
-			UCHAR *pData;
-			DBGPRINT(RT_DEBUG_TRACE,("bAPSDCapable\n"));
-
-			// Qos bit 4
-			pData = (PUCHAR)pHeader + LENGTH_802_11;
-			if ((*pData >> 4) & 0x01)
-			{
-				DBGPRINT(RT_DEBUG_TRACE,("RxDone- Rcv EOSP frame, driver may fall into sleep\n"));
+		if (pAd->CommonCfg.bAPSDCapable
+		    && pAd->CommonCfg.APEdcaParm.bAPSDCapable
+		    && (pHeader->FC.SubType & 0x08)) {
+			u8 *pData;
+			DBGPRINT(RT_DEBUG_INFO, ("bAPSDCapable\n"));
+
+			/* Qos bit 4 */
+			pData = (u8 *)pHeader + LENGTH_802_11;
+			if ((*pData >> 4) & 0x01) {
+				DBGPRINT(RT_DEBUG_INFO,
+					 ("RxDone- Rcv EOSP frame, driver may fall into sleep\n"));
 				pAd->CommonCfg.bInServicePeriod = FALSE;
 
-				// Force driver to fall into sleep mode when rcv EOSP frame
-				if (!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE))
-				{
-					USHORT  TbttNumToNextWakeUp;
-					USHORT  NextDtim = pAd->StaCfg.DtimPeriod;
-					ULONG   Now;
+				/* Force driver to fall into sleep mode when rcv EOSP frame */
+				if (!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE)) {
+					u16 TbttNumToNextWakeUp;
+					u16 NextDtim =
+					    pAd->StaCfg.DtimPeriod;
+					unsigned long Now;
 
 					NdisGetSystemUpTime(&Now);
-					NextDtim -= (USHORT)(Now - pAd->StaCfg.LastBeaconRxTime)/pAd->CommonCfg.BeaconPeriod;
-
-					TbttNumToNextWakeUp = pAd->StaCfg.DefaultListenCount;
-					if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_RECEIVE_DTIM) && (TbttNumToNextWakeUp > NextDtim))
+					NextDtim -=
+					    (u16)(Now -
+						      pAd->StaCfg.
+						      LastBeaconRxTime) /
+					    pAd->CommonCfg.BeaconPeriod;
+
+					TbttNumToNextWakeUp =
+					    pAd->StaCfg.DefaultListenCount;
+					if (OPSTATUS_TEST_FLAG
+					    (pAd, fOP_STATUS_RECEIVE_DTIM)
+					    && (TbttNumToNextWakeUp > NextDtim))
 						TbttNumToNextWakeUp = NextDtim;
 
-					MlmeSetPsmBit(pAd, PWR_SAVE);
-					// if WMM-APSD is failed, try to disable following line
-					AsicSleepThenAutoWakeup(pAd, TbttNumToNextWakeUp);
+					RTMP_SET_PSM_BIT(pAd, PWR_SAVE);
+					/* if WMM-APSD is failed, try to disable following line */
+					AsicSleepThenAutoWakeup(pAd,
+								TbttNumToNextWakeUp);
 				}
 			}
 
-			if ((pHeader->FC.MoreData) && (pAd->CommonCfg.bInServicePeriod))
-			{
-				DBGPRINT(RT_DEBUG_TRACE,("Sending another trigger frame when More Data bit is set to 1\n"));
+			if ((pHeader->FC.MoreData)
+			    && (pAd->CommonCfg.bInServicePeriod)) {
+				DBGPRINT(RT_DEBUG_TRACE,
+					 ("Sending another trigger frame when More Data bit is set to 1\n"));
 			}
 		}
-
-		// Drop NULL, CF-ACK(no data), CF-POLL(no data), and CF-ACK+CF-POLL(no data) data frame
-		if ((pHeader->FC.SubType & 0x04)) // bit 2 : no DATA
+		/* Drop NULL, CF-ACK(no data), CF-POLL(no data), and CF-ACK+CF-POLL(no data) data frame */
+		if ((pHeader->FC.SubType & 0x04))	/* bit 2 : no DATA */
 		{
-			// release packet
-			RELEASE_NDIS_PACKET(pAd, pRxPacket, NDIS_STATUS_FAILURE);
+			/* release packet */
+			RELEASE_NDIS_PACKET(pAd, pRxPacket,
+					    NDIS_STATUS_FAILURE);
 			return;
 		}
+		/* Drop not my BSS frame (we can not only check the MyBss bit in RxD) */
 
-	    // Drop not my BSS frame (we can not only check the MyBss bit in RxD)
-
-		if (INFRA_ON(pAd))
-		{
-			// Infrastructure mode, check address 2 for BSSID
-			if (!RTMPEqualMemory(&pHeader->Addr2, &pAd->CommonCfg.Bssid, 6))
-			{
-				// Receive frame not my BSSID
-	            // release packet
-	            RELEASE_NDIS_PACKET(pAd, pRxPacket, NDIS_STATUS_FAILURE);
+		if (INFRA_ON(pAd)) {
+			/* Infrastructure mode, check address 2 for BSSID */
+			if (!RTMPEqualMemory
+			    (&pHeader->Addr2, &pAd->CommonCfg.Bssid, 6)) {
+				/* Receive frame not my BSSID */
+				/* release packet */
+				RELEASE_NDIS_PACKET(pAd, pRxPacket,
+						    NDIS_STATUS_FAILURE);
 				return;
 			}
-		}
-		else	// Ad-Hoc mode or Not associated
-		{
-			// Ad-Hoc mode, check address 3 for BSSID
-			if (!RTMPEqualMemory(&pHeader->Addr3, &pAd->CommonCfg.Bssid, 6))
-			{
-				// Receive frame not my BSSID
-	            // release packet
-	            RELEASE_NDIS_PACKET(pAd, pRxPacket, NDIS_STATUS_FAILURE);
+		} else		/* Ad-Hoc mode or Not associated */
+		{
+			/* Ad-Hoc mode, check address 3 for BSSID */
+			if (!RTMPEqualMemory
+			    (&pHeader->Addr3, &pAd->CommonCfg.Bssid, 6)) {
+				/* Receive frame not my BSSID */
+				/* release packet */
+				RELEASE_NDIS_PACKET(pAd, pRxPacket,
+						    NDIS_STATUS_FAILURE);
 				return;
 			}
 		}
 
-		//
-		// find pEntry
-		//
-		if (pRxWI->WirelessCliID < MAX_LEN_OF_MAC_TABLE)
-		{
+		/* */
+		/* find pEntry */
+		/* */
+		if (pRxWI->WirelessCliID < MAX_LEN_OF_MAC_TABLE) {
 			pEntry = &pAd->MacTab.Content[pRxWI->WirelessCliID];
-		}
-		else
-		{
-			// 1. release packet if infra mode
-			// 2. new a pEntry if ad-hoc mode
-			RELEASE_NDIS_PACKET(pAd, pRxPacket, NDIS_STATUS_FAILURE);
+		} else {
+			/* 1. release packet if infra mode */
+			/* 2. new a pEntry if ad-hoc mode */
+			RELEASE_NDIS_PACKET(pAd, pRxPacket,
+					    NDIS_STATUS_FAILURE);
 			return;
 		}
 
-		// infra or ad-hoc
-		if (INFRA_ON(pAd))
-		{
+		/* infra or ad-hoc */
+		if (INFRA_ON(pAd)) {
 			RX_BLK_SET_FLAG(pRxBlk, fRX_INFRA);
 			ASSERT(pRxWI->WirelessCliID == BSSID_WCID);
 		}
-
-		// check Atheros Client
-		if ((pEntry->bIAmBadAtheros == FALSE) &&  (pRxD->AMPDU == 1) && (pHeader->FC.Retry ))
-		{
+		/* check Atheros Client */
+		if ((pEntry->bIAmBadAtheros == FALSE) && (pRxD->AMPDU == 1)
+		    && (pHeader->FC.Retry)) {
 			pEntry->bIAmBadAtheros = TRUE;
 			pAd->CommonCfg.IOTestParm.bCurrentAtheros = TRUE;
 			pAd->CommonCfg.IOTestParm.bLastAtheros = TRUE;
-			if (!STA_AES_ON(pAd))
-			{
-				AsicUpdateProtect(pAd, 8, ALLN_SETPROTECT, TRUE, FALSE);
+			if (!STA_AES_ON(pAd)) {
+				AsicUpdateProtect(pAd, 8, ALLN_SETPROTECT, TRUE,
+						  FALSE);
 			}
 		}
 	}
 
-	pRxBlk->pData = (UCHAR *)pHeader;
+	pRxBlk->pData = (u8 *) pHeader;
 
-	//
-	// update RxBlk->pData, DataSize
-	// 802.11 Header, QOS, HTC, Hw Padding
-	//
+	/* */
+	/* update RxBlk->pData, DataSize */
+	/* 802.11 Header, QOS, HTC, Hw Padding */
+	/* */
 
-	// 1. skip 802.11 HEADER
+	/* 1. skip 802.11 HEADER */
 	{
 		pRxBlk->pData += LENGTH_802_11;
 		pRxBlk->DataSize -= LENGTH_802_11;
 	}
 
-	// 2. QOS
-	if (pHeader->FC.SubType & 0x08)
-	{
+	/* 2. QOS */
+	if (pHeader->FC.SubType & 0x08) {
 		RX_BLK_SET_FLAG(pRxBlk, fRX_QOS);
 		UserPriority = *(pRxBlk->pData) & 0x0f;
-		// bit 7 in QoS Control field signals the HT A-MSDU format
-		if ((*pRxBlk->pData) & 0x80)
-		{
+		/* bit 7 in QoS Control field signals the HT A-MSDU format */
+		if ((*pRxBlk->pData) & 0x80) {
 			RX_BLK_SET_FLAG(pRxBlk, fRX_AMSDU);
 		}
-
-		// skip QOS contorl field
+		/* skip QOS contorl field */
 		pRxBlk->pData += 2;
-		pRxBlk->DataSize -=2;
+		pRxBlk->DataSize -= 2;
 	}
 	pRxBlk->UserPriority = UserPriority;
 
-	// 3. Order bit: A-Ralink or HTC+
-	if (pHeader->FC.Order)
-	{
+	/* check if need to resend PS Poll when received packet with MoreData = 1 */
+	if ((pAd->StaCfg.Psm == PWR_SAVE) && (pHeader->FC.MoreData == 1)) {
+		if ((((UserPriority == 0) || (UserPriority == 3)) &&
+		     pAd->CommonCfg.bAPSDAC_BE == 0) ||
+		    (((UserPriority == 1) || (UserPriority == 2)) &&
+		     pAd->CommonCfg.bAPSDAC_BK == 0) ||
+		    (((UserPriority == 4) || (UserPriority == 5)) &&
+		     pAd->CommonCfg.bAPSDAC_VI == 0) ||
+		    (((UserPriority == 6) || (UserPriority == 7)) &&
+		     pAd->CommonCfg.bAPSDAC_VO == 0)) {
+			/* non-UAPSD delivery-enabled AC */
+			RTMP_PS_POLL_ENQUEUE(pAd);
+		}
+	}
+	/* 3. Order bit: A-Ralink or HTC+ */
+	if (pHeader->FC.Order) {
 #ifdef AGGREGATION_SUPPORT
-		if ((pRxWI->PHYMODE <= MODE_OFDM) && (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_AGGREGATION_INUSED)))
+		if ((pRxWI->PHYMODE <= MODE_OFDM)
+		    && (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_AGGREGATION_INUSED)))
 		{
 			RX_BLK_SET_FLAG(pRxBlk, fRX_ARALINK);
-		}
-		else
-#endif
+		} else
+#endif /* AGGREGATION_SUPPORT // */
 		{
 			RX_BLK_SET_FLAG(pRxBlk, fRX_HTC);
-			// skip HTC contorl field
+			/* skip HTC contorl field */
 			pRxBlk->pData += 4;
 			pRxBlk->DataSize -= 4;
 		}
 	}
-
-	// 4. skip HW padding
-	if (pRxD->L2PAD)
-	{
-		// just move pData pointer
-		// because DataSize excluding HW padding
+	/* 4. skip HW padding */
+	if (pRxD->L2PAD) {
+		/* just move pData pointer */
+		/* because DataSize excluding HW padding */
 		RX_BLK_SET_FLAG(pRxBlk, fRX_PAD);
 		pRxBlk->pData += 2;
 	}
 
-	if (pRxD->BA)
-	{
+	if (pRxD->BA) {
 		RX_BLK_SET_FLAG(pRxBlk, fRX_AMPDU);
 	}
-
-	//
-	// Case I  Process Broadcast & Multicast data frame
-	//
-	if (pRxD->Bcast || pRxD->Mcast)
-	{
+	/* */
+	/* Case I  Process Broadcast & Multicast data frame */
+	/* */
+	if (pRxD->Bcast || pRxD->Mcast) {
 		INC_COUNTER64(pAd->WlanCounters.MulticastReceivedFrameCount);
 
-		// Drop Mcast/Bcast frame with fragment bit on
-		if (pHeader->FC.MoreFrag)
-		{
-			// release packet
-			RELEASE_NDIS_PACKET(pAd, pRxPacket, NDIS_STATUS_FAILURE);
+		/* Drop Mcast/Bcast frame with fragment bit on */
+		if (pHeader->FC.MoreFrag) {
+			/* release packet */
+			RELEASE_NDIS_PACKET(pAd, pRxPacket,
+					    NDIS_STATUS_FAILURE);
 			return;
 		}
-
-		// Filter out Bcast frame which AP relayed for us
-		if (pHeader->FC.FrDs && MAC_ADDR_EQUAL(pHeader->Addr3, pAd->CurrentAddress))
-		{
-			// release packet
-			RELEASE_NDIS_PACKET(pAd, pRxPacket, NDIS_STATUS_FAILURE);
+		/* Filter out Bcast frame which AP relayed for us */
+		if (pHeader->FC.FrDs
+		    && MAC_ADDR_EQUAL(pHeader->Addr3, pAd->CurrentAddress)) {
+			/* release packet */
+			RELEASE_NDIS_PACKET(pAd, pRxPacket,
+					    NDIS_STATUS_FAILURE);
 			return;
 		}
 
 		Indicate_Legacy_Packet(pAd, pRxBlk, FromWhichBSSID);
 		return;
-	}
-	else if (pRxD->U2M)
-	{
-		pAd->LastRxRate = (USHORT)((pRxWI->MCS) + (pRxWI->BW <<7) + (pRxWI->ShortGI <<8)+ (pRxWI->PHYMODE <<14)) ;
+	} else if (pRxD->U2M) {
+		pAd->LastRxRate =
+		    (u16)((pRxWI->MCS) + (pRxWI->BW << 7) +
+			      (pRxWI->ShortGI << 8) + (pRxWI->PHYMODE << 14));
 
-		if (ADHOC_ON(pAd))
-		{
+		if (ADHOC_ON(pAd)) {
 			pEntry = MacTableLookup(pAd, pHeader->Addr2);
 			if (pEntry)
-				Update_Rssi_Sample(pAd, &pEntry->RssiSample, pRxWI);
+				Update_Rssi_Sample(pAd, &pEntry->RssiSample,
+						   pRxWI);
 		}
 
-
 		Update_Rssi_Sample(pAd, &pAd->StaCfg.RssiSample, pRxWI);
 
-		pAd->StaCfg.LastSNR0 = (UCHAR)(pRxWI->SNR0);
-		pAd->StaCfg.LastSNR1 = (UCHAR)(pRxWI->SNR1);
+		pAd->StaCfg.LastSNR0 = (u8)(pRxWI->SNR0);
+		pAd->StaCfg.LastSNR1 = (u8)(pRxWI->SNR1);
 
 		pAd->RalinkCounters.OneSecRxOkDataCnt++;
 
+		if (!((pHeader->Frag == 0) && (pHeader->FC.MoreFrag == 0))) {
+			/* re-assemble the fragmented packets */
+			/* return complete frame (pRxPacket) or NULL */
+			bFragment = TRUE;
+			pRxPacket = RTMPDeFragmentDataFrame(pAd, pRxBlk);
+		}
 
-    	if (!((pHeader->Frag == 0) && (pHeader->FC.MoreFrag == 0)))
-    	{
-    		// re-assemble the fragmented packets
-    		// return complete frame (pRxPacket) or NULL
-    		bFragment = TRUE;
-    		pRxPacket = RTMPDeFragmentDataFrame(pAd, pRxBlk);
-    	}
-
-    	if (pRxPacket)
-    	{
+		if (pRxPacket) {
 			pEntry = &pAd->MacTab.Content[pRxWI->WirelessCliID];
 
-    		// process complete frame
-    		if (bFragment && (pRxD->Decrypted) && (pEntry->WepStatus == Ndis802_11Encryption2Enabled))
-    		{
-				// Minus MIC length
+			/* process complete frame */
+			if (bFragment && (pRxD->Decrypted)
+			    && (pEntry->WepStatus ==
+				Ndis802_11Encryption2Enabled)) {
+				/* Minus MIC length */
 				pRxBlk->DataSize -= 8;
 
-    			// For TKIP frame, calculate the MIC value
-    			if (STACheckTkipMICValue(pAd, pEntry, pRxBlk) == FALSE)
-    			{
-    				return;
-    			}
-    		}
+				/* For TKIP frame, calculate the MIC value */
+				if (STACheckTkipMICValue(pAd, pEntry, pRxBlk) ==
+				    FALSE) {
+					return;
+				}
+			}
 
-    		STARxDataFrameAnnounce(pAd, pEntry, pRxBlk, FromWhichBSSID);
+			STARxDataFrameAnnounce(pAd, pEntry, pRxBlk,
+					       FromWhichBSSID);
+			return;
+		} else {
+			/* just return */
+			/* because RTMPDeFragmentDataFrame() will release rx packet, */
+			/* if packet is fragmented */
 			return;
-    	}
-    	else
-    	{
-    		// just return
-    		// because RTMPDeFragmentDataFrame() will release rx packet,
-    		// if packet is fragmented
-    		return;
-    	}
+		}
 	}
 
 	ASSERT(0);
-	// release packet
+	/* release packet */
 	RELEASE_NDIS_PACKET(pAd, pRxPacket, NDIS_STATUS_FAILURE);
 }
 
-VOID STAHandleRxMgmtFrame(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	RX_BLK			*pRxBlk)
+void STAHandleRxMgmtFrame(struct rt_rtmp_adapter *pAd, struct rt_rx_blk *pRxBlk)
 {
-	PRT28XX_RXD_STRUC	pRxD = &(pRxBlk->RxD);
-	PRXWI_STRUC		pRxWI = pRxBlk->pRxWI;
-	PHEADER_802_11	pHeader = pRxBlk->pHeader;
-	PNDIS_PACKET	pRxPacket = pRxBlk->pRxPacket;
+	PRT28XX_RXD_STRUC pRxD = &(pRxBlk->RxD);
+	struct rt_rxwi * pRxWI = pRxBlk->pRxWI;
+	struct rt_header_802_11 * pHeader = pRxBlk->pHeader;
+	void *pRxPacket = pRxBlk->pRxPacket;
 
-	do
-	{
-
-		// We should collect RSSI not only U2M data but also my beacon
-		if (pAd->RxAnt.EvaluatePeriod == 0 &&
-		    pHeader->FC.SubType == SUBTYPE_BEACON &&
-		    MAC_ADDR_EQUAL(&pAd->CommonCfg.Bssid, &pHeader->Addr2)) {
-			Update_Rssi_Sample(pAd, &pAd->StaCfg.RssiSample, pRxWI);
+	do {
 
-			pAd->StaCfg.LastSNR0 = (UCHAR)(pRxWI->SNR0);
-			pAd->StaCfg.LastSNR1 = (UCHAR)(pRxWI->SNR1);
+		/* check if need to resend PS Poll when received packet with MoreData = 1 */
+		if ((pAd->StaCfg.Psm == PWR_SAVE)
+		    && (pHeader->FC.MoreData == 1)) {
+			/* for UAPSD, all management frames will be VO priority */
+			if (pAd->CommonCfg.bAPSDAC_VO == 0) {
+				/* non-UAPSD delivery-enabled AC */
+				RTMP_PS_POLL_ENQUEUE(pAd);
+			}
 		}
 
-#ifdef RT2870
-		// collect rssi information for antenna diversity
-		if (pAd->NicConfig2.field.AntDiversity)
-		{
-			if ((pRxD->U2M) || ((pHeader->FC.SubType == SUBTYPE_BEACON) && (MAC_ADDR_EQUAL(&pAd->CommonCfg.Bssid, &pHeader->Addr2))))
-			{
-					COLLECT_RX_ANTENNA_AVERAGE_RSSI(pAd, ConvertToRssi(pAd, (UCHAR)pRxWI->RSSI0, RSSI_0), 0); //Note: RSSI2 not used on RT73
-					pAd->StaCfg.NumOfAvgRssiSample ++;
-			}
+		/* TODO: if MoreData == 0, station can go to sleep */
+
+		/* We should collect RSSI not only U2M data but also my beacon */
+		if ((pHeader->FC.SubType == SUBTYPE_BEACON)
+		    && (MAC_ADDR_EQUAL(&pAd->CommonCfg.Bssid, &pHeader->Addr2))
+		    && (pAd->RxAnt.EvaluatePeriod == 0)) {
+			Update_Rssi_Sample(pAd, &pAd->StaCfg.RssiSample, pRxWI);
+
+			pAd->StaCfg.LastSNR0 = (u8)(pRxWI->SNR0);
+			pAd->StaCfg.LastSNR1 = (u8)(pRxWI->SNR1);
 		}
-#endif
 
-		// First check the size, it MUST not exceed the mlme queue size
-		if (pRxWI->MPDUtotalByteCount > MGMT_DMA_BUFFER_SIZE)
-		{
+		/* First check the size, it MUST not exceed the mlme queue size */
+		if (pRxWI->MPDUtotalByteCount > MGMT_DMA_BUFFER_SIZE) {
 			DBGPRINT_ERR(("STAHandleRxMgmtFrame: frame too large, size = %d \n", pRxWI->MPDUtotalByteCount));
 			break;
 		}
 
-		REPORT_MGMT_FRAME_TO_MLME(pAd, pRxWI->WirelessCliID, pHeader, pRxWI->MPDUtotalByteCount,
-									pRxWI->RSSI0, pRxWI->RSSI1, pRxWI->RSSI2, pRxD->PlcpSignal);
+		REPORT_MGMT_FRAME_TO_MLME(pAd, pRxWI->WirelessCliID, pHeader,
+					  pRxWI->MPDUtotalByteCount,
+					  pRxWI->RSSI0, pRxWI->RSSI1,
+					  pRxWI->RSSI2, pRxD->PlcpSignal);
 	} while (FALSE);
 
 	RELEASE_NDIS_PACKET(pAd, pRxPacket, NDIS_STATUS_SUCCESS);
 }
 
-VOID STAHandleRxControlFrame(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	RX_BLK			*pRxBlk)
+void STAHandleRxControlFrame(struct rt_rtmp_adapter *pAd, struct rt_rx_blk *pRxBlk)
 {
-	PRXWI_STRUC		pRxWI = pRxBlk->pRxWI;
-	PHEADER_802_11	pHeader = pRxBlk->pHeader;
-	PNDIS_PACKET	pRxPacket = pRxBlk->pRxPacket;
-
-	switch (pHeader->FC.SubType)
-	{
-		case SUBTYPE_BLOCK_ACK_REQ:
-			{
-				CntlEnqueueForRecv(pAd, pRxWI->WirelessCliID, (pRxWI->MPDUtotalByteCount), (PFRAME_BA_REQ)pHeader);
-			}
-			break;
-		case SUBTYPE_BLOCK_ACK:
-		case SUBTYPE_ACK:
-		default:
-			break;
+	struct rt_rxwi * pRxWI = pRxBlk->pRxWI;
+	struct rt_header_802_11 * pHeader = pRxBlk->pHeader;
+	void *pRxPacket = pRxBlk->pRxPacket;
+
+	switch (pHeader->FC.SubType) {
+	case SUBTYPE_BLOCK_ACK_REQ:
+		{
+			CntlEnqueueForRecv(pAd, pRxWI->WirelessCliID,
+					   (pRxWI->MPDUtotalByteCount),
+					   (struct rt_frame_ba_req *) pHeader);
+		}
+		break;
+	case SUBTYPE_BLOCK_ACK:
+	case SUBTYPE_ACK:
+	default:
+		break;
 	}
 
 	RELEASE_NDIS_PACKET(pAd, pRxPacket, NDIS_STATUS_FAILURE);
 }
 
-
 /*
 	========================================================================
 
@@ -654,141 +698,127 @@ VOID STAHandleRxControlFrame(
 		Need to consider QOS DATA format when converting to 802.3
 	========================================================================
 */
-BOOLEAN STARxDoneInterruptHandle(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	BOOLEAN			argc)
+BOOLEAN STARxDoneInterruptHandle(struct rt_rtmp_adapter *pAd, IN BOOLEAN argc)
 {
-	NDIS_STATUS			Status;
-	UINT32			RxProcessed, RxPending;
-	BOOLEAN			bReschedule = FALSE;
-	RT28XX_RXD_STRUC	*pRxD;
-	UCHAR			*pData;
-	PRXWI_STRUC		pRxWI;
-	PNDIS_PACKET	pRxPacket;
-	PHEADER_802_11	pHeader;
-	RX_BLK			RxCell;
+	int Status;
+	u32 RxProcessed, RxPending;
+	BOOLEAN bReschedule = FALSE;
+	PRT28XX_RXD_STRUC pRxD;
+	u8 *pData;
+	struct rt_rxwi * pRxWI;
+	void *pRxPacket;
+	struct rt_header_802_11 * pHeader;
+	struct rt_rx_blk RxCell;
 
 	RxProcessed = RxPending = 0;
 
-	// process whole rx ring
-	while (1)
-	{
+	/* process whole rx ring */
+	while (1) {
 
 		if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RADIO_OFF |
-								fRTMP_ADAPTER_RESET_IN_PROGRESS |
-								fRTMP_ADAPTER_HALT_IN_PROGRESS |
-								fRTMP_ADAPTER_NIC_NOT_EXIST) ||
-			!RTMP_TEST_FLAG(pAd,fRTMP_ADAPTER_START_UP))
-		{
+				   fRTMP_ADAPTER_RESET_IN_PROGRESS |
+				   fRTMP_ADAPTER_HALT_IN_PROGRESS |
+				   fRTMP_ADAPTER_NIC_NOT_EXIST) ||
+		    !RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_START_UP)) {
 			break;
 		}
-
-#ifdef RT2860
-		if (RxProcessed++ > MAX_RX_PROCESS_CNT)
-		{
-			// need to reschedule rx handle
+#ifdef RTMP_MAC_PCI
+		if (RxProcessed++ > MAX_RX_PROCESS_CNT) {
+			/* need to reschedule rx handle */
 			bReschedule = TRUE;
 			break;
 		}
-#endif
-
-		RxProcessed ++; // test
-
-		// 1. allocate a new data packet into rx ring to replace received packet
-		//    then processing the received packet
-		// 2. the callee must take charge of release of packet
-		// 3. As far as driver is concerned ,
-		//    the rx packet must
-		//      a. be indicated to upper layer or
-		//      b. be released if it is discarded
-		pRxPacket = GetPacketFromRxRing(pAd, &(RxCell.RxD), &bReschedule, &RxPending);
-		if (pRxPacket == NULL)
-		{
-			// no more packet to process
+#endif /* RTMP_MAC_PCI // */
+
+		RxProcessed++;	/* test */
+
+		/* 1. allocate a new data packet into rx ring to replace received packet */
+		/*    then processing the received packet */
+		/* 2. the callee must take charge of release of packet */
+		/* 3. As far as driver is concerned , */
+		/*    the rx packet must */
+		/*      a. be indicated to upper layer or */
+		/*      b. be released if it is discarded */
+		pRxPacket =
+		    GetPacketFromRxRing(pAd, &(RxCell.RxD), &bReschedule,
+					&RxPending);
+		if (pRxPacket == NULL) {
+			/* no more packet to process */
 			break;
 		}
-
-		// get rx ring descriptor
+		/* get rx ring descriptor */
 		pRxD = &(RxCell.RxD);
-		// get rx data buffer
-		pData	= GET_OS_PKT_DATAPTR(pRxPacket);
-		pRxWI	= (PRXWI_STRUC) pData;
-		pHeader = (PHEADER_802_11) (pData+RXWI_SIZE) ;
+		/* get rx data buffer */
+		pData = GET_OS_PKT_DATAPTR(pRxPacket);
+		pRxWI = (struct rt_rxwi *) pData;
+		pHeader = (struct rt_header_802_11 *) (pData + RXWI_SIZE);
 
-		// build RxCell
+		/* build RxCell */
 		RxCell.pRxWI = pRxWI;
 		RxCell.pHeader = pHeader;
 		RxCell.pRxPacket = pRxPacket;
-		RxCell.pData = (UCHAR *) pHeader;
+		RxCell.pData = (u8 *) pHeader;
 		RxCell.DataSize = pRxWI->MPDUtotalByteCount;
 		RxCell.Flags = 0;
 
-		// Increase Total receive byte counter after real data received no mater any error or not
-		pAd->RalinkCounters.ReceivedByteCount +=  pRxWI->MPDUtotalByteCount;
-		pAd->RalinkCounters.RxCount ++;
+		/* Increase Total receive byte counter after real data received no mater any error or not */
+		pAd->RalinkCounters.ReceivedByteCount +=
+		    pRxWI->MPDUtotalByteCount;
+		pAd->RalinkCounters.OneSecReceivedByteCount +=
+		    pRxWI->MPDUtotalByteCount;
+		pAd->RalinkCounters.RxCount++;
 
 		INC_COUNTER64(pAd->WlanCounters.ReceivedFragmentCount);
 
 		if (pRxWI->MPDUtotalByteCount < 14)
 			Status = NDIS_STATUS_FAILURE;
 
-        if (MONITOR_ON(pAd))
-		{
-            send_monitor_packets(pAd, &RxCell);
+		if (MONITOR_ON(pAd)) {
+			send_monitor_packets(pAd, &RxCell);
 			break;
 		}
-		/* RT2870 invokes STARxDoneInterruptHandle() in rtusb_bulk.c */
 
-		// Check for all RxD errors
+		/* STARxDoneInterruptHandle() is called in rtusb_bulk.c */
+
+		/* Check for all RxD errors */
 		Status = RTMPCheckRxError(pAd, pHeader, pRxWI, pRxD);
 
-		// Handle the received frame
-		if (Status == NDIS_STATUS_SUCCESS)
-		{
-			switch (pHeader->FC.Type)
-			{
-				// CASE I, receive a DATA frame
-				case BTYPE_DATA:
+		/* Handle the received frame */
+		if (Status == NDIS_STATUS_SUCCESS) {
+			switch (pHeader->FC.Type) {
+				/* CASE I, receive a DATA frame */
+			case BTYPE_DATA:
 				{
-					// process DATA frame
+					/* process DATA frame */
 					STAHandleRxDataFrame(pAd, &RxCell);
 				}
 				break;
-				// CASE II, receive a MGMT frame
-				case BTYPE_MGMT:
+				/* CASE II, receive a MGMT frame */
+			case BTYPE_MGMT:
 				{
 					STAHandleRxMgmtFrame(pAd, &RxCell);
 				}
 				break;
-				// CASE III. receive a CNTL frame
-				case BTYPE_CNTL:
+				/* CASE III. receive a CNTL frame */
+			case BTYPE_CNTL:
 				{
 					STAHandleRxControlFrame(pAd, &RxCell);
 				}
 				break;
-				// discard other type
-				default:
-					RELEASE_NDIS_PACKET(pAd, pRxPacket, NDIS_STATUS_FAILURE);
-					break;
+				/* discard other type */
+			default:
+				RELEASE_NDIS_PACKET(pAd, pRxPacket,
+						    NDIS_STATUS_FAILURE);
+				break;
 			}
-		}
-		else
-		{
+		} else {
 			pAd->Counters8023.RxErrors++;
-			// discard this frame
-			RELEASE_NDIS_PACKET(pAd, pRxPacket, NDIS_STATUS_FAILURE);
+			/* discard this frame */
+			RELEASE_NDIS_PACKET(pAd, pRxPacket,
+					    NDIS_STATUS_FAILURE);
 		}
 	}
 
-#ifdef RT2860
-	// fRTMP_PS_GO_TO_SLEEP_NOW is set if receiving beacon.
-	if (RTMP_TEST_PSFLAG(pAd, fRTMP_PS_GO_TO_SLEEP_NOW) && (INFRA_ON(pAd)))
-	{
-		RTMP_CLEAR_PSFLAG(pAd, fRTMP_PS_GO_TO_SLEEP_NOW);
-		AsicSleepThenAutoWakeup(pAd, pAd->ThisTbttNumToNextWakeUp);
-		bReschedule = FALSE;
-	}
-#endif
 	return bReschedule;
 }
 
@@ -803,15 +833,9 @@ BOOLEAN STARxDoneInterruptHandle(
 
 	========================================================================
 */
-VOID	RTMPHandleTwakeupInterrupt(
-	IN PRTMP_ADAPTER pAd)
+void RTMPHandleTwakeupInterrupt(struct rt_rtmp_adapter *pAd)
 {
-#ifdef RT2860
-	AsicForceWakeup(pAd, DOT11POWERSAVE);
-#endif
-#ifdef RT2870
 	AsicForceWakeup(pAd, FALSE);
-#endif
 }
 
 /*
@@ -820,9 +844,9 @@ Routine Description:
     Early checking and OS-depened parsing for Tx packet send to our STA driver.
 
 Arguments:
-    NDIS_HANDLE 	MiniportAdapterContext	Pointer refer to the device handle, i.e., the pAd.
-	PPNDIS_PACKET	ppPacketArray			The packet array need to do transmission.
-	UINT			NumberOfPackets			Number of packet in packet array.
+    void *	MiniportAdapterContext	Pointer refer to the device handle, i.e., the pAd.
+	void **	ppPacketArray			The packet array need to do transmission.
+	u32			NumberOfPackets			Number of packet in packet array.
 
 Return Value:
 	NONE
@@ -832,47 +856,39 @@ Note:
 	You only can put OS-depened & STA related code in here.
 ========================================================================
 */
-VOID STASendPackets(
-	IN	NDIS_HANDLE		MiniportAdapterContext,
-	IN	PPNDIS_PACKET	ppPacketArray,
-	IN	UINT			NumberOfPackets)
+void STASendPackets(void *MiniportAdapterContext,
+		    void **ppPacketArray, u32 NumberOfPackets)
 {
-	UINT			Index;
-	PRTMP_ADAPTER	pAd = (PRTMP_ADAPTER) MiniportAdapterContext;
-	PNDIS_PACKET	pPacket;
-	BOOLEAN			allowToSend = FALSE;
+	u32 Index;
+	struct rt_rtmp_adapter *pAd = (struct rt_rtmp_adapter *)MiniportAdapterContext;
+	void *pPacket;
+	BOOLEAN allowToSend = FALSE;
 
-
-	for (Index = 0; Index < NumberOfPackets; Index++)
-	{
+	for (Index = 0; Index < NumberOfPackets; Index++) {
 		pPacket = ppPacketArray[Index];
 
-		do
-		{
-			if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RESET_IN_PROGRESS) ||
-				RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS) ||
-				RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RADIO_OFF))
-			{
-				// Drop send request since hardware is in reset state
-					break;
-			}
-			else if (!INFRA_ON(pAd) && !ADHOC_ON(pAd))
-			{
-				// Drop send request since there are no physical connection yet
-					break;
-			}
-			else
-			{
-				// Record that orignal packet source is from NDIS layer,so that
-				// later on driver knows how to release this NDIS PACKET
-				RTMP_SET_PACKET_WCID(pPacket, 0); // this field is useless when in STA mode
+		do {
+			if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RESET_IN_PROGRESS)
+			    || RTMP_TEST_FLAG(pAd,
+					      fRTMP_ADAPTER_HALT_IN_PROGRESS)
+			    || RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RADIO_OFF)) {
+				/* Drop send request since hardware is in reset state */
+				break;
+			} else if (!INFRA_ON(pAd) && !ADHOC_ON(pAd)) {
+				/* Drop send request since there are no physical connection yet */
+				break;
+			} else {
+				/* Record that orignal packet source is from NDIS layer,so that */
+				/* later on driver knows how to release this NDIS PACKET */
+				RTMP_SET_PACKET_WCID(pPacket, 0);	/* this field is useless when in STA mode */
 				RTMP_SET_PACKET_SOURCE(pPacket, PKTSRC_NDIS);
-				NDIS_SET_PACKET_STATUS(pPacket, NDIS_STATUS_PENDING);
+				NDIS_SET_PACKET_STATUS(pPacket,
+						       NDIS_STATUS_PENDING);
 				pAd->RalinkCounters.PendingNdisPacketCount++;
 
 				allowToSend = TRUE;
 			}
-		} while(FALSE);
+		} while (FALSE);
 
 		if (allowToSend == TRUE)
 			STASendPacket(pAd, pPacket);
@@ -880,12 +896,11 @@ VOID STASendPackets(
 			RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_FAILURE);
 	}
 
-	// Dequeue outgoing frames from TxSwQueue[] and process it
+	/* Dequeue outgoing frames from TxSwQueue[] and process it */
 	RTMPDeQueuePacket(pAd, FALSE, NUM_OF_TX_RING, MAX_TX_PROCESS);
 
 }
 
-
 /*
 ========================================================================
 Routine Description:
@@ -898,201 +913,199 @@ Arguments:
 	pPacket 	Pointer to send packet
 
 Return Value:
-	NDIS_STATUS_SUCCESS			If succes to queue the packet into TxSwQueue.
+	NDIS_STATUS_SUCCESS			If success to queue the packet into TxSwQueue.
 	NDIS_STATUS_FAILURE			If failed to do en-queue.
 
 Note:
 	You only can put OS-indepened & STA related code in here.
 ========================================================================
 */
-NDIS_STATUS STASendPacket(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PNDIS_PACKET	pPacket)
+int STASendPacket(struct rt_rtmp_adapter *pAd, void *pPacket)
 {
-	PACKET_INFO 	PacketInfo;
-	PUCHAR			pSrcBufVA;
-	UINT			SrcBufLen;
-	UINT			AllowFragSize;
-	UCHAR			NumberOfFrag;
-	UCHAR			QueIdx, UserPriority;
-	MAC_TABLE_ENTRY *pEntry = NULL;
-	unsigned int 	IrqFlags;
-	UCHAR			FlgIsIP = 0;
-	UCHAR			Rate;
-
-	// Prepare packet information structure for buffer descriptor
-	// chained within a single NDIS packet.
+	struct rt_packet_info PacketInfo;
+	u8 *pSrcBufVA;
+	u32 SrcBufLen;
+	u32 AllowFragSize;
+	u8 NumberOfFrag;
+	u8 RTSRequired;
+	u8 QueIdx, UserPriority;
+	struct rt_mac_table_entry *pEntry = NULL;
+	unsigned int IrqFlags;
+	u8 FlgIsIP = 0;
+	u8 Rate;
+
+	/* Prepare packet information structure for buffer descriptor */
+	/* chained within a single NDIS packet. */
 	RTMP_QueryPacketInfo(pPacket, &PacketInfo, &pSrcBufVA, &SrcBufLen);
 
-	if (pSrcBufVA == NULL)
-	{
-		DBGPRINT(RT_DEBUG_ERROR,("STASendPacket --> pSrcBufVA == NULL !!!SrcBufLen=%x\n",SrcBufLen));
-		// Resourece is low, system did not allocate virtual address
-		// return NDIS_STATUS_FAILURE directly to upper layer
+	if (pSrcBufVA == NULL) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("STASendPacket --> pSrcBufVA == NULL !SrcBufLen=%x\n",
+			  SrcBufLen));
+		/* Resourece is low, system did not allocate virtual address */
+		/* return NDIS_STATUS_FAILURE directly to upper layer */
 		RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_FAILURE);
 		return NDIS_STATUS_FAILURE;
 	}
 
-
-	if (SrcBufLen < 14)
-	{
-		DBGPRINT(RT_DEBUG_ERROR,("STASendPacket --> Ndis Packet buffer error !!!\n"));
+	if (SrcBufLen < 14) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("STASendPacket --> Ndis Packet buffer error!\n"));
 		RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_FAILURE);
 		return (NDIS_STATUS_FAILURE);
 	}
-
-	// In HT rate adhoc mode, A-MPDU is often used. So need to lookup BA Table and MAC Entry.
-	// Note multicast packets in adhoc also use BSSID_WCID index.
+	/* In HT rate adhoc mode, A-MPDU is often used. So need to lookup BA Table and MAC Entry. */
+	/* Note multicast packets in adhoc also use BSSID_WCID index. */
 	{
-		if(INFRA_ON(pAd))
-		{
-			{
-			pEntry = &pAd->MacTab.Content[BSSID_WCID];
-			RTMP_SET_PACKET_WCID(pPacket, BSSID_WCID);
-			Rate = pAd->CommonCfg.TxRate;
-		}
-		}
-		else if (ADHOC_ON(pAd))
-		{
-			if (*pSrcBufVA & 0x01)
+		if (INFRA_ON(pAd)) {
 			{
+				pEntry = &pAd->MacTab.Content[BSSID_WCID];
+				RTMP_SET_PACKET_WCID(pPacket, BSSID_WCID);
+				Rate = pAd->CommonCfg.TxRate;
+			}
+		} else if (ADHOC_ON(pAd)) {
+			if (*pSrcBufVA & 0x01) {
 				RTMP_SET_PACKET_WCID(pPacket, MCAST_WCID);
 				pEntry = &pAd->MacTab.Content[MCAST_WCID];
-			}
-			else
-			{
+			} else {
 				pEntry = MacTableLookup(pAd, pSrcBufVA);
 			}
 			Rate = pAd->CommonCfg.TxRate;
 		}
 	}
 
-	if (!pEntry)
-	{
-		DBGPRINT(RT_DEBUG_ERROR,("STASendPacket->Cannot find pEntry(%2x:%2x:%2x:%2x:%2x:%2x) in MacTab!\n", PRINT_MAC(pSrcBufVA)));
-		// Resourece is low, system did not allocate virtual address
-		// return NDIS_STATUS_FAILURE directly to upper layer
+	if (!pEntry) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("STASendPacket->Cannot find pEntry(%2x:%2x:%2x:%2x:%2x:%2x) in MacTab!\n",
+			  PRINT_MAC(pSrcBufVA)));
+		/* Resourece is low, system did not allocate virtual address */
+		/* return NDIS_STATUS_FAILURE directly to upper layer */
 		RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_FAILURE);
 		return NDIS_STATUS_FAILURE;
 	}
 
 	if (ADHOC_ON(pAd)
-		)
-	{
-		RTMP_SET_PACKET_WCID(pPacket, (UCHAR)pEntry->Aid);
+	    ) {
+		RTMP_SET_PACKET_WCID(pPacket, (u8)pEntry->Aid);
 	}
-
-	//
-	// Check the Ethernet Frame type of this packet, and set the RTMP_SET_PACKET_SPECIFIC flags.
-	//		Here we set the PACKET_SPECIFIC flags(LLC, VLAN, DHCP/ARP, EAPOL).
+	/* */
+	/* Check the Ethernet Frame type of this packet, and set the RTMP_SET_PACKET_SPECIFIC flags. */
+	/*              Here we set the PACKET_SPECIFIC flags(LLC, VLAN, DHCP/ARP, EAPOL). */
 	RTMPCheckEtherType(pAd, pPacket);
 
-
-
-	//
-	// WPA 802.1x secured port control - drop all non-802.1x frame before port secured
-	//
+	/* */
+	/* WPA 802.1x secured port control - drop all non-802.1x frame before port secured */
+	/* */
 	if (((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA) ||
-		 (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPAPSK) ||
-		 (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2) ||
-		 (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK)
-		  || (pAd->StaCfg.IEEE8021X == TRUE)
-		  )
-		  && ((pAd->StaCfg.PortSecured == WPA_802_1X_PORT_NOT_SECURED) || (pAd->StaCfg.MicErrCnt >= 2))
-		  && (RTMP_GET_PACKET_EAPOL(pPacket)== FALSE)
-		  )
-	{
-		DBGPRINT(RT_DEBUG_TRACE,("STASendPacket --> Drop packet before port secured !!!\n"));
+	     (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPAPSK) ||
+	     (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2) ||
+	     (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK)
+	     || (pAd->StaCfg.IEEE8021X == TRUE)
+	    )
+	    && ((pAd->StaCfg.PortSecured == WPA_802_1X_PORT_NOT_SECURED)
+		|| (pAd->StaCfg.MicErrCnt >= 2))
+	    && (RTMP_GET_PACKET_EAPOL(pPacket) == FALSE)
+	    ) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("STASendPacket --> Drop packet before port secured!\n"));
 		RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_FAILURE);
 
 		return (NDIS_STATUS_FAILURE);
 	}
 
+	/* STEP 1. Decide number of fragments required to deliver this MSDU. */
+	/*         The estimation here is not very accurate because difficult to */
+	/*         take encryption overhead into consideration here. The result */
+	/*         "NumberOfFrag" is then just used to pre-check if enough free */
+	/*         TXD are available to hold this MSDU. */
 
-	// STEP 1. Decide number of fragments required to deliver this MSDU.
-	//	   The estimation here is not very accurate because difficult to
-	//	   take encryption overhead into consideration here. The result
-	//	   "NumberOfFrag" is then just used to pre-check if enough free
-	//	   TXD are available to hold this MSDU.
-
-
-	if (*pSrcBufVA & 0x01)	// fragmentation not allowed on multicast & broadcast
+	if (*pSrcBufVA & 0x01)	/* fragmentation not allowed on multicast & broadcast */
 		NumberOfFrag = 1;
 	else if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_AGGREGATION_INUSED))
-		NumberOfFrag = 1;	// Aggregation overwhelms fragmentation
+		NumberOfFrag = 1;	/* Aggregation overwhelms fragmentation */
 	else if (CLIENT_STATUS_TEST_FLAG(pEntry, fCLIENT_STATUS_AMSDU_INUSED))
-		NumberOfFrag = 1;	// Aggregation overwhelms fragmentation
-	else if ((pAd->StaCfg.HTPhyMode.field.MODE == MODE_HTMIX) || (pAd->StaCfg.HTPhyMode.field.MODE == MODE_HTGREENFIELD))
-		NumberOfFrag = 1;	// MIMO RATE overwhelms fragmentation
-	else
-	{
-		// The calculated "NumberOfFrag" is a rough estimation because of various
-		// encryption/encapsulation overhead not taken into consideration. This number is just
-		// used to make sure enough free TXD are available before fragmentation takes place.
-		// In case the actual required number of fragments of an NDIS packet
-		// excceeds "NumberOfFrag"caculated here and not enough free TXD available, the
-		// last fragment (i.e. last MPDU) will be dropped in RTMPHardTransmit() due to out of
-		// resource, and the NDIS packet will be indicated NDIS_STATUS_FAILURE. This should
-		// rarely happen and the penalty is just like a TX RETRY fail. Affordable.
-
-		AllowFragSize = (pAd->CommonCfg.FragmentThreshold) - LENGTH_802_11 - LENGTH_CRC;
-		NumberOfFrag = ((PacketInfo.TotalPacketLength - LENGTH_802_3 + LENGTH_802_1_H) / AllowFragSize) + 1;
-		// To get accurate number of fragmentation, Minus 1 if the size just match to allowable fragment size
-		if (((PacketInfo.TotalPacketLength - LENGTH_802_3 + LENGTH_802_1_H) % AllowFragSize) == 0)
-		{
+		NumberOfFrag = 1;	/* Aggregation overwhelms fragmentation */
+	else if ((pAd->StaCfg.HTPhyMode.field.MODE == MODE_HTMIX)
+		 || (pAd->StaCfg.HTPhyMode.field.MODE == MODE_HTGREENFIELD))
+		NumberOfFrag = 1;	/* MIMO RATE overwhelms fragmentation */
+	else {
+		/* The calculated "NumberOfFrag" is a rough estimation because of various */
+		/* encryption/encapsulation overhead not taken into consideration. This number is just */
+		/* used to make sure enough free TXD are available before fragmentation takes place. */
+		/* In case the actual required number of fragments of an NDIS packet */
+		/* excceeds "NumberOfFrag"caculated here and not enough free TXD available, the */
+		/* last fragment (i.e. last MPDU) will be dropped in RTMPHardTransmit() due to out of */
+		/* resource, and the NDIS packet will be indicated NDIS_STATUS_FAILURE. This should */
+		/* rarely happen and the penalty is just like a TX RETRY fail. Affordable. */
+
+		AllowFragSize =
+		    (pAd->CommonCfg.FragmentThreshold) - LENGTH_802_11 -
+		    LENGTH_CRC;
+		NumberOfFrag =
+		    ((PacketInfo.TotalPacketLength - LENGTH_802_3 +
+		      LENGTH_802_1_H) / AllowFragSize) + 1;
+		/* To get accurate number of fragmentation, Minus 1 if the size just match to allowable fragment size */
+		if (((PacketInfo.TotalPacketLength - LENGTH_802_3 +
+		      LENGTH_802_1_H) % AllowFragSize) == 0) {
 			NumberOfFrag--;
 		}
 	}
 
-	// Save fragment number to Ndis packet reserved field
+	/* Save fragment number to Ndis packet reserved field */
 	RTMP_SET_PACKET_FRAGMENTS(pPacket, NumberOfFrag);
 
+	/* STEP 2. Check the requirement of RTS: */
+	/*         If multiple fragment required, RTS is required only for the first fragment */
+	/*         if the fragment size large than RTS threshold */
+	/*     For RT28xx, Let ASIC send RTS/CTS */
+/*      RTMP_SET_PACKET_RTS(pPacket, 0); */
+	if (NumberOfFrag > 1)
+		RTSRequired =
+		    (pAd->CommonCfg.FragmentThreshold >
+		     pAd->CommonCfg.RtsThreshold) ? 1 : 0;
+	else
+		RTSRequired =
+		    (PacketInfo.TotalPacketLength >
+		     pAd->CommonCfg.RtsThreshold) ? 1 : 0;
 
-	// STEP 2. Check the requirement of RTS:
-	//	   If multiple fragment required, RTS is required only for the first fragment
-	//	   if the fragment size large than RTS threshold
-	//     For RT28xx, Let ASIC send RTS/CTS
-	RTMP_SET_PACKET_RTS(pPacket, 0);
+	/* Save RTS requirement to Ndis packet reserved field */
+	RTMP_SET_PACKET_RTS(pPacket, RTSRequired);
 	RTMP_SET_PACKET_TXRATE(pPacket, pAd->CommonCfg.TxRate);
 
-	//
-	// STEP 3. Traffic classification. outcome = <UserPriority, QueIdx>
-	//
+	/* */
+	/* STEP 3. Traffic classification. outcome = <UserPriority, QueIdx> */
+	/* */
 	UserPriority = 0;
-	QueIdx		 = QID_AC_BE;
-#ifdef RT2860
-	if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_WMM_INUSED))
-#endif
-#ifdef RT2870
+	QueIdx = QID_AC_BE;
 	if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_WMM_INUSED) &&
-		CLIENT_STATUS_TEST_FLAG(pEntry, fCLIENT_STATUS_WMM_CAPABLE))
-#endif
-	{
-		USHORT Protocol;
-		UCHAR  LlcSnapLen = 0, Byte0, Byte1;
-		do
-		{
-			// get Ethernet protocol field
-			Protocol = (USHORT)((pSrcBufVA[12] << 8) + pSrcBufVA[13]);
-			if (Protocol <= 1500)
-			{
-				// get Ethernet protocol field from LLC/SNAP
-				if (Sniff2BytesFromNdisBuffer(PacketInfo.pFirstBuffer, LENGTH_802_3 + 6, &Byte0, &Byte1) != NDIS_STATUS_SUCCESS)
+	    CLIENT_STATUS_TEST_FLAG(pEntry, fCLIENT_STATUS_WMM_CAPABLE)) {
+		u16 Protocol;
+		u8 LlcSnapLen = 0, Byte0, Byte1;
+		do {
+			/* get Ethernet protocol field */
+			Protocol =
+			    (u16)((pSrcBufVA[12] << 8) + pSrcBufVA[13]);
+			if (Protocol <= 1500) {
+				/* get Ethernet protocol field from LLC/SNAP */
+				if (Sniff2BytesFromNdisBuffer
+				    (PacketInfo.pFirstBuffer, LENGTH_802_3 + 6,
+				     &Byte0, &Byte1) != NDIS_STATUS_SUCCESS)
 					break;
 
-				Protocol = (USHORT)((Byte0 << 8) + Byte1);
+				Protocol = (u16)((Byte0 << 8) + Byte1);
 				LlcSnapLen = 8;
 			}
-
-			// always AC_BE for non-IP packet
+			/* always AC_BE for non-IP packet */
 			if (Protocol != 0x0800)
 				break;
 
-			// get IP header
-			if (Sniff2BytesFromNdisBuffer(PacketInfo.pFirstBuffer, LENGTH_802_3 + LlcSnapLen, &Byte0, &Byte1) != NDIS_STATUS_SUCCESS)
+			/* get IP header */
+			if (Sniff2BytesFromNdisBuffer
+			    (PacketInfo.pFirstBuffer, LENGTH_802_3 + LlcSnapLen,
+			     &Byte0, &Byte1) != NDIS_STATUS_SUCCESS)
 				break;
 
-			// return AC_BE if packet is not IPv4
+			/* return AC_BE if packet is not IPv4 */
 			if ((Byte0 & 0xf0) != 0x40)
 				break;
 
@@ -1100,63 +1113,59 @@ NDIS_STATUS STASendPacket(
 			UserPriority = (Byte1 & 0xe0) >> 5;
 			QueIdx = MapUserPriorityToAccessCategory[UserPriority];
 
-			// TODO: have to check ACM bit. apply TSPEC if ACM is ON
-			// TODO: downgrade UP & QueIdx before passing ACM
-			if (pAd->CommonCfg.APEdcaParm.bACM[QueIdx])
-			{
+			/* TODO: have to check ACM bit. apply TSPEC if ACM is ON */
+			/* TODO: downgrade UP & QueIdx before passing ACM */
+			/*
+			   Under WMM ACM control, we dont need to check the bit;
+			   Or when a TSPEC is built for VO but we will change to issue
+			   BA session for BE here, so we will not use BA to send VO packets.
+			 */
+			if (pAd->CommonCfg.APEdcaParm.bACM[QueIdx]) {
 				UserPriority = 0;
-				QueIdx		 = QID_AC_BE;
+				QueIdx = QID_AC_BE;
 			}
 		} while (FALSE);
 	}
 
 	RTMP_SET_PACKET_UP(pPacket, UserPriority);
 
-
-
-	// Make sure SendTxWait queue resource won't be used by other threads
+	/* Make sure SendTxWait queue resource won't be used by other threads */
 	RTMP_IRQ_LOCK(&pAd->irq_lock, IrqFlags);
-	if (pAd->TxSwQueue[QueIdx].Number >= MAX_PACKETS_IN_QUEUE)
-	{
+	if (pAd->TxSwQueue[QueIdx].Number >= MAX_PACKETS_IN_QUEUE) {
 		RTMP_IRQ_UNLOCK(&pAd->irq_lock, IrqFlags);
 		RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_FAILURE);
 
 		return NDIS_STATUS_FAILURE;
-	}
-	else
-	{
-		InsertTailQueue(&pAd->TxSwQueue[QueIdx], PACKET_TO_QUEUE_ENTRY(pPacket));
+	} else {
+		InsertTailQueueAc(pAd, pEntry, &pAd->TxSwQueue[QueIdx],
+				  PACKET_TO_QUEUE_ENTRY(pPacket));
 	}
 	RTMP_IRQ_UNLOCK(&pAd->irq_lock, IrqFlags);
 
-    if ((pAd->CommonCfg.BACapability.field.AutoBA == TRUE)&&
-#ifdef RT2860
-        (pAd->StaActive.SupportedPhyInfo.bHtEnable == TRUE))
-#endif
-#ifdef RT2870
-        IS_HT_STA(pEntry))
-#endif
-	{
-		if (((pEntry->TXBAbitmap & (1<<UserPriority)) == 0) &&
-            ((pEntry->BADeclineBitmap & (1<<UserPriority)) == 0) &&
-            (pEntry->PortSecured == WPA_802_1X_PORT_SECURED)
-			 // For IOT compatibility, if
-			 // 1. It is Ralink chip or
-			 // 2. It is OPEN or AES mode,
-			 // then BA session can be bulit.
-			 && ((pEntry->ValidAsCLI && pAd->MlmeAux.APRalinkIe != 0x0) ||
-			 	 (pEntry->WepStatus == Ndis802_11WEPDisabled || pEntry->WepStatus == Ndis802_11Encryption3Enabled))
-			)
-		{
-			BAOriSessionSetUp(pAd, pEntry, 0, 0, 10, FALSE);
+	if ((pAd->CommonCfg.BACapability.field.AutoBA == TRUE) &&
+	    IS_HT_STA(pEntry)) {
+		/*struct rt_mac_table_entry *pMacEntry = &pAd->MacTab.Content[BSSID_WCID]; */
+		if (((pEntry->TXBAbitmap & (1 << UserPriority)) == 0) &&
+		    ((pEntry->BADeclineBitmap & (1 << UserPriority)) == 0) &&
+		    (pEntry->PortSecured == WPA_802_1X_PORT_SECURED)
+		    /* For IOT compatibility, if */
+		    /* 1. It is Ralink chip or */
+		    /* 2. It is OPEN or AES mode, */
+		    /* then BA session can be bulit. */
+		    && ((pEntry->ValidAsCLI && pAd->MlmeAux.APRalinkIe != 0x0)
+			|| (pEntry->WepStatus != Ndis802_11WEPEnabled
+			    && pEntry->WepStatus !=
+			    Ndis802_11Encryption2Enabled))
+		    ) {
+			BAOriSessionSetUp(pAd, pEntry, UserPriority, 0, 10,
+					  FALSE);
 		}
 	}
 
-	pAd->RalinkCounters.OneSecOsTxCount[QueIdx]++; // TODO: for debug only. to be removed
+	pAd->RalinkCounters.OneSecOsTxCount[QueIdx]++;	/* TODO: for debug only. to be removed */
 	return NDIS_STATUS_SUCCESS;
 }
 
-
 /*
 	========================================================================
 
@@ -1179,123 +1188,132 @@ NDIS_STATUS STASendPacket(
 
 	========================================================================
 */
+#ifdef RTMP_MAC_PCI
+int RTMPFreeTXDRequest(struct rt_rtmp_adapter *pAd,
+			       u8 QueIdx,
+			       u8 NumberRequired, u8 *FreeNumberIs)
+{
+	unsigned long FreeNumber = 0;
+	int Status = NDIS_STATUS_FAILURE;
+
+	switch (QueIdx) {
+	case QID_AC_BK:
+	case QID_AC_BE:
+	case QID_AC_VI:
+	case QID_AC_VO:
+		if (pAd->TxRing[QueIdx].TxSwFreeIdx >
+		    pAd->TxRing[QueIdx].TxCpuIdx)
+			FreeNumber =
+			    pAd->TxRing[QueIdx].TxSwFreeIdx -
+			    pAd->TxRing[QueIdx].TxCpuIdx - 1;
+		else
+			FreeNumber =
+			    pAd->TxRing[QueIdx].TxSwFreeIdx + TX_RING_SIZE -
+			    pAd->TxRing[QueIdx].TxCpuIdx - 1;
+
+		if (FreeNumber >= NumberRequired)
+			Status = NDIS_STATUS_SUCCESS;
+		break;
+
+	case QID_MGMT:
+		if (pAd->MgmtRing.TxSwFreeIdx > pAd->MgmtRing.TxCpuIdx)
+			FreeNumber =
+			    pAd->MgmtRing.TxSwFreeIdx - pAd->MgmtRing.TxCpuIdx -
+			    1;
+		else
+			FreeNumber =
+			    pAd->MgmtRing.TxSwFreeIdx + MGMT_RING_SIZE -
+			    pAd->MgmtRing.TxCpuIdx - 1;
+
+		if (FreeNumber >= NumberRequired)
+			Status = NDIS_STATUS_SUCCESS;
+		break;
+
+	default:
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("RTMPFreeTXDRequest::Invalid QueIdx(=%d)\n", QueIdx));
+		break;
+	}
+	*FreeNumberIs = (u8)FreeNumber;
 
-#ifdef RT2870
+	return (Status);
+}
+#endif /* RTMP_MAC_PCI // */
+#ifdef RTMP_MAC_USB
 /*
 	Actually, this function used to check if the TxHardware Queue still has frame need to send.
 	If no frame need to send, go to sleep, else, still wake up.
 */
-#endif
-NDIS_STATUS RTMPFreeTXDRequest(
-	IN		PRTMP_ADAPTER	pAd,
-	IN		UCHAR			QueIdx,
-	IN		UCHAR			NumberRequired,
-	IN		PUCHAR			FreeNumberIs)
+int RTMPFreeTXDRequest(struct rt_rtmp_adapter *pAd,
+			       u8 QueIdx,
+			       u8 NumberRequired, u8 *FreeNumberIs)
 {
-#ifdef RT2860
-	ULONG		FreeNumber = 0;
-#endif
-	NDIS_STATUS 	Status = NDIS_STATUS_FAILURE;
-#ifdef RT2870
-	unsigned long   IrqFlags;
-	HT_TX_CONTEXT	*pHTTXContext;
-#endif
-
-	switch (QueIdx)
-	{
-		case QID_AC_BK:
-		case QID_AC_BE:
-		case QID_AC_VI:
-		case QID_AC_VO:
-		case QID_HCCA:
-#ifdef RT2860
-			if (pAd->TxRing[QueIdx].TxSwFreeIdx > pAd->TxRing[QueIdx].TxCpuIdx)
-				FreeNumber = pAd->TxRing[QueIdx].TxSwFreeIdx - pAd->TxRing[QueIdx].TxCpuIdx - 1;
-			else
-				FreeNumber = pAd->TxRing[QueIdx].TxSwFreeIdx + TX_RING_SIZE - pAd->TxRing[QueIdx].TxCpuIdx - 1;
-
-			if (FreeNumber >= NumberRequired)
-				Status = NDIS_STATUS_SUCCESS;
-#endif
-#ifdef RT2870
-			{
-				pHTTXContext = &pAd->TxContext[QueIdx];
-				RTMP_IRQ_LOCK(&pAd->TxContextQueueLock[QueIdx], IrqFlags);
-				if ((pHTTXContext->CurWritePosition != pHTTXContext->ENextBulkOutPosition) ||
-					(pHTTXContext->IRPPending == TRUE))
-				{
-					Status = NDIS_STATUS_FAILURE;
-				}
-				else
-				{
-					Status = NDIS_STATUS_SUCCESS;
-				}
-				RTMP_IRQ_UNLOCK(&pAd->TxContextQueueLock[QueIdx], IrqFlags);
-			}
-#endif
-			break;
-
-		case QID_MGMT:
-#ifdef RT2860
-			if (pAd->MgmtRing.TxSwFreeIdx > pAd->MgmtRing.TxCpuIdx)
-				FreeNumber = pAd->MgmtRing.TxSwFreeIdx - pAd->MgmtRing.TxCpuIdx - 1;
-			else
-				FreeNumber = pAd->MgmtRing.TxSwFreeIdx + MGMT_RING_SIZE - pAd->MgmtRing.TxCpuIdx - 1;
-
-			if (FreeNumber >= NumberRequired)
-				Status = NDIS_STATUS_SUCCESS;
-#endif
-#ifdef RT2870
-			if (pAd->MgmtRing.TxSwFreeIdx != MGMT_RING_SIZE)
+	/*unsigned long         FreeNumber = 0; */
+	int Status = NDIS_STATUS_FAILURE;
+	unsigned long IrqFlags;
+	struct rt_ht_tx_context *pHTTXContext;
+
+	switch (QueIdx) {
+	case QID_AC_BK:
+	case QID_AC_BE:
+	case QID_AC_VI:
+	case QID_AC_VO:
+		{
+			pHTTXContext = &pAd->TxContext[QueIdx];
+			RTMP_IRQ_LOCK(&pAd->TxContextQueueLock[QueIdx],
+				      IrqFlags);
+			if ((pHTTXContext->CurWritePosition !=
+			     pHTTXContext->ENextBulkOutPosition)
+			    || (pHTTXContext->IRPPending == TRUE)) {
 				Status = NDIS_STATUS_FAILURE;
-			else
+			} else {
 				Status = NDIS_STATUS_SUCCESS;
-#endif
-			break;
-
-		default:
-			DBGPRINT(RT_DEBUG_ERROR,("RTMPFreeTXDRequest::Invalid QueIdx(=%d)\n", QueIdx));
-			break;
+			}
+			RTMP_IRQ_UNLOCK(&pAd->TxContextQueueLock[QueIdx],
+					IrqFlags);
+		}
+		break;
+	case QID_MGMT:
+		if (pAd->MgmtRing.TxSwFreeIdx != MGMT_RING_SIZE)
+			Status = NDIS_STATUS_FAILURE;
+		else
+			Status = NDIS_STATUS_SUCCESS;
+		break;
+	default:
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("RTMPFreeTXDRequest::Invalid QueIdx(=%d)\n", QueIdx));
+		break;
 	}
-#ifdef RT2860
-	*FreeNumberIs = (UCHAR)FreeNumber;
-#endif
 
 	return (Status);
 }
+#endif /* RTMP_MAC_USB // */
 
-
-
-VOID RTMPSendDisassociationFrame(
-	IN	PRTMP_ADAPTER	pAd)
+void RTMPSendDisassociationFrame(struct rt_rtmp_adapter *pAd)
 {
 }
 
-VOID	RTMPSendNullFrame(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			TxRate,
-	IN	BOOLEAN 		bQosNull)
+void RTMPSendNullFrame(struct rt_rtmp_adapter *pAd,
+		       u8 TxRate, IN BOOLEAN bQosNull)
 {
-	UCHAR	NullFrame[48];
-	ULONG	Length;
-	PHEADER_802_11	pHeader_802_11;
-
-    // WPA 802.1x secured port control
-    if (((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA) ||
-         (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPAPSK) ||
-         (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2) ||
-         (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK)
-			  || (pAd->StaCfg.IEEE8021X == TRUE)
-        ) &&
-       (pAd->StaCfg.PortSecured == WPA_802_1X_PORT_NOT_SECURED))
-	{
+	u8 NullFrame[48];
+	unsigned long Length;
+	struct rt_header_802_11 * pHeader_802_11;
+
+	/* WPA 802.1x secured port control */
+	if (((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA) ||
+	     (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPAPSK) ||
+	     (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2) ||
+	     (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK)
+	     || (pAd->StaCfg.IEEE8021X == TRUE)
+	    ) && (pAd->StaCfg.PortSecured == WPA_802_1X_PORT_NOT_SECURED)) {
 		return;
 	}
 
 	NdisZeroMemory(NullFrame, 48);
-	Length = sizeof(HEADER_802_11);
+	Length = sizeof(struct rt_header_802_11);
 
-	pHeader_802_11 = (PHEADER_802_11) NullFrame;
+	pHeader_802_11 = (struct rt_header_802_11 *) NullFrame;
 
 	pHeader_802_11->FC.Type = BTYPE_DATA;
 	pHeader_802_11->FC.SubType = SUBTYPE_NULL_FUNC;
@@ -1304,97 +1322,84 @@ VOID	RTMPSendNullFrame(
 	COPY_MAC_ADDR(pHeader_802_11->Addr2, pAd->CurrentAddress);
 	COPY_MAC_ADDR(pHeader_802_11->Addr3, pAd->CommonCfg.Bssid);
 
-	if (pAd->CommonCfg.bAPSDForcePowerSave)
-	{
+	if (pAd->CommonCfg.bAPSDForcePowerSave) {
 		pHeader_802_11->FC.PwrMgmt = PWR_SAVE;
+	} else {
+		pHeader_802_11->FC.PwrMgmt =
+		    (pAd->StaCfg.Psm == PWR_SAVE) ? 1 : 0;
 	}
-	else
-	{
-		pHeader_802_11->FC.PwrMgmt = (pAd->StaCfg.Psm == PWR_SAVE) ? 1: 0;
-	}
-	pHeader_802_11->Duration = pAd->CommonCfg.Dsifs + RTMPCalcDuration(pAd, TxRate, 14);
+	pHeader_802_11->Duration =
+	    pAd->CommonCfg.Dsifs + RTMPCalcDuration(pAd, TxRate, 14);
 
 	pAd->Sequence++;
 	pHeader_802_11->Sequence = pAd->Sequence;
 
-	// Prepare QosNull function frame
-	if (bQosNull)
-	{
+	/* Prepare QosNull function frame */
+	if (bQosNull) {
 		pHeader_802_11->FC.SubType = SUBTYPE_QOS_NULL;
 
-		// copy QOS control bytes
-		NullFrame[Length]	=  0;
-		NullFrame[Length+1] =  0;
-		Length += 2;// if pad with 2 bytes for alignment, APSD will fail
+		/* copy QOS control bytes */
+		NullFrame[Length] = 0;
+		NullFrame[Length + 1] = 0;
+		Length += 2;	/* if pad with 2 bytes for alignment, APSD will fail */
 	}
 
 	HAL_KickOutNullFrameTx(pAd, 0, NullFrame, Length);
 
 }
 
-// IRQL = DISPATCH_LEVEL
-VOID	RTMPSendRTSFrame(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			pDA,
-	IN	unsigned int	NextMpduSize,
-	IN	UCHAR			TxRate,
-	IN	UCHAR			RTSRate,
-	IN	USHORT			AckDuration,
-	IN	UCHAR			QueIdx,
-	IN	UCHAR			FrameGap)
+/* IRQL = DISPATCH_LEVEL */
+void RTMPSendRTSFrame(struct rt_rtmp_adapter *pAd,
+		      u8 *pDA,
+		      IN unsigned int NextMpduSize,
+		      u8 TxRate,
+		      u8 RTSRate,
+		      u16 AckDuration, u8 QueIdx, u8 FrameGap)
 {
 }
 
-
-
-// --------------------------------------------------------
-//  FIND ENCRYPT KEY AND DECIDE CIPHER ALGORITHM
-//		Find the WPA key, either Group or Pairwise Key
-//		LEAP + TKIP also use WPA key.
-// --------------------------------------------------------
-// Decide WEP bit and cipher suite to be used. Same cipher suite should be used for whole fragment burst
-// In Cisco CCX 2.0 Leap Authentication
-//		   WepStatus is Ndis802_11Encryption1Enabled but the key will use PairwiseKey
-//		   Instead of the SharedKey, SharedKey Length may be Zero.
-VOID STAFindCipherAlgorithm(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	TX_BLK			*pTxBlk)
+/* -------------------------------------------------------- */
+/*  FIND ENCRYPT KEY AND DECIDE CIPHER ALGORITHM */
+/*              Find the WPA key, either Group or Pairwise Key */
+/*              LEAP + TKIP also use WPA key. */
+/* -------------------------------------------------------- */
+/* Decide WEP bit and cipher suite to be used. Same cipher suite should be used for whole fragment burst */
+/* In Cisco CCX 2.0 Leap Authentication */
+/*                 WepStatus is Ndis802_11Encryption1Enabled but the key will use PairwiseKey */
+/*                 Instead of the SharedKey, SharedKey Length may be Zero. */
+void STAFindCipherAlgorithm(struct rt_rtmp_adapter *pAd, struct rt_tx_blk *pTxBlk)
 {
-	NDIS_802_11_ENCRYPTION_STATUS	Cipher;				// To indicate cipher used for this packet
-	UCHAR							CipherAlg = CIPHER_NONE;		// cipher alogrithm
-	UCHAR							KeyIdx = 0xff;
-	PUCHAR							pSrcBufVA;
-	PCIPHER_KEY						pKey = NULL;
+	NDIS_802_11_ENCRYPTION_STATUS Cipher;	/* To indicate cipher used for this packet */
+	u8 CipherAlg = CIPHER_NONE;	/* cipher alogrithm */
+	u8 KeyIdx = 0xff;
+	u8 *pSrcBufVA;
+	struct rt_cipher_key *pKey = NULL;
 
 	pSrcBufVA = GET_OS_PKT_DATAPTR(pTxBlk->pPacket);
 
 	{
-	    // Select Cipher
-	    if ((*pSrcBufVA & 0x01) && (ADHOC_ON(pAd)))
-	        Cipher = pAd->StaCfg.GroupCipher; // Cipher for Multicast or Broadcast
-	    else
-	        Cipher = pAd->StaCfg.PairCipher; // Cipher for Unicast
+		/* Select Cipher */
+		if ((*pSrcBufVA & 0x01) && (ADHOC_ON(pAd)))
+			Cipher = pAd->StaCfg.GroupCipher;	/* Cipher for Multicast or Broadcast */
+		else
+			Cipher = pAd->StaCfg.PairCipher;	/* Cipher for Unicast */
 
-		if (RTMP_GET_PACKET_EAPOL(pTxBlk->pPacket))
-		{
-			ASSERT(pAd->SharedKey[BSS0][0].CipherAlg <= CIPHER_CKIP128);
+		if (RTMP_GET_PACKET_EAPOL(pTxBlk->pPacket)) {
+			ASSERT(pAd->SharedKey[BSS0][0].CipherAlg <=
+			       CIPHER_CKIP128);
 
-			// 4-way handshaking frame must be clear
-			if (!(TX_BLK_TEST_FLAG(pTxBlk, fTX_bClearEAPFrame)) && (pAd->SharedKey[BSS0][0].CipherAlg) &&
-				(pAd->SharedKey[BSS0][0].KeyLen))
-			{
+			/* 4-way handshaking frame must be clear */
+			if (!(TX_BLK_TEST_FLAG(pTxBlk, fTX_bClearEAPFrame))
+			    && (pAd->SharedKey[BSS0][0].CipherAlg)
+			    && (pAd->SharedKey[BSS0][0].KeyLen)) {
 				CipherAlg = pAd->SharedKey[BSS0][0].CipherAlg;
 				KeyIdx = 0;
 			}
-		}
-		else if (Cipher == Ndis802_11Encryption1Enabled)
-		{
-				KeyIdx = pAd->StaCfg.DefaultKeyId;
-		}
-		else if ((Cipher == Ndis802_11Encryption2Enabled) ||
-				 (Cipher == Ndis802_11Encryption3Enabled))
-		{
-			if ((*pSrcBufVA & 0x01) && (ADHOC_ON(pAd))) // multicast
+		} else if (Cipher == Ndis802_11Encryption1Enabled) {
+			KeyIdx = pAd->StaCfg.DefaultKeyId;
+		} else if ((Cipher == Ndis802_11Encryption2Enabled) ||
+			   (Cipher == Ndis802_11Encryption3Enabled)) {
+			if ((*pSrcBufVA & 0x01) && (ADHOC_ON(pAd)))	/* multicast */
 				KeyIdx = pAd->StaCfg.DefaultKeyId;
 			else if (pAd->SharedKey[BSS0][0].KeyLen)
 				KeyIdx = 0;
@@ -1404,16 +1409,17 @@ VOID STAFindCipherAlgorithm(
 
 		if (KeyIdx == 0xff)
 			CipherAlg = CIPHER_NONE;
-		else if ((Cipher == Ndis802_11EncryptionDisabled) || (pAd->SharedKey[BSS0][KeyIdx].KeyLen == 0))
+		else if ((Cipher == Ndis802_11EncryptionDisabled)
+			 || (pAd->SharedKey[BSS0][KeyIdx].KeyLen == 0))
 			CipherAlg = CIPHER_NONE;
-	    else if ( pAd->StaCfg.WpaSupplicantUP &&
-	             (Cipher == Ndis802_11Encryption1Enabled) &&
-	             (pAd->StaCfg.IEEE8021X == TRUE) &&
-	             (pAd->StaCfg.PortSecured == WPA_802_1X_PORT_NOT_SECURED))
-	        CipherAlg = CIPHER_NONE;
-		else
-		{
-			//Header_802_11.FC.Wep = 1;
+		else if (pAd->StaCfg.WpaSupplicantUP &&
+			 (Cipher == Ndis802_11Encryption1Enabled) &&
+			 (pAd->StaCfg.IEEE8021X == TRUE) &&
+			 (pAd->StaCfg.PortSecured ==
+			  WPA_802_1X_PORT_NOT_SECURED))
+			CipherAlg = CIPHER_NONE;
+		else {
+			/*Header_802_11.FC.Wep = 1; */
 			CipherAlg = pAd->SharedKey[BSS0][KeyIdx].CipherAlg;
 			pKey = &pAd->SharedKey[BSS0][KeyIdx];
 		}
@@ -1423,47 +1429,47 @@ VOID STAFindCipherAlgorithm(
 	pTxBlk->pKey = pKey;
 }
 
-
-VOID STABuildCommon802_11Header(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  TX_BLK          *pTxBlk)
+void STABuildCommon802_11Header(struct rt_rtmp_adapter *pAd, struct rt_tx_blk *pTxBlk)
 {
-	HEADER_802_11	*pHeader_802_11;
+	struct rt_header_802_11 *pHeader_802_11;
 
-	//
-	// MAKE A COMMON 802.11 HEADER
-	//
+	/* */
+	/* MAKE A COMMON 802.11 HEADER */
+	/* */
 
-	// normal wlan header size : 24 octets
-	pTxBlk->MpduHeaderLen = sizeof(HEADER_802_11);
+	/* normal wlan header size : 24 octets */
+	pTxBlk->MpduHeaderLen = sizeof(struct rt_header_802_11);
 
-	pHeader_802_11 = (HEADER_802_11 *) &pTxBlk->HeaderBuf[TXINFO_SIZE + TXWI_SIZE];
+	pHeader_802_11 =
+	    (struct rt_header_802_11 *) & pTxBlk->HeaderBuf[TXINFO_SIZE + TXWI_SIZE];
 
-	NdisZeroMemory(pHeader_802_11, sizeof(HEADER_802_11));
+	NdisZeroMemory(pHeader_802_11, sizeof(struct rt_header_802_11));
 
 	pHeader_802_11->FC.FrDs = 0;
 	pHeader_802_11->FC.Type = BTYPE_DATA;
-	pHeader_802_11->FC.SubType = ((TX_BLK_TEST_FLAG(pTxBlk, fTX_bWMM)) ? SUBTYPE_QDATA : SUBTYPE_DATA);
-
-    if (pTxBlk->pMacEntry)
-	{
-		if (TX_BLK_TEST_FLAG(pTxBlk, fTX_bForceNonQoS))
-		{
-			pHeader_802_11->Sequence = pTxBlk->pMacEntry->NonQosDataSeq;
-			pTxBlk->pMacEntry->NonQosDataSeq = (pTxBlk->pMacEntry->NonQosDataSeq+1) & MAXSEQ;
-		}
-		else
-		{
+	pHeader_802_11->FC.SubType =
+	    ((TX_BLK_TEST_FLAG(pTxBlk, fTX_bWMM)) ? SUBTYPE_QDATA :
+	     SUBTYPE_DATA);
+
+	if (pTxBlk->pMacEntry) {
+		if (TX_BLK_TEST_FLAG(pTxBlk, fTX_bForceNonQoS)) {
+			pHeader_802_11->Sequence =
+			    pTxBlk->pMacEntry->NonQosDataSeq;
+			pTxBlk->pMacEntry->NonQosDataSeq =
+			    (pTxBlk->pMacEntry->NonQosDataSeq + 1) & MAXSEQ;
+		} else {
 			{
-    	    pHeader_802_11->Sequence = pTxBlk->pMacEntry->TxSeq[pTxBlk->UserPriority];
-    	    pTxBlk->pMacEntry->TxSeq[pTxBlk->UserPriority] = (pTxBlk->pMacEntry->TxSeq[pTxBlk->UserPriority]+1) & MAXSEQ;
-    	}
-	}
-	}
-	else
-	{
+				pHeader_802_11->Sequence =
+				    pTxBlk->pMacEntry->TxSeq[pTxBlk->
+							     UserPriority];
+				pTxBlk->pMacEntry->TxSeq[pTxBlk->UserPriority] =
+				    (pTxBlk->pMacEntry->
+				     TxSeq[pTxBlk->UserPriority] + 1) & MAXSEQ;
+			}
+		}
+	} else {
 		pHeader_802_11->Sequence = pAd->Sequence;
-		pAd->Sequence = (pAd->Sequence+1) & MAXSEQ; // next sequence
+		pAd->Sequence = (pAd->Sequence + 1) & MAXSEQ;	/* next sequence */
 	}
 
 	pHeader_802_11->Frag = 0;
@@ -1471,20 +1477,23 @@ VOID STABuildCommon802_11Header(
 	pHeader_802_11->FC.MoreData = TX_BLK_TEST_FLAG(pTxBlk, fTX_bMoreData);
 
 	{
-		if (INFRA_ON(pAd))
-		{
+		if (INFRA_ON(pAd)) {
 			{
-			COPY_MAC_ADDR(pHeader_802_11->Addr1, pAd->CommonCfg.Bssid);
-			COPY_MAC_ADDR(pHeader_802_11->Addr2, pAd->CurrentAddress);
-			COPY_MAC_ADDR(pHeader_802_11->Addr3, pTxBlk->pSrcBufHeader);
-			pHeader_802_11->FC.ToDs = 1;
-		}
-		}
-		else if (ADHOC_ON(pAd))
-		{
-			COPY_MAC_ADDR(pHeader_802_11->Addr1, pTxBlk->pSrcBufHeader);
-			COPY_MAC_ADDR(pHeader_802_11->Addr2, pAd->CurrentAddress);
-			COPY_MAC_ADDR(pHeader_802_11->Addr3, pAd->CommonCfg.Bssid);
+				COPY_MAC_ADDR(pHeader_802_11->Addr1,
+					      pAd->CommonCfg.Bssid);
+				COPY_MAC_ADDR(pHeader_802_11->Addr2,
+					      pAd->CurrentAddress);
+				COPY_MAC_ADDR(pHeader_802_11->Addr3,
+					      pTxBlk->pSrcBufHeader);
+				pHeader_802_11->FC.ToDs = 1;
+			}
+		} else if (ADHOC_ON(pAd)) {
+			COPY_MAC_ADDR(pHeader_802_11->Addr1,
+				      pTxBlk->pSrcBufHeader);
+			COPY_MAC_ADDR(pHeader_802_11->Addr2,
+				      pAd->CurrentAddress);
+			COPY_MAC_ADDR(pHeader_802_11->Addr3,
+				      pAd->CommonCfg.Bssid);
 			pHeader_802_11->FC.ToDs = 0;
 		}
 	}
@@ -1492,107 +1501,107 @@ VOID STABuildCommon802_11Header(
 	if (pTxBlk->CipherAlg != CIPHER_NONE)
 		pHeader_802_11->FC.Wep = 1;
 
-	// -----------------------------------------------------------------
-	// STEP 2. MAKE A COMMON 802.11 HEADER SHARED BY ENTIRE FRAGMENT BURST. Fill sequence later.
-	// -----------------------------------------------------------------
+	/* ----------------------------------------------------------------- */
+	/* STEP 2. MAKE A COMMON 802.11 HEADER SHARED BY ENTIRE FRAGMENT BURST. Fill sequence later. */
+	/* ----------------------------------------------------------------- */
 	if (pAd->CommonCfg.bAPSDForcePowerSave)
-    	pHeader_802_11->FC.PwrMgmt = PWR_SAVE;
+		pHeader_802_11->FC.PwrMgmt = PWR_SAVE;
 	else
-    	pHeader_802_11->FC.PwrMgmt = (pAd->StaCfg.Psm == PWR_SAVE);
+		pHeader_802_11->FC.PwrMgmt = (pAd->StaCfg.Psm == PWR_SAVE);
 }
 
-VOID STABuildCache802_11Header(
-	IN RTMP_ADAPTER		*pAd,
-	IN TX_BLK			*pTxBlk,
-	IN UCHAR			*pHeader)
+void STABuildCache802_11Header(struct rt_rtmp_adapter *pAd,
+			       struct rt_tx_blk *pTxBlk, u8 * pHeader)
 {
-	MAC_TABLE_ENTRY	*pMacEntry;
-	PHEADER_802_11	pHeader80211;
+	struct rt_mac_table_entry *pMacEntry;
+	struct rt_header_802_11 * pHeader80211;
 
-	pHeader80211 = (PHEADER_802_11)pHeader;
+	pHeader80211 = (struct rt_header_802_11 *) pHeader;
 	pMacEntry = pTxBlk->pMacEntry;
 
-	//
-	// Update the cached 802.11 HEADER
-	//
+	/* */
+	/* Update the cached 802.11 HEADER */
+	/* */
 
-	// normal wlan header size : 24 octets
-	pTxBlk->MpduHeaderLen = sizeof(HEADER_802_11);
+	/* normal wlan header size : 24 octets */
+	pTxBlk->MpduHeaderLen = sizeof(struct rt_header_802_11);
 
-	// More Bit
+	/* More Bit */
 	pHeader80211->FC.MoreData = TX_BLK_TEST_FLAG(pTxBlk, fTX_bMoreData);
 
-	// Sequence
+	/* Sequence */
 	pHeader80211->Sequence = pMacEntry->TxSeq[pTxBlk->UserPriority];
-    pMacEntry->TxSeq[pTxBlk->UserPriority] = (pMacEntry->TxSeq[pTxBlk->UserPriority]+1) & MAXSEQ;
+	pMacEntry->TxSeq[pTxBlk->UserPriority] =
+	    (pMacEntry->TxSeq[pTxBlk->UserPriority] + 1) & MAXSEQ;
 
 	{
-		// The addr3 of normal packet send from DS is Dest Mac address.
+		/* Check if the frame can be sent through DLS direct link interface */
+		/* If packet can be sent through DLS, then force aggregation disable. (Hard to determine peer STA's capability) */
+
+		/* The addr3 of normal packet send from DS is Dest Mac address. */
 		if (ADHOC_ON(pAd))
-			COPY_MAC_ADDR(pHeader80211->Addr3, pAd->CommonCfg.Bssid);
+			COPY_MAC_ADDR(pHeader80211->Addr3,
+				      pAd->CommonCfg.Bssid);
 		else
-			COPY_MAC_ADDR(pHeader80211->Addr3, pTxBlk->pSrcBufHeader);
+			COPY_MAC_ADDR(pHeader80211->Addr3,
+				      pTxBlk->pSrcBufHeader);
 	}
 
-	// -----------------------------------------------------------------
-	// STEP 2. MAKE A COMMON 802.11 HEADER SHARED BY ENTIRE FRAGMENT BURST. Fill sequence later.
-	// -----------------------------------------------------------------
+	/* ----------------------------------------------------------------- */
+	/* STEP 2. MAKE A COMMON 802.11 HEADER SHARED BY ENTIRE FRAGMENT BURST. Fill sequence later. */
+	/* ----------------------------------------------------------------- */
 	if (pAd->CommonCfg.bAPSDForcePowerSave)
-    	pHeader80211->FC.PwrMgmt = PWR_SAVE;
+		pHeader80211->FC.PwrMgmt = PWR_SAVE;
 	else
-    	pHeader80211->FC.PwrMgmt = (pAd->StaCfg.Psm == PWR_SAVE);
+		pHeader80211->FC.PwrMgmt = (pAd->StaCfg.Psm == PWR_SAVE);
 }
 
-static inline PUCHAR STA_Build_ARalink_Frame_Header(
-	IN RTMP_ADAPTER *pAd,
-	IN TX_BLK		*pTxBlk)
+static inline u8 *STA_Build_ARalink_Frame_Header(struct rt_rtmp_adapter *pAd,
+						    struct rt_tx_blk *pTxBlk)
 {
-	PUCHAR			pHeaderBufPtr;
-	HEADER_802_11	*pHeader_802_11;
-	PNDIS_PACKET	pNextPacket;
-	UINT32			nextBufLen;
-	PQUEUE_ENTRY	pQEntry;
+	u8 *pHeaderBufPtr;
+	struct rt_header_802_11 *pHeader_802_11;
+	void *pNextPacket;
+	u32 nextBufLen;
+	struct rt_queue_entry *pQEntry;
 
 	STAFindCipherAlgorithm(pAd, pTxBlk);
 	STABuildCommon802_11Header(pAd, pTxBlk);
 
-
 	pHeaderBufPtr = &pTxBlk->HeaderBuf[TXINFO_SIZE + TXWI_SIZE];
-	pHeader_802_11 = (HEADER_802_11 *) pHeaderBufPtr;
+	pHeader_802_11 = (struct rt_header_802_11 *) pHeaderBufPtr;
 
-	// steal "order" bit to mark "aggregation"
+	/* steal "order" bit to mark "aggregation" */
 	pHeader_802_11->FC.Order = 1;
 
-	// skip common header
+	/* skip common header */
 	pHeaderBufPtr += pTxBlk->MpduHeaderLen;
 
-	if (TX_BLK_TEST_FLAG(pTxBlk, fTX_bWMM))
-	{
-		//
-		// build QOS Control bytes
-		//
+	if (TX_BLK_TEST_FLAG(pTxBlk, fTX_bWMM)) {
+		/* */
+		/* build QOS Control bytes */
+		/* */
 		*pHeaderBufPtr = (pTxBlk->UserPriority & 0x0F);
 
-		*(pHeaderBufPtr+1) = 0;
-		pHeaderBufPtr +=2;
+		*(pHeaderBufPtr + 1) = 0;
+		pHeaderBufPtr += 2;
 		pTxBlk->MpduHeaderLen += 2;
 	}
+	/* padding at front of LLC header. LLC header should at 4-bytes aligment. */
+	pTxBlk->HdrPadLen = (unsigned long)pHeaderBufPtr;
+	pHeaderBufPtr = (u8 *)ROUND_UP(pHeaderBufPtr, 4);
+	pTxBlk->HdrPadLen = (unsigned long)(pHeaderBufPtr - pTxBlk->HdrPadLen);
 
-	// padding at front of LLC header. LLC header should at 4-bytes aligment.
-	pTxBlk->HdrPadLen = (ULONG)pHeaderBufPtr;
-	pHeaderBufPtr = (PCHAR)ROUND_UP(pHeaderBufPtr, 4);
-	pTxBlk->HdrPadLen = (ULONG)(pHeaderBufPtr - pTxBlk->HdrPadLen);
-
-	// For RA Aggregation,
-	// put the 2nd MSDU length(extra 2-byte field) after QOS_CONTROL in little endian format
+	/* For RA Aggregation, */
+	/* put the 2nd MSDU length(extra 2-byte field) after struct rt_qos_control in little endian format */
 	pQEntry = pTxBlk->TxPacketList.Head;
-	pNextPacket = QUEUE_ENTRY_TO_PKT(pQEntry);
+	pNextPacket = QUEUE_ENTRY_TO_PACKET(pQEntry);
 	nextBufLen = GET_OS_PKT_LEN(pNextPacket);
 	if (RTMP_GET_PACKET_VLAN(pNextPacket))
 		nextBufLen -= LENGTH_802_1Q;
 
-	*pHeaderBufPtr = (UCHAR)nextBufLen & 0xff;
-	*(pHeaderBufPtr+1) = (UCHAR)(nextBufLen >> 8);
+	*pHeaderBufPtr = (u8)nextBufLen & 0xff;
+	*(pHeaderBufPtr + 1) = (u8)(nextBufLen >> 8);
 
 	pHeaderBufPtr += 2;
 	pTxBlk->MpduHeaderLen += 2;
@@ -1601,198 +1610,207 @@ static inline PUCHAR STA_Build_ARalink_Frame_Header(
 
 }
 
-static inline PUCHAR STA_Build_AMSDU_Frame_Header(
-	IN RTMP_ADAPTER *pAd,
-	IN TX_BLK		*pTxBlk)
+static inline u8 *STA_Build_AMSDU_Frame_Header(struct rt_rtmp_adapter *pAd,
+						  struct rt_tx_blk *pTxBlk)
 {
-	PUCHAR			pHeaderBufPtr;//, pSaveBufPtr;
-	HEADER_802_11	*pHeader_802_11;
-
+	u8 *pHeaderBufPtr;	/*, pSaveBufPtr; */
+	struct rt_header_802_11 *pHeader_802_11;
 
 	STAFindCipherAlgorithm(pAd, pTxBlk);
 	STABuildCommon802_11Header(pAd, pTxBlk);
 
 	pHeaderBufPtr = &pTxBlk->HeaderBuf[TXINFO_SIZE + TXWI_SIZE];
-	pHeader_802_11 = (HEADER_802_11 *) pHeaderBufPtr;
+	pHeader_802_11 = (struct rt_header_802_11 *) pHeaderBufPtr;
 
-	// skip common header
+	/* skip common header */
 	pHeaderBufPtr += pTxBlk->MpduHeaderLen;
 
-	//
-	// build QOS Control bytes
-	//
+	/* */
+	/* build QOS Control bytes */
+	/* */
 	*pHeaderBufPtr = (pTxBlk->UserPriority & 0x0F);
 
-	//
-	// A-MSDU packet
-	//
+	/* */
+	/* A-MSDU packet */
+	/* */
 	*pHeaderBufPtr |= 0x80;
 
-	*(pHeaderBufPtr+1) = 0;
-	pHeaderBufPtr +=2;
+	*(pHeaderBufPtr + 1) = 0;
+	pHeaderBufPtr += 2;
 	pTxBlk->MpduHeaderLen += 2;
 
-	//pSaveBufPtr = pHeaderBufPtr;
+	/*pSaveBufPtr = pHeaderBufPtr; */
 
-	//
-	// padding at front of LLC header
-	// LLC header should locate at 4-octets aligment
-	//
-	// @@@ MpduHeaderLen excluding padding @@@
-	//
-	pTxBlk->HdrPadLen = (ULONG)pHeaderBufPtr;
-	pHeaderBufPtr = (PCHAR) ROUND_UP(pHeaderBufPtr, 4);
-	pTxBlk->HdrPadLen = (ULONG)(pHeaderBufPtr - pTxBlk->HdrPadLen);
+	/* */
+	/* padding at front of LLC header */
+	/* LLC header should locate at 4-octets aligment */
+	/* */
+	/* @@@ MpduHeaderLen excluding padding @@@ */
+	/* */
+	pTxBlk->HdrPadLen = (unsigned long)pHeaderBufPtr;
+	pHeaderBufPtr = (u8 *)ROUND_UP(pHeaderBufPtr, 4);
+	pTxBlk->HdrPadLen = (unsigned long)(pHeaderBufPtr - pTxBlk->HdrPadLen);
 
 	return pHeaderBufPtr;
 
 }
 
-
-VOID STA_AMPDU_Frame_Tx(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	TX_BLK			*pTxBlk)
+void STA_AMPDU_Frame_Tx(struct rt_rtmp_adapter *pAd, struct rt_tx_blk *pTxBlk)
 {
-	HEADER_802_11	*pHeader_802_11;
-	PUCHAR			pHeaderBufPtr;
-	USHORT			FreeNumber;
-	MAC_TABLE_ENTRY	*pMacEntry;
-	BOOLEAN			bVLANPkt;
-	PQUEUE_ENTRY	pQEntry;
+	struct rt_header_802_11 *pHeader_802_11;
+	u8 *pHeaderBufPtr;
+	u16 FreeNumber;
+	struct rt_mac_table_entry *pMacEntry;
+	BOOLEAN bVLANPkt;
+	struct rt_queue_entry *pQEntry;
 
 	ASSERT(pTxBlk);
 
-	while(pTxBlk->TxPacketList.Head)
-	{
+	while (pTxBlk->TxPacketList.Head) {
 		pQEntry = RemoveHeadQueue(&pTxBlk->TxPacketList);
 		pTxBlk->pPacket = QUEUE_ENTRY_TO_PACKET(pQEntry);
-		if ( RTMP_FillTxBlkInfo(pAd, pTxBlk) != TRUE)
-		{
-			RELEASE_NDIS_PACKET(pAd, pTxBlk->pPacket, NDIS_STATUS_FAILURE);
+		if (RTMP_FillTxBlkInfo(pAd, pTxBlk) != TRUE) {
+			RELEASE_NDIS_PACKET(pAd, pTxBlk->pPacket,
+					    NDIS_STATUS_FAILURE);
 			continue;
 		}
 
-		bVLANPkt = (RTMP_GET_PACKET_VLAN(pTxBlk->pPacket) ? TRUE : FALSE);
+		bVLANPkt =
+		    (RTMP_GET_PACKET_VLAN(pTxBlk->pPacket) ? TRUE : FALSE);
 
 		pMacEntry = pTxBlk->pMacEntry;
-		if (pMacEntry->isCached)
-		{
-			// NOTE: Please make sure the size of pMacEntry->CachedBuf[] is smaller than pTxBlk->HeaderBuf[]!!!!
-			NdisMoveMemory((PUCHAR)&pTxBlk->HeaderBuf[TXINFO_SIZE], (PUCHAR)&pMacEntry->CachedBuf[0], TXWI_SIZE + sizeof(HEADER_802_11));
-			pHeaderBufPtr = (PUCHAR)(&pTxBlk->HeaderBuf[TXINFO_SIZE + TXWI_SIZE]);
+		if (pMacEntry->isCached) {
+			/* NOTE: Please make sure the size of pMacEntry->CachedBuf[] is smaller than pTxBlk->HeaderBuf[]! */
+			NdisMoveMemory((u8 *)& pTxBlk->
+				       HeaderBuf[TXINFO_SIZE],
+				       (u8 *)& pMacEntry->CachedBuf[0],
+				       TXWI_SIZE + sizeof(struct rt_header_802_11));
+			pHeaderBufPtr =
+			    (u8 *)(&pTxBlk->
+				      HeaderBuf[TXINFO_SIZE + TXWI_SIZE]);
 			STABuildCache802_11Header(pAd, pTxBlk, pHeaderBufPtr);
-		}
-		else
-		{
+		} else {
 			STAFindCipherAlgorithm(pAd, pTxBlk);
 			STABuildCommon802_11Header(pAd, pTxBlk);
 
-			pHeaderBufPtr = &pTxBlk->HeaderBuf[TXINFO_SIZE + TXWI_SIZE];
+			pHeaderBufPtr =
+			    &pTxBlk->HeaderBuf[TXINFO_SIZE + TXWI_SIZE];
 		}
 
+		pHeader_802_11 = (struct rt_header_802_11 *) pHeaderBufPtr;
 
-		pHeader_802_11 = (HEADER_802_11 *) pHeaderBufPtr;
-
-		// skip common header
+		/* skip common header */
 		pHeaderBufPtr += pTxBlk->MpduHeaderLen;
 
-		//
-		// build QOS Control bytes
-		//
+		/* */
+		/* build QOS Control bytes */
+		/* */
 		*pHeaderBufPtr = (pTxBlk->UserPriority & 0x0F);
-		*(pHeaderBufPtr+1) = 0;
-		pHeaderBufPtr +=2;
+		*(pHeaderBufPtr + 1) = 0;
+		pHeaderBufPtr += 2;
 		pTxBlk->MpduHeaderLen += 2;
 
-		//
-		// build HTC+
-		// HTC control filed following QoS field
-		//
-		if ((pAd->CommonCfg.bRdg == TRUE) && CLIENT_STATUS_TEST_FLAG(pTxBlk->pMacEntry, fCLIENT_STATUS_RDG_CAPABLE))
-		{
-			if (pMacEntry->isCached == FALSE)
-			{
-				// mark HTC bit
+		/* */
+		/* build HTC+ */
+		/* HTC control filed following QoS field */
+		/* */
+		if ((pAd->CommonCfg.bRdg == TRUE)
+		    && CLIENT_STATUS_TEST_FLAG(pTxBlk->pMacEntry,
+					       fCLIENT_STATUS_RDG_CAPABLE)) {
+			if (pMacEntry->isCached == FALSE) {
+				/* mark HTC bit */
 				pHeader_802_11->FC.Order = 1;
 
 				NdisZeroMemory(pHeaderBufPtr, 4);
-				*(pHeaderBufPtr+3) |= 0x80;
+				*(pHeaderBufPtr + 3) |= 0x80;
 			}
 			pHeaderBufPtr += 4;
 			pTxBlk->MpduHeaderLen += 4;
 		}
-
-		//pTxBlk->MpduHeaderLen = pHeaderBufPtr - pTxBlk->HeaderBuf - TXWI_SIZE - TXINFO_SIZE;
+		/*pTxBlk->MpduHeaderLen = pHeaderBufPtr - pTxBlk->HeaderBuf - TXWI_SIZE - TXINFO_SIZE; */
 		ASSERT(pTxBlk->MpduHeaderLen >= 24);
 
-		// skip 802.3 header
+		/* skip 802.3 header */
 		pTxBlk->pSrcBufData = pTxBlk->pSrcBufHeader + LENGTH_802_3;
-		pTxBlk->SrcBufLen  -= LENGTH_802_3;
-
-		// skip vlan tag
-		if (bVLANPkt)
-		{
-			pTxBlk->pSrcBufData	+= LENGTH_802_1Q;
-			pTxBlk->SrcBufLen	-= LENGTH_802_1Q;
-		}
-
-		//
-		// padding at front of LLC header
-		// LLC header should locate at 4-octets aligment
-		//
-		// @@@ MpduHeaderLen excluding padding @@@
-		//
-		pTxBlk->HdrPadLen = (ULONG)pHeaderBufPtr;
-		pHeaderBufPtr = (PCHAR) ROUND_UP(pHeaderBufPtr, 4);
-		pTxBlk->HdrPadLen = (ULONG)(pHeaderBufPtr - pTxBlk->HdrPadLen);
-
-		{
-
-			//
-			// Insert LLC-SNAP encapsulation - 8 octets
-			//
-			EXTRA_LLCSNAP_ENCAP_FROM_PKT_OFFSET(pTxBlk->pSrcBufData-2, pTxBlk->pExtraLlcSnapEncap);
-			if (pTxBlk->pExtraLlcSnapEncap)
-			{
-				NdisMoveMemory(pHeaderBufPtr, pTxBlk->pExtraLlcSnapEncap, 6);
+		pTxBlk->SrcBufLen -= LENGTH_802_3;
+
+		/* skip vlan tag */
+		if (bVLANPkt) {
+			pTxBlk->pSrcBufData += LENGTH_802_1Q;
+			pTxBlk->SrcBufLen -= LENGTH_802_1Q;
+		}
+		/* */
+		/* padding at front of LLC header */
+		/* LLC header should locate at 4-octets aligment */
+		/* */
+		/* @@@ MpduHeaderLen excluding padding @@@ */
+		/* */
+		pTxBlk->HdrPadLen = (unsigned long)pHeaderBufPtr;
+		pHeaderBufPtr = (u8 *)ROUND_UP(pHeaderBufPtr, 4);
+		pTxBlk->HdrPadLen = (unsigned long)(pHeaderBufPtr - pTxBlk->HdrPadLen);
+
+		{
+
+			/* */
+			/* Insert LLC-SNAP encapsulation - 8 octets */
+			/* */
+			EXTRA_LLCSNAP_ENCAP_FROM_PKT_OFFSET(pTxBlk->
+							    pSrcBufData - 2,
+							    pTxBlk->
+							    pExtraLlcSnapEncap);
+			if (pTxBlk->pExtraLlcSnapEncap) {
+				NdisMoveMemory(pHeaderBufPtr,
+					       pTxBlk->pExtraLlcSnapEncap, 6);
 				pHeaderBufPtr += 6;
-				// get 2 octets (TypeofLen)
-				NdisMoveMemory(pHeaderBufPtr, pTxBlk->pSrcBufData-2, 2);
+				/* get 2 octets (TypeofLen) */
+				NdisMoveMemory(pHeaderBufPtr,
+					       pTxBlk->pSrcBufData - 2, 2);
 				pHeaderBufPtr += 2;
 				pTxBlk->MpduHeaderLen += LENGTH_802_1_H;
 			}
 
 		}
 
-		if (pMacEntry->isCached)
-		{
-            RTMPWriteTxWI_Cache(pAd, (PTXWI_STRUC)(&pTxBlk->HeaderBuf[TXINFO_SIZE]), pTxBlk);
-		}
-		else
-		{
-			RTMPWriteTxWI_Data(pAd, (PTXWI_STRUC)(&pTxBlk->HeaderBuf[TXINFO_SIZE]), pTxBlk);
-
-			NdisZeroMemory((PUCHAR)(&pMacEntry->CachedBuf[0]), sizeof(pMacEntry->CachedBuf));
-			NdisMoveMemory((PUCHAR)(&pMacEntry->CachedBuf[0]), (PUCHAR)(&pTxBlk->HeaderBuf[TXINFO_SIZE]), (pHeaderBufPtr - (PUCHAR)(&pTxBlk->HeaderBuf[TXINFO_SIZE])));
+		if (pMacEntry->isCached) {
+			RTMPWriteTxWI_Cache(pAd,
+					    (struct rt_txwi *) (&pTxBlk->
+							   HeaderBuf
+							   [TXINFO_SIZE]),
+					    pTxBlk);
+		} else {
+			RTMPWriteTxWI_Data(pAd,
+					   (struct rt_txwi *) (&pTxBlk->
+							  HeaderBuf
+							  [TXINFO_SIZE]),
+					   pTxBlk);
+
+			NdisZeroMemory((u8 *)(&pMacEntry->CachedBuf[0]),
+				       sizeof(pMacEntry->CachedBuf));
+			NdisMoveMemory((u8 *)(&pMacEntry->CachedBuf[0]),
+				       (u8 *)(&pTxBlk->
+						 HeaderBuf[TXINFO_SIZE]),
+				       (pHeaderBufPtr -
+					(u8 *)(&pTxBlk->
+						  HeaderBuf[TXINFO_SIZE])));
 			pMacEntry->isCached = TRUE;
 		}
 
-		// calculate Transmitted AMPDU count and ByteCount
+		/* calculate Transmitted AMPDU count and ByteCount */
 		{
-			pAd->RalinkCounters.TransmittedMPDUsInAMPDUCount.u.LowPart ++;
-			pAd->RalinkCounters.TransmittedOctetsInAMPDUCount.QuadPart += pTxBlk->SrcBufLen;
+			pAd->RalinkCounters.TransmittedMPDUsInAMPDUCount.u.
+			    LowPart++;
+			pAd->RalinkCounters.TransmittedOctetsInAMPDUCount.
+			    QuadPart += pTxBlk->SrcBufLen;
 		}
 
-		//FreeNumber = GET_TXRING_FREENO(pAd, QueIdx);
+		/*FreeNumber = GET_TXRING_FREENO(pAd, QueIdx); */
 
 		HAL_WriteTxResource(pAd, pTxBlk, TRUE, &FreeNumber);
 
-		//
-		// Kick out Tx
-		//
-#ifdef RT2860
+		/* */
+		/* Kick out Tx */
+		/* */
 		if (!RTMP_TEST_PSFLAG(pAd, fRTMP_PS_DISABLE_TX))
-#endif
 			HAL_KickOutTx(pAd, pTxBlk, pTxBlk->QueIdx);
 
 		pAd->RalinkCounters.KickTxCount++;
@@ -1801,118 +1819,124 @@ VOID STA_AMPDU_Frame_Tx(
 
 }
 
-
-VOID STA_AMSDU_Frame_Tx(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	TX_BLK			*pTxBlk)
+void STA_AMSDU_Frame_Tx(struct rt_rtmp_adapter *pAd, struct rt_tx_blk *pTxBlk)
 {
-	PUCHAR			pHeaderBufPtr;
-	USHORT			FreeNumber;
-	USHORT			subFramePayloadLen = 0;	// AMSDU Subframe length without AMSDU-Header / Padding.
-	USHORT			totalMPDUSize=0;
-	UCHAR			*subFrameHeader;
-	UCHAR			padding = 0;
-	USHORT			FirstTx = 0, LastTxIdx = 0;
-	BOOLEAN			bVLANPkt;
-	int 			frameNum = 0;
-	PQUEUE_ENTRY	pQEntry;
-
+	u8 *pHeaderBufPtr;
+	u16 FreeNumber;
+	u16 subFramePayloadLen = 0;	/* AMSDU Subframe length without AMSDU-Header / Padding. */
+	u16 totalMPDUSize = 0;
+	u8 *subFrameHeader;
+	u8 padding = 0;
+	u16 FirstTx = 0, LastTxIdx = 0;
+	BOOLEAN bVLANPkt;
+	int frameNum = 0;
+	struct rt_queue_entry *pQEntry;
 
 	ASSERT(pTxBlk);
 
 	ASSERT((pTxBlk->TxPacketList.Number > 1));
 
-	while(pTxBlk->TxPacketList.Head)
-	{
+	while (pTxBlk->TxPacketList.Head) {
 		pQEntry = RemoveHeadQueue(&pTxBlk->TxPacketList);
 		pTxBlk->pPacket = QUEUE_ENTRY_TO_PACKET(pQEntry);
-		if (RTMP_FillTxBlkInfo(pAd, pTxBlk) != TRUE)
-		{
-			RELEASE_NDIS_PACKET(pAd, pTxBlk->pPacket, NDIS_STATUS_FAILURE);
+		if (RTMP_FillTxBlkInfo(pAd, pTxBlk) != TRUE) {
+			RELEASE_NDIS_PACKET(pAd, pTxBlk->pPacket,
+					    NDIS_STATUS_FAILURE);
 			continue;
 		}
 
-		bVLANPkt = (RTMP_GET_PACKET_VLAN(pTxBlk->pPacket) ? TRUE : FALSE);
+		bVLANPkt =
+		    (RTMP_GET_PACKET_VLAN(pTxBlk->pPacket) ? TRUE : FALSE);
 
-		// skip 802.3 header
+		/* skip 802.3 header */
 		pTxBlk->pSrcBufData = pTxBlk->pSrcBufHeader + LENGTH_802_3;
-		pTxBlk->SrcBufLen  -= LENGTH_802_3;
+		pTxBlk->SrcBufLen -= LENGTH_802_3;
 
-		// skip vlan tag
-		if (bVLANPkt)
-		{
-			pTxBlk->pSrcBufData	+= LENGTH_802_1Q;
-			pTxBlk->SrcBufLen	-= LENGTH_802_1Q;
+		/* skip vlan tag */
+		if (bVLANPkt) {
+			pTxBlk->pSrcBufData += LENGTH_802_1Q;
+			pTxBlk->SrcBufLen -= LENGTH_802_1Q;
 		}
 
-		if (frameNum == 0)
-		{
-			pHeaderBufPtr = STA_Build_AMSDU_Frame_Header(pAd, pTxBlk);
+		if (frameNum == 0) {
+			pHeaderBufPtr =
+			    STA_Build_AMSDU_Frame_Header(pAd, pTxBlk);
 
-			// NOTE: TxWI->MPDUtotalByteCount will be updated after final frame was handled.
-			RTMPWriteTxWI_Data(pAd, (PTXWI_STRUC)(&pTxBlk->HeaderBuf[TXINFO_SIZE]), pTxBlk);
-		}
-		else
-		{
+			/* NOTE: TxWI->MPDUtotalByteCount will be updated after final frame was handled. */
+			RTMPWriteTxWI_Data(pAd,
+					   (struct rt_txwi *) (&pTxBlk->
+							  HeaderBuf
+							  [TXINFO_SIZE]),
+					   pTxBlk);
+		} else {
 			pHeaderBufPtr = &pTxBlk->HeaderBuf[0];
-			padding = ROUND_UP(LENGTH_AMSDU_SUBFRAMEHEAD + subFramePayloadLen, 4) - (LENGTH_AMSDU_SUBFRAMEHEAD + subFramePayloadLen);
-			NdisZeroMemory(pHeaderBufPtr, padding + LENGTH_AMSDU_SUBFRAMEHEAD);
+			padding =
+			    ROUND_UP(LENGTH_AMSDU_SUBFRAMEHEAD +
+				     subFramePayloadLen,
+				     4) - (LENGTH_AMSDU_SUBFRAMEHEAD +
+					   subFramePayloadLen);
+			NdisZeroMemory(pHeaderBufPtr,
+				       padding + LENGTH_AMSDU_SUBFRAMEHEAD);
 			pHeaderBufPtr += padding;
 			pTxBlk->MpduHeaderLen = padding;
 		}
 
-		//
-		// A-MSDU subframe
-		//   DA(6)+SA(6)+Length(2) + LLC/SNAP Encap
-		//
+		/* */
+		/* A-MSDU subframe */
+		/*   DA(6)+SA(6)+Length(2) + LLC/SNAP Encap */
+		/* */
 		subFrameHeader = pHeaderBufPtr;
 		subFramePayloadLen = pTxBlk->SrcBufLen;
 
 		NdisMoveMemory(subFrameHeader, pTxBlk->pSrcBufHeader, 12);
 
-
 		pHeaderBufPtr += LENGTH_AMSDU_SUBFRAMEHEAD;
 		pTxBlk->MpduHeaderLen += LENGTH_AMSDU_SUBFRAMEHEAD;
 
-
-		//
-		// Insert LLC-SNAP encapsulation - 8 octets
-		//
-		EXTRA_LLCSNAP_ENCAP_FROM_PKT_OFFSET(pTxBlk->pSrcBufData-2, pTxBlk->pExtraLlcSnapEncap);
+		/* */
+		/* Insert LLC-SNAP encapsulation - 8 octets */
+		/* */
+		EXTRA_LLCSNAP_ENCAP_FROM_PKT_OFFSET(pTxBlk->pSrcBufData - 2,
+						    pTxBlk->pExtraLlcSnapEncap);
 
 		subFramePayloadLen = pTxBlk->SrcBufLen;
 
-		if (pTxBlk->pExtraLlcSnapEncap)
-		{
-			NdisMoveMemory(pHeaderBufPtr, pTxBlk->pExtraLlcSnapEncap, 6);
+		if (pTxBlk->pExtraLlcSnapEncap) {
+			NdisMoveMemory(pHeaderBufPtr,
+				       pTxBlk->pExtraLlcSnapEncap, 6);
 			pHeaderBufPtr += 6;
-			// get 2 octets (TypeofLen)
-			NdisMoveMemory(pHeaderBufPtr, pTxBlk->pSrcBufData-2, 2);
+			/* get 2 octets (TypeofLen) */
+			NdisMoveMemory(pHeaderBufPtr, pTxBlk->pSrcBufData - 2,
+				       2);
 			pHeaderBufPtr += 2;
 			pTxBlk->MpduHeaderLen += LENGTH_802_1_H;
 			subFramePayloadLen += LENGTH_802_1_H;
 		}
-
-		// update subFrame Length field
+		/* update subFrame Length field */
 		subFrameHeader[12] = (subFramePayloadLen & 0xFF00) >> 8;
 		subFrameHeader[13] = subFramePayloadLen & 0xFF;
 
 		totalMPDUSize += pTxBlk->MpduHeaderLen + pTxBlk->SrcBufLen;
 
-		if (frameNum ==0)
-			FirstTx = HAL_WriteMultiTxResource(pAd, pTxBlk, frameNum, &FreeNumber);
+		if (frameNum == 0)
+			FirstTx =
+			    HAL_WriteMultiTxResource(pAd, pTxBlk, frameNum,
+						     &FreeNumber);
 		else
-			LastTxIdx = HAL_WriteMultiTxResource(pAd, pTxBlk, frameNum, &FreeNumber);
+			LastTxIdx =
+			    HAL_WriteMultiTxResource(pAd, pTxBlk, frameNum,
+						     &FreeNumber);
 
 		frameNum++;
 
 		pAd->RalinkCounters.KickTxCount++;
 		pAd->RalinkCounters.OneSecTxDoneCount++;
 
-		// calculate Transmitted AMSDU Count and ByteCount
+		/* calculate Transmitted AMSDU Count and ByteCount */
 		{
-			pAd->RalinkCounters.TransmittedAMSDUCount.u.LowPart ++;
-			pAd->RalinkCounters.TransmittedOctetsInAMSDU.QuadPart += totalMPDUSize;
+			pAd->RalinkCounters.TransmittedAMSDUCount.u.LowPart++;
+			pAd->RalinkCounters.TransmittedOctetsInAMSDU.QuadPart +=
+			    totalMPDUSize;
 		}
 
 	}
@@ -1920,38 +1944,31 @@ VOID STA_AMSDU_Frame_Tx(
 	HAL_FinalWriteTxResource(pAd, pTxBlk, totalMPDUSize, FirstTx);
 	HAL_LastTxIdx(pAd, pTxBlk->QueIdx, LastTxIdx);
 
-	//
-	// Kick out Tx
-	//
-#ifdef RT2860
+	/* */
+	/* Kick out Tx */
+	/* */
 	if (!RTMP_TEST_PSFLAG(pAd, fRTMP_PS_DISABLE_TX))
-#endif
 		HAL_KickOutTx(pAd, pTxBlk, pTxBlk->QueIdx);
 }
 
-VOID STA_Legacy_Frame_Tx(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	TX_BLK			*pTxBlk)
+void STA_Legacy_Frame_Tx(struct rt_rtmp_adapter *pAd, struct rt_tx_blk *pTxBlk)
 {
-	HEADER_802_11	*pHeader_802_11;
-	PUCHAR			pHeaderBufPtr;
-	USHORT			FreeNumber;
-	BOOLEAN			bVLANPkt;
-	PQUEUE_ENTRY	pQEntry;
+	struct rt_header_802_11 *pHeader_802_11;
+	u8 *pHeaderBufPtr;
+	u16 FreeNumber;
+	BOOLEAN bVLANPkt;
+	struct rt_queue_entry *pQEntry;
 
 	ASSERT(pTxBlk);
 
-
 	pQEntry = RemoveHeadQueue(&pTxBlk->TxPacketList);
 	pTxBlk->pPacket = QUEUE_ENTRY_TO_PACKET(pQEntry);
-	if (RTMP_FillTxBlkInfo(pAd, pTxBlk) != TRUE)
-	{
+	if (RTMP_FillTxBlkInfo(pAd, pTxBlk) != TRUE) {
 		RELEASE_NDIS_PACKET(pAd, pTxBlk->pPacket, NDIS_STATUS_FAILURE);
 		return;
 	}
 
-	if (pTxBlk->TxFrameType == TX_MCAST_FRAME)
-	{
+	if (pTxBlk->TxFrameType == TX_MCAST_FRAME) {
 		INC_COUNTER64(pAd->WlanCounters.MulticastTransmittedFrameCount);
 	}
 
@@ -1968,181 +1985,187 @@ VOID STA_Legacy_Frame_Tx(
 	STAFindCipherAlgorithm(pAd, pTxBlk);
 	STABuildCommon802_11Header(pAd, pTxBlk);
 
-
-	// skip 802.3 header
+	/* skip 802.3 header */
 	pTxBlk->pSrcBufData = pTxBlk->pSrcBufHeader + LENGTH_802_3;
-	pTxBlk->SrcBufLen  -= LENGTH_802_3;
+	pTxBlk->SrcBufLen -= LENGTH_802_3;
 
-	// skip vlan tag
-	if (bVLANPkt)
-	{
-		pTxBlk->pSrcBufData	+= LENGTH_802_1Q;
-		pTxBlk->SrcBufLen	-= LENGTH_802_1Q;
+	/* skip vlan tag */
+	if (bVLANPkt) {
+		pTxBlk->pSrcBufData += LENGTH_802_1Q;
+		pTxBlk->SrcBufLen -= LENGTH_802_1Q;
 	}
 
 	pHeaderBufPtr = &pTxBlk->HeaderBuf[TXINFO_SIZE + TXWI_SIZE];
-	pHeader_802_11 = (HEADER_802_11 *) pHeaderBufPtr;
+	pHeader_802_11 = (struct rt_header_802_11 *) pHeaderBufPtr;
 
-	// skip common header
+	/* skip common header */
 	pHeaderBufPtr += pTxBlk->MpduHeaderLen;
 
-	if (TX_BLK_TEST_FLAG(pTxBlk, fTX_bWMM))
-	{
-		//
-		// build QOS Control bytes
-		//
-		*pHeaderBufPtr = (pTxBlk->UserPriority & 0x0F);
-		*(pHeaderBufPtr+1) = 0;
-		pHeaderBufPtr +=2;
+	if (TX_BLK_TEST_FLAG(pTxBlk, fTX_bWMM)) {
+		/* */
+		/* build QOS Control bytes */
+		/* */
+		*(pHeaderBufPtr) =
+		    ((pTxBlk->UserPriority & 0x0F) | (pAd->CommonCfg.
+						      AckPolicy[pTxBlk->
+								QueIdx] << 5));
+		*(pHeaderBufPtr + 1) = 0;
+		pHeaderBufPtr += 2;
 		pTxBlk->MpduHeaderLen += 2;
 	}
-
-	// The remaining content of MPDU header should locate at 4-octets aligment
-	pTxBlk->HdrPadLen = (ULONG)pHeaderBufPtr;
-	pHeaderBufPtr = (PCHAR) ROUND_UP(pHeaderBufPtr, 4);
-	pTxBlk->HdrPadLen = (ULONG)(pHeaderBufPtr - pTxBlk->HdrPadLen);
+	/* The remaining content of MPDU header should locate at 4-octets aligment */
+	pTxBlk->HdrPadLen = (unsigned long)pHeaderBufPtr;
+	pHeaderBufPtr = (u8 *)ROUND_UP(pHeaderBufPtr, 4);
+	pTxBlk->HdrPadLen = (unsigned long)(pHeaderBufPtr - pTxBlk->HdrPadLen);
 
 	{
 
-		//
-		// Insert LLC-SNAP encapsulation - 8 octets
-		//
-		//
-   		// if original Ethernet frame contains no LLC/SNAP,
-		// then an extra LLC/SNAP encap is required
-		//
-		EXTRA_LLCSNAP_ENCAP_FROM_PKT_START(pTxBlk->pSrcBufHeader, pTxBlk->pExtraLlcSnapEncap);
-		if (pTxBlk->pExtraLlcSnapEncap)
-		{
-			UCHAR vlan_size;
-
-			NdisMoveMemory(pHeaderBufPtr, pTxBlk->pExtraLlcSnapEncap, 6);
+		/* */
+		/* Insert LLC-SNAP encapsulation - 8 octets */
+		/* */
+		/* */
+		/* if original Ethernet frame contains no LLC/SNAP, */
+		/* then an extra LLC/SNAP encap is required */
+		/* */
+		EXTRA_LLCSNAP_ENCAP_FROM_PKT_START(pTxBlk->pSrcBufHeader,
+						   pTxBlk->pExtraLlcSnapEncap);
+		if (pTxBlk->pExtraLlcSnapEncap) {
+			u8 vlan_size;
+
+			NdisMoveMemory(pHeaderBufPtr,
+				       pTxBlk->pExtraLlcSnapEncap, 6);
 			pHeaderBufPtr += 6;
-			// skip vlan tag
-			vlan_size =  (bVLANPkt) ? LENGTH_802_1Q : 0;
-			// get 2 octets (TypeofLen)
-			NdisMoveMemory(pHeaderBufPtr, pTxBlk->pSrcBufHeader+12+vlan_size, 2);
+			/* skip vlan tag */
+			vlan_size = (bVLANPkt) ? LENGTH_802_1Q : 0;
+			/* get 2 octets (TypeofLen) */
+			NdisMoveMemory(pHeaderBufPtr,
+				       pTxBlk->pSrcBufHeader + 12 + vlan_size,
+				       2);
 			pHeaderBufPtr += 2;
 			pTxBlk->MpduHeaderLen += LENGTH_802_1_H;
 		}
 
 	}
 
-	//
-	// prepare for TXWI
-	// use Wcid as Key Index
-	//
+	/* */
+	/* prepare for TXWI */
+	/* use Wcid as Key Index */
+	/* */
 
-	RTMPWriteTxWI_Data(pAd, (PTXWI_STRUC)(&pTxBlk->HeaderBuf[TXINFO_SIZE]), pTxBlk);
+	RTMPWriteTxWI_Data(pAd, (struct rt_txwi *) (&pTxBlk->HeaderBuf[TXINFO_SIZE]),
+			   pTxBlk);
 
-	//FreeNumber = GET_TXRING_FREENO(pAd, QueIdx);
+	/*FreeNumber = GET_TXRING_FREENO(pAd, QueIdx); */
 
 	HAL_WriteTxResource(pAd, pTxBlk, TRUE, &FreeNumber);
 
 	pAd->RalinkCounters.KickTxCount++;
 	pAd->RalinkCounters.OneSecTxDoneCount++;
 
-	//
-	// Kick out Tx
-	//
-#ifdef RT2860
+	/* */
+	/* Kick out Tx */
+	/* */
 	if (!RTMP_TEST_PSFLAG(pAd, fRTMP_PS_DISABLE_TX))
-#endif
 		HAL_KickOutTx(pAd, pTxBlk, pTxBlk->QueIdx);
 }
 
-
-VOID STA_ARalink_Frame_Tx(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	TX_BLK			*pTxBlk)
+void STA_ARalink_Frame_Tx(struct rt_rtmp_adapter *pAd, struct rt_tx_blk *pTxBlk)
 {
-	PUCHAR			pHeaderBufPtr;
-	USHORT			FreeNumber;
-	USHORT			totalMPDUSize=0;
-	USHORT			FirstTx, LastTxIdx;
-	int 			frameNum = 0;
-	BOOLEAN			bVLANPkt;
-	PQUEUE_ENTRY	pQEntry;
-
+	u8 *pHeaderBufPtr;
+	u16 FreeNumber;
+	u16 totalMPDUSize = 0;
+	u16 FirstTx, LastTxIdx;
+	int frameNum = 0;
+	BOOLEAN bVLANPkt;
+	struct rt_queue_entry *pQEntry;
 
 	ASSERT(pTxBlk);
 
-	ASSERT((pTxBlk->TxPacketList.Number== 2));
-
+	ASSERT((pTxBlk->TxPacketList.Number == 2));
 
-	FirstTx = LastTxIdx = 0;  // Is it ok init they as 0?
-	while(pTxBlk->TxPacketList.Head)
-	{
+	FirstTx = LastTxIdx = 0;	/* Is it ok init they as 0? */
+	while (pTxBlk->TxPacketList.Head) {
 		pQEntry = RemoveHeadQueue(&pTxBlk->TxPacketList);
 		pTxBlk->pPacket = QUEUE_ENTRY_TO_PACKET(pQEntry);
 
-		if (RTMP_FillTxBlkInfo(pAd, pTxBlk) != TRUE)
-		{
-			RELEASE_NDIS_PACKET(pAd, pTxBlk->pPacket, NDIS_STATUS_FAILURE);
+		if (RTMP_FillTxBlkInfo(pAd, pTxBlk) != TRUE) {
+			RELEASE_NDIS_PACKET(pAd, pTxBlk->pPacket,
+					    NDIS_STATUS_FAILURE);
 			continue;
 		}
 
-		bVLANPkt = (RTMP_GET_PACKET_VLAN(pTxBlk->pPacket) ? TRUE : FALSE);
+		bVLANPkt =
+		    (RTMP_GET_PACKET_VLAN(pTxBlk->pPacket) ? TRUE : FALSE);
 
-		// skip 802.3 header
+		/* skip 802.3 header */
 		pTxBlk->pSrcBufData = pTxBlk->pSrcBufHeader + LENGTH_802_3;
-		pTxBlk->SrcBufLen  -= LENGTH_802_3;
-
-		// skip vlan tag
-		if (bVLANPkt)
-		{
-			pTxBlk->pSrcBufData	+= LENGTH_802_1Q;
-			pTxBlk->SrcBufLen	-= LENGTH_802_1Q;
-		}
-
-		if (frameNum == 0)
-		{	// For first frame, we need to create the 802.11 header + padding(optional) + RA-AGG-LEN + SNAP Header
-
-			pHeaderBufPtr = STA_Build_ARalink_Frame_Header(pAd, pTxBlk);
-
-			// It's ok write the TxWI here, because the TxWI->MPDUtotalByteCount
-			//	will be updated after final frame was handled.
-			RTMPWriteTxWI_Data(pAd, (PTXWI_STRUC)(&pTxBlk->HeaderBuf[TXINFO_SIZE]), pTxBlk);
-
-
-			//
-			// Insert LLC-SNAP encapsulation - 8 octets
-			//
-			EXTRA_LLCSNAP_ENCAP_FROM_PKT_OFFSET(pTxBlk->pSrcBufData-2, pTxBlk->pExtraLlcSnapEncap);
-
-			if (pTxBlk->pExtraLlcSnapEncap)
-			{
-				NdisMoveMemory(pHeaderBufPtr, pTxBlk->pExtraLlcSnapEncap, 6);
+		pTxBlk->SrcBufLen -= LENGTH_802_3;
+
+		/* skip vlan tag */
+		if (bVLANPkt) {
+			pTxBlk->pSrcBufData += LENGTH_802_1Q;
+			pTxBlk->SrcBufLen -= LENGTH_802_1Q;
+		}
+
+		if (frameNum == 0) {	/* For first frame, we need to create the 802.11 header + padding(optional) + RA-AGG-LEN + SNAP Header */
+
+			pHeaderBufPtr =
+			    STA_Build_ARalink_Frame_Header(pAd, pTxBlk);
+
+			/* It's ok write the TxWI here, because the TxWI->MPDUtotalByteCount */
+			/*      will be updated after final frame was handled. */
+			RTMPWriteTxWI_Data(pAd,
+					   (struct rt_txwi *) (&pTxBlk->
+							  HeaderBuf
+							  [TXINFO_SIZE]),
+					   pTxBlk);
+
+			/* */
+			/* Insert LLC-SNAP encapsulation - 8 octets */
+			/* */
+			EXTRA_LLCSNAP_ENCAP_FROM_PKT_OFFSET(pTxBlk->
+							    pSrcBufData - 2,
+							    pTxBlk->
+							    pExtraLlcSnapEncap);
+
+			if (pTxBlk->pExtraLlcSnapEncap) {
+				NdisMoveMemory(pHeaderBufPtr,
+					       pTxBlk->pExtraLlcSnapEncap, 6);
 				pHeaderBufPtr += 6;
-				// get 2 octets (TypeofLen)
-				NdisMoveMemory(pHeaderBufPtr, pTxBlk->pSrcBufData-2, 2);
+				/* get 2 octets (TypeofLen) */
+				NdisMoveMemory(pHeaderBufPtr,
+					       pTxBlk->pSrcBufData - 2, 2);
 				pHeaderBufPtr += 2;
 				pTxBlk->MpduHeaderLen += LENGTH_802_1_H;
 			}
-		}
-		else
-		{	// For second aggregated frame, we need create the 802.3 header to headerBuf, because PCI will copy it to SDPtr0.
+		} else {	/* For second aggregated frame, we need create the 802.3 header to headerBuf, because PCI will copy it to SDPtr0. */
 
 			pHeaderBufPtr = &pTxBlk->HeaderBuf[0];
 			pTxBlk->MpduHeaderLen = 0;
 
-			// A-Ralink sub-sequent frame header is the same as 802.3 header.
-			//   DA(6)+SA(6)+FrameType(2)
-			NdisMoveMemory(pHeaderBufPtr, pTxBlk->pSrcBufHeader, 12);
+			/* A-Ralink sub-sequent frame header is the same as 802.3 header. */
+			/*   DA(6)+SA(6)+FrameType(2) */
+			NdisMoveMemory(pHeaderBufPtr, pTxBlk->pSrcBufHeader,
+				       12);
 			pHeaderBufPtr += 12;
-			// get 2 octets (TypeofLen)
-			NdisMoveMemory(pHeaderBufPtr, pTxBlk->pSrcBufData-2, 2);
+			/* get 2 octets (TypeofLen) */
+			NdisMoveMemory(pHeaderBufPtr, pTxBlk->pSrcBufData - 2,
+				       2);
 			pHeaderBufPtr += 2;
 			pTxBlk->MpduHeaderLen = LENGTH_ARALINK_SUBFRAMEHEAD;
 		}
 
 		totalMPDUSize += pTxBlk->MpduHeaderLen + pTxBlk->SrcBufLen;
 
-		//FreeNumber = GET_TXRING_FREENO(pAd, QueIdx);
-		if (frameNum ==0)
-			FirstTx = HAL_WriteMultiTxResource(pAd, pTxBlk, frameNum, &FreeNumber);
+		/*FreeNumber = GET_TXRING_FREENO(pAd, QueIdx); */
+		if (frameNum == 0)
+			FirstTx =
+			    HAL_WriteMultiTxResource(pAd, pTxBlk, frameNum,
+						     &FreeNumber);
 		else
-			LastTxIdx = HAL_WriteMultiTxResource(pAd, pTxBlk, frameNum, &FreeNumber);
+			LastTxIdx =
+			    HAL_WriteMultiTxResource(pAd, pTxBlk, frameNum,
+						     &FreeNumber);
 
 		frameNum++;
 
@@ -2155,40 +2178,34 @@ VOID STA_ARalink_Frame_Tx(
 	HAL_FinalWriteTxResource(pAd, pTxBlk, totalMPDUSize, FirstTx);
 	HAL_LastTxIdx(pAd, pTxBlk->QueIdx, LastTxIdx);
 
-	//
-	// Kick out Tx
-	//
-#ifdef RT2860
+	/* */
+	/* Kick out Tx */
+	/* */
 	if (!RTMP_TEST_PSFLAG(pAd, fRTMP_PS_DISABLE_TX))
-#endif
 		HAL_KickOutTx(pAd, pTxBlk, pTxBlk->QueIdx);
 
 }
 
-
-VOID STA_Fragment_Frame_Tx(
-	IN RTMP_ADAPTER *pAd,
-	IN TX_BLK		*pTxBlk)
+void STA_Fragment_Frame_Tx(struct rt_rtmp_adapter *pAd, struct rt_tx_blk *pTxBlk)
 {
-	HEADER_802_11	*pHeader_802_11;
-	PUCHAR			pHeaderBufPtr;
-	USHORT			FreeNumber;
-	UCHAR 			fragNum = 0;
-	PACKET_INFO		PacketInfo;
-	USHORT			EncryptionOverhead = 0;
-	UINT32			FreeMpduSize, SrcRemainingBytes;
-	USHORT			AckDuration;
-	UINT 			NextMpduSize;
-	BOOLEAN			bVLANPkt;
-	PQUEUE_ENTRY	pQEntry;
-
+	struct rt_header_802_11 *pHeader_802_11;
+	u8 *pHeaderBufPtr;
+	u16 FreeNumber;
+	u8 fragNum = 0;
+	struct rt_packet_info PacketInfo;
+	u16 EncryptionOverhead = 0;
+	u32 FreeMpduSize, SrcRemainingBytes;
+	u16 AckDuration;
+	u32 NextMpduSize;
+	BOOLEAN bVLANPkt;
+	struct rt_queue_entry *pQEntry;
+	HTTRANSMIT_SETTING *pTransmit;
 
 	ASSERT(pTxBlk);
 
 	pQEntry = RemoveHeadQueue(&pTxBlk->TxPacketList);
 	pTxBlk->pPacket = QUEUE_ENTRY_TO_PACKET(pQEntry);
-	if (RTMP_FillTxBlkInfo(pAd, pTxBlk) != TRUE)
-	{
+	if (RTMP_FillTxBlkInfo(pAd, pTxBlk) != TRUE) {
 		RELEASE_NDIS_PACKET(pAd, pTxBlk->pPacket, NDIS_STATUS_FAILURE);
 		return;
 	}
@@ -2199,112 +2216,125 @@ VOID STA_Fragment_Frame_Tx(
 	STAFindCipherAlgorithm(pAd, pTxBlk);
 	STABuildCommon802_11Header(pAd, pTxBlk);
 
-	if (pTxBlk->CipherAlg == CIPHER_TKIP)
-	{
-		pTxBlk->pPacket = duplicate_pkt_with_TKIP_MIC(pAd, pTxBlk->pPacket);
+	if (pTxBlk->CipherAlg == CIPHER_TKIP) {
+		pTxBlk->pPacket =
+		    duplicate_pkt_with_TKIP_MIC(pAd, pTxBlk->pPacket);
 		if (pTxBlk->pPacket == NULL)
 			return;
-		RTMP_QueryPacketInfo(pTxBlk->pPacket, &PacketInfo, &pTxBlk->pSrcBufHeader, &pTxBlk->SrcBufLen);
+		RTMP_QueryPacketInfo(pTxBlk->pPacket, &PacketInfo,
+				     &pTxBlk->pSrcBufHeader,
+				     &pTxBlk->SrcBufLen);
 	}
-
-	// skip 802.3 header
+	/* skip 802.3 header */
 	pTxBlk->pSrcBufData = pTxBlk->pSrcBufHeader + LENGTH_802_3;
-	pTxBlk->SrcBufLen  -= LENGTH_802_3;
+	pTxBlk->SrcBufLen -= LENGTH_802_3;
 
-
-	// skip vlan tag
-	if (bVLANPkt)
-	{
-		pTxBlk->pSrcBufData	+= LENGTH_802_1Q;
-		pTxBlk->SrcBufLen	-= LENGTH_802_1Q;
+	/* skip vlan tag */
+	if (bVLANPkt) {
+		pTxBlk->pSrcBufData += LENGTH_802_1Q;
+		pTxBlk->SrcBufLen -= LENGTH_802_1Q;
 	}
 
 	pHeaderBufPtr = &pTxBlk->HeaderBuf[TXINFO_SIZE + TXWI_SIZE];
-	pHeader_802_11 = (HEADER_802_11 *)pHeaderBufPtr;
-
+	pHeader_802_11 = (struct rt_header_802_11 *) pHeaderBufPtr;
 
-	// skip common header
+	/* skip common header */
 	pHeaderBufPtr += pTxBlk->MpduHeaderLen;
 
-	if (TX_BLK_TEST_FLAG(pTxBlk, fTX_bWMM))
-	{
-		//
-		// build QOS Control bytes
-		//
+	if (TX_BLK_TEST_FLAG(pTxBlk, fTX_bWMM)) {
+		/* */
+		/* build QOS Control bytes */
+		/* */
 		*pHeaderBufPtr = (pTxBlk->UserPriority & 0x0F);
 
-		*(pHeaderBufPtr+1) = 0;
-		pHeaderBufPtr +=2;
+		*(pHeaderBufPtr + 1) = 0;
+		pHeaderBufPtr += 2;
 		pTxBlk->MpduHeaderLen += 2;
 	}
-
-	//
-	// padding at front of LLC header
-	// LLC header should locate at 4-octets aligment
-	//
-	pTxBlk->HdrPadLen = (ULONG)pHeaderBufPtr;
-	pHeaderBufPtr = (PCHAR) ROUND_UP(pHeaderBufPtr, 4);
-	pTxBlk->HdrPadLen = (ULONG)(pHeaderBufPtr - pTxBlk->HdrPadLen);
-
-
-
-	//
-	// Insert LLC-SNAP encapsulation - 8 octets
-	//
-	//
-   	// if original Ethernet frame contains no LLC/SNAP,
-	// then an extra LLC/SNAP encap is required
-	//
-	EXTRA_LLCSNAP_ENCAP_FROM_PKT_START(pTxBlk->pSrcBufHeader, pTxBlk->pExtraLlcSnapEncap);
-	if (pTxBlk->pExtraLlcSnapEncap)
-	{
-		UCHAR vlan_size;
+	/* */
+	/* padding at front of LLC header */
+	/* LLC header should locate at 4-octets aligment */
+	/* */
+	pTxBlk->HdrPadLen = (unsigned long)pHeaderBufPtr;
+	pHeaderBufPtr = (u8 *)ROUND_UP(pHeaderBufPtr, 4);
+	pTxBlk->HdrPadLen = (unsigned long)(pHeaderBufPtr - pTxBlk->HdrPadLen);
+
+	/* */
+	/* Insert LLC-SNAP encapsulation - 8 octets */
+	/* */
+	/* */
+	/* if original Ethernet frame contains no LLC/SNAP, */
+	/* then an extra LLC/SNAP encap is required */
+	/* */
+	EXTRA_LLCSNAP_ENCAP_FROM_PKT_START(pTxBlk->pSrcBufHeader,
+					   pTxBlk->pExtraLlcSnapEncap);
+	if (pTxBlk->pExtraLlcSnapEncap) {
+		u8 vlan_size;
 
 		NdisMoveMemory(pHeaderBufPtr, pTxBlk->pExtraLlcSnapEncap, 6);
 		pHeaderBufPtr += 6;
-		// skip vlan tag
-		vlan_size =  (bVLANPkt) ? LENGTH_802_1Q : 0;
-		// get 2 octets (TypeofLen)
-		NdisMoveMemory(pHeaderBufPtr, pTxBlk->pSrcBufHeader+12+vlan_size, 2);
+		/* skip vlan tag */
+		vlan_size = (bVLANPkt) ? LENGTH_802_1Q : 0;
+		/* get 2 octets (TypeofLen) */
+		NdisMoveMemory(pHeaderBufPtr,
+			       pTxBlk->pSrcBufHeader + 12 + vlan_size, 2);
 		pHeaderBufPtr += 2;
 		pTxBlk->MpduHeaderLen += LENGTH_802_1_H;
 	}
 
-
-	// If TKIP is used and fragmentation is required. Driver has to
-	//	append TKIP MIC at tail of the scatter buffer
-	//	MAC ASIC will only perform IV/EIV/ICV insertion but no TKIP MIC
-	if (pTxBlk->CipherAlg == CIPHER_TKIP)
-	{
-
-		// NOTE: DON'T refer the skb->len directly after following copy. Becasue the length is not adjust
-		//			to correct lenght, refer to pTxBlk->SrcBufLen for the packet length in following progress.
-		NdisMoveMemory(pTxBlk->pSrcBufData + pTxBlk->SrcBufLen, &pAd->PrivateInfo.Tx.MIC[0], 8);
-		//skb_put((RTPKT_TO_OSPKT(pTxBlk->pPacket))->tail, 8);
+	/* If TKIP is used and fragmentation is required. Driver has to */
+	/*      append TKIP MIC at tail of the scatter buffer */
+	/*      MAC ASIC will only perform IV/EIV/ICV insertion but no TKIP MIC */
+	if (pTxBlk->CipherAlg == CIPHER_TKIP) {
+		RTMPCalculateMICValue(pAd, pTxBlk->pPacket,
+				      pTxBlk->pExtraLlcSnapEncap, pTxBlk->pKey,
+				      0);
+
+		/* NOTE: DON'T refer the skb->len directly after following copy. Becasue the length is not adjust */
+		/*                      to correct lenght, refer to pTxBlk->SrcBufLen for the packet length in following progress. */
+		NdisMoveMemory(pTxBlk->pSrcBufData + pTxBlk->SrcBufLen,
+			       &pAd->PrivateInfo.Tx.MIC[0], 8);
+		/*skb_put((RTPKT_TO_OSPKT(pTxBlk->pPacket))->tail, 8); */
 		pTxBlk->SrcBufLen += 8;
 		pTxBlk->TotalFrameLen += 8;
 		pTxBlk->CipherAlg = CIPHER_TKIP_NO_MIC;
 	}
-
-	//
-	// calcuate the overhead bytes that encryption algorithm may add. This
-	// affects the calculate of "duration" field
-	//
-	if ((pTxBlk->CipherAlg == CIPHER_WEP64) || (pTxBlk->CipherAlg == CIPHER_WEP128))
-		EncryptionOverhead = 8; //WEP: IV[4] + ICV[4];
+	/* */
+	/* calcuate the overhead bytes that encryption algorithm may add. This */
+	/* affects the calculate of "duration" field */
+	/* */
+	if ((pTxBlk->CipherAlg == CIPHER_WEP64)
+	    || (pTxBlk->CipherAlg == CIPHER_WEP128))
+		EncryptionOverhead = 8;	/*WEP: IV[4] + ICV[4]; */
 	else if (pTxBlk->CipherAlg == CIPHER_TKIP_NO_MIC)
-		EncryptionOverhead = 12;//TKIP: IV[4] + EIV[4] + ICV[4], MIC will be added to TotalPacketLength
+		EncryptionOverhead = 12;	/*TKIP: IV[4] + EIV[4] + ICV[4], MIC will be added to TotalPacketLength */
 	else if (pTxBlk->CipherAlg == CIPHER_TKIP)
-		EncryptionOverhead = 20;//TKIP: IV[4] + EIV[4] + ICV[4] + MIC[8]
+		EncryptionOverhead = 20;	/*TKIP: IV[4] + EIV[4] + ICV[4] + MIC[8] */
 	else if (pTxBlk->CipherAlg == CIPHER_AES)
-		EncryptionOverhead = 16;	// AES: IV[4] + EIV[4] + MIC[8]
+		EncryptionOverhead = 16;	/* AES: IV[4] + EIV[4] + MIC[8] */
 	else
 		EncryptionOverhead = 0;
 
-	// decide how much time an ACK/CTS frame will consume in the air
-	AckDuration = RTMPCalcDuration(pAd, pAd->CommonCfg.ExpectedACKRate[pTxBlk->TxRate], 14);
+	pTransmit = pTxBlk->pTransmit;
+	/* Decide the TX rate */
+	if (pTransmit->field.MODE == MODE_CCK)
+		pTxBlk->TxRate = pTransmit->field.MCS;
+	else if (pTransmit->field.MODE == MODE_OFDM)
+		pTxBlk->TxRate = pTransmit->field.MCS + RATE_FIRST_OFDM_RATE;
+	else
+		pTxBlk->TxRate = RATE_6_5;
+
+	/* decide how much time an ACK/CTS frame will consume in the air */
+	if (pTxBlk->TxRate <= RATE_LAST_OFDM_RATE)
+		AckDuration =
+		    RTMPCalcDuration(pAd,
+				     pAd->CommonCfg.ExpectedACKRate[pTxBlk->
+								    TxRate],
+				     14);
+	else
+		AckDuration = RTMPCalcDuration(pAd, RATE_6_5, 14);
 
-	// Init the total payload length of this frame.
+	/* Init the total payload length of this frame. */
 	SrcRemainingBytes = pTxBlk->SrcBufLen;
 
 	pTxBlk->TotalFragNum = 0xff;
@@ -2315,25 +2345,28 @@ VOID STA_Fragment_Frame_Tx(
 
 		FreeMpduSize -= pTxBlk->MpduHeaderLen;
 
-		if (SrcRemainingBytes <= FreeMpduSize)
-		{	// this is the last or only fragment
+		if (SrcRemainingBytes <= FreeMpduSize) {	/* this is the last or only fragment */
 
 			pTxBlk->SrcBufLen = SrcRemainingBytes;
 
 			pHeader_802_11->FC.MoreFrag = 0;
-			pHeader_802_11->Duration = pAd->CommonCfg.Dsifs + AckDuration;
+			pHeader_802_11->Duration =
+			    pAd->CommonCfg.Dsifs + AckDuration;
 
-			// Indicate the lower layer that this's the last fragment.
+			/* Indicate the lower layer that this's the last fragment. */
 			pTxBlk->TotalFragNum = fragNum;
-		}
-		else
-		{	// more fragment is required
+		} else {	/* more fragment is required */
 
 			pTxBlk->SrcBufLen = FreeMpduSize;
 
-			NextMpduSize = min(((UINT)SrcRemainingBytes - pTxBlk->SrcBufLen), ((UINT)pAd->CommonCfg.FragmentThreshold));
+			NextMpduSize =
+			    min(((u32)SrcRemainingBytes - pTxBlk->SrcBufLen),
+				((u32)pAd->CommonCfg.FragmentThreshold));
 			pHeader_802_11->FC.MoreFrag = 1;
-			pHeader_802_11->Duration = (3 * pAd->CommonCfg.Dsifs) + (2 * AckDuration) + RTMPCalcDuration(pAd, pTxBlk->TxRate, NextMpduSize + EncryptionOverhead);
+			pHeader_802_11->Duration =
+			    (3 * pAd->CommonCfg.Dsifs) + (2 * AckDuration) +
+			    RTMPCalcDuration(pAd, pTxBlk->TxRate,
+					     NextMpduSize + EncryptionOverhead);
 		}
 
 		if (fragNum == 0)
@@ -2341,16 +2374,19 @@ VOID STA_Fragment_Frame_Tx(
 		else
 			pTxBlk->FrameGap = IFS_SIFS;
 
-		RTMPWriteTxWI_Data(pAd, (PTXWI_STRUC)(&pTxBlk->HeaderBuf[TXINFO_SIZE]), pTxBlk);
+		RTMPWriteTxWI_Data(pAd,
+				   (struct rt_txwi *) (&pTxBlk->
+						  HeaderBuf[TXINFO_SIZE]),
+				   pTxBlk);
 
 		HAL_WriteFragTxResource(pAd, pTxBlk, fragNum, &FreeNumber);
 
 		pAd->RalinkCounters.KickTxCount++;
 		pAd->RalinkCounters.OneSecTxDoneCount++;
 
-		// Update the frame number, remaining size of the NDIS packet payload.
+		/* Update the frame number, remaining size of the NDIS packet payload. */
 
-		// space for 802.11 header.
+		/* space for 802.11 header. */
 		if (fragNum == 0 && pTxBlk->pExtraLlcSnapEncap)
 			pTxBlk->MpduHeaderLen -= LENGTH_802_1_H;
 
@@ -2358,17 +2394,17 @@ VOID STA_Fragment_Frame_Tx(
 		SrcRemainingBytes -= pTxBlk->SrcBufLen;
 		pTxBlk->pSrcBufData += pTxBlk->SrcBufLen;
 
-		pHeader_802_11->Frag++;	 // increase Frag #
+		pHeader_802_11->Frag++;	/* increase Frag # */
 
-	}while(SrcRemainingBytes > 0);
+	} while (SrcRemainingBytes > 0);
 
-	//
-	// Kick out Tx
-	//
-	HAL_KickOutTx(pAd, pTxBlk, pTxBlk->QueIdx);
+	/* */
+	/* Kick out Tx */
+	/* */
+	if (!RTMP_TEST_PSFLAG(pAd, fRTMP_PS_DISABLE_TX))
+		HAL_KickOutTx(pAd, pTxBlk, pTxBlk->QueIdx);
 }
 
-
 #define RELEASE_FRAMES_OF_TXBLK(_pAd, _pTxBlk, _pQEntry, _Status) 										\
 		while(_pTxBlk->TxPacketList.Head)														\
 		{																						\
@@ -2376,7 +2412,6 @@ VOID STA_Fragment_Frame_Tx(
 			RELEASE_NDIS_PACKET(_pAd, QUEUE_ENTRY_TO_PACKET(_pQEntry), _Status);	\
 		}
 
-
 /*
 	========================================================================
 
@@ -2387,7 +2422,7 @@ VOID STA_Fragment_Frame_Tx(
 
 	Arguments:
 		pAd 	Pointer to our adapter
-		PNDIS_PACKET	Pointer to outgoing Ndis frame
+		void *	Pointer to outgoing Ndis frame
 		NumberOfFrag	Number of fragment required
 
 	Return Value:
@@ -2399,122 +2434,117 @@ VOID STA_Fragment_Frame_Tx(
 
 	========================================================================
 */
-NDIS_STATUS STAHardTransmit(
-	IN PRTMP_ADAPTER	pAd,
-	IN TX_BLK 			*pTxBlk,
-	IN	UCHAR			QueIdx)
+int STAHardTransmit(struct rt_rtmp_adapter *pAd,
+			    struct rt_tx_blk *pTxBlk, u8 QueIdx)
 {
-	NDIS_PACKET		*pPacket;
-	PQUEUE_ENTRY	pQEntry;
+	char *pPacket;
+	struct rt_queue_entry *pQEntry;
 
-	// ---------------------------------------------
-	// STEP 0. DO SANITY CHECK AND SOME EARLY PREPARATION.
-	// ---------------------------------------------
-	//
+	/* --------------------------------------------- */
+	/* STEP 0. DO SANITY CHECK AND SOME EARLY PREPARATION. */
+	/* --------------------------------------------- */
+	/* */
 	ASSERT(pTxBlk->TxPacketList.Number);
-	if (pTxBlk->TxPacketList.Head == NULL)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("pTxBlk->TotalFrameNum == %ld!\n", pTxBlk->TxPacketList.Number));
+	if (pTxBlk->TxPacketList.Head == NULL) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("pTxBlk->TotalFrameNum == %ld!\n",
+			  pTxBlk->TxPacketList.Number));
 		return NDIS_STATUS_FAILURE;
 	}
 
 	pPacket = QUEUE_ENTRY_TO_PACKET(pTxBlk->TxPacketList.Head);
 
-	// ------------------------------------------------------------------
-	// STEP 1. WAKE UP PHY
-	//		outgoing frame always wakeup PHY to prevent frame lost and
-	//		turn off PSM bit to improve performance
-	// ------------------------------------------------------------------
-	// not to change PSM bit, just send this frame out?
-	if ((pAd->StaCfg.Psm == PWR_SAVE) && OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE))
-	{
-	    DBGPRINT_RAW(RT_DEBUG_TRACE, ("AsicForceWakeup At HardTx\n"));
-#ifdef RT2860
-		AsicForceWakeup(pAd, FROM_TX);
-#endif
-#ifdef RT2870
+	/* ------------------------------------------------------------------ */
+	/* STEP 1. WAKE UP PHY */
+	/*              outgoing frame always wakeup PHY to prevent frame lost and */
+	/*              turn off PSM bit to improve performance */
+	/* ------------------------------------------------------------------ */
+	/* not to change PSM bit, just send this frame out? */
+	if ((pAd->StaCfg.Psm == PWR_SAVE)
+	    && OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE)) {
+		DBGPRINT_RAW(RT_DEBUG_INFO, ("AsicForceWakeup At HardTx\n"));
+#ifdef RTMP_MAC_PCI
 		AsicForceWakeup(pAd, TRUE);
-#endif
+#endif /* RTMP_MAC_PCI // */
+#ifdef RTMP_MAC_USB
+		RTUSBEnqueueInternalCmd(pAd, CMDTHREAD_FORCE_WAKE_UP, NULL, 0);
+#endif /* RTMP_MAC_USB // */
 	}
-
-	// It should not change PSM bit, when APSD turn on.
-	if ((!(pAd->CommonCfg.bAPSDCapable && pAd->CommonCfg.APEdcaParm.bAPSDCapable) && (pAd->CommonCfg.bAPSDForcePowerSave == FALSE))
-		|| (RTMP_GET_PACKET_EAPOL(pTxBlk->pPacket))
-		|| (RTMP_GET_PACKET_WAI(pTxBlk->pPacket)))
-	{
+	/* It should not change PSM bit, when APSD turn on. */
+	if ((!
+	     (pAd->CommonCfg.bAPSDCapable
+	      && pAd->CommonCfg.APEdcaParm.bAPSDCapable)
+	     && (pAd->CommonCfg.bAPSDForcePowerSave == FALSE))
+	    || (RTMP_GET_PACKET_EAPOL(pTxBlk->pPacket))
+	    || (RTMP_GET_PACKET_WAI(pTxBlk->pPacket))) {
 		if ((pAd->StaCfg.Psm == PWR_SAVE) &&
-            (pAd->StaCfg.WindowsPowerMode == Ndis802_11PowerModeFast_PSP))
-			MlmeSetPsmBit(pAd, PWR_ACTIVE);
+		    (pAd->StaCfg.WindowsPowerMode ==
+		     Ndis802_11PowerModeFast_PSP))
+			RTMP_SET_PSM_BIT(pAd, PWR_ACTIVE);
 	}
 
-	switch (pTxBlk->TxFrameType)
-	{
-		case TX_AMPDU_FRAME:
-				STA_AMPDU_Frame_Tx(pAd, pTxBlk);
-			break;
-		case TX_AMSDU_FRAME:
-				STA_AMSDU_Frame_Tx(pAd, pTxBlk);
-			break;
-		case TX_LEGACY_FRAME:
-				STA_Legacy_Frame_Tx(pAd, pTxBlk);
-			break;
-		case TX_MCAST_FRAME:
-				STA_Legacy_Frame_Tx(pAd, pTxBlk);
-			break;
-		case TX_RALINK_FRAME:
-				STA_ARalink_Frame_Tx(pAd, pTxBlk);
-			break;
-		case TX_FRAG_FRAME:
-				STA_Fragment_Frame_Tx(pAd, pTxBlk);
-			break;
-		default:
-			{
-				// It should not happened!
-				DBGPRINT(RT_DEBUG_ERROR, ("Send a pacekt was not classified!! It should not happen!\n"));
-				while(pTxBlk->TxPacketList.Number)
-				{
-					pQEntry = RemoveHeadQueue(&pTxBlk->TxPacketList);
-					pPacket = QUEUE_ENTRY_TO_PACKET(pQEntry);
-					if (pPacket)
-						RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_FAILURE);
-				}
+	switch (pTxBlk->TxFrameType) {
+	case TX_AMPDU_FRAME:
+		STA_AMPDU_Frame_Tx(pAd, pTxBlk);
+		break;
+	case TX_AMSDU_FRAME:
+		STA_AMSDU_Frame_Tx(pAd, pTxBlk);
+		break;
+	case TX_LEGACY_FRAME:
+		STA_Legacy_Frame_Tx(pAd, pTxBlk);
+		break;
+	case TX_MCAST_FRAME:
+		STA_Legacy_Frame_Tx(pAd, pTxBlk);
+		break;
+	case TX_RALINK_FRAME:
+		STA_ARalink_Frame_Tx(pAd, pTxBlk);
+		break;
+	case TX_FRAG_FRAME:
+		STA_Fragment_Frame_Tx(pAd, pTxBlk);
+		break;
+	default:
+		{
+			/* It should not happened! */
+			DBGPRINT(RT_DEBUG_ERROR,
+				 ("Send a packet was not classified! It should not happen!\n"));
+			while (pTxBlk->TxPacketList.Number) {
+				pQEntry =
+				    RemoveHeadQueue(&pTxBlk->TxPacketList);
+				pPacket = QUEUE_ENTRY_TO_PACKET(pQEntry);
+				if (pPacket)
+					RELEASE_NDIS_PACKET(pAd, pPacket,
+							    NDIS_STATUS_FAILURE);
 			}
-			break;
+		}
+		break;
 	}
 
 	return (NDIS_STATUS_SUCCESS);
 
 }
 
-ULONG  HashBytesPolynomial(UCHAR *value, unsigned int len)
+unsigned long HashBytesPolynomial(u8 * value, unsigned int len)
 {
-   unsigned char *word = value;
-   unsigned int ret = 0;
-   unsigned int i;
-
-   for(i=0; i < len; i++)
-   {
-	  int mod = i % 32;
-	  ret ^=(unsigned int) (word[i]) << mod;
-	  ret ^=(unsigned int) (word[i]) >> (32 - mod);
-   }
-   return ret;
+	unsigned char *word = value;
+	unsigned int ret = 0;
+	unsigned int i;
+
+	for (i = 0; i < len; i++) {
+		int mod = i % 32;
+		ret ^= (unsigned int)(word[i]) << mod;
+		ret ^= (unsigned int)(word[i]) >> (32 - mod);
+	}
+	return ret;
 }
 
-VOID Sta_Announce_or_Forward_802_3_Packet(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PNDIS_PACKET	pPacket,
-	IN	UCHAR			FromWhichBSSID)
+void Sta_Announce_or_Forward_802_3_Packet(struct rt_rtmp_adapter *pAd,
+					  void *pPacket,
+					  u8 FromWhichBSSID)
 {
-	if (TRUE
-		)
-	{
+	if (TRUE) {
 		announce_802_3_packet(pAd, pPacket);
-	}
-	else
-	{
-		// release packet
+	} else {
+		/* release packet */
 		RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_FAILURE);
 	}
 }
-
diff --git a/drivers/staging/rt2860/sta/sanity.c b/drivers/staging/rt2860/sta/sanity.c
index 7d530f601602..8f9fd19be151 100644
--- a/drivers/staging/rt2860/sta/sanity.c
+++ b/drivers/staging/rt2860/sta/sanity.c
@@ -36,15 +36,15 @@
 */
 #include "../rt_config.h"
 
-extern UCHAR	CISCO_OUI[];
+extern u8 CISCO_OUI[];
 
-extern UCHAR	WPA_OUI[];
-extern UCHAR	RSN_OUI[];
-extern UCHAR	WME_INFO_ELEM[];
-extern UCHAR	WME_PARM_ELEM[];
-extern UCHAR	Ccx2QosInfo[];
-extern UCHAR	RALINK_OUI[];
-extern UCHAR	BROADCOM_OUI[];
+extern u8 WPA_OUI[];
+extern u8 RSN_OUI[];
+extern u8 WME_INFO_ELEM[];
+extern u8 WME_PARM_ELEM[];
+extern u8 Ccx2QosInfo[];
+extern u8 RALINK_OUI[];
+extern u8 BROADCOM_OUI[];
 
 /*
     ==========================================================================
@@ -54,27 +54,25 @@ extern UCHAR	BROADCOM_OUI[];
         TRUE if all parameters are OK, FALSE otherwise
     ==========================================================================
  */
-BOOLEAN MlmeStartReqSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN VOID *Msg,
-    IN ULONG MsgLen,
-    OUT CHAR Ssid[],
-    OUT UCHAR *pSsidLen)
+BOOLEAN MlmeStartReqSanity(struct rt_rtmp_adapter *pAd,
+			   void * Msg,
+			   unsigned long MsgLen,
+			   char Ssid[], u8 * pSsidLen)
 {
-    MLME_START_REQ_STRUCT *Info;
+	struct rt_mlme_start_req *Info;
 
-    Info = (MLME_START_REQ_STRUCT *)(Msg);
+	Info = (struct rt_mlme_start_req *)(Msg);
 
-    if (Info->SsidLen > MAX_LEN_OF_SSID)
-    {
-        DBGPRINT(RT_DEBUG_TRACE, ("MlmeStartReqSanity fail - wrong SSID length\n"));
-        return FALSE;
-    }
+	if (Info->SsidLen > MAX_LEN_OF_SSID) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("MlmeStartReqSanity fail - wrong SSID length\n"));
+		return FALSE;
+	}
 
-    *pSsidLen = Info->SsidLen;
-    NdisMoveMemory(Ssid, Info->Ssid, *pSsidLen);
+	*pSsidLen = Info->SsidLen;
+	NdisMoveMemory(Ssid, Info->Ssid, *pSsidLen);
 
-    return TRUE;
+	return TRUE;
 }
 
 /*
@@ -88,211 +86,161 @@ BOOLEAN MlmeStartReqSanity(
 
     ==========================================================================
  */
-BOOLEAN PeerAssocRspSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN VOID *pMsg,
-    IN ULONG MsgLen,
-    OUT PUCHAR pAddr2,
-    OUT USHORT *pCapabilityInfo,
-    OUT USHORT *pStatus,
-    OUT USHORT *pAid,
-    OUT UCHAR SupRate[],
-    OUT UCHAR *pSupRateLen,
-    OUT UCHAR ExtRate[],
-    OUT UCHAR *pExtRateLen,
-    OUT HT_CAPABILITY_IE		*pHtCapability,
-    OUT ADD_HT_INFO_IE		*pAddHtInfo,	// AP might use this additional ht info IE
-    OUT UCHAR			*pHtCapabilityLen,
-    OUT UCHAR			*pAddHtInfoLen,
-    OUT UCHAR			*pNewExtChannelOffset,
-    OUT PEDCA_PARM pEdcaParm,
-    OUT UCHAR *pCkipFlag)
+BOOLEAN PeerAssocRspSanity(struct rt_rtmp_adapter *pAd, void * pMsg, unsigned long MsgLen, u8 *pAddr2, u16 * pCapabilityInfo, u16 * pStatus, u16 * pAid, u8 SupRate[], u8 * pSupRateLen, u8 ExtRate[], u8 * pExtRateLen, struct rt_ht_capability_ie * pHtCapability, struct rt_add_ht_info_ie * pAddHtInfo,	/* AP might use this additional ht info IE */
+			   u8 * pHtCapabilityLen,
+			   u8 * pAddHtInfoLen,
+			   u8 * pNewExtChannelOffset,
+			   struct rt_edca_parm *pEdcaParm, u8 * pCkipFlag)
 {
-    CHAR          IeType, *Ptr;
-    PFRAME_802_11 pFrame = (PFRAME_802_11)pMsg;
-    PEID_STRUCT   pEid;
-    ULONG         Length = 0;
+	char IeType, *Ptr;
+	struct rt_frame_802_11 * pFrame = (struct rt_frame_802_11 *) pMsg;
+	struct rt_eid * pEid;
+	unsigned long Length = 0;
 
 	*pNewExtChannelOffset = 0xff;
 	*pHtCapabilityLen = 0;
 	*pAddHtInfoLen = 0;
-    COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
-    Ptr = pFrame->Octet;
-    Length += LENGTH_802_11;
-
-    NdisMoveMemory(pCapabilityInfo, &pFrame->Octet[0], 2);
-    Length += 2;
-    NdisMoveMemory(pStatus,         &pFrame->Octet[2], 2);
-    Length += 2;
-    *pCkipFlag = 0;
-    *pExtRateLen = 0;
-    pEdcaParm->bValid = FALSE;
-
-    if (*pStatus != MLME_SUCCESS)
-        return TRUE;
-
-    NdisMoveMemory(pAid, &pFrame->Octet[4], 2);
-    Length += 2;
-
-    // Aid already swaped byte order in RTMPFrameEndianChange() for big endian platform
-    *pAid = (*pAid) & 0x3fff; // AID is low 14-bit
-
-    // -- get supported rates from payload and advance the pointer
-    IeType = pFrame->Octet[6];
-    *pSupRateLen = pFrame->Octet[7];
-    if ((IeType != IE_SUPP_RATES) || (*pSupRateLen > MAX_LEN_OF_SUPPORTED_RATES))
-    {
-        DBGPRINT(RT_DEBUG_TRACE, ("PeerAssocRspSanity fail - wrong SupportedRates IE\n"));
-        return FALSE;
-    }
-    else
-        NdisMoveMemory(SupRate, &pFrame->Octet[8], *pSupRateLen);
-
-    Length = Length + 2 + *pSupRateLen;
-
-    // many AP implement proprietary IEs in non-standard order, we'd better
-    // tolerate mis-ordered IEs to get best compatibility
-    pEid = (PEID_STRUCT) &pFrame->Octet[8 + (*pSupRateLen)];
-
-    // get variable fields from payload and advance the pointer
-    while ((Length + 2 + pEid->Len) <= MsgLen)
-    {
-        switch (pEid->Eid)
-        {
-            case IE_EXT_SUPP_RATES:
-                if (pEid->Len <= MAX_LEN_OF_SUPPORTED_RATES)
-                {
-                    NdisMoveMemory(ExtRate, pEid->Octet, pEid->Len);
-                    *pExtRateLen = pEid->Len;
-                }
-                break;
-
-             case IE_HT_CAP:
-            case IE_HT_CAP2:
-			if (pEid->Len >= SIZE_HT_CAP_IE)  //Note: allow extension.!!
+	COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
+	Ptr = (char *)pFrame->Octet;
+	Length += LENGTH_802_11;
+
+	NdisMoveMemory(pCapabilityInfo, &pFrame->Octet[0], 2);
+	Length += 2;
+	NdisMoveMemory(pStatus, &pFrame->Octet[2], 2);
+	Length += 2;
+	*pCkipFlag = 0;
+	*pExtRateLen = 0;
+	pEdcaParm->bValid = FALSE;
+
+	if (*pStatus != MLME_SUCCESS)
+		return TRUE;
+
+	NdisMoveMemory(pAid, &pFrame->Octet[4], 2);
+	Length += 2;
+
+	/* Aid already swaped byte order in RTMPFrameEndianChange() for big endian platform */
+	*pAid = (*pAid) & 0x3fff;	/* AID is low 14-bit */
+
+	/* -- get supported rates from payload and advance the pointer */
+	IeType = pFrame->Octet[6];
+	*pSupRateLen = pFrame->Octet[7];
+	if ((IeType != IE_SUPP_RATES)
+	    || (*pSupRateLen > MAX_LEN_OF_SUPPORTED_RATES)) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("PeerAssocRspSanity fail - wrong SupportedRates IE\n"));
+		return FALSE;
+	} else
+		NdisMoveMemory(SupRate, &pFrame->Octet[8], *pSupRateLen);
+
+	Length = Length + 2 + *pSupRateLen;
+
+	/* many AP implement proprietary IEs in non-standard order, we'd better */
+	/* tolerate mis-ordered IEs to get best compatibility */
+	pEid = (struct rt_eid *) & pFrame->Octet[8 + (*pSupRateLen)];
+
+	/* get variable fields from payload and advance the pointer */
+	while ((Length + 2 + pEid->Len) <= MsgLen) {
+		switch (pEid->Eid) {
+		case IE_EXT_SUPP_RATES:
+			if (pEid->Len <= MAX_LEN_OF_SUPPORTED_RATES) {
+				NdisMoveMemory(ExtRate, pEid->Octet, pEid->Len);
+				*pExtRateLen = pEid->Len;
+			}
+			break;
+
+		case IE_HT_CAP:
+		case IE_HT_CAP2:
+			if (pEid->Len >= SIZE_HT_CAP_IE)	/*Note: allow extension! */
 			{
-				NdisMoveMemory(pHtCapability, pEid->Octet, SIZE_HT_CAP_IE);
+				NdisMoveMemory(pHtCapability, pEid->Octet,
+					       SIZE_HT_CAP_IE);
 
-				*(USHORT *)(&pHtCapability->HtCapInfo) = cpu2le16(*(USHORT *)(&pHtCapability->HtCapInfo));
-				*(USHORT *)(&pHtCapability->ExtHtCapInfo) = cpu2le16(*(USHORT *)(&pHtCapability->ExtHtCapInfo));
+				*(u16 *) (&pHtCapability->HtCapInfo) =
+				    cpu2le16(*(u16 *)
+					     (&pHtCapability->HtCapInfo));
+				*(u16 *) (&pHtCapability->ExtHtCapInfo) =
+				    cpu2le16(*(u16 *)
+					     (&pHtCapability->ExtHtCapInfo));
 
 				*pHtCapabilityLen = SIZE_HT_CAP_IE;
+			} else {
+				DBGPRINT(RT_DEBUG_WARN,
+					 ("PeerAssocRspSanity - wrong IE_HT_CAP. \n"));
 			}
-			else
-			{
-				DBGPRINT(RT_DEBUG_WARN, ("PeerAssocRspSanity - wrong IE_HT_CAP. \n"));
-			}
-
-		break;
-            case IE_ADD_HT:
-            case IE_ADD_HT2:
-			if (pEid->Len >= sizeof(ADD_HT_INFO_IE))
-			{
-				// This IE allows extension, but we can ignore extra bytes beyond our knowledge , so only
-				// copy first sizeof(ADD_HT_INFO_IE)
-				NdisMoveMemory(pAddHtInfo, pEid->Octet, sizeof(ADD_HT_INFO_IE));
 
-				*(USHORT *)(&pAddHtInfo->AddHtInfo2) = cpu2le16(*(USHORT *)(&pAddHtInfo->AddHtInfo2));
-				*(USHORT *)(&pAddHtInfo->AddHtInfo3) = cpu2le16(*(USHORT *)(&pAddHtInfo->AddHtInfo3));
+			break;
+		case IE_ADD_HT:
+		case IE_ADD_HT2:
+			if (pEid->Len >= sizeof(struct rt_add_ht_info_ie)) {
+				/* This IE allows extension, but we can ignore extra bytes beyond our knowledge , so only */
+				/* copy first sizeof(struct rt_add_ht_info_ie) */
+				NdisMoveMemory(pAddHtInfo, pEid->Octet,
+					       sizeof(struct rt_add_ht_info_ie));
+
+				*(u16 *) (&pAddHtInfo->AddHtInfo2) =
+				    cpu2le16(*(u16 *)
+					     (&pAddHtInfo->AddHtInfo2));
+				*(u16 *) (&pAddHtInfo->AddHtInfo3) =
+				    cpu2le16(*(u16 *)
+					     (&pAddHtInfo->AddHtInfo3));
 
 				*pAddHtInfoLen = SIZE_ADD_HT_INFO_IE;
-			}
-			else
-			{
-				DBGPRINT(RT_DEBUG_WARN, ("PeerAssocRspSanity - wrong IE_ADD_HT. \n"));
+			} else {
+				DBGPRINT(RT_DEBUG_WARN,
+					 ("PeerAssocRspSanity - wrong IE_ADD_HT. \n"));
 			}
 
-		break;
-            case IE_SECONDARY_CH_OFFSET:
-			if (pEid->Len == 1)
-			{
+			break;
+		case IE_SECONDARY_CH_OFFSET:
+			if (pEid->Len == 1) {
 				*pNewExtChannelOffset = pEid->Octet[0];
+			} else {
+				DBGPRINT(RT_DEBUG_WARN,
+					 ("PeerAssocRspSanity - wrong IE_SECONDARY_CH_OFFSET. \n"));
 			}
-			else
-			{
-				DBGPRINT(RT_DEBUG_WARN, ("PeerAssocRspSanity - wrong IE_SECONDARY_CH_OFFSET. \n"));
+			break;
+
+		case IE_VENDOR_SPECIFIC:
+			/* handle WME PARAMTER ELEMENT */
+			if (NdisEqualMemory(pEid->Octet, WME_PARM_ELEM, 6)
+			    && (pEid->Len == 24)) {
+				u8 *ptr;
+				int i;
+
+				/* parsing EDCA parameters */
+				pEdcaParm->bValid = TRUE;
+				pEdcaParm->bQAck = FALSE;	/* pEid->Octet[0] & 0x10; */
+				pEdcaParm->bQueueRequest = FALSE;	/* pEid->Octet[0] & 0x20; */
+				pEdcaParm->bTxopRequest = FALSE;	/* pEid->Octet[0] & 0x40; */
+				/*pEdcaParm->bMoreDataAck    = FALSE; // pEid->Octet[0] & 0x80; */
+				pEdcaParm->EdcaUpdateCount =
+				    pEid->Octet[6] & 0x0f;
+				pEdcaParm->bAPSDCapable =
+				    (pEid->Octet[6] & 0x80) ? 1 : 0;
+				ptr = (u8 *)& pEid->Octet[8];
+				for (i = 0; i < 4; i++) {
+					u8 aci = (*ptr & 0x60) >> 5;	/* b5~6 is AC INDEX */
+					pEdcaParm->bACM[aci] = (((*ptr) & 0x10) == 0x10);	/* b5 is ACM */
+					pEdcaParm->Aifsn[aci] = (*ptr) & 0x0f;	/* b0~3 is AIFSN */
+					pEdcaParm->Cwmin[aci] = *(ptr + 1) & 0x0f;	/* b0~4 is Cwmin */
+					pEdcaParm->Cwmax[aci] = *(ptr + 1) >> 4;	/* b5~8 is Cwmax */
+					pEdcaParm->Txop[aci] = *(ptr + 2) + 256 * (*(ptr + 3));	/* in unit of 32-us */
+					ptr += 4;	/* point to next AC */
+				}
 			}
-		break;
-            case IE_AIRONET_CKIP:
-                // 0. Check Aironet IE length, it must be larger or equal to 28
-                //    Cisco's AP VxWork version(will not be supported) used this IE length as 28
-                //    Cisco's AP IOS version used this IE length as 30
-                if (pEid->Len < (CKIP_NEGOTIATION_LENGTH - 2))
-                break;
-
-                // 1. Copy CKIP flag byte to buffer for process
-                *pCkipFlag = *(pEid->Octet + 8);
-                break;
-
-            case IE_AIRONET_IPADDRESS:
-                if (pEid->Len != 0x0A)
-                break;
-
-                // Get Cisco Aironet IP information
-                if (NdisEqualMemory(pEid->Octet, CISCO_OUI, 3) == 1)
-                    NdisMoveMemory(pAd->StaCfg.AironetIPAddress, pEid->Octet + 4, 4);
-                break;
-
-            // CCX2, WMM use the same IE value
-            // case IE_CCX_V2:
-            case IE_VENDOR_SPECIFIC:
-                // handle WME PARAMTER ELEMENT
-                if (NdisEqualMemory(pEid->Octet, WME_PARM_ELEM, 6) && (pEid->Len == 24))
-                {
-                    PUCHAR ptr;
-                    int i;
-
-                    // parsing EDCA parameters
-                    pEdcaParm->bValid          = TRUE;
-                    pEdcaParm->bQAck           = FALSE; // pEid->Octet[0] & 0x10;
-                    pEdcaParm->bQueueRequest   = FALSE; // pEid->Octet[0] & 0x20;
-                    pEdcaParm->bTxopRequest    = FALSE; // pEid->Octet[0] & 0x40;
-                    //pEdcaParm->bMoreDataAck    = FALSE; // pEid->Octet[0] & 0x80;
-                    pEdcaParm->EdcaUpdateCount = pEid->Octet[6] & 0x0f;
-                    pEdcaParm->bAPSDCapable    = (pEid->Octet[6] & 0x80) ? 1 : 0;
-                    ptr = &pEid->Octet[8];
-                    for (i=0; i<4; i++)
-                    {
-                        UCHAR aci = (*ptr & 0x60) >> 5; // b5~6 is AC INDEX
-                        pEdcaParm->bACM[aci]  = (((*ptr) & 0x10) == 0x10);   // b5 is ACM
-                        pEdcaParm->Aifsn[aci] = (*ptr) & 0x0f;               // b0~3 is AIFSN
-                        pEdcaParm->Cwmin[aci] = *(ptr+1) & 0x0f;             // b0~4 is Cwmin
-                        pEdcaParm->Cwmax[aci] = *(ptr+1) >> 4;               // b5~8 is Cwmax
-                        pEdcaParm->Txop[aci]  = *(ptr+2) + 256 * (*(ptr+3)); // in unit of 32-us
-                        ptr += 4; // point to next AC
-                    }
-                }
-
-                // handle CCX IE
-                else
-                {
-                    // 0. Check the size and CCX admin control
-                    if (pAd->StaCfg.CCXControl.field.Enable == 0)
-                        break;
-                    if (pEid->Len != 5)
-                        break;
-
-                    // Turn CCX2 if matched
-                    if (NdisEqualMemory(pEid->Octet, Ccx2IeInfo, 5) == 1)
-                        pAd->StaCfg.CCXEnable = TRUE;
-                    break;
-                }
-                break;
-
-            default:
-                DBGPRINT(RT_DEBUG_TRACE, ("PeerAssocRspSanity - ignore unrecognized EID = %d\n", pEid->Eid));
-                break;
-        }
-
-        Length = Length + 2 + pEid->Len;
-        pEid = (PEID_STRUCT)((UCHAR*)pEid + 2 + pEid->Len);
-    }
-
-    // Force CCX2 enable to TRUE for those AP didn't replay CCX v2 IE, we still force it to be on
-    if (pAd->StaCfg.CCXControl.field.Enable == 1)
-        pAd->StaCfg.CCXEnable = TRUE;
-
-    return TRUE;
+			break;
+		default:
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("PeerAssocRspSanity - ignore unrecognized EID = %d\n",
+				  pEid->Eid));
+			break;
+		}
+
+		Length = Length + 2 + pEid->Len;
+		pEid = (struct rt_eid *) ((u8 *) pEid + 2 + pEid->Len);
+	}
+
+	return TRUE;
 }
 
 /*
@@ -306,47 +254,46 @@ BOOLEAN PeerAssocRspSanity(
 
     ==========================================================================
  */
-BOOLEAN PeerProbeReqSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN VOID *Msg,
-    IN ULONG MsgLen,
-    OUT PUCHAR pAddr2,
-    OUT CHAR Ssid[],
-    OUT UCHAR *pSsidLen)
+BOOLEAN PeerProbeReqSanity(struct rt_rtmp_adapter *pAd,
+			   void * Msg,
+			   unsigned long MsgLen,
+			   u8 *pAddr2,
+			   char Ssid[], u8 * pSsidLen)
 {
-    UCHAR         Idx;
-    UCHAR	      RateLen;
-    CHAR          IeType;
-    PFRAME_802_11 pFrame = (PFRAME_802_11)Msg;
-
-    COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
-
-    if ((pFrame->Octet[0] != IE_SSID) || (pFrame->Octet[1] > MAX_LEN_OF_SSID))
-    {
-        DBGPRINT(RT_DEBUG_TRACE, ("PeerProbeReqSanity fail - wrong SSID IE(Type=%d,Len=%d)\n",pFrame->Octet[0],pFrame->Octet[1]));
-        return FALSE;
-    }
-
-    *pSsidLen = pFrame->Octet[1];
-    NdisMoveMemory(Ssid, &pFrame->Octet[2], *pSsidLen);
-
-    Idx = *pSsidLen + 2;
-
-    // -- get supported rates from payload and advance the pointer
-    IeType = pFrame->Octet[Idx];
-    RateLen = pFrame->Octet[Idx + 1];
-    if (IeType != IE_SUPP_RATES)
-    {
-        DBGPRINT(RT_DEBUG_TRACE, ("PeerProbeReqSanity fail - wrong SupportRates IE(Type=%d,Len=%d)\n",pFrame->Octet[Idx],pFrame->Octet[Idx+1]));
-        return FALSE;
-    }
-    else
-    {
-        if ((pAd->CommonCfg.PhyMode == PHY_11G) && (RateLen < 8))
-            return (FALSE);
-    }
-
-    return TRUE;
+	u8 Idx;
+	u8 RateLen;
+	char IeType;
+	struct rt_frame_802_11 * pFrame = (struct rt_frame_802_11 *) Msg;
+
+	COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
+
+	if ((pFrame->Octet[0] != IE_SSID)
+	    || (pFrame->Octet[1] > MAX_LEN_OF_SSID)) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("PeerProbeReqSanity fail - wrong SSID IE(Type=%d,Len=%d)\n",
+			  pFrame->Octet[0], pFrame->Octet[1]));
+		return FALSE;
+	}
+
+	*pSsidLen = pFrame->Octet[1];
+	NdisMoveMemory(Ssid, &pFrame->Octet[2], *pSsidLen);
+
+	Idx = *pSsidLen + 2;
+
+	/* -- get supported rates from payload and advance the pointer */
+	IeType = pFrame->Octet[Idx];
+	RateLen = pFrame->Octet[Idx + 1];
+	if (IeType != IE_SUPP_RATES) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("PeerProbeReqSanity fail - wrong SupportRates IE(Type=%d,Len=%d)\n",
+			  pFrame->Octet[Idx], pFrame->Octet[Idx + 1]));
+		return FALSE;
+	} else {
+		if ((pAd->CommonCfg.PhyMode == PHY_11G) && (RateLen < 8))
+			return (FALSE);
+	}
+
+	return TRUE;
 }
 
 /*
@@ -357,62 +304,58 @@ BOOLEAN PeerProbeReqSanity(
 
     ==========================================================================
  */
-BOOLEAN GetTimBit(
-    IN CHAR *Ptr,
-    IN USHORT Aid,
-    OUT UCHAR *TimLen,
-    OUT UCHAR *BcastFlag,
-    OUT UCHAR *DtimCount,
-    OUT UCHAR *DtimPeriod,
-    OUT UCHAR *MessageToMe)
+BOOLEAN GetTimBit(char * Ptr,
+		  u16 Aid,
+		  u8 * TimLen,
+		  u8 * BcastFlag,
+		  u8 * DtimCount,
+		  u8 * DtimPeriod, u8 * MessageToMe)
 {
-    UCHAR          BitCntl, N1, N2, MyByte, MyBit;
-    CHAR          *IdxPtr;
+	u8 BitCntl, N1, N2, MyByte, MyBit;
+	char *IdxPtr;
 
-    IdxPtr = Ptr;
+	IdxPtr = Ptr;
 
-    IdxPtr ++;
-    *TimLen = *IdxPtr;
+	IdxPtr++;
+	*TimLen = *IdxPtr;
 
-    // get DTIM Count from TIM element
-    IdxPtr ++;
-    *DtimCount = *IdxPtr;
+	/* get DTIM Count from TIM element */
+	IdxPtr++;
+	*DtimCount = *IdxPtr;
 
-    // get DTIM Period from TIM element
-    IdxPtr++;
-    *DtimPeriod = *IdxPtr;
+	/* get DTIM Period from TIM element */
+	IdxPtr++;
+	*DtimPeriod = *IdxPtr;
 
-    // get Bitmap Control from TIM element
-    IdxPtr++;
-    BitCntl = *IdxPtr;
+	/* get Bitmap Control from TIM element */
+	IdxPtr++;
+	BitCntl = *IdxPtr;
 
-    if ((*DtimCount == 0) && (BitCntl & 0x01))
-        *BcastFlag = TRUE;
-    else
-        *BcastFlag = FALSE;
+	if ((*DtimCount == 0) && (BitCntl & 0x01))
+		*BcastFlag = TRUE;
+	else
+		*BcastFlag = FALSE;
 
-    // Parse Partial Virtual Bitmap from TIM element
-    N1 = BitCntl & 0xfe;    // N1 is the first bitmap byte#
-    N2 = *TimLen - 4 + N1;  // N2 is the last bitmap byte#
+	/* Parse Partial Virtual Bitmap from TIM element */
+	N1 = BitCntl & 0xfe;	/* N1 is the first bitmap byte# */
+	N2 = *TimLen - 4 + N1;	/* N2 is the last bitmap byte# */
 
-    if ((Aid < (N1 << 3)) || (Aid >= ((N2 + 1) << 3)))
-        *MessageToMe = FALSE;
-    else
-    {
-        MyByte = (Aid >> 3) - N1;                       // my byte position in the bitmap byte-stream
-        MyBit = Aid % 16 - ((MyByte & 0x01)? 8:0);
+	if ((Aid < (N1 << 3)) || (Aid >= ((N2 + 1) << 3)))
+		*MessageToMe = FALSE;
+	else {
+		MyByte = (Aid >> 3) - N1;	/* my byte position in the bitmap byte-stream */
+		MyBit = Aid % 16 - ((MyByte & 0x01) ? 8 : 0);
 
-        IdxPtr += (MyByte + 1);
+		IdxPtr += (MyByte + 1);
 
-        //if (*IdxPtr)
-        //    DBGPRINT(RT_DEBUG_WARN, ("TIM bitmap = 0x%02x\n", *IdxPtr));
+		/*if (*IdxPtr) */
+		/*    DBGPRINT(RT_DEBUG_WARN, ("TIM bitmap = 0x%02x\n", *IdxPtr)); */
 
-        if (*IdxPtr & (0x01 << MyBit))
-            *MessageToMe = TRUE;
-        else
-            *MessageToMe = FALSE;
-    }
+		if (*IdxPtr & (0x01 << MyBit))
+			*MessageToMe = TRUE;
+		else
+			*MessageToMe = FALSE;
+	}
 
-    return TRUE;
+	return TRUE;
 }
-
diff --git a/drivers/staging/rt2860/sta/sync.c b/drivers/staging/rt2860/sta/sync.c
index a6e4362fc5cc..cbe90a6496d2 100644
--- a/drivers/staging/rt2860/sta/sync.c
+++ b/drivers/staging/rt2860/sta/sync.c
@@ -37,45 +37,7 @@
 */
 #include "../rt_config.h"
 
-#ifdef RT2860
-#define AC0_DEF_TXOP		0
-#define AC1_DEF_TXOP		0
-#define AC2_DEF_TXOP		94
-#define AC3_DEF_TXOP		47
-
-VOID	AdhocTurnOnQos(
-	IN  PRTMP_ADAPTER pAd)
-{
-	// Turn on QOs if use HT rate.
-	if (pAd->CommonCfg.APEdcaParm.bValid == FALSE)
-	{
-		pAd->CommonCfg.APEdcaParm.bValid = TRUE;
-		pAd->CommonCfg.APEdcaParm.Aifsn[0] = 3;
-		pAd->CommonCfg.APEdcaParm.Aifsn[1] = 7;
-		pAd->CommonCfg.APEdcaParm.Aifsn[2] = 1;
-		pAd->CommonCfg.APEdcaParm.Aifsn[3] = 1;
-
-		pAd->CommonCfg.APEdcaParm.Cwmin[0] = 4;
-		pAd->CommonCfg.APEdcaParm.Cwmin[1] = 4;
-		pAd->CommonCfg.APEdcaParm.Cwmin[2] = 3;
-		pAd->CommonCfg.APEdcaParm.Cwmin[3] = 2;
-
-		pAd->CommonCfg.APEdcaParm.Cwmax[0] = 10;
-		pAd->CommonCfg.APEdcaParm.Cwmax[1] = 6;
-		pAd->CommonCfg.APEdcaParm.Cwmax[2] = 4;
-		pAd->CommonCfg.APEdcaParm.Cwmax[3] = 3;
-
-		pAd->CommonCfg.APEdcaParm.Txop[0]  = 0;
-		pAd->CommonCfg.APEdcaParm.Txop[1]  = 0;
-		pAd->CommonCfg.APEdcaParm.Txop[2]  = AC2_DEF_TXOP;
-		pAd->CommonCfg.APEdcaParm.Txop[3]  = AC3_DEF_TXOP;
-	}
-	AsicSetEdcaParm(pAd, &pAd->CommonCfg.APEdcaParm);
-}
-#endif /* RT2860 */
-#ifdef RT2870
-#define ADHOC_ENTRY_BEACON_LOST_TIME	(2*OS_HZ)	// 2 sec
-#endif
+#define ADHOC_ENTRY_BEACON_LOST_TIME	(2*OS_HZ)	/* 2 sec */
 
 /*
 	==========================================================================
@@ -88,38 +50,56 @@ VOID	AdhocTurnOnQos(
 
 	==========================================================================
  */
-VOID SyncStateMachineInit(
-	IN PRTMP_ADAPTER pAd,
-	IN STATE_MACHINE *Sm,
-	OUT STATE_MACHINE_FUNC Trans[])
+void SyncStateMachineInit(struct rt_rtmp_adapter *pAd,
+			  struct rt_state_machine *Sm, OUT STATE_MACHINE_FUNC Trans[])
 {
-	StateMachineInit(Sm, Trans, MAX_SYNC_STATE, MAX_SYNC_MSG, (STATE_MACHINE_FUNC)Drop, SYNC_IDLE, SYNC_MACHINE_BASE);
-
-	// column 1
-	StateMachineSetAction(Sm, SYNC_IDLE, MT2_MLME_SCAN_REQ, (STATE_MACHINE_FUNC)MlmeScanReqAction);
-	StateMachineSetAction(Sm, SYNC_IDLE, MT2_MLME_JOIN_REQ, (STATE_MACHINE_FUNC)MlmeJoinReqAction);
-	StateMachineSetAction(Sm, SYNC_IDLE, MT2_MLME_START_REQ, (STATE_MACHINE_FUNC)MlmeStartReqAction);
-	StateMachineSetAction(Sm, SYNC_IDLE, MT2_PEER_BEACON, (STATE_MACHINE_FUNC)PeerBeacon);
-	StateMachineSetAction(Sm, SYNC_IDLE, MT2_PEER_PROBE_REQ, (STATE_MACHINE_FUNC)PeerProbeReqAction);
-
-	//column 2
-	StateMachineSetAction(Sm, JOIN_WAIT_BEACON, MT2_MLME_SCAN_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenScan);
-	StateMachineSetAction(Sm, JOIN_WAIT_BEACON, MT2_MLME_JOIN_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenJoin);
-	StateMachineSetAction(Sm, JOIN_WAIT_BEACON, MT2_MLME_START_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenStart);
-	StateMachineSetAction(Sm, JOIN_WAIT_BEACON, MT2_PEER_BEACON, (STATE_MACHINE_FUNC)PeerBeaconAtJoinAction);
-	StateMachineSetAction(Sm, JOIN_WAIT_BEACON, MT2_BEACON_TIMEOUT, (STATE_MACHINE_FUNC)BeaconTimeoutAtJoinAction);
-
-	// column 3
-	StateMachineSetAction(Sm, SCAN_LISTEN, MT2_MLME_SCAN_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenScan);
-	StateMachineSetAction(Sm, SCAN_LISTEN, MT2_MLME_JOIN_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenJoin);
-	StateMachineSetAction(Sm, SCAN_LISTEN, MT2_MLME_START_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenStart);
-	StateMachineSetAction(Sm, SCAN_LISTEN, MT2_PEER_BEACON, (STATE_MACHINE_FUNC)PeerBeaconAtScanAction);
-	StateMachineSetAction(Sm, SCAN_LISTEN, MT2_PEER_PROBE_RSP, (STATE_MACHINE_FUNC)PeerBeaconAtScanAction);
-	StateMachineSetAction(Sm, SCAN_LISTEN, MT2_SCAN_TIMEOUT, (STATE_MACHINE_FUNC)ScanTimeoutAction);
-
-	// timer init
-	RTMPInitTimer(pAd, &pAd->MlmeAux.BeaconTimer, GET_TIMER_FUNCTION(BeaconTimeout), pAd, FALSE);
-	RTMPInitTimer(pAd, &pAd->MlmeAux.ScanTimer, GET_TIMER_FUNCTION(ScanTimeout), pAd, FALSE);
+	StateMachineInit(Sm, Trans, MAX_SYNC_STATE, MAX_SYNC_MSG,
+			 (STATE_MACHINE_FUNC) Drop, SYNC_IDLE,
+			 SYNC_MACHINE_BASE);
+
+	/* column 1 */
+	StateMachineSetAction(Sm, SYNC_IDLE, MT2_MLME_SCAN_REQ,
+			      (STATE_MACHINE_FUNC) MlmeScanReqAction);
+	StateMachineSetAction(Sm, SYNC_IDLE, MT2_MLME_JOIN_REQ,
+			      (STATE_MACHINE_FUNC) MlmeJoinReqAction);
+	StateMachineSetAction(Sm, SYNC_IDLE, MT2_MLME_START_REQ,
+			      (STATE_MACHINE_FUNC) MlmeStartReqAction);
+	StateMachineSetAction(Sm, SYNC_IDLE, MT2_PEER_BEACON,
+			      (STATE_MACHINE_FUNC) PeerBeacon);
+	StateMachineSetAction(Sm, SYNC_IDLE, MT2_PEER_PROBE_REQ,
+			      (STATE_MACHINE_FUNC) PeerProbeReqAction);
+
+	/*column 2 */
+	StateMachineSetAction(Sm, JOIN_WAIT_BEACON, MT2_MLME_SCAN_REQ,
+			      (STATE_MACHINE_FUNC) InvalidStateWhenScan);
+	StateMachineSetAction(Sm, JOIN_WAIT_BEACON, MT2_MLME_JOIN_REQ,
+			      (STATE_MACHINE_FUNC) InvalidStateWhenJoin);
+	StateMachineSetAction(Sm, JOIN_WAIT_BEACON, MT2_MLME_START_REQ,
+			      (STATE_MACHINE_FUNC) InvalidStateWhenStart);
+	StateMachineSetAction(Sm, JOIN_WAIT_BEACON, MT2_PEER_BEACON,
+			      (STATE_MACHINE_FUNC) PeerBeaconAtJoinAction);
+	StateMachineSetAction(Sm, JOIN_WAIT_BEACON, MT2_BEACON_TIMEOUT,
+			      (STATE_MACHINE_FUNC) BeaconTimeoutAtJoinAction);
+
+	/* column 3 */
+	StateMachineSetAction(Sm, SCAN_LISTEN, MT2_MLME_SCAN_REQ,
+			      (STATE_MACHINE_FUNC) InvalidStateWhenScan);
+	StateMachineSetAction(Sm, SCAN_LISTEN, MT2_MLME_JOIN_REQ,
+			      (STATE_MACHINE_FUNC) InvalidStateWhenJoin);
+	StateMachineSetAction(Sm, SCAN_LISTEN, MT2_MLME_START_REQ,
+			      (STATE_MACHINE_FUNC) InvalidStateWhenStart);
+	StateMachineSetAction(Sm, SCAN_LISTEN, MT2_PEER_BEACON,
+			      (STATE_MACHINE_FUNC) PeerBeaconAtScanAction);
+	StateMachineSetAction(Sm, SCAN_LISTEN, MT2_PEER_PROBE_RSP,
+			      (STATE_MACHINE_FUNC) PeerBeaconAtScanAction);
+	StateMachineSetAction(Sm, SCAN_LISTEN, MT2_SCAN_TIMEOUT,
+			      (STATE_MACHINE_FUNC) ScanTimeoutAction);
+
+	/* timer init */
+	RTMPInitTimer(pAd, &pAd->MlmeAux.BeaconTimer,
+		      GET_TIMER_FUNCTION(BeaconTimeout), pAd, FALSE);
+	RTMPInitTimer(pAd, &pAd->MlmeAux.ScanTimer,
+		      GET_TIMER_FUNCTION(ScanTimeout), pAd, FALSE);
 }
 
 /*
@@ -131,36 +111,35 @@ VOID SyncStateMachineInit(
 
 	==========================================================================
  */
-VOID BeaconTimeout(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3)
+void BeaconTimeout(void *SystemSpecific1,
+		   void *FunctionContext,
+		   void *SystemSpecific2, void *SystemSpecific3)
 {
-	RTMP_ADAPTER *pAd = (RTMP_ADAPTER *)FunctionContext;
+	struct rt_rtmp_adapter *pAd = (struct rt_rtmp_adapter *)FunctionContext;
 
-	DBGPRINT(RT_DEBUG_TRACE,("SYNC - BeaconTimeout\n"));
+	DBGPRINT(RT_DEBUG_TRACE, ("SYNC - BeaconTimeout\n"));
 
-	// Do nothing if the driver is starting halt state.
-	// This might happen when timer already been fired before cancel timer with mlmehalt
+	/* Do nothing if the driver is starting halt state. */
+	/* This might happen when timer already been fired before cancel timer with mlmehalt */
 	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS))
 		return;
 
 	if ((pAd->CommonCfg.BBPCurrentBW == BW_40)
-		)
-	{
-		UCHAR        BBPValue = 0;
+	    ) {
+		u8 BBPValue = 0;
 		AsicSwitchChannel(pAd, pAd->CommonCfg.CentralChannel, FALSE);
 		AsicLockChannel(pAd, pAd->CommonCfg.CentralChannel);
 		RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R4, &BBPValue);
 		BBPValue &= (~0x18);
 		BBPValue |= 0x10;
 		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R4, BBPValue);
-		DBGPRINT(RT_DEBUG_TRACE, ("SYNC - End of SCAN, restore to 40MHz channel %d, Total BSS[%02d]\n",pAd->CommonCfg.CentralChannel, pAd->ScanTab.BssNr));
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("SYNC - End of SCAN, restore to 40MHz channel %d, Total BSS[%02d]\n",
+			  pAd->CommonCfg.CentralChannel, pAd->ScanTab.BssNr));
 	}
 
 	MlmeEnqueue(pAd, SYNC_STATE_MACHINE, MT2_BEACON_TIMEOUT, 0, NULL);
-	RT28XX_MLME_HANDLER(pAd);
+	RTMP_MLME_HANDLER(pAd);
 }
 
 /*
@@ -172,32 +151,28 @@ VOID BeaconTimeout(
 
 	==========================================================================
  */
-VOID ScanTimeout(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3)
+void ScanTimeout(void *SystemSpecific1,
+		 void *FunctionContext,
+		 void *SystemSpecific2, void *SystemSpecific3)
 {
-	RTMP_ADAPTER *pAd = (RTMP_ADAPTER *)FunctionContext;
+	struct rt_rtmp_adapter *pAd = (struct rt_rtmp_adapter *)FunctionContext;
 
-
-	// Do nothing if the driver is starting halt state.
-	// This might happen when timer already been fired before cancel timer with mlmehalt
+	/* Do nothing if the driver is starting halt state. */
+	/* This might happen when timer already been fired before cancel timer with mlmehalt */
 	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS))
 		return;
 
-	if (MlmeEnqueue(pAd, SYNC_STATE_MACHINE, MT2_SCAN_TIMEOUT, 0, NULL))
-	{
-		RT28XX_MLME_HANDLER(pAd);
-	}
-	else
-	{
-		// To prevent SyncMachine.CurrState is SCAN_LISTEN forever.
+	if (MlmeEnqueue(pAd, SYNC_STATE_MACHINE, MT2_SCAN_TIMEOUT, 0, NULL)) {
+		RTMP_MLME_HANDLER(pAd);
+	} else {
+		/* To prevent SyncMachine.CurrState is SCAN_LISTEN forever. */
 		pAd->MlmeAux.Channel = 0;
 		ScanNextChannel(pAd);
-		if (pAd->CommonCfg.bWirelessEvent)
-		{
-			RTMPSendWirelessEvent(pAd, IW_SCAN_ENQUEUE_FAIL_EVENT_FLAG, pAd->MacTab.Content[BSSID_WCID].Addr, BSS0, 0);
+		if (pAd->CommonCfg.bWirelessEvent) {
+			RTMPSendWirelessEvent(pAd,
+					      IW_SCAN_ENQUEUE_FAIL_EVENT_FLAG,
+					      pAd->MacTab.Content[BSSID_WCID].
+					      Addr, BSS0, 0);
 		}
 	}
 }
@@ -208,81 +183,78 @@ VOID ScanTimeout(
 		MLME SCAN req state machine procedure
 	==========================================================================
  */
-VOID MlmeScanReqAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
+void MlmeScanReqAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-	UCHAR          Ssid[MAX_LEN_OF_SSID], SsidLen, ScanType, BssType, BBPValue = 0;
-	BOOLEAN        TimerCancelled;
-	ULONG		   Now;
-	USHORT         Status;
-	PHEADER_802_11 pHdr80211;
-	PUCHAR         pOutBuffer = NULL;
-	NDIS_STATUS    NStatus;
-
-	// Check the total scan tries for one single OID command
-	// If this is the CCX 2.0 Case, skip that!
-	if ( !RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_START_UP))
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("SYNC - MlmeScanReqAction before Startup\n"));
+	u8 Ssid[MAX_LEN_OF_SSID], SsidLen, ScanType, BssType, BBPValue = 0;
+	BOOLEAN TimerCancelled;
+	unsigned long Now;
+	u16 Status;
+	struct rt_header_802_11 * pHdr80211;
+	u8 *pOutBuffer = NULL;
+	int NStatus;
+
+	/* Check the total scan tries for one single OID command */
+	/* If this is the CCX 2.0 Case, skip that! */
+	if (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_START_UP)) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("SYNC - MlmeScanReqAction before Startup\n"));
 		return;
 	}
-
-	// Increase the scan retry counters.
+	/* Increase the scan retry counters. */
 	pAd->StaCfg.ScanCnt++;
 
-#ifdef RT2860
-    if ((OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_ADVANCE_POWER_SAVE_PCIE_DEVICE)) &&
-        (IDLE_ON(pAd)) &&
-		(pAd->StaCfg.bRadio == TRUE) &&
-		(RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_IDLE_RADIO_OFF)))
-	{
-		RT28xxPciAsicRadioOn(pAd, GUI_IDLE_POWER_SAVE);
+#ifdef RTMP_MAC_PCI
+	if ((OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE)) &&
+	    (IDLE_ON(pAd)) &&
+	    (pAd->StaCfg.bRadio == TRUE) &&
+	    (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_IDLE_RADIO_OFF))) {
+		if (pAd->StaCfg.PSControl.field.EnableNewPS == FALSE) {
+			AsicSendCommandToMcu(pAd, 0x31, PowerWakeCID, 0x00,
+					     0x02);
+			AsicCheckCommanOk(pAd, PowerWakeCID);
+			RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_IDLE_RADIO_OFF);
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("PSM - Issue Wake up command \n"));
+		} else {
+			RT28xxPciAsicRadioOn(pAd, GUI_IDLE_POWER_SAVE);
+		}
 	}
-#endif
+#endif /* RTMP_MAC_PCI // */
 
-	// first check the parameter sanity
+	/* first check the parameter sanity */
 	if (MlmeScanReqSanity(pAd,
-						  Elem->Msg,
-						  Elem->MsgLen,
-						  &BssType,
-						  Ssid,
-						  &SsidLen,
-						  &ScanType))
-	{
-
-		// Check for channel load and noise hist request
-		// Suspend MSDU only at scan request, not the last two mentioned
-		if ((ScanType == SCAN_CISCO_NOISE) || (ScanType == SCAN_CISCO_CHANNEL_LOAD))
-		{
-			if (pAd->StaCfg.CCXScanChannel != pAd->CommonCfg.Channel)
-				RTMPSuspendMsduTransmission(pAd);			// Suspend MSDU transmission here
-		}
-		else
-		{
-			// Suspend MSDU transmission here
-			RTMPSuspendMsduTransmission(pAd);
-		}
-
-		//
-		// To prevent data lost.
-		// Send an NULL data with turned PSM bit on to current associated AP before SCAN progress.
-		// And should send an NULL data with turned PSM bit off to AP, when scan progress done
-		//
-		if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED) && (INFRA_ON(pAd)))
-		{
-			NStatus = MlmeAllocateMemory(pAd, (PVOID)&pOutBuffer);
-			if (NStatus	== NDIS_STATUS_SUCCESS)
-			{
-				pHdr80211 = (PHEADER_802_11) pOutBuffer;
-				MgtMacHeaderInit(pAd, pHdr80211, SUBTYPE_NULL_FUNC, 1, pAd->CommonCfg.Bssid, pAd->CommonCfg.Bssid);
+			      Elem->Msg,
+			      Elem->MsgLen,
+			      &BssType, (char *)Ssid, &SsidLen, &ScanType)) {
+
+		/* Check for channel load and noise hist request */
+		/* Suspend MSDU only at scan request, not the last two mentioned */
+		/* Suspend MSDU transmission here */
+		RTMPSuspendMsduTransmission(pAd);
+
+		/* */
+		/* To prevent data lost. */
+		/* Send an NULL data with turned PSM bit on to current associated AP before SCAN progress. */
+		/* And should send an NULL data with turned PSM bit off to AP, when scan progress done */
+		/* */
+		if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED)
+		    && (INFRA_ON(pAd))) {
+			NStatus = MlmeAllocateMemory(pAd, (void *)& pOutBuffer);
+			if (NStatus == NDIS_STATUS_SUCCESS) {
+				pHdr80211 = (struct rt_header_802_11 *) pOutBuffer;
+				MgtMacHeaderInit(pAd, pHdr80211,
+						 SUBTYPE_NULL_FUNC, 1,
+						 pAd->CommonCfg.Bssid,
+						 pAd->CommonCfg.Bssid);
 				pHdr80211->Duration = 0;
 				pHdr80211->FC.Type = BTYPE_DATA;
 				pHdr80211->FC.PwrMgmt = PWR_SAVE;
 
-				// Send using priority queue
-				MiniportMMRequest(pAd, 0, pOutBuffer, sizeof(HEADER_802_11));
-				DBGPRINT(RT_DEBUG_TRACE, ("MlmeScanReqAction -- Send PSM Data frame for off channel RM\n"));
+				/* Send using priority queue */
+				MiniportMMRequest(pAd, 0, pOutBuffer,
+						  sizeof(struct rt_header_802_11));
+				DBGPRINT(RT_DEBUG_TRACE,
+					 ("MlmeScanReqAction -- Send PSM Data frame for off channel RM\n"));
 				MlmeFreeMemory(pAd, pOutBuffer);
 				RTMPusecDelay(5000);
 			}
@@ -290,38 +262,32 @@ VOID MlmeScanReqAction(
 
 		NdisGetSystemUpTime(&Now);
 		pAd->StaCfg.LastScanTime = Now;
-		// reset all the timers
+		/* reset all the timers */
 		RTMPCancelTimer(&pAd->MlmeAux.BeaconTimer, &TimerCancelled);
 		RTMPCancelTimer(&pAd->MlmeAux.ScanTimer, &TimerCancelled);
 
-		// record desired BSS parameters
+		/* record desired BSS parameters */
 		pAd->MlmeAux.BssType = BssType;
 		pAd->MlmeAux.ScanType = ScanType;
 		pAd->MlmeAux.SsidLen = SsidLen;
-        NdisZeroMemory(pAd->MlmeAux.Ssid, MAX_LEN_OF_SSID);
+		NdisZeroMemory(pAd->MlmeAux.Ssid, MAX_LEN_OF_SSID);
 		NdisMoveMemory(pAd->MlmeAux.Ssid, Ssid, SsidLen);
 
-		// start from the first channel
+		/* start from the first channel */
 		pAd->MlmeAux.Channel = FirstChannel(pAd);
 
-		// Change the scan channel when dealing with CCX beacon report
-		if ((ScanType == SCAN_CISCO_PASSIVE) || (ScanType == SCAN_CISCO_ACTIVE) ||
-			(ScanType == SCAN_CISCO_CHANNEL_LOAD) || (ScanType == SCAN_CISCO_NOISE))
-			pAd->MlmeAux.Channel = pAd->StaCfg.CCXScanChannel;
-
-		// Let BBP register at 20MHz to do scan
+		/* Let BBP register at 20MHz to do scan */
 		RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R4, &BBPValue);
 		BBPValue &= (~0x18);
 		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R4, BBPValue);
 		DBGPRINT(RT_DEBUG_TRACE, ("SYNC - BBP R4 to 20MHz.l\n"));
 		ScanNextChannel(pAd);
-	}
-	else
-	{
+	} else {
 		DBGPRINT_ERR(("SYNC - MlmeScanReqAction() sanity check fail\n"));
 		pAd->Mlme.SyncMachine.CurrState = SYNC_IDLE;
 		Status = MLME_INVALID_FORMAT;
-		MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_SCAN_CONF, 2, &Status);
+		MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_SCAN_CONF, 2,
+			    &Status);
 	}
 }
 
@@ -331,49 +297,47 @@ VOID MlmeScanReqAction(
 		MLME JOIN req state machine procedure
 	==========================================================================
  */
-VOID MlmeJoinReqAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
+void MlmeJoinReqAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-	UCHAR        BBPValue = 0;
-	BSS_ENTRY    *pBss;
-	BOOLEAN       TimerCancelled;
-	HEADER_802_11 Hdr80211;
-	NDIS_STATUS   NStatus;
-	ULONG         FrameLen = 0;
-	PUCHAR        pOutBuffer = NULL;
-	PUCHAR        pSupRate = NULL;
-	UCHAR         SupRateLen;
-	PUCHAR        pExtRate = NULL;
-	UCHAR         ExtRateLen;
-	UCHAR         ASupRate[] = {0x8C, 0x12, 0x98, 0x24, 0xb0, 0x48, 0x60, 0x6C};
-	UCHAR         ASupRateLen = sizeof(ASupRate)/sizeof(UCHAR);
-	MLME_JOIN_REQ_STRUCT *pInfo = (MLME_JOIN_REQ_STRUCT *)(Elem->Msg);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("SYNC - MlmeJoinReqAction(BSS #%ld)\n", pInfo->BssIdx));
-
-#ifdef RT2860
-    if ((OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_ADVANCE_POWER_SAVE_PCIE_DEVICE)) &&
-        (IDLE_ON(pAd)) &&
-		(pAd->StaCfg.bRadio == TRUE) &&
-		(RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_IDLE_RADIO_OFF)))
-	{
+	u8 BBPValue = 0;
+	struct rt_bss_entry *pBss;
+	BOOLEAN TimerCancelled;
+	struct rt_header_802_11 Hdr80211;
+	int NStatus;
+	unsigned long FrameLen = 0;
+	u8 *pOutBuffer = NULL;
+	u8 *pSupRate = NULL;
+	u8 SupRateLen;
+	u8 *pExtRate = NULL;
+	u8 ExtRateLen;
+	u8 ASupRate[] = { 0x8C, 0x12, 0x98, 0x24, 0xb0, 0x48, 0x60, 0x6C };
+	u8 ASupRateLen = sizeof(ASupRate) / sizeof(u8);
+	struct rt_mlme_join_req *pInfo = (struct rt_mlme_join_req *)(Elem->Msg);
+
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("SYNC - MlmeJoinReqAction(BSS #%ld)\n", pInfo->BssIdx));
+
+#ifdef RTMP_MAC_PCI
+	if ((OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE)) &&
+	    (IDLE_ON(pAd)) &&
+	    (pAd->StaCfg.bRadio == TRUE) &&
+	    (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_IDLE_RADIO_OFF))) {
 		RT28xxPciAsicRadioOn(pAd, GUI_IDLE_POWER_SAVE);
 	}
-#endif
+#endif /* RTMP_MAC_PCI // */
 
-	// reset all the timers
+	/* reset all the timers */
 	RTMPCancelTimer(&pAd->MlmeAux.ScanTimer, &TimerCancelled);
 	RTMPCancelTimer(&pAd->MlmeAux.BeaconTimer, &TimerCancelled);
 
 	pBss = &pAd->MlmeAux.SsidBssTab.BssEntry[pInfo->BssIdx];
 
-	// record the desired SSID & BSSID we're waiting for
+	/* record the desired SSID & BSSID we're waiting for */
 	COPY_MAC_ADDR(pAd->MlmeAux.Bssid, pBss->Bssid);
 
-	// If AP's SSID is not hidden, it is OK for updating ssid to MlmeAux again.
-	if (pBss->Hidden == 0)
-	{
+	/* If AP's SSID is not hidden, it is OK for updating ssid to MlmeAux again. */
+	if (pBss->Hidden == 0) {
+		RTMPZeroMemory(pAd->MlmeAux.Ssid, MAX_LEN_OF_SSID);
 		NdisMoveMemory(pAd->MlmeAux.Ssid, pBss->Ssid, pBss->SsidLen);
 		pAd->MlmeAux.SsidLen = pBss->SsidLen;
 	}
@@ -382,88 +346,87 @@ VOID MlmeJoinReqAction(
 	pAd->MlmeAux.Channel = pBss->Channel;
 	pAd->MlmeAux.CentralChannel = pBss->CentralChannel;
 
-	// Let BBP register at 20MHz to do scan
+	/* Let BBP register at 20MHz to do scan */
 	RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R4, &BBPValue);
 	BBPValue &= (~0x18);
 	RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R4, BBPValue);
+
 	DBGPRINT(RT_DEBUG_TRACE, ("SYNC - BBP R4 to 20MHz.l\n"));
 
-	// switch channel and waiting for beacon timer
+	/* switch channel and waiting for beacon timer */
 	AsicSwitchChannel(pAd, pAd->MlmeAux.Channel, FALSE);
 	AsicLockChannel(pAd, pAd->MlmeAux.Channel);
 	RTMPSetTimer(&pAd->MlmeAux.BeaconTimer, JOIN_TIMEOUT);
 
-    do
-	{
+	do {
 		if (((pAd->CommonCfg.bIEEE80211H == 1) &&
-            (pAd->MlmeAux.Channel > 14) &&
-             RadarChannelCheck(pAd, pAd->MlmeAux.Channel))
-            )
-		{
-			//
-			// We can't send any Probe request frame to meet 802.11h.
-			//
+		     (pAd->MlmeAux.Channel > 14) &&
+		     RadarChannelCheck(pAd, pAd->MlmeAux.Channel))
+		    ) {
+			/* */
+			/* We can't send any Probe request frame to meet 802.11h. */
+			/* */
 			if (pBss->Hidden == 0)
 				break;
 		}
-
-		//
-		// send probe request
-		//
+		/* */
+		/* send probe request */
+		/* */
 		NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);
-		if (NStatus == NDIS_STATUS_SUCCESS)
-		{
-			if (pAd->MlmeAux.Channel <= 14)
-			{
+		if (NStatus == NDIS_STATUS_SUCCESS) {
+			if (pAd->MlmeAux.Channel <= 14) {
 				pSupRate = pAd->CommonCfg.SupRate;
 				SupRateLen = pAd->CommonCfg.SupRateLen;
 				pExtRate = pAd->CommonCfg.ExtRate;
 				ExtRateLen = pAd->CommonCfg.ExtRateLen;
-			}
-			else
-			{
-				//
-				// Overwrite Support Rate, CCK rate are not allowed
-				//
+			} else {
+				/* */
+				/* Overwrite Support Rate, CCK rate are not allowed */
+				/* */
 				pSupRate = ASupRate;
 				SupRateLen = ASupRateLen;
 				ExtRateLen = 0;
 			}
 
 			if (pAd->MlmeAux.BssType == BSS_INFRA)
-				MgtMacHeaderInit(pAd, &Hdr80211, SUBTYPE_PROBE_REQ, 0, pAd->MlmeAux.Bssid, pAd->MlmeAux.Bssid);
+				MgtMacHeaderInit(pAd, &Hdr80211,
+						 SUBTYPE_PROBE_REQ, 0,
+						 pAd->MlmeAux.Bssid,
+						 pAd->MlmeAux.Bssid);
 			else
-				MgtMacHeaderInit(pAd, &Hdr80211, SUBTYPE_PROBE_REQ, 0, BROADCAST_ADDR, BROADCAST_ADDR);
-
-			MakeOutgoingFrame(pOutBuffer,               &FrameLen,
-							  sizeof(HEADER_802_11),    &Hdr80211,
-							  1,                        &SsidIe,
-							  1,                        &pAd->MlmeAux.SsidLen,
-							  pAd->MlmeAux.SsidLen,	    pAd->MlmeAux.Ssid,
-							  1,                        &SupRateIe,
-							  1,                        &SupRateLen,
-							  SupRateLen,               pSupRate,
-							  END_OF_ARGS);
-
-			if (ExtRateLen)
-			{
-				ULONG Tmp;
-				MakeOutgoingFrame(pOutBuffer + FrameLen,            &Tmp,
-								  1,                                &ExtRateIe,
-								  1,                                &ExtRateLen,
-								  ExtRateLen,                       pExtRate,
-								  END_OF_ARGS);
+				MgtMacHeaderInit(pAd, &Hdr80211,
+						 SUBTYPE_PROBE_REQ, 0,
+						 BROADCAST_ADDR,
+						 BROADCAST_ADDR);
+
+			MakeOutgoingFrame(pOutBuffer, &FrameLen,
+					  sizeof(struct rt_header_802_11), &Hdr80211,
+					  1, &SsidIe,
+					  1, &pAd->MlmeAux.SsidLen,
+					  pAd->MlmeAux.SsidLen,
+					  pAd->MlmeAux.Ssid, 1, &SupRateIe, 1,
+					  &SupRateLen, SupRateLen, pSupRate,
+					  END_OF_ARGS);
+
+			if (ExtRateLen) {
+				unsigned long Tmp;
+				MakeOutgoingFrame(pOutBuffer + FrameLen, &Tmp,
+						  1, &ExtRateIe,
+						  1, &ExtRateLen,
+						  ExtRateLen, pExtRate,
+						  END_OF_ARGS);
 				FrameLen += Tmp;
 			}
 
-
 			MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
 			MlmeFreeMemory(pAd, pOutBuffer);
 		}
-    } while (FALSE);
+	} while (FALSE);
 
-	DBGPRINT(RT_DEBUG_TRACE, ("SYNC - Switch to ch %d, Wait BEACON from %02x:%02x:%02x:%02x:%02x:%02x\n",
-		pBss->Channel, pBss->Bssid[0], pBss->Bssid[1], pBss->Bssid[2], pBss->Bssid[3], pBss->Bssid[4], pBss->Bssid[5]));
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("SYNC - Switch to ch %d, Wait BEACON from %02x:%02x:%02x:%02x:%02x:%02x\n",
+		  pBss->Channel, pBss->Bssid[0], pBss->Bssid[1], pBss->Bssid[2],
+		  pBss->Bssid[3], pBss->Bssid[4], pBss->Bssid[5]));
 
 	pAd->Mlme.SyncMachine.CurrState = JOIN_WAIT_BEACON;
 }
@@ -474,95 +437,110 @@ VOID MlmeJoinReqAction(
 		MLME START Request state machine procedure, starting an IBSS
 	==========================================================================
  */
-VOID MlmeStartReqAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
+void MlmeStartReqAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-	UCHAR         Ssid[MAX_LEN_OF_SSID], SsidLen;
-	BOOLEAN       TimerCancelled;
+	u8 Ssid[MAX_LEN_OF_SSID], SsidLen;
+	BOOLEAN TimerCancelled;
 
-	// New for WPA security suites
-	UCHAR						VarIE[MAX_VIE_LEN]; 	// Total VIE length = MAX_VIE_LEN - -5
-	NDIS_802_11_VARIABLE_IEs	*pVIE = NULL;
-	LARGE_INTEGER				TimeStamp;
+	/* New for WPA security suites */
+	u8 VarIE[MAX_VIE_LEN];	/* Total VIE length = MAX_VIE_LEN - -5 */
+	struct rt_ndis_802_11_variable_ies *pVIE = NULL;
+	LARGE_INTEGER TimeStamp;
 	BOOLEAN Privacy;
-	USHORT Status;
+	u16 Status;
 
-	// Init Variable IE structure
-	pVIE = (PNDIS_802_11_VARIABLE_IEs) VarIE;
+	/* Init Variable IE structure */
+	pVIE = (struct rt_ndis_802_11_variable_ies *)VarIE;
 	pVIE->Length = 0;
-	TimeStamp.u.LowPart  = 0;
+	TimeStamp.u.LowPart = 0;
 	TimeStamp.u.HighPart = 0;
 
-	if (MlmeStartReqSanity(pAd, Elem->Msg, Elem->MsgLen, Ssid, &SsidLen))
-	{
-		// reset all the timers
+	if (MlmeStartReqSanity
+	    (pAd, Elem->Msg, Elem->MsgLen, (char *)Ssid, &SsidLen)) {
+		/* reset all the timers */
 		RTMPCancelTimer(&pAd->MlmeAux.ScanTimer, &TimerCancelled);
 		RTMPCancelTimer(&pAd->MlmeAux.BeaconTimer, &TimerCancelled);
 
-		//
-		// Start a new IBSS. All IBSS parameters are decided now....
-		//
-		DBGPRINT(RT_DEBUG_TRACE, ("MlmeStartReqAction - Start a new IBSS. All IBSS parameters are decided now.... \n"));
-		pAd->MlmeAux.BssType           = BSS_ADHOC;
+		/* */
+		/* Start a new IBSS. All IBSS parameters are decided now.... */
+		/* */
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("MlmeStartReqAction - Start a new IBSS. All IBSS parameters are decided now.... \n"));
+		pAd->MlmeAux.BssType = BSS_ADHOC;
 		NdisMoveMemory(pAd->MlmeAux.Ssid, Ssid, SsidLen);
-		pAd->MlmeAux.SsidLen           = SsidLen;
+		pAd->MlmeAux.SsidLen = SsidLen;
 
-		// generate a radom number as BSSID
+		/* generate a radom number as BSSID */
 		MacAddrRandomBssid(pAd, pAd->MlmeAux.Bssid);
-		DBGPRINT(RT_DEBUG_TRACE, ("MlmeStartReqAction - generate a radom number as BSSID \n"));
-
-		Privacy = (pAd->StaCfg.WepStatus == Ndis802_11Encryption1Enabled) ||
-				  (pAd->StaCfg.WepStatus == Ndis802_11Encryption2Enabled) ||
-				  (pAd->StaCfg.WepStatus == Ndis802_11Encryption3Enabled);
-		pAd->MlmeAux.CapabilityInfo    = CAP_GENERATE(0,1,Privacy, (pAd->CommonCfg.TxPreamble == Rt802_11PreambleShort), 1, 0);
-		pAd->MlmeAux.BeaconPeriod      = pAd->CommonCfg.BeaconPeriod;
-		pAd->MlmeAux.AtimWin           = pAd->StaCfg.AtimWin;
-		pAd->MlmeAux.Channel           = pAd->CommonCfg.Channel;
-
-		pAd->CommonCfg.CentralChannel  = pAd->CommonCfg.Channel;
-		pAd->MlmeAux.CentralChannel    = pAd->CommonCfg.CentralChannel;
-
-		pAd->MlmeAux.SupRateLen= pAd->CommonCfg.SupRateLen;
-		NdisMoveMemory(pAd->MlmeAux.SupRate, pAd->CommonCfg.SupRate, MAX_LEN_OF_SUPPORTED_RATES);
-		RTMPCheckRates(pAd, pAd->MlmeAux.SupRate, &pAd->MlmeAux.SupRateLen);
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("MlmeStartReqAction - generate a radom number as BSSID \n"));
+
+		Privacy =
+		    (pAd->StaCfg.WepStatus == Ndis802_11Encryption1Enabled)
+		    || (pAd->StaCfg.WepStatus == Ndis802_11Encryption2Enabled)
+		    || (pAd->StaCfg.WepStatus == Ndis802_11Encryption3Enabled);
+		pAd->MlmeAux.CapabilityInfo =
+		    CAP_GENERATE(0, 1, Privacy,
+				 (pAd->CommonCfg.TxPreamble ==
+				  Rt802_11PreambleShort), 1, 0);
+		pAd->MlmeAux.BeaconPeriod = pAd->CommonCfg.BeaconPeriod;
+		pAd->MlmeAux.AtimWin = pAd->StaCfg.AtimWin;
+		pAd->MlmeAux.Channel = pAd->CommonCfg.Channel;
+
+		pAd->CommonCfg.CentralChannel = pAd->CommonCfg.Channel;
+		pAd->MlmeAux.CentralChannel = pAd->CommonCfg.CentralChannel;
+
+		pAd->MlmeAux.SupRateLen = pAd->CommonCfg.SupRateLen;
+		NdisMoveMemory(pAd->MlmeAux.SupRate, pAd->CommonCfg.SupRate,
+			       MAX_LEN_OF_SUPPORTED_RATES);
+		RTMPCheckRates(pAd, pAd->MlmeAux.SupRate,
+			       &pAd->MlmeAux.SupRateLen);
 		pAd->MlmeAux.ExtRateLen = pAd->CommonCfg.ExtRateLen;
-		NdisMoveMemory(pAd->MlmeAux.ExtRate, pAd->CommonCfg.ExtRate, MAX_LEN_OF_SUPPORTED_RATES);
-		RTMPCheckRates(pAd, pAd->MlmeAux.ExtRate, &pAd->MlmeAux.ExtRateLen);
-
-		if (pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED)
-		{
-			RTMPUpdateHTIE(&pAd->CommonCfg.DesiredHtPhy, &pAd->StaCfg.DesiredHtPhyInfo.MCSSet[0], &pAd->MlmeAux.HtCapability, &pAd->MlmeAux.AddHtInfo);
-			pAd->MlmeAux.HtCapabilityLen = sizeof(HT_CAPABILITY_IE);
-			// Not turn pAd->StaActive.SupportedHtPhy.bHtEnable = TRUE here.
-			DBGPRINT(RT_DEBUG_TRACE, ("SYNC -pAd->StaActive.SupportedHtPhy.bHtEnable = TRUE\n"));
-		}
-		else
-		{
+		NdisMoveMemory(pAd->MlmeAux.ExtRate, pAd->CommonCfg.ExtRate,
+			       MAX_LEN_OF_SUPPORTED_RATES);
+		RTMPCheckRates(pAd, pAd->MlmeAux.ExtRate,
+			       &pAd->MlmeAux.ExtRateLen);
+
+		if (pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED) {
+			RTMPUpdateHTIE(&pAd->CommonCfg.DesiredHtPhy,
+				       &pAd->StaCfg.DesiredHtPhyInfo.MCSSet[0],
+				       &pAd->MlmeAux.HtCapability,
+				       &pAd->MlmeAux.AddHtInfo);
+			pAd->MlmeAux.HtCapabilityLen = sizeof(struct rt_ht_capability_ie);
+			/* Not turn pAd->StaActive.SupportedHtPhy.bHtEnable = TRUE here. */
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("SYNC -pAd->StaActive.SupportedHtPhy.bHtEnable = TRUE\n"));
+		} else {
 			pAd->MlmeAux.HtCapabilityLen = 0;
 			pAd->StaActive.SupportedPhyInfo.bHtEnable = FALSE;
+			NdisZeroMemory(&pAd->StaActive.SupportedPhyInfo.
+				       MCSSet[0], 16);
 		}
-		// temporarily not support QOS in IBSS
-		NdisZeroMemory(&pAd->MlmeAux.APEdcaParm, sizeof(EDCA_PARM));
-		NdisZeroMemory(&pAd->MlmeAux.APQbssLoad, sizeof(QBSS_LOAD_PARM));
-		NdisZeroMemory(&pAd->MlmeAux.APQosCapability, sizeof(QOS_CAPABILITY_PARM));
+		/* temporarily not support QOS in IBSS */
+		NdisZeroMemory(&pAd->MlmeAux.APEdcaParm, sizeof(struct rt_edca_parm));
+		NdisZeroMemory(&pAd->MlmeAux.APQbssLoad,
+			       sizeof(struct rt_qbss_load_parm));
+		NdisZeroMemory(&pAd->MlmeAux.APQosCapability,
+			       sizeof(struct rt_qos_capability_parm));
 
 		AsicSwitchChannel(pAd, pAd->MlmeAux.Channel, FALSE);
 		AsicLockChannel(pAd, pAd->MlmeAux.Channel);
 
-		DBGPRINT(RT_DEBUG_TRACE, ("SYNC - MlmeStartReqAction(ch= %d,sup rates= %d, ext rates=%d)\n",
-			pAd->MlmeAux.Channel, pAd->MlmeAux.SupRateLen, pAd->MlmeAux.ExtRateLen));
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("SYNC - MlmeStartReqAction(ch= %d,sup rates= %d, ext rates=%d)\n",
+			  pAd->MlmeAux.Channel, pAd->MlmeAux.SupRateLen,
+			  pAd->MlmeAux.ExtRateLen));
 
 		pAd->Mlme.SyncMachine.CurrState = SYNC_IDLE;
 		Status = MLME_SUCCESS;
-		MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_START_CONF, 2, &Status);
-	}
-	else
-	{
+		MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_START_CONF, 2,
+			    &Status);
+	} else {
 		DBGPRINT_ERR(("SYNC - MlmeStartReqAction() sanity check fail.\n"));
 		pAd->Mlme.SyncMachine.CurrState = SYNC_IDLE;
 		Status = MLME_INVALID_FORMAT;
-		MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_START_CONF, 2, &Status);
+		MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_START_CONF, 2,
+			    &Status);
 	}
 }
 
@@ -572,126 +550,116 @@ VOID MlmeStartReqAction(
 		peer sends beacon back when scanning
 	==========================================================================
  */
-VOID PeerBeaconAtScanAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
+void PeerBeaconAtScanAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-	UCHAR           Bssid[MAC_ADDR_LEN], Addr2[MAC_ADDR_LEN];
-	UCHAR           Ssid[MAX_LEN_OF_SSID], BssType, Channel, NewChannel,
-					SsidLen, DtimCount, DtimPeriod, BcastFlag, MessageToMe;
-	CF_PARM         CfParm;
-	USHORT          BeaconPeriod, AtimWin, CapabilityInfo;
-	PFRAME_802_11   pFrame;
-	LARGE_INTEGER   TimeStamp;
-	UCHAR           Erp;
-	UCHAR         	SupRate[MAX_LEN_OF_SUPPORTED_RATES], ExtRate[MAX_LEN_OF_SUPPORTED_RATES];
-	UCHAR		  	SupRateLen, ExtRateLen;
-	USHORT 			LenVIE;
-	UCHAR			CkipFlag;
-	UCHAR			AironetCellPowerLimit;
-	EDCA_PARM       EdcaParm;
-	QBSS_LOAD_PARM  QbssLoad;
-	QOS_CAPABILITY_PARM QosCapability;
-	ULONG						RalinkIe;
-	UCHAR						VarIE[MAX_VIE_LEN];		// Total VIE length = MAX_VIE_LEN - -5
-	NDIS_802_11_VARIABLE_IEs	*pVIE = NULL;
-	HT_CAPABILITY_IE		HtCapability;
-	ADD_HT_INFO_IE		AddHtInfo;	// AP might use this additional ht info IE
-	UCHAR			HtCapabilityLen = 0, PreNHtCapabilityLen = 0;
-	UCHAR			AddHtInfoLen;
-	UCHAR			NewExtChannelOffset = 0xff;
-
-	pFrame = (PFRAME_802_11) Elem->Msg;
-	// Init Variable IE structure
-	pVIE = (PNDIS_802_11_VARIABLE_IEs) VarIE;
+	u8 Bssid[MAC_ADDR_LEN], Addr2[MAC_ADDR_LEN];
+	u8 Ssid[MAX_LEN_OF_SSID], BssType, Channel, NewChannel,
+	    SsidLen, DtimCount, DtimPeriod, BcastFlag, MessageToMe;
+	struct rt_cf_parm CfParm;
+	u16 BeaconPeriod, AtimWin, CapabilityInfo;
+	struct rt_frame_802_11 * pFrame;
+	LARGE_INTEGER TimeStamp;
+	u8 Erp;
+	u8 SupRate[MAX_LEN_OF_SUPPORTED_RATES],
+	    ExtRate[MAX_LEN_OF_SUPPORTED_RATES];
+	u8 SupRateLen, ExtRateLen;
+	u16 LenVIE;
+	u8 CkipFlag;
+	u8 AironetCellPowerLimit;
+	struct rt_edca_parm EdcaParm;
+	struct rt_qbss_load_parm QbssLoad;
+	struct rt_qos_capability_parm QosCapability;
+	unsigned long RalinkIe;
+	u8 VarIE[MAX_VIE_LEN];	/* Total VIE length = MAX_VIE_LEN - -5 */
+	struct rt_ndis_802_11_variable_ies *pVIE = NULL;
+	struct rt_ht_capability_ie HtCapability;
+	struct rt_add_ht_info_ie AddHtInfo;	/* AP might use this additional ht info IE */
+	u8 HtCapabilityLen = 0, PreNHtCapabilityLen = 0;
+	u8 AddHtInfoLen;
+	u8 NewExtChannelOffset = 0xff;
+
+	/* NdisFillMemory(Ssid, MAX_LEN_OF_SSID, 0x00); */
+	pFrame = (struct rt_frame_802_11 *) Elem->Msg;
+	/* Init Variable IE structure */
+	pVIE = (struct rt_ndis_802_11_variable_ies *)VarIE;
 	pVIE->Length = 0;
 
-    RTMPZeroMemory(&HtCapability, sizeof(HtCapability));
-	RTMPZeroMemory(&AddHtInfo, sizeof(ADD_HT_INFO_IE));
+	RTMPZeroMemory(&HtCapability, sizeof(HtCapability));
+	RTMPZeroMemory(&AddHtInfo, sizeof(struct rt_add_ht_info_ie));
 
 	if (PeerBeaconAndProbeRspSanity(pAd,
-								Elem->Msg,
-								Elem->MsgLen,
-								Elem->Channel,
-								Addr2,
-								Bssid,
-								Ssid,
-								&SsidLen,
-								&BssType,
-								&BeaconPeriod,
-								&Channel,
-								&NewChannel,
-								&TimeStamp,
-								&CfParm,
-								&AtimWin,
-								&CapabilityInfo,
-								&Erp,
-								&DtimCount,
-								&DtimPeriod,
-								&BcastFlag,
-								&MessageToMe,
-								SupRate,
-								&SupRateLen,
-								ExtRate,
-								&ExtRateLen,
-								&CkipFlag,
-								&AironetCellPowerLimit,
-								&EdcaParm,
-								&QbssLoad,
-								&QosCapability,
-								&RalinkIe,
-								&HtCapabilityLen,
-								&PreNHtCapabilityLen,
-								&HtCapability,
-								&AddHtInfoLen,
-								&AddHtInfo,
-								&NewExtChannelOffset,
-								&LenVIE,
-								pVIE))
-	{
-		ULONG Idx;
-		CHAR Rssi = 0;
+					Elem->Msg,
+					Elem->MsgLen,
+					Elem->Channel,
+					Addr2,
+					Bssid,
+					(char *)Ssid,
+					&SsidLen,
+					&BssType,
+					&BeaconPeriod,
+					&Channel,
+					&NewChannel,
+					&TimeStamp,
+					&CfParm,
+					&AtimWin,
+					&CapabilityInfo,
+					&Erp,
+					&DtimCount,
+					&DtimPeriod,
+					&BcastFlag,
+					&MessageToMe,
+					SupRate,
+					&SupRateLen,
+					ExtRate,
+					&ExtRateLen,
+					&CkipFlag,
+					&AironetCellPowerLimit,
+					&EdcaParm,
+					&QbssLoad,
+					&QosCapability,
+					&RalinkIe,
+					&HtCapabilityLen,
+					&PreNHtCapabilityLen,
+					&HtCapability,
+					&AddHtInfoLen,
+					&AddHtInfo,
+					&NewExtChannelOffset, &LenVIE, pVIE)) {
+		unsigned long Idx;
+		char Rssi = 0;
 
 		Idx = BssTableSearch(&pAd->ScanTab, Bssid, Channel);
 		if (Idx != BSS_NOT_FOUND)
 			Rssi = pAd->ScanTab.BssEntry[Idx].Rssi;
 
-		Rssi = RTMPMaxRssi(pAd, ConvertToRssi(pAd, Elem->Rssi0, RSSI_0), ConvertToRssi(pAd, Elem->Rssi1, RSSI_1), ConvertToRssi(pAd, Elem->Rssi2, RSSI_2));
+		Rssi =
+		    RTMPMaxRssi(pAd, ConvertToRssi(pAd, Elem->Rssi0, RSSI_0),
+				ConvertToRssi(pAd, Elem->Rssi1, RSSI_1),
+				ConvertToRssi(pAd, Elem->Rssi2, RSSI_2));
 
 		if ((HtCapabilityLen > 0) || (PreNHtCapabilityLen > 0))
 			HtCapabilityLen = SIZE_HT_CAP_IE;
 
-		if ((pAd->StaCfg.CCXReqType != MSRN_TYPE_UNUSED) && (Channel == pAd->StaCfg.CCXScanChannel))
-		{
-			Idx = BssTableSetEntry(pAd, &pAd->StaCfg.CCXBssTab, Bssid, Ssid, SsidLen, BssType, BeaconPeriod,
-						 &CfParm, AtimWin, CapabilityInfo, SupRate, SupRateLen,ExtRate, ExtRateLen, &HtCapability,
-						 &AddHtInfo, HtCapabilityLen, AddHtInfoLen, NewExtChannelOffset, Channel, Rssi, TimeStamp, CkipFlag,
-						 &EdcaParm, &QosCapability, &QbssLoad, LenVIE, pVIE);
-			if (Idx != BSS_NOT_FOUND)
-			{
-				NdisMoveMemory(pAd->StaCfg.CCXBssTab.BssEntry[Idx].PTSF, &Elem->Msg[24], 4);
-				NdisMoveMemory(&pAd->StaCfg.CCXBssTab.BssEntry[Idx].TTSF[0], &Elem->TimeStamp.u.LowPart, 4);
-				NdisMoveMemory(&pAd->StaCfg.CCXBssTab.BssEntry[Idx].TTSF[4], &Elem->TimeStamp.u.LowPart, 4);
-				if (pAd->StaCfg.CCXReqType == MSRN_TYPE_BEACON_REQ)
-					AironetAddBeaconReport(pAd, Idx, Elem);
-			}
-		}
-		else
-		{
-			Idx = BssTableSetEntry(pAd, &pAd->ScanTab, Bssid, Ssid, SsidLen, BssType, BeaconPeriod,
-						  &CfParm, AtimWin, CapabilityInfo, SupRate, SupRateLen, ExtRate, ExtRateLen,  &HtCapability,
-						 &AddHtInfo, HtCapabilityLen, AddHtInfoLen, NewExtChannelOffset, Channel, Rssi, TimeStamp, CkipFlag,
-						 &EdcaParm, &QosCapability, &QbssLoad, LenVIE, pVIE);
-
-			if (Idx != BSS_NOT_FOUND)
-			{
-				NdisMoveMemory(pAd->ScanTab.BssEntry[Idx].PTSF, &Elem->Msg[24], 4);
-				NdisMoveMemory(&pAd->ScanTab.BssEntry[Idx].TTSF[0], &Elem->TimeStamp.u.LowPart, 4);
-				NdisMoveMemory(&pAd->ScanTab.BssEntry[Idx].TTSF[4], &Elem->TimeStamp.u.LowPart, 4);
-			}
+		Idx =
+		    BssTableSetEntry(pAd, &pAd->ScanTab, Bssid, (char *)Ssid,
+				     SsidLen, BssType, BeaconPeriod, &CfParm,
+				     AtimWin, CapabilityInfo, SupRate,
+				     SupRateLen, ExtRate, ExtRateLen,
+				     &HtCapability, &AddHtInfo, HtCapabilityLen,
+				     AddHtInfoLen, NewExtChannelOffset, Channel,
+				     Rssi, TimeStamp, CkipFlag, &EdcaParm,
+				     &QosCapability, &QbssLoad, LenVIE, pVIE);
+
+		if (Idx != BSS_NOT_FOUND) {
+			NdisMoveMemory(pAd->ScanTab.BssEntry[Idx].PTSF,
+				       &Elem->Msg[24], 4);
+			NdisMoveMemory(&pAd->ScanTab.BssEntry[Idx].TTSF[0],
+				       &Elem->TimeStamp.u.LowPart, 4);
+			NdisMoveMemory(&pAd->ScanTab.BssEntry[Idx].TTSF[4],
+				       &Elem->TimeStamp.u.LowPart, 4);
 		}
+
 	}
-	// sanity check fail, ignored
+	/* sanity check fail, ignored */
 }
 
 /*
@@ -700,134 +668,207 @@ VOID PeerBeaconAtScanAction(
 		When waiting joining the (I)BSS, beacon received from external
 	==========================================================================
  */
-VOID PeerBeaconAtJoinAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
+void PeerBeaconAtJoinAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-	UCHAR         Bssid[MAC_ADDR_LEN], Addr2[MAC_ADDR_LEN];
-	UCHAR         Ssid[MAX_LEN_OF_SSID], SsidLen, BssType, Channel, MessageToMe,
-				  DtimCount, DtimPeriod, BcastFlag, NewChannel;
+	u8 Bssid[MAC_ADDR_LEN], Addr2[MAC_ADDR_LEN];
+	u8 Ssid[MAX_LEN_OF_SSID], SsidLen, BssType, Channel, MessageToMe,
+	    DtimCount, DtimPeriod, BcastFlag, NewChannel;
 	LARGE_INTEGER TimeStamp;
-	USHORT        BeaconPeriod, AtimWin, CapabilityInfo;
-	CF_PARM       Cf;
-	BOOLEAN       TimerCancelled;
-	UCHAR         Erp;
-	UCHAR         SupRate[MAX_LEN_OF_SUPPORTED_RATES], ExtRate[MAX_LEN_OF_SUPPORTED_RATES];
-	UCHAR		  SupRateLen, ExtRateLen;
-	UCHAR         CkipFlag;
-	USHORT 		  LenVIE;
-	UCHAR		  AironetCellPowerLimit;
-	EDCA_PARM       EdcaParm;
-	QBSS_LOAD_PARM  QbssLoad;
-	QOS_CAPABILITY_PARM QosCapability;
-	USHORT        Status;
-	UCHAR						VarIE[MAX_VIE_LEN];		// Total VIE length = MAX_VIE_LEN - -5
-	NDIS_802_11_VARIABLE_IEs	*pVIE = NULL;
-	ULONG           RalinkIe;
-	ULONG         Idx;
-	HT_CAPABILITY_IE		HtCapability;
-	ADD_HT_INFO_IE		AddHtInfo;	// AP might use this additional ht info IE
-	UCHAR				HtCapabilityLen = 0, PreNHtCapabilityLen = 0;
-	UCHAR			AddHtInfoLen;
-	UCHAR			NewExtChannelOffset = 0xff;
-	UCHAR			CentralChannel;
-
-	// Init Variable IE structure
-	pVIE = (PNDIS_802_11_VARIABLE_IEs) VarIE;
+	u16 BeaconPeriod, AtimWin, CapabilityInfo;
+	struct rt_cf_parm Cf;
+	BOOLEAN TimerCancelled;
+	u8 Erp;
+	u8 SupRate[MAX_LEN_OF_SUPPORTED_RATES],
+	    ExtRate[MAX_LEN_OF_SUPPORTED_RATES];
+	u8 SupRateLen, ExtRateLen;
+	u8 CkipFlag;
+	u16 LenVIE;
+	u8 AironetCellPowerLimit;
+	struct rt_edca_parm EdcaParm;
+	struct rt_qbss_load_parm QbssLoad;
+	struct rt_qos_capability_parm QosCapability;
+	u16 Status;
+	u8 VarIE[MAX_VIE_LEN];	/* Total VIE length = MAX_VIE_LEN - -5 */
+	struct rt_ndis_802_11_variable_ies *pVIE = NULL;
+	unsigned long RalinkIe;
+	unsigned long Idx;
+	struct rt_ht_capability_ie HtCapability;
+	struct rt_add_ht_info_ie AddHtInfo;	/* AP might use this additional ht info IE */
+	u8 HtCapabilityLen = 0, PreNHtCapabilityLen = 0;
+	u8 AddHtInfoLen;
+	u8 NewExtChannelOffset = 0xff;
+	u8 CentralChannel;
+	BOOLEAN bAllowNrate = FALSE;
+
+	/* Init Variable IE structure */
+	pVIE = (struct rt_ndis_802_11_variable_ies *)VarIE;
 	pVIE->Length = 0;
-    RTMPZeroMemory(&HtCapability, sizeof(HtCapability));
-	RTMPZeroMemory(&AddHtInfo, sizeof(ADD_HT_INFO_IE));
-
+	RTMPZeroMemory(&HtCapability, sizeof(HtCapability));
+	RTMPZeroMemory(&AddHtInfo, sizeof(struct rt_add_ht_info_ie));
 
 	if (PeerBeaconAndProbeRspSanity(pAd,
-								Elem->Msg,
-								Elem->MsgLen,
-								Elem->Channel,
-								Addr2,
-								Bssid,
-								Ssid,
-								&SsidLen,
-								&BssType,
-								&BeaconPeriod,
-								&Channel,
-								&NewChannel,
-								&TimeStamp,
-								&Cf,
-								&AtimWin,
-								&CapabilityInfo,
-								&Erp,
-								&DtimCount,
-								&DtimPeriod,
-								&BcastFlag,
-								&MessageToMe,
-								SupRate,
-								&SupRateLen,
-								ExtRate,
-								&ExtRateLen,
-								&CkipFlag,
-								&AironetCellPowerLimit,
-								&EdcaParm,
-								&QbssLoad,
-								&QosCapability,
-								&RalinkIe,
-								&HtCapabilityLen,
-								&PreNHtCapabilityLen,
-								&HtCapability,
-								&AddHtInfoLen,
-								&AddHtInfo,
-								&NewExtChannelOffset,
-								&LenVIE,
-								pVIE))
-	{
-		// Disqualify 11b only adhoc when we are in 11g only adhoc mode
-		if ((BssType == BSS_ADHOC) && (pAd->CommonCfg.PhyMode == PHY_11G) && ((SupRateLen+ExtRateLen)< 12))
+					Elem->Msg,
+					Elem->MsgLen,
+					Elem->Channel,
+					Addr2,
+					Bssid,
+					(char *)Ssid,
+					&SsidLen,
+					&BssType,
+					&BeaconPeriod,
+					&Channel,
+					&NewChannel,
+					&TimeStamp,
+					&Cf,
+					&AtimWin,
+					&CapabilityInfo,
+					&Erp,
+					&DtimCount,
+					&DtimPeriod,
+					&BcastFlag,
+					&MessageToMe,
+					SupRate,
+					&SupRateLen,
+					ExtRate,
+					&ExtRateLen,
+					&CkipFlag,
+					&AironetCellPowerLimit,
+					&EdcaParm,
+					&QbssLoad,
+					&QosCapability,
+					&RalinkIe,
+					&HtCapabilityLen,
+					&PreNHtCapabilityLen,
+					&HtCapability,
+					&AddHtInfoLen,
+					&AddHtInfo,
+					&NewExtChannelOffset, &LenVIE, pVIE)) {
+		/* Disqualify 11b only adhoc when we are in 11g only adhoc mode */
+		if ((BssType == BSS_ADHOC)
+		    && (pAd->CommonCfg.PhyMode == PHY_11G)
+		    && ((SupRateLen + ExtRateLen) < 12))
 			return;
 
-		// BEACON from desired BSS/IBSS found. We should be able to decide most
-		// BSS parameters here.
-		// Q. But what happen if this JOIN doesn't conclude a successful ASSOCIATEION?
-		//    Do we need to receover back all parameters belonging to previous BSS?
-		// A. Should be not. There's no back-door recover to previous AP. It still need
-		//    a new JOIN-AUTH-ASSOC sequence.
-		if (MAC_ADDR_EQUAL(pAd->MlmeAux.Bssid, Bssid))
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("SYNC - receive desired BEACON at JoinWaitBeacon... Channel = %d\n", Channel));
-			RTMPCancelTimer(&pAd->MlmeAux.BeaconTimer, &TimerCancelled);
-
-			// Update RSSI to prevent No signal display when cards first initialized
-			pAd->StaCfg.RssiSample.LastRssi0	= ConvertToRssi(pAd, Elem->Rssi0, RSSI_0);
-			pAd->StaCfg.RssiSample.LastRssi1	= ConvertToRssi(pAd, Elem->Rssi1, RSSI_1);
-			pAd->StaCfg.RssiSample.LastRssi2	= ConvertToRssi(pAd, Elem->Rssi2, RSSI_2);
-			pAd->StaCfg.RssiSample.AvgRssi0	= pAd->StaCfg.RssiSample.LastRssi0;
-			pAd->StaCfg.RssiSample.AvgRssi0X8	= pAd->StaCfg.RssiSample.AvgRssi0 << 3;
-			pAd->StaCfg.RssiSample.AvgRssi1	= pAd->StaCfg.RssiSample.LastRssi1;
-			pAd->StaCfg.RssiSample.AvgRssi1X8	= pAd->StaCfg.RssiSample.AvgRssi1 << 3;
-			pAd->StaCfg.RssiSample.AvgRssi2	= pAd->StaCfg.RssiSample.LastRssi2;
-			pAd->StaCfg.RssiSample.AvgRssi2X8	= pAd->StaCfg.RssiSample.AvgRssi2 << 3;
-
-			//
-			// We need to check if SSID only set to any, then we can record the current SSID.
-			// Otherwise will cause hidden SSID association failed.
-			//
-			if (pAd->MlmeAux.SsidLen == 0)
-			{
-				NdisMoveMemory(pAd->MlmeAux.Ssid, Ssid, SsidLen);
+		/* BEACON from desired BSS/IBSS found. We should be able to decide most */
+		/* BSS parameters here. */
+		/* Q. But what happen if this JOIN doesn't conclude a successful ASSOCIATEION? */
+		/*    Do we need to receover back all parameters belonging to previous BSS? */
+		/* A. Should be not. There's no back-door recover to previous AP. It still need */
+		/*    a new JOIN-AUTH-ASSOC sequence. */
+		if (MAC_ADDR_EQUAL(pAd->MlmeAux.Bssid, Bssid)) {
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("SYNC - receive desired BEACON at JoinWaitBeacon... Channel = %d\n",
+				  Channel));
+			RTMPCancelTimer(&pAd->MlmeAux.BeaconTimer,
+					&TimerCancelled);
+
+			/* Update RSSI to prevent No signal display when cards first initialized */
+			pAd->StaCfg.RssiSample.LastRssi0 =
+			    ConvertToRssi(pAd, Elem->Rssi0, RSSI_0);
+			pAd->StaCfg.RssiSample.LastRssi1 =
+			    ConvertToRssi(pAd, Elem->Rssi1, RSSI_1);
+			pAd->StaCfg.RssiSample.LastRssi2 =
+			    ConvertToRssi(pAd, Elem->Rssi2, RSSI_2);
+			pAd->StaCfg.RssiSample.AvgRssi0 =
+			    pAd->StaCfg.RssiSample.LastRssi0;
+			pAd->StaCfg.RssiSample.AvgRssi0X8 =
+			    pAd->StaCfg.RssiSample.AvgRssi0 << 3;
+			pAd->StaCfg.RssiSample.AvgRssi1 =
+			    pAd->StaCfg.RssiSample.LastRssi1;
+			pAd->StaCfg.RssiSample.AvgRssi1X8 =
+			    pAd->StaCfg.RssiSample.AvgRssi1 << 3;
+			pAd->StaCfg.RssiSample.AvgRssi2 =
+			    pAd->StaCfg.RssiSample.LastRssi2;
+			pAd->StaCfg.RssiSample.AvgRssi2X8 =
+			    pAd->StaCfg.RssiSample.AvgRssi2 << 3;
+
+			/* */
+			/* We need to check if SSID only set to any, then we can record the current SSID. */
+			/* Otherwise will cause hidden SSID association failed. */
+			/* */
+			if (pAd->MlmeAux.SsidLen == 0) {
+				NdisMoveMemory(pAd->MlmeAux.Ssid, Ssid,
+					       SsidLen);
 				pAd->MlmeAux.SsidLen = SsidLen;
-			}
-			else
-			{
-				Idx = BssSsidTableSearch(&pAd->ScanTab, Bssid, pAd->MlmeAux.Ssid, pAd->MlmeAux.SsidLen, Channel);
-
-				if (Idx != BSS_NOT_FOUND)
-				{
-					//
-					// Multiple SSID case, used correct CapabilityInfo
-					//
-					CapabilityInfo = pAd->ScanTab.BssEntry[Idx].CapabilityInfo;
+			} else {
+				Idx =
+				    BssSsidTableSearch(&pAd->ScanTab, Bssid,
+						       pAd->MlmeAux.Ssid,
+						       pAd->MlmeAux.SsidLen,
+						       Channel);
+
+				if (Idx == BSS_NOT_FOUND) {
+					char Rssi = 0;
+					Rssi =
+					    RTMPMaxRssi(pAd,
+							ConvertToRssi(pAd,
+								      Elem->
+								      Rssi0,
+								      RSSI_0),
+							ConvertToRssi(pAd,
+								      Elem->
+								      Rssi1,
+								      RSSI_1),
+							ConvertToRssi(pAd,
+								      Elem->
+								      Rssi2,
+								      RSSI_2));
+					Idx =
+					    BssTableSetEntry(pAd, &pAd->ScanTab,
+							     Bssid,
+							     (char *) Ssid,
+							     SsidLen, BssType,
+							     BeaconPeriod, &Cf,
+							     AtimWin,
+							     CapabilityInfo,
+							     SupRate,
+							     SupRateLen,
+							     ExtRate,
+							     ExtRateLen,
+							     &HtCapability,
+							     &AddHtInfo,
+							     HtCapabilityLen,
+							     AddHtInfoLen,
+							     NewExtChannelOffset,
+							     Channel, Rssi,
+							     TimeStamp,
+							     CkipFlag,
+							     &EdcaParm,
+							     &QosCapability,
+							     &QbssLoad, LenVIE,
+							     pVIE);
+					if (Idx != BSS_NOT_FOUND) {
+						NdisMoveMemory(pAd->ScanTab.
+							       BssEntry[Idx].
+							       PTSF,
+							       &Elem->Msg[24],
+							       4);
+						NdisMoveMemory(&pAd->ScanTab.
+							       BssEntry[Idx].
+							       TTSF[0],
+							       &Elem->TimeStamp.
+							       u.LowPart, 4);
+						NdisMoveMemory(&pAd->ScanTab.
+							       BssEntry[Idx].
+							       TTSF[4],
+							       &Elem->TimeStamp.
+							       u.LowPart, 4);
+						CapabilityInfo =
+						    pAd->ScanTab.BssEntry[Idx].
+						    CapabilityInfo;
+					}
+				} else {
+					/* */
+					/* Multiple SSID case, used correct CapabilityInfo */
+					/* */
+					CapabilityInfo =
+					    pAd->ScanTab.BssEntry[Idx].
+					    CapabilityInfo;
 				}
 			}
 			NdisMoveMemory(pAd->MlmeAux.Bssid, Bssid, MAC_ADDR_LEN);
-			pAd->MlmeAux.CapabilityInfo = CapabilityInfo & SUPPORTED_CAPABILITY_INFO;
+			pAd->MlmeAux.CapabilityInfo =
+			    CapabilityInfo & SUPPORTED_CAPABILITY_INFO;
 			pAd->MlmeAux.BssType = BssType;
 			pAd->MlmeAux.BeaconPeriod = BeaconPeriod;
 			pAd->MlmeAux.Channel = Channel;
@@ -836,107 +877,159 @@ VOID PeerBeaconAtJoinAction(
 			pAd->MlmeAux.CfpMaxDuration = Cf.CfpMaxDuration;
 			pAd->MlmeAux.APRalinkIe = RalinkIe;
 
-			// Copy AP's supported rate to MlmeAux for creating assoication request
-			// Also filter out not supported rate
+			/* Copy AP's supported rate to MlmeAux for creating assoication request */
+			/* Also filter out not supported rate */
 			pAd->MlmeAux.SupRateLen = SupRateLen;
-			NdisMoveMemory(pAd->MlmeAux.SupRate, SupRate, SupRateLen);
-			RTMPCheckRates(pAd, pAd->MlmeAux.SupRate, &pAd->MlmeAux.SupRateLen);
+			NdisMoveMemory(pAd->MlmeAux.SupRate, SupRate,
+				       SupRateLen);
+			RTMPCheckRates(pAd, pAd->MlmeAux.SupRate,
+				       &pAd->MlmeAux.SupRateLen);
 			pAd->MlmeAux.ExtRateLen = ExtRateLen;
-			NdisMoveMemory(pAd->MlmeAux.ExtRate, ExtRate, ExtRateLen);
-			RTMPCheckRates(pAd, pAd->MlmeAux.ExtRate, &pAd->MlmeAux.ExtRateLen);
-
-            NdisZeroMemory(pAd->StaActive.SupportedPhyInfo.MCSSet, 16);
+			NdisMoveMemory(pAd->MlmeAux.ExtRate, ExtRate,
+				       ExtRateLen);
+			RTMPCheckRates(pAd, pAd->MlmeAux.ExtRate,
+				       &pAd->MlmeAux.ExtRateLen);
+
+			NdisZeroMemory(pAd->StaActive.SupportedPhyInfo.MCSSet,
+				       16);
+
+			if (((pAd->StaCfg.WepStatus != Ndis802_11WEPEnabled)
+			     && (pAd->StaCfg.WepStatus !=
+				 Ndis802_11Encryption2Enabled))
+			    || (pAd->CommonCfg.HT_DisallowTKIP == FALSE)) {
+				bAllowNrate = TRUE;
+			}
 
 			pAd->MlmeAux.NewExtChannelOffset = NewExtChannelOffset;
 			pAd->MlmeAux.HtCapabilityLen = HtCapabilityLen;
 
-			// filter out un-supported ht rates
-			if (((HtCapabilityLen > 0) || (PreNHtCapabilityLen > 0)) && (pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED))
-			{
-				RTMPZeroMemory(&pAd->MlmeAux.HtCapability, SIZE_HT_CAP_IE);
-   				RTMPMoveMemory(&pAd->MlmeAux.AddHtInfo, &AddHtInfo, SIZE_ADD_HT_INFO_IE);
-
-				// StaActive.SupportedHtPhy.MCSSet stores Peer AP's 11n Rx capability
-				NdisMoveMemory(pAd->StaActive.SupportedPhyInfo.MCSSet, HtCapability.MCSSet, 16);
-				pAd->MlmeAux.NewExtChannelOffset = NewExtChannelOffset;
+			RTMPZeroMemory(&pAd->MlmeAux.HtCapability,
+				       SIZE_HT_CAP_IE);
+			/* filter out un-supported ht rates */
+			if (((HtCapabilityLen > 0) || (PreNHtCapabilityLen > 0))
+			    && ((pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED)
+				&& (bAllowNrate))) {
+				RTMPMoveMemory(&pAd->MlmeAux.AddHtInfo,
+					       &AddHtInfo, SIZE_ADD_HT_INFO_IE);
+
+				/* StaActive.SupportedHtPhy.MCSSet stores Peer AP's 11n Rx capability */
+				NdisMoveMemory(pAd->StaActive.SupportedPhyInfo.
+					       MCSSet, HtCapability.MCSSet, 16);
+				pAd->MlmeAux.NewExtChannelOffset =
+				    NewExtChannelOffset;
 				pAd->MlmeAux.HtCapabilityLen = SIZE_HT_CAP_IE;
-				pAd->StaActive.SupportedPhyInfo.bHtEnable = TRUE;
+				pAd->StaActive.SupportedPhyInfo.bHtEnable =
+				    TRUE;
 				if (PreNHtCapabilityLen > 0)
-					pAd->StaActive.SupportedPhyInfo.bPreNHt = TRUE;
-				RTMPCheckHt(pAd, BSSID_WCID, &HtCapability, &AddHtInfo);
-				// Copy AP Parameter to StaActive.  This is also in LinkUp.
-				DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAtJoinAction! (MpduDensity=%d, MaxRAmpduFactor=%d, BW=%d)\n",
-					pAd->StaActive.SupportedHtPhy.MpduDensity, pAd->StaActive.SupportedHtPhy.MaxRAmpduFactor, HtCapability.HtCapInfo.ChannelWidth));
-
-				if (AddHtInfoLen > 0)
-				{
+					pAd->StaActive.SupportedPhyInfo.
+					    bPreNHt = TRUE;
+				RTMPCheckHt(pAd, BSSID_WCID, &HtCapability,
+					    &AddHtInfo);
+				/* Copy AP Parameter to StaActive.  This is also in LinkUp. */
+				DBGPRINT(RT_DEBUG_TRACE,
+					 ("PeerBeaconAtJoinAction! (MpduDensity=%d, MaxRAmpduFactor=%d, BW=%d)\n",
+					  pAd->StaActive.SupportedHtPhy.
+					  MpduDensity,
+					  pAd->StaActive.SupportedHtPhy.
+					  MaxRAmpduFactor,
+					  HtCapability.HtCapInfo.ChannelWidth));
+
+				if (AddHtInfoLen > 0) {
 					CentralChannel = AddHtInfo.ControlChan;
-		 			// Check again the Bandwidth capability of this AP.
-		 			if ((AddHtInfo.ControlChan > 2)&& (AddHtInfo.AddHtInfo.ExtChanOffset == EXTCHA_BELOW) && (HtCapability.HtCapInfo.ChannelWidth == BW_40))
-		 			{
-		 				CentralChannel = AddHtInfo.ControlChan - 2;
-		 			}
-		 			else if ((AddHtInfo.AddHtInfo.ExtChanOffset == EXTCHA_ABOVE) && (HtCapability.HtCapInfo.ChannelWidth == BW_40))
-		 			{
-		 				CentralChannel = AddHtInfo.ControlChan + 2;
-		 			}
-
-					// Check Error .
-					if (pAd->MlmeAux.CentralChannel != CentralChannel)
-		 				DBGPRINT(RT_DEBUG_ERROR, ("PeerBeaconAtJoinAction HT===>Beacon Central Channel = %d, Control Channel = %d. Mlmeaux CentralChannel = %d\n", CentralChannel, AddHtInfo.ControlChan, pAd->MlmeAux.CentralChannel));
-
-		 			DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAtJoinAction HT===>Central Channel = %d, Control Channel = %d,  .\n", CentralChannel, AddHtInfo.ControlChan));
+					/* Check again the Bandwidth capability of this AP. */
+					if ((AddHtInfo.ControlChan > 2)
+					    && (AddHtInfo.AddHtInfo.
+						ExtChanOffset == EXTCHA_BELOW)
+					    && (HtCapability.HtCapInfo.
+						ChannelWidth == BW_40)) {
+						CentralChannel =
+						    AddHtInfo.ControlChan - 2;
+					} else
+					    if ((AddHtInfo.AddHtInfo.
+						 ExtChanOffset == EXTCHA_ABOVE)
+						&& (HtCapability.HtCapInfo.
+						    ChannelWidth == BW_40)) {
+						CentralChannel =
+						    AddHtInfo.ControlChan + 2;
+					}
+					/* Check Error . */
+					if (pAd->MlmeAux.CentralChannel !=
+					    CentralChannel)
+						DBGPRINT(RT_DEBUG_ERROR,
+							 ("PeerBeaconAtJoinAction HT===>Beacon Central Channel = %d, Control Channel = %d. Mlmeaux CentralChannel = %d\n",
+							  CentralChannel,
+							  AddHtInfo.ControlChan,
+							  pAd->MlmeAux.
+							  CentralChannel));
+
+					DBGPRINT(RT_DEBUG_TRACE,
+						 ("PeerBeaconAtJoinAction HT===>Central Channel = %d, Control Channel = %d,  .\n",
+						  CentralChannel,
+						  AddHtInfo.ControlChan));
 
 				}
 
-			}
-			else
-			{
-   				// To prevent error, let legacy AP must have same CentralChannel and Channel.
-				if ((HtCapabilityLen == 0) && (PreNHtCapabilityLen == 0))
-					pAd->MlmeAux.CentralChannel = pAd->MlmeAux.Channel;
-
-				pAd->StaActive.SupportedPhyInfo.bHtEnable = FALSE;
-				RTMPZeroMemory(&pAd->MlmeAux.HtCapability, SIZE_HT_CAP_IE);
-				RTMPZeroMemory(&pAd->MlmeAux.AddHtInfo, SIZE_ADD_HT_INFO_IE);
+			} else {
+				/* To prevent error, let legacy AP must have same CentralChannel and Channel. */
+				if ((HtCapabilityLen == 0)
+				    && (PreNHtCapabilityLen == 0))
+					pAd->MlmeAux.CentralChannel =
+					    pAd->MlmeAux.Channel;
+
+				pAd->StaActive.SupportedPhyInfo.bHtEnable =
+				    FALSE;
+				pAd->MlmeAux.NewExtChannelOffset = 0xff;
+				RTMPZeroMemory(&pAd->MlmeAux.HtCapability,
+					       SIZE_HT_CAP_IE);
+				pAd->MlmeAux.HtCapabilityLen = 0;
+				RTMPZeroMemory(&pAd->MlmeAux.AddHtInfo,
+					       SIZE_ADD_HT_INFO_IE);
 			}
 
 			RTMPUpdateMlmeRate(pAd);
 
-			// copy QOS related information
+			/* copy QOS related information */
 			if ((pAd->CommonCfg.bWmmCapable)
-				 || (pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED)
-				)
-			{
-				NdisMoveMemory(&pAd->MlmeAux.APEdcaParm, &EdcaParm, sizeof(EDCA_PARM));
-				NdisMoveMemory(&pAd->MlmeAux.APQbssLoad, &QbssLoad, sizeof(QBSS_LOAD_PARM));
-				NdisMoveMemory(&pAd->MlmeAux.APQosCapability, &QosCapability, sizeof(QOS_CAPABILITY_PARM));
-			}
-			else
-			{
-				NdisZeroMemory(&pAd->MlmeAux.APEdcaParm, sizeof(EDCA_PARM));
-				NdisZeroMemory(&pAd->MlmeAux.APQbssLoad, sizeof(QBSS_LOAD_PARM));
-				NdisZeroMemory(&pAd->MlmeAux.APQosCapability, sizeof(QOS_CAPABILITY_PARM));
+			    || (pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED)
+			    ) {
+				NdisMoveMemory(&pAd->MlmeAux.APEdcaParm,
+					       &EdcaParm, sizeof(struct rt_edca_parm));
+				NdisMoveMemory(&pAd->MlmeAux.APQbssLoad,
+					       &QbssLoad,
+					       sizeof(struct rt_qbss_load_parm));
+				NdisMoveMemory(&pAd->MlmeAux.APQosCapability,
+					       &QosCapability,
+					       sizeof(struct rt_qos_capability_parm));
+			} else {
+				NdisZeroMemory(&pAd->MlmeAux.APEdcaParm,
+					       sizeof(struct rt_edca_parm));
+				NdisZeroMemory(&pAd->MlmeAux.APQbssLoad,
+					       sizeof(struct rt_qbss_load_parm));
+				NdisZeroMemory(&pAd->MlmeAux.APQosCapability,
+					       sizeof(struct rt_qos_capability_parm));
 			}
 
-			DBGPRINT(RT_DEBUG_TRACE, ("SYNC - after JOIN, SupRateLen=%d, ExtRateLen=%d\n",
-										pAd->MlmeAux.SupRateLen, pAd->MlmeAux.ExtRateLen));
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("SYNC - after JOIN, SupRateLen=%d, ExtRateLen=%d\n",
+				  pAd->MlmeAux.SupRateLen,
+				  pAd->MlmeAux.ExtRateLen));
 
-			if (AironetCellPowerLimit != 0xFF)
-			{
-				//We need to change our TxPower for CCX 2.0 AP Control of Client Transmit Power
-				ChangeToCellPowerLimit(pAd, AironetCellPowerLimit);
-			}
-			else  //Used the default TX Power Percentage.
-				pAd->CommonCfg.TxPowerPercentage = pAd->CommonCfg.TxPowerDefault;
+			if (AironetCellPowerLimit != 0xFF) {
+				/*We need to change our TxPower for CCX 2.0 AP Control of Client Transmit Power */
+				ChangeToCellPowerLimit(pAd,
+						       AironetCellPowerLimit);
+			} else	/*Used the default TX Power Percentage. */
+				pAd->CommonCfg.TxPowerPercentage =
+				    pAd->CommonCfg.TxPowerDefault;
 
 			pAd->Mlme.SyncMachine.CurrState = SYNC_IDLE;
 			Status = MLME_SUCCESS;
-			MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_JOIN_CONF, 2, &Status);
+			MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_JOIN_CONF,
+				    2, &Status);
 		}
-		// not to me BEACON, ignored
+		/* not to me BEACON, ignored */
 	}
-	// sanity check fail, ignore this frame
+	/* sanity check fail, ignore this frame */
 }
 
 /*
@@ -948,662 +1041,660 @@ VOID PeerBeaconAtJoinAction(
 
 	==========================================================================
  */
-VOID PeerBeacon(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
+void PeerBeacon(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-	UCHAR         Bssid[MAC_ADDR_LEN], Addr2[MAC_ADDR_LEN];
-	CHAR          Ssid[MAX_LEN_OF_SSID];
-	CF_PARM       CfParm;
-	UCHAR         SsidLen, MessageToMe=0, BssType, Channel, NewChannel, index=0;
-	UCHAR         DtimCount=0, DtimPeriod=0, BcastFlag=0;
-	USHORT        CapabilityInfo, AtimWin, BeaconPeriod;
+	u8 Bssid[MAC_ADDR_LEN], Addr2[MAC_ADDR_LEN];
+	char Ssid[MAX_LEN_OF_SSID];
+	struct rt_cf_parm CfParm;
+	u8 SsidLen, MessageToMe = 0, BssType, Channel, NewChannel, index = 0;
+	u8 DtimCount = 0, DtimPeriod = 0, BcastFlag = 0;
+	u16 CapabilityInfo, AtimWin, BeaconPeriod;
 	LARGE_INTEGER TimeStamp;
-	USHORT        TbttNumToNextWakeUp;
-	UCHAR         Erp;
-	UCHAR         SupRate[MAX_LEN_OF_SUPPORTED_RATES], ExtRate[MAX_LEN_OF_SUPPORTED_RATES];
-	UCHAR		  SupRateLen, ExtRateLen;
-	UCHAR		  CkipFlag;
-	USHORT        LenVIE;
-	UCHAR		  AironetCellPowerLimit;
-	EDCA_PARM       EdcaParm;
-	QBSS_LOAD_PARM  QbssLoad;
-	QOS_CAPABILITY_PARM QosCapability;
-	ULONG           RalinkIe;
-	// New for WPA security suites
-	UCHAR						VarIE[MAX_VIE_LEN];		// Total VIE length = MAX_VIE_LEN - -5
-	NDIS_802_11_VARIABLE_IEs	*pVIE = NULL;
-	HT_CAPABILITY_IE		HtCapability;
-	ADD_HT_INFO_IE		AddHtInfo;	// AP might use this additional ht info IE
-	UCHAR			HtCapabilityLen, PreNHtCapabilityLen;
-	UCHAR			AddHtInfoLen;
-	UCHAR			NewExtChannelOffset = 0xff;
+	u16 TbttNumToNextWakeUp;
+	u8 Erp;
+	u8 SupRate[MAX_LEN_OF_SUPPORTED_RATES],
+	    ExtRate[MAX_LEN_OF_SUPPORTED_RATES];
+	u8 SupRateLen, ExtRateLen;
+	u8 CkipFlag;
+	u16 LenVIE;
+	u8 AironetCellPowerLimit;
+	struct rt_edca_parm EdcaParm;
+	struct rt_qbss_load_parm QbssLoad;
+	struct rt_qos_capability_parm QosCapability;
+	unsigned long RalinkIe;
+	/* New for WPA security suites */
+	u8 VarIE[MAX_VIE_LEN];	/* Total VIE length = MAX_VIE_LEN - -5 */
+	struct rt_ndis_802_11_variable_ies *pVIE = NULL;
+	struct rt_ht_capability_ie HtCapability;
+	struct rt_add_ht_info_ie AddHtInfo;	/* AP might use this additional ht info IE */
+	u8 HtCapabilityLen, PreNHtCapabilityLen;
+	u8 AddHtInfoLen;
+	u8 NewExtChannelOffset = 0xff;
 
 	if (!(INFRA_ON(pAd) || ADHOC_ON(pAd)
-		))
+	    ))
 		return;
 
-	// Init Variable IE structure
-	pVIE = (PNDIS_802_11_VARIABLE_IEs) VarIE;
+	/* Init Variable IE structure */
+	pVIE = (struct rt_ndis_802_11_variable_ies *)VarIE;
 	pVIE->Length = 0;
-    RTMPZeroMemory(&HtCapability, sizeof(HtCapability));
-	RTMPZeroMemory(&AddHtInfo, sizeof(ADD_HT_INFO_IE));
+	RTMPZeroMemory(&HtCapability, sizeof(HtCapability));
+	RTMPZeroMemory(&AddHtInfo, sizeof(struct rt_add_ht_info_ie));
 
 	if (PeerBeaconAndProbeRspSanity(pAd,
-								Elem->Msg,
-								Elem->MsgLen,
-								Elem->Channel,
-								Addr2,
-								Bssid,
-								Ssid,
-								&SsidLen,
-								&BssType,
-								&BeaconPeriod,
-								&Channel,
-								&NewChannel,
-								&TimeStamp,
-								&CfParm,
-								&AtimWin,
-								&CapabilityInfo,
-								&Erp,
-								&DtimCount,
-								&DtimPeriod,
-								&BcastFlag,
-								&MessageToMe,
-								SupRate,
-								&SupRateLen,
-								ExtRate,
-								&ExtRateLen,
-								&CkipFlag,
-								&AironetCellPowerLimit,
-								&EdcaParm,
-								&QbssLoad,
-								&QosCapability,
-								&RalinkIe,
-								&HtCapabilityLen,
-								&PreNHtCapabilityLen,
-								&HtCapability,
-								&AddHtInfoLen,
-								&AddHtInfo,
-								&NewExtChannelOffset,
-								&LenVIE,
-								pVIE))
-	{
+					Elem->Msg,
+					Elem->MsgLen,
+					Elem->Channel,
+					Addr2,
+					Bssid,
+					Ssid,
+					&SsidLen,
+					&BssType,
+					&BeaconPeriod,
+					&Channel,
+					&NewChannel,
+					&TimeStamp,
+					&CfParm,
+					&AtimWin,
+					&CapabilityInfo,
+					&Erp,
+					&DtimCount,
+					&DtimPeriod,
+					&BcastFlag,
+					&MessageToMe,
+					SupRate,
+					&SupRateLen,
+					ExtRate,
+					&ExtRateLen,
+					&CkipFlag,
+					&AironetCellPowerLimit,
+					&EdcaParm,
+					&QbssLoad,
+					&QosCapability,
+					&RalinkIe,
+					&HtCapabilityLen,
+					&PreNHtCapabilityLen,
+					&HtCapability,
+					&AddHtInfoLen,
+					&AddHtInfo,
+					&NewExtChannelOffset, &LenVIE, pVIE)) {
 		BOOLEAN is_my_bssid, is_my_ssid;
-		ULONG   Bssidx, Now;
-		BSS_ENTRY *pBss;
-		CHAR		RealRssi = RTMPMaxRssi(pAd, ConvertToRssi(pAd, Elem->Rssi0, RSSI_0), ConvertToRssi(pAd, Elem->Rssi1, RSSI_1), ConvertToRssi(pAd, Elem->Rssi2, RSSI_2));
-
-		is_my_bssid = MAC_ADDR_EQUAL(Bssid, pAd->CommonCfg.Bssid)? TRUE : FALSE;
-		is_my_ssid = SSID_EQUAL(Ssid, SsidLen, pAd->CommonCfg.Ssid, pAd->CommonCfg.SsidLen)? TRUE:FALSE;
-
-
-		// ignore BEACON not for my SSID
-		if ((! is_my_ssid) && (! is_my_bssid))
+		unsigned long Bssidx, Now;
+		struct rt_bss_entry *pBss;
+		char RealRssi =
+		    RTMPMaxRssi(pAd, ConvertToRssi(pAd, Elem->Rssi0, RSSI_0),
+				ConvertToRssi(pAd, Elem->Rssi1, RSSI_1),
+				ConvertToRssi(pAd, Elem->Rssi2, RSSI_2));
+
+		is_my_bssid =
+		    MAC_ADDR_EQUAL(Bssid, pAd->CommonCfg.Bssid) ? TRUE : FALSE;
+		is_my_ssid =
+		    SSID_EQUAL(Ssid, SsidLen, pAd->CommonCfg.Ssid,
+			       pAd->CommonCfg.SsidLen) ? TRUE : FALSE;
+
+		/* ignore BEACON not for my SSID */
+		if ((!is_my_ssid) && (!is_my_bssid))
 			return;
 
-		// It means STA waits disassoc completely from this AP, ignores this beacon.
+		/* It means STA waits disassoc completely from this AP, ignores this beacon. */
 		if (pAd->Mlme.CntlMachine.CurrState == CNTL_WAIT_DISASSOC)
 			return;
 
-		// Copy Control channel for this BSSID.
+		/* Copy Control channel for this BSSID. */
 		if (AddHtInfoLen != 0)
 			Channel = AddHtInfo.ControlChan;
 
 		if ((HtCapabilityLen > 0) || (PreNHtCapabilityLen > 0))
 			HtCapabilityLen = SIZE_HT_CAP_IE;
 
-		//
-		// Housekeeping "SsidBssTab" table for later-on ROAMing usage.
-		//
+		/* */
+		/* Housekeeping "SsidBssTab" table for later-on ROAMing usage. */
+		/* */
 		Bssidx = BssTableSearch(&pAd->ScanTab, Bssid, Channel);
-		if (Bssidx == BSS_NOT_FOUND)
-		{
-			// discover new AP of this network, create BSS entry
-			Bssidx = BssTableSetEntry(pAd, &pAd->ScanTab, Bssid, Ssid, SsidLen, BssType, BeaconPeriod,
-						 &CfParm, AtimWin, CapabilityInfo, SupRate, SupRateLen, ExtRate, ExtRateLen,
-						&HtCapability, &AddHtInfo,HtCapabilityLen,AddHtInfoLen,NewExtChannelOffset, Channel,
-						RealRssi, TimeStamp, CkipFlag, &EdcaParm, &QosCapability,
-						&QbssLoad, LenVIE, pVIE);
-			if (Bssidx == BSS_NOT_FOUND) // return if BSS table full
+		if (Bssidx == BSS_NOT_FOUND) {
+			/* discover new AP of this network, create BSS entry */
+			Bssidx =
+			    BssTableSetEntry(pAd, &pAd->ScanTab, Bssid, Ssid,
+					     SsidLen, BssType, BeaconPeriod,
+					     &CfParm, AtimWin, CapabilityInfo,
+					     SupRate, SupRateLen, ExtRate,
+					     ExtRateLen, &HtCapability,
+					     &AddHtInfo, HtCapabilityLen,
+					     AddHtInfoLen, NewExtChannelOffset,
+					     Channel, RealRssi, TimeStamp,
+					     CkipFlag, &EdcaParm,
+					     &QosCapability, &QbssLoad, LenVIE,
+					     pVIE);
+			if (Bssidx == BSS_NOT_FOUND)	/* return if BSS table full */
 				return;
 
-			NdisMoveMemory(pAd->ScanTab.BssEntry[Bssidx].PTSF, &Elem->Msg[24], 4);
-			NdisMoveMemory(&pAd->ScanTab.BssEntry[Bssidx].TTSF[0], &Elem->TimeStamp.u.LowPart, 4);
-			NdisMoveMemory(&pAd->ScanTab.BssEntry[Bssidx].TTSF[4], &Elem->TimeStamp.u.LowPart, 4);
-
-
+			NdisMoveMemory(pAd->ScanTab.BssEntry[Bssidx].PTSF,
+				       &Elem->Msg[24], 4);
+			NdisMoveMemory(&pAd->ScanTab.BssEntry[Bssidx].TTSF[0],
+				       &Elem->TimeStamp.u.LowPart, 4);
+			NdisMoveMemory(&pAd->ScanTab.BssEntry[Bssidx].TTSF[4],
+				       &Elem->TimeStamp.u.LowPart, 4);
 
 		}
 
-		if ((pAd->CommonCfg.bIEEE80211H == 1) && (NewChannel != 0) && (Channel != NewChannel))
-		{
-			// Switching to channel 1 can prevent from rescanning the current channel immediately (by auto reconnection).
-			// In addition, clear the MLME queue and the scan table to discard the RX packets and previous scanning results.
+		if ((pAd->CommonCfg.bIEEE80211H == 1) && (NewChannel != 0)
+		    && (Channel != NewChannel)) {
+			/* Switching to channel 1 can prevent from rescanning the current channel immediately (by auto reconnection). */
+			/* In addition, clear the MLME queue and the scan table to discard the RX packets and previous scanning results. */
 			AsicSwitchChannel(pAd, 1, FALSE);
 			AsicLockChannel(pAd, 1);
-		    LinkDown(pAd, FALSE);
+			LinkDown(pAd, FALSE);
 			MlmeQueueInit(&pAd->Mlme.Queue);
 			BssTableInit(&pAd->ScanTab);
-		    RTMPusecDelay(1000000);		// use delay to prevent STA do reassoc
-
-			// channel sanity check
-			for (index = 0 ; index < pAd->ChannelListNum; index++)
-			{
-				if (pAd->ChannelList[index].Channel == NewChannel)
-				{
-					pAd->ScanTab.BssEntry[Bssidx].Channel = NewChannel;
+			RTMPusecDelay(1000000);	/* use delay to prevent STA do reassoc */
+
+			/* channel sanity check */
+			for (index = 0; index < pAd->ChannelListNum; index++) {
+				if (pAd->ChannelList[index].Channel ==
+				    NewChannel) {
+					pAd->ScanTab.BssEntry[Bssidx].Channel =
+					    NewChannel;
 					pAd->CommonCfg.Channel = NewChannel;
-					AsicSwitchChannel(pAd, pAd->CommonCfg.Channel, FALSE);
-					AsicLockChannel(pAd, pAd->CommonCfg.Channel);
-					DBGPRINT(RT_DEBUG_TRACE, ("PeerBeacon - STA receive channel switch announcement IE (New Channel =%d)\n", NewChannel));
+					AsicSwitchChannel(pAd,
+							  pAd->CommonCfg.
+							  Channel, FALSE);
+					AsicLockChannel(pAd,
+							pAd->CommonCfg.Channel);
+					DBGPRINT(RT_DEBUG_TRACE,
+						 ("PeerBeacon - STA receive channel switch announcement IE (New Channel =%d)\n",
+						  NewChannel));
 					break;
 				}
 			}
 
-			if (index >= pAd->ChannelListNum)
-			{
+			if (index >= pAd->ChannelListNum) {
 				DBGPRINT_ERR(("PeerBeacon(can not find New Channel=%d in ChannelList[%d]\n", pAd->CommonCfg.Channel, pAd->ChannelListNum));
 			}
 		}
-
-		// if the ssid matched & bssid unmatched, we should select the bssid with large value.
-		// This might happened when two STA start at the same time
-		if ((! is_my_bssid) && ADHOC_ON(pAd))
-		{
-			INT	i;
-
-			// Add the safeguard against the mismatch of adhoc wep status
-			if (pAd->StaCfg.WepStatus != pAd->ScanTab.BssEntry[Bssidx].WepStatus)
-			{
-				DBGPRINT(RT_DEBUG_TRACE, ("SYNC - Not matched wep status %d %d\n", pAd->StaCfg.WepStatus, pAd->ScanTab.BssEntry[Bssidx].WepStatus));
-				DBGPRINT(RT_DEBUG_TRACE, ("bssid=%s\n", pAd->ScanTab.BssEntry[Bssidx].Bssid));
+		/* if the ssid matched & bssid unmatched, we should select the bssid with large value. */
+		/* This might happened when two STA start at the same time */
+		if ((!is_my_bssid) && ADHOC_ON(pAd)) {
+			int i;
+
+			/* Add the safeguard against the mismatch of adhoc wep status */
+			if (pAd->StaCfg.WepStatus !=
+			    pAd->ScanTab.BssEntry[Bssidx].WepStatus) {
 				return;
 			}
-
-			// collapse into the ADHOC network which has bigger BSSID value.
-			for (i = 0; i < 6; i++)
-			{
-				if (Bssid[i] > pAd->CommonCfg.Bssid[i])
-				{
-					DBGPRINT(RT_DEBUG_TRACE, ("SYNC - merge to the IBSS with bigger BSSID=%02x:%02x:%02x:%02x:%02x:%02x\n",
-						Bssid[0], Bssid[1], Bssid[2], Bssid[3], Bssid[4], Bssid[5]));
+			/* collapse into the ADHOC network which has bigger BSSID value. */
+			for (i = 0; i < 6; i++) {
+				if (Bssid[i] > pAd->CommonCfg.Bssid[i]) {
+					DBGPRINT(RT_DEBUG_TRACE,
+						 ("SYNC - merge to the IBSS with bigger BSSID=%02x:%02x:%02x:%02x:%02x:%02x\n",
+						  Bssid[0], Bssid[1], Bssid[2],
+						  Bssid[3], Bssid[4],
+						  Bssid[5]));
 					AsicDisableSync(pAd);
-					COPY_MAC_ADDR(pAd->CommonCfg.Bssid, Bssid);
+					COPY_MAC_ADDR(pAd->CommonCfg.Bssid,
+						      Bssid);
 					AsicSetBssid(pAd, pAd->CommonCfg.Bssid);
-					MakeIbssBeacon(pAd);        // re-build BEACON frame
-					AsicEnableIbssSync(pAd);    // copy BEACON frame to on-chip memory
+					MakeIbssBeacon(pAd);	/* re-build BEACON frame */
+					AsicEnableIbssSync(pAd);	/* copy BEACON frame to on-chip memory */
 					is_my_bssid = TRUE;
 					break;
-				}
-				else if (Bssid[i] < pAd->CommonCfg.Bssid[i])
+				} else if (Bssid[i] < pAd->CommonCfg.Bssid[i])
 					break;
 			}
 		}
 
-
 		NdisGetSystemUpTime(&Now);
 		pBss = &pAd->ScanTab.BssEntry[Bssidx];
-		pBss->Rssi = RealRssi;       // lastest RSSI
-		pBss->LastBeaconRxTime = Now;   // last RX timestamp
+		pBss->Rssi = RealRssi;	/* lastest RSSI */
+		pBss->LastBeaconRxTime = Now;	/* last RX timestamp */
 
-		//
-		// BEACON from my BSSID - either IBSS or INFRA network
-		//
-		if (is_my_bssid)
-		{
-			RXWI_STRUC	RxWI;
+		/* */
+		/* BEACON from my BSSID - either IBSS or INFRA network */
+		/* */
+		if (is_my_bssid) {
+			struct rt_rxwi RxWI;
 
 			pAd->StaCfg.DtimCount = DtimCount;
 			pAd->StaCfg.DtimPeriod = DtimPeriod;
 			pAd->StaCfg.LastBeaconRxTime = Now;
 
-
 			RxWI.RSSI0 = Elem->Rssi0;
 			RxWI.RSSI1 = Elem->Rssi1;
 			RxWI.RSSI2 = Elem->Rssi2;
 
 			Update_Rssi_Sample(pAd, &pAd->StaCfg.RssiSample, &RxWI);
-			if (AironetCellPowerLimit != 0xFF)
-			{
-				//
-				// We get the Cisco (ccx) "TxPower Limit" required
-				// Changed to appropriate TxPower Limit for Ciso Compatible Extensions
-				//
-				ChangeToCellPowerLimit(pAd, AironetCellPowerLimit);
+			if (AironetCellPowerLimit != 0xFF) {
+				/* */
+				/* We get the Cisco (ccx) "TxPower Limit" required */
+				/* Changed to appropriate TxPower Limit for Ciso Compatible Extensions */
+				/* */
+				ChangeToCellPowerLimit(pAd,
+						       AironetCellPowerLimit);
+			} else {
+				/* */
+				/* AironetCellPowerLimit equal to 0xFF means the Cisco (ccx) "TxPower Limit" not exist. */
+				/* Used the default TX Power Percentage, that set from UI. */
+				/* */
+				pAd->CommonCfg.TxPowerPercentage =
+				    pAd->CommonCfg.TxPowerDefault;
 			}
-			else
-			{
-				//
-				// AironetCellPowerLimit equal to 0xFF means the Cisco (ccx) "TxPower Limit" not exist.
-				// Used the default TX Power Percentage, that set from UI.
-				//
-				pAd->CommonCfg.TxPowerPercentage = pAd->CommonCfg.TxPowerDefault;
-			}
-
-#ifdef RT2860
-			// at least one 11b peer joined. downgrade the MaxTxRate to 11Mbps
-			// after last 11b peer left for several seconds, we'll auto switch back to 11G rate
-			// in MlmePeriodicExec()
-#endif
-			if (ADHOC_ON(pAd) && (CAP_IS_IBSS_ON(CapabilityInfo)))
-			{
-#ifdef RT2860
-				BOOLEAN	bRestart;
-                BOOLEAN	bnRestart;
-
-				bRestart = FALSE;
-                bnRestart = FALSE;
-
-				do
-				{
-					if ((SupRateLen+ExtRateLen <= 4) && (pAd->CommonCfg.MaxTxRate > RATE_11))
-					{
-						if (pAd->StaCfg.AdhocBOnlyJoined == FALSE)
-						{
-							DBGPRINT(RT_DEBUG_TRACE, ("SYNC - 11b peer joined. down-grade to 11b TX rates \n"));
-							bRestart = TRUE;
-							NdisMoveMemory(pAd->StaActive.SupRate, SupRate, MAX_LEN_OF_SUPPORTED_RATES);
-							pAd->StaActive.SupRateLen = SupRateLen;
-							NdisMoveMemory(pAd->StaActive.ExtRate, ExtRate, MAX_LEN_OF_SUPPORTED_RATES);
-							pAd->StaActive.ExtRateLen = ExtRateLen;
-							pAd->StaCfg.AdhocBOnlyJoined = TRUE;
-							pAd->StaActive.SupportedPhyInfo.bHtEnable = FALSE;
-							AsicSetEdcaParm(pAd, NULL);
-						}
-
-						// this timestamp is for MlmePeriodicExec() to check if all 11B peers have left
-						pAd->StaCfg.Last11bBeaconRxTime = Now;
-						break;
-					}
-
-					// Update Ht Phy.
-					if ((pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED))
-					{
-						if (!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED) &&
-							!pAd->StaCfg.AdhocBGJoined &&
-							!pAd->StaCfg.AdhocBOnlyJoined)
-							AdhocTurnOnQos(pAd);
-
-						// Handle rate switch issue when Adhoc mode
-						if ((SupRateLen+ExtRateLen >= 8) && (HtCapability.MCSSet[0] == 0) && (HtCapability.MCSSet[1] == 0))
-						{
-							if (pAd->StaCfg.AdhocBGJoined == FALSE)
-							{
-								DBGPRINT(RT_DEBUG_TRACE, ("SYNC - 11g peer joined. down-grade to 11g TX rates \n"));
-								bRestart = TRUE;
-								NdisMoveMemory(pAd->StaActive.SupRate, SupRate, MAX_LEN_OF_SUPPORTED_RATES);
-								pAd->StaActive.SupRateLen = SupRateLen;
-								NdisMoveMemory(pAd->StaActive.ExtRate, ExtRate, MAX_LEN_OF_SUPPORTED_RATES);
-								pAd->StaActive.ExtRateLen = ExtRateLen;
-								pAd->StaCfg.AdhocBGJoined = TRUE;
-								pAd->StaActive.SupportedPhyInfo.bHtEnable = FALSE;
-								AsicSetEdcaParm(pAd, NULL);
-							}
-
-							// this timestamp is for MlmePeriodicExec() to check if all 11g peers have left
-							pAd->StaCfg.Last11gBeaconRxTime = Now;
-							break;
-						}
-						else if (!pAd->StaCfg.AdhocBGJoined &&
-								 !pAd->StaCfg.AdhocBOnlyJoined &&
-								 (pAd->CommonCfg.RegTransmitSetting.field.BW == BW_40) &&
-								 (HtCapability.HtCapInfo.ChannelWidth == BW_20))
-						{
-							if (pAd->StaCfg.Adhoc20NJoined == FALSE)
-							{
-								pAd->CommonCfg.CentralChannel = pAd->CommonCfg.Channel;
-
-								pAd->StaCfg.Adhoc20NJoined = TRUE;
-								NdisMoveMemory(&pAd->MlmeAux.HtCapability, &HtCapability, SIZE_HT_CAP_IE);
-								if (AddHtInfoLen != 0)
-									NdisMoveMemory(&pAd->MlmeAux.AddHtInfo, &AddHtInfo, AddHtInfoLen);
-								NdisMoveMemory(pAd->StaActive.SupportedPhyInfo.MCSSet, HtCapability.MCSSet, 16);
-
-								RTMPCheckHt(pAd, Elem->Wcid, &pAd->MlmeAux.HtCapability, &pAd->MlmeAux.AddHtInfo);
-								COPY_HTSETTINGS_FROM_MLME_AUX_TO_ACTIVE_CFG(pAd);
-								pAd->StaActive.SupportedPhyInfo.bHtEnable = TRUE;
-								bRestart = TRUE;
-								bnRestart = TRUE;
-							}
-							// this timestamp is for MlmePeriodicExec() to check if all 20MHz N peers have left
-							pAd->StaCfg.Last20NBeaconRxTime = Now;
-						}
 
-					}
-					else
-					{
-						RTMPZeroMemory(&pAd->MlmeAux.HtCapability, SIZE_HT_CAP_IE);
-						RTMPZeroMemory(&pAd->MlmeAux.AddHtInfo, SIZE_ADD_HT_INFO_IE);
-					}
-				}while (FALSE);
-
-				// If peer Adhoc is legacy mode, I don't need to call MlmeUpdateHtTxRates no matter I support HT or not
-				if ((bRestart == TRUE) && (bnRestart == FALSE))
-				{
-					MlmeUpdateTxRates(pAd, FALSE, 0);
-					MakeIbssBeacon(pAd);        // re-build BEACON frame
-					AsicEnableIbssSync(pAd);    // copy to on-chip memory
+			if (ADHOC_ON(pAd) && (CAP_IS_IBSS_ON(CapabilityInfo))) {
+				u8 MaxSupportedRateIn500Kbps = 0;
+				u8 idx;
+				struct rt_mac_table_entry *pEntry;
+
+				/* supported rates array may not be sorted. sort it and find the maximum rate */
+				for (idx = 0; idx < SupRateLen; idx++) {
+					if (MaxSupportedRateIn500Kbps <
+					    (SupRate[idx] & 0x7f))
+						MaxSupportedRateIn500Kbps =
+						    SupRate[idx] & 0x7f;
 				}
-				else if ((bRestart == TRUE) && (bnRestart == TRUE))
-				{
-					MlmeUpdateTxRates(pAd, FALSE, BSS0);
-					MlmeUpdateHtTxRates(pAd, BSS0);
-					MakeIbssBeacon(pAd);        // re-build BEACON frame
-					AsicEnableIbssSync(pAd);    // copy to on-chip memory
-				}
-
-				// At least another peer in this IBSS, declare MediaState as CONNECTED
-				if (!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED))
-				{
-					OPSTATUS_SET_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED);
 
-					pAd->IndicateMediaState = NdisMediaStateConnected;
-					RTMP_IndicateMediaState(pAd);
-	                pAd->ExtraInfo = GENERAL_LINK_UP;
-					AsicSetBssid(pAd, pAd->CommonCfg.Bssid);
-
-					// 2003/03/12 - john
-					// Make sure this entry in "ScanTab" table, thus complies to Microsoft's policy that
-					// "site survey" result should always include the current connected network.
-					//
-					Bssidx = BssTableSearch(&pAd->ScanTab, Bssid, Channel);
-					if (Bssidx == BSS_NOT_FOUND)
-					{
-						Bssidx = BssTableSetEntry(pAd, &pAd->ScanTab, Bssid, Ssid, SsidLen, BssType, BeaconPeriod,
-									&CfParm, AtimWin, CapabilityInfo, SupRate, SupRateLen, ExtRate, ExtRateLen, &HtCapability,
-									&AddHtInfo, HtCapabilityLen, AddHtInfoLen, NewExtChannelOffset, Channel, RealRssi, TimeStamp, 0,
-									&EdcaParm, &QosCapability, &QbssLoad, LenVIE, pVIE);
-					}
-					DBGPRINT(RT_DEBUG_TRACE, ("ADHOC  fOP_STATUS_MEDIA_STATE_CONNECTED.\n"));
+				for (idx = 0; idx < ExtRateLen; idx++) {
+					if (MaxSupportedRateIn500Kbps <
+					    (ExtRate[idx] & 0x7f))
+						MaxSupportedRateIn500Kbps =
+						    ExtRate[idx] & 0x7f;
 				}
 
-				// Ad-hoc mode is using MAC address as BA session. So we need to continuously find newly joined adhoc station by receiving beacon.
-				// To prevent always check this, we use wcid == RESERVED_WCID to recognize it as newly joined adhoc station.
-				if (ADHOC_ON(pAd) && (Elem->Wcid == RESERVED_WCID))
-				{
-					UCHAR	idx;
-					MAC_TABLE_ENTRY *pEntry;
-
-					// look up the existing table
-					pEntry = MacTableLookup(pAd, Addr2);
-					if (pEntry == NULL)
-					{
-						// Another adhoc joining, add to our MAC table.
-						pEntry = MacTableInsertEntry(pAd, Addr2, BSS0, FALSE);
-						if (pEntry)
-						{
-							pEntry->Sst = SST_ASSOC;
-							idx = pAd->StaCfg.DefaultKeyId;
-							// After InsertEntry, Write to ASIC on-chip table.
-							RT28XX_STA_SECURITY_INFO_ADD(pAd, BSS0, idx, pEntry);
-							DBGPRINT(RT_DEBUG_TRACE, ("ADHOC %x:%x:%x:%x:%x:%x  join in.Entry=%d\n", Addr2[0],Addr2[1],Addr2[2],Addr2[3],Addr2[4],Addr2[5], pEntry->Aid));
-
-							pEntry->HTPhyMode.word = pAd->StaCfg.HTPhyMode.word;
-	                        if (HtCapabilityLen <= 0)
-	                        {
-	                            pEntry->HTPhyMode.field.STBC = 0;
-	                            pEntry->HTPhyMode.field.BW = 0;
-	                            pEntry->HTPhyMode.field.ShortGI = 0;
-	                            if ((SupRateLen+ExtRateLen <= 4) && (pAd->CommonCfg.Channel <= 14))
-	        					{
-	        						pEntry->HTPhyMode.field.MODE = MODE_CCK;
-	        					}
-	        					else
-	        					{
-	        						pEntry->HTPhyMode.field.MODE = MODE_OFDM;
-	        					}
-								MlmeUpdateTxRates(pAd, FALSE, 0);
-	                        }
-							else
-							{
-								MlmeUpdateTxRates(pAd, FALSE, 0);
-								MlmeUpdateHtTxRates(pAd, BSS0);
-							}
-
-	                        {
-	                            union iwreq_data    wrqu;
-	                            wext_notify_event_assoc(pAd);
-
-	                            memset(wrqu.ap_addr.sa_data, 0, MAC_ADDR_LEN);
-	                            memcpy(wrqu.ap_addr.sa_data, pAd->MlmeAux.Bssid, MAC_ADDR_LEN);
-	                            wireless_send_event(pAd->net_dev, SIOCGIWAP, &wrqu, NULL);
-
-	                        }
-						}
-					}
-				}
-#endif /* RT2860 */
-#ifdef RT2870
-				UCHAR			MaxSupportedRateIn500Kbps = 0;
-				UCHAR			idx;
-				MAC_TABLE_ENTRY *pEntry;
-
-				// supported rates array may not be sorted. sort it and find the maximum rate
-			    for (idx=0; idx<SupRateLen; idx++)
-			    {
-			        if (MaxSupportedRateIn500Kbps < (SupRate[idx] & 0x7f))
-			            MaxSupportedRateIn500Kbps = SupRate[idx] & 0x7f;
-			    }
-
-				for (idx=0; idx<ExtRateLen; idx++)
-			    {
-			        if (MaxSupportedRateIn500Kbps < (ExtRate[idx] & 0x7f))
-			            MaxSupportedRateIn500Kbps = ExtRate[idx] & 0x7f;
-			    }
-
-				// look up the existing table
+				/* look up the existing table */
 				pEntry = MacTableLookup(pAd, Addr2);
 
-				// Ad-hoc mode is using MAC address as BA session. So we need to continuously find newly joined adhoc station by receiving beacon.
-				// To prevent always check this, we use wcid == RESERVED_WCID to recognize it as newly joined adhoc station.
-				if ((ADHOC_ON(pAd) && (Elem->Wcid == RESERVED_WCID)) ||
-					(pEntry && ((pEntry->LastBeaconRxTime + ADHOC_ENTRY_BEACON_LOST_TIME) < Now)))
-				{
+				/* Ad-hoc mode is using MAC address as BA session. So we need to continuously find newly joined adhoc station by receiving beacon. */
+				/* To prevent always check this, we use wcid == RESERVED_WCID to recognize it as newly joined adhoc station. */
+				if ((ADHOC_ON(pAd)
+				     && (Elem->Wcid == RESERVED_WCID))
+				    || (pEntry
+					&&
+					((pEntry->LastBeaconRxTime +
+					  ADHOC_ENTRY_BEACON_LOST_TIME) <
+					 Now))) {
 					if (pEntry == NULL)
-						// Another adhoc joining, add to our MAC table.
-						pEntry = MacTableInsertEntry(pAd, Addr2, BSS0, FALSE);
-
-					if (StaAddMacTableEntry(pAd, pEntry, MaxSupportedRateIn500Kbps, &HtCapability, HtCapabilityLen, CapabilityInfo) == FALSE)
-					{
-						DBGPRINT(RT_DEBUG_TRACE, ("ADHOC - Add Entry failed.\n"));
+						/* Another adhoc joining, add to our MAC table. */
+						pEntry =
+						    MacTableInsertEntry(pAd,
+									Addr2,
+									BSS0,
+									FALSE);
+
+					if (StaAddMacTableEntry(pAd,
+								pEntry,
+								MaxSupportedRateIn500Kbps,
+								&HtCapability,
+								HtCapabilityLen,
+								&AddHtInfo,
+								AddHtInfoLen,
+								CapabilityInfo)
+					    == FALSE) {
+						DBGPRINT(RT_DEBUG_TRACE,
+							 ("ADHOC - Add Entry failed.\n"));
 						return;
 					}
 
 					if (pEntry &&
-						(Elem->Wcid == RESERVED_WCID))
-					{
+					    (Elem->Wcid == RESERVED_WCID)) {
 						idx = pAd->StaCfg.DefaultKeyId;
-						RT28XX_STA_SECURITY_INFO_ADD(pAd, BSS0, idx, pEntry);
+						RTMP_STA_SECURITY_INFO_ADD(pAd,
+									   BSS0,
+									   idx,
+									   pEntry);
 					}
 				}
 
 				if (pEntry && pEntry->ValidAsCLI)
 					pEntry->LastBeaconRxTime = Now;
 
-				// At least another peer in this IBSS, declare MediaState as CONNECTED
-				if (!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED))
-				{
-					OPSTATUS_SET_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED);
+				/* At least another peer in this IBSS, declare MediaState as CONNECTED */
+				if (!OPSTATUS_TEST_FLAG
+				    (pAd, fOP_STATUS_MEDIA_STATE_CONNECTED)) {
+					OPSTATUS_SET_FLAG(pAd,
+							  fOP_STATUS_MEDIA_STATE_CONNECTED);
 
-					pAd->IndicateMediaState = NdisMediaStateConnected;
+					pAd->IndicateMediaState =
+					    NdisMediaStateConnected;
 					RTMP_IndicateMediaState(pAd);
-	                pAd->ExtraInfo = GENERAL_LINK_UP;
+					pAd->ExtraInfo = GENERAL_LINK_UP;
 					AsicSetBssid(pAd, pAd->CommonCfg.Bssid);
 
-					// 2003/03/12 - john
-					// Make sure this entry in "ScanTab" table, thus complies to Microsoft's policy that
-					// "site survey" result should always include the current connected network.
-					//
-					Bssidx = BssTableSearch(&pAd->ScanTab, Bssid, Channel);
-					if (Bssidx == BSS_NOT_FOUND)
-					{
-						Bssidx = BssTableSetEntry(pAd, &pAd->ScanTab, Bssid, Ssid, SsidLen, BssType, BeaconPeriod,
-									&CfParm, AtimWin, CapabilityInfo, SupRate, SupRateLen, ExtRate, ExtRateLen, &HtCapability,
-									&AddHtInfo, HtCapabilityLen, AddHtInfoLen, NewExtChannelOffset, Channel, RealRssi, TimeStamp, 0,
-									&EdcaParm, &QosCapability, &QbssLoad, LenVIE, pVIE);
+					/* 2003/03/12 - john */
+					/* Make sure this entry in "ScanTab" table, thus complies to Microsoft's policy that */
+					/* "site survey" result should always include the current connected network. */
+					/* */
+					Bssidx =
+					    BssTableSearch(&pAd->ScanTab, Bssid,
+							   Channel);
+					if (Bssidx == BSS_NOT_FOUND) {
+						Bssidx =
+						    BssTableSetEntry(pAd,
+								     &pAd->
+								     ScanTab,
+								     Bssid,
+								     Ssid,
+								     SsidLen,
+								     BssType,
+								     BeaconPeriod,
+								     &CfParm,
+								     AtimWin,
+								     CapabilityInfo,
+								     SupRate,
+								     SupRateLen,
+								     ExtRate,
+								     ExtRateLen,
+								     &HtCapability,
+								     &AddHtInfo,
+								     HtCapabilityLen,
+								     AddHtInfoLen,
+								     NewExtChannelOffset,
+								     Channel,
+								     RealRssi,
+								     TimeStamp,
+								     0,
+								     &EdcaParm,
+								     &QosCapability,
+								     &QbssLoad,
+								     LenVIE,
+								     pVIE);
 					}
-					DBGPRINT(RT_DEBUG_TRACE, ("ADHOC  fOP_STATUS_MEDIA_STATE_CONNECTED.\n"));
+					DBGPRINT(RT_DEBUG_TRACE,
+						 ("ADHOC  fOP_STATUS_MEDIA_STATE_CONNECTED.\n"));
 				}
-#endif /* RT2870 */
 			}
 
-			if (INFRA_ON(pAd))
-			{
+			if (INFRA_ON(pAd)) {
 				BOOLEAN bUseShortSlot, bUseBGProtection;
 
-				// decide to use/change to -
-				//      1. long slot (20 us) or short slot (9 us) time
-				//      2. turn on/off RTS/CTS and/or CTS-to-self protection
-				//      3. short preamble
-
-				//bUseShortSlot = pAd->CommonCfg.bUseShortSlotTime && CAP_IS_SHORT_SLOT(CapabilityInfo);
-				bUseShortSlot = CAP_IS_SHORT_SLOT(CapabilityInfo);
-				if (bUseShortSlot != OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_SHORT_SLOT_INUSED))
+				/* decide to use/change to - */
+				/*      1. long slot (20 us) or short slot (9 us) time */
+				/*      2. turn on/off RTS/CTS and/or CTS-to-self protection */
+				/*      3. short preamble */
+
+				/*bUseShortSlot = pAd->CommonCfg.bUseShortSlotTime && CAP_IS_SHORT_SLOT(CapabilityInfo); */
+				bUseShortSlot =
+				    CAP_IS_SHORT_SLOT(CapabilityInfo);
+				if (bUseShortSlot !=
+				    OPSTATUS_TEST_FLAG(pAd,
+						       fOP_STATUS_SHORT_SLOT_INUSED))
 					AsicSetSlotTime(pAd, bUseShortSlot);
 
-				bUseBGProtection = (pAd->CommonCfg.UseBGProtection == 1) ||    // always use
-								   ((pAd->CommonCfg.UseBGProtection == 0) && ERP_IS_USE_PROTECTION(Erp));
+				bUseBGProtection = (pAd->CommonCfg.UseBGProtection == 1) ||	/* always use */
+				    ((pAd->CommonCfg.UseBGProtection == 0)
+				     && ERP_IS_USE_PROTECTION(Erp));
 
-				if (pAd->CommonCfg.Channel > 14) // always no BG protection in A-band. falsely happened when switching A/G band to a dual-band AP
+				if (pAd->CommonCfg.Channel > 14)	/* always no BG protection in A-band. falsely happened when switching A/G band to a dual-band AP */
 					bUseBGProtection = FALSE;
 
-				if (bUseBGProtection != OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_BG_PROTECTION_INUSED))
+				if (bUseBGProtection !=
+				    OPSTATUS_TEST_FLAG(pAd,
+						       fOP_STATUS_BG_PROTECTION_INUSED))
 				{
-					if (bUseBGProtection)
-					{
-						OPSTATUS_SET_FLAG(pAd, fOP_STATUS_BG_PROTECTION_INUSED);
-						AsicUpdateProtect(pAd, pAd->MlmeAux.AddHtInfo.AddHtInfo2.OperaionMode, (OFDMSETPROTECT|CCKSETPROTECT|ALLN_SETPROTECT),FALSE,(pAd->MlmeAux.AddHtInfo.AddHtInfo2.NonGfPresent == 1));
-					}
-					else
-					{
-						OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_BG_PROTECTION_INUSED);
-						AsicUpdateProtect(pAd, pAd->MlmeAux.AddHtInfo.AddHtInfo2.OperaionMode, (OFDMSETPROTECT|CCKSETPROTECT|ALLN_SETPROTECT),TRUE,(pAd->MlmeAux.AddHtInfo.AddHtInfo2.NonGfPresent == 1));
+					if (bUseBGProtection) {
+						OPSTATUS_SET_FLAG(pAd,
+								  fOP_STATUS_BG_PROTECTION_INUSED);
+						AsicUpdateProtect(pAd,
+								  pAd->MlmeAux.
+								  AddHtInfo.
+								  AddHtInfo2.
+								  OperaionMode,
+								  (OFDMSETPROTECT
+								   |
+								   CCKSETPROTECT
+								   |
+								   ALLN_SETPROTECT),
+								  FALSE,
+								  (pAd->MlmeAux.
+								   AddHtInfo.
+								   AddHtInfo2.
+								   NonGfPresent
+								   == 1));
+					} else {
+						OPSTATUS_CLEAR_FLAG(pAd,
+								    fOP_STATUS_BG_PROTECTION_INUSED);
+						AsicUpdateProtect(pAd,
+								  pAd->MlmeAux.
+								  AddHtInfo.
+								  AddHtInfo2.
+								  OperaionMode,
+								  (OFDMSETPROTECT
+								   |
+								   CCKSETPROTECT
+								   |
+								   ALLN_SETPROTECT),
+								  TRUE,
+								  (pAd->MlmeAux.
+								   AddHtInfo.
+								   AddHtInfo2.
+								   NonGfPresent
+								   == 1));
 					}
 
-					DBGPRINT(RT_DEBUG_WARN, ("SYNC - AP changed B/G protection to %d\n", bUseBGProtection));
+					DBGPRINT(RT_DEBUG_WARN,
+						 ("SYNC - AP changed B/G protection to %d\n",
+						  bUseBGProtection));
 				}
-
-				// check Ht protection mode. and adhere to the Non-GF device indication by AP.
+				/* check Ht protection mode. and adhere to the Non-GF device indication by AP. */
 				if ((AddHtInfoLen != 0) &&
-					((AddHtInfo.AddHtInfo2.OperaionMode != pAd->MlmeAux.AddHtInfo.AddHtInfo2.OperaionMode) ||
-					(AddHtInfo.AddHtInfo2.NonGfPresent != pAd->MlmeAux.AddHtInfo.AddHtInfo2.NonGfPresent)))
-				{
-					pAd->MlmeAux.AddHtInfo.AddHtInfo2.NonGfPresent = AddHtInfo.AddHtInfo2.NonGfPresent;
-					pAd->MlmeAux.AddHtInfo.AddHtInfo2.OperaionMode = AddHtInfo.AddHtInfo2.OperaionMode;
-					if (pAd->MlmeAux.AddHtInfo.AddHtInfo2.NonGfPresent == 1)
-				{
-						AsicUpdateProtect(pAd, pAd->MlmeAux.AddHtInfo.AddHtInfo2.OperaionMode, ALLN_SETPROTECT, FALSE, TRUE);
-					}
-					else
-						AsicUpdateProtect(pAd, pAd->MlmeAux.AddHtInfo.AddHtInfo2.OperaionMode, ALLN_SETPROTECT, FALSE, FALSE);
-
-					DBGPRINT(RT_DEBUG_TRACE, ("SYNC - AP changed N OperaionMode to %d\n", pAd->MlmeAux.AddHtInfo.AddHtInfo2.OperaionMode));
+				    ((AddHtInfo.AddHtInfo2.OperaionMode !=
+				      pAd->MlmeAux.AddHtInfo.AddHtInfo2.
+				      OperaionMode)
+				     || (AddHtInfo.AddHtInfo2.NonGfPresent !=
+					 pAd->MlmeAux.AddHtInfo.AddHtInfo2.
+					 NonGfPresent))) {
+					pAd->MlmeAux.AddHtInfo.AddHtInfo2.
+					    NonGfPresent =
+					    AddHtInfo.AddHtInfo2.NonGfPresent;
+					pAd->MlmeAux.AddHtInfo.AddHtInfo2.
+					    OperaionMode =
+					    AddHtInfo.AddHtInfo2.OperaionMode;
+					if (pAd->MlmeAux.AddHtInfo.AddHtInfo2.
+					    NonGfPresent == 1) {
+						AsicUpdateProtect(pAd,
+								  pAd->MlmeAux.
+								  AddHtInfo.
+								  AddHtInfo2.
+								  OperaionMode,
+								  ALLN_SETPROTECT,
+								  FALSE, TRUE);
+					} else
+						AsicUpdateProtect(pAd,
+								  pAd->MlmeAux.
+								  AddHtInfo.
+								  AddHtInfo2.
+								  OperaionMode,
+								  ALLN_SETPROTECT,
+								  FALSE, FALSE);
+
+					DBGPRINT(RT_DEBUG_TRACE,
+						 ("SYNC - AP changed N OperaionMode to %d\n",
+						  pAd->MlmeAux.AddHtInfo.
+						  AddHtInfo2.OperaionMode));
 				}
 
-				if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_SHORT_PREAMBLE_INUSED) &&
-					ERP_IS_USE_BARKER_PREAMBLE(Erp))
-				{
-					MlmeSetTxPreamble(pAd, Rt802_11PreambleLong);
-					DBGPRINT(RT_DEBUG_TRACE, ("SYNC - AP forced to use LONG preamble\n"));
+				if (OPSTATUS_TEST_FLAG
+				    (pAd, fOP_STATUS_SHORT_PREAMBLE_INUSED)
+				    && ERP_IS_USE_BARKER_PREAMBLE(Erp)) {
+					MlmeSetTxPreamble(pAd,
+							  Rt802_11PreambleLong);
+					DBGPRINT(RT_DEBUG_TRACE,
+						 ("SYNC - AP forced to use long preamble\n"));
 				}
 
-				if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_WMM_INUSED)    &&
-					(EdcaParm.bValid == TRUE)                          &&
-					(EdcaParm.EdcaUpdateCount != pAd->CommonCfg.APEdcaParm.EdcaUpdateCount))
-				{
-					DBGPRINT(RT_DEBUG_TRACE, ("SYNC - AP change EDCA parameters(from %d to %d)\n",
-						pAd->CommonCfg.APEdcaParm.EdcaUpdateCount,
-						EdcaParm.EdcaUpdateCount));
+				if (OPSTATUS_TEST_FLAG
+				    (pAd, fOP_STATUS_WMM_INUSED)
+				    && (EdcaParm.bValid == TRUE)
+				    && (EdcaParm.EdcaUpdateCount !=
+					pAd->CommonCfg.APEdcaParm.
+					EdcaUpdateCount)) {
+					DBGPRINT(RT_DEBUG_TRACE,
+						 ("SYNC - AP change EDCA parameters(from %d to %d)\n",
+						  pAd->CommonCfg.APEdcaParm.
+						  EdcaUpdateCount,
+						  EdcaParm.EdcaUpdateCount));
 					AsicSetEdcaParm(pAd, &EdcaParm);
 				}
-
-				// copy QOS related information
-				NdisMoveMemory(&pAd->CommonCfg.APQbssLoad, &QbssLoad, sizeof(QBSS_LOAD_PARM));
-				NdisMoveMemory(&pAd->CommonCfg.APQosCapability, &QosCapability, sizeof(QOS_CAPABILITY_PARM));
+				/* copy QOS related information */
+				NdisMoveMemory(&pAd->CommonCfg.APQbssLoad,
+					       &QbssLoad,
+					       sizeof(struct rt_qbss_load_parm));
+				NdisMoveMemory(&pAd->CommonCfg.APQosCapability,
+					       &QosCapability,
+					       sizeof(struct rt_qos_capability_parm));
 			}
-
-			// only INFRASTRUCTURE mode support power-saving feature
-			if ((INFRA_ON(pAd) && (pAd->StaCfg.Psm == PWR_SAVE)) || (pAd->CommonCfg.bAPSDForcePowerSave))
-			{
-				UCHAR FreeNumber;
-				//  1. AP has backlogged unicast-to-me frame, stay AWAKE, send PSPOLL
-				//  2. AP has backlogged broadcast/multicast frame and we want those frames, stay AWAKE
-				//  3. we have outgoing frames in TxRing or MgmtRing, better stay AWAKE
-				//  4. Psm change to PWR_SAVE, but AP not been informed yet, we better stay AWAKE
-				//  5. otherwise, put PHY back to sleep to save battery.
-				if (MessageToMe)
-				{
-#ifdef RT2860
-					if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_ADVANCE_POWER_SAVE_PCIE_DEVICE))
-					{
-						RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R3, pAd->StaCfg.BBPR3);
+			/* only INFRASTRUCTURE mode support power-saving feature */
+			if ((INFRA_ON(pAd) && (pAd->StaCfg.Psm == PWR_SAVE))
+			    || (pAd->CommonCfg.bAPSDForcePowerSave)) {
+				u8 FreeNumber;
+				/*  1. AP has backlogged unicast-to-me frame, stay AWAKE, send PSPOLL */
+				/*  2. AP has backlogged broadcast/multicast frame and we want those frames, stay AWAKE */
+				/*  3. we have outgoing frames in TxRing or MgmtRing, better stay AWAKE */
+				/*  4. Psm change to PWR_SAVE, but AP not been informed yet, we better stay AWAKE */
+				/*  5. otherwise, put PHY back to sleep to save battery. */
+				if (MessageToMe) {
+#ifdef RTMP_MAC_PCI
+					if (OPSTATUS_TEST_FLAG
+					    (pAd, fOP_STATUS_PCIE_DEVICE)) {
+						/* Restore to correct BBP R3 value */
+						if (pAd->Antenna.field.RxPath >
+						    1)
+							RTMP_BBP_IO_WRITE8_BY_REG_ID
+							    (pAd, BBP_R3,
+							     pAd->StaCfg.BBPR3);
+						/* Turn clk to 80Mhz. */
 					}
-#endif
-					if (pAd->CommonCfg.bAPSDCapable && pAd->CommonCfg.APEdcaParm.bAPSDCapable &&
-						pAd->CommonCfg.bAPSDAC_BE && pAd->CommonCfg.bAPSDAC_BK && pAd->CommonCfg.bAPSDAC_VI && pAd->CommonCfg.bAPSDAC_VO)
-					{
-						pAd->CommonCfg.bNeedSendTriggerFrame = TRUE;
-					}
-					else
-						RT28XX_PS_POLL_ENQUEUE(pAd);
-				}
-				else if (BcastFlag && (DtimCount == 0) && OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_RECEIVE_DTIM))
+#endif /* RTMP_MAC_PCI // */
+					if (pAd->CommonCfg.bAPSDCapable
+					    && pAd->CommonCfg.APEdcaParm.
+					    bAPSDCapable
+					    && pAd->CommonCfg.bAPSDAC_BE
+					    && pAd->CommonCfg.bAPSDAC_BK
+					    && pAd->CommonCfg.bAPSDAC_VI
+					    && pAd->CommonCfg.bAPSDAC_VO) {
+						pAd->CommonCfg.
+						    bNeedSendTriggerFrame =
+						    TRUE;
+					} else
+						RTMP_PS_POLL_ENQUEUE(pAd);
+				} else if (BcastFlag && (DtimCount == 0)
+					   && OPSTATUS_TEST_FLAG(pAd,
+								 fOP_STATUS_RECEIVE_DTIM))
 				{
-#ifdef RT2860
-					if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_ADVANCE_POWER_SAVE_PCIE_DEVICE))
-					{
-						RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R3, pAd->StaCfg.BBPR3);
+#ifdef RTMP_MAC_PCI
+					if (OPSTATUS_TEST_FLAG
+					    (pAd, fOP_STATUS_PCIE_DEVICE)) {
+						if (pAd->Antenna.field.RxPath >
+						    1)
+							RTMP_BBP_IO_WRITE8_BY_REG_ID
+							    (pAd, BBP_R3,
+							     pAd->StaCfg.BBPR3);
 					}
-#endif
-				}
-				else if ((pAd->TxSwQueue[QID_AC_BK].Number != 0)													||
-						(pAd->TxSwQueue[QID_AC_BE].Number != 0)														||
-						(pAd->TxSwQueue[QID_AC_VI].Number != 0)														||
-						(pAd->TxSwQueue[QID_AC_VO].Number != 0)														||
-						(RTMPFreeTXDRequest(pAd, QID_AC_BK, TX_RING_SIZE - 1, &FreeNumber) != NDIS_STATUS_SUCCESS)	||
-						(RTMPFreeTXDRequest(pAd, QID_AC_BE, TX_RING_SIZE - 1, &FreeNumber) != NDIS_STATUS_SUCCESS)	||
-						(RTMPFreeTXDRequest(pAd, QID_AC_VI, TX_RING_SIZE - 1, &FreeNumber) != NDIS_STATUS_SUCCESS)	||
-						(RTMPFreeTXDRequest(pAd, QID_AC_VO, TX_RING_SIZE - 1, &FreeNumber) != NDIS_STATUS_SUCCESS)	||
-						(RTMPFreeTXDRequest(pAd, QID_MGMT, MGMT_RING_SIZE - 1, &FreeNumber) != NDIS_STATUS_SUCCESS))
-				{
-					// TODO: consider scheduled HCCA. might not be proper to use traditional DTIM-based power-saving scheme
-					// can we cheat here (i.e. just check MGMT & AC_BE) for better performance?
-#ifdef RT2860
-					if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_ADVANCE_POWER_SAVE_PCIE_DEVICE))
-					{
-						RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R3, pAd->StaCfg.BBPR3);
+#endif /* RTMP_MAC_PCI // */
+				} else
+				    if ((pAd->TxSwQueue[QID_AC_BK].Number != 0)
+					|| (pAd->TxSwQueue[QID_AC_BE].Number !=
+					    0)
+					|| (pAd->TxSwQueue[QID_AC_VI].Number !=
+					    0)
+					|| (pAd->TxSwQueue[QID_AC_VO].Number !=
+					    0)
+					||
+					(RTMPFreeTXDRequest
+					 (pAd, QID_AC_BK, TX_RING_SIZE - 1,
+					  &FreeNumber) != NDIS_STATUS_SUCCESS)
+					||
+					(RTMPFreeTXDRequest
+					 (pAd, QID_AC_BE, TX_RING_SIZE - 1,
+					  &FreeNumber) != NDIS_STATUS_SUCCESS)
+					||
+					(RTMPFreeTXDRequest
+					 (pAd, QID_AC_VI, TX_RING_SIZE - 1,
+					  &FreeNumber) != NDIS_STATUS_SUCCESS)
+					||
+					(RTMPFreeTXDRequest
+					 (pAd, QID_AC_VO, TX_RING_SIZE - 1,
+					  &FreeNumber) != NDIS_STATUS_SUCCESS)
+					||
+					(RTMPFreeTXDRequest
+					 (pAd, QID_MGMT, MGMT_RING_SIZE - 1,
+					  &FreeNumber) !=
+					 NDIS_STATUS_SUCCESS)) {
+					/* TODO: consider scheduled HCCA. might not be proper to use traditional DTIM-based power-saving scheme */
+					/* can we cheat here (i.e. just check MGMT & AC_BE) for better performance? */
+#ifdef RTMP_MAC_PCI
+					if (OPSTATUS_TEST_FLAG
+					    (pAd, fOP_STATUS_PCIE_DEVICE)) {
+						if (pAd->Antenna.field.RxPath >
+						    1)
+							RTMP_BBP_IO_WRITE8_BY_REG_ID
+							    (pAd, BBP_R3,
+							     pAd->StaCfg.BBPR3);
 					}
-#endif
-				}
-				else
-				{
-					USHORT NextDtim = DtimCount;
-
-					if (NextDtim == 0)
-						NextDtim = DtimPeriod;
-
-					TbttNumToNextWakeUp = pAd->StaCfg.DefaultListenCount;
-					if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_RECEIVE_DTIM) && (TbttNumToNextWakeUp > NextDtim))
-						TbttNumToNextWakeUp = NextDtim;
-
-					if (!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE))
-					{
-#ifdef RT2860
-						// Set a flag to go to sleep . Then after parse this RxDoneInterrupt, will go to sleep mode.
-						RTMP_SET_PSFLAG(pAd, fRTMP_PS_GO_TO_SLEEP_NOW);
-						pAd->ThisTbttNumToNextWakeUp = TbttNumToNextWakeUp;
-#endif
-#ifdef RT2870
-						AsicSleepThenAutoWakeup(pAd, TbttNumToNextWakeUp);
-#endif
+#endif /* RTMP_MAC_PCI // */
+				} else {
+					if ((pAd->CommonCfg.
+					     bACMAPSDTr[QID_AC_VO])
+					    || (pAd->CommonCfg.
+						bACMAPSDTr[QID_AC_VI])
+					    || (pAd->CommonCfg.
+						bACMAPSDTr[QID_AC_BK])
+					    || (pAd->CommonCfg.
+						bACMAPSDTr[QID_AC_BE])) {
+						/*
+						   WMM Spec v1.0 3.6.2.4,
+						   The WMM STA shall remain awake until it receives a
+						   QoS Data or Null frame addressed to it, with the
+						   EOSP subfield in QoS Control field set to 1.
+
+						   So we can not sleep here or we will suffer a case:
+
+						   PS Management Frame -->
+						   Trigger frame -->
+						   Beacon (TIM=0) (Beacon is closer to Trig frame) -->
+						   Station goes to sleep -->
+						   AP delivery queued UAPSD packets -->
+						   Station can NOT receive the reply
+
+						   Maybe we need a timeout timer to avoid that we do
+						   NOT receive the EOSP frame.
+
+						   We can not use More Data to check if SP is ended
+						   due to MaxSPLength.
+						 */
+					} else {
+						u16 NextDtim = DtimCount;
+
+						if (NextDtim == 0)
+							NextDtim = DtimPeriod;
+
+						TbttNumToNextWakeUp =
+						    pAd->StaCfg.
+						    DefaultListenCount;
+						if (OPSTATUS_TEST_FLAG
+						    (pAd,
+						     fOP_STATUS_RECEIVE_DTIM)
+						    && (TbttNumToNextWakeUp >
+							NextDtim))
+							TbttNumToNextWakeUp =
+							    NextDtim;
+
+						if (!OPSTATUS_TEST_FLAG
+						    (pAd, fOP_STATUS_DOZE)) {
+							/* Set a flag to go to sleep . Then after parse this RxDoneInterrupt, will go to sleep mode. */
+							pAd->
+							    ThisTbttNumToNextWakeUp
+							    =
+							    TbttNumToNextWakeUp;
+							AsicSleepThenAutoWakeup
+							    (pAd,
+							     pAd->
+							     ThisTbttNumToNextWakeUp);
+						}
 					}
 				}
 			}
 		}
-		// not my BSSID, ignore it
+		/* not my BSSID, ignore it */
 	}
-	// sanity check fail, ignore this frame
+	/* sanity check fail, ignore this frame */
 }
 
 /*
@@ -1612,116 +1703,126 @@ VOID PeerBeacon(
 		Receive PROBE REQ from remote peer when operating in IBSS mode
 	==========================================================================
  */
-VOID PeerProbeReqAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
+void PeerProbeReqAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-	UCHAR         Addr2[MAC_ADDR_LEN];
-	CHAR          Ssid[MAX_LEN_OF_SSID];
-	UCHAR         SsidLen;
-	UCHAR		  HtLen, AddHtLen, NewExtLen;
-	HEADER_802_11 ProbeRspHdr;
-	NDIS_STATUS   NStatus;
-	PUCHAR        pOutBuffer = NULL;
-	ULONG         FrameLen = 0;
+	u8 Addr2[MAC_ADDR_LEN];
+	char Ssid[MAX_LEN_OF_SSID];
+	u8 SsidLen;
+	u8 HtLen, AddHtLen, NewExtLen;
+	struct rt_header_802_11 ProbeRspHdr;
+	int NStatus;
+	u8 *pOutBuffer = NULL;
+	unsigned long FrameLen = 0;
 	LARGE_INTEGER FakeTimestamp;
-	UCHAR         DsLen = 1, IbssLen = 2;
-	UCHAR         LocalErpIe[3] = {IE_ERP, 1, 0};
-	BOOLEAN       Privacy;
-	USHORT        CapabilityInfo;
-	UCHAR		  RSNIe = IE_WPA;
+	u8 DsLen = 1, IbssLen = 2;
+	u8 LocalErpIe[3] = { IE_ERP, 1, 0 };
+	BOOLEAN Privacy;
+	u16 CapabilityInfo;
+	u8 RSNIe = IE_WPA;
 
-	if (! ADHOC_ON(pAd))
+	if (!ADHOC_ON(pAd))
 		return;
 
-	if (PeerProbeReqSanity(pAd, Elem->Msg, Elem->MsgLen, Addr2, Ssid, &SsidLen))
-	{
-		if ((SsidLen == 0) || SSID_EQUAL(Ssid, SsidLen, pAd->CommonCfg.Ssid, pAd->CommonCfg.SsidLen))
-		{
-			// allocate and send out ProbeRsp frame
-			NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);  //Get an unused nonpaged memory
+	if (PeerProbeReqSanity
+	    (pAd, Elem->Msg, Elem->MsgLen, Addr2, Ssid, &SsidLen)) {
+		if ((SsidLen == 0)
+		    || SSID_EQUAL(Ssid, SsidLen, pAd->CommonCfg.Ssid,
+				  pAd->CommonCfg.SsidLen)) {
+			/* allocate and send out ProbeRsp frame */
+			NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);	/*Get an unused nonpaged memory */
 			if (NStatus != NDIS_STATUS_SUCCESS)
 				return;
 
-			//pAd->StaCfg.AtimWin = 0;  // ??????
-
-			Privacy = (pAd->StaCfg.WepStatus == Ndis802_11Encryption1Enabled) ||
-					  (pAd->StaCfg.WepStatus == Ndis802_11Encryption2Enabled) ||
-					  (pAd->StaCfg.WepStatus == Ndis802_11Encryption3Enabled);
-			CapabilityInfo = CAP_GENERATE(0, 1, Privacy, (pAd->CommonCfg.TxPreamble == Rt802_11PreambleShort), 0, 0);
-
-			MakeOutgoingFrame(pOutBuffer,                   &FrameLen,
-							  sizeof(HEADER_802_11),        &ProbeRspHdr,
-							  TIMESTAMP_LEN,                &FakeTimestamp,
-							  2,                            &pAd->CommonCfg.BeaconPeriod,
-							  2,                            &CapabilityInfo,
-							  1,                            &SsidIe,
-							  1,                            &pAd->CommonCfg.SsidLen,
-							  pAd->CommonCfg.SsidLen,       pAd->CommonCfg.Ssid,
-							  1,                            &SupRateIe,
-							  1,                            &pAd->StaActive.SupRateLen,
-							  pAd->StaActive.SupRateLen,    pAd->StaActive.SupRate,
-							  1,                            &DsIe,
-							  1,                            &DsLen,
-							  1,                            &pAd->CommonCfg.Channel,
-							  1,                            &IbssIe,
-							  1,                            &IbssLen,
-							  2,                            &pAd->StaActive.AtimWin,
-							  END_OF_ARGS);
-
-			if (pAd->StaActive.ExtRateLen)
-			{
-				ULONG tmp;
-				MakeOutgoingFrame(pOutBuffer + FrameLen,        &tmp,
-								  3,                            LocalErpIe,
-								  1,                            &ExtRateIe,
-								  1,                            &pAd->StaActive.ExtRateLen,
-								  pAd->StaActive.ExtRateLen,    &pAd->StaActive.ExtRate,
-								  END_OF_ARGS);
+			/*pAd->StaCfg.AtimWin = 0;  // ?????? */
+
+			Privacy =
+			    (pAd->StaCfg.WepStatus ==
+			     Ndis802_11Encryption1Enabled)
+			    || (pAd->StaCfg.WepStatus ==
+				Ndis802_11Encryption2Enabled)
+			    || (pAd->StaCfg.WepStatus ==
+				Ndis802_11Encryption3Enabled);
+			CapabilityInfo =
+			    CAP_GENERATE(0, 1, Privacy,
+					 (pAd->CommonCfg.TxPreamble ==
+					  Rt802_11PreambleShort), 0, 0);
+
+			MakeOutgoingFrame(pOutBuffer, &FrameLen,
+					  sizeof(struct rt_header_802_11), &ProbeRspHdr,
+					  TIMESTAMP_LEN, &FakeTimestamp,
+					  2, &pAd->CommonCfg.BeaconPeriod,
+					  2, &CapabilityInfo,
+					  1, &SsidIe,
+					  1, &pAd->CommonCfg.SsidLen,
+					  pAd->CommonCfg.SsidLen,
+					  pAd->CommonCfg.Ssid, 1, &SupRateIe, 1,
+					  &pAd->StaActive.SupRateLen,
+					  pAd->StaActive.SupRateLen,
+					  pAd->StaActive.SupRate, 1, &DsIe, 1,
+					  &DsLen, 1, &pAd->CommonCfg.Channel, 1,
+					  &IbssIe, 1, &IbssLen, 2,
+					  &pAd->StaActive.AtimWin, END_OF_ARGS);
+
+			if (pAd->StaActive.ExtRateLen) {
+				unsigned long tmp;
+				MakeOutgoingFrame(pOutBuffer + FrameLen, &tmp,
+						  3, LocalErpIe,
+						  1, &ExtRateIe,
+						  1, &pAd->StaActive.ExtRateLen,
+						  pAd->StaActive.ExtRateLen,
+						  &pAd->StaActive.ExtRate,
+						  END_OF_ARGS);
 				FrameLen += tmp;
 			}
-
-			// If adhoc secruity is set for WPA-None, append the cipher suite IE
-			if (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPANone)
-			{
-				ULONG tmp;
-				MakeOutgoingFrame(pOutBuffer + FrameLen,        	&tmp,
-						  			1,                              &RSNIe,
-						  			1,                            	&pAd->StaCfg.RSNIE_Len,
-						  			pAd->StaCfg.RSNIE_Len,      	pAd->StaCfg.RSN_IE,
-						  			END_OF_ARGS);
+			/* If adhoc secruity is set for WPA-None, append the cipher suite IE */
+			if (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPANone) {
+				unsigned long tmp;
+				MakeOutgoingFrame(pOutBuffer + FrameLen, &tmp,
+						  1, &RSNIe,
+						  1, &pAd->StaCfg.RSNIE_Len,
+						  pAd->StaCfg.RSNIE_Len,
+						  pAd->StaCfg.RSN_IE,
+						  END_OF_ARGS);
 				FrameLen += tmp;
 			}
 
-			if (pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED)
-			{
-				ULONG TmpLen;
-				UCHAR	BROADCOM[4] = {0x0, 0x90, 0x4c, 0x33};
+			if (pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED) {
+				unsigned long TmpLen;
+				u8 BROADCOM[4] = { 0x0, 0x90, 0x4c, 0x33 };
 				HtLen = sizeof(pAd->CommonCfg.HtCapability);
 				AddHtLen = sizeof(pAd->CommonCfg.AddHTInfo);
 				NewExtLen = 1;
-				//New extension channel offset IE is included in Beacon, Probe Rsp or channel Switch Announcement Frame
-				if (pAd->bBroadComHT == TRUE)
-				{
-					MakeOutgoingFrame(pOutBuffer + FrameLen,            &TmpLen,
-								  1,                                &WpaIe,
-								  4,                                &BROADCOM[0],
-								 pAd->MlmeAux.HtCapabilityLen,          &pAd->MlmeAux.HtCapability,
-								  END_OF_ARGS);
-				}
-				else
-				{
-				MakeOutgoingFrame(pOutBuffer + FrameLen,            &TmpLen,
-								  1,                                &HtCapIe,
-								  1,                                &HtLen,
-								 sizeof(HT_CAPABILITY_IE),          &pAd->CommonCfg.HtCapability,
-								  1,                                &AddHtInfoIe,
-								  1,                                &AddHtLen,
-								 sizeof(ADD_HT_INFO_IE),          &pAd->CommonCfg.AddHTInfo,
-								  1,                                &NewExtChanIe,
-								  1,                                &NewExtLen,
-								 sizeof(NEW_EXT_CHAN_IE),          &pAd->CommonCfg.NewExtChanOffset,
-								  END_OF_ARGS);
+				/*New extension channel offset IE is included in Beacon, Probe Rsp or channel Switch Announcement Frame */
+				if (pAd->bBroadComHT == TRUE) {
+					MakeOutgoingFrame(pOutBuffer + FrameLen,
+							  &TmpLen, 1, &WpaIe, 4,
+							  &BROADCOM[0],
+							  pAd->MlmeAux.
+							  HtCapabilityLen,
+							  &pAd->MlmeAux.
+							  HtCapability,
+							  END_OF_ARGS);
+				} else {
+					MakeOutgoingFrame(pOutBuffer + FrameLen,
+							  &TmpLen, 1, &HtCapIe,
+							  1, &HtLen,
+							  sizeof
+							  (struct rt_ht_capability_ie),
+							  &pAd->CommonCfg.
+							  HtCapability, 1,
+							  &AddHtInfoIe, 1,
+							  &AddHtLen,
+							  sizeof
+							  (struct rt_add_ht_info_ie),
+							  &pAd->CommonCfg.
+							  AddHTInfo, 1,
+							  &NewExtChanIe, 1,
+							  &NewExtLen,
+							  sizeof
+							  (struct rt_new_ext_chan_ie),
+							  &pAd->CommonCfg.
+							  NewExtChanOffset,
+							  END_OF_ARGS);
 				}
 				FrameLen += TmpLen;
 			}
@@ -1732,11 +1833,9 @@ VOID PeerProbeReqAction(
 	}
 }
 
-VOID BeaconTimeoutAtJoinAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
+void BeaconTimeoutAtJoinAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-	USHORT Status;
+	u16 Status;
 	DBGPRINT(RT_DEBUG_TRACE, ("SYNC - BeaconTimeoutAtJoinAction\n"));
 	pAd->Mlme.SyncMachine.CurrState = SYNC_IDLE;
 	Status = MLME_REJ_TIMEOUT;
@@ -1749,20 +1848,18 @@ VOID BeaconTimeoutAtJoinAction(
 		Scan timeout procedure. basically add channel index by 1 and rescan
 	==========================================================================
  */
-VOID ScanTimeoutAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
+void ScanTimeoutAction(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
 	pAd->MlmeAux.Channel = NextChannel(pAd, pAd->MlmeAux.Channel);
 
-	// Only one channel scanned for CISCO beacon request
+	/* Only one channel scanned for CISCO beacon request */
 	if ((pAd->MlmeAux.ScanType == SCAN_CISCO_ACTIVE) ||
-		(pAd->MlmeAux.ScanType == SCAN_CISCO_PASSIVE) ||
-		(pAd->MlmeAux.ScanType == SCAN_CISCO_NOISE) ||
-		(pAd->MlmeAux.ScanType == SCAN_CISCO_CHANNEL_LOAD))
+	    (pAd->MlmeAux.ScanType == SCAN_CISCO_PASSIVE) ||
+	    (pAd->MlmeAux.ScanType == SCAN_CISCO_NOISE) ||
+	    (pAd->MlmeAux.ScanType == SCAN_CISCO_CHANNEL_LOAD))
 		pAd->MlmeAux.Channel = 0;
 
-	// this routine will stop if pAd->MlmeAux.Channel == 0
+	/* this routine will stop if pAd->MlmeAux.Channel == 0 */
 	ScanNextChannel(pAd);
 }
 
@@ -1771,12 +1868,12 @@ VOID ScanTimeoutAction(
 	Description:
 	==========================================================================
  */
-VOID InvalidStateWhenScan(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
+void InvalidStateWhenScan(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-	USHORT Status;
-	DBGPRINT(RT_DEBUG_TRACE, ("AYNC - InvalidStateWhenScan(state=%ld). Reset SYNC machine\n", pAd->Mlme.SyncMachine.CurrState));
+	u16 Status;
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("AYNC - InvalidStateWhenScan(state=%ld). Reset SYNC machine\n",
+		  pAd->Mlme.SyncMachine.CurrState));
 	pAd->Mlme.SyncMachine.CurrState = SYNC_IDLE;
 	Status = MLME_STATE_MACHINE_REJECT;
 	MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_SCAN_CONF, 2, &Status);
@@ -1787,12 +1884,12 @@ VOID InvalidStateWhenScan(
 	Description:
 	==========================================================================
  */
-VOID InvalidStateWhenJoin(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
+void InvalidStateWhenJoin(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-	USHORT Status;
-	DBGPRINT(RT_DEBUG_TRACE, ("InvalidStateWhenJoin(state=%ld). Reset SYNC machine\n", pAd->Mlme.SyncMachine.CurrState));
+	u16 Status;
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("InvalidStateWhenJoin(state=%ld). Reset SYNC machine\n",
+		  pAd->Mlme.SyncMachine.CurrState));
 	pAd->Mlme.SyncMachine.CurrState = SYNC_IDLE;
 	Status = MLME_STATE_MACHINE_REJECT;
 	MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_JOIN_CONF, 2, &Status);
@@ -1803,12 +1900,12 @@ VOID InvalidStateWhenJoin(
 	Description:
 	==========================================================================
  */
-VOID InvalidStateWhenStart(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
+void InvalidStateWhenStart(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-	USHORT Status;
-	DBGPRINT(RT_DEBUG_TRACE, ("InvalidStateWhenStart(state=%ld). Reset SYNC machine\n", pAd->Mlme.SyncMachine.CurrState));
+	u16 Status;
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("InvalidStateWhenStart(state=%ld). Reset SYNC machine\n",
+		  pAd->Mlme.SyncMachine.CurrState));
 	pAd->Mlme.SyncMachine.CurrState = SYNC_IDLE;
 	Status = MLME_STATE_MACHINE_REJECT;
 	MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_START_CONF, 2, &Status);
@@ -1822,54 +1919,51 @@ VOID InvalidStateWhenStart(
 
 	==========================================================================
  */
-VOID EnqueuePsPoll(
-	IN PRTMP_ADAPTER pAd)
+void EnqueuePsPoll(struct rt_rtmp_adapter *pAd)
 {
+
 	if (pAd->StaCfg.WindowsPowerMode == Ndis802_11PowerModeLegacy_PSP)
-    	pAd->PsPollFrame.FC.PwrMgmt = PWR_SAVE;
-	MiniportMMRequest(pAd, 0, (PUCHAR)&pAd->PsPollFrame, sizeof(PSPOLL_FRAME));
+		pAd->PsPollFrame.FC.PwrMgmt = PWR_SAVE;
+	MiniportMMRequest(pAd, 0, (u8 *)& pAd->PsPollFrame,
+			  sizeof(struct rt_pspoll_frame));
 }
 
-
 /*
 	==========================================================================
 	Description:
 	==========================================================================
  */
-VOID EnqueueProbeRequest(
-	IN PRTMP_ADAPTER pAd)
+void EnqueueProbeRequest(struct rt_rtmp_adapter *pAd)
 {
-	NDIS_STATUS     NState;
-	PUCHAR          pOutBuffer;
-	ULONG           FrameLen = 0;
-	HEADER_802_11   Hdr80211;
+	int NState;
+	u8 *pOutBuffer;
+	unsigned long FrameLen = 0;
+	struct rt_header_802_11 Hdr80211;
 
 	DBGPRINT(RT_DEBUG_TRACE, ("force out a ProbeRequest ...\n"));
 
-	NState = MlmeAllocateMemory(pAd, &pOutBuffer);  //Get an unused nonpaged memory
-	if (NState == NDIS_STATUS_SUCCESS)
-	{
-		MgtMacHeaderInit(pAd, &Hdr80211, SUBTYPE_PROBE_REQ, 0, BROADCAST_ADDR, BROADCAST_ADDR);
-
-		// this ProbeRequest explicitly specify SSID to reduce unwanted ProbeResponse
-		MakeOutgoingFrame(pOutBuffer,                     &FrameLen,
-						  sizeof(HEADER_802_11),          &Hdr80211,
-						  1,                              &SsidIe,
-						  1,                              &pAd->CommonCfg.SsidLen,
-						  pAd->CommonCfg.SsidLen,		  pAd->CommonCfg.Ssid,
-						  1,                              &SupRateIe,
-						  1,                              &pAd->StaActive.SupRateLen,
-						  pAd->StaActive.SupRateLen,      pAd->StaActive.SupRate,
-						  END_OF_ARGS);
+	NState = MlmeAllocateMemory(pAd, &pOutBuffer);	/*Get an unused nonpaged memory */
+	if (NState == NDIS_STATUS_SUCCESS) {
+		MgtMacHeaderInit(pAd, &Hdr80211, SUBTYPE_PROBE_REQ, 0,
+				 BROADCAST_ADDR, BROADCAST_ADDR);
+
+		/* this ProbeRequest explicitly specify SSID to reduce unwanted ProbeResponse */
+		MakeOutgoingFrame(pOutBuffer, &FrameLen,
+				  sizeof(struct rt_header_802_11), &Hdr80211,
+				  1, &SsidIe,
+				  1, &pAd->CommonCfg.SsidLen,
+				  pAd->CommonCfg.SsidLen, pAd->CommonCfg.Ssid,
+				  1, &SupRateIe,
+				  1, &pAd->StaActive.SupRateLen,
+				  pAd->StaActive.SupRateLen,
+				  pAd->StaActive.SupRate, END_OF_ARGS);
 		MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
 		MlmeFreeMemory(pAd, pOutBuffer);
 	}
 
 }
 
-BOOLEAN ScanRunning(
-		IN PRTMP_ADAPTER pAd)
+BOOLEAN ScanRunning(struct rt_rtmp_adapter *pAd)
 {
 	return (pAd->Mlme.SyncMachine.CurrState == SCAN_LISTEN) ? TRUE : FALSE;
 }
-
diff --git a/drivers/staging/rt2860/sta/wpa.c b/drivers/staging/rt2860/sta/wpa.c
index 8c34e39f3860..69b8a24daa21 100644
--- a/drivers/staging/rt2860/sta/wpa.c
+++ b/drivers/staging/rt2860/sta/wpa.c
@@ -37,1813 +37,7 @@
 */
 #include "../rt_config.h"
 
-#define		WPARSNIE	0xdd
-#define		WPA2RSNIE	0x30
-
-//extern UCHAR BIT8[];
-UCHAR	CipherWpaPskTkip[] = {
-		0xDD, 0x16,				// RSN IE
-		0x00, 0x50, 0xf2, 0x01,	// oui
-		0x01, 0x00,				// Version
-		0x00, 0x50, 0xf2, 0x02,	// Multicast
-		0x01, 0x00,				// Number of unicast
-		0x00, 0x50, 0xf2, 0x02,	// unicast
-		0x01, 0x00,				// number of authentication method
-		0x00, 0x50, 0xf2, 0x02	// authentication
-		};
-UCHAR	CipherWpaPskTkipLen = (sizeof(CipherWpaPskTkip) / sizeof(UCHAR));
-
-UCHAR	CipherWpaPskAes[] = {
-		0xDD, 0x16, 			// RSN IE
-		0x00, 0x50, 0xf2, 0x01,	// oui
-		0x01, 0x00,				// Version
-		0x00, 0x50, 0xf2, 0x04,	// Multicast
-		0x01, 0x00,				// Number of unicast
-		0x00, 0x50, 0xf2, 0x04,	// unicast
-		0x01, 0x00,				// number of authentication method
-		0x00, 0x50, 0xf2, 0x02	// authentication
-		};
-UCHAR	CipherWpaPskAesLen = (sizeof(CipherWpaPskAes) / sizeof(UCHAR));
-
-UCHAR	CipherSuiteCiscoCCKM[] = {
-		0xDD, 0x16,				// RSN IE
-		0x00, 0x50, 0xf2, 0x01, // oui
-		0x01, 0x00,				// Version
-		0x00, 0x40, 0x96, 0x01, // Multicast
-		0x01, 0x00,				// Number of uicast
-		0x00, 0x40, 0x96, 0x01, // unicast
-		0x01, 0x00,				// number of authentication method
-		0x00, 0x40, 0x96, 0x00  // Authentication
-		};
-UCHAR	CipherSuiteCiscoCCKMLen = (sizeof(CipherSuiteCiscoCCKM) / sizeof(UCHAR));
-
-UCHAR	CipherSuiteCiscoCCKM24[] = {
-		0xDD, 0x18,				// RSN IE
-		0x00, 0x50, 0xf2, 0x01, // oui
-		0x01, 0x00,				// Version
-		0x00, 0x40, 0x96, 0x01, // Multicast
-		0x01, 0x00,				// Number of uicast
-		0x00, 0x40, 0x96, 0x01, // unicast
-		0x01, 0x00,				// number of authentication method
-		0x00, 0x40, 0x96, 0x00,
-		0x28, 0x00// Authentication
-		};
-
-UCHAR	CipherSuiteCiscoCCKM24Len = (sizeof(CipherSuiteCiscoCCKM24) / sizeof(UCHAR));
-
-UCHAR	CipherSuiteCCXTkip[] = {
-		0xDD, 0x16,				// RSN IE
-		0x00, 0x50, 0xf2, 0x01,	// oui
-		0x01, 0x00,				// Version
-		0x00, 0x50, 0xf2, 0x02,	// Multicast
-		0x01, 0x00,				// Number of unicast
-		0x00, 0x50, 0xf2, 0x02,	// unicast
-		0x01, 0x00,				// number of authentication method
-		0x00, 0x50, 0xf2, 0x01	// authentication
-		};
-UCHAR	CipherSuiteCCXTkipLen = (sizeof(CipherSuiteCCXTkip) / sizeof(UCHAR));
-
-UCHAR	CCX_LLC_HDR[] = {0xAA, 0xAA, 0x03, 0x00, 0x40, 0x96, 0x00, 0x02};
-UCHAR	LLC_NORMAL[] = {0xAA, 0xAA, 0x03, 0x00, 0x00, 0x00};
-
-UCHAR	EAPOL_FRAME[] = {0x88, 0x8E};
-
-BOOLEAN CheckRSNIE(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PUCHAR          pData,
-	IN  UCHAR           DataLen,
-	OUT	UCHAR			*Offset);
-
-void inc_byte_array(UCHAR *counter, int len);
-
-/*
-	========================================================================
-
-	Routine Description:
-		Classify WPA EAP message type
-
-	Arguments:
-		EAPType		Value of EAP message type
-		MsgType		Internal Message definition for MLME state machine
-
-	Return Value:
-		TRUE		Found appropriate message type
-		FALSE		No appropriate message type
-
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-		All these constants are defined in wpa.h
-		For supplicant, there is only EAPOL Key message avaliable
-
-	========================================================================
-*/
-BOOLEAN	WpaMsgTypeSubst(
-	IN	UCHAR	EAPType,
-	OUT	INT		*MsgType)
-{
-	switch (EAPType)
-	{
-		case EAPPacket:
-			*MsgType = MT2_EAPPacket;
-			break;
-		case EAPOLStart:
-			*MsgType = MT2_EAPOLStart;
-			break;
-		case EAPOLLogoff:
-			*MsgType = MT2_EAPOLLogoff;
-			break;
-		case EAPOLKey:
-			*MsgType = MT2_EAPOLKey;
-			break;
-		case EAPOLASFAlert:
-			*MsgType = MT2_EAPOLASFAlert;
-			break;
-		default:
-			return FALSE;
-	}
-	return TRUE;
-}
-
-/*
-	==========================================================================
-	Description:
-		association	state machine init,	including state	transition and timer init
-	Parameters:
-		S -	pointer	to the association state machine
-	==========================================================================
- */
-VOID WpaPskStateMachineInit(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	STATE_MACHINE *S,
-	OUT	STATE_MACHINE_FUNC Trans[])
-{
-	StateMachineInit(S,	Trans, MAX_WPA_PSK_STATE, MAX_WPA_PSK_MSG, (STATE_MACHINE_FUNC)Drop, WPA_PSK_IDLE, WPA_MACHINE_BASE);
-	StateMachineSetAction(S, WPA_PSK_IDLE, MT2_EAPOLKey, (STATE_MACHINE_FUNC)WpaEAPOLKeyAction);
-}
-
-/*
-	==========================================================================
-	Description:
-		This is	state machine function.
-		When receiving EAPOL packets which is  for 802.1x key management.
-		Use	both in	WPA, and WPAPSK	case.
-		In this	function, further dispatch to different	functions according	to the received	packet.	 3 categories are :
-		  1.  normal 4-way pairwisekey and 2-way groupkey handshake
-		  2.  MIC error	(Countermeasures attack)  report packet	from STA.
-		  3.  Request for pairwise/group key update	from STA
-	Return:
-	==========================================================================
-*/
-VOID WpaEAPOLKeyAction(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	MLME_QUEUE_ELEM	*Elem)
-
-{
-	INT             MsgType = EAPOL_MSG_INVALID;
-	PKEY_DESCRIPTER pKeyDesc;
-	PHEADER_802_11  pHeader; //red
-	UCHAR           ZeroReplay[LEN_KEY_DESC_REPLAY];
-	UCHAR EapolVr;
-	KEY_INFO		peerKeyInfo;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("-----> WpaEAPOLKeyAction\n"));
-
-	// Get 802.11 header first
-	pHeader = (PHEADER_802_11) Elem->Msg;
-
-	// Get EAPoL-Key Descriptor
-	pKeyDesc = (PKEY_DESCRIPTER) &Elem->Msg[(LENGTH_802_11 + LENGTH_802_1_H + LENGTH_EAPOL_H)];
-
-	NdisZeroMemory((PUCHAR)&peerKeyInfo, sizeof(peerKeyInfo));
-	NdisMoveMemory((PUCHAR)&peerKeyInfo, (PUCHAR)&pKeyDesc->KeyInfo, sizeof(KEY_INFO));
-
-	*((USHORT *)&peerKeyInfo) = cpu2le16(*((USHORT *)&peerKeyInfo));
-
-
-	// 1. Check EAPOL frame version and type
-	EapolVr	= (UCHAR) Elem->Msg[LENGTH_802_11+LENGTH_802_1_H];
-
-    if (((EapolVr != EAPOL_VER) && (EapolVr != EAPOL_VER2)) || ((pKeyDesc->Type != WPA1_KEY_DESC) && (pKeyDesc->Type != WPA2_KEY_DESC)))
-	{
-        DBGPRINT(RT_DEBUG_ERROR, ("Key descripter does not match with WPA rule\n"));
-			return;
-	}
-
-	// First validate replay counter, only accept message with larger replay counter
-	// Let equal pass, some AP start with all zero replay counter
-	NdisZeroMemory(ZeroReplay, LEN_KEY_DESC_REPLAY);
-
-	if((RTMPCompareMemory(pKeyDesc->ReplayCounter, pAd->StaCfg.ReplayCounter, LEN_KEY_DESC_REPLAY) != 1) &&
-		(RTMPCompareMemory(pKeyDesc->ReplayCounter, ZeroReplay, LEN_KEY_DESC_REPLAY) != 0))
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("   ReplayCounter not match   \n"));
-		return;
-	}
-
-	// Process WPA2PSK frame
-	if(pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK)
-	{
-		if((peerKeyInfo.KeyType == PAIRWISEKEY) &&
-			(peerKeyInfo.EKD_DL == 0) &&
-			(peerKeyInfo.KeyAck == 1) &&
-			(peerKeyInfo.KeyMic == 0) &&
-			(peerKeyInfo.Secure == 0) &&
-			(peerKeyInfo.Error == 0) &&
-			(peerKeyInfo.Request == 0))
-		{
-			MsgType = EAPOL_PAIR_MSG_1;
-			DBGPRINT(RT_DEBUG_TRACE, ("Receive EAPOL Key Pairwise Message 1\n"));
-		} else if((peerKeyInfo.KeyType == PAIRWISEKEY) &&
-			(peerKeyInfo.EKD_DL  == 1) &&
-			(peerKeyInfo.KeyAck == 1) &&
-			(peerKeyInfo.KeyMic == 1) &&
-			(peerKeyInfo.Secure == 1) &&
-			(peerKeyInfo.Error == 0) &&
-			(peerKeyInfo.Request == 0))
-		{
-			MsgType = EAPOL_PAIR_MSG_3;
-			DBGPRINT(RT_DEBUG_TRACE, ("Receive EAPOL Key Pairwise Message 3\n"));
-		} else if((peerKeyInfo.KeyType == GROUPKEY) &&
-			(peerKeyInfo.EKD_DL == 1) &&
-			(peerKeyInfo.KeyAck == 1) &&
-			(peerKeyInfo.KeyMic == 1) &&
-			(peerKeyInfo.Secure == 1) &&
-			(peerKeyInfo.Error == 0) &&
-			(peerKeyInfo.Request == 0))
-		{
-			MsgType = EAPOL_GROUP_MSG_1;
-			DBGPRINT(RT_DEBUG_TRACE, ("Receive EAPOL Key Group Message 1\n"));
-		}
-
-		// We will assume link is up (assoc suceess and port not secured).
-		// All state has to be able to process message from previous state
-		switch(pAd->StaCfg.WpaState)
-		{
-		case SS_START:
-			if(MsgType == EAPOL_PAIR_MSG_1)
-			{
-				Wpa2PairMsg1Action(pAd, Elem);
-				pAd->StaCfg.WpaState = SS_WAIT_MSG_3;
-			}
-			break;
-
-		case SS_WAIT_MSG_3:
-			if(MsgType == EAPOL_PAIR_MSG_1)
-			{
-				Wpa2PairMsg1Action(pAd, Elem);
-				pAd->StaCfg.WpaState = SS_WAIT_MSG_3;
-			}
-			else if(MsgType == EAPOL_PAIR_MSG_3)
-			{
-				Wpa2PairMsg3Action(pAd, Elem);
-				pAd->StaCfg.WpaState = SS_WAIT_GROUP;
-			}
-			break;
-
-		case SS_WAIT_GROUP:		// When doing group key exchange
-		case SS_FINISH:			// This happened when update group key
-			if(MsgType == EAPOL_PAIR_MSG_1)
-			{
-			    // Reset port secured variable
-				pAd->StaCfg.PortSecured = WPA_802_1X_PORT_NOT_SECURED;
-				Wpa2PairMsg1Action(pAd, Elem);
-				pAd->StaCfg.WpaState = SS_WAIT_MSG_3;
-			}
-			else if(MsgType == EAPOL_PAIR_MSG_3)
-			{
-			    // Reset port secured variable
-				pAd->StaCfg.PortSecured = WPA_802_1X_PORT_NOT_SECURED;
-				Wpa2PairMsg3Action(pAd, Elem);
-				pAd->StaCfg.WpaState = SS_WAIT_GROUP;
-			}
-			else if(MsgType == EAPOL_GROUP_MSG_1)
-			{
-				WpaGroupMsg1Action(pAd, Elem);
-				pAd->StaCfg.WpaState = SS_FINISH;
-			}
-			break;
-
-		default:
-			break;
-		}
-	}
-	// Process WPAPSK Frame
-	// Classify message Type, either pairwise message 1, 3, or group message 1 for supplicant
-	else if(pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPAPSK)
-	{
-		if((peerKeyInfo.KeyType == PAIRWISEKEY) &&
-			(peerKeyInfo.KeyIndex == 0) &&
-			(peerKeyInfo.KeyAck == 1) &&
-			(peerKeyInfo.KeyMic == 0) &&
-			(peerKeyInfo.Secure == 0) &&
-			(peerKeyInfo.Error == 0) &&
-			(peerKeyInfo.Request == 0))
-		{
-			MsgType = EAPOL_PAIR_MSG_1;
-			DBGPRINT(RT_DEBUG_TRACE, ("Receive EAPOL Key Pairwise Message 1\n"));
-		}
-		else if((peerKeyInfo.KeyType == PAIRWISEKEY) &&
-			(peerKeyInfo.KeyIndex == 0) &&
-			(peerKeyInfo.KeyAck == 1) &&
-			(peerKeyInfo.KeyMic == 1) &&
-			(peerKeyInfo.Secure == 0) &&
-			(peerKeyInfo.Error == 0) &&
-			(peerKeyInfo.Request == 0))
-		{
-			MsgType = EAPOL_PAIR_MSG_3;
-			DBGPRINT(RT_DEBUG_TRACE, ("Receive EAPOL Key Pairwise Message 3\n"));
-		}
-		else if((peerKeyInfo.KeyType == GROUPKEY) &&
-			(peerKeyInfo.KeyIndex != 0) &&
-			(peerKeyInfo.KeyAck == 1) &&
-			(peerKeyInfo.KeyMic == 1) &&
-			(peerKeyInfo.Secure == 1) &&
-			(peerKeyInfo.Error == 0) &&
-			(peerKeyInfo.Request == 0))
-		{
-			MsgType = EAPOL_GROUP_MSG_1;
-			DBGPRINT(RT_DEBUG_TRACE, ("Receive EAPOL Key Group Message 1\n"));
-		}
-
-		// We will assume link is up (assoc suceess and port not secured).
-		// All state has to be able to process message from previous state
-		switch(pAd->StaCfg.WpaState)
-		{
-		case SS_START:
-			if(MsgType == EAPOL_PAIR_MSG_1)
-			{
-				WpaPairMsg1Action(pAd, Elem);
-				pAd->StaCfg.WpaState = SS_WAIT_MSG_3;
-			}
-			break;
-
-		case SS_WAIT_MSG_3:
-			if(MsgType == EAPOL_PAIR_MSG_1)
-			{
-				WpaPairMsg1Action(pAd, Elem);
-				pAd->StaCfg.WpaState = SS_WAIT_MSG_3;
-			}
-			else if(MsgType == EAPOL_PAIR_MSG_3)
-			{
-				WpaPairMsg3Action(pAd, Elem);
-				pAd->StaCfg.WpaState = SS_WAIT_GROUP;
-			}
-			break;
-
-		case SS_WAIT_GROUP:		// When doing group key exchange
-		case SS_FINISH:			// This happened when update group key
-			if(MsgType == EAPOL_PAIR_MSG_1)
-			{
-				WpaPairMsg1Action(pAd, Elem);
-				pAd->StaCfg.WpaState = SS_WAIT_MSG_3;
-				// Reset port secured variable
-				pAd->StaCfg.PortSecured = WPA_802_1X_PORT_NOT_SECURED;
-			}
-			else if(MsgType == EAPOL_PAIR_MSG_3)
-			{
-				WpaPairMsg3Action(pAd, Elem);
-				pAd->StaCfg.WpaState = SS_WAIT_GROUP;
-				// Reset port secured variable
-				pAd->StaCfg.PortSecured = WPA_802_1X_PORT_NOT_SECURED;
-			}
-			else if(MsgType == EAPOL_GROUP_MSG_1)
-			{
-				WpaGroupMsg1Action(pAd, Elem);
-				pAd->StaCfg.WpaState = SS_FINISH;
-			}
-			break;
-
-		default:
-			break;
-		}
-	}
-
-	DBGPRINT(RT_DEBUG_TRACE, ("<----- WpaEAPOLKeyAction\n"));
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-		Process Pairwise key 4-way handshaking
-
-	Arguments:
-		pAd	Pointer	to our adapter
-		Elem		Message body
-
-	Return Value:
-		None
-
-	Note:
-
-	========================================================================
-*/
-VOID	WpaPairMsg1Action(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem)
-{
-	PHEADER_802_11      pHeader;
-	UCHAR				*mpool, *PTK, *digest;
-	PUCHAR              pOutBuffer = NULL;
-	UCHAR               Header802_3[14];
-	ULONG               FrameLen = 0;
-	PEAPOL_PACKET       pMsg1;
-	EAPOL_PACKET        Packet;
-	UCHAR               Mic[16];
-
-	DBGPRINT(RT_DEBUG_TRACE, ("WpaPairMsg1Action ----->\n"));
-
-	// allocate memory pool
-	os_alloc_mem(pAd, (PUCHAR *)&mpool, 256);
-
-	if (mpool == NULL)
-		return;
-
-	// PTK Len = 80.
-	PTK = (UCHAR *) ROUND_UP(mpool, 4);
-	// digest Len = 80.
-	digest = (UCHAR *) ROUND_UP(PTK + 80, 4);
-
-	pHeader = (PHEADER_802_11) Elem->Msg;
-
-	// Process message 1 from authenticator
-	pMsg1 = (PEAPOL_PACKET) &Elem->Msg[LENGTH_802_11 + LENGTH_802_1_H];
-
-	// 1. Save Replay counter, it will use to verify message 3 and construct message 2
-	NdisMoveMemory(pAd->StaCfg.ReplayCounter, pMsg1->KeyDesc.ReplayCounter, LEN_KEY_DESC_REPLAY);
-
-	// 2. Save ANonce
-	NdisMoveMemory(pAd->StaCfg.ANonce, pMsg1->KeyDesc.KeyNonce, LEN_KEY_DESC_NONCE);
-
-	// Generate random SNonce
-	GenRandom(pAd, pAd->CurrentAddress, pAd->StaCfg.SNonce);
-
-	// Calc PTK(ANonce, SNonce)
-	WpaCountPTK(pAd,
-		pAd->StaCfg.PMK,
-		pAd->StaCfg.ANonce,
-		pAd->CommonCfg.Bssid,
-		pAd->StaCfg.SNonce,
-		pAd->CurrentAddress,
-		PTK,
-		LEN_PTK);
-
-	// Save key to PTK entry
-	NdisMoveMemory(pAd->StaCfg.PTK, PTK, LEN_PTK);
-
-	// init 802.3 header and Fill Packet
-	MAKE_802_3_HEADER(Header802_3, pAd->CommonCfg.Bssid, pAd->CurrentAddress, EAPOL);
-
-	// Zero Message 2 body
-	NdisZeroMemory(&Packet, sizeof(Packet));
-	Packet.ProVer	= EAPOL_VER;
-	Packet.ProType	= EAPOLKey;
-	//
-	// Message 2 as  EAPOL-Key(0,1,0,0,0,P,0,SNonce,MIC,RSN IE)
-	//
-	Packet.KeyDesc.Type = WPA1_KEY_DESC;
-	// 1. Key descriptor version and appropriate RSN IE
-	if(pAd->StaCfg.WepStatus  == Ndis802_11Encryption3Enabled)
-	{
-		Packet.KeyDesc.KeyInfo.KeyDescVer = 2;
-	}
-	else	  // TKIP
-	{
-		Packet.KeyDesc.KeyInfo.KeyDescVer = 1;
-	}
-
-	// fill in Data Material and its length
-	Packet.KeyDesc.KeyData[0] = IE_WPA;
-	Packet.KeyDesc.KeyData[1] = pAd->StaCfg.RSNIE_Len;
-	Packet.KeyDesc.KeyDataLen[1] = pAd->StaCfg.RSNIE_Len + 2;
-	NdisMoveMemory(&Packet.KeyDesc.KeyData[2], pAd->StaCfg.RSN_IE, pAd->StaCfg.RSNIE_Len);
-
-	// Update packet length after decide Key data payload
-	Packet.Body_Len[1]  = sizeof(KEY_DESCRIPTER) - MAX_LEN_OF_RSNIE + Packet.KeyDesc.KeyDataLen[1];
-
-	// Update Key length
-	Packet.KeyDesc.KeyLength[0] = pMsg1->KeyDesc.KeyLength[0];
-	Packet.KeyDesc.KeyLength[1] = pMsg1->KeyDesc.KeyLength[1];
-	// 2. Key Type PeerKey
-	Packet.KeyDesc.KeyInfo.KeyType = PAIRWISEKEY;
-
-	// 3. KeyMic field presented
-	Packet.KeyDesc.KeyInfo.KeyMic  = 1;
-
-	//Convert to little-endian format.
-	*((USHORT *)&Packet.KeyDesc.KeyInfo) = cpu2le16(*((USHORT *)&Packet.KeyDesc.KeyInfo));
-
-
-	// 4. Fill SNonce
-	NdisMoveMemory(Packet.KeyDesc.KeyNonce, pAd->StaCfg.SNonce, LEN_KEY_DESC_NONCE);
-
-	// 5. Key Replay Count
-	NdisMoveMemory(Packet.KeyDesc.ReplayCounter, pAd->StaCfg.ReplayCounter, LEN_KEY_DESC_REPLAY);
-
-	// Send EAPOL(0, 1, 0, 0, 0, P, 0, SNonce, MIC, RSN_IE)
-	// Out buffer for transmitting message 2
-	MlmeAllocateMemory(pAd, (PUCHAR *)&pOutBuffer);  // allocate memory
-	if(pOutBuffer == NULL)
-	{
-		os_free_mem(pAd, mpool);
-		return;
-	}
-	// Prepare EAPOL frame for MIC calculation
-	// Be careful, only EAPOL frame is counted for MIC calculation
-	MakeOutgoingFrame(pOutBuffer,           &FrameLen,
-		Packet.Body_Len[1] + 4,    &Packet,
-		END_OF_ARGS);
-
-	// 6. Prepare and Fill MIC value
-	NdisZeroMemory(Mic, sizeof(Mic));
-	if(pAd->StaCfg.WepStatus  == Ndis802_11Encryption3Enabled)
-	{	// AES
-
-		HMAC_SHA1(pOutBuffer, FrameLen, PTK, LEN_EAP_MICK, digest);
-		NdisMoveMemory(Mic, digest, LEN_KEY_DESC_MIC);
-	}
-	else
-	{	// TKIP
-		hmac_md5(PTK,  LEN_EAP_MICK, pOutBuffer, FrameLen, Mic);
-	}
-	NdisMoveMemory(Packet.KeyDesc.KeyMic, Mic, LEN_KEY_DESC_MIC);
-
-	//hex_dump("MIC", Mic, LEN_KEY_DESC_MIC);
-
-		MakeOutgoingFrame(pOutBuffer,           	&FrameLen,
-			  			LENGTH_802_3,     			&Header802_3,
-						Packet.Body_Len[1] + 4,    &Packet,
-						END_OF_ARGS);
-
-
-	// 5. Copy frame to Tx ring and send Msg 2 to authenticator
-	RTMPToWirelessSta(pAd, Header802_3, LENGTH_802_3, (PUCHAR)&Packet, Packet.Body_Len[1] + 4, TRUE);
-
-	MlmeFreeMemory(pAd, (PUCHAR)pOutBuffer);
-	os_free_mem(pAd, (PUCHAR)mpool);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("WpaPairMsg1Action <-----\n"));
-}
-
-VOID Wpa2PairMsg1Action(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem)
-{
-	PHEADER_802_11      pHeader;
-	UCHAR				*mpool, *PTK, *digest;
-	PUCHAR              pOutBuffer = NULL;
-	UCHAR               Header802_3[14];
-	ULONG               FrameLen = 0;
-	PEAPOL_PACKET       pMsg1;
-	EAPOL_PACKET        Packet;
-	UCHAR               Mic[16];
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Wpa2PairMsg1Action ----->\n"));
-
-	// allocate memory pool
-	os_alloc_mem(pAd, (PUCHAR *)&mpool, 256);
-
-	if (mpool == NULL)
-		return;
-
-	// PTK Len = 80.
-	PTK = (UCHAR *) ROUND_UP(mpool, 4);
-	// digest Len = 80.
-	digest = (UCHAR *) ROUND_UP(PTK + 80, 4);
-
-	pHeader = (PHEADER_802_11) Elem->Msg;
-
-	// Process message 1 from authenticator
-		pMsg1 = (PEAPOL_PACKET)	&Elem->Msg[LENGTH_802_11 + LENGTH_802_1_H];
-
-	// 1. Save Replay counter, it will use to verify message 3 and construct message 2
-	NdisMoveMemory(pAd->StaCfg.ReplayCounter, pMsg1->KeyDesc.ReplayCounter, LEN_KEY_DESC_REPLAY);
-
-	// 2. Save ANonce
-	NdisMoveMemory(pAd->StaCfg.ANonce, pMsg1->KeyDesc.KeyNonce, LEN_KEY_DESC_NONCE);
-
-	// Generate random SNonce
-	GenRandom(pAd, pAd->CurrentAddress, pAd->StaCfg.SNonce);
-
-	if(pMsg1->KeyDesc.KeyDataLen[1] > 0 )
-	{
-		// cached PMKID
-	}
-
-	// Calc PTK(ANonce, SNonce)
-	WpaCountPTK(pAd,
-		pAd->StaCfg.PMK,
-		pAd->StaCfg.ANonce,
-		pAd->CommonCfg.Bssid,
-		pAd->StaCfg.SNonce,
-		pAd->CurrentAddress,
-		PTK,
-		LEN_PTK);
-
-	// Save key to PTK entry
-	NdisMoveMemory(pAd->StaCfg.PTK, PTK, LEN_PTK);
-
-	// init 802.3 header and Fill Packet
-	MAKE_802_3_HEADER(Header802_3, pAd->CommonCfg.Bssid, pAd->CurrentAddress, EAPOL);
-
-	// Zero message 2 body
-	NdisZeroMemory(&Packet, sizeof(Packet));
-	Packet.ProVer	= EAPOL_VER;
-	Packet.ProType	= EAPOLKey;
-	//
-	// Message 2 as  EAPOL-Key(0,1,0,0,0,P,0,SNonce,MIC,RSN IE)
-	//
-	Packet.KeyDesc.Type = WPA2_KEY_DESC;
-
-	// 1. Key descriptor version and appropriate RSN IE
-	if(pAd->StaCfg.WepStatus == Ndis802_11Encryption3Enabled)
-	{
-		Packet.KeyDesc.KeyInfo.KeyDescVer = 2;
-	}
-	else	  // TKIP
-	{
-		Packet.KeyDesc.KeyInfo.KeyDescVer = 1;
-	}
-
-	// fill in Data Material and its length
-	Packet.KeyDesc.KeyData[0] = IE_WPA2;
-	Packet.KeyDesc.KeyData[1] = pAd->StaCfg.RSNIE_Len;
-	Packet.KeyDesc.KeyDataLen[1] = pAd->StaCfg.RSNIE_Len + 2;
-	NdisMoveMemory(&Packet.KeyDesc.KeyData[2], pAd->StaCfg.RSN_IE, pAd->StaCfg.RSNIE_Len);
-
-	// Update packet length after decide Key data payload
-	Packet.Body_Len[1]  = sizeof(KEY_DESCRIPTER) - MAX_LEN_OF_RSNIE + Packet.KeyDesc.KeyDataLen[1];
-
-	// 2. Key Type PeerKey
-	Packet.KeyDesc.KeyInfo.KeyType = PAIRWISEKEY;
-
-	// 3. KeyMic field presented
-	Packet.KeyDesc.KeyInfo.KeyMic  = 1;
-
-	// Update Key Length
-	Packet.KeyDesc.KeyLength[0] = 0;
-	Packet.KeyDesc.KeyLength[1] = pMsg1->KeyDesc.KeyLength[1];
-
-	// 4. Fill SNonce
-	NdisMoveMemory(Packet.KeyDesc.KeyNonce, pAd->StaCfg.SNonce, LEN_KEY_DESC_NONCE);
-
-	// 5. Key Replay Count
-	NdisMoveMemory(Packet.KeyDesc.ReplayCounter, pAd->StaCfg.ReplayCounter, LEN_KEY_DESC_REPLAY);
-
-	// Convert to little-endian format.
-	*((USHORT *)&Packet.KeyDesc.KeyInfo) = cpu2le16(*((USHORT *)&Packet.KeyDesc.KeyInfo));
-
-	// Send EAPOL-Key(0,1,0,0,0,P,0,SNonce,MIC,RSN IE)
-	// Out buffer for transmitting message 2
-	MlmeAllocateMemory(pAd,  (PUCHAR *)&pOutBuffer);  // allocate memory
-	if(pOutBuffer == NULL)
-	{
-		os_free_mem(pAd, mpool);
-		return;
-	}
-
-	// Prepare EAPOL frame for MIC calculation
-	// Be careful, only EAPOL frame is counted for MIC calculation
-	MakeOutgoingFrame(pOutBuffer,        &FrameLen,
-		Packet.Body_Len[1] + 4, &Packet,
-		END_OF_ARGS);
-
-	// 6. Prepare and Fill MIC value
-	NdisZeroMemory(Mic, sizeof(Mic));
-	if(pAd->StaCfg.WepStatus == Ndis802_11Encryption3Enabled)
-	{
-		// AES
-		HMAC_SHA1(pOutBuffer, FrameLen, PTK, LEN_EAP_MICK, digest);
-		NdisMoveMemory(Mic, digest, LEN_KEY_DESC_MIC);
-	}
-	else
-	{
-		hmac_md5(PTK,  LEN_EAP_MICK, pOutBuffer, FrameLen, Mic);
-	}
-	NdisMoveMemory(Packet.KeyDesc.KeyMic, Mic, LEN_KEY_DESC_MIC);
-
-
-	// Make  Transmitting frame
-	MakeOutgoingFrame(pOutBuffer,           	&FrameLen,
-			  			LENGTH_802_3,     		&Header802_3,
-						Packet.Body_Len[1] + 4, &Packet,
-						END_OF_ARGS);
-
-
-	// 5. Copy frame to Tx ring
-	RTMPToWirelessSta(pAd, Header802_3, LENGTH_802_3, (PUCHAR)&Packet, Packet.Body_Len[1] + 4, TRUE);
-
-	MlmeFreeMemory(pAd, pOutBuffer);
-	os_free_mem(pAd, mpool);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Wpa2PairMsg1Action <-----\n"));
-
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-		Process Pairwise key 4-way handshaking
-
-	Arguments:
-		pAd	Pointer	to our adapter
-		Elem		Message body
-
-	Return Value:
-		None
-
-	Note:
-
-	========================================================================
-*/
-VOID	WpaPairMsg3Action(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	MLME_QUEUE_ELEM	*Elem)
-
-{
-	PHEADER_802_11      pHeader;
-	PUCHAR          	pOutBuffer = NULL;
-	UCHAR               Header802_3[14];
-	ULONG           	FrameLen = 0;
-	EAPOL_PACKET        Packet;
-	PEAPOL_PACKET       pMsg3;
-	UCHAR           	Mic[16], OldMic[16];
-	MAC_TABLE_ENTRY 	*pEntry = NULL;
-	UCHAR				skip_offset;
-	KEY_INFO			peerKeyInfo;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("WpaPairMsg3Action ----->\n"));
-
-	// Record 802.11 header & the received EAPOL packet Msg3
-	pHeader = (PHEADER_802_11) Elem->Msg;
-	pMsg3 = (PEAPOL_PACKET)	&Elem->Msg[LENGTH_802_11 + LENGTH_802_1_H];
-
-	NdisZeroMemory((PUCHAR)&peerKeyInfo, sizeof(peerKeyInfo));
-	NdisMoveMemory((PUCHAR)&peerKeyInfo, (PUCHAR)&pMsg3->KeyDesc.KeyInfo, sizeof(KEY_INFO));
-
-	*((USHORT*)&peerKeyInfo) = cpu2le16(*((USHORT*)&peerKeyInfo));
-
-
-	// 1. Verify cipher type match
-	if (pAd->StaCfg.WepStatus  == Ndis802_11Encryption3Enabled && (peerKeyInfo.KeyDescVer != 2))
-	{
-		return;
-	}
-	else if(pAd->StaCfg.WepStatus == Ndis802_11Encryption2Enabled && (peerKeyInfo.KeyDescVer != 1))
-	{
-		return;
-	}
-
-	// Verify RSN IE
-	//if (!RTMPEqualMemory(pMsg3->KeyDesc.KeyData, pAd->MacTab.Content[BSSID_WCID].RSN_IE, pAd->MacTab.Content[BSSID_WCID].RSNIE_Len))
-	if (!CheckRSNIE(pAd, pMsg3->KeyDesc.KeyData, pMsg3->KeyDesc.KeyDataLen[1], &skip_offset))
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("RSN_IE Different in Msg 3 of WPA1 4-way handshake!! \n"));
-		hex_dump("The original RSN_IE", pAd->MacTab.Content[BSSID_WCID].RSN_IE, pAd->MacTab.Content[BSSID_WCID].RSNIE_Len);
-		hex_dump("The received RSN_IE", pMsg3->KeyDesc.KeyData, pMsg3->KeyDesc.KeyDataLen[1]);
-		return;
-	}
-	else
-		DBGPRINT(RT_DEBUG_TRACE, ("RSN_IE VALID in Msg 3 of WPA1 4-way handshake!! \n"));
-
-
-	// 2. Check MIC value
-	// Save the MIC and replace with zero
-	NdisMoveMemory(OldMic, pMsg3->KeyDesc.KeyMic, LEN_KEY_DESC_MIC);
-	NdisZeroMemory(pMsg3->KeyDesc.KeyMic, LEN_KEY_DESC_MIC);
-	if(pAd->StaCfg.WepStatus  == Ndis802_11Encryption3Enabled)
-	{
-		// AES
-		UCHAR digest[80];
-
-		HMAC_SHA1((PUCHAR) pMsg3, pMsg3->Body_Len[1] + 4, pAd->StaCfg.PTK, LEN_EAP_MICK, digest);
-		NdisMoveMemory(Mic, digest, LEN_KEY_DESC_MIC);
-	}
-	else	// TKIP
-	{
-		hmac_md5(pAd->StaCfg.PTK, LEN_EAP_MICK, (PUCHAR) pMsg3, pMsg3->Body_Len[1] + 4, Mic);
-	}
-
-	if(!NdisEqualMemory(OldMic, Mic, LEN_KEY_DESC_MIC))
-	{
-		DBGPRINT(RT_DEBUG_ERROR, (" MIC Different in msg 3 of 4-way handshake!!!!!!!!!! \n"));
-		return;
-	}
-	else
-		DBGPRINT(RT_DEBUG_TRACE, (" MIC VALID in msg 3 of 4-way handshake!!!!!!!!!! \n"));
-
-	// 3. Check Replay Counter, it has to be larger than last one. No need to be exact one larger
-	if(RTMPCompareMemory(pMsg3->KeyDesc.ReplayCounter, pAd->StaCfg.ReplayCounter, LEN_KEY_DESC_REPLAY) != 1)
-		return;
-
-	// Update new replay counter
-	NdisMoveMemory(pAd->StaCfg.ReplayCounter, pMsg3->KeyDesc.ReplayCounter, LEN_KEY_DESC_REPLAY);
-
-	// 4. Double check ANonce
-	if(!NdisEqualMemory(pAd->StaCfg.ANonce, pMsg3->KeyDesc.KeyNonce, LEN_KEY_DESC_NONCE))
-		return;
-
-	// init 802.3 header and Fill Packet
-	MAKE_802_3_HEADER(Header802_3, pAd->CommonCfg.Bssid, pAd->CurrentAddress, EAPOL);
-
-	// Zero Message 4 body
-	NdisZeroMemory(&Packet, sizeof(Packet));
-	Packet.ProVer	= EAPOL_VER;
-	Packet.ProType	= EAPOLKey;
-	Packet.Body_Len[1]  = sizeof(KEY_DESCRIPTER) - MAX_LEN_OF_RSNIE;		// No data field
-
-	//
-	// Message 4 as  EAPOL-Key(0,1,0,0,0,P,0,0,MIC,0)
-	//
-	Packet.KeyDesc.Type = WPA1_KEY_DESC;
-
-	// Key descriptor version and appropriate RSN IE
-	Packet.KeyDesc.KeyInfo.KeyDescVer = peerKeyInfo.KeyDescVer;
-
-	// Update Key Length
-	Packet.KeyDesc.KeyLength[0] = pMsg3->KeyDesc.KeyLength[0];
-	Packet.KeyDesc.KeyLength[1] = pMsg3->KeyDesc.KeyLength[1];
-
-	// Key Type PeerKey
-	Packet.KeyDesc.KeyInfo.KeyType = PAIRWISEKEY;
-
-	// KeyMic field presented
-	Packet.KeyDesc.KeyInfo.KeyMic  = 1;
-
-	// In Msg3,  KeyInfo.secure =0 if Group Key HS to come. 1 if no group key HS
-	// Station sends Msg4  KeyInfo.secure should be the same as that in Msg.3
-	Packet.KeyDesc.KeyInfo.Secure= peerKeyInfo.Secure;
-
-	// Convert to little-endian format.
-	*((USHORT *)&Packet.KeyDesc.KeyInfo) = cpu2le16(*((USHORT *)&Packet.KeyDesc.KeyInfo));
-
-	// Key Replay count
-	NdisMoveMemory(Packet.KeyDesc.ReplayCounter, pMsg3->KeyDesc.ReplayCounter, LEN_KEY_DESC_REPLAY);
-
-	// Out buffer for transmitting message 4
-	MlmeAllocateMemory(pAd, (PUCHAR *)&pOutBuffer);  // allocate memory
-	if(pOutBuffer == NULL)
-		return;
-
-	// Prepare EAPOL frame for MIC calculation
-	// Be careful, only EAPOL frame is counted for MIC calculation
-	MakeOutgoingFrame(pOutBuffer,           &FrameLen,
-		Packet.Body_Len[1] + 4,    &Packet,
-		END_OF_ARGS);
-
-	// Prepare and Fill MIC value
-	NdisZeroMemory(Mic, sizeof(Mic));
-	if(pAd->StaCfg.WepStatus  == Ndis802_11Encryption3Enabled)
-	{
-		// AES
-		UCHAR digest[80];
-
-		HMAC_SHA1(pOutBuffer, FrameLen, pAd->StaCfg.PTK, LEN_EAP_MICK, digest);
-		NdisMoveMemory(Mic, digest, LEN_KEY_DESC_MIC);
-	}
-	else
-	{
-		hmac_md5(pAd->StaCfg.PTK, LEN_EAP_MICK, pOutBuffer, FrameLen, Mic);
-	}
-	NdisMoveMemory(Packet.KeyDesc.KeyMic, Mic, LEN_KEY_DESC_MIC);
-
-	// Update PTK
-	// Prepare pair-wise key information into shared key table
-	NdisZeroMemory(&pAd->SharedKey[BSS0][0], sizeof(CIPHER_KEY));
-	pAd->SharedKey[BSS0][0].KeyLen = LEN_TKIP_EK;
-    NdisMoveMemory(pAd->SharedKey[BSS0][0].Key, &pAd->StaCfg.PTK[32], LEN_TKIP_EK);
-	NdisMoveMemory(pAd->SharedKey[BSS0][0].RxMic, &pAd->StaCfg.PTK[48], LEN_TKIP_RXMICK);
-	NdisMoveMemory(pAd->SharedKey[BSS0][0].TxMic, &pAd->StaCfg.PTK[48+LEN_TKIP_RXMICK], LEN_TKIP_TXMICK);
-
-	// Decide its ChiperAlg
-	if (pAd->StaCfg.PairCipher == Ndis802_11Encryption2Enabled)
-		pAd->SharedKey[BSS0][0].CipherAlg = CIPHER_TKIP;
-	else if (pAd->StaCfg.PairCipher == Ndis802_11Encryption3Enabled)
-		pAd->SharedKey[BSS0][0].CipherAlg = CIPHER_AES;
-	else
-		pAd->SharedKey[BSS0][0].CipherAlg = CIPHER_NONE;
-
-	// Update these related information to MAC_TABLE_ENTRY
-	pEntry = &pAd->MacTab.Content[BSSID_WCID];
-	NdisMoveMemory(pEntry->PairwiseKey.Key, &pAd->StaCfg.PTK[32], LEN_TKIP_EK);
-	NdisMoveMemory(pEntry->PairwiseKey.RxMic, &pAd->StaCfg.PTK[48], LEN_TKIP_RXMICK);
-	NdisMoveMemory(pEntry->PairwiseKey.TxMic, &pAd->StaCfg.PTK[48+LEN_TKIP_RXMICK], LEN_TKIP_TXMICK);
-	pEntry->PairwiseKey.CipherAlg = pAd->SharedKey[BSS0][0].CipherAlg;
-
-	// Update pairwise key information to ASIC Shared Key Table
-	AsicAddSharedKeyEntry(pAd,
-						  BSS0,
-						  0,
-						  pAd->SharedKey[BSS0][0].CipherAlg,
-						  pAd->SharedKey[BSS0][0].Key,
-						  pAd->SharedKey[BSS0][0].TxMic,
-						  pAd->SharedKey[BSS0][0].RxMic);
-
-	// Update ASIC WCID attribute table and IVEIV table
-	RTMPAddWcidAttributeEntry(pAd,
-							  BSS0,
-							  0,
-							  pAd->SharedKey[BSS0][0].CipherAlg,
-							  pEntry);
-
-	// Make transmitting frame
-	MakeOutgoingFrame(pOutBuffer,           	&FrameLen,
-			  			LENGTH_802_3,     		&Header802_3,
-						Packet.Body_Len[1] + 4, &Packet,
-						END_OF_ARGS);
-
-
-	// Copy frame to Tx ring and Send Message 4 to authenticator
-	RTMPToWirelessSta(pAd, Header802_3, LENGTH_802_3, (PUCHAR)&Packet, Packet.Body_Len[1] + 4, TRUE);
-
-	MlmeFreeMemory(pAd, (PUCHAR)pOutBuffer);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("WpaPairMsg3Action <-----\n"));
-}
-
-VOID    Wpa2PairMsg3Action(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem)
-
-{
-	PHEADER_802_11      pHeader;
-	PUCHAR              pOutBuffer = NULL;
-	UCHAR               Header802_3[14];
-	ULONG               FrameLen = 0;
-	EAPOL_PACKET        Packet;
-	PEAPOL_PACKET       pMsg3;
-	UCHAR               Mic[16], OldMic[16];
-	UCHAR               *mpool, *KEYDATA, *digest;
-	UCHAR               Key[32];
-	MAC_TABLE_ENTRY 	*pEntry = NULL;
-	KEY_INFO			peerKeyInfo;
-
-	// allocate memory
-	os_alloc_mem(pAd, (PUCHAR *)&mpool, 1024);
-
-	if(mpool == NULL)
-		return;
-
-	// KEYDATA Len = 512.
-	KEYDATA = (UCHAR *) ROUND_UP(mpool, 4);
-	// digest Len = 80.
-	digest = (UCHAR *) ROUND_UP(KEYDATA + 512, 4);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Wpa2PairMsg3Action ----->\n"));
-
-	pHeader = (PHEADER_802_11) Elem->Msg;
-
-	// Process message 3 frame.
-	pMsg3 = (PEAPOL_PACKET)	&Elem->Msg[LENGTH_802_11 + LENGTH_802_1_H];
-
-	NdisZeroMemory((PUCHAR)&peerKeyInfo, sizeof(peerKeyInfo));
-	NdisMoveMemory((PUCHAR)&peerKeyInfo, (PUCHAR)&pMsg3->KeyDesc.KeyInfo, sizeof(KEY_INFO));
-
-	*((USHORT*)&peerKeyInfo) = cpu2le16(*((USHORT*)&peerKeyInfo));
-
-	// 1. Verify cipher type match
-	if (pAd->StaCfg.WepStatus == Ndis802_11Encryption3Enabled && (peerKeyInfo.KeyDescVer!= 2))
-	{
-		os_free_mem(pAd, (PUCHAR)mpool);
-		return;
-	}
-	else if(pAd->StaCfg.WepStatus == Ndis802_11Encryption2Enabled && (peerKeyInfo.KeyDescVer != 1))
-	{
-		os_free_mem(pAd, (PUCHAR)mpool);
-		return;
-	}
-
-	// 2. Check MIC value
-	// Save the MIC and replace with zero
-	NdisMoveMemory(OldMic, pMsg3->KeyDesc.KeyMic, LEN_KEY_DESC_MIC);
-	NdisZeroMemory(pMsg3->KeyDesc.KeyMic, LEN_KEY_DESC_MIC);
-	if (pAd->StaCfg.WepStatus == Ndis802_11Encryption3Enabled)
-	{
-		// AES
-		HMAC_SHA1((PUCHAR) pMsg3, pMsg3->Body_Len[1] + 4, pAd->StaCfg.PTK, LEN_EAP_MICK, digest);
-		NdisMoveMemory(Mic, digest, LEN_KEY_DESC_MIC);
-	}
-	else
-	{
-		hmac_md5(pAd->StaCfg.PTK, LEN_EAP_MICK, (PUCHAR) pMsg3, pMsg3->Body_Len[1] + 4, Mic);
-	}
-
-	if(!NdisEqualMemory(OldMic, Mic, LEN_KEY_DESC_MIC))
-	{
-		DBGPRINT(RT_DEBUG_ERROR, (" MIC Different in msg 3 of 4-way handshake!!!!!!!!!! \n"));
-		os_free_mem(pAd, (PUCHAR)mpool);
-		return;
-	}
-	else
-		DBGPRINT(RT_DEBUG_TRACE, (" MIC VALID in msg 3 of 4-way handshake!!!!!!!!!! \n"));
-
-	// 3. Check Replay Counter, it has to be larger than last one. No need to be exact one larger
-	if(RTMPCompareMemory(pMsg3->KeyDesc.ReplayCounter, pAd->StaCfg.ReplayCounter, LEN_KEY_DESC_REPLAY) != 1)
-	{
-		os_free_mem(pAd, (PUCHAR)mpool);
-		return;
-	}
-
-	// Update new replay counter
-	NdisMoveMemory(pAd->StaCfg.ReplayCounter, pMsg3->KeyDesc.ReplayCounter, LEN_KEY_DESC_REPLAY);
-
-	// 4. Double check ANonce
-	if(!NdisEqualMemory(pAd->StaCfg.ANonce, pMsg3->KeyDesc.KeyNonce, LEN_KEY_DESC_NONCE))
-	{
-		os_free_mem(pAd, (PUCHAR)mpool);
-		return;
-	}
-
-	// Obtain GTK
-	// 5. Decrypt GTK from Key Data
-	DBGPRINT_RAW(RT_DEBUG_TRACE, ("EKD = %d\n", peerKeyInfo.EKD_DL));
-	if(pAd->StaCfg.WepStatus == Ndis802_11Encryption3Enabled)
-	{
-		// Decrypt AES GTK
-		AES_GTK_KEY_UNWRAP(&pAd->StaCfg.PTK[16], KEYDATA, pMsg3->KeyDesc.KeyDataLen[1],pMsg3->KeyDesc.KeyData);
-	}
-	else	  // TKIP
-	{
-		INT i;
-		// Decrypt TKIP GTK
-		// Construct 32 bytes RC4 Key
-		NdisMoveMemory(Key, pMsg3->KeyDesc.KeyIv, 16);
-		NdisMoveMemory(&Key[16], &pAd->StaCfg.PTK[16], 16);
-		ARCFOUR_INIT(&pAd->PrivateInfo.WEPCONTEXT, Key, 32);
-		//discard first 256 bytes
-		for(i = 0; i < 256; i++)
-			ARCFOUR_BYTE(&pAd->PrivateInfo.WEPCONTEXT);
-		// Decrypt GTK. Becareful, there is no ICV to check the result is correct or not
-		ARCFOUR_DECRYPT(&pAd->PrivateInfo.WEPCONTEXT, KEYDATA, pMsg3->KeyDesc.KeyData, pMsg3->KeyDesc.KeyDataLen[1]);
-	}
-
-	if (!ParseKeyData(pAd, KEYDATA, pMsg3->KeyDesc.KeyDataLen[1], 1))
-	{
-		os_free_mem(pAd, (PUCHAR)mpool);
-		return;
-	}
-
-	// Update GTK to ASIC
-	// Update group key information to ASIC Shared Key Table
-	AsicAddSharedKeyEntry(pAd,
-						  BSS0,
-						  pAd->StaCfg.DefaultKeyId,
-						  pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].CipherAlg,
-						  pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].Key,
-						  pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].TxMic,
-						  pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].RxMic);
-
-	// Update ASIC WCID attribute table and IVEIV table
-	RTMPAddWcidAttributeEntry(pAd,
-							  BSS0,
-							  pAd->StaCfg.DefaultKeyId,
-							  pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].CipherAlg,
-							  NULL);
-
-	// init 802.3 header and Fill Packet
-	MAKE_802_3_HEADER(Header802_3, pAd->CommonCfg.Bssid, pAd->CurrentAddress, EAPOL);
-
-	// Zero message 4 body
-	NdisZeroMemory(&Packet, sizeof(Packet));
-	Packet.ProVer	= EAPOL_VER;
-	Packet.ProType	= EAPOLKey;
-	Packet.Body_Len[1]  	= sizeof(KEY_DESCRIPTER) - MAX_LEN_OF_RSNIE;		// No data field
-
-	//
-	// Message 4 as  EAPOL-Key(0,1,0,0,0,P,0,0,MIC,0)
-	//
-	Packet.KeyDesc.Type = WPA2_KEY_DESC;
-
-	// Key descriptor version and appropriate RSN IE
-	Packet.KeyDesc.KeyInfo.KeyDescVer = peerKeyInfo.KeyDescVer;
-
-	// Update Key Length
-	Packet.KeyDesc.KeyLength[0] = pMsg3->KeyDesc.KeyLength[0];
-	Packet.KeyDesc.KeyLength[1] = pMsg3->KeyDesc.KeyLength[1];
-
-	// Key Type PeerKey
-	Packet.KeyDesc.KeyInfo.KeyType = PAIRWISEKEY;
-
-	// KeyMic field presented
-	Packet.KeyDesc.KeyInfo.KeyMic  = 1;
-	Packet.KeyDesc.KeyInfo.Secure = 1;
-
-	// Convert to little-endian format.
-	*((USHORT *)&Packet.KeyDesc.KeyInfo) = cpu2le16(*((USHORT *)&Packet.KeyDesc.KeyInfo));
-
-	// Key Replay count
-	NdisMoveMemory(Packet.KeyDesc.ReplayCounter, pMsg3->KeyDesc.ReplayCounter, LEN_KEY_DESC_REPLAY);
-
-	// Out buffer for transmitting message 4
-	MlmeAllocateMemory(pAd, (PUCHAR *)&pOutBuffer);  // allocate memory
-	if(pOutBuffer == NULL)
-	{
-		os_free_mem(pAd, (PUCHAR)mpool);
-		return;
-	}
-
-	// Prepare EAPOL frame for MIC calculation
-	// Be careful, only EAPOL frame is counted for MIC calculation
-	MakeOutgoingFrame(pOutBuffer,           &FrameLen,
-		Packet.Body_Len[1] + 4,    &Packet,
-		END_OF_ARGS);
-
-	// Prepare and Fill MIC value
-	NdisZeroMemory(Mic, sizeof(Mic));
-	if(pAd->StaCfg.WepStatus == Ndis802_11Encryption3Enabled)
-	{
-		// AES
-		HMAC_SHA1(pOutBuffer, FrameLen, pAd->StaCfg.PTK, LEN_EAP_MICK, digest);
-		NdisMoveMemory(Mic, digest, LEN_KEY_DESC_MIC);
-	}
-	else
-	{
-		hmac_md5(pAd->StaCfg.PTK, LEN_EAP_MICK, pOutBuffer, FrameLen, Mic);
-	}
-	NdisMoveMemory(Packet.KeyDesc.KeyMic, Mic, LEN_KEY_DESC_MIC);
-
-	// Update PTK
-	// Prepare pair-wise key information into shared key table
-	NdisZeroMemory(&pAd->SharedKey[BSS0][0], sizeof(CIPHER_KEY));
-	pAd->SharedKey[BSS0][0].KeyLen = LEN_TKIP_EK;
-    NdisMoveMemory(pAd->SharedKey[BSS0][0].Key, &pAd->StaCfg.PTK[32], LEN_TKIP_EK);
-	NdisMoveMemory(pAd->SharedKey[BSS0][0].RxMic, &pAd->StaCfg.PTK[48], LEN_TKIP_RXMICK);
-	NdisMoveMemory(pAd->SharedKey[BSS0][0].TxMic, &pAd->StaCfg.PTK[48+LEN_TKIP_RXMICK], LEN_TKIP_TXMICK);
-
-	// Decide its ChiperAlg
-	if (pAd->StaCfg.PairCipher == Ndis802_11Encryption2Enabled)
-		pAd->SharedKey[BSS0][0].CipherAlg = CIPHER_TKIP;
-	else if (pAd->StaCfg.PairCipher == Ndis802_11Encryption3Enabled)
-		pAd->SharedKey[BSS0][0].CipherAlg = CIPHER_AES;
-	else
-		pAd->SharedKey[BSS0][0].CipherAlg = CIPHER_NONE;
-
-	// Update these related information to MAC_TABLE_ENTRY
-	pEntry = &pAd->MacTab.Content[BSSID_WCID];
-	NdisMoveMemory(&pEntry->PairwiseKey.Key, &pAd->StaCfg.PTK[32], LEN_TKIP_EK);
-	NdisMoveMemory(&pEntry->PairwiseKey.RxMic, &pAd->StaCfg.PTK[48], LEN_TKIP_RXMICK);
-	NdisMoveMemory(&pEntry->PairwiseKey.TxMic, &pAd->StaCfg.PTK[48+LEN_TKIP_RXMICK], LEN_TKIP_TXMICK);
-	pEntry->PairwiseKey.CipherAlg = pAd->SharedKey[BSS0][0].CipherAlg;
-
-	// Update pairwise key information to ASIC Shared Key Table
-	AsicAddSharedKeyEntry(pAd,
-						  BSS0,
-						  0,
-						  pAd->SharedKey[BSS0][0].CipherAlg,
-						  pAd->SharedKey[BSS0][0].Key,
-						  pAd->SharedKey[BSS0][0].TxMic,
-						  pAd->SharedKey[BSS0][0].RxMic);
-
-	// Update ASIC WCID attribute table and IVEIV table
-	RTMPAddWcidAttributeEntry(pAd,
-							  BSS0,
-							  0,
-							  pAd->SharedKey[BSS0][0].CipherAlg,
-							  pEntry);
-
-	// Make  Transmitting frame
-	MakeOutgoingFrame(pOutBuffer,           	&FrameLen,
-			  			LENGTH_802_3,     		&Header802_3,
-						Packet.Body_Len[1] + 4, &Packet,
-						END_OF_ARGS);
-
-
-	// Copy frame to Tx ring and Send Message 4 to authenticator
-	RTMPToWirelessSta(pAd, Header802_3, LENGTH_802_3, (PUCHAR)&Packet, Packet.Body_Len[1] + 4, TRUE);
-
-	// set 802.1x port control
-	STA_PORT_SECURED(pAd);
-
-    // Indicate Connected for GUI
-    pAd->IndicateMediaState = NdisMediaStateConnected;
-
-	MlmeFreeMemory(pAd, (PUCHAR)pOutBuffer);
-	os_free_mem(pAd, (PUCHAR)mpool);
-
-
-	// send wireless event - for set key done WPA2
-	if (pAd->CommonCfg.bWirelessEvent)
-		RTMPSendWirelessEvent(pAd, IW_SET_KEY_DONE_WPA2_EVENT_FLAG, pEntry->Addr, BSS0, 0);
-
-	DBGPRINT(RT_DEBUG_ERROR, ("Wpa2PairMsg3Action <-----\n"));
-
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-		Process Group key 2-way handshaking
-
-	Arguments:
-		pAd	Pointer	to our adapter
-		Elem		Message body
-
-	Return Value:
-		None
-
-	Note:
-
-	========================================================================
-*/
-VOID	WpaGroupMsg1Action(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	MLME_QUEUE_ELEM	*Elem)
-
-{
-	PUCHAR              pOutBuffer = NULL;
-	UCHAR               Header802_3[14];
-	ULONG               FrameLen = 0;
-	EAPOL_PACKET        Packet;
-	PEAPOL_PACKET       pGroup;
-	UCHAR               *mpool, *digest, *KEYDATA;
-	UCHAR               Mic[16], OldMic[16];
-	UCHAR               GTK[32], Key[32];
-	KEY_INFO			peerKeyInfo;
-
-	// allocate memory
-	os_alloc_mem(pAd, (PUCHAR *)&mpool, 1024);
-
-	if(mpool == NULL)
-		return;
-
-	// digest Len = 80.
-	digest = (UCHAR *) ROUND_UP(mpool, 4);
-	// KEYDATA Len = 512.
-	KEYDATA = (UCHAR *) ROUND_UP(digest + 80, 4);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("WpaGroupMsg1Action ----->\n"));
-
-	// Process Group Message 1 frame. skip 802.11 header(24) & LLC_SNAP header(8)
-	pGroup = (PEAPOL_PACKET) &Elem->Msg[LENGTH_802_11 + LENGTH_802_1_H];
-
-	NdisZeroMemory((PUCHAR)&peerKeyInfo, sizeof(peerKeyInfo));
-	NdisMoveMemory((PUCHAR)&peerKeyInfo, (PUCHAR)&pGroup->KeyDesc.KeyInfo, sizeof(KEY_INFO));
-
-	*((USHORT*)&peerKeyInfo) = cpu2le16(*((USHORT*)&peerKeyInfo));
-
-	// 0. Check cipher type match
-	if (pAd->StaCfg.WepStatus == Ndis802_11Encryption3Enabled && (peerKeyInfo.KeyDescVer != 2))
-	{
-		os_free_mem(pAd, (PUCHAR)mpool);
-		return;
-	}
-	else if (pAd->StaCfg.WepStatus == Ndis802_11Encryption2Enabled && (peerKeyInfo.KeyDescVer != 1))
-	{
-		os_free_mem(pAd, (PUCHAR)mpool);
-		return;
-	}
-
-	// 1. Verify Replay counter
-	//    Check Replay Counter, it has to be larger than last one. No need to be exact one larger
-	if(RTMPCompareMemory(pGroup->KeyDesc.ReplayCounter, pAd->StaCfg.ReplayCounter, LEN_KEY_DESC_REPLAY) != 1)
-	{
-		os_free_mem(pAd, (PUCHAR)mpool);
-		return;
-	}
-
-	// Update new replay counter
-	NdisMoveMemory(pAd->StaCfg.ReplayCounter, pGroup->KeyDesc.ReplayCounter, LEN_KEY_DESC_REPLAY);
-
-	// 2. Verify MIC is valid
-	// Save the MIC and replace with zero
-	NdisMoveMemory(OldMic, pGroup->KeyDesc.KeyMic, LEN_KEY_DESC_MIC);
-	NdisZeroMemory(pGroup->KeyDesc.KeyMic, LEN_KEY_DESC_MIC);
-
-	if(pAd->StaCfg.WepStatus  == Ndis802_11Encryption3Enabled)
-	{	// AES
-		HMAC_SHA1((PUCHAR) pGroup, pGroup->Body_Len[1] + 4, pAd->StaCfg.PTK, LEN_EAP_MICK, digest);
-		NdisMoveMemory(Mic, digest, LEN_KEY_DESC_MIC);
-	}
-	else
-	{	// TKIP
-		hmac_md5(pAd->StaCfg.PTK, LEN_EAP_MICK, (PUCHAR) pGroup, pGroup->Body_Len[1] + 4, Mic);
-	}
-
-	if(!NdisEqualMemory(OldMic, Mic, LEN_KEY_DESC_MIC))
-	{
-		DBGPRINT(RT_DEBUG_ERROR, (" MIC Different in group msg 1 of 2-way handshake!!!!!!!!!! \n"));
-		MlmeFreeMemory(pAd, (PUCHAR)mpool);
-		return;
-	}
-	else
-		DBGPRINT(RT_DEBUG_TRACE, (" MIC VALID in group msg 1 of 2-way handshake!!!!!!!!!! \n"));
-
-
-	// 3. Decrypt GTK from Key Data
-	if (pAd->StaCfg.WepStatus == Ndis802_11Encryption3Enabled)
-	{
-		// Decrypt AES GTK
-		AES_GTK_KEY_UNWRAP(&pAd->StaCfg.PTK[16], KEYDATA,  pGroup->KeyDesc.KeyDataLen[1], pGroup->KeyDesc.KeyData);
-	}
-	else	// TKIP
-	{
-		INT i;
-
-		// Decrypt TKIP GTK
-		// Construct 32 bytes RC4 Key
-		NdisMoveMemory(Key, pGroup->KeyDesc.KeyIv, 16);
-		NdisMoveMemory(&Key[16], &pAd->StaCfg.PTK[16], 16);
-		ARCFOUR_INIT(&pAd->PrivateInfo.WEPCONTEXT, Key, 32);
-		//discard first 256 bytes
-		for(i = 0; i < 256; i++)
-			ARCFOUR_BYTE(&pAd->PrivateInfo.WEPCONTEXT);
-		// Decrypt GTK. Becareful, there is no ICV to check the result is correct or not
-		ARCFOUR_DECRYPT(&pAd->PrivateInfo.WEPCONTEXT, KEYDATA, pGroup->KeyDesc.KeyData, pGroup->KeyDesc.KeyDataLen[1]);
-	}
-
-	// Process decrypted key data material
-	// Parse keyData to handle KDE format for WPA2PSK
-	if (peerKeyInfo.EKD_DL)
-	{
-		if (!ParseKeyData(pAd, KEYDATA, pGroup->KeyDesc.KeyDataLen[1], 0))
-		{
-			os_free_mem(pAd, (PUCHAR)mpool);
-			return;
-		}
-	}
-	else	// WPAPSK
-	{
-		// set key material, TxMic and RxMic for WPAPSK
-		NdisMoveMemory(GTK, KEYDATA, 32);
-		NdisMoveMemory(pAd->StaCfg.GTK, GTK, 32);
-		pAd->StaCfg.DefaultKeyId = peerKeyInfo.KeyIndex;
-
-		// Prepare pair-wise key information into shared key table
-		NdisZeroMemory(&pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId], sizeof(CIPHER_KEY));
-		pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].KeyLen = LEN_TKIP_EK;
-		NdisMoveMemory(pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].Key, GTK, LEN_TKIP_EK);
-		NdisMoveMemory(pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].RxMic, &GTK[16], LEN_TKIP_RXMICK);
-		NdisMoveMemory(pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].TxMic, &GTK[24], LEN_TKIP_TXMICK);
-
-		// Update Shared Key CipherAlg
-		pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].CipherAlg = CIPHER_NONE;
-		if (pAd->StaCfg.GroupCipher == Ndis802_11Encryption2Enabled)
-			pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].CipherAlg = CIPHER_TKIP;
-		else if (pAd->StaCfg.GroupCipher == Ndis802_11Encryption3Enabled)
-			pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].CipherAlg = CIPHER_AES;
-		else if (pAd->StaCfg.GroupCipher == Ndis802_11GroupWEP40Enabled)
-			pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].CipherAlg = CIPHER_WEP64;
-		else if (pAd->StaCfg.GroupCipher == Ndis802_11GroupWEP104Enabled)
-			pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].CipherAlg = CIPHER_WEP128;
-
-    	//hex_dump("Group Key :", pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].Key, LEN_TKIP_EK);
-	}
-
-	// Update group key information to ASIC Shared Key Table
-	AsicAddSharedKeyEntry(pAd,
-						  BSS0,
-						  pAd->StaCfg.DefaultKeyId,
-						  pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].CipherAlg,
-						  pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].Key,
-						  pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].TxMic,
-						  pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].RxMic);
-
-	// Update ASIC WCID attribute table and IVEIV table
-	RTMPAddWcidAttributeEntry(pAd,
-							  BSS0,
-							  pAd->StaCfg.DefaultKeyId,
-							  pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].CipherAlg,
-							  NULL);
-
-	// set 802.1x port control
-	STA_PORT_SECURED(pAd);
-
-    // Indicate Connected for GUI
-    pAd->IndicateMediaState = NdisMediaStateConnected;
-
-	// init header and Fill Packet
-	MAKE_802_3_HEADER(Header802_3, pAd->CommonCfg.Bssid, pAd->CurrentAddress, EAPOL);
-
-	// Zero Group message 1 body
-	NdisZeroMemory(&Packet, sizeof(Packet));
-	Packet.ProVer	= EAPOL_VER;
-	Packet.ProType	= EAPOLKey;
-	Packet.Body_Len[1]  = sizeof(KEY_DESCRIPTER) - MAX_LEN_OF_RSNIE;		// No data field
-
-	//
-	// Group Message 2 as  EAPOL-Key(1,0,0,0,G,0,0,MIC,0)
-	//
-	if (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK)
-	{
-		Packet.KeyDesc.Type = WPA2_KEY_DESC;
-	}
-	else
-	{
-		Packet.KeyDesc.Type = WPA1_KEY_DESC;
-	}
-
-	// Key descriptor version and appropriate RSN IE
-	Packet.KeyDesc.KeyInfo.KeyDescVer = peerKeyInfo.KeyDescVer;
-
-	// Update Key Length
-	Packet.KeyDesc.KeyLength[0] = pGroup->KeyDesc.KeyLength[0];
-	Packet.KeyDesc.KeyLength[1] = pGroup->KeyDesc.KeyLength[1];
-
-	// Key Index as G-Msg 1
-	if(pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPAPSK)
-		Packet.KeyDesc.KeyInfo.KeyIndex = peerKeyInfo.KeyIndex;
-
-	// Key Type Group key
-	Packet.KeyDesc.KeyInfo.KeyType = GROUPKEY;
-
-	// KeyMic field presented
-	Packet.KeyDesc.KeyInfo.KeyMic  = 1;
-
-	// Secure bit
-	Packet.KeyDesc.KeyInfo.Secure  = 1;
-
-	// Convert to little-endian format.
-	*((USHORT *)&Packet.KeyDesc.KeyInfo) = cpu2le16(*((USHORT *)&Packet.KeyDesc.KeyInfo));
-
-	// Key Replay count
-	NdisMoveMemory(Packet.KeyDesc.ReplayCounter, pGroup->KeyDesc.ReplayCounter, LEN_KEY_DESC_REPLAY);
-
-	// Out buffer for transmitting group message 2
-	MlmeAllocateMemory(pAd, (PUCHAR *)&pOutBuffer);  // allocate memory
-	if(pOutBuffer == NULL)
-	{
-		MlmeFreeMemory(pAd, (PUCHAR)mpool);
-		return;
-	}
-
-	// Prepare EAPOL frame for MIC calculation
-	// Be careful, only EAPOL frame is counted for MIC calculation
-	MakeOutgoingFrame(pOutBuffer,           &FrameLen,
-		Packet.Body_Len[1] + 4,    &Packet,
-		END_OF_ARGS);
-
-	// Prepare and Fill MIC value
-	NdisZeroMemory(Mic, sizeof(Mic));
-	if(pAd->StaCfg.WepStatus  == Ndis802_11Encryption3Enabled)
-	{
-		// AES
-		HMAC_SHA1(pOutBuffer, FrameLen, pAd->StaCfg.PTK, LEN_EAP_MICK, digest);
-		NdisMoveMemory(Mic, digest, LEN_KEY_DESC_MIC);
-	}
-	else
-	{
-		hmac_md5(pAd->StaCfg.PTK, LEN_EAP_MICK, pOutBuffer, FrameLen, Mic);
-	}
-	NdisMoveMemory(Packet.KeyDesc.KeyMic, Mic, LEN_KEY_DESC_MIC);
-
-
-	MakeOutgoingFrame(pOutBuffer,       		&FrameLen,
-						LENGTH_802_3,     		&Header802_3,
-						Packet.Body_Len[1] + 4, &Packet,
-						END_OF_ARGS);
-
-
-	// 5. Copy frame to Tx ring and prepare for encryption
-	RTMPToWirelessSta(pAd, Header802_3, LENGTH_802_3, (PUCHAR)&Packet, Packet.Body_Len[1] + 4, FALSE);
-
-	// 6 Free allocated memory
-	MlmeFreeMemory(pAd, (PUCHAR)pOutBuffer);
-	os_free_mem(pAd, (PUCHAR)mpool);
-
-	// send wireless event - for set key done WPA2
-	if (pAd->CommonCfg.bWirelessEvent)
-		RTMPSendWirelessEvent(pAd, IW_SET_KEY_DONE_WPA2_EVENT_FLAG, pAd->MacTab.Content[BSSID_WCID].Addr, BSS0, 0);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("WpaGroupMsg1Action <-----\n"));
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-		Init WPA MAC header
-
-	Arguments:
-		pAd	Pointer	to our adapter
-
-	Return Value:
-		None
-
-	Note:
-
-	========================================================================
-*/
-VOID	WpaMacHeaderInit(
-	IN		PRTMP_ADAPTER	pAd,
-	IN OUT	PHEADER_802_11	pHdr80211,
-	IN		UCHAR			wep,
-	IN		PUCHAR		    pAddr1)
-{
-	NdisZeroMemory(pHdr80211, sizeof(HEADER_802_11));
-	pHdr80211->FC.Type	= BTYPE_DATA;
-	pHdr80211->FC.ToDs	= 1;
-	if (wep	== 1)
-		pHdr80211->FC.Wep = 1;
-
-	 //	Addr1: BSSID, Addr2: SA, Addr3:	DA
-	COPY_MAC_ADDR(pHdr80211->Addr1, pAddr1);
-	COPY_MAC_ADDR(pHdr80211->Addr2, pAd->CurrentAddress);
-	COPY_MAC_ADDR(pHdr80211->Addr3, pAd->CommonCfg.Bssid);
-	pHdr80211->Sequence =	pAd->Sequence;
-}
-
-/*
-	========================================================================
-
-	Routine	Description:
-		Copy frame from waiting queue into relative ring buffer and set
-	appropriate ASIC register to kick hardware encryption before really
-	sent out to air.
-
-	Arguments:
-		pAd		Pointer	to our adapter
-		PNDIS_PACKET	Pointer to outgoing Ndis frame
-		NumberOfFrag	Number of fragment required
-
-	Return Value:
-		None
-
-	Note:
-
-	========================================================================
-*/
-VOID    RTMPToWirelessSta(
-	IN	PRTMP_ADAPTER	pAd,
-	IN  PUCHAR          pHeader802_3,
-    IN  UINT            HdrLen,
-	IN  PUCHAR          pData,
-    IN  UINT            DataLen,
-    IN	BOOLEAN			is4wayFrame)
-
-{
-	NDIS_STATUS     Status;
-	PNDIS_PACKET    pPacket;
-	UCHAR   Index;
-
-	do
-	{
-		// 1. build a NDIS packet and call RTMPSendPacket();
-		//    be careful about how/when to release this internal allocated NDIS PACKET buffer
-		Status = RTMPAllocateNdisPacket(pAd, &pPacket, pHeader802_3, HdrLen, pData, DataLen);
-		if (Status != NDIS_STATUS_SUCCESS)
-			break;
-
-		if (is4wayFrame)
-			RTMP_SET_PACKET_CLEAR_EAP_FRAME(pPacket, 1);
-		else
-			RTMP_SET_PACKET_CLEAR_EAP_FRAME(pPacket, 0);
-
-		// 2. send out the packet
-		Status = STASendPacket(pAd, pPacket);
-		if(Status == NDIS_STATUS_SUCCESS)
-		{
-			// Dequeue one frame from TxSwQueue0..3 queue and process it
-			// There are three place calling dequeue for TX ring.
-			// 1. Here, right after queueing the frame.
-			// 2. At the end of TxRingTxDone service routine.
-			// 3. Upon NDIS call RTMPSendPackets
-			if((!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS)) &&
-				(!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RESET_IN_PROGRESS)))
-			{
-				for(Index = 0; Index < 5; Index ++)
-					if(pAd->TxSwQueue[Index].Number > 0)
-						RTMPDeQueuePacket(pAd, FALSE, Index, MAX_TX_PROCESS);
-			}
-		}
-	} while(FALSE);
-
-}
-
-/*
-    ========================================================================
-
-    Routine Description:
-    Check Sanity RSN IE form AP
-
-    Arguments:
-
-    Return Value:
-
-
-    ========================================================================
-*/
-BOOLEAN CheckRSNIE(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PUCHAR          pData,
-	IN  UCHAR           DataLen,
-	OUT	UCHAR			*Offset)
-{
-	PUCHAR              pVIE;
-	UCHAR               len;
-	PEID_STRUCT         pEid;
-	BOOLEAN				result = FALSE;
-
-	pVIE = pData;
-	len	 = DataLen;
-	*Offset = 0;
-
-	while (len > sizeof(RSNIE2))
-	{
-		pEid = (PEID_STRUCT) pVIE;
-		// WPA RSN IE
-		if ((pEid->Eid == IE_WPA) && (NdisEqualMemory(pEid->Octet, WPA_OUI, 4)))
-		{
-			if ((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA || pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPAPSK) &&
-				(NdisEqualMemory(pVIE, pAd->MacTab.Content[BSSID_WCID].RSN_IE, pAd->MacTab.Content[BSSID_WCID].RSNIE_Len)) &&
-				(pAd->MacTab.Content[BSSID_WCID].RSNIE_Len == (pEid->Len + 2)))
-			{
-					DBGPRINT(RT_DEBUG_TRACE, ("CheckRSNIE ==> WPA/WPAPSK RSN IE matched in Msg 3, Length(%d) \n", (pEid->Len + 2)));
-					result = TRUE;
-			}
-
-			*Offset += (pEid->Len + 2);
-		}
-		// WPA2 RSN IE
-		else if ((pEid->Eid == IE_RSN) && (NdisEqualMemory(pEid->Octet + 2, RSN_OUI, 3)))
-		{
-			if ((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2 || pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK) &&
-				(NdisEqualMemory(pVIE, pAd->MacTab.Content[BSSID_WCID].RSN_IE, pAd->MacTab.Content[BSSID_WCID].RSNIE_Len)) &&
-				(pAd->MacTab.Content[BSSID_WCID].RSNIE_Len == (pEid->Len + 2)))
-			{
-					DBGPRINT(RT_DEBUG_TRACE, ("CheckRSNIE ==> WPA2/WPA2PSK RSN IE matched in Msg 3, Length(%d) \n", (pEid->Len + 2)));
-					result = TRUE;
-			}
-
-			*Offset += (pEid->Len + 2);
-		}
-		else
-		{
-			break;
-		}
-
-		pVIE += (pEid->Len + 2);
-		len  -= (pEid->Len + 2);
-	}
-
-	DBGPRINT(RT_DEBUG_TRACE, ("CheckRSNIE ==> skip_offset(%d) \n", *Offset));
-
-	return result;
-
-}
-
-
-/*
-    ========================================================================
-
-    Routine Description:
-    Parse KEYDATA field.  KEYDATA[] May contain 2 RSN IE and optionally GTK.
-    GTK  is encaptulated in KDE format at  p.83 802.11i D10
-
-    Arguments:
-
-    Return Value:
-
-    Note:
-        802.11i D10
-
-    ========================================================================
-*/
-BOOLEAN ParseKeyData(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PUCHAR          pKeyData,
-	IN  UCHAR           KeyDataLen,
-	IN	UCHAR			bPairewise)
-{
-    PKDE_ENCAP          pKDE = NULL;
-    PUCHAR              pMyKeyData = pKeyData;
-    UCHAR               KeyDataLength = KeyDataLen;
-    UCHAR               GTKLEN;
-	UCHAR				skip_offset;
-
-	// Verify The RSN IE contained in Pairewise-Msg 3 and skip it
-	if (bPairewise)
-    {
-		// Check RSN IE whether it is WPA2/WPA2PSK
-		if (!CheckRSNIE(pAd, pKeyData, KeyDataLen, &skip_offset))
-		{
-			DBGPRINT(RT_DEBUG_ERROR, ("ParseKeyData ==> WPA2/WPA2PSK RSN IE mismatched \n"));
-			hex_dump("Get KEYDATA :", pKeyData, KeyDataLen);
-			return FALSE;
-    	}
-    	else
-		{
-			// skip RSN IE
-			pMyKeyData += skip_offset;
-			KeyDataLength -= skip_offset;
-
-			//DBGPRINT(RT_DEBUG_TRACE, ("ParseKeyData ==> WPA2/WPA2PSK RSN IE matched in Msg 3, Length(%d) \n", skip_offset));
-		}
-	}
-
-	DBGPRINT(RT_DEBUG_TRACE,("ParseKeyData ==> KeyDataLength %d without RSN_IE \n", KeyDataLength));
-
-	// Parse EKD format
-	if (KeyDataLength >= 8)
-    {
-        pKDE = (PKDE_ENCAP) pMyKeyData;
-    }
-	else
-    {
-		DBGPRINT(RT_DEBUG_ERROR, ("ERROR: KeyDataLength is too short \n"));
-        return FALSE;
-    }
-
-
-	// Sanity check - shared key index should not be 0
-	if (pKDE->GTKEncap.Kid == 0)
-    {
-        DBGPRINT(RT_DEBUG_ERROR, ("ERROR: GTK Key index zero \n"));
-        return FALSE;
-    }
-
-	// Sanity check - KED length
-	if (KeyDataLength < (pKDE->Len + 2))
-    {
-        DBGPRINT(RT_DEBUG_ERROR, ("ERROR: The len from KDE is too short \n"));
-        return FALSE;
-    }
-
-	// Get GTK length - refer to IEEE 802.11i-2004 p.82
-	GTKLEN = pKDE->Len -6;
-
-	if (GTKLEN < LEN_AES_KEY)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("ERROR: GTK Key length is too short (%d) \n", GTKLEN));
-        return FALSE;
-	}
-	else
-		DBGPRINT(RT_DEBUG_TRACE, ("GTK Key with KDE formet got index=%d, len=%d \n", pKDE->GTKEncap.Kid, GTKLEN));
-
-	// Update GTK
-	// set key material, TxMic and RxMic for WPAPSK
-	NdisMoveMemory(pAd->StaCfg.GTK, pKDE->GTKEncap.GTK, 32);
-	pAd->StaCfg.DefaultKeyId = pKDE->GTKEncap.Kid;
-
-	// Update shared key table
-	NdisZeroMemory(&pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId], sizeof(CIPHER_KEY));
-	pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].KeyLen = LEN_TKIP_EK;
-	NdisMoveMemory(pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].Key, pKDE->GTKEncap.GTK, LEN_TKIP_EK);
-	NdisMoveMemory(pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].RxMic, &pKDE->GTKEncap.GTK[16], LEN_TKIP_RXMICK);
-	NdisMoveMemory(pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].TxMic, &pKDE->GTKEncap.GTK[24], LEN_TKIP_TXMICK);
-
-	// Update Shared Key CipherAlg
-	pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].CipherAlg = CIPHER_NONE;
-	if (pAd->StaCfg.GroupCipher == Ndis802_11Encryption2Enabled)
-		pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].CipherAlg = CIPHER_TKIP;
-	else if (pAd->StaCfg.GroupCipher == Ndis802_11Encryption3Enabled)
-		pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].CipherAlg = CIPHER_AES;
-	else if (pAd->StaCfg.GroupCipher == Ndis802_11GroupWEP40Enabled)
-		pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].CipherAlg = CIPHER_WEP64;
-	else if (pAd->StaCfg.GroupCipher == Ndis802_11GroupWEP104Enabled)
-		pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].CipherAlg = CIPHER_WEP128;
-
-	return TRUE;
-
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-		Cisco CCKM PRF function
-
-	Arguments:
-		key				Cisco Base Transient Key (BTK)
-		key_len			The key length of the BTK
-		data			Ruquest Number(RN) + BSSID
-		data_len		The length of the data
-		output			Store for PTK(Pairwise transient keys)
-		len				The length of the output
-	Return Value:
-		None
-
-	Note:
-		802.1i	Annex F.9
-
-	========================================================================
-*/
-VOID CCKMPRF(
-	IN	UCHAR	*key,
-	IN	INT		key_len,
-	IN	UCHAR	*data,
-	IN	INT		data_len,
-	OUT	UCHAR	*output,
-	IN	INT		len)
-{
-	INT		i;
-	UCHAR	input[1024];
-	INT		currentindex = 0;
-	INT		total_len;
-
-	NdisMoveMemory(input, data, data_len);
-	total_len = data_len;
-	input[total_len] = 0;
-	total_len++;
-	for	(i = 0;	i <	(len + 19) / 20; i++)
-	{
-		HMAC_SHA1(input, total_len,	key, key_len, &output[currentindex]);
-		currentindex +=	20;
-		input[total_len - 1]++;
-	}
-}
+void inc_byte_array(u8 * counter, int len);
 
 /*
 	========================================================================
@@ -1864,189 +58,178 @@ VOID CCKMPRF(
 
 	========================================================================
 */
-VOID	RTMPReportMicError(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PCIPHER_KEY 	pWpaKey)
+void RTMPReportMicError(struct rt_rtmp_adapter *pAd, struct rt_cipher_key *pWpaKey)
 {
-	ULONG	Now;
-    UCHAR   unicastKey = (pWpaKey->Type == PAIRWISE_KEY ? 1:0);
+	unsigned long Now;
+	u8 unicastKey = (pWpaKey->Type == PAIRWISE_KEY ? 1 : 0);
 
-	// Record Last MIC error time and count
-	Now = jiffies;
-	if (pAd->StaCfg.MicErrCnt == 0)
-	{
+	/* Record Last MIC error time and count */
+	NdisGetSystemUpTime(&Now);
+	if (pAd->StaCfg.MicErrCnt == 0) {
 		pAd->StaCfg.MicErrCnt++;
 		pAd->StaCfg.LastMicErrorTime = Now;
-        NdisZeroMemory(pAd->StaCfg.ReplayCounter, 8);
-	}
-	else if (pAd->StaCfg.MicErrCnt == 1)
-	{
-		if ((pAd->StaCfg.LastMicErrorTime + (60 * OS_HZ)) < Now)
-		{
-			// Update Last MIC error time, this did not violate two MIC errors within 60 seconds
+		NdisZeroMemory(pAd->StaCfg.ReplayCounter, 8);
+	} else if (pAd->StaCfg.MicErrCnt == 1) {
+		if ((pAd->StaCfg.LastMicErrorTime + (60 * OS_HZ)) < Now) {
+			/* Update Last MIC error time, this did not violate two MIC errors within 60 seconds */
 			pAd->StaCfg.LastMicErrorTime = Now;
-		}
-		else
-		{
+		} else {
 
 			if (pAd->CommonCfg.bWirelessEvent)
-				RTMPSendWirelessEvent(pAd, IW_COUNTER_MEASURES_EVENT_FLAG, pAd->MacTab.Content[BSSID_WCID].Addr, BSS0, 0);
+				RTMPSendWirelessEvent(pAd,
+						      IW_COUNTER_MEASURES_EVENT_FLAG,
+						      pAd->MacTab.
+						      Content[BSSID_WCID].Addr,
+						      BSS0, 0);
 
 			pAd->StaCfg.LastMicErrorTime = Now;
-			// Violate MIC error counts, MIC countermeasures kicks in
+			/* Violate MIC error counts, MIC countermeasures kicks in */
 			pAd->StaCfg.MicErrCnt++;
+			/* We shall block all reception */
+			/* We shall clean all Tx ring and disassoicate from AP after next EAPOL frame */
+			/* */
+			/* No necessary to clean all Tx ring, on RTMPHardTransmit will stop sending non-802.1X EAPOL packets */
+			/* if pAd->StaCfg.MicErrCnt greater than 2. */
+			/* */
+			/* RTMPRingCleanUp(pAd, QID_AC_BK); */
+			/* RTMPRingCleanUp(pAd, QID_AC_BE); */
+			/* RTMPRingCleanUp(pAd, QID_AC_VI); */
+			/* RTMPRingCleanUp(pAd, QID_AC_VO); */
+			/* RTMPRingCleanUp(pAd, QID_HCCA); */
 		}
-	}
-	else
-	{
-		// MIC error count >= 2
-		// This should not happen
+	} else {
+		/* MIC error count >= 2 */
+		/* This should not happen */
 		;
 	}
-    MlmeEnqueue(pAd,
-				MLME_CNTL_STATE_MACHINE,
-				OID_802_11_MIC_FAILURE_REPORT_FRAME,
-				1,
-				&unicastKey);
-
-    if (pAd->StaCfg.MicErrCnt == 2)
-    {
-        RTMPSetTimer(&pAd->StaCfg.WpaDisassocAndBlockAssocTimer, 100);
-    }
+	MlmeEnqueue(pAd,
+		    MLME_CNTL_STATE_MACHINE,
+		    OID_802_11_MIC_FAILURE_REPORT_FRAME, 1, &unicastKey);
+
+	if (pAd->StaCfg.MicErrCnt == 2) {
+		RTMPSetTimer(&pAd->StaCfg.WpaDisassocAndBlockAssocTimer, 100);
+	}
 }
 
 #define	LENGTH_EAP_H    4
-// If the received frame is EAP-Packet ,find out its EAP-Code (Request(0x01), Response(0x02), Success(0x03), Failure(0x04)).
-INT	    WpaCheckEapCode(
-	IN  PRTMP_ADAPTER   		pAd,
-	IN  PUCHAR				pFrame,
-	IN  USHORT				FrameLen,
-	IN  USHORT				OffSet)
+/* If the received frame is EAP-Packet ,find out its EAP-Code (Request(0x01), Response(0x02), Success(0x03), Failure(0x04)). */
+int WpaCheckEapCode(struct rt_rtmp_adapter *pAd,
+		    u8 *pFrame, u16 FrameLen, u16 OffSet)
 {
 
-	PUCHAR	pData;
-	INT	result = 0;
+	u8 *pData;
+	int result = 0;
 
-	if( FrameLen < OffSet + LENGTH_EAPOL_H + LENGTH_EAP_H )
+	if (FrameLen < OffSet + LENGTH_EAPOL_H + LENGTH_EAP_H)
 		return result;
 
-	pData = pFrame + OffSet; // skip offset bytes
+	pData = pFrame + OffSet;	/* skip offset bytes */
 
-	if(*(pData+1) == EAPPacket) 	// 802.1x header - Packet Type
+	if (*(pData + 1) == EAPPacket)	/* 802.1x header - Packet Type */
 	{
-		 result = *(pData+4);		// EAP header - Code
+		result = *(pData + 4);	/* EAP header - Code */
 	}
 
 	return result;
 }
 
-VOID    WpaSendMicFailureToWpaSupplicant(
-    IN  PRTMP_ADAPTER    pAd,
-    IN  BOOLEAN          bUnicast)
+void WpaSendMicFailureToWpaSupplicant(struct rt_rtmp_adapter *pAd, IN BOOLEAN bUnicast)
 {
-    union iwreq_data    wrqu;
-    char custom[IW_CUSTOM_MAX] = {0};
+	char custom[IW_CUSTOM_MAX] = { 0 };
 
-    sprintf(custom, "MLME-MICHAELMICFAILURE.indication");
-    if (bUnicast)
-        sprintf(custom, "%s unicast", custom);
-    wrqu.data.length = strlen(custom);
-    wireless_send_event(pAd->net_dev, IWEVCUSTOM, &wrqu, custom);
+	sprintf(custom, "MLME-MICHAELMICFAILURE.indication");
+	if (bUnicast)
+		sprintf(custom, "%s unicast", custom);
 
-    return;
+	RtmpOSWrielessEventSend(pAd, IWEVCUSTOM, -1, NULL, (u8 *)custom,
+				strlen(custom));
+
+	return;
 }
 
-VOID	WpaMicFailureReportFrame(
-	IN  PRTMP_ADAPTER   pAd,
-	IN MLME_QUEUE_ELEM *Elem)
+void WpaMicFailureReportFrame(struct rt_rtmp_adapter *pAd, struct rt_mlme_queue_elem *Elem)
 {
-	PUCHAR              pOutBuffer = NULL;
-	UCHAR               Header802_3[14];
-	ULONG               FrameLen = 0;
-	EAPOL_PACKET        Packet;
-	UCHAR               Mic[16];
-    BOOLEAN             bUnicast;
+	u8 *pOutBuffer = NULL;
+	u8 Header802_3[14];
+	unsigned long FrameLen = 0;
+	struct rt_eapol_packet Packet;
+	u8 Mic[16];
+	BOOLEAN bUnicast;
 
 	DBGPRINT(RT_DEBUG_TRACE, ("WpaMicFailureReportFrame ----->\n"));
 
-    bUnicast = (Elem->Msg[0] == 1 ? TRUE:FALSE);
+	bUnicast = (Elem->Msg[0] == 1 ? TRUE : FALSE);
 	pAd->Sequence = ((pAd->Sequence) + 1) & (MAX_SEQ_NUMBER);
 
-	// init 802.3 header and Fill Packet
-	MAKE_802_3_HEADER(Header802_3, pAd->CommonCfg.Bssid, pAd->CurrentAddress, EAPOL);
+	/* init 802.3 header and Fill Packet */
+	MAKE_802_3_HEADER(Header802_3, pAd->CommonCfg.Bssid,
+			  pAd->CurrentAddress, EAPOL);
 
 	NdisZeroMemory(&Packet, sizeof(Packet));
-	Packet.ProVer	= EAPOL_VER;
-	Packet.ProType	= EAPOLKey;
+	Packet.ProVer = EAPOL_VER;
+	Packet.ProType = EAPOLKey;
 
 	Packet.KeyDesc.Type = WPA1_KEY_DESC;
 
-    // Request field presented
-    Packet.KeyDesc.KeyInfo.Request = 1;
+	/* Request field presented */
+	Packet.KeyDesc.KeyInfo.Request = 1;
 
-	if(pAd->StaCfg.WepStatus  == Ndis802_11Encryption3Enabled)
-	{
+	if (pAd->StaCfg.WepStatus == Ndis802_11Encryption3Enabled) {
 		Packet.KeyDesc.KeyInfo.KeyDescVer = 2;
-	}
-	else	  // TKIP
+	} else			/* TKIP */
 	{
 		Packet.KeyDesc.KeyInfo.KeyDescVer = 1;
 	}
 
-    Packet.KeyDesc.KeyInfo.KeyType = (bUnicast ? PAIRWISEKEY : GROUPKEY);
-
-	// KeyMic field presented
-	Packet.KeyDesc.KeyInfo.KeyMic  = 1;
-
-    // Error field presented
-	Packet.KeyDesc.KeyInfo.Error  = 1;
+	Packet.KeyDesc.KeyInfo.KeyType = (bUnicast ? PAIRWISEKEY : GROUPKEY);
 
-	// Update packet length after decide Key data payload
-	Packet.Body_Len[1]  = sizeof(KEY_DESCRIPTER) - MAX_LEN_OF_RSNIE;
+	/* KeyMic field presented */
+	Packet.KeyDesc.KeyInfo.KeyMic = 1;
 
-	// Key Replay Count
-	NdisMoveMemory(Packet.KeyDesc.ReplayCounter, pAd->StaCfg.ReplayCounter, LEN_KEY_DESC_REPLAY);
-    inc_byte_array(pAd->StaCfg.ReplayCounter, 8);
+	/* Error field presented */
+	Packet.KeyDesc.KeyInfo.Error = 1;
 
-	// Convert to little-endian format.
-	*((USHORT *)&Packet.KeyDesc.KeyInfo) = cpu2le16(*((USHORT *)&Packet.KeyDesc.KeyInfo));
+	/* Update packet length after decide Key data payload */
+	SET_u16_TO_ARRARY(Packet.Body_Len, LEN_EAPOL_KEY_MSG)
+	    /* Key Replay Count */
+	    NdisMoveMemory(Packet.KeyDesc.ReplayCounter,
+			   pAd->StaCfg.ReplayCounter, LEN_KEY_DESC_REPLAY);
+	inc_byte_array(pAd->StaCfg.ReplayCounter, 8);
 
+	/* Convert to little-endian format. */
+	*((u16 *) & Packet.KeyDesc.KeyInfo) =
+	    cpu2le16(*((u16 *) & Packet.KeyDesc.KeyInfo));
 
-	MlmeAllocateMemory(pAd, (PUCHAR *)&pOutBuffer);  // allocate memory
-	if(pOutBuffer == NULL)
-	{
+	MlmeAllocateMemory(pAd, (u8 **) & pOutBuffer);	/* allocate memory */
+	if (pOutBuffer == NULL) {
 		return;
 	}
+	/* Prepare EAPOL frame for MIC calculation */
+	/* Be careful, only EAPOL frame is counted for MIC calculation */
+	MakeOutgoingFrame(pOutBuffer, &FrameLen,
+			  CONV_ARRARY_TO_u16(Packet.Body_Len) + 4, &Packet,
+			  END_OF_ARGS);
 
-	// Prepare EAPOL frame for MIC calculation
-	// Be careful, only EAPOL frame is counted for MIC calculation
-	MakeOutgoingFrame(pOutBuffer,               &FrameLen,
-		              Packet.Body_Len[1] + 4,   &Packet,
-		              END_OF_ARGS);
-
-	// Prepare and Fill MIC value
+	/* Prepare and Fill MIC value */
 	NdisZeroMemory(Mic, sizeof(Mic));
-	if(pAd->StaCfg.WepStatus  == Ndis802_11Encryption3Enabled)
-	{	// AES
-        UCHAR digest[20] = {0};
-		HMAC_SHA1(pOutBuffer, FrameLen, pAd->StaCfg.PTK, LEN_EAP_MICK, digest);
+	if (pAd->StaCfg.WepStatus == Ndis802_11Encryption3Enabled) {	/* AES */
+		u8 digest[20] = { 0 };
+		HMAC_SHA1(pAd->StaCfg.PTK, LEN_EAP_MICK, pOutBuffer, FrameLen,
+			  digest, SHA1_DIGEST_SIZE);
 		NdisMoveMemory(Mic, digest, LEN_KEY_DESC_MIC);
-	}
-	else
-	{	// TKIP
-		hmac_md5(pAd->StaCfg.PTK,  LEN_EAP_MICK, pOutBuffer, FrameLen, Mic);
+	} else {		/* TKIP */
+		HMAC_MD5(pAd->StaCfg.PTK, LEN_EAP_MICK, pOutBuffer, FrameLen,
+			 Mic, MD5_DIGEST_SIZE);
 	}
 	NdisMoveMemory(Packet.KeyDesc.KeyMic, Mic, LEN_KEY_DESC_MIC);
 
-    MakeOutgoingFrame(pOutBuffer,           	&FrameLen,
-    	  			LENGTH_802_3,     			&Header802_3,
-    				Packet.Body_Len[1] + 4,     &Packet,
-    				END_OF_ARGS);
-
-	// opy frame to Tx ring and send MIC failure report frame to authenticator
-	RTMPToWirelessSta(pAd, Header802_3, LENGTH_802_3, (PUCHAR)&Packet, Packet.Body_Len[1] + 4, FALSE);
+	/* copy frame to Tx ring and send MIC failure report frame to authenticator */
+	RTMPToWirelessSta(pAd, &pAd->MacTab.Content[BSSID_WCID],
+			  Header802_3, LENGTH_802_3,
+			  (u8 *)& Packet,
+			  CONV_ARRARY_TO_u16(Packet.Body_Len) + 4, FALSE);
 
-	MlmeFreeMemory(pAd, (PUCHAR)pOutBuffer);
+	MlmeFreeMemory(pAd, (u8 *)pOutBuffer);
 
 	DBGPRINT(RT_DEBUG_TRACE, ("WpaMicFailureReportFrame <-----\n"));
 }
@@ -2060,7 +243,7 @@ VOID	WpaMicFailureReportFrame(
  * rolling over to more significant bytes if the byte was incremented from
  * 0xff to 0x00.
  */
-void inc_byte_array(UCHAR *counter, int len)
+void inc_byte_array(u8 * counter, int len)
 {
 	int pos = len - 1;
 	while (pos >= 0) {
@@ -2071,21 +254,120 @@ void inc_byte_array(UCHAR *counter, int len)
 	}
 }
 
-VOID WpaDisassocApAndBlockAssoc(
-    IN PVOID SystemSpecific1,
-    IN PVOID FunctionContext,
-    IN PVOID SystemSpecific2,
-    IN PVOID SystemSpecific3)
+void WpaDisassocApAndBlockAssoc(void *SystemSpecific1,
+				void *FunctionContext,
+				void *SystemSpecific2,
+				void *SystemSpecific3)
 {
-    RTMP_ADAPTER                *pAd = (PRTMP_ADAPTER)FunctionContext;
-    MLME_DISASSOC_REQ_STRUCT    DisassocReq;
+	struct rt_rtmp_adapter *pAd = (struct rt_rtmp_adapter *)FunctionContext;
+	struct rt_mlme_disassoc_req DisassocReq;
 
-	// disassoc from current AP first
-	DBGPRINT(RT_DEBUG_TRACE, ("RTMPReportMicError - disassociate with current AP after sending second continuous EAPOL frame\n"));
-	DisassocParmFill(pAd, &DisassocReq, pAd->CommonCfg.Bssid, REASON_MIC_FAILURE);
-	MlmeEnqueue(pAd, ASSOC_STATE_MACHINE, MT2_MLME_DISASSOC_REQ, sizeof(MLME_DISASSOC_REQ_STRUCT), &DisassocReq);
+	/* disassoc from current AP first */
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("RTMPReportMicError - disassociate with current AP after sending second continuous EAPOL frame\n"));
+	DisassocParmFill(pAd, &DisassocReq, pAd->CommonCfg.Bssid,
+			 REASON_MIC_FAILURE);
+	MlmeEnqueue(pAd, ASSOC_STATE_MACHINE, MT2_MLME_DISASSOC_REQ,
+		    sizeof(struct rt_mlme_disassoc_req), &DisassocReq);
 
 	pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_DISASSOC;
 	pAd->StaCfg.bBlockAssoc = TRUE;
 }
 
+void WpaStaPairwiseKeySetting(struct rt_rtmp_adapter *pAd)
+{
+	struct rt_cipher_key *pSharedKey;
+	struct rt_mac_table_entry *pEntry;
+
+	pEntry = &pAd->MacTab.Content[BSSID_WCID];
+
+	/* Pairwise key shall use key#0 */
+	pSharedKey = &pAd->SharedKey[BSS0][0];
+
+	NdisMoveMemory(pAd->StaCfg.PTK, pEntry->PTK, LEN_PTK);
+
+	/* Prepare pair-wise key information into shared key table */
+	NdisZeroMemory(pSharedKey, sizeof(struct rt_cipher_key));
+	pSharedKey->KeyLen = LEN_TKIP_EK;
+	NdisMoveMemory(pSharedKey->Key, &pAd->StaCfg.PTK[32], LEN_TKIP_EK);
+	NdisMoveMemory(pSharedKey->RxMic, &pAd->StaCfg.PTK[48],
+		       LEN_TKIP_RXMICK);
+	NdisMoveMemory(pSharedKey->TxMic,
+		       &pAd->StaCfg.PTK[48 + LEN_TKIP_RXMICK], LEN_TKIP_TXMICK);
+
+	/* Decide its ChiperAlg */
+	if (pAd->StaCfg.PairCipher == Ndis802_11Encryption2Enabled)
+		pSharedKey->CipherAlg = CIPHER_TKIP;
+	else if (pAd->StaCfg.PairCipher == Ndis802_11Encryption3Enabled)
+		pSharedKey->CipherAlg = CIPHER_AES;
+	else
+		pSharedKey->CipherAlg = CIPHER_NONE;
+
+	/* Update these related information to struct rt_mac_table_entry */
+	NdisMoveMemory(pEntry->PairwiseKey.Key, &pAd->StaCfg.PTK[32],
+		       LEN_TKIP_EK);
+	NdisMoveMemory(pEntry->PairwiseKey.RxMic, &pAd->StaCfg.PTK[48],
+		       LEN_TKIP_RXMICK);
+	NdisMoveMemory(pEntry->PairwiseKey.TxMic,
+		       &pAd->StaCfg.PTK[48 + LEN_TKIP_RXMICK], LEN_TKIP_TXMICK);
+	pEntry->PairwiseKey.CipherAlg = pSharedKey->CipherAlg;
+
+	/* Update pairwise key information to ASIC Shared Key Table */
+	AsicAddSharedKeyEntry(pAd,
+			      BSS0,
+			      0,
+			      pSharedKey->CipherAlg,
+			      pSharedKey->Key,
+			      pSharedKey->TxMic, pSharedKey->RxMic);
+
+	/* Update ASIC WCID attribute table and IVEIV table */
+	RTMPAddWcidAttributeEntry(pAd, BSS0, 0, pSharedKey->CipherAlg, pEntry);
+	STA_PORT_SECURED(pAd);
+	pAd->IndicateMediaState = NdisMediaStateConnected;
+
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("%s : AID(%d) port secured\n", __func__, pEntry->Aid));
+
+}
+
+void WpaStaGroupKeySetting(struct rt_rtmp_adapter *pAd)
+{
+	struct rt_cipher_key *pSharedKey;
+
+	pSharedKey = &pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId];
+
+	/* Prepare pair-wise key information into shared key table */
+	NdisZeroMemory(pSharedKey, sizeof(struct rt_cipher_key));
+	pSharedKey->KeyLen = LEN_TKIP_EK;
+	NdisMoveMemory(pSharedKey->Key, pAd->StaCfg.GTK, LEN_TKIP_EK);
+	NdisMoveMemory(pSharedKey->RxMic, &pAd->StaCfg.GTK[16],
+		       LEN_TKIP_RXMICK);
+	NdisMoveMemory(pSharedKey->TxMic, &pAd->StaCfg.GTK[24],
+		       LEN_TKIP_TXMICK);
+
+	/* Update Shared Key CipherAlg */
+	pSharedKey->CipherAlg = CIPHER_NONE;
+	if (pAd->StaCfg.GroupCipher == Ndis802_11Encryption2Enabled)
+		pSharedKey->CipherAlg = CIPHER_TKIP;
+	else if (pAd->StaCfg.GroupCipher == Ndis802_11Encryption3Enabled)
+		pSharedKey->CipherAlg = CIPHER_AES;
+	else if (pAd->StaCfg.GroupCipher == Ndis802_11GroupWEP40Enabled)
+		pSharedKey->CipherAlg = CIPHER_WEP64;
+	else if (pAd->StaCfg.GroupCipher == Ndis802_11GroupWEP104Enabled)
+		pSharedKey->CipherAlg = CIPHER_WEP128;
+
+	/* Update group key information to ASIC Shared Key Table */
+	AsicAddSharedKeyEntry(pAd,
+			      BSS0,
+			      pAd->StaCfg.DefaultKeyId,
+			      pSharedKey->CipherAlg,
+			      pSharedKey->Key,
+			      pSharedKey->TxMic, pSharedKey->RxMic);
+
+	/* Update ASIC WCID attribute table and IVEIV table */
+	RTMPAddWcidAttributeEntry(pAd,
+				  BSS0,
+				  pAd->StaCfg.DefaultKeyId,
+				  pSharedKey->CipherAlg, NULL);
+
+}
diff --git a/drivers/staging/rt2860/sta_ioctl.c b/drivers/staging/rt2860/sta_ioctl.c
index c0e04251e126..d8fbe6cc6941 100644
--- a/drivers/staging/rt2860/sta_ioctl.c
+++ b/drivers/staging/rt2860/sta_ioctl.c
@@ -40,7 +40,7 @@
 #include	"rt_config.h"
 
 #ifdef DBG
-extern ULONG    RTDebugLevel;
+extern unsigned long RTDebugLevel;
 #endif
 
 #define NR_WEP_KEYS 				4
@@ -49,424 +49,310 @@ extern ULONG    RTDebugLevel;
 
 #define GROUP_KEY_NO                4
 
-extern UCHAR    CipherWpa2Template[];
-extern UCHAR    CipherWpaPskTkip[];
-extern UCHAR    CipherWpaPskTkipLen;
-
-typedef struct PACKED _RT_VERSION_INFO{
-    UCHAR       DriverVersionW;
-    UCHAR       DriverVersionX;
-    UCHAR       DriverVersionY;
-    UCHAR       DriverVersionZ;
-    UINT        DriverBuildYear;
-    UINT        DriverBuildMonth;
-    UINT        DriverBuildDay;
-} RT_VERSION_INFO, *PRT_VERSION_INFO;
-
-struct iw_priv_args privtab[] = {
-{ RTPRIV_IOCTL_SET,
-  IW_PRIV_TYPE_CHAR | 1024, 0,
-  "set"},
-
-{ RTPRIV_IOCTL_SHOW, 0, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK,
-  ""},
-{ RTPRIV_IOCTL_SHOW, IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK,
-  ""},
-/* --- sub-ioctls definitions --- */
-    { SHOW_CONN_STATUS,
-	  0, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "connStatus" },
-	{ SHOW_DRVIER_VERION,
-	  0, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "driverVer" },
-    { SHOW_BA_INFO,
-	  0, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "bainfo" },
-	{ SHOW_DESC_INFO,
-	  0, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "descinfo" },
-    { RAIO_OFF,
-	  0, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "radio_off" },
-	{ RAIO_ON,
-	  0, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "radio_on" },
-	{ SHOW_CFG_VALUE,
-	  IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "show" },
-/* --- sub-ioctls relations --- */
-
-{ RTPRIV_IOCTL_STATISTICS,
-  0, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK,
-  "stat"},
-{ RTPRIV_IOCTL_GSITESURVEY,
-  0, IW_PRIV_TYPE_CHAR | 1024,
-  "get_site_survey"},
-};
-
-INT Set_SSID_Proc(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  PUCHAR          arg);
-
-#ifdef WMM_SUPPORT
-INT	Set_WmmCapable_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg);
-#endif
+extern u8 CipherWpa2Template[];
 
-INT Set_NetworkType_Proc(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  PUCHAR          arg);
-
-INT Set_AuthMode_Proc(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  PUCHAR          arg);
-
-INT Set_EncrypType_Proc(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  PUCHAR          arg);
-
-INT Set_DefaultKeyID_Proc(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  PUCHAR          arg);
-
-INT Set_Key1_Proc(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  PUCHAR          arg);
-
-INT Set_Key2_Proc(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  PUCHAR          arg);
-
-INT Set_Key3_Proc(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  PUCHAR          arg);
-
-INT Set_Key4_Proc(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  PUCHAR          arg);
-
-INT Set_WPAPSK_Proc(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  PUCHAR          arg);
-
-
-INT Set_PSMode_Proc(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  PUCHAR          arg);
-
-INT Set_Wpa_Support(
-    IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg);
-
-NDIS_STATUS RTMPWPANoneAddKeyProc(
-    IN  PRTMP_ADAPTER   pAd,
-    IN	PVOID			pBuf);
-
-INT Set_FragTest_Proc(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  PUCHAR          arg);
-
-INT Set_TGnWifiTest_Proc(
-    IN  PRTMP_ADAPTER   pAd,
-    IN  PUCHAR          arg);
-
-INT Set_LongRetryLimit_Proc(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	PUCHAR			arg);
-
-INT Set_ShortRetryLimit_Proc(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	PUCHAR			arg);
-
-static struct {
-	CHAR *name;
-	INT (*set_proc)(PRTMP_ADAPTER pAdapter, PUCHAR arg);
-} *PRTMP_PRIVATE_SET_PROC, RTMP_PRIVATE_SUPPORT_PROC[] = {
-	{"DriverVersion",				Set_DriverVersion_Proc},
-	{"CountryRegion",				Set_CountryRegion_Proc},
-	{"CountryRegionABand",			Set_CountryRegionABand_Proc},
-	{"SSID",						Set_SSID_Proc},
-	{"WirelessMode",				Set_WirelessMode_Proc},
-	{"TxBurst",					Set_TxBurst_Proc},
-	{"TxPreamble",				Set_TxPreamble_Proc},
-	{"TxPower",					Set_TxPower_Proc},
-	{"Channel",					Set_Channel_Proc},
-	{"BGProtection",				Set_BGProtection_Proc},
-	{"RTSThreshold",				Set_RTSThreshold_Proc},
-	{"FragThreshold",				Set_FragThreshold_Proc},
-	{"HtBw",		                Set_HtBw_Proc},
-	{"HtMcs",		                Set_HtMcs_Proc},
-	{"HtGi",		                Set_HtGi_Proc},
-	{"HtOpMode",		            Set_HtOpMode_Proc},
-	{"HtExtcha",		            Set_HtExtcha_Proc},
-	{"HtMpduDensity",		        Set_HtMpduDensity_Proc},
-	{"HtBaWinSize",		        	Set_HtBaWinSize_Proc},
-	{"HtRdg",		        		Set_HtRdg_Proc},
-	{"HtAmsdu",		        		Set_HtAmsdu_Proc},
-	{"HtAutoBa",		        	Set_HtAutoBa_Proc},
-	{"HtBaDecline",					Set_BADecline_Proc},
-	{"HtProtect",		        	Set_HtProtect_Proc},
-	{"HtMimoPs",		        	Set_HtMimoPs_Proc},
-#ifdef AGGREGATION_SUPPORT
-	{"PktAggregate",				Set_PktAggregate_Proc},
-#endif
+struct PACKED rt_version_info {
+	u8 DriverVersionW;
+	u8 DriverVersionX;
+	u8 DriverVersionY;
+	u8 DriverVersionZ;
+	u32 DriverBuildYear;
+	u32 DriverBuildMonth;
+	u32 DriverBuildDay;
+};
 
-#ifdef WMM_SUPPORT
-	{"WmmCapable",					Set_WmmCapable_Proc},
-#endif
-	{"IEEE80211H",					Set_IEEE80211H_Proc},
-    {"NetworkType",                 Set_NetworkType_Proc},
-	{"AuthMode",					Set_AuthMode_Proc},
-	{"EncrypType",					Set_EncrypType_Proc},
-	{"DefaultKeyID",				Set_DefaultKeyID_Proc},
-	{"Key1",						Set_Key1_Proc},
-	{"Key2",						Set_Key2_Proc},
-	{"Key3",						Set_Key3_Proc},
-	{"Key4",						Set_Key4_Proc},
-	{"WPAPSK",						Set_WPAPSK_Proc},
-	{"ResetCounter",				Set_ResetStatCounter_Proc},
-	{"PSMode",                      Set_PSMode_Proc},
-#ifdef DBG
-	{"Debug",						Set_Debug_Proc},
-#endif
-    {"WpaSupport",                  Set_Wpa_Support},
-	{"FixedTxMode",                 Set_FixedTxMode_Proc},
-    {"TGnWifiTest",                 Set_TGnWifiTest_Proc},
-    {"ForceGF",		        		Set_ForceGF_Proc},
-	{"LongRetry",	        		Set_LongRetryLimit_Proc},
-	{"ShortRetry",	        		Set_ShortRetryLimit_Proc},
-#ifdef RT2870
-	{"efuseFreeNumber",				set_eFuseGetFreeBlockCount_Proc},
-	{"efuseDump",					set_eFusedump_Proc},
-	{"efuseLoadFromBin",				set_eFuseLoadFromBin_Proc},
-#endif
-	{NULL,}
+static __s32 ralinkrate[] = { 2, 4, 11, 22,	/* CCK */
+	12, 18, 24, 36, 48, 72, 96, 108,	/* OFDM */
+	13, 26, 39, 52, 78, 104, 117, 130, 26, 52, 78, 104, 156, 208, 234, 260,	/* 20MHz, 800ns GI, MCS: 0 ~ 15 */
+	39, 78, 117, 156, 234, 312, 351, 390,	/* 20MHz, 800ns GI, MCS: 16 ~ 23 */
+	27, 54, 81, 108, 162, 216, 243, 270, 54, 108, 162, 216, 324, 432, 486, 540,	/* 40MHz, 800ns GI, MCS: 0 ~ 15 */
+	81, 162, 243, 324, 486, 648, 729, 810,	/* 40MHz, 800ns GI, MCS: 16 ~ 23 */
+	14, 29, 43, 57, 87, 115, 130, 144, 29, 59, 87, 115, 173, 230, 260, 288,	/* 20MHz, 400ns GI, MCS: 0 ~ 15 */
+	43, 87, 130, 173, 260, 317, 390, 433,	/* 20MHz, 400ns GI, MCS: 16 ~ 23 */
+	30, 60, 90, 120, 180, 240, 270, 300, 60, 120, 180, 240, 360, 480, 540, 600,	/* 40MHz, 400ns GI, MCS: 0 ~ 15 */
+	90, 180, 270, 360, 540, 720, 810, 900
 };
 
+int Set_SSID_Proc(struct rt_rtmp_adapter *pAdapter, char *arg);
 
-VOID RTMPAddKey(
-	IN	PRTMP_ADAPTER	    pAd,
-	IN	PNDIS_802_11_KEY    pKey)
-{
-	ULONG				KeyIdx;
-	MAC_TABLE_ENTRY  	*pEntry;
+int Set_NetworkType_Proc(struct rt_rtmp_adapter *pAdapter, char *arg);
 
-    DBGPRINT(RT_DEBUG_TRACE, ("RTMPAddKey ------>\n"));
+void RTMPAddKey(struct rt_rtmp_adapter *pAd, struct rt_ndis_802_11_key *pKey)
+{
+	unsigned long KeyIdx;
+	struct rt_mac_table_entry *pEntry;
+
+	DBGPRINT(RT_DEBUG_TRACE, ("RTMPAddKey ------>\n"));
+
+	if (pAd->StaCfg.AuthMode >= Ndis802_11AuthModeWPA) {
+		if (pKey->KeyIndex & 0x80000000) {
+			if (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPANone) {
+				NdisZeroMemory(pAd->StaCfg.PMK, 32);
+				NdisMoveMemory(pAd->StaCfg.PMK,
+					       pKey->KeyMaterial,
+					       pKey->KeyLength);
+				goto end;
+			}
+			/* Update PTK */
+			NdisZeroMemory(&pAd->SharedKey[BSS0][0],
+				       sizeof(struct rt_cipher_key));
+			pAd->SharedKey[BSS0][0].KeyLen = LEN_TKIP_EK;
+			NdisMoveMemory(pAd->SharedKey[BSS0][0].Key,
+				       pKey->KeyMaterial, LEN_TKIP_EK);
+
+			if (pAd->StaCfg.PairCipher ==
+			    Ndis802_11Encryption2Enabled) {
+				NdisMoveMemory(pAd->SharedKey[BSS0][0].RxMic,
+					       pKey->KeyMaterial + LEN_TKIP_EK,
+					       LEN_TKIP_TXMICK);
+				NdisMoveMemory(pAd->SharedKey[BSS0][0].TxMic,
+					       pKey->KeyMaterial + LEN_TKIP_EK +
+					       LEN_TKIP_TXMICK,
+					       LEN_TKIP_RXMICK);
+			} else {
+				NdisMoveMemory(pAd->SharedKey[BSS0][0].TxMic,
+					       pKey->KeyMaterial + LEN_TKIP_EK,
+					       LEN_TKIP_TXMICK);
+				NdisMoveMemory(pAd->SharedKey[BSS0][0].RxMic,
+					       pKey->KeyMaterial + LEN_TKIP_EK +
+					       LEN_TKIP_TXMICK,
+					       LEN_TKIP_RXMICK);
+			}
 
-#ifdef RT2860
-	RTMP_CLEAR_PSFLAG(pAd, fRTMP_PS_CAN_GO_SLEEP);
-	if (RTMP_TEST_PSFLAG(pAd, fRTMP_PS_SET_PCI_CLK_OFF_COMMAND))
-	{
-		if (pAd->StaCfg.bRadio == FALSE)
-		{
-			RTMP_SET_PSFLAG(pAd, fRTMP_PS_CAN_GO_SLEEP);
-			return;
-		}
-		DBGPRINT(RT_DEBUG_TRACE,("RTMPWPAAddKeyProc1==>\n"));
-		RTMPPCIeLinkCtrlValueRestore(pAd, RESTORE_HALT);
-		RTMPusecDelay(6000);
-		pAd->bPCIclkOff = FALSE;
-	}
-#endif
+			/* Decide its ChiperAlg */
+			if (pAd->StaCfg.PairCipher ==
+			    Ndis802_11Encryption2Enabled)
+				pAd->SharedKey[BSS0][0].CipherAlg = CIPHER_TKIP;
+			else if (pAd->StaCfg.PairCipher ==
+				 Ndis802_11Encryption3Enabled)
+				pAd->SharedKey[BSS0][0].CipherAlg = CIPHER_AES;
+			else
+				pAd->SharedKey[BSS0][0].CipherAlg = CIPHER_NONE;
+
+			/* Update these related information to struct rt_mac_table_entry */
+			pEntry = &pAd->MacTab.Content[BSSID_WCID];
+			NdisMoveMemory(pEntry->PairwiseKey.Key,
+				       pAd->SharedKey[BSS0][0].Key,
+				       LEN_TKIP_EK);
+			NdisMoveMemory(pEntry->PairwiseKey.RxMic,
+				       pAd->SharedKey[BSS0][0].RxMic,
+				       LEN_TKIP_RXMICK);
+			NdisMoveMemory(pEntry->PairwiseKey.TxMic,
+				       pAd->SharedKey[BSS0][0].TxMic,
+				       LEN_TKIP_TXMICK);
+			pEntry->PairwiseKey.CipherAlg =
+			    pAd->SharedKey[BSS0][0].CipherAlg;
+
+			/* Update pairwise key information to ASIC Shared Key Table */
+			AsicAddSharedKeyEntry(pAd,
+					      BSS0,
+					      0,
+					      pAd->SharedKey[BSS0][0].CipherAlg,
+					      pAd->SharedKey[BSS0][0].Key,
+					      pAd->SharedKey[BSS0][0].TxMic,
+					      pAd->SharedKey[BSS0][0].RxMic);
+
+			/* Update ASIC WCID attribute table and IVEIV table */
+			RTMPAddWcidAttributeEntry(pAd,
+						  BSS0,
+						  0,
+						  pAd->SharedKey[BSS0][0].
+						  CipherAlg, pEntry);
 
-	if (pAd->StaCfg.AuthMode >= Ndis802_11AuthModeWPA)
-	{
-		if (pKey->KeyIndex & 0x80000000)
-		{
-		    if (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPANone)
-            {
-                NdisZeroMemory(pAd->StaCfg.PMK, 32);
-                NdisMoveMemory(pAd->StaCfg.PMK, pKey->KeyMaterial, pKey->KeyLength);
-                goto end;
-            }
-		    // Update PTK
-		    NdisZeroMemory(&pAd->SharedKey[BSS0][0], sizeof(CIPHER_KEY));
-            pAd->SharedKey[BSS0][0].KeyLen = LEN_TKIP_EK;
-            NdisMoveMemory(pAd->SharedKey[BSS0][0].Key, pKey->KeyMaterial, LEN_TKIP_EK);
-
-            if (pAd->StaCfg.PairCipher == Ndis802_11Encryption2Enabled)
-            {
-                NdisMoveMemory(pAd->SharedKey[BSS0][0].RxMic, pKey->KeyMaterial + LEN_TKIP_EK, LEN_TKIP_TXMICK);
-                NdisMoveMemory(pAd->SharedKey[BSS0][0].TxMic, pKey->KeyMaterial + LEN_TKIP_EK + LEN_TKIP_TXMICK, LEN_TKIP_RXMICK);
-            }
-            else
-            {
-            	NdisMoveMemory(pAd->SharedKey[BSS0][0].TxMic, pKey->KeyMaterial + LEN_TKIP_EK, LEN_TKIP_TXMICK);
-                NdisMoveMemory(pAd->SharedKey[BSS0][0].RxMic, pKey->KeyMaterial + LEN_TKIP_EK + LEN_TKIP_TXMICK, LEN_TKIP_RXMICK);
-            }
-
-            // Decide its ChiperAlg
-        	if (pAd->StaCfg.PairCipher == Ndis802_11Encryption2Enabled)
-        		pAd->SharedKey[BSS0][0].CipherAlg = CIPHER_TKIP;
-        	else if (pAd->StaCfg.PairCipher == Ndis802_11Encryption3Enabled)
-        		pAd->SharedKey[BSS0][0].CipherAlg = CIPHER_AES;
-        	else
-        		pAd->SharedKey[BSS0][0].CipherAlg = CIPHER_NONE;
-
-            // Update these related information to MAC_TABLE_ENTRY
-        	pEntry = &pAd->MacTab.Content[BSSID_WCID];
-            NdisMoveMemory(pEntry->PairwiseKey.Key, pAd->SharedKey[BSS0][0].Key, LEN_TKIP_EK);
-        	NdisMoveMemory(pEntry->PairwiseKey.RxMic, pAd->SharedKey[BSS0][0].RxMic, LEN_TKIP_RXMICK);
-        	NdisMoveMemory(pEntry->PairwiseKey.TxMic, pAd->SharedKey[BSS0][0].TxMic, LEN_TKIP_TXMICK);
-        	pEntry->PairwiseKey.CipherAlg = pAd->SharedKey[BSS0][0].CipherAlg;
-
-        	// Update pairwise key information to ASIC Shared Key Table
-        	AsicAddSharedKeyEntry(pAd,
-        						  BSS0,
-        						  0,
-        						  pAd->SharedKey[BSS0][0].CipherAlg,
-        						  pAd->SharedKey[BSS0][0].Key,
-        						  pAd->SharedKey[BSS0][0].TxMic,
-        						  pAd->SharedKey[BSS0][0].RxMic);
-
-        	// Update ASIC WCID attribute table and IVEIV table
-        	RTMPAddWcidAttributeEntry(pAd,
-        							  BSS0,
-        							  0,
-        							  pAd->SharedKey[BSS0][0].CipherAlg,
-        							  pEntry);
-
-            if (pAd->StaCfg.AuthMode >= Ndis802_11AuthModeWPA2)
-            {
-                // set 802.1x port control
+			if (pAd->StaCfg.AuthMode >= Ndis802_11AuthModeWPA2) {
+				/* set 802.1x port control */
+				/*pAd->StaCfg.PortSecured = WPA_802_1X_PORT_SECURED; */
 				STA_PORT_SECURED(pAd);
 
-                // Indicate Connected for GUI
-                pAd->IndicateMediaState = NdisMediaStateConnected;
-            }
-		}
-        else
-        {
-            // Update GTK
-            pAd->StaCfg.DefaultKeyId = (pKey->KeyIndex & 0xFF);
-            NdisZeroMemory(&pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId], sizeof(CIPHER_KEY));
-            pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].KeyLen = LEN_TKIP_EK;
-            NdisMoveMemory(pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].Key, pKey->KeyMaterial, LEN_TKIP_EK);
-
-            if (pAd->StaCfg.GroupCipher == Ndis802_11Encryption2Enabled)
-            {
-                NdisMoveMemory(pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].RxMic, pKey->KeyMaterial + LEN_TKIP_EK, LEN_TKIP_TXMICK);
-                NdisMoveMemory(pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].TxMic, pKey->KeyMaterial + LEN_TKIP_EK + LEN_TKIP_TXMICK, LEN_TKIP_RXMICK);
-            }
-            else
-            {
-            	NdisMoveMemory(pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].TxMic, pKey->KeyMaterial + LEN_TKIP_EK, LEN_TKIP_TXMICK);
-                NdisMoveMemory(pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].RxMic, pKey->KeyMaterial + LEN_TKIP_EK + LEN_TKIP_TXMICK, LEN_TKIP_RXMICK);
-            }
-
-            // Update Shared Key CipherAlg
-    		pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].CipherAlg = CIPHER_NONE;
-    		if (pAd->StaCfg.GroupCipher == Ndis802_11Encryption2Enabled)
-    			pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].CipherAlg = CIPHER_TKIP;
-    		else if (pAd->StaCfg.GroupCipher == Ndis802_11Encryption3Enabled)
-    			pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].CipherAlg = CIPHER_AES;
-
-            // Update group key information to ASIC Shared Key Table
-        	AsicAddSharedKeyEntry(pAd,
-        						  BSS0,
-        						  pAd->StaCfg.DefaultKeyId,
-        						  pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].CipherAlg,
-        						  pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].Key,
-        						  pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].TxMic,
-        						  pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].RxMic);
-
-        	// Update ASIC WCID attribute table and IVEIV table
-        	RTMPAddWcidAttributeEntry(pAd,
-        							  BSS0,
-        							  pAd->StaCfg.DefaultKeyId,
-        							  pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].CipherAlg,
-        							  NULL);
-
-            // set 802.1x port control
+				/* Indicate Connected for GUI */
+				pAd->IndicateMediaState =
+				    NdisMediaStateConnected;
+			}
+		} else {
+			/* Update GTK */
+			pAd->StaCfg.DefaultKeyId = (pKey->KeyIndex & 0xFF);
+			NdisZeroMemory(&pAd->
+				       SharedKey[BSS0][pAd->StaCfg.
+						       DefaultKeyId],
+				       sizeof(struct rt_cipher_key));
+			pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].KeyLen =
+			    LEN_TKIP_EK;
+			NdisMoveMemory(pAd->
+				       SharedKey[BSS0][pAd->StaCfg.
+						       DefaultKeyId].Key,
+				       pKey->KeyMaterial, LEN_TKIP_EK);
+
+			if (pAd->StaCfg.GroupCipher ==
+			    Ndis802_11Encryption2Enabled) {
+				NdisMoveMemory(pAd->
+					       SharedKey[BSS0][pAd->StaCfg.
+							       DefaultKeyId].
+					       RxMic,
+					       pKey->KeyMaterial + LEN_TKIP_EK,
+					       LEN_TKIP_TXMICK);
+				NdisMoveMemory(pAd->
+					       SharedKey[BSS0][pAd->StaCfg.
+							       DefaultKeyId].
+					       TxMic,
+					       pKey->KeyMaterial + LEN_TKIP_EK +
+					       LEN_TKIP_TXMICK,
+					       LEN_TKIP_RXMICK);
+			} else {
+				NdisMoveMemory(pAd->
+					       SharedKey[BSS0][pAd->StaCfg.
+							       DefaultKeyId].
+					       TxMic,
+					       pKey->KeyMaterial + LEN_TKIP_EK,
+					       LEN_TKIP_TXMICK);
+				NdisMoveMemory(pAd->
+					       SharedKey[BSS0][pAd->StaCfg.
+							       DefaultKeyId].
+					       RxMic,
+					       pKey->KeyMaterial + LEN_TKIP_EK +
+					       LEN_TKIP_TXMICK,
+					       LEN_TKIP_RXMICK);
+			}
+
+			/* Update Shared Key CipherAlg */
+			pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].
+			    CipherAlg = CIPHER_NONE;
+			if (pAd->StaCfg.GroupCipher ==
+			    Ndis802_11Encryption2Enabled)
+				pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].
+				    CipherAlg = CIPHER_TKIP;
+			else if (pAd->StaCfg.GroupCipher ==
+				 Ndis802_11Encryption3Enabled)
+				pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].
+				    CipherAlg = CIPHER_AES;
+
+			/* Update group key information to ASIC Shared Key Table */
+			AsicAddSharedKeyEntry(pAd,
+					      BSS0,
+					      pAd->StaCfg.DefaultKeyId,
+					      pAd->SharedKey[BSS0][pAd->StaCfg.
+								   DefaultKeyId].
+					      CipherAlg,
+					      pAd->SharedKey[BSS0][pAd->StaCfg.
+								   DefaultKeyId].
+					      Key,
+					      pAd->SharedKey[BSS0][pAd->StaCfg.
+								   DefaultKeyId].
+					      TxMic,
+					      pAd->SharedKey[BSS0][pAd->StaCfg.
+								   DefaultKeyId].
+					      RxMic);
+
+			/* Update ASIC WCID attribute table and IVEIV table */
+			RTMPAddWcidAttributeEntry(pAd,
+						  BSS0,
+						  pAd->StaCfg.DefaultKeyId,
+						  pAd->SharedKey[BSS0][pAd->
+								       StaCfg.
+								       DefaultKeyId].
+						  CipherAlg, NULL);
+
+			/* set 802.1x port control */
+			/*pAd->StaCfg.PortSecured = WPA_802_1X_PORT_SECURED; */
 			STA_PORT_SECURED(pAd);
 
-            // Indicate Connected for GUI
-            pAd->IndicateMediaState = NdisMediaStateConnected;
-        }
-	}
-	else	// dynamic WEP from wpa_supplicant
+			/* Indicate Connected for GUI */
+			pAd->IndicateMediaState = NdisMediaStateConnected;
+		}
+	} else			/* dynamic WEP from wpa_supplicant */
 	{
-		UCHAR	CipherAlg;
-    	PUCHAR	Key;
+		u8 CipherAlg;
+		u8 *Key;
 
-		if(pKey->KeyLength == 32)
+		if (pKey->KeyLength == 32)
 			goto end;
 
 		KeyIdx = pKey->KeyIndex & 0x0fffffff;
 
-		if (KeyIdx < 4)
-		{
-			// it is a default shared key, for Pairwise key setting
-			if (pKey->KeyIndex & 0x80000000)
-			{
+		if (KeyIdx < 4) {
+			/* it is a default shared key, for Pairwise key setting */
+			if (pKey->KeyIndex & 0x80000000) {
 				pEntry = MacTableLookup(pAd, pKey->BSSID);
 
-				if (pEntry)
-				{
-					DBGPRINT(RT_DEBUG_TRACE, ("RTMPAddKey: Set Pair-wise Key\n"));
+				if (pEntry) {
+					DBGPRINT(RT_DEBUG_TRACE,
+						 ("RTMPAddKey: Set Pair-wise Key\n"));
 
-					// set key material and key length
- 					pEntry->PairwiseKey.KeyLen = (UCHAR)pKey->KeyLength;
-					NdisMoveMemory(pEntry->PairwiseKey.Key, &pKey->KeyMaterial, pKey->KeyLength);
+					/* set key material and key length */
+					pEntry->PairwiseKey.KeyLen =
+					    (u8)pKey->KeyLength;
+					NdisMoveMemory(pEntry->PairwiseKey.Key,
+						       &pKey->KeyMaterial,
+						       pKey->KeyLength);
 
-					// set Cipher type
+					/* set Cipher type */
 					if (pKey->KeyLength == 5)
-						pEntry->PairwiseKey.CipherAlg = CIPHER_WEP64;
+						pEntry->PairwiseKey.CipherAlg =
+						    CIPHER_WEP64;
 					else
-						pEntry->PairwiseKey.CipherAlg = CIPHER_WEP128;
-
-					// Add Pair-wise key to Asic
-					AsicAddPairwiseKeyEntry(
-						pAd,
-						pEntry->Addr,
-						(UCHAR)pEntry->Aid,
-                		&pEntry->PairwiseKey);
-
-					// update WCID attribute table and IVEIV table for this entry
-					RTMPAddWcidAttributeEntry(
-						pAd,
-						BSS0,
-						KeyIdx, // The value may be not zero
-						pEntry->PairwiseKey.CipherAlg,
-						pEntry);
+						pEntry->PairwiseKey.CipherAlg =
+						    CIPHER_WEP128;
+
+					/* Add Pair-wise key to Asic */
+					AsicAddPairwiseKeyEntry(pAd,
+								pEntry->Addr,
+								(u8)pEntry->
+								Aid,
+								&pEntry->
+								PairwiseKey);
+
+					/* update WCID attribute table and IVEIV table for this entry */
+					RTMPAddWcidAttributeEntry(pAd, BSS0, KeyIdx,	/* The value may be not zero */
+								  pEntry->
+								  PairwiseKey.
+								  CipherAlg,
+								  pEntry);
 
 				}
-			}
-			else
-            {
-				// Default key for tx (shared key)
-				pAd->StaCfg.DefaultKeyId = (UCHAR) KeyIdx;
-
-				// set key material and key length
-				pAd->SharedKey[BSS0][KeyIdx].KeyLen = (UCHAR) pKey->KeyLength;
-				NdisMoveMemory(pAd->SharedKey[BSS0][KeyIdx].Key, &pKey->KeyMaterial, pKey->KeyLength);
-
-				// Set Ciper type
+			} else {
+				/* Default key for tx (shared key) */
+				pAd->StaCfg.DefaultKeyId = (u8)KeyIdx;
+
+				/* set key material and key length */
+				pAd->SharedKey[BSS0][KeyIdx].KeyLen =
+				    (u8)pKey->KeyLength;
+				NdisMoveMemory(pAd->SharedKey[BSS0][KeyIdx].Key,
+					       &pKey->KeyMaterial,
+					       pKey->KeyLength);
+
+				/* Set Ciper type */
 				if (pKey->KeyLength == 5)
-					pAd->SharedKey[BSS0][KeyIdx].CipherAlg = CIPHER_WEP64;
+					pAd->SharedKey[BSS0][KeyIdx].CipherAlg =
+					    CIPHER_WEP64;
 				else
-					pAd->SharedKey[BSS0][KeyIdx].CipherAlg = CIPHER_WEP128;
+					pAd->SharedKey[BSS0][KeyIdx].CipherAlg =
+					    CIPHER_WEP128;
 
-    			CipherAlg = pAd->SharedKey[BSS0][KeyIdx].CipherAlg;
-    			Key = pAd->SharedKey[BSS0][KeyIdx].Key;
+				CipherAlg =
+				    pAd->SharedKey[BSS0][KeyIdx].CipherAlg;
+				Key = pAd->SharedKey[BSS0][KeyIdx].Key;
 
-				// Set Group key material to Asic
-    			AsicAddSharedKeyEntry(pAd, BSS0, KeyIdx, CipherAlg, Key, NULL, NULL);
+				/* Set Group key material to Asic */
+				AsicAddSharedKeyEntry(pAd, BSS0, KeyIdx,
+						      CipherAlg, Key, NULL,
+						      NULL);
 
-				// Update WCID attribute table and IVEIV table for this group key table
-				RTMPAddWcidAttributeEntry(pAd, BSS0, KeyIdx, CipherAlg, NULL);
+				/* Update WCID attribute table and IVEIV table for this group key table */
+				RTMPAddWcidAttributeEntry(pAd, BSS0, KeyIdx,
+							  CipherAlg, NULL);
 
 			}
 		}
 	}
 end:
-#ifdef RT2860
-	RTMP_SET_PSFLAG(pAd, fRTMP_PS_CAN_GO_SLEEP);
-    DBGPRINT(RT_DEBUG_INFO, ("<------ RTMPAddKey\n"));
-#endif
 	return;
 }
 
-char * rtstrchr(const char * s, int c)
+char *rtstrchr(const char *s, int c)
 {
-    for(; *s != (char) c; ++s)
-        if (*s == '\0')
-            return NULL;
-    return (char *) s;
+	for (; *s != (char)c; ++s)
+		if (*s == '\0')
+			return NULL;
+	return (char *)s;
 }
 
 /*
@@ -475,159 +361,164 @@ This is required for LinEX2004/kernel2.6.7 to provide iwlist scanning function
 
 int
 rt_ioctl_giwname(struct net_device *dev,
-		   struct iw_request_info *info,
-		   char *name, char *extra)
+		 struct iw_request_info *info, char *name, char *extra)
 {
-//	PRTMP_ADAPTER pAdapter = dev->ml_priv;
-	strncpy(name, RT28xx_CHIP_NAME " Wireless", IFNAMSIZ);
+	strncpy(name, "Ralink STA", IFNAMSIZ);
+	/* RT2870 2.1.0.0 uses "RT2870 Wireless" */
+	/* RT3090 2.1.0.0 uses "RT2860 Wireless" */
 	return 0;
 }
 
 int rt_ioctl_siwfreq(struct net_device *dev,
-			struct iw_request_info *info,
-			struct iw_freq *freq, char *extra)
+		     struct iw_request_info *info,
+		     struct iw_freq *freq, char *extra)
 {
-	PRTMP_ADAPTER pAdapter = dev->ml_priv;
-	int 	chan = -1;
+	struct rt_rtmp_adapter *pAdapter = NULL;
+	int chan = -1;
 
-    //check if the interface is down
-    if(!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE))
-    {
-        DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
-        return -ENETDOWN;
-    }
+	GET_PAD_FROM_NET_DEV(pAdapter, dev);
 
+	/*check if the interface is down */
+	if (!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE)) {
+		DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
+		return -ENETDOWN;
+	}
 
 	if (freq->e > 1)
 		return -EINVAL;
 
-	if((freq->e == 0) && (freq->m <= 1000))
-		chan = freq->m;	// Setting by channel number
+	if ((freq->e == 0) && (freq->m <= 1000))
+		chan = freq->m;	/* Setting by channel number */
 	else
-		MAP_KHZ_TO_CHANNEL_ID( (freq->m /100) , chan); // Setting by frequency - search the table , like 2.412G, 2.422G,
-
-    if (ChannelSanity(pAdapter, chan) == TRUE)
-    {
-	pAdapter->CommonCfg.Channel = chan;
-	DBGPRINT(RT_DEBUG_ERROR, ("==>rt_ioctl_siwfreq::SIOCSIWFREQ[cmd=0x%x] (Channel=%d)\n", SIOCSIWFREQ, pAdapter->CommonCfg.Channel));
-    }
-    else
-        return -EINVAL;
+		MAP_KHZ_TO_CHANNEL_ID((freq->m / 100), chan);	/* Setting by frequency - search the table , like 2.412G, 2.422G, */
+
+	if (ChannelSanity(pAdapter, chan) == TRUE) {
+		pAdapter->CommonCfg.Channel = chan;
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("==>rt_ioctl_siwfreq::SIOCSIWFREQ[cmd=0x%x] (Channel=%d)\n",
+			  SIOCSIWFREQ, pAdapter->CommonCfg.Channel));
+	} else
+		return -EINVAL;
 
 	return 0;
 }
+
 int rt_ioctl_giwfreq(struct net_device *dev,
-		   struct iw_request_info *info,
-		   struct iw_freq *freq, char *extra)
+		     struct iw_request_info *info,
+		     struct iw_freq *freq, char *extra)
 {
-	PRTMP_ADAPTER pAdapter = dev->ml_priv;
-	UCHAR ch = pAdapter->CommonCfg.Channel;
-	ULONG	m;
+	struct rt_rtmp_adapter *pAdapter = NULL;
+	u8 ch;
+	unsigned long m = 2412000;
 
-	DBGPRINT(RT_DEBUG_TRACE,("==>rt_ioctl_giwfreq  %d\n", ch));
+	GET_PAD_FROM_NET_DEV(pAdapter, dev);
 
-    MAP_CHANNEL_ID_TO_KHZ(ch, m);
+	ch = pAdapter->CommonCfg.Channel;
+
+	DBGPRINT(RT_DEBUG_TRACE, ("==>rt_ioctl_giwfreq  %d\n", ch));
+
+	MAP_CHANNEL_ID_TO_KHZ(ch, m);
 	freq->m = m * 100;
 	freq->e = 1;
 	return 0;
 }
 
 int rt_ioctl_siwmode(struct net_device *dev,
-		   struct iw_request_info *info,
-		   __u32 *mode, char *extra)
+		     struct iw_request_info *info, __u32 * mode, char *extra)
 {
-	PRTMP_ADAPTER pAdapter = dev->ml_priv;
+	struct rt_rtmp_adapter *pAdapter = NULL;
 
-	//check if the interface is down
-    if(!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE))
-    {
-    	DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
-       	return -ENETDOWN;
-    }
+	GET_PAD_FROM_NET_DEV(pAdapter, dev);
 
-	switch (*mode)
-	{
-		case IW_MODE_ADHOC:
-			Set_NetworkType_Proc(pAdapter, "Adhoc");
-			break;
-		case IW_MODE_INFRA:
-			Set_NetworkType_Proc(pAdapter, "Infra");
-			break;
-        case IW_MODE_MONITOR:
-			Set_NetworkType_Proc(pAdapter, "Monitor");
-			break;
-		default:
-			DBGPRINT(RT_DEBUG_TRACE, ("===>rt_ioctl_siwmode::SIOCSIWMODE (unknown %d)\n", *mode));
-			return -EINVAL;
+	/*check if the interface is down */
+	if (!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE)) {
+		DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
+		return -ENETDOWN;
 	}
 
-	// Reset Ralink supplicant to not use, it will be set to start when UI set PMK key
+	switch (*mode) {
+	case IW_MODE_ADHOC:
+		Set_NetworkType_Proc(pAdapter, "Adhoc");
+		break;
+	case IW_MODE_INFRA:
+		Set_NetworkType_Proc(pAdapter, "Infra");
+		break;
+	case IW_MODE_MONITOR:
+		Set_NetworkType_Proc(pAdapter, "Monitor");
+		break;
+	default:
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("===>rt_ioctl_siwmode::SIOCSIWMODE (unknown %d)\n",
+			  *mode));
+		return -EINVAL;
+	}
+
+	/* Reset Ralink supplicant to not use, it will be set to start when UI set PMK key */
 	pAdapter->StaCfg.WpaState = SS_NOTUSE;
 
 	return 0;
 }
 
 int rt_ioctl_giwmode(struct net_device *dev,
-		   struct iw_request_info *info,
-		   __u32 *mode, char *extra)
+		     struct iw_request_info *info, __u32 * mode, char *extra)
 {
-	PRTMP_ADAPTER pAdapter = dev->ml_priv;
+	struct rt_rtmp_adapter *pAdapter = NULL;
+
+	GET_PAD_FROM_NET_DEV(pAdapter, dev);
 
 	if (ADHOC_ON(pAdapter))
 		*mode = IW_MODE_ADHOC;
-    else if (INFRA_ON(pAdapter))
+	else if (INFRA_ON(pAdapter))
 		*mode = IW_MODE_INFRA;
-    else if (MONITOR_ON(pAdapter))
-    {
-        *mode = IW_MODE_MONITOR;
-    }
-    else
-        *mode = IW_MODE_AUTO;
+	else if (MONITOR_ON(pAdapter)) {
+		*mode = IW_MODE_MONITOR;
+	} else
+		*mode = IW_MODE_AUTO;
 
 	DBGPRINT(RT_DEBUG_TRACE, ("==>rt_ioctl_giwmode(mode=%d)\n", *mode));
 	return 0;
 }
 
 int rt_ioctl_siwsens(struct net_device *dev,
-		   struct iw_request_info *info,
-		   char *name, char *extra)
+		     struct iw_request_info *info, char *name, char *extra)
 {
-	PRTMP_ADAPTER pAdapter = dev->ml_priv;
+	struct rt_rtmp_adapter *pAdapter = NULL;
+
+	GET_PAD_FROM_NET_DEV(pAdapter, dev);
 
-	//check if the interface is down
-    	if(!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE))
-    	{
-        	DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
-        	return -ENETDOWN;
-    	}
+	/*check if the interface is down */
+	if (!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE)) {
+		DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
+		return -ENETDOWN;
+	}
 
 	return 0;
 }
 
 int rt_ioctl_giwsens(struct net_device *dev,
-		   struct iw_request_info *info,
-		   char *name, char *extra)
+		     struct iw_request_info *info, char *name, char *extra)
 {
 	return 0;
 }
 
 int rt_ioctl_giwrange(struct net_device *dev,
-		   struct iw_request_info *info,
-		   struct iw_point *data, char *extra)
+		      struct iw_request_info *info,
+		      struct iw_point *data, char *extra)
 {
-	PRTMP_ADAPTER pAdapter = dev->ml_priv;
-	struct iw_range *range = (struct iw_range *) extra;
+	struct rt_rtmp_adapter *pAdapter = NULL;
+	struct iw_range *range = (struct iw_range *)extra;
 	u16 val;
 	int i;
 
-	DBGPRINT(RT_DEBUG_TRACE ,("===>rt_ioctl_giwrange\n"));
+	GET_PAD_FROM_NET_DEV(pAdapter, dev);
+
+	DBGPRINT(RT_DEBUG_TRACE, ("===>rt_ioctl_giwrange\n"));
 	data->length = sizeof(struct iw_range);
 	memset(range, 0, sizeof(struct iw_range));
 
 	range->txpower_capa = IW_TXPOW_DBM;
 
-	if (INFRA_ON(pAdapter)||ADHOC_ON(pAdapter))
-	{
+	if (INFRA_ON(pAdapter) || ADHOC_ON(pAdapter)) {
 		range->min_pmp = 1 * 1024;
 		range->max_pmp = 65535 * 1024;
 		range->min_pmt = 1 * 1024;
@@ -635,7 +526,7 @@ int rt_ioctl_giwrange(struct net_device *dev,
 		range->pmp_flags = IW_POWER_PERIOD;
 		range->pmt_flags = IW_POWER_TIMEOUT;
 		range->pm_capa = IW_POWER_PERIOD | IW_POWER_TIMEOUT |
-			IW_POWER_UNICAST_R | IW_POWER_ALL_R;
+		    IW_POWER_UNICAST_R | IW_POWER_ALL_R;
 	}
 
 	range->we_version_compiled = WIRELESS_EXT;
@@ -646,15 +537,14 @@ int rt_ioctl_giwrange(struct net_device *dev,
 	range->min_retry = 0;
 	range->max_retry = 255;
 
-	range->num_channels =  pAdapter->ChannelListNum;
+	range->num_channels = pAdapter->ChannelListNum;
 
 	val = 0;
-	for (i = 1; i <= range->num_channels; i++)
-	{
-		u32 m;
-		range->freq[val].i = pAdapter->ChannelList[i-1].Channel;
-		MAP_CHANNEL_ID_TO_KHZ(pAdapter->ChannelList[i-1].Channel, m);
-		range->freq[val].m = m * 100; /* HZ */
+	for (i = 1; i <= range->num_channels; i++) {
+		u32 m = 2412000;
+		range->freq[val].i = pAdapter->ChannelList[i - 1].Channel;
+		MAP_CHANNEL_ID_TO_KHZ(pAdapter->ChannelList[i - 1].Channel, m);
+		range->freq[val].m = m * 100;	/* OS_HZ */
 
 		range->freq[val].e = 1;
 		val++;
@@ -663,11 +553,11 @@ int rt_ioctl_giwrange(struct net_device *dev,
 	}
 	range->num_frequency = val;
 
-	range->max_qual.qual = 100; /* what is correct max? This was not
-					* documented exactly. At least
-					* 69 has been observed. */
-	range->max_qual.level = 0; /* dB */
-	range->max_qual.noise = 0; /* dB */
+	range->max_qual.qual = 100;	/* what is correct max? This was not
+					 * documented exactly. At least
+					 * 69 has been observed. */
+	range->max_qual.level = 0;	/* dB */
+	range->max_qual.noise = 0;	/* dB */
 
 	/* What would be suitable values for "average/typical" qual? */
 	range->avg_qual.qual = 20;
@@ -687,70 +577,68 @@ int rt_ioctl_giwrange(struct net_device *dev,
 
 	/* IW_ENC_CAPA_* bit field */
 	range->enc_capa = IW_ENC_CAPA_WPA | IW_ENC_CAPA_WPA2 |
-					IW_ENC_CAPA_CIPHER_TKIP | IW_ENC_CAPA_CIPHER_CCMP;
+	    IW_ENC_CAPA_CIPHER_TKIP | IW_ENC_CAPA_CIPHER_CCMP;
 
 	return 0;
 }
 
 int rt_ioctl_siwap(struct net_device *dev,
-		      struct iw_request_info *info,
-		      struct sockaddr *ap_addr, char *extra)
+		   struct iw_request_info *info,
+		   struct sockaddr *ap_addr, char *extra)
 {
-	PRTMP_ADAPTER pAdapter = dev->ml_priv;
-    NDIS_802_11_MAC_ADDRESS Bssid;
+	struct rt_rtmp_adapter *pAdapter = NULL;
+	NDIS_802_11_MAC_ADDRESS Bssid;
 
-	//check if the interface is down
-	if(!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE))
-	{
-       	DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
-       	return -ENETDOWN;
-    }
-
-	if (pAdapter->Mlme.CntlMachine.CurrState != CNTL_IDLE)
-    {
-        RT28XX_MLME_RESET_STATE_MACHINE(pAdapter);
-        DBGPRINT(RT_DEBUG_TRACE, ("!!! MLME busy, reset MLME state machine !!!\n"));
-    }
-
-    // tell CNTL state machine to call NdisMSetInformationComplete() after completing
-    // this request, because this request is initiated by NDIS.
-    pAdapter->MlmeAux.CurrReqIsFromNdis = FALSE;
-	// Prevent to connect AP again in STAMlmePeriodicExec
-	pAdapter->MlmeAux.AutoReconnectSsidLen= 32;
-
-    memset(Bssid, 0, MAC_ADDR_LEN);
-    memcpy(Bssid, ap_addr->sa_data, MAC_ADDR_LEN);
-    MlmeEnqueue(pAdapter,
-                MLME_CNTL_STATE_MACHINE,
-                OID_802_11_BSSID,
-                sizeof(NDIS_802_11_MAC_ADDRESS),
-                (VOID *)&Bssid);
-
-    DBGPRINT(RT_DEBUG_TRACE, ("IOCTL::SIOCSIWAP %02x:%02x:%02x:%02x:%02x:%02x\n",
-        Bssid[0], Bssid[1], Bssid[2], Bssid[3], Bssid[4], Bssid[5]));
+	GET_PAD_FROM_NET_DEV(pAdapter, dev);
+
+	/*check if the interface is down */
+	if (!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE)) {
+		DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
+		return -ENETDOWN;
+	}
+
+	if (pAdapter->Mlme.CntlMachine.CurrState != CNTL_IDLE) {
+		RTMP_MLME_RESET_STATE_MACHINE(pAdapter);
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("MLME busy, reset MLME state machine!\n"));
+	}
+	/* tell CNTL state machine to call NdisMSetInformationComplete() after completing */
+	/* this request, because this request is initiated by NDIS. */
+	pAdapter->MlmeAux.CurrReqIsFromNdis = FALSE;
+	/* Prevent to connect AP again in STAMlmePeriodicExec */
+	pAdapter->MlmeAux.AutoReconnectSsidLen = 32;
+
+	memset(Bssid, 0, MAC_ADDR_LEN);
+	memcpy(Bssid, ap_addr->sa_data, MAC_ADDR_LEN);
+	MlmeEnqueue(pAdapter,
+		    MLME_CNTL_STATE_MACHINE,
+		    OID_802_11_BSSID,
+		    sizeof(NDIS_802_11_MAC_ADDRESS), (void *) & Bssid);
+
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("IOCTL::SIOCSIWAP %02x:%02x:%02x:%02x:%02x:%02x\n", Bssid[0],
+		  Bssid[1], Bssid[2], Bssid[3], Bssid[4], Bssid[5]));
 
 	return 0;
 }
 
 int rt_ioctl_giwap(struct net_device *dev,
-		      struct iw_request_info *info,
-		      struct sockaddr *ap_addr, char *extra)
+		   struct iw_request_info *info,
+		   struct sockaddr *ap_addr, char *extra)
 {
-	PRTMP_ADAPTER pAdapter = dev->ml_priv;
+	struct rt_rtmp_adapter *pAdapter = NULL;
 
-	if (INFRA_ON(pAdapter) || ADHOC_ON(pAdapter))
-	{
+	GET_PAD_FROM_NET_DEV(pAdapter, dev);
+
+	if (INFRA_ON(pAdapter) || ADHOC_ON(pAdapter)) {
 		ap_addr->sa_family = ARPHRD_ETHER;
 		memcpy(ap_addr->sa_data, &pAdapter->CommonCfg.Bssid, ETH_ALEN);
 	}
-    // Add for RT2870
-    else if (pAdapter->StaCfg.WpaSupplicantUP != WPA_SUPPLICANT_DISABLE)
-    {
-        ap_addr->sa_family = ARPHRD_ETHER;
-        memcpy(ap_addr->sa_data, &pAdapter->MlmeAux.Bssid, ETH_ALEN);
-    }
-	else
-	{
+	/* Add for RT2870 */
+	else if (pAdapter->StaCfg.WpaSupplicantUP != WPA_SUPPLICANT_DISABLE) {
+		ap_addr->sa_family = ARPHRD_ETHER;
+		memcpy(ap_addr->sa_data, &pAdapter->MlmeAux.Bssid, ETH_ALEN);
+	} else {
 		DBGPRINT(RT_DEBUG_TRACE, ("IOCTL::SIOCGIWAP(=EMPTY)\n"));
 		return -ENOTCONN;
 	}
@@ -774,316 +662,317 @@ int rt_ioctl_giwap(struct net_device *dev,
  * NB: various calculations are based on the orinoco/wavelan
  *     drivers for compatibility
  */
-static void set_quality(PRTMP_ADAPTER pAdapter,
-                        struct iw_quality *iq,
-                        signed char rssi)
+static void set_quality(struct rt_rtmp_adapter *pAdapter,
+			struct iw_quality *iq, signed char rssi)
 {
 	__u8 ChannelQuality;
 
-	// Normalize Rssi
+	/* Normalize Rssi */
 	if (rssi >= -50)
 		ChannelQuality = 100;
-	else if (rssi >= -80) // between -50 ~ -80dbm
-		ChannelQuality = (__u8)(24 + ((rssi + 80) * 26)/10);
-	else if (rssi >= -90)   // between -80 ~ -90dbm
-        ChannelQuality = (__u8)((rssi + 90) * 26)/10;
+	else if (rssi >= -80)	/* between -50 ~ -80dbm */
+		ChannelQuality = (__u8) (24 + ((rssi + 80) * 26) / 10);
+	else if (rssi >= -90)	/* between -80 ~ -90dbm */
+		ChannelQuality = (__u8) ((rssi + 90) * 26) / 10;
 	else
 		ChannelQuality = 0;
 
-    iq->qual = (__u8)ChannelQuality;
+	iq->qual = (__u8) ChannelQuality;
 
-    iq->level = (__u8)(rssi);
-    iq->noise = (pAdapter->BbpWriteLatch[66] > pAdapter->BbpTuning.FalseCcaUpperThreshold) ? ((__u8)pAdapter->BbpTuning.FalseCcaUpperThreshold) : ((__u8) pAdapter->BbpWriteLatch[66]); 	// noise level (dBm)
-    iq->noise += 256 - 143;
-    iq->updated = pAdapter->iw_stats.qual.updated;
+	iq->level = (__u8) (rssi);
+	iq->noise = (pAdapter->BbpWriteLatch[66] > pAdapter->BbpTuning.FalseCcaUpperThreshold) ? ((__u8) pAdapter->BbpTuning.FalseCcaUpperThreshold) : ((__u8) pAdapter->BbpWriteLatch[66]);	/* noise level (dBm) */
+	iq->noise += 256 - 143;
+	iq->updated = pAdapter->iw_stats.qual.updated;
 }
 
 int rt_ioctl_iwaplist(struct net_device *dev,
-			struct iw_request_info *info,
-			struct iw_point *data, char *extra)
+		      struct iw_request_info *info,
+		      struct iw_point *data, char *extra)
 {
- 	PRTMP_ADAPTER pAdapter = dev->ml_priv;
+	struct rt_rtmp_adapter *pAdapter = NULL;
 
 	struct sockaddr addr[IW_MAX_AP];
 	struct iw_quality qual[IW_MAX_AP];
 	int i;
 
-   	//check if the interface is down
-    if(!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE))
-    {
-       	DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
+	GET_PAD_FROM_NET_DEV(pAdapter, dev);
+
+	/*check if the interface is down */
+	if (!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE)) {
+		DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
 		data->length = 0;
 		return 0;
-        //return -ENETDOWN;
+		/*return -ENETDOWN; */
 	}
 
-	for (i = 0; i <IW_MAX_AP ; i++)
-	{
-		if (i >=  pAdapter->ScanTab.BssNr)
+	for (i = 0; i < IW_MAX_AP; i++) {
+		if (i >= pAdapter->ScanTab.BssNr)
 			break;
 		addr[i].sa_family = ARPHRD_ETHER;
-			memcpy(addr[i].sa_data, &pAdapter->ScanTab.BssEntry[i].Bssid, MAC_ADDR_LEN);
-		set_quality(pAdapter, &qual[i], pAdapter->ScanTab.BssEntry[i].Rssi);
+		memcpy(addr[i].sa_data, &pAdapter->ScanTab.BssEntry[i].Bssid,
+		       MAC_ADDR_LEN);
+		set_quality(pAdapter, &qual[i],
+			    pAdapter->ScanTab.BssEntry[i].Rssi);
 	}
 	data->length = i;
-	memcpy(extra, &addr, i*sizeof(addr[0]));
-	data->flags = 1;		/* signal quality present (sort of) */
-	memcpy(extra + i*sizeof(addr[0]), &qual, i*sizeof(qual[i]));
+	memcpy(extra, &addr, i * sizeof(addr[0]));
+	data->flags = 1;	/* signal quality present (sort of) */
+	memcpy(extra + i * sizeof(addr[0]), &qual, i * sizeof(qual[i]));
 
 	return 0;
 }
 
 int rt_ioctl_siwscan(struct net_device *dev,
-			struct iw_request_info *info,
-			struct iw_point *data, char *extra)
+		     struct iw_request_info *info,
+		     struct iw_point *data, char *extra)
 {
-	PRTMP_ADAPTER pAdapter = dev->ml_priv;
+	struct rt_rtmp_adapter *pAdapter = NULL;
 
-	ULONG								Now;
+	unsigned long Now;
 	int Status = NDIS_STATUS_SUCCESS;
 
-	//check if the interface is down
-	if(!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE))
-	{
+	GET_PAD_FROM_NET_DEV(pAdapter, dev);
+
+	/*check if the interface is down */
+	if (!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE)) {
 		DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
 		return -ENETDOWN;
 	}
 
-	if (MONITOR_ON(pAdapter))
-    {
-        DBGPRINT(RT_DEBUG_TRACE, ("!!! Driver is in Monitor Mode now !!!\n"));
-        return -EINVAL;
-    }
-#ifdef RT2860
-	if ((pAdapter->OpMode == OPMODE_STA) && (IDLE_ON(pAdapter))
-		&& (pAdapter->StaCfg.bRadio == TRUE)
-		&& (RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_IDLE_RADIO_OFF)))
-	{
-		RT28xxPciAsicRadioOn(pAdapter, GUI_IDLE_POWER_SAVE);
+	if (MONITOR_ON(pAdapter)) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("Driver is in Monitor Mode now!\n"));
+		return -EINVAL;
 	}
-	// Check if still radio off.
-	else if (pAdapter->bPCIclkOff == TRUE)
-		return 0;
-#endif
-	if (pAdapter->StaCfg.WpaSupplicantUP == WPA_SUPPLICANT_ENABLE)
-	{
+
+	if (pAdapter->StaCfg.WpaSupplicantUP == WPA_SUPPLICANT_ENABLE) {
 		pAdapter->StaCfg.WpaSupplicantScanCount++;
 	}
 
-    pAdapter->StaCfg.bScanReqIsFromWebUI = TRUE;
+	pAdapter->StaCfg.bScanReqIsFromWebUI = TRUE;
 	if (RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS))
-		return 0;
-	do{
+		return NDIS_STATUS_SUCCESS;
+	do {
 		Now = jiffies;
 
-		if ((pAdapter->StaCfg.WpaSupplicantUP == WPA_SUPPLICANT_ENABLE) &&
-			(pAdapter->StaCfg.WpaSupplicantScanCount > 3))
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("!!! WpaSupplicantScanCount > 3\n"));
+		if ((pAdapter->StaCfg.WpaSupplicantUP == WPA_SUPPLICANT_ENABLE)
+		    && (pAdapter->StaCfg.WpaSupplicantScanCount > 3)) {
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("WpaSupplicantScanCount > 3\n"));
 			Status = NDIS_STATUS_SUCCESS;
 			break;
 		}
 
-		if ((OPSTATUS_TEST_FLAG(pAdapter, fOP_STATUS_MEDIA_STATE_CONNECTED)) &&
-			((pAdapter->StaCfg.AuthMode == Ndis802_11AuthModeWPA) ||
-			(pAdapter->StaCfg.AuthMode == Ndis802_11AuthModeWPAPSK)) &&
-			(pAdapter->StaCfg.PortSecured == WPA_802_1X_PORT_NOT_SECURED))
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("!!! Link UP, Port Not Secured! ignore this set::OID_802_11_BSSID_LIST_SCAN\n"));
+		if ((OPSTATUS_TEST_FLAG
+		     (pAdapter, fOP_STATUS_MEDIA_STATE_CONNECTED))
+		    && ((pAdapter->StaCfg.AuthMode == Ndis802_11AuthModeWPA)
+			|| (pAdapter->StaCfg.AuthMode ==
+			    Ndis802_11AuthModeWPAPSK))
+		    && (pAdapter->StaCfg.PortSecured ==
+			WPA_802_1X_PORT_NOT_SECURED)) {
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("Link UP, Port Not Secured! ignore this set::OID_802_11_BSSID_LIST_SCAN\n"));
 			Status = NDIS_STATUS_SUCCESS;
 			break;
 		}
 
-		if (pAdapter->Mlme.CntlMachine.CurrState != CNTL_IDLE)
-		{
-			RT28XX_MLME_RESET_STATE_MACHINE(pAdapter);
-			DBGPRINT(RT_DEBUG_TRACE, ("!!! MLME busy, reset MLME state machine !!!\n"));
+		if (pAdapter->Mlme.CntlMachine.CurrState != CNTL_IDLE) {
+			RTMP_MLME_RESET_STATE_MACHINE(pAdapter);
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("MLME busy, reset MLME state machine!\n"));
 		}
-
-		// tell CNTL state machine to call NdisMSetInformationComplete() after completing
-		// this request, because this request is initiated by NDIS.
+		/* tell CNTL state machine to call NdisMSetInformationComplete() after completing */
+		/* this request, because this request is initiated by NDIS. */
 		pAdapter->MlmeAux.CurrReqIsFromNdis = FALSE;
-		// Reset allowed scan retries
+		/* Reset allowed scan retries */
 		pAdapter->StaCfg.ScanCnt = 0;
 		pAdapter->StaCfg.LastScanTime = Now;
 
 		MlmeEnqueue(pAdapter,
-			MLME_CNTL_STATE_MACHINE,
-			OID_802_11_BSSID_LIST_SCAN,
-			0,
-			NULL);
+			    MLME_CNTL_STATE_MACHINE,
+			    OID_802_11_BSSID_LIST_SCAN, 0, NULL);
 
 		Status = NDIS_STATUS_SUCCESS;
-		RT28XX_MLME_HANDLER(pAdapter);
-	}while(0);
-	return 0;
+		RTMP_MLME_HANDLER(pAdapter);
+	} while (0);
+	return NDIS_STATUS_SUCCESS;
 }
 
 int rt_ioctl_giwscan(struct net_device *dev,
-			struct iw_request_info *info,
-			struct iw_point *data, char *extra)
+		     struct iw_request_info *info,
+		     struct iw_point *data, char *extra)
 {
-
-	PRTMP_ADAPTER pAdapter = dev->ml_priv;
-	int i=0;
+	struct rt_rtmp_adapter *pAdapter = NULL;
+	int i = 0;
 	char *current_ev = extra, *previous_ev = extra;
 	char *end_buf;
-	char *current_val, custom[MAX_CUSTOM_LEN] = {0};
+	char *current_val;
+	char custom[MAX_CUSTOM_LEN] = { 0 };
 	struct iw_event iwe;
 
-	if (RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS))
-    {
+	GET_PAD_FROM_NET_DEV(pAdapter, dev);
+
+	if (RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS)) {
 		/*
 		 * Still scanning, indicate the caller should try again.
 		 */
 		return -EAGAIN;
 	}
 
-	if (pAdapter->StaCfg.WpaSupplicantUP == WPA_SUPPLICANT_ENABLE)
-	{
+	if (pAdapter->StaCfg.WpaSupplicantUP == WPA_SUPPLICANT_ENABLE) {
 		pAdapter->StaCfg.WpaSupplicantScanCount = 0;
 	}
 
-	if (pAdapter->ScanTab.BssNr == 0)
-	{
+	if (pAdapter->ScanTab.BssNr == 0) {
 		data->length = 0;
 		return 0;
 	}
 
-    if (data->length > 0)
-        end_buf = extra + data->length;
-    else
-        end_buf = extra + IW_SCAN_MAX_DATA;
+	if (data->length > 0)
+		end_buf = extra + data->length;
+	else
+		end_buf = extra + IW_SCAN_MAX_DATA;
 
-	for (i = 0; i < pAdapter->ScanTab.BssNr; i++)
-	{
-		if (current_ev >= end_buf)
+	for (i = 0; i < pAdapter->ScanTab.BssNr; i++) {
+		if (current_ev >= end_buf) {
 			return -E2BIG;
-
-		//MAC address
-		//================================
+		}
+		/*MAC address */
+		/*================================ */
 		memset(&iwe, 0, sizeof(iwe));
 		iwe.cmd = SIOCGIWAP;
 		iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
-		memcpy(iwe.u.ap_addr.sa_data, &pAdapter->ScanTab.BssEntry[i].Bssid, ETH_ALEN);
+		memcpy(iwe.u.ap_addr.sa_data,
+		       &pAdapter->ScanTab.BssEntry[i].Bssid, ETH_ALEN);
 
-        previous_ev = current_ev;
-		current_ev = iwe_stream_add_event(info, current_ev,end_buf, &iwe, IW_EV_ADDR_LEN);
-        if (current_ev == previous_ev)
-		return -E2BIG;
+		previous_ev = current_ev;
+		current_ev =
+		    iwe_stream_add_event(info, current_ev, end_buf, &iwe,
+					 IW_EV_ADDR_LEN);
+		if (current_ev == previous_ev)
+			return -E2BIG;
 
 		/*
-		Protocol:
-			it will show scanned AP's WirelessMode .
-			it might be
-					802.11a
-					802.11a/n
-					802.11g/n
-					802.11b/g/n
-					802.11g
-					802.11b/g
-		*/
+		   Protocol:
+		   it will show scanned AP's WirelessMode .
+		   it might be
+		   802.11a
+		   802.11a/n
+		   802.11g/n
+		   802.11b/g/n
+		   802.11g
+		   802.11b/g
+		 */
 		memset(&iwe, 0, sizeof(iwe));
 		iwe.cmd = SIOCGIWNAME;
 
-
-	{
-		PBSS_ENTRY pBssEntry=&pAdapter->ScanTab.BssEntry[i];
-		BOOLEAN isGonly=FALSE;
-		int rateCnt=0;
-
-		if (pBssEntry->Channel>14)
 		{
-			if (pBssEntry->HtCapabilityLen!=0)
-				strcpy(iwe.u.name,"802.11a/n");
-			else
-				strcpy(iwe.u.name,"802.11a");
-		}
-		else
-		{
-			/*
-				if one of non B mode rate is set supported rate . it mean G only.
-			*/
-			for (rateCnt=0;rateCnt<pBssEntry->SupRateLen;rateCnt++)
-			{
-				/*
-					6Mbps(140) 9Mbps(146) and >=12Mbps(152) are supported rate , it mean G only.
-				*/
-				if (pBssEntry->SupRate[rateCnt]==140 || pBssEntry->SupRate[rateCnt]==146 || pBssEntry->SupRate[rateCnt]>=152)
-					isGonly=TRUE;
-			}
+			struct rt_bss_entry *pBssEntry = &pAdapter->ScanTab.BssEntry[i];
+			BOOLEAN isGonly = FALSE;
+			int rateCnt = 0;
 
-			for (rateCnt=0;rateCnt<pBssEntry->ExtRateLen;rateCnt++)
-			{
-				if (pBssEntry->ExtRate[rateCnt]==140 || pBssEntry->ExtRate[rateCnt]==146 || pBssEntry->ExtRate[rateCnt]>=152)
-					isGonly=TRUE;
-			}
+			if (pBssEntry->Channel > 14) {
+				if (pBssEntry->HtCapabilityLen != 0)
+					strcpy(iwe.u.name, "802.11a/n");
+				else
+					strcpy(iwe.u.name, "802.11a");
+			} else {
+				/*
+				   if one of non B mode rate is set supported rate . it mean G only.
+				 */
+				for (rateCnt = 0;
+				     rateCnt < pBssEntry->SupRateLen;
+				     rateCnt++) {
+					/*
+					   6Mbps(140) 9Mbps(146) and >=12Mbps(152) are supported rate , it mean G only.
+					 */
+					if (pBssEntry->SupRate[rateCnt] == 140
+					    || pBssEntry->SupRate[rateCnt] ==
+					    146
+					    || pBssEntry->SupRate[rateCnt] >=
+					    152)
+						isGonly = TRUE;
+				}
 
+				for (rateCnt = 0;
+				     rateCnt < pBssEntry->ExtRateLen;
+				     rateCnt++) {
+					if (pBssEntry->ExtRate[rateCnt] == 140
+					    || pBssEntry->ExtRate[rateCnt] ==
+					    146
+					    || pBssEntry->ExtRate[rateCnt] >=
+					    152)
+						isGonly = TRUE;
+				}
 
-			if (pBssEntry->HtCapabilityLen!=0)
-			{
-				if (isGonly==TRUE)
-					strcpy(iwe.u.name,"802.11g/n");
-				else
-					strcpy(iwe.u.name,"802.11b/g/n");
-			}
-			else
-			{
-				if (isGonly==TRUE)
-					strcpy(iwe.u.name,"802.11g");
-				else
-				{
-					if (pBssEntry->SupRateLen==4 && pBssEntry->ExtRateLen==0)
-						strcpy(iwe.u.name,"802.11b");
+				if (pBssEntry->HtCapabilityLen != 0) {
+					if (isGonly == TRUE)
+						strcpy(iwe.u.name, "802.11g/n");
 					else
-						strcpy(iwe.u.name,"802.11b/g");
+						strcpy(iwe.u.name,
+						       "802.11b/g/n");
+				} else {
+					if (isGonly == TRUE)
+						strcpy(iwe.u.name, "802.11g");
+					else {
+						if (pBssEntry->SupRateLen == 4
+						    && pBssEntry->ExtRateLen ==
+						    0)
+							strcpy(iwe.u.name,
+							       "802.11b");
+						else
+							strcpy(iwe.u.name,
+							       "802.11b/g");
+					}
 				}
 			}
 		}
-	}
 
 		previous_ev = current_ev;
-		current_ev	 = iwe_stream_add_event(info, current_ev, end_buf, &iwe, IW_EV_ADDR_LEN);
-        if (current_ev == previous_ev)
-		return -E2BIG;
+		current_ev =
+		    iwe_stream_add_event(info, current_ev, end_buf, &iwe,
+					 IW_EV_ADDR_LEN);
+		if (current_ev == previous_ev)
+			return -E2BIG;
 
-		//ESSID
-		//================================
+		/*ESSID */
+		/*================================ */
 		memset(&iwe, 0, sizeof(iwe));
 		iwe.cmd = SIOCGIWESSID;
 		iwe.u.data.length = pAdapter->ScanTab.BssEntry[i].SsidLen;
 		iwe.u.data.flags = 1;
 
-        previous_ev = current_ev;
-		current_ev = iwe_stream_add_point(info, current_ev,end_buf, &iwe, pAdapter->ScanTab.BssEntry[i].Ssid);
-        if (current_ev == previous_ev)
-		return -E2BIG;
+		previous_ev = current_ev;
+		current_ev =
+		    iwe_stream_add_point(info, current_ev, end_buf, &iwe,
+					 (char *)pAdapter->ScanTab.
+					 BssEntry[i].Ssid);
+		if (current_ev == previous_ev)
+			return -E2BIG;
 
-		//Network Type
-		//================================
+		/*Network Type */
+		/*================================ */
 		memset(&iwe, 0, sizeof(iwe));
 		iwe.cmd = SIOCGIWMODE;
-		if (pAdapter->ScanTab.BssEntry[i].BssType == Ndis802_11IBSS)
-		{
+		if (pAdapter->ScanTab.BssEntry[i].BssType == Ndis802_11IBSS) {
 			iwe.u.mode = IW_MODE_ADHOC;
-		}
-		else if (pAdapter->ScanTab.BssEntry[i].BssType == Ndis802_11Infrastructure)
-		{
+		} else if (pAdapter->ScanTab.BssEntry[i].BssType ==
+			   Ndis802_11Infrastructure) {
 			iwe.u.mode = IW_MODE_INFRA;
-		}
-		else
-		{
+		} else {
 			iwe.u.mode = IW_MODE_AUTO;
 		}
 		iwe.len = IW_EV_UINT_LEN;
 
-        previous_ev = current_ev;
-		current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe,  IW_EV_UINT_LEN);
-        if (current_ev == previous_ev)
-		return -E2BIG;
+		previous_ev = current_ev;
+		current_ev =
+		    iwe_stream_add_event(info, current_ev, end_buf, &iwe,
+					 IW_EV_UINT_LEN);
+		if (current_ev == previous_ev)
+			return -E2BIG;
 
-		//Channel and Frequency
-		//================================
+		/*Channel and Frequency */
+		/*================================ */
 		memset(&iwe, 0, sizeof(iwe));
 		iwe.cmd = SIOCGIWFREQ;
 		if (INFRA_ON(pAdapter) || ADHOC_ON(pAdapter))
@@ -1094,172 +983,217 @@ int rt_ioctl_giwscan(struct net_device *dev,
 		iwe.u.freq.i = 0;
 
 		previous_ev = current_ev;
-		current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe, IW_EV_FREQ_LEN);
-        if (current_ev == previous_ev)
-		return -E2BIG;
-
-        //Add quality statistics
-        //================================
-        memset(&iwe, 0, sizeof(iwe));
-    	iwe.cmd = IWEVQUAL;
-    	iwe.u.qual.level = 0;
-    	iwe.u.qual.noise = 0;
-        set_quality(pAdapter, &iwe.u.qual, pAdapter->ScanTab.BssEntry[i].Rssi);
-    	current_ev = iwe_stream_add_event(info, current_ev, end_buf, &iwe, IW_EV_QUAL_LEN);
-        if (current_ev == previous_ev)
-		return -E2BIG;
-
-		//Encyption key
-		//================================
+		current_ev =
+		    iwe_stream_add_event(info, current_ev, end_buf, &iwe,
+					 IW_EV_FREQ_LEN);
+		if (current_ev == previous_ev)
+			return -E2BIG;
+
+		/*Add quality statistics */
+		/*================================ */
+		memset(&iwe, 0, sizeof(iwe));
+		iwe.cmd = IWEVQUAL;
+		iwe.u.qual.level = 0;
+		iwe.u.qual.noise = 0;
+		set_quality(pAdapter, &iwe.u.qual,
+			    pAdapter->ScanTab.BssEntry[i].Rssi);
+		current_ev =
+		    iwe_stream_add_event(info, current_ev, end_buf, &iwe,
+					 IW_EV_QUAL_LEN);
+		if (current_ev == previous_ev)
+			return -E2BIG;
+
+		/*Encyption key */
+		/*================================ */
 		memset(&iwe, 0, sizeof(iwe));
 		iwe.cmd = SIOCGIWENCODE;
-		if (CAP_IS_PRIVACY_ON (pAdapter->ScanTab.BssEntry[i].CapabilityInfo ))
-			iwe.u.data.flags =IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
+		if (CAP_IS_PRIVACY_ON
+		    (pAdapter->ScanTab.BssEntry[i].CapabilityInfo))
+			iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
 		else
 			iwe.u.data.flags = IW_ENCODE_DISABLED;
 
-        previous_ev = current_ev;
-        current_ev = iwe_stream_add_point(info, current_ev, end_buf,&iwe, (char *)pAdapter->SharedKey[BSS0][(iwe.u.data.flags & IW_ENCODE_INDEX)-1].Key);
-        if (current_ev == previous_ev)
-		return -E2BIG;
+		previous_ev = current_ev;
+		current_ev =
+		    iwe_stream_add_point(info, current_ev, end_buf, &iwe,
+					 (char *)pAdapter->
+					 SharedKey[BSS0][(iwe.u.data.
+							  flags &
+							  IW_ENCODE_INDEX) -
+							 1].Key);
+		if (current_ev == previous_ev)
+			return -E2BIG;
 
-		//Bit Rate
-		//================================
-		if (pAdapter->ScanTab.BssEntry[i].SupRateLen)
-        {
-            UCHAR tmpRate = pAdapter->ScanTab.BssEntry[i].SupRate[pAdapter->ScanTab.BssEntry[i].SupRateLen-1];
+		/*Bit Rate */
+		/*================================ */
+		if (pAdapter->ScanTab.BssEntry[i].SupRateLen) {
+			u8 tmpRate =
+			    pAdapter->ScanTab.BssEntry[i].SupRate[pAdapter->
+								  ScanTab.
+								  BssEntry[i].
+								  SupRateLen -
+								  1];
 			memset(&iwe, 0, sizeof(iwe));
 			iwe.cmd = SIOCGIWRATE;
-    		current_val = current_ev + IW_EV_LCP_LEN;
-            if (tmpRate == 0x82)
-                iwe.u.bitrate.value =  1 * 1000000;
-            else if (tmpRate == 0x84)
-                iwe.u.bitrate.value =  2 * 1000000;
-            else if (tmpRate == 0x8B)
-                iwe.u.bitrate.value =  5.5 * 1000000;
-            else if (tmpRate == 0x96)
-                iwe.u.bitrate.value =  11 * 1000000;
-            else
-    		    iwe.u.bitrate.value =  (tmpRate/2) * 1000000;
+			current_val = current_ev + IW_EV_LCP_LEN;
+			if (tmpRate == 0x82)
+				iwe.u.bitrate.value = 1 * 1000000;
+			else if (tmpRate == 0x84)
+				iwe.u.bitrate.value = 2 * 1000000;
+			else if (tmpRate == 0x8B)
+				iwe.u.bitrate.value = 5.5 * 1000000;
+			else if (tmpRate == 0x96)
+				iwe.u.bitrate.value = 11 * 1000000;
+			else
+				iwe.u.bitrate.value = (tmpRate / 2) * 1000000;
+
+			if (tmpRate == 0x6c
+			    && pAdapter->ScanTab.BssEntry[i].HtCapabilityLen >
+			    0) {
+				int rate_count =
+				    sizeof(ralinkrate) / sizeof(__s32);
+				struct rt_ht_cap_info capInfo =
+				    pAdapter->ScanTab.BssEntry[i].HtCapability.
+				    HtCapInfo;
+				int shortGI =
+				    capInfo.ChannelWidth ? capInfo.
+				    ShortGIfor40 : capInfo.ShortGIfor20;
+				int maxMCS =
+				    pAdapter->ScanTab.BssEntry[i].HtCapability.
+				    MCSSet[1] ? 15 : 7;
+				int rate_index =
+				    12 + ((u8)capInfo.ChannelWidth * 24) +
+				    ((u8)shortGI * 48) + ((u8)maxMCS);
+				if (rate_index < 0)
+					rate_index = 0;
+				if (rate_index > rate_count)
+					rate_index = rate_count;
+				iwe.u.bitrate.value =
+				    ralinkrate[rate_index] * 500000;
+			}
 
 			iwe.u.bitrate.disabled = 0;
 			current_val = iwe_stream_add_value(info, current_ev,
-				current_val, end_buf, &iwe,
-    			IW_EV_PARAM_LEN);
+							   current_val, end_buf,
+							   &iwe,
+							   IW_EV_PARAM_LEN);
 
-        	if((current_val-current_ev)>IW_EV_LCP_LEN)
-            	current_ev = current_val;
-        	else
-			return -E2BIG;
-        }
-
-		//WPA IE
-		if (pAdapter->ScanTab.BssEntry[i].WpaIE.IELen > 0)
-		{
+			if ((current_val - current_ev) > IW_EV_LCP_LEN)
+				current_ev = current_val;
+			else
+				return -E2BIG;
+		}
+		/*WPA IE */
+		if (pAdapter->ScanTab.BssEntry[i].WpaIE.IELen > 0) {
 			memset(&iwe, 0, sizeof(iwe));
 			memset(&custom[0], 0, MAX_CUSTOM_LEN);
-			memcpy(custom, &(pAdapter->ScanTab.BssEntry[i].WpaIE.IE[0]),
-						   pAdapter->ScanTab.BssEntry[i].WpaIE.IELen);
+			memcpy(custom,
+			       &(pAdapter->ScanTab.BssEntry[i].WpaIE.IE[0]),
+			       pAdapter->ScanTab.BssEntry[i].WpaIE.IELen);
 			iwe.cmd = IWEVGENIE;
-			iwe.u.data.length = pAdapter->ScanTab.BssEntry[i].WpaIE.IELen;
-			current_ev = iwe_stream_add_point(info, current_ev, end_buf, &iwe, custom);
+			iwe.u.data.length =
+			    pAdapter->ScanTab.BssEntry[i].WpaIE.IELen;
+			current_ev =
+			    iwe_stream_add_point(info, current_ev, end_buf,
+						 &iwe, custom);
 			if (current_ev == previous_ev)
 				return -E2BIG;
 		}
-
-		//WPA2 IE
-        if (pAdapter->ScanTab.BssEntry[i].RsnIE.IELen > 0)
-        {
-        	memset(&iwe, 0, sizeof(iwe));
+		/*WPA2 IE */
+		if (pAdapter->ScanTab.BssEntry[i].RsnIE.IELen > 0) {
+			memset(&iwe, 0, sizeof(iwe));
 			memset(&custom[0], 0, MAX_CUSTOM_LEN);
-			memcpy(custom, &(pAdapter->ScanTab.BssEntry[i].RsnIE.IE[0]),
-						   pAdapter->ScanTab.BssEntry[i].RsnIE.IELen);
+			memcpy(custom,
+			       &(pAdapter->ScanTab.BssEntry[i].RsnIE.IE[0]),
+			       pAdapter->ScanTab.BssEntry[i].RsnIE.IELen);
 			iwe.cmd = IWEVGENIE;
-			iwe.u.data.length = pAdapter->ScanTab.BssEntry[i].RsnIE.IELen;
-			current_ev = iwe_stream_add_point(info, current_ev, end_buf, &iwe, custom);
+			iwe.u.data.length =
+			    pAdapter->ScanTab.BssEntry[i].RsnIE.IELen;
+			current_ev =
+			    iwe_stream_add_point(info, current_ev, end_buf,
+						 &iwe, custom);
 			if (current_ev == previous_ev)
 				return -E2BIG;
-        }
+		}
 	}
 
 	data->length = current_ev - extra;
-    pAdapter->StaCfg.bScanReqIsFromWebUI = FALSE;
-	DBGPRINT(RT_DEBUG_ERROR ,("===>rt_ioctl_giwscan. %d(%d) BSS returned, data->length = %d\n",i , pAdapter->ScanTab.BssNr, data->length));
+	pAdapter->StaCfg.bScanReqIsFromWebUI = FALSE;
+	DBGPRINT(RT_DEBUG_ERROR,
+		 ("===>rt_ioctl_giwscan. %d(%d) BSS returned, data->length = %d\n",
+		  i, pAdapter->ScanTab.BssNr, data->length));
 	return 0;
 }
 
 int rt_ioctl_siwessid(struct net_device *dev,
-			 struct iw_request_info *info,
-			 struct iw_point *data, char *essid)
+		      struct iw_request_info *info,
+		      struct iw_point *data, char *essid)
 {
-	PRTMP_ADAPTER pAdapter = dev->ml_priv;
+	struct rt_rtmp_adapter *pAdapter = NULL;
 
-	//check if the interface is down
-    if(!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE))
-    {
-       	DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
-       	return -ENETDOWN;
-    }
+	GET_PAD_FROM_NET_DEV(pAdapter, dev);
 
-	if (data->flags)
-	{
-		PCHAR	pSsidString = NULL;
+	/*check if the interface is down */
+	if (!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE)) {
+		DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
+		return -ENETDOWN;
+	}
 
-		// Includes null character.
+	if (data->flags) {
+		char *pSsidString = NULL;
+
+		/* Includes null character. */
 		if (data->length > (IW_ESSID_MAX_SIZE + 1))
 			return -E2BIG;
 
-		pSsidString = (CHAR *) kmalloc(MAX_LEN_OF_SSID+1, MEM_ALLOC_FLAG);
-		if (pSsidString)
-		{
-			NdisZeroMemory(pSsidString, MAX_LEN_OF_SSID+1);
+		pSsidString = kmalloc(MAX_LEN_OF_SSID + 1, MEM_ALLOC_FLAG);
+		if (pSsidString) {
+			NdisZeroMemory(pSsidString, MAX_LEN_OF_SSID + 1);
 			NdisMoveMemory(pSsidString, essid, data->length);
 			if (Set_SSID_Proc(pAdapter, pSsidString) == FALSE)
 				return -EINVAL;
-		}
-		else
+		} else
 			return -ENOMEM;
-	}
-	else
-	{
-		// ANY ssid
+	} else {
+		/* ANY ssid */
 		if (Set_SSID_Proc(pAdapter, "") == FALSE)
 			return -EINVAL;
-    }
+	}
 	return 0;
 }
 
 int rt_ioctl_giwessid(struct net_device *dev,
-			 struct iw_request_info *info,
-			 struct iw_point *data, char *essid)
+		      struct iw_request_info *info,
+		      struct iw_point *data, char *essid)
 {
-	PRTMP_ADAPTER pAdapter = dev->ml_priv;
+	struct rt_rtmp_adapter *pAdapter = NULL;
+
+	GET_PAD_FROM_NET_DEV(pAdapter, dev);
 
 	data->flags = 1;
-    if (MONITOR_ON(pAdapter))
-    {
-        data->length  = 0;
-        return 0;
-    }
+	if (MONITOR_ON(pAdapter)) {
+		data->length = 0;
+		return 0;
+	}
 
-	if (OPSTATUS_TEST_FLAG(pAdapter, fOP_STATUS_MEDIA_STATE_CONNECTED))
-	{
-		DBGPRINT(RT_DEBUG_TRACE ,("MediaState is connected\n"));
+	if (OPSTATUS_TEST_FLAG(pAdapter, fOP_STATUS_MEDIA_STATE_CONNECTED)) {
+		DBGPRINT(RT_DEBUG_TRACE, ("MediaState is connected\n"));
 		data->length = pAdapter->CommonCfg.SsidLen;
-		memcpy(essid, pAdapter->CommonCfg.Ssid, pAdapter->CommonCfg.SsidLen);
+		memcpy(essid, pAdapter->CommonCfg.Ssid,
+		       pAdapter->CommonCfg.SsidLen);
 	}
-#ifdef RT2870
-    // Add for RT2870
-    else if (pAdapter->StaCfg.WpaSupplicantUP != WPA_SUPPLICANT_DISABLE)
-    {
-        data->length = pAdapter->CommonCfg.SsidLen;
-		memcpy(essid, pAdapter->CommonCfg.Ssid, pAdapter->CommonCfg.SsidLen);
+#ifdef RTMP_MAC_USB
+	/* Add for RT2870 */
+	else if (pAdapter->StaCfg.WpaSupplicantUP != WPA_SUPPLICANT_DISABLE) {
+		data->length = pAdapter->CommonCfg.SsidLen;
+		memcpy(essid, pAdapter->CommonCfg.Ssid,
+		       pAdapter->CommonCfg.SsidLen);
 	}
-#endif // RT2870 //
-	else
-	{//the ANY ssid was specified
-		data->length  = 0;
-		DBGPRINT(RT_DEBUG_TRACE ,("MediaState is not connected, ess\n"));
+#endif /* RTMP_MAC_USB // */
+	else {			/*the ANY ssid was specified */
+		data->length = 0;
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("MediaState is not connected, ess\n"));
 	}
 
 	return 0;
@@ -1267,17 +1201,18 @@ int rt_ioctl_giwessid(struct net_device *dev,
 }
 
 int rt_ioctl_siwnickn(struct net_device *dev,
-			 struct iw_request_info *info,
-			 struct iw_point *data, char *nickname)
+		      struct iw_request_info *info,
+		      struct iw_point *data, char *nickname)
 {
-	PRTMP_ADAPTER pAdapter = dev->ml_priv;
+	struct rt_rtmp_adapter *pAdapter = NULL;
+
+	GET_PAD_FROM_NET_DEV(pAdapter, dev);
 
-    //check if the interface is down
-    if(!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE))
-    {
-        DBGPRINT(RT_DEBUG_TRACE ,("INFO::Network is down!\n"));
-        return -ENETDOWN;
-    }
+	/*check if the interface is down */
+	if (!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE)) {
+		DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
+		return -ENETDOWN;
+	}
 
 	if (data->length > IW_ESSID_MAX_SIZE)
 		return -EINVAL;
@@ -1285,45 +1220,47 @@ int rt_ioctl_siwnickn(struct net_device *dev,
 	memset(pAdapter->nickname, 0, IW_ESSID_MAX_SIZE + 1);
 	memcpy(pAdapter->nickname, nickname, data->length);
 
-
 	return 0;
 }
 
 int rt_ioctl_giwnickn(struct net_device *dev,
-			 struct iw_request_info *info,
-			 struct iw_point *data, char *nickname)
+		      struct iw_request_info *info,
+		      struct iw_point *data, char *nickname)
 {
-	PRTMP_ADAPTER pAdapter = dev->ml_priv;
+	struct rt_rtmp_adapter *pAdapter = NULL;
+
+	GET_PAD_FROM_NET_DEV(pAdapter, dev);
 
-	if (data->length > strlen(pAdapter->nickname) + 1)
-		data->length = strlen(pAdapter->nickname) + 1;
+	if (data->length > strlen((char *)pAdapter->nickname) + 1)
+		data->length = strlen((char *)pAdapter->nickname) + 1;
 	if (data->length > 0) {
-		memcpy(nickname, pAdapter->nickname, data->length-1);
-		nickname[data->length-1] = '\0';
+		memcpy(nickname, pAdapter->nickname, data->length - 1);
+		nickname[data->length - 1] = '\0';
 	}
 	return 0;
 }
 
 int rt_ioctl_siwrts(struct net_device *dev,
-		       struct iw_request_info *info,
-		       struct iw_param *rts, char *extra)
+		    struct iw_request_info *info,
+		    struct iw_param *rts, char *extra)
 {
-	PRTMP_ADAPTER pAdapter = dev->ml_priv;
+	struct rt_rtmp_adapter *pAdapter = NULL;
 	u16 val;
 
-    //check if the interface is down
-    if(!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE))
-    {
-        DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
-        return -ENETDOWN;
-    }
+	GET_PAD_FROM_NET_DEV(pAdapter, dev);
+
+	/*check if the interface is down */
+	if (!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE)) {
+		DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
+		return -ENETDOWN;
+	}
 
 	if (rts->disabled)
 		val = MAX_RTS_THRESHOLD;
 	else if (rts->value < 0 || rts->value > MAX_RTS_THRESHOLD)
 		return -EINVAL;
 	else if (rts->value == 0)
-	    val = MAX_RTS_THRESHOLD;
+		val = MAX_RTS_THRESHOLD;
 	else
 		val = rts->value;
 
@@ -1334,17 +1271,18 @@ int rt_ioctl_siwrts(struct net_device *dev,
 }
 
 int rt_ioctl_giwrts(struct net_device *dev,
-		       struct iw_request_info *info,
-		       struct iw_param *rts, char *extra)
+		    struct iw_request_info *info,
+		    struct iw_param *rts, char *extra)
 {
-	PRTMP_ADAPTER pAdapter = dev->ml_priv;
+	struct rt_rtmp_adapter *pAdapter = NULL;
+
+	GET_PAD_FROM_NET_DEV(pAdapter, dev);
 
-	//check if the interface is down
-    	if(!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE))
-    	{
-      		DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
-        	return -ENETDOWN;
-    	}
+	/*check if the interface is down */
+	if (!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE)) {
+		DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
+		return -ENETDOWN;
+	}
 
 	rts->value = pAdapter->CommonCfg.RtsThreshold;
 	rts->disabled = (rts->value == MAX_RTS_THRESHOLD);
@@ -1354,25 +1292,27 @@ int rt_ioctl_giwrts(struct net_device *dev,
 }
 
 int rt_ioctl_siwfrag(struct net_device *dev,
-			struct iw_request_info *info,
-			struct iw_param *frag, char *extra)
+		     struct iw_request_info *info,
+		     struct iw_param *frag, char *extra)
 {
-	PRTMP_ADAPTER pAdapter = dev->ml_priv;
+	struct rt_rtmp_adapter *pAdapter = NULL;
 	u16 val;
 
-	//check if the interface is down
-    	if(!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE))
-    	{
-      		DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
-        	return -ENETDOWN;
-    	}
+	GET_PAD_FROM_NET_DEV(pAdapter, dev);
+
+	/*check if the interface is down */
+	if (!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE)) {
+		DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
+		return -ENETDOWN;
+	}
 
 	if (frag->disabled)
 		val = MAX_FRAG_THRESHOLD;
-	else if (frag->value >= MIN_FRAG_THRESHOLD && frag->value <= MAX_FRAG_THRESHOLD)
-		val = __cpu_to_le16(frag->value & ~0x1); /* even numbers only */
+	else if (frag->value >= MIN_FRAG_THRESHOLD
+		 && frag->value <= MAX_FRAG_THRESHOLD)
+		val = __cpu_to_le16(frag->value & ~0x1);	/* even numbers only */
 	else if (frag->value == 0)
-	    val = MAX_FRAG_THRESHOLD;
+		val = MAX_FRAG_THRESHOLD;
 	else
 		return -EINVAL;
 
@@ -1381,17 +1321,18 @@ int rt_ioctl_siwfrag(struct net_device *dev,
 }
 
 int rt_ioctl_giwfrag(struct net_device *dev,
-			struct iw_request_info *info,
-			struct iw_param *frag, char *extra)
+		     struct iw_request_info *info,
+		     struct iw_param *frag, char *extra)
 {
-	PRTMP_ADAPTER pAdapter = dev->ml_priv;
+	struct rt_rtmp_adapter *pAdapter = NULL;
+
+	GET_PAD_FROM_NET_DEV(pAdapter, dev);
 
-	//check if the interface is down
-    	if(!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE))
-    	{
-      		DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
-        	return -ENETDOWN;
-    	}
+	/*check if the interface is down */
+	if (!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE)) {
+		DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
+		return -ENETDOWN;
+	}
 
 	frag->value = pAdapter->CommonCfg.FragmentThreshold;
 	frag->disabled = (frag->value == MAX_FRAG_THRESHOLD);
@@ -1403,156 +1344,161 @@ int rt_ioctl_giwfrag(struct net_device *dev,
 #define MAX_WEP_KEY_SIZE 13
 #define MIN_WEP_KEY_SIZE 5
 int rt_ioctl_siwencode(struct net_device *dev,
-			  struct iw_request_info *info,
-			  struct iw_point *erq, char *extra)
+		       struct iw_request_info *info,
+		       struct iw_point *erq, char *extra)
 {
-	PRTMP_ADAPTER pAdapter = dev->ml_priv;
+	struct rt_rtmp_adapter *pAdapter = NULL;
 
-	//check if the interface is down
-    	if(!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE))
-    	{
-      		DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
-        	return -ENETDOWN;
-    	}
+	GET_PAD_FROM_NET_DEV(pAdapter, dev);
 
-	if ((erq->length == 0) &&
-        (erq->flags & IW_ENCODE_DISABLED))
-	{
+	/*check if the interface is down */
+	if (!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE)) {
+		DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
+		return -ENETDOWN;
+	}
+
+	if ((erq->length == 0) && (erq->flags & IW_ENCODE_DISABLED)) {
 		pAdapter->StaCfg.PairCipher = Ndis802_11WEPDisabled;
 		pAdapter->StaCfg.GroupCipher = Ndis802_11WEPDisabled;
 		pAdapter->StaCfg.WepStatus = Ndis802_11WEPDisabled;
-        pAdapter->StaCfg.OrigWepStatus = pAdapter->StaCfg.WepStatus;
-        pAdapter->StaCfg.AuthMode = Ndis802_11AuthModeOpen;
-        goto done;
-	} else if (
-		 (erq->flags & IW_ENCODE_RESTRICTED || erq->flags & IW_ENCODE_OPEN)) {
+		pAdapter->StaCfg.OrigWepStatus = pAdapter->StaCfg.WepStatus;
+		pAdapter->StaCfg.AuthMode = Ndis802_11AuthModeOpen;
+		goto done;
+	} else if (erq->flags & IW_ENCODE_RESTRICTED
+		   || erq->flags & IW_ENCODE_OPEN) {
+		/*pAdapter->StaCfg.PortSecured = WPA_802_1X_PORT_SECURED; */
 		STA_PORT_SECURED(pAdapter);
 		pAdapter->StaCfg.PairCipher = Ndis802_11WEPEnabled;
 		pAdapter->StaCfg.GroupCipher = Ndis802_11WEPEnabled;
 		pAdapter->StaCfg.WepStatus = Ndis802_11WEPEnabled;
-        pAdapter->StaCfg.OrigWepStatus = pAdapter->StaCfg.WepStatus;
+		pAdapter->StaCfg.OrigWepStatus = pAdapter->StaCfg.WepStatus;
 		if (erq->flags & IW_ENCODE_RESTRICTED)
 			pAdapter->StaCfg.AuthMode = Ndis802_11AuthModeShared;
-    	else
+		else
 			pAdapter->StaCfg.AuthMode = Ndis802_11AuthModeOpen;
 	}
 
-    if (erq->length > 0)
-	{
+	if (erq->length > 0) {
 		int keyIdx = (erq->flags & IW_ENCODE_INDEX) - 1;
 		/* Check the size of the key */
 		if (erq->length > MAX_WEP_KEY_SIZE) {
 			return -EINVAL;
 		}
 		/* Check key index */
-		if ((keyIdx < 0) || (keyIdx >= NR_WEP_KEYS))
-        {
-            DBGPRINT(RT_DEBUG_TRACE ,("==>rt_ioctl_siwencode::Wrong keyIdx=%d! Using default key instead (%d)\n",
-                                        keyIdx, pAdapter->StaCfg.DefaultKeyId));
+		if ((keyIdx < 0) || (keyIdx >= NR_WEP_KEYS)) {
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("==>rt_ioctl_siwencode::Wrong keyIdx=%d! Using default key instead (%d)\n",
+				  keyIdx, pAdapter->StaCfg.DefaultKeyId));
 
-            //Using default key
+			/*Using default key */
 			keyIdx = pAdapter->StaCfg.DefaultKeyId;
-        }
-		else
-			pAdapter->StaCfg.DefaultKeyId=keyIdx;
-
-        NdisZeroMemory(pAdapter->SharedKey[BSS0][keyIdx].Key,  16);
-
-		if (erq->length == MAX_WEP_KEY_SIZE)
-        {
-			pAdapter->SharedKey[BSS0][keyIdx].KeyLen = MAX_WEP_KEY_SIZE;
-            pAdapter->SharedKey[BSS0][keyIdx].CipherAlg = CIPHER_WEP128;
-		}
-		else if (erq->length == MIN_WEP_KEY_SIZE)
-        {
-            pAdapter->SharedKey[BSS0][keyIdx].KeyLen = MIN_WEP_KEY_SIZE;
-            pAdapter->SharedKey[BSS0][keyIdx].CipherAlg = CIPHER_WEP64;
-		}
-		else
+		} else
+			pAdapter->StaCfg.DefaultKeyId = keyIdx;
+
+		NdisZeroMemory(pAdapter->SharedKey[BSS0][keyIdx].Key, 16);
+
+		if (erq->length == MAX_WEP_KEY_SIZE) {
+			pAdapter->SharedKey[BSS0][keyIdx].KeyLen =
+			    MAX_WEP_KEY_SIZE;
+			pAdapter->SharedKey[BSS0][keyIdx].CipherAlg =
+			    CIPHER_WEP128;
+		} else if (erq->length == MIN_WEP_KEY_SIZE) {
+			pAdapter->SharedKey[BSS0][keyIdx].KeyLen =
+			    MIN_WEP_KEY_SIZE;
+			pAdapter->SharedKey[BSS0][keyIdx].CipherAlg =
+			    CIPHER_WEP64;
+		} else
 			/* Disable the key */
 			pAdapter->SharedKey[BSS0][keyIdx].KeyLen = 0;
 
 		/* Check if the key is not marked as invalid */
-		if(!(erq->flags & IW_ENCODE_NOKEY)) {
+		if (!(erq->flags & IW_ENCODE_NOKEY)) {
 			/* Copy the key in the driver */
-			NdisMoveMemory(pAdapter->SharedKey[BSS0][keyIdx].Key, extra, erq->length);
-        }
-	}
-    else
-			{
+			NdisMoveMemory(pAdapter->SharedKey[BSS0][keyIdx].Key,
+				       extra, erq->length);
+		}
+	} else {
 		/* Do we want to just set the transmit key index ? */
 		int index = (erq->flags & IW_ENCODE_INDEX) - 1;
-		if ((index >= 0) && (index < 4))
-        {
+		if ((index >= 0) && (index < 4)) {
 			pAdapter->StaCfg.DefaultKeyId = index;
-            }
-        else
+		} else
 			/* Don't complain if only change the mode */
-			if (!(erq->flags & IW_ENCODE_MODE)) {
-				return -EINVAL;
-		}
+		if (!(erq->flags & IW_ENCODE_MODE))
+			return -EINVAL;
 	}
 
 done:
-    DBGPRINT(RT_DEBUG_TRACE ,("==>rt_ioctl_siwencode::erq->flags=%x\n",erq->flags));
-	DBGPRINT(RT_DEBUG_TRACE ,("==>rt_ioctl_siwencode::AuthMode=%x\n",pAdapter->StaCfg.AuthMode));
-	DBGPRINT(RT_DEBUG_TRACE ,("==>rt_ioctl_siwencode::DefaultKeyId=%x, KeyLen = %d\n",pAdapter->StaCfg.DefaultKeyId , pAdapter->SharedKey[BSS0][pAdapter->StaCfg.DefaultKeyId].KeyLen));
-	DBGPRINT(RT_DEBUG_TRACE ,("==>rt_ioctl_siwencode::WepStatus=%x\n",pAdapter->StaCfg.WepStatus));
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("==>rt_ioctl_siwencode::erq->flags=%x\n", erq->flags));
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("==>rt_ioctl_siwencode::AuthMode=%x\n",
+		  pAdapter->StaCfg.AuthMode));
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("==>rt_ioctl_siwencode::DefaultKeyId=%x, KeyLen = %d\n",
+		  pAdapter->StaCfg.DefaultKeyId,
+		  pAdapter->SharedKey[BSS0][pAdapter->StaCfg.DefaultKeyId].
+		  KeyLen));
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("==>rt_ioctl_siwencode::WepStatus=%x\n",
+		  pAdapter->StaCfg.WepStatus));
 	return 0;
 }
 
 int
 rt_ioctl_giwencode(struct net_device *dev,
-			  struct iw_request_info *info,
-			  struct iw_point *erq, char *key)
+		   struct iw_request_info *info,
+		   struct iw_point *erq, char *key)
 {
-	PRTMP_ADAPTER pAdapter = dev->ml_priv;
 	int kid;
+	struct rt_rtmp_adapter *pAdapter = NULL;
 
-	//check if the interface is down
-	if(!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE))
-	{
-  		DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
-    	return -ENETDOWN;
+	GET_PAD_FROM_NET_DEV(pAdapter, dev);
+
+	/*check if the interface is down */
+	if (!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE)) {
+		DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
+		return -ENETDOWN;
 	}
 
 	kid = erq->flags & IW_ENCODE_INDEX;
-	DBGPRINT(RT_DEBUG_TRACE, ("===>rt_ioctl_giwencode %d\n", erq->flags & IW_ENCODE_INDEX));
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("===>rt_ioctl_giwencode %d\n", erq->flags & IW_ENCODE_INDEX));
 
-	if (pAdapter->StaCfg.WepStatus == Ndis802_11WEPDisabled)
-	{
+	if (pAdapter->StaCfg.WepStatus == Ndis802_11WEPDisabled) {
 		erq->length = 0;
 		erq->flags = IW_ENCODE_DISABLED;
-	}
-	else if ((kid > 0) && (kid <=4))
-	{
-		// copy wep key
-		erq->flags = kid ;			/* NB: base 1 */
-		if (erq->length > pAdapter->SharedKey[BSS0][kid-1].KeyLen)
-			erq->length = pAdapter->SharedKey[BSS0][kid-1].KeyLen;
-		memcpy(key, pAdapter->SharedKey[BSS0][kid-1].Key, erq->length);
-		//if ((kid == pAdapter->PortCfg.DefaultKeyId))
-		//erq->flags |= IW_ENCODE_ENABLED;	/* XXX */
+	} else if ((kid > 0) && (kid <= 4)) {
+		/* copy wep key */
+		erq->flags = kid;	/* NB: base 1 */
+		if (erq->length > pAdapter->SharedKey[BSS0][kid - 1].KeyLen)
+			erq->length = pAdapter->SharedKey[BSS0][kid - 1].KeyLen;
+		memcpy(key, pAdapter->SharedKey[BSS0][kid - 1].Key,
+		       erq->length);
+		/*if ((kid == pAdapter->PortCfg.DefaultKeyId)) */
+		/*erq->flags |= IW_ENCODE_ENABLED; */	/* XXX */
 		if (pAdapter->StaCfg.AuthMode == Ndis802_11AuthModeShared)
-			erq->flags |= IW_ENCODE_RESTRICTED;		/* XXX */
+			erq->flags |= IW_ENCODE_RESTRICTED;	/* XXX */
 		else
-			erq->flags |= IW_ENCODE_OPEN;		/* XXX */
+			erq->flags |= IW_ENCODE_OPEN;	/* XXX */
 
-	}
-	else if (kid == 0)
-	{
+	} else if (kid == 0) {
 		if (pAdapter->StaCfg.AuthMode == Ndis802_11AuthModeShared)
-			erq->flags |= IW_ENCODE_RESTRICTED;		/* XXX */
+			erq->flags |= IW_ENCODE_RESTRICTED;	/* XXX */
 		else
-			erq->flags |= IW_ENCODE_OPEN;		/* XXX */
-		erq->length = pAdapter->SharedKey[BSS0][pAdapter->StaCfg.DefaultKeyId].KeyLen;
-		memcpy(key, pAdapter->SharedKey[BSS0][pAdapter->StaCfg.DefaultKeyId].Key, erq->length);
-		// copy default key ID
+			erq->flags |= IW_ENCODE_OPEN;	/* XXX */
+		erq->length =
+		    pAdapter->SharedKey[BSS0][pAdapter->StaCfg.DefaultKeyId].
+		    KeyLen;
+		memcpy(key,
+		       pAdapter->SharedKey[BSS0][pAdapter->StaCfg.DefaultKeyId].
+		       Key, erq->length);
+		/* copy default key ID */
 		if (pAdapter->StaCfg.AuthMode == Ndis802_11AuthModeShared)
-			erq->flags |= IW_ENCODE_RESTRICTED;		/* XXX */
+			erq->flags |= IW_ENCODE_RESTRICTED;	/* XXX */
 		else
-			erq->flags |= IW_ENCODE_OPEN;		/* XXX */
-		erq->flags = pAdapter->StaCfg.DefaultKeyId + 1;			/* NB: base 1 */
+			erq->flags |= IW_ENCODE_OPEN;	/* XXX */
+		erq->flags = pAdapter->StaCfg.DefaultKeyId + 1;	/* NB: base 1 */
 		erq->flags |= IW_ENCODE_ENABLED;	/* XXX */
 	}
 
@@ -1560,770 +1506,585 @@ rt_ioctl_giwencode(struct net_device *dev,
 
 }
 
-static int
-rt_ioctl_setparam(struct net_device *dev, struct iw_request_info *info,
-			 void *w, char *extra)
-{
-	PRTMP_ADAPTER pAdapter = dev->ml_priv;
-	POS_COOKIE pObj = (POS_COOKIE)pAdapter->OS_Cookie;
-	char *this_char = extra;
-	char *value;
-	int  Status=0;
-
-	{
-		pObj->ioctl_if_type = INT_MAIN;
-        pObj->ioctl_if = MAIN_MBSSID;
-	}
-
-	//check if the interface is down
-    	if(!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE))
-    	{
-      		DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
-			return -ENETDOWN;
-    	}
-
-	if (!*this_char)
-		return -EINVAL;
-
-	if ((value = rtstrchr(this_char, '=')) != NULL)
-	    *value++ = 0;
-
-	if (!value)
-	    return -EINVAL;
-
-	// reject setting nothing besides ANY ssid(ssidLen=0)
-    if (!*value && (strcmp(this_char, "SSID") != 0))
-        return -EINVAL;
-
-	for (PRTMP_PRIVATE_SET_PROC = RTMP_PRIVATE_SUPPORT_PROC; PRTMP_PRIVATE_SET_PROC->name; PRTMP_PRIVATE_SET_PROC++)
-	{
-	    if (strcmp(this_char, PRTMP_PRIVATE_SET_PROC->name) == 0)
-	    {
-	        if(!PRTMP_PRIVATE_SET_PROC->set_proc(pAdapter, value))
-	        {	//FALSE:Set private failed then return Invalid argument
-			    Status = -EINVAL;
-	        }
-		    break;	//Exit for loop.
-	    }
-	}
-
-	if(PRTMP_PRIVATE_SET_PROC->name == NULL)
-	{  //Not found argument
-	    Status = -EINVAL;
-	    DBGPRINT(RT_DEBUG_TRACE, ("===>rt_ioctl_setparam:: (iwpriv) Not Support Set Command [%s=%s]\n", this_char, value));
-	}
-
-    return Status;
-}
-
-
-static int
-rt_private_get_statistics(struct net_device *dev, struct iw_request_info *info,
-		struct iw_point *wrq, char *extra)
-{
-	INT				Status = 0;
-    PRTMP_ADAPTER   pAd = dev->ml_priv;
-
-    if (extra == NULL)
-    {
-        wrq->length = 0;
-        return -EIO;
-    }
-
-    memset(extra, 0x00, IW_PRIV_SIZE_MASK);
-    sprintf(extra, "\n\n");
-
-	{
-    sprintf(extra+strlen(extra), "Tx success                      = %ld\n", (ULONG)pAd->WlanCounters.TransmittedFragmentCount.QuadPart);
-    sprintf(extra+strlen(extra), "Tx success without retry        = %ld\n", (ULONG)pAd->WlanCounters.TransmittedFragmentCount.QuadPart - (ULONG)pAd->WlanCounters.RetryCount.QuadPart);
-	}
-    sprintf(extra+strlen(extra), "Tx success after retry          = %ld\n", (ULONG)pAd->WlanCounters.RetryCount.QuadPart);
-    sprintf(extra+strlen(extra), "Tx fail to Rcv ACK after retry  = %ld\n", (ULONG)pAd->WlanCounters.FailedCount.QuadPart);
-    sprintf(extra+strlen(extra), "RTS Success Rcv CTS             = %ld\n", (ULONG)pAd->WlanCounters.RTSSuccessCount.QuadPart);
-    sprintf(extra+strlen(extra), "RTS Fail Rcv CTS                = %ld\n", (ULONG)pAd->WlanCounters.RTSFailureCount.QuadPart);
-
-    sprintf(extra+strlen(extra), "Rx success                      = %ld\n", (ULONG)pAd->WlanCounters.ReceivedFragmentCount.QuadPart);
-    sprintf(extra+strlen(extra), "Rx with CRC                     = %ld\n", (ULONG)pAd->WlanCounters.FCSErrorCount.QuadPart);
-    sprintf(extra+strlen(extra), "Rx drop due to out of resource  = %ld\n", (ULONG)pAd->Counters8023.RxNoBuffer);
-    sprintf(extra+strlen(extra), "Rx duplicate frame              = %ld\n", (ULONG)pAd->WlanCounters.FrameDuplicateCount.QuadPart);
-
-    sprintf(extra+strlen(extra), "False CCA (one second)          = %ld\n", (ULONG)pAd->RalinkCounters.OneSecFalseCCACnt);
-	{
-    	sprintf(extra+strlen(extra), "RSSI-A                          = %ld\n", (LONG)(pAd->StaCfg.RssiSample.LastRssi0 - pAd->BbpRssiToDbmDelta));
-        sprintf(extra+strlen(extra), "RSSI-B (if available)           = %ld\n", (LONG)(pAd->StaCfg.RssiSample.LastRssi1 - pAd->BbpRssiToDbmDelta));
-        sprintf(extra+strlen(extra), "RSSI-C (if available)           = %ld\n\n", (LONG)(pAd->StaCfg.RssiSample.LastRssi2 - pAd->BbpRssiToDbmDelta));
-	}
-    sprintf(extra+strlen(extra), "WpaSupplicantUP                 = %d\n\n", pAd->StaCfg.WpaSupplicantUP);
-
-    wrq->length = strlen(extra) + 1; // 1: size of '\0'
-    DBGPRINT(RT_DEBUG_TRACE, ("<== rt_private_get_statistics, wrq->length = %d\n", wrq->length));
-
-    return Status;
-}
-
-void	getBaInfo(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			pOutBuf)
+void getBaInfo(struct rt_rtmp_adapter *pAd, char *pOutBuf)
 {
-	INT i, j;
-	BA_ORI_ENTRY *pOriBAEntry;
-	BA_REC_ENTRY *pRecBAEntry;
-
-	for (i=0; i<MAX_LEN_OF_MAC_TABLE; i++)
-	{
-		PMAC_TABLE_ENTRY pEntry = &pAd->MacTab.Content[i];
-		if (((pEntry->ValidAsCLI || pEntry->ValidAsApCli) && (pEntry->Sst == SST_ASSOC))
-			|| (pEntry->ValidAsWDS) || (pEntry->ValidAsMesh))
-		{
-			sprintf(pOutBuf + strlen(pOutBuf), "\n%02X:%02X:%02X:%02X:%02X:%02X (Aid = %d) (AP) -\n",
-				pEntry->Addr[0], pEntry->Addr[1], pEntry->Addr[2],
-				pEntry->Addr[3], pEntry->Addr[4], pEntry->Addr[5], pEntry->Aid);
+	int i, j;
+	struct rt_ba_ori_entry *pOriBAEntry;
+	struct rt_ba_rec_entry *pRecBAEntry;
+
+	for (i = 0; i < MAX_LEN_OF_MAC_TABLE; i++) {
+		struct rt_mac_table_entry *pEntry = &pAd->MacTab.Content[i];
+		if (((pEntry->ValidAsCLI || pEntry->ValidAsApCli)
+		     && (pEntry->Sst == SST_ASSOC))
+		    || (pEntry->ValidAsWDS) || (pEntry->ValidAsMesh)) {
+			sprintf(pOutBuf + strlen(pOutBuf),
+				"\n%02X:%02X:%02X:%02X:%02X:%02X (Aid = %d) (AP) -\n",
+				pEntry->Addr[0], pEntry->Addr[1],
+				pEntry->Addr[2], pEntry->Addr[3],
+				pEntry->Addr[4], pEntry->Addr[5], pEntry->Aid);
 
 			sprintf(pOutBuf, "%s[Recipient]\n", pOutBuf);
-			for (j=0; j < NUM_OF_TID; j++)
-			{
-				if (pEntry->BARecWcidArray[j] != 0)
-				{
-					pRecBAEntry =&pAd->BATable.BARecEntry[pEntry->BARecWcidArray[j]];
-					sprintf(pOutBuf + strlen(pOutBuf), "TID=%d, BAWinSize=%d, LastIndSeq=%d, ReorderingPkts=%d\n", j, pRecBAEntry->BAWinSize, pRecBAEntry->LastIndSeq, pRecBAEntry->list.qlen);
+			for (j = 0; j < NUM_OF_TID; j++) {
+				if (pEntry->BARecWcidArray[j] != 0) {
+					pRecBAEntry =
+					    &pAd->BATable.BARecEntry[pEntry->
+								     BARecWcidArray
+								     [j]];
+					sprintf(pOutBuf + strlen(pOutBuf),
+						"TID=%d, BAWinSize=%d, LastIndSeq=%d, ReorderingPkts=%d\n",
+						j, pRecBAEntry->BAWinSize,
+						pRecBAEntry->LastIndSeq,
+						pRecBAEntry->list.qlen);
 				}
 			}
 			sprintf(pOutBuf, "%s\n", pOutBuf);
 
 			sprintf(pOutBuf, "%s[Originator]\n", pOutBuf);
-			for (j=0; j < NUM_OF_TID; j++)
-			{
-				if (pEntry->BAOriWcidArray[j] != 0)
-				{
-					pOriBAEntry =&pAd->BATable.BAOriEntry[pEntry->BAOriWcidArray[j]];
-					sprintf(pOutBuf + strlen(pOutBuf), "TID=%d, BAWinSize=%d, StartSeq=%d, CurTxSeq=%d\n", j, pOriBAEntry->BAWinSize, pOriBAEntry->Sequence, pEntry->TxSeq[j]);
+			for (j = 0; j < NUM_OF_TID; j++) {
+				if (pEntry->BAOriWcidArray[j] != 0) {
+					pOriBAEntry =
+					    &pAd->BATable.BAOriEntry[pEntry->
+								     BAOriWcidArray
+								     [j]];
+					sprintf(pOutBuf + strlen(pOutBuf),
+						"TID=%d, BAWinSize=%d, StartSeq=%d, CurTxSeq=%d\n",
+						j, pOriBAEntry->BAWinSize,
+						pOriBAEntry->Sequence,
+						pEntry->TxSeq[j]);
 				}
 			}
 			sprintf(pOutBuf, "%s\n\n", pOutBuf);
 		}
-        if (strlen(pOutBuf) > (IW_PRIV_SIZE_MASK - 30))
-                break;
+		if (strlen(pOutBuf) > (IW_PRIV_SIZE_MASK - 30))
+			break;
 	}
 
 	return;
 }
 
-static int
-rt_private_show(struct net_device *dev, struct iw_request_info *info,
-		struct iw_point *wrq, char *extra)
-{
-    INT				Status = 0;
-    PRTMP_ADAPTER pAd = dev->ml_priv;
-    POS_COOKIE pObj = (POS_COOKIE) pAd->OS_Cookie;
-    u32             subcmd = wrq->flags;
-
-    if (extra == NULL)
-    {
-        wrq->length = 0;
-        return -EIO;
-    }
-    memset(extra, 0x00, IW_PRIV_SIZE_MASK);
-
-	{
-		pObj->ioctl_if_type = INT_MAIN;
-        pObj->ioctl_if = MAIN_MBSSID;
-	}
-
-    switch(subcmd)
-    {
-
-        case SHOW_CONN_STATUS:
-            if (MONITOR_ON(pAd))
-            {
-                if (pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED &&
-                    pAd->CommonCfg.RegTransmitSetting.field.BW)
-                    sprintf(extra, "Monitor Mode(CentralChannel %d)\n", pAd->CommonCfg.CentralChannel);
-                else
-                    sprintf(extra, "Monitor Mode(Channel %d)\n", pAd->CommonCfg.Channel);
-            }
-            else
-            {
-                if (pAd->IndicateMediaState == NdisMediaStateConnected)
-            	{
-            	    if (INFRA_ON(pAd))
-                    {
-                    sprintf(extra, "Connected(AP: %s[%02X:%02X:%02X:%02X:%02X:%02X])\n",
-                                    pAd->CommonCfg.Ssid,
-                                    pAd->CommonCfg.Bssid[0],
-                                    pAd->CommonCfg.Bssid[1],
-                                    pAd->CommonCfg.Bssid[2],
-                                    pAd->CommonCfg.Bssid[3],
-                                    pAd->CommonCfg.Bssid[4],
-                                    pAd->CommonCfg.Bssid[5]);
-            		DBGPRINT(RT_DEBUG_TRACE ,("Ssid=%s ,Ssidlen = %d\n",pAd->CommonCfg.Ssid, pAd->CommonCfg.SsidLen));
-            	}
-                    else if (ADHOC_ON(pAd))
-                        sprintf(extra, "Connected\n");
-            	}
-            	else
-            	{
-            	    sprintf(extra, "Disconnected\n");
-            		DBGPRINT(RT_DEBUG_TRACE ,("ConnStatus is not connected\n"));
-            	}
-            }
-            wrq->length = strlen(extra) + 1; // 1: size of '\0'
-            break;
-        case SHOW_DRVIER_VERION:
-            sprintf(extra, "Driver version-%s, %s %s\n", STA_DRIVER_VERSION, __DATE__, __TIME__ );
-            wrq->length = strlen(extra) + 1; // 1: size of '\0'
-            break;
-        case SHOW_BA_INFO:
-            getBaInfo(pAd, extra);
-            wrq->length = strlen(extra) + 1; // 1: size of '\0'
-            break;
-		case SHOW_DESC_INFO:
-			{
-				Show_DescInfo_Proc(pAd, NULL);
-				wrq->length = 0; // 1: size of '\0'
-			}
-			break;
-        case RAIO_OFF:
-            if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS))
-            {
-                sprintf(extra, "Scanning\n");
-                wrq->length = strlen(extra) + 1; // 1: size of '\0'
-                break;
-            }
-            pAd->StaCfg.bSwRadio = FALSE;
-            if (pAd->StaCfg.bRadio != (pAd->StaCfg.bHwRadio && pAd->StaCfg.bSwRadio))
-            {
-                pAd->StaCfg.bRadio = (pAd->StaCfg.bHwRadio && pAd->StaCfg.bSwRadio);
-                if (pAd->StaCfg.bRadio == FALSE)
-                {
-                    MlmeRadioOff(pAd);
-                    // Update extra information
-					pAd->ExtraInfo = SW_RADIO_OFF;
-                }
-            }
-            sprintf(extra, "Radio Off\n");
-            wrq->length = strlen(extra) + 1; // 1: size of '\0'
-            break;
-        case RAIO_ON:
-#ifdef RT2870
-            if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS))
-            {
-                sprintf(extra, "Scanning\n");
-                wrq->length = strlen(extra) + 1; // 1: size of '\0'
-                break;
-            }
-#endif
-            pAd->StaCfg.bSwRadio = TRUE;
-            //if (pAd->StaCfg.bRadio != (pAd->StaCfg.bHwRadio && pAd->StaCfg.bSwRadio))
-            {
-                pAd->StaCfg.bRadio = (pAd->StaCfg.bHwRadio && pAd->StaCfg.bSwRadio);
-                if (pAd->StaCfg.bRadio == TRUE)
-                {
-                    MlmeRadioOn(pAd);
-                    // Update extra information
-					pAd->ExtraInfo = EXTRA_INFO_CLEAR;
-                }
-            }
-            sprintf(extra, "Radio On\n");
-            wrq->length = strlen(extra) + 1; // 1: size of '\0'
-            break;
-
-		case SHOW_CFG_VALUE:
-			{
-				Status = RTMPShowCfgValue(pAd, wrq->pointer, extra);
-				if (Status == 0)
-					wrq->length = strlen(extra) + 1; // 1: size of '\0'
-			}
-			break;
-        default:
-            DBGPRINT(RT_DEBUG_TRACE, ("%s - unknow subcmd = %d\n", __func__, subcmd));
-            break;
-    }
-
-    return Status;
-}
-
 int rt_ioctl_siwmlme(struct net_device *dev,
-			   struct iw_request_info *info,
-			   union iwreq_data *wrqu,
-			   char *extra)
+		     struct iw_request_info *info,
+		     union iwreq_data *wrqu, char *extra)
 {
-	PRTMP_ADAPTER   pAd = dev->ml_priv;
+	struct rt_rtmp_adapter *pAd = NULL;
 	struct iw_mlme *pMlme = (struct iw_mlme *)wrqu->data.pointer;
-	MLME_QUEUE_ELEM				MsgElem;
-	MLME_DISASSOC_REQ_STRUCT	DisAssocReq;
-	MLME_DEAUTH_REQ_STRUCT      DeAuthReq;
+	struct rt_mlme_queue_elem MsgElem;
+	struct rt_mlme_disassoc_req DisAssocReq;
+	struct rt_mlme_deauth_req DeAuthReq;
+
+	GET_PAD_FROM_NET_DEV(pAd, dev);
 
 	DBGPRINT(RT_DEBUG_TRACE, ("====> %s\n", __func__));
 
 	if (pMlme == NULL)
 		return -EINVAL;
 
-	switch(pMlme->cmd)
-	{
+	switch (pMlme->cmd) {
 #ifdef IW_MLME_DEAUTH
-		case IW_MLME_DEAUTH:
-			DBGPRINT(RT_DEBUG_TRACE, ("====> %s - IW_MLME_DEAUTH\n", __func__));
-			COPY_MAC_ADDR(DeAuthReq.Addr, pAd->CommonCfg.Bssid);
-			DeAuthReq.Reason = pMlme->reason_code;
-			MsgElem.MsgLen = sizeof(MLME_DEAUTH_REQ_STRUCT);
-			NdisMoveMemory(MsgElem.Msg, &DeAuthReq, sizeof(MLME_DEAUTH_REQ_STRUCT));
-			MlmeDeauthReqAction(pAd, &MsgElem);
-			if (INFRA_ON(pAd))
-			{
-			    LinkDown(pAd, FALSE);
-			    pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
-			}
-			break;
-#endif // IW_MLME_DEAUTH //
+	case IW_MLME_DEAUTH:
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("====> %s - IW_MLME_DEAUTH\n", __func__));
+		COPY_MAC_ADDR(DeAuthReq.Addr, pAd->CommonCfg.Bssid);
+		DeAuthReq.Reason = pMlme->reason_code;
+		MsgElem.MsgLen = sizeof(struct rt_mlme_deauth_req);
+		NdisMoveMemory(MsgElem.Msg, &DeAuthReq,
+			       sizeof(struct rt_mlme_deauth_req));
+		MlmeDeauthReqAction(pAd, &MsgElem);
+		if (INFRA_ON(pAd)) {
+			LinkDown(pAd, FALSE);
+			pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
+		}
+		break;
+#endif /* IW_MLME_DEAUTH // */
 #ifdef IW_MLME_DISASSOC
-		case IW_MLME_DISASSOC:
-			DBGPRINT(RT_DEBUG_TRACE, ("====> %s - IW_MLME_DISASSOC\n", __func__));
-			COPY_MAC_ADDR(DisAssocReq.Addr, pAd->CommonCfg.Bssid);
-			DisAssocReq.Reason =  pMlme->reason_code;
-
-			MsgElem.Machine = ASSOC_STATE_MACHINE;
-			MsgElem.MsgType = MT2_MLME_DISASSOC_REQ;
-			MsgElem.MsgLen = sizeof(MLME_DISASSOC_REQ_STRUCT);
-			NdisMoveMemory(MsgElem.Msg, &DisAssocReq, sizeof(MLME_DISASSOC_REQ_STRUCT));
-
-			pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_OID_DISASSOC;
-			MlmeDisassocReqAction(pAd, &MsgElem);
-			break;
-#endif // IW_MLME_DISASSOC //
-		default:
-			DBGPRINT(RT_DEBUG_TRACE, ("====> %s - Unknow Command\n", __func__));
-			break;
+	case IW_MLME_DISASSOC:
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("====> %s - IW_MLME_DISASSOC\n", __func__));
+		COPY_MAC_ADDR(DisAssocReq.Addr, pAd->CommonCfg.Bssid);
+		DisAssocReq.Reason = pMlme->reason_code;
+
+		MsgElem.Machine = ASSOC_STATE_MACHINE;
+		MsgElem.MsgType = MT2_MLME_DISASSOC_REQ;
+		MsgElem.MsgLen = sizeof(struct rt_mlme_disassoc_req);
+		NdisMoveMemory(MsgElem.Msg, &DisAssocReq,
+			       sizeof(struct rt_mlme_disassoc_req));
+
+		pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_OID_DISASSOC;
+		MlmeDisassocReqAction(pAd, &MsgElem);
+		break;
+#endif /* IW_MLME_DISASSOC // */
+	default:
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("====> %s - Unknow Command\n", __func__));
+		break;
 	}
 
 	return 0;
 }
 
 int rt_ioctl_siwauth(struct net_device *dev,
-			  struct iw_request_info *info,
-			  union iwreq_data *wrqu, char *extra)
+		     struct iw_request_info *info,
+		     union iwreq_data *wrqu, char *extra)
 {
-	PRTMP_ADAPTER   pAdapter = dev->ml_priv;
+	struct rt_rtmp_adapter *pAdapter = NULL;
 	struct iw_param *param = &wrqu->param;
 
-    //check if the interface is down
-	if(!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE))
-	{
-  		DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
-    	return -ENETDOWN;
+	GET_PAD_FROM_NET_DEV(pAdapter, dev);
+
+	/*check if the interface is down */
+	if (!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE)) {
+		DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
+		return -ENETDOWN;
 	}
 	switch (param->flags & IW_AUTH_INDEX) {
-    	case IW_AUTH_WPA_VERSION:
-            if (param->value == IW_AUTH_WPA_VERSION_WPA)
-            {
-                pAdapter->StaCfg.AuthMode = Ndis802_11AuthModeWPAPSK;
-				if (pAdapter->StaCfg.BssType == BSS_ADHOC)
-					pAdapter->StaCfg.AuthMode = Ndis802_11AuthModeWPANone;
-            }
-            else if (param->value == IW_AUTH_WPA_VERSION_WPA2)
-                pAdapter->StaCfg.AuthMode = Ndis802_11AuthModeWPA2PSK;
-
-            DBGPRINT(RT_DEBUG_TRACE, ("%s::IW_AUTH_WPA_VERSION - param->value = %d!\n", __func__, param->value));
-            break;
-    	case IW_AUTH_CIPHER_PAIRWISE:
-            if (param->value == IW_AUTH_CIPHER_NONE)
-            {
-                pAdapter->StaCfg.WepStatus = Ndis802_11WEPDisabled;
-                pAdapter->StaCfg.OrigWepStatus = pAdapter->StaCfg.WepStatus;
-                pAdapter->StaCfg.PairCipher = Ndis802_11WEPDisabled;
-            }
-            else if (param->value == IW_AUTH_CIPHER_WEP40 ||
-                     param->value == IW_AUTH_CIPHER_WEP104)
-            {
-                pAdapter->StaCfg.WepStatus = Ndis802_11WEPEnabled;
-                pAdapter->StaCfg.OrigWepStatus = pAdapter->StaCfg.WepStatus;
-                pAdapter->StaCfg.PairCipher = Ndis802_11WEPEnabled;
-                pAdapter->StaCfg.IEEE8021X = FALSE;
-            }
-            else if (param->value == IW_AUTH_CIPHER_TKIP)
-            {
-                pAdapter->StaCfg.WepStatus = Ndis802_11Encryption2Enabled;
-                pAdapter->StaCfg.OrigWepStatus = pAdapter->StaCfg.WepStatus;
-                pAdapter->StaCfg.PairCipher = Ndis802_11Encryption2Enabled;
-            }
-            else if (param->value == IW_AUTH_CIPHER_CCMP)
-            {
-                pAdapter->StaCfg.WepStatus = Ndis802_11Encryption3Enabled;
-                pAdapter->StaCfg.OrigWepStatus = pAdapter->StaCfg.WepStatus;
-                pAdapter->StaCfg.PairCipher = Ndis802_11Encryption3Enabled;
-            }
-            DBGPRINT(RT_DEBUG_TRACE, ("%s::IW_AUTH_CIPHER_PAIRWISE - param->value = %d!\n", __func__, param->value));
-            break;
-    	case IW_AUTH_CIPHER_GROUP:
-            if (param->value == IW_AUTH_CIPHER_NONE)
-            {
-                pAdapter->StaCfg.GroupCipher = Ndis802_11WEPDisabled;
-            }
-            else if (param->value == IW_AUTH_CIPHER_WEP40 ||
-                     param->value == IW_AUTH_CIPHER_WEP104)
-            {
-                pAdapter->StaCfg.GroupCipher = Ndis802_11WEPEnabled;
-            }
-            else if (param->value == IW_AUTH_CIPHER_TKIP)
-            {
-                pAdapter->StaCfg.GroupCipher = Ndis802_11Encryption2Enabled;
-            }
-            else if (param->value == IW_AUTH_CIPHER_CCMP)
-            {
-                pAdapter->StaCfg.GroupCipher = Ndis802_11Encryption3Enabled;
-            }
-            DBGPRINT(RT_DEBUG_TRACE, ("%s::IW_AUTH_CIPHER_GROUP - param->value = %d!\n", __func__, param->value));
-            break;
-    	case IW_AUTH_KEY_MGMT:
-            if (param->value == IW_AUTH_KEY_MGMT_802_1X)
-            {
-                if (pAdapter->StaCfg.AuthMode == Ndis802_11AuthModeWPAPSK)
-                {
-                    pAdapter->StaCfg.AuthMode = Ndis802_11AuthModeWPA;
-                    pAdapter->StaCfg.IEEE8021X = FALSE;
-                }
-                else if (pAdapter->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK)
-                {
-                    pAdapter->StaCfg.AuthMode = Ndis802_11AuthModeWPA2;
-                    pAdapter->StaCfg.IEEE8021X = FALSE;
-                }
-                else
-                    // WEP 1x
-                    pAdapter->StaCfg.IEEE8021X = TRUE;
-            }
-            else if (param->value == 0)
-            {
-				STA_PORT_SECURED(pAdapter);
-            }
-            DBGPRINT(RT_DEBUG_TRACE, ("%s::IW_AUTH_KEY_MGMT - param->value = %d!\n", __func__, param->value));
-            break;
-    	case IW_AUTH_RX_UNENCRYPTED_EAPOL:
-            break;
-    	case IW_AUTH_PRIVACY_INVOKED:
-            DBGPRINT(RT_DEBUG_TRACE, ("%s::IW_AUTH_PRIVACY_INVOKED - param->value = %d!\n", __func__, param->value));
-    		break;
-    	case IW_AUTH_DROP_UNENCRYPTED:
-            if (param->value != 0)
-                pAdapter->StaCfg.PortSecured = WPA_802_1X_PORT_NOT_SECURED;
-			else
-			{
-				STA_PORT_SECURED(pAdapter);
-			}
-            DBGPRINT(RT_DEBUG_TRACE, ("%s::IW_AUTH_WPA_VERSION - param->value = %d!\n", __func__, param->value));
-    		break;
-    	case IW_AUTH_80211_AUTH_ALG:
-			if (param->value & IW_AUTH_ALG_SHARED_KEY)
-            {
-				pAdapter->StaCfg.AuthMode = Ndis802_11AuthModeShared;
-			}
-            else if (param->value & IW_AUTH_ALG_OPEN_SYSTEM)
-            {
-				pAdapter->StaCfg.AuthMode = Ndis802_11AuthModeOpen;
-			}
-            else
-				return -EINVAL;
-            DBGPRINT(RT_DEBUG_TRACE, ("%s::IW_AUTH_80211_AUTH_ALG - param->value = %d!\n", __func__, param->value));
-			break;
-    	case IW_AUTH_WPA_ENABLED:
-    		DBGPRINT(RT_DEBUG_TRACE, ("%s::IW_AUTH_WPA_ENABLED - Driver supports WPA!(param->value = %d)\n", __func__, param->value));
-    		break;
-    	default:
-    		return -EOPNOTSUPP;
-}
+	case IW_AUTH_WPA_VERSION:
+		if (param->value == IW_AUTH_WPA_VERSION_WPA) {
+			pAdapter->StaCfg.AuthMode = Ndis802_11AuthModeWPAPSK;
+			if (pAdapter->StaCfg.BssType == BSS_ADHOC)
+				pAdapter->StaCfg.AuthMode =
+				    Ndis802_11AuthModeWPANone;
+		} else if (param->value == IW_AUTH_WPA_VERSION_WPA2)
+			pAdapter->StaCfg.AuthMode = Ndis802_11AuthModeWPA2PSK;
+
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("%s::IW_AUTH_WPA_VERSION - param->value = %d!\n",
+			  __func__, param->value));
+		break;
+	case IW_AUTH_CIPHER_PAIRWISE:
+		if (param->value == IW_AUTH_CIPHER_NONE) {
+			pAdapter->StaCfg.WepStatus = Ndis802_11WEPDisabled;
+			pAdapter->StaCfg.OrigWepStatus =
+			    pAdapter->StaCfg.WepStatus;
+			pAdapter->StaCfg.PairCipher = Ndis802_11WEPDisabled;
+		} else if (param->value == IW_AUTH_CIPHER_WEP40 ||
+			   param->value == IW_AUTH_CIPHER_WEP104) {
+			pAdapter->StaCfg.WepStatus = Ndis802_11WEPEnabled;
+			pAdapter->StaCfg.OrigWepStatus =
+			    pAdapter->StaCfg.WepStatus;
+			pAdapter->StaCfg.PairCipher = Ndis802_11WEPEnabled;
+			pAdapter->StaCfg.IEEE8021X = FALSE;
+		} else if (param->value == IW_AUTH_CIPHER_TKIP) {
+			pAdapter->StaCfg.WepStatus =
+			    Ndis802_11Encryption2Enabled;
+			pAdapter->StaCfg.OrigWepStatus =
+			    pAdapter->StaCfg.WepStatus;
+			pAdapter->StaCfg.PairCipher =
+			    Ndis802_11Encryption2Enabled;
+		} else if (param->value == IW_AUTH_CIPHER_CCMP) {
+			pAdapter->StaCfg.WepStatus =
+			    Ndis802_11Encryption3Enabled;
+			pAdapter->StaCfg.OrigWepStatus =
+			    pAdapter->StaCfg.WepStatus;
+			pAdapter->StaCfg.PairCipher =
+			    Ndis802_11Encryption3Enabled;
+		}
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("%s::IW_AUTH_CIPHER_PAIRWISE - param->value = %d!\n",
+			  __func__, param->value));
+		break;
+	case IW_AUTH_CIPHER_GROUP:
+		if (param->value == IW_AUTH_CIPHER_NONE) {
+			pAdapter->StaCfg.GroupCipher = Ndis802_11WEPDisabled;
+		} else if (param->value == IW_AUTH_CIPHER_WEP40 ||
+			   param->value == IW_AUTH_CIPHER_WEP104) {
+			pAdapter->StaCfg.GroupCipher = Ndis802_11WEPEnabled;
+		} else if (param->value == IW_AUTH_CIPHER_TKIP) {
+			pAdapter->StaCfg.GroupCipher =
+			    Ndis802_11Encryption2Enabled;
+		} else if (param->value == IW_AUTH_CIPHER_CCMP) {
+			pAdapter->StaCfg.GroupCipher =
+			    Ndis802_11Encryption3Enabled;
+		}
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("%s::IW_AUTH_CIPHER_GROUP - param->value = %d!\n",
+			  __func__, param->value));
+		break;
+	case IW_AUTH_KEY_MGMT:
+		if (param->value == IW_AUTH_KEY_MGMT_802_1X) {
+			if (pAdapter->StaCfg.AuthMode ==
+			    Ndis802_11AuthModeWPAPSK) {
+				pAdapter->StaCfg.AuthMode =
+				    Ndis802_11AuthModeWPA;
+				pAdapter->StaCfg.IEEE8021X = FALSE;
+			} else if (pAdapter->StaCfg.AuthMode ==
+				   Ndis802_11AuthModeWPA2PSK) {
+				pAdapter->StaCfg.AuthMode =
+				    Ndis802_11AuthModeWPA2;
+				pAdapter->StaCfg.IEEE8021X = FALSE;
+			} else
+				/* WEP 1x */
+				pAdapter->StaCfg.IEEE8021X = TRUE;
+		} else if (param->value == 0) {
+			/*pAdapter->StaCfg.PortSecured = WPA_802_1X_PORT_SECURED; */
+			STA_PORT_SECURED(pAdapter);
+		}
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("%s::IW_AUTH_KEY_MGMT - param->value = %d!\n",
+			  __func__, param->value));
+		break;
+	case IW_AUTH_RX_UNENCRYPTED_EAPOL:
+		break;
+	case IW_AUTH_PRIVACY_INVOKED:
+		/*if (param->value == 0)
+		   {
+		   pAdapter->StaCfg.AuthMode = Ndis802_11AuthModeOpen;
+		   pAdapter->StaCfg.WepStatus = Ndis802_11WEPDisabled;
+		   pAdapter->StaCfg.OrigWepStatus = pAdapter->StaCfg.WepStatus;
+		   pAdapter->StaCfg.PairCipher = Ndis802_11WEPDisabled;
+		   pAdapter->StaCfg.GroupCipher = Ndis802_11WEPDisabled;
+		   } */
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("%s::IW_AUTH_PRIVACY_INVOKED - param->value = %d!\n",
+			  __func__, param->value));
+		break;
+	case IW_AUTH_DROP_UNENCRYPTED:
+		if (param->value != 0)
+			pAdapter->StaCfg.PortSecured =
+			    WPA_802_1X_PORT_NOT_SECURED;
+		else {
+			/*pAdapter->StaCfg.PortSecured = WPA_802_1X_PORT_SECURED; */
+			STA_PORT_SECURED(pAdapter);
+		}
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("%s::IW_AUTH_WPA_VERSION - param->value = %d!\n",
+			  __func__, param->value));
+		break;
+	case IW_AUTH_80211_AUTH_ALG:
+		if (param->value & IW_AUTH_ALG_SHARED_KEY) {
+			pAdapter->StaCfg.AuthMode = Ndis802_11AuthModeShared;
+		} else if (param->value & IW_AUTH_ALG_OPEN_SYSTEM) {
+			pAdapter->StaCfg.AuthMode = Ndis802_11AuthModeOpen;
+		} else
+			return -EINVAL;
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("%s::IW_AUTH_80211_AUTH_ALG - param->value = %d!\n",
+			  __func__, param->value));
+		break;
+	case IW_AUTH_WPA_ENABLED:
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("%s::IW_AUTH_WPA_ENABLED - Driver supports WPA!(param->value = %d)\n",
+			  __func__, param->value));
+		break;
+	default:
+		return -EOPNOTSUPP;
+	}
 
 	return 0;
 }
 
 int rt_ioctl_giwauth(struct net_device *dev,
-			       struct iw_request_info *info,
-			       union iwreq_data *wrqu, char *extra)
+		     struct iw_request_info *info,
+		     union iwreq_data *wrqu, char *extra)
 {
-	PRTMP_ADAPTER   pAdapter = dev->ml_priv;
+	struct rt_rtmp_adapter *pAdapter = NULL;
 	struct iw_param *param = &wrqu->param;
 
-    //check if the interface is down
-	if(!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE))
-    {
-  		DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
-    	return -ENETDOWN;
-    }
+	GET_PAD_FROM_NET_DEV(pAdapter, dev);
+
+	/*check if the interface is down */
+	if (!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE)) {
+		DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
+		return -ENETDOWN;
+	}
 
 	switch (param->flags & IW_AUTH_INDEX) {
 	case IW_AUTH_DROP_UNENCRYPTED:
-        param->value = (pAdapter->StaCfg.WepStatus == Ndis802_11WEPDisabled) ? 0 : 1;
+		param->value =
+		    (pAdapter->StaCfg.WepStatus ==
+		     Ndis802_11WEPDisabled) ? 0 : 1;
 		break;
 
 	case IW_AUTH_80211_AUTH_ALG:
-        param->value = (pAdapter->StaCfg.AuthMode == Ndis802_11AuthModeShared) ? IW_AUTH_ALG_SHARED_KEY : IW_AUTH_ALG_OPEN_SYSTEM;
+		param->value =
+		    (pAdapter->StaCfg.AuthMode ==
+		     Ndis802_11AuthModeShared) ? IW_AUTH_ALG_SHARED_KEY :
+		    IW_AUTH_ALG_OPEN_SYSTEM;
 		break;
 
 	case IW_AUTH_WPA_ENABLED:
-		param->value = (pAdapter->StaCfg.AuthMode >= Ndis802_11AuthModeWPA) ? 1 : 0;
+		param->value =
+		    (pAdapter->StaCfg.AuthMode >=
+		     Ndis802_11AuthModeWPA) ? 1 : 0;
 		break;
 
 	default:
 		return -EOPNOTSUPP;
 	}
-    DBGPRINT(RT_DEBUG_TRACE, ("rt_ioctl_giwauth::param->value = %d!\n", param->value));
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("rt_ioctl_giwauth::param->value = %d!\n", param->value));
 	return 0;
 }
 
-void fnSetCipherKey(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  INT             keyIdx,
-    IN  UCHAR           CipherAlg,
-    IN  BOOLEAN         bGTK,
-    IN  struct iw_encode_ext *ext)
+void fnSetCipherKey(struct rt_rtmp_adapter *pAdapter,
+		    int keyIdx,
+		    u8 CipherAlg,
+		    IN BOOLEAN bGTK, IN struct iw_encode_ext *ext)
 {
-#ifdef RT2860
-	RTMP_CLEAR_PSFLAG(pAdapter, fRTMP_PS_CAN_GO_SLEEP);
-	if (RTMP_TEST_PSFLAG(pAdapter, fRTMP_PS_SET_PCI_CLK_OFF_COMMAND))
-	{
-		if (pAdapter->StaCfg.bRadio == FALSE)
-		{
-			RTMP_SET_PSFLAG(pAdapter, fRTMP_PS_CAN_GO_SLEEP);
-			return;
-		}
-		DBGPRINT(RT_DEBUG_TRACE,("RTMPWPAAddKeyProc1==>\n"));
-		RTMPPCIeLinkCtrlValueRestore(pAdapter, RESTORE_HALT);
-		RTMPusecDelay(6000);
-		pAdapter->bPCIclkOff = FALSE;
-	}
-#endif
-    NdisZeroMemory(&pAdapter->SharedKey[BSS0][keyIdx], sizeof(CIPHER_KEY));
-    pAdapter->SharedKey[BSS0][keyIdx].KeyLen = LEN_TKIP_EK;
-    NdisMoveMemory(pAdapter->SharedKey[BSS0][keyIdx].Key, ext->key, LEN_TKIP_EK);
-    NdisMoveMemory(pAdapter->SharedKey[BSS0][keyIdx].TxMic, ext->key + LEN_TKIP_EK, LEN_TKIP_TXMICK);
-    NdisMoveMemory(pAdapter->SharedKey[BSS0][keyIdx].RxMic, ext->key + LEN_TKIP_EK + LEN_TKIP_TXMICK, LEN_TKIP_RXMICK);
-    pAdapter->SharedKey[BSS0][keyIdx].CipherAlg = CipherAlg;
-
-    // Update group key information to ASIC Shared Key Table
+	NdisZeroMemory(&pAdapter->SharedKey[BSS0][keyIdx], sizeof(struct rt_cipher_key));
+	pAdapter->SharedKey[BSS0][keyIdx].KeyLen = LEN_TKIP_EK;
+	NdisMoveMemory(pAdapter->SharedKey[BSS0][keyIdx].Key, ext->key,
+		       LEN_TKIP_EK);
+	NdisMoveMemory(pAdapter->SharedKey[BSS0][keyIdx].TxMic,
+		       ext->key + LEN_TKIP_EK, LEN_TKIP_TXMICK);
+	NdisMoveMemory(pAdapter->SharedKey[BSS0][keyIdx].RxMic,
+		       ext->key + LEN_TKIP_EK + LEN_TKIP_TXMICK,
+		       LEN_TKIP_RXMICK);
+	pAdapter->SharedKey[BSS0][keyIdx].CipherAlg = CipherAlg;
+
+	/* Update group key information to ASIC Shared Key Table */
 	AsicAddSharedKeyEntry(pAdapter,
-						  BSS0,
-						  keyIdx,
-						  pAdapter->SharedKey[BSS0][keyIdx].CipherAlg,
-						  pAdapter->SharedKey[BSS0][keyIdx].Key,
-						  pAdapter->SharedKey[BSS0][keyIdx].TxMic,
-						  pAdapter->SharedKey[BSS0][keyIdx].RxMic);
-
-    if (bGTK)
-        // Update ASIC WCID attribute table and IVEIV table
-    	RTMPAddWcidAttributeEntry(pAdapter,
-    							  BSS0,
-    							  keyIdx,
-    							  pAdapter->SharedKey[BSS0][keyIdx].CipherAlg,
-    							  NULL);
-    else
-        // Update ASIC WCID attribute table and IVEIV table
-    	RTMPAddWcidAttributeEntry(pAdapter,
-    							  BSS0,
-    							  keyIdx,
-    							  pAdapter->SharedKey[BSS0][keyIdx].CipherAlg,
-    							  &pAdapter->MacTab.Content[BSSID_WCID]);
-#ifdef RT2860
-	RTMP_SET_PSFLAG(pAdapter, fRTMP_PS_CAN_GO_SLEEP);
-#endif
+			      BSS0,
+			      keyIdx,
+			      pAdapter->SharedKey[BSS0][keyIdx].CipherAlg,
+			      pAdapter->SharedKey[BSS0][keyIdx].Key,
+			      pAdapter->SharedKey[BSS0][keyIdx].TxMic,
+			      pAdapter->SharedKey[BSS0][keyIdx].RxMic);
+
+	if (bGTK)
+		/* Update ASIC WCID attribute table and IVEIV table */
+		RTMPAddWcidAttributeEntry(pAdapter,
+					  BSS0,
+					  keyIdx,
+					  pAdapter->SharedKey[BSS0][keyIdx].
+					  CipherAlg, NULL);
+	else
+		/* Update ASIC WCID attribute table and IVEIV table */
+		RTMPAddWcidAttributeEntry(pAdapter,
+					  BSS0,
+					  keyIdx,
+					  pAdapter->SharedKey[BSS0][keyIdx].
+					  CipherAlg,
+					  &pAdapter->MacTab.
+					  Content[BSSID_WCID]);
 }
 
 int rt_ioctl_siwencodeext(struct net_device *dev,
-			   struct iw_request_info *info,
-			   union iwreq_data *wrqu,
-			   char *extra)
-			{
-    PRTMP_ADAPTER   pAdapter = dev->ml_priv;
+			  struct iw_request_info *info,
+			  union iwreq_data *wrqu, char *extra)
+{
+	struct rt_rtmp_adapter *pAdapter = NULL;
 	struct iw_point *encoding = &wrqu->encoding;
 	struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
-    int keyIdx, alg = ext->alg;
+	int keyIdx, alg = ext->alg;
 
-    //check if the interface is down
-	if(!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE))
-	{
-  		DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
-    	return -ENETDOWN;
+	GET_PAD_FROM_NET_DEV(pAdapter, dev);
+
+	/*check if the interface is down */
+	if (!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE)) {
+		DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
+		return -ENETDOWN;
 	}
 
-    if (encoding->flags & IW_ENCODE_DISABLED)
-	{
-        keyIdx = (encoding->flags & IW_ENCODE_INDEX) - 1;
-        // set BSSID wcid entry of the Pair-wise Key table as no-security mode
-	    AsicRemovePairwiseKeyEntry(pAdapter, BSS0, BSSID_WCID);
-        pAdapter->SharedKey[BSS0][keyIdx].KeyLen = 0;
+	if (encoding->flags & IW_ENCODE_DISABLED) {
+		keyIdx = (encoding->flags & IW_ENCODE_INDEX) - 1;
+		/* set BSSID wcid entry of the Pair-wise Key table as no-security mode */
+		AsicRemovePairwiseKeyEntry(pAdapter, BSS0, BSSID_WCID);
+		pAdapter->SharedKey[BSS0][keyIdx].KeyLen = 0;
 		pAdapter->SharedKey[BSS0][keyIdx].CipherAlg = CIPHER_NONE;
-		AsicRemoveSharedKeyEntry(pAdapter, 0, (UCHAR)keyIdx);
-        NdisZeroMemory(&pAdapter->SharedKey[BSS0][keyIdx], sizeof(CIPHER_KEY));
-        DBGPRINT(RT_DEBUG_TRACE, ("%s::Remove all keys!(encoding->flags = %x)\n", __func__, encoding->flags));
-    }
-					else
-    {
-        // Get Key Index and convet to our own defined key index
-    	keyIdx = (encoding->flags & IW_ENCODE_INDEX) - 1;
-    	if((keyIdx < 0) || (keyIdx >= NR_WEP_KEYS))
-    		return -EINVAL;
-
-        if (ext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY)
-        {
-            pAdapter->StaCfg.DefaultKeyId = keyIdx;
-            DBGPRINT(RT_DEBUG_TRACE, ("%s::DefaultKeyId = %d\n", __func__, pAdapter->StaCfg.DefaultKeyId));
-        }
-
-        switch (alg) {
-    		case IW_ENCODE_ALG_NONE:
-                DBGPRINT(RT_DEBUG_TRACE, ("%s::IW_ENCODE_ALG_NONE\n", __func__));
-    			break;
-    		case IW_ENCODE_ALG_WEP:
-                DBGPRINT(RT_DEBUG_TRACE, ("%s::IW_ENCODE_ALG_WEP - ext->key_len = %d, keyIdx = %d\n", __func__, ext->key_len, keyIdx));
-    			if (ext->key_len == MAX_WEP_KEY_SIZE)
-                {
-        			pAdapter->SharedKey[BSS0][keyIdx].KeyLen = MAX_WEP_KEY_SIZE;
-                    pAdapter->SharedKey[BSS0][keyIdx].CipherAlg = CIPHER_WEP128;
-				}
-        		else if (ext->key_len == MIN_WEP_KEY_SIZE)
-                {
-                    pAdapter->SharedKey[BSS0][keyIdx].KeyLen = MIN_WEP_KEY_SIZE;
-                    pAdapter->SharedKey[BSS0][keyIdx].CipherAlg = CIPHER_WEP64;
-			}
-        		else
-                    return -EINVAL;
+		AsicRemoveSharedKeyEntry(pAdapter, 0, (u8)keyIdx);
+		NdisZeroMemory(&pAdapter->SharedKey[BSS0][keyIdx],
+			       sizeof(struct rt_cipher_key));
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("%s::Remove all keys!(encoding->flags = %x)\n",
+			  __func__, encoding->flags));
+	} else {
+		/* Get Key Index and convet to our own defined key index */
+		keyIdx = (encoding->flags & IW_ENCODE_INDEX) - 1;
+		if ((keyIdx < 0) || (keyIdx >= NR_WEP_KEYS))
+			return -EINVAL;
 
-                NdisZeroMemory(pAdapter->SharedKey[BSS0][keyIdx].Key,  16);
-			    NdisMoveMemory(pAdapter->SharedKey[BSS0][keyIdx].Key, ext->key, ext->key_len);
-				if (pAdapter->StaCfg.GroupCipher == Ndis802_11GroupWEP40Enabled ||
-					pAdapter->StaCfg.GroupCipher == Ndis802_11GroupWEP104Enabled)
-				{
-					// Set Group key material to Asic
-					AsicAddSharedKeyEntry(pAdapter, BSS0, keyIdx, pAdapter->SharedKey[BSS0][keyIdx].CipherAlg, pAdapter->SharedKey[BSS0][keyIdx].Key, NULL, NULL);
+		if (ext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY) {
+			pAdapter->StaCfg.DefaultKeyId = keyIdx;
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("%s::DefaultKeyId = %d\n", __func__,
+				  pAdapter->StaCfg.DefaultKeyId));
+		}
+
+		switch (alg) {
+		case IW_ENCODE_ALG_NONE:
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("%s::IW_ENCODE_ALG_NONE\n", __func__));
+			break;
+		case IW_ENCODE_ALG_WEP:
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("%s::IW_ENCODE_ALG_WEP - ext->key_len = %d, keyIdx = %d\n",
+				  __func__, ext->key_len, keyIdx));
+			if (ext->key_len == MAX_WEP_KEY_SIZE) {
+				pAdapter->SharedKey[BSS0][keyIdx].KeyLen =
+				    MAX_WEP_KEY_SIZE;
+				pAdapter->SharedKey[BSS0][keyIdx].CipherAlg =
+				    CIPHER_WEP128;
+			} else if (ext->key_len == MIN_WEP_KEY_SIZE) {
+				pAdapter->SharedKey[BSS0][keyIdx].KeyLen =
+				    MIN_WEP_KEY_SIZE;
+				pAdapter->SharedKey[BSS0][keyIdx].CipherAlg =
+				    CIPHER_WEP64;
+			} else
+				return -EINVAL;
 
-					// Update WCID attribute table and IVEIV table for this group key table
-					RTMPAddWcidAttributeEntry(pAdapter, BSS0, keyIdx, pAdapter->SharedKey[BSS0][keyIdx].CipherAlg, NULL);
+			NdisZeroMemory(pAdapter->SharedKey[BSS0][keyIdx].Key,
+				       16);
+			NdisMoveMemory(pAdapter->SharedKey[BSS0][keyIdx].Key,
+				       ext->key, ext->key_len);
+			if (pAdapter->StaCfg.GroupCipher ==
+			    Ndis802_11GroupWEP40Enabled
+			    || pAdapter->StaCfg.GroupCipher ==
+			    Ndis802_11GroupWEP104Enabled) {
+				/* Set Group key material to Asic */
+				AsicAddSharedKeyEntry(pAdapter, BSS0, keyIdx,
+						      pAdapter->
+						      SharedKey[BSS0][keyIdx].
+						      CipherAlg,
+						      pAdapter->
+						      SharedKey[BSS0][keyIdx].
+						      Key, NULL, NULL);
+
+				/* Update WCID attribute table and IVEIV table for this group key table */
+				RTMPAddWcidAttributeEntry(pAdapter, BSS0,
+							  keyIdx,
+							  pAdapter->
+							  SharedKey[BSS0]
+							  [keyIdx].CipherAlg,
+							  NULL);
 
-					STA_PORT_SECURED(pAdapter);
+				STA_PORT_SECURED(pAdapter);
 
-    				// Indicate Connected for GUI
-    				pAdapter->IndicateMediaState = NdisMediaStateConnected;
+				/* Indicate Connected for GUI */
+				pAdapter->IndicateMediaState =
+				    NdisMediaStateConnected;
+			}
+			break;
+		case IW_ENCODE_ALG_TKIP:
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("%s::IW_ENCODE_ALG_TKIP - keyIdx = %d, ext->key_len = %d\n",
+				  __func__, keyIdx, ext->key_len));
+			if (ext->key_len == 32) {
+				if (ext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY) {
+					fnSetCipherKey(pAdapter, keyIdx,
+						       CIPHER_TKIP, FALSE, ext);
+					if (pAdapter->StaCfg.AuthMode >=
+					    Ndis802_11AuthModeWPA2) {
+						/*pAdapter->StaCfg.PortSecured = WPA_802_1X_PORT_SECURED; */
+						STA_PORT_SECURED(pAdapter);
+						pAdapter->IndicateMediaState =
+						    NdisMediaStateConnected;
+					}
+				} else if (ext->
+					   ext_flags & IW_ENCODE_EXT_GROUP_KEY)
+				{
+					fnSetCipherKey(pAdapter, keyIdx,
+						       CIPHER_TKIP, TRUE, ext);
+
+					/* set 802.1x port control */
+					/*pAdapter->StaCfg.PortSecured = WPA_802_1X_PORT_SECURED; */
+					STA_PORT_SECURED(pAdapter);
+					pAdapter->IndicateMediaState =
+					    NdisMediaStateConnected;
 				}
-    			break;
-            case IW_ENCODE_ALG_TKIP:
-                DBGPRINT(RT_DEBUG_TRACE, ("%s::IW_ENCODE_ALG_TKIP - keyIdx = %d, ext->key_len = %d\n", __func__, keyIdx, ext->key_len));
-                if (ext->key_len == 32)
-                {
-                    if (ext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY)
-                    {
-                        fnSetCipherKey(pAdapter, keyIdx, CIPHER_TKIP, FALSE, ext);
-                        if (pAdapter->StaCfg.AuthMode >= Ndis802_11AuthModeWPA2)
-                        {
-                            STA_PORT_SECURED(pAdapter);
-                        }
-		}
-                    else if (ext->ext_flags & IW_ENCODE_EXT_GROUP_KEY)
-                    {
-                        fnSetCipherKey(pAdapter, keyIdx, CIPHER_TKIP, TRUE, ext);
-
-                        // set 802.1x port control
-            	        STA_PORT_SECURED(pAdapter);
-                    }
-                }
-                else
-                    return -EINVAL;
-                break;
-            case IW_ENCODE_ALG_CCMP:
-                if (ext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY)
-		{
-                    fnSetCipherKey(pAdapter, keyIdx, CIPHER_AES, FALSE, ext);
-                    if (pAdapter->StaCfg.AuthMode >= Ndis802_11AuthModeWPA2)
-                    	STA_PORT_SECURED(pAdapter);
-                }
-                else if (ext->ext_flags & IW_ENCODE_EXT_GROUP_KEY)
-                {
-                    fnSetCipherKey(pAdapter, keyIdx, CIPHER_AES, TRUE, ext);
-
-                    // set 802.1x port control
-        	        STA_PORT_SECURED(pAdapter);
-                }
-                break;
-    		default:
-    			return -EINVAL;
+			} else
+				return -EINVAL;
+			break;
+		case IW_ENCODE_ALG_CCMP:
+			if (ext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY) {
+				fnSetCipherKey(pAdapter, keyIdx, CIPHER_AES,
+					       FALSE, ext);
+				if (pAdapter->StaCfg.AuthMode >=
+				    Ndis802_11AuthModeWPA2)
+					/*pAdapter->StaCfg.PortSecured = WPA_802_1X_PORT_SECURED; */
+					STA_PORT_SECURED(pAdapter);
+				pAdapter->IndicateMediaState =
+				    NdisMediaStateConnected;
+			} else if (ext->ext_flags & IW_ENCODE_EXT_GROUP_KEY) {
+				fnSetCipherKey(pAdapter, keyIdx, CIPHER_AES,
+					       TRUE, ext);
+
+				/* set 802.1x port control */
+				/*pAdapter->StaCfg.PortSecured = WPA_802_1X_PORT_SECURED; */
+				STA_PORT_SECURED(pAdapter);
+				pAdapter->IndicateMediaState =
+				    NdisMediaStateConnected;
+			}
+			break;
+		default:
+			return -EINVAL;
 		}
-    }
+	}
 
-    return 0;
+	return 0;
 }
 
 int
 rt_ioctl_giwencodeext(struct net_device *dev,
-			  struct iw_request_info *info,
-			  union iwreq_data *wrqu, char *extra)
+		      struct iw_request_info *info,
+		      union iwreq_data *wrqu, char *extra)
 {
-	PRTMP_ADAPTER pAd = dev->ml_priv;
-	PCHAR pKey = NULL;
+	struct rt_rtmp_adapter *pAd = NULL;
+	char *pKey = NULL;
 	struct iw_point *encoding = &wrqu->encoding;
 	struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
 	int idx, max_key_len;
 
-	DBGPRINT(RT_DEBUG_TRACE ,("===> rt_ioctl_giwencodeext\n"));
+	GET_PAD_FROM_NET_DEV(pAd, dev);
+
+	DBGPRINT(RT_DEBUG_TRACE, ("===> rt_ioctl_giwencodeext\n"));
 
 	max_key_len = encoding->length - sizeof(*ext);
 	if (max_key_len < 0)
 		return -EINVAL;
 
 	idx = encoding->flags & IW_ENCODE_INDEX;
-	if (idx)
-	{
+	if (idx) {
 		if (idx < 1 || idx > 4)
 			return -EINVAL;
 		idx--;
 
 		if ((pAd->StaCfg.WepStatus == Ndis802_11Encryption2Enabled) ||
-			(pAd->StaCfg.WepStatus == Ndis802_11Encryption3Enabled))
-		{
-			if (idx != pAd->StaCfg.DefaultKeyId)
-			{
+		    (pAd->StaCfg.WepStatus == Ndis802_11Encryption3Enabled)) {
+			if (idx != pAd->StaCfg.DefaultKeyId) {
 				ext->key_len = 0;
 				return 0;
 			}
 		}
-	}
-	else
+	} else
 		idx = pAd->StaCfg.DefaultKeyId;
 
 	encoding->flags = idx + 1;
 	memset(ext, 0, sizeof(*ext));
 
 	ext->key_len = 0;
-	switch(pAd->StaCfg.WepStatus) {
-		case Ndis802_11WEPDisabled:
-			ext->alg = IW_ENCODE_ALG_NONE;
-			encoding->flags |= IW_ENCODE_DISABLED;
-			break;
-		case Ndis802_11WEPEnabled:
-			ext->alg = IW_ENCODE_ALG_WEP;
-			if (pAd->SharedKey[BSS0][idx].KeyLen > max_key_len)
-				return -E2BIG;
-			else
-			{
-				ext->key_len = pAd->SharedKey[BSS0][idx].KeyLen;
-				pKey = &(pAd->SharedKey[BSS0][idx].Key[0]);
-			}
-			break;
-		case Ndis802_11Encryption2Enabled:
-		case Ndis802_11Encryption3Enabled:
-			if (pAd->StaCfg.WepStatus == Ndis802_11Encryption2Enabled)
-				ext->alg = IW_ENCODE_ALG_TKIP;
-			else
-				ext->alg = IW_ENCODE_ALG_CCMP;
+	switch (pAd->StaCfg.WepStatus) {
+	case Ndis802_11WEPDisabled:
+		ext->alg = IW_ENCODE_ALG_NONE;
+		encoding->flags |= IW_ENCODE_DISABLED;
+		break;
+	case Ndis802_11WEPEnabled:
+		ext->alg = IW_ENCODE_ALG_WEP;
+		if (pAd->SharedKey[BSS0][idx].KeyLen > max_key_len)
+			return -E2BIG;
+		else {
+			ext->key_len = pAd->SharedKey[BSS0][idx].KeyLen;
+			pKey = (char *)& (pAd->SharedKey[BSS0][idx].Key[0]);
+		}
+		break;
+	case Ndis802_11Encryption2Enabled:
+	case Ndis802_11Encryption3Enabled:
+		if (pAd->StaCfg.WepStatus == Ndis802_11Encryption2Enabled)
+			ext->alg = IW_ENCODE_ALG_TKIP;
+		else
+			ext->alg = IW_ENCODE_ALG_CCMP;
 
-			if (max_key_len < 32)
-				return -E2BIG;
-			else
-			{
-				ext->key_len = 32;
-				pKey = &pAd->StaCfg.PMK[0];
-			}
-			break;
-		default:
-			return -EINVAL;
+		if (max_key_len < 32)
+			return -E2BIG;
+		else {
+			ext->key_len = 32;
+			pKey = (char *)& pAd->StaCfg.PMK[0];
+		}
+		break;
+	default:
+		return -EINVAL;
 	}
 
-	if (ext->key_len && pKey)
-	{
+	if (ext->key_len && pKey) {
 		encoding->flags |= IW_ENCODE_ENABLED;
 		memcpy(ext->key, pKey, ext->key_len);
 	}
@@ -2332,22 +2093,25 @@ rt_ioctl_giwencodeext(struct net_device *dev,
 }
 
 int rt_ioctl_siwgenie(struct net_device *dev,
-			  struct iw_request_info *info,
-			  union iwreq_data *wrqu, char *extra)
+		      struct iw_request_info *info,
+		      union iwreq_data *wrqu, char *extra)
 {
-	PRTMP_ADAPTER   pAd = dev->ml_priv;
+	struct rt_rtmp_adapter *pAd = NULL;
+
+	GET_PAD_FROM_NET_DEV(pAd, dev);
 
+	DBGPRINT(RT_DEBUG_TRACE, ("===> rt_ioctl_siwgenie\n"));
+	pAd->StaCfg.bRSN_IE_FromWpaSupplicant = FALSE;
 	if (wrqu->data.length > MAX_LEN_OF_RSNIE ||
 	    (wrqu->data.length && extra == NULL))
 		return -EINVAL;
 
-	if (wrqu->data.length)
-	{
+	if (wrqu->data.length) {
 		pAd->StaCfg.RSNIE_Len = wrqu->data.length;
-		NdisMoveMemory(&pAd->StaCfg.RSN_IE[0], extra, pAd->StaCfg.RSNIE_Len);
-	}
-	else
-	{
+		NdisMoveMemory(&pAd->StaCfg.RSN_IE[0], extra,
+			       pAd->StaCfg.RSNIE_Len);
+		pAd->StaCfg.bRSN_IE_FromWpaSupplicant = TRUE;
+	} else {
 		pAd->StaCfg.RSNIE_Len = 0;
 		NdisZeroMemory(&pAd->StaCfg.RSN_IE[0], MAX_LEN_OF_RSNIE);
 	}
@@ -2356,182 +2120,213 @@ int rt_ioctl_siwgenie(struct net_device *dev,
 }
 
 int rt_ioctl_giwgenie(struct net_device *dev,
-			       struct iw_request_info *info,
-			       union iwreq_data *wrqu, char *extra)
+		      struct iw_request_info *info,
+		      union iwreq_data *wrqu, char *extra)
 {
-	PRTMP_ADAPTER   pAd = dev->ml_priv;
+	struct rt_rtmp_adapter *pAd = NULL;
+
+	GET_PAD_FROM_NET_DEV(pAd, dev);
 
 	if ((pAd->StaCfg.RSNIE_Len == 0) ||
-		(pAd->StaCfg.AuthMode < Ndis802_11AuthModeWPA))
-	{
+	    (pAd->StaCfg.AuthMode < Ndis802_11AuthModeWPA)) {
 		wrqu->data.length = 0;
 		return 0;
 	}
 
-	if (pAd->StaCfg.WpaSupplicantUP == WPA_SUPPLICANT_ENABLE)
-	{
-	if (wrqu->data.length < pAd->StaCfg.RSNIE_Len)
-		return -E2BIG;
+	if (pAd->StaCfg.WpaSupplicantUP == WPA_SUPPLICANT_ENABLE) {
+		if (wrqu->data.length < pAd->StaCfg.RSNIE_Len)
+			return -E2BIG;
 
-	wrqu->data.length = pAd->StaCfg.RSNIE_Len;
-	memcpy(extra, &pAd->StaCfg.RSN_IE[0], pAd->StaCfg.RSNIE_Len);
-	}
-	else
-	{
-		UCHAR RSNIe = IE_WPA;
+		wrqu->data.length = pAd->StaCfg.RSNIE_Len;
+		memcpy(extra, &pAd->StaCfg.RSN_IE[0], pAd->StaCfg.RSNIE_Len);
+	} else {
+		u8 RSNIe = IE_WPA;
 
-		if (wrqu->data.length < (pAd->StaCfg.RSNIE_Len + 2)) // ID, Len
+		if (wrqu->data.length < (pAd->StaCfg.RSNIE_Len + 2))	/* ID, Len */
 			return -E2BIG;
 		wrqu->data.length = pAd->StaCfg.RSNIE_Len + 2;
 
 		if ((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK) ||
-            (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2))
+		    (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2))
 			RSNIe = IE_RSN;
 
 		extra[0] = (char)RSNIe;
 		extra[1] = pAd->StaCfg.RSNIE_Len;
-		memcpy(extra+2, &pAd->StaCfg.RSN_IE[0], pAd->StaCfg.RSNIE_Len);
+		memcpy(extra + 2, &pAd->StaCfg.RSN_IE[0],
+		       pAd->StaCfg.RSNIE_Len);
 	}
 
 	return 0;
 }
 
 int rt_ioctl_siwpmksa(struct net_device *dev,
-			   struct iw_request_info *info,
-			   union iwreq_data *wrqu,
-			   char *extra)
+		      struct iw_request_info *info,
+		      union iwreq_data *wrqu, char *extra)
 {
-	PRTMP_ADAPTER   pAd = dev->ml_priv;
+	struct rt_rtmp_adapter *pAd = NULL;
 	struct iw_pmksa *pPmksa = (struct iw_pmksa *)wrqu->data.pointer;
-	INT	CachedIdx = 0, idx = 0;
+	int CachedIdx = 0, idx = 0;
+
+	GET_PAD_FROM_NET_DEV(pAd, dev);
 
 	if (pPmksa == NULL)
 		return -EINVAL;
 
-	DBGPRINT(RT_DEBUG_TRACE ,("===> rt_ioctl_siwpmksa\n"));
-	switch(pPmksa->cmd)
-	{
-		case IW_PMKSA_FLUSH:
-			NdisZeroMemory(pAd->StaCfg.SavedPMK, sizeof(BSSID_INFO)*PMKID_NO);
-			DBGPRINT(RT_DEBUG_TRACE ,("rt_ioctl_siwpmksa - IW_PMKSA_FLUSH\n"));
-			break;
-		case IW_PMKSA_REMOVE:
-			for (CachedIdx = 0; CachedIdx < pAd->StaCfg.SavedPMKNum; CachedIdx++)
-			{
-		        // compare the BSSID
-		        if (NdisEqualMemory(pPmksa->bssid.sa_data, pAd->StaCfg.SavedPMK[CachedIdx].BSSID, MAC_ADDR_LEN))
-		        {
-		        	NdisZeroMemory(pAd->StaCfg.SavedPMK[CachedIdx].BSSID, MAC_ADDR_LEN);
-					NdisZeroMemory(pAd->StaCfg.SavedPMK[CachedIdx].PMKID, 16);
-					for (idx = CachedIdx; idx < (pAd->StaCfg.SavedPMKNum - 1); idx++)
-					{
-						NdisMoveMemory(&pAd->StaCfg.SavedPMK[idx].BSSID[0], &pAd->StaCfg.SavedPMK[idx+1].BSSID[0], MAC_ADDR_LEN);
-						NdisMoveMemory(&pAd->StaCfg.SavedPMK[idx].PMKID[0], &pAd->StaCfg.SavedPMK[idx+1].PMKID[0], 16);
-					}
-					pAd->StaCfg.SavedPMKNum--;
-			        break;
-		        }
-	        }
+	DBGPRINT(RT_DEBUG_TRACE, ("===> rt_ioctl_siwpmksa\n"));
+	switch (pPmksa->cmd) {
+	case IW_PMKSA_FLUSH:
+		NdisZeroMemory(pAd->StaCfg.SavedPMK,
+			       sizeof(struct rt_bssid_info) * PMKID_NO);
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("rt_ioctl_siwpmksa - IW_PMKSA_FLUSH\n"));
+		break;
+	case IW_PMKSA_REMOVE:
+		for (CachedIdx = 0; CachedIdx < pAd->StaCfg.SavedPMKNum;
+		     CachedIdx++) {
+			/* compare the BSSID */
+			if (NdisEqualMemory
+			    (pPmksa->bssid.sa_data,
+			     pAd->StaCfg.SavedPMK[CachedIdx].BSSID,
+			     MAC_ADDR_LEN)) {
+				NdisZeroMemory(pAd->StaCfg.SavedPMK[CachedIdx].
+					       BSSID, MAC_ADDR_LEN);
+				NdisZeroMemory(pAd->StaCfg.SavedPMK[CachedIdx].
+					       PMKID, 16);
+				for (idx = CachedIdx;
+				     idx < (pAd->StaCfg.SavedPMKNum - 1);
+				     idx++) {
+					NdisMoveMemory(&pAd->StaCfg.
+						       SavedPMK[idx].BSSID[0],
+						       &pAd->StaCfg.
+						       SavedPMK[idx +
+								1].BSSID[0],
+						       MAC_ADDR_LEN);
+					NdisMoveMemory(&pAd->StaCfg.
+						       SavedPMK[idx].PMKID[0],
+						       &pAd->StaCfg.
+						       SavedPMK[idx +
+								1].PMKID[0],
+						       16);
+				}
+				pAd->StaCfg.SavedPMKNum--;
+				break;
+			}
+		}
 
-			DBGPRINT(RT_DEBUG_TRACE ,("rt_ioctl_siwpmksa - IW_PMKSA_REMOVE\n"));
-			break;
-		case IW_PMKSA_ADD:
-			for (CachedIdx = 0; CachedIdx < pAd->StaCfg.SavedPMKNum; CachedIdx++)
-			{
-		        // compare the BSSID
-		        if (NdisEqualMemory(pPmksa->bssid.sa_data, pAd->StaCfg.SavedPMK[CachedIdx].BSSID, MAC_ADDR_LEN))
-			        break;
-	        }
-
-	        // Found, replace it
-	        if (CachedIdx < PMKID_NO)
-	        {
-		        DBGPRINT(RT_DEBUG_OFF, ("Update PMKID, idx = %d\n", CachedIdx));
-		        NdisMoveMemory(&pAd->StaCfg.SavedPMK[CachedIdx].BSSID[0], pPmksa->bssid.sa_data, MAC_ADDR_LEN);
-				NdisMoveMemory(&pAd->StaCfg.SavedPMK[CachedIdx].PMKID[0], pPmksa->pmkid, 16);
-		        pAd->StaCfg.SavedPMKNum++;
-	        }
-	        // Not found, replace the last one
-	        else
-	        {
-		        // Randomly replace one
-		        CachedIdx = (pPmksa->bssid.sa_data[5] % PMKID_NO);
-		        DBGPRINT(RT_DEBUG_OFF, ("Update PMKID, idx = %d\n", CachedIdx));
-		        NdisMoveMemory(&pAd->StaCfg.SavedPMK[CachedIdx].BSSID[0], pPmksa->bssid.sa_data, MAC_ADDR_LEN);
-				NdisMoveMemory(&pAd->StaCfg.SavedPMK[CachedIdx].PMKID[0], pPmksa->pmkid, 16);
-	        }
-
-			DBGPRINT(RT_DEBUG_TRACE ,("rt_ioctl_siwpmksa - IW_PMKSA_ADD\n"));
-			break;
-		default:
-			DBGPRINT(RT_DEBUG_TRACE ,("rt_ioctl_siwpmksa - Unknow Command!!\n"));
-			break;
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("rt_ioctl_siwpmksa - IW_PMKSA_REMOVE\n"));
+		break;
+	case IW_PMKSA_ADD:
+		for (CachedIdx = 0; CachedIdx < pAd->StaCfg.SavedPMKNum;
+		     CachedIdx++) {
+			/* compare the BSSID */
+			if (NdisEqualMemory
+			    (pPmksa->bssid.sa_data,
+			     pAd->StaCfg.SavedPMK[CachedIdx].BSSID,
+			     MAC_ADDR_LEN))
+				break;
+		}
+
+		/* Found, replace it */
+		if (CachedIdx < PMKID_NO) {
+			DBGPRINT(RT_DEBUG_OFF,
+				 ("Update PMKID, idx = %d\n", CachedIdx));
+			NdisMoveMemory(&pAd->StaCfg.SavedPMK[CachedIdx].
+				       BSSID[0], pPmksa->bssid.sa_data,
+				       MAC_ADDR_LEN);
+			NdisMoveMemory(&pAd->StaCfg.SavedPMK[CachedIdx].
+				       PMKID[0], pPmksa->pmkid, 16);
+			pAd->StaCfg.SavedPMKNum++;
+		}
+		/* Not found, replace the last one */
+		else {
+			/* Randomly replace one */
+			CachedIdx = (pPmksa->bssid.sa_data[5] % PMKID_NO);
+			DBGPRINT(RT_DEBUG_OFF,
+				 ("Update PMKID, idx = %d\n", CachedIdx));
+			NdisMoveMemory(&pAd->StaCfg.SavedPMK[CachedIdx].
+				       BSSID[0], pPmksa->bssid.sa_data,
+				       MAC_ADDR_LEN);
+			NdisMoveMemory(&pAd->StaCfg.SavedPMK[CachedIdx].
+				       PMKID[0], pPmksa->pmkid, 16);
+		}
+
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("rt_ioctl_siwpmksa - IW_PMKSA_ADD\n"));
+		break;
+	default:
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("rt_ioctl_siwpmksa - Unknown Command!\n"));
+		break;
 	}
 
 	return 0;
 }
 
 int rt_ioctl_siwrate(struct net_device *dev,
-			struct iw_request_info *info,
-			union iwreq_data *wrqu, char *extra)
+		     struct iw_request_info *info,
+		     union iwreq_data *wrqu, char *extra)
 {
-    PRTMP_ADAPTER   pAd = dev->ml_priv;
-    UINT32          rate = wrqu->bitrate.value, fixed = wrqu->bitrate.fixed;
+	struct rt_rtmp_adapter *pAd = NULL;
+	u32 rate = wrqu->bitrate.value, fixed = wrqu->bitrate.fixed;
 
-    //check if the interface is down
-	if(!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_INTERRUPT_IN_USE))
-	{
-  		DBGPRINT(RT_DEBUG_TRACE, ("rt_ioctl_siwrate::Network is down!\n"));
-    	return -ENETDOWN;
+	GET_PAD_FROM_NET_DEV(pAd, dev);
+
+	/*check if the interface is down */
+	if (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_INTERRUPT_IN_USE)) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("rt_ioctl_siwrate::Network is down!\n"));
+		return -ENETDOWN;
 	}
 
-    DBGPRINT(RT_DEBUG_TRACE, ("rt_ioctl_siwrate::(rate = %d, fixed = %d)\n", rate, fixed));
-    /* rate = -1 => auto rate
-       rate = X, fixed = 1 => (fixed rate X)
-    */
-    if (rate == -1)
-    {
-		//Auto Rate
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("rt_ioctl_siwrate::(rate = %d, fixed = %d)\n", rate, fixed));
+	/* rate = -1 => auto rate
+	   rate = X, fixed = 1 => (fixed rate X)
+	 */
+	if (rate == -1) {
+		/*Auto Rate */
 		pAd->StaCfg.DesiredTransmitSetting.field.MCS = MCS_AUTO;
 		pAd->StaCfg.bAutoTxRateSwitch = TRUE;
 		if ((pAd->CommonCfg.PhyMode <= PHY_11G) ||
-		    (pAd->MacTab.Content[BSSID_WCID].HTPhyMode.field.MODE <= MODE_OFDM))
+		    (pAd->MacTab.Content[BSSID_WCID].HTPhyMode.field.MODE <=
+		     MODE_OFDM))
 			RTMPSetDesiredRates(pAd, -1);
 
 		SetCommonHT(pAd);
-    }
-    else
-    {
-        if (fixed)
-        {
-        	pAd->StaCfg.bAutoTxRateSwitch = FALSE;
-            if ((pAd->CommonCfg.PhyMode <= PHY_11G) ||
-                (pAd->MacTab.Content[BSSID_WCID].HTPhyMode.field.MODE <= MODE_OFDM))
-                RTMPSetDesiredRates(pAd, rate);
-            else
-            {
-                pAd->StaCfg.DesiredTransmitSetting.field.MCS = MCS_AUTO;
-                SetCommonHT(pAd);
-            }
-            DBGPRINT(RT_DEBUG_TRACE, ("rt_ioctl_siwrate::(HtMcs=%d)\n",pAd->StaCfg.DesiredTransmitSetting.field.MCS));
-        }
-        else
-        {
-            // TODO: rate = X, fixed = 0 => (rates <= X)
-            return -EOPNOTSUPP;
-        }
-    }
-
-    return 0;
+	} else {
+		if (fixed) {
+			pAd->StaCfg.bAutoTxRateSwitch = FALSE;
+			if ((pAd->CommonCfg.PhyMode <= PHY_11G) ||
+			    (pAd->MacTab.Content[BSSID_WCID].HTPhyMode.field.
+			     MODE <= MODE_OFDM))
+				RTMPSetDesiredRates(pAd, rate);
+			else {
+				pAd->StaCfg.DesiredTransmitSetting.field.MCS =
+				    MCS_AUTO;
+				SetCommonHT(pAd);
+			}
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("rt_ioctl_siwrate::(HtMcs=%d)\n",
+				  pAd->StaCfg.DesiredTransmitSetting.field.
+				  MCS));
+		} else {
+			/* TODO: rate = X, fixed = 0 => (rates <= X) */
+			return -EOPNOTSUPP;
+		}
+	}
+
+	return 0;
 }
 
 int rt_ioctl_giwrate(struct net_device *dev,
-			       struct iw_request_info *info,
-			       union iwreq_data *wrqu, char *extra)
+		     struct iw_request_info *info,
+		     union iwreq_data *wrqu, char *extra)
 {
-    PRTMP_ADAPTER   pAd = dev->ml_priv;
-    int rate_index = 0, rate_count = 0;
-    HTTRANSMIT_SETTING ht_setting;
+	struct rt_rtmp_adapter *pAd = NULL;
+	int rate_index = 0, rate_count = 0;
+	HTTRANSMIT_SETTING ht_setting;
+/* Remove to global variable
     __s32 ralinkrate[] =
 	{2,  4,   11,  22, // CCK
 	12, 18,   24,  36, 48, 72, 96, 108, // OFDM
@@ -2543,329 +2338,295 @@ int rt_ioctl_giwrate(struct net_device *dev,
 	43, 87,  130, 173, 260, 317, 390, 433,										  // 20MHz, 400ns GI, MCS: 16 ~ 23
 	30, 60,   90, 120, 180, 240, 270, 300, 60, 120, 180, 240, 360, 480, 540, 600, // 40MHz, 400ns GI, MCS: 0 ~ 15
 	90, 180, 270, 360, 540, 720, 810, 900};										  // 40MHz, 400ns GI, MCS: 16 ~ 23
+*/
+	GET_PAD_FROM_NET_DEV(pAd, dev);
 
-    rate_count = sizeof(ralinkrate)/sizeof(__s32);
-    //check if the interface is down
-	if(!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_INTERRUPT_IN_USE))
-	{
-  		DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
-    	return -ENETDOWN;
+	rate_count = sizeof(ralinkrate) / sizeof(__s32);
+	/*check if the interface is down */
+	if (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_INTERRUPT_IN_USE)) {
+		DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
+		return -ENETDOWN;
 	}
 
-    if ((pAd->StaCfg.bAutoTxRateSwitch == FALSE) &&
-        (INFRA_ON(pAd)) &&
-        ((pAd->CommonCfg.PhyMode <= PHY_11G) || (pAd->MacTab.Content[BSSID_WCID].HTPhyMode.field.MODE <= MODE_OFDM)))
-        ht_setting.word = pAd->StaCfg.HTPhyMode.word;
-    else
-        ht_setting.word = pAd->MacTab.Content[BSSID_WCID].HTPhyMode.word;
-
-    if (ht_setting.field.MODE >= MODE_HTMIX)
-    {
-    	rate_index = 12 + ((UCHAR)ht_setting.field.BW *24) + ((UCHAR)ht_setting.field.ShortGI *48) + ((UCHAR)ht_setting.field.MCS);
-    }
-    else
-    if (ht_setting.field.MODE == MODE_OFDM)
-    	rate_index = (UCHAR)(ht_setting.field.MCS) + 4;
-    else if (ht_setting.field.MODE == MODE_CCK)
-    	rate_index = (UCHAR)(ht_setting.field.MCS);
-
-    if (rate_index < 0)
-        rate_index = 0;
-
-    if (rate_index > rate_count)
-        rate_index = rate_count;
-
-    wrqu->bitrate.value = ralinkrate[rate_index] * 500000;
-    wrqu->bitrate.disabled = 0;
-
-    return 0;
-}
+	if ((pAd->StaCfg.bAutoTxRateSwitch == FALSE) &&
+	    (INFRA_ON(pAd)) &&
+	    ((pAd->CommonCfg.PhyMode <= PHY_11G)
+	     || (pAd->MacTab.Content[BSSID_WCID].HTPhyMode.field.MODE <=
+		 MODE_OFDM)))
+		ht_setting.word = pAd->StaCfg.HTPhyMode.word;
+	else
+		ht_setting.word =
+		    pAd->MacTab.Content[BSSID_WCID].HTPhyMode.word;
 
-static const iw_handler rt_handler[] =
-{
-	(iw_handler) NULL,			            /* SIOCSIWCOMMIT */
-	(iw_handler) rt_ioctl_giwname,			/* SIOCGIWNAME   */
-	(iw_handler) NULL,			            /* SIOCSIWNWID   */
-	(iw_handler) NULL,			            /* SIOCGIWNWID   */
-	(iw_handler) rt_ioctl_siwfreq,		    /* SIOCSIWFREQ   */
-	(iw_handler) rt_ioctl_giwfreq,		    /* SIOCGIWFREQ   */
-	(iw_handler) rt_ioctl_siwmode,		    /* SIOCSIWMODE   */
-	(iw_handler) rt_ioctl_giwmode,		    /* SIOCGIWMODE   */
-	(iw_handler) NULL,		                /* SIOCSIWSENS   */
-	(iw_handler) NULL,		                /* SIOCGIWSENS   */
-	(iw_handler) NULL /* not used */,		/* SIOCSIWRANGE  */
-	(iw_handler) rt_ioctl_giwrange,		    /* SIOCGIWRANGE  */
-	(iw_handler) NULL /* not used */,		/* SIOCSIWPRIV   */
-	(iw_handler) NULL /* kernel code */,    /* SIOCGIWPRIV   */
-	(iw_handler) NULL /* not used */,		/* SIOCSIWSTATS  */
-	(iw_handler) rt28xx_get_wireless_stats /* kernel code */,    /* SIOCGIWSTATS  */
-	(iw_handler) NULL,		                /* SIOCSIWSPY    */
-	(iw_handler) NULL,		                /* SIOCGIWSPY    */
-	(iw_handler) NULL,				        /* SIOCSIWTHRSPY */
-	(iw_handler) NULL,				        /* SIOCGIWTHRSPY */
-	(iw_handler) rt_ioctl_siwap,            /* SIOCSIWAP     */
-	(iw_handler) rt_ioctl_giwap,		    /* SIOCGIWAP     */
-	(iw_handler) rt_ioctl_siwmlme,	        /* SIOCSIWMLME   */
-	(iw_handler) rt_ioctl_iwaplist,		    /* SIOCGIWAPLIST */
-	(iw_handler) rt_ioctl_siwscan,		    /* SIOCSIWSCAN   */
-	(iw_handler) rt_ioctl_giwscan,		    /* SIOCGIWSCAN   */
-	(iw_handler) rt_ioctl_siwessid,		    /* SIOCSIWESSID  */
-	(iw_handler) rt_ioctl_giwessid,		    /* SIOCGIWESSID  */
-	(iw_handler) rt_ioctl_siwnickn,		    /* SIOCSIWNICKN  */
-	(iw_handler) rt_ioctl_giwnickn,		    /* SIOCGIWNICKN  */
-	(iw_handler) NULL,				        /* -- hole --    */
-	(iw_handler) NULL,				        /* -- hole --    */
-	(iw_handler) rt_ioctl_siwrate,          /* SIOCSIWRATE   */
-	(iw_handler) rt_ioctl_giwrate,          /* SIOCGIWRATE   */
-	(iw_handler) rt_ioctl_siwrts,		    /* SIOCSIWRTS    */
-	(iw_handler) rt_ioctl_giwrts,		    /* SIOCGIWRTS    */
-	(iw_handler) rt_ioctl_siwfrag,		    /* SIOCSIWFRAG   */
-	(iw_handler) rt_ioctl_giwfrag,		    /* SIOCGIWFRAG   */
-	(iw_handler) NULL,		                /* SIOCSIWTXPOW  */
-	(iw_handler) NULL,		                /* SIOCGIWTXPOW  */
-	(iw_handler) NULL,		                /* SIOCSIWRETRY  */
-	(iw_handler) NULL,		                /* SIOCGIWRETRY  */
-	(iw_handler) rt_ioctl_siwencode,		/* SIOCSIWENCODE */
-	(iw_handler) rt_ioctl_giwencode,		/* SIOCGIWENCODE */
-	(iw_handler) NULL,		                /* SIOCSIWPOWER  */
-	(iw_handler) NULL,		                /* SIOCGIWPOWER  */
-	(iw_handler) NULL,						/* -- hole -- */
-	(iw_handler) NULL,						/* -- hole -- */
-    (iw_handler) rt_ioctl_siwgenie,         /* SIOCSIWGENIE  */
-	(iw_handler) rt_ioctl_giwgenie,         /* SIOCGIWGENIE  */
-	(iw_handler) rt_ioctl_siwauth,		    /* SIOCSIWAUTH   */
-	(iw_handler) rt_ioctl_giwauth,		    /* SIOCGIWAUTH   */
-	(iw_handler) rt_ioctl_siwencodeext,	    /* SIOCSIWENCODEEXT */
-	(iw_handler) rt_ioctl_giwencodeext,		/* SIOCGIWENCODEEXT */
-	(iw_handler) rt_ioctl_siwpmksa,         /* SIOCSIWPMKSA  */
-};
+	if (ht_setting.field.MODE >= MODE_HTMIX) {
+/*      rate_index = 12 + ((u8)ht_setting.field.BW *16) + ((u8)ht_setting.field.ShortGI *32) + ((u8)ht_setting.field.MCS); */
+		rate_index =
+		    12 + ((u8)ht_setting.field.BW * 24) +
+		    ((u8)ht_setting.field.ShortGI * 48) +
+		    ((u8)ht_setting.field.MCS);
+	} else if (ht_setting.field.MODE == MODE_OFDM)
+		rate_index = (u8)(ht_setting.field.MCS) + 4;
+	else if (ht_setting.field.MODE == MODE_CCK)
+		rate_index = (u8)(ht_setting.field.MCS);
+
+	if (rate_index < 0)
+		rate_index = 0;
 
-static const iw_handler rt_priv_handlers[] = {
-	(iw_handler) NULL, /* + 0x00 */
-	(iw_handler) NULL, /* + 0x01 */
-	(iw_handler) rt_ioctl_setparam, /* + 0x02 */
-	(iw_handler) NULL, /* + 0x03 */
-	(iw_handler) NULL, /* + 0x04 */
-	(iw_handler) NULL, /* + 0x05 */
-	(iw_handler) NULL, /* + 0x06 */
-	(iw_handler) NULL, /* + 0x07 */
-	(iw_handler) NULL, /* + 0x08 */
-	(iw_handler) rt_private_get_statistics, /* + 0x09 */
-	(iw_handler) NULL, /* + 0x0A */
-	(iw_handler) NULL, /* + 0x0B */
-	(iw_handler) NULL, /* + 0x0C */
-	(iw_handler) NULL, /* + 0x0D */
-	(iw_handler) NULL, /* + 0x0E */
-	(iw_handler) NULL, /* + 0x0F */
-	(iw_handler) NULL, /* + 0x10 */
-	(iw_handler) rt_private_show, /* + 0x11 */
-    (iw_handler) NULL, /* + 0x12 */
-	(iw_handler) NULL, /* + 0x13 */
-	(iw_handler) NULL, /* + 0x15 */
-	(iw_handler) NULL, /* + 0x17 */
-	(iw_handler) NULL, /* + 0x18 */
+	if (rate_index > rate_count)
+		rate_index = rate_count;
+
+	wrqu->bitrate.value = ralinkrate[rate_index] * 500000;
+	wrqu->bitrate.disabled = 0;
+
+	return 0;
+}
+
+static const iw_handler rt_handler[] = {
+	(iw_handler) NULL,	/* SIOCSIWCOMMIT */
+	(iw_handler) rt_ioctl_giwname,	/* SIOCGIWNAME   */
+	(iw_handler) NULL,	/* SIOCSIWNWID   */
+	(iw_handler) NULL,	/* SIOCGIWNWID   */
+	(iw_handler) rt_ioctl_siwfreq,	/* SIOCSIWFREQ   */
+	(iw_handler) rt_ioctl_giwfreq,	/* SIOCGIWFREQ   */
+	(iw_handler) rt_ioctl_siwmode,	/* SIOCSIWMODE   */
+	(iw_handler) rt_ioctl_giwmode,	/* SIOCGIWMODE   */
+	(iw_handler) NULL,	/* SIOCSIWSENS   */
+	(iw_handler) NULL,	/* SIOCGIWSENS   */
+	(iw_handler) NULL /* not used */ ,	/* SIOCSIWRANGE  */
+	(iw_handler) rt_ioctl_giwrange,	/* SIOCGIWRANGE  */
+	(iw_handler) NULL /* not used */ ,	/* SIOCSIWPRIV   */
+	(iw_handler) NULL /* kernel code */ ,	/* SIOCGIWPRIV   */
+	(iw_handler) NULL /* not used */ ,	/* SIOCSIWSTATS  */
+	(iw_handler) rt28xx_get_wireless_stats /* kernel code */ ,	/* SIOCGIWSTATS  */
+	(iw_handler) NULL,	/* SIOCSIWSPY    */
+	(iw_handler) NULL,	/* SIOCGIWSPY    */
+	(iw_handler) NULL,	/* SIOCSIWTHRSPY */
+	(iw_handler) NULL,	/* SIOCGIWTHRSPY */
+	(iw_handler) rt_ioctl_siwap,	/* SIOCSIWAP     */
+	(iw_handler) rt_ioctl_giwap,	/* SIOCGIWAP     */
+	(iw_handler) rt_ioctl_siwmlme,	/* SIOCSIWMLME   */
+	(iw_handler) rt_ioctl_iwaplist,	/* SIOCGIWAPLIST */
+	(iw_handler) rt_ioctl_siwscan,	/* SIOCSIWSCAN   */
+	(iw_handler) rt_ioctl_giwscan,	/* SIOCGIWSCAN   */
+	(iw_handler) rt_ioctl_siwessid,	/* SIOCSIWESSID  */
+	(iw_handler) rt_ioctl_giwessid,	/* SIOCGIWESSID  */
+	(iw_handler) rt_ioctl_siwnickn,	/* SIOCSIWNICKN  */
+	(iw_handler) rt_ioctl_giwnickn,	/* SIOCGIWNICKN  */
+	(iw_handler) NULL,	/* -- hole --    */
+	(iw_handler) NULL,	/* -- hole --    */
+	(iw_handler) rt_ioctl_siwrate,	/* SIOCSIWRATE   */
+	(iw_handler) rt_ioctl_giwrate,	/* SIOCGIWRATE   */
+	(iw_handler) rt_ioctl_siwrts,	/* SIOCSIWRTS    */
+	(iw_handler) rt_ioctl_giwrts,	/* SIOCGIWRTS    */
+	(iw_handler) rt_ioctl_siwfrag,	/* SIOCSIWFRAG   */
+	(iw_handler) rt_ioctl_giwfrag,	/* SIOCGIWFRAG   */
+	(iw_handler) NULL,	/* SIOCSIWTXPOW  */
+	(iw_handler) NULL,	/* SIOCGIWTXPOW  */
+	(iw_handler) NULL,	/* SIOCSIWRETRY  */
+	(iw_handler) NULL,	/* SIOCGIWRETRY  */
+	(iw_handler) rt_ioctl_siwencode,	/* SIOCSIWENCODE */
+	(iw_handler) rt_ioctl_giwencode,	/* SIOCGIWENCODE */
+	(iw_handler) NULL,	/* SIOCSIWPOWER  */
+	(iw_handler) NULL,	/* SIOCGIWPOWER  */
+	(iw_handler) NULL,	/* -- hole -- */
+	(iw_handler) NULL,	/* -- hole -- */
+	(iw_handler) rt_ioctl_siwgenie,	/* SIOCSIWGENIE  */
+	(iw_handler) rt_ioctl_giwgenie,	/* SIOCGIWGENIE  */
+	(iw_handler) rt_ioctl_siwauth,	/* SIOCSIWAUTH   */
+	(iw_handler) rt_ioctl_giwauth,	/* SIOCGIWAUTH   */
+	(iw_handler) rt_ioctl_siwencodeext,	/* SIOCSIWENCODEEXT */
+	(iw_handler) rt_ioctl_giwencodeext,	/* SIOCGIWENCODEEXT */
+	(iw_handler) rt_ioctl_siwpmksa,	/* SIOCSIWPMKSA  */
 };
 
-const struct iw_handler_def rt28xx_iw_handler_def =
-{
-#define	N(a)	(sizeof (a) / sizeof (a[0]))
-	.standard	= (iw_handler *) rt_handler,
-	.num_standard	= sizeof(rt_handler) / sizeof(iw_handler),
-	.private	= (iw_handler *) rt_priv_handlers,
-	.num_private		= N(rt_priv_handlers),
-	.private_args	= (struct iw_priv_args *) privtab,
-	.num_private_args	= N(privtab),
+const struct iw_handler_def rt28xx_iw_handler_def = {
+	.standard = (iw_handler *) rt_handler,
+	.num_standard = sizeof(rt_handler) / sizeof(iw_handler),
 #if IW_HANDLER_VERSION >= 7
-    .get_wireless_stats = rt28xx_get_wireless_stats,
+	.get_wireless_stats = rt28xx_get_wireless_stats,
 #endif
 };
 
-INT rt28xx_sta_ioctl(
-	IN	struct net_device	*net_dev,
-	IN	OUT	struct ifreq	*rq,
-	IN	INT					cmd)
+int rt28xx_sta_ioctl(IN struct net_device *net_dev,
+		     IN OUT struct ifreq *rq, int cmd)
 {
-	RTMP_ADAPTER *pAd = net_dev->ml_priv;
-	POS_COOKIE pObj = (POS_COOKIE)pAd->OS_Cookie;
-	struct iwreq        *wrq = (struct iwreq *) rq;
-	BOOLEAN				StateMachineTouched = FALSE;
-	INT					Status = NDIS_STATUS_SUCCESS;
-
-    //check if the interface is down
-    if(!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_INTERRUPT_IN_USE))
-    {
-        {
-            DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
-		    return -ENETDOWN;
-        }
-    }
-
-	{	// determine this ioctl command is comming from which interface.
+	struct os_cookie *pObj;
+	struct rt_rtmp_adapter *pAd = NULL;
+	struct iwreq *wrq = (struct iwreq *)rq;
+	BOOLEAN StateMachineTouched = FALSE;
+	int Status = NDIS_STATUS_SUCCESS;
+
+	GET_PAD_FROM_NET_DEV(pAd, net_dev);
+
+	pObj = (struct os_cookie *)pAd->OS_Cookie;
+
+	/*check if the interface is down */
+	if (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_INTERRUPT_IN_USE)) {
+		{
+			DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
+			return -ENETDOWN;
+		}
+	}
+
+	{			/* determine this ioctl command is comming from which interface. */
 		pObj->ioctl_if_type = INT_MAIN;
 		pObj->ioctl_if = MAIN_MBSSID;
 	}
 
-	switch(cmd)
-	{
-        case SIOCGIFHWADDR:
-			DBGPRINT(RT_DEBUG_TRACE, ("IOCTL::SIOCGIFHWADDR\n"));
-			memcpy(wrq->u.name, pAd->CurrentAddress, ETH_ALEN);
-			break;
-		case SIOCGIWNAME:
-        {
-        	char *name=&wrq->u.name[0];
-        	rt_ioctl_giwname(net_dev, NULL, name, NULL);
+	switch (cmd) {
+	case SIOCGIFHWADDR:
+		DBGPRINT(RT_DEBUG_TRACE, ("IOCTL::SIOCGIFHWADDR\n"));
+		memcpy(wrq->u.name, pAd->CurrentAddress, ETH_ALEN);
+		break;
+	case SIOCGIWNAME:
+		{
+			char *name = &wrq->u.name[0];
+			rt_ioctl_giwname(net_dev, NULL, name, NULL);
 			break;
 		}
-		case SIOCGIWESSID:  //Get ESSID
-        {
-        	struct iw_point *essid=&wrq->u.essid;
-        	rt_ioctl_giwessid(net_dev, NULL, essid, essid->pointer);
+	case SIOCGIWESSID:	/*Get ESSID */
+		{
+			struct iw_point *essid = &wrq->u.essid;
+			rt_ioctl_giwessid(net_dev, NULL, essid, essid->pointer);
 			break;
 		}
-		case SIOCSIWESSID:  //Set ESSID
-        {
-        	struct iw_point	*essid=&wrq->u.essid;
-        	rt_ioctl_siwessid(net_dev, NULL, essid, essid->pointer);
+	case SIOCSIWESSID:	/*Set ESSID */
+		{
+			struct iw_point *essid = &wrq->u.essid;
+			rt_ioctl_siwessid(net_dev, NULL, essid, essid->pointer);
 			break;
 		}
-		case SIOCSIWNWID:   // set network id (the cell)
-		case SIOCGIWNWID:   // get network id
-			Status = -EOPNOTSUPP;
-			break;
-		case SIOCSIWFREQ:   //set channel/frequency (Hz)
-        {
-        	struct iw_freq *freq=&wrq->u.freq;
-        	rt_ioctl_siwfreq(net_dev, NULL, freq, NULL);
+	case SIOCSIWNWID:	/* set network id (the cell) */
+	case SIOCGIWNWID:	/* get network id */
+		Status = -EOPNOTSUPP;
+		break;
+	case SIOCSIWFREQ:	/*set channel/frequency (Hz) */
+		{
+			struct iw_freq *freq = &wrq->u.freq;
+			rt_ioctl_siwfreq(net_dev, NULL, freq, NULL);
 			break;
 		}
-		case SIOCGIWFREQ:   // get channel/frequency (Hz)
-        {
-        	struct iw_freq *freq=&wrq->u.freq;
-        	rt_ioctl_giwfreq(net_dev, NULL, freq, NULL);
+	case SIOCGIWFREQ:	/* get channel/frequency (Hz) */
+		{
+			struct iw_freq *freq = &wrq->u.freq;
+			rt_ioctl_giwfreq(net_dev, NULL, freq, NULL);
 			break;
 		}
-		case SIOCSIWNICKN: //set node name/nickname
-        {
-        	struct iw_point *data=&wrq->u.data;
-        	rt_ioctl_siwnickn(net_dev, NULL, data, NULL);
+	case SIOCSIWNICKN:	/*set node name/nickname */
+		{
+			/*struct iw_point *data=&wrq->u.data; */
+			/*rt_ioctl_siwnickn(net_dev, NULL, data, NULL); */
 			break;
 		}
-		case SIOCGIWNICKN: //get node name/nickname
-        {
-        	struct iw_point *data=&wrq->u.data;
-        	rt_ioctl_giwnickn(net_dev, NULL, data, NULL);
+	case SIOCGIWNICKN:	/*get node name/nickname */
+		{
+			struct iw_point *erq = NULL;
+			erq = &wrq->u.data;
+			erq->length = strlen((char *)pAd->nickname);
+			Status =
+			    copy_to_user(erq->pointer, pAd->nickname,
+					 erq->length);
 			break;
 		}
-		case SIOCGIWRATE:   //get default bit rate (bps)
-		    rt_ioctl_giwrate(net_dev, NULL, &wrq->u, NULL);
-            break;
-	    case SIOCSIWRATE:  //set default bit rate (bps)
-	        rt_ioctl_siwrate(net_dev, NULL, &wrq->u, NULL);
-            break;
-        case SIOCGIWRTS:  // get RTS/CTS threshold (bytes)
-        {
-        	struct iw_param *rts=&wrq->u.rts;
-        	rt_ioctl_giwrts(net_dev, NULL, rts, NULL);
+	case SIOCGIWRATE:	/*get default bit rate (bps) */
+		rt_ioctl_giwrate(net_dev, NULL, &wrq->u, NULL);
+		break;
+	case SIOCSIWRATE:	/*set default bit rate (bps) */
+		rt_ioctl_siwrate(net_dev, NULL, &wrq->u, NULL);
+		break;
+	case SIOCGIWRTS:	/* get RTS/CTS threshold (bytes) */
+		{
+			struct iw_param *rts = &wrq->u.rts;
+			rt_ioctl_giwrts(net_dev, NULL, rts, NULL);
 			break;
 		}
-        case SIOCSIWRTS:  //set RTS/CTS threshold (bytes)
-        {
-        	struct iw_param *rts=&wrq->u.rts;
-        	rt_ioctl_siwrts(net_dev, NULL, rts, NULL);
+	case SIOCSIWRTS:	/*set RTS/CTS threshold (bytes) */
+		{
+			struct iw_param *rts = &wrq->u.rts;
+			rt_ioctl_siwrts(net_dev, NULL, rts, NULL);
 			break;
 		}
-        case SIOCGIWFRAG:  //get fragmentation thr (bytes)
-        {
-        	struct iw_param *frag=&wrq->u.frag;
-        	rt_ioctl_giwfrag(net_dev, NULL, frag, NULL);
+	case SIOCGIWFRAG:	/*get fragmentation thr (bytes) */
+		{
+			struct iw_param *frag = &wrq->u.frag;
+			rt_ioctl_giwfrag(net_dev, NULL, frag, NULL);
 			break;
 		}
-        case SIOCSIWFRAG:  //set fragmentation thr (bytes)
-        {
-        	struct iw_param *frag=&wrq->u.frag;
-        	rt_ioctl_siwfrag(net_dev, NULL, frag, NULL);
+	case SIOCSIWFRAG:	/*set fragmentation thr (bytes) */
+		{
+			struct iw_param *frag = &wrq->u.frag;
+			rt_ioctl_siwfrag(net_dev, NULL, frag, NULL);
 			break;
 		}
-        case SIOCGIWENCODE:  //get encoding token & mode
-        {
-        	struct iw_point *erq=&wrq->u.encoding;
-        	if(erq->pointer)
-        		rt_ioctl_giwencode(net_dev, NULL, erq, erq->pointer);
+	case SIOCGIWENCODE:	/*get encoding token & mode */
+		{
+			struct iw_point *erq = &wrq->u.encoding;
+			if (erq)
+				rt_ioctl_giwencode(net_dev, NULL, erq,
+						   erq->pointer);
 			break;
 		}
-        case SIOCSIWENCODE:  //set encoding token & mode
-        {
-        	struct iw_point *erq=&wrq->u.encoding;
-        	if(erq->pointer)
-        		rt_ioctl_siwencode(net_dev, NULL, erq, erq->pointer);
+	case SIOCSIWENCODE:	/*set encoding token & mode */
+		{
+			struct iw_point *erq = &wrq->u.encoding;
+			if (erq)
+				rt_ioctl_siwencode(net_dev, NULL, erq,
+						   erq->pointer);
 			break;
 		}
-		case SIOCGIWAP:     //get access point MAC addresses
-        {
-        	struct sockaddr *ap_addr=&wrq->u.ap_addr;
-        	rt_ioctl_giwap(net_dev, NULL, ap_addr, ap_addr->sa_data);
+	case SIOCGIWAP:	/*get access point MAC addresses */
+		{
+			struct sockaddr *ap_addr = &wrq->u.ap_addr;
+			rt_ioctl_giwap(net_dev, NULL, ap_addr,
+				       ap_addr->sa_data);
 			break;
 		}
-	    case SIOCSIWAP:  //set access point MAC addresses
-        {
-        	struct sockaddr *ap_addr=&wrq->u.ap_addr;
-        	rt_ioctl_siwap(net_dev, NULL, ap_addr, ap_addr->sa_data);
+	case SIOCSIWAP:	/*set access point MAC addresses */
+		{
+			struct sockaddr *ap_addr = &wrq->u.ap_addr;
+			rt_ioctl_siwap(net_dev, NULL, ap_addr,
+				       ap_addr->sa_data);
 			break;
 		}
-		case SIOCGIWMODE:   //get operation mode
-        {
-        	__u32 *mode=&wrq->u.mode;
-        	rt_ioctl_giwmode(net_dev, NULL, mode, NULL);
+	case SIOCGIWMODE:	/*get operation mode */
+		{
+			__u32 *mode = &wrq->u.mode;
+			rt_ioctl_giwmode(net_dev, NULL, mode, NULL);
 			break;
 		}
-		case SIOCSIWMODE:   //set operation mode
-        {
-        	__u32 *mode=&wrq->u.mode;
-        	rt_ioctl_siwmode(net_dev, NULL, mode, NULL);
+	case SIOCSIWMODE:	/*set operation mode */
+		{
+			__u32 *mode = &wrq->u.mode;
+			rt_ioctl_siwmode(net_dev, NULL, mode, NULL);
 			break;
 		}
-		case SIOCGIWSENS:   //get sensitivity (dBm)
-		case SIOCSIWSENS:	//set sensitivity (dBm)
-		case SIOCGIWPOWER:  //get Power Management settings
-		case SIOCSIWPOWER:  //set Power Management settings
-		case SIOCGIWTXPOW:  //get transmit power (dBm)
-		case SIOCSIWTXPOW:  //set transmit power (dBm)
-		case SIOCGIWRANGE:	//Get range of parameters
-		case SIOCGIWRETRY:	//get retry limits and lifetime
-		case SIOCSIWRETRY:	//set retry limits and lifetime
-		case RT_PRIV_IOCTL:
-		case RT_PRIV_IOCTL_EXT:
-			Status = -EOPNOTSUPP;
-			break;
-		case SIOCGIWPRIV:
-			if (wrq->u.data.pointer)
-			{
-				if ( access_ok(VERIFY_WRITE, wrq->u.data.pointer, sizeof(privtab)) != TRUE)
-					break;
-				wrq->u.data.length = sizeof(privtab) / sizeof(privtab[0]);
-				if (copy_to_user(wrq->u.data.pointer, privtab, sizeof(privtab)))
-					Status = -EFAULT;
-			}
-			break;
-		case RTPRIV_IOCTL_SET:
-			if(access_ok(VERIFY_READ, wrq->u.data.pointer, wrq->u.data.length) != TRUE)
-				break;
-			rt_ioctl_setparam(net_dev, NULL, NULL, wrq->u.data.pointer);
-			break;
-		case RTPRIV_IOCTL_GSITESURVEY:
-			RTMPIoctlGetSiteSurvey(pAd, wrq);
-		    break;
-        case SIOCETHTOOL:
-                break;
-		default:
-			DBGPRINT(RT_DEBUG_ERROR, ("IOCTL::unknown IOCTL's cmd = 0x%08x\n", cmd));
-			Status = -EOPNOTSUPP;
-			break;
+	case SIOCGIWSENS:	/*get sensitivity (dBm) */
+	case SIOCSIWSENS:	/*set sensitivity (dBm) */
+	case SIOCGIWPOWER:	/*get Power Management settings */
+	case SIOCSIWPOWER:	/*set Power Management settings */
+	case SIOCGIWTXPOW:	/*get transmit power (dBm) */
+	case SIOCSIWTXPOW:	/*set transmit power (dBm) */
+	case SIOCGIWRANGE:	/*Get range of parameters */
+	case SIOCGIWRETRY:	/*get retry limits and lifetime */
+	case SIOCSIWRETRY:	/*set retry limits and lifetime */
+	case RT_PRIV_IOCTL:
+	case RT_PRIV_IOCTL_EXT:
+	case RTPRIV_IOCTL_SET:
+	case RTPRIV_IOCTL_GSITESURVEY:
+	case SIOCGIWPRIV:
+		Status = -EOPNOTSUPP;
+		break;
+	case SIOCETHTOOL:
+		break;
+	default:
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("IOCTL::unknown IOCTL's cmd = 0x%08x\n", cmd));
+		Status = -EOPNOTSUPP;
+		break;
 	}
 
-    if(StateMachineTouched) // Upper layer sent a MLME-related operations
-    	RT28XX_MLME_HANDLER(pAd);
+	if (StateMachineTouched)	/* Upper layer sent a MLME-related operations */
+		RTMP_MLME_HANDLER(pAd);
 
 	return Status;
 }
@@ -2878,94 +2639,76 @@ INT rt28xx_sta_ioctl(
         TRUE if all parameters are OK, FALSE otherwise
     ==========================================================================
 */
-INT Set_SSID_Proc(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  PUCHAR          arg)
+int Set_SSID_Proc(struct rt_rtmp_adapter *pAdapter, char *arg)
 {
-    NDIS_802_11_SSID                    Ssid, *pSsid=NULL;
-    BOOLEAN                             StateMachineTouched = FALSE;
-    int                                 success = TRUE;
-
-    if( strlen(arg) <= MAX_LEN_OF_SSID)
-    {
-        NdisZeroMemory(&Ssid, sizeof(NDIS_802_11_SSID));
-        if (strlen(arg) != 0)
-        {
-            NdisMoveMemory(Ssid.Ssid, arg, strlen(arg));
-            Ssid.SsidLength = strlen(arg);
-        }
-        else   //ANY ssid
-        {
-            Ssid.SsidLength = 0;
-		    memcpy(Ssid.Ssid, "", 0);
+	struct rt_ndis_802_11_ssid Ssid, *pSsid = NULL;
+	BOOLEAN StateMachineTouched = FALSE;
+	int success = TRUE;
+
+	if (strlen(arg) <= MAX_LEN_OF_SSID) {
+		NdisZeroMemory(&Ssid, sizeof(struct rt_ndis_802_11_ssid));
+		if (strlen(arg) != 0) {
+			NdisMoveMemory(Ssid.Ssid, arg, strlen(arg));
+			Ssid.SsidLength = strlen(arg);
+		} else		/*ANY ssid */
+		{
+			Ssid.SsidLength = 0;
+			memcpy(Ssid.Ssid, "", 0);
 			pAdapter->StaCfg.BssType = BSS_INFRA;
 			pAdapter->StaCfg.AuthMode = Ndis802_11AuthModeOpen;
-	        pAdapter->StaCfg.WepStatus  = Ndis802_11EncryptionDisabled;
+			pAdapter->StaCfg.WepStatus =
+			    Ndis802_11EncryptionDisabled;
 		}
-        pSsid = &Ssid;
-
-        if (pAdapter->Mlme.CntlMachine.CurrState != CNTL_IDLE)
-        {
-            RT28XX_MLME_RESET_STATE_MACHINE(pAdapter);
-            DBGPRINT(RT_DEBUG_TRACE, ("!!! MLME busy, reset MLME state machine !!!\n"));
-        }
+		pSsid = &Ssid;
 
-        pAdapter->MlmeAux.CurrReqIsFromNdis = TRUE;
-        pAdapter->StaCfg.bScanReqIsFromWebUI = FALSE;
-		pAdapter->bConfigChanged = TRUE;
-
-        MlmeEnqueue(pAdapter,
-                    MLME_CNTL_STATE_MACHINE,
-                    OID_802_11_SSID,
-                    sizeof(NDIS_802_11_SSID),
-                    (VOID *)pSsid);
+		if (pAdapter->Mlme.CntlMachine.CurrState != CNTL_IDLE) {
+			RTMP_MLME_RESET_STATE_MACHINE(pAdapter);
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("MLME busy, reset MLME state machine!\n"));
+		}
 
-        StateMachineTouched = TRUE;
-        DBGPRINT(RT_DEBUG_TRACE, ("Set_SSID_Proc::(Len=%d,Ssid=%s)\n", Ssid.SsidLength, Ssid.Ssid));
-    }
-    else
-        success = FALSE;
+		if ((pAdapter->StaCfg.WpaPassPhraseLen >= 8) &&
+		    (pAdapter->StaCfg.WpaPassPhraseLen <= 64)) {
+			char passphrase_str[65] = { 0 };
+			u8 keyMaterial[40];
+
+			RTMPMoveMemory(passphrase_str,
+				       pAdapter->StaCfg.WpaPassPhrase,
+				       pAdapter->StaCfg.WpaPassPhraseLen);
+			RTMPZeroMemory(pAdapter->StaCfg.PMK, 32);
+			if (pAdapter->StaCfg.WpaPassPhraseLen == 64) {
+				AtoH((char *)pAdapter->StaCfg.WpaPassPhrase,
+				     pAdapter->StaCfg.PMK, 32);
+			} else {
+				PasswordHash((char *)pAdapter->StaCfg.
+					     WpaPassPhrase, Ssid.Ssid,
+					     Ssid.SsidLength, keyMaterial);
+				NdisMoveMemory(pAdapter->StaCfg.PMK,
+					       keyMaterial, 32);
+			}
+		}
 
-    if (StateMachineTouched) // Upper layer sent a MLME-related operations
-    	RT28XX_MLME_HANDLER(pAdapter);
+		pAdapter->MlmeAux.CurrReqIsFromNdis = TRUE;
+		pAdapter->StaCfg.bScanReqIsFromWebUI = FALSE;
+		pAdapter->bConfigChanged = TRUE;
 
-    return success;
-}
+		MlmeEnqueue(pAdapter,
+			    MLME_CNTL_STATE_MACHINE,
+			    OID_802_11_SSID,
+			    sizeof(struct rt_ndis_802_11_ssid), (void *) pSsid);
 
-#ifdef WMM_SUPPORT
-/*
-    ==========================================================================
-    Description:
-        Set WmmCapable Enable or Disable
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT	Set_WmmCapable_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
-	BOOLEAN	bWmmCapable;
-
-	bWmmCapable = simple_strtol(arg, 0, 10);
-
-	if ((bWmmCapable == 1)
-#ifdef RT2870
-		&& (pAd->NumberOfPipes >= 5)
-#endif // RT2870 //
-		)
-		pAd->CommonCfg.bWmmCapable = TRUE;
-	else if (bWmmCapable == 0)
-		pAd->CommonCfg.bWmmCapable = FALSE;
-	else
-		return FALSE;  //Invalid argument
+		StateMachineTouched = TRUE;
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("Set_SSID_Proc::(Len=%d,Ssid=%s)\n", Ssid.SsidLength,
+			  Ssid.Ssid));
+	} else
+		success = FALSE;
 
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_WmmCapable_Proc::(bWmmCapable=%d)\n",
-		pAd->CommonCfg.bWmmCapable));
+	if (StateMachineTouched)	/* Upper layer sent a MLME-related operations */
+		RTMP_MLME_HANDLER(pAdapter);
 
-	return TRUE;
+	return success;
 }
-#endif // WMM_SUPPORT //
 
 /*
     ==========================================================================
@@ -2975,166 +2718,184 @@ INT	Set_WmmCapable_Proc(
         TRUE if all parameters are OK, FALSE otherwise
     ==========================================================================
 */
-INT Set_NetworkType_Proc(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  PUCHAR          arg)
+int Set_NetworkType_Proc(struct rt_rtmp_adapter *pAdapter, char *arg)
 {
-    UINT32	Value = 0;
+	u32 Value = 0;
 
-    if (strcmp(arg, "Adhoc") == 0)
-	{
-		if (pAdapter->StaCfg.BssType != BSS_ADHOC)
-		{
-			// Config has changed
+	if (strcmp(arg, "Adhoc") == 0) {
+		if (pAdapter->StaCfg.BssType != BSS_ADHOC) {
+			/* Config has changed */
 			pAdapter->bConfigChanged = TRUE;
-            if (MONITOR_ON(pAdapter))
-            {
-                RTMP_IO_WRITE32(pAdapter, RX_FILTR_CFG, STANORMAL);
-                RTMP_IO_READ32(pAdapter, MAC_SYS_CTRL, &Value);
+			if (MONITOR_ON(pAdapter)) {
+				RTMP_IO_WRITE32(pAdapter, RX_FILTR_CFG,
+						STANORMAL);
+				RTMP_IO_READ32(pAdapter, MAC_SYS_CTRL, &Value);
 				Value &= (~0x80);
 				RTMP_IO_WRITE32(pAdapter, MAC_SYS_CTRL, Value);
-                OPSTATUS_CLEAR_FLAG(pAdapter, fOP_STATUS_MEDIA_STATE_CONNECTED);
-                pAdapter->StaCfg.bAutoReconnect = TRUE;
-                LinkDown(pAdapter, FALSE);
-            }
-			if (INFRA_ON(pAdapter))
-			{
-				//BOOLEAN Cancelled;
-				// Set the AutoReconnectSsid to prevent it reconnect to old SSID
-				// Since calling this indicate user don't want to connect to that SSID anymore.
-				pAdapter->MlmeAux.AutoReconnectSsidLen= 32;
-				NdisZeroMemory(pAdapter->MlmeAux.AutoReconnectSsid, pAdapter->MlmeAux.AutoReconnectSsidLen);
+				OPSTATUS_CLEAR_FLAG(pAdapter,
+						    fOP_STATUS_MEDIA_STATE_CONNECTED);
+				pAdapter->StaCfg.bAutoReconnect = TRUE;
+				LinkDown(pAdapter, FALSE);
+			}
+			if (INFRA_ON(pAdapter)) {
+				/*BOOLEAN Cancelled; */
+				/* Set the AutoReconnectSsid to prevent it reconnect to old SSID */
+				/* Since calling this indicate user don't want to connect to that SSID anymore. */
+				pAdapter->MlmeAux.AutoReconnectSsidLen = 32;
+				NdisZeroMemory(pAdapter->MlmeAux.
+					       AutoReconnectSsid,
+					       pAdapter->MlmeAux.
+					       AutoReconnectSsidLen);
 
 				LinkDown(pAdapter, FALSE);
 
-				DBGPRINT(RT_DEBUG_TRACE, ("NDIS_STATUS_MEDIA_DISCONNECT Event BB!\n"));
+				DBGPRINT(RT_DEBUG_TRACE,
+					 ("NDIS_STATUS_MEDIA_DISCONNECT Event BB!\n"));
 			}
 		}
 		pAdapter->StaCfg.BssType = BSS_ADHOC;
-        pAdapter->net_dev->type = pAdapter->StaCfg.OriDevType;
-		DBGPRINT(RT_DEBUG_TRACE, ("===>Set_NetworkType_Proc::(AD-HOC)\n"));
-	}
-    else if (strcmp(arg, "Infra") == 0)
-	{
-		if (pAdapter->StaCfg.BssType != BSS_INFRA)
-		{
-			// Config has changed
+		pAdapter->net_dev->type = pAdapter->StaCfg.OriDevType;
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("===>Set_NetworkType_Proc::(AD-HOC)\n"));
+	} else if (strcmp(arg, "Infra") == 0) {
+		if (pAdapter->StaCfg.BssType != BSS_INFRA) {
+			/* Config has changed */
 			pAdapter->bConfigChanged = TRUE;
-            if (MONITOR_ON(pAdapter))
-            {
-                RTMP_IO_WRITE32(pAdapter, RX_FILTR_CFG, STANORMAL);
-                RTMP_IO_READ32(pAdapter, MAC_SYS_CTRL, &Value);
+			if (MONITOR_ON(pAdapter)) {
+				RTMP_IO_WRITE32(pAdapter, RX_FILTR_CFG,
+						STANORMAL);
+				RTMP_IO_READ32(pAdapter, MAC_SYS_CTRL, &Value);
 				Value &= (~0x80);
 				RTMP_IO_WRITE32(pAdapter, MAC_SYS_CTRL, Value);
-                OPSTATUS_CLEAR_FLAG(pAdapter, fOP_STATUS_MEDIA_STATE_CONNECTED);
-                pAdapter->StaCfg.bAutoReconnect = TRUE;
-                LinkDown(pAdapter, FALSE);
-            }
-			if (ADHOC_ON(pAdapter))
-			{
-				// Set the AutoReconnectSsid to prevent it reconnect to old SSID
-				// Since calling this indicate user don't want to connect to that SSID anymore.
-				pAdapter->MlmeAux.AutoReconnectSsidLen= 32;
-				NdisZeroMemory(pAdapter->MlmeAux.AutoReconnectSsid, pAdapter->MlmeAux.AutoReconnectSsidLen);
+				OPSTATUS_CLEAR_FLAG(pAdapter,
+						    fOP_STATUS_MEDIA_STATE_CONNECTED);
+				pAdapter->StaCfg.bAutoReconnect = TRUE;
+				LinkDown(pAdapter, FALSE);
+			}
+			if (ADHOC_ON(pAdapter)) {
+				/* Set the AutoReconnectSsid to prevent it reconnect to old SSID */
+				/* Since calling this indicate user don't want to connect to that SSID anymore. */
+				pAdapter->MlmeAux.AutoReconnectSsidLen = 32;
+				NdisZeroMemory(pAdapter->MlmeAux.
+					       AutoReconnectSsid,
+					       pAdapter->MlmeAux.
+					       AutoReconnectSsidLen);
 
 				LinkDown(pAdapter, FALSE);
 			}
 		}
 		pAdapter->StaCfg.BssType = BSS_INFRA;
-        pAdapter->net_dev->type = pAdapter->StaCfg.OriDevType;
-		DBGPRINT(RT_DEBUG_TRACE, ("===>Set_NetworkType_Proc::(INFRA)\n"));
-
-        pAdapter->StaCfg.BssType = BSS_INFRA;
-	}
-    else if (strcmp(arg, "Monitor") == 0)
-    {
-		UCHAR	bbpValue = 0;
+		pAdapter->net_dev->type = pAdapter->StaCfg.OriDevType;
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("===>Set_NetworkType_Proc::(INFRA)\n"));
+	} else if (strcmp(arg, "Monitor") == 0) {
+		u8 bbpValue = 0;
 		BCN_TIME_CFG_STRUC csr;
 		OPSTATUS_CLEAR_FLAG(pAdapter, fOP_STATUS_INFRA_ON);
-        OPSTATUS_CLEAR_FLAG(pAdapter, fOP_STATUS_ADHOC_ON);
+		OPSTATUS_CLEAR_FLAG(pAdapter, fOP_STATUS_ADHOC_ON);
 		OPSTATUS_SET_FLAG(pAdapter, fOP_STATUS_MEDIA_STATE_CONNECTED);
-		// disable all periodic state machine
+		/* disable all periodic state machine */
 		pAdapter->StaCfg.bAutoReconnect = FALSE;
-		// reset all mlme state machine
-		RT28XX_MLME_RESET_STATE_MACHINE(pAdapter);
-		DBGPRINT(RT_DEBUG_TRACE, ("fOP_STATUS_MEDIA_STATE_CONNECTED \n"));
-        if (pAdapter->CommonCfg.CentralChannel == 0)
-        {
-            if (pAdapter->CommonCfg.PhyMode == PHY_11AN_MIXED)
-                pAdapter->CommonCfg.CentralChannel = 36;
-            else
-                pAdapter->CommonCfg.CentralChannel = 6;
-        }
-        else
-            N_ChannelCheck(pAdapter);
-
-	if (pAdapter->CommonCfg.PhyMode >= PHY_11ABGN_MIXED &&
-            pAdapter->CommonCfg.RegTransmitSetting.field.BW == BW_40 &&
-            pAdapter->CommonCfg.RegTransmitSetting.field.EXTCHA == EXTCHA_ABOVE)
-		{
-			// 40MHz ,control channel at lower
-			RTMP_BBP_IO_READ8_BY_REG_ID(pAdapter, BBP_R4, &bbpValue);
+		/* reset all mlme state machine */
+		RTMP_MLME_RESET_STATE_MACHINE(pAdapter);
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("fOP_STATUS_MEDIA_STATE_CONNECTED \n"));
+		if (pAdapter->CommonCfg.CentralChannel == 0) {
+			if (pAdapter->CommonCfg.PhyMode == PHY_11AN_MIXED)
+				pAdapter->CommonCfg.CentralChannel = 36;
+			else
+				pAdapter->CommonCfg.CentralChannel = 6;
+		} else
+			N_ChannelCheck(pAdapter);
+
+		if (pAdapter->CommonCfg.PhyMode >= PHY_11ABGN_MIXED &&
+		    pAdapter->CommonCfg.RegTransmitSetting.field.BW == BW_40 &&
+		    pAdapter->CommonCfg.RegTransmitSetting.field.EXTCHA ==
+		    EXTCHA_ABOVE) {
+			/* 40MHz ,control channel at lower */
+			RTMP_BBP_IO_READ8_BY_REG_ID(pAdapter, BBP_R4,
+						    &bbpValue);
 			bbpValue &= (~0x18);
 			bbpValue |= 0x10;
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAdapter, BBP_R4, bbpValue);
+			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAdapter, BBP_R4,
+						     bbpValue);
 			pAdapter->CommonCfg.BBPCurrentBW = BW_40;
-			//  RX : control channel at lower
-			RTMP_BBP_IO_READ8_BY_REG_ID(pAdapter, BBP_R3, &bbpValue);
+			/*  RX : control channel at lower */
+			RTMP_BBP_IO_READ8_BY_REG_ID(pAdapter, BBP_R3,
+						    &bbpValue);
 			bbpValue &= (~0x20);
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAdapter, BBP_R3, bbpValue);
+			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAdapter, BBP_R3,
+						     bbpValue);
 
 			RTMP_IO_READ32(pAdapter, TX_BAND_CFG, &Value);
 			Value &= 0xfffffffe;
 			RTMP_IO_WRITE32(pAdapter, TX_BAND_CFG, Value);
-			pAdapter->CommonCfg.CentralChannel = pAdapter->CommonCfg.Channel + 2;
-            AsicSwitchChannel(pAdapter, pAdapter->CommonCfg.CentralChannel, FALSE);
-		    AsicLockChannel(pAdapter, pAdapter->CommonCfg.CentralChannel);
-            DBGPRINT(RT_DEBUG_TRACE, ("BW_40 ,control_channel(%d), CentralChannel(%d) \n",
-                                       pAdapter->CommonCfg.Channel,
-                                       pAdapter->CommonCfg.CentralChannel));
-		}
-		else if (pAdapter->CommonCfg.PhyMode >= PHY_11ABGN_MIXED &&
-                 pAdapter->CommonCfg.RegTransmitSetting.field.BW == BW_40 &&
-                 pAdapter->CommonCfg.RegTransmitSetting.field.EXTCHA == EXTCHA_BELOW)
-		{
-			// 40MHz ,control channel at upper
-			RTMP_BBP_IO_READ8_BY_REG_ID(pAdapter, BBP_R4, &bbpValue);
+			pAdapter->CommonCfg.CentralChannel =
+			    pAdapter->CommonCfg.Channel + 2;
+			AsicSwitchChannel(pAdapter,
+					  pAdapter->CommonCfg.CentralChannel,
+					  FALSE);
+			AsicLockChannel(pAdapter,
+					pAdapter->CommonCfg.CentralChannel);
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("BW_40 ,control_channel(%d), CentralChannel(%d) \n",
+				  pAdapter->CommonCfg.Channel,
+				  pAdapter->CommonCfg.CentralChannel));
+		} else if (pAdapter->CommonCfg.PhyMode >= PHY_11ABGN_MIXED
+			   && pAdapter->CommonCfg.RegTransmitSetting.field.BW ==
+			   BW_40
+			   && pAdapter->CommonCfg.RegTransmitSetting.field.
+			   EXTCHA == EXTCHA_BELOW) {
+			/* 40MHz ,control channel at upper */
+			RTMP_BBP_IO_READ8_BY_REG_ID(pAdapter, BBP_R4,
+						    &bbpValue);
 			bbpValue &= (~0x18);
 			bbpValue |= 0x10;
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAdapter, BBP_R4, bbpValue);
+			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAdapter, BBP_R4,
+						     bbpValue);
 			pAdapter->CommonCfg.BBPCurrentBW = BW_40;
 			RTMP_IO_READ32(pAdapter, TX_BAND_CFG, &Value);
 			Value |= 0x1;
 			RTMP_IO_WRITE32(pAdapter, TX_BAND_CFG, Value);
 
-			RTMP_BBP_IO_READ8_BY_REG_ID(pAdapter, BBP_R3, &bbpValue);
+			RTMP_BBP_IO_READ8_BY_REG_ID(pAdapter, BBP_R3,
+						    &bbpValue);
 			bbpValue |= (0x20);
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAdapter, BBP_R3, bbpValue);
-			pAdapter->CommonCfg.CentralChannel = pAdapter->CommonCfg.Channel - 2;
-            AsicSwitchChannel(pAdapter, pAdapter->CommonCfg.CentralChannel, FALSE);
-		    AsicLockChannel(pAdapter, pAdapter->CommonCfg.CentralChannel);
-            DBGPRINT(RT_DEBUG_TRACE, ("BW_40 ,control_channel(%d), CentralChannel(%d) \n",
-                                       pAdapter->CommonCfg.Channel,
-                                       pAdapter->CommonCfg.CentralChannel));
-		}
-		else
-		{
-			// 20MHz
-			RTMP_BBP_IO_READ8_BY_REG_ID(pAdapter, BBP_R4, &bbpValue);
+			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAdapter, BBP_R3,
+						     bbpValue);
+			pAdapter->CommonCfg.CentralChannel =
+			    pAdapter->CommonCfg.Channel - 2;
+			AsicSwitchChannel(pAdapter,
+					  pAdapter->CommonCfg.CentralChannel,
+					  FALSE);
+			AsicLockChannel(pAdapter,
+					pAdapter->CommonCfg.CentralChannel);
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("BW_40 ,control_channel(%d), CentralChannel(%d) \n",
+				  pAdapter->CommonCfg.Channel,
+				  pAdapter->CommonCfg.CentralChannel));
+		} else {
+			/* 20MHz */
+			RTMP_BBP_IO_READ8_BY_REG_ID(pAdapter, BBP_R4,
+						    &bbpValue);
 			bbpValue &= (~0x18);
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAdapter, BBP_R4, bbpValue);
+			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAdapter, BBP_R4,
+						     bbpValue);
 			pAdapter->CommonCfg.BBPCurrentBW = BW_20;
-			AsicSwitchChannel(pAdapter, pAdapter->CommonCfg.Channel, FALSE);
+			AsicSwitchChannel(pAdapter, pAdapter->CommonCfg.Channel,
+					  FALSE);
 			AsicLockChannel(pAdapter, pAdapter->CommonCfg.Channel);
-			DBGPRINT(RT_DEBUG_TRACE, ("BW_20, Channel(%d)\n", pAdapter->CommonCfg.Channel));
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("BW_20, Channel(%d)\n",
+				  pAdapter->CommonCfg.Channel));
 		}
-		// Enable Rx with promiscuous reception
+		/* Enable Rx with promiscuous reception */
 		RTMP_IO_WRITE32(pAdapter, RX_FILTR_CFG, 0x3);
-		// ASIC supporsts sniffer function with replacing RSSI with timestamp.
-		//RTMP_IO_READ32(pAdapter, MAC_SYS_CTRL, &Value);
-		//Value |= (0x80);
-		//RTMP_IO_WRITE32(pAdapter, MAC_SYS_CTRL, Value);
-		// disable sync
+		/* ASIC supporsts sniffer function with replacing RSSI with timestamp. */
+		/*RTMP_IO_READ32(pAdapter, MAC_SYS_CTRL, &Value); */
+		/*Value |= (0x80); */
+		/*RTMP_IO_WRITE32(pAdapter, MAC_SYS_CTRL, Value); */
+		/* disable sync */
 		RTMP_IO_READ32(pAdapter, BCN_TIME_CFG, &csr.word);
 		csr.field.bBeaconGen = 0;
 		csr.field.bTBTTEnable = 0;
@@ -3142,655 +2903,16 @@ INT Set_NetworkType_Proc(
 		RTMP_IO_WRITE32(pAdapter, BCN_TIME_CFG, csr.word);
 
 		pAdapter->StaCfg.BssType = BSS_MONITOR;
-        pAdapter->net_dev->type = ARPHRD_IEEE80211_PRISM; //ARPHRD_IEEE80211; // IEEE80211
-		DBGPRINT(RT_DEBUG_TRACE, ("===>Set_NetworkType_Proc::(MONITOR)\n"));
-    }
-
-    // Reset Ralink supplicant to not use, it will be set to start when UI set PMK key
-    pAdapter->StaCfg.WpaState = SS_NOTUSE;
-
-    DBGPRINT(RT_DEBUG_TRACE, ("Set_NetworkType_Proc::(NetworkType=%d)\n", pAdapter->StaCfg.BssType));
-
-    return TRUE;
-}
-
-/*
-    ==========================================================================
-    Description:
-        Set Authentication mode
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT Set_AuthMode_Proc(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  PUCHAR          arg)
-{
-    if ((strcmp(arg, "WEPAUTO") == 0) || (strcmp(arg, "wepauto") == 0))
-        pAdapter->StaCfg.AuthMode = Ndis802_11AuthModeAutoSwitch;
-    else if ((strcmp(arg, "OPEN") == 0) || (strcmp(arg, "open") == 0))
-        pAdapter->StaCfg.AuthMode = Ndis802_11AuthModeOpen;
-    else if ((strcmp(arg, "SHARED") == 0) || (strcmp(arg, "shared") == 0))
-        pAdapter->StaCfg.AuthMode = Ndis802_11AuthModeShared;
-    else if ((strcmp(arg, "WPAPSK") == 0) || (strcmp(arg, "wpapsk") == 0))
-        pAdapter->StaCfg.AuthMode = Ndis802_11AuthModeWPAPSK;
-    else if ((strcmp(arg, "WPANONE") == 0) || (strcmp(arg, "wpanone") == 0))
-        pAdapter->StaCfg.AuthMode = Ndis802_11AuthModeWPANone;
-    else if ((strcmp(arg, "WPA2PSK") == 0) || (strcmp(arg, "wpa2psk") == 0))
-        pAdapter->StaCfg.AuthMode = Ndis802_11AuthModeWPA2PSK;
-    else if ((strcmp(arg, "WPA") == 0) || (strcmp(arg, "wpa") == 0))
-        pAdapter->StaCfg.AuthMode = Ndis802_11AuthModeWPA;
-    else if ((strcmp(arg, "WPA2") == 0) || (strcmp(arg, "wpa2") == 0))
-        pAdapter->StaCfg.AuthMode = Ndis802_11AuthModeWPA2;
-    else
-        return FALSE;
-
-    pAdapter->StaCfg.PortSecured = WPA_802_1X_PORT_NOT_SECURED;
-
-    DBGPRINT(RT_DEBUG_TRACE, ("Set_AuthMode_Proc::(AuthMode=%d)\n", pAdapter->StaCfg.AuthMode));
-
-    return TRUE;
-}
-
-/*
-    ==========================================================================
-    Description:
-        Set Encryption Type
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT Set_EncrypType_Proc(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  PUCHAR          arg)
-{
-    if ((strcmp(arg, "NONE") == 0) || (strcmp(arg, "none") == 0))
-    {
-        if (pAdapter->StaCfg.AuthMode >= Ndis802_11AuthModeWPA)
-            return TRUE;    // do nothing
-
-        pAdapter->StaCfg.WepStatus     = Ndis802_11WEPDisabled;
-        pAdapter->StaCfg.PairCipher    = Ndis802_11WEPDisabled;
-	    pAdapter->StaCfg.GroupCipher   = Ndis802_11WEPDisabled;
-    }
-    else if ((strcmp(arg, "WEP") == 0) || (strcmp(arg, "wep") == 0))
-    {
-        if (pAdapter->StaCfg.AuthMode >= Ndis802_11AuthModeWPA)
-            return TRUE;    // do nothing
-
-        pAdapter->StaCfg.WepStatus     = Ndis802_11WEPEnabled;
-        pAdapter->StaCfg.PairCipher    = Ndis802_11WEPEnabled;
-	    pAdapter->StaCfg.GroupCipher   = Ndis802_11WEPEnabled;
-    }
-    else if ((strcmp(arg, "TKIP") == 0) || (strcmp(arg, "tkip") == 0))
-    {
-        if (pAdapter->StaCfg.AuthMode < Ndis802_11AuthModeWPA)
-            return TRUE;    // do nothing
-
-        pAdapter->StaCfg.WepStatus     = Ndis802_11Encryption2Enabled;
-        pAdapter->StaCfg.PairCipher    = Ndis802_11Encryption2Enabled;
-	    pAdapter->StaCfg.GroupCipher   = Ndis802_11Encryption2Enabled;
-    }
-    else if ((strcmp(arg, "AES") == 0) || (strcmp(arg, "aes") == 0))
-    {
-        if (pAdapter->StaCfg.AuthMode < Ndis802_11AuthModeWPA)
-            return TRUE;    // do nothing
-
-        pAdapter->StaCfg.WepStatus     = Ndis802_11Encryption3Enabled;
-        pAdapter->StaCfg.PairCipher    = Ndis802_11Encryption3Enabled;
-	    pAdapter->StaCfg.GroupCipher   = Ndis802_11Encryption3Enabled;
-    }
-    else
-        return FALSE;
-
-    pAdapter->StaCfg.OrigWepStatus = pAdapter->StaCfg.WepStatus;
-
-    DBGPRINT(RT_DEBUG_TRACE, ("Set_EncrypType_Proc::(EncrypType=%d)\n", pAdapter->StaCfg.WepStatus));
-
-    return TRUE;
-}
-
-/*
-    ==========================================================================
-    Description:
-        Set Default Key ID
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT Set_DefaultKeyID_Proc(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  PUCHAR          arg)
-{
-    ULONG                               KeyIdx;
-
-    KeyIdx = simple_strtol(arg, 0, 10);
-    if((KeyIdx >= 1 ) && (KeyIdx <= 4))
-        pAdapter->StaCfg.DefaultKeyId = (UCHAR) (KeyIdx - 1 );
-    else
-        return FALSE;  //Invalid argument
-
-    DBGPRINT(RT_DEBUG_TRACE, ("Set_DefaultKeyID_Proc::(DefaultKeyID=%d)\n", pAdapter->StaCfg.DefaultKeyId));
-
-    return TRUE;
-}
-
-/*
-    ==========================================================================
-    Description:
-        Set WEP KEY1
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT Set_Key1_Proc(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  PUCHAR          arg)
-{
-    int                                 KeyLen;
-    int                                 i;
-    UCHAR                               CipherAlg=CIPHER_WEP64;
-
-    if (pAdapter->StaCfg.AuthMode >= Ndis802_11AuthModeWPA)
-        return TRUE;    // do nothing
-
-    KeyLen = strlen(arg);
-
-    switch (KeyLen)
-    {
-        case 5: //wep 40 Ascii type
-            pAdapter->SharedKey[BSS0][0].KeyLen = KeyLen;
-            memcpy(pAdapter->SharedKey[BSS0][0].Key, arg, KeyLen);
-            CipherAlg = CIPHER_WEP64;
-            DBGPRINT(RT_DEBUG_TRACE, ("Set_Key1_Proc::(Key1=%s and type=%s)\n", arg, "Ascii"));
-            break;
-        case 10: //wep 40 Hex type
-            for(i=0; i < KeyLen; i++)
-            {
-                if( !isxdigit(*(arg+i)) )
-                    return FALSE;  //Not Hex value;
-            }
-            pAdapter->SharedKey[BSS0][0].KeyLen = KeyLen / 2 ;
-            AtoH(arg, pAdapter->SharedKey[BSS0][0].Key, KeyLen / 2);
-            CipherAlg = CIPHER_WEP64;
-            DBGPRINT(RT_DEBUG_TRACE, ("Set_Key1_Proc::(Key1=%s and type=%s)\n", arg, "Hex"));
-            break;
-        case 13: //wep 104 Ascii type
-            pAdapter->SharedKey[BSS0][0].KeyLen = KeyLen;
-            memcpy(pAdapter->SharedKey[BSS0][0].Key, arg, KeyLen);
-            CipherAlg = CIPHER_WEP128;
-            DBGPRINT(RT_DEBUG_TRACE, ("Set_Key1_Proc::(Key1=%s and type=%s)\n", arg, "Ascii"));
-            break;
-        case 26: //wep 104 Hex type
-            for(i=0; i < KeyLen; i++)
-            {
-                if( !isxdigit(*(arg+i)) )
-                    return FALSE;  //Not Hex value;
-            }
-            pAdapter->SharedKey[BSS0][0].KeyLen = KeyLen / 2 ;
-            AtoH(arg, pAdapter->SharedKey[BSS0][0].Key, KeyLen / 2);
-            CipherAlg = CIPHER_WEP128;
-            DBGPRINT(RT_DEBUG_TRACE, ("Set_Key1_Proc::(Key1=%s and type=%s)\n", arg, "Hex"));
-            break;
-        default: //Invalid argument
-            DBGPRINT(RT_DEBUG_TRACE, ("Set_Key1_Proc::Invalid argument (=%s)\n", arg));
-            return FALSE;
-    }
-
-    pAdapter->SharedKey[BSS0][0].CipherAlg = CipherAlg;
-
-    // Set keys (into ASIC)
-    if (pAdapter->StaCfg.AuthMode >= Ndis802_11AuthModeWPA)
-        ;   // not support
-    else    // Old WEP stuff
-    {
-        AsicAddSharedKeyEntry(pAdapter,
-                              0,
-                              0,
-                              pAdapter->SharedKey[BSS0][0].CipherAlg,
-                              pAdapter->SharedKey[BSS0][0].Key,
-                              NULL,
-                              NULL);
-    }
-
-    return TRUE;
-}
-/*
-    ==========================================================================
-
-    Description:
-        Set WEP KEY2
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT Set_Key2_Proc(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  PUCHAR          arg)
-{
-    int                                 KeyLen;
-    int                                 i;
-    UCHAR                               CipherAlg=CIPHER_WEP64;
-
-    if (pAdapter->StaCfg.AuthMode >= Ndis802_11AuthModeWPA)
-        return TRUE;    // do nothing
-
-    KeyLen = strlen(arg);
-
-    switch (KeyLen)
-    {
-        case 5: //wep 40 Ascii type
-            pAdapter->SharedKey[BSS0][1].KeyLen = KeyLen;
-            memcpy(pAdapter->SharedKey[BSS0][1].Key, arg, KeyLen);
-            CipherAlg = CIPHER_WEP64;
-            DBGPRINT(RT_DEBUG_TRACE, ("Set_Key2_Proc::(Key2=%s and type=%s)\n", arg, "Ascii"));
-            break;
-        case 10: //wep 40 Hex type
-            for(i=0; i < KeyLen; i++)
-            {
-                if( !isxdigit(*(arg+i)) )
-                    return FALSE;  //Not Hex value;
-            }
-            pAdapter->SharedKey[BSS0][1].KeyLen = KeyLen / 2 ;
-            AtoH(arg, pAdapter->SharedKey[BSS0][1].Key, KeyLen / 2);
-            CipherAlg = CIPHER_WEP64;
-            DBGPRINT(RT_DEBUG_TRACE, ("Set_Key2_Proc::(Key2=%s and type=%s)\n", arg, "Hex"));
-            break;
-        case 13: //wep 104 Ascii type
-            pAdapter->SharedKey[BSS0][1].KeyLen = KeyLen;
-            memcpy(pAdapter->SharedKey[BSS0][1].Key, arg, KeyLen);
-            CipherAlg = CIPHER_WEP128;
-            DBGPRINT(RT_DEBUG_TRACE, ("Set_Key2_Proc::(Key2=%s and type=%s)\n", arg, "Ascii"));
-            break;
-        case 26: //wep 104 Hex type
-            for(i=0; i < KeyLen; i++)
-            {
-                if( !isxdigit(*(arg+i)) )
-                    return FALSE;  //Not Hex value;
-            }
-            pAdapter->SharedKey[BSS0][1].KeyLen = KeyLen / 2 ;
-            AtoH(arg, pAdapter->SharedKey[BSS0][1].Key, KeyLen / 2);
-            CipherAlg = CIPHER_WEP128;
-            DBGPRINT(RT_DEBUG_TRACE, ("Set_Key2_Proc::(Key2=%s and type=%s)\n", arg, "Hex"));
-            break;
-        default: //Invalid argument
-            DBGPRINT(RT_DEBUG_TRACE, ("Set_Key2_Proc::Invalid argument (=%s)\n", arg));
-            return FALSE;
-    }
-    pAdapter->SharedKey[BSS0][1].CipherAlg = CipherAlg;
-
-    // Set keys (into ASIC)
-    if (pAdapter->StaCfg.AuthMode >= Ndis802_11AuthModeWPA)
-        ;   // not support
-    else    // Old WEP stuff
-    {
-        AsicAddSharedKeyEntry(pAdapter,
-                              0,
-                              1,
-                              pAdapter->SharedKey[BSS0][1].CipherAlg,
-                              pAdapter->SharedKey[BSS0][1].Key,
-                              NULL,
-                              NULL);
-    }
-
-    return TRUE;
-}
-/*
-    ==========================================================================
-    Description:
-        Set WEP KEY3
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT Set_Key3_Proc(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  PUCHAR          arg)
-{
-    int                                 KeyLen;
-    int                                 i;
-    UCHAR                               CipherAlg=CIPHER_WEP64;
-
-    if (pAdapter->StaCfg.AuthMode >= Ndis802_11AuthModeWPA)
-        return TRUE;    // do nothing
-
-    KeyLen = strlen(arg);
-
-    switch (KeyLen)
-    {
-        case 5: //wep 40 Ascii type
-            pAdapter->SharedKey[BSS0][2].KeyLen = KeyLen;
-            memcpy(pAdapter->SharedKey[BSS0][2].Key, arg, KeyLen);
-            CipherAlg = CIPHER_WEP64;
-            DBGPRINT(RT_DEBUG_TRACE, ("Set_Key3_Proc::(Key3=%s and type=Ascii)\n", arg));
-            break;
-        case 10: //wep 40 Hex type
-            for(i=0; i < KeyLen; i++)
-            {
-                if( !isxdigit(*(arg+i)) )
-                    return FALSE;  //Not Hex value;
-            }
-            pAdapter->SharedKey[BSS0][2].KeyLen = KeyLen / 2 ;
-            AtoH(arg, pAdapter->SharedKey[BSS0][2].Key, KeyLen / 2);
-            CipherAlg = CIPHER_WEP64;
-            DBGPRINT(RT_DEBUG_TRACE, ("Set_Key3_Proc::(Key3=%s and type=Hex)\n", arg));
-            break;
-        case 13: //wep 104 Ascii type
-            pAdapter->SharedKey[BSS0][2].KeyLen = KeyLen;
-            memcpy(pAdapter->SharedKey[BSS0][2].Key, arg, KeyLen);
-            CipherAlg = CIPHER_WEP128;
-            DBGPRINT(RT_DEBUG_TRACE, ("Set_Key3_Proc::(Key3=%s and type=Ascii)\n", arg));
-            break;
-        case 26: //wep 104 Hex type
-            for(i=0; i < KeyLen; i++)
-            {
-                if( !isxdigit(*(arg+i)) )
-                    return FALSE;  //Not Hex value;
-            }
-            pAdapter->SharedKey[BSS0][2].KeyLen = KeyLen / 2 ;
-            AtoH(arg, pAdapter->SharedKey[BSS0][2].Key, KeyLen / 2);
-            CipherAlg = CIPHER_WEP128;
-            DBGPRINT(RT_DEBUG_TRACE, ("Set_Key3_Proc::(Key3=%s and type=Hex)\n", arg));
-            break;
-        default: //Invalid argument
-            DBGPRINT(RT_DEBUG_TRACE, ("Set_Key3_Proc::Invalid argument (=%s)\n", arg));
-            return FALSE;
-    }
-    pAdapter->SharedKey[BSS0][2].CipherAlg = CipherAlg;
-
-    // Set keys (into ASIC)
-    if (pAdapter->StaCfg.AuthMode >= Ndis802_11AuthModeWPA)
-        ;   // not support
-    else    // Old WEP stuff
-    {
-        AsicAddSharedKeyEntry(pAdapter,
-                              0,
-                              2,
-                              pAdapter->SharedKey[BSS0][2].CipherAlg,
-                              pAdapter->SharedKey[BSS0][2].Key,
-                              NULL,
-                              NULL);
-    }
-
-    return TRUE;
-}
-/*
-    ==========================================================================
-    Description:
-        Set WEP KEY4
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT Set_Key4_Proc(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  PUCHAR          arg)
-{
-    int                                 KeyLen;
-    int                                 i;
-    UCHAR                               CipherAlg=CIPHER_WEP64;
-
-    if (pAdapter->StaCfg.AuthMode >= Ndis802_11AuthModeWPA)
-        return TRUE;    // do nothing
-
-    KeyLen = strlen(arg);
-
-    switch (KeyLen)
-    {
-        case 5: //wep 40 Ascii type
-            pAdapter->SharedKey[BSS0][3].KeyLen = KeyLen;
-            memcpy(pAdapter->SharedKey[BSS0][3].Key, arg, KeyLen);
-            CipherAlg = CIPHER_WEP64;
-            DBGPRINT(RT_DEBUG_TRACE, ("Set_Key4_Proc::(Key4=%s and type=%s)\n", arg, "Ascii"));
-            break;
-        case 10: //wep 40 Hex type
-            for(i=0; i < KeyLen; i++)
-            {
-                if( !isxdigit(*(arg+i)) )
-                    return FALSE;  //Not Hex value;
-            }
-            pAdapter->SharedKey[BSS0][3].KeyLen = KeyLen / 2 ;
-            AtoH(arg, pAdapter->SharedKey[BSS0][3].Key, KeyLen / 2);
-            CipherAlg = CIPHER_WEP64;
-            DBGPRINT(RT_DEBUG_TRACE, ("Set_Key4_Proc::(Key4=%s and type=%s)\n", arg, "Hex"));
-            break;
-        case 13: //wep 104 Ascii type
-            pAdapter->SharedKey[BSS0][3].KeyLen = KeyLen;
-            memcpy(pAdapter->SharedKey[BSS0][3].Key, arg, KeyLen);
-            CipherAlg = CIPHER_WEP128;
-            DBGPRINT(RT_DEBUG_TRACE, ("Set_Key4_Proc::(Key4=%s and type=%s)\n", arg, "Ascii"));
-            break;
-        case 26: //wep 104 Hex type
-            for(i=0; i < KeyLen; i++)
-            {
-                if( !isxdigit(*(arg+i)) )
-                    return FALSE;  //Not Hex value;
-            }
-            pAdapter->SharedKey[BSS0][3].KeyLen = KeyLen / 2 ;
-            AtoH(arg, pAdapter->SharedKey[BSS0][3].Key, KeyLen / 2);
-            CipherAlg = CIPHER_WEP128;
-            DBGPRINT(RT_DEBUG_TRACE, ("Set_Key4_Proc::(Key4=%s and type=%s)\n", arg, "Hex"));
-            break;
-        default: //Invalid argument
-            DBGPRINT(RT_DEBUG_TRACE, ("Set_Key4_Proc::Invalid argument (=%s)\n", arg));
-            return FALSE;
-    }
-    pAdapter->SharedKey[BSS0][3].CipherAlg = CipherAlg;
-
-    // Set keys (into ASIC)
-    if (pAdapter->StaCfg.AuthMode >= Ndis802_11AuthModeWPA)
-        ;   // not support
-    else    // Old WEP stuff
-    {
-        AsicAddSharedKeyEntry(pAdapter,
-                              0,
-                              3,
-                              pAdapter->SharedKey[BSS0][3].CipherAlg,
-                              pAdapter->SharedKey[BSS0][3].Key,
-                              NULL,
-                              NULL);
-    }
-
-    return TRUE;
-}
-
-/*
-    ==========================================================================
-    Description:
-        Set WPA PSK key
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT Set_WPAPSK_Proc(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  PUCHAR          arg)
-{
-    UCHAR                   keyMaterial[40];
-
-    if ((pAdapter->StaCfg.AuthMode != Ndis802_11AuthModeWPAPSK) &&
-        (pAdapter->StaCfg.AuthMode != Ndis802_11AuthModeWPA2PSK) &&
-	    (pAdapter->StaCfg.AuthMode != Ndis802_11AuthModeWPANone)
-		)
-        return TRUE;    // do nothing
-
-    DBGPRINT(RT_DEBUG_TRACE, ("Set_WPAPSK_Proc::(WPAPSK=%s)\n", arg));
-
-    NdisZeroMemory(keyMaterial, 40);
-
-    if ((strlen(arg) < 8) || (strlen(arg) > 64))
-    {
-        DBGPRINT(RT_DEBUG_TRACE, ("Set failed!!(WPAPSK=%s), WPAPSK key-string required 8 ~ 64 characters \n", arg));
-        return FALSE;
-    }
-
-    if (strlen(arg) == 64)
-    {
-        AtoH(arg, keyMaterial, 32);
-        NdisMoveMemory(pAdapter->StaCfg.PMK, keyMaterial, 32);
-
-    }
-    else
-    {
-        PasswordHash((char *)arg, pAdapter->MlmeAux.Ssid, pAdapter->MlmeAux.SsidLen, keyMaterial);
-        NdisMoveMemory(pAdapter->StaCfg.PMK, keyMaterial, 32);
-    }
-
-
-
-    if(pAdapter->StaCfg.BssType == BSS_ADHOC &&
-       pAdapter->StaCfg.AuthMode == Ndis802_11AuthModeWPANone)
-    {
-         pAdapter->StaCfg.WpaState = SS_NOTUSE;
-    }
-    else
-    {
-        // Start STA supplicant state machine
-        pAdapter->StaCfg.WpaState = SS_START;
-    }
-
-    return TRUE;
-}
-
-/*
-    ==========================================================================
-    Description:
-        Set Power Saving mode
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT Set_PSMode_Proc(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  PUCHAR          arg)
-{
-    if (pAdapter->StaCfg.BssType == BSS_INFRA)
-    {
-        if ((strcmp(arg, "Max_PSP") == 0) ||
-			(strcmp(arg, "max_psp") == 0) ||
-			(strcmp(arg, "MAX_PSP") == 0))
-        {
-            // do NOT turn on PSM bit here, wait until MlmeCheckForPsmChange()
-            // to exclude certain situations.
-            if (pAdapter->StaCfg.bWindowsACCAMEnable == FALSE)
-                pAdapter->StaCfg.WindowsPowerMode = Ndis802_11PowerModeMAX_PSP;
-            pAdapter->StaCfg.WindowsBatteryPowerMode = Ndis802_11PowerModeMAX_PSP;
-            OPSTATUS_SET_FLAG(pAdapter, fOP_STATUS_RECEIVE_DTIM);
-            pAdapter->StaCfg.DefaultListenCount = 5;
-
-        }
-        else if ((strcmp(arg, "Fast_PSP") == 0) ||
-				 (strcmp(arg, "fast_psp") == 0) ||
-                 (strcmp(arg, "FAST_PSP") == 0))
-        {
-            // do NOT turn on PSM bit here, wait until MlmeCheckForPsmChange()
-            // to exclude certain situations.
-            OPSTATUS_SET_FLAG(pAdapter, fOP_STATUS_RECEIVE_DTIM);
-            if (pAdapter->StaCfg.bWindowsACCAMEnable == FALSE)
-                pAdapter->StaCfg.WindowsPowerMode = Ndis802_11PowerModeFast_PSP;
-            pAdapter->StaCfg.WindowsBatteryPowerMode = Ndis802_11PowerModeFast_PSP;
-            pAdapter->StaCfg.DefaultListenCount = 3;
-        }
-        else if ((strcmp(arg, "Legacy_PSP") == 0) ||
-                 (strcmp(arg, "legacy_psp") == 0) ||
-                 (strcmp(arg, "LEGACY_PSP") == 0))
-        {
-            // do NOT turn on PSM bit here, wait until MlmeCheckForPsmChange()
-            // to exclude certain situations.
-            OPSTATUS_SET_FLAG(pAdapter, fOP_STATUS_RECEIVE_DTIM);
-            if (pAdapter->StaCfg.bWindowsACCAMEnable == FALSE)
-                pAdapter->StaCfg.WindowsPowerMode = Ndis802_11PowerModeLegacy_PSP;
-            pAdapter->StaCfg.WindowsBatteryPowerMode = Ndis802_11PowerModeLegacy_PSP;
-            pAdapter->StaCfg.DefaultListenCount = 3;
-        }
-        else
-        {
-            //Default Ndis802_11PowerModeCAM
-            // clear PSM bit immediately
-            MlmeSetPsmBit(pAdapter, PWR_ACTIVE);
-            OPSTATUS_SET_FLAG(pAdapter, fOP_STATUS_RECEIVE_DTIM);
-            if (pAdapter->StaCfg.bWindowsACCAMEnable == FALSE)
-                pAdapter->StaCfg.WindowsPowerMode = Ndis802_11PowerModeCAM;
-            pAdapter->StaCfg.WindowsBatteryPowerMode = Ndis802_11PowerModeCAM;
-        }
-
-        DBGPRINT(RT_DEBUG_TRACE, ("Set_PSMode_Proc::(PSMode=%ld)\n", pAdapter->StaCfg.WindowsPowerMode));
-    }
-    else
-        return FALSE;
-
-
-    return TRUE;
-}
-
-/*
-    ==========================================================================
-    Description:
-        Set WpaSupport flag.
-    Value:
-        0: Driver ignore wpa_supplicant.
-        1: wpa_supplicant initiates scanning and AP selection.
-        2: driver takes care of scanning, AP selection, and IEEE 802.11 association parameters.
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT Set_Wpa_Support(
-    IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
-
-    if ( simple_strtol(arg, 0, 10) == 0)
-        pAd->StaCfg.WpaSupplicantUP = WPA_SUPPLICANT_DISABLE;
-    else if ( simple_strtol(arg, 0, 10) == 1)
-        pAd->StaCfg.WpaSupplicantUP = WPA_SUPPLICANT_ENABLE;
-    else if ( simple_strtol(arg, 0, 10) == 2)
-        pAd->StaCfg.WpaSupplicantUP = WPA_SUPPLICANT_ENABLE_WITH_WEB_UI;
-    else
-        pAd->StaCfg.WpaSupplicantUP = WPA_SUPPLICANT_DISABLE;
-
-    DBGPRINT(RT_DEBUG_TRACE, ("Set_Wpa_Support::(WpaSupplicantUP=%d)\n", pAd->StaCfg.WpaSupplicantUP));
-
-    return TRUE;
-}
-
-INT Set_TGnWifiTest_Proc(
-    IN  PRTMP_ADAPTER   pAd,
-    IN  PUCHAR          arg)
-{
-    if (simple_strtol(arg, 0, 10) == 0)
-        pAd->StaCfg.bTGnWifiTest = FALSE;
-    else
-        pAd->StaCfg.bTGnWifiTest = TRUE;
-
-    DBGPRINT(RT_DEBUG_TRACE, ("IF Set_TGnWifiTest_Proc::(bTGnWifiTest=%d)\n", pAd->StaCfg.bTGnWifiTest));
-	return TRUE;
-}
-
-INT Set_LongRetryLimit_Proc(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	PUCHAR			arg)
-{
-	TX_RTY_CFG_STRUC	tx_rty_cfg;
-	UCHAR				LongRetryLimit = (UCHAR)simple_strtol(arg, 0, 10);
-
-	RTMP_IO_READ32(pAdapter, TX_RTY_CFG, &tx_rty_cfg.word);
-	tx_rty_cfg.field.LongRtyLimit = LongRetryLimit;
-	RTMP_IO_WRITE32(pAdapter, TX_RTY_CFG, tx_rty_cfg.word);
-	DBGPRINT(RT_DEBUG_TRACE, ("IF Set_LongRetryLimit_Proc::(tx_rty_cfg=0x%x)\n", tx_rty_cfg.word));
-	return TRUE;
-}
+		pAdapter->net_dev->type = ARPHRD_IEEE80211_PRISM;	/*ARPHRD_IEEE80211; // IEEE80211 */
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("===>Set_NetworkType_Proc::(MONITOR)\n"));
+	}
+	/* Reset Ralink supplicant to not use, it will be set to start when UI set PMK key */
+	pAdapter->StaCfg.WpaState = SS_NOTUSE;
 
-INT Set_ShortRetryLimit_Proc(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	PUCHAR			arg)
-{
-	TX_RTY_CFG_STRUC	tx_rty_cfg;
-	UCHAR				ShortRetryLimit = (UCHAR)simple_strtol(arg, 0, 10);
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("Set_NetworkType_Proc::(NetworkType=%d)\n",
+		  pAdapter->StaCfg.BssType));
 
-	RTMP_IO_READ32(pAdapter, TX_RTY_CFG, &tx_rty_cfg.word);
-	tx_rty_cfg.field.ShortRtyLimit = ShortRetryLimit;
-	RTMP_IO_WRITE32(pAdapter, TX_RTY_CFG, tx_rty_cfg.word);
-	DBGPRINT(RT_DEBUG_TRACE, ("IF Set_ShortRetryLimit_Proc::(tx_rty_cfg=0x%x)\n", tx_rty_cfg.word));
 	return TRUE;
 }
diff --git a/drivers/staging/rt2860/usb_main_dev.c b/drivers/staging/rt2860/usb_main_dev.c
new file mode 100644
index 000000000000..925a236e1044
--- /dev/null
+++ b/drivers/staging/rt2860/usb_main_dev.c
@@ -0,0 +1,887 @@
+/*
+ *************************************************************************
+ * Ralink Tech Inc.
+ * 5F., No.36, Taiyuan St., Jhubei City,
+ * Hsinchu County 302,
+ * Taiwan, R.O.C.
+ *
+ * (c) Copyright 2002-2007, Ralink Technology, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify  *
+ * it under the terms of the GNU General Public License as published by  *
+ * the Free Software Foundation; either version 2 of the License, or     *
+ * (at your option) any later version.                                   *
+ *                                                                       *
+ * This program is distributed in the hope that it will be useful,       *
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
+ * GNU General Public License for more details.                          *
+ *                                                                       *
+ * You should have received a copy of the GNU General Public License     *
+ * along with this program; if not, write to the                         *
+ * Free Software Foundation, Inc.,                                       *
+ * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
+ *                                                                       *
+ *************************************************************************/
+
+#include "rt_config.h"
+
+/* Following information will be show when you run 'modinfo' */
+/* *** If you have a solution for the bug in current version of driver, please mail to me. */
+/* Otherwise post to forum in ralinktech's web site(www.ralinktech.com) and let all users help you. *** */
+MODULE_AUTHOR("Paul Lin <paul_lin@ralinktech.com>");
+MODULE_DESCRIPTION("RT2870/RT3070 Wireless Lan Linux Driver");
+MODULE_LICENSE("GPL");
+#ifdef MODULE_VERSION
+MODULE_VERSION(STA_DRIVER_VERSION);
+#endif
+
+/* module table */
+struct usb_device_id rtusb_usb_id[] = {
+#ifdef RT2870
+	{USB_DEVICE(0x148F, 0x2770)},	/* Ralink */
+	{USB_DEVICE(0x148F, 0x2870)},	/* Ralink */
+	{USB_DEVICE(0x07B8, 0x2870)},	/* AboCom */
+	{USB_DEVICE(0x07B8, 0x2770)},	/* AboCom */
+	{USB_DEVICE(0x0DF6, 0x0039)},	/* Sitecom 2770 */
+	{USB_DEVICE(0x083A, 0x7512)},	/* Arcadyan 2770 */
+	{USB_DEVICE(0x0789, 0x0162)},	/* Logitec 2870 */
+	{USB_DEVICE(0x0789, 0x0163)},	/* Logitec 2870 */
+	{USB_DEVICE(0x0789, 0x0164)},	/* Logitec 2870 */
+	{USB_DEVICE(0x177f, 0x0302)},	/* lsusb */
+	{USB_DEVICE(0x0B05, 0x1731)},	/* Asus */
+	{USB_DEVICE(0x0B05, 0x1732)},	/* Asus */
+	{USB_DEVICE(0x0B05, 0x1742)},	/* Asus */
+	{USB_DEVICE(0x0DF6, 0x0017)},	/* Sitecom */
+	{USB_DEVICE(0x0DF6, 0x002B)},	/* Sitecom */
+	{USB_DEVICE(0x0DF6, 0x002C)},	/* Sitecom */
+	{USB_DEVICE(0x0DF6, 0x002D)},	/* Sitecom */
+	{USB_DEVICE(0x14B2, 0x3C06)},	/* Conceptronic */
+	{USB_DEVICE(0x14B2, 0x3C28)},	/* Conceptronic */
+	{USB_DEVICE(0x2019, 0xED06)},	/* Planex Communications, Inc. */
+	{USB_DEVICE(0x07D1, 0x3C09)},	/* D-Link */
+	{USB_DEVICE(0x07D1, 0x3C11)},	/* D-Link */
+	{USB_DEVICE(0x14B2, 0x3C07)},	/* AL */
+	{USB_DEVICE(0x050D, 0x8053)},	/* Belkin */
+	{USB_DEVICE(0x14B2, 0x3C23)},	/* Airlink */
+	{USB_DEVICE(0x14B2, 0x3C27)},	/* Airlink */
+	{USB_DEVICE(0x07AA, 0x002F)},	/* Corega */
+	{USB_DEVICE(0x07AA, 0x003C)},	/* Corega */
+	{USB_DEVICE(0x07AA, 0x003F)},	/* Corega */
+	{USB_DEVICE(0x1044, 0x800B)},	/* Gigabyte */
+	{USB_DEVICE(0x15A9, 0x0006)},	/* Sparklan */
+	{USB_DEVICE(0x083A, 0xB522)},	/* SMC */
+	{USB_DEVICE(0x083A, 0xA618)},	/* SMC */
+	{USB_DEVICE(0x083A, 0x8522)},	/* Arcadyan */
+	{USB_DEVICE(0x083A, 0x7522)},	/* Arcadyan */
+	{USB_DEVICE(0x0CDE, 0x0022)},	/* ZCOM */
+	{USB_DEVICE(0x0586, 0x3416)},	/* Zyxel */
+	{USB_DEVICE(0x0CDE, 0x0025)},	/* Zyxel */
+	{USB_DEVICE(0x1740, 0x9701)},	/* EnGenius */
+	{USB_DEVICE(0x1740, 0x9702)},	/* EnGenius */
+	{USB_DEVICE(0x0471, 0x200f)},	/* Philips */
+	{USB_DEVICE(0x14B2, 0x3C25)},	/* Draytek */
+	{USB_DEVICE(0x13D3, 0x3247)},	/* AzureWave */
+	{USB_DEVICE(0x083A, 0x6618)},	/* Accton */
+	{USB_DEVICE(0x15c5, 0x0008)},	/* Amit */
+	{USB_DEVICE(0x0E66, 0x0001)},	/* Hawking */
+	{USB_DEVICE(0x0E66, 0x0003)},	/* Hawking */
+	{USB_DEVICE(0x129B, 0x1828)},	/* Siemens */
+	{USB_DEVICE(0x157E, 0x300E)},	/* U-Media */
+	{USB_DEVICE(0x050d, 0x805c)},
+	{USB_DEVICE(0x050d, 0x815c)},
+	{USB_DEVICE(0x1482, 0x3C09)},	/* Abocom */
+	{USB_DEVICE(0x14B2, 0x3C09)},	/* Alpha */
+	{USB_DEVICE(0x04E8, 0x2018)},	/* samsung */
+	{USB_DEVICE(0x5A57, 0x0280)},	/* Zinwell */
+	{USB_DEVICE(0x5A57, 0x0282)},	/* Zinwell */
+	{USB_DEVICE(0x7392, 0x7718)},
+	{USB_DEVICE(0x7392, 0x7717)},
+	{USB_DEVICE(0x1737, 0x0070)},	/* Linksys WUSB100 */
+	{USB_DEVICE(0x1737, 0x0071)},	/* Linksys WUSB600N */
+	{USB_DEVICE(0x0411, 0x00e8)},	/* Buffalo WLI-UC-G300N */
+	{USB_DEVICE(0x050d, 0x815c)},	/* Belkin F5D8053 */
+#endif /* RT2870 // */
+#ifdef RT3070
+	{USB_DEVICE(0x148F, 0x3070)},	/* Ralink 3070 */
+	{USB_DEVICE(0x148F, 0x3071)},	/* Ralink 3071 */
+	{USB_DEVICE(0x148F, 0x3072)},	/* Ralink 3072 */
+	{USB_DEVICE(0x0DB0, 0x3820)},	/* Ralink 3070 */
+	{USB_DEVICE(0x0DF6, 0x003E)},	/* Sitecom 3070 */
+	{USB_DEVICE(0x0DF6, 0x0042)},	/* Sitecom 3072 */
+	{USB_DEVICE(0x14B2, 0x3C12)},	/* AL 3070 */
+	{USB_DEVICE(0x18C5, 0x0012)},	/* Corega 3070 */
+	{USB_DEVICE(0x083A, 0x7511)},	/* Arcadyan 3070 */
+	{USB_DEVICE(0x1740, 0x9703)},	/* EnGenius 3070 */
+	{USB_DEVICE(0x1740, 0x9705)},	/* EnGenius 3071 */
+	{USB_DEVICE(0x1740, 0x9706)},	/* EnGenius 3072 */
+	{USB_DEVICE(0x13D3, 0x3273)},	/* AzureWave 3070 */
+	{USB_DEVICE(0x1044, 0x800D)},	/* Gigabyte GN-WB32L 3070 */
+	{USB_DEVICE(0x2019, 0xAB25)},	/* Planex Communications, Inc. RT3070 */
+	{USB_DEVICE(0x07B8, 0x3070)},	/* AboCom 3070 */
+	{USB_DEVICE(0x07B8, 0x3071)},	/* AboCom 3071 */
+	{USB_DEVICE(0x07B8, 0x3072)},	/* Abocom 3072 */
+	{USB_DEVICE(0x7392, 0x7711)},	/* Edimax 3070 */
+	{USB_DEVICE(0x1A32, 0x0304)},	/* Quanta 3070 */
+	{USB_DEVICE(0x1EDA, 0x2310)},	/* AirTies 3070 */
+	{USB_DEVICE(0x07D1, 0x3C0A)},	/* D-Link 3072 */
+	{USB_DEVICE(0x07D1, 0x3C0D)},	/* D-Link 3070 */
+	{USB_DEVICE(0x07D1, 0x3C0E)},	/* D-Link 3070 */
+	{USB_DEVICE(0x07D1, 0x3C0F)},	/* D-Link 3070 */
+	{USB_DEVICE(0x1D4D, 0x000C)},	/* Pegatron Corporation 3070 */
+	{USB_DEVICE(0x1D4D, 0x000E)},	/* Pegatron Corporation 3070 */
+	{USB_DEVICE(0x5A57, 0x5257)},	/* Zinwell 3070 */
+	{USB_DEVICE(0x5A57, 0x0283)},	/* Zinwell 3072 */
+	{USB_DEVICE(0x04BB, 0x0945)},	/* I-O DATA 3072 */
+	{USB_DEVICE(0x203D, 0x1480)},	/* Encore 3070 */
+#endif /* RT3070 // */
+	{USB_DEVICE(0x0DF6, 0x003F)},	/* Sitecom WL-608 */
+	{USB_DEVICE(0x1737, 0x0077)},	/* Linksys WUSB54GC-EU v3 */
+	{USB_DEVICE(0x2001, 0x3C09)},	/* D-Link */
+	{USB_DEVICE(0x2001, 0x3C0A)},	/* D-Link 3072 */
+	{USB_DEVICE(0x2019, 0xED14)},	/* Planex Communications, Inc. */
+	{}			/* Terminating entry */
+};
+
+int const rtusb_usb_id_len =
+    sizeof(rtusb_usb_id) / sizeof(struct usb_device_id);
+
+MODULE_DEVICE_TABLE(usb, rtusb_usb_id);
+
+static void rt2870_disconnect(struct usb_device *dev, struct rt_rtmp_adapter *pAd);
+
+static int __devinit rt2870_probe(IN struct usb_interface *intf,
+				  IN struct usb_device *usb_dev,
+				  IN const struct usb_device_id *dev_id,
+				  struct rt_rtmp_adapter ** ppAd);
+
+#ifndef PF_NOFREEZE
+#define PF_NOFREEZE  0
+#endif
+
+extern int rt28xx_close(IN struct net_device *net_dev);
+extern int rt28xx_open(struct net_device *net_dev);
+
+static BOOLEAN USBDevConfigInit(IN struct usb_device *dev,
+				IN struct usb_interface *intf,
+				struct rt_rtmp_adapter *pAd);
+
+/*
+========================================================================
+Routine Description:
+    Check the chipset vendor/product ID.
+
+Arguments:
+    _dev_p				Point to the PCI or USB device
+
+Return Value:
+    TRUE				Check ok
+	FALSE				Check fail
+
+Note:
+========================================================================
+*/
+BOOLEAN RT28XXChipsetCheck(IN void *_dev_p)
+{
+	struct usb_interface *intf = (struct usb_interface *)_dev_p;
+	struct usb_device *dev_p = interface_to_usbdev(intf);
+	u32 i;
+
+	for (i = 0; i < rtusb_usb_id_len; i++) {
+		if (dev_p->descriptor.idVendor == rtusb_usb_id[i].idVendor &&
+		    dev_p->descriptor.idProduct == rtusb_usb_id[i].idProduct) {
+			printk("rt2870: idVendor = 0x%x, idProduct = 0x%x\n",
+			       dev_p->descriptor.idVendor,
+			       dev_p->descriptor.idProduct);
+			break;
+		}
+	}
+
+	if (i == rtusb_usb_id_len) {
+		printk("rt2870: Error! Device Descriptor not matching!\n");
+		return FALSE;
+	}
+
+	return TRUE;
+}
+
+/**************************************************************************/
+/**************************************************************************/
+/*tested for kernel 2.6series */
+/**************************************************************************/
+/**************************************************************************/
+
+#ifdef CONFIG_PM
+static int rt2870_suspend(struct usb_interface *intf, pm_message_t state);
+static int rt2870_resume(struct usb_interface *intf);
+#endif /* CONFIG_PM // */
+
+static int rtusb_probe(struct usb_interface *intf,
+		       const struct usb_device_id *id);
+static void rtusb_disconnect(struct usb_interface *intf);
+
+static BOOLEAN USBDevConfigInit(IN struct usb_device *dev,
+				IN struct usb_interface *intf,
+				struct rt_rtmp_adapter *pAd)
+{
+	struct usb_host_interface *iface_desc;
+	unsigned long BulkOutIdx;
+	u32 i;
+
+	/* get the active interface descriptor */
+	iface_desc = intf->cur_altsetting;
+
+	/* get # of enpoints  */
+	pAd->NumberOfPipes = iface_desc->desc.bNumEndpoints;
+	DBGPRINT(RT_DEBUG_TRACE,
+		 ("NumEndpoints=%d\n", iface_desc->desc.bNumEndpoints));
+
+	/* Configure Pipes */
+	BulkOutIdx = 0;
+
+	for (i = 0; i < pAd->NumberOfPipes; i++) {
+		if ((iface_desc->endpoint[i].desc.bmAttributes ==
+		     USB_ENDPOINT_XFER_BULK) &&
+		    ((iface_desc->endpoint[i].desc.bEndpointAddress &
+		      USB_ENDPOINT_DIR_MASK) == USB_DIR_IN)) {
+			pAd->BulkInEpAddr =
+			    iface_desc->endpoint[i].desc.bEndpointAddress;
+			pAd->BulkInMaxPacketSize =
+			    le2cpu16(iface_desc->endpoint[i].desc.
+				     wMaxPacketSize);
+
+			DBGPRINT_RAW(RT_DEBUG_TRACE,
+				     ("BULK IN MaxPacketSize = %d\n",
+				      pAd->BulkInMaxPacketSize));
+			DBGPRINT_RAW(RT_DEBUG_TRACE,
+				     ("EP address = 0x%2x\n",
+				      iface_desc->endpoint[i].desc.
+				      bEndpointAddress));
+		} else
+		    if ((iface_desc->endpoint[i].desc.bmAttributes ==
+			 USB_ENDPOINT_XFER_BULK)
+			&&
+			((iface_desc->endpoint[i].desc.
+			  bEndpointAddress & USB_ENDPOINT_DIR_MASK) ==
+			 USB_DIR_OUT)) {
+			/* there are 6 bulk out EP. EP6 highest priority. */
+			/* EP1-4 is EDCA.  EP5 is HCCA. */
+			pAd->BulkOutEpAddr[BulkOutIdx++] =
+			    iface_desc->endpoint[i].desc.bEndpointAddress;
+			pAd->BulkOutMaxPacketSize =
+			    le2cpu16(iface_desc->endpoint[i].desc.
+				     wMaxPacketSize);
+
+			DBGPRINT_RAW(RT_DEBUG_TRACE,
+				     ("BULK OUT MaxPacketSize = %d\n",
+				      pAd->BulkOutMaxPacketSize));
+			DBGPRINT_RAW(RT_DEBUG_TRACE,
+				     ("EP address = 0x%2x  \n",
+				      iface_desc->endpoint[i].desc.
+				      bEndpointAddress));
+		}
+	}
+
+	if (!(pAd->BulkInEpAddr && pAd->BulkOutEpAddr[0])) {
+		printk
+		    ("%s: Could not find both bulk-in and bulk-out endpoints\n",
+		     __FUNCTION__);
+		return FALSE;
+	}
+
+	pAd->config = &dev->config->desc;
+	usb_set_intfdata(intf, pAd);
+
+	return TRUE;
+
+}
+
+static int rtusb_probe(struct usb_interface *intf,
+		       const struct usb_device_id *id)
+{
+	struct rt_rtmp_adapter *pAd;
+	struct usb_device *dev;
+	int rv;
+
+	dev = interface_to_usbdev(intf);
+	dev = usb_get_dev(dev);
+
+	rv = rt2870_probe(intf, dev, id, &pAd);
+	if (rv != 0)
+		usb_put_dev(dev);
+
+	return rv;
+}
+
+static void rtusb_disconnect(struct usb_interface *intf)
+{
+	struct usb_device *dev = interface_to_usbdev(intf);
+	struct rt_rtmp_adapter *pAd;
+
+	pAd = usb_get_intfdata(intf);
+	usb_set_intfdata(intf, NULL);
+
+	rt2870_disconnect(dev, pAd);
+}
+
+struct usb_driver rtusb_driver = {
+	.name = "rt2870",
+	.probe = rtusb_probe,
+	.disconnect = rtusb_disconnect,
+	.id_table = rtusb_usb_id,
+
+#ifdef CONFIG_PM
+suspend:rt2870_suspend,
+resume:rt2870_resume,
+#endif
+};
+
+#ifdef CONFIG_PM
+
+void RT2870RejectPendingPackets(struct rt_rtmp_adapter *pAd)
+{
+	/* clear PS packets */
+	/* clear TxSw packets */
+}
+
+static int rt2870_suspend(struct usb_interface *intf, pm_message_t state)
+{
+	struct net_device *net_dev;
+	struct rt_rtmp_adapter *pAd = usb_get_intfdata(intf);
+
+	DBGPRINT(RT_DEBUG_TRACE, ("===> rt2870_suspend()\n"));
+	net_dev = pAd->net_dev;
+	netif_device_detach(net_dev);
+
+	pAd->PM_FlgSuspend = 1;
+	if (netif_running(net_dev)) {
+		RTUSBCancelPendingBulkInIRP(pAd);
+		RTUSBCancelPendingBulkOutIRP(pAd);
+	}
+	DBGPRINT(RT_DEBUG_TRACE, ("<=== rt2870_suspend()\n"));
+	return 0;
+}
+
+static int rt2870_resume(struct usb_interface *intf)
+{
+	struct net_device *net_dev;
+	struct rt_rtmp_adapter *pAd = usb_get_intfdata(intf);
+
+	DBGPRINT(RT_DEBUG_TRACE, ("===> rt2870_resume()\n"));
+
+	pAd->PM_FlgSuspend = 0;
+	net_dev = pAd->net_dev;
+	netif_device_attach(net_dev);
+	netif_start_queue(net_dev);
+	netif_carrier_on(net_dev);
+	netif_wake_queue(net_dev);
+
+	DBGPRINT(RT_DEBUG_TRACE, ("<=== rt2870_resume()\n"));
+	return 0;
+}
+#endif /* CONFIG_PM // */
+
+/* Init driver module */
+int __init rtusb_init(void)
+{
+	printk("rtusb init --->\n");
+	return usb_register(&rtusb_driver);
+}
+
+/* Deinit driver module */
+void __exit rtusb_exit(void)
+{
+	usb_deregister(&rtusb_driver);
+	printk("<--- rtusb exit\n");
+}
+
+module_init(rtusb_init);
+module_exit(rtusb_exit);
+
+/*---------------------------------------------------------------------	*/
+/* function declarations												*/
+/*---------------------------------------------------------------------	*/
+
+/*
+========================================================================
+Routine Description:
+    MLME kernel thread.
+
+Arguments:
+	*Context			the pAd, driver control block pointer
+
+Return Value:
+    0					close the thread
+
+Note:
+========================================================================
+*/
+int MlmeThread(IN void *Context)
+{
+	struct rt_rtmp_adapter *pAd;
+	struct rt_rtmp_os_task *pTask;
+	int status;
+	status = 0;
+
+	pTask = (struct rt_rtmp_os_task *)Context;
+	pAd = (struct rt_rtmp_adapter *)pTask->priv;
+
+	RtmpOSTaskCustomize(pTask);
+
+	while (!pTask->task_killed) {
+#ifdef KTHREAD_SUPPORT
+		RTMP_WAIT_EVENT_INTERRUPTIBLE(pAd, pTask);
+#else
+		RTMP_SEM_EVENT_WAIT(&(pTask->taskSema), status);
+
+		/* unlock the device pointers */
+		if (status != 0) {
+			RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS);
+			break;
+		}
+#endif
+
+		/* lock the device pointers , need to check if required */
+		/*down(&(pAd->usbdev_semaphore)); */
+
+		if (!pAd->PM_FlgSuspend)
+			MlmeHandler(pAd);
+	}
+
+	/* notify the exit routine that we're actually exiting now
+	 *
+	 * complete()/wait_for_completion() is similar to up()/down(),
+	 * except that complete() is safe in the case where the structure
+	 * is getting deleted in a parallel mode of execution (i.e. just
+	 * after the down() -- that's necessary for the thread-shutdown
+	 * case.
+	 *
+	 * complete_and_exit() goes even further than this -- it is safe in
+	 * the case that the thread of the caller is going away (not just
+	 * the structure) -- this is necessary for the module-remove case.
+	 * This is important in preemption kernels, which transfer the flow
+	 * of execution immediately upon a complete().
+	 */
+	DBGPRINT(RT_DEBUG_TRACE, ("<---%s\n", __FUNCTION__));
+#ifndef KTHREAD_SUPPORT
+	pTask->taskPID = THREAD_PID_INIT_VALUE;
+	complete_and_exit(&pTask->taskComplete, 0);
+#endif
+	return 0;
+
+}
+
+/*
+========================================================================
+Routine Description:
+    USB command kernel thread.
+
+Arguments:
+	*Context			the pAd, driver control block pointer
+
+Return Value:
+    0					close the thread
+
+Note:
+========================================================================
+*/
+int RTUSBCmdThread(IN void *Context)
+{
+	struct rt_rtmp_adapter *pAd;
+	struct rt_rtmp_os_task *pTask;
+	int status;
+	status = 0;
+
+	pTask = (struct rt_rtmp_os_task *)Context;
+	pAd = (struct rt_rtmp_adapter *)pTask->priv;
+
+	RtmpOSTaskCustomize(pTask);
+
+	NdisAcquireSpinLock(&pAd->CmdQLock);
+	pAd->CmdQ.CmdQState = RTMP_TASK_STAT_RUNNING;
+	NdisReleaseSpinLock(&pAd->CmdQLock);
+
+	while (pAd && pAd->CmdQ.CmdQState == RTMP_TASK_STAT_RUNNING) {
+#ifdef KTHREAD_SUPPORT
+		RTMP_WAIT_EVENT_INTERRUPTIBLE(pAd, pTask);
+#else
+		/* lock the device pointers */
+		RTMP_SEM_EVENT_WAIT(&(pTask->taskSema), status);
+
+		if (status != 0) {
+			RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS);
+			break;
+		}
+#endif
+
+		if (pAd->CmdQ.CmdQState == RTMP_TASK_STAT_STOPED)
+			break;
+
+		if (!pAd->PM_FlgSuspend)
+			CMDHandler(pAd);
+	}
+
+	if (pAd && !pAd->PM_FlgSuspend) {	/* Clear the CmdQElements. */
+		struct rt_cmdqelmt *pCmdQElmt = NULL;
+
+		NdisAcquireSpinLock(&pAd->CmdQLock);
+		pAd->CmdQ.CmdQState = RTMP_TASK_STAT_STOPED;
+		while (pAd->CmdQ.size) {
+			RTUSBDequeueCmd(&pAd->CmdQ, &pCmdQElmt);
+			if (pCmdQElmt) {
+				if (pCmdQElmt->CmdFromNdis == TRUE) {
+					if (pCmdQElmt->buffer != NULL)
+						os_free_mem(pAd,
+							    pCmdQElmt->buffer);
+					os_free_mem(pAd, (u8 *)pCmdQElmt);
+				} else {
+					if ((pCmdQElmt->buffer != NULL)
+					    && (pCmdQElmt->bufferlength != 0))
+						os_free_mem(pAd,
+							    pCmdQElmt->buffer);
+					os_free_mem(pAd, (u8 *)pCmdQElmt);
+				}
+			}
+		}
+
+		NdisReleaseSpinLock(&pAd->CmdQLock);
+	}
+	/* notify the exit routine that we're actually exiting now
+	 *
+	 * complete()/wait_for_completion() is similar to up()/down(),
+	 * except that complete() is safe in the case where the structure
+	 * is getting deleted in a parallel mode of execution (i.e. just
+	 * after the down() -- that's necessary for the thread-shutdown
+	 * case.
+	 *
+	 * complete_and_exit() goes even further than this -- it is safe in
+	 * the case that the thread of the caller is going away (not just
+	 * the structure) -- this is necessary for the module-remove case.
+	 * This is important in preemption kernels, which transfer the flow
+	 * of execution immediately upon a complete().
+	 */
+	DBGPRINT(RT_DEBUG_TRACE, ("<---RTUSBCmdThread\n"));
+
+#ifndef KTHREAD_SUPPORT
+	pTask->taskPID = THREAD_PID_INIT_VALUE;
+	complete_and_exit(&pTask->taskComplete, 0);
+#endif
+	return 0;
+
+}
+
+void RTUSBWatchDog(struct rt_rtmp_adapter *pAd)
+{
+	struct rt_ht_tx_context *pHTTXContext;
+	int idx;
+	unsigned long irqFlags;
+	PURB pUrb;
+	BOOLEAN needDumpSeq = FALSE;
+	u32 MACValue;
+	u32 TxRxQ_Pcnt;
+
+	idx = 0;
+	RTMP_IO_READ32(pAd, TXRXQ_PCNT, &MACValue);
+	if ((MACValue & 0xff) != 0) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("TX QUEUE 0 Not EMPTY(Value=0x%0x)!\n",
+			  MACValue));
+		RTMP_IO_WRITE32(pAd, PBF_CFG, 0xf40012);
+		while ((MACValue & 0xff) != 0 && (idx++ < 10)) {
+			RTMP_IO_READ32(pAd, TXRXQ_PCNT, &MACValue);
+			RTMPusecDelay(1);
+		}
+		RTMP_IO_WRITE32(pAd, PBF_CFG, 0xf40006);
+	}
+
+	if (pAd->watchDogRxOverFlowCnt >= 2) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("Maybe the Rx Bulk-In hanged! Cancel the pending Rx bulks request!\n"));
+		if ((!RTMP_TEST_FLAG
+		     (pAd,
+		      (fRTMP_ADAPTER_RESET_IN_PROGRESS |
+		       fRTMP_ADAPTER_BULKIN_RESET |
+		       fRTMP_ADAPTER_HALT_IN_PROGRESS |
+		       fRTMP_ADAPTER_NIC_NOT_EXIST)))) {
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("Call CMDTHREAD_RESET_BULK_IN to cancel the pending Rx Bulk!\n"));
+			RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_BULKIN_RESET);
+			RTUSBEnqueueInternalCmd(pAd, CMDTHREAD_RESET_BULK_IN,
+						NULL, 0);
+			needDumpSeq = TRUE;
+		}
+		pAd->watchDogRxOverFlowCnt = 0;
+	}
+
+	RTUSBReadMACRegister(pAd, 0x438, &TxRxQ_Pcnt);
+
+	for (idx = 0; idx < NUM_OF_TX_RING; idx++) {
+		pUrb = NULL;
+
+		RTMP_IRQ_LOCK(&pAd->BulkOutLock[idx], irqFlags);
+		if ((pAd->BulkOutPending[idx] == TRUE)
+		    && pAd->watchDogTxPendingCnt) {
+			int actual_length = 0, transfer_buffer_length = 0;
+			BOOLEAN isDataPacket = FALSE;
+			pAd->watchDogTxPendingCnt[idx]++;
+
+			if ((pAd->watchDogTxPendingCnt[idx] > 2) &&
+			    (!RTMP_TEST_FLAG
+			     (pAd,
+			      (fRTMP_ADAPTER_RESET_IN_PROGRESS |
+			       fRTMP_ADAPTER_HALT_IN_PROGRESS |
+			       fRTMP_ADAPTER_NIC_NOT_EXIST |
+			       fRTMP_ADAPTER_BULKOUT_RESET)))
+			    ) {
+				/* FIXME: Following code just support single bulk out. If you wanna support multiple bulk out. Modify it! */
+				pHTTXContext =
+				    (struct rt_ht_tx_context *)(&pAd->TxContext[idx]);
+				if (pHTTXContext->IRPPending) {	/* Check TxContext. */
+					pUrb = pHTTXContext->pUrb;
+
+					actual_length = pUrb->actual_length;
+					transfer_buffer_length =
+					    pUrb->transfer_buffer_length;
+					isDataPacket = TRUE;
+				} else if (idx == MGMTPIPEIDX) {
+					struct rt_tx_context *pMLMEContext, *pNULLContext,
+					    *pPsPollContext;
+
+					/*Check MgmtContext. */
+					pMLMEContext =
+					    (struct rt_tx_context *)(pAd->MgmtRing.
+							   Cell[pAd->MgmtRing.
+								TxDmaIdx].
+							   AllocVa);
+					pPsPollContext =
+					    (struct rt_tx_context *)(&pAd->PsPollContext);
+					pNULLContext =
+					    (struct rt_tx_context *)(&pAd->NullContext);
+
+					if (pMLMEContext->IRPPending) {
+						ASSERT(pMLMEContext->
+						       IRPPending);
+						pUrb = pMLMEContext->pUrb;
+					} else if (pNULLContext->IRPPending) {
+						ASSERT(pNULLContext->
+						       IRPPending);
+						pUrb = pNULLContext->pUrb;
+					} else if (pPsPollContext->IRPPending) {
+						ASSERT(pPsPollContext->
+						       IRPPending);
+						pUrb = pPsPollContext->pUrb;
+					}
+				}
+
+				RTMP_IRQ_UNLOCK(&pAd->BulkOutLock[idx],
+						irqFlags);
+
+				printk(KERN_INFO "%d:%lu LTL=%d , TL=%d L:%d\n",
+				       idx, pAd->watchDogTxPendingCnt[idx],
+				       pAd->TransferedLength[idx],
+				       actual_length, transfer_buffer_length);
+
+				if (pUrb) {
+					if ((isDataPacket
+					     && pAd->TransferedLength[idx] ==
+					     actual_length
+					     && pAd->TransferedLength[idx] <
+					     transfer_buffer_length
+					     && actual_length != 0
+/*                                      && TxRxQ_Pcnt==0 */
+					     && pAd->watchDogTxPendingCnt[idx] >
+					     3)
+					    || isDataPacket == FALSE
+					    || pAd->watchDogTxPendingCnt[idx] >
+					    6) {
+						DBGPRINT(RT_DEBUG_TRACE,
+							 ("Maybe the Tx Bulk-Out hanged! Cancel the pending Tx bulks request of idx(%d)!\n",
+							  idx));
+						DBGPRINT(RT_DEBUG_TRACE,
+							 ("Unlink the pending URB!\n"));
+						/* unlink it now */
+						RTUSB_UNLINK_URB(pUrb);
+						/* Sleep 200 microseconds to give cancellation time to work */
+						/*RTMPusecDelay(200); */
+						needDumpSeq = TRUE;
+					}
+				} else {
+					DBGPRINT(RT_DEBUG_ERROR,
+						 ("Unknown bulkOut URB maybe hanged!\n"));
+				}
+			} else {
+				RTMP_IRQ_UNLOCK(&pAd->BulkOutLock[idx],
+						irqFlags);
+			}
+
+			if (isDataPacket == TRUE)
+				pAd->TransferedLength[idx] = actual_length;
+		} else {
+			RTMP_IRQ_UNLOCK(&pAd->BulkOutLock[idx], irqFlags);
+		}
+	}
+
+	/* For Sigma debug, dump the ba_reordering sequence. */
+	if ((needDumpSeq == TRUE) && (pAd->CommonCfg.bDisableReordering == 0)) {
+		u16 Idx;
+		struct rt_ba_rec_entry *pBAEntry = NULL;
+		u8 count = 0;
+		struct reordering_mpdu *mpdu_blk;
+
+		Idx = pAd->MacTab.Content[BSSID_WCID].BARecWcidArray[0];
+
+		pBAEntry = &pAd->BATable.BARecEntry[Idx];
+		if ((pBAEntry->list.qlen > 0) && (pBAEntry->list.next != NULL)) {
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("NICUpdateRawCounters():The Queueing pkt in reordering buffer:\n"));
+			NdisAcquireSpinLock(&pBAEntry->RxReRingLock);
+			mpdu_blk = pBAEntry->list.next;
+			while (mpdu_blk) {
+				DBGPRINT(RT_DEBUG_TRACE,
+					 ("\t%d:Seq-%d, bAMSDU-%d!\n", count,
+					  mpdu_blk->Sequence,
+					  mpdu_blk->bAMSDU));
+				mpdu_blk = mpdu_blk->next;
+				count++;
+			}
+
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("\npBAEntry->LastIndSeq=%d!\n",
+				  pBAEntry->LastIndSeq));
+			NdisReleaseSpinLock(&pBAEntry->RxReRingLock);
+		}
+	}
+}
+
+/*
+========================================================================
+Routine Description:
+    Release allocated resources.
+
+Arguments:
+    *dev				Point to the PCI or USB device
+	pAd					driver control block pointer
+
+Return Value:
+    None
+
+Note:
+========================================================================
+*/
+static void rt2870_disconnect(struct usb_device *dev, struct rt_rtmp_adapter *pAd)
+{
+	DBGPRINT(RT_DEBUG_ERROR,
+		 ("rtusb_disconnect: unregister usbnet usb-%s-%s\n",
+		  dev->bus->bus_name, dev->devpath));
+	if (!pAd) {
+		usb_put_dev(dev);
+		printk("rtusb_disconnect: pAd == NULL!\n");
+		return;
+	}
+	RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST);
+
+	/* for debug, wait to show some messages to /proc system */
+	udelay(1);
+
+	RtmpPhyNetDevExit(pAd, pAd->net_dev);
+
+	/* FIXME: Shall we need following delay and flush the schedule?? */
+	udelay(1);
+	flush_scheduled_work();
+	udelay(1);
+
+	/* free the root net_device */
+	RtmpOSNetDevFree(pAd->net_dev);
+
+	RtmpRaDevCtrlExit(pAd);
+
+	/* release a use of the usb device structure */
+	usb_put_dev(dev);
+	udelay(1);
+
+	DBGPRINT(RT_DEBUG_ERROR, (" RTUSB disconnect successfully\n"));
+}
+
+static int __devinit rt2870_probe(IN struct usb_interface *intf,
+				  IN struct usb_device *usb_dev,
+				  IN const struct usb_device_id *dev_id,
+				  struct rt_rtmp_adapter ** ppAd)
+{
+	struct net_device *net_dev = NULL;
+	struct rt_rtmp_adapter *pAd = (struct rt_rtmp_adapter *)NULL;
+	int status, rv;
+	void *handle;
+	struct rt_rtmp_os_netdev_op_hook netDevHook;
+
+	DBGPRINT(RT_DEBUG_TRACE, ("===>rt2870_probe()!\n"));
+
+	/* Check chipset vendor/product ID */
+	/*if (RT28XXChipsetCheck(_dev_p) == FALSE) */
+	/*      goto err_out; */
+
+/*RtmpDevInit============================================= */
+	/* Allocate struct rt_rtmp_adapter adapter structure */
+	handle = kmalloc(sizeof(struct os_cookie), GFP_KERNEL);
+	if (handle == NULL) {
+		printk
+		    ("rt2870_probe(): Allocate memory for os handle failed!\n");
+		return -ENOMEM;
+	}
+	((struct os_cookie *)handle)->pUsb_Dev = usb_dev;
+
+	rv = RTMPAllocAdapterBlock(handle, &pAd);
+	if (rv != NDIS_STATUS_SUCCESS) {
+		kfree(handle);
+		goto err_out;
+	}
+/*USBDevInit============================================== */
+	if (USBDevConfigInit(usb_dev, intf, pAd) == FALSE)
+		goto err_out_free_radev;
+
+	RtmpRaDevCtrlInit(pAd, RTMP_DEV_INF_USB);
+
+/*NetDevInit============================================== */
+	net_dev = RtmpPhyNetDevInit(pAd, &netDevHook);
+	if (net_dev == NULL)
+		goto err_out_free_radev;
+
+	/* Here are the net_device structure with usb specific parameters. */
+	/* for supporting Network Manager.
+	 * Set the sysfs physical device reference for the network logical device if set prior to registration will
+	 * cause a symlink during initialization.
+	 */
+	SET_NETDEV_DEV(net_dev, &(usb_dev->dev));
+
+	pAd->StaCfg.OriDevType = net_dev->type;
+
+/*All done, it's time to register the net device to linux kernel. */
+	/* Register this device */
+	status = RtmpOSNetDevAttach(net_dev, &netDevHook);
+	if (status != 0)
+		goto err_out_free_netdev;
+
+#ifdef KTHREAD_SUPPORT
+	init_waitqueue_head(&pAd->mlmeTask.kthread_q);
+	init_waitqueue_head(&pAd->timerTask.kthread_q);
+	init_waitqueue_head(&pAd->cmdQTask.kthread_q);
+#endif
+
+	*ppAd = pAd;
+
+	DBGPRINT(RT_DEBUG_TRACE, ("<===rt2870_probe()!\n"));
+
+	return 0;
+
+	/* --------------------------- ERROR HANDLE --------------------------- */
+err_out_free_netdev:
+	RtmpOSNetDevFree(net_dev);
+
+err_out_free_radev:
+	RTMPFreeAdapter(pAd);
+
+err_out:
+	*ppAd = NULL;
+
+	return -1;
+
+}
diff --git a/drivers/staging/rt2860/wpa.h b/drivers/staging/rt2860/wpa.h
index 7006e389e323..6199ae6cdcd0 100644
--- a/drivers/staging/rt2860/wpa.h
+++ b/drivers/staging/rt2860/wpa.h
@@ -38,7 +38,7 @@
 #ifndef	__WPA_H__
 #define	__WPA_H__
 
-// EAPOL Key descripter frame format related length
+/* EAPOL Key descripter frame format related length */
 #define LEN_KEY_DESC_NONCE			32
 #define LEN_KEY_DESC_IV				16
 #define LEN_KEY_DESC_RSC			8
@@ -46,39 +46,38 @@
 #define LEN_KEY_DESC_REPLAY			8
 #define LEN_KEY_DESC_MIC			16
 
-// The length is the EAPoL-Key frame except key data field.
-// Please refer to 802.11i-2004 ,Figure 43u in p.78
-#define LEN_EAPOL_KEY_MSG			(sizeof(KEY_DESCRIPTER) - MAX_LEN_OF_RSNIE)
+/* The length is the EAPoL-Key frame except key data field. */
+/* Please refer to 802.11i-2004 ,Figure 43u in p.78 */
+#define LEN_EAPOL_KEY_MSG			(sizeof(struct rt_key_descripter) - MAX_LEN_OF_RSNIE)
 
-// EAP Code Type.
+/* EAP Code Type. */
 #define EAP_CODE_REQUEST	1
 #define EAP_CODE_RESPONSE	2
 #define EAP_CODE_SUCCESS    3
 #define EAP_CODE_FAILURE    4
 
-// EAPOL frame Protocol Version
+/* EAPOL frame Protocol Version */
 #define	EAPOL_VER					1
 #define	EAPOL_VER2					2
 
-// EAPOL-KEY Descriptor Type
+/* EAPOL-KEY Descriptor Type */
 #define	WPA1_KEY_DESC				0xfe
 #define WPA2_KEY_DESC               0x02
 
-// Key Descriptor Version of Key Information
+/* Key Descriptor Version of Key Information */
 #define	DESC_TYPE_TKIP				1
 #define	DESC_TYPE_AES				2
-#define DESC_TYPE_MESH				3
 
 #define LEN_MSG1_2WAY               0x7f
 #define MAX_LEN_OF_EAP_HS           256
 
 #define LEN_MASTER_KEY				32
 
-// EAPOL EK, MK
+/* EAPOL EK, MK */
 #define LEN_EAP_EK					16
 #define LEN_EAP_MICK				16
 #define LEN_EAP_KEY					((LEN_EAP_EK)+(LEN_EAP_MICK))
-// TKIP key related
+/* TKIP key related */
 #define LEN_PMKID					16
 #define LEN_TKIP_EK					16
 #define LEN_TKIP_RXMICK				8
@@ -90,12 +89,18 @@
 #define TKIP_AP_RXMICK_OFFSET		(TKIP_AP_TXMICK_OFFSET+LEN_TKIP_TXMICK)
 #define TKIP_GTK_LENGTH				((LEN_TKIP_EK)+(LEN_TKIP_RXMICK)+(LEN_TKIP_TXMICK))
 #define LEN_PTK						((LEN_EAP_KEY)+(LEN_TKIP_KEY))
+#define MIN_LEN_OF_GTK				5
+#define LEN_PMK						32
+#define LEN_PMK_NAME				16
+#define LEN_NONCE					32
 
-// RSN IE Length definition
-#define MAX_LEN_OF_RSNIE         	90
+/* RSN IE Length definition */
+#define MAX_LEN_OF_RSNIE		255
 #define MIN_LEN_OF_RSNIE         	8
 
-//EAP Packet Type
+#define KEY_LIFETIME				3600
+
+/*EAP Packet Type */
 #define	EAPPacket		0
 #define	EAPOLStart		1
 #define	EAPOLLogoff		2
@@ -114,11 +119,33 @@
 #define PAIRWISEKEY					1
 #define GROUPKEY					0
 
-// Retry timer counter initial value
+/* Retry timer counter initial value */
 #define PEER_MSG1_RETRY_TIMER_CTR           0
 #define PEER_MSG3_RETRY_TIMER_CTR           10
 #define GROUP_MSG1_RETRY_TIMER_CTR          20
 
+/*#ifdef CONFIG_AP_SUPPORT */
+/* WPA mechanism retry timer interval */
+#define PEER_MSG1_RETRY_EXEC_INTV           1000	/* 1 sec */
+#define PEER_MSG3_RETRY_EXEC_INTV           3000	/* 3 sec */
+#define GROUP_KEY_UPDATE_EXEC_INTV          1000	/* 1 sec */
+#define PEER_GROUP_KEY_UPDATE_INIV			2000	/* 2 sec */
+
+#define ENQUEUE_EAPOL_START_TIMER			200	/* 200 ms */
+
+/* group rekey interval */
+#define TIME_REKEY                          0
+#define PKT_REKEY                           1
+#define DISABLE_REKEY                       2
+#define MAX_REKEY                           2
+
+#define MAX_REKEY_INTER                     0x3ffffff
+/*#endif // CONFIG_AP_SUPPORT // */
+
+#define GROUP_SUITE					0
+#define PAIRWISE_SUITE				1
+#define AKM_SUITE					2
+#define PMKID_LIST					3
 
 #define EAPOL_START_DISABLE					0
 #define EAPOL_START_PSK						1
@@ -129,12 +156,33 @@
 #define MIX_CIPHER_WPA2_TKIP_ON(x)      (((x) & 0x02) != 0)
 #define MIX_CIPHER_WPA2_AES_ON(x)       (((x) & 0x01) != 0)
 
+#ifndef ROUND_UP
 #define ROUND_UP(__x, __y) \
-	(((ULONG)((__x)+((__y)-1))) & ((ULONG)~((__y)-1)))
+	(((unsigned long)((__x)+((__y)-1))) & ((unsigned long)~((__y)-1)))
+#endif
+
+#define	SET_u16_TO_ARRARY(_V, _LEN)		\
+{											\
+	_V[0] = (_LEN & 0xFF00) >> 8;			\
+	_V[1] = (_LEN & 0xFF);					\
+}
+
+#define	INC_u16_TO_ARRARY(_V, _LEN)			\
+{												\
+	u16	var_len;							\
+												\
+	var_len = (_V[0]<<8) | (_V[1]);				\
+	var_len += _LEN;							\
+												\
+	_V[0] = (var_len & 0xFF00) >> 8;			\
+	_V[1] = (var_len & 0xFF);					\
+}
+
+#define	CONV_ARRARY_TO_u16(_V)	((_V[0]<<8) | (_V[1]))
 
 #define	ADD_ONE_To_64BIT_VAR(_V)		\
 {										\
-	UCHAR	cnt = LEN_KEY_DESC_REPLAY;	\
+	u8	cnt = LEN_KEY_DESC_REPLAY;	\
 	do									\
 	{									\
 		cnt--;							\
@@ -146,182 +194,200 @@
 
 #define IS_WPA_CAPABILITY(a)       (((a) >= Ndis802_11AuthModeWPA) && ((a) <= Ndis802_11AuthModeWPA1PSKWPA2PSK))
 
-// EAPOL Key Information definition within Key descriptor format
-typedef	struct PACKED _KEY_INFO
-{
-	UCHAR	KeyMic:1;
-	UCHAR	Secure:1;
-	UCHAR	Error:1;
-	UCHAR	Request:1;
-	UCHAR	EKD_DL:1;       // EKD for AP; DL for STA
-	UCHAR	Rsvd:3;
-	UCHAR	KeyDescVer:3;
-	UCHAR	KeyType:1;
-	UCHAR	KeyIndex:2;
-	UCHAR	Install:1;
-	UCHAR	KeyAck:1;
-}	KEY_INFO, *PKEY_INFO;
-
-// EAPOL Key descriptor format
-typedef	struct PACKED _KEY_DESCRIPTER
-{
-	UCHAR		Type;
-	KEY_INFO	KeyInfo;
-	UCHAR		KeyLength[2];
-	UCHAR		ReplayCounter[LEN_KEY_DESC_REPLAY];
-	UCHAR		KeyNonce[LEN_KEY_DESC_NONCE];
-	UCHAR		KeyIv[LEN_KEY_DESC_IV];
-	UCHAR		KeyRsc[LEN_KEY_DESC_RSC];
-	UCHAR		KeyId[LEN_KEY_DESC_ID];
-	UCHAR		KeyMic[LEN_KEY_DESC_MIC];
-	UCHAR		KeyDataLen[2];
-	UCHAR		KeyData[MAX_LEN_OF_RSNIE];
-}	KEY_DESCRIPTER, *PKEY_DESCRIPTER;
-
-typedef	struct PACKED _EAPOL_PACKET
-{
-	UCHAR	 			ProVer;
-	UCHAR	 			ProType;
-	UCHAR	 			Body_Len[2];
-	KEY_DESCRIPTER		KeyDesc;
-}	EAPOL_PACKET, *PEAPOL_PACKET;
-
-//802.11i D10 page 83
-typedef struct PACKED _GTK_ENCAP
-{
-    UCHAR               Kid:2;
-    UCHAR               tx:1;
-    UCHAR               rsv:5;
-    UCHAR               rsv1;
-    UCHAR               GTK[TKIP_GTK_LENGTH];
-}   GTK_ENCAP, *PGTK_ENCAP;
-
-typedef struct PACKED _KDE_ENCAP
-{
-    UCHAR               Type;
-    UCHAR               Len;
-    UCHAR               OUI[3];
-    UCHAR               DataType;
-    GTK_ENCAP      GTKEncap;
-}   KDE_ENCAP, *PKDE_ENCAP;
-
-// For WPA1
-typedef struct PACKED _RSNIE {
-    UCHAR   oui[4];
-    USHORT  version;
-    UCHAR   mcast[4];
-    USHORT  ucount;
-    struct PACKED {
-        UCHAR oui[4];
-    }ucast[1];
-} RSNIE, *PRSNIE;
-
-// For WPA2
-typedef struct PACKED _RSNIE2 {
-    USHORT  version;
-    UCHAR   mcast[4];
-    USHORT  ucount;
-    struct PACKED {
-        UCHAR oui[4];
-    }ucast[1];
-} RSNIE2, *PRSNIE2;
-
-// AKM Suite
-typedef struct PACKED _RSNIE_AUTH {
-    USHORT acount;
-    struct PACKED {
-        UCHAR oui[4];
-    }auth[1];
-} RSNIE_AUTH,*PRSNIE_AUTH;
-
-typedef	union PACKED _RSN_CAPABILITIES	{
-	struct	PACKED {
-        USHORT		PreAuth:1;
-		USHORT		No_Pairwise:1;
-		USHORT		PTKSA_R_Counter:2;
-		USHORT		GTKSA_R_Counter:2;
-		USHORT		Rsvd:10;
-	}	field;
-	USHORT			word;
-}	RSN_CAPABILITIES, *PRSN_CAPABILITIES;
-
-typedef struct PACKED _EAP_HDR {
-    UCHAR   ProVer;
-    UCHAR   ProType;
-    UCHAR   Body_Len[2];
-    UCHAR   code;
-    UCHAR   identifier;
-    UCHAR   length[2]; // including code and identifier, followed by length-2 octets of data
-} EAP_HDR, *PEAP_HDR;
-
-// For supplicant state machine states. 802.11i Draft 4.1, p. 97
-// We simplified it
-typedef	enum	_WpaState
-{
-	SS_NOTUSE,				// 0
-	SS_START,				// 1
-	SS_WAIT_MSG_3,			// 2
-	SS_WAIT_GROUP,			// 3
-	SS_FINISH,  			// 4
-	SS_KEYUPDATE,			// 5
-}	WPA_STATE;
-
-//
-//	The definition of the cipher combination
-//
-// 	 bit3	bit2  bit1   bit0
-//	+------------+------------+
-// 	|	  WPA	 |	   WPA2   |
-//	+------+-----+------+-----+
-//	| TKIP | AES | TKIP | AES |
-//	|	0  |  1  |   1  |  0  | -> 0x06
-//	|	0  |  1  |   1  |  1  | -> 0x07
-//	|	1  |  0  |   0  |  1  | -> 0x09
-//	|	1  |  0  |   1  |  1  | -> 0x0B
-//	|	1  |  1  |   0  |  1  | -> 0x0D
-//	|	1  |  1  |   1  |  0  | -> 0x0E
-//	|	1  |  1  |   1  |  1  |	-> 0x0F
-//	+------+-----+------+-----+
-//
-typedef	enum	_WpaMixPairCipher
-{
-	MIX_CIPHER_NOTUSE 			= 0x00,
-	WPA_NONE_WPA2_TKIPAES		= 0x03,		// WPA2-TKIPAES
-	WPA_AES_WPA2_TKIP 			= 0x06,
-	WPA_AES_WPA2_TKIPAES		= 0x07,
-	WPA_TKIP_WPA2_AES			= 0x09,
-	WPA_TKIP_WPA2_TKIPAES		= 0x0B,
-	WPA_TKIPAES_WPA2_NONE		= 0x0C,		// WPA-TKIPAES
-	WPA_TKIPAES_WPA2_AES		= 0x0D,
-	WPA_TKIPAES_WPA2_TKIP		= 0x0E,
-	WPA_TKIPAES_WPA2_TKIPAES	= 0x0F,
-}	WPA_MIX_PAIR_CIPHER;
-
-typedef struct PACKED _RSN_IE_HEADER_STRUCT	{
-	UCHAR		Eid;
-	UCHAR		Length;
-	USHORT		Version;	// Little endian format
-}	RSN_IE_HEADER_STRUCT, *PRSN_IE_HEADER_STRUCT;
-
-// Cipher suite selector types
-typedef struct PACKED _CIPHER_SUITE_STRUCT	{
-	UCHAR		Oui[3];
-	UCHAR		Type;
-}	CIPHER_SUITE_STRUCT, *PCIPHER_SUITE_STRUCT;
-
-// Authentication and Key Management suite selector
-typedef struct PACKED _AKM_SUITE_STRUCT	{
-	UCHAR		Oui[3];
-	UCHAR		Type;
-}	AKM_SUITE_STRUCT, *PAKM_SUITE_STRUCT;
-
-// RSN capability
-typedef struct	PACKED _RSN_CAPABILITY	{
-	USHORT		Rsv:10;
-	USHORT		GTKSAReplayCnt:2;
-	USHORT		PTKSAReplayCnt:2;
-	USHORT		NoPairwise:1;
-	USHORT		PreAuth:1;
-}	RSN_CAPABILITY, *PRSN_CAPABILITY;
+/* EAPOL Key Information definition within Key descriptor format */
+struct PACKED rt_key_info {
+	u8 KeyMic:1;
+	u8 Secure:1;
+	u8 Error:1;
+	u8 Request:1;
+	u8 EKD_DL:1;		/* EKD for AP; DL for STA */
+	u8 Rsvd:3;
+	u8 KeyDescVer:3;
+	u8 KeyType:1;
+	u8 KeyIndex:2;
+	u8 Install:1;
+	u8 KeyAck:1;
+};
+
+/* EAPOL Key descriptor format */
+struct PACKED rt_key_descripter {
+	u8 Type;
+	struct rt_key_info KeyInfo;
+	u8 KeyLength[2];
+	u8 ReplayCounter[LEN_KEY_DESC_REPLAY];
+	u8 KeyNonce[LEN_KEY_DESC_NONCE];
+	u8 KeyIv[LEN_KEY_DESC_IV];
+	u8 KeyRsc[LEN_KEY_DESC_RSC];
+	u8 KeyId[LEN_KEY_DESC_ID];
+	u8 KeyMic[LEN_KEY_DESC_MIC];
+	u8 KeyDataLen[2];
+	u8 KeyData[MAX_LEN_OF_RSNIE];
+};
+
+struct PACKED rt_eapol_packet {
+	u8 ProVer;
+	u8 ProType;
+	u8 Body_Len[2];
+	struct rt_key_descripter KeyDesc;
+};
+
+/*802.11i D10 page 83 */
+struct PACKED rt_gtk_encap {
+	u8 Kid:2;
+	u8 tx:1;
+	u8 rsv:5;
+	u8 rsv1;
+	u8 GTK[TKIP_GTK_LENGTH];
+};
+
+struct PACKED rt_kde_encap {
+	u8 Type;
+	u8 Len;
+	u8 OUI[3];
+	u8 DataType;
+	struct rt_gtk_encap GTKEncap;
+};
+
+/* For WPA1 */
+struct PACKED rt_rsnie {
+	u8 oui[4];
+	u16 version;
+	u8 mcast[4];
+	u16 ucount;
+	struct PACKED {
+		u8 oui[4];
+	} ucast[1];
+};
+
+/* For WPA2 */
+struct PACKED rt_rsnie2 {
+	u16 version;
+	u8 mcast[4];
+	u16 ucount;
+	struct PACKED {
+		u8 oui[4];
+	} ucast[1];
+};
+
+/* AKM Suite */
+struct PACKED rt_rsnie_auth {
+	u16 acount;
+	struct PACKED {
+		u8 oui[4];
+	} auth[1];
+};
+
+typedef union PACKED _RSN_CAPABILITIES {
+	struct PACKED {
+		u16 PreAuth:1;
+		u16 No_Pairwise:1;
+		u16 PTKSA_R_Counter:2;
+		u16 GTKSA_R_Counter:2;
+		u16 Rsvd:10;
+	} field;
+	u16 word;
+} RSN_CAPABILITIES, *PRSN_CAPABILITIES;
+
+struct PACKED rt_eap_hdr {
+	u8 ProVer;
+	u8 ProType;
+	u8 Body_Len[2];
+	u8 code;
+	u8 identifier;
+	u8 length[2];	/* including code and identifier, followed by length-2 octets of data */
+};
+
+/* For supplicant state machine states. 802.11i Draft 4.1, p. 97 */
+/* We simplified it */
+typedef enum _WpaState {
+	SS_NOTUSE,		/* 0 */
+	SS_START,		/* 1 */
+	SS_WAIT_MSG_3,		/* 2 */
+	SS_WAIT_GROUP,		/* 3 */
+	SS_FINISH,		/* 4 */
+	SS_KEYUPDATE,		/* 5 */
+} WPA_STATE;
+
+/* */
+/*      The definition of the cipher combination */
+/* */
+/*       bit3   bit2  bit1   bit0 */
+/*      +------------+------------+ */
+/*      |         WPA    |         WPA2   | */
+/*      +------+-----+------+-----+ */
+/*      | TKIP | AES | TKIP | AES | */
+/*      |       0  |  1  |   1  |  0  | -> 0x06 */
+/*      |       0  |  1  |   1  |  1  | -> 0x07 */
+/*      |       1  |  0  |   0  |  1  | -> 0x09 */
+/*      |       1  |  0  |   1  |  1  | -> 0x0B */
+/*      |       1  |  1  |   0  |  1  | -> 0x0D */
+/*      |       1  |  1  |   1  |  0  | -> 0x0E */
+/*      |       1  |  1  |   1  |  1  | -> 0x0F */
+/*      +------+-----+------+-----+ */
+/* */
+typedef enum _WpaMixPairCipher {
+	MIX_CIPHER_NOTUSE = 0x00,
+	WPA_NONE_WPA2_TKIPAES = 0x03,	/* WPA2-TKIPAES */
+	WPA_AES_WPA2_TKIP = 0x06,
+	WPA_AES_WPA2_TKIPAES = 0x07,
+	WPA_TKIP_WPA2_AES = 0x09,
+	WPA_TKIP_WPA2_TKIPAES = 0x0B,
+	WPA_TKIPAES_WPA2_NONE = 0x0C,	/* WPA-TKIPAES */
+	WPA_TKIPAES_WPA2_AES = 0x0D,
+	WPA_TKIPAES_WPA2_TKIP = 0x0E,
+	WPA_TKIPAES_WPA2_TKIPAES = 0x0F,
+} WPA_MIX_PAIR_CIPHER;
+
+struct PACKED rt_rsn_ie_header {
+	u8 Eid;
+	u8 Length;
+	u16 Version;		/* Little endian format */
+};
+
+/* Cipher suite selector types */
+struct PACKED rt_cipher_suite_struct {
+	u8 Oui[3];
+	u8 Type;
+};
+
+/* Authentication and Key Management suite selector */
+struct PACKED rt_akm_suite {
+	u8 Oui[3];
+	u8 Type;
+};
+
+/* RSN capability */
+struct PACKED rt_rsn_capability {
+	u16 Rsv:10;
+	u16 GTKSAReplayCnt:2;
+	u16 PTKSAReplayCnt:2;
+	u16 NoPairwise:1;
+	u16 PreAuth:1;
+};
+
+/*========================================
+	The prototype is defined in cmm_wpa.c
+  ========================================*/
+BOOLEAN WpaMsgTypeSubst(u8 EAPType, int * MsgType);
+
+void PRF(u8 * key,
+	 int key_len,
+	 u8 * prefix,
+	 int prefix_len,
+	 u8 * data, int data_len, u8 * output, int len);
+
+int PasswordHash(char *password,
+		 unsigned char *ssid, int ssidlength, unsigned char *output);
+
+u8 *GetSuiteFromRSNIE(u8 *rsnie,
+			 u32 rsnie_len, u8 type, u8 * count);
+
+void WpaShowAllsuite(u8 *rsnie, u32 rsnie_len);
+
+void RTMPInsertRSNIE(u8 *pFrameBuf,
+		     unsigned long *pFrameLen,
+		     u8 *rsnie_ptr,
+		     u8 rsnie_len,
+		     u8 *pmkid_ptr, u8 pmkid_len);
 
 #endif
diff --git a/drivers/staging/rt2870/2870_main_dev.c b/drivers/staging/rt2870/2870_main_dev.c
deleted file mode 100644
index d0ed48bed2bb..000000000000
--- a/drivers/staging/rt2870/2870_main_dev.c
+++ /dev/null
@@ -1,1530 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-    Module Name:
-    rtmp_main.c
-
-    Abstract:
-    main initialization routines
-
-    Revision History:
-    Who         When            What
-    --------    ----------      ----------------------------------------------
-    Name        Date            Modification logs
-    Jan Lee		01-10-2005	    modified
-	Sample		Jun/01/07		Merge RT2870 and RT2860 drivers.
-*/
-
-#include "rt_config.h"
-
-
-// Following information will be show when you run 'modinfo'
-// *** If you have a solution for the bug in current version of driver, please mail to me.
-// Otherwise post to forum in ralinktech's web site(www.ralinktech.com) and let all users help you. ***
-MODULE_AUTHOR("Paul Lin <paul_lin@ralinktech.com>");
-MODULE_DESCRIPTION(RT28xx_CHIP_NAME " Wireless LAN Linux Driver");
-MODULE_LICENSE("GPL");
-#ifdef MODULE_VERSION
-MODULE_VERSION(STA_DRIVER_VERSION);
-#endif
-MODULE_ALIAS("rt3070sta");
-
-/* Kernel thread and vars, which handles packets that are completed. Only
- * packets that have a "complete" function are sent here. This way, the
- * completion is run out of kernel context, and doesn't block the rest of
- * the stack. */
-
-extern INT __devinit rt28xx_probe(IN void *_dev_p, IN void *_dev_id_p,
-									IN UINT argc, OUT PRTMP_ADAPTER *ppAd);
-
-struct usb_device_id rtusb_usb_id[] = {
-	{ USB_DEVICE(0x148F, 0x2770) }, /* Ralink */
-	{ USB_DEVICE(0x1737, 0x0071) }, /* Linksys WUSB600N */
-	{ USB_DEVICE(0x1737, 0x0070) }, /* Linksys */
-	{ USB_DEVICE(0x148F, 0x2870) }, /* Ralink */
-	{ USB_DEVICE(0x148F, 0x3070) }, /* Ralink 3070 */
-	{ USB_DEVICE(0x148F, 0x3071) }, /* Ralink 3071 */
-	{ USB_DEVICE(0x148F, 0x3072) }, /* Ralink 3072 */
-	{ USB_DEVICE(0x0B05, 0x1731) }, /* Asus */
-	{ USB_DEVICE(0x0B05, 0x1732) }, /* Asus */
-	{ USB_DEVICE(0x0B05, 0x1742) }, /* Asus */
-	{ USB_DEVICE(0x0DF6, 0x0017) }, /* Sitecom */
-	{ USB_DEVICE(0x0DF6, 0x002B) }, /* Sitecom */
-	{ USB_DEVICE(0x0DF6, 0x002C) }, /* Sitecom */
-	{ USB_DEVICE(0x0DF6, 0x003E) }, /* Sitecom 3070 */
-	{ USB_DEVICE(0x0DF6, 0x002D) }, /* Sitecom */
-	{ USB_DEVICE(0x0DF6, 0x0039) }, /* Sitecom 2770 */
-	{ USB_DEVICE(0x0DF6, 0x003F) }, /* Sitecom WL-608 */
-	{ USB_DEVICE(0x14B2, 0x3C06) }, /* Conceptronic */
-	{ USB_DEVICE(0x14B2, 0x3C28) }, /* Conceptronic */
-	{ USB_DEVICE(0x2019, 0xED06) }, /* Planex Communications, Inc. */
-	{ USB_DEVICE(0x2019, 0xED14) }, /* Planex Communications, Inc. */
-	{ USB_DEVICE(0x2019, 0xAB25) }, /* Planex Communications, Inc. RT3070 */
-	{ USB_DEVICE(0x07D1, 0x3C09) }, /* D-Link */
-	{ USB_DEVICE(0x07D1, 0x3C11) }, /* D-Link */
-	{ USB_DEVICE(0x2001, 0x3C09) }, /* D-Link */
-	{ USB_DEVICE(0x2001, 0x3C0A) }, /* D-Link 3072*/
-	{ USB_DEVICE(0x14B2, 0x3C07) }, /* AL */
-	{ USB_DEVICE(0x14B2, 0x3C12) }, /* AL 3070 */
-	{ USB_DEVICE(0x050D, 0x8053) }, /* Belkin */
-	{ USB_DEVICE(0x050D, 0x815C) }, /* Belkin */
-	{ USB_DEVICE(0x050D, 0x825a) }, /* Belkin */
-	{ USB_DEVICE(0x14B2, 0x3C23) }, /* Airlink */
-	{ USB_DEVICE(0x14B2, 0x3C27) }, /* Airlink */
-	{ USB_DEVICE(0x07AA, 0x002F) }, /* Corega */
-	{ USB_DEVICE(0x07AA, 0x003C) }, /* Corega */
-	{ USB_DEVICE(0x07AA, 0x003F) }, /* Corega */
-	{ USB_DEVICE(0x18C5, 0x0012) }, /* Corega 3070 */
-	{ USB_DEVICE(0x1044, 0x800B) }, /* Gigabyte */
-	{ USB_DEVICE(0x1044, 0x800D) }, /* Gigabyte GN-WB32L 3070 */
-	{ USB_DEVICE(0x15A9, 0x0006) }, /* Sparklan */
-	{ USB_DEVICE(0x083A, 0xB522) }, /* SMC */
-	{ USB_DEVICE(0x083A, 0xA618) }, /* SMC */
-	{ USB_DEVICE(0x083A, 0x8522) }, /* Arcadyan */
-	{ USB_DEVICE(0x083A, 0x7512) }, /* Arcadyan 2770 */
-	{ USB_DEVICE(0x083A, 0x7522) }, /* Arcadyan */
-	{ USB_DEVICE(0x083A, 0x7511) }, /* Arcadyan 3070 */
-	{ USB_DEVICE(0x0CDE, 0x0022) }, /* ZCOM */
-	{ USB_DEVICE(0x0586, 0x3416) }, /* Zyxel */
-	{ USB_DEVICE(0x0CDE, 0x0025) }, /* Zyxel */
-	{ USB_DEVICE(0x1740, 0x9701) }, /* EnGenius */
-	{ USB_DEVICE(0x1740, 0x9702) }, /* EnGenius */
-	{ USB_DEVICE(0x1740, 0x9703) }, /* EnGenius 3070 */
-	{ USB_DEVICE(0x0471, 0x200f) }, /* Philips */
-	{ USB_DEVICE(0x14B2, 0x3C25) }, /* Draytek */
-	{ USB_DEVICE(0x13D3, 0x3247) }, /* AzureWave */
-	{ USB_DEVICE(0x13D3, 0x3273) }, /* AzureWave 3070*/
-	{ USB_DEVICE(0x083A, 0x6618) }, /* Accton */
-	{ USB_DEVICE(0x15c5, 0x0008) }, /* Amit */
-	{ USB_DEVICE(0x0E66, 0x0001) }, /* Hawking */
-	{ USB_DEVICE(0x0E66, 0x0003) }, /* Hawking */
-	{ USB_DEVICE(0x129B, 0x1828) }, /* Siemens */
-	{ USB_DEVICE(0x157E, 0x300E) }, /* U-Media */
-	{ USB_DEVICE(0x050d, 0x805c) },
-	{ USB_DEVICE(0x1482, 0x3C09) }, /* Abocom*/
-	{ USB_DEVICE(0x14B2, 0x3C09) }, /* Alpha */
-	{ USB_DEVICE(0x04E8, 0x2018) }, /* samsung */
-	{ USB_DEVICE(0x07B8, 0x3070) }, /* AboCom 3070 */
-	{ USB_DEVICE(0x07B8, 0x3071) }, /* AboCom 3071 */
-	{ USB_DEVICE(0x07B8, 0x2870) }, /* AboCom */
-	{ USB_DEVICE(0x07B8, 0x2770) }, /* AboCom */
-	{ USB_DEVICE(0x07B8, 0x3072) }, /* Abocom 3072 */
-	{ USB_DEVICE(0x7392, 0x7711) }, /* Edimax 3070 */
-	{ USB_DEVICE(0x5A57, 0x0280) }, /* Zinwell */
-	{ USB_DEVICE(0x5A57, 0x0282) }, /* Zinwell */
-	{ USB_DEVICE(0x1A32, 0x0304) }, /* Quanta 3070 */
-	{ USB_DEVICE(0x0789, 0x0162) }, /* Logitec 2870 */
-	{ USB_DEVICE(0x0789, 0x0163) }, /* Logitec 2870 */
-	{ USB_DEVICE(0x0789, 0x0164) }, /* Logitec 2870 */
-	{ USB_DEVICE(0x7392, 0x7717) }, /* Edimax */
-	{ USB_DEVICE(0x1EDA, 0x2310) }, /* AirTies 3070 */
-	{ USB_DEVICE(0x1737, 0x0077) }, /* Linksys WUSB54GC-EU v3 */
-	{ } /* Terminating entry */
-};
-
-INT const               rtusb_usb_id_len = sizeof(rtusb_usb_id) / sizeof(struct usb_device_id);
-MODULE_DEVICE_TABLE(usb, rtusb_usb_id);
-
-#ifndef PF_NOFREEZE
-#define PF_NOFREEZE  0
-#endif
-
-
-#ifdef CONFIG_PM
-static int rt2870_suspend(struct usb_interface *intf, pm_message_t state);
-static int rt2870_resume(struct usb_interface *intf);
-#endif // CONFIG_PM //
-
-/**************************************************************************/
-/**************************************************************************/
-//tested for kernel 2.6series
-/**************************************************************************/
-/**************************************************************************/
-static int rtusb_probe (struct usb_interface *intf,
-						const struct usb_device_id *id);
-static void rtusb_disconnect(struct usb_interface *intf);
-
-struct usb_driver rtusb_driver = {
-	.name="rt2870",
-	.probe=rtusb_probe,
-	.disconnect=rtusb_disconnect,
-	.id_table=rtusb_usb_id,
-
-#ifdef CONFIG_PM
-	suspend:	rt2870_suspend,
-	resume:		rt2870_resume,
-#endif
-	};
-
-#ifdef CONFIG_PM
-
-VOID RT2860RejectPendingPackets(
-	IN	PRTMP_ADAPTER	pAd)
-{
-	// clear PS packets
-	// clear TxSw packets
-}
-
-static int rt2870_suspend(
-	struct usb_interface *intf,
-	pm_message_t state)
-{
-	struct net_device *net_dev;
-	PRTMP_ADAPTER pAd = usb_get_intfdata(intf);
-
-
-	DBGPRINT(RT_DEBUG_TRACE, ("===> rt2870_suspend()\n"));
-	net_dev = pAd->net_dev;
-	netif_device_detach (net_dev);
-
-	pAd->PM_FlgSuspend = 1;
-	if (netif_running(net_dev)) {
-		RTUSBCancelPendingBulkInIRP(pAd);
-		RTUSBCancelPendingBulkOutIRP(pAd);
-	}
-	DBGPRINT(RT_DEBUG_TRACE, ("<=== rt2870_suspend()\n"));
-	return 0;
-}
-
-static int rt2870_resume(
-	struct usb_interface *intf)
-{
-	struct net_device *net_dev;
-	PRTMP_ADAPTER pAd = usb_get_intfdata(intf);
-
-
-	DBGPRINT(RT_DEBUG_TRACE, ("===> rt2870_resume()\n"));
-
-	pAd->PM_FlgSuspend = 0;
-	net_dev = pAd->net_dev;
-	netif_device_attach (net_dev);
-	netif_start_queue(net_dev);
-	netif_carrier_on(net_dev);
-	netif_wake_queue(net_dev);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("<=== rt2870_resume()\n"));
-	return 0;
-}
-#endif // CONFIG_PM //
-
-
-// Init driver module
-INT __init rtusb_init(void)
-{
-	printk("rtusb init --->\n");
-	return usb_register(&rtusb_driver);
-}
-
-// Deinit driver module
-VOID __exit rtusb_exit(void)
-{
-	usb_deregister(&rtusb_driver);
-	printk("<--- rtusb exit\n");
-}
-
-module_init(rtusb_init);
-module_exit(rtusb_exit);
-
-
-
-
-/*---------------------------------------------------------------------	*/
-/* function declarations												*/
-/*---------------------------------------------------------------------	*/
-
-/*
-========================================================================
-Routine Description:
-    MLME kernel thread.
-
-Arguments:
-	*Context			the pAd, driver control block pointer
-
-Return Value:
-    0					close the thread
-
-Note:
-========================================================================
-*/
-INT MlmeThread(
-	IN void *Context)
-{
-	PRTMP_ADAPTER	pAd = (PRTMP_ADAPTER)Context;
-	POS_COOKIE	pObj;
-	int status;
-
-	pObj = (POS_COOKIE)pAd->OS_Cookie;
-
-	rtmp_os_thread_init("rt2870MlmeThread", (PVOID)&(pAd->mlmeComplete));
-
-	while (pAd->mlme_kill == 0)
-	{
-		/* lock the device pointers */
-		//down(&(pAd->mlme_semaphore));
-		status = down_interruptible(&(pAd->mlme_semaphore));
-
-		/* lock the device pointers , need to check if required*/
-		//down(&(pAd->usbdev_semaphore));
-
-		if (!pAd->PM_FlgSuspend)
-		MlmeHandler(pAd);
-
-		/* unlock the device pointers */
-		//up(&(pAd->usbdev_semaphore));
-		if (status != 0)
-		{
-			RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS);
-			break;
-		}
-	}
-
-	/* notify the exit routine that we're actually exiting now
-	 *
-	 * complete()/wait_for_completion() is similar to up()/down(),
-	 * except that complete() is safe in the case where the structure
-	 * is getting deleted in a parallel mode of execution (i.e. just
-	 * after the down() -- that's necessary for the thread-shutdown
-	 * case.
-	 *
-	 * complete_and_exit() goes even further than this -- it is safe in
-	 * the case that the thread of the caller is going away (not just
-	 * the structure) -- this is necessary for the module-remove case.
-	 * This is important in preemption kernels, which transfer the flow
-	 * of execution immediately upon a complete().
-	 */
-	DBGPRINT(RT_DEBUG_TRACE,( "<---%s\n",__func__));
-
-	pObj->MLMEThr_pid = NULL;
-
-	complete_and_exit (&pAd->mlmeComplete, 0);
-	return 0;
-
-}
-
-
-/*
-========================================================================
-Routine Description:
-    USB command kernel thread.
-
-Arguments:
-	*Context			the pAd, driver control block pointer
-
-Return Value:
-    0					close the thread
-
-Note:
-========================================================================
-*/
-INT RTUSBCmdThread(
-	IN void * Context)
-{
-	PRTMP_ADAPTER	pAd = (PRTMP_ADAPTER)Context;
-	POS_COOKIE		pObj;
-	int status;
-
-	pObj = (POS_COOKIE)pAd->OS_Cookie;
-
-	rtmp_os_thread_init("rt2870CmdThread", (PVOID)&(pAd->CmdQComplete));
-
-	NdisAcquireSpinLock(&pAd->CmdQLock);
-	pAd->CmdQ.CmdQState = RT2870_THREAD_RUNNING;
-	NdisReleaseSpinLock(&pAd->CmdQLock);
-
-	while (pAd->CmdQ.CmdQState == RT2870_THREAD_RUNNING)
-	{
-		/* lock the device pointers */
-		//down(&(pAd->RTUSBCmd_semaphore));
-		status = down_interruptible(&(pAd->RTUSBCmd_semaphore));
-
-		if (pAd->CmdQ.CmdQState == RT2870_THREAD_STOPED)
-			break;
-
-		if (status != 0)
-		{
-			RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS);
-			break;
-		}
-		/* lock the device pointers , need to check if required*/
-		//down(&(pAd->usbdev_semaphore));
-
-		if (!pAd->PM_FlgSuspend)
-		CMDHandler(pAd);
-
-		/* unlock the device pointers */
-		//up(&(pAd->usbdev_semaphore));
-	}
-
-	if (!pAd->PM_FlgSuspend)
-	{	// Clear the CmdQElements.
-		CmdQElmt	*pCmdQElmt = NULL;
-
-		NdisAcquireSpinLock(&pAd->CmdQLock);
-		pAd->CmdQ.CmdQState = RT2870_THREAD_STOPED;
-		while(pAd->CmdQ.size)
-		{
-			RTUSBDequeueCmd(&pAd->CmdQ, &pCmdQElmt);
-			if (pCmdQElmt)
-			{
-				if (pCmdQElmt->CmdFromNdis == TRUE)
-				{
-					if (pCmdQElmt->buffer != NULL)
-						NdisFreeMemory(pCmdQElmt->buffer, pCmdQElmt->bufferlength, 0);
-
-					NdisFreeMemory(pCmdQElmt, sizeof(CmdQElmt), 0);
-				}
-				else
-				{
-					if ((pCmdQElmt->buffer != NULL) && (pCmdQElmt->bufferlength != 0))
-						NdisFreeMemory(pCmdQElmt->buffer, pCmdQElmt->bufferlength, 0);
-		            {
-						NdisFreeMemory(pCmdQElmt, sizeof(CmdQElmt), 0);
-					}
-				}
-			}
-		}
-
-		NdisReleaseSpinLock(&pAd->CmdQLock);
-	}
-	/* notify the exit routine that we're actually exiting now
-	 *
-	 * complete()/wait_for_completion() is similar to up()/down(),
-	 * except that complete() is safe in the case where the structure
-	 * is getting deleted in a parallel mode of execution (i.e. just
-	 * after the down() -- that's necessary for the thread-shutdown
-	 * case.
-	 *
-	 * complete_and_exit() goes even further than this -- it is safe in
-	 * the case that the thread of the caller is going away (not just
-	 * the structure) -- this is necessary for the module-remove case.
-	 * This is important in preemption kernels, which transfer the flow
-	 * of execution immediately upon a complete().
-	 */
-	DBGPRINT(RT_DEBUG_TRACE,( "<---RTUSBCmdThread\n"));
-
-	pObj->RTUSBCmdThr_pid = NULL;
-
-	complete_and_exit (&pAd->CmdQComplete, 0);
-	return 0;
-
-}
-
-
-static void RT2870_TimerQ_Handle(RTMP_ADAPTER *pAd)
-{
-	int status;
-	RALINK_TIMER_STRUCT	*pTimer;
-	RT2870_TIMER_ENTRY	*pEntry;
-	unsigned long	irqFlag;
-
-	while(!pAd->TimerFunc_kill)
-	{
-//		printk("waiting for event!\n");
-		pTimer = NULL;
-
-		status = down_interruptible(&(pAd->RTUSBTimer_semaphore));
-
-		if (pAd->TimerQ.status == RT2870_THREAD_STOPED)
-			break;
-
-		// event happened.
-		while(pAd->TimerQ.pQHead)
-		{
-			RTMP_IRQ_LOCK(&pAd->TimerQLock, irqFlag);
-			pEntry = pAd->TimerQ.pQHead;
-			if (pEntry)
-			{
-				pTimer = pEntry->pRaTimer;
-
-				// update pQHead
-				pAd->TimerQ.pQHead = pEntry->pNext;
-				if (pEntry == pAd->TimerQ.pQTail)
-					pAd->TimerQ.pQTail = NULL;
-
-				// return this queue entry to timerQFreeList.
-				pEntry->pNext = pAd->TimerQ.pQPollFreeList;
-				pAd->TimerQ.pQPollFreeList = pEntry;
-			}
-			RTMP_IRQ_UNLOCK(&pAd->TimerQLock, irqFlag);
-
-			if (pTimer)
-			{
-				if (pTimer->handle != NULL)
-				if (!pAd->PM_FlgSuspend)
-					pTimer->handle(NULL, (PVOID) pTimer->cookie, NULL, pTimer);
-				if ((pTimer->Repeat) && (pTimer->State == FALSE))
-					RTMP_OS_Add_Timer(&pTimer->TimerObj, pTimer->TimerValue);
-			}
-		}
-
-		if (status != 0)
-		{
-			pAd->TimerQ.status = RT2870_THREAD_STOPED;
-			RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS);
-			break;
-		}
-	}
-}
-
-
-INT TimerQThread(
-	IN OUT PVOID Context)
-{
-	PRTMP_ADAPTER	pAd;
-	POS_COOKIE	pObj;
-
-	pAd = (PRTMP_ADAPTER)Context;
-	pObj = (POS_COOKIE) pAd->OS_Cookie;
-
-	rtmp_os_thread_init("rt2870TimerQHandle", (PVOID)&(pAd->TimerQComplete));
-
-	RT2870_TimerQ_Handle(pAd);
-
-	/* notify the exit routine that we're actually exiting now
-	 *
-	 * complete()/wait_for_completion() is similar to up()/down(),
-	 * except that complete() is safe in the case where the structure
-	 * is getting deleted in a parallel mode of execution (i.e. just
-	 * after the down() -- that's necessary for the thread-shutdown
-	 * case.
-	 *
-	 * complete_and_exit() goes even further than this -- it is safe in
-	 * the case that the thread of the caller is going away (not just
-	 * the structure) -- this is necessary for the module-remove case.
-	 * This is important in preemption kernels, which transfer the flow
-	 * of execution immediately upon a complete().
-	 */
-	DBGPRINT(RT_DEBUG_TRACE,( "<---%s\n",__func__));
-
-	pObj->TimerQThr_pid = NULL;
-
-	complete_and_exit(&pAd->TimerQComplete, 0);
-	return 0;
-
-}
-
-
-RT2870_TIMER_ENTRY *RT2870_TimerQ_Insert(
-	IN RTMP_ADAPTER *pAd,
-	IN RALINK_TIMER_STRUCT *pTimer)
-{
-	RT2870_TIMER_ENTRY *pQNode = NULL, *pQTail;
-	unsigned long irqFlags;
-
-
-	RTMP_IRQ_LOCK(&pAd->TimerQLock, irqFlags);
-	if (pAd->TimerQ.status & RT2870_THREAD_CAN_DO_INSERT)
-	{
-		if(pAd->TimerQ.pQPollFreeList)
-		{
-			pQNode = pAd->TimerQ.pQPollFreeList;
-			pAd->TimerQ.pQPollFreeList = pQNode->pNext;
-
-			pQNode->pRaTimer = pTimer;
-			pQNode->pNext = NULL;
-
-			pQTail = pAd->TimerQ.pQTail;
-			if (pAd->TimerQ.pQTail != NULL)
-				pQTail->pNext = pQNode;
-			pAd->TimerQ.pQTail = pQNode;
-			if (pAd->TimerQ.pQHead == NULL)
-				pAd->TimerQ.pQHead = pQNode;
-		}
-		RTMP_IRQ_UNLOCK(&pAd->TimerQLock, irqFlags);
-
-		if (pQNode)
-			up(&pAd->RTUSBTimer_semaphore);
-			//wake_up(&timerWaitQ);
-	}
-	else
-	{
-		RTMP_IRQ_UNLOCK(&pAd->TimerQLock, irqFlags);
-	}
-	return pQNode;
-}
-
-
-BOOLEAN RT2870_TimerQ_Remove(
-	IN RTMP_ADAPTER *pAd,
-	IN RALINK_TIMER_STRUCT *pTimer)
-{
-	RT2870_TIMER_ENTRY *pNode, *pPrev = NULL;
-	unsigned long irqFlags;
-
-	RTMP_IRQ_LOCK(&pAd->TimerQLock, irqFlags);
-	if (pAd->TimerQ.status >= RT2870_THREAD_INITED)
-	{
-		pNode = pAd->TimerQ.pQHead;
-		while (pNode)
-		{
-			if (pNode->pRaTimer == pTimer)
-				break;
-			pPrev = pNode;
-			pNode = pNode->pNext;
-		}
-
-		// Now move it to freeList queue.
-		if (pNode)
-		{
-			if (pNode == pAd->TimerQ.pQHead)
-				pAd->TimerQ.pQHead = pNode->pNext;
-			if (pNode == pAd->TimerQ.pQTail)
-				pAd->TimerQ.pQTail = pPrev;
-			if (pPrev != NULL)
-				pPrev->pNext = pNode->pNext;
-
-			// return this queue entry to timerQFreeList.
-			pNode->pNext = pAd->TimerQ.pQPollFreeList;
-			pAd->TimerQ.pQPollFreeList = pNode;
-		}
-	}
-	RTMP_IRQ_UNLOCK(&pAd->TimerQLock, irqFlags);
-
-	return TRUE;
-}
-
-
-void RT2870_TimerQ_Exit(RTMP_ADAPTER *pAd)
-{
-	RT2870_TIMER_ENTRY *pTimerQ;
-	unsigned long irqFlags;
-
-	RTMP_IRQ_LOCK(&pAd->TimerQLock, irqFlags);
-	while (pAd->TimerQ.pQHead)
-	{
-		pTimerQ = pAd->TimerQ.pQHead;
-		pAd->TimerQ.pQHead = pTimerQ->pNext;
-		// remove the timeQ
-	}
-	pAd->TimerQ.pQPollFreeList = NULL;
-	os_free_mem(pAd, pAd->TimerQ.pTimerQPoll);
-	pAd->TimerQ.pQTail = NULL;
-	pAd->TimerQ.pQHead = NULL;
-	pAd->TimerQ.status = RT2870_THREAD_STOPED;
-	RTMP_IRQ_UNLOCK(&pAd->TimerQLock, irqFlags);
-
-}
-
-
-void RT2870_TimerQ_Init(RTMP_ADAPTER *pAd)
-{
-	int 	i;
-	RT2870_TIMER_ENTRY *pQNode, *pEntry;
-	unsigned long irqFlags;
-
-	NdisAllocateSpinLock(&pAd->TimerQLock);
-
-	RTMP_IRQ_LOCK(&pAd->TimerQLock, irqFlags);
-	NdisZeroMemory(&pAd->TimerQ, sizeof(pAd->TimerQ));
-	//InterlockedExchange(&pAd->TimerQ.count, 0);
-
-	/* Initialise the wait q head */
-	//init_waitqueue_head(&timerWaitQ);
-
-	os_alloc_mem(pAd, &pAd->TimerQ.pTimerQPoll, sizeof(RT2870_TIMER_ENTRY) * TIMER_QUEUE_SIZE_MAX);
-	if (pAd->TimerQ.pTimerQPoll)
-	{
-		pEntry = NULL;
-		pQNode = (RT2870_TIMER_ENTRY *)pAd->TimerQ.pTimerQPoll;
-		for (i = 0 ;i <TIMER_QUEUE_SIZE_MAX; i++)
-		{
-			pQNode->pNext = pEntry;
-			pEntry = pQNode;
-			pQNode++;
-		}
-		pAd->TimerQ.pQPollFreeList = pEntry;
-		pAd->TimerQ.pQHead = NULL;
-		pAd->TimerQ.pQTail = NULL;
-		pAd->TimerQ.status = RT2870_THREAD_INITED;
-	}
-	RTMP_IRQ_UNLOCK(&pAd->TimerQLock, irqFlags);
-}
-
-
-VOID RT2870_WatchDog(IN RTMP_ADAPTER *pAd)
-{
-	PHT_TX_CONTEXT		pHTTXContext;
-	int 					idx;
-	ULONG				irqFlags;
-	PURB		   		pUrb;
-	BOOLEAN				needDumpSeq = FALSE;
-	UINT32          	MACValue;
-
-
-	idx = 0;
-	RTMP_IO_READ32(pAd, TXRXQ_PCNT, &MACValue);
-	if ((MACValue & 0xff) !=0 )
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("TX QUEUE 0 Not EMPTY(Value=0x%0x). !!!!!!!!!!!!!!!\n", MACValue));
-		RTMP_IO_WRITE32(pAd, PBF_CFG, 0xf40012);
-		while((MACValue &0xff) != 0 && (idx++ < 10))
-		{
-		        RTMP_IO_READ32(pAd, TXRXQ_PCNT, &MACValue);
-		        NdisMSleep(1);
-		}
-		RTMP_IO_WRITE32(pAd, PBF_CFG, 0xf40006);
-	}
-
-//PS packets use HCCA queue when dequeue from PS unicast queue (WiFi WPA2 MA9_DT1 for Marvell B STA)
-	idx = 0;
-	if ((MACValue & 0xff00) !=0 )
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("TX QUEUE 1 Not EMPTY(Value=0x%0x). !!!!!!!!!!!!!!!\n", MACValue));
-		RTMP_IO_WRITE32(pAd, PBF_CFG, 0xf4000a);
-		while((MACValue &0xff00) != 0 && (idx++ < 10))
-		{
-			RTMP_IO_READ32(pAd, TXRXQ_PCNT, &MACValue);
-			NdisMSleep(1);
-		}
-		RTMP_IO_WRITE32(pAd, PBF_CFG, 0xf40006);
-	}
-
-	if (pAd->watchDogRxOverFlowCnt >= 2)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("Maybe the Rx Bulk-In hanged! Cancel the pending Rx bulks request!\n"));
-		if ((!RTMP_TEST_FLAG(pAd, (fRTMP_ADAPTER_RESET_IN_PROGRESS |
-									fRTMP_ADAPTER_BULKIN_RESET |
-									fRTMP_ADAPTER_HALT_IN_PROGRESS |
-									fRTMP_ADAPTER_NIC_NOT_EXIST))))
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("Call CMDTHREAD_RESET_BULK_IN to cancel the pending Rx Bulk!\n"));
-			RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_BULKIN_RESET);
-			RTUSBEnqueueInternalCmd(pAd, CMDTHREAD_RESET_BULK_IN, NULL, 0);
-			needDumpSeq = TRUE;
-		}
-		pAd->watchDogRxOverFlowCnt = 0;
-	}
-
-
-	for (idx = 0; idx < NUM_OF_TX_RING; idx++)
-	{
-		pUrb = NULL;
-
-		RTMP_IRQ_LOCK(&pAd->BulkOutLock[idx], irqFlags);
-		if ((pAd->BulkOutPending[idx] == TRUE) && pAd->watchDogTxPendingCnt)
-		{
-			pAd->watchDogTxPendingCnt[idx]++;
-
-			if ((pAd->watchDogTxPendingCnt[idx] > 2) &&
-				 (!RTMP_TEST_FLAG(pAd, (fRTMP_ADAPTER_RESET_IN_PROGRESS | fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST | fRTMP_ADAPTER_BULKOUT_RESET)))
-				)
-			{
-				// FIXME: Following code just support single bulk out. If you wanna support multiple bulk out. Modify it!
-				pHTTXContext = (PHT_TX_CONTEXT)(&pAd->TxContext[idx]);
-				if (pHTTXContext->IRPPending)
-				{	// Check TxContext.
-					pUrb = pHTTXContext->pUrb;
-				}
-				else if (idx == MGMTPIPEIDX)
-				{
-					PTX_CONTEXT pMLMEContext, pNULLContext, pPsPollContext;
-
-					//Check MgmtContext.
-					pMLMEContext = (PTX_CONTEXT)(pAd->MgmtRing.Cell[pAd->MgmtRing.TxDmaIdx].AllocVa);
-					pPsPollContext = (PTX_CONTEXT)(&pAd->PsPollContext);
-					pNULLContext = (PTX_CONTEXT)(&pAd->NullContext);
-
-					if (pMLMEContext->IRPPending)
-					{
-						ASSERT(pMLMEContext->IRPPending);
-						pUrb = pMLMEContext->pUrb;
-					}
-					else if (pNULLContext->IRPPending)
-					{
-						ASSERT(pNULLContext->IRPPending);
-						pUrb = pNULLContext->pUrb;
-					}
-					else if (pPsPollContext->IRPPending)
-					{
-						ASSERT(pPsPollContext->IRPPending);
-						pUrb = pPsPollContext->pUrb;
-					}
-				}
-
-				RTMP_IRQ_UNLOCK(&pAd->BulkOutLock[idx], irqFlags);
-
-				DBGPRINT(RT_DEBUG_TRACE, ("Maybe the Tx Bulk-Out hanged! Cancel the pending Tx bulks request of idx(%d)!\n", idx));
-				if (pUrb)
-				{
-					DBGPRINT(RT_DEBUG_TRACE, ("Unlink the pending URB!\n"));
-					// unlink it now
-					RTUSB_UNLINK_URB(pUrb);
-					// Sleep 200 microseconds to give cancellation time to work
-					RTMPusecDelay(200);
-					needDumpSeq = TRUE;
-				}
-				else
-				{
-					DBGPRINT(RT_DEBUG_ERROR, ("Unkonw bulkOut URB maybe hanged!!!!!!!!!!!!\n"));
-				}
-			}
-			else
-			{
-				RTMP_IRQ_UNLOCK(&pAd->BulkOutLock[idx], irqFlags);
-			}
-		}
-		else
-		{
-			RTMP_IRQ_UNLOCK(&pAd->BulkOutLock[idx], irqFlags);
-		}
-	}
-
-	// For Sigma debug, dump the ba_reordering sequence.
-	if((needDumpSeq == TRUE) && (pAd->CommonCfg.bDisableReordering == 0))
-	{
-		USHORT				Idx;
-		PBA_REC_ENTRY		pBAEntry = NULL;
-		UCHAR				count = 0;
-		struct reordering_mpdu *mpdu_blk;
-
-		Idx = pAd->MacTab.Content[BSSID_WCID].BARecWcidArray[0];
-
-		pBAEntry = &pAd->BATable.BARecEntry[Idx];
-		if((pBAEntry->list.qlen > 0) && (pBAEntry->list.next != NULL))
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("NICUpdateRawCounters():The Queueing pkt in reordering buffer:\n"));
-			NdisAcquireSpinLock(&pBAEntry->RxReRingLock);
-			mpdu_blk = pBAEntry->list.next;
-			while (mpdu_blk)
-			{
-				DBGPRINT(RT_DEBUG_TRACE, ("\t%d:Seq-%d, bAMSDU-%d!\n", count, mpdu_blk->Sequence, mpdu_blk->bAMSDU));
-				mpdu_blk = mpdu_blk->next;
-				count++;
-			}
-
-			DBGPRINT(RT_DEBUG_TRACE, ("\npBAEntry->LastIndSeq=%d!\n", pBAEntry->LastIndSeq));
-			NdisReleaseSpinLock(&pBAEntry->RxReRingLock);
-		}
-	}
-}
-
-/*
-========================================================================
-Routine Description:
-    Release allocated resources.
-
-Arguments:
-    *dev				Point to the PCI or USB device
-	pAd					driver control block pointer
-
-Return Value:
-    None
-
-Note:
-========================================================================
-*/
-static void _rtusb_disconnect(struct usb_device *dev, PRTMP_ADAPTER pAd)
-{
-	struct net_device	*net_dev = NULL;
-
-
-	DBGPRINT(RT_DEBUG_ERROR, ("rtusb_disconnect: unregister usbnet usb-%s-%s\n",
-				dev->bus->bus_name, dev->devpath));
-	if (!pAd)
-	{
-		usb_put_dev(dev);
-
-		printk("rtusb_disconnect: pAd == NULL!\n");
-		return;
-	}
-	RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST);
-
-
-
-	// for debug, wait to show some messages to /proc system
-	udelay(1);
-
-
-
-
-	net_dev = pAd->net_dev;
-	if (pAd->net_dev != NULL)
-	{
-		printk("rtusb_disconnect: unregister_netdev(), dev->name=%s!\n", net_dev->name);
-		unregister_netdev (pAd->net_dev);
-	}
-	udelay(1);
-	flush_scheduled_work();
-	udelay(1);
-
-	// free net_device memory
-	free_netdev(net_dev);
-
-	// free adapter memory
-	RTMPFreeAdapter(pAd);
-
-	// release a use of the usb device structure
-	usb_put_dev(dev);
-	udelay(1);
-
-	DBGPRINT(RT_DEBUG_ERROR, (" RTUSB disconnect successfully\n"));
-}
-
-
-/*
-========================================================================
-Routine Description:
-    Probe RT28XX chipset.
-
-Arguments:
-    *dev				Point to the PCI or USB device
-	interface
-	*id_table			Point to the PCI or USB device ID
-
-Return Value:
-    None
-
-Note:
-========================================================================
-*/
-static int rtusb_probe (struct usb_interface *intf,
-						const struct usb_device_id *id)
-{
-	PRTMP_ADAPTER pAd;
-	return (int)rt28xx_probe((void *)intf, (void *)id, 0, &pAd);
-}
-
-
-static void rtusb_disconnect(struct usb_interface *intf)
-{
-	struct usb_device   *dev = interface_to_usbdev(intf);
-	PRTMP_ADAPTER       pAd;
-
-
-	pAd = usb_get_intfdata(intf);
-	usb_set_intfdata(intf, NULL);
-
-	_rtusb_disconnect(dev, pAd);
-}
-
-
-/*
-========================================================================
-Routine Description:
-    Close kernel threads.
-
-Arguments:
-	*pAd				the raxx interface data pointer
-
-Return Value:
-    NONE
-
-Note:
-========================================================================
-*/
-VOID RT28xxThreadTerminate(
-	IN RTMP_ADAPTER *pAd)
-{
-	POS_COOKIE	pObj = (POS_COOKIE) pAd->OS_Cookie;
-	INT			ret;
-
-
-	// Sleep 50 milliseconds so pending io might finish normally
-	RTMPusecDelay(50000);
-
-	// We want to wait until all pending receives and sends to the
-	// device object. We cancel any
-	// irps. Wait until sends and receives have stopped.
-	RTUSBCancelPendingIRPs(pAd);
-
-	// Terminate Threads
-
-	if (pid_nr(pObj->TimerQThr_pid) > 0)
-	{
-		POS_COOKIE pObj = (POS_COOKIE)pAd->OS_Cookie;
-
-		printk("Terminate the TimerQThr_pid=%d!\n", pid_nr(pObj->TimerQThr_pid));
-		mb();
-		pAd->TimerFunc_kill = 1;
-		mb();
-		ret = kill_pid(pObj->TimerQThr_pid, SIGTERM, 1);
-		if (ret)
-		{
-			printk(KERN_WARNING "%s: unable to stop TimerQThread, pid=%d, ret=%d!\n",
-					pAd->net_dev->name, pid_nr(pObj->TimerQThr_pid), ret);
-		}
-		else
-		{
-			wait_for_completion(&pAd->TimerQComplete);
-			pObj->TimerQThr_pid = NULL;
-		}
-	}
-
-	if (pid_nr(pObj->MLMEThr_pid) > 0)
-	{
-		printk("Terminate the MLMEThr_pid=%d!\n", pid_nr(pObj->MLMEThr_pid));
-		mb();
-		pAd->mlme_kill = 1;
-		//RT28XX_MLME_HANDLER(pAd);
-		mb();
-		ret = kill_pid(pObj->MLMEThr_pid, SIGTERM, 1);
-		if (ret)
-		{
-			printk (KERN_WARNING "%s: unable to Mlme thread, pid=%d, ret=%d!\n",
-					pAd->net_dev->name, pid_nr(pObj->MLMEThr_pid), ret);
-		}
-		else
-		{
-			//wait_for_completion (&pAd->notify);
-			wait_for_completion (&pAd->mlmeComplete);
-			pObj->MLMEThr_pid = NULL;
-		}
-	}
-
-	if (pid_nr(pObj->RTUSBCmdThr_pid) > 0)
-	{
-		printk("Terminate the RTUSBCmdThr_pid=%d!\n", pid_nr(pObj->RTUSBCmdThr_pid));
-		mb();
-		NdisAcquireSpinLock(&pAd->CmdQLock);
-		pAd->CmdQ.CmdQState = RT2870_THREAD_STOPED;
-		NdisReleaseSpinLock(&pAd->CmdQLock);
-		mb();
-		//RTUSBCMDUp(pAd);
-		ret = kill_pid(pObj->RTUSBCmdThr_pid, SIGTERM, 1);
-		if (ret)
-		{
-			printk(KERN_WARNING "%s: unable to RTUSBCmd thread, pid=%d, ret=%d!\n",
-					pAd->net_dev->name, pid_nr(pObj->RTUSBCmdThr_pid), ret);
-		}
-		else
-		{
-			//wait_for_completion (&pAd->notify);
-			wait_for_completion (&pAd->CmdQComplete);
-			pObj->RTUSBCmdThr_pid = NULL;
-		}
-	}
-
-	// Kill tasklets
-	pAd->mlme_kill = 0;
-	pAd->CmdQ.CmdQState = RT2870_THREAD_UNKNOWN;
-	pAd->TimerFunc_kill = 0;
-}
-
-
-void kill_thread_task(IN PRTMP_ADAPTER pAd)
-{
-	POS_COOKIE pObj;
-
-	pObj = (POS_COOKIE) pAd->OS_Cookie;
-
-	tasklet_kill(&pObj->rx_done_task);
-	tasklet_kill(&pObj->mgmt_dma_done_task);
-	tasklet_kill(&pObj->ac0_dma_done_task);
-	tasklet_kill(&pObj->ac1_dma_done_task);
-	tasklet_kill(&pObj->ac2_dma_done_task);
-	tasklet_kill(&pObj->ac3_dma_done_task);
-	tasklet_kill(&pObj->hcca_dma_done_task);
-	tasklet_kill(&pObj->tbtt_task);
-
-}
-
-
-/*
-========================================================================
-Routine Description:
-    Check the chipset vendor/product ID.
-
-Arguments:
-    _dev_p				Point to the PCI or USB device
-
-Return Value:
-    TRUE				Check ok
-	FALSE				Check fail
-
-Note:
-========================================================================
-*/
-BOOLEAN RT28XXChipsetCheck(
-	IN void *_dev_p)
-{
-	struct usb_interface *intf = (struct usb_interface *)_dev_p;
-	struct usb_device *dev_p = interface_to_usbdev(intf);
-	UINT32 i;
-
-
-	for(i=0; i<rtusb_usb_id_len; i++)
-	{
-		if (dev_p->descriptor.idVendor == rtusb_usb_id[i].idVendor &&
-			dev_p->descriptor.idProduct == rtusb_usb_id[i].idProduct)
-		{
-			printk("rt2870: idVendor = 0x%x, idProduct = 0x%x\n",
-					dev_p->descriptor.idVendor, dev_p->descriptor.idProduct);
-			break;
-		}
-	}
-
-	if (i == rtusb_usb_id_len)
-	{
-		printk("rt2870: Error! Device Descriptor not matching!\n");
-		return FALSE;
-	}
-
-	return TRUE;
-}
-
-
-/*
-========================================================================
-Routine Description:
-    Init net device structure.
-
-Arguments:
-    _dev_p				Point to the PCI or USB device
-    *net_dev			Point to the net device
-	*pAd				the raxx interface data pointer
-
-Return Value:
-    TRUE				Init ok
-	FALSE				Init fail
-
-Note:
-========================================================================
-*/
-BOOLEAN RT28XXNetDevInit(
-	IN void 				*_dev_p,
-	IN struct  net_device	*net_dev,
-	IN RTMP_ADAPTER 		*pAd)
-{
-	struct usb_interface *intf = (struct usb_interface *)_dev_p;
-	struct usb_device *dev_p = interface_to_usbdev(intf);
-
-
-	pAd->config = &dev_p->config->desc;
-	return TRUE;
-}
-
-
-/*
-========================================================================
-Routine Description:
-    Init net device structure.
-
-Arguments:
-    _dev_p				Point to the PCI or USB device
-	*pAd				the raxx interface data pointer
-
-Return Value:
-    TRUE				Config ok
-	FALSE				Config fail
-
-Note:
-========================================================================
-*/
-BOOLEAN RT28XXProbePostConfig(
-	IN void 				*_dev_p,
-	IN RTMP_ADAPTER 		*pAd,
-	IN INT32				interface)
-{
-	struct usb_interface *intf = (struct usb_interface *)_dev_p;
-	struct usb_host_interface *iface_desc;
-	ULONG BulkOutIdx;
-	UINT32 i;
-
-
-	/* get the active interface descriptor */
-	iface_desc = intf->cur_altsetting;
-
-	/* get # of enpoints  */
-	pAd->NumberOfPipes = iface_desc->desc.bNumEndpoints;
-	DBGPRINT(RT_DEBUG_TRACE,
-			("NumEndpoints=%d\n", iface_desc->desc.bNumEndpoints));
-
-	/* Configure Pipes */
-	BulkOutIdx = 0;
-
-	for(i=0; i<pAd->NumberOfPipes; i++)
-	{
-		if ((iface_desc->endpoint[i].desc.bmAttributes ==
-				USB_ENDPOINT_XFER_BULK) &&
-			((iface_desc->endpoint[i].desc.bEndpointAddress &
-				USB_ENDPOINT_DIR_MASK) == USB_DIR_IN))
-		{
-			pAd->BulkInEpAddr = iface_desc->endpoint[i].desc.bEndpointAddress;
-			pAd->BulkInMaxPacketSize = iface_desc->endpoint[i].desc.wMaxPacketSize;
-
-			DBGPRINT_RAW(RT_DEBUG_TRACE,
-				("BULK IN MaximumPacketSize = %d\n", pAd->BulkInMaxPacketSize));
-			DBGPRINT_RAW(RT_DEBUG_TRACE,
-				("EP address = 0x%2x\n", iface_desc->endpoint[i].desc.bEndpointAddress));
-		}
-		else if ((iface_desc->endpoint[i].desc.bmAttributes ==
-					USB_ENDPOINT_XFER_BULK) &&
-				((iface_desc->endpoint[i].desc.bEndpointAddress &
-					USB_ENDPOINT_DIR_MASK) == USB_DIR_OUT))
-		{
-			// there are 6 bulk out EP. EP6 highest priority.
-			// EP1-4 is EDCA.  EP5 is HCCA.
-			pAd->BulkOutEpAddr[BulkOutIdx++] = iface_desc->endpoint[i].desc.bEndpointAddress;
-			pAd->BulkOutMaxPacketSize = iface_desc->endpoint[i].desc.wMaxPacketSize;
-
-			DBGPRINT_RAW(RT_DEBUG_TRACE,
-				("BULK OUT MaximumPacketSize = %d\n", pAd->BulkOutMaxPacketSize));
-			DBGPRINT_RAW(RT_DEBUG_TRACE,
-				("EP address = 0x%2x  \n", iface_desc->endpoint[i].desc.bEndpointAddress));
-		}
-	}
-
-	if (!(pAd->BulkInEpAddr && pAd->BulkOutEpAddr[0]))
-	{
-		printk("%s: Could not find both bulk-in and bulk-out endpoints\n", __func__);
-		return FALSE;
-	}
-
-	return TRUE;
-}
-
-
-/*
-========================================================================
-Routine Description:
-    Disable DMA.
-
-Arguments:
-	*pAd				the raxx interface data pointer
-
-Return Value:
-	None
-
-Note:
-========================================================================
-*/
-VOID RT28XXDMADisable(
-	IN RTMP_ADAPTER 		*pAd)
-{
-	// no use
-}
-
-
-
-/*
-========================================================================
-Routine Description:
-    Enable DMA.
-
-Arguments:
-	*pAd				the raxx interface data pointer
-
-Return Value:
-	None
-
-Note:
-========================================================================
-*/
-VOID RT28XXDMAEnable(
-	IN RTMP_ADAPTER 		*pAd)
-{
-	WPDMA_GLO_CFG_STRUC	GloCfg;
-	USB_DMA_CFG_STRUC	UsbCfg;
-	int					i = 0;
-
-
-	RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, 0x4);
-	do
-	{
-		RTMP_IO_READ32(pAd, WPDMA_GLO_CFG, &GloCfg.word);
-		if ((GloCfg.field.TxDMABusy == 0)  && (GloCfg.field.RxDMABusy == 0))
-			break;
-
-		DBGPRINT(RT_DEBUG_TRACE, ("==>  DMABusy\n"));
-		RTMPusecDelay(1000);
-		i++;
-	}while ( i <200);
-
-
-	RTMPusecDelay(50);
-	GloCfg.field.EnTXWriteBackDDONE = 1;
-	GloCfg.field.EnableRxDMA = 1;
-	GloCfg.field.EnableTxDMA = 1;
-	DBGPRINT(RT_DEBUG_TRACE, ("<== WRITE DMA offset 0x208 = 0x%x\n", GloCfg.word));
-	RTMP_IO_WRITE32(pAd, WPDMA_GLO_CFG, GloCfg.word);
-
-	UsbCfg.word = 0;
-	UsbCfg.field.phyclear = 0;
-	/* usb version is 1.1,do not use bulk in aggregation */
-	if (pAd->BulkInMaxPacketSize == 512)
-			UsbCfg.field.RxBulkAggEn = 1;
-	/* for last packet, PBF might use more than limited, so minus 2 to prevent from error */
-	UsbCfg.field.RxBulkAggLmt = (MAX_RXBULK_SIZE /1024)-3;
-	UsbCfg.field.RxBulkAggTOut = 0x80; /* 2006-10-18 */
-	UsbCfg.field.RxBulkEn = 1;
-	UsbCfg.field.TxBulkEn = 1;
-
-	RTUSBWriteMACRegister(pAd, USB_DMA_CFG, UsbCfg.word);
-
-}
-
-/*
-========================================================================
-Routine Description:
-    Write Beacon buffer to Asic.
-
-Arguments:
-	*pAd				the raxx interface data pointer
-
-Return Value:
-	None
-
-Note:
-========================================================================
-*/
-VOID RT28xx_UpdateBeaconToAsic(
-	IN RTMP_ADAPTER		*pAd,
-	IN INT				apidx,
-	IN ULONG			FrameLen,
-	IN ULONG			UpdatePos)
-{
-	PUCHAR        	pBeaconFrame = NULL;
-	UCHAR  			*ptr;
-	UINT  			i, padding;
-	BEACON_SYNC_STRUCT	*pBeaconSync = pAd->CommonCfg.pBeaconSync;
-	UINT32			longValue;
-	BOOLEAN			bBcnReq = FALSE;
-	UCHAR			bcn_idx = 0;
-
-
-	if (pBeaconFrame == NULL)
-	{
-		DBGPRINT(RT_DEBUG_ERROR,("pBeaconFrame is NULL!\n"));
-		return;
-	}
-
-	if (pBeaconSync == NULL)
-	{
-		DBGPRINT(RT_DEBUG_ERROR,("pBeaconSync is NULL!\n"));
-		return;
-	}
-
-	//if ((pAd->WdsTab.Mode == WDS_BRIDGE_MODE) ||
-	//	((pAd->ApCfg.MBSSID[apidx].MSSIDDev == NULL) || !(pAd->ApCfg.MBSSID[apidx].MSSIDDev->flags & IFF_UP))
-	//	)
-	if (bBcnReq == FALSE)
-	{
-		/* when the ra interface is down, do not send its beacon frame */
-		/* clear all zero */
-		for(i=0; i<TXWI_SIZE; i+=4) {
-			RTMP_IO_WRITE32(pAd, pAd->BeaconOffset[bcn_idx] + i, 0x00);
-		}
-		pBeaconSync->BeaconBitMap &= (~(BEACON_BITMAP_MASK & (1 << bcn_idx)));
-		NdisZeroMemory(pBeaconSync->BeaconTxWI[bcn_idx], TXWI_SIZE);
-	}
-	else
-	{
-		ptr = (PUCHAR)&pAd->BeaconTxWI;
-
-		if (NdisEqualMemory(pBeaconSync->BeaconTxWI[bcn_idx], &pAd->BeaconTxWI, TXWI_SIZE) == FALSE)
-		{	// If BeaconTxWI changed, we need to rewrite the TxWI for the Beacon frames.
-			pBeaconSync->BeaconBitMap &= (~(BEACON_BITMAP_MASK & (1 << bcn_idx)));
-			NdisMoveMemory(pBeaconSync->BeaconTxWI[bcn_idx], &pAd->BeaconTxWI, TXWI_SIZE);
-		}
-
-		if ((pBeaconSync->BeaconBitMap & (1 << bcn_idx)) != (1 << bcn_idx))
-		{
-			for (i=0; i<TXWI_SIZE; i+=4)  // 16-byte TXWI field
-			{
-				longValue =  *ptr + (*(ptr+1)<<8) + (*(ptr+2)<<16) + (*(ptr+3)<<24);
-				RTMP_IO_WRITE32(pAd, pAd->BeaconOffset[bcn_idx] + i, longValue);
-				ptr += 4;
-			}
-		}
-
-		ptr = pBeaconSync->BeaconBuf[bcn_idx];
-		padding = (FrameLen & 0x01);
-		NdisZeroMemory((PUCHAR)(pBeaconFrame + FrameLen), padding);
-		FrameLen += padding;
-		for (i = 0 ; i < FrameLen /*HW_BEACON_OFFSET*/; i += 2)
-		{
-			if (NdisEqualMemory(ptr, pBeaconFrame, 2) == FALSE)
-			{
-				NdisMoveMemory(ptr, pBeaconFrame, 2);
-				//shortValue = *ptr + (*(ptr+1)<<8);
-				//RTMP_IO_WRITE8(pAd, pAd->BeaconOffset[bcn_idx] + TXWI_SIZE + i, shortValue);
-				RTUSBMultiWrite(pAd, pAd->BeaconOffset[bcn_idx] + TXWI_SIZE + i, ptr, 2);
-			}
-			ptr +=2;
-			pBeaconFrame += 2;
-		}
-
-		pBeaconSync->BeaconBitMap |= (1 << bcn_idx);
-
-		// For AP interface, set the DtimBitOn so that we can send Bcast/Mcast frame out after this beacon frame.
-	}
-
-}
-
-
-VOID RT2870_BssBeaconStop(
-	IN RTMP_ADAPTER *pAd)
-{
-	BEACON_SYNC_STRUCT	*pBeaconSync;
-	int i, offset;
-	BOOLEAN	Cancelled = TRUE;
-
-	pBeaconSync = pAd->CommonCfg.pBeaconSync;
-	if (pBeaconSync && pBeaconSync->EnableBeacon)
-	{
-		INT NumOfBcn;
-
-		NumOfBcn = MAX_MESH_NUM;
-
-		RTMPCancelTimer(&pAd->CommonCfg.BeaconUpdateTimer, &Cancelled);
-
-		for(i=0; i<NumOfBcn; i++)
-		{
-			NdisZeroMemory(pBeaconSync->BeaconBuf[i], HW_BEACON_OFFSET);
-			NdisZeroMemory(pBeaconSync->BeaconTxWI[i], TXWI_SIZE);
-
-			for (offset=0; offset<HW_BEACON_OFFSET; offset+=4)
-				RTMP_IO_WRITE32(pAd, pAd->BeaconOffset[i] + offset, 0x00);
-
-			pBeaconSync->CapabilityInfoLocationInBeacon[i] = 0;
-			pBeaconSync->TimIELocationInBeacon[i] = 0;
-		}
-		pBeaconSync->BeaconBitMap = 0;
-		pBeaconSync->DtimBitOn = 0;
-	}
-}
-
-
-VOID RT2870_BssBeaconStart(
-	IN RTMP_ADAPTER *pAd)
-{
-	int apidx;
-	BEACON_SYNC_STRUCT	*pBeaconSync;
-//	LARGE_INTEGER 	tsfTime, deltaTime;
-
-	pBeaconSync = pAd->CommonCfg.pBeaconSync;
-	if (pBeaconSync && pBeaconSync->EnableBeacon)
-	{
-		INT NumOfBcn;
-
-		NumOfBcn = MAX_MESH_NUM;
-
-		for(apidx=0; apidx<NumOfBcn; apidx++)
-		{
-			UCHAR CapabilityInfoLocationInBeacon = 0;
-			UCHAR TimIELocationInBeacon = 0;
-
-			NdisZeroMemory(pBeaconSync->BeaconBuf[apidx], HW_BEACON_OFFSET);
-			pBeaconSync->CapabilityInfoLocationInBeacon[apidx] = CapabilityInfoLocationInBeacon;
-			pBeaconSync->TimIELocationInBeacon[apidx] = TimIELocationInBeacon;
-			NdisZeroMemory(pBeaconSync->BeaconTxWI[apidx], TXWI_SIZE);
-		}
-		pBeaconSync->BeaconBitMap = 0;
-		pBeaconSync->DtimBitOn = 0;
-		pAd->CommonCfg.BeaconUpdateTimer.Repeat = TRUE;
-
-		pAd->CommonCfg.BeaconAdjust = 0;
-		pAd->CommonCfg.BeaconFactor = 0xffffffff / (pAd->CommonCfg.BeaconPeriod << 10);
-		pAd->CommonCfg.BeaconRemain = (0xffffffff % (pAd->CommonCfg.BeaconPeriod << 10)) + 1;
-		printk(RT28xx_CHIP_NAME "_BssBeaconStart:BeaconFactor=%d, BeaconRemain=%d!\n", pAd->CommonCfg.BeaconFactor, pAd->CommonCfg.BeaconRemain);
-		RTMPSetTimer(&pAd->CommonCfg.BeaconUpdateTimer, pAd->CommonCfg.BeaconPeriod);
-
-	}
-}
-
-
-VOID RT2870_BssBeaconInit(
-	IN RTMP_ADAPTER *pAd)
-{
-	BEACON_SYNC_STRUCT	*pBeaconSync;
-	int i;
-
-	NdisAllocMemory(pAd->CommonCfg.pBeaconSync, sizeof(BEACON_SYNC_STRUCT), MEM_ALLOC_FLAG);
-	if (pAd->CommonCfg.pBeaconSync)
-	{
-		pBeaconSync = pAd->CommonCfg.pBeaconSync;
-		NdisZeroMemory(pBeaconSync, sizeof(BEACON_SYNC_STRUCT));
-		for(i=0; i < HW_BEACON_MAX_COUNT; i++)
-		{
-			NdisZeroMemory(pBeaconSync->BeaconBuf[i], HW_BEACON_OFFSET);
-			pBeaconSync->CapabilityInfoLocationInBeacon[i] = 0;
-			pBeaconSync->TimIELocationInBeacon[i] = 0;
-			NdisZeroMemory(pBeaconSync->BeaconTxWI[i], TXWI_SIZE);
-		}
-		pBeaconSync->BeaconBitMap = 0;
-
-		//RTMPInitTimer(pAd, &pAd->CommonCfg.BeaconUpdateTimer, GET_TIMER_FUNCTION(BeaconUpdateExec), pAd, TRUE);
-		pBeaconSync->EnableBeacon = TRUE;
-	}
-}
-
-
-VOID RT2870_BssBeaconExit(
-	IN RTMP_ADAPTER *pAd)
-{
-	BEACON_SYNC_STRUCT	*pBeaconSync;
-	BOOLEAN	Cancelled = TRUE;
-	int i;
-
-	if (pAd->CommonCfg.pBeaconSync)
-	{
-		pBeaconSync = pAd->CommonCfg.pBeaconSync;
-		pBeaconSync->EnableBeacon = FALSE;
-		RTMPCancelTimer(&pAd->CommonCfg.BeaconUpdateTimer, &Cancelled);
-		pBeaconSync->BeaconBitMap = 0;
-
-		for(i=0; i<HW_BEACON_MAX_COUNT; i++)
-		{
-			NdisZeroMemory(pBeaconSync->BeaconBuf[i], HW_BEACON_OFFSET);
-			pBeaconSync->CapabilityInfoLocationInBeacon[i] = 0;
-			pBeaconSync->TimIELocationInBeacon[i] = 0;
-			NdisZeroMemory(pBeaconSync->BeaconTxWI[i], TXWI_SIZE);
-		}
-
-		NdisFreeMemory(pAd->CommonCfg.pBeaconSync, HW_BEACON_OFFSET * HW_BEACON_MAX_COUNT, 0);
-		pAd->CommonCfg.pBeaconSync = NULL;
-	}
-}
-
-VOID BeaconUpdateExec(
-    IN PVOID SystemSpecific1,
-    IN PVOID FunctionContext,
-    IN PVOID SystemSpecific2,
-    IN PVOID SystemSpecific3)
-{
-	PRTMP_ADAPTER	pAd = (PRTMP_ADAPTER)FunctionContext;
-	LARGE_INTEGER	tsfTime_a;//, tsfTime_b, deltaTime_exp, deltaTime_ab;
-	UINT32			delta, remain, remain_low, remain_high;
-//	BOOLEAN			positive;
-
-	ReSyncBeaconTime(pAd);
-
-
-
-	RTMP_IO_READ32(pAd, TSF_TIMER_DW0, &tsfTime_a.u.LowPart);
-	RTMP_IO_READ32(pAd, TSF_TIMER_DW1, &tsfTime_a.u.HighPart);
-
-
-	//positive=getDeltaTime(tsfTime_a, expectedTime, &deltaTime_exp);
-	remain_high = pAd->CommonCfg.BeaconRemain * tsfTime_a.u.HighPart;
-	remain_low = tsfTime_a.u.LowPart % (pAd->CommonCfg.BeaconPeriod << 10);
-	remain = (remain_high + remain_low)%(pAd->CommonCfg.BeaconPeriod << 10);
-	delta = (pAd->CommonCfg.BeaconPeriod << 10) - remain;
-
-	pAd->CommonCfg.BeaconUpdateTimer.TimerValue = (delta >> 10) + 10;
-
-}
-
diff --git a/drivers/staging/rt2870/Kconfig b/drivers/staging/rt2870/Kconfig
index aea5c8221810..fd3ba3a3b127 100644
--- a/drivers/staging/rt2870/Kconfig
+++ b/drivers/staging/rt2870/Kconfig
@@ -1,5 +1,7 @@
 config RT2870
 	tristate "Ralink 2870/3070 wireless support"
 	depends on USB && X86 && WLAN
+	select WIRELESS_EXT
+	select WEXT_PRIV
 	---help---
 	  This is an experimental driver for the Ralink xx70 wireless chips.
diff --git a/drivers/staging/rt2870/Makefile b/drivers/staging/rt2870/Makefile
index 306c33113c58..523e7e738d00 100644
--- a/drivers/staging/rt2870/Makefile
+++ b/drivers/staging/rt2870/Makefile
@@ -1,27 +1,35 @@
+#
 obj-$(CONFIG_RT2870)	+= rt2870sta.o
 
 # TODO: all of these should be removed
 EXTRA_CFLAGS += -DLINUX -DAGGREGATION_SUPPORT -DPIGGYBACK_SUPPORT -DWMM_SUPPORT
-EXTRA_CFLAGS += -DRT2870 -DRT3070
+EXTRA_CFLAGS += -DRTMP_MAC_USB -DRTMP_USB_SUPPORT -DRT2870 -DRTMP_TIMER_TASK_SUPPORT
+EXTRA_CFLAGS += -DRTMP_RF_RW_SUPPORT -DRTMP_EFUSE_SUPPORT -DRT30xx -DRT3070
 EXTRA_CFLAGS += -DDBG
 
 rt2870sta-objs :=		\
-	common/md5.o		\
+	common/crypt_md5.o	\
+	common/crypt_sha2.o	\
+	common/crypt_hmac.o	\
 	common/mlme.o		\
-	common/rtmp_wep.o	\
+	common/cmm_wep.o	\
 	common/action.o		\
 	common/cmm_data.o	\
 	common/rtmp_init.o	\
-	common/rtmp_tkip.o	\
+	common/cmm_tkip.o	\
+	common/cmm_aes.o	\
 	common/cmm_sync.o	\
 	common/eeprom.o		\
 	common/cmm_sanity.o	\
 	common/cmm_info.o	\
+	common/cmm_cfg.o	\
 	common/cmm_wpa.o	\
 	common/dfs.o		\
 	common/spectrum.o	\
+	common/rtmp_timer.o	\
+	common/rt_channel.o	\
+	common/cmm_asic.o	\
 	sta/assoc.o		\
-	sta/aironet.o		\
 	sta/auth.o		\
 	sta/auth_rsp.o		\
 	sta/sync.o		\
@@ -30,14 +38,18 @@ rt2870sta-objs :=		\
 	sta/connect.o		\
 	sta/wpa.o		\
 	rt_linux.o		\
-	rt_profile.o		\
 	rt_main_dev.o		\
 	sta_ioctl.o		\
 	common/ba_action.o	\
-	2870_main_dev.o		\
-	common/2870_rtmp_init.o	\
+	usb_main_dev.o		\
+	rt_usb.o		\
+	common/cmm_mac_usb.o	\
 	common/rtusb_io.o	\
 	common/rtusb_bulk.o	\
 	common/rtusb_data.o	\
-	common/cmm_data_2870.o
-
+	common/cmm_data_usb.o	\
+	common/rtmp_mcu.o	\
+	common/ee_efuse.o	\
+	chips/rt30xx.o		\
+	common/rt_rf.o		\
+	chips/rt3070.o
diff --git a/drivers/staging/rt2870/chips/rt3070.c b/drivers/staging/rt2870/chips/rt3070.c
new file mode 100644
index 000000000000..3a6db5ea89ab
--- /dev/null
+++ b/drivers/staging/rt2870/chips/rt3070.c
@@ -0,0 +1 @@
+#include "../../rt2860/chips/rt3070.c"
diff --git a/drivers/staging/rt2870/chips/rt30xx.c b/drivers/staging/rt2870/chips/rt30xx.c
new file mode 100644
index 000000000000..6c56b84c75d9
--- /dev/null
+++ b/drivers/staging/rt2870/chips/rt30xx.c
@@ -0,0 +1 @@
+#include "../../rt2860/chips/rt30xx.c"
diff --git a/drivers/staging/rt2870/common/2870_rtmp_init.c b/drivers/staging/rt2870/common/2870_rtmp_init.c
deleted file mode 100644
index f517d9e90271..000000000000
--- a/drivers/staging/rt2870/common/2870_rtmp_init.c
+++ /dev/null
@@ -1,1730 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-	Module Name:
-	2870_rtmp_init.c
-
-	Abstract:
-	Miniport generic portion header file
-
-	Revision History:
-	Who         When          What
-	--------    ----------    ----------------------------------------------
-	Paul Lin    2002-08-01    created
-    John Chang  2004-08-20    RT2561/2661 use scatter-gather scheme
-    Jan Lee  	2006-09-15    RT2860. Change for 802.11n , EEPROM, Led, BA, HT.
-	Sample Lin	2007-05-31    Merge RT2860 and RT2870 drivers.
-*/
-
-#include "../rt_config.h"
-
-
-static void rx_done_tasklet(unsigned long data);
-static void rt2870_hcca_dma_done_tasklet(unsigned long data);
-static void rt2870_ac3_dma_done_tasklet(unsigned long data);
-static void rt2870_ac2_dma_done_tasklet(unsigned long data);
-static void rt2870_ac1_dma_done_tasklet(unsigned long data);
-static void rt2870_ac0_dma_done_tasklet(unsigned long data);
-static void rt2870_mgmt_dma_done_tasklet(unsigned long data);
-static void rt2870_null_frame_complete_tasklet(unsigned long data);
-static void rt2870_rts_frame_complete_tasklet(unsigned long data);
-static void rt2870_pspoll_frame_complete_tasklet(unsigned long data);
-static void rt2870_dataout_complete_tasklet(unsigned long data);
-
-
-/*
-========================================================================
-Routine Description:
-    Initialize receive data structures.
-
-Arguments:
-    pAd					Pointer to our adapter
-
-Return Value:
-	NDIS_STATUS_SUCCESS
-	NDIS_STATUS_RESOURCES
-
-Note:
-	Initialize all receive releated private buffer, include those define
-	in RTMP_ADAPTER structure and all private data structures. The mahor
-	work is to allocate buffer for each packet and chain buffer to
-	NDIS packet descriptor.
-========================================================================
-*/
-NDIS_STATUS	NICInitRecv(
-	IN	PRTMP_ADAPTER	pAd)
-{
-	UCHAR				i;
-	NDIS_STATUS			Status = NDIS_STATUS_SUCCESS;
-	POS_COOKIE			pObj = (POS_COOKIE) pAd->OS_Cookie;
-
-
-	DBGPRINT(RT_DEBUG_TRACE, ("--> NICInitRecv\n"));
-	pObj = pObj;
-
-	//InterlockedExchange(&pAd->PendingRx, 0);
-	pAd->PendingRx = 0;
-	pAd->NextRxBulkInReadIndex 	= 0;	// Next Rx Read index
-	pAd->NextRxBulkInIndex		= 0 ; //RX_RING_SIZE -1; // Rx Bulk pointer
-	pAd->NextRxBulkInPosition 	= 0;
-
-	for (i = 0; i < (RX_RING_SIZE); i++)
-	{
-		PRX_CONTEXT  pRxContext = &(pAd->RxContext[i]);
-
-		//Allocate URB
-		pRxContext->pUrb = RTUSB_ALLOC_URB(0);
-		if (pRxContext->pUrb == NULL)
-		{
-			Status = NDIS_STATUS_RESOURCES;
-			goto out1;
-		}
-
-		// Allocate transfer buffer
-		pRxContext->TransferBuffer = RTUSB_URB_ALLOC_BUFFER(pObj->pUsb_Dev, MAX_RXBULK_SIZE, &pRxContext->data_dma);
-		if (pRxContext->TransferBuffer == NULL)
-		{
-			Status = NDIS_STATUS_RESOURCES;
-			goto out1;
-		}
-
-		NdisZeroMemory(pRxContext->TransferBuffer, MAX_RXBULK_SIZE);
-
-		pRxContext->pAd	= pAd;
-		pRxContext->pIrp = NULL;
-		pRxContext->InUse		= FALSE;
-		pRxContext->IRPPending	= FALSE;
-		pRxContext->Readable	= FALSE;
-		//pRxContext->ReorderInUse = FALSE;
-		pRxContext->bRxHandling = FALSE;
-		pRxContext->BulkInOffset = 0;
-	}
-
-	DBGPRINT(RT_DEBUG_TRACE, ("<-- NICInitRecv\n"));
-	return Status;
-
-out1:
-	for (i = 0; i < (RX_RING_SIZE); i++)
-	{
-		PRX_CONTEXT  pRxContext = &(pAd->RxContext[i]);
-
-		if (NULL != pRxContext->TransferBuffer)
-		{
-			RTUSB_URB_FREE_BUFFER(pObj->pUsb_Dev, MAX_RXBULK_SIZE,
-								pRxContext->TransferBuffer, pRxContext->data_dma);
-			pRxContext->TransferBuffer = NULL;
-		}
-
-		if (NULL != pRxContext->pUrb)
-		{
-			RTUSB_UNLINK_URB(pRxContext->pUrb);
-			RTUSB_FREE_URB(pRxContext->pUrb);
-			pRxContext->pUrb = NULL;
-		}
-	}
-
-	return Status;
-}
-
-
-/*
-========================================================================
-Routine Description:
-    Initialize transmit data structures.
-
-Arguments:
-    pAd					Pointer to our adapter
-
-Return Value:
-	NDIS_STATUS_SUCCESS
-	NDIS_STATUS_RESOURCES
-
-Note:
-========================================================================
-*/
-NDIS_STATUS	NICInitTransmit(
-	IN	PRTMP_ADAPTER	pAd)
-{
-#define LM_USB_ALLOC(pObj, Context, TB_Type, BufferSize, Status, msg1, err1, msg2, err2)	\
-	Context->pUrb = RTUSB_ALLOC_URB(0);		\
-	if (Context->pUrb == NULL) {			\
-		DBGPRINT(RT_DEBUG_ERROR, msg1);		\
-		Status = NDIS_STATUS_RESOURCES;		\
-		goto err1; }						\
-											\
-	Context->TransferBuffer = 				\
-		(TB_Type)RTUSB_URB_ALLOC_BUFFER(pObj->pUsb_Dev, BufferSize, &Context->data_dma);	\
-	if (Context->TransferBuffer == NULL) {	\
-		DBGPRINT(RT_DEBUG_ERROR, msg2);		\
-		Status = NDIS_STATUS_RESOURCES;		\
-		goto err2; }
-
-#define LM_URB_FREE(pObj, Context, BufferSize)				\
-	if (NULL != Context->pUrb) {							\
-		RTUSB_UNLINK_URB(Context->pUrb);					\
-		RTUSB_FREE_URB(Context->pUrb);						\
-		Context->pUrb = NULL; }								\
-	if (NULL != Context->TransferBuffer) {				\
-		RTUSB_URB_FREE_BUFFER(pObj->pUsb_Dev, BufferSize,	\
-								Context->TransferBuffer,	\
-								Context->data_dma);			\
-		Context->TransferBuffer = NULL; }
-
-	UCHAR			i, acidx;
-	NDIS_STATUS     Status = NDIS_STATUS_SUCCESS;
-	PTX_CONTEXT		pNullContext   = &(pAd->NullContext);
-	PTX_CONTEXT		pPsPollContext = &(pAd->PsPollContext);
-	PTX_CONTEXT		pRTSContext    = &(pAd->RTSContext);
-	PTX_CONTEXT		pMLMEContext = NULL;
-//	PHT_TX_CONTEXT	pHTTXContext = NULL;
-	POS_COOKIE		pObj = (POS_COOKIE) pAd->OS_Cookie;
-	PVOID			RingBaseVa;
-//	RTMP_TX_RING	*pTxRing;
-	RTMP_MGMT_RING  *pMgmtRing;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("--> NICInitTransmit\n"));
-	pObj = pObj;
-
-	// Init 4 set of Tx parameters
-	for(acidx = 0; acidx < NUM_OF_TX_RING; acidx++)
-	{
-		// Initialize all Transmit releated queues
-		InitializeQueueHeader(&pAd->TxSwQueue[acidx]);
-
-		// Next Local tx ring pointer waiting for buck out
-		pAd->NextBulkOutIndex[acidx] = acidx;
-		pAd->BulkOutPending[acidx] = FALSE; // Buck Out control flag
-		//pAd->DataBulkDoneIdx[acidx] = 0;
-	}
-
-	//pAd->NextMLMEIndex	= 0;
-	//pAd->PushMgmtIndex	= 0;
-	//pAd->PopMgmtIndex	= 0;
-	//InterlockedExchange(&pAd->MgmtQueueSize, 0);
-	//InterlockedExchange(&pAd->TxCount, 0);
-
-	//pAd->PrioRingFirstIndex	= 0;
-	//pAd->PrioRingTxCnt		= 0;
-
-	do
-	{
-		//
-		// TX_RING_SIZE, 4 ACs
-		//
-		for(acidx=0; acidx<4; acidx++)
-		{
-			PHT_TX_CONTEXT	pHTTXContext = &(pAd->TxContext[acidx]);
-
-			NdisZeroMemory(pHTTXContext, sizeof(HT_TX_CONTEXT));
-			//Allocate URB
-			LM_USB_ALLOC(pObj, pHTTXContext, PHTTX_BUFFER, sizeof(HTTX_BUFFER), Status,
-							("<-- ERROR in Alloc TX TxContext[%d] urb!! \n", acidx),
-							done,
-							("<-- ERROR in Alloc TX TxContext[%d] HTTX_BUFFER !! \n", acidx),
-							out1);
-
-			NdisZeroMemory(pHTTXContext->TransferBuffer->Aggregation, 4);
-			pHTTXContext->pAd = pAd;
-			pHTTXContext->pIrp = NULL;
-			pHTTXContext->IRPPending = FALSE;
-			pHTTXContext->NextBulkOutPosition = 0;
-			pHTTXContext->ENextBulkOutPosition = 0;
-			pHTTXContext->CurWritePosition = 0;
-			pHTTXContext->CurWriteRealPos = 0;
-			pHTTXContext->BulkOutSize = 0;
-			pHTTXContext->BulkOutPipeId = acidx;
-			pHTTXContext->bRingEmpty = TRUE;
-			pHTTXContext->bCopySavePad = FALSE;
-
-			pAd->BulkOutPending[acidx] = FALSE;
-		}
-
-
-		//
-		// MGMT_RING_SIZE
-		//
-		// Allocate MGMT ring descriptor's memory
-		pAd->MgmtDescRing.AllocSize = MGMT_RING_SIZE * sizeof(TX_CONTEXT);
-		RTMPAllocateMemory(&pAd->MgmtDescRing.AllocVa, pAd->MgmtDescRing.AllocSize);
-		if (pAd->MgmtDescRing.AllocVa == NULL)
-		{
-			DBGPRINT_ERR(("Failed to allocate a big buffer for MgmtDescRing!\n"));
-			Status = NDIS_STATUS_RESOURCES;
-			goto out1;
-		}
-		NdisZeroMemory(pAd->MgmtDescRing.AllocVa, pAd->MgmtDescRing.AllocSize);
-		RingBaseVa     = pAd->MgmtDescRing.AllocVa;
-
-		// Initialize MGMT Ring and associated buffer memory
-		pMgmtRing = &pAd->MgmtRing;
-		for (i = 0; i < MGMT_RING_SIZE; i++)
-		{
-			// link the pre-allocated Mgmt buffer to MgmtRing.Cell
-			pMgmtRing->Cell[i].AllocSize = sizeof(TX_CONTEXT);
-			pMgmtRing->Cell[i].AllocVa = RingBaseVa;
-			pMgmtRing->Cell[i].pNdisPacket = NULL;
-			pMgmtRing->Cell[i].pNextNdisPacket = NULL;
-
-			//Allocate URB for MLMEContext
-			pMLMEContext = (PTX_CONTEXT) pAd->MgmtRing.Cell[i].AllocVa;
-			pMLMEContext->pUrb = RTUSB_ALLOC_URB(0);
-			if (pMLMEContext->pUrb == NULL)
-			{
-				DBGPRINT(RT_DEBUG_ERROR, ("<-- ERROR in Alloc TX MLMEContext[%d] urb!! \n", i));
-				Status = NDIS_STATUS_RESOURCES;
-				goto out2;
-			}
-			pMLMEContext->pAd = pAd;
-			pMLMEContext->pIrp = NULL;
-			pMLMEContext->TransferBuffer = NULL;
-			pMLMEContext->InUse = FALSE;
-			pMLMEContext->IRPPending = FALSE;
-			pMLMEContext->bWaitingBulkOut = FALSE;
-			pMLMEContext->BulkOutSize = 0;
-			pMLMEContext->SelfIdx = i;
-
-			// Offset to next ring descriptor address
-			RingBaseVa = (PUCHAR) RingBaseVa + sizeof(TX_CONTEXT);
-		}
-		DBGPRINT(RT_DEBUG_TRACE, ("MGMT Ring: total %d entry allocated\n", i));
-
-		//pAd->MgmtRing.TxSwFreeIdx = (MGMT_RING_SIZE - 1);
-		pAd->MgmtRing.TxSwFreeIdx = MGMT_RING_SIZE;
-		pAd->MgmtRing.TxCpuIdx = 0;
-		pAd->MgmtRing.TxDmaIdx = 0;
-
-		//
-		// BEACON_RING_SIZE
-		//
-		for(i=0; i<BEACON_RING_SIZE; i++) // 2
-		{
-			PTX_CONTEXT	pBeaconContext = &(pAd->BeaconContext[i]);
-
-
-			NdisZeroMemory(pBeaconContext, sizeof(TX_CONTEXT));
-
-			//Allocate URB
-			LM_USB_ALLOC(pObj, pBeaconContext, PTX_BUFFER, sizeof(TX_BUFFER), Status,
-							("<-- ERROR in Alloc TX BeaconContext[%d] urb!! \n", i),
-							out2,
-							("<-- ERROR in Alloc TX BeaconContext[%d] TX_BUFFER !! \n", i),
-							out3);
-
-			pBeaconContext->pAd = pAd;
-			pBeaconContext->pIrp = NULL;
-			pBeaconContext->InUse = FALSE;
-			pBeaconContext->IRPPending = FALSE;
-		}
-
-		//
-		// NullContext
-		//
-		NdisZeroMemory(pNullContext, sizeof(TX_CONTEXT));
-
-		//Allocate URB
-		LM_USB_ALLOC(pObj, pNullContext, PTX_BUFFER, sizeof(TX_BUFFER), Status,
-						("<-- ERROR in Alloc TX NullContext urb!! \n"),
-						out3,
-						("<-- ERROR in Alloc TX NullContext TX_BUFFER !! \n"),
-						out4);
-
-		pNullContext->pAd = pAd;
-		pNullContext->pIrp = NULL;
-		pNullContext->InUse = FALSE;
-		pNullContext->IRPPending = FALSE;
-
-		//
-		// RTSContext
-		//
-		NdisZeroMemory(pRTSContext, sizeof(TX_CONTEXT));
-
-		//Allocate URB
-		LM_USB_ALLOC(pObj, pRTSContext, PTX_BUFFER, sizeof(TX_BUFFER), Status,
-						("<-- ERROR in Alloc TX RTSContext urb!! \n"),
-						out4,
-						("<-- ERROR in Alloc TX RTSContext TX_BUFFER !! \n"),
-						out5);
-
-		pRTSContext->pAd = pAd;
-		pRTSContext->pIrp = NULL;
-		pRTSContext->InUse = FALSE;
-		pRTSContext->IRPPending = FALSE;
-
-		//
-		// PsPollContext
-		//
-		//NdisZeroMemory(pPsPollContext, sizeof(TX_CONTEXT));
-		//Allocate URB
-		LM_USB_ALLOC(pObj, pPsPollContext, PTX_BUFFER, sizeof(TX_BUFFER), Status,
-						("<-- ERROR in Alloc TX PsPollContext urb!! \n"),
-						out5,
-						("<-- ERROR in Alloc TX PsPollContext TX_BUFFER !! \n"),
-						out6);
-
-		pPsPollContext->pAd = pAd;
-		pPsPollContext->pIrp = NULL;
-		pPsPollContext->InUse = FALSE;
-		pPsPollContext->IRPPending = FALSE;
-		pPsPollContext->bAggregatible = FALSE;
-		pPsPollContext->LastOne = TRUE;
-
-	}   while (FALSE);
-
-
-done:
-	DBGPRINT(RT_DEBUG_TRACE, ("<-- NICInitTransmit\n"));
-
-	return Status;
-
-	/* --------------------------- ERROR HANDLE --------------------------- */
-out6:
-	LM_URB_FREE(pObj, pPsPollContext, sizeof(TX_BUFFER));
-
-out5:
-	LM_URB_FREE(pObj, pRTSContext, sizeof(TX_BUFFER));
-
-out4:
-	LM_URB_FREE(pObj, pNullContext, sizeof(TX_BUFFER));
-
-out3:
-	for(i=0; i<BEACON_RING_SIZE; i++)
-	{
-		PTX_CONTEXT	pBeaconContext = &(pAd->BeaconContext[i]);
-		if (pBeaconContext)
-			LM_URB_FREE(pObj, pBeaconContext, sizeof(TX_BUFFER));
-	}
-
-out2:
-	if (pAd->MgmtDescRing.AllocVa)
-	{
-		pMgmtRing = &pAd->MgmtRing;
-	for(i=0; i<MGMT_RING_SIZE; i++)
-	{
-		pMLMEContext = (PTX_CONTEXT) pAd->MgmtRing.Cell[i].AllocVa;
-		if (pMLMEContext)
-			LM_URB_FREE(pObj, pMLMEContext, sizeof(TX_BUFFER));
-	}
-		NdisFreeMemory(pAd->MgmtDescRing.AllocVa, pAd->MgmtDescRing.AllocSize, 0);
-		pAd->MgmtDescRing.AllocVa = NULL;
-	}
-
-out1:
-	for (acidx = 0; acidx < 4; acidx++)
-	{
-		PHT_TX_CONTEXT pTxContext = &(pAd->TxContext[acidx]);
-		if (pTxContext)
-			LM_URB_FREE(pObj, pTxContext, sizeof(HTTX_BUFFER));
-	}
-
-	// Here we didn't have any pre-allocated memory need to free.
-
-	return Status;
-}
-
-
-/*
-========================================================================
-Routine Description:
-    Allocate DMA memory blocks for send, receive.
-
-Arguments:
-    pAd					Pointer to our adapter
-
-Return Value:
-	NDIS_STATUS_SUCCESS
-	NDIS_STATUS_FAILURE
-	NDIS_STATUS_RESOURCES
-
-Note:
-========================================================================
-*/
-NDIS_STATUS	RTMPAllocTxRxRingMemory(
-	IN	PRTMP_ADAPTER	pAd)
-{
-//	COUNTER_802_11	pCounter = &pAd->WlanCounters;
-	NDIS_STATUS		Status;
-	INT				num;
-
-
-	DBGPRINT(RT_DEBUG_TRACE, ("--> RTMPAllocTxRxRingMemory\n"));
-
-
-	do
-	{
-		// Init the CmdQ and CmdQLock
-		NdisAllocateSpinLock(&pAd->CmdQLock);
-		NdisAcquireSpinLock(&pAd->CmdQLock);
-		RTUSBInitializeCmdQ(&pAd->CmdQ);
-		NdisReleaseSpinLock(&pAd->CmdQLock);
-
-
-		NdisAllocateSpinLock(&pAd->MLMEBulkOutLock);
-		//NdisAllocateSpinLock(&pAd->MLMEWaitQueueLock);
-		NdisAllocateSpinLock(&pAd->BulkOutLock[0]);
-		NdisAllocateSpinLock(&pAd->BulkOutLock[1]);
-		NdisAllocateSpinLock(&pAd->BulkOutLock[2]);
-		NdisAllocateSpinLock(&pAd->BulkOutLock[3]);
-		NdisAllocateSpinLock(&pAd->BulkOutLock[4]);
-		NdisAllocateSpinLock(&pAd->BulkOutLock[5]);
-		NdisAllocateSpinLock(&pAd->BulkInLock);
-
-		for (num = 0; num < NUM_OF_TX_RING; num++)
-		{
-			NdisAllocateSpinLock(&pAd->TxContextQueueLock[num]);
-		}
-
-//		NdisAllocateSpinLock(&pAd->MemLock);	// Not used in RT28XX
-
-//		NdisAllocateSpinLock(&pAd->MacTabLock); // init it in UserCfgInit()
-//		NdisAllocateSpinLock(&pAd->BATabLock); // init it in BATableInit()
-
-//		for(num=0; num<MAX_LEN_OF_BA_REC_TABLE; num++)
-//		{
-//			NdisAllocateSpinLock(&pAd->BATable.BARecEntry[num].RxReRingLock);
-//		}
-
-		//
-		// Init Mac Table
-		//
-//		MacTableInitialize(pAd);
-
-		//
-		// Init send data structures and related parameters
-		//
-		Status = NICInitTransmit(pAd);
-		if (Status != NDIS_STATUS_SUCCESS)
-			break;
-
-		//
-		// Init receive data structures and related parameters
-		//
-		Status = NICInitRecv(pAd);
-		if (Status != NDIS_STATUS_SUCCESS)
-			break;
-
-		pAd->PendingIoCount = 1;
-
-	} while (FALSE);
-
-	NdisZeroMemory(&pAd->FragFrame, sizeof(FRAGMENT_FRAME));
-	pAd->FragFrame.pFragPacket =  RTMP_AllocateFragPacketBuffer(pAd, RX_BUFFER_NORMSIZE);
-
-	if (pAd->FragFrame.pFragPacket == NULL)
-	{
-		Status = NDIS_STATUS_RESOURCES;
-	}
-
-	DBGPRINT_S(Status, ("<-- RTMPAllocTxRxRingMemory, Status=%x\n", Status));
-	return Status;
-}
-
-
-/*
-========================================================================
-Routine Description:
-	Calls USB_InterfaceStop and frees memory allocated for the URBs
-    calls NdisMDeregisterDevice and frees the memory
-    allocated in VNetInitialize for the Adapter Object
-
-Arguments:
-	*pAd				the raxx interface data pointer
-
-Return Value:
-	None
-
-Note:
-========================================================================
-*/
-VOID	RTMPFreeTxRxRingMemory(
-	IN	PRTMP_ADAPTER	pAd)
-{
-#define LM_URB_FREE(pObj, Context, BufferSize)				\
-	if (NULL != Context->pUrb) {							\
-		RTUSB_UNLINK_URB(Context->pUrb);					\
-		RTUSB_FREE_URB(Context->pUrb);						\
-		Context->pUrb = NULL; }								\
-	if (NULL != Context->TransferBuffer) {					\
-		RTUSB_URB_FREE_BUFFER(pObj->pUsb_Dev, BufferSize,	\
-								Context->TransferBuffer,	\
-								Context->data_dma);			\
-		Context->TransferBuffer = NULL; }
-
-
-	UINT                i, acidx;
-	PTX_CONTEXT			pNullContext   = &pAd->NullContext;
-	PTX_CONTEXT			pPsPollContext = &pAd->PsPollContext;
-	PTX_CONTEXT			pRTSContext    = &pAd->RTSContext;
-//	PHT_TX_CONTEXT 		pHTTXContext;
-	//PRTMP_REORDERBUF	pReorderBuf;
-	POS_COOKIE			pObj = (POS_COOKIE) pAd->OS_Cookie;
-//	RTMP_TX_RING		*pTxRing;
-
-	DBGPRINT(RT_DEBUG_ERROR, ("---> RTMPFreeTxRxRingMemory\n"));
-	pObj = pObj;
-
-	// Free all resources for the RECEIVE buffer queue.
-	for(i=0; i<(RX_RING_SIZE); i++)
-	{
-		PRX_CONTEXT  pRxContext = &(pAd->RxContext[i]);
-		if (pRxContext)
-			LM_URB_FREE(pObj, pRxContext, MAX_RXBULK_SIZE);
-	}
-
-	// Free PsPoll frame resource
-	LM_URB_FREE(pObj, pPsPollContext, sizeof(TX_BUFFER));
-
-	// Free NULL frame resource
-	LM_URB_FREE(pObj, pNullContext, sizeof(TX_BUFFER));
-
-	// Free RTS frame resource
-	LM_URB_FREE(pObj, pRTSContext, sizeof(TX_BUFFER));
-
-
-	// Free beacon frame resource
-	for(i=0; i<BEACON_RING_SIZE; i++)
-	{
-		PTX_CONTEXT	pBeaconContext = &(pAd->BeaconContext[i]);
-		if (pBeaconContext)
-			LM_URB_FREE(pObj, pBeaconContext, sizeof(TX_BUFFER));
-	}
-
-
-	// Free mgmt frame resource
-	for(i = 0; i < MGMT_RING_SIZE; i++)
-	{
-		PTX_CONTEXT pMLMEContext = (PTX_CONTEXT)pAd->MgmtRing.Cell[i].AllocVa;
-		//LM_URB_FREE(pObj, pMLMEContext, sizeof(TX_BUFFER));
-		if (NULL != pAd->MgmtRing.Cell[i].pNdisPacket)
-		{
-			RTMPFreeNdisPacket(pAd, pAd->MgmtRing.Cell[i].pNdisPacket);
-			pAd->MgmtRing.Cell[i].pNdisPacket = NULL;
-			pMLMEContext->TransferBuffer = NULL;
-		}
-
-		if (pMLMEContext)
-		{
-			if (NULL != pMLMEContext->pUrb)
-			{
-				RTUSB_UNLINK_URB(pMLMEContext->pUrb);
-				RTUSB_FREE_URB(pMLMEContext->pUrb);
-				pMLMEContext->pUrb = NULL;
-			}
-		}
-	}
-	if (pAd->MgmtDescRing.AllocVa)
-		NdisFreeMemory(pAd->MgmtDescRing.AllocVa, pAd->MgmtDescRing.AllocSize, 0);
-
-
-	// Free Tx frame resource
-		for(acidx=0; acidx<4; acidx++)
-		{
-		PHT_TX_CONTEXT pHTTXContext = &(pAd->TxContext[acidx]);
-			if (pHTTXContext)
-				LM_URB_FREE(pObj, pHTTXContext, sizeof(HTTX_BUFFER));
-		}
-
-	if (pAd->FragFrame.pFragPacket)
-		RELEASE_NDIS_PACKET(pAd, pAd->FragFrame.pFragPacket, NDIS_STATUS_SUCCESS);
-
-	for(i=0; i<6; i++)
-	{
-		NdisFreeSpinLock(&pAd->BulkOutLock[i]);
-	}
-
-	NdisFreeSpinLock(&pAd->BulkInLock);
-	NdisFreeSpinLock(&pAd->MLMEBulkOutLock);
-
-	NdisFreeSpinLock(&pAd->CmdQLock);
-
-	// Clear all pending bulk-out request flags.
-	RTUSB_CLEAR_BULK_FLAG(pAd, 0xffffffff);
-
-//	NdisFreeSpinLock(&pAd->MacTabLock);
-
-//	for(i=0; i<MAX_LEN_OF_BA_REC_TABLE; i++)
-//	{
-//		NdisFreeSpinLock(&pAd->BATable.BARecEntry[i].RxReRingLock);
-//	}
-
-	DBGPRINT(RT_DEBUG_ERROR, ("<--- ReleaseAdapter\n"));
-}
-
-
-/*
-========================================================================
-Routine Description:
-    Allocate memory for adapter control block.
-
-Arguments:
-    pAd					Pointer to our adapter
-
-Return Value:
-	NDIS_STATUS_SUCCESS
-	NDIS_STATUS_FAILURE
-	NDIS_STATUS_RESOURCES
-
-Note:
-========================================================================
-*/
-NDIS_STATUS AdapterBlockAllocateMemory(
-	IN PVOID	handle,
-	OUT	PVOID	*ppAd)
-{
-	PUSB_DEV	usb_dev;
-	POS_COOKIE	pObj = (POS_COOKIE) handle;
-
-
-	usb_dev = pObj->pUsb_Dev;
-
-	pObj->MLMEThr_pid	= NULL;
-	pObj->RTUSBCmdThr_pid	= NULL;
-
-	*ppAd = (PVOID)vmalloc(sizeof(RTMP_ADAPTER));
-
-	if (*ppAd)
-	{
-		NdisZeroMemory(*ppAd, sizeof(RTMP_ADAPTER));
-		((PRTMP_ADAPTER)*ppAd)->OS_Cookie = handle;
-		return (NDIS_STATUS_SUCCESS);
-	}
-	else
-	{
-		return (NDIS_STATUS_FAILURE);
-	}
-}
-
-
-/*
-========================================================================
-Routine Description:
-    Create kernel threads & tasklets.
-
-Arguments:
-    *net_dev			Pointer to wireless net device interface
-
-Return Value:
-	NDIS_STATUS_SUCCESS
-	NDIS_STATUS_FAILURE
-
-Note:
-========================================================================
-*/
-NDIS_STATUS	 CreateThreads(
-	IN	struct net_device *net_dev)
-{
-	PRTMP_ADAPTER pAd = net_dev->ml_priv;
-	POS_COOKIE pObj = (POS_COOKIE) pAd->OS_Cookie;
-	pid_t pid_number;
-
-	//init_MUTEX(&(pAd->usbdev_semaphore));
-
-	init_MUTEX_LOCKED(&(pAd->mlme_semaphore));
-	init_completion (&pAd->mlmeComplete);
-
-	init_MUTEX_LOCKED(&(pAd->RTUSBCmd_semaphore));
-	init_completion (&pAd->CmdQComplete);
-
-	init_MUTEX_LOCKED(&(pAd->RTUSBTimer_semaphore));
-	init_completion (&pAd->TimerQComplete);
-
-	// Creat MLME Thread
-	pObj->MLMEThr_pid = NULL;
-	pid_number = kernel_thread(MlmeThread, pAd, CLONE_VM);
-	if (pid_number < 0)
-	{
-		printk (KERN_WARNING "%s: unable to start Mlme thread\n",pAd->net_dev->name);
-		return NDIS_STATUS_FAILURE;
-	}
-
-	pObj->MLMEThr_pid = find_get_pid(pid_number);
-
-	// Wait for the thread to start
-	wait_for_completion(&(pAd->mlmeComplete));
-
-	// Creat Command Thread
-	pObj->RTUSBCmdThr_pid = NULL;
-	pid_number = kernel_thread(RTUSBCmdThread, pAd, CLONE_VM);
-	if (pid_number < 0)
-	{
-		printk (KERN_WARNING "%s: unable to start RTUSBCmd thread\n",pAd->net_dev->name);
-		return NDIS_STATUS_FAILURE;
-	}
-
-	pObj->RTUSBCmdThr_pid = find_get_pid(pid_number);
-
-	wait_for_completion(&(pAd->CmdQComplete));
-
-	pObj->TimerQThr_pid = NULL;
-	pid_number = kernel_thread(TimerQThread, pAd, CLONE_VM);
-	if (pid_number < 0)
-	{
-		printk (KERN_WARNING "%s: unable to start TimerQThread\n",pAd->net_dev->name);
-		return NDIS_STATUS_FAILURE;
-	}
-
-	pObj->TimerQThr_pid = find_get_pid(pid_number);
-
-	// Wait for the thread to start
-	wait_for_completion(&(pAd->TimerQComplete));
-
-	// Create receive tasklet
-	tasklet_init(&pObj->rx_done_task, rx_done_tasklet, (ULONG)pAd);
-	tasklet_init(&pObj->mgmt_dma_done_task, rt2870_mgmt_dma_done_tasklet, (unsigned long)pAd);
-	tasklet_init(&pObj->ac0_dma_done_task, rt2870_ac0_dma_done_tasklet, (unsigned long)pAd);
-	tasklet_init(&pObj->ac1_dma_done_task, rt2870_ac1_dma_done_tasklet, (unsigned long)pAd);
-	tasklet_init(&pObj->ac2_dma_done_task, rt2870_ac2_dma_done_tasklet, (unsigned long)pAd);
-	tasklet_init(&pObj->ac3_dma_done_task, rt2870_ac3_dma_done_tasklet, (unsigned long)pAd);
-	tasklet_init(&pObj->hcca_dma_done_task, rt2870_hcca_dma_done_tasklet, (unsigned long)pAd);
-	tasklet_init(&pObj->tbtt_task, tbtt_tasklet, (unsigned long)pAd);
-	tasklet_init(&pObj->null_frame_complete_task, rt2870_null_frame_complete_tasklet, (unsigned long)pAd);
-	tasklet_init(&pObj->rts_frame_complete_task, rt2870_rts_frame_complete_tasklet, (unsigned long)pAd);
-	tasklet_init(&pObj->pspoll_frame_complete_task, rt2870_pspoll_frame_complete_tasklet, (unsigned long)pAd);
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-/*
-========================================================================
-Routine Description:
- 	As STA's BSSID is a WC too, it uses shared key table.
- 	This function write correct unicast TX key to ASIC WCID.
- 	And we still make a copy in our MacTab.Content[BSSID_WCID].PairwiseKey.
-	Caller guarantee TKIP/AES always has keyidx = 0. (pairwise key)
-	Caller guarantee WEP calls this function when set Txkey,  default key index=0~3.
-
-Arguments:
-	pAd 					Pointer to our adapter
-	pKey					Pointer to the where the key stored
-
-Return Value:
-	NDIS_SUCCESS			Add key successfully
-
-Note:
-========================================================================
-*/
-VOID	RTMPAddBSSIDCipher(
-	IN	PRTMP_ADAPTER		pAd,
-	IN	UCHAR				Aid,
-	IN	PNDIS_802_11_KEY	pKey,
-	IN  UCHAR   			CipherAlg)
-{
-	PUCHAR		pTxMic, pRxMic;
-	BOOLEAN 	bKeyRSC, bAuthenticator; // indicate the receive SC set by KeyRSC value
-//	UCHAR		CipherAlg;
-	UCHAR		i;
-	ULONG		WCIDAttri;
-	USHORT	 	offset;
-	UCHAR		KeyIdx, IVEIV[8];
-	UINT32		Value;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("RTMPAddBSSIDCipher==> Aid = %d\n",Aid));
-
-	// Bit 29 of Add-key KeyRSC
-	bKeyRSC 	   = (pKey->KeyIndex & 0x20000000) ? TRUE : FALSE;
-
-	// Bit 28 of Add-key Authenticator
-	bAuthenticator = (pKey->KeyIndex & 0x10000000) ? TRUE : FALSE;
-	KeyIdx = (UCHAR)pKey->KeyIndex&0xff;
-
-	if (KeyIdx > 4)
-		return;
-
-
-	if (pAd->MacTab.Content[Aid].PairwiseKey.CipherAlg == CIPHER_TKIP)
-	{	if (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPANone)
-		{
-			// for WPA-None Tx, Rx MIC is the same
-			pTxMic = (PUCHAR) (&pKey->KeyMaterial) + 16;
-			pRxMic = pTxMic;
-		}
-		else if (bAuthenticator == TRUE)
-		{
-			pTxMic = (PUCHAR) (&pKey->KeyMaterial) + 16;
-			pRxMic = (PUCHAR) (&pKey->KeyMaterial) + 24;
-		}
-		else
-		{
-			pRxMic = (PUCHAR) (&pKey->KeyMaterial) + 16;
-			pTxMic = (PUCHAR) (&pKey->KeyMaterial) + 24;
-		}
-
-		offset = PAIRWISE_KEY_TABLE_BASE + (Aid * HW_KEY_ENTRY_SIZE) + 0x10;
-		for (i=0; i<8; )
-		{
-			Value = *(pTxMic+i);
-			Value += (*(pTxMic+i+1)<<8);
-			Value += (*(pTxMic+i+2)<<16);
-			Value += (*(pTxMic+i+3)<<24);
-			RTUSBWriteMACRegister(pAd, offset+i, Value);
-			i+=4;
-		}
-
-		offset = PAIRWISE_KEY_TABLE_BASE + (Aid * HW_KEY_ENTRY_SIZE) + 0x18;
-		for (i=0; i<8; )
-		{
-			Value = *(pRxMic+i);
-			Value += (*(pRxMic+i+1)<<8);
-			Value += (*(pRxMic+i+2)<<16);
-			Value += (*(pRxMic+i+3)<<24);
-			RTUSBWriteMACRegister(pAd, offset+i, Value);
-			i+=4;
-		}
-
-		// Only Key lenth equal to TKIP key have these
-		NdisMoveMemory(pAd->MacTab.Content[Aid].PairwiseKey.RxMic, pRxMic, 8);
-		NdisMoveMemory(pAd->MacTab.Content[Aid].PairwiseKey.TxMic, pTxMic, 8);
-
-		DBGPRINT(RT_DEBUG_TRACE,
-				("	TxMIC  = %02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x \n",
-				pTxMic[0],pTxMic[1],pTxMic[2],pTxMic[3],
-				pTxMic[4],pTxMic[5],pTxMic[6],pTxMic[7]));
-		DBGPRINT(RT_DEBUG_TRACE,
-				("	RxMIC  = %02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x \n",
-				pRxMic[0],pRxMic[1],pRxMic[2],pRxMic[3],
-				pRxMic[4],pRxMic[5],pRxMic[6],pRxMic[7]));
-	}
-
-	// 2. Record Security Key.
-	pAd->MacTab.Content[BSSID_WCID].PairwiseKey.KeyLen= (UCHAR)pKey->KeyLength;
-	NdisMoveMemory(pAd->MacTab.Content[Aid].PairwiseKey.Key, &pKey->KeyMaterial, pKey->KeyLength);
-
-	// 3. Check RxTsc. And used to init to ASIC IV.
-	if (bKeyRSC == TRUE)
-		NdisMoveMemory(pAd->MacTab.Content[Aid].PairwiseKey.RxTsc, &pKey->KeyRSC, 6);
-	else
-		NdisZeroMemory(pAd->MacTab.Content[Aid].PairwiseKey.RxTsc, 6);
-
-	// 4. Init TxTsc to one based on WiFi WPA specs
-	pAd->MacTab.Content[Aid].PairwiseKey.TxTsc[0] = 1;
-	pAd->MacTab.Content[Aid].PairwiseKey.TxTsc[1] = 0;
-	pAd->MacTab.Content[Aid].PairwiseKey.TxTsc[2] = 0;
-	pAd->MacTab.Content[Aid].PairwiseKey.TxTsc[3] = 0;
-	pAd->MacTab.Content[Aid].PairwiseKey.TxTsc[4] = 0;
-	pAd->MacTab.Content[Aid].PairwiseKey.TxTsc[5] = 0;
-
-	CipherAlg = pAd->MacTab.Content[Aid].PairwiseKey.CipherAlg;
-
-	offset = PAIRWISE_KEY_TABLE_BASE + (Aid * HW_KEY_ENTRY_SIZE);
-	RTUSBMultiWrite(pAd, (USHORT) offset, pKey->KeyMaterial,
-				((pKey->KeyLength == LEN_TKIP_KEY) ? 16 : (USHORT)pKey->KeyLength));
-
-	offset = SHARED_KEY_TABLE_BASE + (KeyIdx * HW_KEY_ENTRY_SIZE);
-	RTUSBMultiWrite(pAd, (USHORT) offset, pKey->KeyMaterial, (USHORT)pKey->KeyLength);
-
-	offset = PAIRWISE_IVEIV_TABLE_BASE + (Aid * HW_IVEIV_ENTRY_SIZE);
-	NdisZeroMemory(IVEIV, 8);
-
-	// IV/EIV
-	if ((CipherAlg == CIPHER_TKIP) ||
-		(CipherAlg == CIPHER_TKIP_NO_MIC) ||
-		(CipherAlg == CIPHER_AES))
-	{
-		IVEIV[3] = 0x20; // Eiv bit on. keyid always 0 for pairwise key
-	}
-	// default key idx needs to set.
-	// in TKIP/AES KeyIdx = 0 , WEP KeyIdx is default tx key.
-	else
-	{
-		IVEIV[3] |= (KeyIdx<< 6);
-	}
-	RTUSBMultiWrite(pAd, (USHORT) offset, IVEIV, 8);
-
-	// WCID Attribute UDF:3, BSSIdx:3, Alg:3, Keytable:1=PAIRWISE KEY, BSSIdx is 0
-	if ((CipherAlg == CIPHER_TKIP) ||
-		(CipherAlg == CIPHER_TKIP_NO_MIC) ||
-		(CipherAlg == CIPHER_AES))
-	{
-		WCIDAttri = (CipherAlg<<1)|SHAREDKEYTABLE;
-	}
-	else
-		WCIDAttri = (CipherAlg<<1)|SHAREDKEYTABLE;
-
-	offset = MAC_WCID_ATTRIBUTE_BASE + (Aid* HW_WCID_ATTRI_SIZE);
-	RTUSBWriteMACRegister(pAd, offset, WCIDAttri);
-	RTUSBReadMACRegister(pAd, offset, &Value);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("BSSID_WCID : offset = %x, WCIDAttri = %lx\n",
-			offset, WCIDAttri));
-
-	// pAddr
-	// Add Bssid mac address at linkup. not here.  check!
-	/*offset = MAC_WCID_BASE + (BSSID_WCID * HW_WCID_ENTRY_SIZE);
-	*for (i=0; i<MAC_ADDR_LEN; i++)
-	{
-		RTMP_IO_WRITE8(pAd, offset+i, pKey->BSSID[i]);
-	}
-	*/
-
-	DBGPRINT(RT_DEBUG_ERROR, ("AddBSSIDasWCIDEntry: Alg=%s, KeyLength = %d\n",
-			CipherName[CipherAlg], pKey->KeyLength));
-	DBGPRINT(RT_DEBUG_TRACE, ("Key [idx=%x] [KeyLen = %d]\n",
-			pKey->KeyIndex, pKey->KeyLength));
-	for(i=0; i<pKey->KeyLength; i++)
-		DBGPRINT_RAW(RT_DEBUG_TRACE,(" %x:", pKey->KeyMaterial[i]));
-	DBGPRINT(RT_DEBUG_TRACE,("	 \n"));
-}
-
-/*
-========================================================================
-Routine Description:
-    Get a received packet.
-
-Arguments:
-	pAd					device control block
-	pSaveRxD			receive descriptor information
-	*pbReschedule		need reschedule flag
-	*pRxPending			pending received packet flag
-
-Return Value:
-    the recieved packet
-
-Note:
-========================================================================
-*/
-#define RT2870_RXDMALEN_FIELD_SIZE			4
-PNDIS_PACKET GetPacketFromRxRing(
-	IN		PRTMP_ADAPTER		pAd,
-	OUT		PRT28XX_RXD_STRUC	pSaveRxD,
-	OUT		BOOLEAN				*pbReschedule,
-	IN OUT	UINT32				*pRxPending)
-{
-	PRX_CONTEXT		pRxContext;
-	PNDIS_PACKET	pSkb;
-	PUCHAR			pData;
-	ULONG			ThisFrameLen;
-	ULONG			RxBufferLength;
-	PRXWI_STRUC		pRxWI;
-
-	pRxContext = &pAd->RxContext[pAd->NextRxBulkInReadIndex];
-	if ((pRxContext->Readable == FALSE) || (pRxContext->InUse == TRUE))
-		return NULL;
-
-	RxBufferLength = pRxContext->BulkInOffset - pAd->ReadPosition;
-	if (RxBufferLength < (RT2870_RXDMALEN_FIELD_SIZE + sizeof(RXWI_STRUC) + sizeof(RXINFO_STRUC)))
-	{
-		goto label_null;
-	}
-
-	pData = &pRxContext->TransferBuffer[pAd->ReadPosition]; /* 4KB */
-	// The RXDMA field is 4 bytes, now just use the first 2 bytes. The Length including the (RXWI + MSDU + Padding)
-	ThisFrameLen = *pData + (*(pData+1)<<8);
-    if (ThisFrameLen == 0)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("BIRIdx(%d): RXDMALen is zero.[%ld], BulkInBufLen = %ld)\n",
-								pAd->NextRxBulkInReadIndex, ThisFrameLen, pRxContext->BulkInOffset));
-		goto label_null;
-	}
-	if ((ThisFrameLen&0x3) != 0)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("BIRIdx(%d): RXDMALen not multiple of 4.[%ld], BulkInBufLen = %ld)\n",
-								pAd->NextRxBulkInReadIndex, ThisFrameLen, pRxContext->BulkInOffset));
-		goto label_null;
-	}
-
-	if ((ThisFrameLen + 8)> RxBufferLength)	// 8 for (RT2870_RXDMALEN_FIELD_SIZE + sizeof(RXINFO_STRUC))
-	{
-		DBGPRINT(RT_DEBUG_TRACE,("BIRIdx(%d):FrameLen(0x%lx) outranges. BulkInLen=0x%lx, remaining RxBufLen=0x%lx, ReadPos=0x%lx\n",
-						pAd->NextRxBulkInReadIndex, ThisFrameLen, pRxContext->BulkInOffset, RxBufferLength, pAd->ReadPosition));
-
-		// error frame. finish this loop
-		goto label_null;
-	}
-
-	// skip USB frame length field
-	pData += RT2870_RXDMALEN_FIELD_SIZE;
-	pRxWI = (PRXWI_STRUC)pData;
-
-	if (pRxWI->MPDUtotalByteCount > ThisFrameLen)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("%s():pRxWIMPDUtotalByteCount(%d) large than RxDMALen(%ld)\n",
-									__func__, pRxWI->MPDUtotalByteCount, ThisFrameLen));
-		goto label_null;
-	}
-
-	// allocate a rx packet
-	pSkb = dev_alloc_skb(ThisFrameLen);
-	if (pSkb == NULL)
-	{
-		DBGPRINT(RT_DEBUG_ERROR,("%s():Cannot Allocate sk buffer for this Bulk-In buffer!\n", __func__));
-		goto label_null;
-	}
-
-	// copy the rx packet
-	memcpy(skb_put(pSkb, ThisFrameLen), pData, ThisFrameLen);
-	RTPKT_TO_OSPKT(pSkb)->dev = get_netdev_from_bssid(pAd, BSS0);
-	RTMP_SET_PACKET_SOURCE(OSPKT_TO_RTPKT(pSkb), PKTSRC_NDIS);
-
-	// copy RxD
-	*pSaveRxD = *(PRXINFO_STRUC)(pData + ThisFrameLen);
-
-	// update next packet read position.
-	pAd->ReadPosition += (ThisFrameLen + RT2870_RXDMALEN_FIELD_SIZE + RXINFO_SIZE);	// 8 for (RT2870_RXDMALEN_FIELD_SIZE + sizeof(RXINFO_STRUC))
-
-	return pSkb;
-
-label_null:
-
-	return NULL;
-}
-
-
-/*
-========================================================================
-Routine Description:
-    Handle received packets.
-
-Arguments:
-	data				- URB information pointer
-
-Return Value:
-    None
-
-Note:
-========================================================================
-*/
-static void rx_done_tasklet(unsigned long data)
-{
-	purbb_t 			pUrb;
-	PRX_CONTEXT			pRxContext;
-	PRTMP_ADAPTER		pAd;
-	NTSTATUS			Status;
-	unsigned int		IrqFlags;
-
-	pUrb		= (purbb_t)data;
-	pRxContext	= (PRX_CONTEXT)pUrb->context;
-	pAd 		= pRxContext->pAd;
-	Status = pUrb->status;
-
-
-	RTMP_IRQ_LOCK(&pAd->BulkInLock, IrqFlags);
-	pRxContext->InUse = FALSE;
-	pRxContext->IRPPending = FALSE;
-	pRxContext->BulkInOffset += pUrb->actual_length;
-	//NdisInterlockedDecrement(&pAd->PendingRx);
-	pAd->PendingRx--;
-
-	if (Status == USB_ST_NOERROR)
-	{
-		pAd->BulkInComplete++;
-		pAd->NextRxBulkInPosition = 0;
-		if (pRxContext->BulkInOffset)	// As jan's comment, it may bulk-in success but size is zero.
-		{
-			pRxContext->Readable = TRUE;
-			INC_RING_INDEX(pAd->NextRxBulkInIndex, RX_RING_SIZE);
-		}
-		RTMP_IRQ_UNLOCK(&pAd->BulkInLock, IrqFlags);
-	}
-	else	 // STATUS_OTHER
-	{
-		pAd->BulkInCompleteFail++;
-		// Still read this packet although it may comtain wrong bytes.
-		pRxContext->Readable = FALSE;
-		RTMP_IRQ_UNLOCK(&pAd->BulkInLock, IrqFlags);
-
-		// Parsing all packets. because after reset, the index will reset to all zero.
-		if ((!RTMP_TEST_FLAG(pAd, (fRTMP_ADAPTER_RESET_IN_PROGRESS |
-									fRTMP_ADAPTER_BULKIN_RESET |
-									fRTMP_ADAPTER_HALT_IN_PROGRESS |
-									fRTMP_ADAPTER_NIC_NOT_EXIST))))
-		{
-
-			DBGPRINT_RAW(RT_DEBUG_ERROR, ("Bulk In Failed. Status=%d, BIIdx=0x%x, BIRIdx=0x%x, actual_length= 0x%x\n",
-							Status, pAd->NextRxBulkInIndex, pAd->NextRxBulkInReadIndex, pRxContext->pUrb->actual_length));
-
-			RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_BULKIN_RESET);
-			RTUSBEnqueueInternalCmd(pAd, CMDTHREAD_RESET_BULK_IN, NULL, 0);
-		}
-	}
-
-	ASSERT((pRxContext->InUse == pRxContext->IRPPending));
-
-	RTUSBBulkReceive(pAd);
-
-	return;
-
-}
-
-
-static void rt2870_mgmt_dma_done_tasklet(unsigned long data)
-{
-	PRTMP_ADAPTER 	pAd;
-	PTX_CONTEXT		pMLMEContext;
-	int				index;
-	PNDIS_PACKET	pPacket;
-	purbb_t			pUrb;
-	NTSTATUS		Status;
-	unsigned long	IrqFlags;
-
-
-	pUrb			= (purbb_t)data;
-	pMLMEContext	= (PTX_CONTEXT)pUrb->context;
-	pAd 			= pMLMEContext->pAd;
-	Status			= pUrb->status;
-	index 			= pMLMEContext->SelfIdx;
-
-	ASSERT((pAd->MgmtRing.TxDmaIdx == index));
-
-	RTMP_IRQ_LOCK(&pAd->BulkOutLock[MGMTPIPEIDX], IrqFlags);
-
-
-	if (Status != USB_ST_NOERROR)
-	{
-		//Bulk-Out fail status handle
-		if ((!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RESET_IN_PROGRESS)) &&
-			(!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS)) &&
-			(!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)) &&
-			(!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BULKOUT_RESET)))
-		{
-			DBGPRINT_RAW(RT_DEBUG_ERROR, ("Bulk Out MLME Failed, Status=%d!\n", Status));
-			// TODO: How to handle about the MLMEBulkOut failed issue. Need to resend the mgmt pkt?
-			RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_BULKOUT_RESET);
-			pAd->bulkResetPipeid = (MGMTPIPEIDX | BULKOUT_MGMT_RESET_FLAG);
-		}
-	}
-
-	pAd->BulkOutPending[MGMTPIPEIDX] = FALSE;
-	RTMP_IRQ_UNLOCK(&pAd->BulkOutLock[MGMTPIPEIDX], IrqFlags);
-
-	RTMP_IRQ_LOCK(&pAd->MLMEBulkOutLock, IrqFlags);
-	// Reset MLME context flags
-	pMLMEContext->IRPPending = FALSE;
-	pMLMEContext->InUse = FALSE;
-	pMLMEContext->bWaitingBulkOut = FALSE;
-	pMLMEContext->BulkOutSize = 0;
-
-	pPacket = pAd->MgmtRing.Cell[index].pNdisPacket;
-	pAd->MgmtRing.Cell[index].pNdisPacket = NULL;
-
-	// Increase MgmtRing Index
-	INC_RING_INDEX(pAd->MgmtRing.TxDmaIdx, MGMT_RING_SIZE);
-	pAd->MgmtRing.TxSwFreeIdx++;
-	RTMP_IRQ_UNLOCK(&pAd->MLMEBulkOutLock, IrqFlags);
-
-	// No-matter success or fail, we free the mgmt packet.
-	if (pPacket)
-		RTMPFreeNdisPacket(pAd, pPacket);
-
-	if ((RTMP_TEST_FLAG(pAd, (fRTMP_ADAPTER_RESET_IN_PROGRESS |
-								fRTMP_ADAPTER_HALT_IN_PROGRESS |
-								fRTMP_ADAPTER_NIC_NOT_EXIST))))
-	{
-		// do nothing and return directly.
-	}
-	else
-	{
-		if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BULKOUT_RESET) &&
-			((pAd->bulkResetPipeid & BULKOUT_MGMT_RESET_FLAG) == BULKOUT_MGMT_RESET_FLAG))
-		{	// For Mgmt Bulk-Out failed, ignore it now.
-			RTUSBEnqueueInternalCmd(pAd, CMDTHREAD_RESET_BULK_OUT, NULL, 0);
-		}
-		else
-		{
-
-			// Always call Bulk routine, even reset bulk.
-			// The protectioon of rest bulk should be in BulkOut routine
-			if (pAd->MgmtRing.TxSwFreeIdx < MGMT_RING_SIZE /* pMLMEContext->bWaitingBulkOut == TRUE */)
-			{
-				RTUSB_SET_BULK_FLAG(pAd, fRTUSB_BULK_OUT_MLME);
-			}
-				RTUSBKickBulkOut(pAd);
-			}
-		}
-
-}
-
-
-static void rt2870_hcca_dma_done_tasklet(unsigned long data)
-{
-	PRTMP_ADAPTER		pAd;
-	PHT_TX_CONTEXT		pHTTXContext;
-	UCHAR				BulkOutPipeId = 4;
-	purbb_t				pUrb;
-
-	DBGPRINT_RAW(RT_DEBUG_ERROR, ("--->hcca_dma_done_tasklet\n"));
-
-	pUrb			= (purbb_t)data;
-	pHTTXContext	= (PHT_TX_CONTEXT)pUrb->context;
-	pAd				= pHTTXContext->pAd;
-
-	rt2870_dataout_complete_tasklet((unsigned long)pUrb);
-
-	if ((RTMP_TEST_FLAG(pAd, (fRTMP_ADAPTER_RESET_IN_PROGRESS |
-								fRTMP_ADAPTER_HALT_IN_PROGRESS |
-								fRTMP_ADAPTER_NIC_NOT_EXIST))))
-	{
-		// do nothing and return directly.
-	}
-	else
-	{
-		if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BULKOUT_RESET))
-		{
-			RTUSBEnqueueInternalCmd(pAd, CMDTHREAD_RESET_BULK_OUT, NULL, 0);
-		}
-		else
-		{	pHTTXContext = &pAd->TxContext[BulkOutPipeId];
-			if ((pAd->TxSwQueue[BulkOutPipeId].Number > 0) &&
-				/*((pHTTXContext->CurWritePosition > (pHTTXContext->NextBulkOutPosition + 0x6000)) || (pHTTXContext->NextBulkOutPosition > pHTTXContext->CurWritePosition + 0x6000)) && */
-				(pAd->DeQueueRunning[BulkOutPipeId] == FALSE) &&
-				(pHTTXContext->bCurWriting == FALSE))
-			{
-				RTMPDeQueuePacket(pAd, FALSE, BulkOutPipeId, MAX_TX_PROCESS);
-			}
-
-			RTUSB_SET_BULK_FLAG(pAd, fRTUSB_BULK_OUT_DATA_NORMAL<<4);
-			RTUSBKickBulkOut(pAd);
-		}
-	}
-
-	DBGPRINT_RAW(RT_DEBUG_ERROR, ("<---hcca_dma_done_tasklet\n"));
-}
-
-
-static void rt2870_ac3_dma_done_tasklet(unsigned long data)
-{
-	PRTMP_ADAPTER		pAd;
-	PHT_TX_CONTEXT		pHTTXContext;
-	UCHAR				BulkOutPipeId = 3;
-	purbb_t				pUrb;
-
-
-	pUrb			= (purbb_t)data;
-	pHTTXContext	= (PHT_TX_CONTEXT)pUrb->context;
-	pAd				= pHTTXContext->pAd;
-
-	rt2870_dataout_complete_tasklet((unsigned long)pUrb);
-
-	if ((RTMP_TEST_FLAG(pAd, (fRTMP_ADAPTER_RESET_IN_PROGRESS |
-								fRTMP_ADAPTER_HALT_IN_PROGRESS |
-								fRTMP_ADAPTER_NIC_NOT_EXIST))))
-	{
-		// do nothing and return directly.
-	}
-	else
-	{
-		if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BULKOUT_RESET))
-		{
-			RTUSBEnqueueInternalCmd(pAd, CMDTHREAD_RESET_BULK_OUT, NULL, 0);
-		}
-		else
-		{	pHTTXContext = &pAd->TxContext[BulkOutPipeId];
-			if ((pAd->TxSwQueue[BulkOutPipeId].Number > 0) &&
-				/*((pHTTXContext->CurWritePosition > (pHTTXContext->NextBulkOutPosition + 0x6000)) || (pHTTXContext->NextBulkOutPosition > pHTTXContext->CurWritePosition + 0x6000)) && */
-				(pAd->DeQueueRunning[BulkOutPipeId] == FALSE) &&
-				(pHTTXContext->bCurWriting == FALSE))
-			{
-				RTMPDeQueuePacket(pAd, FALSE, BulkOutPipeId, MAX_TX_PROCESS);
-			}
-
-			RTUSB_SET_BULK_FLAG(pAd, fRTUSB_BULK_OUT_DATA_NORMAL<<3);
-			RTUSBKickBulkOut(pAd);
-		}
-	}
-
-
-		return;
-}
-
-
-static void rt2870_ac2_dma_done_tasklet(unsigned long data)
-{
-	PRTMP_ADAPTER		pAd;
-	PHT_TX_CONTEXT		pHTTXContext;
-	UCHAR				BulkOutPipeId = 2;
-	purbb_t				pUrb;
-
-
-	pUrb			= (purbb_t)data;
-	pHTTXContext	= (PHT_TX_CONTEXT)pUrb->context;
-	pAd				= pHTTXContext->pAd;
-
-	rt2870_dataout_complete_tasklet((unsigned long)pUrb);
-
-	if ((RTMP_TEST_FLAG(pAd, (fRTMP_ADAPTER_RESET_IN_PROGRESS |
-								fRTMP_ADAPTER_HALT_IN_PROGRESS |
-								fRTMP_ADAPTER_NIC_NOT_EXIST))))
-	{
-		// do nothing and return directly.
-	}
-	else
-	{
-		if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BULKOUT_RESET))
-		{
-			RTUSBEnqueueInternalCmd(pAd, CMDTHREAD_RESET_BULK_OUT, NULL, 0);
-		}
-		else
-		{	pHTTXContext = &pAd->TxContext[BulkOutPipeId];
-			if ((pAd->TxSwQueue[BulkOutPipeId].Number > 0) &&
-				/*((pHTTXContext->CurWritePosition > (pHTTXContext->NextBulkOutPosition + 0x6000)) || (pHTTXContext->NextBulkOutPosition > pHTTXContext->CurWritePosition + 0x6000)) && */
-				(pAd->DeQueueRunning[BulkOutPipeId] == FALSE) &&
-				(pHTTXContext->bCurWriting == FALSE))
-			{
-				RTMPDeQueuePacket(pAd, FALSE, BulkOutPipeId, MAX_TX_PROCESS);
-			}
-
-			RTUSB_SET_BULK_FLAG(pAd, fRTUSB_BULK_OUT_DATA_NORMAL<<2);
-			RTUSBKickBulkOut(pAd);
-		}
-	}
-
-		return;
-}
-
-
-static void rt2870_ac1_dma_done_tasklet(unsigned long data)
-{
-	PRTMP_ADAPTER		pAd;
-	PHT_TX_CONTEXT		pHTTXContext;
-	UCHAR				BulkOutPipeId = 1;
-	purbb_t				pUrb;
-
-
-	pUrb			= (purbb_t)data;
-	pHTTXContext	= (PHT_TX_CONTEXT)pUrb->context;
-	pAd				= pHTTXContext->pAd;
-
-	rt2870_dataout_complete_tasklet((unsigned long)pUrb);
-
-	if ((RTMP_TEST_FLAG(pAd, (fRTMP_ADAPTER_RESET_IN_PROGRESS |
-								fRTMP_ADAPTER_HALT_IN_PROGRESS |
-								fRTMP_ADAPTER_NIC_NOT_EXIST))))
-	{
-		// do nothing and return directly.
-	}
-	else
-	{
-		if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BULKOUT_RESET))
-		{
-			RTUSBEnqueueInternalCmd(pAd, CMDTHREAD_RESET_BULK_OUT, NULL, 0);
-		}
-		else
-		{	pHTTXContext = &pAd->TxContext[BulkOutPipeId];
-			if ((pAd->TxSwQueue[BulkOutPipeId].Number > 0) &&
-				/*((pHTTXContext->CurWritePosition > (pHTTXContext->NextBulkOutPosition + 0x6000)) || (pHTTXContext->NextBulkOutPosition > pHTTXContext->CurWritePosition + 0x6000)) && */
-				(pAd->DeQueueRunning[BulkOutPipeId] == FALSE) &&
-				(pHTTXContext->bCurWriting == FALSE))
-			{
-				RTMPDeQueuePacket(pAd, FALSE, BulkOutPipeId, MAX_TX_PROCESS);
-			}
-
-			RTUSB_SET_BULK_FLAG(pAd, fRTUSB_BULK_OUT_DATA_NORMAL<<1);
-			RTUSBKickBulkOut(pAd);
-		}
-	}
-
-
-	return;
-}
-
-
-static void rt2870_ac0_dma_done_tasklet(unsigned long data)
-{
-	PRTMP_ADAPTER		pAd;
-	PHT_TX_CONTEXT		pHTTXContext;
-	UCHAR				BulkOutPipeId = 0;
-	purbb_t				pUrb;
-
-
-	pUrb			= (purbb_t)data;
-	pHTTXContext	= (PHT_TX_CONTEXT)pUrb->context;
-	pAd				= pHTTXContext->pAd;
-
-	rt2870_dataout_complete_tasklet((unsigned long)pUrb);
-
-	if ((RTMP_TEST_FLAG(pAd, (fRTMP_ADAPTER_RESET_IN_PROGRESS |
-								fRTMP_ADAPTER_HALT_IN_PROGRESS |
-								fRTMP_ADAPTER_NIC_NOT_EXIST))))
-	{
-		// do nothing and return directly.
-	}
-	else
-	{
-		if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BULKOUT_RESET))
-		{
-			RTUSBEnqueueInternalCmd(pAd, CMDTHREAD_RESET_BULK_OUT, NULL, 0);
-		}
-		else
-		{	pHTTXContext = &pAd->TxContext[BulkOutPipeId];
-			if ((pAd->TxSwQueue[BulkOutPipeId].Number > 0) &&
-				/*  ((pHTTXContext->CurWritePosition > (pHTTXContext->NextBulkOutPosition + 0x6000)) || (pHTTXContext->NextBulkOutPosition > pHTTXContext->CurWritePosition + 0x6000)) && */
-				(pAd->DeQueueRunning[BulkOutPipeId] == FALSE) &&
-				(pHTTXContext->bCurWriting == FALSE))
-			{
-				RTMPDeQueuePacket(pAd, FALSE, BulkOutPipeId, MAX_TX_PROCESS);
-			}
-
-			RTUSB_SET_BULK_FLAG(pAd, fRTUSB_BULK_OUT_DATA_NORMAL);
-			RTUSBKickBulkOut(pAd);
-		}
-	}
-
-
-	return;
-
-}
-
-
-static void rt2870_null_frame_complete_tasklet(unsigned long data)
-{
-	PRTMP_ADAPTER	pAd;
-	PTX_CONTEXT		pNullContext;
-	purbb_t			pUrb;
-	NTSTATUS		Status;
-	unsigned long	irqFlag;
-
-
-	pUrb			= (purbb_t)data;
-	pNullContext	= (PTX_CONTEXT)pUrb->context;
-	pAd 			= pNullContext->pAd;
-	Status 			= pUrb->status;
-
-	// Reset Null frame context flags
-	RTMP_IRQ_LOCK(&pAd->BulkOutLock[0], irqFlag);
-	pNullContext->IRPPending 	= FALSE;
-	pNullContext->InUse 		= FALSE;
-	pAd->BulkOutPending[0] = FALSE;
-	pAd->watchDogTxPendingCnt[0] = 0;
-
-	if (Status == USB_ST_NOERROR)
-	{
-		RTMP_IRQ_UNLOCK(&pAd->BulkOutLock[0], irqFlag);
-
-		RTMPDeQueuePacket(pAd, FALSE, NUM_OF_TX_RING, MAX_TX_PROCESS);
-	}
-	else	// STATUS_OTHER
-	{
-		if ((!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RESET_IN_PROGRESS)) &&
-			(!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS)) &&
-			(!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)) &&
-			(!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BULKOUT_RESET)))
-		{
-			DBGPRINT_RAW(RT_DEBUG_ERROR, ("Bulk Out Null Frame Failed, ReasonCode=%d!\n", Status));
-			RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_BULKOUT_RESET);
-			pAd->bulkResetPipeid = (MGMTPIPEIDX | BULKOUT_MGMT_RESET_FLAG);
-			RTMP_IRQ_UNLOCK(&pAd->BulkOutLock[0], irqFlag);
-			RTUSBEnqueueInternalCmd(pAd, CMDTHREAD_RESET_BULK_OUT, NULL, 0);
-		}
-		else
-		{
-			RTMP_IRQ_UNLOCK(&pAd->BulkOutLock[0], irqFlag);
-		}
-	}
-
-	// Always call Bulk routine, even reset bulk.
-	// The protectioon of rest bulk should be in BulkOut routine
-	RTUSBKickBulkOut(pAd);
-
-}
-
-
-static void rt2870_rts_frame_complete_tasklet(unsigned long data)
-{
-	PRTMP_ADAPTER	pAd;
-	PTX_CONTEXT		pRTSContext;
-	purbb_t			pUrb;
-	NTSTATUS		Status;
-	unsigned long	irqFlag;
-
-
-	pUrb		= (purbb_t)data;
-	pRTSContext	= (PTX_CONTEXT)pUrb->context;
-	pAd			= pRTSContext->pAd;
-	Status		= pUrb->status;
-
-	// Reset RTS frame context flags
-	RTMP_IRQ_LOCK(&pAd->BulkOutLock[0], irqFlag);
-	pRTSContext->IRPPending = FALSE;
-	pRTSContext->InUse		= FALSE;
-
-	if (Status == USB_ST_NOERROR)
-	{
-		RTMP_IRQ_UNLOCK(&pAd->BulkOutLock[0], irqFlag);
-		RTMPDeQueuePacket(pAd, FALSE, NUM_OF_TX_RING, MAX_TX_PROCESS);
-	}
-	else	// STATUS_OTHER
-	{
-		if ((!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RESET_IN_PROGRESS)) &&
-			(!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS)) &&
-			(!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)) &&
-			(!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BULKOUT_RESET)))
-		{
-			DBGPRINT_RAW(RT_DEBUG_ERROR, ("Bulk Out RTS Frame Failed\n"));
-			RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_BULKOUT_RESET);
-			pAd->bulkResetPipeid = (MGMTPIPEIDX | BULKOUT_MGMT_RESET_FLAG);
-			RTMP_IRQ_UNLOCK(&pAd->BulkOutLock[0], irqFlag);
-			RTUSBEnqueueInternalCmd(pAd, CMDTHREAD_RESET_BULK_OUT, NULL, 0);
-		}
-		else
-		{
-			RTMP_IRQ_UNLOCK(&pAd->BulkOutLock[0], irqFlag);
-		}
-	}
-
-	RTMP_SEM_LOCK(&pAd->BulkOutLock[pRTSContext->BulkOutPipeId]);
-	pAd->BulkOutPending[pRTSContext->BulkOutPipeId] = FALSE;
-	RTMP_SEM_UNLOCK(&pAd->BulkOutLock[pRTSContext->BulkOutPipeId]);
-
-	// Always call Bulk routine, even reset bulk.
-	// The protectioon of rest bulk should be in BulkOut routine
-	RTUSBKickBulkOut(pAd);
-
-}
-
-
-static void rt2870_pspoll_frame_complete_tasklet(unsigned long data)
-{
-	PRTMP_ADAPTER	pAd;
-	PTX_CONTEXT		pPsPollContext;
-	purbb_t			pUrb;
-	NTSTATUS		Status;
-
-
-	pUrb			= (purbb_t)data;
-	pPsPollContext	= (PTX_CONTEXT)pUrb->context;
-	pAd				= pPsPollContext->pAd;
-	Status			= pUrb->status;
-
-	// Reset PsPoll context flags
-	pPsPollContext->IRPPending	= FALSE;
-	pPsPollContext->InUse		= FALSE;
-	pAd->watchDogTxPendingCnt[0] = 0;
-
-	if (Status == USB_ST_NOERROR)
-	{
-		RTMPDeQueuePacket(pAd, FALSE, NUM_OF_TX_RING, MAX_TX_PROCESS);
-	}
-	else // STATUS_OTHER
-	{
-		if ((!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RESET_IN_PROGRESS)) &&
-			(!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS)) &&
-			(!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)) &&
-			(!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BULKOUT_RESET)))
-		{
-			DBGPRINT_RAW(RT_DEBUG_ERROR, ("Bulk Out PSPoll Failed\n"));
-			RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_BULKOUT_RESET);
-			pAd->bulkResetPipeid = (MGMTPIPEIDX | BULKOUT_MGMT_RESET_FLAG);
-			RTUSBEnqueueInternalCmd(pAd, CMDTHREAD_RESET_BULK_OUT, NULL, 0);
-		}
-	}
-
-	RTMP_SEM_LOCK(&pAd->BulkOutLock[0]);
-	pAd->BulkOutPending[0] = FALSE;
-	RTMP_SEM_UNLOCK(&pAd->BulkOutLock[0]);
-
-	// Always call Bulk routine, even reset bulk.
-	// The protectioon of rest bulk should be in BulkOut routine
-	RTUSBKickBulkOut(pAd);
-
-}
-
-
-static void rt2870_dataout_complete_tasklet(unsigned long data)
-{
-	PRTMP_ADAPTER		pAd;
-	purbb_t				pUrb;
-	POS_COOKIE			pObj;
-	PHT_TX_CONTEXT		pHTTXContext;
-	UCHAR				BulkOutPipeId;
-	NTSTATUS			Status;
-	unsigned long		IrqFlags;
-
-
-	pUrb			= (purbb_t)data;
-	pHTTXContext	= (PHT_TX_CONTEXT)pUrb->context;
-	pAd				= pHTTXContext->pAd;
-	pObj 			= (POS_COOKIE) pAd->OS_Cookie;
-	Status			= pUrb->status;
-
-	// Store BulkOut PipeId
-	BulkOutPipeId = pHTTXContext->BulkOutPipeId;
-	pAd->BulkOutDataOneSecCount++;
-
-	//DBGPRINT(RT_DEBUG_LOUD, ("Done-B(%d):I=0x%lx, CWPos=%ld, NBPos=%ld, ENBPos=%ld, bCopy=%d!\n", BulkOutPipeId, in_interrupt(), pHTTXContext->CurWritePosition,
-	//		pHTTXContext->NextBulkOutPosition, pHTTXContext->ENextBulkOutPosition, pHTTXContext->bCopySavePad));
-
-	RTMP_IRQ_LOCK(&pAd->BulkOutLock[BulkOutPipeId], IrqFlags);
-	pAd->BulkOutPending[BulkOutPipeId] = FALSE;
-	pHTTXContext->IRPPending = FALSE;
-	pAd->watchDogTxPendingCnt[BulkOutPipeId] = 0;
-
-	if (Status == USB_ST_NOERROR)
-	{
-		pAd->BulkOutComplete++;
-
-		RTMP_IRQ_UNLOCK(&pAd->BulkOutLock[BulkOutPipeId], IrqFlags);
-
-		pAd->Counters8023.GoodTransmits++;
-		//RTMP_IRQ_LOCK(&pAd->TxContextQueueLock[BulkOutPipeId], IrqFlags);
-		FREE_HTTX_RING(pAd, BulkOutPipeId, pHTTXContext);
-		//RTMP_IRQ_UNLOCK(&pAd->TxContextQueueLock[BulkOutPipeId], IrqFlags);
-
-
-	}
-	else	// STATUS_OTHER
-	{
-		PUCHAR	pBuf;
-
-		pAd->BulkOutCompleteOther++;
-
-		pBuf = &pHTTXContext->TransferBuffer->field.WirelessPacket[pHTTXContext->NextBulkOutPosition];
-
-		if (!RTMP_TEST_FLAG(pAd, (fRTMP_ADAPTER_RESET_IN_PROGRESS |
-									fRTMP_ADAPTER_HALT_IN_PROGRESS |
-									fRTMP_ADAPTER_NIC_NOT_EXIST |
-									fRTMP_ADAPTER_BULKOUT_RESET)))
-		{
-			RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_BULKOUT_RESET);
-			pAd->bulkResetPipeid = BulkOutPipeId;
-			pAd->bulkResetReq[BulkOutPipeId] = pAd->BulkOutReq;
-		}
-		RTMP_IRQ_UNLOCK(&pAd->BulkOutLock[BulkOutPipeId], IrqFlags);
-
-		DBGPRINT_RAW(RT_DEBUG_ERROR, ("BulkOutDataPacket failed: ReasonCode=%d!\n", Status));
-		DBGPRINT_RAW(RT_DEBUG_ERROR, ("\t>>BulkOut Req=0x%lx, Complete=0x%lx, Other=0x%lx\n", pAd->BulkOutReq, pAd->BulkOutComplete, pAd->BulkOutCompleteOther));
-		DBGPRINT_RAW(RT_DEBUG_ERROR, ("\t>>BulkOut Header:%x %x %x %x %x %x %x %x\n", pBuf[0], pBuf[1], pBuf[2], pBuf[3], pBuf[4], pBuf[5], pBuf[6], pBuf[7]));
-		//DBGPRINT_RAW(RT_DEBUG_ERROR, (">>BulkOutCompleteCancel=0x%x, BulkOutCompleteOther=0x%x\n", pAd->BulkOutCompleteCancel, pAd->BulkOutCompleteOther));
-
-	}
-
-	//
-	// bInUse = TRUE, means some process are filling TX data, after that must turn on bWaitingBulkOut
-	// bWaitingBulkOut = TRUE, means the TX data are waiting for bulk out.
-	//
-	//RTMP_IRQ_LOCK(&pAd->TxContextQueueLock[BulkOutPipeId], IrqFlags);
-	if ((pHTTXContext->ENextBulkOutPosition != pHTTXContext->CurWritePosition) &&
-		(pHTTXContext->ENextBulkOutPosition != (pHTTXContext->CurWritePosition+8)) &&
-		!RTUSB_TEST_BULK_FLAG(pAd, (fRTUSB_BULK_OUT_DATA_FRAG << BulkOutPipeId)))
-	{
-		// Indicate There is data avaliable
-		RTUSB_SET_BULK_FLAG(pAd, (fRTUSB_BULK_OUT_DATA_NORMAL << BulkOutPipeId));
-	}
-	//RTMP_IRQ_UNLOCK(&pAd->TxContextQueueLock[BulkOutPipeId], IrqFlags);
-
-	// Always call Bulk routine, even reset bulk.
-	// The protection of rest bulk should be in BulkOut routine
-	RTUSBKickBulkOut(pAd);
-}
-
-/* End of 2870_rtmp_init.c */
diff --git a/drivers/staging/rt2870/common/acction.c b/drivers/staging/rt2870/common/acction.c
new file mode 100644
index 000000000000..fd806c3871aa
--- /dev/null
+++ b/drivers/staging/rt2870/common/acction.c
@@ -0,0 +1 @@
+#include "../../rt2860/common/action.c"
diff --git a/drivers/staging/rt2870/common/cmm_aes.c b/drivers/staging/rt2870/common/cmm_aes.c
new file mode 100644
index 000000000000..15d6a14d2d9c
--- /dev/null
+++ b/drivers/staging/rt2870/common/cmm_aes.c
@@ -0,0 +1 @@
+#include "../../rt2860/common/cmm_aes.c"
diff --git a/drivers/staging/rt2870/common/cmm_asic.c b/drivers/staging/rt2870/common/cmm_asic.c
new file mode 100644
index 000000000000..38de817991ff
--- /dev/null
+++ b/drivers/staging/rt2870/common/cmm_asic.c
@@ -0,0 +1 @@
+#include "../../rt2860/common/cmm_asic.c"
diff --git a/drivers/staging/rt2870/common/cmm_cfg.c b/drivers/staging/rt2870/common/cmm_cfg.c
new file mode 100644
index 000000000000..6b2bdd7d44ec
--- /dev/null
+++ b/drivers/staging/rt2870/common/cmm_cfg.c
@@ -0,0 +1 @@
+#include "../../rt2860/common/cmm_cfg.c"
diff --git a/drivers/staging/rt2870/common/cmm_data_2870.c b/drivers/staging/rt2870/common/cmm_data_2870.c
deleted file mode 100644
index 3b63a48310f0..000000000000
--- a/drivers/staging/rt2870/common/cmm_data_2870.c
+++ /dev/null
@@ -1,936 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-*/
-/*
-   All functions in this file must be USB-depended, or you should out your function
-	in other files.
-
-*/
-#include "../rt_config.h"
-
-
-/*
-	We can do copy the frame into pTxContext when match following conditions.
-		=>
-		=>
-		=>
-*/
-static inline NDIS_STATUS RtmpUSBCanDoWrite(
-	IN RTMP_ADAPTER		*pAd,
-	IN UCHAR			QueIdx,
-	IN HT_TX_CONTEXT 	*pHTTXContext)
-{
-	NDIS_STATUS	canWrite = NDIS_STATUS_RESOURCES;
-
-	if (((pHTTXContext->CurWritePosition) < pHTTXContext->NextBulkOutPosition) && (pHTTXContext->CurWritePosition + LOCAL_TXBUF_SIZE) > pHTTXContext->NextBulkOutPosition)
-	{
-		DBGPRINT(RT_DEBUG_ERROR,("RtmpUSBCanDoWrite c1!\n"));
-		RTUSB_SET_BULK_FLAG(pAd, (fRTUSB_BULK_OUT_DATA_NORMAL << QueIdx));
-	}
-	else if ((pHTTXContext->CurWritePosition == 8) && (pHTTXContext->NextBulkOutPosition < LOCAL_TXBUF_SIZE))
-	{
-		DBGPRINT(RT_DEBUG_ERROR,("RtmpUSBCanDoWrite c2!\n"));
-		RTUSB_SET_BULK_FLAG(pAd, (fRTUSB_BULK_OUT_DATA_NORMAL << QueIdx));
-	}
-	else if (pHTTXContext->bCurWriting == TRUE)
-	{
-		DBGPRINT(RT_DEBUG_ERROR,("RtmpUSBCanDoWrite c3!\n"));
-	}
-	else
-	{
-		canWrite = NDIS_STATUS_SUCCESS;
-	}
-
-
-	return canWrite;
-}
-
-
-USHORT RtmpUSB_WriteSubTxResource(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	TX_BLK			*pTxBlk,
-	IN	BOOLEAN			bIsLast,
-	OUT	USHORT			*FreeNumber)
-{
-
-	// Dummy function. Should be removed in the future.
-	return 0;
-
-}
-
-USHORT	RtmpUSB_WriteFragTxResource(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	TX_BLK			*pTxBlk,
-	IN	UCHAR			fragNum,
-	OUT	USHORT			*FreeNumber)
-{
-	HT_TX_CONTEXT	*pHTTXContext;
-	USHORT			hwHdrLen;	// The hwHdrLen consist of 802.11 header length plus the header padding length.
-	UINT32			fillOffset;
-	TXINFO_STRUC	*pTxInfo;
-	TXWI_STRUC		*pTxWI;
-	PUCHAR			pWirelessPacket = NULL;
-	UCHAR			QueIdx;
-	NDIS_STATUS		Status;
-	unsigned long	IrqFlags;
-	UINT32			USBDMApktLen = 0, DMAHdrLen, padding;
-	BOOLEAN			TxQLastRound = FALSE;
-
-	//
-	// get Tx Ring Resource & Dma Buffer address
-	//
-	QueIdx = pTxBlk->QueIdx;
-	pHTTXContext  = &pAd->TxContext[QueIdx];
-
-	RTMP_IRQ_LOCK(&pAd->TxContextQueueLock[QueIdx], IrqFlags);
-
-	pHTTXContext  = &pAd->TxContext[QueIdx];
-	fillOffset = pHTTXContext->CurWritePosition;
-
-	if(fragNum == 0)
-	{
-		// Check if we have enough space for this bulk-out batch.
-		Status = RtmpUSBCanDoWrite(pAd, QueIdx, pHTTXContext);
-		if (Status == NDIS_STATUS_SUCCESS)
-		{
-			pHTTXContext->bCurWriting = TRUE;
-
-			// Reserve space for 8 bytes padding.
-			if ((pHTTXContext->ENextBulkOutPosition == pHTTXContext->CurWritePosition))
-			{
-				pHTTXContext->ENextBulkOutPosition += 8;
-				pHTTXContext->CurWritePosition += 8;
-				fillOffset += 8;
-			}
-			pTxBlk->Priv = 0;
-			pHTTXContext->CurWriteRealPos = pHTTXContext->CurWritePosition;
-		}
-		else
-		{
-			RTMP_IRQ_UNLOCK(&pAd->TxContextQueueLock[QueIdx], IrqFlags);
-
-			RELEASE_NDIS_PACKET(pAd, pTxBlk->pPacket, NDIS_STATUS_FAILURE);
-			return(Status);
-		}
-	}
-	else
-	{
-		// For sub-sequent frames of this bulk-out batch. Just copy it to our bulk-out buffer.
-		Status = ((pHTTXContext->bCurWriting == TRUE) ? NDIS_STATUS_SUCCESS : NDIS_STATUS_FAILURE);
-		if (Status == NDIS_STATUS_SUCCESS)
-		{
-			fillOffset += pTxBlk->Priv;
-		}
-		else
-		{
-			RTMP_IRQ_UNLOCK(&pAd->TxContextQueueLock[QueIdx], IrqFlags);
-
-			RELEASE_NDIS_PACKET(pAd, pTxBlk->pPacket, NDIS_STATUS_FAILURE);
-			return(Status);
-		}
-	}
-
-	NdisZeroMemory((PUCHAR)(&pTxBlk->HeaderBuf[0]), TXINFO_SIZE);
-	pTxInfo = (PTXINFO_STRUC)(&pTxBlk->HeaderBuf[0]);
-	pTxWI= (PTXWI_STRUC)(&pTxBlk->HeaderBuf[TXINFO_SIZE]);
-
-	pWirelessPacket = &pHTTXContext->TransferBuffer->field.WirelessPacket[fillOffset];
-
-	// copy TXWI + WLAN Header + LLC into DMA Header Buffer
-	//hwHdrLen = ROUND_UP(pTxBlk->MpduHeaderLen, 4);
-	hwHdrLen = pTxBlk->MpduHeaderLen + pTxBlk->HdrPadLen;
-
-	// Build our URB for USBD
-	DMAHdrLen = TXWI_SIZE + hwHdrLen;
-	USBDMApktLen = DMAHdrLen + pTxBlk->SrcBufLen;
-	padding = (4 - (USBDMApktLen % 4)) & 0x03;	// round up to 4 byte alignment
-	USBDMApktLen += padding;
-
-	pTxBlk->Priv += (TXINFO_SIZE + USBDMApktLen);
-
-	// For TxInfo, the length of USBDMApktLen = TXWI_SIZE + 802.11 header + payload
-	RTMPWriteTxInfo(pAd, pTxInfo, (USHORT)(USBDMApktLen), FALSE, FIFO_EDCA, FALSE /*NextValid*/,  FALSE);
-
-	if (fragNum == pTxBlk->TotalFragNum)
-	{
-		pTxInfo->USBDMATxburst = 0;
-		if ((pHTTXContext->CurWritePosition + pTxBlk->Priv + 3906)> MAX_TXBULK_LIMIT)
-		{
-			pTxInfo->SwUseLastRound = 1;
-			TxQLastRound = TRUE;
-		}
-	}
-	else
-	{
-		pTxInfo->USBDMATxburst = 1;
-	}
-
-	NdisMoveMemory(pWirelessPacket, pTxBlk->HeaderBuf, TXINFO_SIZE + TXWI_SIZE + hwHdrLen);
-	pWirelessPacket += (TXINFO_SIZE + TXWI_SIZE + hwHdrLen);
-	pHTTXContext->CurWriteRealPos += (TXINFO_SIZE + TXWI_SIZE + hwHdrLen);
-
-	RTMP_IRQ_UNLOCK(&pAd->TxContextQueueLock[QueIdx], IrqFlags);
-
-	NdisMoveMemory(pWirelessPacket, pTxBlk->pSrcBufData, pTxBlk->SrcBufLen);
-
-	//	Zero the last padding.
-	pWirelessPacket += pTxBlk->SrcBufLen;
-	NdisZeroMemory(pWirelessPacket, padding + 8);
-
-	if (fragNum == pTxBlk->TotalFragNum)
-	{
-		RTMP_IRQ_LOCK(&pAd->TxContextQueueLock[QueIdx], IrqFlags);
-
-		// Update the pHTTXContext->CurWritePosition. 3906 used to prevent the NextBulkOut is a A-RALINK/A-MSDU Frame.
-		pHTTXContext->CurWritePosition += pTxBlk->Priv;
-		if (TxQLastRound == TRUE)
-			pHTTXContext->CurWritePosition = 8;
-		pHTTXContext->CurWriteRealPos = pHTTXContext->CurWritePosition;
-
-
-		// Finally, set bCurWriting as FALSE
-	pHTTXContext->bCurWriting = FALSE;
-
-		RTMP_IRQ_UNLOCK(&pAd->TxContextQueueLock[QueIdx], IrqFlags);
-
-		// succeed and release the skb buffer
-		RELEASE_NDIS_PACKET(pAd, pTxBlk->pPacket, NDIS_STATUS_SUCCESS);
-	}
-
-
-	return(Status);
-
-}
-
-
-USHORT RtmpUSB_WriteSingleTxResource(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	TX_BLK			*pTxBlk,
-	IN	BOOLEAN			bIsLast,
-	OUT	USHORT			*FreeNumber)
-{
-	HT_TX_CONTEXT	*pHTTXContext;
-	USHORT			hwHdrLen;
-	UINT32			fillOffset;
-	TXINFO_STRUC	*pTxInfo;
-	TXWI_STRUC		*pTxWI;
-	PUCHAR			pWirelessPacket;
-	UCHAR			QueIdx;
-	unsigned long	IrqFlags;
-	NDIS_STATUS		Status;
-	UINT32			USBDMApktLen = 0, DMAHdrLen, padding;
-	BOOLEAN			bTxQLastRound = FALSE;
-
-	// For USB, didn't need PCI_MAP_SINGLE()
-	//SrcBufPA = PCI_MAP_SINGLE(pAd, (char *) pTxBlk->pSrcBufData, pTxBlk->SrcBufLen, PCI_DMA_TODEVICE);
-
-
-	//
-	// get Tx Ring Resource & Dma Buffer address
-	//
-	QueIdx = pTxBlk->QueIdx;
-
-	RTMP_IRQ_LOCK(&pAd->TxContextQueueLock[QueIdx], IrqFlags);
-	pHTTXContext  = &pAd->TxContext[QueIdx];
-	fillOffset = pHTTXContext->CurWritePosition;
-
-
-
-	// Check ring full.
-	Status = RtmpUSBCanDoWrite(pAd, QueIdx, pHTTXContext);
-	if(Status == NDIS_STATUS_SUCCESS)
-	{
-		pHTTXContext->bCurWriting = TRUE;
-
-		pTxInfo = (PTXINFO_STRUC)(&pTxBlk->HeaderBuf[0]);
-		pTxWI= (PTXWI_STRUC)(&pTxBlk->HeaderBuf[TXINFO_SIZE]);
-
-		// Reserve space for 8 bytes padding.
-		if ((pHTTXContext->ENextBulkOutPosition == pHTTXContext->CurWritePosition))
-		{
-			pHTTXContext->ENextBulkOutPosition += 8;
-			pHTTXContext->CurWritePosition += 8;
-			fillOffset += 8;
-		}
-		pHTTXContext->CurWriteRealPos = pHTTXContext->CurWritePosition;
-
-		pWirelessPacket = &pHTTXContext->TransferBuffer->field.WirelessPacket[fillOffset];
-
-		// copy TXWI + WLAN Header + LLC into DMA Header Buffer
-		//hwHdrLen = ROUND_UP(pTxBlk->MpduHeaderLen, 4);
-		hwHdrLen = pTxBlk->MpduHeaderLen + pTxBlk->HdrPadLen;
-
-		// Build our URB for USBD
-		DMAHdrLen = TXWI_SIZE + hwHdrLen;
-		USBDMApktLen = DMAHdrLen + pTxBlk->SrcBufLen;
-		padding = (4 - (USBDMApktLen % 4)) & 0x03;	// round up to 4 byte alignment
-		USBDMApktLen += padding;
-
-		pTxBlk->Priv = (TXINFO_SIZE + USBDMApktLen);
-
-		// For TxInfo, the length of USBDMApktLen = TXWI_SIZE + 802.11 header + payload
-		//PS packets use HCCA queue when dequeue from PS unicast queue (WiFi WPA2 MA9_DT1 for Marvell B STA)
-		RTMPWriteTxInfo(pAd, pTxInfo, (USHORT)(USBDMApktLen), FALSE, FIFO_EDCA, FALSE /*NextValid*/,  FALSE);
-
-		if ((pHTTXContext->CurWritePosition + 3906 + pTxBlk->Priv) > MAX_TXBULK_LIMIT)
-		{
-			pTxInfo->SwUseLastRound = 1;
-			bTxQLastRound = TRUE;
-		}
-		NdisMoveMemory(pWirelessPacket, pTxBlk->HeaderBuf, TXINFO_SIZE + TXWI_SIZE + hwHdrLen);
-		pWirelessPacket += (TXINFO_SIZE + TXWI_SIZE + hwHdrLen);
-
-		// We unlock it here to prevent the first 8 bytes maybe over-writed issue.
-		//	1. First we got CurWritePosition but the first 8 bytes still not write to the pTxcontext.
-		//	2. An interrupt break our routine and handle bulk-out complete.
-		//	3. In the bulk-out compllete, it need to do another bulk-out,
-		//			if the ENextBulkOutPosition is just the same as CurWritePosition, it will save the first 8 bytes from CurWritePosition,
-		//			but the payload still not copyed. the pTxContext->SavedPad[] will save as allzero. and set the bCopyPad = TRUE.
-		//	4. Interrupt complete.
-		//  5. Our interrupted routine go back and fill the first 8 bytes to pTxContext.
-		//	6. Next time when do bulk-out, it found the bCopyPad==TRUE and will copy the SavedPad[] to pTxContext->NextBulkOutPosition.
-		//		and the packet will wrong.
-		pHTTXContext->CurWriteRealPos += (TXINFO_SIZE + TXWI_SIZE + hwHdrLen);
-		RTMP_IRQ_UNLOCK(&pAd->TxContextQueueLock[QueIdx], IrqFlags);
-
-		NdisMoveMemory(pWirelessPacket, pTxBlk->pSrcBufData, pTxBlk->SrcBufLen);
-		pWirelessPacket += pTxBlk->SrcBufLen;
-		NdisZeroMemory(pWirelessPacket, padding + 8);
-
-		RTMP_IRQ_LOCK(&pAd->TxContextQueueLock[QueIdx], IrqFlags);
-
-		pHTTXContext->CurWritePosition += pTxBlk->Priv;
-		if (bTxQLastRound)
-			pHTTXContext->CurWritePosition = 8;
-		pHTTXContext->CurWriteRealPos = pHTTXContext->CurWritePosition;
-
-	pHTTXContext->bCurWriting = FALSE;
-	}
-
-
-	RTMP_IRQ_UNLOCK(&pAd->TxContextQueueLock[QueIdx], IrqFlags);
-
-
-	// succeed and release the skb buffer
-	RELEASE_NDIS_PACKET(pAd, pTxBlk->pPacket, NDIS_STATUS_SUCCESS);
-
-	return(Status);
-
-}
-
-
-USHORT RtmpUSB_WriteMultiTxResource(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	TX_BLK			*pTxBlk,
-	IN	UCHAR			frameNum,
-	OUT	USHORT			*FreeNumber)
-{
-	HT_TX_CONTEXT	*pHTTXContext;
-	USHORT			hwHdrLen;	// The hwHdrLen consist of 802.11 header length plus the header padding length.
-	UINT32			fillOffset;
-	TXINFO_STRUC	*pTxInfo;
-	TXWI_STRUC		*pTxWI;
-	PUCHAR			pWirelessPacket = NULL;
-	UCHAR			QueIdx;
-	NDIS_STATUS		Status;
-	unsigned long	IrqFlags;
-	//UINT32			USBDMApktLen = 0, DMAHdrLen, padding;
-
-	//
-	// get Tx Ring Resource & Dma Buffer address
-	//
-	QueIdx = pTxBlk->QueIdx;
-	pHTTXContext  = &pAd->TxContext[QueIdx];
-
-	RTMP_IRQ_LOCK(&pAd->TxContextQueueLock[QueIdx], IrqFlags);
-
-	if(frameNum == 0)
-	{
-		// Check if we have enough space for this bulk-out batch.
-		Status = RtmpUSBCanDoWrite(pAd, QueIdx, pHTTXContext);
-		if (Status == NDIS_STATUS_SUCCESS)
-		{
-			pHTTXContext->bCurWriting = TRUE;
-
-			pTxInfo = (PTXINFO_STRUC)(&pTxBlk->HeaderBuf[0]);
-			pTxWI= (PTXWI_STRUC)(&pTxBlk->HeaderBuf[TXINFO_SIZE]);
-
-
-			// Reserve space for 8 bytes padding.
-			if ((pHTTXContext->ENextBulkOutPosition == pHTTXContext->CurWritePosition))
-			{
-
-				pHTTXContext->CurWritePosition += 8;
-				pHTTXContext->ENextBulkOutPosition += 8;
-			}
-			fillOffset = pHTTXContext->CurWritePosition;
-			pHTTXContext->CurWriteRealPos = pHTTXContext->CurWritePosition;
-
-			pWirelessPacket = &pHTTXContext->TransferBuffer->field.WirelessPacket[fillOffset];
-
-			//
-			// Copy TXINFO + TXWI + WLAN Header + LLC into DMA Header Buffer
-			//
-			if (pTxBlk->TxFrameType == TX_AMSDU_FRAME)
-				//hwHdrLen = ROUND_UP(pTxBlk->MpduHeaderLen-LENGTH_AMSDU_SUBFRAMEHEAD, 4)+LENGTH_AMSDU_SUBFRAMEHEAD;
-				hwHdrLen = pTxBlk->MpduHeaderLen-LENGTH_AMSDU_SUBFRAMEHEAD + pTxBlk->HdrPadLen + LENGTH_AMSDU_SUBFRAMEHEAD;
-			else if (pTxBlk->TxFrameType == TX_RALINK_FRAME)
-				//hwHdrLen = ROUND_UP(pTxBlk->MpduHeaderLen-LENGTH_ARALINK_HEADER_FIELD, 4)+LENGTH_ARALINK_HEADER_FIELD;
-				hwHdrLen = pTxBlk->MpduHeaderLen-LENGTH_ARALINK_HEADER_FIELD + pTxBlk->HdrPadLen + LENGTH_ARALINK_HEADER_FIELD;
-			else
-				//hwHdrLen = ROUND_UP(pTxBlk->MpduHeaderLen, 4);
-				hwHdrLen = pTxBlk->MpduHeaderLen + pTxBlk->HdrPadLen;
-
-			// Update the pTxBlk->Priv.
-			pTxBlk->Priv = TXINFO_SIZE + TXWI_SIZE + hwHdrLen;
-
-			//	pTxInfo->USBDMApktLen now just a temp value and will to correct latter.
-			RTMPWriteTxInfo(pAd, pTxInfo, (USHORT)(pTxBlk->Priv), FALSE, FIFO_EDCA, FALSE /*NextValid*/,  FALSE);
-
-			// Copy it.
-			NdisMoveMemory(pWirelessPacket, pTxBlk->HeaderBuf, pTxBlk->Priv);
-			pHTTXContext->CurWriteRealPos += pTxBlk->Priv;
-			pWirelessPacket += pTxBlk->Priv;
-		}
-	}
-	else
-	{	// For sub-sequent frames of this bulk-out batch. Just copy it to our bulk-out buffer.
-
-		Status = ((pHTTXContext->bCurWriting == TRUE) ? NDIS_STATUS_SUCCESS : NDIS_STATUS_FAILURE);
-		if (Status == NDIS_STATUS_SUCCESS)
-		{
-			fillOffset =  (pHTTXContext->CurWritePosition + pTxBlk->Priv);
-			pWirelessPacket = &pHTTXContext->TransferBuffer->field.WirelessPacket[fillOffset];
-
-			//hwHdrLen = pTxBlk->MpduHeaderLen;
-			NdisMoveMemory(pWirelessPacket, pTxBlk->HeaderBuf, pTxBlk->MpduHeaderLen);
-			pWirelessPacket += (pTxBlk->MpduHeaderLen);
-			pTxBlk->Priv += pTxBlk->MpduHeaderLen;
-		}
-		else
-		{	// It should not happened now unless we are going to shutdown.
-			DBGPRINT(RT_DEBUG_ERROR, ("WriteMultiTxResource():bCurWriting is FALSE when handle sub-sequent frames.\n"));
-			Status = NDIS_STATUS_FAILURE;
-		}
-	}
-
-
-	// We unlock it here to prevent the first 8 bytes maybe over-write issue.
-	//	1. First we got CurWritePosition but the first 8 bytes still not write to the pTxContext.
-	//	2. An interrupt break our routine and handle bulk-out complete.
-	//	3. In the bulk-out compllete, it need to do another bulk-out,
-	//			if the ENextBulkOutPosition is just the same as CurWritePosition, it will save the first 8 bytes from CurWritePosition,
-	//			but the payload still not copyed. the pTxContext->SavedPad[] will save as allzero. and set the bCopyPad = TRUE.
-	//	4. Interrupt complete.
-	//  5. Our interrupted routine go back and fill the first 8 bytes to pTxContext.
-	//	6. Next time when do bulk-out, it found the bCopyPad==TRUE and will copy the SavedPad[] to pTxContext->NextBulkOutPosition.
-	//		and the packet will wrong.
-	RTMP_IRQ_UNLOCK(&pAd->TxContextQueueLock[QueIdx], IrqFlags);
-
-	if (Status != NDIS_STATUS_SUCCESS)
-	{
-		DBGPRINT(RT_DEBUG_ERROR,("WriteMultiTxResource: CWPos = %ld, NBOutPos = %ld.\n", pHTTXContext->CurWritePosition, pHTTXContext->NextBulkOutPosition));
-		goto done;
-	}
-
-	// Copy the frame content into DMA buffer and update the pTxBlk->Priv
-	NdisMoveMemory(pWirelessPacket, pTxBlk->pSrcBufData, pTxBlk->SrcBufLen);
-	pWirelessPacket += pTxBlk->SrcBufLen;
-	pTxBlk->Priv += pTxBlk->SrcBufLen;
-
-done:
-	// Release the skb buffer here
-	RELEASE_NDIS_PACKET(pAd, pTxBlk->pPacket, NDIS_STATUS_SUCCESS);
-
-	return(Status);
-
-}
-
-
-VOID RtmpUSB_FinalWriteTxResource(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	TX_BLK			*pTxBlk,
-	IN	USHORT			totalMPDUSize,
-	IN	USHORT			TxIdx)
-{
-	UCHAR			QueIdx;
-	HT_TX_CONTEXT	*pHTTXContext;
-	UINT32			fillOffset;
-	TXINFO_STRUC	*pTxInfo;
-	TXWI_STRUC		*pTxWI;
-	UINT32			USBDMApktLen, padding;
-	unsigned long	IrqFlags;
-	PUCHAR			pWirelessPacket;
-
-	QueIdx = pTxBlk->QueIdx;
-	pHTTXContext  = &pAd->TxContext[QueIdx];
-
-	RTMP_IRQ_LOCK(&pAd->TxContextQueueLock[QueIdx], IrqFlags);
-
-	if (pHTTXContext->bCurWriting == TRUE)
-	{
-		fillOffset = pHTTXContext->CurWritePosition;
-		if (((pHTTXContext->ENextBulkOutPosition == pHTTXContext->CurWritePosition) || ((pHTTXContext->ENextBulkOutPosition-8) == pHTTXContext->CurWritePosition))
-			&& (pHTTXContext->bCopySavePad == TRUE))
-			pWirelessPacket = (PUCHAR)(&pHTTXContext->SavedPad[0]);
-		else
-			pWirelessPacket = (PUCHAR)(&pHTTXContext->TransferBuffer->field.WirelessPacket[fillOffset]);
-
-		//
-		// Update TxInfo->USBDMApktLen ,
-		//		the length = TXWI_SIZE + 802.11_hdr + 802.11_hdr_pad + payload_of_all_batch_frames + Bulk-Out-padding
-		//
-		pTxInfo = (PTXINFO_STRUC)(pWirelessPacket);
-
-		// Calculate the bulk-out padding
-		USBDMApktLen = pTxBlk->Priv - TXINFO_SIZE;
-		padding = (4 - (USBDMApktLen % 4)) & 0x03;	// round up to 4 byte alignment
-		USBDMApktLen += padding;
-
-		pTxInfo->USBDMATxPktLen = USBDMApktLen;
-
-		//
-		// Update TXWI->MPDUtotalByteCount ,
-		//		the length = 802.11 header + payload_of_all_batch_frames
-		pTxWI= (PTXWI_STRUC)(pWirelessPacket + TXINFO_SIZE);
-		pTxWI->MPDUtotalByteCount = totalMPDUSize;
-
-		//
-		// Update the pHTTXContext->CurWritePosition
-		//
-		pHTTXContext->CurWritePosition += (TXINFO_SIZE + USBDMApktLen);
-		if ((pHTTXContext->CurWritePosition + 3906)> MAX_TXBULK_LIMIT)
-		{	// Add 3906 for prevent the NextBulkOut packet size is a A-RALINK/A-MSDU Frame.
-			pHTTXContext->CurWritePosition = 8;
-			pTxInfo->SwUseLastRound = 1;
-		}
-		pHTTXContext->CurWriteRealPos = pHTTXContext->CurWritePosition;
-
-
-		//
-		//	Zero the last padding.
-		//
-		pWirelessPacket = (&pHTTXContext->TransferBuffer->field.WirelessPacket[fillOffset + pTxBlk->Priv]);
-		NdisZeroMemory(pWirelessPacket, padding + 8);
-
-		// Finally, set bCurWriting as FALSE
-		pHTTXContext->bCurWriting = FALSE;
-
-	}
-	else
-	{	// It should not happened now unless we are going to shutdown.
-		DBGPRINT(RT_DEBUG_ERROR, ("FinalWriteTxResource():bCurWriting is FALSE when handle last frames.\n"));
-	}
-
-	RTMP_IRQ_UNLOCK(&pAd->TxContextQueueLock[QueIdx], IrqFlags);
-
-}
-
-
-VOID RtmpUSBDataLastTxIdx(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			QueIdx,
-	IN	USHORT			TxIdx)
-{
-	// DO nothing for USB.
-}
-
-
-/*
-	When can do bulk-out:
-		1. TxSwFreeIdx < TX_RING_SIZE;
-			It means has at least one Ring entity is ready for bulk-out, kick it out.
-		2. If TxSwFreeIdx == TX_RING_SIZE
-			Check if the CurWriting flag is FALSE, if it's FALSE, we can do kick out.
-
-*/
-VOID RtmpUSBDataKickOut(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	TX_BLK			*pTxBlk,
-	IN	UCHAR			QueIdx)
-{
-	RTUSB_SET_BULK_FLAG(pAd, (fRTUSB_BULK_OUT_DATA_NORMAL << QueIdx));
-	RTUSBKickBulkOut(pAd);
-
-}
-
-
-/*
-	Must be run in Interrupt context
-	This function handle RT2870 specific TxDesc and cpu index update and kick the packet out.
- */
-int RtmpUSBMgmtKickOut(
-	IN RTMP_ADAPTER 	*pAd,
-	IN UCHAR 			QueIdx,
-	IN PNDIS_PACKET		pPacket,
-	IN PUCHAR			pSrcBufVA,
-	IN UINT 			SrcBufLen)
-{
-	PTXINFO_STRUC	pTxInfo;
-	ULONG			BulkOutSize;
-	UCHAR			padLen;
-	PUCHAR			pDest;
-	ULONG			SwIdx = pAd->MgmtRing.TxCpuIdx;
-	PTX_CONTEXT		pMLMEContext = (PTX_CONTEXT)pAd->MgmtRing.Cell[SwIdx].AllocVa;
-	unsigned long	IrqFlags;
-
-
-	pTxInfo = (PTXINFO_STRUC)(pSrcBufVA);
-
-	// Build our URB for USBD
-	BulkOutSize = SrcBufLen;
-	BulkOutSize = (BulkOutSize + 3) & (~3);
-	RTMPWriteTxInfo(pAd, pTxInfo, (USHORT)(BulkOutSize - TXINFO_SIZE), TRUE, EpToQueue[MGMTPIPEIDX], FALSE,  FALSE);
-
-	BulkOutSize += 4; // Always add 4 extra bytes at every packet.
-
-	// If BulkOutSize is multiple of BulkOutMaxPacketSize, add extra 4 bytes again.
-	if ((BulkOutSize % pAd->BulkOutMaxPacketSize) == 0)
-		BulkOutSize += 4;
-
-	padLen = BulkOutSize - SrcBufLen;
-	ASSERT((padLen <= RTMP_PKT_TAIL_PADDING));
-
-	// Now memzero all extra padding bytes.
-	pDest = (PUCHAR)(pSrcBufVA + SrcBufLen);
-	skb_put(GET_OS_PKT_TYPE(pPacket), padLen);
-	NdisZeroMemory(pDest, padLen);
-
-	RTMP_IRQ_LOCK(&pAd->MLMEBulkOutLock, IrqFlags);
-
-	pAd->MgmtRing.Cell[pAd->MgmtRing.TxCpuIdx].pNdisPacket = pPacket;
-	pMLMEContext->TransferBuffer = (PTX_BUFFER)(GET_OS_PKT_DATAPTR(pPacket));
-
-	// Length in TxInfo should be 8 less than bulkout size.
-	pMLMEContext->BulkOutSize = BulkOutSize;
-	pMLMEContext->InUse = TRUE;
-	pMLMEContext->bWaitingBulkOut = TRUE;
-
-
-	//for debug
-	//hex_dump("RtmpUSBMgmtKickOut", &pMLMEContext->TransferBuffer->field.WirelessPacket[0], (pMLMEContext->BulkOutSize > 16 ? 16 : pMLMEContext->BulkOutSize));
-
-	//pAd->RalinkCounters.KickTxCount++;
-	//pAd->RalinkCounters.OneSecTxDoneCount++;
-
-	//if (pAd->MgmtRing.TxSwFreeIdx == MGMT_RING_SIZE)
-	//	needKickOut = TRUE;
-
-	// Decrease the TxSwFreeIdx and Increase the TX_CTX_IDX
-	pAd->MgmtRing.TxSwFreeIdx--;
-	INC_RING_INDEX(pAd->MgmtRing.TxCpuIdx, MGMT_RING_SIZE);
-
-	RTMP_IRQ_UNLOCK(&pAd->MLMEBulkOutLock, IrqFlags);
-
-	RTUSB_SET_BULK_FLAG(pAd, fRTUSB_BULK_OUT_MLME);
-	//if (needKickOut)
-	RTUSBKickBulkOut(pAd);
-
-	return 0;
-}
-
-
-VOID RtmpUSBNullFrameKickOut(
-	IN RTMP_ADAPTER *pAd,
-	IN UCHAR		QueIdx,
-	IN UCHAR		*pNullFrame,
-	IN UINT32		frameLen)
-{
-	if (pAd->NullContext.InUse == FALSE)
-	{
-		PTX_CONTEXT		pNullContext;
-		PTXINFO_STRUC	pTxInfo;
-		PTXWI_STRUC		pTxWI;
-		PUCHAR			pWirelessPkt;
-
-		pNullContext = &(pAd->NullContext);
-
-		// Set the in use bit
-		pNullContext->InUse = TRUE;
-		pWirelessPkt = (PUCHAR)&pNullContext->TransferBuffer->field.WirelessPacket[0];
-
-		RTMPZeroMemory(&pWirelessPkt[0], 100);
-		pTxInfo = (PTXINFO_STRUC)&pWirelessPkt[0];
-		RTMPWriteTxInfo(pAd, pTxInfo, (USHORT)(sizeof(HEADER_802_11)+TXWI_SIZE), TRUE, EpToQueue[MGMTPIPEIDX], FALSE,  FALSE);
-		pTxInfo->QSEL = FIFO_EDCA;
-		pTxWI = (PTXWI_STRUC)&pWirelessPkt[TXINFO_SIZE];
-		RTMPWriteTxWI(pAd, pTxWI,  FALSE, FALSE, FALSE, FALSE, TRUE, FALSE, 0, BSSID_WCID, (sizeof(HEADER_802_11)),
-			0, 0, (UCHAR)pAd->CommonCfg.MlmeTransmit.field.MCS, IFS_HTTXOP, FALSE, &pAd->CommonCfg.MlmeTransmit);
-		RTMPMoveMemory(&pWirelessPkt[TXWI_SIZE+TXINFO_SIZE], &pAd->NullFrame, sizeof(HEADER_802_11));
-		pAd->NullContext.BulkOutSize =  TXINFO_SIZE + TXWI_SIZE + sizeof(pAd->NullFrame) + 4;
-
-		// Fill out frame length information for global Bulk out arbitor
-		//pNullContext->BulkOutSize = TransferBufferLength;
-		DBGPRINT(RT_DEBUG_TRACE, ("SYNC - send NULL Frame @%d Mbps...\n", RateIdToMbps[pAd->CommonCfg.TxRate]));
-		RTUSB_SET_BULK_FLAG(pAd, fRTUSB_BULK_OUT_DATA_NULL);
-
-		// Kick bulk out
-		RTUSBKickBulkOut(pAd);
-	}
-
-}
-
-/*
-	========================================================================
-
-	Routine	Description:
-		Check Rx descriptor, return NDIS_STATUS_FAILURE if any error dound
-
-	Arguments:
-		pRxD		Pointer	to the Rx descriptor
-
-	Return Value:
-		NDIS_STATUS_SUCCESS		No err
-		NDIS_STATUS_FAILURE		Error
-
-	Note:
-
-	========================================================================
-*/
-NDIS_STATUS	RTMPCheckRxError(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PHEADER_802_11	pHeader,
-	IN	PRXWI_STRUC	pRxWI,
-	IN	PRT28XX_RXD_STRUC	pRxINFO)
-{
-	PCIPHER_KEY pWpaKey;
-	INT	dBm;
-
-	if (pAd->bPromiscuous == TRUE)
-		return(NDIS_STATUS_SUCCESS);
-	if(pRxINFO == NULL)
-		return(NDIS_STATUS_FAILURE);
-
-	// Phy errors & CRC errors
-	if (pRxINFO->Crc)
-	{
-		// Check RSSI for Noise Hist statistic collection.
-		dBm = (INT) (pRxWI->RSSI0) - pAd->BbpRssiToDbmDelta;
-		if (dBm <= -87)
-			pAd->StaCfg.RPIDensity[0] += 1;
-		else if (dBm <= -82)
-			pAd->StaCfg.RPIDensity[1] += 1;
-		else if (dBm <= -77)
-			pAd->StaCfg.RPIDensity[2] += 1;
-		else if (dBm <= -72)
-			pAd->StaCfg.RPIDensity[3] += 1;
-		else if (dBm <= -67)
-			pAd->StaCfg.RPIDensity[4] += 1;
-		else if (dBm <= -62)
-			pAd->StaCfg.RPIDensity[5] += 1;
-		else if (dBm <= -57)
-			pAd->StaCfg.RPIDensity[6] += 1;
-		else if (dBm > -57)
-			pAd->StaCfg.RPIDensity[7] += 1;
-
-		return(NDIS_STATUS_FAILURE);
-	}
-
-	// Add Rx size to channel load counter, we should ignore error counts
-	pAd->StaCfg.CLBusyBytes += (pRxWI->MPDUtotalByteCount+ 14);
-
-	// Drop ToDs promiscous frame, it is opened due to CCX 2 channel load statistics
-	if (pHeader->FC.ToDs)
-	{
-		DBGPRINT_RAW(RT_DEBUG_ERROR, ("Err;FC.ToDs\n"));
-		return NDIS_STATUS_FAILURE;
-	}
-
-	// Paul 04-03 for OFDM Rx length issue
-	if (pRxWI->MPDUtotalByteCount > MAX_AGGREGATION_SIZE)
-	{
-		DBGPRINT_RAW(RT_DEBUG_ERROR, ("received packet too long\n"));
-		return NDIS_STATUS_FAILURE;
-	}
-
-	// Drop not U2M frames, cant's drop here because we will drop beacon in this case
-	// I am kind of doubting the U2M bit operation
-	// if (pRxD->U2M == 0)
-	//	return(NDIS_STATUS_FAILURE);
-
-	// drop decyption fail frame
-	if (pRxINFO->Decrypted && pRxINFO->CipherErr)
-	{
-
-		//
-		// MIC Error
-		//
-		if ((pRxINFO->CipherErr == 2) && pRxINFO->MyBss)
-		{
-			pWpaKey = &pAd->SharedKey[BSS0][pRxWI->KeyIndex];
-			RTMPReportMicError(pAd, pWpaKey);
-			DBGPRINT_RAW(RT_DEBUG_ERROR,("Rx MIC Value error\n"));
-		}
-
-		if (pRxINFO->Decrypted &&
-			(pAd->SharedKey[BSS0][pRxWI->KeyIndex].CipherAlg == CIPHER_AES) &&
-			(pHeader->Sequence == pAd->FragFrame.Sequence))
-		{
-			//
-			// Acceptable since the First FragFrame no CipherErr problem.
-			//
-			return(NDIS_STATUS_SUCCESS);
-		}
-
-		return(NDIS_STATUS_FAILURE);
-	}
-
-	return(NDIS_STATUS_SUCCESS);
-}
-
-VOID RT28xxUsbStaAsicForceWakeup(
-	IN PRTMP_ADAPTER pAd,
-	IN BOOLEAN       bFromTx)
-{
-    AUTO_WAKEUP_STRUC	AutoWakeupCfg;
-
-	AutoWakeupCfg.word = 0;
-	RTMP_IO_WRITE32(pAd, AUTO_WAKEUP_CFG, AutoWakeupCfg.word);
-
-	AsicSendCommandToMcu(pAd, 0x31, 0xff, 0x00, 0x02);
-
-	OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_DOZE);
-}
-
-VOID RT28xxUsbStaAsicSleepThenAutoWakeup(
-	IN PRTMP_ADAPTER pAd,
-	IN USHORT TbttNumToNextWakeUp)
-{
-	AUTO_WAKEUP_STRUC	AutoWakeupCfg;
-
-	// we have decided to SLEEP, so at least do it for a BEACON period.
-	if (TbttNumToNextWakeUp == 0)
-		TbttNumToNextWakeUp = 1;
-
-	AutoWakeupCfg.word = 0;
-	RTMP_IO_WRITE32(pAd, AUTO_WAKEUP_CFG, AutoWakeupCfg.word);
-
-	AutoWakeupCfg.field.NumofSleepingTbtt = TbttNumToNextWakeUp - 1;
-	AutoWakeupCfg.field.EnableAutoWakeup = 1;
-	AutoWakeupCfg.field.AutoLeadTime = 5;
-	RTMP_IO_WRITE32(pAd, AUTO_WAKEUP_CFG, AutoWakeupCfg.word);
-
-	AsicSendCommandToMcu(pAd, 0x30, 0xff, 0xff, 0x02);   // send POWER-SAVE command to MCU. Timeout 40us.
-
-	OPSTATUS_SET_FLAG(pAd, fOP_STATUS_DOZE);
-
-}
-
-VOID RT28xxUsbMlmeRadioOn(
-	IN PRTMP_ADAPTER pAd)
-{
-    DBGPRINT(RT_DEBUG_TRACE,("RT28xxUsbMlmeRadioOn()\n"));
-
-	if (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RADIO_OFF))
-		return;
-
-    	AsicSendCommandToMcu(pAd, 0x31, 0xff, 0x00, 0x02);
-		RTMPusecDelay(10000);
-
-	NICResetFromError(pAd);
-
-	// Enable Tx/Rx
-	RTMPEnableRxTx(pAd);
-
-#ifdef RT3070
-	if (IS_RT3071(pAd))
-	{
-		RT30xxReverseRFSleepModeSetup(pAd);
-	}
-#endif // RT3070 //
-
-	// Clear Radio off flag
-	RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_RADIO_OFF);
-
-	RTUSBBulkReceive(pAd);
-
-	// Set LED
-	RTMPSetLED(pAd, LED_RADIO_ON);
-}
-
-VOID RT28xxUsbMlmeRadioOFF(
-	IN PRTMP_ADAPTER pAd)
-{
-	WPDMA_GLO_CFG_STRUC	GloCfg;
-	UINT32	Value, i;
-
-	DBGPRINT(RT_DEBUG_TRACE,("RT28xxUsbMlmeRadioOFF()\n"));
-
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RADIO_OFF))
-		return;
-
-	// Set LED
-	RTMPSetLED(pAd, LED_RADIO_OFF);
-	// Set Radio off flag
-	RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_RADIO_OFF);
-
-	{
-		// Link down first if any association exists
-		if (INFRA_ON(pAd) || ADHOC_ON(pAd))
-			LinkDown(pAd, FALSE);
-		RTMPusecDelay(10000);
-
-		//==========================================
-		// Clean up old bss table
-		BssTableInit(&pAd->ScanTab);
-	}
-
-	if (pAd->CommonCfg.BBPCurrentBW == BW_40)
-	{
-		// Must using 40MHz.
-		AsicTurnOffRFClk(pAd, pAd->CommonCfg.CentralChannel);
-	}
-	else
-	{
-		// Must using 20MHz.
-		AsicTurnOffRFClk(pAd, pAd->CommonCfg.Channel);
-	}
-
-	// Disable Tx/Rx DMA
-	RTUSBReadMACRegister(pAd, WPDMA_GLO_CFG, &GloCfg.word);	   // disable DMA
-	GloCfg.field.EnableTxDMA = 0;
-	GloCfg.field.EnableRxDMA = 0;
-	RTUSBWriteMACRegister(pAd, WPDMA_GLO_CFG, GloCfg.word);	   // abort all TX rings
-
-	// Waiting for DMA idle
-	i = 0;
-	do
-	{
-		RTMP_IO_READ32(pAd, WPDMA_GLO_CFG, &GloCfg.word);
-		if ((GloCfg.field.TxDMABusy == 0) && (GloCfg.field.RxDMABusy == 0))
-			break;
-
-		RTMPusecDelay(1000);
-	}while (i++ < 100);
-
-	// Disable MAC Tx/Rx
-	RTMP_IO_READ32(pAd, MAC_SYS_CTRL, &Value);
-	Value &= (0xfffffff3);
-	RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, Value);
-
-	AsicSendCommandToMcu(pAd, 0x30, 0xff, 0xff, 0x02);
-}
-
diff --git a/drivers/staging/rt2870/common/cmm_data_usb.c b/drivers/staging/rt2870/common/cmm_data_usb.c
new file mode 100644
index 000000000000..704675fccb7d
--- /dev/null
+++ b/drivers/staging/rt2870/common/cmm_data_usb.c
@@ -0,0 +1 @@
+#include "../../rt2860/common/cmm_data_usb.c"
diff --git a/drivers/staging/rt2870/common/cmm_mac_usb.c b/drivers/staging/rt2870/common/cmm_mac_usb.c
new file mode 100644
index 000000000000..b26af4af890b
--- /dev/null
+++ b/drivers/staging/rt2870/common/cmm_mac_usb.c
@@ -0,0 +1 @@
+#include "../../rt2860/common/cmm_mac_usb.c"
diff --git a/drivers/staging/rt2870/common/cmm_profile.c b/drivers/staging/rt2870/common/cmm_profile.c
new file mode 100644
index 000000000000..9926e45aba3c
--- /dev/null
+++ b/drivers/staging/rt2870/common/cmm_profile.c
@@ -0,0 +1 @@
+#include "../../rt2860/common/cmm_profile.c"
diff --git a/drivers/staging/rt2870/common/cmm_tkip.c b/drivers/staging/rt2870/common/cmm_tkip.c
new file mode 100644
index 000000000000..f73c71bafe86
--- /dev/null
+++ b/drivers/staging/rt2870/common/cmm_tkip.c
@@ -0,0 +1 @@
+#include "../../rt2860/common/cmm_tkip.c"
diff --git a/drivers/staging/rt2870/common/cmm_wep.c b/drivers/staging/rt2870/common/cmm_wep.c
new file mode 100644
index 000000000000..5f681078387f
--- /dev/null
+++ b/drivers/staging/rt2870/common/cmm_wep.c
@@ -0,0 +1 @@
+#include "../../rt2860/common/cmm_wep.c"
diff --git a/drivers/staging/rt2870/common/crypt_hmac.c b/drivers/staging/rt2870/common/crypt_hmac.c
new file mode 100644
index 000000000000..24d84e7724fb
--- /dev/null
+++ b/drivers/staging/rt2870/common/crypt_hmac.c
@@ -0,0 +1 @@
+#include "../../rt2860/common/crypt_hmac.c"
diff --git a/drivers/staging/rt2870/common/crypt_md5.c b/drivers/staging/rt2870/common/crypt_md5.c
new file mode 100644
index 000000000000..457a2caca1e3
--- /dev/null
+++ b/drivers/staging/rt2870/common/crypt_md5.c
@@ -0,0 +1 @@
+#include "../../rt2860/common/crypt_md5.c"
diff --git a/drivers/staging/rt2870/common/crypt_sha2.c b/drivers/staging/rt2870/common/crypt_sha2.c
new file mode 100644
index 000000000000..07ffb300c193
--- /dev/null
+++ b/drivers/staging/rt2870/common/crypt_sha2.c
@@ -0,0 +1 @@
+#include "../../rt2860/common/crypt_sha2.c"
diff --git a/drivers/staging/rt2870/common/ee_efuse.c b/drivers/staging/rt2870/common/ee_efuse.c
new file mode 100644
index 000000000000..0e34e65e5f28
--- /dev/null
+++ b/drivers/staging/rt2870/common/ee_efuse.c
@@ -0,0 +1 @@
+#include "../../rt2860/common/ee_efuse.c"
diff --git a/drivers/staging/rt2870/common/rt_channel.c b/drivers/staging/rt2870/common/rt_channel.c
new file mode 100644
index 000000000000..c8ceb4c177d9
--- /dev/null
+++ b/drivers/staging/rt2870/common/rt_channel.c
@@ -0,0 +1 @@
+#include "../../rt2860/common/rt_channel.c"
diff --git a/drivers/staging/rt2870/common/rt_rf.c b/drivers/staging/rt2870/common/rt_rf.c
new file mode 100644
index 000000000000..b81cff34969b
--- /dev/null
+++ b/drivers/staging/rt2870/common/rt_rf.c
@@ -0,0 +1 @@
+#include "../../rt2860/common/rt_rf.c"
diff --git a/drivers/staging/rt2870/common/rtmp_mcu.c b/drivers/staging/rt2870/common/rtmp_mcu.c
new file mode 100644
index 000000000000..20b7f13d60f8
--- /dev/null
+++ b/drivers/staging/rt2870/common/rtmp_mcu.c
@@ -0,0 +1 @@
+#include "../../rt2860/common/rtmp_mcu.c"
diff --git a/drivers/staging/rt2870/common/rtmp_timer.c b/drivers/staging/rt2870/common/rtmp_timer.c
new file mode 100644
index 000000000000..fd4aedcd5e8b
--- /dev/null
+++ b/drivers/staging/rt2870/common/rtmp_timer.c
@@ -0,0 +1 @@
+#include "../../rt2860/common/rtmp_timer.c"
diff --git a/drivers/staging/rt2870/common/rtusb_bulk.c b/drivers/staging/rt2870/common/rtusb_bulk.c
index a4244b516440..379780c72b3c 100644
--- a/drivers/staging/rt2870/common/rtusb_bulk.c
+++ b/drivers/staging/rt2870/common/rtusb_bulk.c
@@ -1,4 +1,4 @@
- /*
+/*
  *************************************************************************
  * Ralink Tech Inc.
  * 5F., No.36, Taiyuan St., Jhubei City,
@@ -37,133 +37,124 @@
 
 */
 
+#ifdef RTMP_MAC_USB
+
 #include "../rt_config.h"
-// Match total 6 bulkout endpoint to corresponding queue.
-UCHAR	EpToQueue[6]={FIFO_EDCA, FIFO_EDCA, FIFO_EDCA, FIFO_EDCA, FIFO_EDCA, FIFO_MGMT};
-
-//static BOOLEAN SingleBulkOut = FALSE;
-
-void RTUSB_FILL_BULK_URB (struct urb *pUrb,
-	struct usb_device *pUsb_Dev,
-	unsigned int bulkpipe,
-	void *pTransferBuf,
-	int BufSize,
-	usb_complete_t Complete,
-	void *pContext)
+/* Match total 6 bulkout endpoint to corresponding queue. */
+u8 EpToQueue[6] =
+    { FIFO_EDCA, FIFO_EDCA, FIFO_EDCA, FIFO_EDCA, FIFO_EDCA, FIFO_MGMT };
+
+/*static BOOLEAN SingleBulkOut = FALSE; */
+
+void RTUSB_FILL_BULK_URB(struct urb *pUrb,
+			 struct usb_device *pUsb_Dev,
+			 unsigned int bulkpipe,
+			 void *pTransferBuf,
+			 int BufSize, usb_complete_t Complete, void *pContext)
 {
 
-	usb_fill_bulk_urb(pUrb, pUsb_Dev, bulkpipe, pTransferBuf, BufSize, (usb_complete_t)Complete, pContext);
+	usb_fill_bulk_urb(pUrb, pUsb_Dev, bulkpipe, pTransferBuf, BufSize,
+			  (usb_complete_t) Complete, pContext);
 
 }
 
-VOID	RTUSBInitTxDesc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PTX_CONTEXT		pTxContext,
-	IN	UCHAR			BulkOutPipeId,
-	IN	usb_complete_t	Func)
+void RTUSBInitTxDesc(struct rt_rtmp_adapter *pAd,
+		     struct rt_tx_context *pTxContext,
+		     u8 BulkOutPipeId, IN usb_complete_t Func)
 {
-	PURB				pUrb;
-	PUCHAR				pSrc = NULL;
-	POS_COOKIE			pObj = (POS_COOKIE) pAd->OS_Cookie;
+	PURB pUrb;
+	u8 *pSrc = NULL;
+	struct os_cookie *pObj = (struct os_cookie *)pAd->OS_Cookie;
 
 	pUrb = pTxContext->pUrb;
 	ASSERT(pUrb);
 
-	// Store BulkOut PipeId
+	/* Store BulkOut PipeId */
 	pTxContext->BulkOutPipeId = BulkOutPipeId;
 
-	if (pTxContext->bAggregatible)
-	{
+	if (pTxContext->bAggregatible) {
 		pSrc = &pTxContext->TransferBuffer->Aggregation[2];
-	}
-	else
-	{
-		pSrc = (PUCHAR) pTxContext->TransferBuffer->field.WirelessPacket;
+	} else {
+		pSrc =
+		    (u8 *)pTxContext->TransferBuffer->field.WirelessPacket;
 	}
 
-
-	//Initialize a tx bulk urb
+	/*Initialize a tx bulk urb */
 	RTUSB_FILL_BULK_URB(pUrb,
-						pObj->pUsb_Dev,
-						usb_sndbulkpipe(pObj->pUsb_Dev, pAd->BulkOutEpAddr[BulkOutPipeId]),
-						pSrc,
-						pTxContext->BulkOutSize,
-						Func,
-						pTxContext);
+			    pObj->pUsb_Dev,
+			    usb_sndbulkpipe(pObj->pUsb_Dev,
+					    pAd->BulkOutEpAddr[BulkOutPipeId]),
+			    pSrc, pTxContext->BulkOutSize, Func, pTxContext);
 
 	if (pTxContext->bAggregatible)
-		pUrb->transfer_dma	= (pTxContext->data_dma + TX_BUFFER_NORMSIZE + 2);
+		pUrb->transfer_dma =
+		    (pTxContext->data_dma + TX_BUFFER_NORMSIZE + 2);
 	else
-		pUrb->transfer_dma	= pTxContext->data_dma;
+		pUrb->transfer_dma = pTxContext->data_dma;
 
 	pUrb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
 
 }
 
-VOID	RTUSBInitHTTxDesc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PHT_TX_CONTEXT	pTxContext,
-	IN	UCHAR			BulkOutPipeId,
-	IN	ULONG			BulkOutSize,
-	IN	usb_complete_t	Func)
+void RTUSBInitHTTxDesc(struct rt_rtmp_adapter *pAd,
+		       struct rt_ht_tx_context *pTxContext,
+		       u8 BulkOutPipeId,
+		       unsigned long BulkOutSize, IN usb_complete_t Func)
 {
-	PURB				pUrb;
-	PUCHAR				pSrc = NULL;
-	POS_COOKIE			pObj = (POS_COOKIE) pAd->OS_Cookie;
+	PURB pUrb;
+	u8 *pSrc = NULL;
+	struct os_cookie *pObj = (struct os_cookie *)pAd->OS_Cookie;
 
 	pUrb = pTxContext->pUrb;
 	ASSERT(pUrb);
 
-	// Store BulkOut PipeId
+	/* Store BulkOut PipeId */
 	pTxContext->BulkOutPipeId = BulkOutPipeId;
 
-	pSrc = &pTxContext->TransferBuffer->field.WirelessPacket[pTxContext->NextBulkOutPosition];
-
+	pSrc =
+	    &pTxContext->TransferBuffer->field.WirelessPacket[pTxContext->
+							      NextBulkOutPosition];
 
-	//Initialize a tx bulk urb
+	/*Initialize a tx bulk urb */
 	RTUSB_FILL_BULK_URB(pUrb,
-						pObj->pUsb_Dev,
-						usb_sndbulkpipe(pObj->pUsb_Dev, pAd->BulkOutEpAddr[BulkOutPipeId]),
-						pSrc,
-						BulkOutSize,
-						Func,
-						pTxContext);
-
-	pUrb->transfer_dma	= (pTxContext->data_dma + pTxContext->NextBulkOutPosition);
+			    pObj->pUsb_Dev,
+			    usb_sndbulkpipe(pObj->pUsb_Dev,
+					    pAd->BulkOutEpAddr[BulkOutPipeId]),
+			    pSrc, BulkOutSize, Func, pTxContext);
+
+	pUrb->transfer_dma =
+	    (pTxContext->data_dma + pTxContext->NextBulkOutPosition);
 	pUrb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
 
 }
 
-VOID	RTUSBInitRxDesc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PRX_CONTEXT		pRxContext)
+void RTUSBInitRxDesc(struct rt_rtmp_adapter *pAd, struct rt_rx_context *pRxContext)
 {
-	PURB				pUrb;
-	POS_COOKIE			pObj = (POS_COOKIE) pAd->OS_Cookie;
-	ULONG				RX_bulk_size;
-
+	PURB pUrb;
+	struct os_cookie *pObj = (struct os_cookie *)pAd->OS_Cookie;
+	unsigned long RX_bulk_size;
 
 	pUrb = pRxContext->pUrb;
 	ASSERT(pUrb);
 
-	if ( pAd->BulkInMaxPacketSize == 64)
+	if (pAd->BulkInMaxPacketSize == 64)
 		RX_bulk_size = 4096;
 	else
 		RX_bulk_size = MAX_RXBULK_SIZE;
 
-	//Initialize a rx bulk urb
+	/*Initialize a rx bulk urb */
 	RTUSB_FILL_BULK_URB(pUrb,
-						pObj->pUsb_Dev,
-						usb_rcvbulkpipe(pObj->pUsb_Dev, pAd->BulkInEpAddr),
-						&(pRxContext->TransferBuffer[pAd->NextRxBulkInPosition]),
-						RX_bulk_size - (pAd->NextRxBulkInPosition),
-						(usb_complete_t)RTUSBBulkRxComplete,
-						(void *)pRxContext);
-
-	pUrb->transfer_dma	= pRxContext->data_dma + pAd->NextRxBulkInPosition;
+			    pObj->pUsb_Dev,
+			    usb_rcvbulkpipe(pObj->pUsb_Dev, pAd->BulkInEpAddr),
+			    &(pRxContext->
+			      TransferBuffer[pAd->NextRxBulkInPosition]),
+			    RX_bulk_size - (pAd->NextRxBulkInPosition),
+			    (usb_complete_t) RTUSBBulkRxComplete,
+			    (void *)pRxContext);
+
+	pUrb->transfer_dma = pRxContext->data_dma + pAd->NextRxBulkInPosition;
 	pUrb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
 
-
 }
 
 /*
@@ -188,177 +179,215 @@ VOID	RTUSBInitRxDesc(
 		if(1 /*!(in_interrupt() & 0xffff0000)*/)	\
 			RTMP_IRQ_UNLOCK((pLock), IrqFlags);
 
-
-VOID	RTUSBBulkOutDataPacket(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			BulkOutPipeId,
-	IN	UCHAR			Index)
+void RTUSBBulkOutDataPacket(struct rt_rtmp_adapter *pAd,
+			    u8 BulkOutPipeId, u8 Index)
 {
 
-	PHT_TX_CONTEXT	pHTTXContext;
-	PURB			pUrb;
-	int				ret = 0;
-	PTXINFO_STRUC	pTxInfo, pLastTxInfo = NULL;
-	PTXWI_STRUC             pTxWI;
-	ULONG			TmpBulkEndPos, ThisBulkSize;
-	unsigned long	IrqFlags = 0, IrqFlags2 = 0;
-	PUCHAR			pWirelessPkt, pAppendant;
-	BOOLEAN			bTxQLastRound = FALSE;
-	UCHAR			allzero[4]= {0x0,0x0,0x0,0x0};
+	struct rt_ht_tx_context *pHTTXContext;
+	PURB pUrb;
+	int ret = 0;
+	struct rt_txinfo *pTxInfo, *pLastTxInfo = NULL;
+	struct rt_txwi * pTxWI;
+	unsigned long TmpBulkEndPos, ThisBulkSize;
+	unsigned long IrqFlags = 0, IrqFlags2 = 0;
+	u8 *pWirelessPkt, *pAppendant;
+	BOOLEAN bTxQLastRound = FALSE;
+	u8 allzero[4] = { 0x0, 0x0, 0x0, 0x0 };
 
 	BULK_OUT_LOCK(&pAd->BulkOutLock[BulkOutPipeId], IrqFlags);
-	if ((pAd->BulkOutPending[BulkOutPipeId] == TRUE) || RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NEED_STOP_TX))
-	{
+	if ((pAd->BulkOutPending[BulkOutPipeId] == TRUE)
+	    || RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NEED_STOP_TX)) {
 		BULK_OUT_UNLOCK(&pAd->BulkOutLock[BulkOutPipeId], IrqFlags);
 		return;
 	}
 	pAd->BulkOutPending[BulkOutPipeId] = TRUE;
 
 	if (!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED)
-		)
-	{
+	    ) {
 		pAd->BulkOutPending[BulkOutPipeId] = FALSE;
 		BULK_OUT_UNLOCK(&pAd->BulkOutLock[BulkOutPipeId], IrqFlags);
 		return;
 	}
 	BULK_OUT_UNLOCK(&pAd->BulkOutLock[BulkOutPipeId], IrqFlags);
 
-
 	pHTTXContext = &(pAd->TxContext[BulkOutPipeId]);
 
 	BULK_OUT_LOCK(&pAd->TxContextQueueLock[BulkOutPipeId], IrqFlags2);
-	if ((pHTTXContext->ENextBulkOutPosition == pHTTXContext->CurWritePosition)
-		|| ((pHTTXContext->ENextBulkOutPosition-8) == pHTTXContext->CurWritePosition))
-	{
-		BULK_OUT_UNLOCK(&pAd->TxContextQueueLock[BulkOutPipeId], IrqFlags2);
+	if ((pHTTXContext->ENextBulkOutPosition ==
+	     pHTTXContext->CurWritePosition)
+	    || ((pHTTXContext->ENextBulkOutPosition - 8) ==
+		pHTTXContext->CurWritePosition)) {
+		BULK_OUT_UNLOCK(&pAd->TxContextQueueLock[BulkOutPipeId],
+				IrqFlags2);
 
 		BULK_OUT_LOCK(&pAd->BulkOutLock[BulkOutPipeId], IrqFlags);
 		pAd->BulkOutPending[BulkOutPipeId] = FALSE;
 
-		// Clear Data flag
-		RTUSB_CLEAR_BULK_FLAG(pAd, (fRTUSB_BULK_OUT_DATA_FRAG << BulkOutPipeId));
-		RTUSB_CLEAR_BULK_FLAG(pAd, (fRTUSB_BULK_OUT_DATA_NORMAL << BulkOutPipeId));
+		/* Clear Data flag */
+		RTUSB_CLEAR_BULK_FLAG(pAd,
+				      (fRTUSB_BULK_OUT_DATA_FRAG <<
+				       BulkOutPipeId));
+		RTUSB_CLEAR_BULK_FLAG(pAd,
+				      (fRTUSB_BULK_OUT_DATA_NORMAL <<
+				       BulkOutPipeId));
 
 		BULK_OUT_UNLOCK(&pAd->BulkOutLock[BulkOutPipeId], IrqFlags);
 		return;
 	}
-
-	// Clear Data flag
-	RTUSB_CLEAR_BULK_FLAG(pAd, (fRTUSB_BULK_OUT_DATA_FRAG << BulkOutPipeId));
-	RTUSB_CLEAR_BULK_FLAG(pAd, (fRTUSB_BULK_OUT_DATA_NORMAL << BulkOutPipeId));
-
-	//DBGPRINT(RT_DEBUG_TRACE,("BulkOut-B:I=0x%lx, CWPos=%ld, CWRPos=%ld, NBPos=%ld, ENBPos=%ld, bCopy=%d!\n", in_interrupt(),
-	//							pHTTXContext->CurWritePosition, pHTTXContext->CurWriteRealPos, pHTTXContext->NextBulkOutPosition,
-	//							pHTTXContext->ENextBulkOutPosition, pHTTXContext->bCopySavePad));
+	/* Clear Data flag */
+	RTUSB_CLEAR_BULK_FLAG(pAd,
+			      (fRTUSB_BULK_OUT_DATA_FRAG << BulkOutPipeId));
+	RTUSB_CLEAR_BULK_FLAG(pAd,
+			      (fRTUSB_BULK_OUT_DATA_NORMAL << BulkOutPipeId));
+
+	/*DBGPRINT(RT_DEBUG_TRACE,("BulkOut-B:I=0x%lx, CWPos=%ld, CWRPos=%ld, NBPos=%ld, ENBPos=%ld, bCopy=%d!\n", in_interrupt(), */
+	/*                                                      pHTTXContext->CurWritePosition, pHTTXContext->CurWriteRealPos, pHTTXContext->NextBulkOutPosition, */
+	/*                                                      pHTTXContext->ENextBulkOutPosition, pHTTXContext->bCopySavePad)); */
 	pHTTXContext->NextBulkOutPosition = pHTTXContext->ENextBulkOutPosition;
 	ThisBulkSize = 0;
 	TmpBulkEndPos = pHTTXContext->NextBulkOutPosition;
 	pWirelessPkt = &pHTTXContext->TransferBuffer->field.WirelessPacket[0];
 
-	if ((pHTTXContext->bCopySavePad == TRUE))
-	{
-		if (RTMPEqualMemory(pHTTXContext->SavedPad, allzero,4))
-		{
-			DBGPRINT_RAW(RT_DEBUG_ERROR,("e1, allzero : %x  %x  %x  %x  %x  %x  %x  %x \n",
-				pHTTXContext->SavedPad[0], pHTTXContext->SavedPad[1], pHTTXContext->SavedPad[2],pHTTXContext->SavedPad[3]
-				,pHTTXContext->SavedPad[4], pHTTXContext->SavedPad[5], pHTTXContext->SavedPad[6],pHTTXContext->SavedPad[7]));
+	if ((pHTTXContext->bCopySavePad == TRUE)) {
+		if (RTMPEqualMemory(pHTTXContext->SavedPad, allzero, 4)) {
+			DBGPRINT_RAW(RT_DEBUG_ERROR,
+				     ("e1, allzero : %x  %x  %x  %x  %x  %x  %x  %x \n",
+				      pHTTXContext->SavedPad[0],
+				      pHTTXContext->SavedPad[1],
+				      pHTTXContext->SavedPad[2],
+				      pHTTXContext->SavedPad[3]
+				      , pHTTXContext->SavedPad[4],
+				      pHTTXContext->SavedPad[5],
+				      pHTTXContext->SavedPad[6],
+				      pHTTXContext->SavedPad[7]));
 		}
-		NdisMoveMemory(&pWirelessPkt[TmpBulkEndPos], pHTTXContext->SavedPad, 8);
+		NdisMoveMemory(&pWirelessPkt[TmpBulkEndPos],
+			       pHTTXContext->SavedPad, 8);
 		pHTTXContext->bCopySavePad = FALSE;
 		if (pAd->bForcePrintTX == TRUE)
-			DBGPRINT(RT_DEBUG_TRACE,("RTUSBBulkOutDataPacket --> COPY PAD. CurWrite = %ld, NextBulk = %ld.   ENextBulk = %ld.\n",   pHTTXContext->CurWritePosition, pHTTXContext->NextBulkOutPosition, pHTTXContext->ENextBulkOutPosition));
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("RTUSBBulkOutDataPacket --> COPY PAD. CurWrite = %ld, NextBulk = %ld.   ENextBulk = %ld.\n",
+				  pHTTXContext->CurWritePosition,
+				  pHTTXContext->NextBulkOutPosition,
+				  pHTTXContext->ENextBulkOutPosition));
 	}
 
-	do
-	{
-		pTxInfo = (PTXINFO_STRUC)&pWirelessPkt[TmpBulkEndPos];
-		pTxWI = (PTXWI_STRUC)&pWirelessPkt[TmpBulkEndPos + TXINFO_SIZE];
+	do {
+		pTxInfo = (struct rt_txinfo *)& pWirelessPkt[TmpBulkEndPos];
+		pTxWI =
+		    (struct rt_txwi *) & pWirelessPkt[TmpBulkEndPos + TXINFO_SIZE];
 
 		if (pAd->bForcePrintTX == TRUE)
-			DBGPRINT(RT_DEBUG_TRACE, ("RTUSBBulkOutDataPacket AMPDU = %d.\n",   pTxWI->AMPDU));
-
-		// add by Iverson, limit BulkOut size to 4k to pass WMM b mode 2T1R test items
-		//if ((ThisBulkSize != 0)  && (pTxWI->AMPDU == 0))
-		if ((ThisBulkSize != 0) && (pTxWI->PHYMODE == MODE_CCK))
-		{
-			if (((ThisBulkSize&0xffff8000) != 0) || ((ThisBulkSize&0x1000) == 0x1000))
-			{
-				// Limit BulkOut size to about 4k bytes.
-				pHTTXContext->ENextBulkOutPosition = TmpBulkEndPos;
+			DBGPRINT(RT_DEBUG_TRACE,
+				 ("RTUSBBulkOutDataPacket AMPDU = %d.\n",
+				  pTxWI->AMPDU));
+
+		/* add by Iverson, limit BulkOut size to 4k to pass WMM b mode 2T1R test items */
+		/*if ((ThisBulkSize != 0)  && (pTxWI->AMPDU == 0)) */
+		if ((ThisBulkSize != 0) && (pTxWI->PHYMODE == MODE_CCK)) {
+			if (((ThisBulkSize & 0xffff8000) != 0)
+			    || ((ThisBulkSize & 0x1000) == 0x1000)) {
+				/* Limit BulkOut size to about 4k bytes. */
+				pHTTXContext->ENextBulkOutPosition =
+				    TmpBulkEndPos;
 				break;
-			}
-			else if (((pAd->BulkOutMaxPacketSize < 512) && ((ThisBulkSize&0xfffff800) != 0) ) /*|| ( (ThisBulkSize != 0)  && (pTxWI->AMPDU == 0))*/)
-			{
-				// For USB 1.1 or peer which didn't support AMPDU, limit the BulkOut size.
-				// For performence in b/g mode, now just check for USB 1.1 and didn't care about the APMDU or not! 2008/06/04.
-				pHTTXContext->ENextBulkOutPosition = TmpBulkEndPos;
+			} else
+			    if (((pAd->BulkOutMaxPacketSize < 512)
+				 && ((ThisBulkSize & 0xfffff800) !=
+				     0))
+				/*|| ( (ThisBulkSize != 0)  && (pTxWI->AMPDU == 0)) */
+				) {
+				/* For USB 1.1 or peer which didn't support AMPDU, limit the BulkOut size. */
+				/* For performence in b/g mode, now just check for USB 1.1 and didn't care about the APMDU or not! 2008/06/04. */
+				pHTTXContext->ENextBulkOutPosition =
+				    TmpBulkEndPos;
 				break;
 			}
 		}
-		// end Iverson
-		else
-		{
-			if (((ThisBulkSize&0xffff8000) != 0) || ((ThisBulkSize&0x6000) == 0x6000))
-			{	// Limit BulkOut size to about 24k bytes.
-				pHTTXContext->ENextBulkOutPosition = TmpBulkEndPos;
+		/* end Iverson */
+		else {
+			if (((ThisBulkSize & 0xffff8000) != 0) || ((ThisBulkSize & 0x6000) == 0x6000)) {	/* Limit BulkOut size to about 24k bytes. */
+				pHTTXContext->ENextBulkOutPosition =
+				    TmpBulkEndPos;
 				break;
-			}
-			else if (((pAd->BulkOutMaxPacketSize < 512) && ((ThisBulkSize&0xfffff800) != 0) ) /*|| ( (ThisBulkSize != 0)  && (pTxWI->AMPDU == 0))*/)
-			{	// For USB 1.1 or peer which didn't support AMPDU, limit the BulkOut size.
-				// For performence in b/g mode, now just check for USB 1.1 and didn't care about the APMDU or not! 2008/06/04.
-				pHTTXContext->ENextBulkOutPosition = TmpBulkEndPos;
+			} else if (((pAd->BulkOutMaxPacketSize < 512) && ((ThisBulkSize & 0xfffff800) != 0)) /*|| ( (ThisBulkSize != 0)  && (pTxWI->AMPDU == 0)) */ ) {	/* For USB 1.1 or peer which didn't support AMPDU, limit the BulkOut size. */
+				/* For performence in b/g mode, now just check for USB 1.1 and didn't care about the APMDU or not! 2008/06/04. */
+				pHTTXContext->ENextBulkOutPosition =
+				    TmpBulkEndPos;
 				break;
 			}
 		}
 
-		if (TmpBulkEndPos == pHTTXContext->CurWritePosition)
-		{
+		if (TmpBulkEndPos == pHTTXContext->CurWritePosition) {
 			pHTTXContext->ENextBulkOutPosition = TmpBulkEndPos;
 			break;
 		}
 
-		//PS packets use HCCA queue when dequeue from PS unicast queue (WiFi WPA2 MA9_DT1 for Marvell B STA)
-		if (pTxInfo->QSEL != FIFO_EDCA)
-		{
-			printk("%s(): ====> pTxInfo->QueueSel(%d)!= FIFO_EDCA!!!!\n", __func__, pTxInfo->QSEL);
-			printk("\tCWPos=%ld, NBPos=%ld, ENBPos=%ld, bCopy=%d!\n", pHTTXContext->CurWritePosition, pHTTXContext->NextBulkOutPosition, pHTTXContext->ENextBulkOutPosition, pHTTXContext->bCopySavePad);
-			hex_dump("Wrong QSel Pkt:", (PUCHAR)&pWirelessPkt[TmpBulkEndPos], (pHTTXContext->CurWritePosition - pHTTXContext->NextBulkOutPosition));
+		if (pTxInfo->QSEL != FIFO_EDCA) {
+			DBGPRINT(RT_DEBUG_ERROR,
+				 ("%s(): ====> pTxInfo->QueueSel(%d)!= FIFO_EDCA!!!!\n",
+				  __FUNCTION__, pTxInfo->QSEL));
+			DBGPRINT(RT_DEBUG_ERROR,
+				 ("\tCWPos=%ld, NBPos=%ld, ENBPos=%ld, bCopy=%d!\n",
+				  pHTTXContext->CurWritePosition,
+				  pHTTXContext->NextBulkOutPosition,
+				  pHTTXContext->ENextBulkOutPosition,
+				  pHTTXContext->bCopySavePad));
+			hex_dump("Wrong QSel Pkt:",
+				 (u8 *)& pWirelessPkt[TmpBulkEndPos],
+				 (pHTTXContext->CurWritePosition -
+				  pHTTXContext->NextBulkOutPosition));
 		}
 
-		if (pTxInfo->USBDMATxPktLen <= 8)
-		{
-			BULK_OUT_UNLOCK(&pAd->TxContextQueueLock[BulkOutPipeId], IrqFlags2);
-			DBGPRINT(RT_DEBUG_ERROR /*RT_DEBUG_TRACE*/,("e2, USBDMATxPktLen==0, Size=%ld, bCSPad=%d, CWPos=%ld, NBPos=%ld, CWRPos=%ld!\n",
-					pHTTXContext->BulkOutSize, pHTTXContext->bCopySavePad, pHTTXContext->CurWritePosition, pHTTXContext->NextBulkOutPosition, pHTTXContext->CurWriteRealPos));
+		if (pTxInfo->USBDMATxPktLen <= 8) {
+			BULK_OUT_UNLOCK(&pAd->TxContextQueueLock[BulkOutPipeId],
+					IrqFlags2);
+			DBGPRINT(RT_DEBUG_ERROR /*RT_DEBUG_TRACE */ ,
+				 ("e2, USBDMATxPktLen==0, Size=%ld, bCSPad=%d, CWPos=%ld, NBPos=%ld, CWRPos=%ld!\n",
+				  pHTTXContext->BulkOutSize,
+				  pHTTXContext->bCopySavePad,
+				  pHTTXContext->CurWritePosition,
+				  pHTTXContext->NextBulkOutPosition,
+				  pHTTXContext->CurWriteRealPos));
 			{
-				DBGPRINT_RAW(RT_DEBUG_ERROR /*RT_DEBUG_TRACE*/,("%x  %x  %x  %x  %x  %x  %x  %x \n",
-					pHTTXContext->SavedPad[0], pHTTXContext->SavedPad[1], pHTTXContext->SavedPad[2],pHTTXContext->SavedPad[3]
-					,pHTTXContext->SavedPad[4], pHTTXContext->SavedPad[5], pHTTXContext->SavedPad[6],pHTTXContext->SavedPad[7]));
+				DBGPRINT_RAW(RT_DEBUG_ERROR /*RT_DEBUG_TRACE */
+					     ,
+					     ("%x  %x  %x  %x  %x  %x  %x  %x \n",
+					      pHTTXContext->SavedPad[0],
+					      pHTTXContext->SavedPad[1],
+					      pHTTXContext->SavedPad[2],
+					      pHTTXContext->SavedPad[3]
+					      , pHTTXContext->SavedPad[4],
+					      pHTTXContext->SavedPad[5],
+					      pHTTXContext->SavedPad[6],
+					      pHTTXContext->SavedPad[7]));
 			}
 			pAd->bForcePrintTX = TRUE;
-			BULK_OUT_LOCK(&pAd->BulkOutLock[BulkOutPipeId], IrqFlags);
+			BULK_OUT_LOCK(&pAd->BulkOutLock[BulkOutPipeId],
+				      IrqFlags);
 			pAd->BulkOutPending[BulkOutPipeId] = FALSE;
-			BULK_OUT_UNLOCK(&pAd->BulkOutLock[BulkOutPipeId], IrqFlags);
-			//DBGPRINT(RT_DEBUG_LOUD,("Out:pTxInfo->USBDMATxPktLen=%d!\n", pTxInfo->USBDMATxPktLen));
+			BULK_OUT_UNLOCK(&pAd->BulkOutLock[BulkOutPipeId],
+					IrqFlags);
+			/*DBGPRINT(RT_DEBUG_LOUD,("Out:pTxInfo->USBDMATxPktLen=%d!\n", pTxInfo->USBDMATxPktLen)); */
 			return;
 		}
-
-			// Increase Total transmit byte counter
-		pAd->RalinkCounters.OneSecTransmittedByteCount +=  pTxWI->MPDUtotalByteCount;
-		pAd->RalinkCounters.TransmittedByteCount +=  pTxWI->MPDUtotalByteCount;
+		/* Increase Total transmit byte counter */
+		pAd->RalinkCounters.OneSecTransmittedByteCount +=
+		    pTxWI->MPDUtotalByteCount;
+		pAd->RalinkCounters.TransmittedByteCount +=
+		    pTxWI->MPDUtotalByteCount;
 
 		pLastTxInfo = pTxInfo;
 
-		// Make sure we use EDCA QUEUE.
-		pTxInfo->QSEL = FIFO_EDCA;  //PS packets use HCCA queue when dequeue from PS unicast queue (WiFi WPA2 MA9_DT1 for Marvell B STA)
-		ThisBulkSize += (pTxInfo->USBDMATxPktLen+4);
-		TmpBulkEndPos += (pTxInfo->USBDMATxPktLen+4);
+		/* Make sure we use EDCA QUEUE. */
+		pTxInfo->QSEL = FIFO_EDCA;
+		ThisBulkSize += (pTxInfo->USBDMATxPktLen + 4);
+		TmpBulkEndPos += (pTxInfo->USBDMATxPktLen + 4);
 
 		if (TmpBulkEndPos != pHTTXContext->CurWritePosition)
 			pTxInfo->USBDMANextVLD = 1;
 
-		if (pTxInfo->SwUseLastRound == 1)
-		{
+		if (pTxInfo->SwUseLastRound == 1) {
 			if (pHTTXContext->CurWritePosition == 8)
 				pTxInfo->USBDMANextVLD = 0;
 			pTxInfo->SwUseLastRound = 0;
@@ -368,68 +397,88 @@ VOID	RTUSBBulkOutDataPacket(
 
 			break;
 		}
-	}while (TRUE);
 
-	// adjust the pTxInfo->USBDMANextVLD value of last pTxInfo.
-	if (pLastTxInfo)
-	{
+	} while (TRUE);
+
+	/* adjust the pTxInfo->USBDMANextVLD value of last pTxInfo. */
+	if (pLastTxInfo) {
 		pLastTxInfo->USBDMANextVLD = 0;
 	}
 
 	/*
-		We need to copy SavedPad when following condition matched!
-			1. Not the last round of the TxQueue and
-			2. any match of following cases:
-				(1). The End Position of this bulk out is reach to the Currenct Write position and
-						the TxInfo and related header already write to the CurWritePosition.
-			   		=>(ENextBulkOutPosition == CurWritePosition) && (CurWriteRealPos > CurWritePosition)
-
-				(2). The EndPosition of the bulk out is not reach to the Current Write Position.
-					=>(ENextBulkOutPosition != CurWritePosition)
-	*/
+	   We need to copy SavedPad when following condition matched!
+	   1. Not the last round of the TxQueue and
+	   2. any match of following cases:
+	   (1). The End Position of this bulk out is reach to the Currenct Write position and
+	   the TxInfo and related header already write to the CurWritePosition.
+	   =>(ENextBulkOutPosition == CurWritePosition) && (CurWriteRealPos > CurWritePosition)
+
+	   (2). The EndPosition of the bulk out is not reach to the Current Write Position.
+	   =>(ENextBulkOutPosition != CurWritePosition)
+	 */
 	if ((bTxQLastRound == FALSE) &&
-		 (((pHTTXContext->ENextBulkOutPosition == pHTTXContext->CurWritePosition) && (pHTTXContext->CurWriteRealPos > pHTTXContext->CurWritePosition)) ||
-		  (pHTTXContext->ENextBulkOutPosition != pHTTXContext->CurWritePosition))
-		)
-	{
-		NdisMoveMemory(pHTTXContext->SavedPad, &pWirelessPkt[pHTTXContext->ENextBulkOutPosition], 8);
+	    (((pHTTXContext->ENextBulkOutPosition ==
+	       pHTTXContext->CurWritePosition)
+	      && (pHTTXContext->CurWriteRealPos >
+		  pHTTXContext->CurWritePosition))
+	     || (pHTTXContext->ENextBulkOutPosition !=
+		 pHTTXContext->CurWritePosition))
+	    ) {
+		NdisMoveMemory(pHTTXContext->SavedPad,
+			       &pWirelessPkt[pHTTXContext->
+					     ENextBulkOutPosition], 8);
 		pHTTXContext->bCopySavePad = TRUE;
-		if (RTMPEqualMemory(pHTTXContext->SavedPad, allzero,4))
-		{
-			PUCHAR	pBuf = &pHTTXContext->SavedPad[0];
-			DBGPRINT_RAW(RT_DEBUG_ERROR,("WARNING-Zero-3:%02x%02x%02x%02x%02x%02x%02x%02x,CWPos=%ld, CWRPos=%ld, bCW=%d, NBPos=%ld, TBPos=%ld, TBSize=%ld\n",
-				pBuf[0], pBuf[1], pBuf[2],pBuf[3],pBuf[4], pBuf[5], pBuf[6],pBuf[7], pHTTXContext->CurWritePosition, pHTTXContext->CurWriteRealPos,
-				pHTTXContext->bCurWriting, pHTTXContext->NextBulkOutPosition, TmpBulkEndPos, ThisBulkSize));
+		if (RTMPEqualMemory(pHTTXContext->SavedPad, allzero, 4)) {
+			u8 *pBuf = &pHTTXContext->SavedPad[0];
+			DBGPRINT_RAW(RT_DEBUG_ERROR,
+				     ("WARNING-Zero-3:%02x%02x%02x%02x%02x%02x%02x%02x,CWPos=%ld, CWRPos=%ld, bCW=%d, NBPos=%ld, TBPos=%ld, TBSize=%ld\n",
+				      pBuf[0], pBuf[1], pBuf[2], pBuf[3],
+				      pBuf[4], pBuf[5], pBuf[6], pBuf[7],
+				      pHTTXContext->CurWritePosition,
+				      pHTTXContext->CurWriteRealPos,
+				      pHTTXContext->bCurWriting,
+				      pHTTXContext->NextBulkOutPosition,
+				      TmpBulkEndPos, ThisBulkSize));
 
 			pBuf = &pWirelessPkt[pHTTXContext->CurWritePosition];
-			DBGPRINT_RAW(RT_DEBUG_ERROR,("\tCWPos=%02x%02x%02x%02x%02x%02x%02x%02x\n", pBuf[0], pBuf[1], pBuf[2],pBuf[3],pBuf[4], pBuf[5], pBuf[6],pBuf[7]));
+			DBGPRINT_RAW(RT_DEBUG_ERROR,
+				     ("\tCWPos=%02x%02x%02x%02x%02x%02x%02x%02x\n",
+				      pBuf[0], pBuf[1], pBuf[2], pBuf[3],
+				      pBuf[4], pBuf[5], pBuf[6], pBuf[7]));
 		}
-		//DBGPRINT(RT_DEBUG_LOUD,("ENPos==CWPos=%ld, CWRPos=%ld, bCSPad=%d!\n", pHTTXContext->CurWritePosition, pHTTXContext->CurWriteRealPos, pHTTXContext->bCopySavePad));
+		/*DBGPRINT(RT_DEBUG_LOUD,("ENPos==CWPos=%ld, CWRPos=%ld, bCSPad=%d!\n", pHTTXContext->CurWritePosition, pHTTXContext->CurWriteRealPos, pHTTXContext->bCopySavePad)); */
 	}
 
 	if (pAd->bForcePrintTX == TRUE)
-		DBGPRINT(RT_DEBUG_TRACE,("BulkOut-A:Size=%ld, CWPos=%ld, NBPos=%ld, ENBPos=%ld, bCopy=%d!\n", ThisBulkSize, pHTTXContext->CurWritePosition, pHTTXContext->NextBulkOutPosition, pHTTXContext->ENextBulkOutPosition, pHTTXContext->bCopySavePad));
-	//DBGPRINT(RT_DEBUG_LOUD,("BulkOut-A:Size=%ld, CWPos=%ld, CWRPos=%ld, NBPos=%ld, ENBPos=%ld, bCopy=%d, bLRound=%d!\n", ThisBulkSize, pHTTXContext->CurWritePosition, pHTTXContext->CurWriteRealPos, pHTTXContext->NextBulkOutPosition, pHTTXContext->ENextBulkOutPosition, pHTTXContext->bCopySavePad, bTxQLastRound));
-
-		// USB DMA engine requires to pad extra 4 bytes. This pad doesn't count into real bulkoutsize.
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("BulkOut-A:Size=%ld, CWPos=%ld, NBPos=%ld, ENBPos=%ld, bCopy=%d!\n",
+			  ThisBulkSize, pHTTXContext->CurWritePosition,
+			  pHTTXContext->NextBulkOutPosition,
+			  pHTTXContext->ENextBulkOutPosition,
+			  pHTTXContext->bCopySavePad));
+	/*DBGPRINT(RT_DEBUG_LOUD,("BulkOut-A:Size=%ld, CWPos=%ld, CWRPos=%ld, NBPos=%ld, ENBPos=%ld, bCopy=%d, bLRound=%d!\n", ThisBulkSize, pHTTXContext->CurWritePosition, pHTTXContext->CurWriteRealPos, pHTTXContext->NextBulkOutPosition, pHTTXContext->ENextBulkOutPosition, pHTTXContext->bCopySavePad, bTxQLastRound)); */
+
+	/* USB DMA engine requires to pad extra 4 bytes. This pad doesn't count into real bulkoutsize. */
 	pAppendant = &pWirelessPkt[TmpBulkEndPos];
 	NdisZeroMemory(pAppendant, 8);
+	ThisBulkSize += 4;
+	pHTTXContext->LastOne = TRUE;
+	if ((ThisBulkSize % pAd->BulkOutMaxPacketSize) == 0)
 		ThisBulkSize += 4;
-		pHTTXContext->LastOne = TRUE;
-		if ((ThisBulkSize % pAd->BulkOutMaxPacketSize) == 0)
-			ThisBulkSize += 4;
 	pHTTXContext->BulkOutSize = ThisBulkSize;
 
 	pAd->watchDogTxPendingCnt[BulkOutPipeId] = 1;
 	BULK_OUT_UNLOCK(&pAd->TxContextQueueLock[BulkOutPipeId], IrqFlags2);
 
-	// Init Tx context descriptor
-	RTUSBInitHTTxDesc(pAd, pHTTXContext, BulkOutPipeId, ThisBulkSize, (usb_complete_t)RTUSBBulkOutDataPacketComplete);
+	/* Init Tx context descriptor */
+	RTUSBInitHTTxDesc(pAd, pHTTXContext, BulkOutPipeId, ThisBulkSize,
+			  (usb_complete_t) RTUSBBulkOutDataPacketComplete);
 
 	pUrb = pHTTXContext->pUrb;
-	if((ret = RTUSB_SUBMIT_URB(pUrb))!=0)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("RTUSBBulkOutDataPacket: Submit Tx URB failed %d\n", ret));
+	if ((ret = RTUSB_SUBMIT_URB(pUrb)) != 0) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("RTUSBBulkOutDataPacket: Submit Tx URB failed %d\n",
+			  ret));
 
 		BULK_OUT_LOCK(&pAd->BulkOutLock[BulkOutPipeId], IrqFlags);
 		pAd->BulkOutPending[BulkOutPipeId] = FALSE;
@@ -446,48 +495,41 @@ VOID	RTUSBBulkOutDataPacket(
 
 }
 
-
-VOID RTUSBBulkOutDataPacketComplete(purbb_t pUrb, struct pt_regs *pt_regs)
+void RTUSBBulkOutDataPacketComplete(struct urb *pUrb, struct pt_regs * pt_regs)
 {
-	PHT_TX_CONTEXT	pHTTXContext;
-	PRTMP_ADAPTER	pAd;
-	POS_COOKIE 		pObj;
-	UCHAR			BulkOutPipeId;
+	struct rt_ht_tx_context *pHTTXContext;
+	struct rt_rtmp_adapter *pAd;
+	struct os_cookie *pObj;
+	u8 BulkOutPipeId;
 
+	pHTTXContext = (struct rt_ht_tx_context *)pUrb->context;
+	pAd = pHTTXContext->pAd;
+	pObj = (struct os_cookie *)pAd->OS_Cookie;
 
-	pHTTXContext	= (PHT_TX_CONTEXT)pUrb->context;
-	pAd 			= pHTTXContext->pAd;
-	pObj 			= (POS_COOKIE) pAd->OS_Cookie;
-
-	// Store BulkOut PipeId
-	BulkOutPipeId	= pHTTXContext->BulkOutPipeId;
+	/* Store BulkOut PipeId */
+	BulkOutPipeId = pHTTXContext->BulkOutPipeId;
 	pAd->BulkOutDataOneSecCount++;
 
-	switch (BulkOutPipeId)
-	{
-		case 0:
-				pObj->ac0_dma_done_task.data = (unsigned long)pUrb;
-				tasklet_hi_schedule(&pObj->ac0_dma_done_task);
-				break;
-		case 1:
-				pObj->ac1_dma_done_task.data = (unsigned long)pUrb;
-				tasklet_hi_schedule(&pObj->ac1_dma_done_task);
-				break;
-		case 2:
-				pObj->ac2_dma_done_task.data = (unsigned long)pUrb;
-				tasklet_hi_schedule(&pObj->ac2_dma_done_task);
-				break;
-		case 3:
-				pObj->ac3_dma_done_task.data = (unsigned long)pUrb;
-				tasklet_hi_schedule(&pObj->ac3_dma_done_task);
-				break;
-		case 4:
-				pObj->hcca_dma_done_task.data = (unsigned long)pUrb;
-				tasklet_hi_schedule(&pObj->hcca_dma_done_task);
-				break;
+	switch (BulkOutPipeId) {
+	case 0:
+		pObj->ac0_dma_done_task.data = (unsigned long)pUrb;
+		tasklet_hi_schedule(&pObj->ac0_dma_done_task);
+		break;
+	case 1:
+		pObj->ac1_dma_done_task.data = (unsigned long)pUrb;
+		tasklet_hi_schedule(&pObj->ac1_dma_done_task);
+		break;
+	case 2:
+		pObj->ac2_dma_done_task.data = (unsigned long)pUrb;
+		tasklet_hi_schedule(&pObj->ac2_dma_done_task);
+		break;
+	case 3:
+		pObj->ac3_dma_done_task.data = (unsigned long)pUrb;
+		tasklet_hi_schedule(&pObj->ac3_dma_done_task);
+		break;
 	}
-}
 
+}
 
 /*
 	========================================================================
@@ -502,17 +544,16 @@ VOID RTUSBBulkOutDataPacketComplete(purbb_t pUrb, struct pt_regs *pt_regs)
 
 	========================================================================
 */
-VOID	RTUSBBulkOutNullFrame(
-	IN	PRTMP_ADAPTER	pAd)
+void RTUSBBulkOutNullFrame(struct rt_rtmp_adapter *pAd)
 {
-	PTX_CONTEXT		pNullContext = &(pAd->NullContext);
-	PURB			pUrb;
-	int				ret = 0;
-	unsigned long	IrqFlags;
+	struct rt_tx_context *pNullContext = &(pAd->NullContext);
+	PURB pUrb;
+	int ret = 0;
+	unsigned long IrqFlags;
 
 	RTMP_IRQ_LOCK(&pAd->BulkOutLock[0], IrqFlags);
-	if ((pAd->BulkOutPending[0] == TRUE) || RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NEED_STOP_TX))
-	{
+	if ((pAd->BulkOutPending[0] == TRUE)
+	    || RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NEED_STOP_TX)) {
 		RTMP_IRQ_UNLOCK(&pAd->BulkOutLock[0], IrqFlags);
 		return;
 	}
@@ -521,45 +562,45 @@ VOID	RTUSBBulkOutNullFrame(
 	pNullContext->IRPPending = TRUE;
 	RTMP_IRQ_UNLOCK(&pAd->BulkOutLock[0], IrqFlags);
 
-	// Increase Total transmit byte counter
-	pAd->RalinkCounters.TransmittedByteCount +=  pNullContext->BulkOutSize;
+	/* Increase Total transmit byte counter */
+	pAd->RalinkCounters.TransmittedByteCount += pNullContext->BulkOutSize;
 
-
-	// Clear Null frame bulk flag
+	/* Clear Null frame bulk flag */
 	RTUSB_CLEAR_BULK_FLAG(pAd, fRTUSB_BULK_OUT_DATA_NULL);
 
-	// Init Tx context descriptor
-	RTUSBInitTxDesc(pAd, pNullContext, 0, (usb_complete_t)RTUSBBulkOutNullFrameComplete);
+	/* Init Tx context descriptor */
+	RTUSBInitTxDesc(pAd, pNullContext, 0,
+			(usb_complete_t) RTUSBBulkOutNullFrameComplete);
 
 	pUrb = pNullContext->pUrb;
-	if((ret = RTUSB_SUBMIT_URB(pUrb))!=0)
-	{
+	if ((ret = RTUSB_SUBMIT_URB(pUrb)) != 0) {
 		RTMP_IRQ_LOCK(&pAd->BulkOutLock[0], IrqFlags);
 		pAd->BulkOutPending[0] = FALSE;
 		pAd->watchDogTxPendingCnt[0] = 0;
 		pNullContext->IRPPending = FALSE;
 		RTMP_IRQ_UNLOCK(&pAd->BulkOutLock[0], IrqFlags);
 
-		DBGPRINT(RT_DEBUG_ERROR, ("RTUSBBulkOutNullFrame: Submit Tx URB failed %d\n", ret));
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("RTUSBBulkOutNullFrame: Submit Tx URB failed %d\n",
+			  ret));
 		return;
 	}
 
 }
 
-// NULL frame use BulkOutPipeId = 0
-VOID RTUSBBulkOutNullFrameComplete(purbb_t pUrb, struct pt_regs *pt_regs)
+/* NULL frame use BulkOutPipeId = 0 */
+void RTUSBBulkOutNullFrameComplete(struct urb *pUrb, struct pt_regs * pt_regs)
 {
-	PRTMP_ADAPTER		pAd;
-	PTX_CONTEXT			pNullContext;
-	NTSTATUS			Status;
-	POS_COOKIE			pObj;
-
+	struct rt_rtmp_adapter *pAd;
+	struct rt_tx_context *pNullContext;
+	int Status;
+	struct os_cookie *pObj;
 
-	pNullContext	= (PTX_CONTEXT)pUrb->context;
-	pAd 			= pNullContext->pAd;
-	Status 			= pUrb->status;
+	pNullContext = (struct rt_tx_context *)pUrb->context;
+	pAd = pNullContext->pAd;
+	Status = pUrb->status;
 
-	pObj = (POS_COOKIE) pAd->OS_Cookie;
+	pObj = (struct os_cookie *)pAd->OS_Cookie;
 	pObj->null_frame_complete_task.data = (unsigned long)pUrb;
 	tasklet_hi_schedule(&pObj->null_frame_complete_task);
 }
@@ -577,34 +618,30 @@ VOID RTUSBBulkOutNullFrameComplete(purbb_t pUrb, struct pt_regs *pt_regs)
 
 	========================================================================
 */
-VOID	RTUSBBulkOutMLMEPacket(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			Index)
+void RTUSBBulkOutMLMEPacket(struct rt_rtmp_adapter *pAd, u8 Index)
 {
-	PTX_CONTEXT		pMLMEContext;
-	PURB			pUrb;
-	int				ret = 0;
-	unsigned long	IrqFlags;
+	struct rt_tx_context *pMLMEContext;
+	PURB pUrb;
+	int ret = 0;
+	unsigned long IrqFlags;
 
-	pMLMEContext = (PTX_CONTEXT)pAd->MgmtRing.Cell[pAd->MgmtRing.TxDmaIdx].AllocVa;
+	pMLMEContext =
+	    (struct rt_tx_context *)pAd->MgmtRing.Cell[pAd->MgmtRing.TxDmaIdx].AllocVa;
 	pUrb = pMLMEContext->pUrb;
 
 	if ((pAd->MgmtRing.TxSwFreeIdx >= MGMT_RING_SIZE) ||
-		(pMLMEContext->InUse == FALSE) ||
-		(pMLMEContext->bWaitingBulkOut == FALSE))
-	{
-
+	    (pMLMEContext->InUse == FALSE) ||
+	    (pMLMEContext->bWaitingBulkOut == FALSE)) {
 
-		// Clear MLME bulk flag
+		/* Clear MLME bulk flag */
 		RTUSB_CLEAR_BULK_FLAG(pAd, fRTUSB_BULK_OUT_MLME);
 
 		return;
 	}
 
-
 	RTMP_IRQ_LOCK(&pAd->BulkOutLock[MGMTPIPEIDX], IrqFlags);
-	if ((pAd->BulkOutPending[MGMTPIPEIDX] == TRUE) || RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NEED_STOP_TX))
-	{
+	if ((pAd->BulkOutPending[MGMTPIPEIDX] == TRUE)
+	    || RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NEED_STOP_TX)) {
 		RTMP_IRQ_UNLOCK(&pAd->BulkOutLock[MGMTPIPEIDX], IrqFlags);
 		return;
 	}
@@ -615,23 +652,25 @@ VOID	RTUSBBulkOutMLMEPacket(
 	pMLMEContext->bWaitingBulkOut = FALSE;
 	RTMP_IRQ_UNLOCK(&pAd->BulkOutLock[MGMTPIPEIDX], IrqFlags);
 
-	// Increase Total transmit byte counter
-	pAd->RalinkCounters.TransmittedByteCount +=  pMLMEContext->BulkOutSize;
+	/* Increase Total transmit byte counter */
+	pAd->RalinkCounters.TransmittedByteCount += pMLMEContext->BulkOutSize;
 
-	// Clear MLME bulk flag
+	/* Clear MLME bulk flag */
 	RTUSB_CLEAR_BULK_FLAG(pAd, fRTUSB_BULK_OUT_MLME);
 
-	// Init Tx context descriptor
-	RTUSBInitTxDesc(pAd, pMLMEContext, MGMTPIPEIDX, (usb_complete_t)RTUSBBulkOutMLMEPacketComplete);
+	/* Init Tx context descriptor */
+	RTUSBInitTxDesc(pAd, pMLMEContext, MGMTPIPEIDX,
+			(usb_complete_t) RTUSBBulkOutMLMEPacketComplete);
 
-	//For mgmt urb buffer, because we use sk_buff, so we need to notify the USB controller do dma mapping.
-	pUrb->transfer_dma	= 0;
+	/*For mgmt urb buffer, because we use sk_buff, so we need to notify the USB controller do dma mapping. */
+	pUrb->transfer_dma = 0;
 	pUrb->transfer_flags &= (~URB_NO_TRANSFER_DMA_MAP);
 
 	pUrb = pMLMEContext->pUrb;
-	if((ret = RTUSB_SUBMIT_URB(pUrb))!=0)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("RTUSBBulkOutMLMEPacket: Submit MLME URB failed %d\n", ret));
+	if ((ret = RTUSB_SUBMIT_URB(pUrb)) != 0) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("RTUSBBulkOutMLMEPacket: Submit MLME URB failed %d\n",
+			  ret));
 		RTMP_IRQ_LOCK(&pAd->BulkOutLock[MGMTPIPEIDX], IrqFlags);
 		pAd->BulkOutPending[MGMTPIPEIDX] = FALSE;
 		pAd->watchDogTxPendingCnt[MGMTPIPEIDX] = 0;
@@ -641,32 +680,29 @@ VOID	RTUSBBulkOutMLMEPacket(
 
 		return;
 	}
-
-	//DBGPRINT_RAW(RT_DEBUG_INFO, ("<---RTUSBBulkOutMLMEPacket \n"));
-//	printk("<---RTUSBBulkOutMLMEPacket,Cpu=%d!, Dma=%d, SwIdx=%d!\n", pAd->MgmtRing.TxCpuIdx, pAd->MgmtRing.TxDmaIdx, pAd->MgmtRing.TxSwFreeIdx);
+	/*DBGPRINT_RAW(RT_DEBUG_INFO, ("<---RTUSBBulkOutMLMEPacket \n")); */
+/*      printk("<---RTUSBBulkOutMLMEPacket,Cpu=%d!, Dma=%d, SwIdx=%d!\n", pAd->MgmtRing.TxCpuIdx, pAd->MgmtRing.TxDmaIdx, pAd->MgmtRing.TxSwFreeIdx); */
 }
 
-
-VOID RTUSBBulkOutMLMEPacketComplete(purbb_t pUrb, struct pt_regs *pt_regs)
+void RTUSBBulkOutMLMEPacketComplete(struct urb *pUrb, struct pt_regs * pt_regs)
 {
-	PTX_CONTEXT			pMLMEContext;
-	PRTMP_ADAPTER		pAd;
-	NTSTATUS			Status;
-	POS_COOKIE 			pObj;
-	int					index;
-
-	//DBGPRINT_RAW(RT_DEBUG_INFO, ("--->RTUSBBulkOutMLMEPacketComplete\n"));
-	pMLMEContext	= (PTX_CONTEXT)pUrb->context;
-	pAd 			= pMLMEContext->pAd;
-	pObj 			= (POS_COOKIE)pAd->OS_Cookie;
-	Status			= pUrb->status;
-	index 			= pMLMEContext->SelfIdx;
+	struct rt_tx_context *pMLMEContext;
+	struct rt_rtmp_adapter *pAd;
+	int Status;
+	struct os_cookie *pObj;
+	int index;
+
+	/*DBGPRINT_RAW(RT_DEBUG_INFO, ("--->RTUSBBulkOutMLMEPacketComplete\n")); */
+	pMLMEContext = (struct rt_tx_context *)pUrb->context;
+	pAd = pMLMEContext->pAd;
+	pObj = (struct os_cookie *)pAd->OS_Cookie;
+	Status = pUrb->status;
+	index = pMLMEContext->SelfIdx;
 
 	pObj->mgmt_dma_done_task.data = (unsigned long)pUrb;
 	tasklet_hi_schedule(&pObj->mgmt_dma_done_task);
 }
 
-
 /*
 	========================================================================
 
@@ -680,17 +716,16 @@ VOID RTUSBBulkOutMLMEPacketComplete(purbb_t pUrb, struct pt_regs *pt_regs)
 
 	========================================================================
 */
-VOID	RTUSBBulkOutPsPoll(
-	IN	PRTMP_ADAPTER	pAd)
+void RTUSBBulkOutPsPoll(struct rt_rtmp_adapter *pAd)
 {
-	PTX_CONTEXT		pPsPollContext = &(pAd->PsPollContext);
-	PURB			pUrb;
-	int				ret = 0;
-	unsigned long	IrqFlags;
+	struct rt_tx_context *pPsPollContext = &(pAd->PsPollContext);
+	PURB pUrb;
+	int ret = 0;
+	unsigned long IrqFlags;
 
 	RTMP_IRQ_LOCK(&pAd->BulkOutLock[0], IrqFlags);
-	if ((pAd->BulkOutPending[0] == TRUE) || RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NEED_STOP_TX))
-	{
+	if ((pAd->BulkOutPending[0] == TRUE)
+	    || RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NEED_STOP_TX)) {
 		RTMP_IRQ_UNLOCK(&pAd->BulkOutLock[0], IrqFlags);
 		return;
 	}
@@ -699,57 +734,57 @@ VOID	RTUSBBulkOutPsPoll(
 	pPsPollContext->IRPPending = TRUE;
 	RTMP_IRQ_UNLOCK(&pAd->BulkOutLock[0], IrqFlags);
 
-
-	// Clear PS-Poll bulk flag
+	/* Clear PS-Poll bulk flag */
 	RTUSB_CLEAR_BULK_FLAG(pAd, fRTUSB_BULK_OUT_PSPOLL);
 
-	// Init Tx context descriptor
-	RTUSBInitTxDesc(pAd, pPsPollContext, MGMTPIPEIDX, (usb_complete_t)RTUSBBulkOutPsPollComplete);
+	/* Init Tx context descriptor */
+	RTUSBInitTxDesc(pAd, pPsPollContext, MGMTPIPEIDX,
+			(usb_complete_t) RTUSBBulkOutPsPollComplete);
 
 	pUrb = pPsPollContext->pUrb;
-	if((ret = RTUSB_SUBMIT_URB(pUrb))!=0)
-	{
+	if ((ret = RTUSB_SUBMIT_URB(pUrb)) != 0) {
 		RTMP_IRQ_LOCK(&pAd->BulkOutLock[0], IrqFlags);
 		pAd->BulkOutPending[0] = FALSE;
 		pAd->watchDogTxPendingCnt[0] = 0;
 		pPsPollContext->IRPPending = FALSE;
 		RTMP_IRQ_UNLOCK(&pAd->BulkOutLock[0], IrqFlags);
 
-		DBGPRINT(RT_DEBUG_ERROR, ("RTUSBBulkOutPsPoll: Submit Tx URB failed %d\n", ret));
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("RTUSBBulkOutPsPoll: Submit Tx URB failed %d\n",
+			  ret));
 		return;
 	}
 
 }
 
-// PS-Poll frame use BulkOutPipeId = 0
-VOID RTUSBBulkOutPsPollComplete(purbb_t pUrb,struct pt_regs *pt_regs)
+/* PS-Poll frame use BulkOutPipeId = 0 */
+void RTUSBBulkOutPsPollComplete(struct urb *pUrb, struct pt_regs * pt_regs)
 {
-	PRTMP_ADAPTER		pAd;
-	PTX_CONTEXT			pPsPollContext;
-	NTSTATUS			Status;
-	POS_COOKIE			pObj;
-
+	struct rt_rtmp_adapter *pAd;
+	struct rt_tx_context *pPsPollContext;
+	int Status;
+	struct os_cookie *pObj;
 
-	pPsPollContext= (PTX_CONTEXT)pUrb->context;
+	pPsPollContext = (struct rt_tx_context *)pUrb->context;
 	pAd = pPsPollContext->pAd;
 	Status = pUrb->status;
 
-	pObj = (POS_COOKIE) pAd->OS_Cookie;
+	pObj = (struct os_cookie *)pAd->OS_Cookie;
 	pObj->pspoll_frame_complete_task.data = (unsigned long)pUrb;
 	tasklet_hi_schedule(&pObj->pspoll_frame_complete_task);
 }
 
-VOID DoBulkIn(IN RTMP_ADAPTER *pAd)
+void DoBulkIn(struct rt_rtmp_adapter *pAd)
 {
-	PRX_CONTEXT		pRxContext;
-	PURB			pUrb;
-	int				ret = 0;
-	unsigned long	IrqFlags;
+	struct rt_rx_context *pRxContext;
+	PURB pUrb;
+	int ret = 0;
+	unsigned long IrqFlags;
 
 	RTMP_IRQ_LOCK(&pAd->BulkInLock, IrqFlags);
 	pRxContext = &(pAd->RxContext[pAd->NextRxBulkInIndex]);
-	if ((pAd->PendingRx > 0) || (pRxContext->Readable == TRUE) || (pRxContext->InUse == TRUE))
-	{
+	if ((pAd->PendingRx > 0) || (pRxContext->Readable == TRUE)
+	    || (pRxContext->InUse == TRUE)) {
 		RTMP_IRQ_UNLOCK(&pAd->BulkInLock, IrqFlags);
 		return;
 	}
@@ -759,13 +794,12 @@ VOID DoBulkIn(IN RTMP_ADAPTER *pAd)
 	pAd->BulkInReq++;
 	RTMP_IRQ_UNLOCK(&pAd->BulkInLock, IrqFlags);
 
-	// Init Rx context descriptor
+	/* Init Rx context descriptor */
 	NdisZeroMemory(pRxContext->TransferBuffer, pRxContext->BulkInOffset);
 	RTUSBInitRxDesc(pAd, pRxContext);
 
 	pUrb = pRxContext->pUrb;
-	if ((ret = RTUSB_SUBMIT_URB(pUrb))!=0)
-	{	// fail
+	if ((ret = RTUSB_SUBMIT_URB(pUrb)) != 0) {	/* fail */
 
 		RTMP_IRQ_LOCK(&pAd->BulkInLock, IrqFlags);
 		pRxContext->InUse = FALSE;
@@ -773,16 +807,14 @@ VOID DoBulkIn(IN RTMP_ADAPTER *pAd)
 		pAd->PendingRx--;
 		pAd->BulkInReq--;
 		RTMP_IRQ_UNLOCK(&pAd->BulkInLock, IrqFlags);
-		DBGPRINT(RT_DEBUG_ERROR, ("RTUSBBulkReceive: Submit Rx URB failed %d\n", ret));
-	}
-	else
-	{	// success
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("RTUSBBulkReceive: Submit Rx URB failed %d\n", ret));
+	} else {		/* success */
 		ASSERT((pRxContext->InUse == pRxContext->IRPPending));
-		//printk("BIDone, Pend=%d,BIIdx=%d,BIRIdx=%d!\n", pAd->PendingRx, pAd->NextRxBulkInIndex, pAd->NextRxBulkInReadIndex);
+		/*printk("BIDone, Pend=%d,BIIdx=%d,BIRIdx=%d!\n", pAd->PendingRx, pAd->NextRxBulkInIndex, pAd->NextRxBulkInReadIndex); */
 	}
 }
 
-
 /*
 	========================================================================
 
@@ -813,44 +845,40 @@ VOID DoBulkIn(IN RTMP_ADAPTER *pAd)
 		 fRTMP_ADAPTER_RADIO_OFF | fRTMP_ADAPTER_RESET_IN_PROGRESS | \
 		 fRTMP_ADAPTER_REMOVE_IN_PROGRESS)
 
-VOID	RTUSBBulkReceive(
-	IN	PRTMP_ADAPTER	pAd)
+void RTUSBBulkReceive(struct rt_rtmp_adapter *pAd)
 {
-	PRX_CONTEXT		pRxContext;
-	unsigned long	IrqFlags;
-
+	struct rt_rx_context *pRxContext;
+	unsigned long IrqFlags;
 
 	/* sanity check */
 	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NEED_STOP_HANDLE_RX))
 		return;
 
-	while(1)
-	{
+	while (1) {
 
 		RTMP_IRQ_LOCK(&pAd->BulkInLock, IrqFlags);
 		pRxContext = &(pAd->RxContext[pAd->NextRxBulkInReadIndex]);
-		if (((pRxContext->InUse == FALSE) && (pRxContext->Readable == TRUE)) &&
-			(pRxContext->bRxHandling == FALSE))
-		{
+		if (((pRxContext->InUse == FALSE)
+		     && (pRxContext->Readable == TRUE))
+		    && (pRxContext->bRxHandling == FALSE)) {
 			pRxContext->bRxHandling = TRUE;
 			RTMP_IRQ_UNLOCK(&pAd->BulkInLock, IrqFlags);
 
-			// read RxContext, Since not
+			/* read RxContext, Since not */
 			STARxDoneInterruptHandle(pAd, TRUE);
 
-			// Finish to handle this bulkIn buffer.
+			/* Finish to handle this bulkIn buffer. */
 			RTMP_IRQ_LOCK(&pAd->BulkInLock, IrqFlags);
 			pRxContext->BulkInOffset = 0;
 			pRxContext->Readable = FALSE;
 			pRxContext->bRxHandling = FALSE;
 			pAd->ReadPosition = 0;
 			pAd->TransferBufferLength = 0;
-			INC_RING_INDEX(pAd->NextRxBulkInReadIndex, RX_RING_SIZE);
+			INC_RING_INDEX(pAd->NextRxBulkInReadIndex,
+				       RX_RING_SIZE);
 			RTMP_IRQ_UNLOCK(&pAd->BulkInLock, IrqFlags);
 
-		}
-		else
-		{
+		} else {
 			RTMP_IRQ_UNLOCK(&pAd->BulkInLock, IrqFlags);
 			break;
 		}
@@ -861,7 +889,6 @@ VOID	RTUSBBulkReceive(
 
 }
 
-
 /*
 	========================================================================
 
@@ -885,27 +912,24 @@ VOID	RTUSBBulkReceive(
 		Always returns STATUS_MORE_PROCESSING_REQUIRED
 	========================================================================
 */
-VOID RTUSBBulkRxComplete(purbb_t pUrb, struct pt_regs *pt_regs)
+void RTUSBBulkRxComplete(struct urb *pUrb, struct pt_regs *pt_regs)
 {
-	// use a receive tasklet to handle received packets;
-	// or sometimes hardware IRQ will be disabled here, so we can not
-	// use spin_lock_bh()/spin_unlock_bh() after IRQ is disabled. :<
-	PRX_CONTEXT		pRxContext;
-	PRTMP_ADAPTER	pAd;
-	POS_COOKIE 		pObj;
-
+	/* use a receive tasklet to handle received packets; */
+	/* or sometimes hardware IRQ will be disabled here, so we can not */
+	/* use spin_lock_bh()/spin_unlock_bh() after IRQ is disabled. :< */
+	struct rt_rx_context *pRxContext;
+	struct rt_rtmp_adapter *pAd;
+	struct os_cookie *pObj;
 
-	pRxContext	= (PRX_CONTEXT)pUrb->context;
-	pAd 		= pRxContext->pAd;
-	pObj 		= (POS_COOKIE) pAd->OS_Cookie;
+	pRxContext = (struct rt_rx_context *)pUrb->context;
+	pAd = pRxContext->pAd;
+	pObj = (struct os_cookie *)pAd->OS_Cookie;
 
 	pObj->rx_done_task.data = (unsigned long)pUrb;
 	tasklet_hi_schedule(&pObj->rx_done_task);
 
 }
 
-
-
 /*
 	========================================================================
 
@@ -919,86 +943,78 @@ VOID RTUSBBulkRxComplete(purbb_t pUrb, struct pt_regs *pt_regs)
 
 	========================================================================
 */
-VOID	RTUSBKickBulkOut(
-	IN	PRTMP_ADAPTER pAd)
+void RTUSBKickBulkOut(struct rt_rtmp_adapter *pAd)
 {
-	// BulkIn Reset will reset whole USB PHY. So we need to make sure fRTMP_ADAPTER_BULKIN_RESET not flaged.
-	if (!RTMP_TEST_FLAG(pAd ,fRTMP_ADAPTER_NEED_STOP_TX)
-		)
-	{
-		// 2. PS-Poll frame is next
-		if (RTUSB_TEST_BULK_FLAG(pAd, fRTUSB_BULK_OUT_PSPOLL))
-		{
+	/* BulkIn Reset will reset whole USB PHY. So we need to make sure fRTMP_ADAPTER_BULKIN_RESET not flaged. */
+	if (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NEED_STOP_TX)
+	    ) {
+		/* 2. PS-Poll frame is next */
+		if (RTUSB_TEST_BULK_FLAG(pAd, fRTUSB_BULK_OUT_PSPOLL)) {
 			RTUSBBulkOutPsPoll(pAd);
 		}
-
-		// 5. Mlme frame is next
-		else if ((RTUSB_TEST_BULK_FLAG(pAd, fRTUSB_BULK_OUT_MLME)) &&
-				 (pAd->MgmtRing.TxSwFreeIdx < MGMT_RING_SIZE))
-		{
+		/* 5. Mlme frame is next */
+		else if ((RTUSB_TEST_BULK_FLAG(pAd, fRTUSB_BULK_OUT_MLME)) ||
+			 (pAd->MgmtRing.TxSwFreeIdx < MGMT_RING_SIZE)) {
 			RTUSBBulkOutMLMEPacket(pAd, pAd->MgmtRing.TxDmaIdx);
 		}
-
-		// 6. Data frame normal is next
-		if (RTUSB_TEST_BULK_FLAG(pAd, fRTUSB_BULK_OUT_DATA_NORMAL))
-		{
-			if (((!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS)) ||
-				(!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED))
-				))
-			{
-				RTUSBBulkOutDataPacket(pAd, 0, pAd->NextBulkOutIndex[0]);
+		/* 6. Data frame normal is next */
+		if (RTUSB_TEST_BULK_FLAG(pAd, fRTUSB_BULK_OUT_DATA_NORMAL)) {
+			if (((!RTMP_TEST_FLAG
+			      (pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS))
+			     ||
+			     (!OPSTATUS_TEST_FLAG
+			      (pAd, fOP_STATUS_MEDIA_STATE_CONNECTED))
+			    )) {
+				RTUSBBulkOutDataPacket(pAd, 0,
+						       pAd->
+						       NextBulkOutIndex[0]);
 			}
 		}
-		if (RTUSB_TEST_BULK_FLAG(pAd, fRTUSB_BULK_OUT_DATA_NORMAL_2))
-		{
-			if (((!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS)) ||
-				(!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED))
-				))
-			{
-				RTUSBBulkOutDataPacket(pAd, 1, pAd->NextBulkOutIndex[1]);
+		if (RTUSB_TEST_BULK_FLAG(pAd, fRTUSB_BULK_OUT_DATA_NORMAL_2)) {
+			if (((!RTMP_TEST_FLAG
+			      (pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS))
+			     ||
+			     (!OPSTATUS_TEST_FLAG
+			      (pAd, fOP_STATUS_MEDIA_STATE_CONNECTED))
+			    )) {
+				RTUSBBulkOutDataPacket(pAd, 1,
+						       pAd->
+						       NextBulkOutIndex[1]);
 			}
 		}
-		if (RTUSB_TEST_BULK_FLAG(pAd, fRTUSB_BULK_OUT_DATA_NORMAL_3))
-		{
-			if (((!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS)) ||
-				(!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED))
-				))
-			{
-				RTUSBBulkOutDataPacket(pAd, 2, pAd->NextBulkOutIndex[2]);
+		if (RTUSB_TEST_BULK_FLAG(pAd, fRTUSB_BULK_OUT_DATA_NORMAL_3)) {
+			if (((!RTMP_TEST_FLAG
+			      (pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS))
+			     ||
+			     (!OPSTATUS_TEST_FLAG
+			      (pAd, fOP_STATUS_MEDIA_STATE_CONNECTED))
+			    )) {
+				RTUSBBulkOutDataPacket(pAd, 2,
+						       pAd->
+						       NextBulkOutIndex[2]);
 			}
 		}
-		if (RTUSB_TEST_BULK_FLAG(pAd, fRTUSB_BULK_OUT_DATA_NORMAL_4))
-		{
-			if (((!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS)) ||
-				(!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED))
-				))
-			{
-				RTUSBBulkOutDataPacket(pAd, 3, pAd->NextBulkOutIndex[3]);
+		if (RTUSB_TEST_BULK_FLAG(pAd, fRTUSB_BULK_OUT_DATA_NORMAL_4)) {
+			if (((!RTMP_TEST_FLAG
+			      (pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS))
+			     ||
+			     (!OPSTATUS_TEST_FLAG
+			      (pAd, fOP_STATUS_MEDIA_STATE_CONNECTED))
+			    )) {
+				RTUSBBulkOutDataPacket(pAd, 3,
+						       pAd->
+						       NextBulkOutIndex[3]);
 			}
 		}
-
-		//PS packets use HCCA queue when dequeue from PS unicast queue (WiFi WPA2 MA9_DT1 for Marvell B STA)
-		if (RTUSB_TEST_BULK_FLAG(pAd, fRTUSB_BULK_OUT_DATA_NORMAL_5))
-		{
-			if (((!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS)) ||
-				(!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED))
-				))
-			{
-			}
-		}
-
-		// 7. Null frame is the last
-		else if (RTUSB_TEST_BULK_FLAG(pAd, fRTUSB_BULK_OUT_DATA_NULL))
-		{
-			if (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS))
-			{
+		/* 7. Null frame is the last */
+		else if (RTUSB_TEST_BULK_FLAG(pAd, fRTUSB_BULK_OUT_DATA_NULL)) {
+			if (!RTMP_TEST_FLAG
+			    (pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS)) {
 				RTUSBBulkOutNullFrame(pAd);
 			}
 		}
-
-		// 8. No data avaliable
-		else
-		{
+		/* 8. No data avaliable */
+		else {
 
 		}
 	}
@@ -1017,16 +1033,14 @@ VOID	RTUSBKickBulkOut(
 
 	========================================================================
 */
-VOID	RTUSBCleanUpDataBulkOutQueue(
-	IN	PRTMP_ADAPTER	pAd)
+void RTUSBCleanUpDataBulkOutQueue(struct rt_rtmp_adapter *pAd)
 {
-	UCHAR			Idx;
-	PHT_TX_CONTEXT	pTxContext;
+	u8 Idx;
+	struct rt_ht_tx_context *pTxContext;
 
 	DBGPRINT(RT_DEBUG_TRACE, ("--->CleanUpDataBulkOutQueue\n"));
 
-	for (Idx = 0; Idx < 4; Idx++)
-	{
+	for (Idx = 0; Idx < 4; Idx++) {
 		pTxContext = &pAd->TxContext[Idx];
 
 		pTxContext->CurWritePosition = pTxContext->NextBulkOutPosition;
@@ -1052,14 +1066,12 @@ VOID	RTUSBCleanUpDataBulkOutQueue(
 
 	========================================================================
 */
-VOID	RTUSBCleanUpMLMEBulkOutQueue(
-	IN	PRTMP_ADAPTER	pAd)
+void RTUSBCleanUpMLMEBulkOutQueue(struct rt_rtmp_adapter *pAd)
 {
 	DBGPRINT(RT_DEBUG_TRACE, ("--->CleanUpMLMEBulkOutQueue\n"));
 	DBGPRINT(RT_DEBUG_TRACE, ("<---CleanUpMLMEBulkOutQueue\n"));
 }
 
-
 /*
 	========================================================================
 
@@ -1069,13 +1081,11 @@ VOID	RTUSBCleanUpMLMEBulkOutQueue(
 
 	Return Value:
 
-
 	Note:
 
 	========================================================================
 */
-VOID	RTUSBCancelPendingIRPs(
-	IN	PRTMP_ADAPTER	pAd)
+void RTUSBCancelPendingIRPs(struct rt_rtmp_adapter *pAd)
 {
 	RTUSBCancelPendingBulkInIRP(pAd);
 	RTUSBCancelPendingBulkOutIRP(pAd);
@@ -1094,29 +1104,25 @@ VOID	RTUSBCancelPendingIRPs(
 
 	========================================================================
 */
-VOID	RTUSBCancelPendingBulkInIRP(
-	IN	PRTMP_ADAPTER	pAd)
+void RTUSBCancelPendingBulkInIRP(struct rt_rtmp_adapter *pAd)
 {
-	PRX_CONTEXT		pRxContext;
-	UINT			i;
+	struct rt_rx_context *pRxContext;
+	u32 i;
 
 	DBGPRINT_RAW(RT_DEBUG_TRACE, ("--->RTUSBCancelPendingBulkInIRP\n"));
-	for ( i = 0; i < (RX_RING_SIZE); i++)
-	{
+	for (i = 0; i < (RX_RING_SIZE); i++) {
 		pRxContext = &(pAd->RxContext[i]);
-		if(pRxContext->IRPPending == TRUE)
-		{
+		if (pRxContext->IRPPending == TRUE) {
 			RTUSB_UNLINK_URB(pRxContext->pUrb);
 			pRxContext->IRPPending = FALSE;
 			pRxContext->InUse = FALSE;
-			//NdisInterlockedDecrement(&pAd->PendingRx);
-			//pAd->PendingRx--;
+			/*NdisInterlockedDecrement(&pAd->PendingRx); */
+			/*pAd->PendingRx--; */
 		}
 	}
 	DBGPRINT_RAW(RT_DEBUG_TRACE, ("<---RTUSBCancelPendingBulkInIRP\n"));
 }
 
-
 /*
 	========================================================================
 
@@ -1130,83 +1136,74 @@ VOID	RTUSBCancelPendingBulkInIRP(
 
 	========================================================================
 */
-VOID	RTUSBCancelPendingBulkOutIRP(
-	IN	PRTMP_ADAPTER	pAd)
+void RTUSBCancelPendingBulkOutIRP(struct rt_rtmp_adapter *pAd)
 {
-	PHT_TX_CONTEXT		pHTTXContext;
-	PTX_CONTEXT			pMLMEContext;
-	PTX_CONTEXT			pBeaconContext;
-	PTX_CONTEXT			pNullContext;
-	PTX_CONTEXT			pPsPollContext;
-	PTX_CONTEXT			pRTSContext;
-	UINT				i, Idx;
-//	unsigned int 		IrqFlags;
-//	NDIS_SPIN_LOCK		*pLock;
-//	BOOLEAN				*pPending;
-
-
-//	pLock = &pAd->BulkOutLock[MGMTPIPEIDX];
-//	pPending = &pAd->BulkOutPending[MGMTPIPEIDX];
-
-	for (Idx = 0; Idx < 4; Idx++)
-	{
+	struct rt_ht_tx_context *pHTTXContext;
+	struct rt_tx_context *pMLMEContext;
+	struct rt_tx_context *pBeaconContext;
+	struct rt_tx_context *pNullContext;
+	struct rt_tx_context *pPsPollContext;
+	struct rt_tx_context *pRTSContext;
+	u32 i, Idx;
+/*      unsigned int            IrqFlags; */
+/*      spinlock_t          *pLock; */
+/*      BOOLEAN                         *pPending; */
+
+/*      pLock = &pAd->BulkOutLock[MGMTPIPEIDX]; */
+/*      pPending = &pAd->BulkOutPending[MGMTPIPEIDX]; */
+
+	for (Idx = 0; Idx < 4; Idx++) {
 		pHTTXContext = &(pAd->TxContext[Idx]);
 
-		if (pHTTXContext->IRPPending == TRUE)
-		{
+		if (pHTTXContext->IRPPending == TRUE) {
 
-			// Get the USB_CONTEXT and cancel it's IRP; the completion routine will itself
-			// remove it from the HeadPendingSendList and NULL out HeadPendingSendList
-			//	when the last IRP on the list has been	cancelled; that's how we exit this loop
-			//
+			/* Get the USB_CONTEXT and cancel it's IRP; the completion routine will itself */
+			/* remove it from the HeadPendingSendList and NULL out HeadPendingSendList */
+			/*      when the last IRP on the list has been  cancelled; that's how we exit this loop */
+			/* */
 
 			RTUSB_UNLINK_URB(pHTTXContext->pUrb);
 
-			// Sleep 200 microseconds to give cancellation time to work
+			/* Sleep 200 microseconds to give cancellation time to work */
 			RTMPusecDelay(200);
 		}
 
 		pAd->BulkOutPending[Idx] = FALSE;
 	}
 
-	//RTMP_IRQ_LOCK(pLock, IrqFlags);
-	for (i = 0; i < MGMT_RING_SIZE; i++)
-	{
-		pMLMEContext = (PTX_CONTEXT)pAd->MgmtRing.Cell[i].AllocVa;
-		if(pMLMEContext && (pMLMEContext->IRPPending == TRUE))
-		{
+	/*RTMP_IRQ_LOCK(pLock, IrqFlags); */
+	for (i = 0; i < MGMT_RING_SIZE; i++) {
+		pMLMEContext = (struct rt_tx_context *)pAd->MgmtRing.Cell[i].AllocVa;
+		if (pMLMEContext && (pMLMEContext->IRPPending == TRUE)) {
 
-			// Get the USB_CONTEXT and cancel it's IRP; the completion routine will itself
-			// remove it from the HeadPendingSendList and NULL out HeadPendingSendList
-			//	when the last IRP on the list has been	cancelled; that's how we exit this loop
-			//
+			/* Get the USB_CONTEXT and cancel it's IRP; the completion routine will itself */
+			/* remove it from the HeadPendingSendList and NULL out HeadPendingSendList */
+			/*      when the last IRP on the list has been  cancelled; that's how we exit this loop */
+			/* */
 
 			RTUSB_UNLINK_URB(pMLMEContext->pUrb);
 			pMLMEContext->IRPPending = FALSE;
 
-			// Sleep 200 microsecs to give cancellation time to work
+			/* Sleep 200 microsecs to give cancellation time to work */
 			RTMPusecDelay(200);
 		}
 	}
 	pAd->BulkOutPending[MGMTPIPEIDX] = FALSE;
-	//RTMP_IRQ_UNLOCK(pLock, IrqFlags);
-
+	/*RTMP_IRQ_UNLOCK(pLock, IrqFlags); */
 
-	for (i = 0; i < BEACON_RING_SIZE; i++)
-	{
+	for (i = 0; i < BEACON_RING_SIZE; i++) {
 		pBeaconContext = &(pAd->BeaconContext[i]);
 
-		if(pBeaconContext->IRPPending == TRUE)
-		{
+		if (pBeaconContext->IRPPending == TRUE) {
 
-			// Get the USB_CONTEXT and cancel it's IRP; the completion routine will itself
-			// remove it from the HeadPendingSendList and NULL out HeadPendingSendList
-			//	when the last IRP on the list has been	cancelled; that's how we exit this loop
-			//
+			/* Get the USB_CONTEXT and cancel it's IRP; the completion routine will itself */
+			/* remove it from the HeadPendingSendList and NULL out HeadPendingSendList */
+			/*      when the last IRP on the list has been  cancelled; that's how we exit this loop */
+			/* */
 
 			RTUSB_UNLINK_URB(pBeaconContext->pUrb);
 
-			// Sleep 200 microsecs to give cancellation time to work
+			/* Sleep 200 microsecs to give cancellation time to work */
 			RTMPusecDelay(200);
 		}
 	}
@@ -1223,11 +1220,11 @@ VOID	RTUSBCancelPendingBulkOutIRP(
 	if (pPsPollContext->IRPPending == TRUE)
 		RTUSB_UNLINK_URB(pPsPollContext->pUrb);
 
-	for (Idx = 0; Idx < 4; Idx++)
-	{
+	for (Idx = 0; Idx < 4; Idx++) {
 		NdisAcquireSpinLock(&pAd->BulkOutLock[Idx]);
 		pAd->BulkOutPending[Idx] = FALSE;
 		NdisReleaseSpinLock(&pAd->BulkOutLock[Idx]);
 	}
 }
 
+#endif /* RTMP_MAC_USB // */
diff --git a/drivers/staging/rt2870/common/rtusb_data.c b/drivers/staging/rt2870/common/rtusb_data.c
index 6b003f63372e..4583764c78d2 100644
--- a/drivers/staging/rt2870/common/rtusb_data.c
+++ b/drivers/staging/rt2870/common/rtusb_data.c
@@ -36,82 +36,102 @@
 	Jan            03-25-2006    created
 
 */
+
+#ifdef RTMP_MAC_USB
+
 #include "../rt_config.h"
 
-extern  UCHAR Phy11BGNextRateUpward[]; // defined in mlme.c
-extern UCHAR	EpToQueue[];
+extern u8 Phy11BGNextRateUpward[];	/* defined in mlme.c */
+extern u8 EpToQueue[];
 
-VOID REPORT_AMSDU_FRAMES_TO_LLC(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			pData,
-	IN	ULONG			DataSize)
+void REPORT_AMSDU_FRAMES_TO_LLC(struct rt_rtmp_adapter *pAd,
+				u8 *pData, unsigned long DataSize)
 {
-	PNDIS_PACKET	pPacket;
-	UINT			nMSDU;
-	struct			sk_buff *pSkb;
+	void *pPacket;
+	u32 nMSDU;
+	struct sk_buff *pSkb;
 
 	nMSDU = 0;
 	/* allocate a rx packet */
 	pSkb = dev_alloc_skb(RX_BUFFER_AGGRESIZE);
-	pPacket = (PNDIS_PACKET)OSPKT_TO_RTPKT(pSkb);
-	if (pSkb)
-	{
+	pPacket = (void *)OSPKT_TO_RTPKT(pSkb);
+	if (pSkb) {
 
 		/* convert 802.11 to 802.3 packet */
 		pSkb->dev = get_netdev_from_bssid(pAd, BSS0);
 		RTMP_SET_PACKET_SOURCE(pPacket, PKTSRC_NDIS);
 		deaggregate_AMSDU_announce(pAd, pPacket, pData, DataSize);
-	}
-	else
-	{
-		DBGPRINT(RT_DEBUG_ERROR,("Can't allocate skb\n"));
+	} else {
+		DBGPRINT(RT_DEBUG_ERROR, ("Can't allocate skb\n"));
 	}
 }
 
-NDIS_STATUS	RTUSBFreeDescriptorRequest(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			BulkOutPipeId,
-	IN	UINT32			NumberRequired)
-{
-//	UCHAR			FreeNumber = 0;
-//	UINT			Index;
-	NDIS_STATUS		Status = NDIS_STATUS_FAILURE;
-	unsigned long   IrqFlags;
-	HT_TX_CONTEXT	*pHTTXContext;
+/*
+	========================================================================
+
+	Routine	Description:
+		This subroutine will scan through releative ring descriptor to find
+		out avaliable free ring descriptor and compare with request size.
 
+	Arguments:
+		pAd	Pointer	to our adapter
+		RingType	Selected Ring
+
+	Return Value:
+		NDIS_STATUS_FAILURE		Not enough free descriptor
+		NDIS_STATUS_SUCCESS		Enough free descriptor
+
+	Note:
+
+	========================================================================
+*/
+int RTUSBFreeDescriptorRequest(struct rt_rtmp_adapter *pAd,
+				       u8 BulkOutPipeId,
+				       u32 NumberRequired)
+{
+/*      u8                   FreeNumber = 0; */
+/*      u32                    Index; */
+	int Status = NDIS_STATUS_FAILURE;
+	unsigned long IrqFlags;
+	struct rt_ht_tx_context *pHTTXContext;
 
 	pHTTXContext = &pAd->TxContext[BulkOutPipeId];
 	RTMP_IRQ_LOCK(&pAd->TxContextQueueLock[BulkOutPipeId], IrqFlags);
-	if ((pHTTXContext->CurWritePosition < pHTTXContext->NextBulkOutPosition) && ((pHTTXContext->CurWritePosition + NumberRequired + LOCAL_TXBUF_SIZE) > pHTTXContext->NextBulkOutPosition))
-	{
-
-		RTUSB_SET_BULK_FLAG(pAd, (fRTUSB_BULK_OUT_DATA_NORMAL << BulkOutPipeId));
-	}
-	else if ((pHTTXContext->CurWritePosition == 8) && (pHTTXContext->NextBulkOutPosition < (NumberRequired + LOCAL_TXBUF_SIZE)))
-	{
-		RTUSB_SET_BULK_FLAG(pAd, (fRTUSB_BULK_OUT_DATA_NORMAL << BulkOutPipeId));
-	}
-	else if (pHTTXContext->bCurWriting == TRUE)
-	{
-		DBGPRINT(RT_DEBUG_TRACE,("RTUSBFreeD c3 --> QueIdx=%d, CWPos=%ld, NBOutPos=%ld!\n", BulkOutPipeId, pHTTXContext->CurWritePosition, pHTTXContext->NextBulkOutPosition));
-		RTUSB_SET_BULK_FLAG(pAd, (fRTUSB_BULK_OUT_DATA_NORMAL << BulkOutPipeId));
-	}
-	else
-	{
+	if ((pHTTXContext->CurWritePosition < pHTTXContext->NextBulkOutPosition)
+	    &&
+	    ((pHTTXContext->CurWritePosition + NumberRequired +
+	      LOCAL_TXBUF_SIZE) > pHTTXContext->NextBulkOutPosition)) {
+
+		RTUSB_SET_BULK_FLAG(pAd,
+				    (fRTUSB_BULK_OUT_DATA_NORMAL <<
+				     BulkOutPipeId));
+	} else if ((pHTTXContext->CurWritePosition == 8)
+		   && (pHTTXContext->NextBulkOutPosition <
+		       (NumberRequired + LOCAL_TXBUF_SIZE))) {
+		RTUSB_SET_BULK_FLAG(pAd,
+				    (fRTUSB_BULK_OUT_DATA_NORMAL <<
+				     BulkOutPipeId));
+	} else if (pHTTXContext->bCurWriting == TRUE) {
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("RTUSBFreeD c3 --> QueIdx=%d, CWPos=%ld, NBOutPos=%ld!\n",
+			  BulkOutPipeId, pHTTXContext->CurWritePosition,
+			  pHTTXContext->NextBulkOutPosition));
+		RTUSB_SET_BULK_FLAG(pAd,
+				    (fRTUSB_BULK_OUT_DATA_NORMAL <<
+				     BulkOutPipeId));
+	} else {
 		Status = NDIS_STATUS_SUCCESS;
 	}
 	RTMP_IRQ_UNLOCK(&pAd->TxContextQueueLock[BulkOutPipeId], IrqFlags);
 
-
 	return (Status);
 }
 
-NDIS_STATUS RTUSBFreeDescriptorRelease(
-	IN RTMP_ADAPTER *pAd,
-	IN UCHAR		BulkOutPipeId)
+int RTUSBFreeDescriptorRelease(struct rt_rtmp_adapter *pAd,
+				       u8 BulkOutPipeId)
 {
-	unsigned long   IrqFlags;
-	HT_TX_CONTEXT	*pHTTXContext;
+	unsigned long IrqFlags;
+	struct rt_ht_tx_context *pHTTXContext;
 
 	pHTTXContext = &pAd->TxContext[BulkOutPipeId];
 	RTMP_IRQ_LOCK(&pAd->TxContextQueueLock[BulkOutPipeId], IrqFlags);
@@ -121,28 +141,32 @@ NDIS_STATUS RTUSBFreeDescriptorRelease(
 	return (NDIS_STATUS_SUCCESS);
 }
 
-
-BOOLEAN	RTUSBNeedQueueBackForAgg(
-	IN RTMP_ADAPTER *pAd,
-	IN UCHAR		BulkOutPipeId)
+BOOLEAN RTUSBNeedQueueBackForAgg(struct rt_rtmp_adapter *pAd, u8 BulkOutPipeId)
 {
-	unsigned long   IrqFlags;
-	HT_TX_CONTEXT	*pHTTXContext;
-	BOOLEAN			needQueBack = FALSE;
+	unsigned long IrqFlags;
+	struct rt_ht_tx_context *pHTTXContext;
+	BOOLEAN needQueBack = FALSE;
 
 	pHTTXContext = &pAd->TxContext[BulkOutPipeId];
 
 	RTMP_IRQ_LOCK(&pAd->TxContextQueueLock[BulkOutPipeId], IrqFlags);
-	if ((pHTTXContext->IRPPending == TRUE)  /*&& (pAd->TxSwQueue[BulkOutPipeId].Number == 0) */)
-	{
-		if ((pHTTXContext->CurWritePosition < pHTTXContext->ENextBulkOutPosition) &&
-			(((pHTTXContext->ENextBulkOutPosition+MAX_AGGREGATION_SIZE) < MAX_TXBULK_LIMIT) || (pHTTXContext->CurWritePosition > MAX_AGGREGATION_SIZE)))
-		{
+	if ((pHTTXContext->IRPPending ==
+	     TRUE) /*&& (pAd->TxSwQueue[BulkOutPipeId].Number == 0) */ ) {
+		if ((pHTTXContext->CurWritePosition <
+		     pHTTXContext->ENextBulkOutPosition)
+		    &&
+		    (((pHTTXContext->ENextBulkOutPosition +
+		       MAX_AGGREGATION_SIZE) < MAX_TXBULK_LIMIT)
+		     || (pHTTXContext->CurWritePosition >
+			 MAX_AGGREGATION_SIZE))) {
 			needQueBack = TRUE;
-		}
-		else if ((pHTTXContext->CurWritePosition > pHTTXContext->ENextBulkOutPosition) &&
-				 ((pHTTXContext->ENextBulkOutPosition + MAX_AGGREGATION_SIZE) < pHTTXContext->CurWritePosition))
-		{
+		} else
+		    if ((pHTTXContext->CurWritePosition >
+			 pHTTXContext->ENextBulkOutPosition)
+			&&
+			((pHTTXContext->ENextBulkOutPosition +
+			  MAX_AGGREGATION_SIZE) <
+			 pHTTXContext->CurWritePosition)) {
 			needQueBack = TRUE;
 		}
 	}
@@ -152,7 +176,6 @@ BOOLEAN	RTUSBNeedQueueBackForAgg(
 
 }
 
-
 /*
 	========================================================================
 
@@ -168,21 +191,17 @@ BOOLEAN	RTUSBNeedQueueBackForAgg(
 
 	========================================================================
 */
-VOID	RTUSBRejectPendingPackets(
-	IN	PRTMP_ADAPTER	pAd)
+void RTUSBRejectPendingPackets(struct rt_rtmp_adapter *pAd)
 {
-	UCHAR			Index;
-	PQUEUE_ENTRY	pEntry;
-	PNDIS_PACKET	pPacket;
-	PQUEUE_HEADER	pQueue;
+	u8 Index;
+	struct rt_queue_entry *pEntry;
+	void *pPacket;
+	struct rt_queue_header *pQueue;
 
-
-	for (Index = 0; Index < 4; Index++)
-	{
+	for (Index = 0; Index < 4; Index++) {
 		NdisAcquireSpinLock(&pAd->TxSwQueueLock[Index]);
-		while (pAd->TxSwQueue[Index].Head != NULL)
-		{
-			pQueue = (PQUEUE_HEADER) &(pAd->TxSwQueue[Index]);
+		while (pAd->TxSwQueue[Index].Head != NULL) {
+			pQueue = (struct rt_queue_header *)& (pAd->TxSwQueue[Index]);
 			pEntry = RemoveHeadQueue(pQueue);
 			pPacket = QUEUE_ENTRY_TO_PACKET(pEntry);
 			RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_FAILURE);
@@ -193,20 +212,46 @@ VOID	RTUSBRejectPendingPackets(
 
 }
 
-VOID RTMPWriteTxInfo(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PTXINFO_STRUC 	pTxInfo,
-	IN	  USHORT		USBDMApktLen,
-	IN	  BOOLEAN		bWiv,
-	IN	  UCHAR			QueueSel,
-	IN	  UCHAR			NextValid,
-	IN	  UCHAR			TxBurst)
+/*
+	========================================================================
+
+	Routine	Description:
+		Calculates the duration which is required to transmit out frames
+	with given size and specified rate.
+
+	Arguments:
+		pTxD		Pointer to transmit descriptor
+		Ack			Setting for Ack requirement bit
+		Fragment	Setting for Fragment bit
+		RetryMode	Setting for retry mode
+		Ifs			Setting for IFS gap
+		Rate		Setting for transmit rate
+		Service		Setting for service
+		Length		Frame length
+		TxPreamble  Short or Long preamble when using CCK rates
+		QueIdx - 0-3, according to 802.11e/d4.4 June/2003
+
+	Return Value:
+		None
+
+	IRQL = PASSIVE_LEVEL
+	IRQL = DISPATCH_LEVEL
+
+	========================================================================
+*/
+
+void RTMPWriteTxInfo(struct rt_rtmp_adapter *pAd,
+		     struct rt_txinfo *pTxInfo,
+		     u16 USBDMApktLen,
+		     IN BOOLEAN bWiv,
+		     u8 QueueSel, u8 NextValid, u8 TxBurst)
 {
 	pTxInfo->USBDMATxPktLen = USBDMApktLen;
 	pTxInfo->QSEL = QueueSel;
 	if (QueueSel != FIFO_EDCA)
-		DBGPRINT(RT_DEBUG_TRACE, ("====> QueueSel != FIFO_EDCA<============\n"));
-	pTxInfo->USBDMANextVLD = FALSE; //NextValid;  // Need to check with Jan about this.
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("====> QueueSel != FIFO_EDCA<============\n"));
+	pTxInfo->USBDMANextVLD = FALSE;	/*NextValid;  // Need to check with Jan about this. */
 	pTxInfo->USBDMATxburst = TxBurst;
 	pTxInfo->WIV = bWiv;
 	pTxInfo->SwUseLastRound = 0;
@@ -214,3 +259,4 @@ VOID RTMPWriteTxInfo(
 	pTxInfo->rsv2 = 0;
 }
 
+#endif /* RTMP_MAC_USB // */
diff --git a/drivers/staging/rt2870/common/rtusb_io.c b/drivers/staging/rt2870/common/rtusb_io.c
index 1d69590421a3..34443f2243f1 100644
--- a/drivers/staging/rt2870/common/rtusb_io.c
+++ b/drivers/staging/rt2870/common/rtusb_io.c
@@ -36,8 +36,9 @@
 	Paul Lin    06-25-2004  created
 */
 
-#include "../rt_config.h"
+#ifdef RTMP_MAC_USB
 
+#include "../rt_config.h"
 
 /*
 	========================================================================
@@ -55,26 +56,18 @@
 	========================================================================
 */
 
-NTSTATUS	RTUSBFirmwareRun(
-	IN	PRTMP_ADAPTER	pAd)
+static int RTUSBFirmwareRun(struct rt_rtmp_adapter *pAd)
 {
-	NTSTATUS	Status;
-
-	Status = RTUSB_VendorRequest(
-		pAd,
-		USBD_TRANSFER_DIRECTION_OUT,
-		DEVICE_VENDOR_REQUEST_OUT,
-		0x01,
-		0x8,
-		0,
-		NULL,
-		0);
+	int Status;
+
+	Status = RTUSB_VendorRequest(pAd,
+				     USBD_TRANSFER_DIRECTION_OUT,
+				     DEVICE_VENDOR_REQUEST_OUT,
+				     0x01, 0x8, 0, NULL, 0);
 
 	return Status;
 }
 
-
-
 /*
 	========================================================================
 
@@ -90,19 +83,16 @@ NTSTATUS	RTUSBFirmwareRun(
 
 	========================================================================
 */
-NTSTATUS RTUSBFirmwareWrite(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR		pFwImage,
-	IN ULONG		FwLen)
+int RTUSBFirmwareWrite(struct rt_rtmp_adapter *pAd,
+			    u8 *pFwImage, unsigned long FwLen)
 {
-	UINT32		MacReg;
-	NTSTATUS 	Status;
-//	ULONG 		i;
-	USHORT		writeLen;
+	u32 MacReg;
+	int Status;
+/*      unsigned long           i; */
+	u16 writeLen;
 
 	Status = RTUSBReadMACRegister(pAd, MAC_CSR0, &MacReg);
 
-
 	writeLen = FwLen;
 	RTUSBMultiWrite(pAd, FIRMWARE_IMAGE_BASE, pFwImage, writeLen);
 
@@ -110,66 +100,28 @@ NTSTATUS RTUSBFirmwareWrite(
 	Status = RTUSBWriteMACRegister(pAd, 0x701c, 0xffffffff);
 	Status = RTUSBFirmwareRun(pAd);
 
+	/*2008/11/28:KH add to fix the dead rf frequency offset bug<-- */
 	RTMPusecDelay(10000);
-	RTUSBWriteMACRegister(pAd,H2M_MAILBOX_CSR,0);
-	AsicSendCommandToMcu(pAd, 0x72, 0x00, 0x00, 0x00);//reset rf by MCU supported by new firmware
+	RTUSBWriteMACRegister(pAd, H2M_MAILBOX_CSR, 0);
+	AsicSendCommandToMcu(pAd, 0x72, 0x00, 0x00, 0x00);	/*reset rf by MCU supported by new firmware */
+	/*2008/11/28:KH add to fix the dead rf frequency offset bug--> */
 
 	return Status;
 }
 
-
-/*
-	========================================================================
-
-	Routine Description: Get current firmware operation mode (Return Value)
-
-	Arguments:
-
-	Return Value:
-		0 or 1 = Downloaded by host driver
-		others = Driver doesn't download firmware
-
-	IRQL =
-
-	Note:
-
-	========================================================================
-*/
-NTSTATUS	RTUSBFirmwareOpmode(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PUINT32			pValue)
+int RTUSBVenderReset(struct rt_rtmp_adapter *pAd)
 {
-	NTSTATUS	Status;
-
-	Status = RTUSB_VendorRequest(
-		pAd,
-		(USBD_TRANSFER_DIRECTION_IN | USBD_SHORT_TRANSFER_OK),
-		DEVICE_VENDOR_REQUEST_IN,
-		0x1,
-		0x11,
-		0,
-		pValue,
-		4);
-	return Status;
-}
-NTSTATUS	RTUSBVenderReset(
-	IN	PRTMP_ADAPTER	pAd)
-{
-	NTSTATUS	Status;
+	int Status;
 	DBGPRINT_RAW(RT_DEBUG_ERROR, ("-->RTUSBVenderReset\n"));
-	Status = RTUSB_VendorRequest(
-		pAd,
-		USBD_TRANSFER_DIRECTION_OUT,
-		DEVICE_VENDOR_REQUEST_OUT,
-		0x01,
-		0x1,
-		0,
-		NULL,
-		0);
+	Status = RTUSB_VendorRequest(pAd,
+				     USBD_TRANSFER_DIRECTION_OUT,
+				     DEVICE_VENDOR_REQUEST_OUT,
+				     0x01, 0x1, 0, NULL, 0);
 
 	DBGPRINT_RAW(RT_DEBUG_ERROR, ("<--RTUSBVenderReset\n"));
 	return Status;
 }
+
 /*
 	========================================================================
 
@@ -185,23 +137,16 @@ NTSTATUS	RTUSBVenderReset(
 
 	========================================================================
 */
-NTSTATUS	RTUSBMultiRead(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	USHORT			Offset,
-	OUT	PUCHAR			pData,
-	IN	USHORT			length)
+int RTUSBMultiRead(struct rt_rtmp_adapter *pAd,
+			u16 Offset, u8 *pData, u16 length)
 {
-	NTSTATUS	Status;
-
-	Status = RTUSB_VendorRequest(
-		pAd,
-		(USBD_TRANSFER_DIRECTION_IN | USBD_SHORT_TRANSFER_OK),
-		DEVICE_VENDOR_REQUEST_IN,
-		0x7,
-		0,
-		Offset,
-		pData,
-		length);
+	int Status;
+
+	Status = RTUSB_VendorRequest(pAd,
+				     (USBD_TRANSFER_DIRECTION_IN |
+				      USBD_SHORT_TRANSFER_OK),
+				     DEVICE_VENDOR_REQUEST_IN, 0x7, 0, Offset,
+				     pData, length);
 
 	return Status;
 }
@@ -221,77 +166,56 @@ NTSTATUS	RTUSBMultiRead(
 
 	========================================================================
 */
-NTSTATUS	RTUSBMultiWrite_OneByte(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	USHORT			Offset,
-	IN	PUCHAR			pData)
+int RTUSBMultiWrite_OneByte(struct rt_rtmp_adapter *pAd,
+				 u16 Offset, u8 *pData)
 {
-	NTSTATUS	Status;
-
-	// TODO: In 2870, use this funciton carefully cause it's not stable.
-	Status = RTUSB_VendorRequest(
-		pAd,
-		USBD_TRANSFER_DIRECTION_OUT,
-		DEVICE_VENDOR_REQUEST_OUT,
-		0x6,
-		0,
-		Offset,
-		pData,
-		1);
+	int Status;
+
+	/* TODO: In 2870, use this funciton carefully cause it's not stable. */
+	Status = RTUSB_VendorRequest(pAd,
+				     USBD_TRANSFER_DIRECTION_OUT,
+				     DEVICE_VENDOR_REQUEST_OUT,
+				     0x6, 0, Offset, pData, 1);
 
 	return Status;
 }
 
-NTSTATUS	RTUSBMultiWrite(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	USHORT			Offset,
-	IN	PUCHAR			pData,
-	IN	USHORT			length)
+int RTUSBMultiWrite(struct rt_rtmp_adapter *pAd,
+			 u16 Offset, u8 *pData, u16 length)
 {
-	NTSTATUS	Status;
-
-
-        USHORT          index = 0,Value;
-        PUCHAR          pSrc = pData;
-        USHORT          resude = 0;
-
-        resude = length % 2;
-		length  += resude;
-		do
-		{
-			Value =(USHORT)( *pSrc  | (*(pSrc + 1) << 8));
-		Status = RTUSBSingleWrite(pAd,Offset + index,Value);
-            index +=2;
-            length -= 2;
-            pSrc = pSrc + 2;
-        }while(length > 0);
+	int Status;
+
+	u16 index = 0, Value;
+	u8 *pSrc = pData;
+	u16 resude = 0;
+
+	resude = length % 2;
+	length += resude;
+	do {
+		Value = (u16)(*pSrc | (*(pSrc + 1) << 8));
+		Status = RTUSBSingleWrite(pAd, Offset + index, Value);
+		index += 2;
+		length -= 2;
+		pSrc = pSrc + 2;
+	} while (length > 0);
 
 	return Status;
 }
 
-
-NTSTATUS RTUSBSingleWrite(
-	IN 	RTMP_ADAPTER 	*pAd,
-	IN	USHORT			Offset,
-	IN	USHORT			Value)
+int RTUSBSingleWrite(struct rt_rtmp_adapter *pAd,
+			  u16 Offset, u16 Value)
 {
-	NTSTATUS	Status;
-
-	Status = RTUSB_VendorRequest(
-		pAd,
-		USBD_TRANSFER_DIRECTION_OUT,
-		DEVICE_VENDOR_REQUEST_OUT,
-		0x2,
-		Value,
-		Offset,
-		NULL,
-		0);
+	int Status;
+
+	Status = RTUSB_VendorRequest(pAd,
+				     USBD_TRANSFER_DIRECTION_OUT,
+				     DEVICE_VENDOR_REQUEST_OUT,
+				     0x2, Value, Offset, NULL, 0);
 
 	return Status;
 
 }
 
-
 /*
 	========================================================================
 
@@ -307,26 +231,19 @@ NTSTATUS RTUSBSingleWrite(
 
 	========================================================================
 */
-NTSTATUS	RTUSBReadMACRegister(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	USHORT			Offset,
-	OUT	PUINT32			pValue)
+int RTUSBReadMACRegister(struct rt_rtmp_adapter *pAd,
+			      u16 Offset, u32 *pValue)
 {
-	NTSTATUS	Status;
-	UINT32		localVal;
-
-	Status = RTUSB_VendorRequest(
-		pAd,
-		(USBD_TRANSFER_DIRECTION_IN | USBD_SHORT_TRANSFER_OK),
-		DEVICE_VENDOR_REQUEST_IN,
-		0x7,
-		0,
-		Offset,
-		&localVal,
-		4);
+	int Status = 0;
+	u32 localVal;
 
-	*pValue = le2cpu32(localVal);
+	Status = RTUSB_VendorRequest(pAd,
+				     (USBD_TRANSFER_DIRECTION_IN |
+				      USBD_SHORT_TRANSFER_OK),
+				     DEVICE_VENDOR_REQUEST_IN, 0x7, 0, Offset,
+				     &localVal, 4);
 
+	*pValue = le2cpu32(localVal);
 
 	if (Status < 0)
 		*pValue = 0xffffffff;
@@ -334,7 +251,6 @@ NTSTATUS	RTUSBReadMACRegister(
 	return Status;
 }
 
-
 /*
 	========================================================================
 
@@ -350,25 +266,22 @@ NTSTATUS	RTUSBReadMACRegister(
 
 	========================================================================
 */
-NTSTATUS	RTUSBWriteMACRegister(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	USHORT			Offset,
-	IN	UINT32			Value)
+int RTUSBWriteMACRegister(struct rt_rtmp_adapter *pAd,
+			       u16 Offset, u32 Value)
 {
-	NTSTATUS	Status;
-	UINT32		localVal;
+	int Status;
+	u32 localVal;
 
 	localVal = Value;
 
-	Status = RTUSBSingleWrite(pAd, Offset, (USHORT)(localVal & 0xffff));
-	Status = RTUSBSingleWrite(pAd, Offset + 2, (USHORT)((localVal & 0xffff0000) >> 16));
+	Status = RTUSBSingleWrite(pAd, Offset, (u16)(localVal & 0xffff));
+	Status =
+	    RTUSBSingleWrite(pAd, Offset + 2,
+			     (u16)((localVal & 0xffff0000) >> 16));
 
 	return Status;
 }
 
-
-
-#if 1
 /*
 	========================================================================
 
@@ -384,139 +297,77 @@ NTSTATUS	RTUSBWriteMACRegister(
 
 	========================================================================
 */
-NTSTATUS	RTUSBReadBBPRegister(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			Id,
-	IN	PUCHAR			pValue)
+int RTUSBReadBBPRegister(struct rt_rtmp_adapter *pAd,
+			      u8 Id, u8 *pValue)
 {
-	BBP_CSR_CFG_STRUC	BbpCsr;
-	UINT			i = 0;
-	NTSTATUS		status;
+	BBP_CSR_CFG_STRUC BbpCsr;
+	u32 i = 0;
+	int status;
 
-	// Verify the busy condition
-	do
-	{
+	/* Verify the busy condition */
+	do {
 		status = RTUSBReadMACRegister(pAd, BBP_CSR_CFG, &BbpCsr.word);
-		if(status >= 0)
-		{
-		if (!(BbpCsr.field.Busy == BUSY))
-			break;
+		if (status >= 0) {
+			if (!(BbpCsr.field.Busy == BUSY))
+				break;
 		}
-		printk("RTUSBReadBBPRegister(BBP_CSR_CFG_1):retry count=%d!\n", i);
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("RTUSBReadBBPRegister(BBP_CSR_CFG_1):retry count=%d!\n",
+			  i));
 		i++;
-	}
-	while ((i < RETRY_LIMIT) && (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)));
-
-	if ((i == RETRY_LIMIT) || (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)))
-	{
-		//
-		// Read failed then Return Default value.
-		//
+	} while ((i < RETRY_LIMIT)
+		 && (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)));
+
+	if ((i == RETRY_LIMIT)
+	    || (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST))) {
+		/* */
+		/* Read failed then Return Default value. */
+		/* */
 		*pValue = pAd->BbpWriteLatch[Id];
 
-		DBGPRINT_RAW(RT_DEBUG_ERROR, ("Retry count exhausted or device removed!!!\n"));
+		DBGPRINT_RAW(RT_DEBUG_ERROR,
+			     ("Retry count exhausted or device removed!!!\n"));
 		return STATUS_UNSUCCESSFUL;
 	}
-
-	// Prepare for write material
-	BbpCsr.word 				= 0;
-	BbpCsr.field.fRead			= 1;
-	BbpCsr.field.Busy			= 1;
-	BbpCsr.field.RegNum 		= Id;
+	/* Prepare for write material */
+	BbpCsr.word = 0;
+	BbpCsr.field.fRead = 1;
+	BbpCsr.field.Busy = 1;
+	BbpCsr.field.RegNum = Id;
 	RTUSBWriteMACRegister(pAd, BBP_CSR_CFG, BbpCsr.word);
 
 	i = 0;
-	// Verify the busy condition
-	do
-	{
+	/* Verify the busy condition */
+	do {
 		status = RTUSBReadMACRegister(pAd, BBP_CSR_CFG, &BbpCsr.word);
-		if (status >= 0)
-		{
-		if (!(BbpCsr.field.Busy == BUSY))
-		{
-			*pValue = (UCHAR)BbpCsr.field.Value;
-			break;
-		}
+		if (status >= 0) {
+			if (!(BbpCsr.field.Busy == BUSY)) {
+				*pValue = (u8)BbpCsr.field.Value;
+				break;
+			}
 		}
-		printk("RTUSBReadBBPRegister(BBP_CSR_CFG_2):retry count=%d!\n", i);
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("RTUSBReadBBPRegister(BBP_CSR_CFG_2):retry count=%d!\n",
+			  i));
 		i++;
-	}
-	while ((i < RETRY_LIMIT) && (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)));
-
-	if ((i == RETRY_LIMIT) || (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)))
-	{
-		//
-		// Read failed then Return Default value.
-		//
+	} while ((i < RETRY_LIMIT)
+		 && (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)));
+
+	if ((i == RETRY_LIMIT)
+	    || (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST))) {
+		/* */
+		/* Read failed then Return Default value. */
+		/* */
 		*pValue = pAd->BbpWriteLatch[Id];
 
-		DBGPRINT_RAW(RT_DEBUG_ERROR, ("Retry count exhausted or device removed!!!\n"));
+		DBGPRINT_RAW(RT_DEBUG_ERROR,
+			     ("Retry count exhausted or device removed!!!\n"));
 		return STATUS_UNSUCCESSFUL;
 	}
 
 	return STATUS_SUCCESS;
 }
-#else
-/*
-	========================================================================
-
-	Routine Description: Read 8-bit BBP register via firmware
 
-	Arguments:
-
-	Return Value:
-
-	IRQL =
-
-	Note:
-
-	========================================================================
-*/
-NTSTATUS	RTUSBReadBBPRegister(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			Id,
-	IN	PUCHAR			pValue)
-{
-	BBP_CSR_CFG_STRUC	BbpCsr;
-	int					i, k;
-	for (i=0; i<MAX_BUSY_COUNT; i++)
-	{
-		RTUSBReadMACRegister(pAd, H2M_BBP_AGENT, &BbpCsr.word);
-		if (BbpCsr.field.Busy == BUSY)
-		{
-			continue;
-		}
-		BbpCsr.word = 0;
-		BbpCsr.field.fRead = 1;
-		BbpCsr.field.BBP_RW_MODE = 1;
-		BbpCsr.field.Busy = 1;
-		BbpCsr.field.RegNum = Id;
-		RTUSBWriteMACRegister(pAd, H2M_BBP_AGENT, BbpCsr.word);
-		AsicSendCommandToMcu(pAd, 0x80, 0xff, 0x0, 0x0);
-		for (k=0; k<MAX_BUSY_COUNT; k++)
-		{
-			RTUSBReadMACRegister(pAd, H2M_BBP_AGENT, &BbpCsr.word);
-			if (BbpCsr.field.Busy == IDLE)
-				break;
-		}
-		if ((BbpCsr.field.Busy == IDLE) &&
-			(BbpCsr.field.RegNum == Id))
-		{
-			*pValue = (UCHAR)BbpCsr.field.Value;
-			break;
-		}
-	}
-	if (BbpCsr.field.Busy == BUSY)
-	{
-		DBGPRINT_ERR(("BBP read R%d=0x%x fail\n", Id, BbpCsr.word));
-		*pValue = pAd->BbpWriteLatch[Id];
-		return STATUS_UNSUCCESSFUL;
-	}
-	return STATUS_SUCCESS;
-}
-#endif
-
-#if 1
 /*
 	========================================================================
 
@@ -532,95 +383,46 @@ NTSTATUS	RTUSBReadBBPRegister(
 
 	========================================================================
 */
-NTSTATUS	RTUSBWriteBBPRegister(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			Id,
-	IN	UCHAR			Value)
+int RTUSBWriteBBPRegister(struct rt_rtmp_adapter *pAd,
+			       u8 Id, u8 Value)
 {
-	BBP_CSR_CFG_STRUC	BbpCsr;
-	UINT			i = 0;
-	NTSTATUS		status;
-	// Verify the busy condition
-	do
-	{
+	BBP_CSR_CFG_STRUC BbpCsr;
+	u32 i = 0;
+	int status;
+	/* Verify the busy condition */
+	do {
 		status = RTUSBReadMACRegister(pAd, BBP_CSR_CFG, &BbpCsr.word);
-		if (status >= 0)
-		{
-		if (!(BbpCsr.field.Busy == BUSY))
-			break;
+		if (status >= 0) {
+			if (!(BbpCsr.field.Busy == BUSY))
+				break;
 		}
-		printk("RTUSBWriteBBPRegister(BBP_CSR_CFG):retry count=%d!\n", i);
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("RTUSBWriteBBPRegister(BBP_CSR_CFG):retry count=%d!\n",
+			  i));
 		i++;
 	}
-	while ((i < RETRY_LIMIT) && (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)));
+	while ((i < RETRY_LIMIT)
+	       && (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)));
 
-	if ((i == RETRY_LIMIT) || (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)))
-	{
-		DBGPRINT_RAW(RT_DEBUG_ERROR, ("Retry count exhausted or device removed!!!\n"));
+	if ((i == RETRY_LIMIT)
+	    || (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST))) {
+		DBGPRINT_RAW(RT_DEBUG_ERROR,
+			     ("Retry count exhausted or device removed!!!\n"));
 		return STATUS_UNSUCCESSFUL;
 	}
-
-	// Prepare for write material
-	BbpCsr.word 				= 0;
-	BbpCsr.field.fRead			= 0;
-	BbpCsr.field.Value			= Value;
-	BbpCsr.field.Busy			= 1;
-	BbpCsr.field.RegNum 		= Id;
+	/* Prepare for write material */
+	BbpCsr.word = 0;
+	BbpCsr.field.fRead = 0;
+	BbpCsr.field.Value = Value;
+	BbpCsr.field.Busy = 1;
+	BbpCsr.field.RegNum = Id;
 	RTUSBWriteMACRegister(pAd, BBP_CSR_CFG, BbpCsr.word);
 
 	pAd->BbpWriteLatch[Id] = Value;
 
 	return STATUS_SUCCESS;
 }
-#else
-/*
-	========================================================================
 
-	Routine Description: Write 8-bit BBP register via firmware
-
-	Arguments:
-
-	Return Value:
-
-	IRQL =
-
-	Note:
-
-	========================================================================
-*/
-
-NTSTATUS	RTUSBWriteBBPRegister(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			Id,
-	IN	UCHAR			Value)
-
-{
-	BBP_CSR_CFG_STRUC	BbpCsr;
-	int					BusyCnt;
-	for (BusyCnt=0; BusyCnt<MAX_BUSY_COUNT; BusyCnt++)
-	{
-		RTMP_IO_READ32(pAd, H2M_BBP_AGENT, &BbpCsr.word);
-		if (BbpCsr.field.Busy == BUSY)
-			continue;
-		BbpCsr.word = 0;
-		BbpCsr.field.fRead = 0;
-		BbpCsr.field.BBP_RW_MODE = 1;
-		BbpCsr.field.Busy = 1;
-		BbpCsr.field.Value = Value;
-		BbpCsr.field.RegNum = Id;
-		RTMP_IO_WRITE32(pAd, H2M_BBP_AGENT, BbpCsr.word);
-		AsicSendCommandToMcu(pAd, 0x80, 0xff, 0x0, 0x0);
-		pAd->BbpWriteLatch[Id] = Value;
-		break;
-	}
-	if (BusyCnt == MAX_BUSY_COUNT)
-	{
-		DBGPRINT_ERR(("BBP write R%d=0x%x fail\n", Id, BbpCsr.word));
-		return STATUS_UNSUCCESSFUL;
-	}
-	return STATUS_SUCCESS;
-}
-#endif
 /*
 	========================================================================
 
@@ -636,31 +438,31 @@ NTSTATUS	RTUSBWriteBBPRegister(
 
 	========================================================================
 */
-NTSTATUS	RTUSBWriteRFRegister(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UINT32			Value)
+int RTUSBWriteRFRegister(struct rt_rtmp_adapter *pAd, u32 Value)
 {
-	PHY_CSR4_STRUC	PhyCsr4;
-	UINT			i = 0;
-	NTSTATUS		status;
+	PHY_CSR4_STRUC PhyCsr4;
+	u32 i = 0;
+	int status;
 
 	NdisZeroMemory(&PhyCsr4, sizeof(PHY_CSR4_STRUC));
-	do
-	{
+	do {
 		status = RTUSBReadMACRegister(pAd, RF_CSR_CFG0, &PhyCsr4.word);
-		if (status >= 0)
-		{
-		if (!(PhyCsr4.field.Busy))
-			break;
+		if (status >= 0) {
+			if (!(PhyCsr4.field.Busy))
+				break;
 		}
-		printk("RTUSBWriteRFRegister(RF_CSR_CFG0):retry count=%d!\n", i);
+		DBGPRINT(RT_DEBUG_TRACE,
+			 ("RTUSBWriteRFRegister(RF_CSR_CFG0):retry count=%d!\n",
+			  i));
 		i++;
 	}
-	while ((i < RETRY_LIMIT) && (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)));
+	while ((i < RETRY_LIMIT)
+	       && (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)));
 
-	if ((i == RETRY_LIMIT) || (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)))
-	{
-		DBGPRINT_RAW(RT_DEBUG_ERROR, ("Retry count exhausted or device removed!!!\n"));
+	if ((i == RETRY_LIMIT)
+	    || (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST))) {
+		DBGPRINT_RAW(RT_DEBUG_ERROR,
+			     ("Retry count exhausted or device removed!!!\n"));
 		return STATUS_UNSUCCESSFUL;
 	}
 
@@ -672,57 +474,7 @@ NTSTATUS	RTUSBWriteRFRegister(
 /*
 	========================================================================
 
-	Routine Description: Write RT30xx RF register through MAC
-
-	Arguments:
-
-	Return Value:
-
-	IRQL =
-
-	Note:
-
-	========================================================================
-*/
-NTSTATUS RT30xxWriteRFRegister(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			RegID,
-	IN	UCHAR			Value)
-{
-	RF_CSR_CFG_STRUC	rfcsr;
-	UINT				i = 0;
-
-	do
-	{
-		RTMP_IO_READ32(pAd, RF_CSR_CFG, &rfcsr.word);
-
-		if (!rfcsr.field.RF_CSR_KICK)
-			break;
-		i++;
-	}
-	while ((i < RETRY_LIMIT) && (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)));
-
-	if ((i == RETRY_LIMIT) || (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)))
-	{
-		DBGPRINT_RAW(RT_DEBUG_ERROR, ("Retry count exhausted or device removed!!!\n"));
-		return STATUS_UNSUCCESSFUL;
-	}
-
-	rfcsr.field.RF_CSR_WR = 1;
-	rfcsr.field.RF_CSR_KICK = 1;
-	rfcsr.field.TESTCSR_RFACC_REGNUM = RegID;
-	rfcsr.field.RF_CSR_DATA = Value;
-
-	RTMP_IO_WRITE32(pAd, RF_CSR_CFG, rfcsr.word);
-
-	return STATUS_SUCCESS;
-}
-
-
-/*
-	========================================================================
-
-	Routine Description: Read RT30xx RF register through MAC
+	Routine Description:
 
 	Arguments:
 
@@ -734,48 +486,18 @@ NTSTATUS RT30xxWriteRFRegister(
 
 	========================================================================
 */
-NTSTATUS RT30xxReadRFRegister(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			RegID,
-	IN	PUCHAR			pValue)
+int RTUSBReadEEPROM(struct rt_rtmp_adapter *pAd,
+			 u16 Offset, u8 *pData, u16 length)
 {
-	RF_CSR_CFG_STRUC	rfcsr;
-	UINT				i=0, k=0;
-
-	for (i=0; i<MAX_BUSY_COUNT; i++)
-	{
-		RTMP_IO_READ32(pAd, RF_CSR_CFG, &rfcsr.word);
+	int Status = STATUS_SUCCESS;
 
-		if (rfcsr.field.RF_CSR_KICK == BUSY)
-		{
-			continue;
-		}
-		rfcsr.word = 0;
-		rfcsr.field.RF_CSR_WR = 0;
-		rfcsr.field.RF_CSR_KICK = 1;
-		rfcsr.field.TESTCSR_RFACC_REGNUM = RegID;
-		RTMP_IO_WRITE32(pAd, RF_CSR_CFG, rfcsr.word);
-		for (k=0; k<MAX_BUSY_COUNT; k++)
-		{
-			RTMP_IO_READ32(pAd, RF_CSR_CFG, &rfcsr.word);
-
-			if (rfcsr.field.RF_CSR_KICK == IDLE)
-				break;
-		}
-		if ((rfcsr.field.RF_CSR_KICK == IDLE) &&
-			(rfcsr.field.TESTCSR_RFACC_REGNUM == RegID))
-		{
-			*pValue = (UCHAR)rfcsr.field.RF_CSR_DATA;
-			break;
-		}
-	}
-	if (rfcsr.field.RF_CSR_KICK == BUSY)
-	{
-		DBGPRINT_ERR(("RF read R%d=0x%x fail, i[%d], k[%d]\n", RegID, rfcsr.word,i,k));
-		return STATUS_UNSUCCESSFUL;
-	}
+	Status = RTUSB_VendorRequest(pAd,
+				     (USBD_TRANSFER_DIRECTION_IN |
+				      USBD_SHORT_TRANSFER_OK),
+				     DEVICE_VENDOR_REQUEST_IN, 0x9, 0, Offset,
+				     pData, length);
 
-	return STATUS_SUCCESS;
+	return Status;
 }
 
 /*
@@ -793,71 +515,31 @@ NTSTATUS RT30xxReadRFRegister(
 
 	========================================================================
 */
-NTSTATUS	RTUSBReadEEPROM(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	USHORT			Offset,
-	OUT	PUCHAR			pData,
-	IN	USHORT			length)
+int RTUSBWriteEEPROM(struct rt_rtmp_adapter *pAd,
+			  u16 Offset, u8 *pData, u16 length)
 {
-	NTSTATUS	Status = STATUS_SUCCESS;
+	int Status = STATUS_SUCCESS;
 
-	if(pAd->bUseEfuse)
-		Status =eFuseRead(pAd, Offset, pData, length);
-	else
-	{
-	Status = RTUSB_VendorRequest(
-		pAd,
-		(USBD_TRANSFER_DIRECTION_IN | USBD_SHORT_TRANSFER_OK),
-		DEVICE_VENDOR_REQUEST_IN,
-		0x9,
-		0,
-		Offset,
-		pData,
-		length);
-	}
+	Status = RTUSB_VendorRequest(pAd,
+				     USBD_TRANSFER_DIRECTION_OUT,
+				     DEVICE_VENDOR_REQUEST_OUT,
+				     0x8, 0, Offset, pData, length);
 
 	return Status;
 }
 
-/*
-	========================================================================
-
-	Routine Description:
-
-	Arguments:
-
-	Return Value:
-
-	IRQL =
-
-	Note:
-
-	========================================================================
-*/
-NTSTATUS	RTUSBWriteEEPROM(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	USHORT			Offset,
-	IN	PUCHAR			pData,
-	IN	USHORT			length)
+int RTUSBReadEEPROM16(struct rt_rtmp_adapter *pAd,
+			   u16 offset, u16 *pData)
 {
-	NTSTATUS	Status = STATUS_SUCCESS;
+	int status;
+	u16 localData;
 
-	if(pAd->bUseEfuse)
-		Status = eFuseWrite(pAd, Offset, pData, length);
-	else
-	{
-	Status = RTUSB_VendorRequest(
-		pAd,
-		USBD_TRANSFER_DIRECTION_OUT,
-		DEVICE_VENDOR_REQUEST_OUT,
-		0x8,
-		0,
-		Offset,
-		pData,
-		length);
-	}
+	status = RTUSBReadEEPROM(pAd, offset, (u8 *)(&localData), 2);
+	if (status == STATUS_SUCCESS)
+		*pData = le2cpu16(localData);
+
+	return status;
 
-	return Status;
 }
 
 /*
@@ -875,16 +557,15 @@ NTSTATUS	RTUSBWriteEEPROM(
 
 	========================================================================
 */
-VOID RTUSBPutToSleep(
-	IN	PRTMP_ADAPTER	pAd)
+void RTUSBPutToSleep(struct rt_rtmp_adapter *pAd)
 {
-	UINT32		value;
+	u32 value;
 
-	// Timeout 0x40 x 50us
-	value = (SLEEPCID<<16)+(OWNERMCU<<24)+ (0x40<<8)+1;
+	/* Timeout 0x40 x 50us */
+	value = (SLEEPCID << 16) + (OWNERMCU << 24) + (0x40 << 8) + 1;
 	RTUSBWriteMACRegister(pAd, 0x7010, value);
 	RTUSBWriteMACRegister(pAd, 0x404, 0x30);
-	//RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS);
+	/*RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS); */
 	DBGPRINT_RAW(RT_DEBUG_ERROR, ("Sleep Mailbox testvalue %x\n", value));
 
 }
@@ -904,20 +585,14 @@ VOID RTUSBPutToSleep(
 
 	========================================================================
 */
-NTSTATUS RTUSBWakeUp(
-	IN	PRTMP_ADAPTER	pAd)
+int RTUSBWakeUp(struct rt_rtmp_adapter *pAd)
 {
-	NTSTATUS	Status;
-
-	Status = RTUSB_VendorRequest(
-		pAd,
-		USBD_TRANSFER_DIRECTION_OUT,
-		DEVICE_VENDOR_REQUEST_OUT,
-		0x01,
-		0x09,
-		0,
-		NULL,
-		0);
+	int Status;
+
+	Status = RTUSB_VendorRequest(pAd,
+				     USBD_TRANSFER_DIRECTION_OUT,
+				     DEVICE_VENDOR_REQUEST_OUT,
+				     0x01, 0x09, 0, NULL, 0);
 
 	return Status;
 }
@@ -937,13 +612,12 @@ NTSTATUS RTUSBWakeUp(
 
 	========================================================================
 */
-VOID	RTUSBInitializeCmdQ(
-	IN	PCmdQ	cmdq)
+void RTUSBInitializeCmdQ(struct rt_cmdq *cmdq)
 {
 	cmdq->head = NULL;
 	cmdq->tail = NULL;
 	cmdq->size = 0;
-	cmdq->CmdQState = RT2870_THREAD_INITED;
+	cmdq->CmdQState = RTMP_TASK_STAT_INITED;
 }
 
 /*
@@ -961,41 +635,45 @@ VOID	RTUSBInitializeCmdQ(
 
 	========================================================================
 */
-NDIS_STATUS	RTUSBEnqueueCmdFromNdis(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	NDIS_OID		Oid,
-	IN	BOOLEAN			SetInformation,
-	IN	PVOID			pInformationBuffer,
-	IN	UINT32			InformationBufferLength)
+int RTUSBEnqueueCmdFromNdis(struct rt_rtmp_adapter *pAd,
+				    IN NDIS_OID Oid,
+				    IN BOOLEAN SetInformation,
+				    void *pInformationBuffer,
+				    u32 InformationBufferLength)
 {
-	NDIS_STATUS	status;
-	PCmdQElmt	cmdqelmt = NULL;
-	POS_COOKIE pObj = (POS_COOKIE) pAd->OS_Cookie;
+	int status;
+	struct rt_cmdqelmt *cmdqelmt = NULL;
+	struct rt_rtmp_os_task *pTask = &pAd->cmdQTask;
 
-	if (pid_nr(pObj->RTUSBCmdThr_pid) > 0)
-		return (NDIS_STATUS_RESOURCES);
+#ifdef KTHREAD_SUPPORT
+	if (pTask->kthread_task == NULL)
+#else
+	CHECK_PID_LEGALITY(pTask->taskPID) {
+	}
+	else
+#endif
+	return (NDIS_STATUS_RESOURCES);
 
-	status = RTMPAllocateMemory((PVOID *)&cmdqelmt, sizeof(CmdQElmt));
+	status = os_alloc_mem(pAd, (u8 **) (&cmdqelmt), sizeof(struct rt_cmdqelmt));
 	if ((status != NDIS_STATUS_SUCCESS) || (cmdqelmt == NULL))
 		return (NDIS_STATUS_RESOURCES);
 
-		cmdqelmt->buffer = NULL;
-		if (pInformationBuffer != NULL)
-		{
-			status = RTMPAllocateMemory((PVOID *)&cmdqelmt->buffer, InformationBufferLength);
-			if ((status != NDIS_STATUS_SUCCESS) || (cmdqelmt->buffer == NULL))
-			{
-				kfree(cmdqelmt);
-				return (NDIS_STATUS_RESOURCES);
-			}
-			else
-			{
-				NdisMoveMemory(cmdqelmt->buffer, pInformationBuffer, InformationBufferLength);
-				cmdqelmt->bufferlength = InformationBufferLength;
-			}
+	cmdqelmt->buffer = NULL;
+	if (pInformationBuffer != NULL) {
+		status =
+		    os_alloc_mem(pAd, (u8 **) & cmdqelmt->buffer,
+				 InformationBufferLength);
+		if ((status != NDIS_STATUS_SUCCESS)
+		    || (cmdqelmt->buffer == NULL)) {
+			kfree(cmdqelmt);
+			return (NDIS_STATUS_RESOURCES);
+		} else {
+			NdisMoveMemory(cmdqelmt->buffer, pInformationBuffer,
+				       InformationBufferLength);
+			cmdqelmt->bufferlength = InformationBufferLength;
 		}
-		else
-			cmdqelmt->bufferlength = 0;
+	} else
+		cmdqelmt->bufferlength = 0;
 
 	cmdqelmt->command = Oid;
 	cmdqelmt->CmdFromNdis = TRUE;
@@ -1005,28 +683,22 @@ NDIS_STATUS	RTUSBEnqueueCmdFromNdis(
 		cmdqelmt->SetOperation = FALSE;
 
 	NdisAcquireSpinLock(&pAd->CmdQLock);
-	if (pAd->CmdQ.CmdQState & RT2870_THREAD_CAN_DO_INSERT)
-	{
+	if (pAd->CmdQ.CmdQState & RTMP_TASK_CAN_DO_INSERT) {
 		EnqueueCmd((&pAd->CmdQ), cmdqelmt);
 		status = NDIS_STATUS_SUCCESS;
-	}
-	else
-	{
+	} else {
 		status = NDIS_STATUS_FAILURE;
 	}
 	NdisReleaseSpinLock(&pAd->CmdQLock);
 
-	if (status == NDIS_STATUS_FAILURE)
-	{
+	if (status == NDIS_STATUS_FAILURE) {
 		if (cmdqelmt->buffer)
-			NdisFreeMemory(cmdqelmt->buffer, cmdqelmt->bufferlength, 0);
-		NdisFreeMemory(cmdqelmt, sizeof(CmdQElmt), 0);
-	}
-	else
-	RTUSBCMDUp(pAd);
-
+			os_free_mem(pAd, cmdqelmt->buffer);
+		os_free_mem(pAd, cmdqelmt);
+	} else
+		RTUSBCMDUp(pAd);
 
-    return(NDIS_STATUS_SUCCESS);
+	return (NDIS_STATUS_SUCCESS);
 }
 
 /*
@@ -1044,37 +716,33 @@ NDIS_STATUS	RTUSBEnqueueCmdFromNdis(
 
 	========================================================================
 */
-NDIS_STATUS RTUSBEnqueueInternalCmd(
-	IN PRTMP_ADAPTER	pAd,
-	IN NDIS_OID			Oid,
-	IN PVOID			pInformationBuffer,
-	IN UINT32			InformationBufferLength)
+int RTUSBEnqueueInternalCmd(struct rt_rtmp_adapter *pAd,
+				    IN NDIS_OID Oid,
+				    void *pInformationBuffer,
+				    u32 InformationBufferLength)
 {
-	NDIS_STATUS	status;
-	PCmdQElmt	cmdqelmt = NULL;
+	int status;
+	struct rt_cmdqelmt *cmdqelmt = NULL;
 
-
-	status = RTMPAllocateMemory((PVOID *)&cmdqelmt, sizeof(CmdQElmt));
+	status = os_alloc_mem(pAd, (u8 **) & cmdqelmt, sizeof(struct rt_cmdqelmt));
 	if ((status != NDIS_STATUS_SUCCESS) || (cmdqelmt == NULL))
 		return (NDIS_STATUS_RESOURCES);
-	NdisZeroMemory(cmdqelmt, sizeof(CmdQElmt));
-
-	if(InformationBufferLength > 0)
-	{
-		status = RTMPAllocateMemory((PVOID *)&cmdqelmt->buffer, InformationBufferLength);
-		if ((status != NDIS_STATUS_SUCCESS) || (cmdqelmt->buffer == NULL))
-		{
-			NdisFreeMemory(cmdqelmt, sizeof(CmdQElmt), 0);
+	NdisZeroMemory(cmdqelmt, sizeof(struct rt_cmdqelmt));
+
+	if (InformationBufferLength > 0) {
+		status =
+		    os_alloc_mem(pAd, (u8 **) & cmdqelmt->buffer,
+				 InformationBufferLength);
+		if ((status != NDIS_STATUS_SUCCESS)
+		    || (cmdqelmt->buffer == NULL)) {
+			os_free_mem(pAd, cmdqelmt);
 			return (NDIS_STATUS_RESOURCES);
-		}
-		else
-		{
-			NdisMoveMemory(cmdqelmt->buffer, pInformationBuffer, InformationBufferLength);
+		} else {
+			NdisMoveMemory(cmdqelmt->buffer, pInformationBuffer,
+				       InformationBufferLength);
 			cmdqelmt->bufferlength = InformationBufferLength;
 		}
-	}
-	else
-	{
+	} else {
 		cmdqelmt->buffer = NULL;
 		cmdqelmt->bufferlength = 0;
 	}
@@ -1082,30 +750,24 @@ NDIS_STATUS RTUSBEnqueueInternalCmd(
 	cmdqelmt->command = Oid;
 	cmdqelmt->CmdFromNdis = FALSE;
 
-	if (cmdqelmt != NULL)
-	{
+	if (cmdqelmt != NULL) {
 		NdisAcquireSpinLock(&pAd->CmdQLock);
-		if (pAd->CmdQ.CmdQState & RT2870_THREAD_CAN_DO_INSERT)
-		{
+		if (pAd->CmdQ.CmdQState & RTMP_TASK_CAN_DO_INSERT) {
 			EnqueueCmd((&pAd->CmdQ), cmdqelmt);
 			status = NDIS_STATUS_SUCCESS;
-		}
-		else
-		{
+		} else {
 			status = NDIS_STATUS_FAILURE;
 		}
 		NdisReleaseSpinLock(&pAd->CmdQLock);
 
-		if (status == NDIS_STATUS_FAILURE)
-		{
+		if (status == NDIS_STATUS_FAILURE) {
 			if (cmdqelmt->buffer)
-				NdisFreeMemory(cmdqelmt->buffer, cmdqelmt->bufferlength, 0);
-			NdisFreeMemory(cmdqelmt, sizeof(CmdQElmt), 0);
-		}
-		else
-		RTUSBCMDUp(pAd);
+				os_free_mem(pAd, cmdqelmt->buffer);
+			os_free_mem(pAd, cmdqelmt);
+		} else
+			RTUSBCMDUp(pAd);
 	}
-	return(NDIS_STATUS_SUCCESS);
+	return (NDIS_STATUS_SUCCESS);
 }
 
 /*
@@ -1123,14 +785,11 @@ NDIS_STATUS RTUSBEnqueueInternalCmd(
 
 	========================================================================
 */
-VOID	RTUSBDequeueCmd(
-	IN	PCmdQ		cmdq,
-	OUT	PCmdQElmt	*pcmdqelmt)
+void RTUSBDequeueCmd(struct rt_cmdq *cmdq, struct rt_cmdqelmt * * pcmdqelmt)
 {
 	*pcmdqelmt = cmdq->head;
 
-	if (*pcmdqelmt != NULL)
-	{
+	if (*pcmdqelmt != NULL) {
 		cmdq->head = cmdq->head->next;
 		cmdq->size--;
 		if (cmdq->size == 0)
@@ -1164,7 +823,6 @@ VOID	RTUSBDequeueCmd(
 	  method can wait for it to complete.  Since you don't have a handle on
 	  the URB used, you can't cancel the request.
 
-
 	Routine Description:
 
 	Arguments:
@@ -1175,68 +833,109 @@ VOID	RTUSBDequeueCmd(
 
 	========================================================================
 */
-NTSTATUS    RTUSB_VendorRequest(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UINT32			TransferFlags,
-	IN	UCHAR			RequestType,
-	IN	UCHAR			Request,
-	IN	USHORT			Value,
-	IN	USHORT			Index,
-	IN	PVOID			TransferBuffer,
-	IN	UINT32			TransferBufferLength)
+int RTUSB_VendorRequest(struct rt_rtmp_adapter *pAd,
+			     u32 TransferFlags,
+			     u8 RequestType,
+			     u8 Request,
+			     u16 Value,
+			     u16 Index,
+			     void *TransferBuffer,
+			     u32 TransferBufferLength)
 {
-	int				ret;
-	POS_COOKIE		pObj = (POS_COOKIE) pAd->OS_Cookie;
+	int ret = 0;
+	struct os_cookie *pObj = (struct os_cookie *)pAd->OS_Cookie;
 
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST))
-	{
+	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)) {
 		DBGPRINT(RT_DEBUG_ERROR, ("device disconnected\n"));
 		return -1;
-	}
-	else if (in_interrupt())
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("in_interrupt, RTUSB_VendorRequest Request%02x Value%04x Offset%04x\n",Request,Value,Index));
+	} else if (in_interrupt()) {
+		DBGPRINT(RT_DEBUG_ERROR,
+			 ("in_interrupt, RTUSB_VendorRequest Request%02x Value%04x Offset%04x\n",
+			  Request, Value, Index));
 
 		return -1;
-	}
-	else
-	{
+	} else {
 #define MAX_RETRY_COUNT  10
 
 		int retryCount = 0;
-		void	*tmpBuf = TransferBuffer;
+		void *tmpBuf = TransferBuffer;
 
-		// Acquire Control token
-		do {
-		if( RequestType == DEVICE_VENDOR_REQUEST_OUT)
-			ret=usb_control_msg(pObj->pUsb_Dev, usb_sndctrlpipe( pObj->pUsb_Dev, 0 ), Request, RequestType, Value,Index, tmpBuf, TransferBufferLength, CONTROL_TIMEOUT_JIFFIES);
-		else if(RequestType == DEVICE_VENDOR_REQUEST_IN)
-			ret=usb_control_msg(pObj->pUsb_Dev, usb_rcvctrlpipe( pObj->pUsb_Dev, 0 ), Request, RequestType, Value,Index, tmpBuf, TransferBufferLength, CONTROL_TIMEOUT_JIFFIES);
-		else
-		{
-			DBGPRINT(RT_DEBUG_ERROR, ("vendor request direction is failed\n"));
-			ret = -1;
+		ret = down_interruptible(&(pAd->UsbVendorReq_semaphore));
+		if (pAd->UsbVendorReqBuf) {
+			ASSERT(TransferBufferLength < MAX_PARAM_BUFFER_SIZE);
+
+			tmpBuf = (void *)pAd->UsbVendorReqBuf;
+			NdisZeroMemory(pAd->UsbVendorReqBuf,
+				       TransferBufferLength);
+
+			if (RequestType == DEVICE_VENDOR_REQUEST_OUT)
+				NdisMoveMemory(tmpBuf, TransferBuffer,
+					       TransferBufferLength);
 		}
 
+		do {
+			if (RequestType == DEVICE_VENDOR_REQUEST_OUT)
+				ret =
+				    usb_control_msg(pObj->pUsb_Dev,
+						    usb_sndctrlpipe(pObj->
+								    pUsb_Dev,
+								    0), Request,
+						    RequestType, Value, Index,
+						    tmpBuf,
+						    TransferBufferLength,
+						    CONTROL_TIMEOUT_JIFFIES);
+			else if (RequestType == DEVICE_VENDOR_REQUEST_IN)
+				ret =
+				    usb_control_msg(pObj->pUsb_Dev,
+						    usb_rcvctrlpipe(pObj->
+								    pUsb_Dev,
+								    0), Request,
+						    RequestType, Value, Index,
+						    tmpBuf,
+						    TransferBufferLength,
+						    CONTROL_TIMEOUT_JIFFIES);
+			else {
+				DBGPRINT(RT_DEBUG_ERROR,
+					 ("vendor request direction is failed\n"));
+				ret = -1;
+			}
+
 			retryCount++;
 			if (ret < 0) {
-				printk("#\n");
+				DBGPRINT(RT_DEBUG_OFF, ("#\n"));
 				RTMPusecDelay(5000);
 			}
-		} while((ret < 0) && (retryCount < MAX_RETRY_COUNT));
-
-        if (ret < 0) {
-//			DBGPRINT(RT_DEBUG_ERROR, ("USBVendorRequest failed ret=%d \n",ret));
-			DBGPRINT(RT_DEBUG_ERROR, ("RTUSB_VendorRequest failed(%d),TxFlags=0x%x, ReqType=%s, Req=0x%x, Index=0x%x\n",
-						ret, TransferFlags, (RequestType == DEVICE_VENDOR_REQUEST_OUT ? "OUT" : "IN"), Request, Index));
+		} while ((ret < 0) && (retryCount < MAX_RETRY_COUNT));
+
+		if ((pAd->UsbVendorReqBuf)
+		    && (RequestType == DEVICE_VENDOR_REQUEST_IN))
+			NdisMoveMemory(TransferBuffer, tmpBuf,
+				       TransferBufferLength);
+		up(&(pAd->UsbVendorReq_semaphore));
+
+		if (ret < 0) {
+			DBGPRINT(RT_DEBUG_ERROR,
+				 ("RTUSB_VendorRequest failed(%d),TxFlags=0x%x, ReqType=%s, Req=0x%x, Index=0x%x\n",
+				  ret, TransferFlags,
+				  (RequestType ==
+				   DEVICE_VENDOR_REQUEST_OUT ? "OUT" : "IN"),
+				  Request, Index));
 			if (Request == 0x2)
-				DBGPRINT(RT_DEBUG_ERROR, ("\tRequest Value=0x%04x!\n", Value));
+				DBGPRINT(RT_DEBUG_ERROR,
+					 ("\tRequest Value=0x%04x!\n", Value));
+
+			if ((TransferBuffer != NULL)
+			    && (TransferBufferLength > 0))
+				hex_dump("Failed TransferBuffer value",
+					 TransferBuffer, TransferBufferLength);
+		}
 
-			if ((TransferBuffer!= NULL) && (TransferBufferLength > 0))
-				hex_dump("Failed TransferBuffer value", TransferBuffer, TransferBufferLength);
-        }
 	}
-	return ret;
+
+	if (ret != -1)
+		return STATUS_SUCCESS;
+	else
+		return STATUS_UNSUCCESSFUL;
 }
 
 /*
@@ -1255,28 +954,25 @@ NTSTATUS    RTUSB_VendorRequest(
 
 	========================================================================
 */
-NTSTATUS	RTUSB_ResetDevice(
-	IN	PRTMP_ADAPTER	pAd)
+int RTUSB_ResetDevice(struct rt_rtmp_adapter *pAd)
 {
-	NTSTATUS		Status = TRUE;
+	int Status = TRUE;
 
 	DBGPRINT_RAW(RT_DEBUG_TRACE, ("--->USB_ResetDevice\n"));
-	//RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_RESET_IN_PROGRESS);
+	/*RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_RESET_IN_PROGRESS); */
 	return Status;
 }
 
-VOID CMDHandler(
-    IN PRTMP_ADAPTER pAd)
+void CMDHandler(struct rt_rtmp_adapter *pAd)
 {
-	PCmdQElmt		cmdqelmt;
-	PUCHAR			pData;
-	NDIS_STATUS		NdisStatus = NDIS_STATUS_SUCCESS;
-//	ULONG			Now = 0;
-	NTSTATUS		ntStatus;
-//	unsigned long	IrqFlags;
-
-	while (pAd->CmdQ.size > 0)
-	{
+	struct rt_cmdqelmt *cmdqelmt;
+	u8 *pData;
+	int NdisStatus = NDIS_STATUS_SUCCESS;
+/*      unsigned long                   Now = 0; */
+	int ntStatus;
+/*      unsigned long   IrqFlags; */
+
+	while (pAd && pAd->CmdQ.size > 0) {
 		NdisStatus = NDIS_STATUS_SUCCESS;
 
 		NdisAcquireSpinLock(&pAd->CmdQLock);
@@ -1288,591 +984,1129 @@ VOID CMDHandler(
 
 		pData = cmdqelmt->buffer;
 
-		if(!(RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST) || RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS)))
-		{
-			switch (cmdqelmt->command)
-			{
-				case CMDTHREAD_CHECK_GPIO:
-					{
-						UINT32 data;
-
-						{
-							// Read GPIO pin2 as Hardware controlled radio state
-
-							RTUSBReadMACRegister( pAd, GPIO_CTRL_CFG, &data);
-
-							if (data & 0x04)
-							{
-								pAd->StaCfg.bHwRadio = TRUE;
-							}
-							else
-							{
-								pAd->StaCfg.bHwRadio = FALSE;
-							}
+		if (!
+		    (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)
+		     || RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS))) {
+			switch (cmdqelmt->command) {
+			case CMDTHREAD_CHECK_GPIO:
+				{
+					u32 data;
 
-							if(pAd->StaCfg.bRadio != (pAd->StaCfg.bHwRadio && pAd->StaCfg.bSwRadio))
-							{
-								pAd->StaCfg.bRadio = (pAd->StaCfg.bHwRadio && pAd->StaCfg.bSwRadio);
-								if(pAd->StaCfg.bRadio == TRUE)
-								{
-									DBGPRINT_RAW(RT_DEBUG_ERROR, ("!!! Radio On !!!\n"));
-
-									MlmeRadioOn(pAd);
-									// Update extra information
-									pAd->ExtraInfo = EXTRA_INFO_CLEAR;
-								}
-								else
-								{
-									DBGPRINT_RAW(RT_DEBUG_ERROR, ("!!! Radio Off !!!\n"));
+					{
+						/* Read GPIO pin2 as Hardware controlled radio state */
+
+						RTUSBReadMACRegister(pAd,
+								     GPIO_CTRL_CFG,
+								     &data);
+
+						if (data & 0x04) {
+							pAd->StaCfg.bHwRadio =
+							    TRUE;
+						} else {
+							pAd->StaCfg.bHwRadio =
+							    FALSE;
+						}
 
-									MlmeRadioOff(pAd);
-									// Update extra information
-									pAd->ExtraInfo = HW_RADIO_OFF;
-								}
+						if (pAd->StaCfg.bRadio !=
+						    (pAd->StaCfg.bHwRadio
+						     && pAd->StaCfg.bSwRadio)) {
+							pAd->StaCfg.bRadio =
+							    (pAd->StaCfg.
+							     bHwRadio
+							     && pAd->StaCfg.
+							     bSwRadio);
+							if (pAd->StaCfg.
+							    bRadio == TRUE) {
+								DBGPRINT_RAW
+								    (RT_DEBUG_ERROR,
+								     ("!!! Radio On !!!\n"));
+
+								MlmeRadioOn
+								    (pAd);
+								/* Update extra information */
+								pAd->ExtraInfo =
+								    EXTRA_INFO_CLEAR;
+							} else {
+								DBGPRINT_RAW
+								    (RT_DEBUG_ERROR,
+								     ("!!! Radio Off !!!\n"));
+
+								MlmeRadioOff
+								    (pAd);
+								/* Update extra information */
+								pAd->ExtraInfo =
+								    HW_RADIO_OFF;
 							}
 						}
 					}
-					break;
-
-				case CMDTHREAD_QKERIODIC_EXECUT:
-					{
-						StaQuickResponeForRateUpExec(NULL, pAd, NULL, NULL);
-					}
-					break;
+				}
+				break;
 
-				case CMDTHREAD_RESET_BULK_OUT:
-					{
-						UINT32		MACValue;
-						UCHAR		Index;
-						int			ret=0;
-						PHT_TX_CONTEXT	pHTTXContext;
-//						RTMP_TX_RING *pTxRing;
-						unsigned long IrqFlags;
-
-						DBGPRINT_RAW(RT_DEBUG_TRACE, ("CmdThread : CMDTHREAD_RESET_BULK_OUT(ResetPipeid=0x%0x)===>\n", pAd->bulkResetPipeid));
-						// All transfers must be aborted or cancelled before attempting to reset the pipe.
-						//RTUSBCancelPendingBulkOutIRP(pAd);
-						// Wait 10ms to let previous packet that are already in HW FIFO to clear. by MAXLEE 12-25-2007
-						Index = 0;
-						do
-						{
-							RTUSBReadMACRegister(pAd, TXRXQ_PCNT, &MACValue);
-							if ((MACValue & 0xf00000/*0x800000*/) == 0)
-								break;
-							Index++;
-							RTMPusecDelay(10000);
-						}while(Index < 100);
-						MACValue = 0;
-						RTUSBReadMACRegister(pAd, USB_DMA_CFG, &MACValue);
-						// To prevent Read Register error, we 2nd check the validity.
-						if ((MACValue & 0xc00000) == 0)
-							RTUSBReadMACRegister(pAd, USB_DMA_CFG, &MACValue);
-						// To prevent Read Register error, we 3rd check the validity.
-						if ((MACValue & 0xc00000) == 0)
-							RTUSBReadMACRegister(pAd, USB_DMA_CFG, &MACValue);
-						MACValue |= 0x80000;
-						RTUSBWriteMACRegister(pAd, USB_DMA_CFG, MACValue);
-
-						// Wait 1ms to prevent next URB to bulkout before HW reset. by MAXLEE 12-25-2007
-						RTMPusecDelay(1000);
-
-						MACValue &= (~0x80000);
-						RTUSBWriteMACRegister(pAd, USB_DMA_CFG, MACValue);
-						DBGPRINT_RAW(RT_DEBUG_TRACE, ("\tSet 0x2a0 bit19. Clear USB DMA TX path\n"));
-
-						// Wait 5ms to prevent next URB to bulkout before HW reset. by MAXLEE 12-25-2007
-						//RTMPusecDelay(5000);
-
-						if ((pAd->bulkResetPipeid & BULKOUT_MGMT_RESET_FLAG) == BULKOUT_MGMT_RESET_FLAG)
-						{
-							RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_BULKOUT_RESET);
-							if (pAd->MgmtRing.TxSwFreeIdx < MGMT_RING_SIZE /* pMLMEContext->bWaitingBulkOut == TRUE */)
-							{
-								RTUSB_SET_BULK_FLAG(pAd, fRTUSB_BULK_OUT_MLME);
-							}
-							RTUSBKickBulkOut(pAd);
+			case CMDTHREAD_QKERIODIC_EXECUT:
+				{
+					StaQuickResponeForRateUpExec(NULL, pAd,
+								     NULL,
+								     NULL);
+				}
+				break;
 
-							DBGPRINT_RAW(RT_DEBUG_TRACE, ("\tTX MGMT RECOVER Done!\n"));
+			case CMDTHREAD_RESET_BULK_OUT:
+				{
+					u32 MACValue;
+					u8 Index;
+					int ret = 0;
+					struct rt_ht_tx_context *pHTTXContext;
+/*                                              struct rt_rtmp_tx_ring *pTxRing; */
+					unsigned long IrqFlags;
+
+					DBGPRINT_RAW(RT_DEBUG_TRACE,
+						     ("CmdThread : CMDTHREAD_RESET_BULK_OUT(ResetPipeid=0x%0x)===>\n",
+						      pAd->bulkResetPipeid));
+					/* All transfers must be aborted or cancelled before attempting to reset the pipe. */
+					/*RTUSBCancelPendingBulkOutIRP(pAd); */
+					/* Wait 10ms to let previous packet that are already in HW FIFO to clear. by MAXLEE 12-25-2007 */
+					Index = 0;
+					do {
+						RTUSBReadMACRegister(pAd,
+								     TXRXQ_PCNT,
+								     &MACValue);
+						if ((MACValue & 0xf00000
+						     /*0x800000 */ ) == 0)
+							break;
+						Index++;
+						RTMPusecDelay(10000);
+					} while (Index < 100);
+					MACValue = 0;
+					RTUSBReadMACRegister(pAd, USB_DMA_CFG,
+							     &MACValue);
+					/* To prevent Read Register error, we 2nd check the validity. */
+					if ((MACValue & 0xc00000) == 0)
+						RTUSBReadMACRegister(pAd,
+								     USB_DMA_CFG,
+								     &MACValue);
+					/* To prevent Read Register error, we 3rd check the validity. */
+					if ((MACValue & 0xc00000) == 0)
+						RTUSBReadMACRegister(pAd,
+								     USB_DMA_CFG,
+								     &MACValue);
+					MACValue |= 0x80000;
+					RTUSBWriteMACRegister(pAd, USB_DMA_CFG,
+							      MACValue);
+
+					/* Wait 1ms to prevent next URB to bulkout before HW reset. by MAXLEE 12-25-2007 */
+					RTMPusecDelay(1000);
+
+					MACValue &= (~0x80000);
+					RTUSBWriteMACRegister(pAd, USB_DMA_CFG,
+							      MACValue);
+					DBGPRINT_RAW(RT_DEBUG_TRACE,
+						     ("\tSet 0x2a0 bit19. Clear USB DMA TX path\n"));
+
+					/* Wait 5ms to prevent next URB to bulkout before HW reset. by MAXLEE 12-25-2007 */
+					/*RTMPusecDelay(5000); */
+
+					if ((pAd->
+					     bulkResetPipeid &
+					     BULKOUT_MGMT_RESET_FLAG) ==
+					    BULKOUT_MGMT_RESET_FLAG) {
+						RTMP_CLEAR_FLAG(pAd,
+								fRTMP_ADAPTER_BULKOUT_RESET);
+						if (pAd->MgmtRing.TxSwFreeIdx <
+						    MGMT_RING_SIZE
+						    /* pMLMEContext->bWaitingBulkOut == TRUE */
+						    ) {
+							RTUSB_SET_BULK_FLAG(pAd,
+									    fRTUSB_BULK_OUT_MLME);
 						}
-						else
-						{
-							pHTTXContext = &(pAd->TxContext[pAd->bulkResetPipeid]);
-							//NdisAcquireSpinLock(&pAd->BulkOutLock[pAd->bulkResetPipeid]);
-							RTMP_INT_LOCK(&pAd->BulkOutLock[pAd->bulkResetPipeid], IrqFlags);
-							if ( pAd->BulkOutPending[pAd->bulkResetPipeid] == FALSE)
+						RTUSBKickBulkOut(pAd);
+
+						DBGPRINT_RAW(RT_DEBUG_TRACE,
+							     ("\tTX MGMT RECOVER Done!\n"));
+					} else {
+						pHTTXContext =
+						    &(pAd->
+						      TxContext[pAd->
+								bulkResetPipeid]);
+						/*NdisAcquireSpinLock(&pAd->BulkOutLock[pAd->bulkResetPipeid]); */
+						RTMP_INT_LOCK(&pAd->
+							      BulkOutLock[pAd->
+									  bulkResetPipeid],
+							      IrqFlags);
+						if (pAd->
+						    BulkOutPending[pAd->
+								   bulkResetPipeid]
+						    == FALSE) {
+							pAd->
+							    BulkOutPending[pAd->
+									   bulkResetPipeid]
+							    = TRUE;
+							pHTTXContext->
+							    IRPPending = TRUE;
+							pAd->
+							    watchDogTxPendingCnt
+							    [pAd->
+							     bulkResetPipeid] =
+							    1;
+
+							/* no matter what, clean the flag */
+							RTMP_CLEAR_FLAG(pAd,
+									fRTMP_ADAPTER_BULKOUT_RESET);
+
+							/*NdisReleaseSpinLock(&pAd->BulkOutLock[pAd->bulkResetPipeid]); */
+							RTMP_INT_UNLOCK(&pAd->
+									BulkOutLock
+									[pAd->
+									 bulkResetPipeid],
+									IrqFlags);
 							{
-								pAd->BulkOutPending[pAd->bulkResetPipeid] = TRUE;
-								pHTTXContext->IRPPending = TRUE;
-								pAd->watchDogTxPendingCnt[pAd->bulkResetPipeid] = 1;
-
-								// no matter what, clean the flag
-								RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_BULKOUT_RESET);
-
-								//NdisReleaseSpinLock(&pAd->BulkOutLock[pAd->bulkResetPipeid]);
-								RTMP_INT_UNLOCK(&pAd->BulkOutLock[pAd->bulkResetPipeid], IrqFlags);
-/*-----------------------------------------------------------------------------------------------*/
-/*-----------------------------------------------------------------------------------------------*/
-								{
-								RTUSBInitHTTxDesc(pAd, pHTTXContext, pAd->bulkResetPipeid, pHTTXContext->BulkOutSize, (usb_complete_t)RTUSBBulkOutDataPacketComplete);
-
-								if((ret = RTUSB_SUBMIT_URB(pHTTXContext->pUrb))!=0)
-								{
-										RTMP_INT_LOCK(&pAd->BulkOutLock[pAd->bulkResetPipeid], IrqFlags);
-									pAd->BulkOutPending[pAd->bulkResetPipeid] = FALSE;
-									pHTTXContext->IRPPending = FALSE;
-										pAd->watchDogTxPendingCnt[pAd->bulkResetPipeid] = 0;
-										RTMP_INT_UNLOCK(&pAd->BulkOutLock[pAd->bulkResetPipeid], IrqFlags);
-
-										DBGPRINT(RT_DEBUG_ERROR, ("CmdThread : CMDTHREAD_RESET_BULK_OUT: Submit Tx URB failed %d\n", ret));
-								}
-									else
-									{
-										RTMP_IRQ_LOCK(&pAd->BulkOutLock[pAd->bulkResetPipeid], IrqFlags);
-										DBGPRINT_RAW(RT_DEBUG_TRACE,("\tCMDTHREAD_RESET_BULK_OUT: TxContext[%d]:CWPos=%ld, NBPos=%ld, ENBPos=%ld, bCopy=%d, pending=%d!\n",
-												pAd->bulkResetPipeid, pHTTXContext->CurWritePosition, pHTTXContext->NextBulkOutPosition,
-															pHTTXContext->ENextBulkOutPosition, pHTTXContext->bCopySavePad, pAd->BulkOutPending[pAd->bulkResetPipeid]));
-										DBGPRINT_RAW(RT_DEBUG_TRACE,("\t\tBulkOut Req=0x%lx, Complete=0x%lx, Other=0x%lx\n",
-															pAd->BulkOutReq, pAd->BulkOutComplete, pAd->BulkOutCompleteOther));
-										RTMP_IRQ_UNLOCK(&pAd->BulkOutLock[pAd->bulkResetPipeid], IrqFlags);
-										DBGPRINT_RAW(RT_DEBUG_TRACE, ("\tCMDTHREAD_RESET_BULK_OUT: Submit Tx DATA URB for failed BulkReq(0x%lx) Done, status=%d!\n", pAd->bulkResetReq[pAd->bulkResetPipeid], pHTTXContext->pUrb->status));
-
-									}
+								RTUSBInitHTTxDesc
+								    (pAd,
+								     pHTTXContext,
+								     pAd->
+								     bulkResetPipeid,
+								     pHTTXContext->
+								     BulkOutSize,
+								     (usb_complete_t)
+								     RTUSBBulkOutDataPacketComplete);
+
+								if ((ret =
+								     RTUSB_SUBMIT_URB
+								     (pHTTXContext->
+								      pUrb)) !=
+								    0) {
+									RTMP_INT_LOCK
+									    (&pAd->
+									     BulkOutLock
+									     [pAd->
+									      bulkResetPipeid],
+									     IrqFlags);
+									pAd->
+									    BulkOutPending
+									    [pAd->
+									     bulkResetPipeid]
+									    =
+									    FALSE;
+									pHTTXContext->
+									    IRPPending
+									    =
+									    FALSE;
+									pAd->
+									    watchDogTxPendingCnt
+									    [pAd->
+									     bulkResetPipeid]
+									    = 0;
+									RTMP_INT_UNLOCK
+									    (&pAd->
+									     BulkOutLock
+									     [pAd->
+									      bulkResetPipeid],
+									     IrqFlags);
+
+									DBGPRINT
+									    (RT_DEBUG_ERROR,
+									     ("CmdThread : CMDTHREAD_RESET_BULK_OUT: Submit Tx URB failed %d\n",
+									      ret));
+								} else {
+									RTMP_IRQ_LOCK
+									    (&pAd->
+									     BulkOutLock
+									     [pAd->
+									      bulkResetPipeid],
+									     IrqFlags);
+									DBGPRINT_RAW
+									    (RT_DEBUG_TRACE,
+									     ("\tCMDTHREAD_RESET_BULK_OUT: TxContext[%d]:CWPos=%ld, NBPos=%ld, ENBPos=%ld, bCopy=%d, pending=%d!\n",
+									      pAd->
+									      bulkResetPipeid,
+									      pHTTXContext->
+									      CurWritePosition,
+									      pHTTXContext->
+									      NextBulkOutPosition,
+									      pHTTXContext->
+									      ENextBulkOutPosition,
+									      pHTTXContext->
+									      bCopySavePad,
+									      pAd->
+									      BulkOutPending
+									      [pAd->
+									       bulkResetPipeid]));
+									DBGPRINT_RAW
+									    (RT_DEBUG_TRACE,
+									     ("\t\tBulkOut Req=0x%lx, Complete=0x%lx, Other=0x%lx\n",
+									      pAd->
+									      BulkOutReq,
+									      pAd->
+									      BulkOutComplete,
+									      pAd->
+									      BulkOutCompleteOther));
+									RTMP_IRQ_UNLOCK
+									    (&pAd->
+									     BulkOutLock
+									     [pAd->
+									      bulkResetPipeid],
+									     IrqFlags);
+									DBGPRINT_RAW
+									    (RT_DEBUG_TRACE,
+									     ("\tCMDTHREAD_RESET_BULK_OUT: Submit Tx DATA URB for failed BulkReq(0x%lx) Done, status=%d!\n",
+									      pAd->
+									      bulkResetReq
+									      [pAd->
+									       bulkResetPipeid],
+									      pHTTXContext->
+									      pUrb->
+									      status));
+
 								}
 							}
-							else
-							{
-								//NdisReleaseSpinLock(&pAd->BulkOutLock[pAd->bulkResetPipeid]);
-								//RTMP_INT_UNLOCK(&pAd->BulkOutLock[pAd->bulkResetPipeid], IrqFlags);
-
-								DBGPRINT_RAW(RT_DEBUG_ERROR, ("CmdThread : TX DATA RECOVER FAIL for BulkReq(0x%lx) because BulkOutPending[%d] is TRUE!\n", pAd->bulkResetReq[pAd->bulkResetPipeid], pAd->bulkResetPipeid));
-								if (pAd->bulkResetPipeid == 0)
-								{
-									UCHAR	pendingContext = 0;
-									PHT_TX_CONTEXT pHTTXContext = (PHT_TX_CONTEXT)(&pAd->TxContext[pAd->bulkResetPipeid ]);
-									PTX_CONTEXT pMLMEContext = (PTX_CONTEXT)(pAd->MgmtRing.Cell[pAd->MgmtRing.TxDmaIdx].AllocVa);
-									PTX_CONTEXT pNULLContext = (PTX_CONTEXT)(&pAd->PsPollContext);
-									PTX_CONTEXT pPsPollContext = (PTX_CONTEXT)(&pAd->NullContext);
-
-									if (pHTTXContext->IRPPending)
-										pendingContext |= 1;
-									else if (pMLMEContext->IRPPending)
-										pendingContext |= 2;
-									else if (pNULLContext->IRPPending)
-										pendingContext |= 4;
-									else if (pPsPollContext->IRPPending)
-										pendingContext |= 8;
-									else
-										pendingContext = 0;
-
-									DBGPRINT_RAW(RT_DEBUG_ERROR, ("\tTX Occupied by %d!\n", pendingContext));
-								}
-
-							// no matter what, clean the flag
-							RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_BULKOUT_RESET);
-
-								RTMP_INT_UNLOCK(&pAd->BulkOutLock[pAd->bulkResetPipeid], IrqFlags);
+						} else {
+							/*NdisReleaseSpinLock(&pAd->BulkOutLock[pAd->bulkResetPipeid]); */
+							/*RTMP_INT_UNLOCK(&pAd->BulkOutLock[pAd->bulkResetPipeid], IrqFlags); */
+
+							DBGPRINT_RAW
+							    (RT_DEBUG_ERROR,
+							     ("CmdThread : TX DATA RECOVER FAIL for BulkReq(0x%lx) because BulkOutPending[%d] is TRUE!\n",
+							      pAd->
+							      bulkResetReq[pAd->
+									   bulkResetPipeid],
+							      pAd->
+							      bulkResetPipeid));
+							if (pAd->
+							    bulkResetPipeid ==
+							    0) {
+								u8
+								    pendingContext
+								    = 0;
+								struct rt_ht_tx_context *
+								    pHTTXContext
+								    =
+								    (struct rt_ht_tx_context *)
+								    (&pAd->
+								     TxContext
+								     [pAd->
+								      bulkResetPipeid]);
+								struct rt_tx_context *
+								    pMLMEContext
+								    =
+								    (struct rt_tx_context *)
+								    (pAd->
+								     MgmtRing.
+								     Cell[pAd->
+									  MgmtRing.
+									  TxDmaIdx].
+								     AllocVa);
+								struct rt_tx_context *
+								    pNULLContext
+								    =
+								    (struct rt_tx_context *)
+								    (&pAd->
+								     PsPollContext);
+								struct rt_tx_context *
+								    pPsPollContext
+								    =
+								    (struct rt_tx_context *)
+								    (&pAd->
+								     NullContext);
+
+								if (pHTTXContext->IRPPending)
+									pendingContext
+									    |=
+									    1;
+								else if
+								    (pMLMEContext->
+								     IRPPending)
+									pendingContext
+									    |=
+									    2;
+								else if
+								    (pNULLContext->
+								     IRPPending)
+									pendingContext
+									    |=
+									    4;
+								else if
+								    (pPsPollContext->
+								     IRPPending)
+									pendingContext
+									    |=
+									    8;
+								else
+									pendingContext
+									    = 0;
 
-								RTUSB_SET_BULK_FLAG(pAd, (fRTUSB_BULK_OUT_DATA_NORMAL << pAd->bulkResetPipeid));
+								DBGPRINT_RAW
+								    (RT_DEBUG_ERROR,
+								     ("\tTX Occupied by %d!\n",
+								      pendingContext));
 							}
-
-							RTMPDeQueuePacket(pAd, FALSE, NUM_OF_TX_RING, MAX_TX_PROCESS);
-							//RTUSBKickBulkOut(pAd);
+							/* no matter what, clean the flag */
+							RTMP_CLEAR_FLAG(pAd,
+									fRTMP_ADAPTER_BULKOUT_RESET);
+
+							RTMP_INT_UNLOCK(&pAd->
+									BulkOutLock
+									[pAd->
+									 bulkResetPipeid],
+									IrqFlags);
+
+							RTUSB_SET_BULK_FLAG(pAd,
+									    (fRTUSB_BULK_OUT_DATA_NORMAL
+									     <<
+									     pAd->
+									     bulkResetPipeid));
 						}
 
+						RTMPDeQueuePacket(pAd, FALSE,
+								  NUM_OF_TX_RING,
+								  MAX_TX_PROCESS);
+						/*RTUSBKickBulkOut(pAd); */
 					}
-					/*
-						// Don't cancel BULKIN.
-						while ((atomic_read(&pAd->PendingRx) > 0) &&
-								(!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)))
-						{
-							if (atomic_read(&pAd->PendingRx) > 0)
-							{
-								DBGPRINT_RAW(RT_DEBUG_ERROR, ("BulkIn IRP Pending!!cancel it!\n"));
-								RTUSBCancelPendingBulkInIRP(pAd);
-							}
-							RTMPusecDelay(100000);
-						}
 
-						if ((atomic_read(&pAd->PendingRx) == 0) && (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS)))
-						{
-							UCHAR	i;
-							RTUSBRxPacket(pAd);
-							pAd->NextRxBulkInReadIndex = 0;	// Next Rx Read index
-							pAd->NextRxBulkInIndex		= 0;	// Rx Bulk pointer
-							for (i = 0; i < (RX_RING_SIZE); i++)
-							{
-								PRX_CONTEXT  pRxContext = &(pAd->RxContext[i]);
+				}
+				/*
+				   // Don't cancel BULKIN.
+				   while ((atomic_read(&pAd->PendingRx) > 0) &&
+				   (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)))
+				   {
+				   if (atomic_read(&pAd->PendingRx) > 0)
+				   {
+				   DBGPRINT_RAW(RT_DEBUG_ERROR, ("BulkIn IRP Pending!!cancel it!\n"));
+				   RTUSBCancelPendingBulkInIRP(pAd);
+				   }
+				   RTMPusecDelay(100000);
+				   }
+
+				   if ((atomic_read(&pAd->PendingRx) == 0) && (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS)))
+				   {
+				   u8        i;
+				   RTUSBRxPacket(pAd);
+				   pAd->NextRxBulkInReadIndex = 0;      // Next Rx Read index
+				   pAd->NextRxBulkInIndex               = 0;    // Rx Bulk pointer
+				   for (i = 0; i < (RX_RING_SIZE); i++)
+				   {
+				   struct rt_rx_context *pRxContext = &(pAd->RxContext[i]);
+
+				   pRxContext->pAd      = pAd;
+				   pRxContext->InUse            = FALSE;
+				   pRxContext->IRPPending       = FALSE;
+				   pRxContext->Readable = FALSE;
+				   pRxContext->ReorderInUse = FALSE;
+
+				   }
+				   RTUSBBulkReceive(pAd);
+				   DBGPRINT_RAW(RT_DEBUG_ERROR, ("RTUSBBulkReceive\n"));
+				   } */
+				DBGPRINT_RAW(RT_DEBUG_TRACE,
+					     ("CmdThread : CMDTHREAD_RESET_BULK_OUT<===\n"));
+				break;
 
-								pRxContext->pAd	= pAd;
-								pRxContext->InUse		= FALSE;
-								pRxContext->IRPPending	= FALSE;
-								pRxContext->Readable	= FALSE;
-								pRxContext->ReorderInUse = FALSE;
+			case CMDTHREAD_RESET_BULK_IN:
+				DBGPRINT_RAW(RT_DEBUG_TRACE,
+					     ("CmdThread : CMDTHREAD_RESET_BULK_IN === >\n"));
 
-							}
-							RTUSBBulkReceive(pAd);
-							DBGPRINT_RAW(RT_DEBUG_ERROR, ("RTUSBBulkReceive\n"));
-						}*/
-					DBGPRINT_RAW(RT_DEBUG_TRACE, ("CmdThread : CMDTHREAD_RESET_BULK_OUT<===\n"));
-    	   			break;
+				/* All transfers must be aborted or cancelled before attempting to reset the pipe. */
+				{
+					u32 MACValue;
 
-				case CMDTHREAD_RESET_BULK_IN:
-					DBGPRINT_RAW(RT_DEBUG_TRACE, ("CmdThread : CMDTHREAD_RESET_BULK_IN === >\n"));
-
-					// All transfers must be aborted or cancelled before attempting to reset the pipe.
 					{
-						UINT32		MACValue;
-/*-----------------------------------------------------------------------------------------------*/
-/*-----------------------------------------------------------------------------------------------*/
-						{
-						//while ((atomic_read(&pAd->PendingRx) > 0) && (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)))
-						if((pAd->PendingRx > 0) && (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)))
+						/*while ((atomic_read(&pAd->PendingRx) > 0) && (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST))) */
+						if ((pAd->PendingRx > 0)
+						    &&
+						    (!RTMP_TEST_FLAG
+						     (pAd,
+						      fRTMP_ADAPTER_NIC_NOT_EXIST)))
 						{
-							DBGPRINT_RAW(RT_DEBUG_ERROR, ("BulkIn IRP Pending!!!\n"));
-							RTUSBCancelPendingBulkInIRP(pAd);
+							DBGPRINT_RAW
+							    (RT_DEBUG_ERROR,
+							     ("BulkIn IRP Pending!!!\n"));
+							RTUSBCancelPendingBulkInIRP
+							    (pAd);
 							RTMPusecDelay(100000);
 							pAd->PendingRx = 0;
 						}
-						}
-
-						// Wait 10ms before reading register.
-						RTMPusecDelay(10000);
-						ntStatus = RTUSBReadMACRegister(pAd, MAC_CSR0, &MACValue);
-
-						if ((NT_SUCCESS(ntStatus) == TRUE) &&
-							(!(RTMP_TEST_FLAG(pAd, (fRTMP_ADAPTER_RESET_IN_PROGRESS | fRTMP_ADAPTER_RADIO_OFF |
-													fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST)))))
-						{
-							UCHAR	i;
+					}
 
-							if (RTMP_TEST_FLAG(pAd, (fRTMP_ADAPTER_RESET_IN_PROGRESS | fRTMP_ADAPTER_RADIO_OFF |
-														fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST)))
+					/* Wait 10ms before reading register. */
+					RTMPusecDelay(10000);
+					ntStatus =
+					    RTUSBReadMACRegister(pAd, MAC_CSR0,
+								 &MACValue);
+
+					if ((NT_SUCCESS(ntStatus) == TRUE) &&
+					    (!(RTMP_TEST_FLAG
+					       (pAd,
+						(fRTMP_ADAPTER_RESET_IN_PROGRESS
+						 | fRTMP_ADAPTER_RADIO_OFF |
+						 fRTMP_ADAPTER_HALT_IN_PROGRESS
+						 |
+						 fRTMP_ADAPTER_NIC_NOT_EXIST)))))
+					{
+						u8 i;
+
+						if (RTMP_TEST_FLAG
+						    (pAd,
+						     (fRTMP_ADAPTER_RESET_IN_PROGRESS
+						      | fRTMP_ADAPTER_RADIO_OFF
+						      |
+						      fRTMP_ADAPTER_HALT_IN_PROGRESS
+						      |
+						      fRTMP_ADAPTER_NIC_NOT_EXIST)))
+							break;
+						pAd->NextRxBulkInPosition =
+						    pAd->RxContext[pAd->
+								   NextRxBulkInIndex].
+						    BulkInOffset;
+						DBGPRINT(RT_DEBUG_TRACE,
+							 ("BULK_IN_RESET: NBIIdx=0x%x,NBIRIdx=0x%x, BIRPos=0x%lx. BIReq=x%lx, BIComplete=0x%lx, BICFail0x%lx\n",
+							  pAd->
+							  NextRxBulkInIndex,
+							  pAd->
+							  NextRxBulkInReadIndex,
+							  pAd->
+							  NextRxBulkInPosition,
+							  pAd->BulkInReq,
+							  pAd->BulkInComplete,
+							  pAd->
+							  BulkInCompleteFail));
+						for (i = 0; i < RX_RING_SIZE;
+						     i++) {
+							DBGPRINT(RT_DEBUG_TRACE,
+								 ("\tRxContext[%d]: IRPPending=%d, InUse=%d, Readable=%d!\n",
+								  i,
+								  pAd->
+								  RxContext[i].
+								  IRPPending,
+								  pAd->
+								  RxContext[i].
+								  InUse,
+								  pAd->
+								  RxContext[i].
+								  Readable));
+						}
+						/*
+
+						   DBGPRINT_RAW(RT_DEBUG_ERROR, ("==========================================\n"));
+
+						   pAd->NextRxBulkInReadIndex = 0;      // Next Rx Read index
+						   pAd->NextRxBulkInIndex               = 0;    // Rx Bulk pointer
+						   for (i = 0; i < (RX_RING_SIZE); i++)
+						   {
+						   struct rt_rx_context *pRxContext = &(pAd->RxContext[i]);
+
+						   pRxContext->pAd      = pAd;
+						   pRxContext->InUse            = FALSE;
+						   pRxContext->IRPPending       = FALSE;
+						   pRxContext->Readable = FALSE;
+						   pRxContext->ReorderInUse = FALSE;
+
+						   } */
+						RTMP_CLEAR_FLAG(pAd,
+								fRTMP_ADAPTER_BULKIN_RESET);
+						for (i = 0;
+						     i <
+						     pAd->CommonCfg.
+						     NumOfBulkInIRP; i++) {
+							/*RTUSBBulkReceive(pAd); */
+							struct rt_rx_context *pRxContext;
+							PURB pUrb;
+							int ret = 0;
+							unsigned long IrqFlags;
+
+							RTMP_IRQ_LOCK(&pAd->
+								      BulkInLock,
+								      IrqFlags);
+							pRxContext =
+							    &(pAd->
+							      RxContext[pAd->
+									NextRxBulkInIndex]);
+							if ((pAd->PendingRx > 0)
+							    || (pRxContext->
+								Readable ==
+								TRUE)
+							    || (pRxContext->
+								InUse ==
+								TRUE)) {
+								RTMP_IRQ_UNLOCK
+								    (&pAd->
+								     BulkInLock,
+								     IrqFlags);
 								break;
-							pAd->NextRxBulkInPosition = pAd->RxContext[pAd->NextRxBulkInIndex].BulkInOffset;
-							DBGPRINT(RT_DEBUG_TRACE, ("BULK_IN_RESET: NBIIdx=0x%x,NBIRIdx=0x%x, BIRPos=0x%lx. BIReq=x%lx, BIComplete=0x%lx, BICFail0x%lx\n",
-									pAd->NextRxBulkInIndex,  pAd->NextRxBulkInReadIndex, pAd->NextRxBulkInPosition, pAd->BulkInReq, pAd->BulkInComplete, pAd->BulkInCompleteFail));
-							for (i = 0; i < RX_RING_SIZE; i++)
-							{
- 								DBGPRINT(RT_DEBUG_TRACE, ("\tRxContext[%d]: IRPPending=%d, InUse=%d, Readable=%d!\n"
-									, i, pAd->RxContext[i].IRPPending, pAd->RxContext[i].InUse, pAd->RxContext[i].Readable));
 							}
- 							/*
-
-							DBGPRINT_RAW(RT_DEBUG_ERROR, ("==========================================\n"));
-
-							pAd->NextRxBulkInReadIndex = 0;	// Next Rx Read index
-							pAd->NextRxBulkInIndex		= 0;	// Rx Bulk pointer
-							for (i = 0; i < (RX_RING_SIZE); i++)
-							{
-								PRX_CONTEXT  pRxContext = &(pAd->RxContext[i]);
-
-								pRxContext->pAd	= pAd;
-								pRxContext->InUse		= FALSE;
-								pRxContext->IRPPending	= FALSE;
-								pRxContext->Readable	= FALSE;
-								pRxContext->ReorderInUse = FALSE;
-
-							}*/
-							RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_BULKIN_RESET);
-							for (i = 0; i < pAd->CommonCfg.NumOfBulkInIRP; i++)
-							{
-								//RTUSBBulkReceive(pAd);
-								PRX_CONTEXT		pRxContext;
-								PURB			pUrb;
-								int				ret = 0;
-								unsigned long	IrqFlags;
-
-
-								RTMP_IRQ_LOCK(&pAd->BulkInLock, IrqFlags);
-								pRxContext = &(pAd->RxContext[pAd->NextRxBulkInIndex]);
-								if ((pAd->PendingRx > 0) || (pRxContext->Readable == TRUE) || (pRxContext->InUse == TRUE))
-								{
-									RTMP_IRQ_UNLOCK(&pAd->BulkInLock, IrqFlags);
-									break;
-								}
-								pRxContext->InUse = TRUE;
-								pRxContext->IRPPending = TRUE;
-								pAd->PendingRx++;
-								pAd->BulkInReq++;
-								RTMP_IRQ_UNLOCK(&pAd->BulkInLock, IrqFlags);
-
-								// Init Rx context descriptor
-								RTUSBInitRxDesc(pAd, pRxContext);
-								pUrb = pRxContext->pUrb;
-								if ((ret = RTUSB_SUBMIT_URB(pUrb))!=0)
-								{	// fail
-
-									RTMP_IRQ_LOCK(&pAd->BulkInLock, IrqFlags);
-									pRxContext->InUse = FALSE;
-									pRxContext->IRPPending = FALSE;
-									pAd->PendingRx--;
-									pAd->BulkInReq--;
-									RTMP_IRQ_UNLOCK(&pAd->BulkInLock, IrqFlags);
-									DBGPRINT(RT_DEBUG_ERROR, ("CMDTHREAD_RESET_BULK_IN: Submit Rx URB failed(%d), status=%d\n", ret, pUrb->status));
-								}
-								else
-								{	// success
-									DBGPRINT_RAW(RT_DEBUG_TRACE, ("CMDTHREAD_RESET_BULK_IN: Submit Rx URB Done, status=%d!\n", pUrb->status));
-									ASSERT((pRxContext->InUse == pRxContext->IRPPending));
-								}
-							}
-
-						}
-						else
-						{
-							// Card must be removed
-							if (NT_SUCCESS(ntStatus) != TRUE)
-							{
-							RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST);
-								DBGPRINT_RAW(RT_DEBUG_ERROR, ("CMDTHREAD_RESET_BULK_IN: Read Register Failed!Card must be removed!!\n\n"));
+							pRxContext->InUse =
+							    TRUE;
+							pRxContext->IRPPending =
+							    TRUE;
+							pAd->PendingRx++;
+							pAd->BulkInReq++;
+							RTMP_IRQ_UNLOCK(&pAd->
+									BulkInLock,
+									IrqFlags);
+
+							/* Init Rx context descriptor */
+							RTUSBInitRxDesc(pAd,
+									pRxContext);
+							pUrb = pRxContext->pUrb;
+							if ((ret = RTUSB_SUBMIT_URB(pUrb)) != 0) {	/* fail */
+
+								RTMP_IRQ_LOCK
+								    (&pAd->
+								     BulkInLock,
+								     IrqFlags);
+								pRxContext->
+								    InUse =
+								    FALSE;
+								pRxContext->
+								    IRPPending =
+								    FALSE;
+								pAd->
+								    PendingRx--;
+								pAd->
+								    BulkInReq--;
+								RTMP_IRQ_UNLOCK
+								    (&pAd->
+								     BulkInLock,
+								     IrqFlags);
+								DBGPRINT
+								    (RT_DEBUG_ERROR,
+								     ("CMDTHREAD_RESET_BULK_IN: Submit Rx URB failed(%d), status=%d\n",
+								      ret,
+								      pUrb->
+								      status));
+							} else {	/* success */
+								/*DBGPRINT(RT_DEBUG_TRACE, ("BIDone, Pend=%d,BIIdx=%d,BIRIdx=%d!\n", */
+								/*                                                      pAd->PendingRx, pAd->NextRxBulkInIndex, pAd->NextRxBulkInReadIndex)); */
+								DBGPRINT_RAW
+								    (RT_DEBUG_TRACE,
+								     ("CMDTHREAD_RESET_BULK_IN: Submit Rx URB Done, status=%d!\n",
+								      pUrb->
+								      status));
+								ASSERT((pRxContext->InUse == pRxContext->IRPPending));
 							}
-							else
-							{
-								DBGPRINT_RAW(RT_DEBUG_ERROR, ("CMDTHREAD_RESET_BULK_IN: Cannot do bulk in because flags(0x%lx) on !\n", pAd->Flags));
 						}
-					}
-					}
-					DBGPRINT_RAW(RT_DEBUG_TRACE, ("CmdThread : CMDTHREAD_RESET_BULK_IN <===\n"));
-					break;
 
-				case CMDTHREAD_SET_ASIC_WCID:
-					{
-						RT_SET_ASIC_WCID	SetAsicWcid;
-						USHORT		offset;
-						UINT32		MACValue, MACRValue = 0;
-						SetAsicWcid = *((PRT_SET_ASIC_WCID)(pData));
-
-						if (SetAsicWcid.WCID >= MAX_LEN_OF_MAC_TABLE)
-							return;
-
-						offset = MAC_WCID_BASE + ((UCHAR)SetAsicWcid.WCID)*HW_WCID_ENTRY_SIZE;
-
-						DBGPRINT_RAW(RT_DEBUG_TRACE, ("CmdThread : CMDTHREAD_SET_ASIC_WCID : WCID = %ld, SetTid  = %lx, DeleteTid = %lx.\n", SetAsicWcid.WCID, SetAsicWcid.SetTid, SetAsicWcid.DeleteTid));
-						MACValue = (pAd->MacTab.Content[SetAsicWcid.WCID].Addr[3]<<24)+(pAd->MacTab.Content[SetAsicWcid.WCID].Addr[2]<<16)+(pAd->MacTab.Content[SetAsicWcid.WCID].Addr[1]<<8)+(pAd->MacTab.Content[SetAsicWcid.WCID].Addr[0]);
-						DBGPRINT_RAW(RT_DEBUG_TRACE, ("1-MACValue= %x,\n", MACValue));
-						RTUSBWriteMACRegister(pAd, offset, MACValue);
-						// Read bitmask
-						RTUSBReadMACRegister(pAd, offset+4, &MACRValue);
-						if ( SetAsicWcid.DeleteTid != 0xffffffff)
-							MACRValue &= (~SetAsicWcid.DeleteTid);
-						if (SetAsicWcid.SetTid != 0xffffffff)
-							MACRValue |= (SetAsicWcid.SetTid);
-						MACRValue &= 0xffff0000;
-
-						MACValue = (pAd->MacTab.Content[SetAsicWcid.WCID].Addr[5]<<8)+pAd->MacTab.Content[SetAsicWcid.WCID].Addr[4];
-						MACValue |= MACRValue;
-						RTUSBWriteMACRegister(pAd, offset+4, MACValue);
-
-						DBGPRINT_RAW(RT_DEBUG_TRACE, ("2-MACValue= %x,\n", MACValue));
+					} else {
+						/* Card must be removed */
+						if (NT_SUCCESS(ntStatus) !=
+						    TRUE) {
+							RTMP_SET_FLAG(pAd,
+								      fRTMP_ADAPTER_NIC_NOT_EXIST);
+							DBGPRINT_RAW
+							    (RT_DEBUG_ERROR,
+							     ("CMDTHREAD_RESET_BULK_IN: Read Register Failed!Card must be removed!!\n\n"));
+						} else {
+							DBGPRINT_RAW
+							    (RT_DEBUG_ERROR,
+							     ("CMDTHREAD_RESET_BULK_IN: Cannot do bulk in because flags(0x%lx) on !\n",
+							      pAd->Flags));
+						}
 					}
-					break;
+				}
+				DBGPRINT_RAW(RT_DEBUG_TRACE,
+					     ("CmdThread : CMDTHREAD_RESET_BULK_IN <===\n"));
+				break;
 
-				case CMDTHREAD_SET_ASIC_WCID_CIPHER:
-					{
-						RT_SET_ASIC_WCID_ATTRI	SetAsicWcidAttri;
-						USHORT		offset;
-						UINT32		MACRValue = 0;
-						SHAREDKEY_MODE_STRUC csr1;
-						SetAsicWcidAttri = *((PRT_SET_ASIC_WCID_ATTRI)(pData));
-
-						if (SetAsicWcidAttri.WCID >= MAX_LEN_OF_MAC_TABLE)
-							return;
-
-						offset = MAC_WCID_ATTRIBUTE_BASE + ((UCHAR)SetAsicWcidAttri.WCID)*HW_WCID_ATTRI_SIZE;
-
-						DBGPRINT_RAW(RT_DEBUG_TRACE, ("Cmd : CMDTHREAD_SET_ASIC_WCID_CIPHER : WCID = %ld, Cipher = %lx.\n", SetAsicWcidAttri.WCID, SetAsicWcidAttri.Cipher));
-						// Read bitmask
-						RTUSBReadMACRegister(pAd, offset, &MACRValue);
-						MACRValue = 0;
-						MACRValue |= (((UCHAR)SetAsicWcidAttri.Cipher) << 1);
-
-						RTUSBWriteMACRegister(pAd, offset, MACRValue);
-						DBGPRINT_RAW(RT_DEBUG_TRACE, ("2-offset = %x , MACValue= %x,\n", offset, MACRValue));
-
-						offset = PAIRWISE_IVEIV_TABLE_BASE + ((UCHAR)SetAsicWcidAttri.WCID)*HW_IVEIV_ENTRY_SIZE;
-						MACRValue = 0;
-						if ( (SetAsicWcidAttri.Cipher <= CIPHER_WEP128))
-							MACRValue |= ( pAd->StaCfg.DefaultKeyId << 30);
-						else
-							MACRValue |= (0x20000000);
-						RTUSBWriteMACRegister(pAd, offset, MACRValue);
-						DBGPRINT_RAW(RT_DEBUG_TRACE, ("2-offset = %x , MACValue= %x,\n", offset, MACRValue));
-
-						//
-						// Update cipher algorithm. WSTA always use BSS0
-						//
-						// for adhoc mode only ,because wep status slow than add key, when use zero config
-						if (pAd->StaCfg.BssType == BSS_ADHOC )
-						{
-							offset = MAC_WCID_ATTRIBUTE_BASE;
+			case CMDTHREAD_SET_ASIC_WCID:
+				{
+					struct rt_set_asic_wcid SetAsicWcid;
+					u16 offset;
+					u32 MACValue, MACRValue = 0;
+					SetAsicWcid =
+					    *((struct rt_set_asic_wcid *)(pData));
+
+					if (SetAsicWcid.WCID >=
+					    MAX_LEN_OF_MAC_TABLE)
+						return;
+
+					offset =
+					    MAC_WCID_BASE +
+					    ((u8)SetAsicWcid.WCID) *
+					    HW_WCID_ENTRY_SIZE;
+
+					DBGPRINT_RAW(RT_DEBUG_TRACE,
+						     ("CmdThread : CMDTHREAD_SET_ASIC_WCID : WCID = %ld, SetTid  = %lx, DeleteTid = %lx.\n",
+						      SetAsicWcid.WCID,
+						      SetAsicWcid.SetTid,
+						      SetAsicWcid.DeleteTid));
+					MACValue =
+					    (pAd->MacTab.
+					     Content[SetAsicWcid.WCID].
+					     Addr[3] << 24) +
+					    (pAd->MacTab.
+					     Content[SetAsicWcid.WCID].
+					     Addr[2] << 16) +
+					    (pAd->MacTab.
+					     Content[SetAsicWcid.WCID].
+					     Addr[1] << 8) +
+					    (pAd->MacTab.
+					     Content[SetAsicWcid.WCID].Addr[0]);
+					DBGPRINT_RAW(RT_DEBUG_TRACE,
+						     ("1-MACValue= %x,\n",
+						      MACValue));
+					RTUSBWriteMACRegister(pAd, offset,
+							      MACValue);
+					/* Read bitmask */
+					RTUSBReadMACRegister(pAd, offset + 4,
+							     &MACRValue);
+					if (SetAsicWcid.DeleteTid != 0xffffffff)
+						MACRValue &=
+						    (~SetAsicWcid.DeleteTid);
+					if (SetAsicWcid.SetTid != 0xffffffff)
+						MACRValue |=
+						    (SetAsicWcid.SetTid);
+					MACRValue &= 0xffff0000;
+
+					MACValue =
+					    (pAd->MacTab.
+					     Content[SetAsicWcid.WCID].
+					     Addr[5] << 8) +
+					    pAd->MacTab.Content[SetAsicWcid.
+								WCID].Addr[4];
+					MACValue |= MACRValue;
+					RTUSBWriteMACRegister(pAd, offset + 4,
+							      MACValue);
+
+					DBGPRINT_RAW(RT_DEBUG_TRACE,
+						     ("2-MACValue= %x,\n",
+						      MACValue));
+				}
+				break;
 
-							RTUSBReadMACRegister(pAd, offset, &MACRValue);
-							MACRValue &= (~0xe);
-							MACRValue |= (((UCHAR)SetAsicWcidAttri.Cipher) << 1);
+			case CMDTHREAD_SET_ASIC_WCID_CIPHER:
+				{
+					struct rt_set_asic_wcid_attri SetAsicWcidAttri;
+					u16 offset;
+					u32 MACRValue = 0;
+					SHAREDKEY_MODE_STRUC csr1;
+					SetAsicWcidAttri =
+					    *((struct rt_set_asic_wcid_attri *)
+					      (pData));
+
+					if (SetAsicWcidAttri.WCID >=
+					    MAX_LEN_OF_MAC_TABLE)
+						return;
+
+					offset =
+					    MAC_WCID_ATTRIBUTE_BASE +
+					    ((u8)SetAsicWcidAttri.WCID) *
+					    HW_WCID_ATTRI_SIZE;
+
+					DBGPRINT_RAW(RT_DEBUG_TRACE,
+						     ("Cmd : CMDTHREAD_SET_ASIC_WCID_CIPHER : WCID = %ld, Cipher = %lx.\n",
+						      SetAsicWcidAttri.WCID,
+						      SetAsicWcidAttri.Cipher));
+					/* Read bitmask */
+					RTUSBReadMACRegister(pAd, offset,
+							     &MACRValue);
+					MACRValue = 0;
+					MACRValue |=
+					    (((u8)SetAsicWcidAttri.
+					      Cipher) << 1);
+
+					RTUSBWriteMACRegister(pAd, offset,
+							      MACRValue);
+					DBGPRINT_RAW(RT_DEBUG_TRACE,
+						     ("2-offset = %x , MACValue= %x,\n",
+						      offset, MACRValue));
+
+					offset =
+					    PAIRWISE_IVEIV_TABLE_BASE +
+					    ((u8)SetAsicWcidAttri.WCID) *
+					    HW_IVEIV_ENTRY_SIZE;
+					MACRValue = 0;
+					if ((SetAsicWcidAttri.Cipher <=
+					     CIPHER_WEP128))
+						MACRValue |=
+						    (pAd->StaCfg.
+						     DefaultKeyId << 30);
+					else
+						MACRValue |= (0x20000000);
+					RTUSBWriteMACRegister(pAd, offset,
+							      MACRValue);
+					DBGPRINT_RAW(RT_DEBUG_TRACE,
+						     ("2-offset = %x , MACValue= %x,\n",
+						      offset, MACRValue));
+
+					/* */
+					/* Update cipher algorithm. WSTA always use BSS0 */
+					/* */
+					/* for adhoc mode only ,because wep status slow than add key, when use zero config */
+					if (pAd->StaCfg.BssType == BSS_ADHOC) {
+						offset =
+						    MAC_WCID_ATTRIBUTE_BASE;
+
+						RTUSBReadMACRegister(pAd,
+								     offset,
+								     &MACRValue);
+						MACRValue &= (~0xe);
+						MACRValue |=
+						    (((u8)SetAsicWcidAttri.
+						      Cipher) << 1);
+
+						RTUSBWriteMACRegister(pAd,
+								      offset,
+								      MACRValue);
+
+						/*Update group key cipher,,because wep status slow than add key, when use zero config */
+						RTUSBReadMACRegister(pAd,
+								     SHARED_KEY_MODE_BASE
+								     +
+								     4 * (0 /
+									  2),
+								     &csr1.
+								     word);
+
+						csr1.field.Bss0Key0CipherAlg =
+						    SetAsicWcidAttri.Cipher;
+						csr1.field.Bss0Key1CipherAlg =
+						    SetAsicWcidAttri.Cipher;
+
+						RTUSBWriteMACRegister(pAd,
+								      SHARED_KEY_MODE_BASE
+								      +
+								      4 * (0 /
+									   2),
+								      csr1.
+								      word);
+					}
+				}
+				break;
 
-							RTUSBWriteMACRegister(pAd, offset, MACRValue);
+/*Benson modified for USB interface, avoid in interrupt when write key, 20080724 --> */
+			case RT_CMD_SET_KEY_TABLE:	/*General call for AsicAddPairwiseKeyEntry() */
+				{
+					struct rt_add_pairwise_key_entry KeyInfo;
+					KeyInfo =
+					    *((struct rt_add_pairwise_key_entry *)
+					      (pData));
+					AsicAddPairwiseKeyEntry(pAd,
+								KeyInfo.MacAddr,
+								(u8)KeyInfo.
+								MacTabMatchWCID,
+								&KeyInfo.
+								CipherKey);
+				}
+				break;
 
-							//Update group key cipher,,because wep status slow than add key, when use zero config
-							RTUSBReadMACRegister(pAd, SHARED_KEY_MODE_BASE+4*(0/2), &csr1.word);
+			case RT_CMD_SET_RX_WCID_TABLE:	/*General call for RTMPAddWcidAttributeEntry() */
+				{
+					struct rt_mac_table_entry *pEntry;
+					u8 KeyIdx = 0;
+					u8 CipherAlg = CIPHER_NONE;
+					u8 ApIdx = BSS0;
+
+					pEntry = (struct rt_mac_table_entry *)(pData);
+
+					RTMPAddWcidAttributeEntry(pAd,
+								  ApIdx,
+								  KeyIdx,
+								  CipherAlg,
+								  pEntry);
+				}
+				break;
+/*Benson modified for USB interface, avoid in interrupt when write key, 20080724 <-- */
 
-							csr1.field.Bss0Key0CipherAlg = SetAsicWcidAttri.Cipher;
-							csr1.field.Bss0Key1CipherAlg = SetAsicWcidAttri.Cipher;
+			case CMDTHREAD_SET_CLIENT_MAC_ENTRY:
+				{
+					struct rt_mac_table_entry *pEntry;
+					pEntry = (struct rt_mac_table_entry *)pData;
 
-							RTUSBWriteMACRegister(pAd, SHARED_KEY_MODE_BASE+4*(0/2), csr1.word);
+					{
+						AsicRemovePairwiseKeyEntry(pAd,
+									   pEntry->
+									   apidx,
+									   (u8)
+									   pEntry->
+									   Aid);
+						if ((pEntry->AuthMode <=
+						     Ndis802_11AuthModeAutoSwitch)
+						    && (pEntry->WepStatus ==
+							Ndis802_11Encryption1Enabled))
+						{
+							u32 uIV = 1;
+							u8 *ptr;
+
+							ptr = (u8 *)& uIV;
+							*(ptr + 3) =
+							    (pAd->StaCfg.
+							     DefaultKeyId << 6);
+							AsicUpdateWCIDIVEIV(pAd,
+									    pEntry->
+									    Aid,
+									    uIV,
+									    0);
+							AsicUpdateWCIDAttribute
+							    (pAd, pEntry->Aid,
+							     BSS0,
+							     pAd->
+							     SharedKey[BSS0]
+							     [pAd->StaCfg.
+							      DefaultKeyId].
+							     CipherAlg, FALSE);
+						} else if (pEntry->AuthMode ==
+							   Ndis802_11AuthModeWPANone)
+						{
+							u32 uIV = 1;
+							u8 *ptr;
+
+							ptr = (u8 *)& uIV;
+							*(ptr + 3) =
+							    (pAd->StaCfg.
+							     DefaultKeyId << 6);
+							AsicUpdateWCIDIVEIV(pAd,
+									    pEntry->
+									    Aid,
+									    uIV,
+									    0);
+							AsicUpdateWCIDAttribute
+							    (pAd, pEntry->Aid,
+							     BSS0,
+							     pAd->
+							     SharedKey[BSS0]
+							     [pAd->StaCfg.
+							      DefaultKeyId].
+							     CipherAlg, FALSE);
+						} else {
+							/* */
+							/* Other case, disable engine. */
+							/* Don't worry WPA key, we will add WPA Key after 4-Way handshaking. */
+							/* */
+							u16 offset;
+							offset =
+							    MAC_WCID_ATTRIBUTE_BASE
+							    +
+							    (pEntry->Aid *
+							     HW_WCID_ATTRI_SIZE);
+							/* RX_PKEY_MODE:0 for no security; RX_KEY_TAB:0 for shared key table; BSS_IDX:0 */
+							RTUSBWriteMACRegister
+							    (pAd, offset, 0);
 						}
 					}
-					break;
-				case CMDTHREAD_SET_CLIENT_MAC_ENTRY:
-					{
-						MAC_TABLE_ENTRY *pEntry;
-						pEntry = (MAC_TABLE_ENTRY *)pData;
 
-						{
-							AsicRemovePairwiseKeyEntry(pAd, pEntry->apidx, (UCHAR)pEntry->Aid);
-							if ((pEntry->AuthMode <= Ndis802_11AuthModeAutoSwitch) && (pEntry->WepStatus == Ndis802_11Encryption1Enabled))
-							{
-								UINT32 uIV = 0;
-								PUCHAR  ptr;
+					AsicUpdateRxWCIDTable(pAd, pEntry->Aid,
+							      pEntry->Addr);
+					DBGPRINT(RT_DEBUG_TRACE,
+						 ("UpdateRxWCIDTable(): Aid=%d, Addr=%02x:%02x:%02x:%02x:%02x:%02x!\n",
+						  pEntry->Aid, pEntry->Addr[0],
+						  pEntry->Addr[1],
+						  pEntry->Addr[2],
+						  pEntry->Addr[3],
+						  pEntry->Addr[4],
+						  pEntry->Addr[5]));
+				}
+				break;
 
-								ptr = (PUCHAR) &uIV;
-								*(ptr + 3) = (pAd->StaCfg.DefaultKeyId << 6);
-								AsicUpdateWCIDIVEIV(pAd, pEntry->Aid, uIV, 0);
-								AsicUpdateWCIDAttribute(pAd, pEntry->Aid, BSS0, pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].CipherAlg, FALSE);
+/* add by johnli, fix "in_interrupt" error when call "MacTableDeleteEntry" in Rx tasklet */
+			case CMDTHREAD_UPDATE_PROTECT:
+				{
+					AsicUpdateProtect(pAd, 0,
+							  (ALLN_SETPROTECT),
+							  TRUE, 0);
+				}
+				break;
+/* end johnli */
+
+			case OID_802_11_ADD_WEP:
+				{
+					u32 i;
+					u32 KeyIdx;
+					struct rt_ndis_802_11_wep *pWepKey;
+
+					DBGPRINT(RT_DEBUG_TRACE,
+						 ("CmdThread::OID_802_11_ADD_WEP  \n"));
+
+					pWepKey = (struct rt_ndis_802_11_wep *)pData;
+					KeyIdx = pWepKey->KeyIndex & 0x0fffffff;
+
+					/* it is a shared key */
+					if ((KeyIdx >= 4)
+					    || ((pWepKey->KeyLength != 5)
+						&& (pWepKey->KeyLength !=
+						    13))) {
+						NdisStatus =
+						    NDIS_STATUS_INVALID_DATA;
+						DBGPRINT(RT_DEBUG_ERROR,
+							 ("CmdThread::OID_802_11_ADD_WEP, INVALID_DATA!!\n"));
+					} else {
+						u8 CipherAlg;
+						pAd->SharedKey[BSS0][KeyIdx].
+						    KeyLen =
+						    (u8)pWepKey->KeyLength;
+						NdisMoveMemory(pAd->
+							       SharedKey[BSS0]
+							       [KeyIdx].Key,
+							       &pWepKey->
+							       KeyMaterial,
+							       pWepKey->
+							       KeyLength);
+						CipherAlg =
+						    (pAd->
+						     SharedKey[BSS0][KeyIdx].
+						     KeyLen ==
+						     5) ? CIPHER_WEP64 :
+						    CIPHER_WEP128;
+
+						/* */
+						/* Change the WEP cipher to CKIP cipher if CKIP KP on. */
+						/* Funk UI or Meetinghouse UI will add ckip key from this path. */
+						/* */
+
+						if (pAd->OpMode == OPMODE_STA) {
+							pAd->MacTab.
+							    Content[BSSID_WCID].
+							    PairwiseKey.
+							    CipherAlg =
+							    pAd->
+							    SharedKey[BSS0]
+							    [KeyIdx].CipherAlg;
+							pAd->MacTab.
+							    Content[BSSID_WCID].
+							    PairwiseKey.KeyLen =
+							    pAd->
+							    SharedKey[BSS0]
+							    [KeyIdx].KeyLen;
+						}
+						pAd->SharedKey[BSS0][KeyIdx].
+						    CipherAlg = CipherAlg;
+						if (pWepKey->
+						    KeyIndex & 0x80000000) {
+							/* Default key for tx (shared key) */
+							u8 IVEIV[8];
+							u32 WCIDAttri, Value;
+							u16 offset, offset2;
+							NdisZeroMemory(IVEIV,
+								       8);
+							pAd->StaCfg.
+							    DefaultKeyId =
+							    (u8)KeyIdx;
+							/* Add BSSID to WCTable. because this is Tx wep key. */
+							/* WCID Attribute UDF:3, BSSIdx:3, Alg:3, Keytable:1=PAIRWISE KEY, BSSIdx is 0 */
+							WCIDAttri =
+							    (CipherAlg << 1) |
+							    SHAREDKEYTABLE;
+
+							offset =
+							    MAC_WCID_ATTRIBUTE_BASE
+							    +
+							    (BSSID_WCID *
+							     HW_WCID_ATTRI_SIZE);
+							RTUSBWriteMACRegister
+							    (pAd, offset,
+							     WCIDAttri);
+							/* 1. IV/EIV */
+							/* Specify key index to find shared key. */
+							IVEIV[3] = (u8)(KeyIdx << 6);	/*WEP Eiv bit off. groupkey index is not 0 */
+							offset =
+							    PAIRWISE_IVEIV_TABLE_BASE
+							    +
+							    (BSS0Mcast_WCID *
+							     HW_IVEIV_ENTRY_SIZE);
+							offset2 =
+							    PAIRWISE_IVEIV_TABLE_BASE
+							    +
+							    (BSSID_WCID *
+							     HW_IVEIV_ENTRY_SIZE);
+							for (i = 0; i < 8;) {
+								Value =
+								    IVEIV[i];
+								Value +=
+								    (IVEIV
+								     [i +
+								      1] << 8);
+								Value +=
+								    (IVEIV
+								     [i +
+								      2] << 16);
+								Value +=
+								    (IVEIV
+								     [i +
+								      3] << 24);
+								RTUSBWriteMACRegister
+								    (pAd,
+								     offset + i,
+								     Value);
+								RTUSBWriteMACRegister
+								    (pAd,
+								     offset2 +
+								     i, Value);
+								i += 4;
 							}
-							else if (pEntry->AuthMode == Ndis802_11AuthModeWPANone)
-							{
-								UINT32 uIV = 0;
-								PUCHAR  ptr;
 
-								ptr = (PUCHAR) &uIV;
-								*(ptr + 3) = (pAd->StaCfg.DefaultKeyId << 6);
-								AsicUpdateWCIDIVEIV(pAd, pEntry->Aid, uIV, 0);
-								AsicUpdateWCIDAttribute(pAd, pEntry->Aid, BSS0, pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].CipherAlg, FALSE);
-							}
-							else
-							{
-								//
-								// Other case, disable engine.
-								// Don't worry WPA key, we will add WPA Key after 4-Way handshaking.
-								//
-								USHORT   offset;
-								offset = MAC_WCID_ATTRIBUTE_BASE + (pEntry->Aid * HW_WCID_ATTRI_SIZE);
-								// RX_PKEY_MODE:0 for no security; RX_KEY_TAB:0 for shared key table; BSS_IDX:0
-								RTUSBWriteMACRegister(pAd, offset, 0);
-							}
-						}
+							/* 2. WCID Attribute UDF:3, BSSIdx:3, Alg:3, Keytable:use share key, BSSIdx is 0 */
+							WCIDAttri =
+							    (pAd->
+							     SharedKey[BSS0]
+							     [KeyIdx].
+							     CipherAlg << 1) |
+							    SHAREDKEYTABLE;
+							offset =
+							    MAC_WCID_ATTRIBUTE_BASE
+							    +
+							    (BSS0Mcast_WCID *
+							     HW_WCID_ATTRI_SIZE);
+							DBGPRINT(RT_DEBUG_TRACE,
+								 ("BSS0Mcast_WCID : offset = %x, WCIDAttri = %x\n",
+								  offset,
+								  WCIDAttri));
+							RTUSBWriteMACRegister
+							    (pAd, offset,
+							     WCIDAttri);
 
-						AsicUpdateRxWCIDTable(pAd, pEntry->Aid, pEntry->Addr);
-						printk("UpdateRxWCIDTable(): Aid=%d, Addr=%02x:%02x:%02x:%02x:%02x:%02x!\n", pEntry->Aid,
-								pEntry->Addr[0], pEntry->Addr[1], pEntry->Addr[2], pEntry->Addr[3], pEntry->Addr[4], pEntry->Addr[5]);
-					}
-					break;
-				case CMDTHREAD_UPDATE_PROTECT:
-					{
-						AsicUpdateProtect(pAd, 0, (ALLN_SETPROTECT), TRUE, 0);
+						}
+						AsicAddSharedKeyEntry(pAd, BSS0,
+								      (u8)
+								      KeyIdx,
+								      CipherAlg,
+								      pWepKey->
+								      KeyMaterial,
+								      NULL,
+								      NULL);
+						DBGPRINT(RT_DEBUG_TRACE,
+							 ("CmdThread::OID_802_11_ADD_WEP (KeyIdx=%d, Len=%d-byte)\n",
+							  KeyIdx,
+							  pWepKey->KeyLength));
 					}
-					break;
-				case OID_802_11_ADD_WEP:
-					{
-						UINT	i;
-						UINT32	KeyIdx;
-						PNDIS_802_11_WEP	pWepKey;
-
-						DBGPRINT(RT_DEBUG_TRACE, ("CmdThread::OID_802_11_ADD_WEP  \n"));
+				}
+				break;
 
-						pWepKey = (PNDIS_802_11_WEP)pData;
-						KeyIdx = pWepKey->KeyIndex & 0x0fffffff;
+			case CMDTHREAD_802_11_COUNTER_MEASURE:
+				break;
 
-						// it is a shared key
-						if ((KeyIdx >= 4) || ((pWepKey->KeyLength != 5) && (pWepKey->KeyLength != 13)))
-						{
-							NdisStatus = NDIS_STATUS_INVALID_DATA;
-							DBGPRINT(RT_DEBUG_ERROR, ("CmdThread::OID_802_11_ADD_WEP, INVALID_DATA!!\n"));
-						}
-						else
-						{
-							UCHAR CipherAlg;
-							pAd->SharedKey[BSS0][KeyIdx].KeyLen = (UCHAR) pWepKey->KeyLength;
-							NdisMoveMemory(pAd->SharedKey[BSS0][KeyIdx].Key, &pWepKey->KeyMaterial, pWepKey->KeyLength);
-							CipherAlg = (pAd->SharedKey[BSS0][KeyIdx].KeyLen == 5)? CIPHER_WEP64 : CIPHER_WEP128;
-
-							//
-							// Change the WEP cipher to CKIP cipher if CKIP KP on.
-							// Funk UI or Meetinghouse UI will add ckip key from this path.
-							//
-
-							if (pAd->OpMode == OPMODE_STA)
-						 	{
-								pAd->MacTab.Content[BSSID_WCID].PairwiseKey.CipherAlg = pAd->SharedKey[BSS0][KeyIdx].CipherAlg;
-								pAd->MacTab.Content[BSSID_WCID].PairwiseKey.KeyLen = pAd->SharedKey[BSS0][KeyIdx].KeyLen;
-						 	}
-							pAd->SharedKey[BSS0][KeyIdx].CipherAlg = CipherAlg;
-							if (pWepKey->KeyIndex & 0x80000000)
-							{
-								// Default key for tx (shared key)
-								UCHAR	IVEIV[8];
-								UINT32	WCIDAttri, Value;
-								USHORT	offset, offset2;
-								NdisZeroMemory(IVEIV, 8);
-								pAd->StaCfg.DefaultKeyId = (UCHAR) KeyIdx;
-								// Add BSSID to WCTable. because this is Tx wep key.
-								// WCID Attribute UDF:3, BSSIdx:3, Alg:3, Keytable:1=PAIRWISE KEY, BSSIdx is 0
-								WCIDAttri = (CipherAlg<<1)|SHAREDKEYTABLE;
-
-								offset = MAC_WCID_ATTRIBUTE_BASE + (BSSID_WCID* HW_WCID_ATTRI_SIZE);
-								RTUSBWriteMACRegister(pAd, offset, WCIDAttri);
-								// 1. IV/EIV
-								// Specify key index to find shared key.
-								IVEIV[3] = (UCHAR)(KeyIdx<< 6);	//WEP Eiv bit off. groupkey index is not 0
-								offset = PAIRWISE_IVEIV_TABLE_BASE + (BSS0Mcast_WCID * HW_IVEIV_ENTRY_SIZE);
-								offset2 = PAIRWISE_IVEIV_TABLE_BASE + (BSSID_WCID* HW_IVEIV_ENTRY_SIZE);
-								for (i=0; i<8;)
-								{
-									Value = IVEIV[i];
-									Value += (IVEIV[i+1]<<8);
-									Value += (IVEIV[i+2]<<16);
-									Value += (IVEIV[i+3]<<24);
-									RTUSBWriteMACRegister(pAd, offset+i, Value);
-									RTUSBWriteMACRegister(pAd, offset2+i, Value);
-									i+=4;
-								}
+			case CMDTHREAD_SET_GROUP_KEY:
+				WpaStaGroupKeySetting(pAd);
+				break;
 
-								// 2. WCID Attribute UDF:3, BSSIdx:3, Alg:3, Keytable:use share key, BSSIdx is 0
-								WCIDAttri = (pAd->SharedKey[BSS0][KeyIdx].CipherAlg<<1)|SHAREDKEYTABLE;
-								offset = MAC_WCID_ATTRIBUTE_BASE + (BSS0Mcast_WCID* HW_WCID_ATTRI_SIZE);
-							        DBGPRINT(RT_DEBUG_TRACE, ("BSS0Mcast_WCID : offset = %x, WCIDAttri = %x\n", offset, WCIDAttri));
-								RTUSBWriteMACRegister(pAd, offset, WCIDAttri);
+			case CMDTHREAD_SET_PAIRWISE_KEY:
+				WpaStaPairwiseKeySetting(pAd);
+				break;
 
-							}
-							AsicAddSharedKeyEntry(pAd, BSS0, (UCHAR)KeyIdx, CipherAlg, pWepKey->KeyMaterial, NULL, NULL);
-							DBGPRINT(RT_DEBUG_TRACE, ("CmdThread::OID_802_11_ADD_WEP (KeyIdx=%d, Len=%d-byte)\n", KeyIdx, pWepKey->KeyLength));
-						}
-					}
-					break;
+			case CMDTHREAD_SET_PSM_BIT:
+				{
+					u16 *pPsm = (u16 *) pData;
+					MlmeSetPsmBit(pAd, *pPsm);
+				}
+				break;
+			case CMDTHREAD_FORCE_WAKE_UP:
+				AsicForceWakeup(pAd, TRUE);
+				break;
 
-				case CMDTHREAD_802_11_COUNTER_MEASURE:
-					break;
-				default:
-					DBGPRINT(RT_DEBUG_ERROR, ("--> Control Thread !! ERROR !! Unknown(cmdqelmt->command=0x%x) !! \n", cmdqelmt->command));
-					break;
+			default:
+				DBGPRINT(RT_DEBUG_ERROR,
+					 ("--> Control Thread !! ERROR !! Unknown(cmdqelmt->command=0x%x) !! \n",
+					  cmdqelmt->command));
+				break;
 			}
 		}
 
-		if (cmdqelmt->CmdFromNdis == TRUE)
-		{
-				if (cmdqelmt->buffer != NULL)
-					NdisFreeMemory(cmdqelmt->buffer, cmdqelmt->bufferlength, 0);
-
-			NdisFreeMemory(cmdqelmt, sizeof(CmdQElmt), 0);
-		}
-		else
-		{
-			if ((cmdqelmt->buffer != NULL) && (cmdqelmt->bufferlength != 0))
-				NdisFreeMemory(cmdqelmt->buffer, cmdqelmt->bufferlength, 0);
-            {
-				NdisFreeMemory(cmdqelmt, sizeof(CmdQElmt), 0);
-			}
+		if (cmdqelmt->CmdFromNdis == TRUE) {
+			if (cmdqelmt->buffer != NULL)
+				os_free_mem(pAd, cmdqelmt->buffer);
+			os_free_mem(pAd, cmdqelmt);
+		} else {
+			if ((cmdqelmt->buffer != NULL)
+			    && (cmdqelmt->bufferlength != 0))
+				os_free_mem(pAd, cmdqelmt->buffer);
+			os_free_mem(pAd, cmdqelmt);
 		}
-	}	/* end of while */
+	}			/* end of while */
 }
 
+#endif /* RTMP_MAC_USB // */
diff --git a/drivers/staging/rt2870/rt2870.h b/drivers/staging/rt2870/rt2870.h
deleted file mode 100644
index 4c67bafad4e6..000000000000
--- a/drivers/staging/rt2870/rt2870.h
+++ /dev/null
@@ -1,583 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
- */
-
-#ifndef __RT2870_H__
-#define __RT2870_H__
-
-//usb header files
-#include <linux/usb.h>
-
-/* rtmp_def.h */
-//
-#define BULKAGGRE_ZISE          100
-#define RT28XX_DRVDATA_SET(_a)                                             usb_set_intfdata(_a, pAd);
-#define RT28XX_PUT_DEVICE                                                  usb_put_dev
-#define RTUSB_ALLOC_URB(iso)                                               usb_alloc_urb(iso, GFP_ATOMIC)
-#define RTUSB_SUBMIT_URB(pUrb)                                             usb_submit_urb(pUrb, GFP_ATOMIC)
-#define	RTUSB_URB_ALLOC_BUFFER(pUsb_Dev, BufSize, pDma_addr)               usb_buffer_alloc(pUsb_Dev, BufSize, GFP_ATOMIC, pDma_addr)
-#define	RTUSB_URB_FREE_BUFFER(pUsb_Dev, BufSize, pTransferBuf, Dma_addr)   usb_buffer_free(pUsb_Dev, BufSize, pTransferBuf, Dma_addr)
-
-#define RXBULKAGGRE_ZISE        12
-#define MAX_TXBULK_LIMIT        (LOCAL_TXBUF_SIZE*(BULKAGGRE_ZISE-1))
-#define MAX_TXBULK_SIZE         (LOCAL_TXBUF_SIZE*BULKAGGRE_ZISE)
-#define MAX_RXBULK_SIZE         (LOCAL_TXBUF_SIZE*RXBULKAGGRE_ZISE)
-#define MAX_MLME_HANDLER_MEMORY 20
-#define	RETRY_LIMIT             10
-#define BUFFER_SIZE				2400	//2048
-#define	TX_RING					0xa
-#define	PRIO_RING				0xc
-
-
-// Flags for Bulkflags control for bulk out data
-//
-#define	fRTUSB_BULK_OUT_DATA_NULL				0x00000001
-#define fRTUSB_BULK_OUT_RTS						0x00000002
-#define	fRTUSB_BULK_OUT_MLME					0x00000004
-
-#define	fRTUSB_BULK_OUT_DATA_NORMAL				0x00010000
-#define	fRTUSB_BULK_OUT_DATA_NORMAL_2			0x00020000
-#define	fRTUSB_BULK_OUT_DATA_NORMAL_3			0x00040000
-#define	fRTUSB_BULK_OUT_DATA_NORMAL_4			0x00080000
-#define	fRTUSB_BULK_OUT_DATA_NORMAL_5			0x00100000
-
-#define	fRTUSB_BULK_OUT_PSPOLL					0x00000020
-#define	fRTUSB_BULK_OUT_DATA_FRAG				0x00000040
-#define	fRTUSB_BULK_OUT_DATA_FRAG_2				0x00000080
-#define	fRTUSB_BULK_OUT_DATA_FRAG_3				0x00000100
-#define	fRTUSB_BULK_OUT_DATA_FRAG_4				0x00000200
-
-#define	FREE_HTTX_RING(_p, _b, _t)			\
-{										\
-	if ((_t)->ENextBulkOutPosition == (_t)->CurWritePosition)				\
-	{																	\
-		(_t)->bRingEmpty = TRUE;			\
-	}																	\
-	/*NdisInterlockedDecrement(&(_p)->TxCount); */\
-}
-
-//
-// RXINFO appends at the end of each rx packet.
-//
-typedef	struct	PACKED _RXINFO_STRUC {
-	UINT32		BA:1;
-	UINT32		DATA:1;
-	UINT32		NULLDATA:1;
-	UINT32		FRAG:1;
-	UINT32		U2M:1;              // 1: this RX frame is unicast to me
-	UINT32		Mcast:1;            // 1: this is a multicast frame
-	UINT32		Bcast:1;            // 1: this is a broadcast frame
-	UINT32		MyBss:1;  	// 1: this frame belongs to the same BSSID
-	UINT32		Crc:1;              // 1: CRC error
-	UINT32		CipherErr:2;        // 0: decryption okay, 1:ICV error, 2:MIC error, 3:KEY not valid
-	UINT32		AMSDU:1;		// rx with 802.3 header, not 802.11 header.
-	UINT32		HTC:1;
-	UINT32		RSSI:1;
-	UINT32		L2PAD:1;
-	UINT32		AMPDU:1;		// To be moved
-	UINT32		Decrypted:1;
-	UINT32		PlcpRssil:1;
-	UINT32		CipherAlg:1;
-	UINT32		LastAMSDU:1;
-	UINT32		PlcpSignal:12;
-}	RXINFO_STRUC, *PRXINFO_STRUC, RT28XX_RXD_STRUC, *PRT28XX_RXD_STRUC;
-
-//
-// TXINFO
-//
-typedef	struct	_TXINFO_STRUC {
-	// Word	0
-	UINT32		USBDMATxPktLen:16;	//used ONLY in USB bulk Aggregation,  Total byte counts of all sub-frame.
-	UINT32		rsv:8;
-	UINT32		WIV:1;	// Wireless Info Valid. 1 if Driver already fill WI,  o if DMA needs to copy WI to correctposition
-	UINT32		QSEL:2;	// select on-chip FIFO ID for 2nd-stage output scheduler.0:MGMT, 1:HCCA 2:EDCA
-	UINT32		SwUseLastRound:1; // Software use.
-	UINT32		rsv2:2;  // Software use.
-	UINT32		USBDMANextVLD:1;	//used ONLY in USB bulk Aggregation, NextValid
-	UINT32		USBDMATxburst:1;//used ONLY in USB bulk Aggre. Force USB DMA transmit frame from current selected endpoint
-}	TXINFO_STRUC, *PTXINFO_STRUC;
-
-#define TXINFO_SIZE				4
-#define RXINFO_SIZE				4
-#define TXPADDING_SIZE			11
-
-//
-// Management ring buffer format
-//
-typedef	struct	_MGMT_STRUC	{
-	BOOLEAN		Valid;
-	PUCHAR		pBuffer;
-	ULONG		Length;
-}	MGMT_STRUC, *PMGMT_STRUC;
-
-
-/* ----------------- EEPROM Related MACRO ----------------- */
-#define RT28xx_EEPROM_READ16(pAd, offset, var)					\
-	do {														\
-		RTUSBReadEEPROM(pAd, offset, (PUCHAR)&(var), 2);		\
-		if(!pAd->bUseEfuse)										\
-		var = le2cpu16(var);									\
-	}while(0)
-
-#define RT28xx_EEPROM_WRITE16(pAd, offset, var)					\
-	do{															\
-		USHORT _tmpVar=var;										\
-		if(!pAd->bUseEfuse)									\
-		_tmpVar = cpu2le16(var);								\
-		RTUSBWriteEEPROM(pAd, offset, (PUCHAR)&(_tmpVar), 2);	\
-	}while(0)
-
-/* ----------------- TASK/THREAD Related MACRO ----------------- */
-#define RT28XX_TASK_THREAD_INIT(pAd, Status)		\
-	Status = CreateThreads(net_dev);
-
-
-/* ----------------- Frimware Related MACRO ----------------- */
-#define RT28XX_WRITE_FIRMWARE(_pAd, _pFwImage, _FwLen)		\
-	RTUSBFirmwareWrite(_pAd, _pFwImage, _FwLen)
-
-/* ----------------- TX Related MACRO ----------------- */
-#define RT28XX_START_DEQUEUE(pAd, QueIdx, irqFlags)				\
-			{													\
-				RTMP_IRQ_LOCK(&pAd->DeQueueLock[QueIdx], irqFlags);		\
-				if (pAd->DeQueueRunning[QueIdx])						\
-				{														\
-					RTMP_IRQ_UNLOCK(&pAd->DeQueueLock[QueIdx], irqFlags);\
-					printk("DeQueueRunning[%d]= TRUE!\n", QueIdx);		\
-					continue;											\
-				}														\
-				else													\
-				{														\
-					pAd->DeQueueRunning[QueIdx] = TRUE;					\
-					RTMP_IRQ_UNLOCK(&pAd->DeQueueLock[QueIdx], irqFlags);\
-				}														\
-			}
-#define RT28XX_STOP_DEQUEUE(pAd, QueIdx, irqFlags)						\
-			do{															\
-				RTMP_IRQ_LOCK(&pAd->DeQueueLock[QueIdx], irqFlags);		\
-				pAd->DeQueueRunning[QueIdx] = FALSE;					\
-				RTMP_IRQ_UNLOCK(&pAd->DeQueueLock[QueIdx], irqFlags);	\
-			}while(0)
-
-
-#define	RT28XX_HAS_ENOUGH_FREE_DESC(pAd, pTxBlk, freeNum, pPacket) \
-		(RTUSBFreeDescriptorRequest(pAd, pTxBlk->QueIdx, (pTxBlk->TotalFrameLen + GET_OS_PKT_LEN(pPacket))) == NDIS_STATUS_SUCCESS)
-
-#define RT28XX_RELEASE_DESC_RESOURCE(pAd, QueIdx)			\
-		do{}while(0)
-
-#define NEED_QUEUE_BACK_FOR_AGG(_pAd, _QueIdx, _freeNum, _TxFrameType) 		\
-		((_TxFrameType == TX_RALINK_FRAME) && (RTUSBNeedQueueBackForAgg(_pAd, _QueIdx)))
-
-
-
-#define fRTMP_ADAPTER_NEED_STOP_TX		\
-		(fRTMP_ADAPTER_NIC_NOT_EXIST | fRTMP_ADAPTER_HALT_IN_PROGRESS |	\
-		 fRTMP_ADAPTER_RESET_IN_PROGRESS | fRTMP_ADAPTER_BULKOUT_RESET | \
-		 fRTMP_ADAPTER_RADIO_OFF | fRTMP_ADAPTER_REMOVE_IN_PROGRESS)
-
-
-#define HAL_WriteSubTxResource(pAd, pTxBlk, bIsLast, pFreeNumber)	\
-			RtmpUSB_WriteSubTxResource(pAd, pTxBlk, bIsLast, pFreeNumber)
-
-#define HAL_WriteTxResource(pAd, pTxBlk,bIsLast, pFreeNumber)	\
-			RtmpUSB_WriteSingleTxResource(pAd, pTxBlk,bIsLast, pFreeNumber)
-
-#define HAL_WriteFragTxResource(pAd, pTxBlk, fragNum, pFreeNumber) \
-			RtmpUSB_WriteFragTxResource(pAd, pTxBlk, fragNum, pFreeNumber)
-
-#define HAL_WriteMultiTxResource(pAd, pTxBlk,frameNum, pFreeNumber)	\
-			RtmpUSB_WriteMultiTxResource(pAd, pTxBlk,frameNum, pFreeNumber)
-
-#define HAL_FinalWriteTxResource(pAd, pTxBlk, totalMPDUSize, TxIdx)	\
-			RtmpUSB_FinalWriteTxResource(pAd, pTxBlk, totalMPDUSize, TxIdx)
-
-#define HAL_LastTxIdx(pAd, QueIdx,TxIdx) \
-			/*RtmpUSBDataLastTxIdx(pAd, QueIdx,TxIdx)*/
-
-#define HAL_KickOutTx(pAd, pTxBlk, QueIdx)	\
-			RtmpUSBDataKickOut(pAd, pTxBlk, QueIdx)
-
-
-#define HAL_KickOutMgmtTx(pAd, QueIdx, pPacket, pSrcBufVA, SrcBufLen)	\
-			RtmpUSBMgmtKickOut(pAd, QueIdx, pPacket, pSrcBufVA, SrcBufLen)
-
-#define HAL_KickOutNullFrameTx(_pAd, _QueIdx, _pNullFrame, _frameLen)	\
-			RtmpUSBNullFrameKickOut(_pAd, _QueIdx, _pNullFrame, _frameLen)
-
-#define RTMP_PKT_TAIL_PADDING 	11 // 3(max 4 byte padding) + 4 (last packet padding) + 4 (MaxBulkOutsize align padding)
-
-extern UCHAR EpToQueue[6];
-
-
-#ifdef RT2870
-#define GET_TXRING_FREENO(_pAd, _QueIdx) 	(_QueIdx) //(_pAd->TxRing[_QueIdx].TxSwFreeIdx)
-#define GET_MGMTRING_FREENO(_pAd) 			(_pAd->MgmtRing.TxSwFreeIdx)
-#endif // RT2870 //
-
-
-/* ----------------- RX Related MACRO ----------------- */
-//#define RT28XX_RX_ERROR_CHECK				RTMPCheckRxWI
-
-#define RT28XX_RV_ALL_BUF_END(bBulkReceive)		\
-	/* We return STATUS_MORE_PROCESSING_REQUIRED so that the completion */	\
-	/* routine (IofCompleteRequest) will stop working on the irp. */		\
-	if (bBulkReceive == TRUE)	RTUSBBulkReceive(pAd);
-
-
-/* ----------------- ASIC Related MACRO ----------------- */
-
-// reset MAC of a station entry to 0xFFFFFFFFFFFF
-#define RT28XX_STA_ENTRY_MAC_RESET(pAd, Wcid)					\
-	{	RT_SET_ASIC_WCID	SetAsicWcid;						\
-		SetAsicWcid.WCID = Wcid;								\
-		SetAsicWcid.SetTid = 0xffffffff;						\
-		SetAsicWcid.DeleteTid = 0xffffffff;						\
-		RTUSBEnqueueInternalCmd(pAd, CMDTHREAD_SET_ASIC_WCID, 	\
-				&SetAsicWcid, sizeof(RT_SET_ASIC_WCID));	}
-
-// add this entry into ASIC RX WCID search table
-#define RT28XX_STA_ENTRY_ADD(pAd, pEntry)							\
-	RTUSBEnqueueInternalCmd(pAd, CMDTHREAD_SET_CLIENT_MAC_ENTRY, 	\
-							pEntry, sizeof(MAC_TABLE_ENTRY));
-
-// remove Pair-wise key material from ASIC
-// yet implement
-#define RT28XX_STA_ENTRY_KEY_DEL(pAd, BssIdx, Wcid)
-
-// add Client security information into ASIC WCID table and IVEIV table
-#define RT28XX_STA_SECURITY_INFO_ADD(pAd, apidx, KeyID, pEntry)						\
-	{	RT28XX_STA_ENTRY_MAC_RESET(pAd, pEntry->Aid);								\
-		if (pEntry->Aid >= 1) {														\
-			RT_SET_ASIC_WCID_ATTRI	SetAsicWcidAttri;								\
-			SetAsicWcidAttri.WCID = pEntry->Aid;									\
-			if ((pEntry->AuthMode <= Ndis802_11AuthModeAutoSwitch) &&				\
-				(pEntry->WepStatus == Ndis802_11Encryption1Enabled))				\
-			{																		\
-				SetAsicWcidAttri.Cipher = pAd->SharedKey[apidx][KeyID].CipherAlg;	\
-			}																		\
-			else if (pEntry->AuthMode == Ndis802_11AuthModeWPANone)					\
-			{																		\
-				SetAsicWcidAttri.Cipher = pAd->SharedKey[apidx][KeyID].CipherAlg;	\
-			}																		\
-			else SetAsicWcidAttri.Cipher = 0;										\
-            DBGPRINT(RT_DEBUG_TRACE, ("aid cipher = %ld\n",SetAsicWcidAttri.Cipher));       \
-			RTUSBEnqueueInternalCmd(pAd, CMDTHREAD_SET_ASIC_WCID_CIPHER, 			\
-							&SetAsicWcidAttri, sizeof(RT_SET_ASIC_WCID_ATTRI)); } }
-
-// Insert the BA bitmap to ASIC for the Wcid entry
-#define RT28XX_ADD_BA_SESSION_TO_ASIC(_pAd, _Aid, _TID)					\
-		do{																\
-			RT_SET_ASIC_WCID	SetAsicWcid;							\
-			SetAsicWcid.WCID = (_Aid);									\
-			SetAsicWcid.SetTid = (0x10000<<(_TID));						\
-			SetAsicWcid.DeleteTid = 0xffffffff;							\
-			RTUSBEnqueueInternalCmd((_pAd), CMDTHREAD_SET_ASIC_WCID, &SetAsicWcid, sizeof(RT_SET_ASIC_WCID));	\
-		}while(0)
-
-// Remove the BA bitmap from ASIC for the Wcid entry
-#define RT28XX_DEL_BA_SESSION_FROM_ASIC(_pAd, _Wcid, _TID)				\
-		do{																\
-			RT_SET_ASIC_WCID	SetAsicWcid;							\
-			SetAsicWcid.WCID = (_Wcid);									\
-			SetAsicWcid.SetTid = (0xffffffff);							\
-			SetAsicWcid.DeleteTid = (0x10000<<(_TID) );					\
-			RTUSBEnqueueInternalCmd((_pAd), CMDTHREAD_SET_ASIC_WCID, &SetAsicWcid, sizeof(RT_SET_ASIC_WCID));	\
-		}while(0)
-
-
-/* ----------------- PCI/USB Related MACRO ----------------- */
-#define RT28XX_HANDLE_DEV_ASSIGN(handle, dev_p)			\
-	((POS_COOKIE)handle)->pUsb_Dev = dev_p;
-
-// no use
-#define RT28XX_UNMAP()
-#define RT28XX_IRQ_REQUEST(net_dev)
-#define RT28XX_IRQ_RELEASE(net_dev)
-#define RT28XX_IRQ_INIT(pAd)
-#define RT28XX_IRQ_ENABLE(pAd)
-
-
-/* ----------------- MLME Related MACRO ----------------- */
-#define RT28XX_MLME_HANDLER(pAd)			RTUSBMlmeUp(pAd)
-
-#define RT28XX_MLME_PRE_SANITY_CHECK(pAd)								\
-	{	if ((pAd->CommonCfg.bHardwareRadio == TRUE) && 					\
-			(!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)) &&		\
-			(!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS))) {	\
-			RTUSBEnqueueInternalCmd(pAd, CMDTHREAD_CHECK_GPIO, NULL, 0); } }
-
-#define RT28XX_MLME_STA_QUICK_RSP_WAKE_UP(pAd)	\
-	{	RTUSBEnqueueInternalCmd(pAd, CMDTHREAD_QKERIODIC_EXECUT, NULL, 0);	\
-		RTUSBMlmeUp(pAd); }
-
-#define RT28XX_MLME_RESET_STATE_MACHINE(pAd)	\
-		        MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_RESET_CONF, 0, NULL);	\
-		        RTUSBMlmeUp(pAd);
-
-#define RT28XX_HANDLE_COUNTER_MEASURE(_pAd, _pEntry)		\
-	{	RTUSBEnqueueInternalCmd(_pAd, CMDTHREAD_802_11_COUNTER_MEASURE, _pEntry, sizeof(MAC_TABLE_ENTRY));	\
-		RTUSBMlmeUp(_pAd);									\
-	}
-
-
-/* ----------------- Power Save Related MACRO ----------------- */
-#define RT28XX_PS_POLL_ENQUEUE(pAd)						\
-	{	RTUSB_SET_BULK_FLAG(pAd, fRTUSB_BULK_OUT_PSPOLL);	\
-		RTUSBKickBulkOut(pAd); }
-
-#define RT28xx_CHIP_NAME            "RTxx70"
-
-#define USB_CYC_CFG                 0x02a4
-#define STATUS_SUCCESS				0x00
-#define STATUS_UNSUCCESSFUL 		0x01
-#define NT_SUCCESS(status)			(((status) > 0) ? (1):(0))
-#define InterlockedIncrement 	 	atomic_inc
-#define NdisInterlockedIncrement 	atomic_inc
-#define InterlockedDecrement		atomic_dec
-#define NdisInterlockedDecrement 	atomic_dec
-#define InterlockedExchange			atomic_set
-//#define NdisMSendComplete			RTMP_SendComplete
-#define NdisMCancelTimer			RTMPCancelTimer
-#define NdisAllocMemory(_ptr, _size, _flag)	\
-									do{_ptr = kmalloc((_size),(_flag));}while(0)
-#define NdisFreeMemory(a, b, c) 	kfree((a))
-#define NdisMSleep					RTMPusecDelay		/* unit: microsecond */
-
-
-#define USBD_TRANSFER_DIRECTION_OUT		0
-#define USBD_TRANSFER_DIRECTION_IN		0
-#define USBD_SHORT_TRANSFER_OK			0
-#define PURB			purbb_t
-
-#define RTUSB_FREE_URB(pUrb)	usb_free_urb(pUrb)
-
-//#undef MlmeAllocateMemory
-//#undef MlmeFreeMemory
-
-typedef struct usb_device	* PUSB_DEV;
-
-/* MACRO for linux usb */
-typedef struct urb *purbb_t;
-typedef struct usb_ctrlrequest devctrlrequest;
-#define PIRP		PVOID
-#define PMDL		PVOID
-#define NDIS_OID	UINT
-#ifndef USB_ST_NOERROR
-#define USB_ST_NOERROR     0
-#endif
-
-// vendor-specific control operations
-#define CONTROL_TIMEOUT_JIFFIES ( (100 * HZ) / 1000)
-#define UNLINK_TIMEOUT_MS		3
-
-/* unlink urb	*/
-#define RTUSB_UNLINK_URB(pUrb)		usb_kill_urb(pUrb)
-
-// Prototypes of completion funuc.
-VOID RTUSBBulkOutDataPacketComplete(purbb_t purb, struct pt_regs *pt_regs);
-VOID RTUSBBulkOutMLMEPacketComplete(purbb_t pUrb, struct pt_regs *pt_regs);
-VOID RTUSBBulkOutNullFrameComplete(purbb_t pUrb, struct pt_regs *pt_regs);
-VOID RTUSBBulkOutRTSFrameComplete(purbb_t pUrb, struct pt_regs *pt_regs);
-VOID RTUSBBulkOutPsPollComplete(purbb_t pUrb, struct pt_regs *pt_regs);
-VOID RTUSBBulkRxComplete(purbb_t pUrb, struct pt_regs *pt_regs);
-
-#define RTUSBMlmeUp(pAd)	        \
-{								    \
-	POS_COOKIE pObj = (POS_COOKIE) pAd->OS_Cookie;	\
-	if (pid_nr(pObj->MLMEThr_pid) > 0) \
-        up(&(pAd->mlme_semaphore)); \
-}
-
-#define RTUSBCMDUp(pAd)	                \
-{									    \
-	POS_COOKIE pObj = (POS_COOKIE) pAd->OS_Cookie;	\
-	if (pid_nr(pObj->RTUSBCmdThr_pid) > 0) \
-	    up(&(pAd->RTUSBCmd_semaphore)); \
-}
-
-static inline NDIS_STATUS RTMPAllocateMemory(
-	OUT PVOID *ptr,
-	IN size_t size)
-{
-	*ptr = kmalloc(size, GFP_ATOMIC);
-	if(*ptr)
-		return NDIS_STATUS_SUCCESS;
-	else
-		return NDIS_STATUS_RESOURCES;
-}
-
-/* rtmp.h */
-#define	BEACON_RING_SIZE                2
-#define DEVICE_VENDOR_REQUEST_OUT       0x40
-#define DEVICE_VENDOR_REQUEST_IN        0xc0
-#define INTERFACE_VENDOR_REQUEST_OUT    0x41
-#define INTERFACE_VENDOR_REQUEST_IN     0xc1
-#define MGMTPIPEIDX						0	// EP6 is highest priority
-
-#define BULKOUT_MGMT_RESET_FLAG				0x80
-
-#define RTUSB_SET_BULK_FLAG(_M, _F)				((_M)->BulkFlags |= (_F))
-#define RTUSB_CLEAR_BULK_FLAG(_M, _F)			((_M)->BulkFlags &= ~(_F))
-#define RTUSB_TEST_BULK_FLAG(_M, _F)			(((_M)->BulkFlags & (_F)) != 0)
-
-#define EnqueueCmd(cmdq, cmdqelmt)		\
-{										\
-	if (cmdq->size == 0)				\
-		cmdq->head = cmdqelmt;			\
-	else								\
-		cmdq->tail->next = cmdqelmt;	\
-	cmdq->tail = cmdqelmt;				\
-	cmdqelmt->next = NULL;				\
-	cmdq->size++;						\
-}
-
-typedef struct   _RT_SET_ASIC_WCID {
-	ULONG WCID;          // mechanism for rekeying: 0:disable, 1: time-based, 2: packet-based
-	ULONG SetTid;        // time-based: seconds, packet-based: kilo-packets
-	ULONG DeleteTid;        // time-based: seconds, packet-based: kilo-packets
-	UCHAR Addr[MAC_ADDR_LEN];	// avoid in interrupt when write key
-} RT_SET_ASIC_WCID,*PRT_SET_ASIC_WCID;
-
-typedef struct   _RT_SET_ASIC_WCID_ATTRI {
-	ULONG	WCID;          // mechanism for rekeying: 0:disable, 1: time-based, 2: packet-based
-	ULONG	Cipher;        // ASIC Cipher definition
-	UCHAR	Addr[ETH_LENGTH_OF_ADDRESS];
-} RT_SET_ASIC_WCID_ATTRI,*PRT_SET_ASIC_WCID_ATTRI;
-
-typedef struct _MLME_MEMORY_STRUCT {
-	PVOID                           AllocVa;    //Pointer to the base virtual address of the allocated memory
-	struct _MLME_MEMORY_STRUCT      *Next;      //Pointer to the next virtual address of the allocated memory
-}   MLME_MEMORY_STRUCT, *PMLME_MEMORY_STRUCT;
-
-typedef struct  _MLME_MEMORY_HANDLER {
-	BOOLEAN                 MemRunning;         //The flag of the Mlme memory handler's status
-	UINT                    MemoryCount;        //Total nonpaged system-space memory not size
-	UINT                    InUseCount;         //Nonpaged system-space memory in used counts
-	UINT                    UnUseCount;         //Nonpaged system-space memory available counts
-	INT                    PendingCount;       //Nonpaged system-space memory for free counts
-	PMLME_MEMORY_STRUCT     pInUseHead;         //Pointer to the first nonpaed memory not used
-	PMLME_MEMORY_STRUCT     pInUseTail;         //Pointer to the last nonpaged memory not used
-	PMLME_MEMORY_STRUCT     pUnUseHead;         //Pointer to the first nonpaged memory in used
-	PMLME_MEMORY_STRUCT     pUnUseTail;         //Pointer to the last nonpaged memory in used
-	PULONG                  MemFreePending[MAX_MLME_HANDLER_MEMORY];   //an array to keep pending free-memory's pointer (32bits)
-}   MLME_MEMORY_HANDLER, *PMLME_MEMORY_HANDLER;
-
-typedef	struct _CmdQElmt	{
-	UINT				command;
-	PVOID				buffer;
-	ULONG				bufferlength;
-	BOOLEAN				CmdFromNdis;
-	BOOLEAN				SetOperation;
-	struct _CmdQElmt	*next;
-}	CmdQElmt, *PCmdQElmt;
-
-typedef	struct	_CmdQ	{
-	UINT		size;
-	CmdQElmt	*head;
-	CmdQElmt	*tail;
-	UINT32		CmdQState;
-}CmdQ, *PCmdQ;
-
-/* oid.h */
-// Cipher suite type for mixed mode group cipher, P802.11i-2004
-typedef enum _RT_802_11_CIPHER_SUITE_TYPE {
-	Cipher_Type_NONE,
-	Cipher_Type_WEP40,
-	Cipher_Type_TKIP,
-	Cipher_Type_RSVD,
-	Cipher_Type_CCMP,
-	Cipher_Type_WEP104
-} RT_802_11_CIPHER_SUITE_TYPE, *PRT_802_11_CIPHER_SUITE_TYPE;
-
-//CMDTHREAD_MULTI_READ_MAC
-//CMDTHREAD_MULTI_WRITE_MAC
-//CMDTHREAD_VENDOR_EEPROM_READ
-//CMDTHREAD_VENDOR_EEPROM_WRITE
-typedef	struct	_CMDHandler_TLV	{
-	USHORT		Offset;
-	USHORT		Length;
-	UCHAR		DataFirst;
-}	CMDHandler_TLV, *PCMDHandler_TLV;
-
-// New for MeetingHouse Api support
-#define CMDTHREAD_VENDOR_RESET                      0x0D730101	// cmd
-#define CMDTHREAD_VENDOR_UNPLUG                     0x0D730102	// cmd
-#define CMDTHREAD_VENDOR_SWITCH_FUNCTION            0x0D730103	// cmd
-#define CMDTHREAD_MULTI_WRITE_MAC                   0x0D730107	// cmd
-#define CMDTHREAD_MULTI_READ_MAC                    0x0D730108	// cmd
-#define CMDTHREAD_VENDOR_EEPROM_WRITE               0x0D73010A	// cmd
-#define CMDTHREAD_VENDOR_EEPROM_READ                0x0D73010B	// cmd
-#define CMDTHREAD_VENDOR_ENTER_TESTMODE             0x0D73010C	// cmd
-#define CMDTHREAD_VENDOR_EXIT_TESTMODE              0x0D73010D	// cmd
-#define CMDTHREAD_VENDOR_WRITE_BBP                  0x0D730119	// cmd
-#define CMDTHREAD_VENDOR_READ_BBP                   0x0D730118	// cmd
-#define CMDTHREAD_VENDOR_WRITE_RF                   0x0D73011A	// cmd
-#define CMDTHREAD_VENDOR_FLIP_IQ                    0x0D73011D	// cmd
-#define CMDTHREAD_RESET_BULK_OUT                    0x0D730210	// cmd
-#define CMDTHREAD_RESET_BULK_IN                     0x0D730211	// cmd
-#define CMDTHREAD_SET_PSM_BIT_SAVE                  0x0D730212	// cmd
-#define CMDTHREAD_SET_RADIO                         0x0D730214	// cmd
-#define CMDTHREAD_UPDATE_TX_RATE                    0x0D730216	// cmd
-#define CMDTHREAD_802_11_ADD_KEY_WEP                0x0D730218	// cmd
-#define CMDTHREAD_RESET_FROM_ERROR                  0x0D73021A	// cmd
-#define CMDTHREAD_LINK_DOWN                         0x0D73021B	// cmd
-#define CMDTHREAD_RESET_FROM_NDIS                   0x0D73021C	// cmd
-#define CMDTHREAD_CHECK_GPIO                        0x0D730215	// cmd
-#define CMDTHREAD_FORCE_WAKE_UP                     0x0D730222	// cmd
-#define CMDTHREAD_SET_BW                            0x0D730225	// cmd
-#define CMDTHREAD_SET_ASIC_WCID                     0x0D730226	// cmd
-#define CMDTHREAD_SET_ASIC_WCID_CIPHER              0x0D730227	// cmd
-#define CMDTHREAD_QKERIODIC_EXECUT                  0x0D73023D	// cmd
-#define CMDTHREAD_SET_CLIENT_MAC_ENTRY              0x0D73023E	// cmd
-#define CMDTHREAD_802_11_QUERY_HARDWARE_REGISTER    0x0D710105	// cmd
-#define CMDTHREAD_802_11_SET_PHY_MODE               0x0D79010C	// cmd
-#define CMDTHREAD_802_11_SET_STA_CONFIG             0x0D790111	// cmd
-#define CMDTHREAD_802_11_SET_PREAMBLE               0x0D790101	// cmd
-#define CMDTHREAD_802_11_COUNTER_MEASURE			0x0D790102	// cmd
-#define CMDTHREAD_UPDATE_PROTECT					0x0D790103	// cmd
-
-#define WPA1AKMBIT	    0x01
-#define WPA2AKMBIT	    0x02
-#define WPA1PSKAKMBIT   0x04
-#define WPA2PSKAKMBIT   0x08
-#define TKIPBIT         0x01
-#define CCMPBIT         0x02
-
-
-#define RT28XX_STA_FORCE_WAKEUP(pAd, bFromTx) \
-    RT28xxUsbStaAsicForceWakeup(pAd, bFromTx);
-
-#define RT28XX_STA_SLEEP_THEN_AUTO_WAKEUP(pAd, TbttNumToNextWakeUp) \
-    RT28xxUsbStaAsicSleepThenAutoWakeup(pAd, TbttNumToNextWakeUp);
-
-#define RT28XX_MLME_RADIO_ON(pAd) \
-    RT28xxUsbMlmeRadioOn(pAd);
-
-#define RT28XX_MLME_RADIO_OFF(pAd) \
-    RT28xxUsbMlmeRadioOFF(pAd);
-
-#endif //__RT2870_H__
diff --git a/drivers/staging/rt2870/rt_usb.c b/drivers/staging/rt2870/rt_usb.c
new file mode 100644
index 000000000000..5e02d4c88d73
--- /dev/null
+++ b/drivers/staging/rt2870/rt_usb.c
@@ -0,0 +1 @@
+#include "../rt2860/rt_usb.c"
diff --git a/drivers/staging/rt2870/usb_main_dev.c b/drivers/staging/rt2870/usb_main_dev.c
new file mode 100644
index 000000000000..6e63bc50047a
--- /dev/null
+++ b/drivers/staging/rt2870/usb_main_dev.c
@@ -0,0 +1 @@
+#include "../rt2860/usb_main_dev.c"
diff --git a/drivers/staging/rt3070/firmware.h b/drivers/staging/rt3070/firmware.h
index b07783ed8dd0..5cf9cbcf4ab6 100644
--- a/drivers/staging/rt3070/firmware.h
+++ b/drivers/staging/rt3070/firmware.h
@@ -43,7 +43,7 @@
 /* AUTO GEN PLEASE DO NOT MODIFY IT */
 
 
-UCHAR FirmwareImage [] = {
+u8 FirmwareImage_2870 [] = {
 0xff, 0xff, 0xff, 0x02, 0x10, 0x28, 0x02, 0x10, 0x32, 0x02, 0x10, 0x78, 0x02, 0x12, 0x67, 0x02,
 0x12, 0x68, 0x02, 0x12, 0x87, 0x02, 0x12, 0x8c, 0x12, 0x12, 0x88, 0x22, 0x02, 0x16, 0x49, 0x02,
 0x17, 0x1f, 0x02, 0x13, 0x77, 0x02, 0x12, 0x8d, 0x30, 0x05, 0x06, 0x20, 0x0d, 0x03, 0x12, 0x17,
diff --git a/drivers/staging/rt3070/md4.h b/drivers/staging/rt3070/md4.h
index f1e5b526350a..a9cc7b0f3ee3 100644
--- a/drivers/staging/rt3070/md4.h
+++ b/drivers/staging/rt3070/md4.h
@@ -30,13 +30,13 @@
 
 /* MD4 context. */
 typedef	struct	_MD4_CTX_	{
-	ULONG	state[4];        /* state (ABCD) */
-	ULONG	count[2];        /* number of bits, modulo 2^64 (lsb first) */
-	UCHAR	buffer[64];      /* input buffer */
+	unsigned long	state[4];        /* state (ABCD) */
+	unsigned long	count[2];        /* number of bits, modulo 2^64 (lsb first) */
+	u8	buffer[64];      /* input buffer */
 }	MD4_CTX;
 
-VOID MD4Init (MD4_CTX *);
-VOID MD4Update (MD4_CTX *, PUCHAR, UINT);
-VOID MD4Final (UCHAR [16], MD4_CTX *);
+void MD4Init (MD4_CTX *);
+void MD4Update (MD4_CTX *, u8 *, UINT);
+void MD4Final (u8 [16], MD4_CTX *);
 
 #endif //__MD4_H__
\ No newline at end of file
diff --git a/drivers/staging/rt3090/Kconfig b/drivers/staging/rt3090/Kconfig
deleted file mode 100644
index 2b3f745d72b7..000000000000
--- a/drivers/staging/rt3090/Kconfig
+++ /dev/null
@@ -1,5 +0,0 @@
-config RT3090
-	tristate "Ralink 3090 wireless support"
-	depends on PCI && X86 && WLAN
-	---help---
-	  This is an experimental driver for the Ralink 3090 wireless chip.
diff --git a/drivers/staging/rt3090/Makefile b/drivers/staging/rt3090/Makefile
deleted file mode 100644
index 995491c91fce..000000000000
--- a/drivers/staging/rt3090/Makefile
+++ /dev/null
@@ -1,80 +0,0 @@
-obj-$(CONFIG_RT3090)	+= rt3090sta.o
-
-include drivers/staging/rt3090/config.mk
-
-rt3090sta-objs := \
-	common/crypt_md5.o \
-	common/crypt_sha2.o \
-	common/crypt_hmac.o \
-	common/mlme.o \
-	common/cmm_wep.o \
-	common/action.o \
-	common/cmm_data.o \
-	common/rtmp_init.o \
-	common/cmm_tkip.o \
-	common/cmm_aes.o \
-	common/cmm_sync.o \
-	common/eeprom.o \
-	common/cmm_sanity.o \
-	common/cmm_info.o \
-	common/cmm_cfg.o \
-	common/cmm_wpa.o \
-	common/dfs.o \
-	common/spectrum.o \
-	common/rtmp_timer.o \
-	common/rt_channel.o \
-	common/cmm_profile.o \
-	common/cmm_asic.o \
-	sta/assoc.o \
-	sta/auth.o \
-	sta/auth_rsp.o \
-	sta/sync.o \
-	sta/sanity.o \
-	sta/rtmp_data.o \
-	sta/connect.o \
-	sta/wpa.o \
-	rt_linux.o \
-	rt_profile.o \
-	rt_main_dev.o \
-	sta_ioctl.o
-
-#ifdef DOT11_N_SUPPORT
-ifeq ($(HAS_DOT11_N_SUPPORT),y)
-rt3090sta-objs += \
-	common/ba_action.o
-endif
-#endif // DOT11_N_SUPPORT //
-
-#ifdef ETH_CONVERT
-ifeq ($(HAS_ETH_CONVERT_SUPPORT), y)
-rt3090sta-objs += \
-	common/cmm_mat.o \
-	common/cmm_mat_iparp.o \
-	common/cmm_mat_pppoe.o \
-	common/cmm_mat_ipv6.o
-endif
-#endif // ETH_CONVERT //
-
-ifeq ($(HAS_BLOCK_NET_IF),y)
-rt3090sta-objs += common/netif_block.o
-endif
-
-ifeq ($(HAS_QOS_DLS_SUPPORT),y)
-rt3090sta-objs += sta/dls.o
-endif
-
-rt3090sta-objs += \
-	pci_main_dev.o \
-	rt_pci_rbus.o \
-	common/cmm_mac_pci.o \
-	common/cmm_data_pci.o \
-	common/ee_prom.o \
-	common/ee_efuse.o \
-	common/rtmp_mcu.o \
-	chips/rt30xx.o \
-	common/rt_rf.o \
-	chips/rt3090.o
-
-ifeq ($(HAS_ATE),y)
-rt3090sta-objs += rt_ate.o
-endif
diff --git a/drivers/staging/rt3090/action.h b/drivers/staging/rt3090/action.h
deleted file mode 100644
index ac0a0a3c5ce4..000000000000
--- a/drivers/staging/rt3090/action.h
+++ /dev/null
@@ -1,66 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-	Module Name:
-	aironet.h
-
-	Abstract:
-
-	Revision History:
-	Who			When			What
-	--------	----------		----------------------------------------------
-	Name		Date			Modification logs
-	Paul Lin	04-06-15		Initial
-*/
-
-#ifndef	__ACTION_H__
-#define	__ACTION_H__
-
-typedef struct PACKED __HT_INFO_OCTET
-{
-#ifdef RT_BIG_ENDIAN
-	UCHAR	Reserved:5;
-	UCHAR	STA_Channel_Width:1;
-	UCHAR	Forty_MHz_Intolerant:1;
-	UCHAR	Request:1;
-#else
-	UCHAR	Request:1;
-	UCHAR	Forty_MHz_Intolerant:1;
-	UCHAR	STA_Channel_Width:1;
-	UCHAR	Reserved:5;
-#endif
-} HT_INFORMATION_OCTET;
-
-
-typedef struct PACKED __FRAME_HT_INFO
-{
-	HEADER_802_11			Hdr;
-	UCHAR					Category;
-	UCHAR					Action;
-	HT_INFORMATION_OCTET	HT_Info;
-}   FRAME_HT_INFO, *PFRAME_HT_INFO;
-
-#endif /* __ACTION_H__ */
diff --git a/drivers/staging/rt3090/ap.h b/drivers/staging/rt3090/ap.h
deleted file mode 100644
index e89430381071..000000000000
--- a/drivers/staging/rt3090/ap.h
+++ /dev/null
@@ -1,512 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-    Module Name:
-    ap.h
-
-    Abstract:
-    Miniport generic portion header file
-
-    Revision History:
-    Who         When          What
-    --------    ----------    ----------------------------------------------
-    Paul Lin    08-01-2002    created
-    James Tan   09-06-2002    modified (Revise NTCRegTable)
-    John Chang  12-22-2004    modified for RT2561/2661. merge with STA driver
-*/
-#ifndef __AP_H__
-#define __AP_H__
-
-
-// =============================================================
-//      Function Prototypes
-// =============================================================
-
-// ap_data.c
-
-BOOLEAN APBridgeToWirelessSta(
-    IN  PRTMP_ADAPTER   pAd,
-    IN  PUCHAR          pHeader,
-    IN  UINT            HdrLen,
-    IN  PUCHAR          pData,
-    IN  UINT            DataLen,
-    IN  ULONG           fromwdsidx);
-
-
-VOID	APSendPackets(
-	IN	NDIS_HANDLE		MiniportAdapterContext,
-	IN	PPNDIS_PACKET	ppPacketArray,
-	IN	UINT			NumberOfPackets);
-
-NDIS_STATUS APSendPacket(
-    IN  PRTMP_ADAPTER   pAd,
-    IN  PNDIS_PACKET    pPacket);
-
-
-NDIS_STATUS APHardTransmit(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	TX_BLK			*pTxBlk,
-	IN	UCHAR			QueIdx);
-
-VOID APRxEAPOLFrameIndicate(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	MAC_TABLE_ENTRY	*pEntry,
-	IN	RX_BLK			*pRxBlk,
-	IN	UCHAR			FromWhichBSSID);
-
-NDIS_STATUS APCheckRxError(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PRT28XX_RXD_STRUC		pRxD,
-	IN	UCHAR			Wcid);
-
-BOOLEAN APCheckClass2Class3Error(
-    IN  PRTMP_ADAPTER   pAd,
-	IN ULONG Wcid,
-	IN  PHEADER_802_11  pHeader);
-
-VOID APHandleRxPsPoll(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			pAddr,
-	IN	USHORT			Aid,
-    IN	BOOLEAN			isActive);
-
-VOID    RTMPDescriptorEndianChange(
-    IN  PUCHAR          pData,
-    IN  ULONG           DescriptorType);
-
-VOID    RTMPFrameEndianChange(
-    IN  PRTMP_ADAPTER   pAd,
-    IN  PUCHAR          pData,
-    IN  ULONG           Dir,
-    IN  BOOLEAN         FromRxDoneInt);
-
-// ap_assoc.c
-
-VOID APAssocStateMachineInit(
-    IN  PRTMP_ADAPTER   pAd,
-    IN  STATE_MACHINE *S,
-    OUT STATE_MACHINE_FUNC Trans[]);
-
-VOID  APPeerAssocReqAction(
-    IN  PRTMP_ADAPTER   pAd,
-    IN  MLME_QUEUE_ELEM *Elem);
-
-VOID  APPeerReassocReqAction(
-    IN  PRTMP_ADAPTER   pAd,
-    IN  MLME_QUEUE_ELEM *Elem);
-
-VOID  APPeerDisassocReqAction(
-    IN  PRTMP_ADAPTER   pAd,
-    IN  MLME_QUEUE_ELEM *Elem);
-
-VOID MbssKickOutStas(
-	IN PRTMP_ADAPTER pAd,
-	IN INT apidx,
-	IN USHORT Reason);
-
-VOID APMlmeKickOutSta(
-    IN PRTMP_ADAPTER pAd,
-	IN PUCHAR pStaAddr,
-	IN UCHAR Wcid,
-	IN USHORT Reason);
-
-VOID APMlmeDisassocReqAction(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem);
-
-VOID  APCls3errAction(
-    IN  PRTMP_ADAPTER   pAd,
-	IN	ULONG Wcid,
-    IN	PHEADER_802_11	pHeader);
-
-
-USHORT APBuildAssociation(
-    IN PRTMP_ADAPTER pAd,
-    IN MAC_TABLE_ENTRY *pEntry,
-    IN USHORT CapabilityInfo,
-    IN UCHAR  MaxSupportedRateIn500Kbps,
-    IN UCHAR  *RSN,
-    IN UCHAR  *pRSNLen,
-    IN BOOLEAN bWmmCapable,
-    IN ULONG  RalinkIe,
-#ifdef DOT11N_DRAFT3
-    IN EXT_CAP_INFO_ELEMENT ExtCapInfo,
-#endif // DOT11N_DRAFT3 //
-	IN HT_CAPABILITY_IE		*pHtCapability,
-	IN UCHAR		 HtCapabilityLen,
-    OUT USHORT *pAid);
-
-/*
-VOID	RTMPAddClientSec(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR	BssIdx,
-	IN UCHAR		 KeyIdx,
-	IN UCHAR		 CipherAlg,
-	IN PUCHAR		 pKey,
-	IN PUCHAR		 pTxMic,
-	IN PUCHAR		 pRxMic,
-	IN MAC_TABLE_ENTRY *pEntry);
-*/
-
-// ap_auth.c
-
-void APAuthStateMachineInit(
-    IN PRTMP_ADAPTER pAd,
-    IN STATE_MACHINE *Sm,
-    OUT STATE_MACHINE_FUNC Trans[]);
-
-VOID APCls2errAction(
-    IN PRTMP_ADAPTER pAd,
-	IN	ULONG Wcid,
-    IN	PHEADER_802_11	pHeader);
-
-// ap_connect.c
-
-
-VOID APMakeBssBeacon(
-    IN  PRTMP_ADAPTER   pAd,
-	IN	INT				apidx);
-
-VOID  APUpdateBeaconFrame(
-    IN  PRTMP_ADAPTER   pAd,
-	IN	INT				apidx);
-
-VOID APMakeAllBssBeacon(
-    IN  PRTMP_ADAPTER   pAd);
-
-VOID  APUpdateAllBeaconFrame(
-    IN  PRTMP_ADAPTER   pAd);
-
-
-// ap_sync.c
-
-VOID APSyncStateMachineInit(
-    IN PRTMP_ADAPTER pAd,
-    IN STATE_MACHINE *Sm,
-    OUT STATE_MACHINE_FUNC Trans[]);
-
-VOID APScanTimeout(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3);
-
-VOID APInvalidStateWhenScan(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem);
-
-VOID APScanTimeoutAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem);
-
-VOID APPeerProbeReqAction(
-    IN  PRTMP_ADAPTER pAd,
-    IN  MLME_QUEUE_ELEM *Elem);
-
-VOID APPeerBeaconAction(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem);
-
-VOID APMlmeScanReqAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem);
-
-VOID APPeerBeaconAtScanAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem);
-
-VOID APScanCnclAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem);
-
-VOID ApSiteSurvey(
-	IN	PRTMP_ADAPTER		pAd,
-	IN	PNDIS_802_11_SSID	pSsid,
-	IN	UCHAR				ScanType);
-
-VOID SupportRate(
-	IN PUCHAR SupRate,
-	IN UCHAR SupRateLen,
-	IN PUCHAR ExtRate,
-	IN UCHAR ExtRateLen,
-	OUT PUCHAR *Rates,
-	OUT PUCHAR RatesLen,
-	OUT PUCHAR pMaxSupportRate);
-
-
-BOOLEAN ApScanRunning(
-	IN PRTMP_ADAPTER pAd);
-
-#ifdef DOT11N_DRAFT3
-VOID APOverlappingBSSScan(
-	IN RTMP_ADAPTER *pAd);
-#endif // DOT11N_DRAFT3 //
-
-// ap_wpa.c
-VOID WpaStateMachineInit(
-    IN  PRTMP_ADAPTER   pAd,
-    IN  STATE_MACHINE *Sm,
-    OUT STATE_MACHINE_FUNC Trans[]);
-
-// ap_mlme.c
-VOID APMlmePeriodicExec(
-    IN  PRTMP_ADAPTER   pAd);
-
-VOID APMlmeSelectTxRateTable(
-	IN PRTMP_ADAPTER		pAd,
-	IN PMAC_TABLE_ENTRY		pEntry,
-	IN PUCHAR				*ppTable,
-	IN PUCHAR				pTableSize,
-	IN PUCHAR				pInitTxRateIdx);
-
-VOID APMlmeSetTxRate(
-	IN PRTMP_ADAPTER		pAd,
-	IN PMAC_TABLE_ENTRY		pEntry,
-	IN PRTMP_TX_RATE_SWITCH	pTxRate);
-
-VOID APMlmeDynamicTxRateSwitching(
-    IN PRTMP_ADAPTER pAd);
-
-VOID APQuickResponeForRateUpExec(
-    IN PVOID SystemSpecific1,
-    IN PVOID FunctionContext,
-    IN PVOID SystemSpecific2,
-    IN PVOID SystemSpecific3);
-
-BOOLEAN APMsgTypeSubst(
-    IN PRTMP_ADAPTER pAd,
-    IN PFRAME_802_11 pFrame,
-    OUT INT *Machine,
-    OUT INT *MsgType);
-
-VOID APQuickResponeForRateUpExec(
-    IN PVOID SystemSpecific1,
-    IN PVOID FunctionContext,
-    IN PVOID SystemSpecific2,
-    IN PVOID SystemSpecific3);
-
-
-VOID RTMPSetPiggyBack(
-	IN PRTMP_ADAPTER	pAd,
-	IN BOOLEAN			bPiggyBack);
-
-VOID APAsicEvaluateRxAnt(
-	IN PRTMP_ADAPTER	pAd);
-
-VOID APAsicRxAntEvalTimeout(
-	IN PRTMP_ADAPTER	pAd);
-
-// ap.c
-
-VOID APSwitchChannel(
-	IN PRTMP_ADAPTER pAd,
-	IN INT Channel);
-
-NDIS_STATUS APInitialize(
-    IN  PRTMP_ADAPTER   pAd);
-
-VOID APShutdown(
-    IN PRTMP_ADAPTER    pAd);
-
-VOID APStartUp(
-    IN  PRTMP_ADAPTER   pAd);
-
-VOID APStop(
-    IN  PRTMP_ADAPTER   pAd);
-
-VOID APCleanupPsQueue(
-    IN  PRTMP_ADAPTER   pAd,
-    IN  PQUEUE_HEADER   pQueue);
-
-VOID MacTableReset(
-    IN  PRTMP_ADAPTER   pAd);
-
-MAC_TABLE_ENTRY *MacTableInsertEntry(
-    IN  PRTMP_ADAPTER   pAd,
-    IN  PUCHAR          pAddr,
-	IN	UCHAR			apidx,
-	IN BOOLEAN	CleanAll);
-
-BOOLEAN MacTableDeleteEntry(
-    IN  PRTMP_ADAPTER   pAd,
-	IN USHORT wcid,
-    IN  PUCHAR          pAddr);
-
-MAC_TABLE_ENTRY *MacTableLookup(
-    IN  PRTMP_ADAPTER   pAd,
-    IN  PUCHAR          pAddr);
-
-VOID MacTableMaintenance(
-    IN PRTMP_ADAPTER pAd);
-
-UINT32 MacTableAssocStaNumGet(
-	IN PRTMP_ADAPTER pAd);
-
-MAC_TABLE_ENTRY *APSsPsInquiry(
-    IN  PRTMP_ADAPTER   pAd,
-    IN  PUCHAR          pAddr,
-    OUT SST             *Sst,
-    OUT USHORT          *Aid,
-    OUT UCHAR           *PsMode,
-    OUT UCHAR           *Rate);
-
-BOOLEAN APPsIndicate(
-    IN  PRTMP_ADAPTER   pAd,
-    IN  PUCHAR          pAddr,
-	IN ULONG Wcid,
-    IN  UCHAR           Psm);
-
-VOID ApLogEvent(
-    IN PRTMP_ADAPTER    pAd,
-    IN PUCHAR           pAddr,
-    IN USHORT           Event);
-
-#ifdef DOT11_N_SUPPORT
-VOID APUpdateOperationMode(
-    IN PRTMP_ADAPTER pAd);
-#endif // DOT11_N_SUPPORT //
-
-VOID APUpdateCapabilityAndErpIe(
-	IN PRTMP_ADAPTER pAd);
-
-BOOLEAN ApCheckAccessControlList(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR        pAddr,
-	IN UCHAR         Apidx);
-
-VOID ApUpdateAccessControlList(
-    IN PRTMP_ADAPTER pAd,
-    IN UCHAR         Apidx);
-
-VOID ApEnqueueNullFrame(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR        pAddr,
-	IN UCHAR         TxRate,
-	IN UCHAR         PID,
-	IN UCHAR         apidx,
-    IN BOOLEAN       bQosNull,
-    IN BOOLEAN       bEOSP,
-    IN UCHAR         OldUP);
-
-VOID ApSendFrame(
-    IN  PRTMP_ADAPTER   pAd,
-    IN  PVOID           pBuffer,
-    IN  ULONG           Length,
-    IN  UCHAR           TxRate,
-    IN  UCHAR           PID);
-
-VOID ApEnqueueAckFrame(
-    IN PRTMP_ADAPTER pAd,
-    IN PUCHAR        pAddr,
-    IN UCHAR         TxRate,
-	IN UCHAR         apidx);
-
-// ap_sanity.c
-
-
-BOOLEAN PeerAssocReqCmmSanity(
-    IN PRTMP_ADAPTER pAd,
-	IN BOOLEAN isRessoc,
-    IN VOID *Msg,
-    IN ULONG MsgLen,
-    OUT PUCHAR pAddr2,
-    OUT USHORT *pCapabilityInfo,
-    OUT USHORT *pListenInterval,
-    OUT PUCHAR pApAddr,
-    OUT UCHAR *pSsidLen,
-    OUT char *Ssid,
-    OUT UCHAR *pRatesLen,
-    OUT UCHAR Rates[],
-    OUT UCHAR *RSN,
-    OUT UCHAR *pRSNLen,
-    OUT BOOLEAN *pbWmmCapable,
-    OUT ULONG  *pRalinkIe,
-#ifdef DOT11N_DRAFT3
-    OUT EXT_CAP_INFO_ELEMENT	*pExtCapInfo,
-#endif // DOT11N_DRAFT3 //
-    OUT UCHAR		 *pHtCapabilityLen,
-    OUT HT_CAPABILITY_IE *pHtCapability);
-
-
-BOOLEAN PeerDisassocReqSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN VOID *Msg,
-    IN ULONG MsgLen,
-    OUT PUCHAR pAddr2,
-    OUT USHORT *Reason);
-
-BOOLEAN PeerDeauthReqSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN VOID *Msg,
-    IN ULONG MsgLen,
-    OUT PUCHAR pAddr2,
-    OUT USHORT *Reason);
-
-BOOLEAN APPeerAuthSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN VOID *Msg,
-    IN ULONG MsgLen,
-	OUT PUCHAR pAddr1,
-    OUT PUCHAR pAddr2,
-    OUT USHORT *Alg,
-    OUT USHORT *Seq,
-    OUT USHORT *Status,
-    OUT CHAR *ChlgText
-	);
-
-BOOLEAN APPeerProbeReqSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN VOID *Msg,
-    IN ULONG MsgLen,
-    OUT PUCHAR pAddr2,
-    OUT CHAR Ssid[],
-    OUT UCHAR *SsidLen);
-
-BOOLEAN APPeerBeaconAndProbeRspSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN VOID *Msg,
-    IN ULONG MsgLen,
-    OUT PUCHAR pAddr2,
-    OUT PUCHAR pBssid,
-    OUT CHAR Ssid[],
-    OUT UCHAR *SsidLen,
-    OUT UCHAR *BssType,
-    OUT USHORT *BeaconPeriod,
-    OUT UCHAR *Channel,
-    OUT LARGE_INTEGER *Timestamp,
-    OUT USHORT *CapabilityInfo,
-    OUT UCHAR Rate[],
-    OUT UCHAR *RateLen,
-    OUT BOOLEAN *ExtendedRateIeExist,
-    OUT UCHAR *Erp);
-#if defined(RT30xx) || defined(RT305x)
-VOID EnableAPMIMOPS(
-    IN PRTMP_ADAPTER pAd);
-
-VOID DisableAPMIMOPS(
-    IN PRTMP_ADAPTER pAd);
-#endif
-#endif  // __AP_H__
diff --git a/drivers/staging/rt3090/ap_apcli.h b/drivers/staging/rt3090/ap_apcli.h
deleted file mode 100644
index d363c36b8287..000000000000
--- a/drivers/staging/rt3090/ap_apcli.h
+++ /dev/null
@@ -1,276 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-    Module Name:
-    ap_apcli.h
-
-    Abstract:
-    Miniport generic portion header file
-
-    Revision History:
-    Who         When          What
-    --------    ----------    ----------------------------------------------
-    Shiang, Fonchi    02-13-2007      created
-*/
-
-#ifndef _AP_APCLI_H_
-#define _AP_APCLI_H_
-
-#ifdef APCLI_SUPPORT
-
-#include "rtmp.h"
-
-#define AUTH_TIMEOUT	300         // unit: msec
-#define ASSOC_TIMEOUT	300         // unit: msec
-//#define JOIN_TIMEOUT	2000        // unit: msec // not used in Ap-client mode, remove it
-#define PROBE_TIMEOUT	1000        // unit: msec
-
-#define APCLI_ROOT_BSSID_GET(pAd, wcid) ((pAd)->MacTab.Content[(wcid)].Addr)
-#define APCLI_IF_UP_CHECK(pAd, ifidx) ((pAd)->ApCfg.ApCliTab[(ifidx)].dev->flags & IFF_UP)
-
-/* sanity check for apidx */
-#define APCLI_MR_APIDX_SANITY_CHECK(idx) \
-{ \
-	if ((idx) >= MAX_APCLI_NUM) \
-	{ \
-		(idx) = 0; \
-		DBGPRINT(RT_DEBUG_ERROR, ("%s> Error! apcli-idx > MAX_APCLI_NUM!\n", __FUNCTION__)); \
-	} \
-}
-
-typedef struct _APCLI_MLME_JOIN_REQ_STRUCT {
-	UCHAR	Bssid[MAC_ADDR_LEN];
-	UCHAR	SsidLen;
-	UCHAR	Ssid[MAX_LEN_OF_SSID];
-} APCLI_MLME_JOIN_REQ_STRUCT;
-
-typedef struct _STA_CTRL_JOIN_REQ_STRUCT {
-	USHORT	Status;
-} APCLI_CTRL_MSG_STRUCT, *PSTA_CTRL_MSG_STRUCT;
-
-BOOLEAN isValidApCliIf(
-	SHORT ifIndex);
-
-//
-// Private routines in apcli_ctrl.c
-//
-VOID ApCliCtrlStateMachineInit(
-	IN PRTMP_ADAPTER pAd,
-	IN STATE_MACHINE_EX *Sm,
-	OUT STATE_MACHINE_FUNC_EX Trans[]);
-
-//
-// Private routines in apcli_sync.c
-//
-VOID ApCliSyncStateMachineInit(
-    IN PRTMP_ADAPTER pAd,
-    IN STATE_MACHINE_EX *Sm,
-    OUT STATE_MACHINE_FUNC_EX Trans[]);
-
-//
-// Private routines in apcli_auth.c
-//
-VOID ApCliAuthStateMachineInit(
-    IN PRTMP_ADAPTER pAd,
-    IN STATE_MACHINE_EX *Sm,
-    OUT STATE_MACHINE_FUNC_EX Trans[]);
-
-//
-// Private routines in apcli_assoc.c
-//
-VOID ApCliAssocStateMachineInit(
-    IN PRTMP_ADAPTER pAd,
-    IN STATE_MACHINE_EX *Sm,
-    OUT STATE_MACHINE_FUNC_EX Trans[]);
-
-MAC_TABLE_ENTRY *ApCliTableLookUpByWcid(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR wcid,
-	IN PUCHAR pAddrs);
-
-
-BOOLEAN ApCliAllowToSendPacket(
-	IN RTMP_ADAPTER *pAd,
-	IN PNDIS_PACKET pPacket,
-	OUT UCHAR		*pWcid);
-
-BOOLEAN		ApCliValidateRSNIE(
-	IN		PRTMP_ADAPTER	pAd,
-	IN		PEID_STRUCT	pEid_ptr,
-	IN		USHORT			eid_len,
-	IN		USHORT			idx);
-
-VOID RT28xx_ApCli_Init(
-	IN PRTMP_ADAPTER	pAd,
-	IN PNET_DEV			pPhyNetDev);
-
-VOID RT28xx_ApCli_Close(
-	IN PRTMP_ADAPTER	pAd);
-
-VOID RT28xx_ApCli_Remove(
-	IN PRTMP_ADAPTER	pAd);
-
-
-VOID RT28xx_ApCli_Remove(
-	IN PRTMP_ADAPTER ad_p);
-
-INT ApCliIfLookUp(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR pAddr);
-
-INT ApCli_VirtualIF_Open(
-	IN	PNET_DEV	dev_p);
-
-INT ApCli_VirtualIF_Close(
-	IN	PNET_DEV	dev_p);
-
-INT ApCli_VirtualIF_PacketSend(
-	IN PNDIS_PACKET		skb_p,
-	IN PNET_DEV			dev_p);
-
-INT ApCli_VirtualIF_Ioctl(
-	IN PNET_DEV				dev_p,
-	IN OUT struct ifreq	*rq_p,
-	IN INT cmd);
-
-
-VOID ApCliMgtMacHeaderInit(
-    IN	PRTMP_ADAPTER	pAd,
-    IN OUT PHEADER_802_11 pHdr80211,
-    IN UCHAR SubType,
-    IN UCHAR ToDs,
-    IN PUCHAR pDA,
-    IN PUCHAR pBssid,
-    IN USHORT ifIndex);
-
-#ifdef DOT11_N_SUPPORT
-BOOLEAN ApCliCheckHt(
-	IN		PRTMP_ADAPTER		pAd,
-	IN		USHORT				IfIndex,
-	IN OUT	HT_CAPABILITY_IE	*pHtCapability,
-	IN OUT	ADD_HT_INFO_IE		*pAddHtInfo);
-#endif // DOT11_N_SUPPORT //
-
-BOOLEAN ApCliLinkUp(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR ifIndex);
-
-VOID ApCliLinkDown(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR ifIndex);
-
-VOID ApCliIfUp(
-	IN PRTMP_ADAPTER pAd);
-
-VOID ApCliIfDown(
-	IN PRTMP_ADAPTER pAd);
-
-VOID ApCliIfMonitor(
-	IN PRTMP_ADAPTER pAd);
-
-BOOLEAN ApCliMsgTypeSubst(
-	IN PRTMP_ADAPTER  pAd,
-	IN PFRAME_802_11 pFrame,
-	OUT INT *Machine,
-	OUT INT *MsgType);
-
-BOOLEAN preCheckMsgTypeSubset(
-	IN PRTMP_ADAPTER  pAd,
-	IN PFRAME_802_11 pFrame,
-	OUT INT *Machine,
-	OUT INT *MsgType);
-
-BOOLEAN ApCliPeerAssocRspSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN VOID *pMsg,
-    IN ULONG MsgLen,
-    OUT PUCHAR pAddr2,
-    OUT USHORT *pCapabilityInfo,
-    OUT USHORT *pStatus,
-    OUT USHORT *pAid,
-    OUT UCHAR SupRate[],
-    OUT UCHAR *pSupRateLen,
-    OUT UCHAR ExtRate[],
-    OUT UCHAR *pExtRateLen,
-    OUT HT_CAPABILITY_IE *pHtCapability,
-    OUT ADD_HT_INFO_IE *pAddHtInfo,	// AP might use this additional ht info IE
-    OUT UCHAR *pHtCapabilityLen,
-    OUT UCHAR *pAddHtInfoLen,
-    OUT UCHAR *pNewExtChannelOffset,
-    OUT PEDCA_PARM pEdcaParm,
-    OUT UCHAR *pCkipFlag);
-
-VOID	ApCliPeerPairMsg1Action(
-	IN PRTMP_ADAPTER    pAd,
-    IN MAC_TABLE_ENTRY  *pEntry,
-    IN MLME_QUEUE_ELEM  *Elem);
-
-VOID	ApCliPeerPairMsg3Action(
-	IN PRTMP_ADAPTER    pAd,
-    IN MAC_TABLE_ENTRY  *pEntry,
-    IN MLME_QUEUE_ELEM  *Elem);
-
-VOID	ApCliPeerGroupMsg1Action(
-	IN PRTMP_ADAPTER    pAd,
-    IN MAC_TABLE_ENTRY  *pEntry,
-    IN MLME_QUEUE_ELEM  *Elem);
-
-BOOLEAN ApCliCheckRSNIE(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PUCHAR          pData,
-	IN  UCHAR           DataLen,
-	IN  MAC_TABLE_ENTRY *pEntry,
-	OUT	UCHAR			*Offset);
-
-BOOLEAN ApCliParseKeyData(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PUCHAR          pKeyData,
-	IN  UCHAR           KeyDataLen,
-	IN  MAC_TABLE_ENTRY *pEntry,
-	IN	UCHAR			IfIdx,
-	IN	UCHAR			bPairewise);
-
-BOOLEAN  ApCliHandleRxBroadcastFrame(
-	IN  PRTMP_ADAPTER   pAd,
-	IN	RX_BLK			*pRxBlk,
-	IN  MAC_TABLE_ENTRY *pEntry,
-	IN	UCHAR			FromWhichBSSID);
-
-VOID APCliUpdatePairwiseKeyTable(
-	IN  PRTMP_ADAPTER   pAd,
-	IN	UCHAR			*KeyRsc,
-	IN  MAC_TABLE_ENTRY *pEntry);
-
-BOOLEAN APCliUpdateSharedKeyTable(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PUCHAR          pKey,
-	IN  UCHAR           KeyLen,
-	IN	UCHAR			DefaultKeyIdx,
-	IN  MAC_TABLE_ENTRY *pEntry);
-
-#endif // APCLI_SUPPORT //
-
-#endif /* _AP_APCLI_H_ */
diff --git a/drivers/staging/rt3090/ap_autoChSel.h b/drivers/staging/rt3090/ap_autoChSel.h
deleted file mode 100644
index 46881ff857ac..000000000000
--- a/drivers/staging/rt3090/ap_autoChSel.h
+++ /dev/null
@@ -1,79 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-    Module Name:
-    ap_autoChSel.h
-
-    Abstract:
-    Miniport generic portion header file
-
-    Revision History:
-    Who         When          What
-    --------    ----------    ----------------------------------------------
-*/
-
-#include "ap_autoChSel_cmm.h"
-
-#ifndef __AUTOCHSELECT_H__
-#define __AUTOCHSELECT_H__
-
-#ifdef AUTO_CH_SELECT_ENHANCE
-#define AP_AUTO_CH_SEL(__P, __O)	New_APAutoSelectChannel((__P), (__O))
-#else
-#define AP_AUTO_CH_SEL(__P, __O)	APAutoSelectChannel((__P), (__O))
-#endif
-
-
-ULONG AutoChBssInsertEntry(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR pBssid,
-	IN CHAR Ssid[],
-	IN UCHAR SsidLen,
-	IN UCHAR ChannelNo,
-	IN UCHAR ExtChOffset,
-	IN CHAR Rssi);
-
-void AutoChBssTableInit(
-	IN PRTMP_ADAPTER pAd);
-
-void ChannelInfoInit(
-	IN PRTMP_ADAPTER pAd);
-
-void AutoChBssTableDestroy(
-	IN PRTMP_ADAPTER pAd);
-
-void ChannelInfoDestroy(
-	IN PRTMP_ADAPTER pAd);
-
-UCHAR New_APAutoSelectChannel(
-	IN PRTMP_ADAPTER pAd,
-	IN BOOLEAN Optimal);
-
-UCHAR APAutoSelectChannel(
-	IN PRTMP_ADAPTER pAd,
-	IN BOOLEAN Optimal);
-
-#endif // __AUTOCHSELECT_H__ //
diff --git a/drivers/staging/rt3090/ap_autoChSel_cmm.h b/drivers/staging/rt3090/ap_autoChSel_cmm.h
deleted file mode 100644
index ad77ec125625..000000000000
--- a/drivers/staging/rt3090/ap_autoChSel_cmm.h
+++ /dev/null
@@ -1,66 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-    Module Name:
-    ap_autoChSel_cmm.h
-
-    Abstract:
-    Miniport generic portion header file
-
-    Revision History:
-    Who         When          What
-    --------    ----------    ----------------------------------------------
-*/
-
-
-#ifndef __AUTOCHSELECT_CMM_H__
-#define __AUTOCHSELECT_CMM_H__
-
-#define RSSI_TO_DBM_OFFSET 120 // RSSI-115 = dBm
-
-
-typedef struct {
-	ULONG dirtyness[MAX_NUM_OF_CHANNELS+1];
-	ULONG max_rssi[MAX_NUM_OF_CHANNELS+1];
-	ULONG total_rssi[MAX_NUM_OF_CHANNELS+1];
-	UINT32 FalseCCA[MAX_NUM_OF_CHANNELS+1];
-} CHANNELINFO, *PCHANNELINFO;
-
-typedef struct {
-	UCHAR Bssid[MAC_ADDR_LEN];
-	UCHAR SsidLen;
-	CHAR Ssid[MAX_LEN_OF_SSID];
-	UCHAR Channel;
-	UCHAR ExtChOffset;
-	UCHAR Rssi;
-} BSSENTRY, *PBSSENTRY;
-
-typedef struct {
-	UCHAR BssNr;
-	BSSENTRY BssEntry[MAX_LEN_OF_BSS_TABLE];
-} BSSINFO, *PBSSINFO;
-
-#endif // __AUTOCHSELECT_CMM_H__ //
diff --git a/drivers/staging/rt3090/ap_cfg.h b/drivers/staging/rt3090/ap_cfg.h
deleted file mode 100644
index 7c99423900ad..000000000000
--- a/drivers/staging/rt3090/ap_cfg.h
+++ /dev/null
@@ -1,118 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-    Module Name:
-    ap_cfg.h
-
-    Abstract:
-    Miniport generic portion header file
-
-    Revision History:
-    Who         When          What
-    --------    ----------    ----------------------------------------------
-*/
-#ifndef __AP_CFG_H__
-#define __AP_CFG_H__
-
-
-#include "rt_config.h"
-
-INT RTMPAPPrivIoctlSet(
-	IN RTMP_ADAPTER *pAd,
-	IN struct iwreq *pIoctlCmdStr);
-
-INT RTMPAPPrivIoctlShow(
-	IN RTMP_ADAPTER *pAd,
-	IN struct iwreq *pIoctlCmdStr);
-
-INT RTMPAPSetInformation(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	OUT	struct iwreq	*rq,
-	IN	INT				cmd);
-
-INT RTMPAPQueryInformation(
-	IN	PRTMP_ADAPTER       pAd,
-	IN	OUT	struct iwreq    *rq,
-	IN	INT                 cmd);
-
-VOID RTMPIoctlStatistics(
-	IN PRTMP_ADAPTER pAd,
-	IN struct iwreq *wrq);
-
-VOID RTMPIoctlGetMacTable(
-	IN PRTMP_ADAPTER pAd,
-	IN struct iwreq *wrq);
-
-#ifdef DBG
-VOID RTMPAPIoctlBBP(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  struct iwreq    *wrq);
-
-VOID RTMPAPIoctlMAC(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  struct iwreq    *wrq);
-
-VOID RTMPAPIoctlE2PROM(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  struct iwreq    *wrq);
-
-#ifdef RTMP_RF_RW_SUPPORT
-VOID RTMPAPIoctlRF(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq);
-#endif // RTMP_RF_RW_SUPPORT //
-
-#endif // DBG //
-
-VOID RT28XX_IOCTL_MaxRateGet(
-	IN	RTMP_ADAPTER			*pAd,
-	IN	PHTTRANSMIT_SETTING	pHtPhyMode,
-	OUT	UINT32					*pRate);
-
-
-#ifdef DOT11_N_SUPPORT
-VOID RTMPIoctlQueryBaTable(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	struct iwreq	*wrq);
-#endif // DOT11_N_SUPPORT //
-
-VOID RTMPIoctlStaticWepCopy(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	struct iwreq	*wrq);
-
-VOID RTMPIoctlRadiusData(
-	IN PRTMP_ADAPTER	pAd,
-	IN struct iwreq		*wrq);
-
-VOID RTMPIoctlAddWPAKey(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	struct iwreq	*wrq);
-
-VOID RTMPIoctlAddPMKIDCache(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	struct iwreq	*wrq);
-
-#endif // __AP_CFG_H__ //
diff --git a/drivers/staging/rt3090/ap_ids.h b/drivers/staging/rt3090/ap_ids.h
deleted file mode 100644
index cf8797f7f580..000000000000
--- a/drivers/staging/rt3090/ap_ids.h
+++ /dev/null
@@ -1,82 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-    Module Name:
-    ap_ids.h
-
-    Abstract:
-    Miniport generic portion header file
-
-    Revision History:
-    Who         When          What
-    --------    ----------    ----------------------------------------------
-*/
-
-VOID RTMPIdsPeriodicExec(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3);
-
-BOOLEAN RTMPSpoofedMgmtDetection(
-	IN PRTMP_ADAPTER	pAd,
-	IN PHEADER_802_11	pHeader,
-	IN CHAR				Rssi0,
-	IN CHAR				Rssi1,
-	IN CHAR				Rssi2);
-
-VOID RTMPConflictSsidDetection(
-	IN PRTMP_ADAPTER	pAd,
-	IN PUCHAR			pSsid,
-	IN UCHAR			SsidLen,
-	IN CHAR				Rssi0,
-	IN CHAR				Rssi1,
-	IN CHAR				Rssi2);
-
-BOOLEAN RTMPReplayAttackDetection(
-	IN PRTMP_ADAPTER	pAd,
-	IN PUCHAR			pAddr2,
-	IN CHAR				Rssi0,
-	IN CHAR				Rssi1,
-	IN CHAR				Rssi2);
-
-VOID RTMPUpdateStaMgmtCounter(
-	IN PRTMP_ADAPTER	pAd,
-	IN USHORT			type);
-
-VOID RTMPClearAllIdsCounter(
-	IN PRTMP_ADAPTER	pAd);
-
-VOID RTMPIdsStart(
-	IN PRTMP_ADAPTER	pAd);
-
-VOID RTMPIdsStop(
-	IN PRTMP_ADAPTER	pAd);
-
-VOID rtmp_read_ids_from_file(
-			IN  PRTMP_ADAPTER pAd,
-			char *tmpbuf,
-			char *buffer);
diff --git a/drivers/staging/rt3090/ap_mbss.h b/drivers/staging/rt3090/ap_mbss.h
deleted file mode 100644
index f78556c529a8..000000000000
--- a/drivers/staging/rt3090/ap_mbss.h
+++ /dev/null
@@ -1,72 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-    Module Name:
-    ap_mbss.h
-
-    Abstract:
-    Miniport generic portion header file
-
-    Revision History:
-    Who         When          What
-    --------    ----------    ----------------------------------------------
-*/
-
-#ifndef MODULE_MBSS
-
-#define MBSS_EXTERN    extern
-
-#else
-
-#define MBSS_EXTERN
-
-#endif // MODULE_MBSS //
-
-
-/* Public function list */
-MBSS_EXTERN VOID RT28xx_MBSS_Init(
-	IN PRTMP_ADAPTER ad_p,
-	IN PNET_DEV main_dev_p);
-
-MBSS_EXTERN VOID RT28xx_MBSS_Close(
-	IN PRTMP_ADAPTER ad_p);
-
-MBSS_EXTERN VOID RT28xx_MBSS_Remove(
-	IN PRTMP_ADAPTER ad_p);
-
-INT MBSS_VirtualIF_Open(
-	IN	PNET_DEV			dev_p);
-INT MBSS_VirtualIF_Close(
-	IN	PNET_DEV			dev_p);
-INT MBSS_VirtualIF_PacketSend(
-	IN PNDIS_PACKET			skb_p,
-	IN PNET_DEV				dev_p);
-INT MBSS_VirtualIF_Ioctl(
-	IN PNET_DEV				dev_p,
-	IN OUT struct ifreq	*rq_p,
-	IN INT cmd);
-
-/* End of ap_mbss.h */
diff --git a/drivers/staging/rt3090/ap_uapsd.h b/drivers/staging/rt3090/ap_uapsd.h
deleted file mode 100644
index d49a9e7500b4..000000000000
--- a/drivers/staging/rt3090/ap_uapsd.h
+++ /dev/null
@@ -1,636 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-    Module Name:
-    ap_uapsd.h
-
-    Abstract:
-    Miniport generic portion header file
-
-    Revision History:
-    Who         When          What
-    --------    ----------    ----------------------------------------------
-*/
-
-/* only for UAPSD_TIMING_RECORD */
-
-//#define UAPSD_TIMING_RECORD_FUNC
-
-#define UAPSD_TIMING_RECORD_MAX				1000
-#define UAPSD_TIMING_RECORD_DISPLAY_TIMES	10
-
-#define UAPSD_TIMING_RECORD_ISR				1
-#define UAPSD_TIMING_RECORD_TASKLET			2
-#define UAPSD_TIMING_RECORD_TRG_RCV			3
-#define UAPSD_TIMING_RECORD_MOVE2TX			4
-#define UAPSD_TIMING_RECORD_TX2AIR			5
-
-#define UAPSD_TIMING_CTRL_STOP				0
-#define UAPSD_TIMING_CTRL_START				1
-#define UAPSD_TIMING_CTRL_SUSPEND			2
-
-#define UAPSD_TIMESTAMP_GET(__pAd, __TimeStamp)			\
-	{													\
-		UINT32 __CSR=0;	UINT64 __Value64;				\
-		RTMP_IO_READ32((__pAd), TSF_TIMER_DW0, &__CSR);	\
-		__TimeStamp = (UINT64)__CSR;					\
-		RTMP_IO_READ32((__pAd), TSF_TIMER_DW1, &__CSR);	\
-		__Value64 = (UINT64)__CSR;						\
-		__TimeStamp |= (__Value64 << 32);				\
-	}
-
-#ifdef LINUX
-#define UAPSD_TIME_GET(__pAd, __Time)					\
-		__Time = jiffies
-#endif // LINUX //
-
-
-#ifdef UAPSD_TIMING_RECORD_FUNC
-#define UAPSD_TIMING_RECORD_START()				\
-	UAPSD_TimingRecordCtrl(UAPSD_TIMING_CTRL_START);
-#define UAPSD_TIMING_RECORD_STOP()				\
-	UAPSD_TimingRecordCtrl(UAPSD_TIMING_CTRL_STOP);
-#define UAPSD_TIMING_RECORD(__pAd, __Type)		\
-	UAPSD_TimingRecord(__pAd, __Type);
-#define UAPSD_TIMING_RECORD_INDEX(__LoopIndex)	\
-	UAPSD_TimeingRecordLoopIndex(__LoopIndex);
-#else
-
-#define UAPSD_TIMING_RECORD_START()
-#define UAPSD_TIMING_RECORD_STOP()
-#define UAPSD_TIMING_RECORD(__pAd, __type)
-#define UAPSD_TIMING_RECORD_INDEX(__LoopIndex)
-#endif // UAPSD_TIMING_RECORD_FUNC //
-
-
-#ifndef MODULE_WMM_UAPSD
-
-#define UAPSD_EXTERN			extern
-
-/* Public Marco list */
-
-/*
-	Init some parameters in packet structure for QoS Null frame;
-	purpose: is for management frame tx done use
-*/
-#define UAPSD_MR_QOS_NULL_HANDLE(__pAd, __pData, __pPacket)					\
-	{																		\
-		PHEADER_802_11 __pHeader = (PHEADER_802_11)(__pData);				\
-		MAC_TABLE_ENTRY *__pEntry;											\
-		if (__pHeader->FC.SubType == SUBTYPE_QOS_NULL)						\
-		{																	\
-			RTMP_SET_PACKET_QOS_NULL((__pPacket));							\
-			__pEntry = MacTableLookup((__pAd), __pHeader->Addr1);			\
-			if (__pEntry != NULL)											\
-			{																\
-				RTMP_SET_PACKET_WCID((__pPacket), __pEntry->Aid);			\
-			}																\
-		}																	\
-		else																\
-		{																	\
-			RTMP_SET_PACKET_NON_QOS_NULL((__pPacket));						\
-		}																	\
-	}
-
-/*
-	Init MAC entry UAPSD parameters;
-	purpose: initialize UAPSD PS queue and control parameters
-*/
-#define UAPSD_MR_ENTRY_INIT(__pEntry)										\
-	{																		\
-		UINT16	__IdAc;														\
-		for(__IdAc=0; __IdAc<WMM_NUM_OF_AC; __IdAc++)						\
-			InitializeQueueHeader(&(__pEntry)->UAPSDQueue[__IdAc]);			\
-		(__pEntry)->UAPSDTxNum = 0;											\
-		(__pEntry)->pUAPSDEOSPFrame = NULL;									\
-		(__pEntry)->bAPSDFlagSPStart = 0;									\
-		(__pEntry)->bAPSDFlagEOSPOK = 0;									\
-		(__pEntry)->MaxSPLength = 0;										\
-	}
-
-/*
-	Reset MAC entry UAPSD parameters;
-   purpose: clean all UAPSD PS queue; release the EOSP frame if exists;
-			reset control parameters
-*/
-#define UAPSD_MR_ENTRY_RESET(__pAd, __pEntry)								\
-	{																		\
-		MAC_TABLE_ENTRY *__pSta;											\
-		UINT32 __IdAc;														\
-		__pSta = (__pEntry);												\
-		/* clear all U-APSD queues */										\
-		for(__IdAc=0; __IdAc<WMM_NUM_OF_AC; __IdAc++)						\
-			APCleanupPsQueue((__pAd), &__pSta->UAPSDQueue[__IdAc]);		\
-		/* clear EOSP frame */												\
-		__pSta->UAPSDTxNum = 0;												\
-		if (__pSta->pUAPSDEOSPFrame != NULL) {								\
-			RELEASE_NDIS_PACKET((__pAd),									\
-							QUEUE_ENTRY_TO_PACKET(__pSta->pUAPSDEOSPFrame),	\
-							NDIS_STATUS_FAILURE);							\
-			__pSta->pUAPSDEOSPFrame = NULL; }								\
-		__pSta->bAPSDFlagSPStart = 0;										\
-		__pSta->bAPSDFlagEOSPOK = 0; }
-
-/*
-	Enable or disable UAPSD flag in WMM element in beacon frame;
-	purpose: set UAPSD enable/disable bit
-*/
-#define UAPSD_MR_IE_FILL(__QosCtrlField, __pAd)								\
-		(__QosCtrlField) |= ((__pAd)->CommonCfg.bAPSDCapable) ? 0x80 : 0x00;
-
-/*
-	Check if we do NOT need to control TIM bit for the station;
-	note: we control TIM bit only when all AC are UAPSD AC
-*/
-#define UAPSD_MR_IS_NOT_TIM_BIT_NEEDED_HANDLED(__pMacEntry, __QueIdx)		\
-		(CLIENT_STATUS_TEST_FLAG((__pMacEntry), fCLIENT_STATUS_APSD_CAPABLE) && \
-			(!(__pMacEntry)->bAPSDDeliverEnabledPerAC[QID_AC_VO] ||			\
-			!(__pMacEntry)->bAPSDDeliverEnabledPerAC[QID_AC_VI] ||			\
-			!(__pMacEntry)->bAPSDDeliverEnabledPerAC[QID_AC_BE] ||			\
-			!(__pMacEntry)->bAPSDDeliverEnabledPerAC[QID_AC_BK]) &&			\
-		(__pMacEntry)->bAPSDDeliverEnabledPerAC[__QueIdx])
-
-/* check if the AC is UAPSD delivery-enabled AC */
-#define UAPSD_MR_IS_UAPSD_AC(__pMacEntry, __AcId)							\
-		(CLIENT_STATUS_TEST_FLAG((__pMacEntry), fCLIENT_STATUS_APSD_CAPABLE) &&	\
-			((0 <= (__AcId)) && ((__AcId) < WMM_NUM_OF_AC)) && /* 0 ~ 3 */	\
-			(__pMacEntry)->bAPSDDeliverEnabledPerAC[(__AcId)])
-
-/* check if all AC are UAPSD delivery-enabled AC */
-#define UAPSD_MR_IS_ALL_AC_UAPSD(__FlgIsActive, __pMacEntry)				\
-		(((__FlgIsActive) == FALSE) && ((__pMacEntry)->bAPSDAllAC == 1))
-
-/* suspend SP */
-#define UAPSD_MR_SP_SUSPEND(__pAd)											\
-		(__pAd)->bAPSDFlagSPSuspend = 1;
-
-/* resume SP */
-#define UAPSD_MR_SP_RESUME(__pAd)											\
-		(__pAd)->bAPSDFlagSPSuspend = 0;
-
-/* mark PS poll frame sent in mix mode */
-#ifdef RTMP_MAC_PCI
-/*
-	Note:
-	(1) When SP is not started, try to mark a flag to record if the legacy ps
-		packet is handled in statistics handler;
-	(2) When SP is started, increase the UAPSD count number for the legacy PS.
-*/
-#define UAPSD_MR_MIX_PS_POLL_RCV(__pAd, __pMacEntry)						\
-		if ((__pMacEntry)->bAPSDFlagSpRoughUse == 0)						\
-		{																	\
-			if ((__pMacEntry)->bAPSDFlagSPStart == 0)						\
-			{																\
-				if ((__pMacEntry)->bAPSDFlagLegacySent == 1)				\
-					NICUpdateFifoStaCounters((__pAd));						\
-				(__pMacEntry)->bAPSDFlagLegacySent = 1;						\
-			}																\
-			else															\
-			{																\
-				(__pMacEntry)->UAPSDTxNum ++;								\
-			}																\
-		}
-#endif // RTMP_MAC_PCI //
-
-
-#else
-
-#define UAPSD_EXTERN
-#define UAPSD_QOS_NULL_QUE_ID	0x7f
-
-#ifdef RTMP_MAC_PCI
-/*
-	In RT2870, FIFO counter is for all stations, not for per-entry,
-	so we can not use accurate method in RT2870
-*/
-
-/*
-	Note for SP ACCURATE Mechanism:
-	1. When traffic is busy for the PS station
-		Statistics FIFO counter maybe overflow before we read it, so UAPSD
-		counting mechanism will not accurately.
-
-		Solution:
-		We need to avoid the worse case so we suggest a maximum interval for
-		a SP that the interval between last frame from QAP and data frame from
-		QSTA is larger than UAPSD_EPT_SP_INT.
-
-	2. When traffic use CCK/1Mbps from QAP
-		Statistics FIFO will not count the packet. There are 2 cases:
-		(1) We force to downgrage ARP response & DHCP packet to 1Mbps;
-		(2) After rate switch mechanism, tx rate is fixed to 1Mbps.
-
-		Solution:
-		Use old DMA UAPSD mechanism.
-
-	3. When part of AC uses legacy PS mode
-		Statistics count will inclue packet statistics for legacy PS packets
-		so we can not know which one is UAPSD, which one is legacy.
-
-		Solution:
-		Cound the legacy PS packet.
-
-	4. Check FIFO statistics count in Rx Done function
-		We can not to check TX FIFO statistics count in Rx Done function or
-		the real packet tx/rx sequence will be disarranged.
-
-		Solution:
-		Suspend SP handle before rx done and resume SP handle after rx done.
-*/
-#define UAPSD_SP_ACCURATE		/* use more accurate method to send EOSP */
-#endif // RTMP_MAC_PCI //
-
-#define UAPSD_EPT_SP_INT		(100000/(1000000/OS_HZ)) /* 100ms */
-
-#endif // MODULE_WMM_UAPSD //
-
-
-/* max UAPSD buffer queue size */
-#define MAX_PACKETS_IN_UAPSD_QUEUE	16	/* for each AC = 16*4 = 64 */
-
-
-/* Public function list */
-/*
-========================================================================
-Routine Description:
-	UAPSD Module Init.
-
-Arguments:
-	pAd		Pointer to our adapter
-
-Return Value:
-	None
-
-Note:
-========================================================================
-*/
-UAPSD_EXTERN VOID UAPSD_Init(
-	IN	PRTMP_ADAPTER		pAd);
-
-
-/*
-========================================================================
-Routine Description:
-	UAPSD Module Release.
-
-Arguments:
-	pAd		Pointer to our adapter
-
-Return Value:
-	None
-
-Note:
-========================================================================
-*/
-UAPSD_EXTERN VOID UAPSD_Release(
-	IN	PRTMP_ADAPTER		pAd);
-
-
-/*
-========================================================================
-Routine Description:
-	Free all EOSP frames and close all SP.
-
-Arguments:
-	pAd		Pointer to our adapter
-
-Return Value:
-	None
-
-Note:
-========================================================================
-*/
-UAPSD_EXTERN VOID UAPSD_FreeAll(
-	IN	PRTMP_ADAPTER		pAd);
-
-
-/*
-========================================================================
-Routine Description:
-	Close current Service Period.
-
-Arguments:
-	pAd				Pointer to our adapter
-	pEntry			Close the SP of the entry
-
-Return Value:
-	None
-
-Note:
-========================================================================
-*/
-UAPSD_EXTERN VOID UAPSD_SP_Close(
-    IN  PRTMP_ADAPTER       pAd,
-	IN	MAC_TABLE_ENTRY		*pEntry);
-
-
-/*
-========================================================================
-Routine Description:
-	Deliver all queued packets.
-
-Arguments:
-	pAd            Pointer to our adapter
-	*pEntry        STATION
-
-Return Value:
-	None
-
-Note:
-	SMP protection by caller for packet enqueue.
-========================================================================
-*/
-UAPSD_EXTERN VOID UAPSD_AllPacketDeliver(
-	IN	PRTMP_ADAPTER		pAd,
-	IN	MAC_TABLE_ENTRY		*pEntry);
-
-
-/*
-========================================================================
-Routine Description:
-	Parse the UAPSD field in WMM element in (re)association request frame.
-
-Arguments:
-	pAd				Pointer to our adapter
-	*pEntry			STATION
-	*pElm			QoS information field
-
-Return Value:
-	None
-
-Note:
-	No protection is needed.
-
-	1. Association -> TSPEC:
-		use static UAPSD settings in Association
-		update UAPSD settings in TSPEC
-
-	2. Association -> TSPEC(11r) -> Reassociation:
-		update UAPSD settings in TSPEC
-		backup static UAPSD settings in Reassociation
-
-	3. Association -> Reassociation:
-		update UAPSD settings in TSPEC
-		backup static UAPSD settings in Reassociation
-========================================================================
-*/
-UAPSD_EXTERN VOID UAPSD_AssocParse(
-	IN	PRTMP_ADAPTER		pAd,
-	IN	MAC_TABLE_ENTRY		*pEntry,
-	IN	UCHAR				*pElm);
-
-
-/*
-========================================================================
-Routine Description:
-	Enqueue a UAPSD packet.
-
-Arguments:
-	pAd				Pointer to our adapter
-	*pEntry			STATION
-	pPacket			UAPSD dnlink packet
-	IdAc			UAPSD AC ID (0 ~ 3)
-
-Return Value:
-	None
-
-Note:
-========================================================================
-*/
-UAPSD_EXTERN VOID UAPSD_PacketEnqueue(
-	IN	PRTMP_ADAPTER		pAd,
-	IN	MAC_TABLE_ENTRY		*pEntry,
-	IN	PNDIS_PACKET		pPacket,
-	IN	UINT32				IdAc);
-
-
-/*
-========================================================================
-Routine Description:
-	Handle QoS Null Frame Tx Done or Management Tx Done interrupt.
-
-Arguments:
-	pAd				Pointer to our adapter
-	pPacket			Completed TX packet
-	pDstMac			Destinated MAC address
-
-Return Value:
-	None
-
-Note:
-========================================================================
-*/
-UAPSD_EXTERN VOID UAPSD_QoSNullTxMgmtTxDoneHandle(
-	IN	PRTMP_ADAPTER		pAd,
-	IN	PNDIS_PACKET		pPacket,
-	IN	UCHAR				*pDstMac);
-
-
-/*
-========================================================================
-Routine Description:
-	Maintenance our UAPSD PS queue.  Release all queued packet if timeout.
-
-Arguments:
-	pAd				Pointer to our adapter
-	*pEntry			STATION
-
-Return Value:
-	None
-
-Note:
-	If in RT2870, pEntry can not be removed during UAPSD_QueueMaintenance()
-========================================================================
-*/
-UAPSD_EXTERN VOID UAPSD_QueueMaintenance(
-	IN	PRTMP_ADAPTER		pAd,
-	IN	MAC_TABLE_ENTRY		*pEntry);
-
-
-/*
-========================================================================
-Routine Description:
-	Close SP in Tx Done, not Tx DMA Done.
-
-Arguments:
-	pAd            Pointer to our adapter
-	pEntry			destination entry
-	FlgSuccess		0:tx success, 1:tx fail
-
-Return Value:
-    None
-
-Note:
-	For RT28xx series, for packetID=0 or multicast frame, no statistics
-	count can be got, ex: ARP response or DHCP packets, we will use
-	low rate to set (CCK, MCS=0=packetID).
-	So SP will not be close until UAPSD_EPT_SP_INT timeout.
-
-	So if the tx rate is 1Mbps for a entry, we will use DMA done, not
-	use UAPSD_SP_AUE_Handle().
-========================================================================
-*/
-UAPSD_EXTERN VOID UAPSD_SP_AUE_Handle(
-	IN RTMP_ADAPTER		*pAd,
-    IN MAC_TABLE_ENTRY	*pEntry,
-	IN UCHAR			FlgSuccess);
-
-
-/*
-========================================================================
-Routine Description:
-	Close current Service Period.
-
-Arguments:
-	pAd				Pointer to our adapter
-
-Return Value:
-	None
-
-Note:
-	When we receive EOSP frame tx done interrupt and a uplink packet
-	from the station simultaneously, we will regard it as a new trigger
-	frame because the packet is received when EOSP frame tx done interrupt.
-
-	We can not sure the uplink packet is sent after old SP or in the old SP.
-	So we must close the old SP in receive done ISR to avoid the problem.
-========================================================================
-*/
-UAPSD_EXTERN VOID UAPSD_SP_CloseInRVDone(
-	IN	PRTMP_ADAPTER		pAd);
-
-
-/*
-========================================================================
-Routine Description:
-	Check if we need to close current SP.
-
-Arguments:
-	pAd				Pointer to our adapter
-	pPacket			Completed TX packet
-	pDstMac			Destinated MAC address
-
-Return Value:
-	None
-
-Note:
-	1. We need to call the function in TxDone ISR.
-	2. SMP protection by caller for packet enqueue.
-========================================================================
-*/
-UAPSD_EXTERN VOID UAPSD_SP_PacketCheck(
-	IN	PRTMP_ADAPTER		pAd,
-	IN	PNDIS_PACKET		pPacket,
-	IN	UCHAR				*pDstMac);
-
-
-#ifdef UAPSD_TIMING_RECORD_FUNC
-/*
-========================================================================
-Routine Description:
-	Enable/Disable Timing Record Function.
-
-Arguments:
-	pAd				Pointer to our adapter
-	Flag			1 (Enable) or 0 (Disable)
-
-Return Value:
-	None
-
-Note:
-========================================================================
-*/
-UAPSD_EXTERN VOID UAPSD_TimingRecordCtrl(
-	IN	UINT32				Flag);
-
-/*
-========================================================================
-Routine Description:
-	Record some timings.
-
-Arguments:
-	pAd				Pointer to our adapter
-	Type			The timing is for what type
-
-Return Value:
-	None
-
-Note:
-	UAPSD_TIMING_RECORD_ISR
-	UAPSD_TIMING_RECORD_TASKLET
-	UAPSD_TIMING_RECORD_TRG_RCV
-	UAPSD_TIMING_RECORD_MOVE2TX
-	UAPSD_TIMING_RECORD_TX2AIR
-========================================================================
-*/
-UAPSD_EXTERN VOID UAPSD_TimingRecord(
-	IN	PRTMP_ADAPTER		pAd,
-	IN	UINT32				Type);
-
-/*
-========================================================================
-Routine Description:
-	Record the loop index for received packet handle.
-
-Arguments:
-	pAd				Pointer to our adapter
-	LoopIndex		The RxProcessed in APRxDoneInterruptHandle()
-
-Return Value:
-	None
-
-Note:
-========================================================================
-*/
-UAPSD_EXTERN VOID UAPSD_TimeingRecordLoopIndex(
-	IN	UINT32				LoopIndex);
-#endif // UAPSD_TIMING_RECORD_FUNC //
-
-
-/*
-========================================================================
-Routine Description:
-	Handle UAPSD Trigger Frame.
-
-Arguments:
-	pAd				Pointer to our adapter
-	*pEntry			the source STATION
-	UpOfFrame		the UP of the trigger frame
-
-Return Value:
-	None
-
-Note:
-========================================================================
-*/
-UAPSD_EXTERN VOID UAPSD_TriggerFrameHandle(
-	IN	PRTMP_ADAPTER		pAd,
-	IN	MAC_TABLE_ENTRY		*pEntry,
-	IN	UCHAR				UpOfFrame);
-
-
-
-/* End of ap_uapsd.h */
diff --git a/drivers/staging/rt3090/ap_wds.h b/drivers/staging/rt3090/ap_wds.h
deleted file mode 100644
index efcb107db4ff..000000000000
--- a/drivers/staging/rt3090/ap_wds.h
+++ /dev/null
@@ -1,212 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-    Module Name:
-    ap_cfg.h
-
-    Abstract:
-    Miniport generic portion header file
-
-    Revision History:
-    Who         When          What
-    --------    ----------    ----------------------------------------------
-    Fonchi    02-13-2007      created
-*/
-
-#ifndef _AP_WDS_H_
-#define _AP_WDS_H_
-
-#define WDS_ENTRY_RETRY_INTERVAL	(100 * OS_HZ / 1000)
-
-
-static inline BOOLEAN WDS_IF_UP_CHECK(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  ULONG ifidx)
-{
-	if ((pAd->flg_wds_init != TRUE) ||
-		(ifidx >= MAX_WDS_ENTRY))
-		return FALSE;
-
-//	if (pAd->WdsTab.WdsEntry[ifidx].dev->flags & IFF_UP)
-// Patch for wds ,when dirver call apmlmeperiod => APMlmeDynamicTxRateSwitching check if wds device ready
-if ((pAd->WdsTab.WdsEntry[ifidx].dev != NULL) && (pAd->WdsTab.WdsEntry[ifidx].dev->flags & IFF_UP))
-		return TRUE;
-
-	return FALSE;
-}
-
-LONG WdsEntryAlloc(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR pAddr);
-
-VOID WdsEntryDel(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR pAddr);
-
-MAC_TABLE_ENTRY *MacTableInsertWDSEntry(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PUCHAR pAddr,
-	UINT WdsTabIdx);
-
-BOOLEAN MacTableDeleteWDSEntry(
-	IN PRTMP_ADAPTER pAd,
-	IN USHORT wcid,
-	IN PUCHAR pAddr);
-
-
-BOOLEAN ApWdsAllowToSendPacket(
-	IN RTMP_ADAPTER *pAd,
-	IN PNDIS_PACKET pPacket,
-	OUT	UCHAR		*pWcid);
-
-MAC_TABLE_ENTRY *WdsTableLookupByWcid(
-    IN  PRTMP_ADAPTER   pAd,
-	IN UCHAR wcid,
-	IN PUCHAR pAddr,
-	IN BOOLEAN bResetIdelCount);
-
-MAC_TABLE_ENTRY *WdsTableLookup(
-    IN  PRTMP_ADAPTER   pAd,
-    IN  PUCHAR          pAddr,
-	IN BOOLEAN bResetIdelCount);
-
-MAC_TABLE_ENTRY *FindWdsEntry(
-	IN PRTMP_ADAPTER	pAd,
-	IN UCHAR			Wcid,
-	IN PUCHAR			pAddr,
-	IN UINT32			PhyMode);
-
-VOID WdsTableMaintenance(
-    IN PRTMP_ADAPTER    pAd);
-
-VOID RT28xx_WDS_Init(
-	IN PRTMP_ADAPTER pAd,
-	IN PNET_DEV net_dev);
-
-VOID RT28xx_WDS_Close(
-	IN PRTMP_ADAPTER pAd);
-
-VOID RT28xx_WDS_Remove(
-	IN PRTMP_ADAPTER pAd);
-
-VOID WdsDown(
-	IN PRTMP_ADAPTER pAd);
-
-VOID AsicUpdateWdsRxWCIDTable(
-	IN PRTMP_ADAPTER pAd);
-
-VOID AsicUpdateWdsEncryption(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR wcid);
-
-VOID WdsPeerBeaconProc(
-	IN PRTMP_ADAPTER pAd,
-	IN PMAC_TABLE_ENTRY pEntry,
-	IN USHORT CapabilityInfo,
-	IN UCHAR MaxSupportedRateIn500Kbps,
-	IN UCHAR MaxSupportedRateLen,
-	IN BOOLEAN bWmmCapable,
-	IN ULONG ClientRalinkIe,
-	IN HT_CAPABILITY_IE *pHtCapability,
-	IN UCHAR HtCapabilityLen);
-
-VOID APWdsInitialize(
-	IN PRTMP_ADAPTER pAd);
-
-INT	Show_WdsTable_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-VOID rtmp_read_wds_from_file(
-			IN  PRTMP_ADAPTER pAd,
-			PSTRING tmpbuf,
-			PSTRING buffer);
-
-VOID WdsPrepareWepKeyFromMainBss(
-	IN  PRTMP_ADAPTER pAd);
-
-INT WdsVirtualIFSendPackets(
-	IN PNDIS_PACKET pSkb,
-	IN PNET_DEV dev);
-
-INT WdsVirtualIF_open(
-	IN PNET_DEV dev);
-
-INT WdsVirtualIF_close(
-	IN PNET_DEV dev);
-
-INT WdsVirtualIF_ioctl(
-	IN PNET_DEV net_dev,
-	IN OUT struct ifreq *rq,
-	IN INT cmd);
-
-/*
-	==========================================================================
-	Description:
-		Check the WDS Entry is valid or not.
-	==========================================================================
- */
-static inline BOOLEAN ValidWdsEntry(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR WdsIndex)
-{
-	BOOLEAN result;
-	PMAC_TABLE_ENTRY pMacEntry;
-
-	do
-	{
-		if (WdsIndex >= MAX_WDS_ENTRY)
-		{
-			result = FALSE;
-			break;
-		}
-
-		if (pAd->WdsTab.WdsEntry[WdsIndex].Valid != TRUE)
-		{
-			result = FALSE;
-			break;
-		}
-
-		if ((pAd->WdsTab.WdsEntry[WdsIndex].MacTabMatchWCID==0)
-			|| (pAd->WdsTab.WdsEntry[WdsIndex].MacTabMatchWCID >= MAX_LEN_OF_MAC_TABLE))
-		{
-			result = FALSE;
-			break;
-		}
-
-		pMacEntry = &pAd->MacTab.Content[pAd->WdsTab.WdsEntry[WdsIndex].MacTabMatchWCID];
-		if (pMacEntry->ValidAsWDS != TRUE)
-		{
-			result = FALSE;
-			break;
-		}
-
-		result = TRUE;
-	} while(FALSE);
-
-	return result;
-}
-#endif // _AP_WDS_H_ //
diff --git a/drivers/staging/rt3090/chips/rt3370.c b/drivers/staging/rt3090/chips/rt3370.c
deleted file mode 100644
index 38ecb0623424..000000000000
--- a/drivers/staging/rt3090/chips/rt3370.c
+++ /dev/null
@@ -1,121 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-	Module Name:
-	rt3370.c
-
-	Abstract:
-	Specific funcitons and variables for RT30xx.
-
-	Revision History:
-	Who         When          What
-	--------    ----------    ----------------------------------------------
-*/
-
-#ifdef RT3370
-
-#include "../rt_config.h"
-
-
-#ifndef RTMP_RF_RW_SUPPORT
-#error "You Should Enable compile flag RTMP_RF_RW_SUPPORT for this chip"
-#endif // RTMP_RF_RW_SUPPORT //
-
-
-VOID NICInitRT3370RFRegisters(IN PRTMP_ADAPTER pAd)
-{
-		INT i;
-	// Driver must read EEPROM to get RfIcType before initial RF registers
-	// Initialize RF register to default value
-	if (IS_RT3090(pAd)||IS_RT3390(pAd)||IS_RT3572(pAd))
-	{
-		// Init RF calibration
-		// Driver should toggle RF R30 bit7 before init RF registers
-		UINT32 RfReg = 0, data;
-
-		RT30xxReadRFRegister(pAd, RF_R30, (PUCHAR)&RfReg);
-		RfReg |= 0x80;
-		RT30xxWriteRFRegister(pAd, RF_R30, (UCHAR)RfReg);
-		RTMPusecDelay(1000);
-		RfReg &= 0x7F;
-		RT30xxWriteRFRegister(pAd, RF_R30, (UCHAR)RfReg);
-
-		// init R24, R31
-		RT30xxWriteRFRegister(pAd, RF_R24, 0x0F);
-		RT30xxWriteRFRegister(pAd, RF_R31, 0x0F);
-
-		if (IS_RT3390(pAd))
-		{
-			// patch LNA_PE_G1 failed issue
-			RTMP_IO_READ32(pAd, GPIO_SWITCH, &data);
-			data &= ~(0x20);
-			RTMP_IO_WRITE32(pAd, GPIO_SWITCH, data);
-
-			// RF registers initialization
-			for (i = 0; i < NUM_RF_REG_PARMS_OVER_RT3390; i++)
-			{
-				RT30xxWriteRFRegister(pAd, RFRegTableOverRT3390[i].Register, RFRegTableOverRT3390[i].Value);
-			}
-		}
-
-		// patch LNA_PE_G1 failed issue
-		RTMP_IO_READ32(pAd, GPIO_SWITCH, &data);
-		data &= ~(0x20);
-		RTMP_IO_WRITE32(pAd, GPIO_SWITCH, data);
-
-		// Initialize RF register to default value
-		for (i = 0; i < NUM_RF_REG_PARMS_OVER_RT3390; i++)
-		{
-			RT30xxWriteRFRegister(pAd, RT30xx_RFRegTable[i].Register, RT30xx_RFRegTable[i].Value);
-		}
-
-		// Driver should set RF R6 bit6 on before calibration
-		RT30xxReadRFRegister(pAd, RF_R06, (PUCHAR)&RfReg);
-		RfReg |= 0x40;
-		RT30xxWriteRFRegister(pAd, RF_R06, (UCHAR)RfReg);
-
-		//For RF filter Calibration
-		RTMPFilterCalibration(pAd);
-
-		// Initialize RF R27 register, set RF R27 must be behind RTMPFilterCalibration()
-		if ((pAd->MACVersion & 0xffff) < 0x0211)
-			RT30xxWriteRFRegister(pAd, RF_R27, 0x3);
-
-		// set led open drain enable
-		RTMP_IO_READ32(pAd, OPT_14, &data);
-		data |= 0x01;
-		RTMP_IO_WRITE32(pAd, OPT_14, data);
-
-		// set default antenna as main
-		if (pAd->RfIcType == RFIC_3020)
-			AsicSetRxAnt(pAd, pAd->RxAnt.Pair1PrimaryRxAnt);
-
-		// add by johnli, RF power sequence setup, load RF normal operation-mode setup
-		RT30xxLoadRFNormalModeSetup(pAd);
-	}
-
-}
-#endif // RT3070 //
diff --git a/drivers/staging/rt3090/chips/rt3390.c b/drivers/staging/rt3090/chips/rt3390.c
deleted file mode 100644
index afed9e705e8d..000000000000
--- a/drivers/staging/rt3090/chips/rt3390.c
+++ /dev/null
@@ -1,122 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-	Module Name:
-	rt3390.c
-
-	Abstract:
-	Specific funcitons and variables for RT30xx.
-
-	Revision History:
-	Who         When          What
-	--------    ----------    ----------------------------------------------
-*/
-
-#ifdef RT3390
-
-#include "../rt_config.h"
-
-
-#ifndef RTMP_RF_RW_SUPPORT
-#error "You Should Enable compile flag RTMP_RF_RW_SUPPORT for this chip"
-#endif // RTMP_RF_RW_SUPPORT //
-
-
-VOID NICInitRT3390RFRegisters(IN PRTMP_ADAPTER pAd)
-{
-		INT i;
-	// Driver must read EEPROM to get RfIcType before initial RF registers
-	// Initialize RF register to default value
-	if (IS_RT3090(pAd)||IS_RT3390(pAd)||IS_RT3572(pAd))
-	{
-		// Init RF calibration
-		// Driver should toggle RF R30 bit7 before init RF registers
-		UINT32 RfReg = 0, data;
-
-		RT30xxReadRFRegister(pAd, RF_R30, (PUCHAR)&RfReg);
-		RfReg |= 0x80;
-		RT30xxWriteRFRegister(pAd, RF_R30, (UCHAR)RfReg);
-		RTMPusecDelay(1000);
-		RfReg &= 0x7F;
-		RT30xxWriteRFRegister(pAd, RF_R30, (UCHAR)RfReg);
-
-		// init R24, R31
-		RT30xxWriteRFRegister(pAd, RF_R24, 0x0F);
-		RT30xxWriteRFRegister(pAd, RF_R31, 0x0F);
-
-		if (IS_RT3390(pAd))
-		{
-			// patch LNA_PE_G1 failed issue
-			RTMP_IO_READ32(pAd, GPIO_SWITCH, &data);
-			data &= ~(0x20);
-			RTMP_IO_WRITE32(pAd, GPIO_SWITCH, data);
-
-			// RF registers initialization
-			for (i = 0; i < NUM_RF_REG_PARMS_OVER_RT3390; i++)
-			{
-				RT30xxWriteRFRegister(pAd, RFRegTableOverRT3390[i].Register, RFRegTableOverRT3390[i].Value);
-			}
-		}
-
-		// patch LNA_PE_G1 failed issue
-		RTMP_IO_READ32(pAd, GPIO_SWITCH, &data);
-		data &= ~(0x20);
-		RTMP_IO_WRITE32(pAd, GPIO_SWITCH, data);
-
-		// Initialize RF register to default value
-		for (i = 0; i < NUM_RF_REG_PARMS_OVER_RT3390; i++)
-		{
-			RT30xxWriteRFRegister(pAd, RFRegTableOverRT3390[i].Register, RFRegTableOverRT3390[i].Value);
-		}
-
-		// Driver should set RF R6 bit6 on before calibration
-		RT30xxReadRFRegister(pAd, RF_R06, (PUCHAR)&RfReg);
-		RfReg |= 0x40;
-		RT30xxWriteRFRegister(pAd, RF_R06, (UCHAR)RfReg);
-
-		//For RF filter Calibration
-		RTMPFilterCalibration(pAd);
-
-		// Initialize RF R27 register, set RF R27 must be behind RTMPFilterCalibration()
-		if ((pAd->MACVersion & 0xffff) < 0x0211)
-			RT30xxWriteRFRegister(pAd, RF_R27, 0x3);
-
-		// set led open drain enable
-		RTMP_IO_READ32(pAd, OPT_14, &data);
-		data |= 0x01;
-		RTMP_IO_WRITE32(pAd, OPT_14, data);
-
-		// set default antenna as main
-		if (pAd->RfIcType == RFIC_3020)
-			AsicSetRxAnt(pAd, pAd->RxAnt.Pair1PrimaryRxAnt);
-
-		// add by johnli, RF power sequence setup, load RF normal operation-mode setup
-		RT33xxLoadRFNormalModeSetup(pAd);
-	}
-
-}
-
-#endif // RT3390 //
diff --git a/drivers/staging/rt3090/chips/rt33xx.c b/drivers/staging/rt3090/chips/rt33xx.c
deleted file mode 100644
index 56f376c88bda..000000000000
--- a/drivers/staging/rt3090/chips/rt33xx.c
+++ /dev/null
@@ -1,536 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-	Module Name:
-	rt33xx.c
-
-	Abstract:
-	Specific funcitons and variables for RT30xx.
-
-	Revision History:
-	Who         When          What
-	--------    ----------    ----------------------------------------------
-*/
-
-
-#ifdef RT33xx
-
-
-#ifndef RTMP_RF_RW_SUPPORT
-#error "You Should Enable compile flag RTMP_RF_RW_SUPPORT for this chip"
-#endif // RTMP_RF_RW_SUPPORT //
-
-#include "../rt_config.h"
-
-
-//
-// RF register initialization set
-//
-REG_PAIR RFRegTableOverRT3390[] = {
-	{RF_R00,		0xA0},
-	{RF_R01,		0xE1},
-	{RF_R02,		0xF1},
-	{RF_R03,		0x62},
-	{RF_R04,		0x40},
-	{RF_R05,		0x8B},
-	{RF_R06,		0x42},
-	{RF_R07,		0x34},
-	{RF_R08,		0x00}, // Read only
-	{RF_R09,		0xC0},
-
-	{RF_R10,		0x61},
-	{RF_R11,		0x21},
-	{RF_R12,		0x3B},
-	{RF_R13,		0xE0},
-	{RF_R14,		0x90},
-	{RF_R15,		0x53},
-	{RF_R16,		0x0E},
-	{RF_R17,		0x94},
-	{RF_R18,		0x5C},
-	{RF_R19,		0x4A},
-
-	{RF_R20,		0xB2},
-	{RF_R21,		0xF6},
-	{RF_R22,		0x00},
-	{RF_R23,		0x14},
-	{RF_R24,		0x08},
-	{RF_R25,		0x3D},
-	{RF_R26,		0x85},
-	{RF_R27,		0x00},
-	{RF_R28,		0x41},
-	{RF_R29,		0x8F},
-	{RF_R30,		0x20},
-	{RF_R31,		0x0F},
-};
-
-UCHAR NUM_RF_REG_PARMS_OVER_RT3390=(sizeof(RFRegTableOverRT3390) / sizeof(REG_PAIR));
-
-
-
-// Antenna divesity use GPIO3 and EESK pin for control
-// Antenna and EEPROM access are both using EESK pin,
-// Therefor we should avoid accessing EESK at the same time
-// Then restore antenna after EEPROM access
-// The original name of this function is AsicSetRxAnt(), now change to
-//VOID AsicSetRxAnt(
-
-VOID RT33xxSetRxAnt(
-	IN PRTMP_ADAPTER	pAd,
-	IN UCHAR			Ant)
-{
-	UINT32	Value;
-	UINT32	x;
-
-	if ((pAd->EepromAccess) ||
-		(RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RESET_IN_PROGRESS))	||
-		(RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS))	||
-		(RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RADIO_OFF)) ||
-		(RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)))
-	{
-		return;
-	}
-
-	// the antenna selection is through firmware and MAC register(GPIO3)
-	if (Ant == 0)
-	{
-		// Main antenna
-		RTMP_IO_READ32(pAd, E2PROM_CSR, &x);
-		x |= (EESK);
-		RTMP_IO_WRITE32(pAd, E2PROM_CSR, x);
-
-		RTMP_IO_READ32(pAd, GPIO_CTRL_CFG, &Value);
-		Value &= ~(0x0808);
-		RTMP_IO_WRITE32(pAd, GPIO_CTRL_CFG, Value);
-		DBGPRINT_RAW(RT_DEBUG_TRACE, ("AsicSetRxAnt, switch to main antenna\n"));
-	}
-	else
-	{
-		// Aux antenna
-		RTMP_IO_READ32(pAd, E2PROM_CSR, &x);
-		x &= ~(EESK);
-		RTMP_IO_WRITE32(pAd, E2PROM_CSR, x);
-
-		RTMP_IO_READ32(pAd, GPIO_CTRL_CFG, &Value);
-		Value &= ~(0x0808);
-		Value |= 0x08;
-		RTMP_IO_WRITE32(pAd, GPIO_CTRL_CFG, Value);
-		DBGPRINT_RAW(RT_DEBUG_TRACE, ("AsicSetRxAnt, switch to aux antenna\n"));
-	}
-}
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		For RF filter calibration purpose
-
-	Arguments:
-		pAd                          Pointer to our adapter
-
-	Return Value:
-		None
-
-	IRQL = PASSIVE_LEVEL
-
-	========================================================================
-*/
-VOID RTMPFilterCalibration(
-	IN PRTMP_ADAPTER pAd)
-{
-	UCHAR	R55x = 0, value, FilterTarget = 0x1E, BBPValue=0;
-	UINT	loop = 0, count = 0, loopcnt = 0, ReTry = 0;
-	UCHAR	RF_R24_Value = 0;
-
-	// Give bbp filter initial value
-	pAd->Mlme.CaliBW20RfR24 = 0x1F;
-	pAd->Mlme.CaliBW40RfR24 = 0x2F; //Bit[5] must be 1 for BW 40
-
-	do
-	{
-		if (loop == 1)	//BandWidth = 40 MHz
-		{
-			// Write 0x27 to RF_R24 to program filter
-			RF_R24_Value = 0x27;
-			RT30xxWriteRFRegister(pAd, RF_R24, RF_R24_Value);
-			if (IS_RT3090(pAd) || IS_RT3572(pAd)|| IS_RT3390(pAd))
-				FilterTarget = 0x15;
-			else
-				FilterTarget = 0x19;
-
-			// when calibrate BW40, BBP mask must set to BW40.
-			RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R4, &BBPValue);
-			BBPValue&= (~0x18);
-			BBPValue|= (0x10);
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R4, BBPValue);
-
-			// set to BW40
-			RT30xxReadRFRegister(pAd, RF_R31, &value);
-			value |= 0x20;
-			RT30xxWriteRFRegister(pAd, RF_R31, value);
-		}
-		else			//BandWidth = 20 MHz
-		{
-			// Write 0x07 to RF_R24 to program filter
-			RF_R24_Value = 0x07;
-			RT30xxWriteRFRegister(pAd, RF_R24, RF_R24_Value);
-			if (IS_RT3090(pAd) || IS_RT3572(pAd)|| IS_RT3390(pAd))
-				FilterTarget = 0x13;
-			else
-				FilterTarget = 0x16;
-
-			// set to BW20
-			RT30xxReadRFRegister(pAd, RF_R31, &value);
-			value &= (~0x20);
-			RT30xxWriteRFRegister(pAd, RF_R31, value);
-		}
-
-		// Write 0x01 to RF_R22 to enable baseband loopback mode
-		RT30xxReadRFRegister(pAd, RF_R22, &value);
-		value |= 0x01;
-		RT30xxWriteRFRegister(pAd, RF_R22, value);
-
-		// Write 0x00 to BBP_R24 to set power & frequency of passband test tone
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R24, 0);
-
-		do
-		{
-			// Write 0x90 to BBP_R25 to transmit test tone
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R25, 0x90);
-
-			RTMPusecDelay(1000);
-			// Read BBP_R55[6:0] for received power, set R55x = BBP_R55[6:0]
-			RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R55, &value);
-			R55x = value & 0xFF;
-
-		} while ((ReTry++ < 100) && (R55x == 0));
-
-		// Write 0x06 to BBP_R24 to set power & frequency of stopband test tone
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R24, 0x06);
-
-		while(TRUE)
-		{
-			// Write 0x90 to BBP_R25 to transmit test tone
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R25, 0x90);
-
-			//We need to wait for calibration
-			RTMPusecDelay(1000);
-			RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R55, &value);
-			value &= 0xFF;
-			if ((R55x - value) < FilterTarget)
-			{
-				RF_R24_Value ++;
-			}
-			else if ((R55x - value) == FilterTarget)
-			{
-				RF_R24_Value ++;
-				count ++;
-			}
-			else
-			{
-				break;
-			}
-
-			// prevent infinite loop cause driver hang.
-			if (loopcnt++ > 100)
-			{
-				DBGPRINT(RT_DEBUG_ERROR, ("RTMPFilterCalibration - can't find a valid value, loopcnt=%d stop calibrating", loopcnt));
-				break;
-			}
-
-			// Write RF_R24 to program filter
-			RT30xxWriteRFRegister(pAd, RF_R24, RF_R24_Value);
-		}
-
-		if (count > 0)
-		{
-			RF_R24_Value = RF_R24_Value - ((count) ? (1) : (0));
-		}
-
-		// Store for future usage
-		if (loopcnt < 100)
-		{
-			if (loop++ == 0)
-			{
-				//BandWidth = 20 MHz
-				pAd->Mlme.CaliBW20RfR24 = (UCHAR)RF_R24_Value;
-			}
-			else
-			{
-				//BandWidth = 40 MHz
-				pAd->Mlme.CaliBW40RfR24 = (UCHAR)RF_R24_Value;
-				break;
-			}
-		}
-		else
-			break;
-
-		RT30xxWriteRFRegister(pAd, RF_R24, RF_R24_Value);
-
-		// reset count
-		count = 0;
-	} while(TRUE);
-
-	//
-	// Set back to initial state
-	//
-	RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R24, 0);
-
-	RT30xxReadRFRegister(pAd, RF_R22, &value);
-	value &= ~(0x01);
-	RT30xxWriteRFRegister(pAd, RF_R22, value);
-
-	// set BBP back to BW20
-	RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R4, &BBPValue);
-	BBPValue&= (~0x18);
-	RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R4, BBPValue);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("RTMPFilterCalibration - CaliBW20RfR24=0x%x, CaliBW40RfR24=0x%x\n", pAd->Mlme.CaliBW20RfR24, pAd->Mlme.CaliBW40RfR24));
-}
-
-
-// add by johnli, RF power sequence setup
-/*
-	==========================================================================
-	Description:
-
-	Load RF normal operation-mode setup
-
-	==========================================================================
- */
-VOID RT33xxLoadRFNormalModeSetup(
-	IN PRTMP_ADAPTER	pAd)
-{
-	UCHAR RFValue;
-
-	// RX0_PD & TX0_PD, RF R1 register Bit 2 & Bit 3 to 0 and RF_BLOCK_en,RX1_PD & TX1_PD, Bit0, Bit 4 & Bit5 to 1
-	RT30xxReadRFRegister(pAd, RF_R01, &RFValue);
-	RFValue = (RFValue & (~0x0C)) | 0x31;
-	RT30xxWriteRFRegister(pAd, RF_R01, RFValue);
-
-	// TX_LO2_en, RF R15 register Bit 3 to 0
-	RT30xxReadRFRegister(pAd, RF_R15, &RFValue);
-	RFValue &= (~0x08);
-	RT30xxWriteRFRegister(pAd, RF_R15, RFValue);
-
-	/* move to NICInitRT30xxRFRegisters
-	// TX_LO1_en, RF R17 register Bit 3 to 0
-	RT30xxReadRFRegister(pAd, RF_R17, &RFValue);
-	RFValue &= (~0x08);
-	// to fix rx long range issue
-	if (((pAd->MACVersion & 0xffff) >= 0x0211) && (pAd->NicConfig2.field.ExternalLNAForG == 0))
-	{
-		RFValue |= 0x20;
-	}
-	// set RF_R17_bit[2:0] equal to EEPROM setting at 0x48h
-	if (pAd->TxMixerGain24G >= 2)
-	{
-		RFValue &= (~0x7);  // clean bit [2:0]
-		RFValue |= pAd->TxMixerGain24G;
-	}
-	RT30xxWriteRFRegister(pAd, RF_R17, RFValue);
-	*/
-
-	// RX_LO1_en, RF R20 register Bit 3 to 0
-	RT30xxReadRFRegister(pAd, RF_R20, &RFValue);
-	RFValue &= (~0x08);
-	RT30xxWriteRFRegister(pAd, RF_R20, RFValue);
-
-	// RX_LO2_en, RF R21 register Bit 3 to 0
-	RT30xxReadRFRegister(pAd, RF_R21, &RFValue);
-	RFValue &= (~0x08);
-	RT30xxWriteRFRegister(pAd, RF_R21, RFValue);
-
-	/* add by johnli, reset RF_R27 when interface down & up to fix throughput problem*/
-	// LDORF_VC, RF R27 register Bit 2 to 0
-	RT30xxReadRFRegister(pAd, RF_R27, &RFValue);
-	// TX to RX IQ glitch(RF_R27) has been fixed in RT3070(F).
-	// Raising RF voltage is no longer needed for RT3070(F)
-	if (IS_RT3090(pAd))	// RT309x and RT3071/72
-	{
-		if ((pAd->MACVersion & 0xffff) < 0x0211)
-			RFValue = (RFValue & (~0x77)) | 0x3;
-		else
-			RFValue = (RFValue & (~0x77));
-		RT30xxWriteRFRegister(pAd, RF_R27, RFValue);
-	}
-	/* end johnli */
-}
-
-/*
-	==========================================================================
-	Description:
-
-	Load RF sleep-mode setup
-
-	==========================================================================
- */
-VOID RT33xxLoadRFSleepModeSetup(
-	IN PRTMP_ADAPTER	pAd)
-{
-	UCHAR RFValue;
-	UINT32 MACValue;
-
-
-	{
-		// RF_BLOCK_en. RF R1 register Bit 0 to 0
-		RT30xxReadRFRegister(pAd, RF_R01, &RFValue);
-		RFValue &= (~0x01);
-		RT30xxWriteRFRegister(pAd, RF_R01, RFValue);
-
-		// VCO_IC, RF R7 register Bit 4 & Bit 5 to 0
-		RT30xxReadRFRegister(pAd, RF_R07, &RFValue);
-		RFValue &= (~0x30);
-		RT30xxWriteRFRegister(pAd, RF_R07, RFValue);
-
-		// Idoh, RF R9 register Bit 1, Bit 2 & Bit 3 to 0
-		RT30xxReadRFRegister(pAd, RF_R09, &RFValue);
-		RFValue &= (~0x0E);
-		RT30xxWriteRFRegister(pAd, RF_R09, RFValue);
-
-		// RX_CTB_en, RF R21 register Bit 7 to 0
-		RT30xxReadRFRegister(pAd, RF_R21, &RFValue);
-		RFValue &= (~0x80);
-		RT30xxWriteRFRegister(pAd, RF_R21, RFValue);
-	}
-
-	if (IS_RT3090(pAd) ||	// IS_RT3090 including RT309x and RT3071/72
-		IS_RT3572(pAd) ||
-		IS_RT3390(pAd) ||
-		(IS_RT3070(pAd) && ((pAd->MACVersion & 0xffff) < 0x0201)))
-	{
-		{
-			RT30xxReadRFRegister(pAd, RF_R27, &RFValue);
-			RFValue |= 0x77;
-			RT30xxWriteRFRegister(pAd, RF_R27, RFValue);
-		}
-
-		RTMP_IO_READ32(pAd, LDO_CFG0, &MACValue);
-		MACValue |= 0x1D000000;
-		RTMP_IO_WRITE32(pAd, LDO_CFG0, MACValue);
-	}
-}
-
-/*
-	==========================================================================
-	Description:
-
-	Reverse RF sleep-mode setup
-
-	==========================================================================
- */
-VOID RT33xxReverseRFSleepModeSetup(
-	IN PRTMP_ADAPTER	pAd)
-{
-	UCHAR RFValue;
-	UINT32 MACValue;
-
-	{
-		// RF_BLOCK_en, RF R1 register Bit 0 to 1
-		RT30xxReadRFRegister(pAd, RF_R01, &RFValue);
-		RFValue |= 0x01;
-		RT30xxWriteRFRegister(pAd, RF_R01, RFValue);
-
-		// VCO_IC, RF R7 register Bit 4 & Bit 5 to 1
-		RT30xxReadRFRegister(pAd, RF_R07, &RFValue);
-		RFValue |= 0x30;
-		RT30xxWriteRFRegister(pAd, RF_R07, RFValue);
-
-		// Idoh, RF R9 register Bit 1, Bit 2 & Bit 3 to 1
-		RT30xxReadRFRegister(pAd, RF_R09, &RFValue);
-		RFValue |= 0x0E;
-		RT30xxWriteRFRegister(pAd, RF_R09, RFValue);
-
-		// RX_CTB_en, RF R21 register Bit 7 to 1
-		RT30xxReadRFRegister(pAd, RF_R21, &RFValue);
-		RFValue |= 0x80;
-		RT30xxWriteRFRegister(pAd, RF_R21, RFValue);
-	}
-
-	if (IS_RT3090(pAd) ||	// IS_RT3090 including RT309x and RT3071/72
-		IS_RT3572(pAd) ||
-		IS_RT3390(pAd) ||
-		(IS_RT3070(pAd) && ((pAd->MACVersion & 0xffff) < 0x0201)))
-	{
-		{
-			RT30xxReadRFRegister(pAd, RF_R27, &RFValue);
-			if ((pAd->MACVersion & 0xffff) < 0x0211)
-				RFValue = (RFValue & (~0x77)) | 0x3;
-			else
-				RFValue = (RFValue & (~0x77));
-			RT30xxWriteRFRegister(pAd, RF_R27, RFValue);
-		}
-
-		// RT3071 version E has fixed this issue
-		if ((pAd->NicConfig2.field.DACTestBit == 1) && ((pAd->MACVersion & 0xffff) < 0x0211))
-		{
-			// patch tx EVM issue temporarily
-			RTMP_IO_READ32(pAd, LDO_CFG0, &MACValue);
-			MACValue = ((MACValue & 0xE0FFFFFF) | 0x0D000000);
-			RTMP_IO_WRITE32(pAd, LDO_CFG0, MACValue);
-		}
-		else
-		{
-			RTMP_IO_READ32(pAd, LDO_CFG0, &MACValue);
-			MACValue = ((MACValue & 0xE0FFFFFF) | 0x01000000);
-			RTMP_IO_WRITE32(pAd, LDO_CFG0, MACValue);
-		}
-	}
-
-	if(IS_RT3572(pAd))
-		RT30xxWriteRFRegister(pAd, RF_R08, 0x80);
-}
-// end johnli
-
-VOID RT33xxHaltAction(
-	IN PRTMP_ADAPTER	pAd)
-{
-	UINT32		TxPinCfg = 0x00050F0F;
-
-	//
-	// Turn off LNA_PE or TRSW_POL
-	//
-	if (IS_RT3070(pAd) || IS_RT3071(pAd) || IS_RT3390(pAd)||IS_RT3572(pAd))
-	{
-	//KH? Both support 3390 usb and  PCI
-		if ((IS_RT3071(pAd) || IS_RT3572(pAd)||IS_RT3390(pAd))
-#ifdef RTMP_EFUSE_SUPPORT
-			&& (pAd->bUseEfuse)
-#endif // RTMP_EFUSE_SUPPORT //
-			)
-		{
-			TxPinCfg &= 0xFFFBF0F0; // bit18 off
-		}
-		else
-		{
-			TxPinCfg &= 0xFFFFF0F0;
-		}
-
-		RTMP_IO_WRITE32(pAd, TX_PIN_CFG, TxPinCfg);
-	}
-}
-
-#endif // RT30xx //
diff --git a/drivers/staging/rt3090/chlist.h b/drivers/staging/rt3090/chlist.h
deleted file mode 100644
index d03cb4754394..000000000000
--- a/drivers/staging/rt3090/chlist.h
+++ /dev/null
@@ -1,130 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-    Module Name:
-    chlist.h
-
-    Abstract:
-    Miniport generic portion header file
-
-    Revision History:
-    Who         When          What
-    --------    ----------    ----------------------------------------------
-	Fonchi Wu   2007-12-19    created
-*/
-
-#ifndef __CHLIST_H__
-#define __CHLIST_H__
-
-#include "rtmp_type.h"
-#include "rtmp_def.h"
-
-
-#define ODOR			0
-#define IDOR			1
-#define BOTH			2
-
-#define BAND_5G         0
-#define BAND_24G        1
-#define BAND_BOTH       2
-
-typedef struct _CH_DESP {
-	UCHAR FirstChannel;
-	UCHAR NumOfCh;
-	CHAR MaxTxPwr;			// dBm
-	UCHAR Geography;			// 0:out door, 1:in door, 2:both
-	BOOLEAN DfsReq;			// Dfs require, 0: No, 1: yes.
-} CH_DESP, *PCH_DESP;
-
-typedef struct _CH_REGION {
-	UCHAR CountReg[3];
-	UCHAR DfsType;			// 0: CE, 1: FCC, 2: JAP, 3:JAP_W53, JAP_W56
-	CH_DESP ChDesp[10];
-} CH_REGION, *PCH_REGION;
-
-extern CH_REGION ChRegion[];
-
-typedef struct _CH_FREQ_MAP_{
-	UINT16		channel;
-	UINT16		freqKHz;
-}CH_FREQ_MAP;
-
-extern CH_FREQ_MAP CH_HZ_ID_MAP[];
-extern int CH_HZ_ID_MAP_NUM;
-
-
-#define     MAP_CHANNEL_ID_TO_KHZ(_ch, _khz)					\
-		do{													\
-			int _chIdx;											\
-			for (_chIdx = 0; _chIdx < CH_HZ_ID_MAP_NUM; _chIdx++)\
-			{													\
-				if ((_ch) == CH_HZ_ID_MAP[_chIdx].channel)			\
-				{												\
-					(_khz) = CH_HZ_ID_MAP[_chIdx].freqKHz * 1000;	\
-					break;										\
-				}												\
-			}													\
-			if (_chIdx == CH_HZ_ID_MAP_NUM)					\
-				(_khz) = 2412000;									\
-            }while(0)
-
-#define     MAP_KHZ_TO_CHANNEL_ID(_khz, _ch)                 \
-		do{													\
-			int _chIdx;											\
-			for (_chIdx = 0; _chIdx < CH_HZ_ID_MAP_NUM; _chIdx++)\
-			{													\
-				if ((_khz) == CH_HZ_ID_MAP[_chIdx].freqKHz)			\
-				{												\
-					(_ch) = CH_HZ_ID_MAP[_chIdx].channel;			\
-					break;										\
-				}												\
-			}													\
-			if (_chIdx == CH_HZ_ID_MAP_NUM)					\
-				(_ch) = 1;											\
-		}while(0)
-
-
-VOID BuildChannelListEx(
-	IN PRTMP_ADAPTER pAd);
-
-VOID BuildBeaconChList(
-	IN PRTMP_ADAPTER pAd,
-	OUT PUCHAR pBuf,
-	OUT	PULONG pBufLen);
-
-#ifdef DOT11_N_SUPPORT
-VOID N_ChannelCheck(
-	IN PRTMP_ADAPTER pAd);
-
-VOID N_SetCenCh(
-	IN PRTMP_ADAPTER pAd);
-#endif // DOT11_N_SUPPORT //
-
-UINT8 GetCuntryMaxTxPwr(
-	IN PRTMP_ADAPTER pAd,
-	IN UINT8 channel);
-
-#endif // __CHLIST_H__
diff --git a/drivers/staging/rt3090/common/action.c b/drivers/staging/rt3090/common/action.c
deleted file mode 100644
index 8e3b0a0c2d64..000000000000
--- a/drivers/staging/rt3090/common/action.c
+++ /dev/null
@@ -1,1057 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-    Module Name:
-	action.c
-
-    Abstract:
-    Handle association related requests either from WSTA or from local MLME
-
-    Revision History:
-    Who         When          What
-    --------    ----------    ----------------------------------------------
-	Jan Lee		2006		created for rt2860
- */
-
-#include "../rt_config.h"
-#include "../action.h"
-
-
-static VOID ReservedAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem);
-
-
-/*
-    ==========================================================================
-    Description:
-        association state machine init, including state transition and timer init
-    Parameters:
-        S - pointer to the association state machine
-    Note:
-        The state machine looks like the following
-
-                                    ASSOC_IDLE
-        MT2_MLME_DISASSOC_REQ    mlme_disassoc_req_action
-        MT2_PEER_DISASSOC_REQ    peer_disassoc_action
-        MT2_PEER_ASSOC_REQ       drop
-        MT2_PEER_REASSOC_REQ     drop
-        MT2_CLS3ERR              cls3err_action
-    ==========================================================================
- */
-VOID ActionStateMachineInit(
-    IN	PRTMP_ADAPTER	pAd,
-    IN  STATE_MACHINE *S,
-    OUT STATE_MACHINE_FUNC Trans[])
-{
-	StateMachineInit(S, (STATE_MACHINE_FUNC *)Trans, MAX_ACT_STATE, MAX_ACT_MSG, (STATE_MACHINE_FUNC)Drop, ACT_IDLE, ACT_MACHINE_BASE);
-
-	StateMachineSetAction(S, ACT_IDLE, MT2_PEER_SPECTRUM_CATE, (STATE_MACHINE_FUNC)PeerSpectrumAction);
-	StateMachineSetAction(S, ACT_IDLE, MT2_PEER_QOS_CATE, (STATE_MACHINE_FUNC)PeerQOSAction);
-
-	StateMachineSetAction(S, ACT_IDLE, MT2_PEER_DLS_CATE, (STATE_MACHINE_FUNC)ReservedAction);
-#ifdef QOS_DLS_SUPPORT
-		StateMachineSetAction(S, ACT_IDLE, MT2_PEER_DLS_CATE, (STATE_MACHINE_FUNC)PeerDLSAction);
-#endif // QOS_DLS_SUPPORT //
-
-#ifdef DOT11_N_SUPPORT
-	StateMachineSetAction(S, ACT_IDLE, MT2_PEER_BA_CATE, (STATE_MACHINE_FUNC)PeerBAAction);
-	StateMachineSetAction(S, ACT_IDLE, MT2_PEER_HT_CATE, (STATE_MACHINE_FUNC)PeerHTAction);
-	StateMachineSetAction(S, ACT_IDLE, MT2_MLME_ADD_BA_CATE, (STATE_MACHINE_FUNC)MlmeADDBAAction);
-	StateMachineSetAction(S, ACT_IDLE, MT2_MLME_ORI_DELBA_CATE, (STATE_MACHINE_FUNC)MlmeDELBAAction);
-	StateMachineSetAction(S, ACT_IDLE, MT2_MLME_REC_DELBA_CATE, (STATE_MACHINE_FUNC)MlmeDELBAAction);
-#endif // DOT11_N_SUPPORT //
-
-	StateMachineSetAction(S, ACT_IDLE, MT2_PEER_PUBLIC_CATE, (STATE_MACHINE_FUNC)PeerPublicAction);
-	StateMachineSetAction(S, ACT_IDLE, MT2_PEER_RM_CATE, (STATE_MACHINE_FUNC)PeerRMAction);
-
-	StateMachineSetAction(S, ACT_IDLE, MT2_MLME_QOS_CATE, (STATE_MACHINE_FUNC)MlmeQOSAction);
-	StateMachineSetAction(S, ACT_IDLE, MT2_MLME_DLS_CATE, (STATE_MACHINE_FUNC)MlmeDLSAction);
-	StateMachineSetAction(S, ACT_IDLE, MT2_ACT_INVALID, (STATE_MACHINE_FUNC)MlmeInvalidAction);
-
-
-}
-
-#ifdef DOT11_N_SUPPORT
-VOID MlmeADDBAAction(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem)
-
-{
-	MLME_ADDBA_REQ_STRUCT *pInfo;
-	UCHAR           Addr[6];
-	PUCHAR         pOutBuffer = NULL;
-	NDIS_STATUS     NStatus;
-	ULONG		Idx;
-	FRAME_ADDBA_REQ  Frame;
-	ULONG		FrameLen;
-	BA_ORI_ENTRY			*pBAEntry = NULL;
-
-	pInfo = (MLME_ADDBA_REQ_STRUCT *)Elem->Msg;
-	NdisZeroMemory(&Frame, sizeof(FRAME_ADDBA_REQ));
-
-	if(MlmeAddBAReqSanity(pAd, Elem->Msg, Elem->MsgLen, Addr))
-	{
-		NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);  //Get an unused nonpaged memory
-		if(NStatus != NDIS_STATUS_SUCCESS)
-		{
-			DBGPRINT(RT_DEBUG_TRACE,("BA - MlmeADDBAAction() allocate memory failed \n"));
-			return;
-		}
-		// 1. find entry
-		Idx = pAd->MacTab.Content[pInfo->Wcid].BAOriWcidArray[pInfo->TID];
-		if (Idx == 0)
-		{
-			MlmeFreeMemory(pAd, pOutBuffer);
-			DBGPRINT(RT_DEBUG_ERROR,("BA - MlmeADDBAAction() can't find BAOriEntry \n"));
-			return;
-		}
-		else
-		{
-			pBAEntry =&pAd->BATable.BAOriEntry[Idx];
-		}
-
-#ifdef CONFIG_STA_SUPPORT
-		IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		{
-			if (ADHOC_ON(pAd))
-				ActHeaderInit(pAd, &Frame.Hdr, pInfo->pAddr, pAd->CurrentAddress, pAd->CommonCfg.Bssid);
-			else
-#ifdef QOS_DLS_SUPPORT
-			if (pAd->MacTab.Content[pInfo->Wcid].ValidAsDls)
-				ActHeaderInit(pAd, &Frame.Hdr, pInfo->pAddr, pAd->CurrentAddress, pAd->CommonCfg.Bssid);
-			else
-#endif // QOS_DLS_SUPPORT //
-			ActHeaderInit(pAd, &Frame.Hdr, pAd->CommonCfg.Bssid, pAd->CurrentAddress, pInfo->pAddr);
-
-		}
-#endif // CONFIG_STA_SUPPORT //
-
-		Frame.Category = CATEGORY_BA;
-		Frame.Action = ADDBA_REQ;
-		Frame.BaParm.AMSDUSupported = 0;
-		Frame.BaParm.BAPolicy = IMMED_BA;
-		Frame.BaParm.TID = pInfo->TID;
-		Frame.BaParm.BufSize = pInfo->BaBufSize;
-		Frame.Token = pInfo->Token;
-		Frame.TimeOutValue = pInfo->TimeOutValue;
-		Frame.BaStartSeq.field.FragNum = 0;
-		Frame.BaStartSeq.field.StartSeq = pAd->MacTab.Content[pInfo->Wcid].TxSeq[pInfo->TID];
-
-		*(USHORT *)(&Frame.BaParm) = cpu2le16(*(USHORT *)(&Frame.BaParm));
-		Frame.TimeOutValue = cpu2le16(Frame.TimeOutValue);
-		Frame.BaStartSeq.word = cpu2le16(Frame.BaStartSeq.word);
-
-		MakeOutgoingFrame(pOutBuffer,		   &FrameLen,
-		              sizeof(FRAME_ADDBA_REQ), &Frame,
-		              END_OF_ARGS);
-
-		MiniportMMRequest(pAd, (MGMT_USE_QUEUE_FLAG | MapUserPriorityToAccessCategory[pInfo->TID]), pOutBuffer, FrameLen);
-
-		MlmeFreeMemory(pAd, pOutBuffer);
-
-		DBGPRINT(RT_DEBUG_TRACE, ("BA - Send ADDBA request. StartSeq = %x,  FrameLen = %ld. BufSize = %d\n", Frame.BaStartSeq.field.StartSeq, FrameLen, Frame.BaParm.BufSize));
-    }
-}
-
-/*
-    ==========================================================================
-    Description:
-        send DELBA and delete BaEntry if any
-    Parametrs:
-        Elem - MLME message MLME_DELBA_REQ_STRUCT
-
-	IRQL = DISPATCH_LEVEL
-
-    ==========================================================================
- */
-VOID MlmeDELBAAction(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem)
-{
-	MLME_DELBA_REQ_STRUCT *pInfo;
-	PUCHAR         pOutBuffer = NULL;
-	PUCHAR		   pOutBuffer2 = NULL;
-	NDIS_STATUS     NStatus;
-	ULONG		Idx;
-	FRAME_DELBA_REQ  Frame;
-	ULONG		FrameLen;
-	FRAME_BAR	FrameBar;
-
-	pInfo = (MLME_DELBA_REQ_STRUCT *)Elem->Msg;
-	// must send back DELBA
-	NdisZeroMemory(&Frame, sizeof(FRAME_DELBA_REQ));
-	DBGPRINT(RT_DEBUG_TRACE, ("==> MlmeDELBAAction(), Initiator(%d) \n", pInfo->Initiator));
-
-	if(MlmeDelBAReqSanity(pAd, Elem->Msg, Elem->MsgLen))
-	{
-		NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);  //Get an unused nonpaged memory
-		if(NStatus != NDIS_STATUS_SUCCESS)
-		{
-			DBGPRINT(RT_DEBUG_ERROR,("BA - MlmeDELBAAction() allocate memory failed 1. \n"));
-			return;
-		}
-
-		NStatus = MlmeAllocateMemory(pAd, &pOutBuffer2);  //Get an unused nonpaged memory
-		if(NStatus != NDIS_STATUS_SUCCESS)
-		{
-			MlmeFreeMemory(pAd, pOutBuffer);
-			DBGPRINT(RT_DEBUG_ERROR, ("BA - MlmeDELBAAction() allocate memory failed 2. \n"));
-			return;
-		}
-
-		// SEND BAR (Send BAR to refresh peer reordering buffer.)
-		Idx = pAd->MacTab.Content[pInfo->Wcid].BAOriWcidArray[pInfo->TID];
-
-#ifdef CONFIG_STA_SUPPORT
-		IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-			BarHeaderInit(pAd, &FrameBar, pAd->MacTab.Content[pInfo->Wcid].Addr, pAd->CurrentAddress);
-#endif // CONFIG_STA_SUPPORT //
-
-		FrameBar.StartingSeq.field.FragNum = 0; // make sure sequence not clear in DEL funciton.
-		FrameBar.StartingSeq.field.StartSeq = pAd->MacTab.Content[pInfo->Wcid].TxSeq[pInfo->TID]; // make sure sequence not clear in DEL funciton.
-		FrameBar.BarControl.TID = pInfo->TID; // make sure sequence not clear in DEL funciton.
-		FrameBar.BarControl.ACKPolicy = IMMED_BA; // make sure sequence not clear in DEL funciton.
-		FrameBar.BarControl.Compressed = 1; // make sure sequence not clear in DEL funciton.
-		FrameBar.BarControl.MTID = 0; // make sure sequence not clear in DEL funciton.
-
-		MakeOutgoingFrame(pOutBuffer2,				&FrameLen,
-					  sizeof(FRAME_BAR),	  &FrameBar,
-					  END_OF_ARGS);
-		MiniportMMRequest(pAd, QID_AC_BE, pOutBuffer2, FrameLen);
-		MlmeFreeMemory(pAd, pOutBuffer2);
-		DBGPRINT(RT_DEBUG_TRACE,("BA - MlmeDELBAAction() . Send BAR to refresh peer reordering buffer \n"));
-
-		// SEND DELBA FRAME
-		FrameLen = 0;
-#ifdef CONFIG_STA_SUPPORT
-		IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		{
-			if (ADHOC_ON(pAd))
-				ActHeaderInit(pAd, &Frame.Hdr, pAd->MacTab.Content[pInfo->Wcid].Addr, pAd->CurrentAddress, pAd->CommonCfg.Bssid);
-			else
-#ifdef QOS_DLS_SUPPORT
-			if (pAd->MacTab.Content[pInfo->Wcid].ValidAsDls)
-				ActHeaderInit(pAd, &Frame.Hdr, pAd->MacTab.Content[pInfo->Wcid].Addr, pAd->CurrentAddress, pAd->CommonCfg.Bssid);
-			else
-#endif // QOS_DLS_SUPPORT //
-			ActHeaderInit(pAd, &Frame.Hdr,  pAd->CommonCfg.Bssid, pAd->CurrentAddress, pAd->MacTab.Content[pInfo->Wcid].Addr);
-		}
-#endif // CONFIG_STA_SUPPORT //
-		Frame.Category = CATEGORY_BA;
-		Frame.Action = DELBA;
-		Frame.DelbaParm.Initiator = pInfo->Initiator;
-		Frame.DelbaParm.TID = pInfo->TID;
-		Frame.ReasonCode = 39; // Time Out
-		*(USHORT *)(&Frame.DelbaParm) = cpu2le16(*(USHORT *)(&Frame.DelbaParm));
-		Frame.ReasonCode = cpu2le16(Frame.ReasonCode);
-
-		MakeOutgoingFrame(pOutBuffer,               &FrameLen,
-		              sizeof(FRAME_DELBA_REQ),    &Frame,
-		              END_OF_ARGS);
-		MiniportMMRequest(pAd, QID_AC_BE, pOutBuffer, FrameLen);
-		MlmeFreeMemory(pAd, pOutBuffer);
-		DBGPRINT(RT_DEBUG_TRACE, ("BA - MlmeDELBAAction() . 3 DELBA sent. Initiator(%d)\n", pInfo->Initiator));
-	}
-}
-#endif // DOT11_N_SUPPORT //
-
-VOID MlmeQOSAction(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem)
-{
-}
-
-VOID MlmeDLSAction(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem)
-{
-}
-
-VOID MlmeInvalidAction(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem)
-{
-	//PUCHAR		   pOutBuffer = NULL;
-	//Return the receiving frame except the MSB of category filed set to 1.  7.3.1.11
-}
-
-VOID PeerQOSAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-}
-
-#ifdef QOS_DLS_SUPPORT
-VOID PeerDLSAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-	UCHAR	Action = Elem->Msg[LENGTH_802_11+1];
-
-	switch(Action)
-	{
-		case ACTION_DLS_REQUEST:
-#ifdef CONFIG_STA_SUPPORT
-			IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-			PeerDlsReqAction(pAd, Elem);
-#endif // CONFIG_STA_SUPPORT //
-			break;
-
-		case ACTION_DLS_RESPONSE:
-#ifdef CONFIG_STA_SUPPORT
-			IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-			PeerDlsRspAction(pAd, Elem);
-#endif // CONFIG_STA_SUPPORT //
-			break;
-
-		case ACTION_DLS_TEARDOWN:
-#ifdef CONFIG_STA_SUPPORT
-			IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-			PeerDlsTearDownAction(pAd, Elem);
-#endif // CONFIG_STA_SUPPORT //
-			break;
-	}
-}
-#endif // QOS_DLS_SUPPORT //
-
-
-
-#ifdef DOT11_N_SUPPORT
-VOID PeerBAAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-	UCHAR	Action = Elem->Msg[LENGTH_802_11+1];
-
-	switch(Action)
-	{
-		case ADDBA_REQ:
-			PeerAddBAReqAction(pAd,Elem);
-			break;
-		case ADDBA_RESP:
-			PeerAddBARspAction(pAd,Elem);
-			break;
-		case DELBA:
-			PeerDelBAAction(pAd,Elem);
-			break;
-	}
-}
-
-
-#ifdef DOT11N_DRAFT3
-
-#ifdef CONFIG_STA_SUPPORT
-VOID StaPublicAction(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR Bss2040Coexist)
-{
-	BSS_2040_COEXIST_IE		BssCoexist;
-	MLME_SCAN_REQ_STRUCT			ScanReq;
-
-	BssCoexist.word = Bss2040Coexist;
-	// AP asks Station to return a 20/40 BSS Coexistence mgmt frame.  So we first starts a scan, then send back 20/40 BSS Coexistence mgmt frame
-	if ((BssCoexist.field.InfoReq == 1) && (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_SCAN_2040)))
-	{
-		// Clear record first.  After scan , will update those bit and send back to transmiter.
-		pAd->CommonCfg.BSSCoexist2040.field.InfoReq = 1;
-		pAd->CommonCfg.BSSCoexist2040.field.Intolerant40 = 0;
-		pAd->CommonCfg.BSSCoexist2040.field.BSS20WidthReq = 0;
-		// Fill out stuff for scan request
-		ScanParmFill(pAd, &ScanReq, ZeroSsid, 0, BSS_ANY, SCAN_2040_BSS_COEXIST);
-		MlmeEnqueue(pAd, SYNC_STATE_MACHINE, MT2_MLME_SCAN_REQ, sizeof(MLME_SCAN_REQ_STRUCT), &ScanReq);
-		pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_OID_LIST_SCAN;
-	}
-}
-
-
-/*
-Description : Build Intolerant Channel Rerpot from Trigger event table.
-return : how many bytes copied.
-*/
-ULONG BuildIntolerantChannelRep(
-	IN	PRTMP_ADAPTER	pAd,
-	IN    PUCHAR  pDest)
-{
-	ULONG			FrameLen = 0;
-	ULONG			ReadOffset = 0;
-	UCHAR			i;
-	UCHAR			LastRegClass = 0xff;
-	PUCHAR			pLen;
-
-	for ( i = 0;i < MAX_TRIGGER_EVENT;i++)
-	{
-		if (pAd->CommonCfg.TriggerEventTab.EventA[i].bValid == TRUE)
-		{
-			if (pAd->CommonCfg.TriggerEventTab.EventA[i].RegClass == LastRegClass)
-			{
-				*(pDest + ReadOffset) = (UCHAR)pAd->CommonCfg.TriggerEventTab.EventA[i].Channel;
-				*pLen++;
-				ReadOffset++;
-				FrameLen++;
-			}
-			else
-			{
-				*(pDest + ReadOffset) = IE_2040_BSS_INTOLERANT_REPORT;  // IE
-				*(pDest + ReadOffset + 1) = 2;	// Len = RegClass byte + channel byte.
-				pLen = pDest + ReadOffset + 1;
-				LastRegClass = pAd->CommonCfg.TriggerEventTab.EventA[i].RegClass;
-				*(pDest + ReadOffset + 2) = LastRegClass;	// Len = RegClass byte + channel byte.
-				*(pDest + ReadOffset + 3) = (UCHAR)pAd->CommonCfg.TriggerEventTab.EventA[i].Channel;
-				FrameLen += 4;
-				ReadOffset += 4;
-			}
-
-		}
-	}
-	return FrameLen;
-}
-
-
-/*
-Description : Send 20/40 BSS Coexistence Action frame If one trigger event is triggered.
-*/
-VOID Send2040CoexistAction(
-	IN	PRTMP_ADAPTER	pAd,
-	IN    UCHAR  Wcid,
-	IN	BOOLEAN	bAddIntolerantCha)
-{
-	PUCHAR			pOutBuffer = NULL;
-	NDIS_STATUS	NStatus;
-	FRAME_ACTION_HDR	Frame;
-	ULONG			FrameLen;
-	ULONG			IntolerantChaRepLen;
-
-	IntolerantChaRepLen = 0;
-	NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);  //Get an unused nonpaged memory
-	if(NStatus != NDIS_STATUS_SUCCESS)
-	{
-		DBGPRINT(RT_DEBUG_ERROR,("ACT - Send2040CoexistAction() allocate memory failed \n"));
-		return;
-	}
-	ActHeaderInit(pAd, &Frame.Hdr, pAd->MacTab.Content[Wcid].Addr, pAd->CommonCfg.Bssid);
-	Frame.Category = CATEGORY_PUBLIC;
-	Frame.Action = ACTION_BSS_2040_COEXIST;
-
-	MakeOutgoingFrame(pOutBuffer,				&FrameLen,
-				  sizeof(FRAME_ACTION_HDR),	  &Frame,
-				  END_OF_ARGS);
-
-	*(pOutBuffer + FrameLen) = pAd->CommonCfg.BSSCoexist2040.word;
-	FrameLen++;
-
-	if (bAddIntolerantCha == TRUE)
-		IntolerantChaRepLen = BuildIntolerantChannelRep(pAd, pOutBuffer + FrameLen);
-
-	MiniportMMRequest(pAd, QID_AC_BE, pOutBuffer, FrameLen + IntolerantChaRepLen);
-	DBGPRINT(RT_DEBUG_ERROR,("ACT - Send2040CoexistAction( BSSCoexist2040 = 0x%x )  \n", pAd->CommonCfg.BSSCoexist2040.word));
-
-}
-
-
-/*
-	==========================================================================
-	Description:
-	After scan, Update 20/40 BSS Coexistence IE and send out.
-	According to 802.11n D3.03 11.14.10
-
-	Parameters:
-	==========================================================================
- */
-VOID Update2040CoexistFrameAndNotify(
-	IN	PRTMP_ADAPTER	pAd,
-	IN    UCHAR  Wcid,
-	IN	BOOLEAN	bAddIntolerantCha)
-{
-	BSS_2040_COEXIST_IE	OldValue;
-
-	OldValue.word = pAd->CommonCfg.BSSCoexist2040.word;
-	if ((pAd->CommonCfg.TriggerEventTab.EventANo > 0) || (pAd->CommonCfg.TriggerEventTab.EventBCountDown > 0))
-		pAd->CommonCfg.BSSCoexist2040.field.BSS20WidthReq = 1;
-
-	// Need to check !!!!
-	// How STA will set Intolerant40 if implementation dependent. Now we don't set this bit first.!!!!!
-	// So Only check BSS20WidthReq change.
-	if (OldValue.field.BSS20WidthReq != pAd->CommonCfg.BSSCoexist2040.field.BSS20WidthReq)
-	{
-		Send2040CoexistAction(pAd, Wcid, bAddIntolerantCha);
-	}
-}
-#endif // CONFIG_STA_SUPPORT //
-
-
-BOOLEAN ChannelSwitchSanityCheck(
-	IN	PRTMP_ADAPTER	pAd,
-	IN    UCHAR  Wcid,
-	IN    UCHAR  NewChannel,
-	IN    UCHAR  Secondary)
-{
-	UCHAR		i;
-
-	if (Wcid >= MAX_LEN_OF_MAC_TABLE)
-		return FALSE;
-
-	if ((NewChannel > 7) && (Secondary == 1))
-		return FALSE;
-
-	if ((NewChannel < 5) && (Secondary == 3))
-		return FALSE;
-
-	// 0. Check if new channel is in the channellist.
-	for (i = 0;i < pAd->ChannelListNum;i++)
-	{
-		if (pAd->ChannelList[i].Channel == NewChannel)
-		{
-			break;
-		}
-	}
-
-	if (i == pAd->ChannelListNum)
-		return FALSE;
-
-	return TRUE;
-}
-
-
-VOID ChannelSwitchAction(
-	IN	PRTMP_ADAPTER	pAd,
-	IN    UCHAR  Wcid,
-	IN    UCHAR  NewChannel,
-	IN    UCHAR  Secondary)
-{
-	UCHAR		BBPValue = 0;
-	ULONG		MACValue;
-
-	DBGPRINT(RT_DEBUG_TRACE,("SPECTRUM - ChannelSwitchAction(NewChannel = %d , Secondary = %d)  \n", NewChannel, Secondary));
-
-	if (ChannelSwitchSanityCheck(pAd, Wcid, NewChannel, Secondary) == FALSE)
-		return;
-
-	// 1.  Switches to BW = 20.
-	if (Secondary == 0)
-	{
-		RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R4, &BBPValue);
-		BBPValue&= (~0x18);
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R4, BBPValue);
-		if (pAd->MACVersion == 0x28600100)
-		{
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R69, 0x16);
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R70, 0x08);
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R73, 0x11);
-			DBGPRINT(RT_DEBUG_TRACE, ("!!!rt2860C !!! \n" ));
-		}
-		pAd->CommonCfg.BBPCurrentBW = BW_20;
-		pAd->CommonCfg.Channel = NewChannel;
-		pAd->CommonCfg.CentralChannel = pAd->CommonCfg.Channel;
-		AsicSwitchChannel(pAd, pAd->CommonCfg.Channel,FALSE);
-		AsicLockChannel(pAd, pAd->CommonCfg.Channel);
-		pAd->MacTab.Content[Wcid].HTPhyMode.field.BW = 0;
-		DBGPRINT(RT_DEBUG_TRACE, ("!!!20MHz   !!! \n" ));
-	}
-	// 1.  Switches to BW = 40 And Station supports BW = 40.
-	else if (((Secondary == 1) || (Secondary == 3)) && (pAd->CommonCfg.HtCapability.HtCapInfo.ChannelWidth == 1))
-	{
-		pAd->CommonCfg.Channel = NewChannel;
-
-		if (Secondary == 1)
-		{
-			// Secondary above.
-			pAd->CommonCfg.CentralChannel = pAd->CommonCfg.Channel + 2;
-			RTMP_IO_READ32(pAd, TX_BAND_CFG, &MACValue);
-			MACValue &= 0xfe;
-			RTMP_IO_WRITE32(pAd, TX_BAND_CFG, MACValue);
-			RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R4, &BBPValue);
-			BBPValue&= (~0x18);
-			BBPValue|= (0x10);
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R4, BBPValue);
-			RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R3, &BBPValue);
-			BBPValue&= (~0x20);
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R3, BBPValue);
-			DBGPRINT(RT_DEBUG_TRACE, ("!!!40MHz Lower LINK UP !!! Control Channel at Below. Central = %d \n", pAd->CommonCfg.CentralChannel ));
-		}
-		else
-		{
-			// Secondary below.
-			pAd->CommonCfg.CentralChannel = pAd->CommonCfg.Channel - 2;
-			RTMP_IO_READ32(pAd, TX_BAND_CFG, &MACValue);
-			MACValue &= 0xfe;
-			MACValue |= 0x1;
-			RTMP_IO_WRITE32(pAd, TX_BAND_CFG, MACValue);
-			RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R4, &BBPValue);
-			BBPValue&= (~0x18);
-			BBPValue|= (0x10);
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R4, BBPValue);
-			RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R3, &BBPValue);
-			BBPValue&= (~0x20);
-			BBPValue|= (0x20);
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R3, BBPValue);
-			DBGPRINT(RT_DEBUG_TRACE, ("!!!40MHz Upper LINK UP !!! Control Channel at UpperCentral = %d \n", pAd->CommonCfg.CentralChannel ));
-		}
-		pAd->CommonCfg.BBPCurrentBW = BW_40;
-		AsicSwitchChannel(pAd, pAd->CommonCfg.CentralChannel, FALSE);
-		AsicLockChannel(pAd, pAd->CommonCfg.CentralChannel);
-		pAd->MacTab.Content[Wcid].HTPhyMode.field.BW = 1;
-	}
-}
-#endif // DOT11N_DRAFT3 //
-#endif // DOT11_N_SUPPORT //
-
-VOID PeerPublicAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-#ifdef DOT11_N_SUPPORT
-#ifdef DOT11N_DRAFT3
-	UCHAR	Action = Elem->Msg[LENGTH_802_11+1];
-#endif // DOT11N_DRAFT3 //
-#endif // DOT11_N_SUPPORT //
-	if (Elem->Wcid >= MAX_LEN_OF_MAC_TABLE)
-		return;
-
-#ifdef DOT11_N_SUPPORT
-#ifdef DOT11N_DRAFT3
-	switch(Action)
-	{
-		case ACTION_BSS_2040_COEXIST:	// Format defined in IEEE 7.4.7a.1 in 11n Draf3.03
-			{
-				//UCHAR	BssCoexist;
-				BSS_2040_COEXIST_ELEMENT		*pCoexistInfo;
-				BSS_2040_COEXIST_IE			*pBssCoexistIe;
-				BSS_2040_INTOLERANT_CH_REPORT	*pIntolerantReport = NULL;
-
-				if (Elem->MsgLen <= (LENGTH_802_11 + sizeof(BSS_2040_COEXIST_ELEMENT)) )
-				{
-					DBGPRINT(RT_DEBUG_ERROR, ("ACTION - 20/40 BSS Coexistence Management Frame length too short! len = %ld!\n", Elem->MsgLen));
-					break;
-				}
-				DBGPRINT(RT_DEBUG_TRACE, ("ACTION - 20/40 BSS Coexistence Management action----> \n"));
-				hex_dump("CoexistenceMgmtFrame", Elem->Msg, Elem->MsgLen);
-
-
-				pCoexistInfo = (BSS_2040_COEXIST_ELEMENT *) &Elem->Msg[LENGTH_802_11+2];
-				//hex_dump("CoexistInfo", (PUCHAR)pCoexistInfo, sizeof(BSS_2040_COEXIST_ELEMENT));
-				if (Elem->MsgLen >= (LENGTH_802_11 + sizeof(BSS_2040_COEXIST_ELEMENT) + sizeof(BSS_2040_INTOLERANT_CH_REPORT)))
-				{
-					pIntolerantReport = (BSS_2040_INTOLERANT_CH_REPORT *)((PUCHAR)pCoexistInfo + sizeof(BSS_2040_COEXIST_ELEMENT));
-				}
-				//hex_dump("IntolerantReport ", (PUCHAR)pIntolerantReport, sizeof(BSS_2040_INTOLERANT_CH_REPORT));
-
-				pBssCoexistIe = (BSS_2040_COEXIST_IE *)(&pCoexistInfo->BssCoexistIe);
-
-#ifdef CONFIG_STA_SUPPORT
-				IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-				{
-					if (INFRA_ON(pAd))
-					{
-						StaPublicAction(pAd, pCoexistInfo);
-					}
-				}
-#endif // CONFIG_STA_SUPPORT //
-
-			}
-			break;
-	}
-
-#endif // DOT11N_DRAFT3 //
-#endif // DOT11_N_SUPPORT //
-
-}
-
-
-static VOID ReservedAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-	UCHAR Category;
-
-	if (Elem->MsgLen <= LENGTH_802_11)
-	{
-		return;
-	}
-
-	Category = Elem->Msg[LENGTH_802_11];
-	DBGPRINT(RT_DEBUG_TRACE,("Rcv reserved category(%d) Action Frame\n", Category));
-	hex_dump("Reserved Action Frame", &Elem->Msg[0], Elem->MsgLen);
-}
-
-VOID PeerRMAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-
-{
-	return;
-}
-
-#ifdef DOT11_N_SUPPORT
-static VOID respond_ht_information_exchange_action(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-	PUCHAR			pOutBuffer = NULL;
-	NDIS_STATUS		NStatus;
-	ULONG			FrameLen;
-	FRAME_HT_INFO	HTINFOframe, *pFrame;
-	UCHAR			*pAddr;
-
-
-	// 2. Always send back ADDBA Response
-	NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);	 //Get an unused nonpaged memory
-
-	if (NStatus != NDIS_STATUS_SUCCESS)
-	{
-		DBGPRINT(RT_DEBUG_TRACE,("ACTION - respond_ht_information_exchange_action() allocate memory failed \n"));
-		return;
-	}
-
-	// get RA
-	pFrame = (FRAME_HT_INFO *) &Elem->Msg[0];
-	pAddr = pFrame->Hdr.Addr2;
-
-	NdisZeroMemory(&HTINFOframe, sizeof(FRAME_HT_INFO));
-	// 2-1. Prepare ADDBA Response frame.
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-		if (ADHOC_ON(pAd))
-			ActHeaderInit(pAd, &HTINFOframe.Hdr, pAddr, pAd->CurrentAddress, pAd->CommonCfg.Bssid);
-		else
-		ActHeaderInit(pAd, &HTINFOframe.Hdr, pAd->CommonCfg.Bssid, pAd->CurrentAddress, pAddr);
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-	HTINFOframe.Category = CATEGORY_HT;
-	HTINFOframe.Action = HT_INFO_EXCHANGE;
-	HTINFOframe.HT_Info.Request = 0;
-	HTINFOframe.HT_Info.Forty_MHz_Intolerant = pAd->CommonCfg.HtCapability.HtCapInfo.Forty_Mhz_Intolerant;
-	HTINFOframe.HT_Info.STA_Channel_Width	 = pAd->CommonCfg.AddHTInfo.AddHtInfo.RecomWidth;
-
-	MakeOutgoingFrame(pOutBuffer,					&FrameLen,
-					  sizeof(FRAME_HT_INFO),	&HTINFOframe,
-					  END_OF_ARGS);
-
-	MiniportMMRequest(pAd, QID_AC_BE, pOutBuffer, FrameLen);
-	MlmeFreeMemory(pAd, pOutBuffer);
-}
-
-
-#ifdef DOT11N_DRAFT3
-VOID SendNotifyBWActionFrame(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR  Wcid,
-	IN UCHAR apidx)
-{
-	PUCHAR			pOutBuffer = NULL;
-	NDIS_STATUS	NStatus;
-	FRAME_ACTION_HDR	Frame;
-	ULONG			FrameLen;
-	PUCHAR			pAddr1;
-
-
-	NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);  //Get an unused nonpaged memory
-	if(NStatus != NDIS_STATUS_SUCCESS)
-	{
-		DBGPRINT(RT_DEBUG_ERROR,("ACT - SendNotifyBWAction() allocate memory failed \n"));
-		return;
-	}
-
-	if (Wcid == MCAST_WCID)
-		pAddr1 = &BROADCAST_ADDR[0];
-	else
-		pAddr1 = pAd->MacTab.Content[Wcid].Addr;
-	ActHeaderInit(pAd, &Frame.Hdr, pAddr1, pAd->ApCfg.MBSSID[apidx].Bssid, pAd->ApCfg.MBSSID[apidx].Bssid);
-
-	Frame.Category = CATEGORY_HT;
-	Frame.Action = NOTIFY_BW_ACTION;
-
-	MakeOutgoingFrame(pOutBuffer,				&FrameLen,
-				  sizeof(FRAME_ACTION_HDR),	  &Frame,
-				  END_OF_ARGS);
-
-	*(pOutBuffer + FrameLen) = pAd->CommonCfg.AddHTInfo.AddHtInfo.RecomWidth;
-	FrameLen++;
-
-
-	MiniportMMRequest(pAd, QID_AC_BE, pOutBuffer, FrameLen);
-	DBGPRINT(RT_DEBUG_TRACE,("ACT - SendNotifyBWAction(NotifyBW= %d)!\n", pAd->CommonCfg.AddHTInfo.AddHtInfo.RecomWidth));
-
-}
-#endif // DOT11N_DRAFT3 //
-
-
-VOID PeerHTAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-	UCHAR	Action = Elem->Msg[LENGTH_802_11+1];
-
-	if (Elem->Wcid >= MAX_LEN_OF_MAC_TABLE)
-		return;
-
-	switch(Action)
-	{
-		case NOTIFY_BW_ACTION:
-			DBGPRINT(RT_DEBUG_TRACE,("ACTION - HT Notify Channel bandwidth action----> \n"));
-#ifdef CONFIG_STA_SUPPORT
-			if(pAd->StaActive.SupportedPhyInfo.bHtEnable == FALSE)
-			{
-				// Note, this is to patch DIR-1353 AP. When the AP set to Wep, it will use legacy mode. But AP still keeps
-				// sending BW_Notify Action frame, and cause us to linkup and linkdown.
-				// In legacy mode, don't need to parse HT action frame.
-				DBGPRINT(RT_DEBUG_TRACE,("ACTION -Ignore HT Notify Channel BW when link as legacy mode. BW = %d---> \n",
-								Elem->Msg[LENGTH_802_11+2] ));
-				break;
-			}
-#endif // CONFIG_STA_SUPPORT //
-
-			if (Elem->Msg[LENGTH_802_11+2] == 0)	// 7.4.8.2. if value is 1, keep the same as supported channel bandwidth.
-				pAd->MacTab.Content[Elem->Wcid].HTPhyMode.field.BW = 0;
-
-			break;
-
-		case SMPS_ACTION:
-			// 7.3.1.25
-			DBGPRINT(RT_DEBUG_TRACE,("ACTION - SMPS action----> \n"));
-			if (((Elem->Msg[LENGTH_802_11+2]&0x1) == 0))
-			{
-				pAd->MacTab.Content[Elem->Wcid].MmpsMode = MMPS_ENABLE;
-			}
-			else if (((Elem->Msg[LENGTH_802_11+2]&0x2) == 0))
-			{
-				pAd->MacTab.Content[Elem->Wcid].MmpsMode = MMPS_STATIC;
-			}
-			else
-			{
-				pAd->MacTab.Content[Elem->Wcid].MmpsMode = MMPS_DYNAMIC;
-			}
-
-			DBGPRINT(RT_DEBUG_TRACE,("Aid(%d) MIMO PS = %d\n", Elem->Wcid, pAd->MacTab.Content[Elem->Wcid].MmpsMode));
-			// rt2860c : add something for smps change.
-			break;
-
-		case SETPCO_ACTION:
-			break;
-
-		case MIMO_CHA_MEASURE_ACTION:
-			break;
-
-		case HT_INFO_EXCHANGE:
-			{
-				HT_INFORMATION_OCTET	*pHT_info;
-
-				pHT_info = (HT_INFORMATION_OCTET *) &Elem->Msg[LENGTH_802_11+2];
-				// 7.4.8.10
-				DBGPRINT(RT_DEBUG_TRACE,("ACTION - HT Information Exchange action----> \n"));
-				if (pHT_info->Request)
-				{
-					respond_ht_information_exchange_action(pAd, Elem);
-				}
-			}
-		break;
-	}
-}
-
-
-/*
-	==========================================================================
-	Description:
-		Retry sending ADDBA Reqest.
-
-	IRQL = DISPATCH_LEVEL
-
-	Parametrs:
-	p8023Header: if this is already 802.3 format, p8023Header is NULL
-
-	Return	: TRUE if put into rx reordering buffer, shouldn't indicaterxhere.
-				FALSE , then continue indicaterx at this moment.
-	==========================================================================
- */
-VOID ORIBATimerTimeout(
-	IN	PRTMP_ADAPTER	pAd)
-{
-	MAC_TABLE_ENTRY	*pEntry;
-	INT			i, total;
-//	FRAME_BAR			FrameBar;
-//	ULONG			FrameLen;
-//	NDIS_STATUS	NStatus;
-//	PUCHAR			pOutBuffer = NULL;
-//	USHORT			Sequence;
-	UCHAR			TID;
-
-#ifdef RALINK_ATE
-	if (ATE_ON(pAd))
-		return;
-#endif // RALINK_ATE //
-
-	total = pAd->MacTab.Size * NUM_OF_TID;
-
-	for (i = 1; ((i <MAX_LEN_OF_BA_ORI_TABLE) && (total > 0)) ; i++)
-	{
-		if  (pAd->BATable.BAOriEntry[i].ORI_BA_Status == Originator_Done)
-		{
-			pEntry = &pAd->MacTab.Content[pAd->BATable.BAOriEntry[i].Wcid];
-			TID = pAd->BATable.BAOriEntry[i].TID;
-
-			ASSERT(pAd->BATable.BAOriEntry[i].Wcid < MAX_LEN_OF_MAC_TABLE);
-		}
-		total --;
-	}
-}
-
-
-VOID SendRefreshBAR(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	MAC_TABLE_ENTRY	*pEntry)
-{
-	FRAME_BAR		FrameBar;
-	ULONG			FrameLen;
-	NDIS_STATUS	NStatus;
-	PUCHAR			pOutBuffer = NULL;
-	USHORT			Sequence;
-	UCHAR			i, TID;
-	USHORT			idx;
-	BA_ORI_ENTRY	*pBAEntry;
-
-	for (i = 0; i <NUM_OF_TID; i++)
-	{
-		idx = pEntry->BAOriWcidArray[i];
-		if (idx == 0)
-		{
-			continue;
-		}
-		pBAEntry = &pAd->BATable.BAOriEntry[idx];
-
-		if  (pBAEntry->ORI_BA_Status == Originator_Done)
-		{
-			TID = pBAEntry->TID;
-
-			ASSERT(pBAEntry->Wcid < MAX_LEN_OF_MAC_TABLE);
-
-			NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);  //Get an unused nonpaged memory
-			if(NStatus != NDIS_STATUS_SUCCESS)
-			{
-				DBGPRINT(RT_DEBUG_ERROR,("BA - MlmeADDBAAction() allocate memory failed \n"));
-				return;
-			}
-
-			Sequence = pEntry->TxSeq[TID];
-
-
-#ifdef CONFIG_STA_SUPPORT
-			IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-				BarHeaderInit(pAd, &FrameBar, pEntry->Addr, pAd->CurrentAddress);
-#endif // CONFIG_STA_SUPPORT //
-
-			FrameBar.StartingSeq.field.FragNum = 0; // make sure sequence not clear in DEL function.
-			FrameBar.StartingSeq.field.StartSeq = Sequence; // make sure sequence not clear in DEL funciton.
-			FrameBar.BarControl.TID = TID; // make sure sequence not clear in DEL funciton.
-
-			MakeOutgoingFrame(pOutBuffer,				&FrameLen,
-							  sizeof(FRAME_BAR),	  &FrameBar,
-							  END_OF_ARGS);
-			//if (!(CLIENT_STATUS_TEST_FLAG(pEntry, fCLIENT_STATUS_RALINK_CHIPSET)))
-			if (1)	// Now we always send BAR.
-			{
-				//MiniportMMRequestUnlock(pAd, 0, pOutBuffer, FrameLen);
-				MiniportMMRequest(pAd, (MGMT_USE_QUEUE_FLAG | MapUserPriorityToAccessCategory[TID]), pOutBuffer, FrameLen);
-
-			}
-			MlmeFreeMemory(pAd, pOutBuffer);
-		}
-	}
-}
-#endif // DOT11_N_SUPPORT //
-
-VOID ActHeaderInit(
-    IN	PRTMP_ADAPTER	pAd,
-    IN OUT PHEADER_802_11 pHdr80211,
-    IN PUCHAR Addr1,
-    IN PUCHAR Addr2,
-    IN PUCHAR Addr3)
-{
-    NdisZeroMemory(pHdr80211, sizeof(HEADER_802_11));
-    pHdr80211->FC.Type = BTYPE_MGMT;
-    pHdr80211->FC.SubType = SUBTYPE_ACTION;
-
-    COPY_MAC_ADDR(pHdr80211->Addr1, Addr1);
-	COPY_MAC_ADDR(pHdr80211->Addr2, Addr2);
-    COPY_MAC_ADDR(pHdr80211->Addr3, Addr3);
-}
-
-VOID BarHeaderInit(
-	IN	PRTMP_ADAPTER	pAd,
-	IN OUT PFRAME_BAR pCntlBar,
-	IN PUCHAR pDA,
-	IN PUCHAR pSA)
-{
-//	USHORT	Duration;
-
-	NdisZeroMemory(pCntlBar, sizeof(FRAME_BAR));
-	pCntlBar->FC.Type = BTYPE_CNTL;
-	pCntlBar->FC.SubType = SUBTYPE_BLOCK_ACK_REQ;
-	pCntlBar->BarControl.MTID = 0;
-	pCntlBar->BarControl.Compressed = 1;
-	pCntlBar->BarControl.ACKPolicy = 0;
-
-
-	pCntlBar->Duration = 16 + RTMPCalcDuration(pAd, RATE_1, sizeof(FRAME_BA));
-
-	COPY_MAC_ADDR(pCntlBar->Addr1, pDA);
-	COPY_MAC_ADDR(pCntlBar->Addr2, pSA);
-}
-
-
-/*
-	==========================================================================
-	Description:
-		Insert Category and action code into the action frame.
-
-	Parametrs:
-		1. frame buffer pointer.
-		2. frame length.
-		3. category code of the frame.
-		4. action code of the frame.
-
-	Return	: None.
-	==========================================================================
- */
-VOID InsertActField(
-	IN PRTMP_ADAPTER pAd,
-	OUT PUCHAR pFrameBuf,
-	OUT PULONG pFrameLen,
-	IN UINT8 Category,
-	IN UINT8 ActCode)
-{
-	ULONG TempLen;
-
-	MakeOutgoingFrame(	pFrameBuf,		&TempLen,
-						1,				&Category,
-						1,				&ActCode,
-						END_OF_ARGS);
-
-	*pFrameLen = *pFrameLen + TempLen;
-
-	return;
-}
diff --git a/drivers/staging/rt3090/common/ba_action.c b/drivers/staging/rt3090/common/ba_action.c
deleted file mode 100644
index c73248980690..000000000000
--- a/drivers/staging/rt3090/common/ba_action.c
+++ /dev/null
@@ -1,1779 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
- */
-
-
-#ifdef DOT11_N_SUPPORT
-
-#include "../rt_config.h"
-
-
-#define BA_ORI_INIT_SEQ		(pEntry->TxSeq[TID]) //1			// inital sequence number of BA session
-
-#define ORI_SESSION_MAX_RETRY	8
-#define ORI_BA_SESSION_TIMEOUT	(2000)	// ms
-#define REC_BA_SESSION_IDLE_TIMEOUT	(1000)	// ms
-
-#define REORDERING_PACKET_TIMEOUT		((100 * OS_HZ)/1000)	// system ticks -- 100 ms
-#define MAX_REORDERING_PACKET_TIMEOUT	((3000 * OS_HZ)/1000)	// system ticks -- 100 ms
-
-#define RESET_RCV_SEQ		(0xFFFF)
-
-static void ba_mpdu_blk_free(PRTMP_ADAPTER pAd, struct reordering_mpdu *mpdu_blk);
-
-
-BA_ORI_ENTRY *BATableAllocOriEntry(
-								  IN  PRTMP_ADAPTER   pAd,
-								  OUT USHORT          *Idx);
-
-BA_REC_ENTRY *BATableAllocRecEntry(
-								  IN  PRTMP_ADAPTER   pAd,
-								  OUT USHORT          *Idx);
-
-VOID BAOriSessionSetupTimeout(
-    IN PVOID SystemSpecific1,
-    IN PVOID FunctionContext,
-    IN PVOID SystemSpecific2,
-    IN PVOID SystemSpecific3);
-
-VOID BARecSessionIdleTimeout(
-    IN PVOID SystemSpecific1,
-    IN PVOID FunctionContext,
-    IN PVOID SystemSpecific2,
-    IN PVOID SystemSpecific3);
-
-
-BUILD_TIMER_FUNCTION(BAOriSessionSetupTimeout);
-BUILD_TIMER_FUNCTION(BARecSessionIdleTimeout);
-
-#define ANNOUNCE_REORDERING_PACKET(_pAd, _mpdu_blk)	\
-			Announce_Reordering_Packet(_pAd, _mpdu_blk);
-
-VOID BA_MaxWinSizeReasign(
-	IN PRTMP_ADAPTER	pAd,
-	IN MAC_TABLE_ENTRY  *pEntryPeer,
-	OUT UCHAR			*pWinSize)
-{
-	UCHAR MaxSize;
-
-
-	if (pAd->MACVersion >= RALINK_2883_VERSION) // 3*3
-	{
-		if (pAd->MACVersion >= RALINK_3070_VERSION)
-		{
-			if (pEntryPeer->WepStatus != Ndis802_11EncryptionDisabled)
-				MaxSize = 7; // for non-open mode
-			else
-				MaxSize = 13;
-		}
-		else
-			MaxSize = 31;
-	}
-	else if (pAd->MACVersion >= RALINK_2880E_VERSION) // 2880 e
-	{
-		if (pEntryPeer->WepStatus != Ndis802_11EncryptionDisabled)
-			MaxSize = 7; // for non-open mode
-		else
-			MaxSize = 13;
-	}
-	else
-		MaxSize = 7;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("ba> Win Size = %d, Max Size = %d\n",
-			*pWinSize, MaxSize));
-
-	if ((*pWinSize) > MaxSize)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("ba> reassign max win size from %d to %d\n",
-				*pWinSize, MaxSize));
-
-		*pWinSize = MaxSize;
-	}
-}
-
-void Announce_Reordering_Packet(IN PRTMP_ADAPTER			pAd,
-								IN struct reordering_mpdu	*mpdu)
-{
-	PNDIS_PACKET    pPacket;
-
-	pPacket = mpdu->pPacket;
-
-	if (mpdu->bAMSDU)
-	{
-		ASSERT(0);
-		BA_Reorder_AMSDU_Annnounce(pAd, pPacket);
-	}
-	else
-	{
-		//
-		// pass this 802.3 packet to upper layer or forward this packet to WM directly
-		//
-
-#ifdef CONFIG_STA_SUPPORT
-		IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-			ANNOUNCE_OR_FORWARD_802_3_PACKET(pAd, pPacket, RTMP_GET_PACKET_IF(pPacket));
-#endif // CONFIG_STA_SUPPORT //
-	}
-}
-
-/*
- * Insert a reordering mpdu into sorted linked list by sequence no.
- */
-BOOLEAN ba_reordering_mpdu_insertsorted(struct reordering_list *list, struct reordering_mpdu *mpdu)
-{
-
-	struct reordering_mpdu **ppScan = &list->next;
-
-	while (*ppScan != NULL)
-	{
-		if (SEQ_SMALLER((*ppScan)->Sequence, mpdu->Sequence, MAXSEQ))
-		{
-			ppScan = &(*ppScan)->next;
-		}
-		else if ((*ppScan)->Sequence == mpdu->Sequence)
-		{
-			/* give up this duplicated frame */
-			return(FALSE);
-		}
-		else
-		{
-			/* find position */
-			break;
-		}
-	}
-
-	mpdu->next = *ppScan;
-	*ppScan = mpdu;
-	list->qlen++;
-	return TRUE;
-}
-
-
-/*
- * caller lock critical section if necessary
- */
-static inline void ba_enqueue(struct reordering_list *list, struct reordering_mpdu *mpdu_blk)
-{
-	list->qlen++;
-	mpdu_blk->next = list->next;
-	list->next = mpdu_blk;
-}
-
-/*
- * caller lock critical section if necessary
- */
-static inline struct reordering_mpdu * ba_dequeue(struct reordering_list *list)
-{
-	struct reordering_mpdu *mpdu_blk = NULL;
-
-	ASSERT(list);
-
-		if (list->qlen)
-		{
-			list->qlen--;
-			mpdu_blk = list->next;
-			if (mpdu_blk)
-			{
-				list->next = mpdu_blk->next;
-				mpdu_blk->next = NULL;
-			}
-		}
-	return mpdu_blk;
-}
-
-
-static inline struct reordering_mpdu  *ba_reordering_mpdu_dequeue(struct reordering_list *list)
-{
-	return(ba_dequeue(list));
-}
-
-
-static inline struct reordering_mpdu  *ba_reordering_mpdu_probe(struct reordering_list *list)
-	{
-	ASSERT(list);
-
-		return(list->next);
-	}
-
-
-/*
- * free all resource for reordering mechanism
- */
-void ba_reordering_resource_release(PRTMP_ADAPTER pAd)
-{
-	BA_TABLE        *Tab;
-	PBA_REC_ENTRY   pBAEntry;
-	struct reordering_mpdu *mpdu_blk;
-	int i;
-
-	Tab = &pAd->BATable;
-
-	/* I.  release all pending reordering packet */
-	NdisAcquireSpinLock(&pAd->BATabLock);
-	for (i = 0; i < MAX_LEN_OF_BA_REC_TABLE; i++)
-	{
-		pBAEntry = &Tab->BARecEntry[i];
-		if (pBAEntry->REC_BA_Status != Recipient_NONE)
-		{
-			while ((mpdu_blk = ba_reordering_mpdu_dequeue(&pBAEntry->list)))
-			{
-				ASSERT(mpdu_blk->pPacket);
-				RELEASE_NDIS_PACKET(pAd, mpdu_blk->pPacket, NDIS_STATUS_FAILURE);
-				ba_mpdu_blk_free(pAd, mpdu_blk);
-			}
-		}
-	}
-	NdisReleaseSpinLock(&pAd->BATabLock);
-
-	ASSERT(pBAEntry->list.qlen == 0);
-	/* II. free memory of reordering mpdu table */
-	NdisAcquireSpinLock(&pAd->mpdu_blk_pool.lock);
-	os_free_mem(pAd, pAd->mpdu_blk_pool.mem);
-	NdisReleaseSpinLock(&pAd->mpdu_blk_pool.lock);
-}
-
-
-
-/*
- * Allocate all resource for reordering mechanism
- */
-BOOLEAN ba_reordering_resource_init(PRTMP_ADAPTER pAd, int num)
-{
-	int     i;
-	PUCHAR  mem;
-	struct reordering_mpdu *mpdu_blk;
-	struct reordering_list *freelist;
-
-	/* allocate spinlock */
-	NdisAllocateSpinLock(&pAd->mpdu_blk_pool.lock);
-
-	/* initialize freelist */
-	freelist = &pAd->mpdu_blk_pool.freelist;
-	freelist->next = NULL;
-	freelist->qlen = 0;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Allocate %d memory for BA reordering\n", (UINT32)(num*sizeof(struct reordering_mpdu))));
-
-	/* allocate number of mpdu_blk memory */
-	os_alloc_mem(pAd, (PUCHAR *)&mem, (num*sizeof(struct reordering_mpdu)));
-
-	pAd->mpdu_blk_pool.mem = mem;
-
-	if (mem == NULL)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("Can't Allocate Memory for BA Reordering\n"));
-		return(FALSE);
-	}
-
-	/* build mpdu_blk free list */
-	for (i=0; i<num; i++)
-	{
-		/* get mpdu_blk */
-		mpdu_blk = (struct reordering_mpdu *) mem;
-		/* initial mpdu_blk */
-		NdisZeroMemory(mpdu_blk, sizeof(struct reordering_mpdu));
-		/* next mpdu_blk */
-		mem += sizeof(struct reordering_mpdu);
-		/* insert mpdu_blk into freelist */
-		ba_enqueue(freelist, mpdu_blk);
-	}
-
-	return(TRUE);
-}
-
-//static int blk_count=0; // sample take off, no use
-
-static struct reordering_mpdu *ba_mpdu_blk_alloc(PRTMP_ADAPTER pAd)
-{
-	struct reordering_mpdu *mpdu_blk;
-
-	NdisAcquireSpinLock(&pAd->mpdu_blk_pool.lock);
-	mpdu_blk = ba_dequeue(&pAd->mpdu_blk_pool.freelist);
-	if (mpdu_blk)
-	{
-//		blk_count++;
-		/* reset mpdu_blk */
-		NdisZeroMemory(mpdu_blk, sizeof(struct reordering_mpdu));
-	}
-	NdisReleaseSpinLock(&pAd->mpdu_blk_pool.lock);
-	return mpdu_blk;
-}
-
-static void ba_mpdu_blk_free(PRTMP_ADAPTER pAd, struct reordering_mpdu *mpdu_blk)
-{
-	ASSERT(mpdu_blk);
-
-	NdisAcquireSpinLock(&pAd->mpdu_blk_pool.lock);
-//	blk_count--;
-	ba_enqueue(&pAd->mpdu_blk_pool.freelist, mpdu_blk);
-	NdisReleaseSpinLock(&pAd->mpdu_blk_pool.lock);
-}
-
-
-static USHORT ba_indicate_reordering_mpdus_in_order(
-												   IN PRTMP_ADAPTER    pAd,
-												   IN PBA_REC_ENTRY    pBAEntry,
-												   IN USHORT           StartSeq)
-{
-	struct reordering_mpdu *mpdu_blk;
-	USHORT  LastIndSeq = RESET_RCV_SEQ;
-
-	NdisAcquireSpinLock(&pBAEntry->RxReRingLock);
-
-	while ((mpdu_blk = ba_reordering_mpdu_probe(&pBAEntry->list)))
-		{
-			/* find in-order frame */
-		if (!SEQ_STEPONE(mpdu_blk->Sequence, StartSeq, MAXSEQ))
-			{
-				break;
-			}
-			/* dequeue in-order frame from reodering list */
-			mpdu_blk = ba_reordering_mpdu_dequeue(&pBAEntry->list);
-			/* pass this frame up */
-		ANNOUNCE_REORDERING_PACKET(pAd, mpdu_blk);
-		/* move to next sequence */
-			StartSeq = mpdu_blk->Sequence;
-		LastIndSeq = StartSeq;
-		/* free mpdu_blk */
-			ba_mpdu_blk_free(pAd, mpdu_blk);
-	}
-
-	NdisReleaseSpinLock(&pBAEntry->RxReRingLock);
-
-	/* update last indicated sequence */
-	return LastIndSeq;
-}
-
-static void ba_indicate_reordering_mpdus_le_seq(
-											   IN PRTMP_ADAPTER    pAd,
-											   IN PBA_REC_ENTRY    pBAEntry,
-											   IN USHORT           Sequence)
-{
-	struct reordering_mpdu *mpdu_blk;
-
-	NdisAcquireSpinLock(&pBAEntry->RxReRingLock);
-	while ((mpdu_blk = ba_reordering_mpdu_probe(&pBAEntry->list)))
-		{
-			/* find in-order frame */
-		if ((mpdu_blk->Sequence == Sequence) || SEQ_SMALLER(mpdu_blk->Sequence, Sequence, MAXSEQ))
-		{
-			/* dequeue in-order frame from reodering list */
-			mpdu_blk = ba_reordering_mpdu_dequeue(&pBAEntry->list);
-			/* pass this frame up */
-			ANNOUNCE_REORDERING_PACKET(pAd, mpdu_blk);
-			/* free mpdu_blk */
-			ba_mpdu_blk_free(pAd, mpdu_blk);
-		}
-		else
-			{
-				break;
-			}
-	}
-	NdisReleaseSpinLock(&pBAEntry->RxReRingLock);
-}
-
-
-static void ba_refresh_reordering_mpdus(
-									   IN PRTMP_ADAPTER    pAd,
-									   PBA_REC_ENTRY       pBAEntry)
-{
-	struct reordering_mpdu *mpdu_blk;
-
-	NdisAcquireSpinLock(&pBAEntry->RxReRingLock);
-
-			/* dequeue in-order frame from reodering list */
-	while ((mpdu_blk = ba_reordering_mpdu_dequeue(&pBAEntry->list)))
-	{
-			/* pass this frame up */
-		ANNOUNCE_REORDERING_PACKET(pAd, mpdu_blk);
-
-		pBAEntry->LastIndSeq = mpdu_blk->Sequence;
-			ba_mpdu_blk_free(pAd, mpdu_blk);
-
-		/* update last indicated sequence */
-	}
-	ASSERT(pBAEntry->list.qlen == 0);
-	pBAEntry->LastIndSeq = RESET_RCV_SEQ;
-	NdisReleaseSpinLock(&pBAEntry->RxReRingLock);
-}
-
-
-//static
-void ba_flush_reordering_timeout_mpdus(
-									IN PRTMP_ADAPTER    pAd,
-									IN PBA_REC_ENTRY    pBAEntry,
-									IN ULONG            Now32)
-
-{
-	USHORT Sequence;
-
-//	if ((RTMP_TIME_AFTER((unsigned long)Now32, (unsigned long)(pBAEntry->LastIndSeqAtTimer+REORDERING_PACKET_TIMEOUT)) &&
-//		 (pBAEntry->list.qlen > ((pBAEntry->BAWinSize*7)/8))) //||
-//		(RTMP_TIME_AFTER((unsigned long)Now32, (unsigned long)(pBAEntry->LastIndSeqAtTimer+(10*REORDERING_PACKET_TIMEOUT))) &&
-//		 (pBAEntry->list.qlen > (pBAEntry->BAWinSize/8)))
-	if (RTMP_TIME_AFTER((unsigned long)Now32, (unsigned long)(pBAEntry->LastIndSeqAtTimer+(MAX_REORDERING_PACKET_TIMEOUT/6)))
-		 &&(pBAEntry->list.qlen > 1)
-		)
-	{
-		DBGPRINT(RT_DEBUG_TRACE,("timeout[%d] (%08lx-%08lx = %d > %d): %x, flush all!\n ", pBAEntry->list.qlen, Now32, (pBAEntry->LastIndSeqAtTimer),
-			   (int)((long) Now32 - (long)(pBAEntry->LastIndSeqAtTimer)), MAX_REORDERING_PACKET_TIMEOUT,
-			   pBAEntry->LastIndSeq));
-		ba_refresh_reordering_mpdus(pAd, pBAEntry);
-		pBAEntry->LastIndSeqAtTimer = Now32;
-	}
-	else
-	if (RTMP_TIME_AFTER((unsigned long)Now32, (unsigned long)(pBAEntry->LastIndSeqAtTimer+(REORDERING_PACKET_TIMEOUT)))
-		&& (pBAEntry->list.qlen > 0)
-	   )
-		{
-//		DBGPRINT(RT_DEBUG_OFF, ("timeout[%d] (%lx-%lx = %d > %d): %x, ", pBAEntry->list.qlen, Now32, (pBAEntry->LastIndSeqAtTimer),
-//			   (int)((long) Now32 - (long)(pBAEntry->LastIndSeqAtTimer)), REORDERING_PACKET_TIMEOUT,
-//			   pBAEntry->LastIndSeq));
-		//
-		// force LastIndSeq to shift to LastIndSeq+1
-		//
-		Sequence = (pBAEntry->LastIndSeq+1) & MAXSEQ;
-		ba_indicate_reordering_mpdus_le_seq(pAd, pBAEntry, Sequence);
-		pBAEntry->LastIndSeqAtTimer = Now32;
-			pBAEntry->LastIndSeq = Sequence;
-		//
-		// indicate in-order mpdus
-		//
-		Sequence = ba_indicate_reordering_mpdus_in_order(pAd, pBAEntry, Sequence);
-		if (Sequence != RESET_RCV_SEQ)
-		{
-			pBAEntry->LastIndSeq = Sequence;
-		}
-
-		DBGPRINT(RT_DEBUG_OFF, ("%x, flush one!\n", pBAEntry->LastIndSeq));
-
-	}
-}
-
-
-/*
- * generate ADDBA request to
- * set up BA agreement
- */
-VOID BAOriSessionSetUp(
-					  IN PRTMP_ADAPTER    pAd,
-					  IN MAC_TABLE_ENTRY  *pEntry,
-					  IN UCHAR            TID,
-					  IN USHORT           TimeOut,
-					  IN ULONG            DelayTime,
-					  IN BOOLEAN          isForced)
-
-{
-	//MLME_ADDBA_REQ_STRUCT	AddbaReq;
-	BA_ORI_ENTRY            *pBAEntry = NULL;
-	USHORT                  Idx;
-	BOOLEAN                 Cancelled;
-
-	if ((pAd->CommonCfg.BACapability.field.AutoBA != TRUE)  &&  (isForced == FALSE))
-		return;
-
-	// if this entry is limited to use legacy tx mode, it doesn't generate BA.
-	if (RTMPStaFixedTxMode(pAd, pEntry) != FIXED_TXMODE_HT)
-		return;
-
-	if ((pEntry->BADeclineBitmap & (1<<TID)) && (isForced == FALSE))
-	{
-		// try again after 3 secs
-		DelayTime = 3000;
-//		DBGPRINT(RT_DEBUG_TRACE, ("DeCline BA from Peer\n"));
-//		return;
-	}
-
-
-	Idx = pEntry->BAOriWcidArray[TID];
-	if (Idx == 0)
-	{
-		// allocate a BA session
-		pBAEntry = BATableAllocOriEntry(pAd, &Idx);
-		if (pBAEntry == NULL)
-		{
-			DBGPRINT(RT_DEBUG_TRACE,("ADDBA - MlmeADDBAAction() allocate BA session failed \n"));
-			return;
-		}
-	}
-	else
-	{
-		pBAEntry =&pAd->BATable.BAOriEntry[Idx];
-	}
-
-	if (pBAEntry->ORI_BA_Status >= Originator_WaitRes)
-	{
-		return;
-	}
-
-	pEntry->BAOriWcidArray[TID] = Idx;
-
-	// Initialize BA session
-	pBAEntry->ORI_BA_Status = Originator_WaitRes;
-	pBAEntry->Wcid = pEntry->Aid;
-	pBAEntry->BAWinSize = pAd->CommonCfg.BACapability.field.RxBAWinLimit;
-	pBAEntry->Sequence = BA_ORI_INIT_SEQ;
-	pBAEntry->Token = 1;	// (2008-01-21) Jan Lee recommends it - this token can't be 0
-	pBAEntry->TID = TID;
-	pBAEntry->TimeOutValue = TimeOut;
-	pBAEntry->pAdapter = pAd;
-
-	if (!(pEntry->TXBAbitmap & (1<<TID)))
-	{
-		RTMPInitTimer(pAd, &pBAEntry->ORIBATimer, GET_TIMER_FUNCTION(BAOriSessionSetupTimeout), pBAEntry, FALSE);
-	}
-	else
-		RTMPCancelTimer(&pBAEntry->ORIBATimer, &Cancelled);
-
-	// set timer to send ADDBA request
-	RTMPSetTimer(&pBAEntry->ORIBATimer, DelayTime);
-}
-
-VOID BAOriSessionAdd(
-			IN PRTMP_ADAPTER    pAd,
-					IN MAC_TABLE_ENTRY  *pEntry,
-			IN PFRAME_ADDBA_RSP pFrame)
-{
-	BA_ORI_ENTRY  *pBAEntry = NULL;
-	BOOLEAN       Cancelled;
-	UCHAR         TID;
-	USHORT        Idx;
-	PUCHAR          pOutBuffer2 = NULL;
-	NDIS_STATUS     NStatus;
-	ULONG           FrameLen;
-	FRAME_BAR       FrameBar;
-
-	TID = pFrame->BaParm.TID;
-	Idx = pEntry->BAOriWcidArray[TID];
-	pBAEntry =&pAd->BATable.BAOriEntry[Idx];
-
-	// Start fill in parameters.
-	if ((Idx !=0) && (pBAEntry->TID == TID) && (pBAEntry->ORI_BA_Status == Originator_WaitRes))
-	{
-		pBAEntry->BAWinSize = min(pBAEntry->BAWinSize, ((UCHAR)pFrame->BaParm.BufSize));
-		BA_MaxWinSizeReasign(pAd, pEntry, &pBAEntry->BAWinSize);
-
-		pBAEntry->TimeOutValue = pFrame->TimeOutValue;
-		pBAEntry->ORI_BA_Status = Originator_Done;
-		pAd->BATable.numDoneOriginator ++;
-
-		// reset sequence number
-		pBAEntry->Sequence = BA_ORI_INIT_SEQ;
-		// Set Bitmap flag.
-		pEntry->TXBAbitmap |= (1<<TID);
-				RTMPCancelTimer(&pBAEntry->ORIBATimer, &Cancelled);
-
-		pBAEntry->ORIBATimer.TimerValue = 0;	//pFrame->TimeOutValue;
-
-		DBGPRINT(RT_DEBUG_TRACE,("%s : TXBAbitmap = %x, BAWinSize = %d, TimeOut = %ld\n", __FUNCTION__, pEntry->TXBAbitmap,
-								 pBAEntry->BAWinSize, pBAEntry->ORIBATimer.TimerValue));
-
-		// SEND BAR ;
-		NStatus = MlmeAllocateMemory(pAd, &pOutBuffer2);  //Get an unused nonpaged memory
-		if (NStatus != NDIS_STATUS_SUCCESS)
-		{
-			DBGPRINT(RT_DEBUG_TRACE,("BA - BAOriSessionAdd() allocate memory failed \n"));
-			return;
-		}
-
-
-#ifdef CONFIG_STA_SUPPORT
-		IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-			BarHeaderInit(pAd, &FrameBar, pAd->MacTab.Content[pBAEntry->Wcid].Addr, pAd->CurrentAddress);
-#endif // CONFIG_STA_SUPPORT //
-
-		FrameBar.StartingSeq.field.FragNum = 0;	// make sure sequence not clear in DEL function.
-		FrameBar.StartingSeq.field.StartSeq = pBAEntry->Sequence; // make sure sequence not clear in DEL funciton.
-		FrameBar.BarControl.TID = pBAEntry->TID; // make sure sequence not clear in DEL funciton.
-		MakeOutgoingFrame(pOutBuffer2,              &FrameLen,
-						  sizeof(FRAME_BAR),      &FrameBar,
-					  END_OF_ARGS);
-		MiniportMMRequest(pAd, QID_AC_BE, pOutBuffer2, FrameLen);
-		MlmeFreeMemory(pAd, pOutBuffer2);
-
-
-		if (pBAEntry->ORIBATimer.TimerValue)
-			RTMPSetTimer(&pBAEntry->ORIBATimer, pBAEntry->ORIBATimer.TimerValue); // in mSec
-	}
-}
-
-BOOLEAN BARecSessionAdd(
-					   IN PRTMP_ADAPTER    pAd,
-					   IN MAC_TABLE_ENTRY  *pEntry,
-					   IN PFRAME_ADDBA_REQ pFrame)
-{
-	BA_REC_ENTRY            *pBAEntry = NULL;
-	BOOLEAN                 Status = TRUE;
-	BOOLEAN                 Cancelled;
-	USHORT                  Idx;
-	UCHAR                   TID;
-	UCHAR                   BAWinSize;
-	//UINT32                  Value;
-	//UINT                    offset;
-
-
-	ASSERT(pEntry);
-
-	// find TID
-	TID = pFrame->BaParm.TID;
-
-	BAWinSize = min(((UCHAR)pFrame->BaParm.BufSize), (UCHAR)pAd->CommonCfg.BACapability.field.RxBAWinLimit);
-
-	// Intel patch
-	if (BAWinSize == 0)
-	{
-		BAWinSize = 64;
-	}
-
-	Idx = pEntry->BARecWcidArray[TID];
-
-
-	if (Idx == 0)
-	{
-		pBAEntry = BATableAllocRecEntry(pAd, &Idx);
-	}
-	else
-	{
-		pBAEntry = &pAd->BATable.BARecEntry[Idx];
-		// flush all pending reordering mpdus
-		ba_refresh_reordering_mpdus(pAd, pBAEntry);
-	}
-
-	DBGPRINT(RT_DEBUG_TRACE,("%s(%ld): Idx = %d, BAWinSize(req %d) = %d\n", __FUNCTION__, pAd->BATable.numAsRecipient, Idx,
-							 pFrame->BaParm.BufSize, BAWinSize));
-
-	// Start fill in parameters.
-	if (pBAEntry != NULL)
-	{
-		ASSERT(pBAEntry->list.qlen == 0);
-
-		pBAEntry->REC_BA_Status = Recipient_HandleRes;
-		pBAEntry->BAWinSize = BAWinSize;
-		pBAEntry->Wcid = pEntry->Aid;
-		pBAEntry->TID = TID;
-		pBAEntry->TimeOutValue = pFrame->TimeOutValue;
-		pBAEntry->REC_BA_Status = Recipient_Accept;
-		// initial sequence number
-		pBAEntry->LastIndSeq = RESET_RCV_SEQ; //pFrame->BaStartSeq.field.StartSeq;
-
-		DBGPRINT(RT_DEBUG_OFF, ("Start Seq = %08x\n",  pFrame->BaStartSeq.field.StartSeq));
-
-		if (pEntry->RXBAbitmap & (1<<TID))
-		{
-			RTMPCancelTimer(&pBAEntry->RECBATimer, &Cancelled);
-		}
-		else
-		{
-			RTMPInitTimer(pAd, &pBAEntry->RECBATimer, GET_TIMER_FUNCTION(BARecSessionIdleTimeout), pBAEntry, TRUE);
-		}
-
-
-		// Set Bitmap flag.
-		pEntry->RXBAbitmap |= (1<<TID);
-		pEntry->BARecWcidArray[TID] = Idx;
-
-		pEntry->BADeclineBitmap &= ~(1<<TID);
-
-		// Set BA session mask in WCID table.
-		RTMP_ADD_BA_SESSION_TO_ASIC(pAd, pEntry->Aid, TID);
-
-		DBGPRINT(RT_DEBUG_TRACE,("MACEntry[%d]RXBAbitmap = 0x%x. BARecWcidArray=%d\n",
-				pEntry->Aid, pEntry->RXBAbitmap, pEntry->BARecWcidArray[TID]));
-	}
-	else
-	{
-		Status = FALSE;
-		DBGPRINT(RT_DEBUG_TRACE,("Can't Accept ADDBA for %02x:%02x:%02x:%02x:%02x:%02x TID = %d\n",
-				PRINT_MAC(pEntry->Addr), TID));
-	}
-	return(Status);
-}
-
-
-BA_REC_ENTRY *BATableAllocRecEntry(
-								  IN  PRTMP_ADAPTER   pAd,
-								  OUT USHORT          *Idx)
-{
-	int             i;
-	BA_REC_ENTRY    *pBAEntry = NULL;
-
-
-	NdisAcquireSpinLock(&pAd->BATabLock);
-
-	if (pAd->BATable.numAsRecipient >= MAX_BARECI_SESSION)
-	{
-		DBGPRINT(RT_DEBUG_OFF, ("BA Recipeint Session (%ld) > %d\n",
-							pAd->BATable.numAsRecipient, MAX_BARECI_SESSION));
-		goto done;
-	}
-
-	// reserve idx 0 to identify BAWcidArray[TID] as empty
-	for (i=1; i < MAX_LEN_OF_BA_REC_TABLE; i++)
-	{
-		pBAEntry =&pAd->BATable.BARecEntry[i];
-		if ((pBAEntry->REC_BA_Status == Recipient_NONE))
-		{
-			// get one
-			pAd->BATable.numAsRecipient++;
-			pBAEntry->REC_BA_Status = Recipient_USED;
-			*Idx = i;
-			break;
-		}
-	}
-
-done:
-	NdisReleaseSpinLock(&pAd->BATabLock);
-	return pBAEntry;
-}
-
-BA_ORI_ENTRY *BATableAllocOriEntry(
-								  IN  PRTMP_ADAPTER   pAd,
-								  OUT USHORT          *Idx)
-{
-	int             i;
-	BA_ORI_ENTRY    *pBAEntry = NULL;
-
-	NdisAcquireSpinLock(&pAd->BATabLock);
-
-	if (pAd->BATable.numAsOriginator >= (MAX_LEN_OF_BA_ORI_TABLE))
-	{
-		goto done;
-	}
-
-	// reserve idx 0 to identify BAWcidArray[TID] as empty
-	for (i=1; i<MAX_LEN_OF_BA_ORI_TABLE; i++)
-	{
-		pBAEntry =&pAd->BATable.BAOriEntry[i];
-		if ((pBAEntry->ORI_BA_Status == Originator_NONE))
-		{
-			// get one
-			pAd->BATable.numAsOriginator++;
-			pBAEntry->ORI_BA_Status = Originator_USED;
-			pBAEntry->pAdapter = pAd;
-			*Idx = i;
-			break;
-		}
-	}
-
-done:
-	NdisReleaseSpinLock(&pAd->BATabLock);
-	return pBAEntry;
-}
-
-
-VOID BATableFreeOriEntry(
-						IN  PRTMP_ADAPTER   pAd,
-						IN  ULONG           Idx)
-{
-	BA_ORI_ENTRY    *pBAEntry = NULL;
-	MAC_TABLE_ENTRY *pEntry;
-
-
-	if ((Idx == 0) || (Idx >= MAX_LEN_OF_BA_ORI_TABLE))
-		return;
-
-	pBAEntry =&pAd->BATable.BAOriEntry[Idx];
-
-	if (pBAEntry->ORI_BA_Status != Originator_NONE)
-	{
-		pEntry = &pAd->MacTab.Content[pBAEntry->Wcid];
-		pEntry->BAOriWcidArray[pBAEntry->TID] = 0;
-
-
-		NdisAcquireSpinLock(&pAd->BATabLock);
-		if (pBAEntry->ORI_BA_Status == Originator_Done)
-		{
-			pAd->BATable.numDoneOriginator -= 1;
-			pEntry->TXBAbitmap &= (~(1<<(pBAEntry->TID) ));
-			DBGPRINT(RT_DEBUG_TRACE, ("BATableFreeOriEntry numAsOriginator= %ld\n", pAd->BATable.numAsRecipient));
-			// Erase Bitmap flag.
-		}
-
-		ASSERT(pAd->BATable.numAsOriginator != 0);
-
-		pAd->BATable.numAsOriginator -= 1;
-
-		pBAEntry->ORI_BA_Status = Originator_NONE;
-		pBAEntry->Token = 0;
-		NdisReleaseSpinLock(&pAd->BATabLock);
-	}
-}
-
-
-VOID BATableFreeRecEntry(
-						IN  PRTMP_ADAPTER   pAd,
-						IN  ULONG           Idx)
-{
-	BA_REC_ENTRY    *pBAEntry = NULL;
-	MAC_TABLE_ENTRY *pEntry;
-
-
-	if ((Idx == 0) || (Idx >= MAX_LEN_OF_BA_REC_TABLE))
-		return;
-
-	pBAEntry =&pAd->BATable.BARecEntry[Idx];
-
-	if (pBAEntry->REC_BA_Status != Recipient_NONE)
-	{
-		pEntry = &pAd->MacTab.Content[pBAEntry->Wcid];
-		pEntry->BARecWcidArray[pBAEntry->TID] = 0;
-
-		NdisAcquireSpinLock(&pAd->BATabLock);
-
-		ASSERT(pAd->BATable.numAsRecipient != 0);
-
-		pAd->BATable.numAsRecipient -= 1;
-
-		pBAEntry->REC_BA_Status = Recipient_NONE;
-		NdisReleaseSpinLock(&pAd->BATabLock);
-	}
-}
-
-
-VOID BAOriSessionTearDown(
-						 IN OUT  PRTMP_ADAPTER   pAd,
-						 IN      UCHAR           Wcid,
-						 IN      UCHAR           TID,
-						 IN      BOOLEAN         bPassive,
-						 IN      BOOLEAN         bForceSend)
-{
-	ULONG           Idx = 0;
-	BA_ORI_ENTRY    *pBAEntry;
-	BOOLEAN         Cancelled;
-
-	if (Wcid >= MAX_LEN_OF_MAC_TABLE)
-	{
-		return;
-	}
-
-	//
-	// Locate corresponding BA Originator Entry in BA Table with the (pAddr,TID).
-	//
-	Idx = pAd->MacTab.Content[Wcid].BAOriWcidArray[TID];
-	if ((Idx == 0) || (Idx >= MAX_LEN_OF_BA_ORI_TABLE))
-	{
-		if (bForceSend == TRUE)
-		{
-			// force send specified TID DelBA
-			MLME_DELBA_REQ_STRUCT   DelbaReq;
-			MLME_QUEUE_ELEM *Elem = (MLME_QUEUE_ELEM *) kmalloc(sizeof(MLME_QUEUE_ELEM), MEM_ALLOC_FLAG);
-			if (Elem != NULL)
-			{
-				NdisZeroMemory(&DelbaReq, sizeof(DelbaReq));
-				NdisZeroMemory(Elem, sizeof(MLME_QUEUE_ELEM));
-
-				COPY_MAC_ADDR(DelbaReq.Addr, pAd->MacTab.Content[Wcid].Addr);
-				DelbaReq.Wcid = Wcid;
-				DelbaReq.TID = TID;
-				DelbaReq.Initiator = ORIGINATOR;
-				Elem->MsgLen  = sizeof(DelbaReq);
-				NdisMoveMemory(Elem->Msg, &DelbaReq, sizeof(DelbaReq));
-				MlmeDELBAAction(pAd, Elem);
-				kfree(Elem);
-			}
-			else
-			{
-				DBGPRINT(RT_DEBUG_ERROR, ("%s(bForceSend):alloc memory failed!\n", __FUNCTION__));
-			}
-		}
-
-		return;
-	}
-
-	DBGPRINT(RT_DEBUG_TRACE,("%s===>Wcid=%d.TID=%d \n", __FUNCTION__, Wcid, TID));
-
-	pBAEntry = &pAd->BATable.BAOriEntry[Idx];
-	DBGPRINT(RT_DEBUG_TRACE,("\t===>Idx = %ld, Wcid=%d.TID=%d, ORI_BA_Status = %d \n", Idx, Wcid, TID, pBAEntry->ORI_BA_Status));
-	//
-	// Prepare DelBA action frame and send to the peer.
-	//
-	if ((bPassive == FALSE) && (TID == pBAEntry->TID) && (pBAEntry->ORI_BA_Status == Originator_Done))
-	{
-		MLME_DELBA_REQ_STRUCT   DelbaReq;
-		MLME_QUEUE_ELEM *Elem = (MLME_QUEUE_ELEM *) kmalloc(sizeof(MLME_QUEUE_ELEM), MEM_ALLOC_FLAG);
-		if (Elem != NULL)
-		{
-			NdisZeroMemory(&DelbaReq, sizeof(DelbaReq));
-			NdisZeroMemory(Elem, sizeof(MLME_QUEUE_ELEM));
-
-			COPY_MAC_ADDR(DelbaReq.Addr, pAd->MacTab.Content[Wcid].Addr);
-			DelbaReq.Wcid = Wcid;
-			DelbaReq.TID = pBAEntry->TID;
-			DelbaReq.Initiator = ORIGINATOR;
-			Elem->MsgLen  = sizeof(DelbaReq);
-			NdisMoveMemory(Elem->Msg, &DelbaReq, sizeof(DelbaReq));
-			MlmeDELBAAction(pAd, Elem);
-			kfree(Elem);
-		}
-		else
-		{
-			DBGPRINT(RT_DEBUG_ERROR, ("%s():alloc memory failed!\n", __FUNCTION__));
-			return;
-		}
-	}
-	RTMPCancelTimer(&pBAEntry->ORIBATimer, &Cancelled);
-	BATableFreeOriEntry(pAd, Idx);
-
-	if (bPassive)
-	{
-		//BAOriSessionSetUp(pAd, &pAd->MacTab.Content[Wcid], TID, 0, 10000, TRUE);
-	}
-}
-
-VOID BARecSessionTearDown(
-						 IN OUT  PRTMP_ADAPTER   pAd,
-						 IN      UCHAR           Wcid,
-						 IN      UCHAR           TID,
-						 IN      BOOLEAN         bPassive)
-{
-	ULONG           Idx = 0;
-	BA_REC_ENTRY    *pBAEntry;
-
-	if (Wcid >= MAX_LEN_OF_MAC_TABLE)
-	{
-		return;
-	}
-
-	//
-	//  Locate corresponding BA Originator Entry in BA Table with the (pAddr,TID).
-	//
-	Idx = pAd->MacTab.Content[Wcid].BARecWcidArray[TID];
-	if (Idx == 0)
-		return;
-
-	DBGPRINT(RT_DEBUG_TRACE,("%s===>Wcid=%d.TID=%d \n", __FUNCTION__, Wcid, TID));
-
-
-	pBAEntry = &pAd->BATable.BARecEntry[Idx];
-	DBGPRINT(RT_DEBUG_TRACE,("\t===>Idx = %ld, Wcid=%d.TID=%d, REC_BA_Status = %d \n", Idx, Wcid, TID, pBAEntry->REC_BA_Status));
-	//
-	// Prepare DelBA action frame and send to the peer.
-	//
-	if ((TID == pBAEntry->TID) && (pBAEntry->REC_BA_Status == Recipient_Accept))
-	{
-		MLME_DELBA_REQ_STRUCT   DelbaReq;
-		BOOLEAN					Cancelled;
-		//ULONG   offset;
-		//UINT32  VALUE;
-
-		RTMPCancelTimer(&pBAEntry->RECBATimer, &Cancelled);
-
-		//
-		// 1. Send DELBA Action Frame
-		//
-		if (bPassive == FALSE)
-		{
-			MLME_QUEUE_ELEM *Elem = (MLME_QUEUE_ELEM *) kmalloc(sizeof(MLME_QUEUE_ELEM), MEM_ALLOC_FLAG);
-			if (Elem != NULL)
-			{
-				NdisZeroMemory(&DelbaReq, sizeof(DelbaReq));
-				NdisZeroMemory(Elem, sizeof(MLME_QUEUE_ELEM));
-
-				COPY_MAC_ADDR(DelbaReq.Addr, pAd->MacTab.Content[Wcid].Addr);
-				DelbaReq.Wcid = Wcid;
-				DelbaReq.TID = TID;
-				DelbaReq.Initiator = RECIPIENT;
-				Elem->MsgLen  = sizeof(DelbaReq);
-				NdisMoveMemory(Elem->Msg, &DelbaReq, sizeof(DelbaReq));
-				MlmeDELBAAction(pAd, Elem);
-				kfree(Elem);
-			}
-			else
-			{
-				DBGPRINT(RT_DEBUG_ERROR, ("%s():alloc memory failed!\n", __FUNCTION__));
-				return;
-			}
-		}
-
-
-		//
-		// 2. Free resource of BA session
-		//
-		// flush all pending reordering mpdus
-		ba_refresh_reordering_mpdus(pAd, pBAEntry);
-
-		NdisAcquireSpinLock(&pAd->BATabLock);
-
-		// Erase Bitmap flag.
-		pBAEntry->LastIndSeq = RESET_RCV_SEQ;
-		pBAEntry->BAWinSize = 0;
-		// Erase Bitmap flag at software mactable
-		pAd->MacTab.Content[Wcid].RXBAbitmap &= (~(1<<(pBAEntry->TID)));
-		pAd->MacTab.Content[Wcid].BARecWcidArray[TID] = 0;
-
-		RTMP_DEL_BA_SESSION_FROM_ASIC(pAd, Wcid, TID);
-
-		NdisReleaseSpinLock(&pAd->BATabLock);
-
-	}
-
-	BATableFreeRecEntry(pAd, Idx);
-}
-
-VOID BASessionTearDownALL(
-						 IN OUT  PRTMP_ADAPTER pAd,
-						 IN      UCHAR Wcid)
-{
-	int i;
-
-	for (i=0; i<NUM_OF_TID; i++)
-	{
-		BAOriSessionTearDown(pAd, Wcid, i, FALSE, FALSE);
-		BARecSessionTearDown(pAd, Wcid, i, FALSE);
-	}
-}
-
-
-/*
-	==========================================================================
-	Description:
-		Retry sending ADDBA Reqest.
-
-	IRQL = DISPATCH_LEVEL
-
-	Parametrs:
-	p8023Header: if this is already 802.3 format, p8023Header is NULL
-
-	Return	: TRUE if put into rx reordering buffer, shouldn't indicaterxhere.
-				FALSE , then continue indicaterx at this moment.
-	==========================================================================
- */
-VOID BAOriSessionSetupTimeout(
-    IN PVOID SystemSpecific1,
-    IN PVOID FunctionContext,
-    IN PVOID SystemSpecific2,
-    IN PVOID SystemSpecific3)
-{
-	BA_ORI_ENTRY    *pBAEntry = (BA_ORI_ENTRY *)FunctionContext;
-	MAC_TABLE_ENTRY *pEntry;
-	PRTMP_ADAPTER   pAd;
-
-	if (pBAEntry == NULL)
-		return;
-
-	pAd = pBAEntry->pAdapter;
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-		// Do nothing if monitor mode is on
-		if (MONITOR_ON(pAd))
-			return;
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-#ifdef RALINK_ATE
-	// Nothing to do in ATE mode.
-	if (ATE_ON(pAd))
-		return;
-#endif // RALINK_ATE //
-
-	pEntry = &pAd->MacTab.Content[pBAEntry->Wcid];
-
-	if ((pBAEntry->ORI_BA_Status == Originator_WaitRes) && (pBAEntry->Token < ORI_SESSION_MAX_RETRY))
-	{
-		MLME_ADDBA_REQ_STRUCT    AddbaReq;
-
-		NdisZeroMemory(&AddbaReq, sizeof(AddbaReq));
-		COPY_MAC_ADDR(AddbaReq.pAddr, pEntry->Addr);
-		AddbaReq.Wcid = (UCHAR)(pEntry->Aid);
-		AddbaReq.TID = pBAEntry->TID;
-		AddbaReq.BaBufSize = pAd->CommonCfg.BACapability.field.RxBAWinLimit;
-		AddbaReq.TimeOutValue = 0;
-		AddbaReq.Token = pBAEntry->Token;
-		MlmeEnqueue(pAd, ACTION_STATE_MACHINE, MT2_MLME_ADD_BA_CATE, sizeof(MLME_ADDBA_REQ_STRUCT), (PVOID)&AddbaReq);
-		RTMP_MLME_HANDLER(pAd);
-		DBGPRINT(RT_DEBUG_TRACE,("BA Ori Session Timeout(%d) : Send ADD BA again\n", pBAEntry->Token));
-
-		pBAEntry->Token++;
-		RTMPSetTimer(&pBAEntry->ORIBATimer, ORI_BA_SESSION_TIMEOUT);
-	}
-	else
-	{
-		BATableFreeOriEntry(pAd, pEntry->BAOriWcidArray[pBAEntry->TID]);
-	}
-}
-
-/*
-	==========================================================================
-	Description:
-		Retry sending ADDBA Reqest.
-
-	IRQL = DISPATCH_LEVEL
-
-	Parametrs:
-	p8023Header: if this is already 802.3 format, p8023Header is NULL
-
-	Return	: TRUE if put into rx reordering buffer, shouldn't indicaterxhere.
-				FALSE , then continue indicaterx at this moment.
-	==========================================================================
- */
-VOID BARecSessionIdleTimeout(
-    IN PVOID SystemSpecific1,
-    IN PVOID FunctionContext,
-    IN PVOID SystemSpecific2,
-    IN PVOID SystemSpecific3)
-{
-
-	BA_REC_ENTRY    *pBAEntry = (BA_REC_ENTRY *)FunctionContext;
-	PRTMP_ADAPTER   pAd;
-	ULONG           Now32;
-
-	if (pBAEntry == NULL)
-		return;
-
-	if ((pBAEntry->REC_BA_Status == Recipient_Accept))
-	{
-		NdisGetSystemUpTime(&Now32);
-
-		if (RTMP_TIME_AFTER((unsigned long)Now32, (unsigned long)(pBAEntry->LastIndSeqAtTimer + REC_BA_SESSION_IDLE_TIMEOUT)))
-		{
-			pAd = pBAEntry->pAdapter;
-			// flush all pending reordering mpdus
-			ba_refresh_reordering_mpdus(pAd, pBAEntry);
-			DBGPRINT(RT_DEBUG_OFF, ("%ld: REC BA session Timeout\n", Now32));
-		}
-	}
-}
-
-
-VOID PeerAddBAReqAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-
-{
-	//	7.4.4.1
-	//ULONG	Idx;
-	UCHAR   Status = 1;
-	UCHAR   pAddr[6];
-	FRAME_ADDBA_RSP ADDframe;
-	PUCHAR         pOutBuffer = NULL;
-	NDIS_STATUS     NStatus;
-	PFRAME_ADDBA_REQ  pAddreqFrame = NULL;
-	//UCHAR		BufSize;
-	ULONG       FrameLen;
-	PULONG      ptemp;
-	PMAC_TABLE_ENTRY	pMacEntry;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("%s ==> (Wcid = %d)\n", __FUNCTION__, Elem->Wcid));
-
-	//hex_dump("AddBAReq", Elem->Msg, Elem->MsgLen);
-
-	//ADDBA Request from unknown peer, ignore this.
-	if (Elem->Wcid >= MAX_LEN_OF_MAC_TABLE)
-		return;
-
-	pMacEntry = &pAd->MacTab.Content[Elem->Wcid];
-	DBGPRINT(RT_DEBUG_TRACE,("BA - PeerAddBAReqAction----> \n"));
-	ptemp = (PULONG)Elem->Msg;
-	//DBGPRINT_RAW(RT_DEBUG_EMU, ("%08x:: %08x:: %08x:: %08x:: %08x:: %08x:: %08x:: %08x:: %08x\n", *(ptemp), *(ptemp+1), *(ptemp+2), *(ptemp+3), *(ptemp+4), *(ptemp+5), *(ptemp+6), *(ptemp+7), *(ptemp+8)));
-
-	if (PeerAddBAReqActionSanity(pAd, Elem->Msg, Elem->MsgLen, pAddr))
-	{
-
-		if ((pAd->CommonCfg.bBADecline == FALSE) && IS_HT_STA(pMacEntry))
-		{
-			pAddreqFrame = (PFRAME_ADDBA_REQ)(&Elem->Msg[0]);
-			DBGPRINT(RT_DEBUG_OFF, ("Rcv Wcid(%d) AddBAReq\n", Elem->Wcid));
-			if (BARecSessionAdd(pAd, &pAd->MacTab.Content[Elem->Wcid], pAddreqFrame))
-				Status = 0;
-			else
-				Status = 38; // more parameters have invalid values
-		}
-		else
-		{
-			Status = 37; // the request has been declined.
-		}
-	}
-
-	if (pAd->MacTab.Content[Elem->Wcid].ValidAsCLI)
-		ASSERT(pAd->MacTab.Content[Elem->Wcid].Sst == SST_ASSOC);
-
-	pAddreqFrame = (PFRAME_ADDBA_REQ)(&Elem->Msg[0]);
-	// 2. Always send back ADDBA Response
-	NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);	 //Get an unused nonpaged memory
-	if (NStatus != NDIS_STATUS_SUCCESS)
-	{
-		DBGPRINT(RT_DEBUG_TRACE,("ACTION - PeerBAAction() allocate memory failed \n"));
-		return;
-	}
-
-	NdisZeroMemory(&ADDframe, sizeof(FRAME_ADDBA_RSP));
-	// 2-1. Prepare ADDBA Response frame.
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-		if (ADHOC_ON(pAd))
-			ActHeaderInit(pAd, &ADDframe.Hdr, pAddr, pAd->CurrentAddress, pAd->CommonCfg.Bssid);
-		else
-#ifdef QOS_DLS_SUPPORT
-		if (pAd->MacTab.Content[Elem->Wcid].ValidAsDls)
-			ActHeaderInit(pAd, &ADDframe.Hdr, pAddr, pAd->CurrentAddress, pAd->CommonCfg.Bssid);
-		else
-#endif // QOS_DLS_SUPPORT //
-		ActHeaderInit(pAd, &ADDframe.Hdr, pAd->CommonCfg.Bssid, pAd->CurrentAddress, pAddr);
-	}
-#endif // CONFIG_STA_SUPPORT //
-	ADDframe.Category = CATEGORY_BA;
-	ADDframe.Action = ADDBA_RESP;
-	ADDframe.Token = pAddreqFrame->Token;
-	// What is the Status code??  need to check.
-	ADDframe.StatusCode = Status;
-	ADDframe.BaParm.BAPolicy = IMMED_BA;
-	ADDframe.BaParm.AMSDUSupported = 0;
-	ADDframe.BaParm.TID = pAddreqFrame->BaParm.TID;
-	ADDframe.BaParm.BufSize = min(((UCHAR)pAddreqFrame->BaParm.BufSize), (UCHAR)pAd->CommonCfg.BACapability.field.RxBAWinLimit);
-	if (ADDframe.BaParm.BufSize == 0)
-	{
-		ADDframe.BaParm.BufSize = 64;
-	}
-	ADDframe.TimeOutValue = 0; //pAddreqFrame->TimeOutValue;
-
-	*(USHORT *)(&ADDframe.BaParm) = cpu2le16(*(USHORT *)(&ADDframe.BaParm));
-	ADDframe.StatusCode = cpu2le16(ADDframe.StatusCode);
-	ADDframe.TimeOutValue = cpu2le16(ADDframe.TimeOutValue);
-
-	MakeOutgoingFrame(pOutBuffer,               &FrameLen,
-					  sizeof(FRAME_ADDBA_RSP),  &ADDframe,
-			  END_OF_ARGS);
-	MiniportMMRequest(pAd, QID_AC_BE, pOutBuffer, FrameLen);
-	MlmeFreeMemory(pAd, pOutBuffer);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("%s(%d): TID(%d), BufSize(%d) <== \n", __FUNCTION__, Elem->Wcid, ADDframe.BaParm.TID,
-							  ADDframe.BaParm.BufSize));
-}
-
-
-VOID PeerAddBARspAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-
-{
-	//UCHAR		Idx, i;
-	//PUCHAR		   pOutBuffer = NULL;
-	PFRAME_ADDBA_RSP    pFrame = NULL;
-	//PBA_ORI_ENTRY		pBAEntry;
-
-	//ADDBA Response from unknown peer, ignore this.
-	if (Elem->Wcid >= MAX_LEN_OF_MAC_TABLE)
-		return;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("%s ==> Wcid(%d)\n", __FUNCTION__, Elem->Wcid));
-
-	//hex_dump("PeerAddBARspAction()", Elem->Msg, Elem->MsgLen);
-
-	if (PeerAddBARspActionSanity(pAd, Elem->Msg, Elem->MsgLen))
-	{
-		pFrame = (PFRAME_ADDBA_RSP)(&Elem->Msg[0]);
-
-		DBGPRINT(RT_DEBUG_TRACE, ("\t\t StatusCode = %d\n", pFrame->StatusCode));
-		switch (pFrame->StatusCode)
-		{
-			case 0:
-				// I want a BAsession with this peer as an originator.
-				BAOriSessionAdd(pAd, &pAd->MacTab.Content[Elem->Wcid], pFrame);
-				break;
-			default:
-				// check status == USED ???
-				BAOriSessionTearDown(pAd, Elem->Wcid, pFrame->BaParm.TID, TRUE, FALSE);
-				break;
-		}
-		// Rcv Decline StatusCode
-		if ((pFrame->StatusCode == 37)
-#ifdef CONFIG_STA_SUPPORT
-            || ((pAd->OpMode == OPMODE_STA) && STA_TGN_WIFI_ON(pAd) && (pFrame->StatusCode != 0))
-#endif // CONFIG_STA_SUPPORT //
-            )
-		{
-			pAd->MacTab.Content[Elem->Wcid].BADeclineBitmap |= 1<<pFrame->BaParm.TID;
-		}
-	}
-}
-
-VOID PeerDelBAAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-
-{
-	//UCHAR				Idx;
-	//PUCHAR				pOutBuffer = NULL;
-	PFRAME_DELBA_REQ    pDelFrame = NULL;
-
-	DBGPRINT(RT_DEBUG_TRACE,("%s ==>\n", __FUNCTION__));
-	//DELBA Request from unknown peer, ignore this.
-	if (PeerDelBAActionSanity(pAd, Elem->Wcid, Elem->Msg, Elem->MsgLen))
-	{
-		pDelFrame = (PFRAME_DELBA_REQ)(&Elem->Msg[0]);
-		if (pDelFrame->DelbaParm.Initiator == ORIGINATOR)
-		{
-			DBGPRINT(RT_DEBUG_TRACE,("BA - PeerDelBAAction----> ORIGINATOR\n"));
-			BARecSessionTearDown(pAd, Elem->Wcid, pDelFrame->DelbaParm.TID, TRUE);
-		}
-		else
-		{
-			DBGPRINT(RT_DEBUG_TRACE,("BA - PeerDelBAAction----> RECIPIENT, Reason = %d\n",  pDelFrame->ReasonCode));
-			//hex_dump("DelBA Frame", pDelFrame, Elem->MsgLen);
-			BAOriSessionTearDown(pAd, Elem->Wcid, pDelFrame->DelbaParm.TID, TRUE, FALSE);
-		}
-	}
-}
-
-
-BOOLEAN CntlEnqueueForRecv(
-						  IN PRTMP_ADAPTER		pAd,
-						  IN ULONG				Wcid,
-						  IN ULONG				MsgLen,
-						  IN PFRAME_BA_REQ		pMsg)
-{
-	PFRAME_BA_REQ   pFrame = pMsg;
-	//PRTMP_REORDERBUF	pBuffer;
-	//PRTMP_REORDERBUF	pDmaBuf;
-	PBA_REC_ENTRY pBAEntry;
-	//BOOLEAN	Result;
-	ULONG   Idx;
-	//UCHAR	NumRxPkt;
-	UCHAR	TID;//, i;
-
-	TID = (UCHAR)pFrame->BARControl.TID;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("%s(): BAR-Wcid(%ld), Tid (%d)\n", __FUNCTION__, Wcid, TID));
-	//hex_dump("BAR", (PCHAR) pFrame, MsgLen);
-	// Do nothing if the driver is starting halt state.
-	// This might happen when timer already been fired before cancel timer with mlmehalt
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
-		return FALSE;
-
-	// First check the size, it MUST not exceed the mlme queue size
-	if (MsgLen > MGMT_DMA_BUFFER_SIZE)
-	{
-		DBGPRINT_ERR(("CntlEnqueueForRecv: frame too large, size = %ld \n", MsgLen));
-		return FALSE;
-	}
-	else if (MsgLen != sizeof(FRAME_BA_REQ))
-	{
-		DBGPRINT_ERR(("CntlEnqueueForRecv: BlockAck Request frame length size = %ld incorrect\n", MsgLen));
-		return FALSE;
-	}
-	else if (MsgLen != sizeof(FRAME_BA_REQ))
-	{
-		DBGPRINT_ERR(("CntlEnqueueForRecv: BlockAck Request frame length size = %ld incorrect\n", MsgLen));
-		return FALSE;
-	}
-
-	if ((Wcid < MAX_LEN_OF_MAC_TABLE) && (TID < 8))
-		{
-		// if this receiving packet is from SA that is in our OriEntry. Since WCID <9 has direct mapping. no need search.
-		Idx = pAd->MacTab.Content[Wcid].BARecWcidArray[TID];
-		pBAEntry = &pAd->BATable.BARecEntry[Idx];
-		}
-		else
-		{
-		return FALSE;
-	}
-
-	DBGPRINT(RT_DEBUG_TRACE, ("BAR(%ld) : Tid (%d) - %04x:%04x\n", Wcid, TID, pFrame->BAStartingSeq.field.StartSeq, pBAEntry->LastIndSeq ));
-
-	if (SEQ_SMALLER(pBAEntry->LastIndSeq, pFrame->BAStartingSeq.field.StartSeq, MAXSEQ))
-	{
-		//DBGPRINT(RT_DEBUG_TRACE, ("BAR Seq = %x, LastIndSeq = %x\n", pFrame->BAStartingSeq.field.StartSeq, pBAEntry->LastIndSeq));
-		ba_indicate_reordering_mpdus_le_seq(pAd, pBAEntry, pFrame->BAStartingSeq.field.StartSeq);
-		pBAEntry->LastIndSeq = (pFrame->BAStartingSeq.field.StartSeq == 0) ? MAXSEQ :(pFrame->BAStartingSeq.field.StartSeq -1);
-	}
-	//ba_refresh_reordering_mpdus(pAd, pBAEntry);
-	return TRUE;
-}
-
-/*
-Description : Send PSMP Action frame If PSMP mode switches.
-*/
-VOID SendPSMPAction(
-				   IN PRTMP_ADAPTER		pAd,
-				   IN UCHAR				Wcid,
-				   IN UCHAR				Psmp)
-{
-	PUCHAR          pOutBuffer = NULL;
-	NDIS_STATUS     NStatus;
-	//ULONG           Idx;
-	FRAME_PSMP_ACTION   Frame;
-	ULONG           FrameLen;
-
-	NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);	 //Get an unused nonpaged memory
-	if (NStatus != NDIS_STATUS_SUCCESS)
-	{
-		DBGPRINT(RT_DEBUG_ERROR,("BA - MlmeADDBAAction() allocate memory failed \n"));
-		return;
-	}
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		ActHeaderInit(pAd, &Frame.Hdr, pAd->CommonCfg.Bssid, pAd->CurrentAddress, pAd->MacTab.Content[Wcid].Addr);
-#endif // CONFIG_STA_SUPPORT //
-
-	Frame.Category = CATEGORY_HT;
-	Frame.Action = SMPS_ACTION;
-	switch (Psmp)
-	{
-		case MMPS_ENABLE:
-#ifdef RT30xx
-			if (IS_RT30xx(pAd)
-				&&(pAd->Antenna.field.RxPath>1||pAd->Antenna.field.TxPath>1))
-			{
-				RTMP_ASIC_MMPS_DISABLE(pAd);
-			}
-#endif // RT30xx //
-			Frame.Psmp = 0;
-			break;
-		case MMPS_DYNAMIC:
-			Frame.Psmp = 3;
-			break;
-		case MMPS_STATIC:
-#ifdef RT30xx
-			if (IS_RT30xx(pAd)
-				&&(pAd->Antenna.field.RxPath>1||pAd->Antenna.field.TxPath>1))
-			{
-				RTMP_ASIC_MMPS_ENABLE(pAd);
-			}
-#endif // RT30xx //
-			Frame.Psmp = 1;
-			break;
-	}
-	MakeOutgoingFrame(pOutBuffer,               &FrameLen,
-					  sizeof(FRAME_PSMP_ACTION),      &Frame,
-					  END_OF_ARGS);
-	MiniportMMRequest(pAd, QID_AC_BE, pOutBuffer, FrameLen);
-	MlmeFreeMemory(pAd, pOutBuffer);
-	DBGPRINT(RT_DEBUG_ERROR,("HT - SendPSMPAction( %d )  \n", Frame.Psmp));
-}
-
-
-#define RADIO_MEASUREMENT_REQUEST_ACTION	0
-
-typedef struct PACKED
-{
-	UCHAR	RegulatoryClass;
-	UCHAR	ChannelNumber;
-	USHORT	RandomInterval;
-	USHORT	MeasurementDuration;
-	UCHAR	MeasurementMode;
-	UCHAR   BSSID[MAC_ADDR_LEN];
-	UCHAR	ReportingCondition;
-	UCHAR	Threshold;
-	UCHAR   SSIDIE[2];			// 2 byte
-} BEACON_REQUEST;
-
-typedef struct PACKED
-{
-	UCHAR	ID;
-	UCHAR	Length;
-	UCHAR	Token;
-	UCHAR	RequestMode;
-	UCHAR	Type;
-} MEASUREMENT_REQ;
-
-
-
-
-void convert_reordering_packet_to_preAMSDU_or_802_3_packet(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	RX_BLK			*pRxBlk,
-	IN  UCHAR			FromWhichBSSID)
-{
-	PNDIS_PACKET	pRxPkt;
-	UCHAR			Header802_3[LENGTH_802_3];
-
-	// 1. get 802.3 Header
-	// 2. remove LLC
-	//		a. pointer pRxBlk->pData to payload
-	//      b. modify pRxBlk->DataSize
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		RTMP_802_11_REMOVE_LLC_AND_CONVERT_TO_802_3(pRxBlk, Header802_3);
-#endif // CONFIG_STA_SUPPORT //
-
-	ASSERT(pRxBlk->pRxPacket);
-	pRxPkt = RTPKT_TO_OSPKT(pRxBlk->pRxPacket);
-
-	SET_OS_PKT_NETDEV(pRxPkt, get_netdev_from_bssid(pAd, FromWhichBSSID));
-	SET_OS_PKT_DATAPTR(pRxPkt, pRxBlk->pData);
-	SET_OS_PKT_LEN(pRxPkt, pRxBlk->DataSize);
-	SET_OS_PKT_DATATAIL(pRxPkt, pRxBlk->pData, pRxBlk->DataSize);
-
-	//
-	// copy 802.3 header, if necessary
-	//
-	if (!RX_BLK_TEST_FLAG(pRxBlk, fRX_AMSDU))
-	{
-
-#ifdef CONFIG_STA_SUPPORT
-		IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		{
-#ifdef LINUX
-			NdisMoveMemory(skb_push(pRxPkt, LENGTH_802_3), Header802_3, LENGTH_802_3);
-#endif
-		}
-#endif // CONFIG_STA_SUPPORT //
-	}
-}
-
-
-#define INDICATE_LEGACY_OR_AMSDU(_pAd, _pRxBlk, _fromWhichBSSID)		\
-	do																	\
-	{																	\
-	if (RX_BLK_TEST_FLAG(_pRxBlk, fRX_AMSDU))						\
-	{																\
-		Indicate_AMSDU_Packet(_pAd, _pRxBlk, _fromWhichBSSID);		\
-	}																\
-		else if (RX_BLK_TEST_FLAG(_pRxBlk, fRX_EAP))					\
-		{																\
-			Indicate_EAPOL_Packet(_pAd, _pRxBlk, _fromWhichBSSID);		\
-		}																\
-	else															\
-	{																\
-		Indicate_Legacy_Packet(_pAd, _pRxBlk, _fromWhichBSSID);		\
-	}																\
-	} while (0);
-
-
-
-static VOID ba_enqueue_reordering_packet(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PBA_REC_ENTRY	pBAEntry,
-	IN	RX_BLK			*pRxBlk,
-	IN	UCHAR			FromWhichBSSID)
-{
-	struct reordering_mpdu *mpdu_blk;
-	UINT16	Sequence = (UINT16) pRxBlk->pHeader->Sequence;
-
-	mpdu_blk = ba_mpdu_blk_alloc(pAd);
-	if ((mpdu_blk != NULL) &&
-		(!RX_BLK_TEST_FLAG(pRxBlk, fRX_EAP)))
-	{
-		// Write RxD buffer address & allocated buffer length
-		NdisAcquireSpinLock(&pBAEntry->RxReRingLock);
-
-		mpdu_blk->Sequence = Sequence;
-
-		mpdu_blk->bAMSDU = RX_BLK_TEST_FLAG(pRxBlk, fRX_AMSDU);
-
-		convert_reordering_packet_to_preAMSDU_or_802_3_packet(pAd, pRxBlk, FromWhichBSSID);
-
-		STATS_INC_RX_PACKETS(pAd, FromWhichBSSID);
-
-        //
-		// it is necessary for reordering packet to record
-		// which BSS it come from
-		//
-		RTMP_SET_PACKET_IF(pRxBlk->pRxPacket, FromWhichBSSID);
-
-		mpdu_blk->pPacket = pRxBlk->pRxPacket;
-
-		if (ba_reordering_mpdu_insertsorted(&pBAEntry->list, mpdu_blk) == FALSE)
-		{
-			// had been already within reordering list
-			// don't indicate
-			RELEASE_NDIS_PACKET(pAd, pRxBlk->pRxPacket, NDIS_STATUS_SUCCESS);
-			ba_mpdu_blk_free(pAd, mpdu_blk);
-		}
-
-		ASSERT((0<= pBAEntry->list.qlen)  && (pBAEntry->list.qlen <= pBAEntry->BAWinSize));
-		NdisReleaseSpinLock(&pBAEntry->RxReRingLock);
-	}
-	else
-	{
-		DBGPRINT(RT_DEBUG_ERROR,  ("!!! (%d) Can't allocate reordering mpdu blk\n",
-								   pBAEntry->list.qlen));
-		/*
-		 * flush all pending reordering mpdus
-		 * and receving mpdu to upper layer
-		 * make tcp/ip to take care reordering mechanism
-		 */
-		//ba_refresh_reordering_mpdus(pAd, pBAEntry);
-		ba_indicate_reordering_mpdus_le_seq(pAd, pBAEntry, Sequence);
-
-		pBAEntry->LastIndSeq = Sequence;
-		INDICATE_LEGACY_OR_AMSDU(pAd, pRxBlk, FromWhichBSSID);
-	}
-}
-
-
-/*
-	==========================================================================
-	Description:
-		Indicate this packet to upper layer or put it into reordering buffer
-
-	Parametrs:
-		pRxBlk         : carry necessary packet info 802.11 format
-		FromWhichBSSID : the packet received from which BSS
-
-	Return	:
-			  none
-
-	Note    :
-	          the packet queued into reordering buffer need to cover to 802.3 format
-			  or pre_AMSDU format
-	==========================================================================
- */
-
-VOID Indicate_AMPDU_Packet(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	RX_BLK			*pRxBlk,
-	IN	UCHAR			FromWhichBSSID)
-{
-	USHORT				Idx;
-	PBA_REC_ENTRY		pBAEntry = NULL;
-	UINT16				Sequence = pRxBlk->pHeader->Sequence;
-	ULONG				Now32;
-	UCHAR				Wcid = pRxBlk->pRxWI->WirelessCliID;
-	UCHAR				TID = pRxBlk->pRxWI->TID;
-
-
-	if (!RX_BLK_TEST_FLAG(pRxBlk, fRX_AMSDU) &&  (pRxBlk->DataSize > MAX_RX_PKT_LEN))
-	{
-		// release packet
-		RELEASE_NDIS_PACKET(pAd, pRxBlk->pRxPacket, NDIS_STATUS_FAILURE);
-		return;
-	}
-
-
-
-	if (Wcid < MAX_LEN_OF_MAC_TABLE)
-	{
-		Idx = pAd->MacTab.Content[Wcid].BARecWcidArray[TID];
-		if (Idx == 0)
-		{
-			/* Rec BA Session had been torn down */
-			INDICATE_LEGACY_OR_AMSDU(pAd, pRxBlk, FromWhichBSSID);
-			return;
-		}
-		pBAEntry = &pAd->BATable.BARecEntry[Idx];
-	}
-	else
-	{
-		// impossible !!!
-		ASSERT(0);
-		// release packet
-		RELEASE_NDIS_PACKET(pAd, pRxBlk->pRxPacket, NDIS_STATUS_FAILURE);
-		return;
-	}
-
-	ASSERT(pBAEntry);
-
-	// update last rx time
-	NdisGetSystemUpTime(&Now32);
-
-	pBAEntry->rcvSeq = Sequence;
-
-
-	ba_flush_reordering_timeout_mpdus(pAd, pBAEntry, Now32);
-	pBAEntry->LastIndSeqAtTimer = Now32;
-
-	//
-	// Reset Last Indicate Sequence
-	//
-	if (pBAEntry->LastIndSeq == RESET_RCV_SEQ)
-	{
-		ASSERT((pBAEntry->list.qlen == 0) && (pBAEntry->list.next == NULL));
-
-		// reset rcv sequence of BA session
-		pBAEntry->LastIndSeq = Sequence;
-		pBAEntry->LastIndSeqAtTimer = Now32;
-		INDICATE_LEGACY_OR_AMSDU(pAd, pRxBlk, FromWhichBSSID);
-		return;
-	}
-
-	//
-	// I. Check if in order.
-	//
-	if (SEQ_STEPONE(Sequence, pBAEntry->LastIndSeq, MAXSEQ))
-	{
-		USHORT  LastIndSeq;
-
-		pBAEntry->LastIndSeq = Sequence;
-		INDICATE_LEGACY_OR_AMSDU(pAd, pRxBlk, FromWhichBSSID);
-		LastIndSeq = ba_indicate_reordering_mpdus_in_order(pAd, pBAEntry, pBAEntry->LastIndSeq);
-		if (LastIndSeq != RESET_RCV_SEQ)
-		{
-			pBAEntry->LastIndSeq = LastIndSeq;
-		}
-		pBAEntry->LastIndSeqAtTimer = Now32;
-	}
-	//
-	// II. Drop Duplicated Packet
-	//
-	else if (Sequence == pBAEntry->LastIndSeq)
-	{
-
-		// drop and release packet
-		pBAEntry->nDropPacket++;
-		RELEASE_NDIS_PACKET(pAd, pRxBlk->pRxPacket, NDIS_STATUS_FAILURE);
-	}
-	//
-	// III. Drop Old Received Packet
-	//
-	else if (SEQ_SMALLER(Sequence, pBAEntry->LastIndSeq, MAXSEQ))
-	{
-
-		// drop and release packet
-		pBAEntry->nDropPacket++;
-		RELEASE_NDIS_PACKET(pAd, pRxBlk->pRxPacket, NDIS_STATUS_FAILURE);
-	}
-	//
-	// IV. Receive Sequence within Window Size
-	//
-	else if (SEQ_SMALLER(Sequence, (((pBAEntry->LastIndSeq+pBAEntry->BAWinSize+1)) & MAXSEQ), MAXSEQ))
-	{
-		ba_enqueue_reordering_packet(pAd, pBAEntry, pRxBlk, FromWhichBSSID);
-	}
-	//
-	// V. Receive seq surpasses Win(lastseq + nMSDU). So refresh all reorder buffer
-	//
-	else
-	{
-		LONG WinStartSeq, TmpSeq;
-
-
-		TmpSeq = Sequence - (pBAEntry->BAWinSize) -1;
-		if (TmpSeq < 0)
-		{
-			TmpSeq = (MAXSEQ+1) + TmpSeq;
-		}
-		WinStartSeq = (TmpSeq+1) & MAXSEQ;
-		ba_indicate_reordering_mpdus_le_seq(pAd, pBAEntry, WinStartSeq);
-		pBAEntry->LastIndSeq = WinStartSeq; //TmpSeq;
-
-		pBAEntry->LastIndSeqAtTimer = Now32;
-
-		ba_enqueue_reordering_packet(pAd, pBAEntry, pRxBlk, FromWhichBSSID);
-
-		TmpSeq = ba_indicate_reordering_mpdus_in_order(pAd, pBAEntry, pBAEntry->LastIndSeq);
-		if (TmpSeq != RESET_RCV_SEQ)
-		{
-			pBAEntry->LastIndSeq = TmpSeq;
-		}
-	}
-}
-
-#endif // DOT11_N_SUPPORT //
diff --git a/drivers/staging/rt3090/common/cmm_asic.c b/drivers/staging/rt3090/common/cmm_asic.c
deleted file mode 100644
index 3d1c808496f3..000000000000
--- a/drivers/staging/rt3090/common/cmm_asic.c
+++ /dev/null
@@ -1,2753 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-	Module Name:
-	cmm_asic.c
-
-	Abstract:
-	Functions used to communicate with ASIC
-
-	Revision History:
-	Who			When			What
-	--------	----------		----------------------------------------------
-*/
-
-#include "../rt_config.h"
-
-
-// Reset the RFIC setting to new series
-RTMP_RF_REGS RF2850RegTable[] = {
-//		ch	 R1		 R2		 R3(TX0~4=0) R4
-		{1,  0x98402ecc, 0x984c0786, 0x9816b455, 0x9800510b},
-		{2,  0x98402ecc, 0x984c0786, 0x98168a55, 0x9800519f},
-		{3,  0x98402ecc, 0x984c078a, 0x98168a55, 0x9800518b},
-		{4,  0x98402ecc, 0x984c078a, 0x98168a55, 0x9800519f},
-		{5,  0x98402ecc, 0x984c078e, 0x98168a55, 0x9800518b},
-		{6,  0x98402ecc, 0x984c078e, 0x98168a55, 0x9800519f},
-		{7,  0x98402ecc, 0x984c0792, 0x98168a55, 0x9800518b},
-		{8,  0x98402ecc, 0x984c0792, 0x98168a55, 0x9800519f},
-		{9,  0x98402ecc, 0x984c0796, 0x98168a55, 0x9800518b},
-		{10, 0x98402ecc, 0x984c0796, 0x98168a55, 0x9800519f},
-		{11, 0x98402ecc, 0x984c079a, 0x98168a55, 0x9800518b},
-		{12, 0x98402ecc, 0x984c079a, 0x98168a55, 0x9800519f},
-		{13, 0x98402ecc, 0x984c079e, 0x98168a55, 0x9800518b},
-		{14, 0x98402ecc, 0x984c07a2, 0x98168a55, 0x98005193},
-
-		// 802.11 UNI / HyperLan 2
-		{36, 0x98402ecc, 0x984c099a, 0x98158a55, 0x980ed1a3},
-		{38, 0x98402ecc, 0x984c099e, 0x98158a55, 0x980ed193},
-		{40, 0x98402ec8, 0x984c0682, 0x98158a55, 0x980ed183},
-		{44, 0x98402ec8, 0x984c0682, 0x98158a55, 0x980ed1a3},
-		{46, 0x98402ec8, 0x984c0686, 0x98158a55, 0x980ed18b},
-		{48, 0x98402ec8, 0x984c0686, 0x98158a55, 0x980ed19b},
-		{52, 0x98402ec8, 0x984c068a, 0x98158a55, 0x980ed193},
-		{54, 0x98402ec8, 0x984c068a, 0x98158a55, 0x980ed1a3},
-		{56, 0x98402ec8, 0x984c068e, 0x98158a55, 0x980ed18b},
-		{60, 0x98402ec8, 0x984c0692, 0x98158a55, 0x980ed183},
-		{62, 0x98402ec8, 0x984c0692, 0x98158a55, 0x980ed193},
-		{64, 0x98402ec8, 0x984c0692, 0x98158a55, 0x980ed1a3}, // Plugfest#4, Day4, change RFR3 left4th 9->5.
-
-		// 802.11 HyperLan 2
-		{100, 0x98402ec8, 0x984c06b2, 0x98178a55, 0x980ed783},
-
-		// 2008.04.30 modified
-		// The system team has AN to improve the EVM value
-		// for channel 102 to 108 for the RT2850/RT2750 dual band solution.
-		{102, 0x98402ec8, 0x985c06b2, 0x98578a55, 0x980ed793},
-		{104, 0x98402ec8, 0x985c06b2, 0x98578a55, 0x980ed1a3},
-		{108, 0x98402ecc, 0x985c0a32, 0x98578a55, 0x980ed193},
-
-		{110, 0x98402ecc, 0x984c0a36, 0x98178a55, 0x980ed183},
-		{112, 0x98402ecc, 0x984c0a36, 0x98178a55, 0x980ed19b},
-		{116, 0x98402ecc, 0x984c0a3a, 0x98178a55, 0x980ed1a3},
-		{118, 0x98402ecc, 0x984c0a3e, 0x98178a55, 0x980ed193},
-		{120, 0x98402ec4, 0x984c0382, 0x98178a55, 0x980ed183},
-		{124, 0x98402ec4, 0x984c0382, 0x98178a55, 0x980ed193},
-		{126, 0x98402ec4, 0x984c0382, 0x98178a55, 0x980ed15b}, // 0x980ed1bb->0x980ed15b required by Rory 20070927
-		{128, 0x98402ec4, 0x984c0382, 0x98178a55, 0x980ed1a3},
-		{132, 0x98402ec4, 0x984c0386, 0x98178a55, 0x980ed18b},
-		{134, 0x98402ec4, 0x984c0386, 0x98178a55, 0x980ed193},
-		{136, 0x98402ec4, 0x984c0386, 0x98178a55, 0x980ed19b},
-		{140, 0x98402ec4, 0x984c038a, 0x98178a55, 0x980ed183},
-
-		// 802.11 UNII
-		{149, 0x98402ec4, 0x984c038a, 0x98178a55, 0x980ed1a7},
-		{151, 0x98402ec4, 0x984c038e, 0x98178a55, 0x980ed187},
-		{153, 0x98402ec4, 0x984c038e, 0x98178a55, 0x980ed18f},
-		{157, 0x98402ec4, 0x984c038e, 0x98178a55, 0x980ed19f},
-		{159, 0x98402ec4, 0x984c038e, 0x98178a55, 0x980ed1a7},
-		{161, 0x98402ec4, 0x984c0392, 0x98178a55, 0x980ed187},
-		{165, 0x98402ec4, 0x984c0392, 0x98178a55, 0x980ed197},
-		{167, 0x98402ec4, 0x984c03d2, 0x98179855, 0x9815531f},
-		{169, 0x98402ec4, 0x984c03d2, 0x98179855, 0x98155327},
-		{171, 0x98402ec4, 0x984c03d6, 0x98179855, 0x98155307},
-		{173, 0x98402ec4, 0x984c03d6, 0x98179855, 0x9815530f},
-
-		// Japan
-		{184, 0x95002ccc, 0x9500491e, 0x9509be55, 0x950c0a0b},
-		{188, 0x95002ccc, 0x95004922, 0x9509be55, 0x950c0a13},
-		{192, 0x95002ccc, 0x95004926, 0x9509be55, 0x950c0a1b},
-		{196, 0x95002ccc, 0x9500492a, 0x9509be55, 0x950c0a23},
-		{208, 0x95002ccc, 0x9500493a, 0x9509be55, 0x950c0a13},
-		{212, 0x95002ccc, 0x9500493e, 0x9509be55, 0x950c0a1b},
-		{216, 0x95002ccc, 0x95004982, 0x9509be55, 0x950c0a23},
-
-		// still lack of MMAC(Japan) ch 34,38,42,46
-};
-UCHAR	NUM_OF_2850_CHNL = (sizeof(RF2850RegTable) / sizeof(RTMP_RF_REGS));
-
-FREQUENCY_ITEM FreqItems3020[] =
-{
-	/**************************************************/
-	// ISM : 2.4 to 2.483 GHz                         //
-	/**************************************************/
-	// 11g
-	/**************************************************/
-	//-CH---N-------R---K-----------
-	{1,    241,  2,  2},
-	{2,    241,	 2,  7},
-	{3,    242,	 2,  2},
-	{4,    242,	 2,  7},
-	{5,    243,	 2,  2},
-	{6,    243,	 2,  7},
-	{7,    244,	 2,  2},
-	{8,    244,	 2,  7},
-	{9,    245,	 2,  2},
-	{10,   245,	 2,  7},
-	{11,   246,	 2,  2},
-	{12,   246,	 2,  7},
-	{13,   247,	 2,  2},
-	{14,   248,	 2,  4},
-};
-UCHAR	NUM_OF_3020_CHNL = (sizeof(FreqItems3020) / sizeof(FREQUENCY_ITEM));
-
-
-VOID AsicUpdateAutoFallBackTable(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			pRateTable)
-{
-	UCHAR					i;
-	HT_FBK_CFG0_STRUC		HtCfg0;
-	HT_FBK_CFG1_STRUC		HtCfg1;
-	LG_FBK_CFG0_STRUC		LgCfg0;
-	LG_FBK_CFG1_STRUC		LgCfg1;
-	PRTMP_TX_RATE_SWITCH	pCurrTxRate, pNextTxRate;
-
-	// set to initial value
-	HtCfg0.word = 0x65432100;
-	HtCfg1.word = 0xedcba988;
-	LgCfg0.word = 0xedcba988;
-	LgCfg1.word = 0x00002100;
-
-	pNextTxRate = (PRTMP_TX_RATE_SWITCH)pRateTable+1;
-	for (i = 1; i < *((PUCHAR) pRateTable); i++)
-	{
-		pCurrTxRate = (PRTMP_TX_RATE_SWITCH)pRateTable+1+i;
-		switch (pCurrTxRate->Mode)
-		{
-			case 0:		//CCK
-				break;
-			case 1:		//OFDM
-				{
-					switch(pCurrTxRate->CurrMCS)
-					{
-						case 0:
-							LgCfg0.field.OFDMMCS0FBK = (pNextTxRate->Mode == MODE_OFDM) ? (pNextTxRate->CurrMCS+8): pNextTxRate->CurrMCS;
-							break;
-						case 1:
-							LgCfg0.field.OFDMMCS1FBK = (pNextTxRate->Mode == MODE_OFDM) ? (pNextTxRate->CurrMCS+8): pNextTxRate->CurrMCS;
-							break;
-						case 2:
-							LgCfg0.field.OFDMMCS2FBK = (pNextTxRate->Mode == MODE_OFDM) ? (pNextTxRate->CurrMCS+8): pNextTxRate->CurrMCS;
-							break;
-						case 3:
-							LgCfg0.field.OFDMMCS3FBK = (pNextTxRate->Mode == MODE_OFDM) ? (pNextTxRate->CurrMCS+8): pNextTxRate->CurrMCS;
-							break;
-						case 4:
-							LgCfg0.field.OFDMMCS4FBK = (pNextTxRate->Mode == MODE_OFDM) ? (pNextTxRate->CurrMCS+8): pNextTxRate->CurrMCS;
-							break;
-						case 5:
-							LgCfg0.field.OFDMMCS5FBK = (pNextTxRate->Mode == MODE_OFDM) ? (pNextTxRate->CurrMCS+8): pNextTxRate->CurrMCS;
-							break;
-						case 6:
-							LgCfg0.field.OFDMMCS6FBK = (pNextTxRate->Mode == MODE_OFDM) ? (pNextTxRate->CurrMCS+8): pNextTxRate->CurrMCS;
-							break;
-						case 7:
-							LgCfg0.field.OFDMMCS7FBK = (pNextTxRate->Mode == MODE_OFDM) ? (pNextTxRate->CurrMCS+8): pNextTxRate->CurrMCS;
-							break;
-					}
-				}
-				break;
-#ifdef DOT11_N_SUPPORT
-			case 2:		//HT-MIX
-			case 3:		//HT-GF
-				{
-					if ((pNextTxRate->Mode >= MODE_HTMIX) && (pCurrTxRate->CurrMCS != pNextTxRate->CurrMCS))
-					{
-						switch(pCurrTxRate->CurrMCS)
-						{
-							case 0:
-								HtCfg0.field.HTMCS0FBK = pNextTxRate->CurrMCS;
-								break;
-							case 1:
-								HtCfg0.field.HTMCS1FBK = pNextTxRate->CurrMCS;
-								break;
-							case 2:
-								HtCfg0.field.HTMCS2FBK = pNextTxRate->CurrMCS;
-								break;
-							case 3:
-								HtCfg0.field.HTMCS3FBK = pNextTxRate->CurrMCS;
-								break;
-							case 4:
-								HtCfg0.field.HTMCS4FBK = pNextTxRate->CurrMCS;
-								break;
-							case 5:
-								HtCfg0.field.HTMCS5FBK = pNextTxRate->CurrMCS;
-								break;
-							case 6:
-								HtCfg0.field.HTMCS6FBK = pNextTxRate->CurrMCS;
-								break;
-							case 7:
-								HtCfg0.field.HTMCS7FBK = pNextTxRate->CurrMCS;
-								break;
-							case 8:
-								HtCfg1.field.HTMCS8FBK = pNextTxRate->CurrMCS;
-								break;
-							case 9:
-								HtCfg1.field.HTMCS9FBK = pNextTxRate->CurrMCS;
-								break;
-							case 10:
-								HtCfg1.field.HTMCS10FBK = pNextTxRate->CurrMCS;
-								break;
-							case 11:
-								HtCfg1.field.HTMCS11FBK = pNextTxRate->CurrMCS;
-								break;
-							case 12:
-								HtCfg1.field.HTMCS12FBK = pNextTxRate->CurrMCS;
-								break;
-							case 13:
-								HtCfg1.field.HTMCS13FBK = pNextTxRate->CurrMCS;
-								break;
-							case 14:
-								HtCfg1.field.HTMCS14FBK = pNextTxRate->CurrMCS;
-								break;
-							case 15:
-								HtCfg1.field.HTMCS15FBK = pNextTxRate->CurrMCS;
-								break;
-							default:
-								DBGPRINT(RT_DEBUG_ERROR, ("AsicUpdateAutoFallBackTable: not support CurrMCS=%d\n", pCurrTxRate->CurrMCS));
-						}
-					}
-				}
-				break;
-#endif // DOT11_N_SUPPORT //
-		}
-
-		pNextTxRate = pCurrTxRate;
-	}
-
-	RTMP_IO_WRITE32(pAd, HT_FBK_CFG0, HtCfg0.word);
-	RTMP_IO_WRITE32(pAd, HT_FBK_CFG1, HtCfg1.word);
-	RTMP_IO_WRITE32(pAd, LG_FBK_CFG0, LgCfg0.word);
-	RTMP_IO_WRITE32(pAd, LG_FBK_CFG1, LgCfg1.word);
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-		Set MAC register value according operation mode.
-		OperationMode AND bNonGFExist are for MM and GF Proteciton.
-		If MM or GF mask is not set, those passing argument doesn't not take effect.
-
-		Operation mode meaning:
-		= 0 : Pure HT, no preotection.
-		= 0x01; there may be non-HT devices in both the control and extension channel, protection is optional in BSS.
-		= 0x10: No Transmission in 40M is protected.
-		= 0x11: Transmission in both 40M and 20M shall be protected
-		if (bNonGFExist)
-			we should choose not to use GF. But still set correct ASIC registers.
-	========================================================================
-*/
-VOID	AsicUpdateProtect(
-	IN		PRTMP_ADAPTER	pAd,
-	IN		USHORT			OperationMode,
-	IN		UCHAR			SetMask,
-	IN		BOOLEAN			bDisableBGProtect,
-	IN		BOOLEAN			bNonGFExist)
-{
-	PROT_CFG_STRUC	ProtCfg, ProtCfg4;
-	UINT32 Protect[6];
-	USHORT			offset;
-	UCHAR			i;
-	UINT32 MacReg = 0;
-
-#ifdef RALINK_ATE
-	if (ATE_ON(pAd))
-		return;
-#endif // RALINK_ATE //
-
-#ifdef DOT11_N_SUPPORT
-	if (!(pAd->CommonCfg.bHTProtect) && (OperationMode != 8))
-	{
-		return;
-	}
-
-	if (pAd->BATable.numDoneOriginator)
-	{
-		//
-		// enable the RTS/CTS to avoid channel collision
-		//
-		SetMask = ALLN_SETPROTECT;
-		OperationMode = 8;
-	}
-#endif // DOT11_N_SUPPORT //
-
-	// Config ASIC RTS threshold register
-	RTMP_IO_READ32(pAd, TX_RTS_CFG, &MacReg);
-	MacReg &= 0xFF0000FF;
-	// If the user want disable RtsThreshold and enbale Amsdu/Ralink-Aggregation, set the RtsThreshold as 4096
-        if ((
-#ifdef DOT11_N_SUPPORT
-			(pAd->CommonCfg.BACapability.field.AmsduEnable) ||
-#endif // DOT11_N_SUPPORT //
-			(pAd->CommonCfg.bAggregationCapable == TRUE))
-            && pAd->CommonCfg.RtsThreshold == MAX_RTS_THRESHOLD)
-        {
-			MacReg |= (0x1000 << 8);
-        }
-        else
-        {
-			MacReg |= (pAd->CommonCfg.RtsThreshold << 8);
-        }
-
-	RTMP_IO_WRITE32(pAd, TX_RTS_CFG, MacReg);
-
-	// Initial common protection settings
-	RTMPZeroMemory(Protect, sizeof(Protect));
-	ProtCfg4.word = 0;
-	ProtCfg.word = 0;
-	ProtCfg.field.TxopAllowGF40 = 1;
-	ProtCfg.field.TxopAllowGF20 = 1;
-	ProtCfg.field.TxopAllowMM40 = 1;
-	ProtCfg.field.TxopAllowMM20 = 1;
-	ProtCfg.field.TxopAllowOfdm = 1;
-	ProtCfg.field.TxopAllowCck = 1;
-	ProtCfg.field.RTSThEn = 1;
-	ProtCfg.field.ProtectNav = ASIC_SHORTNAV;
-
-	// update PHY mode and rate
-	if (pAd->CommonCfg.Channel > 14)
-		ProtCfg.field.ProtectRate = 0x4000;
-	ProtCfg.field.ProtectRate |= pAd->CommonCfg.RtsRate;
-
-	// Handle legacy(B/G) protection
-	if (bDisableBGProtect)
-	{
-		//ProtCfg.field.ProtectRate = pAd->CommonCfg.RtsRate;
-		ProtCfg.field.ProtectCtrl = 0;
-		Protect[0] = ProtCfg.word;
-		Protect[1] = ProtCfg.word;
-		pAd->FlgCtsEnabled = 0; /* CTS-self is not used */
-	}
-	else
-	{
-		//ProtCfg.field.ProtectRate = pAd->CommonCfg.RtsRate;
-		ProtCfg.field.ProtectCtrl = 0;			// CCK do not need to be protected
-		Protect[0] = ProtCfg.word;
-		ProtCfg.field.ProtectCtrl = ASIC_CTS;	// OFDM needs using CCK to protect
-		Protect[1] = ProtCfg.word;
-		pAd->FlgCtsEnabled = 1; /* CTS-self is used */
-	}
-
-#ifdef DOT11_N_SUPPORT
-	// Decide HT frame protection.
-	if ((SetMask & ALLN_SETPROTECT) != 0)
-	{
-		switch(OperationMode)
-		{
-			case 0x0:
-				// NO PROTECT
-				// 1.All STAs in the BSS are 20/40 MHz HT
-				// 2. in ai 20/40MHz BSS
-				// 3. all STAs are 20MHz in a 20MHz BSS
-				// Pure HT. no protection.
-
-				// MM20_PROT_CFG
-				//	Reserved (31:27)
-				//	PROT_TXOP(25:20) -- 010111
-				//	PROT_NAV(19:18)  -- 01 (Short NAV protection)
-				//  PROT_CTRL(17:16) -- 00 (None)
-				//	PROT_RATE(15:0)  -- 0x4004 (OFDM 24M)
-				Protect[2] = 0x01744004;
-
-				// MM40_PROT_CFG
-				//	Reserved (31:27)
-				//	PROT_TXOP(25:20) -- 111111
-				//	PROT_NAV(19:18)  -- 01 (Short NAV protection)
-				//  PROT_CTRL(17:16) -- 00 (None)
-				//	PROT_RATE(15:0)  -- 0x4084 (duplicate OFDM 24M)
-				Protect[3] = 0x03f44084;
-
-				// CF20_PROT_CFG
-				//	Reserved (31:27)
-				//	PROT_TXOP(25:20) -- 010111
-				//	PROT_NAV(19:18)  -- 01 (Short NAV protection)
-				//  PROT_CTRL(17:16) -- 00 (None)
-				//	PROT_RATE(15:0)  -- 0x4004 (OFDM 24M)
-				Protect[4] = 0x01744004;
-
-				// CF40_PROT_CFG
-				//	Reserved (31:27)
-				//	PROT_TXOP(25:20) -- 111111
-				//	PROT_NAV(19:18)  -- 01 (Short NAV protection)
-				//  PROT_CTRL(17:16) -- 00 (None)
-				//	PROT_RATE(15:0)  -- 0x4084 (duplicate OFDM 24M)
-				Protect[5] = 0x03f44084;
-
-				if (bNonGFExist)
-				{
-					// PROT_NAV(19:18)  -- 01 (Short NAV protectiion)
-					// PROT_CTRL(17:16) -- 01 (RTS/CTS)
-					Protect[4] = 0x01754004;
-					Protect[5] = 0x03f54084;
-				}
-				pAd->CommonCfg.IOTestParm.bRTSLongProtOn = FALSE;
-				break;
-
-			case 1:
-				// This is "HT non-member protection mode."
-				// If there may be non-HT STAs my BSS
-				ProtCfg.word = 0x01744004;	// PROT_CTRL(17:16) : 0 (None)
-				ProtCfg4.word = 0x03f44084; // duplicaet legacy 24M. BW set 1.
-				if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_BG_PROTECTION_INUSED))
-				{
-					ProtCfg.word = 0x01740003;	//ERP use Protection bit is set, use protection rate at Clause 18..
-					ProtCfg4.word = 0x03f40003; // Don't duplicate RTS/CTS in CCK mode. 0x03f40083;
-				}
-				//Assign Protection method for 20&40 MHz packets
-				ProtCfg.field.ProtectCtrl = ASIC_RTS;
-				ProtCfg.field.ProtectNav = ASIC_SHORTNAV;
-				ProtCfg4.field.ProtectCtrl = ASIC_RTS;
-				ProtCfg4.field.ProtectNav = ASIC_SHORTNAV;
-				Protect[2] = ProtCfg.word;
-				Protect[3] = ProtCfg4.word;
-				Protect[4] = ProtCfg.word;
-				Protect[5] = ProtCfg4.word;
-				pAd->CommonCfg.IOTestParm.bRTSLongProtOn = TRUE;
-				break;
-
-			case 2:
-				// If only HT STAs are in BSS. at least one is 20MHz. Only protect 40MHz packets
-				ProtCfg.word = 0x01744004;  // PROT_CTRL(17:16) : 0 (None)
-				ProtCfg4.word = 0x03f44084; // duplicaet legacy 24M. BW set 1.
-
-				//Assign Protection method for 40MHz packets
-				ProtCfg4.field.ProtectCtrl = ASIC_RTS;
-				ProtCfg4.field.ProtectNav = ASIC_SHORTNAV;
-				Protect[2] = ProtCfg.word;
-				Protect[3] = ProtCfg4.word;
-				if (bNonGFExist)
-				{
-					ProtCfg.field.ProtectCtrl = ASIC_RTS;
-					ProtCfg.field.ProtectNav = ASIC_SHORTNAV;
-				}
-				Protect[4] = ProtCfg.word;
-				Protect[5] = ProtCfg4.word;
-
-				pAd->CommonCfg.IOTestParm.bRTSLongProtOn = FALSE;
-				break;
-
-			case 3:
-				// HT mixed mode.	 PROTECT ALL!
-				// Assign Rate
-				ProtCfg.word = 0x01744004;	//duplicaet legacy 24M. BW set 1.
-				ProtCfg4.word = 0x03f44084;
-				// both 20MHz and 40MHz are protected. Whether use RTS or CTS-to-self depends on the
-				if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_BG_PROTECTION_INUSED))
-				{
-					ProtCfg.word = 0x01740003;	//ERP use Protection bit is set, use protection rate at Clause 18..
-					ProtCfg4.word = 0x03f40003; // Don't duplicate RTS/CTS in CCK mode. 0x03f40083
-				}
-				//Assign Protection method for 20&40 MHz packets
-				ProtCfg.field.ProtectCtrl = ASIC_RTS;
-				ProtCfg.field.ProtectNav = ASIC_SHORTNAV;
-				ProtCfg4.field.ProtectCtrl = ASIC_RTS;
-				ProtCfg4.field.ProtectNav = ASIC_SHORTNAV;
-				Protect[2] = ProtCfg.word;
-				Protect[3] = ProtCfg4.word;
-				Protect[4] = ProtCfg.word;
-				Protect[5] = ProtCfg4.word;
-				pAd->CommonCfg.IOTestParm.bRTSLongProtOn = TRUE;
-				break;
-
-			case 8:
-				// Special on for Atheros problem n chip.
-				Protect[2] = 0x01754004;
-				Protect[3] = 0x03f54084;
-				Protect[4] = 0x01754004;
-				Protect[5] = 0x03f54084;
-				pAd->CommonCfg.IOTestParm.bRTSLongProtOn = TRUE;
-				break;
-		}
-	}
-#endif // DOT11_N_SUPPORT //
-
-	offset = CCK_PROT_CFG;
-	for (i = 0;i < 6;i++)
-	{
-			if ((SetMask & (1<< i)))
-		{
-		RTMP_IO_WRITE32(pAd, offset + i*4, Protect[i]);
-	}
-}
-}
-
-
-/*
-	==========================================================================
-	Description:
-
-	IRQL = PASSIVE_LEVEL
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-VOID AsicSwitchChannel(
-					  IN PRTMP_ADAPTER pAd,
-	IN	UCHAR			Channel,
-	IN	BOOLEAN			bScan)
-{
-	ULONG			R2 = 0, R3 = DEFAULT_RF_TX_POWER, R4 = 0;
-	CHAR    TxPwer = 0, TxPwer2 = DEFAULT_RF_TX_POWER; //Bbp94 = BBPR94_DEFAULT, TxPwer2 = DEFAULT_RF_TX_POWER;
-	UCHAR	index;
-	UINT32	Value = 0; //BbpReg, Value;
-	RTMP_RF_REGS *RFRegTable;
-	UCHAR	RFValue;
-
-	RFValue = 0;
-	// Search Tx power value
-	// We can't use ChannelList to search channel, since some central channl's txpowr doesn't list
-	// in ChannelList, so use TxPower array instead.
-	//
-	for (index = 0; index < MAX_NUM_OF_CHANNELS; index++)
-	{
-		if (Channel == pAd->TxPower[index].Channel)
-		{
-			TxPwer = pAd->TxPower[index].Power;
-			TxPwer2 = pAd->TxPower[index].Power2;
-			break;
-		}
-	}
-
-	if (index == MAX_NUM_OF_CHANNELS)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("AsicSwitchChannel: Can't find the Channel#%d \n", Channel));
-	}
-
-#ifdef RT30xx
-	// The RF programming sequence is difference between 3xxx and 2xxx
-	if ((IS_RT3070(pAd) || IS_RT3090(pAd)||IS_RT3390(pAd)) && ((pAd->RfIcType == RFIC_3020) || (pAd->RfIcType == RFIC_2020) ||
-		(pAd->RfIcType == RFIC_3021) || (pAd->RfIcType == RFIC_3022)))
-	{
-		/* modify by WY for Read RF Reg. error */
-
-		for (index = 0; index < NUM_OF_3020_CHNL; index++)
-		{
-			if (Channel == FreqItems3020[index].Channel)
-			{
-				// Programming channel parameters
-				RT30xxWriteRFRegister(pAd, RF_R02, FreqItems3020[index].N);
-				RT30xxWriteRFRegister(pAd, RF_R03, FreqItems3020[index].K);
-				RT30xxReadRFRegister(pAd, RF_R06, &RFValue);
-				RFValue = (RFValue & 0xFC) | FreqItems3020[index].R;
-				RT30xxWriteRFRegister(pAd, RF_R06, RFValue);
-
-				// Set Tx0 Power
-				RT30xxReadRFRegister(pAd, RF_R12, &RFValue);
-				RFValue = (RFValue & 0xE0) | TxPwer;
-				RT30xxWriteRFRegister(pAd, RF_R12, RFValue);
-
-				// Set Tx1 Power
-				RT30xxReadRFRegister(pAd, RF_R13, &RFValue);
-				RFValue = (RFValue & 0xE0) | TxPwer2;
-				RT30xxWriteRFRegister(pAd, RF_R13, RFValue);
-
-				// Tx/Rx Stream setting
-				RT30xxReadRFRegister(pAd, RF_R01, &RFValue);
-				//if (IS_RT3090(pAd))
-				//	RFValue |= 0x01; // Enable RF block.
-				RFValue &= 0x03;	//clear bit[7~2]
-				if (pAd->Antenna.field.TxPath == 1)
-					RFValue |= 0xA0;
-				else if (pAd->Antenna.field.TxPath == 2)
-					RFValue |= 0x80;
-				if (pAd->Antenna.field.RxPath == 1)
-					RFValue |= 0x50;
-				else if (pAd->Antenna.field.RxPath == 2)
-					RFValue |= 0x40;
-				RT30xxWriteRFRegister(pAd, RF_R01, RFValue);
-
-				// Set RF offset
-				RT30xxReadRFRegister(pAd, RF_R23, &RFValue);
-				RFValue = (RFValue & 0x80) | pAd->RfFreqOffset;
-				RT30xxWriteRFRegister(pAd, RF_R23, RFValue);
-
-				// Set BW
-				if (!bScan && (pAd->CommonCfg.BBPCurrentBW == BW_40))
-				{
-					RFValue = pAd->Mlme.CaliBW40RfR24;
-					//DISABLE_11N_CHECK(pAd);
-				}
-				else
-				{
-					RFValue = pAd->Mlme.CaliBW20RfR24;
-				}
-				RT30xxWriteRFRegister(pAd, RF_R24, RFValue);
-				RT30xxWriteRFRegister(pAd, RF_R31, RFValue);
-
-				// Enable RF tuning
-				RT30xxReadRFRegister(pAd, RF_R07, &RFValue);
-				RFValue = RFValue | 0x1;
-				RT30xxWriteRFRegister(pAd, RF_R07, RFValue);
-
-				// latch channel for future usage.
-				pAd->LatchRfRegs.Channel = Channel;
-
-		DBGPRINT(RT_DEBUG_TRACE, ("SwitchChannel#%d(RF=%d, Pwr0=%d, Pwr1=%d, %dT), N=0x%02X, K=0x%02X, R=0x%02X\n",
-			Channel,
-			pAd->RfIcType,
-			TxPwer,
-			TxPwer2,
-			pAd->Antenna.field.TxPath,
-			FreqItems3020[index].N,
-			FreqItems3020[index].K,
-			FreqItems3020[index].R));
-
-				break;
-			}
-		}
-	}
-	else
-#endif // RT30xx //
-	{
-		RFRegTable = RF2850RegTable;
-		switch (pAd->RfIcType)
-		{
-			case RFIC_2820:
-			case RFIC_2850:
-			case RFIC_2720:
-			case RFIC_2750:
-
-				for (index = 0; index < NUM_OF_2850_CHNL; index++)
-				{
-					if (Channel == RFRegTable[index].Channel)
-					{
-						R2 = RFRegTable[index].R2;
-						if (pAd->Antenna.field.TxPath == 1)
-						{
-							R2 |= 0x4000;	// If TXpath is 1, bit 14 = 1;
-						}
-
-						if (pAd->Antenna.field.RxPath == 2)
-						{
-							R2 |= 0x40;	// write 1 to off Rxpath.
-						}
-						else if (pAd->Antenna.field.RxPath == 1)
-						{
-							R2 |= 0x20040;	// write 1 to off RxPath
-						}
-
-						if (Channel > 14)
-						{
-							// initialize R3, R4
-							R3 = (RFRegTable[index].R3 & 0xffffc1ff);
-							R4 = (RFRegTable[index].R4 & (~0x001f87c0)) | (pAd->RfFreqOffset << 15);
-
-							// 5G band power range: 0xF9~0X0F, TX0 Reg3 bit9/TX1 Reg4 bit6="0" means the TX power reduce 7dB
-							// R3
-							if ((TxPwer >= -7) && (TxPwer < 0))
-							{
-								TxPwer = (7+TxPwer);
-								TxPwer = (TxPwer > 0xF) ? (0xF) : (TxPwer);
-								R3 |= (TxPwer << 10);
-								DBGPRINT(RT_DEBUG_ERROR, ("AsicSwitchChannel: TxPwer=%d \n", TxPwer));
-							}
-							else
-							{
-								TxPwer = (TxPwer > 0xF) ? (0xF) : (TxPwer);
-								R3 |= (TxPwer << 10) | (1 << 9);
-							}
-
-							// R4
-							if ((TxPwer2 >= -7) && (TxPwer2 < 0))
-							{
-								TxPwer2 = (7+TxPwer2);
-								TxPwer2 = (TxPwer2 > 0xF) ? (0xF) : (TxPwer2);
-								R4 |= (TxPwer2 << 7);
-								DBGPRINT(RT_DEBUG_ERROR, ("AsicSwitchChannel: TxPwer2=%d \n", TxPwer2));
-							}
-							else
-							{
-								TxPwer2 = (TxPwer2 > 0xF) ? (0xF) : (TxPwer2);
-								R4 |= (TxPwer2 << 7) | (1 << 6);
-							}
-						}
-						else
-						{
-							R3 = (RFRegTable[index].R3 & 0xffffc1ff) | (TxPwer << 9); // set TX power0
-						R4 = (RFRegTable[index].R4 & (~0x001f87c0)) | (pAd->RfFreqOffset << 15) | (TxPwer2 <<6);// Set freq Offset & TxPwr1
-						}
-
-						// Based on BBP current mode before changing RF channel.
-						if (!bScan && (pAd->CommonCfg.BBPCurrentBW == BW_40))
-						{
-							R4 |=0x200000;
-						}
-
-						// Update variables
-						pAd->LatchRfRegs.Channel = Channel;
-						pAd->LatchRfRegs.R1 = RFRegTable[index].R1;
-						pAd->LatchRfRegs.R2 = R2;
-						pAd->LatchRfRegs.R3 = R3;
-						pAd->LatchRfRegs.R4 = R4;
-
-#ifdef DFS_DEBUG
-#ifdef DFS_FCC_BW40_FIX
-						if (pAd->infType == RTMP_DEV_INF_PCI) // RT2880 PCI
-						{
-							/* only for RT2880 */
-							// FCC DFS test
-							pAd->LatchRfRegs.R1 |= 0x100;
-							pAd->LatchRfRegs.R4 |= 0x00400000;
-						}
-#endif // DFS_FCC_BW40_FIX //
-#endif // DFS_DEBUG //
-
-						// Set RF value 1's set R3[bit2] = [0]
-						RTMP_RF_IO_WRITE32(pAd, pAd->LatchRfRegs.R1);
-						RTMP_RF_IO_WRITE32(pAd, pAd->LatchRfRegs.R2);
-						RTMP_RF_IO_WRITE32(pAd, (pAd->LatchRfRegs.R3 & (~0x04)));
-						RTMP_RF_IO_WRITE32(pAd, pAd->LatchRfRegs.R4);
-
-						RTMPusecDelay(200);
-
-						// Set RF value 2's set R3[bit2] = [1]
-						RTMP_RF_IO_WRITE32(pAd, pAd->LatchRfRegs.R1);
-						RTMP_RF_IO_WRITE32(pAd, pAd->LatchRfRegs.R2);
-						RTMP_RF_IO_WRITE32(pAd, (pAd->LatchRfRegs.R3 | 0x04));
-						RTMP_RF_IO_WRITE32(pAd, pAd->LatchRfRegs.R4);
-
-						RTMPusecDelay(200);
-
-						// Set RF value 3's set R3[bit2] = [0]
-						RTMP_RF_IO_WRITE32(pAd, pAd->LatchRfRegs.R1);
-						RTMP_RF_IO_WRITE32(pAd, pAd->LatchRfRegs.R2);
-						RTMP_RF_IO_WRITE32(pAd, (pAd->LatchRfRegs.R3 & (~0x04)));
-						RTMP_RF_IO_WRITE32(pAd, pAd->LatchRfRegs.R4);
-
-						break;
-					}
-				}
-				break;
-
-			default:
-				break;
-		}
-
-		DBGPRINT(RT_DEBUG_TRACE, ("SwitchChannel#%d(RF=%d, Pwr0=%lu, Pwr1=%lu, %dT) to , R1=0x%08lx, R2=0x%08lx, R3=0x%08lx, R4=0x%08lx\n",
-							  Channel,
-							  pAd->RfIcType,
-							  (R3 & 0x00003e00) >> 9,
-							  (R4 & 0x000007c0) >> 6,
-							  pAd->Antenna.field.TxPath,
-							  pAd->LatchRfRegs.R1,
-							  pAd->LatchRfRegs.R2,
-							  pAd->LatchRfRegs.R3,
-							  pAd->LatchRfRegs.R4));
-	}
-
-	// Change BBP setting during siwtch from a->g, g->a
-	if (Channel <= 14)
-	{
-		ULONG	TxPinCfg = 0x00050F0A;//Gary 2007/08/09 0x050A0A
-
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R62, (0x37 - GET_LNA_GAIN(pAd)));
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R63, (0x37 - GET_LNA_GAIN(pAd)));
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R64, (0x37 - GET_LNA_GAIN(pAd)));
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R86, 0);//(0x44 - GET_LNA_GAIN(pAd)));	// According the Rory's suggestion to solve the middle range issue.
-		//RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R82, 0x62);
-
-		// Rx High power VGA offset for LNA select
-		if (pAd->NicConfig2.field.ExternalLNAForG)
-		{
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R82, 0x62);
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R75, 0x46);
-		}
-		else
-		{
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R82, 0x84);
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R75, 0x50);
-		}
-
-		// 5G band selection PIN, bit1 and bit2 are complement
-		RTMP_IO_READ32(pAd, TX_BAND_CFG, &Value);
-		Value &= (~0x6);
-		Value |= (0x04);
-		RTMP_IO_WRITE32(pAd, TX_BAND_CFG, Value);
-
-		// Turn off unused PA or LNA when only 1T or 1R
-		if (pAd->Antenna.field.TxPath == 1)
-		{
-			TxPinCfg &= 0xFFFFFFF3;
-		}
-		if (pAd->Antenna.field.RxPath == 1)
-		{
-			TxPinCfg &= 0xFFFFF3FF;
-		}
-
-
-		RTMP_IO_WRITE32(pAd, TX_PIN_CFG, TxPinCfg);
-
-#if defined(RT3090) || defined(RT3390)
-		// PCIe PHY Transmit attenuation adjustment
-		if (IS_RT3090A(pAd) || IS_RT3390(pAd))
-		{
-			TX_ATTENUATION_CTRL_STRUC TxAttenuationCtrl = {0};
-
-			RTMP_IO_READ32(pAd, PCIE_PHY_TX_ATTENUATION_CTRL, &TxAttenuationCtrl.word);
-
-			if (Channel == 14) // Channel #14
-			{
-				TxAttenuationCtrl.field.PCIE_PHY_TX_ATTEN_EN = 1; // Enable PCIe PHY Tx attenuation
-				TxAttenuationCtrl.field.PCIE_PHY_TX_ATTEN_VALUE = 4; // 9/16 full drive level
-			}
-			else // Channel #1~#13
-			{
-				TxAttenuationCtrl.field.PCIE_PHY_TX_ATTEN_EN = 0; // Disable PCIe PHY Tx attenuation
-				TxAttenuationCtrl.field.PCIE_PHY_TX_ATTEN_VALUE = 0; // n/a
-			}
-
-			RTMP_IO_WRITE32(pAd, PCIE_PHY_TX_ATTENUATION_CTRL, TxAttenuationCtrl.word);
-		}
-#endif
-	}
-	else
-	{
-		ULONG	TxPinCfg = 0x00050F05;//Gary 2007/8/9 0x050505
-
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R62, (0x37 - GET_LNA_GAIN(pAd)));
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R63, (0x37 - GET_LNA_GAIN(pAd)));
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R64, (0x37 - GET_LNA_GAIN(pAd)));
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R86, 0);//(0x44 - GET_LNA_GAIN(pAd)));   // According the Rory's suggestion to solve the middle range issue.
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R82, 0xF2);
-
-		// Rx High power VGA offset for LNA select
-		if (pAd->NicConfig2.field.ExternalLNAForA)
-		{
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R75, 0x46);
-		}
-		else
-		{
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R75, 0x50);
-		}
-
-		// 5G band selection PIN, bit1 and bit2 are complement
-		RTMP_IO_READ32(pAd, TX_BAND_CFG, &Value);
-		Value &= (~0x6);
-		Value |= (0x02);
-		RTMP_IO_WRITE32(pAd, TX_BAND_CFG, Value);
-
-		// Turn off unused PA or LNA when only 1T or 1R
-		if (pAd->Antenna.field.TxPath == 1)
-		{
-			TxPinCfg &= 0xFFFFFFF3;
-		}
-		if (pAd->Antenna.field.RxPath == 1)
-		{
-			TxPinCfg &= 0xFFFFF3FF;
-		}
-
-
-		RTMP_IO_WRITE32(pAd, TX_PIN_CFG, TxPinCfg);
-
-	}
-
-	// R66 should be set according to Channel and use 20MHz when scanning
-	//RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R66, (0x2E + GET_LNA_GAIN(pAd)));
-	if (bScan)
-		RTMPSetAGCInitValue(pAd, BW_20);
-	else
-		RTMPSetAGCInitValue(pAd, pAd->CommonCfg.BBPCurrentBW);
-
-	//
-	// On 11A, We should delay and wait RF/BBP to be stable
-	// and the appropriate time should be 1000 micro seconds
-	// 2005/06/05 - On 11G, We also need this delay time. Otherwise it's difficult to pass the WHQL.
-	//
-	RTMPusecDelay(1000);
-}
-
-/*
-	==========================================================================
-	Description:
-		This function is required for 2421 only, and should not be used during
-		site survey. It's only required after NIC decided to stay at a channel
-		for a longer period.
-		When this function is called, it's always after AsicSwitchChannel().
-
-	IRQL = PASSIVE_LEVEL
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-VOID AsicLockChannel(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR Channel)
-{
-}
-
-/*
-	==========================================================================
-	Description:
-
-	IRQL = PASSIVE_LEVEL
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-#ifdef ANT_DIVERSITY_SUPPORT
-VOID	AsicAntennaSelect(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			Channel)
-{
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	if (pAd->Mlme.OneSecPeriodicRound % 2 == 1)
-#endif // CONFIG_STA_SUPPORT //
-	{
-		// patch for AsicSetRxAnt failed
-		pAd->RxAnt.EvaluatePeriod = 0;
-
-		// check every 2 second. If rcv-beacon less than 5 in the past 2 second, then AvgRSSI is no longer a
-		// valid indication of the distance between this AP and its clients.
-		if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED))
-		{
-			SHORT	realavgrssi1;
-
-			// if no traffic then reset average rssi to trigger evaluation
-#ifdef CONFIG_STA_SUPPORT
-			if (pAd->StaCfg.NumOfAvgRssiSample < 5)
-			{
-				pAd->RxAnt.Pair1LastAvgRssi = (-99);
-				pAd->RxAnt.Pair2LastAvgRssi = (-99);
-				DBGPRINT(RT_DEBUG_TRACE, ("MlmePeriodicExec: no traffic/beacon, reset RSSI\n"));
-			}
-
-			pAd->StaCfg.NumOfAvgRssiSample = 0;
-			realavgrssi1 = (pAd->RxAnt.Pair1AvgRssi[pAd->RxAnt.Pair1PrimaryRxAnt] >> 3);
-#endif // CONFIG_STA_SUPPORT //
-
-			DBGPRINT(RT_DEBUG_TRACE,("Ant-realrssi0(%d), Lastrssi0(%d), EvaluateStableCnt=%d\n", realavgrssi1, pAd->RxAnt.Pair1LastAvgRssi, pAd->RxAnt.EvaluateStableCnt));
-
-			// if the difference between two rssi is larger or less than 5, then evaluate the other antenna
-			if ((pAd->RxAnt.EvaluateStableCnt < 2) || (realavgrssi1 > (pAd->RxAnt.Pair1LastAvgRssi + 5)) || (realavgrssi1 < (pAd->RxAnt.Pair1LastAvgRssi - 5)))
-				AsicEvaluateRxAnt(pAd);
-
-				pAd->RxAnt.Pair1LastAvgRssi = realavgrssi1;
-		}
-		else
-		{
-			// if not connected, always switch antenna to try to connect
-			UCHAR	temp;
-
-			temp = pAd->RxAnt.Pair1PrimaryRxAnt;
-			pAd->RxAnt.Pair1PrimaryRxAnt = pAd->RxAnt.Pair1SecondaryRxAnt;
-			pAd->RxAnt.Pair1SecondaryRxAnt = temp;
-
-			DBGPRINT(RT_DEBUG_TRACE, ("MlmePeriodicExec: no connect, switch to another one to try connection\n"));
-
-			AsicSetRxAnt(pAd, pAd->RxAnt.Pair1PrimaryRxAnt);
-		}
-	}
-}
-#endif // ANT_DIVERSITY_SUPPORT //
-
-/*
-	========================================================================
-
-	Routine Description:
-		Antenna miscellaneous setting.
-
-	Arguments:
-		pAd						Pointer to our adapter
-		BandState				Indicate current Band State.
-
-	Return Value:
-		None
-
-	IRQL <= DISPATCH_LEVEL
-
-	Note:
-		1.) Frame End type control
-			only valid for G only (RF_2527 & RF_2529)
-			0: means DPDT, set BBP R4 bit 5 to 1
-			1: means SPDT, set BBP R4 bit 5 to 0
-
-
-	========================================================================
-*/
-VOID	AsicAntennaSetting(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	ABGBAND_STATE	BandState)
-{
-}
-
-VOID AsicRfTuningExec(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3)
-{
-}
-
-/*
-	==========================================================================
-	Description:
-		Gives CCK TX rate 2 more dB TX power.
-		This routine works only in LINK UP in INFRASTRUCTURE mode.
-
-		calculate desired Tx power in RF R3.Tx0~5,	should consider -
-		0. if current radio is a noisy environment (pAd->DrsCounters.fNoisyEnvironment)
-		1. TxPowerPercentage
-		2. auto calibration based on TSSI feedback
-		3. extra 2 db for CCK
-		4. -10 db upon very-short distance (AvgRSSI >= -40db) to AP
-
-	NOTE: Since this routine requires the value of (pAd->DrsCounters.fNoisyEnvironment),
-		it should be called AFTER MlmeDynamicTxRatSwitching()
-	==========================================================================
- */
-VOID AsicAdjustTxPower(
-	IN PRTMP_ADAPTER pAd)
-{
-	INT			i, j;
-	CHAR		DeltaPwr = 0;
-	BOOLEAN		bAutoTxAgc = FALSE;
-	UCHAR		TssiRef, *pTssiMinusBoundary, *pTssiPlusBoundary, TxAgcStep;
-	UCHAR		BbpR1 = 0, BbpR49 = 0, idx;
-	PCHAR		pTxAgcCompensate;
-	ULONG		TxPwr[5];
-	CHAR		Value;
-#ifdef CONFIG_STA_SUPPORT
-	CHAR		Rssi = -127;
-#endif // CONFIG_STA_SUPPORT //
-#ifdef CARRIER_SENSE_NEW_ALGO
-	unsigned long flags; //KH Add to Fix PCIe Power-Saving bug
-#endif // CARRIER_SENSE_NEW_ALGO //
-
-
-#ifdef CARRIER_SENSE_NEW_ALGO
-	//KH Add to Fix PCIe Power-Saving bug<--
-	RTMP_INT_LOCK(&pAd->irq_lock, flags);
-	//KH Add to Fix PCIe Power-Saving bug-->
-#endif // CARRIER_SENSE_NEW_ALGO //
-
-#ifdef CONFIG_STA_SUPPORT
-	if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE) ||
-#ifdef RTMP_MAC_PCI
-		(pAd->bPCIclkOff == TRUE) ||
-#endif // RTMP_MAC_PCI //
-		RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_IDLE_RADIO_OFF) ||
-		RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS))
-{
-
-#ifdef CARRIER_SENSE_NEW_ALGO
-	//KH Add to Fix PCIe Power-Saving bug<--
-	RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
-	//KH add to fix PCIe-Power Saving -->
-#endif // CARRIER_SENSE_NEW_ALGO //
-		return;
-}
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		Rssi = RTMPMaxRssi(pAd,
-						   pAd->StaCfg.RssiSample.AvgRssi0,
-						   pAd->StaCfg.RssiSample.AvgRssi1,
-						   pAd->StaCfg.RssiSample.AvgRssi2);
-#endif // CONFIG_STA_SUPPORT //
-
-	if (pAd->CommonCfg.BBPCurrentBW == BW_40)
-	{
-		if (pAd->CommonCfg.CentralChannel > 14)
-		{
-			TxPwr[0] = pAd->Tx40MPwrCfgABand[0];
-			TxPwr[1] = pAd->Tx40MPwrCfgABand[1];
-			TxPwr[2] = pAd->Tx40MPwrCfgABand[2];
-			TxPwr[3] = pAd->Tx40MPwrCfgABand[3];
-			TxPwr[4] = pAd->Tx40MPwrCfgABand[4];
-		}
-		else
-		{
-			TxPwr[0] = pAd->Tx40MPwrCfgGBand[0];
-			TxPwr[1] = pAd->Tx40MPwrCfgGBand[1];
-			TxPwr[2] = pAd->Tx40MPwrCfgGBand[2];
-			TxPwr[3] = pAd->Tx40MPwrCfgGBand[3];
-			TxPwr[4] = pAd->Tx40MPwrCfgGBand[4];
-		}
-	}
-	else
-	{
-		if (pAd->CommonCfg.Channel > 14)
-		{
-			TxPwr[0] = pAd->Tx20MPwrCfgABand[0];
-			TxPwr[1] = pAd->Tx20MPwrCfgABand[1];
-			TxPwr[2] = pAd->Tx20MPwrCfgABand[2];
-			TxPwr[3] = pAd->Tx20MPwrCfgABand[3];
-			TxPwr[4] = pAd->Tx20MPwrCfgABand[4];
-		}
-		else
-		{
-			TxPwr[0] = pAd->Tx20MPwrCfgGBand[0];
-			TxPwr[1] = pAd->Tx20MPwrCfgGBand[1];
-			TxPwr[2] = pAd->Tx20MPwrCfgGBand[2];
-			TxPwr[3] = pAd->Tx20MPwrCfgGBand[3];
-			TxPwr[4] = pAd->Tx20MPwrCfgGBand[4];
-		}
-	}
-
-	// TX power compensation for temperature variation based on TSSI. try every 4 second
-	if (pAd->Mlme.OneSecPeriodicRound % 4 == 0)
-	{
-		if (pAd->CommonCfg.Channel <= 14)
-		{
-			/* bg channel */
-			bAutoTxAgc         = pAd->bAutoTxAgcG;
-			TssiRef            = pAd->TssiRefG;
-			pTssiMinusBoundary = &pAd->TssiMinusBoundaryG[0];
-			pTssiPlusBoundary  = &pAd->TssiPlusBoundaryG[0];
-			TxAgcStep          = pAd->TxAgcStepG;
-			pTxAgcCompensate   = &pAd->TxAgcCompensateG;
-		}
-		else
-		{
-			/* a channel */
-			bAutoTxAgc         = pAd->bAutoTxAgcA;
-			TssiRef            = pAd->TssiRefA;
-			pTssiMinusBoundary = &pAd->TssiMinusBoundaryA[0];
-			pTssiPlusBoundary  = &pAd->TssiPlusBoundaryA[0];
-			TxAgcStep          = pAd->TxAgcStepA;
-			pTxAgcCompensate   = &pAd->TxAgcCompensateA;
-		}
-
-		if (bAutoTxAgc)
-		{
-			/* BbpR1 is unsigned char */
-			RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R49, &BbpR49);
-
-			/* (p) TssiPlusBoundaryG[0] = 0 = (m) TssiMinusBoundaryG[0] */
-			/* compensate: +4     +3   +2   +1    0   -1   -2   -3   -4 * steps */
-			/* step value is defined in pAd->TxAgcStepG for tx power value */
-
-			/* [4]+1+[4]   p4     p3   p2   p1   o1   m1   m2   m3   m4 */
-			/* ex:         0x00 0x15 0x25 0x45 0x88 0xA0 0xB5 0xD0 0xF0
-			   above value are examined in mass factory production */
-			/*             [4]    [3]  [2]  [1]  [0]  [1]  [2]  [3]  [4] */
-
-			/* plus (+) is 0x00 ~ 0x45, minus (-) is 0xa0 ~ 0xf0 */
-			/* if value is between p1 ~ o1 or o1 ~ s1, no need to adjust tx power */
-			/* if value is 0xa5, tx power will be -= TxAgcStep*(2-1) */
-
-			if (BbpR49 > pTssiMinusBoundary[1])
-			{
-				// Reading is larger than the reference value
-				// check for how large we need to decrease the Tx power
-				for (idx = 1; idx < 5; idx++)
-				{
-					if (BbpR49 <= pTssiMinusBoundary[idx])  // Found the range
-						break;
-				}
-				// The index is the step we should decrease, idx = 0 means there is nothing to compensate
-//				if (R3 > (ULONG) (TxAgcStep * (idx-1)))
-					*pTxAgcCompensate = -(TxAgcStep * (idx-1));
-//				else
-//					*pTxAgcCompensate = -((UCHAR)R3);
-
-				DeltaPwr += (*pTxAgcCompensate);
-				DBGPRINT(RT_DEBUG_TRACE, ("-- Tx Power, BBP R1=%x, TssiRef=%x, TxAgcStep=%x, step = -%d\n",
-					BbpR49, TssiRef, TxAgcStep, idx-1));
-			}
-			else if (BbpR49 < pTssiPlusBoundary[1])
-			{
-				// Reading is smaller than the reference value
-				// check for how large we need to increase the Tx power
-				for (idx = 1; idx < 5; idx++)
-				{
-					if (BbpR49 >= pTssiPlusBoundary[idx])   // Found the range
-						break;
-				}
-				// The index is the step we should increase, idx = 0 means there is nothing to compensate
-				*pTxAgcCompensate = TxAgcStep * (idx-1);
-				DeltaPwr += (*pTxAgcCompensate);
-				DBGPRINT(RT_DEBUG_TRACE, ("++ Tx Power, BBP R1=%x, TssiRef=%x, TxAgcStep=%x, step = +%d\n",
-					BbpR49, TssiRef, TxAgcStep, idx-1));
-			}
-			else
-			{
-				*pTxAgcCompensate = 0;
-				DBGPRINT(RT_DEBUG_TRACE, ("   Tx Power, BBP R49=%x, TssiRef=%x, TxAgcStep=%x, step = +%d\n",
-					BbpR49, TssiRef, TxAgcStep, 0));
-			}
-		}
-	}
-	else
-	{
-		if (pAd->CommonCfg.Channel <= 14)
-		{
-			bAutoTxAgc         = pAd->bAutoTxAgcG;
-			pTxAgcCompensate   = &pAd->TxAgcCompensateG;
-		}
-		else
-		{
-			bAutoTxAgc         = pAd->bAutoTxAgcA;
-			pTxAgcCompensate   = &pAd->TxAgcCompensateA;
-		}
-
-		if (bAutoTxAgc)
-			DeltaPwr += (*pTxAgcCompensate);
-	}
-
-	RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R1, &BbpR1);
-	BbpR1 &= 0xFC;
-
-#ifdef SINGLE_SKU
-	// Handle regulatory max tx power constrain
-	do
-	{
-		UCHAR    TxPwrInEEPROM = 0xFF, CountryTxPwr = 0xFF, criterion;
-		UCHAR    AdjustMaxTxPwr[40];
-
-		if (pAd->CommonCfg.Channel > 14) // 5G band
-			TxPwrInEEPROM = ((pAd->CommonCfg.DefineMaxTxPwr & 0xFF00) >> 8);
-		else // 2.4G band
-			TxPwrInEEPROM = (pAd->CommonCfg.DefineMaxTxPwr & 0x00FF);
-		CountryTxPwr = GetCuntryMaxTxPwr(pAd, pAd->CommonCfg.Channel);
-
-		// error handling, range check
-		if ((TxPwrInEEPROM > 0x50) || (CountryTxPwr > 0x50))
-		{
-			DBGPRINT(RT_DEBUG_ERROR,("AsicAdjustTxPower - Invalid max tx power (=0x%02x), CountryTxPwr=%d\n", TxPwrInEEPROM, CountryTxPwr));
-			break;
-		}
-
-		criterion = *((PUCHAR)TxPwr + 2) & 0xF;        // FAE use OFDM 6M as criterion
-
-		DBGPRINT_RAW(RT_DEBUG_TRACE,("AsicAdjustTxPower (criterion=%d, TxPwrInEEPROM=%d, CountryTxPwr=%d)\n", criterion, TxPwrInEEPROM, CountryTxPwr));
-
-		// Adjust max tx power according to the relationship of tx power in E2PROM
-		for (i=0; i<5; i++)
-		{
-			// CCK will have 4dBm larger than OFDM
-			// Therefore, we should separate to parse the tx power field
-			if (i == 0)
-			{
-				for (j=0; j<8; j++)
-				{
-					Value = (CHAR)((TxPwr[i] >> j*4) & 0x0F);
-
-					if (j < 4)
-					{
-						// CCK will have 4dBm larger than OFDM
-						AdjustMaxTxPwr[i*8+j] = TxPwrInEEPROM + (Value - criterion) + 4;
-					}
-					else
-					{
-						AdjustMaxTxPwr[i*8+j] = TxPwrInEEPROM + (Value - criterion);
-					}
-					DBGPRINT_RAW(RT_DEBUG_TRACE,("AsicAdjustTxPower (i/j=%d/%d, Value=%d, %d)\n", i, j, Value, AdjustMaxTxPwr[i*8+j]));
-				}
-			}
-			else
-			{
-				for (j=0; j<8; j++)
-				{
-					Value = (CHAR)((TxPwr[i] >> j*4) & 0x0F);
-
-					AdjustMaxTxPwr[i*8+j] = TxPwrInEEPROM + (Value - criterion);
-					DBGPRINT_RAW(RT_DEBUG_TRACE,("AsicAdjustTxPower (i/j=%d/%d, Value=%d, %d)\n", i, j, Value, AdjustMaxTxPwr[i*8+j]));
-				}
-			}
-		}
-
-		// Adjust tx power according to the relationship
-		for (i=0; i<5; i++)
-		{
-			if (TxPwr[i] != 0xffffffff)
-			{
-				for (j=0; j<8; j++)
-				{
-					Value = (CHAR)((TxPwr[i] >> j*4) & 0x0F);
-
-					// The system tx power is larger than the regulatory, the power should be restrain
-					if (AdjustMaxTxPwr[i*8+j] > CountryTxPwr)
-					{
-						// decrease to zero and don't need to take care BBPR1
-						if ((Value - (AdjustMaxTxPwr[i*8+j] - CountryTxPwr)) > 0)
-							Value -= (AdjustMaxTxPwr[i*8+j] - CountryTxPwr);
-						else
-							Value = 0;
-
-						DBGPRINT_RAW(RT_DEBUG_TRACE,("AsicAdjustTxPower (i/j=%d/%d, Value=%d, %d)\n", i, j, Value, AdjustMaxTxPwr[i*8+j]));
-					}
-					else
-						DBGPRINT_RAW(RT_DEBUG_TRACE,("AsicAdjustTxPower (i/j=%d/%d, Value=%d, %d, no change)\n", i, j, Value, AdjustMaxTxPwr[i*8+j]));
-
-						TxPwr[i] = (TxPwr[i] & ~(0x0000000F << j*4)) | (Value << j*4);
-				}
-			}
-		}
-	} while (FALSE);
-#endif // SINGLE_SKU //
-
-	/* calculate delta power based on the percentage specified from UI */
-	// E2PROM setting is calibrated for maximum TX power (i.e. 100%)
-	// We lower TX power here according to the percentage specified from UI
-	if (pAd->CommonCfg.TxPowerPercentage == 0xffffffff)       // AUTO TX POWER control
-	{
-#ifdef CONFIG_STA_SUPPORT
-		IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		{
-			// to patch high power issue with some APs, like Belkin N1.
-			if (Rssi > -35)
-			{
-				BbpR1 |= 0x02;		// DeltaPwr -= 12;
-			}
-			else if (Rssi > -40)
-			{
-				BbpR1 |= 0x01;		// DeltaPwr -= 6;
-			}
-			else
-		;
-		}
-#endif // CONFIG_STA_SUPPORT //
-	}
-	else if (pAd->CommonCfg.TxPowerPercentage > 90)  // 91 ~ 100% & AUTO, treat as 100% in terms of mW
-		;
-	else if (pAd->CommonCfg.TxPowerPercentage > 60)  // 61 ~ 90%, treat as 75% in terms of mW		// DeltaPwr -= 1;
-	{
-		DeltaPwr -= 1;
-	}
-	else if (pAd->CommonCfg.TxPowerPercentage > 30)  // 31 ~ 60%, treat as 50% in terms of mW		// DeltaPwr -= 3;
-	{
-		DeltaPwr -= 3;
-	}
-	else if (pAd->CommonCfg.TxPowerPercentage > 15)  // 16 ~ 30%, treat as 25% in terms of mW		// DeltaPwr -= 6;
-	{
-		BbpR1 |= 0x01;
-	}
-	else if (pAd->CommonCfg.TxPowerPercentage > 9)   // 10 ~ 15%, treat as 12.5% in terms of mW		// DeltaPwr -= 9;
-	{
-		BbpR1 |= 0x01;
-		DeltaPwr -= 3;
-	}
-	else                                           // 0 ~ 9 %, treat as MIN(~3%) in terms of mW		// DeltaPwr -= 12;
-	{
-		BbpR1 |= 0x02;
-	}
-
-	RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R1, BbpR1);
-
-	/* reset different new tx power for different TX rate */
-	for(i=0; i<5; i++)
-	{
-		if (TxPwr[i] != 0xffffffff)
-		{
-			for (j=0; j<8; j++)
-			{
-				Value = (CHAR)((TxPwr[i] >> j*4) & 0x0F); /* 0 ~ 15 */
-
-				if ((Value + DeltaPwr) < 0)
-				{
-					Value = 0; /* min */
-				}
-				else if ((Value + DeltaPwr) > 0xF)
-				{
-					Value = 0xF; /* max */
-				}
-				else
-				{
-					Value += DeltaPwr; /* temperature compensation */
-				}
-
-				/* fill new value to CSR offset */
-				TxPwr[i] = (TxPwr[i] & ~(0x0000000F << j*4)) | (Value << j*4);
-			}
-
-			/* write tx power value to CSR */
-			/* TX_PWR_CFG_0 (8 tx rate) for	TX power for OFDM 12M/18M
-											TX power for OFDM 6M/9M
-											TX power for CCK5.5M/11M
-											TX power for CCK1M/2M */
-			/* TX_PWR_CFG_1 ~ TX_PWR_CFG_4 */
-			RTMP_IO_WRITE32(pAd, TX_PWR_CFG_0 + i*4, TxPwr[i]);
-		}
-	}
-
-#ifdef CARRIER_SENSE_NEW_ALGO
-	//KH Add to Fix PCIe Power-Saving bug<--
-	RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
-	//KH add to fix PCIe-Power Saving -->
-#endif // CARRIER_SENSE_NEW_ALGO //
-
-}
-
-
-#ifdef CONFIG_STA_SUPPORT
-VOID AsicResetBBPAgent(
-IN PRTMP_ADAPTER pAd)
-{
-	BBP_CSR_CFG_STRUC	BbpCsr;
-	DBGPRINT(RT_DEBUG_ERROR, ("Reset BBP Agent busy bit.!! \n"));
-	// Still need to find why BBP agent keeps busy, but in fact, hardware still function ok. Now clear busy first.
-	RTMP_IO_READ32(pAd, H2M_BBP_AGENT, &BbpCsr.word);
-	BbpCsr.field.Busy = 0;
-	RTMP_IO_WRITE32(pAd, H2M_BBP_AGENT, BbpCsr.word);
-}
-/*
-	==========================================================================
-	Description:
-		put PHY to sleep here, and set next wakeup timer. PHY doesn't not wakeup
-		automatically. Instead, MCU will issue a TwakeUpInterrupt to host after
-		the wakeup timer timeout. Driver has to issue a separate command to wake
-		PHY up.
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-VOID AsicSleepThenAutoWakeup(
-	IN PRTMP_ADAPTER pAd,
-	IN USHORT TbttNumToNextWakeUp)
-{
-	RTMP_STA_SLEEP_THEN_AUTO_WAKEUP(pAd, TbttNumToNextWakeUp);
-}
-
-/*
-	==========================================================================
-	Description:
-		AsicForceWakeup() is used whenever manual wakeup is required
-		AsicForceSleep() should only be used when not in INFRA BSS. When
-		in INFRA BSS, we should use AsicSleepThenAutoWakeup() instead.
-	==========================================================================
- */
-VOID AsicForceSleep(
-	IN PRTMP_ADAPTER pAd)
-{
-
-}
-
-/*
-	==========================================================================
-	Description:
-		AsicForceWakeup() is used whenever Twakeup timer (set via AsicSleepThenAutoWakeup)
-		expired.
-
-	IRQL = PASSIVE_LEVEL
-	IRQL = DISPATCH_LEVEL
-	==========================================================================
- */
-VOID AsicForceWakeup(
-	IN PRTMP_ADAPTER pAd,
-	IN BOOLEAN    bFromTx)
-{
-    DBGPRINT(RT_DEBUG_INFO, ("--> AsicForceWakeup \n"));
-    RTMP_STA_FORCE_WAKEUP(pAd, bFromTx);
-}
-#endif // CONFIG_STA_SUPPORT //
-
-
-/*
-	==========================================================================
-	Description:
-		Set My BSSID
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-VOID AsicSetBssid(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR pBssid)
-{
-	ULONG		  Addr4;
-	DBGPRINT(RT_DEBUG_TRACE, ("==============> AsicSetBssid %x:%x:%x:%x:%x:%x\n",
-		pBssid[0],pBssid[1],pBssid[2],pBssid[3], pBssid[4],pBssid[5]));
-
-	Addr4 = (ULONG)(pBssid[0])		 |
-			(ULONG)(pBssid[1] << 8)  |
-			(ULONG)(pBssid[2] << 16) |
-			(ULONG)(pBssid[3] << 24);
-	RTMP_IO_WRITE32(pAd, MAC_BSSID_DW0, Addr4);
-
-	Addr4 = 0;
-	// always one BSSID in STA mode
-	Addr4 = (ULONG)(pBssid[4]) | (ULONG)(pBssid[5] << 8);
-
-	RTMP_IO_WRITE32(pAd, MAC_BSSID_DW1, Addr4);
-}
-
-VOID AsicSetMcastWC(
-	IN PRTMP_ADAPTER pAd)
-{
-	MAC_TABLE_ENTRY *pEntry = &pAd->MacTab.Content[MCAST_WCID];
-	USHORT		offset;
-
-	pEntry->Sst        = SST_ASSOC;
-	pEntry->Aid        = MCAST_WCID;	// Softap supports 1 BSSID and use WCID=0 as multicast Wcid index
-	pEntry->PsMode     = PWR_ACTIVE;
-	pEntry->CurrTxRate = pAd->CommonCfg.MlmeRate;
-	offset = MAC_WCID_BASE + BSS0Mcast_WCID * HW_WCID_ENTRY_SIZE;
-}
-
-/*
-	==========================================================================
-	Description:
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-VOID AsicDelWcidTab(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR	Wcid)
-{
-	ULONG		  Addr0 = 0x0, Addr1 = 0x0;
-	ULONG		offset;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("AsicDelWcidTab==>Wcid = 0x%x\n",Wcid));
-	offset = MAC_WCID_BASE + Wcid * HW_WCID_ENTRY_SIZE;
-	RTMP_IO_WRITE32(pAd, offset, Addr0);
-	offset += 4;
-	RTMP_IO_WRITE32(pAd, offset, Addr1);
-}
-
-/*
-	==========================================================================
-	Description:
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-VOID AsicEnableRDG(
-	IN PRTMP_ADAPTER pAd)
-{
-	TX_LINK_CFG_STRUC	TxLinkCfg;
-	UINT32				Data = 0;
-
-	RTMP_IO_READ32(pAd, TX_LINK_CFG, &TxLinkCfg.word);
-	TxLinkCfg.field.TxRDGEn = 1;
-	RTMP_IO_WRITE32(pAd, TX_LINK_CFG, TxLinkCfg.word);
-
-	RTMP_IO_READ32(pAd, EDCA_AC0_CFG, &Data);
-	Data  &= 0xFFFFFF00;
-	Data  |= 0x80;
-	RTMP_IO_WRITE32(pAd, EDCA_AC0_CFG, Data);
-
-	//OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_AGGREGATION_INUSED);
-}
-
-/*
-	==========================================================================
-	Description:
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-VOID AsicDisableRDG(
-	IN PRTMP_ADAPTER pAd)
-{
-	TX_LINK_CFG_STRUC	TxLinkCfg;
-	UINT32				Data = 0;
-
-
-	RTMP_IO_READ32(pAd, TX_LINK_CFG, &TxLinkCfg.word);
-	TxLinkCfg.field.TxRDGEn = 0;
-	RTMP_IO_WRITE32(pAd, TX_LINK_CFG, TxLinkCfg.word);
-
-	RTMP_IO_READ32(pAd, EDCA_AC0_CFG, &Data);
-
-	Data  &= 0xFFFFFF00;
-	//Data  |= 0x20;
-#ifndef WIFI_TEST
-	//if ( pAd->CommonCfg.bEnableTxBurst )
-	//	Data |= 0x60; // for performance issue not set the TXOP to 0
-#endif
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_DYNAMIC_BE_TXOP_ACTIVE)
-#ifdef DOT11_N_SUPPORT
-		&& (pAd->MacTab.fAnyStationMIMOPSDynamic == FALSE)
-#endif // DOT11_N_SUPPORT //
-	)
-	{
-		// For CWC test, change txop from 0x30 to 0x20 in TxBurst mode
-		if (pAd->CommonCfg.bEnableTxBurst)
-		Data |= 0x20;
-	}
-	RTMP_IO_WRITE32(pAd, EDCA_AC0_CFG, Data);
-}
-
-/*
-	==========================================================================
-	Description:
-
-	IRQL = PASSIVE_LEVEL
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-VOID AsicDisableSync(
-	IN PRTMP_ADAPTER pAd)
-{
-	BCN_TIME_CFG_STRUC csr;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("--->Disable TSF synchronization\n"));
-
-	// 2003-12-20 disable TSF and TBTT while NIC in power-saving have side effect
-	//			  that NIC will never wakes up because TSF stops and no more
-	//			  TBTT interrupts
-	pAd->TbttTickCount = 0;
-	RTMP_IO_READ32(pAd, BCN_TIME_CFG, &csr.word);
-	csr.field.bBeaconGen = 0;
-	csr.field.bTBTTEnable = 0;
-	csr.field.TsfSyncMode = 0;
-	csr.field.bTsfTicking = 0;
-	RTMP_IO_WRITE32(pAd, BCN_TIME_CFG, csr.word);
-
-}
-
-/*
-	==========================================================================
-	Description:
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-VOID AsicEnableBssSync(
-	IN PRTMP_ADAPTER pAd)
-{
-	BCN_TIME_CFG_STRUC csr;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("--->AsicEnableBssSync(INFRA mode)\n"));
-
-	RTMP_IO_READ32(pAd, BCN_TIME_CFG, &csr.word);
-//	RTMP_IO_WRITE32(pAd, BCN_TIME_CFG, 0x00000000);
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-		csr.field.BeaconInterval = pAd->CommonCfg.BeaconPeriod << 4; // ASIC register in units of 1/16 TU
-		csr.field.bTsfTicking = 1;
-		csr.field.TsfSyncMode = 1; // sync TSF in INFRASTRUCTURE mode
-		csr.field.bBeaconGen  = 0; // do NOT generate BEACON
-		csr.field.bTBTTEnable = 1;
-	}
-#endif // CONFIG_STA_SUPPORT //
-	RTMP_IO_WRITE32(pAd, BCN_TIME_CFG, csr.word);
-}
-
-/*
-	==========================================================================
-	Description:
-	Note:
-		BEACON frame in shared memory should be built ok before this routine
-		can be called. Otherwise, a garbage frame maybe transmitted out every
-		Beacon period.
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-VOID AsicEnableIbssSync(
-	IN PRTMP_ADAPTER pAd)
-{
-	BCN_TIME_CFG_STRUC csr9;
-	PUCHAR			ptr;
-	UINT i;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("--->AsicEnableIbssSync(ADHOC mode. MPDUtotalByteCount = %d)\n", pAd->BeaconTxWI.MPDUtotalByteCount));
-
-	RTMP_IO_READ32(pAd, BCN_TIME_CFG, &csr9.word);
-	csr9.field.bBeaconGen = 0;
-	csr9.field.bTBTTEnable = 0;
-	csr9.field.bTsfTicking = 0;
-	RTMP_IO_WRITE32(pAd, BCN_TIME_CFG, csr9.word);
-
-#ifdef RTMP_MAC_PCI
-	// move BEACON TXD and frame content to on-chip memory
-	ptr = (PUCHAR)&pAd->BeaconTxWI;
-	for (i=0; i<TXWI_SIZE; i+=4)  // 16-byte TXWI field
-	{
-		UINT32 longptr =  *ptr + (*(ptr+1)<<8) + (*(ptr+2)<<16) + (*(ptr+3)<<24);
-		RTMP_IO_WRITE32(pAd, HW_BEACON_BASE0 + i, longptr);
-		ptr += 4;
-	}
-
-	// start right after the 16-byte TXWI field
-	ptr = pAd->BeaconBuf;
-	for (i=0; i< pAd->BeaconTxWI.MPDUtotalByteCount; i+=4)
-	{
-		UINT32 longptr =  *ptr + (*(ptr+1)<<8) + (*(ptr+2)<<16) + (*(ptr+3)<<24);
-		RTMP_IO_WRITE32(pAd, HW_BEACON_BASE0 + TXWI_SIZE + i, longptr);
-		ptr +=4;
-	}
-#endif // RTMP_MAC_PCI //
-
-
-	//
-	// For Wi-Fi faily generated beacons between participating stations.
-	// Set TBTT phase adaptive adjustment step to 8us (default 16us)
-	// don't change settings 2006-5- by Jerry
-	//RTMP_IO_WRITE32(pAd, TBTT_SYNC_CFG, 0x00001010);
-
-	// start sending BEACON
-	csr9.field.BeaconInterval = pAd->CommonCfg.BeaconPeriod << 4; // ASIC register in units of 1/16 TU
-	csr9.field.bTsfTicking = 1;
-	csr9.field.TsfSyncMode = 2; // sync TSF in IBSS mode
-	csr9.field.bTBTTEnable = 1;
-	csr9.field.bBeaconGen = 1;
-	RTMP_IO_WRITE32(pAd, BCN_TIME_CFG, csr9.word);
-}
-
-/*
-	==========================================================================
-	Description:
-
-	IRQL = PASSIVE_LEVEL
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-VOID AsicSetEdcaParm(
-	IN PRTMP_ADAPTER pAd,
-	IN PEDCA_PARM	 pEdcaParm)
-{
-	EDCA_AC_CFG_STRUC   Ac0Cfg, Ac1Cfg, Ac2Cfg, Ac3Cfg;
-	AC_TXOP_CSR0_STRUC csr0;
-	AC_TXOP_CSR1_STRUC csr1;
-	AIFSN_CSR_STRUC    AifsnCsr;
-	CWMIN_CSR_STRUC    CwminCsr;
-	CWMAX_CSR_STRUC    CwmaxCsr;
-	int i;
-
-	Ac0Cfg.word = 0;
-	Ac1Cfg.word = 0;
-	Ac2Cfg.word = 0;
-	Ac3Cfg.word = 0;
-	if ((pEdcaParm == NULL) || (pEdcaParm->bValid == FALSE))
-	{
-		DBGPRINT(RT_DEBUG_TRACE,("AsicSetEdcaParm\n"));
-		OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_WMM_INUSED);
-		for (i=0; i<MAX_LEN_OF_MAC_TABLE; i++)
-		{
-			if (pAd->MacTab.Content[i].ValidAsCLI || pAd->MacTab.Content[i].ValidAsApCli)
-				CLIENT_STATUS_CLEAR_FLAG(&pAd->MacTab.Content[i], fCLIENT_STATUS_WMM_CAPABLE);
-		}
-
-		//========================================================
-		//      MAC Register has a copy .
-		//========================================================
-//#ifndef WIFI_TEST
-		if( pAd->CommonCfg.bEnableTxBurst )
-		{
-			// For CWC test, change txop from 0x30 to 0x20 in TxBurst mode
-			Ac0Cfg.field.AcTxop = 0x20; // Suggest by John for TxBurst in HT Mode
-		}
-		else
-			Ac0Cfg.field.AcTxop = 0;	// QID_AC_BE
-//#else
-//		Ac0Cfg.field.AcTxop = 0;	// QID_AC_BE
-//#endif
-		Ac0Cfg.field.Cwmin = CW_MIN_IN_BITS;
-		Ac0Cfg.field.Cwmax = CW_MAX_IN_BITS;
-		Ac0Cfg.field.Aifsn = 2;
-		RTMP_IO_WRITE32(pAd, EDCA_AC0_CFG, Ac0Cfg.word);
-
-		Ac1Cfg.field.AcTxop = 0;	// QID_AC_BK
-		Ac1Cfg.field.Cwmin = CW_MIN_IN_BITS;
-		Ac1Cfg.field.Cwmax = CW_MAX_IN_BITS;
-		Ac1Cfg.field.Aifsn = 2;
-		RTMP_IO_WRITE32(pAd, EDCA_AC1_CFG, Ac1Cfg.word);
-
-		if (pAd->CommonCfg.PhyMode == PHY_11B)
-		{
-			Ac2Cfg.field.AcTxop = 192;	// AC_VI: 192*32us ~= 6ms
-			Ac3Cfg.field.AcTxop = 96;	// AC_VO: 96*32us  ~= 3ms
-		}
-		else
-		{
-			Ac2Cfg.field.AcTxop = 96;	// AC_VI: 96*32us ~= 3ms
-			Ac3Cfg.field.AcTxop = 48;	// AC_VO: 48*32us ~= 1.5ms
-		}
-		Ac2Cfg.field.Cwmin = CW_MIN_IN_BITS;
-		Ac2Cfg.field.Cwmax = CW_MAX_IN_BITS;
-		Ac2Cfg.field.Aifsn = 2;
-		RTMP_IO_WRITE32(pAd, EDCA_AC2_CFG, Ac2Cfg.word);
-		Ac3Cfg.field.Cwmin = CW_MIN_IN_BITS;
-		Ac3Cfg.field.Cwmax = CW_MAX_IN_BITS;
-		Ac3Cfg.field.Aifsn = 2;
-		RTMP_IO_WRITE32(pAd, EDCA_AC3_CFG, Ac3Cfg.word);
-
-		//========================================================
-		//      DMA Register has a copy too.
-		//========================================================
-		csr0.field.Ac0Txop = 0;		// QID_AC_BE
-		csr0.field.Ac1Txop = 0;		// QID_AC_BK
-		RTMP_IO_WRITE32(pAd, WMM_TXOP0_CFG, csr0.word);
-		if (pAd->CommonCfg.PhyMode == PHY_11B)
-		{
-			csr1.field.Ac2Txop = 192;		// AC_VI: 192*32us ~= 6ms
-			csr1.field.Ac3Txop = 96;		// AC_VO: 96*32us  ~= 3ms
-		}
-		else
-		{
-			csr1.field.Ac2Txop = 96;		// AC_VI: 96*32us ~= 3ms
-			csr1.field.Ac3Txop = 48;		// AC_VO: 48*32us ~= 1.5ms
-		}
-		RTMP_IO_WRITE32(pAd, WMM_TXOP1_CFG, csr1.word);
-
-		CwminCsr.word = 0;
-		CwminCsr.field.Cwmin0 = CW_MIN_IN_BITS;
-		CwminCsr.field.Cwmin1 = CW_MIN_IN_BITS;
-		CwminCsr.field.Cwmin2 = CW_MIN_IN_BITS;
-		CwminCsr.field.Cwmin3 = CW_MIN_IN_BITS;
-		RTMP_IO_WRITE32(pAd, WMM_CWMIN_CFG, CwminCsr.word);
-
-		CwmaxCsr.word = 0;
-		CwmaxCsr.field.Cwmax0 = CW_MAX_IN_BITS;
-		CwmaxCsr.field.Cwmax1 = CW_MAX_IN_BITS;
-		CwmaxCsr.field.Cwmax2 = CW_MAX_IN_BITS;
-		CwmaxCsr.field.Cwmax3 = CW_MAX_IN_BITS;
-		RTMP_IO_WRITE32(pAd, WMM_CWMAX_CFG, CwmaxCsr.word);
-
-		RTMP_IO_WRITE32(pAd, WMM_AIFSN_CFG, 0x00002222);
-
-		NdisZeroMemory(&pAd->CommonCfg.APEdcaParm, sizeof(EDCA_PARM));
-	}
-	else
-	{
-		OPSTATUS_SET_FLAG(pAd, fOP_STATUS_WMM_INUSED);
-		//========================================================
-		//      MAC Register has a copy.
-		//========================================================
-		//
-		// Modify Cwmin/Cwmax/Txop on queue[QID_AC_VI], Recommend by Jerry 2005/07/27
-		// To degrade our VIDO Queue's throughput for WiFi WMM S3T07 Issue.
-		//
-		//pEdcaParm->Txop[QID_AC_VI] = pEdcaParm->Txop[QID_AC_VI] * 7 / 10; // rt2860c need this
-
-		Ac0Cfg.field.AcTxop =  pEdcaParm->Txop[QID_AC_BE];
-		Ac0Cfg.field.Cwmin= pEdcaParm->Cwmin[QID_AC_BE];
-		Ac0Cfg.field.Cwmax = pEdcaParm->Cwmax[QID_AC_BE];
-		Ac0Cfg.field.Aifsn = pEdcaParm->Aifsn[QID_AC_BE]; //+1;
-
-		Ac1Cfg.field.AcTxop =  pEdcaParm->Txop[QID_AC_BK];
-		Ac1Cfg.field.Cwmin = pEdcaParm->Cwmin[QID_AC_BK]; //+2;
-		Ac1Cfg.field.Cwmax = pEdcaParm->Cwmax[QID_AC_BK];
-		Ac1Cfg.field.Aifsn = pEdcaParm->Aifsn[QID_AC_BK]; //+1;
-
-		Ac2Cfg.field.AcTxop = (pEdcaParm->Txop[QID_AC_VI] * 6) / 10;
-		if(pAd->Antenna.field.TxPath == 1)
-		{
-			Ac2Cfg.field.Cwmin = pEdcaParm->Cwmin[QID_AC_VI] + 1;
-			Ac2Cfg.field.Cwmax = pEdcaParm->Cwmax[QID_AC_VI] + 1;
-		}
-		else
-		{
-		Ac2Cfg.field.Cwmin = pEdcaParm->Cwmin[QID_AC_VI];
-		Ac2Cfg.field.Cwmax = pEdcaParm->Cwmax[QID_AC_VI];
-		}
-		Ac2Cfg.field.Aifsn = pEdcaParm->Aifsn[QID_AC_VI] + 1;
-#ifdef CONFIG_STA_SUPPORT
-#endif // CONFIG_STA_SUPPORT //
-
-#ifdef INF_AMAZON_SE
-#endif // INF_AMAZON_SE //
-
-#ifdef CONFIG_STA_SUPPORT
-		IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		{
-			// Tuning for Wi-Fi WMM S06
-			if (pAd->CommonCfg.bWiFiTest &&
-				pEdcaParm->Aifsn[QID_AC_VI] == 10)
-				Ac2Cfg.field.Aifsn -= 1;
-
-			// Tuning for TGn Wi-Fi 5.2.32
-			// STA TestBed changes in this item: conexant legacy sta ==> broadcom 11n sta
-			if (STA_TGN_WIFI_ON(pAd) &&
-				pEdcaParm->Aifsn[QID_AC_VI] == 10)
-			{
-				Ac0Cfg.field.Aifsn = 3;
-				Ac2Cfg.field.AcTxop = 5;
-			}
-
-#ifdef RT30xx
-			if (pAd->RfIcType == RFIC_3020 || pAd->RfIcType == RFIC_2020)
-			{
-				// Tuning for WiFi WMM S3-T07: connexant legacy sta ==> broadcom 11n sta.
-				Ac2Cfg.field.Aifsn = 5;
-			}
-#endif // RT30xx //
-		}
-#endif // CONFIG_STA_SUPPORT //
-
-		Ac3Cfg.field.AcTxop = pEdcaParm->Txop[QID_AC_VO];
-		Ac3Cfg.field.Cwmin = pEdcaParm->Cwmin[QID_AC_VO];
-		Ac3Cfg.field.Cwmax = pEdcaParm->Cwmax[QID_AC_VO];
-		Ac3Cfg.field.Aifsn = pEdcaParm->Aifsn[QID_AC_VO];
-
-//#ifdef WIFI_TEST
-		if (pAd->CommonCfg.bWiFiTest)
-		{
-			if (Ac3Cfg.field.AcTxop == 102)
-			{
-			Ac0Cfg.field.AcTxop = pEdcaParm->Txop[QID_AC_BE] ? pEdcaParm->Txop[QID_AC_BE] : 10;
-				Ac0Cfg.field.Aifsn  = pEdcaParm->Aifsn[QID_AC_BE]-1; /* AIFSN must >= 1 */
-			Ac1Cfg.field.AcTxop = pEdcaParm->Txop[QID_AC_BK];
-				Ac1Cfg.field.Aifsn  = pEdcaParm->Aifsn[QID_AC_BK];
-			Ac2Cfg.field.AcTxop = pEdcaParm->Txop[QID_AC_VI];
-			} /* End of if */
-		}
-//#endif // WIFI_TEST //
-
-		RTMP_IO_WRITE32(pAd, EDCA_AC0_CFG, Ac0Cfg.word);
-		RTMP_IO_WRITE32(pAd, EDCA_AC1_CFG, Ac1Cfg.word);
-		RTMP_IO_WRITE32(pAd, EDCA_AC2_CFG, Ac2Cfg.word);
-		RTMP_IO_WRITE32(pAd, EDCA_AC3_CFG, Ac3Cfg.word);
-
-
-		//========================================================
-		//      DMA Register has a copy too.
-		//========================================================
-		csr0.field.Ac0Txop = Ac0Cfg.field.AcTxop;
-		csr0.field.Ac1Txop = Ac1Cfg.field.AcTxop;
-		RTMP_IO_WRITE32(pAd, WMM_TXOP0_CFG, csr0.word);
-
-		csr1.field.Ac2Txop = Ac2Cfg.field.AcTxop;
-		csr1.field.Ac3Txop = Ac3Cfg.field.AcTxop;
-		RTMP_IO_WRITE32(pAd, WMM_TXOP1_CFG, csr1.word);
-
-		CwminCsr.word = 0;
-		CwminCsr.field.Cwmin0 = pEdcaParm->Cwmin[QID_AC_BE];
-		CwminCsr.field.Cwmin1 = pEdcaParm->Cwmin[QID_AC_BK];
-		CwminCsr.field.Cwmin2 = pEdcaParm->Cwmin[QID_AC_VI];
-#ifdef CONFIG_STA_SUPPORT
-		IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-			CwminCsr.field.Cwmin3 = pEdcaParm->Cwmin[QID_AC_VO] - 1; //for TGn wifi test
-#endif // CONFIG_STA_SUPPORT //
-		RTMP_IO_WRITE32(pAd, WMM_CWMIN_CFG, CwminCsr.word);
-
-		CwmaxCsr.word = 0;
-		CwmaxCsr.field.Cwmax0 = pEdcaParm->Cwmax[QID_AC_BE];
-		CwmaxCsr.field.Cwmax1 = pEdcaParm->Cwmax[QID_AC_BK];
-		CwmaxCsr.field.Cwmax2 = pEdcaParm->Cwmax[QID_AC_VI];
-		CwmaxCsr.field.Cwmax3 = pEdcaParm->Cwmax[QID_AC_VO];
-		RTMP_IO_WRITE32(pAd, WMM_CWMAX_CFG, CwmaxCsr.word);
-
-		AifsnCsr.word = 0;
-		AifsnCsr.field.Aifsn0 = Ac0Cfg.field.Aifsn; //pEdcaParm->Aifsn[QID_AC_BE];
-		AifsnCsr.field.Aifsn1 = Ac1Cfg.field.Aifsn; //pEdcaParm->Aifsn[QID_AC_BK];
-		AifsnCsr.field.Aifsn2 = Ac2Cfg.field.Aifsn; //pEdcaParm->Aifsn[QID_AC_VI];
-#ifdef INF_AMAZON_SE
-#endif // INF_AMAZON_SE //
-
-#ifdef CONFIG_STA_SUPPORT
-		IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		{
-			// Tuning for Wi-Fi WMM S06
-			if (pAd->CommonCfg.bWiFiTest &&
-				pEdcaParm->Aifsn[QID_AC_VI] == 10)
-				AifsnCsr.field.Aifsn2 = Ac2Cfg.field.Aifsn - 4;
-
-			// Tuning for TGn Wi-Fi 5.2.32
-			// STA TestBed changes in this item: connexant legacy sta ==> broadcom 11n sta
-			if (STA_TGN_WIFI_ON(pAd) &&
-				pEdcaParm->Aifsn[QID_AC_VI] == 10)
-			{
-				AifsnCsr.field.Aifsn0 = 3;
-				AifsnCsr.field.Aifsn2 = 7;
-			}
-
-			if (INFRA_ON(pAd))
-				CLIENT_STATUS_SET_FLAG(&pAd->MacTab.Content[BSSID_WCID], fCLIENT_STATUS_WMM_CAPABLE);
-		}
-#endif // CONFIG_STA_SUPPORT //
-
-#ifdef CONFIG_STA_SUPPORT
-		IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		{
-			AifsnCsr.field.Aifsn3 = Ac3Cfg.field.Aifsn - 1; //pEdcaParm->Aifsn[QID_AC_VO]; //for TGn wifi test
-#ifdef RT30xx
-			// TODO: Shiang, this modification also suitable for RT3052/RT3050 ???
-			if (pAd->RfIcType == RFIC_3020 || pAd->RfIcType == RFIC_2020)
-			{
-				IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-					AifsnCsr.field.Aifsn2 = 0x2; //pEdcaParm->Aifsn[QID_AC_VI]; //for WiFi WMM S4-T04.
-			}
-#endif // RT30xx //
-		}
-#endif // CONFIG_STA_SUPPORT //
-		RTMP_IO_WRITE32(pAd, WMM_AIFSN_CFG, AifsnCsr.word);
-
-		NdisMoveMemory(&pAd->CommonCfg.APEdcaParm, pEdcaParm, sizeof(EDCA_PARM));
-		if (!ADHOC_ON(pAd))
-		{
-			DBGPRINT(RT_DEBUG_TRACE,("EDCA [#%d]: AIFSN CWmin CWmax  TXOP(us)  ACM\n", pEdcaParm->EdcaUpdateCount));
-			DBGPRINT(RT_DEBUG_TRACE,("     AC_BE      %2d     %2d     %2d      %4d     %d\n",
-									 pEdcaParm->Aifsn[0],
-									 pEdcaParm->Cwmin[0],
-									 pEdcaParm->Cwmax[0],
-									 pEdcaParm->Txop[0]<<5,
-									 pEdcaParm->bACM[0]));
-			DBGPRINT(RT_DEBUG_TRACE,("     AC_BK      %2d     %2d     %2d      %4d     %d\n",
-									 pEdcaParm->Aifsn[1],
-									 pEdcaParm->Cwmin[1],
-									 pEdcaParm->Cwmax[1],
-									 pEdcaParm->Txop[1]<<5,
-									 pEdcaParm->bACM[1]));
-			DBGPRINT(RT_DEBUG_TRACE,("     AC_VI      %2d     %2d     %2d      %4d     %d\n",
-									 pEdcaParm->Aifsn[2],
-									 pEdcaParm->Cwmin[2],
-									 pEdcaParm->Cwmax[2],
-									 pEdcaParm->Txop[2]<<5,
-									 pEdcaParm->bACM[2]));
-			DBGPRINT(RT_DEBUG_TRACE,("     AC_VO      %2d     %2d     %2d      %4d     %d\n",
-									 pEdcaParm->Aifsn[3],
-									 pEdcaParm->Cwmin[3],
-									 pEdcaParm->Cwmax[3],
-									 pEdcaParm->Txop[3]<<5,
-									 pEdcaParm->bACM[3]));
-		}
-	}
-
-}
-
-/*
-	==========================================================================
-	Description:
-
-	IRQL = PASSIVE_LEVEL
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-VOID	AsicSetSlotTime(
-	IN PRTMP_ADAPTER pAd,
-	IN BOOLEAN bUseShortSlotTime)
-{
-	ULONG	SlotTime;
-	UINT32	RegValue = 0;
-
-#ifdef CONFIG_STA_SUPPORT
-	if (pAd->CommonCfg.Channel > 14)
-		bUseShortSlotTime = TRUE;
-#endif // CONFIG_STA_SUPPORT //
-
-	if (bUseShortSlotTime && OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_SHORT_SLOT_INUSED))
-		return;
-	else if ((!bUseShortSlotTime) && (!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_SHORT_SLOT_INUSED)))
-		return;
-
-	if (bUseShortSlotTime)
-		OPSTATUS_SET_FLAG(pAd, fOP_STATUS_SHORT_SLOT_INUSED);
-	else
-		OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_SHORT_SLOT_INUSED);
-
-	SlotTime = (bUseShortSlotTime)? 9 : 20;
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-		// force using short SLOT time for FAE to demo performance when TxBurst is ON
-		if (((pAd->StaActive.SupportedPhyInfo.bHtEnable == FALSE) && (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_WMM_INUSED)))
-#ifdef DOT11_N_SUPPORT
-			|| ((pAd->StaActive.SupportedPhyInfo.bHtEnable == TRUE) && (pAd->CommonCfg.BACapability.field.Policy == BA_NOTUSE))
-#endif // DOT11_N_SUPPORT //
-			)
-		{
-			// In this case, we will think it is doing Wi-Fi test
-			// And we will not set to short slot when bEnableTxBurst is TRUE.
-		}
-		else if (pAd->CommonCfg.bEnableTxBurst)
-		{
-			OPSTATUS_SET_FLAG(pAd, fOP_STATUS_SHORT_SLOT_INUSED);
-			SlotTime = 9;
-		}
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-	//
-	// For some reasons, always set it to short slot time.
-	//
-	// ToDo: Should consider capability with 11B
-	//
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-		if (pAd->StaCfg.BssType == BSS_ADHOC)
-		{
-			OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_SHORT_SLOT_INUSED);
-			SlotTime = 20;
-		}
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-	RTMP_IO_READ32(pAd, BKOFF_SLOT_CFG, &RegValue);
-	RegValue = RegValue & 0xFFFFFF00;
-
-	RegValue |= SlotTime;
-
-	RTMP_IO_WRITE32(pAd, BKOFF_SLOT_CFG, RegValue);
-}
-
-/*
-	========================================================================
-	Description:
-		Add Shared key information into ASIC.
-		Update shared key, TxMic and RxMic to Asic Shared key table
-		Update its cipherAlg to Asic Shared key Mode.
-
-    Return:
-	========================================================================
-*/
-VOID AsicAddSharedKeyEntry(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR		 BssIndex,
-	IN UCHAR		 KeyIdx,
-	IN UCHAR		 CipherAlg,
-	IN PUCHAR		 pKey,
-	IN PUCHAR		 pTxMic,
-	IN PUCHAR		 pRxMic)
-{
-	ULONG offset; //, csr0;
-	SHAREDKEY_MODE_STRUC csr1;
-#ifdef RTMP_MAC_PCI
-	INT   i;
-#endif // RTMP_MAC_PCI //
-
-	DBGPRINT(RT_DEBUG_TRACE, ("AsicAddSharedKeyEntry BssIndex=%d, KeyIdx=%d\n", BssIndex,KeyIdx));
-//============================================================================================
-
-	DBGPRINT(RT_DEBUG_TRACE,("AsicAddSharedKeyEntry: %s key #%d\n", CipherName[CipherAlg], BssIndex*4 + KeyIdx));
-	DBGPRINT_RAW(RT_DEBUG_TRACE, ("		Key = %02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x\n",
-		pKey[0],pKey[1],pKey[2],pKey[3],pKey[4],pKey[5],pKey[6],pKey[7],pKey[8],pKey[9],pKey[10],pKey[11],pKey[12],pKey[13],pKey[14],pKey[15]));
-	if (pRxMic)
-	{
-		DBGPRINT_RAW(RT_DEBUG_TRACE, ("		Rx MIC Key = %02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x\n",
-			pRxMic[0],pRxMic[1],pRxMic[2],pRxMic[3],pRxMic[4],pRxMic[5],pRxMic[6],pRxMic[7]));
-	}
-	if (pTxMic)
-	{
-		DBGPRINT_RAW(RT_DEBUG_TRACE, ("		Tx MIC Key = %02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x\n",
-			pTxMic[0],pTxMic[1],pTxMic[2],pTxMic[3],pTxMic[4],pTxMic[5],pTxMic[6],pTxMic[7]));
-	}
-//============================================================================================
-	//
-	// fill key material - key + TX MIC + RX MIC
-	//
-#ifdef RTMP_MAC_PCI
-	offset = SHARED_KEY_TABLE_BASE + (4*BssIndex + KeyIdx)*HW_KEY_ENTRY_SIZE;
-	for (i=0; i<MAX_LEN_OF_SHARE_KEY; i++)
-	{
-		RTMP_IO_WRITE8(pAd, offset + i, pKey[i]);
-	}
-
-	offset += MAX_LEN_OF_SHARE_KEY;
-	if (pTxMic)
-	{
-		for (i=0; i<8; i++)
-		{
-			RTMP_IO_WRITE8(pAd, offset + i, pTxMic[i]);
-		}
-	}
-
-	offset += 8;
-	if (pRxMic)
-	{
-		for (i=0; i<8; i++)
-		{
-			RTMP_IO_WRITE8(pAd, offset + i, pRxMic[i]);
-		}
-	}
-#endif // RTMP_MAC_PCI //
-
-
-	//
-	// Update cipher algorithm. WSTA always use BSS0
-	//
-	RTMP_IO_READ32(pAd, SHARED_KEY_MODE_BASE+4*(BssIndex/2), &csr1.word);
-	DBGPRINT(RT_DEBUG_TRACE,("Read: SHARED_KEY_MODE_BASE at this Bss[%d] KeyIdx[%d]= 0x%x \n", BssIndex,KeyIdx, csr1.word));
-	if ((BssIndex%2) == 0)
-	{
-		if (KeyIdx == 0)
-			csr1.field.Bss0Key0CipherAlg = CipherAlg;
-		else if (KeyIdx == 1)
-			csr1.field.Bss0Key1CipherAlg = CipherAlg;
-		else if (KeyIdx == 2)
-			csr1.field.Bss0Key2CipherAlg = CipherAlg;
-		else
-			csr1.field.Bss0Key3CipherAlg = CipherAlg;
-	}
-	else
-	{
-		if (KeyIdx == 0)
-			csr1.field.Bss1Key0CipherAlg = CipherAlg;
-		else if (KeyIdx == 1)
-			csr1.field.Bss1Key1CipherAlg = CipherAlg;
-		else if (KeyIdx == 2)
-			csr1.field.Bss1Key2CipherAlg = CipherAlg;
-		else
-			csr1.field.Bss1Key3CipherAlg = CipherAlg;
-	}
-	DBGPRINT(RT_DEBUG_TRACE,("Write: SHARED_KEY_MODE_BASE at this Bss[%d] = 0x%x \n", BssIndex, csr1.word));
-	RTMP_IO_WRITE32(pAd, SHARED_KEY_MODE_BASE+4*(BssIndex/2), csr1.word);
-
-}
-
-//	IRQL = DISPATCH_LEVEL
-VOID AsicRemoveSharedKeyEntry(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR		 BssIndex,
-	IN UCHAR		 KeyIdx)
-{
-	//ULONG SecCsr0;
-	SHAREDKEY_MODE_STRUC csr1;
-
-	DBGPRINT(RT_DEBUG_TRACE,("AsicRemoveSharedKeyEntry: #%d \n", BssIndex*4 + KeyIdx));
-
-	RTMP_IO_READ32(pAd, SHARED_KEY_MODE_BASE+4*(BssIndex/2), &csr1.word);
-	if ((BssIndex%2) == 0)
-	{
-		if (KeyIdx == 0)
-			csr1.field.Bss0Key0CipherAlg = 0;
-		else if (KeyIdx == 1)
-			csr1.field.Bss0Key1CipherAlg = 0;
-		else if (KeyIdx == 2)
-			csr1.field.Bss0Key2CipherAlg = 0;
-		else
-			csr1.field.Bss0Key3CipherAlg = 0;
-	}
-	else
-	{
-		if (KeyIdx == 0)
-			csr1.field.Bss1Key0CipherAlg = 0;
-		else if (KeyIdx == 1)
-			csr1.field.Bss1Key1CipherAlg = 0;
-		else if (KeyIdx == 2)
-			csr1.field.Bss1Key2CipherAlg = 0;
-		else
-			csr1.field.Bss1Key3CipherAlg = 0;
-	}
-	DBGPRINT(RT_DEBUG_TRACE,("Write: SHARED_KEY_MODE_BASE at this Bss[%d] = 0x%x \n", BssIndex, csr1.word));
-	RTMP_IO_WRITE32(pAd, SHARED_KEY_MODE_BASE+4*(BssIndex/2), csr1.word);
-	ASSERT(BssIndex < 4);
-	ASSERT(KeyIdx < 4);
-
-}
-
-
-VOID AsicUpdateWCIDAttribute(
-	IN PRTMP_ADAPTER pAd,
-	IN USHORT		WCID,
-	IN UCHAR		BssIndex,
-	IN UCHAR        CipherAlg,
-	IN BOOLEAN		bUsePairewiseKeyTable)
-{
-	ULONG   WCIDAttri = 0, offset;
-
-	//
-	// Update WCID attribute.
-	// Only TxKey could update WCID attribute.
-	//
-	offset = MAC_WCID_ATTRIBUTE_BASE + (WCID * HW_WCID_ATTRI_SIZE);
-	WCIDAttri = (BssIndex << 4) | (CipherAlg << 1) | (bUsePairewiseKeyTable);
-	RTMP_IO_WRITE32(pAd, offset, WCIDAttri);
-}
-
-VOID AsicUpdateWCIDIVEIV(
-	IN PRTMP_ADAPTER pAd,
-	IN USHORT		WCID,
-	IN ULONG        uIV,
-	IN ULONG        uEIV)
-{
-	ULONG	offset;
-
-	offset = MAC_IVEIV_TABLE_BASE + (WCID * HW_IVEIV_ENTRY_SIZE);
-
-	RTMP_IO_WRITE32(pAd, offset, uIV);
-	RTMP_IO_WRITE32(pAd, offset + 4, uEIV);
-}
-
-VOID AsicUpdateRxWCIDTable(
-	IN PRTMP_ADAPTER pAd,
-	IN USHORT		WCID,
-	IN PUCHAR        pAddr)
-{
-	ULONG offset;
-	ULONG Addr;
-
-	offset = MAC_WCID_BASE + (WCID * HW_WCID_ENTRY_SIZE);
-	Addr = pAddr[0] + (pAddr[1] << 8) +(pAddr[2] << 16) +(pAddr[3] << 24);
-	RTMP_IO_WRITE32(pAd, offset, Addr);
-	Addr = pAddr[4] + (pAddr[5] << 8);
-	RTMP_IO_WRITE32(pAd, offset + 4, Addr);
-}
-
-
-/*
-    ========================================================================
-
-    Routine Description:
-        Set Cipher Key, Cipher algorithm, IV/EIV to Asic
-
-    Arguments:
-        pAd                     Pointer to our adapter
-        WCID                    WCID Entry number.
-        BssIndex                BSSID index, station or none multiple BSSID support
-                                this value should be 0.
-        KeyIdx                  This KeyIdx will set to IV's KeyID if bTxKey enabled
-        pCipherKey              Pointer to Cipher Key.
-        bUsePairewiseKeyTable   TRUE means saved the key in SharedKey table,
-                                otherwise PairewiseKey table
-        bTxKey                  This is the transmit key if enabled.
-
-    Return Value:
-        None
-
-    Note:
-        This routine will set the relative key stuff to Asic including WCID attribute,
-        Cipher Key, Cipher algorithm and IV/EIV.
-
-        IV/EIV will be update if this CipherKey is the transmission key because
-        ASIC will base on IV's KeyID value to select Cipher Key.
-
-        If bTxKey sets to FALSE, this is not the TX key, but it could be
-        RX key
-
-	For AP mode bTxKey must be always set to TRUE.
-    ========================================================================
-*/
-VOID AsicAddKeyEntry(
-	IN PRTMP_ADAPTER pAd,
-	IN USHORT		WCID,
-	IN UCHAR		BssIndex,
-	IN UCHAR		KeyIdx,
-	IN PCIPHER_KEY	pCipherKey,
-	IN BOOLEAN		bUsePairewiseKeyTable,
-	IN BOOLEAN		bTxKey)
-{
-	ULONG	offset;
-//	ULONG   WCIDAttri = 0;
-	UCHAR	IV4 = 0;
-	PUCHAR		pKey = pCipherKey->Key;
-//	ULONG		KeyLen = pCipherKey->KeyLen;
-	PUCHAR		pTxMic = pCipherKey->TxMic;
-	PUCHAR		pRxMic = pCipherKey->RxMic;
-	PUCHAR		pTxtsc = pCipherKey->TxTsc;
-	UCHAR		CipherAlg = pCipherKey->CipherAlg;
-	SHAREDKEY_MODE_STRUC csr1;
-#ifdef RTMP_MAC_PCI
-	UCHAR		i;
-#endif // RTMP_MAC_PCI //
-
-//	ASSERT(KeyLen <= MAX_LEN_OF_PEER_KEY);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("==> AsicAddKeyEntry\n"));
-	//
-	// 1.) decide key table offset
-	//
-	if (bUsePairewiseKeyTable)
-		offset = PAIRWISE_KEY_TABLE_BASE + (WCID * HW_KEY_ENTRY_SIZE);
-	else
-		offset = SHARED_KEY_TABLE_BASE + (4 * BssIndex + KeyIdx) * HW_KEY_ENTRY_SIZE;
-
-	//
-	// 2.) Set Key to Asic
-	//
-	//for (i = 0; i < KeyLen; i++)
-#ifdef RTMP_MAC_PCI
-	for (i = 0; i < MAX_LEN_OF_PEER_KEY; i++)
-	{
-		RTMP_IO_WRITE8(pAd, offset + i, pKey[i]);
-	}
-	offset += MAX_LEN_OF_PEER_KEY;
-
-	//
-	// 3.) Set MIC key if available
-	//
-	if (pTxMic)
-	{
-		for (i = 0; i < 8; i++)
-		{
-			RTMP_IO_WRITE8(pAd, offset + i, pTxMic[i]);
-		}
-	}
-	offset += LEN_TKIP_TXMICK;
-
-	if (pRxMic)
-	{
-		for (i = 0; i < 8; i++)
-		{
-			RTMP_IO_WRITE8(pAd, offset + i, pRxMic[i]);
-		}
-	}
-#endif // RTMP_MAC_PCI //
-
-
-	//
-	// 4.) Modify IV/EIV if needs
-	//     This will force Asic to use this key ID by setting IV.
-	//
-	if (bTxKey)
-	{
-#ifdef RTMP_MAC_PCI
-		offset = MAC_IVEIV_TABLE_BASE + (WCID * HW_IVEIV_ENTRY_SIZE);
-		//
-		// Write IV
-		//
-		RTMP_IO_WRITE8(pAd, offset, pTxtsc[1]);
-		RTMP_IO_WRITE8(pAd, offset + 1, ((pTxtsc[1] | 0x20) & 0x7f));
-		RTMP_IO_WRITE8(pAd, offset + 2, pTxtsc[0]);
-
-		IV4 = (KeyIdx << 6);
-		if ((CipherAlg == CIPHER_TKIP) || (CipherAlg == CIPHER_TKIP_NO_MIC) ||(CipherAlg == CIPHER_AES))
-			IV4 |= 0x20;  // turn on extension bit means EIV existence
-
-		RTMP_IO_WRITE8(pAd, offset + 3, IV4);
-
-		//
-		// Write EIV
-		//
-		offset += 4;
-		for (i = 0; i < 4; i++)
-		{
-			RTMP_IO_WRITE8(pAd, offset + i, pTxtsc[i + 2]);
-		}
-#endif // RTMP_MAC_PCI //
-
-		AsicUpdateWCIDAttribute(pAd, WCID, BssIndex, CipherAlg, bUsePairewiseKeyTable);
-	}
-
-	if (!bUsePairewiseKeyTable)
-	{
-		//
-		// Only update the shared key security mode
-		//
-		RTMP_IO_READ32(pAd, SHARED_KEY_MODE_BASE + 4 * (BssIndex / 2), &csr1.word);
-		if ((BssIndex % 2) == 0)
-		{
-			if (KeyIdx == 0)
-				csr1.field.Bss0Key0CipherAlg = CipherAlg;
-			else if (KeyIdx == 1)
-				csr1.field.Bss0Key1CipherAlg = CipherAlg;
-			else if (KeyIdx == 2)
-				csr1.field.Bss0Key2CipherAlg = CipherAlg;
-			else
-				csr1.field.Bss0Key3CipherAlg = CipherAlg;
-		}
-		else
-		{
-			if (KeyIdx == 0)
-				csr1.field.Bss1Key0CipherAlg = CipherAlg;
-			else if (KeyIdx == 1)
-				csr1.field.Bss1Key1CipherAlg = CipherAlg;
-			else if (KeyIdx == 2)
-				csr1.field.Bss1Key2CipherAlg = CipherAlg;
-			else
-				csr1.field.Bss1Key3CipherAlg = CipherAlg;
-		}
-		RTMP_IO_WRITE32(pAd, SHARED_KEY_MODE_BASE + 4 * (BssIndex / 2), csr1.word);
-	}
-
-	DBGPRINT(RT_DEBUG_TRACE, ("<== AsicAddKeyEntry\n"));
-}
-
-
-/*
-	========================================================================
-	Description:
-		Add Pair-wise key material into ASIC.
-		Update pairwise key, TxMic and RxMic to Asic Pair-wise key table
-
-    Return:
-	========================================================================
-*/
-VOID AsicAddPairwiseKeyEntry(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR        pAddr,
-	IN UCHAR		WCID,
-	IN CIPHER_KEY		 *pCipherKey)
-{
-	INT i;
-	ULONG		offset;
-	PUCHAR		 pKey = pCipherKey->Key;
-	PUCHAR		 pTxMic = pCipherKey->TxMic;
-	PUCHAR		 pRxMic = pCipherKey->RxMic;
-#ifdef DBG
-	UCHAR		CipherAlg = pCipherKey->CipherAlg;
-#endif // DBG //
-
-	// EKEY
-	offset = PAIRWISE_KEY_TABLE_BASE + (WCID * HW_KEY_ENTRY_SIZE);
-#ifdef RTMP_MAC_PCI
-	for (i=0; i<MAX_LEN_OF_PEER_KEY; i++)
-	{
-		RTMP_IO_WRITE8(pAd, offset + i, pKey[i]);
-	}
-#endif // RTMP_MAC_PCI //
-	for (i=0; i<MAX_LEN_OF_PEER_KEY; i+=4)
-	{
-		UINT32 Value;
-		RTMP_IO_READ32(pAd, offset + i, &Value);
-	}
-
-	offset += MAX_LEN_OF_PEER_KEY;
-
-	//  MIC KEY
-	if (pTxMic)
-	{
-#ifdef RTMP_MAC_PCI
-		for (i=0; i<8; i++)
-		{
-			RTMP_IO_WRITE8(pAd, offset+i, pTxMic[i]);
-		}
-#endif // RTMP_MAC_PCI //
-	}
-	offset += 8;
-	if (pRxMic)
-	{
-#ifdef RTMP_MAC_PCI
-		for (i=0; i<8; i++)
-		{
-			RTMP_IO_WRITE8(pAd, offset+i, pRxMic[i]);
-		}
-#endif // RTMP_MAC_PCI //
-	}
-
-	DBGPRINT(RT_DEBUG_TRACE,("AsicAddPairwiseKeyEntry: WCID #%d Alg=%s\n",WCID, CipherName[CipherAlg]));
-	DBGPRINT(RT_DEBUG_TRACE,("	Key = %02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x\n",
-		pKey[0],pKey[1],pKey[2],pKey[3],pKey[4],pKey[5],pKey[6],pKey[7],pKey[8],pKey[9],pKey[10],pKey[11],pKey[12],pKey[13],pKey[14],pKey[15]));
-	if (pRxMic)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("	Rx MIC Key = %02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x\n",
-			pRxMic[0],pRxMic[1],pRxMic[2],pRxMic[3],pRxMic[4],pRxMic[5],pRxMic[6],pRxMic[7]));
-	}
-	if (pTxMic)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("	Tx MIC Key = %02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x\n",
-			pTxMic[0],pTxMic[1],pTxMic[2],pTxMic[3],pTxMic[4],pTxMic[5],pTxMic[6],pTxMic[7]));
-	}
-}
-/*
-	========================================================================
-	Description:
-		Remove Pair-wise key material from ASIC.
-
-    Return:
-	========================================================================
-*/
-VOID AsicRemovePairwiseKeyEntry(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR		 BssIdx,
-	IN UCHAR		 Wcid)
-{
-	ULONG		WCIDAttri;
-	USHORT		offset;
-
-	// re-set the entry's WCID attribute as OPEN-NONE.
-	offset = MAC_WCID_ATTRIBUTE_BASE + (Wcid * HW_WCID_ATTRI_SIZE);
-	WCIDAttri = (BssIdx<<4) | PAIRWISEKEYTABLE;
-	RTMP_IO_WRITE32(pAd, offset, WCIDAttri);
-}
-
-BOOLEAN AsicSendCommandToMcu(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR		 Command,
-	IN UCHAR		 Token,
-	IN UCHAR		 Arg0,
-	IN UCHAR		 Arg1)
-{
-
-
-	if (pAd->chipOps.sendCommandToMcu)
-		pAd->chipOps.sendCommandToMcu(pAd, Command, Token, Arg0, Arg1);
-
-	return TRUE;
-}
-
-
-VOID AsicSetRxAnt(
-	IN PRTMP_ADAPTER	pAd,
-	IN UCHAR			Ant)
-{
-#ifdef RT33xx
-	RT33xxSetRxAnt(pAd, Ant);
-#else
-#ifdef RT30xx
-	/* RT3572 ATE need not to do this. */
-	RT30xxSetRxAnt(pAd, Ant);
-#endif // RT30xx //
-#endif // RT33xx //
-}
-
-
-VOID AsicTurnOffRFClk(
-	IN PRTMP_ADAPTER pAd,
-	IN	UCHAR		Channel)
-{
-	if (pAd->chipOps.AsicRfTurnOff)
-	{
-		pAd->chipOps.AsicRfTurnOff(pAd);
-	}
-	else
-	{
-		// RF R2 bit 18 = 0
-		UINT32			R1 = 0, R2 = 0, R3 = 0;
-		UCHAR			index;
-		RTMP_RF_REGS	*RFRegTable;
-
-		RFRegTable = RF2850RegTable;
-
-		switch (pAd->RfIcType)
-		{
-			case RFIC_2820:
-			case RFIC_2850:
-			case RFIC_2720:
-			case RFIC_2750:
-
-				for (index = 0; index < NUM_OF_2850_CHNL; index++)
-				{
-					if (Channel == RFRegTable[index].Channel)
-					{
-						R1 = RFRegTable[index].R1 & 0xffffdfff;
-						R2 = RFRegTable[index].R2 & 0xfffbffff;
-						R3 = RFRegTable[index].R3 & 0xfff3ffff;
-
-						RTMP_RF_IO_WRITE32(pAd, R1);
-						RTMP_RF_IO_WRITE32(pAd, R2);
-
-						// Program R1b13 to 1, R3/b18,19 to 0, R2b18 to 0.
-						// Set RF R2 bit18=0, R3 bit[18:19]=0
-						//if (pAd->StaCfg.bRadio == FALSE)
-						if (1)
-						{
-							RTMP_RF_IO_WRITE32(pAd, R3);
-
-							DBGPRINT(RT_DEBUG_TRACE, ("AsicTurnOffRFClk#%d(RF=%d, ) , R2=0x%08x,  R3 = 0x%08x \n",
-								Channel, pAd->RfIcType, R2, R3));
-						}
-						else
-							DBGPRINT(RT_DEBUG_TRACE, ("AsicTurnOffRFClk#%d(RF=%d, ) , R2=0x%08x \n",
-								Channel, pAd->RfIcType, R2));
-						break;
-					}
-				}
-				break;
-
-			default:
-				break;
-		}
-	}
-}
-
-
-VOID AsicTurnOnRFClk(
-	IN PRTMP_ADAPTER pAd,
-	IN	UCHAR			Channel)
-{
-	// RF R2 bit 18 = 0
-	UINT32			R1 = 0, R2 = 0, R3 = 0;
-	UCHAR			index;
-	RTMP_RF_REGS	*RFRegTable;
-
-#ifdef PCIE_PS_SUPPORT
-	// The RF programming sequence is difference between 3xxx and 2xxx
-	if ((IS_RT3090(pAd) || IS_RT3572(pAd) || IS_RT3390(pAd)))
-	{
-		return;
-	}
-#endif // PCIE_PS_SUPPORT //
-
-	RFRegTable = RF2850RegTable;
-
-	switch (pAd->RfIcType)
-	{
-		case RFIC_2820:
-		case RFIC_2850:
-		case RFIC_2720:
-		case RFIC_2750:
-
-			for (index = 0; index < NUM_OF_2850_CHNL; index++)
-			{
-				if (Channel == RFRegTable[index].Channel)
-				{
-					R3 = pAd->LatchRfRegs.R3;
-					R3 &= 0xfff3ffff;
-					R3 |= 0x00080000;
-					RTMP_RF_IO_WRITE32(pAd, R3);
-
-					R1 = RFRegTable[index].R1;
-					RTMP_RF_IO_WRITE32(pAd, R1);
-
-					R2 = RFRegTable[index].R2;
-					if (pAd->Antenna.field.TxPath == 1)
-					{
-						R2 |= 0x4000;	// If TXpath is 1, bit 14 = 1;
-					}
-
-					if (pAd->Antenna.field.RxPath == 2)
-					{
-						R2 |= 0x40;	// write 1 to off Rxpath.
-					}
-					else if (pAd->Antenna.field.RxPath == 1)
-					{
-						R2 |= 0x20040;	// write 1 to off RxPath
-					}
-					RTMP_RF_IO_WRITE32(pAd, R2);
-
-					break;
-				}
-			}
-			break;
-
-		default:
-			break;
-	}
-
-	DBGPRINT(RT_DEBUG_TRACE, ("AsicTurnOnRFClk#%d(RF=%d, ) , R2=0x%08x\n",
-		Channel,
-		pAd->RfIcType,
-		R2));
-}
diff --git a/drivers/staging/rt3090/common/cmm_data.c b/drivers/staging/rt3090/common/cmm_data.c
deleted file mode 100644
index 634007163160..000000000000
--- a/drivers/staging/rt3090/common/cmm_data.c
+++ /dev/null
@@ -1,2763 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-    Module Name:
-	cmm_data.c
-
-    Abstract:
-
-    Revision History:
-    Who          When          What
-    ---------    ----------    ----------------------------------------------
- */
-
-#include "../rt_config.h"
-
-
-UCHAR	SNAP_802_1H[] = {0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00};
-UCHAR	SNAP_BRIDGE_TUNNEL[] = {0xaa, 0xaa, 0x03, 0x00, 0x00, 0xf8};
-// Add Cisco Aironet SNAP heade for CCX2 support
-UCHAR	SNAP_AIRONET[] = {0xaa, 0xaa, 0x03, 0x00, 0x40, 0x96, 0x00, 0x00};
-UCHAR	CKIP_LLC_SNAP[] = {0xaa, 0xaa, 0x03, 0x00, 0x40, 0x96, 0x00, 0x02};
-UCHAR	EAPOL_LLC_SNAP[]= {0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00, 0x88, 0x8e};
-UCHAR	EAPOL[] = {0x88, 0x8e};
-UCHAR   TPID[] = {0x81, 0x00}; /* VLAN related */
-
-UCHAR	IPX[] = {0x81, 0x37};
-UCHAR	APPLE_TALK[] = {0x80, 0xf3};
-UCHAR	RateIdToPlcpSignal[12] = {
-	 0, /* RATE_1 */	1, /* RATE_2 */		2, /* RATE_5_5 */	3, /* RATE_11 */	// see BBP spec
-	11, /* RATE_6 */   15, /* RATE_9 */    10, /* RATE_12 */   14, /* RATE_18 */	// see IEEE802.11a-1999 p.14
-	 9, /* RATE_24 */  13, /* RATE_36 */	8, /* RATE_48 */   12  /* RATE_54 */ }; // see IEEE802.11a-1999 p.14
-
-UCHAR	 OfdmSignalToRateId[16] = {
-	RATE_54,  RATE_54,	RATE_54,  RATE_54,	// OFDM PLCP Signal = 0,  1,  2,  3 respectively
-	RATE_54,  RATE_54,	RATE_54,  RATE_54,	// OFDM PLCP Signal = 4,  5,  6,  7 respectively
-	RATE_48,  RATE_24,	RATE_12,  RATE_6,	// OFDM PLCP Signal = 8,  9,  10, 11 respectively
-	RATE_54,  RATE_36,	RATE_18,  RATE_9,	// OFDM PLCP Signal = 12, 13, 14, 15 respectively
-};
-
-UCHAR	 OfdmRateToRxwiMCS[12] = {
-	0,  0,	0,  0,
-	0,  1,	2,  3,	// OFDM rate 6,9,12,18 = rxwi mcs 0,1,2,3
-	4,  5,	6,  7,	// OFDM rate 24,36,48,54 = rxwi mcs 4,5,6,7
-};
-UCHAR	 RxwiMCSToOfdmRate[12] = {
-	RATE_6,  RATE_9,	RATE_12,  RATE_18,
-	RATE_24,  RATE_36,	RATE_48,  RATE_54,	// OFDM rate 6,9,12,18 = rxwi mcs 0,1,2,3
-	4,  5,	6,  7,	// OFDM rate 24,36,48,54 = rxwi mcs 4,5,6,7
-};
-
-char*   MCSToMbps[] = {"1Mbps","2Mbps","5.5Mbps","11Mbps","06Mbps","09Mbps","12Mbps","18Mbps","24Mbps","36Mbps","48Mbps","54Mbps","MM-0","MM-1","MM-2","MM-3","MM-4","MM-5","MM-6","MM-7","MM-8","MM-9","MM-10","MM-11","MM-12","MM-13","MM-14","MM-15","MM-32","ee1","ee2","ee3"};
-
-UCHAR default_cwmin[]={CW_MIN_IN_BITS, CW_MIN_IN_BITS, CW_MIN_IN_BITS-1, CW_MIN_IN_BITS-2};
-//UCHAR default_cwmax[]={CW_MAX_IN_BITS, CW_MAX_IN_BITS, CW_MIN_IN_BITS, CW_MIN_IN_BITS-1};
-UCHAR default_sta_aifsn[]={3,7,2,2};
-
-UCHAR MapUserPriorityToAccessCategory[8] = {QID_AC_BE, QID_AC_BK, QID_AC_BK, QID_AC_BE, QID_AC_VI, QID_AC_VI, QID_AC_VO, QID_AC_VO};
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		API for MLME to transmit management frame to AP (BSS Mode)
-	or station (IBSS Mode)
-
-	Arguments:
-		pAd Pointer to our adapter
-		pData		Pointer to the outgoing 802.11 frame
-		Length		Size of outgoing management frame
-
-	Return Value:
-		NDIS_STATUS_FAILURE
-		NDIS_STATUS_PENDING
-		NDIS_STATUS_SUCCESS
-
-	IRQL = PASSIVE_LEVEL
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-NDIS_STATUS MiniportMMRequest(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			QueIdx,
-	IN	PUCHAR			pData,
-	IN	UINT			Length)
-{
-	PNDIS_PACKET	pPacket;
-	NDIS_STATUS	Status = NDIS_STATUS_SUCCESS;
-	ULONG			FreeNum;
-	UCHAR			rtmpHwHdr[TXINFO_SIZE + TXWI_SIZE]; //RTMP_HW_HDR_LEN];
-#ifdef RTMP_MAC_PCI
-	unsigned long	IrqFlags = 0;
-	UCHAR			IrqState;
-#endif // RTMP_MAC_PCI //
-	BOOLEAN			bUseDataQ = FALSE;
-	int			retryCnt = 0;
-
-	ASSERT(Length <= MGMT_DMA_BUFFER_SIZE);
-
-	if ((QueIdx & MGMT_USE_QUEUE_FLAG) == MGMT_USE_QUEUE_FLAG)
-	{
-		bUseDataQ = TRUE;
-		QueIdx &= (~MGMT_USE_QUEUE_FLAG);
-	}
-
-#ifdef RTMP_MAC_PCI
-	// 2860C use Tx Ring
-	IrqState = pAd->irq_disabled;
-	if (pAd->MACVersion == 0x28600100)
-	{
-		QueIdx = (bUseDataQ ==TRUE ? QueIdx : 3);
-		bUseDataQ = TRUE;
-	}
-	if (bUseDataQ && (!IrqState))
-		RTMP_IRQ_LOCK(&pAd->irq_lock, IrqFlags);
-#endif // RTMP_MAC_PCI //
-
-	do
-	{
-		// Reset is in progress, stop immediately
-		if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RESET_IN_PROGRESS) ||
-			 RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST)||
-			 !RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_START_UP))
-		{
-			Status = NDIS_STATUS_FAILURE;
-			break;
-		}
-
-		// Check Free priority queue
-		// Since we use PBF Queue2 for management frame.  Its corresponding DMA ring should be using TxRing.
-#ifdef RTMP_MAC_PCI
-		if (bUseDataQ)
-		{
-			retryCnt = MAX_DATAMM_RETRY;
-			// free Tx(QueIdx) resources
-			RTMPFreeTXDUponTxDmaDone(pAd, QueIdx);
-			FreeNum = GET_TXRING_FREENO(pAd, QueIdx);
-		}
-		else
-#endif // RTMP_MAC_PCI //
-		{
-			FreeNum = GET_MGMTRING_FREENO(pAd);
-		}
-
-		if ((FreeNum > 0))
-		{
-			// We need to reserve space for rtmp hardware header. i.e., TxWI for RT2860 and TxInfo+TxWI for RT2870
-			NdisZeroMemory(&rtmpHwHdr, (TXINFO_SIZE + TXWI_SIZE));
-			Status = RTMPAllocateNdisPacket(pAd, &pPacket, (PUCHAR)&rtmpHwHdr, (TXINFO_SIZE + TXWI_SIZE), pData, Length);
-			if (Status != NDIS_STATUS_SUCCESS)
-			{
-				DBGPRINT(RT_DEBUG_WARN, ("MiniportMMRequest (error:: can't allocate NDIS PACKET)\n"));
-				break;
-			}
-
-			//pAd->CommonCfg.MlmeTransmit.field.MODE = MODE_CCK;
-			//pAd->CommonCfg.MlmeRate = RATE_2;
-
-
-#ifdef RTMP_MAC_PCI
-			if (bUseDataQ)
-			{
-				Status = MlmeDataHardTransmit(pAd, QueIdx, pPacket);
-				retryCnt--;
-			}
-			else
-#endif // RTMP_MAC_PCI //
-				Status = MlmeHardTransmit(pAd, QueIdx, pPacket);
-			if (Status == NDIS_STATUS_SUCCESS)
-				retryCnt = 0;
-			else
-				RTMPFreeNdisPacket(pAd, pPacket);
-		}
-		else
-		{
-			pAd->RalinkCounters.MgmtRingFullCount++;
-#ifdef RTMP_MAC_PCI
-			if (bUseDataQ)
-			{
-				retryCnt--;
-				DBGPRINT(RT_DEBUG_TRACE, ("retryCnt %d\n", retryCnt));
-				if (retryCnt == 0)
-				{
-					DBGPRINT(RT_DEBUG_ERROR, ("Qidx(%d), not enough space in DataRing, MgmtRingFullCount=%ld!\n",
-											QueIdx, pAd->RalinkCounters.MgmtRingFullCount));
-				}
-			}
-#endif // RTMP_MAC_PCI //
-			DBGPRINT(RT_DEBUG_ERROR, ("Qidx(%d), not enough space in MgmtRing, MgmtRingFullCount=%ld!\n",
-										QueIdx, pAd->RalinkCounters.MgmtRingFullCount));
-
-
-
-		}
-	} while (retryCnt > 0);
-
-
-#ifdef RTMP_MAC_PCI
-	if (bUseDataQ && (!IrqState))
-		RTMP_IRQ_UNLOCK(&pAd->irq_lock, IrqFlags);
-#endif // RTMP_MAC_PCI //
-
-	return Status;
-}
-
-
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		Copy frame from waiting queue into relative ring buffer and set
-	appropriate ASIC register to kick hardware transmit function
-
-	Arguments:
-		pAd Pointer to our adapter
-		pBuffer		Pointer to	memory of outgoing frame
-		Length		Size of outgoing management frame
-
-	Return Value:
-		NDIS_STATUS_FAILURE
-		NDIS_STATUS_PENDING
-		NDIS_STATUS_SUCCESS
-
-	IRQL = PASSIVE_LEVEL
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-NDIS_STATUS MlmeHardTransmit(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			QueIdx,
-	IN	PNDIS_PACKET	pPacket)
-{
-	PACKET_INFO	PacketInfo;
-	PUCHAR			pSrcBufVA;
-	UINT			SrcBufLen;
-	PHEADER_802_11	pHeader_802_11;
-
-	if ((pAd->CommonCfg.RadarDetect.RDMode != RD_NORMAL_MODE)
-#ifdef CARRIER_DETECTION_SUPPORT
-#endif // CARRIER_DETECTION_SUPPORT //
-		)
-	{
-		return NDIS_STATUS_FAILURE;
-	}
-
-	RTMP_QueryPacketInfo(pPacket, &PacketInfo, &pSrcBufVA, &SrcBufLen);
-	if (pSrcBufVA == NULL)
-		return NDIS_STATUS_FAILURE;
-
-	pHeader_802_11 = (PHEADER_802_11) (pSrcBufVA + TXINFO_SIZE + TXWI_SIZE);
-
-
-#ifdef RTMP_MAC_PCI
-	if ( pAd->MACVersion == 0x28600100 )
-		return MlmeHardTransmitTxRing(pAd,QueIdx,pPacket);
-	else
-#endif // RTMP_MAC_PCI //
-		return MlmeHardTransmitMgmtRing(pAd,QueIdx,pPacket);
-
-}
-
-
-NDIS_STATUS MlmeHardTransmitMgmtRing(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR	QueIdx,
-	IN	PNDIS_PACKET	pPacket)
-{
-	PACKET_INFO	PacketInfo;
-	PUCHAR			pSrcBufVA;
-	UINT			SrcBufLen;
-	PHEADER_802_11	pHeader_802_11;
-	BOOLEAN			bAckRequired, bInsertTimestamp;
-	UCHAR			MlmeRate;
-	PTXWI_STRUC	pFirstTxWI;
-	MAC_TABLE_ENTRY	*pMacEntry = NULL;
-	UCHAR			PID;
-
-	RTMP_QueryPacketInfo(pPacket, &PacketInfo, &pSrcBufVA, &SrcBufLen);
-
-	// Make sure MGMT ring resource won't be used by other threads
-	RTMP_SEM_LOCK(&pAd->MgmtRingLock);
-	if (pSrcBufVA == NULL)
-	{
-		// The buffer shouldn't be NULL
-			RTMP_SEM_UNLOCK(&pAd->MgmtRingLock);
-		return NDIS_STATUS_FAILURE;
-	}
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-		// outgoing frame always wakeup PHY to prevent frame lost
-		if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE))
-			AsicForceWakeup(pAd, TRUE);
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-	pFirstTxWI = (PTXWI_STRUC)(pSrcBufVA +  TXINFO_SIZE);
-	pHeader_802_11 = (PHEADER_802_11) (pSrcBufVA + TXINFO_SIZE + TXWI_SIZE); //TXWI_SIZE);
-
-	if (pHeader_802_11->Addr1[0] & 0x01)
-	{
-		MlmeRate = pAd->CommonCfg.BasicMlmeRate;
-	}
-	else
-	{
-		MlmeRate = pAd->CommonCfg.MlmeRate;
-	}
-
-	// Verify Mlme rate for a / g bands.
-	if ((pAd->LatchRfRegs.Channel > 14) && (MlmeRate < RATE_6)) // 11A band
-		MlmeRate = RATE_6;
-
-	if ((pHeader_802_11->FC.Type == BTYPE_DATA) &&
-		(pHeader_802_11->FC.SubType == SUBTYPE_QOS_NULL))
-	{
-		pMacEntry = MacTableLookup(pAd, pHeader_802_11->Addr1);
-	}
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-		// Fixed W52 with Activity scan issue in ABG_MIXED and ABGN_MIXED mode.
-		if (pAd->CommonCfg.PhyMode == PHY_11ABG_MIXED
-#ifdef DOT11_N_SUPPORT
-			|| pAd->CommonCfg.PhyMode == PHY_11ABGN_MIXED
-#endif // DOT11_N_SUPPORT //
-		)
-		{
-			if (pAd->LatchRfRegs.Channel > 14)
-				pAd->CommonCfg.MlmeTransmit.field.MODE = 1;
-			else
-				pAd->CommonCfg.MlmeTransmit.field.MODE = 0;
-		}
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-	//
-	// Should not be hard code to set PwrMgmt to 0 (PWR_ACTIVE)
-	// Snice it's been set to 0 while on MgtMacHeaderInit
-	// By the way this will cause frame to be send on PWR_SAVE failed.
-	//
-	pHeader_802_11->FC.PwrMgmt = PWR_ACTIVE; // (pAd->StaCfg.Psm == PWR_SAVE);
-
-#ifdef CONFIG_STA_SUPPORT
-	//
-	// In WMM-UAPSD, mlme frame should be set psm as power saving but probe request frame
-	// Data-Null packets alse pass through MMRequest in RT2860, however, we hope control the psm bit to pass APSD
-//	if ((pHeader_802_11->FC.Type != BTYPE_DATA) && (pHeader_802_11->FC.Type != BTYPE_CNTL))
-	{
-		if ((pHeader_802_11->FC.SubType == SUBTYPE_ACTION) ||
-			((pHeader_802_11->FC.Type == BTYPE_DATA) &&
-			((pHeader_802_11->FC.SubType == SUBTYPE_QOS_NULL) ||
-			(pHeader_802_11->FC.SubType == SUBTYPE_NULL_FUNC))))
-		{
-			if (pAd->StaCfg.Psm == PWR_SAVE)
-				pHeader_802_11->FC.PwrMgmt = PWR_SAVE;
-			else
-				pHeader_802_11->FC.PwrMgmt = pAd->CommonCfg.bAPSDForcePowerSave;
-		}
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-
-
-
-
-	bInsertTimestamp = FALSE;
-	if (pHeader_802_11->FC.Type == BTYPE_CNTL) // must be PS-POLL
-	{
-#ifdef CONFIG_STA_SUPPORT
-		//Set PM bit in ps-poll, to fix WLK 1.2  PowerSaveMode_ext failure issue.
-		if ((pAd->OpMode == OPMODE_STA) && (pHeader_802_11->FC.SubType == SUBTYPE_PS_POLL))
-		{
-			pHeader_802_11->FC.PwrMgmt = PWR_SAVE;
-		}
-#endif // CONFIG_STA_SUPPORT //
-		bAckRequired = FALSE;
-	}
-	else // BTYPE_MGMT or BTYPE_DATA(must be NULL frame)
-	{
-		//pAd->Sequence++;
-		//pHeader_802_11->Sequence = pAd->Sequence;
-
-		if (pHeader_802_11->Addr1[0] & 0x01) // MULTICAST, BROADCAST
-		{
-			bAckRequired = FALSE;
-			pHeader_802_11->Duration = 0;
-		}
-		else
-		{
-			bAckRequired = TRUE;
-			pHeader_802_11->Duration = RTMPCalcDuration(pAd, MlmeRate, 14);
-			if ((pHeader_802_11->FC.SubType == SUBTYPE_PROBE_RSP) && (pHeader_802_11->FC.Type == BTYPE_MGMT))
-			{
-				bInsertTimestamp = TRUE;
-				bAckRequired = FALSE; // Disable ACK to prevent retry 0x1f for Probe Response
-			}
-			else if ((pHeader_802_11->FC.SubType == SUBTYPE_PROBE_REQ) && (pHeader_802_11->FC.Type == BTYPE_MGMT))
-			{
-				bAckRequired = FALSE; // Disable ACK to prevent retry 0x1f for Probe Request
-			}
-		}
-	}
-
-	pHeader_802_11->Sequence = pAd->Sequence++;
-	if (pAd->Sequence >0xfff)
-		pAd->Sequence = 0;
-
-	// Before radar detection done, mgmt frame can not be sent but probe req
-	// Because we need to use probe req to trigger driver to send probe req in passive scan
-	if ((pHeader_802_11->FC.SubType != SUBTYPE_PROBE_REQ)
-		&& (pAd->CommonCfg.bIEEE80211H == 1)
-		&& (pAd->CommonCfg.RadarDetect.RDMode != RD_NORMAL_MODE))
-	{
-		DBGPRINT(RT_DEBUG_ERROR,("MlmeHardTransmit --> radar detect not in normal mode !!!\n"));
-//		if (!IrqState)
-		RTMP_SEM_UNLOCK(&pAd->MgmtRingLock);
-		return (NDIS_STATUS_FAILURE);
-	}
-
-#ifdef RT_BIG_ENDIAN
-	RTMPFrameEndianChange(pAd, (PUCHAR)pHeader_802_11, DIR_WRITE, FALSE);
-#endif
-
-	//
-	// fill scatter-and-gather buffer list into TXD. Internally created NDIS PACKET
-	// should always has only one physical buffer, and the whole frame size equals
-	// to the first scatter buffer size
-	//
-
-	// Initialize TX Descriptor
-	// For inter-frame gap, the number is for this frame and next frame
-	// For MLME rate, we will fix as 2Mb to match other vendor's implement
-//	pAd->CommonCfg.MlmeTransmit.field.MODE = 1;
-
-// management frame doesn't need encryption. so use RESERVED_WCID no matter u are sending to specific wcid or not.
-	PID = PID_MGMT;
-
-
-	if (pMacEntry == NULL)
-	{
-		RTMPWriteTxWI(pAd, pFirstTxWI, FALSE, FALSE, bInsertTimestamp, FALSE, bAckRequired, FALSE,
-		0, RESERVED_WCID, (SrcBufLen - TXINFO_SIZE - TXWI_SIZE), PID, 0,  (UCHAR)pAd->CommonCfg.MlmeTransmit.field.MCS, IFS_BACKOFF, FALSE, &pAd->CommonCfg.MlmeTransmit);
-	}
-	else
-	{
-		/* dont use low rate to send QoS Null data frame */
-		RTMPWriteTxWI(pAd, pFirstTxWI, FALSE, FALSE,
-					bInsertTimestamp, FALSE, bAckRequired, FALSE,
-					0, pMacEntry->Aid, (SrcBufLen - TXINFO_SIZE - TXWI_SIZE),
-					pMacEntry->MaxHTPhyMode.field.MCS, 0,
-					(UCHAR)pMacEntry->MaxHTPhyMode.field.MCS,
-					IFS_BACKOFF, FALSE, &pMacEntry->MaxHTPhyMode);
-	}
-
-#ifdef RT_BIG_ENDIAN
-	RTMPWIEndianChange((PUCHAR)pFirstTxWI, TYPE_TXWI);
-#endif
-
-	// Now do hardware-depened kick out.
-	HAL_KickOutMgmtTx(pAd, QueIdx, pPacket, pSrcBufVA, SrcBufLen);
-
-	// Make sure to release MGMT ring resource
-//	if (!IrqState)
-		RTMP_SEM_UNLOCK(&pAd->MgmtRingLock);
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-/********************************************************************************
-
-	New DeQueue Procedures.
-
- ********************************************************************************/
-
-#define DEQUEUE_LOCK(lock, bIntContext, IrqFlags)				\
-			do{													\
-				if (bIntContext == FALSE)						\
-				RTMP_IRQ_LOCK((lock), IrqFlags);		\
-			}while(0)
-
-#define DEQUEUE_UNLOCK(lock, bIntContext, IrqFlags)				\
-			do{													\
-				if (bIntContext == FALSE)						\
-					RTMP_IRQ_UNLOCK((lock), IrqFlags);	\
-			}while(0)
-
-
-
-
-/*
-	========================================================================
-	Tx Path design algorithm:
-		Basically, we divide the packets into four types, Broadcast/Multicast, 11N Rate(AMPDU, AMSDU, Normal), B/G Rate(ARALINK, Normal),
-		Specific Packet Type. Following show the classification rule and policy for each kinds of packets.
-				Classification Rule=>
-					Multicast: (*addr1 & 0x01) == 0x01
-					Specific : bDHCPFrame, bARPFrame, bEAPOLFrame, etc.
-					11N Rate : If peer support HT
-								(1).AMPDU  -- If TXBA is negotiated.
-								(2).AMSDU  -- If AMSDU is capable for both peer and ourself.
-											*). AMSDU can embedded in a AMPDU, but now we didn't support it.
-								(3).Normal -- Other packets which send as 11n rate.
-
-					B/G Rate : If peer is b/g only.
-								(1).ARALINK-- If both of peer/us supprot Ralink proprietary Aggregation and the TxRate is large than RATE_6
-								(2).Normal -- Other packets which send as b/g rate.
-					Fragment:
-								The packet must be unicast, NOT A-RALINK, NOT A-MSDU, NOT 11n, then can consider about fragment.
-
-				Classified Packet Handle Rule=>
-					Multicast:
-								No ACK,			//pTxBlk->bAckRequired = FALSE;
-								No WMM,			//pTxBlk->bWMM = FALSE;
-								No piggyback,   //pTxBlk->bPiggyBack = FALSE;
-								Force LowRate,  //pTxBlk->bForceLowRate = TRUE;
-					Specific :	Basically, for specific packet, we should handle it specifically, but now all specific packets are use
-									the same policy to handle it.
-								Force LowRate,  //pTxBlk->bForceLowRate = TRUE;
-
-					11N Rate :
-								No piggyback,	//pTxBlk->bPiggyBack = FALSE;
-
-								(1).AMSDU
-									pTxBlk->bWMM = TRUE;
-								(2).AMPDU
-									pTxBlk->bWMM = TRUE;
-								(3).Normal
-
-					B/G Rate :
-								(1).ARALINK
-
-								(2).Normal
-	========================================================================
-*/
-static UCHAR TxPktClassification(
-	IN RTMP_ADAPTER *pAd,
-	IN PNDIS_PACKET  pPacket)
-{
-	UCHAR			TxFrameType = TX_UNKOWN_FRAME;
-	UCHAR			Wcid;
-	MAC_TABLE_ENTRY	*pMacEntry = NULL;
-#ifdef DOT11_N_SUPPORT
-	BOOLEAN			bHTRate = FALSE;
-#endif // DOT11_N_SUPPORT //
-
-	Wcid = RTMP_GET_PACKET_WCID(pPacket);
-	if (Wcid == MCAST_WCID)
-	{	// Handle for RA is Broadcast/Multicast Address.
-		return TX_MCAST_FRAME;
-	}
-
-	// Handle for unicast packets
-	pMacEntry = &pAd->MacTab.Content[Wcid];
-	if (RTMP_GET_PACKET_LOWRATE(pPacket))
-	{	// It's a specific packet need to force low rate, i.e., bDHCPFrame, bEAPOLFrame, bWAIFrame
-		TxFrameType = TX_LEGACY_FRAME;
-	}
-#ifdef DOT11_N_SUPPORT
-	else if (IS_HT_RATE(pMacEntry))
-	{	// it's a 11n capable packet
-
-		// Depends on HTPhyMode to check if the peer support the HTRate transmission.
-		//	Currently didn't support A-MSDU embedded in A-MPDU
-		bHTRate = TRUE;
-		if (RTMP_GET_PACKET_MOREDATA(pPacket) || (pMacEntry->PsMode == PWR_SAVE))
-			TxFrameType = TX_LEGACY_FRAME;
-#ifdef UAPSD_AP_SUPPORT
-		else if (RTMP_GET_PACKET_EOSP(pPacket))
-			TxFrameType = TX_LEGACY_FRAME;
-#endif // UAPSD_AP_SUPPORT //
-		else if((pMacEntry->TXBAbitmap & (1<<(RTMP_GET_PACKET_UP(pPacket)))) != 0)
-			return TX_AMPDU_FRAME;
-		else if(CLIENT_STATUS_TEST_FLAG(pMacEntry, fCLIENT_STATUS_AMSDU_INUSED))
-			return TX_AMSDU_FRAME;
-		else
-			TxFrameType = TX_LEGACY_FRAME;
-	}
-#endif // DOT11_N_SUPPORT //
-	else
-	{	// it's a legacy b/g packet.
-		if ((CLIENT_STATUS_TEST_FLAG(pMacEntry, fCLIENT_STATUS_AGGREGATION_CAPABLE) && pAd->CommonCfg.bAggregationCapable) &&
-			(RTMP_GET_PACKET_TXRATE(pPacket) >= RATE_6) &&
-			(!(OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_WMM_INUSED) && CLIENT_STATUS_TEST_FLAG(pMacEntry, fCLIENT_STATUS_WMM_CAPABLE))))
-		{	// if peer support Ralink Aggregation, we use it.
-			TxFrameType = TX_RALINK_FRAME;
-		}
-		else
-		{
-			TxFrameType = TX_LEGACY_FRAME;
-		}
-	}
-
-	// Currently, our fragment only support when a unicast packet send as NOT-ARALINK, NOT-AMSDU and NOT-AMPDU.
-	if ((RTMP_GET_PACKET_FRAGMENTS(pPacket) > 1) && (TxFrameType == TX_LEGACY_FRAME))
-		TxFrameType = TX_FRAG_FRAME;
-
-	return TxFrameType;
-}
-
-
-BOOLEAN RTMP_FillTxBlkInfo(
-	IN RTMP_ADAPTER *pAd,
-	IN TX_BLK *pTxBlk)
-{
-	PACKET_INFO			PacketInfo;
-	PNDIS_PACKET		pPacket;
-	PMAC_TABLE_ENTRY	pMacEntry = NULL;
-
-	pPacket = pTxBlk->pPacket;
-	RTMP_QueryPacketInfo(pPacket, &PacketInfo, &pTxBlk->pSrcBufHeader, &pTxBlk->SrcBufLen);
-
-	pTxBlk->Wcid				= RTMP_GET_PACKET_WCID(pPacket);
-	pTxBlk->apidx				= RTMP_GET_PACKET_IF(pPacket);
-	pTxBlk->UserPriority		= RTMP_GET_PACKET_UP(pPacket);
-	pTxBlk->FrameGap = IFS_HTTXOP;		// ASIC determine Frame Gap
-
-	if (RTMP_GET_PACKET_CLEAR_EAP_FRAME(pTxBlk->pPacket))
-		TX_BLK_SET_FLAG(pTxBlk, fTX_bClearEAPFrame);
-	else
-		TX_BLK_CLEAR_FLAG(pTxBlk, fTX_bClearEAPFrame);
-
-	// Default to clear this flag
-	TX_BLK_CLEAR_FLAG(pTxBlk, fTX_bForceNonQoS);
-
-
-	if (pTxBlk->Wcid == MCAST_WCID)
-	{
-		pTxBlk->pMacEntry = NULL;
-		{
-#ifdef MCAST_RATE_SPECIFIC
-			PUCHAR pDA = GET_OS_PKT_DATAPTR(pPacket);
-			if (((*pDA & 0x01) == 0x01) && (*pDA != 0xff))
-				pTxBlk->pTransmit = &pAd->CommonCfg.MCastPhyMode;
-			else
-#endif // MCAST_RATE_SPECIFIC //
-				pTxBlk->pTransmit = &pAd->MacTab.Content[MCAST_WCID].HTPhyMode;
-		}
-
-		TX_BLK_CLEAR_FLAG(pTxBlk, fTX_bAckRequired);	// AckRequired = FALSE, when broadcast packet in Adhoc mode.
-		//TX_BLK_SET_FLAG(pTxBlk, fTX_bForceLowRate);
-		TX_BLK_CLEAR_FLAG(pTxBlk, fTX_bAllowFrag);
-		TX_BLK_CLEAR_FLAG(pTxBlk, fTX_bWMM);
-		if (RTMP_GET_PACKET_MOREDATA(pPacket))
-		{
-			TX_BLK_SET_FLAG(pTxBlk, fTX_bMoreData);
-		}
-
-	}
-	else
-	{
-		pTxBlk->pMacEntry = &pAd->MacTab.Content[pTxBlk->Wcid];
-		pTxBlk->pTransmit = &pTxBlk->pMacEntry->HTPhyMode;
-
-		pMacEntry = pTxBlk->pMacEntry;
-
-
-		// For all unicast packets, need Ack unless the Ack Policy is not set as NORMAL_ACK.
-		if (pAd->CommonCfg.AckPolicy[pTxBlk->QueIdx] != NORMAL_ACK)
-			TX_BLK_CLEAR_FLAG(pTxBlk, fTX_bAckRequired);
-		else
-			TX_BLK_SET_FLAG(pTxBlk, fTX_bAckRequired);
-
-#ifdef CONFIG_STA_SUPPORT
-		if ((pAd->OpMode == OPMODE_STA) &&
-			(ADHOC_ON(pAd)) &&
-			(RX_FILTER_TEST_FLAG(pAd, fRX_FILTER_ACCEPT_PROMISCUOUS)))
-		{
-			if(pAd->CommonCfg.PSPXlink)
-				TX_BLK_CLEAR_FLAG(pTxBlk, fTX_bAckRequired);
-		}
-#endif // CONFIG_STA_SUPPORT //
-
-		{
-
-#ifdef CONFIG_STA_SUPPORT
-			IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-			{
-
-				// If support WMM, enable it.
-				if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_WMM_INUSED) &&
-					CLIENT_STATUS_TEST_FLAG(pMacEntry, fCLIENT_STATUS_WMM_CAPABLE))
-					TX_BLK_SET_FLAG(pTxBlk, fTX_bWMM);
-
-//				if (pAd->StaCfg.bAutoTxRateSwitch)
-//					TX_BLK_SET_FLAG(pTxBlk, fTX_AutoRateSwitch);
-			}
-#endif // CONFIG_STA_SUPPORT //
-		}
-
-		if (pTxBlk->TxFrameType == TX_LEGACY_FRAME)
-		{
-			if ( (RTMP_GET_PACKET_LOWRATE(pPacket)) ||
-                ((pAd->OpMode == OPMODE_AP) && (pMacEntry->MaxHTPhyMode.field.MODE == MODE_CCK) && (pMacEntry->MaxHTPhyMode.field.MCS == RATE_1)))
-			{	// Specific packet, i.e., bDHCPFrame, bEAPOLFrame, bWAIFrame, need force low rate.
-				pTxBlk->pTransmit = &pAd->MacTab.Content[MCAST_WCID].HTPhyMode;
-#ifdef DOT11_N_SUPPORT
-				// Modify the WMM bit for ICV issue. If we have a packet with EOSP field need to set as 1, how to handle it???
-				if (IS_HT_STA(pTxBlk->pMacEntry) &&
-					(CLIENT_STATUS_TEST_FLAG(pMacEntry, fCLIENT_STATUS_RALINK_CHIPSET)) &&
-					((pAd->CommonCfg.bRdg == TRUE) && CLIENT_STATUS_TEST_FLAG(pMacEntry, fCLIENT_STATUS_RDG_CAPABLE)))
-				{
-					TX_BLK_CLEAR_FLAG(pTxBlk, fTX_bWMM);
-					TX_BLK_SET_FLAG(pTxBlk, fTX_bForceNonQoS);
-				}
-#endif // DOT11_N_SUPPORT //
-			}
-
-#ifdef DOT11_N_SUPPORT
-			if ( (IS_HT_RATE(pMacEntry) == FALSE) &&
-				(CLIENT_STATUS_TEST_FLAG(pMacEntry, fCLIENT_STATUS_PIGGYBACK_CAPABLE)))
-			{	// Currently piggy-back only support when peer is operate in b/g mode.
-				TX_BLK_SET_FLAG(pTxBlk, fTX_bPiggyBack);
-			}
-#endif // DOT11_N_SUPPORT //
-
-			if (RTMP_GET_PACKET_MOREDATA(pPacket))
-			{
-				TX_BLK_SET_FLAG(pTxBlk, fTX_bMoreData);
-			}
-#ifdef UAPSD_AP_SUPPORT
-			if (RTMP_GET_PACKET_EOSP(pPacket))
-			{
-				TX_BLK_SET_FLAG(pTxBlk, fTX_bWMM_UAPSD_EOSP);
-			}
-#endif // UAPSD_AP_SUPPORT //
-		}
-		else if (pTxBlk->TxFrameType == TX_FRAG_FRAME)
-		{
-			TX_BLK_SET_FLAG(pTxBlk, fTX_bAllowFrag);
-		}
-
-		pMacEntry->DebugTxCount++;
-	}
-
-	return TRUE;
-}
-
-
-BOOLEAN CanDoAggregateTransmit(
-	IN RTMP_ADAPTER *pAd,
-	IN NDIS_PACKET *pPacket,
-	IN TX_BLK		*pTxBlk)
-{
-
-	//DBGPRINT(RT_DEBUG_TRACE, ("Check if can do aggregation! TxFrameType=%d!\n", pTxBlk->TxFrameType));
-
-	if (RTMP_GET_PACKET_WCID(pPacket) == MCAST_WCID)
-		return FALSE;
-
-	if (RTMP_GET_PACKET_DHCP(pPacket) ||
-		RTMP_GET_PACKET_EAPOL(pPacket) ||
-		RTMP_GET_PACKET_WAI(pPacket))
-		return FALSE;
-
-	if ((pTxBlk->TxFrameType == TX_AMSDU_FRAME) &&
-		((pTxBlk->TotalFrameLen + GET_OS_PKT_LEN(pPacket))> (RX_BUFFER_AGGRESIZE - 100)))
-	{	// For AMSDU, allow the packets with total length < max-amsdu size
-		return FALSE;
-	}
-
-	if ((pTxBlk->TxFrameType == TX_RALINK_FRAME) &&
-		(pTxBlk->TxPacketList.Number == 2))
-	{	// For RALINK-Aggregation, allow two frames in one batch.
-		return FALSE;
-	}
-
-#ifdef CONFIG_STA_SUPPORT
-	if ((INFRA_ON(pAd)) && (pAd->OpMode == OPMODE_STA)) // must be unicast to AP
-		return TRUE;
-	else
-#endif // CONFIG_STA_SUPPORT //
-		return FALSE;
-
-}
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		To do the enqueue operation and extract the first item of waiting
-		list. If a number of available shared memory segments could meet
-		the request of extracted item, the extracted item will be fragmented
-		into shared memory segments.
-
-	Arguments:
-		pAd Pointer to our adapter
-		pQueue		Pointer to Waiting Queue
-
-	Return Value:
-		None
-
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-VOID RTMPDeQueuePacket(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  BOOLEAN         bIntContext,
-	IN  UCHAR			QIdx, /* BulkOutPipeId */
-	IN  UCHAR           Max_Tx_Packets)
-{
-	PQUEUE_ENTRY    pEntry = NULL;
-	PNDIS_PACKET	pPacket;
-	NDIS_STATUS     Status = NDIS_STATUS_SUCCESS;
-	UCHAR           Count=0;
-	PQUEUE_HEADER   pQueue;
-	ULONG           FreeNumber[NUM_OF_TX_RING];
-	UCHAR			QueIdx, sQIdx, eQIdx;
-	unsigned long	IrqFlags = 0;
-	BOOLEAN			hasTxDesc = FALSE;
-	TX_BLK			TxBlk;
-	TX_BLK			*pTxBlk;
-
-#ifdef DBG_DIAGNOSE
-	BOOLEAN			firstRound;
-	RtmpDiagStruct	*pDiagStruct = &pAd->DiagStruct;
-#endif
-
-
-	if (QIdx == NUM_OF_TX_RING)
-	{
-		sQIdx = 0;
-		eQIdx = 3;	// 4 ACs, start from 0.
-	}
-	else
-	{
-		sQIdx = eQIdx = QIdx;
-	}
-
-	for (QueIdx=sQIdx; QueIdx <= eQIdx; QueIdx++)
-	{
-		Count=0;
-
-		RTMP_START_DEQUEUE(pAd, QueIdx, IrqFlags);
-
-#ifdef DBG_DIAGNOSE
-		firstRound = ((QueIdx == 0) ? TRUE : FALSE);
-#endif // DBG_DIAGNOSE //
-
-		while (1)
-		{
-			if ((RTMP_TEST_FLAG(pAd, (fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS |
-										fRTMP_ADAPTER_RADIO_OFF |
-										fRTMP_ADAPTER_RESET_IN_PROGRESS |
-										fRTMP_ADAPTER_HALT_IN_PROGRESS |
-										fRTMP_ADAPTER_NIC_NOT_EXIST))))
-			{
-				RTMP_STOP_DEQUEUE(pAd, QueIdx, IrqFlags);
-				return;
-			}
-
-			if (Count >= Max_Tx_Packets)
-				break;
-
-			DEQUEUE_LOCK(&pAd->irq_lock, bIntContext, IrqFlags);
-			if (&pAd->TxSwQueue[QueIdx] == NULL)
-			{
-#ifdef DBG_DIAGNOSE
-				if (firstRound == TRUE)
-					pDiagStruct->TxSWQueCnt[pDiagStruct->ArrayCurIdx][0]++;
-#endif // DBG_DIAGNOSE //
-				DEQUEUE_UNLOCK(&pAd->irq_lock, bIntContext, IrqFlags);
-				break;
-			}
-
-#ifdef RTMP_MAC_PCI
-			FreeNumber[QueIdx] = GET_TXRING_FREENO(pAd, QueIdx);
-
-#ifdef DBG_DIAGNOSE
-			if (firstRound == TRUE)
-			{
-				UCHAR	txDescNumLevel, txSwQNumLevel;
-
-				txDescNumLevel = (TX_RING_SIZE - FreeNumber[QueIdx]); // Number of occupied hw desc.
-				txDescNumLevel = ((txDescNumLevel <=15) ? txDescNumLevel : 15);
-				pDiagStruct->TxDescCnt[pDiagStruct->ArrayCurIdx][txDescNumLevel]++;
-
-				txSwQNumLevel = ((pAd->TxSwQueue[QueIdx].Number <=7) ? pAd->TxSwQueue[QueIdx].Number : 8);
-				pDiagStruct->TxSWQueCnt[pDiagStruct->ArrayCurIdx][txSwQNumLevel]++;
-
-				firstRound = FALSE;
-			}
-#endif // DBG_DIAGNOSE //
-
-			if (FreeNumber[QueIdx] <= 5)
-			{
-				// free Tx(QueIdx) resources
-				RTMPFreeTXDUponTxDmaDone(pAd, QueIdx);
-				FreeNumber[QueIdx] = GET_TXRING_FREENO(pAd, QueIdx);
-			}
-#endif // RTMP_MAC_PCI //
-
-			// probe the Queue Head
-			pQueue = &pAd->TxSwQueue[QueIdx];
-			if ((pEntry = pQueue->Head) == NULL)
-			{
-				DEQUEUE_UNLOCK(&pAd->irq_lock, bIntContext, IrqFlags);
-				break;
-			}
-
-			pTxBlk = &TxBlk;
-			NdisZeroMemory((PUCHAR)pTxBlk, sizeof(TX_BLK));
-			//InitializeQueueHeader(&pTxBlk->TxPacketList);		// Didn't need it because we already memzero it.
-			pTxBlk->QueIdx = QueIdx;
-
-			pPacket = QUEUE_ENTRY_TO_PACKET(pEntry);
-
-
-			// Early check to make sure we have enoguh Tx Resource.
-			hasTxDesc = RTMP_HAS_ENOUGH_FREE_DESC(pAd, pTxBlk, FreeNumber[QueIdx], pPacket);
-			if (!hasTxDesc)
-			{
-				pAd->PrivateInfo.TxRingFullCnt++;
-
-				DEQUEUE_UNLOCK(&pAd->irq_lock, bIntContext, IrqFlags);
-
-				break;
-			}
-
-			pTxBlk->TxFrameType = TxPktClassification(pAd, pPacket);
-			pEntry = RemoveHeadQueue(pQueue);
-			pTxBlk->TotalFrameNum++;
-			pTxBlk->TotalFragNum += RTMP_GET_PACKET_FRAGMENTS(pPacket);	// The real fragment number maybe vary
-			pTxBlk->TotalFrameLen += GET_OS_PKT_LEN(pPacket);
-			pTxBlk->pPacket = pPacket;
-			InsertTailQueue(&pTxBlk->TxPacketList, PACKET_TO_QUEUE_ENTRY(pPacket));
-
-			if (pTxBlk->TxFrameType == TX_RALINK_FRAME || pTxBlk->TxFrameType == TX_AMSDU_FRAME)
-			{
-				// Enhance SW Aggregation Mechanism
-				if (NEED_QUEUE_BACK_FOR_AGG(pAd, QueIdx, FreeNumber[QueIdx], pTxBlk->TxFrameType))
-				{
-					InsertHeadQueue(pQueue, PACKET_TO_QUEUE_ENTRY(pPacket));
-					DEQUEUE_UNLOCK(&pAd->irq_lock, bIntContext, IrqFlags);
-					break;
-				}
-
-				do{
-					if((pEntry = pQueue->Head) == NULL)
-						break;
-
-					// For TX_AMSDU_FRAME/TX_RALINK_FRAME, Need to check if next pakcet can do aggregation.
-					pPacket = QUEUE_ENTRY_TO_PACKET(pEntry);
-					FreeNumber[QueIdx] = GET_TXRING_FREENO(pAd, QueIdx);
-					hasTxDesc = RTMP_HAS_ENOUGH_FREE_DESC(pAd, pTxBlk, FreeNumber[QueIdx], pPacket);
-					if ((hasTxDesc == FALSE) || (CanDoAggregateTransmit(pAd, pPacket, pTxBlk) == FALSE))
-						break;
-
-					//Remove the packet from the TxSwQueue and insert into pTxBlk
-					pEntry = RemoveHeadQueue(pQueue);
-					ASSERT(pEntry);
-					pPacket = QUEUE_ENTRY_TO_PACKET(pEntry);
-					pTxBlk->TotalFrameNum++;
-					pTxBlk->TotalFragNum += RTMP_GET_PACKET_FRAGMENTS(pPacket);	// The real fragment number maybe vary
-					pTxBlk->TotalFrameLen += GET_OS_PKT_LEN(pPacket);
-					InsertTailQueue(&pTxBlk->TxPacketList, PACKET_TO_QUEUE_ENTRY(pPacket));
-				}while(1);
-
-				if (pTxBlk->TxPacketList.Number == 1)
-					pTxBlk->TxFrameType = TX_LEGACY_FRAME;
-			}
-
-
-			Count += pTxBlk->TxPacketList.Number;
-
-
-				// Do HardTransmit now.
-#ifdef CONFIG_STA_SUPPORT
-			IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-				Status = STAHardTransmit(pAd, pTxBlk, QueIdx);
-#endif // CONFIG_STA_SUPPORT //
-
-#ifdef RTMP_MAC_PCI
-			DEQUEUE_UNLOCK(&pAd->irq_lock, bIntContext, IrqFlags);
-			// static rate also need NICUpdateFifoStaCounters() function.
-			//if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_TX_RATE_SWITCH_ENABLED))
-				NICUpdateFifoStaCounters(pAd);
-#endif // RTMP_MAC_PCI //
-
-		}
-
-		RTMP_STOP_DEQUEUE(pAd, QueIdx, IrqFlags);
-
-
-#ifdef BLOCK_NET_IF
-		if ((pAd->blockQueueTab[QueIdx].SwTxQueueBlockFlag == TRUE)
-			&& (pAd->TxSwQueue[QueIdx].Number < 1))
-		{
-			releaseNetIf(&pAd->blockQueueTab[QueIdx]);
-		}
-#endif // BLOCK_NET_IF //
-
-	}
-
-}
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		Calculates the duration which is required to transmit out frames
-	with given size and specified rate.
-
-	Arguments:
-		pAd	Pointer to our adapter
-		Rate			Transmit rate
-		Size			Frame size in units of byte
-
-	Return Value:
-		Duration number in units of usec
-
-	IRQL = PASSIVE_LEVEL
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-USHORT	RTMPCalcDuration(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			Rate,
-	IN	ULONG			Size)
-{
-	ULONG	Duration = 0;
-
-	if (Rate < RATE_FIRST_OFDM_RATE) // CCK
-	{
-		if ((Rate > RATE_1) && OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_SHORT_PREAMBLE_INUSED))
-			Duration = 96;	// 72+24 preamble+plcp
-		else
-			Duration = 192; // 144+48 preamble+plcp
-
-		Duration += (USHORT)((Size << 4) / RateIdTo500Kbps[Rate]);
-		if ((Size << 4) % RateIdTo500Kbps[Rate])
-			Duration ++;
-	}
-	else if (Rate <= RATE_LAST_OFDM_RATE)// OFDM rates
-	{
-		Duration = 20 + 6;		// 16+4 preamble+plcp + Signal Extension
-		Duration += 4 * (USHORT)((11 + Size * 4) / RateIdTo500Kbps[Rate]);
-		if ((11 + Size * 4) % RateIdTo500Kbps[Rate])
-			Duration += 4;
-	}
-	else	//mimo rate
-	{
-		Duration = 20 + 6;		// 16+4 preamble+plcp + Signal Extension
-	}
-
-	return (USHORT)Duration;
-}
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		Calculates the duration which is required to transmit out frames
-	with given size and specified rate.
-
-	Arguments:
-		pTxWI		Pointer to head of each MPDU to HW.
-		Ack		Setting for Ack requirement bit
-		Fragment	Setting for Fragment bit
-		RetryMode	Setting for retry mode
-		Ifs		Setting for IFS gap
-		Rate		Setting for transmit rate
-		Service		Setting for service
-		Length		Frame length
-		TxPreamble	Short or Long preamble when using CCK rates
-		QueIdx - 0-3, according to 802.11e/d4.4 June/2003
-
-	Return Value:
-		None
-
-	IRQL = PASSIVE_LEVEL
-	IRQL = DISPATCH_LEVEL
-
-    See also : BASmartHardTransmit()    !!!
-
-	========================================================================
-*/
-VOID RTMPWriteTxWI(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PTXWI_STRUC	pOutTxWI,
-	IN	BOOLEAN			FRAG,
-	IN	BOOLEAN			CFACK,
-	IN	BOOLEAN			InsTimestamp,
-	IN	BOOLEAN			AMPDU,
-	IN	BOOLEAN			Ack,
-	IN	BOOLEAN			NSeq,		// HW new a sequence.
-	IN	UCHAR			BASize,
-	IN	UCHAR			WCID,
-	IN	ULONG			Length,
-	IN	UCHAR			PID,
-	IN	UCHAR			TID,
-	IN	UCHAR			TxRate,
-	IN	UCHAR			Txopmode,
-	IN	BOOLEAN			CfAck,
-	IN	HTTRANSMIT_SETTING	*pTransmit)
-{
-	PMAC_TABLE_ENTRY	pMac = NULL;
-	TXWI_STRUC		TxWI;
-	PTXWI_STRUC	pTxWI;
-
-	if (WCID < MAX_LEN_OF_MAC_TABLE)
-		pMac = &pAd->MacTab.Content[WCID];
-
-	//
-	// Always use Long preamble before verifiation short preamble functionality works well.
-	// Todo: remove the following line if short preamble functionality works
-	//
-	OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_SHORT_PREAMBLE_INUSED);
-	NdisZeroMemory(&TxWI, TXWI_SIZE);
-	pTxWI = &TxWI;
-
-	pTxWI->FRAG= FRAG;
-
-	pTxWI->CFACK = CFACK;
-	pTxWI->TS= InsTimestamp;
-	pTxWI->AMPDU = AMPDU;
-	pTxWI->ACK = Ack;
-	pTxWI->txop= Txopmode;
-
-	pTxWI->NSEQ = NSeq;
-	// John tune the performace with Intel Client in 20 MHz performance
-#ifdef DOT11_N_SUPPORT
-	BASize = pAd->CommonCfg.TxBASize;
-	if (pAd->MACVersion == 0x28720200)
-	{
-		if( BASize >13 )
-			BASize =13;
-	}
-	else
-	{
-		if( BASize >7 )
-			BASize =7;
-	}
-	pTxWI->BAWinSize = BASize;
-	pTxWI->ShortGI = pTransmit->field.ShortGI;
-	pTxWI->STBC = pTransmit->field.STBC;
-#endif // DOT11_N_SUPPORT //
-
-	pTxWI->WirelessCliID = WCID;
-	pTxWI->MPDUtotalByteCount = Length;
-	pTxWI->PacketId = PID;
-
-	// If CCK or OFDM, BW must be 20
-	pTxWI->BW = (pTransmit->field.MODE <= MODE_OFDM) ? (BW_20) : (pTransmit->field.BW);
-#ifdef DOT11_N_SUPPORT
-#ifdef DOT11N_DRAFT3
-	if (pTxWI->BW)
-		pTxWI->BW = (pAd->CommonCfg.AddHTInfo.AddHtInfo.RecomWidth == 0) ? (BW_20) : (pTransmit->field.BW);
-#endif // DOT11N_DRAFT3 //
-#endif // DOT11_N_SUPPORT //
-
-	pTxWI->MCS = pTransmit->field.MCS;
-	pTxWI->PHYMODE = pTransmit->field.MODE;
-	pTxWI->CFACK = CfAck;
-
-#ifdef DOT11_N_SUPPORT
-	if (pMac)
-	{
-        if (pAd->CommonCfg.bMIMOPSEnable)
-        {
-		if ((pMac->MmpsMode == MMPS_DYNAMIC) && (pTransmit->field.MCS > 7))
-			{
-				// Dynamic MIMO Power Save Mode
-				pTxWI->MIMOps = 1;
-			}
-			else if (pMac->MmpsMode == MMPS_STATIC)
-			{
-				// Static MIMO Power Save Mode
-				if (pTransmit->field.MODE >= MODE_HTMIX && pTransmit->field.MCS > 7)
-				{
-					pTxWI->MCS = 7;
-					pTxWI->MIMOps = 0;
-				}
-			}
-        }
-		//pTxWI->MIMOps = (pMac->PsMode == PWR_MMPS)? 1:0;
-		if (pMac->bIAmBadAtheros && (pMac->WepStatus != Ndis802_11WEPDisabled))
-		{
-			pTxWI->MpduDensity = 7;
-		}
-		else
-		{
-		pTxWI->MpduDensity = pMac->MpduDensity;
-	}
-	}
-#endif // DOT11_N_SUPPORT //
-
-	pTxWI->PacketId = pTxWI->MCS;
-	NdisMoveMemory(pOutTxWI, &TxWI, sizeof(TXWI_STRUC));
-}
-
-
-VOID RTMPWriteTxWI_Data(
-	IN	PRTMP_ADAPTER		pAd,
-	IN	OUT PTXWI_STRUC		pTxWI,
-	IN	TX_BLK				*pTxBlk)
-{
-	HTTRANSMIT_SETTING	*pTransmit;
-	PMAC_TABLE_ENTRY	pMacEntry;
-#ifdef DOT11_N_SUPPORT
-	UCHAR				BASize;
-#endif // DOT11_N_SUPPORT //
-
-
-	ASSERT(pTxWI);
-
-	pTransmit = pTxBlk->pTransmit;
-	pMacEntry = pTxBlk->pMacEntry;
-
-
-	//
-	// Always use Long preamble before verifiation short preamble functionality works well.
-	// Todo: remove the following line if short preamble functionality works
-	//
-	OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_SHORT_PREAMBLE_INUSED);
-	NdisZeroMemory(pTxWI, TXWI_SIZE);
-
-	pTxWI->FRAG		= TX_BLK_TEST_FLAG(pTxBlk, fTX_bAllowFrag);
-	pTxWI->ACK		= TX_BLK_TEST_FLAG(pTxBlk, fTX_bAckRequired);
-	pTxWI->txop		= pTxBlk->FrameGap;
-
-#ifdef CONFIG_STA_SUPPORT
-#ifdef QOS_DLS_SUPPORT
-	if (pMacEntry &&
-		(pAd->StaCfg.BssType == BSS_INFRA) &&
-		(pMacEntry->ValidAsDls == TRUE))
-		pTxWI->WirelessCliID = BSSID_WCID;
-	else
-#endif // QOS_DLS_SUPPORT //
-#endif // CONFIG_STA_SUPPORT //
-	pTxWI->WirelessCliID		= pTxBlk->Wcid;
-
-	pTxWI->MPDUtotalByteCount	= pTxBlk->MpduHeaderLen + pTxBlk->SrcBufLen;
-	pTxWI->CFACK				= TX_BLK_TEST_FLAG(pTxBlk, fTX_bPiggyBack);
-
-	// If CCK or OFDM, BW must be 20
-	pTxWI->BW = (pTransmit->field.MODE <= MODE_OFDM) ? (BW_20) : (pTransmit->field.BW);
-#ifdef DOT11_N_SUPPORT
-#ifdef DOT11N_DRAFT3
-	if (pTxWI->BW)
-		pTxWI->BW = (pAd->CommonCfg.AddHTInfo.AddHtInfo.RecomWidth == 0) ? (BW_20) : (pTransmit->field.BW);
-#endif // DOT11N_DRAFT3 //
-	pTxWI->AMPDU	= ((pTxBlk->TxFrameType == TX_AMPDU_FRAME) ? TRUE : FALSE);
-
-	// John tune the performace with Intel Client in 20 MHz performance
-	BASize = pAd->CommonCfg.TxBASize;
-	if((pTxBlk->TxFrameType == TX_AMPDU_FRAME) && (pMacEntry))
-	{
-		UCHAR		RABAOriIdx = 0;	//The RA's BA Originator table index.
-
-		RABAOriIdx = pTxBlk->pMacEntry->BAOriWcidArray[pTxBlk->UserPriority];
-		BASize = pAd->BATable.BAOriEntry[RABAOriIdx].BAWinSize;
-	}
-
-
-	pTxWI->TxBF = pTransmit->field.TxBF;
-	pTxWI->BAWinSize = BASize;
-	pTxWI->ShortGI = pTransmit->field.ShortGI;
-	pTxWI->STBC = pTransmit->field.STBC;
-#endif // DOT11_N_SUPPORT //
-
-	pTxWI->MCS = pTransmit->field.MCS;
-	pTxWI->PHYMODE = pTransmit->field.MODE;
-
-
-#ifdef DOT11_N_SUPPORT
-	if (pMacEntry)
-	{
-		if ((pMacEntry->MmpsMode == MMPS_DYNAMIC) && (pTransmit->field.MCS > 7))
-		{
-			// Dynamic MIMO Power Save Mode
-			pTxWI->MIMOps = 1;
-		}
-		else if (pMacEntry->MmpsMode == MMPS_STATIC)
-		{
-			// Static MIMO Power Save Mode
-			if (pTransmit->field.MODE >= MODE_HTMIX && pTransmit->field.MCS > 7)
-			{
-				pTxWI->MCS = 7;
-				pTxWI->MIMOps = 0;
-			}
-		}
-
-		if (pMacEntry->bIAmBadAtheros && (pMacEntry->WepStatus != Ndis802_11WEPDisabled))
-		{
-			pTxWI->MpduDensity = 7;
-		}
-		else
-		{
-		pTxWI->MpduDensity = pMacEntry->MpduDensity;
-	}
-	}
-#endif // DOT11_N_SUPPORT //
-
-#ifdef DBG_DIAGNOSE
-		if (pTxBlk->QueIdx== 0)
-		{
-			pAd->DiagStruct.TxDataCnt[pAd->DiagStruct.ArrayCurIdx]++;
-			pAd->DiagStruct.TxMcsCnt[pAd->DiagStruct.ArrayCurIdx][pTxWI->MCS]++;
-		}
-#endif // DBG_DIAGNOSE //
-
-	// for rate adapation
-	pTxWI->PacketId = pTxWI->MCS;
-#ifdef INF_AMAZON_SE
-/*Iverson patch for WMM A5-T07 ,WirelessStaToWirelessSta do not bulk out aggregate */
-	if( RTMP_GET_PACKET_NOBULKOUT(pTxBlk->pPacket))
-	{
-		if(pTxWI->PHYMODE == MODE_CCK)
-		{
-			pTxWI->PacketId = 6;
-		}
-	}
-#endif // INF_AMAZON_SE //
-}
-
-
-VOID RTMPWriteTxWI_Cache(
-	IN	PRTMP_ADAPTER		pAd,
-	IN	OUT PTXWI_STRUC		pTxWI,
-	IN	TX_BLK				*pTxBlk)
-{
-	PHTTRANSMIT_SETTING	/*pTxHTPhyMode,*/ pTransmit;
-	PMAC_TABLE_ENTRY	pMacEntry;
-
-	//
-	// update TXWI
-	//
-	pMacEntry = pTxBlk->pMacEntry;
-	pTransmit = pTxBlk->pTransmit;
-
-	//if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_TX_RATE_SWITCH_ENABLED))
-	//if (RTMPCheckEntryEnableAutoRateSwitch(pAd, pMacEntry))
-	//if (TX_BLK_TEST_FLAG(pTxBlk, fTX_AutoRateSwitch))
-	if (pMacEntry->bAutoTxRateSwitch)
-	{
-		pTxWI->txop = IFS_HTTXOP;
-
-		// If CCK or OFDM, BW must be 20
-		pTxWI->BW = (pTransmit->field.MODE <= MODE_OFDM) ? (BW_20) : (pTransmit->field.BW);
-		pTxWI->ShortGI = pTransmit->field.ShortGI;
-		pTxWI->STBC = pTransmit->field.STBC;
-
-		pTxWI->MCS = pTransmit->field.MCS;
-		pTxWI->PHYMODE = pTransmit->field.MODE;
-
-		// set PID for TxRateSwitching
-		pTxWI->PacketId = pTransmit->field.MCS;
-	}
-
-#ifdef DOT11_N_SUPPORT
-	pTxWI->AMPDU = ((pMacEntry->NoBADataCountDown == 0) ? TRUE: FALSE);
-	pTxWI->MIMOps = 0;
-
-#ifdef DOT11N_DRAFT3
-	if (pTxWI->BW)
-		pTxWI->BW = (pAd->CommonCfg.AddHTInfo.AddHtInfo.RecomWidth == 0) ? (BW_20) : (pTransmit->field.BW);
-#endif // DOT11N_DRAFT3 //
-
-    if (pAd->CommonCfg.bMIMOPSEnable)
-    {
-		// MIMO Power Save Mode
-		if ((pMacEntry->MmpsMode == MMPS_DYNAMIC) && (pTransmit->field.MCS > 7))
-		{
-			// Dynamic MIMO Power Save Mode
-			pTxWI->MIMOps = 1;
-		}
-		else if (pMacEntry->MmpsMode == MMPS_STATIC)
-		{
-			// Static MIMO Power Save Mode
-			if ((pTransmit->field.MODE >= MODE_HTMIX) && (pTransmit->field.MCS > 7))
-			{
-				pTxWI->MCS = 7;
-				pTxWI->MIMOps = 0;
-			}
-		}
-    }
-#endif // DOT11_N_SUPPORT //
-
-#ifdef DBG_DIAGNOSE
-	if (pTxBlk->QueIdx== 0)
-	{
-		pAd->DiagStruct.TxDataCnt[pAd->DiagStruct.ArrayCurIdx]++;
-		pAd->DiagStruct.TxMcsCnt[pAd->DiagStruct.ArrayCurIdx][pTxWI->MCS]++;
-	}
-#endif // DBG_DIAGNOSE //
-
-	pTxWI->MPDUtotalByteCount = pTxBlk->MpduHeaderLen + pTxBlk->SrcBufLen;
-
-}
-
-
-// should be called only when -
-// 1. MEADIA_CONNECTED
-// 2. AGGREGATION_IN_USED
-// 3. Fragmentation not in used
-// 4. either no previous frame (pPrevAddr1=NULL) .OR. previoud frame is aggregatible
-BOOLEAN TxFrameIsAggregatible(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			pPrevAddr1,
-	IN	PUCHAR			p8023hdr)
-{
-
-	// can't aggregate EAPOL (802.1x) frame
-	if ((p8023hdr[12] == 0x88) && (p8023hdr[13] == 0x8e))
-		return FALSE;
-
-	// can't aggregate multicast/broadcast frame
-	if (p8023hdr[0] & 0x01)
-		return FALSE;
-
-	if (INFRA_ON(pAd)) // must be unicast to AP
-		return TRUE;
-	else if ((pPrevAddr1 == NULL) || MAC_ADDR_EQUAL(pPrevAddr1, p8023hdr)) // unicast to same STA
-		return TRUE;
-	else
-		return FALSE;
-}
-
-
-/*
-	========================================================================
-
-	Routine Description:
-	   Check the MSDU Aggregation policy
-	1.HT aggregation is A-MSDU
-	2.legaacy rate aggregation is software aggregation by Ralink.
-
-	Arguments:
-
-	Return Value:
-
-	Note:
-
-	========================================================================
-*/
-BOOLEAN PeerIsAggreOn(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	ULONG		   TxRate,
-	IN	PMAC_TABLE_ENTRY pMacEntry)
-{
-	ULONG	AFlags = (fCLIENT_STATUS_AMSDU_INUSED | fCLIENT_STATUS_AGGREGATION_CAPABLE);
-
-	if (pMacEntry != NULL && CLIENT_STATUS_TEST_FLAG(pMacEntry, AFlags))
-	{
-#ifdef DOT11_N_SUPPORT
-		if (pMacEntry->HTPhyMode.field.MODE >= MODE_HTMIX)
-		{
-			return TRUE;
-		}
-#endif // DOT11_N_SUPPORT //
-
-#ifdef AGGREGATION_SUPPORT
-		if (TxRate >= RATE_6 && pAd->CommonCfg.bAggregationCapable && (!(OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_WMM_INUSED) && CLIENT_STATUS_TEST_FLAG(pMacEntry, fCLIENT_STATUS_WMM_CAPABLE))))
-		{	// legacy  Ralink Aggregation support
-			return TRUE;
-		}
-#endif // AGGREGATION_SUPPORT //
-	}
-
-	return FALSE;
-
-}
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		Check and fine the packet waiting in SW queue with highest priority
-
-	Arguments:
-		pAd Pointer to our adapter
-
-	Return Value:
-		pQueue		Pointer to Waiting Queue
-
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-PQUEUE_HEADER	RTMPCheckTxSwQueue(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT PUCHAR			pQueIdx)
-{
-
-	ULONG	Number;
-	// 2004-11-15 to be removed. test aggregation only
-//	if ((OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_AGGREGATION_INUSED)) && (*pNumber < 2))
-//		 return NULL;
-
-	Number = pAd->TxSwQueue[QID_AC_BK].Number
-			 + pAd->TxSwQueue[QID_AC_BE].Number
-			 + pAd->TxSwQueue[QID_AC_VI].Number
-			 + pAd->TxSwQueue[QID_AC_VO].Number;
-			 /*+ pAd->TxSwQueue[QID_HCCA].Number;*/
-
-	if (pAd->TxSwQueue[QID_AC_VO].Head != NULL)
-	{
-		*pQueIdx = QID_AC_VO;
-		return (&pAd->TxSwQueue[QID_AC_VO]);
-	}
-	else if (pAd->TxSwQueue[QID_AC_VI].Head != NULL)
-	{
-		*pQueIdx = QID_AC_VI;
-		return (&pAd->TxSwQueue[QID_AC_VI]);
-	}
-	else if (pAd->TxSwQueue[QID_AC_BE].Head != NULL)
-	{
-		*pQueIdx = QID_AC_BE;
-		return (&pAd->TxSwQueue[QID_AC_BE]);
-	}
-	else if (pAd->TxSwQueue[QID_AC_BK].Head != NULL)
-	{
-		*pQueIdx = QID_AC_BK;
-		return (&pAd->TxSwQueue[QID_AC_BK]);
-	}
-	/*
-	else if (pAd->TxSwQueue[QID_HCCA].Head != NULL)
-	{
-		*pQueIdx = QID_HCCA;
-		return (&pAd->TxSwQueue[QID_HCCA]);
-	}
-	*/
-
-	// No packet pending in Tx Sw queue
-	*pQueIdx = QID_AC_BK;
-
-	return (NULL);
-}
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		Suspend MSDU transmission
-
-	Arguments:
-		pAd	Pointer to our adapter
-
-	Return Value:
-		None
-
-	Note:
-
-	========================================================================
-*/
-VOID	RTMPSuspendMsduTransmission(
-	IN	PRTMP_ADAPTER	pAd)
-{
-	DBGPRINT(RT_DEBUG_TRACE,("SCANNING, suspend MSDU transmission ...\n"));
-
-
-	//
-	// Before BSS_SCAN_IN_PROGRESS, we need to keep Current R66 value and
-	// use Lowbound as R66 value on ScanNextChannel(...)
-	//
-	RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R66, &pAd->BbpTuning.R66CurrentValue);
-
-	// set BBP_R66 to 0x30/0x40 when scanning (AsicSwitchChannel will set R66 according to channel when scanning)
-	//RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R66, (0x26 + GET_LNA_GAIN(pAd)));
-	RTMPSetAGCInitValue(pAd, BW_20);
-
-	RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS);
-	//RTMP_IO_WRITE32(pAd, TX_CNTL_CSR, 0x000f0000);		// abort all TX rings
-}
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		Resume MSDU transmission
-
-	Arguments:
-		pAd	Pointer to our adapter
-
-	Return Value:
-		None
-
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-VOID RTMPResumeMsduTransmission(
-	IN	PRTMP_ADAPTER	pAd)
-{
-//    UCHAR			IrqState;
-
-	DBGPRINT(RT_DEBUG_TRACE,("SCAN done, resume MSDU transmission ...\n"));
-
-
-	// After finish BSS_SCAN_IN_PROGRESS, we need to restore Current R66 value
-	// R66 should not be 0
-	if (pAd->BbpTuning.R66CurrentValue == 0)
-	{
-		pAd->BbpTuning.R66CurrentValue = 0x38;
-		DBGPRINT_ERR(("RTMPResumeMsduTransmission, R66CurrentValue=0...\n"));
-	}
-
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R66, pAd->BbpTuning.R66CurrentValue);
-
-	RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS);
-// sample, for IRQ LOCK to SEM LOCK
-//    IrqState = pAd->irq_disabled;
-//	if (IrqState)
-//		RTMPDeQueuePacket(pAd, TRUE, NUM_OF_TX_RING, MAX_TX_PROCESS);
-//    else
-	RTMPDeQueuePacket(pAd, FALSE, NUM_OF_TX_RING, MAX_TX_PROCESS);
-}
-
-
-UINT deaggregate_AMSDU_announce(
-	IN	PRTMP_ADAPTER	pAd,
-	PNDIS_PACKET		pPacket,
-	IN	PUCHAR			pData,
-	IN	ULONG			DataSize)
-{
-	USHORT			PayloadSize;
-	USHORT			SubFrameSize;
-	PHEADER_802_3	pAMSDUsubheader;
-	UINT			nMSDU;
-    UCHAR			Header802_3[14];
-
-	PUCHAR			pPayload, pDA, pSA, pRemovedLLCSNAP;
-	PNDIS_PACKET	pClonePacket;
-
-
-
-	nMSDU = 0;
-
-	while (DataSize > LENGTH_802_3)
-	{
-
-		nMSDU++;
-
-		//hex_dump("subheader", pData, 64);
-		pAMSDUsubheader = (PHEADER_802_3)pData;
-		//pData += LENGTH_802_3;
-		PayloadSize = pAMSDUsubheader->Octet[1] + (pAMSDUsubheader->Octet[0]<<8);
-		SubFrameSize = PayloadSize + LENGTH_802_3;
-
-
-		if ((DataSize < SubFrameSize) || (PayloadSize > 1518 ))
-		{
-			break;
-		}
-
-		//DBGPRINT(RT_DEBUG_TRACE,("%d subframe: Size = %d\n",  nMSDU, PayloadSize));
-
-		pPayload = pData + LENGTH_802_3;
-		pDA = pData;
-		pSA = pData + MAC_ADDR_LEN;
-
-		// convert to 802.3 header
-        CONVERT_TO_802_3(Header802_3, pDA, pSA, pPayload, PayloadSize, pRemovedLLCSNAP);
-
-#ifdef CONFIG_STA_SUPPORT
-		if ((Header802_3[12] == 0x88) && (Header802_3[13] == 0x8E) )
-		{
-			/* avoid local heap overflow, use dyanamic allocation */
-		   MLME_QUEUE_ELEM *Elem = (MLME_QUEUE_ELEM *) kmalloc(sizeof(MLME_QUEUE_ELEM), MEM_ALLOC_FLAG);
-			if (Elem != NULL)
-			{
-				memmove(Elem->Msg+(LENGTH_802_11 + LENGTH_802_1_H), pPayload, PayloadSize);
-				Elem->MsgLen = LENGTH_802_11 + LENGTH_802_1_H + PayloadSize;
-				//WpaEAPOLKeyAction(pAd, Elem);
-				REPORT_MGMT_FRAME_TO_MLME(pAd, BSSID_WCID, Elem->Msg, Elem->MsgLen, 0, 0, 0, 0);
-				kfree(Elem);
-			}
-		}
-#endif // CONFIG_STA_SUPPORT //
-
-#ifdef CONFIG_STA_SUPPORT
-		IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		{
-			if (pRemovedLLCSNAP)
-			{
-				pPayload -= LENGTH_802_3;
-				PayloadSize += LENGTH_802_3;
-				NdisMoveMemory(pPayload, &Header802_3[0], LENGTH_802_3);
-			}
-		}
-#endif // CONFIG_STA_SUPPORT //
-
-		pClonePacket = ClonePacket(pAd, pPacket, pPayload, PayloadSize);
-		if (pClonePacket)
-		{
-#ifdef CONFIG_STA_SUPPORT
-			IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-				ANNOUNCE_OR_FORWARD_802_3_PACKET(pAd, pClonePacket, RTMP_GET_PACKET_IF(pPacket));
-#endif // CONFIG_STA_SUPPORT //
-		}
-
-
-		// A-MSDU has padding to multiple of 4 including subframe header.
-		// align SubFrameSize up to multiple of 4
-		SubFrameSize = (SubFrameSize+3)&(~0x3);
-
-
-		if (SubFrameSize > 1528 || SubFrameSize < 32)
-		{
-			break;
-		}
-
-		if (DataSize > SubFrameSize)
-		{
-			pData += SubFrameSize;
-			DataSize -= SubFrameSize;
-		}
-		else
-		{
-			// end of A-MSDU
-			DataSize = 0;
-		}
-	}
-
-	// finally release original rx packet
-	RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_SUCCESS);
-
-	return nMSDU;
-}
-
-
-UINT BA_Reorder_AMSDU_Annnounce(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PNDIS_PACKET	pPacket)
-{
-	PUCHAR			pData;
-	USHORT			DataSize;
-	UINT			nMSDU = 0;
-
-	pData = (PUCHAR) GET_OS_PKT_DATAPTR(pPacket);
-	DataSize = (USHORT) GET_OS_PKT_LEN(pPacket);
-
-	nMSDU = deaggregate_AMSDU_announce(pAd, pPacket, pData, DataSize);
-
-	return nMSDU;
-}
-
-
-/*
-	==========================================================================
-	Description:
-		Look up the MAC address in the MAC table. Return NULL if not found.
-	Return:
-		pEntry - pointer to the MAC entry; NULL is not found
-	==========================================================================
-*/
-MAC_TABLE_ENTRY *MacTableLookup(
-	IN PRTMP_ADAPTER pAd,
-	PUCHAR pAddr)
-{
-	ULONG HashIdx;
-	MAC_TABLE_ENTRY *pEntry = NULL;
-
-	HashIdx = MAC_ADDR_HASH_INDEX(pAddr);
-	pEntry = pAd->MacTab.Hash[HashIdx];
-
-	while (pEntry && (pEntry->ValidAsCLI || pEntry->ValidAsWDS || pEntry->ValidAsApCli || pEntry->ValidAsMesh))
-	{
-		if (MAC_ADDR_EQUAL(pEntry->Addr, pAddr))
-		{
-			break;
-		}
-		else
-			pEntry = pEntry->pNext;
-	}
-
-	return pEntry;
-}
-
-MAC_TABLE_ENTRY *MacTableInsertEntry(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PUCHAR			pAddr,
-	IN	UCHAR			apidx,
-	IN BOOLEAN	CleanAll)
-{
-	UCHAR HashIdx;
-	int i, FirstWcid;
-	MAC_TABLE_ENTRY *pEntry = NULL, *pCurrEntry;
-//	USHORT	offset;
-//	ULONG	addr;
-
-	// if FULL, return
-	if (pAd->MacTab.Size >= MAX_LEN_OF_MAC_TABLE)
-		return NULL;
-
-	FirstWcid = 1;
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	if (pAd->StaCfg.BssType == BSS_INFRA)
-		FirstWcid = 2;
-#endif // CONFIG_STA_SUPPORT //
-
-	// allocate one MAC entry
-	NdisAcquireSpinLock(&pAd->MacTabLock);
-	for (i = FirstWcid; i< MAX_LEN_OF_MAC_TABLE; i++)   // skip entry#0 so that "entry index == AID" for fast lookup
-	{
-		// pick up the first available vacancy
-		if ((pAd->MacTab.Content[i].ValidAsCLI == FALSE) &&
-			(pAd->MacTab.Content[i].ValidAsWDS == FALSE) &&
-			(pAd->MacTab.Content[i].ValidAsApCli== FALSE) &&
-			(pAd->MacTab.Content[i].ValidAsMesh == FALSE)
-#ifdef CONFIG_STA_SUPPORT
-#ifdef QOS_DLS_SUPPORT
-			&& (pAd->MacTab.Content[i].ValidAsDls == FALSE)
-#endif // QOS_DLS_SUPPORT //
-#endif // CONFIG_STA_SUPPORT //
-			)
-		{
-			pEntry = &pAd->MacTab.Content[i];
-			if (CleanAll == TRUE)
-			{
-				pEntry->MaxSupportedRate = RATE_11;
-				pEntry->CurrTxRate = RATE_11;
-				NdisZeroMemory(pEntry, sizeof(MAC_TABLE_ENTRY));
-				pEntry->PairwiseKey.KeyLen = 0;
-				pEntry->PairwiseKey.CipherAlg = CIPHER_NONE;
-			}
-#ifdef CONFIG_STA_SUPPORT
-#ifdef QOS_DLS_SUPPORT
-			if (apidx >= MIN_NET_DEVICE_FOR_DLS)
-			{
-				pEntry->ValidAsCLI = FALSE;
-				pEntry->ValidAsWDS = FALSE;
-				pEntry->ValidAsApCli = FALSE;
-				pEntry->ValidAsMesh = FALSE;
-				pEntry->ValidAsDls = TRUE;
-				pEntry->isCached = FALSE;
-			}
-			else
-#endif // QOS_DLS_SUPPORT //
-#endif // CONFIG_STA_SUPPORT //
-			{
-
-#ifdef CONFIG_STA_SUPPORT
-				IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-				{
-					pEntry->ValidAsCLI = TRUE;
-					pEntry->ValidAsWDS = FALSE;
-					pEntry->ValidAsApCli = FALSE;
-					pEntry->ValidAsMesh = FALSE;
-					pEntry->ValidAsDls = FALSE;
-				}
-#endif // CONFIG_STA_SUPPORT //
-			}
-
-			pEntry->bIAmBadAtheros = FALSE;
-			pEntry->pAd = pAd;
-			pEntry->CMTimerRunning = FALSE;
-			pEntry->EnqueueEapolStartTimerRunning = EAPOL_START_DISABLE;
-			pEntry->RSNIE_Len = 0;
-			NdisZeroMemory(pEntry->R_Counter, sizeof(pEntry->R_Counter));
-			pEntry->ReTryCounter = PEER_MSG1_RETRY_TIMER_CTR;
-
-			if (pEntry->ValidAsMesh)
-				pEntry->apidx = (apidx - MIN_NET_DEVICE_FOR_MESH);
-			else if (pEntry->ValidAsApCli)
-				pEntry->apidx = (apidx - MIN_NET_DEVICE_FOR_APCLI);
-			else if (pEntry->ValidAsWDS)
-				pEntry->apidx = (apidx - MIN_NET_DEVICE_FOR_WDS);
-#ifdef CONFIG_STA_SUPPORT
-#ifdef QOS_DLS_SUPPORT
-			else if (pEntry->ValidAsDls)
-				pEntry->apidx = (apidx - MIN_NET_DEVICE_FOR_DLS);
-#endif // QOS_DLS_SUPPORT //
-#endif // CONFIG_STA_SUPPORT //
-			else
-				pEntry->apidx = apidx;
-
-
-			{
-
-#ifdef CONFIG_STA_SUPPORT
-				IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-				{
-					pEntry->AuthMode = pAd->StaCfg.AuthMode;
-					pEntry->WepStatus = pAd->StaCfg.WepStatus;
-					pEntry->PrivacyFilter = Ndis802_11PrivFilterAcceptAll;
-#ifdef RTMP_MAC_PCI
-					AsicRemovePairwiseKeyEntry(pAd, pEntry->apidx, (UCHAR)i);
-#endif // RTMP_MAC_PCI //
-				}
-#endif // CONFIG_STA_SUPPORT //
-			}
-
-			pEntry->GTKState = REKEY_NEGOTIATING;
-			pEntry->PairwiseKey.KeyLen = 0;
-			pEntry->PairwiseKey.CipherAlg = CIPHER_NONE;
-#ifdef CONFIG_STA_SUPPORT
-#ifdef QOS_DLS_SUPPORT
-			if (pEntry->ValidAsDls == TRUE)
-				pEntry->PortSecured = WPA_802_1X_PORT_SECURED;
-			else
-#endif //QOS_DLS_SUPPORT
-#endif // CONFIG_STA_SUPPORT //
-				pEntry->PortSecured = WPA_802_1X_PORT_NOT_SECURED;
-
-			pEntry->PMKID_CacheIdx = ENTRY_NOT_FOUND;
-			COPY_MAC_ADDR(pEntry->Addr, pAddr);
-			pEntry->Sst = SST_NOT_AUTH;
-			pEntry->AuthState = AS_NOT_AUTH;
-			pEntry->Aid = (USHORT)i;  //0;
-			pEntry->CapabilityInfo = 0;
-			pEntry->PsMode = PWR_ACTIVE;
-			pEntry->PsQIdleCount = 0;
-			pEntry->NoDataIdleCount = 0;
-			pEntry->AssocDeadLine = MAC_TABLE_ASSOC_TIMEOUT;
-			pEntry->ContinueTxFailCnt = 0;
-#ifdef WDS_SUPPORT
-			pEntry->LockEntryTx = FALSE;
-			pEntry->TimeStamp_toTxRing = 0;
-#endif // WDS_SUPPORT //
-			InitializeQueueHeader(&pEntry->PsQueue);
-
-
-			pAd->MacTab.Size ++;
-			// Add this entry into ASIC RX WCID search table
-			RTMP_STA_ENTRY_ADD(pAd, pEntry);
-
-
-
-			DBGPRINT(RT_DEBUG_TRACE, ("MacTableInsertEntry - allocate entry #%d, Total= %d\n",i, pAd->MacTab.Size));
-			break;
-		}
-	}
-
-	// add this MAC entry into HASH table
-	if (pEntry)
-	{
-		HashIdx = MAC_ADDR_HASH_INDEX(pAddr);
-		if (pAd->MacTab.Hash[HashIdx] == NULL)
-		{
-			pAd->MacTab.Hash[HashIdx] = pEntry;
-		}
-		else
-		{
-			pCurrEntry = pAd->MacTab.Hash[HashIdx];
-			while (pCurrEntry->pNext != NULL)
-				pCurrEntry = pCurrEntry->pNext;
-			pCurrEntry->pNext = pEntry;
-		}
-	}
-
-	NdisReleaseSpinLock(&pAd->MacTabLock);
-	return pEntry;
-}
-
-/*
-	==========================================================================
-	Description:
-		Delete a specified client from MAC table
-	==========================================================================
- */
-BOOLEAN MacTableDeleteEntry(
-	IN PRTMP_ADAPTER pAd,
-	IN USHORT wcid,
-	IN PUCHAR pAddr)
-{
-	USHORT HashIdx;
-	MAC_TABLE_ENTRY *pEntry, *pPrevEntry, *pProbeEntry;
-	BOOLEAN Cancelled;
-	//USHORT	offset;	// unused variable
-	//UCHAR	j;			// unused variable
-
-	if (wcid >= MAX_LEN_OF_MAC_TABLE)
-		return FALSE;
-
-	NdisAcquireSpinLock(&pAd->MacTabLock);
-
-	HashIdx = MAC_ADDR_HASH_INDEX(pAddr);
-	//pEntry = pAd->MacTab.Hash[HashIdx];
-	pEntry = &pAd->MacTab.Content[wcid];
-
-	if (pEntry && (pEntry->ValidAsCLI || pEntry->ValidAsApCli || pEntry->ValidAsWDS || pEntry->ValidAsMesh
-#ifdef CONFIG_STA_SUPPORT
-#ifdef QOS_DLS_SUPPORT
-		|| pEntry->ValidAsDls
-#endif // QOS_DLS_SUPPORT //
-#endif // CONFIG_STA_SUPPORT //
-		))
-	{
-		if (MAC_ADDR_EQUAL(pEntry->Addr, pAddr))
-		{
-
-			// Delete this entry from ASIC on-chip WCID Table
-			RTMP_STA_ENTRY_MAC_RESET(pAd, wcid);
-
-#ifdef DOT11_N_SUPPORT
-			// free resources of BA
-			BASessionTearDownALL(pAd, pEntry->Aid);
-#endif // DOT11_N_SUPPORT //
-
-
-			pPrevEntry = NULL;
-			pProbeEntry = pAd->MacTab.Hash[HashIdx];
-			ASSERT(pProbeEntry);
-
-			// update Hash list
-			do
-			{
-				if (pProbeEntry == pEntry)
-				{
-					if (pPrevEntry == NULL)
-					{
-						pAd->MacTab.Hash[HashIdx] = pEntry->pNext;
-					}
-					else
-					{
-						pPrevEntry->pNext = pEntry->pNext;
-					}
-					break;
-				}
-
-				pPrevEntry = pProbeEntry;
-				pProbeEntry = pProbeEntry->pNext;
-			} while (pProbeEntry);
-
-			// not found !!!
-			ASSERT(pProbeEntry != NULL);
-
-			RTMP_STA_ENTRY_KEY_DEL(pAd, BSS0, wcid);
-
-
-		if (pEntry->EnqueueEapolStartTimerRunning != EAPOL_START_DISABLE)
-		{
-            RTMPCancelTimer(&pEntry->EnqueueStartForPSKTimer, &Cancelled);
-			pEntry->EnqueueEapolStartTimerRunning = EAPOL_START_DISABLE;
-        }
-
-
-			NdisZeroMemory(pEntry, sizeof(MAC_TABLE_ENTRY));
-			pAd->MacTab.Size --;
-			DBGPRINT(RT_DEBUG_TRACE, ("MacTableDeleteEntry1 - Total= %d\n", pAd->MacTab.Size));
-		}
-		else
-		{
-			DBGPRINT(RT_DEBUG_OFF, ("\n%s: Impossible Wcid = %d !!!!!\n", __FUNCTION__, wcid));
-		}
-	}
-
-	NdisReleaseSpinLock(&pAd->MacTabLock);
-
-	//Reset operating mode when no Sta.
-	if (pAd->MacTab.Size == 0)
-	{
-#ifdef DOT11_N_SUPPORT
-		pAd->CommonCfg.AddHTInfo.AddHtInfo2.OperaionMode = 0;
-#endif // DOT11_N_SUPPORT //
-		//AsicUpdateProtect(pAd, 0 /*pAd->CommonCfg.AddHTInfo.AddHtInfo2.OperaionMode*/, (ALLN_SETPROTECT), TRUE, 0 /*pAd->MacTab.fAnyStationNonGF*/);
-		RTMP_UPDATE_PROTECT(pAd);  // edit by johnli, fix "in_interrupt" error when call "MacTableDeleteEntry" in Rx tasklet
-	}
-
-	return TRUE;
-}
-
-
-/*
-	==========================================================================
-	Description:
-		This routine reset the entire MAC table. All packets pending in
-		the power-saving queues are freed here.
-	==========================================================================
- */
-VOID MacTableReset(
-	IN  PRTMP_ADAPTER  pAd)
-{
-	int         i;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("MacTableReset\n"));
-	//NdisAcquireSpinLock(&pAd->MacTabLock);
-
-
-	for (i=1; i<MAX_LEN_OF_MAC_TABLE; i++)
-	{
-#ifdef RTMP_MAC_PCI
-		RTMP_STA_ENTRY_MAC_RESET(pAd, i);
-#endif // RTMP_MAC_PCI //
-		if (pAd->MacTab.Content[i].ValidAsCLI == TRUE)
-	   {
-
-
-#ifdef DOT11_N_SUPPORT
-			// free resources of BA
-			BASessionTearDownALL(pAd, i);
-#endif // DOT11_N_SUPPORT //
-
-			pAd->MacTab.Content[i].ValidAsCLI = FALSE;
-
-
-
-
-			//AsicDelWcidTab(pAd, i);
-		}
-	}
-
-	return;
-}
-
-/*
-	==========================================================================
-	Description:
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
-*/
-VOID AssocParmFill(
-	IN PRTMP_ADAPTER pAd,
-	IN OUT MLME_ASSOC_REQ_STRUCT *AssocReq,
-	IN PUCHAR                     pAddr,
-	IN USHORT                     CapabilityInfo,
-	IN ULONG                      Timeout,
-	IN USHORT                     ListenIntv)
-{
-	COPY_MAC_ADDR(AssocReq->Addr, pAddr);
-	// Add mask to support 802.11b mode only
-	AssocReq->CapabilityInfo = CapabilityInfo & SUPPORTED_CAPABILITY_INFO; // not cf-pollable, not cf-poll-request
-	AssocReq->Timeout = Timeout;
-	AssocReq->ListenIntv = ListenIntv;
-}
-
-
-/*
-	==========================================================================
-	Description:
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
-*/
-VOID DisassocParmFill(
-	IN PRTMP_ADAPTER pAd,
-	IN OUT MLME_DISASSOC_REQ_STRUCT *DisassocReq,
-	IN PUCHAR pAddr,
-	IN USHORT Reason)
-{
-	COPY_MAC_ADDR(DisassocReq->Addr, pAddr);
-	DisassocReq->Reason = Reason;
-}
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		Check the out going frame, if this is an DHCP or ARP datagram
-	will be duplicate another frame at low data rate transmit.
-
-	Arguments:
-		pAd		Pointer to our adapter
-		pPacket		Pointer to outgoing Ndis frame
-
-	Return Value:
-		TRUE		To be duplicate at Low data rate transmit. (1mb)
-		FALSE		Do nothing.
-
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-
-		MAC header + IP Header + UDP Header
-		  14 Bytes	  20 Bytes
-
-		UDP Header
-		00|01|02|03|04|05|06|07|08|09|10|11|12|13|14|15|
-						Source Port
-		16|17|18|19|20|21|22|23|24|25|26|27|28|29|30|31|
-					Destination Port
-
-		port 0x43 means Bootstrap Protocol, server.
-		Port 0x44 means Bootstrap Protocol, client.
-
-	========================================================================
-*/
-
-BOOLEAN RTMPCheckDHCPFrame(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PNDIS_PACKET	pPacket)
-{
-	PACKET_INFO	PacketInfo;
-	ULONG			NumberOfBytesRead = 0;
-	ULONG			CurrentOffset = 0;
-	PVOID			pVirtualAddress = NULL;
-	UINT			NdisBufferLength;
-	PUCHAR			pSrc;
-	USHORT			Protocol;
-	UCHAR			ByteOffset36 = 0;
-	UCHAR			ByteOffset38 = 0;
-	BOOLEAN			ReadFirstParm = TRUE;
-
-	RTMP_QueryPacketInfo(pPacket, &PacketInfo, (PUCHAR *)&pVirtualAddress, &NdisBufferLength);
-
-	NumberOfBytesRead += NdisBufferLength;
-	pSrc = (PUCHAR) pVirtualAddress;
-	Protocol = *(pSrc + 12) * 256 + *(pSrc + 13);
-
-	//
-	// Check DHCP & BOOTP protocol
-	//
-	while (NumberOfBytesRead <= PacketInfo.TotalPacketLength)
-	{
-		if ((NumberOfBytesRead >= 35) && (ReadFirstParm == TRUE))
-		{
-			CurrentOffset = 35 - (NumberOfBytesRead - NdisBufferLength);
-			ByteOffset36 = *(pSrc + CurrentOffset);
-			ReadFirstParm = FALSE;
-		}
-
-		if (NumberOfBytesRead >= 37)
-		{
-			CurrentOffset = 37 - (NumberOfBytesRead - NdisBufferLength);
-			ByteOffset38 = *(pSrc + CurrentOffset);
-			//End of Read
-			break;
-		}
-		return FALSE;
-	}
-
-	// Check for DHCP & BOOTP protocol
-	if ((ByteOffset36 != 0x44) || (ByteOffset38 != 0x43))
-		{
-		//
-		// 2054 (hex 0806) for ARP datagrams
-		// if this packet is not ARP datagrams, then do nothing
-		// ARP datagrams will also be duplicate at 1mb broadcast frames
-		//
-		if (Protocol != 0x0806 )
-			return FALSE;
-		}
-
-	return TRUE;
-}
-
-
-BOOLEAN RTMPCheckEtherType(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PNDIS_PACKET	pPacket)
-{
-	USHORT	TypeLen;
-	UCHAR	Byte0, Byte1;
-	PUCHAR	pSrcBuf;
-	UINT32	pktLen;
-	UINT16	srcPort, dstPort;
-	BOOLEAN	status = TRUE;
-
-
-	pSrcBuf = GET_OS_PKT_DATAPTR(pPacket);
-	pktLen = GET_OS_PKT_LEN(pPacket);
-
-	ASSERT(pSrcBuf);
-
-	RTMP_SET_PACKET_SPECIFIC(pPacket, 0);
-
-	// get Ethernet protocol field
-	TypeLen = (pSrcBuf[12] << 8) + pSrcBuf[13];
-
-	pSrcBuf += LENGTH_802_3;	// Skip the Ethernet Header.
-
-	if (TypeLen <= 1500)
-	{	// 802.3, 802.3 LLC
-		/*
-			DestMAC(6) + SrcMAC(6) + Lenght(2) +
-			DSAP(1) + SSAP(1) + Control(1) +
-			if the DSAP = 0xAA, SSAP=0xAA, Contorl = 0x03, it has a 5-bytes SNAP header.
-				=> + SNAP (5, OriginationID(3) + etherType(2))
-		*/
-		if (pSrcBuf[0] == 0xAA && pSrcBuf[1] == 0xAA && pSrcBuf[2] == 0x03)
-		{
-			Sniff2BytesFromNdisBuffer((PNDIS_BUFFER)pSrcBuf, 6, &Byte0, &Byte1);
-			RTMP_SET_PACKET_LLCSNAP(pPacket, 1);
-			TypeLen = (USHORT)((Byte0 << 8) + Byte1);
-			pSrcBuf += 8; // Skip this LLC/SNAP header
-		}
-		else
-		{
-			//It just has 3-byte LLC header, maybe a legacy ether type frame. we didn't handle it.
-		}
-	}
-
-	// If it's a VLAN packet, get the real Type/Length field.
-	if (TypeLen == 0x8100)
-	{
-		/* 0x8100 means VLAN packets */
-
-		/* Dest. MAC Address (6-bytes) +
-		   Source MAC Address (6-bytes) +
-		   Length/Type = 802.1Q Tag Type (2-byte) +
-		   Tag Control Information (2-bytes) +
-		   Length / Type (2-bytes) +
-		   data payload (0-n bytes) +
-		   Pad (0-p bytes) +
-		   Frame Check Sequence (4-bytes) */
-
-		RTMP_SET_PACKET_VLAN(pPacket, 1);
-		Sniff2BytesFromNdisBuffer((PNDIS_BUFFER)pSrcBuf, 2, &Byte0, &Byte1);
-		TypeLen = (USHORT)((Byte0 << 8) + Byte1);
-
-		pSrcBuf += 4; // Skip the VLAN Header.
-	}
-
-	switch (TypeLen)
-	{
-		case 0x0800:
-			{
-				ASSERT((pktLen > 34));
-				if (*(pSrcBuf + 9) == 0x11)
-				{	// udp packet
-					ASSERT((pktLen > 34));	// 14 for ethernet header, 20 for IP header
-
-					pSrcBuf += 20;	// Skip the IP header
-					srcPort = OS_NTOHS(get_unaligned((PUINT16)(pSrcBuf)));
-					dstPort = OS_NTOHS(get_unaligned((PUINT16)(pSrcBuf+2)));
-
-					if ((srcPort==0x44 && dstPort==0x43) || (srcPort==0x43 && dstPort==0x44))
-					{	//It's a BOOTP/DHCP packet
-						RTMP_SET_PACKET_DHCP(pPacket, 1);
-					}
-				}
-			}
-			break;
-		case 0x0806:
-			{
-				//ARP Packet.
-				RTMP_SET_PACKET_DHCP(pPacket, 1);
-			}
-			break;
-		case 0x888e:
-			{
-				// EAPOL Packet.
-				RTMP_SET_PACKET_EAPOL(pPacket, 1);
-			}
-			break;
-		default:
-			status = FALSE;
-			break;
-	}
-
-	return status;
-
-}
-
-
-
-VOID Update_Rssi_Sample(
-	IN PRTMP_ADAPTER	pAd,
-	IN RSSI_SAMPLE		*pRssi,
-	IN PRXWI_STRUC		pRxWI)
-		{
-	CHAR	rssi0 = pRxWI->RSSI0;
-	CHAR	rssi1 = pRxWI->RSSI1;
-	CHAR	rssi2 = pRxWI->RSSI2;
-
-	if (rssi0 != 0)
-	{
-		pRssi->LastRssi0	= ConvertToRssi(pAd, (CHAR)rssi0, RSSI_0);
-		pRssi->AvgRssi0X8	= (pRssi->AvgRssi0X8 - pRssi->AvgRssi0) + pRssi->LastRssi0;
-		pRssi->AvgRssi0	= pRssi->AvgRssi0X8 >> 3;
-	}
-
-	if (rssi1 != 0)
-	{
-		pRssi->LastRssi1	= ConvertToRssi(pAd, (CHAR)rssi1, RSSI_1);
-		pRssi->AvgRssi1X8	= (pRssi->AvgRssi1X8 - pRssi->AvgRssi1) + pRssi->LastRssi1;
-		pRssi->AvgRssi1	= pRssi->AvgRssi1X8 >> 3;
-	}
-
-	if (rssi2 != 0)
-	{
-		pRssi->LastRssi2	= ConvertToRssi(pAd, (CHAR)rssi2, RSSI_2);
-		pRssi->AvgRssi2X8  = (pRssi->AvgRssi2X8 - pRssi->AvgRssi2) + pRssi->LastRssi2;
-		pRssi->AvgRssi2 = pRssi->AvgRssi2X8 >> 3;
-	}
-}
-
-
-
-// Normal legacy Rx packet indication
-VOID Indicate_Legacy_Packet(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	RX_BLK			*pRxBlk,
-	IN	UCHAR			FromWhichBSSID)
-{
-	PNDIS_PACKET	pRxPacket = pRxBlk->pRxPacket;
-	UCHAR			Header802_3[LENGTH_802_3];
-
-	// 1. get 802.3 Header
-	// 2. remove LLC
-	//		a. pointer pRxBlk->pData to payload
-	//      b. modify pRxBlk->DataSize
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		RTMP_802_11_REMOVE_LLC_AND_CONVERT_TO_802_3(pRxBlk, Header802_3);
-#endif // CONFIG_STA_SUPPORT //
-
-	if (pRxBlk->DataSize > MAX_RX_PKT_LEN)
-	{
-
-		// release packet
-		RELEASE_NDIS_PACKET(pAd, pRxPacket, NDIS_STATUS_FAILURE);
-		return;
-	}
-
-
-	STATS_INC_RX_PACKETS(pAd, FromWhichBSSID);
-
-
-	wlan_802_11_to_802_3_packet(pAd, pRxBlk, Header802_3, FromWhichBSSID);
-
-	//
-	// pass this 802.3 packet to upper layer or forward this packet to WM directly
-	//
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		ANNOUNCE_OR_FORWARD_802_3_PACKET(pAd, pRxPacket, FromWhichBSSID);
-#endif // CONFIG_STA_SUPPORT //
-
-}
-
-
-// Normal, AMPDU or AMSDU
-VOID CmmRxnonRalinkFrameIndicate(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	RX_BLK			*pRxBlk,
-	IN	UCHAR			FromWhichBSSID)
-{
-#ifdef DOT11_N_SUPPORT
-	if (RX_BLK_TEST_FLAG(pRxBlk, fRX_AMPDU) && (pAd->CommonCfg.bDisableReordering == 0))
-	{
-		Indicate_AMPDU_Packet(pAd, pRxBlk, FromWhichBSSID);
-	}
-	else
-#endif // DOT11_N_SUPPORT //
-	{
-#ifdef DOT11_N_SUPPORT
-		if (RX_BLK_TEST_FLAG(pRxBlk, fRX_AMSDU))
-		{
-			// handle A-MSDU
-			Indicate_AMSDU_Packet(pAd, pRxBlk, FromWhichBSSID);
-		}
-		else
-#endif // DOT11_N_SUPPORT //
-		{
-			Indicate_Legacy_Packet(pAd, pRxBlk, FromWhichBSSID);
-		}
-	}
-}
-
-
-VOID CmmRxRalinkFrameIndicate(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	MAC_TABLE_ENTRY	*pEntry,
-	IN	RX_BLK			*pRxBlk,
-	IN	UCHAR			FromWhichBSSID)
-{
-	UCHAR			Header802_3[LENGTH_802_3];
-	UINT16			Msdu2Size;
-	UINT16			Payload1Size, Payload2Size;
-	PUCHAR			pData2;
-	PNDIS_PACKET	pPacket2 = NULL;
-
-
-
-	Msdu2Size = *(pRxBlk->pData) + (*(pRxBlk->pData+1) << 8);
-
-	if ((Msdu2Size <= 1536) && (Msdu2Size < pRxBlk->DataSize))
-	{
-		/* skip two byte MSDU2 len */
-		pRxBlk->pData += 2;
-		pRxBlk->DataSize -= 2;
-	}
-	else
-	{
-		// release packet
-		RELEASE_NDIS_PACKET(pAd, pRxBlk->pRxPacket, NDIS_STATUS_FAILURE);
-		return;
-	}
-
-	// get 802.3 Header and  remove LLC
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		RTMP_802_11_REMOVE_LLC_AND_CONVERT_TO_802_3(pRxBlk, Header802_3);
-#endif // CONFIG_STA_SUPPORT //
-
-
-	ASSERT(pRxBlk->pRxPacket);
-
-	// Ralink Aggregation frame
-	pAd->RalinkCounters.OneSecRxAggregationCount ++;
-	Payload1Size = pRxBlk->DataSize - Msdu2Size;
-	Payload2Size = Msdu2Size - LENGTH_802_3;
-
-	pData2 = pRxBlk->pData + Payload1Size + LENGTH_802_3;
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		pPacket2 = duplicate_pkt(pAd, (pData2-LENGTH_802_3), LENGTH_802_3, pData2, Payload2Size, FromWhichBSSID);
-#endif // CONFIG_STA_SUPPORT //
-
-	if (!pPacket2)
-	{
-		// release packet
-		RELEASE_NDIS_PACKET(pAd, pRxBlk->pRxPacket, NDIS_STATUS_FAILURE);
-		return;
-	}
-
-	// update payload size of 1st packet
-	pRxBlk->DataSize = Payload1Size;
-	wlan_802_11_to_802_3_packet(pAd, pRxBlk, Header802_3, FromWhichBSSID);
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		ANNOUNCE_OR_FORWARD_802_3_PACKET(pAd, pRxBlk->pRxPacket, FromWhichBSSID);
-#endif // CONFIG_STA_SUPPORT //
-
-	if (pPacket2)
-	{
-#ifdef CONFIG_STA_SUPPORT
-		IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-			ANNOUNCE_OR_FORWARD_802_3_PACKET(pAd, pPacket2, FromWhichBSSID);
-#endif // CONFIG_STA_SUPPORT //
-	}
-}
-
-
-#define RESET_FRAGFRAME(_fragFrame) \
-	{								\
-		_fragFrame.RxSize = 0;		\
-		_fragFrame.Sequence = 0;	\
-		_fragFrame.LastFrag = 0;	\
-		_fragFrame.Flags = 0;		\
-	}
-
-
-PNDIS_PACKET RTMPDeFragmentDataFrame(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	RX_BLK			*pRxBlk)
-{
-	PHEADER_802_11	pHeader = pRxBlk->pHeader;
-	PNDIS_PACKET	pRxPacket = pRxBlk->pRxPacket;
-	UCHAR			*pData = pRxBlk->pData;
-	USHORT			DataSize = pRxBlk->DataSize;
-	PNDIS_PACKET	pRetPacket = NULL;
-	UCHAR			*pFragBuffer = NULL;
-	BOOLEAN			bReassDone = FALSE;
-	UCHAR			HeaderRoom = 0;
-
-
-	ASSERT(pHeader);
-
-	HeaderRoom = pData - (UCHAR *)pHeader;
-
-	// Re-assemble the fragmented packets
-	if (pHeader->Frag == 0)		// Frag. Number is 0 : First frag or only one pkt
-	{
-		// the first pkt of fragment, record it.
-		if (pHeader->FC.MoreFrag)
-		{
-			ASSERT(pAd->FragFrame.pFragPacket);
-			pFragBuffer = GET_OS_PKT_DATAPTR(pAd->FragFrame.pFragPacket);
-			pAd->FragFrame.RxSize   = DataSize + HeaderRoom;
-			NdisMoveMemory(pFragBuffer,	 pHeader, pAd->FragFrame.RxSize);
-			pAd->FragFrame.Sequence = pHeader->Sequence;
-			pAd->FragFrame.LastFrag = pHeader->Frag;	   // Should be 0
-			ASSERT(pAd->FragFrame.LastFrag == 0);
-			goto done;	// end of processing this frame
-		}
-	}
-	else	//Middle & End of fragment
-	{
-		if ((pHeader->Sequence != pAd->FragFrame.Sequence) ||
-			(pHeader->Frag != (pAd->FragFrame.LastFrag + 1)))
-		{
-			// Fragment is not the same sequence or out of fragment number order
-			// Reset Fragment control blk
-			RESET_FRAGFRAME(pAd->FragFrame);
-			DBGPRINT(RT_DEBUG_ERROR, ("Fragment is not the same sequence or out of fragment number order.\n"));
-			goto done; // give up this frame
-		}
-		else if ((pAd->FragFrame.RxSize + DataSize) > MAX_FRAME_SIZE)
-		{
-			// Fragment frame is too large, it exeeds the maximum frame size.
-			// Reset Fragment control blk
-			RESET_FRAGFRAME(pAd->FragFrame);
-			DBGPRINT(RT_DEBUG_ERROR, ("Fragment frame is too large, it exeeds the maximum frame size.\n"));
-			goto done; // give up this frame
-		}
-
-        //
-		// Broadcom AP(BCM94704AGR) will send out LLC in fragment's packet, LLC only can accpet at first fragment.
-		// In this case, we will dropt it.
-		//
-		if (NdisEqualMemory(pData, SNAP_802_1H, sizeof(SNAP_802_1H)))
-		{
-			DBGPRINT(RT_DEBUG_ERROR, ("Find another LLC at Middle or End fragment(SN=%d, Frag=%d)\n", pHeader->Sequence, pHeader->Frag));
-			goto done; // give up this frame
-		}
-
-		pFragBuffer = GET_OS_PKT_DATAPTR(pAd->FragFrame.pFragPacket);
-
-		// concatenate this fragment into the re-assembly buffer
-		NdisMoveMemory((pFragBuffer + pAd->FragFrame.RxSize), pData, DataSize);
-		pAd->FragFrame.RxSize  += DataSize;
-		pAd->FragFrame.LastFrag = pHeader->Frag;	   // Update fragment number
-
-		// Last fragment
-		if (pHeader->FC.MoreFrag == FALSE)
-		{
-			bReassDone = TRUE;
-		}
-	}
-
-done:
-	// always release rx fragmented packet
-	RELEASE_NDIS_PACKET(pAd, pRxPacket, NDIS_STATUS_FAILURE);
-
-	// return defragmented packet if packet is reassembled completely
-	// otherwise return NULL
-	if (bReassDone)
-	{
-		PNDIS_PACKET pNewFragPacket;
-
-		// allocate a new packet buffer for fragment
-		pNewFragPacket = RTMP_AllocateFragPacketBuffer(pAd, RX_BUFFER_NORMSIZE);
-		if (pNewFragPacket)
-		{
-			// update RxBlk
-			pRetPacket = pAd->FragFrame.pFragPacket;
-			pAd->FragFrame.pFragPacket = pNewFragPacket;
-			pRxBlk->pHeader = (PHEADER_802_11) GET_OS_PKT_DATAPTR(pRetPacket);
-			pRxBlk->pData = (UCHAR *)pRxBlk->pHeader + HeaderRoom;
-			pRxBlk->DataSize = pAd->FragFrame.RxSize - HeaderRoom;
-			pRxBlk->pRxPacket = pRetPacket;
-		}
-		else
-		{
-			RESET_FRAGFRAME(pAd->FragFrame);
-		}
-	}
-
-	return pRetPacket;
-}
-
-
-VOID Indicate_AMSDU_Packet(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	RX_BLK			*pRxBlk,
-	IN	UCHAR			FromWhichBSSID)
-{
-	UINT			nMSDU;
-
-	update_os_packet_info(pAd, pRxBlk, FromWhichBSSID);
-	RTMP_SET_PACKET_IF(pRxBlk->pRxPacket, FromWhichBSSID);
-	nMSDU = deaggregate_AMSDU_announce(pAd, pRxBlk->pRxPacket, pRxBlk->pData, pRxBlk->DataSize);
-}
-
-VOID Indicate_EAPOL_Packet(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	RX_BLK			*pRxBlk,
-	IN	UCHAR			FromWhichBSSID)
-{
-	MAC_TABLE_ENTRY *pEntry = NULL;
-
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-		pEntry = &pAd->MacTab.Content[BSSID_WCID];
-		STARxEAPOLFrameIndicate(pAd, pEntry, pRxBlk, FromWhichBSSID);
-		return;
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-	if (pEntry == NULL)
-	{
-		DBGPRINT(RT_DEBUG_WARN, ("Indicate_EAPOL_Packet: drop and release the invalid packet.\n"));
-		// release packet
-		RELEASE_NDIS_PACKET(pAd, pRxBlk->pRxPacket, NDIS_STATUS_FAILURE);
-		return;
-	}
-}
-
-#define BCN_TBTT_OFFSET		64	//defer 64 us
-VOID ReSyncBeaconTime(
-	IN  PRTMP_ADAPTER   pAd)
-{
-
-	UINT32  Offset;
-
-
-	Offset = (pAd->TbttTickCount) % (BCN_TBTT_OFFSET);
-
-	pAd->TbttTickCount++;
-
-	//
-	// The updated BeaconInterval Value will affect Beacon Interval after two TBTT
-	// beacasue the original BeaconInterval had been loaded into next TBTT_TIMER
-	//
-	if (Offset == (BCN_TBTT_OFFSET-2))
-	{
-		BCN_TIME_CFG_STRUC csr;
-		RTMP_IO_READ32(pAd, BCN_TIME_CFG, &csr.word);
-		csr.field.BeaconInterval = (pAd->CommonCfg.BeaconPeriod << 4) - 1 ;	// ASIC register in units of 1/16 TU = 64us
-		RTMP_IO_WRITE32(pAd, BCN_TIME_CFG, csr.word);
-	}
-	else
-	{
-		if (Offset == (BCN_TBTT_OFFSET-1))
-		{
-			BCN_TIME_CFG_STRUC csr;
-
-			RTMP_IO_READ32(pAd, BCN_TIME_CFG, &csr.word);
-			csr.field.BeaconInterval = (pAd->CommonCfg.BeaconPeriod) << 4; // ASIC register in units of 1/16 TU
-			RTMP_IO_WRITE32(pAd, BCN_TIME_CFG, csr.word);
-		}
-	}
-}
diff --git a/drivers/staging/rt3090/common/cmm_data_pci.c b/drivers/staging/rt3090/common/cmm_data_pci.c
deleted file mode 100644
index 084f81927158..000000000000
--- a/drivers/staging/rt3090/common/cmm_data_pci.c
+++ /dev/null
@@ -1,1576 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-*/
-
-/*
-   All functions in this file must be PCI-depended, or you should out your function
-	in other files.
-
-*/
-#include "../rt_config.h"
-
-
-USHORT RtmpPCI_WriteTxResource(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	TX_BLK			*pTxBlk,
-	IN	BOOLEAN			bIsLast,
-	OUT	USHORT			*FreeNumber)
-{
-
-	UCHAR			*pDMAHeaderBufVA;
-	USHORT			TxIdx, RetTxIdx;
-	PTXD_STRUC		pTxD;
-	UINT32			BufBasePaLow;
-	PRTMP_TX_RING	pTxRing;
-	USHORT			hwHeaderLen;
-
-	//
-	// get Tx Ring Resource
-	//
-	pTxRing = &pAd->TxRing[pTxBlk->QueIdx];
-	TxIdx = pAd->TxRing[pTxBlk->QueIdx].TxCpuIdx;
-	pDMAHeaderBufVA = (PUCHAR) pTxRing->Cell[TxIdx].DmaBuf.AllocVa;
-	BufBasePaLow = RTMP_GetPhysicalAddressLow(pTxRing->Cell[TxIdx].DmaBuf.AllocPa);
-
-	// copy TXINFO + TXWI + WLAN Header + LLC into DMA Header Buffer
-	if (pTxBlk->TxFrameType == TX_AMSDU_FRAME)
-	{
-		//hwHeaderLen = ROUND_UP(pTxBlk->MpduHeaderLen-LENGTH_AMSDU_SUBFRAMEHEAD, 4)+LENGTH_AMSDU_SUBFRAMEHEAD;
-		hwHeaderLen = pTxBlk->MpduHeaderLen - LENGTH_AMSDU_SUBFRAMEHEAD + pTxBlk->HdrPadLen + LENGTH_AMSDU_SUBFRAMEHEAD;
-	}
-	else
-	{
-		//hwHeaderLen = ROUND_UP(pTxBlk->MpduHeaderLen, 4);
-		hwHeaderLen = pTxBlk->MpduHeaderLen + pTxBlk->HdrPadLen;
-	}
-	NdisMoveMemory(pDMAHeaderBufVA, pTxBlk->HeaderBuf, TXINFO_SIZE + TXWI_SIZE + hwHeaderLen);
-
-	pTxRing->Cell[TxIdx].pNdisPacket = pTxBlk->pPacket;
-	pTxRing->Cell[TxIdx].pNextNdisPacket = NULL;
-
-	//
-	// build Tx Descriptor
-	//
-
-	pTxD = (PTXD_STRUC) pTxRing->Cell[TxIdx].AllocVa;
-	NdisZeroMemory(pTxD, TXD_SIZE);
-
-	pTxD->SDPtr0 = BufBasePaLow;
-	pTxD->SDLen0 = TXINFO_SIZE + TXWI_SIZE + hwHeaderLen; // include padding
-	pTxD->SDPtr1 = PCI_MAP_SINGLE(pAd, pTxBlk, 0, 1, PCI_DMA_TODEVICE);
-	pTxD->SDLen1 = pTxBlk->SrcBufLen;
-	pTxD->LastSec0 = 0;
-	pTxD->LastSec1 = (bIsLast) ? 1 : 0;
-
-	RTMPWriteTxDescriptor(pAd, pTxD, FALSE, FIFO_EDCA);
-
-	RetTxIdx = TxIdx;
-	//
-	// Update Tx index
-	//
-	INC_RING_INDEX(TxIdx, TX_RING_SIZE);
-	pTxRing->TxCpuIdx = TxIdx;
-
-	*FreeNumber -= 1;
-
-	return RetTxIdx;
-}
-
-
-USHORT RtmpPCI_WriteSingleTxResource(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	TX_BLK			*pTxBlk,
-	IN	BOOLEAN			bIsLast,
-	OUT	USHORT			*FreeNumber)
-{
-
-	UCHAR			*pDMAHeaderBufVA;
-	USHORT			TxIdx, RetTxIdx;
-	PTXD_STRUC		pTxD;
-#ifdef RT_BIG_ENDIAN
-    PTXD_STRUC      pDestTxD;
-    TXD_STRUC       TxD;
-#endif
-	UINT32			BufBasePaLow;
-	PRTMP_TX_RING	pTxRing;
-	USHORT			hwHeaderLen;
-
-	//
-	// get Tx Ring Resource
-	//
-	pTxRing = &pAd->TxRing[pTxBlk->QueIdx];
-	TxIdx = pAd->TxRing[pTxBlk->QueIdx].TxCpuIdx;
-	pDMAHeaderBufVA = (PUCHAR) pTxRing->Cell[TxIdx].DmaBuf.AllocVa;
-	BufBasePaLow = RTMP_GetPhysicalAddressLow(pTxRing->Cell[TxIdx].DmaBuf.AllocPa);
-
-	// copy TXINFO + TXWI + WLAN Header + LLC into DMA Header Buffer
-	//hwHeaderLen = ROUND_UP(pTxBlk->MpduHeaderLen, 4);
-	hwHeaderLen = pTxBlk->MpduHeaderLen + pTxBlk->HdrPadLen;
-
-	NdisMoveMemory(pDMAHeaderBufVA, pTxBlk->HeaderBuf, TXINFO_SIZE + TXWI_SIZE + hwHeaderLen);
-
-	pTxRing->Cell[TxIdx].pNdisPacket = pTxBlk->pPacket;
-	pTxRing->Cell[TxIdx].pNextNdisPacket = NULL;
-
-	//
-	// build Tx Descriptor
-	//
-#ifndef RT_BIG_ENDIAN
-	pTxD = (PTXD_STRUC) pTxRing->Cell[TxIdx].AllocVa;
-#else
-	pDestTxD = (PTXD_STRUC) pTxRing->Cell[TxIdx].AllocVa;
-	TxD = *pDestTxD;
-	pTxD = &TxD;
-#endif
-	NdisZeroMemory(pTxD, TXD_SIZE);
-
-	pTxD->SDPtr0 = BufBasePaLow;
-	pTxD->SDLen0 = TXINFO_SIZE + TXWI_SIZE + hwHeaderLen; // include padding
-	pTxD->SDPtr1 = PCI_MAP_SINGLE(pAd, pTxBlk, 0, 1, PCI_DMA_TODEVICE);;
-	pTxD->SDLen1 = pTxBlk->SrcBufLen;
-	pTxD->LastSec0 = 0;
-	pTxD->LastSec1 = (bIsLast) ? 1 : 0;
-
-	RTMPWriteTxDescriptor(pAd, pTxD, FALSE, FIFO_EDCA);
-#ifdef RT_BIG_ENDIAN
-	RTMPWIEndianChange((PUCHAR)(pDMAHeaderBufVA + TXINFO_SIZE), TYPE_TXWI);
-	RTMPFrameEndianChange(pAd, (PUCHAR)(pDMAHeaderBufVA + TXINFO_SIZE + TXWI_SIZE), DIR_WRITE, FALSE);
-	RTMPDescriptorEndianChange((PUCHAR)pTxD, TYPE_TXD);
-	WriteBackToDescriptor((PUCHAR)pDestTxD, (PUCHAR)pTxD, FALSE, TYPE_TXD);
-#endif // RT_BIG_ENDIAN //
-
-	RetTxIdx = TxIdx;
-	//
-	// Update Tx index
-	//
-	INC_RING_INDEX(TxIdx, TX_RING_SIZE);
-	pTxRing->TxCpuIdx = TxIdx;
-
-	*FreeNumber -= 1;
-
-	return RetTxIdx;
-}
-
-
-USHORT RtmpPCI_WriteMultiTxResource(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	TX_BLK			*pTxBlk,
-	IN	UCHAR			frameNum,
-	OUT	USHORT			*FreeNumber)
-{
-	BOOLEAN bIsLast;
-	UCHAR			*pDMAHeaderBufVA;
-	USHORT			TxIdx, RetTxIdx;
-	PTXD_STRUC		pTxD;
-#ifdef RT_BIG_ENDIAN
-    PTXD_STRUC      pDestTxD;
-    TXD_STRUC       TxD;
-#endif
-	UINT32			BufBasePaLow;
-	PRTMP_TX_RING	pTxRing;
-	USHORT			hwHdrLen;
-	UINT32			firstDMALen;
-
-	bIsLast = ((frameNum == (pTxBlk->TotalFrameNum - 1)) ? 1 : 0);
-
-	//
-	// get Tx Ring Resource
-	//
-	pTxRing = &pAd->TxRing[pTxBlk->QueIdx];
-	TxIdx = pAd->TxRing[pTxBlk->QueIdx].TxCpuIdx;
-	pDMAHeaderBufVA = (PUCHAR) pTxRing->Cell[TxIdx].DmaBuf.AllocVa;
-	BufBasePaLow = RTMP_GetPhysicalAddressLow(pTxRing->Cell[TxIdx].DmaBuf.AllocPa);
-
-	if (frameNum == 0)
-	{
-		// copy TXINFO + TXWI + WLAN Header + LLC into DMA Header Buffer
-		if (pTxBlk->TxFrameType == TX_AMSDU_FRAME)
-			//hwHdrLen = ROUND_UP(pTxBlk->MpduHeaderLen-LENGTH_AMSDU_SUBFRAMEHEAD, 4)+LENGTH_AMSDU_SUBFRAMEHEAD;
-			hwHdrLen = pTxBlk->MpduHeaderLen - LENGTH_AMSDU_SUBFRAMEHEAD + pTxBlk->HdrPadLen + LENGTH_AMSDU_SUBFRAMEHEAD;
-		else if (pTxBlk->TxFrameType == TX_RALINK_FRAME)
-			//hwHdrLen = ROUND_UP(pTxBlk->MpduHeaderLen-LENGTH_ARALINK_HEADER_FIELD, 4)+LENGTH_ARALINK_HEADER_FIELD;
-			hwHdrLen = pTxBlk->MpduHeaderLen - LENGTH_ARALINK_HEADER_FIELD + pTxBlk->HdrPadLen + LENGTH_ARALINK_HEADER_FIELD;
-		else
-			//hwHdrLen = ROUND_UP(pTxBlk->MpduHeaderLen, 4);
-			hwHdrLen = pTxBlk->MpduHeaderLen + pTxBlk->HdrPadLen;
-
-		firstDMALen = TXINFO_SIZE + TXWI_SIZE + hwHdrLen;
-	}
-	else
-	{
-		firstDMALen = pTxBlk->MpduHeaderLen;
-	}
-
-	NdisMoveMemory(pDMAHeaderBufVA, pTxBlk->HeaderBuf, firstDMALen);
-
-	pTxRing->Cell[TxIdx].pNdisPacket = pTxBlk->pPacket;
-	pTxRing->Cell[TxIdx].pNextNdisPacket = NULL;
-
-	//
-	// build Tx Descriptor
-	//
-#ifndef RT_BIG_ENDIAN
-	pTxD = (PTXD_STRUC) pTxRing->Cell[TxIdx].AllocVa;
-#else
-	pDestTxD = (PTXD_STRUC) pTxRing->Cell[TxIdx].AllocVa;
-	TxD = *pDestTxD;
-	pTxD = &TxD;
-#endif
-	NdisZeroMemory(pTxD, TXD_SIZE);
-
-	pTxD->SDPtr0 = BufBasePaLow;
-	pTxD->SDLen0 = firstDMALen; // include padding
-	pTxD->SDPtr1 = PCI_MAP_SINGLE(pAd, pTxBlk, 0, 1, PCI_DMA_TODEVICE);;
-	pTxD->SDLen1 = pTxBlk->SrcBufLen;
-	pTxD->LastSec0 = 0;
-	pTxD->LastSec1 = (bIsLast) ? 1 : 0;
-
-	RTMPWriteTxDescriptor(pAd, pTxD, FALSE, FIFO_EDCA);
-
-#ifdef RT_BIG_ENDIAN
-	if (frameNum == 0)
-		RTMPFrameEndianChange(pAd, (PUCHAR)(pDMAHeaderBufVA+ TXINFO_SIZE + TXWI_SIZE), DIR_WRITE, FALSE);
-
-	if (frameNum != 0)
-		RTMPWIEndianChange((PUCHAR)(pDMAHeaderBufVA + TXINFO_SIZE), TYPE_TXWI);
-
-	RTMPDescriptorEndianChange((PUCHAR)pTxD, TYPE_TXD);
-	WriteBackToDescriptor((PUCHAR)pDestTxD, (PUCHAR)pTxD, FALSE, TYPE_TXD);
-#endif // RT_BIG_ENDIAN //
-
-	RetTxIdx = TxIdx;
-	//
-	// Update Tx index
-	//
-	INC_RING_INDEX(TxIdx, TX_RING_SIZE);
-	pTxRing->TxCpuIdx = TxIdx;
-
-	*FreeNumber -= 1;
-
-	return RetTxIdx;
-
-}
-
-
-VOID RtmpPCI_FinalWriteTxResource(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	TX_BLK			*pTxBlk,
-	IN	USHORT			totalMPDUSize,
-	IN	USHORT			FirstTxIdx)
-{
-
-	PTXWI_STRUC		pTxWI;
-	PRTMP_TX_RING	pTxRing;
-
-	//
-	// get Tx Ring Resource
-	//
-	pTxRing = &pAd->TxRing[pTxBlk->QueIdx];
-	pTxWI = (PTXWI_STRUC) pTxRing->Cell[FirstTxIdx].DmaBuf.AllocVa;
-	pTxWI->MPDUtotalByteCount = totalMPDUSize;
-#ifdef RT_BIG_ENDIAN
-	RTMPWIEndianChange((PUCHAR)pTxWI, TYPE_TXWI);
-#endif // RT_BIG_ENDIAN //
-
-}
-
-
-VOID RtmpPCIDataLastTxIdx(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			QueIdx,
-	IN	USHORT			LastTxIdx)
-{
-	PTXD_STRUC		pTxD;
-#ifdef RT_BIG_ENDIAN
-    PTXD_STRUC      pDestTxD;
-    TXD_STRUC       TxD;
-#endif
-	PRTMP_TX_RING	pTxRing;
-
-	//
-	// get Tx Ring Resource
-	//
-	pTxRing = &pAd->TxRing[QueIdx];
-
-	//
-	// build Tx Descriptor
-	//
-#ifndef RT_BIG_ENDIAN
-	pTxD = (PTXD_STRUC) pTxRing->Cell[LastTxIdx].AllocVa;
-#else
-	pDestTxD = (PTXD_STRUC) pTxRing->Cell[LastTxIdx].AllocVa;
-	TxD = *pDestTxD;
-	pTxD = &TxD;
-#endif
-
-	pTxD->LastSec1 = 1;
-
-#ifdef RT_BIG_ENDIAN
-	RTMPDescriptorEndianChange((PUCHAR)pTxD, TYPE_TXD);
-	WriteBackToDescriptor((PUCHAR)pDestTxD, (PUCHAR)pTxD, FALSE, TYPE_TXD);
-#endif // RT_BIG_ENDIAN //
-
-}
-
-
-USHORT	RtmpPCI_WriteFragTxResource(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	TX_BLK			*pTxBlk,
-	IN	UCHAR			fragNum,
-	OUT	USHORT			*FreeNumber)
-{
-	UCHAR			*pDMAHeaderBufVA;
-	USHORT			TxIdx, RetTxIdx;
-	PTXD_STRUC		pTxD;
-#ifdef RT_BIG_ENDIAN
-    PTXD_STRUC      pDestTxD;
-    TXD_STRUC       TxD;
-#endif
-	UINT32			BufBasePaLow;
-	PRTMP_TX_RING	pTxRing;
-	USHORT			hwHeaderLen;
-	UINT32			firstDMALen;
-
-	//
-	// Get Tx Ring Resource
-	//
-	pTxRing = &pAd->TxRing[pTxBlk->QueIdx];
-	TxIdx = pAd->TxRing[pTxBlk->QueIdx].TxCpuIdx;
-	pDMAHeaderBufVA = (PUCHAR) pTxRing->Cell[TxIdx].DmaBuf.AllocVa;
-	BufBasePaLow = RTMP_GetPhysicalAddressLow(pTxRing->Cell[TxIdx].DmaBuf.AllocPa);
-
-	//
-	// Copy TXINFO + TXWI + WLAN Header + LLC into DMA Header Buffer
-	//
-	//hwHeaderLen = ROUND_UP(pTxBlk->MpduHeaderLen, 4);
-	hwHeaderLen = pTxBlk->MpduHeaderLen + pTxBlk->HdrPadLen;
-
-	firstDMALen = TXINFO_SIZE + TXWI_SIZE + hwHeaderLen;
-	NdisMoveMemory(pDMAHeaderBufVA, pTxBlk->HeaderBuf, firstDMALen);
-
-
-	//
-	// Build Tx Descriptor
-	//
-#ifndef RT_BIG_ENDIAN
-	pTxD = (PTXD_STRUC) pTxRing->Cell[TxIdx].AllocVa;
-#else
-	pDestTxD = (PTXD_STRUC) pTxRing->Cell[TxIdx].AllocVa;
-	TxD = *pDestTxD;
-	pTxD = &TxD;
-#endif
-	NdisZeroMemory(pTxD, TXD_SIZE);
-
-	if (fragNum == pTxBlk->TotalFragNum)
-	{
-		pTxRing->Cell[TxIdx].pNdisPacket = pTxBlk->pPacket;
-		pTxRing->Cell[TxIdx].pNextNdisPacket = NULL;
-	}
-
-	pTxD->SDPtr0 = BufBasePaLow;
-	pTxD->SDLen0 = firstDMALen; // include padding
-	pTxD->SDPtr1 = PCI_MAP_SINGLE(pAd, pTxBlk, 0, 1, PCI_DMA_TODEVICE);
-	pTxD->SDLen1 = pTxBlk->SrcBufLen;
-	pTxD->LastSec0 = 0;
-	pTxD->LastSec1 = 1;
-
-	RTMPWriteTxDescriptor(pAd, pTxD, FALSE, FIFO_EDCA);
-
-#ifdef RT_BIG_ENDIAN
-	RTMPWIEndianChange((PUCHAR)(pDMAHeaderBufVA + TXINFO_SIZE), TYPE_TXWI);
-	RTMPFrameEndianChange(pAd, (PUCHAR)(pDMAHeaderBufVA + TXINFO_SIZE + TXWI_SIZE), DIR_WRITE, FALSE);
-	RTMPDescriptorEndianChange((PUCHAR)pTxD, TYPE_TXD);
-    WriteBackToDescriptor((PUCHAR)pDestTxD, (PUCHAR)pTxD, FALSE, TYPE_TXD);
-#endif // RT_BIG_ENDIAN //
-
-	RetTxIdx = TxIdx;
-	pTxBlk->Priv += pTxBlk->SrcBufLen;
-
-	//
-	// Update Tx index
-	//
-	INC_RING_INDEX(TxIdx, TX_RING_SIZE);
-	pTxRing->TxCpuIdx = TxIdx;
-
-	*FreeNumber -= 1;
-
-	return RetTxIdx;
-
-}
-
-
-/*
-	Must be run in Interrupt context
-	This function handle PCI specific TxDesc and cpu index update and kick the packet out.
- */
-int RtmpPCIMgmtKickOut(
-	IN RTMP_ADAPTER		*pAd,
-	IN UCHAR			QueIdx,
-	IN PNDIS_PACKET		pPacket,
-	IN PUCHAR			pSrcBufVA,
-	IN UINT				SrcBufLen)
-{
-	PTXD_STRUC		pTxD;
-#ifdef RT_BIG_ENDIAN
-    PTXD_STRUC      pDestTxD;
-    TXD_STRUC       TxD;
-#endif
-	ULONG			SwIdx = pAd->MgmtRing.TxCpuIdx;
-
-#ifdef RT_BIG_ENDIAN
-    pDestTxD  = (PTXD_STRUC)pAd->MgmtRing.Cell[SwIdx].AllocVa;
-    TxD = *pDestTxD;
-    pTxD = &TxD;
-    RTMPDescriptorEndianChange((PUCHAR)pTxD, TYPE_TXD);
-#else
-	pTxD  = (PTXD_STRUC) pAd->MgmtRing.Cell[SwIdx].AllocVa;
-#endif
-
-	pAd->MgmtRing.Cell[SwIdx].pNdisPacket = pPacket;
-	pAd->MgmtRing.Cell[SwIdx].pNextNdisPacket = NULL;
-
-	RTMPWriteTxDescriptor(pAd, pTxD, TRUE, FIFO_MGMT);
-	pTxD->LastSec0 = 1;
-	pTxD->LastSec1 = 1;
-	pTxD->DMADONE = 0;
-	pTxD->SDLen1 = 0;
-	pTxD->SDPtr0 = PCI_MAP_SINGLE(pAd, pSrcBufVA, SrcBufLen, 0, PCI_DMA_TODEVICE);
-	pTxD->SDLen0 = SrcBufLen;
-
-#ifdef RT_BIG_ENDIAN
-	RTMPDescriptorEndianChange((PUCHAR)pTxD, TYPE_TXD);
-    WriteBackToDescriptor((PUCHAR)pDestTxD, (PUCHAR)pTxD, FALSE, TYPE_TXD);
-#endif
-
-//==================================================================
-/*	DBGPRINT_RAW(RT_DEBUG_TRACE, ("MLMEHardTransmit\n"));
-	for (i = 0; i < (TXWI_SIZE+24); i++)
-	{
-
-		DBGPRINT_RAW(RT_DEBUG_TRACE, ("%x:", *(pSrcBufVA+i)));
-		if ( i%4 == 3)
-			DBGPRINT_RAW(RT_DEBUG_TRACE, (" :: "));
-		if ( i%16 == 15)
-			DBGPRINT_RAW(RT_DEBUG_TRACE, ("\n      "));
-	}
-	DBGPRINT_RAW(RT_DEBUG_TRACE, ("\n      "));*/
-//=======================================================================
-
-	pAd->RalinkCounters.KickTxCount++;
-	pAd->RalinkCounters.OneSecTxDoneCount++;
-
-	// Increase TX_CTX_IDX, but write to register later.
-	INC_RING_INDEX(pAd->MgmtRing.TxCpuIdx, MGMT_RING_SIZE);
-
-	RTMP_IO_WRITE32(pAd, TX_MGMTCTX_IDX,  pAd->MgmtRing.TxCpuIdx);
-
-	return 0;
-}
-
-
-#ifdef CONFIG_STA_SUPPORT
-/*
-	========================================================================
-
-	Routine Description:
-		Check Rx descriptor, return NDIS_STATUS_FAILURE if any error dound
-
-	Arguments:
-		pRxD		Pointer to the Rx descriptor
-
-	Return Value:
-		NDIS_STATUS_SUCCESS	No err
-		NDIS_STATUS_FAILURE	Error
-
-	Note:
-
-	========================================================================
-*/
-NDIS_STATUS RTMPCheckRxError(
-	IN	PRTMP_ADAPTER		pAd,
-	IN	PHEADER_802_11		pHeader,
-	IN	PRXWI_STRUC		pRxWI,
-	IN  PRT28XX_RXD_STRUC	pRxD)
-{
-	PCIPHER_KEY pWpaKey;
-	INT dBm;
-
-	// Phy errors & CRC errors
-	if (/*(pRxD->PhyErr) ||*/ (pRxD->Crc))
-	{
-		// Check RSSI for Noise Hist statistic collection.
-		dBm = (INT) (pRxWI->RSSI0) - pAd->BbpRssiToDbmDelta;
-		if (dBm <= -87)
-			pAd->StaCfg.RPIDensity[0] += 1;
-		else if (dBm <= -82)
-			pAd->StaCfg.RPIDensity[1] += 1;
-		else if (dBm <= -77)
-			pAd->StaCfg.RPIDensity[2] += 1;
-		else if (dBm <= -72)
-			pAd->StaCfg.RPIDensity[3] += 1;
-		else if (dBm <= -67)
-			pAd->StaCfg.RPIDensity[4] += 1;
-		else if (dBm <= -62)
-			pAd->StaCfg.RPIDensity[5] += 1;
-		else if (dBm <= -57)
-			pAd->StaCfg.RPIDensity[6] += 1;
-		else if (dBm > -57)
-			pAd->StaCfg.RPIDensity[7] += 1;
-
-		return(NDIS_STATUS_FAILURE);
-	}
-
-	// Add Rx size to channel load counter, we should ignore error counts
-	pAd->StaCfg.CLBusyBytes += (pRxD->SDL0 + 14);
-
-	// Drop ToDs promiscous frame, it is opened due to CCX 2 channel load statistics
-	if (pHeader != NULL)
-	{
-		if (pHeader->FC.ToDs)
-		{
-			return(NDIS_STATUS_FAILURE);
-		}
-	}
-
-	// Drop not U2M frames, cant's drop here because we will drop beacon in this case
-	// I am kind of doubting the U2M bit operation
-	// if (pRxD->U2M == 0)
-	//	return(NDIS_STATUS_FAILURE);
-
-	// drop decyption fail frame
-	if (pRxD->CipherErr)
-	{
-		if (pRxD->CipherErr == 2)
-			{DBGPRINT_RAW(RT_DEBUG_TRACE,("pRxD ERROR: ICV ok but MICErr "));}
-		else if (pRxD->CipherErr == 1)
-			{DBGPRINT_RAW(RT_DEBUG_TRACE,("pRxD ERROR: ICV Err "));}
-		else if (pRxD->CipherErr == 3)
-			DBGPRINT_RAW(RT_DEBUG_TRACE,("pRxD ERROR: Key not valid "));
-
-        if (((pRxD->CipherErr & 1) == 1) && pAd->CommonCfg.bWirelessEvent && INFRA_ON(pAd))
-            RTMPSendWirelessEvent(pAd, IW_ICV_ERROR_EVENT_FLAG, pAd->MacTab.Content[BSSID_WCID].Addr, BSS0, 0);
-
-		DBGPRINT_RAW(RT_DEBUG_TRACE,(" %d (len=%d, Mcast=%d, MyBss=%d, Wcid=%d, KeyId=%d)\n",
-			pRxD->CipherErr,
-			pRxD->SDL0,
-			pRxD->Mcast | pRxD->Bcast,
-			pRxD->MyBss,
-			pRxWI->WirelessCliID,
-//			CipherName[pRxD->CipherAlg],
-			pRxWI->KeyIndex));
-
-		//
-		// MIC Error
-		//
-		if (pRxD->CipherErr == 2)
-		{
-			pWpaKey = &pAd->SharedKey[BSS0][pRxWI->KeyIndex];
-#ifdef WPA_SUPPLICANT_SUPPORT
-            if (pAd->StaCfg.WpaSupplicantUP)
-                WpaSendMicFailureToWpaSupplicant(pAd,
-                                   (pWpaKey->Type == PAIRWISEKEY) ? TRUE:FALSE);
-            else
-#endif // WPA_SUPPLICANT_SUPPORT //
-			    RTMPReportMicError(pAd, pWpaKey);
-
-            if (((pRxD->CipherErr & 2) == 2) && pAd->CommonCfg.bWirelessEvent && INFRA_ON(pAd))
-                RTMPSendWirelessEvent(pAd, IW_MIC_ERROR_EVENT_FLAG, pAd->MacTab.Content[BSSID_WCID].Addr, BSS0, 0);
-
-			DBGPRINT_RAW(RT_DEBUG_ERROR,("Rx MIC Value error\n"));
-		}
-
-		if (pHeader == NULL)
-			return(NDIS_STATUS_SUCCESS);
-		/*if ((pRxD->CipherAlg == CIPHER_AES) &&
-			(pHeader->Sequence == pAd->FragFrame.Sequence))
-		{
-			//
-			// Acceptable since the First FragFrame no CipherErr problem.
-			//
-			return(NDIS_STATUS_SUCCESS);
-		}*/
-
-		return(NDIS_STATUS_FAILURE);
-	}
-
-	return(NDIS_STATUS_SUCCESS);
-}
-#endif // CONFIG_STA_SUPPORT //
-
-
-BOOLEAN  RTMPFreeTXDUponTxDmaDone(
-	IN PRTMP_ADAPTER	pAd,
-	IN UCHAR			QueIdx)
-{
-	PRTMP_TX_RING pTxRing;
-	PTXD_STRUC	  pTxD;
-#ifdef	RT_BIG_ENDIAN
-    PTXD_STRUC      pDestTxD;
-#endif
-	PNDIS_PACKET  pPacket;
-	UCHAR	FREE = 0;
-	TXD_STRUC	TxD, *pOriTxD;
-	//ULONG		IrqFlags;
-	BOOLEAN			bReschedule = FALSE;
-
-
-	ASSERT(QueIdx < NUM_OF_TX_RING);
-	pTxRing = &pAd->TxRing[QueIdx];
-
-	RTMP_IO_READ32(pAd, TX_DTX_IDX0 + QueIdx * RINGREG_DIFF, &pTxRing->TxDmaIdx);
-	while (pTxRing->TxSwFreeIdx != pTxRing->TxDmaIdx)
-	{
-//		RTMP_IRQ_LOCK(&pAd->irq_lock, IrqFlags);
-#ifdef RALINK_ATE
-#ifdef RALINK_28xx_QA
-		PHEADER_802_11	pHeader80211;
-
-		if ((ATE_ON(pAd)) && (pAd->ate.bQATxStart == TRUE))
-		{
-			if (pAd->ate.QID == QueIdx)
-			{
-				pAd->ate.TxDoneCount++;
-				pAd->RalinkCounters.KickTxCount++;
-
-				/* always use QID_AC_BE and FIFO_EDCA */
-				ASSERT(pAd->ate.QID == 0);
-				pAd->ate.TxAc0++;
-
-				FREE++;
-#ifndef RT_BIG_ENDIAN
-				pTxD = (PTXD_STRUC) (pTxRing->Cell[pTxRing->TxSwFreeIdx].AllocVa);
-				pOriTxD = pTxD;
-		        NdisMoveMemory(&TxD, pTxD, sizeof(TXD_STRUC));
-				pTxD = &TxD;
-#else
-		        pDestTxD = (PTXD_STRUC) (pTxRing->Cell[pTxRing->TxSwFreeIdx].AllocVa);
-		        pOriTxD = pDestTxD ;
-		        TxD = *pDestTxD;
-		        pTxD = &TxD;
-		        RTMPDescriptorEndianChange((PUCHAR)pTxD, TYPE_TXD);
-#endif
-				pTxD->DMADONE = 0;
-
-				pHeader80211 = pTxRing->Cell[pTxRing->TxSwFreeIdx].DmaBuf.AllocVa + sizeof(TXWI_STRUC);
-#ifdef RT_BIG_ENDIAN
-				RTMPFrameEndianChange(pAd, (PUCHAR)pHeader80211, DIR_READ, FALSE);
-#endif
-				pHeader80211->Sequence = ++pAd->ate.seq;
-#ifdef RT_BIG_ENDIAN
-				RTMPFrameEndianChange(pAd, (PUCHAR)pHeader80211, DIR_WRITE, FALSE);
-#endif
-
-				if  ((pAd->ate.bQATxStart == TRUE) && (pAd->ate.Mode & ATE_TXFRAME) && (pAd->ate.TxDoneCount < pAd->ate.TxCount))
-				{
-					pAd->RalinkCounters.TransmittedByteCount +=  (pTxD->SDLen1 + pTxD->SDLen0);
-					pAd->RalinkCounters.OneSecTransmittedByteCount += (pTxD->SDLen1 + pTxD->SDLen0);
-					pAd->RalinkCounters.OneSecDmaDoneCount[QueIdx] ++;
-					INC_RING_INDEX(pTxRing->TxSwFreeIdx, TX_RING_SIZE);
-
-					/* get TX_DTX_IDX again */
-					RTMP_IO_READ32(pAd, TX_DTX_IDX0 + QueIdx * RINGREG_DIFF ,  &pTxRing->TxDmaIdx);
-					goto kick_out;
-				}
-				else if ((pAd->ate.TxStatus == 1)/* or (pAd->ate.bQATxStart == TRUE) ??? */ && (pAd->ate.TxDoneCount == pAd->ate.TxCount))
-				{
-					DBGPRINT(RT_DEBUG_TRACE,("all Tx is done\n"));
-
-					// Tx status enters idle mode.
-					pAd->ate.TxStatus = 0;
-				}
-				else if (!(pAd->ate.Mode & ATE_TXFRAME))
-				{
-					/* not complete sending yet, but someone press the Stop TX botton */
-					DBGPRINT(RT_DEBUG_ERROR,("not complete sending yet, but someone pressed the Stop TX bottom\n"));
-					DBGPRINT(RT_DEBUG_ERROR,("pAd->ate.Mode = 0x%02x\n", pAd->ate.Mode));
-				}
-				else
-				{
-					DBGPRINT(RT_DEBUG_OFF,("pTxRing->TxSwFreeIdx = %d\n", pTxRing->TxSwFreeIdx));
-				}
-
-#ifndef RT_BIG_ENDIAN
-			NdisMoveMemory(pOriTxD, pTxD, sizeof(TXD_STRUC));
-#else
-			RTMPDescriptorEndianChange((PUCHAR)pTxD, TYPE_TXD);
-			*pDestTxD = TxD;
-#endif // RT_BIG_ENDIAN //
-
-				INC_RING_INDEX(pTxRing->TxSwFreeIdx, TX_RING_SIZE);
-				continue;
-			}
-		}
-#endif // RALINK_28xx_QA //
-#endif // RALINK_ATE //
-
-		// static rate also need NICUpdateFifoStaCounters() function.
-		//if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_TX_RATE_SWITCH_ENABLED))
-			NICUpdateFifoStaCounters(pAd);
-
-		/* Note : If (pAd->ate.bQATxStart == TRUE), we will never reach here. */
-		FREE++;
-#ifndef RT_BIG_ENDIAN
-                pTxD = (PTXD_STRUC) (pTxRing->Cell[pTxRing->TxSwFreeIdx].AllocVa);
-		pOriTxD = pTxD;
-                NdisMoveMemory(&TxD, pTxD, sizeof(TXD_STRUC));
-		pTxD = &TxD;
-#else
-        pDestTxD = (PTXD_STRUC) (pTxRing->Cell[pTxRing->TxSwFreeIdx].AllocVa);
-        pOriTxD = pDestTxD ;
-        TxD = *pDestTxD;
-        pTxD = &TxD;
-        RTMPDescriptorEndianChange((PUCHAR)pTxD, TYPE_TXD);
-#endif
-
-		pTxD->DMADONE = 0;
-
-
-#ifdef RALINK_ATE
-		/* Execution of this block is not allowed when ATE is running. */
-		if (!(ATE_ON(pAd)))
-#endif // RALINK_ATE //
-		{
-			pPacket = pTxRing->Cell[pTxRing->TxSwFreeIdx].pNdisPacket;
-			if (pPacket)
-			{
-#ifdef CONFIG_5VT_ENHANCE
-				if (RTMP_GET_PACKET_5VT(pPacket))
-					PCI_UNMAP_SINGLE(pAd, pTxD->SDPtr1, 16, PCI_DMA_TODEVICE);
-				else
-#endif // CONFIG_5VT_ENHANCE //
-					PCI_UNMAP_SINGLE(pAd, pTxD->SDPtr1, pTxD->SDLen1, PCI_DMA_TODEVICE);
-				RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_SUCCESS);
-			}
-			//Always assign pNdisPacket as NULL after clear
-			pTxRing->Cell[pTxRing->TxSwFreeIdx].pNdisPacket = NULL;
-
-			pPacket = pTxRing->Cell[pTxRing->TxSwFreeIdx].pNextNdisPacket;
-
-			ASSERT(pPacket == NULL);
-			if (pPacket)
-			{
-#ifdef CONFIG_5VT_ENHANCE
-				if (RTMP_GET_PACKET_5VT(pPacket))
-					PCI_UNMAP_SINGLE(pAd, pTxD->SDPtr1, 16, PCI_DMA_TODEVICE);
-				else
-#endif // CONFIG_5VT_ENHANCE //
-					PCI_UNMAP_SINGLE(pAd, pTxD->SDPtr1, pTxD->SDLen1, PCI_DMA_TODEVICE);
-				RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_SUCCESS);
-			}
-			//Always assign pNextNdisPacket as NULL after clear
-			pTxRing->Cell[pTxRing->TxSwFreeIdx].pNextNdisPacket = NULL;
-		}
-
-		pAd->RalinkCounters.TransmittedByteCount +=  (pTxD->SDLen1 + pTxD->SDLen0);
-		pAd->RalinkCounters.OneSecDmaDoneCount[QueIdx] ++;
-		INC_RING_INDEX(pTxRing->TxSwFreeIdx, TX_RING_SIZE);
-		/* get tx_tdx_idx again */
-		RTMP_IO_READ32(pAd, TX_DTX_IDX0 + QueIdx * RINGREG_DIFF ,  &pTxRing->TxDmaIdx);
-#ifdef RT_BIG_ENDIAN
-        RTMPDescriptorEndianChange((PUCHAR)pTxD, TYPE_TXD);
-        *pDestTxD = TxD;
-#else
-        NdisMoveMemory(pOriTxD, pTxD, sizeof(TXD_STRUC));
-#endif
-
-#ifdef RALINK_ATE
-#ifdef RALINK_28xx_QA
-kick_out:
-#endif // RALINK_28xx_QA //
-
-		/*
-			ATE_TXCONT mode also need to send some normal frames, so let it in.
-			ATE_STOP must be changed not to be 0xff
-			to prevent it from running into this block.
-		*/
-		if ((pAd->ate.Mode & ATE_TXFRAME) && (pAd->ate.QID == QueIdx))
-		{
-			// TxDoneCount++ has been done if QA is used.
-			if (pAd->ate.bQATxStart == FALSE)
-			{
-				pAd->ate.TxDoneCount++;
-			}
-			if (((pAd->ate.TxCount - pAd->ate.TxDoneCount + 1) >= TX_RING_SIZE))
-			{
-				/* Note : We increase TxCpuIdx here, not TxSwFreeIdx ! */
-				INC_RING_INDEX(pAd->TxRing[QueIdx].TxCpuIdx, TX_RING_SIZE);
-#ifndef RT_BIG_ENDIAN
-				pTxD = (PTXD_STRUC) (pTxRing->Cell[pAd->TxRing[QueIdx].TxCpuIdx].AllocVa);
-				pOriTxD = pTxD;
-		        NdisMoveMemory(&TxD, pTxD, sizeof(TXD_STRUC));
-				pTxD = &TxD;
-#else
-		        pDestTxD = (PTXD_STRUC) (pTxRing->Cell[pAd->TxRing[QueIdx].TxCpuIdx].AllocVa);
-		        pOriTxD = pDestTxD ;
-		        TxD = *pDestTxD;
-		        pTxD = &TxD;
-		        RTMPDescriptorEndianChange((PUCHAR)pTxD, TYPE_TXD);
-#endif
-				pTxD->DMADONE = 0;
-#ifndef RT_BIG_ENDIAN
-			NdisMoveMemory(pOriTxD, pTxD, sizeof(TXD_STRUC));
-#else
-			RTMPDescriptorEndianChange((PUCHAR)pTxD, TYPE_TXD);
-			*pDestTxD = TxD;
-#endif
-				// kick Tx-Ring
-				RTMP_IO_WRITE32(pAd, TX_CTX_IDX0 + QueIdx * RINGREG_DIFF, pAd->TxRing[QueIdx].TxCpuIdx);
-				pAd->RalinkCounters.KickTxCount++;
-			}
-		}
-#endif // RALINK_ATE //
-//         RTMP_IRQ_UNLOCK(&pAd->irq_lock, IrqFlags);
-	}
-
-
-	return  bReschedule;
-
-}
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		Process TX Rings DMA Done interrupt, running in DPC level
-
-	Arguments:
-		Adapter		Pointer to our adapter
-
-	Return Value:
-		None
-
-	IRQL = DISPATCH_LEVEL
-
-	========================================================================
-*/
-BOOLEAN	RTMPHandleTxRingDmaDoneInterrupt(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	INT_SOURCE_CSR_STRUC TxRingBitmap)
-{
-//	UCHAR			Count = 0;
-    unsigned long	IrqFlags;
-	BOOLEAN			bReschedule = FALSE;
-
-	// Make sure Tx ring resource won't be used by other threads
-	//NdisAcquireSpinLock(&pAd->TxRingLock);
-
-	RTMP_IRQ_LOCK(&pAd->irq_lock, IrqFlags);
-
-	if (TxRingBitmap.field.Ac0DmaDone)
-		bReschedule = RTMPFreeTXDUponTxDmaDone(pAd, QID_AC_BE);
-/*
-	if (TxRingBitmap.field.HccaDmaDone)
-		bReschedule |= RTMPFreeTXDUponTxDmaDone(pAd, QID_HCCA);
-*/
-
-	if (TxRingBitmap.field.Ac3DmaDone)
-		bReschedule |= RTMPFreeTXDUponTxDmaDone(pAd, QID_AC_VO);
-
-	if (TxRingBitmap.field.Ac2DmaDone)
-		bReschedule |= RTMPFreeTXDUponTxDmaDone(pAd, QID_AC_VI);
-
-	if (TxRingBitmap.field.Ac1DmaDone)
-		bReschedule |= RTMPFreeTXDUponTxDmaDone(pAd, QID_AC_BK);
-
-	// Make sure to release Tx ring resource
-	//NdisReleaseSpinLock(&pAd->TxRingLock);
-	RTMP_IRQ_UNLOCK(&pAd->irq_lock, IrqFlags);
-
-	// Dequeue outgoing frames from TxSwQueue[] and process it
-	RTMPDeQueuePacket(pAd, FALSE, NUM_OF_TX_RING, MAX_TX_PROCESS);
-
-	return  bReschedule;
-}
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		Process MGMT ring DMA done interrupt, running in DPC level
-
-	Arguments:
-		pAd	Pointer to our adapter
-
-	Return Value:
-		None
-
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-VOID	RTMPHandleMgmtRingDmaDoneInterrupt(
-	IN	PRTMP_ADAPTER	pAd)
-{
-	PTXD_STRUC	 pTxD;
-#ifdef RT_BIG_ENDIAN
-    PTXD_STRUC      pDestTxD;
-    TXD_STRUC       TxD;
-#endif
-	PNDIS_PACKET pPacket;
-//	int		 i;
-	UCHAR	FREE = 0;
-	PRTMP_MGMT_RING pMgmtRing = &pAd->MgmtRing;
-
-	NdisAcquireSpinLock(&pAd->MgmtRingLock);
-
-	RTMP_IO_READ32(pAd, TX_MGMTDTX_IDX, &pMgmtRing->TxDmaIdx);
-	while (pMgmtRing->TxSwFreeIdx!= pMgmtRing->TxDmaIdx)
-	{
-		FREE++;
-#ifdef RT_BIG_ENDIAN
-        pDestTxD = (PTXD_STRUC) (pMgmtRing->Cell[pAd->MgmtRing.TxSwFreeIdx].AllocVa);
-        TxD = *pDestTxD;
-        pTxD = &TxD;
-		RTMPDescriptorEndianChange((PUCHAR)pTxD, TYPE_TXD);
-#else
-		pTxD = (PTXD_STRUC) (pMgmtRing->Cell[pAd->MgmtRing.TxSwFreeIdx].AllocVa);
-#endif
-		pTxD->DMADONE = 0;
-		pPacket = pMgmtRing->Cell[pMgmtRing->TxSwFreeIdx].pNdisPacket;
-
-
-		if (pPacket)
-		{
-			PCI_UNMAP_SINGLE(pAd, pTxD->SDPtr0, pTxD->SDLen0, PCI_DMA_TODEVICE);
-			RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_SUCCESS);
-		}
-		pMgmtRing->Cell[pMgmtRing->TxSwFreeIdx].pNdisPacket = NULL;
-
-		pPacket = pMgmtRing->Cell[pMgmtRing->TxSwFreeIdx].pNextNdisPacket;
-		if (pPacket)
-		{
-			PCI_UNMAP_SINGLE(pAd, pTxD->SDPtr1, pTxD->SDLen1, PCI_DMA_TODEVICE);
-			RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_SUCCESS);
-		}
-		pMgmtRing->Cell[pMgmtRing->TxSwFreeIdx].pNextNdisPacket = NULL;
-		INC_RING_INDEX(pMgmtRing->TxSwFreeIdx, MGMT_RING_SIZE);
-
-#ifdef RT_BIG_ENDIAN
-        RTMPDescriptorEndianChange((PUCHAR)pTxD, TYPE_TXD);
-        WriteBackToDescriptor((PUCHAR)pDestTxD, (PUCHAR)pTxD, TRUE, TYPE_TXD);
-#endif
-	}
-	NdisReleaseSpinLock(&pAd->MgmtRingLock);
-
-#ifdef CONFIG_STA_SUPPORT
-#endif // CONFIG_STA_SUPPORT //
-}
-
-
-/*
-	========================================================================
-
-	Routine Description:
-	Arguments:
-		Adapter		Pointer to our adapter. Dequeue all power safe delayed braodcast frames after beacon.
-
-	IRQL = DISPATCH_LEVEL
-
-	========================================================================
-*/
-VOID	RTMPHandleTBTTInterrupt(
-	IN PRTMP_ADAPTER pAd)
-{
-	{
-		if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE))
-		{
-		}
-	}
-}
-
-
-/*
-	========================================================================
-
-	Routine Description:
-	Arguments:
-		pAd		Pointer to our adapter. Rewrite beacon content before next send-out.
-
-	IRQL = DISPATCH_LEVEL
-
-	========================================================================
-*/
-VOID	RTMPHandlePreTBTTInterrupt(
-	IN PRTMP_ADAPTER pAd)
-{
-	{
-		if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE))
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("RTMPHandlePreTBTTInterrupt...\n"));
-		}
-	}
-
-
-}
-
-VOID	RTMPHandleRxCoherentInterrupt(
-	IN	PRTMP_ADAPTER	pAd)
-{
-	WPDMA_GLO_CFG_STRUC	GloCfg;
-
-	if (pAd == NULL)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("====> pAd is NULL, return.\n"));
-		return;
-	}
-
-	DBGPRINT(RT_DEBUG_TRACE, ("==> RTMPHandleRxCoherentInterrupt \n"));
-
-	RTMP_IO_READ32(pAd, WPDMA_GLO_CFG , &GloCfg.word);
-
-	GloCfg.field.EnTXWriteBackDDONE = 0;
-	GloCfg.field.EnableRxDMA = 0;
-	GloCfg.field.EnableTxDMA = 0;
-	RTMP_IO_WRITE32(pAd, WPDMA_GLO_CFG, GloCfg.word);
-
-	RTMPRingCleanUp(pAd, QID_AC_BE);
-	RTMPRingCleanUp(pAd, QID_AC_BK);
-	RTMPRingCleanUp(pAd, QID_AC_VI);
-	RTMPRingCleanUp(pAd, QID_AC_VO);
-	/*RTMPRingCleanUp(pAd, QID_HCCA);*/
-	RTMPRingCleanUp(pAd, QID_MGMT);
-	RTMPRingCleanUp(pAd, QID_RX);
-
-	RTMPEnableRxTx(pAd);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("<== RTMPHandleRxCoherentInterrupt \n"));
-}
-
-
-
-
-VOID DBGPRINT_TX_RING(
-	IN PRTMP_ADAPTER  pAd,
-	IN UCHAR          QueIdx)
-{
-	UINT32		Ac0Base;
-	UINT32		Ac0HwIdx = 0, Ac0SwIdx = 0, AC0freeIdx;
-	int			i;
-//	PULONG		pTxD;
-	PULONG	ptemp;
-
-	DBGPRINT_RAW(RT_DEBUG_TRACE, ("=====================================================\n "  ));
-	switch (QueIdx)
-	{
-		case QID_AC_BE:
-			RTMP_IO_READ32(pAd, TX_BASE_PTR0, &Ac0Base);
-			RTMP_IO_READ32(pAd, TX_CTX_IDX0, &Ac0SwIdx);
-			RTMP_IO_READ32(pAd, TX_DTX_IDX0, &Ac0HwIdx);
-			DBGPRINT_RAW(RT_DEBUG_TRACE, ("All QID_AC_BE DESCRIPTOR  \n "  ));
-			for (i=0;i<TX_RING_SIZE;i++)
-			{
-				ptemp= (PULONG)pAd->TxRing[QID_AC_BE].Cell[i].AllocVa;
-				DBGPRINT_RAW(RT_DEBUG_TRACE, ("[%02d]  %08lx: %08lx: %08lx: %08lx\n " , i, *ptemp,*(ptemp+1),*(ptemp+2),*(ptemp+3)));
-			}
-			DBGPRINT_RAW(RT_DEBUG_TRACE, ("  \n "  ));
-			break;
-		case QID_AC_BK:
-			RTMP_IO_READ32(pAd, TX_BASE_PTR1, &Ac0Base);
-			RTMP_IO_READ32(pAd, TX_CTX_IDX1, &Ac0SwIdx);
-			RTMP_IO_READ32(pAd, TX_DTX_IDX1, &Ac0HwIdx);
-			DBGPRINT_RAW(RT_DEBUG_TRACE, ("All QID_AC_BK DESCRIPTOR  \n "  ));
-			for (i=0;i<TX_RING_SIZE;i++)
-			{
-				ptemp= (PULONG)pAd->TxRing[QID_AC_BK].Cell[i].AllocVa;
-				DBGPRINT_RAW(RT_DEBUG_TRACE, ("[%02d]  %08lx: %08lx: %08lx: %08lx\n " , i, *ptemp,*(ptemp+1),*(ptemp+2),*(ptemp+3)));
-			}
-			DBGPRINT_RAW(RT_DEBUG_TRACE, ("  \n "  ));
-			break;
-		case QID_AC_VI:
-			RTMP_IO_READ32(pAd, TX_BASE_PTR2, &Ac0Base);
-			RTMP_IO_READ32(pAd, TX_CTX_IDX2, &Ac0SwIdx);
-			RTMP_IO_READ32(pAd, TX_DTX_IDX2, &Ac0HwIdx);
-			DBGPRINT_RAW(RT_DEBUG_TRACE, ("All QID_AC_VI DESCRIPTOR \n "  ));
-			for (i=0;i<TX_RING_SIZE;i++)
-			{
-				ptemp= (PULONG)pAd->TxRing[QID_AC_VI].Cell[i].AllocVa;
-				DBGPRINT_RAW(RT_DEBUG_TRACE, ("[%02d]  %08lx: %08lx: %08lx: %08lx\n " , i, *ptemp,*(ptemp+1),*(ptemp+2),*(ptemp+3)));
-			}
-			DBGPRINT_RAW(RT_DEBUG_TRACE, ("  \n "  ));
-			break;
-		case QID_AC_VO:
-			RTMP_IO_READ32(pAd, TX_BASE_PTR3, &Ac0Base);
-			RTMP_IO_READ32(pAd, TX_CTX_IDX3, &Ac0SwIdx);
-			RTMP_IO_READ32(pAd, TX_DTX_IDX3, &Ac0HwIdx);
-			DBGPRINT_RAW(RT_DEBUG_TRACE, ("All QID_AC_VO DESCRIPTOR \n "  ));
-			for (i=0;i<TX_RING_SIZE;i++)
-			{
-				ptemp= (PULONG)pAd->TxRing[QID_AC_VO].Cell[i].AllocVa;
-				DBGPRINT_RAW(RT_DEBUG_TRACE, ("[%02d]  %08lx: %08lx: %08lx: %08lx\n " , i, *ptemp,*(ptemp+1),*(ptemp+2),*(ptemp+3)));
-			}
-			DBGPRINT_RAW(RT_DEBUG_TRACE, ("  \n "  ));
-			break;
-		case QID_MGMT:
-			RTMP_IO_READ32(pAd, TX_BASE_PTR5, &Ac0Base);
-			RTMP_IO_READ32(pAd, TX_CTX_IDX5, &Ac0SwIdx);
-			RTMP_IO_READ32(pAd, TX_DTX_IDX5, &Ac0HwIdx);
-			DBGPRINT_RAW(RT_DEBUG_TRACE, (" All QID_MGMT  DESCRIPTOR \n "  ));
-			for (i=0;i<MGMT_RING_SIZE;i++)
-			{
-				ptemp= (PULONG)pAd->MgmtRing.Cell[i].AllocVa;
-				DBGPRINT_RAW(RT_DEBUG_TRACE, ("[%02d]  %08lx: %08lx: %08lx: %08lx\n " , i, *ptemp,*(ptemp+1),*(ptemp+2),*(ptemp+3)));
-			}
-			DBGPRINT_RAW(RT_DEBUG_TRACE, ("  \n "  ));
-			break;
-
-		default:
-			DBGPRINT_ERR(("DBGPRINT_TX_RING(Ring %d) not supported\n", QueIdx));
-			break;
-	}
-	AC0freeIdx = pAd->TxRing[QueIdx].TxSwFreeIdx;
-
-	DBGPRINT(RT_DEBUG_TRACE,("TxRing%d, TX_DTX_IDX=%d, TX_CTX_IDX=%d\n", QueIdx, Ac0HwIdx, Ac0SwIdx));
-	DBGPRINT_RAW(RT_DEBUG_TRACE,("	TxSwFreeIdx[%d]", AC0freeIdx));
-	DBGPRINT_RAW(RT_DEBUG_TRACE,("	pending-NDIS=%ld\n", pAd->RalinkCounters.PendingNdisPacketCount));
-
-
-}
-
-
-VOID DBGPRINT_RX_RING(
-	IN PRTMP_ADAPTER  pAd)
-{
-	UINT32		Ac0Base;
-	UINT32		Ac0HwIdx = 0, Ac0SwIdx = 0, AC0freeIdx;
-//	PULONG	 pTxD;
-	int			i;
-	UINT32	*ptemp;
-//	PRXD_STRUC		pRxD;
-
-	DBGPRINT_RAW(RT_DEBUG_TRACE, ("=====================================================\n "  ));
-	RTMP_IO_READ32(pAd, RX_BASE_PTR, &Ac0Base);
-	RTMP_IO_READ32(pAd, RX_CRX_IDX, &Ac0SwIdx);
-	RTMP_IO_READ32(pAd, RX_DRX_IDX, &Ac0HwIdx);
-	AC0freeIdx = pAd->RxRing.RxSwReadIdx;
-
-	DBGPRINT_RAW(RT_DEBUG_TRACE, ("All RX DSP  \n "  ));
-	for (i=0;i<RX_RING_SIZE;i++)
-	{
-		ptemp = (UINT32 *)pAd->RxRing.Cell[i].AllocVa;
-		DBGPRINT_RAW(RT_DEBUG_TRACE, ("[%02d]  %08x: %08x: %08x: %08x\n " , i, *ptemp,*(ptemp+1),*(ptemp+2),*(ptemp+3)));
-	}
-	DBGPRINT(RT_DEBUG_TRACE,("RxRing, RX_DRX_IDX=%d, RX_CRX_IDX=%d \n", Ac0HwIdx, Ac0SwIdx));
-	DBGPRINT_RAW(RT_DEBUG_TRACE,("	RxSwReadIdx [%d]=", AC0freeIdx));
-	DBGPRINT_RAW(RT_DEBUG_TRACE,("	pending-NDIS=%ld\n", pAd->RalinkCounters.PendingNdisPacketCount));
-}
-
-
-PNDIS_PACKET GetPacketFromRxRing(
-	IN		PRTMP_ADAPTER	pAd,
-	OUT		PRT28XX_RXD_STRUC	pSaveRxD,
-	OUT		BOOLEAN			*pbReschedule,
-	IN OUT	UINT32			*pRxPending)
-{
-	PRXD_STRUC				pRxD;
-#ifdef RT_BIG_ENDIAN
-	PRXD_STRUC				pDestRxD;
-	RXD_STRUC				RxD;
-#endif
-	PNDIS_PACKET			pRxPacket = NULL;
-	PNDIS_PACKET			pNewPacket;
-	PVOID					AllocVa;
-	NDIS_PHYSICAL_ADDRESS	AllocPa;
-	BOOLEAN					bReschedule = FALSE;
-
-	RTMP_SEM_LOCK(&pAd->RxRingLock);
-
-	if (*pRxPending == 0)
-	{
-		// Get how may packets had been received
-		RTMP_IO_READ32(pAd, RX_DRX_IDX , &pAd->RxRing.RxDmaIdx);
-
-		if (pAd->RxRing.RxSwReadIdx == pAd->RxRing.RxDmaIdx)
-		{
-			// no more rx packets
-			bReschedule = FALSE;
-			goto done;
-		}
-
-		// get rx pending count
-		if (pAd->RxRing.RxDmaIdx > pAd->RxRing.RxSwReadIdx)
-			*pRxPending = pAd->RxRing.RxDmaIdx - pAd->RxRing.RxSwReadIdx;
-		else
-			*pRxPending	= pAd->RxRing.RxDmaIdx + RX_RING_SIZE - pAd->RxRing.RxSwReadIdx;
-
-	}
-
-#ifdef RT_BIG_ENDIAN
-	pDestRxD = (PRXD_STRUC) pAd->RxRing.Cell[pAd->RxRing.RxSwReadIdx].AllocVa;
-	RxD = *pDestRxD;
-	pRxD = &RxD;
-	RTMPDescriptorEndianChange((PUCHAR)pRxD, TYPE_RXD);
-#else
-	// Point to Rx indexed rx ring descriptor
-	pRxD = (PRXD_STRUC) pAd->RxRing.Cell[pAd->RxRing.RxSwReadIdx].AllocVa;
-#endif
-
-	if (pRxD->DDONE == 0)
-	{
-		*pRxPending = 0;
-		// DMAIndx had done but DDONE bit not ready
-		bReschedule = TRUE;
-		goto done;
-	}
-
-
-	// return rx descriptor
-	NdisMoveMemory(pSaveRxD, pRxD, RXD_SIZE);
-
-	pNewPacket = RTMP_AllocateRxPacketBuffer(pAd, RX_BUFFER_AGGRESIZE, FALSE, &AllocVa, &AllocPa);
-
-	if (pNewPacket)
-	{
-		// unmap the rx buffer
-		PCI_UNMAP_SINGLE(pAd, pAd->RxRing.Cell[pAd->RxRing.RxSwReadIdx].DmaBuf.AllocPa,
-					 pAd->RxRing.Cell[pAd->RxRing.RxSwReadIdx].DmaBuf.AllocSize, PCI_DMA_FROMDEVICE);
-		pRxPacket = pAd->RxRing.Cell[pAd->RxRing.RxSwReadIdx].pNdisPacket;
-
-		pAd->RxRing.Cell[pAd->RxRing.RxSwReadIdx].DmaBuf.AllocSize	= RX_BUFFER_AGGRESIZE;
-		pAd->RxRing.Cell[pAd->RxRing.RxSwReadIdx].pNdisPacket		= (PNDIS_PACKET) pNewPacket;
-		pAd->RxRing.Cell[pAd->RxRing.RxSwReadIdx].DmaBuf.AllocVa	= AllocVa;
-		pAd->RxRing.Cell[pAd->RxRing.RxSwReadIdx].DmaBuf.AllocPa	= AllocPa;
-		/* update SDP0 to new buffer of rx packet */
-		pRxD->SDP0 = AllocPa;
-	}
-	else
-	{
-		//DBGPRINT(RT_DEBUG_TRACE,("No Rx Buffer\n"));
-		pRxPacket = NULL;
-		bReschedule = TRUE;
-	}
-
-	pRxD->DDONE = 0;
-
-	// had handled one rx packet
-	*pRxPending = *pRxPending - 1;
-
-	// update rx descriptor and kick rx
-#ifdef RT_BIG_ENDIAN
-	RTMPDescriptorEndianChange((PUCHAR)pRxD, TYPE_RXD);
-	WriteBackToDescriptor((PUCHAR)pDestRxD, (PUCHAR)pRxD, FALSE, TYPE_RXD);
-#endif
-	INC_RING_INDEX(pAd->RxRing.RxSwReadIdx, RX_RING_SIZE);
-
-	pAd->RxRing.RxCpuIdx = (pAd->RxRing.RxSwReadIdx == 0) ? (RX_RING_SIZE-1) : (pAd->RxRing.RxSwReadIdx-1);
-	RTMP_IO_WRITE32(pAd, RX_CRX_IDX, pAd->RxRing.RxCpuIdx);
-
-done:
-	RTMP_SEM_UNLOCK(&pAd->RxRingLock);
-	*pbReschedule = bReschedule;
-	return pRxPacket;
-}
-
-
-NDIS_STATUS MlmeHardTransmitTxRing(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR	QueIdx,
-	IN	PNDIS_PACKET	pPacket)
-{
-	PACKET_INFO	PacketInfo;
-	PUCHAR			pSrcBufVA;
-	UINT			SrcBufLen;
-	PTXD_STRUC		pTxD;
-#ifdef RT_BIG_ENDIAN
-    PTXD_STRUC      pDestTxD;
-    TXD_STRUC       TxD;
-#endif
-	PHEADER_802_11	pHeader_802_11;
-	BOOLEAN			bAckRequired, bInsertTimestamp;
-	ULONG			SrcBufPA;
-	//UCHAR			TxBufIdx;
-	UCHAR			MlmeRate;
-	ULONG			SwIdx = pAd->TxRing[QueIdx].TxCpuIdx;
-	PTXWI_STRUC	pFirstTxWI;
-	//ULONG	i;
-	//HTTRANSMIT_SETTING	MlmeTransmit;   //Rate for this MGMT frame.
-	ULONG	 FreeNum;
-	MAC_TABLE_ENTRY	*pMacEntry = NULL;
-
-
-	RTMP_QueryPacketInfo(pPacket, &PacketInfo, &pSrcBufVA, &SrcBufLen);
-
-
-	if (pSrcBufVA == NULL)
-	{
-		// The buffer shouldn't be NULL
-		return NDIS_STATUS_FAILURE;
-	}
-
-	// Make sure MGMT ring resource won't be used by other threads
-	//NdisAcquireSpinLock(&pAd->TxRingLock);
-
-	FreeNum = GET_TXRING_FREENO(pAd, QueIdx);
-
-	if (FreeNum == 0)
-	{
-		//NdisReleaseSpinLock(&pAd->TxRingLock);
-		return NDIS_STATUS_FAILURE;
-	}
-
-	SwIdx = pAd->TxRing[QueIdx].TxCpuIdx;
-
-#ifndef RT_BIG_ENDIAN
-	pTxD  = (PTXD_STRUC) pAd->TxRing[QueIdx].Cell[SwIdx].AllocVa;
-#else
-    pDestTxD  = (PTXD_STRUC)pAd->TxRing[QueIdx].Cell[SwIdx].AllocVa;
-    TxD = *pDestTxD;
-    pTxD = &TxD;
-    RTMPDescriptorEndianChange((PUCHAR)pTxD, TYPE_TXD);
-#endif
-
-	if (pAd->TxRing[QueIdx].Cell[SwIdx].pNdisPacket)
-	{
-		DBGPRINT(RT_DEBUG_OFF, ("MlmeHardTransmit Error\n"));
-		//NdisReleaseSpinLock(&pAd->TxRingLock);
-		return NDIS_STATUS_FAILURE;
-	}
-
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-		// outgoing frame always wakeup PHY to prevent frame lost
-		// if (pAd->StaCfg.Psm == PWR_SAVE)
-		if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE))
-			AsicForceWakeup(pAd, TRUE);
-	}
-#endif // CONFIG_STA_SUPPORT //
-	pFirstTxWI	=(PTXWI_STRUC)pSrcBufVA;
-
-	pHeader_802_11 = (PHEADER_802_11) (pSrcBufVA + TXWI_SIZE);
-	if (pHeader_802_11->Addr1[0] & 0x01)
-	{
-		MlmeRate = pAd->CommonCfg.BasicMlmeRate;
-	}
-	else
-	{
-		MlmeRate = pAd->CommonCfg.MlmeRate;
-	}
-
-	if ((pHeader_802_11->FC.Type == BTYPE_DATA) &&
-		(pHeader_802_11->FC.SubType == SUBTYPE_QOS_NULL))
-	{
-		pMacEntry = MacTableLookup(pAd, pHeader_802_11->Addr1);
-	}
-
-	// Verify Mlme rate for a / g bands.
-	if ((pAd->LatchRfRegs.Channel > 14) && (MlmeRate < RATE_6)) // 11A band
-		MlmeRate = RATE_6;
-
-	//
-	// Should not be hard code to set PwrMgmt to 0 (PWR_ACTIVE)
-	// Snice it's been set to 0 while on MgtMacHeaderInit
-	// By the way this will cause frame to be send on PWR_SAVE failed.
-	//
-	//
-	// In WMM-UAPSD, mlme frame should be set psm as power saving but probe request frame
-#ifdef CONFIG_STA_SUPPORT
-    // Data-Null packets alse pass through MMRequest in RT2860, however, we hope control the psm bit to pass APSD
-	if (pHeader_802_11->FC.Type != BTYPE_DATA)
-    {
-	if ((pHeader_802_11->FC.SubType == SUBTYPE_PROBE_REQ) || !(pAd->CommonCfg.bAPSDCapable && pAd->CommonCfg.APEdcaParm.bAPSDCapable))
-	{
-		pHeader_802_11->FC.PwrMgmt = PWR_ACTIVE;
-	}
-	else
-	{
-		pHeader_802_11->FC.PwrMgmt = pAd->CommonCfg.bAPSDForcePowerSave;
-	}
-    }
-#endif // CONFIG_STA_SUPPORT //
-
-	bInsertTimestamp = FALSE;
-	if (pHeader_802_11->FC.Type == BTYPE_CNTL) // must be PS-POLL
-	{
-		bAckRequired = FALSE;
-	}
-	else // BTYPE_MGMT or BTYPE_DATA(must be NULL frame)
-	{
-		if (pHeader_802_11->Addr1[0] & 0x01) // MULTICAST, BROADCAST
-		{
-			bAckRequired = FALSE;
-			pHeader_802_11->Duration = 0;
-		}
-		else
-		{
-			bAckRequired = TRUE;
-			pHeader_802_11->Duration = RTMPCalcDuration(pAd, MlmeRate, 14);
-			if (pHeader_802_11->FC.SubType == SUBTYPE_PROBE_RSP)
-			{
-				bInsertTimestamp = TRUE;
-			}
-		}
-	}
-	pHeader_802_11->Sequence = pAd->Sequence++;
-	if (pAd->Sequence > 0xfff)
-		pAd->Sequence = 0;
-	// Before radar detection done, mgmt frame can not be sent but probe req
-	// Because we need to use probe req to trigger driver to send probe req in passive scan
-	if ((pHeader_802_11->FC.SubType != SUBTYPE_PROBE_REQ)
-		&& (pAd->CommonCfg.bIEEE80211H == 1)
-		&& (pAd->CommonCfg.RadarDetect.RDMode != RD_NORMAL_MODE))
-	{
-		DBGPRINT(RT_DEBUG_ERROR,("MlmeHardTransmit --> radar detect not in normal mode !!!\n"));
-		//NdisReleaseSpinLock(&pAd->TxRingLock);
-		return (NDIS_STATUS_FAILURE);
-	}
-
-#ifdef RT_BIG_ENDIAN
-	RTMPFrameEndianChange(pAd, (PUCHAR)pHeader_802_11, DIR_WRITE, FALSE);
-#endif
-	//
-	// fill scatter-and-gather buffer list into TXD. Internally created NDIS PACKET
-	// should always has only one ohysical buffer, and the whole frame size equals
-	// to the first scatter buffer size
-	//
-
-	// Initialize TX Descriptor
-	// For inter-frame gap, the number is for this frame and next frame
-	// For MLME rate, we will fix as 2Mb to match other vendor's implement
-//	pAd->CommonCfg.MlmeTransmit.field.MODE = 1;
-
-// management frame doesn't need encryption. so use RESERVED_WCID no matter u are sending to specific wcid or not.
-	// Only beacon use Nseq=TRUE. So here we use Nseq=FALSE.
-	if (pMacEntry == NULL)
-	{
-	RTMPWriteTxWI(pAd, pFirstTxWI, FALSE, FALSE, bInsertTimestamp, FALSE, bAckRequired, FALSE,
-		0, RESERVED_WCID, (SrcBufLen - TXWI_SIZE), PID_MGMT, 0,  (UCHAR)pAd->CommonCfg.MlmeTransmit.field.MCS, IFS_BACKOFF, FALSE, &pAd->CommonCfg.MlmeTransmit);
-	}
-	else
-	{
-		RTMPWriteTxWI(pAd, pFirstTxWI, FALSE, FALSE,
-					bInsertTimestamp, FALSE, bAckRequired, FALSE,
-					0, pMacEntry->Aid, (SrcBufLen - TXWI_SIZE),
-					pMacEntry->MaxHTPhyMode.field.MCS, 0,
-					(UCHAR)pMacEntry->MaxHTPhyMode.field.MCS,
-					IFS_BACKOFF, FALSE, &pMacEntry->MaxHTPhyMode);
-	}
-
-	pAd->TxRing[QueIdx].Cell[SwIdx].pNdisPacket = pPacket;
-	pAd->TxRing[QueIdx].Cell[SwIdx].pNextNdisPacket = NULL;
-//	pFirstTxWI->MPDUtotalByteCount = SrcBufLen - TXWI_SIZE;
-#ifdef RT_BIG_ENDIAN
-	RTMPWIEndianChange((PUCHAR)pFirstTxWI, TYPE_TXWI);
-#endif
-	SrcBufPA = PCI_MAP_SINGLE(pAd, pSrcBufVA, SrcBufLen, 0, PCI_DMA_TODEVICE);
-
-
-	RTMPWriteTxDescriptor(pAd, pTxD, TRUE, FIFO_EDCA);
-	pTxD->LastSec0 = 1;
-	pTxD->LastSec1 = 1;
-	pTxD->SDLen0 = SrcBufLen;
-	pTxD->SDLen1 = 0;
-	pTxD->SDPtr0 = SrcBufPA;
-	pTxD->DMADONE = 0;
-
-#ifdef RT_BIG_ENDIAN
-    RTMPDescriptorEndianChange((PUCHAR)pTxD, TYPE_TXD);
-    WriteBackToDescriptor((PUCHAR)pDestTxD, (PUCHAR)pTxD, FALSE, TYPE_TXD);
-#endif
-
-	pAd->RalinkCounters.KickTxCount++;
-	pAd->RalinkCounters.OneSecTxDoneCount++;
-
-	// Increase TX_CTX_IDX, but write to register later.
-	INC_RING_INDEX(pAd->TxRing[QueIdx].TxCpuIdx, TX_RING_SIZE);
-
-	RTMP_IO_WRITE32(pAd, TX_CTX_IDX0 + QueIdx*0x10,  pAd->TxRing[QueIdx].TxCpuIdx);
-
-	// Make sure to release MGMT ring resource
-//	NdisReleaseSpinLock(&pAd->TxRingLock);
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-NDIS_STATUS MlmeDataHardTransmit(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR	QueIdx,
-	IN	PNDIS_PACKET	pPacket)
-{
-	if ((pAd->CommonCfg.RadarDetect.RDMode != RD_NORMAL_MODE)
-		)
-	{
-		return NDIS_STATUS_FAILURE;
-	}
-
-	return MlmeHardTransmitTxRing(pAd,QueIdx,pPacket);
-}
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		Calculates the duration which is required to transmit out frames
-	with given size and specified rate.
-
-	Arguments:
-		pTxD		Pointer to transmit descriptor
-		Ack		Setting for Ack requirement bit
-		Fragment	Setting for Fragment bit
-		RetryMode	Setting for retry mode
-		Ifs		Setting for IFS gap
-		Rate		Setting for transmit rate
-		Service		Setting for service
-		Length		Frame length
-		TxPreamble	Short or Long preamble when using CCK rates
-		QueIdx - 0-3, according to 802.11e/d4.4 June/2003
-
-	Return Value:
-		None
-
-	IRQL = PASSIVE_LEVEL
-	IRQL = DISPATCH_LEVEL
-
-	========================================================================
-*/
-VOID RTMPWriteTxDescriptor(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PTXD_STRUC		pTxD,
-	IN	BOOLEAN			bWIV,
-	IN	UCHAR			QueueSEL)
-{
-	//
-	// Always use Long preamble before verifiation short preamble functionality works well.
-	// Todo: remove the following line if short preamble functionality works
-	//
-	OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_SHORT_PREAMBLE_INUSED);
-
-	pTxD->WIV	= (bWIV) ? 1: 0;
-	pTxD->QSEL= (QueueSEL);
-	//RT2860c??  fixed using EDCA queue for test...  We doubt Queue1 has problem.  2006-09-26 Jan
-	//pTxD->QSEL= FIFO_EDCA;
-	/*
-	if (pAd->bGenOneHCCA == TRUE)
-		pTxD->QSEL= FIFO_HCCA;
-	*/
-	pTxD->DMADONE = 0;
-}
diff --git a/drivers/staging/rt3090/common/cmm_info.c b/drivers/staging/rt3090/common/cmm_info.c
deleted file mode 100644
index 3e51e98b474c..000000000000
--- a/drivers/staging/rt3090/common/cmm_info.c
+++ /dev/null
@@ -1,3718 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-    Module Name:
-	cmm_info.c
-
-    Abstract:
-
-    Revision History:
-    Who          When          What
-    ---------    ----------    ----------------------------------------------
- */
-
-#include <linux/sched.h>
-#include "../rt_config.h"
-
-
-INT	Show_SSID_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf);
-
-INT	Show_WirelessMode_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf);
-
-INT	Show_TxBurst_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf);
-
-INT	Show_TxPreamble_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf);
-
-INT	Show_TxPower_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf);
-
-INT	Show_Channel_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf);
-
-INT	Show_BGProtection_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf);
-
-INT	Show_RTSThreshold_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf);
-
-INT	Show_FragThreshold_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf);
-
-#ifdef DOT11_N_SUPPORT
-INT	Show_HtBw_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf);
-
-INT	Show_HtMcs_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf);
-
-INT	Show_HtGi_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf);
-
-INT	Show_HtOpMode_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf);
-
-INT	Show_HtExtcha_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf);
-
-INT	Show_HtMpduDensity_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf);
-
-INT	Show_HtBaWinSize_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf);
-
-INT	Show_HtRdg_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf);
-
-INT	Show_HtAmsdu_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf);
-
-INT	Show_HtAutoBa_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf);
-#endif // DOT11_N_SUPPORT //
-
-INT	Show_CountryRegion_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf);
-
-INT	Show_CountryRegionABand_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf);
-
-INT	Show_CountryCode_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf);
-
-#ifdef AGGREGATION_SUPPORT
-INT	Show_PktAggregate_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf);
-#endif // AGGREGATION_SUPPORT //
-
-#ifdef WMM_SUPPORT
-INT	Show_WmmCapable_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf);
-#endif // WMM_SUPPORT //
-
-INT	Show_IEEE80211H_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf);
-
-#ifdef CONFIG_STA_SUPPORT
-INT	Show_NetworkType_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf);
-
-#endif // CONFIG_STA_SUPPORT //
-
-INT	Show_AuthMode_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf);
-
-INT	Show_EncrypType_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf);
-
-INT	Show_DefaultKeyID_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf);
-
-INT	Show_Key1_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf);
-
-INT	Show_Key2_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf);
-
-INT	Show_Key3_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf);
-
-INT	Show_Key4_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf);
-
-INT	Show_WPAPSK_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf);
-
-static struct {
-	PSTRING name;
-	INT (*show_proc)(PRTMP_ADAPTER pAdapter, PSTRING arg);
-} *PRTMP_PRIVATE_STA_SHOW_CFG_VALUE_PROC, RTMP_PRIVATE_STA_SHOW_CFG_VALUE_PROC[] = {
-	{"SSID",					Show_SSID_Proc},
-	{"WirelessMode",			Show_WirelessMode_Proc},
-	{"TxBurst",					Show_TxBurst_Proc},
-	{"TxPreamble",				Show_TxPreamble_Proc},
-	{"TxPower",					Show_TxPower_Proc},
-	{"Channel",					Show_Channel_Proc},
-	{"BGProtection",			Show_BGProtection_Proc},
-	{"RTSThreshold",			Show_RTSThreshold_Proc},
-	{"FragThreshold",			Show_FragThreshold_Proc},
-#ifdef DOT11_N_SUPPORT
-	{"HtBw",					Show_HtBw_Proc},
-	{"HtMcs",					Show_HtMcs_Proc},
-	{"HtGi",					Show_HtGi_Proc},
-	{"HtOpMode",				Show_HtOpMode_Proc},
-	{"HtExtcha",				Show_HtExtcha_Proc},
-	{"HtMpduDensity",			Show_HtMpduDensity_Proc},
-	{"HtBaWinSize",		        Show_HtBaWinSize_Proc},
-	{"HtRdg",				Show_HtRdg_Proc},
-	{"HtAmsdu",				Show_HtAmsdu_Proc},
-	{"HtAutoBa",		        Show_HtAutoBa_Proc},
-#endif // DOT11_N_SUPPORT //
-	{"CountryRegion",			Show_CountryRegion_Proc},
-	{"CountryRegionABand",		Show_CountryRegionABand_Proc},
-	{"CountryCode",				Show_CountryCode_Proc},
-#ifdef AGGREGATION_SUPPORT
-	{"PktAggregate",			Show_PktAggregate_Proc},
-#endif
-
-#ifdef WMM_SUPPORT
-	{"WmmCapable",				Show_WmmCapable_Proc},
-#endif
-	{"IEEE80211H",				Show_IEEE80211H_Proc},
-#ifdef CONFIG_STA_SUPPORT
-    {"NetworkType",				Show_NetworkType_Proc},
-#endif // CONFIG_STA_SUPPORT //
-	{"AuthMode",				Show_AuthMode_Proc},
-	{"EncrypType",				Show_EncrypType_Proc},
-	{"DefaultKeyID",			Show_DefaultKeyID_Proc},
-	{"Key1",					Show_Key1_Proc},
-	{"Key2",					Show_Key2_Proc},
-	{"Key3",					Show_Key3_Proc},
-	{"Key4",					Show_Key4_Proc},
-	{"WPAPSK",					Show_WPAPSK_Proc},
-	{NULL, NULL}
-};
-
-/*
-    ==========================================================================
-    Description:
-        Get Driver version.
-
-    Return:
-    ==========================================================================
-*/
-INT Set_DriverVersion_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		DBGPRINT(RT_DEBUG_TRACE, ("Driver version-%s\n", STA_DRIVER_VERSION));
-#endif // CONFIG_STA_SUPPORT //
-
-
-    return TRUE;
-}
-
-/*
-    ==========================================================================
-    Description:
-        Set Country Region.
-        This command will not work, if the field of CountryRegion in eeprom is programmed.
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT Set_CountryRegion_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	int retval;
-
-#ifdef EXT_BUILD_CHANNEL_LIST
-	return -EOPNOTSUPP;
-#endif // EXT_BUILD_CHANNEL_LIST //
-
-	retval = RT_CfgSetCountryRegion(pAd, arg, BAND_24G);
-	if (retval == FALSE)
-		return FALSE;
-
-	// if set country region, driver needs to be reset
-	BuildChannelList(pAd);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_CountryRegion_Proc::(CountryRegion=%d)\n", pAd->CommonCfg.CountryRegion));
-
-	return TRUE;
-}
-
-
-/*
-    ==========================================================================
-    Description:
-        Set Country Region for A band.
-        This command will not work, if the field of CountryRegion in eeprom is programmed.
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT Set_CountryRegionABand_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	int retval;
-
-#ifdef EXT_BUILD_CHANNEL_LIST
-	return -EOPNOTSUPP;
-#endif // EXT_BUILD_CHANNEL_LIST //
-
-	retval = RT_CfgSetCountryRegion(pAd, arg, BAND_5G);
-	if (retval == FALSE)
-		return FALSE;
-
-	// if set country region, driver needs to be reset
-	BuildChannelList(pAd);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_CountryRegionABand_Proc::(CountryRegion=%d)\n", pAd->CommonCfg.CountryRegionForABand));
-
-	return TRUE;
-}
-
-
-/*
-    ==========================================================================
-    Description:
-        Set Wireless Mode
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT	Set_WirelessMode_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	INT	success = TRUE;
-
-	success = RT_CfgSetWirelessMode(pAd, arg);
-	if (success)
-	{
-
-#ifdef CONFIG_STA_SUPPORT
-		IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		{
-			LONG	WirelessMode = pAd->CommonCfg.PhyMode;
-
-			RTMPSetPhyMode(pAd, WirelessMode);
-#ifdef DOT11_N_SUPPORT
-			if (WirelessMode >= PHY_11ABGN_MIXED)
-			{
-				pAd->CommonCfg.BACapability.field.AutoBA = TRUE;
-				pAd->CommonCfg.REGBACapability.field.AutoBA = TRUE;
-			}
-			else
-			{
-				pAd->CommonCfg.BACapability.field.AutoBA = FALSE;
-				pAd->CommonCfg.REGBACapability.field.AutoBA = FALSE;
-			}
-#endif // DOT11_N_SUPPORT //
-			// Set AdhocMode rates
-			if (pAd->StaCfg.BssType == BSS_ADHOC)
-			{
-				MlmeUpdateTxRates(pAd, FALSE, 0);
-				MakeIbssBeacon(pAd);           // re-build BEACON frame
-				AsicEnableIbssSync(pAd);       // copy to on-chip memory
-			}
-		}
-#endif // CONFIG_STA_SUPPORT //
-
-		// it is needed to set SSID to take effect
-#ifdef DOT11_N_SUPPORT
-		SetCommonHT(pAd);
-#endif // DOT11_N_SUPPORT //
-		DBGPRINT(RT_DEBUG_TRACE, ("Set_WirelessMode_Proc::(=%d)\n", pAd->CommonCfg.PhyMode));
-	}
-	else
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("Set_WirelessMode_Proc::parameters out of range\n"));
-	}
-
-	return success;
-}
-
-/*
-    ==========================================================================
-    Description:
-        Set Channel
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT	Set_Channel_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	INT		success = TRUE;
-	UCHAR	Channel;
-
-	Channel = (UCHAR) simple_strtol(arg, 0, 10);
-
-	// check if this channel is valid
-	if (ChannelSanity(pAd, Channel) == TRUE)
-	{
-#ifdef CONFIG_STA_SUPPORT
-		IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		{
-			pAd->CommonCfg.Channel = Channel;
-
-			if (MONITOR_ON(pAd))
-			{
-#ifdef DOT11_N_SUPPORT
-				N_ChannelCheck(pAd);
-				if (pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED &&
-					pAd->CommonCfg.RegTransmitSetting.field.BW == BW_40)
-				{
-					N_SetCenCh(pAd);
-						AsicSwitchChannel(pAd, pAd->CommonCfg.CentralChannel, FALSE);
-						AsicLockChannel(pAd, pAd->CommonCfg.CentralChannel);
-					DBGPRINT(RT_DEBUG_TRACE, ("BW_40, control_channel(%d), CentralChannel(%d) \n",
-								pAd->CommonCfg.Channel, pAd->CommonCfg.CentralChannel));
-				}
-				else
-#endif // DOT11_N_SUPPORT //
-				{
-					AsicSwitchChannel(pAd, pAd->CommonCfg.Channel, FALSE);
-					AsicLockChannel(pAd, pAd->CommonCfg.Channel);
-					DBGPRINT(RT_DEBUG_TRACE, ("BW_20, Channel(%d)\n", pAd->CommonCfg.Channel));
-				}
-			}
-		}
-#endif // CONFIG_STA_SUPPORT //
-		success = TRUE;
-	}
-	else
-	{
-
-#ifdef CONFIG_STA_SUPPORT
-		IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-			success = FALSE;
-#endif // CONFIG_STA_SUPPORT //
-	}
-
-
-	if (success == TRUE)
-		DBGPRINT(RT_DEBUG_TRACE, ("Set_Channel_Proc::(Channel=%d)\n", pAd->CommonCfg.Channel));
-
-	return success;
-}
-
-
-/*
-    ==========================================================================
-    Description:
-        Set Short Slot Time Enable or Disable
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT	Set_ShortSlot_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	int retval;
-
-	retval = RT_CfgSetShortSlot(pAd, arg);
-	if (retval == TRUE)
-		DBGPRINT(RT_DEBUG_TRACE, ("Set_ShortSlot_Proc::(ShortSlot=%d)\n", pAd->CommonCfg.bUseShortSlotTime));
-
-	return retval;
-}
-
-
-/*
-    ==========================================================================
-    Description:
-        Set Tx power
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT	Set_TxPower_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	LONG TxPower;
-	INT   success = FALSE;
-
-	TxPower = simple_strtol(arg, 0, 10);
-	if (TxPower <= 100)
-	{
-
-#ifdef CONFIG_STA_SUPPORT
-		IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		{
-			pAd->CommonCfg.TxPowerDefault = TxPower;
-			pAd->CommonCfg.TxPowerPercentage = pAd->CommonCfg.TxPowerDefault;
-		}
-#endif // CONFIG_STA_SUPPORT //
-		success = TRUE;
-	}
-	else
-		success = FALSE;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_TxPower_Proc::(TxPowerPercentage=%ld)\n", pAd->CommonCfg.TxPowerPercentage));
-
-	return success;
-}
-
-/*
-    ==========================================================================
-    Description:
-        Set 11B/11G Protection
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT	Set_BGProtection_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	switch (simple_strtol(arg, 0, 10))
-	{
-		case 0: //AUTO
-			pAd->CommonCfg.UseBGProtection = 0;
-			break;
-		case 1: //Always On
-			pAd->CommonCfg.UseBGProtection = 1;
-			break;
-		case 2: //Always OFF
-			pAd->CommonCfg.UseBGProtection = 2;
-			break;
-		default:  //Invalid argument
-			return FALSE;
-	}
-
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_BGProtection_Proc::(BGProtection=%ld)\n", pAd->CommonCfg.UseBGProtection));
-
-	return TRUE;
-}
-
-/*
-    ==========================================================================
-    Description:
-        Set TxPreamble
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT	Set_TxPreamble_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	RT_802_11_PREAMBLE	Preamble;
-
-	Preamble = simple_strtol(arg, 0, 10);
-
-
-	switch (Preamble)
-	{
-		case Rt802_11PreambleShort:
-			pAd->CommonCfg.TxPreamble = Preamble;
-#ifdef CONFIG_STA_SUPPORT
-			IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-				MlmeSetTxPreamble(pAd, Rt802_11PreambleShort);
-#endif // CONFIG_STA_SUPPORT //
-			break;
-		case Rt802_11PreambleLong:
-#ifdef CONFIG_STA_SUPPORT
-		case Rt802_11PreambleAuto:
-			// if user wants AUTO, initialize to LONG here, then change according to AP's
-			// capability upon association.
-#endif // CONFIG_STA_SUPPORT //
-			pAd->CommonCfg.TxPreamble = Preamble;
-#ifdef CONFIG_STA_SUPPORT
-			IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-				MlmeSetTxPreamble(pAd, Rt802_11PreambleLong);
-#endif // CONFIG_STA_SUPPORT //
-			break;
-		default: //Invalid argument
-			return FALSE;
-	}
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_TxPreamble_Proc::(TxPreamble=%ld)\n", pAd->CommonCfg.TxPreamble));
-
-	return TRUE;
-}
-
-/*
-    ==========================================================================
-    Description:
-        Set RTS Threshold
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT	Set_RTSThreshold_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	 NDIS_802_11_RTS_THRESHOLD           RtsThresh;
-
-	RtsThresh = simple_strtol(arg, 0, 10);
-
-	if((RtsThresh > 0) && (RtsThresh <= MAX_RTS_THRESHOLD))
-		pAd->CommonCfg.RtsThreshold  = (USHORT)RtsThresh;
-#ifdef CONFIG_STA_SUPPORT
-	else if (RtsThresh == 0)
-		pAd->CommonCfg.RtsThreshold = MAX_RTS_THRESHOLD;
-#endif // CONFIG_STA_SUPPORT //
-	else
-		return FALSE; //Invalid argument
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_RTSThreshold_Proc::(RTSThreshold=%d)\n", pAd->CommonCfg.RtsThreshold));
-
-	return TRUE;
-}
-
-/*
-    ==========================================================================
-    Description:
-        Set Fragment Threshold
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT	Set_FragThreshold_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	 NDIS_802_11_FRAGMENTATION_THRESHOLD     FragThresh;
-
-	FragThresh = simple_strtol(arg, 0, 10);
-
-	if (FragThresh > MAX_FRAG_THRESHOLD || FragThresh < MIN_FRAG_THRESHOLD)
-	{
-		//Illegal FragThresh so we set it to default
-		pAd->CommonCfg.FragmentThreshold = MAX_FRAG_THRESHOLD;
-	}
-	else if (FragThresh % 2 == 1)
-	{
-		// The length of each fragment shall always be an even number of octets, except for the last fragment
-		// of an MSDU or MMPDU, which may be either an even or an odd number of octets.
-		pAd->CommonCfg.FragmentThreshold = (USHORT)(FragThresh - 1);
-	}
-	else
-	{
-		pAd->CommonCfg.FragmentThreshold = (USHORT)FragThresh;
-	}
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-		if (pAd->CommonCfg.FragmentThreshold == MAX_FRAG_THRESHOLD)
-			pAd->CommonCfg.bUseZeroToDisableFragment = TRUE;
-		else
-			pAd->CommonCfg.bUseZeroToDisableFragment = FALSE;
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_FragThreshold_Proc::(FragThreshold=%d)\n", pAd->CommonCfg.FragmentThreshold));
-
-	return TRUE;
-}
-
-/*
-    ==========================================================================
-    Description:
-        Set TxBurst
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT	Set_TxBurst_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	LONG TxBurst;
-
-	TxBurst = simple_strtol(arg, 0, 10);
-	if (TxBurst == 1)
-		pAd->CommonCfg.bEnableTxBurst = TRUE;
-	else if (TxBurst == 0)
-		pAd->CommonCfg.bEnableTxBurst = FALSE;
-	else
-		return FALSE;  //Invalid argument
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_TxBurst_Proc::(TxBurst=%d)\n", pAd->CommonCfg.bEnableTxBurst));
-
-	return TRUE;
-}
-
-#ifdef AGGREGATION_SUPPORT
-/*
-    ==========================================================================
-    Description:
-        Set TxBurst
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT	Set_PktAggregate_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	LONG aggre;
-
-	aggre = simple_strtol(arg, 0, 10);
-
-	if (aggre == 1)
-		pAd->CommonCfg.bAggregationCapable = TRUE;
-	else if (aggre == 0)
-		pAd->CommonCfg.bAggregationCapable = FALSE;
-	else
-		return FALSE;  //Invalid argument
-
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_PktAggregate_Proc::(AGGRE=%d)\n", pAd->CommonCfg.bAggregationCapable));
-
-	return TRUE;
-}
-#endif
-
-
-#ifdef INF_AMAZON_PPA
-INT	Set_INF_AMAZON_SE_PPA_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
-	ULONG aggre;
-	UINT status;
-
-	aggre = simple_strtol(arg, 0, 10);
-
-	if (aggre == 1)
-	{
-		if(pAd->PPAEnable==TRUE)
-		{
-			printk("INF_AMAZON_SE_PPA already enabled \n");
-		}
-		else
-		{
-			if (ppa_hook_directpath_register_dev_fn)
-			{
-				UINT32 g_if_id;
-
-				if (pAd->pDirectpathCb == NULL)
-				{
-					 pAd->pDirectpathCb = (PPA_DIRECTPATH_CB *) kmalloc (sizeof(PPA_DIRECTPATH_CB), GFP_ATOMIC);
-				        printk("Realloc memory for  pDirectpathCb ??\n");
-				}
-
-				/* register callback */
-				pAd->pDirectpathCb->rx_fn = NULL;
-				pAd->pDirectpathCb->stop_tx_fn = NULL;
-				pAd->pDirectpathCb->start_tx_fn = NULL;
-
-				status = ppa_hook_directpath_register_dev_fn(&g_if_id, pAd->net_dev, pAd->pDirectpathCb, PPA_F_DIRECTPATH_ETH_IF);
-
-				if(status==1)
-				{
-					pAd->g_if_id=g_if_id;
-					printk("register INF_AMAZON_SE_PPA success :ret:%d id:%d:%d\n",status,pAd->g_if_id,g_if_id);
-					pAd->PPAEnable=TRUE;
-				}
-				else
-				{
-					printk("register INF_AMAZON_SE_PPA fail :ret:%d\n",status);
-				}
-
-			}
-			else
-			{
-				printk("INF_AMAZON_SE_PPA enable fail : there is no INF_AMAZON_SE_PPA module . \n");
-			}
-		}
-
-
-	}
-	else if (aggre == 0)
-	{
-		if(pAd->PPAEnable==FALSE)
-		{
-
-printk("INF_AMAZON_SE_PPA already disable \n");
-		}
-		else
-		{
-			if (ppa_hook_directpath_register_dev_fn)
-			{
-				UINT32 g_if_id;
-				g_if_id=pAd->g_if_id;
-				printk("g_if_id=%d \n",pAd->g_if_id);
-				status=ppa_hook_directpath_register_dev_fn(&g_if_id, pAd->net_dev, NULL, PPA_F_DIRECTPATH_DEREGISTER);
-
-				if(status==1)
-				{
-					pAd->g_if_id=0;
-					printk("unregister INF_AMAZON_SE_PPA success :ret:%d\n",status);
-					pAd->PPAEnable=FALSE;
-				}
-				else
-				{
-					printk("unregister INF_AMAZON_SE_PPA fail :ret:%d\n",status);
-				}
-
-			}
-			else
-			{
-				printk("INF_AMAZON_SE_PPA enable fail : there is no INF_AMAZON_SE_PPA module . \n");
-			}
-		}
-
-	}
-	else
-	{
-		printk("Invalid argument %d \n",aggre);
-		return FALSE;  //Invalid argument
-	}
-
-	return TRUE;
-
-}
-#endif // INF_AMAZON_PPA //
-
-
-/*
-    ==========================================================================
-    Description:
-        Set IEEE80211H.
-        This parameter is 1 when needs radar detection, otherwise 0
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT	Set_IEEE80211H_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-    LONG ieee80211h;
-
-	ieee80211h = simple_strtol(arg, 0, 10);
-
-	if (ieee80211h == 1)
-		pAd->CommonCfg.bIEEE80211H = TRUE;
-	else if (ieee80211h == 0)
-		pAd->CommonCfg.bIEEE80211H = FALSE;
-	else
-		return FALSE;  //Invalid argument
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_IEEE80211H_Proc::(IEEE80211H=%d)\n", pAd->CommonCfg.bIEEE80211H));
-
-	return TRUE;
-}
-
-
-#ifdef DBG
-/*
-    ==========================================================================
-    Description:
-        For Debug information
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT	Set_Debug_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	DBGPRINT(RT_DEBUG_TRACE, ("==> Set_Debug_Proc *******************\n"));
-
-    if(simple_strtol(arg, 0, 10) <= RT_DEBUG_LOUD)
-        RTDebugLevel = simple_strtol(arg, 0, 10);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("<== Set_Debug_Proc(RTDebugLevel = %ld)\n", RTDebugLevel));
-
-	return TRUE;
-}
-#endif
-
-INT	Show_DescInfo_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-#ifdef RTMP_MAC_PCI
-	INT i, QueIdx=0;
-//  ULONG	RegValue;
-        PRT28XX_RXD_STRUC pRxD;
-        PTXD_STRUC pTxD;
-	PRTMP_TX_RING	pTxRing = &pAd->TxRing[QueIdx];
-	PRTMP_MGMT_RING	pMgmtRing = &pAd->MgmtRing;
-	PRTMP_RX_RING	pRxRing = &pAd->RxRing;
-
-	for(i=0;i<TX_RING_SIZE;i++)
-	{
-	    pTxD = (PTXD_STRUC) pTxRing->Cell[i].AllocVa;
-	    DBGPRINT(RT_DEBUG_OFF, ("Desc #%d\n",i));
-	    hex_dump("Tx Descriptor", (PUCHAR)pTxD, 16);
-	    DBGPRINT(RT_DEBUG_OFF, ("pTxD->DMADONE = %x\n", pTxD->DMADONE));
-	}
-	DBGPRINT(RT_DEBUG_OFF, ("---------------------------------------------------\n"));
-	for(i=0;i<MGMT_RING_SIZE;i++)
-	{
-	    pTxD = (PTXD_STRUC) pMgmtRing->Cell[i].AllocVa;
-	    DBGPRINT(RT_DEBUG_OFF, ("Desc #%d\n",i));
-	    hex_dump("Mgmt Descriptor", (PUCHAR)pTxD, 16);
-	    DBGPRINT(RT_DEBUG_OFF, ("pMgmt->DMADONE = %x\n", pTxD->DMADONE));
-	}
-	DBGPRINT(RT_DEBUG_OFF, ("---------------------------------------------------\n"));
-	for(i=0;i<RX_RING_SIZE;i++)
-	{
-	    pRxD = (PRT28XX_RXD_STRUC) pRxRing->Cell[i].AllocVa;
-	    DBGPRINT(RT_DEBUG_OFF, ("Desc #%d\n",i));
-	    hex_dump("Rx Descriptor", (PUCHAR)pRxD, 16);
-	    DBGPRINT(RT_DEBUG_OFF, ("pRxD->DDONE = %x\n", pRxD->DDONE));
-	}
-#endif // RTMP_MAC_PCI //
-
-	return TRUE;
-}
-
-/*
-    ==========================================================================
-    Description:
-        Reset statistics counter
-
-    Arguments:
-        pAdapter            Pointer to our adapter
-        arg
-
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT	Set_ResetStatCounter_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	//UCHAR           i;
-	//MAC_TABLE_ENTRY *pEntry;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("==>Set_ResetStatCounter_Proc\n"));
-
-	// add the most up-to-date h/w raw counters into software counters
-	NICUpdateRawCounters(pAd);
-
-	NdisZeroMemory(&pAd->WlanCounters, sizeof(COUNTER_802_11));
-	NdisZeroMemory(&pAd->Counters8023, sizeof(COUNTER_802_3));
-	NdisZeroMemory(&pAd->RalinkCounters, sizeof(COUNTER_RALINK));
-
-	// Reset HotSpot counter
-
-
-	return TRUE;
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-		Add WPA key process.
-		In Adhoc WPANONE, bPairwise = 0;  KeyIdx = 0;
-
-	Arguments:
-		pAd					Pointer to our adapter
-		pBuf							Pointer to the where the key stored
-
-	Return Value:
-		NDIS_SUCCESS					Add key successfully
-
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-
-BOOLEAN RTMPCheckStrPrintAble(
-    IN  CHAR *pInPutStr,
-    IN  UCHAR strLen)
-{
-    UCHAR i=0;
-
-    for (i=0; i<strLen; i++)
-    {
-        if ((pInPutStr[i] < 0x21) ||
-            (pInPutStr[i] > 0x7E))
-            return FALSE;
-    }
-
-    return TRUE;
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-		Remove WPA Key process
-
-	Arguments:
-		pAd					Pointer to our adapter
-		pBuf							Pointer to the where the key stored
-
-	Return Value:
-		NDIS_SUCCESS					Add key successfully
-
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-#ifdef CONFIG_STA_SUPPORT
-VOID    RTMPSetDesiredRates(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  LONG            Rates)
-{
-    NDIS_802_11_RATES aryRates;
-
-    memset(&aryRates, 0x00, sizeof(NDIS_802_11_RATES));
-    switch (pAdapter->CommonCfg.PhyMode)
-    {
-        case PHY_11A: // A only
-            switch (Rates)
-            {
-                case 6000000: //6M
-                    aryRates[0] = 0x0c; // 6M
-                    pAdapter->StaCfg.DesiredTransmitSetting.field.MCS = MCS_0;
-                    break;
-                case 9000000: //9M
-                    aryRates[0] = 0x12; // 9M
-                    pAdapter->StaCfg.DesiredTransmitSetting.field.MCS = MCS_1;
-                    break;
-                case 12000000: //12M
-                    aryRates[0] = 0x18; // 12M
-                    pAdapter->StaCfg.DesiredTransmitSetting.field.MCS = MCS_2;
-                    break;
-                case 18000000: //18M
-                    aryRates[0] = 0x24; // 18M
-                    pAdapter->StaCfg.DesiredTransmitSetting.field.MCS = MCS_3;
-                    break;
-                case 24000000: //24M
-                    aryRates[0] = 0x30; // 24M
-                    pAdapter->StaCfg.DesiredTransmitSetting.field.MCS = MCS_4;
-                    break;
-                case 36000000: //36M
-                    aryRates[0] = 0x48; // 36M
-                    pAdapter->StaCfg.DesiredTransmitSetting.field.MCS = MCS_5;
-                    break;
-                case 48000000: //48M
-                    aryRates[0] = 0x60; // 48M
-                    pAdapter->StaCfg.DesiredTransmitSetting.field.MCS = MCS_6;
-                    break;
-                case 54000000: //54M
-                    aryRates[0] = 0x6c; // 54M
-                    pAdapter->StaCfg.DesiredTransmitSetting.field.MCS = MCS_7;
-                    break;
-                case -1: //Auto
-                default:
-                    aryRates[0] = 0x6c; // 54Mbps
-                    aryRates[1] = 0x60; // 48Mbps
-                    aryRates[2] = 0x48; // 36Mbps
-                    aryRates[3] = 0x30; // 24Mbps
-                    aryRates[4] = 0x24; // 18M
-                    aryRates[5] = 0x18; // 12M
-                    aryRates[6] = 0x12; // 9M
-                    aryRates[7] = 0x0c; // 6M
-                    pAdapter->StaCfg.DesiredTransmitSetting.field.MCS = MCS_AUTO;
-                    break;
-            }
-            break;
-        case PHY_11BG_MIXED: // B/G Mixed
-        case PHY_11B: // B only
-        case PHY_11ABG_MIXED: // A/B/G Mixed
-        default:
-            switch (Rates)
-            {
-                case 1000000: //1M
-                    aryRates[0] = 0x02;
-                    pAdapter->StaCfg.DesiredTransmitSetting.field.MCS = MCS_0;
-                    break;
-                case 2000000: //2M
-                    aryRates[0] = 0x04;
-                    pAdapter->StaCfg.DesiredTransmitSetting.field.MCS = MCS_1;
-                    break;
-                case 5000000: //5.5M
-                    aryRates[0] = 0x0b; // 5.5M
-                    pAdapter->StaCfg.DesiredTransmitSetting.field.MCS = MCS_2;
-                    break;
-                case 11000000: //11M
-                    aryRates[0] = 0x16; // 11M
-                    pAdapter->StaCfg.DesiredTransmitSetting.field.MCS = MCS_3;
-                    break;
-                case 6000000: //6M
-                    aryRates[0] = 0x0c; // 6M
-                    pAdapter->StaCfg.DesiredTransmitSetting.field.MCS = MCS_0;
-                    break;
-                case 9000000: //9M
-                    aryRates[0] = 0x12; // 9M
-                    pAdapter->StaCfg.DesiredTransmitSetting.field.MCS = MCS_1;
-                    break;
-                case 12000000: //12M
-                    aryRates[0] = 0x18; // 12M
-                    pAdapter->StaCfg.DesiredTransmitSetting.field.MCS = MCS_2;
-                    break;
-                case 18000000: //18M
-                    aryRates[0] = 0x24; // 18M
-                    pAdapter->StaCfg.DesiredTransmitSetting.field.MCS = MCS_3;
-                    break;
-                case 24000000: //24M
-                    aryRates[0] = 0x30; // 24M
-                    pAdapter->StaCfg.DesiredTransmitSetting.field.MCS = MCS_4;
-                    break;
-                case 36000000: //36M
-                    aryRates[0] = 0x48; // 36M
-                    pAdapter->StaCfg.DesiredTransmitSetting.field.MCS = MCS_5;
-                    break;
-                case 48000000: //48M
-                    aryRates[0] = 0x60; // 48M
-                    pAdapter->StaCfg.DesiredTransmitSetting.field.MCS = MCS_6;
-                    break;
-                case 54000000: //54M
-                    aryRates[0] = 0x6c; // 54M
-                    pAdapter->StaCfg.DesiredTransmitSetting.field.MCS = MCS_7;
-                    break;
-                case -1: //Auto
-                default:
-                    if (pAdapter->CommonCfg.PhyMode == PHY_11B)
-                    { //B Only
-                        aryRates[0] = 0x16; // 11Mbps
-                        aryRates[1] = 0x0b; // 5.5Mbps
-                        aryRates[2] = 0x04; // 2Mbps
-                        aryRates[3] = 0x02; // 1Mbps
-                    }
-                    else
-                    { //(B/G) Mixed or (A/B/G) Mixed
-                        aryRates[0] = 0x6c; // 54Mbps
-                        aryRates[1] = 0x60; // 48Mbps
-                        aryRates[2] = 0x48; // 36Mbps
-                        aryRates[3] = 0x30; // 24Mbps
-                        aryRates[4] = 0x16; // 11Mbps
-                        aryRates[5] = 0x0b; // 5.5Mbps
-                        aryRates[6] = 0x04; // 2Mbps
-                        aryRates[7] = 0x02; // 1Mbps
-                    }
-                    pAdapter->StaCfg.DesiredTransmitSetting.field.MCS = MCS_AUTO;
-                    break;
-            }
-            break;
-    }
-
-    NdisZeroMemory(pAdapter->CommonCfg.DesireRate, MAX_LEN_OF_SUPPORTED_RATES);
-    NdisMoveMemory(pAdapter->CommonCfg.DesireRate, &aryRates, sizeof(NDIS_802_11_RATES));
-    DBGPRINT(RT_DEBUG_TRACE, (" RTMPSetDesiredRates (%02x,%02x,%02x,%02x,%02x,%02x,%02x,%02x)\n",
-        pAdapter->CommonCfg.DesireRate[0],pAdapter->CommonCfg.DesireRate[1],
-        pAdapter->CommonCfg.DesireRate[2],pAdapter->CommonCfg.DesireRate[3],
-        pAdapter->CommonCfg.DesireRate[4],pAdapter->CommonCfg.DesireRate[5],
-        pAdapter->CommonCfg.DesireRate[6],pAdapter->CommonCfg.DesireRate[7] ));
-    // Changing DesiredRate may affect the MAX TX rate we used to TX frames out
-    MlmeUpdateTxRates(pAdapter, FALSE, 0);
-}
-
-NDIS_STATUS RTMPWPARemoveKeyProc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PVOID			pBuf)
-{
-	PNDIS_802_11_REMOVE_KEY pKey;
-	ULONG					KeyIdx;
-	NDIS_STATUS			Status = NDIS_STATUS_FAILURE;
-	BOOLEAN		bTxKey;			// Set the key as transmit key
-	BOOLEAN		bPairwise;		// Indicate the key is pairwise key
-	BOOLEAN		bKeyRSC;		// indicate the receive  SC set by KeyRSC value.
-								// Otherwise, it will set by the NIC.
-	BOOLEAN		bAuthenticator; // indicate key is set by authenticator.
-	INT		i;
-
-	DBGPRINT(RT_DEBUG_TRACE,("---> RTMPWPARemoveKeyProc\n"));
-
-	pKey = (PNDIS_802_11_REMOVE_KEY) pBuf;
-	KeyIdx = pKey->KeyIndex & 0xff;
-	// Bit 31 of Add-key, Tx Key
-	bTxKey		   = (pKey->KeyIndex & 0x80000000) ? TRUE : FALSE;
-	// Bit 30 of Add-key PairwiseKey
-	bPairwise	   = (pKey->KeyIndex & 0x40000000) ? TRUE : FALSE;
-	// Bit 29 of Add-key KeyRSC
-	bKeyRSC		   = (pKey->KeyIndex & 0x20000000) ? TRUE : FALSE;
-	// Bit 28 of Add-key Authenticator
-	bAuthenticator = (pKey->KeyIndex & 0x10000000) ? TRUE : FALSE;
-
-	// 1. If bTx is TRUE, return failure information
-	if (bTxKey == TRUE)
-		return(NDIS_STATUS_INVALID_DATA);
-
-	// 2. Check Pairwise Key
-	if (bPairwise)
-	{
-		// a. If BSSID is broadcast, remove all pairwise keys.
-		// b. If not broadcast, remove the pairwise specified by BSSID
-		for (i = 0; i < SHARE_KEY_NUM; i++)
-		{
-			if (MAC_ADDR_EQUAL(pAd->SharedKey[BSS0][i].BssId, pKey->BSSID))
-			{
-				DBGPRINT(RT_DEBUG_TRACE,("RTMPWPARemoveKeyProc(KeyIdx=%d)\n", i));
-				pAd->SharedKey[BSS0][i].KeyLen = 0;
-				pAd->SharedKey[BSS0][i].CipherAlg = CIPHER_NONE;
-				AsicRemoveSharedKeyEntry(pAd, BSS0, (UCHAR)i);
-				Status = NDIS_STATUS_SUCCESS;
-				break;
-			}
-		}
-	}
-	// 3. Group Key
-	else
-	{
-		// a. If BSSID is broadcast, remove all group keys indexed
-		// b. If BSSID matched, delete the group key indexed.
-		DBGPRINT(RT_DEBUG_TRACE,("RTMPWPARemoveKeyProc(KeyIdx=%ld)\n", KeyIdx));
-		pAd->SharedKey[BSS0][KeyIdx].KeyLen = 0;
-		pAd->SharedKey[BSS0][KeyIdx].CipherAlg = CIPHER_NONE;
-		AsicRemoveSharedKeyEntry(pAd, BSS0, (UCHAR)KeyIdx);
-		Status = NDIS_STATUS_SUCCESS;
-	}
-
-	return (Status);
-}
-#endif // CONFIG_STA_SUPPORT //
-
-
-#ifdef CONFIG_STA_SUPPORT
-/*
-	========================================================================
-
-	Routine Description:
-		Remove All WPA Keys
-
-	Arguments:
-		pAd					Pointer to our adapter
-
-	Return Value:
-		None
-
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-VOID	RTMPWPARemoveAllKeys(
-	IN	PRTMP_ADAPTER	pAd)
-{
-
-	UCHAR	i;
-
-	DBGPRINT(RT_DEBUG_TRACE,("RTMPWPARemoveAllKeys(AuthMode=%d, WepStatus=%d)\n", pAd->StaCfg.AuthMode, pAd->StaCfg.WepStatus));
-	RTMP_CLEAR_PSFLAG(pAd, fRTMP_PS_CAN_GO_SLEEP);
-	// For WEP/CKIP, there is no need to remove it, since WinXP won't set it again after
-	// Link up. And it will be replaced if user changed it.
-	if (pAd->StaCfg.AuthMode < Ndis802_11AuthModeWPA)
-		return;
-
-	// For WPA-None, there is no need to remove it, since WinXP won't set it again after
-	// Link up. And it will be replaced if user changed it.
-	if (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPANone)
-		return;
-
-	// set BSSID wcid entry of the Pair-wise Key table as no-security mode
-	AsicRemovePairwiseKeyEntry(pAd, BSS0, BSSID_WCID);
-
-	// set all shared key mode as no-security.
-	for (i = 0; i < SHARE_KEY_NUM; i++)
-    {
-		DBGPRINT(RT_DEBUG_TRACE,("remove %s key #%d\n", CipherName[pAd->SharedKey[BSS0][i].CipherAlg], i));
-		NdisZeroMemory(&pAd->SharedKey[BSS0][i], sizeof(CIPHER_KEY));
-
-		AsicRemoveSharedKeyEntry(pAd, BSS0, i);
-	}
-	RTMP_SET_PSFLAG(pAd, fRTMP_PS_CAN_GO_SLEEP);
-
-}
-#endif // CONFIG_STA_SUPPORT //
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		As STA's BSSID is a WC too, it uses shared key table.
-		This function write correct unicast TX key to ASIC WCID.
-		And we still make a copy in our MacTab.Content[BSSID_WCID].PairwiseKey.
-		Caller guarantee TKIP/AES always has keyidx = 0. (pairwise key)
-		Caller guarantee WEP calls this function when set Txkey,  default key index=0~3.
-
-	Arguments:
-		pAd					Pointer to our adapter
-		pKey							Pointer to the where the key stored
-
-	Return Value:
-		NDIS_SUCCESS					Add key successfully
-
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-/*
-	========================================================================
-	Routine Description:
-		Change NIC PHY mode. Re-association may be necessary. possible settings
-		include - PHY_11B, PHY_11BG_MIXED, PHY_11A, and PHY_11ABG_MIXED
-
-	Arguments:
-		pAd - Pointer to our adapter
-		phymode  -
-
-	IRQL = PASSIVE_LEVEL
-	IRQL = DISPATCH_LEVEL
-
-	========================================================================
-*/
-VOID	RTMPSetPhyMode(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	ULONG phymode)
-{
-	INT i;
-	// the selected phymode must be supported by the RF IC encoded in E2PROM
-
-	// if no change, do nothing
-	/* bug fix
-	if (pAd->CommonCfg.PhyMode == phymode)
-		return;
-    */
-	pAd->CommonCfg.PhyMode = (UCHAR)phymode;
-
-	DBGPRINT(RT_DEBUG_TRACE,("RTMPSetPhyMode : PhyMode=%d, channel=%d \n", pAd->CommonCfg.PhyMode, pAd->CommonCfg.Channel));
-#ifdef EXT_BUILD_CHANNEL_LIST
-	BuildChannelListEx(pAd);
-#else
-	BuildChannelList(pAd);
-#endif // EXT_BUILD_CHANNEL_LIST //
-
-	// sanity check user setting
-	for (i = 0; i < pAd->ChannelListNum; i++)
-	{
-		if (pAd->CommonCfg.Channel == pAd->ChannelList[i].Channel)
-			break;
-	}
-
-	if (i == pAd->ChannelListNum)
-	{
-#ifdef CONFIG_STA_SUPPORT
-		IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-			pAd->CommonCfg.Channel = FirstChannel(pAd);
-#endif // CONFIG_STA_SUPPORT //
-		DBGPRINT(RT_DEBUG_ERROR, ("RTMPSetPhyMode: channel is out of range, use first channel=%d \n", pAd->CommonCfg.Channel));
-	}
-
-	NdisZeroMemory(pAd->CommonCfg.SupRate, MAX_LEN_OF_SUPPORTED_RATES);
-	NdisZeroMemory(pAd->CommonCfg.ExtRate, MAX_LEN_OF_SUPPORTED_RATES);
-	NdisZeroMemory(pAd->CommonCfg.DesireRate, MAX_LEN_OF_SUPPORTED_RATES);
-	switch (phymode) {
-		case PHY_11B:
-			pAd->CommonCfg.SupRate[0]  = 0x82;	  // 1 mbps, in units of 0.5 Mbps, basic rate
-			pAd->CommonCfg.SupRate[1]  = 0x84;	  // 2 mbps, in units of 0.5 Mbps, basic rate
-			pAd->CommonCfg.SupRate[2]  = 0x8B;	  // 5.5 mbps, in units of 0.5 Mbps, basic rate
-			pAd->CommonCfg.SupRate[3]  = 0x96;	  // 11 mbps, in units of 0.5 Mbps, basic rate
-			pAd->CommonCfg.SupRateLen  = 4;
-			pAd->CommonCfg.ExtRateLen  = 0;
-			pAd->CommonCfg.DesireRate[0]  = 2;	   // 1 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.DesireRate[1]  = 4;	   // 2 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.DesireRate[2]  = 11;    // 5.5 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.DesireRate[3]  = 22;    // 11 mbps, in units of 0.5 Mbps
-			//pAd->CommonCfg.HTPhyMode.field.MODE = MODE_CCK; // This MODE is only FYI. not use
-			break;
-
-		case PHY_11G:
-		case PHY_11BG_MIXED:
-		case PHY_11ABG_MIXED:
-#ifdef DOT11_N_SUPPORT
-		case PHY_11N_2_4G:
-		case PHY_11ABGN_MIXED:
-		case PHY_11BGN_MIXED:
-		case PHY_11GN_MIXED:
-#endif // DOT11_N_SUPPORT //
-			pAd->CommonCfg.SupRate[0]  = 0x82;	  // 1 mbps, in units of 0.5 Mbps, basic rate
-			pAd->CommonCfg.SupRate[1]  = 0x84;	  // 2 mbps, in units of 0.5 Mbps, basic rate
-			pAd->CommonCfg.SupRate[2]  = 0x8B;	  // 5.5 mbps, in units of 0.5 Mbps, basic rate
-			pAd->CommonCfg.SupRate[3]  = 0x96;	  // 11 mbps, in units of 0.5 Mbps, basic rate
-			pAd->CommonCfg.SupRate[4]  = 0x12;	  // 9 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.SupRate[5]  = 0x24;	  // 18 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.SupRate[6]  = 0x48;	  // 36 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.SupRate[7]  = 0x6c;	  // 54 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.SupRateLen  = 8;
-			pAd->CommonCfg.ExtRate[0]  = 0x0C;	  // 6 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.ExtRate[1]  = 0x18;	  // 12 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.ExtRate[2]  = 0x30;	  // 24 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.ExtRate[3]  = 0x60;	  // 48 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.ExtRateLen  = 4;
-			pAd->CommonCfg.DesireRate[0]  = 2;	   // 1 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.DesireRate[1]  = 4;	   // 2 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.DesireRate[2]  = 11;    // 5.5 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.DesireRate[3]  = 22;    // 11 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.DesireRate[4]  = 12;    // 6 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.DesireRate[5]  = 18;    // 9 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.DesireRate[6]  = 24;    // 12 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.DesireRate[7]  = 36;    // 18 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.DesireRate[8]  = 48;    // 24 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.DesireRate[9]  = 72;    // 36 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.DesireRate[10] = 96;    // 48 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.DesireRate[11] = 108;   // 54 mbps, in units of 0.5 Mbps
-			break;
-
-		case PHY_11A:
-#ifdef DOT11_N_SUPPORT
-		case PHY_11AN_MIXED:
-		case PHY_11AGN_MIXED:
-		case PHY_11N_5G:
-#endif // DOT11_N_SUPPORT //
-			pAd->CommonCfg.SupRate[0]  = 0x8C;	  // 6 mbps, in units of 0.5 Mbps, basic rate
-			pAd->CommonCfg.SupRate[1]  = 0x12;	  // 9 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.SupRate[2]  = 0x98;	  // 12 mbps, in units of 0.5 Mbps, basic rate
-			pAd->CommonCfg.SupRate[3]  = 0x24;	  // 18 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.SupRate[4]  = 0xb0;	  // 24 mbps, in units of 0.5 Mbps, basic rate
-			pAd->CommonCfg.SupRate[5]  = 0x48;	  // 36 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.SupRate[6]  = 0x60;	  // 48 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.SupRate[7]  = 0x6c;	  // 54 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.SupRateLen  = 8;
-			pAd->CommonCfg.ExtRateLen  = 0;
-			pAd->CommonCfg.DesireRate[0]  = 12;    // 6 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.DesireRate[1]  = 18;    // 9 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.DesireRate[2]  = 24;    // 12 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.DesireRate[3]  = 36;    // 18 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.DesireRate[4]  = 48;    // 24 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.DesireRate[5]  = 72;    // 36 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.DesireRate[6]  = 96;    // 48 mbps, in units of 0.5 Mbps
-			pAd->CommonCfg.DesireRate[7]  = 108;   // 54 mbps, in units of 0.5 Mbps
-			//pAd->CommonCfg.HTPhyMode.field.MODE = MODE_OFDM; // This MODE is only FYI. not use
-			break;
-
-		default:
-			break;
-	}
-
-
-	pAd->CommonCfg.BandState = UNKNOWN_BAND;
-}
-
-
-#ifdef DOT11_N_SUPPORT
-/*
-	========================================================================
-	Routine Description:
-		Caller ensures we has 802.11n support.
-		Calls at setting HT from AP/STASetinformation
-
-	Arguments:
-		pAd - Pointer to our adapter
-		phymode  -
-
-	========================================================================
-*/
-VOID	RTMPSetHT(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	OID_SET_HT_PHYMODE *pHTPhyMode)
-{
-	//ULONG	*pmcs;
-	UINT32	Value = 0;
-	UCHAR	BBPValue = 0;
-	UCHAR	BBP3Value = 0;
-	UCHAR	RxStream = pAd->CommonCfg.RxStream;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("RTMPSetHT : HT_mode(%d), ExtOffset(%d), MCS(%d), BW(%d), STBC(%d), SHORTGI(%d)\n",
-										pHTPhyMode->HtMode, pHTPhyMode->ExtOffset,
-										pHTPhyMode->MCS, pHTPhyMode->BW,
-										pHTPhyMode->STBC, pHTPhyMode->SHORTGI));
-
-	// Don't zero supportedHyPhy structure.
-	RTMPZeroMemory(&pAd->CommonCfg.HtCapability, sizeof(pAd->CommonCfg.HtCapability));
-	RTMPZeroMemory(&pAd->CommonCfg.AddHTInfo, sizeof(pAd->CommonCfg.AddHTInfo));
-	RTMPZeroMemory(&pAd->CommonCfg.NewExtChanOffset, sizeof(pAd->CommonCfg.NewExtChanOffset));
-	RTMPZeroMemory(&pAd->CommonCfg.DesiredHtPhy, sizeof(pAd->CommonCfg.DesiredHtPhy));
-
-	if (pAd->CommonCfg.bRdg)
-	{
-		pAd->CommonCfg.HtCapability.ExtHtCapInfo.PlusHTC = 1;
-		pAd->CommonCfg.HtCapability.ExtHtCapInfo.RDGSupport = 1;
-	}
-	else
-	{
-		pAd->CommonCfg.HtCapability.ExtHtCapInfo.PlusHTC = 0;
-		pAd->CommonCfg.HtCapability.ExtHtCapInfo.RDGSupport = 0;
-	}
-
-	pAd->CommonCfg.HtCapability.HtCapParm.MaxRAmpduFactor = 3;
-	pAd->CommonCfg.DesiredHtPhy.MaxRAmpduFactor = 3;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("RTMPSetHT : RxBAWinLimit = %d\n", pAd->CommonCfg.BACapability.field.RxBAWinLimit));
-
-	// Mimo power save, A-MSDU size,
-	pAd->CommonCfg.DesiredHtPhy.AmsduEnable = (USHORT)pAd->CommonCfg.BACapability.field.AmsduEnable;
-	pAd->CommonCfg.DesiredHtPhy.AmsduSize = (UCHAR)pAd->CommonCfg.BACapability.field.AmsduSize;
-	pAd->CommonCfg.DesiredHtPhy.MimoPs = (UCHAR)pAd->CommonCfg.BACapability.field.MMPSmode;
-	pAd->CommonCfg.DesiredHtPhy.MpduDensity = (UCHAR)pAd->CommonCfg.BACapability.field.MpduDensity;
-
-	pAd->CommonCfg.HtCapability.HtCapInfo.AMsduSize = (USHORT)pAd->CommonCfg.BACapability.field.AmsduSize;
-	pAd->CommonCfg.HtCapability.HtCapInfo.MimoPs = (USHORT)pAd->CommonCfg.BACapability.field.MMPSmode;
-	pAd->CommonCfg.HtCapability.HtCapParm.MpduDensity = (UCHAR)pAd->CommonCfg.BACapability.field.MpduDensity;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("RTMPSetHT : AMsduSize = %d, MimoPs = %d, MpduDensity = %d, MaxRAmpduFactor = %d\n",
-													pAd->CommonCfg.DesiredHtPhy.AmsduSize,
-													pAd->CommonCfg.DesiredHtPhy.MimoPs,
-													pAd->CommonCfg.DesiredHtPhy.MpduDensity,
-													pAd->CommonCfg.DesiredHtPhy.MaxRAmpduFactor));
-
-	if(pHTPhyMode->HtMode == HTMODE_GF)
-	{
-		pAd->CommonCfg.HtCapability.HtCapInfo.GF = 1;
-		pAd->CommonCfg.DesiredHtPhy.GF = 1;
-	}
-	else
-		pAd->CommonCfg.DesiredHtPhy.GF = 0;
-
-	// Decide Rx MCSSet
-	switch (RxStream)
-	{
-		case 1:
-			pAd->CommonCfg.HtCapability.MCSSet[0] =  0xff;
-			pAd->CommonCfg.HtCapability.MCSSet[1] =  0x00;
-			break;
-
-		case 2:
-			pAd->CommonCfg.HtCapability.MCSSet[0] =  0xff;
-			pAd->CommonCfg.HtCapability.MCSSet[1] =  0xff;
-			break;
-
-		case 3: // 3*3
-			pAd->CommonCfg.HtCapability.MCSSet[0] =  0xff;
-			pAd->CommonCfg.HtCapability.MCSSet[1] =  0xff;
-			pAd->CommonCfg.HtCapability.MCSSet[2] =  0xff;
-			break;
-	}
-
-	if (pAd->CommonCfg.bForty_Mhz_Intolerant && (pAd->CommonCfg.Channel <= 14) && (pHTPhyMode->BW == BW_40) )
-	{
-		pHTPhyMode->BW = BW_20;
-		pAd->CommonCfg.HtCapability.HtCapInfo.Forty_Mhz_Intolerant = 1;
-	}
-
-	if(pHTPhyMode->BW == BW_40)
-	{
-		pAd->CommonCfg.HtCapability.MCSSet[4] = 0x1; // MCS 32
-		pAd->CommonCfg.HtCapability.HtCapInfo.ChannelWidth = 1;
-		if (pAd->CommonCfg.Channel <= 14)
-			pAd->CommonCfg.HtCapability.HtCapInfo.CCKmodein40 = 1;
-
-		pAd->CommonCfg.DesiredHtPhy.ChannelWidth = 1;
-		pAd->CommonCfg.AddHTInfo.AddHtInfo.RecomWidth = 1;
-		pAd->CommonCfg.AddHTInfo.AddHtInfo.ExtChanOffset = (pHTPhyMode->ExtOffset == EXTCHA_BELOW)? (EXTCHA_BELOW): EXTCHA_ABOVE;
-		// Set Regsiter for extension channel position.
-		RTMP_IO_READ32(pAd, TX_BAND_CFG, &Value);
-		RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R3, &BBP3Value);
-		if ((pHTPhyMode->ExtOffset == EXTCHA_BELOW))
-		{
-			Value |= 0x1;
-			BBP3Value |= (0x20);
-			RTMP_IO_WRITE32(pAd, TX_BAND_CFG, Value);
-		}
-		else if ((pHTPhyMode->ExtOffset == EXTCHA_ABOVE))
-		{
-			Value &= 0xfe;
-			BBP3Value &= (~0x20);
-			RTMP_IO_WRITE32(pAd, TX_BAND_CFG, Value);
-		}
-
-		// Turn on BBP 40MHz mode now only as AP .
-		// Sta can turn on BBP 40MHz after connection with 40MHz AP. Sta only broadcast 40MHz capability before connection.
-		if ((pAd->OpMode == OPMODE_AP) || INFRA_ON(pAd) || ADHOC_ON(pAd)
-			)
-		{
-			RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R4, &BBPValue);
-			BBPValue &= (~0x18);
-			BBPValue |= 0x10;
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R4, BBPValue);
-
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R3, BBP3Value);
-			pAd->CommonCfg.BBPCurrentBW = BW_40;
-		}
-	}
-	else
-	{
-		pAd->CommonCfg.HtCapability.HtCapInfo.ChannelWidth = 0;
-		pAd->CommonCfg.DesiredHtPhy.ChannelWidth = 0;
-		pAd->CommonCfg.AddHTInfo.AddHtInfo.RecomWidth = 0;
-		pAd->CommonCfg.AddHTInfo.AddHtInfo.ExtChanOffset = EXTCHA_NONE;
-		pAd->CommonCfg.CentralChannel = pAd->CommonCfg.Channel;
-		// Turn on BBP 20MHz mode by request here.
-		{
-			RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R4, &BBPValue);
-			BBPValue &= (~0x18);
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R4, BBPValue);
-			pAd->CommonCfg.BBPCurrentBW = BW_20;
-		}
-	}
-
-	if(pHTPhyMode->STBC == STBC_USE)
-	{
-		pAd->CommonCfg.HtCapability.HtCapInfo.TxSTBC = 1;
-		pAd->CommonCfg.DesiredHtPhy.TxSTBC = 1;
-		pAd->CommonCfg.HtCapability.HtCapInfo.RxSTBC = 1;
-		pAd->CommonCfg.DesiredHtPhy.RxSTBC = 1;
-	}
-	else
-	{
-		pAd->CommonCfg.DesiredHtPhy.TxSTBC = 0;
-		pAd->CommonCfg.DesiredHtPhy.RxSTBC = 0;
-	}
-
-	if(pHTPhyMode->SHORTGI == GI_400)
-	{
-		pAd->CommonCfg.HtCapability.HtCapInfo.ShortGIfor20 = 1;
-		pAd->CommonCfg.HtCapability.HtCapInfo.ShortGIfor40 = 1;
-		pAd->CommonCfg.DesiredHtPhy.ShortGIfor20 = 1;
-		pAd->CommonCfg.DesiredHtPhy.ShortGIfor40 = 1;
-	}
-	else
-	{
-		pAd->CommonCfg.HtCapability.HtCapInfo.ShortGIfor20 = 0;
-		pAd->CommonCfg.HtCapability.HtCapInfo.ShortGIfor40 = 0;
-		pAd->CommonCfg.DesiredHtPhy.ShortGIfor20 = 0;
-		pAd->CommonCfg.DesiredHtPhy.ShortGIfor40 = 0;
-	}
-
-	// We support link adaptation for unsolicit MCS feedback, set to 2.
-	pAd->CommonCfg.HtCapability.ExtHtCapInfo.MCSFeedback = MCSFBK_NONE; //MCSFBK_UNSOLICIT;
-	pAd->CommonCfg.AddHTInfo.ControlChan = pAd->CommonCfg.Channel;
-	// 1, the extension channel above the control channel.
-
-	// EDCA parameters used for AP's own transmission
-	if (pAd->CommonCfg.APEdcaParm.bValid == FALSE)
-	{
-		pAd->CommonCfg.APEdcaParm.bValid = TRUE;
-		pAd->CommonCfg.APEdcaParm.Aifsn[0] = 3;
-		pAd->CommonCfg.APEdcaParm.Aifsn[1] = 7;
-		pAd->CommonCfg.APEdcaParm.Aifsn[2] = 1;
-		pAd->CommonCfg.APEdcaParm.Aifsn[3] = 1;
-
-		pAd->CommonCfg.APEdcaParm.Cwmin[0] = 4;
-		pAd->CommonCfg.APEdcaParm.Cwmin[1] = 4;
-		pAd->CommonCfg.APEdcaParm.Cwmin[2] = 3;
-		pAd->CommonCfg.APEdcaParm.Cwmin[3] = 2;
-
-		pAd->CommonCfg.APEdcaParm.Cwmax[0] = 6;
-		pAd->CommonCfg.APEdcaParm.Cwmax[1] = 10;
-		pAd->CommonCfg.APEdcaParm.Cwmax[2] = 4;
-		pAd->CommonCfg.APEdcaParm.Cwmax[3] = 3;
-
-		pAd->CommonCfg.APEdcaParm.Txop[0]  = 0;
-		pAd->CommonCfg.APEdcaParm.Txop[1]  = 0;
-		pAd->CommonCfg.APEdcaParm.Txop[2]  = 94;
-		pAd->CommonCfg.APEdcaParm.Txop[3]  = 47;
-	}
-	AsicSetEdcaParm(pAd, &pAd->CommonCfg.APEdcaParm);
-
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		{
-		RTMPSetIndividualHT(pAd, 0);
-		}
-#endif // CONFIG_STA_SUPPORT //
-
-}
-
-/*
-	========================================================================
-	Routine Description:
-		Caller ensures we has 802.11n support.
-		Calls at setting HT from AP/STASetinformation
-
-	Arguments:
-		pAd - Pointer to our adapter
-		phymode  -
-
-	========================================================================
-*/
-VOID	RTMPSetIndividualHT(
-	IN	PRTMP_ADAPTER		pAd,
-	IN	UCHAR				apidx)
-{
-	PRT_HT_PHY_INFO		pDesired_ht_phy = NULL;
-	UCHAR	TxStream = pAd->CommonCfg.TxStream;
-	UCHAR	DesiredMcs	= MCS_AUTO;
-
-	do
-	{
-
-#ifdef CONFIG_STA_SUPPORT
-		IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		{
-			pDesired_ht_phy = &pAd->StaCfg.DesiredHtPhyInfo;
-			DesiredMcs = pAd->StaCfg.DesiredTransmitSetting.field.MCS;
-			//pAd->StaCfg.bAutoTxRateSwitch = (DesiredMcs == MCS_AUTO) ? TRUE : FALSE;
-				break;
-		}
-#endif // CONFIG_STA_SUPPORT //
-	} while (FALSE);
-
-	if (pDesired_ht_phy == NULL)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("RTMPSetIndividualHT: invalid apidx(%d)\n", apidx));
-		return;
-	}
-	RTMPZeroMemory(pDesired_ht_phy, sizeof(RT_HT_PHY_INFO));
-
-	DBGPRINT(RT_DEBUG_TRACE, ("RTMPSetIndividualHT : Desired MCS = %d\n", DesiredMcs));
-	// Check the validity of MCS
-	if ((TxStream == 1) && ((DesiredMcs >= MCS_8) && (DesiredMcs <= MCS_15)))
-	{
-		DBGPRINT(RT_DEBUG_WARN, ("RTMPSetIndividualHT: MCS(%d) is invalid in 1S, reset it as MCS_7\n", DesiredMcs));
-		DesiredMcs = MCS_7;
-	}
-
-	if ((pAd->CommonCfg.DesiredHtPhy.ChannelWidth == BW_20) && (DesiredMcs == MCS_32))
-	{
-		DBGPRINT(RT_DEBUG_WARN, ("RTMPSetIndividualHT: MCS_32 is only supported in 40-MHz, reset it as MCS_0\n"));
-		DesiredMcs = MCS_0;
-	}
-
-	pDesired_ht_phy->bHtEnable = TRUE;
-
-	// Decide desired Tx MCS
-	switch (TxStream)
-	{
-		case 1:
-			if (DesiredMcs == MCS_AUTO)
-			{
-				pDesired_ht_phy->MCSSet[0]= 0xff;
-				pDesired_ht_phy->MCSSet[1]= 0x00;
-			}
-			else if (DesiredMcs <= MCS_7)
-			{
-				pDesired_ht_phy->MCSSet[0]= 1<<DesiredMcs;
-				pDesired_ht_phy->MCSSet[1]= 0x00;
-			}
-			break;
-
-		case 2:
-			if (DesiredMcs == MCS_AUTO)
-			{
-				pDesired_ht_phy->MCSSet[0]= 0xff;
-				pDesired_ht_phy->MCSSet[1]= 0xff;
-			}
-			else if (DesiredMcs <= MCS_15)
-			{
-				ULONG mode;
-
-				mode = DesiredMcs / 8;
-				if (mode < 2)
-					pDesired_ht_phy->MCSSet[mode] = (1 << (DesiredMcs - mode * 8));
-			}
-			break;
-
-		case 3: // 3*3
-			if (DesiredMcs == MCS_AUTO)
-			{
-				/* MCS0 ~ MCS23, 3 bytes */
-				pDesired_ht_phy->MCSSet[0]= 0xff;
-				pDesired_ht_phy->MCSSet[1]= 0xff;
-				pDesired_ht_phy->MCSSet[2]= 0xff;
-			}
-			else if (DesiredMcs <= MCS_23)
-			{
-				ULONG mode;
-
-				mode = DesiredMcs / 8;
-				if (mode < 3)
-					pDesired_ht_phy->MCSSet[mode] = (1 << (DesiredMcs - mode * 8));
-			}
-			break;
-	}
-
-	if(pAd->CommonCfg.DesiredHtPhy.ChannelWidth == BW_40)
-	{
-		if (DesiredMcs == MCS_AUTO || DesiredMcs == MCS_32)
-			pDesired_ht_phy->MCSSet[4] = 0x1;
-	}
-
-	// update HT Rate setting
-    if (pAd->OpMode == OPMODE_STA)
-        MlmeUpdateHtTxRates(pAd, BSS0);
-    else
-	    MlmeUpdateHtTxRates(pAd, apidx);
-}
-
-
-/*
-	========================================================================
-	Routine Description:
-		Update HT IE from our capability.
-
-	Arguments:
-		Send all HT IE in beacon/probe rsp/assoc rsp/action frame.
-
-
-	========================================================================
-*/
-VOID	RTMPUpdateHTIE(
-	IN	RT_HT_CAPABILITY	*pRtHt,
-	IN		UCHAR				*pMcsSet,
-	OUT		HT_CAPABILITY_IE *pHtCapability,
-	OUT		ADD_HT_INFO_IE		*pAddHtInfo)
-{
-	RTMPZeroMemory(pHtCapability, sizeof(HT_CAPABILITY_IE));
-	RTMPZeroMemory(pAddHtInfo, sizeof(ADD_HT_INFO_IE));
-
-		pHtCapability->HtCapInfo.ChannelWidth = pRtHt->ChannelWidth;
-		pHtCapability->HtCapInfo.MimoPs = pRtHt->MimoPs;
-		pHtCapability->HtCapInfo.GF = pRtHt->GF;
-		pHtCapability->HtCapInfo.ShortGIfor20 = pRtHt->ShortGIfor20;
-		pHtCapability->HtCapInfo.ShortGIfor40 = pRtHt->ShortGIfor40;
-		pHtCapability->HtCapInfo.TxSTBC = pRtHt->TxSTBC;
-		pHtCapability->HtCapInfo.RxSTBC = pRtHt->RxSTBC;
-		pHtCapability->HtCapInfo.AMsduSize = pRtHt->AmsduSize;
-		pHtCapability->HtCapParm.MaxRAmpduFactor = pRtHt->MaxRAmpduFactor;
-		pHtCapability->HtCapParm.MpduDensity = pRtHt->MpduDensity;
-
-		pAddHtInfo->AddHtInfo.ExtChanOffset = pRtHt->ExtChanOffset ;
-		pAddHtInfo->AddHtInfo.RecomWidth = pRtHt->RecomWidth;
-		pAddHtInfo->AddHtInfo2.OperaionMode = pRtHt->OperaionMode;
-		pAddHtInfo->AddHtInfo2.NonGfPresent = pRtHt->NonGfPresent;
-		RTMPMoveMemory(pAddHtInfo->MCSSet, /*pRtHt->MCSSet*/pMcsSet, 4); // rt2860 only support MCS max=32, no need to copy all 16 uchar.
-
-        DBGPRINT(RT_DEBUG_TRACE,("RTMPUpdateHTIE <== \n"));
-}
-#endif // DOT11_N_SUPPORT //
-
-/*
-	========================================================================
-	Description:
-		Add Client security information into ASIC WCID table and IVEIV table.
-    Return:
-	========================================================================
-*/
-VOID	RTMPAddWcidAttributeEntry(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			BssIdx,
-	IN	UCHAR			KeyIdx,
-	IN	UCHAR			CipherAlg,
-	IN	MAC_TABLE_ENTRY *pEntry)
-{
-	UINT32		WCIDAttri = 0;
-	USHORT		offset;
-	UCHAR		IVEIV = 0;
-	USHORT		Wcid = 0;
-
-	{
-#ifdef CONFIG_STA_SUPPORT
-		IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		{
-			if (BssIdx > BSS0)
-			{
-				DBGPRINT(RT_DEBUG_ERROR, ("RTMPAddWcidAttributeEntry: The BSS-index(%d) is out of range for Infra link. \n", BssIdx));
-				return;
-			}
-
-			// 1.	In ADHOC mode, the AID is wcid number. And NO mesh link exists.
-			// 2.	In Infra mode, the AID:1 MUST be wcid of infra STA.
-			//					   the AID:2~ assign to mesh link entry.
-			if (pEntry)
-				Wcid = pEntry->Aid;
-			else
-				Wcid = MCAST_WCID;
-		}
-#endif // CONFIG_STA_SUPPORT //
-	}
-
-	// Update WCID attribute table
-	offset = MAC_WCID_ATTRIBUTE_BASE + (Wcid * HW_WCID_ATTRI_SIZE);
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-		if (pEntry && pEntry->ValidAsMesh)
-			WCIDAttri = (CipherAlg<<1) | PAIRWISEKEYTABLE;
-#ifdef QOS_DLS_SUPPORT
-		else if ((pEntry) && (pEntry->ValidAsDls) &&
-					((CipherAlg == CIPHER_TKIP) ||
-					(CipherAlg == CIPHER_TKIP_NO_MIC) ||
-					(CipherAlg == CIPHER_AES) ||
-					(CipherAlg == CIPHER_NONE)))
-			WCIDAttri = (CipherAlg<<1) | PAIRWISEKEYTABLE;
-#endif // QOS_DLS_SUPPORT //
-		else
-		WCIDAttri = (CipherAlg<<1) | SHAREDKEYTABLE;
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-	RTMP_IO_WRITE32(pAd, offset, WCIDAttri);
-
-
-	// Update IV/EIV table
-	offset = MAC_IVEIV_TABLE_BASE + (Wcid * HW_IVEIV_ENTRY_SIZE);
-
-	// WPA mode
-	if ((CipherAlg == CIPHER_TKIP) || (CipherAlg == CIPHER_TKIP_NO_MIC) || (CipherAlg == CIPHER_AES))
-	{
-		// Eiv bit on. keyid always is 0 for pairwise key
-		IVEIV = (KeyIdx <<6) | 0x20;
-	}
-	else
-	{
-		// WEP KeyIdx is default tx key.
-		IVEIV = (KeyIdx << 6);
-	}
-
-	// For key index and ext IV bit, so only need to update the position(offset+3).
-#ifdef RTMP_MAC_PCI
-	RTMP_IO_WRITE8(pAd, offset+3, IVEIV);
-#endif // RTMP_MAC_PCI //
-
-	DBGPRINT(RT_DEBUG_TRACE,("RTMPAddWcidAttributeEntry: WCID #%d, KeyIndex #%d, Alg=%s\n",Wcid, KeyIdx, CipherName[CipherAlg]));
-	DBGPRINT(RT_DEBUG_TRACE,("	WCIDAttri = 0x%x \n",  WCIDAttri));
-
-}
-
-/*
-    ==========================================================================
-    Description:
-        Parse encryption type
-Arguments:
-    pAdapter                    Pointer to our adapter
-    wrq                         Pointer to the ioctl argument
-
-    Return Value:
-        None
-
-    Note:
-    ==========================================================================
-*/
-PSTRING GetEncryptType(CHAR enc)
-{
-    if(enc == Ndis802_11WEPDisabled)
-        return "NONE";
-    if(enc == Ndis802_11WEPEnabled)
-	return "WEP";
-    if(enc == Ndis802_11Encryption2Enabled)
-	return "TKIP";
-    if(enc == Ndis802_11Encryption3Enabled)
-	return "AES";
-	if(enc == Ndis802_11Encryption4Enabled)
-	return "TKIPAES";
-    else
-	return "UNKNOW";
-}
-
-PSTRING GetAuthMode(CHAR auth)
-{
-    if(auth == Ndis802_11AuthModeOpen)
-	return "OPEN";
-    if(auth == Ndis802_11AuthModeShared)
-	return "SHARED";
-	if(auth == Ndis802_11AuthModeAutoSwitch)
-	return "AUTOWEP";
-    if(auth == Ndis802_11AuthModeWPA)
-	return "WPA";
-    if(auth == Ndis802_11AuthModeWPAPSK)
-	return "WPAPSK";
-    if(auth == Ndis802_11AuthModeWPANone)
-	return "WPANONE";
-    if(auth == Ndis802_11AuthModeWPA2)
-	return "WPA2";
-    if(auth == Ndis802_11AuthModeWPA2PSK)
-	return "WPA2PSK";
-	if(auth == Ndis802_11AuthModeWPA1WPA2)
-	return "WPA1WPA2";
-	if(auth == Ndis802_11AuthModeWPA1PSKWPA2PSK)
-	return "WPA1PSKWPA2PSK";
-
-	return "UNKNOW";
-}
-
-
-/*
-    ==========================================================================
-    Description:
-        Get site survey results
-	Arguments:
-	    pAdapter                    Pointer to our adapter
-	    wrq                         Pointer to the ioctl argument
-
-    Return Value:
-        None
-
-    Note:
-        Usage:
-			1.) UI needs to wait 4 seconds after issue a site survey command
-			2.) iwpriv ra0 get_site_survey
-			3.) UI needs to prepare at least 4096bytes to get the results
-    ==========================================================================
-*/
-#define	LINE_LEN	(4+33+20+23+9+7+3)	// Channel+SSID+Bssid+Security+Signal+WiressMode+NetworkType
-#ifdef CONFIG_STA_SUPPORT
-#endif // CONFIG_STA_SUPPORT //
-VOID	RTMPCommSiteSurveyData(
-	IN  PSTRING		msg,
-	IN  PBSS_ENTRY	pBss)
-{
-	INT         Rssi = 0;
-	UINT        Rssi_Quality = 0;
-	NDIS_802_11_NETWORK_TYPE    wireless_mode;
-	CHAR		Ssid[MAX_LEN_OF_SSID +1];
-	STRING		SecurityStr[32] = {0};
-	NDIS_802_11_ENCRYPTION_STATUS	ap_cipher = Ndis802_11EncryptionDisabled;
-	NDIS_802_11_AUTHENTICATION_MODE	ap_auth_mode = Ndis802_11AuthModeOpen;
-
-	memset(Ssid, 0 ,(MAX_LEN_OF_SSID +1));
-
-		//Channel
-		sprintf(msg+strlen(msg),"%-4d", pBss->Channel);
-		//SSID
-		memcpy(Ssid, pBss->Ssid, pBss->SsidLen);
-		Ssid[pBss->SsidLen] = '\0';
-		sprintf(msg+strlen(msg),"%-33s", Ssid);
-		//BSSID
-		sprintf(msg+strlen(msg),"%02x:%02x:%02x:%02x:%02x:%02x   ",
-			pBss->Bssid[0],
-			pBss->Bssid[1],
-			pBss->Bssid[2],
-			pBss->Bssid[3],
-			pBss->Bssid[4],
-			pBss->Bssid[5]);
-
-	//Security
-	if ((Ndis802_11AuthModeWPA <= pBss->AuthMode) &&
-		(pBss->AuthMode <= Ndis802_11AuthModeWPA1PSKWPA2PSK))
-	{
-		if (pBss->AuthModeAux == Ndis802_11AuthModeWPANone)
-		{
-			ap_auth_mode = pBss->AuthMode;
-			if (pBss->WPA.PairCipherAux == Ndis802_11WEPDisabled)
-				ap_cipher = pBss->WPA.PairCipher;
-			else
-				ap_cipher = Ndis802_11Encryption4Enabled;
-		}
-		else if (pBss->AuthModeAux == Ndis802_11AuthModeOpen)
-		{
-			ap_auth_mode = pBss->AuthMode;
-			if ((ap_auth_mode == Ndis802_11AuthModeWPA) ||
-				(ap_auth_mode == Ndis802_11AuthModeWPAPSK))
-			{
-				if (pBss->WPA.PairCipherAux == Ndis802_11WEPDisabled)
-					ap_cipher = pBss->WPA.PairCipher;
-				else
-					ap_cipher = Ndis802_11Encryption4Enabled;
-			}
-			else if ((ap_auth_mode == Ndis802_11AuthModeWPA2) ||
-					 (ap_auth_mode == Ndis802_11AuthModeWPA2PSK))
-			{
-				if (pBss->WPA2.PairCipherAux == Ndis802_11WEPDisabled)
-					ap_cipher = pBss->WPA2.PairCipher;
-				else
-					ap_cipher = Ndis802_11Encryption4Enabled;
-			}
-		}
-		else if ((pBss->AuthMode == Ndis802_11AuthModeWPAPSK) ||
-				 (pBss->AuthMode == Ndis802_11AuthModeWPA2PSK))
-		{
-			if ((pBss->AuthModeAux == Ndis802_11AuthModeWPAPSK) ||
-				(pBss->AuthModeAux == Ndis802_11AuthModeWPA2PSK))
-				ap_auth_mode = Ndis802_11AuthModeWPA1PSKWPA2PSK;
-			else
-				ap_auth_mode = pBss->AuthMode;
-
-			if (pBss->WPA.PairCipher != pBss->WPA2.PairCipher)
-				ap_cipher = Ndis802_11Encryption4Enabled;
-			else if ((pBss->WPA.PairCipher == pBss->WPA2.PairCipher) &&
-					 (pBss->WPA.PairCipherAux != pBss->WPA2.PairCipherAux))
-				ap_cipher = Ndis802_11Encryption4Enabled;
-			else if ((pBss->WPA.PairCipher == pBss->WPA2.PairCipher) &&
-					 (pBss->WPA.PairCipherAux == pBss->WPA2.PairCipherAux) &&
-					 (pBss->WPA.PairCipherAux != Ndis802_11WEPDisabled))
-				ap_cipher = Ndis802_11Encryption4Enabled;
-			else if ((pBss->WPA.PairCipher == pBss->WPA2.PairCipher) &&
-					 (pBss->WPA.PairCipherAux == pBss->WPA2.PairCipherAux) &&
-					 (pBss->WPA.PairCipherAux == Ndis802_11WEPDisabled))
-				ap_cipher = pBss->WPA.PairCipher;
-		}
-		else if ((pBss->AuthMode == Ndis802_11AuthModeWPA) ||
-				 (pBss->AuthMode == Ndis802_11AuthModeWPA2))
-		{
-			if ((pBss->AuthModeAux == Ndis802_11AuthModeWPA) ||
-				(pBss->AuthMode == Ndis802_11AuthModeWPA2))
-				ap_auth_mode = Ndis802_11AuthModeWPA1WPA2;
-			else
-				ap_auth_mode = pBss->AuthMode;
-
-			if (pBss->WPA.PairCipher != pBss->WPA2.PairCipher)
-				ap_cipher = Ndis802_11Encryption4Enabled;
-			else if ((pBss->WPA.PairCipher == pBss->WPA2.PairCipher) &&
-					 (pBss->WPA.PairCipherAux != pBss->WPA2.PairCipherAux))
-				ap_cipher = Ndis802_11Encryption4Enabled;
-			else if ((pBss->WPA.PairCipher == pBss->WPA2.PairCipher) &&
-					 (pBss->WPA.PairCipherAux == pBss->WPA2.PairCipherAux) &&
-					 (pBss->WPA.PairCipherAux != Ndis802_11WEPDisabled))
-				ap_cipher = Ndis802_11Encryption4Enabled;
-			else if ((pBss->WPA.PairCipher == pBss->WPA2.PairCipher) &&
-					 (pBss->WPA.PairCipherAux == pBss->WPA2.PairCipherAux) &&
-					 (pBss->WPA.PairCipherAux == Ndis802_11WEPDisabled))
-				ap_cipher = pBss->WPA.PairCipher;
-		}
-
-		sprintf(SecurityStr, "%s/%s", GetAuthMode((CHAR)ap_auth_mode), GetEncryptType((CHAR)ap_cipher));
-	}
-	else
-	{
-		ap_auth_mode = pBss->AuthMode;
-		ap_cipher = pBss->WepStatus;
-		if (ap_cipher == Ndis802_11WEPDisabled)
-			sprintf(SecurityStr, "NONE");
-		else if (ap_cipher == Ndis802_11WEPEnabled)
-			sprintf(SecurityStr, "WEP");
-		else
-			sprintf(SecurityStr, "%s/%s", GetAuthMode((CHAR)ap_auth_mode), GetEncryptType((CHAR)ap_cipher));
-	}
-
-	sprintf(msg+strlen(msg), "%-23s", SecurityStr);
-
-		// Rssi
-		Rssi = (INT)pBss->Rssi;
-		if (Rssi >= -50)
-			Rssi_Quality = 100;
-		else if (Rssi >= -80)    // between -50 ~ -80dbm
-			Rssi_Quality = (UINT)(24 + ((Rssi + 80) * 26)/10);
-		else if (Rssi >= -90)   // between -80 ~ -90dbm
-			Rssi_Quality = (UINT)(((Rssi + 90) * 26)/10);
-		else    // < -84 dbm
-			Rssi_Quality = 0;
-		sprintf(msg+strlen(msg),"%-9d", Rssi_Quality);
-		// Wireless Mode
-		wireless_mode = NetworkTypeInUseSanity(pBss);
-		if (wireless_mode == Ndis802_11FH ||
-			wireless_mode == Ndis802_11DS)
-			sprintf(msg+strlen(msg),"%-7s", "11b");
-		else if (wireless_mode == Ndis802_11OFDM5)
-			sprintf(msg+strlen(msg),"%-7s", "11a");
-		else if (wireless_mode == Ndis802_11OFDM5_N)
-			sprintf(msg+strlen(msg),"%-7s", "11a/n");
-		else if (wireless_mode == Ndis802_11OFDM24)
-			sprintf(msg+strlen(msg),"%-7s", "11b/g");
-		else if (wireless_mode == Ndis802_11OFDM24_N)
-			sprintf(msg+strlen(msg),"%-7s", "11b/g/n");
-		else
-			sprintf(msg+strlen(msg),"%-7s", "unknow");
-		//Network Type
-		if (pBss->BssType == BSS_ADHOC)
-			sprintf(msg+strlen(msg),"%-3s", " Ad");
-		else
-			sprintf(msg+strlen(msg),"%-3s", " In");
-
-        sprintf(msg+strlen(msg),"\n");
-
-	return;
-}
-
-VOID RTMPIoctlGetSiteSurvey(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq)
-{
-	PSTRING		msg;
-	INT		i=0;
-	INT			WaitCnt;
-	INT		Status=0;
-    INT         max_len = LINE_LEN;
-	PBSS_ENTRY	pBss;
-
-#ifdef CONFIG_STA_SUPPORT
-#endif // CONFIG_STA_SUPPORT //
-
-	os_alloc_mem(NULL, (PUCHAR *)&msg, sizeof(CHAR)*((MAX_LEN_OF_BSS_TABLE)*max_len));
-
-	if (msg == NULL)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("RTMPIoctlGetSiteSurvey - msg memory alloc fail.\n"));
-		return;
-	}
-
-	memset(msg, 0 ,(MAX_LEN_OF_BSS_TABLE)*max_len );
-	sprintf(msg,"%s","\n");
-	sprintf(msg+strlen(msg),"%-4s%-33s%-20s%-23s%-9s%-7s%-3s\n",
-	    "Ch", "SSID", "BSSID", "Security", "Siganl(%)", "W-Mode", " NT");
-
-#ifdef CONFIG_STA_SUPPORT
-
-#endif // CONFIG_STA_SUPPORT //
-
-	WaitCnt = 0;
-#ifdef CONFIG_STA_SUPPORT
-	pAdapter->StaCfg.bScanReqIsFromWebUI = TRUE;
-	while ((ScanRunning(pAdapter) == TRUE) && (WaitCnt++ < 200))
-		OS_WAIT(500);
-#endif // CONFIG_STA_SUPPORT //
-
-	for(i=0; i<pAdapter->ScanTab.BssNr ;i++)
-	{
-		pBss = &pAdapter->ScanTab.BssEntry[i];
-
-		if( pBss->Channel==0)
-			break;
-
-		if((strlen(msg)+max_len ) >= IW_SCAN_MAX_DATA)
-			break;
-
-
-		RTMPCommSiteSurveyData(msg, pBss);
-
-#ifdef CONFIG_STA_SUPPORT
-
-#endif // CONFIG_STA_SUPPORT //
-	}
-
-#ifdef CONFIG_STA_SUPPORT
-	pAdapter->StaCfg.bScanReqIsFromWebUI = FALSE;
-#endif // CONFIG_STA_SUPPORT //
-	wrq->u.data.length = strlen(msg);
-	Status = copy_to_user(wrq->u.data.pointer, msg, wrq->u.data.length);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("RTMPIoctlGetSiteSurvey - wrq->u.data.length = %d\n", wrq->u.data.length));
-	os_free_mem(NULL, (PUCHAR)msg);
-}
-
-#define	MAC_LINE_LEN	(14+4+4+10+10+10+6+6)	// Addr+aid+psm+datatime+rxbyte+txbyte+current tx rate+last tx rate
-VOID RTMPIoctlGetMacTable(
-	IN PRTMP_ADAPTER pAd,
-	IN struct iwreq *wrq)
-{
-	INT i;
-	RT_802_11_MAC_TABLE MacTab;
-	char *msg;
-
-	MacTab.Num = 0;
-	for (i=0; i<MAX_LEN_OF_MAC_TABLE; i++)
-	{
-		if (pAd->MacTab.Content[i].ValidAsCLI && (pAd->MacTab.Content[i].Sst == SST_ASSOC))
-		{
-			COPY_MAC_ADDR(MacTab.Entry[MacTab.Num].Addr, &pAd->MacTab.Content[i].Addr);
-			MacTab.Entry[MacTab.Num].Aid = (UCHAR)pAd->MacTab.Content[i].Aid;
-			MacTab.Entry[MacTab.Num].Psm = pAd->MacTab.Content[i].PsMode;
-#ifdef DOT11_N_SUPPORT
-			MacTab.Entry[MacTab.Num].MimoPs = pAd->MacTab.Content[i].MmpsMode;
-#endif // DOT11_N_SUPPORT //
-
-			// Fill in RSSI per entry
-			MacTab.Entry[MacTab.Num].AvgRssi0 = pAd->MacTab.Content[i].RssiSample.AvgRssi0;
-			MacTab.Entry[MacTab.Num].AvgRssi1 = pAd->MacTab.Content[i].RssiSample.AvgRssi1;
-			MacTab.Entry[MacTab.Num].AvgRssi2 = pAd->MacTab.Content[i].RssiSample.AvgRssi2;
-
-			// the connected time per entry
-			MacTab.Entry[MacTab.Num].ConnectedTime = pAd->MacTab.Content[i].StaConnectTime;
-			MacTab.Entry[MacTab.Num].TxRate.field.MCS = pAd->MacTab.Content[i].HTPhyMode.field.MCS;
-			MacTab.Entry[MacTab.Num].TxRate.field.BW = pAd->MacTab.Content[i].HTPhyMode.field.BW;
-			MacTab.Entry[MacTab.Num].TxRate.field.ShortGI = pAd->MacTab.Content[i].HTPhyMode.field.ShortGI;
-			MacTab.Entry[MacTab.Num].TxRate.field.STBC = pAd->MacTab.Content[i].HTPhyMode.field.STBC;
-			MacTab.Entry[MacTab.Num].TxRate.field.rsv = pAd->MacTab.Content[i].HTPhyMode.field.rsv;
-			MacTab.Entry[MacTab.Num].TxRate.field.MODE = pAd->MacTab.Content[i].HTPhyMode.field.MODE;
-			MacTab.Entry[MacTab.Num].TxRate.word = pAd->MacTab.Content[i].HTPhyMode.word;
-
-			MacTab.Num += 1;
-		}
-	}
-	wrq->u.data.length = sizeof(RT_802_11_MAC_TABLE);
-	if (copy_to_user(wrq->u.data.pointer, &MacTab, wrq->u.data.length))
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("%s: copy_to_user() fail\n", __FUNCTION__));
-	}
-
-	msg = kmalloc(sizeof(CHAR)*(MAX_LEN_OF_MAC_TABLE*MAC_LINE_LEN), MEM_ALLOC_FLAG);
-	if (msg == NULL)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("%s():Alloc memory failed\n", __FUNCTION__));
-		return;
-	}
-	memset(msg, 0 ,MAX_LEN_OF_MAC_TABLE*MAC_LINE_LEN );
-	sprintf(msg,"%s","\n");
-	sprintf(msg+strlen(msg),"%-14s%-4s%-4s%-10s%-10s%-10s%-6s%-6s\n",
-		"MAC", "AID", "PSM", "LDT", "RxB", "TxB","CTxR", "LTxR");
-
-	for (i=0; i<MAX_LEN_OF_MAC_TABLE; i++)
-	{
-		PMAC_TABLE_ENTRY pEntry = &pAd->MacTab.Content[i];
-		if (pEntry->ValidAsCLI && (pEntry->Sst == SST_ASSOC))
-		{
-			if((strlen(msg)+MAC_LINE_LEN ) >= (MAX_LEN_OF_MAC_TABLE*MAC_LINE_LEN) )
-				break;
-			sprintf(msg+strlen(msg),"%02x%02x%02x%02x%02x%02x  ",
-				pEntry->Addr[0], pEntry->Addr[1], pEntry->Addr[2],
-				pEntry->Addr[3], pEntry->Addr[4], pEntry->Addr[5]);
-			sprintf(msg+strlen(msg),"%-4d", (int)pEntry->Aid);
-			sprintf(msg+strlen(msg),"%-4d", (int)pEntry->PsMode);
-			sprintf(msg+strlen(msg),"%-10d",0/*pAd->MacTab.Content[i].HSCounter.LastDataPacketTime*/); // ToDo
-			sprintf(msg+strlen(msg),"%-10d",0/*pAd->MacTab.Content[i].HSCounter.TotalRxByteCount*/); // ToDo
-			sprintf(msg+strlen(msg),"%-10d",0/*pAd->MacTab.Content[i].HSCounter.TotalTxByteCount*/); // ToDo
-			sprintf(msg+strlen(msg),"%-6d",RateIdToMbps[pAd->MacTab.Content[i].CurrTxRate]);
-			sprintf(msg+strlen(msg),"%-6d\n",0/*RateIdToMbps[pAd->MacTab.Content[i].LastTxRate]*/); // ToDo
-		}
-	}
-	// for compatible with old API just do the printk to console
-	//wrq->u.data.length = strlen(msg);
-	//if (copy_to_user(wrq->u.data.pointer, msg, wrq->u.data.length))
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("%s", msg));
-	}
-
-	kfree(msg);
-}
-
-
-#ifdef DOT11_N_SUPPORT
-INT	Set_BASetup_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-    UCHAR mac[6], tid;
-	PSTRING token;
-	STRING sepValue[] = ":", DASH = '-';
-	INT i;
-    MAC_TABLE_ENTRY *pEntry;
-
-/*
-	The BASetup inupt string format should be xx:xx:xx:xx:xx:xx-d,
-		=>The six 2 digit hex-decimal number previous are the Mac address,
-		=>The seventh decimal number is the tid value.
-*/
-	//DBGPRINT(RT_DEBUG_TRACE,("\n%s\n", arg));
-
-	if(strlen(arg) < 19)  //Mac address acceptable format 01:02:03:04:05:06 length 17 plus the "-" and tid value in decimal format.
-		return FALSE;
-
-	token = strchr(arg, DASH);
-	if ((token != NULL) && (strlen(token)>1))
-	{
-		tid = (UCHAR) simple_strtol((token+1), 0, 10);
-		if (tid > 15)
-			return FALSE;
-
-		*token = '\0';
-		for (i = 0, token = rstrtok(arg, &sepValue[0]); token; token = rstrtok(NULL, &sepValue[0]), i++)
-		{
-			if((strlen(token) != 2) || (!isxdigit(*token)) || (!isxdigit(*(token+1))))
-				return FALSE;
-			AtoH(token, (&mac[i]), 1);
-		}
-		if(i != 6)
-			return FALSE;
-
-		DBGPRINT(RT_DEBUG_OFF, ("\n%02x:%02x:%02x:%02x:%02x:%02x-%02x\n",
-								mac[0], mac[1], mac[2], mac[3], mac[4], mac[5], tid));
-
-	    pEntry = MacTableLookup(pAd, (PUCHAR) mac);
-
-	if (pEntry) {
-		DBGPRINT(RT_DEBUG_OFF, ("\nSetup BA Session: Tid = %d\n", tid));
-	        BAOriSessionSetUp(pAd, pEntry, tid, 0, 100, TRUE);
-	}
-
-		return TRUE;
-	}
-
-	return FALSE;
-
-}
-
-INT	Set_BADecline_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	ULONG bBADecline;
-
-	bBADecline = simple_strtol(arg, 0, 10);
-
-	if (bBADecline == 0)
-	{
-		pAd->CommonCfg.bBADecline = FALSE;
-	}
-	else if (bBADecline == 1)
-	{
-		pAd->CommonCfg.bBADecline = TRUE;
-	}
-	else
-	{
-		return FALSE; //Invalid argument
-	}
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_BADecline_Proc::(BADecline=%d)\n", pAd->CommonCfg.bBADecline));
-
-	return TRUE;
-}
-
-INT	Set_BAOriTearDown_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-    UCHAR mac[6], tid;
-	PSTRING token;
-	STRING sepValue[] = ":", DASH = '-';
-	INT i;
-    MAC_TABLE_ENTRY *pEntry;
-
-    //DBGPRINT(RT_DEBUG_TRACE,("\n%s\n", arg));
-/*
-	The BAOriTearDown inupt string format should be xx:xx:xx:xx:xx:xx-d,
-		=>The six 2 digit hex-decimal number previous are the Mac address,
-		=>The seventh decimal number is the tid value.
-*/
-    if(strlen(arg) < 19)  //Mac address acceptable format 01:02:03:04:05:06 length 17 plus the "-" and tid value in decimal format.
-		return FALSE;
-
-	token = strchr(arg, DASH);
-	if ((token != NULL) && (strlen(token)>1))
-	{
-		tid = simple_strtol((token+1), 0, 10);
-		if (tid > NUM_OF_TID)
-			return FALSE;
-
-		*token = '\0';
-		for (i = 0, token = rstrtok(arg, &sepValue[0]); token; token = rstrtok(NULL, &sepValue[0]), i++)
-		{
-			if((strlen(token) != 2) || (!isxdigit(*token)) || (!isxdigit(*(token+1))))
-				return FALSE;
-			AtoH(token, (&mac[i]), 1);
-		}
-		if(i != 6)
-			return FALSE;
-
-	    DBGPRINT(RT_DEBUG_OFF, ("\n%02x:%02x:%02x:%02x:%02x:%02x-%02x",
-								mac[0], mac[1], mac[2], mac[3], mac[4], mac[5], tid));
-
-	    pEntry = MacTableLookup(pAd, (PUCHAR) mac);
-
-	    if (pEntry) {
-	        DBGPRINT(RT_DEBUG_OFF, ("\nTear down Ori BA Session: Tid = %d\n", tid));
-	        BAOriSessionTearDown(pAd, pEntry->Aid, tid, FALSE, TRUE);
-	    }
-
-		return TRUE;
-	}
-
-	return FALSE;
-
-}
-
-INT	Set_BARecTearDown_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-    UCHAR mac[6], tid;
-	PSTRING token;
-	STRING sepValue[] = ":", DASH = '-';
-	INT i;
-    MAC_TABLE_ENTRY *pEntry;
-
-    //DBGPRINT(RT_DEBUG_TRACE,("\n%s\n", arg));
-/*
-	The BARecTearDown inupt string format should be xx:xx:xx:xx:xx:xx-d,
-		=>The six 2 digit hex-decimal number previous are the Mac address,
-		=>The seventh decimal number is the tid value.
-*/
-    if(strlen(arg) < 19)  //Mac address acceptable format 01:02:03:04:05:06 length 17 plus the "-" and tid value in decimal format.
-		return FALSE;
-
-	token = strchr(arg, DASH);
-	if ((token != NULL) && (strlen(token)>1))
-	{
-		tid = simple_strtol((token+1), 0, 10);
-		if (tid > NUM_OF_TID)
-			return FALSE;
-
-		*token = '\0';
-		for (i = 0, token = rstrtok(arg, &sepValue[0]); token; token = rstrtok(NULL, &sepValue[0]), i++)
-		{
-			if((strlen(token) != 2) || (!isxdigit(*token)) || (!isxdigit(*(token+1))))
-				return FALSE;
-			AtoH(token, (&mac[i]), 1);
-		}
-		if(i != 6)
-			return FALSE;
-
-		DBGPRINT(RT_DEBUG_OFF, ("\n%02x:%02x:%02x:%02x:%02x:%02x-%02x",
-								mac[0], mac[1], mac[2], mac[3], mac[4], mac[5], tid));
-
-		pEntry = MacTableLookup(pAd, (PUCHAR) mac);
-
-		if (pEntry) {
-		    DBGPRINT(RT_DEBUG_OFF, ("\nTear down Rec BA Session: Tid = %d\n", tid));
-		    BARecSessionTearDown(pAd, pEntry->Aid, tid, FALSE);
-		}
-
-		return TRUE;
-	}
-
-	return FALSE;
-
-}
-
-INT	Set_HtBw_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	ULONG HtBw;
-
-	HtBw = simple_strtol(arg, 0, 10);
-	if (HtBw == BW_40)
-		pAd->CommonCfg.RegTransmitSetting.field.BW  = BW_40;
-	else if (HtBw == BW_20)
-		pAd->CommonCfg.RegTransmitSetting.field.BW  = BW_20;
-	else
-		return FALSE;  //Invalid argument
-
-	SetCommonHT(pAd);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_HtBw_Proc::(HtBw=%d)\n", pAd->CommonCfg.RegTransmitSetting.field.BW));
-
-	return TRUE;
-}
-
-INT	Set_HtMcs_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	ULONG HtMcs, Mcs_tmp;
-#ifdef CONFIG_STA_SUPPORT
-    BOOLEAN bAutoRate = FALSE;
-#endif // CONFIG_STA_SUPPORT //
-
-	Mcs_tmp = simple_strtol(arg, 0, 10);
-
-	if (Mcs_tmp <= 15 || Mcs_tmp == 32)
-		HtMcs = Mcs_tmp;
-	else
-		HtMcs = MCS_AUTO;
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-		pAd->StaCfg.DesiredTransmitSetting.field.MCS = HtMcs;
-		pAd->StaCfg.bAutoTxRateSwitch = (HtMcs == MCS_AUTO) ? TRUE:FALSE;
-		DBGPRINT(RT_DEBUG_TRACE, ("Set_HtMcs_Proc::(HtMcs=%d, bAutoTxRateSwitch = %d)\n",
-						pAd->StaCfg.DesiredTransmitSetting.field.MCS, pAd->StaCfg.bAutoTxRateSwitch));
-
-		if ((pAd->CommonCfg.PhyMode < PHY_11ABGN_MIXED) ||
-			(pAd->MacTab.Content[BSSID_WCID].HTPhyMode.field.MODE < MODE_HTMIX))
-		{
-	        if ((pAd->StaCfg.DesiredTransmitSetting.field.MCS != MCS_AUTO) &&
-				(HtMcs >= 0 && HtMcs <= 3) &&
-	            (pAd->StaCfg.DesiredTransmitSetting.field.FixedTxMode == FIXED_TXMODE_CCK))
-			{
-				RTMPSetDesiredRates(pAd, (LONG) (RateIdToMbps[HtMcs] * 1000000));
-			}
-	        else if ((pAd->StaCfg.DesiredTransmitSetting.field.MCS != MCS_AUTO) &&
-					(HtMcs >= 0 && HtMcs <= 7) &&
-			(pAd->StaCfg.DesiredTransmitSetting.field.FixedTxMode == FIXED_TXMODE_OFDM))
-			{
-				RTMPSetDesiredRates(pAd, (LONG) (RateIdToMbps[HtMcs+4] * 1000000));
-			}
-			else
-				bAutoRate = TRUE;
-
-			if (bAutoRate)
-			{
-	            pAd->StaCfg.DesiredTransmitSetting.field.MCS = MCS_AUTO;
-				RTMPSetDesiredRates(pAd, -1);
-			}
-	        DBGPRINT(RT_DEBUG_TRACE, ("Set_HtMcs_Proc::(FixedTxMode=%d)\n",pAd->StaCfg.DesiredTransmitSetting.field.FixedTxMode));
-		}
-        if (ADHOC_ON(pAd))
-            return TRUE;
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-	SetCommonHT(pAd);
-
-	return TRUE;
-}
-
-INT	Set_HtGi_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	ULONG HtGi;
-
-	HtGi = simple_strtol(arg, 0, 10);
-
-	if ( HtGi == GI_400)
-		pAd->CommonCfg.RegTransmitSetting.field.ShortGI = GI_400;
-	else if ( HtGi == GI_800 )
-		pAd->CommonCfg.RegTransmitSetting.field.ShortGI = GI_800;
-	else
-		return FALSE; //Invalid argument
-
-	SetCommonHT(pAd);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_HtGi_Proc::(ShortGI=%d)\n",pAd->CommonCfg.RegTransmitSetting.field.ShortGI));
-
-	return TRUE;
-}
-
-
-INT	Set_HtTxBASize_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	UCHAR Size;
-
-	Size = simple_strtol(arg, 0, 10);
-
-	if (Size <=0 || Size >=64)
-	{
-		Size = 8;
-	}
-	pAd->CommonCfg.TxBASize = Size-1;
-	DBGPRINT(RT_DEBUG_ERROR, ("Set_HtTxBASize ::(TxBASize= %d)\n", Size));
-
-	return TRUE;
-}
-
-INT	Set_HtDisallowTKIP_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	ULONG Value;
-
-	Value = simple_strtol(arg, 0, 10);
-
-	if (Value == 1)
-	{
-		pAd->CommonCfg.HT_DisallowTKIP = TRUE;
-	}
-	else
-	{
-		pAd->CommonCfg.HT_DisallowTKIP = FALSE;
-	}
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_HtDisallowTKIP_Proc ::%s\n",
-				(pAd->CommonCfg.HT_DisallowTKIP == TRUE) ? "enabled" : "disabled"));
-
-	return TRUE;
-}
-
-INT	Set_HtOpMode_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-
-	ULONG Value;
-
-	Value = simple_strtol(arg, 0, 10);
-
-	if (Value == HTMODE_GF)
-		pAd->CommonCfg.RegTransmitSetting.field.HTMODE  = HTMODE_GF;
-	else if ( Value == HTMODE_MM )
-		pAd->CommonCfg.RegTransmitSetting.field.HTMODE  = HTMODE_MM;
-	else
-		return FALSE; //Invalid argument
-
-	SetCommonHT(pAd);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_HtOpMode_Proc::(HtOpMode=%d)\n",pAd->CommonCfg.RegTransmitSetting.field.HTMODE));
-
-	return TRUE;
-
-}
-
-INT	Set_HtStbc_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-
-	ULONG Value;
-
-	Value = simple_strtol(arg, 0, 10);
-
-	if (Value == STBC_USE)
-		pAd->CommonCfg.RegTransmitSetting.field.STBC = STBC_USE;
-	else if ( Value == STBC_NONE )
-		pAd->CommonCfg.RegTransmitSetting.field.STBC = STBC_NONE;
-	else
-		return FALSE; //Invalid argument
-
-	SetCommonHT(pAd);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_Stbc_Proc::(HtStbc=%d)\n",pAd->CommonCfg.RegTransmitSetting.field.STBC));
-
-	return TRUE;
-}
-
-INT	Set_HtHtc_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-
-	ULONG Value;
-
-	Value = simple_strtol(arg, 0, 10);
-	if (Value == 0)
-		pAd->HTCEnable = FALSE;
-	else if ( Value ==1 )
-        pAd->HTCEnable = TRUE;
-	else
-		return FALSE; //Invalid argument
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_HtHtc_Proc::(HtHtc=%d)\n",pAd->HTCEnable));
-
-	return TRUE;
-}
-
-INT	Set_HtExtcha_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-
-	ULONG Value;
-
-	Value = simple_strtol(arg, 0, 10);
-
-	if (Value == 0)
-		pAd->CommonCfg.RegTransmitSetting.field.EXTCHA  = EXTCHA_BELOW;
-	else if ( Value ==1 )
-        pAd->CommonCfg.RegTransmitSetting.field.EXTCHA = EXTCHA_ABOVE;
-	else
-		return FALSE; //Invalid argument
-
-	SetCommonHT(pAd);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_HtExtcha_Proc::(HtExtcha=%d)\n",pAd->CommonCfg.RegTransmitSetting.field.EXTCHA));
-
-	return TRUE;
-}
-
-INT	Set_HtMpduDensity_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	ULONG Value;
-
-	Value = simple_strtol(arg, 0, 10);
-
-	if (Value <=7 && Value >= 0)
-		pAd->CommonCfg.BACapability.field.MpduDensity = Value;
-	else
-		pAd->CommonCfg.BACapability.field.MpduDensity = 4;
-
-	SetCommonHT(pAd);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_HtMpduDensity_Proc::(HtMpduDensity=%d)\n",pAd->CommonCfg.BACapability.field.MpduDensity));
-
-	return TRUE;
-}
-
-INT	Set_HtBaWinSize_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	ULONG Value;
-
-	Value = simple_strtol(arg, 0, 10);
-
-
-	if (Value >=1 && Value <= 64)
-	{
-		pAd->CommonCfg.REGBACapability.field.RxBAWinLimit = Value;
-		pAd->CommonCfg.BACapability.field.RxBAWinLimit = Value;
-	}
-	else
-	{
-        pAd->CommonCfg.REGBACapability.field.RxBAWinLimit = 64;
-		pAd->CommonCfg.BACapability.field.RxBAWinLimit = 64;
-	}
-
-	SetCommonHT(pAd);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_HtBaWinSize_Proc::(HtBaWinSize=%d)\n",pAd->CommonCfg.BACapability.field.RxBAWinLimit));
-
-	return TRUE;
-}
-
-INT	Set_HtRdg_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	ULONG Value;
-
-	Value = simple_strtol(arg, 0, 10);
-
-	if (Value == 0)
-		pAd->CommonCfg.bRdg = FALSE;
-	else if ( Value ==1 )
-	{
-		pAd->HTCEnable = TRUE;
-        pAd->CommonCfg.bRdg = TRUE;
-	}
-	else
-		return FALSE; //Invalid argument
-
-	SetCommonHT(pAd);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_HtRdg_Proc::(HtRdg=%d)\n",pAd->CommonCfg.bRdg));
-
-	return TRUE;
-}
-
-INT	Set_HtLinkAdapt_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	ULONG Value;
-
-	Value = simple_strtol(arg, 0, 10);
-	if (Value == 0)
-		pAd->bLinkAdapt = FALSE;
-	else if ( Value ==1 )
-	{
-			pAd->HTCEnable = TRUE;
-			pAd->bLinkAdapt = TRUE;
-	}
-	else
-		return FALSE; //Invalid argument
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_HtLinkAdapt_Proc::(HtLinkAdapt=%d)\n",pAd->bLinkAdapt));
-
-	return TRUE;
-}
-
-INT	Set_HtAmsdu_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	ULONG Value;
-
-	Value = simple_strtol(arg, 0, 10);
-	if (Value == 0)
-		pAd->CommonCfg.BACapability.field.AmsduEnable = FALSE;
-	else if ( Value == 1 )
-        pAd->CommonCfg.BACapability.field.AmsduEnable = TRUE;
-	else
-		return FALSE; //Invalid argument
-
-	SetCommonHT(pAd);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_HtAmsdu_Proc::(HtAmsdu=%d)\n",pAd->CommonCfg.BACapability.field.AmsduEnable));
-
-	return TRUE;
-}
-
-INT	Set_HtAutoBa_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	ULONG Value;
-
-	Value = simple_strtol(arg, 0, 10);
-	if (Value == 0)
-	{
-		pAd->CommonCfg.BACapability.field.AutoBA = FALSE;
-		pAd->CommonCfg.BACapability.field.Policy = BA_NOTUSE;
-	}
-    else if (Value == 1)
-    {
-		pAd->CommonCfg.BACapability.field.AutoBA = TRUE;
-		pAd->CommonCfg.BACapability.field.Policy = IMMED_BA;
-    }
-	else
-		return FALSE; //Invalid argument
-
-    pAd->CommonCfg.REGBACapability.field.AutoBA = pAd->CommonCfg.BACapability.field.AutoBA;
-	pAd->CommonCfg.REGBACapability.field.Policy = pAd->CommonCfg.BACapability.field.Policy;
-	SetCommonHT(pAd);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_HtAutoBa_Proc::(HtAutoBa=%d)\n",pAd->CommonCfg.BACapability.field.AutoBA));
-
-	return TRUE;
-
-}
-
-INT	Set_HtProtect_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	ULONG Value;
-
-	Value = simple_strtol(arg, 0, 10);
-	if (Value == 0)
-		pAd->CommonCfg.bHTProtect = FALSE;
-    else if (Value == 1)
-		pAd->CommonCfg.bHTProtect = TRUE;
-	else
-		return FALSE; //Invalid argument
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_HtProtect_Proc::(HtProtect=%d)\n",pAd->CommonCfg.bHTProtect));
-
-	return TRUE;
-}
-
-INT	Set_SendPSMPAction_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-    UCHAR mac[6], mode;
-	PSTRING token;
-	STRING sepValue[] = ":", DASH = '-';
-	INT i;
-    MAC_TABLE_ENTRY *pEntry;
-
-    //DBGPRINT(RT_DEBUG_TRACE,("\n%s\n", arg));
-/*
-	The BARecTearDown inupt string format should be xx:xx:xx:xx:xx:xx-d,
-		=>The six 2 digit hex-decimal number previous are the Mac address,
-		=>The seventh decimal number is the mode value.
-*/
-    if(strlen(arg) < 19)  //Mac address acceptable format 01:02:03:04:05:06 length 17 plus the "-" and mode value in decimal format.
-		return FALSE;
-
-	token = strchr(arg, DASH);
-	if ((token != NULL) && (strlen(token)>1))
-	{
-		mode = simple_strtol((token+1), 0, 10);
-		if (mode > MMPS_ENABLE)
-			return FALSE;
-
-		*token = '\0';
-		for (i = 0, token = rstrtok(arg, &sepValue[0]); token; token = rstrtok(NULL, &sepValue[0]), i++)
-		{
-			if((strlen(token) != 2) || (!isxdigit(*token)) || (!isxdigit(*(token+1))))
-				return FALSE;
-			AtoH(token, (&mac[i]), 1);
-		}
-		if(i != 6)
-			return FALSE;
-
-		DBGPRINT(RT_DEBUG_OFF, ("\n%02x:%02x:%02x:%02x:%02x:%02x-%02x",
-								mac[0], mac[1], mac[2], mac[3], mac[4], mac[5], mode));
-
-		pEntry = MacTableLookup(pAd, mac);
-
-		if (pEntry) {
-		    DBGPRINT(RT_DEBUG_OFF, ("\nSendPSMPAction MIPS mode = %d\n", mode));
-		    SendPSMPAction(pAd, pEntry->Aid, mode);
-		}
-
-		return TRUE;
-	}
-
-	return FALSE;
-
-
-}
-
-INT	Set_HtMIMOPSmode_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	ULONG Value;
-
-	Value = simple_strtol(arg, 0, 10);
-
-	if (Value <=3 && Value >= 0)
-		pAd->CommonCfg.BACapability.field.MMPSmode = Value;
-	else
-		pAd->CommonCfg.BACapability.field.MMPSmode = 3;
-
-	SetCommonHT(pAd);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_HtMIMOPSmode_Proc::(MIMOPS mode=%d)\n",pAd->CommonCfg.BACapability.field.MMPSmode));
-
-	return TRUE;
-}
-
-
-INT	Set_ForceShortGI_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	ULONG Value;
-
-	Value = simple_strtol(arg, 0, 10);
-	if (Value == 0)
-		pAd->WIFItestbed.bShortGI = FALSE;
-	else if (Value == 1)
-		pAd->WIFItestbed.bShortGI = TRUE;
-	else
-		return FALSE; //Invalid argument
-
-	SetCommonHT(pAd);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_ForceShortGI_Proc::(ForceShortGI=%d)\n", pAd->WIFItestbed.bShortGI));
-
-	return TRUE;
-}
-
-
-
-INT	Set_ForceGF_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	ULONG Value;
-
-	Value = simple_strtol(arg, 0, 10);
-	if (Value == 0)
-		pAd->WIFItestbed.bGreenField = FALSE;
-	else if (Value == 1)
-		pAd->WIFItestbed.bGreenField = TRUE;
-	else
-		return FALSE; //Invalid argument
-
-	SetCommonHT(pAd);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_ForceGF_Proc::(ForceGF=%d)\n", pAd->WIFItestbed.bGreenField));
-
-	return TRUE;
-}
-
-INT	Set_HtMimoPs_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	ULONG Value;
-
-	Value = simple_strtol(arg, 0, 10);
-	if (Value == 0)
-		pAd->CommonCfg.bMIMOPSEnable = FALSE;
-	else if (Value == 1)
-		pAd->CommonCfg.bMIMOPSEnable = TRUE;
-	else
-		return FALSE; //Invalid argument
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_HtMimoPs_Proc::(HtMimoPs=%d)\n",pAd->CommonCfg.bMIMOPSEnable));
-
-	return TRUE;
-}
-#endif // DOT11_N_SUPPORT //
-
-
-#ifdef DOT11_N_SUPPORT
-INT	SetCommonHT(
-	IN	PRTMP_ADAPTER	pAd)
-{
-	OID_SET_HT_PHYMODE		SetHT;
-
-	if (pAd->CommonCfg.PhyMode < PHY_11ABGN_MIXED)
-		return FALSE;
-
-	SetHT.PhyMode = pAd->CommonCfg.PhyMode;
-	SetHT.TransmitNo = ((UCHAR)pAd->Antenna.field.TxPath);
-	SetHT.HtMode = (UCHAR)pAd->CommonCfg.RegTransmitSetting.field.HTMODE;
-	SetHT.ExtOffset = (UCHAR)pAd->CommonCfg.RegTransmitSetting.field.EXTCHA;
-	SetHT.MCS = MCS_AUTO;
-	SetHT.BW = (UCHAR)pAd->CommonCfg.RegTransmitSetting.field.BW;
-	SetHT.STBC = (UCHAR)pAd->CommonCfg.RegTransmitSetting.field.STBC;
-	SetHT.SHORTGI = (UCHAR)pAd->CommonCfg.RegTransmitSetting.field.ShortGI;
-
-	RTMPSetHT(pAd, &SetHT);
-
-	return TRUE;
-}
-#endif // DOT11_N_SUPPORT //
-
-INT	Set_FixedTxMode_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	UCHAR	fix_tx_mode = FIXED_TXMODE_HT;
-
-	if (strcmp(arg, "OFDM") == 0 || strcmp(arg, "ofdm") == 0)
-	{
-		fix_tx_mode = FIXED_TXMODE_OFDM;
-	}
-	else if (strcmp(arg, "CCK") == 0 || strcmp(arg, "cck") == 0)
-	{
-        fix_tx_mode = FIXED_TXMODE_CCK;
-	}
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		pAd->StaCfg.DesiredTransmitSetting.field.FixedTxMode = fix_tx_mode;
-#endif // CONFIG_STA_SUPPORT //
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_FixedTxMode_Proc::(FixedTxMode=%d)\n", fix_tx_mode));
-
-	return TRUE;
-}
-
-#ifdef CONFIG_APSTA_MIXED_SUPPORT
-INT	Set_OpMode_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	ULONG Value;
-
-	Value = simple_strtol(arg, 0, 10);
-
-#ifdef RTMP_MAC_PCI
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_INTERRUPT_IN_USE))
-#endif // RTMP_MAC_PCI //
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("Can not switch operate mode on interface up !! \n"));
-		return FALSE;
-	}
-
-	if (Value == 0)
-		pAd->OpMode = OPMODE_STA;
-	else if (Value == 1)
-		pAd->OpMode = OPMODE_AP;
-	else
-		return FALSE; //Invalid argument
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_OpMode_Proc::(OpMode=%s)\n", pAd->OpMode == 1 ? "AP Mode" : "STA Mode"));
-
-	return TRUE;
-}
-#endif // CONFIG_APSTA_MIXED_SUPPORT //
-
-
-
-INT Set_LongRetryLimit_Proc(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	PSTRING			arg)
-{
-	TX_RTY_CFG_STRUC	tx_rty_cfg;
-	UCHAR				LongRetryLimit = (UCHAR)simple_strtol(arg, 0, 10);
-
-	RTMP_IO_READ32(pAdapter, TX_RTY_CFG, &tx_rty_cfg.word);
-	tx_rty_cfg.field.LongRtyLimit = LongRetryLimit;
-	RTMP_IO_WRITE32(pAdapter, TX_RTY_CFG, tx_rty_cfg.word);
-	DBGPRINT(RT_DEBUG_TRACE, ("IF Set_LongRetryLimit_Proc::(tx_rty_cfg=0x%x)\n", tx_rty_cfg.word));
-	return TRUE;
-}
-
-INT Set_ShortRetryLimit_Proc(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	PSTRING			arg)
-{
-	TX_RTY_CFG_STRUC	tx_rty_cfg;
-	UCHAR				ShortRetryLimit = (UCHAR)simple_strtol(arg, 0, 10);
-
-	RTMP_IO_READ32(pAdapter, TX_RTY_CFG, &tx_rty_cfg.word);
-	tx_rty_cfg.field.ShortRtyLimit = ShortRetryLimit;
-	RTMP_IO_WRITE32(pAdapter, TX_RTY_CFG, tx_rty_cfg.word);
-	DBGPRINT(RT_DEBUG_TRACE, ("IF Set_ShortRetryLimit_Proc::(tx_rty_cfg=0x%x)\n", tx_rty_cfg.word));
-	return TRUE;
-}
-
-
-/////////////////////////////////////////////////////////////////////////
-PSTRING RTMPGetRalinkAuthModeStr(
-    IN  NDIS_802_11_AUTHENTICATION_MODE authMode)
-{
-	switch(authMode)
-	{
-		case Ndis802_11AuthModeOpen:
-			return "OPEN";
-		case Ndis802_11AuthModeWPAPSK:
-			return "WPAPSK";
-		case Ndis802_11AuthModeShared:
-			return "SHARED";
-		case Ndis802_11AuthModeWPA:
-			return "WPA";
-		case Ndis802_11AuthModeWPA2:
-			return "WPA2";
-		case Ndis802_11AuthModeWPA2PSK:
-			return "WPA2PSK";
-        case Ndis802_11AuthModeWPA1PSKWPA2PSK:
-			return "WPAPSKWPA2PSK";
-        case Ndis802_11AuthModeWPA1WPA2:
-			return "WPA1WPA2";
-		case Ndis802_11AuthModeWPANone:
-			return "WPANONE";
-		default:
-			return "UNKNOW";
-	}
-}
-
-PSTRING RTMPGetRalinkEncryModeStr(
-    IN  USHORT encryMode)
-{
-	switch(encryMode)
-	{
-		case Ndis802_11WEPDisabled:
-			return "NONE";
-		case Ndis802_11WEPEnabled:
-			return "WEP";
-		case Ndis802_11Encryption2Enabled:
-			return "TKIP";
-		case Ndis802_11Encryption3Enabled:
-			return "AES";
-        case Ndis802_11Encryption4Enabled:
-			return "TKIPAES";
-		default:
-			return "UNKNOW";
-	}
-}
-
-INT RTMPShowCfgValue(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			pName,
-	IN	PSTRING			pBuf)
-{
-	INT	Status = 0;
-
-	for (PRTMP_PRIVATE_STA_SHOW_CFG_VALUE_PROC = RTMP_PRIVATE_STA_SHOW_CFG_VALUE_PROC; PRTMP_PRIVATE_STA_SHOW_CFG_VALUE_PROC->name; PRTMP_PRIVATE_STA_SHOW_CFG_VALUE_PROC++)
-	{
-		if (!strcmp(pName, PRTMP_PRIVATE_STA_SHOW_CFG_VALUE_PROC->name))
-		{
-			if(PRTMP_PRIVATE_STA_SHOW_CFG_VALUE_PROC->show_proc(pAd, pBuf))
-				Status = -EINVAL;
-			break;  //Exit for loop.
-		}
-	}
-
-	if(PRTMP_PRIVATE_STA_SHOW_CFG_VALUE_PROC->name == NULL)
-	{
-		sprintf(pBuf, "\n");
-		for (PRTMP_PRIVATE_STA_SHOW_CFG_VALUE_PROC = RTMP_PRIVATE_STA_SHOW_CFG_VALUE_PROC; PRTMP_PRIVATE_STA_SHOW_CFG_VALUE_PROC->name; PRTMP_PRIVATE_STA_SHOW_CFG_VALUE_PROC++)
-			sprintf(pBuf, "%s%s\n", pBuf, PRTMP_PRIVATE_STA_SHOW_CFG_VALUE_PROC->name);
-	}
-
-	return Status;
-}
-
-INT	Show_SSID_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf)
-{
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		sprintf(pBuf, "\t%s", pAd->CommonCfg.Ssid);
-#endif // CONFIG_STA_SUPPORT //
-	return 0;
-}
-
-INT	Show_WirelessMode_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf)
-{
-	switch(pAd->CommonCfg.PhyMode)
-	{
-		case PHY_11BG_MIXED:
-			sprintf(pBuf, "\t11B/G");
-			break;
-		case PHY_11B:
-			sprintf(pBuf, "\t11B");
-			break;
-		case PHY_11A:
-			sprintf(pBuf, "\t11A");
-			break;
-		case PHY_11ABG_MIXED:
-			sprintf(pBuf, "\t11A/B/G");
-			break;
-		case PHY_11G:
-			sprintf(pBuf, "\t11G");
-			break;
-#ifdef DOT11_N_SUPPORT
-		case PHY_11ABGN_MIXED:
-			sprintf(pBuf, "\t11A/B/G/N");
-			break;
-		case PHY_11N_2_4G:
-			sprintf(pBuf, "\t11N only with 2.4G");
-			break;
-		case PHY_11GN_MIXED:
-			sprintf(pBuf, "\t11G/N");
-			break;
-		case PHY_11AN_MIXED:
-			sprintf(pBuf, "\t11A/N");
-			break;
-		case PHY_11BGN_MIXED:
-			sprintf(pBuf, "\t11B/G/N");
-			break;
-		case PHY_11AGN_MIXED:
-			sprintf(pBuf, "\t11A/G/N");
-			break;
-		case PHY_11N_5G:
-			sprintf(pBuf, "\t11N only with 5G");
-			break;
-#endif // DOT11_N_SUPPORT //
-		default:
-			sprintf(pBuf, "\tUnknow Value(%d)", pAd->CommonCfg.PhyMode);
-			break;
-	}
-	return 0;
-}
-
-
-INT	Show_TxBurst_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf)
-{
-	sprintf(pBuf, "\t%s", pAd->CommonCfg.bEnableTxBurst ? "TRUE":"FALSE");
-	return 0;
-}
-
-INT	Show_TxPreamble_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf)
-{
-	switch(pAd->CommonCfg.TxPreamble)
-	{
-		case Rt802_11PreambleShort:
-			sprintf(pBuf, "\tShort");
-			break;
-		case Rt802_11PreambleLong:
-			sprintf(pBuf, "\tLong");
-			break;
-		case Rt802_11PreambleAuto:
-			sprintf(pBuf, "\tAuto");
-			break;
-		default:
-			sprintf(pBuf, "\tUnknow Value(%lu)", pAd->CommonCfg.TxPreamble);
-			break;
-	}
-
-	return 0;
-}
-
-INT	Show_TxPower_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf)
-{
-	sprintf(pBuf, "\t%lu", pAd->CommonCfg.TxPowerPercentage);
-	return 0;
-}
-
-INT	Show_Channel_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf)
-{
-	sprintf(pBuf, "\t%d", pAd->CommonCfg.Channel);
-	return 0;
-}
-
-INT	Show_BGProtection_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf)
-{
-	switch(pAd->CommonCfg.UseBGProtection)
-	{
-		case 1: //Always On
-			sprintf(pBuf, "\tON");
-			break;
-		case 2: //Always OFF
-			sprintf(pBuf, "\tOFF");
-			break;
-		case 0: //AUTO
-			sprintf(pBuf, "\tAuto");
-			break;
-		default:
-			sprintf(pBuf, "\tUnknow Value(%lu)", pAd->CommonCfg.UseBGProtection);
-			break;
-	}
-	return 0;
-}
-
-INT	Show_RTSThreshold_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf)
-{
-	sprintf(pBuf, "\t%u", pAd->CommonCfg.RtsThreshold);
-	return 0;
-}
-
-INT	Show_FragThreshold_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf)
-{
-	sprintf(pBuf, "\t%u", pAd->CommonCfg.FragmentThreshold);
-	return 0;
-}
-
-#ifdef DOT11_N_SUPPORT
-INT	Show_HtBw_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf)
-{
-	if (pAd->CommonCfg.RegTransmitSetting.field.BW == BW_40)
-	{
-		sprintf(pBuf, "\t40 MHz");
-	}
-	else
-	{
-        sprintf(pBuf, "\t20 MHz");
-	}
-	return 0;
-}
-
-INT	Show_HtMcs_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf)
-{
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		sprintf(pBuf, "\t%u", pAd->StaCfg.DesiredTransmitSetting.field.MCS);
-#endif // CONFIG_STA_SUPPORT //
-	return 0;
-}
-
-INT	Show_HtGi_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf)
-{
-	switch(pAd->CommonCfg.RegTransmitSetting.field.ShortGI)
-	{
-		case GI_400:
-			sprintf(pBuf, "\tGI_400");
-			break;
-		case GI_800:
-			sprintf(pBuf, "\tGI_800");
-			break;
-		default:
-			sprintf(pBuf, "\tUnknow Value(%u)", pAd->CommonCfg.RegTransmitSetting.field.ShortGI);
-			break;
-	}
-	return 0;
-}
-
-INT	Show_HtOpMode_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf)
-{
-	switch(pAd->CommonCfg.RegTransmitSetting.field.HTMODE)
-	{
-		case HTMODE_GF:
-			sprintf(pBuf, "\tGF");
-			break;
-		case HTMODE_MM:
-			sprintf(pBuf, "\tMM");
-			break;
-		default:
-			sprintf(pBuf, "\tUnknow Value(%u)", pAd->CommonCfg.RegTransmitSetting.field.HTMODE);
-			break;
-	}
-	return 0;
-}
-
-INT	Show_HtExtcha_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf)
-{
-	switch(pAd->CommonCfg.RegTransmitSetting.field.EXTCHA)
-	{
-		case EXTCHA_BELOW:
-			sprintf(pBuf, "\tBelow");
-			break;
-		case EXTCHA_ABOVE:
-			sprintf(pBuf, "\tAbove");
-			break;
-		default:
-			sprintf(pBuf, "\tUnknow Value(%u)", pAd->CommonCfg.RegTransmitSetting.field.EXTCHA);
-			break;
-	}
-	return 0;
-}
-
-
-INT	Show_HtMpduDensity_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf)
-{
-	sprintf(pBuf, "\t%u", pAd->CommonCfg.BACapability.field.MpduDensity);
-	return 0;
-}
-
-INT	Show_HtBaWinSize_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf)
-{
-	sprintf(pBuf, "\t%u", pAd->CommonCfg.BACapability.field.RxBAWinLimit);
-	return 0;
-}
-
-INT	Show_HtRdg_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf)
-{
-	sprintf(pBuf, "\t%s", pAd->CommonCfg.bRdg ? "TRUE":"FALSE");
-	return 0;
-}
-
-INT	Show_HtAmsdu_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf)
-{
-	sprintf(pBuf, "\t%s", pAd->CommonCfg.BACapability.field.AmsduEnable ? "TRUE":"FALSE");
-	return 0;
-}
-
-INT	Show_HtAutoBa_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf)
-{
-	sprintf(pBuf, "\t%s", pAd->CommonCfg.BACapability.field.AutoBA ? "TRUE":"FALSE");
-	return 0;
-}
-#endif // DOT11_N_SUPPORT //
-
-INT	Show_CountryRegion_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf)
-{
-	sprintf(pBuf, "\t%d", pAd->CommonCfg.CountryRegion);
-	return 0;
-}
-
-INT	Show_CountryRegionABand_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf)
-{
-	sprintf(pBuf, "\t%d", pAd->CommonCfg.CountryRegionForABand);
-	return 0;
-}
-
-INT	Show_CountryCode_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf)
-{
-	sprintf(pBuf, "\t%s", pAd->CommonCfg.CountryCode);
-	return 0;
-}
-
-#ifdef AGGREGATION_SUPPORT
-INT	Show_PktAggregate_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf)
-{
-	sprintf(pBuf, "\t%s", pAd->CommonCfg.bAggregationCapable ? "TRUE":"FALSE");
-	return 0;
-}
-#endif // AGGREGATION_SUPPORT //
-
-#ifdef WMM_SUPPORT
-INT	Show_WmmCapable_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf)
-{
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		sprintf(pBuf, "\t%s", pAd->CommonCfg.bWmmCapable ? "TRUE":"FALSE");
-#endif // CONFIG_STA_SUPPORT //
-
-	return 0;
-}
-#endif // WMM_SUPPORT //
-
-INT	Show_IEEE80211H_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf)
-{
-	sprintf(pBuf, "\t%s", pAd->CommonCfg.bIEEE80211H ? "TRUE":"FALSE");
-	return 0;
-}
-
-#ifdef CONFIG_STA_SUPPORT
-INT	Show_NetworkType_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf)
-{
-	switch(pAd->StaCfg.BssType)
-	{
-		case BSS_ADHOC:
-			sprintf(pBuf, "\tAdhoc");
-			break;
-		case BSS_INFRA:
-			sprintf(pBuf, "\tInfra");
-			break;
-		case BSS_ANY:
-			sprintf(pBuf, "\tAny");
-			break;
-		case BSS_MONITOR:
-			sprintf(pBuf, "\tMonitor");
-			break;
-		default:
-			sprintf(pBuf, "\tUnknow Value(%d)", pAd->StaCfg.BssType);
-			break;
-	}
-	return 0;
-}
-
-
-#endif // CONFIG_STA_SUPPORT //
-
-INT	Show_AuthMode_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf)
-{
-	NDIS_802_11_AUTHENTICATION_MODE	AuthMode = Ndis802_11AuthModeOpen;
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		AuthMode = pAd->StaCfg.AuthMode;
-#endif // CONFIG_STA_SUPPORT //
-
-	if ((AuthMode >= Ndis802_11AuthModeOpen) &&
-		(AuthMode <= Ndis802_11AuthModeWPA1PSKWPA2PSK))
-		sprintf(pBuf, "\t%s", RTMPGetRalinkAuthModeStr(AuthMode));
-	else
-		sprintf(pBuf, "\tUnknow Value(%d)", AuthMode);
-
-	return 0;
-}
-
-INT	Show_EncrypType_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf)
-{
-	NDIS_802_11_WEP_STATUS	WepStatus = Ndis802_11WEPDisabled;
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		WepStatus = pAd->StaCfg.WepStatus;
-#endif // CONFIG_STA_SUPPORT //
-
-	if ((WepStatus >= Ndis802_11WEPEnabled) &&
-		(WepStatus <= Ndis802_11Encryption4KeyAbsent))
-		sprintf(pBuf, "\t%s", RTMPGetRalinkEncryModeStr(WepStatus));
-	else
-		sprintf(pBuf, "\tUnknow Value(%d)", WepStatus);
-
-	return 0;
-}
-
-INT	Show_DefaultKeyID_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf)
-{
-	UCHAR DefaultKeyId = 0;
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		DefaultKeyId = pAd->StaCfg.DefaultKeyId;
-#endif // CONFIG_STA_SUPPORT //
-
-	sprintf(pBuf, "\t%d", DefaultKeyId);
-
-	return 0;
-}
-
-INT	Show_WepKey_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN  INT				KeyIdx,
-	OUT	PSTRING			pBuf)
-{
-	UCHAR   Key[16] = {0}, KeyLength = 0;
-	INT		index = BSS0;
-
-	KeyLength = pAd->SharedKey[index][KeyIdx].KeyLen;
-	NdisMoveMemory(Key, pAd->SharedKey[index][KeyIdx].Key, KeyLength);
-
-	//check key string is ASCII or not
-    if (RTMPCheckStrPrintAble((PCHAR)Key, KeyLength))
-        sprintf(pBuf, "\t%s", Key);
-    else
-    {
-        int idx;
-        sprintf(pBuf, "\t");
-        for (idx = 0; idx < KeyLength; idx++)
-            sprintf(pBuf+strlen(pBuf), "%02X", Key[idx]);
-    }
-	return 0;
-}
-
-INT	Show_Key1_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf)
-{
-	Show_WepKey_Proc(pAd, 0, pBuf);
-	return 0;
-}
-
-INT	Show_Key2_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf)
-{
-	Show_WepKey_Proc(pAd, 1, pBuf);
-	return 0;
-}
-
-INT	Show_Key3_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf)
-{
-	Show_WepKey_Proc(pAd, 2, pBuf);
-	return 0;
-}
-
-INT	Show_Key4_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf)
-{
-	Show_WepKey_Proc(pAd, 3, pBuf);
-	return 0;
-}
-
-INT	Show_WPAPSK_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT	PSTRING			pBuf)
-{
-	INT	idx;
-	UCHAR	PMK[32] = {0};
-
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		NdisMoveMemory(PMK, pAd->StaCfg.PMK, 32);
-#endif // CONFIG_STA_SUPPORT //
-
-    sprintf(pBuf, "\tPMK = ");
-    for (idx = 0; idx < 32; idx++)
-        sprintf(pBuf+strlen(pBuf), "%02X", PMK[idx]);
-
-	return 0;
-}
diff --git a/drivers/staging/rt3090/common/cmm_mac_pci.c b/drivers/staging/rt3090/common/cmm_mac_pci.c
deleted file mode 100644
index 8e1636315a8b..000000000000
--- a/drivers/staging/rt3090/common/cmm_mac_pci.c
+++ /dev/null
@@ -1,1757 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-*/
-
-#ifdef RTMP_MAC_PCI
-
-#include "../rt_config.h"
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		Allocate DMA memory blocks for send, receive
-
-	Arguments:
-		Adapter		Pointer to our adapter
-
-	Return Value:
-		NDIS_STATUS_SUCCESS
-		NDIS_STATUS_FAILURE
-		NDIS_STATUS_RESOURCES
-
-	IRQL = PASSIVE_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-NDIS_STATUS	RTMPAllocTxRxRingMemory(
-	IN	PRTMP_ADAPTER	pAd)
-{
-	NDIS_STATUS		Status = NDIS_STATUS_SUCCESS;
-	ULONG			RingBasePaHigh;
-	ULONG			RingBasePaLow;
-	PVOID			RingBaseVa;
-	INT				index, num;
-	PTXD_STRUC		pTxD;
-	PRXD_STRUC		pRxD;
-	ULONG			ErrorValue = 0;
-	PRTMP_TX_RING	pTxRing;
-	PRTMP_DMABUF	pDmaBuf;
-	PNDIS_PACKET	pPacket;
-//	PRTMP_REORDERBUF	pReorderBuf;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("--> RTMPAllocTxRxRingMemory\n"));
-	do
-	{
-		//
-		// Allocate all ring descriptors, include TxD, RxD, MgmtD.
-		// Although each size is different, to prevent cacheline and alignment
-		// issue, I intentional set them all to 64 bytes.
-		//
-		for (num=0; num<NUM_OF_TX_RING; num++)
-		{
-			ULONG  BufBasePaHigh;
-			ULONG  BufBasePaLow;
-			PVOID  BufBaseVa;
-
-			//
-			// Allocate Tx ring descriptor's memory (5 TX rings = 4 ACs + 1 HCCA)
-			//
-			pAd->TxDescRing[num].AllocSize = TX_RING_SIZE * TXD_SIZE;
-			RTMP_AllocateTxDescMemory(
-				pAd,
-				num,
-				pAd->TxDescRing[num].AllocSize,
-				FALSE,
-				&pAd->TxDescRing[num].AllocVa,
-				&pAd->TxDescRing[num].AllocPa);
-
-			if (pAd->TxDescRing[num].AllocVa == NULL)
-			{
-				ErrorValue = ERRLOG_OUT_OF_SHARED_MEMORY;
-				DBGPRINT_ERR(("Failed to allocate a big buffer\n"));
-				Status = NDIS_STATUS_RESOURCES;
-				break;
-			}
-
-			// Zero init this memory block
-			NdisZeroMemory(pAd->TxDescRing[num].AllocVa, pAd->TxDescRing[num].AllocSize);
-
-			// Save PA & VA for further operation
-			RingBasePaHigh = RTMP_GetPhysicalAddressHigh(pAd->TxDescRing[num].AllocPa);
-			RingBasePaLow  = RTMP_GetPhysicalAddressLow (pAd->TxDescRing[num].AllocPa);
-			RingBaseVa     = pAd->TxDescRing[num].AllocVa;
-
-			//
-			// Allocate all 1st TXBuf's memory for this TxRing
-			//
-			pAd->TxBufSpace[num].AllocSize = TX_RING_SIZE * TX_DMA_1ST_BUFFER_SIZE;
-			RTMP_AllocateFirstTxBuffer(
-				pAd,
-				num,
-				pAd->TxBufSpace[num].AllocSize,
-				FALSE,
-				&pAd->TxBufSpace[num].AllocVa,
-				&pAd->TxBufSpace[num].AllocPa);
-
-			if (pAd->TxBufSpace[num].AllocVa == NULL)
-			{
-				ErrorValue = ERRLOG_OUT_OF_SHARED_MEMORY;
-				DBGPRINT_ERR(("Failed to allocate a big buffer\n"));
-				Status = NDIS_STATUS_RESOURCES;
-				break;
-			}
-
-			// Zero init this memory block
-			NdisZeroMemory(pAd->TxBufSpace[num].AllocVa, pAd->TxBufSpace[num].AllocSize);
-
-			// Save PA & VA for further operation
-			BufBasePaHigh = RTMP_GetPhysicalAddressHigh(pAd->TxBufSpace[num].AllocPa);
-			BufBasePaLow  = RTMP_GetPhysicalAddressLow (pAd->TxBufSpace[num].AllocPa);
-			BufBaseVa     = pAd->TxBufSpace[num].AllocVa;
-
-			//
-			// Initialize Tx Ring Descriptor and associated buffer memory
-			//
-			pTxRing = &pAd->TxRing[num];
-			for (index = 0; index < TX_RING_SIZE; index++)
-			{
-				pTxRing->Cell[index].pNdisPacket = NULL;
-				pTxRing->Cell[index].pNextNdisPacket = NULL;
-				// Init Tx Ring Size, Va, Pa variables
-				pTxRing->Cell[index].AllocSize = TXD_SIZE;
-				pTxRing->Cell[index].AllocVa = RingBaseVa;
-				RTMP_SetPhysicalAddressHigh(pTxRing->Cell[index].AllocPa, RingBasePaHigh);
-				RTMP_SetPhysicalAddressLow (pTxRing->Cell[index].AllocPa, RingBasePaLow);
-
-				// Setup Tx Buffer size & address. only 802.11 header will store in this space
-				pDmaBuf = &pTxRing->Cell[index].DmaBuf;
-				pDmaBuf->AllocSize = TX_DMA_1ST_BUFFER_SIZE;
-				pDmaBuf->AllocVa = BufBaseVa;
-				RTMP_SetPhysicalAddressHigh(pDmaBuf->AllocPa, BufBasePaHigh);
-				RTMP_SetPhysicalAddressLow(pDmaBuf->AllocPa, BufBasePaLow);
-
-				// link the pre-allocated TxBuf to TXD
-				pTxD = (PTXD_STRUC) pTxRing->Cell[index].AllocVa;
-				pTxD->SDPtr0 = BufBasePaLow;
-				// advance to next ring descriptor address
-				pTxD->DMADONE = 1;
-#ifdef RT_BIG_ENDIAN
-				RTMPDescriptorEndianChange((PUCHAR)pTxD, TYPE_TXD);
-#endif
-				RingBasePaLow += TXD_SIZE;
-				RingBaseVa = (PUCHAR) RingBaseVa + TXD_SIZE;
-
-				// advance to next TxBuf address
-				BufBasePaLow += TX_DMA_1ST_BUFFER_SIZE;
-				BufBaseVa = (PUCHAR) BufBaseVa + TX_DMA_1ST_BUFFER_SIZE;
-			}
-			DBGPRINT(RT_DEBUG_TRACE, ("TxRing[%d]: total %d entry allocated\n", num, index));
-		}
-		if (Status == NDIS_STATUS_RESOURCES)
-			break;
-
-		//
-		// Allocate MGMT ring descriptor's memory except Tx ring which allocated eariler
-		//
-		pAd->MgmtDescRing.AllocSize = MGMT_RING_SIZE * TXD_SIZE;
-		RTMP_AllocateMgmtDescMemory(
-			pAd,
-			pAd->MgmtDescRing.AllocSize,
-			FALSE,
-			&pAd->MgmtDescRing.AllocVa,
-			&pAd->MgmtDescRing.AllocPa);
-
-		if (pAd->MgmtDescRing.AllocVa == NULL)
-		{
-			ErrorValue = ERRLOG_OUT_OF_SHARED_MEMORY;
-			DBGPRINT_ERR(("Failed to allocate a big buffer\n"));
-			Status = NDIS_STATUS_RESOURCES;
-			break;
-		}
-
-		// Zero init this memory block
-		NdisZeroMemory(pAd->MgmtDescRing.AllocVa, pAd->MgmtDescRing.AllocSize);
-
-		// Save PA & VA for further operation
-		RingBasePaHigh = RTMP_GetPhysicalAddressHigh(pAd->MgmtDescRing.AllocPa);
-		RingBasePaLow  = RTMP_GetPhysicalAddressLow (pAd->MgmtDescRing.AllocPa);
-		RingBaseVa     = pAd->MgmtDescRing.AllocVa;
-
-		//
-		// Initialize MGMT Ring and associated buffer memory
-		//
-		for (index = 0; index < MGMT_RING_SIZE; index++)
-		{
-			pAd->MgmtRing.Cell[index].pNdisPacket = NULL;
-			pAd->MgmtRing.Cell[index].pNextNdisPacket = NULL;
-			// Init MGMT Ring Size, Va, Pa variables
-			pAd->MgmtRing.Cell[index].AllocSize = TXD_SIZE;
-			pAd->MgmtRing.Cell[index].AllocVa = RingBaseVa;
-			RTMP_SetPhysicalAddressHigh(pAd->MgmtRing.Cell[index].AllocPa, RingBasePaHigh);
-			RTMP_SetPhysicalAddressLow (pAd->MgmtRing.Cell[index].AllocPa, RingBasePaLow);
-
-			// Offset to next ring descriptor address
-			RingBasePaLow += TXD_SIZE;
-			RingBaseVa = (PUCHAR) RingBaseVa + TXD_SIZE;
-
-			// link the pre-allocated TxBuf to TXD
-			pTxD = (PTXD_STRUC) pAd->MgmtRing.Cell[index].AllocVa;
-			pTxD->DMADONE = 1;
-
-#ifdef RT_BIG_ENDIAN
-			RTMPDescriptorEndianChange((PUCHAR)pTxD, TYPE_TXD);
-#endif
-			// no pre-allocated buffer required in MgmtRing for scatter-gather case
-		}
-		DBGPRINT(RT_DEBUG_TRACE, ("MGMT Ring: total %d entry allocated\n", index));
-
-		//
-		// Allocate RX ring descriptor's memory except Tx ring which allocated eariler
-		//
-		pAd->RxDescRing.AllocSize = RX_RING_SIZE * RXD_SIZE;
-		RTMP_AllocateRxDescMemory(
-			pAd,
-			pAd->RxDescRing.AllocSize,
-			FALSE,
-			&pAd->RxDescRing.AllocVa,
-			&pAd->RxDescRing.AllocPa);
-
-		if (pAd->RxDescRing.AllocVa == NULL)
-		{
-			ErrorValue = ERRLOG_OUT_OF_SHARED_MEMORY;
-			DBGPRINT_ERR(("Failed to allocate a big buffer\n"));
-			Status = NDIS_STATUS_RESOURCES;
-			break;
-		}
-
-		// Zero init this memory block
-		NdisZeroMemory(pAd->RxDescRing.AllocVa, pAd->RxDescRing.AllocSize);
-
-
-		DBGPRINT(RT_DEBUG_OFF,
-					("RX DESC %p  size = %ld\n", pAd->RxDescRing.AllocVa, pAd->RxDescRing.AllocSize));
-
-		// Save PA & VA for further operation
-		RingBasePaHigh = RTMP_GetPhysicalAddressHigh(pAd->RxDescRing.AllocPa);
-		RingBasePaLow  = RTMP_GetPhysicalAddressLow (pAd->RxDescRing.AllocPa);
-		RingBaseVa     = pAd->RxDescRing.AllocVa;
-
-		//
-		// Initialize Rx Ring and associated buffer memory
-		//
-		for (index = 0; index < RX_RING_SIZE; index++)
-		{
-			// Init RX Ring Size, Va, Pa variables
-			pAd->RxRing.Cell[index].AllocSize = RXD_SIZE;
-			pAd->RxRing.Cell[index].AllocVa = RingBaseVa;
-			RTMP_SetPhysicalAddressHigh(pAd->RxRing.Cell[index].AllocPa, RingBasePaHigh);
-			RTMP_SetPhysicalAddressLow (pAd->RxRing.Cell[index].AllocPa, RingBasePaLow);
-
-			//NdisZeroMemory(RingBaseVa, RXD_SIZE);
-
-			// Offset to next ring descriptor address
-			RingBasePaLow += RXD_SIZE;
-			RingBaseVa = (PUCHAR) RingBaseVa + RXD_SIZE;
-
-			// Setup Rx associated Buffer size & allocate share memory
-			pDmaBuf = &pAd->RxRing.Cell[index].DmaBuf;
-			pDmaBuf->AllocSize = RX_BUFFER_AGGRESIZE;
-			pPacket = RTMP_AllocateRxPacketBuffer(
-				pAd,
-				pDmaBuf->AllocSize,
-				FALSE,
-				&pDmaBuf->AllocVa,
-				&pDmaBuf->AllocPa);
-
-			/* keep allocated rx packet */
-			pAd->RxRing.Cell[index].pNdisPacket = pPacket;
-
-			// Error handling
-			if (pDmaBuf->AllocVa == NULL)
-			{
-				ErrorValue = ERRLOG_OUT_OF_SHARED_MEMORY;
-				DBGPRINT_ERR(("Failed to allocate RxRing's 1st buffer\n"));
-				Status = NDIS_STATUS_RESOURCES;
-				break;
-			}
-
-			// Zero init this memory block
-			NdisZeroMemory(pDmaBuf->AllocVa, pDmaBuf->AllocSize);
-
-			// Write RxD buffer address & allocated buffer length
-			pRxD = (PRXD_STRUC) pAd->RxRing.Cell[index].AllocVa;
-			pRxD->SDP0 = RTMP_GetPhysicalAddressLow(pDmaBuf->AllocPa);
-			pRxD->DDONE = 0;
-
-#ifdef RT_BIG_ENDIAN
-			RTMPDescriptorEndianChange((PUCHAR)pRxD, TYPE_RXD);
-#endif
-		}
-
-		DBGPRINT(RT_DEBUG_TRACE, ("Rx Ring: total %d entry allocated\n", index));
-
-	}	while (FALSE);
-
-
-	NdisZeroMemory(&pAd->FragFrame, sizeof(FRAGMENT_FRAME));
-	pAd->FragFrame.pFragPacket =  RTMP_AllocateFragPacketBuffer(pAd, RX_BUFFER_NORMSIZE);
-
-	if (pAd->FragFrame.pFragPacket == NULL)
-	{
-		Status = NDIS_STATUS_RESOURCES;
-	}
-
-	if (Status != NDIS_STATUS_SUCCESS)
-	{
-		// Log error inforamtion
-		NdisWriteErrorLogEntry(
-			pAd->AdapterHandle,
-			NDIS_ERROR_CODE_OUT_OF_RESOURCES,
-			1,
-			ErrorValue);
-	}
-
-	// Following code segment get from original func:NICInitTxRxRingAndBacklogQueue(), now should integrate it to here.
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("--> NICInitTxRxRingAndBacklogQueue\n"));
-
-/*
-		// Disable DMA.
-		RTMP_IO_READ32(pAd, WPDMA_GLO_CFG, &GloCfg.word);
-		GloCfg.word &= 0xff0;
-		GloCfg.field.EnTXWriteBackDDONE =1;
-		RTMP_IO_WRITE32(pAd, WPDMA_GLO_CFG, GloCfg.word);
-*/
-
-		// Initialize all transmit related software queues
-		for(index = 0; index < NUM_OF_TX_RING; index++)
-		{
-			InitializeQueueHeader(&pAd->TxSwQueue[index]);
-			// Init TX rings index pointer
-			pAd->TxRing[index].TxSwFreeIdx = 0;
-			pAd->TxRing[index].TxCpuIdx = 0;
-			//RTMP_IO_WRITE32(pAd, (TX_CTX_IDX0 + i * 0x10) ,  pAd->TxRing[i].TX_CTX_IDX);
-		}
-
-		// Init RX Ring index pointer
-		pAd->RxRing.RxSwReadIdx = 0;
-		pAd->RxRing.RxCpuIdx = RX_RING_SIZE - 1;
-		//RTMP_IO_WRITE32(pAd, RX_CRX_IDX, pAd->RxRing.RX_CRX_IDX0);
-
-
-		// init MGMT ring index pointer
-		pAd->MgmtRing.TxSwFreeIdx = 0;
-		pAd->MgmtRing.TxCpuIdx = 0;
-
-		pAd->PrivateInfo.TxRingFullCnt = 0;
-
-		DBGPRINT(RT_DEBUG_TRACE, ("<-- NICInitTxRxRingAndBacklogQueue\n"));
-	}
-
-	DBGPRINT_S(Status, ("<-- RTMPAllocTxRxRingMemory, Status=%x\n", Status));
-	return Status;
-}
-
-
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		Reset NIC Asics. Call after rest DMA. So reset TX_CTX_IDX to zero.
-
-	Arguments:
-		Adapter						Pointer to our adapter
-
-	Return Value:
-		None
-
-	IRQL = PASSIVE_LEVEL
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-		Reset NIC to initial state AS IS system boot up time.
-
-	========================================================================
-*/
-VOID	RTMPRingCleanUp(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			RingType)
-{
-	PTXD_STRUC		pTxD;
-	PRXD_STRUC		pRxD;
-	PQUEUE_ENTRY	pEntry;
-	PNDIS_PACKET	pPacket;
-	int				i;
-	PRTMP_TX_RING	pTxRing;
-	unsigned long	IrqFlags;
-	//UINT32			RxSwReadIdx;
-
-
-	DBGPRINT(RT_DEBUG_TRACE,("RTMPRingCleanUp(RingIdx=%d, Pending-NDIS=%ld)\n", RingType, pAd->RalinkCounters.PendingNdisPacketCount));
-	switch (RingType)
-	{
-		case QID_AC_BK:
-		case QID_AC_BE:
-		case QID_AC_VI:
-		case QID_AC_VO:
-		/*case QID_HCCA:*/
-
-			pTxRing = &pAd->TxRing[RingType];
-
-			RTMP_IRQ_LOCK(&pAd->irq_lock, IrqFlags);
-			// We have to clean all descriptors in case some error happened with reset
-			for (i=0; i<TX_RING_SIZE; i++) // We have to scan all TX ring
-			{
-				pTxD  = (PTXD_STRUC) pTxRing->Cell[i].AllocVa;
-
-				pPacket = (PNDIS_PACKET) pTxRing->Cell[i].pNdisPacket;
-				// release scatter-and-gather NDIS_PACKET
-				if (pPacket)
-				{
-					RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_FAILURE);
-					pTxRing->Cell[i].pNdisPacket = NULL;
-				}
-
-				pPacket = (PNDIS_PACKET) pTxRing->Cell[i].pNextNdisPacket;
-				// release scatter-and-gather NDIS_PACKET
-				if (pPacket)
-				{
-					RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_FAILURE);
-					pTxRing->Cell[i].pNextNdisPacket = NULL;
-				}
-			}
-
-			RTMP_IO_READ32(pAd, TX_DTX_IDX0 + RingType * 0x10, &pTxRing->TxDmaIdx);
-			pTxRing->TxSwFreeIdx = pTxRing->TxDmaIdx;
-			pTxRing->TxCpuIdx = pTxRing->TxDmaIdx;
-			RTMP_IO_WRITE32(pAd, TX_CTX_IDX0 + RingType * 0x10, pTxRing->TxCpuIdx);
-
-			RTMP_IRQ_UNLOCK(&pAd->irq_lock, IrqFlags);
-
-			RTMP_IRQ_LOCK(&pAd->irq_lock, IrqFlags);
-			while (pAd->TxSwQueue[RingType].Head != NULL)
-			{
-				pEntry = RemoveHeadQueue(&pAd->TxSwQueue[RingType]);
-				pPacket = QUEUE_ENTRY_TO_PACKET(pEntry);
-				RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_FAILURE);
-				DBGPRINT(RT_DEBUG_TRACE,("Release 1 NDIS packet from s/w backlog queue\n"));
-			}
-			RTMP_IRQ_UNLOCK(&pAd->irq_lock, IrqFlags);
-			break;
-
-		case QID_MGMT:
-			// We have to clean all descriptors in case some error happened with reset
-			NdisAcquireSpinLock(&pAd->MgmtRingLock);
-
-			for (i=0; i<MGMT_RING_SIZE; i++)
-			{
-				pTxD  = (PTXD_STRUC) pAd->MgmtRing.Cell[i].AllocVa;
-
-				pPacket = (PNDIS_PACKET) pAd->MgmtRing.Cell[i].pNdisPacket;
-				// rlease scatter-and-gather NDIS_PACKET
-				if (pPacket)
-				{
-					PCI_UNMAP_SINGLE(pAd, pTxD->SDPtr0, pTxD->SDLen0, PCI_DMA_TODEVICE);
-					RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_FAILURE);
-				}
-				pAd->MgmtRing.Cell[i].pNdisPacket = NULL;
-
-				pPacket = (PNDIS_PACKET) pAd->MgmtRing.Cell[i].pNextNdisPacket;
-				// release scatter-and-gather NDIS_PACKET
-				if (pPacket)
-				{
-					PCI_UNMAP_SINGLE(pAd, pTxD->SDPtr1, pTxD->SDLen1, PCI_DMA_TODEVICE);
-					RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_FAILURE);
-			}
-				pAd->MgmtRing.Cell[i].pNextNdisPacket = NULL;
-
-			}
-
-			RTMP_IO_READ32(pAd, TX_MGMTDTX_IDX, &pAd->MgmtRing.TxDmaIdx);
-			pAd->MgmtRing.TxSwFreeIdx = pAd->MgmtRing.TxDmaIdx;
-			pAd->MgmtRing.TxCpuIdx = pAd->MgmtRing.TxDmaIdx;
-			RTMP_IO_WRITE32(pAd, TX_MGMTCTX_IDX, pAd->MgmtRing.TxCpuIdx);
-
-			NdisReleaseSpinLock(&pAd->MgmtRingLock);
-			pAd->RalinkCounters.MgmtRingFullCount = 0;
-			break;
-
-		case QID_RX:
-			// We have to clean all descriptors in case some error happened with reset
-			NdisAcquireSpinLock(&pAd->RxRingLock);
-
-			for (i=0; i<RX_RING_SIZE; i++)
-			{
-				pRxD  = (PRXD_STRUC) pAd->RxRing.Cell[i].AllocVa;
-                pRxD->DDONE = 0 ;
-			}
-
-			RTMP_IO_READ32(pAd, RX_DRX_IDX, &pAd->RxRing.RxDmaIdx);
-			pAd->RxRing.RxSwReadIdx = pAd->RxRing.RxDmaIdx;
-			pAd->RxRing.RxCpuIdx = ((pAd->RxRing.RxDmaIdx == 0) ? (RX_RING_SIZE-1) : (pAd->RxRing.RxDmaIdx-1));
-			RTMP_IO_WRITE32(pAd, RX_CRX_IDX, pAd->RxRing.RxCpuIdx);
-
-			NdisReleaseSpinLock(&pAd->RxRingLock);
-			break;
-
-		default:
-			break;
-	}
-}
-
-
-VOID RTMPFreeTxRxRingMemory(
-    IN  PRTMP_ADAPTER   pAd)
-{
-	int index, num , j;
-	PRTMP_TX_RING pTxRing;
-	PTXD_STRUC	  pTxD;
-	PNDIS_PACKET  pPacket;
-	unsigned int  IrqFlags;
-
-	//POS_COOKIE pObj =(POS_COOKIE) pAd->OS_Cookie;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("--> RTMPFreeTxRxRingMemory\n"));
-
-	// Free TxSwQueue Packet
-	for (index=0; index <NUM_OF_TX_RING; index++)
-	{
-		PQUEUE_ENTRY pEntry;
-		PNDIS_PACKET pPacket;
-		PQUEUE_HEADER   pQueue;
-
-		RTMP_IRQ_LOCK(&pAd->irq_lock, IrqFlags);
-		pQueue = &pAd->TxSwQueue[index];
-		while (pQueue->Head)
-		{
-			pEntry = RemoveHeadQueue(pQueue);
-			pPacket = QUEUE_ENTRY_TO_PACKET(pEntry);
-			RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_FAILURE);
-		}
-		RTMP_IRQ_UNLOCK(&pAd->irq_lock, IrqFlags);
-	}
-
-	// Free Tx Ring Packet
-	for (index=0;index< NUM_OF_TX_RING;index++)
-	{
-		pTxRing = &pAd->TxRing[index];
-
-		for (j=0; j< TX_RING_SIZE; j++)
-		{
-			pTxD = (PTXD_STRUC) (pTxRing->Cell[j].AllocVa);
-			pPacket = pTxRing->Cell[j].pNdisPacket;
-
-			if (pPacket)
-			{
-				PCI_UNMAP_SINGLE(pAd, pTxD->SDPtr0, pTxD->SDLen0, PCI_DMA_TODEVICE);
-				RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_SUCCESS);
-			}
-			//Always assign pNdisPacket as NULL after clear
-			pTxRing->Cell[j].pNdisPacket = NULL;
-
-			pPacket = pTxRing->Cell[j].pNextNdisPacket;
-
-			if (pPacket)
-			{
-				PCI_UNMAP_SINGLE(pAd, pTxD->SDPtr1, pTxD->SDLen1, PCI_DMA_TODEVICE);
-				RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_SUCCESS);
-			}
-			//Always assign pNextNdisPacket as NULL after clear
-			pTxRing->Cell[pTxRing->TxSwFreeIdx].pNextNdisPacket = NULL;
-
-		}
-	}
-
-	for (index = RX_RING_SIZE - 1 ; index >= 0; index--)
-	{
-		if ((pAd->RxRing.Cell[index].DmaBuf.AllocVa) && (pAd->RxRing.Cell[index].pNdisPacket))
-		{
-			PCI_UNMAP_SINGLE(pAd, pAd->RxRing.Cell[index].DmaBuf.AllocPa, pAd->RxRing.Cell[index].DmaBuf.AllocSize, PCI_DMA_FROMDEVICE);
-			RELEASE_NDIS_PACKET(pAd, pAd->RxRing.Cell[index].pNdisPacket, NDIS_STATUS_SUCCESS);
-		}
-	}
-	NdisZeroMemory(pAd->RxRing.Cell, RX_RING_SIZE * sizeof(RTMP_DMACB));
-
-	if (pAd->RxDescRing.AllocVa)
-    {
-		RTMP_FreeDescMemory(pAd, pAd->RxDescRing.AllocSize, pAd->RxDescRing.AllocVa, pAd->RxDescRing.AllocPa);
-    }
-    NdisZeroMemory(&pAd->RxDescRing, sizeof(RTMP_DMABUF));
-
-	if (pAd->MgmtDescRing.AllocVa)
-	{
-		RTMP_FreeDescMemory(pAd, pAd->MgmtDescRing.AllocSize, pAd->MgmtDescRing.AllocVa, pAd->MgmtDescRing.AllocPa);
-	}
-	NdisZeroMemory(&pAd->MgmtDescRing, sizeof(RTMP_DMABUF));
-
-	for (num = 0; num < NUM_OF_TX_RING; num++)
-	{
-	if (pAd->TxBufSpace[num].AllocVa)
-		{
-			RTMP_FreeFirstTxBuffer(pAd, pAd->TxBufSpace[num].AllocSize, FALSE, pAd->TxBufSpace[num].AllocVa, pAd->TxBufSpace[num].AllocPa);
-	    }
-	    NdisZeroMemory(&pAd->TxBufSpace[num], sizeof(RTMP_DMABUF));
-
-	if (pAd->TxDescRing[num].AllocVa)
-		{
-			RTMP_FreeDescMemory(pAd, pAd->TxDescRing[num].AllocSize, pAd->TxDescRing[num].AllocVa, pAd->TxDescRing[num].AllocPa);
-	    }
-	    NdisZeroMemory(&pAd->TxDescRing[num], sizeof(RTMP_DMABUF));
-	}
-
-	if (pAd->FragFrame.pFragPacket)
-		RELEASE_NDIS_PACKET(pAd, pAd->FragFrame.pFragPacket, NDIS_STATUS_SUCCESS);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("<-- RTMPFreeTxRxRingMemory\n"));
-}
-
-
-/***************************************************************************
-  *
-  *	register related procedures.
-  *
-  **************************************************************************/
-/*
-========================================================================
-Routine Description:
-    Disable DMA.
-
-Arguments:
-	*pAd				the raxx interface data pointer
-
-Return Value:
-	None
-
-Note:
-========================================================================
-*/
-VOID RT28XXDMADisable(
-	IN RTMP_ADAPTER			*pAd)
-{
-	WPDMA_GLO_CFG_STRUC     GloCfg;
-
-
-	RTMP_IO_READ32(pAd, WPDMA_GLO_CFG, &GloCfg.word);
-	GloCfg.word &= 0xff0;
-	GloCfg.field.EnTXWriteBackDDONE =1;
-	RTMP_IO_WRITE32(pAd, WPDMA_GLO_CFG, GloCfg.word);
-}
-
-
-/*
-========================================================================
-Routine Description:
-    Enable DMA.
-
-Arguments:
-	*pAd				the raxx interface data pointer
-
-Return Value:
-	None
-
-Note:
-========================================================================
-*/
-VOID RT28XXDMAEnable(
-	IN RTMP_ADAPTER			*pAd)
-{
-	WPDMA_GLO_CFG_STRUC	GloCfg;
-	int i = 0;
-
-	RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, 0x4);
-	do
-	{
-		RTMP_IO_READ32(pAd, WPDMA_GLO_CFG, &GloCfg.word);
-		if ((GloCfg.field.TxDMABusy == 0)  && (GloCfg.field.RxDMABusy == 0))
-			break;
-
-		DBGPRINT(RT_DEBUG_TRACE, ("==>  DMABusy\n"));
-		RTMPusecDelay(1000);
-		i++;
-	}while ( i <200);
-
-	RTMPusecDelay(50);
-
-	GloCfg.field.EnTXWriteBackDDONE = 1;
-	GloCfg.field.WPDMABurstSIZE = 2;
-	GloCfg.field.EnableRxDMA = 1;
-	GloCfg.field.EnableTxDMA = 1;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("<== WRITE DMA offset 0x208 = 0x%x\n", GloCfg.word));
-	RTMP_IO_WRITE32(pAd, WPDMA_GLO_CFG, GloCfg.word);
-
-}
-
-
-BOOLEAN AsicCheckCommanOk(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR		 Command)
-{
-	UINT32	CmdStatus = 0, CID = 0, i;
-	UINT32	ThisCIDMask = 0;
-
-	i = 0;
-	do
-	{
-		RTMP_IO_READ32(pAd, H2M_MAILBOX_CID, &CID);
-		// Find where the command is. Because this is randomly specified by firmware.
-		if ((CID & CID0MASK) == Command)
-		{
-			ThisCIDMask = CID0MASK;
-			break;
-		}
-		else if ((((CID & CID1MASK)>>8) & 0xff) == Command)
-		{
-			ThisCIDMask = CID1MASK;
-			break;
-		}
-		else if ((((CID & CID2MASK)>>16) & 0xff) == Command)
-		{
-			ThisCIDMask = CID2MASK;
-			break;
-		}
-		else if ((((CID & CID3MASK)>>24) & 0xff) == Command)
-		{
-			ThisCIDMask = CID3MASK;
-			break;
-		}
-
-		RTMPusecDelay(100);
-		i++;
-	}while (i < 200);
-
-	// Get CommandStatus Value
-	RTMP_IO_READ32(pAd, H2M_MAILBOX_STATUS, &CmdStatus);
-
-	// This command's status is at the same position as command. So AND command position's bitmask to read status.
-	if (i < 200)
-	{
-		// If Status is 1, the comamnd is success.
-		if (((CmdStatus & ThisCIDMask) == 0x1) || ((CmdStatus & ThisCIDMask) == 0x100)
-			|| ((CmdStatus & ThisCIDMask) == 0x10000) || ((CmdStatus & ThisCIDMask) == 0x1000000))
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("--> AsicCheckCommanOk CID = 0x%x, CmdStatus= 0x%x \n", CID, CmdStatus));
-			RTMP_IO_WRITE32(pAd, H2M_MAILBOX_STATUS, 0xffffffff);
-			RTMP_IO_WRITE32(pAd, H2M_MAILBOX_CID, 0xffffffff);
-			return TRUE;
-		}
-		DBGPRINT(RT_DEBUG_TRACE, ("--> AsicCheckCommanFail1 CID = 0x%x, CmdStatus= 0x%x \n", CID, CmdStatus));
-	}
-	else
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("--> AsicCheckCommanFail2 Timeout Command = %d, CmdStatus= 0x%x \n", Command, CmdStatus));
-	}
-	// Clear Command and Status.
-	RTMP_IO_WRITE32(pAd, H2M_MAILBOX_STATUS, 0xffffffff);
-	RTMP_IO_WRITE32(pAd, H2M_MAILBOX_CID, 0xffffffff);
-
-	return FALSE;
-}
-
-
-/*
-========================================================================
-Routine Description:
-    Write Beacon buffer to Asic.
-
-Arguments:
-	*pAd				the raxx interface data pointer
-
-Return Value:
-	None
-
-Note:
-========================================================================
-*/
-VOID RT28xx_UpdateBeaconToAsic(
-	IN RTMP_ADAPTER		*pAd,
-	IN INT				apidx,
-	IN ULONG			FrameLen,
-	IN ULONG			UpdatePos)
-{
-	ULONG				CapInfoPos = 0;
-	UCHAR			*ptr, *ptr_update, *ptr_capinfo;
-	UINT			i;
-	BOOLEAN			bBcnReq = FALSE;
-	UCHAR			bcn_idx = 0;
-
-
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("%s() : No valid Interface be found.\n", __FUNCTION__));
-		return;
-	}
-
-	//if ((pAd->WdsTab.Mode == WDS_BRIDGE_MODE)
-	//	|| ((pAd->ApCfg.MBSSID[apidx].MSSIDDev == NULL)
-	//		|| !(pAd->ApCfg.MBSSID[apidx].MSSIDDev->flags & IFF_UP))
-	//	)
-	if (bBcnReq == FALSE)
-	{
-		/* when the ra interface is down, do not send its beacon frame */
-		/* clear all zero */
-		for(i=0; i<TXWI_SIZE; i+=4)
-			RTMP_IO_WRITE32(pAd, pAd->BeaconOffset[bcn_idx] + i, 0x00);
-	}
-	else
-	{
-		ptr = (PUCHAR)&pAd->BeaconTxWI;
-#ifdef RT_BIG_ENDIAN
-		RTMPWIEndianChange(ptr, TYPE_TXWI);
-#endif
-		for (i=0; i<TXWI_SIZE; i+=4)  // 16-byte TXWI field
-		{
-			UINT32 longptr =  *ptr + (*(ptr+1)<<8) + (*(ptr+2)<<16) + (*(ptr+3)<<24);
-			RTMP_IO_WRITE32(pAd, pAd->BeaconOffset[bcn_idx] + i, longptr);
-			ptr += 4;
-		}
-
-		// Update CapabilityInfo in Beacon
-		for (i = CapInfoPos; i < (CapInfoPos+2); i++)
-		{
-			RTMP_IO_WRITE8(pAd, pAd->BeaconOffset[bcn_idx] + TXWI_SIZE + i, *ptr_capinfo);
-			ptr_capinfo ++;
-		}
-
-		if (FrameLen > UpdatePos)
-		{
-			for (i= UpdatePos; i< (FrameLen); i++)
-			{
-				RTMP_IO_WRITE8(pAd, pAd->BeaconOffset[bcn_idx] + TXWI_SIZE + i, *ptr_update);
-				ptr_update ++;
-			}
-		}
-
-	}
-
-}
-
-
-#ifdef CONFIG_STA_SUPPORT
-VOID RT28xxPciStaAsicForceWakeup(
-	IN PRTMP_ADAPTER pAd,
-	IN BOOLEAN       bFromTx)
-{
-    AUTO_WAKEUP_STRUC	AutoWakeupCfg;
-
-    if (!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE))
-        return;
-
-    if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_WAKEUP_NOW))
-    {
-        DBGPRINT(RT_DEBUG_TRACE, ("waking up now!\n"));
-        return;
-    }
-
-    OPSTATUS_SET_FLAG(pAd, fOP_STATUS_WAKEUP_NOW);
-
-    RTMP_CLEAR_PSFLAG(pAd, fRTMP_PS_GO_TO_SLEEP_NOW);
-
-    if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE)
-		&&pAd->StaCfg.PSControl.field.EnableNewPS == TRUE)
-    {
-        // Support PCIe Advance Power Save
-	if (bFromTx == TRUE
-			&&(pAd->Mlme.bPsPollTimerRunning == TRUE))
-	{
-            pAd->Mlme.bPsPollTimerRunning = FALSE;
-		RTMPPCIeLinkCtrlValueRestore(pAd, RESTORE_WAKEUP);
-		RTMPusecDelay(3000);
-            DBGPRINT(RT_DEBUG_TRACE, ("=======AsicForceWakeup===bFromTx\n"));
-	}
-
-		AutoWakeupCfg.word = 0;
-		RTMP_IO_WRITE32(pAd, AUTO_WAKEUP_CFG, AutoWakeupCfg.word);
-
-        if (RT28xxPciAsicRadioOn(pAd, DOT11POWERSAVE))
-        {
-#ifdef PCIE_PS_SUPPORT
-			// add by johnli, RF power sequence setup, load RF normal operation-mode setup
-			if ((IS_RT3090(pAd) || IS_RT3572(pAd) || IS_RT3390(pAd)) && IS_VERSION_AFTER_F(pAd))
-			{
-				RTMP_CHIP_OP *pChipOps = &pAd->chipOps;
-
-				if (pChipOps->AsicReverseRfFromSleepMode)
-					pChipOps->AsicReverseRfFromSleepMode(pAd);
-			}
-			else
-#endif // PCIE_PS_SUPPORT //
-			{
-			// end johnli
-				// In Radio Off, we turn off RF clk, So now need to call ASICSwitchChannel again.
-				if (INFRA_ON(pAd) && (pAd->CommonCfg.CentralChannel != pAd->CommonCfg.Channel)
-					&& (pAd->MlmeAux.HtCapability.HtCapInfo.ChannelWidth == BW_40))
-				{
-					// Must using 40MHz.
-					AsicSwitchChannel(pAd, pAd->CommonCfg.CentralChannel, FALSE);
-					AsicLockChannel(pAd, pAd->CommonCfg.CentralChannel);
-				}
-				else
-				{
-					// Must using 20MHz.
-					AsicSwitchChannel(pAd, pAd->CommonCfg.Channel, FALSE);
-					AsicLockChannel(pAd, pAd->CommonCfg.Channel);
-				}
-			}
-        }
-#ifdef PCIE_PS_SUPPORT
-		// 3090 MCU Wakeup command needs more time to be stable.
-		// Before stable, don't issue other MCU command to prevent from firmware error.
-		if (((IS_RT3090(pAd) || IS_RT3572(pAd) || IS_RT3390(pAd)) && IS_VERSION_AFTER_F(pAd)) && IS_VERSION_AFTER_F(pAd)
-			&& (pAd->StaCfg.PSControl.field.rt30xxPowerMode == 3)
-			&& (pAd->StaCfg.PSControl.field.EnableNewPS == TRUE))
-			{
-			DBGPRINT(RT_DEBUG_TRACE, ("<==RT28xxPciStaAsicForceWakeup::Release the MCU Lock(3090)\n"));
-			RTMP_SEM_LOCK(&pAd->McuCmdLock);
-			pAd->brt30xxBanMcuCmd = FALSE;
-			RTMP_SEM_UNLOCK(&pAd->McuCmdLock);
-			}
-#endif // PCIE_PS_SUPPORT //
-    }
-    else
-    {
-        // PCI, 2860-PCIe
-         DBGPRINT(RT_DEBUG_TRACE, ("<==RT28xxPciStaAsicForceWakeup::Original PCI Power Saving\n"));
-        AsicSendCommandToMcu(pAd, 0x31, 0xff, 0x00, 0x02);
-        AutoWakeupCfg.word = 0;
-	    RTMP_IO_WRITE32(pAd, AUTO_WAKEUP_CFG, AutoWakeupCfg.word);
-    }
-
-    OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_DOZE);
-    OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_WAKEUP_NOW);
-    DBGPRINT(RT_DEBUG_TRACE, ("<=======RT28xxPciStaAsicForceWakeup\n"));
-}
-
-
-VOID RT28xxPciStaAsicSleepThenAutoWakeup(
-	IN PRTMP_ADAPTER pAd,
-	IN USHORT TbttNumToNextWakeUp)
-{
-	BOOLEAN brc;
-
-	if (pAd->StaCfg.bRadio == FALSE)
-	{
-		OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_DOZE);
-		return;
-	}
-	if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE)
-		&&pAd->StaCfg.PSControl.field.EnableNewPS == TRUE)
-	{
-		ULONG	Now = 0;
-		if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_WAKEUP_NOW))
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("waking up now!\n"));
-			OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_DOZE);
-			return;
-		}
-
-		NdisGetSystemUpTime(&Now);
-		// If last send NULL fram time is too close to this receiving beacon (within 8ms), don't go to sleep for this DTM.
-		// Because Some AP can't queuing outgoing frames immediately.
-		if (((pAd->Mlme.LastSendNULLpsmTime + 8) >= Now) && (pAd->Mlme.LastSendNULLpsmTime <= Now))
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("Now = %lu, LastSendNULLpsmTime=%lu :  RxCountSinceLastNULL = %lu. \n", Now, pAd->Mlme.LastSendNULLpsmTime, pAd->RalinkCounters.RxCountSinceLastNULL));
-			return;
-		}
-		else if ((pAd->RalinkCounters.RxCountSinceLastNULL > 0) && ((pAd->Mlme.LastSendNULLpsmTime + pAd->CommonCfg.BeaconPeriod) >= Now))
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("Now = %lu, LastSendNULLpsmTime=%lu: RxCountSinceLastNULL = %lu > 0 \n", Now, pAd->Mlme.LastSendNULLpsmTime,  pAd->RalinkCounters.RxCountSinceLastNULL));
-			return;
-		}
-
-		brc = RT28xxPciAsicRadioOff(pAd, DOT11POWERSAVE, TbttNumToNextWakeUp);
-		if (brc==TRUE)
-			OPSTATUS_SET_FLAG(pAd, fOP_STATUS_DOZE);
-	}
-	else
-	{
-		AUTO_WAKEUP_STRUC	AutoWakeupCfg;
-		// we have decided to SLEEP, so at least do it for a BEACON period.
-		if (TbttNumToNextWakeUp == 0)
-			TbttNumToNextWakeUp = 1;
-
-		//RTMP_IO_WRITE32(pAd, INT_MASK_CSR, AutoWakeupInt);
-
-		AutoWakeupCfg.word = 0;
-		RTMP_IO_WRITE32(pAd, AUTO_WAKEUP_CFG, AutoWakeupCfg.word);
-		AutoWakeupCfg.field.NumofSleepingTbtt = TbttNumToNextWakeUp - 1;
-		AutoWakeupCfg.field.EnableAutoWakeup = 1;
-		AutoWakeupCfg.field.AutoLeadTime = 5;
-		RTMP_IO_WRITE32(pAd, AUTO_WAKEUP_CFG, AutoWakeupCfg.word);
-		AsicSendCommandToMcu(pAd, 0x30, 0xff, 0xff, 0x00);   // send POWER-SAVE command to MCU. Timeout 40us.
-		OPSTATUS_SET_FLAG(pAd, fOP_STATUS_DOZE);
-		DBGPRINT(RT_DEBUG_TRACE, ("<-- %s, TbttNumToNextWakeUp=%d \n", __FUNCTION__, TbttNumToNextWakeUp));
-	}
-
-}
-
-
-VOID PsPollWakeExec(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3)
-{
-	RTMP_ADAPTER *pAd = (RTMP_ADAPTER *)FunctionContext;
-	unsigned long flags;
-
-    DBGPRINT(RT_DEBUG_TRACE,("-->PsPollWakeExec \n"));
-
-	RTMP_INT_LOCK(&pAd->irq_lock, flags);
-    if (pAd->Mlme.bPsPollTimerRunning)
-    {
-	    RTMPPCIeLinkCtrlValueRestore(pAd, RESTORE_WAKEUP);
-    }
-    pAd->Mlme.bPsPollTimerRunning = FALSE;
-	RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
-#ifdef PCIE_PS_SUPPORT
-	// For rt30xx power solution 3, Use software timer to wake up in psm. So call
-	// AsicForceWakeup here instead of handling twakeup interrupt.
-	if (((IS_RT3090(pAd) || IS_RT3572(pAd) || IS_RT3390(pAd)) && IS_VERSION_AFTER_F(pAd))
-	&& (pAd->StaCfg.PSControl.field.rt30xxPowerMode == 3)
-	&& (pAd->StaCfg.PSControl.field.EnableNewPS == TRUE))
-	{
-		DBGPRINT(RT_DEBUG_TRACE,("<--PsPollWakeExec::3090 calls AsicForceWakeup(pAd, DOT11POWERSAVE) in advance \n"));
-		AsicForceWakeup(pAd, DOT11POWERSAVE);
-	}
-
-#endif // PCIE_PS_SUPPORT //
-}
-
-VOID  RadioOnExec(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3)
-{
-	RTMP_ADAPTER *pAd = (RTMP_ADAPTER *)FunctionContext;
-	RTMP_CHIP_OP *pChipOps = &pAd->chipOps;
-	WPDMA_GLO_CFG_STRUC	DmaCfg;
-	BOOLEAN				Cancelled;
-
-	if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE))
-	{
-		DBGPRINT(RT_DEBUG_TRACE,("-->RadioOnExec() return on fOP_STATUS_DOZE == TRUE; \n"));
-//KH Debug: Add the compile flag "RT2860 and condition
-#ifdef RTMP_PCI_SUPPORT
-		if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE)
-			&&pAd->StaCfg.PSControl.field.EnableNewPS == TRUE)
-		RTMPSetTimer(&pAd->Mlme.RadioOnOffTimer, 10);
-#endif // RTMP_PCI_SUPPORT //
-		return;
-	}
-
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS))
-	{
-		DBGPRINT(RT_DEBUG_TRACE,("-->RadioOnExec() return on SCAN_IN_PROGRESS; \n"));
-
-
-#ifdef RTMP_PCI_SUPPORT
-if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE)
-	&&pAd->StaCfg.PSControl.field.EnableNewPS == TRUE)
-		RTMPSetTimer(&pAd->Mlme.RadioOnOffTimer, 10);
-#endif // RTMP_PCI_SUPPORT //
-		return;
-	}
-//KH Debug: need to check. I add the compile flag "CONFIG_STA_SUPPORT" to enclose the following codes.
-#ifdef RTMP_PCI_SUPPORT
-if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE)
-	&&pAd->StaCfg.PSControl.field.EnableNewPS == TRUE)
-	{
-	pAd->Mlme.bPsPollTimerRunning = FALSE;
-	RTMPCancelTimer(&pAd->Mlme.PsPollTimer,	&Cancelled);
-	}
-#endif // RTMP_PCI_SUPPORT //
-	if (pAd->StaCfg.bRadio == TRUE)
-	{
-		pAd->bPCIclkOff = FALSE;
-		RTMPRingCleanUp(pAd, QID_AC_BK);
-		RTMPRingCleanUp(pAd, QID_AC_BE);
-		RTMPRingCleanUp(pAd, QID_AC_VI);
-		RTMPRingCleanUp(pAd, QID_AC_VO);
-		/*RTMPRingCleanUp(pAd, QID_HCCA);*/
-		RTMPRingCleanUp(pAd, QID_MGMT);
-		RTMPRingCleanUp(pAd, QID_RX);
-
-		// 2. Send wake up command.
-		AsicSendCommandToMcu(pAd, 0x31, PowerWakeCID, 0x00, 0x02);
-		// 2-1. wait command ok.
-		AsicCheckCommanOk(pAd, PowerWakeCID);
-
-		// When PCI clock is off, don't want to service interrupt. So when back to clock on, enable interrupt.
-		//RTMP_IO_WRITE32(pAd, INT_MASK_CSR, (DELAYINTMASK|RxINT));
-		RTMP_ASIC_INTERRUPT_ENABLE(pAd);
-
-		// 3. Enable Tx DMA.
-		RTMP_IO_READ32(pAd, WPDMA_GLO_CFG, &DmaCfg.word);
-		DmaCfg.field.EnableTxDMA = 1;
-		RTMP_IO_WRITE32(pAd, WPDMA_GLO_CFG, DmaCfg.word);
-
-		// In Radio Off, we turn off RF clk, So now need to call ASICSwitchChannel again.
-		if (INFRA_ON(pAd) && (pAd->CommonCfg.CentralChannel != pAd->CommonCfg.Channel)
-			&& (pAd->MlmeAux.HtCapability.HtCapInfo.ChannelWidth == BW_40))
-		{
-			// Must using 40MHz.
-			AsicSwitchChannel(pAd, pAd->CommonCfg.CentralChannel, FALSE);
-			AsicLockChannel(pAd, pAd->CommonCfg.CentralChannel);
-		}
-		else
-		{
-			// Must using 20MHz.
-			AsicSwitchChannel(pAd, pAd->CommonCfg.Channel, FALSE);
-			AsicLockChannel(pAd, pAd->CommonCfg.Channel);
-		}
-//KH Debug:The following codes should be enclosed by RT3090 compile flag
-		if (pChipOps->AsicReverseRfFromSleepMode)
-			pChipOps->AsicReverseRfFromSleepMode(pAd);
-#ifdef PCIE_PS_SUPPORT
-#ifdef CONFIG_STA_SUPPORT
-// 3090 MCU Wakeup command needs more time to be stable.
-// Before stable, don't issue other MCU command to prevent from firmware error.
-if ((IS_RT3090(pAd) || IS_RT3572(pAd) || IS_RT3390(pAd)) && IS_VERSION_AFTER_F(pAd)
-	&& (pAd->StaCfg.PSControl.field.rt30xxPowerMode == 3)
-	&& (pAd->StaCfg.PSControl.field.EnableNewPS == TRUE))
-	{
-	RTMP_SEM_LOCK(&pAd->McuCmdLock);
-	pAd->brt30xxBanMcuCmd = FALSE;
-	RTMP_SEM_UNLOCK(&pAd->McuCmdLock);
-	}
-#endif // CONFIG_STA_SUPPORT //
-#endif // PCIE_PS_SUPPORT //
-		// Clear Radio off flag
-		RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_RADIO_OFF);
-
-		// Set LED
-		RTMPSetLED(pAd, LED_RADIO_ON);
-
-        if (pAd->StaCfg.Psm == PWR_ACTIVE)
-        {
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R3, pAd->StaCfg.BBPR3);
-        }
-	}
-	else
-	{
-		RT28xxPciAsicRadioOff(pAd, GUIRADIO_OFF, 0);
-	}
-}
-#endif // CONFIG_STA_SUPPORT //
-
-
-/*
-	==========================================================================
-	Description:
-		This routine sends command to firmware and turn our chip to wake up mode from power save mode.
-		Both RadioOn and .11 power save function needs to call this routine.
-	Input:
-		Level = GUIRADIO_OFF : call this function is from Radio Off to Radio On.  Need to restore PCI host value.
-		Level = other value : normal wake up function.
-
-	==========================================================================
- */
-BOOLEAN RT28xxPciAsicRadioOn(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR     Level)
-{
-    //WPDMA_GLO_CFG_STRUC	DmaCfg;
-#ifdef CONFIG_STA_SUPPORT
-	BOOLEAN				Cancelled;
-#endif // CONFIG_STA_SUPPORT //
-    //UINT32			    MACValue;
-
-	if (pAd->OpMode == OPMODE_AP && Level==DOT11POWERSAVE)
-		return FALSE;
-
-#ifdef CONFIG_STA_SUPPORT
-	if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE))
-	{
-		if (pAd->StaCfg.PSControl.field.EnableNewPS == TRUE)
-		{
-	    pAd->Mlme.bPsPollTimerRunning = FALSE;
-		RTMPCancelTimer(&pAd->Mlme.PsPollTimer,	&Cancelled);
-		}
-		if ((pAd->StaCfg.PSControl.field.EnableNewPS == TRUE)&&
-		((Level == GUIRADIO_OFF) || (Level == GUI_IDLE_POWER_SAVE))
-		||(RTMP_TEST_PSFLAG(pAd, fRTMP_PS_SET_PCI_CLK_OFF_COMMAND)))
-		{
-			// Some chips don't need to delay 6ms, so copy RTMPPCIePowerLinkCtrlRestore
-			// return condition here.
-			/*
-			if (((pAd->MACVersion&0xffff0000) != 0x28600000)
-				&& ((pAd->DeviceID == NIC2860_PCIe_DEVICE_ID)
-				||(pAd->DeviceID == NIC2790_PCIe_DEVICE_ID)))
-			*/
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("RT28xxPciAsicRadioOn ()\n"));
-			// 1. Set PCI Link Control in Configuration Space.
-			RTMPPCIeLinkCtrlValueRestore(pAd, RESTORE_WAKEUP);
-			RTMPusecDelay(6000);
-		}
-	}
-	}
-
-#ifdef PCIE_PS_SUPPORT
-if (!(((IS_RT3090(pAd) || IS_RT3572(pAd) || IS_RT3390(pAd)) && IS_VERSION_AFTER_F(pAd)
-	&& (pAd->StaCfg.PSControl.field.rt30xxPowerMode == 3)
-	&& (pAd->StaCfg.PSControl.field.EnableNewPS == TRUE))))
-#endif // PCIE_PS_SUPPORT //
-	{
-    pAd->bPCIclkOff = FALSE;
-		DBGPRINT(RT_DEBUG_TRACE, ("PSM :309xbPCIclkOff == %d\n", pAd->bPCIclkOff));
-
-	}
-#endif // CONFIG_STA_SUPPORT //
-	// 2. Send wake up command.
-	AsicSendCommandToMcu(pAd, 0x31, PowerWakeCID, 0x00, 0x02);
-	pAd->bPCIclkOff = FALSE;
-	// 2-1. wait command ok.
-	AsicCheckCommanOk(pAd, PowerWakeCID);
-	RTMP_ASIC_INTERRUPT_ENABLE(pAd);
-
-
-	RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_IDLE_RADIO_OFF);
-	if (Level == GUI_IDLE_POWER_SAVE)
-	{
-#ifdef  PCIE_PS_SUPPORT
-
-			// add by johnli, RF power sequence setup, load RF normal operation-mode setup
-			if ((IS_RT3090(pAd) || IS_RT3572(pAd) || IS_RT3390(pAd)))
-			{
-				RTMP_CHIP_OP *pChipOps = &pAd->chipOps;
-
-				if (pChipOps->AsicReverseRfFromSleepMode)
-					pChipOps->AsicReverseRfFromSleepMode(pAd);
-#ifdef CONFIG_STA_SUPPORT
-				// 3090 MCU Wakeup command needs more time to be stable.
-				// Before stable, don't issue other MCU command to prevent from firmware error.
-				if ((IS_RT3090(pAd) || IS_RT3572(pAd) || IS_RT3390(pAd)) && IS_VERSION_AFTER_F(pAd)
-					&& (pAd->StaCfg.PSControl.field.rt30xxPowerMode == 3)
-					&& (pAd->StaCfg.PSControl.field.EnableNewPS == TRUE))
-					{
-						RTMP_SEM_LOCK(&pAd->McuCmdLock);
-						pAd->brt30xxBanMcuCmd = FALSE;
-						RTMP_SEM_UNLOCK(&pAd->McuCmdLock);
-					}
-#endif // CONFIG_STA_SUPPORT //
-			}
-			else
-			// end johnli
-#endif // PCIE_PS_SUPPORT //
-			{
-			// In Radio Off, we turn off RF clk, So now need to call ASICSwitchChannel again.
-#ifdef CONFIG_STA_SUPPORT
-			IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-				{
-				if (INFRA_ON(pAd) && (pAd->CommonCfg.CentralChannel != pAd->CommonCfg.Channel)
-					&& (pAd->MlmeAux.HtCapability.HtCapInfo.ChannelWidth == BW_40))
-				{
-					// Must using 40MHz.
-					AsicSwitchChannel(pAd, pAd->CommonCfg.CentralChannel, FALSE);
-					AsicLockChannel(pAd, pAd->CommonCfg.CentralChannel);
-				}
-				else
-				{
-					// Must using 20MHz.
-					AsicSwitchChannel(pAd, pAd->CommonCfg.Channel, FALSE);
-					AsicLockChannel(pAd, pAd->CommonCfg.Channel);
-				}
-				}
-#endif // CONFIG_STA_SUPPORT //
-			}
-	}
-        return TRUE;
-
-}
-
-
-/*
-	==========================================================================
-	Description:
-		This routine sends command to firmware and turn our chip to power save mode.
-		Both RadioOff and .11 power save function needs to call this routine.
-	Input:
-		Level = GUIRADIO_OFF  : GUI Radio Off mode
-		Level = DOT11POWERSAVE  : 802.11 power save mode
-		Level = RTMP_HALT  : When Disable device.
-
-	==========================================================================
- */
-BOOLEAN RT28xxPciAsicRadioOff(
-	IN PRTMP_ADAPTER    pAd,
-	IN UCHAR            Level,
-	IN USHORT           TbttNumToNextWakeUp)
-{
-#ifdef CONFIG_STA_SUPPORT
-	WPDMA_GLO_CFG_STRUC	DmaCfg;
-	UCHAR		i, tempBBP_R3 = 0;
-#endif // CONFIG_STA_SUPPORT //
-	BOOLEAN		brc = FALSE, Cancelled;
-    UINT32		TbTTTime = 0;
-	UINT32		PsPollTime = 0/*, MACValue*/;
-    ULONG		BeaconPeriodTime;
-    UINT32		RxDmaIdx, RxCpuIdx;
-	DBGPRINT(RT_DEBUG_TRACE, ("AsicRadioOff ===> Lv= %d, TxCpuIdx = %d, TxDmaIdx = %d. RxCpuIdx = %d, RxDmaIdx = %d.\n", Level,pAd->TxRing[0].TxCpuIdx, pAd->TxRing[0].TxDmaIdx, pAd->RxRing.RxCpuIdx, pAd->RxRing.RxDmaIdx));
-
-	if (pAd->OpMode == OPMODE_AP && Level==DOT11POWERSAVE)
-		return FALSE;
-
-    // Check Rx DMA busy status, if more than half is occupied, give up this radio off.
-	RTMP_IO_READ32(pAd, RX_DRX_IDX , &RxDmaIdx);
-	RTMP_IO_READ32(pAd, RX_CRX_IDX , &RxCpuIdx);
-	if ((RxDmaIdx > RxCpuIdx) && ((RxDmaIdx - RxCpuIdx) > RX_RING_SIZE/3))
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("AsicRadioOff ===> return1. RxDmaIdx = %d ,  RxCpuIdx = %d. \n", RxDmaIdx, RxCpuIdx));
-		return FALSE;
-	}
-	else if ((RxCpuIdx >= RxDmaIdx) && ((RxCpuIdx - RxDmaIdx) < RX_RING_SIZE/3))
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("AsicRadioOff ===> return2.  RxCpuIdx = %d. RxDmaIdx = %d ,  \n", RxCpuIdx, RxDmaIdx));
-		return FALSE;
-	}
-
-    // Once go into this function, disable tx because don't want too many packets in queue to prevent HW stops.
-	//pAd->bPCIclkOffDisableTx = TRUE;
-	RTMP_SET_PSFLAG(pAd, fRTMP_PS_DISABLE_TX);
-	if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE)
-		&& pAd->OpMode == OPMODE_STA
-#ifdef CONFIG_STA_SUPPORT
-		&&pAd->StaCfg.PSControl.field.EnableNewPS == TRUE
-#endif // CONFIG_STA_SUPPORT //
-		)
-	{
-
-	    RTMPCancelTimer(&pAd->Mlme.RadioOnOffTimer,	&Cancelled);
-	    RTMPCancelTimer(&pAd->Mlme.PsPollTimer,	&Cancelled);
-
-	    if (Level == DOT11POWERSAVE)
-		{
-			RTMP_IO_READ32(pAd, TBTT_TIMER, &TbTTTime);
-			TbTTTime &= 0x1ffff;
-			// 00. check if need to do sleep in this DTIM period.   If next beacon will arrive within 30ms , ...doesn't necessarily sleep.
-			// TbTTTime uint = 64us, LEAD_TIME unit = 1024us, PsPollTime unit = 1ms
-	        if  (((64*TbTTTime) <((LEAD_TIME*1024) + 40000)) && (TbttNumToNextWakeUp == 0))
-			{
-				DBGPRINT(RT_DEBUG_TRACE, ("TbTTTime = 0x%x , give up this sleep. \n", TbTTTime));
-	            OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_DOZE);
-	            //pAd->bPCIclkOffDisableTx = FALSE;
-	            RTMP_CLEAR_PSFLAG(pAd, fRTMP_PS_DISABLE_TX);
-				return FALSE;
-			}
-			else
-			{
-				PsPollTime = (64*TbTTTime- LEAD_TIME*1024)/1000;
-#ifdef PCIE_PS_SUPPORT
-#ifdef CONFIG_STA_SUPPORT
-				if ((IS_RT3090(pAd) || IS_RT3572(pAd) || IS_RT3390(pAd)) && IS_VERSION_AFTER_F(pAd)
-				&& (pAd->StaCfg.PSControl.field.rt30xxPowerMode == 3)
-				&& (pAd->StaCfg.PSControl.field.EnableNewPS == TRUE))
-				{
-							PsPollTime -= 5;
-				}
-				else
-#endif // CONFIG_STA_SUPPORT //
-#endif // PCIE_PS_SUPPORT //
-				PsPollTime -= 3;
-
-	            BeaconPeriodTime = pAd->CommonCfg.BeaconPeriod*102/100;
-				if (TbttNumToNextWakeUp > 0)
-					PsPollTime += ((TbttNumToNextWakeUp -1) * BeaconPeriodTime);
-
-	            pAd->Mlme.bPsPollTimerRunning = TRUE;
-				RTMPSetTimer(&pAd->Mlme.PsPollTimer, PsPollTime);
-			}
-		}
-	}
-	else
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("RT28xxPciAsicRadioOff::Level!=DOT11POWERSAVE \n"));
-	}
-
-	pAd->bPCIclkOffDisableTx = FALSE;
-    RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_IDLE_RADIO_OFF);
-
-#ifdef CONFIG_STA_SUPPORT
-    // Set to 1R.
-	if (pAd->Antenna.field.RxPath > 1 && pAd->OpMode == OPMODE_STA)
-	{
-    tempBBP_R3 = (pAd->StaCfg.BBPR3 & 0xE7);
-	RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R3, tempBBP_R3);
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-	// In Radio Off, we turn off RF clk, So now need to call ASICSwitchChannel again.
-	if ((INFRA_ON(pAd) || pAd->OpMode == OPMODE_AP) && (pAd->CommonCfg.CentralChannel != pAd->CommonCfg.Channel)
-		&& (pAd->MlmeAux.HtCapability.HtCapInfo.ChannelWidth == BW_40))
-	{
-		// Must using 40MHz.
-		AsicTurnOffRFClk(pAd, pAd->CommonCfg.CentralChannel);
-	}
-	else
-	{
-		// Must using 20MHz.
-		AsicTurnOffRFClk(pAd, pAd->CommonCfg.Channel);
-	}
-
-	if (Level != RTMP_HALT)
-	{
-		// Change Interrupt bitmask.
-    // When PCI clock is off, don't want to service interrupt.
-	RTMP_IO_WRITE32(pAd, INT_MASK_CSR, AutoWakeupInt);
-	}
-	else
-	{
-		RTMP_ASIC_INTERRUPT_DISABLE(pAd);
-	}
-
-
-	RTMP_IO_WRITE32(pAd, RX_CRX_IDX, pAd->RxRing.RxCpuIdx);
-	//  2. Send Sleep command
-	RTMP_IO_WRITE32(pAd, H2M_MAILBOX_STATUS, 0xffffffff);
-	RTMP_IO_WRITE32(pAd, H2M_MAILBOX_CID, 0xffffffff);
-	// send POWER-SAVE command to MCU. high-byte = 1 save power as much as possible. high byte = 0 save less power
-	AsicSendCommandToMcu(pAd, 0x30, PowerSafeCID, 0xff, 0x1);
-	//  2-1. Wait command success
-	// Status = 1 : success, Status = 2, already sleep, Status = 3, Maybe MAC is busy so can't finish this task.
-	brc = AsicCheckCommanOk(pAd, PowerSafeCID);
-
-	//  3. After 0x30 command is ok, send radio off command. lowbyte = 0 for power safe.
-	// If 0x30 command is not ok this time, we can ignore 0x35 command. It will make sure not cause firmware'r problem.
-	if ((Level == DOT11POWERSAVE) && (brc == TRUE))
-	{
-		AsicSendCommandToMcu(pAd, 0x35, PowerRadioOffCID, 0, 0x00);	// lowbyte = 0 means to do power safe, NOT turn off radio.
-		//  3-1. Wait command success
-		AsicCheckCommanOk(pAd, PowerRadioOffCID);
-	}
-	else if (brc == TRUE)
-	{
-		AsicSendCommandToMcu(pAd, 0x35, PowerRadioOffCID, 1, 0x00);	// lowbyte = 0 means to do power safe, NOT turn off radio.
-		//  3-1. Wait command success
-		AsicCheckCommanOk(pAd, PowerRadioOffCID);
-	}
-
-#ifdef CONFIG_STA_SUPPORT
-	// 1. Wait DMA not busy
-	i = 0;
-	do
-	{
-		RTMP_IO_READ32(pAd, WPDMA_GLO_CFG, &DmaCfg.word);
-		if ((DmaCfg.field.RxDMABusy == 0) && (DmaCfg.field.TxDMABusy == 0))
-			break;
-		RTMPusecDelay(20);
-		i++;
-	}while(i < 50);
-
-	/*
-	if (i >= 50)
-	{
-		pAd->CheckDmaBusyCount++;
-		DBGPRINT(RT_DEBUG_TRACE, ("DMA Rx keeps busy.  return on AsicRadioOff () CheckDmaBusyCount = %d \n", pAd->CheckDmaBusyCount));
-	}
-	else
-	{
-		pAd->CheckDmaBusyCount = 0;
-	}
-	*/
-#endif // CONFIG_STA_SUPPORT //
-//KH Debug:My original codes have the follwoing codes, but currecnt codes do not have it.
-// Disable for stability. If PCIE Link Control is modified for advance power save, re-covery this code segment.
-RTMP_IO_WRITE32(pAd, PBF_SYS_CTRL, 0x1280);
-//OPSTATUS_SET_FLAG(pAd, fOP_STATUS_CLKSELECT_40MHZ);
-
-#ifdef PCIE_PS_SUPPORT
-#ifdef CONFIG_STA_SUPPORT
-if ((IS_RT3090(pAd) || IS_RT3572(pAd) || IS_RT3390(pAd)) && IS_VERSION_AFTER_F(pAd)
-	&& (pAd->StaCfg.PSControl.field.rt30xxPowerMode == 3)
-	&& (pAd->StaCfg.PSControl.field.EnableNewPS == TRUE))
-	{
-	DBGPRINT(RT_DEBUG_TRACE, ("RT28xxPciAsicRadioOff::3090 return to skip the following TbttNumToNextWakeUp setting for 279x\n"));
-	pAd->bPCIclkOff = TRUE;
-	RTMP_CLEAR_PSFLAG(pAd, fRTMP_PS_DISABLE_TX);
-	// For this case, doesn't need to below actions, so return here.
-	return brc;
-	}
-#endif // CONFIG_STA_SUPPORT //
-#endif // PCIE_PS_SUPPORT //
-	if (Level == DOT11POWERSAVE)
-	{
-		AUTO_WAKEUP_STRUC	AutoWakeupCfg;
-		//RTMPSetTimer(&pAd->Mlme.PsPollTimer, 90);
-
-		// we have decided to SLEEP, so at least do it for a BEACON period.
-		if (TbttNumToNextWakeUp == 0)
-			TbttNumToNextWakeUp = 1;
-
-		AutoWakeupCfg.word = 0;
-		RTMP_IO_WRITE32(pAd, AUTO_WAKEUP_CFG, AutoWakeupCfg.word);
-
-		// 1. Set auto wake up timer.
-		AutoWakeupCfg.field.NumofSleepingTbtt = TbttNumToNextWakeUp - 1;
-		AutoWakeupCfg.field.EnableAutoWakeup = 1;
-		AutoWakeupCfg.field.AutoLeadTime = LEAD_TIME;
-		RTMP_IO_WRITE32(pAd, AUTO_WAKEUP_CFG, AutoWakeupCfg.word);
-	}
-
-#ifdef CONFIG_STA_SUPPORT
-	//  4-1. If it's to disable our device. Need to restore PCI Configuration Space to its original value.
-	if (Level == RTMP_HALT && pAd->OpMode == OPMODE_STA)
-	{
-		if ((brc == TRUE) && (i < 50))
-			RTMPPCIeLinkCtrlSetting(pAd, 1);
-	}
-	//  4. Set PCI configuration Space Link Comtrol fields.  Only Radio Off needs to call this function
-	else if (pAd->OpMode == OPMODE_STA)
-	{
-		if ((brc == TRUE) && (i < 50))
-			RTMPPCIeLinkCtrlSetting(pAd, 3);
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-	//pAd->bPCIclkOffDisableTx = FALSE;
-	RTMP_CLEAR_PSFLAG(pAd, fRTMP_PS_DISABLE_TX);
-	return TRUE;
-}
-
-
-
-
-VOID RT28xxPciMlmeRadioOn(
-	IN PRTMP_ADAPTER pAd)
-{
-    if (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RADIO_OFF))
-		return;
-
-    DBGPRINT(RT_DEBUG_TRACE,("%s===>\n", __FUNCTION__));
-
-    if ((pAd->OpMode == OPMODE_AP) ||
-        ((pAd->OpMode == OPMODE_STA)
-        && (!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE)
-#ifdef CONFIG_STA_SUPPORT
-        ||pAd->StaCfg.PSControl.field.EnableNewPS == FALSE
-#endif // CONFIG_STA_SUPPORT //
-        )))
-    {
-	RT28xxPciAsicRadioOn(pAd, GUI_IDLE_POWER_SAVE);
-	//NICResetFromError(pAd);
-
-	RTMPRingCleanUp(pAd, QID_AC_BK);
-	RTMPRingCleanUp(pAd, QID_AC_BE);
-	RTMPRingCleanUp(pAd, QID_AC_VI);
-	RTMPRingCleanUp(pAd, QID_AC_VO);
-	/*RTMPRingCleanUp(pAd, QID_HCCA);*/
-	RTMPRingCleanUp(pAd, QID_MGMT);
-	RTMPRingCleanUp(pAd, QID_RX);
-
-	// Enable Tx/Rx
-	RTMPEnableRxTx(pAd);
-
-	// Clear Radio off flag
-	RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_RADIO_OFF);
-	RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_IDLE_RADIO_OFF);
-	    // Set LED
-	    RTMPSetLED(pAd, LED_RADIO_ON);
-    }
-
-#ifdef CONFIG_STA_SUPPORT
-    if ((pAd->OpMode == OPMODE_STA) &&
-        (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE))
-        &&(pAd->StaCfg.PSControl.field.EnableNewPS == TRUE))
-    {
-        BOOLEAN		Cancelled;
-
-	RTMPPCIeLinkCtrlValueRestore(pAd, RESTORE_WAKEUP);
-
-        pAd->Mlme.bPsPollTimerRunning = FALSE;
-	RTMPCancelTimer(&pAd->Mlme.PsPollTimer,	&Cancelled);
-	RTMPCancelTimer(&pAd->Mlme.RadioOnOffTimer,	&Cancelled);
-	RTMPSetTimer(&pAd->Mlme.RadioOnOffTimer, 40);
-    }
-#endif // CONFIG_STA_SUPPORT //
-}
-
-
-VOID RT28xxPciMlmeRadioOFF(
-	IN PRTMP_ADAPTER pAd)
-{
-	BOOLEAN brc=TRUE;
-
-    if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RADIO_OFF))
-	return;
-
-#ifdef CONFIG_STA_SUPPORT
-	// Link down first if any association exists
-	if (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST))
-	{
-		if (INFRA_ON(pAd) || ADHOC_ON(pAd))
-		{
-			MLME_DISASSOC_REQ_STRUCT DisReq;
-			MLME_QUEUE_ELEM *pMsgElem = (MLME_QUEUE_ELEM *) kmalloc(sizeof(MLME_QUEUE_ELEM), MEM_ALLOC_FLAG);
-
-			if (pMsgElem)
-			{
-				COPY_MAC_ADDR(&DisReq.Addr, pAd->CommonCfg.Bssid);
-				DisReq.Reason =  REASON_DISASSOC_STA_LEAVING;
-
-				pMsgElem->Machine = ASSOC_STATE_MACHINE;
-				pMsgElem->MsgType = MT2_MLME_DISASSOC_REQ;
-				pMsgElem->MsgLen = sizeof(MLME_DISASSOC_REQ_STRUCT);
-				NdisMoveMemory(pMsgElem->Msg, &DisReq, sizeof(MLME_DISASSOC_REQ_STRUCT));
-
-				MlmeDisassocReqAction(pAd, pMsgElem);
-				kfree(pMsgElem);
-
-				RTMPusecDelay(1000);
-			}
-		}
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-    DBGPRINT(RT_DEBUG_TRACE,("%s===>\n", __FUNCTION__));
-
-	// Set LED
-	//RTMPSetLED(pAd, LED_RADIO_OFF);
-	// Set Radio off flag
-	RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_RADIO_OFF);
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-    {
-	BOOLEAN		Cancelled;
-	if (pAd->StaCfg.PSControl.field.EnableNewPS == TRUE)
-		{
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS))
-	{
-			RTMPCancelTimer(&pAd->MlmeAux.ScanTimer, &Cancelled);
-			RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS);
-	}
-			// If during power safe mode.
-			if (pAd->StaCfg.bRadio == TRUE)
-			{
-				DBGPRINT(RT_DEBUG_TRACE,("-->MlmeRadioOff() return on bRadio == TRUE; \n"));
-				return;
-			}
-			// Always radio on since the NIC needs to set the MCU command (LED_RADIO_OFF).
-			if (IDLE_ON(pAd) &&
-				(RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_IDLE_RADIO_OFF)))
-			{
-				RT28xxPciAsicRadioOn(pAd, GUI_IDLE_POWER_SAVE);
-			}
-		if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE))
-        {
-            BOOLEAN Cancelled;
-            pAd->Mlme.bPsPollTimerRunning = FALSE;
-            RTMPCancelTimer(&pAd->Mlme.PsPollTimer,	&Cancelled);
-	        RTMPCancelTimer(&pAd->Mlme.RadioOnOffTimer,	&Cancelled);
-        }
-		}
-
-        // Link down first if any association exists
-        if (INFRA_ON(pAd) || ADHOC_ON(pAd))
-            LinkDown(pAd, FALSE);
-        RTMPusecDelay(10000);
-        //==========================================
-        // Clean up old bss table
-        BssTableInit(&pAd->ScanTab);
-
-        /*
-        if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE))
-        {
-            RTMPSetTimer(&pAd->Mlme.RadioOnOffTimer, 10);
-            return;
-        }
-        */
-    }
-#endif // CONFIG_STA_SUPPORT //
-	// Set LED.Move to here for fixing LED bug. This flag must be called after LinkDown
-	RTMPSetLED(pAd, LED_RADIO_OFF);
-
-#ifdef CONFIG_STA_SUPPORT
-//KH Debug:All PCIe devices need to use timer to execute radio off function, or the PCIe&&EnableNewPS needs.
-//KH Ans:It is right, because only when the PCIe and EnableNewPs is true, we need to delay the RadioOffTimer
-//to avoid the deadlock with PCIe Power saving function.
-if (pAd->OpMode == OPMODE_STA&&
-	OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE)&&
-	pAd->StaCfg.PSControl.field.EnableNewPS == TRUE)
-	{
-	RTMPSetTimer(&pAd->Mlme.RadioOnOffTimer, 10);
-	}
-else
-#endif // CONFIG_STA_SUPPORT //
-{
-
-
-	brc=RT28xxPciAsicRadioOff(pAd, GUIRADIO_OFF, 0);
-
-	if (brc==FALSE)
-	{
-		DBGPRINT(RT_DEBUG_ERROR,("%s call RT28xxPciAsicRadioOff fail !!\n", __FUNCTION__));
-	}
-}
-/*
-	// Disable Tx/Rx DMA
-	RTMP_IO_READ32(pAd, WPDMA_GLO_CFG, &GloCfg.word);	   // disable DMA
-	GloCfg.field.EnableTxDMA = 0;
-	GloCfg.field.EnableRxDMA = 0;
-	RTMP_IO_WRITE32(pAd, WPDMA_GLO_CFG, GloCfg.word);	   // abort all TX rings
-
-
-	// MAC_SYS_CTRL => value = 0x0 => 40mA
-	RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, 0);
-
-	// PWR_PIN_CFG => value = 0x0 => 40mA
-	RTMP_IO_WRITE32(pAd, PWR_PIN_CFG, 0);
-
-	// TX_PIN_CFG => value = 0x0 => 20mA
-	RTMP_IO_WRITE32(pAd, TX_PIN_CFG, 0);
-
-	if (pAd->CommonCfg.BBPCurrentBW == BW_40)
-	{
-		// Must using 40MHz.
-		AsicTurnOffRFClk(pAd, pAd->CommonCfg.CentralChannel);
-	}
-	else
-	{
-		// Must using 20MHz.
-		AsicTurnOffRFClk(pAd, pAd->CommonCfg.Channel);
-	}
-
-	// Waiting for DMA idle
-	i = 0;
-	do
-	{
-		RTMP_IO_READ32(pAd, WPDMA_GLO_CFG, &GloCfg.word);
-		if ((GloCfg.field.TxDMABusy == 0) && (GloCfg.field.RxDMABusy == 0))
-			break;
-
-		RTMPusecDelay(1000);
-	}while (i++ < 100);
-*/
-}
-
-#endif // RTMP_MAC_PCI //
diff --git a/drivers/staging/rt3090/common/cmm_profile.c b/drivers/staging/rt3090/common/cmm_profile.c
deleted file mode 100644
index 5803f422ae09..000000000000
--- a/drivers/staging/rt3090/common/cmm_profile.c
+++ /dev/null
@@ -1,2321 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-    Module Name:
-	cmm_profile.c
-
-    Abstract:
-
-    Revision History:
-    Who          When          What
-    ---------    ----------    ----------------------------------------------
- */
-
-#include "../rt_config.h"
-
-
-#define ETH_MAC_ADDR_STR_LEN 17  // in format of xx:xx:xx:xx:xx:xx
-
-// We assume the s1 is a sting, s2 is a memory space with 6 bytes. and content of s1 will be changed.
-BOOLEAN rtstrmactohex(PSTRING s1, PSTRING s2)
-{
-	int i = 0;
-	PSTRING ptokS = s1, ptokE = s1;
-
-	if (strlen(s1) != ETH_MAC_ADDR_STR_LEN)
-		return FALSE;
-
-	while((*ptokS) != '\0')
-	{
-		if((ptokE = strchr(ptokS, ':')) != NULL)
-			*ptokE++ = '\0';
-		if ((strlen(ptokS) != 2) || (!isxdigit(*ptokS)) || (!isxdigit(*(ptokS+1))))
-			break; // fail
-		AtoH(ptokS, (PUCHAR)&s2[i++], 1);
-		ptokS = ptokE;
-		if (i == 6)
-			break; // parsing finished
-	}
-
-	return ( i == 6 ? TRUE : FALSE);
-
-}
-
-
-// we assume the s1 and s2 both are strings.
-BOOLEAN rtstrcasecmp(PSTRING s1, PSTRING s2)
-{
-	PSTRING p1 = s1, p2 = s2;
-
-	if (strlen(s1) != strlen(s2))
-		return FALSE;
-
-	while(*p1 != '\0')
-	{
-		if((*p1 != *p2) && ((*p1 ^ *p2) != 0x20))
-			return FALSE;
-		p1++;
-		p2++;
-	}
-
-	return TRUE;
-}
-
-// we assume the s1 (buffer) and s2 (key) both are strings.
-PSTRING rtstrstruncasecmp(PSTRING s1, PSTRING s2)
-{
-	INT l1, l2, i;
-	char temp1, temp2;
-
-	l2 = strlen(s2);
-	if (!l2)
-		return (char *) s1;
-
-	l1 = strlen(s1);
-
-	while (l1 >= l2)
-	{
-		l1--;
-
-		for(i=0; i<l2; i++)
-		{
-			temp1 = *(s1+i);
-			temp2 = *(s2+i);
-
-			if (('a' <= temp1) && (temp1 <= 'z'))
-				temp1 = 'A'+(temp1-'a');
-			if (('a' <= temp2) && (temp2 <= 'z'))
-				temp2 = 'A'+(temp2-'a');
-
-			if (temp1 != temp2)
-				break;
-		}
-
-		if (i == l2)
-			return (char *) s1;
-
-		s1++;
-	}
-
-	return NULL; // not found
-}
-
-//add by kathy
-
- /**
-  * strstr - Find the first substring in a %NUL terminated string
-  * @s1: The string to be searched
-  * @s2: The string to search for
-  */
-PSTRING rtstrstr(PSTRING s1,const PSTRING s2)
-{
-	INT l1, l2;
-
-	l2 = strlen(s2);
-	if (!l2)
-		return s1;
-
-	l1 = strlen(s1);
-
-	while (l1 >= l2)
-	{
-		l1--;
-		if (!memcmp(s1,s2,l2))
-			return s1;
-		s1++;
-	}
-
-	return NULL;
-}
-
-/**
- * rstrtok - Split a string into tokens
- * @s: The string to be searched
- * @ct: The characters to search for
- * * WARNING: strtok is deprecated, use strsep instead. However strsep is not compatible with old architecture.
- */
-PSTRING __rstrtok;
-PSTRING rstrtok(PSTRING s,const PSTRING ct)
-{
-	PSTRING sbegin, send;
-
-	sbegin  = s ? s : __rstrtok;
-	if (!sbegin)
-	{
-		return NULL;
-	}
-
-	sbegin += strspn(sbegin,ct);
-	if (*sbegin == '\0')
-	{
-		__rstrtok = NULL;
-		return( NULL );
-	}
-
-	send = strpbrk( sbegin, ct);
-	if (send && *send != '\0')
-		*send++ = '\0';
-
-	__rstrtok = send;
-
-	return (sbegin);
-}
-
-/**
- * delimitcnt - return the count of a given delimiter in a given string.
- * @s: The string to be searched.
- * @ct: The delimiter to search for.
- * Notice : We suppose the delimiter is a single-char string(for example : ";").
- */
-INT delimitcnt(PSTRING s,PSTRING ct)
-{
-	INT count = 0;
-	/* point to the beginning of the line */
-	PSTRING token = s;
-
-	for ( ;; )
-	{
-		token = strpbrk(token, ct); /* search for delimiters */
-
-        if ( token == NULL )
-		{
-			/* advanced to the terminating null character */
-			break;
-		}
-		/* skip the delimiter */
-	    ++token;
-
-		/*
-		 * Print the found text: use len with %.*s to specify field width.
-		 */
-
-		/* accumulate delimiter count */
-	    ++count;
-	}
-    return count;
-}
-
-/*
-  * converts the Internet host address from the standard numbers-and-dots notation
-  * into binary data.
-  * returns nonzero if the address is valid, zero if not.
-  */
-int rtinet_aton(PSTRING cp, unsigned int *addr)
-{
-	unsigned int	val;
-	int		base, n;
-	STRING		c;
-	unsigned int    parts[4];
-	unsigned int    *pp = parts;
-
-	for (;;)
-    {
-         /*
-          * Collect number up to ``.''.
-          * Values are specified as for C:
-          *	0x=hex, 0=octal, other=decimal.
-          */
-         val = 0;
-         base = 10;
-         if (*cp == '0')
-         {
-             if (*++cp == 'x' || *cp == 'X')
-                 base = 16, cp++;
-             else
-                 base = 8;
-         }
-         while ((c = *cp) != '\0')
-         {
-             if (isdigit((unsigned char) c))
-             {
-                 val = (val * base) + (c - '0');
-                 cp++;
-                 continue;
-             }
-             if (base == 16 && isxdigit((unsigned char) c))
-             {
-                 val = (val << 4) +
-                     (c + 10 - (islower((unsigned char) c) ? 'a' : 'A'));
-                 cp++;
-                 continue;
-             }
-             break;
-         }
-         if (*cp == '.')
-         {
-             /*
-              * Internet format: a.b.c.d a.b.c   (with c treated as 16-bits)
-              * a.b     (with b treated as 24 bits)
-              */
-             if (pp >= parts + 3 || val > 0xff)
-                 return 0;
-             *pp++ = val, cp++;
-         }
-         else
-             break;
-     }
-
-     /*
-      * Check for trailing junk.
-      */
-     while (*cp)
-         if (!isspace((unsigned char) *cp++))
-             return 0;
-
-     /*
-      * Concoct the address according to the number of parts specified.
-      */
-     n = pp - parts + 1;
-     switch (n)
-     {
-
-         case 1:         /* a -- 32 bits */
-             break;
-
-         case 2:         /* a.b -- 8.24 bits */
-             if (val > 0xffffff)
-                 return 0;
-             val |= parts[0] << 24;
-             break;
-
-         case 3:         /* a.b.c -- 8.8.16 bits */
-             if (val > 0xffff)
-                 return 0;
-             val |= (parts[0] << 24) | (parts[1] << 16);
-             break;
-
-         case 4:         /* a.b.c.d -- 8.8.8.8 bits */
-             if (val > 0xff)
-                 return 0;
-             val |= (parts[0] << 24) | (parts[1] << 16) | (parts[2] << 8);
-             break;
-     }
-
-     *addr = htonl(val);
-     return 1;
-
-}
-
-/*
-    ========================================================================
-
-    Routine Description:
-        Find key section for Get key parameter.
-
-    Arguments:
-        buffer                      Pointer to the buffer to start find the key section
-        section                     the key of the secion to be find
-
-    Return Value:
-        NULL                        Fail
-        Others                      Success
-    ========================================================================
-*/
-PSTRING RTMPFindSection(
-    IN  PSTRING   buffer)
-{
-    STRING temp_buf[32];
-    PSTRING  ptr;
-
-    strcpy(temp_buf, "Default");
-
-    if((ptr = rtstrstr(buffer, temp_buf)) != NULL)
-            return (ptr+strlen("\n"));
-        else
-            return NULL;
-}
-
-/*
-    ========================================================================
-
-    Routine Description:
-        Get key parameter.
-
-    Arguments:
-	key			Pointer to key string
-	dest			Pointer to destination
-	destsize		The datasize of the destination
-	buffer		Pointer to the buffer to start find the key
-	bTrimSpace	Set true if you want to strip the space character of the result pattern
-
-    Return Value:
-        TRUE                        Success
-        FALSE                       Fail
-
-    Note:
-	This routine get the value with the matched key (case case-sensitive)
-	For SSID and security key related parameters, we SHALL NOT trim the space(' ') character.
-    ========================================================================
-*/
-INT RTMPGetKeyParameter(
-    IN PSTRING key,
-    OUT PSTRING dest,
-    IN INT destsize,
-    IN PSTRING buffer,
-    IN BOOLEAN bTrimSpace)
-{
-	PSTRING pMemBuf, temp_buf1 = NULL, temp_buf2 = NULL;
-	PSTRING start_ptr, end_ptr;
-	PSTRING ptr;
-	PSTRING offset = NULL;
-	INT  len, keyLen;
-
-
-	keyLen = strlen(key);
-	os_alloc_mem(NULL, (PUCHAR *)&pMemBuf, MAX_PARAM_BUFFER_SIZE  * 2);
-	if (pMemBuf == NULL)
-		return (FALSE);
-
-	memset(pMemBuf, 0, MAX_PARAM_BUFFER_SIZE * 2);
-	temp_buf1 = pMemBuf;
-	temp_buf2 = (PSTRING)(pMemBuf + MAX_PARAM_BUFFER_SIZE);
-
-
-	//find section
-	if((offset = RTMPFindSection(buffer)) == NULL)
-	{
-		os_free_mem(NULL, (PUCHAR)pMemBuf);
-		return (FALSE);
-	}
-
-	strcpy(temp_buf1, "\n");
-	strcat(temp_buf1, key);
-	strcat(temp_buf1, "=");
-
-	//search key
-	if((start_ptr=rtstrstr(offset, temp_buf1)) == NULL)
-	{
-		os_free_mem(NULL, (PUCHAR)pMemBuf);
-		return (FALSE);
-	}
-
-	start_ptr += strlen("\n");
-	if((end_ptr = rtstrstr(start_ptr, "\n"))==NULL)
-		end_ptr = start_ptr+strlen(start_ptr);
-
-	if (end_ptr<start_ptr)
-	{
-		os_free_mem(NULL, (PUCHAR)pMemBuf);
-		return (FALSE);
-	}
-
-	NdisMoveMemory(temp_buf2, start_ptr, end_ptr-start_ptr);
-	temp_buf2[end_ptr-start_ptr]='\0';
-	if((start_ptr=rtstrstr(temp_buf2, "=")) == NULL)
-	{
-		os_free_mem(NULL, (PUCHAR)pMemBuf);
-		return (FALSE);
-	}
-	ptr = (start_ptr +1);
-	//trim special characters, i.e.,  TAB or space
-	while(*start_ptr != 0x00)
-	{
-		if( ((*ptr == ' ') && bTrimSpace) || (*ptr == '\t') )
-			ptr++;
-		else
-			break;
-	}
-	len = strlen(start_ptr);
-
-	memset(dest, 0x00, destsize);
-	strncpy(dest, ptr, ((len >= destsize) ? destsize: len));
-
-	os_free_mem(NULL, (PUCHAR)pMemBuf);
-
-	return TRUE;
-}
-
-
-/*
-    ========================================================================
-
-    Routine Description:
-        Get multiple key parameter.
-
-    Arguments:
-        key                         Pointer to key string
-        dest                        Pointer to destination
-        destsize                    The datasize of the destination
-        buffer                      Pointer to the buffer to start find the key
-
-    Return Value:
-        TRUE                        Success
-        FALSE                       Fail
-
-    Note:
-        This routine get the value with the matched key (case case-sensitive)
-    ========================================================================
-*/
-INT RTMPGetKeyParameterWithOffset(
-    IN  PSTRING   key,
-    OUT PSTRING   dest,
-    OUT	USHORT	*end_offset,
-    IN  INT     destsize,
-    IN  PSTRING   buffer,
-    IN	BOOLEAN	bTrimSpace)
-{
-    PSTRING temp_buf1 = NULL;
-    PSTRING temp_buf2 = NULL;
-    PSTRING start_ptr;
-    PSTRING end_ptr;
-    PSTRING ptr;
-    PSTRING offset = 0;
-    INT  len;
-
-	if (*end_offset >= MAX_INI_BUFFER_SIZE)
-		return (FALSE);
-
-	os_alloc_mem(NULL, (PUCHAR *)&temp_buf1, MAX_PARAM_BUFFER_SIZE);
-
-	if(temp_buf1 == NULL)
-        return (FALSE);
-
-	os_alloc_mem(NULL, (PUCHAR *)&temp_buf2, MAX_PARAM_BUFFER_SIZE);
-	if(temp_buf2 == NULL)
-	{
-		os_free_mem(NULL, (PUCHAR)temp_buf1);
-        return (FALSE);
-	}
-
-    //find section
-	if(*end_offset == 0)
-    {
-		if ((offset = RTMPFindSection(buffer)) == NULL)
-		{
-			os_free_mem(NULL, (PUCHAR)temp_buf1);
-		os_free_mem(NULL, (PUCHAR)temp_buf2);
-	    return (FALSE);
-		}
-    }
-	else
-		offset = buffer + (*end_offset);
-
-    strcpy(temp_buf1, "\n");
-    strcat(temp_buf1, key);
-    strcat(temp_buf1, "=");
-
-    //search key
-    if((start_ptr=rtstrstr(offset, temp_buf1))==NULL)
-    {
-		os_free_mem(NULL, (PUCHAR)temp_buf1);
-	os_free_mem(NULL, (PUCHAR)temp_buf2);
-        return (FALSE);
-    }
-
-    start_ptr+=strlen("\n");
-    if((end_ptr=rtstrstr(start_ptr, "\n"))==NULL)
-       end_ptr=start_ptr+strlen(start_ptr);
-
-    if (end_ptr<start_ptr)
-    {
-		os_free_mem(NULL, (PUCHAR)temp_buf1);
-	os_free_mem(NULL, (PUCHAR)temp_buf2);
-        return (FALSE);
-    }
-
-	*end_offset = end_ptr - buffer;
-
-    NdisMoveMemory(temp_buf2, start_ptr, end_ptr-start_ptr);
-    temp_buf2[end_ptr-start_ptr]='\0';
-    len = strlen(temp_buf2);
-    strcpy(temp_buf1, temp_buf2);
-    if((start_ptr=rtstrstr(temp_buf1, "=")) == NULL)
-    {
-		os_free_mem(NULL, (PUCHAR)temp_buf1);
-	os_free_mem(NULL, (PUCHAR)temp_buf2);
-        return (FALSE);
-    }
-
-    strcpy(temp_buf2, start_ptr+1);
-    ptr = temp_buf2;
-    //trim space or tab
-    while(*ptr != 0x00)
-    {
-        if((bTrimSpace && (*ptr == ' ')) || (*ptr == '\t') )
-            ptr++;
-        else
-           break;
-    }
-
-    len = strlen(ptr);
-    memset(dest, 0x00, destsize);
-    strncpy(dest, ptr, len >= destsize ?  destsize: len);
-
-	os_free_mem(NULL, (PUCHAR)temp_buf1);
-    os_free_mem(NULL, (PUCHAR)temp_buf2);
-    return TRUE;
-}
-
-
-static int rtmp_parse_key_buffer_from_file(IN  PRTMP_ADAPTER pAd,IN  PSTRING buffer,IN  ULONG KeyType,IN  INT BSSIdx,IN  INT KeyIdx)
-{
-	PSTRING		keybuff;
-	//INT			i = BSSIdx, idx = KeyIdx, retVal;
-	ULONG		KeyLen;
-	//UCHAR		CipherAlg = CIPHER_WEP64;
-	CIPHER_KEY	*pSharedKey;
-
-	keybuff = buffer;
-	KeyLen = strlen(keybuff);
-	pSharedKey = &pAd->SharedKey[BSSIdx][KeyIdx];
-
-	if(((KeyType != 0) && (KeyType != 1)) ||
-	    ((KeyType == 0) && (KeyLen != 10) && (KeyLen != 26)) ||
-	    ((KeyType== 1) && (KeyLen != 5) && (KeyLen != 13)))
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("Key%dStr is Invalid key length(%ld) or Type(%ld)\n",
-								KeyIdx+1, KeyLen, KeyType));
-		return FALSE;
-	}
-	else
-	{
-		return RT_CfgSetWepKey(pAd, buffer, pSharedKey, KeyIdx);
-	}
-
-}
-
-
-static void rtmp_read_key_parms_from_file(IN  PRTMP_ADAPTER pAd, PSTRING tmpbuf, PSTRING buffer)
-{
-	STRING		tok_str[16];
-	PSTRING		macptr;
-	INT			i = 0, idx;
-	ULONG		KeyType[MAX_MBSSID_NUM];
-	ULONG		KeyIdx;
-
-	NdisZeroMemory(KeyType, sizeof(KeyType));
-
-	//DefaultKeyID
-	if(RTMPGetKeyParameter("DefaultKeyID", tmpbuf, 25, buffer, TRUE))
-	{
-
-#ifdef CONFIG_STA_SUPPORT
-		IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		{
-			KeyIdx = simple_strtol(tmpbuf, 0, 10);
-			if((KeyIdx >= 1 ) && (KeyIdx <= 4))
-				pAd->StaCfg.DefaultKeyId = (UCHAR) (KeyIdx - 1);
-			else
-				pAd->StaCfg.DefaultKeyId = 0;
-
-			DBGPRINT(RT_DEBUG_TRACE, ("DefaultKeyID(0~3)=%d\n", pAd->StaCfg.DefaultKeyId));
-		}
-#endif // CONFIG_STA_SUPPORT //
-	}
-
-
-	for (idx = 0; idx < 4; idx++)
-	{
-		sprintf(tok_str, "Key%dType", idx + 1);
-		//Key1Type
-		if (RTMPGetKeyParameter(tok_str, tmpbuf, 128, buffer, TRUE))
-		{
-		    for (i = 0, macptr = rstrtok(tmpbuf,";"); macptr; macptr = rstrtok(NULL,";"), i++)
-		    {
-				/*
-					do sanity check for KeyType length;
-					or in station mode, the KeyType length > 1,
-					the code will overwrite the stack of caller
-					(RTMPSetProfileParameters) and cause srcbuf = NULL
-				*/
-				if (i < MAX_MBSSID_NUM)
-					KeyType[i] = simple_strtol(macptr, 0, 10);
-		    }
-
-#ifdef CONFIG_STA_SUPPORT
-			IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-			{
-				sprintf(tok_str, "Key%dStr", idx + 1);
-				if (RTMPGetKeyParameter(tok_str, tmpbuf, 128, buffer, FALSE))
-				{
-					rtmp_parse_key_buffer_from_file(pAd, tmpbuf, KeyType[BSS0], BSS0, idx);
-				}
-			}
-#endif // CONFIG_STA_SUPPORT //
-		}
-	}
-}
-
-
-
-#ifdef CONFIG_STA_SUPPORT
-static void rtmp_read_sta_wmm_parms_from_file(IN  PRTMP_ADAPTER pAd, char *tmpbuf, char *buffer)
-{
-	PSTRING					macptr;
-	INT						i=0;
-	BOOLEAN					bWmmEnable = FALSE;
-
-	//WmmCapable
-	if(RTMPGetKeyParameter("WmmCapable", tmpbuf, 32, buffer, TRUE))
-	{
-		if(simple_strtol(tmpbuf, 0, 10) != 0) //Enable
-		{
-			pAd->CommonCfg.bWmmCapable = TRUE;
-			bWmmEnable = TRUE;
-		}
-		else //Disable
-		{
-			pAd->CommonCfg.bWmmCapable = FALSE;
-		}
-
-		DBGPRINT(RT_DEBUG_TRACE, ("WmmCapable=%d\n", pAd->CommonCfg.bWmmCapable));
-	}
-
-#ifdef QOS_DLS_SUPPORT
-	//DLSCapable
-	if(RTMPGetKeyParameter("DLSCapable", tmpbuf, 32, buffer, TRUE))
-	{
-		if(simple_strtol(tmpbuf, 0, 10) != 0)  //Enable
-		{
-			pAd->CommonCfg.bDLSCapable = TRUE;
-		}
-		else //Disable
-		{
-			pAd->CommonCfg.bDLSCapable = FALSE;
-		}
-
-		DBGPRINT(RT_DEBUG_TRACE, ("bDLSCapable=%d\n", pAd->CommonCfg.bDLSCapable));
-	}
-#endif // QOS_DLS_SUPPORT //
-
-	//AckPolicy for AC_BK, AC_BE, AC_VI, AC_VO
-	if(RTMPGetKeyParameter("AckPolicy", tmpbuf, 32, buffer, TRUE))
-	{
-		for (i = 0, macptr = rstrtok(tmpbuf,";"); macptr; macptr = rstrtok(NULL,";"), i++)
-		{
-			pAd->CommonCfg.AckPolicy[i] = (UCHAR)simple_strtol(macptr, 0, 10);
-
-			DBGPRINT(RT_DEBUG_TRACE, ("AckPolicy[%d]=%d\n", i, pAd->CommonCfg.AckPolicy[i]));
-		}
-	}
-
-	if (bWmmEnable)
-	{
-		//APSDCapable
-		if(RTMPGetKeyParameter("APSDCapable", tmpbuf, 10, buffer, TRUE))
-		{
-			if(simple_strtol(tmpbuf, 0, 10) != 0)  //Enable
-				pAd->CommonCfg.bAPSDCapable = TRUE;
-			else
-				pAd->CommonCfg.bAPSDCapable = FALSE;
-
-			DBGPRINT(RT_DEBUG_TRACE, ("APSDCapable=%d\n", pAd->CommonCfg.bAPSDCapable));
-		}
-
-		//MaxSPLength
-		if(RTMPGetKeyParameter("MaxSPLength", tmpbuf, 10, buffer, TRUE))
-		{
-			pAd->CommonCfg.MaxSPLength = simple_strtol(tmpbuf, 0, 10);
-
-			DBGPRINT(RT_DEBUG_TRACE, ("MaxSPLength=%d\n", pAd->CommonCfg.MaxSPLength));
-		}
-
-		//APSDAC for AC_BE, AC_BK, AC_VI, AC_VO
-		if(RTMPGetKeyParameter("APSDAC", tmpbuf, 32, buffer, TRUE))
-		{
-			BOOLEAN apsd_ac[4];
-
-			for (i = 0, macptr = rstrtok(tmpbuf,";"); macptr; macptr = rstrtok(NULL,";"), i++)
-			{
-				apsd_ac[i] = (BOOLEAN)simple_strtol(macptr, 0, 10);
-
-				DBGPRINT(RT_DEBUG_TRACE, ("APSDAC%d  %d\n", i,  apsd_ac[i]));
-			}
-
-			pAd->CommonCfg.bAPSDAC_BE = apsd_ac[0];
-			pAd->CommonCfg.bAPSDAC_BK = apsd_ac[1];
-			pAd->CommonCfg.bAPSDAC_VI = apsd_ac[2];
-			pAd->CommonCfg.bAPSDAC_VO = apsd_ac[3];
-
-			pAd->CommonCfg.bACMAPSDTr[0] = apsd_ac[0];
-			pAd->CommonCfg.bACMAPSDTr[1] = apsd_ac[1];
-			pAd->CommonCfg.bACMAPSDTr[2] = apsd_ac[2];
-			pAd->CommonCfg.bACMAPSDTr[3] = apsd_ac[3];
-		}
-	}
-
-}
-#endif // CONFIG_STA_SUPPORT //
-
-
-#ifdef DOT11_N_SUPPORT
-static void HTParametersHook(
-	IN	PRTMP_ADAPTER pAd,
-	IN	PSTRING		  pValueStr,
-	IN	PSTRING		  pInput)
-{
-
-	long Value;
-
-    if (RTMPGetKeyParameter("HT_PROTECT", pValueStr, 25, pInput, TRUE))
-    {
-        Value = simple_strtol(pValueStr, 0, 10);
-        if (Value == 0)
-        {
-            pAd->CommonCfg.bHTProtect = FALSE;
-        }
-        else
-        {
-            pAd->CommonCfg.bHTProtect = TRUE;
-        }
-        DBGPRINT(RT_DEBUG_TRACE, ("HT: Protection  = %s\n", (Value==0) ? "Disable" : "Enable"));
-    }
-
-    if (RTMPGetKeyParameter("HT_MIMOPSEnable", pValueStr, 25, pInput, TRUE))
-    {
-        Value = simple_strtol(pValueStr, 0, 10);
-        if (Value == 0)
-        {
-            pAd->CommonCfg.bMIMOPSEnable = FALSE;
-        }
-        else
-        {
-            pAd->CommonCfg.bMIMOPSEnable = TRUE;
-        }
-        DBGPRINT(RT_DEBUG_TRACE, ("HT: MIMOPSEnable  = %s\n", (Value==0) ? "Disable" : "Enable"));
-    }
-
-
-    if (RTMPGetKeyParameter("HT_MIMOPSMode", pValueStr, 25, pInput, TRUE))
-    {
-        Value = simple_strtol(pValueStr, 0, 10);
-        if (Value > MMPS_ENABLE)
-        {
-			pAd->CommonCfg.BACapability.field.MMPSmode = MMPS_ENABLE;
-        }
-        else
-        {
-            //TODO: add mimo power saving mechanism
-            pAd->CommonCfg.BACapability.field.MMPSmode = MMPS_ENABLE;
-			//pAd->CommonCfg.BACapability.field.MMPSmode = Value;
-        }
-        DBGPRINT(RT_DEBUG_TRACE, ("HT: MIMOPS Mode  = %d\n", (INT) Value));
-    }
-
-    if (RTMPGetKeyParameter("HT_BADecline", pValueStr, 25, pInput, TRUE))
-    {
-        Value = simple_strtol(pValueStr, 0, 10);
-        if (Value == 0)
-        {
-            pAd->CommonCfg.bBADecline = FALSE;
-        }
-        else
-        {
-            pAd->CommonCfg.bBADecline = TRUE;
-        }
-        DBGPRINT(RT_DEBUG_TRACE, ("HT: BA Decline  = %s\n", (Value==0) ? "Disable" : "Enable"));
-    }
-
-
-    if (RTMPGetKeyParameter("HT_DisableReordering", pValueStr, 25, pInput, TRUE))
-    {
-        Value = simple_strtol(pValueStr, 0, 10);
-        if (Value == 0)
-        {
-            pAd->CommonCfg.bDisableReordering = FALSE;
-        }
-        else
-        {
-            pAd->CommonCfg.bDisableReordering = TRUE;
-        }
-        DBGPRINT(RT_DEBUG_TRACE, ("HT: DisableReordering  = %s\n", (Value==0) ? "Disable" : "Enable"));
-    }
-
-    if (RTMPGetKeyParameter("HT_AutoBA", pValueStr, 25, pInput, TRUE))
-    {
-        Value = simple_strtol(pValueStr, 0, 10);
-        if (Value == 0)
-        {
-            pAd->CommonCfg.BACapability.field.AutoBA = FALSE;
-			pAd->CommonCfg.BACapability.field.Policy = BA_NOTUSE;
-        }
-        else
-        {
-            pAd->CommonCfg.BACapability.field.AutoBA = TRUE;
-			pAd->CommonCfg.BACapability.field.Policy = IMMED_BA;
-        }
-        pAd->CommonCfg.REGBACapability.field.AutoBA = pAd->CommonCfg.BACapability.field.AutoBA;
-        DBGPRINT(RT_DEBUG_TRACE, ("HT: Auto BA  = %s\n", (Value==0) ? "Disable" : "Enable"));
-    }
-
-	// Tx_+HTC frame
-    if (RTMPGetKeyParameter("HT_HTC", pValueStr, 25, pInput, TRUE))
-	{
-		Value = simple_strtol(pValueStr, 0, 10);
-		if (Value == 0)
-		{
-			pAd->HTCEnable = FALSE;
-		}
-		else
-		{
-            pAd->HTCEnable = TRUE;
-		}
-		DBGPRINT(RT_DEBUG_TRACE, ("HT: Tx +HTC frame = %s\n", (Value==0) ? "Disable" : "Enable"));
-	}
-
-	// Enable HT Link Adaptation Control
-	if (RTMPGetKeyParameter("HT_LinkAdapt", pValueStr, 25, pInput, TRUE))
-	{
-		Value = simple_strtol(pValueStr, 0, 10);
-		if (Value == 0)
-		{
-			pAd->bLinkAdapt = FALSE;
-		}
-		else
-		{
-			pAd->HTCEnable = TRUE;
-			pAd->bLinkAdapt = TRUE;
-		}
-		DBGPRINT(RT_DEBUG_TRACE, ("HT: Link Adaptation Control = %s\n", (Value==0) ? "Disable" : "Enable(+HTC)"));
-	}
-
-	// Reverse Direction Mechanism
-    if (RTMPGetKeyParameter("HT_RDG", pValueStr, 25, pInput, TRUE))
-	{
-		Value = simple_strtol(pValueStr, 0, 10);
-		if (Value == 0)
-		{
-			pAd->CommonCfg.bRdg = FALSE;
-		}
-		else
-		{
-			pAd->HTCEnable = TRUE;
-            pAd->CommonCfg.bRdg = TRUE;
-		}
-		DBGPRINT(RT_DEBUG_TRACE, ("HT: RDG = %s\n", (Value==0) ? "Disable" : "Enable(+HTC)"));
-	}
-
-
-
-
-	// Tx A-MSUD ?
-    if (RTMPGetKeyParameter("HT_AMSDU", pValueStr, 25, pInput, TRUE))
-	{
-		Value = simple_strtol(pValueStr, 0, 10);
-		if (Value == 0)
-		{
-			pAd->CommonCfg.BACapability.field.AmsduEnable = FALSE;
-		}
-		else
-		{
-            pAd->CommonCfg.BACapability.field.AmsduEnable = TRUE;
-		}
-		DBGPRINT(RT_DEBUG_TRACE, ("HT: Tx A-MSDU = %s\n", (Value==0) ? "Disable" : "Enable"));
-	}
-
-	// MPDU Density
-    if (RTMPGetKeyParameter("HT_MpduDensity", pValueStr, 25, pInput, TRUE))
-	{
-		Value = simple_strtol(pValueStr, 0, 10);
-		if (Value <=7 && Value >= 0)
-		{
-			pAd->CommonCfg.BACapability.field.MpduDensity = Value;
-			DBGPRINT(RT_DEBUG_TRACE, ("HT: MPDU Density = %d\n", (INT) Value));
-		}
-		else
-		{
-			pAd->CommonCfg.BACapability.field.MpduDensity = 4;
-			DBGPRINT(RT_DEBUG_TRACE, ("HT: MPDU Density = %d (Default)\n", 4));
-		}
-	}
-
-	// Max Rx BA Window Size
-    if (RTMPGetKeyParameter("HT_BAWinSize", pValueStr, 25, pInput, TRUE))
-	{
-		Value = simple_strtol(pValueStr, 0, 10);
-
-		if (Value >=1 && Value <= 64)
-		{
-			pAd->CommonCfg.REGBACapability.field.RxBAWinLimit = Value;
-			pAd->CommonCfg.BACapability.field.RxBAWinLimit = Value;
-			DBGPRINT(RT_DEBUG_TRACE, ("HT: BA Windw Size = %d\n", (INT) Value));
-		}
-		else
-		{
-            pAd->CommonCfg.REGBACapability.field.RxBAWinLimit = 64;
-			pAd->CommonCfg.BACapability.field.RxBAWinLimit = 64;
-			DBGPRINT(RT_DEBUG_TRACE, ("HT: BA Windw Size = 64 (Defualt)\n"));
-		}
-
-	}
-
-	// Guard Interval
-	if (RTMPGetKeyParameter("HT_GI", pValueStr, 25, pInput, TRUE))
-	{
-		Value = simple_strtol(pValueStr, 0, 10);
-
-		if (Value == GI_400)
-		{
-			pAd->CommonCfg.RegTransmitSetting.field.ShortGI = GI_400;
-		}
-		else
-		{
-			pAd->CommonCfg.RegTransmitSetting.field.ShortGI = GI_800;
-		}
-
-		DBGPRINT(RT_DEBUG_TRACE, ("HT: Guard Interval = %s\n", (Value==GI_400) ? "400" : "800" ));
-	}
-
-	// HT Operation Mode : Mixed Mode , Green Field
-	if (RTMPGetKeyParameter("HT_OpMode", pValueStr, 25, pInput, TRUE))
-	{
-		Value = simple_strtol(pValueStr, 0, 10);
-
-		if (Value == HTMODE_GF)
-		{
-
-			pAd->CommonCfg.RegTransmitSetting.field.HTMODE  = HTMODE_GF;
-		}
-		else
-		{
-			pAd->CommonCfg.RegTransmitSetting.field.HTMODE  = HTMODE_MM;
-		}
-
-		DBGPRINT(RT_DEBUG_TRACE, ("HT: Operate Mode = %s\n", (Value==HTMODE_GF) ? "Green Field" : "Mixed Mode" ));
-	}
-
-	// Fixed Tx mode : CCK, OFDM
-	if (RTMPGetKeyParameter("FixedTxMode", pValueStr, 25, pInput, TRUE))
-	{
-		UCHAR	fix_tx_mode;
-
-#ifdef CONFIG_STA_SUPPORT
-		IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		{
-			fix_tx_mode = FIXED_TXMODE_HT;
-
-			if (strcmp(pValueStr, "OFDM") == 0 || strcmp(pValueStr, "ofdm") == 0)
-			{
-				fix_tx_mode = FIXED_TXMODE_OFDM;
-			}
-			else if (strcmp(pValueStr, "CCK") == 0 || strcmp(pValueStr, "cck") == 0)
-			{
-		        fix_tx_mode = FIXED_TXMODE_CCK;
-			}
-			else if (strcmp(pValueStr, "HT") == 0 || strcmp(pValueStr, "ht") == 0)
-			{
-		        fix_tx_mode = FIXED_TXMODE_HT;
-		}
-		else
-		{
-				Value = simple_strtol(pValueStr, 0, 10);
-				// 1 : CCK
-				// 2 : OFDM
-				// otherwise : HT
-				if (Value == FIXED_TXMODE_CCK || Value == FIXED_TXMODE_OFDM)
-					fix_tx_mode = Value;
-				else
-					fix_tx_mode = FIXED_TXMODE_HT;
-		}
-
-			pAd->StaCfg.DesiredTransmitSetting.field.FixedTxMode = fix_tx_mode;
-			DBGPRINT(RT_DEBUG_TRACE, ("Fixed Tx Mode = %d\n", fix_tx_mode));
-
-		}
-#endif // CONFIG_STA_SUPPORT //
-	}
-
-
-	// Channel Width
-	if (RTMPGetKeyParameter("HT_BW", pValueStr, 25, pInput, TRUE))
-	{
-		Value = simple_strtol(pValueStr, 0, 10);
-
-		if (Value == BW_40)
-		{
-			pAd->CommonCfg.RegTransmitSetting.field.BW  = BW_40;
-		}
-		else
-		{
-            pAd->CommonCfg.RegTransmitSetting.field.BW  = BW_20;
-		}
-
-#ifdef MCAST_RATE_SPECIFIC
-		pAd->CommonCfg.MCastPhyMode.field.BW = pAd->CommonCfg.RegTransmitSetting.field.BW;
-#endif // MCAST_RATE_SPECIFIC //
-
-		DBGPRINT(RT_DEBUG_TRACE, ("HT: Channel Width = %s\n", (Value==BW_40) ? "40 MHz" : "20 MHz" ));
-	}
-
-	if (RTMPGetKeyParameter("HT_EXTCHA", pValueStr, 25, pInput, TRUE))
-	{
-		Value = simple_strtol(pValueStr, 0, 10);
-
-		if (Value == 0)
-		{
-
-			pAd->CommonCfg.RegTransmitSetting.field.EXTCHA  = EXTCHA_BELOW;
-		}
-		else
-		{
-            pAd->CommonCfg.RegTransmitSetting.field.EXTCHA = EXTCHA_ABOVE;
-		}
-
-		DBGPRINT(RT_DEBUG_TRACE, ("HT: Ext Channel = %s\n", (Value==0) ? "BELOW" : "ABOVE" ));
-	}
-
-	// MSC
-	if (RTMPGetKeyParameter("HT_MCS", pValueStr, 50, pInput, TRUE))
-	{
-
-#ifdef CONFIG_STA_SUPPORT
-		IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		{
-			Value = simple_strtol(pValueStr, 0, 10);
-
-//			if ((Value >= 0 && Value <= 15) || (Value == 32))
-			if ((Value >= 0 && Value <= 23) || (Value == 32)) // 3*3
-		{
-				pAd->StaCfg.DesiredTransmitSetting.field.MCS  = Value;
-				pAd->StaCfg.bAutoTxRateSwitch = FALSE;
-				DBGPRINT(RT_DEBUG_TRACE, ("HT: MCS = %d\n", pAd->StaCfg.DesiredTransmitSetting.field.MCS));
-		}
-		else
-		{
-				pAd->StaCfg.DesiredTransmitSetting.field.MCS  = MCS_AUTO;
-				pAd->StaCfg.bAutoTxRateSwitch = TRUE;
-				DBGPRINT(RT_DEBUG_TRACE, ("HT: MCS = AUTO\n"));
-		}
-	}
-#endif // CONFIG_STA_SUPPORT //
-	}
-
-	// STBC
-    if (RTMPGetKeyParameter("HT_STBC", pValueStr, 25, pInput, TRUE))
-	{
-		Value = simple_strtol(pValueStr, 0, 10);
-		if (Value == STBC_USE)
-		{
-			pAd->CommonCfg.RegTransmitSetting.field.STBC = STBC_USE;
-		}
-		else
-		{
-			pAd->CommonCfg.RegTransmitSetting.field.STBC = STBC_NONE;
-		}
-		DBGPRINT(RT_DEBUG_TRACE, ("HT: STBC = %d\n", pAd->CommonCfg.RegTransmitSetting.field.STBC));
-	}
-
-	// 40_Mhz_Intolerant
-	if (RTMPGetKeyParameter("HT_40MHZ_INTOLERANT", pValueStr, 25, pInput, TRUE))
-	{
-		Value = simple_strtol(pValueStr, 0, 10);
-		if (Value == 0)
-		{
-			pAd->CommonCfg.bForty_Mhz_Intolerant = FALSE;
-		}
-		else
-		{
-			pAd->CommonCfg.bForty_Mhz_Intolerant = TRUE;
-		}
-		DBGPRINT(RT_DEBUG_TRACE, ("HT: 40MHZ INTOLERANT = %d\n", pAd->CommonCfg.bForty_Mhz_Intolerant));
-	}
-	//HT_TxStream
-	if(RTMPGetKeyParameter("HT_TxStream", pValueStr, 10, pInput, TRUE))
-	{
-		switch (simple_strtol(pValueStr, 0, 10))
-		{
-			case 1:
-				pAd->CommonCfg.TxStream = 1;
-				break;
-			case 2:
-				pAd->CommonCfg.TxStream = 2;
-				break;
-			case 3: // 3*3
-			default:
-				pAd->CommonCfg.TxStream = 3;
-
-				if (pAd->MACVersion < RALINK_2883_VERSION)
-					pAd->CommonCfg.TxStream = 2; // only 2 tx streams for RT2860 series
-				break;
-		}
-		DBGPRINT(RT_DEBUG_TRACE, ("HT: Tx Stream = %d\n", pAd->CommonCfg.TxStream));
-	}
-	//HT_RxStream
-	if(RTMPGetKeyParameter("HT_RxStream", pValueStr, 10, pInput, TRUE))
-	{
-		switch (simple_strtol(pValueStr, 0, 10))
-		{
-			case 1:
-				pAd->CommonCfg.RxStream = 1;
-				break;
-			case 2:
-				pAd->CommonCfg.RxStream = 2;
-				break;
-			case 3:
-			default:
-				pAd->CommonCfg.RxStream = 3;
-
-				if (pAd->MACVersion < RALINK_2883_VERSION)
-					pAd->CommonCfg.RxStream = 2; // only 2 rx streams for RT2860 series
-				break;
-		}
-		DBGPRINT(RT_DEBUG_TRACE, ("HT: Rx Stream = %d\n", pAd->CommonCfg.RxStream));
-	}
-	//2008/11/05: KH add to support Antenna power-saving of AP<--
-	//Green AP
-	if(RTMPGetKeyParameter("GreenAP", pValueStr, 10, pInput, TRUE))
-	{
-		Value = simple_strtol(pValueStr, 0, 10);
-		if (Value == 0)
-		{
-			pAd->CommonCfg.bGreenAPEnable = FALSE;
-		}
-		else
-		{
-			pAd->CommonCfg.bGreenAPEnable = TRUE;
-		}
-		DBGPRINT(RT_DEBUG_TRACE, ("HT: Green AP= %d\n", pAd->CommonCfg.bGreenAPEnable));
-	}
-
-	// HT_DisallowTKIP
-	if (RTMPGetKeyParameter("HT_DisallowTKIP", pValueStr, 25, pInput, TRUE))
-	{
-		Value = simple_strtol(pValueStr, 0, 10);
-
-		if (Value == 1)
-		{
-			pAd->CommonCfg.HT_DisallowTKIP = TRUE;
-		}
-		else
-		{
-			pAd->CommonCfg.HT_DisallowTKIP = FALSE;
-		}
-
-		DBGPRINT(RT_DEBUG_TRACE, ("HT: Disallow TKIP mode = %s\n", (pAd->CommonCfg.HT_DisallowTKIP == TRUE) ? "ON" : "OFF" ));
-	}
-
-
-	//2008/11/05:KH add to support Antenna power-saving of AP-->
-}
-#endif // DOT11_N_SUPPORT //
-
-
-NDIS_STATUS	RTMPSetProfileParameters(
-	IN RTMP_ADAPTER *pAd,
-	IN PSTRING	pBuffer)
-{
-	PSTRING					tmpbuf;
-	ULONG					RtsThresh;
-	ULONG					FragThresh;
-	PSTRING					macptr;
-	INT						i = 0, retval;
-	tmpbuf = kmalloc(MAX_PARAM_BUFFER_SIZE, MEM_ALLOC_FLAG);
-	if(tmpbuf == NULL)
-		return NDIS_STATUS_FAILURE;
-
-	do
-	{
-		// set file parameter to portcfg
-		//CountryRegion
-		if(RTMPGetKeyParameter("CountryRegion", tmpbuf, 25, pBuffer, TRUE))
-		{
-			retval = RT_CfgSetCountryRegion(pAd, tmpbuf, BAND_24G);
-			DBGPRINT(RT_DEBUG_TRACE, ("CountryRegion=%d\n", pAd->CommonCfg.CountryRegion));
-		}
-		//CountryRegionABand
-		if(RTMPGetKeyParameter("CountryRegionABand", tmpbuf, 25, pBuffer, TRUE))
-		{
-			retval = RT_CfgSetCountryRegion(pAd, tmpbuf, BAND_5G);
-			DBGPRINT(RT_DEBUG_TRACE, ("CountryRegionABand=%d\n", pAd->CommonCfg.CountryRegionForABand));
-		}
-#ifdef RTMP_EFUSE_SUPPORT
-#ifdef RT30xx
-		//EfuseBufferMode
-		if(RTMPGetKeyParameter("EfuseBufferMode", tmpbuf, 25, pBuffer, TRUE))
-		{
-			pAd->bEEPROMFile = (UCHAR) simple_strtol(tmpbuf, 0, 10);
-			DBGPRINT(RT_DEBUG_TRACE, ("EfuseBufferMode=%d\n", pAd->bUseEfuse));
-		}
-#endif // RT30xx //
-#endif // RTMP_EFUSE_SUPPORT //
-		//CountryCode
-		if(RTMPGetKeyParameter("CountryCode", tmpbuf, 25, pBuffer, TRUE))
-		{
-			NdisMoveMemory(pAd->CommonCfg.CountryCode, tmpbuf , 2);
-#ifdef CONFIG_STA_SUPPORT
-#ifdef EXT_BUILD_CHANNEL_LIST
-			IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-				NdisMoveMemory(pAd->StaCfg.StaOriCountryCode, tmpbuf , 2);
-#endif // EXT_BUILD_CHANNEL_LIST //
-#endif // CONFIG_STA_SUPPORT //
-			if (strlen((PSTRING) pAd->CommonCfg.CountryCode) != 0)
-			{
-				pAd->CommonCfg.bCountryFlag = TRUE;
-			}
-			DBGPRINT(RT_DEBUG_TRACE, ("CountryCode=%s\n", pAd->CommonCfg.CountryCode));
-		}
-		//ChannelGeography
-		if(RTMPGetKeyParameter("ChannelGeography", tmpbuf, 25, pBuffer, TRUE))
-		{
-			UCHAR Geography = (UCHAR) simple_strtol(tmpbuf, 0, 10);
-			if (Geography <= BOTH)
-			{
-				pAd->CommonCfg.Geography = Geography;
-				pAd->CommonCfg.CountryCode[2] =
-					(pAd->CommonCfg.Geography == BOTH) ? ' ' : ((pAd->CommonCfg.Geography == IDOR) ? 'I' : 'O');
-#ifdef CONFIG_STA_SUPPORT
-#ifdef EXT_BUILD_CHANNEL_LIST
-				IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-					pAd->StaCfg.StaOriGeography = pAd->CommonCfg.Geography;
-#endif // EXT_BUILD_CHANNEL_LIST //
-#endif // CONFIG_STA_SUPPORT //
-				DBGPRINT(RT_DEBUG_TRACE, ("ChannelGeography=%d\n", pAd->CommonCfg.Geography));
-			}
-		}
-		else
-		{
-			pAd->CommonCfg.Geography = BOTH;
-			pAd->CommonCfg.CountryCode[2] = ' ';
-		}
-
-
-#ifdef CONFIG_STA_SUPPORT
-		IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		{
-			//SSID
-			if (RTMPGetKeyParameter("SSID", tmpbuf, 256, pBuffer, FALSE))
-			{
-				if (strlen(tmpbuf) <= 32)
-				{
-						pAd->CommonCfg.SsidLen = (UCHAR) strlen(tmpbuf);
-					NdisZeroMemory(pAd->CommonCfg.Ssid, NDIS_802_11_LENGTH_SSID);
-					NdisMoveMemory(pAd->CommonCfg.Ssid, tmpbuf, pAd->CommonCfg.SsidLen);
-					pAd->MlmeAux.AutoReconnectSsidLen = pAd->CommonCfg.SsidLen;
-					NdisZeroMemory(pAd->MlmeAux.AutoReconnectSsid, NDIS_802_11_LENGTH_SSID);
-					NdisMoveMemory(pAd->MlmeAux.AutoReconnectSsid, tmpbuf, pAd->MlmeAux.AutoReconnectSsidLen);
-					pAd->MlmeAux.SsidLen = pAd->CommonCfg.SsidLen;
-					NdisZeroMemory(pAd->MlmeAux.Ssid, NDIS_802_11_LENGTH_SSID);
-					NdisMoveMemory(pAd->MlmeAux.Ssid, tmpbuf, pAd->MlmeAux.SsidLen);
-					DBGPRINT(RT_DEBUG_TRACE, ("%s::(SSID=%s)\n", __FUNCTION__, tmpbuf));
-				}
-			}
-		}
-#endif // CONFIG_STA_SUPPORT //
-
-#ifdef CONFIG_STA_SUPPORT
-		IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		{
-			//NetworkType
-			if (RTMPGetKeyParameter("NetworkType", tmpbuf, 25, pBuffer, TRUE))
-			{
-				pAd->bConfigChanged = TRUE;
-				if (strcmp(tmpbuf, "Adhoc") == 0)
-					pAd->StaCfg.BssType = BSS_ADHOC;
-				else //Default Infrastructure mode
-					pAd->StaCfg.BssType = BSS_INFRA;
-				// Reset Ralink supplicant to not use, it will be set to start when UI set PMK key
-				pAd->StaCfg.WpaState = SS_NOTUSE;
-				DBGPRINT(RT_DEBUG_TRACE, ("%s::(NetworkType=%d)\n", __FUNCTION__, pAd->StaCfg.BssType));
-			}
-		}
-#ifdef RTMP_MAC_PCI
-		//NewPCIePS
-		if(RTMPGetKeyParameter("NewPCIePS", tmpbuf, 10, pBuffer, TRUE))
-		{
-			UCHAR temp_buffer = (UCHAR) simple_strtol(tmpbuf, 0, 10);
-			if(temp_buffer>0)
-				pAd->StaCfg.PSControl.field.EnableNewPS=TRUE;
-				else
-					pAd->StaCfg.PSControl.field.EnableNewPS=FALSE;
-			DBGPRINT(RT_DEBUG_TRACE, ("NewPCIePS=%d\n", pAd->StaCfg.PSControl.field.EnableNewPS));
-		}
-#endif // RTMP_MAC_PCI //
-#ifdef RT3090
-		//PCIePowerLevel
-
-		if(RTMPGetKeyParameter("PCIePowerLevel", tmpbuf, 10, pBuffer, TRUE))
-		{
-			pAd->StaCfg.PSControl.field.rt30xxPowerMode = (UCHAR) simple_strtol(tmpbuf, 0, 10);
-			DBGPRINT(RT_DEBUG_TRACE, ("PCIePowerLevel=%d\n", pAd->StaCfg.PSControl.field.rt30xxPowerMode));
-		}
-		//FollowHostASPM
-		if(RTMPGetKeyParameter("FollowHostASPM", tmpbuf, 10, pBuffer, TRUE))
-		{
-			UCHAR temp_buffer = (UCHAR) simple_strtol(tmpbuf, 0, 10);
-
-			if(temp_buffer>0)
-				pAd->StaCfg.PSControl.field.rt30xxFollowHostASPM=TRUE;
-				else
-					pAd->StaCfg.PSControl.field.rt30xxFollowHostASPM=FALSE;
-			DBGPRINT(RT_DEBUG_TRACE, ("rt30xxFollowHostASPM=%d\n", pAd->StaCfg.PSControl.field.rt30xxFollowHostASPM));
-		}
-		//ForceTestASPM
-		if(RTMPGetKeyParameter("ForceTestASPM", tmpbuf, 10, pBuffer, TRUE))
-		{
-			UCHAR temp_buffer = (UCHAR) simple_strtol(tmpbuf, 0, 10);
-
-			if(temp_buffer>0)
-				pAd->StaCfg.PSControl.field.rt30xxForceASPMTest=TRUE;
-				else
-					pAd->StaCfg.PSControl.field.rt30xxForceASPMTest=FALSE;
-			DBGPRINT(RT_DEBUG_TRACE, ("rt30xxForceASPM=%d\n", pAd->StaCfg.PSControl.field.rt30xxForceASPMTest));
-		}
-#endif // RT3090 //
-#endif // CONFIG_STA_SUPPORT //
-		//Channel
-		if(RTMPGetKeyParameter("Channel", tmpbuf, 10, pBuffer, TRUE))
-		{
-			pAd->CommonCfg.Channel = (UCHAR) simple_strtol(tmpbuf, 0, 10);
-			DBGPRINT(RT_DEBUG_TRACE, ("Channel=%d\n", pAd->CommonCfg.Channel));
-		}
-		//WirelessMode
-		if(RTMPGetKeyParameter("WirelessMode", tmpbuf, 10, pBuffer, TRUE))
-		{
-			RT_CfgSetWirelessMode(pAd, tmpbuf);
-			DBGPRINT(RT_DEBUG_TRACE, ("PhyMode=%d\n", pAd->CommonCfg.PhyMode));
-		}
-	    //BasicRate
-		if(RTMPGetKeyParameter("BasicRate", tmpbuf, 10, pBuffer, TRUE))
-		{
-			pAd->CommonCfg.BasicRateBitmap = (ULONG) simple_strtol(tmpbuf, 0, 10);
-			DBGPRINT(RT_DEBUG_TRACE, ("BasicRate=%ld\n", pAd->CommonCfg.BasicRateBitmap));
-		}
-		//BeaconPeriod
-		if(RTMPGetKeyParameter("BeaconPeriod", tmpbuf, 10, pBuffer, TRUE))
-		{
-			pAd->CommonCfg.BeaconPeriod = (USHORT) simple_strtol(tmpbuf, 0, 10);
-			DBGPRINT(RT_DEBUG_TRACE, ("BeaconPeriod=%d\n", pAd->CommonCfg.BeaconPeriod));
-		}
-	    //TxPower
-		if(RTMPGetKeyParameter("TxPower", tmpbuf, 10, pBuffer, TRUE))
-		{
-			pAd->CommonCfg.TxPowerPercentage = (ULONG) simple_strtol(tmpbuf, 0, 10);
-#ifdef CONFIG_STA_SUPPORT
-			IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-				pAd->CommonCfg.TxPowerDefault = pAd->CommonCfg.TxPowerPercentage;
-#endif // CONFIG_STA_SUPPORT //
-			DBGPRINT(RT_DEBUG_TRACE, ("TxPower=%ld\n", pAd->CommonCfg.TxPowerPercentage));
-		}
-		//BGProtection
-		if(RTMPGetKeyParameter("BGProtection", tmpbuf, 10, pBuffer, TRUE))
-		{
-	//#if 0	//#ifndef WIFI_TEST
-	//		pAd->CommonCfg.UseBGProtection = 2;// disable b/g protection for throughput test
-	//#else
-			switch (simple_strtol(tmpbuf, 0, 10))
-			{
-				case 1: //Always On
-					pAd->CommonCfg.UseBGProtection = 1;
-					break;
-				case 2: //Always OFF
-					pAd->CommonCfg.UseBGProtection = 2;
-					break;
-				case 0: //AUTO
-				default:
-					pAd->CommonCfg.UseBGProtection = 0;
-					break;
-			}
-	//#endif
-			DBGPRINT(RT_DEBUG_TRACE, ("BGProtection=%ld\n", pAd->CommonCfg.UseBGProtection));
-		}
-		//OLBCDetection
-		if(RTMPGetKeyParameter("DisableOLBC", tmpbuf, 10, pBuffer, TRUE))
-		{
-			switch (simple_strtol(tmpbuf, 0, 10))
-			{
-				case 1: //disable OLBC Detection
-					pAd->CommonCfg.DisableOLBCDetect = 1;
-					break;
-				case 0: //enable OLBC Detection
-					pAd->CommonCfg.DisableOLBCDetect = 0;
-					break;
-				default:
-					pAd->CommonCfg.DisableOLBCDetect= 0;
-					break;
-			}
-			DBGPRINT(RT_DEBUG_TRACE, ("OLBCDetection=%ld\n", pAd->CommonCfg.DisableOLBCDetect));
-		}
-		//TxPreamble
-		if(RTMPGetKeyParameter("TxPreamble", tmpbuf, 10, pBuffer, TRUE))
-		{
-			switch (simple_strtol(tmpbuf, 0, 10))
-			{
-				case Rt802_11PreambleShort:
-					pAd->CommonCfg.TxPreamble = Rt802_11PreambleShort;
-					break;
-				case Rt802_11PreambleLong:
-				default:
-					pAd->CommonCfg.TxPreamble = Rt802_11PreambleLong;
-					break;
-			}
-			DBGPRINT(RT_DEBUG_TRACE, ("TxPreamble=%ld\n", pAd->CommonCfg.TxPreamble));
-		}
-		//RTSThreshold
-		if(RTMPGetKeyParameter("RTSThreshold", tmpbuf, 10, pBuffer, TRUE))
-		{
-			RtsThresh = simple_strtol(tmpbuf, 0, 10);
-			if( (RtsThresh >= 1) && (RtsThresh <= MAX_RTS_THRESHOLD) )
-				pAd->CommonCfg.RtsThreshold  = (USHORT)RtsThresh;
-			else
-				pAd->CommonCfg.RtsThreshold = MAX_RTS_THRESHOLD;
-
-			DBGPRINT(RT_DEBUG_TRACE, ("RTSThreshold=%d\n", pAd->CommonCfg.RtsThreshold));
-		}
-		//FragThreshold
-		if(RTMPGetKeyParameter("FragThreshold", tmpbuf, 10, pBuffer, TRUE))
-		{
-			FragThresh = simple_strtol(tmpbuf, 0, 10);
-			pAd->CommonCfg.bUseZeroToDisableFragment = FALSE;
-
-			if (FragThresh > MAX_FRAG_THRESHOLD || FragThresh < MIN_FRAG_THRESHOLD)
-			{ //illegal FragThresh so we set it to default
-				pAd->CommonCfg.FragmentThreshold = MAX_FRAG_THRESHOLD;
-				pAd->CommonCfg.bUseZeroToDisableFragment = TRUE;
-			}
-			else if (FragThresh % 2 == 1)
-			{
-				// The length of each fragment shall always be an even number of octets, except for the last fragment
-				// of an MSDU or MMPDU, which may be either an even or an odd number of octets.
-				pAd->CommonCfg.FragmentThreshold = (USHORT)(FragThresh - 1);
-			}
-			else
-			{
-				pAd->CommonCfg.FragmentThreshold = (USHORT)FragThresh;
-			}
-			//pAd->CommonCfg.AllowFragSize = (pAd->CommonCfg.FragmentThreshold) - LENGTH_802_11 - LENGTH_CRC;
-			DBGPRINT(RT_DEBUG_TRACE, ("FragThreshold=%d\n", pAd->CommonCfg.FragmentThreshold));
-		}
-		//TxBurst
-		if(RTMPGetKeyParameter("TxBurst", tmpbuf, 10, pBuffer, TRUE))
-		{
-	//#ifdef WIFI_TEST
-	//						pAd->CommonCfg.bEnableTxBurst = FALSE;
-	//#else
-			if(simple_strtol(tmpbuf, 0, 10) != 0)  //Enable
-				pAd->CommonCfg.bEnableTxBurst = TRUE;
-			else //Disable
-				pAd->CommonCfg.bEnableTxBurst = FALSE;
-	//#endif
-			DBGPRINT(RT_DEBUG_TRACE, ("TxBurst=%d\n", pAd->CommonCfg.bEnableTxBurst));
-		}
-
-#ifdef AGGREGATION_SUPPORT
-		//PktAggregate
-		if(RTMPGetKeyParameter("PktAggregate", tmpbuf, 10, pBuffer, TRUE))
-		{
-			if(simple_strtol(tmpbuf, 0, 10) != 0)  //Enable
-				pAd->CommonCfg.bAggregationCapable = TRUE;
-			else //Disable
-				pAd->CommonCfg.bAggregationCapable = FALSE;
-#ifdef PIGGYBACK_SUPPORT
-			pAd->CommonCfg.bPiggyBackCapable = pAd->CommonCfg.bAggregationCapable;
-#endif // PIGGYBACK_SUPPORT //
-			DBGPRINT(RT_DEBUG_TRACE, ("PktAggregate=%d\n", pAd->CommonCfg.bAggregationCapable));
-		}
-#else
-		pAd->CommonCfg.bAggregationCapable = FALSE;
-		pAd->CommonCfg.bPiggyBackCapable = FALSE;
-#endif // AGGREGATION_SUPPORT //
-
-		// WmmCapable
-
-#ifdef CONFIG_STA_SUPPORT
-		IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-			rtmp_read_sta_wmm_parms_from_file(pAd, tmpbuf, pBuffer);
-#endif // CONFIG_STA_SUPPORT //
-
-		//ShortSlot
-		if(RTMPGetKeyParameter("ShortSlot", tmpbuf, 10, pBuffer, TRUE))
-		{
-			RT_CfgSetShortSlot(pAd, tmpbuf);
-			DBGPRINT(RT_DEBUG_TRACE, ("ShortSlot=%d\n", pAd->CommonCfg.bUseShortSlotTime));
-		}
-		//IEEE80211H
-		if(RTMPGetKeyParameter("IEEE80211H", tmpbuf, 10, pBuffer, TRUE))
-		{
-		    for (i = 0, macptr = rstrtok(tmpbuf,";"); macptr; macptr = rstrtok(NULL,";"), i++)
-		    {
-				if(simple_strtol(macptr, 0, 10) != 0)  //Enable
-					pAd->CommonCfg.bIEEE80211H = TRUE;
-				else //Disable
-					pAd->CommonCfg.bIEEE80211H = FALSE;
-
-				DBGPRINT(RT_DEBUG_TRACE, ("IEEE80211H=%d\n", pAd->CommonCfg.bIEEE80211H));
-		    }
-		}
-		//CSPeriod
-		if(RTMPGetKeyParameter("CSPeriod", tmpbuf, 10, pBuffer, TRUE))
-		{
-		    if(simple_strtol(tmpbuf, 0, 10) != 0)
-				pAd->CommonCfg.RadarDetect.CSPeriod = simple_strtol(tmpbuf, 0, 10);
-			else
-				pAd->CommonCfg.RadarDetect.CSPeriod = 0;
-
-				DBGPRINT(RT_DEBUG_TRACE, ("CSPeriod=%d\n", pAd->CommonCfg.RadarDetect.CSPeriod));
-		}
-
-#ifdef MERGE_ARCH_TEAM
-		// DfsLowerLimit
-		if(RTMPGetKeyParameter("DfsLowerLimit", tmpbuf, 10, pBuffer, TRUE))
-		{
-			if(simple_strtol(tmpbuf, 0, 10) != 0)
-				pAd->CommonCfg.RadarDetect.DfsLowerLimit = simple_strtol(tmpbuf, 0, 10);
-
-			DBGPRINT(RT_DEBUG_TRACE, ("DfsLowerLimit=%ld\n", pAd->CommonCfg.RadarDetect.DfsLowerLimit));
-		}
-
-		// DfsUpperLimit
-		if(RTMPGetKeyParameter("DfsUpperLimit", tmpbuf, 10, pBuffer, TRUE))
-		{
-			if(simple_strtol(tmpbuf, 0, 10) != 0)
-				pAd->CommonCfg.RadarDetect.DfsUpperLimit = simple_strtol(tmpbuf, 0, 10);
-
-			DBGPRINT(RT_DEBUG_TRACE, ("DfsUpperLimit=%ld\n", pAd->CommonCfg.RadarDetect.DfsUpperLimit));
-		}
-
-		// FixDfsLimit
-		if(RTMPGetKeyParameter("FixDfsLimit", tmpbuf, 10, pBuffer, TRUE))
-		{
-		    if(simple_strtol(tmpbuf, 0, 10) != 0)
-				pAd->CommonCfg.RadarDetect.FixDfsLimit = TRUE;
-			else
-				pAd->CommonCfg.RadarDetect.FixDfsLimit = FALSE;
-
-			DBGPRINT(RT_DEBUG_TRACE, ("FixDfsLimit=%d\n", pAd->CommonCfg.RadarDetect.FixDfsLimit));
-		}
-
-		// LongPulseRadarTh
-		if(RTMPGetKeyParameter("LongPulseRadarTh", tmpbuf, 10, pBuffer, TRUE))
-		{
-		    if(simple_strtol(tmpbuf, 0, 10) != 0)
-				pAd->CommonCfg.RadarDetect.LongPulseRadarTh = simple_strtol(tmpbuf, 0, 10);
-
-			DBGPRINT(RT_DEBUG_TRACE, ("LongPulseRadarTh=%d\n", pAd->CommonCfg.RadarDetect.LongPulseRadarTh));
-		}
-
-		// AvgRssiReq
-		if(RTMPGetKeyParameter("AvgRssiReq", tmpbuf, 10, pBuffer, TRUE))
-		{
-			if(simple_strtol(tmpbuf, 0, 10) != 0)
-				pAd->CommonCfg.RadarDetect.AvgRssiReq = simple_strtol(tmpbuf, 0, 10);
-
-			DBGPRINT(RT_DEBUG_TRACE, ("AvgRssiReq=%d\n", pAd->CommonCfg.RadarDetect.AvgRssiReq));
-		}
-
-#endif // MERGE_ARCH_TEAM //
-
-		//RDRegion
-		if(RTMPGetKeyParameter("RDRegion", tmpbuf, 128, pBuffer, TRUE))
-		{
-						RADAR_DETECT_STRUCT	*pRadarDetect = &pAd->CommonCfg.RadarDetect;
-			if ((strncmp(tmpbuf, "JAP_W53", 7) == 0) || (strncmp(tmpbuf, "jap_w53", 7) == 0))
-			{
-							pRadarDetect->RDDurRegion = JAP_W53;
-							pRadarDetect->DfsSessionTime = 15;
-			}
-			else if ((strncmp(tmpbuf, "JAP_W56", 7) == 0) || (strncmp(tmpbuf, "jap_w56", 7) == 0))
-			{
-							pRadarDetect->RDDurRegion = JAP_W56;
-							pRadarDetect->DfsSessionTime = 13;
-			}
-			else if ((strncmp(tmpbuf, "JAP", 3) == 0) || (strncmp(tmpbuf, "jap", 3) == 0))
-			{
-							pRadarDetect->RDDurRegion = JAP;
-							pRadarDetect->DfsSessionTime = 5;
-			}
-			else  if ((strncmp(tmpbuf, "FCC", 3) == 0) || (strncmp(tmpbuf, "fcc", 3) == 0))
-			{
-							pRadarDetect->RDDurRegion = FCC;
-							pRadarDetect->DfsSessionTime = 5;
-#ifdef DFS_FCC_BW40_FIX
-							pRadarDetect->DfsSessionFccOff = 0;
-#endif // DFS_FCC_BW40_FIX //
-			}
-			else if ((strncmp(tmpbuf, "CE", 2) == 0) || (strncmp(tmpbuf, "ce", 2) == 0))
-			{
-							pRadarDetect->RDDurRegion = CE;
-							pRadarDetect->DfsSessionTime = 13;
-			}
-			else
-			{
-							pRadarDetect->RDDurRegion = CE;
-							pRadarDetect->DfsSessionTime = 13;
-			}
-
-						DBGPRINT(RT_DEBUG_TRACE, ("RDRegion=%d\n", pRadarDetect->RDDurRegion));
-		}
-		else
-		{
-			pAd->CommonCfg.RadarDetect.RDDurRegion = CE;
-			pAd->CommonCfg.RadarDetect.DfsSessionTime = 13;
-		}
-
-		//WirelessEvent
-		if(RTMPGetKeyParameter("WirelessEvent", tmpbuf, 10, pBuffer, TRUE))
-		{
-#if WIRELESS_EXT >= 15
-		    if(simple_strtol(tmpbuf, 0, 10) != 0)
-				pAd->CommonCfg.bWirelessEvent = simple_strtol(tmpbuf, 0, 10);
-			else
-				pAd->CommonCfg.bWirelessEvent = 0;	// disable
-#else
-			pAd->CommonCfg.bWirelessEvent = 0;	// disable
-#endif
-				DBGPRINT(RT_DEBUG_TRACE, ("WirelessEvent=%d\n", pAd->CommonCfg.bWirelessEvent));
-		}
-		if(RTMPGetKeyParameter("WiFiTest", tmpbuf, 10, pBuffer, TRUE))
-		{
-		    if(simple_strtol(tmpbuf, 0, 10) != 0)
-				pAd->CommonCfg.bWiFiTest= simple_strtol(tmpbuf, 0, 10);
-			else
-				pAd->CommonCfg.bWiFiTest = 0;	// disable
-
-				DBGPRINT(RT_DEBUG_TRACE, ("WiFiTest=%d\n", pAd->CommonCfg.bWiFiTest));
-		}
-		//AuthMode
-		if(RTMPGetKeyParameter("AuthMode", tmpbuf, 128, pBuffer, TRUE))
-		{
-#ifdef CONFIG_STA_SUPPORT
-			IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-			{
-				if ((strcmp(tmpbuf, "WEPAUTO") == 0) || (strcmp(tmpbuf, "wepauto") == 0))
-	                            pAd->StaCfg.AuthMode = Ndis802_11AuthModeAutoSwitch;
-	                        else if ((strcmp(tmpbuf, "SHARED") == 0) || (strcmp(tmpbuf, "shared") == 0))
-	                            pAd->StaCfg.AuthMode = Ndis802_11AuthModeShared;
-	                        else if ((strcmp(tmpbuf, "WPAPSK") == 0) || (strcmp(tmpbuf, "wpapsk") == 0))
-	                            pAd->StaCfg.AuthMode = Ndis802_11AuthModeWPAPSK;
-	                        else if ((strcmp(tmpbuf, "WPANONE") == 0) || (strcmp(tmpbuf, "wpanone") == 0))
-	                            pAd->StaCfg.AuthMode = Ndis802_11AuthModeWPANone;
-	                        else if ((strcmp(tmpbuf, "WPA2PSK") == 0) || (strcmp(tmpbuf, "wpa2psk") == 0))
-							    pAd->StaCfg.AuthMode = Ndis802_11AuthModeWPA2PSK;
-#ifdef WPA_SUPPLICANT_SUPPORT
-							else if ((strcmp(tmpbuf, "WPA") == 0) || (strcmp(tmpbuf, "wpa") == 0))
-			                    pAd->StaCfg.AuthMode = Ndis802_11AuthModeWPA;
-							else if ((strcmp(tmpbuf, "WPA2") == 0) || (strcmp(tmpbuf, "wpa2") == 0))
-							    pAd->StaCfg.AuthMode = Ndis802_11AuthModeWPA2;
-#endif // WPA_SUPPLICANT_SUPPORT //
-	                        else
-	                            pAd->StaCfg.AuthMode = Ndis802_11AuthModeOpen;
-
-	                        pAd->StaCfg.PortSecured = WPA_802_1X_PORT_NOT_SECURED;
-
-				DBGPRINT(RT_DEBUG_TRACE, ("%s::(EncrypType=%d)\n", __FUNCTION__, pAd->StaCfg.WepStatus));
-			}
-#endif // CONFIG_STA_SUPPORT //
-		}
-		//EncrypType
-		if(RTMPGetKeyParameter("EncrypType", tmpbuf, 128, pBuffer, TRUE))
-		{
-
-#ifdef CONFIG_STA_SUPPORT
-			IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-			{
-				if ((strcmp(tmpbuf, "WEP") == 0) || (strcmp(tmpbuf, "wep") == 0))
-					pAd->StaCfg.WepStatus	= Ndis802_11WEPEnabled;
-				else if ((strcmp(tmpbuf, "TKIP") == 0) || (strcmp(tmpbuf, "tkip") == 0))
-					pAd->StaCfg.WepStatus	= Ndis802_11Encryption2Enabled;
-				else if ((strcmp(tmpbuf, "AES") == 0) || (strcmp(tmpbuf, "aes") == 0))
-					pAd->StaCfg.WepStatus	= Ndis802_11Encryption3Enabled;
-				else
-					pAd->StaCfg.WepStatus	= Ndis802_11WEPDisabled;
-
-				// Update all wepstatus related
-				pAd->StaCfg.PairCipher		= pAd->StaCfg.WepStatus;
-				pAd->StaCfg.GroupCipher		= pAd->StaCfg.WepStatus;
-				pAd->StaCfg.OrigWepStatus	= pAd->StaCfg.WepStatus;
-				pAd->StaCfg.bMixCipher		= FALSE;
-
-				//RTMPMakeRSNIE(pAd, pAd->StaCfg.AuthMode, pAd->StaCfg.WepStatus, 0);
-				DBGPRINT(RT_DEBUG_TRACE, ("%s::(EncrypType=%d)\n", __FUNCTION__, pAd->StaCfg.WepStatus));
-			}
-#endif // CONFIG_STA_SUPPORT //
-		}
-
-
-#ifdef CONFIG_STA_SUPPORT
-		IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		{
-			if(RTMPGetKeyParameter("WPAPSK", tmpbuf, 512, pBuffer, FALSE))
-			{
-				int     ret = TRUE;
-
-				tmpbuf[strlen(tmpbuf)] = '\0'; // make STA can process .$^& for WPAPSK input
-
-				if ((pAd->StaCfg.AuthMode != Ndis802_11AuthModeWPAPSK) &&
-					(pAd->StaCfg.AuthMode != Ndis802_11AuthModeWPA2PSK) &&
-					(pAd->StaCfg.AuthMode != Ndis802_11AuthModeWPANone)
-					)
-				{
-					ret = FALSE;
-				}
-				else
-				{
-					ret = RT_CfgSetWPAPSKKey(pAd, tmpbuf, (PUCHAR)pAd->CommonCfg.Ssid, pAd->CommonCfg.SsidLen, pAd->StaCfg.PMK);
-				}
-
-				if (ret == TRUE)
-				{
-			RTMPZeroMemory(pAd->StaCfg.WpaPassPhrase, 64);
-			RTMPMoveMemory(pAd->StaCfg.WpaPassPhrase, tmpbuf, strlen(tmpbuf));
-					pAd->StaCfg.WpaPassPhraseLen= strlen(tmpbuf);
-
-					if ((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPAPSK) ||
-						(pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK))
-					{
-						// Start STA supplicant state machine
-						pAd->StaCfg.WpaState = SS_START;
-					}
-					else if (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPANone)
-					{
-						pAd->StaCfg.WpaState = SS_NOTUSE;
-					}
-					DBGPRINT(RT_DEBUG_TRACE, ("%s::(WPAPSK=%s)\n", __FUNCTION__, tmpbuf));
-				}
-			}
-		}
-#endif // CONFIG_STA_SUPPORT //
-
-		//DefaultKeyID, KeyType, KeyStr
-		rtmp_read_key_parms_from_file(pAd, tmpbuf, pBuffer);
-
-
-		//HSCounter
-		/*if(RTMPGetKeyParameter("HSCounter", tmpbuf, 10, pBuffer, TRUE))
-		{
-			switch (simple_strtol(tmpbuf, 0, 10))
-			{
-				case 1: //Enable
-					pAd->CommonCfg.bEnableHSCounter = TRUE;
-					break;
-				case 0: //Disable
-				default:
-					pAd->CommonCfg.bEnableHSCounter = FALSE;
-					break;
-			}
-			DBGPRINT(RT_DEBUG_TRACE, "HSCounter=%d\n", pAd->CommonCfg.bEnableHSCounter);
-		}*/
-
-#ifdef DOT11_N_SUPPORT
-		HTParametersHook(pAd, tmpbuf, pBuffer);
-#endif // DOT11_N_SUPPORT //
-
-
-#ifdef CARRIER_DETECTION_SUPPORT
-			//CarrierDetect
-			if(RTMPGetKeyParameter("CarrierDetect", tmpbuf, 128, pBuffer, TRUE))
-			{
-				if ((strncmp(tmpbuf, "0", 1) == 0))
-					pAd->CommonCfg.CarrierDetect.Enable = FALSE;
-				else if ((strncmp(tmpbuf, "1", 1) == 0))
-					pAd->CommonCfg.CarrierDetect.Enable = TRUE;
-				else
-					pAd->CommonCfg.CarrierDetect.Enable = FALSE;
-
-				DBGPRINT(RT_DEBUG_TRACE, ("CarrierDetect.Enable=%d\n", pAd->CommonCfg.CarrierDetect.Enable));
-			}
-			else
-				pAd->CommonCfg.CarrierDetect.Enable = FALSE;
-#endif // CARRIER_DETECTION_SUPPORT //
-
-#ifdef CONFIG_STA_SUPPORT
-		IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		{
-			//PSMode
-			if (RTMPGetKeyParameter("PSMode", tmpbuf, 10, pBuffer, TRUE))
-			{
-				if (pAd->StaCfg.BssType == BSS_INFRA)
-				{
-					if ((strcmp(tmpbuf, "MAX_PSP") == 0) || (strcmp(tmpbuf, "max_psp") == 0))
-					{
-						// do NOT turn on PSM bit here, wait until MlmeCheckForPsmChange()
-						// to exclude certain situations.
-						//	   MlmeSetPsm(pAd, PWR_SAVE);
-						OPSTATUS_SET_FLAG(pAd, fOP_STATUS_RECEIVE_DTIM);
-						if (pAd->StaCfg.bWindowsACCAMEnable == FALSE)
-							pAd->StaCfg.WindowsPowerMode = Ndis802_11PowerModeMAX_PSP;
-						pAd->StaCfg.WindowsBatteryPowerMode = Ndis802_11PowerModeMAX_PSP;
-						pAd->StaCfg.DefaultListenCount = 5;
-					}
-					else if ((strcmp(tmpbuf, "Fast_PSP") == 0) || (strcmp(tmpbuf, "fast_psp") == 0)
-						|| (strcmp(tmpbuf, "FAST_PSP") == 0))
-					{
-						// do NOT turn on PSM bit here, wait until MlmeCheckForPsmChange()
-						// to exclude certain situations.
-						//	   MlmeSetPsmBit(pAd, PWR_SAVE);
-						OPSTATUS_SET_FLAG(pAd, fOP_STATUS_RECEIVE_DTIM);
-						if (pAd->StaCfg.bWindowsACCAMEnable == FALSE)
-							pAd->StaCfg.WindowsPowerMode = Ndis802_11PowerModeFast_PSP;
-						pAd->StaCfg.WindowsBatteryPowerMode = Ndis802_11PowerModeFast_PSP;
-						pAd->StaCfg.DefaultListenCount = 3;
-					}
-					else if ((strcmp(tmpbuf, "Legacy_PSP") == 0) || (strcmp(tmpbuf, "legacy_psp") == 0)
-						|| (strcmp(tmpbuf, "LEGACY_PSP") == 0))
-					{
-						// do NOT turn on PSM bit here, wait until MlmeCheckForPsmChange()
-						// to exclude certain situations.
-						//	   MlmeSetPsmBit(pAd, PWR_SAVE);
-						OPSTATUS_SET_FLAG(pAd, fOP_STATUS_RECEIVE_DTIM);
-						if (pAd->StaCfg.bWindowsACCAMEnable == FALSE)
-							pAd->StaCfg.WindowsPowerMode = Ndis802_11PowerModeLegacy_PSP;
-						pAd->StaCfg.WindowsBatteryPowerMode = Ndis802_11PowerModeLegacy_PSP;
-						pAd->StaCfg.DefaultListenCount = 3;
-					}
-					else
-					{ //Default Ndis802_11PowerModeCAM
-						// clear PSM bit immediately
-						RTMP_SET_PSM_BIT(pAd, PWR_ACTIVE);
-						OPSTATUS_SET_FLAG(pAd, fOP_STATUS_RECEIVE_DTIM);
-						if (pAd->StaCfg.bWindowsACCAMEnable == FALSE)
-							pAd->StaCfg.WindowsPowerMode = Ndis802_11PowerModeCAM;
-						pAd->StaCfg.WindowsBatteryPowerMode = Ndis802_11PowerModeCAM;
-					}
-					DBGPRINT(RT_DEBUG_TRACE, ("PSMode=%ld\n", pAd->StaCfg.WindowsPowerMode));
-				}
-			}
-			// AutoRoaming by RSSI
-			if (RTMPGetKeyParameter("AutoRoaming", tmpbuf, 32, pBuffer, TRUE))
-			{
-				if (simple_strtol(tmpbuf, 0, 10) == 0)
-					pAd->StaCfg.bAutoRoaming = FALSE;
-				else
-					pAd->StaCfg.bAutoRoaming = TRUE;
-
-				DBGPRINT(RT_DEBUG_TRACE, ("AutoRoaming=%d\n", pAd->StaCfg.bAutoRoaming));
-			}
-			// RoamThreshold
-			if (RTMPGetKeyParameter("RoamThreshold", tmpbuf, 32, pBuffer, TRUE))
-			{
-				long lInfo = simple_strtol(tmpbuf, 0, 10);
-
-				if (lInfo > 90 || lInfo < 60)
-					pAd->StaCfg.dBmToRoam = -70;
-				else
-					pAd->StaCfg.dBmToRoam = (CHAR)(-1)*lInfo;
-
-				DBGPRINT(RT_DEBUG_TRACE, ("RoamThreshold=%d  dBm\n", pAd->StaCfg.dBmToRoam));
-			}
-
-			if(RTMPGetKeyParameter("TGnWifiTest", tmpbuf, 10, pBuffer, TRUE))
-			{
-				if(simple_strtol(tmpbuf, 0, 10) == 0)
-					pAd->StaCfg.bTGnWifiTest = FALSE;
-				else
-					pAd->StaCfg.bTGnWifiTest = TRUE;
-					DBGPRINT(RT_DEBUG_TRACE, ("TGnWifiTest=%d\n", pAd->StaCfg.bTGnWifiTest));
-			}
-
-			// Beacon Lost Time
-			if (RTMPGetKeyParameter("BeaconLostTime", tmpbuf, 32, pBuffer, TRUE))
-			{
-				ULONG lInfo = (ULONG)simple_strtol(tmpbuf, 0, 10);
-
-				if ((lInfo != 0) && (lInfo <= 60))
-					pAd->StaCfg.BeaconLostTime = (lInfo * OS_HZ);
-				DBGPRINT(RT_DEBUG_TRACE, ("BeaconLostTime=%ld \n", pAd->StaCfg.BeaconLostTime));
-			}
-
-
-		}
-#endif // CONFIG_STA_SUPPORT //
-
-
-
-#ifdef RT30xx
-#ifdef ANT_DIVERSITY_SUPPORT
-		IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		{
-			if(RTMPGetKeyParameter("AntDiversity", tmpbuf, 10, pBuffer, TRUE))
-			{
-				for (i = 0, macptr = rstrtok(tmpbuf,";"); macptr; macptr = rstrtok(NULL,";"), i++)
-				{
-					UCHAR Ant = simple_strtol(tmpbuf, 0, 10);
-					if(Ant < 3)
-						pAd->CommonCfg.bRxAntDiversity = Ant;
-					else
-						pAd->CommonCfg.bRxAntDiversity = ANT_DIVERSITY_DISABLE;
-
-					DBGPRINT(RT_DEBUG_ERROR, ("AntDiversity=%d\n", pAd->CommonCfg.bRxAntDiversity));
-				}
-			}
-		}
-#endif // ANT_DIVERSITY_SUPPORT //
-#endif // RT30xx //
-
-	}while(0);
-
-
-	kfree(tmpbuf);
-
-	return NDIS_STATUS_SUCCESS;
-
-}
-
-
-#ifdef MULTIPLE_CARD_SUPPORT
-// record whether the card in the card list is used in the card file
-UINT8  MC_CardUsed[MAX_NUM_OF_MULTIPLE_CARD];
-// record used card mac address in the card list
-static UINT8  MC_CardMac[MAX_NUM_OF_MULTIPLE_CARD][6];
-
-/*
-========================================================================
-Routine Description:
-    Get card profile path.
-
-Arguments:
-    pAd
-
-Return Value:
-    TRUE		- Find a card profile
-	FALSE		- use default profile
-
-Note:
-========================================================================
-*/
-BOOLEAN RTMP_CardInfoRead(
-	IN	PRTMP_ADAPTER pAd)
-{
-#define MC_SELECT_CARDID		0	/* use CARD ID (0 ~ 31) to identify different cards */
-#define MC_SELECT_MAC			1	/* use CARD MAC to identify different cards */
-#define MC_SELECT_CARDTYPE		2	/* use CARD type (abgn or bgn) to identify different cards */
-
-#define LETTER_CASE_TRANSLATE(txt_p, card_id)			\
-	{	UINT32 _len; char _char;						\
-		for(_len=0; _len<strlen(card_id); _len++) {		\
-			_char = *(txt_p + _len);					\
-			if (('A' <= _char) && (_char <= 'Z'))		\
-				*(txt_p+_len) = 'a'+(_char-'A');		\
-		} }
-
-	RTMP_OS_FD srcf;
-	INT retval;
-	PSTRING buffer, tmpbuf;
-	STRING card_id_buf[30], RFIC_word[30];
-	BOOLEAN flg_match_ok = FALSE;
-	INT32 card_select_method;
-	INT32 card_free_id, card_nouse_id, card_same_mac_id, card_match_id;
-	EEPROM_ANTENNA_STRUC antenna;
-	USHORT addr01, addr23, addr45;
-	UINT8 mac[6];
-	UINT32 data, card_index;
-	UCHAR *start_ptr;
-	RTMP_OS_FS_INFO osFSInfo;
-
-	// init
-	buffer = kmalloc(MAX_INI_BUFFER_SIZE, MEM_ALLOC_FLAG);
-	if (buffer == NULL)
-		return FALSE;
-
-	tmpbuf = kmalloc(MAX_PARAM_BUFFER_SIZE, MEM_ALLOC_FLAG);
-	if(tmpbuf == NULL)
-	{
-		kfree(buffer);
-		return NDIS_STATUS_FAILURE;
-	}
-
-	// get RF IC type
-	RTMP_IO_READ32(pAd, E2PROM_CSR, &data);
-
-	if ((data & 0x30) == 0)
-		pAd->EEPROMAddressNum = 6;	// 93C46
-	else if ((data & 0x30) == 0x10)
-		pAd->EEPROMAddressNum = 8;	// 93C66
-	else
-		pAd->EEPROMAddressNum = 8;	// 93C86
-
-	RT28xx_EEPROM_READ16(pAd, EEPROM_NIC1_OFFSET, antenna.word);
-
-	if ((antenna.field.RfIcType == RFIC_2850) ||
-		(antenna.field.RfIcType == RFIC_2750))
-	{
-		/* ABGN card */
-		strcpy(RFIC_word, "abgn");
-	}
-	else
-	{
-		/* BGN card */
-		strcpy(RFIC_word, "bgn");
-	}
-
-	// get MAC address
-	RT28xx_EEPROM_READ16(pAd, 0x04, addr01);
-	RT28xx_EEPROM_READ16(pAd, 0x06, addr23);
-	RT28xx_EEPROM_READ16(pAd, 0x08, addr45);
-
-	mac[0] = (UCHAR)(addr01 & 0xff);
-	mac[1] = (UCHAR)(addr01 >> 8);
-	mac[2] = (UCHAR)(addr23 & 0xff);
-	mac[3] = (UCHAR)(addr23 >> 8);
-	mac[4] = (UCHAR)(addr45 & 0xff);
-	mac[5] = (UCHAR)(addr45 >> 8);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("mac addr=%02x:%02x:%02x:%02x:%02x:%02x!\n", PRINT_MAC(mac)));
-
-	RtmpOSFSInfoChange(&osFSInfo, TRUE);
-	// open card information file
-	srcf = RtmpOSFileOpen(CARD_INFO_PATH, O_RDONLY, 0);
-	if (IS_FILE_OPEN_ERR(srcf))
-	{
-		/* card information file does not exist */
-			DBGPRINT(RT_DEBUG_TRACE,
-				("--> Error opening %s\n", CARD_INFO_PATH));
-		goto  free_resource;
-	}
-
-	/* card information file exists so reading the card information */
-	memset(buffer, 0x00, MAX_INI_BUFFER_SIZE);
-	retval = RtmpOSFileRead(srcf, buffer, MAX_INI_BUFFER_SIZE);
-	if (retval < 0)
-	{
-		/* read fail */
-			DBGPRINT(RT_DEBUG_TRACE,
-				("--> Read %s error %d\n", CARD_INFO_PATH, -retval));
-	}
-	else
-	{
-		/* get card selection method */
-		memset(tmpbuf, 0x00, MAX_PARAM_BUFFER_SIZE);
-		card_select_method = MC_SELECT_CARDTYPE; // default
-
-		if (RTMPGetKeyParameter("SELECT", tmpbuf, 256, buffer, TRUE))
-		{
-			if (strcmp(tmpbuf, "CARDID") == 0)
-				card_select_method = MC_SELECT_CARDID;
-			else if (strcmp(tmpbuf, "MAC") == 0)
-				card_select_method = MC_SELECT_MAC;
-			else if (strcmp(tmpbuf, "CARDTYPE") == 0)
-				card_select_method = MC_SELECT_CARDTYPE;
-		}
-
-		DBGPRINT(RT_DEBUG_TRACE,
-				("MC> Card Selection = %d\n", card_select_method));
-
-		// init
-		card_free_id = -1;
-		card_nouse_id = -1;
-		card_same_mac_id = -1;
-		card_match_id = -1;
-
-		// search current card information records
-		for(card_index=0;
-			card_index<MAX_NUM_OF_MULTIPLE_CARD;
-			card_index++)
-		{
-			if ((*(UINT32 *)&MC_CardMac[card_index][0] == 0) &&
-				(*(UINT16 *)&MC_CardMac[card_index][4] == 0))
-			{
-				// MAC is all-0 so the entry is available
-				MC_CardUsed[card_index] = 0;
-
-				if (card_free_id < 0)
-					card_free_id = card_index; // 1st free entry
-			}
-			else
-			{
-				if (memcmp(MC_CardMac[card_index], mac, 6) == 0)
-				{
-					// we find the entry with same MAC
-					if (card_same_mac_id < 0)
-						card_same_mac_id = card_index; // 1st same entry
-				}
-				else
-				{
-					// MAC is not all-0 but used flag == 0
-					if ((MC_CardUsed[card_index] == 0) &&
-						(card_nouse_id < 0))
-					{
-						card_nouse_id = card_index; // 1st available entry
-					}
-				}
-			}
-		}
-
-		DBGPRINT(RT_DEBUG_TRACE,
-				("MC> Free = %d, Same = %d, NOUSE = %d\n",
-				card_free_id, card_same_mac_id, card_nouse_id));
-
-		if ((card_same_mac_id >= 0) &&
-			((card_select_method == MC_SELECT_CARDID) ||
-			(card_select_method == MC_SELECT_CARDTYPE)))
-		{
-			// same MAC entry is found
-			card_match_id = card_same_mac_id;
-
-			if (card_select_method == MC_SELECT_CARDTYPE)
-			{
-				// for CARDTYPE
-				sprintf(card_id_buf, "%02dCARDTYPE%s",
-						card_match_id, RFIC_word);
-
-				if ((start_ptr = (PUCHAR)rtstrstruncasecmp(buffer, card_id_buf)) != NULL)
-				{
-					// we found the card ID
-					LETTER_CASE_TRANSLATE(start_ptr, card_id_buf);
-				}
-			}
-		}
-		else
-		{
-			// the card is 1st plug-in, try to find the match card profile
-			switch(card_select_method)
-			{
-				case MC_SELECT_CARDID: // CARDID
-				default:
-					if (card_free_id >= 0)
-						card_match_id = card_free_id;
-					else
-						card_match_id = card_nouse_id;
-					break;
-
-				case MC_SELECT_MAC: // MAC
-					sprintf(card_id_buf, "MAC%02x:%02x:%02x:%02x:%02x:%02x",
-							mac[0], mac[1], mac[2],
-							mac[3], mac[4], mac[5]);
-
-					/* try to find the key word in the card file */
-					if ((start_ptr = (PUCHAR)rtstrstruncasecmp(buffer, card_id_buf)) != NULL)
-					{
-						LETTER_CASE_TRANSLATE(start_ptr, card_id_buf);
-
-						/* get the row ID (2 ASCII characters) */
-						start_ptr -= 2;
-						card_id_buf[0] = *(start_ptr);
-						card_id_buf[1] = *(start_ptr+1);
-						card_id_buf[2] = 0x00;
-
-						card_match_id = simple_strtol(card_id_buf, 0, 10);
-					}
-					break;
-
-				case MC_SELECT_CARDTYPE: // CARDTYPE
-					card_nouse_id = -1;
-
-					for(card_index=0;
-						card_index<MAX_NUM_OF_MULTIPLE_CARD;
-						card_index++)
-					{
-						sprintf(card_id_buf, "%02dCARDTYPE%s",
-								card_index, RFIC_word);
-
-						if ((start_ptr = (PUCHAR)rtstrstruncasecmp(buffer,
-													card_id_buf)) != NULL)
-						{
-							LETTER_CASE_TRANSLATE(start_ptr, card_id_buf);
-
-							if (MC_CardUsed[card_index] == 0)
-							{
-								/* current the card profile is not used */
-								if ((*(UINT32 *)&MC_CardMac[card_index][0] == 0) &&
-									(*(UINT16 *)&MC_CardMac[card_index][4] == 0))
-								{
-									// find it and no previous card use it
-									card_match_id = card_index;
-									break;
-								}
-								else
-								{
-									// ever a card use it
-									if (card_nouse_id < 0)
-										card_nouse_id = card_index;
-								}
-							}
-						}
-					}
-
-					// if not find a free one, use the available one
-					if (card_match_id < 0)
-						card_match_id = card_nouse_id;
-					break;
-			}
-		}
-
-		if (card_match_id >= 0)
-		{
-			// make up search keyword
-			switch(card_select_method)
-			{
-				case MC_SELECT_CARDID: // CARDID
-					sprintf(card_id_buf, "%02dCARDID", card_match_id);
-					break;
-
-				case MC_SELECT_MAC: // MAC
-					sprintf(card_id_buf,
-							"%02dmac%02x:%02x:%02x:%02x:%02x:%02x",
-							card_match_id,
-							mac[0], mac[1], mac[2],
-							mac[3], mac[4], mac[5]);
-					break;
-
-				case MC_SELECT_CARDTYPE: // CARDTYPE
-				default:
-					sprintf(card_id_buf, "%02dcardtype%s",
-							card_match_id, RFIC_word);
-					break;
-			}
-
-			DBGPRINT(RT_DEBUG_TRACE, ("Search Keyword = %s\n", card_id_buf));
-
-			// read card file path
-			if (RTMPGetKeyParameter(card_id_buf, tmpbuf, 256, buffer, TRUE))
-			{
-				if (strlen(tmpbuf) < sizeof(pAd->MC_FileName))
-				{
-					// backup card information
-					pAd->MC_RowID = card_match_id; /* base 0 */
-					MC_CardUsed[card_match_id] = 1;
-					memcpy(MC_CardMac[card_match_id], mac, sizeof(mac));
-
-					// backup card file path
-					NdisMoveMemory(pAd->MC_FileName, tmpbuf , strlen(tmpbuf));
-					pAd->MC_FileName[strlen(tmpbuf)] = '\0';
-					flg_match_ok = TRUE;
-
-					DBGPRINT(RT_DEBUG_TRACE,
-							("Card Profile Name = %s\n", pAd->MC_FileName));
-				}
-				else
-				{
-					DBGPRINT(RT_DEBUG_ERROR,
-							("Card Profile Name length too large!\n"));
-				}
-			}
-			else
-			{
-				DBGPRINT(RT_DEBUG_ERROR,
-						("Can not find search key word in card.dat!\n"));
-			}
-
-			if ((flg_match_ok != TRUE) &&
-				(card_match_id < MAX_NUM_OF_MULTIPLE_CARD))
-			{
-				MC_CardUsed[card_match_id] = 0;
-				memset(MC_CardMac[card_match_id], 0, sizeof(mac));
-			}
-		} // if (card_match_id >= 0)
-	}
-
-
-	// close file
-	retval = RtmpOSFileClose(srcf);
-
-free_resource:
-	RtmpOSFSInfoChange(&osFSInfo, FALSE);
-	kfree(buffer);
-	kfree(tmpbuf);
-
-	return flg_match_ok;
-}
-#endif // MULTIPLE_CARD_SUPPORT //
diff --git a/drivers/staging/rt3090/common/cmm_sanity.c b/drivers/staging/rt3090/common/cmm_sanity.c
deleted file mode 100644
index de631c38a44e..000000000000
--- a/drivers/staging/rt3090/common/cmm_sanity.c
+++ /dev/null
@@ -1,1718 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-	Module Name:
-	sanity.c
-
-	Abstract:
-
-	Revision History:
-	Who			When			What
-	--------	----------		----------------------------------------------
-	John Chang  2004-09-01      add WMM support
-*/
-
-#include "../rt_config.h"
-
-
-extern UCHAR	CISCO_OUI[];
-
-extern UCHAR	WPA_OUI[];
-extern UCHAR	RSN_OUI[];
-extern UCHAR	WME_INFO_ELEM[];
-extern UCHAR	WME_PARM_ELEM[];
-extern UCHAR	Ccx2QosInfo[];
-extern UCHAR	RALINK_OUI[];
-extern UCHAR	BROADCOM_OUI[];
-extern UCHAR    WPS_OUI[];
-
-/*
-    ==========================================================================
-    Description:
-        MLME message sanity check
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-
-	IRQL = DISPATCH_LEVEL
-
-    ==========================================================================
- */
-BOOLEAN MlmeAddBAReqSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN VOID *Msg,
-    IN ULONG MsgLen,
-    OUT PUCHAR pAddr2)
-{
-    PMLME_ADDBA_REQ_STRUCT   pInfo;
-
-    pInfo = (MLME_ADDBA_REQ_STRUCT *)Msg;
-
-    if ((MsgLen != sizeof(MLME_ADDBA_REQ_STRUCT)))
-    {
-        DBGPRINT(RT_DEBUG_TRACE, ("MlmeAddBAReqSanity fail - message lenght not correct.\n"));
-        return FALSE;
-    }
-
-    if ((pInfo->Wcid >= MAX_LEN_OF_MAC_TABLE))
-    {
-        DBGPRINT(RT_DEBUG_TRACE, ("MlmeAddBAReqSanity fail - The peer Mac is not associated yet.\n"));
-        return FALSE;
-    }
-
-	/*
-    if ((pInfo->BaBufSize > MAX_RX_REORDERBUF) || (pInfo->BaBufSize < 2))
-    {
-        DBGPRINT(RT_DEBUG_TRACE, ("MlmeAddBAReqSanity fail - Rx Reordering buffer too big or too small\n"));
-        return FALSE;
-    }
-	*/
-
-    if ((pInfo->pAddr[0]&0x01) == 0x01)
-    {
-        DBGPRINT(RT_DEBUG_TRACE, ("MlmeAddBAReqSanity fail - broadcast address not support BA\n"));
-        return FALSE;
-    }
-
-    return TRUE;
-}
-
-/*
-    ==========================================================================
-    Description:
-        MLME message sanity check
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-
-	IRQL = DISPATCH_LEVEL
-
-    ==========================================================================
- */
-BOOLEAN MlmeDelBAReqSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN VOID *Msg,
-    IN ULONG MsgLen)
-{
-	MLME_DELBA_REQ_STRUCT *pInfo;
-	pInfo = (MLME_DELBA_REQ_STRUCT *)Msg;
-
-    if ((MsgLen != sizeof(MLME_DELBA_REQ_STRUCT)))
-    {
-        DBGPRINT(RT_DEBUG_ERROR, ("MlmeDelBAReqSanity fail - message lenght not correct.\n"));
-        return FALSE;
-    }
-
-    if ((pInfo->Wcid >= MAX_LEN_OF_MAC_TABLE))
-    {
-        DBGPRINT(RT_DEBUG_ERROR, ("MlmeDelBAReqSanity fail - The peer Mac is not associated yet.\n"));
-        return FALSE;
-    }
-
-    if ((pInfo->TID & 0xf0))
-    {
-        DBGPRINT(RT_DEBUG_ERROR, ("MlmeDelBAReqSanity fail - The peer TID is incorrect.\n"));
-        return FALSE;
-    }
-
-	if (NdisEqualMemory(pAd->MacTab.Content[pInfo->Wcid].Addr, pInfo->Addr, MAC_ADDR_LEN) == 0)
-    {
-        DBGPRINT(RT_DEBUG_ERROR, ("MlmeDelBAReqSanity fail - the peer addr dosen't exist.\n"));
-        return FALSE;
-    }
-
-    return TRUE;
-}
-
-BOOLEAN PeerAddBAReqActionSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN VOID *pMsg,
-    IN ULONG MsgLen,
-	OUT PUCHAR pAddr2)
-{
-	PFRAME_802_11 pFrame = (PFRAME_802_11)pMsg;
-	PFRAME_ADDBA_REQ pAddFrame;
-	pAddFrame = (PFRAME_ADDBA_REQ)(pMsg);
-	if (MsgLen < (sizeof(FRAME_ADDBA_REQ)))
-	{
-		DBGPRINT(RT_DEBUG_ERROR,("PeerAddBAReqActionSanity: ADDBA Request frame length size = %ld incorrect\n", MsgLen));
-		return FALSE;
-	}
-	// we support immediate BA.
-#ifdef UNALIGNMENT_SUPPORT
-	{
-		BA_PARM		tmpBaParm;
-
-		NdisMoveMemory((PUCHAR)(&tmpBaParm), (PUCHAR)(&pAddFrame->BaParm), sizeof(BA_PARM));
-		*(USHORT *)(&tmpBaParm) = cpu2le16(*(USHORT *)(&tmpBaParm));
-		NdisMoveMemory((PUCHAR)(&pAddFrame->BaParm), (PUCHAR)(&tmpBaParm), sizeof(BA_PARM));
-	}
-#else
-	*(USHORT *)(&pAddFrame->BaParm) = cpu2le16(*(USHORT *)(&pAddFrame->BaParm));
-#endif
-	pAddFrame->TimeOutValue = cpu2le16(pAddFrame->TimeOutValue);
-	pAddFrame->BaStartSeq.word = cpu2le16(pAddFrame->BaStartSeq.word);
-
-	if (pAddFrame->BaParm.BAPolicy != IMMED_BA)
-	{
-		DBGPRINT(RT_DEBUG_ERROR,("PeerAddBAReqActionSanity: ADDBA Request Ba Policy[%d] not support\n", pAddFrame->BaParm.BAPolicy));
-		DBGPRINT(RT_DEBUG_ERROR,("ADDBA Request. tid=%x, Bufsize=%x, AMSDUSupported=%x \n", pAddFrame->BaParm.TID, pAddFrame->BaParm.BufSize, pAddFrame->BaParm.AMSDUSupported));
-		return FALSE;
-	}
-
-	// we support immediate BA.
-	if (pAddFrame->BaParm.TID &0xfff0)
-	{
-		DBGPRINT(RT_DEBUG_ERROR,("PeerAddBAReqActionSanity: ADDBA Request incorrect TID = %d\n", pAddFrame->BaParm.TID));
-		return FALSE;
-	}
-	COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
-	return TRUE;
-}
-
-BOOLEAN PeerAddBARspActionSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN VOID *pMsg,
-    IN ULONG MsgLen)
-{
-	//PFRAME_802_11 pFrame = (PFRAME_802_11)pMsg;
-	PFRAME_ADDBA_RSP pAddFrame;
-
-	pAddFrame = (PFRAME_ADDBA_RSP)(pMsg);
-	if (MsgLen < (sizeof(FRAME_ADDBA_RSP)))
-	{
-		DBGPRINT(RT_DEBUG_ERROR,("PeerAddBARspActionSanity: ADDBA Response frame length size = %ld incorrect\n", MsgLen));
-		return FALSE;
-	}
-	// we support immediate BA.
-#ifdef UNALIGNMENT_SUPPORT
-	{
-		BA_PARM		tmpBaParm;
-
-		NdisMoveMemory((PUCHAR)(&tmpBaParm), (PUCHAR)(&pAddFrame->BaParm), sizeof(BA_PARM));
-		*(USHORT *)(&tmpBaParm) = cpu2le16(*(USHORT *)(&tmpBaParm));
-		NdisMoveMemory((PUCHAR)(&pAddFrame->BaParm), (PUCHAR)(&tmpBaParm), sizeof(BA_PARM));
-	}
-#else
-	*(USHORT *)(&pAddFrame->BaParm) = cpu2le16(*(USHORT *)(&pAddFrame->BaParm));
-#endif
-	pAddFrame->StatusCode = cpu2le16(pAddFrame->StatusCode);
-	pAddFrame->TimeOutValue = cpu2le16(pAddFrame->TimeOutValue);
-
-	if (pAddFrame->BaParm.BAPolicy != IMMED_BA)
-	{
-		DBGPRINT(RT_DEBUG_ERROR,("PeerAddBAReqActionSanity: ADDBA Response Ba Policy[%d] not support\n", pAddFrame->BaParm.BAPolicy));
-		return FALSE;
-	}
-
-	// we support immediate BA.
-	if (pAddFrame->BaParm.TID &0xfff0)
-	{
-		DBGPRINT(RT_DEBUG_ERROR,("PeerAddBARspActionSanity: ADDBA Response incorrect TID = %d\n", pAddFrame->BaParm.TID));
-		return FALSE;
-	}
-	return TRUE;
-
-}
-
-BOOLEAN PeerDelBAActionSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN UCHAR Wcid,
-    IN VOID *pMsg,
-    IN ULONG MsgLen )
-{
-	//PFRAME_802_11 pFrame = (PFRAME_802_11)pMsg;
-	PFRAME_DELBA_REQ  pDelFrame;
-	if (MsgLen != (sizeof(FRAME_DELBA_REQ)))
-		return FALSE;
-
-	if (Wcid >= MAX_LEN_OF_MAC_TABLE)
-		return FALSE;
-
-	pDelFrame = (PFRAME_DELBA_REQ)(pMsg);
-
-	*(USHORT *)(&pDelFrame->DelbaParm) = cpu2le16(*(USHORT *)(&pDelFrame->DelbaParm));
-	pDelFrame->ReasonCode = cpu2le16(pDelFrame->ReasonCode);
-
-	if (pDelFrame->DelbaParm.TID &0xfff0)
-		return FALSE;
-
-	return TRUE;
-}
-
-/*
-    ==========================================================================
-    Description:
-        MLME message sanity check
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-
-	IRQL = DISPATCH_LEVEL
-
-    ==========================================================================
- */
-BOOLEAN PeerBeaconAndProbeRspSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN VOID *Msg,
-    IN ULONG MsgLen,
-    IN UCHAR  MsgChannel,
-    OUT PUCHAR pAddr2,
-    OUT PUCHAR pBssid,
-    OUT CHAR Ssid[],
-    OUT UCHAR *pSsidLen,
-    OUT UCHAR *pBssType,
-    OUT USHORT *pBeaconPeriod,
-    OUT UCHAR *pChannel,
-    OUT UCHAR *pNewChannel,
-    OUT LARGE_INTEGER *pTimestamp,
-    OUT CF_PARM *pCfParm,
-    OUT USHORT *pAtimWin,
-    OUT USHORT *pCapabilityInfo,
-    OUT UCHAR *pErp,
-    OUT UCHAR *pDtimCount,
-    OUT UCHAR *pDtimPeriod,
-    OUT UCHAR *pBcastFlag,
-    OUT UCHAR *pMessageToMe,
-    OUT UCHAR SupRate[],
-    OUT UCHAR *pSupRateLen,
-    OUT UCHAR ExtRate[],
-    OUT UCHAR *pExtRateLen,
-    OUT	UCHAR *pCkipFlag,
-    OUT	UCHAR *pAironetCellPowerLimit,
-    OUT PEDCA_PARM       pEdcaParm,
-    OUT PQBSS_LOAD_PARM  pQbssLoad,
-    OUT PQOS_CAPABILITY_PARM pQosCapability,
-    OUT ULONG *pRalinkIe,
-    OUT UCHAR		 *pHtCapabilityLen,
-#ifdef CONFIG_STA_SUPPORT
-    OUT UCHAR		 *pPreNHtCapabilityLen,
-#endif // CONFIG_STA_SUPPORT //
-    OUT HT_CAPABILITY_IE *pHtCapability,
-	OUT UCHAR		 *AddHtInfoLen,
-	OUT ADD_HT_INFO_IE *AddHtInfo,
-	OUT UCHAR *NewExtChannelOffset,		// Ht extension channel offset(above or below)
-    OUT USHORT *LengthVIE,
-    OUT	PNDIS_802_11_VARIABLE_IEs pVIE)
-{
-    UCHAR				*Ptr;
-#ifdef CONFIG_STA_SUPPORT
-	UCHAR				TimLen;
-#endif // CONFIG_STA_SUPPORT //
-    PFRAME_802_11		pFrame;
-    PEID_STRUCT         pEid;
-    UCHAR				SubType;
-    UCHAR				Sanity;
-    //UCHAR				ECWMin, ECWMax;
-    //MAC_CSR9_STRUC		Csr9;
-    ULONG				Length = 0;
-
-	// For some 11a AP which didn't have DS_IE, we use two conditions to decide the channel
-	//	1. If the AP is 11n enabled, then check the control channel.
-	//	2. If the AP didn't have any info about channel, use the channel we received this frame as the channel. (May inaccuracy!!)
-	UCHAR			CtrlChannel = 0;
-
-    // Add for 3 necessary EID field check
-    Sanity = 0;
-
-    *pAtimWin = 0;
-    *pErp = 0;
-    *pDtimCount = 0;
-    *pDtimPeriod = 0;
-    *pBcastFlag = 0;
-    *pMessageToMe = 0;
-    *pExtRateLen = 0;
-    *pCkipFlag = 0;			        // Default of CkipFlag is 0
-    *pAironetCellPowerLimit = 0xFF;  // Default of AironetCellPowerLimit is 0xFF
-    *LengthVIE = 0;					// Set the length of VIE to init value 0
-    *pHtCapabilityLen = 0;					// Set the length of VIE to init value 0
-#ifdef CONFIG_STA_SUPPORT
-	if (pAd->OpMode == OPMODE_STA)
-		*pPreNHtCapabilityLen = 0;					// Set the length of VIE to init value 0
-#endif // CONFIG_STA_SUPPORT //
-    *AddHtInfoLen = 0;					// Set the length of VIE to init value 0
-    *pRalinkIe = 0;
-    *pNewChannel = 0;
-    *NewExtChannelOffset = 0xff;	//Default 0xff means no such IE
-    pCfParm->bValid = FALSE;        // default: no IE_CF found
-    pQbssLoad->bValid = FALSE;      // default: no IE_QBSS_LOAD found
-    pEdcaParm->bValid = FALSE;      // default: no IE_EDCA_PARAMETER found
-    pQosCapability->bValid = FALSE; // default: no IE_QOS_CAPABILITY found
-
-    pFrame = (PFRAME_802_11)Msg;
-
-    // get subtype from header
-    SubType = (UCHAR)pFrame->Hdr.FC.SubType;
-
-    // get Addr2 and BSSID from header
-    COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
-    COPY_MAC_ADDR(pBssid, pFrame->Hdr.Addr3);
-
-//	hex_dump("Beacon", Msg, MsgLen);
-
-    Ptr = pFrame->Octet;
-    Length += LENGTH_802_11;
-
-    // get timestamp from payload and advance the pointer
-    NdisMoveMemory(pTimestamp, Ptr, TIMESTAMP_LEN);
-
-	pTimestamp->u.LowPart = cpu2le32(pTimestamp->u.LowPart);
-	pTimestamp->u.HighPart = cpu2le32(pTimestamp->u.HighPart);
-
-    Ptr += TIMESTAMP_LEN;
-    Length += TIMESTAMP_LEN;
-
-    // get beacon interval from payload and advance the pointer
-    NdisMoveMemory(pBeaconPeriod, Ptr, 2);
-    Ptr += 2;
-    Length += 2;
-
-    // get capability info from payload and advance the pointer
-    NdisMoveMemory(pCapabilityInfo, Ptr, 2);
-    Ptr += 2;
-    Length += 2;
-
-    if (CAP_IS_ESS_ON(*pCapabilityInfo))
-        *pBssType = BSS_INFRA;
-    else
-        *pBssType = BSS_ADHOC;
-
-    pEid = (PEID_STRUCT) Ptr;
-
-    // get variable fields from payload and advance the pointer
-    while ((Length + 2 + pEid->Len) <= MsgLen)
-    {
-        //
-        // Secure copy VIE to VarIE[MAX_VIE_LEN] didn't overflow.
-        //
-        if ((*LengthVIE + pEid->Len + 2) >= MAX_VIE_LEN)
-        {
-            DBGPRINT(RT_DEBUG_WARN, ("PeerBeaconAndProbeRspSanity - Variable IEs out of resource [len(=%d) > MAX_VIE_LEN(=%d)]\n",
-                    (*LengthVIE + pEid->Len + 2), MAX_VIE_LEN));
-            break;
-        }
-
-        switch(pEid->Eid)
-        {
-            case IE_SSID:
-                // Already has one SSID EID in this beacon, ignore the second one
-                if (Sanity & 0x1)
-                    break;
-                if(pEid->Len <= MAX_LEN_OF_SSID)
-                {
-                    NdisMoveMemory(Ssid, pEid->Octet, pEid->Len);
-                    *pSsidLen = pEid->Len;
-                    Sanity |= 0x1;
-                }
-                else
-                {
-                    DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_SSID (len=%d)\n",pEid->Len));
-                    return FALSE;
-                }
-                break;
-
-            case IE_SUPP_RATES:
-                if(pEid->Len <= MAX_LEN_OF_SUPPORTED_RATES)
-                {
-                    Sanity |= 0x2;
-                    NdisMoveMemory(SupRate, pEid->Octet, pEid->Len);
-                    *pSupRateLen = pEid->Len;
-
-                    // TODO: 2004-09-14 not a good design here, cause it exclude extra rates
-                    // from ScanTab. We should report as is. And filter out unsupported
-                    // rates in MlmeAux.
-                    // Check against the supported rates
-                    // RTMPCheckRates(pAd, SupRate, pSupRateLen);
-                }
-                else
-                {
-                    DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_SUPP_RATES (len=%d)\n",pEid->Len));
-                    return FALSE;
-                }
-                break;
-
-            case IE_HT_CAP:
-			if (pEid->Len >= SIZE_HT_CAP_IE)  //Note: allow extension.!!
-			{
-				NdisMoveMemory(pHtCapability, pEid->Octet, sizeof(HT_CAPABILITY_IE));
-				*pHtCapabilityLen = SIZE_HT_CAP_IE;	// Nnow we only support 26 bytes.
-
-				*(USHORT *)(&pHtCapability->HtCapInfo) = cpu2le16(*(USHORT *)(&pHtCapability->HtCapInfo));
-#ifdef UNALIGNMENT_SUPPORT
-				{
-					EXT_HT_CAP_INFO extHtCapInfo;
-					NdisMoveMemory((PUCHAR)(&extHtCapInfo), (PUCHAR)(&pHtCapability->ExtHtCapInfo), sizeof(EXT_HT_CAP_INFO));
-					*(USHORT *)(&extHtCapInfo) = cpu2le16(*(USHORT *)(&extHtCapInfo));
-					NdisMoveMemory((PUCHAR)(&pHtCapability->ExtHtCapInfo), (PUCHAR)(&extHtCapInfo), sizeof(EXT_HT_CAP_INFO));
-				}
-#else
-				*(USHORT *)(&pHtCapability->ExtHtCapInfo) = cpu2le16(*(USHORT *)(&pHtCapability->ExtHtCapInfo));
-#endif // UNALIGNMENT_SUPPORT //
-
-#ifdef CONFIG_STA_SUPPORT
-				IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-				{
-					*pPreNHtCapabilityLen = 0;	// Now we only support 26 bytes.
-
-					Ptr = (PUCHAR) pVIE;
-					NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid, pEid->Len + 2);
-					*LengthVIE += (pEid->Len + 2);
-				}
-#endif // CONFIG_STA_SUPPORT //
-			}
-			else
-			{
-				DBGPRINT(RT_DEBUG_WARN, ("PeerBeaconAndProbeRspSanity - wrong IE_HT_CAP. pEid->Len = %d\n", pEid->Len));
-			}
-
-		break;
-            case IE_ADD_HT:
-			if (pEid->Len >= sizeof(ADD_HT_INFO_IE))
-			{
-				// This IE allows extension, but we can ignore extra bytes beyond our knowledge , so only
-				// copy first sizeof(ADD_HT_INFO_IE)
-				NdisMoveMemory(AddHtInfo, pEid->Octet, sizeof(ADD_HT_INFO_IE));
-				*AddHtInfoLen = SIZE_ADD_HT_INFO_IE;
-
-				CtrlChannel = AddHtInfo->ControlChan;
-
-				*(USHORT *)(&AddHtInfo->AddHtInfo2) = cpu2le16(*(USHORT *)(&AddHtInfo->AddHtInfo2));
-				*(USHORT *)(&AddHtInfo->AddHtInfo3) = cpu2le16(*(USHORT *)(&AddHtInfo->AddHtInfo3));
-
-#ifdef CONFIG_STA_SUPPORT
-				IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-				{
-			                Ptr = (PUCHAR) pVIE;
-			                NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid, pEid->Len + 2);
-			                *LengthVIE += (pEid->Len + 2);
-				}
-#endif // CONFIG_STA_SUPPORT //
-			}
-			else
-			{
-				DBGPRINT(RT_DEBUG_WARN, ("PeerBeaconAndProbeRspSanity - wrong IE_ADD_HT. \n"));
-			}
-
-		break;
-            case IE_SECONDARY_CH_OFFSET:
-			if (pEid->Len == 1)
-			{
-				*NewExtChannelOffset = pEid->Octet[0];
-			}
-			else
-			{
-				DBGPRINT(RT_DEBUG_WARN, ("PeerBeaconAndProbeRspSanity - wrong IE_SECONDARY_CH_OFFSET. \n"));
-			}
-
-		break;
-            case IE_FH_PARM:
-                DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity(IE_FH_PARM) \n"));
-                break;
-
-            case IE_DS_PARM:
-                if(pEid->Len == 1)
-                {
-                    *pChannel = *pEid->Octet;
-#ifdef CONFIG_STA_SUPPORT
-					IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-					{
-						if (ChannelSanity(pAd, *pChannel) == 0)
-						{
-
-							return FALSE;
-						}
-					}
-#endif // CONFIG_STA_SUPPORT //
-                    Sanity |= 0x4;
-                }
-                else
-                {
-                    DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_DS_PARM (len=%d)\n",pEid->Len));
-                    return FALSE;
-                }
-                break;
-
-            case IE_CF_PARM:
-                if(pEid->Len == 6)
-                {
-                    pCfParm->bValid = TRUE;
-                    pCfParm->CfpCount = pEid->Octet[0];
-                    pCfParm->CfpPeriod = pEid->Octet[1];
-                    pCfParm->CfpMaxDuration = pEid->Octet[2] + 256 * pEid->Octet[3];
-                    pCfParm->CfpDurRemaining = pEid->Octet[4] + 256 * pEid->Octet[5];
-                }
-                else
-                {
-                    DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_CF_PARM\n"));
-                    return FALSE;
-                }
-                break;
-
-            case IE_IBSS_PARM:
-                if(pEid->Len == 2)
-                {
-                    NdisMoveMemory(pAtimWin, pEid->Octet, pEid->Len);
-                }
-                else
-                {
-                    DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_IBSS_PARM\n"));
-                    return FALSE;
-                }
-                break;
-
-#ifdef CONFIG_STA_SUPPORT
-            case IE_TIM:
-                if(INFRA_ON(pAd) && SubType == SUBTYPE_BEACON)
-                {
-                    GetTimBit((PCHAR)pEid, pAd->StaActive.Aid, &TimLen, pBcastFlag, pDtimCount, pDtimPeriod, pMessageToMe);
-                }
-                break;
-#endif // CONFIG_STA_SUPPORT //
-            case IE_CHANNEL_SWITCH_ANNOUNCEMENT:
-                if(pEid->Len == 3)
-                {
-			*pNewChannel = pEid->Octet[1];	//extract new channel number
-                }
-                break;
-
-            // New for WPA
-            // CCX v2 has the same IE, we need to parse that too
-            // Wifi WMM use the same IE vale, need to parse that too
-            // case IE_WPA:
-            case IE_VENDOR_SPECIFIC:
-                // Check Broadcom/Atheros 802.11n OUI version, for HT Capability IE.
-                // This HT IE is before IEEE draft set HT IE value.2006-09-28 by Jan.
-                /*if (NdisEqualMemory(pEid->Octet, BROADCOM_OUI, 3) && (pEid->Len >= 4))
-                {
-			if ((pEid->Octet[3] == OUI_BROADCOM_HT) && (pEid->Len >= 30))
-			{
-				{
-					NdisMoveMemory(pHtCapability, &pEid->Octet[4], sizeof(HT_CAPABILITY_IE));
-					*pHtCapabilityLen = SIZE_HT_CAP_IE;	// Nnow we only support 26 bytes.
-				}
-			}
-			if ((pEid->Octet[3] == OUI_BROADCOM_HT) && (pEid->Len >= 26))
-			{
-				{
-					NdisMoveMemory(AddHtInfo, &pEid->Octet[4], sizeof(ADD_HT_INFO_IE));
-					*AddHtInfoLen = SIZE_ADD_HT_INFO_IE;	// Nnow we only support 26 bytes.
-				}
-			}
-                }
-				*/
-                // Check the OUI version, filter out non-standard usage
-                if (NdisEqualMemory(pEid->Octet, RALINK_OUI, 3) && (pEid->Len == 7))
-                {
-                    //*pRalinkIe = pEid->Octet[3];
-                    if (pEid->Octet[3] != 0)
-					*pRalinkIe = pEid->Octet[3];
-				else
-					*pRalinkIe = 0xf0000000; // Set to non-zero value (can't set bit0-2) to represent this is Ralink Chip. So at linkup, we will set ralinkchip flag.
-                }
-#ifdef CONFIG_STA_SUPPORT
-#ifdef DOT11_N_SUPPORT
-		// This HT IE is before IEEE draft set HT IE value.2006-09-28 by Jan.
-
-                // Other vendors had production before IE_HT_CAP value is assigned. To backward support those old-firmware AP,
-                // Check broadcom-defiend pre-802.11nD1.0 OUI for HT related IE, including HT Capatilities IE and HT Information IE
-                else if ((*pHtCapabilityLen == 0) && NdisEqualMemory(pEid->Octet, PRE_N_HT_OUI, 3) && (pEid->Len >= 4) && (pAd->OpMode == OPMODE_STA))
-                {
-                    if ((pEid->Octet[3] == OUI_PREN_HT_CAP) && (pEid->Len >= 30) && (*pHtCapabilityLen == 0))
-                    {
-                        NdisMoveMemory(pHtCapability, &pEid->Octet[4], sizeof(HT_CAPABILITY_IE));
-                        *pPreNHtCapabilityLen = SIZE_HT_CAP_IE;
-                    }
-
-                    if ((pEid->Octet[3] == OUI_PREN_ADD_HT) && (pEid->Len >= 26))
-                    {
-                        NdisMoveMemory(AddHtInfo, &pEid->Octet[4], sizeof(ADD_HT_INFO_IE));
-                        *AddHtInfoLen = SIZE_ADD_HT_INFO_IE;
-                    }
-                }
-#endif // DOT11_N_SUPPORT //
-#endif // CONFIG_STA_SUPPORT //
-                else if (NdisEqualMemory(pEid->Octet, WPA_OUI, 4))
-                {
-                    // Copy to pVIE which will report to microsoft bssid list.
-                    Ptr = (PUCHAR) pVIE;
-                    NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid, pEid->Len + 2);
-                    *LengthVIE += (pEid->Len + 2);
-                }
-                else if (NdisEqualMemory(pEid->Octet, WME_PARM_ELEM, 6) && (pEid->Len == 24))
-                {
-                    PUCHAR ptr;
-                    int i;
-
-                    // parsing EDCA parameters
-                    pEdcaParm->bValid          = TRUE;
-                    pEdcaParm->bQAck           = FALSE; // pEid->Octet[0] & 0x10;
-                    pEdcaParm->bQueueRequest   = FALSE; // pEid->Octet[0] & 0x20;
-                    pEdcaParm->bTxopRequest    = FALSE; // pEid->Octet[0] & 0x40;
-                    pEdcaParm->EdcaUpdateCount = pEid->Octet[6] & 0x0f;
-                    pEdcaParm->bAPSDCapable    = (pEid->Octet[6] & 0x80) ? 1 : 0;
-                    ptr = &pEid->Octet[8];
-                    for (i=0; i<4; i++)
-                    {
-                        UCHAR aci = (*ptr & 0x60) >> 5; // b5~6 is AC INDEX
-                        pEdcaParm->bACM[aci]  = (((*ptr) & 0x10) == 0x10);   // b5 is ACM
-                        pEdcaParm->Aifsn[aci] = (*ptr) & 0x0f;               // b0~3 is AIFSN
-                        pEdcaParm->Cwmin[aci] = *(ptr+1) & 0x0f;             // b0~4 is Cwmin
-                        pEdcaParm->Cwmax[aci] = *(ptr+1) >> 4;               // b5~8 is Cwmax
-                        pEdcaParm->Txop[aci]  = *(ptr+2) + 256 * (*(ptr+3)); // in unit of 32-us
-                        ptr += 4; // point to next AC
-                    }
-                }
-                else if (NdisEqualMemory(pEid->Octet, WME_INFO_ELEM, 6) && (pEid->Len == 7))
-                {
-                    // parsing EDCA parameters
-                    pEdcaParm->bValid          = TRUE;
-                    pEdcaParm->bQAck           = FALSE; // pEid->Octet[0] & 0x10;
-                    pEdcaParm->bQueueRequest   = FALSE; // pEid->Octet[0] & 0x20;
-                    pEdcaParm->bTxopRequest    = FALSE; // pEid->Octet[0] & 0x40;
-                    pEdcaParm->EdcaUpdateCount = pEid->Octet[6] & 0x0f;
-                    pEdcaParm->bAPSDCapable    = (pEid->Octet[6] & 0x80) ? 1 : 0;
-
-                    // use default EDCA parameter
-                    pEdcaParm->bACM[QID_AC_BE]  = 0;
-                    pEdcaParm->Aifsn[QID_AC_BE] = 3;
-                    pEdcaParm->Cwmin[QID_AC_BE] = CW_MIN_IN_BITS;
-                    pEdcaParm->Cwmax[QID_AC_BE] = CW_MAX_IN_BITS;
-                    pEdcaParm->Txop[QID_AC_BE]  = 0;
-
-                    pEdcaParm->bACM[QID_AC_BK]  = 0;
-                    pEdcaParm->Aifsn[QID_AC_BK] = 7;
-                    pEdcaParm->Cwmin[QID_AC_BK] = CW_MIN_IN_BITS;
-                    pEdcaParm->Cwmax[QID_AC_BK] = CW_MAX_IN_BITS;
-                    pEdcaParm->Txop[QID_AC_BK]  = 0;
-
-                    pEdcaParm->bACM[QID_AC_VI]  = 0;
-                    pEdcaParm->Aifsn[QID_AC_VI] = 2;
-                    pEdcaParm->Cwmin[QID_AC_VI] = CW_MIN_IN_BITS-1;
-                    pEdcaParm->Cwmax[QID_AC_VI] = CW_MAX_IN_BITS;
-                    pEdcaParm->Txop[QID_AC_VI]  = 96;   // AC_VI: 96*32us ~= 3ms
-
-                    pEdcaParm->bACM[QID_AC_VO]  = 0;
-                    pEdcaParm->Aifsn[QID_AC_VO] = 2;
-                    pEdcaParm->Cwmin[QID_AC_VO] = CW_MIN_IN_BITS-2;
-                    pEdcaParm->Cwmax[QID_AC_VO] = CW_MAX_IN_BITS-1;
-                    pEdcaParm->Txop[QID_AC_VO]  = 48;   // AC_VO: 48*32us ~= 1.5ms
-                }
-#ifdef CONFIG_STA_SUPPORT
-#endif // CONFIG_STA_SUPPORT //
-
-
-                break;
-
-            case IE_EXT_SUPP_RATES:
-                if (pEid->Len <= MAX_LEN_OF_SUPPORTED_RATES)
-                {
-                    NdisMoveMemory(ExtRate, pEid->Octet, pEid->Len);
-                    *pExtRateLen = pEid->Len;
-
-                    // TODO: 2004-09-14 not a good design here, cause it exclude extra rates
-                    // from ScanTab. We should report as is. And filter out unsupported
-                    // rates in MlmeAux.
-                    // Check against the supported rates
-                    // RTMPCheckRates(pAd, ExtRate, pExtRateLen);
-                }
-                break;
-
-            case IE_ERP:
-                if (pEid->Len == 1)
-                {
-                    *pErp = (UCHAR)pEid->Octet[0];
-                }
-                break;
-
-            case IE_AIRONET_CKIP:
-                // 0. Check Aironet IE length, it must be larger or equal to 28
-                // Cisco AP350 used length as 28
-                // Cisco AP12XX used length as 30
-                if (pEid->Len < (CKIP_NEGOTIATION_LENGTH - 2))
-                    break;
-
-                // 1. Copy CKIP flag byte to buffer for process
-                *pCkipFlag = *(pEid->Octet + 8);
-                break;
-
-            case IE_AP_TX_POWER:
-                // AP Control of Client Transmit Power
-                //0. Check Aironet IE length, it must be 6
-                if (pEid->Len != 0x06)
-                    break;
-
-                // Get cell power limit in dBm
-                if (NdisEqualMemory(pEid->Octet, CISCO_OUI, 3) == 1)
-                    *pAironetCellPowerLimit = *(pEid->Octet + 4);
-                break;
-
-            // WPA2 & 802.11i RSN
-            case IE_RSN:
-                // There is no OUI for version anymore, check the group cipher OUI before copying
-                if (RTMPEqualMemory(pEid->Octet + 2, RSN_OUI, 3))
-                {
-                    // Copy to pVIE which will report to microsoft bssid list.
-                    Ptr = (PUCHAR) pVIE;
-                    NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid, pEid->Len + 2);
-                    *LengthVIE += (pEid->Len + 2);
-                }
-                break;
-#ifdef CONFIG_STA_SUPPORT
-#ifdef EXT_BUILD_CHANNEL_LIST
-			case IE_COUNTRY:
-				Ptr = (PUCHAR) pVIE;
-                NdisMoveMemory(Ptr + *LengthVIE, &pEid->Eid, pEid->Len + 2);
-                *LengthVIE += (pEid->Len + 2);
-				break;
-#endif // EXT_BUILD_CHANNEL_LIST //
-#endif // CONFIG_STA_SUPPORT //
-
-
-            default:
-                break;
-        }
-
-        Length = Length + 2 + pEid->Len;  // Eid[1] + Len[1]+ content[Len]
-        pEid = (PEID_STRUCT)((UCHAR*)pEid + 2 + pEid->Len);
-    }
-
-    // For some 11a AP. it did not have the channel EID, patch here
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-		UCHAR LatchRfChannel = MsgChannel;
-		if ((pAd->LatchRfRegs.Channel > 14) && ((Sanity & 0x4) == 0))
-		{
-			if (CtrlChannel != 0)
-				*pChannel = CtrlChannel;
-			else
-				*pChannel = LatchRfChannel;
-			Sanity |= 0x4;
-		}
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-	if (Sanity != 0x7)
-	{
-		DBGPRINT(RT_DEBUG_LOUD, ("PeerBeaconAndProbeRspSanity - missing field, Sanity=0x%02x\n", Sanity));
-		return FALSE;
-	}
-	else
-	{
-		return TRUE;
-	}
-
-}
-
-#ifdef DOT11N_DRAFT3
-/*
-	==========================================================================
-	Description:
-		MLME message sanity check for some IE addressed  in 802.11n d3.03.
-	Return:
-		TRUE if all parameters are OK, FALSE otherwise
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-BOOLEAN PeerBeaconAndProbeRspSanity2(
-	IN PRTMP_ADAPTER pAd,
-	IN VOID *Msg,
-	IN ULONG MsgLen,
-	OUT UCHAR	*RegClass)
-{
-	CHAR				*Ptr;
-	PFRAME_802_11		pFrame;
-	PEID_STRUCT			pEid;
-	ULONG				Length = 0;
-
-	pFrame = (PFRAME_802_11)Msg;
-
-	*RegClass = 0;
-	Ptr = (PCHAR) pFrame->Octet;
-	Length += LENGTH_802_11;
-
-	// get timestamp from payload and advance the pointer
-	Ptr += TIMESTAMP_LEN;
-	Length += TIMESTAMP_LEN;
-
-	// get beacon interval from payload and advance the pointer
-	Ptr += 2;
-	Length += 2;
-
-	// get capability info from payload and advance the pointer
-	Ptr += 2;
-	Length += 2;
-
-	pEid = (PEID_STRUCT) Ptr;
-
-	// get variable fields from payload and advance the pointer
-	while ((Length + 2 + pEid->Len) <= MsgLen)
-	{
-		switch(pEid->Eid)
-		{
-			case IE_SUPP_REG_CLASS:
-				if(pEid->Len > 0)
-				{
-					*RegClass = *pEid->Octet;
-				}
-				else
-				{
-					DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAndProbeRspSanity - wrong IE_SSID (len=%d)\n",pEid->Len));
-					return FALSE;
-				}
-				break;
-		}
-
-		Length = Length + 2 + pEid->Len;  // Eid[1] + Len[1]+ content[Len]
-		pEid = (PEID_STRUCT)((UCHAR*)pEid + 2 + pEid->Len);
-	}
-
-	return TRUE;
-
-}
-#endif // DOT11N_DRAFT3 //
-
-/*
-    ==========================================================================
-    Description:
-        MLME message sanity check
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
- */
-BOOLEAN MlmeScanReqSanity(
-	IN PRTMP_ADAPTER pAd,
-	IN VOID *Msg,
-	IN ULONG MsgLen,
-	OUT UCHAR *pBssType,
-	OUT CHAR Ssid[],
-	OUT UCHAR *pSsidLen,
-	OUT UCHAR *pScanType)
-{
-	MLME_SCAN_REQ_STRUCT *Info;
-
-	Info = (MLME_SCAN_REQ_STRUCT *)(Msg);
-	*pBssType = Info->BssType;
-	*pSsidLen = Info->SsidLen;
-	NdisMoveMemory(Ssid, Info->Ssid, *pSsidLen);
-	*pScanType = Info->ScanType;
-
-	if ((*pBssType == BSS_INFRA || *pBssType == BSS_ADHOC || *pBssType == BSS_ANY)
-		&& (*pScanType == SCAN_ACTIVE || *pScanType == SCAN_PASSIVE
-#ifdef CONFIG_STA_SUPPORT
-#endif // CONFIG_STA_SUPPORT //
-		))
-	{
-		return TRUE;
-	}
-	else
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("MlmeScanReqSanity fail - wrong BssType or ScanType\n"));
-		return FALSE;
-	}
-}
-
-// IRQL = DISPATCH_LEVEL
-UCHAR ChannelSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN UCHAR channel)
-{
-    int i;
-
-    for (i = 0; i < pAd->ChannelListNum; i ++)
-    {
-        if (channel == pAd->ChannelList[i].Channel)
-            return 1;
-    }
-    return 0;
-}
-
-/*
-    ==========================================================================
-    Description:
-        MLME message sanity check
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-
-	IRQL = DISPATCH_LEVEL
-
-    ==========================================================================
- */
-BOOLEAN PeerDeauthSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN VOID *Msg,
-    IN ULONG MsgLen,
-    OUT PUCHAR pAddr2,
-    OUT USHORT *pReason)
-{
-    PFRAME_802_11 pFrame = (PFRAME_802_11)Msg;
-
-    COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
-    NdisMoveMemory(pReason, &pFrame->Octet[0], 2);
-
-    return TRUE;
-}
-
-/*
-    ==========================================================================
-    Description:
-        MLME message sanity check
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-
-	IRQL = DISPATCH_LEVEL
-
-    ==========================================================================
- */
-BOOLEAN PeerAuthSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN VOID *Msg,
-    IN ULONG MsgLen,
-    OUT PUCHAR pAddr,
-    OUT USHORT *pAlg,
-    OUT USHORT *pSeq,
-    OUT USHORT *pStatus,
-    CHAR *pChlgText)
-{
-    PFRAME_802_11 pFrame = (PFRAME_802_11)Msg;
-
-    COPY_MAC_ADDR(pAddr,   pFrame->Hdr.Addr2);
-    NdisMoveMemory(pAlg,    &pFrame->Octet[0], 2);
-    NdisMoveMemory(pSeq,    &pFrame->Octet[2], 2);
-    NdisMoveMemory(pStatus, &pFrame->Octet[4], 2);
-
-    if (*pAlg == AUTH_MODE_OPEN)
-    {
-        if (*pSeq == 1 || *pSeq == 2)
-        {
-            return TRUE;
-        }
-        else
-        {
-            DBGPRINT(RT_DEBUG_TRACE, ("PeerAuthSanity fail - wrong Seg#\n"));
-            return FALSE;
-        }
-    }
-    else if (*pAlg == AUTH_MODE_KEY)
-    {
-        if (*pSeq == 1 || *pSeq == 4)
-        {
-            return TRUE;
-        }
-        else if (*pSeq == 2 || *pSeq == 3)
-        {
-            NdisMoveMemory(pChlgText, &pFrame->Octet[8], CIPHER_TEXT_LEN);
-            return TRUE;
-        }
-        else
-        {
-            DBGPRINT(RT_DEBUG_TRACE, ("PeerAuthSanity fail - wrong Seg#\n"));
-            return FALSE;
-        }
-    }
-    else
-    {
-        DBGPRINT(RT_DEBUG_TRACE, ("PeerAuthSanity fail - wrong algorithm\n"));
-        return FALSE;
-    }
-}
-
-/*
-    ==========================================================================
-    Description:
-        MLME message sanity check
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
- */
-BOOLEAN MlmeAuthReqSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN VOID *Msg,
-    IN ULONG MsgLen,
-    OUT PUCHAR pAddr,
-    OUT ULONG *pTimeout,
-    OUT USHORT *pAlg)
-{
-    MLME_AUTH_REQ_STRUCT *pInfo;
-
-    pInfo  = (MLME_AUTH_REQ_STRUCT *)Msg;
-    COPY_MAC_ADDR(pAddr, pInfo->Addr);
-    *pTimeout = pInfo->Timeout;
-    *pAlg = pInfo->Alg;
-
-    if (((*pAlg == AUTH_MODE_KEY) ||(*pAlg == AUTH_MODE_OPEN)
-	) &&
-        ((*pAddr & 0x01) == 0))
-    {
-        return TRUE;
-    }
-    else
-    {
-        DBGPRINT(RT_DEBUG_TRACE, ("MlmeAuthReqSanity fail - wrong algorithm\n"));
-        return FALSE;
-    }
-}
-
-/*
-    ==========================================================================
-    Description:
-        MLME message sanity check
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-
-	IRQL = DISPATCH_LEVEL
-
-    ==========================================================================
- */
-BOOLEAN MlmeAssocReqSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN VOID *Msg,
-    IN ULONG MsgLen,
-    OUT PUCHAR pApAddr,
-    OUT USHORT *pCapabilityInfo,
-    OUT ULONG *pTimeout,
-    OUT USHORT *pListenIntv)
-{
-    MLME_ASSOC_REQ_STRUCT *pInfo;
-
-    pInfo = (MLME_ASSOC_REQ_STRUCT *)Msg;
-    *pTimeout = pInfo->Timeout;                             // timeout
-    COPY_MAC_ADDR(pApAddr, pInfo->Addr);                   // AP address
-    *pCapabilityInfo = pInfo->CapabilityInfo;               // capability info
-    *pListenIntv = pInfo->ListenIntv;
-
-    return TRUE;
-}
-
-/*
-    ==========================================================================
-    Description:
-        MLME message sanity check
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-
-	IRQL = DISPATCH_LEVEL
-
-    ==========================================================================
- */
-BOOLEAN PeerDisassocSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN VOID *Msg,
-    IN ULONG MsgLen,
-    OUT PUCHAR pAddr2,
-    OUT USHORT *pReason)
-{
-    PFRAME_802_11 pFrame = (PFRAME_802_11)Msg;
-
-    COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
-    NdisMoveMemory(pReason, &pFrame->Octet[0], 2);
-
-    return TRUE;
-}
-
-/*
-	========================================================================
-	Routine Description:
-		Sanity check NetworkType (11b, 11g or 11a)
-
-	Arguments:
-		pBss - Pointer to BSS table.
-
-	Return Value:
-        Ndis802_11DS .......(11b)
-        Ndis802_11OFDM24....(11g)
-        Ndis802_11OFDM5.....(11a)
-
-	IRQL = DISPATCH_LEVEL
-
-	========================================================================
-*/
-NDIS_802_11_NETWORK_TYPE NetworkTypeInUseSanity(
-    IN PBSS_ENTRY pBss)
-{
-	NDIS_802_11_NETWORK_TYPE	NetWorkType;
-	UCHAR						rate, i;
-
-	NetWorkType = Ndis802_11DS;
-
-	if (pBss->Channel <= 14)
-	{
-		//
-		// First check support Rate.
-		//
-		for (i = 0; i < pBss->SupRateLen; i++)
-		{
-			rate = pBss->SupRate[i] & 0x7f; // Mask out basic rate set bit
-			if ((rate == 2) || (rate == 4) || (rate == 11) || (rate == 22))
-			{
-				continue;
-			}
-			else
-			{
-				//
-				// Otherwise (even rate > 108) means Ndis802_11OFDM24
-				//
-				NetWorkType = Ndis802_11OFDM24;
-				break;
-			}
-		}
-
-		//
-		// Second check Extend Rate.
-		//
-		if (NetWorkType != Ndis802_11OFDM24)
-		{
-			for (i = 0; i < pBss->ExtRateLen; i++)
-			{
-				rate = pBss->SupRate[i] & 0x7f; // Mask out basic rate set bit
-				if ((rate == 2) || (rate == 4) || (rate == 11) || (rate == 22))
-				{
-					continue;
-				}
-				else
-				{
-					//
-					// Otherwise (even rate > 108) means Ndis802_11OFDM24
-					//
-					NetWorkType = Ndis802_11OFDM24;
-					break;
-				}
-			}
-		}
-	}
-	else
-	{
-		NetWorkType = Ndis802_11OFDM5;
-	}
-
-    if (pBss->HtCapabilityLen != 0)
-    {
-        if (NetWorkType == Ndis802_11OFDM5)
-            NetWorkType = Ndis802_11OFDM5_N;
-        else
-            NetWorkType = Ndis802_11OFDM24_N;
-    }
-
-	return NetWorkType;
-}
-
-/*
-    ==========================================================================
-    Description:
-        Check the validity of the received EAPoL frame
-    Return:
-        TRUE if all parameters are OK,
-        FALSE otherwise
-    ==========================================================================
- */
-BOOLEAN PeerWpaMessageSanity(
-    IN	PRTMP_ADAPTER		pAd,
-    IN	PEAPOL_PACKET		pMsg,
-    IN	ULONG				MsgLen,
-    IN	UCHAR				MsgType,
-    IN	MAC_TABLE_ENTRY		*pEntry)
-{
-	UCHAR			mic[LEN_KEY_DESC_MIC], digest[80], KEYDATA[MAX_LEN_OF_RSNIE];
-	BOOLEAN			bReplayDiff = FALSE;
-	BOOLEAN			bWPA2 = FALSE;
-	KEY_INFO		EapolKeyInfo;
-	UCHAR			GroupKeyIndex = 0;
-
-
-	NdisZeroMemory(mic, sizeof(mic));
-	NdisZeroMemory(digest, sizeof(digest));
-	NdisZeroMemory(KEYDATA, sizeof(KEYDATA));
-	NdisZeroMemory((PUCHAR)&EapolKeyInfo, sizeof(EapolKeyInfo));
-
-	NdisMoveMemory((PUCHAR)&EapolKeyInfo, (PUCHAR)&pMsg->KeyDesc.KeyInfo, sizeof(KEY_INFO));
-
-	*((USHORT *)&EapolKeyInfo) = cpu2le16(*((USHORT *)&EapolKeyInfo));
-
-	// Choose WPA2 or not
-	if ((pEntry->AuthMode == Ndis802_11AuthModeWPA2) || (pEntry->AuthMode == Ndis802_11AuthModeWPA2PSK))
-		bWPA2 = TRUE;
-
-	// 0. Check MsgType
-	if ((MsgType > EAPOL_GROUP_MSG_2) || (MsgType < EAPOL_PAIR_MSG_1))
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("The message type is invalid(%d)! \n", MsgType));
-		return FALSE;
-	}
-
-	// 1. Replay counter check
-	if (MsgType == EAPOL_PAIR_MSG_1 || MsgType == EAPOL_PAIR_MSG_3 || MsgType == EAPOL_GROUP_MSG_1)	// For supplicant
-    {
-	// First validate replay counter, only accept message with larger replay counter.
-		// Let equal pass, some AP start with all zero replay counter
-		UCHAR	ZeroReplay[LEN_KEY_DESC_REPLAY];
-
-        NdisZeroMemory(ZeroReplay, LEN_KEY_DESC_REPLAY);
-		if ((RTMPCompareMemory(pMsg->KeyDesc.ReplayCounter, pEntry->R_Counter, LEN_KEY_DESC_REPLAY) != 1) &&
-			(RTMPCompareMemory(pMsg->KeyDesc.ReplayCounter, ZeroReplay, LEN_KEY_DESC_REPLAY) != 0))
-	{
-			bReplayDiff = TRUE;
-	}
-	}
-	else if (MsgType == EAPOL_PAIR_MSG_2 || MsgType == EAPOL_PAIR_MSG_4 || MsgType == EAPOL_GROUP_MSG_2)	// For authenticator
-	{
-		// check Replay Counter coresponds to MSG from authenticator, otherwise discard
-	if (!NdisEqualMemory(pMsg->KeyDesc.ReplayCounter, pEntry->R_Counter, LEN_KEY_DESC_REPLAY))
-	{
-			bReplayDiff = TRUE;
-	}
-	}
-
-	// Replay Counter different condition
-	if (bReplayDiff)
-	{
-		// send wireless event - for replay counter different
-		if (pAd->CommonCfg.bWirelessEvent)
-			RTMPSendWirelessEvent(pAd, IW_REPLAY_COUNTER_DIFF_EVENT_FLAG, pEntry->Addr, pEntry->apidx, 0);
-
-		if (MsgType < EAPOL_GROUP_MSG_1)
-		{
-		DBGPRINT(RT_DEBUG_ERROR, ("Replay Counter Different in pairwise msg %d of 4-way handshake!\n", MsgType));
-		}
-		else
-		{
-			DBGPRINT(RT_DEBUG_ERROR, ("Replay Counter Different in group msg %d of 2-way handshake!\n", (MsgType - EAPOL_PAIR_MSG_4)));
-		}
-
-		hex_dump("Receive replay counter ", pMsg->KeyDesc.ReplayCounter, LEN_KEY_DESC_REPLAY);
-		hex_dump("Current replay counter ", pEntry->R_Counter, LEN_KEY_DESC_REPLAY);
-        return FALSE;
-	}
-
-	// 2. Verify MIC except Pairwise Msg1
-	if (MsgType != EAPOL_PAIR_MSG_1)
-	{
-		UCHAR			rcvd_mic[LEN_KEY_DESC_MIC];
-
-		// Record the received MIC for check later
-		NdisMoveMemory(rcvd_mic, pMsg->KeyDesc.KeyMic, LEN_KEY_DESC_MIC);
-		NdisZeroMemory(pMsg->KeyDesc.KeyMic, LEN_KEY_DESC_MIC);
-
-        if (EapolKeyInfo.KeyDescVer == DESC_TYPE_TKIP)	// TKIP
-        {
-            HMAC_MD5(pEntry->PTK, LEN_EAP_MICK, (PUCHAR)pMsg, MsgLen, mic, MD5_DIGEST_SIZE);
-        }
-        else if (EapolKeyInfo.KeyDescVer == DESC_TYPE_AES)	// AES
-        {
-            HMAC_SHA1(pEntry->PTK, LEN_EAP_MICK, (PUCHAR)pMsg, MsgLen, digest, SHA1_DIGEST_SIZE);
-            NdisMoveMemory(mic, digest, LEN_KEY_DESC_MIC);
-        }
-
-        if (!NdisEqualMemory(rcvd_mic, mic, LEN_KEY_DESC_MIC))
-        {
-			// send wireless event - for MIC different
-			if (pAd->CommonCfg.bWirelessEvent)
-				RTMPSendWirelessEvent(pAd, IW_MIC_DIFF_EVENT_FLAG, pEntry->Addr, pEntry->apidx, 0);
-
-			if (MsgType < EAPOL_GROUP_MSG_1)
-			{
-		DBGPRINT(RT_DEBUG_ERROR, ("MIC Different in pairwise msg %d of 4-way handshake!\n", MsgType));
-			}
-			else
-			{
-				DBGPRINT(RT_DEBUG_ERROR, ("MIC Different in group msg %d of 2-way handshake!\n", (MsgType - EAPOL_PAIR_MSG_4)));
-			}
-
-			hex_dump("Received MIC", rcvd_mic, LEN_KEY_DESC_MIC);
-			hex_dump("Desired  MIC", mic, LEN_KEY_DESC_MIC);
-
-			return FALSE;
-        }
-	}
-
-	// 1. Decrypt the Key Data field if GTK is included.
-	// 2. Extract the context of the Key Data field if it exist.
-	// The field in pairwise_msg_2_WPA1(WPA2) & pairwise_msg_3_WPA1 is clear.
-	// The field in group_msg_1_WPA1(WPA2) & pairwise_msg_3_WPA2 is encrypted.
-	if (CONV_ARRARY_TO_UINT16(pMsg->KeyDesc.KeyDataLen) > 0)
-	{
-		// Decrypt this field
-		if ((MsgType == EAPOL_PAIR_MSG_3 && bWPA2) || (MsgType == EAPOL_GROUP_MSG_1))
-		{
-			if(
-				(EapolKeyInfo.KeyDescVer == DESC_TYPE_AES))
-			{
-				// AES
-				AES_GTK_KEY_UNWRAP(&pEntry->PTK[16], KEYDATA,
-									CONV_ARRARY_TO_UINT16(pMsg->KeyDesc.KeyDataLen),
-									pMsg->KeyDesc.KeyData);
-			}
-			else
-			{
-				INT	i;
-				UCHAR   Key[32];
-				// Decrypt TKIP GTK
-				// Construct 32 bytes RC4 Key
-				NdisMoveMemory(Key, pMsg->KeyDesc.KeyIv, 16);
-				NdisMoveMemory(&Key[16], &pEntry->PTK[16], 16);
-				ARCFOUR_INIT(&pAd->PrivateInfo.WEPCONTEXT, Key, 32);
-				//discard first 256 bytes
-				for(i = 0; i < 256; i++)
-					ARCFOUR_BYTE(&pAd->PrivateInfo.WEPCONTEXT);
-				// Decrypt GTK. Becareful, there is no ICV to check the result is correct or not
-				ARCFOUR_DECRYPT(&pAd->PrivateInfo.WEPCONTEXT, KEYDATA,
-								pMsg->KeyDesc.KeyData,
-								CONV_ARRARY_TO_UINT16(pMsg->KeyDesc.KeyDataLen));
-			}
-
-			if (!bWPA2 && (MsgType == EAPOL_GROUP_MSG_1))
-				GroupKeyIndex = EapolKeyInfo.KeyIndex;
-
-		}
-		else if ((MsgType == EAPOL_PAIR_MSG_2) || (MsgType == EAPOL_PAIR_MSG_3 && !bWPA2))
-		{
-			NdisMoveMemory(KEYDATA, pMsg->KeyDesc.KeyData, CONV_ARRARY_TO_UINT16(pMsg->KeyDesc.KeyDataLen));
-		}
-		else
-		{
-
-			return TRUE;
-		}
-
-		// Parse Key Data field to
-		// 1. verify RSN IE for pairwise_msg_2_WPA1(WPA2) ,pairwise_msg_3_WPA1(WPA2)
-		// 2. verify KDE format for pairwise_msg_3_WPA2, group_msg_1_WPA2
-		// 3. update shared key for pairwise_msg_3_WPA2, group_msg_1_WPA1(WPA2)
-		if (!RTMPParseEapolKeyData(pAd, KEYDATA,
-								  CONV_ARRARY_TO_UINT16(pMsg->KeyDesc.KeyDataLen),
-								  GroupKeyIndex, MsgType, bWPA2, pEntry))
-		{
-			return FALSE;
-		}
-	}
-
-	return TRUE;
-
-}
-
-#ifdef CONFIG_STA_SUPPORT
-#ifdef QOS_DLS_SUPPORT
-BOOLEAN MlmeDlsReqSanity(
-	IN PRTMP_ADAPTER pAd,
-    IN VOID *Msg,
-    IN ULONG MsgLen,
-    OUT PRT_802_11_DLS *pDLS,
-    OUT PUSHORT pReason)
-{
-	MLME_DLS_REQ_STRUCT *pInfo;
-
-    pInfo = (MLME_DLS_REQ_STRUCT *)Msg;
-
-	*pDLS = pInfo->pDLS;
-	*pReason = pInfo->Reason;
-
-	return TRUE;
-}
-#endif // QOS_DLS_SUPPORT //
-#endif // CONFIG_STA_SUPPORT //
-
-#ifdef QOS_DLS_SUPPORT
-BOOLEAN PeerDlsReqSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN VOID *Msg,
-    IN ULONG MsgLen,
-    OUT PUCHAR pDA,
-    OUT PUCHAR pSA,
-    OUT USHORT *pCapabilityInfo,
-    OUT USHORT *pDlsTimeout,
-    OUT UCHAR *pRatesLen,
-    OUT UCHAR Rates[],
-	OUT UCHAR *pHtCapabilityLen,
-    OUT HT_CAPABILITY_IE *pHtCapability)
-{
-	CHAR            *Ptr;
-    PFRAME_802_11	Fr = (PFRAME_802_11)Msg;
-	PEID_STRUCT  eid_ptr;
-
-    // to prevent caller from using garbage output value
-    *pCapabilityInfo	= 0;
-    *pDlsTimeout	= 0;
-	*pHtCapabilityLen = 0;
-
-    Ptr = (PCHAR)Fr->Octet;
-
-	// offset to destination MAC address (Category and Action field)
-    Ptr += 2;
-
-    // get DA from payload and advance the pointer
-    NdisMoveMemory(pDA, Ptr, MAC_ADDR_LEN);
-    Ptr += MAC_ADDR_LEN;
-
-    // get SA from payload and advance the pointer
-    NdisMoveMemory(pSA, Ptr, MAC_ADDR_LEN);
-    Ptr += MAC_ADDR_LEN;
-
-    // get capability info from payload and advance the pointer
-    NdisMoveMemory(pCapabilityInfo, Ptr, 2);
-    Ptr += 2;
-
-    // get capability info from payload and advance the pointer
-    NdisMoveMemory(pDlsTimeout, Ptr, 2);
-    Ptr += 2;
-
-	// Category and Action field + DA + SA + capability + Timeout
-	eid_ptr = (PEID_STRUCT) &Fr->Octet[18];
-
-	while (((UCHAR*)eid_ptr + eid_ptr->Len + 1) < ((UCHAR*)Fr + MsgLen))
-	{
-		switch(eid_ptr->Eid)
-		{
-			case IE_SUPP_RATES:
-                if ((eid_ptr->Len <= MAX_LEN_OF_SUPPORTED_RATES) && (eid_ptr->Len > 0))
-                {
-                    NdisMoveMemory(Rates, eid_ptr->Octet, eid_ptr->Len);
-                    DBGPRINT(RT_DEBUG_TRACE, ("PeerDlsReqSanity - IE_SUPP_RATES., Len=%d. Rates[0]=%x\n",eid_ptr->Len, Rates[0]));
-                    DBGPRINT(RT_DEBUG_TRACE, ("Rates[1]=%x %x %x %x %x %x %x\n", Rates[1], Rates[2], Rates[3], Rates[4], Rates[5], Rates[6], Rates[7]));
-                    *pRatesLen = eid_ptr->Len;
-                }
-                else
-                {
-                    *pRatesLen = 8;
-					Rates[0] = 0x82;
-					Rates[1] = 0x84;
-					Rates[2] = 0x8b;
-					Rates[3] = 0x96;
-					Rates[4] = 0x12;
-					Rates[5] = 0x24;
-					Rates[6] = 0x48;
-					Rates[7] = 0x6c;
-                    DBGPRINT(RT_DEBUG_TRACE, ("PeerDlsReqSanity - wrong IE_SUPP_RATES., Len=%d\n",eid_ptr->Len));
-                }
-				break;
-
-			case IE_EXT_SUPP_RATES:
-                if (eid_ptr->Len + *pRatesLen <= MAX_LEN_OF_SUPPORTED_RATES)
-                {
-                    NdisMoveMemory(&Rates[*pRatesLen], eid_ptr->Octet, eid_ptr->Len);
-                    *pRatesLen = (*pRatesLen) + eid_ptr->Len;
-                }
-                else
-                {
-                    NdisMoveMemory(&Rates[*pRatesLen], eid_ptr->Octet, MAX_LEN_OF_SUPPORTED_RATES - (*pRatesLen));
-                    *pRatesLen = MAX_LEN_OF_SUPPORTED_RATES;
-                }
-				break;
-
-			case IE_HT_CAP:
-				if (eid_ptr->Len >= sizeof(HT_CAPABILITY_IE))
-				{
-					NdisMoveMemory(pHtCapability, eid_ptr->Octet, sizeof(HT_CAPABILITY_IE));
-
-					*(USHORT *)(&pHtCapability->HtCapInfo) = cpu2le16(*(USHORT *)(&pHtCapability->HtCapInfo));
-#ifdef UNALIGNMENT_SUPPORT
-					{
-						EXT_HT_CAP_INFO extHtCapInfo;
-
-						NdisMoveMemory((PUCHAR)(&extHtCapInfo), (PUCHAR)(&pHtCapability->ExtHtCapInfo), sizeof(EXT_HT_CAP_INFO));
-						*(USHORT *)(&extHtCapInfo) = cpu2le16(*(USHORT *)(&extHtCapInfo));
-						NdisMoveMemory((PUCHAR)(&pHtCapability->ExtHtCapInfo), (PUCHAR)(&extHtCapInfo), sizeof(EXT_HT_CAP_INFO));
-					}
-#else
-					*(USHORT *)(&pHtCapability->ExtHtCapInfo) = cpu2le16(*(USHORT *)(&pHtCapability->ExtHtCapInfo));
-#endif // UNALIGNMENT_SUPPORT //
-					*pHtCapabilityLen = sizeof(HT_CAPABILITY_IE);
-
-					DBGPRINT(RT_DEBUG_TRACE, ("PeerDlsReqSanity - IE_HT_CAP\n"));
-				}
-				else
-				{
-					DBGPRINT(RT_DEBUG_TRACE, ("PeerDlsReqSanity - wrong IE_HT_CAP.eid_ptr->Len = %d\n", eid_ptr->Len));
-				}
-				break;
-
-			default:
-				break;
-		}
-
-		eid_ptr = (PEID_STRUCT)((UCHAR*)eid_ptr + 2 + eid_ptr->Len);
-	}
-
-    return TRUE;
-}
-
-BOOLEAN PeerDlsRspSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN VOID *Msg,
-    IN ULONG MsgLen,
-    OUT PUCHAR pDA,
-    OUT PUCHAR pSA,
-    OUT USHORT *pCapabilityInfo,
-    OUT USHORT *pStatus,
-    OUT UCHAR *pRatesLen,
-    OUT UCHAR Rates[],
-    OUT UCHAR *pHtCapabilityLen,
-    OUT HT_CAPABILITY_IE *pHtCapability)
-{
-    CHAR            *Ptr;
-    PFRAME_802_11	Fr = (PFRAME_802_11)Msg;
-	PEID_STRUCT  eid_ptr;
-
-    // to prevent caller from using garbage output value
-    *pStatus		= 0;
-    *pCapabilityInfo	= 0;
-	*pHtCapabilityLen = 0;
-
-    Ptr = (PCHAR)Fr->Octet;
-
-	// offset to destination MAC address (Category and Action field)
-    Ptr += 2;
-
-	// get status code from payload and advance the pointer
-    NdisMoveMemory(pStatus, Ptr, 2);
-    Ptr += 2;
-
-    // get DA from payload and advance the pointer
-    NdisMoveMemory(pDA, Ptr, MAC_ADDR_LEN);
-    Ptr += MAC_ADDR_LEN;
-
-    // get SA from payload and advance the pointer
-    NdisMoveMemory(pSA, Ptr, MAC_ADDR_LEN);
-    Ptr += MAC_ADDR_LEN;
-
-	if (pStatus == 0)
-	{
-	    // get capability info from payload and advance the pointer
-	    NdisMoveMemory(pCapabilityInfo, Ptr, 2);
-	    Ptr += 2;
-	}
-
-	// Category and Action field + status code + DA + SA + capability
-	eid_ptr = (PEID_STRUCT) &Fr->Octet[18];
-
-	while (((UCHAR*)eid_ptr + eid_ptr->Len + 1) < ((UCHAR*)Fr + MsgLen))
-	{
-		switch(eid_ptr->Eid)
-		{
-			case IE_SUPP_RATES:
-                if ((eid_ptr->Len <= MAX_LEN_OF_SUPPORTED_RATES) && (eid_ptr->Len > 0))
-                {
-                    NdisMoveMemory(Rates, eid_ptr->Octet, eid_ptr->Len);
-                    DBGPRINT(RT_DEBUG_TRACE, ("PeerDlsRspSanity - IE_SUPP_RATES., Len=%d. Rates[0]=%x\n",eid_ptr->Len, Rates[0]));
-                    DBGPRINT(RT_DEBUG_TRACE, ("Rates[1]=%x %x %x %x %x %x %x\n", Rates[1], Rates[2], Rates[3], Rates[4], Rates[5], Rates[6], Rates[7]));
-                    *pRatesLen = eid_ptr->Len;
-                }
-                else
-                {
-                    *pRatesLen = 8;
-					Rates[0] = 0x82;
-					Rates[1] = 0x84;
-					Rates[2] = 0x8b;
-					Rates[3] = 0x96;
-					Rates[4] = 0x12;
-					Rates[5] = 0x24;
-					Rates[6] = 0x48;
-					Rates[7] = 0x6c;
-                    DBGPRINT(RT_DEBUG_TRACE, ("PeerDlsRspSanity - wrong IE_SUPP_RATES., Len=%d\n",eid_ptr->Len));
-                }
-				break;
-
-			case IE_EXT_SUPP_RATES:
-                if (eid_ptr->Len + *pRatesLen <= MAX_LEN_OF_SUPPORTED_RATES)
-                {
-                    NdisMoveMemory(&Rates[*pRatesLen], eid_ptr->Octet, eid_ptr->Len);
-                    *pRatesLen = (*pRatesLen) + eid_ptr->Len;
-                }
-                else
-                {
-                    NdisMoveMemory(&Rates[*pRatesLen], eid_ptr->Octet, MAX_LEN_OF_SUPPORTED_RATES - (*pRatesLen));
-                    *pRatesLen = MAX_LEN_OF_SUPPORTED_RATES;
-                }
-				break;
-
-			case IE_HT_CAP:
-				if (eid_ptr->Len >= sizeof(HT_CAPABILITY_IE))
-				{
-					NdisMoveMemory(pHtCapability, eid_ptr->Octet, sizeof(HT_CAPABILITY_IE));
-
-					*(USHORT *)(&pHtCapability->HtCapInfo) = cpu2le16(*(USHORT *)(&pHtCapability->HtCapInfo));
-#ifdef UNALIGNMENT_SUPPORT
-					{
-						EXT_HT_CAP_INFO extHtCapInfo;
-
-						NdisMoveMemory((PUCHAR)(&extHtCapInfo), (PUCHAR)(&pHtCapability->ExtHtCapInfo), sizeof(EXT_HT_CAP_INFO));
-						*(USHORT *)(&extHtCapInfo) = cpu2le16(*(USHORT *)(&extHtCapInfo));
-						NdisMoveMemory((PUCHAR)(&pHtCapability->ExtHtCapInfo), (PUCHAR)(&extHtCapInfo), sizeof(EXT_HT_CAP_INFO));
-					}
-#else
-					*(USHORT *)(&pHtCapability->ExtHtCapInfo) = cpu2le16(*(USHORT *)(&pHtCapability->ExtHtCapInfo));
-#endif // UNALIGNMENT_SUPPORT //
-					*pHtCapabilityLen = sizeof(HT_CAPABILITY_IE);
-
-					DBGPRINT(RT_DEBUG_TRACE, ("PeerDlsRspSanity - IE_HT_CAP\n"));
-				}
-				else
-				{
-					DBGPRINT(RT_DEBUG_TRACE, ("PeerDlsRspSanity - wrong IE_HT_CAP.eid_ptr->Len = %d\n", eid_ptr->Len));
-				}
-				break;
-
-			default:
-				break;
-		}
-
-		eid_ptr = (PEID_STRUCT)((UCHAR*)eid_ptr + 2 + eid_ptr->Len);
-	}
-
-    return TRUE;
-}
-
-BOOLEAN PeerDlsTearDownSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN VOID *Msg,
-    IN ULONG MsgLen,
-    OUT PUCHAR pDA,
-    OUT PUCHAR pSA,
-    OUT USHORT *pReason)
-{
-    CHAR            *Ptr;
-    PFRAME_802_11	Fr = (PFRAME_802_11)Msg;
-
-    // to prevent caller from using garbage output value
-    *pReason	= 0;
-
-    Ptr = (PCHAR)Fr->Octet;
-
-	// offset to destination MAC address (Category and Action field)
-    Ptr += 2;
-
-    // get DA from payload and advance the pointer
-    NdisMoveMemory(pDA, Ptr, MAC_ADDR_LEN);
-    Ptr += MAC_ADDR_LEN;
-
-    // get SA from payload and advance the pointer
-    NdisMoveMemory(pSA, Ptr, MAC_ADDR_LEN);
-    Ptr += MAC_ADDR_LEN;
-
-	// get reason code from payload and advance the pointer
-    NdisMoveMemory(pReason, Ptr, 2);
-    Ptr += 2;
-
-    return TRUE;
-}
-#endif // QOS_DLS_SUPPORT //
diff --git a/drivers/staging/rt3090/common/cmm_sync.c b/drivers/staging/rt3090/common/cmm_sync.c
deleted file mode 100644
index 6d7b974d7e15..000000000000
--- a/drivers/staging/rt3090/common/cmm_sync.c
+++ /dev/null
@@ -1,734 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-	Module Name:
-	cmm_sync.c
-
-	Abstract:
-
-	Revision History:
-	Who			When			What
-	--------	----------		----------------------------------------------
-	John Chang	2004-09-01      modified for rt2561/2661
-*/
-
-#include "../rt_config.h"
-
-
-// 2.4 Ghz channel plan index in the TxPower arrays.
-#define	BG_BAND_REGION_0_START	0			// 1,2,3,4,5,6,7,8,9,10,11
-#define	BG_BAND_REGION_0_SIZE	11
-#define	BG_BAND_REGION_1_START	0			// 1,2,3,4,5,6,7,8,9,10,11,12,13
-#define	BG_BAND_REGION_1_SIZE	13
-#define	BG_BAND_REGION_2_START	9			// 10,11
-#define	BG_BAND_REGION_2_SIZE	2
-#define	BG_BAND_REGION_3_START	9			// 10,11,12,13
-#define	BG_BAND_REGION_3_SIZE	4
-#define	BG_BAND_REGION_4_START	13			// 14
-#define	BG_BAND_REGION_4_SIZE	1
-#define	BG_BAND_REGION_5_START	0			// 1,2,3,4,5,6,7,8,9,10,11,12,13,14
-#define	BG_BAND_REGION_5_SIZE	14
-#define	BG_BAND_REGION_6_START	2			// 3,4,5,6,7,8,9
-#define	BG_BAND_REGION_6_SIZE	7
-#define	BG_BAND_REGION_7_START	4			// 5,6,7,8,9,10,11,12,13
-#define	BG_BAND_REGION_7_SIZE	9
-#define	BG_BAND_REGION_31_START	0			// 1,2,3,4,5,6,7,8,9,10,11,12,13,14
-#define	BG_BAND_REGION_31_SIZE	14
-
-// 5 Ghz channel plan index in the TxPower arrays.
-UCHAR A_BAND_REGION_0_CHANNEL_LIST[]={36, 40, 44, 48, 52, 56, 60, 64, 149, 153, 157, 161, 165};
-UCHAR A_BAND_REGION_1_CHANNEL_LIST[]={36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140};
-UCHAR A_BAND_REGION_2_CHANNEL_LIST[]={36, 40, 44, 48, 52, 56, 60, 64};
-UCHAR A_BAND_REGION_3_CHANNEL_LIST[]={52, 56, 60, 64, 149, 153, 157, 161};
-UCHAR A_BAND_REGION_4_CHANNEL_LIST[]={149, 153, 157, 161, 165};
-UCHAR A_BAND_REGION_5_CHANNEL_LIST[]={149, 153, 157, 161};
-UCHAR A_BAND_REGION_6_CHANNEL_LIST[]={36, 40, 44, 48};
-UCHAR A_BAND_REGION_7_CHANNEL_LIST[]={36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 149, 153, 157, 161, 165, 169, 173};
-UCHAR A_BAND_REGION_8_CHANNEL_LIST[]={52, 56, 60, 64};
-UCHAR A_BAND_REGION_9_CHANNEL_LIST[]={36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 132, 136, 140, 149, 153, 157, 161, 165};
-UCHAR A_BAND_REGION_10_CHANNEL_LIST[]={36, 40, 44, 48, 149, 153, 157, 161, 165};
-UCHAR A_BAND_REGION_11_CHANNEL_LIST[]={36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 149, 153, 157, 161};
-UCHAR A_BAND_REGION_12_CHANNEL_LIST[]={36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140};
-UCHAR A_BAND_REGION_13_CHANNEL_LIST[]={52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 149, 153, 157, 161};
-UCHAR A_BAND_REGION_14_CHANNEL_LIST[]={36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 136, 140, 149, 153, 157, 161, 165};
-UCHAR A_BAND_REGION_15_CHANNEL_LIST[]={149, 153, 157, 161, 165, 169, 173};
-
-
-//BaSizeArray follows the 802.11n definition as MaxRxFactor.  2^(13+factor) bytes. When factor =0, it's about Ba buffer size =8.
-UCHAR BaSizeArray[4] = {8,16,32,64};
-
-/*
-	==========================================================================
-	Description:
-		Update StaCfg->ChannelList[] according to 1) Country Region 2) RF IC type,
-		and 3) PHY-mode user selected.
-		The outcome is used by driver when doing site survey.
-
-	IRQL = PASSIVE_LEVEL
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-VOID BuildChannelList(
-	IN PRTMP_ADAPTER pAd)
-{
-	UCHAR i, j, index=0, num=0;
-	PUCHAR	pChannelList = NULL;
-
-	NdisZeroMemory(pAd->ChannelList, MAX_NUM_OF_CHANNELS * sizeof(CHANNEL_TX_POWER));
-
-	// if not 11a-only mode, channel list starts from 2.4Ghz band
-	if ((pAd->CommonCfg.PhyMode != PHY_11A)
-#ifdef DOT11_N_SUPPORT
-		&& (pAd->CommonCfg.PhyMode != PHY_11AN_MIXED) && (pAd->CommonCfg.PhyMode != PHY_11N_5G)
-#endif // DOT11_N_SUPPORT //
-	)
-	{
-		switch (pAd->CommonCfg.CountryRegion  & 0x7f)
-		{
-			case REGION_0_BG_BAND:	// 1 -11
-				NdisMoveMemory(&pAd->ChannelList[index], &pAd->TxPower[BG_BAND_REGION_0_START], sizeof(CHANNEL_TX_POWER) * BG_BAND_REGION_0_SIZE);
-				index += BG_BAND_REGION_0_SIZE;
-				break;
-			case REGION_1_BG_BAND:	// 1 - 13
-				NdisMoveMemory(&pAd->ChannelList[index], &pAd->TxPower[BG_BAND_REGION_1_START], sizeof(CHANNEL_TX_POWER) * BG_BAND_REGION_1_SIZE);
-				index += BG_BAND_REGION_1_SIZE;
-				break;
-			case REGION_2_BG_BAND:	// 10 - 11
-				NdisMoveMemory(&pAd->ChannelList[index], &pAd->TxPower[BG_BAND_REGION_2_START], sizeof(CHANNEL_TX_POWER) * BG_BAND_REGION_2_SIZE);
-				index += BG_BAND_REGION_2_SIZE;
-				break;
-			case REGION_3_BG_BAND:	// 10 - 13
-				NdisMoveMemory(&pAd->ChannelList[index], &pAd->TxPower[BG_BAND_REGION_3_START], sizeof(CHANNEL_TX_POWER) * BG_BAND_REGION_3_SIZE);
-				index += BG_BAND_REGION_3_SIZE;
-				break;
-			case REGION_4_BG_BAND:	// 14
-				NdisMoveMemory(&pAd->ChannelList[index], &pAd->TxPower[BG_BAND_REGION_4_START], sizeof(CHANNEL_TX_POWER) * BG_BAND_REGION_4_SIZE);
-				index += BG_BAND_REGION_4_SIZE;
-				break;
-			case REGION_5_BG_BAND:	// 1 - 14
-				NdisMoveMemory(&pAd->ChannelList[index], &pAd->TxPower[BG_BAND_REGION_5_START], sizeof(CHANNEL_TX_POWER) * BG_BAND_REGION_5_SIZE);
-				index += BG_BAND_REGION_5_SIZE;
-				break;
-			case REGION_6_BG_BAND:	// 3 - 9
-				NdisMoveMemory(&pAd->ChannelList[index], &pAd->TxPower[BG_BAND_REGION_6_START], sizeof(CHANNEL_TX_POWER) * BG_BAND_REGION_6_SIZE);
-				index += BG_BAND_REGION_6_SIZE;
-				break;
-			case REGION_7_BG_BAND:  // 5 - 13
-				NdisMoveMemory(&pAd->ChannelList[index], &pAd->TxPower[BG_BAND_REGION_7_START], sizeof(CHANNEL_TX_POWER) * BG_BAND_REGION_7_SIZE);
-				index += BG_BAND_REGION_7_SIZE;
-				break;
-			case REGION_31_BG_BAND:	// 1 - 14
-				NdisMoveMemory(&pAd->ChannelList[index], &pAd->TxPower[BG_BAND_REGION_31_START], sizeof(CHANNEL_TX_POWER) * BG_BAND_REGION_31_SIZE);
-				index += BG_BAND_REGION_31_SIZE;
-				break;
-			default:            // Error. should never happen
-				break;
-		}
-		for (i=0; i<index; i++)
-			pAd->ChannelList[i].MaxTxPwr = 20;
-	}
-
-	if ((pAd->CommonCfg.PhyMode == PHY_11A) || (pAd->CommonCfg.PhyMode == PHY_11ABG_MIXED)
-#ifdef DOT11_N_SUPPORT
-		|| (pAd->CommonCfg.PhyMode == PHY_11ABGN_MIXED) || (pAd->CommonCfg.PhyMode == PHY_11AN_MIXED)
-		|| (pAd->CommonCfg.PhyMode == PHY_11AGN_MIXED) || (pAd->CommonCfg.PhyMode == PHY_11N_5G)
-#endif // DOT11_N_SUPPORT //
-	)
-	{
-		switch (pAd->CommonCfg.CountryRegionForABand & 0x7f)
-		{
-			case REGION_0_A_BAND:
-				num = sizeof(A_BAND_REGION_0_CHANNEL_LIST)/sizeof(UCHAR);
-				pChannelList = A_BAND_REGION_0_CHANNEL_LIST;
-				break;
-			case REGION_1_A_BAND:
-				num = sizeof(A_BAND_REGION_1_CHANNEL_LIST)/sizeof(UCHAR);
-				pChannelList = A_BAND_REGION_1_CHANNEL_LIST;
-				break;
-			case REGION_2_A_BAND:
-				num = sizeof(A_BAND_REGION_2_CHANNEL_LIST)/sizeof(UCHAR);
-				pChannelList = A_BAND_REGION_2_CHANNEL_LIST;
-				break;
-			case REGION_3_A_BAND:
-				num = sizeof(A_BAND_REGION_3_CHANNEL_LIST)/sizeof(UCHAR);
-				pChannelList = A_BAND_REGION_3_CHANNEL_LIST;
-				break;
-			case REGION_4_A_BAND:
-				num = sizeof(A_BAND_REGION_4_CHANNEL_LIST)/sizeof(UCHAR);
-				pChannelList = A_BAND_REGION_4_CHANNEL_LIST;
-				break;
-			case REGION_5_A_BAND:
-				num = sizeof(A_BAND_REGION_5_CHANNEL_LIST)/sizeof(UCHAR);
-				pChannelList = A_BAND_REGION_5_CHANNEL_LIST;
-				break;
-			case REGION_6_A_BAND:
-				num = sizeof(A_BAND_REGION_6_CHANNEL_LIST)/sizeof(UCHAR);
-				pChannelList = A_BAND_REGION_6_CHANNEL_LIST;
-				break;
-			case REGION_7_A_BAND:
-				num = sizeof(A_BAND_REGION_7_CHANNEL_LIST)/sizeof(UCHAR);
-				pChannelList = A_BAND_REGION_7_CHANNEL_LIST;
-				break;
-			case REGION_8_A_BAND:
-				num = sizeof(A_BAND_REGION_8_CHANNEL_LIST)/sizeof(UCHAR);
-				pChannelList = A_BAND_REGION_8_CHANNEL_LIST;
-				break;
-			case REGION_9_A_BAND:
-				num = sizeof(A_BAND_REGION_9_CHANNEL_LIST)/sizeof(UCHAR);
-				pChannelList = A_BAND_REGION_9_CHANNEL_LIST;
-				break;
-			case REGION_10_A_BAND:
-				num = sizeof(A_BAND_REGION_10_CHANNEL_LIST)/sizeof(UCHAR);
-				pChannelList = A_BAND_REGION_10_CHANNEL_LIST;
-				break;
-			case REGION_11_A_BAND:
-				num = sizeof(A_BAND_REGION_11_CHANNEL_LIST)/sizeof(UCHAR);
-				pChannelList = A_BAND_REGION_11_CHANNEL_LIST;
-				break;
-			case REGION_12_A_BAND:
-				num = sizeof(A_BAND_REGION_12_CHANNEL_LIST)/sizeof(UCHAR);
-				pChannelList = A_BAND_REGION_12_CHANNEL_LIST;
-				break;
-			case REGION_13_A_BAND:
-				num = sizeof(A_BAND_REGION_13_CHANNEL_LIST)/sizeof(UCHAR);
-				pChannelList = A_BAND_REGION_13_CHANNEL_LIST;
-				break;
-			case REGION_14_A_BAND:
-				num = sizeof(A_BAND_REGION_14_CHANNEL_LIST)/sizeof(UCHAR);
-				pChannelList = A_BAND_REGION_14_CHANNEL_LIST;
-				break;
-			case REGION_15_A_BAND:
-				num = sizeof(A_BAND_REGION_15_CHANNEL_LIST)/sizeof(UCHAR);
-				pChannelList = A_BAND_REGION_15_CHANNEL_LIST;
-				break;
-			default:            // Error. should never happen
-				DBGPRINT(RT_DEBUG_WARN,("countryregion=%d not support", pAd->CommonCfg.CountryRegionForABand));
-				break;
-		}
-
-		if (num != 0)
-		{
-			UCHAR RadarCh[15]={52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140};
-			for (i=0; i<num; i++)
-			{
-				for (j=0; j<MAX_NUM_OF_CHANNELS; j++)
-				{
-					if (pChannelList[i] == pAd->TxPower[j].Channel)
-						NdisMoveMemory(&pAd->ChannelList[index+i], &pAd->TxPower[j], sizeof(CHANNEL_TX_POWER));
-					}
-				for (j=0; j<15; j++)
-				{
-					if (pChannelList[i] == RadarCh[j])
-						pAd->ChannelList[index+i].DfsReq = TRUE;
-				}
-				pAd->ChannelList[index+i].MaxTxPwr = 20;
-			}
-			index += num;
-		}
-	}
-
-	pAd->ChannelListNum = index;
-	DBGPRINT(RT_DEBUG_TRACE,("country code=%d/%d, RFIC=%d, PHY mode=%d, support %d channels\n",
-		pAd->CommonCfg.CountryRegion, pAd->CommonCfg.CountryRegionForABand, pAd->RfIcType, pAd->CommonCfg.PhyMode, pAd->ChannelListNum));
-#ifdef DBG
-	for (i=0;i<pAd->ChannelListNum;i++)
-	{
-		DBGPRINT_RAW(RT_DEBUG_TRACE,("BuildChannel # %d :: Pwr0 = %d, Pwr1 =%d, \n ", pAd->ChannelList[i].Channel, pAd->ChannelList[i].Power, pAd->ChannelList[i].Power2));
-	}
-#endif
-}
-
-/*
-	==========================================================================
-	Description:
-		This routine return the first channel number according to the country
-		code selection and RF IC selection (signal band or dual band). It is called
-		whenever driver need to start a site survey of all supported channels.
-	Return:
-		ch - the first channel number of current country code setting
-
-	IRQL = PASSIVE_LEVEL
-
-	==========================================================================
- */
-UCHAR FirstChannel(
-	IN PRTMP_ADAPTER pAd)
-{
-	return pAd->ChannelList[0].Channel;
-}
-
-/*
-	==========================================================================
-	Description:
-		This routine returns the next channel number. This routine is called
-		during driver need to start a site survey of all supported channels.
-	Return:
-		next_channel - the next channel number valid in current country code setting.
-	Note:
-		return 0 if no more next channel
-	==========================================================================
- */
-UCHAR NextChannel(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR channel)
-{
-	int i;
-	UCHAR next_channel = 0;
-
-	for (i = 0; i < (pAd->ChannelListNum - 1); i++)
-		if (channel == pAd->ChannelList[i].Channel)
-		{
-			next_channel = pAd->ChannelList[i+1].Channel;
-			break;
-	}
-	return next_channel;
-}
-
-/*
-	==========================================================================
-	Description:
-		This routine is for Cisco Compatible Extensions 2.X
-		Spec31. AP Control of Client Transmit Power
-	Return:
-		None
-	Note:
-	   Required by Aironet dBm(mW)
-		   0dBm(1mW),   1dBm(5mW), 13dBm(20mW), 15dBm(30mW),
-		  17dBm(50mw), 20dBm(100mW)
-
-	   We supported
-		   3dBm(Lowest), 6dBm(10%), 9dBm(25%), 12dBm(50%),
-		  14dBm(75%),   15dBm(100%)
-
-		The client station's actual transmit power shall be within +/- 5dB of
-		the minimum value or next lower value.
-	==========================================================================
- */
-VOID ChangeToCellPowerLimit(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR         AironetCellPowerLimit)
-{
-	//valud 0xFF means that hasn't found power limit information
-	//from the AP's Beacon/Probe response.
-	if (AironetCellPowerLimit == 0xFF)
-		return;
-
-	if (AironetCellPowerLimit < 6) //Used Lowest Power Percentage.
-		pAd->CommonCfg.TxPowerPercentage = 6;
-	else if (AironetCellPowerLimit < 9)
-		pAd->CommonCfg.TxPowerPercentage = 10;
-	else if (AironetCellPowerLimit < 12)
-		pAd->CommonCfg.TxPowerPercentage = 25;
-	else if (AironetCellPowerLimit < 14)
-		pAd->CommonCfg.TxPowerPercentage = 50;
-	else if (AironetCellPowerLimit < 15)
-		pAd->CommonCfg.TxPowerPercentage = 75;
-	else
-		pAd->CommonCfg.TxPowerPercentage = 100; //else used maximum
-
-	if (pAd->CommonCfg.TxPowerPercentage > pAd->CommonCfg.TxPowerDefault)
-		pAd->CommonCfg.TxPowerPercentage = pAd->CommonCfg.TxPowerDefault;
-
-}
-
-CHAR	ConvertToRssi(
-	IN PRTMP_ADAPTER	pAd,
-	IN CHAR				Rssi,
-	IN UCHAR			RssiNumber)
-{
-	UCHAR	RssiOffset, LNAGain;
-
-	// Rssi equals to zero should be an invalid value
-	if (Rssi == 0)
-		return -99;
-
-	LNAGain = GET_LNA_GAIN(pAd);
-    if (pAd->LatchRfRegs.Channel > 14)
-    {
-        if (RssiNumber == 0)
-			RssiOffset = pAd->ARssiOffset0;
-		else if (RssiNumber == 1)
-			RssiOffset = pAd->ARssiOffset1;
-		else
-			RssiOffset = pAd->ARssiOffset2;
-    }
-    else
-    {
-        if (RssiNumber == 0)
-			RssiOffset = pAd->BGRssiOffset0;
-		else if (RssiNumber == 1)
-			RssiOffset = pAd->BGRssiOffset1;
-		else
-			RssiOffset = pAd->BGRssiOffset2;
-    }
-
-    return (-12 - RssiOffset - LNAGain - Rssi);
-}
-
-/*
-	==========================================================================
-	Description:
-		Scan next channel
-	==========================================================================
- */
-VOID ScanNextChannel(
-	IN PRTMP_ADAPTER pAd)
-{
-	HEADER_802_11   Hdr80211;
-	PUCHAR          pOutBuffer = NULL;
-	NDIS_STATUS     NStatus;
-	ULONG           FrameLen = 0;
-	UCHAR           SsidLen = 0, ScanType = pAd->MlmeAux.ScanType, BBPValue = 0;
-#ifdef CONFIG_STA_SUPPORT
-	USHORT          Status;
-	PHEADER_802_11  pHdr80211;
-#endif // CONFIG_STA_SUPPORT //
-	UINT			ScanTimeIn5gChannel = SHORT_CHANNEL_TIME;
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-		if (MONITOR_ON(pAd))
-			return;
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-#ifdef RALINK_ATE
-	// Nothing to do in ATE mode.
-	if (ATE_ON(pAd))
-		return;
-#endif // RALINK_ATE //
-
-	if (pAd->MlmeAux.Channel == 0)
-	{
-		if ((pAd->CommonCfg.BBPCurrentBW == BW_40)
-#ifdef CONFIG_STA_SUPPORT
-			&& (INFRA_ON(pAd)
-				|| (pAd->OpMode == OPMODE_AP))
-#endif // CONFIG_STA_SUPPORT //
-			)
-		{
-			AsicSwitchChannel(pAd, pAd->CommonCfg.CentralChannel, FALSE);
-			AsicLockChannel(pAd, pAd->CommonCfg.CentralChannel);
-			RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R4, &BBPValue);
-			BBPValue &= (~0x18);
-			BBPValue |= 0x10;
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R4, BBPValue);
-			DBGPRINT(RT_DEBUG_TRACE, ("SYNC - End of SCAN, restore to 40MHz channel %d, Total BSS[%02d]\n",pAd->CommonCfg.CentralChannel, pAd->ScanTab.BssNr));
-		}
-		else
-		{
-			AsicSwitchChannel(pAd, pAd->CommonCfg.Channel, FALSE);
-			AsicLockChannel(pAd, pAd->CommonCfg.Channel);
-			DBGPRINT(RT_DEBUG_TRACE, ("SYNC - End of SCAN, restore to channel %d, Total BSS[%02d]\n",pAd->CommonCfg.Channel, pAd->ScanTab.BssNr));
-		}
-
-#ifdef CONFIG_STA_SUPPORT
-		IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		{
-			//
-			// To prevent data lost.
-			// Send an NULL data with turned PSM bit on to current associated AP before SCAN progress.
-			// Now, we need to send an NULL data with turned PSM bit off to AP, when scan progress done
-			//
-			if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED) && (INFRA_ON(pAd)))
-			{
-				NStatus = MlmeAllocateMemory(pAd, (PVOID)&pOutBuffer);
-				if (NStatus	== NDIS_STATUS_SUCCESS)
-				{
-					pHdr80211 = (PHEADER_802_11) pOutBuffer;
-					MgtMacHeaderInit(pAd, pHdr80211, SUBTYPE_NULL_FUNC, 1, pAd->CommonCfg.Bssid, pAd->CommonCfg.Bssid);
-					pHdr80211->Duration = 0;
-					pHdr80211->FC.Type = BTYPE_DATA;
-					pHdr80211->FC.PwrMgmt = (pAd->StaCfg.Psm == PWR_SAVE);
-
-					// Send using priority queue
-					MiniportMMRequest(pAd, 0, pOutBuffer, sizeof(HEADER_802_11));
-					DBGPRINT(RT_DEBUG_TRACE, ("MlmeScanReqAction -- Send PSM Data frame\n"));
-					MlmeFreeMemory(pAd, pOutBuffer);
-					RTMPusecDelay(5000);
-				}
-			}
-
-			pAd->Mlme.SyncMachine.CurrState = SYNC_IDLE;
-			Status = MLME_SUCCESS;
-			MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_SCAN_CONF, 2, &Status);
-		}
-#endif // CONFIG_STA_SUPPORT //
-
-
-		RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS);
-	}
-	else
-	{
-#ifdef CONFIG_STA_SUPPORT
-		IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		{
-		// BBP and RF are not accessible in PS mode, we has to wake them up first
-		if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE))
-			AsicForceWakeup(pAd, TRUE);
-
-			// leave PSM during scanning. otherwise we may lost ProbeRsp & BEACON
-			if (pAd->StaCfg.Psm == PWR_SAVE)
-				RTMP_SET_PSM_BIT(pAd, PWR_ACTIVE);
-		}
-#endif // CONFIG_STA_SUPPORT //
-
-		AsicSwitchChannel(pAd, pAd->MlmeAux.Channel, TRUE);
-		AsicLockChannel(pAd, pAd->MlmeAux.Channel);
-
-#ifdef CONFIG_STA_SUPPORT
-		IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		{
-			if (pAd->MlmeAux.Channel > 14)
-			{
-				if ((pAd->CommonCfg.bIEEE80211H == 1) && RadarChannelCheck(pAd, pAd->MlmeAux.Channel))
-				{
-					ScanType = SCAN_PASSIVE;
-					ScanTimeIn5gChannel = MIN_CHANNEL_TIME;
-				}
-			}
-
-#ifdef CARRIER_DETECTION_SUPPORT // Roger sync Carrier
-			// carrier detection
-			if (pAd->CommonCfg.CarrierDetect.Enable == TRUE)
-			{
-				ScanType = SCAN_PASSIVE;
-				ScanTimeIn5gChannel = MIN_CHANNEL_TIME;
-			}
-#endif // CARRIER_DETECTION_SUPPORT //
-		}
-
-#endif // CONFIG_STA_SUPPORT //
-
-		//Global country domain(ch1-11:active scan, ch12-14 passive scan)
-		if ((pAd->MlmeAux.Channel <= 14) && (pAd->MlmeAux.Channel >= 12) && ((pAd->CommonCfg.CountryRegion & 0x7f) == REGION_31_BG_BAND))
-		{
-			ScanType = SCAN_PASSIVE;
-		}
-
-		// We need to shorten active scan time in order for WZC connect issue
-		// Chnage the channel scan time for CISCO stuff based on its IAPP announcement
-		if (ScanType == FAST_SCAN_ACTIVE)
-			RTMPSetTimer(&pAd->MlmeAux.ScanTimer, FAST_ACTIVE_SCAN_TIME);
-		else // must be SCAN_PASSIVE or SCAN_ACTIVE
-		{
-			if ((pAd->CommonCfg.PhyMode == PHY_11ABG_MIXED)
-#ifdef DOT11_N_SUPPORT
-				|| (pAd->CommonCfg.PhyMode == PHY_11ABGN_MIXED) || (pAd->CommonCfg.PhyMode == PHY_11AGN_MIXED)
-#endif // DOT11_N_SUPPORT //
-			)
-			{
-				if (pAd->MlmeAux.Channel > 14)
-					RTMPSetTimer(&pAd->MlmeAux.ScanTimer, ScanTimeIn5gChannel);
-				else
-				RTMPSetTimer(&pAd->MlmeAux.ScanTimer, MIN_CHANNEL_TIME);
-			}
-			else
-				RTMPSetTimer(&pAd->MlmeAux.ScanTimer, MAX_CHANNEL_TIME);
-		}
-
-		if ((ScanType == SCAN_ACTIVE)
-			|| (ScanType == FAST_SCAN_ACTIVE)
-			)
-		{
-			NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);  //Get an unused nonpaged memory
-			if (NStatus != NDIS_STATUS_SUCCESS)
-			{
-				DBGPRINT(RT_DEBUG_TRACE, ("SYNC - ScanNextChannel() allocate memory fail\n"));
-#ifdef CONFIG_STA_SUPPORT
-				IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-				{
-					pAd->Mlme.SyncMachine.CurrState = SYNC_IDLE;
-					Status = MLME_FAIL_NO_RESOURCE;
-					MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_SCAN_CONF, 2, &Status);
-				}
-#endif // CONFIG_STA_SUPPORT //
-
-				return;
-			}
-
-			// There is no need to send broadcast probe request if active scan is in effect.
-			if ((ScanType == SCAN_ACTIVE) || (ScanType == FAST_SCAN_ACTIVE)
-				)
-				SsidLen = pAd->MlmeAux.SsidLen;
-			else
-				SsidLen = 0;
-
-#ifdef CONFIG_STA_SUPPORT
-			IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-				MgtMacHeaderInit(pAd, &Hdr80211, SUBTYPE_PROBE_REQ, 0, BROADCAST_ADDR, BROADCAST_ADDR);
-#endif // CONFIG_STA_SUPPORT //
-
-
-			MakeOutgoingFrame(pOutBuffer,               &FrameLen,
-							  sizeof(HEADER_802_11),    &Hdr80211,
-							  1,                        &SsidIe,
-							  1,                        &SsidLen,
-							  SsidLen,			        pAd->MlmeAux.Ssid,
-							  1,                        &SupRateIe,
-							  1,                        &pAd->CommonCfg.SupRateLen,
-							  pAd->CommonCfg.SupRateLen,  pAd->CommonCfg.SupRate,
-							  END_OF_ARGS);
-
-			if (pAd->CommonCfg.ExtRateLen)
-			{
-				ULONG Tmp;
-				MakeOutgoingFrame(pOutBuffer + FrameLen,            &Tmp,
-								  1,                                &ExtRateIe,
-								  1,                                &pAd->CommonCfg.ExtRateLen,
-								  pAd->CommonCfg.ExtRateLen,          pAd->CommonCfg.ExtRate,
-								  END_OF_ARGS);
-				FrameLen += Tmp;
-			}
-
-#ifdef DOT11_N_SUPPORT
-			if (pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED)
-			{
-				ULONG	Tmp;
-				UCHAR	HtLen;
-				UCHAR	BROADCOM[4] = {0x0, 0x90, 0x4c, 0x33};
-#ifdef RT_BIG_ENDIAN
-				HT_CAPABILITY_IE HtCapabilityTmp;
-#endif
-				if (pAd->bBroadComHT == TRUE)
-				{
-					HtLen = pAd->MlmeAux.HtCapabilityLen + 4;
-#ifdef RT_BIG_ENDIAN
-					NdisMoveMemory(&HtCapabilityTmp, &pAd->MlmeAux.HtCapability, SIZE_HT_CAP_IE);
-					*(USHORT *)(&HtCapabilityTmp.HtCapInfo) = SWAP16(*(USHORT *)(&HtCapabilityTmp.HtCapInfo));
-#ifdef UNALIGNMENT_SUPPORT
-					{
-						EXT_HT_CAP_INFO extHtCapInfo;
-
-						NdisMoveMemory((PUCHAR)(&extHtCapInfo), (PUCHAR)(&HtCapabilityTmp.ExtHtCapInfo), sizeof(EXT_HT_CAP_INFO));
-						*(USHORT *)(&extHtCapInfo) = cpu2le16(*(USHORT *)(&extHtCapInfo));
-						NdisMoveMemory((PUCHAR)(&HtCapabilityTmp.ExtHtCapInfo), (PUCHAR)(&extHtCapInfo), sizeof(EXT_HT_CAP_INFO));
-					}
-#else
-					*(USHORT *)(&HtCapabilityTmp.ExtHtCapInfo) = cpu2le16(*(USHORT *)(&HtCapabilityTmp.ExtHtCapInfo));
-#endif // UNALIGNMENT_SUPPORT //
-
-					MakeOutgoingFrame(pOutBuffer + FrameLen,          &Tmp,
-									1,                                &WpaIe,
-									1,                                &HtLen,
-									4,                                &BROADCOM[0],
-									pAd->MlmeAux.HtCapabilityLen,     &HtCapabilityTmp,
-									END_OF_ARGS);
-#else
-					MakeOutgoingFrame(pOutBuffer + FrameLen,          &Tmp,
-									1,                                &WpaIe,
-									1,                                &HtLen,
-									4,                                &BROADCOM[0],
-									pAd->MlmeAux.HtCapabilityLen,     &pAd->MlmeAux.HtCapability,
-									END_OF_ARGS);
-#endif // RT_BIG_ENDIAN //
-				}
-				else
-				{
-					HtLen = pAd->MlmeAux.HtCapabilityLen;
-#ifdef RT_BIG_ENDIAN
-					NdisMoveMemory(&HtCapabilityTmp, &pAd->CommonCfg.HtCapability, SIZE_HT_CAP_IE);
-					*(USHORT *)(&HtCapabilityTmp.HtCapInfo) = SWAP16(*(USHORT *)(&HtCapabilityTmp.HtCapInfo));
-#ifdef UNALIGNMENT_SUPPORT
-					{
-						EXT_HT_CAP_INFO extHtCapInfo;
-
-						NdisMoveMemory((PUCHAR)(&extHtCapInfo), (PUCHAR)(&HtCapabilityTmp.ExtHtCapInfo), sizeof(EXT_HT_CAP_INFO));
-						*(USHORT *)(&extHtCapInfo) = cpu2le16(*(USHORT *)(&extHtCapInfo));
-						NdisMoveMemory((PUCHAR)(&HtCapabilityTmp.ExtHtCapInfo), (PUCHAR)(&extHtCapInfo), sizeof(EXT_HT_CAP_INFO));
-					}
-#else
-					*(USHORT *)(&HtCapabilityTmp.ExtHtCapInfo) = cpu2le16(*(USHORT *)(&HtCapabilityTmp.ExtHtCapInfo));
-#endif // UNALIGNMENT_SUPPORT //
-
-					MakeOutgoingFrame(pOutBuffer + FrameLen,          &Tmp,
-									1,                                &HtCapIe,
-									1,                                &HtLen,
-									HtLen,                            &HtCapabilityTmp,
-									END_OF_ARGS);
-#else
-					MakeOutgoingFrame(pOutBuffer + FrameLen,          &Tmp,
-									1,                                &HtCapIe,
-									1,                                &HtLen,
-									HtLen,                            &pAd->CommonCfg.HtCapability,
-									END_OF_ARGS);
-#endif // RT_BIG_ENDIAN //
-				}
-				FrameLen += Tmp;
-
-#ifdef DOT11N_DRAFT3
-				if (pAd->CommonCfg.BACapability.field.b2040CoexistScanSup == 1)
-				{
-					ULONG		Tmp;
-					HtLen = 1;
-					MakeOutgoingFrame(pOutBuffer + FrameLen,            &Tmp,
-									  1,					&ExtHtCapIe,
-									  1,					&HtLen,
-									  1,				&pAd->CommonCfg.BSSCoexist2040.word,
-									  END_OF_ARGS);
-
-					FrameLen += Tmp;
-				}
-#endif // DOT11N_DRAFT3 //
-			}
-#endif // DOT11_N_SUPPORT //
-
-
-			MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
-			MlmeFreeMemory(pAd, pOutBuffer);
-		}
-
-		// For SCAN_CISCO_PASSIVE, do nothing and silently wait for beacon or other probe reponse
-
-#ifdef CONFIG_STA_SUPPORT
-		IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-			pAd->Mlme.SyncMachine.CurrState = SCAN_LISTEN;
-#endif // CONFIG_STA_SUPPORT //
-
-	}
-}
-
-VOID MgtProbReqMacHeaderInit(
-	IN	PRTMP_ADAPTER	pAd,
-	IN OUT PHEADER_802_11 pHdr80211,
-	IN UCHAR SubType,
-	IN UCHAR ToDs,
-	IN PUCHAR pDA,
-	IN PUCHAR pBssid)
-{
-	NdisZeroMemory(pHdr80211, sizeof(HEADER_802_11));
-
-	pHdr80211->FC.Type = BTYPE_MGMT;
-	pHdr80211->FC.SubType = SubType;
-	if (SubType == SUBTYPE_ACK)
-		pHdr80211->FC.Type = BTYPE_CNTL;
-	pHdr80211->FC.ToDs = ToDs;
-	COPY_MAC_ADDR(pHdr80211->Addr1, pDA);
-	COPY_MAC_ADDR(pHdr80211->Addr2, pAd->CurrentAddress);
-	COPY_MAC_ADDR(pHdr80211->Addr3, pBssid);
-}
diff --git a/drivers/staging/rt3090/common/cmm_tkip.c b/drivers/staging/rt3090/common/cmm_tkip.c
deleted file mode 100644
index 0b474f20859b..000000000000
--- a/drivers/staging/rt3090/common/cmm_tkip.c
+++ /dev/null
@@ -1,966 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-	Module Name:
-	cmm_tkip.c
-
-	Abstract:
-
-	Revision History:
-	Who			When			What
-	--------	----------		----------------------------------------------
-	Paul Wu		02-25-02		Initial
-*/
-
-#include "../rt_config.h"
-
-
-// Rotation functions on 32 bit values
-#define ROL32( A, n ) \
-	( ((A) << (n)) | ( ((A)>>(32-(n))) & ( (1UL << (n)) - 1 ) ) )
-#define ROR32( A, n ) ROL32( (A), 32-(n) )
-
-UINT Tkip_Sbox_Lower[256] =
-{
-	0xA5,0x84,0x99,0x8D,0x0D,0xBD,0xB1,0x54,
-	0x50,0x03,0xA9,0x7D,0x19,0x62,0xE6,0x9A,
-	0x45,0x9D,0x40,0x87,0x15,0xEB,0xC9,0x0B,
-	0xEC,0x67,0xFD,0xEA,0xBF,0xF7,0x96,0x5B,
-	0xC2,0x1C,0xAE,0x6A,0x5A,0x41,0x02,0x4F,
-	0x5C,0xF4,0x34,0x08,0x93,0x73,0x53,0x3F,
-	0x0C,0x52,0x65,0x5E,0x28,0xA1,0x0F,0xB5,
-	0x09,0x36,0x9B,0x3D,0x26,0x69,0xCD,0x9F,
-	0x1B,0x9E,0x74,0x2E,0x2D,0xB2,0xEE,0xFB,
-	0xF6,0x4D,0x61,0xCE,0x7B,0x3E,0x71,0x97,
-	0xF5,0x68,0x00,0x2C,0x60,0x1F,0xC8,0xED,
-	0xBE,0x46,0xD9,0x4B,0xDE,0xD4,0xE8,0x4A,
-	0x6B,0x2A,0xE5,0x16,0xC5,0xD7,0x55,0x94,
-	0xCF,0x10,0x06,0x81,0xF0,0x44,0xBA,0xE3,
-	0xF3,0xFE,0xC0,0x8A,0xAD,0xBC,0x48,0x04,
-	0xDF,0xC1,0x75,0x63,0x30,0x1A,0x0E,0x6D,
-	0x4C,0x14,0x35,0x2F,0xE1,0xA2,0xCC,0x39,
-	0x57,0xF2,0x82,0x47,0xAC,0xE7,0x2B,0x95,
-	0xA0,0x98,0xD1,0x7F,0x66,0x7E,0xAB,0x83,
-	0xCA,0x29,0xD3,0x3C,0x79,0xE2,0x1D,0x76,
-	0x3B,0x56,0x4E,0x1E,0xDB,0x0A,0x6C,0xE4,
-	0x5D,0x6E,0xEF,0xA6,0xA8,0xA4,0x37,0x8B,
-	0x32,0x43,0x59,0xB7,0x8C,0x64,0xD2,0xE0,
-	0xB4,0xFA,0x07,0x25,0xAF,0x8E,0xE9,0x18,
-	0xD5,0x88,0x6F,0x72,0x24,0xF1,0xC7,0x51,
-	0x23,0x7C,0x9C,0x21,0xDD,0xDC,0x86,0x85,
-	0x90,0x42,0xC4,0xAA,0xD8,0x05,0x01,0x12,
-	0xA3,0x5F,0xF9,0xD0,0x91,0x58,0x27,0xB9,
-	0x38,0x13,0xB3,0x33,0xBB,0x70,0x89,0xA7,
-	0xB6,0x22,0x92,0x20,0x49,0xFF,0x78,0x7A,
-	0x8F,0xF8,0x80,0x17,0xDA,0x31,0xC6,0xB8,
-	0xC3,0xB0,0x77,0x11,0xCB,0xFC,0xD6,0x3A
-};
-
-UINT Tkip_Sbox_Upper[256] =
-{
-	0xC6,0xF8,0xEE,0xF6,0xFF,0xD6,0xDE,0x91,
-	0x60,0x02,0xCE,0x56,0xE7,0xB5,0x4D,0xEC,
-	0x8F,0x1F,0x89,0xFA,0xEF,0xB2,0x8E,0xFB,
-	0x41,0xB3,0x5F,0x45,0x23,0x53,0xE4,0x9B,
-	0x75,0xE1,0x3D,0x4C,0x6C,0x7E,0xF5,0x83,
-	0x68,0x51,0xD1,0xF9,0xE2,0xAB,0x62,0x2A,
-	0x08,0x95,0x46,0x9D,0x30,0x37,0x0A,0x2F,
-	0x0E,0x24,0x1B,0xDF,0xCD,0x4E,0x7F,0xEA,
-	0x12,0x1D,0x58,0x34,0x36,0xDC,0xB4,0x5B,
-	0xA4,0x76,0xB7,0x7D,0x52,0xDD,0x5E,0x13,
-	0xA6,0xB9,0x00,0xC1,0x40,0xE3,0x79,0xB6,
-	0xD4,0x8D,0x67,0x72,0x94,0x98,0xB0,0x85,
-	0xBB,0xC5,0x4F,0xED,0x86,0x9A,0x66,0x11,
-	0x8A,0xE9,0x04,0xFE,0xA0,0x78,0x25,0x4B,
-	0xA2,0x5D,0x80,0x05,0x3F,0x21,0x70,0xF1,
-	0x63,0x77,0xAF,0x42,0x20,0xE5,0xFD,0xBF,
-	0x81,0x18,0x26,0xC3,0xBE,0x35,0x88,0x2E,
-	0x93,0x55,0xFC,0x7A,0xC8,0xBA,0x32,0xE6,
-	0xC0,0x19,0x9E,0xA3,0x44,0x54,0x3B,0x0B,
-	0x8C,0xC7,0x6B,0x28,0xA7,0xBC,0x16,0xAD,
-	0xDB,0x64,0x74,0x14,0x92,0x0C,0x48,0xB8,
-	0x9F,0xBD,0x43,0xC4,0x39,0x31,0xD3,0xF2,
-	0xD5,0x8B,0x6E,0xDA,0x01,0xB1,0x9C,0x49,
-	0xD8,0xAC,0xF3,0xCF,0xCA,0xF4,0x47,0x10,
-	0x6F,0xF0,0x4A,0x5C,0x38,0x57,0x73,0x97,
-	0xCB,0xA1,0xE8,0x3E,0x96,0x61,0x0D,0x0F,
-	0xE0,0x7C,0x71,0xCC,0x90,0x06,0xF7,0x1C,
-	0xC2,0x6A,0xAE,0x69,0x17,0x99,0x3A,0x27,
-	0xD9,0xEB,0x2B,0x22,0xD2,0xA9,0x07,0x33,
-	0x2D,0x3C,0x15,0xC9,0x87,0xAA,0x50,0xA5,
-	0x03,0x59,0x09,0x1A,0x65,0xD7,0x84,0xD0,
-	0x82,0x29,0x5A,0x1E,0x7B,0xA8,0x6D,0x2C
-};
-
-//
-// Expanded IV for TKIP function.
-//
-typedef	struct	PACKED _IV_CONTROL_
-{
-	union PACKED
-	{
-		struct PACKED
-		{
-			UCHAR		rc0;
-			UCHAR		rc1;
-			UCHAR		rc2;
-
-			union PACKED
-			{
-				struct PACKED
-				{
-#ifdef RT_BIG_ENDIAN
-					UCHAR	KeyID:2;
-					UCHAR	ExtIV:1;
-					UCHAR	Rsvd:5;
-#else
-					UCHAR	Rsvd:5;
-					UCHAR	ExtIV:1;
-					UCHAR	KeyID:2;
-#endif
-				}	field;
-				UCHAR		Byte;
-			}	CONTROL;
-		}	field;
-
-		ULONG	word;
-	}	IV16;
-
-	ULONG	IV32;
-}	TKIP_IV, *PTKIP_IV;
-
-
-/*
-	========================================================================
-
-	Routine	Description:
-		Convert from UCHAR[] to ULONG in a portable way
-
-	Arguments:
-      pMICKey		pointer to MIC Key
-
-	Return Value:
-		None
-
-	Note:
-
-	========================================================================
-*/
-ULONG	RTMPTkipGetUInt32(
-	IN	PUCHAR	pMICKey)
-{
-	ULONG	res = 0;
-	INT		i;
-
-	for (i = 0; i < 4; i++)
-	{
-		res |= (*pMICKey++) << (8 * i);
-	}
-
-	return res;
-}
-
-/*
-	========================================================================
-
-	Routine	Description:
-		Convert from ULONG to UCHAR[] in a portable way
-
-	Arguments:
-      pDst			pointer to destination for convert ULONG to UCHAR[]
-      val			the value for convert
-
-	Return Value:
-		None
-
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-VOID	RTMPTkipPutUInt32(
-	IN OUT	PUCHAR		pDst,
-	IN		ULONG		val)
-{
-	INT i;
-
-	for(i = 0; i < 4; i++)
-	{
-		*pDst++ = (UCHAR) (val & 0xff);
-		val >>= 8;
-	}
-}
-
-/*
-	========================================================================
-
-	Routine	Description:
-		Set the MIC Key.
-
-	Arguments:
-      pAd		Pointer to our adapter
-      pMICKey		pointer to MIC Key
-
-	Return Value:
-		None
-
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-VOID RTMPTkipSetMICKey(
-	IN	PTKIP_KEY_INFO	pTkip,
-	IN	PUCHAR			pMICKey)
-{
-	// Set the key
-	pTkip->K0 = RTMPTkipGetUInt32(pMICKey);
-	pTkip->K1 = RTMPTkipGetUInt32(pMICKey + 4);
-	// and reset the message
-	pTkip->L = pTkip->K0;
-	pTkip->R = pTkip->K1;
-	pTkip->nBytesInM = 0;
-	pTkip->M = 0;
-}
-
-/*
-	========================================================================
-
-	Routine	Description:
-		Calculate the MIC Value.
-
-	Arguments:
-      pAd		Pointer to our adapter
-      uChar			Append this uChar
-
-	Return Value:
-		None
-
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-VOID	RTMPTkipAppendByte(
-	IN	PTKIP_KEY_INFO	pTkip,
-	IN	UCHAR			uChar)
-{
-	// Append the byte to our word-sized buffer
-	pTkip->M |= (uChar << (8* pTkip->nBytesInM));
-	pTkip->nBytesInM++;
-	// Process the word if it is full.
-	if( pTkip->nBytesInM >= 4 )
-	{
-		pTkip->L ^= pTkip->M;
-		pTkip->R ^= ROL32( pTkip->L, 17 );
-		pTkip->L += pTkip->R;
-		pTkip->R ^= ((pTkip->L & 0xff00ff00) >> 8) | ((pTkip->L & 0x00ff00ff) << 8);
-		pTkip->L += pTkip->R;
-		pTkip->R ^= ROL32( pTkip->L, 3 );
-		pTkip->L += pTkip->R;
-		pTkip->R ^= ROR32( pTkip->L, 2 );
-		pTkip->L += pTkip->R;
-		// Clear the buffer
-		pTkip->M = 0;
-		pTkip->nBytesInM = 0;
-	}
-}
-
-/*
-	========================================================================
-
-	Routine	Description:
-		Calculate the MIC Value.
-
-	Arguments:
-      pAd		Pointer to our adapter
-      pSrc			Pointer to source data for Calculate MIC Value
-      Len			Indicate the length of the source data
-
-	Return Value:
-		None
-
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-VOID	RTMPTkipAppend(
-	IN	PTKIP_KEY_INFO	pTkip,
-	IN	PUCHAR			pSrc,
-	IN	UINT			nBytes)
-{
-	// This is simple
-	while(nBytes > 0)
-	{
-		RTMPTkipAppendByte(pTkip, *pSrc++);
-		nBytes--;
-	}
-}
-
-/*
-	========================================================================
-
-	Routine	Description:
-		Get the MIC Value.
-
-	Arguments:
-      pAd		Pointer to our adapter
-
-	Return Value:
-		None
-
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-		the MIC Value is store in pAd->PrivateInfo.MIC
-	========================================================================
-*/
-VOID	RTMPTkipGetMIC(
-	IN	PTKIP_KEY_INFO	pTkip)
-{
-	// Append the minimum padding
-	RTMPTkipAppendByte(pTkip, 0x5a );
-	RTMPTkipAppendByte(pTkip, 0 );
-	RTMPTkipAppendByte(pTkip, 0 );
-	RTMPTkipAppendByte(pTkip, 0 );
-	RTMPTkipAppendByte(pTkip, 0 );
-	// and then zeroes until the length is a multiple of 4
-	while( pTkip->nBytesInM != 0 )
-	{
-		RTMPTkipAppendByte(pTkip, 0 );
-	}
-	// The appendByte function has already computed the result.
-	RTMPTkipPutUInt32(pTkip->MIC, pTkip->L);
-	RTMPTkipPutUInt32(pTkip->MIC + 4, pTkip->R);
-}
-
-/*
-	========================================================================
-
-	Routine	Description:
-		Init Tkip function.
-
-	Arguments:
-      pAd		Pointer to our adapter
-		pTKey       Pointer to the Temporal Key (TK), TK shall be 128bits.
-		KeyId		TK Key ID
-		pTA			Pointer to transmitter address
-		pMICKey		pointer to MIC Key
-
-	Return Value:
-		None
-
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-VOID	RTMPInitTkipEngine(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			pKey,
-	IN	UCHAR			KeyId,
-	IN	PUCHAR			pTA,
-	IN	PUCHAR			pMICKey,
-	IN	PUCHAR			pTSC,
-	OUT	PULONG			pIV16,
-	OUT	PULONG			pIV32)
-{
-	TKIP_IV	tkipIv;
-
-	// Prepare 8 bytes TKIP encapsulation for MPDU
-	NdisZeroMemory(&tkipIv, sizeof(TKIP_IV));
-	tkipIv.IV16.field.rc0 = *(pTSC + 1);
-	tkipIv.IV16.field.rc1 = (tkipIv.IV16.field.rc0 | 0x20) & 0x7f;
-	tkipIv.IV16.field.rc2 = *pTSC;
-	tkipIv.IV16.field.CONTROL.field.ExtIV = 1;  // 0: non-extended IV, 1: an extended IV
-	tkipIv.IV16.field.CONTROL.field.KeyID = KeyId;
-//	tkipIv.IV32 = *(PULONG)(pTSC + 2);
-	NdisMoveMemory(&tkipIv.IV32, (pTSC + 2), 4);   // Copy IV
-
-	*pIV16 = tkipIv.IV16.word;
-	*pIV32 = tkipIv.IV32;
-}
-
-/*
-	========================================================================
-
-	Routine	Description:
-		Init MIC Value calculation function which include set MIC key &
-		calculate first 16 bytes (DA + SA + priority +  0)
-
-	Arguments:
-      pAd		Pointer to our adapter
-		pTKey       Pointer to the Temporal Key (TK), TK shall be 128bits.
-		pDA			Pointer to DA address
-		pSA			Pointer to SA address
-		pMICKey		pointer to MIC Key
-
-	Return Value:
-		None
-
-	Note:
-
-	========================================================================
-*/
-VOID	RTMPInitMICEngine(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			pKey,
-	IN	PUCHAR			pDA,
-	IN	PUCHAR			pSA,
-	IN  UCHAR           UserPriority,
-	IN	PUCHAR			pMICKey)
-{
-	ULONG Priority = UserPriority;
-
-	// Init MIC value calculation
-	RTMPTkipSetMICKey(&pAd->PrivateInfo.Tx, pMICKey);
-	// DA
-	RTMPTkipAppend(&pAd->PrivateInfo.Tx, pDA, MAC_ADDR_LEN);
-	// SA
-	RTMPTkipAppend(&pAd->PrivateInfo.Tx, pSA, MAC_ADDR_LEN);
-	// Priority + 3 bytes of 0
-	RTMPTkipAppend(&pAd->PrivateInfo.Tx, (PUCHAR)&Priority, 4);
-}
-
-/*
-	========================================================================
-
-	Routine	Description:
-		Compare MIC value of received MSDU
-
-	Arguments:
-		pAd	Pointer to our adapter
-		pSrc        Pointer to the received Plain text data
-		pDA			Pointer to DA address
-		pSA			Pointer to SA address
-		pMICKey		pointer to MIC Key
-		Len         the length of the received plain text data exclude MIC value
-
-	Return Value:
-		TRUE        MIC value matched
-		FALSE       MIC value mismatched
-
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-BOOLEAN	RTMPTkipCompareMICValue(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			pSrc,
-	IN	PUCHAR			pDA,
-	IN	PUCHAR			pSA,
-	IN	PUCHAR			pMICKey,
-	IN	UCHAR			UserPriority,
-	IN	UINT			Len)
-{
-	UCHAR	OldMic[8];
-	ULONG	Priority = UserPriority;
-
-	// Init MIC value calculation
-	RTMPTkipSetMICKey(&pAd->PrivateInfo.Rx, pMICKey);
-	// DA
-	RTMPTkipAppend(&pAd->PrivateInfo.Rx, pDA, MAC_ADDR_LEN);
-	// SA
-	RTMPTkipAppend(&pAd->PrivateInfo.Rx, pSA, MAC_ADDR_LEN);
-	// Priority + 3 bytes of 0
-	RTMPTkipAppend(&pAd->PrivateInfo.Rx, (PUCHAR)&Priority, 4);
-
-	// Calculate MIC value from plain text data
-	RTMPTkipAppend(&pAd->PrivateInfo.Rx, pSrc, Len);
-
-	// Get MIC valude from received frame
-	NdisMoveMemory(OldMic, pSrc + Len, 8);
-
-	// Get MIC value from decrypted plain data
-	RTMPTkipGetMIC(&pAd->PrivateInfo.Rx);
-
-	// Move MIC value from MSDU, this steps should move to data path.
-	// Since the MIC value might cross MPDUs.
-	if(!NdisEqualMemory(pAd->PrivateInfo.Rx.MIC, OldMic, 8))
-	{
-		DBGPRINT_RAW(RT_DEBUG_ERROR, ("RTMPTkipCompareMICValue(): TKIP MIC Error !\n"));  //MIC error.
-
-
-		return (FALSE);
-	}
-	return (TRUE);
-}
-
-/*
-	========================================================================
-
-	Routine	Description:
-		Compare MIC value of received MSDU
-
-	Arguments:
-		pAd	Pointer to our adapter
-		pLLC		LLC header
-		pSrc        Pointer to the received Plain text data
-		pDA			Pointer to DA address
-		pSA			Pointer to SA address
-		pMICKey		pointer to MIC Key
-		Len         the length of the received plain text data exclude MIC value
-
-	Return Value:
-		TRUE        MIC value matched
-		FALSE       MIC value mismatched
-
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-BOOLEAN	RTMPTkipCompareMICValueWithLLC(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			pLLC,
-	IN	PUCHAR			pSrc,
-	IN	PUCHAR			pDA,
-	IN	PUCHAR			pSA,
-	IN	PUCHAR			pMICKey,
-	IN	UINT			Len)
-{
-	UCHAR	OldMic[8];
-	ULONG	Priority = 0;
-
-	// Init MIC value calculation
-	RTMPTkipSetMICKey(&pAd->PrivateInfo.Rx, pMICKey);
-	// DA
-	RTMPTkipAppend(&pAd->PrivateInfo.Rx, pDA, MAC_ADDR_LEN);
-	// SA
-	RTMPTkipAppend(&pAd->PrivateInfo.Rx, pSA, MAC_ADDR_LEN);
-	// Priority + 3 bytes of 0
-	RTMPTkipAppend(&pAd->PrivateInfo.Rx, (PUCHAR)&Priority, 4);
-
-	// Start with LLC header
-	RTMPTkipAppend(&pAd->PrivateInfo.Rx, pLLC, 8);
-
-	// Calculate MIC value from plain text data
-	RTMPTkipAppend(&pAd->PrivateInfo.Rx, pSrc, Len);
-
-	// Get MIC valude from received frame
-	NdisMoveMemory(OldMic, pSrc + Len, 8);
-
-	// Get MIC value from decrypted plain data
-	RTMPTkipGetMIC(&pAd->PrivateInfo.Rx);
-
-	// Move MIC value from MSDU, this steps should move to data path.
-	// Since the MIC value might cross MPDUs.
-	if(!NdisEqualMemory(pAd->PrivateInfo.Rx.MIC, OldMic, 8))
-	{
-		DBGPRINT_RAW(RT_DEBUG_ERROR, ("RTMPTkipCompareMICValueWithLLC(): TKIP MIC Error !\n"));  //MIC error.
-
-
-		return (FALSE);
-	}
-	return (TRUE);
-}
-/*
-	========================================================================
-
-	Routine	Description:
-		Copy frame from waiting queue into relative ring buffer and set
-	appropriate ASIC register to kick hardware transmit function
-
-	Arguments:
-		pAd		Pointer	to our adapter
-		PNDIS_PACKET	Pointer to Ndis Packet for MIC calculation
-		pEncap			Pointer to LLC encap data
-		LenEncap		Total encap length, might be 0 which indicates no encap
-
-	Return Value:
-		None
-
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-VOID	RTMPCalculateMICValue(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PNDIS_PACKET	pPacket,
-	IN	PUCHAR			pEncap,
-	IN	PCIPHER_KEY		pKey,
-	IN	UCHAR			apidx)
-{
-	PACKET_INFO		PacketInfo;
-	PUCHAR			pSrcBufVA;
-	UINT			SrcBufLen;
-	PUCHAR			pSrc;
-    UCHAR           UserPriority;
-	UCHAR			vlan_offset = 0;
-
-	RTMP_QueryPacketInfo(pPacket, &PacketInfo, &pSrcBufVA, &SrcBufLen);
-
-	UserPriority = RTMP_GET_PACKET_UP(pPacket);
-	pSrc = pSrcBufVA;
-
-	// determine if this is a vlan packet
-	if (((*(pSrc + 12) << 8) + *(pSrc + 13)) == 0x8100)
-		vlan_offset = 4;
-
-#ifdef CONFIG_STA_SUPPORT
-#endif // CONFIG_STA_SUPPORT //
-	{
-		RTMPInitMICEngine(
-			pAd,
-			pKey->Key,
-			pSrc,
-			pSrc + 6,
-			UserPriority,
-			pKey->TxMic);
-	}
-
-
-	if (pEncap != NULL)
-	{
-		// LLC encapsulation
-		RTMPTkipAppend(&pAd->PrivateInfo.Tx, pEncap, 6);
-		// Protocol Type
-		RTMPTkipAppend(&pAd->PrivateInfo.Tx, pSrc + 12 + vlan_offset, 2);
-	}
-	SrcBufLen -= (14 + vlan_offset);
-	pSrc += (14 + vlan_offset);
-	do
-	{
-		if (SrcBufLen > 0)
-		{
-			RTMPTkipAppend(&pAd->PrivateInfo.Tx, pSrc, SrcBufLen);
-		}
-
-		break;	// No need handle next packet
-
-	}	while (TRUE);		// End of copying payload
-
-	// Compute the final MIC Value
-	RTMPTkipGetMIC(&pAd->PrivateInfo.Tx);
-}
-
-
-/************************************************************/
-/* tkip_sbox()																*/
-/* Returns a 16 bit value from a 64K entry table. The Table */
-/* is synthesized from two 256 entry byte wide tables.		*/
-/************************************************************/
-
-UINT tkip_sbox(UINT index)
-{
-	UINT index_low;
-	UINT index_high;
-	UINT left, right;
-
-	index_low = (index % 256);
-	index_high = ((index >> 8) % 256);
-
-	left = Tkip_Sbox_Lower[index_low] + (Tkip_Sbox_Upper[index_low] * 256);
-	right = Tkip_Sbox_Upper[index_high] + (Tkip_Sbox_Lower[index_high] * 256);
-
-	return (left ^ right);
-}
-
-UINT rotr1(UINT a)
-{
-	unsigned int b;
-
-	if ((a & 0x01) == 0x01)
-	{
-		b = (a >> 1) | 0x8000;
-	}
-	else
-	{
-		b = (a >> 1) & 0x7fff;
-	}
-	b = b % 65536;
-	return b;
-}
-
-VOID RTMPTkipMixKey(
-	UCHAR *key,
-	UCHAR *ta,
-	ULONG pnl, /* Least significant 16 bits of PN */
-	ULONG pnh, /* Most significant 32 bits of PN */
-	UCHAR *rc4key,
-	UINT *p1k)
-{
-
-	UINT tsc0;
-	UINT tsc1;
-	UINT tsc2;
-
-	UINT ppk0;
-	UINT ppk1;
-	UINT ppk2;
-	UINT ppk3;
-	UINT ppk4;
-	UINT ppk5;
-
-	INT i;
-	INT j;
-
-	tsc0 = (unsigned int)((pnh >> 16) % 65536); /* msb */
-	tsc1 = (unsigned int)(pnh % 65536);
-	tsc2 = (unsigned int)(pnl % 65536); /* lsb */
-
-	/* Phase 1, step 1 */
-	p1k[0] = tsc1;
-	p1k[1] = tsc0;
-	p1k[2] = (UINT)(ta[0] + (ta[1]*256));
-	p1k[3] = (UINT)(ta[2] + (ta[3]*256));
-	p1k[4] = (UINT)(ta[4] + (ta[5]*256));
-
-	/* Phase 1, step 2 */
-	for (i=0; i<8; i++)
-	{
-		j = 2*(i & 1);
-		p1k[0] = (p1k[0] + tkip_sbox( (p1k[4] ^ ((256*key[1+j]) + key[j])) % 65536 )) % 65536;
-		p1k[1] = (p1k[1] + tkip_sbox( (p1k[0] ^ ((256*key[5+j]) + key[4+j])) % 65536 )) % 65536;
-		p1k[2] = (p1k[2] + tkip_sbox( (p1k[1] ^ ((256*key[9+j]) + key[8+j])) % 65536 )) % 65536;
-		p1k[3] = (p1k[3] + tkip_sbox( (p1k[2] ^ ((256*key[13+j]) + key[12+j])) % 65536 )) % 65536;
-		p1k[4] = (p1k[4] + tkip_sbox( (p1k[3] ^ (((256*key[1+j]) + key[j]))) % 65536 )) % 65536;
-		p1k[4] = (p1k[4] + i) % 65536;
-	}
-
-	/* Phase 2, Step 1 */
-	ppk0 = p1k[0];
-	ppk1 = p1k[1];
-	ppk2 = p1k[2];
-	ppk3 = p1k[3];
-	ppk4 = p1k[4];
-	ppk5 = (p1k[4] + tsc2) % 65536;
-
-	/* Phase2, Step 2 */
-	ppk0 = ppk0 + tkip_sbox( (ppk5 ^ ((256*key[1]) + key[0])) % 65536);
-	ppk1 = ppk1 + tkip_sbox( (ppk0 ^ ((256*key[3]) + key[2])) % 65536);
-	ppk2 = ppk2 + tkip_sbox( (ppk1 ^ ((256*key[5]) + key[4])) % 65536);
-	ppk3 = ppk3 + tkip_sbox( (ppk2 ^ ((256*key[7]) + key[6])) % 65536);
-	ppk4 = ppk4 + tkip_sbox( (ppk3 ^ ((256*key[9]) + key[8])) % 65536);
-	ppk5 = ppk5 + tkip_sbox( (ppk4 ^ ((256*key[11]) + key[10])) % 65536);
-
-	ppk0 = ppk0 + rotr1(ppk5 ^ ((256*key[13]) + key[12]));
-	ppk1 = ppk1 + rotr1(ppk0 ^ ((256*key[15]) + key[14]));
-	ppk2 = ppk2 + rotr1(ppk1);
-	ppk3 = ppk3 + rotr1(ppk2);
-	ppk4 = ppk4 + rotr1(ppk3);
-	ppk5 = ppk5 + rotr1(ppk4);
-
-	/* Phase 2, Step 3 */
-    /* Phase 2, Step 3 */
-
-	tsc0 = (unsigned int)((pnh >> 16) % 65536); /* msb */
-	tsc1 = (unsigned int)(pnh % 65536);
-	tsc2 = (unsigned int)(pnl % 65536); /* lsb */
-
-	rc4key[0] = (tsc2 >> 8) % 256;
-	rc4key[1] = (((tsc2 >> 8) % 256) | 0x20) & 0x7f;
-	rc4key[2] = tsc2 % 256;
-	rc4key[3] = ((ppk5 ^ ((256*key[1]) + key[0])) >> 1) % 256;
-
-	rc4key[4] = ppk0 % 256;
-	rc4key[5] = (ppk0 >> 8) % 256;
-
-	rc4key[6] = ppk1 % 256;
-	rc4key[7] = (ppk1 >> 8) % 256;
-
-	rc4key[8] = ppk2 % 256;
-	rc4key[9] = (ppk2 >> 8) % 256;
-
-	rc4key[10] = ppk3 % 256;
-	rc4key[11] = (ppk3 >> 8) % 256;
-
-	rc4key[12] = ppk4 % 256;
-	rc4key[13] = (ppk4 >> 8) % 256;
-
-	rc4key[14] = ppk5 % 256;
-	rc4key[15] = (ppk5 >> 8) % 256;
-}
-
-
-//
-// TRUE: Success!
-// FALSE: Decrypt Error!
-//
-BOOLEAN RTMPSoftDecryptTKIP(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR	pData,
-	IN ULONG	DataByteCnt,
-	IN UCHAR    UserPriority,
-	IN PCIPHER_KEY	pWpaKey)
-{
-	UCHAR			KeyID;
-	UINT			HeaderLen;
-    UCHAR			fc0;
-	UCHAR			fc1;
-	USHORT			fc;
-	UINT			frame_type;
-	UINT			frame_subtype;
-    UINT			from_ds;
-    UINT			to_ds;
-	INT				a4_exists;
-	INT				qc_exists;
-	USHORT			duration;
-	USHORT			seq_control;
-	USHORT			qos_control;
-	UCHAR			TA[MAC_ADDR_LEN];
-	UCHAR			DA[MAC_ADDR_LEN];
-	UCHAR			SA[MAC_ADDR_LEN];
-	UCHAR			RC4Key[16];
-	UINT			p1k[5]; //for mix_key;
-	ULONG			pnl;/* Least significant 16 bits of PN */
-	ULONG			pnh;/* Most significant 32 bits of PN */
-	UINT			num_blocks;
-	UINT			payload_remainder;
-	ARCFOURCONTEXT	ArcFourContext;
-	UINT			crc32 = 0;
-	UINT			trailfcs = 0;
-	UCHAR			MIC[8];
-	UCHAR			TrailMIC[8];
-
-#ifdef RT_BIG_ENDIAN
-	RTMPFrameEndianChange(pAd, (PUCHAR)pData, DIR_READ, FALSE);
-#endif
-
-	fc0 = *pData;
-	fc1 = *(pData + 1);
-
-	fc = *((PUSHORT)pData);
-
-	frame_type = ((fc0 >> 2) & 0x03);
-	frame_subtype = ((fc0 >> 4) & 0x0f);
-
-    from_ds = (fc1 & 0x2) >> 1;
-    to_ds = (fc1 & 0x1);
-
-    a4_exists = (from_ds & to_ds);
-    qc_exists = ((frame_subtype == 0x08) ||    /* Assumed QoS subtypes */
-                  (frame_subtype == 0x09) ||   /* Likely to change.    */
-                  (frame_subtype == 0x0a) ||
-                  (frame_subtype == 0x0b)
-                 );
-
-	HeaderLen = 24;
-	if (a4_exists)
-		HeaderLen += 6;
-
-	KeyID = *((PUCHAR)(pData+ HeaderLen + 3));
-	KeyID = KeyID >> 6;
-
-	if (pWpaKey[KeyID].KeyLen == 0)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("RTMPSoftDecryptTKIP failed!(KeyID[%d] Length can not be 0)\n", KeyID));
-		return FALSE;
-	}
-
-	duration = *((PUSHORT)(pData+2));
-
-	seq_control = *((PUSHORT)(pData+22));
-
-	if (qc_exists)
-	{
-		if (a4_exists)
-		{
-			qos_control = *((PUSHORT)(pData+30));
-		}
-		else
-		{
-			qos_control = *((PUSHORT)(pData+24));
-		}
-	}
-
-	if (to_ds == 0 && from_ds == 1)
-	{
-		NdisMoveMemory(DA, pData+4, MAC_ADDR_LEN);
-		NdisMoveMemory(SA, pData+16, MAC_ADDR_LEN);
-		NdisMoveMemory(TA, pData+10, MAC_ADDR_LEN);  //BSSID
-	}
-	else if (to_ds == 0 && from_ds == 0 )
-	{
-		NdisMoveMemory(TA, pData+10, MAC_ADDR_LEN);
-		NdisMoveMemory(DA, pData+4, MAC_ADDR_LEN);
-		NdisMoveMemory(SA, pData+10, MAC_ADDR_LEN);
-	}
-	else if (to_ds == 1 && from_ds == 0)
-	{
-		NdisMoveMemory(SA, pData+10, MAC_ADDR_LEN);
-		NdisMoveMemory(TA, pData+10, MAC_ADDR_LEN);
-		NdisMoveMemory(DA, pData+16, MAC_ADDR_LEN);
-	}
-	else if (to_ds == 1 && from_ds == 1)
-	{
-		NdisMoveMemory(TA, pData+10, MAC_ADDR_LEN);
-		NdisMoveMemory(DA, pData+16, MAC_ADDR_LEN);
-		NdisMoveMemory(SA, pData+22, MAC_ADDR_LEN);
-	}
-
-	num_blocks = (DataByteCnt - 16) / 16;
-	payload_remainder = (DataByteCnt - 16) % 16;
-
-	pnl = (*(pData + HeaderLen)) * 256 + *(pData + HeaderLen + 2);
-	pnh = *((PULONG)(pData + HeaderLen + 4));
-	pnh = cpu2le32(pnh);
-	RTMPTkipMixKey(pWpaKey[KeyID].Key, TA, pnl, pnh, RC4Key, p1k);
-
-	ARCFOUR_INIT(&ArcFourContext, RC4Key, 16);
-
-	ARCFOUR_DECRYPT(&ArcFourContext, pData + HeaderLen, pData + HeaderLen + 8, DataByteCnt - HeaderLen - 8);
-	NdisMoveMemory(&trailfcs, pData + DataByteCnt - 8 - 4, 4);
-	crc32 = RTMP_CALC_FCS32(PPPINITFCS32, pData + HeaderLen, DataByteCnt - HeaderLen - 8 - 4);  //Skip IV+EIV 8 bytes & Skip last 4 bytes(FCS).
-	crc32 ^= 0xffffffff;             /* complement */
-
-    if(crc32 != cpu2le32(trailfcs))
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("RTMPSoftDecryptTKIP, WEP Data ICV Error !\n"));	 //ICV error.
-
-		return (FALSE);
-	}
-
-	NdisMoveMemory(TrailMIC, pData + DataByteCnt - 8 - 8 - 4, 8);
-	RTMPInitMICEngine(pAd, pWpaKey[KeyID].Key, DA, SA, UserPriority, pWpaKey[KeyID].RxMic);
-	RTMPTkipAppend(&pAd->PrivateInfo.Tx, pData + HeaderLen, DataByteCnt - HeaderLen - 8 - 12);
-	RTMPTkipGetMIC(&pAd->PrivateInfo.Tx);
-	NdisMoveMemory(MIC, pAd->PrivateInfo.Tx.MIC, 8);
-
-	if (!NdisEqualMemory(MIC, TrailMIC, 8))
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("RTMPSoftDecryptTKIP, WEP Data MIC Error !\n"));	 //MIC error.
-		//RTMPReportMicError(pAd, &pWpaKey[KeyID]);	// marked by AlbertY @ 20060630
-		return (FALSE);
-	}
-
-#ifdef RT_BIG_ENDIAN
-	RTMPFrameEndianChange(pAd, (PUCHAR)pData, DIR_READ, FALSE);
-#endif
-	//DBGPRINT(RT_DEBUG_TRACE, "RTMPSoftDecryptTKIP Decript done!!\n");
-	return TRUE;
-}
diff --git a/drivers/staging/rt3090/common/cmm_wpa.c b/drivers/staging/rt3090/common/cmm_wpa.c
deleted file mode 100644
index bf68ad8747ac..000000000000
--- a/drivers/staging/rt3090/common/cmm_wpa.c
+++ /dev/null
@@ -1,3149 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-	Module Name:
-	wpa.c
-
-	Abstract:
-
-	Revision History:
-	Who			When			What
-	--------	----------		----------------------------------------------
-	Jan	Lee		03-07-22		Initial
-	Paul Lin	03-11-28		Modify for supplicant
-*/
-
-#include "../rt_config.h"
-
-
-// WPA OUI
-UCHAR		OUI_WPA_NONE_AKM[4]		= {0x00, 0x50, 0xF2, 0x00};
-UCHAR       OUI_WPA_VERSION[4]      = {0x00, 0x50, 0xF2, 0x01};
-UCHAR       OUI_WPA_WEP40[4]      = {0x00, 0x50, 0xF2, 0x01};
-UCHAR       OUI_WPA_TKIP[4]     = {0x00, 0x50, 0xF2, 0x02};
-UCHAR       OUI_WPA_CCMP[4]     = {0x00, 0x50, 0xF2, 0x04};
-UCHAR       OUI_WPA_WEP104[4]      = {0x00, 0x50, 0xF2, 0x05};
-UCHAR       OUI_WPA_8021X_AKM[4]	= {0x00, 0x50, 0xF2, 0x01};
-UCHAR       OUI_WPA_PSK_AKM[4]      = {0x00, 0x50, 0xF2, 0x02};
-// WPA2 OUI
-UCHAR       OUI_WPA2_WEP40[4]   = {0x00, 0x0F, 0xAC, 0x01};
-UCHAR       OUI_WPA2_TKIP[4]        = {0x00, 0x0F, 0xAC, 0x02};
-UCHAR       OUI_WPA2_CCMP[4]        = {0x00, 0x0F, 0xAC, 0x04};
-UCHAR       OUI_WPA2_8021X_AKM[4]   = {0x00, 0x0F, 0xAC, 0x01};
-UCHAR       OUI_WPA2_PSK_AKM[4]		= {0x00, 0x0F, 0xAC, 0x02};
-UCHAR       OUI_WPA2_WEP104[4]   = {0x00, 0x0F, 0xAC, 0x05};
-
-
-
-static VOID	ConstructEapolKeyData(
-	IN	PMAC_TABLE_ENTRY	pEntry,
-	IN	UCHAR			GroupKeyWepStatus,
-	IN	UCHAR			keyDescVer,
-	IN	UCHAR			MsgType,
-	IN	UCHAR			DefaultKeyIdx,
-	IN	UCHAR			*GTK,
-	IN	UCHAR			*RSNIE,
-	IN	UCHAR			RSNIE_LEN,
-	OUT PEAPOL_PACKET   pMsg);
-
-static VOID	CalculateMIC(
-	IN	UCHAR			KeyDescVer,
-	IN	UCHAR			*PTK,
-	OUT PEAPOL_PACKET   pMsg);
-
-static VOID WpaEAPPacketAction(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem);
-
-static VOID WpaEAPOLASFAlertAction(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem);
-
-static VOID WpaEAPOLLogoffAction(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem);
-
-static VOID WpaEAPOLStartAction(
-    IN PRTMP_ADAPTER    pAd,
-    IN MLME_QUEUE_ELEM  *Elem);
-
-static VOID WpaEAPOLKeyAction(
-    IN PRTMP_ADAPTER    pAd,
-    IN MLME_QUEUE_ELEM  *Elem);
-
-/*
-    ==========================================================================
-    Description:
-        association state machine init, including state transition and timer init
-    Parameters:
-        S - pointer to the association state machine
-    ==========================================================================
- */
-VOID WpaStateMachineInit(
-    IN  PRTMP_ADAPTER   pAd,
-    IN  STATE_MACHINE *S,
-    OUT STATE_MACHINE_FUNC Trans[])
-{
-    StateMachineInit(S, (STATE_MACHINE_FUNC *)Trans, MAX_WPA_PTK_STATE, MAX_WPA_MSG, (STATE_MACHINE_FUNC)Drop, WPA_PTK, WPA_MACHINE_BASE);
-
-    StateMachineSetAction(S, WPA_PTK, MT2_EAPPacket, (STATE_MACHINE_FUNC)WpaEAPPacketAction);
-    StateMachineSetAction(S, WPA_PTK, MT2_EAPOLStart, (STATE_MACHINE_FUNC)WpaEAPOLStartAction);
-    StateMachineSetAction(S, WPA_PTK, MT2_EAPOLLogoff, (STATE_MACHINE_FUNC)WpaEAPOLLogoffAction);
-    StateMachineSetAction(S, WPA_PTK, MT2_EAPOLKey, (STATE_MACHINE_FUNC)WpaEAPOLKeyAction);
-    StateMachineSetAction(S, WPA_PTK, MT2_EAPOLASFAlert, (STATE_MACHINE_FUNC)WpaEAPOLASFAlertAction);
-}
-
-/*
-    ==========================================================================
-    Description:
-        this is state machine function.
-        When receiving EAP packets which is  for 802.1x authentication use.
-        Not use in PSK case
-    Return:
-    ==========================================================================
-*/
-VOID WpaEAPPacketAction(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem)
-{
-}
-
-VOID WpaEAPOLASFAlertAction(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem)
-{
-}
-
-VOID WpaEAPOLLogoffAction(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem)
-{
-}
-
-/*
-    ==========================================================================
-    Description:
-       Start 4-way HS when rcv EAPOL_START which may create by our driver in assoc.c
-    Return:
-    ==========================================================================
-*/
-VOID WpaEAPOLStartAction(
-    IN PRTMP_ADAPTER    pAd,
-    IN MLME_QUEUE_ELEM  *Elem)
-{
-    MAC_TABLE_ENTRY     *pEntry;
-    PHEADER_802_11      pHeader;
-
-    DBGPRINT(RT_DEBUG_TRACE, ("WpaEAPOLStartAction ===> \n"));
-
-    pHeader = (PHEADER_802_11)Elem->Msg;
-
-    //For normaol PSK, we enqueue an EAPOL-Start command to trigger the process.
-    if (Elem->MsgLen == 6)
-        pEntry = MacTableLookup(pAd, Elem->Msg);
-    else
-    {
-        pEntry = MacTableLookup(pAd, pHeader->Addr2);
-    }
-
-    if (pEntry)
-    {
-		DBGPRINT(RT_DEBUG_TRACE, (" PortSecured(%d), WpaState(%d), AuthMode(%d), PMKID_CacheIdx(%d) \n", pEntry->PortSecured, pEntry->WpaState, pEntry->AuthMode, pEntry->PMKID_CacheIdx));
-
-        if ((pEntry->PortSecured == WPA_802_1X_PORT_NOT_SECURED)
-			&& (pEntry->WpaState < AS_PTKSTART)
-            && ((pEntry->AuthMode == Ndis802_11AuthModeWPAPSK) || (pEntry->AuthMode == Ndis802_11AuthModeWPA2PSK) || ((pEntry->AuthMode == Ndis802_11AuthModeWPA2) && (pEntry->PMKID_CacheIdx != ENTRY_NOT_FOUND))))
-        {
-            pEntry->PrivacyFilter = Ndis802_11PrivFilter8021xWEP;
-            pEntry->WpaState = AS_INITPSK;
-            pEntry->PortSecured = WPA_802_1X_PORT_NOT_SECURED;
-            NdisZeroMemory(pEntry->R_Counter, sizeof(pEntry->R_Counter));
-            pEntry->ReTryCounter = PEER_MSG1_RETRY_TIMER_CTR;
-
-            WPAStart4WayHS(pAd, pEntry, PEER_MSG1_RETRY_EXEC_INTV);
-        }
-    }
-}
-
-/*
-    ==========================================================================
-    Description:
-        This is state machine function.
-        When receiving EAPOL packets which is  for 802.1x key management.
-        Use both in WPA, and WPAPSK case.
-        In this function, further dispatch to different functions according to the received packet.  3 categories are :
-          1.  normal 4-way pairwisekey and 2-way groupkey handshake
-          2.  MIC error (Countermeasures attack)  report packet from STA.
-          3.  Request for pairwise/group key update from STA
-    Return:
-    ==========================================================================
-*/
-VOID WpaEAPOLKeyAction(
-    IN PRTMP_ADAPTER    pAd,
-    IN MLME_QUEUE_ELEM  *Elem)
-{
-    MAC_TABLE_ENTRY     *pEntry;
-    PHEADER_802_11      pHeader;
-    PEAPOL_PACKET       pEapol_packet;
-	KEY_INFO			peerKeyInfo;
-
-    DBGPRINT(RT_DEBUG_TRACE, ("WpaEAPOLKeyAction ===>\n"));
-
-    pHeader = (PHEADER_802_11)Elem->Msg;
-    pEapol_packet = (PEAPOL_PACKET)&Elem->Msg[LENGTH_802_11 + LENGTH_802_1_H];
-
-	NdisZeroMemory((PUCHAR)&peerKeyInfo, sizeof(peerKeyInfo));
-	NdisMoveMemory((PUCHAR)&peerKeyInfo, (PUCHAR)&pEapol_packet->KeyDesc.KeyInfo, sizeof(KEY_INFO));
-
-	hex_dump("Received Eapol frame", (unsigned char *)pEapol_packet, (Elem->MsgLen - LENGTH_802_11 - LENGTH_802_1_H));
-
-	*((USHORT *)&peerKeyInfo) = cpu2le16(*((USHORT *)&peerKeyInfo));
-
-    do
-    {
-        pEntry = MacTableLookup(pAd, pHeader->Addr2);
-
-		if (!pEntry || ((!pEntry->ValidAsCLI) && (!pEntry->ValidAsApCli)))
-            break;
-
-		if (pEntry->AuthMode < Ndis802_11AuthModeWPA)
-				break;
-
-		DBGPRINT(RT_DEBUG_TRACE, ("Receive EAPoL-Key frame from STA %02X-%02X-%02X-%02X-%02X-%02X\n", PRINT_MAC(pEntry->Addr)));
-
-        if (((pEapol_packet->ProVer != EAPOL_VER) && (pEapol_packet->ProVer != EAPOL_VER2)) ||
-			((pEapol_packet->KeyDesc.Type != WPA1_KEY_DESC) && (pEapol_packet->KeyDesc.Type != WPA2_KEY_DESC)))
-        {
-            DBGPRINT(RT_DEBUG_ERROR, ("Key descripter does not match with WPA rule\n"));
-            break;
-        }
-
-		// The value 1 shall be used for all EAPOL-Key frames to and from a STA when
-		// neither the group nor pairwise ciphers are CCMP for Key Descriptor 1.
-		if ((pEntry->WepStatus == Ndis802_11Encryption2Enabled) && (peerKeyInfo.KeyDescVer != DESC_TYPE_TKIP))
-        {
-	        DBGPRINT(RT_DEBUG_ERROR, ("Key descripter version not match(TKIP) \n"));
-	    break;
-	}
-		// The value 2 shall be used for all EAPOL-Key frames to and from a STA when
-		// either the pairwise or the group cipher is AES-CCMP for Key Descriptor 2.
-	else if ((pEntry->WepStatus == Ndis802_11Encryption3Enabled) && (peerKeyInfo.KeyDescVer != DESC_TYPE_AES))
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("Key descripter version not match(AES) \n"));
-		break;
-	}
-
-		// Check if this STA is in class 3 state and the WPA state is started
-        if ((pEntry->Sst == SST_ASSOC) && (pEntry->WpaState >= AS_INITPSK))
-        {
-			// Check the Key Ack (bit 7) of the Key Information to determine the Authenticator
-			// or not.
-			// An EAPOL-Key frame that is sent by the Supplicant in response to an EAPOL-
-			// Key frame from the Authenticator must not have the Ack bit set.
-			if (peerKeyInfo.KeyAck == 1)
-			{
-				// The frame is snet by Authenticator.
-				// So the Supplicant side shall handle this.
-
-				if ((peerKeyInfo.Secure == 0) && (peerKeyInfo.Request == 0) &&
-					(peerKeyInfo.Error == 0) && (peerKeyInfo.KeyType == PAIRWISEKEY))
-				{
-					// Process 1. the message 1 of 4-way HS in WPA or WPA2
-					//			  EAPOL-Key(0,0,1,0,P,0,0,ANonce,0,DataKD_M1)
-					//		   2. the message 3 of 4-way HS in WPA
-					//			  EAPOL-Key(0,1,1,1,P,0,KeyRSC,ANonce,MIC,DataKD_M3)
-					if (peerKeyInfo.KeyMic == 0)
-			PeerPairMsg1Action(pAd, pEntry, Elem);
-	                else
-	                PeerPairMsg3Action(pAd, pEntry, Elem);
-				}
-				else if ((peerKeyInfo.Secure == 1) &&
-						 (peerKeyInfo.KeyMic == 1) &&
-						 (peerKeyInfo.Request == 0) &&
-						 (peerKeyInfo.Error == 0))
-				{
-					// Process 1. the message 3 of 4-way HS in WPA2
-					//			  EAPOL-Key(1,1,1,1,P,0,KeyRSC,ANonce,MIC,DataKD_M3)
-					//		   2. the message 1 of group KS in WPA or WPA2
-					//			  EAPOL-Key(1,1,1,0,G,0,Key RSC,0, MIC,GTK[N])
-					if (peerKeyInfo.KeyType == PAIRWISEKEY)
-						PeerPairMsg3Action(pAd, pEntry, Elem);
-					else
-						PeerGroupMsg1Action(pAd, pEntry, Elem);
-				}
-			}
-			else
-			{
-				// The frame is snet by Supplicant.
-				// So the Authenticator side shall handle this.
-				if ((peerKeyInfo.Request == 0) &&
-						 (peerKeyInfo.Error == 0) &&
-						 (peerKeyInfo.KeyMic == 1))
-				{
-					if (peerKeyInfo.Secure == 0 && peerKeyInfo.KeyType == PAIRWISEKEY)
-					{
-						// EAPOL-Key(0,1,0,0,P,0,0,SNonce,MIC,Data)
-						// Process 1. message 2 of 4-way HS in WPA or WPA2
-						//		   2. message 4 of 4-way HS in WPA
-						if (CONV_ARRARY_TO_UINT16(pEapol_packet->KeyDesc.KeyDataLen) == 0)
-						{
-							PeerPairMsg4Action(pAd, pEntry, Elem);
-			}
-						else
-						{
-							PeerPairMsg2Action(pAd, pEntry, Elem);
-						}
-					}
-					else if (peerKeyInfo.Secure == 1 && peerKeyInfo.KeyType == PAIRWISEKEY)
-					{
-						// EAPOL-Key(1,1,0,0,P,0,0,0,MIC,0)
-						// Process message 4 of 4-way HS in WPA2
-						PeerPairMsg4Action(pAd, pEntry, Elem);
-					}
-					else if (peerKeyInfo.Secure == 1 && peerKeyInfo.KeyType == GROUPKEY)
-					{
-						// EAPOL-Key(1,1,0,0,G,0,0,0,MIC,0)
-						// Process message 2 of Group key HS in WPA or WPA2
-						PeerGroupMsg2Action(pAd, pEntry, &Elem->Msg[LENGTH_802_11], (Elem->MsgLen - LENGTH_802_11));
-					}
-				}
-			}
-        }
-    }while(FALSE);
-}
-
-/*
-	========================================================================
-
-	Routine	Description:
-		Copy frame from waiting queue into relative ring buffer and set
-	appropriate ASIC register to kick hardware encryption before really
-	sent out to air.
-
-	Arguments:
-		pAd		Pointer	to our adapter
-		PNDIS_PACKET	Pointer to outgoing Ndis frame
-		NumberOfFrag	Number of fragment required
-
-	Return Value:
-		None
-
-	Note:
-
-	========================================================================
-*/
-VOID    RTMPToWirelessSta(
-    IN  PRTMP_ADAPTER		pAd,
-    IN  PMAC_TABLE_ENTRY	pEntry,
-    IN  PUCHAR			pHeader802_3,
-    IN  UINT			HdrLen,
-    IN  PUCHAR			pData,
-    IN  UINT			DataLen,
-    IN	BOOLEAN				bClearFrame)
-{
-    PNDIS_PACKET    pPacket;
-    NDIS_STATUS     Status;
-
-	if ((!pEntry) || ((!pEntry->ValidAsCLI) && (!pEntry->ValidAsApCli)))
-		return;
-
-    do {
-		// build a NDIS packet
-		Status = RTMPAllocateNdisPacket(pAd, &pPacket, pHeader802_3, HdrLen, pData, DataLen);
-		if (Status != NDIS_STATUS_SUCCESS)
-		break;
-
-
-			if (bClearFrame)
-				RTMP_SET_PACKET_CLEAR_EAP_FRAME(pPacket, 1);
-			else
-				RTMP_SET_PACKET_CLEAR_EAP_FRAME(pPacket, 0);
-		{
-			RTMP_SET_PACKET_SOURCE(pPacket, PKTSRC_NDIS);
-
-			RTMP_SET_PACKET_NET_DEVICE_MBSSID(pPacket, MAIN_MBSSID);	// set a default value
-			if(pEntry->apidx != 0)
-			RTMP_SET_PACKET_NET_DEVICE_MBSSID(pPacket, pEntry->apidx);
-
-		RTMP_SET_PACKET_WCID(pPacket, (UCHAR)pEntry->Aid);
-			RTMP_SET_PACKET_MOREDATA(pPacket, FALSE);
-		}
-
-#ifdef CONFIG_STA_SUPPORT
-		IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		{
-		    // send out the packet
-	        Status = STASendPacket(pAd, pPacket);
-	    if (Status == NDIS_STATUS_SUCCESS)
-			{
-				UCHAR   Index;
-
-				// Dequeue one frame from TxSwQueue0..3 queue and process it
-				// There are three place calling dequeue for TX ring.
-				// 1. Here, right after queueing the frame.
-				// 2. At the end of TxRingTxDone service routine.
-				// 3. Upon NDIS call RTMPSendPackets
-				if((!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS)) &&
-					(!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RESET_IN_PROGRESS)))
-				{
-					for(Index = 0; Index < 5; Index ++)
-						if(pAd->TxSwQueue[Index].Number > 0)
-							RTMPDeQueuePacket(pAd, FALSE, Index, MAX_TX_PROCESS);
-				}
-			}
-		}
-#endif // CONFIG_STA_SUPPORT //
-
-    } while (FALSE);
-}
-
-/*
-    ==========================================================================
-    Description:
-        This is a function to initilize 4-way handshake
-
-    Return:
-
-    ==========================================================================
-*/
-VOID WPAStart4WayHS(
-    IN PRTMP_ADAPTER    pAd,
-    IN MAC_TABLE_ENTRY  *pEntry,
-    IN ULONG			TimeInterval)
-{
-    UCHAR           Header802_3[14];
-    EAPOL_PACKET	EAPOLPKT;
-	PUINT8			pBssid = NULL;
-	UCHAR			group_cipher = Ndis802_11WEPDisabled;
-
-    DBGPRINT(RT_DEBUG_TRACE, ("===> WPAStart4WayHS\n"));
-
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RESET_IN_PROGRESS | fRTMP_ADAPTER_HALT_IN_PROGRESS))
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("[ERROR]WPAStart4WayHS : The interface is closed...\n"));
-		return;
-	}
-
-
-	if (pBssid == NULL)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("[ERROR]WPAStart4WayHS : No corresponding Authenticator.\n"));
-		return;
-    }
-
-	// Check the status
-    if ((pEntry->WpaState > AS_PTKSTART) || (pEntry->WpaState < AS_INITPMK))
-    {
-        DBGPRINT(RT_DEBUG_ERROR, ("[ERROR]WPAStart4WayHS : Not expect calling\n"));
-        return;
-    }
-
-
-	// Increment replay counter by 1
-	ADD_ONE_To_64BIT_VAR(pEntry->R_Counter);
-
-	// Randomly generate ANonce
-	GenRandom(pAd, (UCHAR *)pBssid, pEntry->ANonce);
-
-	// Construct EAPoL message - Pairwise Msg 1
-	// EAPOL-Key(0,0,1,0,P,0,0,ANonce,0,DataKD_M1)
-	NdisZeroMemory(&EAPOLPKT, sizeof(EAPOL_PACKET));
-	ConstructEapolMsg(pEntry,
-					  group_cipher,
-					  EAPOL_PAIR_MSG_1,
-					  0,					// Default key index
-					  pEntry->ANonce,
-					  NULL,					// TxRSC
-					  NULL,					// GTK
-					  NULL,					// RSNIE
-					  0,					// RSNIE length
-					  &EAPOLPKT);
-
-
-	// Make outgoing frame
-    MAKE_802_3_HEADER(Header802_3, pEntry->Addr, pBssid, EAPOL);
-    RTMPToWirelessSta(pAd, pEntry, Header802_3,
-					  LENGTH_802_3, (PUCHAR)&EAPOLPKT,
-					  CONV_ARRARY_TO_UINT16(EAPOLPKT.Body_Len) + 4,
-					  (pEntry->PortSecured == WPA_802_1X_PORT_SECURED) ? FALSE : TRUE);
-
-	// Trigger Retry Timer
-    RTMPModTimer(&pEntry->RetryTimer, TimeInterval);
-
-	// Update State
-    pEntry->WpaState = AS_PTKSTART;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("<=== WPAStart4WayHS: send Msg1 of 4-way \n"));
-
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-		Process Pairwise key Msg-1 of 4-way handshaking and send Msg-2
-
-	Arguments:
-		pAd			Pointer	to our adapter
-		Elem		Message body
-
-	Return Value:
-		None
-
-	Note:
-
-	========================================================================
-*/
-VOID PeerPairMsg1Action(
-	IN PRTMP_ADAPTER    pAd,
-    IN MAC_TABLE_ENTRY  *pEntry,
-    IN MLME_QUEUE_ELEM  *Elem)
-{
-	UCHAR				PTK[80];
-	UCHAR               Header802_3[14];
-	PEAPOL_PACKET		pMsg1;
-	UINT			MsgLen;
-	EAPOL_PACKET		EAPOLPKT;
-	PUINT8				pCurrentAddr = NULL;
-	PUINT8				pmk_ptr = NULL;
-	UCHAR				group_cipher = Ndis802_11WEPDisabled;
-	PUINT8				rsnie_ptr = NULL;
-	UCHAR				rsnie_len = 0;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("===> PeerPairMsg1Action \n"));
-
-	if ((!pEntry) || ((!pEntry->ValidAsCLI) && (!pEntry->ValidAsApCli)))
-		return;
-
-    if (Elem->MsgLen < (LENGTH_802_11 + LENGTH_802_1_H + LENGTH_EAPOL_H + sizeof(KEY_DESCRIPTER) - MAX_LEN_OF_RSNIE - 2))
-        return;
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-		pCurrentAddr = pAd->CurrentAddress;
-		pmk_ptr = pAd->StaCfg.PMK;
-		group_cipher = pAd->StaCfg.GroupCipher;
-		rsnie_ptr = pAd->StaCfg.RSN_IE;
-		rsnie_len = pAd->StaCfg.RSNIE_Len;
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-	// Store the received frame
-	pMsg1 = (PEAPOL_PACKET) &Elem->Msg[LENGTH_802_11 + LENGTH_802_1_H];
-	MsgLen = Elem->MsgLen - LENGTH_802_11 - LENGTH_802_1_H;
-
-	// Sanity Check peer Pairwise message 1 - Replay Counter
-	if (PeerWpaMessageSanity(pAd, pMsg1, MsgLen, EAPOL_PAIR_MSG_1, pEntry) == FALSE)
-		return;
-
-	// Store Replay counter, it will use to verify message 3 and construct message 2
-	NdisMoveMemory(pEntry->R_Counter, pMsg1->KeyDesc.ReplayCounter, LEN_KEY_DESC_REPLAY);
-
-	// Store ANonce
-	NdisMoveMemory(pEntry->ANonce, pMsg1->KeyDesc.KeyNonce, LEN_KEY_DESC_NONCE);
-
-	// Generate random SNonce
-	GenRandom(pAd, (UCHAR *)pCurrentAddr, pEntry->SNonce);
-
-	{
-	    // Calculate PTK(ANonce, SNonce)
-	    WpaDerivePTK(pAd,
-				pmk_ptr,
-				pEntry->ANonce,
-					pEntry->Addr,
-					pEntry->SNonce,
-					pCurrentAddr,
-				    PTK,
-				    LEN_PTK);
-
-		// Save key to PTK entry
-		NdisMoveMemory(pEntry->PTK, PTK, LEN_PTK);
-	}
-
-	// Update WpaState
-	pEntry->WpaState = AS_PTKINIT_NEGOTIATING;
-
-	// Construct EAPoL message - Pairwise Msg 2
-	//  EAPOL-Key(0,1,0,0,P,0,0,SNonce,MIC,DataKD_M2)
-	NdisZeroMemory(&EAPOLPKT, sizeof(EAPOL_PACKET));
-	ConstructEapolMsg(pEntry,
-					  group_cipher,
-					  EAPOL_PAIR_MSG_2,
-					  0,				// DefaultKeyIdx
-					  pEntry->SNonce,
-					  NULL,				// TxRsc
-					  NULL,				// GTK
-					  (UCHAR *)rsnie_ptr,
-					  rsnie_len,
-					  &EAPOLPKT);
-
-	// Make outgoing frame
-	MAKE_802_3_HEADER(Header802_3, pEntry->Addr, pCurrentAddr, EAPOL);
-
-	RTMPToWirelessSta(pAd, pEntry,
-					  Header802_3, sizeof(Header802_3), (PUCHAR)&EAPOLPKT,
-					  CONV_ARRARY_TO_UINT16(EAPOLPKT.Body_Len) + 4, TRUE);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("<=== PeerPairMsg1Action: send Msg2 of 4-way \n"));
-}
-
-
-/*
-    ==========================================================================
-    Description:
-        When receiving the second packet of 4-way pairwisekey handshake.
-    Return:
-    ==========================================================================
-*/
-VOID PeerPairMsg2Action(
-    IN PRTMP_ADAPTER    pAd,
-    IN MAC_TABLE_ENTRY  *pEntry,
-    IN MLME_QUEUE_ELEM  *Elem)
-{
-	UCHAR				PTK[80];
-    BOOLEAN             Cancelled;
-    PHEADER_802_11      pHeader;
-	EAPOL_PACKET        EAPOLPKT;
-	PEAPOL_PACKET       pMsg2;
-	UINT			MsgLen;
-    UCHAR               Header802_3[LENGTH_802_3];
-	UCHAR				TxTsc[6];
-	PUINT8				pBssid = NULL;
-	PUINT8				pmk_ptr = NULL;
-	PUINT8				gtk_ptr = NULL;
-	UCHAR				default_key = 0;
-	UCHAR				group_cipher = Ndis802_11WEPDisabled;
-	PUINT8				rsnie_ptr = NULL;
-	UCHAR				rsnie_len = 0;
-
-    DBGPRINT(RT_DEBUG_TRACE, ("===> PeerPairMsg2Action \n"));
-
-    if ((!pEntry) || (!pEntry->ValidAsCLI))
-        return;
-
-    if (Elem->MsgLen < (LENGTH_802_11 + LENGTH_802_1_H + LENGTH_EAPOL_H + sizeof(KEY_DESCRIPTER) - MAX_LEN_OF_RSNIE - 2))
-        return;
-
-    // check Entry in valid State
-    if (pEntry->WpaState < AS_PTKSTART)
-        return;
-
-
-
-    // pointer to 802.11 header
-	pHeader = (PHEADER_802_11)Elem->Msg;
-
-	// skip 802.11_header(24-byte) and LLC_header(8)
-	pMsg2 = (PEAPOL_PACKET)&Elem->Msg[LENGTH_802_11 + LENGTH_802_1_H];
-	MsgLen = Elem->MsgLen - LENGTH_802_11 - LENGTH_802_1_H;
-
-	// Store SNonce
-	NdisMoveMemory(pEntry->SNonce, pMsg2->KeyDesc.KeyNonce, LEN_KEY_DESC_NONCE);
-
-	{
-		// Derive PTK
-		WpaDerivePTK(pAd,
-					(UCHAR *)pmk_ptr,
-					pEntry->ANonce,			// ANONCE
-					(UCHAR *)pBssid,
-					pEntry->SNonce,			// SNONCE
-					pEntry->Addr,
-					PTK,
-					LEN_PTK);
-
-	NdisMoveMemory(pEntry->PTK, PTK, LEN_PTK);
-	}
-
-	// Sanity Check peer Pairwise message 2 - Replay Counter, MIC, RSNIE
-	if (PeerWpaMessageSanity(pAd, pMsg2, MsgLen, EAPOL_PAIR_MSG_2, pEntry) == FALSE)
-		return;
-
-    do
-    {
-        // delete retry timer
-		RTMPCancelTimer(&pEntry->RetryTimer, &Cancelled);
-
-		// Change state
-        pEntry->WpaState = AS_PTKINIT_NEGOTIATING;
-
-		// Increment replay counter by 1
-		ADD_ONE_To_64BIT_VAR(pEntry->R_Counter);
-
-		// Construct EAPoL message - Pairwise Msg 3
-		NdisZeroMemory(&EAPOLPKT, sizeof(EAPOL_PACKET));
-		ConstructEapolMsg(pEntry,
-						  group_cipher,
-						  EAPOL_PAIR_MSG_3,
-						  default_key,
-						  pEntry->ANonce,
-						  TxTsc,
-						  (UCHAR *)gtk_ptr,
-						  (UCHAR *)rsnie_ptr,
-						  rsnie_len,
-						  &EAPOLPKT);
-
-        // Make outgoing frame
-        MAKE_802_3_HEADER(Header802_3, pEntry->Addr, pBssid, EAPOL);
-        RTMPToWirelessSta(pAd, pEntry, Header802_3, LENGTH_802_3,
-						  (PUCHAR)&EAPOLPKT,
-						  CONV_ARRARY_TO_UINT16(EAPOLPKT.Body_Len) + 4,
-						  (pEntry->PortSecured == WPA_802_1X_PORT_SECURED) ? FALSE : TRUE);
-
-        pEntry->ReTryCounter = PEER_MSG3_RETRY_TIMER_CTR;
-		RTMPSetTimer(&pEntry->RetryTimer, PEER_MSG3_RETRY_EXEC_INTV);
-
-		// Update State
-        pEntry->WpaState = AS_PTKINIT_NEGOTIATING;
-    }while(FALSE);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("<=== PeerPairMsg2Action: send Msg3 of 4-way \n"));
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-		Process Pairwise key Msg 3 of 4-way handshaking and send Msg 4
-
-	Arguments:
-		pAd	Pointer	to our adapter
-		Elem		Message body
-
-	Return Value:
-		None
-
-	Note:
-
-	========================================================================
-*/
-VOID PeerPairMsg3Action(
-    IN PRTMP_ADAPTER    pAd,
-    IN MAC_TABLE_ENTRY  *pEntry,
-    IN MLME_QUEUE_ELEM  *Elem)
-{
-	PHEADER_802_11		pHeader;
-	UCHAR               Header802_3[14];
-	EAPOL_PACKET		EAPOLPKT;
-	PEAPOL_PACKET		pMsg3;
-	UINT			MsgLen;
-	PUINT8				pCurrentAddr = NULL;
-	UCHAR				group_cipher = Ndis802_11WEPDisabled;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("===> PeerPairMsg3Action \n"));
-
-	if ((!pEntry) || ((!pEntry->ValidAsCLI) && (!pEntry->ValidAsApCli)))
-		return;
-
-    if (Elem->MsgLen < (LENGTH_802_11 + LENGTH_802_1_H + LENGTH_EAPOL_H + sizeof(KEY_DESCRIPTER) - MAX_LEN_OF_RSNIE - 2))
-		return;
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-		pCurrentAddr = pAd->CurrentAddress;
-		group_cipher = pAd->StaCfg.GroupCipher;
-
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-	// Record 802.11 header & the received EAPOL packet Msg3
-	pHeader	= (PHEADER_802_11) Elem->Msg;
-	pMsg3 = (PEAPOL_PACKET) &Elem->Msg[LENGTH_802_11 + LENGTH_802_1_H];
-	MsgLen = Elem->MsgLen - LENGTH_802_11 - LENGTH_802_1_H;
-
-	// Sanity Check peer Pairwise message 3 - Replay Counter, MIC, RSNIE
-	if (PeerWpaMessageSanity(pAd, pMsg3, MsgLen, EAPOL_PAIR_MSG_3, pEntry) == FALSE)
-		return;
-
-	// Save Replay counter, it will use construct message 4
-	NdisMoveMemory(pEntry->R_Counter, pMsg3->KeyDesc.ReplayCounter, LEN_KEY_DESC_REPLAY);
-
-	// Double check ANonce
-	if (!NdisEqualMemory(pEntry->ANonce, pMsg3->KeyDesc.KeyNonce, LEN_KEY_DESC_NONCE))
-	{
-		return;
-	}
-
-	// Construct EAPoL message - Pairwise Msg 4
-	NdisZeroMemory(&EAPOLPKT, sizeof(EAPOL_PACKET));
-	ConstructEapolMsg(pEntry,
-					  group_cipher,
-					  EAPOL_PAIR_MSG_4,
-					  0,					// group key index not used in message 4
-					  NULL,					// Nonce not used in message 4
-					  NULL,					// TxRSC not used in message 4
-					  NULL,					// GTK not used in message 4
-					  NULL,					// RSN IE not used in message 4
-					  0,
-					  &EAPOLPKT);
-
-	// Update WpaState
-	pEntry->WpaState = AS_PTKINITDONE;
-
-	// Update pairwise key
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-		PCIPHER_KEY pSharedKey;
-
-		pSharedKey = &pAd->SharedKey[BSS0][0];
-
-		NdisMoveMemory(pAd->StaCfg.PTK, pEntry->PTK, LEN_PTK);
-
-		// Prepare pair-wise key information into shared key table
-		NdisZeroMemory(pSharedKey, sizeof(CIPHER_KEY));
-		pSharedKey->KeyLen = LEN_TKIP_EK;
-	    NdisMoveMemory(pSharedKey->Key, &pAd->StaCfg.PTK[32], LEN_TKIP_EK);
-		NdisMoveMemory(pSharedKey->RxMic, &pAd->StaCfg.PTK[48], LEN_TKIP_RXMICK);
-		NdisMoveMemory(pSharedKey->TxMic, &pAd->StaCfg.PTK[48+LEN_TKIP_RXMICK], LEN_TKIP_TXMICK);
-
-		// Decide its ChiperAlg
-		if (pAd->StaCfg.PairCipher == Ndis802_11Encryption2Enabled)
-			pSharedKey->CipherAlg = CIPHER_TKIP;
-		else if (pAd->StaCfg.PairCipher == Ndis802_11Encryption3Enabled)
-			pSharedKey->CipherAlg = CIPHER_AES;
-		else
-			pSharedKey->CipherAlg = CIPHER_NONE;
-
-		// Update these related information to MAC_TABLE_ENTRY
-		pEntry = &pAd->MacTab.Content[BSSID_WCID];
-		NdisMoveMemory(pEntry->PairwiseKey.Key, &pAd->StaCfg.PTK[32], LEN_TKIP_EK);
-		NdisMoveMemory(pEntry->PairwiseKey.RxMic, &pAd->StaCfg.PTK[48], LEN_TKIP_RXMICK);
-		NdisMoveMemory(pEntry->PairwiseKey.TxMic, &pAd->StaCfg.PTK[48+LEN_TKIP_RXMICK], LEN_TKIP_TXMICK);
-		pEntry->PairwiseKey.CipherAlg = pSharedKey->CipherAlg;
-
-		// Update pairwise key information to ASIC Shared Key Table
-		AsicAddSharedKeyEntry(pAd,
-							  BSS0,
-							  0,
-							  pSharedKey->CipherAlg,
-							  pSharedKey->Key,
-							  pSharedKey->TxMic,
-							  pSharedKey->RxMic);
-
-		// Update ASIC WCID attribute table and IVEIV table
-		RTMPAddWcidAttributeEntry(pAd,
-								  BSS0,
-								  0,
-								  pSharedKey->CipherAlg,
-								  pEntry);
-
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-	// open 802.1x port control and privacy filter
-	if (pEntry->AuthMode == Ndis802_11AuthModeWPA2PSK ||
-		pEntry->AuthMode == Ndis802_11AuthModeWPA2)
-	{
-		pEntry->PortSecured = WPA_802_1X_PORT_SECURED;
-		pEntry->PrivacyFilter = Ndis802_11PrivFilterAcceptAll;
-
-#ifdef CONFIG_STA_SUPPORT
-		STA_PORT_SECURED(pAd);
-	    // Indicate Connected for GUI
-	    pAd->IndicateMediaState = NdisMediaStateConnected;
-#endif // CONFIG_STA_SUPPORT //
-		DBGPRINT(RT_DEBUG_TRACE, ("PeerPairMsg3Action: AuthMode(%s) PairwiseCipher(%s) GroupCipher(%s) \n",
-									GetAuthMode(pEntry->AuthMode),
-									GetEncryptType(pEntry->WepStatus),
-									GetEncryptType(group_cipher)));
-	}
-	else
-	{
-	}
-
-	// Init 802.3 header and send out
-	MAKE_802_3_HEADER(Header802_3, pEntry->Addr, pCurrentAddr, EAPOL);
-	RTMPToWirelessSta(pAd, pEntry,
-					  Header802_3, sizeof(Header802_3),
-					  (PUCHAR)&EAPOLPKT,
-					  CONV_ARRARY_TO_UINT16(EAPOLPKT.Body_Len) + 4, TRUE);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("<=== PeerPairMsg3Action: send Msg4 of 4-way \n"));
-}
-
-/*
-    ==========================================================================
-    Description:
-        When receiving the last packet of 4-way pairwisekey handshake.
-        Initilize 2-way groupkey handshake following.
-    Return:
-    ==========================================================================
-*/
-VOID PeerPairMsg4Action(
-    IN PRTMP_ADAPTER    pAd,
-    IN MAC_TABLE_ENTRY  *pEntry,
-    IN MLME_QUEUE_ELEM  *Elem)
-{
-	PEAPOL_PACKET		pMsg4;
-    PHEADER_802_11      pHeader;
-    UINT		MsgLen;
-    BOOLEAN             Cancelled;
-	UCHAR				group_cipher = Ndis802_11WEPDisabled;
-
-    DBGPRINT(RT_DEBUG_TRACE, ("===> PeerPairMsg4Action\n"));
-
-    do
-    {
-        if ((!pEntry) || (!pEntry->ValidAsCLI))
-            break;
-
-        if (Elem->MsgLen < (LENGTH_802_11 + LENGTH_802_1_H + LENGTH_EAPOL_H + sizeof(KEY_DESCRIPTER) - MAX_LEN_OF_RSNIE - 2 ) )
-            break;
-
-        if (pEntry->WpaState < AS_PTKINIT_NEGOTIATING)
-            break;
-
-
-        // pointer to 802.11 header
-        pHeader = (PHEADER_802_11)Elem->Msg;
-
-		// skip 802.11_header(24-byte) and LLC_header(8)
-		pMsg4 = (PEAPOL_PACKET)&Elem->Msg[LENGTH_802_11 + LENGTH_802_1_H];
-		MsgLen = Elem->MsgLen - LENGTH_802_11 - LENGTH_802_1_H;
-
-        // Sanity Check peer Pairwise message 4 - Replay Counter, MIC
-		if (PeerWpaMessageSanity(pAd, pMsg4, MsgLen, EAPOL_PAIR_MSG_4, pEntry) == FALSE)
-			break;
-
-        // 3. uses the MLME.SETKEYS.request to configure PTK into MAC
-        NdisZeroMemory(&pEntry->PairwiseKey, sizeof(CIPHER_KEY));
-
-		// reset IVEIV in Asic
-		AsicUpdateWCIDIVEIV(pAd, pEntry->Aid, 1, 0);
-
-        pEntry->PairwiseKey.KeyLen = LEN_TKIP_EK;
-        NdisMoveMemory(pEntry->PairwiseKey.Key, &pEntry->PTK[32], LEN_TKIP_EK);
-        NdisMoveMemory(pEntry->PairwiseKey.RxMic, &pEntry->PTK[TKIP_AP_RXMICK_OFFSET], LEN_TKIP_RXMICK);
-        NdisMoveMemory(pEntry->PairwiseKey.TxMic, &pEntry->PTK[TKIP_AP_TXMICK_OFFSET], LEN_TKIP_TXMICK);
-
-		// Set pairwise key to Asic
-        {
-            pEntry->PairwiseKey.CipherAlg = CIPHER_NONE;
-            if (pEntry->WepStatus == Ndis802_11Encryption2Enabled)
-                pEntry->PairwiseKey.CipherAlg = CIPHER_TKIP;
-            else if (pEntry->WepStatus == Ndis802_11Encryption3Enabled)
-                pEntry->PairwiseKey.CipherAlg = CIPHER_AES;
-
-			// Add Pair-wise key to Asic
-            AsicAddPairwiseKeyEntry(
-                pAd,
-                pEntry->Addr,
-                (UCHAR)pEntry->Aid,
-                &pEntry->PairwiseKey);
-
-			// update WCID attribute table and IVEIV table for this entry
-			RTMPAddWcidAttributeEntry(
-				pAd,
-				pEntry->apidx,
-				0,
-				pEntry->PairwiseKey.CipherAlg,
-				pEntry);
-        }
-
-        // 4. upgrade state
-        pEntry->PrivacyFilter = Ndis802_11PrivFilterAcceptAll;
-        pEntry->WpaState = AS_PTKINITDONE;
-		pEntry->PortSecured = WPA_802_1X_PORT_SECURED;
-
-
-		if (pEntry->AuthMode == Ndis802_11AuthModeWPA2 ||
-			pEntry->AuthMode == Ndis802_11AuthModeWPA2PSK)
-		{
-			pEntry->GTKState = REKEY_ESTABLISHED;
-			RTMPCancelTimer(&pEntry->RetryTimer, &Cancelled);
-
-
-			// send wireless event - for set key done WPA2
-			if (pAd->CommonCfg.bWirelessEvent)
-				RTMPSendWirelessEvent(pAd, IW_SET_KEY_DONE_WPA2_EVENT_FLAG, pEntry->Addr, pEntry->apidx, 0);
-
-	        DBGPRINT(RT_DEBUG_OFF, ("AP SETKEYS DONE - WPA2, AuthMode(%d)=%s, WepStatus(%d)=%s, GroupWepStatus(%d)=%s\n\n",
-									pEntry->AuthMode, GetAuthMode(pEntry->AuthMode),
-									pEntry->WepStatus, GetEncryptType(pEntry->WepStatus),
-									group_cipher,
-									GetEncryptType(group_cipher)));
-		}
-		else
-		{
-		// 5. init Group 2-way handshake if necessary.
-	        WPAStart2WayGroupHS(pAd, pEntry);
-
-		pEntry->ReTryCounter = GROUP_MSG1_RETRY_TIMER_CTR;
-			RTMPModTimer(&pEntry->RetryTimer, PEER_MSG3_RETRY_EXEC_INTV);
-		}
-    }while(FALSE);
-
-}
-
-/*
-    ==========================================================================
-    Description:
-        This is a function to send the first packet of 2-way groupkey handshake
-    Return:
-
-    ==========================================================================
-*/
-VOID WPAStart2WayGroupHS(
-    IN PRTMP_ADAPTER    pAd,
-    IN MAC_TABLE_ENTRY  *pEntry)
-{
-    UCHAR               Header802_3[14];
-	UCHAR				TxTsc[6];
-    EAPOL_PACKET	EAPOLPKT;
-	UCHAR				group_cipher = Ndis802_11WEPDisabled;
-	UCHAR				default_key = 0;
-	PUINT8				gnonce_ptr = NULL;
-	PUINT8				gtk_ptr = NULL;
-	PUINT8				pBssid = NULL;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("===> WPAStart2WayGroupHS\n"));
-
-    if ((!pEntry) || (!pEntry->ValidAsCLI))
-        return;
-
-
-    do
-    {
-        // Increment replay counter by 1
-		ADD_ONE_To_64BIT_VAR(pEntry->R_Counter);
-
-		// Construct EAPoL message - Group Msg 1
-		NdisZeroMemory(&EAPOLPKT, sizeof(EAPOL_PACKET));
-		ConstructEapolMsg(pEntry,
-						  group_cipher,
-						  EAPOL_GROUP_MSG_1,
-						  default_key,
-						  (UCHAR *)gnonce_ptr,
-						  TxTsc,
-						  (UCHAR *)gtk_ptr,
-						  NULL,
-						  0,
-						  &EAPOLPKT);
-
-		// Make outgoing frame
-        MAKE_802_3_HEADER(Header802_3, pEntry->Addr, pBssid, EAPOL);
-        RTMPToWirelessSta(pAd, pEntry,
-						  Header802_3, LENGTH_802_3,
-						  (PUCHAR)&EAPOLPKT,
-						  CONV_ARRARY_TO_UINT16(EAPOLPKT.Body_Len) + 4, FALSE);
-
-
-
-    }while (FALSE);
-
-    DBGPRINT(RT_DEBUG_TRACE, ("<=== WPAStart2WayGroupHS : send out Group Message 1 \n"));
-
-    return;
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-		Process Group key 2-way handshaking
-
-	Arguments:
-		pAd	Pointer	to our adapter
-		Elem		Message body
-
-	Return Value:
-		None
-
-	Note:
-
-	========================================================================
-*/
-VOID	PeerGroupMsg1Action(
-	IN PRTMP_ADAPTER    pAd,
-    IN MAC_TABLE_ENTRY  *pEntry,
-    IN MLME_QUEUE_ELEM  *Elem)
-{
-    UCHAR               Header802_3[14];
-	EAPOL_PACKET		EAPOLPKT;
-	PEAPOL_PACKET		pGroup;
-	UINT			MsgLen;
-	BOOLEAN             Cancelled;
-	UCHAR				default_key = 0;
-	UCHAR				group_cipher = Ndis802_11WEPDisabled;
-	PUINT8				pCurrentAddr = NULL;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("===> PeerGroupMsg1Action \n"));
-
-	if ((!pEntry) || ((!pEntry->ValidAsCLI) && (!pEntry->ValidAsApCli)))
-        return;
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-		pCurrentAddr = pAd->CurrentAddress;
-		group_cipher = pAd->StaCfg.GroupCipher;
-		default_key = pAd->StaCfg.DefaultKeyId;
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-	// Process Group Message 1 frame. skip 802.11 header(24) & LLC_SNAP header(8)
-	pGroup = (PEAPOL_PACKET) &Elem->Msg[LENGTH_802_11 + LENGTH_802_1_H];
-	MsgLen = Elem->MsgLen - LENGTH_802_11 - LENGTH_802_1_H;
-
-	// Sanity Check peer group message 1 - Replay Counter, MIC, RSNIE
-	if (PeerWpaMessageSanity(pAd, pGroup, MsgLen, EAPOL_GROUP_MSG_1, pEntry) == FALSE)
-		return;
-
-	// delete retry timer
-	RTMPCancelTimer(&pEntry->RetryTimer, &Cancelled);
-
-	// Save Replay counter, it will use to construct message 2
-	NdisMoveMemory(pEntry->R_Counter, pGroup->KeyDesc.ReplayCounter, LEN_KEY_DESC_REPLAY);
-
-	// Construct EAPoL message - Group Msg 2
-	NdisZeroMemory(&EAPOLPKT, sizeof(EAPOL_PACKET));
-	ConstructEapolMsg(pEntry,
-					  group_cipher,
-					  EAPOL_GROUP_MSG_2,
-					  default_key,
-					  NULL,					// Nonce not used
-					  NULL,					// TxRSC not used
-					  NULL,					// GTK not used
-					  NULL,					// RSN IE not used
-					  0,
-					  &EAPOLPKT);
-
-    // open 802.1x port control and privacy filter
-	pEntry->PortSecured = WPA_802_1X_PORT_SECURED;
-	pEntry->PrivacyFilter = Ndis802_11PrivFilterAcceptAll;
-
-#ifdef CONFIG_STA_SUPPORT
-	STA_PORT_SECURED(pAd);
-    // Indicate Connected for GUI
-    pAd->IndicateMediaState = NdisMediaStateConnected;
-#endif // CONFIG_STA_SUPPORT //
-
-	DBGPRINT(RT_DEBUG_TRACE, ("PeerGroupMsg1Action: AuthMode(%s) PairwiseCipher(%s) GroupCipher(%s) \n",
-									GetAuthMode(pEntry->AuthMode),
-									GetEncryptType(pEntry->WepStatus),
-									GetEncryptType(group_cipher)));
-
-	// init header and Fill Packet and send Msg 2 to authenticator
-	MAKE_802_3_HEADER(Header802_3, pEntry->Addr, pCurrentAddr, EAPOL);
-	RTMPToWirelessSta(pAd, pEntry,
-					  Header802_3, sizeof(Header802_3),
-					  (PUCHAR)&EAPOLPKT,
-					  CONV_ARRARY_TO_UINT16(EAPOLPKT.Body_Len) + 4, FALSE);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("<=== PeerGroupMsg1Action: sned group message 2\n"));
-}
-
-/*
-    ==========================================================================
-    Description:
-        When receiving the last packet of 2-way groupkey handshake.
-    Return:
-    ==========================================================================
-*/
-VOID PeerGroupMsg2Action(
-    IN PRTMP_ADAPTER    pAd,
-    IN MAC_TABLE_ENTRY  *pEntry,
-    IN VOID             *Msg,
-    IN UINT             MsgLen)
-{
-    UINT		Len;
-    PUCHAR		pData;
-    BOOLEAN		Cancelled;
-	PEAPOL_PACKET       pMsg2;
-	UCHAR				group_cipher = Ndis802_11WEPDisabled;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("===> PeerGroupMsg2Action \n"));
-
-    do
-    {
-        if ((!pEntry) || (!pEntry->ValidAsCLI))
-            break;
-
-        if (MsgLen < (LENGTH_802_1_H + LENGTH_EAPOL_H + sizeof(KEY_DESCRIPTER) - MAX_LEN_OF_RSNIE - 2))
-            break;
-
-        if (pEntry->WpaState != AS_PTKINITDONE)
-            break;
-
-
-        pData = (PUCHAR)Msg;
-		pMsg2 = (PEAPOL_PACKET) (pData + LENGTH_802_1_H);
-        Len = MsgLen - LENGTH_802_1_H;
-
-		// Sanity Check peer group message 2 - Replay Counter, MIC
-		if (PeerWpaMessageSanity(pAd, pMsg2, Len, EAPOL_GROUP_MSG_2, pEntry) == FALSE)
-            break;
-
-        // 3.  upgrade state
-
-		RTMPCancelTimer(&pEntry->RetryTimer, &Cancelled);
-        pEntry->GTKState = REKEY_ESTABLISHED;
-
-		if ((pEntry->AuthMode == Ndis802_11AuthModeWPA2) || (pEntry->AuthMode == Ndis802_11AuthModeWPA2PSK))
-		{
-			// send wireless event - for set key done WPA2
-			if (pAd->CommonCfg.bWirelessEvent)
-				RTMPSendWirelessEvent(pAd, IW_SET_KEY_DONE_WPA2_EVENT_FLAG, pEntry->Addr, pEntry->apidx, 0);
-
-			DBGPRINT(RT_DEBUG_OFF, ("AP SETKEYS DONE - WPA2, AuthMode(%d)=%s, WepStatus(%d)=%s, GroupWepStatus(%d)=%s\n\n",
-										pEntry->AuthMode, GetAuthMode(pEntry->AuthMode),
-										pEntry->WepStatus, GetEncryptType(pEntry->WepStatus),
-										group_cipher, GetEncryptType(group_cipher)));
-		}
-		else
-		{
-			// send wireless event - for set key done WPA
-			if (pAd->CommonCfg.bWirelessEvent)
-				RTMPSendWirelessEvent(pAd, IW_SET_KEY_DONE_WPA1_EVENT_FLAG, pEntry->Addr, pEntry->apidx, 0);
-
-		DBGPRINT(RT_DEBUG_OFF, ("AP SETKEYS DONE - WPA1, AuthMode(%d)=%s, WepStatus(%d)=%s, GroupWepStatus(%d)=%s\n\n",
-										pEntry->AuthMode, GetAuthMode(pEntry->AuthMode),
-										pEntry->WepStatus, GetEncryptType(pEntry->WepStatus),
-										group_cipher, GetEncryptType(group_cipher)));
-		}
-    }while(FALSE);
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-		Classify WPA EAP message type
-
-	Arguments:
-		EAPType		Value of EAP message type
-		MsgType		Internal Message definition for MLME state machine
-
-	Return Value:
-		TRUE		Found appropriate message type
-		FALSE		No appropriate message type
-
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-		All these constants are defined in wpa.h
-		For supplicant, there is only EAPOL Key message avaliable
-
-	========================================================================
-*/
-BOOLEAN	WpaMsgTypeSubst(
-	IN	UCHAR	EAPType,
-	OUT	INT		*MsgType)
-{
-	switch (EAPType)
-	{
-		case EAPPacket:
-			*MsgType = MT2_EAPPacket;
-			break;
-		case EAPOLStart:
-			*MsgType = MT2_EAPOLStart;
-			break;
-		case EAPOLLogoff:
-			*MsgType = MT2_EAPOLLogoff;
-			break;
-		case EAPOLKey:
-			*MsgType = MT2_EAPOLKey;
-			break;
-		case EAPOLASFAlert:
-			*MsgType = MT2_EAPOLASFAlert;
-			break;
-		default:
-			return FALSE;
-	}
-	return TRUE;
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-		The pseudo-random function(PRF) that hashes various inputs to
-		derive a pseudo-random value. To add liveness to the pseudo-random
-		value, a nonce should be one of the inputs.
-
-		It is used to generate PTK, GTK or some specific random value.
-
-	Arguments:
-		UCHAR	*key,		-	the key material for HMAC_SHA1 use
-		INT		key_len		-	the length of key
-		UCHAR	*prefix		-	a prefix label
-		INT		prefix_len	-	the length of the label
-		UCHAR	*data		-	a specific data with variable length
-		INT		data_len	-	the length of a specific data
-		INT		len			-	the output lenght
-
-	Return Value:
-		UCHAR	*output		-	the calculated result
-
-	Note:
-		802.11i-2004	Annex H.3
-
-	========================================================================
-*/
-VOID	PRF(
-	IN	UCHAR	*key,
-	IN	INT		key_len,
-	IN	UCHAR	*prefix,
-	IN	INT		prefix_len,
-	IN	UCHAR	*data,
-	IN	INT		data_len,
-	OUT	UCHAR	*output,
-	IN	INT		len)
-{
-	INT		i;
-    UCHAR   *input;
-	INT		currentindex = 0;
-	INT		total_len;
-
-	// Allocate memory for input
-	os_alloc_mem(NULL, (PUCHAR *)&input, 1024);
-
-    if (input == NULL)
-    {
-        DBGPRINT(RT_DEBUG_ERROR, ("!!!PRF: no memory!!!\n"));
-        return;
-    }
-
-	// Generate concatenation input
-	NdisMoveMemory(input, prefix, prefix_len);
-
-	// Concatenate a single octet containing 0
-	input[prefix_len] =	0;
-
-	// Concatenate specific data
-	NdisMoveMemory(&input[prefix_len + 1], data, data_len);
-	total_len =	prefix_len + 1 + data_len;
-
-	// Concatenate a single octet containing 0
-	// This octet shall be update later
-	input[total_len] = 0;
-	total_len++;
-
-	// Iterate to calculate the result by hmac-sha-1
-	// Then concatenate to last result
-	for	(i = 0;	i <	(len + 19) / 20; i++)
-	{
-		HMAC_SHA1(key, key_len, input, total_len, &output[currentindex], SHA1_DIGEST_SIZE);
-		currentindex +=	20;
-
-		// update the last octet
-		input[total_len - 1]++;
-	}
-    os_free_mem(NULL, input);
-}
-
-/*
-* F(P, S, c, i) = U1 xor U2 xor ... Uc
-* U1 = PRF(P, S || Int(i))
-* U2 = PRF(P, U1)
-* Uc = PRF(P, Uc-1)
-*/
-
-static void F(char *password, unsigned char *ssid, int ssidlength, int iterations, int count, unsigned char *output)
-{
-    unsigned char digest[36], digest1[SHA1_DIGEST_SIZE];
-    int i, j;
-
-    /* U1 = PRF(P, S || int(i)) */
-    memcpy(digest, ssid, ssidlength);
-    digest[ssidlength] = (unsigned char)((count>>24) & 0xff);
-    digest[ssidlength+1] = (unsigned char)((count>>16) & 0xff);
-    digest[ssidlength+2] = (unsigned char)((count>>8) & 0xff);
-    digest[ssidlength+3] = (unsigned char)(count & 0xff);
-    HMAC_SHA1((unsigned char*) password, (int) strlen(password), digest, ssidlength+4, digest1, SHA1_DIGEST_SIZE); // for WPA update
-
-    /* output = U1 */
-    memcpy(output, digest1, SHA1_DIGEST_SIZE);
-
-    for (i = 1; i < iterations; i++)
-    {
-        /* Un = PRF(P, Un-1) */
-        HMAC_SHA1((unsigned char*) password, (int) strlen(password), digest1, SHA1_DIGEST_SIZE, digest, SHA1_DIGEST_SIZE); // for WPA update
-        memcpy(digest1, digest, SHA1_DIGEST_SIZE);
-
-        /* output = output xor Un */
-        for (j = 0; j < SHA1_DIGEST_SIZE; j++)
-        {
-            output[j] ^= digest[j];
-        }
-    }
-}
-
-/*
-* password - ascii string up to 63 characters in length
-* ssid - octet string up to 32 octets
-* ssidlength - length of ssid in octets
-* output must be 40 octets in length and outputs 256 bits of key
-*/
-int PasswordHash(PSTRING password, PUCHAR ssid, INT ssidlength, PUCHAR output)
-{
-    if ((strlen(password) > 63) || (ssidlength > 32))
-        return 0;
-
-    F(password, ssid, ssidlength, 4096, 1, output);
-    F(password, ssid, ssidlength, 4096, 2, &output[SHA1_DIGEST_SIZE]);
-    return 1;
-}
-
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		It utilizes PRF-384 or PRF-512 to derive session-specific keys from a PMK.
-		It shall be called by 4-way handshake processing.
-
-	Arguments:
-		pAd	-	pointer to our pAdapter context
-		PMK		-	pointer to PMK
-		ANonce	-	pointer to ANonce
-		AA		-	pointer to Authenticator Address
-		SNonce	-	pointer to SNonce
-		SA		-	pointer to Supplicant Address
-		len		-	indicate the length of PTK (octet)
-
-	Return Value:
-		Output		pointer to the PTK
-
-	Note:
-		Refer to IEEE 802.11i-2004 8.5.1.2
-
-	========================================================================
-*/
-VOID WpaDerivePTK(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR	*PMK,
-	IN	UCHAR	*ANonce,
-	IN	UCHAR	*AA,
-	IN	UCHAR	*SNonce,
-	IN	UCHAR	*SA,
-	OUT	UCHAR	*output,
-	IN	UINT	len)
-{
-	UCHAR	concatenation[76];
-	UINT	CurrPos = 0;
-	UCHAR	temp[32];
-	UCHAR	Prefix[] = {'P', 'a', 'i', 'r', 'w', 'i', 's', 'e', ' ', 'k', 'e', 'y', ' ',
-						'e', 'x', 'p', 'a', 'n', 's', 'i', 'o', 'n'};
-
-	// initiate the concatenation input
-	NdisZeroMemory(temp, sizeof(temp));
-	NdisZeroMemory(concatenation, 76);
-
-	// Get smaller address
-	if (RTMPCompareMemory(SA, AA, 6) == 1)
-		NdisMoveMemory(concatenation, AA, 6);
-	else
-		NdisMoveMemory(concatenation, SA, 6);
-	CurrPos += 6;
-
-	// Get larger address
-	if (RTMPCompareMemory(SA, AA, 6) == 1)
-		NdisMoveMemory(&concatenation[CurrPos], SA, 6);
-	else
-		NdisMoveMemory(&concatenation[CurrPos], AA, 6);
-
-	// store the larger mac address for backward compatible of
-	// ralink proprietary STA-key issue
-	NdisMoveMemory(temp, &concatenation[CurrPos], MAC_ADDR_LEN);
-	CurrPos += 6;
-
-	// Get smaller Nonce
-	if (RTMPCompareMemory(ANonce, SNonce, 32) == 0)
-		NdisMoveMemory(&concatenation[CurrPos], temp, 32);	// patch for ralink proprietary STA-key issue
-	else if (RTMPCompareMemory(ANonce, SNonce, 32) == 1)
-		NdisMoveMemory(&concatenation[CurrPos], SNonce, 32);
-	else
-		NdisMoveMemory(&concatenation[CurrPos], ANonce, 32);
-	CurrPos += 32;
-
-	// Get larger Nonce
-	if (RTMPCompareMemory(ANonce, SNonce, 32) == 0)
-		NdisMoveMemory(&concatenation[CurrPos], temp, 32);	// patch for ralink proprietary STA-key issue
-	else if (RTMPCompareMemory(ANonce, SNonce, 32) == 1)
-		NdisMoveMemory(&concatenation[CurrPos], ANonce, 32);
-	else
-		NdisMoveMemory(&concatenation[CurrPos], SNonce, 32);
-	CurrPos += 32;
-
-	hex_dump("concatenation=", concatenation, 76);
-
-	// Use PRF to generate PTK
-	PRF(PMK, LEN_MASTER_KEY, Prefix, 22, concatenation, 76, output, len);
-
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-		Generate random number by software.
-
-	Arguments:
-		pAd		-	pointer to our pAdapter context
-		macAddr	-	pointer to local MAC address
-
-	Return Value:
-
-	Note:
-		802.1ii-2004  Annex H.5
-
-	========================================================================
-*/
-VOID	GenRandom(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			*macAddr,
-	OUT	UCHAR			*random)
-{
-	INT		i, curr;
-	UCHAR	local[80], KeyCounter[32];
-	UCHAR	result[80];
-	ULONG	CurrentTime;
-	UCHAR	prefix[] = {'I', 'n', 'i', 't', ' ', 'C', 'o', 'u', 'n', 't', 'e', 'r'};
-
-	// Zero the related information
-	NdisZeroMemory(result, 80);
-	NdisZeroMemory(local, 80);
-	NdisZeroMemory(KeyCounter, 32);
-
-	for	(i = 0;	i <	32;	i++)
-	{
-		// copy the local MAC address
-		COPY_MAC_ADDR(local, macAddr);
-		curr =	MAC_ADDR_LEN;
-
-		// concatenate the current time
-		NdisGetSystemUpTime(&CurrentTime);
-		NdisMoveMemory(&local[curr],  &CurrentTime,	sizeof(CurrentTime));
-		curr +=	sizeof(CurrentTime);
-
-		// concatenate the last result
-		NdisMoveMemory(&local[curr],  result, 32);
-		curr +=	32;
-
-		// concatenate a variable
-		NdisMoveMemory(&local[curr],  &i,  2);
-		curr +=	2;
-
-		// calculate the result
-		PRF(KeyCounter, 32, prefix,12, local, curr, result, 32);
-	}
-
-	NdisMoveMemory(random, result,	32);
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-		Build cipher suite in RSN-IE.
-		It only shall be called by RTMPMakeRSNIE.
-
-	Arguments:
-		pAd			-	pointer to our pAdapter context
-	ElementID	-	indicate the WPA1 or WPA2
-	WepStatus	-	indicate the encryption type
-		bMixCipher	-	a boolean to indicate the pairwise cipher and group
-						cipher are the same or not
-
-	Return Value:
-
-	Note:
-
-	========================================================================
-*/
-static VOID RTMPMakeRsnIeCipher(
-	IN  PRTMP_ADAPTER   pAd,
-	IN	UCHAR			ElementID,
-	IN	UINT			WepStatus,
-	IN	BOOLEAN			bMixCipher,
-	IN	UCHAR			FlexibleCipher,
-	OUT	PUCHAR			pRsnIe,
-	OUT	UCHAR			*rsn_len)
-{
-	UCHAR	PairwiseCnt;
-
-	*rsn_len = 0;
-
-	// decide WPA2 or WPA1
-	if (ElementID == Wpa2Ie)
-	{
-		RSNIE2	*pRsnie_cipher = (RSNIE2*)pRsnIe;
-
-		// Assign the verson as 1
-		pRsnie_cipher->version = 1;
-
-        switch (WepStatus)
-        {
-		// TKIP mode
-            case Ndis802_11Encryption2Enabled:
-                NdisMoveMemory(pRsnie_cipher->mcast, OUI_WPA2_TKIP, 4);
-                pRsnie_cipher->ucount = 1;
-                NdisMoveMemory(pRsnie_cipher->ucast[0].oui, OUI_WPA2_TKIP, 4);
-                *rsn_len = sizeof(RSNIE2);
-                break;
-
-			// AES mode
-            case Ndis802_11Encryption3Enabled:
-				if (bMixCipher)
-					NdisMoveMemory(pRsnie_cipher->mcast, OUI_WPA2_TKIP, 4);
-				else
-					NdisMoveMemory(pRsnie_cipher->mcast, OUI_WPA2_CCMP, 4);
-                pRsnie_cipher->ucount = 1;
-                NdisMoveMemory(pRsnie_cipher->ucast[0].oui, OUI_WPA2_CCMP, 4);
-                *rsn_len = sizeof(RSNIE2);
-                break;
-
-			// TKIP-AES mix mode
-            case Ndis802_11Encryption4Enabled:
-                NdisMoveMemory(pRsnie_cipher->mcast, OUI_WPA2_TKIP, 4);
-
-				PairwiseCnt = 1;
-				// Insert WPA2 TKIP as the first pairwise cipher
-				if (MIX_CIPHER_WPA2_TKIP_ON(FlexibleCipher))
-				{
-			NdisMoveMemory(pRsnie_cipher->ucast[0].oui, OUI_WPA2_TKIP, 4);
-					// Insert WPA2 AES as the secondary pairwise cipher
-					if (MIX_CIPHER_WPA2_AES_ON(FlexibleCipher))
-					{
-				NdisMoveMemory(pRsnie_cipher->ucast[0].oui + 4, OUI_WPA2_CCMP, 4);
-						PairwiseCnt = 2;
-					}
-				}
-				else
-				{
-					// Insert WPA2 AES as the first pairwise cipher
-					NdisMoveMemory(pRsnie_cipher->ucast[0].oui, OUI_WPA2_CCMP, 4);
-				}
-
-                pRsnie_cipher->ucount = PairwiseCnt;
-                *rsn_len = sizeof(RSNIE2) + (4 * (PairwiseCnt - 1));
-                break;
-        }
-
-#ifdef CONFIG_STA_SUPPORT
-		if ((pAd->OpMode == OPMODE_STA) &&
-			(pAd->StaCfg.GroupCipher != Ndis802_11Encryption2Enabled) &&
-			(pAd->StaCfg.GroupCipher != Ndis802_11Encryption3Enabled))
-		{
-			UINT	GroupCipher = pAd->StaCfg.GroupCipher;
-			switch(GroupCipher)
-			{
-				case Ndis802_11GroupWEP40Enabled:
-					NdisMoveMemory(pRsnie_cipher->mcast, OUI_WPA2_WEP40, 4);
-					break;
-				case Ndis802_11GroupWEP104Enabled:
-					NdisMoveMemory(pRsnie_cipher->mcast, OUI_WPA2_WEP104, 4);
-					break;
-			}
-		}
-#endif // CONFIG_STA_SUPPORT //
-
-		// swap for big-endian platform
-		pRsnie_cipher->version = cpu2le16(pRsnie_cipher->version);
-	    pRsnie_cipher->ucount = cpu2le16(pRsnie_cipher->ucount);
-	}
-	else
-	{
-		RSNIE	*pRsnie_cipher = (RSNIE*)pRsnIe;
-
-		// Assign OUI and version
-		NdisMoveMemory(pRsnie_cipher->oui, OUI_WPA_VERSION, 4);
-        pRsnie_cipher->version = 1;
-
-		switch (WepStatus)
-		{
-			// TKIP mode
-            case Ndis802_11Encryption2Enabled:
-                NdisMoveMemory(pRsnie_cipher->mcast, OUI_WPA_TKIP, 4);
-                pRsnie_cipher->ucount = 1;
-                NdisMoveMemory(pRsnie_cipher->ucast[0].oui, OUI_WPA_TKIP, 4);
-                *rsn_len = sizeof(RSNIE);
-                break;
-
-			// AES mode
-            case Ndis802_11Encryption3Enabled:
-				if (bMixCipher)
-					NdisMoveMemory(pRsnie_cipher->mcast, OUI_WPA_TKIP, 4);
-				else
-					NdisMoveMemory(pRsnie_cipher->mcast, OUI_WPA_CCMP, 4);
-                pRsnie_cipher->ucount = 1;
-                NdisMoveMemory(pRsnie_cipher->ucast[0].oui, OUI_WPA_CCMP, 4);
-                *rsn_len = sizeof(RSNIE);
-                break;
-
-			// TKIP-AES mix mode
-            case Ndis802_11Encryption4Enabled:
-                NdisMoveMemory(pRsnie_cipher->mcast, OUI_WPA_TKIP, 4);
-
-				PairwiseCnt = 1;
-				// Insert WPA TKIP as the first pairwise cipher
-				if (MIX_CIPHER_WPA_TKIP_ON(FlexibleCipher))
-				{
-			NdisMoveMemory(pRsnie_cipher->ucast[0].oui, OUI_WPA_TKIP, 4);
-					// Insert WPA AES as the secondary pairwise cipher
-					if (MIX_CIPHER_WPA_AES_ON(FlexibleCipher))
-					{
-				NdisMoveMemory(pRsnie_cipher->ucast[0].oui + 4, OUI_WPA_CCMP, 4);
-						PairwiseCnt = 2;
-					}
-				}
-				else
-				{
-					// Insert WPA AES as the first pairwise cipher
-					NdisMoveMemory(pRsnie_cipher->ucast[0].oui, OUI_WPA_CCMP, 4);
-				}
-
-                pRsnie_cipher->ucount = PairwiseCnt;
-                *rsn_len = sizeof(RSNIE) + (4 * (PairwiseCnt - 1));
-                break;
-        }
-
-#ifdef CONFIG_STA_SUPPORT
-		if ((pAd->OpMode == OPMODE_STA) &&
-			(pAd->StaCfg.GroupCipher != Ndis802_11Encryption2Enabled) &&
-			(pAd->StaCfg.GroupCipher != Ndis802_11Encryption3Enabled))
-		{
-			UINT	GroupCipher = pAd->StaCfg.GroupCipher;
-			switch(GroupCipher)
-			{
-				case Ndis802_11GroupWEP40Enabled:
-					NdisMoveMemory(pRsnie_cipher->mcast, OUI_WPA_WEP40, 4);
-					break;
-				case Ndis802_11GroupWEP104Enabled:
-					NdisMoveMemory(pRsnie_cipher->mcast, OUI_WPA_WEP104, 4);
-					break;
-			}
-		}
-#endif // CONFIG_STA_SUPPORT //
-
-		// swap for big-endian platform
-		pRsnie_cipher->version = cpu2le16(pRsnie_cipher->version);
-	    pRsnie_cipher->ucount = cpu2le16(pRsnie_cipher->ucount);
-	}
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-		Build AKM suite in RSN-IE.
-		It only shall be called by RTMPMakeRSNIE.
-
-	Arguments:
-		pAd			-	pointer to our pAdapter context
-	ElementID	-	indicate the WPA1 or WPA2
-	AuthMode	-	indicate the authentication mode
-		apidx		-	indicate the interface index
-
-	Return Value:
-
-	Note:
-
-	========================================================================
-*/
-static VOID RTMPMakeRsnIeAKM(
-	IN  PRTMP_ADAPTER   pAd,
-	IN	UCHAR			ElementID,
-	IN	UINT			AuthMode,
-	IN	UCHAR			apidx,
-	OUT	PUCHAR			pRsnIe,
-	OUT	UCHAR			*rsn_len)
-{
-	RSNIE_AUTH		*pRsnie_auth;
-	UCHAR			AkmCnt = 1;		// default as 1
-
-	pRsnie_auth = (RSNIE_AUTH*)(pRsnIe + (*rsn_len));
-
-	// decide WPA2 or WPA1
-	if (ElementID == Wpa2Ie)
-	{
-
-		switch (AuthMode)
-        {
-            case Ndis802_11AuthModeWPA2:
-            case Ndis802_11AuthModeWPA1WPA2:
-			NdisMoveMemory(pRsnie_auth->auth[0].oui, OUI_WPA2_8021X_AKM, 4);
-                break;
-
-            case Ndis802_11AuthModeWPA2PSK:
-            case Ndis802_11AuthModeWPA1PSKWPA2PSK:
-			NdisMoveMemory(pRsnie_auth->auth[0].oui, OUI_WPA2_PSK_AKM, 4);
-                break;
-			default:
-				AkmCnt = 0;
-				break;
-
-        }
-	}
-	else
-	{
-		switch (AuthMode)
-        {
-            case Ndis802_11AuthModeWPA:
-            case Ndis802_11AuthModeWPA1WPA2:
-                NdisMoveMemory(pRsnie_auth->auth[0].oui, OUI_WPA_8021X_AKM, 4);
-                break;
-
-            case Ndis802_11AuthModeWPAPSK:
-            case Ndis802_11AuthModeWPA1PSKWPA2PSK:
-                NdisMoveMemory(pRsnie_auth->auth[0].oui, OUI_WPA_PSK_AKM, 4);
-                break;
-
-			case Ndis802_11AuthModeWPANone:
-                NdisMoveMemory(pRsnie_auth->auth[0].oui, OUI_WPA_NONE_AKM, 4);
-                break;
-			default:
-				AkmCnt = 0;
-				break;
-        }
-	}
-
-	pRsnie_auth->acount = AkmCnt;
-	pRsnie_auth->acount = cpu2le16(pRsnie_auth->acount);
-
-	// update current RSNIE length
-	(*rsn_len) += (sizeof(RSNIE_AUTH) + (4 * (AkmCnt - 1)));
-
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-		Build capability in RSN-IE.
-		It only shall be called by RTMPMakeRSNIE.
-
-	Arguments:
-		pAd			-	pointer to our pAdapter context
-	ElementID	-	indicate the WPA1 or WPA2
-		apidx		-	indicate the interface index
-
-	Return Value:
-
-	Note:
-
-	========================================================================
-*/
-static VOID RTMPMakeRsnIeCap(
-	IN  PRTMP_ADAPTER   pAd,
-	IN	UCHAR			ElementID,
-	IN	UCHAR			apidx,
-	OUT	PUCHAR			pRsnIe,
-	OUT	UCHAR			*rsn_len)
-{
-	RSN_CAPABILITIES    *pRSN_Cap;
-
-	// it could be ignored in WPA1 mode
-	if (ElementID == WpaIe)
-		return;
-
-	pRSN_Cap = (RSN_CAPABILITIES*)(pRsnIe + (*rsn_len));
-
-
-	pRSN_Cap->word = cpu2le16(pRSN_Cap->word);
-
-	(*rsn_len) += sizeof(RSN_CAPABILITIES);	// update current RSNIE length
-
-}
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		Build RSN IE context. It is not included element-ID and length.
-
-	Arguments:
-		pAd			-	pointer to our pAdapter context
-	AuthMode	-	indicate the authentication mode
-	WepStatus	-	indicate the encryption type
-		apidx		-	indicate the interface index
-
-	Return Value:
-
-	Note:
-
-	========================================================================
-*/
-VOID RTMPMakeRSNIE(
-    IN  PRTMP_ADAPTER   pAd,
-    IN  UINT            AuthMode,
-    IN  UINT            WepStatus,
-	IN	UCHAR			apidx)
-{
-	PUCHAR		pRsnIe = NULL;			// primary RSNIE
-	UCHAR		*rsnielen_cur_p = 0;	// the length of the primary RSNIE
-	UCHAR		*rsnielen_ex_cur_p = 0;	// the length of the secondary RSNIE
-	UCHAR		PrimaryRsnie;
-	BOOLEAN		bMixCipher = FALSE;	// indicate the pairwise and group cipher are different
-	UCHAR		p_offset;
-	WPA_MIX_PAIR_CIPHER		FlexibleCipher = WPA_TKIPAES_WPA2_TKIPAES;	// it provide the more flexible cipher combination in WPA-WPA2 and TKIPAES mode
-
-	rsnielen_cur_p = NULL;
-	rsnielen_ex_cur_p = NULL;
-
-	{
-#ifdef CONFIG_STA_SUPPORT
-		IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		{
-#ifdef WPA_SUPPLICANT_SUPPORT
-			if (pAd->StaCfg.WpaSupplicantUP != WPA_SUPPLICANT_DISABLE)
-			{
-				if (AuthMode < Ndis802_11AuthModeWPA)
-					return;
-			}
-			else
-#endif // WPA_SUPPLICANT_SUPPORT //
-			{
-				// Support WPAPSK or WPA2PSK in STA-Infra mode
-				// Support WPANone in STA-Adhoc mode
-				if ((AuthMode != Ndis802_11AuthModeWPAPSK) &&
-					(AuthMode != Ndis802_11AuthModeWPA2PSK) &&
-					(AuthMode != Ndis802_11AuthModeWPANone)
-					)
-					return;
-			}
-
-			DBGPRINT(RT_DEBUG_TRACE,("==> RTMPMakeRSNIE(STA)\n"));
-
-			// Zero RSNIE context
-			pAd->StaCfg.RSNIE_Len = 0;
-			NdisZeroMemory(pAd->StaCfg.RSN_IE, MAX_LEN_OF_RSNIE);
-
-			// Pointer to RSNIE
-			rsnielen_cur_p = &pAd->StaCfg.RSNIE_Len;
-			pRsnIe = pAd->StaCfg.RSN_IE;
-
-			bMixCipher = pAd->StaCfg.bMixCipher;
-		}
-#endif // CONFIG_STA_SUPPORT //
-	}
-
-	// indicate primary RSNIE as WPA or WPA2
-	if ((AuthMode == Ndis802_11AuthModeWPA) ||
-		(AuthMode == Ndis802_11AuthModeWPAPSK) ||
-		(AuthMode == Ndis802_11AuthModeWPANone) ||
-		(AuthMode == Ndis802_11AuthModeWPA1WPA2) ||
-		(AuthMode == Ndis802_11AuthModeWPA1PSKWPA2PSK))
-		PrimaryRsnie = WpaIe;
-	else
-		PrimaryRsnie = Wpa2Ie;
-
-	{
-		// Build the primary RSNIE
-		// 1. insert cipher suite
-		RTMPMakeRsnIeCipher(pAd, PrimaryRsnie, WepStatus, bMixCipher, FlexibleCipher, pRsnIe, &p_offset);
-
-		// 2. insert AKM
-		RTMPMakeRsnIeAKM(pAd, PrimaryRsnie, AuthMode, apidx, pRsnIe, &p_offset);
-
-		// 3. insert capability
-		RTMPMakeRsnIeCap(pAd, PrimaryRsnie, apidx, pRsnIe, &p_offset);
-	}
-
-	// 4. update the RSNIE length
-	*rsnielen_cur_p = p_offset;
-
-	hex_dump("The primary RSNIE", pRsnIe, (*rsnielen_cur_p));
-
-
-}
-
-/*
-    ==========================================================================
-    Description:
-		Check whether the received frame is EAP frame.
-
-	Arguments:
-		pAd				-	pointer to our pAdapter context
-		pEntry			-	pointer to active entry
-		pData			-	the received frame
-		DataByteCount	-	the received frame's length
-		FromWhichBSSID	-	indicate the interface index
-
-    Return:
-         TRUE			-	This frame is EAP frame
-         FALSE			-	otherwise
-    ==========================================================================
-*/
-BOOLEAN RTMPCheckWPAframe(
-    IN PRTMP_ADAPTER    pAd,
-    IN PMAC_TABLE_ENTRY	pEntry,
-    IN PUCHAR           pData,
-    IN ULONG            DataByteCount,
-	IN UCHAR			FromWhichBSSID)
-{
-	ULONG	Body_len;
-	BOOLEAN Cancelled;
-
-
-    if(DataByteCount < (LENGTH_802_1_H + LENGTH_EAPOL_H))
-        return FALSE;
-
-
-	// Skip LLC header
-    if (NdisEqualMemory(SNAP_802_1H, pData, 6) ||
-        // Cisco 1200 AP may send packet with SNAP_BRIDGE_TUNNEL
-        NdisEqualMemory(SNAP_BRIDGE_TUNNEL, pData, 6))
-    {
-        pData += 6;
-    }
-	// Skip 2-bytes EAPoL type
-    if (NdisEqualMemory(EAPOL, pData, 2))
-//	if (*(UINT16 *)EAPOL == *(UINT16 *)pData)
-    {
-        pData += 2;
-    }
-    else
-        return FALSE;
-
-    switch (*(pData+1))
-    {
-        case EAPPacket:
-			Body_len = (*(pData+2)<<8) | (*(pData+3));
-            DBGPRINT(RT_DEBUG_TRACE, ("Receive EAP-Packet frame, TYPE = 0, Length = %ld\n", Body_len));
-            break;
-        case EAPOLStart:
-            DBGPRINT(RT_DEBUG_TRACE, ("Receive EAPOL-Start frame, TYPE = 1 \n"));
-			if (pEntry->EnqueueEapolStartTimerRunning != EAPOL_START_DISABLE)
-            {
-		DBGPRINT(RT_DEBUG_TRACE, ("Cancel the EnqueueEapolStartTimerRunning \n"));
-                RTMPCancelTimer(&pEntry->EnqueueStartForPSKTimer, &Cancelled);
-                pEntry->EnqueueEapolStartTimerRunning = EAPOL_START_DISABLE;
-            }
-            break;
-        case EAPOLLogoff:
-            DBGPRINT(RT_DEBUG_TRACE, ("Receive EAPOLLogoff frame, TYPE = 2 \n"));
-            break;
-        case EAPOLKey:
-			Body_len = (*(pData+2)<<8) | (*(pData+3));
-            DBGPRINT(RT_DEBUG_TRACE, ("Receive EAPOL-Key frame, TYPE = 3, Length = %ld\n", Body_len));
-            break;
-        case EAPOLASFAlert:
-            DBGPRINT(RT_DEBUG_TRACE, ("Receive EAPOLASFAlert frame, TYPE = 4 \n"));
-            break;
-        default:
-            return FALSE;
-
-    }
-    return TRUE;
-}
-
-/*
-    ==========================================================================
-    Description:
-		Report the EAP message type
-
-	Arguments:
-		msg		-	EAPOL_PAIR_MSG_1
-					EAPOL_PAIR_MSG_2
-					EAPOL_PAIR_MSG_3
-					EAPOL_PAIR_MSG_4
-					EAPOL_GROUP_MSG_1
-					EAPOL_GROUP_MSG_2
-
-    Return:
-         message type string
-
-    ==========================================================================
-*/
-PSTRING GetEapolMsgType(CHAR msg)
-{
-    if(msg == EAPOL_PAIR_MSG_1)
-        return "Pairwise Message 1";
-    else if(msg == EAPOL_PAIR_MSG_2)
-        return "Pairwise Message 2";
-	else if(msg == EAPOL_PAIR_MSG_3)
-        return "Pairwise Message 3";
-	else if(msg == EAPOL_PAIR_MSG_4)
-        return "Pairwise Message 4";
-	else if(msg == EAPOL_GROUP_MSG_1)
-        return "Group Message 1";
-	else if(msg == EAPOL_GROUP_MSG_2)
-        return "Group Message 2";
-    else
-	return "Invalid Message";
-}
-
-
-/*
-    ========================================================================
-
-    Routine Description:
-    Check Sanity RSN IE of EAPoL message
-
-    Arguments:
-
-    Return Value:
-
-
-    ========================================================================
-*/
-BOOLEAN RTMPCheckRSNIE(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PUCHAR          pData,
-	IN  UCHAR           DataLen,
-	IN  MAC_TABLE_ENTRY *pEntry,
-	OUT	UCHAR			*Offset)
-{
-	PUCHAR              pVIE;
-	UCHAR               len;
-	PEID_STRUCT         pEid;
-	BOOLEAN				result = FALSE;
-
-	pVIE = pData;
-	len	 = DataLen;
-	*Offset = 0;
-
-	while (len > sizeof(RSNIE2))
-	{
-		pEid = (PEID_STRUCT) pVIE;
-		// WPA RSN IE
-		if ((pEid->Eid == IE_WPA) && (NdisEqualMemory(pEid->Octet, WPA_OUI, 4)))
-		{
-			if ((pEntry->AuthMode == Ndis802_11AuthModeWPA || pEntry->AuthMode == Ndis802_11AuthModeWPAPSK) &&
-				(NdisEqualMemory(pVIE, pEntry->RSN_IE, pEntry->RSNIE_Len)) &&
-				(pEntry->RSNIE_Len == (pEid->Len + 2)))
-			{
-					result = TRUE;
-			}
-
-			*Offset += (pEid->Len + 2);
-		}
-		// WPA2 RSN IE
-		else if ((pEid->Eid == IE_RSN) && (NdisEqualMemory(pEid->Octet + 2, RSN_OUI, 3)))
-		{
-			if ((pEntry->AuthMode == Ndis802_11AuthModeWPA2 || pEntry->AuthMode == Ndis802_11AuthModeWPA2PSK) &&
-				(pEid->Eid == pEntry->RSN_IE[0]) &&
-				((pEid->Len + 2) >= pEntry->RSNIE_Len) &&
-				(NdisEqualMemory(pEid->Octet, &pEntry->RSN_IE[2], pEntry->RSNIE_Len - 2)))
-			{
-
-					result = TRUE;
-			}
-
-			*Offset += (pEid->Len + 2);
-		}
-		else
-		{
-			break;
-		}
-
-		pVIE += (pEid->Len + 2);
-		len  -= (pEid->Len + 2);
-	}
-
-
-	return result;
-
-}
-
-
-/*
-    ========================================================================
-
-    Routine Description:
-    Parse KEYDATA field.  KEYDATA[] May contain 2 RSN IE and optionally GTK.
-    GTK  is encaptulated in KDE format at  p.83 802.11i D10
-
-    Arguments:
-
-    Return Value:
-
-    Note:
-        802.11i D10
-
-    ========================================================================
-*/
-BOOLEAN RTMPParseEapolKeyData(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PUCHAR          pKeyData,
-	IN  UCHAR           KeyDataLen,
-	IN	UCHAR			GroupKeyIndex,
-	IN	UCHAR			MsgType,
-	IN	BOOLEAN			bWPA2,
-	IN  MAC_TABLE_ENTRY *pEntry)
-{
-    PKDE_ENCAP          pKDE = NULL;
-    PUCHAR              pMyKeyData = pKeyData;
-    UCHAR               KeyDataLength = KeyDataLen;
-    UCHAR               GTKLEN = 0;
-	UCHAR				DefaultIdx = 0;
-	UCHAR				skip_offset;
-
-	// Verify The RSN IE contained in pairewise_msg_2 && pairewise_msg_3 and skip it
-	if (MsgType == EAPOL_PAIR_MSG_2 || MsgType == EAPOL_PAIR_MSG_3)
-    {
-		// Check RSN IE whether it is WPA2/WPA2PSK
-		if (!RTMPCheckRSNIE(pAd, pKeyData, KeyDataLen, pEntry, &skip_offset))
-		{
-			// send wireless event - for RSN IE different
-			if (pAd->CommonCfg.bWirelessEvent)
-				RTMPSendWirelessEvent(pAd, IW_RSNIE_DIFF_EVENT_FLAG, pEntry->Addr, pEntry->apidx, 0);
-
-		DBGPRINT(RT_DEBUG_ERROR, ("RSN_IE Different in msg %d of 4-way handshake!\n", MsgType));
-			hex_dump("Receive RSN_IE ", pKeyData, KeyDataLen);
-			hex_dump("Desired RSN_IE ", pEntry->RSN_IE, pEntry->RSNIE_Len);
-
-			return FALSE;
-	}
-	else
-		{
-			if (bWPA2 && MsgType == EAPOL_PAIR_MSG_3)
-			{
-				WpaShowAllsuite(pMyKeyData, skip_offset);
-
-				// skip RSN IE
-				pMyKeyData += skip_offset;
-				KeyDataLength -= skip_offset;
-				DBGPRINT(RT_DEBUG_TRACE, ("RTMPParseEapolKeyData ==> WPA2/WPA2PSK RSN IE matched in Msg 3, Length(%d) \n", skip_offset));
-			}
-			else
-				return TRUE;
-		}
-	}
-
-	DBGPRINT(RT_DEBUG_TRACE,("RTMPParseEapolKeyData ==> KeyDataLength %d without RSN_IE \n", KeyDataLength));
-	//hex_dump("remain data", pMyKeyData, KeyDataLength);
-
-
-	// Parse EKD format in pairwise_msg_3_WPA2 && group_msg_1_WPA2
-	if (bWPA2 && (MsgType == EAPOL_PAIR_MSG_3 || MsgType == EAPOL_GROUP_MSG_1))
-	{
-		if (KeyDataLength >= 8)	// KDE format exclude GTK length
-	{
-		pKDE = (PKDE_ENCAP) pMyKeyData;
-
-
-			DefaultIdx = pKDE->GTKEncap.Kid;
-
-			// Sanity check - KED length
-			if (KeyDataLength < (pKDE->Len + 2))
-		{
-			DBGPRINT(RT_DEBUG_ERROR, ("ERROR: The len from KDE is too short \n"));
-			return FALSE;
-		}
-
-			// Get GTK length - refer to IEEE 802.11i-2004 p.82
-			GTKLEN = pKDE->Len -6;
-			if (GTKLEN < LEN_AES_KEY)
-			{
-				DBGPRINT(RT_DEBUG_ERROR, ("ERROR: GTK Key length is too short (%d) \n", GTKLEN));
-			return FALSE;
-			}
-
-	}
-		else
-	{
-			DBGPRINT(RT_DEBUG_ERROR, ("ERROR: KDE format length is too short \n"));
-	        return FALSE;
-	}
-
-		DBGPRINT(RT_DEBUG_TRACE, ("GTK in KDE format ,DefaultKeyID=%d, KeyLen=%d \n", DefaultIdx, GTKLEN));
-		// skip it
-		pMyKeyData += 8;
-		KeyDataLength -= 8;
-
-	}
-	else if (!bWPA2 && MsgType == EAPOL_GROUP_MSG_1)
-	{
-		DefaultIdx = GroupKeyIndex;
-		DBGPRINT(RT_DEBUG_TRACE, ("GTK DefaultKeyID=%d \n", DefaultIdx));
-	}
-
-	// Sanity check - shared key index must be 1 ~ 3
-	if (DefaultIdx < 1 || DefaultIdx > 3)
-    {
-	DBGPRINT(RT_DEBUG_ERROR, ("ERROR: GTK Key index(%d) is invalid in %s %s \n", DefaultIdx, ((bWPA2) ? "WPA2" : "WPA"), GetEapolMsgType(MsgType)));
-        return FALSE;
-    }
-
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-		PCIPHER_KEY pSharedKey;
-
-		// set key material, TxMic and RxMic
-		NdisMoveMemory(pAd->StaCfg.GTK, pMyKeyData, 32);
-		pAd->StaCfg.DefaultKeyId = DefaultIdx;
-
-		pSharedKey = &pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId];
-
-		// Prepare pair-wise key information into shared key table
-		NdisZeroMemory(pSharedKey, sizeof(CIPHER_KEY));
-		pSharedKey->KeyLen = LEN_TKIP_EK;
-		NdisMoveMemory(pSharedKey->Key, pAd->StaCfg.GTK, LEN_TKIP_EK);
-		NdisMoveMemory(pSharedKey->RxMic, &pAd->StaCfg.GTK[16], LEN_TKIP_RXMICK);
-		NdisMoveMemory(pSharedKey->TxMic, &pAd->StaCfg.GTK[24], LEN_TKIP_TXMICK);
-
-		// Update Shared Key CipherAlg
-		pSharedKey->CipherAlg = CIPHER_NONE;
-		if (pAd->StaCfg.GroupCipher == Ndis802_11Encryption2Enabled)
-			pSharedKey->CipherAlg = CIPHER_TKIP;
-		else if (pAd->StaCfg.GroupCipher == Ndis802_11Encryption3Enabled)
-			pSharedKey->CipherAlg = CIPHER_AES;
-		else if (pAd->StaCfg.GroupCipher == Ndis802_11GroupWEP40Enabled)
-			pSharedKey->CipherAlg = CIPHER_WEP64;
-		else if (pAd->StaCfg.GroupCipher == Ndis802_11GroupWEP104Enabled)
-			pSharedKey->CipherAlg = CIPHER_WEP128;
-
-
-		// Update group key information to ASIC Shared Key Table
-		AsicAddSharedKeyEntry(pAd,
-							  BSS0,
-							  pAd->StaCfg.DefaultKeyId,
-							  pSharedKey->CipherAlg,
-							  pSharedKey->Key,
-							  pSharedKey->TxMic,
-							  pSharedKey->RxMic);
-
-		// Update ASIC WCID attribute table and IVEIV table
-		RTMPAddWcidAttributeEntry(pAd,
-								  BSS0,
-								  pAd->StaCfg.DefaultKeyId,
-								  pSharedKey->CipherAlg,
-								  NULL);
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-	return TRUE;
-
-}
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		Construct EAPoL message for WPA handshaking
-		Its format is below,
-
-		+--------------------+
-		| Protocol Version	 |  1 octet
-		+--------------------+
-		| Protocol Type		 |	1 octet
-		+--------------------+
-		| Body Length		 |  2 octets
-		+--------------------+
-		| Descriptor Type	 |	1 octet
-		+--------------------+
-		| Key Information    |	2 octets
-		+--------------------+
-		| Key Length	     |  1 octet
-		+--------------------+
-		| Key Repaly Counter |	8 octets
-		+--------------------+
-		| Key Nonce		     |  32 octets
-		+--------------------+
-		| Key IV			 |  16 octets
-		+--------------------+
-		| Key RSC			 |  8 octets
-		+--------------------+
-		| Key ID or Reserved |	8 octets
-		+--------------------+
-		| Key MIC			 |	16 octets
-		+--------------------+
-		| Key Data Length	 |	2 octets
-		+--------------------+
-		| Key Data			 |	n octets
-		+--------------------+
-
-
-	Arguments:
-		pAd			Pointer	to our adapter
-
-	Return Value:
-		None
-
-	Note:
-
-	========================================================================
-*/
-VOID	ConstructEapolMsg(
-	IN	PMAC_TABLE_ENTRY	pEntry,
-    IN	UCHAR				GroupKeyWepStatus,
-    IN	UCHAR				MsgType,
-    IN	UCHAR				DefaultKeyIdx,
-	IN	UCHAR				*KeyNonce,
-	IN	UCHAR				*TxRSC,
-	IN	UCHAR				*GTK,
-	IN	UCHAR				*RSNIE,
-	IN	UCHAR				RSNIE_Len,
-    OUT PEAPOL_PACKET       pMsg)
-{
-	BOOLEAN	bWPA2 = FALSE;
-	UCHAR	KeyDescVer;
-
-	// Choose WPA2 or not
-	if ((pEntry->AuthMode == Ndis802_11AuthModeWPA2) ||
-		(pEntry->AuthMode == Ndis802_11AuthModeWPA2PSK))
-		bWPA2 = TRUE;
-
-    // Init Packet and Fill header
-    pMsg->ProVer = EAPOL_VER;
-    pMsg->ProType = EAPOLKey;
-
-	// Default 95 bytes, the EAPoL-Key descriptor exclude Key-data field
-	SET_UINT16_TO_ARRARY(pMsg->Body_Len, LEN_EAPOL_KEY_MSG);
-
-	// Fill in EAPoL descriptor
-	if (bWPA2)
-		pMsg->KeyDesc.Type = WPA2_KEY_DESC;
-	else
-		pMsg->KeyDesc.Type = WPA1_KEY_DESC;
-
-	// Key Descriptor Version (bits 0-2) specifies the key descriptor version type
-	{
-		// Fill in Key information, refer to IEEE Std 802.11i-2004 page 78
-		// When either the pairwise or the group cipher is AES, the DESC_TYPE_AES(2) shall be used.
-		KeyDescVer = (((pEntry->WepStatus == Ndis802_11Encryption3Enabled) ||
-					(GroupKeyWepStatus == Ndis802_11Encryption3Enabled)) ? (DESC_TYPE_AES) : (DESC_TYPE_TKIP));
-	}
-
-	pMsg->KeyDesc.KeyInfo.KeyDescVer = KeyDescVer;
-
-	// Specify Key Type as Group(0) or Pairwise(1)
-	if (MsgType >= EAPOL_GROUP_MSG_1)
-		pMsg->KeyDesc.KeyInfo.KeyType = GROUPKEY;
-	else
-		pMsg->KeyDesc.KeyInfo.KeyType = PAIRWISEKEY;
-
-	// Specify Key Index, only group_msg1_WPA1
-	if (!bWPA2 && (MsgType >= EAPOL_GROUP_MSG_1))
-		pMsg->KeyDesc.KeyInfo.KeyIndex = DefaultKeyIdx;
-
-	if (MsgType == EAPOL_PAIR_MSG_3)
-		pMsg->KeyDesc.KeyInfo.Install = 1;
-
-	if ((MsgType == EAPOL_PAIR_MSG_1) || (MsgType == EAPOL_PAIR_MSG_3) || (MsgType == EAPOL_GROUP_MSG_1))
-		pMsg->KeyDesc.KeyInfo.KeyAck = 1;
-
-	if (MsgType != EAPOL_PAIR_MSG_1)
-		pMsg->KeyDesc.KeyInfo.KeyMic = 1;
-
-	if ((bWPA2 && (MsgType >= EAPOL_PAIR_MSG_3)) ||
-		(!bWPA2 && (MsgType >= EAPOL_GROUP_MSG_1)))
-    {
-	pMsg->KeyDesc.KeyInfo.Secure = 1;
-    }
-
-	if (bWPA2 && ((MsgType == EAPOL_PAIR_MSG_3) ||
-		(MsgType == EAPOL_GROUP_MSG_1)))
-    {
-        pMsg->KeyDesc.KeyInfo.EKD_DL = 1;
-    }
-
-	// key Information element has done.
-	*(USHORT *)(&pMsg->KeyDesc.KeyInfo) = cpu2le16(*(USHORT *)(&pMsg->KeyDesc.KeyInfo));
-
-	// Fill in Key Length
-	{
-		if (MsgType >= EAPOL_GROUP_MSG_1)
-		{
-			// the length of group key cipher
-			pMsg->KeyDesc.KeyLength[1] = ((GroupKeyWepStatus == Ndis802_11Encryption2Enabled) ? TKIP_GTK_LENGTH : LEN_AES_KEY);
-		}
-		else
-		{
-			// the length of pairwise key cipher
-			pMsg->KeyDesc.KeyLength[1] = ((pEntry->WepStatus == Ndis802_11Encryption2Enabled) ? LEN_TKIP_KEY : LEN_AES_KEY);
-		}
-	}
-
-	// Fill in replay counter
-    NdisMoveMemory(pMsg->KeyDesc.ReplayCounter, pEntry->R_Counter, LEN_KEY_DESC_REPLAY);
-
-	// Fill Key Nonce field
-	// ANonce : pairwise_msg1 & pairwise_msg3
-	// SNonce : pairwise_msg2
-	// GNonce : group_msg1_wpa1
-	if ((MsgType <= EAPOL_PAIR_MSG_3) || ((!bWPA2 && (MsgType == EAPOL_GROUP_MSG_1))))
-	NdisMoveMemory(pMsg->KeyDesc.KeyNonce, KeyNonce, LEN_KEY_DESC_NONCE);
-
-	// Fill key IV - WPA2 as 0, WPA1 as random
-	if (!bWPA2 && (MsgType == EAPOL_GROUP_MSG_1))
-	{
-		// Suggest IV be random number plus some number,
-		NdisMoveMemory(pMsg->KeyDesc.KeyIv, &KeyNonce[16], LEN_KEY_DESC_IV);
-        pMsg->KeyDesc.KeyIv[15] += 2;
-	}
-
-    // Fill Key RSC field
-    // It contains the RSC for the GTK being installed.
-	if ((MsgType == EAPOL_PAIR_MSG_3 && bWPA2) || (MsgType == EAPOL_GROUP_MSG_1))
-	{
-        NdisMoveMemory(pMsg->KeyDesc.KeyRsc, TxRSC, 6);
-	}
-
-	// Clear Key MIC field for MIC calculation later
-    NdisZeroMemory(pMsg->KeyDesc.KeyMic, LEN_KEY_DESC_MIC);
-
-	ConstructEapolKeyData(pEntry,
-						  GroupKeyWepStatus,
-						  KeyDescVer,
-						  MsgType,
-						  DefaultKeyIdx,
-						  GTK,
-						  RSNIE,
-						  RSNIE_Len,
-						  pMsg);
-
-	// Calculate MIC and fill in KeyMic Field except Pairwise Msg 1.
-	if (MsgType != EAPOL_PAIR_MSG_1)
-	{
-		CalculateMIC(KeyDescVer, pEntry->PTK, pMsg);
-	}
-
-	DBGPRINT(RT_DEBUG_TRACE, ("===> ConstructEapolMsg for %s %s\n", ((bWPA2) ? "WPA2" : "WPA"), GetEapolMsgType(MsgType)));
-	DBGPRINT(RT_DEBUG_TRACE, ("	     Body length = %d \n", CONV_ARRARY_TO_UINT16(pMsg->Body_Len)));
-	DBGPRINT(RT_DEBUG_TRACE, ("	     Key length  = %d \n", CONV_ARRARY_TO_UINT16(pMsg->KeyDesc.KeyLength)));
-
-
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-		Construct the Key Data field of EAPoL message
-
-	Arguments:
-		pAd			Pointer	to our adapter
-		Elem		Message body
-
-	Return Value:
-		None
-
-	Note:
-
-	========================================================================
-*/
-VOID	ConstructEapolKeyData(
-	IN	PMAC_TABLE_ENTRY	pEntry,
-	IN	UCHAR			GroupKeyWepStatus,
-	IN	UCHAR			keyDescVer,
-	IN	UCHAR			MsgType,
-	IN	UCHAR			DefaultKeyIdx,
-	IN	UCHAR			*GTK,
-	IN	UCHAR			*RSNIE,
-	IN	UCHAR			RSNIE_LEN,
-	OUT PEAPOL_PACKET   pMsg)
-{
-	UCHAR		*mpool, *Key_Data, *Rc4GTK;
-	UCHAR       ekey[(LEN_KEY_DESC_IV+LEN_EAP_EK)];
-	ULONG		data_offset;
-	BOOLEAN		bWPA2Capable = FALSE;
-	PRTMP_ADAPTER	pAd = pEntry->pAd;
-	BOOLEAN		GTK_Included = FALSE;
-
-	// Choose WPA2 or not
-	if ((pEntry->AuthMode == Ndis802_11AuthModeWPA2) ||
-		(pEntry->AuthMode == Ndis802_11AuthModeWPA2PSK))
-		bWPA2Capable = TRUE;
-
-	if (MsgType == EAPOL_PAIR_MSG_1 ||
-		MsgType == EAPOL_PAIR_MSG_4 ||
-		MsgType == EAPOL_GROUP_MSG_2)
-		return;
-
-	// allocate memory pool
-	os_alloc_mem(NULL, (PUCHAR *)&mpool, 1500);
-
-    if (mpool == NULL)
-		return;
-
-	/* Rc4GTK Len = 512 */
-	Rc4GTK = (UCHAR *) ROUND_UP(mpool, 4);
-	/* Key_Data Len = 512 */
-	Key_Data = (UCHAR *) ROUND_UP(Rc4GTK + 512, 4);
-
-	NdisZeroMemory(Key_Data, 512);
-	SET_UINT16_TO_ARRARY(pMsg->KeyDesc.KeyDataLen, 0);
-	data_offset = 0;
-
-	// Encapsulate RSNIE in pairwise_msg2 & pairwise_msg3
-	if (RSNIE_LEN && ((MsgType == EAPOL_PAIR_MSG_2) || (MsgType == EAPOL_PAIR_MSG_3)))
-	{
-		PUINT8	pmkid_ptr = NULL;
-		UINT8	pmkid_len = 0;
-
-
-		RTMPInsertRSNIE(&Key_Data[data_offset],
-						(PULONG)&data_offset,
-						RSNIE,
-						RSNIE_LEN,
-						pmkid_ptr,
-						pmkid_len);
-	}
-
-
-	// Encapsulate KDE format in pairwise_msg3_WPA2 & group_msg1_WPA2
-	if (bWPA2Capable && ((MsgType == EAPOL_PAIR_MSG_3) || (MsgType == EAPOL_GROUP_MSG_1)))
-	{
-		// Key Data Encapsulation (KDE) format - 802.11i-2004  Figure-43w and Table-20h
-        Key_Data[data_offset + 0] = 0xDD;
-
-		if (GroupKeyWepStatus == Ndis802_11Encryption3Enabled)
-		{
-			Key_Data[data_offset + 1] = 0x16;// 4+2+16(OUI+DataType+DataField)
-		}
-		else
-		{
-			Key_Data[data_offset + 1] = 0x26;// 4+2+32(OUI+DataType+DataField)
-		}
-
-        Key_Data[data_offset + 2] = 0x00;
-        Key_Data[data_offset + 3] = 0x0F;
-        Key_Data[data_offset + 4] = 0xAC;
-        Key_Data[data_offset + 5] = 0x01;
-
-		// GTK KDE format - 802.11i-2004  Figure-43x
-        Key_Data[data_offset + 6] = (DefaultKeyIdx & 0x03);
-        Key_Data[data_offset + 7] = 0x00;	// Reserved Byte
-
-		data_offset += 8;
-	}
-
-
-	// Encapsulate GTK
-	// Only for pairwise_msg3_WPA2 and group_msg1
-	if ((MsgType == EAPOL_PAIR_MSG_3 && bWPA2Capable) || (MsgType == EAPOL_GROUP_MSG_1))
-	{
-		// Fill in GTK
-		if (GroupKeyWepStatus == Ndis802_11Encryption3Enabled)
-		{
-			NdisMoveMemory(&Key_Data[data_offset], GTK, LEN_AES_KEY);
-			data_offset += LEN_AES_KEY;
-		}
-		else
-		{
-			NdisMoveMemory(&Key_Data[data_offset], GTK, TKIP_GTK_LENGTH);
-			data_offset += TKIP_GTK_LENGTH;
-		}
-
-		GTK_Included = TRUE;
-	}
-
-
-	// This whole key-data field shall be encrypted if a GTK is included.
-	// Encrypt the data material in key data field with KEK
-	if (GTK_Included)
-	{
-		//hex_dump("GTK_Included", Key_Data, data_offset);
-
-		if (
-			(keyDescVer == DESC_TYPE_AES))
-		{
-			UCHAR	remainder = 0;
-			UCHAR	pad_len = 0;
-
-			// Key Descriptor Version 2 or 3: AES key wrap, defined in IETF RFC 3394,
-			// shall be used to encrypt the Key Data field using the KEK field from
-			// the derived PTK.
-
-			// If the Key Data field uses the NIST AES key wrap, then the Key Data field
-			// shall be padded before encrypting if the key data length is less than 16
-			// octets or if it is not a multiple of 8. The padding consists of appending
-			// a single octet 0xdd followed by zero or more 0x00 octets.
-			if ((remainder = data_offset & 0x07) != 0)
-			{
-				INT		i;
-
-				pad_len = (8 - remainder);
-				Key_Data[data_offset] = 0xDD;
-				for (i = 1; i < pad_len; i++)
-					Key_Data[data_offset + i] = 0;
-
-				data_offset += pad_len;
-			}
-
-			AES_GTK_KEY_WRAP(&pEntry->PTK[16], Key_Data, data_offset, Rc4GTK);
-            // AES wrap function will grow 8 bytes in length
-            data_offset += 8;
-		}
-		else
-		{
-			/*	Key Descriptor Version 1: ARC4 is used to encrypt the Key Data field
-				using the KEK field from the derived PTK. */
-
-			// PREPARE Encrypted  "Key DATA" field.  (Encrypt GTK with RC4, usinf PTK[16]->[31] as Key, IV-field as IV)
-			// put TxTsc in Key RSC field
-			pAd->PrivateInfo.FCSCRC32 = PPPINITFCS32;   //Init crc32.
-
-			// ekey is the contanetion of IV-field, and PTK[16]->PTK[31]
-			NdisMoveMemory(ekey, pMsg->KeyDesc.KeyIv, LEN_KEY_DESC_IV);
-			NdisMoveMemory(&ekey[LEN_KEY_DESC_IV], &pEntry->PTK[16], LEN_EAP_EK);
-			ARCFOUR_INIT(&pAd->PrivateInfo.WEPCONTEXT, ekey, sizeof(ekey));  //INIT SBOX, KEYLEN+3(IV)
-			pAd->PrivateInfo.FCSCRC32 = RTMP_CALC_FCS32(pAd->PrivateInfo.FCSCRC32, Key_Data, data_offset);
-			WPAARCFOUR_ENCRYPT(&pAd->PrivateInfo.WEPCONTEXT, Rc4GTK, Key_Data, data_offset);
-		}
-
-		NdisMoveMemory(pMsg->KeyDesc.KeyData, Rc4GTK, data_offset);
-	}
-	else
-	{
-		NdisMoveMemory(pMsg->KeyDesc.KeyData, Key_Data, data_offset);
-	}
-
-	// Update key data length field and total body length
-	SET_UINT16_TO_ARRARY(pMsg->KeyDesc.KeyDataLen, data_offset);
-	INC_UINT16_TO_ARRARY(pMsg->Body_Len, data_offset);
-
-	os_free_mem(NULL, mpool);
-
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-		Calcaulate MIC. It is used during 4-ways handsharking.
-
-	Arguments:
-		pAd				-	pointer to our pAdapter context
-	PeerWepStatus	-	indicate the encryption type
-
-	Return Value:
-
-	Note:
-
-	========================================================================
-*/
-static VOID	CalculateMIC(
-	IN	UCHAR			KeyDescVer,
-	IN	UCHAR			*PTK,
-	OUT PEAPOL_PACKET   pMsg)
-{
-    UCHAR   *OutBuffer;
-	ULONG	FrameLen = 0;
-	UCHAR	mic[LEN_KEY_DESC_MIC];
-	UCHAR	digest[80];
-
-	// allocate memory for MIC calculation
-	os_alloc_mem(NULL, (PUCHAR *)&OutBuffer, 512);
-
-    if (OutBuffer == NULL)
-    {
-		DBGPRINT(RT_DEBUG_ERROR, ("!!!CalculateMIC: no memory!!!\n"));
-		return;
-    }
-
-	// make a frame for calculating MIC.
-    MakeOutgoingFrame(OutBuffer,		&FrameLen,
-                      CONV_ARRARY_TO_UINT16(pMsg->Body_Len) + 4,	pMsg,
-                      END_OF_ARGS);
-
-	NdisZeroMemory(mic, sizeof(mic));
-
-	// Calculate MIC
-    if (KeyDescVer == DESC_TYPE_AES)
-	{
-		HMAC_SHA1(PTK, LEN_EAP_MICK, OutBuffer,  FrameLen, digest, SHA1_DIGEST_SIZE);
-		NdisMoveMemory(mic, digest, LEN_KEY_DESC_MIC);
-	}
-	else
-	{
-		HMAC_MD5(PTK,  LEN_EAP_MICK, OutBuffer, FrameLen, mic, MD5_DIGEST_SIZE);
-	}
-
-	// store the calculated MIC
-	NdisMoveMemory(pMsg->KeyDesc.KeyMic, mic, LEN_KEY_DESC_MIC);
-
-	os_free_mem(NULL, OutBuffer);
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-		Some received frames can't decrypt by Asic, so decrypt them by software.
-
-	Arguments:
-		pAd				-	pointer to our pAdapter context
-	PeerWepStatus	-	indicate the encryption type
-
-	Return Value:
-		NDIS_STATUS_SUCCESS		-	decryption successful
-		NDIS_STATUS_FAILURE		-	decryption failure
-
-	========================================================================
-*/
-NDIS_STATUS	RTMPSoftDecryptBroadCastData(
-	IN	PRTMP_ADAPTER					pAd,
-	IN	RX_BLK							*pRxBlk,
-	IN  NDIS_802_11_ENCRYPTION_STATUS	GroupCipher,
-	IN  PCIPHER_KEY						pShard_key)
-{
-	PRXWI_STRUC			pRxWI = pRxBlk->pRxWI;
-
-
-
-	// handle WEP decryption
-	if (GroupCipher == Ndis802_11Encryption1Enabled)
-    {
-		if (RTMPSoftDecryptWEP(pAd, pRxBlk->pData, pRxWI->MPDUtotalByteCount, pShard_key))
-		{
-
-			//Minus IV[4] & ICV[4]
-			pRxWI->MPDUtotalByteCount -= 8;
-		}
-		else
-		{
-			DBGPRINT(RT_DEBUG_ERROR, ("ERROR : Software decrypt WEP data fails.\n"));
-			// give up this frame
-			return NDIS_STATUS_FAILURE;
-		}
-	}
-	// handle TKIP decryption
-	else if (GroupCipher == Ndis802_11Encryption2Enabled)
-	{
-		if (RTMPSoftDecryptTKIP(pAd, pRxBlk->pData, pRxWI->MPDUtotalByteCount, 0, pShard_key))
-		{
-
-			//Minus 8 bytes MIC, 8 bytes IV/EIV, 4 bytes ICV
-			pRxWI->MPDUtotalByteCount -= 20;
-		}
-        else
-		{
-			DBGPRINT(RT_DEBUG_ERROR, ("ERROR : RTMPSoftDecryptTKIP Failed\n"));
-			// give up this frame
-			return NDIS_STATUS_FAILURE;
-        }
-	}
-	// handle AES decryption
-	else if (GroupCipher == Ndis802_11Encryption3Enabled)
-	{
-		if (RTMPSoftDecryptAES(pAd, pRxBlk->pData, pRxWI->MPDUtotalByteCount , pShard_key))
-		{
-
-			//8 bytes MIC, 8 bytes IV/EIV (CCMP Header)
-			pRxWI->MPDUtotalByteCount -= 16;
-		}
-		else
-		{
-			DBGPRINT(RT_DEBUG_ERROR, ("ERROR : RTMPSoftDecryptAES Failed\n"));
-			// give up this frame
-			return NDIS_STATUS_FAILURE;
-		}
-	}
-	else
-	{
-		// give up this frame
-		return NDIS_STATUS_FAILURE;
-	}
-
-	return NDIS_STATUS_SUCCESS;
-
-}
-
-
-PUINT8	GetSuiteFromRSNIE(
-		IN	PUINT8	rsnie,
-		IN	UINT	rsnie_len,
-		IN	UINT8	type,
-		OUT	UINT8	*count)
-{
-	PEID_STRUCT pEid;
-	INT			len;
-	PUINT8		pBuf;
-	INT			offset = 0;
-	PRSNIE_AUTH	pAkm;
-	UINT16		acount;
-	BOOLEAN		isWPA2 = FALSE;
-
-	pEid = (PEID_STRUCT)rsnie;
-	len = rsnie_len - 2;	// exclude IE and length
-	pBuf = (PUINT8)&pEid->Octet[0];
-
-
-
-	// set default value
-	*count = 0;
-
-	// Check length
-	if ((len <= 0) || (pEid->Len != len))
-	{
-		DBGPRINT_ERR(("%s : The length is invalid\n", __FUNCTION__));
-		return NULL;
-	}
-
-	// Check WPA or WPA2
-	if (pEid->Eid == IE_WPA)
-	{
-		PRSNIE	pRsnie = (PRSNIE)pBuf;
-		UINT16 ucount;
-
-		if (len < sizeof(RSNIE))
-		{
-			DBGPRINT_ERR(("%s : The length is too short for WPA\n", __FUNCTION__));
-			return NULL;
-		}
-
-		// Get the count of pairwise cipher
-		ucount = cpu2le16(pRsnie->ucount);
-		if (ucount > 2)
-		{
-			DBGPRINT_ERR(("%s : The count(%d) of pairwise cipher is invlaid\n",
-											__FUNCTION__, ucount));
-			return NULL;
-		}
-
-		// Get the group cipher
-		if (type == GROUP_SUITE)
-		{
-			*count = 1;
-			return pRsnie->mcast;
-		}
-		// Get the pairwise cipher suite
-		else if (type == PAIRWISE_SUITE)
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("%s : The count of pairwise cipher is %d\n",
-										__FUNCTION__, ucount));
-			*count = ucount;
-			return pRsnie->ucast[0].oui;
-		}
-
-		offset = sizeof(RSNIE) + (4 * (ucount - 1));
-
-	}
-	else if (pEid->Eid == IE_RSN)
-	{
-		PRSNIE2	pRsnie = (PRSNIE2)pBuf;
-		UINT16 ucount;
-
-		isWPA2 = TRUE;
-
-		if (len < sizeof(RSNIE2))
-		{
-			DBGPRINT_ERR(("%s : The length is too short for WPA2\n", __FUNCTION__));
-			return NULL;
-		}
-
-		// Get the count of pairwise cipher
-		ucount = cpu2le16(pRsnie->ucount);
-		if (ucount > 2)
-		{
-			DBGPRINT_ERR(("%s : The count(%d) of pairwise cipher is invlaid\n",
-											__FUNCTION__, ucount));
-			return NULL;
-		}
-
-		// Get the group cipher
-		if (type == GROUP_SUITE)
-		{
-			*count = 1;
-			return pRsnie->mcast;
-		}
-		// Get the pairwise cipher suite
-		else if (type == PAIRWISE_SUITE)
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("%s : The count of pairwise cipher is %d\n",
-										__FUNCTION__, ucount));
-			*count = ucount;
-			return pRsnie->ucast[0].oui;
-		}
-
-		offset = sizeof(RSNIE2) + (4 * (ucount - 1));
-
-	}
-	else
-	{
-		DBGPRINT_ERR(("%s : Unknown IE (%d)\n", __FUNCTION__, pEid->Eid));
-		return NULL;
-	}
-
-	// skip group cipher and pairwise cipher suite
-	pBuf += offset;
-	len -= offset;
-
-	if (len < sizeof(RSNIE_AUTH))
-	{
-		DBGPRINT_ERR(("%s : The length of RSNIE is too short\n", __FUNCTION__));
-		return NULL;
-	}
-
-	// pointer to AKM count
-	pAkm = (PRSNIE_AUTH)pBuf;
-
-	// Get the count of pairwise cipher
-	acount = cpu2le16(pAkm->acount);
-	if (acount > 2)
-	{
-		DBGPRINT_ERR(("%s : The count(%d) of AKM is invlaid\n",
-										__FUNCTION__, acount));
-		return NULL;
-	}
-
-	// Get the AKM suite
-	if (type == AKM_SUITE)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("%s : The count of AKM is %d\n",
-									__FUNCTION__, acount));
-		*count = acount;
-		return pAkm->auth[0].oui;
-	}
-	offset = sizeof(RSNIE_AUTH) + (4 * (acount - 1));
-
-	pBuf += offset;
-	len -= offset;
-
-	// The remaining length must larger than (RSN-Capability(2) + PMKID-Count(2) + PMKID(16~))
-	if (len >= (sizeof(RSN_CAPABILITIES) + 2 + LEN_PMKID))
-	{
-		// Skip RSN capability and PMKID-Count
-		pBuf += (sizeof(RSN_CAPABILITIES) + 2);
-		len -= (sizeof(RSN_CAPABILITIES) + 2);
-
-		// Get PMKID
-		if (type == PMKID_LIST)
-		{
-			*count = 1;
-			return pBuf;
-		}
-	}
-	else
-	{
-		DBGPRINT_ERR(("%s : it can't get any more information beyond AKM \n", __FUNCTION__));
-		return NULL;
-	}
-
-	*count = 0;
-	//DBGPRINT_ERR(("%s : The type(%d) doesn't support \n", __FUNCTION__, type));
-	return NULL;
-
-}
-
-VOID WpaShowAllsuite(
-	IN	PUINT8	rsnie,
-	IN	UINT	rsnie_len)
-{
-	PUINT8 pSuite = NULL;
-	UINT8 count;
-
-	hex_dump("RSNIE", rsnie, rsnie_len);
-
-	// group cipher
-	if ((pSuite = GetSuiteFromRSNIE(rsnie, rsnie_len, GROUP_SUITE, &count)) != NULL)
-	{
-		hex_dump("group cipher", pSuite, 4*count);
-	}
-
-	// pairwise cipher
-	if ((pSuite = GetSuiteFromRSNIE(rsnie, rsnie_len, PAIRWISE_SUITE, &count)) != NULL)
-	{
-		hex_dump("pairwise cipher", pSuite, 4*count);
-	}
-
-	// AKM
-	if ((pSuite = GetSuiteFromRSNIE(rsnie, rsnie_len, AKM_SUITE, &count)) != NULL)
-	{
-		hex_dump("AKM suite", pSuite, 4*count);
-	}
-
-	// PMKID
-	if ((pSuite = GetSuiteFromRSNIE(rsnie, rsnie_len, PMKID_LIST, &count)) != NULL)
-	{
-		hex_dump("PMKID", pSuite, LEN_PMKID);
-	}
-
-}
-
-VOID RTMPInsertRSNIE(
-	IN PUCHAR pFrameBuf,
-	OUT PULONG pFrameLen,
-	IN PUINT8 rsnie_ptr,
-	IN UINT8  rsnie_len,
-	IN PUINT8 pmkid_ptr,
-	IN UINT8  pmkid_len)
-{
-	PUCHAR	pTmpBuf;
-	ULONG	TempLen = 0;
-	UINT8	extra_len = 0;
-	UINT16	pmk_count = 0;
-	UCHAR	ie_num;
-	UINT8	total_len = 0;
-    UCHAR	WPA2_OUI[3]={0x00,0x0F,0xAC};
-
-	pTmpBuf = pFrameBuf;
-
-	/* PMKID-List Must larger than 0 and the multiple of 16. */
-	if (pmkid_len > 0 && ((pmkid_len & 0x0f) == 0))
-	{
-		extra_len = sizeof(UINT16) + pmkid_len;
-
-		pmk_count = (pmkid_len >> 4);
-		pmk_count = cpu2le16(pmk_count);
-	}
-	else
-	{
-		DBGPRINT(RT_DEBUG_WARN, ("%s : The length is PMKID-List is invalid (%d), so don't insert it.\n",
-									__FUNCTION__, pmkid_len));
-	}
-
-	if (rsnie_len != 0)
-	{
-		ie_num = IE_WPA;
-		total_len = rsnie_len;
-
-		if (NdisEqualMemory(rsnie_ptr + 2, WPA2_OUI, sizeof(WPA2_OUI)))
-		{
-			ie_num = IE_RSN;
-			total_len += extra_len;
-		}
-
-		/* construct RSNIE body */
-		MakeOutgoingFrame(pTmpBuf,			&TempLen,
-						  1,				&ie_num,
-						  1,				&total_len,
-						  rsnie_len,		rsnie_ptr,
-						  END_OF_ARGS);
-
-		pTmpBuf += TempLen;
-		*pFrameLen = *pFrameLen + TempLen;
-
-		if (ie_num == IE_RSN)
-		{
-			/* Insert PMKID-List field */
-			if (extra_len > 0)
-			{
-				MakeOutgoingFrame(pTmpBuf,					&TempLen,
-								  2,						&pmk_count,
-								  pmkid_len,				pmkid_ptr,
-								  END_OF_ARGS);
-
-				pTmpBuf += TempLen;
-				*pFrameLen = *pFrameLen + TempLen;
-			}
-		}
-	}
-
-	return;
-}
diff --git a/drivers/staging/rt3090/common/crypt_aes.c b/drivers/staging/rt3090/common/crypt_aes.c
deleted file mode 100644
index f400f1eab516..000000000000
--- a/drivers/staging/rt3090/common/crypt_aes.c
+++ /dev/null
@@ -1,1007 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-	Module Name:
-	crypt_aes.c
-
-	Abstract:
-
-	Revision History:
-	Who			When			What
-	--------	----------		----------------------------------------------
-        Eddy        2009/01/19      Create AES-128, AES-192, AES-256, AES-CBC
-*/
-
-#include "crypt_aes.h"
-
-/* The value given by [x^(i-1),{00},{00},{00}], with x^(i-1) being powers of x in the field GF(2^8). */
-static const UINT32 aes_rcon[] = {
-	0x00000000, 0x01000000, 0x02000000, 0x04000000,
-    0x08000000, 0x10000000, 0x20000000, 0x40000000,
-    0x80000000, 0x1B000000, 0x36000000};
-
-static const UINT8 aes_sbox_enc[] = {
-  /*  0     1     2     3     4     5     6     7     8     9     a     b     c     d     e     f    */
-    0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5, 0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7 ,0xab, 0x76, /* 0 */
-    0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0, 0xad, 0xd4, 0xa2, 0xaf, 0x9c, 0xa4 ,0x72, 0xc0, /* 1 */
-    0xb7, 0xfd, 0x93, 0x26, 0x36, 0x3f, 0xf7, 0xcc, 0x34, 0xa5, 0xe5, 0xf1, 0x71, 0xd8 ,0x31, 0x15, /* 2 */
-    0x04, 0xc7, 0x23, 0xc3, 0x18, 0x96, 0x05, 0x9a, 0x07, 0x12, 0x80, 0xe2, 0xeb, 0x27 ,0xb2, 0x75, /* 3 */
-    0x09, 0x83, 0x2c, 0x1a, 0x1b, 0x6e, 0x5a, 0xa0, 0x52, 0x3b, 0xd6, 0xb3, 0x29, 0xe3 ,0x2f, 0x84, /* 4 */
-    0x53, 0xd1, 0x00, 0xed, 0x20, 0xfc, 0xb1, 0x5b, 0x6a, 0xcb, 0xbe, 0x39, 0x4a, 0x4c ,0x58, 0xcf, /* 5 */
-    0xd0, 0xef, 0xaa, 0xfb, 0x43, 0x4d, 0x33, 0x85, 0x45, 0xf9, 0x02, 0x7f, 0x50, 0x3c ,0x9f, 0xa8, /* 6 */
-    0x51, 0xa3, 0x40, 0x8f, 0x92, 0x9d, 0x38, 0xf5, 0xbc, 0xb6, 0xda, 0x21, 0x10, 0xff ,0xf3, 0xd2, /* 7 */
-    0xcd, 0x0c, 0x13, 0xec, 0x5f, 0x97, 0x44, 0x17, 0xc4, 0xa7, 0x7e, 0x3d, 0x64, 0x5d ,0x19, 0x73, /* 8 */
-    0x60, 0x81, 0x4f, 0xdc, 0x22, 0x2a, 0x90, 0x88, 0x46, 0xee, 0xb8, 0x14, 0xde, 0x5e ,0x0b, 0xdb, /* 9 */
-    0xe0, 0x32, 0x3a, 0x0a, 0x49, 0x06, 0x24, 0x5c, 0xc2, 0xd3, 0xac, 0x62, 0x91, 0x95 ,0xe4, 0x79, /* a */
-    0xe7, 0xc8, 0x37, 0x6d, 0x8d, 0xd5, 0x4e, 0xa9, 0x6c, 0x56, 0xf4, 0xea, 0x65, 0x7a ,0xae, 0x08, /* b */
-    0xba, 0x78, 0x25, 0x2e, 0x1c, 0xa6, 0xb4, 0xc6, 0xe8, 0xdd, 0x74, 0x1f, 0x4b, 0xbd ,0x8b, 0x8a, /* c */
-    0x70, 0x3e, 0xb5, 0x66, 0x48, 0x03, 0xf6, 0x0e, 0x61, 0x35, 0x57, 0xb9, 0x86, 0xc1 ,0x1d, 0x9e, /* d */
-    0xe1, 0xf8, 0x98, 0x11, 0x69, 0xd9, 0x8e, 0x94, 0x9b, 0x1e, 0x87, 0xe9, 0xce, 0x55 ,0x28, 0xdf, /* e */
-    0x8c, 0xa1, 0x89, 0x0d, 0xbf, 0xe6, 0x42, 0x68, 0x41, 0x99, 0x2d, 0x0f, 0xb0, 0x54 ,0xbb, 0x16, /* f */
-};
-
-static const UINT8 aes_sbox_dec[] = {
-  /*  0     1     2     3     4     5     6     7     8     9     a     b     c     d     e     f    */
-    0x52, 0x09, 0x6a, 0xd5, 0x30, 0x36, 0xa5, 0x38, 0xbf, 0x40, 0xa3, 0x9e, 0x81, 0xf3, 0xd7, 0xfb, /* 0 */
-    0x7c, 0xe3, 0x39, 0x82, 0x9b, 0x2f, 0xff, 0x87, 0x34, 0x8e, 0x43, 0x44, 0xc4, 0xde, 0xe9, 0xcb, /* 1 */
-    0x54, 0x7b, 0x94, 0x32, 0xa6, 0xc2, 0x23, 0x3d, 0xee, 0x4c, 0x95, 0x0b, 0x42, 0xfa, 0xc3, 0x4e, /* 2 */
-    0x08, 0x2e, 0xa1, 0x66, 0x28, 0xd9, 0x24, 0xb2, 0x76, 0x5b, 0xa2, 0x49, 0x6d, 0x8b, 0xd1, 0x25, /* 3 */
-    0x72, 0xf8, 0xf6, 0x64, 0x86, 0x68, 0x98, 0x16, 0xd4, 0xa4, 0x5c, 0xcc, 0x5d, 0x65, 0xb6, 0x92, /* 4 */
-    0x6c, 0x70, 0x48, 0x50, 0xfd, 0xed, 0xb9, 0xda, 0x5e, 0x15, 0x46, 0x57, 0xa7, 0x8d, 0x9d, 0x84, /* 5 */
-    0x90, 0xd8, 0xab, 0x00, 0x8c, 0xbc, 0xd3, 0x0a, 0xf7, 0xe4, 0x58, 0x05, 0xb8, 0xb3, 0x45, 0x06, /* 6 */
-    0xd0, 0x2c, 0x1e, 0x8f, 0xca, 0x3f, 0x0f, 0x02, 0xc1, 0xaf, 0xbd, 0x03, 0x01, 0x13, 0x8a, 0x6b, /* 7 */
-    0x3a, 0x91, 0x11, 0x41, 0x4f, 0x67, 0xdc, 0xea, 0x97, 0xf2, 0xcf, 0xce, 0xf0, 0xb4, 0xe6, 0x73, /* 8 */
-    0x96, 0xac, 0x74, 0x22, 0xe7, 0xad, 0x35, 0x85, 0xe2, 0xf9, 0x37, 0xe8, 0x1c, 0x75, 0xdf, 0x6e, /* 9 */
-    0x47, 0xf1, 0x1a, 0x71, 0x1d, 0x29, 0xc5, 0x89, 0x6f, 0xb7, 0x62, 0x0e, 0xaa, 0x18, 0xbe, 0x1b, /* a */
-    0xfc, 0x56, 0x3e, 0x4b, 0xc6, 0xd2, 0x79, 0x20, 0x9a, 0xdb, 0xc0, 0xfe, 0x78, 0xcd, 0x5a, 0xf4, /* b */
-    0x1f, 0xdd, 0xa8, 0x33, 0x88, 0x07, 0xc7, 0x31, 0xb1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xec, 0x5f, /* c */
-    0x60, 0x51, 0x7f, 0xa9, 0x19, 0xb5, 0x4a, 0x0d, 0x2d, 0xe5, 0x7a, 0x9f, 0x93, 0xc9, 0x9c, 0xef, /* d */
-    0xa0, 0xe0, 0x3b, 0x4d, 0xae, 0x2a, 0xf5, 0xb0, 0xc8, 0xeb, 0xbb, 0x3c, 0x83, 0x53, 0x99, 0x61, /* e */
-    0x17, 0x2b, 0x04, 0x7e, 0xba, 0x77, 0xd6, 0x26, 0xe1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0c, 0x7d, /* f */
-};
-
-/* ArrayIndex*{02} */
-static const UINT8 aes_mul_2[] = {
-  /*  0     1     2     3     4     5     6     7     8     9     a     b     c     d     e     f    */
-    0x00, 0x02, 0x04, 0x06, 0x08, 0x0a, 0x0c, 0x0e, 0x10, 0x12, 0x14, 0x16, 0x18, 0x1a, 0x1c, 0x1e, /* 0 */
-    0x20, 0x22, 0x24, 0x26, 0x28, 0x2a, 0x2c, 0x2e, 0x30, 0x32, 0x34, 0x36, 0x38, 0x3a, 0x3c, 0x3e, /* 1 */
-    0x40, 0x42, 0x44, 0x46, 0x48, 0x4a, 0x4c, 0x4e, 0x50, 0x52, 0x54, 0x56, 0x58, 0x5a, 0x5c, 0x5e, /* 2 */
-    0x60, 0x62, 0x64, 0x66, 0x68, 0x6a, 0x6c, 0x6e, 0x70, 0x72, 0x74, 0x76, 0x78, 0x7a, 0x7c, 0x7e, /* 3 */
-    0x80, 0x82, 0x84, 0x86, 0x88, 0x8a, 0x8c, 0x8e, 0x90, 0x92, 0x94, 0x96, 0x98, 0x9a, 0x9c, 0x9e, /* 4 */
-    0xa0, 0xa2, 0xa4, 0xa6, 0xa8, 0xaa, 0xac, 0xae, 0xb0, 0xb2, 0xb4, 0xb6, 0xb8, 0xba, 0xbc, 0xbe, /* 5 */
-    0xc0, 0xc2, 0xc4, 0xc6, 0xc8, 0xca, 0xcc, 0xce, 0xd0, 0xd2, 0xd4, 0xd6, 0xd8, 0xda, 0xdc, 0xde, /* 6 */
-    0xe0, 0xe2, 0xe4, 0xe6, 0xe8, 0xea, 0xec, 0xee, 0xf0, 0xf2, 0xf4, 0xf6, 0xf8, 0xfa, 0xfc, 0xfe, /* 7 */
-    0x1b, 0x19, 0x1f, 0x1d, 0x13, 0x11, 0x17, 0x15, 0x0b, 0x09, 0x0f, 0x0d, 0x03, 0x01, 0x07, 0x05, /* 8 */
-    0x3b, 0x39, 0x3f, 0x3d, 0x33, 0x31, 0x37, 0x35, 0x2b, 0x29, 0x2f, 0x2d, 0x23, 0x21, 0x27, 0x25, /* 9 */
-    0x5b, 0x59, 0x5f, 0x5d, 0x53, 0x51, 0x57, 0x55, 0x4b, 0x49, 0x4f, 0x4d, 0x43, 0x41, 0x47, 0x45, /* a */
-    0x7b, 0x79, 0x7f, 0x7d, 0x73, 0x71, 0x77, 0x75, 0x6b, 0x69, 0x6f, 0x6d, 0x63, 0x61, 0x67, 0x65, /* b */
-    0x9b, 0x99, 0x9f, 0x9d, 0x93, 0x91, 0x97, 0x95, 0x8b, 0x89, 0x8f, 0x8d, 0x83, 0x81, 0x87, 0x85, /* c */
-    0xbb, 0xb9, 0xbf, 0xbd, 0xb3, 0xb1, 0xb7, 0xb5, 0xab, 0xa9, 0xaf, 0xad, 0xa3, 0xa1, 0xa7, 0xa5, /* d */
-    0xdb, 0xd9, 0xdf, 0xdd, 0xd3, 0xd1, 0xd7, 0xd5, 0xcb, 0xc9, 0xcf, 0xcd, 0xc3, 0xc1, 0xc7, 0xc5, /* e */
-    0xfb, 0xf9, 0xff, 0xfd, 0xf3, 0xf1, 0xf7, 0xf5, 0xeb, 0xe9, 0xef, 0xed, 0xe3, 0xe1, 0xe7, 0xe5, /* f */
-};
-
-/* ArrayIndex*{03} */
-static const UINT8 aes_mul_3[] = {
-  /*  0     1     2     3     4     5     6     7     8     9     a     b     c     d     e     f    */
-    0x00, 0x03, 0x06, 0x05, 0x0c, 0x0f, 0x0a, 0x09, 0x18, 0x1b, 0x1e, 0x1d, 0x14, 0x17, 0x12, 0x11, /* 0 */
-    0x30, 0x33, 0x36, 0x35, 0x3c, 0x3f, 0x3a, 0x39, 0x28, 0x2b, 0x2e, 0x2d, 0x24, 0x27, 0x22, 0x21, /* 1 */
-    0x60, 0x63, 0x66, 0x65, 0x6c, 0x6f, 0x6a, 0x69, 0x78, 0x7b, 0x7e, 0x7d, 0x74, 0x77, 0x72, 0x71, /* 2 */
-    0x50, 0x53, 0x56, 0x55, 0x5c, 0x5f, 0x5a, 0x59, 0x48, 0x4b, 0x4e, 0x4d, 0x44, 0x47, 0x42, 0x41, /* 3 */
-    0xc0, 0xc3, 0xc6, 0xc5, 0xcc, 0xcf, 0xca, 0xc9, 0xd8, 0xdb, 0xde, 0xdd, 0xd4, 0xd7, 0xd2, 0xd1, /* 4 */
-    0xf0, 0xf3, 0xf6, 0xf5, 0xfc, 0xff, 0xfa, 0xf9, 0xe8, 0xeb, 0xee, 0xed, 0xe4, 0xe7, 0xe2, 0xe1, /* 5 */
-    0xa0, 0xa3, 0xa6, 0xa5, 0xac, 0xaf, 0xaa, 0xa9, 0xb8, 0xbb, 0xbe, 0xbd, 0xb4, 0xb7, 0xb2, 0xb1, /* 6 */
-    0x90, 0x93, 0x96, 0x95, 0x9c, 0x9f, 0x9a, 0x99, 0x88, 0x8b, 0x8e, 0x8d, 0x84, 0x87, 0x82, 0x81, /* 7 */
-    0x9b, 0x98, 0x9d, 0x9e, 0x97, 0x94, 0x91, 0x92, 0x83, 0x80, 0x85, 0x86, 0x8f, 0x8c, 0x89, 0x8a, /* 8 */
-    0xab, 0xa8, 0xad, 0xae, 0xa7, 0xa4, 0xa1, 0xa2, 0xb3, 0xb0, 0xb5, 0xb6, 0xbf, 0xbc, 0xb9, 0xba, /* 9 */
-    0xfb, 0xf8, 0xfd, 0xfe, 0xf7, 0xf4, 0xf1, 0xf2, 0xe3, 0xe0, 0xe5, 0xe6, 0xef, 0xec, 0xe9, 0xea, /* a */
-    0xcb, 0xc8, 0xcd, 0xce, 0xc7, 0xc4, 0xc1, 0xc2, 0xd3, 0xd0, 0xd5, 0xd6, 0xdf, 0xdc, 0xd9, 0xda, /* b */
-    0x5b, 0x58, 0x5d, 0x5e, 0x57, 0x54, 0x51, 0x52, 0x43, 0x40, 0x45, 0x46, 0x4f, 0x4c, 0x49, 0x4a, /* c */
-    0x6b, 0x68, 0x6d, 0x6e, 0x67, 0x64, 0x61, 0x62, 0x73, 0x70, 0x75, 0x76, 0x7f, 0x7c, 0x79, 0x7a, /* d */
-    0x3b, 0x38, 0x3d, 0x3e, 0x37, 0x34, 0x31, 0x32, 0x23, 0x20, 0x25, 0x26, 0x2f, 0x2c, 0x29, 0x2a, /* e */
-    0x0b, 0x08, 0x0d, 0x0e, 0x07, 0x04, 0x01, 0x02, 0x13, 0x10, 0x15, 0x16, 0x1f, 0x1c, 0x19, 0x1a, /* f */
-};
-
-/* ArrayIndex*{09} */
-static const UINT8 aes_mul_9[] = {
-  /*  0     1     2     3     4     5     6     7     8     9     a     b     c     d     e     f    */
-    0x00, 0x09, 0x12, 0x1b, 0x24, 0x2d, 0x36, 0x3f, 0x48, 0x41, 0x5a, 0x53, 0x6c, 0x65, 0x7e, 0x77, /* 0 */
-    0x90, 0x99, 0x82, 0x8b, 0xb4, 0xbd, 0xa6, 0xaf, 0xd8, 0xd1, 0xca, 0xc3, 0xfc, 0xf5, 0xee, 0xe7, /* 1 */
-    0x3b, 0x32, 0x29, 0x20, 0x1f, 0x16, 0x0d, 0x04, 0x73, 0x7a, 0x61, 0x68, 0x57, 0x5e, 0x45, 0x4c, /* 2 */
-    0xab, 0xa2, 0xb9, 0xb0, 0x8f, 0x86, 0x9d, 0x94, 0xe3, 0xea, 0xf1, 0xf8, 0xc7, 0xce, 0xd5, 0xdc, /* 3 */
-    0x76, 0x7f, 0x64, 0x6d, 0x52, 0x5b, 0x40, 0x49, 0x3e, 0x37, 0x2c, 0x25, 0x1a, 0x13, 0x08, 0x01, /* 4 */
-    0xe6, 0xef, 0xf4, 0xfd, 0xc2, 0xcb, 0xd0, 0xd9, 0xae, 0xa7, 0xbc, 0xb5, 0x8a, 0x83, 0x98, 0x91, /* 5 */
-    0x4d, 0x44, 0x5f, 0x56, 0x69, 0x60, 0x7b, 0x72, 0x05, 0x0c, 0x17, 0x1e, 0x21, 0x28, 0x33, 0x3a, /* 6 */
-    0xdd, 0xd4, 0xcf, 0xc6, 0xf9, 0xf0, 0xeb, 0xe2, 0x95, 0x9c, 0x87, 0x8e, 0xb1, 0xb8, 0xa3, 0xaa, /* 7 */
-    0xec, 0xe5, 0xfe, 0xf7, 0xc8, 0xc1, 0xda, 0xd3, 0xa4, 0xad, 0xb6, 0xbf, 0x80, 0x89, 0x92, 0x9b, /* 8 */
-    0x7c, 0x75, 0x6e, 0x67, 0x58, 0x51, 0x4a, 0x43, 0x34, 0x3d, 0x26, 0x2f, 0x10, 0x19, 0x02, 0x0b, /* 9 */
-    0xd7, 0xde, 0xc5, 0xcc, 0xf3, 0xfa, 0xe1, 0xe8, 0x9f, 0x96, 0x8d, 0x84, 0xbb, 0xb2, 0xa9, 0xa0, /* a */
-    0x47, 0x4e, 0x55, 0x5c, 0x63, 0x6a, 0x71, 0x78, 0x0f, 0x06, 0x1d, 0x14, 0x2b, 0x22, 0x39, 0x30, /* b */
-    0x9a, 0x93, 0x88, 0x81, 0xbe, 0xb7, 0xac, 0xa5, 0xd2, 0xdb, 0xc0, 0xc9, 0xf6, 0xff, 0xe4, 0xed, /* c */
-    0x0a, 0x03, 0x18, 0x11, 0x2e, 0x27, 0x3c, 0x35, 0x42, 0x4b, 0x50, 0x59, 0x66, 0x6f, 0x74, 0x7d, /* d */
-    0xa1, 0xa8, 0xb3, 0xba, 0x85, 0x8c, 0x97, 0x9e, 0xe9, 0xe0, 0xfb, 0xf2, 0xcd, 0xc4, 0xdf, 0xd6, /* e */
-    0x31, 0x38, 0x23, 0x2a, 0x15, 0x1c, 0x07, 0x0e, 0x79, 0x70, 0x6b, 0x62, 0x5d, 0x54, 0x4f, 0x46, /* f */
-};
-
-/* ArrayIndex*{0b} */
-static const UINT8 aes_mul_b[] = {
-  /*  0     1     2     3     4     5     6     7     8     9     a     b     c     d     e     f    */
-    0x00, 0x0b, 0x16, 0x1d, 0x2c, 0x27, 0x3a, 0x31, 0x58, 0x53, 0x4e, 0x45, 0x74, 0x7f, 0x62, 0x69, /* 0 */
-    0xb0, 0xbb, 0xa6, 0xad, 0x9c, 0x97, 0x8a, 0x81, 0xe8, 0xe3, 0xfe, 0xf5, 0xc4, 0xcf, 0xd2, 0xd9, /* 1 */
-    0x7b, 0x70, 0x6d, 0x66, 0x57, 0x5c, 0x41, 0x4a, 0x23, 0x28, 0x35, 0x3e, 0x0f, 0x04, 0x19, 0x12, /* 2 */
-    0xcb, 0xc0, 0xdd, 0xd6, 0xe7, 0xec, 0xf1, 0xfa, 0x93, 0x98, 0x85, 0x8e, 0xbf, 0xb4, 0xa9, 0xa2, /* 3 */
-    0xf6, 0xfd, 0xe0, 0xeb, 0xda, 0xd1, 0xcc, 0xc7, 0xae, 0xa5, 0xb8, 0xb3, 0x82, 0x89, 0x94, 0x9f, /* 4 */
-    0x46, 0x4d, 0x50, 0x5b, 0x6a, 0x61, 0x7c, 0x77, 0x1e, 0x15, 0x08, 0x03, 0x32, 0x39, 0x24, 0x2f, /* 5 */
-    0x8d, 0x86, 0x9b, 0x90, 0xa1, 0xaa, 0xb7, 0xbc, 0xd5, 0xde, 0xc3, 0xc8, 0xf9, 0xf2, 0xef, 0xe4, /* 6 */
-    0x3d, 0x36, 0x2b, 0x20, 0x11, 0x1a, 0x07, 0x0c, 0x65, 0x6e, 0x73, 0x78, 0x49, 0x42, 0x5f, 0x54, /* 7 */
-    0xf7, 0xfc, 0xe1, 0xea, 0xdb, 0xd0, 0xcd, 0xc6, 0xaf, 0xa4, 0xb9, 0xb2, 0x83, 0x88, 0x95, 0x9e, /* 8 */
-    0x47, 0x4c, 0x51, 0x5a, 0x6b, 0x60, 0x7d, 0x76, 0x1f, 0x14, 0x09, 0x02, 0x33, 0x38, 0x25, 0x2e, /* 9 */
-    0x8c, 0x87, 0x9a, 0x91, 0xa0, 0xab, 0xb6, 0xbd, 0xd4, 0xdf, 0xc2, 0xc9, 0xf8, 0xf3, 0xee, 0xe5, /* a */
-    0x3c, 0x37, 0x2a, 0x21, 0x10, 0x1b, 0x06, 0x0d, 0x64, 0x6f, 0x72, 0x79, 0x48, 0x43, 0x5e, 0x55, /* b */
-    0x01, 0x0a, 0x17, 0x1c, 0x2d, 0x26, 0x3b, 0x30, 0x59, 0x52, 0x4f, 0x44, 0x75, 0x7e, 0x63, 0x68, /* c */
-    0xb1, 0xba, 0xa7, 0xac, 0x9d, 0x96, 0x8b, 0x80, 0xe9, 0xe2, 0xff, 0xf4, 0xc5, 0xce, 0xd3, 0xd8, /* d */
-    0x7a, 0x71, 0x6c, 0x67, 0x56, 0x5d, 0x40, 0x4b, 0x22, 0x29, 0x34, 0x3f, 0x0e, 0x05, 0x18, 0x13, /* e */
-    0xca, 0xc1, 0xdc, 0xd7, 0xe6, 0xed, 0xf0, 0xfb, 0x92, 0x99, 0x84, 0x8f, 0xbe, 0xb5, 0xa8, 0xa3, /* f */
-};
-
-/* ArrayIndex*{0d} */
-static const UINT8 aes_mul_d[] = {
-  /*  0     1     2     3     4     5     6     7     8     9     a     b     c     d     e     f    */
-    0x00, 0x0d, 0x1a, 0x17, 0x34, 0x39, 0x2e, 0x23, 0x68, 0x65, 0x72, 0x7f, 0x5c, 0x51, 0x46, 0x4b, /* 0 */
-    0xd0, 0xdd, 0xca, 0xc7, 0xe4, 0xe9, 0xfe, 0xf3, 0xb8, 0xb5, 0xa2, 0xaf, 0x8c, 0x81, 0x96, 0x9b, /* 1 */
-    0xbb, 0xb6, 0xa1, 0xac, 0x8f, 0x82, 0x95, 0x98, 0xd3, 0xde, 0xc9, 0xc4, 0xe7, 0xea, 0xfd, 0xf0, /* 2 */
-    0x6b, 0x66, 0x71, 0x7c, 0x5f, 0x52, 0x45, 0x48, 0x03, 0x0e, 0x19, 0x14, 0x37, 0x3a, 0x2d, 0x20, /* 3 */
-    0x6d, 0x60, 0x77, 0x7a, 0x59, 0x54, 0x43, 0x4e, 0x05, 0x08, 0x1f, 0x12, 0x31, 0x3c, 0x2b, 0x26, /* 4 */
-    0xbd, 0xb0, 0xa7, 0xaa, 0x89, 0x84, 0x93, 0x9e, 0xd5, 0xd8, 0xcf, 0xc2, 0xe1, 0xec, 0xfb, 0xf6, /* 5 */
-    0xd6, 0xdb, 0xcc, 0xc1, 0xe2, 0xef, 0xf8, 0xf5, 0xbe, 0xb3, 0xa4, 0xa9, 0x8a, 0x87, 0x90, 0x9d, /* 6 */
-    0x06, 0x0b, 0x1c, 0x11, 0x32, 0x3f, 0x28, 0x25, 0x6e, 0x63, 0x74, 0x79, 0x5a, 0x57, 0x40, 0x4d, /* 7 */
-    0xda, 0xd7, 0xc0, 0xcd, 0xee, 0xe3, 0xf4, 0xf9, 0xb2, 0xbf, 0xa8, 0xa5, 0x86, 0x8b, 0x9c, 0x91, /* 8 */
-    0x0a, 0x07, 0x10, 0x1d, 0x3e, 0x33, 0x24, 0x29, 0x62, 0x6f, 0x78, 0x75, 0x56, 0x5b, 0x4c, 0x41, /* 9 */
-    0x61, 0x6c, 0x7b, 0x76, 0x55, 0x58, 0x4f, 0x42, 0x09, 0x04, 0x13, 0x1e, 0x3d, 0x30, 0x27, 0x2a, /* a */
-    0xb1, 0xbc, 0xab, 0xa6, 0x85, 0x88, 0x9f, 0x92, 0xd9, 0xd4, 0xc3, 0xce, 0xed, 0xe0, 0xf7, 0xfa, /* b */
-    0xb7, 0xba, 0xad, 0xa0, 0x83, 0x8e, 0x99, 0x94, 0xdf, 0xd2, 0xc5, 0xc8, 0xeb, 0xe6, 0xf1, 0xfc, /* c */
-    0x67, 0x6a, 0x7d, 0x70, 0x53, 0x5e, 0x49, 0x44, 0x0f, 0x02, 0x15, 0x18, 0x3b, 0x36, 0x21, 0x2c, /* d */
-    0x0c, 0x01, 0x16, 0x1b, 0x38, 0x35, 0x22, 0x2f, 0x64, 0x69, 0x7e, 0x73, 0x50, 0x5d, 0x4a, 0x47, /* e */
-    0xdc, 0xd1, 0xc6, 0xcb, 0xe8, 0xe5, 0xf2, 0xff, 0xb4, 0xb9, 0xae, 0xa3, 0x80, 0x8d, 0x9a, 0x97, /* f */
-};
-
-/* ArrayIndex*{0e} */
-static const UINT8 aes_mul_e[] = {
-  /*  0     1     2     3     4     5     6     7     8     9     a     b     c     d     e     f    */
-    0x00, 0x0e, 0x1c, 0x12, 0x38, 0x36, 0x24, 0x2a, 0x70, 0x7e, 0x6c, 0x62, 0x48, 0x46, 0x54, 0x5a, /* 0 */
-    0xe0, 0xee, 0xfc, 0xf2, 0xd8, 0xd6, 0xc4, 0xca, 0x90, 0x9e, 0x8c, 0x82, 0xa8, 0xa6, 0xb4, 0xba, /* 1 */
-    0xdb, 0xd5, 0xc7, 0xc9, 0xe3, 0xed, 0xff, 0xf1, 0xab, 0xa5, 0xb7, 0xb9, 0x93, 0x9d, 0x8f, 0x81, /* 2 */
-    0x3b, 0x35, 0x27, 0x29, 0x03, 0x0d, 0x1f, 0x11, 0x4b, 0x45, 0x57, 0x59, 0x73, 0x7d, 0x6f, 0x61, /* 3 */
-    0xad, 0xa3, 0xb1, 0xbf, 0x95, 0x9b, 0x89, 0x87, 0xdd, 0xd3, 0xc1, 0xcf, 0xe5, 0xeb, 0xf9, 0xf7, /* 4 */
-    0x4d, 0x43, 0x51, 0x5f, 0x75, 0x7b, 0x69, 0x67, 0x3d, 0x33, 0x21, 0x2f, 0x05, 0x0b, 0x19, 0x17, /* 5 */
-    0x76, 0x78, 0x6a, 0x64, 0x4e, 0x40, 0x52, 0x5c, 0x06, 0x08, 0x1a, 0x14, 0x3e, 0x30, 0x22, 0x2c, /* 6 */
-    0x96, 0x98, 0x8a, 0x84, 0xae, 0xa0, 0xb2, 0xbc, 0xe6, 0xe8, 0xfa, 0xf4, 0xde, 0xd0, 0xc2, 0xcc, /* 7 */
-    0x41, 0x4f, 0x5d, 0x53, 0x79, 0x77, 0x65, 0x6b, 0x31, 0x3f, 0x2d, 0x23, 0x09, 0x07, 0x15, 0x1b, /* 8 */
-    0xa1, 0xaf, 0xbd, 0xb3, 0x99, 0x97, 0x85, 0x8b, 0xd1, 0xdf, 0xcd, 0xc3, 0xe9, 0xe7, 0xf5, 0xfb, /* 9 */
-    0x9a, 0x94, 0x86, 0x88, 0xa2, 0xac, 0xbe, 0xb0, 0xea, 0xe4, 0xf6, 0xf8, 0xd2, 0xdc, 0xce, 0xc0, /* a */
-    0x7a, 0x74, 0x66, 0x68, 0x42, 0x4c, 0x5e, 0x50, 0x0a, 0x04, 0x16, 0x18, 0x32, 0x3c, 0x2e, 0x20, /* b */
-    0xec, 0xe2, 0xf0, 0xfe, 0xd4, 0xda, 0xc8, 0xc6, 0x9c, 0x92, 0x80, 0x8e, 0xa4, 0xaa, 0xb8, 0xb6, /* c */
-    0x0c, 0x02, 0x10, 0x1e, 0x34, 0x3a, 0x28, 0x26, 0x7c, 0x72, 0x60, 0x6e, 0x44, 0x4a, 0x58, 0x56, /* d */
-    0x37, 0x39, 0x2b, 0x25, 0x0f, 0x01, 0x13, 0x1d, 0x47, 0x49, 0x5b, 0x55, 0x7f, 0x71, 0x63, 0x6d, /* e */
-    0xd7, 0xd9, 0xcb, 0xc5, 0xef, 0xe1, 0xf3, 0xfd, 0xa7, 0xa9, 0xbb, 0xb5, 0x9f, 0x91, 0x83, 0x8d, /* f */
-};
-
-
-/* For AES_CMAC */
-#define AES_MAC_LENGTH 16 /* 128-bit string */
-static UINT8 Const_Zero[16] = {
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
-static UINT8 Const_Rb[16] = {
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x87};
-
-
-/*
-========================================================================
-Routine Description:
-    AES key expansion (key schedule)
-
-Arguments:
-    Key              Cipher key, it may be 16, 24, or 32 bytes (128, 192, or 256 bits)
-    KeyLength        The length of cipher key in bytes
-    paes_ctx         Pointer to AES_CTX_STRUC
-
-Return Value:
-    paes_ctx         Retrun the KeyWordExpansion of AES_CTX_STRUC
-
-Note:
-    Pseudo code for key expansion
-    ------------------------------------------
-       Nk = (key length/4);
-
-       while (i < Nk)
-           KeyWordExpansion[i] = word(key[4*i], key[4*i + 1], key[4*i + 2], key[4*i + 3]);
-           i++;
-       end while
-
-       while (i < ((key length/4 + 6 + 1)*4) )
-           temp = KeyWordExpansion[i - 1];
-           if (i % Nk ==0)
-               temp = SubWord(RotWord(temp)) ^ Rcon[i/Nk];
-           else if ((Nk > 6) && (i % 4 == 4))
-               temp = SubWord(temp);
-           end if
-
-           KeyWordExpansion[i] = KeyWordExpansion[i - Nk]^ temp;
-           i++;
-       end while
-========================================================================
-*/
-VOID AES_KeyExpansion (
-    IN UINT8 Key[],
-    IN UINT KeyLength,
-    INOUT AES_CTX_STRUC *paes_ctx)
-{
-    UINT KeyIndex = 0;
-    UINT NumberOfWordOfKey, NumberOfWordOfKeyExpansion;
-    UINT8  TempWord[AES_KEY_ROWS], Temp;
-    UINT32 Temprcon;
-
-    NumberOfWordOfKey = KeyLength >> 2;
-    while (KeyIndex < NumberOfWordOfKey)
-    {
-        paes_ctx->KeyWordExpansion[0][KeyIndex] = Key[4*KeyIndex];
-        paes_ctx->KeyWordExpansion[1][KeyIndex] = Key[4*KeyIndex + 1];
-        paes_ctx->KeyWordExpansion[2][KeyIndex] = Key[4*KeyIndex + 2];
-        paes_ctx->KeyWordExpansion[3][KeyIndex] = Key[4*KeyIndex + 3];
-        KeyIndex++;
-    } /* End of while */
-
-    NumberOfWordOfKeyExpansion = ((UINT) AES_KEY_ROWS) * ((KeyLength >> 2) + 6 + 1);
-    while (KeyIndex < NumberOfWordOfKeyExpansion)
-    {
-        TempWord[0] = paes_ctx->KeyWordExpansion[0][KeyIndex - 1];
-        TempWord[1] = paes_ctx->KeyWordExpansion[1][KeyIndex - 1];
-        TempWord[2] = paes_ctx->KeyWordExpansion[2][KeyIndex - 1];
-        TempWord[3] = paes_ctx->KeyWordExpansion[3][KeyIndex - 1];
-        if ((KeyIndex % NumberOfWordOfKey) == 0) {
-            Temprcon = aes_rcon[KeyIndex/NumberOfWordOfKey];
-            Temp = aes_sbox_enc[TempWord[1]]^((Temprcon >> 24) & 0xff);
-            TempWord[1] = aes_sbox_enc[TempWord[2]]^((Temprcon >> 16) & 0xff);
-            TempWord[2] = aes_sbox_enc[TempWord[3]]^((Temprcon >>  8) & 0xff);
-            TempWord[3] = aes_sbox_enc[TempWord[0]]^((Temprcon      ) & 0xff);
-            TempWord[0] = Temp;
-        } else if ((NumberOfWordOfKey > 6) && ((KeyIndex % NumberOfWordOfKey) == 4)) {
-            Temp = aes_sbox_enc[TempWord[0]];
-            TempWord[1] = aes_sbox_enc[TempWord[1]];
-            TempWord[2] = aes_sbox_enc[TempWord[2]];
-            TempWord[3] = aes_sbox_enc[TempWord[3]];
-            TempWord[0] = Temp;
-        }
-        paes_ctx->KeyWordExpansion[0][KeyIndex] = paes_ctx->KeyWordExpansion[0][KeyIndex - NumberOfWordOfKey]^TempWord[0];
-        paes_ctx->KeyWordExpansion[1][KeyIndex] = paes_ctx->KeyWordExpansion[1][KeyIndex - NumberOfWordOfKey]^TempWord[1];
-        paes_ctx->KeyWordExpansion[2][KeyIndex] = paes_ctx->KeyWordExpansion[2][KeyIndex - NumberOfWordOfKey]^TempWord[2];
-        paes_ctx->KeyWordExpansion[3][KeyIndex] = paes_ctx->KeyWordExpansion[3][KeyIndex - NumberOfWordOfKey]^TempWord[3];
-        KeyIndex++;
-    } /* End of while */
-} /* End of AES_KeyExpansion */
-
-
-/*
-========================================================================
-Routine Description:
-    AES encryption
-
-Arguments:
-    PlainBlock       The block of plain text, 16 bytes(128 bits) each block
-    PlainBlockSize   The length of block of plain text in bytes
-    Key              Cipher key, it may be 16, 24, or 32 bytes (128, 192, or 256 bits)
-    KeyLength        The length of cipher key in bytes
-    CipherBlockSize  The length of allocated cipher block in bytes
-
-Return Value:
-    CipherBlock      Return cipher text
-    CipherBlockSize  Return the length of real used cipher block in bytes
-
-Note:
-    Reference to FIPS-PUB 197
-    1. Check if block size is 16 bytes(128 bits) and if key length is 16, 24, or 32 bytes(128, 192, or 256 bits)
-    2. Transfer the plain block to state block
-    3. Main encryption rounds
-    4. Transfer the state block to cipher block
-    ------------------------------------------
-       NumberOfRound = (key length / 4) + 6;
-       state block = plain block;
-
-       AddRoundKey(state block, key);
-       for round = 1 to NumberOfRound
-           SubBytes(state block)
-           ShiftRows(state block)
-           MixColumns(state block)
-           AddRoundKey(state block, key);
-       end for
-
-       SubBytes(state block)
-       ShiftRows(state block)
-       AddRoundKey(state block, key);
-
-       cipher block = state block;
-========================================================================
-*/
-VOID AES_Encrypt (
-    IN UINT8 PlainBlock[],
-    IN UINT PlainBlockSize,
-    IN UINT8 Key[],
-    IN UINT KeyLength,
-    OUT UINT8 CipherBlock[],
-    INOUT UINT *CipherBlockSize)
-{
-    AES_CTX_STRUC aes_ctx;
-    UINT RowIndex, ColumnIndex;
-    UINT RoundIndex, NumberOfRound = 0;
-    UINT8 Temp, Row0, Row1, Row2, Row3;
-
-    /*
-     * 1. Check if block size is 16 bytes(128 bits) and if key length is 16, 24, or 32 bytes(128, 192, or 256 bits)
-     */
-    if (PlainBlockSize != AES_BLOCK_SIZES) {
-	DBGPRINT(RT_DEBUG_ERROR, ("AES_Encrypt: plain block size is %d bytes, it must be %d bytes(128 bits).\n",
-            PlainBlockSize, AES_BLOCK_SIZES));
-        return;
-    } /* End of if */
-    if ((KeyLength != AES_KEY128_LENGTH) && (KeyLength != AES_KEY192_LENGTH) && (KeyLength != AES_KEY256_LENGTH)) {
-	DBGPRINT(RT_DEBUG_ERROR, ("AES_Encrypt: key length is %d bytes, it must be %d, %d, or %d bytes(128, 192, or 256 bits).\n",
-            KeyLength, AES_KEY128_LENGTH, AES_KEY192_LENGTH, AES_KEY256_LENGTH));
-        return;
-    } /* End of if */
-    if (*CipherBlockSize < AES_BLOCK_SIZES) {
-	DBGPRINT(RT_DEBUG_ERROR, ("AES_Encrypt: cipher block size is %d bytes, it must be %d bytes(128 bits).\n",
-            *CipherBlockSize, AES_BLOCK_SIZES));
-        return;
-    } /* End of if */
-
-    /*
-     * 2. Transfer the plain block to state block
-     */
-    for (RowIndex = 0; RowIndex < AES_STATE_ROWS;RowIndex++)
-        for (ColumnIndex = 0; ColumnIndex < AES_STATE_COLUMNS;ColumnIndex++)
-            aes_ctx.State[RowIndex][ColumnIndex] = PlainBlock[RowIndex + 4*ColumnIndex];
-
-    /*
-     *  3. Main encryption rounds
-     */
-    AES_KeyExpansion(Key, KeyLength, &aes_ctx);
-    NumberOfRound = (KeyLength >> 2) + 6;
-
-    /* AES_AddRoundKey */
-    RoundIndex = 0;
-    for (RowIndex = 0; RowIndex < AES_STATE_ROWS;RowIndex++)
-        for (ColumnIndex = 0; ColumnIndex < AES_STATE_COLUMNS;ColumnIndex++)
-            aes_ctx.State[RowIndex][ColumnIndex] ^= aes_ctx.KeyWordExpansion[RowIndex][(RoundIndex*((UINT) AES_STATE_COLUMNS)) + ColumnIndex];
-
-    for (RoundIndex = 1; RoundIndex < NumberOfRound;RoundIndex++)
-    {
-        /* AES_SubBytes */
-        for (RowIndex = 0; RowIndex < AES_STATE_ROWS;RowIndex++)
-            for (ColumnIndex = 0; ColumnIndex < AES_STATE_COLUMNS;ColumnIndex++)
-                aes_ctx.State[RowIndex][ColumnIndex] = aes_sbox_enc[aes_ctx.State[RowIndex][ColumnIndex]];
-
-        /* AES_ShiftRows */
-        Temp = aes_ctx.State[1][0];
-        aes_ctx.State[1][0] = aes_ctx.State[1][1];
-        aes_ctx.State[1][1] = aes_ctx.State[1][2];
-        aes_ctx.State[1][2] = aes_ctx.State[1][3];
-        aes_ctx.State[1][3] = Temp;
-        Temp = aes_ctx.State[2][0];
-        aes_ctx.State[2][0] = aes_ctx.State[2][2];
-        aes_ctx.State[2][2] = Temp;
-        Temp = aes_ctx.State[2][1];
-        aes_ctx.State[2][1] = aes_ctx.State[2][3];
-        aes_ctx.State[2][3] = Temp;
-        Temp = aes_ctx.State[3][3];
-        aes_ctx.State[3][3] = aes_ctx.State[3][2];
-        aes_ctx.State[3][2] = aes_ctx.State[3][1];
-        aes_ctx.State[3][1] = aes_ctx.State[3][0];
-        aes_ctx.State[3][0] = Temp;
-
-        /* AES_MixColumns */
-        for (ColumnIndex = 0; ColumnIndex < AES_STATE_COLUMNS;ColumnIndex++)
-        {
-            Row0 = aes_ctx.State[0][ColumnIndex];
-            Row1 = aes_ctx.State[1][ColumnIndex];
-            Row2 = aes_ctx.State[2][ColumnIndex];
-            Row3 = aes_ctx.State[3][ColumnIndex];
-            aes_ctx.State[0][ColumnIndex] = aes_mul_2[Row0]^aes_mul_3[Row1]^Row2^Row3;
-            aes_ctx.State[1][ColumnIndex] = Row0^aes_mul_2[Row1]^aes_mul_3[Row2]^Row3;
-            aes_ctx.State[2][ColumnIndex] = Row0^Row1^aes_mul_2[Row2]^aes_mul_3[Row3];
-            aes_ctx.State[3][ColumnIndex] = aes_mul_3[Row0]^Row1^Row2^aes_mul_2[Row3];
-        }
-
-        /* AES_AddRoundKey */
-        for (RowIndex = 0; RowIndex < AES_STATE_ROWS;RowIndex++)
-            for (ColumnIndex = 0; ColumnIndex < AES_STATE_COLUMNS;ColumnIndex++)
-                aes_ctx.State[RowIndex][ColumnIndex] ^= aes_ctx.KeyWordExpansion[RowIndex][(RoundIndex*((UINT) AES_STATE_COLUMNS)) + ColumnIndex];
-    } /* End of for */
-
-    /* AES_SubBytes */
-    for (RowIndex = 0; RowIndex < AES_STATE_ROWS;RowIndex++)
-        for (ColumnIndex = 0; ColumnIndex < AES_STATE_COLUMNS;ColumnIndex++)
-            aes_ctx.State[RowIndex][ColumnIndex] = aes_sbox_enc[aes_ctx.State[RowIndex][ColumnIndex]];
-    /* AES_ShiftRows */
-    Temp = aes_ctx.State[1][0];
-    aes_ctx.State[1][0] = aes_ctx.State[1][1];
-    aes_ctx.State[1][1] = aes_ctx.State[1][2];
-    aes_ctx.State[1][2] = aes_ctx.State[1][3];
-    aes_ctx.State[1][3] = Temp;
-    Temp = aes_ctx.State[2][0];
-    aes_ctx.State[2][0] = aes_ctx.State[2][2];
-    aes_ctx.State[2][2] = Temp;
-    Temp = aes_ctx.State[2][1];
-    aes_ctx.State[2][1] = aes_ctx.State[2][3];
-    aes_ctx.State[2][3] = Temp;
-    Temp = aes_ctx.State[3][3];
-    aes_ctx.State[3][3] = aes_ctx.State[3][2];
-    aes_ctx.State[3][2] = aes_ctx.State[3][1];
-    aes_ctx.State[3][1] = aes_ctx.State[3][0];
-    aes_ctx.State[3][0] = Temp;
-    /* AES_AddRoundKey */
-    for (RowIndex = 0; RowIndex < AES_STATE_ROWS;RowIndex++)
-        for (ColumnIndex = 0; ColumnIndex < AES_STATE_COLUMNS;ColumnIndex++)
-            aes_ctx.State[RowIndex][ColumnIndex] ^= aes_ctx.KeyWordExpansion[RowIndex][(RoundIndex*((UINT) AES_STATE_COLUMNS)) + ColumnIndex];
-
-    /*
-     * 4. Transfer the state block to cipher block
-     */
-    for (RowIndex = 0; RowIndex < AES_STATE_ROWS;RowIndex++)
-        for (ColumnIndex = 0; ColumnIndex < AES_STATE_COLUMNS;ColumnIndex++)
-            CipherBlock[RowIndex + 4*ColumnIndex] = aes_ctx.State[RowIndex][ColumnIndex];
-
-    *CipherBlockSize = ((UINT) AES_STATE_ROWS)*((UINT) AES_STATE_COLUMNS);
-} /* End of AES_Encrypt */
-
-
-/*
-========================================================================
-Routine Description:
-    AES decryption
-
-Arguments:
-    CipherBlock      The block of cipher text, 16 bytes(128 bits) each block
-    CipherBlockSize  The length of block of cipher text in bytes
-    Key              Cipher key, it may be 16, 24, or 32 bytes (128, 192, or 256 bits)
-    KeyLength        The length of cipher key in bytes
-    PlainBlockSize   The length of allocated plain block in bytes
-
-Return Value:
-    PlainBlock       Return plain text
-    PlainBlockSize  Return the length of real used plain block in bytes
-
-Note:
-    Reference to FIPS-PUB 197
-    1. Check if block size is 16 bytes(128 bits) and if key length is 16, 24, or 32 bytes(128, 192, or 256 bits)
-    2. Transfer the cipher block to state block
-    3. Main decryption rounds
-    4. Transfer the state block to plain block
-    ------------------------------------------
-       NumberOfRound = (key length / 4) + 6;
-       state block = cipher block;
-
-       AddRoundKey(state block, key);
-       for round = NumberOfRound to 1
-           InvSubBytes(state block)
-           InvShiftRows(state block)
-           InvMixColumns(state block)
-           AddRoundKey(state block, key);
-       end for
-
-       InvSubBytes(state block)
-       InvShiftRows(state block)
-       AddRoundKey(state block, key);
-
-       plain block = state block;
-========================================================================
-*/
-VOID AES_Decrypt (
-    IN UINT8 CipherBlock[],
-    IN UINT CipherBlockSize,
-    IN UINT8 Key[],
-    IN UINT KeyLength,
-    OUT UINT8 PlainBlock[],
-    INOUT UINT *PlainBlockSize)
-{
-    AES_CTX_STRUC aes_ctx;
-    UINT RowIndex, ColumnIndex;
-    UINT RoundIndex, NumberOfRound = 0;
-    UINT8 Temp, Row0, Row1, Row2, Row3;
-
-    /*
-     * 1. Check if block size is 16 bytes(128 bits) and if key length is 16, 24, or 32 bytes(128, 192, or 256 bits)
-     */
-    if (*PlainBlockSize < AES_BLOCK_SIZES) {
-	DBGPRINT(RT_DEBUG_ERROR, ("AES_Decrypt: plain block size is %d bytes, it must be %d bytes(128 bits).\n",
-            *PlainBlockSize, AES_BLOCK_SIZES));
-        return;
-    } /* End of if */
-    if ((KeyLength != AES_KEY128_LENGTH) && (KeyLength != AES_KEY192_LENGTH) && (KeyLength != AES_KEY256_LENGTH)) {
-	DBGPRINT(RT_DEBUG_ERROR, ("AES_Decrypt: key length is %d bytes, it must be %d, %d, or %d bytes(128, 192, or 256 bits).\n",
-            KeyLength, AES_KEY128_LENGTH, AES_KEY192_LENGTH, AES_KEY256_LENGTH));
-        return;
-    } /* End of if */
-    if (CipherBlockSize != AES_BLOCK_SIZES) {
-	DBGPRINT(RT_DEBUG_ERROR, ("AES_Decrypt: cipher block size is %d bytes, it must be %d bytes(128 bits).\n",
-            CipherBlockSize, AES_BLOCK_SIZES));
-        return;
-    } /* End of if */
-
-    /*
-     * 2. Transfer the cipher block to state block
-     */
-    for (RowIndex = 0; RowIndex < AES_STATE_ROWS;RowIndex++)
-        for (ColumnIndex = 0; ColumnIndex < AES_STATE_COLUMNS;ColumnIndex++)
-            aes_ctx.State[RowIndex][ColumnIndex] = CipherBlock[RowIndex + 4*ColumnIndex];
-
-    /*
-     *  3. Main decryption rounds
-     */
-    AES_KeyExpansion(Key, KeyLength, &aes_ctx);
-    NumberOfRound = (KeyLength >> 2) + 6;
-
-    /* AES_AddRoundKey */
-    RoundIndex = NumberOfRound;
-    for (RowIndex = 0; RowIndex < AES_STATE_ROWS;RowIndex++)
-        for (ColumnIndex = 0; ColumnIndex < AES_STATE_COLUMNS;ColumnIndex++)
-            aes_ctx.State[RowIndex][ColumnIndex] ^= aes_ctx.KeyWordExpansion[RowIndex][(RoundIndex*((UINT) AES_STATE_COLUMNS)) + ColumnIndex];
-
-    for (RoundIndex = (NumberOfRound - 1); RoundIndex > 0 ;RoundIndex--)
-    {
-        /* AES_InvShiftRows */
-        Temp = aes_ctx.State[1][3];
-        aes_ctx.State[1][3] = aes_ctx.State[1][2];
-        aes_ctx.State[1][2] = aes_ctx.State[1][1];
-        aes_ctx.State[1][1] = aes_ctx.State[1][0];
-        aes_ctx.State[1][0] = Temp;
-        Temp = aes_ctx.State[2][0];
-        aes_ctx.State[2][0] = aes_ctx.State[2][2];
-        aes_ctx.State[2][2] = Temp;
-        Temp = aes_ctx.State[2][1];
-        aes_ctx.State[2][1] = aes_ctx.State[2][3];
-        aes_ctx.State[2][3] = Temp;
-        Temp = aes_ctx.State[3][0];
-        aes_ctx.State[3][0] = aes_ctx.State[3][1];
-        aes_ctx.State[3][1] = aes_ctx.State[3][2];
-        aes_ctx.State[3][2] = aes_ctx.State[3][3];
-        aes_ctx.State[3][3] = Temp;
-
-        /* AES_InvSubBytes */
-        for (RowIndex = 0; RowIndex < AES_STATE_ROWS;RowIndex++)
-            for (ColumnIndex = 0; ColumnIndex < AES_STATE_COLUMNS;ColumnIndex++)
-                aes_ctx.State[RowIndex][ColumnIndex] = aes_sbox_dec[aes_ctx.State[RowIndex][ColumnIndex]];
-
-        /* AES_AddRoundKey */
-        for (RowIndex = 0; RowIndex < AES_STATE_ROWS;RowIndex++)
-            for (ColumnIndex = 0; ColumnIndex < AES_STATE_COLUMNS;ColumnIndex++)
-                aes_ctx.State[RowIndex][ColumnIndex] ^= aes_ctx.KeyWordExpansion[RowIndex][(RoundIndex*((UINT) AES_STATE_COLUMNS)) + ColumnIndex];
-
-        /* AES_InvMixColumns */
-        for (ColumnIndex = 0; ColumnIndex < AES_STATE_COLUMNS;ColumnIndex++)
-        {
-            Row0 = aes_ctx.State[0][ColumnIndex];
-            Row1 = aes_ctx.State[1][ColumnIndex];
-            Row2 = aes_ctx.State[2][ColumnIndex];
-            Row3 = aes_ctx.State[3][ColumnIndex];
-            aes_ctx.State[0][ColumnIndex] = aes_mul_e[Row0]^aes_mul_b[Row1]^aes_mul_d[Row2]^aes_mul_9[Row3];
-            aes_ctx.State[1][ColumnIndex] = aes_mul_9[Row0]^aes_mul_e[Row1]^aes_mul_b[Row2]^aes_mul_d[Row3];
-            aes_ctx.State[2][ColumnIndex] = aes_mul_d[Row0]^aes_mul_9[Row1]^aes_mul_e[Row2]^aes_mul_b[Row3];
-            aes_ctx.State[3][ColumnIndex] = aes_mul_b[Row0]^aes_mul_d[Row1]^aes_mul_9[Row2]^aes_mul_e[Row3];
-        }
-    } /* End of for */
-
-    /* AES_InvShiftRows */
-    Temp = aes_ctx.State[1][3];
-    aes_ctx.State[1][3] = aes_ctx.State[1][2];
-    aes_ctx.State[1][2] = aes_ctx.State[1][1];
-    aes_ctx.State[1][1] = aes_ctx.State[1][0];
-    aes_ctx.State[1][0] = Temp;
-    Temp = aes_ctx.State[2][0];
-    aes_ctx.State[2][0] = aes_ctx.State[2][2];
-    aes_ctx.State[2][2] = Temp;
-    Temp = aes_ctx.State[2][1];
-    aes_ctx.State[2][1] = aes_ctx.State[2][3];
-    aes_ctx.State[2][3] = Temp;
-    Temp = aes_ctx.State[3][0];
-    aes_ctx.State[3][0] = aes_ctx.State[3][1];
-    aes_ctx.State[3][1] = aes_ctx.State[3][2];
-    aes_ctx.State[3][2] = aes_ctx.State[3][3];
-    aes_ctx.State[3][3] = Temp;
-    /* AES_InvSubBytes */
-    for (RowIndex = 0; RowIndex < AES_STATE_ROWS;RowIndex++)
-        for (ColumnIndex = 0; ColumnIndex < AES_STATE_COLUMNS;ColumnIndex++)
-            aes_ctx.State[RowIndex][ColumnIndex] = aes_sbox_dec[aes_ctx.State[RowIndex][ColumnIndex]];
-    /* AES_AddRoundKey */
-    for (RowIndex = 0; RowIndex < AES_STATE_ROWS;RowIndex++)
-        for (ColumnIndex = 0; ColumnIndex < AES_STATE_COLUMNS;ColumnIndex++)
-            aes_ctx.State[RowIndex][ColumnIndex] ^= aes_ctx.KeyWordExpansion[RowIndex][(RoundIndex*((UINT) AES_STATE_COLUMNS)) + ColumnIndex];
-
-    /*
-     * 4. Transfer the state block to plain block
-     */
-    for (RowIndex = 0; RowIndex < AES_STATE_ROWS;RowIndex++)
-        for (ColumnIndex = 0; ColumnIndex < AES_STATE_COLUMNS;ColumnIndex++)
-            PlainBlock[RowIndex + 4*ColumnIndex] = aes_ctx.State[RowIndex][ColumnIndex];
-
-    *PlainBlockSize = ((UINT) AES_STATE_ROWS)*((UINT) AES_STATE_COLUMNS);
-} /* End of AES_Decrypt */
-
-
-/*
-========================================================================
-Routine Description:
-    AES-CBC encryption
-
-Arguments:
-    PlainText        Plain text
-    PlainTextLength  The length of plain text in bytes
-    Key              Cipher key, it may be 16, 24, or 32 bytes (128, 192, or 256 bits)
-    KeyLength        The length of cipher key in bytes
-    IV               Initialization vector, it may be 16 bytes (128 bits)
-    IVLength         The length of initialization vector in bytes
-    CipherTextLength The length of allocated cipher text in bytes
-
-Return Value:
-    CipherText       Return cipher text
-    CipherTextLength Return the length of real used cipher text in bytes
-
-Note:
-    Reference to RFC 3602 and NIST 800-38A
-========================================================================
-*/
-VOID AES_CBC_Encrypt (
-    IN UINT8 PlainText[],
-    IN UINT PlainTextLength,
-    IN UINT8 Key[],
-    IN UINT KeyLength,
-    IN UINT8 IV[],
-    IN UINT IVLength,
-    OUT UINT8 CipherText[],
-    INOUT UINT *CipherTextLength)
-{
-    UINT PaddingSize, PlainBlockStart, CipherBlockStart, CipherBlockSize;
-    UINT Index;
-    UINT8 Block[AES_BLOCK_SIZES];
-
-    /*
-     * 1. Check the input parameters
-     *    - CipherTextLength > (PlainTextLength + Padding size), Padding size = block size - (PlainTextLength % block size)
-     *    - Key length must be 16, 24, or 32 bytes(128, 192, or 256 bits)
-     *    - IV length must be 16 bytes(128 bits)
-     */
-    PaddingSize = ((UINT) AES_BLOCK_SIZES) - (PlainTextLength % ((UINT)AES_BLOCK_SIZES));
-    if (*CipherTextLength < (PlainTextLength + PaddingSize)) {
-	DBGPRINT(RT_DEBUG_ERROR, ("AES_CBC_Encrypt: cipher text length is %d bytes < (plain text length %d bytes + padding size %d bytes).\n",
-            *CipherTextLength, PlainTextLength, PaddingSize));
-        return;
-    } /* End of if */
-    if ((KeyLength != AES_KEY128_LENGTH) && (KeyLength != AES_KEY192_LENGTH) && (KeyLength != AES_KEY256_LENGTH)) {
-	DBGPRINT(RT_DEBUG_ERROR, ("AES_CBC_Encrypt: key length is %d bytes, it must be %d, %d, or %d bytes(128, 192, or 256 bits).\n",
-            KeyLength, AES_KEY128_LENGTH, AES_KEY192_LENGTH, AES_KEY256_LENGTH));
-        return;
-    } /* End of if */
-    if (IVLength != AES_CBC_IV_LENGTH) {
-	DBGPRINT(RT_DEBUG_ERROR, ("AES_CBC_Encrypt: IV length is %d bytes, it must be %d bytes(128bits).\n",
-            IVLength, AES_CBC_IV_LENGTH));
-        return;
-    } /* End of if */
-
-
-    /*
-     * 2. Main algorithm
-     *    - Plain text divide into serveral blocks (16 bytes/block)
-     *    - If plain text is divided with no remainder by block, add a new block and padding size = block(16 bytes)
-     *    - If plain text is not divided with no remainder by block, padding size = (block - remainder plain text)
-     *    - Execute AES_Encrypt procedure.
-     *
-     *    - Padding method: The remainder bytes will be filled with padding size (1 byte)
-     */
-    PlainBlockStart = 0;
-    CipherBlockStart = 0;
-    while ((PlainTextLength - PlainBlockStart) >= AES_BLOCK_SIZES)
-    {
-        if (CipherBlockStart == 0) {
-            for (Index = 0; Index < AES_BLOCK_SIZES; Index++)
-                Block[Index] = PlainText[PlainBlockStart + Index]^IV[Index];
-        } else {
-            for (Index = 0; Index < AES_BLOCK_SIZES; Index++)
-                Block[Index] = PlainText[PlainBlockStart + Index]^CipherText[CipherBlockStart - ((UINT) AES_BLOCK_SIZES) + Index];
-        } /* End of if */
-
-        CipherBlockSize = *CipherTextLength - CipherBlockStart;
-        AES_Encrypt(Block, AES_BLOCK_SIZES , Key, KeyLength, CipherText + CipherBlockStart, &CipherBlockSize);
-
-        PlainBlockStart += ((UINT) AES_BLOCK_SIZES);
-        CipherBlockStart += CipherBlockSize;
-    } /* End of while */
-
-    NdisMoveMemory(Block, (&PlainText[0] + PlainBlockStart), (PlainTextLength - PlainBlockStart));
-    NdisFillMemory((Block + (((UINT) AES_BLOCK_SIZES) -PaddingSize)), PaddingSize, (UINT8) PaddingSize);
-    if (CipherBlockStart == 0) {
-       for (Index = 0; Index < AES_BLOCK_SIZES; Index++)
-           Block[Index] ^= IV[Index];
-    } else {
-       for (Index = 0; Index < AES_BLOCK_SIZES; Index++)
-           Block[Index] ^= CipherText[CipherBlockStart - ((UINT) AES_BLOCK_SIZES) + Index];
-    } /* End of if */
-    CipherBlockSize = *CipherTextLength - CipherBlockStart;
-    AES_Encrypt(Block, AES_BLOCK_SIZES , Key, KeyLength, CipherText + CipherBlockStart, &CipherBlockSize);
-    CipherBlockStart += CipherBlockSize;
-    *CipherTextLength = CipherBlockStart;
-} /* End of AES_CBC_Encrypt */
-
-
-/*
-========================================================================
-Routine Description:
-    AES-CBC decryption
-
-Arguments:
-    CipherText       Cipher text
-    CipherTextLength The length of cipher text in bytes
-    Key              Cipher key, it may be 16, 24, or 32 bytes (128, 192, or 256 bits)
-    KeyLength        The length of cipher key in bytes
-    IV               Initialization vector, it may be 16 bytes (128 bits)
-    IVLength         The length of initialization vector in bytes
-    PlainTextLength  The length of allocated plain text in bytes
-
-Return Value:
-    PlainText        Return plain text
-    PlainTextLength  Return the length of real used plain text in bytes
-
-Note:
-    Reference to RFC 3602 and NIST 800-38A
-========================================================================
-*/
-VOID AES_CBC_Decrypt (
-    IN UINT8 CipherText[],
-    IN UINT CipherTextLength,
-    IN UINT8 Key[],
-    IN UINT KeyLength,
-    IN UINT8 IV[],
-    IN UINT IVLength,
-    OUT UINT8 PlainText[],
-    INOUT UINT *PlainTextLength)
-{
-    UINT PaddingSize, PlainBlockStart, CipherBlockStart, PlainBlockSize;
-    UINT Index;
-
-    /*
-     * 1. Check the input parameters
-     *    - CipherTextLength must be divided with no remainder by block
-     *    - Key length must be 16, 24, or 32 bytes(128, 192, or 256 bits)
-     *    - IV length must be 16 bytes(128 bits)
-     */
-    if ((CipherTextLength % AES_BLOCK_SIZES) != 0) {
-	DBGPRINT(RT_DEBUG_ERROR, ("AES_CBC_Decrypt: cipher text length is %d bytes, it can't be divided with no remainder by block size(%d).\n",
-            CipherTextLength, AES_BLOCK_SIZES));
-        return;
-    } /* End of if */
-    if ((KeyLength != AES_KEY128_LENGTH) && (KeyLength != AES_KEY192_LENGTH) && (KeyLength != AES_KEY256_LENGTH)) {
-	DBGPRINT(RT_DEBUG_ERROR, ("AES_CBC_Decrypt: key length is %d bytes, it must be %d, %d, or %d bytes(128, 192, or 256 bits).\n",
-            KeyLength, AES_KEY128_LENGTH, AES_KEY192_LENGTH, AES_KEY256_LENGTH));
-        return;
-    } /* End of if */
-    if (IVLength != AES_CBC_IV_LENGTH) {
-	DBGPRINT(RT_DEBUG_ERROR, ("AES_CBC_Decrypt: IV length is %d bytes, it must be %d bytes(128bits).\n",
-            IVLength, AES_CBC_IV_LENGTH));
-        return;
-    } /* End of if */
-
-
-    /*
-     * 2. Main algorithm
-     *    - Cypher text divide into serveral blocks (16 bytes/block)
-     *    - Execute AES_Decrypt procedure.
-     *    - Remove padding bytes, padding size is the last byte of plain text
-     */
-    CipherBlockStart = 0;
-    PlainBlockStart = 0;
-    while ((CipherTextLength - CipherBlockStart) >= AES_BLOCK_SIZES)
-    {
-        PlainBlockSize = *PlainTextLength - PlainBlockStart;
-        AES_Decrypt(CipherText + CipherBlockStart, AES_BLOCK_SIZES , Key, KeyLength, PlainText + PlainBlockStart, &PlainBlockSize);
-
-        if (PlainBlockStart == 0) {
-            for (Index = 0; Index < AES_BLOCK_SIZES; Index++)
-                PlainText[PlainBlockStart + Index] ^= IV[Index];
-        } else {
-            for (Index = 0; Index < AES_BLOCK_SIZES; Index++)
-                PlainText[PlainBlockStart + Index] ^= CipherText[CipherBlockStart + Index - ((UINT) AES_BLOCK_SIZES)];
-        } /* End of if */
-
-        CipherBlockStart += AES_BLOCK_SIZES;
-        PlainBlockStart += PlainBlockSize;
-    } /* End of while */
-
-    PaddingSize = (UINT8) PlainText[PlainBlockStart -1];
-    *PlainTextLength = PlainBlockStart - PaddingSize;
-
-} /* End of AES_CBC_Encrypt */
-
-
-
-/*
-========================================================================
-Routine Description:
-    AES-CMAC generate subkey
-
-Arguments:
-    Key        Cipher key 128 bits
-    KeyLength  The length of Cipher key in bytes
-
-Return Value:
-    SubKey1    SubKey 1 128 bits
-    SubKey2    SubKey 2 128 bits
-
-Note:
-    Reference to RFC 4493
-
-    Step 1.  L := AES-128(K, const_Zero);
-    Step 2.  if MSB(L) is equal to 0
-                then    K1 := L << 1;
-                else    K1 := (L << 1) XOR const_Rb;
-    Step 3.  if MSB(K1) is equal to 0
-                then    K2 := K1 << 1;
-                else    K2 := (K1 << 1) XOR const_Rb;
-    Step 4.  return K1, K2;
-========================================================================
-*/
-VOID AES_CMAC_GenerateSubKey (
-    IN UINT8 Key[],
-    IN UINT KeyLength,
-    OUT UINT8 SubKey1[],
-    OUT UINT8 SubKey2[])
-{
-    UINT8 MSB_L = 0, MSB_K1 = 0, Top_Bit = 0;
-    UINT  SubKey1_Length = 0;
-    INT   Index = 0;
-
-    if (KeyLength != AES_KEY128_LENGTH) {
-	DBGPRINT(RT_DEBUG_ERROR, ("AES_CMAC_GenerateSubKey: key length is %d bytes, it must be %d bytes(128 bits).\n",
-            KeyLength, AES_KEY128_LENGTH));
-        return;
-    } /* End of if */
-
-    /* Step 1: L := AES-128(K, const_Zero); */
-    SubKey1_Length = 16;
-    AES_Encrypt(Const_Zero, sizeof(Const_Zero), Key, KeyLength, SubKey1, &SubKey1_Length);
-
-    /*
-     * Step 2.  if MSB(L) is equal to 0
-     *           then    K1 := L << 1;
-     *           else    K1 := (L << 1) XOR const_Rb;
-     */
-    MSB_L = SubKey1[0] & 0x80;
-    for(Index = 0; Index < 15; Index++) {
-        Top_Bit = (SubKey1[Index + 1] & 0x80)?1:0;
-        SubKey1[Index] <<= 1;
-        SubKey1[Index] |= Top_Bit;
-    }
-    SubKey1[15] <<= 1;
-    if (MSB_L > 0) {
-        for(Index = 0; Index < 16; Index++)
-            SubKey1[Index] ^= Const_Rb[Index];
-    } /* End of if */
-
-    /*
-     * Step 3.  if MSB(K1) is equal to 0
-     *           then    K2 := K1 << 1;
-     *           else    K2 := (K1 << 1) XOR const_Rb;
-     */
-    MSB_K1 = SubKey1[0] & 0x80;
-    for(Index = 0; Index < 15; Index++) {
-        Top_Bit = (SubKey1[Index + 1] & 0x80)?1:0;
-        SubKey2[Index] = SubKey1[Index] << 1;
-        SubKey2[Index] |= Top_Bit;
-    }
-    SubKey2[15] = SubKey1[15] << 1;
-    if (MSB_K1 > 0) {
-        for(Index = 0; Index < 16; Index++)
-            SubKey2[Index] ^= Const_Rb[Index];
-    } /* End of if */
-} /* End of AES_CMAC_GenerateSubKey */
-
-
-/*
-========================================================================
-Routine Description:
-    AES-CMAC
-
-Arguments:
-    PlainText        Plain text
-    PlainTextLength  The length of plain text in bytes
-    Key              Cipher key, it may be 16, 24, or 32 bytes (128, 192, or 256 bits)
-    KeyLength        The length of cipher key in bytes
-    MACTextLength    The length of allocated memory spaces in bytes
-
-Return Value:
-    MACText       Message authentication code (128-bit string)
-    MACTextLength Return the length of Message authentication code in bytes
-
-Note:
-    Reference to RFC 4493
-========================================================================
-*/
-VOID AES_CMAC (
-    IN UINT8 PlainText[],
-    IN UINT PlainTextLength,
-    IN UINT8 Key[],
-    IN UINT KeyLength,
-    OUT UINT8 MACText[],
-    INOUT UINT *MACTextLength)
-{
-    UINT  PlainBlockStart;
-    UINT8 X[AES_BLOCK_SIZES], Y[AES_BLOCK_SIZES];
-    UINT8 SubKey1[16];
-    UINT8 SubKey2[16];
-    INT X_Length, Index;
-
-    if (*MACTextLength < AES_MAC_LENGTH) {
-	DBGPRINT(RT_DEBUG_ERROR, ("AES_CMAC: MAC text length is less than %d bytes).\n",
-            AES_MAC_LENGTH));
-        return;
-    } /* End of if */
-    if (KeyLength != AES_KEY128_LENGTH) {
-	DBGPRINT(RT_DEBUG_ERROR, ("AES_CMAC: key length is %d bytes, it must be %d bytes(128 bits).\n",
-            KeyLength, AES_KEY128_LENGTH));
-        return;
-    } /* End of if */
-
-    /* Step 1.  (K1,K2) := Generate_Subkey(K); */
-    NdisZeroMemory(SubKey1, 16);
-    NdisZeroMemory(SubKey2, 16);
-    AES_CMAC_GenerateSubKey(Key, KeyLength, SubKey1, SubKey2);
-
-    /*
-     * 2. Main algorithm
-     *    - Plain text divide into serveral blocks (16 bytes/block)
-     *    - If plain text is not divided with no remainder by block, padding size = (block - remainder plain text)
-     *    - Execute AES_Encrypt procedure.
-     */
-    PlainBlockStart = 0;
-    NdisMoveMemory(X, Const_Zero, AES_BLOCK_SIZES);
-    while ((PlainTextLength - PlainBlockStart) > AES_BLOCK_SIZES)
-    {
-        for (Index = 0; Index < AES_BLOCK_SIZES; Index++)
-                Y[Index] = PlainText[PlainBlockStart + Index]^X[Index];
-
-        X_Length = sizeof(X);
-        AES_Encrypt(Y, sizeof(Y) , Key, KeyLength, X, &X_Length);
-        PlainBlockStart += ((UINT) AES_BLOCK_SIZES);
-    } /* End of while */
-    if ((PlainTextLength - PlainBlockStart) == AES_BLOCK_SIZES) {
-        for (Index = 0; Index < AES_BLOCK_SIZES; Index++)
-                Y[Index] = PlainText[PlainBlockStart + Index]^X[Index]^SubKey1[Index];
-    } else {
-        NdisZeroMemory(Y, AES_BLOCK_SIZES);
-        NdisMoveMemory(Y, &PlainText[PlainBlockStart], (PlainTextLength - PlainBlockStart));
-        Y[(PlainTextLength - PlainBlockStart)] = 0x80;
-        for (Index = 0; Index < AES_BLOCK_SIZES; Index++)
-                Y[Index] = Y[Index]^X[Index]^SubKey2[Index];
-    } /* End of if */
-    AES_Encrypt(Y, sizeof(Y) , Key, KeyLength, MACText, MACTextLength);
-} /* End of AES_CMAC */
diff --git a/drivers/staging/rt3090/common/crypt_biginteger.c b/drivers/staging/rt3090/common/crypt_biginteger.c
deleted file mode 100644
index b346c5f7fbd0..000000000000
--- a/drivers/staging/rt3090/common/crypt_biginteger.c
+++ /dev/null
@@ -1,1119 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-    Module Name:
-	cmm_profile.c
-
-    Abstract:
-
-    Revision History:
-    Who          When          What
-    ---------    ----------    ----------------------------------------------
- */
-
-#include "crypt_biginteger.h"
-
-#ifdef __KERNEL__
-#define DEBUGPRINT(fmt, args...) printk(KERN_ERR fmt, ## args)
-#else
-#define DEBUGPRINT(fmt, args...) printf(fmt, ## args)
-#endif /* __KERNEL__ */
-
-#define UINT32_HBITS(value)	(((value) >> 0x10) & 0xffff)
-#define UINT32_LBITS(value)	((value) & 0xffff)
-#define UINT32_GETBYTE(value, index)	(((value) >> ((index)*8)) & 0xff)
-#define UINT64_HBITS(value)	(((value) >> 0x20) & 0xffffffff)
-#define UINT64_LBITS(value)	((value) & 0xffffffff)
-
-static UINT8 WPS_DH_P_VALUE[192] =
-{
-    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
-    0xC9, 0x0F, 0xDA, 0xA2, 0x21, 0x68, 0xC2, 0x34,
-    0xC4, 0xC6, 0x62, 0x8B, 0x80, 0xDC, 0x1C, 0xD1,
-    0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC, 0x74,
-    0x02, 0x0B, 0xBE, 0xA6, 0x3B, 0x13, 0x9B, 0x22,
-    0x51, 0x4A, 0x08, 0x79, 0x8E, 0x34, 0x04, 0xDD,
-    0xEF, 0x95, 0x19, 0xB3, 0xCD, 0x3A, 0x43, 0x1B,
-    0x30, 0x2B, 0x0A, 0x6D, 0xF2, 0x5F, 0x14, 0x37,
-    0x4F, 0xE1, 0x35, 0x6D, 0x6D, 0x51, 0xC2, 0x45,
-    0xE4, 0x85, 0xB5, 0x76, 0x62, 0x5E, 0x7E, 0xC6,
-    0xF4, 0x4C, 0x42, 0xE9, 0xA6, 0x37, 0xED, 0x6B,
-    0x0B, 0xFF, 0x5C, 0xB6, 0xF4, 0x06, 0xB7, 0xED,
-    0xEE, 0x38, 0x6B, 0xFB, 0x5A, 0x89, 0x9F, 0xA5,
-    0xAE, 0x9F, 0x24, 0x11, 0x7C, 0x4B, 0x1F, 0xE6,
-    0x49, 0x28, 0x66, 0x51, 0xEC, 0xE4, 0x5B, 0x3D,
-    0xC2, 0x00, 0x7C, 0xB8, 0xA1, 0x63, 0xBF, 0x05,
-    0x98, 0xDA, 0x48, 0x36, 0x1C, 0x55, 0xD3, 0x9A,
-    0x69, 0x16, 0x3F, 0xA8, 0xFD, 0x24, 0xCF, 0x5F,
-    0x83, 0x65, 0x5D, 0x23, 0xDC, 0xA3, 0xAD, 0x96,
-    0x1C, 0x62, 0xF3, 0x56, 0x20, 0x85, 0x52, 0xBB,
-    0x9E, 0xD5, 0x29, 0x07, 0x70, 0x96, 0x96, 0x6D,
-    0x67, 0x0C, 0x35, 0x4E, 0x4A, 0xBC, 0x98, 0x04,
-    0xF1, 0x74, 0x6C, 0x08, 0xCA, 0x23, 0x73, 0x27,
-    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
-};
-
-static UINT8 WPS_DH_R_VALUE[193] =
-{
-    0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00,
-};
-
-static UINT8 WPS_DH_X_VALUE[184] =
-{
-    0x36, 0xf0, 0x25, 0x5d, 0xde, 0x97, 0x3d, 0xcb,
-    0x3b, 0x39, 0x9d, 0x74, 0x7f, 0x23, 0xe3, 0x2e,
-    0xd6, 0xfd, 0xb1, 0xf7, 0x75, 0x98, 0x33, 0x8b,
-    0xfd, 0xf4, 0x41, 0x59, 0xc4, 0xec, 0x64, 0xdd,
-    0xae, 0xb5, 0xf7, 0x86, 0x71, 0xcb, 0xfb, 0x22,
-    0x10, 0x6a, 0xe6, 0x4c, 0x32, 0xc5, 0xbc, 0xe4,
-    0xcf, 0xd4, 0xf5, 0x92, 0x0d, 0xa0, 0xeb, 0xc8,
-    0xb0, 0x1e, 0xca, 0x92, 0x92, 0xae, 0x3d, 0xba,
-    0x1b, 0x7a, 0x4a, 0x89, 0x9d, 0xa1, 0x81, 0x39,
-    0x0b, 0xb3, 0xbd, 0x16, 0x59, 0xc8, 0x12, 0x94,
-    0xf4, 0x00, 0xa3, 0x49, 0x0b, 0xf9, 0x48, 0x12,
-    0x11, 0xc7, 0x94, 0x04, 0xa5, 0x76, 0x60, 0x5a,
-    0x51, 0x60, 0xdb, 0xee, 0x83, 0xb4, 0xe0, 0x19,
-    0xb6, 0xd7, 0x99, 0xae, 0x13, 0x1b, 0xa4, 0xc2,
-    0x3d, 0xff, 0x83, 0x47, 0x5e, 0x9c, 0x40, 0xfa,
-    0x67, 0x25, 0xb7, 0xc9, 0xe3, 0xaa, 0x2c, 0x65,
-    0x96, 0xe9, 0xc0, 0x57, 0x02, 0xdb, 0x30, 0xa0,
-    0x7c, 0x9a, 0xa2, 0xdc, 0x23, 0x5c, 0x52, 0x69,
-    0xe3, 0x9d, 0x0c, 0xa9, 0xdf, 0x7a, 0xad, 0x44,
-    0x61, 0x2a, 0xd6, 0xf8, 0x8f, 0x69, 0x69, 0x92,
-    0x98, 0xf3, 0xca, 0xb1, 0xb5, 0x43, 0x67, 0xfb,
-    0x0e, 0x8b, 0x93, 0xf7, 0x35, 0xdc, 0x8c, 0xd8,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
-};
-
-static UINT8 WPS_DH_RRModP_VALUE[192] =
-{
-	0xe3, 0xb3, 0x3c, 0x72, 0x59, 0x54, 0x1c, 0x01,
-	0xee, 0x9c, 0x9a, 0x21, 0x6c, 0xc1, 0xeb, 0xd2,
-	0xae, 0x59, 0x41, 0x04, 0x79, 0x29, 0xa1, 0xc7,
-	0xe9, 0xc3, 0xfa, 0x02, 0xcc, 0x24, 0x56, 0xef,
-	0x10, 0x26, 0x30, 0xfa, 0x9a, 0x36, 0xa5, 0x1f,
-	0x57, 0xb5, 0x93, 0x48, 0x67, 0x98, 0x44, 0x60,
-	0x0b, 0xe4, 0x96, 0x47, 0xa8, 0x7c, 0x7b, 0x37,
-	0xf8, 0x05, 0x65, 0x64, 0x96, 0x9b, 0x7f, 0x02,
-	0xdc, 0x54, 0x1a, 0x4e, 0xd4, 0x05, 0x3f, 0x54,
-	0xd6, 0x2a, 0x0e, 0xea, 0xb2, 0x70, 0x52, 0x1b,
-	0x22, 0xc2, 0x96, 0xe9, 0xd4, 0x6f, 0xec, 0x23,
-	0x8e, 0x1a, 0xbd, 0x78, 0x02, 0x23, 0xb7, 0x6b,
-	0xb8, 0xfe, 0x61, 0x21, 0x19, 0x6b, 0x7e, 0x88,
-	0x1c, 0x72, 0x9c, 0x7e, 0x04, 0xb9, 0xf7, 0x96,
-	0x07, 0xcd, 0x0a, 0x62, 0x8e, 0x43, 0x41, 0x30,
-	0x04, 0xa5, 0x41, 0xff, 0x93, 0xae, 0x1c, 0xeb,
-	0xb0, 0x04, 0xa7, 0x50, 0xdb, 0x10, 0x2d, 0x39,
-	0xb9, 0x05, 0x2b, 0xb4, 0x7a, 0x58, 0xf1, 0x70,
-	0x7e, 0x8c, 0xd2, 0xac, 0x98, 0xb5, 0xfb, 0x62,
-	0x8f, 0x23, 0x31, 0xb1, 0x3b, 0x01, 0xe0, 0x18,
-	0xf4, 0x66, 0xee, 0x5f, 0xbc, 0xd4, 0x9d, 0x68,
-	0xd0, 0xab, 0x92, 0xe1, 0x83, 0x97, 0xf2, 0x45,
-	0x8e, 0x0e, 0x3e, 0x21, 0x67, 0x47, 0x8c, 0x73,
-	0xf1, 0x15, 0xd2, 0x7d, 0x32, 0xc6, 0x95, 0xe0,
-};
-
-static UINT8 Value_0[1] = {0x00};
-static UINT8 Value_1[1] = {0x01};
-static PBIG_INTEGER pBI_U = NULL, pBI_S = NULL, pBI_O = NULL;
-static UINT Bits_Of_R = 0;
-
-
-VOID BigInteger_Print (
-    IN PBIG_INTEGER pBI)
-{
-    int i = 0, j = 0;
-
-    if ((pBI == NULL) || (pBI->pIntegerArray == NULL))
-        return;
-
-    if (strlen(pBI->Name) != 0)
-        DEBUGPRINT("Name=%s\n", pBI->Name);
-    DEBUGPRINT("AllocSize=%d, ArrayLength=%d, IntegerLength=%d, Signed=%d\n", pBI->AllocSize, pBI->ArrayLength, pBI->IntegerLength, pBI->Signed);
-    for (i = (pBI->ArrayLength - 1), j = 0;i >=0;i--,j++) {
-        DEBUGPRINT("%08x, ", pBI->pIntegerArray[i]);
-        if ((j%8) == 7)
-            DEBUGPRINT("\n");
-    } /* End od for */
-    DEBUGPRINT("\n\n");
-} /* End of BigInteger_Print */
-
-
-VOID BigInteger_Init (
-    INOUT PBIG_INTEGER *pBI)
-{
-    if (*pBI != NULL)
-        BigInteger_Free(pBI);
-
-    if ((*pBI = (PBIG_INTEGER) kmalloc(sizeof(BIG_INTEGER), GFP_ATOMIC)) == NULL) {
-        DEBUGPRINT("BigInteger_Init: allocate %d bytes memory failure.\n", (sizeof(BIG_INTEGER)));
-        return;
-    } /* End of if */
-
-    NdisZeroMemory(*pBI, sizeof(BIG_INTEGER));
-    (*pBI)->pIntegerArray = NULL;
-    (*pBI)->Signed = 1;
-} /* End of BigInteger_Init */
-
-
-VOID BigInteger_Free_AllocSize (
-    IN PBIG_INTEGER *pBI)
-{
-    if ((*pBI != NULL) && ((*pBI)->pIntegerArray != NULL)) {
-        kfree((*pBI)->pIntegerArray);
-        NdisZeroMemory(*pBI, sizeof(BIG_INTEGER));
-        (*pBI)->pIntegerArray = NULL;
-        (*pBI)->Signed = 1;
-    } /* End of if */
-} /* End of BigInteger_Free_AllocSize */
-
-
-VOID BigInteger_Free (
-    IN PBIG_INTEGER *pBI)
-{
-    if (*pBI != NULL) {
-        BigInteger_Free_AllocSize(pBI);
-        kfree(*pBI);
-    } /* End of if */
-
-    *pBI = NULL;
-} /* End of BigInteger_Free */
-
-
-VOID BigInteger_AllocSize (
-    IN PBIG_INTEGER *pBI,
-    IN UINT Length)
-{
-    UINT ArrayLength = 0;
-
-    if (Length == 0)
-        return;
-
-    if (*pBI == NULL)
-        BigInteger_Init(pBI);
-
-    /* Caculate array size */
-    ArrayLength = Length >> 0x2;
-    if ((Length & 0x3) != 0)
-        ArrayLength++;
-
-    if (((*pBI)->pIntegerArray != NULL) && ((*pBI)->AllocSize < (sizeof(UINT32)*ArrayLength)))
-        BigInteger_Free_AllocSize(pBI);
-
-    if ((*pBI)->pIntegerArray == NULL) {
-        if (((*pBI)->pIntegerArray = (UINT32 *) kmalloc(sizeof(UINT32)*ArrayLength, GFP_ATOMIC)) == NULL) {
-            DEBUGPRINT("BigInteger_AllocSize: allocate %d bytes memory failure.\n", (sizeof(UINT32)*ArrayLength));
-            return;
-        } /* End of if */
-        (*pBI)->AllocSize = sizeof(UINT32)*ArrayLength;
-    } /* End of if */
-
-    NdisZeroMemory((*pBI)->pIntegerArray, (*pBI)->AllocSize);
-    (*pBI)->ArrayLength = ArrayLength;
-    (*pBI)->IntegerLength = Length;
-} /* End of BigInteger_AllocSize */
-
-
-VOID BigInteger_ClearHighBits (
-    IN PBIG_INTEGER pBI)
-{
-    INT BIArrayIndex, ShiftIndex = 0;
-    UINT8 value;
-
-    if ((pBI == NULL) || (pBI->pIntegerArray == NULL))
-        return;
-
-    BIArrayIndex = pBI->ArrayLength - 1;
-    while ((BIArrayIndex >= 0) && (pBI->pIntegerArray[BIArrayIndex] == 0))
-	BIArrayIndex--;
-
-    if (BIArrayIndex >= 0) {
-        value = 0;
-        ShiftIndex = 4;
-        while (value == 0) {
-            ShiftIndex--;
-            value = UINT32_GETBYTE(pBI->pIntegerArray[BIArrayIndex], ShiftIndex);
-	} /* End of while */
-    } /* End of if */
-
-    if ((BIArrayIndex == -1) && (ShiftIndex == -1)) {
-        pBI->IntegerLength = 1;
-        pBI->ArrayLength = 1;
-        pBI->Signed = 1;
-    } else {
-        pBI->IntegerLength = (BIArrayIndex*4) + ShiftIndex + 1;
-        pBI->ArrayLength = BIArrayIndex + 1;
-    } /* End of if */
-} /* End of BigInteger_ClearHighBits */
-
-
-VOID BigInteger_BI2Bin (
-    IN PBIG_INTEGER pBI,
-    OUT UINT8 *pValue,
-    OUT UINT *Length)
-{
-    INT  ValueIndex, BIArrayIndex, ShiftIndex;
-    UINT32  Number;
-
-    if (pBI == NULL) {
-        DEBUGPRINT("BigInteger_BI2Bin: pBI is NUll\n");
-        *Length = 0;
-        return;
-    } /* End of if */
-
-    if (*Length < (sizeof(UINT8) * pBI->IntegerLength)) {
-        DEBUGPRINT("BigInteger_BI2Bin: length(%d) is not enough.\n", *Length);
-        *Length = 0;
-        return;
-    } /* End of if */
-
-    if (pBI->pIntegerArray == NULL) {
-        *Length = 0;
-        return;
-    } /* End of if */
-
-    BigInteger_ClearHighBits(pBI);
-    if ((ShiftIndex = pBI->IntegerLength & 0x3) == 0)
-       ShiftIndex = 4;
-    BIArrayIndex = pBI->ArrayLength - 1;
-    ValueIndex = 0;
-
-    Number = pBI->pIntegerArray[BIArrayIndex];
-    while (ValueIndex < pBI->IntegerLength)
-    {
-        pValue[ValueIndex++] = (UINT8) UINT32_GETBYTE(Number, ShiftIndex - 1);
-        if ((--ShiftIndex) == 0) {
-            ShiftIndex = 4;
-            BIArrayIndex--;
-            Number = pBI->pIntegerArray[BIArrayIndex];
-        } /* End of if */
-    } /* End of while */
-    *Length = pBI->IntegerLength;
-} /* End of BigInteger_BI2Bin */
-
-
-VOID BigInteger_Bin2BI (
-    IN UINT8 *pValue,
-    IN UINT Length,
-    OUT PBIG_INTEGER *pBI)
-{
-    INT  ValueIndex, BIArrayIndex, ShiftIndex;
-    UINT32  Number;
-
-    BigInteger_AllocSize(pBI, Length);
-
-    if ((*pBI)->pIntegerArray != NULL) {
-        Number = 0;
-        if ((ShiftIndex = Length & 0x3) == 0)
-            ShiftIndex = 4;
-        BIArrayIndex = (*pBI)->ArrayLength - 1;
-        ValueIndex = 0;
-        while (ValueIndex < Length)
-        {
-            Number = (Number << 8) | (UINT8) pValue[ValueIndex++];
-            if ((--ShiftIndex) == 0) {
-                (*pBI)->pIntegerArray[BIArrayIndex] = Number;
-                ShiftIndex = 4;
-                BIArrayIndex--;
-                Number = 0;
-            } /* End of if */
-        } /* End of while */
-    } /* End of if */
-} /* End of BigInteger_Bin2BI */
-
-
-/* Calculate the bits of BigInteger, the highest bit is 1 */
-VOID BigInteger_BitsOfBI (
-    IN PBIG_INTEGER pBI,
-    OUT UINT *Bits_Of_P)
-{
-    UINT32 Number, Index;
-
-    Number = pBI->pIntegerArray[pBI->ArrayLength - 1];
-    Index = 0;
-    while ((!(Number & 0x80000000)) && (Index < 32)) {
-        Number <<= 1;
-        Index++;
-    } /* End of while */
-    *Bits_Of_P = (pBI->ArrayLength*sizeof(UINT32)) - Index;
-} /* End of BigInteger_BitsOfBN */
-
-
-INT BigInteger_GetBitValue (
-    IN PBIG_INTEGER pBI,
-    IN UINT Index)
-{
-    UINT Array = 0;
-    UINT Shift = 0;
-
-    if (Index > 0) {
-        Array = (Index - 1) >> 0x5;
-        Shift = (Index - 1) & 0x1F;
-    }
-    if (Array > pBI->ArrayLength)
-        return 0;
-
-    return ((pBI->pIntegerArray[Array] >> Shift) & 0x1);
-} /* End of BigInteger_GetBitValue */
-
-
-UINT8 BigInteger_GetByteValue (
-    IN PBIG_INTEGER pBI,
-    IN UINT Index)
-{
-    UINT Array = 0;
-    UINT Shift = 0;
-
-    if (Index > 0) {
-        Array = (Index - 1) >> 0x2;
-        Shift = (Index - 1) & 0x3;
-    }
-    if ((Array > pBI->ArrayLength) || (Index > pBI->IntegerLength))
-        return 0;
-
-
-    return (UINT8) UINT32_GETBYTE(pBI->pIntegerArray[Array], Shift - 1);
-} /* End of BigInteger_GetByteValue */
-
-
-VOID BigInteger_Copy (
-    IN PBIG_INTEGER pBI_Copied,
-    OUT PBIG_INTEGER *pBI_Result)
-{
-    BigInteger_AllocSize(pBI_Result, pBI_Copied->IntegerLength);
-    NdisCopyMemory((*pBI_Result)->pIntegerArray, pBI_Copied->pIntegerArray, (sizeof(UINT32)*(*pBI_Result)->ArrayLength));
-    (*pBI_Result)->ArrayLength = pBI_Copied->ArrayLength;
-    (*pBI_Result)->IntegerLength = pBI_Copied->IntegerLength;
-    (*pBI_Result)->Signed = pBI_Copied->Signed;
-} /* End of BigInteger_Copy */
-
-
-INT BigInteger_UnsignedCompare (
-    IN PBIG_INTEGER pFirstOperand,
-    IN PBIG_INTEGER pSecondOperand)
-{
-    INT BIArrayIndex;
-
-    if (pFirstOperand->IntegerLength > pSecondOperand->IntegerLength)
-        return 1;
-
-    if (pFirstOperand->IntegerLength < pSecondOperand->IntegerLength)
-        return -1;
-
-    if (pFirstOperand->IntegerLength == pSecondOperand->IntegerLength) {
-        for(BIArrayIndex = (pFirstOperand->ArrayLength - 1);BIArrayIndex >= 0 ; BIArrayIndex--)
-        {
-            if (pFirstOperand->pIntegerArray[BIArrayIndex] > pSecondOperand->pIntegerArray[BIArrayIndex])
-                return 1;
-            else if (pFirstOperand->pIntegerArray[BIArrayIndex] < pSecondOperand->pIntegerArray[BIArrayIndex])
-                return -1;
-        } /* End of for */
-    } /* End of if */
-
-    return 0;
-} /* End of BigInteger_Compare */
-
-
-VOID BigInteger_Add (
-    IN PBIG_INTEGER pFirstOperand,
-    IN PBIG_INTEGER pSecondOperand,
-    OUT PBIG_INTEGER *pBI_Result)
-{
-    INT CompareResult;
-    UINT32 BIArrayIndex;
-    UINT64 Sum, Carry;
-    PBIG_INTEGER pTempBI = NULL;
-
-    if  ((pFirstOperand == NULL) || (pFirstOperand->pIntegerArray == NULL)
-      || (pSecondOperand == NULL) || (pSecondOperand->pIntegerArray == NULL)) {
-        DEBUGPRINT("BigInteger_Add: first or second operand is NULL.\n");
-        return;
-    } /* End of if */
-
-    if (*pBI_Result == NULL)
-        BigInteger_Init(pBI_Result);
-
-    CompareResult = BigInteger_UnsignedCompare(pFirstOperand, pSecondOperand);
-    if ((CompareResult == 0) & ((pFirstOperand->Signed * pSecondOperand->Signed) < 0)) {
-        BigInteger_AllocSize(pBI_Result, 1);
-        return ;
-    } /* End of if */
-
-    /*
-     *  Singed table
-     *  A + B || A > B || A < B
-     *  ------------------------
-     *  +   + ||   +   ||   +
-     *  +   - ||   +   ||   -
-     *  -   + ||   -   ||   +
-     *  -   - ||   -   ||   -
-     */
-    if ((pFirstOperand->Signed * pSecondOperand->Signed) > 0) {
-        if (pFirstOperand->IntegerLength > pSecondOperand->IntegerLength) {
-                BigInteger_AllocSize(pBI_Result, pFirstOperand->IntegerLength + 1);
-        } else {
-                BigInteger_AllocSize(pBI_Result, pSecondOperand->IntegerLength + 1);
-        } /* End of if */
-
-        Carry = 0;
-        for (BIArrayIndex=0; BIArrayIndex < (*pBI_Result)->ArrayLength; BIArrayIndex++)
-        {
-
-            Sum = 0;
-            if (BIArrayIndex < pFirstOperand->ArrayLength)
-                Sum += (UINT64) pFirstOperand->pIntegerArray[BIArrayIndex];
-
-            if (BIArrayIndex < pSecondOperand->ArrayLength)
-                Sum += (UINT64) pSecondOperand->pIntegerArray[BIArrayIndex];
-
-            Sum += Carry;
-            Carry = Sum  >> 32;
-            (*pBI_Result)->pIntegerArray[BIArrayIndex] = (UINT32) (Sum & 0xffffffffUL);
-        } /* End of for */
-        (*pBI_Result)->Signed = pFirstOperand->Signed;
-        BigInteger_ClearHighBits(*pBI_Result);
-    } else {
-        if  ((pFirstOperand->Signed == 1) & (pSecondOperand->Signed == -1)) {
-            BigInteger_Copy(pSecondOperand, &pTempBI);
-            pTempBI->Signed = 1;
-            BigInteger_Sub(pFirstOperand, pTempBI, pBI_Result);
-        } else if ((pFirstOperand->Signed == -1) & (pSecondOperand->Signed == 1)) {
-            BigInteger_Copy(pFirstOperand, &pTempBI);
-            pTempBI->Signed = 1;
-            BigInteger_Sub(pSecondOperand, pTempBI, pBI_Result);
-        } /* End of if */
-    } /* End of if */
-
-    BigInteger_Free(&pTempBI);
-} /* End of BigInteger_Add */
-
-
-VOID BigInteger_Sub (
-    IN PBIG_INTEGER pFirstOperand,
-    IN PBIG_INTEGER pSecondOperand,
-    OUT PBIG_INTEGER *pBI_Result)
-{
-    INT CompareResult;
-    UINT32 BIArrayIndex, Carry;
-    PBIG_INTEGER pTempBI = NULL, pTempBI2 = NULL;
-
-    if  ((pFirstOperand == NULL) || (pFirstOperand->pIntegerArray == NULL)
-      || (pSecondOperand == NULL) || (pSecondOperand->pIntegerArray == NULL)) {
-        DEBUGPRINT("BigInteger_Sub: first or second operand is NULL.\n");
-        return;
-    } /* End of if */
-
-    if (*pBI_Result == NULL)
-        BigInteger_Init(pBI_Result);
-
-    CompareResult = BigInteger_UnsignedCompare(pFirstOperand, pSecondOperand);
-    if ((CompareResult == 0) & ((pFirstOperand->Signed * pSecondOperand->Signed) > 0)) {
-        BigInteger_AllocSize(pBI_Result, 1);
-        return ;
-    } /* End of if */
-
-    BigInteger_Init(&pTempBI);
-    BigInteger_Init(&pTempBI2);
-
-    /*
-     *  Singed table
-     *  A - B || A > B || A < B
-     *  ------------------------
-     *  +   + ||   +   ||   -
-     *  +   - ||   +   ||   +
-     *  -   + ||   -   ||   -
-     *  -   - ||   -   ||   +
-     */
-    if ((pFirstOperand->Signed * pSecondOperand->Signed) > 0) {
-        if (CompareResult == 1) {
-            BigInteger_Copy(pFirstOperand, &pTempBI);
-            BigInteger_Copy(pSecondOperand, &pTempBI2);
-        } else if (CompareResult == -1) {
-            BigInteger_Copy(pSecondOperand, &pTempBI);
-            BigInteger_Copy(pFirstOperand, &pTempBI2);
-        } /* End of if */
-
-        BigInteger_Copy(pTempBI, pBI_Result);
-        Carry = 0;
-        for (BIArrayIndex=0; BIArrayIndex < (*pBI_Result)->ArrayLength; BIArrayIndex++)
-        {
-            if (BIArrayIndex < pTempBI2->ArrayLength) {
-                if ((*pBI_Result)->pIntegerArray[BIArrayIndex] >= (pTempBI2->pIntegerArray[BIArrayIndex] - Carry)) {
-                    (*pBI_Result)->pIntegerArray[BIArrayIndex] = (*pBI_Result)->pIntegerArray[BIArrayIndex] - pTempBI2->pIntegerArray[BIArrayIndex] - Carry;
-                    Carry = 0;
-                } else {
-                    (*pBI_Result)->pIntegerArray[BIArrayIndex] = 0xffffffffUL - pTempBI2->pIntegerArray[BIArrayIndex] - Carry + (*pBI_Result)->pIntegerArray[BIArrayIndex] + 1;
-                    Carry = 1;
-                } /* End of if */
-            } else {
-                if ((*pBI_Result)->pIntegerArray[BIArrayIndex] >= Carry) {
-                    (*pBI_Result)->pIntegerArray[BIArrayIndex] -= Carry;
-                    Carry = 0;
-                } else {
-                    (*pBI_Result)->pIntegerArray[BIArrayIndex] = 0xffffffffUL - Carry;
-                    Carry = 1;
-                } /* End of if */
-            } /* End of if */
-        } /* End of for */
-
-        if  (((pFirstOperand->Signed == 1) & (pSecondOperand->Signed == 1) & (CompareResult == -1))
-          || ((pFirstOperand->Signed == -1) & (pSecondOperand->Signed == -1) & (CompareResult == 1)))
-            (*pBI_Result)->Signed = -1;
-
-        BigInteger_ClearHighBits(*pBI_Result);
-    } else {
-        if  ((pFirstOperand->Signed == 1) & (pSecondOperand->Signed == -1)) {
-            BigInteger_Copy(pSecondOperand, &pTempBI);
-            pTempBI->Signed = 1;
-            BigInteger_Add(pFirstOperand, pTempBI, pBI_Result);
-        } else if ((pFirstOperand->Signed == -1) & (pSecondOperand->Signed == 1)) {
-            BigInteger_Copy(pFirstOperand, &pTempBI);
-            pTempBI->Signed = 1;
-            BigInteger_Add(pTempBI, pSecondOperand, pBI_Result);
-            (*pBI_Result)->Signed = -1;
-        } /* End of if */
-    } /* End of if */
-
-    BigInteger_Free(&pTempBI);
-    BigInteger_Free(&pTempBI2);
-} /* End of BigInteger_Sub */
-
-
-VOID BigInteger_Mul (
-    IN PBIG_INTEGER pFirstOperand,
-    IN PBIG_INTEGER pSecondOperand,
-    OUT PBIG_INTEGER *pBI_Result)
-{
-
-    UINT32 BIFirstIndex, BISecondIndex;
-    UINT64 FirstValue, SecondValue, Sum, Carry;
-
-    if  ((pFirstOperand == NULL) || (pFirstOperand->pIntegerArray == NULL)
-      || (pSecondOperand == NULL) || (pSecondOperand->pIntegerArray == NULL)) {
-        DEBUGPRINT("BigInteger_Mul: first or second operand is NULL.\n");
-        return;
-    } /* End of if */
-
-    /* The first or second operand is zero */
-    if  (((pFirstOperand->IntegerLength  == 1) && (pFirstOperand->pIntegerArray[0]  == 0))
-       ||((pSecondOperand->IntegerLength == 1) && (pSecondOperand->pIntegerArray[0] == 0))) {
-        BigInteger_AllocSize(pBI_Result, 1);
-        goto output;
-    } /* End of if */
-
-    /* The first or second operand is one */
-    if  ((pFirstOperand->IntegerLength  == 1) && (pFirstOperand->pIntegerArray[0]  == 1)) {
-        BigInteger_Copy(pSecondOperand, pBI_Result);
-        goto output;
-    } /* End of if */
-    if  ((pSecondOperand->IntegerLength  == 1) && (pSecondOperand->pIntegerArray[0]  == 1)) {
-        BigInteger_Copy(pFirstOperand, pBI_Result);
-        goto output;
-    } /* End of if */
-
-    BigInteger_AllocSize(pBI_Result, pFirstOperand->IntegerLength + pSecondOperand->IntegerLength);
-
-    for (BIFirstIndex=0; BIFirstIndex < pFirstOperand->ArrayLength; BIFirstIndex++)
-    {
-        Carry = 0;
-        FirstValue = (UINT64) pFirstOperand->pIntegerArray[BIFirstIndex];
-        if (FirstValue == 0) {
-            continue;
-        } else {
-            for (BISecondIndex=0; BISecondIndex < pSecondOperand->ArrayLength; BISecondIndex++)
-            {
-                SecondValue = ((UINT64) pSecondOperand->pIntegerArray[BISecondIndex])*FirstValue;
-                Sum = (UINT64) ((*pBI_Result)->pIntegerArray[BIFirstIndex + BISecondIndex] + SecondValue + Carry);
-                Carry = Sum >> 32;
-                (*pBI_Result)->pIntegerArray[BIFirstIndex + BISecondIndex] = (UINT32) (Sum & 0xffffffffUL);
-            } /* End of for */
-            while (Carry != 0) {
-                Sum = (UINT64) (*pBI_Result)->pIntegerArray[BIFirstIndex + BISecondIndex];
-                Sum += Carry;
-
-                Carry = Sum >> 32;
-                (*pBI_Result)->pIntegerArray[BIFirstIndex + BISecondIndex] = (UINT32) (Sum & 0xffffffffUL);
-                BISecondIndex++;
-            } /* End of while */
-        } /* End of if */
-    } /* End of for */
-
-output:
-    (*pBI_Result)->Signed = pFirstOperand->Signed * pSecondOperand->Signed;
-    BigInteger_ClearHighBits(*pBI_Result);
-} /* End of BigInteger_Mul */
-
-
-VOID BigInteger_Square (
-    IN PBIG_INTEGER pBI,
-    OUT PBIG_INTEGER *pBI_Result)
-{
-    INT BIFirstIndex, BISecondIndex;
-	UINT32 HBITS_Value, LBITS_Value, Temp1_Value, Temp2_Value, Carry32;
-	UINT32 *Point_Of_S, *Point_Of_Result, *Point_Of_BI;
-    UINT64 Result64_1, Result64_2, Carry64, TempValue64;
-
-    if ((pBI == NULL) || (pBI->pIntegerArray == NULL)) {
-        DEBUGPRINT("\tBigInteger_Square: the operand is NULL.\n");
-        return;
-    } /* End of if */
-
-    /* The operand is zero */
-    if  ((pBI->IntegerLength  == 1) && (pBI->pIntegerArray[0]  ==  0)) {
-        BigInteger_AllocSize(pBI_Result, 1);
-        goto output;
-    } /* End of if */
-
-    BigInteger_AllocSize(pBI_Result, (pBI->IntegerLength*2) + 20);
-    BigInteger_AllocSize(&pBI_S, (pBI->IntegerLength*2) + 20);
-    BigInteger_AllocSize(&pBI_O, (pBI->IntegerLength*2) + 20);
-
-    /*
-     * Input: pBI = {a_0, a_1, a_2, a_3, ..., a_n}
-     * Step1. calculate a_0^2, a_1^2, a_2^2, a_3^2 ... a_n^2
-     */
-	Point_Of_S = pBI_S->pIntegerArray;
-    for (BIFirstIndex=0; BIFirstIndex < pBI->ArrayLength; BIFirstIndex++)
-    {
-	HBITS_Value = UINT32_HBITS(pBI->pIntegerArray[BIFirstIndex]);
-		LBITS_Value = UINT32_LBITS(pBI->pIntegerArray[BIFirstIndex]);
-		Temp1_Value = HBITS_Value*LBITS_Value;
-		Temp2_Value = (Temp1_Value & 0x7fff) << 0x11;
-		Point_Of_S[0] = (LBITS_Value*LBITS_Value) + Temp2_Value;
-		Point_Of_S[1] = (HBITS_Value*HBITS_Value) + ((Temp1_Value >> 0xf) & 0x1ffff);
-		if (Point_Of_S[0] < Temp2_Value)
-			Point_Of_S[1] += 1;
-
-		Point_Of_S += 2;
-    } /* End of for */
-
-    /*
-     * Step2. calculate a_0*{a_1, a_2, a_3, a_4, ..., a_n}
-     */
-    Point_Of_BI = pBI->pIntegerArray;
-    Point_Of_Result = (*pBI_Result)->pIntegerArray;
-    Point_Of_Result[0] = 0;
-    TempValue64 = (UINT64) Point_Of_BI[0];
-    Point_Of_Result++;
-    Carry64 = 0;
-    for (BIFirstIndex=1; BIFirstIndex < pBI->ArrayLength; BIFirstIndex++)
-    {
-        Result64_1 =  (UINT64) Point_Of_BI[BIFirstIndex]*TempValue64;
-        Result64_1 += Carry64;
-        Carry64 = (Result64_1 >> 32);
-        Point_Of_Result[0] = (UINT32) (Result64_1 & 0xffffffffUL);
-        Point_Of_Result++;
-    } /* End of for */
-    if (Carry64 > 0)
-        Point_Of_Result[0] = (UINT32) (Carry64 & 0xffffffffUL);
-
-    /*
-     * Step3. calculate
-     *           a_1*{a_2, a_3, a_4, ..., a_n}
-     *           a_2*{a_3, a_4, a_5, ..., a_n}
-     *           a_3*{a_4, a_5, a_6, ..., a_n}
-     *           a_4*{a_5, a_6, a_7, ..., a_n}
-     *           ...
-     *           a_n-1*{a_n}
-     */
-    Point_Of_BI = pBI->pIntegerArray;
-    for (BIFirstIndex=1; BIFirstIndex < (pBI->ArrayLength - 1); BIFirstIndex++)
-    {
-        Point_Of_Result = (*pBI_Result)->pIntegerArray;
-        Point_Of_Result += (BIFirstIndex*2) + 1;
-        TempValue64 = (UINT64) Point_Of_BI[BIFirstIndex];
-        Carry64 = 0;
-        for (BISecondIndex=(BIFirstIndex + 1); BISecondIndex < pBI->ArrayLength; BISecondIndex++)
-        {
-            Result64_1 = ((UINT64) Point_Of_Result[0]) + Carry64;
-            Result64_2 = (UINT64) Point_Of_BI[BISecondIndex]*TempValue64;
-            Carry64 = (Result64_1 >> 32);
-            Result64_1 = (Result64_1 & 0xffffffffUL);
-            Result64_1 = Result64_1 + Result64_2;
-            Carry64 += (Result64_1 >> 32);
-            Point_Of_Result[0] = (UINT32) (Result64_1 & 0xffffffffUL);
-            Point_Of_Result++;
-        } /* End of for */
-        if (Carry64 > 0)
-            Point_Of_Result[0] += (UINT32) (Carry64 & 0xffffffffUL);
-    } /* End of for */
-
-    BigInteger_ClearHighBits(*pBI_Result);
-    BigInteger_Copy(*pBI_Result, &pBI_O);
-
-    Carry32 = 0;
-	for (BIFirstIndex=0; BIFirstIndex < pBI_O->ArrayLength; BIFirstIndex++) {
-        pBI_O->pIntegerArray[BIFirstIndex] = (pBI_O->pIntegerArray[BIFirstIndex] << 1) | Carry32;
-        if (pBI_O->pIntegerArray[BIFirstIndex] < (*pBI_Result)->pIntegerArray[BIFirstIndex])
-            Carry32 = 1;
-        else
-            Carry32 = 0;
-    } /* End of for */
-    pBI_O->pIntegerArray[BIFirstIndex] = Carry32;
-    pBI_O->IntegerLength++;
-    pBI_O->ArrayLength++;
-    BigInteger_ClearHighBits(pBI_O);
-
-    BigInteger_Add(pBI_O, pBI_S, pBI_Result);
-output:
-    (*pBI_Result)->Signed = 1;
-    BigInteger_ClearHighBits(*pBI_Result);
-} /* End of BigInteger_Square */
-
-
-VOID BigInteger_Div (
-    IN PBIG_INTEGER pFirstOperand,
-    IN PBIG_INTEGER pSecondOperand,
-    OUT PBIG_INTEGER *pBI_Result,
-    OUT PBIG_INTEGER *pBI_Remainder)
-{
-    INT CompareResult;
-    INT Index, MulIndex, ComputeSize;
-    UINT32 MulStart;
-    UINT AllocLength, ArrayIndex, ShiftIndex;
-    PBIG_INTEGER pTempBI = NULL, pTempBI2 = NULL, pMulBI = NULL;
-    UINT8 SecondHighByte;
-
-    if  ((pFirstOperand == NULL) || (pFirstOperand->pIntegerArray == NULL)
-      || (pSecondOperand == NULL) || (pSecondOperand->pIntegerArray == NULL)) {
-        DEBUGPRINT("BigInteger_Div: first or second operand is NULL.\n");
-        return;
-    } /* End of if */
-
-    /* The second operand is zero */
-    if ((pSecondOperand->IntegerLength == 1) && (pSecondOperand->pIntegerArray[0] == 0)) {
-        DEBUGPRINT("BigInteger_Div: second operand is zero.\n");
-        return;
-    } /* End of if */
-
-    if (*pBI_Result == NULL)
-        BigInteger_Init(pBI_Result);
-    if (*pBI_Remainder == NULL)
-        BigInteger_Init(pBI_Remainder);
-
-    /* The second operand is one */
-    if  ((pSecondOperand->IntegerLength  == 1) && (pSecondOperand->pIntegerArray[0]  == 1)) {
-        BigInteger_Copy(pFirstOperand, pBI_Result);
-        BigInteger_Bin2BI(Value_0, 1, pBI_Remainder);
-        goto output;
-    } /* End of if */
-
-    CompareResult = BigInteger_UnsignedCompare(pFirstOperand, pSecondOperand);
-    if (CompareResult == 0) {
-        BigInteger_Bin2BI(Value_1, 1, pBI_Result);
-        BigInteger_Bin2BI(Value_0, 1, pBI_Remainder);
-        goto output;
-    } else if (CompareResult == -1) {
-        BigInteger_Bin2BI(Value_0, 1, pBI_Result);
-        BigInteger_Copy(pFirstOperand, pBI_Remainder);
-        goto output;
-    } /* End of if */
-    BigInteger_AllocSize(pBI_Result, pFirstOperand->IntegerLength - pSecondOperand->IntegerLength + 1);
-    BigInteger_AllocSize(pBI_Remainder, pSecondOperand->IntegerLength);
-
-    AllocLength = (UINT) (pFirstOperand->IntegerLength << 1);
-    BigInteger_AllocSize(&pTempBI, AllocLength);
-    BigInteger_AllocSize(&pTempBI2, AllocLength);
-    BigInteger_AllocSize(&pMulBI, AllocLength);
-
-    BigInteger_Copy(pFirstOperand, pBI_Remainder);
-    SecondHighByte = BigInteger_GetByteValue(pSecondOperand, pSecondOperand->IntegerLength);
-    ComputeSize = (INT) pFirstOperand->IntegerLength - pSecondOperand->IntegerLength + 1;
-    for (Index = (INT) ComputeSize;Index >= 0;Index--) {
-        if (BigInteger_UnsignedCompare(*pBI_Remainder, pSecondOperand) == -1)
-            break;
-
-        if (((pSecondOperand->IntegerLength + Index) - (*pBI_Remainder)->IntegerLength) <= 1) {
-            BigInteger_AllocSize(&pMulBI, Index + 1);
-            ArrayIndex = 0;
-            if (Index > 0)
-                ArrayIndex = (UINT) (Index - 1) >> 2 ;
-            ShiftIndex = (Index & 0x03);
-            if (ShiftIndex == 0)
-                ShiftIndex = 4;
-            ShiftIndex--;
-            MulStart = 0;
-            MulStart = (BigInteger_GetByteValue((*pBI_Remainder), pFirstOperand->IntegerLength + Index - ComputeSize + 1) & 0xFF) << 8;
-            MulStart = MulStart | (BigInteger_GetByteValue((*pBI_Remainder), pFirstOperand->IntegerLength + Index - ComputeSize) & 0xFF);
-            if (MulStart < (UINT32) SecondHighByte)
-                continue;
-
-            MulStart = MulStart / (UINT32) SecondHighByte;
-
-            if (MulStart > 0xFF)
-                MulStart = 0x100;
-
-            for (MulIndex = (INT) MulStart;MulIndex <= 0x101;MulIndex++) { /* 0xFFFF / 0xFF = 0x101 */
-                if ((MulIndex > 0xFF) && (ShiftIndex == 3))
-                        pMulBI->pIntegerArray[ArrayIndex + 1] = 0x01;
-                pMulBI->pIntegerArray[ArrayIndex] = ((UINT) MulIndex << (8*ShiftIndex));
-                BigInteger_Mul(pSecondOperand, pMulBI , &pTempBI);
-                CompareResult = BigInteger_UnsignedCompare(*pBI_Remainder, pTempBI);
-                if (CompareResult < 1) {
-                    if (MulIndex > 1) {
-                        if (CompareResult != 0) {
-                            if ((MulIndex == 0x100) && (ShiftIndex == 3))
-                                   pMulBI->pIntegerArray[ArrayIndex + 1] = 0;
-                            pMulBI->pIntegerArray[ArrayIndex] = ((UINT) (MulIndex - 1) << (8*ShiftIndex));
-                        } /* End of if */
-
-                        BigInteger_Mul(pSecondOperand, pMulBI, &pTempBI);
-                        BigInteger_Sub(*pBI_Remainder, pTempBI, &pTempBI2);
-                        BigInteger_Copy(pTempBI2, pBI_Remainder);
-                        BigInteger_Add(*pBI_Result, pMulBI, &pTempBI2);
-                        BigInteger_Copy(pTempBI2, pBI_Result);
-                    } /* End of if */
-                    break;
-                } /* End of if */
-
-                if ((MulIndex >= 0x100) && (ShiftIndex == 3))
-                   pMulBI->pIntegerArray[ArrayIndex++] = 0;
-                pMulBI->pIntegerArray[ArrayIndex] = 0;
-            } /* End of for */
-        } /* End of if */
-    } /* End of for */
-
-    BigInteger_Free(&pTempBI);
-    BigInteger_Free(&pTempBI2);
-    BigInteger_Free(&pMulBI);
-output:
-    (*pBI_Result)->Signed = pFirstOperand->Signed * pSecondOperand->Signed;
-    (*pBI_Remainder)->Signed = pFirstOperand->Signed * pSecondOperand->Signed;
-    BigInteger_ClearHighBits(*pBI_Result);
-    BigInteger_ClearHighBits(*pBI_Remainder);
-} /* End of BigInteger_Div */
-
-
-VOID BigInteger_Montgomery_Reduction (
-    IN PBIG_INTEGER pBI_A,
-    IN PBIG_INTEGER pBI_P,
-     IN PBIG_INTEGER pBI_R,
-    OUT PBIG_INTEGER *pBI_Result)
-{
-    UINT32 *Point_P, *Point_Result;
-    UINT32 LoopCount;
-    UINT64 Result64_1, Result64_2, Carry64, TempValue64;
-    INT FirstLoop, SecondLoop;
-
-    BigInteger_AllocSize(pBI_Result, pBI_A->IntegerLength+ pBI_P->IntegerLength + 20);
-    BigInteger_Copy(pBI_A, pBI_Result);
-
-    Point_P = pBI_P->pIntegerArray;
-    Point_Result = (*pBI_Result)->pIntegerArray;
-
-    LoopCount = Bits_Of_R >> 0x5;
-    for (FirstLoop = 0;FirstLoop < LoopCount;FirstLoop++) {
-        Carry64 = 0;
-        TempValue64 = (UINT64) Point_Result[0];
-        for (SecondLoop = 0;SecondLoop < pBI_P->ArrayLength;SecondLoop++) {
-            Result64_1 = ((UINT64) Point_Result[SecondLoop]) + Carry64;
-            Result64_2 = (UINT64) Point_P[SecondLoop]*TempValue64;
-            Carry64 = (Result64_1 >> 32);
-            Result64_1 = (Result64_1 & 0xffffffffUL);
-            Result64_1 = Result64_1 + Result64_2;
-            Carry64 += (Result64_1 >> 32);
-            Point_Result[SecondLoop] = (UINT32) (Result64_1 & 0xffffffffUL);
-        } /* End of for */
-        while (Carry64 != 0) {
-          Result64_1 = ((UINT64) Point_Result[SecondLoop]) + Carry64;
-          Carry64 = Result64_1 >> 32;
-          Point_Result[SecondLoop] = (UINT32) (Result64_1 & 0xffffffffUL);
-          SecondLoop++;
-        } /* End of while */
-        Point_Result++;
-    } /* End of for */
-
-    for (FirstLoop = 0;FirstLoop <= LoopCount;FirstLoop++) {
-        (*pBI_Result)->pIntegerArray[FirstLoop] = (*pBI_Result)->pIntegerArray[FirstLoop + LoopCount];
-    } /* End of for */
-    if ((*pBI_Result)->pIntegerArray[LoopCount] != 0)
-        (*pBI_Result)->ArrayLength = LoopCount + 1;
-    else
-        (*pBI_Result)->ArrayLength = LoopCount;
-
-    (*pBI_Result)->IntegerLength = (*pBI_Result)->ArrayLength*4;
-    BigInteger_ClearHighBits(*pBI_Result);
-
-    if (BigInteger_UnsignedCompare(*pBI_Result, pBI_P) >= 0) {
-        BigInteger_Sub(*pBI_Result, pBI_P, &pBI_U);
-        BigInteger_Copy(pBI_U, pBI_Result);
-    } /* End of if */
-    BigInteger_ClearHighBits(*pBI_Result);
-} /* End of BigInteger_Montgomery_Reduction */
-
-
-VOID BigInteger_Montgomery_ExpMod (
-    IN PBIG_INTEGER pBI_G,
-    IN PBIG_INTEGER pBI_E,
-    IN PBIG_INTEGER pBI_P,
-    OUT PBIG_INTEGER *pBI_Result)
-{
-    UINT Bits_Of_P;
-    UINT32 Index, Index2, AllocLength;
-	UINT32 Sliding_Value , Sliding_HighValue, Sliding_LowValue;
-    PBIG_INTEGER pBI_Temp1 = NULL, pBI_Temp2 = NULL;
-    PBIG_INTEGER pBI_X = NULL, pBI_R = NULL, pBI_RR = NULL, pBI_1 = NULL;
-    BIG_INTEGER *pBI_A[SLIDING_WINDOW];
-    UINT8 *pRValue = NULL;
-
-    AllocLength = (pBI_G->IntegerLength + pBI_E->IntegerLength + pBI_P->IntegerLength + 300);
-    BigInteger_AllocSize(&pBI_Temp1, AllocLength);
-    BigInteger_AllocSize(&pBI_Temp2, AllocLength);
-
-    /* Calculate the bits of P and E, the highest bit is 1 */
-    BigInteger_BitsOfBI(pBI_P, &Bits_Of_P);
-
-    if ((pBI_E->IntegerLength == 1) && (pBI_E->pIntegerArray[0] == 1)) {
-        BigInteger_Div(pBI_G, pBI_P, &pBI_Temp1, pBI_Result);
-        goto memory_free;
-    } /* End of if */
-
-    if ((pBI_E->IntegerLength == 1) && (pBI_E->pIntegerArray[0] == 2)) {
-        BigInteger_Mul(pBI_G, pBI_G, &pBI_Temp1);
-        BigInteger_Div(pBI_Temp1, pBI_P, &pBI_Temp2, pBI_Result);
-        goto memory_free;
-    } /* End of if */
-
-    /*
-     * Main algorithm
-     */
-    BigInteger_Init(&pBI_R);
-    BigInteger_Init(&pBI_RR);
-    BigInteger_Bin2BI(Value_1, 1, &pBI_1);
-    BigInteger_AllocSize(&pBI_X, AllocLength);
-    BigInteger_AllocSize(&pBI_U, AllocLength); // for BigInteger_Montgomery_Reduction
-    BigInteger_AllocSize(&pBI_S, AllocLength); // for BigInteger_Square
-    BigInteger_AllocSize(&pBI_O, AllocLength); // for BigInteger_Square
-
-    for (Index = 0; Index < SLIDING_WINDOW; Index++) {
-        pBI_A[Index] = NULL;
-		BigInteger_AllocSize(&pBI_A[Index], 193);
-    } /* End of for */
-    BigInteger_Bin2BI(WPS_DH_P_VALUE, 192, &pBI_Temp1);
-    if (NdisCmpMemory(pBI_P->pIntegerArray, pBI_Temp1->pIntegerArray, pBI_P->IntegerLength) == 0) {
-        BigInteger_Bin2BI(WPS_DH_X_VALUE, 184, &pBI_X);
-        BigInteger_Bin2BI(WPS_DH_R_VALUE, 193, &pBI_R);
-        BigInteger_Bin2BI(WPS_DH_RRModP_VALUE, 192, &pBI_RR);
-        Bits_Of_R = 1537;
-    } else {
-        if ((Bits_Of_P % 8) == 0) {
-            AllocLength = pBI_P->IntegerLength + 1;
-        } else {
-            AllocLength = pBI_P->IntegerLength;
-        } /* End of if */
-        pRValue = (UINT8 *) kmalloc(sizeof(UINT8)*AllocLength, GFP_ATOMIC);
-	if (pRValue == NULL)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("%s():Alloc memory failed\n", __FUNCTION__));
-		goto memory_free;
-	}
-        NdisZeroMemory(pRValue, sizeof(UINT8)*AllocLength);
-        pRValue[0] = (UINT8) (1 << (Bits_Of_P & 0x7));
-        BigInteger_Bin2BI(pRValue, AllocLength , &pBI_R);
-
-        BigInteger_Mul(pBI_R, pBI_R, &pBI_Temp1);
-        BigInteger_Div(pBI_Temp1, pBI_P, &pBI_A[1], &pBI_RR);
-
-        /* X = 1*R (mod P) */
-        BigInteger_Div(pBI_R, pBI_P, &pBI_Temp2, &pBI_X);
-    } /* End of if */
-
-    /* A = G*R (mod P) => A = MonMod(G, R^2 mod P) */
-    BigInteger_Mul(pBI_G, pBI_RR, &pBI_Temp1);
-    BigInteger_Montgomery_Reduction(pBI_Temp1, pBI_P , pBI_R, &pBI_A[1]);
-    for (Index = 2; Index < SLIDING_WINDOW; Index++) {
-        BigInteger_Mul(pBI_A[Index - 1], pBI_A[1], &pBI_Temp1);
-	    BigInteger_Montgomery_Reduction(pBI_Temp1, pBI_P, pBI_R, &pBI_A[Index]);
-    } /* End of for */
-
-    for (Index = pBI_E->IntegerLength ; Index > 0 ; Index--) {
-        for (Index2 = 0; Index2 < 4 ; Index2++) {
-            BigInteger_Square(pBI_X, &pBI_Temp1);
-			BigInteger_Montgomery_Reduction(pBI_Temp1, pBI_P, pBI_R, &pBI_X);
-	    } /* End of for */
-
-		Sliding_Value = BigInteger_GetByteValue(pBI_E, Index);
-		Sliding_HighValue = (Sliding_Value >> 4);
-		if (Sliding_HighValue != 0) {
-            BigInteger_Mul(pBI_A[Sliding_HighValue], pBI_X, &pBI_Temp1);
-			BigInteger_Montgomery_Reduction(pBI_Temp1, pBI_P, pBI_R, &pBI_X);
-		} /* End of if */
-
-        for (Index2 = 0; Index2 < 4 ; Index2++) {
-            BigInteger_Square(pBI_X, &pBI_Temp1);
-			BigInteger_Montgomery_Reduction(pBI_Temp1, pBI_P, pBI_R, &pBI_X);
-	    } /* End of for */
-
-		Sliding_LowValue = Sliding_Value & 0x0f;
-		if (Sliding_LowValue != 0) {
-            BigInteger_Mul(pBI_A[Sliding_LowValue], pBI_X, &pBI_Temp1);
-			BigInteger_Montgomery_Reduction(pBI_Temp1, pBI_P, pBI_R, &pBI_X);
-		} /* End of if */
-    } /* End of for */
-    BigInteger_Montgomery_Reduction(pBI_X, pBI_P , pBI_R, pBI_Result);
-
-    BigInteger_Free(&pBI_X);
-    BigInteger_Free(&pBI_R);
-    BigInteger_Free(&pBI_RR);
-    BigInteger_Free(&pBI_1);
-    BigInteger_Free(&pBI_U);
-    BigInteger_Free(&pBI_S);
-    BigInteger_Free(&pBI_O);
-    for(Index = 0; Index < SLIDING_WINDOW; Index++)
-			BigInteger_Free(&pBI_A[Index]);
-    if (pRValue != NULL)
-        kfree(pRValue);
-
-memory_free:
-    BigInteger_Free(&pBI_Temp1);
-    BigInteger_Free(&pBI_Temp2);
-} /* End of BigInteger_Montgomery_ExpMod */
-
-/* End of crypt_biginteger.c */
diff --git a/drivers/staging/rt3090/common/crypt_dh.c b/drivers/staging/rt3090/common/crypt_dh.c
deleted file mode 100644
index 0f69f2af9038..000000000000
--- a/drivers/staging/rt3090/common/crypt_dh.c
+++ /dev/null
@@ -1,234 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-	Module Name:
-	crypt_dh.c
-
-	Abstract:
-
-	Revision History:
-	Who			When			What
-	--------	----------		----------------------------------------------
-	Eddy        2009/01/19      Create AES-128, AES-192, AES-256, AES-CBC
-*/
-
-#include "crypt_dh.h"
-#include "crypt_biginteger.h"
-
-/*
-========================================================================
-Routine Description:
-    Diffie-Hellman public key generation
-
-Arguments:
-    GValue           Array in UINT8
-    GValueLength     The length of G in bytes
-    PValue           Array in UINT8
-    PValueLength     The length of P in bytes
-    PrivateKey       Private key
-    PrivateKeyLength The length of Private key in bytes
-
-Return Value:
-    PublicKey       Public key
-    PublicKeyLength The length of public key in bytes
-
-Note:
-    Reference to RFC2631
-    PublicKey = G^PrivateKey (mod P)
-========================================================================
-*/
-void DH_PublicKey_Generate (
-    IN UINT8 GValue[],
-    IN UINT GValueLength,
-    IN UINT8 PValue[],
-    IN UINT PValueLength,
-    IN UINT8 PrivateKey[],
-    IN UINT PrivateKeyLength,
-    OUT UINT8 PublicKey[],
-    INOUT UINT *PublicKeyLength)
-{
-    PBIG_INTEGER pBI_G = NULL;
-    PBIG_INTEGER pBI_P = NULL;
-    PBIG_INTEGER pBI_PrivateKey = NULL;
-    PBIG_INTEGER pBI_PublicKey = NULL;
-
-    /*
-     * 1. Check the input parameters
-     *    - GValueLength, PValueLength and PrivateLength must be large than zero
-     *    - PublicKeyLength must be large or equal than PValueLength
-     *    - PValue must be odd
-     *
-     *    - PValue must be prime number (no implement)
-     *    - GValue must be greater than 0 but less than the PValue (no implement)
-     */
-    if (GValueLength == 0) {
-	DBGPRINT(RT_DEBUG_ERROR, ("DH_PublicKey_Generate: G length is (%d)\n", GValueLength));
-        return;
-    } /* End of if */
-    if (PValueLength == 0) {
-	DBGPRINT(RT_DEBUG_ERROR, ("DH_PublicKey_Generate: P length is (%d)\n", PValueLength));
-        return;
-    } /* End of if */
-    if (PrivateKeyLength == 0) {
-	DBGPRINT(RT_DEBUG_ERROR, ("DH_PublicKey_Generate: private key length is (%d)\n", PrivateKeyLength));
-        return;
-    } /* End of if */
-    if (*PublicKeyLength < PValueLength) {
-	DBGPRINT(RT_DEBUG_ERROR, ("DH_PublicKey_Generate: public key length(%d) must be large or equal than P length(%d)\n",
-            *PublicKeyLength, PValueLength));
-        return;
-    } /* End of if */
-    if (!(PValue[PValueLength - 1] & 0x1)) {
-	DBGPRINT(RT_DEBUG_ERROR, ("DH_PublicKey_Generate: P value must be odd\n"));
-        return;
-    } /* End of if */
-
-    /*
-     * 2. Transfer parameters to BigInteger structure
-     */
-    BigInteger_Init(&pBI_G);
-    BigInteger_Init(&pBI_P);
-    BigInteger_Init(&pBI_PrivateKey);
-    BigInteger_Init(&pBI_PublicKey);
-    BigInteger_Bin2BI(GValue, GValueLength, &pBI_G);
-    BigInteger_Bin2BI(PValue, PValueLength, &pBI_P);
-    BigInteger_Bin2BI(PrivateKey, PrivateKeyLength, &pBI_PrivateKey);
-
-    /*
-     * 3. Calculate PublicKey = G^PrivateKey (mod P)
-     *    - BigInteger Operation
-     *    - Montgomery reduction
-     */
-    BigInteger_Montgomery_ExpMod(pBI_G, pBI_PrivateKey, pBI_P, &pBI_PublicKey);
-
-    /*
-     * 4. Transfer BigInteger structure to char array
-     */
-    BigInteger_BI2Bin(pBI_PublicKey, PublicKey, PublicKeyLength);
-
-    BigInteger_Free(&pBI_G);
-    BigInteger_Free(&pBI_P);
-    BigInteger_Free(&pBI_PrivateKey);
-    BigInteger_Free(&pBI_PublicKey);
-} /* End of DH_PublicKey_Generate */
-
-
-/*
-========================================================================
-Routine Description:
-    Diffie-Hellman secret key generation
-
-Arguments:
-    PublicKey        Public key
-    PublicKeyLength  The length of Public key in bytes
-    PValue           Array in UINT8
-    PValueLength     The length of P in bytes
-    PrivateKey       Private key
-    PrivateKeyLength The length of Private key in bytes
-
-Return Value:
-    SecretKey        Secret key
-    SecretKeyLength  The length of secret key in bytes
-
-Note:
-    Reference to RFC2631
-    SecretKey = PublicKey^PrivateKey (mod P)
-========================================================================
-*/
-void DH_SecretKey_Generate (
-    IN UINT8 PublicKey[],
-    IN UINT PublicKeyLength,
-    IN UINT8 PValue[],
-    IN UINT PValueLength,
-    IN UINT8 PrivateKey[],
-    IN UINT PrivateKeyLength,
-    OUT UINT8 SecretKey[],
-    INOUT UINT *SecretKeyLength)
-{
-    PBIG_INTEGER pBI_P = NULL;
-    PBIG_INTEGER pBI_SecretKey = NULL;
-    PBIG_INTEGER pBI_PrivateKey = NULL;
-    PBIG_INTEGER pBI_PublicKey = NULL;
-
-    /*
-     * 1. Check the input parameters
-     *    - PublicKeyLength, PValueLength and PrivateLength must be large than zero
-     *    - SecretKeyLength must be large or equal than PValueLength
-     *    - PValue must be odd
-     *
-     *    - PValue must be prime number (no implement)
-     */
-    if (PublicKeyLength == 0) {
-	DBGPRINT(RT_DEBUG_ERROR, ("DH_SecretKey_Generate: public key length is (%d)\n", PublicKeyLength));
-        return;
-    } /* End of if */
-    if (PValueLength == 0) {
-	DBGPRINT(RT_DEBUG_ERROR, ("DH_SecretKey_Generate: P length is (%d)\n", PValueLength));
-        return;
-    } /* End of if */
-    if (PrivateKeyLength == 0) {
-	DBGPRINT(RT_DEBUG_ERROR, ("DH_SecretKey_Generate: private key length is (%d)\n", PrivateKeyLength));
-        return;
-    } /* End of if */
-    if (*SecretKeyLength < PValueLength) {
-	DBGPRINT(RT_DEBUG_ERROR, ("DH_SecretKey_Generate: secret key length(%d) must be large or equal than P length(%d)\n",
-            *SecretKeyLength, PValueLength));
-        return;
-    } /* End of if */
-    if (!(PValue[PValueLength - 1] & 0x1)) {
-	DBGPRINT(RT_DEBUG_ERROR, ("DH_SecretKey_Generate: P value must be odd\n"));
-        return;
-    } /* End of if */
-
-    /*
-     * 2. Transfer parameters to BigInteger structure
-     */
-    BigInteger_Init(&pBI_P);
-    BigInteger_Init(&pBI_PrivateKey);
-    BigInteger_Init(&pBI_PublicKey);
-    BigInteger_Init(&pBI_SecretKey);
-
-    BigInteger_Bin2BI(PublicKey, PublicKeyLength, &pBI_PublicKey);
-    BigInteger_Bin2BI(PValue, PValueLength, &pBI_P);
-    BigInteger_Bin2BI(PrivateKey, PrivateKeyLength, &pBI_PrivateKey);
-
-    /*
-     * 3. Calculate SecretKey = PublicKey^PrivateKey (mod P)
-     *    - BigInteger Operation
-     *    - Montgomery reduction
-     */
-    BigInteger_Montgomery_ExpMod(pBI_PublicKey, pBI_PrivateKey, pBI_P, &pBI_SecretKey);
-
-    /*
-     * 4. Transfer BigInteger structure to char array
-     */
-    BigInteger_BI2Bin(pBI_SecretKey, SecretKey, SecretKeyLength);
-
-    BigInteger_Free(&pBI_P);
-    BigInteger_Free(&pBI_PrivateKey);
-    BigInteger_Free(&pBI_PublicKey);
-    BigInteger_Free(&pBI_SecretKey);
-} /* End of DH_SecretKey_Generate */
diff --git a/drivers/staging/rt3090/common/crypt_hmac.c b/drivers/staging/rt3090/common/crypt_hmac.c
deleted file mode 100644
index e2854082f1d9..000000000000
--- a/drivers/staging/rt3090/common/crypt_hmac.c
+++ /dev/null
@@ -1,279 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************/
-
-#include "../crypt_hmac.h"
-
-
-#ifdef HMAC_SHA1_SUPPORT
-/*
-========================================================================
-Routine Description:
-    HMAC using SHA1 hash function
-
-Arguments:
-    key             Secret key
-    key_len         The length of the key in bytes
-    message         Message context
-    message_len     The length of message in bytes
-    macLen          Request the length of message authentication code
-
-Return Value:
-    mac             Message authentication code
-
-Note:
-    None
-========================================================================
-*/
-VOID HMAC_SHA1 (
-    IN  const UINT8 Key[],
-    IN  UINT KeyLen,
-    IN  const UINT8 Message[],
-    IN  UINT MessageLen,
-    OUT UINT8 MAC[],
-    IN  UINT MACLen)
-{
-    SHA1_CTX_STRUC sha_ctx1;
-    SHA1_CTX_STRUC sha_ctx2;
-    UINT8 K0[SHA1_BLOCK_SIZE];
-    UINT8 Digest[SHA1_DIGEST_SIZE];
-    UINT index;
-
-    NdisZeroMemory(&sha_ctx1, sizeof(SHA1_CTX_STRUC));
-    NdisZeroMemory(&sha_ctx2, sizeof(SHA1_CTX_STRUC));
-    /*
-     * If the length of K = B(Block size): K0 = K.
-     * If the length of K > B: hash K to obtain an L byte string,
-     * then append (B-L) zeros to create a B-byte string K0 (i.e., K0 = H(K) || 00...00).
-     * If the length of K < B: append zeros to the end of K to create a B-byte string K0
-     */
-    NdisZeroMemory(K0, SHA1_BLOCK_SIZE);
-    if (KeyLen <= SHA1_BLOCK_SIZE)
-        NdisMoveMemory(K0, Key, KeyLen);
-    else
-        RT_SHA1(Key, KeyLen, K0);
-    /* End of if */
-
-    /* Exclusive-Or K0 with ipad */
-    /* ipad: Inner pad; the byte x��36�� repeated B times. */
-    for (index = 0; index < SHA1_BLOCK_SIZE; index++)
-        K0[index] ^= 0x36;
-        /* End of for */
-
-    SHA1_Init(&sha_ctx1);
-    /* H(K0^ipad) */
-    SHA1_Append(&sha_ctx1, K0, sizeof(K0));
-    /* H((K0^ipad)||text) */
-    SHA1_Append(&sha_ctx1, Message, MessageLen);
-    SHA1_End(&sha_ctx1, Digest);
-
-    /* Exclusive-Or K0 with opad and remove ipad */
-    /* opad: Outer pad; the byte x��5c�� repeated B times. */
-    for (index = 0; index < SHA1_BLOCK_SIZE; index++)
-        K0[index] ^= 0x36^0x5c;
-        /* End of for */
-
-    SHA1_Init(&sha_ctx2);
-    /* H(K0^opad) */
-    SHA1_Append(&sha_ctx2, K0, sizeof(K0));
-    /* H( (K0^opad) || H((K0^ipad)||text) ) */
-    SHA1_Append(&sha_ctx2, Digest, SHA1_DIGEST_SIZE);
-    SHA1_End(&sha_ctx2, Digest);
-
-    if (MACLen > SHA1_DIGEST_SIZE)
-        NdisMoveMemory(MAC, Digest, SHA1_DIGEST_SIZE);
-    else
-        NdisMoveMemory(MAC, Digest, MACLen);
-} /* End of HMAC_SHA1 */
-#endif /* HMAC_SHA1_SUPPORT */
-
-
-#ifdef HMAC_SHA256_SUPPORT
-/*
-========================================================================
-Routine Description:
-    HMAC using SHA256 hash function
-
-Arguments:
-    key             Secret key
-    key_len         The length of the key in bytes
-    message         Message context
-    message_len     The length of message in bytes
-    macLen          Request the length of message authentication code
-
-Return Value:
-    mac             Message authentication code
-
-Note:
-    None
-========================================================================
-*/
-VOID HMAC_SHA256 (
-    IN  const UINT8 Key[],
-    IN  UINT KeyLen,
-    IN  const UINT8 Message[],
-    IN  UINT MessageLen,
-    OUT UINT8 MAC[],
-    IN  UINT MACLen)
-{
-    SHA256_CTX_STRUC sha_ctx1;
-    SHA256_CTX_STRUC sha_ctx2;
-    UINT8 K0[SHA256_BLOCK_SIZE];
-    UINT8 Digest[SHA256_DIGEST_SIZE];
-    UINT index;
-
-    NdisZeroMemory(&sha_ctx1, sizeof(SHA256_CTX_STRUC));
-    NdisZeroMemory(&sha_ctx2, sizeof(SHA256_CTX_STRUC));
-    /*
-     * If the length of K = B(Block size): K0 = K.
-     * If the length of K > B: hash K to obtain an L byte string,
-     * then append (B-L) zeros to create a B-byte string K0 (i.e., K0 = H(K) || 00...00).
-     * If the length of K < B: append zeros to the end of K to create a B-byte string K0
-     */
-    NdisZeroMemory(K0, SHA256_BLOCK_SIZE);
-    if (KeyLen <= SHA256_BLOCK_SIZE) {
-        NdisMoveMemory(K0, Key, KeyLen);
-    } else {
-        RT_SHA256(Key, KeyLen, K0);
-    }
-
-    /* Exclusive-Or K0 with ipad */
-    /* ipad: Inner pad; the byte x��36�� repeated B times. */
-    for (index = 0; index < SHA256_BLOCK_SIZE; index++)
-        K0[index] ^= 0x36;
-        /* End of for */
-
-    SHA256_Init(&sha_ctx1);
-    /* H(K0^ipad) */
-    SHA256_Append(&sha_ctx1, K0, sizeof(K0));
-    /* H((K0^ipad)||text) */
-    SHA256_Append(&sha_ctx1, Message, MessageLen);
-    SHA256_End(&sha_ctx1, Digest);
-
-    /* Exclusive-Or K0 with opad and remove ipad */
-    /* opad: Outer pad; the byte x��5c�� repeated B times. */
-    for (index = 0; index < SHA256_BLOCK_SIZE; index++)
-        K0[index] ^= 0x36^0x5c;
-        /* End of for */
-
-    SHA256_Init(&sha_ctx2);
-    /* H(K0^opad) */
-    SHA256_Append(&sha_ctx2, K0, sizeof(K0));
-    /* H( (K0^opad) || H((K0^ipad)||text) ) */
-    SHA256_Append(&sha_ctx2, Digest, SHA256_DIGEST_SIZE);
-    SHA256_End(&sha_ctx2, Digest);
-
-    if (MACLen > SHA256_DIGEST_SIZE)
-        NdisMoveMemory(MAC, Digest,SHA256_DIGEST_SIZE);
-    else
-        NdisMoveMemory(MAC, Digest, MACLen);
-
-} /* End of HMAC_SHA256 */
-#endif /* HMAC_SHA256_SUPPORT */
-
-
-#ifdef HMAC_MD5_SUPPORT
-/*
-========================================================================
-Routine Description:
-    HMAC using MD5 hash function
-
-Arguments:
-    key             Secret key
-    key_len         The length of the key in bytes
-    message         Message context
-    message_len     The length of message in bytes
-    macLen          Request the length of message authentication code
-
-Return Value:
-    mac             Message authentication code
-
-Note:
-    None
-========================================================================
-*/
-VOID HMAC_MD5(
-    IN  const UINT8 Key[],
-    IN  UINT KeyLen,
-    IN  const UINT8 Message[],
-    IN  UINT MessageLen,
-    OUT UINT8 MAC[],
-    IN  UINT MACLen)
-{
-    MD5_CTX_STRUC md5_ctx1;
-    MD5_CTX_STRUC md5_ctx2;
-    UINT8 K0[MD5_BLOCK_SIZE];
-    UINT8 Digest[MD5_DIGEST_SIZE];
-    UINT index;
-
-    NdisZeroMemory(&md5_ctx1, sizeof(MD5_CTX_STRUC));
-    NdisZeroMemory(&md5_ctx2, sizeof(MD5_CTX_STRUC));
-    /*
-     * If the length of K = B(Block size): K0 = K.
-     * If the length of K > B: hash K to obtain an L byte string,
-     * then append (B-L) zeros to create a B-byte string K0 (i.e., K0 = H(K) || 00...00).
-     * If the length of K < B: append zeros to the end of K to create a B-byte string K0
-     */
-    NdisZeroMemory(K0, MD5_BLOCK_SIZE);
-    if (KeyLen <= MD5_BLOCK_SIZE) {
-        NdisMoveMemory(K0, Key, KeyLen);
-    } else {
-        RT_MD5(Key, KeyLen, K0);
-    }
-
-    /* Exclusive-Or K0 with ipad */
-    /* ipad: Inner pad; the byte x��36�� repeated B times. */
-    for (index = 0; index < MD5_BLOCK_SIZE; index++)
-        K0[index] ^= 0x36;
-        /* End of for */
-
-    MD5_Init(&md5_ctx1);
-    /* H(K0^ipad) */
-    MD5_Append(&md5_ctx1, K0, sizeof(K0));
-    /* H((K0^ipad)||text) */
-    MD5_Append(&md5_ctx1, Message, MessageLen);
-    MD5_End(&md5_ctx1, Digest);
-
-    /* Exclusive-Or K0 with opad and remove ipad */
-    /* opad: Outer pad; the byte x��5c�� repeated B times. */
-    for (index = 0; index < MD5_BLOCK_SIZE; index++)
-        K0[index] ^= 0x36^0x5c;
-        /* End of for */
-
-    MD5_Init(&md5_ctx2);
-    /* H(K0^opad) */
-    MD5_Append(&md5_ctx2, K0, sizeof(K0));
-    /* H( (K0^opad) || H((K0^ipad)||text) ) */
-    MD5_Append(&md5_ctx2, Digest, MD5_DIGEST_SIZE);
-    MD5_End(&md5_ctx2, Digest);
-
-    if (MACLen > MD5_DIGEST_SIZE)
-        NdisMoveMemory(MAC, Digest, MD5_DIGEST_SIZE);
-    else
-        NdisMoveMemory(MAC, Digest, MACLen);
-} /* End of HMAC_SHA256 */
-#endif /* HMAC_MD5_SUPPORT */
-
-/* End of crypt_hmac.c */
diff --git a/drivers/staging/rt3090/common/crypt_md5.c b/drivers/staging/rt3090/common/crypt_md5.c
deleted file mode 100644
index b09326540f5e..000000000000
--- a/drivers/staging/rt3090/common/crypt_md5.c
+++ /dev/null
@@ -1,353 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************/
-
-#include "../crypt_md5.h"
-
-
-#ifdef MD5_SUPPORT
-/*
- * F, G, H and I are basic MD5 functions.
- */
-#define F(x, y, z) (((x) & (y)) | ((~x) & (z)))
-#define G(x, y, z) (((x) & (z)) | ((y) & (~z)))
-#define H(x, y, z) ((x) ^ (y) ^ (z))
-#define I(x, y, z) ((y) ^ ((x) | (~z)))
-
-#define ROTL(x,n,w) ((x << n) | (x >> (w - n)))
-#define ROTL32(x,n) ROTL(x,n,32) /* 32 bits word */
-
-#define ROUND1(a, b, c, d, x, s, ac) {          \
-    (a) += F((b),(c),(d)) + (x) + (UINT32)(ac); \
-    (a)  = ROTL32((a),(s));                     \
-    (a) += (b);                                 \
-}
-#define ROUND2(a, b, c, d, x, s, ac) {          \
-    (a) += G((b),(c),(d)) + (x) + (UINT32)(ac); \
-    (a)  = ROTL32((a),(s));                     \
-    (a) += (b);                                 \
-}
-#define ROUND3(a, b, c, d, x, s, ac) {          \
-    (a) += H((b),(c),(d)) + (x) + (UINT32)(ac); \
-    (a)  = ROTL32((a),(s));                     \
-    (a) += (b);                                 \
-}
-#define ROUND4(a, b, c, d, x, s, ac) {          \
-    (a) += I((b),(c),(d)) + (x) + (UINT32)(ac); \
-    (a)  = ROTL32((a),(s));                     \
-    (a) += (b);                                 \
-}
-static const UINT32 MD5_DefaultHashValue[4] = {
-    0x67452301UL, 0xefcdab89UL, 0x98badcfeUL, 0x10325476UL
-};
-#endif /* MD5_SUPPORT */
-
-
-#ifdef MD5_SUPPORT
-/*
-========================================================================
-Routine Description:
-    Initial Md5_CTX_STRUC
-
-Arguments:
-    pMD5_CTX        Pointer to Md5_CTX_STRUC
-
-Return Value:
-    None
-
-Note:
-    None
-========================================================================
-*/
-VOID MD5_Init (
-    IN  MD5_CTX_STRUC *pMD5_CTX)
-{
-    NdisMoveMemory(pMD5_CTX->HashValue, MD5_DefaultHashValue,
-        sizeof(MD5_DefaultHashValue));
-    NdisZeroMemory(pMD5_CTX->Block, MD5_BLOCK_SIZE);
-    pMD5_CTX->BlockLen   = 0;
-    pMD5_CTX->MessageLen = 0;
-} /* End of MD5_Init */
-
-
-/*
-========================================================================
-Routine Description:
-    MD5 computation for one block (512 bits)
-
-Arguments:
-    pMD5_CTX        Pointer to Md5_CTX_STRUC
-
-Return Value:
-    None
-
-Note:
-    T[i] := floor(abs(sin(i + 1)) * (2 pow 32)), i is number of round
-========================================================================
-*/
-VOID MD5_Hash (
-    IN  MD5_CTX_STRUC *pMD5_CTX)
-{
-    UINT32 X_i;
-    UINT32 X[16];
-    UINT32 a,b,c,d;
-
-    /* Prepare the message schedule, {X_i} */
-    NdisMoveMemory(X, pMD5_CTX->Block, MD5_BLOCK_SIZE);
-    for (X_i = 0; X_i < 16; X_i++)
-        X[X_i] = cpu2le32(X[X_i]); /* Endian Swap */
-        /* End of for */
-
-    /* MD5 hash computation */
-    /* Initialize the working variables */
-    a = pMD5_CTX->HashValue[0];
-    b = pMD5_CTX->HashValue[1];
-    c = pMD5_CTX->HashValue[2];
-    d = pMD5_CTX->HashValue[3];
-
-    /*
-     *  Round 1
-     *  Let [abcd k s i] denote the operation
-     *  a = b + ((a + F(b,c,d) + X[k] + T[i]) <<< s)
-     */
-    ROUND1(a, b, c, d, X[ 0],  7, 0xd76aa478); /* 1 */
-    ROUND1(d, a, b, c, X[ 1], 12, 0xe8c7b756); /* 2 */
-    ROUND1(c, d, a, b, X[ 2], 17, 0x242070db); /* 3 */
-    ROUND1(b, c, d, a, X[ 3], 22, 0xc1bdceee); /* 4 */
-    ROUND1(a, b, c, d, X[ 4],  7, 0xf57c0faf); /* 5 */
-    ROUND1(d, a, b, c, X[ 5], 12, 0x4787c62a); /* 6 */
-    ROUND1(c, d, a, b, X[ 6], 17, 0xa8304613); /* 7 */
-    ROUND1(b, c, d, a, X[ 7], 22, 0xfd469501); /* 8 */
-    ROUND1(a, b, c, d, X[ 8],  7, 0x698098d8); /* 9 */
-    ROUND1(d, a, b, c, X[ 9], 12, 0x8b44f7af); /* 10 */
-    ROUND1(c, d, a, b, X[10], 17, 0xffff5bb1); /* 11 */
-    ROUND1(b, c, d, a, X[11], 22, 0x895cd7be); /* 12 */
-    ROUND1(a, b, c, d, X[12],  7, 0x6b901122); /* 13 */
-    ROUND1(d, a, b, c, X[13], 12, 0xfd987193); /* 14 */
-    ROUND1(c, d, a, b, X[14], 17, 0xa679438e); /* 15 */
-    ROUND1(b, c, d, a, X[15], 22, 0x49b40821); /* 16 */
-
-    /*
-     *  Round 2
-     *  Let [abcd k s i] denote the operation
-     *  a = b + ((a + G(b,c,d) + X[k] + T[i]) <<< s)
-     */
-    ROUND2(a, b, c, d, X[ 1],  5, 0xf61e2562); /* 17 */
-    ROUND2(d, a, b, c, X[ 6],  9, 0xc040b340); /* 18 */
-    ROUND2(c, d, a, b, X[11], 14, 0x265e5a51); /* 19 */
-    ROUND2(b, c, d, a, X[ 0], 20, 0xe9b6c7aa); /* 20 */
-    ROUND2(a, b, c, d, X[ 5],  5, 0xd62f105d); /* 21 */
-    ROUND2(d, a, b, c, X[10],  9,  0x2441453); /* 22 */
-    ROUND2(c, d, a, b, X[15], 14, 0xd8a1e681); /* 23 */
-    ROUND2(b, c, d, a, X[ 4], 20, 0xe7d3fbc8); /* 24 */
-    ROUND2(a, b, c, d, X[ 9],  5, 0x21e1cde6); /* 25 */
-    ROUND2(d, a, b, c, X[14],  9, 0xc33707d6); /* 26 */
-    ROUND2(c, d, a, b, X[ 3], 14, 0xf4d50d87); /* 27 */
-    ROUND2(b, c, d, a, X[ 8], 20, 0x455a14ed); /* 28 */
-    ROUND2(a, b, c, d, X[13],  5, 0xa9e3e905); /* 29 */
-    ROUND2(d, a, b, c, X[ 2],  9, 0xfcefa3f8); /* 30 */
-    ROUND2(c, d, a, b, X[ 7], 14, 0x676f02d9); /* 31 */
-    ROUND2(b, c, d, a, X[12], 20, 0x8d2a4c8a); /* 32 */
-
-    /*
-     *  Round 3
-     *  Let [abcd k s t] denote the operation
-     *  a = b + ((a + H(b,c,d) + X[k] + T[i]) <<< s)
-     */
-    ROUND3(a, b, c, d, X[ 5],  4, 0xfffa3942); /* 33 */
-    ROUND3(d, a, b, c, X[ 8], 11, 0x8771f681); /* 34 */
-    ROUND3(c, d, a, b, X[11], 16, 0x6d9d6122); /* 35 */
-    ROUND3(b, c, d, a, X[14], 23, 0xfde5380c); /* 36 */
-    ROUND3(a, b, c, d, X[ 1],  4, 0xa4beea44); /* 37 */
-    ROUND3(d, a, b, c, X[ 4], 11, 0x4bdecfa9); /* 38 */
-    ROUND3(c, d, a, b, X[ 7], 16, 0xf6bb4b60); /* 39 */
-    ROUND3(b, c, d, a, X[10], 23, 0xbebfbc70); /* 40 */
-    ROUND3(a, b, c, d, X[13],  4, 0x289b7ec6); /* 41 */
-    ROUND3(d, a, b, c, X[ 0], 11, 0xeaa127fa); /* 42 */
-    ROUND3(c, d, a, b, X[ 3], 16, 0xd4ef3085); /* 43 */
-    ROUND3(b, c, d, a, X[ 6], 23,  0x4881d05); /* 44 */
-    ROUND3(a, b, c, d, X[ 9],  4, 0xd9d4d039); /* 45 */
-    ROUND3(d, a, b, c, X[12], 11, 0xe6db99e5); /* 46 */
-    ROUND3(c, d, a, b, X[15], 16, 0x1fa27cf8); /* 47 */
-    ROUND3(b, c, d, a, X[ 2], 23, 0xc4ac5665); /* 48 */
-
-    /*
-     *  Round 4
-     *  Let [abcd k s t] denote the operation
-     *  a = b + ((a + I(b,c,d) + X[k] + T[i]) <<< s)
-     */
-    ROUND4(a, b, c, d, X[ 0],  6, 0xf4292244); /* 49 */
-    ROUND4(d, a, b, c, X[ 7], 10, 0x432aff97); /* 50 */
-    ROUND4(c, d, a, b, X[14], 15, 0xab9423a7); /* 51 */
-    ROUND4(b, c, d, a, X[ 5], 21, 0xfc93a039); /* 52 */
-    ROUND4(a, b, c, d, X[12],  6, 0x655b59c3); /* 53 */
-    ROUND4(d, a, b, c, X[ 3], 10, 0x8f0ccc92); /* 54 */
-    ROUND4(c, d, a, b, X[10], 15, 0xffeff47d); /* 55 */
-    ROUND4(b, c, d, a, X[ 1], 21, 0x85845dd1); /* 56 */
-    ROUND4(a, b, c, d, X[ 8],  6, 0x6fa87e4f); /* 57 */
-    ROUND4(d, a, b, c, X[15], 10, 0xfe2ce6e0); /* 58 */
-    ROUND4(c, d, a, b, X[ 6], 15, 0xa3014314); /* 59 */
-    ROUND4(b, c, d, a, X[13], 21, 0x4e0811a1); /* 60 */
-    ROUND4(a, b, c, d, X[ 4],  6, 0xf7537e82); /* 61 */
-    ROUND4(d, a, b, c, X[11], 10, 0xbd3af235); /* 62 */
-    ROUND4(c, d, a, b, X[ 2], 15, 0x2ad7d2bb); /* 63 */
-    ROUND4(b, c, d, a, X[ 9], 21, 0xeb86d391); /* 64 */
-
-    /* Compute the i^th intermediate hash value H^(i) */
-    pMD5_CTX->HashValue[0] += a;
-    pMD5_CTX->HashValue[1] += b;
-    pMD5_CTX->HashValue[2] += c;
-    pMD5_CTX->HashValue[3] += d;
-
-    NdisZeroMemory(pMD5_CTX->Block, MD5_BLOCK_SIZE);
-    pMD5_CTX->BlockLen = 0;
-} /* End of MD5_Hash */
-
-
-/*
-========================================================================
-Routine Description:
-    The message is appended to block. If block size > 64 bytes, the MD5_Hash
-will be called.
-
-Arguments:
-    pMD5_CTX        Pointer to MD5_CTX_STRUC
-    message         Message context
-    messageLen      The length of message in bytes
-
-Return Value:
-    None
-
-Note:
-    None
-========================================================================
-*/
-VOID MD5_Append (
-    IN  MD5_CTX_STRUC *pMD5_CTX,
-    IN  const UINT8 Message[],
-    IN  UINT MessageLen)
-{
-    UINT appendLen = 0;
-    UINT diffLen = 0;
-
-    while (appendLen != MessageLen) {
-        diffLen = MessageLen - appendLen;
-        if ((pMD5_CTX->BlockLen + diffLen) < MD5_BLOCK_SIZE) {
-            NdisMoveMemory(pMD5_CTX->Block + pMD5_CTX->BlockLen,
-                Message + appendLen, diffLen);
-            pMD5_CTX->BlockLen += diffLen;
-            appendLen += diffLen;
-        }
-        else
-        {
-            NdisMoveMemory(pMD5_CTX->Block + pMD5_CTX->BlockLen,
-                Message + appendLen, MD5_BLOCK_SIZE - pMD5_CTX->BlockLen);
-            appendLen += (MD5_BLOCK_SIZE - pMD5_CTX->BlockLen);
-            pMD5_CTX->BlockLen = MD5_BLOCK_SIZE;
-            MD5_Hash(pMD5_CTX);
-        } /* End of if */
-    } /* End of while */
-    pMD5_CTX->MessageLen += MessageLen;
-} /* End of MD5_Append */
-
-
-/*
-========================================================================
-Routine Description:
-    1. Append bit 1 to end of the message
-    2. Append the length of message in rightmost 64 bits
-    3. Transform the Hash Value to digest message
-
-Arguments:
-    pMD5_CTX        Pointer to MD5_CTX_STRUC
-
-Return Value:
-    digestMessage   Digest message
-
-Note:
-    None
-========================================================================
-*/
-VOID MD5_End (
-    IN  MD5_CTX_STRUC *pMD5_CTX,
-    OUT UINT8 DigestMessage[])
-{
-    UINT index;
-    UINT64 message_length_bits;
-
-    /* append 1 bits to end of the message */
-    NdisFillMemory(pMD5_CTX->Block + pMD5_CTX->BlockLen, 1, 0x80);
-
-    /* 55 = 64 - 8 - 1: append 1 bit(1 byte) and message length (8 bytes) */
-    if (pMD5_CTX->BlockLen > 55)
-        MD5_Hash(pMD5_CTX);
-        /* End of if */
-
-    /* Append the length of message in rightmost 64 bits */
-    message_length_bits = pMD5_CTX->MessageLen*8;
-    message_length_bits = cpu2le64(message_length_bits);
-    NdisMoveMemory(&pMD5_CTX->Block[56], &message_length_bits, 8);
-    MD5_Hash(pMD5_CTX);
-
-    /* Return message digest, transform the UINT32 hash value to bytes */
-    for (index = 0; index < 4;index++)
-        pMD5_CTX->HashValue[index] = cpu2le32(pMD5_CTX->HashValue[index]);
-        /* End of for */
-    NdisMoveMemory(DigestMessage, pMD5_CTX->HashValue, MD5_DIGEST_SIZE);
-} /* End of MD5_End */
-
-
-/*
-========================================================================
-Routine Description:
-    MD5 algorithm
-
-Arguments:
-    message         Message context
-    messageLen      The length of message in bytes
-
-Return Value:
-    digestMessage   Digest message
-
-Note:
-    None
-========================================================================
-*/
-VOID RT_MD5 (
-    IN  const UINT8 Message[],
-    IN  UINT MessageLen,
-    OUT UINT8 DigestMessage[])
-{
-    MD5_CTX_STRUC md5_ctx;
-
-    NdisZeroMemory(&md5_ctx, sizeof(MD5_CTX_STRUC));
-    MD5_Init(&md5_ctx);
-    MD5_Append(&md5_ctx, Message, MessageLen);
-    MD5_End(&md5_ctx, DigestMessage);
-} /* End of RT_MD5 */
-
-#endif /* MD5_SUPPORT */
-
-/* End of crypt_md5.c */
diff --git a/drivers/staging/rt3090/common/crypt_sha2.c b/drivers/staging/rt3090/common/crypt_sha2.c
deleted file mode 100644
index c7490d0d3c44..000000000000
--- a/drivers/staging/rt3090/common/crypt_sha2.c
+++ /dev/null
@@ -1,536 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************/
-
-#include "../crypt_sha2.h"
-
-
-/* Basic operations */
-#define SHR(x,n) (x >> n) /* SHR(x)^n, right shift n bits , x is w-bit word, 0 <= n <= w */
-#define ROTR(x,n,w) ((x >> n) | (x << (w - n))) /* ROTR(x)^n, circular right shift n bits , x is w-bit word, 0 <= n <= w */
-#define ROTL(x,n,w) ((x << n) | (x >> (w - n))) /* ROTL(x)^n, circular left shift n bits , x is w-bit word, 0 <= n <= w */
-#define ROTR32(x,n) ROTR(x,n,32) /* 32 bits word */
-#define ROTL32(x,n) ROTL(x,n,32) /* 32 bits word */
-
-/* Basic functions */
-#define Ch(x,y,z) ((x & y) ^ ((~x) & z))
-#define Maj(x,y,z) ((x & y) ^ (x & z) ^ (y & z))
-#define Parity(x,y,z) (x ^ y ^ z)
-
-#ifdef SHA1_SUPPORT
-/* SHA1 constants */
-#define SHA1_MASK 0x0000000f
-static const UINT32 SHA1_K[4] = {
-    0x5a827999UL, 0x6ed9eba1UL, 0x8f1bbcdcUL, 0xca62c1d6UL
-};
-static const UINT32 SHA1_DefaultHashValue[5] = {
-    0x67452301UL, 0xefcdab89UL, 0x98badcfeUL, 0x10325476UL, 0xc3d2e1f0UL
-};
-#endif /* SHA1_SUPPORT */
-
-
-#ifdef SHA256_SUPPORT
-/* SHA256 functions */
-#define Zsigma_256_0(x) (ROTR32(x,2) ^ ROTR32(x,13) ^ ROTR32(x,22))
-#define Zsigma_256_1(x) (ROTR32(x,6) ^ ROTR32(x,11) ^ ROTR32(x,25))
-#define Sigma_256_0(x)  (ROTR32(x,7) ^ ROTR32(x,18) ^ SHR(x,3))
-#define Sigma_256_1(x)  (ROTR32(x,17) ^ ROTR32(x,19) ^ SHR(x,10))
-/* SHA256 constants */
-static const UINT32 SHA256_K[64] = {
-    0x428a2f98UL, 0x71374491UL, 0xb5c0fbcfUL, 0xe9b5dba5UL,
-    0x3956c25bUL, 0x59f111f1UL, 0x923f82a4UL, 0xab1c5ed5UL,
-    0xd807aa98UL, 0x12835b01UL, 0x243185beUL, 0x550c7dc3UL,
-    0x72be5d74UL, 0x80deb1feUL, 0x9bdc06a7UL, 0xc19bf174UL,
-    0xe49b69c1UL, 0xefbe4786UL, 0x0fc19dc6UL, 0x240ca1ccUL,
-    0x2de92c6fUL, 0x4a7484aaUL, 0x5cb0a9dcUL, 0x76f988daUL,
-    0x983e5152UL, 0xa831c66dUL, 0xb00327c8UL, 0xbf597fc7UL,
-    0xc6e00bf3UL, 0xd5a79147UL, 0x06ca6351UL, 0x14292967UL,
-    0x27b70a85UL, 0x2e1b2138UL, 0x4d2c6dfcUL, 0x53380d13UL,
-    0x650a7354UL, 0x766a0abbUL, 0x81c2c92eUL, 0x92722c85UL,
-    0xa2bfe8a1UL, 0xa81a664bUL, 0xc24b8b70UL, 0xc76c51a3UL,
-    0xd192e819UL, 0xd6990624UL, 0xf40e3585UL, 0x106aa070UL,
-    0x19a4c116UL, 0x1e376c08UL, 0x2748774cUL, 0x34b0bcb5UL,
-    0x391c0cb3UL, 0x4ed8aa4aUL, 0x5b9cca4fUL, 0x682e6ff3UL,
-    0x748f82eeUL, 0x78a5636fUL, 0x84c87814UL, 0x8cc70208UL,
-    0x90befffaUL, 0xa4506cebUL, 0xbef9a3f7UL, 0xc67178f2UL
-};
-static const UINT32 SHA256_DefaultHashValue[8] = {
-    0x6a09e667UL, 0xbb67ae85UL, 0x3c6ef372UL, 0xa54ff53aUL,
-    0x510e527fUL, 0x9b05688cUL, 0x1f83d9abUL, 0x5be0cd19UL
-};
-#endif /* SHA256_SUPPORT */
-
-
-#ifdef SHA1_SUPPORT
-/*
-========================================================================
-Routine Description:
-    Initial SHA1_CTX_STRUC
-
-Arguments:
-    pSHA_CTX        Pointer to SHA1_CTX_STRUC
-
-Return Value:
-    None
-
-Note:
-    None
-========================================================================
-*/
-VOID SHA1_Init (
-    IN  SHA1_CTX_STRUC *pSHA_CTX)
-{
-    NdisMoveMemory(pSHA_CTX->HashValue, SHA1_DefaultHashValue,
-        sizeof(SHA1_DefaultHashValue));
-    NdisZeroMemory(pSHA_CTX->Block, SHA1_BLOCK_SIZE);
-    pSHA_CTX->MessageLen = 0;
-    pSHA_CTX->BlockLen   = 0;
-} /* End of SHA1_Init */
-
-
-/*
-========================================================================
-Routine Description:
-    SHA1 computation for one block (512 bits)
-
-Arguments:
-    pSHA_CTX        Pointer to SHA1_CTX_STRUC
-
-Return Value:
-    None
-
-Note:
-    None
-========================================================================
-*/
-VOID SHA1_Hash (
-    IN  SHA1_CTX_STRUC *pSHA_CTX)
-{
-    UINT32 W_i,t,s;
-    UINT32 W[16];
-    UINT32 a,b,c,d,e,T,f_t = 0;
-
-    /* Prepare the message schedule, {W_i}, 0 < t < 15 */
-    NdisMoveMemory(W, pSHA_CTX->Block, SHA1_BLOCK_SIZE);
-    for (W_i = 0; W_i < 16; W_i++)
-        W[W_i] = cpu2be32(W[W_i]); /* Endian Swap */
-        /* End of for */
-
-    /* SHA256 hash computation */
-    /* Initialize the working variables */
-    a = pSHA_CTX->HashValue[0];
-    b = pSHA_CTX->HashValue[1];
-    c = pSHA_CTX->HashValue[2];
-    d = pSHA_CTX->HashValue[3];
-    e = pSHA_CTX->HashValue[4];
-
-    /* 80 rounds */
-    for (t = 0;t < 80;t++) {
-        s = t & SHA1_MASK;
-        if (t > 15) { /* Prepare the message schedule, {W_i}, 16 < t < 79 */
-            W[s] = (W[(s+13) & SHA1_MASK]) ^ (W[(s+8) & SHA1_MASK]) ^ (W[(s+2) & SHA1_MASK]) ^ W[s];
-            W[s] = ROTL32(W[s],1);
-        } /* End of if */
-        switch (t / 20) {
-            case 0:
-                 f_t = Ch(b,c,d);
-                 break;
-            case 1:
-                 f_t = Parity(b,c,d);
-                 break;
-            case 2:
-                 f_t = Maj(b,c,d);
-                 break;
-            case 3:
-                 f_t = Parity(b,c,d);
-                 break;
-        } /* End of switch */
-        T = ROTL32(a,5) + f_t + e + SHA1_K[t / 20] + W[s];
-        e = d;
-        d = c;
-        c = ROTL32(b,30);
-        b = a;
-        a = T;
-     } /* End of for */
-
-     /* Compute the i^th intermediate hash value H^(i) */
-     pSHA_CTX->HashValue[0] += a;
-     pSHA_CTX->HashValue[1] += b;
-     pSHA_CTX->HashValue[2] += c;
-     pSHA_CTX->HashValue[3] += d;
-     pSHA_CTX->HashValue[4] += e;
-
-    NdisZeroMemory(pSHA_CTX->Block, SHA1_BLOCK_SIZE);
-    pSHA_CTX->BlockLen = 0;
-} /* End of SHA1_Hash */
-
-
-/*
-========================================================================
-Routine Description:
-    The message is appended to block. If block size > 64 bytes, the SHA1_Hash
-will be called.
-
-Arguments:
-    pSHA_CTX        Pointer to SHA1_CTX_STRUC
-    message         Message context
-    messageLen      The length of message in bytes
-
-Return Value:
-    None
-
-Note:
-    None
-========================================================================
-*/
-VOID SHA1_Append (
-    IN  SHA1_CTX_STRUC *pSHA_CTX,
-    IN  const UINT8 Message[],
-    IN  UINT MessageLen)
-{
-    UINT appendLen = 0;
-    UINT diffLen   = 0;
-
-    while (appendLen != MessageLen) {
-        diffLen = MessageLen - appendLen;
-        if ((pSHA_CTX->BlockLen + diffLen) <  SHA1_BLOCK_SIZE) {
-            NdisMoveMemory(pSHA_CTX->Block + pSHA_CTX->BlockLen,
-                Message + appendLen, diffLen);
-            pSHA_CTX->BlockLen += diffLen;
-            appendLen += diffLen;
-        }
-        else
-        {
-            NdisMoveMemory(pSHA_CTX->Block + pSHA_CTX->BlockLen,
-                Message + appendLen, SHA1_BLOCK_SIZE - pSHA_CTX->BlockLen);
-            appendLen += (SHA1_BLOCK_SIZE - pSHA_CTX->BlockLen);
-            pSHA_CTX->BlockLen = SHA1_BLOCK_SIZE;
-            SHA1_Hash(pSHA_CTX);
-        } /* End of if */
-    } /* End of while */
-    pSHA_CTX->MessageLen += MessageLen;
-} /* End of SHA1_Append */
-
-
-/*
-========================================================================
-Routine Description:
-    1. Append bit 1 to end of the message
-    2. Append the length of message in rightmost 64 bits
-    3. Transform the Hash Value to digest message
-
-Arguments:
-    pSHA_CTX        Pointer to SHA1_CTX_STRUC
-
-Return Value:
-    digestMessage   Digest message
-
-Note:
-    None
-========================================================================
-*/
-VOID SHA1_End (
-    IN  SHA1_CTX_STRUC *pSHA_CTX,
-    OUT UINT8 DigestMessage[])
-{
-    UINT index;
-    UINT64 message_length_bits;
-
-    /* Append bit 1 to end of the message */
-    NdisFillMemory(pSHA_CTX->Block + pSHA_CTX->BlockLen, 1, 0x80);
-
-    /* 55 = 64 - 8 - 1: append 1 bit(1 byte) and message length (8 bytes) */
-    if (pSHA_CTX->BlockLen > 55)
-        SHA1_Hash(pSHA_CTX);
-        /* End of if */
-
-    /* Append the length of message in rightmost 64 bits */
-    message_length_bits = pSHA_CTX->MessageLen*8;
-    message_length_bits = cpu2be64(message_length_bits);
-    NdisMoveMemory(&pSHA_CTX->Block[56], &message_length_bits, 8);
-    SHA1_Hash(pSHA_CTX);
-
-    /* Return message digest, transform the UINT32 hash value to bytes */
-    for (index = 0; index < 5;index++)
-        pSHA_CTX->HashValue[index] = cpu2be32(pSHA_CTX->HashValue[index]);
-        /* End of for */
-    NdisMoveMemory(DigestMessage, pSHA_CTX->HashValue, SHA1_DIGEST_SIZE);
-} /* End of SHA1_End */
-
-
-/*
-========================================================================
-Routine Description:
-    SHA1 algorithm
-
-Arguments:
-    message         Message context
-    messageLen      The length of message in bytes
-
-Return Value:
-    digestMessage   Digest message
-
-Note:
-    None
-========================================================================
-*/
-VOID RT_SHA1 (
-    IN  const UINT8 Message[],
-    IN  UINT MessageLen,
-    OUT UINT8 DigestMessage[])
-{
-
-    SHA1_CTX_STRUC sha_ctx;
-
-    NdisZeroMemory(&sha_ctx, sizeof(SHA1_CTX_STRUC));
-    SHA1_Init(&sha_ctx);
-    SHA1_Append(&sha_ctx, Message, MessageLen);
-    SHA1_End(&sha_ctx, DigestMessage);
-} /* End of RT_SHA1 */
-#endif /* SHA1_SUPPORT */
-
-
-#ifdef SHA256_SUPPORT
-/*
-========================================================================
-Routine Description:
-    Initial SHA256_CTX_STRUC
-
-Arguments:
-    pSHA_CTX    Pointer to SHA256_CTX_STRUC
-
-Return Value:
-    None
-
-Note:
-    None
-========================================================================
-*/
-VOID SHA256_Init (
-    IN  SHA256_CTX_STRUC *pSHA_CTX)
-{
-    NdisMoveMemory(pSHA_CTX->HashValue, SHA256_DefaultHashValue,
-        sizeof(SHA256_DefaultHashValue));
-    NdisZeroMemory(pSHA_CTX->Block, SHA256_BLOCK_SIZE);
-    pSHA_CTX->MessageLen = 0;
-    pSHA_CTX->BlockLen   = 0;
-} /* End of SHA256_Init */
-
-
-/*
-========================================================================
-Routine Description:
-    SHA256 computation for one block (512 bits)
-
-Arguments:
-    pSHA_CTX    Pointer to SHA256_CTX_STRUC
-
-Return Value:
-    None
-
-Note:
-    None
-========================================================================
-*/
-VOID SHA256_Hash (
-    IN  SHA256_CTX_STRUC *pSHA_CTX)
-{
-    UINT32 W_i,t;
-    UINT32 W[64];
-    UINT32 a,b,c,d,e,f,g,h,T1,T2;
-
-    /* Prepare the message schedule, {W_i}, 0 < t < 15 */
-    NdisMoveMemory(W, pSHA_CTX->Block, SHA256_BLOCK_SIZE);
-    for (W_i = 0; W_i < 16; W_i++)
-        W[W_i] = cpu2be32(W[W_i]); /* Endian Swap */
-        /* End of for */
-
-    /* SHA256 hash computation */
-    /* Initialize the working variables */
-    a = pSHA_CTX->HashValue[0];
-    b = pSHA_CTX->HashValue[1];
-    c = pSHA_CTX->HashValue[2];
-    d = pSHA_CTX->HashValue[3];
-    e = pSHA_CTX->HashValue[4];
-    f = pSHA_CTX->HashValue[5];
-    g = pSHA_CTX->HashValue[6];
-    h = pSHA_CTX->HashValue[7];
-
-    /* 64 rounds */
-    for (t = 0;t < 64;t++) {
-        if (t > 15) /* Prepare the message schedule, {W_i}, 16 < t < 63 */
-            W[t] = Sigma_256_1(W[t-2]) + W[t-7] + Sigma_256_0(W[t-15]) + W[t-16];
-            /* End of if */
-        T1 = h + Zsigma_256_1(e) + Ch(e,f,g) + SHA256_K[t] + W[t];
-        T2 = Zsigma_256_0(a) + Maj(a,b,c);
-        h = g;
-        g = f;
-        f = e;
-        e = d + T1;
-        d = c;
-        c = b;
-        b = a;
-        a = T1 + T2;
-     } /* End of for */
-
-     /* Compute the i^th intermediate hash value H^(i) */
-     pSHA_CTX->HashValue[0] += a;
-     pSHA_CTX->HashValue[1] += b;
-     pSHA_CTX->HashValue[2] += c;
-     pSHA_CTX->HashValue[3] += d;
-     pSHA_CTX->HashValue[4] += e;
-     pSHA_CTX->HashValue[5] += f;
-     pSHA_CTX->HashValue[6] += g;
-     pSHA_CTX->HashValue[7] += h;
-
-    NdisZeroMemory(pSHA_CTX->Block, SHA256_BLOCK_SIZE);
-    pSHA_CTX->BlockLen = 0;
-} /* End of SHA256_Hash */
-
-
-/*
-========================================================================
-Routine Description:
-    The message is appended to block. If block size > 64 bytes, the SHA256_Hash
-will be called.
-
-Arguments:
-    pSHA_CTX    Pointer to SHA256_CTX_STRUC
-    message     Message context
-    messageLen  The length of message in bytes
-
-Return Value:
-    None
-
-Note:
-    None
-========================================================================
-*/
-VOID SHA256_Append (
-    IN  SHA256_CTX_STRUC *pSHA_CTX,
-    IN  const UINT8 Message[],
-    IN  UINT MessageLen)
-{
-    UINT appendLen = 0;
-    UINT diffLen   = 0;
-
-    while (appendLen != MessageLen) {
-        diffLen = MessageLen - appendLen;
-        if ((pSHA_CTX->BlockLen + diffLen) <  SHA256_BLOCK_SIZE) {
-            NdisMoveMemory(pSHA_CTX->Block + pSHA_CTX->BlockLen,
-                Message + appendLen, diffLen);
-            pSHA_CTX->BlockLen += diffLen;
-            appendLen += diffLen;
-        }
-        else
-        {
-            NdisMoveMemory(pSHA_CTX->Block + pSHA_CTX->BlockLen,
-                Message + appendLen, SHA256_BLOCK_SIZE - pSHA_CTX->BlockLen);
-            appendLen += (SHA256_BLOCK_SIZE - pSHA_CTX->BlockLen);
-            pSHA_CTX->BlockLen = SHA256_BLOCK_SIZE;
-            SHA256_Hash(pSHA_CTX);
-        } /* End of if */
-    } /* End of while */
-    pSHA_CTX->MessageLen += MessageLen;
-} /* End of SHA256_Append */
-
-
-/*
-========================================================================
-Routine Description:
-    1. Append bit 1 to end of the message
-    2. Append the length of message in rightmost 64 bits
-    3. Transform the Hash Value to digest message
-
-Arguments:
-    pSHA_CTX        Pointer to SHA256_CTX_STRUC
-
-Return Value:
-    digestMessage   Digest message
-
-Note:
-    None
-========================================================================
-*/
-VOID SHA256_End (
-    IN  SHA256_CTX_STRUC *pSHA_CTX,
-    OUT UINT8 DigestMessage[])
-{
-    UINT index;
-    UINT64 message_length_bits;
-
-    /* Append bit 1 to end of the message */
-    NdisFillMemory(pSHA_CTX->Block + pSHA_CTX->BlockLen, 1, 0x80);
-
-    /* 55 = 64 - 8 - 1: append 1 bit(1 byte) and message length (8 bytes) */
-    if (pSHA_CTX->BlockLen > 55)
-        SHA256_Hash(pSHA_CTX);
-        /* End of if */
-
-    /* Append the length of message in rightmost 64 bits */
-    message_length_bits = pSHA_CTX->MessageLen*8;
-    message_length_bits = cpu2be64(message_length_bits);
-    NdisMoveMemory(&pSHA_CTX->Block[56], &message_length_bits, 8);
-    SHA256_Hash(pSHA_CTX);
-
-    /* Return message digest, transform the UINT32 hash value to bytes */
-    for (index = 0; index < 8;index++)
-        pSHA_CTX->HashValue[index] = cpu2be32(pSHA_CTX->HashValue[index]);
-        /* End of for */
-    NdisMoveMemory(DigestMessage, pSHA_CTX->HashValue, SHA256_DIGEST_SIZE);
-} /* End of SHA256_End */
-
-
-/*
-========================================================================
-Routine Description:
-    SHA256 algorithm
-
-Arguments:
-    message         Message context
-    messageLen      The length of message in bytes
-
-Return Value:
-    digestMessage   Digest message
-
-Note:
-    None
-========================================================================
-*/
-VOID RT_SHA256 (
-    IN  const UINT8 Message[],
-    IN  UINT MessageLen,
-    OUT UINT8 DigestMessage[])
-{
-    SHA256_CTX_STRUC sha_ctx;
-
-    NdisZeroMemory(&sha_ctx, sizeof(SHA256_CTX_STRUC));
-    SHA256_Init(&sha_ctx);
-    SHA256_Append(&sha_ctx, Message, MessageLen);
-    SHA256_End(&sha_ctx, DigestMessage);
-} /* End of RT_SHA256 */
-#endif /* SHA256_SUPPORT */
-
-/* End of crypt_sha2.c */
diff --git a/drivers/staging/rt3090/common/dfs.c b/drivers/staging/rt3090/common/dfs.c
deleted file mode 100644
index c15704ae2f24..000000000000
--- a/drivers/staging/rt3090/common/dfs.c
+++ /dev/null
@@ -1,481 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-    Module Name:
-    ap_dfs.c
-
-    Abstract:
-    Support DFS function.
-
-    Revision History:
-    Who       When            What
-    --------  ----------      ----------------------------------------------
-*/
-
-#include "../rt_config.h"
-
-
-typedef struct _RADAR_DURATION_TABLE
-{
-	ULONG RDDurRegion;
-	ULONG RadarSignalDuration;
-	ULONG Tolerance;
-} RADAR_DURATION_TABLE, *PRADAR_DURATION_TABLE;
-
-
-
-UCHAR RdIdleTimeTable[MAX_RD_REGION][4] =
-{
-	{9, 250, 250, 250},		// CE
-#ifdef DFS_FCC_BW40_FIX
-	{1, 250, 250, 250},		// FCC
-#else
-	{4, 250, 250, 250},		// FCC
-#endif
-	{4, 250, 250, 250},		// JAP
-	{15, 250, 250, 250},	// JAP_W53
-	{4, 250, 250, 250}		// JAP_W56
-};
-
-#ifdef TONE_RADAR_DETECT_SUPPORT
-static void ToneRadarProgram(PRTMP_ADAPTER pAd);
-static void ToneRadarEnable(PRTMP_ADAPTER pAd);
-#endif // TONE_RADAR_DETECT_SUPPORT //
-
-#ifdef DFS_SUPPORT
-/*
-	========================================================================
-
-	Routine Description:
-		Bbp Radar detection routine
-
-	Arguments:
-		pAd	Pointer to our adapter
-
-	Return Value:
-
-	========================================================================
-*/
-VOID BbpRadarDetectionStart(
-	IN PRTMP_ADAPTER pAd)
-{
-	UINT8 RadarPeriod;
-
-	RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, 114, 0x02);
-	RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, 121, 0x20);
-	RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, 122, 0x00);
-	RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, 123, 0x08/*0x80*/);
-	RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, 124, 0x28);
-	RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, 125, 0xff);
-
-#ifdef MERGE_ARCH_TEAM
-	if ((pAd->CommonCfg.RadarDetect.RDDurRegion == JAP) || (pAd->CommonCfg.RadarDetect.RDDurRegion == JAP_W53) || (pAd->CommonCfg.RadarDetect.RDDurRegion == JAP_W56))
-	{
-		pAd->CommonCfg.RadarDetect.RDDurRegion = JAP;
-		pAd->CommonCfg.RadarDetect.RDDurRegion = JapRadarType(pAd);
-		if (pAd->CommonCfg.RadarDetect.RDDurRegion == JAP_W56)
-		{
-			pAd->CommonCfg.RadarDetect.DfsSessionTime = 13;
-		}
-		else if (pAd->CommonCfg.RadarDetect.RDDurRegion == JAP_W53)
-		{
-			pAd->CommonCfg.RadarDetect.DfsSessionTime = 15;
-		}
-#ifdef CARRIER_DETECTION_SUPPORT
-		pAd->CommonCfg.CarrierDetect.Enable = 1;
-#endif // CARRIER_DETECTION_SUPPORT //
-	}
-#endif // MERGE_ARCH_TEAM //
-
-	RadarPeriod = ((UINT)RdIdleTimeTable[pAd->CommonCfg.RadarDetect.RDDurRegion][0] + (UINT)pAd->CommonCfg.RadarDetect.DfsSessionTime) < 250 ?
-			(RdIdleTimeTable[pAd->CommonCfg.RadarDetect.RDDurRegion][0] + pAd->CommonCfg.RadarDetect.DfsSessionTime) : 250;
-
-#ifdef MERGE_ARCH_TEAM
-
-
-#else // Original RT28xx source code.
-	RTMP_IO_WRITE8(pAd, 0x7020, 0x1d);
-	RTMP_IO_WRITE8(pAd, 0x7021, 0x40);
-#endif // MERGE_ARCH_TEAM //
-
-	RadarDetectionStart(pAd, 0, RadarPeriod);
-	return;
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-		Bbp Radar detection routine
-
-	Arguments:
-		pAd	Pointer to our adapter
-
-	Return Value:
-
-	========================================================================
-*/
-VOID BbpRadarDetectionStop(
-	IN PRTMP_ADAPTER pAd)
-{
-	RTMP_IO_WRITE8(pAd, 0x7020, 0x1d);
-	RTMP_IO_WRITE8(pAd, 0x7021, 0x60);
-
-	RadarDetectionStop(pAd);
-	return;
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-		Radar detection routine
-
-	Arguments:
-		pAd	Pointer to our adapter
-
-	Return Value:
-
-	========================================================================
-*/
-VOID RadarDetectionStart(
-	IN PRTMP_ADAPTER pAd,
-	IN BOOLEAN CTSProtect,
-	IN UINT8 CTSPeriod)
-{
-	UINT8 DfsActiveTime = (pAd->CommonCfg.RadarDetect.DfsSessionTime & 0x1f);
-	UINT8 CtsProtect = (CTSProtect == 1) ? 0x02 : 0x01; // CTS protect.
-
-	if (CTSProtect != 0)
-	{
-		switch(pAd->CommonCfg.RadarDetect.RDDurRegion)
-		{
-		case FCC:
-		case JAP_W56:
-			CtsProtect = 0x03;
-			break;
-
-		case JAP:
-			{
-				UCHAR RDDurRegion;
-				RDDurRegion = JapRadarType(pAd);
-				if (RDDurRegion == JAP_W56)
-					CtsProtect = 0x03;
-				else
-					CtsProtect = 0x02;
-				break;
-			}
-
-		case CE:
-		case JAP_W53:
-		default:
-			CtsProtect = 0x02;
-			break;
-		}
-	}
-	else
-		CtsProtect = 0x01;
-
-
-	// send start-RD with CTS protection command to MCU
-	// highbyte [7]		reserve
-	// highbyte [6:5]	0x: stop Carrier/Radar detection
-	// highbyte [10]:	Start Carrier/Radar detection without CTS protection, 11: Start Carrier/Radar detection with CTS protection
-	// highbyte [4:0]	Radar/carrier detection duration. In 1ms.
-
-	// lowbyte [7:0]	Radar/carrier detection period, in 1ms.
-	AsicSendCommandToMcu(pAd, 0x60, 0xff, CTSPeriod, DfsActiveTime | (CtsProtect << 5));
-	//AsicSendCommandToMcu(pAd, 0x63, 0xff, 10, 0);
-
-	return;
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-		Radar detection routine
-
-	Arguments:
-		pAd	Pointer to our adapter
-
-	Return Value:
-		TRUE	Found radar signal
-		FALSE	Not found radar signal
-
-	========================================================================
-*/
-VOID RadarDetectionStop(
-	IN PRTMP_ADAPTER	pAd)
-{
-	DBGPRINT(RT_DEBUG_TRACE,("RadarDetectionStop.\n"));
-	AsicSendCommandToMcu(pAd, 0x60, 0xff, 0x00, 0x00);	// send start-RD with CTS protection command to MCU
-
-	return;
-}
-#endif // DFS_SUPPORT //
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		Radar channel check routine
-
-	Arguments:
-		pAd	Pointer to our adapter
-
-	Return Value:
-		TRUE	need to do radar detect
-		FALSE	need not to do radar detect
-
-	========================================================================
-*/
-BOOLEAN RadarChannelCheck(
-	IN PRTMP_ADAPTER	pAd,
-	IN UCHAR			Ch)
-{
-	INT		i;
-	BOOLEAN result = FALSE;
-
-	for (i=0; i<pAd->ChannelListNum; i++)
-	{
-		if (Ch == pAd->ChannelList[i].Channel)
-		{
-			result = pAd->ChannelList[i].DfsReq;
-			break;
-		}
-	}
-
-	return result;
-}
-
-#ifdef DFS_SUPPORT
-
-ULONG JapRadarType(
-	IN PRTMP_ADAPTER pAd)
-{
-	ULONG		i;
-	const UCHAR	Channel[15]={52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140};
-
-	if (pAd->CommonCfg.RadarDetect.RDDurRegion != JAP)
-	{
-		return pAd->CommonCfg.RadarDetect.RDDurRegion;
-	}
-
-	for (i=0; i<15; i++)
-	{
-		if (pAd->CommonCfg.Channel == Channel[i])
-		{
-			break;
-		}
-	}
-
-	if (i < 4)
-		return JAP_W53;
-	else if (i < 15)
-		return JAP_W56;
-	else
-		return JAP; // W52
-
-}
-
-ULONG RTMPBbpReadRadarDuration(
-	IN PRTMP_ADAPTER	pAd)
-{
-	UINT8 byteValue = 0;
-	ULONG result;
-
-	BBP_IO_READ8_BY_REG_ID(pAd, BBP_R115, &byteValue);
-
-	result = 0;
-	switch (byteValue)
-	{
-	case 1: // radar signal detected by pulse mode.
-	case 2: // radar signal detected by width mode.
-		result = RTMPReadRadarDuration(pAd);
-		break;
-
-	case 0: // No radar signal.
-	default:
-
-		result = 0;
-		break;
-	}
-
-	return result;
-}
-
-ULONG RTMPReadRadarDuration(
-	IN PRTMP_ADAPTER	pAd)
-{
-	ULONG result = 0;
-
-#ifdef DFS_SUPPORT
-	UINT8 duration1 = 0, duration2 = 0, duration3 = 0;
-
-
-	BBP_IO_READ8_BY_REG_ID(pAd, BBP_R116, &duration1);
-	BBP_IO_READ8_BY_REG_ID(pAd, BBP_R117, &duration2);
-	BBP_IO_READ8_BY_REG_ID(pAd, BBP_R118, &duration3);
-	result = (duration1 << 16) + (duration2 << 8) + duration3;
-#endif // DFS_SUPPORT //
-
-	return result;
-
-}
-
-VOID RTMPCleanRadarDuration(
-	IN PRTMP_ADAPTER	pAd)
-{
-	return;
-}
-
-/*
-    ========================================================================
-    Routine Description:
-        Radar wave detection. The API should be invoke each second.
-
-    Arguments:
-        pAd         - Adapter pointer
-
-    Return Value:
-        None
-
-    ========================================================================
-*/
-VOID ApRadarDetectPeriodic(
-	IN PRTMP_ADAPTER pAd)
-{
-	INT	i;
-
-	pAd->CommonCfg.RadarDetect.InServiceMonitorCount++;
-
-	for (i=0; i<pAd->ChannelListNum; i++)
-	{
-
-		if (pAd->ChannelList[i].RemainingTimeForUse > 0)
-		{
-			pAd->ChannelList[i].RemainingTimeForUse --;
-			if ((pAd->Mlme.PeriodicRound%5) == 0)
-			{
-				DBGPRINT(RT_DEBUG_TRACE, ("RadarDetectPeriodic - ch=%d, RemainingTimeForUse=%d\n", pAd->ChannelList[i].Channel, pAd->ChannelList[i].RemainingTimeForUse));
-			}
-		}
-	}
-
-	//radar detect
-	if ((pAd->CommonCfg.Channel > 14)
-		&& (pAd->CommonCfg.bIEEE80211H == 1)
-		&& RadarChannelCheck(pAd, pAd->CommonCfg.Channel))
-	{
-		RadarDetectPeriodic(pAd);
-	}
-
-	return;
-}
-
-// Periodic Radar detection, switch channel will occur in RTMPHandleTBTTInterrupt()
-// Before switch channel, driver needs doing channel switch announcement.
-VOID RadarDetectPeriodic(
-	IN PRTMP_ADAPTER	pAd)
-{
-
-	// need to check channel availability, after switch channel
-	if (pAd->CommonCfg.RadarDetect.RDMode != RD_SILENCE_MODE)
-			return;
-
-
-
-	// channel availability check time is 60sec, use 65 for assurance
-	if (pAd->CommonCfg.RadarDetect.RDCount++ > pAd->CommonCfg.RadarDetect.ChMovingTime)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("Not found radar signal, start send beacon and radar detection in service monitor\n\n"));
-		BbpRadarDetectionStop(pAd);
-
-
-		AsicEnableBssSync(pAd);
-		pAd->CommonCfg.RadarDetect.RDMode = RD_NORMAL_MODE;
-
-
-
-		return;
-	}
-
-	return;
-}
-#endif // DFS_SUPPORT //
-
-#ifdef DFS_SUPPORT
-/*
-    ==========================================================================
-    Description:
-		change channel moving time for DFS testing.
-
-	Arguments:
-	    pAdapter                    Pointer to our adapter
-	    wrq                         Pointer to the ioctl argument
-
-    Return Value:
-        None
-
-    Note:
-        Usage:
-               1.) iwpriv ra0 set ChMovTime=[value]
-    ==========================================================================
-*/
-INT Set_ChMovingTime_Proc(
-	IN PRTMP_ADAPTER pAd,
-	IN PSTRING arg)
-{
-	UINT8 Value;
-
-	Value = (UINT8) simple_strtol(arg, 0, 10);
-
-	pAd->CommonCfg.RadarDetect.ChMovingTime = Value;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("%s:: %d\n", __FUNCTION__,
-		pAd->CommonCfg.RadarDetect.ChMovingTime));
-
-	return TRUE;
-}
-
-INT Set_LongPulseRadarTh_Proc(
-	IN PRTMP_ADAPTER pAd,
-	IN PSTRING arg)
-{
-	UINT8 Value;
-
-	Value = (UINT8) simple_strtol(arg, 0, 10) > 10 ? 10 : simple_strtol(arg, 0, 10);
-
-	pAd->CommonCfg.RadarDetect.LongPulseRadarTh = Value;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("%s:: %d\n", __FUNCTION__,
-		pAd->CommonCfg.RadarDetect.LongPulseRadarTh));
-
-	return TRUE;
-}
-#endif // DFS_SUPPORT //
diff --git a/drivers/staging/rt3090/common/ee_efuse.c b/drivers/staging/rt3090/common/ee_efuse.c
deleted file mode 100644
index c51e3059bf4c..000000000000
--- a/drivers/staging/rt3090/common/ee_efuse.c
+++ /dev/null
@@ -1,1548 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-	Module Name:
-	ee_efuse.c
-
-	Abstract:
-	Miniport generic portion header file
-
-	Revision History:
-	Who         When          What
-	--------    ----------    ----------------------------------------------
-*/
-
-#include "../rt_config.h"
-
-
-#define EFUSE_USAGE_MAP_START	0x2d0
-#define EFUSE_USAGE_MAP_END		0x2fc
-#define EFUSE_USAGE_MAP_SIZE	45
-
-
-
-#define EFUSE_EEPROM_DEFULT_FILE	"RT30xxEEPROM.bin"
-#define MAX_EEPROM_BIN_FILE_SIZE	1024
-
-
-
-#define EFUSE_TAG				0x2fe
-
-
-#ifdef RT_BIG_ENDIAN
-typedef	union	_EFUSE_CTRL_STRUC {
-	struct	{
-		UINT32            SEL_EFUSE:1;
-		UINT32            EFSROM_KICK:1;
-		UINT32            RESERVED:4;
-		UINT32            EFSROM_AIN:10;
-		UINT32            EFSROM_LDO_ON_TIME:2;
-		UINT32            EFSROM_LDO_OFF_TIME:6;
-		UINT32            EFSROM_MODE:2;
-		UINT32            EFSROM_AOUT:6;
-	}	field;
-	UINT32			word;
-}	EFUSE_CTRL_STRUC, *PEFUSE_CTRL_STRUC;
-#else
-typedef	union	_EFUSE_CTRL_STRUC {
-	struct	{
-		UINT32            EFSROM_AOUT:6;
-		UINT32            EFSROM_MODE:2;
-		UINT32            EFSROM_LDO_OFF_TIME:6;
-		UINT32            EFSROM_LDO_ON_TIME:2;
-		UINT32            EFSROM_AIN:10;
-		UINT32            RESERVED:4;
-		UINT32            EFSROM_KICK:1;
-		UINT32            SEL_EFUSE:1;
-	}	field;
-	UINT32			word;
-}	EFUSE_CTRL_STRUC, *PEFUSE_CTRL_STRUC;
-#endif // RT_BIG_ENDIAN //
-
-static UCHAR eFuseReadRegisters(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	USHORT Offset,
-	IN	USHORT Length,
-	OUT	USHORT* pData);
-
-static VOID eFuseReadPhysical(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUSHORT lpInBuffer,
-	IN	ULONG nInBufferSize,
-	OUT	PUSHORT lpOutBuffer,
-	IN	ULONG nOutBufferSize);
-
-static VOID eFusePhysicalWriteRegisters(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	USHORT Offset,
-	IN	USHORT Length,
-	OUT	USHORT* pData);
-
-static NTSTATUS eFuseWriteRegisters(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	USHORT Offset,
-	IN	USHORT Length,
-	IN	USHORT* pData);
-
-static VOID eFuseWritePhysical(
-	IN	PRTMP_ADAPTER	pAd,
-	PUSHORT lpInBuffer,
-	ULONG nInBufferSize,
-	PUCHAR lpOutBuffer,
-	ULONG nOutBufferSize);
-
-
-static NTSTATUS eFuseWriteRegistersFromBin(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	USHORT Offset,
-	IN	USHORT Length,
-	IN	USHORT* pData);
-
-
-/*
-========================================================================
-
-	Routine Description:
-
-	Arguments:
-
-	Return Value:
-
-	Note:
-
-========================================================================
-*/
-UCHAR eFuseReadRegisters(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	USHORT Offset,
-	IN	USHORT Length,
-	OUT	USHORT* pData)
-{
-	EFUSE_CTRL_STRUC		eFuseCtrlStruc;
-	int	i;
-	USHORT	efuseDataOffset;
-	UINT32	data;
-
-	RTMP_IO_READ32(pAd, EFUSE_CTRL, &eFuseCtrlStruc.word);
-
-	//Step0. Write 10-bit of address to EFSROM_AIN (0x580, bit25:bit16). The address must be 16-byte alignment.
-	//Use the eeprom logical address and covert to address to block number
-	eFuseCtrlStruc.field.EFSROM_AIN = Offset & 0xfff0;
-
-	//Step1. Write EFSROM_MODE (0x580, bit7:bit6) to 0.
-	eFuseCtrlStruc.field.EFSROM_MODE = 0;
-
-	//Step2. Write EFSROM_KICK (0x580, bit30) to 1 to kick-off physical read procedure.
-	eFuseCtrlStruc.field.EFSROM_KICK = 1;
-
-	NdisMoveMemory(&data, &eFuseCtrlStruc, 4);
-	RTMP_IO_WRITE32(pAd, EFUSE_CTRL, data);
-
-	//Step3. Polling EFSROM_KICK(0x580, bit30) until it become 0 again.
-	i = 0;
-	while(i < 500)
-	{
-		//rtmp.HwMemoryReadDword(EFUSE_CTRL, (DWORD *) &eFuseCtrlStruc, 4);
-		RTMP_IO_READ32(pAd, EFUSE_CTRL, &eFuseCtrlStruc.word);
-		if(eFuseCtrlStruc.field.EFSROM_KICK == 0)
-		{
-			break;
-		}
-		RTMPusecDelay(2);
-		i++;
-	}
-
-	//if EFSROM_AOUT is not found in physical address, write 0xffff
-	if (eFuseCtrlStruc.field.EFSROM_AOUT == 0x3f)
-	{
-		for(i=0; i<Length/2; i++)
-			*(pData+2*i) = 0xffff;
-	}
-	else
-	{
-		//Step4. Read 16-byte of data from EFUSE_DATA0-3 (0x590-0x59C)
-		efuseDataOffset =  EFUSE_DATA3 - (Offset & 0xC);
-		//data hold 4 bytes data.
-		//In RTMP_IO_READ32 will automatically execute 32-bytes swapping
-		RTMP_IO_READ32(pAd, efuseDataOffset, &data);
-		//Decide the upper 2 bytes or the bottom 2 bytes.
-		// Little-endian		S	|	S	Big-endian
-		// addr	3	2	1	0	|	0	1	2	3
-		// Ori-V	D	C	B	A	|	A	B	C	D
-		//After swapping
-		//		D	C	B	A	|	D	C	B	A
-		//Return 2-bytes
-		//The return byte statrs from S. Therefore, the little-endian will return BA, the Big-endian will return DC.
-		//For returning the bottom 2 bytes, the Big-endian should shift right 2-bytes.
-#ifdef RT_BIG_ENDIAN
-		data = data << (8*((Offset & 0x3)^0x2));
-#else
-		data = data >> (8*(Offset & 0x3));
-#endif // RT_BIG_ENDIAN //
-
-		NdisMoveMemory(pData, &data, Length);
-	}
-
-	return (UCHAR) eFuseCtrlStruc.field.EFSROM_AOUT;
-
-}
-
-/*
-========================================================================
-
-	Routine Description:
-
-	Arguments:
-
-	Return Value:
-
-	Note:
-
-========================================================================
-*/
-VOID eFusePhysicalReadRegisters(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	USHORT Offset,
-	IN	USHORT Length,
-	OUT	USHORT* pData)
-{
-	EFUSE_CTRL_STRUC		eFuseCtrlStruc;
-	int	i;
-	USHORT	efuseDataOffset;
-	UINT32	data;
-
-	RTMP_IO_READ32(pAd, EFUSE_CTRL, &eFuseCtrlStruc.word);
-
-	//Step0. Write 10-bit of address to EFSROM_AIN (0x580, bit25:bit16). The address must be 16-byte alignment.
-	eFuseCtrlStruc.field.EFSROM_AIN = Offset & 0xfff0;
-
-	//Step1. Write EFSROM_MODE (0x580, bit7:bit6) to 1.
-	//Read in physical view
-	eFuseCtrlStruc.field.EFSROM_MODE = 1;
-
-	//Step2. Write EFSROM_KICK (0x580, bit30) to 1 to kick-off physical read procedure.
-	eFuseCtrlStruc.field.EFSROM_KICK = 1;
-
-	NdisMoveMemory(&data, &eFuseCtrlStruc, 4);
-	RTMP_IO_WRITE32(pAd, EFUSE_CTRL, data);
-
-	//Step3. Polling EFSROM_KICK(0x580, bit30) until it become 0 again.
-	i = 0;
-	while(i < 500)
-	{
-		RTMP_IO_READ32(pAd, EFUSE_CTRL, &eFuseCtrlStruc.word);
-		if(eFuseCtrlStruc.field.EFSROM_KICK == 0)
-			break;
-		RTMPusecDelay(2);
-		i++;
-	}
-
-	//Step4. Read 16-byte of data from EFUSE_DATA0-3 (0x59C-0x590)
-	//Because the size of each EFUSE_DATA is 4 Bytes, the size of address of each is 2 bits.
-	//The previous 2 bits is the EFUSE_DATA number, the last 2 bits is used to decide which bytes
-	//Decide which EFUSE_DATA to read
-	//590:F E D C
-	//594:B A 9 8
-	//598:7 6 5 4
-	//59C:3 2 1 0
-	efuseDataOffset =  EFUSE_DATA3 - (Offset & 0xC)  ;
-
-	RTMP_IO_READ32(pAd, efuseDataOffset, &data);
-
-#ifdef RT_BIG_ENDIAN
-		data = data << (8*((Offset & 0x3)^0x2));
-#else
-	data = data >> (8*(Offset & 0x3));
-#endif // RT_BIG_ENDIAN //
-
-	NdisMoveMemory(pData, &data, Length);
-
-}
-
-/*
-========================================================================
-
-	Routine Description:
-
-	Arguments:
-
-	Return Value:
-
-	Note:
-
-========================================================================
-*/
-static VOID eFuseReadPhysical(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUSHORT lpInBuffer,
-	IN	ULONG nInBufferSize,
-	OUT	PUSHORT lpOutBuffer,
-	IN	ULONG nOutBufferSize
-)
-{
-	USHORT* pInBuf = (USHORT*)lpInBuffer;
-	USHORT* pOutBuf = (USHORT*)lpOutBuffer;
-
-	USHORT Offset = pInBuf[0];					//addr
-	USHORT Length = pInBuf[1];					//length
-	int		i;
-
-	for(i=0; i<Length; i+=2)
-	{
-		eFusePhysicalReadRegisters(pAd,Offset+i, 2, &pOutBuf[i/2]);
-	}
-}
-
-/*
-========================================================================
-
-	Routine Description:
-
-	Arguments:
-
-	Return Value:
-
-	Note:
-
-========================================================================
-*/
-NTSTATUS eFuseRead(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	USHORT			Offset,
-	OUT	PUCHAR			pData,
-	IN	USHORT			Length)
-{
-	USHORT* pOutBuf = (USHORT*)pData;
-	NTSTATUS Status = STATUS_SUCCESS;
-	UCHAR	EFSROM_AOUT;
-	int	i;
-
-	for(i=0; i<Length; i+=2)
-	{
-		EFSROM_AOUT = eFuseReadRegisters(pAd, Offset+i, 2, &pOutBuf[i/2]);
-	}
-	return Status;
-}
-
-/*
-========================================================================
-
-	Routine Description:
-
-	Arguments:
-
-	Return Value:
-
-	Note:
-
-========================================================================
-*/
-static VOID eFusePhysicalWriteRegisters(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	USHORT Offset,
-	IN	USHORT Length,
-	OUT	USHORT* pData)
-{
-	EFUSE_CTRL_STRUC		eFuseCtrlStruc;
-	int	i;
-	USHORT	efuseDataOffset;
-	UINT32	data, eFuseDataBuffer[4];
-
-	//Step0. Write 16-byte of data to EFUSE_DATA0-3 (0x590-0x59C), where EFUSE_DATA0 is the LSB DW, EFUSE_DATA3 is the MSB DW.
-
-	/////////////////////////////////////////////////////////////////
-	//read current values of 16-byte block
-	RTMP_IO_READ32(pAd, EFUSE_CTRL,  &eFuseCtrlStruc.word);
-
-	//Step0. Write 10-bit of address to EFSROM_AIN (0x580, bit25:bit16). The address must be 16-byte alignment.
-	eFuseCtrlStruc.field.EFSROM_AIN = Offset & 0xfff0;
-
-	//Step1. Write EFSROM_MODE (0x580, bit7:bit6) to 1.
-	eFuseCtrlStruc.field.EFSROM_MODE = 1;
-
-	//Step2. Write EFSROM_KICK (0x580, bit30) to 1 to kick-off physical read procedure.
-	eFuseCtrlStruc.field.EFSROM_KICK = 1;
-
-	NdisMoveMemory(&data, &eFuseCtrlStruc, 4);
-	RTMP_IO_WRITE32(pAd, EFUSE_CTRL, data);
-
-	//Step3. Polling EFSROM_KICK(0x580, bit30) until it become 0 again.
-	i = 0;
-	while(i < 500)
-	{
-		RTMP_IO_READ32(pAd, EFUSE_CTRL, &eFuseCtrlStruc.word);
-
-		if(eFuseCtrlStruc.field.EFSROM_KICK == 0)
-			break;
-		RTMPusecDelay(2);
-		i++;
-	}
-
-	//Step4. Read 16-byte of data from EFUSE_DATA0-3 (0x59C-0x590)
-	efuseDataOffset =  EFUSE_DATA3;
-	for(i=0; i< 4; i++)
-	{
-		RTMP_IO_READ32(pAd, efuseDataOffset, (PUINT32) &eFuseDataBuffer[i]);
-		efuseDataOffset -=  4;
-	}
-
-	//Update the value, the offset is multiple of 2, length is 2
-	efuseDataOffset = (Offset & 0xc) >> 2;
-	data = pData[0] & 0xffff;
-	//The offset should be 0x***10 or 0x***00
-	if((Offset % 4) != 0)
-	{
-		eFuseDataBuffer[efuseDataOffset] = (eFuseDataBuffer[efuseDataOffset] & 0xffff) | (data << 16);
-	}
-	else
-	{
-		eFuseDataBuffer[efuseDataOffset] = (eFuseDataBuffer[efuseDataOffset] & 0xffff0000) | data;
-	}
-
-	efuseDataOffset =  EFUSE_DATA3;
-	for(i=0; i< 4; i++)
-	{
-		RTMP_IO_WRITE32(pAd, efuseDataOffset, eFuseDataBuffer[i]);
-		efuseDataOffset -= 4;
-	}
-	/////////////////////////////////////////////////////////////////
-
-	//Step1. Write 10-bit of address to EFSROM_AIN (0x580, bit25:bit16). The address must be 16-byte alignment.
-
-	RTMP_IO_READ32(pAd, EFUSE_CTRL, &eFuseCtrlStruc.word);
-
-	eFuseCtrlStruc.field.EFSROM_AIN = Offset & 0xfff0;
-
-	//Step2. Write EFSROM_MODE (0x580, bit7:bit6) to 3.
-	eFuseCtrlStruc.field.EFSROM_MODE = 3;
-
-	//Step3. Write EFSROM_KICK (0x580, bit30) to 1 to kick-off physical write procedure.
-	eFuseCtrlStruc.field.EFSROM_KICK = 1;
-
-	NdisMoveMemory(&data, &eFuseCtrlStruc, 4);
-	RTMP_IO_WRITE32(pAd, EFUSE_CTRL, data);
-
-	//Step4. Polling EFSROM_KICK(0x580, bit30) until it become 0 again. It��s done.
-	i = 0;
-
-	while(i < 500)
-	{
-		RTMP_IO_READ32(pAd, EFUSE_CTRL, &eFuseCtrlStruc.word);
-
-		if(eFuseCtrlStruc.field.EFSROM_KICK == 0)
-			break;
-
-		RTMPusecDelay(2);
-		i++;
-	}
-}
-
-/*
-========================================================================
-
-	Routine Description:
-
-	Arguments:
-
-	Return Value:
-
-	Note:
-
-========================================================================
-*/
-static NTSTATUS eFuseWriteRegisters(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	USHORT Offset,
-	IN	USHORT Length,
-	IN	USHORT* pData)
-{
-	USHORT	i,Loop=0;
-	USHORT	eFuseData;
-	USHORT	LogicalAddress, BlkNum = 0xffff;
-	UCHAR	EFSROM_AOUT;
-
-	USHORT addr,tmpaddr, InBuf[3], tmpOffset;
-	USHORT buffer[8];
-	BOOLEAN		bWriteSuccess = TRUE;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("eFuseWriteRegisters Offset=%x, pData=%x\n", Offset, *pData));
-
-	//Step 0. find the entry in the mapping table
-	//The address of EEPROM is 2-bytes alignment.
-	//The last bit is used for alignment, so it must be 0.
-	tmpOffset = Offset & 0xfffe;
-	EFSROM_AOUT = eFuseReadRegisters(pAd, tmpOffset, 2, &eFuseData);
-
-	if( EFSROM_AOUT == 0x3f)
-	{	//find available logical address pointer
-		//the logical address does not exist, find an empty one
-		//from the first address of block 45=16*45=0x2d0 to the last address of block 47
-		//==>48*16-3(reserved)=2FC
-		for (i=EFUSE_USAGE_MAP_START; i<=EFUSE_USAGE_MAP_END; i+=2)
-		{
-			//Retrive the logical block nubmer form each logical address pointer
-			//It will access two logical address pointer each time.
-			eFusePhysicalReadRegisters(pAd, i, 2, &LogicalAddress);
-			if( (LogicalAddress & 0xff) == 0)
-			{//Not used logical address pointer
-				BlkNum = i-EFUSE_USAGE_MAP_START;
-				break;
-			}
-			else if(( (LogicalAddress >> 8) & 0xff) == 0)
-			{//Not used logical address pointer
-				if (i != EFUSE_USAGE_MAP_END)
-				{
-					BlkNum = i-EFUSE_USAGE_MAP_START+1;
-				}
-				break;
-			}
-		}
-	}
-	else
-	{
-		BlkNum = EFSROM_AOUT;
-	}
-
-	DBGPRINT(RT_DEBUG_TRACE, ("eFuseWriteRegisters BlkNum = %d \n", BlkNum));
-
-	if(BlkNum == 0xffff)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("eFuseWriteRegisters: out of free E-fuse space!!!\n"));
-		return FALSE;
-	}
-
-	//Step 1. Save data of this block	which is pointed by the avaible logical address pointer
-	// read and save the original block data
-	for(i =0; i<8; i++)
-	{
-		addr = BlkNum * 0x10 ;
-
-		InBuf[0] = addr+2*i;
-		InBuf[1] = 2;
-		InBuf[2] = 0x0;
-
-		eFuseReadPhysical(pAd, &InBuf[0], 4, &InBuf[2], 2);
-
-		buffer[i] = InBuf[2];
-	}
-
-	//Step 2. Update the data in buffer, and write the data to Efuse
-	buffer[ (Offset >> 1) % 8] = pData[0];
-
-	do
-	{	Loop++;
-		//Step 3. Write the data to Efuse
-		if(!bWriteSuccess)
-		{
-			for(i =0; i<8; i++)
-			{
-				addr = BlkNum * 0x10 ;
-
-				InBuf[0] = addr+2*i;
-				InBuf[1] = 2;
-				InBuf[2] = buffer[i];
-
-				eFuseWritePhysical(pAd, &InBuf[0], 6, NULL, 2);
-			}
-		}
-		else
-		{
-				addr = BlkNum * 0x10 ;
-
-				InBuf[0] = addr+(Offset % 16);
-				InBuf[1] = 2;
-				InBuf[2] = pData[0];
-
-				eFuseWritePhysical(pAd, &InBuf[0], 6, NULL, 2);
-		}
-
-		//Step 4. Write mapping table
-		addr = EFUSE_USAGE_MAP_START+BlkNum;
-
-		tmpaddr = addr;
-
-		if(addr % 2 != 0)
-			addr = addr -1;
-		InBuf[0] = addr;
-		InBuf[1] = 2;
-
-		//convert the address from 10 to 8 bit ( bit7, 6 = parity and bit5 ~ 0 = bit9~4), and write to logical map entry
-		tmpOffset = Offset;
-		tmpOffset >>= 4;
-		tmpOffset |= ((~((tmpOffset & 0x01) ^ ( tmpOffset >> 1 & 0x01) ^  (tmpOffset >> 2 & 0x01) ^  (tmpOffset >> 3 & 0x01))) << 6) & 0x40;
-		tmpOffset |= ((~( (tmpOffset >> 2 & 0x01) ^ (tmpOffset >> 3 & 0x01) ^ (tmpOffset >> 4 & 0x01) ^ ( tmpOffset >> 5 & 0x01))) << 7) & 0x80;
-
-		// write the logical address
-		if(tmpaddr%2 != 0)
-			InBuf[2] = tmpOffset<<8;
-		else
-			InBuf[2] = tmpOffset;
-
-		eFuseWritePhysical(pAd,&InBuf[0], 6, NULL, 0);
-
-		//Step 5. Compare data if not the same, invalidate the mapping entry, then re-write the data until E-fuse is exhausted
-		bWriteSuccess = TRUE;
-		for(i =0; i<8; i++)
-		{
-			addr = BlkNum * 0x10 ;
-
-			InBuf[0] = addr+2*i;
-			InBuf[1] = 2;
-			InBuf[2] = 0x0;
-
-			eFuseReadPhysical(pAd, &InBuf[0], 4, &InBuf[2], 2);
-
-			if(buffer[i] != InBuf[2])
-			{
-				bWriteSuccess = FALSE;
-				break;
-			}
-		}
-
-		//Step 6. invlidate mapping entry and find a free mapping entry if not succeed
-		if (!bWriteSuccess)
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("Not bWriteSuccess BlkNum = %d\n", BlkNum));
-
-			// the offset of current mapping entry
-			addr = EFUSE_USAGE_MAP_START+BlkNum;
-
-			//find a new mapping entry
-			BlkNum = 0xffff;
-			for (i=EFUSE_USAGE_MAP_START; i<=EFUSE_USAGE_MAP_END; i+=2)
-			{
-				eFusePhysicalReadRegisters(pAd, i, 2, &LogicalAddress);
-				if( (LogicalAddress & 0xff) == 0)
-				{
-					BlkNum = i-EFUSE_USAGE_MAP_START;
-					break;
-				}
-				else if(( (LogicalAddress >> 8) & 0xff) == 0)
-				{
-					if (i != EFUSE_USAGE_MAP_END)
-					{
-						BlkNum = i+1-EFUSE_USAGE_MAP_START;
-					}
-					break;
-				}
-			}
-			DBGPRINT(RT_DEBUG_TRACE, ("Not bWriteSuccess new BlkNum = %d\n", BlkNum));
-			if(BlkNum == 0xffff)
-			{
-				DBGPRINT(RT_DEBUG_TRACE, ("eFuseWriteRegisters: out of free E-fuse space!!!\n"));
-				return FALSE;
-			}
-
-			//invalidate the original mapping entry if new entry is not found
-			tmpaddr = addr;
-
-			if(addr % 2 != 0)
-				addr = addr -1;
-			InBuf[0] = addr;
-			InBuf[1] = 2;
-
-			eFuseReadPhysical(pAd, &InBuf[0], 4, &InBuf[2], 2);
-
-			// write the logical address
-			if(tmpaddr%2 != 0)
-			{
-				// Invalidate the high byte
-				for (i=8; i<15; i++)
-				{
-					if( ( (InBuf[2] >> i) & 0x01) == 0)
-					{
-						InBuf[2] |= (0x1 <<i);
-						break;
-					}
-				}
-			}
-			else
-			{
-				// invalidate the low byte
-				for (i=0; i<8; i++)
-				{
-					if( ( (InBuf[2] >> i) & 0x01) == 0)
-					{
-						InBuf[2] |= (0x1 <<i);
-						break;
-					}
-				}
-			}
-			eFuseWritePhysical(pAd, &InBuf[0], 6, NULL, 0);
-		}
-	}
-	while (!bWriteSuccess&&Loop<2);
-	if(!bWriteSuccess)
-		DBGPRINT(RT_DEBUG_ERROR,("Efsue Write Failed!!\n"));
-	return TRUE;
-}
-
-
-/*
-========================================================================
-
-	Routine Description:
-
-	Arguments:
-
-	Return Value:
-
-	Note:
-
-========================================================================
-*/
-static VOID eFuseWritePhysical(
-	IN	PRTMP_ADAPTER	pAd,
-	PUSHORT lpInBuffer,
-	ULONG nInBufferSize,
-	PUCHAR lpOutBuffer,
-	ULONG nOutBufferSize
-)
-{
-	USHORT* pInBuf = (USHORT*)lpInBuffer;
-	int		i;
-	//USHORT* pOutBuf = (USHORT*)ioBuffer;
-	USHORT Offset = pInBuf[0];					// addr
-	USHORT Length = pInBuf[1];					// length
-	USHORT* pValueX = &pInBuf[2];				// value ...
-
-	DBGPRINT(RT_DEBUG_TRACE, ("eFuseWritePhysical Offset=0x%x, length=%d\n", Offset, Length));
-
-	{
-		// Little-endian		S	|	S	Big-endian
-		// addr	3	2	1	0	|	0	1	2	3
-		// Ori-V	D	C	B	A	|	A	B	C	D
-		// After swapping
-		//		D	C	B	A	|	D	C	B	A
-		// Both the little and big-endian use the same sequence to write  data.
-		// Therefore, we only need swap data when read the data.
-		for (i=0; i<Length; i+=2)
-		{
-			eFusePhysicalWriteRegisters(pAd, Offset+i, 2, &pValueX[i/2]);
-		}
-	}
-}
-
-
-/*
-========================================================================
-
-	Routine Description:
-
-	Arguments:
-
-	Return Value:
-
-	Note:
-
-========================================================================
-*/
-NTSTATUS eFuseWrite(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	USHORT			Offset,
-	IN	PUCHAR			pData,
-	IN	USHORT			length)
-{
-	int i;
-	USHORT* pValueX = (PUSHORT) pData;				//value ...
-
-	// The input value=3070 will be stored as following
-	// Little-endian		S	|	S	Big-endian
-	// addr			1	0	|	0	1
-	// Ori-V			30	70	|	30	70
-	// After swapping
-	//				30	70	|	70	30
-	// Casting
-	//				3070	|	7030 (x)
-	// The swapping should be removed for big-endian
-	for(i=0; i<length; i+=2)
-	{
-		eFuseWriteRegisters(pAd, Offset+i, 2, &pValueX[i/2]);
-	}
-
-	return TRUE;
-}
-
-
-
-
-/*
-========================================================================
-
-	Routine Description:
-
-	Arguments:
-
-	Return Value:
-
-	Note:
-
-========================================================================
-*/
-INT set_eFuseGetFreeBlockCount_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	USHORT i;
-	USHORT	LogicalAddress;
-	USHORT efusefreenum=0;
-	if(!pAd->bUseEfuse)
-		return FALSE;
-	for (i = EFUSE_USAGE_MAP_START; i <= EFUSE_USAGE_MAP_END; i+=2)
-	{
-		eFusePhysicalReadRegisters(pAd, i, 2, &LogicalAddress);
-		if( (LogicalAddress & 0xff) == 0)
-		{
-			efusefreenum= (UCHAR) (EFUSE_USAGE_MAP_END-i+1);
-			break;
-		}
-		else if(( (LogicalAddress >> 8) & 0xff) == 0)
-		{
-			efusefreenum = (UCHAR) (EFUSE_USAGE_MAP_END-i);
-			break;
-		}
-
-		if(i == EFUSE_USAGE_MAP_END)
-			efusefreenum = 0;
-	}
-	printk("efuseFreeNumber is %d\n",efusefreenum);
-	return TRUE;
-}
-
-
-INT set_eFusedump_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-USHORT InBuf[3];
-	INT i=0;
-	if(!pAd->bUseEfuse)
-		return FALSE;
-	for(i =0; i<EFUSE_USAGE_MAP_END/2; i++)
-	{
-		InBuf[0] = 2*i;
-		InBuf[1] = 2;
-		InBuf[2] = 0x0;
-
-		eFuseReadPhysical(pAd, &InBuf[0], 4, &InBuf[2], 2);
-		if(i%4==0)
-		printk("\nBlock %x:",i/8);
-		printk("%04x ",InBuf[2]);
-	}
-	return TRUE;
-}
-
-
-INT	set_eFuseLoadFromBin_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	PSTRING					src;
-	RTMP_OS_FD				srcf;
-	RTMP_OS_FS_INFO			osfsInfo;
-	INT						retval, memSize;
-	PSTRING					buffer, memPtr;
-	INT						i = 0,j=0,k=1;
-	USHORT					*PDATA;
-	USHORT					DATA;
-
-	memSize = 128 + MAX_EEPROM_BIN_FILE_SIZE + sizeof(USHORT) * 8;
-	memPtr = kmalloc(memSize, MEM_ALLOC_FLAG);
-	if (memPtr == NULL)
-		return FALSE;
-
-	NdisZeroMemory(memPtr, memSize);
-	src = memPtr; // kmalloc(128, MEM_ALLOC_FLAG);
-	buffer = src + 128;		// kmalloc(MAX_EEPROM_BIN_FILE_SIZE, MEM_ALLOC_FLAG);
-	PDATA = (USHORT*)(buffer + MAX_EEPROM_BIN_FILE_SIZE);	// kmalloc(sizeof(USHORT)*8,MEM_ALLOC_FLAG);
-
-	if(strlen(arg)>0)
-		NdisMoveMemory(src, arg, strlen(arg));
-	else
-		NdisMoveMemory(src, EFUSE_EEPROM_DEFULT_FILE, strlen(EFUSE_EEPROM_DEFULT_FILE));
-	DBGPRINT(RT_DEBUG_TRACE, ("FileName=%s\n",src));
-
-	RtmpOSFSInfoChange(&osfsInfo, TRUE);
-
-	srcf = RtmpOSFileOpen(src, O_RDONLY, 0);
-	if (IS_FILE_OPEN_ERR(srcf))
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("--> Error opening file %s\n", src));
-		retval = FALSE;
-		goto recoverFS;
-	}
-	else
-	{
-		// The object must have a read method
-		while(RtmpOSFileRead(srcf, &buffer[i], 1)==1)
-		{
-		i++;
-			if(i>MAX_EEPROM_BIN_FILE_SIZE)
-			{
-				DBGPRINT(RT_DEBUG_ERROR, ("--> Error reading file %s, file size too large[>%d]\n", src, MAX_EEPROM_BIN_FILE_SIZE));
-				retval = FALSE;
-				goto closeFile;
-			}
-		}
-
-		retval = RtmpOSFileClose(srcf);
-		if (retval)
-			DBGPRINT(RT_DEBUG_TRACE, ("--> Error closing file %s\n", src));
-	}
-
-
-	RtmpOSFSInfoChange(&osfsInfo, FALSE);
-
-	for(j=0;j<i;j++)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("%02X ",buffer[j]&0xff));
-		if((j+1)%2==0)
-			PDATA[j/2%8]=((buffer[j]<<8)&0xff00)|(buffer[j-1]&0xff);
-		if(j%16==0)
-		{
-			k=buffer[j];
-		}
-		else
-		{
-			k&=buffer[j];
-			if((j+1)%16==0)
-			{
-				DBGPRINT(RT_DEBUG_TRACE, (" result=%02X,blk=%02x\n",k,j/16));
-				if(k!=0xff)
-					eFuseWriteRegistersFromBin(pAd,(USHORT)j-15, 16, PDATA);
-				else
-				{
-					if(eFuseReadRegisters(pAd,j, 2,(PUSHORT)&DATA)!=0x3f)
-						eFuseWriteRegistersFromBin(pAd,(USHORT)j-15, 16, PDATA);
-				}
-				/*
-				for(l=0;l<8;l++)
-					printk("%04x ",PDATA[l]);
-				printk("\n");
-				*/
-				NdisZeroMemory(PDATA,16);
-			}
-		}
-	}
-
-	return TRUE;
-
-closeFile:
-	if (srcf)
-		RtmpOSFileClose(srcf);
-
-recoverFS:
-	RtmpOSFSInfoChange(&osfsInfo, FALSE);
-
-
-	if (memPtr)
-		kfree(memPtr);
-
-	return retval;
-}
-
-
-static NTSTATUS eFuseWriteRegistersFromBin(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	USHORT Offset,
-	IN	USHORT Length,
-	IN	USHORT* pData)
-{
-	USHORT	i;
-	USHORT	eFuseData;
-	USHORT	LogicalAddress, BlkNum = 0xffff;
-	UCHAR	EFSROM_AOUT,Loop=0;
-	EFUSE_CTRL_STRUC		eFuseCtrlStruc;
-	USHORT	efuseDataOffset;
-	UINT32	data,tempbuffer;
-	USHORT addr,tmpaddr, InBuf[3], tmpOffset;
-	UINT32 buffer[4];
-	BOOLEAN		bWriteSuccess = TRUE;
-	BOOLEAN		bNotWrite=TRUE;
-	BOOLEAN		bAllocateNewBlk=TRUE;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("eFuseWriteRegistersFromBin Offset=%x, pData=%04x:%04x:%04x:%04x\n", Offset, *pData,*(pData+1),*(pData+2),*(pData+3)));
-
-	do
-	{
-	//Step 0. find the entry in the mapping table
-	//The address of EEPROM is 2-bytes alignment.
-	//The last bit is used for alignment, so it must be 0.
-	Loop++;
-	tmpOffset = Offset & 0xfffe;
-	EFSROM_AOUT = eFuseReadRegisters(pAd, tmpOffset, 2, &eFuseData);
-
-	if( EFSROM_AOUT == 0x3f)
-	{	//find available logical address pointer
-		//the logical address does not exist, find an empty one
-		//from the first address of block 45=16*45=0x2d0 to the last address of block 47
-		//==>48*16-3(reserved)=2FC
-		bAllocateNewBlk=TRUE;
-		for (i=EFUSE_USAGE_MAP_START; i<=EFUSE_USAGE_MAP_END; i+=2)
-		{
-			//Retrive the logical block nubmer form each logical address pointer
-			//It will access two logical address pointer each time.
-			eFusePhysicalReadRegisters(pAd, i, 2, &LogicalAddress);
-			if( (LogicalAddress & 0xff) == 0)
-			{//Not used logical address pointer
-				BlkNum = i-EFUSE_USAGE_MAP_START;
-				break;
-			}
-			else if(( (LogicalAddress >> 8) & 0xff) == 0)
-			{//Not used logical address pointer
-				if (i != EFUSE_USAGE_MAP_END)
-				{
-					BlkNum = i-EFUSE_USAGE_MAP_START+1;
-				}
-				break;
-			}
-		}
-	}
-	else
-	{
-		bAllocateNewBlk=FALSE;
-		BlkNum = EFSROM_AOUT;
-	}
-
-	DBGPRINT(RT_DEBUG_TRACE, ("eFuseWriteRegisters BlkNum = %d \n", BlkNum));
-
-	if(BlkNum == 0xffff)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("eFuseWriteRegisters: out of free E-fuse space!!!\n"));
-		return FALSE;
-	}
-	//Step 1.1.0
-	//If the block is not existing in mapping table, create one
-	//and write down the 16-bytes data to the new block
-	if(bAllocateNewBlk)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("Allocate New Blk\n"));
-		efuseDataOffset =  EFUSE_DATA3;
-		for(i=0; i< 4; i++)
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("Allocate New Blk, Data%d=%04x%04x\n",3-i,pData[2*i+1],pData[2*i]));
-			tempbuffer=((pData[2*i+1]<<16)&0xffff0000)|pData[2*i];
-
-
-			RTMP_IO_WRITE32(pAd, efuseDataOffset,tempbuffer);
-			efuseDataOffset -= 4;
-
-		}
-		/////////////////////////////////////////////////////////////////
-
-		//Step1.1.1. Write 10-bit of address to EFSROM_AIN (0x580, bit25:bit16). The address must be 16-byte alignment.
-		RTMP_IO_READ32(pAd, EFUSE_CTRL, &eFuseCtrlStruc.word);
-		eFuseCtrlStruc.field.EFSROM_AIN = BlkNum* 0x10 ;
-
-		//Step1.1.2. Write EFSROM_MODE (0x580, bit7:bit6) to 3.
-		eFuseCtrlStruc.field.EFSROM_MODE = 3;
-
-		//Step1.1.3. Write EFSROM_KICK (0x580, bit30) to 1 to kick-off physical write procedure.
-		eFuseCtrlStruc.field.EFSROM_KICK = 1;
-
-		NdisMoveMemory(&data, &eFuseCtrlStruc, 4);
-
-		RTMP_IO_WRITE32(pAd, EFUSE_CTRL, data);
-
-		//Step1.1.4. Polling EFSROM_KICK(0x580, bit30) until it become 0 again. It��s done.
-		i = 0;
-		while(i < 100)
-		{
-			RTMP_IO_READ32(pAd, EFUSE_CTRL, (PUINT32) &eFuseCtrlStruc);
-
-			if(eFuseCtrlStruc.field.EFSROM_KICK == 0)
-				break;
-
-			RTMPusecDelay(2);
-			i++;
-		}
-
-	}
-	else
-	{	//Step1.2.
-		//If the same logical number is existing, check if the writting data and the data
-		//saving in this block are the same.
-		/////////////////////////////////////////////////////////////////
-		//read current values of 16-byte block
-		RTMP_IO_READ32(pAd, EFUSE_CTRL, &eFuseCtrlStruc.word);
-
-		//Step1.2.0. Write 10-bit of address to EFSROM_AIN (0x580, bit25:bit16). The address must be 16-byte alignment.
-		eFuseCtrlStruc.field.EFSROM_AIN = Offset & 0xfff0;
-
-		//Step1.2.1. Write EFSROM_MODE (0x580, bit7:bit6) to 1.
-		eFuseCtrlStruc.field.EFSROM_MODE = 0;
-
-		//Step1.2.2. Write EFSROM_KICK (0x580, bit30) to 1 to kick-off physical read procedure.
-		eFuseCtrlStruc.field.EFSROM_KICK = 1;
-
-		NdisMoveMemory(&data, &eFuseCtrlStruc, 4);
-		RTMP_IO_WRITE32(pAd, EFUSE_CTRL, data);
-
-		//Step1.2.3. Polling EFSROM_KICK(0x580, bit30) until it become 0 again.
-		i = 0;
-		while(i < 500)
-		{
-			RTMP_IO_READ32(pAd, EFUSE_CTRL, (PUINT32) &eFuseCtrlStruc);
-
-			if(eFuseCtrlStruc.field.EFSROM_KICK == 0)
-				break;
-			RTMPusecDelay(2);
-			i++;
-		}
-
-		//Step1.2.4. Read 16-byte of data from EFUSE_DATA0-3 (0x59C-0x590)
-		efuseDataOffset =  EFUSE_DATA3;
-		for(i=0; i< 4; i++)
-		{
-			RTMP_IO_READ32(pAd, efuseDataOffset, (PUINT32) &buffer[i]);
-			efuseDataOffset -=  4;
-		}
-		//Step1.2.5. Check if the data of efuse and the writing data are the same.
-		for(i =0; i<4; i++)
-		{
-			tempbuffer=((pData[2*i+1]<<16)&0xffff0000)|pData[2*i];
-			DBGPRINT(RT_DEBUG_TRACE, ("buffer[%d]=%x,pData[%d]=%x,pData[%d]=%x,tempbuffer=%x\n",i,buffer[i],2*i,pData[2*i],2*i+1,pData[2*i+1],tempbuffer));
-
-			if(((buffer[i]&0xffff0000)==(pData[2*i+1]<<16))&&((buffer[i]&0xffff)==pData[2*i]))
-				bNotWrite&=TRUE;
-			else
-			{
-				bNotWrite&=FALSE;
-				break;
-			}
-		}
-		if(!bNotWrite)
-		{
-		printk("The data is not the same\n");
-
-			for(i =0; i<8; i++)
-			{
-				addr = BlkNum * 0x10 ;
-
-				InBuf[0] = addr+2*i;
-				InBuf[1] = 2;
-				InBuf[2] = pData[i];
-
-				eFuseWritePhysical(pAd, &InBuf[0], 6, NULL, 2);
-			}
-
-		}
-		else
-			return TRUE;
-	     }
-
-
-
-		//Step 2. Write mapping table
-		addr = EFUSE_USAGE_MAP_START+BlkNum;
-
-		tmpaddr = addr;
-
-		if(addr % 2 != 0)
-			addr = addr -1;
-		InBuf[0] = addr;
-		InBuf[1] = 2;
-
-		//convert the address from 10 to 8 bit ( bit7, 6 = parity and bit5 ~ 0 = bit9~4), and write to logical map entry
-		tmpOffset = Offset;
-		tmpOffset >>= 4;
-		tmpOffset |= ((~((tmpOffset & 0x01) ^ ( tmpOffset >> 1 & 0x01) ^  (tmpOffset >> 2 & 0x01) ^  (tmpOffset >> 3 & 0x01))) << 6) & 0x40;
-		tmpOffset |= ((~( (tmpOffset >> 2 & 0x01) ^ (tmpOffset >> 3 & 0x01) ^ (tmpOffset >> 4 & 0x01) ^ ( tmpOffset >> 5 & 0x01))) << 7) & 0x80;
-
-		// write the logical address
-		if(tmpaddr%2 != 0)
-			InBuf[2] = tmpOffset<<8;
-		else
-			InBuf[2] = tmpOffset;
-
-		eFuseWritePhysical(pAd,&InBuf[0], 6, NULL, 0);
-
-		//Step 3. Compare data if not the same, invalidate the mapping entry, then re-write the data until E-fuse is exhausted
-		bWriteSuccess = TRUE;
-		for(i =0; i<8; i++)
-		{
-			addr = BlkNum * 0x10 ;
-
-			InBuf[0] = addr+2*i;
-			InBuf[1] = 2;
-			InBuf[2] = 0x0;
-
-			eFuseReadPhysical(pAd, &InBuf[0], 4, &InBuf[2], 2);
-			DBGPRINT(RT_DEBUG_TRACE, ("addr=%x, buffer[i]=%x,InBuf[2]=%x\n",InBuf[0],pData[i],InBuf[2]));
-			if(pData[i] != InBuf[2])
-			{
-				bWriteSuccess = FALSE;
-				break;
-			}
-		}
-
-		//Step 4. invlidate mapping entry and find a free mapping entry if not succeed
-
-		if (!bWriteSuccess&&Loop<2)
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("eFuseWriteRegistersFromBin::Not bWriteSuccess BlkNum = %d\n", BlkNum));
-
-			// the offset of current mapping entry
-			addr = EFUSE_USAGE_MAP_START+BlkNum;
-
-			//find a new mapping entry
-			BlkNum = 0xffff;
-			for (i=EFUSE_USAGE_MAP_START; i<=EFUSE_USAGE_MAP_END; i+=2)
-			{
-				eFusePhysicalReadRegisters(pAd, i, 2, &LogicalAddress);
-				if( (LogicalAddress & 0xff) == 0)
-				{
-					BlkNum = i-EFUSE_USAGE_MAP_START;
-					break;
-				}
-				else if(( (LogicalAddress >> 8) & 0xff) == 0)
-				{
-					if (i != EFUSE_USAGE_MAP_END)
-					{
-						BlkNum = i+1-EFUSE_USAGE_MAP_START;
-					}
-					break;
-				}
-			}
-			DBGPRINT(RT_DEBUG_TRACE, ("eFuseWriteRegistersFromBin::Not bWriteSuccess new BlkNum = %d\n", BlkNum));
-			if(BlkNum == 0xffff)
-			{
-				DBGPRINT(RT_DEBUG_TRACE, ("eFuseWriteRegistersFromBin: out of free E-fuse space!!!\n"));
-				return FALSE;
-			}
-
-			//invalidate the original mapping entry if new entry is not found
-			tmpaddr = addr;
-
-			if(addr % 2 != 0)
-				addr = addr -1;
-			InBuf[0] = addr;
-			InBuf[1] = 2;
-
-			eFuseReadPhysical(pAd, &InBuf[0], 4, &InBuf[2], 2);
-
-			// write the logical address
-			if(tmpaddr%2 != 0)
-			{
-				// Invalidate the high byte
-				for (i=8; i<15; i++)
-				{
-					if( ( (InBuf[2] >> i) & 0x01) == 0)
-					{
-						InBuf[2] |= (0x1 <<i);
-						break;
-					}
-				}
-			}
-			else
-			{
-				// invalidate the low byte
-				for (i=0; i<8; i++)
-				{
-					if( ( (InBuf[2] >> i) & 0x01) == 0)
-					{
-						InBuf[2] |= (0x1 <<i);
-						break;
-					}
-				}
-			}
-			eFuseWritePhysical(pAd, &InBuf[0], 6, NULL, 0);
-		}
-
-	}
-	while(!bWriteSuccess&&Loop<2);
-
-	return TRUE;
-}
-
-
-int rtmp_ee_efuse_read16(
-	IN RTMP_ADAPTER *pAd,
-	IN USHORT Offset,
-	OUT USHORT *pValue)
-{
-	if(pAd->bFroceEEPROMBuffer || pAd->bEEPROMFile)
-	{
-	    DBGPRINT(RT_DEBUG_TRACE,  ("Read from EEPROM Buffer\n"));
-	    NdisMoveMemory(pValue, &(pAd->EEPROMImage[Offset]), 2);
-	}
-	else
-	    eFuseReadRegisters(pAd, Offset, 2, pValue);
-	return (*pValue);
-}
-
-
-int rtmp_ee_efuse_write16(
-	IN RTMP_ADAPTER *pAd,
-	IN USHORT Offset,
-	IN USHORT data)
-{
-    if(pAd->bFroceEEPROMBuffer||pAd->bEEPROMFile)
-    {
-        DBGPRINT(RT_DEBUG_TRACE,  ("Write to EEPROM Buffer\n"));
-        NdisMoveMemory(&(pAd->EEPROMImage[Offset]), &data, 2);
-    }
-    else
-        eFuseWriteRegisters(pAd, Offset, 2, &data);
-	return 0;
-}
-
-
-int RtmpEfuseSupportCheck(
-	IN RTMP_ADAPTER *pAd)
-{
-	USHORT value;
-
-	if (IS_RT30xx(pAd))
-	{
-		eFusePhysicalReadRegisters(pAd, EFUSE_TAG, 2, &value);
-		pAd->EFuseTag = (value & 0xff);
-	}
-	return 0;
-}
-
-INT set_eFuseBufferModeWriteBack_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	UINT Enable;
-
-
-	if(strlen(arg)>0)
-	{
-		Enable= simple_strtol(arg, 0, 16);
-	}
-	else
-		return FALSE;
-	if(Enable==1)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("set_eFuseBufferMode_Proc:: Call WRITEEEPROMBUF"));
-		eFuseWriteEeeppromBuf(pAd);
-	}
-	else
-		return FALSE;
-	return TRUE;
-}
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		Load EEPROM from bin file for eFuse mode
-
-	Arguments:
-		Adapter						Pointer to our adapter
-
-	Return Value:
-		NDIS_STATUS_SUCCESS         firmware image load ok
-		NDIS_STATUS_FAILURE         image not found
-
-	IRQL = PASSIVE_LEVEL
-
-	========================================================================
-*/
-INT eFuseLoadEEPROM(
-	IN PRTMP_ADAPTER pAd)
-{
-	PSTRING					src = NULL;
-	INT						retval;
-	RTMP_OS_FD				srcf;
-	RTMP_OS_FS_INFO			osFSInfo;
-
-
-	src=EFUSE_BUFFER_PATH;
-	DBGPRINT(RT_DEBUG_TRACE, ("FileName=%s\n",src));
-
-
-	RtmpOSFSInfoChange(&osFSInfo, TRUE);
-
-	if (src && *src)
-	{
-		srcf = RtmpOSFileOpen(src, O_RDONLY, 0);
-		if (IS_FILE_OPEN_ERR(srcf))
-		{
-			DBGPRINT(RT_DEBUG_ERROR, ("--> Error %ld opening %s\n", -PTR_ERR(srcf),src));
-			return FALSE;
-		}
-		else
-		{
-
-				memset(pAd->EEPROMImage, 0x00, MAX_EEPROM_BIN_FILE_SIZE);
-
-
-			retval =RtmpOSFileRead(srcf, (PSTRING)pAd->EEPROMImage, MAX_EEPROM_BIN_FILE_SIZE);
-			if (retval > 0)
-							{
-				RTMPSetProfileParameters(pAd, (PSTRING)pAd->EEPROMImage);
-				retval = NDIS_STATUS_SUCCESS;
-			}
-			else
-				DBGPRINT(RT_DEBUG_ERROR, ("Read file \"%s\" failed(errCode=%d)!\n", src, retval));
-
-		}
-
-
-	}
-	else
-		{
-					DBGPRINT(RT_DEBUG_ERROR, ("--> Error src  or srcf is null\n"));
-					return FALSE;
-
-		}
-
-	retval=RtmpOSFileClose(srcf);
-
-	if (retval)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("--> Error %d closing %s\n", -retval, src));
-	}
-
-
-	RtmpOSFSInfoChange(&osFSInfo, FALSE);
-
-	return TRUE;
-}
-
-INT eFuseWriteEeeppromBuf(
-	IN PRTMP_ADAPTER pAd)
-{
-
-	PSTRING					src = NULL;
-	INT						retval;
-	RTMP_OS_FD				srcf;
-	RTMP_OS_FS_INFO			osFSInfo;
-
-
-	src=EFUSE_BUFFER_PATH;
-	DBGPRINT(RT_DEBUG_TRACE, ("FileName=%s\n",src));
-
-	RtmpOSFSInfoChange(&osFSInfo, TRUE);
-
-
-
-	if (src && *src)
-	{
-		srcf = RtmpOSFileOpen(src, O_WRONLY|O_CREAT, 0);
-
-		if (IS_FILE_OPEN_ERR(srcf))
-		{
-			DBGPRINT(RT_DEBUG_ERROR, ("--> Error %ld opening %s\n", -PTR_ERR(srcf),src));
-			return FALSE;
-		}
-		else
-		{
-/*
-			// The object must have a read method
-			if (srcf->f_op && srcf->f_op->write)
-			{
-				// The object must have a read method
-                        srcf->f_op->write(srcf, pAd->EEPROMImage, 1024, &srcf->f_pos);
-
-			}
-			else
-			{
-						DBGPRINT(RT_DEBUG_ERROR, ("--> Error!! System doest not support read function\n"));
-						return FALSE;
-			}
-*/
-
-			RtmpOSFileWrite(srcf, (PSTRING)pAd->EEPROMImage,MAX_EEPROM_BIN_FILE_SIZE);
-
-		}
-
-
-	}
-	else
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("--> Error src  or srcf is null\n"));
-		return FALSE;
-
-	}
-
-	retval=RtmpOSFileClose(srcf);
-
-	if (retval)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("--> Error %d closing %s\n", -retval, src));
-	}
-
-	RtmpOSFSInfoChange(&osFSInfo, FALSE);
-	return TRUE;
-}
-
-
-VOID eFuseGetFreeBlockCount(IN PRTMP_ADAPTER pAd,
-	PUINT EfuseFreeBlock)
-{
-	USHORT i;
-	USHORT	LogicalAddress;
-	if(!pAd->bUseEfuse)
-		{
-		DBGPRINT(RT_DEBUG_TRACE,("eFuseGetFreeBlockCount Only supports efuse Mode\n"));
-		return ;
-		}
-	for (i = EFUSE_USAGE_MAP_START; i <= EFUSE_USAGE_MAP_END; i+=2)
-	{
-		eFusePhysicalReadRegisters(pAd, i, 2, &LogicalAddress);
-		if( (LogicalAddress & 0xff) == 0)
-		{
-			*EfuseFreeBlock= (UCHAR) (EFUSE_USAGE_MAP_END-i+1);
-			break;
-		}
-		else if(( (LogicalAddress >> 8) & 0xff) == 0)
-		{
-			*EfuseFreeBlock = (UCHAR) (EFUSE_USAGE_MAP_END-i);
-			break;
-		}
-
-		if(i == EFUSE_USAGE_MAP_END)
-			*EfuseFreeBlock = 0;
-	}
-	DBGPRINT(RT_DEBUG_TRACE,("eFuseGetFreeBlockCount is 0x%x\n",*EfuseFreeBlock));
-}
-
-INT eFuse_init(
-	IN PRTMP_ADAPTER pAd)
-{
-	UINT	EfuseFreeBlock=0;
-	DBGPRINT(RT_DEBUG_ERROR, ("NVM is Efuse and its size =%x[%x-%x] \n",EFUSE_USAGE_MAP_SIZE,EFUSE_USAGE_MAP_START,EFUSE_USAGE_MAP_END));
-	eFuseGetFreeBlockCount(pAd, &EfuseFreeBlock);
-	//If the used block of efuse is less than 5. We assume the default value
-	// of this efuse is empty and change to the buffer mode in odrder to
-	//bring up interfaces successfully.
-	if(EfuseFreeBlock > (EFUSE_USAGE_MAP_END-5))
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("NVM is Efuse and the information is too less to bring up interface. Force to use EEPROM Buffer Mode\n"));
-		pAd->bFroceEEPROMBuffer = TRUE;
-		eFuseLoadEEPROM(pAd);
-	}
-	else
-		pAd->bFroceEEPROMBuffer = FALSE;
-	DBGPRINT(RT_DEBUG_TRACE, ("NVM is Efuse and force to use EEPROM Buffer Mode=%x\n",pAd->bFroceEEPROMBuffer));
-
-	return 0;
-}
diff --git a/drivers/staging/rt3090/common/ee_prom.c b/drivers/staging/rt3090/common/ee_prom.c
deleted file mode 100644
index 051cfdee2a15..000000000000
--- a/drivers/staging/rt3090/common/ee_prom.c
+++ /dev/null
@@ -1,308 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-	Module Name:
-	ee_prom.c
-
-	Abstract:
-	Miniport generic portion header file
-
-	Revision History:
-	Who         When          What
-	--------    ----------    ----------------------------------------------
-*/
-
-#include "../rt_config.h"
-
-
-// IRQL = PASSIVE_LEVEL
-static inline VOID RaiseClock(
-    IN	PRTMP_ADAPTER	pAd,
-    IN  UINT32 *x)
-{
-	*x = *x | EESK;
-	RTMP_IO_WRITE32(pAd, E2PROM_CSR, *x);
-	RTMPusecDelay(1);				// Max frequency = 1MHz in Spec. definition
-}
-
-// IRQL = PASSIVE_LEVEL
-static inline VOID LowerClock(
-    IN	PRTMP_ADAPTER	pAd,
-    IN  UINT32 *x)
-{
-	*x = *x & ~EESK;
-	RTMP_IO_WRITE32(pAd, E2PROM_CSR, *x);
-	RTMPusecDelay(1);
-}
-
-// IRQL = PASSIVE_LEVEL
-static inline USHORT ShiftInBits(
-	IN PRTMP_ADAPTER	pAd)
-{
-	UINT32		x,i;
-	USHORT      data=0;
-
-	RTMP_IO_READ32(pAd, E2PROM_CSR, &x);
-
-	x &= ~( EEDO | EEDI);
-
-	for(i=0; i<16; i++)
-	{
-		data = data << 1;
-		RaiseClock(pAd, &x);
-
-		RTMP_IO_READ32(pAd, E2PROM_CSR, &x);
-		LowerClock(pAd, &x); //prevent read failed
-
-		x &= ~(EEDI);
-		if(x & EEDO)
-		    data |= 1;
-	}
-
-	return data;
-}
-
-
-// IRQL = PASSIVE_LEVEL
-static inline VOID ShiftOutBits(
-	IN PRTMP_ADAPTER	pAd,
-	IN USHORT			data,
-	IN USHORT			count)
-{
-	UINT32       x,mask;
-
-	mask = 0x01 << (count - 1);
-	RTMP_IO_READ32(pAd, E2PROM_CSR, &x);
-
-	x &= ~(EEDO | EEDI);
-
-	do
-	{
-	    x &= ~EEDI;
-	    if(data & mask)		x |= EEDI;
-
-	    RTMP_IO_WRITE32(pAd, E2PROM_CSR, x);
-
-	    RaiseClock(pAd, &x);
-	    LowerClock(pAd, &x);
-
-	    mask = mask >> 1;
-	} while(mask);
-
-	x &= ~EEDI;
-	RTMP_IO_WRITE32(pAd, E2PROM_CSR, x);
-}
-
-
-// IRQL = PASSIVE_LEVEL
-static inline VOID EEpromCleanup(
-	IN PRTMP_ADAPTER	pAd)
-{
-	UINT32 x;
-
-	RTMP_IO_READ32(pAd, E2PROM_CSR, &x);
-
-	x &= ~(EECS | EEDI);
-	RTMP_IO_WRITE32(pAd, E2PROM_CSR, x);
-
-	RaiseClock(pAd, &x);
-	LowerClock(pAd, &x);
-}
-
-
-static inline VOID EWEN(
-	IN PRTMP_ADAPTER	pAd)
-{
-	UINT32	x;
-
-	// reset bits and set EECS
-	RTMP_IO_READ32(pAd, E2PROM_CSR, &x);
-	x &= ~(EEDI | EEDO | EESK);
-	x |= EECS;
-	RTMP_IO_WRITE32(pAd, E2PROM_CSR, x);
-
-	// kick a pulse
-	RaiseClock(pAd, &x);
-	LowerClock(pAd, &x);
-
-	// output the read_opcode and six pulse in that order
-	ShiftOutBits(pAd, EEPROM_EWEN_OPCODE, 5);
-	ShiftOutBits(pAd, 0, 6);
-
-	EEpromCleanup(pAd);
-}
-
-
-static inline VOID EWDS(
-	IN PRTMP_ADAPTER	pAd)
-{
-	UINT32	x;
-
-	// reset bits and set EECS
-	RTMP_IO_READ32(pAd, E2PROM_CSR, &x);
-	x &= ~(EEDI | EEDO | EESK);
-	x |= EECS;
-	RTMP_IO_WRITE32(pAd, E2PROM_CSR, x);
-
-	// kick a pulse
-	RaiseClock(pAd, &x);
-	LowerClock(pAd, &x);
-
-	// output the read_opcode and six pulse in that order
-	ShiftOutBits(pAd, EEPROM_EWDS_OPCODE, 5);
-	ShiftOutBits(pAd, 0, 6);
-
-	EEpromCleanup(pAd);
-}
-
-
-// IRQL = PASSIVE_LEVEL
-int rtmp_ee_prom_read16(
-	IN PRTMP_ADAPTER	pAd,
-	IN USHORT			Offset,
-	OUT USHORT			*pValue)
-{
-	UINT32		x;
-	USHORT		data;
-
-#ifdef RT30xx
-#ifdef ANT_DIVERSITY_SUPPORT
-	if (pAd->NicConfig2.field.AntDiversity)
-	{
-		pAd->EepromAccess = TRUE;
-	}
-#endif // ANT_DIVERSITY_SUPPORT //
-#endif // RT30xx //
-
-	Offset /= 2;
-	// reset bits and set EECS
-	RTMP_IO_READ32(pAd, E2PROM_CSR, &x);
-	x &= ~(EEDI | EEDO | EESK);
-	x |= EECS;
-	RTMP_IO_WRITE32(pAd, E2PROM_CSR, x);
-
-	// patch can not access e-Fuse issue
-	if (!(IS_RT3090(pAd) || IS_RT3572(pAd) || IS_RT3390(pAd)))
-	{
-		// kick a pulse
-		RaiseClock(pAd, &x);
-		LowerClock(pAd, &x);
-	}
-
-	// output the read_opcode and register number in that order
-	ShiftOutBits(pAd, EEPROM_READ_OPCODE, 3);
-	ShiftOutBits(pAd, Offset, pAd->EEPROMAddressNum);
-
-	// Now read the data (16 bits) in from the selected EEPROM word
-	data = ShiftInBits(pAd);
-
-	EEpromCleanup(pAd);
-
-#ifdef RT30xx
-#ifdef ANT_DIVERSITY_SUPPORT
-	// Antenna and EEPROM access are both using EESK pin,
-	// Therefor we should avoid accessing EESK at the same time
-	// Then restore antenna after EEPROM access
-	if ((pAd->NicConfig2.field.AntDiversity)/* || (pAd->RfIcType == RFIC_3020)*/)
-	{
-		pAd->EepromAccess = FALSE;
-		AsicSetRxAnt(pAd, pAd->RxAnt.Pair1PrimaryRxAnt);
-	}
-#endif // ANT_DIVERSITY_SUPPORT //
-#endif // RT30xx //
-
-	*pValue = data;
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-int rtmp_ee_prom_write16(
-    IN  PRTMP_ADAPTER	pAd,
-    IN  USHORT Offset,
-    IN  USHORT Data)
-{
-	UINT32 x;
-
-#ifdef RT30xx
-#ifdef ANT_DIVERSITY_SUPPORT
-	if (pAd->NicConfig2.field.AntDiversity)
-	{
-		pAd->EepromAccess = TRUE;
-	}
-#endif // ANT_DIVERSITY_SUPPORT //
-#endif // RT30xx //
-
-	Offset /= 2;
-
-	EWEN(pAd);
-
-	// reset bits and set EECS
-	RTMP_IO_READ32(pAd, E2PROM_CSR, &x);
-	x &= ~(EEDI | EEDO | EESK);
-	x |= EECS;
-	RTMP_IO_WRITE32(pAd, E2PROM_CSR, x);
-
-	// patch can not access e-Fuse issue
-	if (!(IS_RT3090(pAd) || IS_RT3572(pAd) || IS_RT3390(pAd)))
-	{
-		// kick a pulse
-		RaiseClock(pAd, &x);
-		LowerClock(pAd, &x);
-	}
-
-	// output the read_opcode ,register number and data in that order
-	ShiftOutBits(pAd, EEPROM_WRITE_OPCODE, 3);
-	ShiftOutBits(pAd, Offset, pAd->EEPROMAddressNum);
-	ShiftOutBits(pAd, Data, 16);		// 16-bit access
-
-	// read DO status
-	RTMP_IO_READ32(pAd, E2PROM_CSR, &x);
-
-	EEpromCleanup(pAd);
-
-	RTMPusecDelay(10000);	//delay for twp(MAX)=10ms
-
-	EWDS(pAd);
-
-	EEpromCleanup(pAd);
-
-#ifdef RT30xx
-#ifdef ANT_DIVERSITY_SUPPORT
-	// Antenna and EEPROM access are both using EESK pin,
-	// Therefor we should avoid accessing EESK at the same time
-	// Then restore antenna after EEPROM access
-	if ((pAd->NicConfig2.field.AntDiversity) /*|| (pAd->RfIcType == RFIC_3020)*/)
-	{
-		pAd->EepromAccess = FALSE;
-		AsicSetRxAnt(pAd, pAd->RxAnt.Pair1PrimaryRxAnt);
-	}
-#endif // ANT_DIVERSITY_SUPPORT //
-#endif // RT30xx //
-
-	return NDIS_STATUS_SUCCESS;
-
-}
diff --git a/drivers/staging/rt3090/common/eeprom.c b/drivers/staging/rt3090/common/eeprom.c
deleted file mode 100644
index 2e837499e5e4..000000000000
--- a/drivers/staging/rt3090/common/eeprom.c
+++ /dev/null
@@ -1,98 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-	Module Name:
-	eeprom.c
-
-	Abstract:
-
-	Revision History:
-	Who			When			What
-	--------	----------		----------------------------------------------
-	Name		Date			Modification logs
-*/
-
-#include "../rt_config.h"
-
-
-INT RtmpChipOpsEepromHook(
-	IN RTMP_ADAPTER *pAd,
-	IN INT			infType)
-{
-	RTMP_CHIP_OP	*pChipOps = &pAd->chipOps;
-#ifdef RT30xx
-#ifdef RTMP_EFUSE_SUPPORT
-	UINT32			eFuseCtrl, MacCsr0;
-	int index;
-
-	index = 0;
-	do
-	{
-		RTMP_IO_READ32(pAd, MAC_CSR0, &MacCsr0);
-		pAd->MACVersion = MacCsr0;
-
-		if ((pAd->MACVersion != 0x00) && (pAd->MACVersion != 0xFFFFFFFF))
-			break;
-
-		RTMPusecDelay(10);
-	} while (index++ < 100);
-
-	pAd->bUseEfuse=FALSE;
-	RTMP_IO_READ32(pAd, EFUSE_CTRL, &eFuseCtrl);
-	pAd->bUseEfuse = ( (eFuseCtrl & 0x80000000) == 0x80000000) ? 1 : 0;
-	if(pAd->bUseEfuse)
-	{
-		pChipOps->eeinit = eFuse_init;
-		pChipOps->eeread = rtmp_ee_efuse_read16;
-		pChipOps->eewrite = rtmp_ee_efuse_write16;
-		return 0 ;
-	}
-	else
-	{
-		pAd->bFroceEEPROMBuffer = FALSE;
-		DBGPRINT(RT_DEBUG_TRACE, ("NVM is EEPROM\n"));
-	}
-#endif // RTMP_EFUSE_SUPPORT //
-#endif // RT30xx //
-
-	switch(infType)
-	{
-#ifdef RTMP_PCI_SUPPORT
-		case RTMP_DEV_INF_PCI:
-			pChipOps->eeinit = NULL;
-			pChipOps->eeread = rtmp_ee_prom_read16;
-			pChipOps->eewrite = rtmp_ee_prom_write16;
-			break;
-#endif // RTMP_PCI_SUPPORT //
-
-
-		default:
-			DBGPRINT(RT_DEBUG_ERROR, ("RtmpChipOpsEepromHook() failed!\n"));
-			break;
-	}
-
-	return 0;
-}
diff --git a/drivers/staging/rt3090/common/igmp_snoop.c b/drivers/staging/rt3090/common/igmp_snoop.c
deleted file mode 100644
index 680658f97f0a..000000000000
--- a/drivers/staging/rt3090/common/igmp_snoop.c
+++ /dev/null
@@ -1,1365 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
- */
-
-
-#ifdef IGMP_SNOOP_SUPPORT
-
-#include "../rt_config.h"
-#include "../ipv6.h"
-#include "../igmp_snoop.h"
-
-
-static inline void initFreeEntryList(
-	IN PMULTICAST_FILTER_TABLE pMulticastFilterTable,
-	IN PLIST_HEADER pList)
-{
-	int i;
-
-	for (i = 0; i < FREE_MEMBER_POOL_SIZE; i++)
-		insertTailList(pList, (PLIST_ENTRY)&(pMulticastFilterTable->freeMemberPool[i]));
-
-	return;
-}
-
-static inline PMEMBER_ENTRY AllocaGrpMemberEntry(
-	IN PMULTICAST_FILTER_TABLE pMulticastFilterTable)
-{
-	PMEMBER_ENTRY pMemberEntry;
-
-	RTMP_SEM_LOCK(&pMulticastFilterTable->FreeMemberPoolTabLock);
-
-	pMemberEntry = (PMEMBER_ENTRY)removeHeadList(&pMulticastFilterTable->freeEntryList);
-
-	RTMP_SEM_UNLOCK(&pMulticastFilterTable->FreeMemberPoolTabLock);
-
-	return (PMEMBER_ENTRY)pMemberEntry;
-}
-
-static inline VOID FreeGrpMemberEntry(
-	IN PMULTICAST_FILTER_TABLE pMulticastFilterTable,
-	IN PMEMBER_ENTRY pEntry)
-{
-	RTMP_SEM_LOCK(&pMulticastFilterTable->FreeMemberPoolTabLock);
-
-	insertTailList(&pMulticastFilterTable->freeEntryList, (PLIST_ENTRY)pEntry);
-
-	RTMP_SEM_UNLOCK(&pMulticastFilterTable->FreeMemberPoolTabLock);
-}
-
-static VOID IGMPTableDisplay(
-	IN PRTMP_ADAPTER pAd);
-
-static BOOLEAN isIgmpMacAddr(
-	IN PUCHAR pMacAddr);
-
-static VOID InsertIgmpMember(
-	IN PMULTICAST_FILTER_TABLE pMulticastFilterTable,
-	IN PLIST_HEADER pList,
-	IN PUCHAR pMemberAddr);
-
-static VOID DeleteIgmpMember(
-	IN PMULTICAST_FILTER_TABLE pMulticastFilterTable,
-	IN PLIST_HEADER pList,
-	IN PUCHAR pMemberAddr);
-
-static VOID DeleteIgmpMemberList(
-	IN PMULTICAST_FILTER_TABLE pMulticastFilterTable,
-	IN PLIST_HEADER pList);
-
-
-/*
-    ==========================================================================
-    Description:
-        This routine init the entire IGMP table.
-    ==========================================================================
- */
-VOID MulticastFilterTableInit(
-	IN PMULTICAST_FILTER_TABLE *ppMulticastFilterTable)
-{
-	// Initialize MAC table and allocate spin lock
-	*ppMulticastFilterTable = kmalloc(sizeof(MULTICAST_FILTER_TABLE), MEM_ALLOC_FLAG);
-	if (*ppMulticastFilterTable == NULL)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("%s unable to alloc memory for Multicase filter table, size=%d\n",
-			__FUNCTION__, sizeof(MULTICAST_FILTER_TABLE)));
-		return;
-	}
-
-	NdisZeroMemory(*ppMulticastFilterTable, sizeof(MULTICAST_FILTER_TABLE));
-	NdisAllocateSpinLock(&((*ppMulticastFilterTable)->MulticastFilterTabLock));
-
-	NdisAllocateSpinLock(&((*ppMulticastFilterTable)->FreeMemberPoolTabLock));
-	initList(&((*ppMulticastFilterTable)->freeEntryList));
-	initFreeEntryList(*ppMulticastFilterTable, &((*ppMulticastFilterTable)->freeEntryList));
-	return;
-}
-
-/*
-    ==========================================================================
-    Description:
-        This routine reset the entire IGMP table.
-    ==========================================================================
- */
-VOID MultiCastFilterTableReset(
-	IN PMULTICAST_FILTER_TABLE *ppMulticastFilterTable)
-{
-	if(*ppMulticastFilterTable == NULL)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("%s Multicase filter table is not ready.\n", __FUNCTION__));
-		return;
-	}
-
-	NdisFreeSpinLock(&((*ppMulticastFilterTable)->FreeMemberPoolTabLock));
-	NdisFreeSpinLock(&((*ppMulticastFilterTable)->MulticastFilterTabLock));
-	kfree(*ppMulticastFilterTable);
-	*ppMulticastFilterTable = NULL;
-}
-
-/*
-    ==========================================================================
-    Description:
-        Display all entrys in IGMP table
-    ==========================================================================
- */
-static VOID IGMPTableDisplay(
-	IN PRTMP_ADAPTER pAd)
-{
-	int i;
-	MULTICAST_FILTER_TABLE_ENTRY *pEntry = NULL;
-	PMULTICAST_FILTER_TABLE pMulticastFilterTable = pAd->pMulticastFilterTable;
-
-	if (pMulticastFilterTable == NULL)
-	{
-		DBGPRINT(RT_DEBUG_OFF, ("%s Multicase filter table is not ready.\n", __FUNCTION__));
-		return;
-	}
-
-	// if FULL, return
-	if (pMulticastFilterTable->Size == 0)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("Table empty.\n"));
-		return;
-	}
-
-	// allocate one MAC entry
-	RTMP_SEM_LOCK(&pMulticastFilterTable->MulticastFilterTabLock);
-
-	for (i = 0; i< MAX_LEN_OF_MULTICAST_FILTER_TABLE; i++)
-	{
-		// pick up the first available vacancy
-		if (pMulticastFilterTable->Content[i].Valid == TRUE)
-		{
-			PMEMBER_ENTRY pMemberEntry = NULL;
-			pEntry = &pMulticastFilterTable->Content[i];
-
-			DBGPRINT(RT_DEBUG_OFF, ("IF(%s) entry #%d, type=%s, GrpId=(%02x:%02x:%02x:%02x:%02x:%02x) memberCnt=%d\n",
-				RTMP_OS_NETDEV_GET_DEVNAME(pEntry->net_dev), i, (pEntry->type==0 ? "static":"dynamic"),
-				PRINT_MAC(pEntry->Addr), IgmpMemberCnt(&pEntry->MemberList)));
-
-			pMemberEntry = (PMEMBER_ENTRY)pEntry->MemberList.pHead;
-			while (pMemberEntry)
-			{
-				DBGPRINT(RT_DEBUG_OFF, ("member mac=(%02x:%02x:%02x:%02x:%02x:%02x)\n",
-										PRINT_MAC(pMemberEntry->Addr)));
-
-				pMemberEntry = pMemberEntry->pNext;
-			}
-		}
-	}
-
-	RTMP_SEM_UNLOCK(&pMulticastFilterTable->MulticastFilterTabLock);
-
-	return;
-}
-
-/*
-    ==========================================================================
-    Description:
-        Add and new entry into MAC table
-    ==========================================================================
- */
-BOOLEAN MulticastFilterTableInsertEntry(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR pGrpId,
-	IN PUCHAR pMemberAddr,
-	IN PNET_DEV dev,
-	IN MulticastFilterEntryType type)
-{
-	UCHAR HashIdx;
-	int i;
-	MULTICAST_FILTER_TABLE_ENTRY *pEntry = NULL, *pCurrEntry, *pPrevEntry;
-	PMEMBER_ENTRY pMemberEntry;
-	PMULTICAST_FILTER_TABLE pMulticastFilterTable = pAd->pMulticastFilterTable;
-
-	if (pMulticastFilterTable == NULL)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("%s Multicase filter table is not ready.\n", __FUNCTION__));
-		return FALSE;
-	}
-
-	// if FULL, return
-	if (pMulticastFilterTable->Size >= MAX_LEN_OF_MULTICAST_FILTER_TABLE)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("%s Multicase filter table full. max-entries = %d\n",
-			__FUNCTION__, MAX_LEN_OF_MULTICAST_FILTER_TABLE));
-		return FALSE;
-	}
-
-	// check the rule is in table already or not.
-	if ((pEntry = MulticastFilterTableLookup(pMulticastFilterTable, pGrpId, dev)))
-	{
-		// doesn't indicate member mac address.
-		if(pMemberAddr == NULL)
-		{
-			return FALSE;
-		}
-
-		pMemberEntry = (PMEMBER_ENTRY)pEntry->MemberList.pHead;
-
-		while (pMemberEntry)
-		{
-			if (MAC_ADDR_EQUAL(pMemberAddr, pMemberEntry->Addr))
-			{
-				DBGPRINT(RT_DEBUG_ERROR, ("%s: already in Members list.\n", __FUNCTION__));
-				return FALSE;
-			}
-
-			pMemberEntry = pMemberEntry->pNext;
-		}
-	}
-
-	RTMP_SEM_LOCK(&pMulticastFilterTable->MulticastFilterTabLock);
-	do
-	{
-		ULONG Now;
-		// the multicast entry already exist but doesn't include the member yet.
-		if (pEntry != NULL && pMemberAddr != NULL)
-		{
-			InsertIgmpMember(pMulticastFilterTable, &pEntry->MemberList, pMemberAddr);
-			break;
-		}
-
-		// allocate one MAC entry
-		for (i = 0; i < MAX_LEN_OF_MULTICAST_FILTER_TABLE; i++)
-		{
-			// pick up the first available vacancy
-			pEntry = &pMulticastFilterTable->Content[i];
-			NdisGetSystemUpTime(&Now);
-			if ((pEntry->Valid == TRUE) && (pEntry->type == MCAT_FILTER_DYNAMIC)
-				&& ((Now - pEntry->lastTime) > IGMPMAC_TB_ENTRY_AGEOUT_TIME))
-			{
-				PMULTICAST_FILTER_TABLE_ENTRY pHashEntry;
-
-				HashIdx = MULTICAST_ADDR_HASH_INDEX(pEntry->Addr);
-				pHashEntry = pMulticastFilterTable->Hash[HashIdx];
-
-				if ((pEntry->net_dev == pHashEntry->net_dev)
-					&& MAC_ADDR_EQUAL(pEntry->Addr, pHashEntry->Addr))
-				{
-					pMulticastFilterTable->Hash[HashIdx] = pHashEntry->pNext;
-					pMulticastFilterTable->Size --;
-					DBGPRINT(RT_DEBUG_TRACE, ("MCastFilterTableDeleteEntry 1 - Total= %d\n", pMulticastFilterTable->Size));
-				} else
-				{
-					while (pHashEntry->pNext)
-					{
-						pPrevEntry = pHashEntry;
-						pHashEntry = pHashEntry->pNext;
-						if ((pEntry->net_dev == pHashEntry->net_dev)
-							&& MAC_ADDR_EQUAL(pEntry->Addr, pHashEntry->Addr))
-						{
-							pPrevEntry->pNext = pHashEntry->pNext;
-							pMulticastFilterTable->Size --;
-							DBGPRINT(RT_DEBUG_TRACE, ("MCastFilterTableDeleteEntry 2 - Total= %d\n", pMulticastFilterTable->Size));
-							break;
-						}
-					}
-				}
-				pEntry->Valid = FALSE;
-				DeleteIgmpMemberList(pMulticastFilterTable, &pEntry->MemberList);
-			}
-
-			if (pEntry->Valid == FALSE)
-			{
-				NdisZeroMemory(pEntry, sizeof(MULTICAST_FILTER_TABLE_ENTRY));
-				pEntry->Valid = TRUE;
-
-				COPY_MAC_ADDR(pEntry->Addr, pGrpId);
-				pEntry->net_dev = dev;
-				NdisGetSystemUpTime(&Now);
-				pEntry->lastTime = Now;
-				pEntry->type = type;
-				initList(&pEntry->MemberList);
-				if (pMemberAddr != NULL)
-					InsertIgmpMember(pMulticastFilterTable, &pEntry->MemberList, pMemberAddr);
-
-				pMulticastFilterTable->Size ++;
-
-				DBGPRINT(RT_DEBUG_TRACE, ("MulticastFilterTableInsertEntry -IF(%s) allocate entry #%d, Total= %d\n", RTMP_OS_NETDEV_GET_DEVNAME(dev), i, pMulticastFilterTable->Size));
-				break;
-			}
-		}
-
-		// add this MAC entry into HASH table
-		if (pEntry)
-		{
-			HashIdx = MULTICAST_ADDR_HASH_INDEX(pGrpId);
-			if (pMulticastFilterTable->Hash[HashIdx] == NULL)
-			{
-				pMulticastFilterTable->Hash[HashIdx] = pEntry;
-			} else
-			{
-				pCurrEntry = pMulticastFilterTable->Hash[HashIdx];
-				while (pCurrEntry->pNext != NULL)
-					pCurrEntry = pCurrEntry->pNext;
-				pCurrEntry->pNext = pEntry;
-			}
-		}
-	}while(FALSE);
-
-	RTMP_SEM_UNLOCK(&pMulticastFilterTable->MulticastFilterTabLock);
-
-	return TRUE;
-}
-
-/*
-    ==========================================================================
-    Description:
-        Delete a specified client from MAC table
-    ==========================================================================
- */
-BOOLEAN MulticastFilterTableDeleteEntry(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR pGrpId,
-	IN PUCHAR pMemberAddr,
-	IN PNET_DEV dev)
-{
-	USHORT HashIdx;
-	MULTICAST_FILTER_TABLE_ENTRY *pEntry, *pPrevEntry;
-	PMULTICAST_FILTER_TABLE pMulticastFilterTable = pAd->pMulticastFilterTable;
-	USHORT Aid = MCAST_WCID;
-	SST	Sst = SST_ASSOC;
-	UCHAR PsMode = PWR_ACTIVE, Rate;
-
-	if (pMulticastFilterTable == NULL)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("%s Multicase filter table is not ready.\n", __FUNCTION__));
-		return FALSE;
-	}
-
-	RTMP_SEM_LOCK(&pMulticastFilterTable->MulticastFilterTabLock);
-
-	do
-	{
-		HashIdx = MULTICAST_ADDR_HASH_INDEX(pGrpId);
-		pPrevEntry = pEntry = pMulticastFilterTable->Hash[HashIdx];
-
-		while (pEntry && pEntry->Valid)
-		{
-			if ((pEntry->net_dev ==  dev)
-				&& MAC_ADDR_EQUAL(pEntry->Addr, pGrpId))
-				break;
-			else
-			{
-				pPrevEntry = pEntry;
-				pEntry = pEntry->pNext;
-			}
-		}
-
-		// check the rule is in table already or not.
-		if (pEntry && (pMemberAddr != NULL))
-		{
-			if(APSsPsInquiry(pAd, pMemberAddr, &Sst, &Aid, &PsMode, &Rate))
-				DeleteIgmpMember(pMulticastFilterTable, &pEntry->MemberList, pMemberAddr);
-			if (IgmpMemberCnt(&pEntry->MemberList) > 0)
-				break;
-		}
-
-		if (pEntry)
-		{
-			if (pEntry == pMulticastFilterTable->Hash[HashIdx])
-			{
-				pMulticastFilterTable->Hash[HashIdx] = pEntry->pNext;
-				DeleteIgmpMemberList(pMulticastFilterTable, &pEntry->MemberList);
-				NdisZeroMemory(pEntry, sizeof(MULTICAST_FILTER_TABLE_ENTRY));
-				pMulticastFilterTable->Size --;
-				DBGPRINT(RT_DEBUG_TRACE, ("MCastFilterTableDeleteEntry 1 - Total= %d\n", pMulticastFilterTable->Size));
-			}
-			else
-			{
-				pPrevEntry->pNext = pEntry->pNext;
-				DeleteIgmpMemberList(pMulticastFilterTable, &pEntry->MemberList);
-				NdisZeroMemory(pEntry, sizeof(MULTICAST_FILTER_TABLE_ENTRY));
-				pMulticastFilterTable->Size --;
-				DBGPRINT(RT_DEBUG_TRACE, ("MCastFilterTableDeleteEntry 2 - Total= %d\n", pMulticastFilterTable->Size));
-			}
-		}
-		else
-		{
-			DBGPRINT(RT_DEBUG_ERROR, ("%s: the Group doesn't exist.\n", __FUNCTION__));
-		}
-	} while(FALSE);
-
-	RTMP_SEM_UNLOCK(&pMulticastFilterTable->MulticastFilterTabLock);
-
-	return TRUE;
-}
-
-/*
-    ==========================================================================
-    Description:
-        Look up the MAC address in the IGMP table. Return NULL if not found.
-    Return:
-        pEntry - pointer to the MAC entry; NULL is not found
-    ==========================================================================
-*/
-PMULTICAST_FILTER_TABLE_ENTRY MulticastFilterTableLookup(
-	IN PMULTICAST_FILTER_TABLE pMulticastFilterTable,
-	IN PUCHAR pAddr,
-	IN PNET_DEV dev)
-{
-	ULONG HashIdx, Now;
-	PMULTICAST_FILTER_TABLE_ENTRY pEntry = NULL, pPrev = NULL;
-
-	if (pMulticastFilterTable == NULL)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("%s Multicase filter table is not ready.\n", __FUNCTION__));
-		return NULL;
-	}
-
-	RTMP_SEM_LOCK(&pMulticastFilterTable->MulticastFilterTabLock);
-
-	HashIdx = MULTICAST_ADDR_HASH_INDEX(pAddr);
-	pEntry = pPrev = pMulticastFilterTable->Hash[HashIdx];
-
-	while (pEntry && pEntry->Valid)
-	{
-		if ((pEntry->net_dev ==  dev)
-			&& MAC_ADDR_EQUAL(pEntry->Addr, pAddr))
-		{
-			NdisGetSystemUpTime(&Now);
-			pEntry->lastTime = Now;
-			break;
-		}
-		else
-		{
-			NdisGetSystemUpTime(&Now);
-			if ((pEntry->Valid == TRUE) && (pEntry->type == MCAT_FILTER_DYNAMIC)
-				&& RTMP_TIME_AFTER(Now, pEntry->lastTime+IGMPMAC_TB_ENTRY_AGEOUT_TIME))
-			{
-				// Remove the aged entry
-				if (pEntry == pMulticastFilterTable->Hash[HashIdx])
-				{
-					pMulticastFilterTable->Hash[HashIdx] = pEntry->pNext;
-					pPrev = pMulticastFilterTable->Hash[HashIdx];
-					DeleteIgmpMemberList(pMulticastFilterTable, &pEntry->MemberList);
-					NdisZeroMemory(pEntry, sizeof(MULTICAST_FILTER_TABLE_ENTRY));
-					pMulticastFilterTable->Size --;
-					pEntry = pPrev;
-					DBGPRINT(RT_DEBUG_TRACE, ("MCastFilterTableDeleteEntry 2 - Total= %d\n", pMulticastFilterTable->Size));
-				}
-				else
-				{
-					pPrev->pNext = pEntry->pNext;
-					DeleteIgmpMemberList(pMulticastFilterTable, &pEntry->MemberList);
-					NdisZeroMemory(pEntry, sizeof(MULTICAST_FILTER_TABLE_ENTRY));
-					pMulticastFilterTable->Size --;
-					pEntry = (pPrev == NULL ? NULL: pPrev->pNext);
-					DBGPRINT(RT_DEBUG_TRACE, ("MCastFilterTableDeleteEntry 2 - Total= %d\n", pMulticastFilterTable->Size));
-				}
-			}
-			else
-			{
-				pPrev = pEntry;
-				pEntry = pEntry->pNext;
-			}
-		}
-	}
-
-	RTMP_SEM_UNLOCK(&pMulticastFilterTable->MulticastFilterTabLock);
-
-	return pEntry;
-}
-
-VOID IGMPSnooping(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR pDstMacAddr,
-	IN PUCHAR pSrcMacAddr,
-	IN PUCHAR pIpHeader,
-	IN PNET_DEV pDev)
-{
-	INT i;
-	INT IpHeaderLen;
-	UCHAR GroupType;
-	UINT16 numOfGroup;
-	UCHAR IgmpVerType;
-	PUCHAR pIgmpHeader;
-	PUCHAR pGroup;
-	UCHAR AuxDataLen;
-	UINT16 numOfSources;
-	PUCHAR pGroupIpAddr;
-	UCHAR GroupMacAddr[6];
-	PUCHAR pGroupMacAddr = (PUCHAR)&GroupMacAddr;
-
-	if(isIgmpPkt(pDstMacAddr, pIpHeader))
-	{
-		IpHeaderLen = (*(pIpHeader + 2) & 0x0f) * 4;
-		pIgmpHeader = pIpHeader + 2 + IpHeaderLen;
-		IgmpVerType = (UCHAR)(*(pIgmpHeader));
-
-		DBGPRINT(RT_DEBUG_TRACE, ("IGMP type=%0x\n", IgmpVerType));
-
-		switch(IgmpVerType)
-		{
-		case IGMP_V1_MEMBERSHIP_REPORT: // IGMP version 1 membership report.
-		case IGMP_V2_MEMBERSHIP_REPORT: // IGMP version 2 membership report.
-			pGroupIpAddr = (PUCHAR)(pIgmpHeader + 4);
-				ConvertMulticastIP2MAC(pGroupIpAddr, (PUCHAR *)&pGroupMacAddr, ETH_P_IP);
-			DBGPRINT(RT_DEBUG_TRACE, ("IGMP Group=%02x:%02x:%02x:%02x:%02x:%02x\n",
-				GroupMacAddr[0], GroupMacAddr[1], GroupMacAddr[2], GroupMacAddr[3], GroupMacAddr[4], GroupMacAddr[5]));
-			MulticastFilterTableInsertEntry(pAd, GroupMacAddr, pSrcMacAddr, pDev, MCAT_FILTER_DYNAMIC);
-			break;
-
-		case IGMP_LEAVE_GROUP: // IGMP version 1 and version 2 leave group.
-			pGroupIpAddr = (PUCHAR)(pIgmpHeader + 4);
-				ConvertMulticastIP2MAC(pGroupIpAddr, (PUCHAR *)&pGroupMacAddr, ETH_P_IP);
-			DBGPRINT(RT_DEBUG_TRACE, ("IGMP Group=%02x:%02x:%02x:%02x:%02x:%02x\n",
-				GroupMacAddr[0], GroupMacAddr[1], GroupMacAddr[2], GroupMacAddr[3], GroupMacAddr[4], GroupMacAddr[5]));
-			MulticastFilterTableDeleteEntry(pAd, GroupMacAddr, pSrcMacAddr, pDev);
-			break;
-
-		case IGMP_V3_MEMBERSHIP_REPORT: // IGMP version 3 membership report.
-			numOfGroup = ntohs(*((UINT16 *)(pIgmpHeader + 6)));
-			pGroup = (PUCHAR)(pIgmpHeader + 8);
-			for (i=0; i < numOfGroup; i++)
-			{
-				GroupType = (UCHAR)(*pGroup);
-				AuxDataLen = (UCHAR)(*(pGroup + 1));
-				numOfSources = ntohs(*((UINT16 *)(pGroup + 2)));
-				pGroupIpAddr = (PUCHAR)(pGroup + 4);
-				DBGPRINT(RT_DEBUG_TRACE, ("IGMPv3 Type=%d, ADL=%d, numOfSource=%d\n", GroupType, AuxDataLen, numOfSources));
-					ConvertMulticastIP2MAC(pGroupIpAddr, (PUCHAR *)&pGroupMacAddr, ETH_P_IP);
-				DBGPRINT(RT_DEBUG_TRACE, ("IGMP Group=%02x:%02x:%02x:%02x:%02x:%02x\n",
-					GroupMacAddr[0], GroupMacAddr[1], GroupMacAddr[2], GroupMacAddr[3], GroupMacAddr[4], GroupMacAddr[5]));
-
-				do
-				{
-					if((GroupType == MODE_IS_EXCLUDE) || (GroupType == CHANGE_TO_EXCLUDE_MODE) || (GroupType == ALLOW_NEW_SOURCES))
-					{
-						MulticastFilterTableInsertEntry(pAd, GroupMacAddr, pSrcMacAddr, pDev, MCAT_FILTER_DYNAMIC);
-						break;
-					}
-
-					if((GroupType == MODE_IS_INCLUDE) || (GroupType == BLOCK_OLD_SOURCES))
-					{
-						MulticastFilterTableDeleteEntry(pAd, GroupMacAddr, pSrcMacAddr, pDev);
-						break;
-					}
-
-					if((GroupType == CHANGE_TO_INCLUDE_MODE))
-					{
-						if(numOfSources == 0)
-							MulticastFilterTableDeleteEntry(pAd, GroupMacAddr, pSrcMacAddr, pDev);
-						else
-							MulticastFilterTableInsertEntry(pAd, GroupMacAddr, pSrcMacAddr, pDev, MCAT_FILTER_DYNAMIC);
-						break;
-					}
-				} while(FALSE);
-				pGroup += (8 + (numOfSources * 4) + AuxDataLen);
-			}
-			break;
-
-		default:
-			DBGPRINT(RT_DEBUG_TRACE, ("unknow IGMP Type=%d\n", IgmpVerType));
-			break;
-		}
-	}
-
-	return;
-}
-
-
-static BOOLEAN isIgmpMacAddr(
-	IN PUCHAR pMacAddr)
-{
-	if((pMacAddr[0] == 0x01)
-		&& (pMacAddr[1] == 0x00)
-		&& (pMacAddr[2] == 0x5e))
-		return TRUE;
-	return FALSE;
-}
-
-BOOLEAN isIgmpPkt(
-	IN PUCHAR pDstMacAddr,
-	IN PUCHAR pIpHeader)
-{
-	UINT16 IpProtocol = ntohs(*((UINT16 *)(pIpHeader)));
-	UCHAR IgmpProtocol;
-
-	if(!isIgmpMacAddr(pDstMacAddr))
-		return FALSE;
-
-	if(IpProtocol == ETH_P_IP)
-	{
-		IgmpProtocol = (UCHAR)*(pIpHeader + 11);
-		if(IgmpProtocol == IGMP_PROTOCOL_DESCRIPTOR)
-				return TRUE;
-	}
-
-	return FALSE;
-}
-
-static VOID InsertIgmpMember(
-	IN PMULTICAST_FILTER_TABLE pMulticastFilterTable,
-	IN PLIST_HEADER pList,
-	IN PUCHAR pMemberAddr)
-{
-	PMEMBER_ENTRY pMemberEntry;
-
-	if(pList == NULL)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("%s: membert list doesn't exist.\n", __FUNCTION__));
-		return;
-	}
-
-	if (pMemberAddr == NULL)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("%s: invalid member.\n", __FUNCTION__));
-		return;
-	}
-
-	if((pMemberEntry = (PMEMBER_ENTRY)AllocaGrpMemberEntry(pMulticastFilterTable)) != NULL)
-	{
-		NdisZeroMemory(pMemberEntry, sizeof(MEMBER_ENTRY));
-		COPY_MAC_ADDR(pMemberEntry->Addr, pMemberAddr);
-		insertTailList(pList, (PLIST_ENTRY)pMemberEntry);
-
-		DBGPRINT(RT_DEBUG_TRACE, ("%s Member Mac=%02x:%02x:%02x:%02x:%02x:%02x\n", __FUNCTION__,
-			pMemberEntry->Addr[0], pMemberEntry->Addr[1], pMemberEntry->Addr[2],
-			pMemberEntry->Addr[3], pMemberEntry->Addr[4], pMemberEntry->Addr[5]));
-	}
-	return;
-}
-
-static VOID DeleteIgmpMember(
-	IN PMULTICAST_FILTER_TABLE pMulticastFilterTable,
-	IN PLIST_HEADER pList,
-	IN PUCHAR pMemberAddr)
-{
-	PMEMBER_ENTRY pCurEntry;
-
-	if((pList == NULL) || (pList->pHead == NULL))
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("%s: membert list doesn't exist.\n", __FUNCTION__));
-		return;
-	}
-
-	if (pMemberAddr == NULL)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("%s: invalid member.\n", __FUNCTION__));
-		return;
-	}
-
-	pCurEntry = (PMEMBER_ENTRY)pList->pHead;
-	while (pCurEntry)
-	{
-		if(MAC_ADDR_EQUAL(pMemberAddr, pCurEntry->Addr))
-		{
-			delEntryList(pList, (PLIST_ENTRY)pCurEntry);
-			FreeGrpMemberEntry(pMulticastFilterTable, pCurEntry);
-			break;
-		}
-		pCurEntry = pCurEntry->pNext;
-	}
-
-	return;
-}
-
-static VOID DeleteIgmpMemberList(
-	IN PMULTICAST_FILTER_TABLE pMulticastFilterTable,
-	IN PLIST_HEADER pList)
-{
-	PMEMBER_ENTRY pCurEntry, pPrvEntry;
-
-	if((pList == NULL) || (pList->pHead == NULL))
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("%s: membert list doesn't exist.\n", __FUNCTION__));
-		return;
-	}
-
-	pPrvEntry = pCurEntry = (PMEMBER_ENTRY)pList->pHead;
-	while (pCurEntry)
-	{
-		delEntryList(pList, (PLIST_ENTRY)pCurEntry);
-		pPrvEntry = pCurEntry;
-		pCurEntry = pCurEntry->pNext;
-		FreeGrpMemberEntry(pMulticastFilterTable, pPrvEntry);
-	}
-
-	initList(pList);
-	return;
-}
-
-
-UCHAR IgmpMemberCnt(
-	IN PLIST_HEADER pList)
-{
-	if(pList == NULL)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("%s: membert list doesn't exist.\n", __FUNCTION__));
-		return 0;
-	}
-
-	return getListSize(pList);
-}
-
-VOID IgmpGroupDelMembers(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR pMemberAddr,
-	IN PNET_DEV pDev)
-{
-	INT i;
-	MULTICAST_FILTER_TABLE_ENTRY *pEntry = NULL;
-	PMULTICAST_FILTER_TABLE pMulticastFilterTable = pAd->pMulticastFilterTable;
-
-	for (i = 0; i < MAX_LEN_OF_MULTICAST_FILTER_TABLE; i++)
-	{
-		// pick up the first available vacancy
-		pEntry = &pMulticastFilterTable->Content[i];
-		if (pEntry->Valid == TRUE)
-		{
-			if(pMemberAddr != NULL)
-			{
-				RTMP_SEM_LOCK(&pMulticastFilterTable->MulticastFilterTabLock);
-				DeleteIgmpMember(pMulticastFilterTable, &pEntry->MemberList, pMemberAddr);
-				RTMP_SEM_UNLOCK(&pMulticastFilterTable->MulticastFilterTabLock);
-			}
-
-			if((pEntry->type == MCAT_FILTER_DYNAMIC)
-				&& (IgmpMemberCnt(&pEntry->MemberList) == 0))
-				MulticastFilterTableDeleteEntry(pAd, pEntry->Addr, pMemberAddr, pDev);
-		}
-	}
-}
-
-INT Set_IgmpSn_Enable_Proc(
-	IN PRTMP_ADAPTER pAd,
-	IN PSTRING arg)
-{
-	UINT Enable;
-	POS_COOKIE pObj;
-	UCHAR ifIndex;
-	PNET_DEV pDev;
-
-	pObj = (POS_COOKIE) pAd->OS_Cookie;
-	ifIndex = pObj->ioctl_if;
-
-	pDev = (ifIndex == MAIN_MBSSID) ? (pAd->net_dev) : (pAd->ApCfg.MBSSID[ifIndex].MSSIDDev);
-	Enable = (UINT) simple_strtol(arg, 0, 10);
-
-	pAd->ApCfg.MBSSID[ifIndex].IgmpSnoopEnable = (BOOLEAN)(Enable == 0 ? 0 : 1);
-	DBGPRINT(RT_DEBUG_TRACE, ("%s::(%s) %s\n", __FUNCTION__, RTMP_OS_NETDEV_GET_DEVNAME(pDev), Enable == TRUE ? "Enable IGMP Snooping":"Disable IGMP Snooping"));
-
-	return TRUE;
-}
-
-INT Set_IgmpSn_AddEntry_Proc(
-	IN PRTMP_ADAPTER pAd,
-	IN PSTRING arg)
-{
-	INT i;
-	BOOLEAN bGroupId = 1;
-	PSTRING value;
-	PSTRING thisChar;
-	UCHAR IpAddr[4];
-	UCHAR Addr[ETH_LENGTH_OF_ADDRESS];
-	UCHAR GroupId[ETH_LENGTH_OF_ADDRESS];
-	PUCHAR *pAddr = (PUCHAR *)&Addr;
-	PNET_DEV pDev;
-	POS_COOKIE pObj;
-	UCHAR ifIndex;
-
-	pObj = (POS_COOKIE) pAd->OS_Cookie;
-	ifIndex = pObj->ioctl_if;
-
-	pDev = (ifIndex == MAIN_MBSSID) ? (pAd->net_dev) : (pAd->ApCfg.MBSSID[ifIndex].MSSIDDev);
-
-	while ((thisChar = strsep((char **)&arg, "-")) != NULL)
-	{
-		// refuse the Member if it's not a MAC address.
-		if((bGroupId == 0) && (strlen(thisChar) != 17))
-			continue;
-
-		if(strlen(thisChar) == 17)  //Mac address acceptable format 01:02:03:04:05:06 length 17
-		{
-			for (i=0, value = rstrtok(thisChar,":"); value; value = rstrtok(NULL,":"))
-			{
-				if((strlen(value) != 2) || (!isxdigit(*value)) || (!isxdigit(*(value+1))) )
-					return FALSE;  //Invalid
-
-				AtoH(value, &Addr[i++], 1);
-			}
-
-			if(i != 6)
-				return FALSE;  //Invalid
-		}
-		else
-		{
-			for (i=0, value = rstrtok(thisChar,"."); value; value = rstrtok(NULL,"."))
-			{
-				if((strlen(value) > 0) && (strlen(value) <= 3))
-				{
-					int ii;
-					for(ii=0; ii<strlen(value); ii++)
-						if (!isxdigit(*(value + ii)))
-							return FALSE;
-				}
-				else
-					return FALSE;  //Invalid
-
-				IpAddr[i] = (UCHAR)simple_strtol(value, NULL, 10);
-				i++;
-			}
-
-			if(i != 4)
-				return FALSE;  //Invalid
-
-			ConvertMulticastIP2MAC(IpAddr, (PUCHAR *)&pAddr, ETH_P_IP);
-		}
-
-		if(bGroupId == 1)
-			COPY_MAC_ADDR(GroupId, Addr);
-
-		// Group-Id must be a MCAST address.
-		if((bGroupId == 1) && IS_MULTICAST_MAC_ADDR(Addr))
-			MulticastFilterTableInsertEntry(pAd, GroupId, NULL, pDev, MCAT_FILTER_STATIC);
-		// Group-Member must be a UCAST address.
-		else if ((bGroupId == 0) && !IS_MULTICAST_MAC_ADDR(Addr))
-			MulticastFilterTableInsertEntry(pAd, GroupId, Addr, pDev, MCAT_FILTER_STATIC);
-		else
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("%s (%2X:%2X:%2X:%2X:%2X:%2X) is not a acceptable address.\n",
-				__FUNCTION__, Addr[0], Addr[1], Addr[2], Addr[3], Addr[4], Addr[5]));
-			return FALSE;
-		}
-
-		bGroupId = 0;
-		DBGPRINT(RT_DEBUG_TRACE, ("%s (%2X:%2X:%2X:%2X:%2X:%2X)\n",
-			__FUNCTION__, Addr[0], Addr[1], Addr[2], Addr[3], Addr[4], Addr[5]));
-
-	}
-
-	return TRUE;
-}
-
-INT Set_IgmpSn_DelEntry_Proc(
-	IN PRTMP_ADAPTER pAd,
-	IN PSTRING arg)
-{
-	INT i, memberCnt = 0;
-	BOOLEAN bGroupId = 1;
-	PSTRING value;
-	PSTRING thisChar;
-	UCHAR IpAddr[4];
-	UCHAR Addr[ETH_LENGTH_OF_ADDRESS];
-	UCHAR GroupId[ETH_LENGTH_OF_ADDRESS];
-	PUCHAR *pAddr = (PUCHAR *)&Addr;
-	PNET_DEV pDev;
-	POS_COOKIE pObj;
-	UCHAR ifIndex;
-
-	pObj = (POS_COOKIE) pAd->OS_Cookie;
-	ifIndex = pObj->ioctl_if;
-
-	pDev = (ifIndex == MAIN_MBSSID) ? (pAd->net_dev) : (pAd->ApCfg.MBSSID[ifIndex].MSSIDDev);
-
-	while ((thisChar = strsep((char **)&arg, "-")) != NULL)
-	{
-		// refuse the Member if it's not a MAC address.
-		if((bGroupId == 0) && (strlen(thisChar) != 17))
-			continue;
-
-		if(strlen(thisChar) == 17)  //Mac address acceptable format 01:02:03:04:05:06 length 17
-		{
-			for (i=0, value = rstrtok(thisChar,":"); value; value = rstrtok(NULL,":"))
-			{
-				if((strlen(value) != 2) || (!isxdigit(*value)) || (!isxdigit(*(value+1))) )
-					return FALSE;  //Invalid
-
-				AtoH(value, &Addr[i++], 1);
-			}
-
-			if(i != 6)
-				return FALSE;  //Invalid
-		}
-		else
-		{
-			for (i=0, value = rstrtok(thisChar,"."); value; value = rstrtok(NULL,"."))
-			{
-				if((strlen(value) > 0) && (strlen(value) <= 3))
-				{
-					int ii;
-					for(ii=0; ii<strlen(value); ii++)
-						if (!isxdigit(*(value + ii)))
-							return FALSE;
-				}
-				else
-					return FALSE;  //Invalid
-
-				IpAddr[i] = (UCHAR)simple_strtol(value, NULL, 10);
-				i++;
-			}
-
-			if(i != 4)
-				return FALSE;  //Invalid
-
-			ConvertMulticastIP2MAC(IpAddr, (PUCHAR *)&pAddr, ETH_P_IP);
-		}
-
-		if(bGroupId == 1)
-			COPY_MAC_ADDR(GroupId, Addr);
-		else
-			memberCnt++;
-
-		if (memberCnt > 0 )
-			MulticastFilterTableDeleteEntry(pAd, (PUCHAR)GroupId, Addr, pDev);
-
-		bGroupId = 0;
-	}
-
-	if(memberCnt == 0)
-		MulticastFilterTableDeleteEntry(pAd, (PUCHAR)GroupId, NULL, pDev);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("%s (%2X:%2X:%2X:%2X:%2X:%2X)\n",
-		__FUNCTION__, Addr[0], Addr[1], Addr[2], Addr[3], Addr[4], Addr[5]));
-
-	return TRUE;
-}
-
-INT Set_IgmpSn_TabDisplay_Proc(
-	IN PRTMP_ADAPTER pAd,
-	IN PSTRING arg)
-{
-	IGMPTableDisplay(pAd);
-	return TRUE;
-}
-
-void rtmp_read_igmp_snoop_from_file(
-	IN  PRTMP_ADAPTER pAd,
-	PSTRING tmpbuf,
-	PSTRING buffer)
-{
-	PSTRING		macptr;
-	INT			i=0;
-
-	//IgmpSnEnable
-	if(RTMPGetKeyParameter("IgmpSnEnable", tmpbuf, 128, buffer, TRUE))
-	{
-		for (i = 0, macptr = rstrtok(tmpbuf,";"); (macptr && i < pAd->ApCfg.BssidNum); macptr = rstrtok(NULL,";"), i++)
-		{
-			if ((strncmp(macptr, "0", 1) == 0))
-				pAd->ApCfg.MBSSID[i].IgmpSnoopEnable = FALSE;
-			else if ((strncmp(macptr, "1", 1) == 0))
-				pAd->ApCfg.MBSSID[i].IgmpSnoopEnable = TRUE;
-	        else
-				pAd->ApCfg.MBSSID[i].IgmpSnoopEnable = FALSE;
-
-			DBGPRINT(RT_DEBUG_TRACE, ("MBSSID[%d].Enable=%d\n", i, pAd->ApCfg.MBSSID[i].IgmpSnoopEnable));
-	    }
-	}
-}
-
-NDIS_STATUS IgmpPktInfoQuery(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR pSrcBufVA,
-	IN PNDIS_PACKET pPacket,
-	IN UCHAR apidx,
-	OUT BOOLEAN *pInIgmpGroup,
-	OUT PMULTICAST_FILTER_TABLE_ENTRY *ppGroupEntry)
-{
-	if(IS_MULTICAST_MAC_ADDR(pSrcBufVA))
-	{
-		BOOLEAN IgmpMldPkt = FALSE;
-		PUCHAR pIpHeader = pSrcBufVA + 12;
-
-		if(ntohs(*((UINT16 *)(pIpHeader))) == ETH_P_IPV6)
-			IgmpMldPkt = isMldPkt(pSrcBufVA, pIpHeader, NULL, NULL);
-		else
-			IgmpMldPkt = isIgmpPkt(pSrcBufVA, pIpHeader);
-
-		if (IgmpMldPkt)
-		{
-			*ppGroupEntry = NULL;
-		}
-		else if ((*ppGroupEntry = MulticastFilterTableLookup(pAd->pMulticastFilterTable, pSrcBufVA,
-									pAd->ApCfg.MBSSID[apidx].MSSIDDev)) == NULL)
-		{
-			RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_FAILURE);
-			return NDIS_STATUS_FAILURE;
-		}
-		*pInIgmpGroup = TRUE;
-	}
-	else if (IS_BROADCAST_MAC_ADDR(pSrcBufVA))
-	{
-		PUCHAR pDstIpAddr = pSrcBufVA + 30; // point to Destination of Ip address of IP header.
-		UCHAR GroupMacAddr[6];
-		PUCHAR pGroupMacAddr = (PUCHAR)&GroupMacAddr;
-
-		ConvertMulticastIP2MAC(pDstIpAddr, (PUCHAR *)&pGroupMacAddr, ETH_P_IP);
-		if ((*ppGroupEntry = MulticastFilterTableLookup(pAd->pMulticastFilterTable, pGroupMacAddr,
-								pAd->ApCfg.MBSSID[apidx].MSSIDDev)) != NULL)
-		{
-			*pInIgmpGroup = TRUE;
-		}
-	}
-	return NDIS_STATUS_SUCCESS;
-}
-
-NDIS_STATUS IgmpPktClone(
-	IN PRTMP_ADAPTER pAd,
-	IN PNDIS_PACKET pPacket,
-	IN UCHAR QueIdx,
-	IN PMULTICAST_FILTER_TABLE_ENTRY pGroupEntry)
-{
-	PNDIS_PACKET pSkbClone = NULL;
-	PMEMBER_ENTRY pMemberEntry = (PMEMBER_ENTRY)pGroupEntry->MemberList.pHead;
-	MAC_TABLE_ENTRY *pMacEntry = NULL;
-	USHORT Aid;
-	SST	Sst = SST_ASSOC;
-	UCHAR PsMode = PWR_ACTIVE;
-	UCHAR Rate;
-	unsigned long IrqFlags;
-
-	// check all members of the IGMP group.
-	while(pMemberEntry != NULL)
-	{
-		pMacEntry = APSsPsInquiry(pAd, pMemberEntry->Addr, &Sst, &Aid, &PsMode, &Rate);
-
-		if (pMacEntry && (Sst == SST_ASSOC) && (PsMode != PWR_SAVE))
-		{
-		pSkbClone = skb_clone(RTPKT_TO_OSPKT(pPacket), MEM_ALLOC_FLAG);
-		if(pSkbClone)
-		{
-				RTMP_SET_PACKET_WCID(pSkbClone, (UCHAR)Aid);
-				// Pkt type must set to PKTSRC_NDIS.
-				// It cause of the deason that APHardTransmit()
-				// doesn't handle PKTSRC_DRIVER pkt type in version 1.3.0.0.
-				RTMP_SET_PACKET_SOURCE(pSkbClone, PKTSRC_NDIS);
-			}
-			else
-			{
-				pMemberEntry = pMemberEntry->pNext;
-				continue;
-			}
-
-			// insert the pkt to TxSwQueue.
-			if (pAd->TxSwQueue[QueIdx].Number >= MAX_PACKETS_IN_QUEUE)
-			{
-#ifdef BLOCK_NET_IF
-				StopNetIfQueue(pAd, QueIdx, pSkbClone);
-#endif // BLOCK_NET_IF //
-				RELEASE_NDIS_PACKET(pAd, pSkbClone, NDIS_STATUS_FAILURE);
-				return NDIS_STATUS_FAILURE;
-			}
-			else
-			{
-				RTMP_IRQ_LOCK(&pAd->irq_lock, IrqFlags);
-				InsertTailQueueAc(pAd, pMacEntry, &pAd->TxSwQueue[QueIdx], PACKET_TO_QUEUE_ENTRY(pSkbClone));
-				RTMP_IRQ_UNLOCK(&pAd->irq_lock, IrqFlags);
-			}
-		}
-		pMemberEntry = pMemberEntry->pNext;
-	}
-	return NDIS_STATUS_SUCCESS;
-}
-
-static inline BOOLEAN isMldMacAddr(
-	IN PUCHAR pMacAddr)
-{
-	return ((pMacAddr[0] == 0x33) && (pMacAddr[1] == 0x33)) ? TRUE : FALSE;
-}
-
-static inline BOOLEAN IsSupportedMldMsg(
-	IN UINT8 MsgType)
-{
-	BOOLEAN result = FALSE;
-	switch(MsgType)
-	{
-		case MLD_V1_LISTENER_REPORT:
-		case MLD_V1_LISTENER_DONE:
-		case MLD_V2_LISTERNER_REPORT:
-			result = TRUE;
-			break;
-		default:
-			result = FALSE;
-			break;
-	}
-
-	return result;
-}
-
-BOOLEAN isMldPkt(
-	IN PUCHAR pDstMacAddr,
-	IN PUCHAR pIpHeader,
-	OUT UINT8 *pProtoType,
-	OUT PUCHAR *pMldHeader)
-{
-	BOOLEAN result = FALSE;
-	UINT16 IpProtocol = ntohs(*((UINT16 *)(pIpHeader)));
-
-	if(!isMldMacAddr(pDstMacAddr))
-		return FALSE;
-
-	if(IpProtocol != ETH_P_IPV6)
-		return FALSE;
-
-	// skip protocol (2 Bytes).
-	pIpHeader += 2;
-	do
-	{
-		PRT_IPV6_HDR pIpv6Hdr = (PRT_IPV6_HDR)(pIpHeader);
-		UINT8 nextProtocol = pIpv6Hdr->nextHdr;
-		UINT32 offset = IPV6_HDR_LEN;
-
-		while(nextProtocol != IPV6_NEXT_HEADER_ICMPV6)
-		{
-			if(IPv6ExtHdrHandle((RT_IPV6_EXT_HDR *)(pIpHeader + offset), &nextProtocol, &offset) == FALSE)
-				break;
-		}
-
-		if(nextProtocol == IPV6_NEXT_HEADER_ICMPV6)
-		{
-			PRT_ICMPV6_HDR pICMPv6Hdr = (PRT_ICMPV6_HDR)(pIpHeader + offset);
-			if (IsSupportedMldMsg(pICMPv6Hdr->type) == TRUE)
-			{
-				if (pProtoType != NULL)
-					*pProtoType = pICMPv6Hdr->type;
-				if (pMldHeader != NULL)
-					*pMldHeader = (PUCHAR)pICMPv6Hdr;
-				result = TRUE;
-			}
-		}
-	}while(FALSE);
-
-	return result;
-}
-
-/*  MLD v1 messages have the following format:
-	0                   1                   2                   3
-	0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-	+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-	|     Type      |     Code      |          Checksum             |
-	+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-	|     Maximum Response Delay    |          Reserved             |
-	+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-	|                                                               |
-	+                                                               +
-	|                                                               |
-	+                       Multicast Address                       +
-	|                                                               |
-	+                                                               +
-	|                                                               |
-	+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-*/
-
-/*	Version 3 Membership Report Message
-	0                   1                   2                   3
-	0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-	+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-	|  Type = 143   |    Reserved   |           Checksum            |
-	+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-	|           Reserved            |  Number of Group Records (M)  |
-	+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-	|                                                               |
-	.                                                               .
-	.               Multicast Address Record [1]                    .
-	.                                                               .
-	|                                                               |
-	+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-	|                                                               |
-	.                                                               .
-	.               Multicast Address Record [2]                    .
-	.                                                               .
-	|                                                               |
-	+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-	|                               .                               |
-	.                               .                               .
-	|                               .                               |
-	+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-	|                                                               |
-	.                                                               .
-	.               Multicast Address Record [M]                    .
-	.                                                               .
-	|                                                               |
-	+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-
-
-	where each Group Record has the following internal format:
-	+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-	|  Record Type  |  Aux Data Len |     Number of Sources (N)     |
-	+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-    |                                                               |
-    *                                                               *
-    |                                                               |
-    *                       Multicast Address                       *
-    |                                                               |
-    *                                                               *
-    |                                                               |
-	+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-    |                                                               |
-    *                                                               *
-    |                                                               |
-    *                       Source Address [1]                      *
-    |                                                               |
-    *                                                               *
-    |                                                               |
-    +-                                                             -+
-    |                                                               |
-    *                                                               *
-    |                                                               |
-    *                       Source Address [2]                      *
-    |                                                               |
-    *                                                               *
-    |                                                               |
-    +-                                                             -+
-    .                               .                               .
-    .                               .                               .
-    .                               .                               .
-    +-                                                             -+
-    |                                                               |
-    *                                                               *
-    |                                                               |
-    *                       Source Address [N]                      *
-    |                                                               |
-    *                                                               *
-    |                                                               |
-    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-    |                                                               |
-    .                                                               .
-    .                         Auxiliary Data                        .
-    .                                                               .
-    |                                                               |
-    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-*/
-
-VOID MLDSnooping(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR pDstMacAddr,
-	IN PUCHAR pSrcMacAddr,
-	IN PUCHAR pIpHeader,
-	IN PNET_DEV pDev)
-{
-	INT i;
-	UCHAR GroupType;
-	UINT16 numOfGroup;
-	PUCHAR pGroup;
-	UCHAR AuxDataLen;
-	UINT16 numOfSources;
-	PUCHAR pGroupIpAddr;
-	UCHAR GroupMacAddr[6];
-	PUCHAR pGroupMacAddr = (PUCHAR)&GroupMacAddr;
-
-	UINT8 MldType;
-	PUCHAR pMldHeader;
-
-	if(isMldPkt(pDstMacAddr, pIpHeader, &MldType, &pMldHeader) == TRUE)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("MLD type=%0x\n", MldType));
-
-		switch(MldType)
-		{
-			case MLD_V1_LISTENER_REPORT:
-				// skip Type(1 Byte), code(1 Byte), checksum(2 Bytes), Maximum Rsp Delay(2 Bytes), Reserve(2 Bytes).
-				pGroupIpAddr = (PUCHAR)(pMldHeader + 8);
-				ConvertMulticastIP2MAC(pGroupIpAddr, (PUCHAR *)&pGroupMacAddr, ETH_P_IPV6);
-				DBGPRINT(RT_DEBUG_TRACE, ("Group Id=%02x:%02x:%02x:%02x:%02x:%02x\n",
-						GroupMacAddr[0], GroupMacAddr[1], GroupMacAddr[2], GroupMacAddr[3], GroupMacAddr[4], GroupMacAddr[5]));
-				MulticastFilterTableInsertEntry(pAd, GroupMacAddr, pSrcMacAddr, pDev, MCAT_FILTER_DYNAMIC);
-				break;
-
-			case MLD_V1_LISTENER_DONE:
-				// skip Type(1 Byte), code(1 Byte), checksum(2 Bytes), Maximum Rsp Delay(2 Bytes), Reserve(2 Bytes).
-				pGroupIpAddr = (PUCHAR)(pMldHeader + 8);
-				ConvertMulticastIP2MAC(pGroupIpAddr, (PUCHAR *)&pGroupMacAddr, ETH_P_IPV6);
-				DBGPRINT(RT_DEBUG_TRACE, ("Group Id=%02x:%02x:%02x:%02x:%02x:%02x\n",
-						GroupMacAddr[0], GroupMacAddr[1], GroupMacAddr[2], GroupMacAddr[3], GroupMacAddr[4], GroupMacAddr[5]));
-				MulticastFilterTableDeleteEntry(pAd, GroupMacAddr, pSrcMacAddr, pDev);
-				break;
-
-			case MLD_V2_LISTERNER_REPORT: // IGMP version 3 membership report.
-				numOfGroup = ntohs(*((UINT16 *)(pMldHeader + 6)));
-				pGroup = (PUCHAR)(pMldHeader + 8);
-				for (i=0; i < numOfGroup; i++)
-				{
-					GroupType = (UCHAR)(*pGroup);
-					AuxDataLen = (UCHAR)(*(pGroup + 1));
-					numOfSources = ntohs(*((UINT16 *)(pGroup + 2)));
-					pGroupIpAddr = (PUCHAR)(pGroup + 4);
-					DBGPRINT(RT_DEBUG_TRACE, ("MLDv2 Type=%d, ADL=%d, numOfSource=%d\n", GroupType, AuxDataLen, numOfSources));
-					ConvertMulticastIP2MAC(pGroupIpAddr, (PUCHAR *)&pGroupMacAddr, ETH_P_IPV6);
-					DBGPRINT(RT_DEBUG_TRACE, ("MLD Group=%02x:%02x:%02x:%02x:%02x:%02x\n",
-							GroupMacAddr[0], GroupMacAddr[1], GroupMacAddr[2], GroupMacAddr[3], GroupMacAddr[4], GroupMacAddr[5]));
-
-					do
-					{
-						if((GroupType == MODE_IS_EXCLUDE) || (GroupType == CHANGE_TO_EXCLUDE_MODE) || (GroupType == ALLOW_NEW_SOURCES))
-						{
-							MulticastFilterTableInsertEntry(pAd, GroupMacAddr, pSrcMacAddr, pDev, MCAT_FILTER_DYNAMIC);
-							break;
-						}
-
-						if((GroupType == MODE_IS_INCLUDE) || (GroupType == BLOCK_OLD_SOURCES))
-						{
-							MulticastFilterTableDeleteEntry(pAd, GroupMacAddr, pSrcMacAddr, pDev);
-							break;
-						}
-
-						if((GroupType == CHANGE_TO_INCLUDE_MODE))
-						{
-							if(numOfSources == 0)
-								MulticastFilterTableDeleteEntry(pAd, GroupMacAddr, pSrcMacAddr, pDev);
-							else
-								MulticastFilterTableInsertEntry(pAd, GroupMacAddr, pSrcMacAddr, pDev, MCAT_FILTER_DYNAMIC);
-							break;
-						}
-					} while(FALSE);
-					// skip 4 Bytes (Record Type, Aux Data Len, Number of Sources) + a IPv6 address.
-					pGroup += (4 + IPV6_ADDR_LEN + (numOfSources * 16) + AuxDataLen);
-				}
-				break;
-
-			default:
-				DBGPRINT(RT_DEBUG_TRACE, ("unknow MLD Type=%d\n", MldType));
-				break;
-		}
-	}
-
-	return;
-}
-
-
-#endif // IGMP_SNOOP_SUPPORT //
diff --git a/drivers/staging/rt3090/common/mlme.c b/drivers/staging/rt3090/common/mlme.c
deleted file mode 100644
index 1613c04c5932..000000000000
--- a/drivers/staging/rt3090/common/mlme.c
+++ /dev/null
@@ -1,6550 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-	Module Name:
-	mlme.c
-
-	Abstract:
-
-	Revision History:
-	Who			When			What
-	--------	----------		----------------------------------------------
-	John Chang	2004-08-25		Modify from RT2500 code base
-	John Chang	2004-09-06		modified for RT2600
-*/
-
-#include "../rt_config.h"
-#include <stdarg.h>
-
-UCHAR	CISCO_OUI[] = {0x00, 0x40, 0x96};
-
-UCHAR	WPA_OUI[] = {0x00, 0x50, 0xf2, 0x01};
-UCHAR	RSN_OUI[] = {0x00, 0x0f, 0xac};
-UCHAR	WAPI_OUI[] = {0x00, 0x14, 0x72};
-UCHAR   WME_INFO_ELEM[]  = {0x00, 0x50, 0xf2, 0x02, 0x00, 0x01};
-UCHAR   WME_PARM_ELEM[] = {0x00, 0x50, 0xf2, 0x02, 0x01, 0x01};
-UCHAR	Ccx2QosInfo[] = {0x00, 0x40, 0x96, 0x04};
-UCHAR   RALINK_OUI[]  = {0x00, 0x0c, 0x43};
-UCHAR   BROADCOM_OUI[]  = {0x00, 0x90, 0x4c};
-UCHAR   WPS_OUI[] = {0x00, 0x50, 0xf2, 0x04};
-#ifdef CONFIG_STA_SUPPORT
-#ifdef DOT11_N_SUPPORT
-UCHAR	PRE_N_HT_OUI[]	= {0x00, 0x90, 0x4c};
-#endif // DOT11_N_SUPPORT //
-#endif // CONFIG_STA_SUPPORT //
-
-UCHAR RateSwitchTable[] = {
-// Item No.   Mode   Curr-MCS   TrainUp   TrainDown		// Mode- Bit0: STBC, Bit1: Short GI, Bit4,5: Mode(0:CCK, 1:OFDM, 2:HT Mix, 3:HT GF)
-    0x11, 0x00,  0,  0,  0,						// Initial used item after association
-    0x00, 0x00,  0, 40, 101,
-    0x01, 0x00,  1, 40, 50,
-    0x02, 0x00,  2, 35, 45,
-    0x03, 0x00,  3, 20, 45,
-    0x04, 0x21,  0, 30, 50,
-    0x05, 0x21,  1, 20, 50,
-    0x06, 0x21,  2, 20, 50,
-    0x07, 0x21,  3, 15, 50,
-    0x08, 0x21,  4, 15, 30,
-    0x09, 0x21,  5, 10, 25,
-    0x0a, 0x21,  6,  8, 25,
-    0x0b, 0x21,  7,  8, 25,
-    0x0c, 0x20, 12,  15, 30,
-    0x0d, 0x20, 13,  8, 20,
-    0x0e, 0x20, 14,  8, 20,
-    0x0f, 0x20, 15,  8, 25,
-    0x10, 0x22, 15,  8, 25,
-    0x11, 0x00,  0,  0,  0,
-    0x12, 0x00,  0,  0,  0,
-    0x13, 0x00,  0,  0,  0,
-    0x14, 0x00,  0,  0,  0,
-    0x15, 0x00,  0,  0,  0,
-    0x16, 0x00,  0,  0,  0,
-    0x17, 0x00,  0,  0,  0,
-    0x18, 0x00,  0,  0,  0,
-    0x19, 0x00,  0,  0,  0,
-    0x1a, 0x00,  0,  0,  0,
-    0x1b, 0x00,  0,  0,  0,
-    0x1c, 0x00,  0,  0,  0,
-    0x1d, 0x00,  0,  0,  0,
-    0x1e, 0x00,  0,  0,  0,
-    0x1f, 0x00,  0,  0,  0,
-};
-
-UCHAR RateSwitchTable11B[] = {
-// Item No.   Mode   Curr-MCS   TrainUp   TrainDown		// Mode- Bit0: STBC, Bit1: Short GI, Bit4,5: Mode(0:CCK, 1:OFDM, 2:HT Mix, 3:HT GF)
-    0x04, 0x03,  0,  0,  0,						// Initial used item after association
-    0x00, 0x00,  0, 40, 101,
-    0x01, 0x00,  1, 40, 50,
-    0x02, 0x00,  2, 35, 45,
-    0x03, 0x00,  3, 20, 45,
-};
-
-UCHAR RateSwitchTable11BG[] = {
-// Item No.   Mode   Curr-MCS   TrainUp   TrainDown		// Mode- Bit0: STBC, Bit1: Short GI, Bit4,5: Mode(0:CCK, 1:OFDM, 2:HT Mix, 3:HT GF)
-    0x0a, 0x00,  0,  0,  0,						// Initial used item after association
-    0x00, 0x00,  0, 40, 101,
-    0x01, 0x00,  1, 40, 50,
-    0x02, 0x00,  2, 35, 45,
-    0x03, 0x00,  3, 20, 45,
-    0x04, 0x10,  2, 20, 35,
-    0x05, 0x10,  3, 16, 35,
-    0x06, 0x10,  4, 10, 25,
-    0x07, 0x10,  5, 16, 25,
-    0x08, 0x10,  6, 10, 25,
-    0x09, 0x10,  7, 10, 13,
-};
-
-UCHAR RateSwitchTable11G[] = {
-// Item No.   Mode   Curr-MCS   TrainUp   TrainDown		// Mode- Bit0: STBC, Bit1: Short GI, Bit4,5: Mode(0:CCK, 1:OFDM, 2:HT Mix, 3:HT GF)
-    0x08, 0x00,  0,  0,  0,						// Initial used item after association
-    0x00, 0x10,  0, 20, 101,
-    0x01, 0x10,  1, 20, 35,
-    0x02, 0x10,  2, 20, 35,
-    0x03, 0x10,  3, 16, 35,
-    0x04, 0x10,  4, 10, 25,
-    0x05, 0x10,  5, 16, 25,
-    0x06, 0x10,  6, 10, 25,
-    0x07, 0x10,  7, 10, 13,
-};
-
-#ifdef DOT11_N_SUPPORT
-UCHAR RateSwitchTable11N1S[] = {
-// Item No.   Mode   Curr-MCS   TrainUp   TrainDown		// Mode- Bit0: STBC, Bit1: Short GI, Bit4,5: Mode(0:CCK, 1:OFDM, 2:HT Mix, 3:HT GF)
-    0x0c, 0x0a,  0,  0,  0,						// Initial used item after association
-    0x00, 0x00,  0, 40, 101,
-    0x01, 0x00,  1, 40, 50,
-    0x02, 0x00,  2, 25, 45,
-    0x03, 0x21,  0, 20, 35,
-    0x04, 0x21,  1, 20, 35,
-    0x05, 0x21,  2, 20, 35,
-    0x06, 0x21,  3, 15, 35,
-    0x07, 0x21,  4, 15, 30,
-    0x08, 0x21,  5, 10, 25,
-    0x09, 0x21,  6,  8, 14,
-    0x0a, 0x21,  7,  8, 14,
-    0x0b, 0x23,  7,  8, 14,
-};
-
-UCHAR RateSwitchTable11N2S[] = {
-// Item No.   Mode   Curr-MCS   TrainUp   TrainDown		// Mode- Bit0: STBC, Bit1: Short GI, Bit4,5: Mode(0:CCK, 1:OFDM, 2:HT Mix, 3:HT GF)
-    0x0e, 0x0c,  0,  0,  0,						// Initial used item after association
-    0x00, 0x00,  0, 40, 101,
-    0x01, 0x00,  1, 40, 50,
-    0x02, 0x00,  2, 25, 45,
-    0x03, 0x21,  0, 20, 35,
-    0x04, 0x21,  1, 20, 35,
-    0x05, 0x21,  2, 20, 35,
-    0x06, 0x21,  3, 15, 35,
-    0x07, 0x21,  4, 15, 30,
-    0x08, 0x20, 11, 15, 30,
-    0x09, 0x20, 12, 15, 30,
-    0x0a, 0x20, 13,  8, 20,
-    0x0b, 0x20, 14,  8, 20,
-    0x0c, 0x20, 15,  8, 25,
-    0x0d, 0x22, 15,  8, 15,
-};
-
-UCHAR RateSwitchTable11N3S[] = {
-// Item No.	Mode	Curr-MCS	TrainUp	TrainDown	// Mode- Bit0: STBC, Bit1: Short GI, Bit4,5: Mode(0:CCK, 1:OFDM, 2:HT Mix, 3:HT GF)
-    0x0b, 0x00,  0,  0,  0,	// 0x0a, 0x00,  0,  0,  0,      // Initial used item after association
-    0x00, 0x21,  0, 30, 101,
-    0x01, 0x21,  1, 20, 50,
-    0x02, 0x21,  2, 20, 50,
-    0x03, 0x21,  3, 15, 50,
-    0x04, 0x21,  4, 15, 30,
-    0x05, 0x20, 11, 15, 30,	// Required by System-Alan @ 20080812
-    0x06, 0x20, 12, 15, 30,	// 0x05, 0x20, 12, 15, 30,
-    0x07, 0x20, 13,  8, 20,	// 0x06, 0x20, 13,  8, 20,
-    0x08, 0x20, 14,  8, 20,	// 0x07, 0x20, 14,  8, 20,
-    0x09, 0x20, 15,  8, 25,	// 0x08, 0x20, 15,  8, 25,
-    0x0a, 0x22, 15,  8, 25,	// 0x09, 0x22, 15,  8, 25,
-};
-
-UCHAR RateSwitchTable11N2SForABand[] = {
-// Item No.   Mode   Curr-MCS   TrainUp   TrainDown		// Mode- Bit0: STBC, Bit1: Short GI, Bit4,5: Mode(0:CCK, 1:OFDM, 2:HT Mix, 3:HT GF)
-    0x0b, 0x09,  0,  0,  0,						// Initial used item after association
-    0x00, 0x21,  0, 30, 101,
-    0x01, 0x21,  1, 20, 50,
-    0x02, 0x21,  2, 20, 50,
-    0x03, 0x21,  3, 15, 50,
-    0x04, 0x21,  4, 15, 30,
-    0x05, 0x21,  5, 15, 30,
-    0x06, 0x20, 12,  15, 30,
-    0x07, 0x20, 13,  8, 20,
-    0x08, 0x20, 14,  8, 20,
-    0x09, 0x20, 15,  8, 25,
-    0x0a, 0x22, 15,  8, 25,
-};
-
-UCHAR RateSwitchTable11N3SForABand[] = { // 3*3
-// Item No.   Mode   Curr-MCS   TrainUp   TrainDown		// Mode- Bit0: STBC, Bit1: Short GI, Bit4,5: Mode(0:CCK, 1:OFDM, 2:HT Mix, 3:HT GF)
-    0x0b, 0x09,  0,  0,  0,						// Initial used item after association
-    0x00, 0x21,  0, 30, 101,
-    0x01, 0x21,  1, 20, 50,
-    0x02, 0x21,  2, 20, 50,
-    0x03, 0x21,  3, 15, 50,
-    0x04, 0x21,  4, 15, 30,
-    0x05, 0x21,  5, 15, 30,
-    0x06, 0x20, 12,  15, 30,
-    0x07, 0x20, 13,  8, 20,
-    0x08, 0x20, 14,  8, 20,
-    0x09, 0x20, 15,  8, 25,
-    0x0a, 0x22, 15,  8, 25,
-};
-
-UCHAR RateSwitchTable11BGN1S[] = {
-// Item No.   Mode   Curr-MCS   TrainUp   TrainDown		// Mode- Bit0: STBC, Bit1: Short GI, Bit4,5: Mode(0:CCK, 1:OFDM, 2:HT Mix, 3:HT GF)
-    0x0c, 0x0a,  0,  0,  0,						// Initial used item after association
-    0x00, 0x00,  0, 40, 101,
-    0x01, 0x00,  1, 40, 50,
-    0x02, 0x00,  2, 25, 45,
-    0x03, 0x21,  0, 20, 35,
-    0x04, 0x21,  1, 20, 35,
-    0x05, 0x21,  2, 20, 35,
-    0x06, 0x21,  3, 15, 35,
-    0x07, 0x21,  4, 15, 30,
-    0x08, 0x21,  5, 10, 25,
-    0x09, 0x21,  6,  8, 14,
-    0x0a, 0x21,  7,  8, 14,
-    0x0b, 0x23,  7,  8, 14,
-};
-
-UCHAR RateSwitchTable11BGN2S[] = {
-// Item No.   Mode   Curr-MCS   TrainUp   TrainDown		// Mode- Bit0: STBC, Bit1: Short GI, Bit4,5: Mode(0:CCK, 1:OFDM, 2:HT Mix, 3:HT GF)
-    0x0e, 0x0c,  0,  0,  0,						// Initial used item after association
-    0x00, 0x00,  0, 40, 101,
-    0x01, 0x00,  1, 40, 50,
-    0x02, 0x00,  2, 25, 45,
-    0x03, 0x21,  0, 20, 35,
-    0x04, 0x21,  1, 20, 35,
-    0x05, 0x21,  2, 20, 35,
-    0x06, 0x21,  3, 15, 35,
-    0x07, 0x21,  4, 15, 30,
-    0x08, 0x20, 11, 15, 30,
-    0x09, 0x20, 12, 15, 30,
-    0x0a, 0x20, 13,  8, 20,
-    0x0b, 0x20, 14,  8, 20,
-    0x0c, 0x20, 15,  8, 25,
-    0x0d, 0x22, 15,  8, 15,
-};
-
-UCHAR RateSwitchTable11BGN3S[] = { // 3*3
-// Item No.   Mode   Curr-MCS   TrainUp   TrainDown		// Mode- Bit0: STBC, Bit1: Short GI, Bit4,5: Mode(0:CCK, 1:OFDM, 2:HT Mix, 3:HT GF)
-    0x0a, 0x00,  0,  0,  0,						// Initial used item after association
-    0x00, 0x21,  0, 30,101,	//50
-    0x01, 0x21,  1, 20, 50,
-    0x02, 0x21,  2, 20, 50,
-    0x03, 0x21,  3, 20, 50,
-    0x04, 0x21,  4, 15, 50,
-    0x05, 0x20, 20, 15, 30,
-    0x06, 0x20, 21,  8, 20,
-    0x07, 0x20, 22,  8, 20,
-    0x08, 0x20, 23,  8, 25,
-    0x09, 0x22, 23,  8, 25,
-};
-
-UCHAR RateSwitchTable11BGN2SForABand[] = {
-// Item No.   Mode   Curr-MCS   TrainUp   TrainDown		// Mode- Bit0: STBC, Bit1: Short GI, Bit4,5: Mode(0:CCK, 1:OFDM, 2:HT Mix, 3:HT GF)
-    0x0b, 0x09,  0,  0,  0,						// Initial used item after association
-    0x00, 0x21,  0, 30,101,	//50
-    0x01, 0x21,  1, 20, 50,
-    0x02, 0x21,  2, 20, 50,
-    0x03, 0x21,  3, 15, 50,
-    0x04, 0x21,  4, 15, 30,
-    0x05, 0x21,  5, 15, 30,
-    0x06, 0x20, 12, 15, 30,
-    0x07, 0x20, 13,  8, 20,
-    0x08, 0x20, 14,  8, 20,
-    0x09, 0x20, 15,  8, 25,
-    0x0a, 0x22, 15,  8, 25,
-};
-
-UCHAR RateSwitchTable11BGN3SForABand[] = { // 3*3
-// Item No.   Mode   Curr-MCS   TrainUp   TrainDown		// Mode- Bit0: STBC, Bit1: Short GI, Bit4,5: Mode(0:CCK, 1:OFDM, 2:HT Mix, 3:HT GF)
-    0x0c, 0x09,  0,  0,  0,						// Initial used item after association
-    0x00, 0x21,  0, 30,101,	//50
-    0x01, 0x21,  1, 20, 50,
-    0x02, 0x21,  2, 20, 50,
-    0x03, 0x21,  3, 15, 50,
-    0x04, 0x21,  4, 15, 30,
-    0x05, 0x21,  5, 15, 30,
-    0x06, 0x21, 12, 15, 30,
-    0x07, 0x20, 20, 15, 30,
-    0x08, 0x20, 21,  8, 20,
-    0x09, 0x20, 22,  8, 20,
-    0x0a, 0x20, 23,  8, 25,
-    0x0b, 0x22, 23,  8, 25,
-};
-#endif // DOT11_N_SUPPORT //
-
-
-extern UCHAR	 OfdmRateToRxwiMCS[];
-// since RT61 has better RX sensibility, we have to limit TX ACK rate not to exceed our normal data TX rate.
-// otherwise the WLAN peer may not be able to receive the ACK thus downgrade its data TX rate
-ULONG BasicRateMask[12]				= {0xfffff001 /* 1-Mbps */, 0xfffff003 /* 2 Mbps */, 0xfffff007 /* 5.5 */, 0xfffff00f /* 11 */,
-									  0xfffff01f /* 6 */	 , 0xfffff03f /* 9 */	  , 0xfffff07f /* 12 */ , 0xfffff0ff /* 18 */,
-									  0xfffff1ff /* 24 */	 , 0xfffff3ff /* 36 */	  , 0xfffff7ff /* 48 */ , 0xffffffff /* 54 */};
-
-UCHAR BROADCAST_ADDR[MAC_ADDR_LEN] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
-UCHAR ZERO_MAC_ADDR[MAC_ADDR_LEN]  = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
-
-// e.g. RssiSafeLevelForTxRate[RATE_36]" means if the current RSSI is greater than
-//		this value, then it's quaranteed capable of operating in 36 mbps TX rate in
-//		clean environment.
-//								  TxRate: 1   2   5.5	11	 6	  9    12	18	 24   36   48	54	 72  100
-CHAR RssiSafeLevelForTxRate[] ={  -92, -91, -90, -87, -88, -86, -85, -83, -81, -78, -72, -71, -40, -40 };
-
-UCHAR  RateIdToMbps[]	 = { 1, 2, 5, 11, 6, 9, 12, 18, 24, 36, 48, 54, 72, 100};
-USHORT RateIdTo500Kbps[] = { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108, 144, 200};
-
-UCHAR  SsidIe	 = IE_SSID;
-UCHAR  SupRateIe = IE_SUPP_RATES;
-UCHAR  ExtRateIe = IE_EXT_SUPP_RATES;
-#ifdef DOT11_N_SUPPORT
-UCHAR  HtCapIe = IE_HT_CAP;
-UCHAR  AddHtInfoIe = IE_ADD_HT;
-UCHAR  NewExtChanIe = IE_SECONDARY_CH_OFFSET;
-#ifdef DOT11N_DRAFT3
-UCHAR  ExtHtCapIe = IE_EXT_CAPABILITY;
-#endif // DOT11N_DRAFT3 //
-#endif // DOT11_N_SUPPORT //
-UCHAR  ErpIe	 = IE_ERP;
-UCHAR  DsIe	 = IE_DS_PARM;
-UCHAR  TimIe	 = IE_TIM;
-UCHAR  WpaIe	 = IE_WPA;
-UCHAR  Wpa2Ie	 = IE_WPA2;
-UCHAR  IbssIe	 = IE_IBSS_PARM;
-UCHAR  Ccx2Ie	 = IE_CCX_V2;
-UCHAR  WapiIe	 = IE_WAPI;
-
-extern UCHAR	WPA_OUI[];
-
-UCHAR	SES_OUI[] = {0x00, 0x90, 0x4c};
-
-UCHAR	ZeroSsid[32] = {0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
-	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};
-
-
-/*
-	==========================================================================
-	Description:
-		initialize the MLME task and its data structure (queue, spinlock,
-		timer, state machines).
-
-	IRQL = PASSIVE_LEVEL
-
-	Return:
-		always return NDIS_STATUS_SUCCESS
-
-	==========================================================================
-*/
-NDIS_STATUS MlmeInit(
-	IN PRTMP_ADAPTER pAd)
-{
-	NDIS_STATUS Status = NDIS_STATUS_SUCCESS;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("--> MLME Initialize\n"));
-
-	do
-	{
-		Status = MlmeQueueInit(&pAd->Mlme.Queue);
-		if(Status != NDIS_STATUS_SUCCESS)
-			break;
-
-		pAd->Mlme.bRunning = FALSE;
-		NdisAllocateSpinLock(&pAd->Mlme.TaskLock);
-
-#ifdef CONFIG_STA_SUPPORT
-		IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		{
-			BssTableInit(&pAd->ScanTab);
-
-			// init STA state machines
-			AssocStateMachineInit(pAd, &pAd->Mlme.AssocMachine, pAd->Mlme.AssocFunc);
-			AuthStateMachineInit(pAd, &pAd->Mlme.AuthMachine, pAd->Mlme.AuthFunc);
-			AuthRspStateMachineInit(pAd, &pAd->Mlme.AuthRspMachine, pAd->Mlme.AuthRspFunc);
-			SyncStateMachineInit(pAd, &pAd->Mlme.SyncMachine, pAd->Mlme.SyncFunc);
-
-#ifdef QOS_DLS_SUPPORT
-			DlsStateMachineInit(pAd, &pAd->Mlme.DlsMachine, pAd->Mlme.DlsFunc);
-#endif // QOS_DLS_SUPPORT //
-
-
-
-			// Since we are using switch/case to implement it, the init is different from the above
-			// state machine init
-			MlmeCntlInit(pAd, &pAd->Mlme.CntlMachine, NULL);
-		}
-#endif // CONFIG_STA_SUPPORT //
-
-
-		WpaStateMachineInit(pAd, &pAd->Mlme.WpaMachine, pAd->Mlme.WpaFunc);
-
-
-		ActionStateMachineInit(pAd, &pAd->Mlme.ActMachine, pAd->Mlme.ActFunc);
-
-		// Init mlme periodic timer
-		RTMPInitTimer(pAd, &pAd->Mlme.PeriodicTimer, GET_TIMER_FUNCTION(MlmePeriodicExec), pAd, TRUE);
-
-		// Set mlme periodic timer
-		RTMPSetTimer(&pAd->Mlme.PeriodicTimer, MLME_TASK_EXEC_INTV);
-
-		// software-based RX Antenna diversity
-		RTMPInitTimer(pAd, &pAd->Mlme.RxAntEvalTimer, GET_TIMER_FUNCTION(AsicRxAntEvalTimeout), pAd, FALSE);
-
-
-#ifdef CONFIG_STA_SUPPORT
-		IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		{
-#ifdef RTMP_PCI_SUPPORT
-			if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE))
-			{
-			    // only PCIe cards need these two timers
-				RTMPInitTimer(pAd, &pAd->Mlme.PsPollTimer, GET_TIMER_FUNCTION(PsPollWakeExec), pAd, FALSE);
-				RTMPInitTimer(pAd, &pAd->Mlme.RadioOnOffTimer, GET_TIMER_FUNCTION(RadioOnExec), pAd, FALSE);
-			}
-#endif // RTMP_PCI_SUPPORT //
-
-			RTMPInitTimer(pAd, &pAd->Mlme.LinkDownTimer, GET_TIMER_FUNCTION(LinkDownExec), pAd, FALSE);
-
-		}
-#endif // CONFIG_STA_SUPPORT //
-
-	} while (FALSE);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("<-- MLME Initialize\n"));
-
-	return Status;
-}
-
-/*
-	==========================================================================
-	Description:
-		main loop of the MLME
-	Pre:
-		Mlme has to be initialized, and there are something inside the queue
-	Note:
-		This function is invoked from MPSetInformation and MPReceive;
-		This task guarantee only one MlmeHandler will run.
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-VOID MlmeHandler(
-	IN PRTMP_ADAPTER pAd)
-{
-	MLME_QUEUE_ELEM		   *Elem = NULL;
-#ifdef APCLI_SUPPORT
-	SHORT apcliIfIndex;
-#endif // APCLI_SUPPORT //
-
-	// Only accept MLME and Frame from peer side, no other (control/data) frame should
-	// get into this state machine
-
-	NdisAcquireSpinLock(&pAd->Mlme.TaskLock);
-	if(pAd->Mlme.bRunning)
-	{
-		NdisReleaseSpinLock(&pAd->Mlme.TaskLock);
-		return;
-	}
-	else
-	{
-		pAd->Mlme.bRunning = TRUE;
-	}
-	NdisReleaseSpinLock(&pAd->Mlme.TaskLock);
-
-	while (!MlmeQueueEmpty(&pAd->Mlme.Queue))
-	{
-		if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_MLME_RESET_IN_PROGRESS) ||
-			RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS) ||
-			RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST))
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("Device Halted or Removed or MlmeRest, exit MlmeHandler! (queue num = %ld)\n", pAd->Mlme.Queue.Num));
-			break;
-		}
-
-#ifdef RALINK_ATE
-		if(ATE_ON(pAd))
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("The driver is in ATE mode now in MlmeHandler\n"));
-			break;
-		}
-#endif // RALINK_ATE //
-
-		//From message type, determine which state machine I should drive
-		if (MlmeDequeue(&pAd->Mlme.Queue, &Elem))
-		{
-
-			// if dequeue success
-			switch (Elem->Machine)
-			{
-				// STA state machines
-#ifdef CONFIG_STA_SUPPORT
-				case ASSOC_STATE_MACHINE:
-					StateMachinePerformAction(pAd, &pAd->Mlme.AssocMachine, Elem);
-					break;
-				case AUTH_STATE_MACHINE:
-					StateMachinePerformAction(pAd, &pAd->Mlme.AuthMachine, Elem);
-					break;
-				case AUTH_RSP_STATE_MACHINE:
-					StateMachinePerformAction(pAd, &pAd->Mlme.AuthRspMachine, Elem);
-					break;
-				case SYNC_STATE_MACHINE:
-					StateMachinePerformAction(pAd, &pAd->Mlme.SyncMachine, Elem);
-					break;
-				case MLME_CNTL_STATE_MACHINE:
-					MlmeCntlMachinePerformAction(pAd, &pAd->Mlme.CntlMachine, Elem);
-					break;
-				case WPA_PSK_STATE_MACHINE:
-					StateMachinePerformAction(pAd, &pAd->Mlme.WpaPskMachine, Elem);
-					break;
-
-#ifdef QOS_DLS_SUPPORT
-				case DLS_STATE_MACHINE:
-					StateMachinePerformAction(pAd, &pAd->Mlme.DlsMachine, Elem);
-					break;
-#endif // QOS_DLS_SUPPORT //
-
-#endif // CONFIG_STA_SUPPORT //
-
-				case ACTION_STATE_MACHINE:
-					StateMachinePerformAction(pAd, &pAd->Mlme.ActMachine, Elem);
-					break;
-
-				case WPA_STATE_MACHINE:
-					StateMachinePerformAction(pAd, &pAd->Mlme.WpaMachine, Elem);
-					break;
-
-
-				default:
-					DBGPRINT(RT_DEBUG_TRACE, ("ERROR: Illegal machine %ld in MlmeHandler()\n", Elem->Machine));
-					break;
-			} // end of switch
-
-			// free MLME element
-			Elem->Occupied = FALSE;
-			Elem->MsgLen = 0;
-
-		}
-		else {
-			DBGPRINT_ERR(("MlmeHandler: MlmeQueue empty\n"));
-		}
-	}
-
-	NdisAcquireSpinLock(&pAd->Mlme.TaskLock);
-	pAd->Mlme.bRunning = FALSE;
-	NdisReleaseSpinLock(&pAd->Mlme.TaskLock);
-}
-
-/*
-	==========================================================================
-	Description:
-		Destructor of MLME (Destroy queue, state machine, spin lock and timer)
-	Parameters:
-		Adapter - NIC Adapter pointer
-	Post:
-		The MLME task will no longer work properly
-
-	IRQL = PASSIVE_LEVEL
-
-	==========================================================================
- */
-VOID MlmeHalt(
-	IN PRTMP_ADAPTER pAd)
-{
-	BOOLEAN		  Cancelled;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("==> MlmeHalt\n"));
-
-	if (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST))
-	{
-		// disable BEACON generation and other BEACON related hardware timers
-		AsicDisableSync(pAd);
-	}
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-#ifdef QOS_DLS_SUPPORT
-		UCHAR		i;
-#endif // QOS_DLS_SUPPORT //
-		// Cancel pending timers
-		RTMPCancelTimer(&pAd->MlmeAux.AssocTimer,		&Cancelled);
-		RTMPCancelTimer(&pAd->MlmeAux.ReassocTimer,		&Cancelled);
-		RTMPCancelTimer(&pAd->MlmeAux.DisassocTimer,	&Cancelled);
-		RTMPCancelTimer(&pAd->MlmeAux.AuthTimer,		&Cancelled);
-		RTMPCancelTimer(&pAd->MlmeAux.BeaconTimer,		&Cancelled);
-		RTMPCancelTimer(&pAd->MlmeAux.ScanTimer,		&Cancelled);
-
-
-#ifdef RTMP_MAC_PCI
-	    if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE)
-			&&(pAd->StaCfg.PSControl.field.EnableNewPS == TRUE))
-	    {
-		    RTMPCancelTimer(&pAd->Mlme.PsPollTimer,		&Cancelled);
-		    RTMPCancelTimer(&pAd->Mlme.RadioOnOffTimer,		&Cancelled);
-		}
-#endif // RTMP_MAC_PCI //
-
-#ifdef QOS_DLS_SUPPORT
-		for (i=0; i<MAX_NUM_OF_DLS_ENTRY; i++)
-		{
-			RTMPCancelTimer(&pAd->StaCfg.DLSEntry[i].Timer, &Cancelled);
-		}
-#endif // QOS_DLS_SUPPORT //
-		RTMPCancelTimer(&pAd->Mlme.LinkDownTimer,		&Cancelled);
-
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-	RTMPCancelTimer(&pAd->Mlme.PeriodicTimer,		&Cancelled);
-	RTMPCancelTimer(&pAd->Mlme.RxAntEvalTimer,		&Cancelled);
-
-
-
-	if (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST))
-	{
-		RTMP_CHIP_OP *pChipOps = &pAd->chipOps;
-
-		// Set LED
-		RTMPSetLED(pAd, LED_HALT);
-		RTMPSetSignalLED(pAd, -100);	// Force signal strength Led to be turned off, firmware is not done it.
-
-		if (pChipOps->AsicHaltAction)
-			pChipOps->AsicHaltAction(pAd);
-	}
-
-	RTMPusecDelay(5000);    //  5 msec to gurantee Ant Diversity timer canceled
-
-	MlmeQueueDestroy(&pAd->Mlme.Queue);
-	NdisFreeSpinLock(&pAd->Mlme.TaskLock);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("<== MlmeHalt\n"));
-}
-
-VOID MlmeResetRalinkCounters(
-	IN  PRTMP_ADAPTER   pAd)
-{
-	pAd->RalinkCounters.LastOneSecRxOkDataCnt = pAd->RalinkCounters.OneSecRxOkDataCnt;
-	// clear all OneSecxxx counters.
-	pAd->RalinkCounters.OneSecBeaconSentCnt = 0;
-	pAd->RalinkCounters.OneSecFalseCCACnt = 0;
-	pAd->RalinkCounters.OneSecRxFcsErrCnt = 0;
-	pAd->RalinkCounters.OneSecRxOkCnt = 0;
-	pAd->RalinkCounters.OneSecTxFailCount = 0;
-	pAd->RalinkCounters.OneSecTxNoRetryOkCount = 0;
-	pAd->RalinkCounters.OneSecTxRetryOkCount = 0;
-	pAd->RalinkCounters.OneSecRxOkDataCnt = 0;
-	pAd->RalinkCounters.OneSecReceivedByteCount = 0;
-	pAd->RalinkCounters.OneSecTransmittedByteCount = 0;
-
-	// TODO: for debug only. to be removed
-	pAd->RalinkCounters.OneSecOsTxCount[QID_AC_BE] = 0;
-	pAd->RalinkCounters.OneSecOsTxCount[QID_AC_BK] = 0;
-	pAd->RalinkCounters.OneSecOsTxCount[QID_AC_VI] = 0;
-	pAd->RalinkCounters.OneSecOsTxCount[QID_AC_VO] = 0;
-	pAd->RalinkCounters.OneSecDmaDoneCount[QID_AC_BE] = 0;
-	pAd->RalinkCounters.OneSecDmaDoneCount[QID_AC_BK] = 0;
-	pAd->RalinkCounters.OneSecDmaDoneCount[QID_AC_VI] = 0;
-	pAd->RalinkCounters.OneSecDmaDoneCount[QID_AC_VO] = 0;
-	pAd->RalinkCounters.OneSecTxDoneCount = 0;
-	pAd->RalinkCounters.OneSecRxCount = 0;
-	pAd->RalinkCounters.OneSecTxAggregationCount = 0;
-	pAd->RalinkCounters.OneSecRxAggregationCount = 0;
-
-	return;
-}
-
-
-/*
-	==========================================================================
-	Description:
-		This routine is executed periodically to -
-		1. Decide if it's a right time to turn on PwrMgmt bit of all
-		   outgoiing frames
-		2. Calculate ChannelQuality based on statistics of the last
-		   period, so that TX rate won't toggling very frequently between a
-		   successful TX and a failed TX.
-		3. If the calculated ChannelQuality indicated current connection not
-		   healthy, then a ROAMing attempt is tried here.
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-#define ADHOC_BEACON_LOST_TIME		(8*OS_HZ)  // 8 sec
-VOID MlmePeriodicExec(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3)
-{
-	ULONG			TxTotalCnt;
-	PRTMP_ADAPTER	pAd = (RTMP_ADAPTER *)FunctionContext;
-	SHORT	realavgrssi;
-
-#ifdef CONFIG_STA_SUPPORT
-#ifdef RTMP_MAC_PCI
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-	    // If Hardware controlled Radio enabled, we have to check GPIO pin2 every 2 second.
-		// Move code to here, because following code will return when radio is off
-		if ((pAd->Mlme.PeriodicRound % (MLME_TASK_EXEC_MULTIPLE * 2) == 0) && (pAd->StaCfg.bHardwareRadio == TRUE) &&
-			(!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)) &&
-			(!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS))
-			/*&&(pAd->bPCIclkOff == FALSE)*/)
-		{
-			UINT32				data = 0;
-
-			// Read GPIO pin2 as Hardware controlled radio state
-#ifndef RT3090
-			RTMP_IO_READ32(pAd, GPIO_CTRL_CFG, &data);
-#endif // RT3090 //
-//KH(PCIE PS):Added based on Jane<--
-#ifdef RT3090
-// Read GPIO pin2 as Hardware controlled radio state
-// We need to Read GPIO if HW said so no mater what advance power saving
-if ((pAd->OpMode == OPMODE_STA) && (IDLE_ON(pAd))
-	&& (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_IDLE_RADIO_OFF))
-	&& (pAd->StaCfg.PSControl.field.EnablePSinIdle == TRUE))
-	{
-	// Want to make sure device goes to L0 state before reading register.
-	RTMPPCIeLinkCtrlValueRestore(pAd, 0);
-	RTMP_IO_FORCE_READ32(pAd, GPIO_CTRL_CFG, &data);
-	RTMPPCIeLinkCtrlSetting(pAd, 3);
-	}
-else
-	RTMP_IO_FORCE_READ32(pAd, GPIO_CTRL_CFG, &data);
-#endif // RT3090 //
-//KH(PCIE PS):Added based on Jane-->
-
-			if (data & 0x04)
-			{
-				pAd->StaCfg.bHwRadio = TRUE;
-			}
-			else
-			{
-				pAd->StaCfg.bHwRadio = FALSE;
-			}
-			if (pAd->StaCfg.bRadio != (pAd->StaCfg.bHwRadio && pAd->StaCfg.bSwRadio))
-			{
-				pAd->StaCfg.bRadio = (pAd->StaCfg.bHwRadio && pAd->StaCfg.bSwRadio);
-				if (pAd->StaCfg.bRadio == TRUE)
-				{
-					MlmeRadioOn(pAd);
-					// Update extra information
-					pAd->ExtraInfo = EXTRA_INFO_CLEAR;
-				}
-				else
-				{
-					MlmeRadioOff(pAd);
-					// Update extra information
-					pAd->ExtraInfo = HW_RADIO_OFF;
-				}
-			}
-		}
-	}
-#endif // RTMP_MAC_PCI //
-#endif // CONFIG_STA_SUPPORT //
-
-	// Do nothing if the driver is starting halt state.
-	// This might happen when timer already been fired before cancel timer with mlmehalt
-	if ((RTMP_TEST_FLAG(pAd, (fRTMP_ADAPTER_HALT_IN_PROGRESS |
-								fRTMP_ADAPTER_RADIO_OFF |
-								fRTMP_ADAPTER_RADIO_MEASUREMENT |
-								fRTMP_ADAPTER_RESET_IN_PROGRESS))))
-		return;
-
-	RTMP_MLME_PRE_SANITY_CHECK(pAd);
-
-#ifdef RALINK_ATE
-	/* Do not show RSSI until "Normal 1 second Mlme PeriodicExec". */
-	if (ATE_ON(pAd))
-	{
-		if (pAd->Mlme.PeriodicRound % MLME_TASK_EXEC_MULTIPLE != (MLME_TASK_EXEC_MULTIPLE - 1))
-	{
-			pAd->Mlme.PeriodicRound ++;
-			return;
-		}
-	}
-#endif // RALINK_ATE //
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-		// Do nothing if monitor mode is on
-		if (MONITOR_ON(pAd))
-			return;
-
-		if (pAd->Mlme.PeriodicRound & 0x1)
-		{
-			// This is the fix for wifi 11n extension channel overlapping test case.  for 2860D
-			if (((pAd->MACVersion & 0xffff) == 0x0101) &&
-				(STA_TGN_WIFI_ON(pAd)) &&
-				(pAd->CommonCfg.IOTestParm.bToggle == FALSE))
-
-				{
-					RTMP_IO_WRITE32(pAd, TXOP_CTRL_CFG, 0x24Bf);
-					pAd->CommonCfg.IOTestParm.bToggle = TRUE;
-				}
-				else if ((STA_TGN_WIFI_ON(pAd)) &&
-						((pAd->MACVersion & 0xffff) == 0x0101))
-				{
-					RTMP_IO_WRITE32(pAd, TXOP_CTRL_CFG, 0x243f);
-					pAd->CommonCfg.IOTestParm.bToggle = FALSE;
-				}
-		}
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-	pAd->bUpdateBcnCntDone = FALSE;
-
-//	RECBATimerTimeout(SystemSpecific1,FunctionContext,SystemSpecific2,SystemSpecific3);
-	pAd->Mlme.PeriodicRound ++;
-
-
-	// execute every 500ms
-	if ((pAd->Mlme.PeriodicRound % 5 == 0) && RTMPAutoRateSwitchCheck(pAd)/*(OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_TX_RATE_SWITCH_ENABLED))*/)
-	{
-#ifdef CONFIG_STA_SUPPORT
-		// perform dynamic tx rate switching based on past TX history
-		IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		{
-			if ((OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED)
-					)
-				&& (!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE)))
-				MlmeDynamicTxRateSwitching(pAd);
-		}
-#endif // CONFIG_STA_SUPPORT //
-	}
-
-	// Normal 1 second Mlme PeriodicExec.
-	if (pAd->Mlme.PeriodicRound %MLME_TASK_EXEC_MULTIPLE == 0)
-	{
-                pAd->Mlme.OneSecPeriodicRound ++;
-
-#ifdef RALINK_ATE
-	if (ATE_ON(pAd))
-	{
-			/* request from Baron : move this routine from later to here */
-			/* for showing Rx error count in ATE RXFRAME */
-            NICUpdateRawCounters(pAd);
-			if (pAd->ate.bRxFER == 1)
-			{
-				pAd->ate.RxTotalCnt += pAd->ate.RxCntPerSec;
-			    ate_print(KERN_EMERG "MlmePeriodicExec: Rx packet cnt = %d/%d\n", pAd->ate.RxCntPerSec, pAd->ate.RxTotalCnt);
-				pAd->ate.RxCntPerSec = 0;
-
-				if (pAd->ate.RxAntennaSel == 0)
-					ate_print(KERN_EMERG "MlmePeriodicExec: Rx AvgRssi0=%d, AvgRssi1=%d, AvgRssi2=%d\n\n",
-						pAd->ate.AvgRssi0, pAd->ate.AvgRssi1, pAd->ate.AvgRssi2);
-				else
-					ate_print(KERN_EMERG "MlmePeriodicExec: Rx AvgRssi=%d\n\n", pAd->ate.AvgRssi0);
-			}
-			MlmeResetRalinkCounters(pAd);
-
-
-
-			return;
-	}
-#endif // RALINK_ATE //
-
-
-
-		//ORIBATimerTimeout(pAd);
-
-		// Media status changed, report to NDIS
-		if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_MEDIA_STATE_CHANGE))
-		{
-			RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_MEDIA_STATE_CHANGE);
-			if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED))
-			{
-				pAd->IndicateMediaState = NdisMediaStateConnected;
-				RTMP_IndicateMediaState(pAd);
-			}
-			else
-			{
-				pAd->IndicateMediaState = NdisMediaStateDisconnected;
-				RTMP_IndicateMediaState(pAd);
-			}
-		}
-
-		NdisGetSystemUpTime(&pAd->Mlme.Now32);
-
-		// add the most up-to-date h/w raw counters into software variable, so that
-		// the dynamic tuning mechanism below are based on most up-to-date information
-		NICUpdateRawCounters(pAd);
-
-
-#ifdef DOT11_N_SUPPORT
-		// Need statistics after read counter. So put after NICUpdateRawCounters
-		ORIBATimerTimeout(pAd);
-#endif // DOT11_N_SUPPORT //
-
-		// if MGMT RING is full more than twice within 1 second, we consider there's
-		// a hardware problem stucking the TX path. In this case, try a hardware reset
-		// to recover the system
-	//	if (pAd->RalinkCounters.MgmtRingFullCount >= 2)
-	//		RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_HARDWARE_ERROR);
-	//	else
-	//		pAd->RalinkCounters.MgmtRingFullCount = 0;
-
-		// The time period for checking antenna is according to traffic
-#ifdef ANT_DIVERSITY_SUPPORT
-		if ((pAd->NicConfig2.field.AntDiversity) &&
-			(pAd->CommonCfg.bRxAntDiversity == ANT_DIVERSITY_ENABLE) &&
-			(!pAd->EepromAccess))
-			AsicAntennaSelect(pAd, pAd->MlmeAux.Channel);
-		else if(pAd->CommonCfg.bRxAntDiversity == ANT_FIX_ANT1 || pAd->CommonCfg.bRxAntDiversity == ANT_FIX_ANT2)
-		{
-#ifdef CONFIG_STA_SUPPORT
-			realavgrssi = (pAd->RxAnt.Pair1AvgRssi[pAd->RxAnt.Pair1PrimaryRxAnt] >> 3);
-#endif // CONFIG_STA_SUPPORT //
-			DBGPRINT(RT_DEBUG_TRACE,("Ant-realrssi0(%d), Lastrssi0(%d), EvaluateStableCnt=%d\n", realavgrssi, pAd->RxAnt.Pair1LastAvgRssi, pAd->RxAnt.EvaluateStableCnt));
-		}
-		else
-#endif // ANT_DIVERSITY_SUPPORT //
-		{
-			if (pAd->Mlme.bEnableAutoAntennaCheck)
-			{
-				TxTotalCnt = pAd->RalinkCounters.OneSecTxNoRetryOkCount +
-								 pAd->RalinkCounters.OneSecTxRetryOkCount +
-								 pAd->RalinkCounters.OneSecTxFailCount;
-
-				// dynamic adjust antenna evaluation period according to the traffic
-				if (TxTotalCnt > 50)
-				{
-					if (pAd->Mlme.OneSecPeriodicRound % 10 == 0)
-					{
-						AsicEvaluateRxAnt(pAd);
-					}
-				}
-				else
-				{
-					if (pAd->Mlme.OneSecPeriodicRound % 3 == 0)
-					{
-						AsicEvaluateRxAnt(pAd);
-					}
-				}
-			}
-		}
-
-#ifdef CONFIG_STA_SUPPORT
-		IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-			STAMlmePeriodicExec(pAd);
-#endif // CONFIG_STA_SUPPORT //
-
-		MlmeResetRalinkCounters(pAd);
-
-#ifdef CONFIG_STA_SUPPORT
-		IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		{
-#ifdef RTMP_MAC_PCI
-			if (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST) && (pAd->bPCIclkOff == FALSE))
-#endif // RTMP_MAC_PCI //
-			{
-			// When Adhoc beacon is enabled and RTS/CTS is enabled, there is a chance that hardware MAC FSM will run into a deadlock
-			// and sending CTS-to-self over and over.
-			// Software Patch Solution:
-			// 1. Polling debug state register 0x10F4 every one second.
-			// 2. If in 0x10F4 the ((bit29==1) && (bit7==1)) OR ((bit29==1) && (bit5==1)), it means the deadlock has occurred.
-			// 3. If the deadlock occurred, reset MAC/BBP by setting 0x1004 to 0x0001 for a while then setting it back to 0x000C again.
-
-			UINT32	MacReg = 0;
-
-			RTMP_IO_READ32(pAd, 0x10F4, &MacReg);
-			if (((MacReg & 0x20000000) && (MacReg & 0x80)) || ((MacReg & 0x20000000) && (MacReg & 0x20)))
-			{
-				RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, 0x1);
-				RTMPusecDelay(1);
-				RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, 0xC);
-
-				DBGPRINT(RT_DEBUG_WARN,("Warning, MAC specific condition occurs \n"));
-			}
-		}
-		}
-#endif // CONFIG_STA_SUPPORT //
-
-		RTMP_MLME_HANDLER(pAd);
-	}
-
-
-	pAd->bUpdateBcnCntDone = FALSE;
-}
-
-
-/*
-	==========================================================================
-	Validate SSID for connection try and rescan purpose
-	Valid SSID will have visible chars only.
-	The valid length is from 0 to 32.
-	IRQL = DISPATCH_LEVEL
-	==========================================================================
- */
-BOOLEAN MlmeValidateSSID(
-	IN PUCHAR	pSsid,
-	IN UCHAR	SsidLen)
-{
-	int	index;
-
-	if (SsidLen > MAX_LEN_OF_SSID)
-		return (FALSE);
-
-	// Check each character value
-	for (index = 0; index < SsidLen; index++)
-	{
-		if (pSsid[index] < 0x20)
-			return (FALSE);
-	}
-
-	// All checked
-	return (TRUE);
-}
-
-VOID MlmeSelectTxRateTable(
-	IN PRTMP_ADAPTER		pAd,
-	IN PMAC_TABLE_ENTRY		pEntry,
-	IN PUCHAR				*ppTable,
-	IN PUCHAR				pTableSize,
-	IN PUCHAR				pInitTxRateIdx)
-{
-	do
-	{
-		// decide the rate table for tuning
-		if (pAd->CommonCfg.TxRateTableSize > 0)
-		{
-			*ppTable = RateSwitchTable;
-			*pTableSize = RateSwitchTable[0];
-			*pInitTxRateIdx = RateSwitchTable[1];
-
-			break;
-		}
-
-#ifdef CONFIG_STA_SUPPORT
-		if ((pAd->OpMode == OPMODE_STA) && ADHOC_ON(pAd))
-		{
-#ifdef DOT11_N_SUPPORT
-			if ((pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED) &&
-				(pEntry->HTCapability.MCSSet[0] == 0xff) &&
-				((pEntry->HTCapability.MCSSet[1] == 0x00) || (pAd->Antenna.field.TxPath == 1)))
-			{// 11N 1S Adhoc
-				*ppTable = RateSwitchTable11N1S;
-				*pTableSize = RateSwitchTable11N1S[0];
-				*pInitTxRateIdx = RateSwitchTable11N1S[1];
-
-			}
-			else if ((pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED) &&
-					(pEntry->HTCapability.MCSSet[0] == 0xff) &&
-					(pEntry->HTCapability.MCSSet[1] == 0xff) &&
-					(pAd->Antenna.field.TxPath == 2))
-			{// 11N 2S Adhoc
-				if (pAd->LatchRfRegs.Channel <= 14)
-				{
-					*ppTable = RateSwitchTable11N2S;
-					*pTableSize = RateSwitchTable11N2S[0];
-					*pInitTxRateIdx = RateSwitchTable11N2S[1];
-				}
-				else
-				{
-					*ppTable = RateSwitchTable11N2SForABand;
-					*pTableSize = RateSwitchTable11N2SForABand[0];
-					*pInitTxRateIdx = RateSwitchTable11N2SForABand[1];
-				}
-
-			}
-			else
-#endif // DOT11_N_SUPPORT //
-				if ((pEntry->RateLen == 4)
-#ifdef DOT11_N_SUPPORT
-					&& (pEntry->HTCapability.MCSSet[0] == 0) && (pEntry->HTCapability.MCSSet[1] == 0)
-#endif // DOT11_N_SUPPORT //
-					)
-			{
-				*ppTable = RateSwitchTable11B;
-				*pTableSize = RateSwitchTable11B[0];
-				*pInitTxRateIdx = RateSwitchTable11B[1];
-
-			}
-			else if (pAd->LatchRfRegs.Channel <= 14)
-			{
-				*ppTable = RateSwitchTable11BG;
-				*pTableSize = RateSwitchTable11BG[0];
-				*pInitTxRateIdx = RateSwitchTable11BG[1];
-
-			}
-			else
-			{
-				*ppTable = RateSwitchTable11G;
-				*pTableSize = RateSwitchTable11G[0];
-				*pInitTxRateIdx = RateSwitchTable11G[1];
-
-			}
-			break;
-		}
-#endif // CONFIG_STA_SUPPORT //
-
-#ifdef DOT11_N_SUPPORT
-		//if ((pAd->StaActive.SupRateLen + pAd->StaActive.ExtRateLen == 12) && (pAd->StaActive.SupportedPhyInfo.MCSSet[0] == 0xff) &&
-		//	((pAd->StaActive.SupportedPhyInfo.MCSSet[1] == 0x00) || (pAd->Antenna.field.TxPath == 1)))
-		if (((pEntry->RateLen == 12) || (pAd->OpMode == OPMODE_STA)) && (pEntry->HTCapability.MCSSet[0] == 0xff) &&
-			((pEntry->HTCapability.MCSSet[1] == 0x00) || (pAd->CommonCfg.TxStream == 1)))
-		{// 11BGN 1S AP
-			*ppTable = RateSwitchTable11BGN1S;
-			*pTableSize = RateSwitchTable11BGN1S[0];
-			*pInitTxRateIdx = RateSwitchTable11BGN1S[1];
-
-			break;
-		}
-
-		//else if ((pAd->StaActive.SupRateLen + pAd->StaActive.ExtRateLen == 12) && (pAd->StaActive.SupportedPhyInfo.MCSSet[0] == 0xff) &&
-		//	(pAd->StaActive.SupportedPhyInfo.MCSSet[1] == 0xff) && (pAd->Antenna.field.TxPath == 2))
-		if (((pEntry->RateLen == 12) || (pAd->OpMode == OPMODE_STA)) && (pEntry->HTCapability.MCSSet[0] == 0xff) &&
-			(pEntry->HTCapability.MCSSet[1] == 0xff) && (pAd->CommonCfg.TxStream == 2))
-		{// 11BGN 2S AP
-			if (pAd->LatchRfRegs.Channel <= 14)
-			{
-				*ppTable = RateSwitchTable11BGN2S;
-				*pTableSize = RateSwitchTable11BGN2S[0];
-				*pInitTxRateIdx = RateSwitchTable11BGN2S[1];
-
-			}
-			else
-			{
-				*ppTable = RateSwitchTable11BGN2SForABand;
-				*pTableSize = RateSwitchTable11BGN2SForABand[0];
-				*pInitTxRateIdx = RateSwitchTable11BGN2SForABand[1];
-
-			}
-			break;
-		}
-
-		//else if ((pAd->StaActive.SupportedPhyInfo.MCSSet[0] == 0xff) && ((pAd->StaActive.SupportedPhyInfo.MCSSet[1] == 0x00) || (pAd->Antenna.field.TxPath == 1)))
-		if ((pEntry->HTCapability.MCSSet[0] == 0xff) && ((pEntry->HTCapability.MCSSet[1] == 0x00) || (pAd->CommonCfg.TxStream == 1)))
-		{// 11N 1S AP
-			*ppTable = RateSwitchTable11N1S;
-			*pTableSize = RateSwitchTable11N1S[0];
-			*pInitTxRateIdx = RateSwitchTable11N1S[1];
-
-			break;
-		}
-
-		//else if ((pAd->StaActive.SupportedPhyInfo.MCSSet[0] == 0xff) && (pAd->StaActive.SupportedPhyInfo.MCSSet[1] == 0xff) && (pAd->Antenna.field.TxPath == 2))
-		if ((pEntry->HTCapability.MCSSet[0] == 0xff) && (pEntry->HTCapability.MCSSet[1] == 0xff) && (pAd->CommonCfg.TxStream == 2))
-		{// 11N 2S AP
-			if (pAd->LatchRfRegs.Channel <= 14)
-			{
-			*ppTable = RateSwitchTable11N2S;
-			*pTableSize = RateSwitchTable11N2S[0];
-			*pInitTxRateIdx = RateSwitchTable11N2S[1];
-			}
-			else
-			{
-				*ppTable = RateSwitchTable11N2SForABand;
-				*pTableSize = RateSwitchTable11N2SForABand[0];
-				*pInitTxRateIdx = RateSwitchTable11N2SForABand[1];
-			}
-
-			break;
-		}
-#endif // DOT11_N_SUPPORT //
-		//else if ((pAd->StaActive.SupRateLen == 4) && (pAd->StaActive.ExtRateLen == 0) && (pAd->StaActive.SupportedPhyInfo.MCSSet[0] == 0) && (pAd->StaActive.SupportedPhyInfo.MCSSet[1] == 0))
-		if ((pEntry->RateLen == 4 || pAd->CommonCfg.PhyMode==PHY_11B)
-#ifdef DOT11_N_SUPPORT
-		//Iverson mark for Adhoc b mode,sta will use rate 54  Mbps when connect with sta b/g/n mode
-		/* && (pEntry->HTCapability.MCSSet[0] == 0) && (pEntry->HTCapability.MCSSet[1] == 0)*/
-#endif // DOT11_N_SUPPORT //
-			)
-		{// B only AP
-			*ppTable = RateSwitchTable11B;
-			*pTableSize = RateSwitchTable11B[0];
-			*pInitTxRateIdx = RateSwitchTable11B[1];
-
-			break;
-		}
-
-		//else if ((pAd->StaActive.SupRateLen + pAd->StaActive.ExtRateLen > 8) && (pAd->StaActive.SupportedPhyInfo.MCSSet[0] == 0) && (pAd->StaActive.SupportedPhyInfo.MCSSet[1] == 0))
-		if ((pEntry->RateLen > 8)
-#ifdef DOT11_N_SUPPORT
-			&& (pEntry->HTCapability.MCSSet[0] == 0) && (pEntry->HTCapability.MCSSet[1] == 0)
-#endif // DOT11_N_SUPPORT //
-			)
-		{// B/G  mixed AP
-			*ppTable = RateSwitchTable11BG;
-			*pTableSize = RateSwitchTable11BG[0];
-			*pInitTxRateIdx = RateSwitchTable11BG[1];
-
-			break;
-		}
-
-		//else if ((pAd->StaActive.SupRateLen + pAd->StaActive.ExtRateLen == 8) && (pAd->StaActive.SupportedPhyInfo.MCSSet[0] == 0) && (pAd->StaActive.SupportedPhyInfo.MCSSet[1] == 0))
-		if ((pEntry->RateLen == 8)
-#ifdef DOT11_N_SUPPORT
-			&& (pEntry->HTCapability.MCSSet[0] == 0) && (pEntry->HTCapability.MCSSet[1] == 0)
-#endif // DOT11_N_SUPPORT //
-			)
-		{// G only AP
-			*ppTable = RateSwitchTable11G;
-			*pTableSize = RateSwitchTable11G[0];
-			*pInitTxRateIdx = RateSwitchTable11G[1];
-
-			break;
-		}
-#ifdef DOT11_N_SUPPORT
-#endif // DOT11_N_SUPPORT //
-
-#ifdef CONFIG_STA_SUPPORT
-		IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		{
-#ifdef DOT11_N_SUPPORT
-			//else if ((pAd->StaActive.SupportedPhyInfo.MCSSet[0] == 0) && (pAd->StaActive.SupportedPhyInfo.MCSSet[1] == 0))
-			if ((pEntry->HTCapability.MCSSet[0] == 0) && (pEntry->HTCapability.MCSSet[1] == 0))
-#endif // DOT11_N_SUPPORT //
-			{	// Legacy mode
-				if (pAd->CommonCfg.MaxTxRate <= RATE_11)
-				{
-					*ppTable = RateSwitchTable11B;
-					*pTableSize = RateSwitchTable11B[0];
-					*pInitTxRateIdx = RateSwitchTable11B[1];
-				}
-				else if ((pAd->CommonCfg.MaxTxRate > RATE_11) && (pAd->CommonCfg.MinTxRate > RATE_11))
-				{
-					*ppTable = RateSwitchTable11G;
-					*pTableSize = RateSwitchTable11G[0];
-					*pInitTxRateIdx = RateSwitchTable11G[1];
-
-				}
-				else
-				{
-					*ppTable = RateSwitchTable11BG;
-					*pTableSize = RateSwitchTable11BG[0];
-					*pInitTxRateIdx = RateSwitchTable11BG[1];
-				}
-				break;
-			}
-#ifdef DOT11_N_SUPPORT
-			if (pAd->LatchRfRegs.Channel <= 14)
-			{
-				if (pAd->CommonCfg.TxStream == 1)
-				{
-					*ppTable = RateSwitchTable11N1S;
-					*pTableSize = RateSwitchTable11N1S[0];
-					*pInitTxRateIdx = RateSwitchTable11N1S[1];
-					DBGPRINT_RAW(RT_DEBUG_ERROR,("DRS: unkown mode,default use 11N 1S AP \n"));
-				}
-				else
-				{
-					*ppTable = RateSwitchTable11N2S;
-					*pTableSize = RateSwitchTable11N2S[0];
-					*pInitTxRateIdx = RateSwitchTable11N2S[1];
-					DBGPRINT_RAW(RT_DEBUG_ERROR,("DRS: unkown mode,default use 11N 2S AP \n"));
-				}
-			}
-			else
-			{
-				if (pAd->CommonCfg.TxStream == 1)
-				{
-					*ppTable = RateSwitchTable11N1S;
-					*pTableSize = RateSwitchTable11N1S[0];
-					*pInitTxRateIdx = RateSwitchTable11N1S[1];
-					DBGPRINT_RAW(RT_DEBUG_ERROR,("DRS: unkown mode,default use 11N 1S AP \n"));
-				}
-				else
-				{
-					*ppTable = RateSwitchTable11N2SForABand;
-					*pTableSize = RateSwitchTable11N2SForABand[0];
-					*pInitTxRateIdx = RateSwitchTable11N2SForABand[1];
-					DBGPRINT_RAW(RT_DEBUG_ERROR,("DRS: unkown mode,default use 11N 2S AP \n"));
-				}
-			}
-#endif // DOT11_N_SUPPORT //
-			DBGPRINT_RAW(RT_DEBUG_ERROR,("DRS: unkown mode (SupRateLen=%d, ExtRateLen=%d, MCSSet[0]=0x%x, MCSSet[1]=0x%x)\n",
-				pAd->StaActive.SupRateLen, pAd->StaActive.ExtRateLen, pAd->StaActive.SupportedPhyInfo.MCSSet[0], pAd->StaActive.SupportedPhyInfo.MCSSet[1]));
-		}
-#endif // CONFIG_STA_SUPPORT //
-	} while(FALSE);
-}
-
-
-#ifdef CONFIG_STA_SUPPORT
-VOID STAMlmePeriodicExec(
-	PRTMP_ADAPTER pAd)
-{
-	ULONG			    TxTotalCnt;
-	int	i;
-
-
-
-
-	/*
-		We return here in ATE mode, because the statistics
-		that ATE need are not collected via this routine.
-	*/
-#ifdef RALINK_ATE
-	if (ATE_ON(pAd))
-	return;
-#endif // RALINK_ATE //
-
-#ifdef RALINK_ATE
-	// It is supposed that we will never reach here in ATE mode.
-	ASSERT(!(ATE_ON(pAd)));
-	if (ATE_ON(pAd))
-		return;
-#endif // RALINK_ATE //
-
-#ifdef PCIE_PS_SUPPORT
-// don't perform idle-power-save mechanism within 3 min after driver initialization.
-// This can make rebooter test more robust
-if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE))
-	{
-	if ((pAd->OpMode == OPMODE_STA) && (IDLE_ON(pAd))
-		&& (pAd->Mlme.SyncMachine.CurrState == SYNC_IDLE)
-		&& (pAd->Mlme.CntlMachine.CurrState == CNTL_IDLE)
-		&& (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_IDLE_RADIO_OFF)))
-		{
-		if (IS_RT3090(pAd)|| IS_RT3572(pAd) || IS_RT3390(pAd))
-			{
-			if (pAd->StaCfg.PSControl.field.EnableNewPS == TRUE)
-				{
-				DBGPRINT(RT_DEBUG_TRACE, ("%s::%d\n",__FUNCTION__,__LINE__));
-
-				RT28xxPciAsicRadioOff(pAd, GUI_IDLE_POWER_SAVE, 0);
-				}
-			else
-				{
-				DBGPRINT(RT_DEBUG_TRACE, ("%s::%d\n",__FUNCTION__,__LINE__));
-				AsicSendCommandToMcu(pAd, 0x30, PowerSafeCID, 0xff, 0x2);
-				// Wait command success
-				AsicCheckCommanOk(pAd, PowerSafeCID);
-				RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_IDLE_RADIO_OFF);
-				DBGPRINT(RT_DEBUG_TRACE, ("PSM - rt30xx Issue Sleep command)\n"));
-				}
-			}
-		else if (pAd->Mlme.OneSecPeriodicRound > 180)
-			{
-			if (pAd->StaCfg.PSControl.field.EnableNewPS == TRUE)
-				{
-				DBGPRINT(RT_DEBUG_TRACE, ("%s::%d\n",__FUNCTION__,__LINE__));
-				RT28xxPciAsicRadioOff(pAd, GUI_IDLE_POWER_SAVE, 0);
-				}
-			else
-				{
-				DBGPRINT(RT_DEBUG_TRACE, ("%s::%d\n",__FUNCTION__,__LINE__));
-				AsicSendCommandToMcu(pAd, 0x30, PowerSafeCID, 0xff, 0x02);
-				// Wait command success
-				AsicCheckCommanOk(pAd, PowerSafeCID);
-				RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_IDLE_RADIO_OFF);
-				DBGPRINT(RT_DEBUG_TRACE, ("PSM -  rt28xx Issue Sleep command)\n"));
-				}
-			}
-		}
-	else
-		{
-		DBGPRINT(RT_DEBUG_TRACE,("STAMlmePeriodicExec MMCHK - CommonCfg.Ssid[%d]=%c%c%c%c... MlmeAux.Ssid[%d]=%c%c%c%c...\n",
-			pAd->CommonCfg.SsidLen, pAd->CommonCfg.Ssid[0], pAd->CommonCfg.Ssid[1], pAd->CommonCfg.Ssid[2], pAd->CommonCfg.Ssid[3],
-			pAd->MlmeAux.SsidLen, pAd->MlmeAux.Ssid[0], pAd->MlmeAux.Ssid[1], pAd->MlmeAux.Ssid[2], pAd->MlmeAux.Ssid[3]));
-		}
-	}
-#endif // PCIE_PS_SUPPORT //
-
-
-#ifdef WPA_SUPPLICANT_SUPPORT
-    if (pAd->StaCfg.WpaSupplicantUP == WPA_SUPPLICANT_DISABLE)
-#endif // WPA_SUPPLICANT_SUPPORT //
-    {
-	// WPA MIC error should block association attempt for 60 seconds
-		if (pAd->StaCfg.bBlockAssoc &&
-			RTMP_TIME_AFTER(pAd->Mlme.Now32, pAd->StaCfg.LastMicErrorTime + (60*OS_HZ)))
-		pAd->StaCfg.bBlockAssoc = FALSE;
-    }
-
-    if ((pAd->PreMediaState != pAd->IndicateMediaState) && (pAd->CommonCfg.bWirelessEvent))
-	{
-		if (pAd->IndicateMediaState == NdisMediaStateConnected)
-		{
-			RTMPSendWirelessEvent(pAd, IW_STA_LINKUP_EVENT_FLAG, pAd->MacTab.Content[BSSID_WCID].Addr, BSS0, 0);
-		}
-		pAd->PreMediaState = pAd->IndicateMediaState;
-	}
-
-
-
-
-	if (pAd->CommonCfg.PSPXlink && ADHOC_ON(pAd))
-	{
-	}
-	else
-	{
-	AsicStaBbpTuning(pAd);
-	}
-
-	TxTotalCnt = pAd->RalinkCounters.OneSecTxNoRetryOkCount +
-					 pAd->RalinkCounters.OneSecTxRetryOkCount +
-					 pAd->RalinkCounters.OneSecTxFailCount;
-
-	if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED))
-	{
-		// update channel quality for Roaming and UI LinkQuality display
-		MlmeCalculateChannelQuality(pAd, NULL, pAd->Mlme.Now32);
-	}
-
-	// must be AFTER MlmeDynamicTxRateSwitching() because it needs to know if
-	// Radio is currently in noisy environment
-	if (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS))
-	AsicAdjustTxPower(pAd);
-
-	if (INFRA_ON(pAd))
-	{
-#ifdef QOS_DLS_SUPPORT
-		// Check DLS time out, then tear down those session
-		RTMPCheckDLSTimeOut(pAd);
-#endif // QOS_DLS_SUPPORT //
-
-		// Is PSM bit consistent with user power management policy?
-		// This is the only place that will set PSM bit ON.
-		if (!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE))
-		MlmeCheckPsmChange(pAd, pAd->Mlme.Now32);
-
-		pAd->RalinkCounters.LastOneSecTotalTxCount = TxTotalCnt;
-
-		if ((RTMP_TIME_AFTER(pAd->Mlme.Now32, pAd->StaCfg.LastBeaconRxTime + (1*OS_HZ))) &&
-			(!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS)) &&
-			(((TxTotalCnt + pAd->RalinkCounters.OneSecRxOkCnt) < 600)))
-		{
-			RTMPSetAGCInitValue(pAd, BW_20);
-			DBGPRINT(RT_DEBUG_TRACE, ("MMCHK - No BEACON. restore R66 to the low bound(%d) \n", (0x2E + GET_LNA_GAIN(pAd))));
-		}
-
-        //if ((pAd->RalinkCounters.OneSecTxNoRetryOkCount == 0) &&
-        //    (pAd->RalinkCounters.OneSecTxRetryOkCount == 0))
-        {
-		if (pAd->CommonCfg.bAPSDCapable && pAd->CommonCfg.APEdcaParm.bAPSDCapable)
-		{
-		    // When APSD is enabled, the period changes as 20 sec
-			if ((pAd->Mlme.OneSecPeriodicRound % 20) == 8)
-				RTMPSendNullFrame(pAd, pAd->CommonCfg.TxRate, TRUE);
-		}
-		else
-		{
-		    // Send out a NULL frame every 10 sec to inform AP that STA is still alive (Avoid being age out)
-			if ((pAd->Mlme.OneSecPeriodicRound % 10) == 8)
-                {
-                    if (pAd->CommonCfg.bWmmCapable)
-					RTMPSendNullFrame(pAd, pAd->CommonCfg.TxRate, TRUE);
-                    else
-						RTMPSendNullFrame(pAd, pAd->CommonCfg.TxRate, FALSE);
-                }
-		}
-        }
-
-		if (CQI_IS_DEAD(pAd->Mlme.ChannelQuality))
-			{
-			DBGPRINT(RT_DEBUG_TRACE, ("MMCHK - No BEACON. Dead CQI. Auto Recovery attempt #%ld\n", pAd->RalinkCounters.BadCQIAutoRecoveryCount));
-
-			// Lost AP, send disconnect & link down event
-			LinkDown(pAd, FALSE);
-
-#ifdef WPA_SUPPLICANT_SUPPORT
-#ifndef NATIVE_WPA_SUPPLICANT_SUPPORT
-		//send disassociate event to wpa_supplicant
-		if (pAd->StaCfg.WpaSupplicantUP) {
-			RtmpOSWrielessEventSend(pAd, IWEVCUSTOM, RT_DISASSOC_EVENT_FLAG, NULL, NULL, 0);
-		}
-#endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
-#endif // WPA_SUPPLICANT_SUPPORT //
-
-#ifdef NATIVE_WPA_SUPPLICANT_SUPPORT
-		RtmpOSWrielessEventSend(pAd, SIOCGIWAP, -1, NULL, NULL, 0);
-#endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
-
-			// RTMPPatchMacBbpBug(pAd);
-			MlmeAutoReconnectLastSSID(pAd);
-		}
-		else if (CQI_IS_BAD(pAd->Mlme.ChannelQuality))
-		{
-			pAd->RalinkCounters.BadCQIAutoRecoveryCount ++;
-			DBGPRINT(RT_DEBUG_TRACE, ("MMCHK - Bad CQI. Auto Recovery attempt #%ld\n", pAd->RalinkCounters.BadCQIAutoRecoveryCount));
-			MlmeAutoReconnectLastSSID(pAd);
-		}
-
-		if (pAd->StaCfg.bAutoRoaming)
-		{
-			BOOLEAN	rv = FALSE;
-			CHAR	dBmToRoam = pAd->StaCfg.dBmToRoam;
-			CHAR	MaxRssi = RTMPMaxRssi(pAd,
-										  pAd->StaCfg.RssiSample.LastRssi0,
-										  pAd->StaCfg.RssiSample.LastRssi1,
-										  pAd->StaCfg.RssiSample.LastRssi2);
-
-			// Scanning, ignore Roaming
-			if (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS) &&
-				(pAd->Mlme.SyncMachine.CurrState == SYNC_IDLE) &&
-				(MaxRssi <= dBmToRoam))
-			{
-				DBGPRINT(RT_DEBUG_TRACE, ("Rssi=%d, dBmToRoam=%d\n", MaxRssi, (CHAR)dBmToRoam));
-
-
-				// Add auto seamless roaming
-				if (rv == FALSE)
-					rv = MlmeCheckForFastRoaming(pAd);
-
-				if (rv == FALSE)
-				{
-					if ((pAd->StaCfg.LastScanTime + 10 * OS_HZ) < pAd->Mlme.Now32)
-					{
-						DBGPRINT(RT_DEBUG_TRACE, ("MMCHK - Roaming, No eligable entry, try new scan!\n"));
-						pAd->StaCfg.ScanCnt = 2;
-						pAd->StaCfg.LastScanTime = pAd->Mlme.Now32;
-						MlmeAutoScan(pAd);
-					}
-				}
-			}
-		}
-	}
-	else if (ADHOC_ON(pAd))
-	{
-
-		// If all peers leave, and this STA becomes the last one in this IBSS, then change MediaState
-		// to DISCONNECTED. But still holding this IBSS (i.e. sending BEACON) so that other STAs can
-		// join later.
-		if (RTMP_TIME_AFTER(pAd->Mlme.Now32, pAd->StaCfg.LastBeaconRxTime + ADHOC_BEACON_LOST_TIME) &&
-			OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED))
-		{
-			MLME_START_REQ_STRUCT     StartReq;
-
-			DBGPRINT(RT_DEBUG_TRACE, ("MMCHK - excessive BEACON lost, last STA in this IBSS, MediaState=Disconnected\n"));
-			LinkDown(pAd, FALSE);
-
-			StartParmFill(pAd, &StartReq, (CHAR *)pAd->MlmeAux.Ssid, pAd->MlmeAux.SsidLen);
-			MlmeEnqueue(pAd, SYNC_STATE_MACHINE, MT2_MLME_START_REQ, sizeof(MLME_START_REQ_STRUCT), &StartReq);
-			pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_START;
-		}
-
-		for (i = 1; i < MAX_LEN_OF_MAC_TABLE; i++)
-		{
-			MAC_TABLE_ENTRY *pEntry = &pAd->MacTab.Content[i];
-
-			if (pEntry->ValidAsCLI == FALSE)
-				continue;
-
-			if (RTMP_TIME_AFTER(pAd->Mlme.Now32, pEntry->LastBeaconRxTime + ADHOC_BEACON_LOST_TIME))
-				MacTableDeleteEntry(pAd, pEntry->Aid, pEntry->Addr);
-		}
-	}
-	else // no INFRA nor ADHOC connection
-	{
-
-		if (pAd->StaCfg.bScanReqIsFromWebUI &&
-			RTMP_TIME_BEFORE(pAd->Mlme.Now32, pAd->StaCfg.LastScanTime + (30 * OS_HZ)))
-			goto SKIP_AUTO_SCAN_CONN;
-        else
-            pAd->StaCfg.bScanReqIsFromWebUI = FALSE;
-
-		if ((pAd->StaCfg.bAutoReconnect == TRUE)
-			&& RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_START_UP)
-			&& (MlmeValidateSSID(pAd->MlmeAux.AutoReconnectSsid, pAd->MlmeAux.AutoReconnectSsidLen) == TRUE))
-		{
-			if ((pAd->ScanTab.BssNr==0) && (pAd->Mlme.CntlMachine.CurrState == CNTL_IDLE))
-			{
-				MLME_SCAN_REQ_STRUCT	   ScanReq;
-
-				if (RTMP_TIME_AFTER(pAd->Mlme.Now32, pAd->StaCfg.LastScanTime + (10 * OS_HZ)))
-				{
-					DBGPRINT(RT_DEBUG_TRACE, ("STAMlmePeriodicExec():CNTL - ScanTab.BssNr==0, start a new ACTIVE scan SSID[%s]\n", pAd->MlmeAux.AutoReconnectSsid));
-					ScanParmFill(pAd, &ScanReq, (PSTRING) pAd->MlmeAux.AutoReconnectSsid, pAd->MlmeAux.AutoReconnectSsidLen, BSS_ANY, SCAN_ACTIVE);
-					MlmeEnqueue(pAd, SYNC_STATE_MACHINE, MT2_MLME_SCAN_REQ, sizeof(MLME_SCAN_REQ_STRUCT), &ScanReq);
-					pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_OID_LIST_SCAN;
-					// Reset Missed scan number
-					pAd->StaCfg.LastScanTime = pAd->Mlme.Now32;
-				}
-				else if (pAd->StaCfg.BssType == BSS_ADHOC)	// Quit the forever scan when in a very clean room
-					MlmeAutoReconnectLastSSID(pAd);
-			}
-			else if (pAd->Mlme.CntlMachine.CurrState == CNTL_IDLE)
-			{
-				if ((pAd->Mlme.OneSecPeriodicRound % 7) == 0)
-					{
-						MlmeAutoScan(pAd);
-						pAd->StaCfg.LastScanTime = pAd->Mlme.Now32;
-					}
-				else
-				{
-#ifdef CARRIER_DETECTION_SUPPORT // Roger sync Carrier
-					if (pAd->CommonCfg.CarrierDetect.Enable == TRUE)
-					{
-						if ((pAd->Mlme.OneSecPeriodicRound % 5) == 1)
-							MlmeAutoReconnectLastSSID(pAd);
-					}
-					else
-#endif // CARRIER_DETECTION_SUPPORT //
-						MlmeAutoReconnectLastSSID(pAd);
-				}
-			}
-		}
-	}
-
-SKIP_AUTO_SCAN_CONN:
-
-#ifdef DOT11_N_SUPPORT
-    if ((pAd->MacTab.Content[BSSID_WCID].TXBAbitmap !=0) && (pAd->MacTab.fAnyBASession == FALSE))
-	{
-		pAd->MacTab.fAnyBASession = TRUE;
-		AsicUpdateProtect(pAd, HT_FORCERTSCTS,  ALLN_SETPROTECT, FALSE, FALSE);
-	}
-	else if ((pAd->MacTab.Content[BSSID_WCID].TXBAbitmap ==0) && (pAd->MacTab.fAnyBASession == TRUE))
-	{
-		pAd->MacTab.fAnyBASession = FALSE;
-		AsicUpdateProtect(pAd, pAd->MlmeAux.AddHtInfo.AddHtInfo2.OperaionMode,  ALLN_SETPROTECT, FALSE, FALSE);
-	}
-#endif // DOT11_N_SUPPORT //
-
-
-#ifdef DOT11_N_SUPPORT
-#ifdef DOT11N_DRAFT3
-	if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_SCAN_2040))
-		TriEventCounterMaintenance(pAd);
-#endif // DOT11N_DRAFT3 //
-#endif // DOT11_N_SUPPORT //
-
-	return;
-}
-
-// Link down report
-VOID LinkDownExec(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3)
-{
-	RTMP_ADAPTER *pAd = (RTMP_ADAPTER *)FunctionContext;
-
-	if (pAd != NULL)
-	{
-		MLME_DISASSOC_REQ_STRUCT   DisassocReq;
-
-		if ((pAd->StaCfg.PortSecured == WPA_802_1X_PORT_NOT_SECURED) &&
-			(INFRA_ON(pAd)))
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("LinkDownExec(): disassociate with current AP...\n"));
-			DisassocParmFill(pAd, &DisassocReq, pAd->CommonCfg.Bssid, REASON_DISASSOC_STA_LEAVING);
-			MlmeEnqueue(pAd, ASSOC_STATE_MACHINE, MT2_MLME_DISASSOC_REQ,
-						sizeof(MLME_DISASSOC_REQ_STRUCT), &DisassocReq);
-			pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_DISASSOC;
-
-			pAd->IndicateMediaState = NdisMediaStateDisconnected;
-			RTMP_IndicateMediaState(pAd);
-		    pAd->ExtraInfo = GENERAL_LINK_DOWN;
-		}
-	}
-}
-
-// IRQL = DISPATCH_LEVEL
-VOID MlmeAutoScan(
-	IN PRTMP_ADAPTER pAd)
-{
-	// check CntlMachine.CurrState to avoid collision with NDIS SetOID request
-	if (pAd->Mlme.CntlMachine.CurrState == CNTL_IDLE)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("MMCHK - Driver auto scan\n"));
-		MlmeEnqueue(pAd,
-					MLME_CNTL_STATE_MACHINE,
-					OID_802_11_BSSID_LIST_SCAN,
-					pAd->MlmeAux.AutoReconnectSsidLen,
-					pAd->MlmeAux.AutoReconnectSsid);
-		RTMP_MLME_HANDLER(pAd);
-	}
-}
-
-// IRQL = DISPATCH_LEVEL
-VOID MlmeAutoReconnectLastSSID(
-	IN PRTMP_ADAPTER pAd)
-{
-	if (pAd->StaCfg.bAutoConnectByBssid)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("Driver auto reconnect to last OID_802_11_BSSID setting - %02X:%02X:%02X:%02X:%02X:%02X\n",
-									pAd->MlmeAux.Bssid[0],
-									pAd->MlmeAux.Bssid[1],
-									pAd->MlmeAux.Bssid[2],
-									pAd->MlmeAux.Bssid[3],
-									pAd->MlmeAux.Bssid[4],
-									pAd->MlmeAux.Bssid[5]));
-
-		pAd->MlmeAux.Channel = pAd->CommonCfg.Channel;
-		MlmeEnqueue(pAd,
-			 MLME_CNTL_STATE_MACHINE,
-			 OID_802_11_BSSID,
-			 MAC_ADDR_LEN,
-			 pAd->MlmeAux.Bssid);
-
-		pAd->Mlme.CntlMachine.CurrState = CNTL_IDLE;
-
-		RTMP_MLME_HANDLER(pAd);
-	}
-	// check CntlMachine.CurrState to avoid collision with NDIS SetOID request
-	else if ((pAd->Mlme.CntlMachine.CurrState == CNTL_IDLE) &&
-		(MlmeValidateSSID(pAd->MlmeAux.AutoReconnectSsid, pAd->MlmeAux.AutoReconnectSsidLen) == TRUE))
-	{
-		NDIS_802_11_SSID OidSsid;
-		OidSsid.SsidLength = pAd->MlmeAux.AutoReconnectSsidLen;
-		NdisMoveMemory(OidSsid.Ssid, pAd->MlmeAux.AutoReconnectSsid, pAd->MlmeAux.AutoReconnectSsidLen);
-
-		DBGPRINT(RT_DEBUG_TRACE, ("Driver auto reconnect to last OID_802_11_SSID setting - %s, len - %d\n", pAd->MlmeAux.AutoReconnectSsid, pAd->MlmeAux.AutoReconnectSsidLen));
-		MlmeEnqueue(pAd,
-					MLME_CNTL_STATE_MACHINE,
-					OID_802_11_SSID,
-					sizeof(NDIS_802_11_SSID),
-					&OidSsid);
-		RTMP_MLME_HANDLER(pAd);
-	}
-}
-
-
-/*
-	==========================================================================
-	Description:
-		This routine checks if there're other APs out there capable for
-		roaming. Caller should call this routine only when Link up in INFRA mode
-		and channel quality is below CQI_GOOD_THRESHOLD.
-
-	IRQL = DISPATCH_LEVEL
-
-	Output:
-	==========================================================================
- */
-VOID MlmeCheckForRoaming(
-	IN PRTMP_ADAPTER pAd,
-	IN ULONG	Now32)
-{
-	USHORT	   i;
-	BSS_TABLE  *pRoamTab = &pAd->MlmeAux.RoamTab;
-	BSS_ENTRY  *pBss;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("==> MlmeCheckForRoaming\n"));
-	// put all roaming candidates into RoamTab, and sort in RSSI order
-	BssTableInit(pRoamTab);
-	for (i = 0; i < pAd->ScanTab.BssNr; i++)
-	{
-		pBss = &pAd->ScanTab.BssEntry[i];
-
-		if ((pBss->LastBeaconRxTime + pAd->StaCfg.BeaconLostTime) < Now32)
-			continue;	 // AP disappear
-		if (pBss->Rssi <= RSSI_THRESHOLD_FOR_ROAMING)
-			continue;	 // RSSI too weak. forget it.
-		if (MAC_ADDR_EQUAL(pBss->Bssid, pAd->CommonCfg.Bssid))
-			continue;	 // skip current AP
-		if (pBss->Rssi < (pAd->StaCfg.RssiSample.LastRssi0 + RSSI_DELTA))
-			continue;	 // only AP with stronger RSSI is eligible for roaming
-
-		// AP passing all above rules is put into roaming candidate table
-		NdisMoveMemory(&pRoamTab->BssEntry[pRoamTab->BssNr], pBss, sizeof(BSS_ENTRY));
-		pRoamTab->BssNr += 1;
-	}
-
-	if (pRoamTab->BssNr > 0)
-	{
-		// check CntlMachine.CurrState to avoid collision with NDIS SetOID request
-		if (pAd->Mlme.CntlMachine.CurrState == CNTL_IDLE)
-		{
-			pAd->RalinkCounters.PoorCQIRoamingCount ++;
-			DBGPRINT(RT_DEBUG_TRACE, ("MMCHK - Roaming attempt #%ld\n", pAd->RalinkCounters.PoorCQIRoamingCount));
-			MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_MLME_ROAMING_REQ, 0, NULL);
-			RTMP_MLME_HANDLER(pAd);
-		}
-	}
-	DBGPRINT(RT_DEBUG_TRACE, ("<== MlmeCheckForRoaming(# of candidate= %d)\n",pRoamTab->BssNr));
-}
-
-/*
-	==========================================================================
-	Description:
-		This routine checks if there're other APs out there capable for
-		roaming. Caller should call this routine only when link up in INFRA mode
-		and channel quality is below CQI_GOOD_THRESHOLD.
-
-	IRQL = DISPATCH_LEVEL
-
-	Output:
-	==========================================================================
- */
-BOOLEAN MlmeCheckForFastRoaming(
-	IN	PRTMP_ADAPTER	pAd)
-{
-	USHORT		i;
-	BSS_TABLE	*pRoamTab = &pAd->MlmeAux.RoamTab;
-	BSS_ENTRY	*pBss;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("==> MlmeCheckForFastRoaming\n"));
-	// put all roaming candidates into RoamTab, and sort in RSSI order
-	BssTableInit(pRoamTab);
-	for (i = 0; i < pAd->ScanTab.BssNr; i++)
-	{
-		pBss = &pAd->ScanTab.BssEntry[i];
-
-        if ((pBss->Rssi <= -50) && (pBss->Channel == pAd->CommonCfg.Channel))
-			continue;	 // RSSI too weak. forget it.
-		if (MAC_ADDR_EQUAL(pBss->Bssid, pAd->CommonCfg.Bssid))
-			continue;	 // skip current AP
-		if (!SSID_EQUAL(pBss->Ssid, pBss->SsidLen, pAd->CommonCfg.Ssid, pAd->CommonCfg.SsidLen))
-			continue;	 // skip different SSID
-        if (pBss->Rssi < (RTMPMaxRssi(pAd, pAd->StaCfg.RssiSample.LastRssi0, pAd->StaCfg.RssiSample.LastRssi1, pAd->StaCfg.RssiSample.LastRssi2) + RSSI_DELTA))
-			continue;	 // skip AP without better RSSI
-
-        DBGPRINT(RT_DEBUG_TRACE, ("LastRssi0 = %d, pBss->Rssi = %d\n", RTMPMaxRssi(pAd, pAd->StaCfg.RssiSample.LastRssi0, pAd->StaCfg.RssiSample.LastRssi1, pAd->StaCfg.RssiSample.LastRssi2), pBss->Rssi));
-		// AP passing all above rules is put into roaming candidate table
-		NdisMoveMemory(&pRoamTab->BssEntry[pRoamTab->BssNr], pBss, sizeof(BSS_ENTRY));
-		pRoamTab->BssNr += 1;
-	}
-
-	DBGPRINT(RT_DEBUG_TRACE, ("<== MlmeCheckForFastRoaming (BssNr=%d)\n", pRoamTab->BssNr));
-	if (pRoamTab->BssNr > 0)
-	{
-		// check CntlMachine.CurrState to avoid collision with NDIS SetOID request
-		if (pAd->Mlme.CntlMachine.CurrState == CNTL_IDLE)
-		{
-			pAd->RalinkCounters.PoorCQIRoamingCount ++;
-			DBGPRINT(RT_DEBUG_TRACE, ("MMCHK - Roaming attempt #%ld\n", pAd->RalinkCounters.PoorCQIRoamingCount));
-			MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_MLME_ROAMING_REQ, 0, NULL);
-			RTMP_MLME_HANDLER(pAd);
-			return TRUE;
-		}
-	}
-
-	return FALSE;
-}
-
-VOID MlmeSetTxRate(
-	IN PRTMP_ADAPTER		pAd,
-	IN PMAC_TABLE_ENTRY		pEntry,
-	IN PRTMP_TX_RATE_SWITCH	pTxRate)
-{
-	UCHAR	MaxMode = MODE_OFDM;
-
-#ifdef DOT11_N_SUPPORT
-	MaxMode = MODE_HTGREENFIELD;
-
-	if (pTxRate->STBC && (pAd->StaCfg.MaxHTPhyMode.field.STBC) && (pAd->Antenna.field.TxPath == 2))
-		pAd->StaCfg.HTPhyMode.field.STBC = STBC_USE;
-	else
-#endif // DOT11_N_SUPPORT //
-		pAd->StaCfg.HTPhyMode.field.STBC = STBC_NONE;
-
-	if (pTxRate->CurrMCS < MCS_AUTO)
-		pAd->StaCfg.HTPhyMode.field.MCS = pTxRate->CurrMCS;
-
-	if (pAd->StaCfg.HTPhyMode.field.MCS > 7)
-		pAd->StaCfg.HTPhyMode.field.STBC = STBC_NONE;
-
-	if (ADHOC_ON(pAd))
-	{
-		// If peer adhoc is b-only mode, we can't send 11g rate.
-		pAd->StaCfg.HTPhyMode.field.ShortGI = GI_800;
-		pEntry->HTPhyMode.field.STBC	= STBC_NONE;
-
-		//
-		// For Adhoc MODE_CCK, driver will use AdhocBOnlyJoined flag to roll back to B only if necessary
-		//
-		pEntry->HTPhyMode.field.MODE	= pTxRate->Mode;
-		pEntry->HTPhyMode.field.ShortGI	= pAd->StaCfg.HTPhyMode.field.ShortGI;
-		pEntry->HTPhyMode.field.MCS		= pAd->StaCfg.HTPhyMode.field.MCS;
-
-		// Patch speed error in status page
-		pAd->StaCfg.HTPhyMode.field.MODE = pEntry->HTPhyMode.field.MODE;
-	}
-	else
-    {
-		if (pTxRate->Mode <= MaxMode)
-		pAd->StaCfg.HTPhyMode.field.MODE = pTxRate->Mode;
-
-#ifdef DOT11_N_SUPPORT
-        if (pTxRate->ShortGI && (pAd->StaCfg.MaxHTPhyMode.field.ShortGI))
-			pAd->StaCfg.HTPhyMode.field.ShortGI = GI_400;
-		else
-#endif // DOT11_N_SUPPORT //
-			pAd->StaCfg.HTPhyMode.field.ShortGI = GI_800;
-
-#ifdef DOT11_N_SUPPORT
-		// Reexam each bandwidth's SGI support.
-		if (pAd->StaCfg.HTPhyMode.field.ShortGI == GI_400)
-		{
-			if ((pEntry->HTPhyMode.field.BW == BW_20) && (!CLIENT_STATUS_TEST_FLAG(pEntry, fCLIENT_STATUS_SGI20_CAPABLE)))
-				pAd->StaCfg.HTPhyMode.field.ShortGI = GI_800;
-			if ((pEntry->HTPhyMode.field.BW == BW_40) && (!CLIENT_STATUS_TEST_FLAG(pEntry, fCLIENT_STATUS_SGI40_CAPABLE)))
-				pAd->StaCfg.HTPhyMode.field.ShortGI = GI_800;
-		}
-
-        // Turn RTS/CTS rate to 6Mbps.
-		if ((pEntry->HTPhyMode.field.MCS == 0) && (pAd->StaCfg.HTPhyMode.field.MCS != 0))
-		{
-			pEntry->HTPhyMode.field.MCS		= pAd->StaCfg.HTPhyMode.field.MCS;
-			if (pAd->MacTab.fAnyBASession)
-			{
-				AsicUpdateProtect(pAd, HT_FORCERTSCTS, ALLN_SETPROTECT, TRUE, (BOOLEAN)pAd->MlmeAux.AddHtInfo.AddHtInfo2.NonGfPresent);
-			}
-			else
-			{
-				AsicUpdateProtect(pAd, pAd->MlmeAux.AddHtInfo.AddHtInfo2.OperaionMode, ALLN_SETPROTECT, TRUE, (BOOLEAN)pAd->MlmeAux.AddHtInfo.AddHtInfo2.NonGfPresent);
-			}
-		}
-		else if ((pEntry->HTPhyMode.field.MCS == 8) && (pAd->StaCfg.HTPhyMode.field.MCS != 8))
-		{
-			pEntry->HTPhyMode.field.MCS		= pAd->StaCfg.HTPhyMode.field.MCS;
-			if (pAd->MacTab.fAnyBASession)
-			{
-				AsicUpdateProtect(pAd, HT_FORCERTSCTS, ALLN_SETPROTECT, TRUE, (BOOLEAN)pAd->MlmeAux.AddHtInfo.AddHtInfo2.NonGfPresent);
-			}
-			else
-			{
-				AsicUpdateProtect(pAd, pAd->MlmeAux.AddHtInfo.AddHtInfo2.OperaionMode, ALLN_SETPROTECT, TRUE, (BOOLEAN)pAd->MlmeAux.AddHtInfo.AddHtInfo2.NonGfPresent);
-			}
-		}
-		else if ((pEntry->HTPhyMode.field.MCS != 0) && (pAd->StaCfg.HTPhyMode.field.MCS == 0))
-		{
-			AsicUpdateProtect(pAd, HT_RTSCTS_6M, ALLN_SETPROTECT, TRUE, (BOOLEAN)pAd->MlmeAux.AddHtInfo.AddHtInfo2.NonGfPresent);
-
-		}
-		else if ((pEntry->HTPhyMode.field.MCS != 8) && (pAd->StaCfg.HTPhyMode.field.MCS == 8))
-		{
-			AsicUpdateProtect(pAd, HT_RTSCTS_6M, ALLN_SETPROTECT, TRUE, (BOOLEAN)pAd->MlmeAux.AddHtInfo.AddHtInfo2.NonGfPresent);
-		}
-#endif // DOT11_N_SUPPORT //
-
-		pEntry->HTPhyMode.field.STBC	= pAd->StaCfg.HTPhyMode.field.STBC;
-		pEntry->HTPhyMode.field.ShortGI	= pAd->StaCfg.HTPhyMode.field.ShortGI;
-		pEntry->HTPhyMode.field.MCS		= pAd->StaCfg.HTPhyMode.field.MCS;
-		pEntry->HTPhyMode.field.MODE	= pAd->StaCfg.HTPhyMode.field.MODE;
-#ifdef DOT11_N_SUPPORT
-        if ((pAd->StaCfg.MaxHTPhyMode.field.MODE == MODE_HTGREENFIELD) &&
-            pAd->WIFItestbed.bGreenField)
-            pEntry->HTPhyMode.field.MODE = MODE_HTGREENFIELD;
-#endif // DOT11_N_SUPPORT //
-    }
-
-    pAd->LastTxRate = (USHORT)(pEntry->HTPhyMode.word);
-}
-
-/*
-	==========================================================================
-	Description:
-		This routine calculates the acumulated TxPER of eaxh TxRate. And
-		according to the calculation result, change CommonCfg.TxRate which
-		is the stable TX Rate we expect the Radio situation could sustained.
-
-		CommonCfg.TxRate will change dynamically within {RATE_1/RATE_6, MaxTxRate}
-	Output:
-		CommonCfg.TxRate -
-
-	IRQL = DISPATCH_LEVEL
-
-	NOTE:
-		call this routine every second
-	==========================================================================
- */
-VOID MlmeDynamicTxRateSwitching(
-	IN PRTMP_ADAPTER pAd)
-{
-	UCHAR					UpRateIdx = 0, DownRateIdx = 0, CurrRateIdx;
-	ULONG					i, AccuTxTotalCnt = 0, TxTotalCnt;
-	ULONG					TxErrorRatio = 0;
-	BOOLEAN					bTxRateChanged = FALSE, bUpgradeQuality = FALSE;
-	PRTMP_TX_RATE_SWITCH	pCurrTxRate, pNextTxRate = NULL;
-	PUCHAR					pTable;
-	UCHAR					TableSize = 0;
-	UCHAR					InitTxRateIdx = 0, TrainUp, TrainDown;
-	CHAR					Rssi, RssiOffset = 0;
-	TX_STA_CNT1_STRUC		StaTx1;
-	TX_STA_CNT0_STRUC		TxStaCnt0;
-	ULONG					TxRetransmit = 0, TxSuccess = 0, TxFailCount = 0;
-	MAC_TABLE_ENTRY			*pEntry;
-	RSSI_SAMPLE				*pRssi = &pAd->StaCfg.RssiSample;
-
-#ifdef RALINK_ATE
-	if (ATE_ON(pAd))
-	{
-		return;
-	}
-#endif // RALINK_ATE //
-
-	//
-	// walk through MAC table, see if need to change AP's TX rate toward each entry
-	//
-	for (i = 1; i < MAX_LEN_OF_MAC_TABLE; i++)
-	{
-		pEntry = &pAd->MacTab.Content[i];
-
-	// check if this entry need to switch rate automatically
-		if (RTMPCheckEntryEnableAutoRateSwitch(pAd, pEntry) == FALSE)
-			continue;
-
-		if ((pAd->MacTab.Size == 1) || (pEntry->ValidAsDls))
-		{
-			Rssi = RTMPMaxRssi(pAd,
-							   pRssi->AvgRssi0,
-							   pRssi->AvgRssi1,
-							   pRssi->AvgRssi2);
-
-			// Update statistic counter
-			RTMP_IO_READ32(pAd, TX_STA_CNT0, &TxStaCnt0.word);
-			RTMP_IO_READ32(pAd, TX_STA_CNT1, &StaTx1.word);
-			pAd->bUpdateBcnCntDone = TRUE;
-			TxRetransmit = StaTx1.field.TxRetransmit;
-			TxSuccess = StaTx1.field.TxSuccess;
-			TxFailCount = TxStaCnt0.field.TxFailCount;
-			TxTotalCnt = TxRetransmit + TxSuccess + TxFailCount;
-
-			pAd->RalinkCounters.OneSecTxRetryOkCount += StaTx1.field.TxRetransmit;
-			pAd->RalinkCounters.OneSecTxNoRetryOkCount += StaTx1.field.TxSuccess;
-			pAd->RalinkCounters.OneSecTxFailCount += TxStaCnt0.field.TxFailCount;
-			pAd->WlanCounters.TransmittedFragmentCount.u.LowPart += StaTx1.field.TxSuccess;
-			pAd->WlanCounters.RetryCount.u.LowPart += StaTx1.field.TxRetransmit;
-			pAd->WlanCounters.FailedCount.u.LowPart += TxStaCnt0.field.TxFailCount;
-
-			// if no traffic in the past 1-sec period, don't change TX rate,
-			// but clear all bad history. because the bad history may affect the next
-			// Chariot throughput test
-			AccuTxTotalCnt = pAd->RalinkCounters.OneSecTxNoRetryOkCount +
-						 pAd->RalinkCounters.OneSecTxRetryOkCount +
-						 pAd->RalinkCounters.OneSecTxFailCount;
-
-			if (TxTotalCnt)
-				TxErrorRatio = ((TxRetransmit + TxFailCount) * 100) / TxTotalCnt;
-		}
-		else
-		{
-			if (INFRA_ON(pAd) && (i == 1))
-				Rssi = RTMPMaxRssi(pAd,
-								   pRssi->AvgRssi0,
-								   pRssi->AvgRssi1,
-								   pRssi->AvgRssi2);
-			else
-				Rssi = RTMPMaxRssi(pAd,
-								   pEntry->RssiSample.AvgRssi0,
-								   pEntry->RssiSample.AvgRssi1,
-								   pEntry->RssiSample.AvgRssi2);
-
-			TxTotalCnt = pEntry->OneSecTxNoRetryOkCount +
-				 pEntry->OneSecTxRetryOkCount +
-				 pEntry->OneSecTxFailCount;
-
-			if (TxTotalCnt)
-				TxErrorRatio = ((pEntry->OneSecTxRetryOkCount + pEntry->OneSecTxFailCount) * 100) / TxTotalCnt;
-		}
-
-		if (TxTotalCnt)
-		{
-			/*
-				Three AdHoc connections can not work normally if one AdHoc connection is disappeared from a heavy traffic environment generated by ping tool
-				We force to set LongRtyLimit and ShortRtyLimit to 0 to stop retransmitting packet, after a while, resoring original settings
-			*/
-			if (TxErrorRatio == 100)
-			{
-				TX_RTY_CFG_STRUC	TxRtyCfg,TxRtyCfgtmp;
-				ULONG	Index;
-				ULONG	MACValue;
-
-				RTMP_IO_READ32(pAd, TX_RTY_CFG, &TxRtyCfg.word);
-				TxRtyCfgtmp.word = TxRtyCfg.word;
-				TxRtyCfg.field.LongRtyLimit = 0x0;
-				TxRtyCfg.field.ShortRtyLimit = 0x0;
-				RTMP_IO_WRITE32(pAd, TX_RTY_CFG, TxRtyCfg.word);
-
-				RTMPusecDelay(1);
-
-				Index = 0;
-				MACValue = 0;
-				do
-				{
-					RTMP_IO_READ32(pAd, TXRXQ_PCNT, &MACValue);
-					if ((MACValue & 0xffffff) == 0)
-						break;
-					Index++;
-					RTMPusecDelay(1000);
-				}while((Index < 330)&&(!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS)));
-
-				RTMP_IO_READ32(pAd, TX_RTY_CFG, &TxRtyCfg.word);
-				TxRtyCfg.field.LongRtyLimit = TxRtyCfgtmp.field.LongRtyLimit;
-				TxRtyCfg.field.ShortRtyLimit = TxRtyCfgtmp.field.ShortRtyLimit;
-				RTMP_IO_WRITE32(pAd, TX_RTY_CFG, TxRtyCfg.word);
-			}
-		}
-
-		CurrRateIdx = pEntry->CurrTxRateIndex;
-
-		MlmeSelectTxRateTable(pAd, pEntry, &pTable, &TableSize, &InitTxRateIdx);
-
-		if (CurrRateIdx >= TableSize)
-		{
-			CurrRateIdx = TableSize - 1;
-		}
-
-		// When switch from Fixed rate -> auto rate, the REAL TX rate might be different from pAd->CommonCfg.TxRateIndex.
-		// So need to sync here.
-		pCurrTxRate = (PRTMP_TX_RATE_SWITCH) &pTable[(CurrRateIdx+1)*5];
-		if ((pEntry->HTPhyMode.field.MCS != pCurrTxRate->CurrMCS)
-			//&& (pAd->StaCfg.bAutoTxRateSwitch == TRUE)
-			)
-		{
-
-			// Need to sync Real Tx rate and our record.
-			// Then return for next DRS.
-			pCurrTxRate = (PRTMP_TX_RATE_SWITCH) &pTable[(InitTxRateIdx+1)*5];
-			pEntry->CurrTxRateIndex = InitTxRateIdx;
-			MlmeSetTxRate(pAd, pEntry, pCurrTxRate);
-
-			// reset all OneSecTx counters
-			RESET_ONE_SEC_TX_CNT(pEntry);
-			continue;
-		}
-
-		// decide the next upgrade rate and downgrade rate, if any
-		if ((CurrRateIdx > 0) && (CurrRateIdx < (TableSize - 1)))
-		{
-			UpRateIdx = CurrRateIdx + 1;
-			DownRateIdx = CurrRateIdx -1;
-		}
-		else if (CurrRateIdx == 0)
-		{
-			UpRateIdx = CurrRateIdx + 1;
-			DownRateIdx = CurrRateIdx;
-		}
-		else if (CurrRateIdx == (TableSize - 1))
-		{
-			UpRateIdx = CurrRateIdx;
-			DownRateIdx = CurrRateIdx - 1;
-		}
-
-		pCurrTxRate = (PRTMP_TX_RATE_SWITCH) &pTable[(CurrRateIdx+1)*5];
-
-#ifdef DOT11_N_SUPPORT
-		if ((Rssi > -65) && (pCurrTxRate->Mode >= MODE_HTMIX))
-		{
-			TrainUp		= (pCurrTxRate->TrainUp + (pCurrTxRate->TrainUp >> 1));
-			TrainDown	= (pCurrTxRate->TrainDown + (pCurrTxRate->TrainDown >> 1));
-		}
-		else
-#endif // DOT11_N_SUPPORT //
-		{
-			TrainUp		= pCurrTxRate->TrainUp;
-			TrainDown	= pCurrTxRate->TrainDown;
-		}
-
-		//pAd->DrsCounters.LastTimeTxRateChangeAction = pAd->DrsCounters.LastSecTxRateChangeAction;
-
-		//
-		// Keep the last time TxRateChangeAction status.
-		//
-		pEntry->LastTimeTxRateChangeAction = pEntry->LastSecTxRateChangeAction;
-
-
-
-		//
-		// CASE 1. when TX samples are fewer than 15, then decide TX rate solely on RSSI
-		//         (criteria copied from RT2500 for Netopia case)
-		//
-		if (TxTotalCnt <= 15)
-		{
-			CHAR	idx = 0;
-			UCHAR	TxRateIdx;
-			UCHAR	MCS0 = 0, MCS1 = 0, MCS2 = 0, MCS3 = 0, MCS4 = 0,  MCS5 =0, MCS6 = 0, MCS7 = 0;
-	        UCHAR	MCS12 = 0, MCS13 = 0, MCS14 = 0, MCS15 = 0;
-			UCHAR	MCS20 = 0, MCS21 = 0, MCS22 = 0, MCS23 = 0; // 3*3
-
-			// check the existence and index of each needed MCS
-			while (idx < pTable[0])
-			{
-				pCurrTxRate = (PRTMP_TX_RATE_SWITCH) &pTable[(idx+1)*5];
-
-				if (pCurrTxRate->CurrMCS == MCS_0)
-				{
-					MCS0 = idx;
-				}
-				else if (pCurrTxRate->CurrMCS == MCS_1)
-				{
-					MCS1 = idx;
-				}
-				else if (pCurrTxRate->CurrMCS == MCS_2)
-				{
-					MCS2 = idx;
-				}
-				else if (pCurrTxRate->CurrMCS == MCS_3)
-				{
-					MCS3 = idx;
-				}
-				else if (pCurrTxRate->CurrMCS == MCS_4)
-				{
-					MCS4 = idx;
-				}
-	            else if (pCurrTxRate->CurrMCS == MCS_5)
-	            {
-	                MCS5 = idx;
-	            }
-	            else if (pCurrTxRate->CurrMCS == MCS_6)
-	            {
-	                MCS6 = idx;
-	            }
-				//else if (pCurrTxRate->CurrMCS == MCS_7)
-				else if ((pCurrTxRate->CurrMCS == MCS_7) && (pCurrTxRate->ShortGI == GI_800))	// prevent the highest MCS using short GI when 1T and low throughput
-				{
-					MCS7 = idx;
-				}
-				else if (pCurrTxRate->CurrMCS == MCS_12)
-				{
-					MCS12 = idx;
-				}
-				else if (pCurrTxRate->CurrMCS == MCS_13)
-				{
-					MCS13 = idx;
-				}
-				else if (pCurrTxRate->CurrMCS == MCS_14)
-				{
-					MCS14 = idx;
-				}
-				//else if ((pCurrTxRate->CurrMCS == MCS_15)/* && (pCurrTxRate->ShortGI == GI_800)*/)	//we hope to use ShortGI as initial rate
-				else if ((pCurrTxRate->CurrMCS == MCS_15) && (pCurrTxRate->ShortGI == GI_800))	//we hope to use ShortGI as initial rate, however Atheros's chip has bugs when short GI
-				{
-					MCS15 = idx;
-				}
-				else if (pCurrTxRate->CurrMCS == MCS_20) // 3*3
-				{
-					MCS20 = idx;
-				}
-				else if (pCurrTxRate->CurrMCS == MCS_21)
-				{
-					MCS21 = idx;
-				}
-				else if (pCurrTxRate->CurrMCS == MCS_22)
-				{
-					MCS22 = idx;
-				}
-				else if (pCurrTxRate->CurrMCS == MCS_23)
-				{
-					MCS23 = idx;
-				}
-				idx ++;
-			}
-
-			if (pAd->LatchRfRegs.Channel <= 14)
-			{
-				if (pAd->NicConfig2.field.ExternalLNAForG)
-				{
-					RssiOffset = 2;
-				}
-				else
-				{
-					RssiOffset = 5;
-				}
-			}
-			else
-			{
-				if (pAd->NicConfig2.field.ExternalLNAForA)
-				{
-					RssiOffset = 5;
-				}
-				else
-				{
-					RssiOffset = 8;
-				}
-			}
-#ifdef DOT11_N_SUPPORT
-			/*if (MCS15)*/
-			if ((pTable == RateSwitchTable11BGN3S) ||
-				(pTable == RateSwitchTable11N3S) ||
-				(pTable == RateSwitchTable))
-			{// N mode with 3 stream // 3*3
-				if (MCS23 && (Rssi >= -70))
-					TxRateIdx = MCS23;
-				else if (MCS22 && (Rssi >= -72))
-					TxRateIdx = MCS22;
-		    else if (MCS21 && (Rssi >= -76))
-					TxRateIdx = MCS21;
-				else if (MCS20 && (Rssi >= -78))
-					TxRateIdx = MCS20;
-			else if (MCS4 && (Rssi >= -82))
-				TxRateIdx = MCS4;
-			else if (MCS3 && (Rssi >= -84))
-				TxRateIdx = MCS3;
-			else if (MCS2 && (Rssi >= -86))
-				TxRateIdx = MCS2;
-			else if (MCS1 && (Rssi >= -88))
-				TxRateIdx = MCS1;
-			else
-				TxRateIdx = MCS0;
-		}
-//		else if ((pTable == RateSwitchTable11BGN2S) || (pTable == RateSwitchTable11BGN2SForABand) ||(pTable == RateSwitchTable11N2S) ||(pTable == RateSwitchTable11N2SForABand) || (pTable == RateSwitchTable))
-		else if ((pTable == RateSwitchTable11BGN2S) || (pTable == RateSwitchTable11BGN2SForABand) ||(pTable == RateSwitchTable11N2S) ||(pTable == RateSwitchTable11N2SForABand)) // 3*3
-			{// N mode with 2 stream
-				if (MCS15 && (Rssi >= (-70+RssiOffset)))
-					TxRateIdx = MCS15;
-				else if (MCS14 && (Rssi >= (-72+RssiOffset)))
-					TxRateIdx = MCS14;
-				else if (MCS13 && (Rssi >= (-76+RssiOffset)))
-					TxRateIdx = MCS13;
-				else if (MCS12 && (Rssi >= (-78+RssiOffset)))
-					TxRateIdx = MCS12;
-				else if (MCS4 && (Rssi >= (-82+RssiOffset)))
-					TxRateIdx = MCS4;
-				else if (MCS3 && (Rssi >= (-84+RssiOffset)))
-					TxRateIdx = MCS3;
-				else if (MCS2 && (Rssi >= (-86+RssiOffset)))
-					TxRateIdx = MCS2;
-				else if (MCS1 && (Rssi >= (-88+RssiOffset)))
-					TxRateIdx = MCS1;
-				else
-					TxRateIdx = MCS0;
-			}
-			else if ((pTable == RateSwitchTable11BGN1S) || (pTable == RateSwitchTable11N1S))
-			{// N mode with 1 stream
-				if (MCS7 && (Rssi > (-72+RssiOffset)))
-					TxRateIdx = MCS7;
-				else if (MCS6 && (Rssi > (-74+RssiOffset)))
-					TxRateIdx = MCS6;
-				else if (MCS5 && (Rssi > (-77+RssiOffset)))
-					TxRateIdx = MCS5;
-				else if (MCS4 && (Rssi > (-79+RssiOffset)))
-					TxRateIdx = MCS4;
-				else if (MCS3 && (Rssi > (-81+RssiOffset)))
-					TxRateIdx = MCS3;
-				else if (MCS2 && (Rssi > (-83+RssiOffset)))
-					TxRateIdx = MCS2;
-				else if (MCS1 && (Rssi > (-86+RssiOffset)))
-					TxRateIdx = MCS1;
-				else
-					TxRateIdx = MCS0;
-			}
-			else
-#endif // DOT11_N_SUPPORT //
-			{// Legacy mode
-				if (MCS7 && (Rssi > -70))
-					TxRateIdx = MCS7;
-				else if (MCS6 && (Rssi > -74))
-					TxRateIdx = MCS6;
-				else if (MCS5 && (Rssi > -78))
-					TxRateIdx = MCS5;
-				else if (MCS4 && (Rssi > -82))
-					TxRateIdx = MCS4;
-				else if (MCS4 == 0)	// for B-only mode
-					TxRateIdx = MCS3;
-				else if (MCS3 && (Rssi > -85))
-					TxRateIdx = MCS3;
-				else if (MCS2 && (Rssi > -87))
-					TxRateIdx = MCS2;
-				else if (MCS1 && (Rssi > -90))
-					TxRateIdx = MCS1;
-				else
-					TxRateIdx = MCS0;
-			}
-
-	//		if (TxRateIdx != pAd->CommonCfg.TxRateIndex)
-			{
-				pEntry->CurrTxRateIndex = TxRateIdx;
-				pNextTxRate = (PRTMP_TX_RATE_SWITCH) &pTable[(pEntry->CurrTxRateIndex+1)*5];
-				MlmeSetTxRate(pAd, pEntry, pNextTxRate);
-			}
-
-			NdisZeroMemory(pEntry->TxQuality, sizeof(USHORT) * MAX_STEP_OF_TX_RATE_SWITCH);
-			NdisZeroMemory(pEntry->PER, sizeof(UCHAR) * MAX_STEP_OF_TX_RATE_SWITCH);
-			pEntry->fLastSecAccordingRSSI = TRUE;
-			// reset all OneSecTx counters
-			RESET_ONE_SEC_TX_CNT(pEntry);
-
-			continue;
-		}
-
-		if (pEntry->fLastSecAccordingRSSI == TRUE)
-		{
-			pEntry->fLastSecAccordingRSSI = FALSE;
-			pEntry->LastSecTxRateChangeAction = 0;
-			// reset all OneSecTx counters
-			RESET_ONE_SEC_TX_CNT(pEntry);
-
-			continue;
-		}
-
-		do
-		{
-			BOOLEAN	bTrainUpDown = FALSE;
-
-			pEntry->CurrTxRateStableTime ++;
-
-			// downgrade TX quality if PER >= Rate-Down threshold
-			if (TxErrorRatio >= TrainDown)
-			{
-				bTrainUpDown = TRUE;
-				pEntry->TxQuality[CurrRateIdx] = DRS_TX_QUALITY_WORST_BOUND;
-			}
-			// upgrade TX quality if PER <= Rate-Up threshold
-			else if (TxErrorRatio <= TrainUp)
-			{
-				bTrainUpDown = TRUE;
-				bUpgradeQuality = TRUE;
-				if (pEntry->TxQuality[CurrRateIdx])
-					pEntry->TxQuality[CurrRateIdx] --;  // quality very good in CurrRate
-
-				if (pEntry->TxRateUpPenalty)
-					pEntry->TxRateUpPenalty --;
-				else if (pEntry->TxQuality[UpRateIdx])
-					pEntry->TxQuality[UpRateIdx] --;    // may improve next UP rate's quality
-			}
-
-			pEntry->PER[CurrRateIdx] = (UCHAR)TxErrorRatio;
-
-			if (bTrainUpDown)
-			{
-				// perform DRS - consider TxRate Down first, then rate up.
-				if ((CurrRateIdx != DownRateIdx) && (pEntry->TxQuality[CurrRateIdx] >= DRS_TX_QUALITY_WORST_BOUND))
-				{
-					pEntry->CurrTxRateIndex = DownRateIdx;
-				}
-				else if ((CurrRateIdx != UpRateIdx) && (pEntry->TxQuality[UpRateIdx] <= 0))
-				{
-					pEntry->CurrTxRateIndex = UpRateIdx;
-				}
-			}
-		} while (FALSE);
-
-		// if rate-up happen, clear all bad history of all TX rates
-		if (pEntry->CurrTxRateIndex > CurrRateIdx)
-		{
-			pEntry->CurrTxRateStableTime = 0;
-			pEntry->TxRateUpPenalty = 0;
-			pEntry->LastSecTxRateChangeAction = 1; // rate UP
-			NdisZeroMemory(pEntry->TxQuality, sizeof(USHORT) * MAX_STEP_OF_TX_RATE_SWITCH);
-			NdisZeroMemory(pEntry->PER, sizeof(UCHAR) * MAX_STEP_OF_TX_RATE_SWITCH);
-
-			//
-			// For TxRate fast train up
-			//
-			if (!pAd->StaCfg.StaQuickResponeForRateUpTimerRunning)
-			{
-				RTMPSetTimer(&pAd->StaCfg.StaQuickResponeForRateUpTimer, 100);
-
-				pAd->StaCfg.StaQuickResponeForRateUpTimerRunning = TRUE;
-			}
-			bTxRateChanged = TRUE;
-		}
-		// if rate-down happen, only clear DownRate's bad history
-		else if (pEntry->CurrTxRateIndex < CurrRateIdx)
-		{
-			pEntry->CurrTxRateStableTime = 0;
-			pEntry->TxRateUpPenalty = 0;           // no penalty
-			pEntry->LastSecTxRateChangeAction = 2; // rate DOWN
-			pEntry->TxQuality[pEntry->CurrTxRateIndex] = 0;
-			pEntry->PER[pEntry->CurrTxRateIndex] = 0;
-
-			//
-			// For TxRate fast train down
-			//
-			if (!pAd->StaCfg.StaQuickResponeForRateUpTimerRunning)
-			{
-				RTMPSetTimer(&pAd->StaCfg.StaQuickResponeForRateUpTimer, 100);
-
-				pAd->StaCfg.StaQuickResponeForRateUpTimerRunning = TRUE;
-			}
-			bTxRateChanged = TRUE;
-		}
-		else
-		{
-			pEntry->LastSecTxRateChangeAction = 0; // rate no change
-			bTxRateChanged = FALSE;
-		}
-
-		pEntry->LastTxOkCount = TxSuccess;
-
-		{
-			UCHAR tmpTxRate;
-
-			// to fix tcp ack issue
-			if (!bTxRateChanged && (pAd->RalinkCounters.OneSecReceivedByteCount > (pAd->RalinkCounters.OneSecTransmittedByteCount * 5)))
-			{
-				tmpTxRate = DownRateIdx;
-				DBGPRINT_RAW(RT_DEBUG_TRACE,("DRS: Rx(%d) is 5 times larger than Tx(%d), use low rate (curr=%d, tmp=%d)\n",
-					pAd->RalinkCounters.OneSecReceivedByteCount, pAd->RalinkCounters.OneSecTransmittedByteCount, pEntry->CurrTxRateIndex, tmpTxRate));
-			}
-			else
-			{
-				tmpTxRate = pEntry->CurrTxRateIndex;
-			}
-
-			pNextTxRate = (PRTMP_TX_RATE_SWITCH) &pTable[(tmpTxRate+1)*5];
-			if (bTxRateChanged && pNextTxRate)
-			{
-				MlmeSetTxRate(pAd, pEntry, pNextTxRate);
-			}
-		}
-		// reset all OneSecTx counters
-		RESET_ONE_SEC_TX_CNT(pEntry);
-	}
-}
-
-/*
-	========================================================================
-	Routine Description:
-		Station side, Auto TxRate faster train up timer call back function.
-
-	Arguments:
-		SystemSpecific1			- Not used.
-		FunctionContext			- Pointer to our Adapter context.
-		SystemSpecific2			- Not used.
-		SystemSpecific3			- Not used.
-
-	Return Value:
-		None
-
-	========================================================================
-*/
-VOID StaQuickResponeForRateUpExec(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3)
-{
-	PRTMP_ADAPTER			pAd = (PRTMP_ADAPTER)FunctionContext;
-	UCHAR					UpRateIdx = 0, DownRateIdx = 0, CurrRateIdx = 0;
-	ULONG					TxTotalCnt;
-	ULONG					TxErrorRatio = 0;
-	BOOLEAN					bTxRateChanged; //, bUpgradeQuality = FALSE;
-	PRTMP_TX_RATE_SWITCH	pCurrTxRate, pNextTxRate = NULL;
-	PUCHAR					pTable;
-	UCHAR					TableSize = 0;
-	UCHAR					InitTxRateIdx = 0, TrainUp, TrainDown;
-	TX_STA_CNT1_STRUC		StaTx1;
-	TX_STA_CNT0_STRUC		TxStaCnt0;
-	CHAR					Rssi, ratio;
-	ULONG					TxRetransmit = 0, TxSuccess = 0, TxFailCount = 0;
-	MAC_TABLE_ENTRY			*pEntry;
-	ULONG					i;
-
-	pAd->StaCfg.StaQuickResponeForRateUpTimerRunning = FALSE;
-
-    //
-    // walk through MAC table, see if need to change AP's TX rate toward each entry
-    //
-	for (i = 1; i < MAX_LEN_OF_MAC_TABLE; i++)
-	{
-		pEntry = &pAd->MacTab.Content[i];
-
-		// check if this entry need to switch rate automatically
-		if (RTMPCheckEntryEnableAutoRateSwitch(pAd, pEntry) == FALSE)
-			continue;
-
-		if (INFRA_ON(pAd) && (i == 1))
-			Rssi = RTMPMaxRssi(pAd,
-							   pAd->StaCfg.RssiSample.AvgRssi0,
-							   pAd->StaCfg.RssiSample.AvgRssi1,
-							   pAd->StaCfg.RssiSample.AvgRssi2);
-		else
-			Rssi = RTMPMaxRssi(pAd,
-							   pEntry->RssiSample.AvgRssi0,
-							   pEntry->RssiSample.AvgRssi1,
-							   pEntry->RssiSample.AvgRssi2);
-
-	CurrRateIdx = pAd->CommonCfg.TxRateIndex;
-
-			MlmeSelectTxRateTable(pAd, pEntry, &pTable, &TableSize, &InitTxRateIdx);
-
-	// decide the next upgrade rate and downgrade rate, if any
-	if ((CurrRateIdx > 0) && (CurrRateIdx < (TableSize - 1)))
-	{
-		UpRateIdx = CurrRateIdx + 1;
-		DownRateIdx = CurrRateIdx -1;
-	}
-	else if (CurrRateIdx == 0)
-	{
-		UpRateIdx = CurrRateIdx + 1;
-		DownRateIdx = CurrRateIdx;
-	}
-	else if (CurrRateIdx == (TableSize - 1))
-	{
-		UpRateIdx = CurrRateIdx;
-		DownRateIdx = CurrRateIdx - 1;
-	}
-
-	pCurrTxRate = (PRTMP_TX_RATE_SWITCH) &pTable[(CurrRateIdx+1)*5];
-
-#ifdef DOT11_N_SUPPORT
-	if ((Rssi > -65) && (pCurrTxRate->Mode >= MODE_HTMIX))
-	{
-		TrainUp		= (pCurrTxRate->TrainUp + (pCurrTxRate->TrainUp >> 1));
-		TrainDown	= (pCurrTxRate->TrainDown + (pCurrTxRate->TrainDown >> 1));
-	}
-	else
-#endif // DOT11_N_SUPPORT //
-	{
-		TrainUp		= pCurrTxRate->TrainUp;
-		TrainDown	= pCurrTxRate->TrainDown;
-	}
-
-		if (pAd->MacTab.Size == 1)
-		{
-	// Update statistic counter
-	RTMP_IO_READ32(pAd, TX_STA_CNT0, &TxStaCnt0.word);
-	RTMP_IO_READ32(pAd, TX_STA_CNT1, &StaTx1.word);
-
-	TxRetransmit = StaTx1.field.TxRetransmit;
-	TxSuccess = StaTx1.field.TxSuccess;
-	TxFailCount = TxStaCnt0.field.TxFailCount;
-	TxTotalCnt = TxRetransmit + TxSuccess + TxFailCount;
-
-	pAd->RalinkCounters.OneSecTxRetryOkCount += StaTx1.field.TxRetransmit;
-	pAd->RalinkCounters.OneSecTxNoRetryOkCount += StaTx1.field.TxSuccess;
-	pAd->RalinkCounters.OneSecTxFailCount += TxStaCnt0.field.TxFailCount;
-			pAd->WlanCounters.TransmittedFragmentCount.u.LowPart += StaTx1.field.TxSuccess;
-			pAd->WlanCounters.RetryCount.u.LowPart += StaTx1.field.TxRetransmit;
-			pAd->WlanCounters.FailedCount.u.LowPart += TxStaCnt0.field.TxFailCount;
-
-	if (TxTotalCnt)
-		TxErrorRatio = ((TxRetransmit + TxFailCount) * 100) / TxTotalCnt;
-		}
-		else
-		{
-			TxTotalCnt = pEntry->OneSecTxNoRetryOkCount +
-				 pEntry->OneSecTxRetryOkCount +
-				 pEntry->OneSecTxFailCount;
-
-			if (TxTotalCnt)
-				TxErrorRatio = ((pEntry->OneSecTxRetryOkCount + pEntry->OneSecTxFailCount) * 100) / TxTotalCnt;
-		}
-
-
-	//
-	// CASE 1. when TX samples are fewer than 15, then decide TX rate solely on RSSI
-	//         (criteria copied from RT2500 for Netopia case)
-	//
-	if (TxTotalCnt <= 12)
-	{
-		NdisZeroMemory(pAd->DrsCounters.TxQuality, sizeof(USHORT) * MAX_STEP_OF_TX_RATE_SWITCH);
-		NdisZeroMemory(pAd->DrsCounters.PER, sizeof(UCHAR) * MAX_STEP_OF_TX_RATE_SWITCH);
-
-		if ((pAd->DrsCounters.LastSecTxRateChangeAction == 1) && (CurrRateIdx != DownRateIdx))
-		{
-			pAd->CommonCfg.TxRateIndex = DownRateIdx;
-			pAd->DrsCounters.TxQuality[CurrRateIdx] = DRS_TX_QUALITY_WORST_BOUND;
-		}
-		else if ((pAd->DrsCounters.LastSecTxRateChangeAction == 2) && (CurrRateIdx != UpRateIdx))
-		{
-			pAd->CommonCfg.TxRateIndex = UpRateIdx;
-		}
-
-		DBGPRINT_RAW(RT_DEBUG_TRACE,("QuickDRS: TxTotalCnt <= 15, train back to original rate \n"));
-		return;
-	}
-
-	do
-	{
-		ULONG OneSecTxNoRetryOKRationCount;
-
-		if (pAd->DrsCounters.LastTimeTxRateChangeAction == 0)
-			ratio = 5;
-		else
-			ratio = 4;
-
-		// downgrade TX quality if PER >= Rate-Down threshold
-		if (TxErrorRatio >= TrainDown)
-		{
-			pAd->DrsCounters.TxQuality[CurrRateIdx] = DRS_TX_QUALITY_WORST_BOUND;
-		}
-
-		pAd->DrsCounters.PER[CurrRateIdx] = (UCHAR)TxErrorRatio;
-
-		OneSecTxNoRetryOKRationCount = (TxSuccess * ratio);
-
-		// perform DRS - consider TxRate Down first, then rate up.
-		if ((pAd->DrsCounters.LastSecTxRateChangeAction == 1) && (CurrRateIdx != DownRateIdx))
-		{
-			if ((pAd->DrsCounters.LastTxOkCount + 2) >= OneSecTxNoRetryOKRationCount)
-		{
-			pAd->CommonCfg.TxRateIndex = DownRateIdx;
-				pAd->DrsCounters.TxQuality[CurrRateIdx] = DRS_TX_QUALITY_WORST_BOUND;
-
-			}
-
-		}
-		else if ((pAd->DrsCounters.LastSecTxRateChangeAction == 2) && (CurrRateIdx != UpRateIdx))
-		{
-			if ((TxErrorRatio >= 50) || (TxErrorRatio >= TrainDown))
-			{
-
-			}
-			else if ((pAd->DrsCounters.LastTxOkCount + 2) >= OneSecTxNoRetryOKRationCount)
-			{
-				pAd->CommonCfg.TxRateIndex = UpRateIdx;
-			}
-		}
-	}while (FALSE);
-
-	// if rate-up happen, clear all bad history of all TX rates
-	if (pAd->CommonCfg.TxRateIndex > CurrRateIdx)
-	{
-		pAd->DrsCounters.TxRateUpPenalty = 0;
-		NdisZeroMemory(pAd->DrsCounters.TxQuality, sizeof(USHORT) * MAX_STEP_OF_TX_RATE_SWITCH);
-		NdisZeroMemory(pAd->DrsCounters.PER, sizeof(UCHAR) * MAX_STEP_OF_TX_RATE_SWITCH);
-			bTxRateChanged = TRUE;
-	}
-	// if rate-down happen, only clear DownRate's bad history
-	else if (pAd->CommonCfg.TxRateIndex < CurrRateIdx)
-	{
-		DBGPRINT_RAW(RT_DEBUG_TRACE,("QuickDRS: --TX rate from %d to %d \n", CurrRateIdx, pAd->CommonCfg.TxRateIndex));
-
-		pAd->DrsCounters.TxRateUpPenalty = 0;           // no penalty
-		pAd->DrsCounters.TxQuality[pAd->CommonCfg.TxRateIndex] = 0;
-		pAd->DrsCounters.PER[pAd->CommonCfg.TxRateIndex] = 0;
-			bTxRateChanged = TRUE;
-	}
-	else
-	{
-		bTxRateChanged = FALSE;
-	}
-
-	pNextTxRate = (PRTMP_TX_RATE_SWITCH) &pTable[(pAd->CommonCfg.TxRateIndex+1)*5];
-	if (bTxRateChanged && pNextTxRate)
-	{
-			MlmeSetTxRate(pAd, pEntry, pNextTxRate);
-		}
-	}
-}
-
-/*
-	==========================================================================
-	Description:
-		This routine is executed periodically inside MlmePeriodicExec() after
-		association with an AP.
-		It checks if StaCfg.Psm is consistent with user policy (recorded in
-		StaCfg.WindowsPowerMode). If not, enforce user policy. However,
-		there're some conditions to consider:
-		1. we don't support power-saving in ADHOC mode, so Psm=PWR_ACTIVE all
-		   the time when Mibss==TRUE
-		2. When link up in INFRA mode, Psm should not be switch to PWR_SAVE
-		   if outgoing traffic available in TxRing or MgmtRing.
-	Output:
-		1. change pAd->StaCfg.Psm to PWR_SAVE or leave it untouched
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-VOID MlmeCheckPsmChange(
-	IN PRTMP_ADAPTER pAd,
-	IN ULONG	Now32)
-{
-	ULONG	PowerMode;
-
-	// condition -
-	// 1. Psm maybe ON only happen in INFRASTRUCTURE mode
-	// 2. user wants either MAX_PSP or FAST_PSP
-	// 3. but current psm is not in PWR_SAVE
-	// 4. CNTL state machine is not doing SCANning
-	// 5. no TX SUCCESS event for the past 1-sec period
-	PowerMode = pAd->StaCfg.WindowsPowerMode;
-
-	if (INFRA_ON(pAd) &&
-		(PowerMode != Ndis802_11PowerModeCAM) &&
-		(pAd->StaCfg.Psm == PWR_ACTIVE) &&
-//		(! RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS))
-		(pAd->Mlme.CntlMachine.CurrState == CNTL_IDLE)&&
-		RTMP_TEST_PSFLAG(pAd, fRTMP_PS_CAN_GO_SLEEP)
-		 /*&&
-		(pAd->RalinkCounters.OneSecTxNoRetryOkCount == 0) &&
-		(pAd->RalinkCounters.OneSecTxRetryOkCount == 0)*/)
-	{
-		NdisGetSystemUpTime(&pAd->Mlme.LastSendNULLpsmTime);
-		pAd->RalinkCounters.RxCountSinceLastNULL = 0;
-		RTMP_SET_PSM_BIT(pAd, PWR_SAVE);
-		if (!(pAd->CommonCfg.bAPSDCapable && pAd->CommonCfg.APEdcaParm.bAPSDCapable))
-		{
-			RTMPSendNullFrame(pAd, pAd->CommonCfg.TxRate, FALSE);
-		}
-		else
-		{
-			RTMPSendNullFrame(pAd, pAd->CommonCfg.TxRate, TRUE);
-		}
-	}
-}
-
-// IRQL = PASSIVE_LEVEL
-// IRQL = DISPATCH_LEVEL
-VOID MlmeSetPsmBit(
-	IN PRTMP_ADAPTER pAd,
-	IN USHORT psm)
-{
-	AUTO_RSP_CFG_STRUC csr4;
-
-	pAd->StaCfg.Psm = psm;
-	RTMP_IO_READ32(pAd, AUTO_RSP_CFG, &csr4.word);
-	csr4.field.AckCtsPsmBit = (psm == PWR_SAVE)? 1:0;
-	RTMP_IO_WRITE32(pAd, AUTO_RSP_CFG, csr4.word);
-	DBGPRINT(RT_DEBUG_TRACE, ("MlmeSetPsmBit = %d\n", psm));
-}
-#endif // CONFIG_STA_SUPPORT //
-
-/*
-	==========================================================================
-	Description:
-		This routine calculates TxPER, RxPER of the past N-sec period. And
-		according to the calculation result, ChannelQuality is calculated here
-		to decide if current AP is still doing the job.
-
-		If ChannelQuality is not good, a ROAMing attempt may be tried later.
-	Output:
-		StaCfg.ChannelQuality - 0..100
-
-	IRQL = DISPATCH_LEVEL
-
-	NOTE: This routine decide channle quality based on RX CRC error ratio.
-		Caller should make sure a function call to NICUpdateRawCounters(pAd)
-		is performed right before this routine, so that this routine can decide
-		channel quality based on the most up-to-date information
-	==========================================================================
- */
-VOID MlmeCalculateChannelQuality(
-	IN PRTMP_ADAPTER pAd,
-	IN PMAC_TABLE_ENTRY pMacEntry,
-	IN ULONG Now32)
-{
-	ULONG TxOkCnt, TxCnt, TxPER, TxPRR;
-	ULONG RxCnt, RxPER;
-	UCHAR NorRssi;
-	CHAR  MaxRssi;
-	RSSI_SAMPLE *pRssiSample = NULL;
-	UINT32 OneSecTxNoRetryOkCount = 0;
-	UINT32 OneSecTxRetryOkCount = 0;
-	UINT32 OneSecTxFailCount = 0;
-	UINT32 OneSecRxOkCnt = 0;
-	UINT32 OneSecRxFcsErrCnt = 0;
-	ULONG ChannelQuality = 0;  // 0..100, Channel Quality Indication for Roaming
-#ifdef CONFIG_STA_SUPPORT
-	ULONG BeaconLostTime = pAd->StaCfg.BeaconLostTime;
-#endif // CONFIG_STA_SUPPORT //
-
-#ifdef CONFIG_STA_SUPPORT
-#ifdef CARRIER_DETECTION_SUPPORT // Roger sync Carrier
-	// longer beacon lost time when carrier detection enabled
-	if (pAd->CommonCfg.CarrierDetect.Enable == TRUE)
-	{
-		BeaconLostTime = pAd->StaCfg.BeaconLostTime + (pAd->StaCfg.BeaconLostTime/2);
-	}
-#endif // CARRIER_DETECTION_SUPPORT //
-#endif // CONFIG_STA_SUPPORT //
-
-#ifdef CONFIG_STA_SUPPORT
-	if (pAd->OpMode == OPMODE_STA)
-	{
-		pRssiSample = &pAd->StaCfg.RssiSample;
-		OneSecTxNoRetryOkCount = pAd->RalinkCounters.OneSecTxNoRetryOkCount;
-		OneSecTxRetryOkCount = pAd->RalinkCounters.OneSecTxRetryOkCount;
-		OneSecTxFailCount = pAd->RalinkCounters.OneSecTxFailCount;
-		OneSecRxOkCnt = pAd->RalinkCounters.OneSecRxOkCnt;
-		OneSecRxFcsErrCnt = pAd->RalinkCounters.OneSecRxFcsErrCnt;
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-	MaxRssi = RTMPMaxRssi(pAd, pRssiSample->LastRssi0,
-								pRssiSample->LastRssi1,
-								pRssiSample->LastRssi2);
-
-	//
-	// calculate TX packet error ratio and TX retry ratio - if too few TX samples, skip TX related statistics
-	//
-	TxOkCnt = OneSecTxNoRetryOkCount + OneSecTxRetryOkCount;
-	TxCnt = TxOkCnt + OneSecTxFailCount;
-	if (TxCnt < 5)
-	{
-		TxPER = 0;
-		TxPRR = 0;
-	}
-	else
-	{
-		TxPER = (OneSecTxFailCount * 100) / TxCnt;
-		TxPRR = ((TxCnt - OneSecTxNoRetryOkCount) * 100) / TxCnt;
-	}
-
-	//
-	// calculate RX PER - don't take RxPER into consideration if too few sample
-	//
-	RxCnt = OneSecRxOkCnt + OneSecRxFcsErrCnt;
-	if (RxCnt < 5)
-		RxPER = 0;
-	else
-		RxPER = (OneSecRxFcsErrCnt * 100) / RxCnt;
-
-	//
-	// decide ChannelQuality based on: 1)last BEACON received time, 2)last RSSI, 3)TxPER, and 4)RxPER
-	//
-#ifdef CONFIG_STA_SUPPORT
-	if ((pAd->OpMode == OPMODE_STA) &&
-		INFRA_ON(pAd) &&
-		(OneSecTxNoRetryOkCount < 2) && // no heavy traffic
-		((pAd->StaCfg.LastBeaconRxTime + BeaconLostTime) < Now32))
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("BEACON lost > %ld msec with TxOkCnt=%ld -> CQI=0\n", BeaconLostTime, TxOkCnt));
-		ChannelQuality = 0;
-	}
-	else
-#endif // CONFIG_STA_SUPPORT //
-	{
-		// Normalize Rssi
-		if (MaxRssi > -40)
-			NorRssi = 100;
-		else if (MaxRssi < -90)
-			NorRssi = 0;
-		else
-			NorRssi = (MaxRssi + 90) * 2;
-
-		// ChannelQuality = W1*RSSI + W2*TxPRR + W3*RxPER	 (RSSI 0..100), (TxPER 100..0), (RxPER 100..0)
-		ChannelQuality = (RSSI_WEIGHTING * NorRssi +
-								   TX_WEIGHTING * (100 - TxPRR) +
-								   RX_WEIGHTING* (100 - RxPER)) / 100;
-	}
-
-
-#ifdef CONFIG_STA_SUPPORT
-	if (pAd->OpMode == OPMODE_STA)
-		pAd->Mlme.ChannelQuality = (ChannelQuality > 100) ? 100 : ChannelQuality;
-#endif // CONFIG_STA_SUPPORT //
-
-
-}
-
-
-// IRQL = DISPATCH_LEVEL
-VOID MlmeSetTxPreamble(
-	IN PRTMP_ADAPTER pAd,
-	IN USHORT TxPreamble)
-{
-	AUTO_RSP_CFG_STRUC csr4;
-
-	//
-	// Always use Long preamble before verifiation short preamble functionality works well.
-	// Todo: remove the following line if short preamble functionality works
-	//
-	//TxPreamble = Rt802_11PreambleLong;
-
-	RTMP_IO_READ32(pAd, AUTO_RSP_CFG, &csr4.word);
-	if (TxPreamble == Rt802_11PreambleLong)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("MlmeSetTxPreamble (= LONG PREAMBLE)\n"));
-		OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_SHORT_PREAMBLE_INUSED);
-		csr4.field.AutoResponderPreamble = 0;
-	}
-	else
-	{
-		// NOTE: 1Mbps should always use long preamble
-		DBGPRINT(RT_DEBUG_TRACE, ("MlmeSetTxPreamble (= SHORT PREAMBLE)\n"));
-		OPSTATUS_SET_FLAG(pAd, fOP_STATUS_SHORT_PREAMBLE_INUSED);
-		csr4.field.AutoResponderPreamble = 1;
-	}
-
-	RTMP_IO_WRITE32(pAd, AUTO_RSP_CFG, csr4.word);
-}
-
-/*
-    ==========================================================================
-    Description:
-        Update basic rate bitmap
-    ==========================================================================
- */
-
-VOID UpdateBasicRateBitmap(
-    IN  PRTMP_ADAPTER   pAdapter)
-{
-    INT  i, j;
-                  /* 1  2  5.5, 11,  6,  9, 12, 18, 24, 36, 48,  54 */
-    UCHAR rate[] = { 2, 4,  11, 22, 12, 18, 24, 36, 48, 72, 96, 108 };
-    UCHAR *sup_p = pAdapter->CommonCfg.SupRate;
-    UCHAR *ext_p = pAdapter->CommonCfg.ExtRate;
-    ULONG bitmap = pAdapter->CommonCfg.BasicRateBitmap;
-
-
-    /* if A mode, always use fix BasicRateBitMap */
-    //if (pAdapter->CommonCfg.Channel == PHY_11A)
-	if (pAdapter->CommonCfg.Channel > 14)
-        pAdapter->CommonCfg.BasicRateBitmap = 0x150; /* 6, 12, 24M */
-    /* End of if */
-
-    if (pAdapter->CommonCfg.BasicRateBitmap > 4095)
-    {
-        /* (2 ^ MAX_LEN_OF_SUPPORTED_RATES) -1 */
-        return;
-    } /* End of if */
-
-    for(i=0; i<MAX_LEN_OF_SUPPORTED_RATES; i++)
-    {
-        sup_p[i] &= 0x7f;
-        ext_p[i] &= 0x7f;
-    } /* End of for */
-
-    for(i=0; i<MAX_LEN_OF_SUPPORTED_RATES; i++)
-    {
-        if (bitmap & (1 << i))
-        {
-            for(j=0; j<MAX_LEN_OF_SUPPORTED_RATES; j++)
-            {
-                if (sup_p[j] == rate[i])
-                    sup_p[j] |= 0x80;
-                /* End of if */
-            } /* End of for */
-
-            for(j=0; j<MAX_LEN_OF_SUPPORTED_RATES; j++)
-            {
-                if (ext_p[j] == rate[i])
-                    ext_p[j] |= 0x80;
-                /* End of if */
-            } /* End of for */
-        } /* End of if */
-    } /* End of for */
-} /* End of UpdateBasicRateBitmap */
-
-// IRQL = PASSIVE_LEVEL
-// IRQL = DISPATCH_LEVEL
-// bLinkUp is to identify the inital link speed.
-// TRUE indicates the rate update at linkup, we should not try to set the rate at 54Mbps.
-VOID MlmeUpdateTxRates(
-	IN PRTMP_ADAPTER		pAd,
-	IN	BOOLEAN				bLinkUp,
-	IN	UCHAR				apidx)
-{
-	int i, num;
-	UCHAR Rate = RATE_6, MaxDesire = RATE_1, MaxSupport = RATE_1;
-	UCHAR MinSupport = RATE_54;
-	ULONG BasicRateBitmap = 0;
-	UCHAR CurrBasicRate = RATE_1;
-	UCHAR *pSupRate, SupRateLen, *pExtRate, ExtRateLen;
-	PHTTRANSMIT_SETTING		pHtPhy = NULL;
-	PHTTRANSMIT_SETTING		pMaxHtPhy = NULL;
-	PHTTRANSMIT_SETTING		pMinHtPhy = NULL;
-	BOOLEAN					*auto_rate_cur_p;
-	UCHAR					HtMcs = MCS_AUTO;
-
-	// find max desired rate
-	UpdateBasicRateBitmap(pAd);
-
-	num = 0;
-	auto_rate_cur_p = NULL;
-	for (i=0; i<MAX_LEN_OF_SUPPORTED_RATES; i++)
-	{
-		switch (pAd->CommonCfg.DesireRate[i] & 0x7f)
-		{
-			case 2:  Rate = RATE_1;   num++;   break;
-			case 4:  Rate = RATE_2;   num++;   break;
-			case 11: Rate = RATE_5_5; num++;   break;
-			case 22: Rate = RATE_11;  num++;   break;
-			case 12: Rate = RATE_6;   num++;   break;
-			case 18: Rate = RATE_9;   num++;   break;
-			case 24: Rate = RATE_12;  num++;   break;
-			case 36: Rate = RATE_18;  num++;   break;
-			case 48: Rate = RATE_24;  num++;   break;
-			case 72: Rate = RATE_36;  num++;   break;
-			case 96: Rate = RATE_48;  num++;   break;
-			case 108: Rate = RATE_54; num++;   break;
-			//default: Rate = RATE_1;   break;
-		}
-		if (MaxDesire < Rate)  MaxDesire = Rate;
-	}
-
-//===========================================================================
-//===========================================================================
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-		pHtPhy		= &pAd->StaCfg.HTPhyMode;
-		pMaxHtPhy	= &pAd->StaCfg.MaxHTPhyMode;
-		pMinHtPhy	= &pAd->StaCfg.MinHTPhyMode;
-
-		auto_rate_cur_p = &pAd->StaCfg.bAutoTxRateSwitch;
-		HtMcs		= pAd->StaCfg.DesiredTransmitSetting.field.MCS;
-
-		if ((pAd->StaCfg.BssType == BSS_ADHOC) &&
-			(pAd->CommonCfg.PhyMode == PHY_11B) &&
-		(MaxDesire > RATE_11))
-		{
-			MaxDesire = RATE_11;
-		}
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-	pAd->CommonCfg.MaxDesiredRate = MaxDesire;
-	pMinHtPhy->word = 0;
-	pMaxHtPhy->word = 0;
-	pHtPhy->word = 0;
-
-	// Auto rate switching is enabled only if more than one DESIRED RATES are
-	// specified; otherwise disabled
-	if (num <= 1)
-	{
-		//OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_TX_RATE_SWITCH_ENABLED);
-		//pAd->CommonCfg.bAutoTxRateSwitch	= FALSE;
-		*auto_rate_cur_p = FALSE;
-	}
-	else
-	{
-		//OPSTATUS_SET_FLAG(pAd, fOP_STATUS_TX_RATE_SWITCH_ENABLED);
-		//pAd->CommonCfg.bAutoTxRateSwitch	= TRUE;
-		*auto_rate_cur_p = TRUE;
-	}
-
-	if (HtMcs != MCS_AUTO)
-	{
-		//OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_TX_RATE_SWITCH_ENABLED);
-		//pAd->CommonCfg.bAutoTxRateSwitch	= FALSE;
-		*auto_rate_cur_p = FALSE;
-	}
-	else
-	{
-		//OPSTATUS_SET_FLAG(pAd, fOP_STATUS_TX_RATE_SWITCH_ENABLED);
-		//pAd->CommonCfg.bAutoTxRateSwitch	= TRUE;
-		*auto_rate_cur_p = TRUE;
-	}
-
-#ifdef CONFIG_STA_SUPPORT
-	if ((ADHOC_ON(pAd) || INFRA_ON(pAd)) && (pAd->OpMode == OPMODE_STA))
-	{
-		pSupRate = &pAd->StaActive.SupRate[0];
-		pExtRate = &pAd->StaActive.ExtRate[0];
-		SupRateLen = pAd->StaActive.SupRateLen;
-		ExtRateLen = pAd->StaActive.ExtRateLen;
-	}
-	else
-#endif // CONFIG_STA_SUPPORT //
-	{
-		pSupRate = &pAd->CommonCfg.SupRate[0];
-		pExtRate = &pAd->CommonCfg.ExtRate[0];
-		SupRateLen = pAd->CommonCfg.SupRateLen;
-		ExtRateLen = pAd->CommonCfg.ExtRateLen;
-	}
-
-	// find max supported rate
-	for (i=0; i<SupRateLen; i++)
-	{
-		switch (pSupRate[i] & 0x7f)
-		{
-			case 2:   Rate = RATE_1;	if (pSupRate[i] & 0x80) BasicRateBitmap |= 0x0001;	 break;
-			case 4:   Rate = RATE_2;	if (pSupRate[i] & 0x80) BasicRateBitmap |= 0x0002;	 break;
-			case 11:  Rate = RATE_5_5;	if (pSupRate[i] & 0x80) BasicRateBitmap |= 0x0004;	 break;
-			case 22:  Rate = RATE_11;	if (pSupRate[i] & 0x80) BasicRateBitmap |= 0x0008;	 break;
-			case 12:  Rate = RATE_6;	/*if (pSupRate[i] & 0x80)*/  BasicRateBitmap |= 0x0010;  break;
-			case 18:  Rate = RATE_9;	if (pSupRate[i] & 0x80) BasicRateBitmap |= 0x0020;	 break;
-			case 24:  Rate = RATE_12;	/*if (pSupRate[i] & 0x80)*/  BasicRateBitmap |= 0x0040;  break;
-			case 36:  Rate = RATE_18;	if (pSupRate[i] & 0x80) BasicRateBitmap |= 0x0080;	 break;
-			case 48:  Rate = RATE_24;	/*if (pSupRate[i] & 0x80)*/  BasicRateBitmap |= 0x0100;  break;
-			case 72:  Rate = RATE_36;	if (pSupRate[i] & 0x80) BasicRateBitmap |= 0x0200;	 break;
-			case 96:  Rate = RATE_48;	if (pSupRate[i] & 0x80) BasicRateBitmap |= 0x0400;	 break;
-			case 108: Rate = RATE_54;	if (pSupRate[i] & 0x80) BasicRateBitmap |= 0x0800;	 break;
-			default:  Rate = RATE_1;	break;
-		}
-		if (MaxSupport < Rate)	MaxSupport = Rate;
-
-		if (MinSupport > Rate) MinSupport = Rate;
-	}
-
-	for (i=0; i<ExtRateLen; i++)
-	{
-		switch (pExtRate[i] & 0x7f)
-		{
-			case 2:   Rate = RATE_1;	if (pExtRate[i] & 0x80) BasicRateBitmap |= 0x0001;	 break;
-			case 4:   Rate = RATE_2;	if (pExtRate[i] & 0x80) BasicRateBitmap |= 0x0002;	 break;
-			case 11:  Rate = RATE_5_5;	if (pExtRate[i] & 0x80) BasicRateBitmap |= 0x0004;	 break;
-			case 22:  Rate = RATE_11;	if (pExtRate[i] & 0x80) BasicRateBitmap |= 0x0008;	 break;
-			case 12:  Rate = RATE_6;	/*if (pExtRate[i] & 0x80)*/  BasicRateBitmap |= 0x0010;  break;
-			case 18:  Rate = RATE_9;	if (pExtRate[i] & 0x80) BasicRateBitmap |= 0x0020;	 break;
-			case 24:  Rate = RATE_12;	/*if (pExtRate[i] & 0x80)*/  BasicRateBitmap |= 0x0040;  break;
-			case 36:  Rate = RATE_18;	if (pExtRate[i] & 0x80) BasicRateBitmap |= 0x0080;	 break;
-			case 48:  Rate = RATE_24;	/*if (pExtRate[i] & 0x80)*/  BasicRateBitmap |= 0x0100;  break;
-			case 72:  Rate = RATE_36;	if (pExtRate[i] & 0x80) BasicRateBitmap |= 0x0200;	 break;
-			case 96:  Rate = RATE_48;	if (pExtRate[i] & 0x80) BasicRateBitmap |= 0x0400;	 break;
-			case 108: Rate = RATE_54;	if (pExtRate[i] & 0x80) BasicRateBitmap |= 0x0800;	 break;
-			default:  Rate = RATE_1;	break;
-		}
-		if (MaxSupport < Rate)	MaxSupport = Rate;
-
-		if (MinSupport > Rate) MinSupport = Rate;
-	}
-
-	RTMP_IO_WRITE32(pAd, LEGACY_BASIC_RATE, BasicRateBitmap);
-
-	// bug fix
-	// pAd->CommonCfg.BasicRateBitmap = BasicRateBitmap;
-
-	// calculate the exptected ACK rate for each TX rate. This info is used to caculate
-	// the DURATION field of outgoing uniicast DATA/MGMT frame
-	for (i=0; i<MAX_LEN_OF_SUPPORTED_RATES; i++)
-	{
-		if (BasicRateBitmap & (0x01 << i))
-			CurrBasicRate = (UCHAR)i;
-		pAd->CommonCfg.ExpectedACKRate[i] = CurrBasicRate;
-	}
-
-	DBGPRINT(RT_DEBUG_TRACE,("MlmeUpdateTxRates[MaxSupport = %d] = MaxDesire %d Mbps\n", RateIdToMbps[MaxSupport], RateIdToMbps[MaxDesire]));
-	// max tx rate = min {max desire rate, max supported rate}
-	if (MaxSupport < MaxDesire)
-		pAd->CommonCfg.MaxTxRate = MaxSupport;
-	else
-		pAd->CommonCfg.MaxTxRate = MaxDesire;
-
-	pAd->CommonCfg.MinTxRate = MinSupport;
-	// 2003-07-31 john - 2500 doesn't have good sensitivity at high OFDM rates. to increase the success
-	// ratio of initial DHCP packet exchange, TX rate starts from a lower rate depending
-	// on average RSSI
-	//	 1. RSSI >= -70db, start at 54 Mbps (short distance)
-	//	 2. -70 > RSSI >= -75, start at 24 Mbps (mid distance)
-	//	 3. -75 > RSSI, start at 11 Mbps (long distance)
-	//if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_TX_RATE_SWITCH_ENABLED)/* &&
-	//	OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED)*/)
-	if (*auto_rate_cur_p)
-	{
-		short dbm = 0;
-#ifdef CONFIG_STA_SUPPORT
-		IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-			dbm = pAd->StaCfg.RssiSample.AvgRssi0 - pAd->BbpRssiToDbmDelta;
-#endif // CONFIG_STA_SUPPORT //
-		if (bLinkUp == TRUE)
-			pAd->CommonCfg.TxRate = RATE_24;
-		else
-			pAd->CommonCfg.TxRate = pAd->CommonCfg.MaxTxRate;
-
-		if (dbm < -75)
-			pAd->CommonCfg.TxRate = RATE_11;
-		else if (dbm < -70)
-			pAd->CommonCfg.TxRate = RATE_24;
-
-		// should never exceed MaxTxRate (consider 11B-only mode)
-		if (pAd->CommonCfg.TxRate > pAd->CommonCfg.MaxTxRate)
-			pAd->CommonCfg.TxRate = pAd->CommonCfg.MaxTxRate;
-
-		pAd->CommonCfg.TxRateIndex = 0;
-	}
-	else
-	{
-		pAd->CommonCfg.TxRate = pAd->CommonCfg.MaxTxRate;
-		pHtPhy->field.MCS	= (pAd->CommonCfg.MaxTxRate > 3) ? (pAd->CommonCfg.MaxTxRate - 4) : pAd->CommonCfg.MaxTxRate;
-		pHtPhy->field.MODE	= (pAd->CommonCfg.MaxTxRate > 3) ? MODE_OFDM : MODE_CCK;
-
-		pAd->MacTab.Content[BSSID_WCID].HTPhyMode.field.STBC	= pHtPhy->field.STBC;
-		pAd->MacTab.Content[BSSID_WCID].HTPhyMode.field.ShortGI	= pHtPhy->field.ShortGI;
-		pAd->MacTab.Content[BSSID_WCID].HTPhyMode.field.MCS		= pHtPhy->field.MCS;
-		pAd->MacTab.Content[BSSID_WCID].HTPhyMode.field.MODE	= pHtPhy->field.MODE;
-	}
-
-	if (pAd->CommonCfg.TxRate <= RATE_11)
-	{
-		pMaxHtPhy->field.MODE = MODE_CCK;
-		pMaxHtPhy->field.MCS = pAd->CommonCfg.TxRate;
-		pMinHtPhy->field.MCS = pAd->CommonCfg.MinTxRate;
-	}
-	else
-	{
-		pMaxHtPhy->field.MODE = MODE_OFDM;
-		pMaxHtPhy->field.MCS = OfdmRateToRxwiMCS[pAd->CommonCfg.TxRate];
-		if (pAd->CommonCfg.MinTxRate >= RATE_6 && (pAd->CommonCfg.MinTxRate <= RATE_54))
-			{pMinHtPhy->field.MCS = OfdmRateToRxwiMCS[pAd->CommonCfg.MinTxRate];}
-		else
-			{pMinHtPhy->field.MCS = pAd->CommonCfg.MinTxRate;}
-	}
-
-	pHtPhy->word = (pMaxHtPhy->word);
-	if (bLinkUp && (pAd->OpMode == OPMODE_STA))
-	{
-			pAd->MacTab.Content[BSSID_WCID].HTPhyMode.word = pHtPhy->word;
-			pAd->MacTab.Content[BSSID_WCID].MaxHTPhyMode.word = pMaxHtPhy->word;
-			pAd->MacTab.Content[BSSID_WCID].MinHTPhyMode.word = pMinHtPhy->word;
-	}
-	else
-	{
-		switch (pAd->CommonCfg.PhyMode)
-		{
-			case PHY_11BG_MIXED:
-			case PHY_11B:
-#ifdef DOT11_N_SUPPORT
-			case PHY_11BGN_MIXED:
-#endif // DOT11_N_SUPPORT //
-				pAd->CommonCfg.MlmeRate = RATE_1;
-				pAd->CommonCfg.MlmeTransmit.field.MODE = MODE_CCK;
-				pAd->CommonCfg.MlmeTransmit.field.MCS = RATE_1;
-
-//#ifdef	WIFI_TEST
-				pAd->CommonCfg.RtsRate = RATE_11;
-//#else
-//				pAd->CommonCfg.RtsRate = RATE_1;
-//#endif
-				break;
-			case PHY_11G:
-			case PHY_11A:
-#ifdef DOT11_N_SUPPORT
-			case PHY_11AGN_MIXED:
-			case PHY_11GN_MIXED:
-			case PHY_11N_2_4G:
-			case PHY_11AN_MIXED:
-			case PHY_11N_5G:
-#endif // DOT11_N_SUPPORT //
-				pAd->CommonCfg.MlmeRate = RATE_6;
-				pAd->CommonCfg.RtsRate = RATE_6;
-				pAd->CommonCfg.MlmeTransmit.field.MODE = MODE_OFDM;
-				pAd->CommonCfg.MlmeTransmit.field.MCS = OfdmRateToRxwiMCS[pAd->CommonCfg.MlmeRate];
-				break;
-			case PHY_11ABG_MIXED:
-#ifdef DOT11_N_SUPPORT
-			case PHY_11ABGN_MIXED:
-#endif // DOT11_N_SUPPORT //
-				if (pAd->CommonCfg.Channel <= 14)
-				{
-					pAd->CommonCfg.MlmeRate = RATE_1;
-					pAd->CommonCfg.RtsRate = RATE_1;
-					pAd->CommonCfg.MlmeTransmit.field.MODE = MODE_CCK;
-					pAd->CommonCfg.MlmeTransmit.field.MCS = RATE_1;
-				}
-				else
-				{
-					pAd->CommonCfg.MlmeRate = RATE_6;
-					pAd->CommonCfg.RtsRate = RATE_6;
-					pAd->CommonCfg.MlmeTransmit.field.MODE = MODE_OFDM;
-					pAd->CommonCfg.MlmeTransmit.field.MCS = OfdmRateToRxwiMCS[pAd->CommonCfg.MlmeRate];
-				}
-				break;
-			default: // error
-				pAd->CommonCfg.MlmeRate = RATE_6;
-				pAd->CommonCfg.MlmeTransmit.field.MODE = MODE_OFDM;
-				pAd->CommonCfg.MlmeTransmit.field.MCS = OfdmRateToRxwiMCS[pAd->CommonCfg.MlmeRate];
-				pAd->CommonCfg.RtsRate = RATE_1;
-				break;
-		}
-		//
-		// Keep Basic Mlme Rate.
-		//
-		pAd->MacTab.Content[MCAST_WCID].HTPhyMode.word = pAd->CommonCfg.MlmeTransmit.word;
-		if (pAd->CommonCfg.MlmeTransmit.field.MODE == MODE_OFDM)
-			pAd->MacTab.Content[MCAST_WCID].HTPhyMode.field.MCS = OfdmRateToRxwiMCS[RATE_24];
-		else
-			pAd->MacTab.Content[MCAST_WCID].HTPhyMode.field.MCS = RATE_1;
-		pAd->CommonCfg.BasicMlmeRate = pAd->CommonCfg.MlmeRate;
-	}
-
-	DBGPRINT(RT_DEBUG_TRACE, (" MlmeUpdateTxRates (MaxDesire=%d, MaxSupport=%d, MaxTxRate=%d, MinRate=%d, Rate Switching =%d)\n",
-			 RateIdToMbps[MaxDesire], RateIdToMbps[MaxSupport], RateIdToMbps[pAd->CommonCfg.MaxTxRate], RateIdToMbps[pAd->CommonCfg.MinTxRate],
-			 /*OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_TX_RATE_SWITCH_ENABLED)*/*auto_rate_cur_p));
-	DBGPRINT(RT_DEBUG_TRACE, (" MlmeUpdateTxRates (TxRate=%d, RtsRate=%d, BasicRateBitmap=0x%04lx)\n",
-			 RateIdToMbps[pAd->CommonCfg.TxRate], RateIdToMbps[pAd->CommonCfg.RtsRate], BasicRateBitmap));
-	DBGPRINT(RT_DEBUG_TRACE, ("MlmeUpdateTxRates (MlmeTransmit=0x%x, MinHTPhyMode=%x, MaxHTPhyMode=0x%x, HTPhyMode=0x%x)\n",
-			 pAd->CommonCfg.MlmeTransmit.word, pAd->MacTab.Content[BSSID_WCID].MinHTPhyMode.word ,pAd->MacTab.Content[BSSID_WCID].MaxHTPhyMode.word ,pAd->MacTab.Content[BSSID_WCID].HTPhyMode.word ));
-}
-
-#ifdef DOT11_N_SUPPORT
-/*
-	==========================================================================
-	Description:
-		This function update HT Rate setting.
-		Input Wcid value is valid for 2 case :
-		1. it's used for Station in infra mode that copy AP rate to Mactable.
-		2. OR Station	in adhoc mode to copy peer's HT rate to Mactable.
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-VOID MlmeUpdateHtTxRates(
-	IN PRTMP_ADAPTER		pAd,
-	IN	UCHAR				apidx)
-{
-	UCHAR	StbcMcs; //j, StbcMcs, bitmask;
-	CHAR	i; // 3*3
-	RT_HT_CAPABILITY	*pRtHtCap = NULL;
-	RT_HT_PHY_INFO		*pActiveHtPhy = NULL;
-	ULONG		BasicMCS;
-	UCHAR j, bitmask;
-	PRT_HT_PHY_INFO			pDesireHtPhy = NULL;
-	PHTTRANSMIT_SETTING		pHtPhy = NULL;
-	PHTTRANSMIT_SETTING		pMaxHtPhy = NULL;
-	PHTTRANSMIT_SETTING		pMinHtPhy = NULL;
-	BOOLEAN					*auto_rate_cur_p;
-
-	DBGPRINT(RT_DEBUG_TRACE,("MlmeUpdateHtTxRates===> \n"));
-
-	auto_rate_cur_p = NULL;
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-		pDesireHtPhy	= &pAd->StaCfg.DesiredHtPhyInfo;
-		pActiveHtPhy	= &pAd->StaCfg.DesiredHtPhyInfo;
-		pHtPhy		= &pAd->StaCfg.HTPhyMode;
-		pMaxHtPhy	= &pAd->StaCfg.MaxHTPhyMode;
-		pMinHtPhy	= &pAd->StaCfg.MinHTPhyMode;
-
-		auto_rate_cur_p = &pAd->StaCfg.bAutoTxRateSwitch;
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-#ifdef CONFIG_STA_SUPPORT
-	if ((ADHOC_ON(pAd) || INFRA_ON(pAd)) && (pAd->OpMode == OPMODE_STA))
-	{
-		if (pAd->StaActive.SupportedPhyInfo.bHtEnable == FALSE)
-			return;
-
-		pRtHtCap = &pAd->StaActive.SupportedHtPhy;
-		pActiveHtPhy = &pAd->StaActive.SupportedPhyInfo;
-		StbcMcs = (UCHAR)pAd->MlmeAux.AddHtInfo.AddHtInfo3.StbcMcs;
-		BasicMCS =pAd->MlmeAux.AddHtInfo.MCSSet[0]+(pAd->MlmeAux.AddHtInfo.MCSSet[1]<<8)+(StbcMcs<<16);
-		if ((pAd->CommonCfg.DesiredHtPhy.TxSTBC) && (pRtHtCap->RxSTBC) && (pAd->Antenna.field.TxPath == 2))
-			pMaxHtPhy->field.STBC = STBC_USE;
-		else
-			pMaxHtPhy->field.STBC = STBC_NONE;
-	}
-	else
-#endif // CONFIG_STA_SUPPORT //
-	{
-		if (pDesireHtPhy->bHtEnable == FALSE)
-			return;
-
-		pRtHtCap = &pAd->CommonCfg.DesiredHtPhy;
-		StbcMcs = (UCHAR)pAd->CommonCfg.AddHTInfo.AddHtInfo3.StbcMcs;
-		BasicMCS = pAd->CommonCfg.AddHTInfo.MCSSet[0]+(pAd->CommonCfg.AddHTInfo.MCSSet[1]<<8)+(StbcMcs<<16);
-		if ((pAd->CommonCfg.DesiredHtPhy.TxSTBC) && (pRtHtCap->RxSTBC) && (pAd->Antenna.field.TxPath == 2))
-			pMaxHtPhy->field.STBC = STBC_USE;
-		else
-			pMaxHtPhy->field.STBC = STBC_NONE;
-	}
-
-	// Decide MAX ht rate.
-	if ((pRtHtCap->GF) && (pAd->CommonCfg.DesiredHtPhy.GF))
-		pMaxHtPhy->field.MODE = MODE_HTGREENFIELD;
-	else
-		pMaxHtPhy->field.MODE = MODE_HTMIX;
-
-    if ((pAd->CommonCfg.DesiredHtPhy.ChannelWidth) && (pRtHtCap->ChannelWidth))
-		pMaxHtPhy->field.BW = BW_40;
-	else
-		pMaxHtPhy->field.BW = BW_20;
-
-    if (pMaxHtPhy->field.BW == BW_20)
-		pMaxHtPhy->field.ShortGI = (pAd->CommonCfg.DesiredHtPhy.ShortGIfor20 & pRtHtCap->ShortGIfor20);
-	else
-		pMaxHtPhy->field.ShortGI = (pAd->CommonCfg.DesiredHtPhy.ShortGIfor40 & pRtHtCap->ShortGIfor40);
-
-	if (pDesireHtPhy->MCSSet[4] != 0)
-	{
-		pMaxHtPhy->field.MCS = 32;
-	}
-
-	for (i=23; i>=0; i--) // 3*3
-	{
-		j = i/8;
-		bitmask = (1<<(i-(j*8)));
-
-		if ((pActiveHtPhy->MCSSet[j] & bitmask) && (pDesireHtPhy->MCSSet[j] & bitmask))
-		{
-			pMaxHtPhy->field.MCS = i;
-			break;
-		}
-
-		if (i==0)
-			break;
-	}
-
-	// Copy MIN ht rate.  rt2860???
-	pMinHtPhy->field.BW = BW_20;
-	pMinHtPhy->field.MCS = 0;
-	pMinHtPhy->field.STBC = 0;
-	pMinHtPhy->field.ShortGI = 0;
-	//If STA assigns fixed rate. update to fixed here.
-#ifdef CONFIG_STA_SUPPORT
-	if ( (pAd->OpMode == OPMODE_STA) && (pDesireHtPhy->MCSSet[0] != 0xff))
-	{
-		if (pDesireHtPhy->MCSSet[4] != 0)
-		{
-			pMaxHtPhy->field.MCS = 32;
-			pMinHtPhy->field.MCS = 32;
-			DBGPRINT(RT_DEBUG_TRACE,("MlmeUpdateHtTxRates<=== Use Fixed MCS = %d\n",pMinHtPhy->field.MCS));
-		}
-
-		for (i=23; (CHAR)i >= 0; i--) // 3*3
-		{
-			j = i/8;
-			bitmask = (1<<(i-(j*8)));
-			if ( (pDesireHtPhy->MCSSet[j] & bitmask) && (pActiveHtPhy->MCSSet[j] & bitmask))
-			{
-				pMaxHtPhy->field.MCS = i;
-				pMinHtPhy->field.MCS = i;
-				break;
-			}
-			if (i==0)
-				break;
-		}
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-
-	// Decide ht rate
-	pHtPhy->field.STBC = pMaxHtPhy->field.STBC;
-	pHtPhy->field.BW = pMaxHtPhy->field.BW;
-	pHtPhy->field.MODE = pMaxHtPhy->field.MODE;
-	pHtPhy->field.MCS = pMaxHtPhy->field.MCS;
-	pHtPhy->field.ShortGI = pMaxHtPhy->field.ShortGI;
-
-	// use default now. rt2860
-	if (pDesireHtPhy->MCSSet[0] != 0xff)
-		*auto_rate_cur_p = FALSE;
-	else
-		*auto_rate_cur_p = TRUE;
-
-	DBGPRINT(RT_DEBUG_TRACE, (" MlmeUpdateHtTxRates<---.AMsduSize = %d  \n", pAd->CommonCfg.DesiredHtPhy.AmsduSize ));
-	DBGPRINT(RT_DEBUG_TRACE,("TX: MCS[0] = %x (choose %d), BW = %d, ShortGI = %d, MODE = %d,  \n", pActiveHtPhy->MCSSet[0],pHtPhy->field.MCS,
-		pHtPhy->field.BW, pHtPhy->field.ShortGI, pHtPhy->field.MODE));
-	DBGPRINT(RT_DEBUG_TRACE,("MlmeUpdateHtTxRates<=== \n"));
-}
-
-
-VOID BATableInit(
-	IN PRTMP_ADAPTER pAd,
-    IN BA_TABLE *Tab)
-{
-	int i;
-
-	Tab->numAsOriginator = 0;
-	Tab->numAsRecipient = 0;
-	Tab->numDoneOriginator = 0;
-	NdisAllocateSpinLock(&pAd->BATabLock);
-	for (i = 0; i < MAX_LEN_OF_BA_REC_TABLE; i++)
-	{
-		Tab->BARecEntry[i].REC_BA_Status = Recipient_NONE;
-		NdisAllocateSpinLock(&(Tab->BARecEntry[i].RxReRingLock));
-	}
-	for (i = 0; i < MAX_LEN_OF_BA_ORI_TABLE; i++)
-	{
-		Tab->BAOriEntry[i].ORI_BA_Status = Originator_NONE;
-	}
-}
-#endif // DOT11_N_SUPPORT //
-
-// IRQL = DISPATCH_LEVEL
-VOID MlmeRadioOff(
-	IN PRTMP_ADAPTER pAd)
-{
-	RTMP_MLME_RADIO_OFF(pAd);
-}
-
-// IRQL = DISPATCH_LEVEL
-VOID MlmeRadioOn(
-	IN PRTMP_ADAPTER pAd)
-{
-	RTMP_MLME_RADIO_ON(pAd);
-}
-
-// ===========================================================================================
-// bss_table.c
-// ===========================================================================================
-
-
-/*! \brief initialize BSS table
- *	\param p_tab pointer to the table
- *	\return none
- *	\pre
- *	\post
-
- IRQL = PASSIVE_LEVEL
- IRQL = DISPATCH_LEVEL
-
- */
-VOID BssTableInit(
-	IN BSS_TABLE *Tab)
-{
-	int i;
-
-	Tab->BssNr = 0;
-    Tab->BssOverlapNr = 0;
-	for (i = 0; i < MAX_LEN_OF_BSS_TABLE; i++)
-	{
-		NdisZeroMemory(&Tab->BssEntry[i], sizeof(BSS_ENTRY));
-		Tab->BssEntry[i].Rssi = -127;	// initial the rssi as a minimum value
-	}
-}
-
-
-/*! \brief search the BSS table by SSID
- *	\param p_tab pointer to the bss table
- *	\param ssid SSID string
- *	\return index of the table, BSS_NOT_FOUND if not in the table
- *	\pre
- *	\post
- *	\note search by sequential search
-
- IRQL = DISPATCH_LEVEL
-
- */
-ULONG BssTableSearch(
-	IN BSS_TABLE *Tab,
-	IN PUCHAR	 pBssid,
-	IN UCHAR	 Channel)
-{
-	UCHAR i;
-
-	for (i = 0; i < Tab->BssNr; i++)
-	{
-		//
-		// Some AP that support A/B/G mode that may used the same BSSID on 11A and 11B/G.
-		// We should distinguish this case.
-		//
-		if ((((Tab->BssEntry[i].Channel <= 14) && (Channel <= 14)) ||
-			 ((Tab->BssEntry[i].Channel > 14) && (Channel > 14))) &&
-			MAC_ADDR_EQUAL(Tab->BssEntry[i].Bssid, pBssid))
-		{
-			return i;
-		}
-	}
-	return (ULONG)BSS_NOT_FOUND;
-}
-
-ULONG BssSsidTableSearch(
-	IN BSS_TABLE *Tab,
-	IN PUCHAR	 pBssid,
-	IN PUCHAR	 pSsid,
-	IN UCHAR	 SsidLen,
-	IN UCHAR	 Channel)
-{
-	UCHAR i;
-
-	for (i = 0; i < Tab->BssNr; i++)
-	{
-		//
-		// Some AP that support A/B/G mode that may used the same BSSID on 11A and 11B/G.
-		// We should distinguish this case.
-		//
-		if ((((Tab->BssEntry[i].Channel <= 14) && (Channel <= 14)) ||
-			 ((Tab->BssEntry[i].Channel > 14) && (Channel > 14))) &&
-			MAC_ADDR_EQUAL(Tab->BssEntry[i].Bssid, pBssid) &&
-			SSID_EQUAL(pSsid, SsidLen, Tab->BssEntry[i].Ssid, Tab->BssEntry[i].SsidLen))
-		{
-			return i;
-		}
-	}
-	return (ULONG)BSS_NOT_FOUND;
-}
-
-ULONG BssTableSearchWithSSID(
-	IN BSS_TABLE *Tab,
-	IN PUCHAR	 Bssid,
-	IN PUCHAR	 pSsid,
-	IN UCHAR	 SsidLen,
-	IN UCHAR	 Channel)
-{
-	UCHAR i;
-
-	for (i = 0; i < Tab->BssNr; i++)
-	{
-		if ((((Tab->BssEntry[i].Channel <= 14) && (Channel <= 14)) ||
-			((Tab->BssEntry[i].Channel > 14) && (Channel > 14))) &&
-			MAC_ADDR_EQUAL(&(Tab->BssEntry[i].Bssid), Bssid) &&
-			(SSID_EQUAL(pSsid, SsidLen, Tab->BssEntry[i].Ssid, Tab->BssEntry[i].SsidLen) ||
-			(NdisEqualMemory(pSsid, ZeroSsid, SsidLen)) ||
-			(NdisEqualMemory(Tab->BssEntry[i].Ssid, ZeroSsid, Tab->BssEntry[i].SsidLen))))
-		{
-			return i;
-		}
-	}
-	return (ULONG)BSS_NOT_FOUND;
-}
-
-
-ULONG BssSsidTableSearchBySSID(
-	IN BSS_TABLE *Tab,
-	IN PUCHAR	 pSsid,
-	IN UCHAR	 SsidLen)
-{
-	UCHAR i;
-
-	for (i = 0; i < Tab->BssNr; i++)
-	{
-		if (SSID_EQUAL(pSsid, SsidLen, Tab->BssEntry[i].Ssid, Tab->BssEntry[i].SsidLen))
-		{
-			return i;
-		}
-	}
-	return (ULONG)BSS_NOT_FOUND;
-}
-
-
-// IRQL = DISPATCH_LEVEL
-VOID BssTableDeleteEntry(
-	IN OUT	BSS_TABLE *Tab,
-	IN		PUCHAR	  pBssid,
-	IN		UCHAR	  Channel)
-{
-	UCHAR i, j;
-
-	for (i = 0; i < Tab->BssNr; i++)
-	{
-		if ((Tab->BssEntry[i].Channel == Channel) &&
-			(MAC_ADDR_EQUAL(Tab->BssEntry[i].Bssid, pBssid)))
-		{
-			for (j = i; j < Tab->BssNr - 1; j++)
-			{
-				NdisMoveMemory(&(Tab->BssEntry[j]), &(Tab->BssEntry[j + 1]), sizeof(BSS_ENTRY));
-			}
-			NdisZeroMemory(&(Tab->BssEntry[Tab->BssNr - 1]), sizeof(BSS_ENTRY));
-			Tab->BssNr -= 1;
-			return;
-		}
-	}
-}
-
-#ifdef DOT11_N_SUPPORT
-/*
-	========================================================================
-	Routine Description:
-		Delete the Originator Entry in BAtable. Or decrease numAs Originator by 1 if needed.
-
-	Arguments:
-	// IRQL = DISPATCH_LEVEL
-	========================================================================
-*/
-VOID BATableDeleteORIEntry(
-	IN OUT	PRTMP_ADAPTER pAd,
-	IN		BA_ORI_ENTRY	*pBAORIEntry)
-{
-
-	if (pBAORIEntry->ORI_BA_Status != Originator_NONE)
-	{
-		NdisAcquireSpinLock(&pAd->BATabLock);
-		if (pBAORIEntry->ORI_BA_Status == Originator_Done)
-		{
-			pAd->BATable.numAsOriginator -= 1;
-			DBGPRINT(RT_DEBUG_TRACE, ("BATableDeleteORIEntry numAsOriginator= %ld\n", pAd->BATable.numAsRecipient));
-			// Erase Bitmap flag.
-		}
-		pAd->MacTab.Content[pBAORIEntry->Wcid].TXBAbitmap &= (~(1<<(pBAORIEntry->TID) ));	// If STA mode,  erase flag here
-		pAd->MacTab.Content[pBAORIEntry->Wcid].BAOriWcidArray[pBAORIEntry->TID] = 0;	// If STA mode,  erase flag here
-		pBAORIEntry->ORI_BA_Status = Originator_NONE;
-		pBAORIEntry->Token = 1;
-		// Not clear Sequence here.
-		NdisReleaseSpinLock(&pAd->BATabLock);
-	}
-}
-#endif // DOT11_N_SUPPORT //
-
-/*! \brief
- *	\param
- *	\return
- *	\pre
- *	\post
-
- IRQL = DISPATCH_LEVEL
-
- */
-VOID BssEntrySet(
-	IN PRTMP_ADAPTER	pAd,
-	OUT BSS_ENTRY *pBss,
-	IN PUCHAR pBssid,
-	IN CHAR Ssid[],
-	IN UCHAR SsidLen,
-	IN UCHAR BssType,
-	IN USHORT BeaconPeriod,
-	IN PCF_PARM pCfParm,
-	IN USHORT AtimWin,
-	IN USHORT CapabilityInfo,
-	IN UCHAR SupRate[],
-	IN UCHAR SupRateLen,
-	IN UCHAR ExtRate[],
-	IN UCHAR ExtRateLen,
-	IN HT_CAPABILITY_IE *pHtCapability,
-	IN ADD_HT_INFO_IE *pAddHtInfo,	// AP might use this additional ht info IE
-	IN UCHAR			HtCapabilityLen,
-	IN UCHAR			AddHtInfoLen,
-	IN UCHAR			NewExtChanOffset,
-	IN UCHAR Channel,
-	IN CHAR Rssi,
-	IN LARGE_INTEGER TimeStamp,
-	IN UCHAR CkipFlag,
-	IN PEDCA_PARM pEdcaParm,
-	IN PQOS_CAPABILITY_PARM pQosCapability,
-	IN PQBSS_LOAD_PARM pQbssLoad,
-	IN USHORT LengthVIE,
-	IN PNDIS_802_11_VARIABLE_IEs pVIE)
-{
-	COPY_MAC_ADDR(pBss->Bssid, pBssid);
-	// Default Hidden SSID to be TRUE, it will be turned to FALSE after coping SSID
-	pBss->Hidden = 1;
-	if (SsidLen > 0)
-	{
-		// For hidden SSID AP, it might send beacon with SSID len equal to 0
-		// Or send beacon /probe response with SSID len matching real SSID length,
-		// but SSID is all zero. such as "00-00-00-00" with length 4.
-		// We have to prevent this case overwrite correct table
-		if (NdisEqualMemory(Ssid, ZeroSsid, SsidLen) == 0)
-		{
-		    NdisZeroMemory(pBss->Ssid, MAX_LEN_OF_SSID);
-			NdisMoveMemory(pBss->Ssid, Ssid, SsidLen);
-			pBss->SsidLen = SsidLen;
-			pBss->Hidden = 0;
-		}
-	}
-	else
-		pBss->SsidLen = 0;
-	pBss->BssType = BssType;
-	pBss->BeaconPeriod = BeaconPeriod;
-	if (BssType == BSS_INFRA)
-	{
-		if (pCfParm->bValid)
-		{
-			pBss->CfpCount = pCfParm->CfpCount;
-			pBss->CfpPeriod = pCfParm->CfpPeriod;
-			pBss->CfpMaxDuration = pCfParm->CfpMaxDuration;
-			pBss->CfpDurRemaining = pCfParm->CfpDurRemaining;
-		}
-	}
-	else
-	{
-		pBss->AtimWin = AtimWin;
-	}
-
-	pBss->CapabilityInfo = CapabilityInfo;
-	// The privacy bit indicate security is ON, it maight be WEP, TKIP or AES
-	// Combine with AuthMode, they will decide the connection methods.
-	pBss->Privacy = CAP_IS_PRIVACY_ON(pBss->CapabilityInfo);
-	ASSERT(SupRateLen <= MAX_LEN_OF_SUPPORTED_RATES);
-	if (SupRateLen <= MAX_LEN_OF_SUPPORTED_RATES)
-		NdisMoveMemory(pBss->SupRate, SupRate, SupRateLen);
-	else
-		NdisMoveMemory(pBss->SupRate, SupRate, MAX_LEN_OF_SUPPORTED_RATES);
-	pBss->SupRateLen = SupRateLen;
-	ASSERT(ExtRateLen <= MAX_LEN_OF_SUPPORTED_RATES);
-	NdisMoveMemory(pBss->ExtRate, ExtRate, ExtRateLen);
-	pBss->NewExtChanOffset = NewExtChanOffset;
-	pBss->ExtRateLen = ExtRateLen;
-	pBss->Channel = Channel;
-	pBss->CentralChannel = Channel;
-	pBss->Rssi = Rssi;
-	// Update CkipFlag. if not exists, the value is 0x0
-	pBss->CkipFlag = CkipFlag;
-
-	// New for microsoft Fixed IEs
-	NdisMoveMemory(pBss->FixIEs.Timestamp, &TimeStamp, 8);
-	pBss->FixIEs.BeaconInterval = BeaconPeriod;
-	pBss->FixIEs.Capabilities = CapabilityInfo;
-
-	// New for microsoft Variable IEs
-	if (LengthVIE != 0)
-	{
-		pBss->VarIELen = LengthVIE;
-		NdisMoveMemory(pBss->VarIEs, pVIE, pBss->VarIELen);
-	}
-	else
-	{
-		pBss->VarIELen = 0;
-	}
-
-	pBss->AddHtInfoLen = 0;
-	pBss->HtCapabilityLen = 0;
-#ifdef DOT11_N_SUPPORT
-	if (HtCapabilityLen> 0)
-	{
-		pBss->HtCapabilityLen = HtCapabilityLen;
-		NdisMoveMemory(&pBss->HtCapability, pHtCapability, HtCapabilityLen);
-		if (AddHtInfoLen > 0)
-		{
-			pBss->AddHtInfoLen = AddHtInfoLen;
-			NdisMoveMemory(&pBss->AddHtInfo, pAddHtInfo, AddHtInfoLen);
-
-				if ((pAddHtInfo->ControlChan > 2)&& (pAddHtInfo->AddHtInfo.ExtChanOffset == EXTCHA_BELOW) && (pHtCapability->HtCapInfo.ChannelWidth == BW_40))
-				{
-					pBss->CentralChannel = pAddHtInfo->ControlChan - 2;
-				}
-				else if ((pAddHtInfo->AddHtInfo.ExtChanOffset == EXTCHA_ABOVE) && (pHtCapability->HtCapInfo.ChannelWidth == BW_40))
-				{
-						pBss->CentralChannel = pAddHtInfo->ControlChan + 2;
-				}
-		}
-	}
-#endif // DOT11_N_SUPPORT //
-
-	BssCipherParse(pBss);
-
-	// new for QOS
-	if (pEdcaParm)
-		NdisMoveMemory(&pBss->EdcaParm, pEdcaParm, sizeof(EDCA_PARM));
-	else
-		pBss->EdcaParm.bValid = FALSE;
-	if (pQosCapability)
-		NdisMoveMemory(&pBss->QosCapability, pQosCapability, sizeof(QOS_CAPABILITY_PARM));
-	else
-		pBss->QosCapability.bValid = FALSE;
-	if (pQbssLoad)
-		NdisMoveMemory(&pBss->QbssLoad, pQbssLoad, sizeof(QBSS_LOAD_PARM));
-	else
-		pBss->QbssLoad.bValid = FALSE;
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-		PEID_STRUCT     pEid;
-		USHORT          Length = 0;
-
-
-		NdisZeroMemory(&pBss->WpaIE.IE[0], MAX_CUSTOM_LEN);
-		NdisZeroMemory(&pBss->RsnIE.IE[0], MAX_CUSTOM_LEN);
-#ifdef EXT_BUILD_CHANNEL_LIST
-		NdisZeroMemory(&pBss->CountryString[0], 3);
-		pBss->bHasCountryIE = FALSE;
-#endif // EXT_BUILD_CHANNEL_LIST //
-		pEid = (PEID_STRUCT) pVIE;
-		while ((Length + 2 + (USHORT)pEid->Len) <= LengthVIE)
-		{
-			switch(pEid->Eid)
-			{
-				case IE_WPA:
-					if (NdisEqualMemory(pEid->Octet, WPA_OUI, 4))
-					{
-						if ((pEid->Len + 2) > MAX_CUSTOM_LEN)
-						{
-							pBss->WpaIE.IELen = 0;
-							break;
-						}
-						pBss->WpaIE.IELen = pEid->Len + 2;
-						NdisMoveMemory(pBss->WpaIE.IE, pEid, pBss->WpaIE.IELen);
-					}
-					break;
-                case IE_RSN:
-                    if (NdisEqualMemory(pEid->Octet + 2, RSN_OUI, 3))
-					{
-						if ((pEid->Len + 2) > MAX_CUSTOM_LEN)
-                        {
-							pBss->RsnIE.IELen = 0;
-							break;
-					}
-						pBss->RsnIE.IELen = pEid->Len + 2;
-						NdisMoveMemory(pBss->RsnIE.IE, pEid, pBss->RsnIE.IELen);
-			}
-				break;
-#ifdef EXT_BUILD_CHANNEL_LIST
-				case IE_COUNTRY:
-					NdisMoveMemory(&pBss->CountryString[0], pEid->Octet, 3);
-					pBss->bHasCountryIE = TRUE;
-					break;
-#endif // EXT_BUILD_CHANNEL_LIST //
-            }
-			Length = Length + 2 + (USHORT)pEid->Len;  // Eid[1] + Len[1]+ content[Len]
-			pEid = (PEID_STRUCT)((UCHAR*)pEid + 2 + pEid->Len);
-		}
-	}
-#endif // CONFIG_STA_SUPPORT //
-}
-
-/*!
- *	\brief insert an entry into the bss table
- *	\param p_tab The BSS table
- *	\param Bssid BSSID
- *	\param ssid SSID
- *	\param ssid_len Length of SSID
- *	\param bss_type
- *	\param beacon_period
- *	\param timestamp
- *	\param p_cf
- *	\param atim_win
- *	\param cap
- *	\param rates
- *	\param rates_len
- *	\param channel_idx
- *	\return none
- *	\pre
- *	\post
- *	\note If SSID is identical, the old entry will be replaced by the new one
-
- IRQL = DISPATCH_LEVEL
-
- */
-ULONG BssTableSetEntry(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT BSS_TABLE *Tab,
-	IN PUCHAR pBssid,
-	IN CHAR Ssid[],
-	IN UCHAR SsidLen,
-	IN UCHAR BssType,
-	IN USHORT BeaconPeriod,
-	IN CF_PARM *CfParm,
-	IN USHORT AtimWin,
-	IN USHORT CapabilityInfo,
-	IN UCHAR SupRate[],
-	IN UCHAR SupRateLen,
-	IN UCHAR ExtRate[],
-	IN UCHAR ExtRateLen,
-	IN HT_CAPABILITY_IE *pHtCapability,
-	IN ADD_HT_INFO_IE *pAddHtInfo,	// AP might use this additional ht info IE
-	IN UCHAR			HtCapabilityLen,
-	IN UCHAR			AddHtInfoLen,
-	IN UCHAR			NewExtChanOffset,
-	IN UCHAR ChannelNo,
-	IN CHAR Rssi,
-	IN LARGE_INTEGER TimeStamp,
-	IN UCHAR CkipFlag,
-	IN PEDCA_PARM pEdcaParm,
-	IN PQOS_CAPABILITY_PARM pQosCapability,
-	IN PQBSS_LOAD_PARM pQbssLoad,
-	IN USHORT LengthVIE,
-	IN PNDIS_802_11_VARIABLE_IEs pVIE)
-{
-	ULONG	Idx;
-
-	Idx = BssTableSearchWithSSID(Tab, pBssid,  (UCHAR *)Ssid, SsidLen, ChannelNo);
-	if (Idx == BSS_NOT_FOUND)
-	{
-		if (Tab->BssNr >= MAX_LEN_OF_BSS_TABLE)
-	    {
-			//
-			// It may happen when BSS Table was full.
-			// The desired AP will not be added into BSS Table
-			// In this case, if we found the desired AP then overwrite BSS Table.
-			//
-			if(!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED))
-			{
-				if (MAC_ADDR_EQUAL(pAd->MlmeAux.Bssid, pBssid) ||
-					SSID_EQUAL(pAd->MlmeAux.Ssid, pAd->MlmeAux.SsidLen, Ssid, SsidLen))
-				{
-					Idx = Tab->BssOverlapNr;
-					BssEntrySet(pAd, &Tab->BssEntry[Idx], pBssid, Ssid, SsidLen, BssType, BeaconPeriod, CfParm, AtimWin,
-						CapabilityInfo, SupRate, SupRateLen, ExtRate, ExtRateLen,pHtCapability, pAddHtInfo,HtCapabilityLen, AddHtInfoLen,
-						NewExtChanOffset, ChannelNo, Rssi, TimeStamp, CkipFlag, pEdcaParm, pQosCapability, pQbssLoad, LengthVIE, pVIE);
-                    Tab->BssOverlapNr = (Tab->BssOverlapNr++) % MAX_LEN_OF_BSS_TABLE;
-				}
-				return Idx;
-			}
-			else
-			{
-			return BSS_NOT_FOUND;
-			}
-		}
-		Idx = Tab->BssNr;
-		BssEntrySet(pAd, &Tab->BssEntry[Idx], pBssid, Ssid, SsidLen, BssType, BeaconPeriod, CfParm, AtimWin,
-					CapabilityInfo, SupRate, SupRateLen, ExtRate, ExtRateLen,pHtCapability, pAddHtInfo,HtCapabilityLen, AddHtInfoLen,
-					NewExtChanOffset, ChannelNo, Rssi, TimeStamp, CkipFlag, pEdcaParm, pQosCapability, pQbssLoad, LengthVIE, pVIE);
-		Tab->BssNr++;
-	}
-	else
-	{
-		/* avoid  Hidden SSID form beacon to overwirite correct SSID from probe response */
-		if ((SSID_EQUAL(Ssid, SsidLen, Tab->BssEntry[Idx].Ssid, Tab->BssEntry[Idx].SsidLen)) ||
-			(NdisEqualMemory(Tab->BssEntry[Idx].Ssid, ZeroSsid, Tab->BssEntry[Idx].SsidLen)))
-		{
-			BssEntrySet(pAd, &Tab->BssEntry[Idx], pBssid, Ssid, SsidLen, BssType, BeaconPeriod,CfParm, AtimWin,
-						CapabilityInfo, SupRate, SupRateLen, ExtRate, ExtRateLen,pHtCapability, pAddHtInfo,HtCapabilityLen, AddHtInfoLen,
-						NewExtChanOffset, ChannelNo, Rssi, TimeStamp, CkipFlag, pEdcaParm, pQosCapability, pQbssLoad, LengthVIE, pVIE);
-		}
-	}
-
-	return Idx;
-}
-
-#ifdef CONFIG_STA_SUPPORT
-#ifdef DOT11_N_SUPPORT
-#ifdef DOT11N_DRAFT3
-VOID  TriEventInit(
-	IN	PRTMP_ADAPTER	pAd)
-{
-	UCHAR		i;
-
-	for (i = 0;i < MAX_TRIGGER_EVENT;i++)
-		pAd->CommonCfg.TriggerEventTab.EventA[i].bValid = FALSE;
-
-	pAd->CommonCfg.TriggerEventTab.EventANo = 0;
-	pAd->CommonCfg.TriggerEventTab.EventBCountDown = 0;
-}
-
-ULONG TriEventTableSetEntry(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT TRIGGER_EVENT_TAB *Tab,
-	IN PUCHAR pBssid,
-	IN HT_CAPABILITY_IE *pHtCapability,
-	IN UCHAR			HtCapabilityLen,
-	IN UCHAR			RegClass,
-	IN UCHAR ChannelNo)
-{
-	// Event A
-	if (HtCapabilityLen == 0)
-	{
-		if (Tab->EventANo < MAX_TRIGGER_EVENT)
-		{
-			RTMPMoveMemory(Tab->EventA[Tab->EventANo].BSSID, pBssid, 6);
-			Tab->EventA[Tab->EventANo].bValid = TRUE;
-			Tab->EventA[Tab->EventANo].Channel = ChannelNo;
-			Tab->EventA[Tab->EventANo].CDCounter = pAd->CommonCfg.Dot11BssWidthChanTranDelay;
-			if (RegClass != 0)
-			{
-				// Beacon has Regulatory class IE. So use beacon's
-				Tab->EventA[Tab->EventANo].RegClass = RegClass;
-			}
-			else
-			{
-				// Use Station's Regulatory class instead.
-				if (pAd->StaActive.SupportedHtPhy.bHtEnable == TRUE)
-				{
-					if (pAd->CommonCfg.CentralChannel > pAd->CommonCfg.Channel)
-					{
-						Tab->EventA[Tab->EventANo].RegClass = 32;
-					}
-					else if (pAd->CommonCfg.CentralChannel < pAd->CommonCfg.Channel)
-						Tab->EventA[Tab->EventANo].RegClass = 33;
-				}
-				else
-					Tab->EventA[Tab->EventANo].RegClass = ??;
-
-			}
-
-			Tab->EventANo ++;
-		}
-	}
-	else if (pHtCapability->HtCapInfo.Intolerant40)
-	{
-		Tab->EventBCountDown = pAd->CommonCfg.Dot11BssWidthChanTranDelay;
-	}
-
-}
-
-/*
-	========================================================================
-	Routine Description:
-		Trigger Event table Maintainence called once every second.
-
-	Arguments:
-	// IRQL = DISPATCH_LEVEL
-	========================================================================
-*/
-VOID TriEventCounterMaintenance(
-	IN	PRTMP_ADAPTER	pAd)
-{
-	UCHAR		i;
-	BOOLEAN			bNotify = FALSE;
-	for (i = 0;i < MAX_TRIGGER_EVENT;i++)
-	{
-		if (pAd->CommonCfg.TriggerEventTab.EventA[i].bValid && (pAd->CommonCfg.TriggerEventTab.EventA[i].CDCounter > 0))
-		{
-			pAd->CommonCfg.TriggerEventTab.EventA[i].CDCounter--;
-			if (pAd->CommonCfg.TriggerEventTab.EventA[i].CDCounter == 0)
-			{
-				pAd->CommonCfg.TriggerEventTab.EventA[i].bValid = FALSE;
-				pAd->CommonCfg.TriggerEventTab.EventANo --;
-				// Need to send 20/40 Coexistence Notify frame if has status change.
-				bNotify = TRUE;
-			}
-		}
-	}
-	if (pAd->CommonCfg.TriggerEventTab.EventBCountDown > 0)
-	{
-		pAd->CommonCfg.TriggerEventTab.EventBCountDown--;
-		if (pAd->CommonCfg.TriggerEventTab.EventBCountDown == 0)
-			bNotify = TRUE;
-	}
-
-	if (bNotify == TRUE)
-		Update2040CoexistFrameAndNotify(pAd, BSSID_WCID, TRUE);
-}
-#endif // DOT11N_DRAFT3 //
-#endif // DOT11_N_SUPPORT //
-
-// IRQL = DISPATCH_LEVEL
-VOID BssTableSsidSort(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT BSS_TABLE *OutTab,
-	IN	CHAR Ssid[],
-	IN	UCHAR SsidLen)
-{
-	INT i;
-	BssTableInit(OutTab);
-
-	for (i = 0; i < pAd->ScanTab.BssNr; i++)
-	{
-		BSS_ENTRY *pInBss = &pAd->ScanTab.BssEntry[i];
-		BOOLEAN	bIsHiddenApIncluded = FALSE;
-
-		if (((pAd->CommonCfg.bIEEE80211H == 1) &&
-            (pAd->MlmeAux.Channel > 14) &&
-             RadarChannelCheck(pAd, pInBss->Channel))
-#ifdef CARRIER_DETECTION_SUPPORT // Roger sync Carrier
-             || (pAd->CommonCfg.CarrierDetect.Enable == TRUE)
-#endif // CARRIER_DETECTION_SUPPORT //
-            )
-{
-			if (pInBss->Hidden)
-				bIsHiddenApIncluded = TRUE;
-}
-
-		if ((pInBss->BssType == pAd->StaCfg.BssType) &&
-			(SSID_EQUAL(Ssid, SsidLen, pInBss->Ssid, pInBss->SsidLen) || bIsHiddenApIncluded))
-		{
-			BSS_ENTRY *pOutBss = &OutTab->BssEntry[OutTab->BssNr];
-
-
-#ifdef EXT_BUILD_CHANNEL_LIST
-			// If no Country IE exists no Connection will be established when IEEE80211dClientMode is strict.
-			if ((pAd->StaCfg.IEEE80211dClientMode == Rt802_11_D_Strict) &&
-				(pInBss->bHasCountryIE == FALSE))
-			{
-				DBGPRINT(RT_DEBUG_TRACE,("StaCfg.IEEE80211dClientMode == Rt802_11_D_Strict, but this AP doesn't have country IE.\n"));
-				continue;
-			}
-#endif // EXT_BUILD_CHANNEL_LIST //
-
-#ifdef DOT11_N_SUPPORT
-			// 2.4G/5G N only mode
-			if ((pInBss->HtCapabilityLen == 0) &&
-				((pAd->CommonCfg.PhyMode == PHY_11N_2_4G) || (pAd->CommonCfg.PhyMode == PHY_11N_5G)))
-			{
-				DBGPRINT(RT_DEBUG_TRACE,("STA is in N-only Mode, this AP don't have Ht capability in Beacon.\n"));
-				continue;
-			}
-#endif // DOT11_N_SUPPORT //
-
-			// New for WPA2
-			// Check the Authmode first
-			if (pAd->StaCfg.AuthMode >= Ndis802_11AuthModeWPA)
-			{
-				// Check AuthMode and AuthModeAux for matching, in case AP support dual-mode
-				if ((pAd->StaCfg.AuthMode != pInBss->AuthMode) && (pAd->StaCfg.AuthMode != pInBss->AuthModeAux))
-					// None matched
-					continue;
-
-				// Check cipher suite, AP must have more secured cipher than station setting
-				if ((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA) || (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPAPSK))
-				{
-					// If it's not mixed mode, we should only let BSS pass with the same encryption
-					if (pInBss->WPA.bMixMode == FALSE)
-						if (pAd->StaCfg.WepStatus != pInBss->WPA.GroupCipher)
-							continue;
-
-					// check group cipher
-					if ((pAd->StaCfg.WepStatus < pInBss->WPA.GroupCipher) &&
-						(pInBss->WPA.GroupCipher != Ndis802_11GroupWEP40Enabled) &&
-						(pInBss->WPA.GroupCipher != Ndis802_11GroupWEP104Enabled))
-						continue;
-
-					// check pairwise cipher, skip if none matched
-					// If profile set to AES, let it pass without question.
-					// If profile set to TKIP, we must find one mateched
-					if ((pAd->StaCfg.WepStatus == Ndis802_11Encryption2Enabled) &&
-						(pAd->StaCfg.WepStatus != pInBss->WPA.PairCipher) &&
-						(pAd->StaCfg.WepStatus != pInBss->WPA.PairCipherAux))
-						continue;
-				}
-				else if ((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2) || (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK))
-				{
-					// If it's not mixed mode, we should only let BSS pass with the same encryption
-					if (pInBss->WPA2.bMixMode == FALSE)
-						if (pAd->StaCfg.WepStatus != pInBss->WPA2.GroupCipher)
-							continue;
-
-					// check group cipher
-					if ((pAd->StaCfg.WepStatus < pInBss->WPA.GroupCipher) &&
-						(pInBss->WPA2.GroupCipher != Ndis802_11GroupWEP40Enabled) &&
-						(pInBss->WPA2.GroupCipher != Ndis802_11GroupWEP104Enabled))
-						continue;
-
-					// check pairwise cipher, skip if none matched
-					// If profile set to AES, let it pass without question.
-					// If profile set to TKIP, we must find one mateched
-					if ((pAd->StaCfg.WepStatus == Ndis802_11Encryption2Enabled) &&
-						(pAd->StaCfg.WepStatus != pInBss->WPA2.PairCipher) &&
-						(pAd->StaCfg.WepStatus != pInBss->WPA2.PairCipherAux))
-						continue;
-				}
-			}
-			// Bss Type matched, SSID matched.
-			// We will check wepstatus for qualification Bss
-			else if (pAd->StaCfg.WepStatus != pInBss->WepStatus)
-			{
-				DBGPRINT(RT_DEBUG_TRACE,("StaCfg.WepStatus=%d, while pInBss->WepStatus=%d\n", pAd->StaCfg.WepStatus, pInBss->WepStatus));
-				//
-				// For the SESv2 case, we will not qualify WepStatus.
-				//
-				if (!pInBss->bSES)
-					continue;
-			}
-
-			// Since the AP is using hidden SSID, and we are trying to connect to ANY
-			// It definitely will fail. So, skip it.
-			// CCX also require not even try to connect it!!
-			if (SsidLen == 0)
-				continue;
-
-#ifdef DOT11_N_SUPPORT
-			// If both station and AP use 40MHz, still need to check if the 40MHZ band's legality in my country region
-			// If this 40MHz wideband is not allowed in my country list, use bandwidth 20MHZ instead,
-			if ((pInBss->CentralChannel != pInBss->Channel) &&
-				(pAd->CommonCfg.RegTransmitSetting.field.BW == BW_40))
-			{
-				if (RTMPCheckChannel(pAd, pInBss->CentralChannel, pInBss->Channel) == FALSE)
-				{
-					pAd->CommonCfg.RegTransmitSetting.field.BW = BW_20;
-					SetCommonHT(pAd);
-					pAd->CommonCfg.RegTransmitSetting.field.BW = BW_40;
-				}
-				else
-				{
-					if (pAd->CommonCfg.DesiredHtPhy.ChannelWidth == BAND_WIDTH_20)
-					{
-						SetCommonHT(pAd);
-					}
-				}
-			}
-#endif // DOT11_N_SUPPORT //
-
-			// copy matching BSS from InTab to OutTab
-			NdisMoveMemory(pOutBss, pInBss, sizeof(BSS_ENTRY));
-
-			OutTab->BssNr++;
-		}
-		else if ((pInBss->BssType == pAd->StaCfg.BssType) && (SsidLen == 0))
-		{
-			BSS_ENTRY *pOutBss = &OutTab->BssEntry[OutTab->BssNr];
-
-
-#ifdef DOT11_N_SUPPORT
-			// 2.4G/5G N only mode
-			if ((pInBss->HtCapabilityLen == 0) &&
-				((pAd->CommonCfg.PhyMode == PHY_11N_2_4G) || (pAd->CommonCfg.PhyMode == PHY_11N_5G)))
-			{
-				DBGPRINT(RT_DEBUG_TRACE,("STA is in N-only Mode, this AP don't have Ht capability in Beacon.\n"));
-				continue;
-			}
-#endif // DOT11_N_SUPPORT //
-
-			// New for WPA2
-			// Check the Authmode first
-			if (pAd->StaCfg.AuthMode >= Ndis802_11AuthModeWPA)
-			{
-				// Check AuthMode and AuthModeAux for matching, in case AP support dual-mode
-				if ((pAd->StaCfg.AuthMode != pInBss->AuthMode) && (pAd->StaCfg.AuthMode != pInBss->AuthModeAux))
-					// None matched
-					continue;
-
-				// Check cipher suite, AP must have more secured cipher than station setting
-				if ((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA) || (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPAPSK))
-				{
-					// If it's not mixed mode, we should only let BSS pass with the same encryption
-					if (pInBss->WPA.bMixMode == FALSE)
-						if (pAd->StaCfg.WepStatus != pInBss->WPA.GroupCipher)
-							continue;
-
-					// check group cipher
-					if (pAd->StaCfg.WepStatus < pInBss->WPA.GroupCipher)
-						continue;
-
-					// check pairwise cipher, skip if none matched
-					// If profile set to AES, let it pass without question.
-					// If profile set to TKIP, we must find one mateched
-					if ((pAd->StaCfg.WepStatus == Ndis802_11Encryption2Enabled) &&
-						(pAd->StaCfg.WepStatus != pInBss->WPA.PairCipher) &&
-						(pAd->StaCfg.WepStatus != pInBss->WPA.PairCipherAux))
-						continue;
-				}
-				else if ((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2) || (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK))
-				{
-					// If it's not mixed mode, we should only let BSS pass with the same encryption
-					if (pInBss->WPA2.bMixMode == FALSE)
-						if (pAd->StaCfg.WepStatus != pInBss->WPA2.GroupCipher)
-							continue;
-
-					// check group cipher
-					if (pAd->StaCfg.WepStatus < pInBss->WPA2.GroupCipher)
-						continue;
-
-					// check pairwise cipher, skip if none matched
-					// If profile set to AES, let it pass without question.
-					// If profile set to TKIP, we must find one mateched
-					if ((pAd->StaCfg.WepStatus == Ndis802_11Encryption2Enabled) &&
-						(pAd->StaCfg.WepStatus != pInBss->WPA2.PairCipher) &&
-						(pAd->StaCfg.WepStatus != pInBss->WPA2.PairCipherAux))
-						continue;
-				}
-			}
-			// Bss Type matched, SSID matched.
-			// We will check wepstatus for qualification Bss
-			else if (pAd->StaCfg.WepStatus != pInBss->WepStatus)
-					continue;
-
-#ifdef DOT11_N_SUPPORT
-			// If both station and AP use 40MHz, still need to check if the 40MHZ band's legality in my country region
-			// If this 40MHz wideband is not allowed in my country list, use bandwidth 20MHZ instead,
-			if ((pInBss->CentralChannel != pInBss->Channel) &&
-				(pAd->CommonCfg.RegTransmitSetting.field.BW == BW_40))
-			{
-				if (RTMPCheckChannel(pAd, pInBss->CentralChannel, pInBss->Channel) == FALSE)
-				{
-					pAd->CommonCfg.RegTransmitSetting.field.BW = BW_20;
-					SetCommonHT(pAd);
-					pAd->CommonCfg.RegTransmitSetting.field.BW = BW_40;
-				}
-			}
-#endif // DOT11_N_SUPPORT //
-
-			// copy matching BSS from InTab to OutTab
-			NdisMoveMemory(pOutBss, pInBss, sizeof(BSS_ENTRY));
-
-			OutTab->BssNr++;
-		}
-
-		if (OutTab->BssNr >= MAX_LEN_OF_BSS_TABLE)
-			break;
-	}
-
-	BssTableSortByRssi(OutTab);
-}
-
-
-// IRQL = DISPATCH_LEVEL
-VOID BssTableSortByRssi(
-	IN OUT BSS_TABLE *OutTab)
-{
-	INT	  i, j;
-	BSS_ENTRY TmpBss;
-
-	for (i = 0; i < OutTab->BssNr - 1; i++)
-	{
-		for (j = i+1; j < OutTab->BssNr; j++)
-		{
-			if (OutTab->BssEntry[j].Rssi > OutTab->BssEntry[i].Rssi)
-			{
-				NdisMoveMemory(&TmpBss, &OutTab->BssEntry[j], sizeof(BSS_ENTRY));
-				NdisMoveMemory(&OutTab->BssEntry[j], &OutTab->BssEntry[i], sizeof(BSS_ENTRY));
-				NdisMoveMemory(&OutTab->BssEntry[i], &TmpBss, sizeof(BSS_ENTRY));
-			}
-		}
-	}
-}
-#endif // CONFIG_STA_SUPPORT //
-
-
-VOID BssCipherParse(
-	IN OUT	PBSS_ENTRY	pBss)
-{
-	PEID_STRUCT		 pEid;
-	PUCHAR				pTmp;
-	PRSN_IE_HEADER_STRUCT			pRsnHeader;
-	PCIPHER_SUITE_STRUCT			pCipher;
-	PAKM_SUITE_STRUCT				pAKM;
-	USHORT							Count;
-	INT								Length;
-	NDIS_802_11_ENCRYPTION_STATUS	TmpCipher;
-
-	//
-	// WepStatus will be reset later, if AP announce TKIP or AES on the beacon frame.
-	//
-	if (pBss->Privacy)
-	{
-		pBss->WepStatus		= Ndis802_11WEPEnabled;
-	}
-	else
-	{
-		pBss->WepStatus		= Ndis802_11WEPDisabled;
-	}
-	// Set default to disable & open authentication before parsing variable IE
-	pBss->AuthMode		= Ndis802_11AuthModeOpen;
-	pBss->AuthModeAux	= Ndis802_11AuthModeOpen;
-
-	// Init WPA setting
-	pBss->WPA.PairCipher	= Ndis802_11WEPDisabled;
-	pBss->WPA.PairCipherAux = Ndis802_11WEPDisabled;
-	pBss->WPA.GroupCipher	= Ndis802_11WEPDisabled;
-	pBss->WPA.RsnCapability = 0;
-	pBss->WPA.bMixMode		= FALSE;
-
-	// Init WPA2 setting
-	pBss->WPA2.PairCipher	 = Ndis802_11WEPDisabled;
-	pBss->WPA2.PairCipherAux = Ndis802_11WEPDisabled;
-	pBss->WPA2.GroupCipher	 = Ndis802_11WEPDisabled;
-	pBss->WPA2.RsnCapability = 0;
-	pBss->WPA2.bMixMode	 = FALSE;
-
-
-	Length = (INT) pBss->VarIELen;
-
-	while (Length > 0)
-	{
-		// Parse cipher suite base on WPA1 & WPA2, they should be parsed differently
-		pTmp = ((PUCHAR) pBss->VarIEs) + pBss->VarIELen - Length;
-		pEid = (PEID_STRUCT) pTmp;
-		switch (pEid->Eid)
-		{
-			case IE_WPA:
-				if (NdisEqualMemory(pEid->Octet, SES_OUI, 3) && (pEid->Len == 7))
-				{
-					pBss->bSES = TRUE;
-					break;
-				}
-				else if (NdisEqualMemory(pEid->Octet, WPA_OUI, 4) != 1)
-				{
-					// if unsupported vendor specific IE
-					break;
-				}
-				// Skip OUI, version, and multicast suite
-				// This part should be improved in the future when AP supported multiple cipher suite.
-				// For now, it's OK since almost all APs have fixed cipher suite supported.
-				// pTmp = (PUCHAR) pEid->Octet;
-				pTmp   += 11;
-
-				// Cipher Suite Selectors from Spec P802.11i/D3.2 P26.
-				//	Value	   Meaning
-				//	0			None
-				//	1			WEP-40
-				//	2			Tkip
-				//	3			WRAP
-				//	4			AES
-				//	5			WEP-104
-				// Parse group cipher
-				switch (*pTmp)
-				{
-					case 1:
-						pBss->WPA.GroupCipher = Ndis802_11GroupWEP40Enabled;
-						break;
-					case 5:
-						pBss->WPA.GroupCipher = Ndis802_11GroupWEP104Enabled;
-						break;
-					case 2:
-						pBss->WPA.GroupCipher = Ndis802_11Encryption2Enabled;
-						break;
-					case 4:
-						pBss->WPA.GroupCipher = Ndis802_11Encryption3Enabled;
-						break;
-					default:
-						break;
-				}
-				// number of unicast suite
-				pTmp   += 1;
-
-				// skip all unicast cipher suites
-				//Count = *(PUSHORT) pTmp;
-				Count = (pTmp[1]<<8) + pTmp[0];
-				pTmp   += sizeof(USHORT);
-
-				// Parsing all unicast cipher suite
-				while (Count > 0)
-				{
-					// Skip OUI
-					pTmp += 3;
-					TmpCipher = Ndis802_11WEPDisabled;
-					switch (*pTmp)
-					{
-						case 1:
-						case 5: // Although WEP is not allowed in WPA related auth mode, we parse it anyway
-							TmpCipher = Ndis802_11Encryption1Enabled;
-							break;
-						case 2:
-							TmpCipher = Ndis802_11Encryption2Enabled;
-							break;
-						case 4:
-							TmpCipher = Ndis802_11Encryption3Enabled;
-							break;
-						default:
-							break;
-					}
-					if (TmpCipher > pBss->WPA.PairCipher)
-					{
-						// Move the lower cipher suite to PairCipherAux
-						pBss->WPA.PairCipherAux = pBss->WPA.PairCipher;
-						pBss->WPA.PairCipher	= TmpCipher;
-					}
-					else
-					{
-						pBss->WPA.PairCipherAux = TmpCipher;
-					}
-					pTmp++;
-					Count--;
-				}
-
-				// 4. get AKM suite counts
-				//Count	= *(PUSHORT) pTmp;
-				Count = (pTmp[1]<<8) + pTmp[0];
-				pTmp   += sizeof(USHORT);
-				pTmp   += 3;
-
-				switch (*pTmp)
-				{
-					case 1:
-						// Set AP support WPA-enterprise mode
-						if (pBss->AuthMode == Ndis802_11AuthModeOpen)
-							pBss->AuthMode = Ndis802_11AuthModeWPA;
-						else
-							pBss->AuthModeAux = Ndis802_11AuthModeWPA;
-						break;
-					case 2:
-						// Set AP support WPA-PSK mode
-						if (pBss->AuthMode == Ndis802_11AuthModeOpen)
-							pBss->AuthMode = Ndis802_11AuthModeWPAPSK;
-						else
-							pBss->AuthModeAux = Ndis802_11AuthModeWPAPSK;
-						break;
-					default:
-						break;
-				}
-				pTmp   += 1;
-
-				// Fixed for WPA-None
-				if (pBss->BssType == BSS_ADHOC)
-				{
-					pBss->AuthMode	  = Ndis802_11AuthModeWPANone;
-					pBss->AuthModeAux = Ndis802_11AuthModeWPANone;
-					pBss->WepStatus   = pBss->WPA.GroupCipher;
-					// Patched bugs for old driver
-					if (pBss->WPA.PairCipherAux == Ndis802_11WEPDisabled)
-						pBss->WPA.PairCipherAux = pBss->WPA.GroupCipher;
-				}
-				else
-					pBss->WepStatus   = pBss->WPA.PairCipher;
-
-				// Check the Pair & Group, if different, turn on mixed mode flag
-				if (pBss->WPA.GroupCipher != pBss->WPA.PairCipher)
-					pBss->WPA.bMixMode = TRUE;
-
-				break;
-
-			case IE_RSN:
-				pRsnHeader = (PRSN_IE_HEADER_STRUCT) pTmp;
-
-				// 0. Version must be 1
-				if (le2cpu16(pRsnHeader->Version) != 1)
-					break;
-				pTmp   += sizeof(RSN_IE_HEADER_STRUCT);
-
-				// 1. Check group cipher
-				pCipher = (PCIPHER_SUITE_STRUCT) pTmp;
-				if (!RTMPEqualMemory(pTmp, RSN_OUI, 3))
-					break;
-
-				// Parse group cipher
-				switch (pCipher->Type)
-				{
-					case 1:
-						pBss->WPA2.GroupCipher = Ndis802_11GroupWEP40Enabled;
-						break;
-					case 5:
-						pBss->WPA2.GroupCipher = Ndis802_11GroupWEP104Enabled;
-						break;
-					case 2:
-						pBss->WPA2.GroupCipher = Ndis802_11Encryption2Enabled;
-						break;
-					case 4:
-						pBss->WPA2.GroupCipher = Ndis802_11Encryption3Enabled;
-						break;
-					default:
-						break;
-				}
-				// set to correct offset for next parsing
-				pTmp   += sizeof(CIPHER_SUITE_STRUCT);
-
-				// 2. Get pairwise cipher counts
-				//Count = *(PUSHORT) pTmp;
-				Count = (pTmp[1]<<8) + pTmp[0];
-				pTmp   += sizeof(USHORT);
-
-				// 3. Get pairwise cipher
-				// Parsing all unicast cipher suite
-				while (Count > 0)
-				{
-					// Skip OUI
-					pCipher = (PCIPHER_SUITE_STRUCT) pTmp;
-					TmpCipher = Ndis802_11WEPDisabled;
-					switch (pCipher->Type)
-					{
-						case 1:
-						case 5: // Although WEP is not allowed in WPA related auth mode, we parse it anyway
-							TmpCipher = Ndis802_11Encryption1Enabled;
-							break;
-						case 2:
-							TmpCipher = Ndis802_11Encryption2Enabled;
-							break;
-						case 4:
-							TmpCipher = Ndis802_11Encryption3Enabled;
-							break;
-						default:
-							break;
-					}
-					if (TmpCipher > pBss->WPA2.PairCipher)
-					{
-						// Move the lower cipher suite to PairCipherAux
-						pBss->WPA2.PairCipherAux = pBss->WPA2.PairCipher;
-						pBss->WPA2.PairCipher	 = TmpCipher;
-					}
-					else
-					{
-						pBss->WPA2.PairCipherAux = TmpCipher;
-					}
-					pTmp += sizeof(CIPHER_SUITE_STRUCT);
-					Count--;
-				}
-
-				// 4. get AKM suite counts
-				//Count	= *(PUSHORT) pTmp;
-				Count = (pTmp[1]<<8) + pTmp[0];
-				pTmp   += sizeof(USHORT);
-
-				// 5. Get AKM ciphers
-				// Parsing all AKM ciphers
-				while (Count > 0)
-				{
-					pAKM = (PAKM_SUITE_STRUCT) pTmp;
-					if (!RTMPEqualMemory(pTmp, RSN_OUI, 3))
-						break;
-
-					switch (pAKM->Type)
-					{
-						case 1:
-							// Set AP support WPA-enterprise mode
-							if (pBss->AuthMode == Ndis802_11AuthModeOpen)
-								pBss->AuthMode = Ndis802_11AuthModeWPA2;
-							else
-								pBss->AuthModeAux = Ndis802_11AuthModeWPA2;
-							break;
-						case 2:
-							// Set AP support WPA-PSK mode
-							if (pBss->AuthMode == Ndis802_11AuthModeOpen)
-								pBss->AuthMode = Ndis802_11AuthModeWPA2PSK;
-							else
-								pBss->AuthModeAux = Ndis802_11AuthModeWPA2PSK;
-							break;
-						default:
-							if (pBss->AuthMode == Ndis802_11AuthModeOpen)
-								pBss->AuthMode = Ndis802_11AuthModeMax;
-							else
-								pBss->AuthModeAux = Ndis802_11AuthModeMax;
-							break;
-					}
-					pTmp   += (Count * sizeof(AKM_SUITE_STRUCT));
-					Count--;
-				}
-
-				// Fixed for WPA-None
-				if (pBss->BssType == BSS_ADHOC)
-				{
-					pBss->AuthMode = Ndis802_11AuthModeWPANone;
-					pBss->AuthModeAux = Ndis802_11AuthModeWPANone;
-					pBss->WPA.PairCipherAux = pBss->WPA2.PairCipherAux;
-					pBss->WPA.GroupCipher	= pBss->WPA2.GroupCipher;
-					pBss->WepStatus			= pBss->WPA.GroupCipher;
-					// Patched bugs for old driver
-					if (pBss->WPA.PairCipherAux == Ndis802_11WEPDisabled)
-						pBss->WPA.PairCipherAux = pBss->WPA.GroupCipher;
-				}
-				pBss->WepStatus   = pBss->WPA2.PairCipher;
-
-				// 6. Get RSN capability
-				//pBss->WPA2.RsnCapability = *(PUSHORT) pTmp;
-				pBss->WPA2.RsnCapability = (pTmp[1]<<8) + pTmp[0];
-				pTmp += sizeof(USHORT);
-
-				// Check the Pair & Group, if different, turn on mixed mode flag
-				if (pBss->WPA2.GroupCipher != pBss->WPA2.PairCipher)
-					pBss->WPA2.bMixMode = TRUE;
-
-				break;
-			default:
-				break;
-		}
-		Length -= (pEid->Len + 2);
-	}
-}
-
-// ===========================================================================================
-// mac_table.c
-// ===========================================================================================
-
-/*! \brief generates a random mac address value for IBSS BSSID
- *	\param Addr the bssid location
- *	\return none
- *	\pre
- *	\post
- */
-VOID MacAddrRandomBssid(
-	IN PRTMP_ADAPTER pAd,
-	OUT PUCHAR pAddr)
-{
-	INT i;
-
-	for (i = 0; i < MAC_ADDR_LEN; i++)
-	{
-		pAddr[i] = RandomByte(pAd);
-	}
-
-	pAddr[0] = (pAddr[0] & 0xfe) | 0x02;  // the first 2 bits must be 01xxxxxxxx
-}
-
-/*! \brief init the management mac frame header
- *	\param p_hdr mac header
- *	\param subtype subtype of the frame
- *	\param p_ds destination address, don't care if it is a broadcast address
- *	\return none
- *	\pre the station has the following information in the pAd->StaCfg
- *	 - bssid
- *	 - station address
- *	\post
- *	\note this function initializes the following field
-
- IRQL = PASSIVE_LEVEL
- IRQL = DISPATCH_LEVEL
-
- */
-VOID MgtMacHeaderInit(
-	IN	PRTMP_ADAPTER	pAd,
-	IN OUT PHEADER_802_11 pHdr80211,
-	IN UCHAR SubType,
-	IN UCHAR ToDs,
-	IN PUCHAR pDA,
-	IN PUCHAR pBssid)
-{
-	NdisZeroMemory(pHdr80211, sizeof(HEADER_802_11));
-
-	pHdr80211->FC.Type = BTYPE_MGMT;
-	pHdr80211->FC.SubType = SubType;
-//	if (SubType == SUBTYPE_ACK)	// sample, no use, it will conflict with ACTION frame sub type
-//		pHdr80211->FC.Type = BTYPE_CNTL;
-	pHdr80211->FC.ToDs = ToDs;
-	COPY_MAC_ADDR(pHdr80211->Addr1, pDA);
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		COPY_MAC_ADDR(pHdr80211->Addr2, pAd->CurrentAddress);
-#endif // CONFIG_STA_SUPPORT //
-	COPY_MAC_ADDR(pHdr80211->Addr3, pBssid);
-}
-
-// ===========================================================================================
-// mem_mgmt.c
-// ===========================================================================================
-
-/*!***************************************************************************
- * This routine build an outgoing frame, and fill all information specified
- * in argument list to the frame body. The actual frame size is the summation
- * of all arguments.
- * input params:
- *		Buffer - pointer to a pre-allocated memory segment
- *		args - a list of <int arg_size, arg> pairs.
- *		NOTE NOTE NOTE!!!! the last argument must be NULL, otherwise this
- *						   function will FAIL!!!
- * return:
- *		Size of the buffer
- * usage:
- *		MakeOutgoingFrame(Buffer, output_length, 2, &fc, 2, &dur, 6, p_addr1, 6,p_addr2, END_OF_ARGS);
-
- IRQL = PASSIVE_LEVEL
- IRQL = DISPATCH_LEVEL
-
- ****************************************************************************/
-ULONG MakeOutgoingFrame(
-	OUT UCHAR *Buffer,
-	OUT ULONG *FrameLen, ...)
-{
-	UCHAR   *p;
-	int	leng;
-	ULONG	TotLeng;
-	va_list Args;
-
-	// calculates the total length
-	TotLeng = 0;
-	va_start(Args, FrameLen);
-	do
-	{
-		leng = va_arg(Args, int);
-		if (leng == END_OF_ARGS)
-		{
-			break;
-		}
-		p = va_arg(Args, PVOID);
-		NdisMoveMemory(&Buffer[TotLeng], p, leng);
-		TotLeng = TotLeng + leng;
-	} while(TRUE);
-
-	va_end(Args); /* clean up */
-	*FrameLen = TotLeng;
-	return TotLeng;
-}
-
-// ===========================================================================================
-// mlme_queue.c
-// ===========================================================================================
-
-/*! \brief	Initialize The MLME Queue, used by MLME Functions
- *	\param	*Queue	   The MLME Queue
- *	\return Always	   Return NDIS_STATE_SUCCESS in this implementation
- *	\pre
- *	\post
- *	\note	Because this is done only once (at the init stage), no need to be locked
-
- IRQL = PASSIVE_LEVEL
-
- */
-NDIS_STATUS MlmeQueueInit(
-	IN MLME_QUEUE *Queue)
-{
-	INT i;
-
-	NdisAllocateSpinLock(&Queue->Lock);
-
-	Queue->Num	= 0;
-	Queue->Head = 0;
-	Queue->Tail = 0;
-
-	for (i = 0; i < MAX_LEN_OF_MLME_QUEUE; i++)
-	{
-		Queue->Entry[i].Occupied = FALSE;
-		Queue->Entry[i].MsgLen = 0;
-		NdisZeroMemory(Queue->Entry[i].Msg, MGMT_DMA_BUFFER_SIZE);
-	}
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-/*! \brief	 Enqueue a message for other threads, if they want to send messages to MLME thread
- *	\param	*Queue	  The MLME Queue
- *	\param	 Machine  The State Machine Id
- *	\param	 MsgType  The Message Type
- *	\param	 MsgLen   The Message length
- *	\param	*Msg	  The message pointer
- *	\return  TRUE if enqueue is successful, FALSE if the queue is full
- *	\pre
- *	\post
- *	\note	 The message has to be initialized
-
- IRQL = PASSIVE_LEVEL
- IRQL = DISPATCH_LEVEL
-
- */
-BOOLEAN MlmeEnqueue(
-	IN	PRTMP_ADAPTER	pAd,
-	IN ULONG Machine,
-	IN ULONG MsgType,
-	IN ULONG MsgLen,
-	IN VOID *Msg)
-{
-	INT Tail;
-	MLME_QUEUE	*Queue = (MLME_QUEUE *)&pAd->Mlme.Queue;
-
-	// Do nothing if the driver is starting halt state.
-	// This might happen when timer already been fired before cancel timer with mlmehalt
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
-		return FALSE;
-
-	// First check the size, it MUST not exceed the mlme queue size
-	if (MsgLen > MGMT_DMA_BUFFER_SIZE)
-	{
-		DBGPRINT_ERR(("MlmeEnqueue: msg too large, size = %ld \n", MsgLen));
-		return FALSE;
-	}
-
-	if (MlmeQueueFull(Queue))
-	{
-		return FALSE;
-	}
-
-	NdisAcquireSpinLock(&(Queue->Lock));
-	Tail = Queue->Tail;
-	Queue->Tail++;
-	Queue->Num++;
-	if (Queue->Tail == MAX_LEN_OF_MLME_QUEUE)
-	{
-		Queue->Tail = 0;
-	}
-
-	Queue->Entry[Tail].Wcid = RESERVED_WCID;
-	Queue->Entry[Tail].Occupied = TRUE;
-	Queue->Entry[Tail].Machine = Machine;
-	Queue->Entry[Tail].MsgType = MsgType;
-	Queue->Entry[Tail].MsgLen  = MsgLen;
-
-	if (Msg != NULL)
-	{
-		NdisMoveMemory(Queue->Entry[Tail].Msg, Msg, MsgLen);
-	}
-
-	NdisReleaseSpinLock(&(Queue->Lock));
-	return TRUE;
-}
-
-/*! \brief	 This function is used when Recv gets a MLME message
- *	\param	*Queue			 The MLME Queue
- *	\param	 TimeStampHigh	 The upper 32 bit of timestamp
- *	\param	 TimeStampLow	 The lower 32 bit of timestamp
- *	\param	 Rssi			 The receiving RSSI strength
- *	\param	 MsgLen			 The length of the message
- *	\param	*Msg			 The message pointer
- *	\return  TRUE if everything ok, FALSE otherwise (like Queue Full)
- *	\pre
- *	\post
-
- IRQL = DISPATCH_LEVEL
-
- */
-BOOLEAN MlmeEnqueueForRecv(
-	IN	PRTMP_ADAPTER	pAd,
-	IN ULONG Wcid,
-	IN ULONG TimeStampHigh,
-	IN ULONG TimeStampLow,
-	IN UCHAR Rssi0,
-	IN UCHAR Rssi1,
-	IN UCHAR Rssi2,
-	IN ULONG MsgLen,
-	IN VOID *Msg,
-	IN UCHAR Signal)
-{
-	INT		 Tail, Machine;
-	PFRAME_802_11 pFrame = (PFRAME_802_11)Msg;
-	INT		 MsgType;
-	MLME_QUEUE	*Queue = (MLME_QUEUE *)&pAd->Mlme.Queue;
-
-#ifdef RALINK_ATE
-	/* Nothing to do in ATE mode */
-	if(ATE_ON(pAd))
-		return FALSE;
-#endif // RALINK_ATE //
-
-	// Do nothing if the driver is starting halt state.
-	// This might happen when timer already been fired before cancel timer with mlmehalt
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
-	{
-		DBGPRINT_ERR(("MlmeEnqueueForRecv: fRTMP_ADAPTER_HALT_IN_PROGRESS\n"));
-		return FALSE;
-	}
-
-	// First check the size, it MUST not exceed the mlme queue size
-	if (MsgLen > MGMT_DMA_BUFFER_SIZE)
-	{
-		DBGPRINT_ERR(("MlmeEnqueueForRecv: frame too large, size = %ld \n", MsgLen));
-		return FALSE;
-	}
-
-	if (MlmeQueueFull(Queue))
-	{
-		return FALSE;
-	}
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-		if (!MsgTypeSubst(pAd, pFrame, &Machine, &MsgType))
-		{
-			DBGPRINT_ERR(("MlmeEnqueueForRecv: un-recongnized mgmt->subtype=%d\n",pFrame->Hdr.FC.SubType));
-			return FALSE;
-		}
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-	// OK, we got all the informations, it is time to put things into queue
-	NdisAcquireSpinLock(&(Queue->Lock));
-	Tail = Queue->Tail;
-	Queue->Tail++;
-	Queue->Num++;
-	if (Queue->Tail == MAX_LEN_OF_MLME_QUEUE)
-	{
-		Queue->Tail = 0;
-	}
-	Queue->Entry[Tail].Occupied = TRUE;
-	Queue->Entry[Tail].Machine = Machine;
-	Queue->Entry[Tail].MsgType = MsgType;
-	Queue->Entry[Tail].MsgLen  = MsgLen;
-	Queue->Entry[Tail].TimeStamp.u.LowPart = TimeStampLow;
-	Queue->Entry[Tail].TimeStamp.u.HighPart = TimeStampHigh;
-	Queue->Entry[Tail].Rssi0 = Rssi0;
-	Queue->Entry[Tail].Rssi1 = Rssi1;
-	Queue->Entry[Tail].Rssi2 = Rssi2;
-	Queue->Entry[Tail].Signal = Signal;
-	Queue->Entry[Tail].Wcid = (UCHAR)Wcid;
-
-	Queue->Entry[Tail].Channel = pAd->LatchRfRegs.Channel;
-
-	if (Msg != NULL)
-	{
-		NdisMoveMemory(Queue->Entry[Tail].Msg, Msg, MsgLen);
-	}
-
-	NdisReleaseSpinLock(&(Queue->Lock));
-
-	RTMP_MLME_HANDLER(pAd);
-
-	return TRUE;
-}
-
-
-/*! \brief	 Dequeue a message from the MLME Queue
- *	\param	*Queue	  The MLME Queue
- *	\param	*Elem	  The message dequeued from MLME Queue
- *	\return  TRUE if the Elem contains something, FALSE otherwise
- *	\pre
- *	\post
-
- IRQL = DISPATCH_LEVEL
-
- */
-BOOLEAN MlmeDequeue(
-	IN MLME_QUEUE *Queue,
-	OUT MLME_QUEUE_ELEM **Elem)
-{
-	NdisAcquireSpinLock(&(Queue->Lock));
-	*Elem = &(Queue->Entry[Queue->Head]);
-	Queue->Num--;
-	Queue->Head++;
-	if (Queue->Head == MAX_LEN_OF_MLME_QUEUE)
-	{
-		Queue->Head = 0;
-	}
-	NdisReleaseSpinLock(&(Queue->Lock));
-	return TRUE;
-}
-
-// IRQL = DISPATCH_LEVEL
-VOID	MlmeRestartStateMachine(
-	IN	PRTMP_ADAPTER	pAd)
-{
-#ifdef RTMP_MAC_PCI
-	MLME_QUEUE_ELEM		*Elem = NULL;
-#endif // RTMP_MAC_PCI //
-#ifdef CONFIG_STA_SUPPORT
-	BOOLEAN				Cancelled;
-#endif // CONFIG_STA_SUPPORT //
-
-	DBGPRINT(RT_DEBUG_TRACE, ("MlmeRestartStateMachine \n"));
-
-#ifdef RTMP_MAC_PCI
-	NdisAcquireSpinLock(&pAd->Mlme.TaskLock);
-	if(pAd->Mlme.bRunning)
-	{
-		NdisReleaseSpinLock(&pAd->Mlme.TaskLock);
-		return;
-	}
-	else
-	{
-		pAd->Mlme.bRunning = TRUE;
-	}
-	NdisReleaseSpinLock(&pAd->Mlme.TaskLock);
-
-	// Remove all Mlme queues elements
-	while (!MlmeQueueEmpty(&pAd->Mlme.Queue))
-	{
-		//From message type, determine which state machine I should drive
-		if (MlmeDequeue(&pAd->Mlme.Queue, &Elem))
-		{
-			// free MLME element
-			Elem->Occupied = FALSE;
-			Elem->MsgLen = 0;
-
-		}
-		else {
-			DBGPRINT_ERR(("MlmeRestartStateMachine: MlmeQueue empty\n"));
-		}
-	}
-#endif // RTMP_MAC_PCI //
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-#ifdef QOS_DLS_SUPPORT
-		UCHAR i;
-#endif // QOS_DLS_SUPPORT //
-		// Cancel all timer events
-		// Be careful to cancel new added timer
-		RTMPCancelTimer(&pAd->MlmeAux.AssocTimer,	  &Cancelled);
-		RTMPCancelTimer(&pAd->MlmeAux.ReassocTimer,   &Cancelled);
-		RTMPCancelTimer(&pAd->MlmeAux.DisassocTimer,  &Cancelled);
-		RTMPCancelTimer(&pAd->MlmeAux.AuthTimer,	   &Cancelled);
-		RTMPCancelTimer(&pAd->MlmeAux.BeaconTimer,	   &Cancelled);
-		RTMPCancelTimer(&pAd->MlmeAux.ScanTimer,	   &Cancelled);
-
-#ifdef QOS_DLS_SUPPORT
-		for (i=0; i<MAX_NUM_OF_DLS_ENTRY; i++)
-		{
-			RTMPCancelTimer(&pAd->StaCfg.DLSEntry[i].Timer, &Cancelled);
-		}
-#endif // QOS_DLS_SUPPORT //
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-	// Change back to original channel in case of doing scan
-	AsicSwitchChannel(pAd, pAd->CommonCfg.Channel, FALSE);
-	AsicLockChannel(pAd, pAd->CommonCfg.Channel);
-
-	// Resume MSDU which is turned off durning scan
-	RTMPResumeMsduTransmission(pAd);
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-		// Set all state machines back IDLE
-		pAd->Mlme.CntlMachine.CurrState    = CNTL_IDLE;
-		pAd->Mlme.AssocMachine.CurrState   = ASSOC_IDLE;
-		pAd->Mlme.AuthMachine.CurrState    = AUTH_REQ_IDLE;
-		pAd->Mlme.AuthRspMachine.CurrState = AUTH_RSP_IDLE;
-		pAd->Mlme.SyncMachine.CurrState    = SYNC_IDLE;
-		pAd->Mlme.ActMachine.CurrState    = ACT_IDLE;
-#ifdef QOS_DLS_SUPPORT
-		pAd->Mlme.DlsMachine.CurrState    = DLS_IDLE;
-#endif // QOS_DLS_SUPPORT //
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-#ifdef RTMP_MAC_PCI
-	// Remove running state
-	NdisAcquireSpinLock(&pAd->Mlme.TaskLock);
-	pAd->Mlme.bRunning = FALSE;
-	NdisReleaseSpinLock(&pAd->Mlme.TaskLock);
-#endif // RTMP_MAC_PCI //
-}
-
-/*! \brief	test if the MLME Queue is empty
- *	\param	*Queue	  The MLME Queue
- *	\return TRUE if the Queue is empty, FALSE otherwise
- *	\pre
- *	\post
-
- IRQL = DISPATCH_LEVEL
-
- */
-BOOLEAN MlmeQueueEmpty(
-	IN MLME_QUEUE *Queue)
-{
-	BOOLEAN Ans;
-
-	NdisAcquireSpinLock(&(Queue->Lock));
-	Ans = (Queue->Num == 0);
-	NdisReleaseSpinLock(&(Queue->Lock));
-
-	return Ans;
-}
-
-/*! \brief	 test if the MLME Queue is full
- *	\param	 *Queue		 The MLME Queue
- *	\return  TRUE if the Queue is empty, FALSE otherwise
- *	\pre
- *	\post
-
- IRQL = PASSIVE_LEVEL
- IRQL = DISPATCH_LEVEL
-
- */
-BOOLEAN MlmeQueueFull(
-	IN MLME_QUEUE *Queue)
-{
-	BOOLEAN Ans;
-
-	NdisAcquireSpinLock(&(Queue->Lock));
-	Ans = (Queue->Num == MAX_LEN_OF_MLME_QUEUE || Queue->Entry[Queue->Tail].Occupied);
-	NdisReleaseSpinLock(&(Queue->Lock));
-
-	return Ans;
-}
-
-/*! \brief	 The destructor of MLME Queue
- *	\param
- *	\return
- *	\pre
- *	\post
- *	\note	Clear Mlme Queue, Set Queue->Num to Zero.
-
- IRQL = PASSIVE_LEVEL
-
- */
-VOID MlmeQueueDestroy(
-	IN MLME_QUEUE *pQueue)
-{
-	NdisAcquireSpinLock(&(pQueue->Lock));
-	pQueue->Num  = 0;
-	pQueue->Head = 0;
-	pQueue->Tail = 0;
-	NdisReleaseSpinLock(&(pQueue->Lock));
-	NdisFreeSpinLock(&(pQueue->Lock));
-}
-
-
-/*! \brief	 To substitute the message type if the message is coming from external
- *	\param	pFrame		   The frame received
- *	\param	*Machine	   The state machine
- *	\param	*MsgType	   the message type for the state machine
- *	\return TRUE if the substitution is successful, FALSE otherwise
- *	\pre
- *	\post
-
- IRQL = DISPATCH_LEVEL
-
- */
-#ifdef CONFIG_STA_SUPPORT
-BOOLEAN MsgTypeSubst(
-	IN PRTMP_ADAPTER  pAd,
-	IN PFRAME_802_11 pFrame,
-	OUT INT *Machine,
-	OUT INT *MsgType)
-{
-	USHORT	Seq, Alg;
-	UCHAR	EAPType;
-	PUCHAR	pData;
-
-	// Pointer to start of data frames including SNAP header
-	pData = (PUCHAR) pFrame + LENGTH_802_11;
-
-	// The only data type will pass to this function is EAPOL frame
-	if (pFrame->Hdr.FC.Type == BTYPE_DATA)
-	{
-		{
-	        *Machine = WPA_STATE_MACHINE;
-			EAPType = *((UCHAR*)pFrame + LENGTH_802_11 + LENGTH_802_1_H + 1);
-	        return (WpaMsgTypeSubst(EAPType, (INT *) MsgType));
-		}
-	}
-
-	switch (pFrame->Hdr.FC.SubType)
-	{
-		case SUBTYPE_ASSOC_REQ:
-			*Machine = ASSOC_STATE_MACHINE;
-			*MsgType = MT2_PEER_ASSOC_REQ;
-			break;
-		case SUBTYPE_ASSOC_RSP:
-			*Machine = ASSOC_STATE_MACHINE;
-			*MsgType = MT2_PEER_ASSOC_RSP;
-			break;
-		case SUBTYPE_REASSOC_REQ:
-			*Machine = ASSOC_STATE_MACHINE;
-			*MsgType = MT2_PEER_REASSOC_REQ;
-			break;
-		case SUBTYPE_REASSOC_RSP:
-			*Machine = ASSOC_STATE_MACHINE;
-			*MsgType = MT2_PEER_REASSOC_RSP;
-			break;
-		case SUBTYPE_PROBE_REQ:
-			*Machine = SYNC_STATE_MACHINE;
-			*MsgType = MT2_PEER_PROBE_REQ;
-			break;
-		case SUBTYPE_PROBE_RSP:
-			*Machine = SYNC_STATE_MACHINE;
-			*MsgType = MT2_PEER_PROBE_RSP;
-			break;
-		case SUBTYPE_BEACON:
-			*Machine = SYNC_STATE_MACHINE;
-			*MsgType = MT2_PEER_BEACON;
-			break;
-		case SUBTYPE_ATIM:
-			*Machine = SYNC_STATE_MACHINE;
-			*MsgType = MT2_PEER_ATIM;
-			break;
-		case SUBTYPE_DISASSOC:
-			*Machine = ASSOC_STATE_MACHINE;
-			*MsgType = MT2_PEER_DISASSOC_REQ;
-			break;
-		case SUBTYPE_AUTH:
-			// get the sequence number from payload 24 Mac Header + 2 bytes algorithm
-			NdisMoveMemory(&Seq, &pFrame->Octet[2], sizeof(USHORT));
-			NdisMoveMemory(&Alg, &pFrame->Octet[0], sizeof(USHORT));
-			if (Seq == 1 || Seq == 3)
-			{
-				*Machine = AUTH_RSP_STATE_MACHINE;
-				*MsgType = MT2_PEER_AUTH_ODD;
-			}
-			else if (Seq == 2 || Seq == 4)
-			{
-				if (Alg == AUTH_MODE_OPEN || Alg == AUTH_MODE_KEY)
-				{
-					*Machine = AUTH_STATE_MACHINE;
-					*MsgType = MT2_PEER_AUTH_EVEN;
-				}
-			}
-			else
-			{
-				return FALSE;
-			}
-			break;
-		case SUBTYPE_DEAUTH:
-			*Machine = AUTH_RSP_STATE_MACHINE;
-			*MsgType = MT2_PEER_DEAUTH;
-			break;
-		case SUBTYPE_ACTION:
-			*Machine = ACTION_STATE_MACHINE;
-			//  Sometimes Sta will return with category bytes with MSB = 1, if they receive catogory out of their support
-			if ((pFrame->Octet[0]&0x7F) > MAX_PEER_CATE_MSG)
-			{
-				*MsgType = MT2_ACT_INVALID;
-			}
-			else
-			{
-				*MsgType = (pFrame->Octet[0]&0x7F);
-			}
-			break;
-		default:
-			return FALSE;
-			break;
-	}
-
-	return TRUE;
-}
-#endif // CONFIG_STA_SUPPORT //
-
-// ===========================================================================================
-// state_machine.c
-// ===========================================================================================
-
-/*! \brief Initialize the state machine.
- *	\param *S			pointer to the state machine
- *	\param	Trans		State machine transition function
- *	\param	StNr		number of states
- *	\param	MsgNr		number of messages
- *	\param	DefFunc		default function, when there is invalid state/message combination
- *	\param	InitState	initial state of the state machine
- *	\param	Base		StateMachine base, internal use only
- *	\pre p_sm should be a legal pointer
- *	\post
-
- IRQL = PASSIVE_LEVEL
-
- */
-VOID StateMachineInit(
-	IN STATE_MACHINE *S,
-	IN STATE_MACHINE_FUNC Trans[],
-	IN ULONG StNr,
-	IN ULONG MsgNr,
-	IN STATE_MACHINE_FUNC DefFunc,
-	IN ULONG InitState,
-	IN ULONG Base)
-{
-	ULONG i, j;
-
-	// set number of states and messages
-	S->NrState = StNr;
-	S->NrMsg   = MsgNr;
-	S->Base    = Base;
-
-	S->TransFunc  = Trans;
-
-	// init all state transition to default function
-	for (i = 0; i < StNr; i++)
-	{
-		for (j = 0; j < MsgNr; j++)
-		{
-			S->TransFunc[i * MsgNr + j] = DefFunc;
-		}
-	}
-
-	// set the starting state
-	S->CurrState = InitState;
-}
-
-/*! \brief This function fills in the function pointer into the cell in the state machine
- *	\param *S	pointer to the state machine
- *	\param St	state
- *	\param Msg	incoming message
- *	\param f	the function to be executed when (state, message) combination occurs at the state machine
- *	\pre *S should be a legal pointer to the state machine, st, msg, should be all within the range, Base should be set in the initial state
- *	\post
-
- IRQL = PASSIVE_LEVEL
-
- */
-VOID StateMachineSetAction(
-	IN STATE_MACHINE *S,
-	IN ULONG St,
-	IN ULONG Msg,
-	IN STATE_MACHINE_FUNC Func)
-{
-	ULONG MsgIdx;
-
-	MsgIdx = Msg - S->Base;
-
-	if (St < S->NrState && MsgIdx < S->NrMsg)
-	{
-		// boundary checking before setting the action
-		S->TransFunc[St * S->NrMsg + MsgIdx] = Func;
-	}
-}
-
-/*! \brief	 This function does the state transition
- *	\param	 *Adapter the NIC adapter pointer
- *	\param	 *S	  the state machine
- *	\param	 *Elem	  the message to be executed
- *	\return   None
-
- IRQL = DISPATCH_LEVEL
-
- */
-VOID StateMachinePerformAction(
-	IN	PRTMP_ADAPTER	pAd,
-	IN STATE_MACHINE *S,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-	(*(S->TransFunc[S->CurrState * S->NrMsg + Elem->MsgType - S->Base]))(pAd, Elem);
-}
-
-/*
-	==========================================================================
-	Description:
-		The drop function, when machine executes this, the message is simply
-		ignored. This function does nothing, the message is freed in
-		StateMachinePerformAction()
-	==========================================================================
- */
-VOID Drop(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-}
-
-// ===========================================================================================
-// lfsr.c
-// ===========================================================================================
-
-/*
-	==========================================================================
-	Description:
-
-	IRQL = PASSIVE_LEVEL
-
-	==========================================================================
- */
-VOID LfsrInit(
-	IN PRTMP_ADAPTER pAd,
-	IN ULONG Seed)
-{
-	if (Seed == 0)
-		pAd->Mlme.ShiftReg = 1;
-	else
-		pAd->Mlme.ShiftReg = Seed;
-}
-
-/*
-	==========================================================================
-	Description:
-	==========================================================================
- */
-UCHAR RandomByte(
-	IN PRTMP_ADAPTER pAd)
-{
-	ULONG i;
-	UCHAR R, Result;
-
-	R = 0;
-
-	if (pAd->Mlme.ShiftReg == 0)
-	NdisGetSystemUpTime((ULONG *)&pAd->Mlme.ShiftReg);
-
-	for (i = 0; i < 8; i++)
-	{
-		if (pAd->Mlme.ShiftReg & 0x00000001)
-		{
-			pAd->Mlme.ShiftReg = ((pAd->Mlme.ShiftReg ^ LFSR_MASK) >> 1) | 0x80000000;
-			Result = 1;
-		}
-		else
-		{
-			pAd->Mlme.ShiftReg = pAd->Mlme.ShiftReg >> 1;
-			Result = 0;
-		}
-		R = (R << 1) | Result;
-	}
-
-	return R;
-}
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		Verify the support rate for different PHY type
-
-	Arguments:
-		pAd				Pointer to our adapter
-
-	Return Value:
-		None
-
-	IRQL = PASSIVE_LEVEL
-
-	========================================================================
-*/
-VOID	RTMPCheckRates(
-	IN		PRTMP_ADAPTER	pAd,
-	IN OUT	UCHAR			SupRate[],
-	IN OUT	UCHAR			*SupRateLen)
-{
-	UCHAR	RateIdx, i, j;
-	UCHAR	NewRate[12], NewRateLen;
-
-	NewRateLen = 0;
-
-	if (pAd->CommonCfg.PhyMode == PHY_11B)
-		RateIdx = 4;
-	else
-		RateIdx = 12;
-
-	// Check for support rates exclude basic rate bit
-	for (i = 0; i < *SupRateLen; i++)
-		for (j = 0; j < RateIdx; j++)
-			if ((SupRate[i] & 0x7f) == RateIdTo500Kbps[j])
-				NewRate[NewRateLen++] = SupRate[i];
-
-	*SupRateLen = NewRateLen;
-	NdisMoveMemory(SupRate, NewRate, NewRateLen);
-}
-
-#ifdef CONFIG_STA_SUPPORT
-#ifdef DOT11_N_SUPPORT
-BOOLEAN RTMPCheckChannel(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR		CentralChannel,
-	IN UCHAR		Channel)
-{
-	UCHAR		k;
-	UCHAR		UpperChannel = 0, LowerChannel = 0;
-	UCHAR		NoEffectChannelinList = 0;
-
-	// Find upper and lower channel according to 40MHz current operation.
-	if (CentralChannel < Channel)
-	{
-		UpperChannel = Channel;
-		if (CentralChannel > 2)
-			LowerChannel = CentralChannel - 2;
-		else
-			return FALSE;
-	}
-	else if (CentralChannel > Channel)
-	{
-		UpperChannel = CentralChannel + 2;
-		LowerChannel = Channel;
-	}
-
-	for (k = 0;k < pAd->ChannelListNum;k++)
-	{
-		if (pAd->ChannelList[k].Channel == UpperChannel)
-		{
-			NoEffectChannelinList ++;
-		}
-		if (pAd->ChannelList[k].Channel == LowerChannel)
-		{
-			NoEffectChannelinList ++;
-		}
-	}
-
-	DBGPRINT(RT_DEBUG_TRACE,("Total Channel in Channel List = [%d]\n", NoEffectChannelinList));
-	if (NoEffectChannelinList == 2)
-		return TRUE;
-	else
-		return FALSE;
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-		Verify the support rate for HT phy type
-
-	Arguments:
-		pAd				Pointer to our adapter
-
-	Return Value:
-		FALSE if pAd->CommonCfg.SupportedHtPhy doesn't accept the pHtCapability.  (AP Mode)
-
-	IRQL = PASSIVE_LEVEL
-
-	========================================================================
-*/
-BOOLEAN		RTMPCheckHt(
-	IN	PRTMP_ADAPTER			pAd,
-	IN	UCHAR					Wcid,
-	IN	HT_CAPABILITY_IE		*pHtCapability,
-	IN	ADD_HT_INFO_IE			*pAddHtInfo)
-{
-	if (Wcid >= MAX_LEN_OF_MAC_TABLE)
-		return FALSE;
-
-	// If use AMSDU, set flag.
-	if (pAd->CommonCfg.DesiredHtPhy.AmsduEnable)
-		CLIENT_STATUS_SET_FLAG(&pAd->MacTab.Content[Wcid], fCLIENT_STATUS_AMSDU_INUSED);
-	// Save Peer Capability
-	if (pHtCapability->HtCapInfo.ShortGIfor20)
-		CLIENT_STATUS_SET_FLAG(&pAd->MacTab.Content[Wcid], fCLIENT_STATUS_SGI20_CAPABLE);
-	if (pHtCapability->HtCapInfo.ShortGIfor40)
-		CLIENT_STATUS_SET_FLAG(&pAd->MacTab.Content[Wcid], fCLIENT_STATUS_SGI40_CAPABLE);
-	if (pHtCapability->HtCapInfo.TxSTBC)
-		CLIENT_STATUS_SET_FLAG(&pAd->MacTab.Content[Wcid], fCLIENT_STATUS_TxSTBC_CAPABLE);
-	if (pHtCapability->HtCapInfo.RxSTBC)
-		CLIENT_STATUS_SET_FLAG(&pAd->MacTab.Content[Wcid], fCLIENT_STATUS_RxSTBC_CAPABLE);
-	if (pAd->CommonCfg.bRdg && pHtCapability->ExtHtCapInfo.RDGSupport)
-	{
-		CLIENT_STATUS_SET_FLAG(&pAd->MacTab.Content[Wcid], fCLIENT_STATUS_RDG_CAPABLE);
-	}
-
-	if (Wcid < MAX_LEN_OF_MAC_TABLE)
-	{
-		pAd->MacTab.Content[Wcid].MpduDensity = pHtCapability->HtCapParm.MpduDensity;
-	}
-
-	// Will check ChannelWidth for MCSSet[4] below
-	pAd->MlmeAux.HtCapability.MCSSet[4] = 0x1;
-    switch (pAd->CommonCfg.RxStream)
-	{
-		case 1:
-			pAd->MlmeAux.HtCapability.MCSSet[0] = 0xff;
-			pAd->MlmeAux.HtCapability.MCSSet[1] = 0x00;
-            pAd->MlmeAux.HtCapability.MCSSet[2] = 0x00;
-            pAd->MlmeAux.HtCapability.MCSSet[3] = 0x00;
-			break;
-		case 2:
-			pAd->MlmeAux.HtCapability.MCSSet[0] = 0xff;
-			pAd->MlmeAux.HtCapability.MCSSet[1] = 0xff;
-            pAd->MlmeAux.HtCapability.MCSSet[2] = 0x00;
-            pAd->MlmeAux.HtCapability.MCSSet[3] = 0x00;
-			break;
-		case 3:
-			pAd->MlmeAux.HtCapability.MCSSet[0] = 0xff;
-			pAd->MlmeAux.HtCapability.MCSSet[1] = 0xff;
-            pAd->MlmeAux.HtCapability.MCSSet[2] = 0xff;
-            pAd->MlmeAux.HtCapability.MCSSet[3] = 0x00;
-			break;
-	}
-
-	pAd->MlmeAux.HtCapability.HtCapInfo.ChannelWidth = pAddHtInfo->AddHtInfo.RecomWidth & pAd->CommonCfg.DesiredHtPhy.ChannelWidth;
-
-    DBGPRINT(RT_DEBUG_TRACE, ("RTMPCheckHt:: HtCapInfo.ChannelWidth=%d, RecomWidth=%d, DesiredHtPhy.ChannelWidth=%d, BW40MAvailForA/G=%d/%d, PhyMode=%d \n",
-		pAd->MlmeAux.HtCapability.HtCapInfo.ChannelWidth, pAddHtInfo->AddHtInfo.RecomWidth, pAd->CommonCfg.DesiredHtPhy.ChannelWidth,
-		pAd->NicConfig2.field.BW40MAvailForA, pAd->NicConfig2.field.BW40MAvailForG, pAd->CommonCfg.PhyMode));
-
-	pAd->MlmeAux.HtCapability.HtCapInfo.GF =  pHtCapability->HtCapInfo.GF &pAd->CommonCfg.DesiredHtPhy.GF;
-
-	// Send Assoc Req with my HT capability.
-	pAd->MlmeAux.HtCapability.HtCapInfo.AMsduSize =  pAd->CommonCfg.DesiredHtPhy.AmsduSize;
-	pAd->MlmeAux.HtCapability.HtCapInfo.MimoPs =  pAd->CommonCfg.DesiredHtPhy.MimoPs;
-	pAd->MlmeAux.HtCapability.HtCapInfo.ShortGIfor20 =  (pAd->CommonCfg.DesiredHtPhy.ShortGIfor20) & (pHtCapability->HtCapInfo.ShortGIfor20);
-	pAd->MlmeAux.HtCapability.HtCapInfo.ShortGIfor40 =  (pAd->CommonCfg.DesiredHtPhy.ShortGIfor40) & (pHtCapability->HtCapInfo.ShortGIfor40);
-	pAd->MlmeAux.HtCapability.HtCapInfo.TxSTBC =  (pAd->CommonCfg.DesiredHtPhy.TxSTBC)&(pHtCapability->HtCapInfo.RxSTBC);
-	pAd->MlmeAux.HtCapability.HtCapInfo.RxSTBC =  (pAd->CommonCfg.DesiredHtPhy.RxSTBC)&(pHtCapability->HtCapInfo.TxSTBC);
-	pAd->MlmeAux.HtCapability.HtCapParm.MaxRAmpduFactor = pAd->CommonCfg.DesiredHtPhy.MaxRAmpduFactor;
-    pAd->MlmeAux.HtCapability.HtCapParm.MpduDensity = pAd->CommonCfg.HtCapability.HtCapParm.MpduDensity;
-	pAd->MlmeAux.HtCapability.ExtHtCapInfo.PlusHTC = pHtCapability->ExtHtCapInfo.PlusHTC;
-	pAd->MacTab.Content[Wcid].HTCapability.ExtHtCapInfo.PlusHTC = pHtCapability->ExtHtCapInfo.PlusHTC;
-	if (pAd->CommonCfg.bRdg)
-	{
-		pAd->MlmeAux.HtCapability.ExtHtCapInfo.RDGSupport = pHtCapability->ExtHtCapInfo.RDGSupport;
-        pAd->MlmeAux.HtCapability.ExtHtCapInfo.PlusHTC = 1;
-	}
-
-    if (pAd->MlmeAux.HtCapability.HtCapInfo.ChannelWidth == BW_20)
-        pAd->MlmeAux.HtCapability.MCSSet[4] = 0x0;  // BW20 can't transmit MCS32
-
-	COPY_AP_HTSETTINGS_FROM_BEACON(pAd, pHtCapability);
-	return TRUE;
-}
-#endif // DOT11_N_SUPPORT //
-#endif // CONFIG_STA_SUPPORT //
-
-/*
-	========================================================================
-
-	Routine Description:
-		Verify the support rate for different PHY type
-
-	Arguments:
-		pAd				Pointer to our adapter
-
-	Return Value:
-		None
-
-	IRQL = PASSIVE_LEVEL
-
-	========================================================================
-*/
-VOID RTMPUpdateMlmeRate(
-	IN PRTMP_ADAPTER	pAd)
-{
-	UCHAR	MinimumRate;
-	UCHAR	ProperMlmeRate; //= RATE_54;
-	UCHAR	i, j, RateIdx = 12; //1, 2, 5.5, 11, 6, 9, 12, 18, 24, 36, 48, 54
-	BOOLEAN	bMatch = FALSE;
-
-	switch (pAd->CommonCfg.PhyMode)
-	{
-		case PHY_11B:
-			ProperMlmeRate = RATE_11;
-			MinimumRate = RATE_1;
-			break;
-		case PHY_11BG_MIXED:
-#ifdef DOT11_N_SUPPORT
-		case PHY_11ABGN_MIXED:
-		case PHY_11BGN_MIXED:
-#endif // DOT11_N_SUPPORT //
-			if ((pAd->MlmeAux.SupRateLen == 4) &&
-				(pAd->MlmeAux.ExtRateLen == 0))
-				// B only AP
-				ProperMlmeRate = RATE_11;
-			else
-				ProperMlmeRate = RATE_24;
-
-			if (pAd->MlmeAux.Channel <= 14)
-			MinimumRate = RATE_1;
-			else
-				MinimumRate = RATE_6;
-			break;
-		case PHY_11A:
-#ifdef DOT11_N_SUPPORT
-		case PHY_11N_2_4G:	// rt2860 need to check mlmerate for 802.11n
-		case PHY_11GN_MIXED:
-		case PHY_11AGN_MIXED:
-		case PHY_11AN_MIXED:
-		case PHY_11N_5G:
-#endif // DOT11_N_SUPPORT //
-			ProperMlmeRate = RATE_24;
-			MinimumRate = RATE_6;
-			break;
-		case PHY_11ABG_MIXED:
-			ProperMlmeRate = RATE_24;
-			if (pAd->MlmeAux.Channel <= 14)
-			   MinimumRate = RATE_1;
-			else
-				MinimumRate = RATE_6;
-			break;
-		default: // error
-			ProperMlmeRate = RATE_1;
-			MinimumRate = RATE_1;
-			break;
-	}
-
-	for (i = 0; i < pAd->MlmeAux.SupRateLen; i++)
-	{
-		for (j = 0; j < RateIdx; j++)
-		{
-			if ((pAd->MlmeAux.SupRate[i] & 0x7f) == RateIdTo500Kbps[j])
-			{
-				if (j == ProperMlmeRate)
-				{
-					bMatch = TRUE;
-					break;
-				}
-			}
-		}
-
-		if (bMatch)
-			break;
-	}
-
-	if (bMatch == FALSE)
-	{
-	for (i = 0; i < pAd->MlmeAux.ExtRateLen; i++)
-	{
-		for (j = 0; j < RateIdx; j++)
-		{
-			if ((pAd->MlmeAux.ExtRate[i] & 0x7f) == RateIdTo500Kbps[j])
-			{
-					if (j == ProperMlmeRate)
-					{
-						bMatch = TRUE;
-						break;
-					}
-			}
-		}
-
-			if (bMatch)
-			break;
-	}
-	}
-
-	if (bMatch == FALSE)
-	{
-		ProperMlmeRate = MinimumRate;
-	}
-
-	pAd->CommonCfg.MlmeRate = MinimumRate;
-	pAd->CommonCfg.RtsRate = ProperMlmeRate;
-	if (pAd->CommonCfg.MlmeRate >= RATE_6)
-	{
-		pAd->CommonCfg.MlmeTransmit.field.MODE = MODE_OFDM;
-		pAd->CommonCfg.MlmeTransmit.field.MCS = OfdmRateToRxwiMCS[pAd->CommonCfg.MlmeRate];
-		pAd->MacTab.Content[BSS0Mcast_WCID].HTPhyMode.field.MODE = MODE_OFDM;
-		pAd->MacTab.Content[BSS0Mcast_WCID].HTPhyMode.field.MCS = OfdmRateToRxwiMCS[pAd->CommonCfg.MlmeRate];
-	}
-	else
-	{
-		pAd->CommonCfg.MlmeTransmit.field.MODE = MODE_CCK;
-		pAd->CommonCfg.MlmeTransmit.field.MCS = pAd->CommonCfg.MlmeRate;
-		pAd->MacTab.Content[BSS0Mcast_WCID].HTPhyMode.field.MODE = MODE_CCK;
-		pAd->MacTab.Content[BSS0Mcast_WCID].HTPhyMode.field.MCS = pAd->CommonCfg.MlmeRate;
-	}
-
-	DBGPRINT(RT_DEBUG_TRACE, ("RTMPUpdateMlmeRate ==>   MlmeTransmit = 0x%x  \n" , pAd->CommonCfg.MlmeTransmit.word));
-}
-
-CHAR RTMPMaxRssi(
-	IN PRTMP_ADAPTER	pAd,
-	IN CHAR				Rssi0,
-	IN CHAR				Rssi1,
-	IN CHAR				Rssi2)
-{
-	CHAR	larger = -127;
-
-	if ((pAd->Antenna.field.RxPath == 1) && (Rssi0 != 0))
-	{
-		larger = Rssi0;
-	}
-
-	if ((pAd->Antenna.field.RxPath >= 2) && (Rssi1 != 0))
-	{
-		larger = max(Rssi0, Rssi1);
-	}
-
-	if ((pAd->Antenna.field.RxPath == 3) && (Rssi2 != 0))
-	{
-		larger = max(larger, Rssi2);
-	}
-
-	if (larger == -127)
-		larger = 0;
-
-	return larger;
-}
-
-
-/*
-    ========================================================================
-    Routine Description:
-        Periodic evaluate antenna link status
-
-    Arguments:
-        pAd         - Adapter pointer
-
-    Return Value:
-        None
-
-    ========================================================================
-*/
-VOID AsicEvaluateRxAnt(
-	IN PRTMP_ADAPTER	pAd)
-{
-#ifdef CONFIG_STA_SUPPORT
-	UCHAR	BBPR3 = 0;
-#endif // CONFIG_STA_SUPPORT //
-
-#ifdef RALINK_ATE
-	if (ATE_ON(pAd))
-		return;
-#endif // RALINK_ATE //
-
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RESET_IN_PROGRESS	|
-							fRTMP_ADAPTER_HALT_IN_PROGRESS	|
-							fRTMP_ADAPTER_RADIO_OFF			|
-							fRTMP_ADAPTER_NIC_NOT_EXIST		|
-							fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS) ||
-							OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE)
-#ifdef RT3090
-							|| (pAd->bPCIclkOff == TRUE)
-#endif // RT3090 //
-#ifdef ANT_DIVERSITY_SUPPORT
-							|| (pAd->EepromAccess)
-#endif // ANT_DIVERSITY_SUPPORT //
-							)
-		return;
-
-#ifdef ANT_DIVERSITY_SUPPORT
-	if ((pAd->NicConfig2.field.AntDiversity) && (pAd->CommonCfg.bRxAntDiversity == ANT_DIVERSITY_ENABLE))
-	{
-		// two antenna selection mechanism- one is antenna diversity, the other is failed antenna remove
-		// one is antenna diversity:there is only one antenna can rx and tx
-		// the other is failed antenna remove:two physical antenna can rx and tx
-			DBGPRINT(RT_DEBUG_TRACE,("AntDiv - before evaluate Pair1-Ant (%d,%d)\n",
-				pAd->RxAnt.Pair1PrimaryRxAnt, pAd->RxAnt.Pair1SecondaryRxAnt));
-
-			AsicSetRxAnt(pAd, pAd->RxAnt.Pair1SecondaryRxAnt);
-
-			pAd->RxAnt.EvaluatePeriod = 1; // 1:Means switch to SecondaryRxAnt, 0:Means switch to Pair1PrimaryRxAnt
-			pAd->RxAnt.FirstPktArrivedWhenEvaluate = FALSE;
-			pAd->RxAnt.RcvPktNumWhenEvaluate = 0;
-
-			// a one-shot timer to end the evalution
-			// dynamic adjust antenna evaluation period according to the traffic
-			if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED))
-				RTMPSetTimer(&pAd->Mlme.RxAntEvalTimer, 100);
-			else
-				RTMPSetTimer(&pAd->Mlme.RxAntEvalTimer, 300);
-		}
-		else
-#endif // ANT_DIVERSITY_SUPPORT //
-	{
-#ifdef CONFIG_STA_SUPPORT
-		IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		{
-
-			if (pAd->StaCfg.Psm == PWR_SAVE)
-				return;
-
-			RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R3, &BBPR3);
-			BBPR3 &= (~0x18);
-			if(pAd->Antenna.field.RxPath == 3)
-			{
-				BBPR3 |= (0x10);
-			}
-			else if(pAd->Antenna.field.RxPath == 2)
-			{
-				BBPR3 |= (0x8);
-			}
-			else if(pAd->Antenna.field.RxPath == 1)
-			{
-				BBPR3 |= (0x0);
-			}
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R3, BBPR3);
-#ifdef RTMP_MAC_PCI
-			IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-			pAd->StaCfg.BBPR3 = BBPR3;
-#endif // RTMP_MAC_PCI //
-			if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED)
-			)
-			{
-				ULONG	TxTotalCnt = pAd->RalinkCounters.OneSecTxNoRetryOkCount +
-									pAd->RalinkCounters.OneSecTxRetryOkCount +
-									pAd->RalinkCounters.OneSecTxFailCount;
-
-				// dynamic adjust antenna evaluation period according to the traffic
-				if (TxTotalCnt > 50)
-				{
-					RTMPSetTimer(&pAd->Mlme.RxAntEvalTimer, 20);
-					pAd->Mlme.bLowThroughput = FALSE;
-				}
-				else
-				{
-					RTMPSetTimer(&pAd->Mlme.RxAntEvalTimer, 300);
-					pAd->Mlme.bLowThroughput = TRUE;
-				}
-			}
-		}
-#endif // CONFIG_STA_SUPPORT //
-	}
-}
-
-/*
-    ========================================================================
-    Routine Description:
-        After evaluation, check antenna link status
-
-    Arguments:
-        pAd         - Adapter pointer
-
-    Return Value:
-        None
-
-    ========================================================================
-*/
-VOID AsicRxAntEvalTimeout(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3)
-{
-	RTMP_ADAPTER	*pAd = (RTMP_ADAPTER *)FunctionContext;
-	BOOLEAN			bSwapAnt = FALSE;
-#ifdef CONFIG_STA_SUPPORT
-	UCHAR			BBPR3 = 0;
-	CHAR			larger = -127, rssi0, rssi1, rssi2;
-#endif // CONFIG_STA_SUPPORT //
-
-#ifdef RALINK_ATE
-	if (ATE_ON(pAd))
-		return;
-#endif // RALINK_ATE //
-
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RESET_IN_PROGRESS	|
-							fRTMP_ADAPTER_HALT_IN_PROGRESS	|
-							fRTMP_ADAPTER_RADIO_OFF			|
-							fRTMP_ADAPTER_NIC_NOT_EXIST) ||
-							OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE)
-#ifdef RT3090
-							|| (pAd->bPCIclkOff == TRUE)
-#endif // RT3090 //
-#ifdef ANT_DIVERSITY_SUPPORT
-							|| (pAd->EepromAccess)
-#endif // ANT_DIVERSITY_SUPPORT //
-							)
-		return;
-
-#ifdef ANT_DIVERSITY_SUPPORT
-	if ((pAd->NicConfig2.field.AntDiversity) && (pAd->CommonCfg.bRxAntDiversity == ANT_DIVERSITY_ENABLE))
-	{
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-			if ((pAd->RxAnt.RcvPktNumWhenEvaluate != 0) && (pAd->RxAnt.Pair1AvgRssi[pAd->RxAnt.Pair1SecondaryRxAnt] >= pAd->RxAnt.Pair1AvgRssi[pAd->RxAnt.Pair1PrimaryRxAnt]))
-				bSwapAnt = TRUE;
-#endif // CONFIG_STA_SUPPORT //
-		if (bSwapAnt == TRUE)
-			{
-				UCHAR			temp;
-
-				//
-				// select PrimaryRxAntPair
-				//    Role change, Used Pair1SecondaryRxAnt as PrimaryRxAntPair.
-				//    Since Pair1SecondaryRxAnt Quality good than Pair1PrimaryRxAnt
-				//
-				temp = pAd->RxAnt.Pair1PrimaryRxAnt;
-				pAd->RxAnt.Pair1PrimaryRxAnt = pAd->RxAnt.Pair1SecondaryRxAnt;
-				pAd->RxAnt.Pair1SecondaryRxAnt = temp;
-
-#ifdef CONFIG_STA_SUPPORT
-				pAd->RxAnt.Pair1LastAvgRssi = (pAd->RxAnt.Pair1AvgRssi[pAd->RxAnt.Pair1SecondaryRxAnt] >> 3);
-#endif // CONFIG_STA_SUPPORT //
-//				pAd->RxAnt.EvaluateStableCnt = 0;
-			}
-			else
-			{
-				// if the evaluated antenna is not better than original, switch back to original antenna
-				AsicSetRxAnt(pAd, pAd->RxAnt.Pair1PrimaryRxAnt);
-				pAd->RxAnt.EvaluateStableCnt ++;
-			}
-
-			pAd->RxAnt.EvaluatePeriod = 0; // 1:Means switch to SecondaryRxAnt, 0:Means switch to Pair1PrimaryRxAnt
-
-#ifdef CONFIG_STA_SUPPORT
-			DBGPRINT(RT_DEBUG_TRACE,("AsicRxAntEvalAction::After Eval(fix in #%d), <%d, %d>, RcvPktNumWhenEvaluate=%ld\n",
-					pAd->RxAnt.Pair1PrimaryRxAnt, (pAd->RxAnt.Pair1AvgRssi[0] >> 3), (pAd->RxAnt.Pair1AvgRssi[1] >> 3), pAd->RxAnt.RcvPktNumWhenEvaluate));
-#endif // CONFIG_STA_SUPPORT //
-		}
-		else
-#endif // ANT_DIVERSITY_SUPPORT //
-	{
-#ifdef CONFIG_STA_SUPPORT
-		IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		{
-			if (pAd->StaCfg.Psm == PWR_SAVE)
-				return;
-
-
-			// if the traffic is low, use average rssi as the criteria
-			if (pAd->Mlme.bLowThroughput == TRUE)
-			{
-				rssi0 = pAd->StaCfg.RssiSample.LastRssi0;
-				rssi1 = pAd->StaCfg.RssiSample.LastRssi1;
-				rssi2 = pAd->StaCfg.RssiSample.LastRssi2;
-			}
-			else
-			{
-				rssi0 = pAd->StaCfg.RssiSample.AvgRssi0;
-				rssi1 = pAd->StaCfg.RssiSample.AvgRssi1;
-				rssi2 = pAd->StaCfg.RssiSample.AvgRssi2;
-			}
-
-			if(pAd->Antenna.field.RxPath == 3)
-			{
-				larger = max(rssi0, rssi1);
-
-				if (larger > (rssi2 + 20))
-					pAd->Mlme.RealRxPath = 2;
-				else
-					pAd->Mlme.RealRxPath = 3;
-			}
-			else if(pAd->Antenna.field.RxPath == 2)
-			{
-				if (rssi0 > (rssi1 + 20))
-					pAd->Mlme.RealRxPath = 1;
-				else
-					pAd->Mlme.RealRxPath = 2;
-			}
-
-			RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R3, &BBPR3);
-			BBPR3 &= (~0x18);
-			if(pAd->Mlme.RealRxPath == 3)
-			{
-				BBPR3 |= (0x10);
-			}
-			else if(pAd->Mlme.RealRxPath == 2)
-			{
-				BBPR3 |= (0x8);
-			}
-			else if(pAd->Mlme.RealRxPath == 1)
-			{
-				BBPR3 |= (0x0);
-			}
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R3, BBPR3);
-#ifdef RTMP_MAC_PCI
-			pAd->StaCfg.BBPR3 = BBPR3;
-#endif // RTMP_MAC_PCI //
-		}
-#endif // CONFIG_STA_SUPPORT //
-	}
-}
-
-
-VOID APSDPeriodicExec(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3)
-{
-	RTMP_ADAPTER *pAd = (RTMP_ADAPTER *)FunctionContext;
-
-	if (!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED))
-		return;
-
-	pAd->CommonCfg.TriggerTimerCount++;
-
-// Driver should not send trigger frame, it should be send by application layer
-/*
-	if (pAd->CommonCfg.bAPSDCapable && pAd->CommonCfg.APEdcaParm.bAPSDCapable
-		&& (pAd->CommonCfg.bNeedSendTriggerFrame ||
-		(((pAd->CommonCfg.TriggerTimerCount%20) == 19) && (!pAd->CommonCfg.bAPSDAC_BE || !pAd->CommonCfg.bAPSDAC_BK || !pAd->CommonCfg.bAPSDAC_VI || !pAd->CommonCfg.bAPSDAC_VO))))
-	{
-		DBGPRINT(RT_DEBUG_TRACE,("Sending trigger frame and enter service period when support APSD\n"));
-		RTMPSendNullFrame(pAd, pAd->CommonCfg.TxRate, TRUE);
-		pAd->CommonCfg.bNeedSendTriggerFrame = FALSE;
-		pAd->CommonCfg.TriggerTimerCount = 0;
-		pAd->CommonCfg.bInServicePeriod = TRUE;
-	}*/
-}
-
-/*
-    ========================================================================
-    Routine Description:
-        Set/reset MAC registers according to bPiggyBack parameter
-
-    Arguments:
-        pAd         - Adapter pointer
-        bPiggyBack  - Enable / Disable Piggy-Back
-
-    Return Value:
-        None
-
-    ========================================================================
-*/
-VOID RTMPSetPiggyBack(
-    IN PRTMP_ADAPTER    pAd,
-    IN BOOLEAN          bPiggyBack)
-{
-	TX_LINK_CFG_STRUC  TxLinkCfg;
-
-	RTMP_IO_READ32(pAd, TX_LINK_CFG, &TxLinkCfg.word);
-
-	TxLinkCfg.field.TxCFAckEn = bPiggyBack;
-	RTMP_IO_WRITE32(pAd, TX_LINK_CFG, TxLinkCfg.word);
-}
-
-/*
-    ========================================================================
-    Routine Description:
-        check if this entry need to switch rate automatically
-
-    Arguments:
-        pAd
-        pEntry
-
-    Return Value:
-        TURE
-        FALSE
-
-    ========================================================================
-*/
-BOOLEAN RTMPCheckEntryEnableAutoRateSwitch(
-	IN PRTMP_ADAPTER    pAd,
-	IN PMAC_TABLE_ENTRY	pEntry)
-{
-	BOOLEAN		result = TRUE;
-
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-		// only associated STA counts
-		if (pEntry && (pEntry->ValidAsCLI) && (pEntry->Sst == SST_ASSOC))
-		{
-		result = pAd->StaCfg.bAutoTxRateSwitch;
-	}
-		else
-			result = FALSE;
-
-#ifdef QOS_DLS_SUPPORT
-		if (pEntry && (pEntry->ValidAsDls))
-			result = pAd->StaCfg.bAutoTxRateSwitch;
-#endif // QOS_DLS_SUPPORT //
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-
-
-	return result;
-}
-
-
-BOOLEAN RTMPAutoRateSwitchCheck(
-	IN PRTMP_ADAPTER    pAd)
-{
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-		if (pAd->StaCfg.bAutoTxRateSwitch)
-			return TRUE;
-	}
-#endif // CONFIG_STA_SUPPORT //
-	return FALSE;
-}
-
-
-/*
-    ========================================================================
-    Routine Description:
-        check if this entry need to fix tx legacy rate
-
-    Arguments:
-        pAd
-        pEntry
-
-    Return Value:
-        TURE
-        FALSE
-
-    ========================================================================
-*/
-UCHAR RTMPStaFixedTxMode(
-	IN PRTMP_ADAPTER    pAd,
-	IN PMAC_TABLE_ENTRY	pEntry)
-{
-	UCHAR	tx_mode = FIXED_TXMODE_HT;
-
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-		tx_mode = (UCHAR)pAd->StaCfg.DesiredTransmitSetting.field.FixedTxMode;
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-	return tx_mode;
-}
-
-/*
-    ========================================================================
-    Routine Description:
-        Overwrite HT Tx Mode by Fixed Legency Tx Mode, if specified.
-
-    Arguments:
-        pAd
-        pEntry
-
-    Return Value:
-        TURE
-        FALSE
-
-    ========================================================================
-*/
-VOID RTMPUpdateLegacyTxSetting(
-		UCHAR				fixed_tx_mode,
-		PMAC_TABLE_ENTRY	pEntry)
-{
-	HTTRANSMIT_SETTING TransmitSetting;
-
-	if (fixed_tx_mode == FIXED_TXMODE_HT)
-		return;
-
-	TransmitSetting.word = 0;
-
-	TransmitSetting.field.MODE = pEntry->HTPhyMode.field.MODE;
-	TransmitSetting.field.MCS = pEntry->HTPhyMode.field.MCS;
-
-	if (fixed_tx_mode == FIXED_TXMODE_CCK)
-	{
-		TransmitSetting.field.MODE = MODE_CCK;
-		// CCK mode allow MCS 0~3
-		if (TransmitSetting.field.MCS > MCS_3)
-			TransmitSetting.field.MCS = MCS_3;
-	}
-	else
-	{
-		TransmitSetting.field.MODE = MODE_OFDM;
-		// OFDM mode allow MCS 0~7
-		if (TransmitSetting.field.MCS > MCS_7)
-			TransmitSetting.field.MCS = MCS_7;
-	}
-
-	if (pEntry->HTPhyMode.field.MODE >= TransmitSetting.field.MODE)
-	{
-		pEntry->HTPhyMode.word = TransmitSetting.word;
-		DBGPRINT(RT_DEBUG_TRACE, ("RTMPUpdateLegacyTxSetting : wcid-%d, MODE=%s, MCS=%d \n",
-				pEntry->Aid, GetPhyMode(pEntry->HTPhyMode.field.MODE), pEntry->HTPhyMode.field.MCS));
-	}
-}
-
-#ifdef CONFIG_STA_SUPPORT
-/*
-	==========================================================================
-	Description:
-		dynamic tune BBP R66 to find a balance between sensibility and
-		noise isolation
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-VOID AsicStaBbpTuning(
-	IN PRTMP_ADAPTER pAd)
-{
-	UCHAR	OrigR66Value = 0, R66;//, R66UpperBound = 0x30, R66LowerBound = 0x30;
-	CHAR	Rssi;
-
-	// 2860C did not support Fase CCA, therefore can't tune
-	if (pAd->MACVersion == 0x28600100)
-		return;
-
-	//
-	// work as a STA
-	//
-	if (pAd->Mlme.CntlMachine.CurrState != CNTL_IDLE)  // no R66 tuning when SCANNING
-		return;
-
-	if ((pAd->OpMode == OPMODE_STA)
-		&& (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED)
-			)
-		&& !(OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE))
-#ifdef RTMP_MAC_PCI
-		&& (pAd->bPCIclkOff == FALSE)
-#endif // RTMP_MAC_PCI //
-		)
-	{
-		RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R66, &OrigR66Value);
-		R66 = OrigR66Value;
-
-		if (pAd->Antenna.field.RxPath > 1)
-			Rssi = (pAd->StaCfg.RssiSample.AvgRssi0 + pAd->StaCfg.RssiSample.AvgRssi1) >> 1;
-		else
-			Rssi = pAd->StaCfg.RssiSample.AvgRssi0;
-
-		if (pAd->LatchRfRegs.Channel <= 14)
-		{	//BG band
-#ifdef RT30xx
-			// RT3070 is a no LNA solution, it should have different control regarding to AGC gain control
-			// Otherwise, it will have some throughput side effect when low RSSI
-
-			if (IS_RT3070(pAd)||IS_RT3090(pAd) || IS_RT3572(pAd) || IS_RT3390(pAd))
-			{
-				if (Rssi > RSSI_FOR_MID_LOW_SENSIBILITY)
-				{
-					R66 = 0x1C + 2*GET_LNA_GAIN(pAd) + 0x20;
-					if (OrigR66Value != R66)
-					{
-							RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R66, R66);
-					}
-				}
-				else
-				{
-					R66 = 0x1C + 2*GET_LNA_GAIN(pAd);
-					if (OrigR66Value != R66)
-					{
-							RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R66, R66);
-					}
-				}
-			}
-			else
-#endif // RT30xx //
-			{
-				if (Rssi > RSSI_FOR_MID_LOW_SENSIBILITY)
-				{
-					R66 = (0x2E + GET_LNA_GAIN(pAd)) + 0x10;
-					if (OrigR66Value != R66)
-					{
-						RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R66, R66);
-					}
-				}
-				else
-				{
-					R66 = 0x2E + GET_LNA_GAIN(pAd);
-					if (OrigR66Value != R66)
-					{
-						RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R66, R66);
-					}
-				}
-			}
-		}
-		else
-		{	//A band
-			if (pAd->CommonCfg.BBPCurrentBW == BW_20)
-			{
-				if (Rssi > RSSI_FOR_MID_LOW_SENSIBILITY)
-				{
-					R66 = 0x32 + (GET_LNA_GAIN(pAd)*5)/3 + 0x10;
-					if (OrigR66Value != R66)
-					{
-							RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R66, R66);
-					}
-				}
-				else
-				{
-					R66 = 0x32 + (GET_LNA_GAIN(pAd)*5)/3;
-					if (OrigR66Value != R66)
-					{
-							RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R66, R66);
-					}
-				}
-			}
-			else
-			{
-				if (Rssi > RSSI_FOR_MID_LOW_SENSIBILITY)
-				{
-					R66 = 0x3A + (GET_LNA_GAIN(pAd)*5)/3 + 0x10;
-					if (OrigR66Value != R66)
-					{
-							RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R66, R66);
-					}
-				}
-				else
-				{
-					R66 = 0x3A + (GET_LNA_GAIN(pAd)*5)/3;
-					if (OrigR66Value != R66)
-					{
-							RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R66, R66);
-					}
-				}
-			}
-		}
-
-
-	}
-}
-#endif // CONFIG_STA_SUPPORT //
-
-VOID RTMPSetAGCInitValue(
-	IN PRTMP_ADAPTER	pAd,
-	IN UCHAR			BandWidth)
-{
-	UCHAR	R66 = 0x30;
-
-	if (pAd->LatchRfRegs.Channel <= 14)
-	{	// BG band
-#ifdef RT30xx
-		/* Gary was verified Amazon AP and find that RT307x has BBP_R66 invalid default value */
-
-		if (IS_RT3070(pAd)||IS_RT3090(pAd) || IS_RT3572(pAd) || IS_RT3390(pAd))
-		{
-			R66 = 0x1C + 2*GET_LNA_GAIN(pAd);
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R66, R66);
-		}
-		else
-#endif // RT30xx //
-		{
-			R66 = 0x2E + GET_LNA_GAIN(pAd);
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R66, R66);
-		}
-	}
-	else
-	{	//A band
-		{
-			if (BandWidth == BW_20)
-			{
-				R66 = (UCHAR)(0x32 + (GET_LNA_GAIN(pAd)*5)/3);
-				RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R66, R66);
-			}
-#ifdef DOT11_N_SUPPORT
-			else
-			{
-				R66 = (UCHAR)(0x3A + (GET_LNA_GAIN(pAd)*5)/3);
-				RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R66, R66);
-			}
-#endif // DOT11_N_SUPPORT //
-		}
-	}
-
-}
diff --git a/drivers/staging/rt3090/common/mlme_ex.c b/drivers/staging/rt3090/common/mlme_ex.c
deleted file mode 100644
index d7fb7f58daee..000000000000
--- a/drivers/staging/rt3090/common/mlme_ex.c
+++ /dev/null
@@ -1,215 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-	Module Name:
-	mlme_ex.c
-
-	Abstract:
-	Miniport generic portion header file
-
-	Revision History:
-	Who         When          What
-	--------    ----------    ----------------------------------------------
-	Fonchi		2007-06-25		Extend original mlme APIs to support multi-entries
-*/
-
-#include "../rt_config.h"
-#include "../mlme_ex_def.h"
-//#include <stdarg.h>
-
-
-// ===========================================================================================
-// state_machine
-// ===========================================================================================
-
-/*! \brief Initialize the state machine.
- *  \param *S           pointer to the state machine
- *  \param  Trans       State machine transition function
- *  \param  StNr        number of states
- *  \param  MsgNr       number of messages
- *  \param  DefFunc     default function, when there is invalid state/message combination
- *  \param  InitState   initial state of the state machine
- *  \param  Base        StateMachine base, internal use only
- *  \pre p_sm should be a legal pointer
- *  \post
- */
-VOID StateMachineInitEx(
-	IN STATE_MACHINE_EX *S,
-	IN STATE_MACHINE_FUNC_EX Trans[],
-	IN ULONG StNr,
-	IN ULONG MsgNr,
-	IN STATE_MACHINE_FUNC_EX DefFunc,
-	IN ULONG InitState,
-	IN ULONG Base)
-{
-	ULONG i, j;
-
-	// set number of states and messages
-	S->NrState = StNr;
-	S->NrMsg   = MsgNr;
-	S->Base    = Base;
-
-	S->TransFunc  = Trans;
-
-	// init all state transition to default function
-	for (i = 0; i < StNr; i++)
-	{
-		for (j = 0; j < MsgNr; j++)
-		{
-			S->TransFunc[i * MsgNr + j] = DefFunc;
-		}
-	}
-
-	// set the starting state
-	S->CurrState = InitState;
-
-	return;
-}
-
-/*! \brief This function fills in the function pointer into the cell in the state machine
- *  \param *S   pointer to the state machine
- *  \param St   state
- *  \param Msg  incoming message
- *  \param f    the function to be executed when (state, message) combination occurs at the state machine
- *  \pre *S should be a legal pointer to the state machine, st, msg, should be all within the range, Base should be set in the initial state
- *  \post
- */
-VOID StateMachineSetActionEx(
-	IN STATE_MACHINE_EX *S,
-	IN ULONG St,
-	IN ULONG Msg,
-	IN STATE_MACHINE_FUNC_EX Func)
-{
-	ULONG MsgIdx;
-
-	MsgIdx = Msg - S->Base;
-
-	if (St < S->NrState && MsgIdx < S->NrMsg)
-	{
-		// boundary checking before setting the action
-		S->TransFunc[St * S->NrMsg + MsgIdx] = Func;
-	}
-
-	return;
-}
-
-/*! \brief   This function does the state transition
- *  \param   *Adapter the NIC adapter pointer
- *  \param   *S       the state machine
- *  \param   *Elem    the message to be executed
- *  \return   None
- */
-VOID StateMachinePerformActionEx(
-	IN PRTMP_ADAPTER	pAd,
-	IN STATE_MACHINE_EX *S,
-	IN MLME_QUEUE_ELEM *Elem,
-	USHORT Idx,
-	PULONG pCurrState)
-{
-	if (S->TransFunc[(*pCurrState) * S->NrMsg + Elem->MsgType - S->Base])
-		(*(S->TransFunc[(*pCurrState) * S->NrMsg + Elem->MsgType - S->Base]))(pAd, Elem, pCurrState, Idx);
-
-	return;
-}
-
-/*! \brief   Enqueue a message for other threads, if they want to send messages to MLME thread
- *  \param  *Queue    The MLME Queue
- *  \param   Machine  The State Machine Id
- *  \param   MsgType  The Message Type
- *  \param   MsgLen   The Message length
- *  \param  *Msg      The message pointer
- *  \return  TRUE if enqueue is successful, FALSE if the queue is full
- *  \pre
- *  \post
- *  \note    The message has to be initialized
- */
-BOOLEAN MlmeEnqueueEx(
-	IN	PRTMP_ADAPTER	pAd,
-	IN ULONG Machine,
-	IN ULONG MsgType,
-	IN ULONG MsgLen,
-	IN VOID *Msg,
-	IN USHORT Idx)
-{
-	INT Tail;
-	MLME_QUEUE *Queue = (MLME_QUEUE *)&pAd->Mlme.Queue;
-
-	// Do nothing if the driver is starting halt state.
-	// This might happen when timer already been fired before cancel timer with mlmehalt
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS))
-		return FALSE;
-
-
-	// First check the size, it MUST not exceed the mlme queue size
-	if (MsgLen > MAX_LEN_OF_MLME_BUFFER)
-	{
-		DBGPRINT_ERR(("MlmeEnqueueEx: msg too large, size = %ld \n", MsgLen));
-		return FALSE;
-	}
-
-	if (MlmeQueueFull(Queue))
-	{
-
-		return FALSE;
-	}
-
-	RTMP_SEM_LOCK(&Queue->Lock);
-	Tail = Queue->Tail;
-	Queue->Tail++;
-	Queue->Num++;
-	if (Queue->Tail == MAX_LEN_OF_MLME_QUEUE)
-	{
-		Queue->Tail = 0;
-	}
-	Queue->Entry[Tail].Occupied = TRUE;
-	Queue->Entry[Tail].Machine = Machine;
-	Queue->Entry[Tail].MsgType = MsgType;
-	Queue->Entry[Tail].MsgLen = MsgLen;
-	Queue->Entry[Tail].Idx = Idx;
-	if (Msg != NULL)
-		NdisMoveMemory(Queue->Entry[Tail].Msg, Msg, MsgLen);
-
-	RTMP_SEM_UNLOCK(&Queue->Lock);
-
-	return TRUE;
-}
-
-/*
-    ==========================================================================
-    Description:
-        The drop function, when machine executes this, the message is simply
-        ignored. This function does nothing, the message is freed in
-        StateMachinePerformAction()
-    ==========================================================================
- */
-VOID DropEx(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem,
-	PULONG pCurrState,
-	USHORT Idx)
-{
-	return;
-}
diff --git a/drivers/staging/rt3090/common/netif_block.c b/drivers/staging/rt3090/common/netif_block.c
deleted file mode 100644
index 2172957f4e41..000000000000
--- a/drivers/staging/rt3090/common/netif_block.c
+++ /dev/null
@@ -1,147 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
- */
-#ifdef BLOCK_NET_IF
-
-#include "../rt_config.h"
-#include "../netif_block.h"
-
-
-static NETIF_ENTRY freeNetIfEntryPool[FREE_NETIF_POOL_SIZE];
-static LIST_HEADER freeNetIfEntryList;
-
-void initblockQueueTab(
-	IN PRTMP_ADAPTER pAd)
-{
-	int i;
-
-	initList(&freeNetIfEntryList);
-	for (i = 0; i < FREE_NETIF_POOL_SIZE; i++)
-		insertTailList(&freeNetIfEntryList, (PLIST_ENTRY)&freeNetIfEntryPool[i]);
-
-	for (i=0; i < NUM_OF_TX_RING; i++)
-		initList(&pAd->blockQueueTab[i].NetIfList);
-
-	return;
-}
-
-BOOLEAN blockNetIf(
-	IN PBLOCK_QUEUE_ENTRY pBlockQueueEntry,
-	IN PNET_DEV pNetDev)
-{
-	PNETIF_ENTRY pNetIfEntry = NULL;
-
-	if ((pNetIfEntry = (PNETIF_ENTRY)removeHeadList(&freeNetIfEntryList)) != NULL)
-	{
-		RTMP_OS_NETDEV_STOP_QUEUE(pNetDev);
-		pNetIfEntry->pNetDev = pNetDev;
-		insertTailList(&pBlockQueueEntry->NetIfList, (PLIST_ENTRY)pNetIfEntry);
-
-		pBlockQueueEntry->SwTxQueueBlockFlag = TRUE;
-		DBGPRINT(RT_DEBUG_TRACE, ("RTMP_OS_NETDEV_STOP_QUEUE(%s)\n", RTMP_OS_NETDEV_GET_DEVNAME(pNetDev)));
-	}
-	else
-		return FALSE;
-
-	return TRUE;
-}
-
-VOID releaseNetIf(
-	IN PBLOCK_QUEUE_ENTRY pBlockQueueEntry)
-{
-	PNETIF_ENTRY pNetIfEntry = NULL;
-	PLIST_HEADER pNetIfList = &pBlockQueueEntry->NetIfList;
-
-	while((pNetIfEntry = (PNETIF_ENTRY)removeHeadList(pNetIfList)) !=  NULL)
-	{
-		PNET_DEV pNetDev = pNetIfEntry->pNetDev;
-		RTMP_OS_NETDEV_WAKE_QUEUE(pNetDev);
-		insertTailList(&freeNetIfEntryList, (PLIST_ENTRY)pNetIfEntry);
-
-		DBGPRINT(RT_DEBUG_TRACE, ("RTMP_OS_NETDEV_WAKE_QUEUE(%s)\n", RTMP_OS_NETDEV_GET_DEVNAME(pNetDev)));
-	}
-	pBlockQueueEntry->SwTxQueueBlockFlag = FALSE;
-	return;
-}
-
-
-VOID StopNetIfQueue(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR QueIdx,
-	IN PNDIS_PACKET pPacket)
-{
-	PNET_DEV NetDev = NULL;
-	UCHAR IfIdx = 0;
-	BOOLEAN valid = FALSE;
-
-#ifdef APCLI_SUPPORT
-	if (RTMP_GET_PACKET_NET_DEVICE(pPacket) >= MIN_NET_DEVICE_FOR_APCLI)
-	{
-		IfIdx = (RTMP_GET_PACKET_NET_DEVICE(pPacket) - MIN_NET_DEVICE_FOR_APCLI) % MAX_APCLI_NUM;
-		NetDev = pAd->ApCfg.ApCliTab[IfIdx].dev;
-	}
-	else
-#endif // APCLI_SUPPORT //
-#ifdef WDS_SUPPORT
-	if (RTMP_GET_PACKET_NET_DEVICE(pPacket) >= MIN_NET_DEVICE_FOR_WDS)
-	{
-		IfIdx = (RTMP_GET_PACKET_NET_DEVICE(pPacket) - MIN_NET_DEVICE_FOR_WDS) % MAX_WDS_ENTRY;
-		NetDev = pAd->WdsTab.WdsEntry[IfIdx].dev;
-	}
-	else
-#endif // WDS_SUPPORT //
-	{
-#ifdef MBSS_SUPPORT
-		if (pAd->OpMode == OPMODE_AP)
-		{
-			IfIdx = (RTMP_GET_PACKET_NET_DEVICE(pPacket) - MIN_NET_DEVICE_FOR_MBSSID) % MAX_MBSSID_NUM;
-			NetDev = pAd->ApCfg.MBSSID[IfIdx].MSSIDDev;
-		}
-		else
-		{
-			IfIdx = MAIN_MBSSID;
-			NetDev = pAd->net_dev;
-		}
-#else
-		IfIdx = MAIN_MBSSID;
-		NetDev = pAd->net_dev;
-#endif
-	}
-
-	// WMM support 4 software queues.
-	// One software queue full doesn't mean device have no capbility to transmit packet.
-	// So disable block Net-If queue function while WMM enable.
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		valid = (pAd->CommonCfg.bWmmCapable == TRUE) ? FALSE : TRUE;
-#endif // CONFIG_STA_SUPPORT //
-
-	if (valid)
-		blockNetIf(&pAd->blockQueueTab[QueIdx], NetDev);
-	return;
-}
-
-#endif // BLOCK_NET_IF //
diff --git a/drivers/staging/rt3090/common/rt_channel.c b/drivers/staging/rt3090/common/rt_channel.c
deleted file mode 100644
index da2391e8b74b..000000000000
--- a/drivers/staging/rt3090/common/rt_channel.c
+++ /dev/null
@@ -1,1287 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-*/
-
-#include "../rt_config.h"
-
-
-CH_FREQ_MAP CH_HZ_ID_MAP[]=
-		{
-			{1, 2412},
-			{2, 2417},
-			{3, 2422},
-			{4, 2427},
-			{5, 2432},
-			{6, 2437},
-			{7, 2442},
-			{8, 2447},
-			{9, 2452},
-			{10, 2457},
-			{11, 2462},
-			{12, 2467},
-			{13, 2472},
-			{14, 2484},
-
-			/*  UNII */
-			{36, 5180},
-			{40, 5200},
-			{44, 5220},
-			{48, 5240},
-			{52, 5260},
-			{56, 5280},
-			{60, 5300},
-			{64, 5320},
-			{149, 5745},
-			{153, 5765},
-			{157, 5785},
-			{161, 5805},
-			{165, 5825},
-			{167, 5835},
-			{169, 5845},
-			{171, 5855},
-			{173, 5865},
-
-			/* HiperLAN2 */
-			{100, 5500},
-			{104, 5520},
-			{108, 5540},
-			{112, 5560},
-			{116, 5580},
-			{120, 5600},
-			{124, 5620},
-			{128, 5640},
-			{132, 5660},
-			{136, 5680},
-			{140, 5700},
-
-			/* Japan MMAC */
-			{34, 5170},
-			{38, 5190},
-			{42, 5210},
-			{46, 5230},
-
-			/*  Japan */
-			{184, 4920},
-			{188, 4940},
-			{192, 4960},
-			{196, 4980},
-
-			{208, 5040},	/* Japan, means J08 */
-			{212, 5060},	/* Japan, means J12 */
-			{216, 5080},	/* Japan, means J16 */
-};
-
-INT	CH_HZ_ID_MAP_NUM = (sizeof(CH_HZ_ID_MAP)/sizeof(CH_FREQ_MAP));
-
-CH_REGION ChRegion[] =
-{
-		{	// Antigua and Berbuda
-			"AG",
-			CE,
-			{
-				{ 1,   13, 20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,  23, BOTH, FALSE},	// 5G, ch 36~48
-				{ 52,  4,  23, BOTH, FALSE},	// 5G, ch 52~64
-				{ 100, 11, 30, BOTH, FALSE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Argentina
-			"AR",
-			CE,
-			{
-				{ 1,   13, 20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 52,  4,  24, BOTH, FALSE},	// 5G, ch 52~64
-				{ 149, 4,  30, BOTH, FALSE},	// 5G, ch 149~161
-				{ 0},							// end
-			}
-		},
-
-		{	// Aruba
-			"AW",
-			CE,
-			{
-				{ 1,   13, 20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,  23, BOTH, FALSE},	// 5G, ch 36~48
-				{ 52,  4,  23, BOTH, FALSE},	// 5G, ch 52~64
-				{ 100, 11, 30, BOTH, FALSE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Australia
-			"AU",
-			CE,
-			{
-				{ 1,   13, 20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,  23, BOTH, FALSE},	// 5G, ch 36~48
-				{ 52,  4,  24, BOTH, FALSE},	// 5G, ch 52~64
-				{ 149, 5,  30, BOTH, FALSE},	// 5G, ch 149~165
-				{ 0},							// end
-			}
-		},
-
-		{	// Austria
-			"AT",
-			CE,
-			{
-				{ 1,   13, 20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,  23, IDOR, TRUE},		// 5G, ch 36~48
-				{ 52,  4,  23, IDOR, TRUE},		// 5G, ch 52~64
-				{ 100, 11, 30, BOTH, TRUE},		// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Bahamas
-			"BS",
-			CE,
-			{
-				{ 1,   13, 20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,  23, BOTH, FALSE},	// 5G, ch 36~48
-				{ 52,  4,  24, BOTH, FALSE},	// 5G, ch 52~64
-				{ 149, 5,  30, BOTH, FALSE},	// 5G, ch 149~165
-				{ 0},							// end
-			}
-		},
-
-		{	// Barbados
-			"BB",
-			CE,
-			{
-				{ 1,   13, 20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,  23, BOTH, FALSE},	// 5G, ch 36~48
-				{ 52,  4,  24, BOTH, FALSE},	// 5G, ch 52~64
-				{ 100, 11, 30, BOTH, FALSE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Bermuda
-			"BM",
-			CE,
-			{
-				{ 1,   13, 20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,  23, BOTH, FALSE},	// 5G, ch 36~48
-				{ 52,  4,  24, BOTH, FALSE},	// 5G, ch 52~64
-				{ 100, 11, 30, BOTH, FALSE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Brazil
-			"BR",
-			CE,
-			{
-				{ 1,   13, 20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,  23, BOTH, FALSE},	// 5G, ch 36~48
-				{ 52,  4,  24, BOTH, FALSE},	// 5G, ch 52~64
-				{ 100, 11, 24, BOTH, FALSE},	// 5G, ch 100~140
-				{ 149, 5,  30, BOTH, FALSE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Belgium
-			"BE",
-			CE,
-			{
-				{ 1,   13, 20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,  18, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52,  4,  18, IDOR, FALSE},	// 5G, ch 52~64
-				{ 0},							// end
-			}
-		},
-
-		{	// Bulgaria
-			"BG",
-			CE,
-			{
-				{ 1,   13, 20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,  23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52,  4,  23, IDOR, TRUE},	// 5G, ch 52~64
-				{ 100, 11, 30, ODOR, TRUE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Canada
-			"CA",
-			CE,
-			{
-				{ 1,   13, 20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,  23, BOTH, FALSE},	// 5G, ch 36~48
-				{ 52,  4,  23, BOTH, FALSE},	// 5G, ch 52~64
-				{ 149, 5,  30, BOTH, FALSE},	// 5G, ch 149~165
-				{ 0},							// end
-			}
-		},
-
-		{	// Cayman IsLands
-			"KY",
-			CE,
-			{
-				{ 1,   13, 20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,  23, BOTH, FALSE},	// 5G, ch 36~48
-				{ 52,  4,  24, BOTH, FALSE},	// 5G, ch 52~64
-				{ 100, 11, 30, BOTH, FALSE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Chile
-			"CL",
-			CE,
-			{
-				{ 1,   13, 20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,  20, BOTH, FALSE},	// 5G, ch 36~48
-				{ 52,  4,  20, BOTH, FALSE},	// 5G, ch 52~64
-				{ 149, 5,  20, BOTH, FALSE},	// 5G, ch 149~165
-				{ 0},							// end
-			}
-		},
-
-		{	// China
-			"CN",
-			CE,
-			{
-				{ 1,   13, 20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 149, 4,  27, BOTH, FALSE},	// 5G, ch 149~161
-				{ 0},							// end
-			}
-		},
-
-		{	// Colombia
-			"CO",
-			CE,
-			{
-				{ 1,   13, 20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,  17, BOTH, FALSE},	// 5G, ch 36~48
-				{ 52,  4,  24, BOTH, FALSE},	// 5G, ch 52~64
-				{ 100, 11, 30, BOTH, FALSE},	// 5G, ch 100~140
-				{ 149, 5,  30, BOTH, FALSE},	// 5G, ch 149~165
-				{ 0},							// end
-			}
-		},
-
-		{	// Costa Rica
-			"CR",
-			CE,
-			{
-				{ 1,   13, 20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,  17, BOTH, FALSE},	// 5G, ch 36~48
-				{ 52,  4,  24, BOTH, FALSE},	// 5G, ch 52~64
-				{ 149, 4,  30, BOTH, FALSE},	// 5G, ch 149~161
-				{ 0},							// end
-			}
-		},
-
-		{	// Cyprus
-			"CY",
-			CE,
-			{
-				{ 1,   13, 20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,  23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52,  4,  24, IDOR, TRUE},		// 5G, ch 52~64
-				{ 100, 11, 30, BOTH, TRUE},		// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Czech_Republic
-			"CZ",
-			CE,
-			{
-				{ 1,   13, 20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,  23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52,  4,  23, IDOR, TRUE},		// 5G, ch 52~64
-				{ 0},							// end
-			}
-		},
-
-		{	// Denmark
-			"DK",
-			CE,
-			{
-				{ 1,   13, 20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,  23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52,  4,  23, IDOR, TRUE},		// 5G, ch 52~64
-				{ 100, 11, 30, BOTH, TRUE},		// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Dominican Republic
-			"DO",
-			CE,
-			{
-				{ 1,   0,  20, BOTH, FALSE},	// 2.4 G, ch 0
-				{ 149, 4,  20, BOTH, FALSE},	// 5G, ch 149~161
-				{ 0},							// end
-			}
-		},
-
-		{	// Equador
-			"EC",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 100, 11,  27, BOTH, FALSE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// El Salvador
-			"SV",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,   23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52,  4,   30, BOTH, TRUE},	// 5G, ch 52~64
-				{ 149, 4,   36, BOTH, TRUE},	// 5G, ch 149~165
-				{ 0},							// end
-			}
-		},
-
-		{	// Finland
-			"FI",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,   23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52,  4,   23, IDOR, TRUE},	// 5G, ch 52~64
-				{ 100, 11,  30, BOTH, TRUE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// France
-			"FR",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,   23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52,  4,   23, IDOR, TRUE},	// 5G, ch 52~64
-				{ 0},							// end
-			}
-		},
-
-		{	// Germany
-			"DE",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,   23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52,  4,   23, IDOR, TRUE},	// 5G, ch 52~64
-				{ 100, 11,  30, BOTH, TRUE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Greece
-			"GR",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,   23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52,  4,   23, IDOR, TRUE},	// 5G, ch 52~64
-				{ 100, 11,  30, ODOR, TRUE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Guam
-			"GU",
-			CE,
-			{
-				{ 1,   11,  20, BOTH, FALSE},	// 2.4 G, ch 1~11
-				{ 36,  4,   17, BOTH, FALSE},	// 5G, ch 36~48
-				{ 52,  4,   24, BOTH, FALSE},	// 5G, ch 52~64
-				{ 100, 11,  30, BOTH, FALSE},	// 5G, ch 100~140
-				{ 149,  5,  30, BOTH, FALSE},	// 5G, ch 149~165
-				{ 0},							// end
-			}
-		},
-
-		{	// Guatemala
-			"GT",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,   17, BOTH, FALSE},	// 5G, ch 36~48
-				{ 52,  4,   24, BOTH, FALSE},	// 5G, ch 52~64
-				{ 149,  4,  30, BOTH, FALSE},	// 5G, ch 149~161
-				{ 0},							// end
-			}
-		},
-
-		{	// Haiti
-			"HT",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,  4,   17, BOTH, FALSE},	// 5G, ch 36~48
-				{ 52,  4,   24, BOTH, FALSE},	// 5G, ch 52~64
-				{ 149,  4,  30, BOTH, FALSE},	// 5G, ch 149~161
-				{ 0},							// end
-			}
-		},
-
-		{	// Honduras
-			"HN",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 149,  4,  27, BOTH, FALSE},	// 5G, ch 149~161
-				{ 0},							// end
-			}
-		},
-
-		{	// Hong Kong
-			"HK",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,   4,  23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52,   4,  23, IDOR, FALSE},	// 5G, ch 52~64
-				{ 149,  4,  30, BOTH, FALSE},	// 5G, ch 149~161
-				{ 0},							// end
-			}
-		},
-
-		{	// Hungary
-			"HU",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,   4,  23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52,   4,  23, IDOR, TRUE},	// 5G, ch 52~64
-				{ 0},							// end
-			}
-		},
-
-		{	// Iceland
-			"IS",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,   4,  23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52,   4,  23, IDOR, TRUE},	// 5G, ch 52~64
-				{ 100, 11,  30, BOTH, TRUE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// India
-			"IN",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 149,	4,  24, IDOR, FALSE},	// 5G, ch 149~161
-				{ 0},							// end
-			}
-		},
-
-		{	// Indonesia
-			"ID",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 149,	4,  27, BOTH, FALSE},	// 5G, ch 149~161
-				{ 0},							// end
-			}
-		},
-
-		{	// Ireland
-			"IE",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,	4,  23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52,	4,  23, IDOR, TRUE},	// 5G, ch 52~64
-				{ 100, 11,  30, ODOR, TRUE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Israel
-			"IL",
-			CE,
-			{
-				{ 1,    3,  20, IDOR, FALSE},	// 2.4 G, ch 1~3
-				{ 4,	6,  20, BOTH, FALSE},	// 2.4 G, ch 4~9
-				{ 10,	4,  20, IDOR, FALSE},	// 2.4 G, ch 10~13
-				{ 0},							// end
-			}
-		},
-
-		{	// Italy
-			"IT",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,	4,  23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52,	4,  23, IDOR, TRUE},	// 5G, ch 52~64
-				{ 100, 11,  30, ODOR, TRUE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Japan
-			"JP",
-			JAP,
-			{
-				{ 1,   14,  20, BOTH, FALSE},	// 2.4 G, ch 1~14
-				{ 36,	4,  23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 0},							// end
-			}
-		},
-
-		{	// Jordan
-			"JO",
-			CE,
-			{
-				{ 1,   13,  20, IDOR, FALSE},	// 2.4 G, ch 1~13
-				{ 36,	4,  23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 149,	4,  23, IDOR, FALSE},	// 5G, ch 149~161
-				{ 0},							// end
-			}
-		},
-
-		{	// Latvia
-			"LV",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,	4,  23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52,	4,  23, IDOR, TRUE},	// 5G, ch 52~64
-				{ 100, 11,  30, BOTH, TRUE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Liechtenstein
-			"LI",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 52,	4,  23, IDOR, TRUE},	// 5G, ch 52~64
-				{ 100, 11,  30, BOTH, TRUE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Lithuania
-			"LT",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,	4,  23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52,	4,  23, IDOR, TRUE},	// 5G, ch 52~64
-				{ 100, 11,  30, BOTH, TRUE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Luxemburg
-			"LU",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,	4,  23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52,	4,  23, IDOR, TRUE},	// 5G, ch 52~64
-				{ 100, 11,  30, BOTH, TRUE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Malaysia
-			"MY",
-			CE,
-			{
-				{ 36,	4,  23, BOTH, FALSE},	// 5G, ch 36~48
-				{ 52,	4,  23, BOTH, FALSE},	// 5G, ch 52~64
-				{ 149,  5,  20, BOTH, FALSE},	// 5G, ch 149~165
-				{ 0},							// end
-			}
-		},
-
-		{	// Malta
-			"MT",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,	4,  23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52,	4,  23, IDOR, TRUE},	// 5G, ch 52~64
-				{ 100, 11,  30, BOTH, TRUE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Marocco
-			"MA",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,	4,  24, IDOR, FALSE},	// 5G, ch 36~48
-				{ 0},							// end
-			}
-		},
-
-		{	// Mexico
-			"MX",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,	4,  23, BOTH, FALSE},	// 5G, ch 36~48
-				{ 52,	4,  24, BOTH, FALSE},	// 5G, ch 52~64
-				{ 149,  5,  30, IDOR, FALSE},	// 5G, ch 149~165
-				{ 0},							// end
-			}
-		},
-
-		{	// Netherlands
-			"NL",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,	4,  23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52,	4,  24, IDOR, TRUE},	// 5G, ch 52~64
-				{ 100, 11,  30, BOTH, TRUE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// New Zealand
-			"NZ",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,	4,  24, BOTH, FALSE},	// 5G, ch 36~48
-				{ 52,	4,  24, BOTH, FALSE},	// 5G, ch 52~64
-				{ 149,  4,  30, BOTH, FALSE},	// 5G, ch 149~161
-				{ 0},							// end
-			}
-		},
-
-		{	// Norway
-			"NO",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,	4,  24, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52,	4,  24, IDOR, TRUE},	// 5G, ch 52~64
-				{ 100, 11,  30, BOTH, TRUE},	// 5G, ch 149~161
-				{ 0},							// end
-			}
-		},
-
-		{	// Peru
-			"PE",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 149,  4,  27, BOTH, FALSE},	// 5G, ch 149~161
-				{ 0},							// end
-			}
-		},
-
-		{	// Portugal
-			"PT",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,   4,  23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52,   4,  23, IDOR, TRUE},	// 5G, ch 52~64
-				{ 100, 11,  30, BOTH, TRUE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Poland
-			"PL",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,   4,  23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52,   4,  23, IDOR, TRUE},	// 5G, ch 52~64
-				{ 100, 11,  30, BOTH, TRUE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Romania
-			"RO",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,   4,  23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52,   4,  23, IDOR, TRUE},	// 5G, ch 52~64
-				{ 100, 11,  30, BOTH, TRUE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Russia
-			"RU",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 149,  4,  20, IDOR, FALSE},	// 5G, ch 149~161
-				{ 0},							// end
-			}
-		},
-
-		{	// Saudi Arabia
-			"SA",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,   4,  23, BOTH, FALSE},	// 5G, ch 36~48
-				{ 52,   4,  23, BOTH, FALSE},	// 5G, ch 52~64
-				{ 149,  4,  23, BOTH, FALSE},	// 5G, ch 149~161
-				{ 0},							// end
-			}
-		},
-
-		{	// Serbia_and_Montenegro
-			"CS",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 0},							// end
-			}
-		},
-
-		{	// Singapore
-			"SG",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,   4,  23, BOTH, FALSE},	// 5G, ch 36~48
-				{ 52,   4,  23, BOTH, FALSE},	// 5G, ch 52~64
-				{ 149,  4,  20, BOTH, FALSE},	// 5G, ch 149~161
-				{ 0},							// end
-			}
-		},
-
-		{	// Slovakia
-			"SK",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,   4,  23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52,   4,  23, IDOR, TRUE},	// 5G, ch 52~64
-				{ 100, 11,  30, BOTH, TRUE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Slovenia
-			"SI",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,   4,  23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52,   4,  23, IDOR, TRUE},	// 5G, ch 52~64
-				{ 0},							// end
-			}
-		},
-
-		{	// South Africa
-			"ZA",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,   4,  23, BOTH, FALSE},	// 5G, ch 36~48
-				{ 52,   4,  23, IDOR, FALSE},	// 5G, ch 52~64
-				{ 100, 11,  30, BOTH, TRUE},	// 5G, ch 100~140
-				{ 149,  4,  30, BOTH, FALSE},	// 5G, ch 149~161
-				{ 0},							// end
-			}
-		},
-
-		{	// South Korea
-			"KR",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,   4,  20, BOTH, FALSE},	// 5G, ch 36~48
-				{ 52,   4,  20, BOTH, FALSE},	// 5G, ch 52~64
-				{ 100,  8,  20, BOTH, FALSE},	// 5G, ch 100~128
-				{ 149,  4,  20, BOTH, FALSE},	// 5G, ch 149~161
-				{ 0},							// end
-			}
-		},
-
-		{	// Spain
-			"ES",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,   4,  17, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52,   4,  23, IDOR, TRUE},	// 5G, ch 52~64
-				{ 100, 11,  30, BOTH, TRUE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Sweden
-			"SE",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,   4,  23, IDOR, FALSE},	// 5G, ch 36~48
-				{ 52,   4,  23, IDOR, TRUE},	// 5G, ch 52~64
-				{ 100, 11,  30, BOTH, TRUE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Switzerland
-			"CH",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~13
-				{ 36,   4,  23, IDOR, TRUE},	// 5G, ch 36~48
-				{ 52,   4,  23, IDOR, TRUE},	// 5G, ch 52~64
-				{ 0},							// end
-			}
-		},
-
-		{	// Taiwan
-			"TW",
-			CE,
-			{
-				{ 1,   11,  30, BOTH, FALSE},	// 2.4 G, ch 1~11
-				{ 52,   4,  23, IDOR, FALSE},	// 5G, ch 52~64
-				{ 0},							// end
-			}
-		},
-
-		{	// Turkey
-			"TR",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~11
-				{ 36,   4,  23, BOTH, FALSE},	// 5G, ch 36~48
-				{ 52,   4,  23, BOTH, FALSE},	// 5G, ch 52~64
-				{ 0},							// end
-			}
-		},
-
-		{	// UK
-			"GB",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~11
-				{ 36,   4,  23, IDOR, FALSE},	// 5G, ch 52~64
-				{ 52,   4,  23, IDOR, TRUE},	// 5G, ch 52~64
-				{ 100, 11,  30, BOTH, TRUE},	// 5G, ch 100~140
-				{ 0},							// end
-			}
-		},
-
-		{	// Ukraine
-			"UA",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~11
-				{ 0},							// end
-			}
-		},
-
-		{	// United_Arab_Emirates
-			"AE",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~11
-				{ 0},							// end
-			}
-		},
-
-		{	// United_States
-			"US",
-			CE,
-			{
-				{ 1,   11,  30, BOTH, FALSE},	// 2.4 G, ch 1~11
-				{ 36,   4,  17, IDOR, FALSE},	// 5G, ch 52~64
-				{ 52,   4,  24, BOTH, TRUE},	// 5G, ch 52~64
-				{ 100, 11,  30, BOTH, TRUE},	// 5G, ch 100~140
-				{ 149,  5,  30, BOTH, FALSE},	// 5G, ch 149~165
-				{ 0},							// end
-			}
-		},
-
-		{	// Venezuela
-			"VE",
-			CE,
-			{
-				{ 1,   13,  20, BOTH, FALSE},	// 2.4 G, ch 1~11
-				{ 149,  4,  27, BOTH, FALSE},	// 5G, ch 149~161
-				{ 0},							// end
-			}
-		},
-
-		{	// Default
-			"",
-			CE,
-			{
-				{ 1,   11,  20, BOTH, FALSE},	// 2.4 G, ch 1~11
-				{ 36,   4,  20, BOTH, FALSE},	// 5G, ch 52~64
-				{ 52,   4,  20, BOTH, FALSE},	// 5G, ch 52~64
-				{ 100, 11,  20, BOTH, FALSE},	// 5G, ch 100~140
-				{ 149,  5,  20, BOTH, FALSE},	// 5G, ch 149~165
-				{ 0},							// end
-			}
-		},
-};
-
-
-static PCH_REGION GetChRegion(
-	IN PUCHAR CntryCode)
-{
-	INT loop = 0;
-	PCH_REGION pChRegion = NULL;
-
-	while (strcmp((PSTRING) ChRegion[loop].CountReg, "") != 0)
-	{
-		if (strncmp((PSTRING) ChRegion[loop].CountReg, (PSTRING) CntryCode, 2) == 0)
-		{
-			pChRegion = &ChRegion[loop];
-			break;
-		}
-		loop++;
-	}
-
-	if (pChRegion == NULL)
-		pChRegion = &ChRegion[loop];
-	return pChRegion;
-}
-
-static VOID ChBandCheck(
-	IN UCHAR PhyMode,
-	OUT PUCHAR pChType)
-{
-	switch(PhyMode)
-	{
-		case PHY_11A:
-#ifdef DOT11_N_SUPPORT
-		case PHY_11AN_MIXED:
-#endif // DOT11_N_SUPPORT //
-			*pChType = BAND_5G;
-			break;
-		case PHY_11ABG_MIXED:
-#ifdef DOT11_N_SUPPORT
-		case PHY_11AGN_MIXED:
-		case PHY_11ABGN_MIXED:
-#endif // DOT11_N_SUPPORT //
-			*pChType = BAND_BOTH;
-			break;
-
-		default:
-			*pChType = BAND_24G;
-			break;
-	}
-}
-
-static UCHAR FillChList(
-	IN PRTMP_ADAPTER pAd,
-	IN PCH_DESP pChDesp,
-	IN UCHAR Offset,
-	IN UCHAR increment)
-{
-	INT i, j, l;
-	UCHAR channel;
-
-	j = Offset;
-	for (i = 0; i < pChDesp->NumOfCh; i++)
-	{
-		channel = pChDesp->FirstChannel + i * increment;
-		for (l=0; l<MAX_NUM_OF_CHANNELS; l++)
-		{
-			if (channel == pAd->TxPower[l].Channel)
-			{
-				pAd->ChannelList[j].Power = pAd->TxPower[l].Power;
-				pAd->ChannelList[j].Power2 = pAd->TxPower[l].Power2;
-				break;
-			}
-		}
-		if (l == MAX_NUM_OF_CHANNELS)
-			continue;
-
-		pAd->ChannelList[j].Channel = pChDesp->FirstChannel + i * increment;
-		pAd->ChannelList[j].MaxTxPwr = pChDesp->MaxTxPwr;
-		pAd->ChannelList[j].DfsReq = pChDesp->DfsReq;
-		j++;
-	}
-	pAd->ChannelListNum = j;
-
-	return j;
-}
-
-
-static inline VOID CreateChList(
-	IN PRTMP_ADAPTER pAd,
-	IN PCH_REGION pChRegion,
-	IN UCHAR Geography)
-{
-	INT i;
-	UCHAR offset = 0;
-	PCH_DESP pChDesp;
-	UCHAR ChType;
-	UCHAR increment;
-
-	if (pChRegion == NULL)
-		return;
-
-	ChBandCheck(pAd->CommonCfg.PhyMode, &ChType);
-
-	for (i=0; i<10; i++)
-	{
-		pChDesp = &pChRegion->ChDesp[i];
-		if (pChDesp->FirstChannel == 0)
-			break;
-
-		if (ChType == BAND_5G)
-		{
-			if (pChDesp->FirstChannel <= 14)
-				continue;
-		}
-		else if (ChType == BAND_24G)
-		{
-			if (pChDesp->FirstChannel > 14)
-				continue;
-		}
-
-		if ((pChDesp->Geography == BOTH)
-			|| (pChDesp->Geography == Geography))
-        {
-			if (pChDesp->FirstChannel > 14)
-                increment = 4;
-            else
-                increment = 1;
-			offset = FillChList(pAd, pChDesp, offset, increment);
-        }
-	}
-}
-
-
-VOID BuildChannelListEx(
-	IN PRTMP_ADAPTER pAd)
-{
-	PCH_REGION pChReg;
-
-	pChReg = GetChRegion(pAd->CommonCfg.CountryCode);
-	CreateChList(pAd, pChReg, pAd->CommonCfg.Geography);
-}
-
-
-VOID BuildBeaconChList(
-	IN PRTMP_ADAPTER pAd,
-	OUT PUCHAR pBuf,
-	OUT	PULONG pBufLen)
-{
-	INT i;
-	ULONG TmpLen;
-	PCH_REGION pChRegion;
-	PCH_DESP pChDesp;
-	UCHAR ChType;
-
-	pChRegion = GetChRegion(pAd->CommonCfg.CountryCode);
-
-	if (pChRegion == NULL)
-		return;
-
-	ChBandCheck(pAd->CommonCfg.PhyMode, &ChType);
-	*pBufLen = 0;
-
-	for (i=0; i<10; i++)
-	{
-		pChDesp = &pChRegion->ChDesp[i];
-		if (pChDesp->FirstChannel == 0)
-			break;
-
-		if (ChType == BAND_5G)
-		{
-			if (pChDesp->FirstChannel <= 14)
-				continue;
-		}
-		else if (ChType == BAND_24G)
-		{
-			if (pChDesp->FirstChannel > 14)
-				continue;
-		}
-
-		if ((pChDesp->Geography == BOTH)
-			|| (pChDesp->Geography == pAd->CommonCfg.Geography))
-		{
-			MakeOutgoingFrame(pBuf + *pBufLen,		&TmpLen,
-								1,			&pChDesp->FirstChannel,
-								1,			&pChDesp->NumOfCh,
-								1,			&pChDesp->MaxTxPwr,
-								END_OF_ARGS);
-			*pBufLen += TmpLen;
-		}
-	}
-}
-
-
-#ifdef DOT11_N_SUPPORT
-static BOOLEAN IsValidChannel(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR channel)
-
-{
-	INT i;
-
-	for (i = 0; i < pAd->ChannelListNum; i++)
-	{
-		if (pAd->ChannelList[i].Channel == channel)
-			break;
-	}
-
-	if (i == pAd->ChannelListNum)
-		return FALSE;
-	else
-		return TRUE;
-}
-
-
-static UCHAR GetExtCh(
-	IN UCHAR Channel,
-	IN UCHAR Direction)
-{
-	CHAR ExtCh;
-
-	if (Direction == EXTCHA_ABOVE)
-		ExtCh = Channel + 4;
-	else
-		ExtCh = (Channel - 4) > 0 ? (Channel - 4) : 0;
-
-	return ExtCh;
-}
-
-
-VOID N_ChannelCheck(
-	IN PRTMP_ADAPTER pAd)
-{
-	//UCHAR ChannelNum = pAd->ChannelListNum;
-	UCHAR Channel = pAd->CommonCfg.Channel;
-
-	if ((pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED) && (pAd->CommonCfg.RegTransmitSetting.field.BW  == BW_40))
-	{
-		if (Channel > 14)
-		{
-			if ((Channel == 36) || (Channel == 44) || (Channel == 52) || (Channel == 60) || (Channel == 100) || (Channel == 108) ||
-			    (Channel == 116) || (Channel == 124) || (Channel == 132) || (Channel == 149) || (Channel == 157))
-			{
-				pAd->CommonCfg.RegTransmitSetting.field.EXTCHA = EXTCHA_ABOVE;
-			}
-			else if ((Channel == 40) || (Channel == 48) || (Channel == 56) || (Channel == 64) || (Channel == 104) || (Channel == 112) ||
-					(Channel == 120) || (Channel == 128) || (Channel == 136) || (Channel == 153) || (Channel == 161))
-			{
-				pAd->CommonCfg.RegTransmitSetting.field.EXTCHA = EXTCHA_BELOW;
-			}
-			else
-			{
-				pAd->CommonCfg.RegTransmitSetting.field.BW  = BW_20;
-			}
-		}
-		else
-		{
-			do
-			{
-				UCHAR ExtCh;
-				UCHAR Dir = pAd->CommonCfg.RegTransmitSetting.field.EXTCHA;
-				ExtCh = GetExtCh(Channel, Dir);
-				if (IsValidChannel(pAd, ExtCh))
-					break;
-
-				Dir = (Dir == EXTCHA_ABOVE) ? EXTCHA_BELOW : EXTCHA_ABOVE;
-				ExtCh = GetExtCh(Channel, Dir);
-				if (IsValidChannel(pAd, ExtCh))
-				{
-					pAd->CommonCfg.RegTransmitSetting.field.EXTCHA = Dir;
-					break;
-				}
-				pAd->CommonCfg.RegTransmitSetting.field.BW  = BW_20;
-			} while(FALSE);
-
-			if (Channel == 14)
-			{
-				pAd->CommonCfg.RegTransmitSetting.field.BW  = BW_20;
-				//pAd->CommonCfg.RegTransmitSetting.field.EXTCHA = EXTCHA_NONE;	// We didn't set the ExtCh as NONE due to it'll set in RTMPSetHT()
-			}
-		}
-	}
-
-
-}
-
-
-VOID N_SetCenCh(
-	IN PRTMP_ADAPTER pAd)
-{
-	if (pAd->CommonCfg.RegTransmitSetting.field.BW == BW_40)
-	{
-		if (pAd->CommonCfg.RegTransmitSetting.field.EXTCHA == EXTCHA_ABOVE)
-		{
-			pAd->CommonCfg.CentralChannel = pAd->CommonCfg.Channel + 2;
-		}
-		else
-		{
-			if (pAd->CommonCfg.Channel == 14)
-				pAd->CommonCfg.CentralChannel = pAd->CommonCfg.Channel - 1;
-			else
-				pAd->CommonCfg.CentralChannel = pAd->CommonCfg.Channel - 2;
-		}
-	}
-	else
-	{
-		pAd->CommonCfg.CentralChannel = pAd->CommonCfg.Channel;
-	}
-}
-#endif // DOT11_N_SUPPORT //
-
-
-UINT8 GetCuntryMaxTxPwr(
-	IN PRTMP_ADAPTER pAd,
-	IN UINT8 channel)
-{
-	int i;
-	for (i = 0; i < pAd->ChannelListNum; i++)
-	{
-		if (pAd->ChannelList[i].Channel == channel)
-			break;
-	}
-
-	if (i == pAd->ChannelListNum)
-		return 0xff;
-	else
-		return pAd->ChannelList[i].MaxTxPwr;
-}
diff --git a/drivers/staging/rt3090/common/rtmp_init.c b/drivers/staging/rt3090/common/rtmp_init.c
deleted file mode 100644
index 48b95b75b0d5..000000000000
--- a/drivers/staging/rt3090/common/rtmp_init.c
+++ /dev/null
@@ -1,3882 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-	Module Name:
-	rtmp_init.c
-
-	Abstract:
-	Miniport generic portion header file
-
-	Revision History:
-	Who         When          What
-	--------    ----------    ----------------------------------------------
-*/
-
-#include "../rt_config.h"
-
-
-UCHAR    BIT8[] = {0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80};
-char*   CipherName[] = {"none","wep64","wep128","TKIP","AES","CKIP64","CKIP128"};
-
-//
-// BBP register initialization set
-//
-REG_PAIR   BBPRegTable[] = {
-	{BBP_R65,		0x2C},		// fix rssi issue
-	{BBP_R66,		0x38},	// Also set this default value to pAd->BbpTuning.R66CurrentValue at initial
-	{BBP_R69,		0x12},
-	{BBP_R70,		0xa},	// BBP_R70 will change to 0x8 in ApStartUp and LinkUp for rt2860C, otherwise value is 0xa
-	{BBP_R73,		0x10},
-	{BBP_R81,		0x37},
-	{BBP_R82,		0x62},
-	{BBP_R83,		0x6A},
-	{BBP_R84,		0x99},	// 0x19 is for rt2860E and after. This is for extension channel overlapping IOT. 0x99 is for rt2860D and before
-	{BBP_R86,		0x00},	// middle range issue, Rory @2008-01-28
-	{BBP_R91,		0x04},	// middle range issue, Rory @2008-01-28
-	{BBP_R92,		0x00},	// middle range issue, Rory @2008-01-28
-	{BBP_R103,		0x00},	// near range high-power issue, requested from Gary @2008-0528
-	{BBP_R105,		0x05},	// 0x05 is for rt2860E to turn on FEQ control. It is safe for rt2860D and before, because Bit 7:2 are reserved in rt2860D and before.
-	{BBP_R106,		0x35},  // for ShortGI throughput
-};
-#define	NUM_BBP_REG_PARMS	(sizeof(BBPRegTable) / sizeof(REG_PAIR))
-
-
-//
-// ASIC register initialization sets
-//
-
-RTMP_REG_PAIR	MACRegTable[] =	{
-#if defined(HW_BEACON_OFFSET) && (HW_BEACON_OFFSET == 0x200)
-	{BCN_OFFSET0,			0xf8f0e8e0}, /* 0x3800(e0), 0x3A00(e8), 0x3C00(f0), 0x3E00(f8), 512B for each beacon */
-	{BCN_OFFSET1,			0x6f77d0c8}, /* 0x3200(c8), 0x3400(d0), 0x1DC0(77), 0x1BC0(6f), 512B for each beacon */
-#elif defined(HW_BEACON_OFFSET) && (HW_BEACON_OFFSET == 0x100)
-	{BCN_OFFSET0,			0xece8e4e0}, /* 0x3800, 0x3A00, 0x3C00, 0x3E00, 512B for each beacon */
-	{BCN_OFFSET1,			0xfcf8f4f0}, /* 0x3800, 0x3A00, 0x3C00, 0x3E00, 512B for each beacon */
-#else
-    #error You must re-calculate new value for BCN_OFFSET0 & BCN_OFFSET1 in MACRegTable[]!!!
-#endif // HW_BEACON_OFFSET //
-
-	{LEGACY_BASIC_RATE,		0x0000013f}, //  Basic rate set bitmap
-	{HT_BASIC_RATE,		0x00008003}, // Basic HT rate set , 20M, MCS=3, MM. Format is the same as in TXWI.
-	{MAC_SYS_CTRL,		0x00}, // 0x1004, , default Disable RX
-	{RX_FILTR_CFG,		0x17f97}, //0x1400  , RX filter control,
-	{BKOFF_SLOT_CFG,	0x209}, // default set short slot time, CC_DELAY_TIME should be 2
-	//{TX_SW_CFG0,		0x40a06}, // Gary,2006-08-23
-	{TX_SW_CFG0,		0x0},		// Gary,2008-05-21 for CWC test
-	{TX_SW_CFG1,		0x80606}, // Gary,2006-08-23
-	{TX_LINK_CFG,		0x1020},		// Gary,2006-08-23
-	//{TX_TIMEOUT_CFG,	0x00182090},	// CCK has some problem. So increase timieout value. 2006-10-09// MArvek RT
-	{TX_TIMEOUT_CFG,	0x000a2090},	// CCK has some problem. So increase timieout value. 2006-10-09// MArvek RT , Modify for 2860E ,2007-08-01
-	{MAX_LEN_CFG,		MAX_AGGREGATION_SIZE | 0x00001000},	// 0x3018, MAX frame length. Max PSDU = 16kbytes.
-	{LED_CFG,		0x7f031e46}, // Gary, 2006-08-23
-
-//#ifdef CONFIG_AP_SUPPORT
-//	{WMM_AIFSN_CFG,		0x00001173},
-//	{WMM_CWMIN_CFG,		0x00002344},
-//	{WMM_CWMAX_CFG,		0x000034a6},
-//	{WMM_TXOP0_CFG,		0x00100020},
-//	{WMM_TXOP1_CFG,		0x002F0038},
-//#endif // CONFIG_AP_SUPPORT //
-
-//#ifdef CONFIG_STA_SUPPORT
-//	{WMM_AIFSN_CFG,		0x00002273},
-//	{WMM_CWMIN_CFG,		0x00002344},
-//	{WMM_CWMAX_CFG,		0x000034aa},
-//#endif // CONFIG_STA_SUPPORT //
-#ifdef INF_AMAZON_SE
-	{PBF_MAX_PCNT,			0x1F3F6F6F},	//iverson modify for usb issue, 2008/09/19
-											// 6F + 6F < total page count FE
-											// so that RX doesn't occupy TX's buffer space when WMM congestion.
-#else
-	{PBF_MAX_PCNT,			0x1F3FBF9F},	//0x1F3f7f9f},		//Jan, 2006/04/20
-#endif // INF_AMAZON_SE //
-	//{TX_RTY_CFG,			0x6bb80408},	// Jan, 2006/11/16
-// WMM_ACM_SUPPORT
-//	{TX_RTY_CFG,			0x6bb80101},	// sample
-	{TX_RTY_CFG,			0x47d01f0f},	// Jan, 2006/11/16, Set TxWI->ACK =0 in Probe Rsp Modify for 2860E ,2007-08-03
-
-	{AUTO_RSP_CFG,			0x00000013},	// Initial Auto_Responder, because QA will turn off Auto-Responder
-	{CCK_PROT_CFG,			0x05740003 /*0x01740003*/},	// Initial Auto_Responder, because QA will turn off Auto-Responder. And RTS threshold is enabled.
-	{OFDM_PROT_CFG,			0x05740003 /*0x01740003*/},	// Initial Auto_Responder, because QA will turn off Auto-Responder. And RTS threshold is enabled.
-	{GF20_PROT_CFG,			0x01744004},    // set 19:18 --> Short NAV for MIMO PS
-	{GF40_PROT_CFG,			0x03F44084},
-	{MM20_PROT_CFG,			0x01744004},
-#ifdef RTMP_MAC_PCI
-	{MM40_PROT_CFG,			0x03F54084},
-#endif // RTMP_MAC_PCI //
-	{TXOP_CTRL_CFG,			0x0000583f, /*0x0000243f*/ /*0x000024bf*/},	//Extension channel backoff.
-	{TX_RTS_CFG,			0x00092b20},
-//#ifdef WIFI_TEST
-	{EXP_ACK_TIME,			0x002400ca},	// default value
-//#else
-//	{EXP_ACK_TIME,			0x005400ca},	// suggested by Gray @ 20070323 for 11n intel-sta throughput
-//#endif // end - WIFI_TEST //
-//#ifdef CONFIG_AP_SUPPORT
-//	{TBTT_SYNC_CFG,			0x00422000},	// TBTT_ADJUST(7:0) == 0
-//	{TBTT_SYNC_CFG,			0x00012000},	// TBTT_ADJUST(7:0) == 0
-//#endif // CONFIG_AP_SUPPORT //
-	{TXOP_HLDR_ET,			0x00000002},
-
-	/* Jerry comments 2008/01/16: we use SIFS = 10us in CCK defaultly, but it seems that 10us
-		is too small for INTEL 2200bg card, so in MBSS mode, the delta time between beacon0
-		and beacon1 is SIFS (10us), so if INTEL 2200bg card connects to BSS0, the ping
-		will always lost. So we change the SIFS of CCK from 10us to 16us. */
-	{XIFS_TIME_CFG,			0x33a41010},
-	{PWR_PIN_CFG,			0x00000003},	// patch for 2880-E
-};
-
-
-#ifdef CONFIG_STA_SUPPORT
-RTMP_REG_PAIR	STAMACRegTable[] =	{
-	{WMM_AIFSN_CFG,		0x00002273},
-	{WMM_CWMIN_CFG,	0x00002344},
-	{WMM_CWMAX_CFG,	0x000034aa},
-};
-#endif // CONFIG_STA_SUPPORT //
-
-#define	NUM_MAC_REG_PARMS		(sizeof(MACRegTable) / sizeof(RTMP_REG_PAIR))
-#ifdef CONFIG_STA_SUPPORT
-#define	NUM_STA_MAC_REG_PARMS	(sizeof(STAMACRegTable) / sizeof(RTMP_REG_PAIR))
-#endif // CONFIG_STA_SUPPORT //
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		Allocate RTMP_ADAPTER data block and do some initialization
-
-	Arguments:
-		Adapter		Pointer to our adapter
-
-	Return Value:
-		NDIS_STATUS_SUCCESS
-		NDIS_STATUS_FAILURE
-
-	IRQL = PASSIVE_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-NDIS_STATUS	RTMPAllocAdapterBlock(
-	IN  PVOID	handle,
-	OUT	PRTMP_ADAPTER	*ppAdapter)
-{
-	PRTMP_ADAPTER	pAd;
-	NDIS_STATUS		Status;
-	INT			index;
-	UCHAR			*pBeaconBuf = NULL;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("--> RTMPAllocAdapterBlock\n"));
-
-	*ppAdapter = NULL;
-
-	do
-	{
-		// Allocate RTMP_ADAPTER memory block
-		pBeaconBuf = kmalloc(MAX_BEACON_SIZE, MEM_ALLOC_FLAG);
-		if (pBeaconBuf == NULL)
-		{
-			Status = NDIS_STATUS_FAILURE;
-			DBGPRINT_ERR(("Failed to allocate memory - BeaconBuf!\n"));
-			break;
-		}
-		NdisZeroMemory(pBeaconBuf, MAX_BEACON_SIZE);
-
-		Status = AdapterBlockAllocateMemory(handle, (PVOID *)&pAd);
-		if (Status != NDIS_STATUS_SUCCESS)
-		{
-			DBGPRINT_ERR(("Failed to allocate memory - ADAPTER\n"));
-			break;
-		}
-		pAd->BeaconBuf = pBeaconBuf;
-		DBGPRINT(RT_DEBUG_OFF, ("\n\n=== pAd = %p, size = %d ===\n\n", pAd, (UINT32)sizeof(RTMP_ADAPTER)));
-
-
-		// Init spin locks
-		NdisAllocateSpinLock(&pAd->MgmtRingLock);
-#ifdef RTMP_MAC_PCI
-		NdisAllocateSpinLock(&pAd->RxRingLock);
-#ifdef RT3090
-#ifdef CONFIG_STA_SUPPORT
-	NdisAllocateSpinLock(&pAd->McuCmdLock);
-#endif // CONFIG_STA_SUPPORT //
-#endif // RT3090 //
-#endif // RTMP_MAC_PCI //
-
-		for (index =0 ; index < NUM_OF_TX_RING; index++)
-		{
-			NdisAllocateSpinLock(&pAd->TxSwQueueLock[index]);
-			NdisAllocateSpinLock(&pAd->DeQueueLock[index]);
-			pAd->DeQueueRunning[index] = FALSE;
-		}
-
-		NdisAllocateSpinLock(&pAd->irq_lock);
-
-
-	} while (FALSE);
-
-	if ((Status != NDIS_STATUS_SUCCESS) && (pBeaconBuf))
-		kfree(pBeaconBuf);
-
-	*ppAdapter = pAd;
-
-	DBGPRINT_S(Status, ("<-- RTMPAllocAdapterBlock, Status=%x\n", Status));
-	return Status;
-}
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		Read initial Tx power per MCS and BW from EEPROM
-
-	Arguments:
-		Adapter						Pointer to our adapter
-
-	Return Value:
-		None
-
-	IRQL = PASSIVE_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-VOID	RTMPReadTxPwrPerRate(
-	IN	PRTMP_ADAPTER	pAd)
-{
-	ULONG		data, Adata, Gdata;
-	USHORT		i, value, value2;
-	INT			Apwrdelta, Gpwrdelta;
-	UCHAR		t1,t2,t3,t4;
-	BOOLEAN		bApwrdeltaMinus = TRUE, bGpwrdeltaMinus = TRUE;
-
-	//
-	// Get power delta for 20MHz and 40MHz.
-	//
-	DBGPRINT(RT_DEBUG_TRACE, ("Txpower per Rate\n"));
-	RT28xx_EEPROM_READ16(pAd, EEPROM_TXPOWER_DELTA, value2);
-	Apwrdelta = 0;
-	Gpwrdelta = 0;
-
-	if ((value2 & 0xff) != 0xff)
-	{
-		if ((value2 & 0x80))
-			Gpwrdelta = (value2&0xf);
-
-		if ((value2 & 0x40))
-			bGpwrdeltaMinus = FALSE;
-		else
-			bGpwrdeltaMinus = TRUE;
-	}
-	if ((value2 & 0xff00) != 0xff00)
-	{
-		if ((value2 & 0x8000))
-			Apwrdelta = ((value2&0xf00)>>8);
-
-		if ((value2 & 0x4000))
-			bApwrdeltaMinus = FALSE;
-		else
-			bApwrdeltaMinus = TRUE;
-	}
-	DBGPRINT(RT_DEBUG_TRACE, ("Gpwrdelta = %x, Apwrdelta = %x .\n", Gpwrdelta, Apwrdelta));
-
-	//
-	// Get Txpower per MCS for 20MHz in 2.4G.
-	//
-	for (i=0; i<5; i++)
-	{
-		RT28xx_EEPROM_READ16(pAd, EEPROM_TXPOWER_BYRATE_20MHZ_2_4G + i*4, value);
-		data = value;
-		if (bApwrdeltaMinus == FALSE)
-		{
-			t1 = (value&0xf)+(Apwrdelta);
-			if (t1 > 0xf)
-				t1 = 0xf;
-			t2 = ((value&0xf0)>>4)+(Apwrdelta);
-			if (t2 > 0xf)
-				t2 = 0xf;
-			t3 = ((value&0xf00)>>8)+(Apwrdelta);
-			if (t3 > 0xf)
-				t3 = 0xf;
-			t4 = ((value&0xf000)>>12)+(Apwrdelta);
-			if (t4 > 0xf)
-				t4 = 0xf;
-		}
-		else
-		{
-			if ((value&0xf) > Apwrdelta)
-				t1 = (value&0xf)-(Apwrdelta);
-			else
-				t1 = 0;
-			if (((value&0xf0)>>4) > Apwrdelta)
-				t2 = ((value&0xf0)>>4)-(Apwrdelta);
-			else
-				t2 = 0;
-			if (((value&0xf00)>>8) > Apwrdelta)
-				t3 = ((value&0xf00)>>8)-(Apwrdelta);
-			else
-				t3 = 0;
-			if (((value&0xf000)>>12) > Apwrdelta)
-				t4 = ((value&0xf000)>>12)-(Apwrdelta);
-			else
-				t4 = 0;
-		}
-		Adata = t1 + (t2<<4) + (t3<<8) + (t4<<12);
-		if (bGpwrdeltaMinus == FALSE)
-		{
-			t1 = (value&0xf)+(Gpwrdelta);
-			if (t1 > 0xf)
-				t1 = 0xf;
-			t2 = ((value&0xf0)>>4)+(Gpwrdelta);
-			if (t2 > 0xf)
-				t2 = 0xf;
-			t3 = ((value&0xf00)>>8)+(Gpwrdelta);
-			if (t3 > 0xf)
-				t3 = 0xf;
-			t4 = ((value&0xf000)>>12)+(Gpwrdelta);
-			if (t4 > 0xf)
-				t4 = 0xf;
-		}
-		else
-		{
-			if ((value&0xf) > Gpwrdelta)
-				t1 = (value&0xf)-(Gpwrdelta);
-			else
-				t1 = 0;
-			if (((value&0xf0)>>4) > Gpwrdelta)
-				t2 = ((value&0xf0)>>4)-(Gpwrdelta);
-			else
-				t2 = 0;
-			if (((value&0xf00)>>8) > Gpwrdelta)
-				t3 = ((value&0xf00)>>8)-(Gpwrdelta);
-			else
-				t3 = 0;
-			if (((value&0xf000)>>12) > Gpwrdelta)
-				t4 = ((value&0xf000)>>12)-(Gpwrdelta);
-			else
-				t4 = 0;
-		}
-		Gdata = t1 + (t2<<4) + (t3<<8) + (t4<<12);
-
-		RT28xx_EEPROM_READ16(pAd, EEPROM_TXPOWER_BYRATE_20MHZ_2_4G + i*4 + 2, value);
-		if (bApwrdeltaMinus == FALSE)
-		{
-			t1 = (value&0xf)+(Apwrdelta);
-			if (t1 > 0xf)
-				t1 = 0xf;
-			t2 = ((value&0xf0)>>4)+(Apwrdelta);
-			if (t2 > 0xf)
-				t2 = 0xf;
-			t3 = ((value&0xf00)>>8)+(Apwrdelta);
-			if (t3 > 0xf)
-				t3 = 0xf;
-			t4 = ((value&0xf000)>>12)+(Apwrdelta);
-			if (t4 > 0xf)
-				t4 = 0xf;
-		}
-		else
-		{
-			if ((value&0xf) > Apwrdelta)
-				t1 = (value&0xf)-(Apwrdelta);
-			else
-				t1 = 0;
-			if (((value&0xf0)>>4) > Apwrdelta)
-				t2 = ((value&0xf0)>>4)-(Apwrdelta);
-			else
-				t2 = 0;
-			if (((value&0xf00)>>8) > Apwrdelta)
-				t3 = ((value&0xf00)>>8)-(Apwrdelta);
-			else
-				t3 = 0;
-			if (((value&0xf000)>>12) > Apwrdelta)
-				t4 = ((value&0xf000)>>12)-(Apwrdelta);
-			else
-				t4 = 0;
-		}
-		Adata |= ((t1<<16) + (t2<<20) + (t3<<24) + (t4<<28));
-		if (bGpwrdeltaMinus == FALSE)
-		{
-			t1 = (value&0xf)+(Gpwrdelta);
-			if (t1 > 0xf)
-				t1 = 0xf;
-			t2 = ((value&0xf0)>>4)+(Gpwrdelta);
-			if (t2 > 0xf)
-				t2 = 0xf;
-			t3 = ((value&0xf00)>>8)+(Gpwrdelta);
-			if (t3 > 0xf)
-				t3 = 0xf;
-			t4 = ((value&0xf000)>>12)+(Gpwrdelta);
-			if (t4 > 0xf)
-				t4 = 0xf;
-		}
-		else
-		{
-			if ((value&0xf) > Gpwrdelta)
-				t1 = (value&0xf)-(Gpwrdelta);
-			else
-				t1 = 0;
-			if (((value&0xf0)>>4) > Gpwrdelta)
-				t2 = ((value&0xf0)>>4)-(Gpwrdelta);
-			else
-				t2 = 0;
-			if (((value&0xf00)>>8) > Gpwrdelta)
-				t3 = ((value&0xf00)>>8)-(Gpwrdelta);
-			else
-				t3 = 0;
-			if (((value&0xf000)>>12) > Gpwrdelta)
-				t4 = ((value&0xf000)>>12)-(Gpwrdelta);
-			else
-				t4 = 0;
-		}
-		Gdata |= ((t1<<16) + (t2<<20) + (t3<<24) + (t4<<28));
-		data |= (value<<16);
-
-		/* For 20M/40M Power Delta issue */
-		pAd->Tx20MPwrCfgABand[i] = data;
-		pAd->Tx20MPwrCfgGBand[i] = data;
-		pAd->Tx40MPwrCfgABand[i] = Adata;
-		pAd->Tx40MPwrCfgGBand[i] = Gdata;
-
-		if (data != 0xffffffff)
-			RTMP_IO_WRITE32(pAd, TX_PWR_CFG_0 + i*4, data);
-		DBGPRINT_RAW(RT_DEBUG_TRACE, ("20MHz BW, 2.4G band-%lx,  Adata = %lx,  Gdata = %lx \n", data, Adata, Gdata));
-	}
-}
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		Read initial channel power parameters from EEPROM
-
-	Arguments:
-		Adapter						Pointer to our adapter
-
-	Return Value:
-		None
-
-	IRQL = PASSIVE_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-VOID	RTMPReadChannelPwr(
-	IN	PRTMP_ADAPTER	pAd)
-{
-	UCHAR				i, choffset;
-	EEPROM_TX_PWR_STRUC	    Power;
-	EEPROM_TX_PWR_STRUC	    Power2;
-
-	// Read Tx power value for all channels
-	// Value from 1 - 0x7f. Default value is 24.
-	// Power value : 2.4G 0x00 (0) ~ 0x1F (31)
-	//             : 5.5G 0xF9 (-7) ~ 0x0F (15)
-
-	// 0. 11b/g, ch1 - ch 14
-	for (i = 0; i < 7; i++)
-	{
-		RT28xx_EEPROM_READ16(pAd, EEPROM_G_TX_PWR_OFFSET + i * 2, Power.word);
-		RT28xx_EEPROM_READ16(pAd, EEPROM_G_TX2_PWR_OFFSET + i * 2, Power2.word);
-		pAd->TxPower[i * 2].Channel = i * 2 + 1;
-		pAd->TxPower[i * 2 + 1].Channel = i * 2 + 2;
-
-		if ((Power.field.Byte0 > 31) || (Power.field.Byte0 < 0))
-			pAd->TxPower[i * 2].Power = DEFAULT_RF_TX_POWER;
-		else
-			pAd->TxPower[i * 2].Power = Power.field.Byte0;
-
-		if ((Power.field.Byte1 > 31) || (Power.field.Byte1 < 0))
-			pAd->TxPower[i * 2 + 1].Power = DEFAULT_RF_TX_POWER;
-		else
-			pAd->TxPower[i * 2 + 1].Power = Power.field.Byte1;
-
-		if ((Power2.field.Byte0 > 31) || (Power2.field.Byte0 < 0))
-			pAd->TxPower[i * 2].Power2 = DEFAULT_RF_TX_POWER;
-		else
-			pAd->TxPower[i * 2].Power2 = Power2.field.Byte0;
-
-		if ((Power2.field.Byte1 > 31) || (Power2.field.Byte1 < 0))
-			pAd->TxPower[i * 2 + 1].Power2 = DEFAULT_RF_TX_POWER;
-		else
-			pAd->TxPower[i * 2 + 1].Power2 = Power2.field.Byte1;
-	}
-
-	// 1. U-NII lower/middle band: 36, 38, 40; 44, 46, 48; 52, 54, 56; 60, 62, 64 (including central frequency in BW 40MHz)
-	// 1.1 Fill up channel
-	choffset = 14;
-	for (i = 0; i < 4; i++)
-	{
-		pAd->TxPower[3 * i + choffset + 0].Channel	= 36 + i * 8 + 0;
-		pAd->TxPower[3 * i + choffset + 0].Power	= DEFAULT_RF_TX_POWER;
-		pAd->TxPower[3 * i + choffset + 0].Power2	= DEFAULT_RF_TX_POWER;
-
-		pAd->TxPower[3 * i + choffset + 1].Channel	= 36 + i * 8 + 2;
-		pAd->TxPower[3 * i + choffset + 1].Power	= DEFAULT_RF_TX_POWER;
-		pAd->TxPower[3 * i + choffset + 1].Power2	= DEFAULT_RF_TX_POWER;
-
-		pAd->TxPower[3 * i + choffset + 2].Channel	= 36 + i * 8 + 4;
-		pAd->TxPower[3 * i + choffset + 2].Power	= DEFAULT_RF_TX_POWER;
-		pAd->TxPower[3 * i + choffset + 2].Power2	= DEFAULT_RF_TX_POWER;
-	}
-
-	// 1.2 Fill up power
-	for (i = 0; i < 6; i++)
-	{
-		RT28xx_EEPROM_READ16(pAd, EEPROM_A_TX_PWR_OFFSET + i * 2, Power.word);
-		RT28xx_EEPROM_READ16(pAd, EEPROM_A_TX2_PWR_OFFSET + i * 2, Power2.word);
-
-		if ((Power.field.Byte0 < 16) && (Power.field.Byte0 >= -7))
-			pAd->TxPower[i * 2 + choffset + 0].Power = Power.field.Byte0;
-
-		if ((Power.field.Byte1 < 16) && (Power.field.Byte1 >= -7))
-			pAd->TxPower[i * 2 + choffset + 1].Power = Power.field.Byte1;
-
-		if ((Power2.field.Byte0 < 16) && (Power2.field.Byte0 >= -7))
-			pAd->TxPower[i * 2 + choffset + 0].Power2 = Power2.field.Byte0;
-
-		if ((Power2.field.Byte1 < 16) && (Power2.field.Byte1 >= -7))
-			pAd->TxPower[i * 2 + choffset + 1].Power2 = Power2.field.Byte1;
-	}
-
-	// 2. HipperLAN 2 100, 102 ,104; 108, 110, 112; 116, 118, 120; 124, 126, 128; 132, 134, 136; 140 (including central frequency in BW 40MHz)
-	// 2.1 Fill up channel
-	choffset = 14 + 12;
-	for (i = 0; i < 5; i++)
-	{
-		pAd->TxPower[3 * i + choffset + 0].Channel	= 100 + i * 8 + 0;
-		pAd->TxPower[3 * i + choffset + 0].Power	= DEFAULT_RF_TX_POWER;
-		pAd->TxPower[3 * i + choffset + 0].Power2	= DEFAULT_RF_TX_POWER;
-
-		pAd->TxPower[3 * i + choffset + 1].Channel	= 100 + i * 8 + 2;
-		pAd->TxPower[3 * i + choffset + 1].Power	= DEFAULT_RF_TX_POWER;
-		pAd->TxPower[3 * i + choffset + 1].Power2	= DEFAULT_RF_TX_POWER;
-
-		pAd->TxPower[3 * i + choffset + 2].Channel	= 100 + i * 8 + 4;
-		pAd->TxPower[3 * i + choffset + 2].Power	= DEFAULT_RF_TX_POWER;
-		pAd->TxPower[3 * i + choffset + 2].Power2	= DEFAULT_RF_TX_POWER;
-	}
-	pAd->TxPower[3 * 5 + choffset + 0].Channel		= 140;
-	pAd->TxPower[3 * 5 + choffset + 0].Power		= DEFAULT_RF_TX_POWER;
-	pAd->TxPower[3 * 5 + choffset + 0].Power2		= DEFAULT_RF_TX_POWER;
-
-	// 2.2 Fill up power
-	for (i = 0; i < 8; i++)
-	{
-		RT28xx_EEPROM_READ16(pAd, EEPROM_A_TX_PWR_OFFSET + (choffset - 14) + i * 2, Power.word);
-		RT28xx_EEPROM_READ16(pAd, EEPROM_A_TX2_PWR_OFFSET + (choffset - 14) + i * 2, Power2.word);
-
-		if ((Power.field.Byte0 < 16) && (Power.field.Byte0 >= -7))
-			pAd->TxPower[i * 2 + choffset + 0].Power = Power.field.Byte0;
-
-		if ((Power.field.Byte1 < 16) && (Power.field.Byte1 >= -7))
-			pAd->TxPower[i * 2 + choffset + 1].Power = Power.field.Byte1;
-
-		if ((Power2.field.Byte0 < 16) && (Power2.field.Byte0 >= -7))
-			pAd->TxPower[i * 2 + choffset + 0].Power2 = Power2.field.Byte0;
-
-		if ((Power2.field.Byte1 < 16) && (Power2.field.Byte1 >= -7))
-			pAd->TxPower[i * 2 + choffset + 1].Power2 = Power2.field.Byte1;
-	}
-
-	// 3. U-NII upper band: 149, 151, 153; 157, 159, 161; 165, 167, 169; 171, 173 (including central frequency in BW 40MHz)
-	// 3.1 Fill up channel
-	choffset = 14 + 12 + 16;
-	/*for (i = 0; i < 2; i++)*/
-	for (i = 0; i < 3; i++)
-	{
-		pAd->TxPower[3 * i + choffset + 0].Channel	= 149 + i * 8 + 0;
-		pAd->TxPower[3 * i + choffset + 0].Power	= DEFAULT_RF_TX_POWER;
-		pAd->TxPower[3 * i + choffset + 0].Power2	= DEFAULT_RF_TX_POWER;
-
-		pAd->TxPower[3 * i + choffset + 1].Channel	= 149 + i * 8 + 2;
-		pAd->TxPower[3 * i + choffset + 1].Power	= DEFAULT_RF_TX_POWER;
-		pAd->TxPower[3 * i + choffset + 1].Power2	= DEFAULT_RF_TX_POWER;
-
-		pAd->TxPower[3 * i + choffset + 2].Channel	= 149 + i * 8 + 4;
-		pAd->TxPower[3 * i + choffset + 2].Power	= DEFAULT_RF_TX_POWER;
-		pAd->TxPower[3 * i + choffset + 2].Power2	= DEFAULT_RF_TX_POWER;
-	}
-	pAd->TxPower[3 * 3 + choffset + 0].Channel		= 171;
-	pAd->TxPower[3 * 3 + choffset + 0].Power		= DEFAULT_RF_TX_POWER;
-	pAd->TxPower[3 * 3 + choffset + 0].Power2		= DEFAULT_RF_TX_POWER;
-
-	pAd->TxPower[3 * 3 + choffset + 1].Channel		= 173;
-	pAd->TxPower[3 * 3 + choffset + 1].Power		= DEFAULT_RF_TX_POWER;
-	pAd->TxPower[3 * 3 + choffset + 1].Power2		= DEFAULT_RF_TX_POWER;
-
-	// 3.2 Fill up power
-	/*for (i = 0; i < 4; i++)*/
-	for (i = 0; i < 6; i++)
-	{
-		RT28xx_EEPROM_READ16(pAd, EEPROM_A_TX_PWR_OFFSET + (choffset - 14) + i * 2, Power.word);
-		RT28xx_EEPROM_READ16(pAd, EEPROM_A_TX2_PWR_OFFSET + (choffset - 14) + i * 2, Power2.word);
-
-		if ((Power.field.Byte0 < 16) && (Power.field.Byte0 >= -7))
-			pAd->TxPower[i * 2 + choffset + 0].Power = Power.field.Byte0;
-
-		if ((Power.field.Byte1 < 16) && (Power.field.Byte1 >= -7))
-			pAd->TxPower[i * 2 + choffset + 1].Power = Power.field.Byte1;
-
-		if ((Power2.field.Byte0 < 16) && (Power2.field.Byte0 >= -7))
-			pAd->TxPower[i * 2 + choffset + 0].Power2 = Power2.field.Byte0;
-
-		if ((Power2.field.Byte1 < 16) && (Power2.field.Byte1 >= -7))
-			pAd->TxPower[i * 2 + choffset + 1].Power2 = Power2.field.Byte1;
-	}
-
-	// 4. Print and Debug
-	/*choffset = 14 + 12 + 16 + 7;*/
-	choffset = 14 + 12 + 16 + 11;
-
-
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-		Read the following from the registry
-		1. All the parameters
-		2. NetworkAddres
-
-	Arguments:
-		Adapter						Pointer to our adapter
-		WrapperConfigurationContext	For use by NdisOpenConfiguration
-
-	Return Value:
-		NDIS_STATUS_SUCCESS
-		NDIS_STATUS_FAILURE
-		NDIS_STATUS_RESOURCES
-
-	IRQL = PASSIVE_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-NDIS_STATUS	NICReadRegParameters(
-	IN	PRTMP_ADAPTER		pAd,
-	IN	NDIS_HANDLE			WrapperConfigurationContext
-	)
-{
-	NDIS_STATUS						Status = NDIS_STATUS_SUCCESS;
-	DBGPRINT_S(Status, ("<-- NICReadRegParameters, Status=%x\n", Status));
-	return Status;
-}
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		Read initial parameters from EEPROM
-
-	Arguments:
-		Adapter						Pointer to our adapter
-
-	Return Value:
-		None
-
-	IRQL = PASSIVE_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-VOID	NICReadEEPROMParameters(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			mac_addr)
-{
-	UINT32			data = 0;
-	USHORT			i, value, value2;
-	UCHAR			TmpPhy;
-	EEPROM_TX_PWR_STRUC	    Power;
-	EEPROM_VERSION_STRUC    Version;
-	EEPROM_ANTENNA_STRUC	Antenna;
-	EEPROM_NIC_CONFIG2_STRUC    NicConfig2;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("--> NICReadEEPROMParameters\n"));
-
-	if (pAd->chipOps.eeinit)
-		pAd->chipOps.eeinit(pAd);
-#ifdef RTMP_EFUSE_SUPPORT
-#ifdef RT30xx
-	if(!pAd->bFroceEEPROMBuffer && pAd->bEEPROMFile)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("--> NICReadEEPROMParameters::(Efuse)Load  to EEPROM Buffer Mode\n"));
-		eFuseLoadEEPROM(pAd);
-	}
-#endif // RT30xx //
-#endif // RTMP_EFUSE_SUPPORT //
-
-	// Init EEPROM Address Number, before access EEPROM; if 93c46, EEPROMAddressNum=6, else if 93c66, EEPROMAddressNum=8
-	RTMP_IO_READ32(pAd, E2PROM_CSR, &data);
-	DBGPRINT(RT_DEBUG_TRACE, ("--> E2PROM_CSR = 0x%x\n", data));
-
-	if((data & 0x30) == 0)
-		pAd->EEPROMAddressNum = 6;		// 93C46
-	else if((data & 0x30) == 0x10)
-		pAd->EEPROMAddressNum = 8;     // 93C66
-	else
-		pAd->EEPROMAddressNum = 8;     // 93C86
-	DBGPRINT(RT_DEBUG_TRACE, ("--> EEPROMAddressNum = %d\n", pAd->EEPROMAddressNum ));
-
-	// RT2860 MAC no longer auto load MAC address from E2PROM. Driver has to intialize
-	// MAC address registers according to E2PROM setting
-	if (mac_addr == NULL ||
-		strlen((PSTRING) mac_addr) != 17 ||
-		mac_addr[2] != ':'  || mac_addr[5] != ':'  || mac_addr[8] != ':' ||
-		mac_addr[11] != ':' || mac_addr[14] != ':')
-	{
-		USHORT  Addr01,Addr23,Addr45 ;
-
-		RT28xx_EEPROM_READ16(pAd, 0x04, Addr01);
-		RT28xx_EEPROM_READ16(pAd, 0x06, Addr23);
-		RT28xx_EEPROM_READ16(pAd, 0x08, Addr45);
-
-		pAd->PermanentAddress[0] = (UCHAR)(Addr01 & 0xff);
-		pAd->PermanentAddress[1] = (UCHAR)(Addr01 >> 8);
-		pAd->PermanentAddress[2] = (UCHAR)(Addr23 & 0xff);
-		pAd->PermanentAddress[3] = (UCHAR)(Addr23 >> 8);
-		pAd->PermanentAddress[4] = (UCHAR)(Addr45 & 0xff);
-		pAd->PermanentAddress[5] = (UCHAR)(Addr45 >> 8);
-
-		DBGPRINT(RT_DEBUG_TRACE, ("Initialize MAC Address from E2PROM \n"));
-	}
-	else
-	{
-		INT		j;
-		PSTRING	macptr;
-
-		macptr = (PSTRING) mac_addr;
-
-		for (j=0; j<MAC_ADDR_LEN; j++)
-		{
-			AtoH(macptr, &pAd->PermanentAddress[j], 1);
-			macptr=macptr+3;
-		}
-
-		DBGPRINT(RT_DEBUG_TRACE, ("Initialize MAC Address from module parameter \n"));
-	}
-
-
-	{
-		//more conveninet to test mbssid, so ap's bssid &0xf1
-		if (pAd->PermanentAddress[0] == 0xff)
-			pAd->PermanentAddress[0] = RandomByte(pAd)&0xf8;
-
-		//if (pAd->PermanentAddress[5] == 0xff)
-		//	pAd->PermanentAddress[5] = RandomByte(pAd)&0xf8;
-
-		DBGPRINT_RAW(RT_DEBUG_TRACE,("E2PROM MAC: =%02x:%02x:%02x:%02x:%02x:%02x\n",
-			pAd->PermanentAddress[0], pAd->PermanentAddress[1],
-			pAd->PermanentAddress[2], pAd->PermanentAddress[3],
-			pAd->PermanentAddress[4], pAd->PermanentAddress[5]));
-		if (pAd->bLocalAdminMAC == FALSE)
-		{
-			MAC_DW0_STRUC csr2;
-			MAC_DW1_STRUC csr3;
-			COPY_MAC_ADDR(pAd->CurrentAddress, pAd->PermanentAddress);
-			csr2.field.Byte0 = pAd->CurrentAddress[0];
-			csr2.field.Byte1 = pAd->CurrentAddress[1];
-			csr2.field.Byte2 = pAd->CurrentAddress[2];
-			csr2.field.Byte3 = pAd->CurrentAddress[3];
-			RTMP_IO_WRITE32(pAd, MAC_ADDR_DW0, csr2.word);
-			csr3.word = 0;
-			csr3.field.Byte4 = pAd->CurrentAddress[4];
-			csr3.field.Byte5 = pAd->CurrentAddress[5];
-			csr3.field.U2MeMask = 0xff;
-			RTMP_IO_WRITE32(pAd, MAC_ADDR_DW1, csr3.word);
-			DBGPRINT_RAW(RT_DEBUG_TRACE,("E2PROM MAC: =%02x:%02x:%02x:%02x:%02x:%02x\n",
-							PRINT_MAC(pAd->PermanentAddress)));
-		}
-	}
-
-	// if not return early. cause fail at emulation.
-	// Init the channel number for TX channel power
-	RTMPReadChannelPwr(pAd);
-
-	// if E2PROM version mismatch with driver's expectation, then skip
-	// all subsequent E2RPOM retieval and set a system error bit to notify GUI
-	RT28xx_EEPROM_READ16(pAd, EEPROM_VERSION_OFFSET, Version.word);
-	pAd->EepromVersion = Version.field.Version + Version.field.FaeReleaseNumber * 256;
-	DBGPRINT(RT_DEBUG_TRACE, ("E2PROM: Version = %d, FAE release #%d\n", Version.field.Version, Version.field.FaeReleaseNumber));
-
-	if (Version.field.Version > VALID_EEPROM_VERSION)
-	{
-		DBGPRINT_ERR(("E2PROM: WRONG VERSION 0x%x, should be %d\n",Version.field.Version, VALID_EEPROM_VERSION));
-		/*pAd->SystemErrorBitmap |= 0x00000001;
-
-		// hard-code default value when no proper E2PROM installed
-		pAd->bAutoTxAgcA = FALSE;
-		pAd->bAutoTxAgcG = FALSE;
-
-		// Default the channel power
-		for (i = 0; i < MAX_NUM_OF_CHANNELS; i++)
-			pAd->TxPower[i].Power = DEFAULT_RF_TX_POWER;
-
-		// Default the channel power
-		for (i = 0; i < MAX_NUM_OF_11JCHANNELS; i++)
-			pAd->TxPower11J[i].Power = DEFAULT_RF_TX_POWER;
-
-		for(i = 0; i < NUM_EEPROM_BBP_PARMS; i++)
-			pAd->EEPROMDefaultValue[i] = 0xffff;
-		return;  */
-	}
-
-	// Read BBP default value from EEPROM and store to array(EEPROMDefaultValue) in pAd
-	RT28xx_EEPROM_READ16(pAd, EEPROM_NIC1_OFFSET, value);
-	pAd->EEPROMDefaultValue[0] = value;
-
-	RT28xx_EEPROM_READ16(pAd, EEPROM_NIC2_OFFSET, value);
-	pAd->EEPROMDefaultValue[1] = value;
-
-	RT28xx_EEPROM_READ16(pAd, 0x38, value);	// Country Region
-	pAd->EEPROMDefaultValue[2] = value;
-
-	for(i = 0; i < 8; i++)
-	{
-		RT28xx_EEPROM_READ16(pAd, EEPROM_BBP_BASE_OFFSET + i*2, value);
-		pAd->EEPROMDefaultValue[i+3] = value;
-	}
-
-	// We have to parse NIC configuration 0 at here.
-	// If TSSI did not have preloaded value, it should reset the TxAutoAgc to false
-	// Therefore, we have to read TxAutoAgc control beforehand.
-	// Read Tx AGC control bit
-	Antenna.word = pAd->EEPROMDefaultValue[0];
-	if (Antenna.word == 0xFFFF)
-	{
-#ifdef RT30xx
-		if(IS_RT3090(pAd)|| IS_RT3390(pAd))
-		{
-			Antenna.word = 0;
-			Antenna.field.RfIcType = RFIC_3020;
-			Antenna.field.TxPath = 1;
-			Antenna.field.RxPath = 1;
-		}
-		else
-#endif // RT30xx //
-		{
-
-			Antenna.word = 0;
-			Antenna.field.RfIcType = RFIC_2820;
-			Antenna.field.TxPath = 1;
-			Antenna.field.RxPath = 2;
-			DBGPRINT(RT_DEBUG_WARN, ("E2PROM error, hard code as 0x%04x\n", Antenna.word));
-		}
-	}
-
-	// Choose the desired Tx&Rx stream.
-	if ((pAd->CommonCfg.TxStream == 0) || (pAd->CommonCfg.TxStream > Antenna.field.TxPath))
-		pAd->CommonCfg.TxStream = Antenna.field.TxPath;
-
-	if ((pAd->CommonCfg.RxStream == 0) || (pAd->CommonCfg.RxStream > Antenna.field.RxPath))
-	{
-		pAd->CommonCfg.RxStream = Antenna.field.RxPath;
-
-		if ((pAd->MACVersion < RALINK_2883_VERSION) &&
-			(pAd->CommonCfg.RxStream > 2))
-		{
-			// only 2 Rx streams for RT2860 series
-			pAd->CommonCfg.RxStream = 2;
-		}
-	}
-
-	// 3*3
-	// read value from EEPROM and set them to CSR174 ~ 177 in chain0 ~ chain2
-	// yet implement
-	for(i=0; i<3; i++)
-	{
-	}
-
-	NicConfig2.word = pAd->EEPROMDefaultValue[1];
-
-
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-		if ((NicConfig2.word & 0x00ff) == 0xff)
-		{
-			NicConfig2.word &= 0xff00;
-		}
-
-		if ((NicConfig2.word >> 8) == 0xff)
-		{
-			NicConfig2.word &= 0x00ff;
-		}
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-	if (NicConfig2.field.DynamicTxAgcControl == 1)
-		pAd->bAutoTxAgcA = pAd->bAutoTxAgcG = TRUE;
-	else
-		pAd->bAutoTxAgcA = pAd->bAutoTxAgcG = FALSE;
-
-	DBGPRINT_RAW(RT_DEBUG_TRACE, ("NICReadEEPROMParameters: RxPath = %d, TxPath = %d\n", Antenna.field.RxPath, Antenna.field.TxPath));
-
-	// Save the antenna for future use
-	pAd->Antenna.word = Antenna.word;
-
-	// Set the RfICType here, then we can initialize RFIC related operation callbacks
-	pAd->Mlme.RealRxPath = (UCHAR) Antenna.field.RxPath;
-	pAd->RfIcType = (UCHAR) Antenna.field.RfIcType;
-
-#ifdef RTMP_RF_RW_SUPPORT
-	RtmpChipOpsRFHook(pAd);
-#endif // RTMP_RF_RW_SUPPORT //
-
-	//
-	// Reset PhyMode if we don't support 802.11a
-	// Only RFIC_2850 & RFIC_2750 support 802.11a
-	//
-	if ((Antenna.field.RfIcType != RFIC_2850)
-		&& (Antenna.field.RfIcType != RFIC_2750)
-		&& (Antenna.field.RfIcType != RFIC_3052))
-	{
-		if ((pAd->CommonCfg.PhyMode == PHY_11ABG_MIXED) ||
-			(pAd->CommonCfg.PhyMode == PHY_11A))
-			pAd->CommonCfg.PhyMode = PHY_11BG_MIXED;
-#ifdef DOT11_N_SUPPORT
-		else if ((pAd->CommonCfg.PhyMode == PHY_11ABGN_MIXED)	||
-				 (pAd->CommonCfg.PhyMode == PHY_11AN_MIXED)	||
-				 (pAd->CommonCfg.PhyMode == PHY_11AGN_MIXED)	||
-				 (pAd->CommonCfg.PhyMode == PHY_11N_5G))
-			pAd->CommonCfg.PhyMode = PHY_11BGN_MIXED;
-#endif // DOT11_N_SUPPORT //
-	}
-
-	// Read TSSI reference and TSSI boundary for temperature compensation. This is ugly
-	// 0. 11b/g
-	{
-		/* these are tempature reference value (0x00 ~ 0xFE)
-		   ex: 0x00 0x15 0x25 0x45 0x88 0xA0 0xB5 0xD0 0xF0
-		   TssiPlusBoundaryG [4] [3] [2] [1] [0] (smaller) +
-		   TssiMinusBoundaryG[0] [1] [2] [3] [4] (larger) */
-		RT28xx_EEPROM_READ16(pAd, 0x6E, Power.word);
-		pAd->TssiMinusBoundaryG[4] = Power.field.Byte0;
-		pAd->TssiMinusBoundaryG[3] = Power.field.Byte1;
-		RT28xx_EEPROM_READ16(pAd, 0x70, Power.word);
-		pAd->TssiMinusBoundaryG[2] = Power.field.Byte0;
-		pAd->TssiMinusBoundaryG[1] = Power.field.Byte1;
-		RT28xx_EEPROM_READ16(pAd, 0x72, Power.word);
-		pAd->TssiRefG   = Power.field.Byte0; /* reference value [0] */
-		pAd->TssiPlusBoundaryG[1] = Power.field.Byte1;
-		RT28xx_EEPROM_READ16(pAd, 0x74, Power.word);
-		pAd->TssiPlusBoundaryG[2] = Power.field.Byte0;
-		pAd->TssiPlusBoundaryG[3] = Power.field.Byte1;
-		RT28xx_EEPROM_READ16(pAd, 0x76, Power.word);
-		pAd->TssiPlusBoundaryG[4] = Power.field.Byte0;
-		pAd->TxAgcStepG = Power.field.Byte1;
-		pAd->TxAgcCompensateG = 0;
-		pAd->TssiMinusBoundaryG[0] = pAd->TssiRefG;
-		pAd->TssiPlusBoundaryG[0]  = pAd->TssiRefG;
-
-		// Disable TxAgc if the based value is not right
-		if (pAd->TssiRefG == 0xff)
-			pAd->bAutoTxAgcG = FALSE;
-
-		DBGPRINT(RT_DEBUG_TRACE,("E2PROM: G Tssi[-4 .. +4] = %d %d %d %d - %d -%d %d %d %d, step=%d, tuning=%d\n",
-			pAd->TssiMinusBoundaryG[4], pAd->TssiMinusBoundaryG[3], pAd->TssiMinusBoundaryG[2], pAd->TssiMinusBoundaryG[1],
-			pAd->TssiRefG,
-			pAd->TssiPlusBoundaryG[1], pAd->TssiPlusBoundaryG[2], pAd->TssiPlusBoundaryG[3], pAd->TssiPlusBoundaryG[4],
-			pAd->TxAgcStepG, pAd->bAutoTxAgcG));
-	}
-	// 1. 11a
-	{
-		RT28xx_EEPROM_READ16(pAd, 0xD4, Power.word);
-		pAd->TssiMinusBoundaryA[4] = Power.field.Byte0;
-		pAd->TssiMinusBoundaryA[3] = Power.field.Byte1;
-		RT28xx_EEPROM_READ16(pAd, 0xD6, Power.word);
-		pAd->TssiMinusBoundaryA[2] = Power.field.Byte0;
-		pAd->TssiMinusBoundaryA[1] = Power.field.Byte1;
-		RT28xx_EEPROM_READ16(pAd, 0xD8, Power.word);
-		pAd->TssiRefA   = Power.field.Byte0;
-		pAd->TssiPlusBoundaryA[1] = Power.field.Byte1;
-		RT28xx_EEPROM_READ16(pAd, 0xDA, Power.word);
-		pAd->TssiPlusBoundaryA[2] = Power.field.Byte0;
-		pAd->TssiPlusBoundaryA[3] = Power.field.Byte1;
-		RT28xx_EEPROM_READ16(pAd, 0xDC, Power.word);
-		pAd->TssiPlusBoundaryA[4] = Power.field.Byte0;
-		pAd->TxAgcStepA = Power.field.Byte1;
-		pAd->TxAgcCompensateA = 0;
-		pAd->TssiMinusBoundaryA[0] = pAd->TssiRefA;
-		pAd->TssiPlusBoundaryA[0]  = pAd->TssiRefA;
-
-		// Disable TxAgc if the based value is not right
-		if (pAd->TssiRefA == 0xff)
-			pAd->bAutoTxAgcA = FALSE;
-
-		DBGPRINT(RT_DEBUG_TRACE,("E2PROM: A Tssi[-4 .. +4] = %d %d %d %d - %d -%d %d %d %d, step=%d, tuning=%d\n",
-			pAd->TssiMinusBoundaryA[4], pAd->TssiMinusBoundaryA[3], pAd->TssiMinusBoundaryA[2], pAd->TssiMinusBoundaryA[1],
-			pAd->TssiRefA,
-			pAd->TssiPlusBoundaryA[1], pAd->TssiPlusBoundaryA[2], pAd->TssiPlusBoundaryA[3], pAd->TssiPlusBoundaryA[4],
-			pAd->TxAgcStepA, pAd->bAutoTxAgcA));
-	}
-	pAd->BbpRssiToDbmDelta = 0x0;
-
-	// Read frequency offset setting for RF
-	RT28xx_EEPROM_READ16(pAd, EEPROM_FREQ_OFFSET, value);
-	if ((value & 0x00FF) != 0x00FF)
-		pAd->RfFreqOffset = (ULONG) (value & 0x00FF);
-	else
-		pAd->RfFreqOffset = 0;
-	DBGPRINT(RT_DEBUG_TRACE, ("E2PROM: RF FreqOffset=0x%lx \n", pAd->RfFreqOffset));
-
-	//CountryRegion byte offset (38h)
-	value = pAd->EEPROMDefaultValue[2] >> 8;		// 2.4G band
-	value2 = pAd->EEPROMDefaultValue[2] & 0x00FF;	// 5G band
-
-	if ((value <= REGION_MAXIMUM_BG_BAND) && (value2 <= REGION_MAXIMUM_A_BAND))
-	{
-		pAd->CommonCfg.CountryRegion = ((UCHAR) value) | 0x80;
-		pAd->CommonCfg.CountryRegionForABand = ((UCHAR) value2) | 0x80;
-		TmpPhy = pAd->CommonCfg.PhyMode;
-		pAd->CommonCfg.PhyMode = 0xff;
-		RTMPSetPhyMode(pAd, TmpPhy);
-#ifdef DOT11_N_SUPPORT
-		SetCommonHT(pAd);
-#endif // DOT11_N_SUPPORT //
-	}
-
-	//
-	// Get RSSI Offset on EEPROM 0x9Ah & 0x9Ch.
-	// The valid value are (-10 ~ 10)
-	//
-	RT28xx_EEPROM_READ16(pAd, EEPROM_RSSI_BG_OFFSET, value);
-	pAd->BGRssiOffset0 = value & 0x00ff;
-	pAd->BGRssiOffset1 = (value >> 8);
-	RT28xx_EEPROM_READ16(pAd, EEPROM_RSSI_BG_OFFSET+2, value);
-	pAd->BGRssiOffset2 = value & 0x00ff;
-	pAd->ALNAGain1 = (value >> 8);
-	RT28xx_EEPROM_READ16(pAd, EEPROM_LNA_OFFSET, value);
-	pAd->BLNAGain = value & 0x00ff;
-	pAd->ALNAGain0 = (value >> 8);
-
-	// Validate 11b/g RSSI_0 offset.
-	if ((pAd->BGRssiOffset0 < -10) || (pAd->BGRssiOffset0 > 10))
-		pAd->BGRssiOffset0 = 0;
-
-	// Validate 11b/g RSSI_1 offset.
-	if ((pAd->BGRssiOffset1 < -10) || (pAd->BGRssiOffset1 > 10))
-		pAd->BGRssiOffset1 = 0;
-
-	// Validate 11b/g RSSI_2 offset.
-	if ((pAd->BGRssiOffset2 < -10) || (pAd->BGRssiOffset2 > 10))
-		pAd->BGRssiOffset2 = 0;
-
-	RT28xx_EEPROM_READ16(pAd, EEPROM_RSSI_A_OFFSET, value);
-	pAd->ARssiOffset0 = value & 0x00ff;
-	pAd->ARssiOffset1 = (value >> 8);
-	RT28xx_EEPROM_READ16(pAd, (EEPROM_RSSI_A_OFFSET+2), value);
-	pAd->ARssiOffset2 = value & 0x00ff;
-	pAd->ALNAGain2 = (value >> 8);
-
-	if (((UCHAR)pAd->ALNAGain1 == 0xFF) || (pAd->ALNAGain1 == 0x00))
-		pAd->ALNAGain1 = pAd->ALNAGain0;
-	if (((UCHAR)pAd->ALNAGain2 == 0xFF) || (pAd->ALNAGain2 == 0x00))
-		pAd->ALNAGain2 = pAd->ALNAGain0;
-
-	// Validate 11a RSSI_0 offset.
-	if ((pAd->ARssiOffset0 < -10) || (pAd->ARssiOffset0 > 10))
-		pAd->ARssiOffset0 = 0;
-
-	// Validate 11a RSSI_1 offset.
-	if ((pAd->ARssiOffset1 < -10) || (pAd->ARssiOffset1 > 10))
-		pAd->ARssiOffset1 = 0;
-
-	//Validate 11a RSSI_2 offset.
-	if ((pAd->ARssiOffset2 < -10) || (pAd->ARssiOffset2 > 10))
-		pAd->ARssiOffset2 = 0;
-
-#ifdef RT30xx
-	//
-	// Get TX mixer gain setting
-	// 0xff are invalid value
-	// Note: RT30xX default value is 0x00 and will program to RF_R17 only when this value is not zero.
-	//       RT359X default value is 0x02
-	//
-	if (IS_RT30xx(pAd) || IS_RT3572(pAd))
-	{
-		RT28xx_EEPROM_READ16(pAd, EEPROM_TXMIXER_GAIN_2_4G, value);
-		pAd->TxMixerGain24G = 0;
-		value &= 0x00ff;
-		if (value != 0xff)
-		{
-			value &= 0x07;
-			pAd->TxMixerGain24G = (UCHAR)value;
-		}
-	}
-#endif // RT30xx //
-
-	//
-	// Get LED Setting.
-	//
-	RT28xx_EEPROM_READ16(pAd, 0x3a, value);
-	pAd->LedCntl.word = (value>>8);
-	RT28xx_EEPROM_READ16(pAd, EEPROM_LED1_OFFSET, value);
-	pAd->Led1 = value;
-	RT28xx_EEPROM_READ16(pAd, EEPROM_LED2_OFFSET, value);
-	pAd->Led2 = value;
-	RT28xx_EEPROM_READ16(pAd, EEPROM_LED3_OFFSET, value);
-	pAd->Led3 = value;
-
-	RTMPReadTxPwrPerRate(pAd);
-
-#ifdef SINGLE_SKU
-	RT28xx_EEPROM_READ16(pAd, EEPROM_DEFINE_MAX_TXPWR, pAd->CommonCfg.DefineMaxTxPwr);
-#endif // SINGLE_SKU //
-
-#ifdef RT30xx
-#ifdef RTMP_EFUSE_SUPPORT
-	RtmpEfuseSupportCheck(pAd);
-#endif // RTMP_EFUSE_SUPPORT //
-#endif // RT30xx //
-
-	DBGPRINT(RT_DEBUG_TRACE, ("<-- NICReadEEPROMParameters\n"));
-}
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		Set default value from EEPROM
-
-	Arguments:
-		Adapter						Pointer to our adapter
-
-	Return Value:
-		None
-
-	IRQL = PASSIVE_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-VOID	NICInitAsicFromEEPROM(
-	IN	PRTMP_ADAPTER	pAd)
-{
-#ifdef CONFIG_STA_SUPPORT
-	UINT32					data = 0;
-	UCHAR	BBPR1 = 0;
-#endif // CONFIG_STA_SUPPORT //
-	USHORT					i;
-//	EEPROM_ANTENNA_STRUC	Antenna;
-	EEPROM_NIC_CONFIG2_STRUC    NicConfig2;
-	UCHAR	BBPR3 = 0;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("--> NICInitAsicFromEEPROM\n"));
-	for(i = 3; i < NUM_EEPROM_BBP_PARMS; i++)
-	{
-		UCHAR BbpRegIdx, BbpValue;
-
-		if ((pAd->EEPROMDefaultValue[i] != 0xFFFF) && (pAd->EEPROMDefaultValue[i] != 0))
-		{
-			BbpRegIdx = (UCHAR)(pAd->EEPROMDefaultValue[i] >> 8);
-			BbpValue  = (UCHAR)(pAd->EEPROMDefaultValue[i] & 0xff);
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BbpRegIdx, BbpValue);
-		}
-	}
-
-
-	NicConfig2.word = pAd->EEPROMDefaultValue[1];
-
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-		if ((NicConfig2.word & 0x00ff) == 0xff)
-		{
-			NicConfig2.word &= 0xff00;
-		}
-
-		if ((NicConfig2.word >> 8) == 0xff)
-		{
-			NicConfig2.word &= 0x00ff;
-		}
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-	// Save the antenna for future use
-	pAd->NicConfig2.word = NicConfig2.word;
-
-#ifdef RT30xx
-	// set default antenna as main
-	if (pAd->RfIcType == RFIC_3020)
-		AsicSetRxAnt(pAd, pAd->RxAnt.Pair1PrimaryRxAnt);
-#endif // RT30xx //
-
-	//
-	// Send LED Setting to MCU.
-	//
-	if (pAd->LedCntl.word == 0xFF)
-	{
-		pAd->LedCntl.word = 0x01;
-		pAd->Led1 = 0x5555;
-		pAd->Led2 = 0x2221;
-
-#ifdef RTMP_MAC_PCI
-		pAd->Led3 = 0xA9F8;
-#endif // RTMP_MAC_PCI //
-	}
-
-	AsicSendCommandToMcu(pAd, 0x52, 0xff, (UCHAR)pAd->Led1, (UCHAR)(pAd->Led1 >> 8));
-	AsicSendCommandToMcu(pAd, 0x53, 0xff, (UCHAR)pAd->Led2, (UCHAR)(pAd->Led2 >> 8));
-	AsicSendCommandToMcu(pAd, 0x54, 0xff, (UCHAR)pAd->Led3, (UCHAR)(pAd->Led3 >> 8));
-	AsicSendCommandToMcu(pAd, 0x51, 0xff, 0, pAd->LedCntl.field.Polarity);
-
-	pAd->LedIndicatorStrength = 0xFF;
-	RTMPSetSignalLED(pAd, -100);	// Force signal strength Led to be turned off, before link up
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-		// Read Hardware controlled Radio state enable bit
-		if (NicConfig2.field.HardwareRadioControl == 1)
-		{
-			pAd->StaCfg.bHardwareRadio = TRUE;
-
-			// Read GPIO pin2 as Hardware controlled radio state
-			RTMP_IO_READ32(pAd, GPIO_CTRL_CFG, &data);
-			if ((data & 0x04) == 0)
-			{
-				pAd->StaCfg.bHwRadio = FALSE;
-				pAd->StaCfg.bRadio = FALSE;
-//				RTMP_IO_WRITE32(pAd, PWR_PIN_CFG, 0x00001818);
-				RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_RADIO_OFF);
-			}
-		}
-		else
-			pAd->StaCfg.bHardwareRadio = FALSE;
-
-		if (pAd->StaCfg.bRadio == FALSE)
-		{
-			RTMPSetLED(pAd, LED_RADIO_OFF);
-		}
-		else
-		{
-			RTMPSetLED(pAd, LED_RADIO_ON);
-#ifdef RTMP_MAC_PCI
-#ifdef RT3090
-			AsicSendCommandToMcu(pAd, 0x30, PowerRadioOffCID, 0xff, 0x02);
-			AsicCheckCommanOk(pAd, PowerRadioOffCID);
-#endif // RT3090 //
-#ifndef RT3090
-			AsicSendCommandToMcu(pAd, 0x30, 0xff, 0xff, 0x02);
-#endif // RT3090 //
-			AsicSendCommandToMcu(pAd, 0x31, PowerWakeCID, 0x00, 0x00);
-			// 2-1. wait command ok.
-			AsicCheckCommanOk(pAd, PowerWakeCID);
-#endif // RTMP_MAC_PCI //
-		}
-	}
-#ifdef RTMP_MAC_PCI
-#ifdef RT30xx
-		if (IS_RT3090(pAd)|| IS_RT3572(pAd) || IS_RT3390(pAd))
-		{
-			RTMP_CHIP_OP *pChipOps = &pAd->chipOps;
-			if (pChipOps->AsicReverseRfFromSleepMode)
-				pChipOps->AsicReverseRfFromSleepMode(pAd);
-		}
-		// 3090 MCU Wakeup command needs more time to be stable.
-		// Before stable, don't issue other MCU command to prevent from firmware error.
-
-		if ((IS_RT3090(pAd)|| IS_RT3572(pAd) || IS_RT3390(pAd)) && IS_VERSION_AFTER_F(pAd)
-			&& (pAd->StaCfg.PSControl.field.rt30xxPowerMode == 3)
-			&& (pAd->StaCfg.PSControl.field.EnableNewPS == TRUE))
-		{
-			DBGPRINT(RT_DEBUG_TRACE,("%s::%d,release Mcu Lock\n",__FUNCTION__,__LINE__));
-			RTMP_SEM_LOCK(&pAd->McuCmdLock);
-			pAd->brt30xxBanMcuCmd = FALSE;
-			RTMP_SEM_UNLOCK(&pAd->McuCmdLock);
-		}
-#endif // RT30xx //
-#endif // RTMP_MAC_PCI //
-#endif // CONFIG_STA_SUPPORT //
-
-	// Turn off patching for cardbus controller
-	if (NicConfig2.field.CardbusAcceleration == 1)
-	{
-//		pAd->bTest1 = TRUE;
-	}
-
-	if (NicConfig2.field.DynamicTxAgcControl == 1)
-		pAd->bAutoTxAgcA = pAd->bAutoTxAgcG = TRUE;
-	else
-		pAd->bAutoTxAgcA = pAd->bAutoTxAgcG = FALSE;
-	//
-	// Since BBP has been progamed, to make sure BBP setting will be
-	// upate inside of AsicAntennaSelect, so reset to UNKNOWN_BAND!!
-	//
-	pAd->CommonCfg.BandState = UNKNOWN_BAND;
-
-	RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R3, &BBPR3);
-	BBPR3 &= (~0x18);
-	if(pAd->Antenna.field.RxPath == 3)
-	{
-		BBPR3 |= (0x10);
-	}
-	else if(pAd->Antenna.field.RxPath == 2)
-	{
-		BBPR3 |= (0x8);
-	}
-	else if(pAd->Antenna.field.RxPath == 1)
-	{
-		BBPR3 |= (0x0);
-	}
-	RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R3, BBPR3);
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-		// Handle the difference when 1T
-		RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R1, &BBPR1);
-		if(pAd->Antenna.field.TxPath == 1)
-		{
-		BBPR1 &= (~0x18);
-		}
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R1, BBPR1);
-
-		DBGPRINT(RT_DEBUG_TRACE, ("Use Hw Radio Control Pin=%d; if used Pin=%d;\n",
-					pAd->CommonCfg.bHardwareRadio, pAd->CommonCfg.bHardwareRadio));
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-
-	DBGPRINT(RT_DEBUG_TRACE, ("TxPath = %d, RxPath = %d, RFIC=%d, Polar+LED mode=%x\n",
-				pAd->Antenna.field.TxPath, pAd->Antenna.field.RxPath,
-				pAd->RfIcType, pAd->LedCntl.word));
-	DBGPRINT(RT_DEBUG_TRACE, ("<-- NICInitAsicFromEEPROM\n"));
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-		Initialize NIC hardware
-
-	Arguments:
-		Adapter						Pointer to our adapter
-
-	Return Value:
-		None
-
-	IRQL = PASSIVE_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-NDIS_STATUS	NICInitializeAdapter(
-	IN	PRTMP_ADAPTER	pAd,
-	IN   BOOLEAN    bHardReset)
-{
-	NDIS_STATUS     Status = NDIS_STATUS_SUCCESS;
-	WPDMA_GLO_CFG_STRUC	GloCfg;
-#ifdef RTMP_MAC_PCI
-	UINT32			Value;
-	DELAY_INT_CFG_STRUC	IntCfg;
-#endif // RTMP_MAC_PCI //
-//	INT_MASK_CSR_STRUC		IntMask;
-	ULONG	i =0, j=0;
-	AC_TXOP_CSR0_STRUC	csr0;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("--> NICInitializeAdapter\n"));
-
-	// 3. Set DMA global configuration except TX_DMA_EN and RX_DMA_EN bits:
-retry:
-	i = 0;
-	do
-	{
-		RTMP_IO_READ32(pAd, WPDMA_GLO_CFG, &GloCfg.word);
-		if ((GloCfg.field.TxDMABusy == 0)  && (GloCfg.field.RxDMABusy == 0))
-			break;
-
-		RTMPusecDelay(1000);
-		i++;
-	}while ( i<100);
-	DBGPRINT(RT_DEBUG_TRACE, ("<== DMA offset 0x208 = 0x%x\n", GloCfg.word));
-	GloCfg.word &= 0xff0;
-	GloCfg.field.EnTXWriteBackDDONE =1;
-	RTMP_IO_WRITE32(pAd, WPDMA_GLO_CFG, GloCfg.word);
-
-	// Record HW Beacon offset
-	pAd->BeaconOffset[0] = HW_BEACON_BASE0;
-	pAd->BeaconOffset[1] = HW_BEACON_BASE1;
-	pAd->BeaconOffset[2] = HW_BEACON_BASE2;
-	pAd->BeaconOffset[3] = HW_BEACON_BASE3;
-	pAd->BeaconOffset[4] = HW_BEACON_BASE4;
-	pAd->BeaconOffset[5] = HW_BEACON_BASE5;
-	pAd->BeaconOffset[6] = HW_BEACON_BASE6;
-	pAd->BeaconOffset[7] = HW_BEACON_BASE7;
-
-	//
-	// write all shared Ring's base address into ASIC
-	//
-
-	// asic simulation sequence put this ahead before loading firmware.
-	// pbf hardware reset
-#ifdef RTMP_MAC_PCI
-	RTMP_IO_WRITE32(pAd, WPDMA_RST_IDX, 0x1003f);	// 0x10000 for reset rx, 0x3f resets all 6 tx rings.
-	RTMP_IO_WRITE32(pAd, PBF_SYS_CTRL, 0xe1f);
-	RTMP_IO_WRITE32(pAd, PBF_SYS_CTRL, 0xe00);
-#endif // RTMP_MAC_PCI //
-
-	// Initialze ASIC for TX & Rx operation
-	if (NICInitializeAsic(pAd , bHardReset) != NDIS_STATUS_SUCCESS)
-	{
-		if (j++ == 0)
-		{
-			NICLoadFirmware(pAd);
-			goto retry;
-		}
-		return NDIS_STATUS_FAILURE;
-	}
-
-
-#ifdef RTMP_MAC_PCI
-	// Write AC_BK base address register
-	Value = RTMP_GetPhysicalAddressLow(pAd->TxRing[QID_AC_BK].Cell[0].AllocPa);
-	RTMP_IO_WRITE32(pAd, TX_BASE_PTR1, Value);
-	DBGPRINT(RT_DEBUG_TRACE, ("--> TX_BASE_PTR1 : 0x%x\n", Value));
-
-	// Write AC_BE base address register
-	Value = RTMP_GetPhysicalAddressLow(pAd->TxRing[QID_AC_BE].Cell[0].AllocPa);
-	RTMP_IO_WRITE32(pAd, TX_BASE_PTR0, Value);
-	DBGPRINT(RT_DEBUG_TRACE, ("--> TX_BASE_PTR0 : 0x%x\n", Value));
-
-	// Write AC_VI base address register
-	Value = RTMP_GetPhysicalAddressLow(pAd->TxRing[QID_AC_VI].Cell[0].AllocPa);
-	RTMP_IO_WRITE32(pAd, TX_BASE_PTR2, Value);
-	DBGPRINT(RT_DEBUG_TRACE, ("--> TX_BASE_PTR2 : 0x%x\n", Value));
-
-	// Write AC_VO base address register
-	Value = RTMP_GetPhysicalAddressLow(pAd->TxRing[QID_AC_VO].Cell[0].AllocPa);
-	RTMP_IO_WRITE32(pAd, TX_BASE_PTR3, Value);
-	DBGPRINT(RT_DEBUG_TRACE, ("--> TX_BASE_PTR3 : 0x%x\n", Value));
-
-	// Write HCCA base address register
-	/*
-	Value = RTMP_GetPhysicalAddressLow(pAd->TxRing[QID_HCCA].Cell[0].AllocPa);
-	RTMP_IO_WRITE32(pAd, TX_BASE_PTR4, Value);
-	DBGPRINT(RT_DEBUG_TRACE, ("--> TX_BASE_PTR4 : 0x%x\n", Value));
-	*/
-
-	// Write MGMT_BASE_CSR register
-	Value = RTMP_GetPhysicalAddressLow(pAd->MgmtRing.Cell[0].AllocPa);
-	RTMP_IO_WRITE32(pAd, TX_BASE_PTR5, Value);
-	DBGPRINT(RT_DEBUG_TRACE, ("--> TX_BASE_PTR5 : 0x%x\n", Value));
-
-	// Write RX_BASE_CSR register
-	Value = RTMP_GetPhysicalAddressLow(pAd->RxRing.Cell[0].AllocPa);
-	RTMP_IO_WRITE32(pAd, RX_BASE_PTR, Value);
-	DBGPRINT(RT_DEBUG_TRACE, ("--> RX_BASE_PTR : 0x%x\n", Value));
-
-	// Init RX Ring index pointer
-	pAd->RxRing.RxSwReadIdx = 0;
-	pAd->RxRing.RxCpuIdx = RX_RING_SIZE-1;
-	RTMP_IO_WRITE32(pAd, RX_CRX_IDX, pAd->RxRing.RxCpuIdx);
-
-	// Init TX rings index pointer
-	{
-		for (i=0; i<NUM_OF_TX_RING; i++)
-		{
-			pAd->TxRing[i].TxSwFreeIdx = 0;
-			pAd->TxRing[i].TxCpuIdx = 0;
-			RTMP_IO_WRITE32(pAd, (TX_CTX_IDX0 + i * 0x10) ,  pAd->TxRing[i].TxCpuIdx);
-		}
-	}
-
-	// init MGMT ring index pointer
-	pAd->MgmtRing.TxSwFreeIdx = 0;
-	pAd->MgmtRing.TxCpuIdx = 0;
-	RTMP_IO_WRITE32(pAd, TX_MGMTCTX_IDX,  pAd->MgmtRing.TxCpuIdx);
-
-	//
-	// set each Ring's SIZE  into ASIC. Descriptor Size is fixed by design.
-	//
-
-	// Write TX_RING_CSR0 register
-	Value = TX_RING_SIZE;
-	RTMP_IO_WRITE32(pAd, TX_MAX_CNT0, Value);
-	RTMP_IO_WRITE32(pAd, TX_MAX_CNT1, Value);
-	RTMP_IO_WRITE32(pAd, TX_MAX_CNT2, Value);
-	RTMP_IO_WRITE32(pAd, TX_MAX_CNT3, Value);
-	RTMP_IO_WRITE32(pAd, TX_MAX_CNT4, Value);
-	Value = MGMT_RING_SIZE;
-	RTMP_IO_WRITE32(pAd, TX_MGMTMAX_CNT, Value);
-
-	// Write RX_RING_CSR register
-	Value = RX_RING_SIZE;
-	RTMP_IO_WRITE32(pAd, RX_MAX_CNT, Value);
-#endif // RTMP_MAC_PCI //
-
-
-	// WMM parameter
-	csr0.word = 0;
-	RTMP_IO_WRITE32(pAd, WMM_TXOP0_CFG, csr0.word);
-	if (pAd->CommonCfg.PhyMode == PHY_11B)
-	{
-		csr0.field.Ac0Txop = 192;	// AC_VI: 192*32us ~= 6ms
-		csr0.field.Ac1Txop = 96;	// AC_VO: 96*32us  ~= 3ms
-	}
-	else
-	{
-		csr0.field.Ac0Txop = 96;	// AC_VI: 96*32us ~= 3ms
-		csr0.field.Ac1Txop = 48;	// AC_VO: 48*32us ~= 1.5ms
-	}
-	RTMP_IO_WRITE32(pAd, WMM_TXOP1_CFG, csr0.word);
-
-
-#ifdef RTMP_MAC_PCI
-	// 3. Set DMA global configuration except TX_DMA_EN and RX_DMA_EN bits:
-	i = 0;
-	do
-	{
-		RTMP_IO_READ32(pAd, WPDMA_GLO_CFG, &GloCfg.word);
-		if ((GloCfg.field.TxDMABusy == 0)  && (GloCfg.field.RxDMABusy == 0))
-			break;
-
-		RTMPusecDelay(1000);
-		i++;
-	}while ( i < 100);
-
-	GloCfg.word &= 0xff0;
-	GloCfg.field.EnTXWriteBackDDONE =1;
-	RTMP_IO_WRITE32(pAd, WPDMA_GLO_CFG, GloCfg.word);
-
-	IntCfg.word = 0;
-	RTMP_IO_WRITE32(pAd, DELAY_INT_CFG, IntCfg.word);
-#endif // RTMP_MAC_PCI //
-
-
-	// reset action
-	// Load firmware
-	//  Status = NICLoadFirmware(pAd);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("<-- NICInitializeAdapter\n"));
-	return Status;
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-		Initialize ASIC
-
-	Arguments:
-		Adapter						Pointer to our adapter
-
-	Return Value:
-		None
-
-	IRQL = PASSIVE_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-NDIS_STATUS	NICInitializeAsic(
-	IN	PRTMP_ADAPTER	pAd,
-	IN  BOOLEAN		bHardReset)
-{
-	ULONG			Index = 0;
-	UCHAR			R0 = 0xff;
-	UINT32			MacCsr12 = 0, Counter = 0;
-#ifdef RT30xx
-	UCHAR			bbpreg=0;
-	UCHAR			RFValue=0;
-#endif // RT30xx //
-	USHORT			KeyIdx;
-	INT				i,apidx;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("--> NICInitializeAsic\n"));
-
-#ifdef RTMP_MAC_PCI
-	RTMP_IO_WRITE32(pAd, PWR_PIN_CFG, 0x3);	// To fix driver disable/enable hang issue when radio off
-	if (bHardReset == TRUE)
-	{
-		RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, 0x3);
-	}
-	else
-		RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, 0x1);
-
-	RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, 0x0);
-	// Initialize MAC register to default value
-	for (Index = 0; Index < NUM_MAC_REG_PARMS; Index++)
-	{
-#ifdef RT30xx
-		if ((MACRegTable[Index].Register == TX_SW_CFG0) && ( IS_RT3090(pAd) ||  IS_RT3390(pAd)))
-		{
-			MACRegTable[Index].Value = 0x00000400;
-		}
-#endif // RT30xx //
-		RTMP_IO_WRITE32(pAd, MACRegTable[Index].Register, MACRegTable[Index].Value);
-	}
-
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-		for (Index = 0; Index < NUM_STA_MAC_REG_PARMS; Index++)
-		{
-			RTMP_IO_WRITE32(pAd, STAMACRegTable[Index].Register, STAMACRegTable[Index].Value);
-		}
-	}
-#endif // CONFIG_STA_SUPPORT //
-#endif // RTMP_MAC_PCI //
-
-
-#ifdef RT30xx
-	// Initialize RT3070 serial MAC registers which is different from RT2870 serial
-	if (IS_RT3090(pAd) || IS_RT3572(pAd)||IS_RT3390(pAd))
-	{
-		RTMP_IO_WRITE32(pAd, TX_SW_CFG1, 0);
-
-		// RT3071 version E has fixed this issue
-		if ((pAd->MACVersion & 0xffff) < 0x0211)
-		{
-			if (pAd->NicConfig2.field.DACTestBit == 1)
-			{
-				RTMP_IO_WRITE32(pAd, TX_SW_CFG2, 0x2C);	// To fix throughput drop drastically
-			}
-			else
-			{
-				RTMP_IO_WRITE32(pAd, TX_SW_CFG2, 0x0F);	// To fix throughput drop drastically
-			}
-		}
-		else
-		{
-			RTMP_IO_WRITE32(pAd, TX_SW_CFG2, 0x0);
-		}
-	}
-	else if (IS_RT3070(pAd))
-	{
-		if (((pAd->MACVersion & 0xffff) < 0x0201))
-		{
-			RTMP_IO_WRITE32(pAd, TX_SW_CFG1, 0);
-			RTMP_IO_WRITE32(pAd, TX_SW_CFG2, 0x2C);	// To fix throughput drop drastically
-		}
-		else
-		{
-			RTMP_IO_WRITE32(pAd, TX_SW_CFG2, 0);
-		}
-	}
-#endif // RT30xx //
-
-	//
-	// Before program BBP, we need to wait BBP/RF get wake up.
-	//
-	Index = 0;
-	do
-	{
-		RTMP_IO_READ32(pAd, MAC_STATUS_CFG, &MacCsr12);
-
-		if ((MacCsr12 & 0x03) == 0)	// if BB.RF is stable
-			break;
-
-		DBGPRINT(RT_DEBUG_TRACE, ("Check MAC_STATUS_CFG  = Busy = %x\n", MacCsr12));
-		RTMPusecDelay(1000);
-	} while (Index++ < 100);
-
-	// The commands to firmware should be after these commands, these commands will init firmware
-	// PCI and USB are not the same because PCI driver needs to wait for PCI bus ready
-	RTMP_IO_WRITE32(pAd, H2M_BBP_AGENT, 0);	// initialize BBP R/W access agent
-	RTMP_IO_WRITE32(pAd, H2M_MAILBOX_CSR, 0);
-#ifdef RT3090
-	//2008/11/28:KH add to fix the dead rf frequency offset bug<--
-	AsicSendCommandToMcu(pAd, 0x72, 0, 0, 0);
-	//2008/11/28:KH add to fix the dead rf frequency offset bug-->
-#endif // RT3090 //
-	RTMPusecDelay(1000);
-
-	// Read BBP register, make sure BBP is up and running before write new data
-	Index = 0;
-	do
-	{
-		RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R0, &R0);
-		DBGPRINT(RT_DEBUG_TRACE, ("BBP version = %x\n", R0));
-	} while ((++Index < 20) && ((R0 == 0xff) || (R0 == 0x00)));
-	//ASSERT(Index < 20); //this will cause BSOD on Check-build driver
-
-	if ((R0 == 0xff) || (R0 == 0x00))
-		return NDIS_STATUS_FAILURE;
-
-	// Initialize BBP register to default value
-	for (Index = 0; Index < NUM_BBP_REG_PARMS; Index++)
-	{
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBPRegTable[Index].Register, BBPRegTable[Index].Value);
-	}
-
-#ifdef RTMP_MAC_PCI
-	// TODO: shiang, check MACVersion, currently, rbus-based chip use this.
-	if (pAd->MACVersion == 0x28720200)
-	{
-		//UCHAR value;
-		ULONG value2;
-
-		//disable MLD by Bruce 20080704
-		//BBP_IO_READ8_BY_REG_ID(pAd, BBP_R105, &value);
-		//BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R105, value | 4);
-
-		//Maximum PSDU length from 16K to 32K bytes
-		RTMP_IO_READ32(pAd, MAX_LEN_CFG, &value2);
-		value2 &= ~(0x3<<12);
-		value2 |= (0x2<<12);
-		RTMP_IO_WRITE32(pAd, MAX_LEN_CFG, value2);
-	}
-#endif // RTMP_MAC_PCI //
-
-	// for rt2860E and after, init BBP_R84 with 0x19. This is for extension channel overlapping IOT.
-	// RT3090 should not program BBP R84 to 0x19, otherwise TX will block.
-	//3070/71/72,3090,3090A( are included in RT30xx),3572,3390
-	if (((pAd->MACVersion & 0xffff) != 0x0101) && !(IS_RT30xx(pAd)|| IS_RT3572(pAd) || IS_RT3390(pAd)))
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R84, 0x19);
-
-#ifdef RT30xx
-// add by johnli, RF power sequence setup
-	if (IS_RT30xx(pAd) || IS_RT3572(pAd) || IS_RT3390(pAd))
-	{	//update for RT3070/71/72/90/91/92,3572,3390.
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R79, 0x13);
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R80, 0x05);
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R81, 0x33);
-	}
-
-	if (IS_RT3090(pAd)||IS_RT3390(pAd))	// RT309x, RT3071/72
-	{
-		// enable DC filter
-		if ((pAd->MACVersion & 0xffff) >= 0x0211)
-		{
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R103, 0xc0);
-		}
-
-		// improve power consumption
-		RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R138, &bbpreg);
-		if (pAd->Antenna.field.TxPath == 1)
-		{
-			// turn off tx DAC_1
-			bbpreg = (bbpreg | 0x20);
-		}
-
-		if (pAd->Antenna.field.RxPath == 1)
-		{
-			// turn off tx ADC_1
-			bbpreg &= (~0x2);
-		}
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R138, bbpreg);
-
-		// improve power consumption in RT3071 Ver.E
-		if ((pAd->MACVersion & 0xffff) >= 0x0211)
-		{
-			RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R31, &bbpreg);
-			bbpreg &= (~0x3);
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R31, bbpreg);
-		}
-	}
-	else if (IS_RT3070(pAd))
-	{
-		if ((pAd->MACVersion & 0xffff) >= 0x0201)
-		{
-			// enable DC filter
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R103, 0xc0);
-
-			// improve power consumption in RT3070 Ver.F
-			RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R31, &bbpreg);
-			bbpreg &= (~0x3);
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R31, bbpreg);
-		}
-
-		// TX_LO1_en, RF R17 register Bit 3 to 0
-		RT30xxReadRFRegister(pAd, RF_R17, &RFValue);
-		RFValue &= (~0x08);
-		// to fix rx long range issue
-		if (pAd->NicConfig2.field.ExternalLNAForG == 0)
-		{
-			RFValue |= 0x20;
-		}
-		// set RF_R17_bit[2:0] equal to EEPROM setting at 0x48h
-		if (pAd->TxMixerGain24G >= 1)
-		{
-			RFValue &= (~0x7);  // clean bit [2:0]
-			RFValue |= pAd->TxMixerGain24G;
-		}
-		RT30xxWriteRFRegister(pAd, RF_R17, RFValue);
-	}
-// end johnli
-#endif // RT30xx //
-
-	if (pAd->MACVersion == 0x28600100)
-	{
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R69, 0x16);
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R73, 0x12);
-	}
-
-	if (pAd->MACVersion >= RALINK_2880E_VERSION && pAd->MACVersion < RALINK_3070_VERSION) // 3*3
-	{
-		// enlarge MAX_LEN_CFG
-		UINT32 csr;
-		RTMP_IO_READ32(pAd, MAX_LEN_CFG, &csr);
-		csr &= 0xFFF;
-		csr |= 0x2000;
-		RTMP_IO_WRITE32(pAd, MAX_LEN_CFG, csr);
-	}
-
-
-#ifdef CONFIG_STA_SUPPORT
-	// Add radio off control
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-		if (pAd->StaCfg.bRadio == FALSE)
-		{
-//			RTMP_IO_WRITE32(pAd, PWR_PIN_CFG, 0x00001818);
-			RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_RADIO_OFF);
-			DBGPRINT(RT_DEBUG_TRACE, ("Set Radio Off\n"));
-		}
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-	// Clear raw counters
-	RTMP_IO_READ32(pAd, RX_STA_CNT0, &Counter);
-	RTMP_IO_READ32(pAd, RX_STA_CNT1, &Counter);
-	RTMP_IO_READ32(pAd, RX_STA_CNT2, &Counter);
-	RTMP_IO_READ32(pAd, TX_STA_CNT0, &Counter);
-	RTMP_IO_READ32(pAd, TX_STA_CNT1, &Counter);
-	RTMP_IO_READ32(pAd, TX_STA_CNT2, &Counter);
-
-	// ASIC will keep garbage value after boot
-	// Clear all shared key table when initial
-	// This routine can be ignored in radio-ON/OFF operation.
-	if (bHardReset)
-	{
-		for (KeyIdx = 0; KeyIdx < 4; KeyIdx++)
-		{
-			RTMP_IO_WRITE32(pAd, SHARED_KEY_MODE_BASE + 4*KeyIdx, 0);
-		}
-
-		// Clear all pairwise key table when initial
-		for (KeyIdx = 0; KeyIdx < 256; KeyIdx++)
-		{
-			RTMP_IO_WRITE32(pAd, MAC_WCID_ATTRIBUTE_BASE + (KeyIdx * HW_WCID_ATTRI_SIZE), 1);
-		}
-	}
-
-	// assert HOST ready bit
-//  RTMP_IO_WRITE32(pAd, MAC_CSR1, 0x0); // 2004-09-14 asked by Mark
-//  RTMP_IO_WRITE32(pAd, MAC_CSR1, 0x4);
-
-	// It isn't necessary to clear this space when not hard reset.
-	if (bHardReset == TRUE)
-	{
-		// clear all on-chip BEACON frame space
-		for (apidx = 0; apidx < HW_BEACON_MAX_COUNT; apidx++)
-		{
-			for (i = 0; i < HW_BEACON_OFFSET>>2; i+=4)
-				RTMP_IO_WRITE32(pAd, pAd->BeaconOffset[apidx] + i, 0x00);
-		}
-	}
-
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-		// for rt2860E and after, init TXOP_CTRL_CFG with 0x583f. This is for extension channel overlapping IOT.
-		if ((pAd->MACVersion&0xffff) != 0x0101)
-			RTMP_IO_WRITE32(pAd, TXOP_CTRL_CFG, 0x583f);
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-#ifdef RT30xx
-#ifdef NEW_FW
-	if (IS_RT3070(pAd) ||  IS_RT3572(pAd)||IS_RT3390(pAd)||IS_RT3090(pAd))
-	{
-		// send 0x36 mcu command after 0x72 for RT3xxx to fix Radio-Off current leakage issue
-		RTMPusecDelay(200);
-		if (pAd->buseEfuse)
-			AsicSendCommandToMcu(pAd, 0x36, 0xff, 0xff, 0);
-		else
-			AsicSendCommandToMcu(pAd, 0x36, 0xff, 0xff, 0x04);
-		RTMPusecDelay(10);
-	}
-#endif // NEW_FW //
-#endif // RT30xx //
-
-	DBGPRINT(RT_DEBUG_TRACE, ("<-- NICInitializeAsic\n"));
-	return NDIS_STATUS_SUCCESS;
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-		Reset NIC Asics
-
-	Arguments:
-		Adapter						Pointer to our adapter
-
-	Return Value:
-		None
-
-	IRQL = PASSIVE_LEVEL
-
-	Note:
-		Reset NIC to initial state AS IS system boot up time.
-
-	========================================================================
-*/
-VOID	NICIssueReset(
-	IN	PRTMP_ADAPTER	pAd)
-{
-	UINT32	Value = 0;
-	DBGPRINT(RT_DEBUG_TRACE, ("--> NICIssueReset\n"));
-
-	// Abort Tx, prevent ASIC from writing to Host memory
-	//RTMP_IO_WRITE32(pAd, TX_CNTL_CSR, 0x001f0000);
-
-	// Disable Rx, register value supposed will remain after reset
-	RTMP_IO_READ32(pAd, MAC_SYS_CTRL, &Value);
-	Value &= (0xfffffff3);
-	RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, Value);
-
-	// Issue reset and clear from reset state
-	RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, 0x03); // 2004-09-17 change from 0x01
-	RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, 0x00);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("<-- NICIssueReset\n"));
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-		Check ASIC registers and find any reason the system might hang
-
-	Arguments:
-		Adapter						Pointer to our adapter
-
-	Return Value:
-		None
-
-	IRQL = DISPATCH_LEVEL
-
-	========================================================================
-*/
-BOOLEAN	NICCheckForHang(
-	IN	PRTMP_ADAPTER	pAd)
-{
-	return (FALSE);
-}
-
-VOID NICUpdateFifoStaCounters(
-	IN PRTMP_ADAPTER pAd)
-{
-	TX_STA_FIFO_STRUC	StaFifo;
-	MAC_TABLE_ENTRY		*pEntry;
-	UCHAR				i = 0;
-	UCHAR			pid = 0, wcid = 0;
-	CHAR				reTry;
-	UCHAR				succMCS;
-
-#ifdef RALINK_ATE
-	/* Nothing to do in ATE mode */
-	if (ATE_ON(pAd))
-		return;
-#endif // RALINK_ATE //
-
-		do
-		{
-			RTMP_IO_READ32(pAd, TX_STA_FIFO, &StaFifo.word);
-
-			if (StaFifo.field.bValid == 0)
-				break;
-
-			wcid = (UCHAR)StaFifo.field.wcid;
-
-
-		/* ignore NoACK and MGMT frame use 0xFF as WCID */
-			if ((StaFifo.field.TxAckRequired == 0) || (wcid >= MAX_LEN_OF_MAC_TABLE))
-			{
-				i++;
-				continue;
-			}
-
-			/* PID store Tx MCS Rate */
-			pid = (UCHAR)StaFifo.field.PidType;
-
-			pEntry = &pAd->MacTab.Content[wcid];
-
-			pEntry->DebugFIFOCount++;
-
-#ifdef DOT11_N_SUPPORT
-			if (StaFifo.field.TxBF) // 3*3
-				pEntry->TxBFCount++;
-#endif // DOT11_N_SUPPORT //
-
-#ifdef UAPSD_AP_SUPPORT
-			UAPSD_SP_AUE_Handle(pAd, pEntry, StaFifo.field.TxSuccess);
-#endif // UAPSD_AP_SUPPORT //
-
-			if (!StaFifo.field.TxSuccess)
-			{
-				pEntry->FIFOCount++;
-				pEntry->OneSecTxFailCount++;
-
-				if (pEntry->FIFOCount >= 1)
-				{
-					DBGPRINT(RT_DEBUG_TRACE, ("#"));
-#ifdef DOT11_N_SUPPORT
-					pEntry->NoBADataCountDown = 64;
-#endif // DOT11_N_SUPPORT //
-
-					if(pEntry->PsMode == PWR_ACTIVE)
-					{
-#ifdef DOT11_N_SUPPORT
-						int tid;
-						for (tid=0; tid<NUM_OF_TID; tid++)
-						{
-							BAOriSessionTearDown(pAd, pEntry->Aid,  tid, FALSE, FALSE);
-						}
-#endif // DOT11_N_SUPPORT //
-
-						// Update the continuous transmission counter except PS mode
-						pEntry->ContinueTxFailCnt++;
-
-#ifdef WDS_SUPPORT
-						// fix WDS Jam issue
-						if((pEntry->ValidAsWDS == TRUE)
-							&& (pEntry->LockEntryTx == FALSE)
-							&& (pEntry->ContinueTxFailCnt >= pAd->ApCfg.EntryLifeCheck))
-						{
-							DBGPRINT(RT_DEBUG_TRACE, ("Entry %02x:%02x:%02x:%02x:%02x:%02x Blocked!! (Fail Cnt = %d)\n",
-								pEntry->Addr[0],pEntry->Addr[1],pEntry->Addr[2],pEntry->Addr[3],
-								pEntry->Addr[4],pEntry->Addr[5],pEntry->ContinueTxFailCnt ));
-
-							pEntry->LockEntryTx = TRUE;
-						}
-#endif // WDS_SUPPORT //
-					}
-					else
-					{
-						// Clear the FIFOCount when sta in Power Save mode. Basically we assume
-						//     this tx error happened due to sta just go to sleep.
-						pEntry->FIFOCount = 0;
-						pEntry->ContinueTxFailCnt = 0;
-					}
-					//pEntry->FIFOCount = 0;
-				}
-				//pEntry->bSendBAR = TRUE;
-			}
-			else
-			{
-#ifdef DOT11_N_SUPPORT
-				if ((pEntry->PsMode != PWR_SAVE) && (pEntry->NoBADataCountDown > 0))
-				{
-					pEntry->NoBADataCountDown--;
-					if (pEntry->NoBADataCountDown==0)
-					{
-						DBGPRINT(RT_DEBUG_TRACE, ("@\n"));
-					}
-				}
-#endif // DOT11_N_SUPPORT //
-				pEntry->FIFOCount = 0;
-				pEntry->OneSecTxNoRetryOkCount++;
-				// update NoDataIdleCount when sucessful send packet to STA.
-				pEntry->NoDataIdleCount = 0;
-				pEntry->ContinueTxFailCnt = 0;
-#ifdef WDS_SUPPORT
-				pEntry->LockEntryTx = FALSE;
-#endif // WDS_SUPPORT //
-			}
-
-			succMCS = StaFifo.field.SuccessRate & 0x7F;
-
-			reTry = pid - succMCS;
-
-			if (StaFifo.field.TxSuccess)
-			{
-				pEntry->TXMCSExpected[pid]++;
-				if (pid == succMCS)
-				{
-					pEntry->TXMCSSuccessful[pid]++;
-				}
-				else
-				{
-					pEntry->TXMCSAutoFallBack[pid][succMCS]++;
-				}
-			}
-			else
-			{
-				pEntry->TXMCSFailed[pid]++;
-			}
-
-			if (reTry > 0)
-			{
-				if ((pid >= 12) && succMCS <=7)
-				{
-					reTry -= 4;
-				}
-				pEntry->OneSecTxRetryOkCount += reTry;
-			}
-
-			i++;
-			// ASIC store 16 stack
-		} while ( i < (TX_RING_SIZE<<1) );
-
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-		Read statistical counters from hardware registers and record them
-		in software variables for later on query
-
-	Arguments:
-		pAd					Pointer to our adapter
-
-	Return Value:
-		None
-
-	IRQL = DISPATCH_LEVEL
-
-	========================================================================
-*/
-VOID NICUpdateRawCounters(
-	IN PRTMP_ADAPTER pAd)
-{
-	UINT32	OldValue;//, Value2;
-	//ULONG	PageSum, OneSecTransmitCount;
-	//ULONG	TxErrorRatio, Retry, Fail;
-	RX_STA_CNT0_STRUC	 RxStaCnt0;
-	RX_STA_CNT1_STRUC   RxStaCnt1;
-	RX_STA_CNT2_STRUC   RxStaCnt2;
-	TX_STA_CNT0_STRUC	 TxStaCnt0;
-	TX_STA_CNT1_STRUC	 StaTx1;
-	TX_STA_CNT2_STRUC	 StaTx2;
-	TX_AGG_CNT_STRUC	TxAggCnt;
-	TX_AGG_CNT0_STRUC	TxAggCnt0;
-	TX_AGG_CNT1_STRUC	TxAggCnt1;
-	TX_AGG_CNT2_STRUC	TxAggCnt2;
-	TX_AGG_CNT3_STRUC	TxAggCnt3;
-	TX_AGG_CNT4_STRUC	TxAggCnt4;
-	TX_AGG_CNT5_STRUC	TxAggCnt5;
-	TX_AGG_CNT6_STRUC	TxAggCnt6;
-	TX_AGG_CNT7_STRUC	TxAggCnt7;
-	COUNTER_RALINK		*pRalinkCounters;
-
-
-	pRalinkCounters = &pAd->RalinkCounters;
-
-	RTMP_IO_READ32(pAd, RX_STA_CNT0, &RxStaCnt0.word);
-	RTMP_IO_READ32(pAd, RX_STA_CNT2, &RxStaCnt2.word);
-
-	{
-		RTMP_IO_READ32(pAd, RX_STA_CNT1, &RxStaCnt1.word);
-	    // Update RX PLCP error counter
-	    pAd->PrivateInfo.PhyRxErrCnt += RxStaCnt1.field.PlcpErr;
-		// Update False CCA counter
-		pAd->RalinkCounters.OneSecFalseCCACnt += RxStaCnt1.field.FalseCca;
-	}
-
-	// Update FCS counters
-	OldValue= pAd->WlanCounters.FCSErrorCount.u.LowPart;
-	pAd->WlanCounters.FCSErrorCount.u.LowPart += (RxStaCnt0.field.CrcErr); // >> 7);
-	if (pAd->WlanCounters.FCSErrorCount.u.LowPart < OldValue)
-		pAd->WlanCounters.FCSErrorCount.u.HighPart++;
-
-	// Add FCS error count to private counters
-	pRalinkCounters->OneSecRxFcsErrCnt += RxStaCnt0.field.CrcErr;
-	OldValue = pRalinkCounters->RealFcsErrCount.u.LowPart;
-	pRalinkCounters->RealFcsErrCount.u.LowPart += RxStaCnt0.field.CrcErr;
-	if (pRalinkCounters->RealFcsErrCount.u.LowPart < OldValue)
-		pRalinkCounters->RealFcsErrCount.u.HighPart++;
-
-	// Update Duplicate Rcv check
-	pRalinkCounters->DuplicateRcv += RxStaCnt2.field.RxDupliCount;
-	pAd->WlanCounters.FrameDuplicateCount.u.LowPart += RxStaCnt2.field.RxDupliCount;
-	// Update RX Overflow counter
-	pAd->Counters8023.RxNoBuffer += (RxStaCnt2.field.RxFifoOverflowCount);
-
-	//pAd->RalinkCounters.RxCount = 0;
-
-
-	//if (!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_TX_RATE_SWITCH_ENABLED) ||
-	//	(OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_TX_RATE_SWITCH_ENABLED) && (pAd->MacTab.Size != 1)))
-	if (!pAd->bUpdateBcnCntDone)
-	{
-	// Update BEACON sent count
-	RTMP_IO_READ32(pAd, TX_STA_CNT0, &TxStaCnt0.word);
-	RTMP_IO_READ32(pAd, TX_STA_CNT1, &StaTx1.word);
-	RTMP_IO_READ32(pAd, TX_STA_CNT2, &StaTx2.word);
-	pRalinkCounters->OneSecBeaconSentCnt += TxStaCnt0.field.TxBeaconCount;
-	pRalinkCounters->OneSecTxRetryOkCount += StaTx1.field.TxRetransmit;
-	pRalinkCounters->OneSecTxNoRetryOkCount += StaTx1.field.TxSuccess;
-	pRalinkCounters->OneSecTxFailCount += TxStaCnt0.field.TxFailCount;
-	pAd->WlanCounters.TransmittedFragmentCount.u.LowPart += StaTx1.field.TxSuccess;
-	pAd->WlanCounters.RetryCount.u.LowPart += StaTx1.field.TxRetransmit;
-	pAd->WlanCounters.FailedCount.u.LowPart += TxStaCnt0.field.TxFailCount;
-	}
-
-
-	//if (pAd->bStaFifoTest == TRUE)
-	{
-		RTMP_IO_READ32(pAd, TX_AGG_CNT, &TxAggCnt.word);
-	RTMP_IO_READ32(pAd, TX_AGG_CNT0, &TxAggCnt0.word);
-	RTMP_IO_READ32(pAd, TX_AGG_CNT1, &TxAggCnt1.word);
-	RTMP_IO_READ32(pAd, TX_AGG_CNT2, &TxAggCnt2.word);
-	RTMP_IO_READ32(pAd, TX_AGG_CNT3, &TxAggCnt3.word);
-		RTMP_IO_READ32(pAd, TX_AGG_CNT4, &TxAggCnt4.word);
-		RTMP_IO_READ32(pAd, TX_AGG_CNT5, &TxAggCnt5.word);
-		RTMP_IO_READ32(pAd, TX_AGG_CNT6, &TxAggCnt6.word);
-		RTMP_IO_READ32(pAd, TX_AGG_CNT7, &TxAggCnt7.word);
-		pRalinkCounters->TxAggCount += TxAggCnt.field.AggTxCount;
-		pRalinkCounters->TxNonAggCount += TxAggCnt.field.NonAggTxCount;
-		pRalinkCounters->TxAgg1MPDUCount += TxAggCnt0.field.AggSize1Count;
-		pRalinkCounters->TxAgg2MPDUCount += TxAggCnt0.field.AggSize2Count;
-
-		pRalinkCounters->TxAgg3MPDUCount += TxAggCnt1.field.AggSize3Count;
-		pRalinkCounters->TxAgg4MPDUCount += TxAggCnt1.field.AggSize4Count;
-		pRalinkCounters->TxAgg5MPDUCount += TxAggCnt2.field.AggSize5Count;
-		pRalinkCounters->TxAgg6MPDUCount += TxAggCnt2.field.AggSize6Count;
-
-		pRalinkCounters->TxAgg7MPDUCount += TxAggCnt3.field.AggSize7Count;
-		pRalinkCounters->TxAgg8MPDUCount += TxAggCnt3.field.AggSize8Count;
-		pRalinkCounters->TxAgg9MPDUCount += TxAggCnt4.field.AggSize9Count;
-		pRalinkCounters->TxAgg10MPDUCount += TxAggCnt4.field.AggSize10Count;
-
-		pRalinkCounters->TxAgg11MPDUCount += TxAggCnt5.field.AggSize11Count;
-		pRalinkCounters->TxAgg12MPDUCount += TxAggCnt5.field.AggSize12Count;
-		pRalinkCounters->TxAgg13MPDUCount += TxAggCnt6.field.AggSize13Count;
-		pRalinkCounters->TxAgg14MPDUCount += TxAggCnt6.field.AggSize14Count;
-
-		pRalinkCounters->TxAgg15MPDUCount += TxAggCnt7.field.AggSize15Count;
-		pRalinkCounters->TxAgg16MPDUCount += TxAggCnt7.field.AggSize16Count;
-
-		// Calculate the transmitted A-MPDU count
-		pRalinkCounters->TransmittedAMPDUCount.u.LowPart += TxAggCnt0.field.AggSize1Count;
-		pRalinkCounters->TransmittedAMPDUCount.u.LowPart += (TxAggCnt0.field.AggSize2Count / 2);
-
-		pRalinkCounters->TransmittedAMPDUCount.u.LowPart += (TxAggCnt1.field.AggSize3Count / 3);
-		pRalinkCounters->TransmittedAMPDUCount.u.LowPart += (TxAggCnt1.field.AggSize4Count / 4);
-
-		pRalinkCounters->TransmittedAMPDUCount.u.LowPart += (TxAggCnt2.field.AggSize5Count / 5);
-		pRalinkCounters->TransmittedAMPDUCount.u.LowPart += (TxAggCnt2.field.AggSize6Count / 6);
-
-		pRalinkCounters->TransmittedAMPDUCount.u.LowPart += (TxAggCnt3.field.AggSize7Count / 7);
-		pRalinkCounters->TransmittedAMPDUCount.u.LowPart += (TxAggCnt3.field.AggSize8Count / 8);
-
-		pRalinkCounters->TransmittedAMPDUCount.u.LowPart += (TxAggCnt4.field.AggSize9Count / 9);
-		pRalinkCounters->TransmittedAMPDUCount.u.LowPart += (TxAggCnt4.field.AggSize10Count / 10);
-
-		pRalinkCounters->TransmittedAMPDUCount.u.LowPart += (TxAggCnt5.field.AggSize11Count / 11);
-		pRalinkCounters->TransmittedAMPDUCount.u.LowPart += (TxAggCnt5.field.AggSize12Count / 12);
-
-		pRalinkCounters->TransmittedAMPDUCount.u.LowPart += (TxAggCnt6.field.AggSize13Count / 13);
-		pRalinkCounters->TransmittedAMPDUCount.u.LowPart += (TxAggCnt6.field.AggSize14Count / 14);
-
-		pRalinkCounters->TransmittedAMPDUCount.u.LowPart += (TxAggCnt7.field.AggSize15Count / 15);
-		pRalinkCounters->TransmittedAMPDUCount.u.LowPart += (TxAggCnt7.field.AggSize16Count / 16);
-	}
-
-#ifdef DBG_DIAGNOSE
-	{
-		RtmpDiagStruct	*pDiag;
-		UCHAR			ArrayCurIdx, i;
-
-		pDiag = &pAd->DiagStruct;
-		ArrayCurIdx = pDiag->ArrayCurIdx;
-
-		if (pDiag->inited == 0)
-		{
-			NdisZeroMemory(pDiag, sizeof(struct _RtmpDiagStrcut_));
-			pDiag->ArrayStartIdx = pDiag->ArrayCurIdx = 0;
-			pDiag->inited = 1;
-		}
-		else
-		{
-			// Tx
-			pDiag->TxFailCnt[ArrayCurIdx] = TxStaCnt0.field.TxFailCount;
-			pDiag->TxAggCnt[ArrayCurIdx] = TxAggCnt.field.AggTxCount;
-			pDiag->TxNonAggCnt[ArrayCurIdx] = TxAggCnt.field.NonAggTxCount;
-			pDiag->TxAMPDUCnt[ArrayCurIdx][0] = TxAggCnt0.field.AggSize1Count;
-			pDiag->TxAMPDUCnt[ArrayCurIdx][1] = TxAggCnt0.field.AggSize2Count;
-			pDiag->TxAMPDUCnt[ArrayCurIdx][2] = TxAggCnt1.field.AggSize3Count;
-			pDiag->TxAMPDUCnt[ArrayCurIdx][3] = TxAggCnt1.field.AggSize4Count;
-			pDiag->TxAMPDUCnt[ArrayCurIdx][4] = TxAggCnt2.field.AggSize5Count;
-			pDiag->TxAMPDUCnt[ArrayCurIdx][5] = TxAggCnt2.field.AggSize6Count;
-			pDiag->TxAMPDUCnt[ArrayCurIdx][6] = TxAggCnt3.field.AggSize7Count;
-			pDiag->TxAMPDUCnt[ArrayCurIdx][7] = TxAggCnt3.field.AggSize8Count;
-			pDiag->TxAMPDUCnt[ArrayCurIdx][8] = TxAggCnt4.field.AggSize9Count;
-			pDiag->TxAMPDUCnt[ArrayCurIdx][9] = TxAggCnt4.field.AggSize10Count;
-			pDiag->TxAMPDUCnt[ArrayCurIdx][10] = TxAggCnt5.field.AggSize11Count;
-			pDiag->TxAMPDUCnt[ArrayCurIdx][11] = TxAggCnt5.field.AggSize12Count;
-			pDiag->TxAMPDUCnt[ArrayCurIdx][12] = TxAggCnt6.field.AggSize13Count;
-			pDiag->TxAMPDUCnt[ArrayCurIdx][13] = TxAggCnt6.field.AggSize14Count;
-			pDiag->TxAMPDUCnt[ArrayCurIdx][14] = TxAggCnt7.field.AggSize15Count;
-			pDiag->TxAMPDUCnt[ArrayCurIdx][15] = TxAggCnt7.field.AggSize16Count;
-
-			pDiag->RxCrcErrCnt[ArrayCurIdx] = RxStaCnt0.field.CrcErr;
-
-			INC_RING_INDEX(pDiag->ArrayCurIdx,  DIAGNOSE_TIME);
-			ArrayCurIdx = pDiag->ArrayCurIdx;
-			for (i =0; i < 9; i++)
-			{
-				pDiag->TxDescCnt[ArrayCurIdx][i]= 0;
-				pDiag->TxSWQueCnt[ArrayCurIdx][i] =0;
-				pDiag->TxMcsCnt[ArrayCurIdx][i] = 0;
-				pDiag->RxMcsCnt[ArrayCurIdx][i] = 0;
-			}
-			pDiag->TxDataCnt[ArrayCurIdx] = 0;
-			pDiag->TxFailCnt[ArrayCurIdx] = 0;
-			pDiag->RxDataCnt[ArrayCurIdx] = 0;
-			pDiag->RxCrcErrCnt[ArrayCurIdx]  = 0;
-//			for (i = 9; i < 16; i++)
-			for (i = 9; i < 24; i++) // 3*3
-			{
-				pDiag->TxDescCnt[ArrayCurIdx][i] = 0;
-				pDiag->TxMcsCnt[ArrayCurIdx][i] = 0;
-				pDiag->RxMcsCnt[ArrayCurIdx][i] = 0;
-}
-
-			if (pDiag->ArrayCurIdx == pDiag->ArrayStartIdx)
-				INC_RING_INDEX(pDiag->ArrayStartIdx,  DIAGNOSE_TIME);
-		}
-
-	}
-#endif // DBG_DIAGNOSE //
-
-
-}
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		Reset NIC from error
-
-	Arguments:
-		Adapter						Pointer to our adapter
-
-	Return Value:
-		None
-
-	IRQL = PASSIVE_LEVEL
-
-	Note:
-		Reset NIC from error state
-
-	========================================================================
-*/
-VOID	NICResetFromError(
-	IN	PRTMP_ADAPTER	pAd)
-{
-	// Reset BBP (according to alex, reset ASIC will force reset BBP
-	// Therefore, skip the reset BBP
-	// RTMP_IO_WRITE32(pAd, MAC_CSR1, 0x2);
-
-	RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, 0x1);
-	// Remove ASIC from reset state
-	RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, 0x0);
-
-	NICInitializeAdapter(pAd, FALSE);
-	NICInitAsicFromEEPROM(pAd);
-
-	// Switch to current channel, since during reset process, the connection should remains on.
-	AsicSwitchChannel(pAd, pAd->CommonCfg.CentralChannel, FALSE);
-	AsicLockChannel(pAd, pAd->CommonCfg.CentralChannel);
-}
-
-
-NDIS_STATUS NICLoadFirmware(
-	IN PRTMP_ADAPTER pAd)
-{
-	NDIS_STATUS	 status = NDIS_STATUS_SUCCESS;
-	if (pAd->chipOps.loadFirmware)
-		status = pAd->chipOps.loadFirmware(pAd);
-
-	return status;
-}
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		erase 8051 firmware image in MAC ASIC
-
-	Arguments:
-		Adapter						Pointer to our adapter
-
-	IRQL = PASSIVE_LEVEL
-
-	========================================================================
-*/
-VOID NICEraseFirmware(
-	IN PRTMP_ADAPTER pAd)
-{
-	if (pAd->chipOps.eraseFirmware)
-		pAd->chipOps.eraseFirmware(pAd);
-
-}/* End of NICEraseFirmware */
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		Load Tx rate switching parameters
-
-	Arguments:
-		Adapter						Pointer to our adapter
-
-	Return Value:
-		NDIS_STATUS_SUCCESS         firmware image load ok
-		NDIS_STATUS_FAILURE         image not found
-
-	IRQL = PASSIVE_LEVEL
-
-	Rate Table Format:
-		1. (B0: Valid Item number) (B1:Initial item from zero)
-		2. Item Number(Dec)      Mode(Hex)     Current MCS(Dec)    TrainUp(Dec)    TrainDown(Dec)
-
-	========================================================================
-*/
-NDIS_STATUS NICLoadRateSwitchingParams(
-	IN PRTMP_ADAPTER pAd)
-{
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		Compare two memory block
-
-	Arguments:
-		pSrc1		Pointer to first memory address
-		pSrc2		Pointer to second memory address
-
-	Return Value:
-		0:			memory is equal
-		1:			pSrc1 memory is larger
-		2:			pSrc2 memory is larger
-
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-ULONG	RTMPCompareMemory(
-	IN	PVOID	pSrc1,
-	IN	PVOID	pSrc2,
-	IN	ULONG	Length)
-{
-	PUCHAR	pMem1;
-	PUCHAR	pMem2;
-	ULONG	Index = 0;
-
-	pMem1 = (PUCHAR) pSrc1;
-	pMem2 = (PUCHAR) pSrc2;
-
-	for (Index = 0; Index < Length; Index++)
-	{
-		if (pMem1[Index] > pMem2[Index])
-			return (1);
-		else if (pMem1[Index] < pMem2[Index])
-			return (2);
-	}
-
-	// Equal
-	return (0);
-}
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		Zero out memory block
-
-	Arguments:
-		pSrc1		Pointer to memory address
-		Length		Size
-
-	Return Value:
-		None
-
-	IRQL = PASSIVE_LEVEL
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-VOID	RTMPZeroMemory(
-	IN	PVOID	pSrc,
-	IN	ULONG	Length)
-{
-	PUCHAR	pMem;
-	ULONG	Index = 0;
-
-	pMem = (PUCHAR) pSrc;
-
-	for (Index = 0; Index < Length; Index++)
-	{
-		pMem[Index] = 0x00;
-	}
-}
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		Copy data from memory block 1 to memory block 2
-
-	Arguments:
-		pDest		Pointer to destination memory address
-		pSrc		Pointer to source memory address
-		Length		Copy size
-
-	Return Value:
-		None
-
-	IRQL = PASSIVE_LEVEL
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-VOID RTMPMoveMemory(
-	OUT	PVOID	pDest,
-	IN	PVOID	pSrc,
-	IN	ULONG	Length)
-{
-	PUCHAR	pMem1;
-	PUCHAR	pMem2;
-	UINT	Index;
-
-	ASSERT((Length==0) || (pDest && pSrc));
-
-	pMem1 = (PUCHAR) pDest;
-	pMem2 = (PUCHAR) pSrc;
-
-	for (Index = 0; Index < Length; Index++)
-	{
-		pMem1[Index] = pMem2[Index];
-	}
-}
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		Initialize port configuration structure
-
-	Arguments:
-		Adapter						Pointer to our adapter
-
-	Return Value:
-		None
-
-	IRQL = PASSIVE_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-VOID	UserCfgInit(
-	IN	PRTMP_ADAPTER pAd)
-{
-//	EDCA_PARM DefaultEdcaParm;
-    UINT key_index, bss_index;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("--> UserCfgInit\n"));
-
-	//
-	//  part I. intialize common configuration
-	//
-
-	for(key_index=0; key_index<SHARE_KEY_NUM; key_index++)
-	{
-		for(bss_index = 0; bss_index < MAX_MBSSID_NUM; bss_index++)
-		{
-			pAd->SharedKey[bss_index][key_index].KeyLen = 0;
-			pAd->SharedKey[bss_index][key_index].CipherAlg = CIPHER_NONE;
-		}
-	}
-
-	pAd->EepromAccess = FALSE;
-
-	pAd->Antenna.word = 0;
-	pAd->CommonCfg.BBPCurrentBW = BW_20;
-
-	pAd->LedCntl.word = 0;
-#ifdef RTMP_MAC_PCI
-	pAd->LedIndicatorStrength = 0;
-	pAd->RLnkCtrlOffset = 0;
-	pAd->HostLnkCtrlOffset = 0;
-#ifdef CONFIG_STA_SUPPORT
-	pAd->StaCfg.PSControl.field.EnableNewPS=TRUE;
-	pAd->CheckDmaBusyCount = 0;
-#endif // CONFIG_STA_SUPPORT //
-#endif // RTMP_MAC_PCI //
-
-	pAd->bAutoTxAgcA = FALSE;			// Default is OFF
-	pAd->bAutoTxAgcG = FALSE;			// Default is OFF
-	pAd->RfIcType = RFIC_2820;
-
-	// Init timer for reset complete event
-	pAd->CommonCfg.CentralChannel = 1;
-	pAd->bForcePrintTX = FALSE;
-	pAd->bForcePrintRX = FALSE;
-	pAd->bStaFifoTest = FALSE;
-	pAd->bProtectionTest = FALSE;
-	/*
-	pAd->bHCCATest = FALSE;
-	pAd->bGenOneHCCA = FALSE;
-	*/
-	pAd->CommonCfg.Dsifs = 10;      // in units of usec
-	pAd->CommonCfg.TxPower = 100; //mW
-	pAd->CommonCfg.TxPowerPercentage = 0xffffffff; // AUTO
-	pAd->CommonCfg.TxPowerDefault = 0xffffffff; // AUTO
-	pAd->CommonCfg.TxPreamble = Rt802_11PreambleAuto; // use Long preamble on TX by defaut
-	pAd->CommonCfg.bUseZeroToDisableFragment = FALSE;
-	pAd->CommonCfg.RtsThreshold = 2347;
-	pAd->CommonCfg.FragmentThreshold = 2346;
-	pAd->CommonCfg.UseBGProtection = 0;    // 0: AUTO
-	pAd->CommonCfg.bEnableTxBurst = TRUE; //0;
-	pAd->CommonCfg.PhyMode = 0xff;     // unknown
-	pAd->CommonCfg.BandState = UNKNOWN_BAND;
-	pAd->CommonCfg.RadarDetect.CSPeriod = 10;
-	pAd->CommonCfg.RadarDetect.CSCount = 0;
-	pAd->CommonCfg.RadarDetect.RDMode = RD_NORMAL_MODE;
-
-
-
-#ifdef TONE_RADAR_DETECT_SUPPORT
-#ifdef CARRIER_DETECTION_SUPPORT
-	pAd->CommonCfg.CarrierDetect.delta = CARRIER_DETECT_DELTA;
-	pAd->CommonCfg.CarrierDetect.div_flag = CARRIER_DETECT_DIV_FLAG;
-	pAd->CommonCfg.CarrierDetect.criteria = CARRIER_DETECT_CRITIRIA;
-#ifdef RT3090
-	if(IS_RT3090A(pAd))
-	pAd->CommonCfg.CarrierDetect.threshold = CARRIER_DETECT_THRESHOLD_3090A;
-	else
-#endif // RT3090 //
-	pAd->CommonCfg.CarrierDetect.threshold = CARRIER_DETECT_THRESHOLD;
-#endif // CARRIER_DETECTION_SUPPORT //
-#endif // TONE_RADAR_DETECT_SUPPORT //
-
-	pAd->CommonCfg.RadarDetect.ChMovingTime = 65;
-#ifdef MERGE_ARCH_TEAM
-	pAd->CommonCfg.RadarDetect.LongPulseRadarTh = 2;
-	pAd->CommonCfg.RadarDetect.AvgRssiReq = -75;
-#else // original rt28xx source code
-	pAd->CommonCfg.RadarDetect.LongPulseRadarTh = 3;
-#endif // MERGE_ARCH_TEAM //
-	pAd->CommonCfg.bAPSDCapable = FALSE;
-	pAd->CommonCfg.bNeedSendTriggerFrame = FALSE;
-	pAd->CommonCfg.TriggerTimerCount = 0;
-	pAd->CommonCfg.bAPSDForcePowerSave = FALSE;
-	pAd->CommonCfg.bCountryFlag = FALSE;
-	pAd->CommonCfg.TxStream = 0;
-	pAd->CommonCfg.RxStream = 0;
-
-	NdisZeroMemory(&pAd->BeaconTxWI, sizeof(pAd->BeaconTxWI));
-
-#ifdef DOT11_N_SUPPORT
-	NdisZeroMemory(&pAd->CommonCfg.HtCapability, sizeof(pAd->CommonCfg.HtCapability));
-	pAd->HTCEnable = FALSE;
-	pAd->bBroadComHT = FALSE;
-	pAd->CommonCfg.bRdg = FALSE;
-
-#ifdef DOT11N_DRAFT3
-	pAd->CommonCfg.Dot11OBssScanPassiveDwell = dot11OBSSScanPassiveDwell;	// Unit : TU. 5~1000
-	pAd->CommonCfg.Dot11OBssScanActiveDwell = dot11OBSSScanActiveDwell;	// Unit : TU. 10~1000
-	pAd->CommonCfg.Dot11BssWidthTriggerScanInt = dot11BSSWidthTriggerScanInterval;	// Unit : Second
-	pAd->CommonCfg.Dot11OBssScanPassiveTotalPerChannel = dot11OBSSScanPassiveTotalPerChannel;	// Unit : TU. 200~10000
-	pAd->CommonCfg.Dot11OBssScanActiveTotalPerChannel = dot11OBSSScanActiveTotalPerChannel;	// Unit : TU. 20~10000
-	pAd->CommonCfg.Dot11BssWidthChanTranDelayFactor = dot11BSSWidthChannelTransactionDelayFactor;
-	pAd->CommonCfg.Dot11OBssScanActivityThre = dot11BSSScanActivityThreshold;	// Unit : percentage
-	pAd->CommonCfg.Dot11BssWidthChanTranDelay = (pAd->CommonCfg.Dot11BssWidthTriggerScanInt * pAd->CommonCfg.Dot11BssWidthChanTranDelayFactor);
-#endif  // DOT11N_DRAFT3 //
-
-	NdisZeroMemory(&pAd->CommonCfg.AddHTInfo, sizeof(pAd->CommonCfg.AddHTInfo));
-	pAd->CommonCfg.BACapability.field.MMPSmode = MMPS_ENABLE;
-	pAd->CommonCfg.BACapability.field.MpduDensity = 0;
-	pAd->CommonCfg.BACapability.field.Policy = IMMED_BA;
-	pAd->CommonCfg.BACapability.field.RxBAWinLimit = 64; //32;
-	pAd->CommonCfg.BACapability.field.TxBAWinLimit = 64; //32;
-	DBGPRINT(RT_DEBUG_TRACE, ("--> UserCfgInit. BACapability = 0x%x\n", pAd->CommonCfg.BACapability.word));
-
-	pAd->CommonCfg.BACapability.field.AutoBA = FALSE;
-	BATableInit(pAd, &pAd->BATable);
-
-	pAd->CommonCfg.bExtChannelSwitchAnnouncement = 1;
-	pAd->CommonCfg.bHTProtect = 1;
-	pAd->CommonCfg.bMIMOPSEnable = TRUE;
-	//2008/11/05:KH add to support Antenna power-saving of AP<--
-	pAd->CommonCfg.bGreenAPEnable=FALSE;
-	pAd->CommonCfg.bBlockAntDivforGreenAP=FALSE;
-	//2008/11/05:KH add to support Antenna power-saving of AP-->
-	pAd->CommonCfg.bBADecline = FALSE;
-	pAd->CommonCfg.bDisableReordering = FALSE;
-
-	if (pAd->MACVersion == 0x28720200)
-	{
-		pAd->CommonCfg.TxBASize = 13; //by Jerry recommend
-	}else{
-		pAd->CommonCfg.TxBASize = 7;
-	}
-
-	pAd->CommonCfg.REGBACapability.word = pAd->CommonCfg.BACapability.word;
-#endif // DOT11_N_SUPPORT //
-
-	//pAd->CommonCfg.HTPhyMode.field.BW = BW_20;
-	//pAd->CommonCfg.HTPhyMode.field.MCS = MCS_AUTO;
-	//pAd->CommonCfg.HTPhyMode.field.ShortGI = GI_800;
-	//pAd->CommonCfg.HTPhyMode.field.STBC = STBC_NONE;
-	pAd->CommonCfg.TxRate = RATE_6;
-
-	pAd->CommonCfg.MlmeTransmit.field.MCS = MCS_RATE_6;
-	pAd->CommonCfg.MlmeTransmit.field.BW = BW_20;
-	pAd->CommonCfg.MlmeTransmit.field.MODE = MODE_OFDM;
-
-	pAd->CommonCfg.BeaconPeriod = 100;     // in mSec
-
-
-	//
-	// part II. intialize STA specific configuration
-	//
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-		RX_FILTER_SET_FLAG(pAd, fRX_FILTER_ACCEPT_DIRECT);
-		RX_FILTER_CLEAR_FLAG(pAd, fRX_FILTER_ACCEPT_MULTICAST);
-		RX_FILTER_SET_FLAG(pAd, fRX_FILTER_ACCEPT_BROADCAST);
-		RX_FILTER_SET_FLAG(pAd, fRX_FILTER_ACCEPT_ALL_MULTICAST);
-
-		pAd->StaCfg.Psm = PWR_ACTIVE;
-
-		pAd->StaCfg.OrigWepStatus = Ndis802_11EncryptionDisabled;
-		pAd->StaCfg.PairCipher = Ndis802_11EncryptionDisabled;
-		pAd->StaCfg.GroupCipher = Ndis802_11EncryptionDisabled;
-		pAd->StaCfg.bMixCipher = FALSE;
-		pAd->StaCfg.DefaultKeyId = 0;
-
-		// 802.1x port control
-		pAd->StaCfg.PrivacyFilter = Ndis802_11PrivFilter8021xWEP;
-		pAd->StaCfg.PortSecured = WPA_802_1X_PORT_NOT_SECURED;
-		pAd->StaCfg.LastMicErrorTime = 0;
-		pAd->StaCfg.MicErrCnt        = 0;
-		pAd->StaCfg.bBlockAssoc      = FALSE;
-		pAd->StaCfg.WpaState         = SS_NOTUSE;
-
-		pAd->CommonCfg.NdisRadioStateOff = FALSE;		// New to support microsoft disable radio with OID command
-
-		pAd->StaCfg.RssiTrigger = 0;
-		NdisZeroMemory(&pAd->StaCfg.RssiSample, sizeof(RSSI_SAMPLE));
-		pAd->StaCfg.RssiTriggerMode = RSSI_TRIGGERED_UPON_BELOW_THRESHOLD;
-		pAd->StaCfg.AtimWin = 0;
-		pAd->StaCfg.DefaultListenCount = 3;//default listen count;
-		pAd->StaCfg.BssType = BSS_INFRA;  // BSS_INFRA or BSS_ADHOC or BSS_MONITOR
-		pAd->StaCfg.bScanReqIsFromWebUI = FALSE;
-		OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_DOZE);
-		OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_WAKEUP_NOW);
-
-		pAd->StaCfg.bAutoTxRateSwitch = TRUE;
-		pAd->StaCfg.DesiredTransmitSetting.field.MCS = MCS_AUTO;
-	}
-
-#ifdef EXT_BUILD_CHANNEL_LIST
-	pAd->StaCfg.IEEE80211dClientMode = Rt802_11_D_None;
-#endif // EXT_BUILD_CHANNEL_LIST //
-#ifdef PCIE_PS_SUPPORT
-pAd->brt30xxBanMcuCmd = FALSE;
-pAd->b3090ESpecialChip = FALSE;
-//KH Debug:the following must be removed
-pAd->StaCfg.PSControl.field.rt30xxPowerMode=3;
-pAd->StaCfg.PSControl.field.rt30xxForceASPMTest=0;
-pAd->StaCfg.PSControl.field.rt30xxFollowHostASPM=1;
-#endif // PCIE_PS_SUPPORT //
-#endif // CONFIG_STA_SUPPORT //
-
-	// global variables mXXXX used in MAC protocol state machines
-	OPSTATUS_SET_FLAG(pAd, fOP_STATUS_RECEIVE_DTIM);
-	OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_ADHOC_ON);
-	OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_INFRA_ON);
-
-	// PHY specification
-	pAd->CommonCfg.PhyMode = PHY_11BG_MIXED;		// default PHY mode
-	OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_SHORT_PREAMBLE_INUSED);  // CCK use LONG preamble
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-		// user desired power mode
-		pAd->StaCfg.WindowsPowerMode = Ndis802_11PowerModeCAM;
-		pAd->StaCfg.WindowsBatteryPowerMode = Ndis802_11PowerModeCAM;
-		pAd->StaCfg.bWindowsACCAMEnable = FALSE;
-
-		RTMPInitTimer(pAd, &pAd->StaCfg.StaQuickResponeForRateUpTimer, GET_TIMER_FUNCTION(StaQuickResponeForRateUpExec), pAd, FALSE);
-		pAd->StaCfg.StaQuickResponeForRateUpTimerRunning = FALSE;
-
-		// Patch for Ndtest
-		pAd->StaCfg.ScanCnt = 0;
-
-		pAd->StaCfg.bHwRadio  = TRUE; // Default Hardware Radio status is On
-		pAd->StaCfg.bSwRadio  = TRUE; // Default Software Radio status is On
-		pAd->StaCfg.bRadio    = TRUE; // bHwRadio && bSwRadio
-		pAd->StaCfg.bHardwareRadio = FALSE;		// Default is OFF
-		pAd->StaCfg.bShowHiddenSSID = FALSE;		// Default no show
-
-		// Nitro mode control
-		pAd->StaCfg.bAutoReconnect = TRUE;
-
-		// Save the init time as last scan time, the system should do scan after 2 seconds.
-		// This patch is for driver wake up from standby mode, system will do scan right away.
-		NdisGetSystemUpTime(&pAd->StaCfg.LastScanTime);
-		if (pAd->StaCfg.LastScanTime > 10 * OS_HZ)
-			pAd->StaCfg.LastScanTime -= (10 * OS_HZ);
-
-		NdisZeroMemory(pAd->nickname, IW_ESSID_MAX_SIZE+1);
-#ifdef RTMP_MAC_PCI
-		sprintf((PSTRING) pAd->nickname, "RT2860STA");
-#endif // RTMP_MAC_PCI //
-		RTMPInitTimer(pAd, &pAd->StaCfg.WpaDisassocAndBlockAssocTimer, GET_TIMER_FUNCTION(WpaDisassocApAndBlockAssoc), pAd, FALSE);
-#ifdef WPA_SUPPLICANT_SUPPORT
-		pAd->StaCfg.IEEE8021X = FALSE;
-		pAd->StaCfg.IEEE8021x_required_keys = FALSE;
-		pAd->StaCfg.WpaSupplicantUP = WPA_SUPPLICANT_DISABLE;
-		pAd->StaCfg.bRSN_IE_FromWpaSupplicant = FALSE;
-#ifdef NATIVE_WPA_SUPPLICANT_SUPPORT
-		pAd->StaCfg.WpaSupplicantUP = WPA_SUPPLICANT_ENABLE;
-#endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
-#endif // WPA_SUPPLICANT_SUPPORT //
-
-		NdisZeroMemory(pAd->StaCfg.ReplayCounter, 8);
-
-
-		pAd->StaCfg.bAutoConnectByBssid = FALSE;
-		pAd->StaCfg.BeaconLostTime = BEACON_LOST_TIME;
-		NdisZeroMemory(pAd->StaCfg.WpaPassPhrase, 64);
-		pAd->StaCfg.WpaPassPhraseLen = 0;
-		pAd->StaCfg.bAutoRoaming = FALSE;
-		pAd->StaCfg.bForceTxBurst = FALSE;
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-	// Default for extra information is not valid
-	pAd->ExtraInfo = EXTRA_INFO_CLEAR;
-
-	// Default Config change flag
-	pAd->bConfigChanged = FALSE;
-
-	//
-	// part III. AP configurations
-	//
-
-
-	//
-	// part IV. others
-	//
-	// dynamic BBP R66:sensibity tuning to overcome background noise
-	pAd->BbpTuning.bEnable                = TRUE;
-	pAd->BbpTuning.FalseCcaLowerThreshold = 100;
-	pAd->BbpTuning.FalseCcaUpperThreshold = 512;
-	pAd->BbpTuning.R66Delta               = 4;
-	pAd->Mlme.bEnableAutoAntennaCheck = TRUE;
-
-	//
-	// Also initial R66CurrentValue, RTUSBResumeMsduTransmission might use this value.
-	// if not initial this value, the default value will be 0.
-	//
-	pAd->BbpTuning.R66CurrentValue = 0x38;
-
-	pAd->Bbp94 = BBPR94_DEFAULT;
-	pAd->BbpForCCK = FALSE;
-
-	// Default is FALSE for test bit 1
-	//pAd->bTest1 = FALSE;
-
-	// initialize MAC table and allocate spin lock
-	NdisZeroMemory(&pAd->MacTab, sizeof(MAC_TABLE));
-	InitializeQueueHeader(&pAd->MacTab.McastPsQueue);
-	NdisAllocateSpinLock(&pAd->MacTabLock);
-
-	//RTMPInitTimer(pAd, &pAd->RECBATimer, RECBATimerTimeout, pAd, TRUE);
-	//RTMPSetTimer(&pAd->RECBATimer, REORDER_EXEC_INTV);
-
-#ifdef RALINK_ATE
-	NdisZeroMemory(&pAd->ate, sizeof(ATE_INFO));
-	pAd->ate.Mode = ATE_STOP;
-	pAd->ate.TxCount = 200;/* to exceed TX_RING_SIZE ... */
-	pAd->ate.TxDoneCount = 0;
-	pAd->ate.RFFreqOffset = 0;
-	pAd->ate.TxLength = 1024;
-	pAd->ate.TxWI.ShortGI = 0;// LONG GI : 800 ns
-	pAd->ate.TxWI.PHYMODE = MODE_CCK;
-	pAd->ate.TxWI.MCS = 3;
-	pAd->ate.TxWI.BW = BW_20;
-	pAd->ate.Channel = 1;
-	pAd->ate.QID = QID_AC_BE;
-	pAd->ate.Addr1[0] = 0x00;
-	pAd->ate.Addr1[1] = 0x11;
-	pAd->ate.Addr1[2] = 0x22;
-	pAd->ate.Addr1[3] = 0xAA;
-	pAd->ate.Addr1[4] = 0xBB;
-	pAd->ate.Addr1[5] = 0xCC;
-	NdisMoveMemory(pAd->ate.Addr2, pAd->ate.Addr1, ETH_LENGTH_OF_ADDRESS);
-	NdisMoveMemory(pAd->ate.Addr3, pAd->ate.Addr1, ETH_LENGTH_OF_ADDRESS);
-	pAd->ate.bRxFER = 0;
-	pAd->ate.bQATxStart = FALSE;
-	pAd->ate.bQARxStart = FALSE;
-
-#ifdef RTMP_MAC_PCI
-	pAd->ate.bFWLoading = FALSE;
-#endif // RTMP_MAC_PCI //
-
-
-#ifdef RALINK_28xx_QA
-	pAd->ate.TxStatus = 0;
-	pAd->ate.AtePid = THREAD_PID_INIT_VALUE;
-#endif // RALINK_28xx_QA //
-#endif // RALINK_ATE //
-
-
-	pAd->CommonCfg.bWiFiTest = FALSE;
-#ifdef RTMP_MAC_PCI
-    pAd->bPCIclkOff = FALSE;
-#endif // RTMP_MAC_PCI //
-
-#ifdef CONFIG_STA_SUPPORT
-RTMP_SET_PSFLAG(pAd, fRTMP_PS_CAN_GO_SLEEP);
-#endif // CONFIG_STA_SUPPORT //
-#ifdef ANT_DIVERSITY_SUPPORT
-		if ( pAd->CommonCfg.bRxAntDiversity == ANT_FIX_ANT2)
-		{
-			pAd->RxAnt.Pair1PrimaryRxAnt = 1;
-			pAd->RxAnt.Pair1SecondaryRxAnt = 0;
-		}
-		else // Default
-		{
-			pAd->RxAnt.Pair1PrimaryRxAnt = 0;
-			pAd->RxAnt.Pair1SecondaryRxAnt = 1;
-		}
-		pAd->RxAnt.EvaluatePeriod = 0;
-		pAd->RxAnt.RcvPktNumWhenEvaluate = 0;
-#ifdef CONFIG_STA_SUPPORT
-		pAd->RxAnt.Pair1AvgRssi[0] = pAd->RxAnt.Pair1AvgRssi[1] = 0;
-#endif // CONFIG_STA_SUPPORT //
-#endif // AP_ANTENNA_DIVERSITY_SUPPORT //
-
-	DBGPRINT(RT_DEBUG_TRACE, ("<-- UserCfgInit\n"));
-}
-
-// IRQL = PASSIVE_LEVEL
-UCHAR BtoH(STRING ch)
-{
-	if (ch >= '0' && ch <= '9') return (ch - '0');        // Handle numerals
-	if (ch >= 'A' && ch <= 'F') return (ch - 'A' + 0xA);  // Handle capitol hex digits
-	if (ch >= 'a' && ch <= 'f') return (ch - 'a' + 0xA);  // Handle small hex digits
-	return(255);
-}
-
-//
-//  FUNCTION: AtoH(char *, UCHAR *, int)
-//
-//  PURPOSE:  Converts ascii string to network order hex
-//
-//  PARAMETERS:
-//    src    - pointer to input ascii string
-//    dest   - pointer to output hex
-//    destlen - size of dest
-//
-//  COMMENTS:
-//
-//    2 ascii bytes make a hex byte so must put 1st ascii byte of pair
-//    into upper nibble and 2nd ascii byte of pair into lower nibble.
-//
-// IRQL = PASSIVE_LEVEL
-
-void AtoH(PSTRING src, PUCHAR dest, int destlen)
-{
-	PSTRING srcptr;
-	PUCHAR destTemp;
-
-	srcptr = src;
-	destTemp = (PUCHAR) dest;
-
-	while(destlen--)
-	{
-		*destTemp = BtoH(*srcptr++) << 4;    // Put 1st ascii byte in upper nibble.
-		*destTemp += BtoH(*srcptr++);      // Add 2nd ascii byte to above.
-		destTemp++;
-	}
-}
-
-
-//+++Mark by shiang, not use now, need to remove after confirm
-//---Mark by shiang, not use now, need to remove after confirm
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		Init timer objects
-
-	Arguments:
-		pAd			Pointer to our adapter
-		pTimer				Timer structure
-		pTimerFunc			Function to execute when timer expired
-		Repeat				Ture for period timer
-
-	Return Value:
-		None
-
-	Note:
-
-	========================================================================
-*/
-VOID	RTMPInitTimer(
-	IN	PRTMP_ADAPTER			pAd,
-	IN	PRALINK_TIMER_STRUCT	pTimer,
-	IN	PVOID					pTimerFunc,
-	IN	PVOID					pData,
-	IN	BOOLEAN					Repeat)
-{
-	//
-	// Set Valid to TRUE for later used.
-	// It will crash if we cancel a timer or set a timer
-	// that we haven't initialize before.
-	//
-	pTimer->Valid      = TRUE;
-
-	pTimer->PeriodicType = Repeat;
-	pTimer->State      = FALSE;
-	pTimer->cookie = (ULONG) pData;
-
-#ifdef RTMP_TIMER_TASK_SUPPORT
-	pTimer->pAd = pAd;
-#endif // RTMP_TIMER_TASK_SUPPORT //
-
-	RTMP_OS_Init_Timer(pAd, &pTimer->TimerObj,	pTimerFunc, (PVOID) pTimer);
-}
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		Init timer objects
-
-	Arguments:
-		pTimer				Timer structure
-		Value				Timer value in milliseconds
-
-	Return Value:
-		None
-
-	Note:
-		To use this routine, must call RTMPInitTimer before.
-
-	========================================================================
-*/
-VOID	RTMPSetTimer(
-	IN	PRALINK_TIMER_STRUCT	pTimer,
-	IN	ULONG					Value)
-{
-	if (pTimer->Valid)
-	{
-		pTimer->TimerValue = Value;
-		pTimer->State      = FALSE;
-		if (pTimer->PeriodicType == TRUE)
-		{
-			pTimer->Repeat = TRUE;
-			RTMP_SetPeriodicTimer(&pTimer->TimerObj, Value);
-		}
-		else
-		{
-			pTimer->Repeat = FALSE;
-			RTMP_OS_Add_Timer(&pTimer->TimerObj, Value);
-		}
-	}
-	else
-	{
-		DBGPRINT_ERR(("RTMPSetTimer failed, Timer hasn't been initialize!\n"));
-	}
-}
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		Init timer objects
-
-	Arguments:
-		pTimer				Timer structure
-		Value				Timer value in milliseconds
-
-	Return Value:
-		None
-
-	Note:
-		To use this routine, must call RTMPInitTimer before.
-
-	========================================================================
-*/
-VOID	RTMPModTimer(
-	IN	PRALINK_TIMER_STRUCT	pTimer,
-	IN	ULONG					Value)
-{
-	BOOLEAN	Cancel;
-
-	if (pTimer->Valid)
-	{
-		pTimer->TimerValue = Value;
-		pTimer->State      = FALSE;
-		if (pTimer->PeriodicType == TRUE)
-		{
-			RTMPCancelTimer(pTimer, &Cancel);
-			RTMPSetTimer(pTimer, Value);
-		}
-		else
-		{
-			RTMP_OS_Mod_Timer(&pTimer->TimerObj, Value);
-		}
-	}
-	else
-	{
-		DBGPRINT_ERR(("RTMPModTimer failed, Timer hasn't been initialize!\n"));
-	}
-}
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		Cancel timer objects
-
-	Arguments:
-		Adapter						Pointer to our adapter
-
-	Return Value:
-		None
-
-	IRQL = PASSIVE_LEVEL
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-		1.) To use this routine, must call RTMPInitTimer before.
-		2.) Reset NIC to initial state AS IS system boot up time.
-
-	========================================================================
-*/
-VOID	RTMPCancelTimer(
-	IN	PRALINK_TIMER_STRUCT	pTimer,
-	OUT	BOOLEAN					*pCancelled)
-{
-	if (pTimer->Valid)
-	{
-		if (pTimer->State == FALSE)
-			pTimer->Repeat = FALSE;
-
-		RTMP_OS_Del_Timer(&pTimer->TimerObj, pCancelled);
-
-		if (*pCancelled == TRUE)
-			pTimer->State = TRUE;
-
-#ifdef RTMP_TIMER_TASK_SUPPORT
-		// We need to go-through the TimerQ to findout this timer handler and remove it if
-		//		it's still waiting for execution.
-		RtmpTimerQRemove(pTimer->pAd, pTimer);
-#endif // RTMP_TIMER_TASK_SUPPORT //
-	}
-	else
-	{
-		DBGPRINT_ERR(("RTMPCancelTimer failed, Timer hasn't been initialize!\n"));
-	}
-}
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		Set LED Status
-
-	Arguments:
-		pAd						Pointer to our adapter
-		Status					LED Status
-
-	Return Value:
-		None
-
-	IRQL = PASSIVE_LEVEL
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-VOID RTMPSetLED(
-	IN PRTMP_ADAPTER	pAd,
-	IN UCHAR			Status)
-{
-	//ULONG			data;
-	UCHAR			HighByte = 0;
-	UCHAR			LowByte;
-	BOOLEAN			bIgnored = FALSE;
-
-#ifdef RALINK_ATE
-	/*
-		In ATE mode of RT2860 AP/STA, we have erased 8051 firmware.
-		So LED mode is not supported when ATE is running.
-	*/
-	if (!IS_RT3572(pAd))
-	{
-		if (ATE_ON(pAd))
-			return;
-	}
-#endif // RALINK_ATE //
-
-	LowByte = pAd->LedCntl.field.LedMode&0x7f;
-	switch (Status)
-	{
-		case LED_LINK_DOWN:
-			HighByte = 0x20;
-			AsicSendCommandToMcu(pAd, 0x50, 0xff, LowByte, HighByte);
-			pAd->LedIndicatorStrength = 0;
-			break;
-		case LED_LINK_UP:
-			if (pAd->CommonCfg.Channel > 14)
-				HighByte = 0xa0;
-			else
-				HighByte = 0x60;
-			AsicSendCommandToMcu(pAd, 0x50, 0xff, LowByte, HighByte);
-			break;
-		case LED_RADIO_ON:
-			HighByte = 0x20;
-			AsicSendCommandToMcu(pAd, 0x50, 0xff, LowByte, HighByte);
-			break;
-		case LED_HALT:
-			LowByte = 0; // Driver sets MAC register and MAC controls LED
-		case LED_RADIO_OFF:
-			HighByte = 0;
-			AsicSendCommandToMcu(pAd, 0x50, 0xff, LowByte, HighByte);
-			break;
-		case LED_WPS:
-			HighByte = 0x10;
-			AsicSendCommandToMcu(pAd, 0x50, 0xff, LowByte, HighByte);
-			break;
-		case LED_ON_SITE_SURVEY:
-			HighByte = 0x08;
-			AsicSendCommandToMcu(pAd, 0x50, 0xff, LowByte, HighByte);
-			break;
-		case LED_POWER_UP:
-			HighByte = 0x04;
-			AsicSendCommandToMcu(pAd, 0x50, 0xff, LowByte, HighByte);
-			break;
-#ifdef RALINK_ATE
-#endif // RALINK_ATE //
-		default:
-			DBGPRINT(RT_DEBUG_WARN, ("RTMPSetLED::Unknown Status %d\n", Status));
-			break;
-	}
-
-    //
-	// Keep LED status for LED SiteSurvey mode.
-	// After SiteSurvey, we will set the LED mode to previous status.
-	//
-	if ((Status != LED_ON_SITE_SURVEY) && (Status != LED_POWER_UP) && (bIgnored == FALSE))
-		pAd->LedStatus = Status;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("RTMPSetLED::Mode=%d,HighByte=0x%02x,LowByte=0x%02x\n", pAd->LedCntl.field.LedMode, HighByte, LowByte));
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-		Set LED Signal Stregth
-
-	Arguments:
-		pAd						Pointer to our adapter
-		Dbm						Signal Stregth
-
-	Return Value:
-		None
-
-	IRQL = PASSIVE_LEVEL
-
-	Note:
-		Can be run on any IRQL level.
-
-		According to Microsoft Zero Config Wireless Signal Stregth definition as belows.
-		<= -90  No Signal
-		<= -81  Very Low
-		<= -71  Low
-		<= -67  Good
-		<= -57  Very Good
-		 > -57  Excellent
-	========================================================================
-*/
-VOID RTMPSetSignalLED(
-	IN PRTMP_ADAPTER	pAd,
-	IN NDIS_802_11_RSSI Dbm)
-{
-	UCHAR		nLed = 0;
-
-	if (pAd->LedCntl.field.LedMode == LED_MODE_SIGNAL_STREGTH)
-	{
-		if (Dbm <= -90)
-			nLed = 0;
-		else if (Dbm <= -81)
-			nLed = 1;
-		else if (Dbm <= -71)
-			nLed = 3;
-		else if (Dbm <= -67)
-			nLed = 7;
-		else if (Dbm <= -57)
-			nLed = 15;
-		else
-			nLed = 31;
-
-		//
-		// Update Signal Stregth to firmware if changed.
-		//
-		if (pAd->LedIndicatorStrength != nLed)
-		{
-			AsicSendCommandToMcu(pAd, 0x51, 0xff, nLed, pAd->LedCntl.field.Polarity);
-			pAd->LedIndicatorStrength = nLed;
-		}
-	}
-}
-
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		Enable RX
-
-	Arguments:
-		pAd						Pointer to our adapter
-
-	Return Value:
-		None
-
-	IRQL <= DISPATCH_LEVEL
-
-	Note:
-		Before Enable RX, make sure you have enabled Interrupt.
-	========================================================================
-*/
-VOID RTMPEnableRxTx(
-	IN PRTMP_ADAPTER	pAd)
-{
-//	WPDMA_GLO_CFG_STRUC	GloCfg;
-//	ULONG	i = 0;
-	UINT32 rx_filter_flag;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("==> RTMPEnableRxTx\n"));
-
-	// Enable Rx DMA.
-	RT28XXDMAEnable(pAd);
-
-	// enable RX of MAC block
-	if (pAd->OpMode == OPMODE_AP)
-	{
-		rx_filter_flag = APNORMAL;
-
-
-		RTMP_IO_WRITE32(pAd, RX_FILTR_CFG, rx_filter_flag);     // enable RX of DMA block
-	}
-	else
-	{
-		if (pAd->CommonCfg.PSPXlink)
-			rx_filter_flag = PSPXLINK;
-		else
-			rx_filter_flag = STANORMAL;     // Staion not drop control frame will fail WiFi Certification.
-		RTMP_IO_WRITE32(pAd, RX_FILTR_CFG, rx_filter_flag);
-	}
-
-	RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, 0xc);
-	DBGPRINT(RT_DEBUG_TRACE, ("<== RTMPEnableRxTx\n"));
-}
-
-
-//+++Add by shiang, move from os/linux/rt_main_dev.c
-void CfgInitHook(PRTMP_ADAPTER pAd)
-{
-	pAd->bBroadComHT = TRUE;
-}
-
-
-int rt28xx_init(
-	IN PRTMP_ADAPTER pAd,
-	IN PSTRING pDefaultMac,
-	IN PSTRING pHostName)
-{
-	UINT					index;
-	UCHAR					TmpPhy;
-	NDIS_STATUS				Status;
-	UINT32					MacCsr0 = 0;
-
-#ifdef CONFIG_STA_SUPPORT
-#ifdef RTMP_MAC_PCI
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-	// If dirver doesn't wake up firmware here,
-	// NICLoadFirmware will hang forever when interface is up again.
-	// RT2860 PCI
-	if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE) &&
-		OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE))
-	{
-		AUTO_WAKEUP_STRUC AutoWakeupCfg;
-			AsicForceWakeup(pAd, TRUE);
-		AutoWakeupCfg.word = 0;
-		RTMP_IO_WRITE32(pAd, AUTO_WAKEUP_CFG, AutoWakeupCfg.word);
-		OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_DOZE);
-	}
-	}
-#endif // RTMP_MAC_PCI //
-#endif // CONFIG_STA_SUPPORT //
-
-
-	// reset Adapter flags
-	RTMP_CLEAR_FLAGS(pAd);
-
-	// Init BssTab & ChannelInfo tabbles for auto channel select.
-
-#ifdef DOT11_N_SUPPORT
-	// Allocate BA Reordering memory
-	ba_reordering_resource_init(pAd, MAX_REORDERING_MPDU_NUM);
-#endif // DOT11_N_SUPPORT //
-
-	// Make sure MAC gets ready.
-	index = 0;
-	do
-	{
-		RTMP_IO_READ32(pAd, MAC_CSR0, &MacCsr0);
-		pAd->MACVersion = MacCsr0;
-
-		if ((pAd->MACVersion != 0x00) && (pAd->MACVersion != 0xFFFFFFFF))
-			break;
-
-		RTMPusecDelay(10);
-	} while (index++ < 100);
-	DBGPRINT(RT_DEBUG_TRACE, ("MAC_CSR0  [ Ver:Rev=0x%08x]\n", pAd->MACVersion));
-
-#ifdef RTMP_MAC_PCI
-#ifdef PCIE_PS_SUPPORT
-	/*Iverson patch PCIE L1 issue to make sure that driver can be read,write ,BBP and RF register  at pcie L.1 level */
-	if ((IS_RT3090(pAd) || IS_RT3572(pAd) || IS_RT3390(pAd))&&OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE))
-	{
-		RTMP_IO_READ32(pAd, AUX_CTRL, &MacCsr0);
-		MacCsr0 |= 0x402;
-		RTMP_IO_WRITE32(pAd, AUX_CTRL, MacCsr0);
-		DBGPRINT(RT_DEBUG_TRACE, ("AUX_CTRL = 0x%x\n", MacCsr0));
-	}
-#endif // PCIE_PS_SUPPORT //
-
-	// To fix driver disable/enable hang issue when radio off
-	RTMP_IO_WRITE32(pAd, PWR_PIN_CFG, 0x2);
-#endif // RTMP_MAC_PCI //
-
-	// Disable DMA
-	RT28XXDMADisable(pAd);
-
-
-	// Load 8051 firmware
-	Status = NICLoadFirmware(pAd);
-	if (Status != NDIS_STATUS_SUCCESS)
-	{
-		DBGPRINT_ERR(("NICLoadFirmware failed, Status[=0x%08x]\n", Status));
-		goto err1;
-	}
-
-	NICLoadRateSwitchingParams(pAd);
-
-	// Disable interrupts here which is as soon as possible
-	// This statement should never be true. We might consider to remove it later
-#ifdef RTMP_MAC_PCI
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_INTERRUPT_ACTIVE))
-	{
-		RTMP_ASIC_INTERRUPT_DISABLE(pAd);
-	}
-#endif // RTMP_MAC_PCI //
-
-	Status = RTMPAllocTxRxRingMemory(pAd);
-	if (Status != NDIS_STATUS_SUCCESS)
-	{
-		DBGPRINT_ERR(("RTMPAllocDMAMemory failed, Status[=0x%08x]\n", Status));
-		goto err1;
-	}
-
-	RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_INTERRUPT_IN_USE);
-
-	// initialize MLME
-	//
-
-	Status = RtmpMgmtTaskInit(pAd);
-	if (Status != NDIS_STATUS_SUCCESS)
-		goto err2;
-
-	Status = MlmeInit(pAd);
-	if (Status != NDIS_STATUS_SUCCESS)
-	{
-		DBGPRINT_ERR(("MlmeInit failed, Status[=0x%08x]\n", Status));
-		goto err2;
-	}
-
-	// Initialize pAd->StaCfg, pAd->ApCfg, pAd->CommonCfg to manufacture default
-	//
-	UserCfgInit(pAd);
-	Status = RtmpNetTaskInit(pAd);
-	if (Status != NDIS_STATUS_SUCCESS)
-		goto err3;
-
-//	COPY_MAC_ADDR(pAd->ApCfg.MBSSID[apidx].Bssid, netif->hwaddr);
-//	pAd->bForcePrintTX = TRUE;
-
-	CfgInitHook(pAd);
-
-
-#ifdef BLOCK_NET_IF
-	initblockQueueTab(pAd);
-#endif // BLOCK_NET_IF //
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		NdisAllocateSpinLock(&pAd->MacTabLock);
-#endif // CONFIG_STA_SUPPORT //
-
-	MeasureReqTabInit(pAd);
-	TpcReqTabInit(pAd);
-
-	//
-	// Init the hardware, we need to init asic before read registry, otherwise mac register will be reset
-	//
-	Status = NICInitializeAdapter(pAd, TRUE);
-	if (Status != NDIS_STATUS_SUCCESS)
-	{
-		DBGPRINT_ERR(("NICInitializeAdapter failed, Status[=0x%08x]\n", Status));
-		if (Status != NDIS_STATUS_SUCCESS)
-		goto err3;
-	}
-
-	// Read parameters from Config File
-	Status = RTMPReadParametersHook(pAd);
-
-	DBGPRINT(RT_DEBUG_OFF, ("1. Phy Mode = %d\n", pAd->CommonCfg.PhyMode));
-	if (Status != NDIS_STATUS_SUCCESS)
-	{
-		DBGPRINT_ERR(("NICReadRegParameters failed, Status[=0x%08x]\n",Status));
-		goto err4;
-	}
-
-
-
-#ifdef DOT11_N_SUPPORT
-	//Init Ba Capability parameters.
-//	RT28XX_BA_INIT(pAd);
-	pAd->CommonCfg.DesiredHtPhy.MpduDensity = (UCHAR)pAd->CommonCfg.BACapability.field.MpduDensity;
-	pAd->CommonCfg.DesiredHtPhy.AmsduEnable = (USHORT)pAd->CommonCfg.BACapability.field.AmsduEnable;
-	pAd->CommonCfg.DesiredHtPhy.AmsduSize = (USHORT)pAd->CommonCfg.BACapability.field.AmsduSize;
-	pAd->CommonCfg.DesiredHtPhy.MimoPs = (USHORT)pAd->CommonCfg.BACapability.field.MMPSmode;
-	// UPdata to HT IE
-	pAd->CommonCfg.HtCapability.HtCapInfo.MimoPs = (USHORT)pAd->CommonCfg.BACapability.field.MMPSmode;
-	pAd->CommonCfg.HtCapability.HtCapInfo.AMsduSize = (USHORT)pAd->CommonCfg.BACapability.field.AmsduSize;
-	pAd->CommonCfg.HtCapability.HtCapParm.MpduDensity = (UCHAR)pAd->CommonCfg.BACapability.field.MpduDensity;
-#endif // DOT11_N_SUPPORT //
-
-	// after reading Registry, we now know if in AP mode or STA mode
-
-	// Load 8051 firmware; crash when FW image not existent
-	// Status = NICLoadFirmware(pAd);
-	// if (Status != NDIS_STATUS_SUCCESS)
-	//    break;
-
-	DBGPRINT(RT_DEBUG_OFF, ("2. Phy Mode = %d\n", pAd->CommonCfg.PhyMode));
-
-	// We should read EEPROM for all cases.  rt2860b
-	NICReadEEPROMParameters(pAd, (PUCHAR)pDefaultMac);
-#ifdef CONFIG_STA_SUPPORT
-#endif // CONFIG_STA_SUPPORT //
-
-	DBGPRINT(RT_DEBUG_OFF, ("3. Phy Mode = %d\n", pAd->CommonCfg.PhyMode));
-
-	NICInitAsicFromEEPROM(pAd); //rt2860b
-
-	// Set PHY to appropriate mode
-	TmpPhy = pAd->CommonCfg.PhyMode;
-	pAd->CommonCfg.PhyMode = 0xff;
-	RTMPSetPhyMode(pAd, TmpPhy);
-#ifdef DOT11_N_SUPPORT
-	SetCommonHT(pAd);
-#endif // DOT11_N_SUPPORT //
-
-	// No valid channels.
-	if (pAd->ChannelListNum == 0)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("Wrong configuration. No valid channel found. Check \"ContryCode\" and \"ChannelGeography\" setting.\n"));
-		goto err4;
-	}
-
-#ifdef DOT11_N_SUPPORT
-	DBGPRINT(RT_DEBUG_OFF, ("MCS Set = %02x %02x %02x %02x %02x\n", pAd->CommonCfg.HtCapability.MCSSet[0],
-           pAd->CommonCfg.HtCapability.MCSSet[1], pAd->CommonCfg.HtCapability.MCSSet[2],
-           pAd->CommonCfg.HtCapability.MCSSet[3], pAd->CommonCfg.HtCapability.MCSSet[4]));
-#endif // DOT11_N_SUPPORT //
-
-#ifdef RTMP_RF_RW_SUPPORT
-	//Init RT30xx RFRegisters after read RFIC type from EEPROM
-	NICInitRFRegisters(pAd);
-#endif // RTMP_RF_RW_SUPPORT //
-
-
-
-//		APInitialize(pAd);
-
-#ifdef IKANOS_VX_1X0
-	VR_IKANOS_FP_Init(pAd->ApCfg.BssidNum, pAd->PermanentAddress);
-#endif // IKANOS_VX_1X0 //
-
-		//
-	// Initialize RF register to default value
-	//
-	AsicSwitchChannel(pAd, pAd->CommonCfg.Channel, FALSE);
-	AsicLockChannel(pAd, pAd->CommonCfg.Channel);
-
-	// 8051 firmware require the signal during booting time.
-	//2008/11/28:KH marked the following codes to patch Frequency offset bug
-	//AsicSendCommandToMcu(pAd, 0x72, 0xFF, 0x00, 0x00);
-
-	if (pAd && (Status != NDIS_STATUS_SUCCESS))
-	{
-		//
-		// Undo everything if it failed
-		//
-		if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_INTERRUPT_IN_USE))
-		{
-//			NdisMDeregisterInterrupt(&pAd->Interrupt);
-			RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_INTERRUPT_IN_USE);
-		}
-//		RTMPFreeAdapter(pAd); // we will free it in disconnect()
-	}
-	else if (pAd)
-	{
-		// Microsoft HCT require driver send a disconnect event after driver initialization.
-		OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED);
-//		pAd->IndicateMediaState = NdisMediaStateDisconnected;
-		RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_MEDIA_STATE_CHANGE);
-
-		DBGPRINT(RT_DEBUG_TRACE, ("NDIS_STATUS_MEDIA_DISCONNECT Event B!\n"));
-
-
-	}// end of else
-
-
-	// Set up the Mac address
-	RtmpOSNetDevAddrSet(pAd->net_dev, &pAd->CurrentAddress[0]);
-
-	// Various AP function init
-
-
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-#ifdef WPA_SUPPLICANT_SUPPORT
-#ifndef NATIVE_WPA_SUPPLICANT_SUPPORT
-		// send wireless event to wpa_supplicant for infroming interface up.
-		RtmpOSWrielessEventSend(pAd, IWEVCUSTOM, RT_INTERFACE_UP, NULL, NULL, 0);
-#endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
-#endif // WPA_SUPPLICANT_SUPPORT //
-
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-
-
-	DBGPRINT_S(Status, ("<==== rt28xx_init, Status=%x\n", Status));
-
-	return TRUE;
-
-
-err4:
-err3:
-	MlmeHalt(pAd);
-err2:
-	RTMPFreeTxRxRingMemory(pAd);
-err1:
-
-#ifdef DOT11_N_SUPPORT
-	os_free_mem(pAd, pAd->mpdu_blk_pool.mem); // free BA pool
-#endif // DOT11_N_SUPPORT //
-
-	// shall not set priv to NULL here because the priv didn't been free yet.
-	//net_dev->priv = 0;
-#ifdef INF_AMAZON_SE
-err0:
-#endif // INF_AMAZON_SE //
-#ifdef ST
-err0:
-#endif // ST //
-
-	DBGPRINT(RT_DEBUG_ERROR, ("!!! rt28xx Initialized fail !!!\n"));
-	return FALSE;
-}
-//---Add by shiang, move from os/linux/rt_main_dev.c
-
-
-static INT RtmpChipOpsRegister(
-	IN RTMP_ADAPTER *pAd,
-	IN INT			infType)
-{
-	RTMP_CHIP_OP	*pChipOps = &pAd->chipOps;
-	int status;
-
-	memset(pChipOps, 0, sizeof(RTMP_CHIP_OP));
-
-	/* set eeprom related hook functions */
-	status = RtmpChipOpsEepromHook(pAd, infType);
-
-	/* set mcu related hook functions */
-	switch(infType)
-	{
-#ifdef RTMP_PCI_SUPPORT
-		case RTMP_DEV_INF_PCI:
-			pChipOps->loadFirmware = RtmpAsicLoadFirmware;
-			pChipOps->eraseFirmware = RtmpAsicEraseFirmware;
-			pChipOps->sendCommandToMcu = RtmpAsicSendCommandToMcu;
-			break;
-#endif // RTMP_PCI_SUPPORT //
-
-
-		default:
-			break;
-	}
-
-	return status;
-}
-
-
-INT RtmpRaDevCtrlInit(
-	IN RTMP_ADAPTER *pAd,
-	IN RTMP_INF_TYPE infType)
-{
-	//VOID	*handle;
-
-	// Assign the interface type. We need use it when do register/EEPROM access.
-	pAd->infType = infType;
-
-
-#ifdef CONFIG_STA_SUPPORT
-	pAd->OpMode = OPMODE_STA;
-	DBGPRINT(RT_DEBUG_TRACE, ("STA Driver version-%s\n", STA_DRIVER_VERSION));
-#endif // CONFIG_STA_SUPPORT //
-
-
-
-	RtmpChipOpsRegister(pAd, infType);
-
-#ifdef MULTIPLE_CARD_SUPPORT
-{
-	extern BOOLEAN RTMP_CardInfoRead(PRTMP_ADAPTER pAd);
-
-	// find its profile path
-	pAd->MC_RowID = -1; // use default profile path
-	RTMP_CardInfoRead(pAd);
-
-	if (pAd->MC_RowID == -1)
-#ifdef CONFIG_STA_SUPPORT
-		strcpy(pAd->MC_FileName, STA_PROFILE_PATH);
-#endif // CONFIG_STA_SUPPORT //
-
-	DBGPRINT(RT_DEBUG_TRACE, ("MC> ROW = %d, PATH = %s\n", pAd->MC_RowID, pAd->MC_FileName));
-}
-#endif // MULTIPLE_CARD_SUPPORT //
-
-	return 0;
-}
-
-
-BOOLEAN RtmpRaDevCtrlExit(IN RTMP_ADAPTER *pAd)
-{
-#ifdef MULTIPLE_CARD_SUPPORT
-extern UINT8  MC_CardUsed[MAX_NUM_OF_MULTIPLE_CARD];
-
-	if ((pAd->MC_RowID >= 0) && (pAd->MC_RowID <= MAX_NUM_OF_MULTIPLE_CARD))
-		MC_CardUsed[pAd->MC_RowID] = 0; // not clear MAC address
-#endif // MULTIPLE_CARD_SUPPORT //
-
-
-	RTMPFreeAdapter(pAd);
-
-	return TRUE;
-}
-
-
-// not yet support MBSS
-PNET_DEV get_netdev_from_bssid(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			FromWhichBSSID)
-{
-	PNET_DEV dev_p = NULL;
-
-
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-		dev_p = pAd->net_dev;
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-	ASSERT(dev_p);
-	return dev_p; /* return one of MBSS */
-}
diff --git a/drivers/staging/rt3090/common/rtmp_mcu.c b/drivers/staging/rt3090/common/rtmp_mcu.c
deleted file mode 100644
index 23f785a90e06..000000000000
--- a/drivers/staging/rt3090/common/rtmp_mcu.c
+++ /dev/null
@@ -1,560 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-	Module Name:
-	rtmp_mcu.c
-
-	Abstract:
-	Miniport generic portion header file
-
-	Revision History:
-	Who         When          What
-	--------    ----------    ----------------------------------------------
-*/
-
-#include "../rt_config.h"
-#include "../firmware.h"
-
-//#define BIN_IN_FILE /* use *.bin firmware */
-
-
-// New 8k byte firmware size for RT3071/RT3072
-#define FIRMWAREIMAGE_MAX_LENGTH	0x2000
-#define FIRMWAREIMAGE_LENGTH			(sizeof (FirmwareImage) / sizeof(UCHAR))
-#define FIRMWARE_MAJOR_VERSION		0
-
-#define FIRMWAREIMAGEV1_LENGTH		0x1000
-#define FIRMWAREIMAGEV2_LENGTH		0x1000
-
-#ifdef RTMP_MAC_PCI
-#define FIRMWARE_MINOR_VERSION		2
-#endif // RTMP_MAC_PCI //
-
-const unsigned short ccitt_16Table[] = {
-	0x0000, 0x1021, 0x2042, 0x3063, 0x4084, 0x50A5, 0x60C6, 0x70E7,
-	0x8108, 0x9129, 0xA14A, 0xB16B, 0xC18C, 0xD1AD, 0xE1CE, 0xF1EF,
-	0x1231, 0x0210, 0x3273, 0x2252, 0x52B5, 0x4294, 0x72F7, 0x62D6,
-	0x9339, 0x8318, 0xB37B, 0xA35A, 0xD3BD, 0xC39C, 0xF3FF, 0xE3DE,
-	0x2462, 0x3443, 0x0420, 0x1401, 0x64E6, 0x74C7, 0x44A4, 0x5485,
-	0xA56A, 0xB54B, 0x8528, 0x9509, 0xE5EE, 0xF5CF, 0xC5AC, 0xD58D,
-	0x3653, 0x2672, 0x1611, 0x0630, 0x76D7, 0x66F6, 0x5695, 0x46B4,
-	0xB75B, 0xA77A, 0x9719, 0x8738, 0xF7DF, 0xE7FE, 0xD79D, 0xC7BC,
-	0x48C4, 0x58E5, 0x6886, 0x78A7, 0x0840, 0x1861, 0x2802, 0x3823,
-	0xC9CC, 0xD9ED, 0xE98E, 0xF9AF, 0x8948, 0x9969, 0xA90A, 0xB92B,
-	0x5AF5, 0x4AD4, 0x7AB7, 0x6A96, 0x1A71, 0x0A50, 0x3A33, 0x2A12,
-	0xDBFD, 0xCBDC, 0xFBBF, 0xEB9E, 0x9B79, 0x8B58, 0xBB3B, 0xAB1A,
-	0x6CA6, 0x7C87, 0x4CE4, 0x5CC5, 0x2C22, 0x3C03, 0x0C60, 0x1C41,
-	0xEDAE, 0xFD8F, 0xCDEC, 0xDDCD, 0xAD2A, 0xBD0B, 0x8D68, 0x9D49,
-	0x7E97, 0x6EB6, 0x5ED5, 0x4EF4, 0x3E13, 0x2E32, 0x1E51, 0x0E70,
-	0xFF9F, 0xEFBE, 0xDFDD, 0xCFFC, 0xBF1B, 0xAF3A, 0x9F59, 0x8F78,
-	0x9188, 0x81A9, 0xB1CA, 0xA1EB, 0xD10C, 0xC12D, 0xF14E, 0xE16F,
-	0x1080, 0x00A1, 0x30C2, 0x20E3, 0x5004, 0x4025, 0x7046, 0x6067,
-	0x83B9, 0x9398, 0xA3FB, 0xB3DA, 0xC33D, 0xD31C, 0xE37F, 0xF35E,
-	0x02B1, 0x1290, 0x22F3, 0x32D2, 0x4235, 0x5214, 0x6277, 0x7256,
-	0xB5EA, 0xA5CB, 0x95A8, 0x8589, 0xF56E, 0xE54F, 0xD52C, 0xC50D,
-	0x34E2, 0x24C3, 0x14A0, 0x0481, 0x7466, 0x6447, 0x5424, 0x4405,
-	0xA7DB, 0xB7FA, 0x8799, 0x97B8, 0xE75F, 0xF77E, 0xC71D, 0xD73C,
-	0x26D3, 0x36F2, 0x0691, 0x16B0, 0x6657, 0x7676, 0x4615, 0x5634,
-	0xD94C, 0xC96D, 0xF90E, 0xE92F, 0x99C8, 0x89E9, 0xB98A, 0xA9AB,
-	0x5844, 0x4865, 0x7806, 0x6827, 0x18C0, 0x08E1, 0x3882, 0x28A3,
-	0xCB7D, 0xDB5C, 0xEB3F, 0xFB1E, 0x8BF9, 0x9BD8, 0xABBB, 0xBB9A,
-	0x4A75, 0x5A54, 0x6A37, 0x7A16, 0x0AF1, 0x1AD0, 0x2AB3, 0x3A92,
-	0xFD2E, 0xED0F, 0xDD6C, 0xCD4D, 0xBDAA, 0xAD8B, 0x9DE8, 0x8DC9,
-	0x7C26, 0x6C07, 0x5C64, 0x4C45, 0x3CA2, 0x2C83, 0x1CE0, 0x0CC1,
-	0xEF1F, 0xFF3E, 0xCF5D, 0xDF7C, 0xAF9B, 0xBFBA, 0x8FD9, 0x9FF8,
-	0x6E17, 0x7E36, 0x4E55, 0x5E74, 0x2E93, 0x3EB2, 0x0ED1, 0x1EF0
-};
-#define ByteCRC16(v, crc) \
-	(unsigned short)((crc << 8) ^  ccitt_16Table[((crc >> 8) ^ (v)) & 255])
-
-unsigned char BitReverse(unsigned char x)
-{
-	int i;
-	unsigned char Temp=0;
-	for(i=0; ; i++)
-	{
-		if(x & 0x80)	Temp |= 0x80;
-		if(i==7)		break;
-		x	<<= 1;
-		Temp >>= 1;
-	}
-	return Temp;
-}
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		erase 8051 firmware image in MAC ASIC
-
-	Arguments:
-		Adapter						Pointer to our adapter
-
-	IRQL = PASSIVE_LEVEL
-
-	========================================================================
-*/
-INT RtmpAsicEraseFirmware(
-	IN PRTMP_ADAPTER pAd)
-{
-	ULONG i;
-
-	for(i=0; i<MAX_FIRMWARE_IMAGE_SIZE; i+=4)
-		RTMP_IO_WRITE32(pAd, FIRMWARE_IMAGE_BASE + i, 0);
-
-	return 0;
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-		Load 8051 firmware file into MAC ASIC
-
-	Arguments:
-		Adapter						Pointer to our adapter
-
-	Return Value:
-		NDIS_STATUS_SUCCESS         firmware image load ok
-		NDIS_STATUS_FAILURE         image not found
-
-	IRQL = PASSIVE_LEVEL
-
-	========================================================================
-*/
-NDIS_STATUS RtmpAsicLoadFirmware(
-	IN PRTMP_ADAPTER pAd)
-{
-#ifdef BIN_IN_FILE
-#define NICLF_DEFAULT_USE()	\
-	flg_default_firm_use = TRUE; \
-	DBGPRINT(RT_DEBUG_OFF, ("%s - Use default firmware!\n", __FUNCTION__));
-
-	NDIS_STATUS		Status = NDIS_STATUS_SUCCESS;
-	PUCHAR			src;
-	RTMP_OS_FD		srcf;
-	INT				retval, i;
-	PUCHAR			pFirmwareImage;
-	INT				FileLength = 0;
-	UINT32			MacReg;
-	ULONG			Index;
-	ULONG			firm;
-	BOOLEAN			flg_default_firm_use = FALSE;
-	RTMP_OS_FS_INFO	osFSInfo;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("===> %s\n", __FUNCTION__));
-
-	/* init */
-	pFirmwareImage = NULL;
-	src = RTMP_FIRMWARE_FILE_NAME;
-
-	RtmpOSFSInfoChange(&osFSInfo, TRUE);
-
-	pAd->FirmwareVersion = (FIRMWARE_MAJOR_VERSION << 8) + \
-						   FIRMWARE_MINOR_VERSION;
-
-
-	/* allocate firmware buffer */
-	pFirmwareImage = kmalloc(MAX_FIRMWARE_IMAGE_SIZE, MEM_ALLOC_FLAG);
-	if (pFirmwareImage == NULL)
-	{
-		/* allocate fail, use default firmware array in firmware.h */
-		DBGPRINT(RT_DEBUG_ERROR, ("%s - Allocate memory fail!\n", __FUNCTION__));
-		NICLF_DEFAULT_USE();
-	}
-	else
-	{
-		/* allocate ok! zero the firmware buffer */
-		memset(pFirmwareImage, 0x00, MAX_FIRMWARE_IMAGE_SIZE);
-	} /* End of if */
-
-
-	/* if ok, read firmware file from *.bin file */
-	if (flg_default_firm_use == FALSE)
-	{
-		do
-		{
-			/* open the bin file */
-			srcf = RtmpOSFileOpen(src, O_RDONLY, 0);
-
-			if (IS_FILE_OPEN_ERR(srcf))
-			{
-				DBGPRINT(RT_DEBUG_ERROR, ("%s - Error opening file %s\n", __FUNCTION__, src));
-				NICLF_DEFAULT_USE();
-				break;
-			}
-
-
-			/* read the firmware from the file *.bin */
-			FileLength = RtmpOSFileRead(srcf, pFirmwareImage, MAX_FIRMWARE_IMAGE_SIZE);
-			if (FileLength != MAX_FIRMWARE_IMAGE_SIZE)
-			{
-				DBGPRINT(RT_DEBUG_ERROR, ("%s: error file length (=%d) in RT2860AP.BIN\n",
-					   __FUNCTION__, FileLength));
-				NICLF_DEFAULT_USE();
-				break;
-			}
-			else
-			{
-				PUCHAR ptr = pFirmwareImage;
-				USHORT crc = 0xffff;
-
-
-				/* calculate firmware CRC */
-				for(i=0; i<(MAX_FIRMWARE_IMAGE_SIZE-2); i++, ptr++)
-					crc = ByteCRC16(BitReverse(*ptr), crc);
-				/* End of for */
-
-				if ((pFirmwareImage[MAX_FIRMWARE_IMAGE_SIZE-2] != \
-								(UCHAR)BitReverse((UCHAR)(crc>>8))) ||
-					(pFirmwareImage[MAX_FIRMWARE_IMAGE_SIZE-1] != \
-								(UCHAR)BitReverse((UCHAR)crc)))
-				{
-					/* CRC fail */
-					DBGPRINT(RT_DEBUG_ERROR, ("%s: CRC = 0x%02x 0x%02x "
-						   "error, should be 0x%02x 0x%02x\n",
-						   __FUNCTION__,
-						   pFirmwareImage[MAX_FIRMWARE_IMAGE_SIZE-2],
-						   pFirmwareImage[MAX_FIRMWARE_IMAGE_SIZE-1],
-						   (UCHAR)(crc>>8), (UCHAR)(crc)));
-					NICLF_DEFAULT_USE();
-					break;
-				}
-				else
-				{
-					/* firmware is ok */
-					pAd->FirmwareVersion = \
-						(pFirmwareImage[MAX_FIRMWARE_IMAGE_SIZE-4] << 8) +
-						pFirmwareImage[MAX_FIRMWARE_IMAGE_SIZE-3];
-
-					/* check if firmware version of the file is too old */
-					if ((pAd->FirmwareVersion) < \
-											((FIRMWARE_MAJOR_VERSION << 8) +
-											 FIRMWARE_MINOR_VERSION))
-					{
-						DBGPRINT(RT_DEBUG_ERROR, ("%s: firmware version too old!\n", __FUNCTION__));
-						NICLF_DEFAULT_USE();
-						break;
-					} /* End of if */
-				} /* End of if */
-
-				DBGPRINT(RT_DEBUG_TRACE,
-						 ("NICLoadFirmware: CRC ok, ver=%d.%d\n",
-						  pFirmwareImage[MAX_FIRMWARE_IMAGE_SIZE-4],
-						  pFirmwareImage[MAX_FIRMWARE_IMAGE_SIZE-3]));
-			} /* End of if (FileLength == MAX_FIRMWARE_IMAGE_SIZE) */
-			break;
-		} while(TRUE);
-
-		/* close firmware file */
-		if (IS_FILE_OPEN_ERR(srcf))
-			;
-		else
-		{
-			retval = RtmpOSFileClose(srcf);
-			if (retval)
-			{
-				DBGPRINT(RT_DEBUG_ERROR, ("--> Error %d closing %s\n", -retval, src));
-			}
-		}
-	}
-
-
-	/* write firmware to ASIC */
-	if (flg_default_firm_use == TRUE)
-	{
-		/* use default fimeware, free allocated buffer */
-		if (pFirmwareImage != NULL)
-			kfree(pFirmwareImage);
-		/* End of if */
-
-		/* use default *.bin array */
-		pFirmwareImage = FirmwareImage;
-		FileLength = sizeof(FirmwareImage);
-	} /* End of if */
-
-	/* enable Host program ram write selection */
-	RTMP_IO_WRITE32(pAd, PBF_SYS_CTRL, 0x10000);
-
-	for(i=0; i<FileLength; i+=4)
-	{
-		firm = pFirmwareImage[i] +
-			   (pFirmwareImage[i+3] << 24) +
-			   (pFirmwareImage[i+2] << 16) +
-			   (pFirmwareImage[i+1] << 8);
-
-		RTMP_IO_WRITE32(pAd, FIRMWARE_IMAGE_BASE + i, firm);
-	} /* End of for */
-
-	RTMP_IO_WRITE32(pAd, PBF_SYS_CTRL, 0x00000);
-	RTMP_IO_WRITE32(pAd, PBF_SYS_CTRL, 0x00001);
-
-	/* initialize BBP R/W access agent */
-	RTMP_IO_WRITE32(pAd, H2M_BBP_AGENT, 0);
-	RTMP_IO_WRITE32(pAd, H2M_MAILBOX_CSR, 0);
-
-	if (flg_default_firm_use == FALSE)
-	{
-		/* use file firmware, free allocated buffer */
-		if (pFirmwareImage != NULL)
-			kfree(pFirmwareImage);
-		/* End of if */
-	} /* End of if */
-
-	RtmpOSFSInfoChange(&osFSInfo, FALSE);
-#else
-
-	NDIS_STATUS		Status = NDIS_STATUS_SUCCESS;
-	PUCHAR			pFirmwareImage;
-	ULONG			FileLength, Index;
-	//ULONG			firm;
-	UINT32			MacReg = 0;
-	UINT32			Version = (pAd->MACVersion >> 16);
-
-	pFirmwareImage = FirmwareImage;
-	FileLength = sizeof(FirmwareImage);
-
-	// New 8k byte firmware size for RT3071/RT3072
-	//DBGPRINT(RT_DEBUG_TRACE, ("Usb Chip\n"));
-	if (FIRMWAREIMAGE_LENGTH == FIRMWAREIMAGE_MAX_LENGTH)
-	//The firmware image consists of two parts. One is the origianl and the other is the new.
-	//Use Second Part
-	{
-#ifdef RTMP_MAC_PCI
-		if ((Version == 0x2860) || IS_RT3090(pAd)||IS_RT3390(pAd))
-		{
-			pFirmwareImage = FirmwareImage;
-			FileLength = FIRMWAREIMAGE_LENGTH;
-		}
-#endif // RTMP_MAC_PCI //
-	}
-	else
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("KH: bin file should be 8KB.\n"));
-		Status = NDIS_STATUS_FAILURE;
-	}
-
-
-	RTMP_WRITE_FIRMWARE(pAd, pFirmwareImage, FileLength);
-
-#endif
-
-	/* check if MCU is ready */
-	Index = 0;
-	do
-	{
-		RTMP_IO_READ32(pAd, PBF_SYS_CTRL, &MacReg);
-
-		if (MacReg & 0x80)
-			break;
-
-		RTMPusecDelay(1000);
-	} while (Index++ < 1000);
-
-    if (Index >= 1000)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("NICLoadFirmware: MCU is not ready\n\n\n"));
-		Status = NDIS_STATUS_FAILURE;
-	}
-
-    DBGPRINT(RT_DEBUG_TRACE, ("<=== %s (status=%d)\n", __FUNCTION__, Status));
-
-    return Status;
-}
-
-
-INT RtmpAsicSendCommandToMcu(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR		 Command,
-	IN UCHAR		 Token,
-	IN UCHAR		 Arg0,
-	IN UCHAR		 Arg1)
-{
-	HOST_CMD_CSR_STRUC	H2MCmd;
-	H2M_MAILBOX_STRUC	H2MMailbox;
-	ULONG				i = 0;
-#ifdef RTMP_MAC_PCI
-#ifdef RALINK_ATE
-	static UINT32 j = 0;
-#endif // RALINK_ATE //
-#endif // RTMP_MAC_PCI //
-#ifdef PCIE_PS_SUPPORT
-#ifdef CONFIG_STA_SUPPORT
-	// 3090F power solution 3 has hw limitation that needs to ban all mcu command
-	// when firmware is in radio state.  For other chip doesn't have this limitation.
-	if (((IS_RT3090(pAd) || IS_RT3572(pAd) || IS_RT3390(pAd)) && IS_VERSION_AFTER_F(pAd)) && IS_VERSION_AFTER_F(pAd)
-		&& (pAd->StaCfg.PSControl.field.rt30xxPowerMode == 3)
-		&& (pAd->StaCfg.PSControl.field.EnableNewPS == TRUE))
-	{
-		RTMP_SEM_LOCK(&pAd->McuCmdLock);
-		if ((pAd->brt30xxBanMcuCmd == TRUE)
-			&& (Command != WAKE_MCU_CMD) && (Command != RFOFF_MCU_CMD))
-		{
-			RTMP_SEM_UNLOCK(&pAd->McuCmdLock);
-			DBGPRINT(RT_DEBUG_TRACE, (" Ban Mcu Cmd %x in sleep mode\n",  Command));
-			return FALSE;
-		}
-		else if ((Command == SLEEP_MCU_CMD)
-			||(Command == RFOFF_MCU_CMD))
-		{
-			pAd->brt30xxBanMcuCmd = TRUE;
-		}
-		else if (Command != WAKE_MCU_CMD)
-		{
-			pAd->brt30xxBanMcuCmd = FALSE;
-		}
-
-		RTMP_SEM_UNLOCK(&pAd->McuCmdLock);
-
-	}
-	if (((IS_RT3090(pAd) || IS_RT3572(pAd) || IS_RT3390(pAd)) && IS_VERSION_AFTER_F(pAd)) && IS_VERSION_AFTER_F(pAd)
-		&& (pAd->StaCfg.PSControl.field.rt30xxPowerMode == 3)
-		&& (pAd->StaCfg.PSControl.field.EnableNewPS == TRUE)
-		&& (Command == WAKE_MCU_CMD))
-	{
-
-		do
-		{
-			RTMP_IO_FORCE_READ32(pAd, H2M_MAILBOX_CSR, &H2MMailbox.word);
-			if (H2MMailbox.field.Owner == 0)
-				break;
-
-			RTMPusecDelay(2);
-			DBGPRINT(RT_DEBUG_INFO, ("AsicSendCommanToMcu::Mail box is busy\n"));
-		} while(i++ < 100);
-
-		if (i >= 100)
-		{
-			DBGPRINT_ERR(("H2M_MAILBOX still hold by MCU. command fail\n"));
-			return FALSE;
-		}
-
-		H2MMailbox.field.Owner	  = 1;	   // pass ownership to MCU
-		H2MMailbox.field.CmdToken = Token;
-		H2MMailbox.field.HighByte = Arg1;
-		H2MMailbox.field.LowByte  = Arg0;
-		RTMP_IO_FORCE_WRITE32(pAd, H2M_MAILBOX_CSR, H2MMailbox.word);
-
-		H2MCmd.word			  = 0;
-		H2MCmd.field.HostCommand  = Command;
-		RTMP_IO_FORCE_WRITE32(pAd, HOST_CMD_CSR, H2MCmd.word);
-
-
-	}
-	else
-#endif // CONFIG_STA_SUPPORT //
-#endif // PCIE_PS_SUPPORT //
-	{
-	do
-	{
-		RTMP_IO_READ32(pAd, H2M_MAILBOX_CSR, &H2MMailbox.word);
-		if (H2MMailbox.field.Owner == 0)
-			break;
-
-		RTMPusecDelay(2);
-	} while(i++ < 100);
-
-	if (i >= 100)
-	{
-#ifdef RTMP_MAC_PCI
-#ifdef RALINK_ATE
-		if (pAd->ate.bFWLoading == TRUE)
-		{
-			/* reloading firmware when received iwpriv cmd "ATE=ATESTOP" */
-			if (j > 0)
-			{
-				if (j % 64 != 0)
-				{
-					ATEDBGPRINT(RT_DEBUG_ERROR, ("#"));
-				}
-				else
-				{
-					ATEDBGPRINT(RT_DEBUG_ERROR, ("\n"));
-				}
-				++j;
-			}
-			else if (j == 0)
-			{
-				ATEDBGPRINT(RT_DEBUG_ERROR, ("Loading firmware. Please wait for a moment...\n"));
-				++j;
-			}
-		}
-		else
-#endif // RALINK_ATE //
-#endif // RTMP_MAC_PCI //
-		{
-		DBGPRINT_ERR(("H2M_MAILBOX still hold by MCU. command fail\n"));
-		}
-		return FALSE;
-	}
-
-#ifdef RTMP_MAC_PCI
-#ifdef RALINK_ATE
-	else if (pAd->ate.bFWLoading == TRUE)
-	{
-		/* reloading of firmware is completed */
-		pAd->ate.bFWLoading = FALSE;
-		ATEDBGPRINT(RT_DEBUG_ERROR, ("\n"));
-		j = 0;
-	}
-#endif // RALINK_ATE //
-#endif // RTMP_MAC_PCI //
-
-	H2MMailbox.field.Owner	  = 1;	   // pass ownership to MCU
-	H2MMailbox.field.CmdToken = Token;
-	H2MMailbox.field.HighByte = Arg1;
-	H2MMailbox.field.LowByte  = Arg0;
-	RTMP_IO_WRITE32(pAd, H2M_MAILBOX_CSR, H2MMailbox.word);
-
-	H2MCmd.word			  = 0;
-	H2MCmd.field.HostCommand  = Command;
-	RTMP_IO_WRITE32(pAd, HOST_CMD_CSR, H2MCmd.word);
-
-	if (Command != 0x80)
-	{
-	}
-}
-#ifdef PCIE_PS_SUPPORT
-#ifdef CONFIG_STA_SUPPORT
-	// 3090 MCU Wakeup command needs more time to be stable.
-	// Before stable, don't issue other MCU command to prevent from firmware error.
-	if (((IS_RT3090(pAd) || IS_RT3572(pAd) || IS_RT3390(pAd)) && IS_VERSION_AFTER_F(pAd)) && IS_VERSION_AFTER_F(pAd)
-		&& (pAd->StaCfg.PSControl.field.rt30xxPowerMode == 3)
-		&& (pAd->StaCfg.PSControl.field.EnableNewPS == TRUE)
-		&& (Command == WAKE_MCU_CMD))
-	{
-		RTMPusecDelay(2000);
-		//Put this is after RF programming.
-		//NdisAcquireSpinLock(&pAd->McuCmdLock);
-		//pAd->brt30xxBanMcuCmd = FALSE;
-		//NdisReleaseSpinLock(&pAd->McuCmdLock);
-	}
-#endif // CONFIG_STA_SUPPORT //
-#endif // PCIE_PS_SUPPORT //
-
-	return TRUE;
-}
diff --git a/drivers/staging/rt3090/common/spectrum.c b/drivers/staging/rt3090/common/spectrum.c
deleted file mode 100644
index 12d2125148ba..000000000000
--- a/drivers/staging/rt3090/common/spectrum.c
+++ /dev/null
@@ -1,2221 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-    Module Name:
-	action.c
-
-    Abstract:
-    Handle association related requests either from WSTA or from local MLME
-
-    Revision History:
-    Who          When          What
-    ---------    ----------    ----------------------------------------------
-	Fonchi Wu    2008		   created for 802.11h
- */
-
-#include "../rt_config.h"
-#include "../action.h"
-
-
-/* The regulatory information in the USA (US) */
-DOT11_REGULATORY_INFORMATION USARegulatoryInfo[] =
-{
-/*  "regulatory class"  "number of channels"  "Max Tx Pwr"  "channel list" */
-    {0,	                {0,                   0,           {0}}}, // Invlid entry
-    {1,                 {4,                   16,           {36, 40, 44, 48}}},
-    {2,                 {4,                   23,           {52, 56, 60, 64}}},
-    {3,                 {4,                   29,           {149, 153, 157, 161}}},
-    {4,                 {11,                  23,           {100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140}}},
-    {5,                 {5,                   30,           {149, 153, 157, 161, 165}}},
-    {6,                 {10,                  14,           {1, 2, 3, 4, 5, 6, 7, 8, 9, 10}}},
-    {7,                 {10,                  27,           {1, 2, 3, 4, 5, 6, 7, 8, 9, 10}}},
-    {8,                 {5,                   17,           {11, 13, 15, 17, 19}}},
-    {9,                 {5,                   30,           {11, 13, 15, 17, 19}}},
-    {10,                {2,                   20,           {21, 25}}},
-    {11,                {2,                   33,            {21, 25}}},
-    {12,                {11,                  30,            {1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11}}}
-};
-#define USA_REGULATORY_INFO_SIZE (sizeof(USARegulatoryInfo) / sizeof(DOT11_REGULATORY_INFORMATION))
-
-
-/* The regulatory information in Europe */
-DOT11_REGULATORY_INFORMATION EuropeRegulatoryInfo[] =
-{
-/*  "regulatory class"  "number of channels"  "Max Tx Pwr"  "channel list" */
-    {0,                 {0,                   0,           {0}}}, // Invalid entry
-    {1,                 {4,                   20,           {36, 40, 44, 48}}},
-    {2,                 {4,                   20,           {52, 56, 60, 64}}},
-    {3,                 {11,                  30,           {100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140}}},
-    {4,                 {13,                  20,           {1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13}}}
-};
-#define EU_REGULATORY_INFO_SIZE (sizeof(EuropeRegulatoryInfo) / sizeof(DOT11_REGULATORY_INFORMATION))
-
-
-/* The regulatory information in Japan */
-DOT11_REGULATORY_INFORMATION JapanRegulatoryInfo[] =
-{
-/*  "regulatory class"  "number of channels"  "Max Tx Pwr"  "channel list" */
-    {0,                 {0,                   0,           {0}}}, // Invalid entry
-    {1,                 {4,                   22,           {34, 38, 42, 46}}},
-    {2,                 {3,                   24,           {8, 12, 16}}},
-    {3,                 {3,                   24,           {8, 12, 16}}},
-    {4,                 {3,                   24,           {8, 12, 16}}},
-    {5,                 {3,                   24,           {8, 12, 16}}},
-    {6,                 {3,                   22,           {8, 12, 16}}},
-    {7,                 {4,                   24,           {184, 188, 192, 196}}},
-    {8,                 {4,                   24,           {184, 188, 192, 196}}},
-    {9,                 {4,                   24,           {184, 188, 192, 196}}},
-    {10,                {4,                   24,           {184, 188, 192, 196}}},
-    {11,                {4,                   22,           {184, 188, 192, 196}}},
-    {12,                {4,                   24,           {7, 8, 9, 11}}},
-    {13,                {4,                   24,           {7, 8, 9, 11}}},
-    {14,                {4,                   24,           {7, 8, 9, 11}}},
-    {15,                {4,                   24,           {7, 8, 9, 11}}},
-    {16,                {6,                   24,           {183, 184, 185, 187, 188, 189}}},
-    {17,                {6,                   24,           {183, 184, 185, 187, 188, 189}}},
-    {18,                {6,                   24,           {183, 184, 185, 187, 188, 189}}},
-    {19,                {6,                   24,           {183, 184, 185, 187, 188, 189}}},
-    {20,                {6,                   17,           {183, 184, 185, 187, 188, 189}}},
-    {21,                {6,                   24,           {6, 7, 8, 9, 10, 11}}},
-    {22,                {6,                   24,           {6, 7, 8, 9, 10, 11}}},
-    {23,                {6,                   24,           {6, 7, 8, 9, 10, 11}}},
-    {24,                {6,                   24,           {6, 7, 8, 9, 10, 11}}},
-    {25,                {8,                   24,           {182, 183, 184, 185, 186, 187, 188, 189}}},
-    {26,                {8,                   24,           {182, 183, 184, 185, 186, 187, 188, 189}}},
-    {27,                {8,                   24,           {182, 183, 184, 185, 186, 187, 188, 189}}},
-    {28,                {8,                   24,           {182, 183, 184, 185, 186, 187, 188, 189}}},
-    {29,                {8,                   17,           {182, 183, 184, 185, 186, 187, 188, 189}}},
-    {30,                {13,                  23,           {1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13}}},
-    {31,                {1,                   23,           {14}}},
-    {32,                {4,                   22,           {52, 56, 60, 64}}}
-};
-#define JP_REGULATORY_INFO_SIZE (sizeof(JapanRegulatoryInfo) / sizeof(DOT11_REGULATORY_INFORMATION))
-
-
-CHAR RTMP_GetTxPwr(
-	IN PRTMP_ADAPTER pAd,
-	IN HTTRANSMIT_SETTING HTTxMode)
-{
-typedef struct __TX_PWR_CFG
-{
-	UINT8 Mode;
-	UINT8 MCS;
-	UINT16 req;
-	UINT8 shift;
-	UINT32 BitMask;
-} TX_PWR_CFG;
-
-	UINT32 Value;
-	INT Idx;
-	UINT8 PhyMode;
-	CHAR CurTxPwr;
-	UINT8 TxPwrRef = 0;
-	CHAR DaltaPwr;
-	ULONG TxPwr[5];
-
-
-	TX_PWR_CFG TxPwrCfg[] = {
-		{MODE_CCK, 0, 0, 4, 0x000000f0},
-		{MODE_CCK, 1, 0, 0, 0x0000000f},
-		{MODE_CCK, 2, 0, 12, 0x0000f000},
-		{MODE_CCK, 3, 0, 8, 0x00000f00},
-
-		{MODE_OFDM, 0, 0, 20, 0x00f00000},
-		{MODE_OFDM, 1, 0, 16, 0x000f0000},
-		{MODE_OFDM, 2, 0, 28, 0xf0000000},
-		{MODE_OFDM, 3, 0, 24, 0x0f000000},
-		{MODE_OFDM, 4, 1, 4, 0x000000f0},
-		{MODE_OFDM, 5, 1, 0, 0x0000000f},
-		{MODE_OFDM, 6, 1, 12, 0x0000f000},
-		{MODE_OFDM, 7, 1, 8, 0x00000f00}
-#ifdef DOT11_N_SUPPORT
-		,{MODE_HTMIX, 0, 1, 20, 0x00f00000},
-		{MODE_HTMIX, 1, 1, 16, 0x000f0000},
-		{MODE_HTMIX, 2, 1, 28, 0xf0000000},
-		{MODE_HTMIX, 3, 1, 24, 0x0f000000},
-		{MODE_HTMIX, 4, 2, 4, 0x000000f0},
-		{MODE_HTMIX, 5, 2, 0, 0x0000000f},
-		{MODE_HTMIX, 6, 2, 12, 0x0000f000},
-		{MODE_HTMIX, 7, 2, 8, 0x00000f00},
-		{MODE_HTMIX, 8, 2, 20, 0x00f00000},
-		{MODE_HTMIX, 9, 2, 16, 0x000f0000},
-		{MODE_HTMIX, 10, 2, 28, 0xf0000000},
-		{MODE_HTMIX, 11, 2, 24, 0x0f000000},
-		{MODE_HTMIX, 12, 3, 4, 0x000000f0},
-		{MODE_HTMIX, 13, 3, 0, 0x0000000f},
-		{MODE_HTMIX, 14, 3, 12, 0x0000f000},
-		{MODE_HTMIX, 15, 3, 8, 0x00000f00}
-#endif // DOT11_N_SUPPORT //
-	};
-#define MAX_TXPWR_TAB_SIZE (sizeof(TxPwrCfg) / sizeof(TX_PWR_CFG))
-
-#ifdef SINGLE_SKU
-	CurTxPwr = pAd->CommonCfg.DefineMaxTxPwr;
-#else
-	CurTxPwr = 19;
-#endif
-
-	/* check Tx Power setting from UI. */
-	if (pAd->CommonCfg.TxPowerPercentage > 90)
-		;
-	else if (pAd->CommonCfg.TxPowerPercentage > 60)  /* reduce Pwr for 1 dB. */
-		CurTxPwr -= 1;
-	else if (pAd->CommonCfg.TxPowerPercentage > 30)  /* reduce Pwr for 3 dB. */
-		CurTxPwr -= 3;
-	else if (pAd->CommonCfg.TxPowerPercentage > 15)  /* reduce Pwr for 6 dB. */
-		CurTxPwr -= 6;
-	else if (pAd->CommonCfg.TxPowerPercentage > 9)   /* reduce Pwr for 9 dB. */
-		CurTxPwr -= 9;
-	else                                           /* reduce Pwr for 12 dB. */
-		CurTxPwr -= 12;
-
-	if (pAd->CommonCfg.BBPCurrentBW == BW_40)
-	{
-		if (pAd->CommonCfg.CentralChannel > 14)
-		{
-			TxPwr[0] = pAd->Tx40MPwrCfgABand[0];
-			TxPwr[1] = pAd->Tx40MPwrCfgABand[1];
-			TxPwr[2] = pAd->Tx40MPwrCfgABand[2];
-			TxPwr[3] = pAd->Tx40MPwrCfgABand[3];
-			TxPwr[4] = pAd->Tx40MPwrCfgABand[4];
-		}
-		else
-		{
-			TxPwr[0] = pAd->Tx40MPwrCfgGBand[0];
-			TxPwr[1] = pAd->Tx40MPwrCfgGBand[1];
-			TxPwr[2] = pAd->Tx40MPwrCfgGBand[2];
-			TxPwr[3] = pAd->Tx40MPwrCfgGBand[3];
-			TxPwr[4] = pAd->Tx40MPwrCfgGBand[4];
-		}
-	}
-	else
-	{
-		if (pAd->CommonCfg.Channel > 14)
-		{
-			TxPwr[0] = pAd->Tx20MPwrCfgABand[0];
-			TxPwr[1] = pAd->Tx20MPwrCfgABand[1];
-			TxPwr[2] = pAd->Tx20MPwrCfgABand[2];
-			TxPwr[3] = pAd->Tx20MPwrCfgABand[3];
-			TxPwr[4] = pAd->Tx20MPwrCfgABand[4];
-		}
-		else
-		{
-			TxPwr[0] = pAd->Tx20MPwrCfgGBand[0];
-			TxPwr[1] = pAd->Tx20MPwrCfgGBand[1];
-			TxPwr[2] = pAd->Tx20MPwrCfgGBand[2];
-			TxPwr[3] = pAd->Tx20MPwrCfgGBand[3];
-			TxPwr[4] = pAd->Tx20MPwrCfgGBand[4];
-		}
-	}
-
-
-	switch(HTTxMode.field.MODE)
-	{
-		case MODE_CCK:
-		case MODE_OFDM:
-			Value = TxPwr[1];
-			TxPwrRef = (Value & 0x00000f00) >> 8;
-
-			break;
-
-#ifdef DOT11_N_SUPPORT
-		case MODE_HTMIX:
-		case MODE_HTGREENFIELD:
-			if (pAd->CommonCfg.TxStream == 1)
-			{
-				Value = TxPwr[2];
-				TxPwrRef = (Value & 0x00000f00) >> 8;
-			}
-			else if (pAd->CommonCfg.TxStream == 2)
-			{
-				Value = TxPwr[3];
-				TxPwrRef = (Value & 0x00000f00) >> 8;
-			}
-			break;
-#endif // DOT11_N_SUPPORT //
-	}
-
-	PhyMode =
-#ifdef DOT11_N_SUPPORT
-				(HTTxMode.field.MODE == MODE_HTGREENFIELD)
-				? MODE_HTMIX :
-#endif // DOT11_N_SUPPORT //
-				HTTxMode.field.MODE;
-
-	for (Idx = 0; Idx < MAX_TXPWR_TAB_SIZE; Idx++)
-	{
-		if ((TxPwrCfg[Idx].Mode == PhyMode)
-			&& (TxPwrCfg[Idx].MCS == HTTxMode.field.MCS))
-		{
-			Value = TxPwr[TxPwrCfg[Idx].req];
-			DaltaPwr = TxPwrRef - (CHAR)((Value & TxPwrCfg[Idx].BitMask)
-											>> TxPwrCfg[Idx].shift);
-			CurTxPwr -= DaltaPwr;
-			break;
-		}
-	}
-
-	return CurTxPwr;
-}
-
-
-VOID MeasureReqTabInit(
-	IN PRTMP_ADAPTER pAd)
-{
-	NdisAllocateSpinLock(&pAd->CommonCfg.MeasureReqTabLock);
-
-	pAd->CommonCfg.pMeasureReqTab = kmalloc(sizeof(MEASURE_REQ_TAB), GFP_ATOMIC);
-	if (pAd->CommonCfg.pMeasureReqTab)
-		NdisZeroMemory(pAd->CommonCfg.pMeasureReqTab, sizeof(MEASURE_REQ_TAB));
-	else
-		DBGPRINT(RT_DEBUG_ERROR, ("%s Fail to alloc memory for pAd->CommonCfg.pMeasureReqTab.\n", __FUNCTION__));
-
-	return;
-}
-
-VOID MeasureReqTabExit(
-	IN PRTMP_ADAPTER pAd)
-{
-	NdisFreeSpinLock(&pAd->CommonCfg.MeasureReqTabLock);
-
-	if (pAd->CommonCfg.pMeasureReqTab)
-		kfree(pAd->CommonCfg.pMeasureReqTab);
-	pAd->CommonCfg.pMeasureReqTab = NULL;
-
-	return;
-}
-
-PMEASURE_REQ_ENTRY MeasureReqLookUp(
-	IN PRTMP_ADAPTER	pAd,
-	IN UINT8			DialogToken)
-{
-	UINT HashIdx;
-	PMEASURE_REQ_TAB pTab = pAd->CommonCfg.pMeasureReqTab;
-	PMEASURE_REQ_ENTRY pEntry = NULL;
-	PMEASURE_REQ_ENTRY pPrevEntry = NULL;
-
-	if (pTab == NULL)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("%s: pMeasureReqTab doesn't exist.\n", __FUNCTION__));
-		return NULL;
-	}
-
-	RTMP_SEM_LOCK(&pAd->CommonCfg.MeasureReqTabLock);
-
-	HashIdx = MQ_DIALOGTOKEN_HASH_INDEX(DialogToken);
-	pEntry = pTab->Hash[HashIdx];
-
-	while (pEntry)
-	{
-		if (pEntry->DialogToken == DialogToken)
-			break;
-		else
-		{
-			pPrevEntry = pEntry;
-			pEntry = pEntry->pNext;
-		}
-	}
-
-	RTMP_SEM_UNLOCK(&pAd->CommonCfg.MeasureReqTabLock);
-
-	return pEntry;
-}
-
-PMEASURE_REQ_ENTRY MeasureReqInsert(
-	IN PRTMP_ADAPTER	pAd,
-	IN UINT8			DialogToken)
-{
-	INT i;
-	ULONG HashIdx;
-	PMEASURE_REQ_TAB pTab = pAd->CommonCfg.pMeasureReqTab;
-	PMEASURE_REQ_ENTRY pEntry = NULL, pCurrEntry;
-	ULONG Now;
-
-	if(pTab == NULL)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("%s: pMeasureReqTab doesn't exist.\n", __FUNCTION__));
-		return NULL;
-	}
-
-	pEntry = MeasureReqLookUp(pAd, DialogToken);
-	if (pEntry == NULL)
-	{
-		RTMP_SEM_LOCK(&pAd->CommonCfg.MeasureReqTabLock);
-		for (i = 0; i < MAX_MEASURE_REQ_TAB_SIZE; i++)
-		{
-			NdisGetSystemUpTime(&Now);
-			pEntry = &pTab->Content[i];
-
-			if ((pEntry->Valid == TRUE)
-				&& RTMP_TIME_AFTER((unsigned long)Now, (unsigned long)(pEntry->lastTime + MQ_REQ_AGE_OUT)))
-			{
-				PMEASURE_REQ_ENTRY pPrevEntry = NULL;
-				ULONG HashIdx = MQ_DIALOGTOKEN_HASH_INDEX(pEntry->DialogToken);
-				PMEASURE_REQ_ENTRY pProbeEntry = pTab->Hash[HashIdx];
-
-				// update Hash list
-				do
-				{
-					if (pProbeEntry == pEntry)
-					{
-						if (pPrevEntry == NULL)
-						{
-							pTab->Hash[HashIdx] = pEntry->pNext;
-						}
-						else
-						{
-							pPrevEntry->pNext = pEntry->pNext;
-						}
-						break;
-					}
-
-					pPrevEntry = pProbeEntry;
-					pProbeEntry = pProbeEntry->pNext;
-				} while (pProbeEntry);
-
-				NdisZeroMemory(pEntry, sizeof(MEASURE_REQ_ENTRY));
-				pTab->Size--;
-
-				break;
-			}
-
-			if (pEntry->Valid == FALSE)
-				break;
-		}
-
-		if (i < MAX_MEASURE_REQ_TAB_SIZE)
-		{
-			NdisGetSystemUpTime(&Now);
-			pEntry->lastTime = Now;
-			pEntry->Valid = TRUE;
-			pEntry->DialogToken = DialogToken;
-			pTab->Size++;
-		}
-		else
-		{
-			pEntry = NULL;
-			DBGPRINT(RT_DEBUG_ERROR, ("%s: pMeasureReqTab tab full.\n", __FUNCTION__));
-		}
-
-		// add this Neighbor entry into HASH table
-		if (pEntry)
-		{
-			HashIdx = MQ_DIALOGTOKEN_HASH_INDEX(DialogToken);
-			if (pTab->Hash[HashIdx] == NULL)
-			{
-				pTab->Hash[HashIdx] = pEntry;
-			}
-			else
-			{
-				pCurrEntry = pTab->Hash[HashIdx];
-				while (pCurrEntry->pNext != NULL)
-					pCurrEntry = pCurrEntry->pNext;
-				pCurrEntry->pNext = pEntry;
-			}
-		}
-
-		RTMP_SEM_UNLOCK(&pAd->CommonCfg.MeasureReqTabLock);
-	}
-
-	return pEntry;
-}
-
-VOID MeasureReqDelete(
-	IN PRTMP_ADAPTER	pAd,
-	IN UINT8			DialogToken)
-{
-	PMEASURE_REQ_TAB pTab = pAd->CommonCfg.pMeasureReqTab;
-	PMEASURE_REQ_ENTRY pEntry = NULL;
-
-	if(pTab == NULL)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("%s: pMeasureReqTab doesn't exist.\n", __FUNCTION__));
-		return;
-	}
-
-	// if empty, return
-	if (pTab->Size == 0)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("pMeasureReqTab empty.\n"));
-		return;
-	}
-
-	pEntry = MeasureReqLookUp(pAd, DialogToken);
-	if (pEntry != NULL)
-	{
-		PMEASURE_REQ_ENTRY pPrevEntry = NULL;
-		ULONG HashIdx = MQ_DIALOGTOKEN_HASH_INDEX(pEntry->DialogToken);
-		PMEASURE_REQ_ENTRY pProbeEntry = pTab->Hash[HashIdx];
-
-		RTMP_SEM_LOCK(&pAd->CommonCfg.MeasureReqTabLock);
-		// update Hash list
-		do
-		{
-			if (pProbeEntry == pEntry)
-			{
-				if (pPrevEntry == NULL)
-				{
-					pTab->Hash[HashIdx] = pEntry->pNext;
-				}
-				else
-				{
-					pPrevEntry->pNext = pEntry->pNext;
-				}
-				break;
-			}
-
-			pPrevEntry = pProbeEntry;
-			pProbeEntry = pProbeEntry->pNext;
-		} while (pProbeEntry);
-
-		NdisZeroMemory(pEntry, sizeof(MEASURE_REQ_ENTRY));
-		pTab->Size--;
-
-		RTMP_SEM_UNLOCK(&pAd->CommonCfg.MeasureReqTabLock);
-	}
-
-	return;
-}
-
-VOID TpcReqTabInit(
-	IN PRTMP_ADAPTER pAd)
-{
-	NdisAllocateSpinLock(&pAd->CommonCfg.TpcReqTabLock);
-
-	pAd->CommonCfg.pTpcReqTab = kmalloc(sizeof(TPC_REQ_TAB), GFP_ATOMIC);
-	if (pAd->CommonCfg.pTpcReqTab)
-		NdisZeroMemory(pAd->CommonCfg.pTpcReqTab, sizeof(TPC_REQ_TAB));
-	else
-		DBGPRINT(RT_DEBUG_ERROR, ("%s Fail to alloc memory for pAd->CommonCfg.pTpcReqTab.\n", __FUNCTION__));
-
-	return;
-}
-
-VOID TpcReqTabExit(
-	IN PRTMP_ADAPTER pAd)
-{
-	NdisFreeSpinLock(&pAd->CommonCfg.TpcReqTabLock);
-
-	if (pAd->CommonCfg.pTpcReqTab)
-		kfree(pAd->CommonCfg.pTpcReqTab);
-	pAd->CommonCfg.pTpcReqTab = NULL;
-
-	return;
-}
-
-static PTPC_REQ_ENTRY TpcReqLookUp(
-	IN PRTMP_ADAPTER	pAd,
-	IN UINT8			DialogToken)
-{
-	UINT HashIdx;
-	PTPC_REQ_TAB pTab = pAd->CommonCfg.pTpcReqTab;
-	PTPC_REQ_ENTRY pEntry = NULL;
-	PTPC_REQ_ENTRY pPrevEntry = NULL;
-
-	if (pTab == NULL)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("%s: pTpcReqTab doesn't exist.\n", __FUNCTION__));
-		return NULL;
-	}
-
-	RTMP_SEM_LOCK(&pAd->CommonCfg.TpcReqTabLock);
-
-	HashIdx = TPC_DIALOGTOKEN_HASH_INDEX(DialogToken);
-	pEntry = pTab->Hash[HashIdx];
-
-	while (pEntry)
-	{
-		if (pEntry->DialogToken == DialogToken)
-			break;
-		else
-		{
-			pPrevEntry = pEntry;
-			pEntry = pEntry->pNext;
-		}
-	}
-
-	RTMP_SEM_UNLOCK(&pAd->CommonCfg.TpcReqTabLock);
-
-	return pEntry;
-}
-
-
-static PTPC_REQ_ENTRY TpcReqInsert(
-	IN PRTMP_ADAPTER	pAd,
-	IN UINT8			DialogToken)
-{
-	INT i;
-	ULONG HashIdx;
-	PTPC_REQ_TAB pTab = pAd->CommonCfg.pTpcReqTab;
-	PTPC_REQ_ENTRY pEntry = NULL, pCurrEntry;
-	ULONG Now;
-
-	if(pTab == NULL)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("%s: pTpcReqTab doesn't exist.\n", __FUNCTION__));
-		return NULL;
-	}
-
-	pEntry = TpcReqLookUp(pAd, DialogToken);
-	if (pEntry == NULL)
-	{
-		RTMP_SEM_LOCK(&pAd->CommonCfg.TpcReqTabLock);
-		for (i = 0; i < MAX_TPC_REQ_TAB_SIZE; i++)
-		{
-			NdisGetSystemUpTime(&Now);
-			pEntry = &pTab->Content[i];
-
-			if ((pEntry->Valid == TRUE)
-				&& RTMP_TIME_AFTER((unsigned long)Now, (unsigned long)(pEntry->lastTime + TPC_REQ_AGE_OUT)))
-			{
-				PTPC_REQ_ENTRY pPrevEntry = NULL;
-				ULONG HashIdx = TPC_DIALOGTOKEN_HASH_INDEX(pEntry->DialogToken);
-				PTPC_REQ_ENTRY pProbeEntry = pTab->Hash[HashIdx];
-
-				// update Hash list
-				do
-				{
-					if (pProbeEntry == pEntry)
-					{
-						if (pPrevEntry == NULL)
-						{
-							pTab->Hash[HashIdx] = pEntry->pNext;
-						}
-						else
-						{
-							pPrevEntry->pNext = pEntry->pNext;
-						}
-						break;
-					}
-
-					pPrevEntry = pProbeEntry;
-					pProbeEntry = pProbeEntry->pNext;
-				} while (pProbeEntry);
-
-				NdisZeroMemory(pEntry, sizeof(TPC_REQ_ENTRY));
-				pTab->Size--;
-
-				break;
-			}
-
-			if (pEntry->Valid == FALSE)
-				break;
-		}
-
-		if (i < MAX_TPC_REQ_TAB_SIZE)
-		{
-			NdisGetSystemUpTime(&Now);
-			pEntry->lastTime = Now;
-			pEntry->Valid = TRUE;
-			pEntry->DialogToken = DialogToken;
-			pTab->Size++;
-		}
-		else
-		{
-			pEntry = NULL;
-			DBGPRINT(RT_DEBUG_ERROR, ("%s: pTpcReqTab tab full.\n", __FUNCTION__));
-		}
-
-		// add this Neighbor entry into HASH table
-		if (pEntry)
-		{
-			HashIdx = TPC_DIALOGTOKEN_HASH_INDEX(DialogToken);
-			if (pTab->Hash[HashIdx] == NULL)
-			{
-				pTab->Hash[HashIdx] = pEntry;
-			}
-			else
-			{
-				pCurrEntry = pTab->Hash[HashIdx];
-				while (pCurrEntry->pNext != NULL)
-					pCurrEntry = pCurrEntry->pNext;
-				pCurrEntry->pNext = pEntry;
-			}
-		}
-
-		RTMP_SEM_UNLOCK(&pAd->CommonCfg.TpcReqTabLock);
-	}
-
-	return pEntry;
-}
-
-static VOID TpcReqDelete(
-	IN PRTMP_ADAPTER	pAd,
-	IN UINT8			DialogToken)
-{
-	PTPC_REQ_TAB pTab = pAd->CommonCfg.pTpcReqTab;
-	PTPC_REQ_ENTRY pEntry = NULL;
-
-	if(pTab == NULL)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("%s: pTpcReqTab doesn't exist.\n", __FUNCTION__));
-		return;
-	}
-
-	// if empty, return
-	if (pTab->Size == 0)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("pTpcReqTab empty.\n"));
-		return;
-	}
-
-	pEntry = TpcReqLookUp(pAd, DialogToken);
-	if (pEntry != NULL)
-	{
-		PTPC_REQ_ENTRY pPrevEntry = NULL;
-		ULONG HashIdx = TPC_DIALOGTOKEN_HASH_INDEX(pEntry->DialogToken);
-		PTPC_REQ_ENTRY pProbeEntry = pTab->Hash[HashIdx];
-
-		RTMP_SEM_LOCK(&pAd->CommonCfg.TpcReqTabLock);
-		// update Hash list
-		do
-		{
-			if (pProbeEntry == pEntry)
-			{
-				if (pPrevEntry == NULL)
-				{
-					pTab->Hash[HashIdx] = pEntry->pNext;
-				}
-				else
-				{
-					pPrevEntry->pNext = pEntry->pNext;
-				}
-				break;
-			}
-
-			pPrevEntry = pProbeEntry;
-			pProbeEntry = pProbeEntry->pNext;
-		} while (pProbeEntry);
-
-		NdisZeroMemory(pEntry, sizeof(TPC_REQ_ENTRY));
-		pTab->Size--;
-
-		RTMP_SEM_UNLOCK(&pAd->CommonCfg.TpcReqTabLock);
-	}
-
-	return;
-}
-
-/*
-	==========================================================================
-	Description:
-		Get Current TimeS tamp.
-
-	Parametrs:
-
-	Return	: Current Time Stamp.
-	==========================================================================
- */
-static UINT64 GetCurrentTimeStamp(
-	IN PRTMP_ADAPTER pAd)
-{
-	// get current time stamp.
-	return 0;
-}
-
-/*
-	==========================================================================
-	Description:
-		Get Current Transmit Power.
-
-	Parametrs:
-
-	Return	: Current Time Stamp.
-	==========================================================================
- */
-static UINT8 GetCurTxPwr(
-	IN PRTMP_ADAPTER pAd,
-	IN UINT8 Wcid)
-{
-	return 16; /* 16 dBm */
-}
-
-/*
-	==========================================================================
-	Description:
-		Get Current Transmit Power.
-
-	Parametrs:
-
-	Return	: Current Time Stamp.
-	==========================================================================
- */
-VOID InsertChannelRepIE(
-	IN PRTMP_ADAPTER pAd,
-	OUT PUCHAR pFrameBuf,
-	OUT PULONG pFrameLen,
-	IN PSTRING pCountry,
-	IN UINT8 RegulatoryClass)
-{
-	ULONG TempLen;
-	UINT8 Len;
-	UINT8 IEId = IE_AP_CHANNEL_REPORT;
-	PUCHAR pChListPtr = NULL;
-
-	Len = 1;
-	if (strncmp(pCountry, "US", 2) == 0)
-	{
-		if (RegulatoryClass >= USA_REGULATORY_INFO_SIZE)
-		{
-			DBGPRINT(RT_DEBUG_ERROR, ("%s: USA Unknow Requlatory class (%d)\n",
-						__FUNCTION__, RegulatoryClass));
-			return;
-		}
-
-		Len += USARegulatoryInfo[RegulatoryClass].ChannelSet.NumberOfChannels;
-		pChListPtr = USARegulatoryInfo[RegulatoryClass].ChannelSet.ChannelList;
-	}
-	else if (strncmp(pCountry, "JP", 2) == 0)
-	{
-		if (RegulatoryClass >= JP_REGULATORY_INFO_SIZE)
-		{
-			DBGPRINT(RT_DEBUG_ERROR, ("%s: JP Unknow Requlatory class (%d)\n",
-						__FUNCTION__, RegulatoryClass));
-			return;
-		}
-
-		Len += JapanRegulatoryInfo[RegulatoryClass].ChannelSet.NumberOfChannels;
-		pChListPtr = JapanRegulatoryInfo[RegulatoryClass].ChannelSet.ChannelList;
-	}
-	else
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("%s: Unknow Country (%s)\n",
-					__FUNCTION__, pCountry));
-		return;
-	}
-
-	MakeOutgoingFrame(pFrameBuf,	&TempLen,
-					1,				&IEId,
-					1,				&Len,
-					1,				&RegulatoryClass,
-					Len -1,			pChListPtr,
-					END_OF_ARGS);
-
-	*pFrameLen = *pFrameLen + TempLen;
-
-	return;
-}
-
-/*
-	==========================================================================
-	Description:
-		Insert Dialog Token into frame.
-
-	Parametrs:
-		1. frame buffer pointer.
-		2. frame length.
-		3. Dialog token.
-
-	Return	: None.
-	==========================================================================
- */
-VOID InsertDialogToken(
-	IN PRTMP_ADAPTER pAd,
-	OUT PUCHAR pFrameBuf,
-	OUT PULONG pFrameLen,
-	IN UINT8 DialogToken)
-{
-	ULONG TempLen;
-	MakeOutgoingFrame(pFrameBuf,	&TempLen,
-					1,				&DialogToken,
-					END_OF_ARGS);
-
-	*pFrameLen = *pFrameLen + TempLen;
-
-	return;
-}
-
-/*
-	==========================================================================
-	Description:
-		Insert TPC Request IE into frame.
-
-	Parametrs:
-		1. frame buffer pointer.
-		2. frame length.
-
-	Return	: None.
-	==========================================================================
- */
- static VOID InsertTpcReqIE(
-	IN PRTMP_ADAPTER pAd,
-	OUT PUCHAR pFrameBuf,
-	OUT PULONG pFrameLen)
-{
-	ULONG TempLen;
-	ULONG Len = 0;
-	UINT8 ElementID = IE_TPC_REQUEST;
-
-	MakeOutgoingFrame(pFrameBuf,					&TempLen,
-						1,							&ElementID,
-						1,							&Len,
-						END_OF_ARGS);
-
-	*pFrameLen = *pFrameLen + TempLen;
-
-	return;
-}
-
-/*
-	==========================================================================
-	Description:
-		Insert TPC Report IE into frame.
-
-	Parametrs:
-		1. frame buffer pointer.
-		2. frame length.
-		3. Transmit Power.
-		4. Link Margin.
-
-	Return	: None.
-	==========================================================================
- */
-VOID InsertTpcReportIE(
-	IN PRTMP_ADAPTER pAd,
-	OUT PUCHAR pFrameBuf,
-	OUT PULONG pFrameLen,
-	IN UINT8 TxPwr,
-	IN UINT8 LinkMargin)
-{
-	ULONG TempLen;
-	ULONG Len = sizeof(TPC_REPORT_INFO);
-	UINT8 ElementID = IE_TPC_REPORT;
-	TPC_REPORT_INFO TpcReportIE;
-
-	TpcReportIE.TxPwr = TxPwr;
-	TpcReportIE.LinkMargin = LinkMargin;
-
-	MakeOutgoingFrame(pFrameBuf,					&TempLen,
-						1,							&ElementID,
-						1,							&Len,
-						Len,						&TpcReportIE,
-						END_OF_ARGS);
-
-	*pFrameLen = *pFrameLen + TempLen;
-
-
-	return;
-}
-
-/*
-	==========================================================================
-	Description:
-		Insert Channel Switch Announcement IE into frame.
-
-	Parametrs:
-		1. frame buffer pointer.
-		2. frame length.
-		3. channel switch announcement mode.
-		4. new selected channel.
-		5. channel switch announcement count.
-
-	Return	: None.
-	==========================================================================
- */
-static VOID InsertChSwAnnIE(
-	IN PRTMP_ADAPTER pAd,
-	OUT PUCHAR pFrameBuf,
-	OUT PULONG pFrameLen,
-	IN UINT8 ChSwMode,
-	IN UINT8 NewChannel,
-	IN UINT8 ChSwCnt)
-{
-	ULONG TempLen;
-	ULONG Len = sizeof(CH_SW_ANN_INFO);
-	UINT8 ElementID = IE_CHANNEL_SWITCH_ANNOUNCEMENT;
-	CH_SW_ANN_INFO ChSwAnnIE;
-
-	ChSwAnnIE.ChSwMode = ChSwMode;
-	ChSwAnnIE.Channel = NewChannel;
-	ChSwAnnIE.ChSwCnt = ChSwCnt;
-
-	MakeOutgoingFrame(pFrameBuf,				&TempLen,
-						1,						&ElementID,
-						1,						&Len,
-						Len,					&ChSwAnnIE,
-						END_OF_ARGS);
-
-	*pFrameLen = *pFrameLen + TempLen;
-
-
-	return;
-}
-
-/*
-	==========================================================================
-	Description:
-		Insert Measure Request IE into frame.
-
-	Parametrs:
-		1. frame buffer pointer.
-		2. frame length.
-		3. Measure Token.
-		4. Measure Request Mode.
-		5. Measure Request Type.
-		6. Measure Channel.
-		7. Measure Start time.
-		8. Measure Duration.
-
-
-	Return	: None.
-	==========================================================================
- */
-static VOID InsertMeasureReqIE(
-	IN PRTMP_ADAPTER pAd,
-	OUT PUCHAR pFrameBuf,
-	OUT PULONG pFrameLen,
-	IN UINT8 Len,
-	IN PMEASURE_REQ_INFO pMeasureReqIE)
-{
-	ULONG TempLen;
-	UINT8 ElementID = IE_MEASUREMENT_REQUEST;
-
-	MakeOutgoingFrame(pFrameBuf,					&TempLen,
-						1,							&ElementID,
-						1,							&Len,
-						sizeof(MEASURE_REQ_INFO),	pMeasureReqIE,
-						END_OF_ARGS);
-
-	*pFrameLen = *pFrameLen + TempLen;
-
-	return;
-}
-
-/*
-	==========================================================================
-	Description:
-		Insert Measure Report IE into frame.
-
-	Parametrs:
-		1. frame buffer pointer.
-		2. frame length.
-		3. Measure Token.
-		4. Measure Request Mode.
-		5. Measure Request Type.
-		6. Length of Report Infomation
-		7. Pointer of Report Infomation Buffer.
-
-	Return	: None.
-	==========================================================================
- */
-static VOID InsertMeasureReportIE(
-	IN PRTMP_ADAPTER pAd,
-	OUT PUCHAR pFrameBuf,
-	OUT PULONG pFrameLen,
-	IN PMEASURE_REPORT_INFO pMeasureReportIE,
-	IN UINT8 ReportLnfoLen,
-	IN PUINT8 pReportInfo)
-{
-	ULONG TempLen;
-	ULONG Len;
-	UINT8 ElementID = IE_MEASUREMENT_REPORT;
-
-	Len = sizeof(MEASURE_REPORT_INFO) + ReportLnfoLen;
-
-	MakeOutgoingFrame(pFrameBuf,					&TempLen,
-						1,							&ElementID,
-						1,							&Len,
-						Len,						pMeasureReportIE,
-						END_OF_ARGS);
-
-	*pFrameLen = *pFrameLen + TempLen;
-
-	if ((ReportLnfoLen > 0) && (pReportInfo != NULL))
-	{
-		MakeOutgoingFrame(pFrameBuf + *pFrameLen,		&TempLen,
-							ReportLnfoLen,				pReportInfo,
-							END_OF_ARGS);
-
-		*pFrameLen = *pFrameLen + TempLen;
-	}
-	return;
-}
-
-/*
-	==========================================================================
-	Description:
-		Prepare Measurement request action frame and enqueue it into
-		management queue waiting for transmition.
-
-	Parametrs:
-		1. the destination mac address of the frame.
-
-	Return	: None.
-	==========================================================================
- */
-VOID MakeMeasurementReqFrame(
-	IN PRTMP_ADAPTER pAd,
-	OUT PUCHAR pOutBuffer,
-	OUT PULONG pFrameLen,
-	IN UINT8 TotalLen,
-	IN UINT8 Category,
-	IN UINT8 Action,
-	IN UINT8 MeasureToken,
-	IN UINT8 MeasureReqMode,
-	IN UINT8 MeasureReqType,
-	IN UINT8 NumOfRepetitions)
-{
-	ULONG TempLen;
-	MEASURE_REQ_INFO MeasureReqIE;
-
-	InsertActField(pAd, (pOutBuffer + *pFrameLen), pFrameLen, Category, Action);
-
-	// fill Dialog Token
-	InsertDialogToken(pAd, (pOutBuffer + *pFrameLen), pFrameLen, MeasureToken);
-
-	/* fill Number of repetitions. */
-	if (Category == CATEGORY_RM)
-	{
-		MakeOutgoingFrame((pOutBuffer+*pFrameLen),	&TempLen,
-						2,							&NumOfRepetitions,
-						END_OF_ARGS);
-
-		*pFrameLen += TempLen;
-	}
-
-	// prepare Measurement IE.
-	NdisZeroMemory(&MeasureReqIE, sizeof(MEASURE_REQ_INFO));
-	MeasureReqIE.Token = MeasureToken;
-	MeasureReqIE.ReqMode.word = MeasureReqMode;
-	MeasureReqIE.ReqType = MeasureReqType;
-	InsertMeasureReqIE(pAd, (pOutBuffer+*pFrameLen), pFrameLen,
-		TotalLen, &MeasureReqIE);
-
-	return;
-}
-
-/*
-	==========================================================================
-	Description:
-		Prepare Measurement report action frame and enqueue it into
-		management queue waiting for transmition.
-
-	Parametrs:
-		1. the destination mac address of the frame.
-
-	Return	: None.
-	==========================================================================
- */
-VOID EnqueueMeasurementRep(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR pDA,
-	IN UINT8 DialogToken,
-	IN UINT8 MeasureToken,
-	IN UINT8 MeasureReqMode,
-	IN UINT8 MeasureReqType,
-	IN UINT8 ReportInfoLen,
-	IN PUINT8 pReportInfo)
-{
-	PUCHAR pOutBuffer = NULL;
-	NDIS_STATUS NStatus;
-	ULONG FrameLen;
-	HEADER_802_11 ActHdr;
-	MEASURE_REPORT_INFO MeasureRepIE;
-
-	// build action frame header.
-	MgtMacHeaderInit(pAd, &ActHdr, SUBTYPE_ACTION, 0, pDA,
-						pAd->CurrentAddress);
-
-	NStatus = MlmeAllocateMemory(pAd, (PVOID)&pOutBuffer);  //Get an unused nonpaged memory
-	if(NStatus != NDIS_STATUS_SUCCESS)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("%s() allocate memory failed \n", __FUNCTION__));
-		return;
-	}
-	NdisMoveMemory(pOutBuffer, (PCHAR)&ActHdr, sizeof(HEADER_802_11));
-	FrameLen = sizeof(HEADER_802_11);
-
-	InsertActField(pAd, (pOutBuffer + FrameLen), &FrameLen, CATEGORY_SPECTRUM, SPEC_MRP);
-
-	// fill Dialog Token
-	InsertDialogToken(pAd, (pOutBuffer + FrameLen), &FrameLen, DialogToken);
-
-	// prepare Measurement IE.
-	NdisZeroMemory(&MeasureRepIE, sizeof(MEASURE_REPORT_INFO));
-	MeasureRepIE.Token = MeasureToken;
-	MeasureRepIE.ReportMode = MeasureReqMode;
-	MeasureRepIE.ReportType = MeasureReqType;
-	InsertMeasureReportIE(pAd, (pOutBuffer + FrameLen), &FrameLen, &MeasureRepIE, ReportInfoLen, pReportInfo);
-
-	MiniportMMRequest(pAd, QID_AC_BE, pOutBuffer, FrameLen);
-	MlmeFreeMemory(pAd, pOutBuffer);
-
-	return;
-}
-
-/*
-	==========================================================================
-	Description:
-		Prepare TPC Request action frame and enqueue it into
-		management queue waiting for transmition.
-
-	Parametrs:
-		1. the destination mac address of the frame.
-
-	Return	: None.
-	==========================================================================
- */
-VOID EnqueueTPCReq(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR pDA,
-	IN UCHAR DialogToken)
-{
-	PUCHAR pOutBuffer = NULL;
-	NDIS_STATUS NStatus;
-	ULONG FrameLen;
-
-	HEADER_802_11 ActHdr;
-
-	// build action frame header.
-	MgtMacHeaderInit(pAd, &ActHdr, SUBTYPE_ACTION, 0, pDA,
-						pAd->CurrentAddress);
-
-	NStatus = MlmeAllocateMemory(pAd, (PVOID)&pOutBuffer);  //Get an unused nonpaged memory
-	if(NStatus != NDIS_STATUS_SUCCESS)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("%s() allocate memory failed \n", __FUNCTION__));
-		return;
-	}
-	NdisMoveMemory(pOutBuffer, (PCHAR)&ActHdr, sizeof(HEADER_802_11));
-	FrameLen = sizeof(HEADER_802_11);
-
-	InsertActField(pAd, (pOutBuffer + FrameLen), &FrameLen, CATEGORY_SPECTRUM, SPEC_TPCRQ);
-
-	// fill Dialog Token
-	InsertDialogToken(pAd, (pOutBuffer + FrameLen), &FrameLen, DialogToken);
-
-	// Insert TPC Request IE.
-	InsertTpcReqIE(pAd, (pOutBuffer + FrameLen), &FrameLen);
-
-	MiniportMMRequest(pAd, QID_AC_BE, pOutBuffer, FrameLen);
-	MlmeFreeMemory(pAd, pOutBuffer);
-
-	return;
-}
-
-/*
-	==========================================================================
-	Description:
-		Prepare TPC Report action frame and enqueue it into
-		management queue waiting for transmition.
-
-	Parametrs:
-		1. the destination mac address of the frame.
-
-	Return	: None.
-	==========================================================================
- */
-VOID EnqueueTPCRep(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR pDA,
-	IN UINT8 DialogToken,
-	IN UINT8 TxPwr,
-	IN UINT8 LinkMargin)
-{
-	PUCHAR pOutBuffer = NULL;
-	NDIS_STATUS NStatus;
-	ULONG FrameLen;
-
-	HEADER_802_11 ActHdr;
-
-	// build action frame header.
-	MgtMacHeaderInit(pAd, &ActHdr, SUBTYPE_ACTION, 0, pDA,
-						pAd->CurrentAddress);
-
-	NStatus = MlmeAllocateMemory(pAd, (PVOID)&pOutBuffer);  //Get an unused nonpaged memory
-	if(NStatus != NDIS_STATUS_SUCCESS)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("%s() allocate memory failed \n", __FUNCTION__));
-		return;
-	}
-	NdisMoveMemory(pOutBuffer, (PCHAR)&ActHdr, sizeof(HEADER_802_11));
-	FrameLen = sizeof(HEADER_802_11);
-
-	InsertActField(pAd, (pOutBuffer + FrameLen), &FrameLen, CATEGORY_SPECTRUM, SPEC_TPCRP);
-
-	// fill Dialog Token
-	InsertDialogToken(pAd, (pOutBuffer + FrameLen), &FrameLen, DialogToken);
-
-	// Insert TPC Request IE.
-	InsertTpcReportIE(pAd, (pOutBuffer + FrameLen), &FrameLen, TxPwr, LinkMargin);
-
-	MiniportMMRequest(pAd, QID_AC_BE, pOutBuffer, FrameLen);
-	MlmeFreeMemory(pAd, pOutBuffer);
-
-	return;
-}
-
-/*
-	==========================================================================
-	Description:
-		Prepare Channel Switch Announcement action frame and enqueue it into
-		management queue waiting for transmition.
-
-	Parametrs:
-		1. the destination mac address of the frame.
-		2. Channel switch announcement mode.
-		2. a New selected channel.
-
-	Return	: None.
-	==========================================================================
- */
-VOID EnqueueChSwAnn(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR pDA,
-	IN UINT8 ChSwMode,
-	IN UINT8 NewCh)
-{
-	PUCHAR pOutBuffer = NULL;
-	NDIS_STATUS NStatus;
-	ULONG FrameLen;
-
-	HEADER_802_11 ActHdr;
-
-	// build action frame header.
-	MgtMacHeaderInit(pAd, &ActHdr, SUBTYPE_ACTION, 0, pDA,
-						pAd->CurrentAddress);
-
-	NStatus = MlmeAllocateMemory(pAd, (PVOID)&pOutBuffer);  //Get an unused nonpaged memory
-	if(NStatus != NDIS_STATUS_SUCCESS)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("%s() allocate memory failed \n", __FUNCTION__));
-		return;
-	}
-	NdisMoveMemory(pOutBuffer, (PCHAR)&ActHdr, sizeof(HEADER_802_11));
-	FrameLen = sizeof(HEADER_802_11);
-
-	InsertActField(pAd, (pOutBuffer + FrameLen), &FrameLen, CATEGORY_SPECTRUM, SPEC_CHANNEL_SWITCH);
-
-	InsertChSwAnnIE(pAd, (pOutBuffer + FrameLen), &FrameLen, ChSwMode, NewCh, 0);
-
-	MiniportMMRequest(pAd, QID_AC_BE, pOutBuffer, FrameLen);
-	MlmeFreeMemory(pAd, pOutBuffer);
-
-	return;
-}
-
-static BOOLEAN DfsRequirementCheck(
-	IN PRTMP_ADAPTER pAd,
-	IN UINT8 Channel)
-{
-	BOOLEAN Result = FALSE;
-	INT i;
-
-	do
-	{
-		// check DFS procedure is running.
-		// make sure DFS procedure won't start twice.
-		if (pAd->CommonCfg.RadarDetect.RDMode != RD_NORMAL_MODE)
-		{
-			Result = FALSE;
-			break;
-		}
-
-		// check the new channel carried from Channel Switch Announcemnet is valid.
-		for (i=0; i<pAd->ChannelListNum; i++)
-		{
-			if ((Channel == pAd->ChannelList[i].Channel)
-				&&(pAd->ChannelList[i].RemainingTimeForUse == 0))
-			{
-				// found radar signal in the channel. the channel can't use at least for 30 minutes.
-				pAd->ChannelList[i].RemainingTimeForUse = 1800;//30 min = 1800 sec
-				Result = TRUE;
-				break;
-			}
-		}
-	} while(FALSE);
-
-	return Result;
-}
-
-VOID NotifyChSwAnnToPeerAPs(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR pRA,
-	IN PUCHAR pTA,
-	IN UINT8 ChSwMode,
-	IN UINT8 Channel)
-{
-#ifdef WDS_SUPPORT
-	if (!((pRA[0] & 0xff) == 0xff)) // is pRA a broadcase address.
-	{
-		INT i;
-		// info neighbor APs that Radar signal found throgh WDS link.
-		for (i = 0; i < MAX_WDS_ENTRY; i++)
-		{
-			if (ValidWdsEntry(pAd, i))
-			{
-				PUCHAR pDA = pAd->WdsTab.WdsEntry[i].PeerWdsAddr;
-
-				// DA equal to SA. have no necessary orignal AP which found Radar signal.
-				if (MAC_ADDR_EQUAL(pTA, pDA))
-					continue;
-
-				// send Channel Switch Action frame to info Neighbro APs.
-				EnqueueChSwAnn(pAd, pDA, ChSwMode, Channel);
-			}
-		}
-	}
-#endif // WDS_SUPPORT //
-}
-
-static VOID StartDFSProcedure(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR Channel,
-	IN UINT8 ChSwMode)
-{
-	// start DFS procedure
-	pAd->CommonCfg.Channel = Channel;
-#ifdef DOT11_N_SUPPORT
-	N_ChannelCheck(pAd);
-#endif // DOT11_N_SUPPORT //
-	pAd->CommonCfg.RadarDetect.RDMode = RD_SWITCHING_MODE;
-	pAd->CommonCfg.RadarDetect.CSCount = 0;
-}
-
-/*
-	==========================================================================
-	Description:
-		Channel Switch Announcement action frame sanity check.
-
-	Parametrs:
-		1. MLME message containing the received frame
-		2. message length.
-		3. Channel switch announcement infomation buffer.
-
-
-	Return	: None.
-	==========================================================================
- */
-
-/*
-  Channel Switch Announcement IE.
-  +----+-----+-----------+------------+-----------+
-  | ID | Len |Ch Sw Mode | New Ch Num | Ch Sw Cnt |
-  +----+-----+-----------+------------+-----------+
-    1    1        1           1            1
-*/
-static BOOLEAN PeerChSwAnnSanity(
-	IN PRTMP_ADAPTER pAd,
-	IN VOID *pMsg,
-	IN ULONG MsgLen,
-	OUT PCH_SW_ANN_INFO pChSwAnnInfo)
-{
-	PFRAME_802_11 Fr = (PFRAME_802_11)pMsg;
-	PUCHAR pFramePtr = Fr->Octet;
-	BOOLEAN result = FALSE;
-	PEID_STRUCT eid_ptr;
-
-	// skip 802.11 header.
-	MsgLen -= sizeof(HEADER_802_11);
-
-	// skip category and action code.
-	pFramePtr += 2;
-	MsgLen -= 2;
-
-	if (pChSwAnnInfo == NULL)
-		return result;
-
-	eid_ptr = (PEID_STRUCT)pFramePtr;
-	while (((UCHAR*)eid_ptr + eid_ptr->Len + 1) < ((PUCHAR)pFramePtr + MsgLen))
-	{
-		switch(eid_ptr->Eid)
-		{
-			case IE_CHANNEL_SWITCH_ANNOUNCEMENT:
-				NdisMoveMemory(&pChSwAnnInfo->ChSwMode, eid_ptr->Octet, 1);
-				NdisMoveMemory(&pChSwAnnInfo->Channel, eid_ptr->Octet + 1, 1);
-				NdisMoveMemory(&pChSwAnnInfo->ChSwCnt, eid_ptr->Octet + 2, 1);
-
-				result = TRUE;
-                break;
-
-			default:
-				break;
-		}
-		eid_ptr = (PEID_STRUCT)((UCHAR*)eid_ptr + 2 + eid_ptr->Len);
-	}
-
-	return result;
-}
-
-/*
-	==========================================================================
-	Description:
-		Measurement request action frame sanity check.
-
-	Parametrs:
-		1. MLME message containing the received frame
-		2. message length.
-		3. Measurement request infomation buffer.
-
-	Return	: None.
-	==========================================================================
- */
-static BOOLEAN PeerMeasureReqSanity(
-	IN PRTMP_ADAPTER pAd,
-	IN VOID *pMsg,
-	IN ULONG MsgLen,
-	OUT PUINT8 pDialogToken,
-	OUT PMEASURE_REQ_INFO pMeasureReqInfo,
-	OUT PMEASURE_REQ pMeasureReq)
-{
-	PFRAME_802_11 Fr = (PFRAME_802_11)pMsg;
-	PUCHAR pFramePtr = Fr->Octet;
-	BOOLEAN result = FALSE;
-	PEID_STRUCT eid_ptr;
-	PUCHAR ptr;
-	UINT64 MeasureStartTime;
-	UINT16 MeasureDuration;
-
-	// skip 802.11 header.
-	MsgLen -= sizeof(HEADER_802_11);
-
-	// skip category and action code.
-	pFramePtr += 2;
-	MsgLen -= 2;
-
-	if (pMeasureReqInfo == NULL)
-		return result;
-
-	NdisMoveMemory(pDialogToken, pFramePtr, 1);
-	pFramePtr += 1;
-	MsgLen -= 1;
-
-	eid_ptr = (PEID_STRUCT)pFramePtr;
-	while (((UCHAR*)eid_ptr + eid_ptr->Len + 1) < ((PUCHAR)pFramePtr + MsgLen))
-	{
-		switch(eid_ptr->Eid)
-		{
-			case IE_MEASUREMENT_REQUEST:
-				NdisMoveMemory(&pMeasureReqInfo->Token, eid_ptr->Octet, 1);
-				NdisMoveMemory(&pMeasureReqInfo->ReqMode.word, eid_ptr->Octet + 1, 1);
-				NdisMoveMemory(&pMeasureReqInfo->ReqType, eid_ptr->Octet + 2, 1);
-				ptr = (PUCHAR)(eid_ptr->Octet + 3);
-				NdisMoveMemory(&pMeasureReq->ChNum, ptr, 1);
-				NdisMoveMemory(&MeasureStartTime, ptr + 1, 8);
-				pMeasureReq->MeasureStartTime = SWAP64(MeasureStartTime);
-				NdisMoveMemory(&MeasureDuration, ptr + 9, 2);
-				pMeasureReq->MeasureDuration = SWAP16(MeasureDuration);
-
-				result = TRUE;
-				break;
-
-			default:
-				break;
-		}
-		eid_ptr = (PEID_STRUCT)((UCHAR*)eid_ptr + 2 + eid_ptr->Len);
-	}
-
-	return result;
-}
-
-/*
-	==========================================================================
-	Description:
-		Measurement report action frame sanity check.
-
-	Parametrs:
-		1. MLME message containing the received frame
-		2. message length.
-		3. Measurement report infomation buffer.
-		4. basic report infomation buffer.
-
-	Return	: None.
-	==========================================================================
- */
-
-/*
-  Measurement Report IE.
-  +----+-----+-------+-------------+--------------+----------------+
-  | ID | Len | Token | Report Mode | Measure Type | Measure Report |
-  +----+-----+-------+-------------+--------------+----------------+
-    1     1      1          1             1            variable
-
-  Basic Report.
-  +--------+------------+----------+-----+
-  | Ch Num | Start Time | Duration | Map |
-  +--------+------------+----------+-----+
-      1          8           2        1
-
-  Map Field Bit Format.
-  +-----+---------------+---------------------+-------+------------+----------+
-  | Bss | OFDM Preamble | Unidentified signal | Radar | Unmeasured | Reserved |
-  +-----+---------------+---------------------+-------+------------+----------+
-     0          1                  2              3         4          5-7
-*/
-static BOOLEAN PeerMeasureReportSanity(
-	IN PRTMP_ADAPTER pAd,
-	IN VOID *pMsg,
-	IN ULONG MsgLen,
-	OUT PUINT8 pDialogToken,
-	OUT PMEASURE_REPORT_INFO pMeasureReportInfo,
-	OUT PUINT8 pReportBuf)
-{
-	PFRAME_802_11 Fr = (PFRAME_802_11)pMsg;
-	PUCHAR pFramePtr = Fr->Octet;
-	BOOLEAN result = FALSE;
-	PEID_STRUCT eid_ptr;
-	PUCHAR ptr;
-
-	// skip 802.11 header.
-	MsgLen -= sizeof(HEADER_802_11);
-
-	// skip category and action code.
-	pFramePtr += 2;
-	MsgLen -= 2;
-
-	if (pMeasureReportInfo == NULL)
-		return result;
-
-	NdisMoveMemory(pDialogToken, pFramePtr, 1);
-	pFramePtr += 1;
-	MsgLen -= 1;
-
-	eid_ptr = (PEID_STRUCT)pFramePtr;
-	while (((UCHAR*)eid_ptr + eid_ptr->Len + 1) < ((PUCHAR)pFramePtr + MsgLen))
-	{
-		switch(eid_ptr->Eid)
-		{
-			case IE_MEASUREMENT_REPORT:
-				NdisMoveMemory(&pMeasureReportInfo->Token, eid_ptr->Octet, 1);
-				NdisMoveMemory(&pMeasureReportInfo->ReportMode, eid_ptr->Octet + 1, 1);
-				NdisMoveMemory(&pMeasureReportInfo->ReportType, eid_ptr->Octet + 2, 1);
-				if (pMeasureReportInfo->ReportType == RM_BASIC)
-				{
-					PMEASURE_BASIC_REPORT pReport = (PMEASURE_BASIC_REPORT)pReportBuf;
-					ptr = (PUCHAR)(eid_ptr->Octet + 3);
-					NdisMoveMemory(&pReport->ChNum, ptr, 1);
-					NdisMoveMemory(&pReport->MeasureStartTime, ptr + 1, 8);
-					NdisMoveMemory(&pReport->MeasureDuration, ptr + 9, 2);
-					NdisMoveMemory(&pReport->Map, ptr + 11, 1);
-
-				}
-				else if (pMeasureReportInfo->ReportType == RM_CCA)
-				{
-					PMEASURE_CCA_REPORT pReport = (PMEASURE_CCA_REPORT)pReportBuf;
-					ptr = (PUCHAR)(eid_ptr->Octet + 3);
-					NdisMoveMemory(&pReport->ChNum, ptr, 1);
-					NdisMoveMemory(&pReport->MeasureStartTime, ptr + 1, 8);
-					NdisMoveMemory(&pReport->MeasureDuration, ptr + 9, 2);
-					NdisMoveMemory(&pReport->CCA_Busy_Fraction, ptr + 11, 1);
-
-				}
-				else if (pMeasureReportInfo->ReportType == RM_RPI_HISTOGRAM)
-				{
-					PMEASURE_RPI_REPORT pReport = (PMEASURE_RPI_REPORT)pReportBuf;
-					ptr = (PUCHAR)(eid_ptr->Octet + 3);
-					NdisMoveMemory(&pReport->ChNum, ptr, 1);
-					NdisMoveMemory(&pReport->MeasureStartTime, ptr + 1, 8);
-					NdisMoveMemory(&pReport->MeasureDuration, ptr + 9, 2);
-					NdisMoveMemory(&pReport->RPI_Density, ptr + 11, 8);
-				}
-				result = TRUE;
-                break;
-
-			default:
-				break;
-		}
-		eid_ptr = (PEID_STRUCT)((UCHAR*)eid_ptr + 2 + eid_ptr->Len);
-	}
-
-	return result;
-}
-
-/*
-	==========================================================================
-	Description:
-		TPC Request action frame sanity check.
-
-	Parametrs:
-		1. MLME message containing the received frame
-		2. message length.
-		3. Dialog Token.
-
-	Return	: None.
-	==========================================================================
- */
-static BOOLEAN PeerTpcReqSanity(
-	IN PRTMP_ADAPTER pAd,
-	IN VOID *pMsg,
-	IN ULONG MsgLen,
-	OUT PUINT8 pDialogToken)
-{
-	PFRAME_802_11 Fr = (PFRAME_802_11)pMsg;
-	PUCHAR pFramePtr = Fr->Octet;
-	BOOLEAN result = FALSE;
-	PEID_STRUCT eid_ptr;
-
-	MsgLen -= sizeof(HEADER_802_11);
-
-	// skip category and action code.
-	pFramePtr += 2;
-	MsgLen -= 2;
-
-	if (pDialogToken == NULL)
-		return result;
-
-	NdisMoveMemory(pDialogToken, pFramePtr, 1);
-	pFramePtr += 1;
-	MsgLen -= 1;
-
-	eid_ptr = (PEID_STRUCT)pFramePtr;
-	while (((UCHAR*)eid_ptr + eid_ptr->Len + 1) < ((PUCHAR)pFramePtr + MsgLen))
-	{
-		switch(eid_ptr->Eid)
-		{
-			case IE_TPC_REQUEST:
-				result = TRUE;
-                break;
-
-			default:
-				break;
-		}
-		eid_ptr = (PEID_STRUCT)((UCHAR*)eid_ptr + 2 + eid_ptr->Len);
-	}
-
-	return result;
-}
-
-/*
-	==========================================================================
-	Description:
-		TPC Report action frame sanity check.
-
-	Parametrs:
-		1. MLME message containing the received frame
-		2. message length.
-		3. Dialog Token.
-		4. TPC Report IE.
-
-	Return	: None.
-	==========================================================================
- */
-static BOOLEAN PeerTpcRepSanity(
-	IN PRTMP_ADAPTER pAd,
-	IN VOID *pMsg,
-	IN ULONG MsgLen,
-	OUT PUINT8 pDialogToken,
-	OUT PTPC_REPORT_INFO pTpcRepInfo)
-{
-	PFRAME_802_11 Fr = (PFRAME_802_11)pMsg;
-	PUCHAR pFramePtr = Fr->Octet;
-	BOOLEAN result = FALSE;
-	PEID_STRUCT eid_ptr;
-
-	MsgLen -= sizeof(HEADER_802_11);
-
-	// skip category and action code.
-	pFramePtr += 2;
-	MsgLen -= 2;
-
-	if (pDialogToken == NULL)
-		return result;
-
-	NdisMoveMemory(pDialogToken, pFramePtr, 1);
-	pFramePtr += 1;
-	MsgLen -= 1;
-
-	eid_ptr = (PEID_STRUCT)pFramePtr;
-	while (((UCHAR*)eid_ptr + eid_ptr->Len + 1) < ((PUCHAR)pFramePtr + MsgLen))
-	{
-		switch(eid_ptr->Eid)
-		{
-			case IE_TPC_REPORT:
-				NdisMoveMemory(&pTpcRepInfo->TxPwr, eid_ptr->Octet, 1);
-				NdisMoveMemory(&pTpcRepInfo->LinkMargin, eid_ptr->Octet + 1, 1);
-				result = TRUE;
-                break;
-
-			default:
-				break;
-		}
-		eid_ptr = (PEID_STRUCT)((UCHAR*)eid_ptr + 2 + eid_ptr->Len);
-	}
-
-	return result;
-}
-
-/*
-	==========================================================================
-	Description:
-		Channel Switch Announcement action frame handler.
-
-	Parametrs:
-		Elme - MLME message containing the received frame
-
-	Return	: None.
-	==========================================================================
- */
-static VOID PeerChSwAnnAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-	CH_SW_ANN_INFO ChSwAnnInfo;
-	PFRAME_802_11 pFr = (PFRAME_802_11)Elem->Msg;
-#ifdef CONFIG_STA_SUPPORT
-	UCHAR index = 0, Channel = 0, NewChannel = 0;
-	ULONG Bssidx = 0;
-#endif // CONFIG_STA_SUPPORT //
-
-	NdisZeroMemory(&ChSwAnnInfo, sizeof(CH_SW_ANN_INFO));
-	if (! PeerChSwAnnSanity(pAd, Elem->Msg, Elem->MsgLen, &ChSwAnnInfo))
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("Invalid Channel Switch Action Frame.\n"));
-		return;
-	}
-
-
-#ifdef CONFIG_STA_SUPPORT
-	if (pAd->OpMode == OPMODE_STA)
-	{
-		Bssidx = BssTableSearch(&pAd->ScanTab, pFr->Hdr.Addr3, pAd->CommonCfg.Channel);
-		if (Bssidx == BSS_NOT_FOUND)
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("PeerChSwAnnAction - Bssidx is not found\n"));
-			return;
-		}
-
-		DBGPRINT(RT_DEBUG_TRACE, ("\n****Bssidx is %d, Channel = %d\n", index, pAd->ScanTab.BssEntry[Bssidx].Channel));
-		hex_dump("SSID",pAd->ScanTab.BssEntry[Bssidx].Bssid ,6);
-
-		Channel = pAd->CommonCfg.Channel;
-		NewChannel = ChSwAnnInfo.Channel;
-
-		if ((pAd->CommonCfg.bIEEE80211H == 1) && (NewChannel != 0) && (Channel != NewChannel))
-		{
-			// Switching to channel 1 can prevent from rescanning the current channel immediately (by auto reconnection).
-			// In addition, clear the MLME queue and the scan table to discard the RX packets and previous scanning results.
-			AsicSwitchChannel(pAd, 1, FALSE);
-			AsicLockChannel(pAd, 1);
-		    LinkDown(pAd, FALSE);
-			MlmeQueueInit(&pAd->Mlme.Queue);
-			BssTableInit(&pAd->ScanTab);
-		    RTMPusecDelay(1000000);		// use delay to prevent STA do reassoc
-
-			// channel sanity check
-			for (index = 0 ; index < pAd->ChannelListNum; index++)
-			{
-				if (pAd->ChannelList[index].Channel == NewChannel)
-				{
-					pAd->ScanTab.BssEntry[Bssidx].Channel = NewChannel;
-					pAd->CommonCfg.Channel = NewChannel;
-					AsicSwitchChannel(pAd, pAd->CommonCfg.Channel, FALSE);
-					AsicLockChannel(pAd, pAd->CommonCfg.Channel);
-					DBGPRINT(RT_DEBUG_TRACE, ("&&&&&&&&&&&&&&&&PeerChSwAnnAction - STA receive channel switch announcement IE (New Channel =%d)\n", NewChannel));
-					break;
-				}
-			}
-
-			if (index >= pAd->ChannelListNum)
-			{
-				DBGPRINT_ERR(("&&&&&&&&&&&&&&&&&&&&&&&&&&PeerChSwAnnAction(can not find New Channel=%d in ChannelList[%d]\n", pAd->CommonCfg.Channel, pAd->ChannelListNum));
-			}
-		}
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-	return;
-}
-
-
-/*
-	==========================================================================
-	Description:
-		Measurement Request action frame handler.
-
-	Parametrs:
-		Elme - MLME message containing the received frame
-
-	Return	: None.
-	==========================================================================
- */
-static VOID PeerMeasureReqAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-	PFRAME_802_11 pFr = (PFRAME_802_11)Elem->Msg;
-	UINT8 DialogToken;
-	MEASURE_REQ_INFO MeasureReqInfo;
-	MEASURE_REQ	MeasureReq;
-	MEASURE_REPORT_MODE ReportMode;
-
-	if(PeerMeasureReqSanity(pAd, Elem->Msg, Elem->MsgLen, &DialogToken, &MeasureReqInfo, &MeasureReq))
-	{
-		ReportMode.word = 0;
-		ReportMode.field.Incapable = 1;
-		EnqueueMeasurementRep(pAd, pFr->Hdr.Addr2, DialogToken, MeasureReqInfo.Token, ReportMode.word, MeasureReqInfo.ReqType, 0, NULL);
-	}
-
-	return;
-}
-
-/*
-	==========================================================================
-	Description:
-		Measurement Report action frame handler.
-
-	Parametrs:
-		Elme - MLME message containing the received frame
-
-	Return	: None.
-	==========================================================================
- */
-static VOID PeerMeasureReportAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-	MEASURE_REPORT_INFO MeasureReportInfo;
-	PFRAME_802_11 pFr = (PFRAME_802_11)Elem->Msg;
-	UINT8 DialogToken;
-	PUINT8 pMeasureReportInfo;
-
-//	if (pAd->CommonCfg.bIEEE80211H != TRUE)
-//		return;
-
-	if ((pMeasureReportInfo = kmalloc(sizeof(MEASURE_RPI_REPORT), GFP_ATOMIC)) == NULL)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("%s unable to alloc memory for measure report buffer (size=%d).\n", __FUNCTION__, sizeof(MEASURE_RPI_REPORT)));
-		return;
-	}
-
-	NdisZeroMemory(&MeasureReportInfo, sizeof(MEASURE_REPORT_INFO));
-	NdisZeroMemory(pMeasureReportInfo, sizeof(MEASURE_RPI_REPORT));
-	if (PeerMeasureReportSanity(pAd, Elem->Msg, Elem->MsgLen, &DialogToken, &MeasureReportInfo, pMeasureReportInfo))
-	{
-		do {
-			PMEASURE_REQ_ENTRY pEntry = NULL;
-
-			// Not a autonomous measure report.
-			// check the dialog token field. drop it if the dialog token doesn't match.
-			if ((DialogToken != 0)
-				&& ((pEntry = MeasureReqLookUp(pAd, DialogToken)) == NULL))
-				break;
-
-			if (pEntry != NULL)
-				MeasureReqDelete(pAd, pEntry->DialogToken);
-
-			if (MeasureReportInfo.ReportType == RM_BASIC)
-			{
-				PMEASURE_BASIC_REPORT pBasicReport = (PMEASURE_BASIC_REPORT)pMeasureReportInfo;
-				if ((pBasicReport->Map.field.Radar)
-					&& (DfsRequirementCheck(pAd, pBasicReport->ChNum) == TRUE))
-				{
-					NotifyChSwAnnToPeerAPs(pAd, pFr->Hdr.Addr1, pFr->Hdr.Addr2, 1, pBasicReport->ChNum);
-					StartDFSProcedure(pAd, pBasicReport->ChNum, 1);
-				}
-			}
-		} while (FALSE);
-	}
-	else
-		DBGPRINT(RT_DEBUG_TRACE, ("Invalid Measurement Report Frame.\n"));
-
-	kfree(pMeasureReportInfo);
-
-	return;
-}
-
-/*
-	==========================================================================
-	Description:
-		TPC Request action frame handler.
-
-	Parametrs:
-		Elme - MLME message containing the received frame
-
-	Return	: None.
-	==========================================================================
- */
-static VOID PeerTpcReqAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-	PFRAME_802_11 pFr = (PFRAME_802_11)Elem->Msg;
-	PUCHAR pFramePtr = pFr->Octet;
-	UINT8 DialogToken;
-	UINT8 TxPwr = GetCurTxPwr(pAd, Elem->Wcid);
-	UINT8 LinkMargin = 0;
-	CHAR RealRssi;
-
-	// link margin: Ratio of the received signal power to the minimum desired by the station (STA). The
-	//				STA may incorporate rate information and channel conditions, including interference, into its computation
-	//				of link margin.
-
-	RealRssi = RTMPMaxRssi(pAd, ConvertToRssi(pAd, Elem->Rssi0, RSSI_0),
-								ConvertToRssi(pAd, Elem->Rssi1, RSSI_1),
-								ConvertToRssi(pAd, Elem->Rssi2, RSSI_2));
-
-	// skip Category and action code.
-	pFramePtr += 2;
-
-	// Dialog token.
-	NdisMoveMemory(&DialogToken, pFramePtr, 1);
-
-	LinkMargin = (RealRssi / MIN_RCV_PWR);
-	if (PeerTpcReqSanity(pAd, Elem->Msg, Elem->MsgLen, &DialogToken))
-		EnqueueTPCRep(pAd, pFr->Hdr.Addr2, DialogToken, TxPwr, LinkMargin);
-
-	return;
-}
-
-/*
-	==========================================================================
-	Description:
-		TPC Report action frame handler.
-
-	Parametrs:
-		Elme - MLME message containing the received frame
-
-	Return	: None.
-	==========================================================================
- */
-static VOID PeerTpcRepAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-	UINT8 DialogToken;
-	TPC_REPORT_INFO TpcRepInfo;
-	PTPC_REQ_ENTRY pEntry = NULL;
-
-	NdisZeroMemory(&TpcRepInfo, sizeof(TPC_REPORT_INFO));
-	if (PeerTpcRepSanity(pAd, Elem->Msg, Elem->MsgLen, &DialogToken, &TpcRepInfo))
-	{
-		if ((pEntry = TpcReqLookUp(pAd, DialogToken)) != NULL)
-		{
-			TpcReqDelete(pAd, pEntry->DialogToken);
-			DBGPRINT(RT_DEBUG_TRACE, ("%s: DialogToken=%x, TxPwr=%d, LinkMargin=%d\n",
-				__FUNCTION__, DialogToken, TpcRepInfo.TxPwr, TpcRepInfo.LinkMargin));
-		}
-	}
-
-	return;
-}
-
-/*
-	==========================================================================
-	Description:
-		Spectrun action frames Handler such as channel switch annoucement,
-		measurement report, measurement request actions frames.
-
-	Parametrs:
-		Elme - MLME message containing the received frame
-
-	Return	: None.
-	==========================================================================
- */
-VOID PeerSpectrumAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-
-	UCHAR	Action = Elem->Msg[LENGTH_802_11+1];
-
-	if (pAd->CommonCfg.bIEEE80211H != TRUE)
-		return;
-
-	switch(Action)
-	{
-		case SPEC_MRQ:
-			// current rt2860 unable do such measure specified in Measurement Request.
-			// reject all measurement request.
-			PeerMeasureReqAction(pAd, Elem);
-			break;
-
-		case SPEC_MRP:
-			PeerMeasureReportAction(pAd, Elem);
-			break;
-
-		case SPEC_TPCRQ:
-			PeerTpcReqAction(pAd, Elem);
-			break;
-
-		case SPEC_TPCRP:
-			PeerTpcRepAction(pAd, Elem);
-			break;
-
-		case SPEC_CHANNEL_SWITCH:
-
-#ifdef DOT11N_DRAFT3
-			{
-				SEC_CHA_OFFSET_IE	Secondary;
-				CHA_SWITCH_ANNOUNCE_IE	ChannelSwitch;
-
-				// 802.11h only has Channel Switch Announcement IE.
-				RTMPMoveMemory(&ChannelSwitch, &Elem->Msg[LENGTH_802_11+4], sizeof (CHA_SWITCH_ANNOUNCE_IE));
-
-				// 802.11n D3.03 adds secondary channel offset element in the end.
-				if (Elem->MsgLen ==  (LENGTH_802_11 + 2 + sizeof (CHA_SWITCH_ANNOUNCE_IE) + sizeof (SEC_CHA_OFFSET_IE)))
-				{
-					RTMPMoveMemory(&Secondary, &Elem->Msg[LENGTH_802_11+9], sizeof (SEC_CHA_OFFSET_IE));
-				}
-				else
-				{
-					Secondary.SecondaryChannelOffset = 0;
-				}
-
-				if ((Elem->Msg[LENGTH_802_11+2] == IE_CHANNEL_SWITCH_ANNOUNCEMENT) && (Elem->Msg[LENGTH_802_11+3] == 3))
-				{
-					ChannelSwitchAction(pAd, Elem->Wcid, ChannelSwitch.NewChannel, Secondary.SecondaryChannelOffset);
-				}
-			}
-#endif // DOT11N_DRAFT3 //
-
-			PeerChSwAnnAction(pAd, Elem);
-			break;
-	}
-
-	return;
-}
-
-/*
-	==========================================================================
-	Description:
-
-	Parametrs:
-
-	Return	: None.
-	==========================================================================
- */
-INT Set_MeasureReq_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	UINT Aid = 1;
-	UINT ArgIdx;
-	PSTRING thisChar;
-
-	MEASURE_REQ_MODE MeasureReqMode;
-	UINT8 MeasureReqToken = RandomByte(pAd);
-	UINT8 MeasureReqType = RM_BASIC;
-	UINT8 MeasureCh = 1;
-	UINT64 MeasureStartTime = GetCurrentTimeStamp(pAd);
-	MEASURE_REQ MeasureReq;
-	UINT8 TotalLen;
-
-	HEADER_802_11 ActHdr;
-	PUCHAR pOutBuffer = NULL;
-	NDIS_STATUS NStatus;
-	ULONG FrameLen;
-
-	NStatus = MlmeAllocateMemory(pAd, (PVOID)&pOutBuffer);  //Get an unused nonpaged memory
-	if(NStatus != NDIS_STATUS_SUCCESS)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("%s() allocate memory failed \n", __FUNCTION__));
-		goto END_OF_MEASURE_REQ;
-	}
-
-	ArgIdx = 1;
-	while ((thisChar = strsep((char **)&arg, "-")) != NULL)
-	{
-		switch(ArgIdx)
-		{
-			case 1:	// Aid.
-				Aid = (UINT8) simple_strtol(thisChar, 0, 16);
-				break;
-
-			case 2: // Measurement Request Type.
-				MeasureReqType = simple_strtol(thisChar, 0, 16);
-				if (MeasureReqType > 3)
-				{
-					DBGPRINT(RT_DEBUG_ERROR, ("%s: unknow MeasureReqType(%d)\n", __FUNCTION__, MeasureReqType));
-					goto END_OF_MEASURE_REQ;
-				}
-				break;
-
-			case 3: // Measurement channel.
-				MeasureCh = (UINT8) simple_strtol(thisChar, 0, 16);
-				break;
-		}
-		ArgIdx++;
-	}
-
-	DBGPRINT(RT_DEBUG_TRACE, ("%s::Aid = %d, MeasureReqType=%d MeasureCh=%d\n", __FUNCTION__, Aid, MeasureReqType, MeasureCh));
-	if (!VALID_WCID(Aid))
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("%s: unknow sta of Aid(%d)\n", __FUNCTION__, Aid));
-		goto END_OF_MEASURE_REQ;
-	}
-
-	MeasureReqMode.word = 0;
-	MeasureReqMode.field.Enable = 1;
-
-	MeasureReqInsert(pAd, MeasureReqToken);
-
-	// build action frame header.
-	MgtMacHeaderInit(pAd, &ActHdr, SUBTYPE_ACTION, 0, pAd->MacTab.Content[Aid].Addr,
-						pAd->CurrentAddress);
-
-	NdisMoveMemory(pOutBuffer, (PCHAR)&ActHdr, sizeof(HEADER_802_11));
-	FrameLen = sizeof(HEADER_802_11);
-
-	TotalLen = sizeof(MEASURE_REQ_INFO) + sizeof(MEASURE_REQ);
-
-	MakeMeasurementReqFrame(pAd, pOutBuffer, &FrameLen,
-		sizeof(MEASURE_REQ_INFO), CATEGORY_RM, RM_BASIC,
-		MeasureReqToken, MeasureReqMode.word,
-		MeasureReqType, 0);
-
-	MeasureReq.ChNum = MeasureCh;
-	MeasureReq.MeasureStartTime = cpu2le64(MeasureStartTime);
-	MeasureReq.MeasureDuration = cpu2le16(2000);
-
-	{
-		ULONG TempLen;
-		MakeOutgoingFrame(	pOutBuffer+FrameLen,	&TempLen,
-							sizeof(MEASURE_REQ),	&MeasureReq,
-							END_OF_ARGS);
-		FrameLen += TempLen;
-	}
-
-	MiniportMMRequest(pAd, QID_AC_BE, pOutBuffer, (UINT)FrameLen);
-
-END_OF_MEASURE_REQ:
-	MlmeFreeMemory(pAd, pOutBuffer);
-
-	return TRUE;
-}
-
-INT Set_TpcReq_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	UINT Aid;
-
-	UINT8 TpcReqToken = RandomByte(pAd);
-
-	Aid = (UINT) simple_strtol(arg, 0, 16);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("%s::Aid = %d\n", __FUNCTION__, Aid));
-	if (!VALID_WCID(Aid))
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("%s: unknow sta of Aid(%d)\n", __FUNCTION__, Aid));
-		return TRUE;
-	}
-
-	TpcReqInsert(pAd, TpcReqToken);
-
-	EnqueueTPCReq(pAd, pAd->MacTab.Content[Aid].Addr, TpcReqToken);
-
-	return TRUE;
-}
diff --git a/drivers/staging/rt3090/config.mk b/drivers/staging/rt3090/config.mk
deleted file mode 100644
index 4c90c4060d10..000000000000
--- a/drivers/staging/rt3090/config.mk
+++ /dev/null
@@ -1,187 +0,0 @@
-# Support ATE function
-HAS_ATE=y
-
-# Support 28xx QA ATE function
-HAS_28xx_QA=n
-
-
-HAS_NINTENDO=n
-
-# Support LLTD function
-HAS_LLTD=n
-
-# Support WDS function
-HAS_WDS=n
-
-# Support AP-Client function
-HAS_APCLI=n
-
-# Support Wpa_Supplicant
-HAS_WPA_SUPPLICANT=y
-
-# Support Native WpaSupplicant for Network Maganger
-HAS_NATIVE_WPA_SUPPLICANT_SUPPORT=y
-
-#Support Net interface block while Tx-Sw queue full
-HAS_BLOCK_NET_IF=n
-
-#Support IGMP-Snooping function.
-HAS_IGMP_SNOOP_SUPPORT=n
-
-#Support DFS function
-HAS_DFS_SUPPORT=n
-
-#Support Carrier-Sense function
-HAS_CS_SUPPORT=n
-
-# Support for STA Ethernet Converter
-HAS_ETH_CONVERT_SUPPORT=n
-
-# Support user specific transmit rate of Multicast packet.
-HAS_MCAST_RATE_SPECIFIC_SUPPORT=n
-
-# Support for Multiple Cards
-HAS_MC_SUPPORT=n
-
-#Support for PCI-MSI
-HAS_MSI_SUPPORT=n
-
-
-#Support for IEEE802.11e DLS
-HAS_QOS_DLS_SUPPORT=n
-
-#Support for EXT_CHANNEL
-HAS_EXT_BUILD_CHANNEL_LIST=n
-
-#Support for IDS
-HAS_IDS_SUPPORT=n
-
-
-#Support for Net-SNMP
-HAS_SNMP_SUPPORT=n
-
-#Support features of 802.11n Draft3
-HAS_DOT11N_DRAFT3_SUPPORT=n
-
-#Support features of Single SKU.
-HAS_SINGLE_SKU_SUPPORT=n
-
-#Support features of 802.11n
-HAS_DOT11_N_SUPPORT=y
-
-
-
-#Support for 2860/2880 co-exist
-HAS_RT2880_RT2860_COEXIST=n
-
-HAS_KTHREAD_SUPPORT=n
-
-
-#Support for Auto channel select enhance
-HAS_AUTO_CH_SELECT_ENHANCE=n
-
-#Support bypass bridge
-HAS_BG_FT_SUPPORT=n
-
-#Support Antenna Diversity
-HAS_ANTENNA_DIVERSITY_SUPPORT=y
-#################################################
-
-WFLAGS := -DAGGREGATION_SUPPORT -DPIGGYBACK_SUPPORT -DWMM_SUPPORT  -DLINUX -Wall -Wstrict-prototypes -Wno-trigraphs -Wpointer-sign
-
-ifeq ($(HAS_KTHREAD_SUPPORT),y)
-WFLAGS += -DKTHREAD_SUPPORT
-endif
-
-
-#################################################
-
-# config for STA mode
-
-WFLAGS += -DCONFIG_STA_SUPPORT -DDBG
-
-ifeq ($(HAS_WPA_SUPPLICANT),y)
-WFLAGS += -DWPA_SUPPLICANT_SUPPORT
-ifeq ($(HAS_NATIVE_WPA_SUPPLICANT_SUPPORT),y)
-WFLAGS += -DNATIVE_WPA_SUPPLICANT_SUPPORT
-endif
-endif
-
-
-ifeq ($(HAS_ETH_CONVERT_SUPPORT), y)
-WFLAGS += -DETH_CONVERT_SUPPORT  -DMAT_SUPPORT
-endif
-
-ifeq ($(HAS_ATE),y)
-WFLAGS += -DRALINK_ATE
-ifeq ($(HAS_28xx_QA),y)
-WFLAGS += -DRALINK_28xx_QA
-endif
-endif
-
-
-ifeq ($(HAS_SNMP_SUPPORT),y)
-WFLAGS += -DSNMP_SUPPORT
-endif
-
-ifeq ($(HAS_QOS_DLS_SUPPORT),y)
-WFLAGS += -DQOS_DLS_SUPPORT
-endif
-
-ifeq ($(HAS_DOT11_N_SUPPORT),y)
-WFLAGS += -DDOT11_N_SUPPORT
-endif
-
-ifeq ($(HAS_CS_SUPPORT),y)
-WFLAGS += -DCARRIER_DETECTION_SUPPORT
-endif
-
-ifeq ($(HAS_ANTENNA_DIVERSITY_SUPPORT),y)
-WFLAGS += -DANT_DIVERSITY_SUPPORT
-endif
-
-#################################################
-
-#################################################
-
-#
-# Common compiler flag
-#
-
-
-
-
-
-ifeq ($(HAS_EXT_BUILD_CHANNEL_LIST),y)
-WFLAGS += -DEXT_BUILD_CHANNEL_LIST
-endif
-
-ifeq ($(HAS_IDS_SUPPORT),y)
-WFLAGS += -DIDS_SUPPORT
-endif
-
-
-#################################################
-# ChipSet specific definitions.
-#
-WFLAGS +=-DRTMP_MAC_PCI -DRT30xx -DRT3090  -DRTMP_PCI_SUPPORT -DRTMP_RF_RW_SUPPORT -DRTMP_EFUSE_SUPPORT
-#################################################
-
-
-ifeq ($(HAS_BLOCK_NET_IF),y)
-WFLAGS += -DBLOCK_NET_IF
-endif
-
-ifeq ($(HAS_DFS_SUPPORT),y)
-WFLAGS += -DDFS_SUPPORT
-endif
-
-ifeq ($(HAS_MC_SUPPORT),y)
-WFLAGS += -DMULTIPLE_CARD_SUPPORT
-endif
-
-ifeq ($(HAS_LLTD),y)
-WFLAGS += -DLLTD_SUPPORT
-endif
-
-EXTRA_CFLAGS := $(WFLAGS)
diff --git a/drivers/staging/rt3090/crypt_sha2.h b/drivers/staging/rt3090/crypt_sha2.h
deleted file mode 100644
index 85c0403d725a..000000000000
--- a/drivers/staging/rt3090/crypt_sha2.h
+++ /dev/null
@@ -1,107 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-    Module Name:
-    crypt_sha2.h
-
-    Abstract:
-    Miniport generic portion header file
-
-    Revision History:
-    Who         When          What
-    --------    ----------    ----------------------------------------------
-    Eddy        2008/11/24      Create SHA1
-    Eddy        2008/07/23      Create SHA256
-*/
-
-#ifndef __CRYPT_SHA2_H__
-#define __CRYPT_SHA2_H__
-
-#ifdef CRYPT_TESTPLAN
-#include "crypt_testplan.h"
-#else
-#include "rt_config.h"
-#endif /* CRYPT_TESTPLAN */
-
-/* Algorithm options */
-#define SHA1_SUPPORT
-#define SHA256_SUPPORT
-
-#ifdef SHA1_SUPPORT
-#define SHA1_BLOCK_SIZE    64 /* 512 bits = 64 bytes */
-#define SHA1_DIGEST_SIZE   20 /* 160 bits = 20 bytes */
-typedef struct _SHA1_CTX_STRUC {
-    UINT32 HashValue[5];  /* 5 = (SHA1_DIGEST_SIZE / 32) */
-    UINT64 MessageLen;    /* total size */
-    UINT8  Block[SHA1_BLOCK_SIZE];
-    UINT   BlockLen;
-} SHA1_CTX_STRUC, *PSHA1_CTX_STRUC;
-
-VOID SHA1_Init (
-    IN  SHA1_CTX_STRUC *pSHA_CTX);
-VOID SHA1_Hash (
-    IN  SHA1_CTX_STRUC *pSHA_CTX);
-VOID SHA1_Append (
-    IN  SHA1_CTX_STRUC *pSHA_CTX,
-    IN  const UINT8 Message[],
-    IN  UINT MessageLen);
-VOID SHA1_End (
-    IN  SHA1_CTX_STRUC *pSHA_CTX,
-    OUT UINT8 DigestMessage[]);
-VOID RT_SHA1 (
-    IN  const UINT8 Message[],
-    IN  UINT MessageLen,
-    OUT UINT8 DigestMessage[]);
-#endif /* SHA1_SUPPORT */
-
-#ifdef SHA256_SUPPORT
-#define SHA256_BLOCK_SIZE   64 /* 512 bits = 64 bytes */
-#define SHA256_DIGEST_SIZE  32 /* 256 bits = 32 bytes */
-typedef struct _SHA256_CTX_STRUC {
-    UINT32 HashValue[8];  /* 8 = (SHA256_DIGEST_SIZE / 32) */
-    UINT64 MessageLen;    /* total size */
-    UINT8  Block[SHA256_BLOCK_SIZE];
-    UINT   BlockLen;
-} SHA256_CTX_STRUC, *PSHA256_CTX_STRUC;
-
-VOID SHA256_Init (
-    IN  SHA256_CTX_STRUC *pSHA_CTX);
-VOID SHA256_Hash (
-    IN  SHA256_CTX_STRUC *pSHA_CTX);
-VOID SHA256_Append (
-    IN  SHA256_CTX_STRUC *pSHA_CTX,
-    IN  const UINT8 Message[],
-    IN  UINT MessageLen);
-VOID SHA256_End (
-    IN  SHA256_CTX_STRUC *pSHA_CTX,
-    OUT UINT8 DigestMessage[]);
-VOID RT_SHA256 (
-    IN  const UINT8 Message[],
-    IN  UINT MessageLen,
-    OUT UINT8 DigestMessage[]);
-#endif /* SHA256_SUPPORT */
-
-#endif /* __CRYPT_SHA2_H__ */
diff --git a/drivers/staging/rt3090/dfs.h b/drivers/staging/rt3090/dfs.h
deleted file mode 100644
index 506468ea952f..000000000000
--- a/drivers/staging/rt3090/dfs.h
+++ /dev/null
@@ -1,137 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-    Module Name:
-    dfs.h
-
-    Abstract:
-    Miniport generic portion header file
-
-    Revision History:
-    Who         When          What
-    --------    ----------    ----------------------------------------------
-    Fonchi    03-12-2007      created
-*/
-
-#define RADAR_PULSE 1
-#define RADAR_WIDTH 2
-
-#define WIDTH_RD_IDLE 0
-#define WIDTH_RD_CHECK 1
-
-
-
-/*************************************************************************
-  *
-  *	DFS Radar related definitions.
-  *
-  ************************************************************************/
-//#define CARRIER_DETECT_TASK_NUM	6
-//#define RADAR_DETECT_TASK_NUM	7
-
-// McuRadarState && McuCarrierState for 2880-SW-MCU
-#define FREE_FOR_TX				0
-#define WAIT_CTS_BEING_SENT		1
-#define DO_DETECTION			2
-
-// McuRadarEvent
-#define RADAR_EVENT_CTS_SENT			0x01 // Host signal MCU that CTS has been sent
-#define RADAR_EVENT_CTS_CARRIER_SENT	0x02 // Host signal MCU that CTS has been sent (Carrier)
-#define RADAR_EVENT_RADAR_DETECTING		0x04 // Radar detection is on going, carrier detection hold back
-#define RADAR_EVENT_CARRIER_DETECTING	0x08 // Carrier detection is on going, radar detection hold back
-#define RADAR_EVENT_WIDTH_RADAR			0x10 // BBP == 2 radar detected
-#define RADAR_EVENT_CTS_KICKED			0x20 // Radar detection need to sent double CTS, first CTS sent
-
-// McuRadarCmd
-#define DETECTION_STOP			0
-#define RADAR_DETECTION			1
-#define CARRIER_DETECTION		2
-
-
-
-#ifdef TONE_RADAR_DETECT_SUPPORT
-INT Set_CarrierCriteria_Proc(IN PRTMP_ADAPTER pAd, IN PSTRING arg);
-int Set_CarrierReCheck_Proc(IN PRTMP_ADAPTER pAd, IN PSTRING arg);
-INT Set_CarrierStopCheck_Proc(IN PRTMP_ADAPTER pAd, IN PSTRING arg);
-void NewCarrierDetectionStart(PRTMP_ADAPTER pAd);
-void RTMPHandleRadarInterrupt(PRTMP_ADAPTER  pAd);
-VOID CSAsicDisableSync(IN PRTMP_ADAPTER pAd);
-#endif // TONE_RADAR_DETECT_SUPPORT //
-
-
-VOID BbpRadarDetectionStart(
-	IN PRTMP_ADAPTER pAd);
-
-VOID BbpRadarDetectionStop(
-	IN PRTMP_ADAPTER pAd);
-
-VOID RadarDetectionStart(
-	IN PRTMP_ADAPTER pAd,
-	IN BOOLEAN CTS_Protect,
-	IN UINT8 CTSPeriod);
-
-VOID RadarDetectionStop(
-	IN PRTMP_ADAPTER	pAd);
-
-VOID RadarDetectPeriodic(
-	IN PRTMP_ADAPTER	pAd);
-
-
-BOOLEAN RadarChannelCheck(
-	IN PRTMP_ADAPTER	pAd,
-	IN UCHAR			Ch);
-
-ULONG JapRadarType(
-	IN PRTMP_ADAPTER pAd);
-
-ULONG RTMPBbpReadRadarDuration(
-	IN PRTMP_ADAPTER	pAd);
-
-ULONG RTMPReadRadarDuration(
-	IN PRTMP_ADAPTER	pAd);
-
-VOID RTMPCleanRadarDuration(
-	IN PRTMP_ADAPTER	pAd);
-
-VOID RTMPPrepareRDCTSFrame(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			pDA,
-	IN	ULONG			Duration,
-	IN  UCHAR           RTSRate,
-	IN  ULONG           CTSBaseAddr,
-	IN  UCHAR			FrameGap);
-
-VOID RTMPPrepareRadarDetectParams(
-	IN PRTMP_ADAPTER	pAd);
-
-
-INT Set_ChMovingTime_Proc(
-	IN PRTMP_ADAPTER pAd,
-	IN PSTRING arg);
-
-INT Set_LongPulseRadarTh_Proc(
-	IN PRTMP_ADAPTER pAd,
-	IN PSTRING arg);
diff --git a/drivers/staging/rt3090/firmware.h b/drivers/staging/rt3090/firmware.h
index f2836a22cb8e..17056e26795b 100644
--- a/drivers/staging/rt3090/firmware.h
+++ b/drivers/staging/rt3090/firmware.h
@@ -2,7 +2,7 @@
 /* AUTO GEN PLEASE DO NOT MODIFY IT */
 
 
-UCHAR FirmwareImage [] = {
+u8 FirmwareImage_3090 [] = {
 0x02, 0x02, 0xf3, 0x02, 0x02, 0xa1, 0x22, 0x22, 0xff, 0xff, 0xff, 0x02, 0x01, 0x27, 0xff, 0xff,
 0xff, 0xff, 0xff, 0x02, 0x00, 0x1e, 0xff, 0xff, 0xff, 0xff, 0xff, 0x02, 0x00, 0xd8, 0xc0, 0xe0,
 0xc0, 0xf0, 0xc0, 0x83, 0xc0, 0x82, 0xc0, 0xd0, 0x75, 0xd0, 0x18, 0xc2, 0xaf, 0x30, 0x45, 0x03,
diff --git a/drivers/staging/rt3090/igmp_snoop.h b/drivers/staging/rt3090/igmp_snoop.h
deleted file mode 100644
index 63f9692e0b35..000000000000
--- a/drivers/staging/rt3090/igmp_snoop.h
+++ /dev/null
@@ -1,152 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-    Module Name:
-    igmp_snoop.h
-
-    Abstract:
-    Miniport generic portion header file
-
-    Revision History:
-    Who         When          What
-    --------    ----------    ----------------------------------------------
-*/
-
-
-#ifndef __RTMP_IGMP_SNOOP_H__
-#define __RTMP_IGMP_SNOOP_H__
-
-#include "link_list.h"
-
-#define IGMP_PROTOCOL_DESCRIPTOR	0x02
-#define IGMP_V1_MEMBERSHIP_REPORT	0x12
-#define IGMP_V2_MEMBERSHIP_REPORT	0x16
-#define IGMP_LEAVE_GROUP			0x17
-#define IGMP_V3_MEMBERSHIP_REPORT	0x22
-
-#define MLD_V1_LISTENER_REPORT		131
-#define MLD_V1_LISTENER_DONE		132
-#define MLD_V2_LISTERNER_REPORT		143
-
-#define IGMPMAC_TB_ENTRY_AGEOUT_TIME 120 * OS_HZ
-
-#define MULTICAST_ADDR_HASH_INDEX(Addr)      (MAC_ADDR_HASH(Addr) % (MAX_LEN_OF_MULTICAST_FILTER_HASH_TABLE))
-
-#define IS_MULTICAST_MAC_ADDR(Addr)			((((Addr[0]) & 0x01) == 0x01) && ((Addr[0]) != 0xff))
-#define IS_BROADCAST_MAC_ADDR(Addr)			((((Addr[0]) & 0xff) == 0xff))
-
-VOID MulticastFilterTableInit(
-	IN PMULTICAST_FILTER_TABLE *ppMulticastFilterTable);
-
-VOID MultiCastFilterTableReset(
-	IN PMULTICAST_FILTER_TABLE *ppMulticastFilterTable);
-
-BOOLEAN MulticastFilterTableInsertEntry(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR pGrpId,
-	IN PUCHAR pMemberAddr,
-	IN PNET_DEV dev,
-	IN MulticastFilterEntryType type);
-
-BOOLEAN MulticastFilterTableDeleteEntry(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR pGrpId,
-	IN PUCHAR pMemberAddr,
-	IN PNET_DEV dev);
-
-PMULTICAST_FILTER_TABLE_ENTRY MulticastFilterTableLookup(
-	IN PMULTICAST_FILTER_TABLE pMulticastFilterTable,
-	IN PUCHAR pAddr,
-	IN PNET_DEV dev);
-
-BOOLEAN isIgmpPkt(
-	IN PUCHAR pDstMacAddr,
-	IN PUCHAR pIpHeader);
-
-VOID IGMPSnooping(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR pDstMacAddr,
-	IN PUCHAR pSrcMacAddr,
-	IN PUCHAR pIpHeader,
-	IN PNET_DEV pDev);
-
-BOOLEAN isMldPkt(
-	IN PUCHAR pDstMacAddr,
-	IN PUCHAR pIpHeader,
-	OUT UINT8 *pProtoType,
-	OUT PUCHAR *pMldHeader);
-
-VOID MLDSnooping(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR pDstMacAddr,
-	IN PUCHAR pSrcMacAddr,
-	IN PUCHAR pIpHeader,
-	IN PNET_DEV pDev);
-
-UCHAR IgmpMemberCnt(
-	IN PLIST_HEADER pList);
-
-VOID IgmpGroupDelMembers(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR pMemberAddr,
-	IN PNET_DEV pDev);
-
-INT Set_IgmpSn_Enable_Proc(
-	IN PRTMP_ADAPTER pAd,
-	IN PSTRING arg);
-
-INT Set_IgmpSn_AddEntry_Proc(
-	IN PRTMP_ADAPTER pAd,
-	IN PSTRING arg);
-
-INT Set_IgmpSn_DelEntry_Proc(
-	IN PRTMP_ADAPTER pAd,
-	IN PSTRING arg);
-
-INT Set_IgmpSn_TabDisplay_Proc(
-	IN PRTMP_ADAPTER pAd,
-	IN PSTRING arg);
-
-void rtmp_read_igmp_snoop_from_file(
-	IN  PRTMP_ADAPTER pAd,
-	PSTRING tmpbuf,
-	PSTRING buffer);
-
-NDIS_STATUS IgmpPktInfoQuery(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR pSrcBufVA,
-	IN PNDIS_PACKET pPacket,
-	IN UCHAR apidx,
-	OUT BOOLEAN *pInIgmpGroup,
-	OUT PMULTICAST_FILTER_TABLE_ENTRY *ppGroupEntry);
-
-NDIS_STATUS IgmpPktClone(
-	IN PRTMP_ADAPTER pAd,
-	IN PNDIS_PACKET pPacket,
-	IN UCHAR QueIdx,
-	IN PMULTICAST_FILTER_TABLE_ENTRY pGroupEntry);
-
-#endif /* __RTMP_IGMP_SNOOP_H__ */
diff --git a/drivers/staging/rt3090/ipv6.h b/drivers/staging/rt3090/ipv6.h
deleted file mode 100644
index c34a5f2569dd..000000000000
--- a/drivers/staging/rt3090/ipv6.h
+++ /dev/null
@@ -1,215 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-    Module Name:
-    ipv6.h
-
-    Abstract:
-    Miniport generic portion header file
-
-    Revision History:
-    Who         When          What
-    --------    ----------    ----------------------------------------------
-*/
-
-#ifndef __IPV6_HDR_H_
-#define __IPV6_HDR_H_
-
-#define IPV6_ADDR_LEN 16
-#define IPV6_HDR_LEN  40
-
-// IPv6 address definition
-#define IPV6_LINK_LOCAL_ADDR_PREFIX		0xFE8
-#define IPV6_SITE_LOCAL_ADDR_PREFIX		0xFEC
-#define IPV6_LOCAL_ADDR_PREFIX			0xFE8
-#define IPV6_MULTICAST_ADDR_PREFIX		0xFF
-#define IPV6_LOOPBACK_ADDR				0x1
-#define IPV6_UNSPECIFIED_ADDR			0x0
-
-// defined as sequence in IPv6 header
-#define IPV6_NEXT_HEADER_HOP_BY_HOP		0x00	// 0
-#define IPV6_NEXT_HEADER_DESTINATION	0x3c	// 60
-#define IPV6_NEXT_HEADER_ROUTING		0x2b	// 43
-#define IPV6_NEXT_HEADER_FRAGMENT		0x2c	// 44
-#define IPV6_NEXT_HEADER_AUTHENTICATION	0x33	// 51
-#define IPV6_NEXT_HEADER_ENCAPSULATION	0x32	// 50, RFC-2406
-#define IPV6_NEXT_HEADER_NONE			0x3b	// 59
-
-#define IPV6_NEXT_HEADER_TCP			0x06
-#define IPV6_NEXT_HEADER_UDP			0x11
-#define IPV6_NEXT_HEADER_ICMPV6			0x3a
-
-// ICMPv6 msg type definition
-#define ICMPV6_MSG_TYPE_ROUTER_SOLICITATION			0x85 // 133
-#define ROUTER_SOLICITATION_FIXED_LEN				8
-
-#define ICMPV6_MSG_TYPE_ROUTER_ADVERTISEMENT		0x86 // 134
-#define ROUTER_ADVERTISEMENT_FIXED_LEN				16
-
-#define ICMPV6_MSG_TYPE_NEIGHBOR_SOLICITATION		0x87 // 135
-#define NEIGHBOR_SOLICITATION_FIXED_LEN				24
-
-#define ICMPV6_MSG_TYPE_NEIGHBOR_ADVERTISEMENT		0x88 // 136
-#define NEIGHBOR_ADVERTISEMENT_FIXED_LEN			24
-
-#define ICMPV6_MSG_TYPE_REDIRECT					0x89 // 137
-#define REDIRECT_FIXED_LEN							40
-
-/* IPv6 Address related structures */
-typedef struct rt_ipv6_addr_
-{
-	union
-	{
-		UCHAR	ipv6Addr8[16];
-		USHORT	ipv6Addr16[8];
-		UINT32	ipv6Addr32[4];
-	}addr;
-#define ipv6_addr			addr.ipv6Addr8
-#define ipv6_addr16			addr.ipv6Addr16
-#define ipv6_addr32			addr.ipv6Addr32
-}RT_IPV6_ADDR, *PRT_IPV6_ADDR;
-
-
-#define PRINT_IPV6_ADDR(ipv6Addr)	\
-	OS_NTOHS((ipv6Addr).ipv6_addr16[0]), \
-	OS_NTOHS((ipv6Addr).ipv6_addr16[1]), \
-	OS_NTOHS((ipv6Addr).ipv6_addr16[2]), \
-	OS_NTOHS((ipv6Addr).ipv6_addr16[3]), \
-	OS_NTOHS((ipv6Addr).ipv6_addr16[4]), \
-	OS_NTOHS((ipv6Addr).ipv6_addr16[5]), \
-	OS_NTOHS((ipv6Addr).ipv6_addr16[6]), \
-	OS_NTOHS((ipv6Addr).ipv6_addr16[7])
-
-
-/*IPv6 Header related structures */
-typedef struct PACKED _rt_ipv6_hdr_
-{
-	UINT32			ver:4,
-					trafficClass:8,
-				flowLabel:20;
-	USHORT			payload_len;
-	UCHAR			nextHdr;
-	UCHAR			hopLimit;
-	RT_IPV6_ADDR	srcAddr;
-	RT_IPV6_ADDR	dstAddr;
-}RT_IPV6_HDR, *PRT_IPV6_HDR;
-
-
-typedef struct PACKED _rt_ipv6_ext_hdr_
-{
-	UCHAR	nextProto; // Indicate the protocol type of next extension header.
-	UCHAR	extHdrLen; // optional field for msg length of this extension header which didn't include the first "nextProto" field.
-	UCHAR	octets[1]; // hook to extend header message body.
-}RT_IPV6_EXT_HDR, *PRT_IPV6_EXT_HDR;
-
-
-/* ICMPv6 related structures */
-typedef struct PACKED _rt_ipv6_icmpv6_hdr_
-{
-	UCHAR	type;
-	UCHAR	code;
-	USHORT	chksum;
-	UCHAR	octets[1]; //hook to extend header message body.
-}RT_ICMPV6_HDR, *PRT_ICMPV6_HDR;
-
-
-typedef struct PACKED _rt_icmp6_option_hdr_
-{
-	UCHAR type;
-	UCHAR len;
-	UCHAR octet[1];
-}RT_ICMPV6_OPTION_HDR, *PRT_ICMPV6_OPTION_HDR;
-
-typedef enum{
-// Defined ICMPv6 Option Types.
-	TYPE_SRC_LL_ADDR	= 1,
-	TYPE_TGT_LL_ADDR	= 2,
-	TYPE_PREFIX_INFO			= 3,
-	TYPE_REDIRECTED_HDR			= 4,
-	TYPE_MTU					= 5,
-}ICMPV6_OPTIONS_TYPE_DEF;
-
-
-static inline BOOLEAN IPv6ExtHdrHandle(
-	RT_IPV6_EXT_HDR		*pExtHdr,
-	UCHAR				*pProto,
-	UINT32				*pOffset)
-{
-	UCHAR nextProto = 0xff;
-	UINT32 extLen = 0;
-	BOOLEAN status = TRUE;
-
-	//printk("%s(): parsing the Extension Header with Protocol(0x%x):\n", __FUNCTION__, *pProto);
-	switch (*pProto)
-	{
-		case IPV6_NEXT_HEADER_HOP_BY_HOP:
-			// IPv6ExtHopByHopHandle();
-			nextProto = pExtHdr->nextProto;
-			extLen = (pExtHdr->extHdrLen + 1) * 8;
-			break;
-
-		case IPV6_NEXT_HEADER_DESTINATION:
-			// IPv6ExtDestHandle();
-			nextProto = pExtHdr->nextProto;
-			extLen = (pExtHdr->extHdrLen + 1) * 8;
-			break;
-
-		case IPV6_NEXT_HEADER_ROUTING:
-			// IPv6ExtRoutingHandle();
-			nextProto = pExtHdr->nextProto;
-			extLen = (pExtHdr->extHdrLen + 1) * 8;
-			break;
-
-		case IPV6_NEXT_HEADER_FRAGMENT:
-			// IPv6ExtFragmentHandle();
-			nextProto = pExtHdr->nextProto;
-			extLen = 8; // The Fragment header length is fixed to 8 bytes.
-			break;
-
-		case IPV6_NEXT_HEADER_AUTHENTICATION:
-		//   IPV6_NEXT_HEADER_ENCAPSULATION:
-			/*
-				TODO: Not support. For encryption issue.
-			*/
-			nextProto = 0xFF;
-			status = FALSE;
-			break;
-
-		default:
-			nextProto = 0xFF;
-			status = FALSE;
-			break;
-	}
-
-	*pProto = nextProto;
-	*pOffset += extLen;
-	//printk("%s(): nextProto = 0x%x!, offset=0x%x!\n", __FUNCTION__, nextProto, offset);
-
-	return status;
-
-}
-
-#endif // __IPV6_HDR_H_ //
diff --git a/drivers/staging/rt3090/link_list.h b/drivers/staging/rt3090/link_list.h
deleted file mode 100644
index 205b610bfb90..000000000000
--- a/drivers/staging/rt3090/link_list.h
+++ /dev/null
@@ -1,133 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
- */
-
-#ifndef __LINK_LIST_H__
-#define __LINK_LIST_H__
-
-typedef struct _LIST_ENTRY
-{
-	struct _LIST_ENTRY *pNext;
-} LIST_ENTRY, *PLIST_ENTRY;
-
-typedef struct _LIST_HEADR
-{
-	PLIST_ENTRY pHead;
-	PLIST_ENTRY pTail;
-	UCHAR size;
-} LIST_HEADER, *PLIST_HEADER;
-
-static inline VOID initList(
-	IN PLIST_HEADER pList)
-{
-	pList->pHead = pList->pTail = NULL;
-	pList->size = 0;
-	return;
-}
-
-static inline VOID insertTailList(
-	IN PLIST_HEADER pList,
-	IN PLIST_ENTRY pEntry)
-{
-	pEntry->pNext = NULL;
-	if (pList->pTail)
-		pList->pTail->pNext = pEntry;
-	else
-		pList->pHead = pEntry;
-	pList->pTail = pEntry;
-	pList->size++;
-
-	return;
-}
-
-static inline PLIST_ENTRY removeHeadList(
-	IN PLIST_HEADER pList)
-{
-	PLIST_ENTRY pNext;
-	PLIST_ENTRY pEntry;
-
-	pEntry = pList->pHead;
-	if (pList->pHead != NULL)
-	{
-		pNext = pList->pHead->pNext;
-		pList->pHead = pNext;
-		if (pNext == NULL)
-			pList->pTail = NULL;
-		pList->size--;
-	}
-	return pEntry;
-}
-
-static inline int getListSize(
-	IN PLIST_HEADER pList)
-{
-	return pList->size;
-}
-
-static inline PLIST_ENTRY delEntryList(
-	IN PLIST_HEADER pList,
-	IN PLIST_ENTRY pEntry)
-{
-	PLIST_ENTRY pCurEntry;
-	PLIST_ENTRY pPrvEntry;
-
-	if(pList->pHead == NULL)
-		return NULL;
-
-	if(pEntry == pList->pHead)
-	{
-		pCurEntry = pList->pHead;
-		pList->pHead = pCurEntry->pNext;
-
-		if(pList->pHead == NULL)
-			pList->pTail = NULL;
-
-		pList->size--;
-		return pCurEntry;
-	}
-
-	pPrvEntry = pList->pHead;
-	pCurEntry = pPrvEntry->pNext;
-	while(pCurEntry != NULL)
-	{
-		if (pEntry == pCurEntry)
-		{
-			pPrvEntry->pNext = pCurEntry->pNext;
-
-			if(pEntry == pList->pTail)
-				pList->pTail = pPrvEntry;
-
-			pList->size--;
-			break;
-		}
-		pPrvEntry = pCurEntry;
-		pCurEntry = pPrvEntry->pNext;
-	}
-
-	return pCurEntry;
-}
-
-#endif // ___LINK_LIST_H__ //
diff --git a/drivers/staging/rt3090/mlme.h b/drivers/staging/rt3090/mlme.h
deleted file mode 100644
index 233674397a73..000000000000
--- a/drivers/staging/rt3090/mlme.h
+++ /dev/null
@@ -1,1360 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-    Module Name:
-    mlme.h
-
-    Abstract:
-    Miniport generic portion header file
-
-    Revision History:
-    Who         When          What
-    --------    ----------    ----------------------------------------------
-	John Chang	2003-08-28		Created
-	John Chang  2004-09-06      modified for RT2600
-*/
-#ifndef __MLME_H__
-#define __MLME_H__
-
-#include "rtmp_dot11.h"
-
-#ifdef CONFIG_STA_SUPPORT
-#endif // CONFIG_STA_SUPPORT //
-
-
-// maximum supported capability information -
-// ESS, IBSS, Privacy, Short Preamble, Spectrum mgmt, Short Slot
-#define SUPPORTED_CAPABILITY_INFO   0x0533
-
-#define END_OF_ARGS                 -1
-#define LFSR_MASK                   0x80000057
-#define MLME_TASK_EXEC_INTV         100/*200*/       //
-#define LEAD_TIME                   5
-#define MLME_TASK_EXEC_MULTIPLE       10  /*5*/       // MLME_TASK_EXEC_MULTIPLE * MLME_TASK_EXEC_INTV = 1 sec
-#define REORDER_EXEC_INTV		100       // 0.1 sec
-//#define TBTT_PRELOAD_TIME         384        // usec. LomgPreamble + 24-byte at 1Mbps
-
-// The definition of Radar detection duration region
-#define CE		0
-#define FCC		1
-#define JAP		2
-#define JAP_W53	3
-#define JAP_W56	4
-#define MAX_RD_REGION 5
-
-#define BEACON_LOST_TIME            4 * OS_HZ    // 2048 msec = 2 sec
-
-#define DLS_TIMEOUT                 1200      // unit: msec
-#define AUTH_TIMEOUT                300       // unit: msec
-#define ASSOC_TIMEOUT               300       // unit: msec
-#define JOIN_TIMEOUT                2000        // unit: msec
-#define SHORT_CHANNEL_TIME          90        // unit: msec
-#define MIN_CHANNEL_TIME            110        // unit: msec, for dual band scan
-#define MAX_CHANNEL_TIME            140       // unit: msec, for single band scan
-#define	FAST_ACTIVE_SCAN_TIME	    30		  // Active scan waiting for probe response time
-#define CW_MIN_IN_BITS              4         // actual CwMin = 2^CW_MIN_IN_BITS - 1
-#define LINK_DOWN_TIMEOUT           20000      // unit: msec
-#define AUTO_WAKEUP_TIMEOUT			70			//unit: msec
-
-
-#ifdef CONFIG_STA_SUPPORT
-#define CW_MAX_IN_BITS              10        // actual CwMax = 2^CW_MAX_IN_BITS - 1
-#endif // CONFIG_STA_SUPPORT //
-
-#ifdef CONFIG_APSTA_MIXED_SUPPORT
-extern UINT32 CW_MAX_IN_BITS;
-#endif // CONFIG_APSTA_MIXED_SUPPORT //
-
-// Note: RSSI_TO_DBM_OFFSET has been changed to variable for new RF (2004-0720).
-// SHould not refer to this constant anymore
-//#define RSSI_TO_DBM_OFFSET          120 // for RT2530 RSSI-115 = dBm
-#define RSSI_FOR_MID_TX_POWER       -55  // -55 db is considered mid-distance
-#define RSSI_FOR_LOW_TX_POWER       -45  // -45 db is considered very short distance and
-                                        // eligible to use a lower TX power
-#define RSSI_FOR_LOWEST_TX_POWER    -30
-//#define MID_TX_POWER_DELTA          0   // 0 db from full TX power upon mid-distance to AP
-#define LOW_TX_POWER_DELTA          6    // -3 db from full TX power upon very short distance. 1 grade is 0.5 db
-#define LOWEST_TX_POWER_DELTA       16   // -8 db from full TX power upon shortest distance. 1 grade is 0.5 db
-
-#define RSSI_TRIGGERED_UPON_BELOW_THRESHOLD     0
-#define RSSI_TRIGGERED_UPON_EXCCEED_THRESHOLD   1
-#define RSSI_THRESHOLD_FOR_ROAMING              25
-#define RSSI_DELTA                              5
-
-// Channel Quality Indication
-#define CQI_IS_GOOD(cqi)            ((cqi) >= 50)
-//#define CQI_IS_FAIR(cqi)          (((cqi) >= 20) && ((cqi) < 50))
-#define CQI_IS_POOR(cqi)            (cqi < 50)  //(((cqi) >= 5) && ((cqi) < 20))
-#define CQI_IS_BAD(cqi)             (cqi < 5)
-#define CQI_IS_DEAD(cqi)            (cqi == 0)
-
-// weighting factor to calculate Channel quality, total should be 100%
-#define RSSI_WEIGHTING                   50
-#define TX_WEIGHTING                     30
-#define RX_WEIGHTING                     20
-
-//#define PEER_KEY_NOT_USED                0
-//#define PEER_KEY_64_BIT                  64
-//#define PEER_KEY_128_BIT                 128
-
-//#define PEER_KEY_64BIT_LEN               8
-//#define PEER_KEY_128BIT_LEN              16
-
-#define BSS_NOT_FOUND                    0xFFFFFFFF
-
-
-#ifdef CONFIG_STA_SUPPORT
-#define MAX_LEN_OF_MLME_QUEUE            40 //10
-#endif // CONFIG_STA_SUPPORT //
-
-#define SCAN_PASSIVE                     18		// scan with no probe request, only wait beacon and probe response
-#define SCAN_ACTIVE                      19		// scan with probe request, and wait beacon and probe response
-#define	SCAN_CISCO_PASSIVE				 20		// Single channel passive scan
-#define	SCAN_CISCO_ACTIVE				 21		// Single channel active scan
-#define	SCAN_CISCO_NOISE				 22		// Single channel passive scan for noise histogram collection
-#define	SCAN_CISCO_CHANNEL_LOAD			 23		// Single channel passive scan for channel load collection
-#define FAST_SCAN_ACTIVE                 24		// scan with probe request, and wait beacon and probe response
-
-#ifdef DOT11N_DRAFT3
-#define SCAN_2040_BSS_COEXIST                  26
-#endif // DOT11N_DRAFT3 //
-
-//#define BSS_TABLE_EMPTY(x)             ((x).BssNr == 0)
-#define MAC_ADDR_IS_GROUP(Addr)       (((Addr[0]) & 0x01))
-#define MAC_ADDR_HASH(Addr)            (Addr[0] ^ Addr[1] ^ Addr[2] ^ Addr[3] ^ Addr[4] ^ Addr[5])
-#define MAC_ADDR_HASH_INDEX(Addr)      (MAC_ADDR_HASH(Addr) % HASH_TABLE_SIZE)
-#define TID_MAC_HASH(Addr,TID)            (TID^Addr[0] ^ Addr[1] ^ Addr[2] ^ Addr[3] ^ Addr[4] ^ Addr[5])
-#define TID_MAC_HASH_INDEX(Addr,TID)      (TID_MAC_HASH(Addr,TID) % HASH_TABLE_SIZE)
-
-// LED Control
-// assoiation ON. one LED ON. another blinking when TX, OFF when idle
-// no association, both LED off
-#define ASIC_LED_ACT_ON(pAd)        RTMP_IO_WRITE32(pAd, MAC_CSR14, 0x00031e46)
-#define ASIC_LED_ACT_OFF(pAd)       RTMP_IO_WRITE32(pAd, MAC_CSR14, 0x00001e46)
-
-// bit definition of the 2-byte pBEACON->Capability field
-#define CAP_IS_ESS_ON(x)                 (((x) & 0x0001) != 0)
-#define CAP_IS_IBSS_ON(x)                (((x) & 0x0002) != 0)
-#define CAP_IS_CF_POLLABLE_ON(x)         (((x) & 0x0004) != 0)
-#define CAP_IS_CF_POLL_REQ_ON(x)         (((x) & 0x0008) != 0)
-#define CAP_IS_PRIVACY_ON(x)             (((x) & 0x0010) != 0)
-#define CAP_IS_SHORT_PREAMBLE_ON(x)      (((x) & 0x0020) != 0)
-#define CAP_IS_PBCC_ON(x)                (((x) & 0x0040) != 0)
-#define CAP_IS_AGILITY_ON(x)             (((x) & 0x0080) != 0)
-#define CAP_IS_SPECTRUM_MGMT(x)          (((x) & 0x0100) != 0)  // 802.11e d9
-#define CAP_IS_QOS(x)                    (((x) & 0x0200) != 0)  // 802.11e d9
-#define CAP_IS_SHORT_SLOT(x)             (((x) & 0x0400) != 0)
-#define CAP_IS_APSD(x)                   (((x) & 0x0800) != 0)  // 802.11e d9
-#define CAP_IS_IMMED_BA(x)               (((x) & 0x1000) != 0)  // 802.11e d9
-#define CAP_IS_DSSS_OFDM(x)              (((x) & 0x2000) != 0)
-#define CAP_IS_DELAY_BA(x)               (((x) & 0x4000) != 0)  // 802.11e d9
-
-#define CAP_GENERATE(ess,ibss,priv,s_pre,s_slot,spectrum)  (((ess) ? 0x0001 : 0x0000) | ((ibss) ? 0x0002 : 0x0000) | ((priv) ? 0x0010 : 0x0000) | ((s_pre) ? 0x0020 : 0x0000) | ((s_slot) ? 0x0400 : 0x0000) | ((spectrum) ? 0x0100 : 0x0000))
-
-//#define STA_QOS_CAPABILITY               0 // 1-byte. see 802.11e d9.0 for bit definition
-
-#define ERP_IS_NON_ERP_PRESENT(x)        (((x) & 0x01) != 0)    // 802.11g
-#define ERP_IS_USE_PROTECTION(x)         (((x) & 0x02) != 0)    // 802.11g
-#define ERP_IS_USE_BARKER_PREAMBLE(x)    (((x) & 0x04) != 0)    // 802.11g
-
-#define DRS_TX_QUALITY_WORST_BOUND       8// 3  // just test by gary
-#define DRS_PENALTY                      8
-
-#define BA_NOTUSE	2
-//BA Policy subfiled value in ADDBA frame
-#define IMMED_BA	1
-#define DELAY_BA	0
-
-// BA Initiator subfield in DELBA frame
-#define ORIGINATOR	1
-#define RECIPIENT	0
-
-// ADDBA Status Code
-#define ADDBA_RESULTCODE_SUCCESS					0
-#define ADDBA_RESULTCODE_REFUSED					37
-#define ADDBA_RESULTCODE_INVALID_PARAMETERS			38
-
-// DELBA Reason Code
-#define DELBA_REASONCODE_QSTA_LEAVING				36
-#define DELBA_REASONCODE_END_BA						37
-#define DELBA_REASONCODE_UNKNOWN_BA					38
-#define DELBA_REASONCODE_TIMEOUT					39
-
-// reset all OneSecTx counters
-#define RESET_ONE_SEC_TX_CNT(__pEntry) \
-if (((__pEntry)) != NULL) \
-{ \
-	(__pEntry)->OneSecTxRetryOkCount = 0; \
-	(__pEntry)->OneSecTxFailCount = 0; \
-	(__pEntry)->OneSecTxNoRetryOkCount = 0; \
-}
-
-//
-// 802.11 frame formats
-//
-//  HT Capability INFO field in HT Cap IE .
-typedef struct PACKED {
-#ifdef RT_BIG_ENDIAN
-	USHORT	LSIGTxopProSup:1;
-	USHORT	Forty_Mhz_Intolerant:1;
-	USHORT	PSMP:1;
-	USHORT	CCKmodein40:1;
-	USHORT	AMsduSize:1;
-	USHORT	DelayedBA:1;	//rt2860c not support
-	USHORT	RxSTBC:2;
-	USHORT	TxSTBC:1;
-	USHORT	ShortGIfor40:1;	//for40MHz
-	USHORT	ShortGIfor20:1;
-	USHORT	GF:1;	//green field
-	USHORT	MimoPs:2;//momi power safe
-	USHORT	ChannelWidth:1;
-	USHORT	AdvCoding:1;
-#else
-	USHORT	AdvCoding:1;
-	USHORT	ChannelWidth:1;
-	USHORT	MimoPs:2;//momi power safe
-	USHORT	GF:1;	//green field
-	USHORT	ShortGIfor20:1;
-	USHORT	ShortGIfor40:1;	//for40MHz
-	USHORT	TxSTBC:1;
-	USHORT	RxSTBC:2;
-	USHORT	DelayedBA:1;	//rt2860c not support
-	USHORT	AMsduSize:1;	// only support as zero
-	USHORT	CCKmodein40:1;
-	USHORT	PSMP:1;
-	USHORT	Forty_Mhz_Intolerant:1;
-	USHORT	LSIGTxopProSup:1;
-#endif	/* !RT_BIG_ENDIAN */
-} HT_CAP_INFO, *PHT_CAP_INFO;
-
-//  HT Capability INFO field in HT Cap IE .
-typedef struct PACKED {
-#ifdef RT_BIG_ENDIAN
-	UCHAR	rsv:3;//momi power safe
-	UCHAR	MpduDensity:3;
-	UCHAR	MaxRAmpduFactor:2;
-#else
-	UCHAR	MaxRAmpduFactor:2;
-	UCHAR	MpduDensity:3;
-	UCHAR	rsv:3;//momi power safe
-#endif /* !RT_BIG_ENDIAN */
-} HT_CAP_PARM, *PHT_CAP_PARM;
-
-//  HT Capability INFO field in HT Cap IE .
-typedef struct PACKED {
-	UCHAR	MCSSet[10];
-	UCHAR	SupRate[2];  // unit : 1Mbps
-#ifdef RT_BIG_ENDIAN
-	UCHAR	rsv:3;
-	UCHAR	MpduDensity:1;
-	UCHAR	TxStream:2;
-	UCHAR	TxRxNotEqual:1;
-	UCHAR	TxMCSSetDefined:1;
-#else
-	UCHAR	TxMCSSetDefined:1;
-	UCHAR	TxRxNotEqual:1;
-	UCHAR	TxStream:2;
-	UCHAR	MpduDensity:1;
-	UCHAR	rsv:3;
-#endif // RT_BIG_ENDIAN //
-	UCHAR	rsv3[3];
-} HT_MCS_SET, *PHT_MCS_SET;
-
-//  HT Capability INFO field in HT Cap IE .
-typedef struct PACKED {
-#ifdef RT_BIG_ENDIAN
-	USHORT	rsv2:4;
-	USHORT	RDGSupport:1;	//reverse Direction Grant  support
-	USHORT	PlusHTC:1;	//+HTC control field support
-	USHORT	MCSFeedback:2;	//0:no MCS feedback, 2:unsolicited MCS feedback, 3:Full MCS feedback,  1:rsv.
-	USHORT	rsv:5;//momi power safe
-	USHORT	TranTime:2;
-	USHORT	Pco:1;
-#else
-	USHORT	Pco:1;
-	USHORT	TranTime:2;
-	USHORT	rsv:5;//momi power safe
-	USHORT	MCSFeedback:2;	//0:no MCS feedback, 2:unsolicited MCS feedback, 3:Full MCS feedback,  1:rsv.
-	USHORT	PlusHTC:1;	//+HTC control field support
-	USHORT	RDGSupport:1;	//reverse Direction Grant  support
-	USHORT	rsv2:4;
-#endif /* RT_BIG_ENDIAN */
-} EXT_HT_CAP_INFO, *PEXT_HT_CAP_INFO;
-
-//  HT Beamforming field in HT Cap IE .
-typedef struct PACKED _HT_BF_CAP{
-#ifdef RT_BIG_ENDIAN
-	ULONG	rsv:3;
-	ULONG	ChanEstimation:2;
-	ULONG	CSIRowBFSup:2;
-	ULONG	ComSteerBFAntSup:2;
-	ULONG	NoComSteerBFAntSup:2;
-	ULONG	CSIBFAntSup:2;
-	ULONG	MinGrouping:2;
-	ULONG	ExpComBF:2;
-	ULONG	ExpNoComBF:2;
-	ULONG	ExpCSIFbk:2;
-	ULONG	ExpComSteerCapable:1;
-	ULONG	ExpNoComSteerCapable:1;
-	ULONG	ExpCSICapable:1;
-	ULONG	Calibration:2;
-	ULONG	ImpTxBFCapable:1;
-	ULONG	TxNDPCapable:1;
-	ULONG	RxNDPCapable:1;
-	ULONG	TxSoundCapable:1;
-	ULONG	RxSoundCapable:1;
-	ULONG	TxBFRecCapable:1;
-#else
-	ULONG	TxBFRecCapable:1;
-	ULONG	RxSoundCapable:1;
-	ULONG	TxSoundCapable:1;
-	ULONG	RxNDPCapable:1;
-	ULONG	TxNDPCapable:1;
-	ULONG	ImpTxBFCapable:1;
-	ULONG	Calibration:2;
-	ULONG	ExpCSICapable:1;
-	ULONG	ExpNoComSteerCapable:1;
-	ULONG	ExpComSteerCapable:1;
-	ULONG	ExpCSIFbk:2;
-	ULONG	ExpNoComBF:2;
-	ULONG	ExpComBF:2;
-	ULONG	MinGrouping:2;
-	ULONG	CSIBFAntSup:2;
-	ULONG	NoComSteerBFAntSup:2;
-	ULONG	ComSteerBFAntSup:2;
-	ULONG	CSIRowBFSup:2;
-	ULONG	ChanEstimation:2;
-	ULONG	rsv:3;
-#endif // RT_BIG_ENDIAN //
-} HT_BF_CAP, *PHT_BF_CAP;
-
-//  HT antenna selection field in HT Cap IE .
-typedef struct PACKED _HT_AS_CAP{
-#ifdef RT_BIG_ENDIAN
-	UCHAR	rsv:1;
-	UCHAR	TxSoundPPDU:1;
-	UCHAR	RxASel:1;
-	UCHAR	AntIndFbk:1;
-	UCHAR	ExpCSIFbk:1;
-	UCHAR	AntIndFbkTxASEL:1;
-	UCHAR	ExpCSIFbkTxASEL:1;
-	UCHAR	AntSelect:1;
-#else
-	UCHAR	AntSelect:1;
-	UCHAR	ExpCSIFbkTxASEL:1;
-	UCHAR	AntIndFbkTxASEL:1;
-	UCHAR	ExpCSIFbk:1;
-	UCHAR	AntIndFbk:1;
-	UCHAR	RxASel:1;
-	UCHAR	TxSoundPPDU:1;
-	UCHAR	rsv:1;
-#endif // RT_BIG_ENDIAN //
-} HT_AS_CAP, *PHT_AS_CAP;
-
-// Draft 1.0 set IE length 26, but is extensible..
-#define SIZE_HT_CAP_IE		26
-// The structure for HT Capability IE.
-typedef struct PACKED _HT_CAPABILITY_IE{
-	HT_CAP_INFO		HtCapInfo;
-	HT_CAP_PARM		HtCapParm;
-//	HT_MCS_SET		HtMCSSet;
-	UCHAR			MCSSet[16];
-	EXT_HT_CAP_INFO	ExtHtCapInfo;
-	HT_BF_CAP		TxBFCap;	// beamforming cap. rt2860c not support beamforming.
-	HT_AS_CAP		ASCap;	//antenna selection.
-} HT_CAPABILITY_IE, *PHT_CAPABILITY_IE;
-
-
-// 802.11n draft3 related structure definitions.
-// 7.3.2.60
-#define dot11OBSSScanPassiveDwell							20	// in TU. min amount of time that the STA continously scans each channel when performing an active OBSS scan.
-#define dot11OBSSScanActiveDwell							10	// in TU.min amount of time that the STA continously scans each channel when performing an passive OBSS scan.
-#define dot11BSSWidthTriggerScanInterval					300  // in sec. max interval between scan operations to be performed to detect BSS channel width trigger events.
-#define dot11OBSSScanPassiveTotalPerChannel					200	// in TU. min total amount of time that the STA scans each channel when performing a passive OBSS scan.
-#define dot11OBSSScanActiveTotalPerChannel					20	//in TU. min total amount of time that the STA scans each channel when performing a active OBSS scan
-#define dot11BSSWidthChannelTransactionDelayFactor			5	// min ratio between the delay time in performing a switch from 20MHz BSS to 20/40 BSS operation and the maximum
-																//	interval between overlapping BSS scan operations.
-#define dot11BSSScanActivityThreshold						25	// in %%, max total time that a STA may be active on the medium during a period of
-																//	(dot11BSSWidthChannelTransactionDelayFactor * dot11BSSWidthTriggerScanInterval) seconds without
-																//	being obligated to perform OBSS Scan operations. default is 25(== 0.25%)
-
-typedef struct PACKED _OVERLAP_BSS_SCAN_IE{
-	USHORT		ScanPassiveDwell;
-	USHORT		ScanActiveDwell;
-	USHORT		TriggerScanInt;				// Trigger scan interval
-	USHORT		PassiveTalPerChannel;		// passive total per channel
-	USHORT		ActiveTalPerChannel;		// active total per channel
-	USHORT		DelayFactor;				// BSS width channel transition delay factor
-	USHORT		ScanActThre;				// Scan Activity threshold
-}OVERLAP_BSS_SCAN_IE, *POVERLAP_BSS_SCAN_IE;
-
-
-//  7.3.2.56. 20/40 Coexistence element used in  Element ID = 72 = IE_2040_BSS_COEXIST
-typedef union PACKED _BSS_2040_COEXIST_IE{
- struct PACKED {
- #ifdef RT_BIG_ENDIAN
-	UCHAR	rsv:5;
-	UCHAR	BSS20WidthReq:1;
-	UCHAR	Intolerant40:1;
-	UCHAR	InfoReq:1;
- #else
-	UCHAR	InfoReq:1;
-	UCHAR	Intolerant40:1;			// Inter-BSS. set 1 when prohibits a receiving BSS from operating as a 20/40 Mhz BSS.
-	UCHAR	BSS20WidthReq:1;		// Intra-BSS set 1 when prohibits a receiving AP from operating its BSS as a 20/40MHz BSS.
-	UCHAR	rsv:5;
-#endif // RT_BIG_ENDIAN //
-    } field;
- UCHAR   word;
-} BSS_2040_COEXIST_IE, *PBSS_2040_COEXIST_IE;
-
-
-typedef struct  _TRIGGER_EVENTA{
-	BOOLEAN			bValid;
-	UCHAR	BSSID[6];
-	UCHAR	RegClass;	// Regulatory Class
-	USHORT	Channel;
-	ULONG	CDCounter;   // Maintain a seperate count down counter for each Event A.
-} TRIGGER_EVENTA, *PTRIGGER_EVENTA;
-
-// 20/40 trigger event table
-// If one Event A delete or created, or if Event B is detected or not detected, STA should send 2040BSSCoexistence to AP.
-#define MAX_TRIGGER_EVENT		64
-typedef struct  _TRIGGER_EVENT_TAB{
-	UCHAR	EventANo;
-	TRIGGER_EVENTA	EventA[MAX_TRIGGER_EVENT];
-	ULONG			EventBCountDown;	// Count down counter for Event B.
-} TRIGGER_EVENT_TAB, *PTRIGGER_EVENT_TAB;
-
-// 7.3.27 20/40 Bss Coexistence Mgmt capability used in extended capabilities information IE( ID = 127 = IE_EXT_CAPABILITY).
-//	This is the first octet and was defined in 802.11n D3.03 and 802.11yD9.0
-typedef struct PACKED _EXT_CAP_INFO_ELEMENT{
-#ifdef RT_BIG_ENDIAN
-	UCHAR	rsv2:5;
-	UCHAR	ExtendChannelSwitch:1;
-	UCHAR	rsv:1;
-	UCHAR	BssCoexistMgmtSupport:1;
-#else
-	UCHAR	BssCoexistMgmtSupport:1;
-	UCHAR	rsv:1;
-	UCHAR	ExtendChannelSwitch:1;
-	UCHAR	rsv2:5;
-#endif // RT_BIG_ENDIAN //
-}EXT_CAP_INFO_ELEMENT, *PEXT_CAP_INFO_ELEMENT;
-
-
-// 802.11n 7.3.2.61
-typedef struct PACKED _BSS_2040_COEXIST_ELEMENT{
-	UCHAR					ElementID;		// ID = IE_2040_BSS_COEXIST = 72
-	UCHAR					Len;
-	BSS_2040_COEXIST_IE		BssCoexistIe;
-}BSS_2040_COEXIST_ELEMENT, *PBSS_2040_COEXIST_ELEMENT;
-
-
-//802.11n 7.3.2.59
-typedef struct PACKED _BSS_2040_INTOLERANT_CH_REPORT{
-	UCHAR				ElementID;		// ID = IE_2040_BSS_INTOLERANT_REPORT = 73
-	UCHAR				Len;
-	UCHAR				RegulatoryClass;
-	UCHAR				ChList[0];
-}BSS_2040_INTOLERANT_CH_REPORT, *PBSS_2040_INTOLERANT_CH_REPORT;
-
-
-// The structure for channel switch annoucement IE. This is in 802.11n D3.03
-typedef struct PACKED _CHA_SWITCH_ANNOUNCE_IE{
-	UCHAR			SwitchMode;	//channel switch mode
-	UCHAR			NewChannel;	//
-	UCHAR			SwitchCount;	//
-} CHA_SWITCH_ANNOUNCE_IE, *PCHA_SWITCH_ANNOUNCE_IE;
-
-
-// The structure for channel switch annoucement IE. This is in 802.11n D3.03
-typedef struct PACKED _SEC_CHA_OFFSET_IE{
-	UCHAR			SecondaryChannelOffset;	 // 1: Secondary above, 3: Secondary below, 0: no Secondary
-} SEC_CHA_OFFSET_IE, *PSEC_CHA_OFFSET_IE;
-
-
-// This structure is extracted from struct RT_HT_CAPABILITY
-typedef struct {
-	BOOLEAN			bHtEnable;	 // If we should use ht rate.
-	BOOLEAN			bPreNHt;	 // If we should use ht rate.
-	//Substract from HT Capability IE
-	UCHAR			MCSSet[16];
-} RT_HT_PHY_INFO, *PRT_HT_PHY_INFO;
-
-//This structure substracts ralink supports from all 802.11n-related features.
-//Features not listed here but contained in 802.11n spec are not supported in rt2860.
-typedef struct {
-#ifdef RT_BIG_ENDIAN
-	USHORT	rsv:5;
-	USHORT	AmsduSize:1;	// Max receiving A-MSDU size
-	USHORT	AmsduEnable:1;	// Enable to transmit A-MSDU. Suggest disable. We should use A-MPDU to gain best benifit of 802.11n
-	USHORT	RxSTBC:2;	// 2 bits
-	USHORT	TxSTBC:1;
-	USHORT	ShortGIfor40:1;	//for40MHz
-	USHORT	ShortGIfor20:1;
-	USHORT	GF:1;	//green field
-	USHORT	MimoPs:2;//mimo power safe MMPS_
-	USHORT	ChannelWidth:1;
-#else
-	USHORT	ChannelWidth:1;
-	USHORT	MimoPs:2;//mimo power safe MMPS_
-	USHORT	GF:1;	//green field
-	USHORT	ShortGIfor20:1;
-	USHORT	ShortGIfor40:1;	//for40MHz
-	USHORT	TxSTBC:1;
-	USHORT	RxSTBC:2;	// 2 bits
-	USHORT	AmsduEnable:1;	// Enable to transmit A-MSDU. Suggest disable. We should use A-MPDU to gain best benifit of 802.11n
-	USHORT	AmsduSize:1;	// Max receiving A-MSDU size
-	USHORT	rsv:5;
-#endif
-
-	//Substract from Addiont HT INFO IE
-#ifdef RT_BIG_ENDIAN
-	UCHAR	RecomWidth:1;
-	UCHAR	ExtChanOffset:2;	// Please not the difference with following	UCHAR	NewExtChannelOffset; from 802.11n
-	UCHAR	MpduDensity:3;
-	UCHAR	MaxRAmpduFactor:2;
-#else
-	UCHAR	MaxRAmpduFactor:2;
-	UCHAR	MpduDensity:3;
-	UCHAR	ExtChanOffset:2;	// Please not the difference with following	UCHAR	NewExtChannelOffset; from 802.11n
-	UCHAR	RecomWidth:1;
-#endif
-
-#ifdef RT_BIG_ENDIAN
-	USHORT	rsv2:11;
-	USHORT	OBSS_NonHTExist:1;
-	USHORT	rsv3:1;
-	USHORT	NonGfPresent:1;
-	USHORT	OperaionMode:2;
-#else
-	USHORT	OperaionMode:2;
-	USHORT	NonGfPresent:1;
-	USHORT	rsv3:1;
-	USHORT	OBSS_NonHTExist:1;
-	USHORT	rsv2:11;
-#endif
-
-	// New Extension Channel Offset IE
-	UCHAR	NewExtChannelOffset;
-	// Extension Capability IE = 127
-	UCHAR	BSSCoexist2040;
-} RT_HT_CAPABILITY, *PRT_HT_CAPABILITY;
-
-//   field in Addtional HT Information IE .
-typedef struct PACKED {
-#ifdef RT_BIG_ENDIAN
-	UCHAR	SerInterGranu:3;
-	UCHAR	S_PSMPSup:1;
-	UCHAR	RifsMode:1;
-	UCHAR	RecomWidth:1;
-	UCHAR	ExtChanOffset:2;
-#else
-	UCHAR	ExtChanOffset:2;
-	UCHAR	RecomWidth:1;
-	UCHAR	RifsMode:1;
-	UCHAR	S_PSMPSup:1;	 //Indicate support for scheduled PSMP
-	UCHAR	SerInterGranu:3;	 //service interval granularity
-#endif
-} ADD_HTINFO, *PADD_HTINFO;
-
-typedef struct PACKED{
-#ifdef RT_BIG_ENDIAN
-	USHORT	rsv2:11;
-	USHORT	OBSS_NonHTExist:1;
-	USHORT	rsv:1;
-	USHORT	NonGfPresent:1;
-	USHORT	OperaionMode:2;
-#else
-	USHORT	OperaionMode:2;
-	USHORT	NonGfPresent:1;
-	USHORT	rsv:1;
-	USHORT	OBSS_NonHTExist:1;
-	USHORT	rsv2:11;
-#endif
-} ADD_HTINFO2, *PADD_HTINFO2;
-
-
-// TODO: Need sync with spec about the definition of StbcMcs. In Draft 3.03, it's reserved.
-typedef struct PACKED{
-#ifdef RT_BIG_ENDIAN
-	USHORT	rsv:4;
-	USHORT	PcoPhase:1;
-	USHORT	PcoActive:1;
-	USHORT	LsigTxopProt:1;
-	USHORT	STBCBeacon:1;
-	USHORT	DualCTSProtect:1;
-	USHORT	DualBeacon:1;
-	USHORT	StbcMcs:6;
-#else
-	USHORT	StbcMcs:6;
-	USHORT	DualBeacon:1;
-	USHORT	DualCTSProtect:1;
-	USHORT	STBCBeacon:1;
-	USHORT	LsigTxopProt:1;	// L-SIG TXOP protection full support
-	USHORT	PcoActive:1;
-	USHORT	PcoPhase:1;
-	USHORT	rsv:4;
-#endif // RT_BIG_ENDIAN //
-} ADD_HTINFO3, *PADD_HTINFO3;
-
-#define SIZE_ADD_HT_INFO_IE		22
-typedef struct  PACKED{
-	UCHAR				ControlChan;
-	ADD_HTINFO			AddHtInfo;
-	ADD_HTINFO2			AddHtInfo2;
-	ADD_HTINFO3			AddHtInfo3;
-	UCHAR				MCSSet[16];		// Basic MCS set
-} ADD_HT_INFO_IE, *PADD_HT_INFO_IE;
-
-typedef struct  PACKED{
-	UCHAR				NewExtChanOffset;
-} NEW_EXT_CHAN_IE, *PNEW_EXT_CHAN_IE;
-
-typedef struct PACKED _FRAME_802_11 {
-    HEADER_802_11   Hdr;
-    UCHAR            Octet[1];
-}   FRAME_802_11, *PFRAME_802_11;
-
-// QoSNull embedding of management action. When HT Control MA field set to 1.
-typedef struct PACKED _MA_BODY {
-    UCHAR            Category;
-    UCHAR            Action;
-    UCHAR            Octet[1];
-}   MA_BODY, *PMA_BODY;
-
-typedef	struct	PACKED _HEADER_802_3	{
-    UCHAR           DAAddr1[MAC_ADDR_LEN];
-    UCHAR           SAAddr2[MAC_ADDR_LEN];
-    UCHAR           Octet[2];
-}	HEADER_802_3, *PHEADER_802_3;
-////Block ACK related format
-// 2-byte BA Parameter  field  in	DELBA frames to terminate an already set up bA
-typedef struct PACKED{
-#ifdef RT_BIG_ENDIAN
-    USHORT      TID:4;	// value of TC os TS
-    USHORT      Initiator:1;	// 1: originator    0:recipient
-    USHORT      Rsv:11;	// always set to 0
-#else
-    USHORT      Rsv:11;	// always set to 0
-    USHORT      Initiator:1;	// 1: originator    0:recipient
-    USHORT      TID:4;	// value of TC os TS
-#endif /* !RT_BIG_ENDIAN */
-} DELBA_PARM, *PDELBA_PARM;
-
-// 2-byte BA Parameter Set field  in ADDBA frames to signal parm for setting up a BA
-typedef struct PACKED {
-#ifdef RT_BIG_ENDIAN
-    USHORT      BufSize:10;	// number of buffe of size 2304 octetsr
-    USHORT      TID:4;	// value of TC os TS
-    USHORT      BAPolicy:1;	// 1: immediately BA    0:delayed BA
-    USHORT      AMSDUSupported:1;	// 0: not permitted		1: permitted
-#else
-    USHORT      AMSDUSupported:1;	// 0: not permitted		1: permitted
-    USHORT      BAPolicy:1;	// 1: immediately BA    0:delayed BA
-    USHORT      TID:4;	// value of TC os TS
-    USHORT      BufSize:10;	// number of buffe of size 2304 octetsr
-#endif /* !RT_BIG_ENDIAN */
-} BA_PARM, *PBA_PARM;
-
-// 2-byte BA Starting Seq CONTROL field
-typedef union PACKED {
-    struct PACKED {
-#ifdef RT_BIG_ENDIAN
-    USHORT      StartSeq:12;   // sequence number of the 1st MSDU for which this BAR is sent
-	USHORT      FragNum:4;	// always set to 0
-#else
-    USHORT      FragNum:4;	// always set to 0
-	USHORT      StartSeq:12;   // sequence number of the 1st MSDU for which this BAR is sent
-#endif /* RT_BIG_ENDIAN */
-    }   field;
-    USHORT           word;
-} BASEQ_CONTROL, *PBASEQ_CONTROL;
-
-//BAControl and BARControl are the same
-// 2-byte BA CONTROL field in BA frame
-typedef struct PACKED {
-#ifdef RT_BIG_ENDIAN
-    USHORT      TID:4;
-    USHORT      Rsv:9;
-    USHORT      Compressed:1;
-    USHORT      MTID:1;		//EWC V1.24
-    USHORT      ACKPolicy:1; // only related to N-Delayed BA. But not support in RT2860b. 0:NormalACK  1:No ACK
-#else
-    USHORT      ACKPolicy:1; // only related to N-Delayed BA. But not support in RT2860b. 0:NormalACK  1:No ACK
-    USHORT      MTID:1;		//EWC V1.24
-    USHORT      Compressed:1;
-    USHORT      Rsv:9;
-    USHORT      TID:4;
-#endif /* !RT_BIG_ENDIAN */
-} BA_CONTROL, *PBA_CONTROL;
-
-// 2-byte BAR CONTROL field in BAR frame
-typedef struct PACKED {
-#ifdef RT_BIG_ENDIAN
-    USHORT      TID:4;
-    USHORT      Rsv1:9;
-    USHORT      Compressed:1;
-    USHORT      MTID:1;		//if this bit1, use  FRAME_MTBA_REQ,  if 0, use FRAME_BA_REQ
-    USHORT      ACKPolicy:1;
-#else
-    USHORT      ACKPolicy:1; // 0:normal ack,  1:no ack.
-    USHORT      MTID:1;		//if this bit1, use  FRAME_MTBA_REQ,  if 0, use FRAME_BA_REQ
-    USHORT      Compressed:1;
-    USHORT      Rsv1:9;
-    USHORT      TID:4;
-#endif /* !RT_BIG_ENDIAN */
-} BAR_CONTROL, *PBAR_CONTROL;
-
-// BARControl in MTBAR frame
-typedef struct PACKED {
-#ifdef RT_BIG_ENDIAN
-    USHORT      NumTID:4;
-    USHORT      Rsv1:9;
-    USHORT      Compressed:1;
-    USHORT      MTID:1;
-    USHORT      ACKPolicy:1;
-#else
-    USHORT      ACKPolicy:1;
-    USHORT      MTID:1;
-    USHORT      Compressed:1;
-    USHORT      Rsv1:9;
-    USHORT      NumTID:4;
-#endif /* !RT_BIG_ENDIAN */
-} MTBAR_CONTROL, *PMTBAR_CONTROL;
-
-typedef struct PACKED {
-#ifdef RT_BIG_ENDIAN
-    USHORT      TID:4;
-    USHORT      Rsv1:12;
-#else
-    USHORT      Rsv1:12;
-    USHORT      TID:4;
-#endif /* !RT_BIG_ENDIAN */
-} PER_TID_INFO, *PPER_TID_INFO;
-
-typedef struct {
-	PER_TID_INFO      PerTID;
-	BASEQ_CONTROL	 BAStartingSeq;
-} EACH_TID, *PEACH_TID;
-
-
-// BAREQ AND MTBAREQ have the same subtype BAR, 802.11n BAR use compressed bitmap.
-typedef struct PACKED _FRAME_BA_REQ {
-	FRAME_CONTROL   FC;
-	USHORT          Duration;
-	UCHAR           Addr1[MAC_ADDR_LEN];
-	UCHAR           Addr2[MAC_ADDR_LEN];
-	BAR_CONTROL  BARControl;
-	BASEQ_CONTROL	 BAStartingSeq;
-}   FRAME_BA_REQ, *PFRAME_BA_REQ;
-
-typedef struct PACKED _FRAME_MTBA_REQ {
-	FRAME_CONTROL   FC;
-	USHORT          Duration;
-	UCHAR           Addr1[MAC_ADDR_LEN];
-	UCHAR           Addr2[MAC_ADDR_LEN];
-	MTBAR_CONTROL  MTBARControl;
-	PER_TID_INFO	PerTIDInfo;
-	BASEQ_CONTROL	 BAStartingSeq;
-}   FRAME_MTBA_REQ, *PFRAME_MTBA_REQ;
-
-// Compressed format is mandantory in HT STA
-typedef struct PACKED _FRAME_MTBA {
-	FRAME_CONTROL   FC;
-	USHORT          Duration;
-	UCHAR           Addr1[MAC_ADDR_LEN];
-	UCHAR           Addr2[MAC_ADDR_LEN];
-	BA_CONTROL  BAControl;
-	BASEQ_CONTROL	 BAStartingSeq;
-	UCHAR		BitMap[8];
-}   FRAME_MTBA, *PFRAME_MTBA;
-
-typedef struct PACKED _FRAME_PSMP_ACTION {
-	HEADER_802_11   Hdr;
-	UCHAR	Category;
-	UCHAR	Action;
-	UCHAR	Psmp;	// 7.3.1.25
-}   FRAME_PSMP_ACTION, *PFRAME_PSMP_ACTION;
-
-typedef struct PACKED _FRAME_ACTION_HDR {
-	HEADER_802_11   Hdr;
-	UCHAR	Category;
-	UCHAR	Action;
-}   FRAME_ACTION_HDR, *PFRAME_ACTION_HDR;
-
-//Action Frame
-//Action Frame  Category:Spectrum,  Action:Channel Switch. 7.3.2.20
-typedef struct PACKED _CHAN_SWITCH_ANNOUNCE {
-	UCHAR					ElementID;	// ID = IE_CHANNEL_SWITCH_ANNOUNCEMENT = 37
-	UCHAR					Len;
-	CHA_SWITCH_ANNOUNCE_IE	CSAnnounceIe;
-}   CHAN_SWITCH_ANNOUNCE, *PCHAN_SWITCH_ANNOUNCE;
-
-
-//802.11n : 7.3.2.20a
-typedef struct PACKED _SECOND_CHAN_OFFSET {
-	UCHAR				ElementID;		// ID = IE_SECONDARY_CH_OFFSET = 62
-	UCHAR				Len;
-	SEC_CHA_OFFSET_IE	SecChOffsetIe;
-}   SECOND_CHAN_OFFSET, *PSECOND_CHAN_OFFSET;
-
-
-typedef struct PACKED _FRAME_SPETRUM_CS {
-	HEADER_802_11   Hdr;
-	UCHAR	Category;
-	UCHAR	Action;
-	CHAN_SWITCH_ANNOUNCE	CSAnnounce;
-	SECOND_CHAN_OFFSET		SecondChannel;
-}   FRAME_SPETRUM_CS, *PFRAME_SPETRUM_CS;
-
-
-typedef struct PACKED _FRAME_ADDBA_REQ {
-	HEADER_802_11   Hdr;
-	UCHAR	Category;
-	UCHAR	Action;
-	UCHAR	Token;	// 1
-	BA_PARM		BaParm;	      //  2 - 10
-	USHORT		TimeOutValue;	// 0 - 0
-	BASEQ_CONTROL	BaStartSeq; // 0-0
-}   FRAME_ADDBA_REQ, *PFRAME_ADDBA_REQ;
-
-typedef struct PACKED _FRAME_ADDBA_RSP {
-	HEADER_802_11   Hdr;
-	UCHAR	Category;
-	UCHAR	Action;
-	UCHAR	Token;
-	USHORT	StatusCode;
-	BA_PARM		BaParm; //0 - 2
-	USHORT		TimeOutValue;
-}   FRAME_ADDBA_RSP, *PFRAME_ADDBA_RSP;
-
-typedef struct PACKED _FRAME_DELBA_REQ {
-	HEADER_802_11   Hdr;
-	UCHAR	Category;
-	UCHAR	Action;
-	DELBA_PARM		DelbaParm;
-	USHORT	ReasonCode;
-}   FRAME_DELBA_REQ, *PFRAME_DELBA_REQ;
-
-
-//7.2.1.7
-typedef struct PACKED _FRAME_BAR {
-	FRAME_CONTROL   FC;
-	USHORT          Duration;
-	UCHAR           Addr1[MAC_ADDR_LEN];
-	UCHAR           Addr2[MAC_ADDR_LEN];
-	BAR_CONTROL		BarControl;
-	BASEQ_CONTROL	StartingSeq;
-}   FRAME_BAR, *PFRAME_BAR;
-
-//7.2.1.7
-typedef struct PACKED _FRAME_BA {
-	FRAME_CONTROL   FC;
-	USHORT          Duration;
-	UCHAR           Addr1[MAC_ADDR_LEN];
-	UCHAR           Addr2[MAC_ADDR_LEN];
-	BAR_CONTROL		BarControl;
-	BASEQ_CONTROL	StartingSeq;
-	UCHAR		bitmask[8];
-}   FRAME_BA, *PFRAME_BA;
-
-
-// Radio Measuement Request Frame Format
-typedef struct PACKED _FRAME_RM_REQ_ACTION {
-	HEADER_802_11   Hdr;
-	UCHAR	Category;
-	UCHAR	Action;
-	UCHAR	Token;
-	USHORT	Repetition;
-	UCHAR   data[0];
-}   FRAME_RM_REQ_ACTION, *PFRAME_RM_REQ_ACTION;
-
-typedef struct PACKED {
-	UCHAR		ID;
-	UCHAR		Length;
-	UCHAR		ChannelSwitchMode;
-	UCHAR		NewRegClass;
-	UCHAR		NewChannelNum;
-	UCHAR		ChannelSwitchCount;
-} HT_EXT_CHANNEL_SWITCH_ANNOUNCEMENT_IE, *PHT_EXT_CHANNEL_SWITCH_ANNOUNCEMENT_IE;
-
-
-//
-// _Limit must be the 2**n - 1
-// _SEQ1 , _SEQ2 must be within 0 ~ _Limit
-//
-#define SEQ_STEPONE(_SEQ1, _SEQ2, _Limit)	((_SEQ1 == ((_SEQ2+1) & _Limit)))
-#define SEQ_SMALLER(_SEQ1, _SEQ2, _Limit)	(((_SEQ1-_SEQ2) & ((_Limit+1)>>1)))
-#define SEQ_LARGER(_SEQ1, _SEQ2, _Limit)	((_SEQ1 != _SEQ2) && !(((_SEQ1-_SEQ2) & ((_Limit+1)>>1))))
-#define SEQ_WITHIN_WIN(_SEQ1, _SEQ2, _WIN, _Limit) (SEQ_LARGER(_SEQ1, _SEQ2, _Limit) &&  \
-												SEQ_SMALLER(_SEQ1, ((_SEQ2+_WIN+1)&_Limit), _Limit))
-
-//
-// Contention-free parameter (without ID and Length)
-//
-typedef struct PACKED {
-    BOOLEAN     bValid;         // 1: variable contains valid value
-    UCHAR       CfpCount;
-    UCHAR       CfpPeriod;
-    USHORT      CfpMaxDuration;
-    USHORT      CfpDurRemaining;
-} CF_PARM, *PCF_PARM;
-
-typedef	struct	_CIPHER_SUITE	{
-	NDIS_802_11_ENCRYPTION_STATUS	PairCipher;		// Unicast cipher 1, this one has more secured cipher suite
-	NDIS_802_11_ENCRYPTION_STATUS	PairCipherAux;	// Unicast cipher 2 if AP announce two unicast cipher suite
-	NDIS_802_11_ENCRYPTION_STATUS	GroupCipher;	// Group cipher
-	USHORT							RsnCapability;	// RSN capability from beacon
-	BOOLEAN							bMixMode;		// Indicate Pair & Group cipher might be different
-}	CIPHER_SUITE, *PCIPHER_SUITE;
-
-// EDCA configuration from AP's BEACON/ProbeRsp
-typedef struct {
-    BOOLEAN     bValid;         // 1: variable contains valid value
-    BOOLEAN     bAdd;         // 1: variable contains valid value
-    BOOLEAN     bQAck;
-    BOOLEAN     bQueueRequest;
-    BOOLEAN     bTxopRequest;
-    BOOLEAN     bAPSDCapable;
-//  BOOLEAN     bMoreDataAck;
-    UCHAR       EdcaUpdateCount;
-    UCHAR       Aifsn[4];       // 0:AC_BK, 1:AC_BE, 2:AC_VI, 3:AC_VO
-    UCHAR       Cwmin[4];
-    UCHAR       Cwmax[4];
-    USHORT      Txop[4];      // in unit of 32-us
-    BOOLEAN     bACM[4];      // 1: Admission Control of AC_BK is mandattory
-} EDCA_PARM, *PEDCA_PARM;
-
-// QBSS LOAD information from QAP's BEACON/ProbeRsp
-typedef struct {
-    BOOLEAN     bValid;                     // 1: variable contains valid value
-    USHORT      StaNum;
-    UCHAR       ChannelUtilization;
-    USHORT      RemainingAdmissionControl;  // in unit of 32-us
-} QBSS_LOAD_PARM, *PQBSS_LOAD_PARM;
-
-// QBSS Info field in QSTA's assoc req
-typedef struct PACKED {
-#ifdef RT_BIG_ENDIAN
-	UCHAR		Rsv2:1;
-	UCHAR		MaxSPLength:2;
-	UCHAR		Rsv1:1;
-	UCHAR		UAPSD_AC_BE:1;
-	UCHAR		UAPSD_AC_BK:1;
-	UCHAR		UAPSD_AC_VI:1;
-	UCHAR		UAPSD_AC_VO:1;
-#else
-    UCHAR		UAPSD_AC_VO:1;
-	UCHAR		UAPSD_AC_VI:1;
-	UCHAR		UAPSD_AC_BK:1;
-	UCHAR		UAPSD_AC_BE:1;
-	UCHAR		Rsv1:1;
-	UCHAR		MaxSPLength:2;
-	UCHAR		Rsv2:1;
-#endif /* !RT_BIG_ENDIAN */
-} QBSS_STA_INFO_PARM, *PQBSS_STA_INFO_PARM;
-
-// QBSS Info field in QAP's Beacon/ProbeRsp
-typedef struct PACKED {
-#ifdef RT_BIG_ENDIAN
-	UCHAR		UAPSD:1;
-	UCHAR		Rsv:3;
-    UCHAR		ParamSetCount:4;
-#else
-    UCHAR		ParamSetCount:4;
-	UCHAR		Rsv:3;
-	UCHAR		UAPSD:1;
-#endif /* !RT_BIG_ENDIAN */
-} QBSS_AP_INFO_PARM, *PQBSS_AP_INFO_PARM;
-
-// QOS Capability reported in QAP's BEACON/ProbeRsp
-// QOS Capability sent out in QSTA's AssociateReq/ReAssociateReq
-typedef struct {
-    BOOLEAN     bValid;                     // 1: variable contains valid value
-    BOOLEAN     bQAck;
-    BOOLEAN     bQueueRequest;
-    BOOLEAN     bTxopRequest;
-//  BOOLEAN     bMoreDataAck;
-    UCHAR       EdcaUpdateCount;
-} QOS_CAPABILITY_PARM, *PQOS_CAPABILITY_PARM;
-
-#ifdef CONFIG_STA_SUPPORT
-typedef struct {
-    UCHAR       IELen;
-    UCHAR       IE[MAX_CUSTOM_LEN];
-} WPA_IE_;
-#endif // CONFIG_STA_SUPPORT //
-
-
-typedef struct {
-    UCHAR   Bssid[MAC_ADDR_LEN];
-    UCHAR   Channel;
-	UCHAR   CentralChannel;	//Store the wide-band central channel for 40MHz.  .used in 40MHz AP. Or this is the same as Channel.
-    UCHAR   BssType;
-    USHORT  AtimWin;
-    USHORT  BeaconPeriod;
-
-    UCHAR   SupRate[MAX_LEN_OF_SUPPORTED_RATES];
-    UCHAR   SupRateLen;
-    UCHAR   ExtRate[MAX_LEN_OF_SUPPORTED_RATES];
-    UCHAR   ExtRateLen;
-	HT_CAPABILITY_IE HtCapability;
-	UCHAR			HtCapabilityLen;
-	ADD_HT_INFO_IE AddHtInfo;	// AP might use this additional ht info IE
-	UCHAR			AddHtInfoLen;
-	UCHAR			NewExtChanOffset;
-	CHAR    Rssi;
-    UCHAR   Privacy;			// Indicate security function ON/OFF. Don't mess up with auth mode.
-	UCHAR	Hidden;
-
-    USHORT  DtimPeriod;
-    USHORT  CapabilityInfo;
-
-    USHORT  CfpCount;
-    USHORT  CfpPeriod;
-    USHORT  CfpMaxDuration;
-    USHORT  CfpDurRemaining;
-    UCHAR   SsidLen;
-    CHAR    Ssid[MAX_LEN_OF_SSID];
-
-    ULONG   LastBeaconRxTime; // OS's timestamp
-
-	BOOLEAN	bSES;
-
-	// New for WPA2
-	CIPHER_SUITE					WPA;			// AP announced WPA cipher suite
-	CIPHER_SUITE					WPA2;			// AP announced WPA2 cipher suite
-
-	// New for microsoft WPA support
-	NDIS_802_11_FIXED_IEs	FixIEs;
-	NDIS_802_11_AUTHENTICATION_MODE	AuthModeAux;	// Addition mode for WPA2 / WPA capable AP
-	NDIS_802_11_AUTHENTICATION_MODE	AuthMode;
-	NDIS_802_11_WEP_STATUS	WepStatus;				// Unicast Encryption Algorithm extract from VAR_IE
-	USHORT					VarIELen;				// Length of next VIE include EID & Length
-	UCHAR					VarIEs[MAX_VIE_LEN];
-
-	// CCX Ckip information
-    UCHAR   CkipFlag;
-
-	// CCX 2 TSF
-	UCHAR	PTSF[4];		// Parent TSF
-	UCHAR	TTSF[8];		// Target TSF
-
-    // 802.11e d9, and WMM
-	EDCA_PARM           EdcaParm;
-	QOS_CAPABILITY_PARM QosCapability;
-	QBSS_LOAD_PARM      QbssLoad;
-#ifdef CONFIG_STA_SUPPORT
-    WPA_IE_     WpaIE;
-    WPA_IE_     RsnIE;
-#ifdef EXT_BUILD_CHANNEL_LIST
-	UCHAR		CountryString[3];
-	BOOLEAN		bHasCountryIE;
-#endif // EXT_BUILD_CHANNEL_LIST //
-#endif // CONFIG_STA_SUPPORT //
-
-} BSS_ENTRY, *PBSS_ENTRY;
-
-typedef struct {
-    UCHAR           BssNr;
-    UCHAR           BssOverlapNr;
-    BSS_ENTRY       BssEntry[MAX_LEN_OF_BSS_TABLE];
-} BSS_TABLE, *PBSS_TABLE;
-
-
-typedef struct _MLME_QUEUE_ELEM {
-    ULONG             Machine;
-    ULONG             MsgType;
-    ULONG             MsgLen;
-    UCHAR             Msg[MGMT_DMA_BUFFER_SIZE];
-    LARGE_INTEGER     TimeStamp;
-    UCHAR             Rssi0;
-    UCHAR             Rssi1;
-    UCHAR             Rssi2;
-    UCHAR             Signal;
-    UCHAR             Channel;
-    UCHAR             Wcid;
-    BOOLEAN           Occupied;
-#ifdef MLME_EX
-	USHORT            Idx;
-#endif // MLME_EX //
-} MLME_QUEUE_ELEM, *PMLME_QUEUE_ELEM;
-
-typedef struct _MLME_QUEUE {
-    ULONG             Num;
-    ULONG             Head;
-    ULONG             Tail;
-    NDIS_SPIN_LOCK   Lock;
-    MLME_QUEUE_ELEM  Entry[MAX_LEN_OF_MLME_QUEUE];
-} MLME_QUEUE, *PMLME_QUEUE;
-
-typedef VOID (*STATE_MACHINE_FUNC)(VOID *Adaptor, MLME_QUEUE_ELEM *Elem);
-
-typedef struct _STATE_MACHINE {
-    ULONG                           Base;
-    ULONG                           NrState;
-    ULONG                           NrMsg;
-    ULONG                           CurrState;
-    STATE_MACHINE_FUNC             *TransFunc;
-} STATE_MACHINE, *PSTATE_MACHINE;
-
-
-// MLME AUX data structure that hold temporarliy settings during a connection attempt.
-// Once this attemp succeeds, all settings will be copy to pAd->StaActive.
-// A connection attempt (user set OID, roaming, CCX fast roaming,..) consists of
-// several steps (JOIN, AUTH, ASSOC or REASSOC) and may fail at any step. We purposely
-// separate this under-trial settings away from pAd->StaActive so that once
-// this new attempt failed, driver can auto-recover back to the active settings.
-typedef struct _MLME_AUX {
-    UCHAR               BssType;
-    UCHAR               Ssid[MAX_LEN_OF_SSID];
-    UCHAR               SsidLen;
-    UCHAR               Bssid[MAC_ADDR_LEN];
-	UCHAR				AutoReconnectSsid[MAX_LEN_OF_SSID];
-	UCHAR				AutoReconnectSsidLen;
-    USHORT              Alg;
-    UCHAR               ScanType;
-    UCHAR               Channel;
-	UCHAR               CentralChannel;
-    USHORT              Aid;
-    USHORT              CapabilityInfo;
-    USHORT              BeaconPeriod;
-    USHORT              CfpMaxDuration;
-    USHORT              CfpPeriod;
-    USHORT              AtimWin;
-
-	// Copy supported rate from desired AP's beacon. We are trying to match
-	// AP's supported and extended rate settings.
-	UCHAR		        SupRate[MAX_LEN_OF_SUPPORTED_RATES];
-	UCHAR		        ExtRate[MAX_LEN_OF_SUPPORTED_RATES];
-	UCHAR		        SupRateLen;
-	UCHAR		        ExtRateLen;
-	HT_CAPABILITY_IE		HtCapability;
-	UCHAR				HtCapabilityLen;
-	ADD_HT_INFO_IE		AddHtInfo;	// AP might use this additional ht info IE
-	UCHAR			NewExtChannelOffset;
-	//RT_HT_CAPABILITY	SupportedHtPhy;
-
-    // new for QOS
-    QOS_CAPABILITY_PARM APQosCapability;    // QOS capability of the current associated AP
-    EDCA_PARM           APEdcaParm;         // EDCA parameters of the current associated AP
-    QBSS_LOAD_PARM      APQbssLoad;         // QBSS load of the current associated AP
-
-    // new to keep Ralink specific feature
-    ULONG               APRalinkIe;
-
-    BSS_TABLE           SsidBssTab;     // AP list for the same SSID
-    BSS_TABLE           RoamTab;        // AP list eligible for roaming
-    ULONG               BssIdx;
-    ULONG               RoamIdx;
-
-	BOOLEAN				CurrReqIsFromNdis;
-
-    RALINK_TIMER_STRUCT BeaconTimer, ScanTimer;
-    RALINK_TIMER_STRUCT AuthTimer;
-    RALINK_TIMER_STRUCT AssocTimer, ReassocTimer, DisassocTimer;
-
-#ifdef CONFIG_STA_SUPPORT
-#endif // CONFIG_STA_SUPPORT //
-} MLME_AUX, *PMLME_AUX;
-
-typedef struct _MLME_ADDBA_REQ_STRUCT{
-	UCHAR   Wcid;	//
-	UCHAR   pAddr[MAC_ADDR_LEN];
-	UCHAR   BaBufSize;
-	USHORT	TimeOutValue;
-	UCHAR   TID;
-	UCHAR   Token;
-	USHORT	BaStartSeq;
-} MLME_ADDBA_REQ_STRUCT, *PMLME_ADDBA_REQ_STRUCT;
-
-
-typedef struct _MLME_DELBA_REQ_STRUCT{
-	UCHAR   Wcid;	//
-	UCHAR     Addr[MAC_ADDR_LEN];
-	UCHAR   TID;
-	UCHAR	Initiator;
-} MLME_DELBA_REQ_STRUCT, *PMLME_DELBA_REQ_STRUCT;
-
-// assoc struct is equal to reassoc
-typedef struct _MLME_ASSOC_REQ_STRUCT{
-    UCHAR     Addr[MAC_ADDR_LEN];
-    USHORT    CapabilityInfo;
-    USHORT    ListenIntv;
-    ULONG     Timeout;
-} MLME_ASSOC_REQ_STRUCT, *PMLME_ASSOC_REQ_STRUCT, MLME_REASSOC_REQ_STRUCT, *PMLME_REASSOC_REQ_STRUCT;
-
-typedef struct _MLME_DISASSOC_REQ_STRUCT{
-    UCHAR     Addr[MAC_ADDR_LEN];
-    USHORT    Reason;
-} MLME_DISASSOC_REQ_STRUCT, *PMLME_DISASSOC_REQ_STRUCT;
-
-typedef struct _MLME_AUTH_REQ_STRUCT {
-    UCHAR        Addr[MAC_ADDR_LEN];
-    USHORT       Alg;
-    ULONG        Timeout;
-} MLME_AUTH_REQ_STRUCT, *PMLME_AUTH_REQ_STRUCT;
-
-typedef struct _MLME_DEAUTH_REQ_STRUCT {
-    UCHAR        Addr[MAC_ADDR_LEN];
-    USHORT       Reason;
-} MLME_DEAUTH_REQ_STRUCT, *PMLME_DEAUTH_REQ_STRUCT;
-
-typedef struct {
-    ULONG      BssIdx;
-} MLME_JOIN_REQ_STRUCT;
-
-typedef struct _MLME_SCAN_REQ_STRUCT {
-    UCHAR      Bssid[MAC_ADDR_LEN];
-    UCHAR      BssType;
-    UCHAR      ScanType;
-    UCHAR      SsidLen;
-    CHAR       Ssid[MAX_LEN_OF_SSID];
-} MLME_SCAN_REQ_STRUCT, *PMLME_SCAN_REQ_STRUCT;
-
-typedef struct _MLME_START_REQ_STRUCT {
-    CHAR        Ssid[MAX_LEN_OF_SSID];
-    UCHAR       SsidLen;
-} MLME_START_REQ_STRUCT, *PMLME_START_REQ_STRUCT;
-
-#ifdef CONFIG_STA_SUPPORT
-#ifdef QOS_DLS_SUPPORT
-// structure for DLS
-typedef struct _RT_802_11_DLS {
-	USHORT						TimeOut;		// Use to time out while slience, unit: second , set by UI
-	USHORT						CountDownTimer;	// Use to time out while slience,unit: second , used by driver only
-	NDIS_802_11_MAC_ADDRESS		MacAddr;		// set by UI
-	UCHAR						Status;			// 0: none , 1: wait STAkey, 2: finish DLS setup , set by driver only
-	BOOLEAN						Valid;			// 1: valid , 0: invalid , set by UI, use to setup or tear down DLS link
-	RALINK_TIMER_STRUCT			Timer;			// Use to time out while handshake
-	USHORT						Sequence;
-	USHORT						MacTabMatchWCID;	// ASIC
-	BOOLEAN						bHTCap;
-	PVOID						pAd;
-} RT_802_11_DLS, *PRT_802_11_DLS;
-
-typedef struct _MLME_DLS_REQ_STRUCT {
-    PRT_802_11_DLS	pDLS;
-    USHORT			Reason;
-} MLME_DLS_REQ_STRUCT, *PMLME_DLS_REQ_STRUCT;
-#endif // QOS_DLS_SUPPORT //
-#endif // CONFIG_STA_SUPPORT //
-
-typedef struct PACKED {
-    UCHAR   Eid;
-    UCHAR   Len;
-    UCHAR   Octet[1];
-} EID_STRUCT,*PEID_STRUCT, BEACON_EID_STRUCT, *PBEACON_EID_STRUCT;
-
-typedef struct PACKED _RTMP_TX_RATE_SWITCH
-{
-	UCHAR   ItemNo;
-#ifdef RT_BIG_ENDIAN
-	UCHAR	Rsv2:2;
-	UCHAR	Mode:2;
-	UCHAR	Rsv1:1;
-	UCHAR	BW:1;
-	UCHAR	ShortGI:1;
-	UCHAR	STBC:1;
-#else
-	UCHAR	STBC:1;
-	UCHAR	ShortGI:1;
-	UCHAR	BW:1;
-	UCHAR	Rsv1:1;
-	UCHAR	Mode:2;
-	UCHAR	Rsv2:2;
-#endif
-	UCHAR   CurrMCS;
-	UCHAR   TrainUp;
-	UCHAR   TrainDown;
-} RRTMP_TX_RATE_SWITCH, *PRTMP_TX_RATE_SWITCH;
-
-// ========================== AP mlme.h ===============================
-#define TBTT_PRELOAD_TIME       384        // usec. LomgPreamble + 24-byte at 1Mbps
-#define DEFAULT_DTIM_PERIOD     1
-
-// weighting factor to calculate Channel quality, total should be 100%
-//#define RSSI_WEIGHTING                   0
-//#define TX_WEIGHTING                     40
-//#define RX_WEIGHTING                     60
-
-#define MAC_TABLE_AGEOUT_TIME			300			// unit: sec
-#define MAC_TABLE_ASSOC_TIMEOUT			5			// unit: sec
-#define MAC_TABLE_FULL(Tab)				((Tab).size == MAX_LEN_OF_MAC_TABLE)
-
-// AP shall drop the sta if contine Tx fail count reach it.
-#define MAC_ENTRY_LIFE_CHECK_CNT		20			// packet cnt.
-
-// Value domain of pMacEntry->Sst
-typedef enum _Sst {
-    SST_NOT_AUTH,   // 0: equivalent to IEEE 802.11/1999 state 1
-    SST_AUTH,       // 1: equivalent to IEEE 802.11/1999 state 2
-    SST_ASSOC       // 2: equivalent to IEEE 802.11/1999 state 3
-} SST;
-
-// value domain of pMacEntry->AuthState
-typedef enum _AuthState {
-    AS_NOT_AUTH,
-    AS_AUTH_OPEN,       // STA has been authenticated using OPEN SYSTEM
-    AS_AUTH_KEY,        // STA has been authenticated using SHARED KEY
-    AS_AUTHENTICATING   // STA is waiting for AUTH seq#3 using SHARED KEY
-} AUTH_STATE;
-
-//for-wpa value domain of pMacEntry->WpaState  802.1i D3   p.114
-typedef enum _ApWpaState {
-    AS_NOTUSE,              // 0
-    AS_DISCONNECT,          // 1
-    AS_DISCONNECTED,        // 2
-    AS_INITIALIZE,          // 3
-    AS_AUTHENTICATION,      // 4
-    AS_AUTHENTICATION2,     // 5
-    AS_INITPMK,             // 6
-    AS_INITPSK,             // 7
-    AS_PTKSTART,            // 8
-    AS_PTKINIT_NEGOTIATING, // 9
-    AS_PTKINITDONE,         // 10
-    AS_UPDATEKEYS,          // 11
-    AS_INTEGRITY_FAILURE,   // 12
-    AS_KEYUPDATE,           // 13
-} AP_WPA_STATE;
-
-// for-wpa value domain of pMacEntry->WpaState  802.1i D3   p.114
-typedef enum _GTKState {
-    REKEY_NEGOTIATING,
-    REKEY_ESTABLISHED,
-    KEYERROR,
-} GTK_STATE;
-
-//  for-wpa  value domain of pMacEntry->WpaState  802.1i D3   p.114
-typedef enum _WpaGTKState {
-    SETKEYS,
-    SETKEYS_DONE,
-} WPA_GTK_STATE;
-// ====================== end of AP mlme.h ============================
-
-
-#endif	// MLME_H__
diff --git a/drivers/staging/rt3090/mlme_ex.h b/drivers/staging/rt3090/mlme_ex.h
deleted file mode 100644
index b3e94dc88375..000000000000
--- a/drivers/staging/rt3090/mlme_ex.h
+++ /dev/null
@@ -1,83 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-    Module Name:
-    mlme_ex.h
-
-    Abstract:
-    Miniport generic portion header file
-
-    Revision History:
-    Who         When          What
-    --------    ----------    ----------------------------------------------
-	Fonchi		2007-06-25		Extend original mlme APIs to support multi-entries
-*/
-#ifndef __MLME_EX_H__
-#define __MLME_EX_H__
-
-#include "mlme_ex_def.h"
-
-
-VOID StateMachineInitEx(
-	IN STATE_MACHINE_EX *S,
-	IN STATE_MACHINE_FUNC_EX Trans[],
-	IN ULONG StNr,
-	IN ULONG MsgNr,
-	IN STATE_MACHINE_FUNC_EX DefFunc,
-	IN ULONG InitState,
-	IN ULONG Base);
-
-VOID StateMachineSetActionEx(
-	IN STATE_MACHINE_EX *S,
-	IN ULONG St,
-	IN ULONG Msg,
-	IN STATE_MACHINE_FUNC_EX Func);
-
-BOOLEAN isValidApCliIf(
-	SHORT Idx);
-
-VOID StateMachinePerformActionEx(
-	IN PRTMP_ADAPTER pAd,
-	IN STATE_MACHINE_EX *S,
-	IN MLME_QUEUE_ELEM *Elem,
-	USHORT Idx,
-	PULONG pCurrState);
-
-BOOLEAN MlmeEnqueueEx(
-	IN	PRTMP_ADAPTER pAd,
-	IN ULONG Machine,
-	IN ULONG MsgType,
-	IN ULONG MsgLen,
-	IN VOID *Msg,
-	IN USHORT Idx);
-
-VOID DropEx(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem,
-	PULONG pCurrState,
-	USHORT Idx);
-
-#endif /* __MLME_EX_H__ */
diff --git a/drivers/staging/rt3090/mlme_ex_def.h b/drivers/staging/rt3090/mlme_ex_def.h
deleted file mode 100644
index ccd60b41614a..000000000000
--- a/drivers/staging/rt3090/mlme_ex_def.h
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-    Module Name:
-    mlme_ex_def.h
-
-    Abstract:
-    Miniport generic portion header file
-
-    Revision History:
-    Who         When          What
-    --------    ----------    ----------------------------------------------
-	Fonchi		2007-06-25		Extend original mlme APIs to support multi-entries
-*/
-#ifndef __MLME_EX_DEF_H__
-#define __MLME_EX_DEF_H__
-
-
-typedef VOID (*STATE_MACHINE_FUNC_EX)(VOID *Adaptor, MLME_QUEUE_ELEM *Elem, PULONG pCurrState, USHORT Idx);
-
-typedef struct _STA_STATE_MACHINE_EX
-{
-	ULONG					Base;
-	ULONG					NrState;
-	ULONG					NrMsg;
-	ULONG					CurrState;
-	STATE_MACHINE_FUNC_EX	*TransFunc;
-} STATE_MACHINE_EX, *PSTA_STATE_MACHINE_EX;
-
-#endif // __MLME_EX_DEF_H__ //
diff --git a/drivers/staging/rt3090/oid.h b/drivers/staging/rt3090/oid.h
deleted file mode 100644
index 29a43401095e..000000000000
--- a/drivers/staging/rt3090/oid.h
+++ /dev/null
@@ -1,1144 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-	Module Name:
-	oid.h
-
-	Abstract:
-
-	Revision History:
-	Who			When			What
-	--------	----------		----------------------------------------------
-	Name		Date			Modification logs
-*/
-#ifndef _OID_H_
-#define _OID_H_
-
-//#include <linux/wireless.h>
-
-#ifndef TRUE
-#define TRUE				1
-#endif
-#ifndef FALSE
-#define FALSE				0
-#endif
-//
-// IEEE 802.11 Structures and definitions
-//
-#define MAX_TX_POWER_LEVEL              100   /* mW */
-#define MAX_RSSI_TRIGGER                -10    /* dBm */
-#define MIN_RSSI_TRIGGER                -200   /* dBm */
-#define MAX_FRAG_THRESHOLD              2346  /* byte count */
-#define MIN_FRAG_THRESHOLD              256   /* byte count */
-#define MAX_RTS_THRESHOLD               2347  /* byte count */
-
-// new types for Media Specific Indications
-// Extension channel offset
-#define EXTCHA_NONE			0
-#define EXTCHA_ABOVE		0x1
-#define EXTCHA_BELOW		0x3
-
-// BW
-#define BAND_WIDTH_20		0
-#define BAND_WIDTH_40		1
-#define BAND_WIDTH_BOTH		2
-#define BAND_WIDTH_10		3	// 802.11j has 10MHz. This definition is for internal usage. doesn't fill in the IE or other field.
-// SHORTGI
-#define GAP_INTERVAL_400	1	// only support in HT mode
-#define GAP_INTERVAL_800	0
-#define GAP_INTERVAL_BOTH	2
-
-#define NdisMediaStateConnected			1
-#define NdisMediaStateDisconnected		0
-
-#define NDIS_802_11_LENGTH_SSID         32
-#define NDIS_802_11_LENGTH_RATES        8
-#define NDIS_802_11_LENGTH_RATES_EX     16
-#define MAC_ADDR_LENGTH                 6
-//#define MAX_NUM_OF_CHS					49 // 14 channels @2.4G +  12@UNII + 4 @MMAC + 11 @HiperLAN2 + 7 @Japan + 1 as NULL terminationc
-#define MAX_NUM_OF_CHS				54      // 14 channels @2.4G +  12@UNII(lower/middle) + 16@HiperLAN2 + 11@UNII(upper) + 0 @Japan + 1 as NULL termination
-#define MAX_NUMBER_OF_EVENT				10  // entry # in EVENT table
-#define MAX_NUMBER_OF_MAC				32 // if MAX_MBSSID_NUM is 8, this value can't be larger than 211
-#define MAX_NUMBER_OF_ACL				64
-#define MAX_LENGTH_OF_SUPPORT_RATES		12    // 1, 2, 5.5, 11, 6, 9, 12, 18, 24, 36, 48, 54
-#define MAX_NUMBER_OF_DLS_ENTRY			4
-
-
-#define RT_QUERY_SIGNAL_CONTEXT				0x0402
-#define RT_SET_IAPP_PID				0x0404
-#define RT_SET_APD_PID						0x0405
-#define RT_SET_DEL_MAC_ENTRY				0x0406
-#define RT_QUERY_EVENT_TABLE			0x0407
-//
-// IEEE 802.11 OIDs
-//
-#define	OID_GET_SET_TOGGLE			0x8000
-#define	OID_GET_SET_FROM_UI			0x4000
-
-#define	OID_802_11_NETWORK_TYPES_SUPPORTED			0x0103
-#define	OID_802_11_NETWORK_TYPE_IN_USE				0x0104
-#define	OID_802_11_RSSI_TRIGGER						0x0107
-#define	RT_OID_802_11_RSSI							0x0108 //rt2860	only , kathy
-#define	RT_OID_802_11_RSSI_1						0x0109 //rt2860	only , kathy
-#define	RT_OID_802_11_RSSI_2						0x010A //rt2860	only , kathy
-#define	OID_802_11_NUMBER_OF_ANTENNAS				0x010B
-#define	OID_802_11_RX_ANTENNA_SELECTED				0x010C
-#define	OID_802_11_TX_ANTENNA_SELECTED				0x010D
-#define	OID_802_11_SUPPORTED_RATES					0x010E
-#define	OID_802_11_ADD_WEP							0x0112
-#define	OID_802_11_REMOVE_WEP						0x0113
-#define	OID_802_11_DISASSOCIATE						0x0114
-#define	OID_802_11_PRIVACY_FILTER					0x0118
-#define	OID_802_11_ASSOCIATION_INFORMATION			0x011E
-#define	OID_802_11_TEST								0x011F
-
-
-#define	RT_OID_802_11_COUNTRY_REGION				0x0507
-#define	OID_802_11_BSSID_LIST_SCAN					0x0508
-#define	OID_802_11_SSID								0x0509
-#define	OID_802_11_BSSID							0x050A
-#define	RT_OID_802_11_RADIO							0x050B
-#define	RT_OID_802_11_PHY_MODE						0x050C
-#define	RT_OID_802_11_STA_CONFIG					0x050D
-#define	OID_802_11_DESIRED_RATES					0x050E
-#define	RT_OID_802_11_PREAMBLE						0x050F
-#define	OID_802_11_WEP_STATUS						0x0510
-#define	OID_802_11_AUTHENTICATION_MODE				0x0511
-#define	OID_802_11_INFRASTRUCTURE_MODE				0x0512
-#define	RT_OID_802_11_RESET_COUNTERS				0x0513
-#define	OID_802_11_RTS_THRESHOLD					0x0514
-#define	OID_802_11_FRAGMENTATION_THRESHOLD			0x0515
-#define	OID_802_11_POWER_MODE						0x0516
-#define	OID_802_11_TX_POWER_LEVEL					0x0517
-#define	RT_OID_802_11_ADD_WPA						0x0518
-#define	OID_802_11_REMOVE_KEY						0x0519
-#define	OID_802_11_ADD_KEY							0x0520
-#define	OID_802_11_CONFIGURATION					0x0521
-#define	OID_802_11_TX_PACKET_BURST					0x0522
-#define	RT_OID_802_11_QUERY_NOISE_LEVEL				0x0523
-#define	RT_OID_802_11_EXTRA_INFO					0x0524
-#ifdef	DBG
-#define	RT_OID_802_11_HARDWARE_REGISTER				0x0525
-#endif
-#define OID_802_11_ENCRYPTION_STATUS            OID_802_11_WEP_STATUS
-#define OID_802_11_DEAUTHENTICATION                 0x0526
-#define OID_802_11_DROP_UNENCRYPTED                 0x0527
-#define OID_802_11_MIC_FAILURE_REPORT_FRAME         0x0528
-#define OID_802_11_EAP_METHOD						0x0529
-
-// For 802.1x daemin using to require current driver configuration
-#define OID_802_11_RADIUS_QUERY_SETTING				0x0540
-
-#define	RT_OID_DEVICE_NAME							0x0607
-#define	RT_OID_VERSION_INFO							0x0608
-#define	OID_802_11_BSSID_LIST						0x0609
-#define	OID_802_3_CURRENT_ADDRESS					0x060A
-#define	OID_GEN_MEDIA_CONNECT_STATUS				0x060B
-#define	RT_OID_802_11_QUERY_LINK_STATUS				0x060C
-#define	OID_802_11_RSSI								0x060D
-#define	OID_802_11_STATISTICS						0x060E
-#define	OID_GEN_RCV_OK								0x060F
-#define	OID_GEN_RCV_NO_BUFFER						0x0610
-#define	RT_OID_802_11_QUERY_EEPROM_VERSION			0x0611
-#define	RT_OID_802_11_QUERY_FIRMWARE_VERSION		0x0612
-#define	RT_OID_802_11_QUERY_LAST_RX_RATE			0x0613
-#define	RT_OID_802_11_TX_POWER_LEVEL_1				0x0614
-#define	RT_OID_802_11_QUERY_PIDVID					0x0615
-//for WPA_SUPPLICANT_SUPPORT
-#define OID_SET_COUNTERMEASURES                     0x0616
-#define OID_802_11_SET_IEEE8021X                    0x0617
-#define OID_802_11_SET_IEEE8021X_REQUIRE_KEY        0x0618
-#define OID_802_11_PMKID                            0x0620
-#define RT_OID_WPA_SUPPLICANT_SUPPORT               0x0621
-#define RT_OID_WE_VERSION_COMPILED                  0x0622
-#define RT_OID_NEW_DRIVER                           0x0623
-
-#define	RT_OID_802_11_SNR_0							0x0630
-#define	RT_OID_802_11_SNR_1							0x0631
-#define	RT_OID_802_11_QUERY_LAST_TX_RATE			0x0632
-#define	RT_OID_802_11_QUERY_HT_PHYMODE				0x0633
-#define	RT_OID_802_11_SET_HT_PHYMODE				0x0634
-#define	OID_802_11_RELOAD_DEFAULTS					0x0635
-#define	RT_OID_802_11_QUERY_APSD_SETTING			0x0636
-#define	RT_OID_802_11_SET_APSD_SETTING				0x0637
-#define	RT_OID_802_11_QUERY_APSD_PSM				0x0638
-#define	RT_OID_802_11_SET_APSD_PSM					0x0639
-#define	RT_OID_802_11_QUERY_DLS						0x063A
-#define	RT_OID_802_11_SET_DLS						0x063B
-#define	RT_OID_802_11_QUERY_DLS_PARAM				0x063C
-#define	RT_OID_802_11_SET_DLS_PARAM					0x063D
-#define RT_OID_802_11_QUERY_WMM				0x063E
-#define RT_OID_802_11_SET_WMM						0x063F
-#define RT_OID_802_11_QUERY_IMME_BA_CAP				0x0640
-#define RT_OID_802_11_SET_IMME_BA_CAP				0x0641
-#define RT_OID_802_11_QUERY_BATABLE					0x0642
-#define RT_OID_802_11_ADD_IMME_BA					0x0643
-#define RT_OID_802_11_TEAR_IMME_BA					0x0644
-#define RT_OID_DRIVER_DEVICE_NAME                   0x0645
-#define RT_OID_802_11_QUERY_DAT_HT_PHYMODE          0x0646
-#define RT_OID_QUERY_MULTIPLE_CARD_SUPPORT          0x0647
-#define OID_802_11_SET_PSPXLINK_MODE				0x0648
-/*+++ add by woody +++*/
-#define OID_802_11_SET_PASSPHRASE				0x0649
-// Ralink defined OIDs
-// Dennis Lee move to platform specific
-
-#define	RT_OID_802_11_BSSID					  (OID_GET_SET_TOGGLE |	OID_802_11_BSSID)
-#define	RT_OID_802_11_SSID					  (OID_GET_SET_TOGGLE |	OID_802_11_SSID)
-#define	RT_OID_802_11_INFRASTRUCTURE_MODE	  (OID_GET_SET_TOGGLE |	OID_802_11_INFRASTRUCTURE_MODE)
-#define	RT_OID_802_11_ADD_WEP				  (OID_GET_SET_TOGGLE |	OID_802_11_ADD_WEP)
-#define	RT_OID_802_11_ADD_KEY				  (OID_GET_SET_TOGGLE |	OID_802_11_ADD_KEY)
-#define	RT_OID_802_11_REMOVE_WEP			  (OID_GET_SET_TOGGLE |	OID_802_11_REMOVE_WEP)
-#define	RT_OID_802_11_REMOVE_KEY			  (OID_GET_SET_TOGGLE |	OID_802_11_REMOVE_KEY)
-#define	RT_OID_802_11_DISASSOCIATE			  (OID_GET_SET_TOGGLE |	OID_802_11_DISASSOCIATE)
-#define	RT_OID_802_11_AUTHENTICATION_MODE	  (OID_GET_SET_TOGGLE |	OID_802_11_AUTHENTICATION_MODE)
-#define	RT_OID_802_11_PRIVACY_FILTER		  (OID_GET_SET_TOGGLE |	OID_802_11_PRIVACY_FILTER)
-#define	RT_OID_802_11_BSSID_LIST_SCAN		  (OID_GET_SET_TOGGLE |	OID_802_11_BSSID_LIST_SCAN)
-#define	RT_OID_802_11_WEP_STATUS			  (OID_GET_SET_TOGGLE |	OID_802_11_WEP_STATUS)
-#define	RT_OID_802_11_RELOAD_DEFAULTS		  (OID_GET_SET_TOGGLE |	OID_802_11_RELOAD_DEFAULTS)
-#define	RT_OID_802_11_NETWORK_TYPE_IN_USE	  (OID_GET_SET_TOGGLE |	OID_802_11_NETWORK_TYPE_IN_USE)
-#define	RT_OID_802_11_TX_POWER_LEVEL		  (OID_GET_SET_TOGGLE |	OID_802_11_TX_POWER_LEVEL)
-#define	RT_OID_802_11_RSSI_TRIGGER			  (OID_GET_SET_TOGGLE |	OID_802_11_RSSI_TRIGGER)
-#define	RT_OID_802_11_FRAGMENTATION_THRESHOLD (OID_GET_SET_TOGGLE |	OID_802_11_FRAGMENTATION_THRESHOLD)
-#define	RT_OID_802_11_RTS_THRESHOLD			  (OID_GET_SET_TOGGLE |	OID_802_11_RTS_THRESHOLD)
-#define	RT_OID_802_11_RX_ANTENNA_SELECTED	  (OID_GET_SET_TOGGLE |	OID_802_11_RX_ANTENNA_SELECTED)
-#define	RT_OID_802_11_TX_ANTENNA_SELECTED	  (OID_GET_SET_TOGGLE |	OID_802_11_TX_ANTENNA_SELECTED)
-#define	RT_OID_802_11_SUPPORTED_RATES		  (OID_GET_SET_TOGGLE |	OID_802_11_SUPPORTED_RATES)
-#define	RT_OID_802_11_DESIRED_RATES			  (OID_GET_SET_TOGGLE |	OID_802_11_DESIRED_RATES)
-#define	RT_OID_802_11_CONFIGURATION			  (OID_GET_SET_TOGGLE |	OID_802_11_CONFIGURATION)
-#define	RT_OID_802_11_POWER_MODE			  (OID_GET_SET_TOGGLE |	OID_802_11_POWER_MODE)
-#define RT_OID_802_11_SET_PSPXLINK_MODE		  (OID_GET_SET_TOGGLE |	OID_802_11_SET_PSPXLINK_MODE)
-#define RT_OID_802_11_EAP_METHOD			  (OID_GET_SET_TOGGLE | OID_802_11_EAP_METHOD)
-#define RT_OID_802_11_SET_PASSPHRASE		  (OID_GET_SET_TOGGLE | OID_802_11_SET_PASSPHRASE)
-
-
-
-typedef enum _NDIS_802_11_STATUS_TYPE
-{
-    Ndis802_11StatusType_Authentication,
-    Ndis802_11StatusType_MediaStreamMode,
-    Ndis802_11StatusType_PMKID_CandidateList,
-    Ndis802_11StatusTypeMax    // not a real type, defined as an upper bound
-} NDIS_802_11_STATUS_TYPE, *PNDIS_802_11_STATUS_TYPE;
-
-typedef UCHAR   NDIS_802_11_MAC_ADDRESS[6];
-
-typedef struct _NDIS_802_11_STATUS_INDICATION
-{
-    NDIS_802_11_STATUS_TYPE StatusType;
-} NDIS_802_11_STATUS_INDICATION, *PNDIS_802_11_STATUS_INDICATION;
-
-// mask for authentication/integrity fields
-#define NDIS_802_11_AUTH_REQUEST_AUTH_FIELDS        0x0f
-
-#define NDIS_802_11_AUTH_REQUEST_REAUTH             0x01
-#define NDIS_802_11_AUTH_REQUEST_KEYUPDATE          0x02
-#define NDIS_802_11_AUTH_REQUEST_PAIRWISE_ERROR     0x06
-#define NDIS_802_11_AUTH_REQUEST_GROUP_ERROR        0x0E
-
-typedef struct _NDIS_802_11_AUTHENTICATION_REQUEST
-{
-    ULONG Length;            // Length of structure
-    NDIS_802_11_MAC_ADDRESS Bssid;
-    ULONG Flags;
-} NDIS_802_11_AUTHENTICATION_REQUEST, *PNDIS_802_11_AUTHENTICATION_REQUEST;
-
-//Added new types for PMKID Candidate lists.
-typedef struct _PMKID_CANDIDATE {
-    NDIS_802_11_MAC_ADDRESS BSSID;
-    ULONG Flags;
-} PMKID_CANDIDATE, *PPMKID_CANDIDATE;
-
-typedef struct _NDIS_802_11_PMKID_CANDIDATE_LIST
-{
-    ULONG Version;       // Version of the structure
-    ULONG NumCandidates; // No. of pmkid candidates
-    PMKID_CANDIDATE CandidateList[1];
-} NDIS_802_11_PMKID_CANDIDATE_LIST, *PNDIS_802_11_PMKID_CANDIDATE_LIST;
-
-//Flags for PMKID Candidate list structure
-#define NDIS_802_11_PMKID_CANDIDATE_PREAUTH_ENABLED	0x01
-
-// Added new types for OFDM 5G and 2.4G
-typedef enum _NDIS_802_11_NETWORK_TYPE
-{
-   Ndis802_11FH,
-   Ndis802_11DS,
-    Ndis802_11OFDM5,
-    Ndis802_11OFDM24,
-	Ndis802_11Automode,
-    Ndis802_11OFDM5_N,
-    Ndis802_11OFDM24_N,
-    Ndis802_11NetworkTypeMax    // not a real type, defined as an upper bound
-} NDIS_802_11_NETWORK_TYPE, *PNDIS_802_11_NETWORK_TYPE;
-
-typedef struct _NDIS_802_11_NETWORK_TYPE_LIST
-{
-    UINT                       NumberOfItems;  // in list below, at least 1
-   NDIS_802_11_NETWORK_TYPE    NetworkType [1];
-} NDIS_802_11_NETWORK_TYPE_LIST, *PNDIS_802_11_NETWORK_TYPE_LIST;
-
-typedef enum _NDIS_802_11_POWER_MODE
-{
-    Ndis802_11PowerModeCAM,
-    Ndis802_11PowerModeMAX_PSP,
-    Ndis802_11PowerModeFast_PSP,
-    Ndis802_11PowerModeLegacy_PSP,
-    Ndis802_11PowerModeMax      // not a real mode, defined as an upper bound
-} NDIS_802_11_POWER_MODE, *PNDIS_802_11_POWER_MODE;
-
-typedef ULONG   NDIS_802_11_TX_POWER_LEVEL; // in milliwatts
-
-//
-// Received Signal Strength Indication
-//
-typedef LONG    NDIS_802_11_RSSI;           // in dBm
-
-typedef struct _NDIS_802_11_CONFIGURATION_FH
-{
-   ULONG           Length;            // Length of structure
-   ULONG           HopPattern;        // As defined by 802.11, MSB set
-   ULONG           HopSet;            // to one if non-802.11
-   ULONG           DwellTime;         // units are Kusec
-} NDIS_802_11_CONFIGURATION_FH, *PNDIS_802_11_CONFIGURATION_FH;
-
-typedef struct _NDIS_802_11_CONFIGURATION
-{
-   ULONG                           Length;             // Length of structure
-   ULONG                           BeaconPeriod;       // units are Kusec
-   ULONG                           ATIMWindow;         // units are Kusec
-   ULONG                           DSConfig;           // Frequency, units are kHz
-   NDIS_802_11_CONFIGURATION_FH    FHConfig;
-} NDIS_802_11_CONFIGURATION, *PNDIS_802_11_CONFIGURATION;
-
-typedef struct _NDIS_802_11_STATISTICS
-{
-   ULONG           Length;             // Length of structure
-   LARGE_INTEGER   TransmittedFragmentCount;
-   LARGE_INTEGER   MulticastTransmittedFrameCount;
-   LARGE_INTEGER   FailedCount;
-   LARGE_INTEGER   RetryCount;
-   LARGE_INTEGER   MultipleRetryCount;
-   LARGE_INTEGER   RTSSuccessCount;
-   LARGE_INTEGER   RTSFailureCount;
-   LARGE_INTEGER   ACKFailureCount;
-   LARGE_INTEGER   FrameDuplicateCount;
-   LARGE_INTEGER   ReceivedFragmentCount;
-   LARGE_INTEGER   MulticastReceivedFrameCount;
-   LARGE_INTEGER   FCSErrorCount;
-   LARGE_INTEGER   TKIPLocalMICFailures;
-   LARGE_INTEGER   TKIPRemoteMICErrors;
-   LARGE_INTEGER   TKIPICVErrors;
-   LARGE_INTEGER   TKIPCounterMeasuresInvoked;
-   LARGE_INTEGER   TKIPReplays;
-   LARGE_INTEGER   CCMPFormatErrors;
-   LARGE_INTEGER   CCMPReplays;
-   LARGE_INTEGER   CCMPDecryptErrors;
-   LARGE_INTEGER   FourWayHandshakeFailures;
-} NDIS_802_11_STATISTICS, *PNDIS_802_11_STATISTICS;
-
-typedef  ULONG  NDIS_802_11_KEY_INDEX;
-typedef ULONGLONG   NDIS_802_11_KEY_RSC;
-
-#define MAX_RADIUS_SRV_NUM			2	  // 802.1x failover number
-
-typedef struct PACKED _RADIUS_SRV_INFO {
-	UINT32			radius_ip;
-	UINT32			radius_port;
-	UCHAR			radius_key[64];
-	UCHAR			radius_key_len;
-} RADIUS_SRV_INFO, *PRADIUS_SRV_INFO;
-
-typedef struct PACKED _RADIUS_KEY_INFO
-{
-	UCHAR			radius_srv_num;
-	RADIUS_SRV_INFO	radius_srv_info[MAX_RADIUS_SRV_NUM];
-	UCHAR			ieee8021xWEP;		 // dynamic WEP
-    UCHAR           key_index;
-    UCHAR           key_length;          // length of key in bytes
-    UCHAR           key_material[13];
-} RADIUS_KEY_INFO, *PRADIUS_KEY_INFO;
-
-// It's used by 802.1x daemon to require relative configuration
-typedef struct PACKED _RADIUS_CONF
-{
-    UINT32          Length;             // Length of this structure
-    UCHAR			mbss_num;			// indicate multiple BSS number
-	UINT32			own_ip_addr;
-	UINT32			retry_interval;
-	UINT32			session_timeout_interval;
-	UCHAR			EAPifname[8][IFNAMSIZ];
-	UCHAR			EAPifname_len[8];
-	UCHAR			PreAuthifname[8][IFNAMSIZ];
-	UCHAR			PreAuthifname_len[8];
-	RADIUS_KEY_INFO	RadiusInfo[8];
-} RADIUS_CONF, *PRADIUS_CONF;
-
-
-
-#ifdef CONFIG_STA_SUPPORT
-// Key mapping keys require a BSSID
-typedef struct _NDIS_802_11_KEY
-{
-    UINT           Length;             // Length of this structure
-    UINT           KeyIndex;
-    UINT           KeyLength;          // length of key in bytes
-    NDIS_802_11_MAC_ADDRESS BSSID;
-    NDIS_802_11_KEY_RSC KeyRSC;
-    UCHAR           KeyMaterial[1];     // variable length depending on above field
-} NDIS_802_11_KEY, *PNDIS_802_11_KEY;
-
-typedef struct _NDIS_802_11_PASSPHRASE
-{
-    UINT           KeyLength;          // length of key in bytes
-    NDIS_802_11_MAC_ADDRESS BSSID;
-    UCHAR           KeyMaterial[1];     // variable length depending on above field
-} NDIS_802_11_PASSPHRASE, *PNDIS_802_11_PASSPHRASE;
-#endif // CONFIG_STA_SUPPORT //
-
-typedef struct _NDIS_802_11_REMOVE_KEY
-{
-    UINT           Length;             // Length of this structure
-    UINT           KeyIndex;
-    NDIS_802_11_MAC_ADDRESS BSSID;
-} NDIS_802_11_REMOVE_KEY, *PNDIS_802_11_REMOVE_KEY;
-
-typedef struct _NDIS_802_11_WEP
-{
-   UINT     Length;        // Length of this structure
-   UINT     KeyIndex;           // 0 is the per-client key, 1-N are the
-                                        // global keys
-   UINT     KeyLength;     // length of key in bytes
-   UCHAR     KeyMaterial[1];// variable length depending on above field
-} NDIS_802_11_WEP, *PNDIS_802_11_WEP;
-
-
-typedef enum _NDIS_802_11_NETWORK_INFRASTRUCTURE
-{
-   Ndis802_11IBSS,
-   Ndis802_11Infrastructure,
-   Ndis802_11AutoUnknown,
-   Ndis802_11Monitor,
-   Ndis802_11InfrastructureMax     // Not a real value, defined as upper bound
-} NDIS_802_11_NETWORK_INFRASTRUCTURE, *PNDIS_802_11_NETWORK_INFRASTRUCTURE;
-
-// Add new authentication modes
-typedef enum _NDIS_802_11_AUTHENTICATION_MODE
-{
-   Ndis802_11AuthModeOpen,
-   Ndis802_11AuthModeShared,
-   Ndis802_11AuthModeAutoSwitch,
-    Ndis802_11AuthModeWPA,
-    Ndis802_11AuthModeWPAPSK,
-    Ndis802_11AuthModeWPANone,
-   Ndis802_11AuthModeWPA2,
-   Ndis802_11AuthModeWPA2PSK,
-	Ndis802_11AuthModeWPA1WPA2,
-	Ndis802_11AuthModeWPA1PSKWPA2PSK,
-   Ndis802_11AuthModeMax           // Not a real mode, defined as upper bound
-} NDIS_802_11_AUTHENTICATION_MODE, *PNDIS_802_11_AUTHENTICATION_MODE;
-
-typedef UCHAR   NDIS_802_11_RATES[NDIS_802_11_LENGTH_RATES];        // Set of 8 data rates
-typedef UCHAR   NDIS_802_11_RATES_EX[NDIS_802_11_LENGTH_RATES_EX];  // Set of 16 data rates
-
-typedef struct PACKED _NDIS_802_11_SSID
-{
-    UINT   SsidLength;         // length of SSID field below, in bytes;
-                                // this can be zero.
-    UCHAR   Ssid[NDIS_802_11_LENGTH_SSID];           // SSID information field
-} NDIS_802_11_SSID, *PNDIS_802_11_SSID;
-
-
-typedef struct PACKED _NDIS_WLAN_BSSID
-{
-   ULONG                               Length;     // Length of this structure
-   NDIS_802_11_MAC_ADDRESS             MacAddress; // BSSID
-   UCHAR                               Reserved[2];
-   NDIS_802_11_SSID                    Ssid;       // SSID
-   ULONG                               Privacy;    // WEP encryption requirement
-   NDIS_802_11_RSSI                    Rssi;       // receive signal strength in dBm
-   NDIS_802_11_NETWORK_TYPE            NetworkTypeInUse;
-   NDIS_802_11_CONFIGURATION           Configuration;
-   NDIS_802_11_NETWORK_INFRASTRUCTURE  InfrastructureMode;
-   NDIS_802_11_RATES                   SupportedRates;
-} NDIS_WLAN_BSSID, *PNDIS_WLAN_BSSID;
-
-typedef struct PACKED _NDIS_802_11_BSSID_LIST
-{
-   UINT           NumberOfItems;      // in list below, at least 1
-   NDIS_WLAN_BSSID Bssid[1];
-} NDIS_802_11_BSSID_LIST, *PNDIS_802_11_BSSID_LIST;
-
-// Added Capabilities, IELength and IEs for each BSSID
-typedef struct PACKED _NDIS_WLAN_BSSID_EX
-{
-    ULONG                               Length;             // Length of this structure
-    NDIS_802_11_MAC_ADDRESS             MacAddress;         // BSSID
-    UCHAR                               Reserved[2];
-    NDIS_802_11_SSID                    Ssid;               // SSID
-    UINT                                Privacy;            // WEP encryption requirement
-    NDIS_802_11_RSSI                    Rssi;               // receive signal
-                                                            // strength in dBm
-    NDIS_802_11_NETWORK_TYPE            NetworkTypeInUse;
-    NDIS_802_11_CONFIGURATION           Configuration;
-    NDIS_802_11_NETWORK_INFRASTRUCTURE  InfrastructureMode;
-    NDIS_802_11_RATES_EX                SupportedRates;
-    ULONG                               IELength;
-    UCHAR                               IEs[1];
-} NDIS_WLAN_BSSID_EX, *PNDIS_WLAN_BSSID_EX;
-
-typedef struct PACKED _NDIS_802_11_BSSID_LIST_EX
-{
-    UINT                   NumberOfItems;      // in list below, at least 1
-    NDIS_WLAN_BSSID_EX      Bssid[1];
-} NDIS_802_11_BSSID_LIST_EX, *PNDIS_802_11_BSSID_LIST_EX;
-
-typedef struct PACKED _NDIS_802_11_FIXED_IEs
-{
-    UCHAR Timestamp[8];
-    USHORT BeaconInterval;
-    USHORT Capabilities;
-} NDIS_802_11_FIXED_IEs, *PNDIS_802_11_FIXED_IEs;
-
-typedef struct _NDIS_802_11_VARIABLE_IEs
-{
-    UCHAR ElementID;
-    UCHAR Length;    // Number of bytes in data field
-    UCHAR data[1];
-} NDIS_802_11_VARIABLE_IEs, *PNDIS_802_11_VARIABLE_IEs;
-
-typedef  ULONG   NDIS_802_11_FRAGMENTATION_THRESHOLD;
-
-typedef  ULONG   NDIS_802_11_RTS_THRESHOLD;
-
-typedef  ULONG   NDIS_802_11_ANTENNA;
-
-typedef enum _NDIS_802_11_PRIVACY_FILTER
-{
-   Ndis802_11PrivFilterAcceptAll,
-   Ndis802_11PrivFilter8021xWEP
-} NDIS_802_11_PRIVACY_FILTER, *PNDIS_802_11_PRIVACY_FILTER;
-
-// Added new encryption types
-// Also aliased typedef to new name
-typedef enum _NDIS_802_11_WEP_STATUS
-{
-   Ndis802_11WEPEnabled,
-    Ndis802_11Encryption1Enabled = Ndis802_11WEPEnabled,
-   Ndis802_11WEPDisabled,
-    Ndis802_11EncryptionDisabled = Ndis802_11WEPDisabled,
-   Ndis802_11WEPKeyAbsent,
-    Ndis802_11Encryption1KeyAbsent = Ndis802_11WEPKeyAbsent,
-   Ndis802_11WEPNotSupported,
-    Ndis802_11EncryptionNotSupported = Ndis802_11WEPNotSupported,
-    Ndis802_11Encryption2Enabled,
-    Ndis802_11Encryption2KeyAbsent,
-    Ndis802_11Encryption3Enabled,
-    Ndis802_11Encryption3KeyAbsent,
-    Ndis802_11Encryption4Enabled,	// TKIP or AES mix
-    Ndis802_11Encryption4KeyAbsent,
-    Ndis802_11GroupWEP40Enabled,
-	Ndis802_11GroupWEP104Enabled,
-} NDIS_802_11_WEP_STATUS, *PNDIS_802_11_WEP_STATUS,
-  NDIS_802_11_ENCRYPTION_STATUS, *PNDIS_802_11_ENCRYPTION_STATUS;
-
-typedef enum _NDIS_802_11_RELOAD_DEFAULTS
-{
-   Ndis802_11ReloadWEPKeys
-} NDIS_802_11_RELOAD_DEFAULTS, *PNDIS_802_11_RELOAD_DEFAULTS;
-
-#define NDIS_802_11_AI_REQFI_CAPABILITIES      1
-#define NDIS_802_11_AI_REQFI_LISTENINTERVAL    2
-#define NDIS_802_11_AI_REQFI_CURRENTAPADDRESS  4
-
-#define NDIS_802_11_AI_RESFI_CAPABILITIES      1
-#define NDIS_802_11_AI_RESFI_STATUSCODE        2
-#define NDIS_802_11_AI_RESFI_ASSOCIATIONID     4
-
-typedef struct _NDIS_802_11_AI_REQFI
-{
-    USHORT Capabilities;
-    USHORT ListenInterval;
-    NDIS_802_11_MAC_ADDRESS  CurrentAPAddress;
-} NDIS_802_11_AI_REQFI, *PNDIS_802_11_AI_REQFI;
-
-typedef struct _NDIS_802_11_AI_RESFI
-{
-    USHORT Capabilities;
-    USHORT StatusCode;
-    USHORT AssociationId;
-} NDIS_802_11_AI_RESFI, *PNDIS_802_11_AI_RESFI;
-
-typedef struct _NDIS_802_11_ASSOCIATION_INFORMATION
-{
-    ULONG                   Length;
-    USHORT                  AvailableRequestFixedIEs;
-    NDIS_802_11_AI_REQFI    RequestFixedIEs;
-    ULONG                   RequestIELength;
-    ULONG                   OffsetRequestIEs;
-    USHORT                  AvailableResponseFixedIEs;
-    NDIS_802_11_AI_RESFI    ResponseFixedIEs;
-    ULONG                   ResponseIELength;
-    ULONG                   OffsetResponseIEs;
-} NDIS_802_11_ASSOCIATION_INFORMATION, *PNDIS_802_11_ASSOCIATION_INFORMATION;
-
-typedef struct _NDIS_802_11_AUTHENTICATION_EVENT
-{
-    NDIS_802_11_STATUS_INDICATION       Status;
-    NDIS_802_11_AUTHENTICATION_REQUEST  Request[1];
-} NDIS_802_11_AUTHENTICATION_EVENT, *PNDIS_802_11_AUTHENTICATION_EVENT;
-
-/*
-typedef struct _NDIS_802_11_TEST
-{
-    ULONG Length;
-    ULONG Type;
-    union
-    {
-        NDIS_802_11_AUTHENTICATION_EVENT AuthenticationEvent;
-        NDIS_802_11_RSSI RssiTrigger;
-    };
-} NDIS_802_11_TEST, *PNDIS_802_11_TEST;
- */
-
-// 802.11 Media stream constraints, associated with OID_802_11_MEDIA_STREAM_MODE
-typedef enum _NDIS_802_11_MEDIA_STREAM_MODE
-{
-    Ndis802_11MediaStreamOff,
-    Ndis802_11MediaStreamOn,
-} NDIS_802_11_MEDIA_STREAM_MODE, *PNDIS_802_11_MEDIA_STREAM_MODE;
-
-// PMKID Structures
-typedef UCHAR   NDIS_802_11_PMKID_VALUE[16];
-
-#ifdef CONFIG_STA_SUPPORT
-typedef struct _BSSID_INFO
-{
-    NDIS_802_11_MAC_ADDRESS BSSID;
-    NDIS_802_11_PMKID_VALUE PMKID;
-} BSSID_INFO, *PBSSID_INFO;
-
-typedef struct _NDIS_802_11_PMKID
-{
-    UINT    Length;
-    UINT    BSSIDInfoCount;
-    BSSID_INFO BSSIDInfo[1];
-} NDIS_802_11_PMKID, *PNDIS_802_11_PMKID;
-#endif // CONFIG_STA_SUPPORT //
-
-
-typedef struct _NDIS_802_11_AUTHENTICATION_ENCRYPTION
-{
-    NDIS_802_11_AUTHENTICATION_MODE AuthModeSupported;
-    NDIS_802_11_ENCRYPTION_STATUS EncryptStatusSupported;
-} NDIS_802_11_AUTHENTICATION_ENCRYPTION, *PNDIS_802_11_AUTHENTICATION_ENCRYPTION;
-
-typedef struct _NDIS_802_11_CAPABILITY
-{
-     ULONG Length;
-     ULONG Version;
-     ULONG NoOfPMKIDs;
-     ULONG NoOfAuthEncryptPairsSupported;
-     NDIS_802_11_AUTHENTICATION_ENCRYPTION AuthenticationEncryptionSupported[1];
-} NDIS_802_11_CAPABILITY, *PNDIS_802_11_CAPABILITY;
-
-#ifdef LINUX
-#if WIRELESS_EXT <= 11
-#ifndef SIOCDEVPRIVATE
-#define SIOCDEVPRIVATE                              0x8BE0
-#endif
-#define SIOCIWFIRSTPRIV								SIOCDEVPRIVATE
-#endif
-#endif // LINUX //
-
-
-#ifdef CONFIG_STA_SUPPORT
-#define RT_PRIV_IOCTL							(SIOCIWFIRSTPRIV + 0x01) // Sync. with AP for wsc upnp daemon
-#define RTPRIV_IOCTL_SET							(SIOCIWFIRSTPRIV + 0x02)
-
-#ifdef DBG
-#define RTPRIV_IOCTL_BBP                            (SIOCIWFIRSTPRIV + 0x03)
-#define RTPRIV_IOCTL_MAC                            (SIOCIWFIRSTPRIV + 0x05)
-
-#ifdef RTMP_RF_RW_SUPPORT
-// TODO: shiang, Need to reassign the oid number. ArchTeam use (SIOCIWFIRSTPRIV + 0x19) for this oid
-#define RTPRIV_IOCTL_RF                             (SIOCIWFIRSTPRIV + 0x13)  // edit by johnli, fix read rf register problem
-#endif // RTMP_RF_RW_SUPPORT //
-
-#define RTPRIV_IOCTL_E2P                            (SIOCIWFIRSTPRIV + 0x07)
-#endif // DBG //
-
-#ifdef RALINK_ATE
-#ifdef RALINK_28xx_QA
-#define RTPRIV_IOCTL_ATE							(SIOCIWFIRSTPRIV + 0x08)
-#endif // RALINK_28xx_QA //
-#endif // RALINK_ATE //
-
-#define RTPRIV_IOCTL_STATISTICS                     (SIOCIWFIRSTPRIV + 0x09)
-#define RTPRIV_IOCTL_ADD_PMKID_CACHE                (SIOCIWFIRSTPRIV + 0x0A)
-#define RTPRIV_IOCTL_RADIUS_DATA                    (SIOCIWFIRSTPRIV + 0x0C)
-#define RTPRIV_IOCTL_GSITESURVEY					(SIOCIWFIRSTPRIV + 0x0D)
-#define RT_PRIV_IOCTL_EXT							(SIOCIWFIRSTPRIV + 0x0E) // Sync. with RT61 (for wpa_supplicant)
-#define RTPRIV_IOCTL_GET_MAC_TABLE					(SIOCIWFIRSTPRIV + 0x0F)
-
-#define RTPRIV_IOCTL_SHOW							(SIOCIWFIRSTPRIV + 0x11)
-enum {
-	SHOW_CONN_STATUS = 4,
-	SHOW_DRVIER_VERION = 5,
-	SHOW_BA_INFO = 6,
-	SHOW_DESC_INFO = 7,
-	RAIO_OFF = 10,
-	RAIO_ON = 11,
-#ifdef QOS_DLS_SUPPORT
-	SHOW_DLS_ENTRY_INFO = 19,
-#endif // QOS_DLS_SUPPORT //
-	SHOW_CFG_VALUE = 20,
-	SHOW_ADHOC_ENTRY_INFO = 21,
-};
-
-
-#endif // CONFIG_STA_SUPPORT //
-
-
-
-#ifdef SNMP_SUPPORT
-//SNMP ieee 802dot11, kathy , 2008_0220
-// dot11res(3)
-#define RT_OID_802_11_MANUFACTUREROUI			0x0700
-#define RT_OID_802_11_MANUFACTURERNAME			0x0701
-#define RT_OID_802_11_RESOURCETYPEIDNAME		0x0702
-
-// dot11smt(1)
-#define RT_OID_802_11_PRIVACYOPTIONIMPLEMENTED	0x0703
-#define RT_OID_802_11_POWERMANAGEMENTMODE		0x0704
-#define OID_802_11_WEPDEFAULTKEYVALUE			0x0705 // read , write
-#define OID_802_11_WEPDEFAULTKEYID				0x0706
-#define RT_OID_802_11_WEPKEYMAPPINGLENGTH		0x0707
-#define OID_802_11_SHORTRETRYLIMIT				0x0708
-#define OID_802_11_LONGRETRYLIMIT				0x0709
-#define RT_OID_802_11_PRODUCTID					0x0710
-#define RT_OID_802_11_MANUFACTUREID				0x0711
-
-// //dot11Phy(4)
-#define OID_802_11_CURRENTCHANNEL				0x0712
-
-//dot11mac
-#define RT_OID_802_11_MAC_ADDRESS				0x0713
-#endif // SNMP_SUPPORT //
-
-#define OID_802_11_BUILD_CHANNEL_EX				0x0714
-#define OID_802_11_GET_CH_LIST					0x0715
-#define OID_802_11_GET_COUNTRY_CODE				0x0716
-#define OID_802_11_GET_CHANNEL_GEOGRAPHY		0x0717
-
-//#define RT_OID_802_11_STATISTICS              (OID_GET_SET_TOGGLE | OID_802_11_STATISTICS)
-
-#ifdef CONFIG_STA_SUPPORT
-#define RT_OID_WSC_SET_PASSPHRASE                   0x0740 // passphrase for wpa(2)-psk
-#define RT_OID_WSC_DRIVER_AUTO_CONNECT              0x0741
-#define RT_OID_WSC_QUERY_DEFAULT_PROFILE            0x0742
-#define RT_OID_WSC_SET_CONN_BY_PROFILE_INDEX        0x0743
-#define RT_OID_WSC_SET_ACTION                       0x0744
-#define RT_OID_WSC_SET_SSID                         0x0745
-#define RT_OID_WSC_SET_PIN_CODE                     0x0746
-#define RT_OID_WSC_SET_MODE                         0x0747 // PIN or PBC
-#define RT_OID_WSC_SET_CONF_MODE                    0x0748 // Enrollee or Registrar
-#define RT_OID_WSC_SET_PROFILE                      0x0749
-#endif // CONFIG_STA_SUPPORT //
-#define	RT_OID_WSC_CONFIG_STATUS					0x074F
-#define RT_OID_802_11_WSC_QUERY_PROFILE				0x0750
-// for consistency with RT61
-#define RT_OID_WSC_QUERY_STATUS						0x0751
-#define RT_OID_WSC_PIN_CODE							0x0752
-#define RT_OID_WSC_UUID								0x0753
-#define RT_OID_WSC_SET_SELECTED_REGISTRAR			0x0754
-#define RT_OID_WSC_EAPMSG							0x0755
-#define RT_OID_WSC_MANUFACTURER						0x0756
-#define RT_OID_WSC_MODEL_NAME						0x0757
-#define RT_OID_WSC_MODEL_NO							0x0758
-#define RT_OID_WSC_SERIAL_NO						0x0759
-#define RT_OID_WSC_MAC_ADDRESS						0x0760
-
-#ifdef LLTD_SUPPORT
-// for consistency with RT61
-#define RT_OID_GET_PHY_MODE                         0x761
-#endif // LLTD_SUPPORT //
-
-#ifdef NINTENDO_AP
-//#define RT_OID_NINTENDO                             0x0D010770
-#define RT_OID_802_11_NINTENDO_GET_TABLE			0x0771 //((RT_OID_NINTENDO + 0x01) & 0xffff)
-#define RT_OID_802_11_NINTENDO_SET_TABLE			0x0772 //((RT_OID_NINTENDO + 0x02) & 0xffff)
-#define RT_OID_802_11_NINTENDO_CAPABLE				0x0773 //((RT_OID_NINTENDO + 0x03) & 0xffff)
-#endif // NINTENDO_AP //
-
-
-// New for MeetingHouse Api support
-#define OID_MH_802_1X_SUPPORTED               0xFFEDC100
-
-// MIMO Tx parameter, ShortGI, MCS, STBC, etc.  these are fields in TXWI. Don't change this definition!!!
-typedef union  _HTTRANSMIT_SETTING {
-#ifdef RT_BIG_ENDIAN
-	struct	{
-	USHORT		MODE:2;	// Use definition MODE_xxx.
-//	USHORT		rsv:3;
-	USHORT		TxBF:1;
-	USHORT		rsv:2;
-	USHORT		STBC:2;	//SPACE
-	USHORT		ShortGI:1;
-	USHORT		BW:1;	//channel bandwidth 20MHz or 40 MHz
-	USHORT		MCS:7;                 // MCS
-	}	field;
-#else
-	struct	{
-	USHORT		MCS:7;                 // MCS
-	USHORT		BW:1;	//channel bandwidth 20MHz or 40 MHz
-	USHORT		ShortGI:1;
-	USHORT		STBC:2;	//SPACE
-//	USHORT		rsv:3;
-	USHORT		rsv:2;
-	USHORT		TxBF:1;
-	USHORT		MODE:2;	// Use definition MODE_xxx.
-	}	field;
-#endif
-	USHORT		word;
- } HTTRANSMIT_SETTING, *PHTTRANSMIT_SETTING;
-
-typedef enum _RT_802_11_PREAMBLE {
-    Rt802_11PreambleLong,
-    Rt802_11PreambleShort,
-    Rt802_11PreambleAuto
-} RT_802_11_PREAMBLE, *PRT_802_11_PREAMBLE;
-
-typedef enum _RT_802_11_PHY_MODE {
-	PHY_11BG_MIXED = 0,
-	PHY_11B,
-	PHY_11A,
-	PHY_11ABG_MIXED,
-	PHY_11G,
-#ifdef DOT11_N_SUPPORT
-	PHY_11ABGN_MIXED,	// both band   5
-	PHY_11N_2_4G,		// 11n-only with 2.4G band	6
-	PHY_11GN_MIXED,	// 2.4G band      7
-	PHY_11AN_MIXED,	// 5G  band       8
-	PHY_11BGN_MIXED,	// if check 802.11b.      9
-	PHY_11AGN_MIXED,	// if check 802.11b.      10
-	PHY_11N_5G,			// 11n-only with 5G band		11
-#endif // DOT11_N_SUPPORT //
-} RT_802_11_PHY_MODE;
-
-
-// put all proprietery for-query objects here to reduce # of Query_OID
-typedef struct _RT_802_11_LINK_STATUS {
-    ULONG   CurrTxRate;         // in units of 0.5Mbps
-    ULONG   ChannelQuality;     // 0..100 %
-    ULONG   TxByteCount;        // both ok and fail
-    ULONG   RxByteCount;        // both ok and fail
-    ULONG	CentralChannel;		// 40MHz central channel number
-} RT_802_11_LINK_STATUS, *PRT_802_11_LINK_STATUS;
-
-typedef struct _RT_802_11_EVENT_LOG {
-    LARGE_INTEGER   SystemTime;  // timestammp via NdisGetCurrentSystemTime()
-    UCHAR           Addr[MAC_ADDR_LENGTH];
-    USHORT          Event;       // EVENT_xxx
-} RT_802_11_EVENT_LOG, *PRT_802_11_EVENT_LOG;
-
-typedef struct _RT_802_11_EVENT_TABLE {
-    ULONG       Num;
-    ULONG       Rsv;     // to align Log[] at LARGE_INEGER boundary
-    RT_802_11_EVENT_LOG   Log[MAX_NUMBER_OF_EVENT];
-} RT_802_11_EVENT_TABLE, PRT_802_11_EVENT_TABLE;
-
-// MIMO Tx parameter, ShortGI, MCS, STBC, etc.  these are fields in TXWI. Don't change this definition!!!
-typedef union  _MACHTTRANSMIT_SETTING {
-	struct	{
-	USHORT		MCS:7;                 // MCS
-	USHORT		BW:1;	//channel bandwidth 20MHz or 40 MHz
-	USHORT		ShortGI:1;
-	USHORT		STBC:2;	//SPACE
-	USHORT		rsv:3;
-	USHORT		MODE:2;	// Use definition MODE_xxx.
-	}	field;
-	USHORT		word;
- } MACHTTRANSMIT_SETTING, *PMACHTTRANSMIT_SETTING;
-
-typedef struct _RT_802_11_MAC_ENTRY {
-    UCHAR       Addr[MAC_ADDR_LENGTH];
-    UCHAR       Aid;
-    UCHAR       Psm;     // 0:PWR_ACTIVE, 1:PWR_SAVE
-    UCHAR		MimoPs;  // 0:MMPS_STATIC, 1:MMPS_DYNAMIC, 3:MMPS_Enabled
-    CHAR		AvgRssi0;
-	CHAR		AvgRssi1;
-	CHAR		AvgRssi2;
-	UINT32		ConnectedTime;
-    MACHTTRANSMIT_SETTING	TxRate;
-} RT_802_11_MAC_ENTRY, *PRT_802_11_MAC_ENTRY;
-
-typedef struct _RT_802_11_MAC_TABLE {
-    ULONG       Num;
-    RT_802_11_MAC_ENTRY Entry[MAX_NUMBER_OF_MAC];
-} RT_802_11_MAC_TABLE, *PRT_802_11_MAC_TABLE;
-
-// structure for query/set hardware register - MAC, BBP, RF register
-typedef struct _RT_802_11_HARDWARE_REGISTER {
-    ULONG   HardwareType;       // 0:MAC, 1:BBP, 2:RF register, 3:EEPROM
-    ULONG   Offset;             // Q/S register offset addr
-    ULONG   Data;               // R/W data buffer
-} RT_802_11_HARDWARE_REGISTER, *PRT_802_11_HARDWARE_REGISTER;
-
-typedef struct _RT_802_11_AP_CONFIG {
-    ULONG   EnableTxBurst;      // 0-disable, 1-enable
-    ULONG   EnableTurboRate;    // 0-disable, 1-enable 72/100mbps turbo rate
-    ULONG   IsolateInterStaTraffic;     // 0-disable, 1-enable isolation
-    ULONG   HideSsid;           // 0-disable, 1-enable hiding
-    ULONG   UseBGProtection;    // 0-AUTO, 1-always ON, 2-always OFF
-    ULONG   UseShortSlotTime;   // 0-no use, 1-use 9-us short slot time
-    ULONG   Rsv1;               // must be 0
-    ULONG   SystemErrorBitmap;  // ignore upon SET, return system error upon QUERY
-} RT_802_11_AP_CONFIG, *PRT_802_11_AP_CONFIG;
-
-// structure to query/set STA_CONFIG
-typedef struct _RT_802_11_STA_CONFIG {
-    ULONG   EnableTxBurst;      // 0-disable, 1-enable
-    ULONG   EnableTurboRate;    // 0-disable, 1-enable 72/100mbps turbo rate
-    ULONG   UseBGProtection;    // 0-AUTO, 1-always ON, 2-always OFF
-    ULONG   UseShortSlotTime;   // 0-no use, 1-use 9-us short slot time when applicable
-    ULONG   AdhocMode;			// 0-11b rates only (WIFI spec), 1 - b/g mixed, 2 - g only
-    ULONG   HwRadioStatus;      // 0-OFF, 1-ON, default is 1, Read-Only
-    ULONG   Rsv1;               // must be 0
-    ULONG   SystemErrorBitmap;  // ignore upon SET, return system error upon QUERY
-} RT_802_11_STA_CONFIG, *PRT_802_11_STA_CONFIG;
-
-//
-//  For OID Query or Set about BA structure
-//
-typedef	struct	_OID_BACAP_STRUC	{
-		UCHAR		RxBAWinLimit;
-		UCHAR		TxBAWinLimit;
-		UCHAR		Policy;	// 0: DELAY_BA 1:IMMED_BA  (//BA Policy subfiled value in ADDBA frame)   2:BA-not use. other value invalid
-		UCHAR		MpduDensity;	// 0: DELAY_BA 1:IMMED_BA  (//BA Policy subfiled value in ADDBA frame)   2:BA-not use. other value invalid
-		UCHAR		AmsduEnable;	//Enable AMSDU transmisstion
-		UCHAR		AmsduSize;	// 0:3839, 1:7935 bytes. UINT  MSDUSizeToBytes[]	= { 3839, 7935};
-		UCHAR		MMPSmode;	// MIMO power save more, 0:static, 1:dynamic, 2:rsv, 3:mimo enable
-		BOOLEAN		AutoBA;	// Auto BA will automatically
-} OID_BACAP_STRUC, *POID_BACAP_STRUC;
-
-typedef struct _RT_802_11_ACL_ENTRY {
-    UCHAR   Addr[MAC_ADDR_LENGTH];
-    USHORT  Rsv;
-} RT_802_11_ACL_ENTRY, *PRT_802_11_ACL_ENTRY;
-
-typedef struct PACKED _RT_802_11_ACL {
-    ULONG   Policy;             // 0-disable, 1-positive list, 2-negative list
-    ULONG   Num;
-    RT_802_11_ACL_ENTRY Entry[MAX_NUMBER_OF_ACL];
-} RT_802_11_ACL, *PRT_802_11_ACL;
-
-typedef struct _RT_802_11_WDS {
-    ULONG						Num;
-    NDIS_802_11_MAC_ADDRESS		Entry[24/*MAX_NUM_OF_WDS_LINK*/];
-	ULONG						KeyLength;
-	UCHAR						KeyMaterial[32];
-} RT_802_11_WDS, *PRT_802_11_WDS;
-
-typedef struct _RT_802_11_TX_RATES_ {
-    UCHAR       SupRateLen;
-    UCHAR       SupRate[MAX_LENGTH_OF_SUPPORT_RATES];
-    UCHAR       ExtRateLen;
-    UCHAR       ExtRate[MAX_LENGTH_OF_SUPPORT_RATES];
-} RT_802_11_TX_RATES, *PRT_802_11_TX_RATES;
-
-
-// Definition of extra information code
-#define	GENERAL_LINK_UP			0x0			// Link is Up
-#define	GENERAL_LINK_DOWN		0x1			// Link is Down
-#define	HW_RADIO_OFF			0x2			// Hardware radio off
-#define	SW_RADIO_OFF			0x3			// Software radio off
-#define	AUTH_FAIL				0x4			// Open authentication fail
-#define	AUTH_FAIL_KEYS			0x5			// Shared authentication fail
-#define	ASSOC_FAIL				0x6			// Association failed
-#define	EAP_MIC_FAILURE			0x7			// Deauthencation because MIC failure
-#define	EAP_4WAY_TIMEOUT		0x8			// Deauthencation on 4-way handshake timeout
-#define	EAP_GROUP_KEY_TIMEOUT	0x9			// Deauthencation on group key handshake timeout
-#define	EAP_SUCCESS				0xa			// EAP succeed
-#define	DETECT_RADAR_SIGNAL		0xb         // Radar signal occur in current channel
-#define EXTRA_INFO_MAX			0xb			// Indicate Last OID
-
-#define EXTRA_INFO_CLEAR		0xffffffff
-
-// This is OID setting structure. So only GF or MM as Mode. This is valid when our wirelss mode has 802.11n in use.
-typedef struct {
-	RT_802_11_PHY_MODE		PhyMode;	//
-	UCHAR		TransmitNo;
-	UCHAR		HtMode;		//HTMODE_GF or HTMODE_MM
-	UCHAR		ExtOffset;	//extension channel above or below
-	UCHAR		MCS;
-	UCHAR		BW;
-	UCHAR		STBC;
-	UCHAR		SHORTGI;
-	UCHAR		rsv;
-} OID_SET_HT_PHYMODE, *POID_SET_HT_PHYMODE;
-
-#ifdef NINTENDO_AP
-#define NINTENDO_MAX_ENTRY 16
-#define NINTENDO_SSID_NAME_LN 8
-#define NINTENDO_SSID_NAME "NWCUSBAP"
-#define NINTENDO_PROBE_REQ_FLAG_MASK 0x03
-#define NINTENDO_PROBE_REQ_ON 0x01
-#define NINTENDO_PROBE_REQ_SIGNAL 0x02
-#define NINTENDO_PROBE_RSP_ON 0x01
-#define NINTENDO_SSID_NICKNAME_LN 20
-
-#define NINTENDO_WEPKEY_LN 13
-
-typedef struct _NINTENDO_SSID
-{
-	UCHAR	NINTENDOFixChar[NINTENDO_SSID_NAME_LN];
-	UCHAR	zero1;
-	UCHAR	registe;
-	UCHAR	ID;
-	UCHAR	zero2;
-	UCHAR	NICKname[NINTENDO_SSID_NICKNAME_LN];
-} RT_NINTENDO_SSID, *PRT_NINTENDO_SSID;
-
-typedef struct _NINTENDO_ENTRY
-{
-	UCHAR	NICKname[NINTENDO_SSID_NICKNAME_LN];
-    UCHAR   DS_Addr[ETH_LENGTH_OF_ADDRESS];
-	UCHAR	registe;
-	UCHAR	UserSpaceAck;
-} RT_NINTENDO_ENTRY, *PRT_NINTENDO_ENTRY;
-
-//RTPRIV_IOCTL_NINTENDO_GET_TABLE
-//RTPRIV_IOCTL_NINTENDO_SET_TABLE
-typedef struct _NINTENDO_TABLE
-{
-	UINT				number;
-	RT_NINTENDO_ENTRY	entry[NINTENDO_MAX_ENTRY];
-} RT_NINTENDO_TABLE, *PRT_NINTENDO_TABLE;
-
-//RTPRIV_IOCTL_NINTENDO_SEED_WEPKEY
-typedef struct _NINTENDO_SEED_WEPKEY
-{
-	UCHAR	seed[NINTENDO_SSID_NICKNAME_LN];
-	UCHAR	wepkey[16];//use 13 for 104 bits wep key
-} RT_NINTENDO_SEED_WEPKEY, *PRT_NINTENDO_SEED_WEPKEY;
-#endif // NINTENDO_AP //
-
-#ifdef LLTD_SUPPORT
-typedef struct _RT_LLTD_ASSOICATION_ENTRY {
-    UCHAR           Addr[ETH_LENGTH_OF_ADDRESS];
-    unsigned short  MOR;        // maximum operational rate
-    UCHAR           phyMode;
-} RT_LLTD_ASSOICATION_ENTRY, *PRT_LLTD_ASSOICATION_ENTRY;
-
-typedef struct _RT_LLTD_ASSOICATION_TABLE {
-    unsigned int                Num;
-    RT_LLTD_ASSOICATION_ENTRY   Entry[MAX_NUMBER_OF_MAC];
-} RT_LLTD_ASSOICATION_TABLE, *PRT_LLTD_ASSOICATION_TABLE;
-#endif // LLTD_SUPPORT //
-
-#ifdef CONFIG_STA_SUPPORT
-#ifdef QOS_DLS_SUPPORT
-//rt2860, kathy 2007-0118
-// structure for DLS
-typedef struct _RT_802_11_DLS_UI {
-	USHORT						TimeOut;		// unit: second , set by UI
-	USHORT						CountDownTimer;	// unit: second , used by driver only
-	NDIS_802_11_MAC_ADDRESS		MacAddr;		// set by UI
-	UCHAR						Status;			// 0: none , 1: wait STAkey, 2: finish DLS setup , set by driver only
-	BOOLEAN						Valid;			// 1: valid , 0: invalid , set by UI, use to setup or tear down DLS link
-} RT_802_11_DLS_UI, *PRT_802_11_DLS_UI;
-
-typedef struct _RT_802_11_DLS_INFO {
-	RT_802_11_DLS_UI	Entry[MAX_NUMBER_OF_DLS_ENTRY];
-	UCHAR				num;
-} RT_802_11_DLS_INFO, *PRT_802_11_DLS_INFO;
-
-typedef enum _RT_802_11_DLS_MODE {
-    DLS_NONE,
-    DLS_WAIT_KEY,
-    DLS_FINISH
-} RT_802_11_DLS_MODE;
-#endif // QOS_DLS_SUPPORT //
-
-#ifdef WPA_SUPPLICANT_SUPPORT
-#ifndef NATIVE_WPA_SUPPLICANT_SUPPORT
-#define	RT_ASSOC_EVENT_FLAG                         0x0101
-#define	RT_DISASSOC_EVENT_FLAG                      0x0102
-#define	RT_REQIE_EVENT_FLAG                         0x0103
-#define	RT_RESPIE_EVENT_FLAG                        0x0104
-#define	RT_ASSOCINFO_EVENT_FLAG                     0x0105
-#define RT_PMKIDCAND_FLAG                           0x0106
-#define RT_INTERFACE_DOWN                           0x0107
-#define RT_INTERFACE_UP                             0x0108
-#endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
-#endif // WPA_SUPPLICANT_SUPPORT //
-#endif // CONFIG_STA_SUPPORT //
-
-
-
-
-#define MAX_CUSTOM_LEN 128
-
-#ifdef CONFIG_STA_SUPPORT
-typedef enum _RT_802_11_D_CLIENT_MODE
-{
-   Rt802_11_D_None,
-   Rt802_11_D_Flexible,
-   Rt802_11_D_Strict,
-} RT_802_11_D_CLIENT_MODE, *PRT_802_11_D_CLIENT_MODE;
-#endif // CONFIG_STA_SUPPORT //
-
-typedef struct _RT_CHANNEL_LIST_INFO
-{
-	UCHAR ChannelList[MAX_NUM_OF_CHS];   // list all supported channels for site survey
-	UCHAR ChannelListNum; // number of channel in ChannelList[]
-} RT_CHANNEL_LIST_INFO, *PRT_CHANNEL_LIST_INFO;
-
-// WSC configured credential
-typedef	struct	_WSC_CREDENTIAL
-{
-	NDIS_802_11_SSID	SSID;				// mandatory
-	USHORT				AuthType;			// mandatory, 1: open, 2: wpa-psk, 4: shared, 8:wpa, 0x10: wpa2, 0x20: wpa2-psk
-	USHORT				EncrType;			// mandatory, 1: none, 2: wep, 4: tkip, 8: aes
-	UCHAR				Key[64];			// mandatory, Maximum 64 byte
-	USHORT				KeyLength;
-	UCHAR				MacAddr[6];			// mandatory, AP MAC address
-	UCHAR				KeyIndex;			// optional, default is 1
-	UCHAR				Rsvd[3];			// Make alignment
-}	WSC_CREDENTIAL, *PWSC_CREDENTIAL;
-
-// WSC configured profiles
-typedef	struct	_WSC_PROFILE
-{
-	UINT			ProfileCnt;
-	UINT			ApplyProfileIdx;  // add by johnli, fix WPS test plan 5.1.1
-	WSC_CREDENTIAL	Profile[8];				// Support up to 8 profiles
-}	WSC_PROFILE, *PWSC_PROFILE;
-
-
-
-#endif // _OID_H_
diff --git a/drivers/staging/rt3090/pci_main_dev.c b/drivers/staging/rt3090/pci_main_dev.c
deleted file mode 100644
index 1410156b90c6..000000000000
--- a/drivers/staging/rt3090/pci_main_dev.c
+++ /dev/null
@@ -1,1195 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-	Module Name:
-	pci_main_dev.c
-
-	Abstract:
-
-	Revision History:
-	Who			When			What
-	--------	----------		----------------------------------------------
-	Name		Date			Modification logs
-*/
-
-
-#include "rt_config.h"
-#include <linux/pci.h>
-
-// Following information will be show when you run 'modinfo'
-// *** If you have a solution for the bug in current version of driver, please mail to me.
-// Otherwise post to forum in ralinktech's web site(www.ralinktech.com) and let all users help you. ***
-MODULE_AUTHOR("Jett Chen <jett_chen@ralinktech.com>");
-MODULE_DESCRIPTION("RT3090 Wireless Lan Linux Driver");
-MODULE_LICENSE("GPL");
-
-//
-// Function declarations
-//
-extern int rt28xx_close(IN struct net_device *net_dev);
-extern int rt28xx_open(struct net_device *net_dev);
-
-static VOID __devexit rt2860_remove_one(struct pci_dev *pci_dev);
-static INT __devinit rt2860_probe(struct pci_dev *pci_dev, const struct pci_device_id  *ent);
-static void __exit rt2860_cleanup_module(void);
-static int __init rt2860_init_module(void);
-
-
- static VOID RTMPInitPCIeDevice(
-    IN  struct pci_dev   *pci_dev,
-    IN PRTMP_ADAPTER     pAd);
-
-
-#ifdef CONFIG_PM
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,5,0)
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,10)
-#define pm_message_t u32
-#endif
-
-static int rt2860_suspend(struct pci_dev *pci_dev, pm_message_t state);
-static int rt2860_resume(struct pci_dev *pci_dev);
-#endif
-#endif // CONFIG_PM //
-
-//
-// Ralink PCI device table, include all supported chipsets
-//
-static struct pci_device_id rt2860_pci_tbl[] __devinitdata =
-{
-#ifdef RT3090
-	{PCI_DEVICE(NIC_PCI_VENDOR_ID, NIC3090_PCIe_DEVICE_ID)},
-	{PCI_DEVICE(NIC_PCI_VENDOR_ID, NIC3091_PCIe_DEVICE_ID)},
-	{PCI_DEVICE(NIC_PCI_VENDOR_ID, NIC3092_PCIe_DEVICE_ID)},
-	{PCI_DEVICE(0x1462, 0x891A)},
-#endif // RT3090 //
-#ifdef RT3390
-	{PCI_DEVICE(NIC_PCI_VENDOR_ID, NIC3390_PCIe_DEVICE_ID)},
-	{PCI_DEVICE(NIC_PCI_VENDOR_ID, NIC3391_PCIe_DEVICE_ID)},
-	{PCI_DEVICE(NIC_PCI_VENDOR_ID, NIC3392_PCIe_DEVICE_ID)},
-#endif // RT3390 //
-    {0,}		// terminate list
-};
-
-MODULE_DEVICE_TABLE(pci, rt2860_pci_tbl);
-#ifdef CONFIG_STA_SUPPORT
-#ifdef MODULE_VERSION
-MODULE_VERSION(STA_DRIVER_VERSION);
-#endif
-#endif // CONFIG_STA_SUPPORT //
-
-
-//
-// Our PCI driver structure
-//
-static struct pci_driver rt2860_driver =
-{
-    name:       "rt3090",
-    id_table:   rt2860_pci_tbl,
-    probe:      rt2860_probe,
-#if LINUX_VERSION_CODE >= 0x20412
-    remove:     __devexit_p(rt2860_remove_one),
-#else
-    remove:     __devexit(rt2860_remove_one),
-#endif
-
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,5,0)
-#ifdef CONFIG_PM
-	suspend:	rt2860_suspend,
-	resume:		rt2860_resume,
-#endif
-#endif
-};
-
-
-/***************************************************************************
- *
- *	PCI device initialization related procedures.
- *
- ***************************************************************************/
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,5,0)
-#ifdef CONFIG_PM
-
-VOID RT2860RejectPendingPackets(
-	IN	PRTMP_ADAPTER	pAd)
-{
-	// clear PS packets
-	// clear TxSw packets
-}
-
-static int rt2860_suspend(
-	struct pci_dev *pci_dev,
-	pm_message_t state)
-{
-	struct net_device *net_dev = pci_get_drvdata(pci_dev);
-	PRTMP_ADAPTER pAd = (PRTMP_ADAPTER)NULL;
-	INT32 retval = 0;
-
-
-	DBGPRINT(RT_DEBUG_TRACE, ("===> rt2860_suspend()\n"));
-
-	if (net_dev == NULL)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("net_dev == NULL!\n"));
-	}
-	else
-	{
-		pAd = (PRTMP_ADAPTER)RTMP_OS_NETDEV_GET_PRIV(net_dev);
-
-		/* we can not use IFF_UP because ra0 down but ra1 up */
-		/* and 1 suspend/resume function for 1 module, not for each interface */
-		/* so Linux will call suspend/resume function once */
-		if (VIRTUAL_IF_NUM(pAd) > 0)
-		{
-			// avoid users do suspend after interface is down
-
-			// stop interface
-			netif_carrier_off(net_dev);
-			netif_stop_queue(net_dev);
-
-			// mark device as removed from system and therefore no longer available
-			netif_device_detach(net_dev);
-
-			// mark halt flag
-			RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS);
-			RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_RADIO_OFF);
-
-			// take down the device
-			rt28xx_close((PNET_DEV)net_dev);
-
-			RT_MOD_DEC_USE_COUNT();
-		}
-	}
-
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,10)
-	// reference to http://vovo2000.com/type-lab/linux/kernel-api/linux-kernel-api.html
-	// enable device to generate PME# when suspended
-	// pci_choose_state(): Choose the power state of a PCI device to be suspended
-	retval = pci_enable_wake(pci_dev, pci_choose_state(pci_dev, state), 1);
-	// save the PCI configuration space of a device before suspending
-	pci_save_state(pci_dev);
-	// disable PCI device after use
-	pci_disable_device(pci_dev);
-
-	retval = pci_set_power_state(pci_dev, pci_choose_state(pci_dev, state));
-#endif
-
-	DBGPRINT(RT_DEBUG_TRACE, ("<=== rt2860_suspend()\n"));
-	return retval;
-}
-
-static int rt2860_resume(
-	struct pci_dev *pci_dev)
-{
-	struct net_device *net_dev = pci_get_drvdata(pci_dev);
-	PRTMP_ADAPTER pAd = (PRTMP_ADAPTER)NULL;
-
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,10)
-	INT32 retval;
-
-
-	// set the power state of a PCI device
-	// PCI has 4 power states, DO (normal) ~ D3(less power)
-	// in include/linux/pci.h, you can find that
-	// #define PCI_D0          ((pci_power_t __force) 0)
-	// #define PCI_D1          ((pci_power_t __force) 1)
-	// #define PCI_D2          ((pci_power_t __force) 2)
-	// #define PCI_D3hot       ((pci_power_t __force) 3)
-	// #define PCI_D3cold      ((pci_power_t __force) 4)
-	// #define PCI_UNKNOWN     ((pci_power_t __force) 5)
-	// #define PCI_POWER_ERROR ((pci_power_t __force) -1)
-	retval = pci_set_power_state(pci_dev, PCI_D0);
-
-	// restore the saved state of a PCI device
-	pci_restore_state(pci_dev);
-
-	// initialize device before it's used by a driver
-	if (pci_enable_device(pci_dev))
-	{
-		printk("pci enable fail!\n");
-		return 0;
-	}
-#endif
-
-	DBGPRINT(RT_DEBUG_TRACE, ("===> rt2860_resume()\n"));
-
-	if (net_dev == NULL)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("net_dev == NULL!\n"));
-	}
-	else
-		pAd = (PRTMP_ADAPTER)RTMP_OS_NETDEV_GET_PRIV(net_dev);
-
-	if (pAd != NULL)
-	{
-		/* we can not use IFF_UP because ra0 down but ra1 up */
-		/* and 1 suspend/resume function for 1 module, not for each interface */
-		/* so Linux will call suspend/resume function once */
-		if (VIRTUAL_IF_NUM(pAd) > 0)
-		{
-			// mark device as attached from system and restart if needed
-			netif_device_attach(net_dev);
-
-			if (rt28xx_open((PNET_DEV)net_dev) != 0)
-			{
-				// open fail
-				DBGPRINT(RT_DEBUG_TRACE, ("<=== rt2860_resume()\n"));
-				return 0;
-			}
-
-			// increase MODULE use count
-			RT_MOD_INC_USE_COUNT();
-
-			RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS);
-			RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_RADIO_OFF);
-
-			netif_start_queue(net_dev);
-			netif_carrier_on(net_dev);
-			netif_wake_queue(net_dev);
-		}
-	}
-
-	DBGPRINT(RT_DEBUG_TRACE, ("<=== rt2860_resume()\n"));
-	return 0;
-}
-#endif // CONFIG_PM //
-#endif
-
-
-static INT __init rt2860_init_module(VOID)
-{
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,5,0)
-	return pci_register_driver(&rt2860_driver);
-#else
-    return pci_module_init(&rt2860_driver);
-#endif
-}
-
-
-//
-// Driver module unload function
-//
-static VOID __exit rt2860_cleanup_module(VOID)
-{
-    pci_unregister_driver(&rt2860_driver);
-}
-
-module_init(rt2860_init_module);
-module_exit(rt2860_cleanup_module);
-
-
-//
-// PCI device probe & initialization function
-//
-static INT __devinit   rt2860_probe(
-    IN  struct pci_dev              *pci_dev,
-    IN  const struct pci_device_id  *pci_id)
-{
-	PRTMP_ADAPTER		pAd = (PRTMP_ADAPTER)NULL;
-	struct  net_device		*net_dev;
-	PVOID				handle;
-	PSTRING				print_name;
-	ULONG				csr_addr;
-	INT rv = 0;
-	RTMP_OS_NETDEV_OP_HOOK	netDevHook;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("===> rt2860_probe\n"));
-
-//PCIDevInit==============================================
-	// wake up and enable device
-	if ((rv = pci_enable_device(pci_dev))!= 0)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("Enable PCI device failed, errno=%d!\n", rv));
-		return rv;
-	}
-
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,5,0)
-	print_name = pci_dev ? pci_name(pci_dev) : "rt3090";
-#else
-	print_name = pci_dev ? pci_dev->slot_name : "rt3090";
-#endif // LINUX_VERSION_CODE //
-
-	if ((rv = pci_request_regions(pci_dev, print_name)) != 0)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("Request PCI resource failed, errno=%d!\n", rv));
-		goto err_out;
-	}
-
-	// map physical address to virtual address for accessing register
-	csr_addr = (unsigned long) ioremap(pci_resource_start(pci_dev, 0), pci_resource_len(pci_dev, 0));
-	if (!csr_addr)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("ioremap failed for device %s, region 0x%lX @ 0x%lX\n",
-					print_name, (ULONG)pci_resource_len(pci_dev, 0), (ULONG)pci_resource_start(pci_dev, 0)));
-		goto err_out_free_res;
-	}
-	else
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("%s: at 0x%lx, VA 0x%lx, IRQ %d. \n",  print_name,
-					(ULONG)pci_resource_start(pci_dev, 0), (ULONG)csr_addr, pci_dev->irq));
-	}
-
-	// Set DMA master
-	pci_set_master(pci_dev);
-
-
-//RtmpDevInit==============================================
-	// Allocate RTMP_ADAPTER adapter structure
-	handle = kmalloc(sizeof(struct os_cookie), GFP_KERNEL);
-	if (handle == NULL)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("%s(): Allocate memory for os handle failed!\n", __FUNCTION__));
-		goto err_out_iounmap;
-	}
-
-	((POS_COOKIE)handle)->pci_dev = pci_dev;
-
-	rv = RTMPAllocAdapterBlock(handle, &pAd);	//shiang: we may need the pci_dev for allocate structure of "RTMP_ADAPTER"
-	if (rv != NDIS_STATUS_SUCCESS)
-		goto err_out_iounmap;
-	// Here are the RTMP_ADAPTER structure with pci-bus specific parameters.
-	pAd->CSRBaseAddress = (PUCHAR)csr_addr;
-	DBGPRINT(RT_DEBUG_ERROR, ("pAd->CSRBaseAddress =0x%lx, csr_addr=0x%lx!\n", (ULONG)pAd->CSRBaseAddress, csr_addr));
-	RtmpRaDevCtrlInit(pAd, RTMP_DEV_INF_PCI);
-
-
-//NetDevInit==============================================
-	net_dev = RtmpPhyNetDevInit(pAd, &netDevHook);
-	if (net_dev == NULL)
-		goto err_out_free_radev;
-
-	// Here are the net_device structure with pci-bus specific parameters.
-	net_dev->irq = pci_dev->irq;		// Interrupt IRQ number
-	net_dev->base_addr = csr_addr;		// Save CSR virtual address and irq to device structure
-	pci_set_drvdata(pci_dev, net_dev);	// Set driver data
-
-#ifdef NATIVE_WPA_SUPPLICANT_SUPPORT
-/* for supporting Network Manager */
-	/* Set the sysfs physical device reference for the network logical device
-	  * if set prior to registration will cause a symlink during initialization.
-	 */
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0))
-	SET_NETDEV_DEV(net_dev, &(pci_dev->dev));
-#endif
-#endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
-
-
-//All done, it's time to register the net device to linux kernel.
-	// Register this device
-	rv = RtmpOSNetDevAttach(net_dev, &netDevHook);
-	if (rv)
-		goto err_out_free_netdev;
-
-#ifdef CONFIG_STA_SUPPORT
-	pAd->StaCfg.OriDevType = net_dev->type;
-#endif // CONFIG_STA_SUPPORT //
-RTMPInitPCIeDevice(pci_dev, pAd);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("<=== rt2860_probe\n"));
-
-	return 0; // probe ok
-
-
-	/* --------------------------- ERROR HANDLE --------------------------- */
-err_out_free_netdev:
-	RtmpOSNetDevFree(net_dev);
-
-err_out_free_radev:
-	/* free RTMP_ADAPTER strcuture and os_cookie*/
-	RTMPFreeAdapter(pAd);
-
-err_out_iounmap:
-	iounmap((void *)(csr_addr));
-	release_mem_region(pci_resource_start(pci_dev, 0), pci_resource_len(pci_dev, 0));
-
-err_out_free_res:
-	pci_release_regions(pci_dev);
-
-err_out:
-	pci_disable_device(pci_dev);
-
-	DBGPRINT(RT_DEBUG_ERROR, ("<=== rt2860_probe failed with rv = %d!\n", rv));
-
-	return -ENODEV; /* probe fail */
-}
-
-
-static VOID __devexit rt2860_remove_one(
-    IN  struct pci_dev  *pci_dev)
-{
-	PNET_DEV	net_dev = pci_get_drvdata(pci_dev);
-	RTMP_ADAPTER	*pAd = RTMP_OS_NETDEV_GET_PRIV(net_dev);
-	ULONG			csr_addr = net_dev->base_addr; // pAd->CSRBaseAddress;
-
-    DBGPRINT(RT_DEBUG_TRACE, ("===> rt2860_remove_one\n"));
-
-	if (pAd != NULL)
-	{
-		// Unregister/Free all allocated net_device.
-		RtmpPhyNetDevExit(pAd, net_dev);
-
-		// Unmap CSR base address
-		iounmap((char *)(csr_addr));
-
-		// release memory region
-		release_mem_region(pci_resource_start(pci_dev, 0), pci_resource_len(pci_dev, 0));
-
-		// Free RTMP_ADAPTER related structures.
-		RtmpRaDevCtrlExit(pAd);
-
-	}
-	else
-	{
-		// Unregister network device
-		RtmpOSNetDevDetach(net_dev);
-
-		// Unmap CSR base address
-		iounmap((char *)(net_dev->base_addr));
-
-		// release memory region
-		release_mem_region(pci_resource_start(pci_dev, 0), pci_resource_len(pci_dev, 0));
-	}
-
-	// Free the root net_device
-	RtmpOSNetDevFree(net_dev);
-
-}
-
-
-/*
-========================================================================
-Routine Description:
-    Check the chipset vendor/product ID.
-
-Arguments:
-    _dev_p				Point to the PCI or USB device
-
-Return Value:
-    TRUE				Check ok
-	FALSE				Check fail
-
-Note:
-========================================================================
-*/
-BOOLEAN RT28XXChipsetCheck(
-	IN void *_dev_p)
-{
-	/* always TRUE */
-	return TRUE;
-}
-
-
-
-/***************************************************************************
- *
- *	PCIe device initialization related procedures.
- *
- ***************************************************************************/
- static VOID RTMPInitPCIeDevice(
-    IN  struct pci_dev   *pci_dev,
-    IN PRTMP_ADAPTER     pAd)
-{
-	USHORT  device_id;
-	POS_COOKIE pObj;
-
-	pObj = (POS_COOKIE) pAd->OS_Cookie;
-	pci_read_config_word(pci_dev, PCI_DEVICE_ID, &device_id);
-	device_id = le2cpu16(device_id);
-	pObj->DeviceID = device_id;
-	if (
-#ifdef RT3090
-		(device_id == NIC3090_PCIe_DEVICE_ID) ||
-		(device_id == NIC3091_PCIe_DEVICE_ID) ||
-		(device_id == NIC3092_PCIe_DEVICE_ID) ||
-#endif // RT3090 //
-		 0)
-	{
-		UINT32 MacCsr0 = 0, Index= 0;
-		do
-		{
-			RTMP_IO_READ32(pAd, MAC_CSR0, &MacCsr0);
-
-			if ((MacCsr0 != 0x00) && (MacCsr0 != 0xFFFFFFFF))
-				break;
-
-			RTMPusecDelay(10);
-		} while (Index++ < 100);
-
-		// Support advanced power save after 2892/2790.
-		// MAC version at offset 0x1000 is 0x2872XXXX/0x2870XXXX(PCIe, USB, SDIO).
-		if ((MacCsr0&0xffff0000) != 0x28600000)
-		{
-			OPSTATUS_SET_FLAG(pAd, fOP_STATUS_PCIE_DEVICE);
-		}
-	}
-}
-
-#ifdef CONFIG_STA_SUPPORT
-VOID RTMPInitPCIeLinkCtrlValue(
-	IN	PRTMP_ADAPTER	pAd)
-{
-    INT     pos;
-    USHORT	reg16, data2, PCIePowerSaveLevel, Configuration;
-	UINT32 MacValue;
-    BOOLEAN	bFindIntel = FALSE;
-	POS_COOKIE pObj;
-
-	pObj = (POS_COOKIE) pAd->OS_Cookie;
-
-	if (!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE))
-		return;
-
-    DBGPRINT(RT_DEBUG_TRACE, ("%s.===>\n", __FUNCTION__));
-	// Init EEPROM, and save settings
-	if (!(IS_RT3090(pAd) || IS_RT3572(pAd) || IS_RT3390(pAd)))
-	{
-		RT28xx_EEPROM_READ16(pAd, 0x22, PCIePowerSaveLevel);
-		pAd->PCIePowerSaveLevel = PCIePowerSaveLevel & 0xff;
-		pAd->LnkCtrlBitMask = 0;
-		if ((PCIePowerSaveLevel&0xff) == 0xff)
-		{
-			OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_PCIE_DEVICE);
-			DBGPRINT(RT_DEBUG_TRACE, ("====> PCIePowerSaveLevel = 0x%x.\n", PCIePowerSaveLevel));
-			return;
-		}
-	else
-	{
-		PCIePowerSaveLevel &= 0x3;
-		RT28xx_EEPROM_READ16(pAd, 0x24, data2);
-
-		if( !(((data2&0xff00) == 0x9200) && ((data2&0x80) !=0)) )
-		{
-			if (PCIePowerSaveLevel > 1 )
-				PCIePowerSaveLevel = 1;
-		}
-
-		DBGPRINT(RT_DEBUG_TRACE, ("====> Write 0x83 = 0x%x.\n", PCIePowerSaveLevel));
-		AsicSendCommandToMcu(pAd, 0x83, 0xff, (UCHAR)PCIePowerSaveLevel, 0x00);
-		RT28xx_EEPROM_READ16(pAd, 0x22, PCIePowerSaveLevel);
-		PCIePowerSaveLevel &= 0xff;
-		PCIePowerSaveLevel = PCIePowerSaveLevel >> 6;
-		switch(PCIePowerSaveLevel)
-		{
-				case 0:	// Only support L0
-					pAd->LnkCtrlBitMask = 0;
-				break;
-				case 1:	// Only enable L0s
-					pAd->LnkCtrlBitMask = 1;
-				break;
-				case 2:	// enable L1, L0s
-					pAd->LnkCtrlBitMask = 3;
-				break;
-				case 3:	// sync with host clk and enable L1, L0s
-				pAd->LnkCtrlBitMask = 0x103;
-				break;
-		}
-			RT28xx_EEPROM_READ16(pAd, 0x24, data2);
-			if ((PCIePowerSaveLevel&0xff) != 0xff)
-			{
-				PCIePowerSaveLevel &= 0x3;
-
-				if( !(((data2&0xff00) == 0x9200) && ((data2&0x80) !=0)) )
-				{
-					if (PCIePowerSaveLevel > 1 )
-						PCIePowerSaveLevel = 1;
-				}
-
-				DBGPRINT(RT_DEBUG_TRACE, ("====> rt28xx Write 0x83 Command = 0x%x.\n", PCIePowerSaveLevel));
-					       printk("\n\n\n%s:%d\n",__FUNCTION__,__LINE__);
-
-				AsicSendCommandToMcu(pAd, 0x83, 0xff, (UCHAR)PCIePowerSaveLevel, 0x00);
-			}
-		DBGPRINT(RT_DEBUG_TRACE, ("====> LnkCtrlBitMask = 0x%x.\n", pAd->LnkCtrlBitMask));
-	}
-	}
-	else if (IS_RT3090(pAd) || IS_RT3572(pAd) || IS_RT3390(pAd))
-	{
-		UCHAR	LinkCtrlSetting = 0;
-
-		// Check 3090E special setting chip.
-			RT28xx_EEPROM_READ16(pAd, 0x24, data2);
-		if ((data2 == 0x9280) && ((pAd->MACVersion&0xffff) == 0x0211))
-		{
-			pAd->b3090ESpecialChip = TRUE;
-			DBGPRINT_RAW(RT_DEBUG_ERROR,("Special 3090E chip \n"));
-		}
-
-		RTMP_IO_READ32(pAd, AUX_CTRL, &MacValue);
-		//enable WAKE_PCIE function, which forces to enable PCIE clock when mpu interrupt asserting.
-		//Force PCIE 125MHz CLK to toggle
-		MacValue |= 0x402;
-		RTMP_IO_WRITE32(pAd, AUX_CTRL, MacValue);
-		DBGPRINT_RAW(RT_DEBUG_ERROR,(" AUX_CTRL = 0x%32x\n", MacValue));
-
-
-
-		// for RT30xx F and after, PCIe infterface, and for power solution 3
-		if ((IS_VERSION_AFTER_F(pAd))
-			&& (pAd->StaCfg.PSControl.field.rt30xxPowerMode >= 2)
-			&& (pAd->StaCfg.PSControl.field.rt30xxPowerMode <= 3))
-		{
-			RTMP_IO_READ32(pAd, AUX_CTRL, &MacValue);
-			DBGPRINT_RAW(RT_DEBUG_ERROR,(" Read AUX_CTRL = 0x%x\n", MacValue));
-			// turn on bit 12.
-			//enable 32KHz clock mode for power saving
-			MacValue |= 0x1000;
-			if (MacValue != 0xffffffff)
-			{
-				RTMP_IO_WRITE32(pAd, AUX_CTRL, MacValue);
-				DBGPRINT_RAW(RT_DEBUG_ERROR,(" Write AUX_CTRL = 0x%x\n", MacValue));
-				// 1. if use PCIePowerSetting is 2 or 3, need to program OSC_CTRL to 0x3ff11.
-				MacValue = 0x3ff11;
-				RTMP_IO_WRITE32(pAd, OSC_CTRL, MacValue);
-				DBGPRINT_RAW(RT_DEBUG_ERROR,(" OSC_CTRL = 0x%x\n", MacValue));
-				// 2. Write PCI register Clk ref bit
-				RTMPrt3xSetPCIePowerLinkCtrl(pAd);
-			}
-			else
-			{
-				// Error read Aux_Ctrl value.  Force to use solution 1
-				DBGPRINT(RT_DEBUG_ERROR,(" Error Value in AUX_CTRL = 0x%x\n", MacValue));
-				pAd->StaCfg.PSControl.field.rt30xxPowerMode = 1;
-				DBGPRINT(RT_DEBUG_ERROR,(" Force to use power solution1 \n"));
-			}
-		}
-		// 1. read setting from inf file.
-
-		PCIePowerSaveLevel = (USHORT)pAd->StaCfg.PSControl.field.rt30xxPowerMode;
-		DBGPRINT(RT_DEBUG_ERROR, ("====> rt30xx Read PowerLevelMode =  0x%x.\n", PCIePowerSaveLevel));
-		// 2. Check EnableNewPS.
-		if (pAd->StaCfg.PSControl.field.EnableNewPS == FALSE)
-			PCIePowerSaveLevel = 1;
-
-		if (IS_VERSION_BEFORE_F(pAd) && (pAd->b3090ESpecialChip == FALSE))
-		{
-			// Chip Version E only allow 1, So force set 1.
-			PCIePowerSaveLevel &= 0x1;
-			pAd->PCIePowerSaveLevel = (USHORT)PCIePowerSaveLevel;
-			DBGPRINT(RT_DEBUG_TRACE, ("====> rt30xx E Write 0x83 Command = 0x%x.\n", PCIePowerSaveLevel));
-
-			AsicSendCommandToMcu(pAd, 0x83, 0xff, (UCHAR)PCIePowerSaveLevel, 0x00);
-		}
-		else
-		{
-			// Chip Version F and after only allow 1 or 2 or 3. This might be modified after new chip version come out.
-			if (!((PCIePowerSaveLevel == 1) || (PCIePowerSaveLevel == 3)))
-				PCIePowerSaveLevel = 1;
-			DBGPRINT(RT_DEBUG_ERROR, ("====> rt30xx F Write 0x83 Command = 0x%x.\n", PCIePowerSaveLevel));
-			pAd->PCIePowerSaveLevel = (USHORT)PCIePowerSaveLevel;
-			// for 3090F , we need to add high-byte arg for 0x83 command to indicate the link control setting in
-			// PCI Configuration Space. Because firmware can't read PCI Configuration Space
-			if ((pAd->Rt3xxRalinkLinkCtrl & 0x2) && (pAd->Rt3xxHostLinkCtrl & 0x2))
-			{
-				LinkCtrlSetting = 1;
-			}
-			DBGPRINT(RT_DEBUG_TRACE, ("====> rt30xxF LinkCtrlSetting = 0x%x.\n", LinkCtrlSetting));
-			AsicSendCommandToMcu(pAd, 0x83, 0xff, (UCHAR)PCIePowerSaveLevel, LinkCtrlSetting);
-		}
-
-	}
-
-    // Find Ralink PCIe Device's Express Capability Offset
-	pos = pci_find_capability(pObj->pci_dev, PCI_CAP_ID_EXP);
-
-    if (pos != 0)
-    {
-        // Ralink PCIe Device's Link Control Register Offset
-        pAd->RLnkCtrlOffset = pos + PCI_EXP_LNKCTL;
-	pci_read_config_word(pObj->pci_dev, pAd->RLnkCtrlOffset, &reg16);
-        Configuration = le2cpu16(reg16);
-        DBGPRINT(RT_DEBUG_TRACE, ("Read (Ralink PCIe Link Control Register) offset 0x%x = 0x%x\n",
-                                    pAd->RLnkCtrlOffset, Configuration));
-        pAd->RLnkCtrlConfiguration = (Configuration & 0x103);
-        Configuration &= 0xfefc;
-        Configuration |= (0x0);
-
-        RTMPFindHostPCIDev(pAd);
-        if (pObj->parent_pci_dev)
-        {
-		USHORT  vendor_id;
-
-		pci_read_config_word(pObj->parent_pci_dev, PCI_VENDOR_ID, &vendor_id);
-		vendor_id = le2cpu16(vendor_id);
-		if (vendor_id == PCIBUS_INTEL_VENDOR)
-                 {
-			bFindIntel = TRUE;
-                        RTMP_SET_PSFLAG(pAd, fRTMP_PS_TOGGLE_L1);
-                 }
-		/*
-		else if ((vendor_id == PCIBUS_AMD_VENDOR1)
-					&& (DeviceID == 0x96000000))
-				{
-					//Verified 2792 Aspire 8530 AMD NB (S3/S4/CBoot/WBoot/Chariot) by customer and ourselves.
-					// So use L1 Toggle method in this NB.
-			bFindIntel = TRUE;
-					RTMP_SET_PSFLAG(pAd, fRTMP_PS_TOGGLE_L1);
-					DBGPRINT(RT_DEBUG_TRACE, ("PSM : Aspire 8530 AMD NB. Use L1 Toggle. \n"));
-				}
-		*/
-		// Find PCI-to-PCI Bridge Express Capability Offset
-		pos = pci_find_capability(pObj->parent_pci_dev, PCI_CAP_ID_EXP);
-
-		if (pos != 0)
-		{
-			BOOLEAN		bChange = FALSE;
-			// PCI-to-PCI Bridge Link Control Register Offset
-			pAd->HostLnkCtrlOffset = pos + PCI_EXP_LNKCTL;
-			pci_read_config_word(pObj->parent_pci_dev, pAd->HostLnkCtrlOffset, &reg16);
-			Configuration = le2cpu16(reg16);
-			DBGPRINT(RT_DEBUG_TRACE, ("Read (Host PCI-to-PCI Bridge Link Control Register) offset 0x%x = 0x%x\n",
-			                            pAd->HostLnkCtrlOffset, Configuration));
-			pAd->HostLnkCtrlConfiguration = (Configuration & 0x103);
-			Configuration &= 0xfefc;
-			Configuration |= (0x0);
-
-			switch (pObj->DeviceID)
-			{
-#ifdef RT3090
-				case NIC3090_PCIe_DEVICE_ID:
-				case NIC3091_PCIe_DEVICE_ID:
-				case NIC3092_PCIe_DEVICE_ID:
-					if (bFindIntel == FALSE)
-						bChange = TRUE;
-					break;
-#endif // RT3090 //
-				default:
-					break;
-			}
-
-			if (bChange)
-			{
-				reg16 = cpu2le16(Configuration);
-				pci_write_config_word(pObj->parent_pci_dev, pAd->HostLnkCtrlOffset, reg16);
-				DBGPRINT(RT_DEBUG_TRACE, ("Write (Host PCI-to-PCI Bridge Link Control Register) offset 0x%x = 0x%x\n",
-						pAd->HostLnkCtrlOffset, Configuration));
-			}
-		}
-		else
-		{
-			pAd->HostLnkCtrlOffset = 0;
-			DBGPRINT(RT_DEBUG_ERROR, ("%s: cannot find PCI-to-PCI Bridge PCI Express Capability!\n", __FUNCTION__));
-		}
-        }
-    }
-    else
-    {
-        pAd->RLnkCtrlOffset = 0;
-        pAd->HostLnkCtrlOffset = 0;
-        DBGPRINT(RT_DEBUG_ERROR, ("%s: cannot find Ralink PCIe Device's PCI Express Capability!\n", __FUNCTION__));
-    }
-
-    if (bFindIntel == FALSE)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("Doesn't find Intel PCI host controller. \n"));
-		// Doesn't switch L0, L1, So set PCIePowerSaveLevel to 0xff
-		pAd->PCIePowerSaveLevel = 0xff;
-		if ((pAd->RLnkCtrlOffset != 0)
-#ifdef RT3090
-			&& ((pObj->DeviceID == NIC3090_PCIe_DEVICE_ID)
-				||(pObj->DeviceID == NIC3091_PCIe_DEVICE_ID)
-				||(pObj->DeviceID == NIC3092_PCIe_DEVICE_ID))
-#endif // RT3090 //
-		)
-		{
-			pci_read_config_word(pObj->pci_dev, pAd->RLnkCtrlOffset, &reg16);
-			Configuration = le2cpu16(reg16);
-			DBGPRINT(RT_DEBUG_TRACE, ("Read (Ralink 30xx PCIe Link Control Register) offset 0x%x = 0x%x\n",
-			                        pAd->RLnkCtrlOffset, Configuration));
-			pAd->RLnkCtrlConfiguration = (Configuration & 0x103);
-			Configuration &= 0xfefc;
-			Configuration |= (0x0);
-			reg16 = cpu2le16(Configuration);
-			pci_write_config_word(pObj->pci_dev, pAd->RLnkCtrlOffset, reg16);
-			DBGPRINT(RT_DEBUG_TRACE, ("Write (Ralink PCIe Link Control Register)  offset 0x%x = 0x%x\n",
-			                        pos + PCI_EXP_LNKCTL, Configuration));
-		}
-	}
-}
-
-VOID RTMPFindHostPCIDev(
-    IN	PRTMP_ADAPTER	pAd)
-{
-    USHORT  reg16;
-    UCHAR   reg8;
-	UINT	DevFn;
-    PPCI_DEV    pPci_dev;
-	POS_COOKIE	pObj;
-
-	pObj = (POS_COOKIE) pAd->OS_Cookie;
-
-	if (!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE))
-		return;
-
-    DBGPRINT(RT_DEBUG_TRACE, ("%s.===>\n", __FUNCTION__));
-
-    pObj->parent_pci_dev = NULL;
-    if (pObj->pci_dev->bus->parent)
-    {
-        for (DevFn = 0; DevFn < 255; DevFn++)
-        {
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,0)
-            pPci_dev = pci_get_slot(pObj->pci_dev->bus->parent, DevFn);
-#else
-            pPci_dev = pci_find_slot(pObj->pci_dev->bus->parent->number, DevFn);
-#endif
-            if (pPci_dev)
-            {
-                pci_read_config_word(pPci_dev, PCI_CLASS_DEVICE, &reg16);
-                reg16 = le2cpu16(reg16);
-                pci_read_config_byte(pPci_dev, PCI_CB_CARD_BUS, &reg8);
-                if ((reg16 == PCI_CLASS_BRIDGE_PCI) &&
-                    (reg8 == pObj->pci_dev->bus->number))
-                {
-                    pObj->parent_pci_dev = pPci_dev;
-                }
-            }
-        }
-    }
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-
-	Arguments:
-		Level = RESTORE_HALT : Restore PCI host and Ralink PCIe Link Control field to its default value.
-		Level = Other Value : Restore from dot11 power save or radio off status. And force PCI host Link Control fields to 0x1
-
-	========================================================================
-*/
-VOID RTMPPCIeLinkCtrlValueRestore(
-	IN	PRTMP_ADAPTER	pAd,
-	IN   UCHAR		Level)
-{
-	USHORT  PCIePowerSaveLevel, reg16;
-	USHORT	Configuration;
-	POS_COOKIE	pObj;
-
-	pObj = (POS_COOKIE) pAd->OS_Cookie;
-
-	if (!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE))
-		return;
-
-	// Check PSControl Configuration
-	if (pAd->StaCfg.PSControl.field.EnableNewPS == FALSE)
-		return TRUE;
-
-	//3090 will not execute the following codes.
-	// Check interface : If not PCIe interface, return.
-
-#ifdef RT3090
-	if ((pObj->DeviceID == NIC3090_PCIe_DEVICE_ID)
-		||(pObj->DeviceID == NIC3091_PCIe_DEVICE_ID)
-		||(pObj->DeviceID == NIC3092_PCIe_DEVICE_ID))
-		return;
-#endif // RT3090 //
-	DBGPRINT(RT_DEBUG_TRACE, ("%s.===>\n", __FUNCTION__));
-	PCIePowerSaveLevel = pAd->PCIePowerSaveLevel;
-	if ((PCIePowerSaveLevel&0xff) == 0xff)
-	{
-		DBGPRINT(RT_DEBUG_TRACE,("return  \n"));
-		return;
-	}
-
-	if (pObj->parent_pci_dev && (pAd->HostLnkCtrlOffset != 0))
-    {
-        PCI_REG_READ_WORD(pObj->parent_pci_dev, pAd->HostLnkCtrlOffset, Configuration);
-        if ((Configuration != 0) &&
-            (Configuration != 0xFFFF))
-        {
-		Configuration &= 0xfefc;
-		// If call from interface down, restore to orginial setting.
-		if (Level == RESTORE_CLOSE)
-		{
-			Configuration |= pAd->HostLnkCtrlConfiguration;
-		}
-		else
-			Configuration |= 0x0;
-            PCI_REG_WIRTE_WORD(pObj->parent_pci_dev, pAd->HostLnkCtrlOffset, Configuration);
-		DBGPRINT(RT_DEBUG_TRACE, ("Restore PCI host : offset 0x%x = 0x%x\n", pAd->HostLnkCtrlOffset, Configuration));
-        }
-        else
-            DBGPRINT(RT_DEBUG_ERROR, ("Restore PCI host : PCI_REG_READ_WORD failed (Configuration = 0x%x)\n", Configuration));
-    }
-
-    if (pObj->pci_dev && (pAd->RLnkCtrlOffset != 0))
-    {
-        PCI_REG_READ_WORD(pObj->pci_dev, pAd->RLnkCtrlOffset, Configuration);
-        if ((Configuration != 0) &&
-            (Configuration != 0xFFFF))
-        {
-		Configuration &= 0xfefc;
-			// If call from interface down, restore to orginial setting.
-			if (Level == RESTORE_CLOSE)
-		Configuration |= pAd->RLnkCtrlConfiguration;
-			else
-				Configuration |= 0x0;
-            PCI_REG_WIRTE_WORD(pObj->pci_dev, pAd->RLnkCtrlOffset, Configuration);
-		DBGPRINT(RT_DEBUG_TRACE, ("Restore Ralink : offset 0x%x = 0x%x\n", pAd->RLnkCtrlOffset, Configuration));
-        }
-        else
-            DBGPRINT(RT_DEBUG_ERROR, ("Restore Ralink : PCI_REG_READ_WORD failed (Configuration = 0x%x)\n", Configuration));
-	}
-
-	DBGPRINT(RT_DEBUG_TRACE,("%s <===\n", __FUNCTION__));
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-
-	Arguments:
-		Max : limit Host PCI and Ralink PCIe device's LINK CONTROL field's value.
-		Because now frequently set our device to mode 1 or mode 3 will cause problem.
-
-	========================================================================
-*/
-VOID RTMPPCIeLinkCtrlSetting(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	USHORT		Max)
-{
-	USHORT  PCIePowerSaveLevel, reg16;
-	USHORT	Configuration;
-	POS_COOKIE	pObj;
-
-	pObj = (POS_COOKIE) pAd->OS_Cookie;
-
-	if (!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE))
-		return;
-
-	// Check PSControl Configuration
-	if (pAd->StaCfg.PSControl.field.EnableNewPS == FALSE)
-		return TRUE;
-
-	// Check interface : If not PCIe interface, return.
-	//Block 3090 to enter the following function
-
-#ifdef RT3090
-	if ((pObj->DeviceID == NIC3090_PCIe_DEVICE_ID)
-		||(pObj->DeviceID == NIC3091_PCIe_DEVICE_ID)
-		||(pObj->DeviceID == NIC3092_PCIe_DEVICE_ID))
-		return;
-#endif // RT3090 //
-	if (!RTMP_TEST_PSFLAG(pAd, fRTMP_PS_CAN_GO_SLEEP))
-	{
-		DBGPRINT(RT_DEBUG_INFO, ("RTMPPCIePowerLinkCtrl return on fRTMP_PS_CAN_GO_SLEEP flag\n"));
-		return;
-	}
-	DBGPRINT(RT_DEBUG_TRACE,("%s===>\n", __FUNCTION__));
-	PCIePowerSaveLevel = pAd->PCIePowerSaveLevel;
-	if ((PCIePowerSaveLevel&0xff) == 0xff)
-	{
-		DBGPRINT(RT_DEBUG_TRACE,("return  \n"));
-		return;
-	}
-	PCIePowerSaveLevel = PCIePowerSaveLevel>>6;
-
-    // Skip non-exist deice right away
-	if (pObj->parent_pci_dev && (pAd->HostLnkCtrlOffset != 0))
-	{
-        PCI_REG_READ_WORD(pObj->parent_pci_dev, pAd->HostLnkCtrlOffset, Configuration);
-		switch (PCIePowerSaveLevel)
-		{
-			case 0:
-				// Set b0 and b1 of LinkControl (both 2892 and PCIe bridge) to 00
-				Configuration &= 0xfefc;
-				break;
-			case 1:
-				// Set b0 and b1 of LinkControl (both 2892 and PCIe bridge) to 01
-				Configuration &= 0xfefc;
-				Configuration |= 0x1;
-				break;
-			case 2:
-				//  Set b0 and b1 of LinkControl (both 2892 and PCIe bridge) to 11
-				Configuration &= 0xfefc;
-				Configuration |= 0x3;
-				break;
-			case 3:
-				// Set b0 and b1 of LinkControl (both 2892 and PCIe bridge) to 11 and bit 8 of LinkControl of 2892 to 1
-				Configuration &= 0xfefc;
-				Configuration |= 0x103;
-				break;
-		}
-        PCI_REG_WIRTE_WORD(pObj->parent_pci_dev, pAd->HostLnkCtrlOffset, Configuration);
-		DBGPRINT(RT_DEBUG_TRACE, ("Write PCI host offset 0x%x = 0x%x\n", pAd->HostLnkCtrlOffset, Configuration));
-	}
-
-	if (pObj->pci_dev && (pAd->RLnkCtrlOffset != 0))
-	{
-		// first 2892 chip not allow to frequently set mode 3. will cause hang problem.
-		if (PCIePowerSaveLevel > Max)
-			PCIePowerSaveLevel = Max;
-
-        PCI_REG_READ_WORD(pObj->pci_dev, pAd->RLnkCtrlOffset, Configuration);
-		switch (PCIePowerSaveLevel)
-		{
-			case 0:
-				// No PCI power safe
-				// Set b0 and b1 of LinkControl (both 2892 and PCIe bridge) to 00 .
-				Configuration &= 0xfefc;
-				break;
-			case 1:
-				//  L0
-				// Set b0 and b1 of LinkControl (both 2892 and PCIe bridge) to 01 .
-				Configuration &= 0xfefc;
-				Configuration |= 0x1;
-				break;
-			case 2:
-				// L0 and L1
-				//  Set b0 and b1 of LinkControl (both 2892 and PCIe bridge) to 11
-				Configuration &= 0xfefc;
-				Configuration |= 0x3;
-				break;
-			case 3:
-				// L0 , L1 and clock management.
-				// Set b0 and b1 of LinkControl (both 2892 and PCIe bridge) to 11 and bit 8 of LinkControl of 2892 to 1
-				Configuration &= 0xfefc;
-				Configuration |= 0x103;
-		              pAd->bPCIclkOff = TRUE;
-				break;
-		}
-        PCI_REG_WIRTE_WORD(pObj->pci_dev, pAd->RLnkCtrlOffset, Configuration);
-		DBGPRINT(RT_DEBUG_TRACE, ("Write Ralink device : offset 0x%x = 0x%x\n", pAd->RLnkCtrlOffset, Configuration));
-	}
-
-	DBGPRINT(RT_DEBUG_TRACE,("RTMPPCIePowerLinkCtrl <==============\n"));
-}
-/*
-	========================================================================
-
-	Routine Description:
-		1. Write a PCI register for rt30xx power solution 3
-
-	========================================================================
-*/
-VOID RTMPrt3xSetPCIePowerLinkCtrl(
-	IN	PRTMP_ADAPTER	pAd)
-{
-
-	ULONG	HostConfiguration;
-	ULONG	Configuration;
-	ULONG	Vendor;
-	ULONG	offset;
-	POS_COOKIE	pObj;
-	INT     pos;
-	USHORT	reg16;
-
-	pObj = (POS_COOKIE) pAd->OS_Cookie;
-
-	DBGPRINT(RT_DEBUG_INFO, ("RTMPrt3xSetPCIePowerLinkCtrl.===> %x\n", pAd->StaCfg.PSControl.word));
-
-	// Check PSControl Configuration
-	if (pAd->StaCfg.PSControl.field.EnableNewPS == FALSE)
-		return;
-	RTMPFindHostPCIDev(pAd);
-        if (pObj->parent_pci_dev)
-        {
-		USHORT  vendor_id;
-		// Find PCI-to-PCI Bridge Express Capability Offset
-		pos = pci_find_capability(pObj->parent_pci_dev, PCI_CAP_ID_EXP);
-
-		if (pos != 0)
-		{
-			pAd->HostLnkCtrlOffset = pos + PCI_EXP_LNKCTL;
-		}
-	// If configurared to turn on L1.
-	HostConfiguration = 0;
-		if (pAd->StaCfg.PSControl.field.rt30xxForceASPMTest == 1)
-		{
-						DBGPRINT(RT_DEBUG_TRACE, ("Enter,PSM : Force ASPM \n"));
-
-			// Skip non-exist deice right away
-			if ((pAd->HostLnkCtrlOffset != 0))
-			{
-			 PCI_REG_READ_WORD(pObj->parent_pci_dev, pAd->HostLnkCtrlOffset, HostConfiguration);
-				// Prepare Configuration to write to Host
-				HostConfiguration |= 0x3;
-				PCI_REG_WIRTE_WORD(pObj->parent_pci_dev, pAd->HostLnkCtrlOffset, HostConfiguration);
-				pAd->Rt3xxHostLinkCtrl = HostConfiguration;
-				// Because in rt30xxForceASPMTest Mode, Force turn on L0s, L1.
-				// Fix HostConfiguration bit0:1 = 0x3 for later use.
-				HostConfiguration = 0x3;
-				DBGPRINT(RT_DEBUG_TRACE, ("PSM : Force ASPM : Host device L1/L0s Value =  0x%x\n", HostConfiguration));
-			}
-		}
-		else if (pAd->StaCfg.PSControl.field.rt30xxFollowHostASPM == 1)
-		{
-
-			// Skip non-exist deice right away
-			if ((pAd->HostLnkCtrlOffset != 0))
-			{
-			 PCI_REG_READ_WORD(pObj->parent_pci_dev, pAd->HostLnkCtrlOffset, HostConfiguration);
-				pAd->Rt3xxHostLinkCtrl = HostConfiguration;
-				HostConfiguration &= 0x3;
-				DBGPRINT(RT_DEBUG_TRACE, ("PSM : Follow Host ASPM : Host device L1/L0s Value =  0x%x\n", HostConfiguration));
-			}
-		}
-        }
-	// Prepare to write Ralink setting.
-	// Find Ralink PCIe Device's Express Capability Offset
-	pos = pci_find_capability(pObj->pci_dev, PCI_CAP_ID_EXP);
-
-    if (pos != 0)
-    {
-        // Ralink PCIe Device's Link Control Register Offset
-       pAd->RLnkCtrlOffset = pos + PCI_EXP_LNKCTL;
-	pci_read_config_word(pObj->pci_dev, pAd->RLnkCtrlOffset, &reg16);
-        Configuration = le2cpu16(reg16);
-	DBGPRINT(RT_DEBUG_TRACE, ("Read (Ralink PCIe Link Control Register) offset 0x%x = 0x%x\n",
-			                                    pAd->RLnkCtrlOffset, Configuration));
-		Configuration |= 0x100;
-		if ((pAd->StaCfg.PSControl.field.rt30xxFollowHostASPM == 1)
-			|| (pAd->StaCfg.PSControl.field.rt30xxForceASPMTest == 1))
-		{
-			switch(HostConfiguration)
-			{
-				case 0:
-					Configuration &= 0xffffffc;
-					break;
-				case 1:
-					Configuration &= 0xffffffc;
-					Configuration |= 0x1;
-					break;
-				case 2:
-					Configuration &= 0xffffffc;
-					Configuration |= 0x2;
-					break;
-				case 3:
-					Configuration |= 0x3;
-					break;
-			}
-		}
-		reg16 = cpu2le16(Configuration);
-		pci_write_config_word(pObj->pci_dev, pAd->RLnkCtrlOffset, reg16);
-		pAd->Rt3xxRalinkLinkCtrl = Configuration;
-		DBGPRINT(RT_DEBUG_TRACE, ("PSM :Write Ralink device L1/L0s Value =  0x%x\n", Configuration));
-	}
-	DBGPRINT(RT_DEBUG_INFO,("PSM :RTMPrt3xSetPCIePowerLinkCtrl <==============\n"));
-
-}
-
-#endif // CONFIG_STA_SUPPORT //
diff --git a/drivers/staging/rt3090/rt3390.h b/drivers/staging/rt3090/rt3390.h
deleted file mode 100644
index 412ab3d32ab5..000000000000
--- a/drivers/staging/rt3090/rt3390.h
+++ /dev/null
@@ -1,77 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-    Module Name:
-    rt3390.h
-
-    Abstract:
-
-    Revision History:
-    Who          When          What
-    ---------    ----------    ----------------------------------------------
- */
-
-#ifndef __RT3390_H__
-#define __RT3390_H__
-
-#ifdef RT3390
-
-#ifndef RTMP_PCI_SUPPORT
-#error "For RT3390, you should define the compile flag -DRTMP_PCI_SUPPORT"
-#endif
-
-#ifndef RTMP_MAC_PCI
-#error "For RT3390, you should define the compile flag -DRTMP_MAC_PCI"
-#endif
-
-#ifndef RTMP_RF_RW_SUPPORT
-#error "For RT3390, you should define the compile flag -DRTMP_RF_RW_SUPPORT"
-#endif
-
-#ifndef RT30xx
-#error "For RT3390, you should define the compile flag -DRT30xx"
-#endif
-
-#ifdef CARRIER_DETECTION_SUPPORT
-#define TONE_RADAR_DETECT_SUPPORT
-#define CARRIER_SENSE_NEW_ALGO
-#endif // CARRIER_DETECTION_SUPPORT //
-
-#define PCIE_PS_SUPPORT
-
-#include "mac_pci.h"
-#include "rt33xx.h"
-
-//
-// Device ID & Vendor ID, these values should match EEPROM value
-//
-#define NIC3390_PCIe_DEVICE_ID  0x3090		// 1T/1R miniCard
-#define NIC3391_PCIe_DEVICE_ID  0x3091		// 1T/2R miniCard
-#define NIC3392_PCIe_DEVICE_ID  0x3092		// 2T/2R miniCard
-
-#endif // RT3390 //
-
-#endif //__RT3390_H__ //
diff --git a/drivers/staging/rt3090/rt_ate.c b/drivers/staging/rt3090/rt_ate.c
deleted file mode 100644
index 259aae411628..000000000000
--- a/drivers/staging/rt3090/rt_ate.c
+++ /dev/null
@@ -1,6089 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
- */
-
-#include "rt_config.h"
-
-#ifdef RALINK_ATE
-
-#ifdef RT30xx
-#define ATE_BBP_REG_NUM	168
-UCHAR restore_BBP[ATE_BBP_REG_NUM]={0};
-#endif // RT30xx //
-
-// 802.11 MAC Header, Type:Data, Length:24bytes
-UCHAR TemplateFrame[24] = {0x08,0x00,0x00,0x00,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
-		0x00,0xAA,0xBB,0x12,0x34,0x56,0x00,0x11,0x22,0xAA,0xBB,0xCC,0x00,0x00};
-
-extern RTMP_RF_REGS RF2850RegTable[];
-extern UCHAR NUM_OF_2850_CHNL;
-
-extern FREQUENCY_ITEM FreqItems3020[];
-extern UCHAR NUM_OF_3020_CHNL;
-
-
-
-
-static CHAR CCKRateTable[] = {0, 1, 2, 3, 8, 9, 10, 11, -1}; /* CCK Mode. */
-static CHAR OFDMRateTable[] = {0, 1, 2, 3, 4, 5, 6, 7, -1}; /* OFDM Mode. */
-static CHAR HTMIXRateTable[] = {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, -1}; /* HT Mix Mode. */
-
-static INT TxDmaBusy(
-	IN PRTMP_ADAPTER pAd);
-
-static INT RxDmaBusy(
-	IN PRTMP_ADAPTER pAd);
-
-static VOID RtmpDmaEnable(
-	IN PRTMP_ADAPTER pAd,
-	IN INT Enable);
-
-static VOID BbpSoftReset(
-	IN PRTMP_ADAPTER pAd);
-
-static VOID RtmpRfIoWrite(
-	IN PRTMP_ADAPTER pAd);
-
-static INT ATESetUpFrame(
-	IN PRTMP_ADAPTER pAd,
-	IN UINT32 TxIdx);
-
-static INT ATETxPwrHandler(
-	IN PRTMP_ADAPTER pAd,
-	IN char index);
-
-static INT ATECmdHandler(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-#ifndef RT30xx
-static int CheckMCSValid(
-	IN UCHAR Mode,
-	IN UCHAR Mcs);
-#endif // RT30xx //
-
-#ifdef RT30xx
-static int CheckMCSValid(
-	IN UCHAR Mode,
-	IN UCHAR Mcs,
-	IN BOOLEAN bRT2070);
-#endif // RT30xx //
-
-#ifdef RTMP_MAC_PCI
-static VOID ATEWriteTxWI(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PTXWI_STRUC	pOutTxWI,
-	IN	BOOLEAN			FRAG,
-	IN	BOOLEAN			CFACK,
-	IN	BOOLEAN			InsTimestamp,
-	IN	BOOLEAN			AMPDU,
-	IN	BOOLEAN			Ack,
-	IN	BOOLEAN			NSeq,		// HW new a sequence.
-	IN	UCHAR			BASize,
-	IN	UCHAR			WCID,
-	IN	ULONG			Length,
-	IN	UCHAR			PID,
-	IN	UCHAR			TID,
-	IN	UCHAR			TxRate,
-	IN	UCHAR			Txopmode,
-	IN	BOOLEAN			CfAck,
-	IN	HTTRANSMIT_SETTING	*pTransmit);
-#endif // RTMP_MAC_PCI //
-
-
-static VOID SetJapanFilter(
-	IN	PRTMP_ADAPTER	pAd);
-
-
-#ifdef RALINK_28xx_QA
-static inline INT	DO_RACFG_CMD_ATE_START(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN struct ate_racfghdr *pRaCfg
-);
-
-static inline INT DO_RACFG_CMD_ATE_STOP(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN struct ate_racfghdr *pRaCfg
-);
-
-static inline INT DO_RACFG_CMD_RF_WRITE_ALL(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN struct ate_racfghdr *pRaCfg
-);
-
-static inline INT DO_RACFG_CMD_E2PROM_READ16(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN struct ate_racfghdr *pRaCfg
-);
-
-static inline INT DO_RACFG_CMD_E2PROM_WRITE16(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN struct ate_racfghdr *pRaCfg
-);
-
-static inline INT DO_RACFG_CMD_E2PROM_READ_ALL
-(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN struct ate_racfghdr *pRaCfg
-);
-
-static inline INT DO_RACFG_CMD_E2PROM_WRITE_ALL(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN struct ate_racfghdr *pRaCfg
-);
-
-static inline INT DO_RACFG_CMD_IO_READ(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN struct ate_racfghdr *pRaCfg
-);
-
-static inline INT DO_RACFG_CMD_IO_WRITE(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN struct ate_racfghdr *pRaCfg
-);
-
-static inline INT DO_RACFG_CMD_IO_READ_BULK(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN struct ate_racfghdr *pRaCfg
-);
-
-static inline INT DO_RACFG_CMD_BBP_READ8(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN struct ate_racfghdr *pRaCfg
-);
-
-static inline INT DO_RACFG_CMD_BBP_WRITE8(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN struct ate_racfghdr *pRaCfg
-);
-
-static inline INT DO_RACFG_CMD_BBP_READ_ALL(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN struct ate_racfghdr *pRaCfg
-);
-
-static inline INT DO_RACFG_CMD_GET_NOISE_LEVEL(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN struct ate_racfghdr *pRaCfg
-);
-
-static inline INT DO_RACFG_CMD_GET_COUNTER(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN struct ate_racfghdr *pRaCfg
-);
-
-static inline INT DO_RACFG_CMD_CLEAR_COUNTER(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN struct ate_racfghdr *pRaCfg
-);
-
-static inline INT DO_RACFG_CMD_TX_START(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN struct ate_racfghdr *pRaCfg
-);
-
-static inline INT DO_RACFG_CMD_GET_TX_STATUS(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN struct ate_racfghdr *pRaCfg
-);
-
-static inline INT DO_RACFG_CMD_TX_STOP(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN struct ate_racfghdr *pRaCfg
-);
-
-static inline INT DO_RACFG_CMD_RX_START(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN struct ate_racfghdr *pRaCfg
-);
-
-static inline INT DO_RACFG_CMD_RX_STOP(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN struct ate_racfghdr *pRaCfg
-);
-
-static inline INT DO_RACFG_CMD_RX_STOP(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN struct ate_racfghdr *pRaCfg
-);
-
-static inline INT DO_RACFG_CMD_ATE_START_TX_CARRIER(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN struct ate_racfghdr *pRaCfg
-);
-
-static inline INT DO_RACFG_CMD_ATE_START_TX_CONT(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN struct ate_racfghdr *pRaCfg
-);
-
-static inline INT DO_RACFG_CMD_ATE_START_TX_FRAME(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN struct ate_racfghdr *pRaCfg
-);
-
-static inline INT DO_RACFG_CMD_ATE_SET_BW(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN struct ate_racfghdr *pRaCfg
-);
-
-static inline INT DO_RACFG_CMD_ATE_SET_TX_POWER0(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN struct ate_racfghdr *pRaCfg
-);
-
-static inline INT DO_RACFG_CMD_ATE_SET_TX_POWER1(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN struct ate_racfghdr *pRaCfg
-);
-
-static inline INT DO_RACFG_CMD_ATE_SET_FREQ_OFFSET(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN struct ate_racfghdr *pRaCfg
-);
-
-static inline INT DO_RACFG_CMD_ATE_GET_STATISTICS(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN struct ate_racfghdr *pRaCfg
-);
-
-static inline INT DO_RACFG_CMD_ATE_RESET_COUNTER(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN struct ate_racfghdr *pRaCfg
-);
-
-static inline INT DO_RACFG_CMD_ATE_SEL_TX_ANTENNA(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN struct ate_racfghdr *pRaCfg
-);
-
-static inline INT DO_RACFG_CMD_ATE_SEL_RX_ANTENNA(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN struct ate_racfghdr *pRaCfg
-);
-
-static inline INT DO_RACFG_CMD_ATE_SET_PREAMBLE(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN struct ate_racfghdr *pRaCfg
-);
-
-static inline INT DO_RACFG_CMD_ATE_SET_CHANNEL(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN struct ate_racfghdr *pRaCfg
-);
-
-static inline INT DO_RACFG_CMD_ATE_SET_ADDR1(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN struct ate_racfghdr *pRaCfg
-);
-
-static inline INT DO_RACFG_CMD_ATE_SET_ADDR2(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN struct ate_racfghdr *pRaCfg
-);
-
-static inline INT DO_RACFG_CMD_ATE_SET_ADDR3(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN struct ate_racfghdr *pRaCfg
-);
-
-static inline INT DO_RACFG_CMD_ATE_SET_RATE(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN struct ate_racfghdr *pRaCfg
-);
-
-static inline INT DO_RACFG_CMD_ATE_SET_TX_FRAME_LEN(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN struct ate_racfghdr *pRaCfg
-);
-
-static inline INT DO_RACFG_CMD_ATE_SET_TX_FRAME_COUNT(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN struct ate_racfghdr *pRaCfg
-);
-
-static inline INT DO_RACFG_CMD_ATE_START_RX_FRAME(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN struct ate_racfghdr *pRaCfg
-);
-
-static inline INT DO_RACFG_CMD_ATE_E2PROM_READ_BULK(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN struct ate_racfghdr *pRaCfg
-);
-
-static inline INT DO_RACFG_CMD_ATE_E2PROM_WRITE_BULK(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN struct ate_racfghdr *pRaCfg
-);
-
-static inline INT DO_RACFG_CMD_ATE_IO_WRITE_BULK(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN struct ate_racfghdr *pRaCfg
-);
-
-static inline INT DO_RACFG_CMD_ATE_BBP_READ_BULK(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN struct ate_racfghdr *pRaCfg
-);
-
-static inline INT DO_RACFG_CMD_ATE_BBP_WRITE_BULK(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN struct ate_racfghdr *pRaCfg
-);
-
-#endif // RALINK_28xx_QA //
-
-
-#ifdef RTMP_MAC_PCI
-static INT TxDmaBusy(
-	IN PRTMP_ADAPTER pAd)
-{
-	INT result;
-	WPDMA_GLO_CFG_STRUC GloCfg;
-
-	RTMP_IO_READ32(pAd, WPDMA_GLO_CFG, &GloCfg.word);	// disable DMA
-	if (GloCfg.field.TxDMABusy)
-		result = 1;
-	else
-		result = 0;
-
-	return result;
-}
-
-
-static INT RxDmaBusy(
-	IN PRTMP_ADAPTER pAd)
-{
-	INT result;
-	WPDMA_GLO_CFG_STRUC GloCfg;
-
-	RTMP_IO_READ32(pAd, WPDMA_GLO_CFG, &GloCfg.word);	// disable DMA
-	if (GloCfg.field.RxDMABusy)
-		result = 1;
-	else
-		result = 0;
-
-	return result;
-}
-
-
-static VOID RtmpDmaEnable(
-	IN PRTMP_ADAPTER pAd,
-	IN INT Enable)
-{
-	BOOLEAN value;
-	ULONG WaitCnt;
-	WPDMA_GLO_CFG_STRUC GloCfg;
-
-	value = Enable > 0 ? 1 : 0;
-
-	// check DMA is in busy mode.
-	WaitCnt = 0;
-
-	while (TxDmaBusy(pAd) || RxDmaBusy(pAd))
-	{
-		RTMPusecDelay(10);
-		if (WaitCnt++ > 100)
-			break;
-	}
-
-	RTMP_IO_READ32(pAd, WPDMA_GLO_CFG, &GloCfg.word);	// disable DMA
-	GloCfg.field.EnableTxDMA = value;
-	GloCfg.field.EnableRxDMA = value;
-	RTMP_IO_WRITE32(pAd, WPDMA_GLO_CFG, GloCfg.word);	// abort all TX rings
-	RTMPusecDelay(5000);
-
-	return;
-}
-#endif // RTMP_MAC_PCI //
-
-
-
-
-static VOID BbpSoftReset(
-	IN PRTMP_ADAPTER pAd)
-{
-	UCHAR BbpData = 0;
-
-	// Soft reset, set BBP R21 bit0=1->0
-	ATE_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R21, &BbpData);
-	BbpData |= 0x00000001; //set bit0=1
-	ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R21, BbpData);
-
-	ATE_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R21, &BbpData);
-	BbpData &= ~(0x00000001); //set bit0=0
-	ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R21, BbpData);
-
-	return;
-}
-
-
-static VOID RtmpRfIoWrite(
-	IN PRTMP_ADAPTER pAd)
-{
-	// Set RF value 1's set R3[bit2] = [0]
-	RTMP_RF_IO_WRITE32(pAd, pAd->LatchRfRegs.R1);
-	RTMP_RF_IO_WRITE32(pAd, pAd->LatchRfRegs.R2);
-	RTMP_RF_IO_WRITE32(pAd, (pAd->LatchRfRegs.R3 & (~0x04)));
-	RTMP_RF_IO_WRITE32(pAd, pAd->LatchRfRegs.R4);
-
-	RTMPusecDelay(200);
-
-	// Set RF value 2's set R3[bit2] = [1]
-	RTMP_RF_IO_WRITE32(pAd, pAd->LatchRfRegs.R1);
-	RTMP_RF_IO_WRITE32(pAd, pAd->LatchRfRegs.R2);
-	RTMP_RF_IO_WRITE32(pAd, (pAd->LatchRfRegs.R3 | 0x04));
-	RTMP_RF_IO_WRITE32(pAd, pAd->LatchRfRegs.R4);
-
-	RTMPusecDelay(200);
-
-	// Set RF value 3's set R3[bit2] = [0]
-	RTMP_RF_IO_WRITE32(pAd, pAd->LatchRfRegs.R1);
-	RTMP_RF_IO_WRITE32(pAd, pAd->LatchRfRegs.R2);
-	RTMP_RF_IO_WRITE32(pAd, (pAd->LatchRfRegs.R3 & (~0x04)));
-	RTMP_RF_IO_WRITE32(pAd, pAd->LatchRfRegs.R4);
-
-	return;
-}
-
-
-#ifdef RT30xx
-static int CheckMCSValid(
-	UCHAR Mode,
-	UCHAR Mcs,
-	BOOLEAN bRT2070)
-#endif // RT30xx //
-#ifndef RT30xx
-static int CheckMCSValid(
-	IN UCHAR Mode,
-	IN UCHAR Mcs)
-#endif // RT30xx //
-{
-	INT i;
-	PCHAR pRateTab;
-
-	switch (Mode)
-	{
-		case 0:
-			pRateTab = CCKRateTable;
-			break;
-		case 1:
-			pRateTab = OFDMRateTable;
-			break;
-		case 2:
-		case 3:
-#ifdef RT30xx
-			if (bRT2070)
-				pRateTab = OFDMRateTable;
-			else
-#endif // RT30xx //
-			pRateTab = HTMIXRateTable;
-			break;
-		default:
-			ATEDBGPRINT(RT_DEBUG_ERROR, ("unrecognizable Tx Mode %d\n", Mode));
-			return -1;
-			break;
-	}
-
-	i = 0;
-	while (pRateTab[i] != -1)
-	{
-		if (pRateTab[i] == Mcs)
-			return 0;
-		i++;
-	}
-
-	return -1;
-}
-
-
-static INT ATETxPwrHandler(
-	IN PRTMP_ADAPTER pAd,
-	IN char index)
-{
-	ULONG R;
-	CHAR TxPower;
-	UCHAR Bbp94 = 0;
-	BOOLEAN bPowerReduce = FALSE;
-#ifdef RTMP_RF_RW_SUPPORT
-	UCHAR RFValue;
-#endif // RTMP_RF_RW_SUPPORT //
-#ifdef RALINK_28xx_QA
-	if ((pAd->ate.bQATxStart == TRUE) || (pAd->ate.bQARxStart == TRUE))
-	{
-		/*
-			When QA is used for Tx, pAd->ate.TxPower0/1 and real tx power
-			are not synchronized.
-		*/
-		return 0;
-	}
-	else
-#endif // RALINK_28xx_QA //
-	{
-		TxPower = index == 0 ? pAd->ate.TxPower0 : pAd->ate.TxPower1;
-
-		if (pAd->ate.Channel <= 14)
-		{
-			if (TxPower > 31)
-			{
-
-				// R3, R4 can't large than 31 (0x24), 31 ~ 36 used by BBP 94
-				R = 31;
-				if (TxPower <= 36)
-					Bbp94 = BBPR94_DEFAULT + (UCHAR)(TxPower - 31);
-			}
-			else if (TxPower < 0)
-			{
-
-				// R3, R4 can't less than 0, -1 ~ -6 used by BBP 94
-				R = 0;
-				if (TxPower >= -6)
-					Bbp94 = BBPR94_DEFAULT + TxPower;
-			}
-			else
-			{
-				// 0 ~ 31
-				R = (ULONG) TxPower;
-				Bbp94 = BBPR94_DEFAULT;
-			}
-
-			ATEDBGPRINT(RT_DEBUG_TRACE, ("%s (TxPower=%d, R=%ld, BBP_R94=%d)\n", __FUNCTION__, TxPower, R, Bbp94));
-		}
-		else /* 5.5 GHz */
-		{
-			if (TxPower > 15)
-			{
-
-				// R3, R4 can't large than 15 (0x0F)
-				R = 15;
-			}
-			else if (TxPower < 0)
-			{
-
-				// R3, R4 can't less than 0
-				// -1 ~ -7
-				ASSERT((TxPower >= -7));
-				R = (ULONG)(TxPower + 7);
-				bPowerReduce = TRUE;
-			}
-			else
-			{
-				// 0 ~ 15
-				R = (ULONG) TxPower;
-			}
-
-			ATEDBGPRINT(RT_DEBUG_TRACE, ("%s (TxPower=%d, R=%lu)\n", __FUNCTION__, TxPower, R));
-		}
-//2008/09/10:KH adds to support 3070 ATE TX Power tunning real time<--
-#ifdef RTMP_RF_RW_SUPPORT
-		if (IS_RT30xx(pAd))
-		{
-			// Set Tx Power
-			ATE_RF_IO_READ8_BY_REG_ID(pAd, RF_R12, (PUCHAR)&RFValue);
-			RFValue = (RFValue & 0xE0) | TxPower;
-			ATE_RF_IO_WRITE8_BY_REG_ID(pAd, RF_R12, (UCHAR)RFValue);
-			ATEDBGPRINT(RT_DEBUG_TRACE, ("3070 or 2070:%s (TxPower=%d, RFValue=%x)\n", __FUNCTION__, TxPower, RFValue));
-		}
-		else
-#endif // RTMP_RF_RW_SUPPORT //
-		{
-		if (pAd->ate.Channel <= 14)
-		{
-			if (index == 0)
-			{
-				// shift TX power control to correct RF(R3) register bit position
-				R = R << 9;
-				R |= (pAd->LatchRfRegs.R3 & 0xffffc1ff);
-				pAd->LatchRfRegs.R3 = R;
-			}
-			else
-			{
-				// shift TX power control to correct RF(R4) register bit position
-				R = R << 6;
-				R |= (pAd->LatchRfRegs.R4 & 0xfffff83f);
-				pAd->LatchRfRegs.R4 = R;
-			}
-		}
-		else /* 5.5GHz */
-		{
-			if (bPowerReduce == FALSE)
-			{
-				if (index == 0)
-				{
-					// shift TX power control to correct RF(R3) register bit position
-					R = (R << 10) | (1 << 9);
-					R |= (pAd->LatchRfRegs.R3 & 0xffffc1ff);
-					pAd->LatchRfRegs.R3 = R;
-				}
-				else
-				{
-					// shift TX power control to correct RF(R4) register bit position
-					R = (R << 7) | (1 << 6);
-					R |= (pAd->LatchRfRegs.R4 & 0xfffff83f);
-					pAd->LatchRfRegs.R4 = R;
-				}
-			}
-			else
-			{
-				if (index == 0)
-				{
-					// shift TX power control to correct RF(R3) register bit position
-					R = (R << 10);
-					R |= (pAd->LatchRfRegs.R3 & 0xffffc1ff);
-
-					/* Clear bit 9 of R3 to reduce 7dB. */
-					pAd->LatchRfRegs.R3 = (R & (~(1 << 9)));
-				}
-				else
-				{
-					// shift TX power control to correct RF(R4) register bit position
-					R = (R << 7);
-					R |= (pAd->LatchRfRegs.R4 & 0xfffff83f);
-
-					/* Clear bit 6 of R4 to reduce 7dB. */
-					pAd->LatchRfRegs.R4 = (R & (~(1 << 6)));
-				}
-			}
-		}
-		RtmpRfIoWrite(pAd);
-	}
-//2008/09/10:KH adds to support 3070 ATE TX Power tunning real time-->
-
-		return 0;
-	}
-}
-
-
-/*
-==========================================================================
-    Description:
-        Set ATE operation mode to
-        0. ATESTART  = Start ATE Mode
-        1. ATESTOP   = Stop ATE Mode
-        2. TXCONT    = Continuous Transmit
-        3. TXCARR    = Transmit Carrier
-        4. TXFRAME   = Transmit Frames
-        5. RXFRAME   = Receive Frames
-#ifdef RALINK_28xx_QA
-        6. TXSTOP    = Stop Any Type of Transmition
-        7. RXSTOP    = Stop Receiving Frames
-#endif // RALINK_28xx_QA //
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-==========================================================================
-*/
-#ifdef RTMP_MAC_PCI
-static INT	ATECmdHandler(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	UINT32			Value = 0;
-	UCHAR			BbpData;
-	UINT32			MacData = 0;
-	PTXD_STRUC		pTxD;
-	INT				index;
-	UINT			i = 0, atemode = 0;
-	PRXD_STRUC		pRxD;
-	PRTMP_TX_RING	pTxRing = &pAd->TxRing[QID_AC_BE];
-	NDIS_STATUS		Status = NDIS_STATUS_SUCCESS;
-#ifdef	RT_BIG_ENDIAN
-    PTXD_STRUC      pDestTxD;
-    TXD_STRUC       TxD;
-#endif
-
-	ATEDBGPRINT(RT_DEBUG_TRACE, ("===> ATECmdHandler()\n"));
-
-	ATEAsicSwitchChannel(pAd);
-
-	/* empty function */
-	AsicLockChannel(pAd, pAd->ate.Channel);
-
-	RTMPusecDelay(5000);
-
-	// read MAC_SYS_CTRL and backup MAC_SYS_CTRL value.
-	RTMP_IO_READ32(pAd, MAC_SYS_CTRL, &MacData);
-
-	// Default value in BBP R22 is 0x0.
-	BbpData = 0;
-
-	// clean bit4 to stop continuous Tx production test.
-	MacData &= 0xFFFFFFEF;
-
-	// Enter ATE mode and set Tx/Rx Idle
-	if (!strcmp(arg, "ATESTART"))
-	{
-		ATEDBGPRINT(RT_DEBUG_TRACE, ("ATE: ATESTART\n"));
-
-#if defined(LINUX) || defined(VXWORKS)
-		// check if we have removed the firmware
-		if (!(ATE_ON(pAd)))
-		{
-			NICEraseFirmware(pAd);
-		}
-#endif // defined(LINUX) || defined(VXWORKS) //
-
-		atemode = pAd->ate.Mode;
-		pAd->ate.Mode = ATE_START;
-		RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, MacData);
-
-		if (atemode == ATE_TXCARR)
-		{
-			// No Carrier Test set BBP R22 bit7=0, bit6=0, bit[5~0]=0x0
-			ATE_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R22, &BbpData);
-			BbpData &= 0xFFFFFF00; // clear bit7, bit6, bit[5~0]
-		    ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R22, BbpData);
-		}
-		else if (atemode == ATE_TXCARRSUPP)
-		{
-			// No Cont. TX set BBP R22 bit7=0
-			ATE_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R22, &BbpData);
-			BbpData &= ~(1 << 7); // set bit7=0
-			ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R22, BbpData);
-
-			// No Carrier Suppression set BBP R24 bit0=0
-			ATE_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R24, &BbpData);
-			BbpData &= 0xFFFFFFFE; // clear bit0
-		    ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R24, BbpData);
-		}
-
-		/*
-			We should free some resource which was allocated
-			when ATE_TXFRAME , ATE_STOP, and ATE_TXCONT.
-		*/
-		else if ((atemode & ATE_TXFRAME) || (atemode == ATE_STOP))
-		{
-			PRTMP_TX_RING pTxRing = &pAd->TxRing[QID_AC_BE];
-
-			if (atemode == ATE_TXCONT)
-			{
-				// No Cont. TX set BBP R22 bit7=0
-				ATE_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R22, &BbpData);
-				BbpData &= ~(1 << 7); // set bit7=0
-				ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R22, BbpData);
-			}
-
-			// Abort Tx, Rx DMA.
-			RtmpDmaEnable(pAd, 0);
-			for (i=0; i<TX_RING_SIZE; i++)
-			{
-				PNDIS_PACKET  pPacket;
-
-#ifndef RT_BIG_ENDIAN
-			    pTxD = (PTXD_STRUC)pAd->TxRing[QID_AC_BE].Cell[i].AllocVa;
-#else
-			pDestTxD = (PTXD_STRUC)pAd->TxRing[QID_AC_BE].Cell[i].AllocVa;
-			TxD = *pDestTxD;
-			pTxD = &TxD;
-			RTMPDescriptorEndianChange((PUCHAR)pTxD, TYPE_TXD);
-#endif
-				pTxD->DMADONE = 0;
-				pPacket = pTxRing->Cell[i].pNdisPacket;
-
-				if (pPacket)
-				{
-					PCI_UNMAP_SINGLE(pAd, pTxD->SDPtr0, pTxD->SDLen0, PCI_DMA_TODEVICE);
-					RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_SUCCESS);
-				}
-
-				// Always assign pNdisPacket as NULL after clear
-				pTxRing->Cell[i].pNdisPacket = NULL;
-
-				pPacket = pTxRing->Cell[i].pNextNdisPacket;
-
-				if (pPacket)
-				{
-					PCI_UNMAP_SINGLE(pAd, pTxD->SDPtr1, pTxD->SDLen1, PCI_DMA_TODEVICE);
-					RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_SUCCESS);
-				}
-
-				// Always assign pNextNdisPacket as NULL after clear
-				pTxRing->Cell[i].pNextNdisPacket = NULL;
-#ifdef RT_BIG_ENDIAN
-				RTMPDescriptorEndianChange((PUCHAR)pTxD, TYPE_TXD);
-				WriteBackToDescriptor((PUCHAR)pDestTxD, (PUCHAR)pTxD, FALSE, TYPE_TXD);
-#endif
-			}
-
-			// Start Tx, RX DMA
-			RtmpDmaEnable(pAd, 1);
-		}
-
-		// reset Rx statistics.
-		pAd->ate.LastSNR0 = 0;
-		pAd->ate.LastSNR1 = 0;
-		pAd->ate.LastRssi0 = 0;
-		pAd->ate.LastRssi1 = 0;
-		pAd->ate.LastRssi2 = 0;
-		pAd->ate.AvgRssi0 = 0;
-		pAd->ate.AvgRssi1 = 0;
-		pAd->ate.AvgRssi2 = 0;
-		pAd->ate.AvgRssi0X8 = 0;
-		pAd->ate.AvgRssi1X8 = 0;
-		pAd->ate.AvgRssi2X8 = 0;
-		pAd->ate.NumOfAvgRssiSample = 0;
-
-#ifdef RALINK_28xx_QA
-		// Tx frame
-		pAd->ate.bQATxStart = FALSE;
-		pAd->ate.bQARxStart = FALSE;
-		pAd->ate.seq = 0;
-
-		// counters
-		pAd->ate.U2M = 0;
-		pAd->ate.OtherData = 0;
-		pAd->ate.Beacon = 0;
-		pAd->ate.OtherCount = 0;
-		pAd->ate.TxAc0 = 0;
-		pAd->ate.TxAc1 = 0;
-		pAd->ate.TxAc2 = 0;
-		pAd->ate.TxAc3 = 0;
-		/*pAd->ate.TxHCCA = 0;*/
-		pAd->ate.TxMgmt = 0;
-		pAd->ate.RSSI0 = 0;
-		pAd->ate.RSSI1 = 0;
-		pAd->ate.RSSI2 = 0;
-		pAd->ate.SNR0 = 0;
-		pAd->ate.SNR1 = 0;
-
-		// control
-		pAd->ate.TxDoneCount = 0;
-		// TxStatus : 0 --> task is idle, 1 --> task is running
-		pAd->ate.TxStatus = 0;
-#endif // RALINK_28xx_QA //
-
-		// Soft reset BBP.
-		BbpSoftReset(pAd);
-
-
-#ifdef CONFIG_STA_SUPPORT
-		/* LinkDown() has "AsicDisableSync();" and "RTMP_BBP_IO_R/W8_BY_REG_ID();" inside. */
-//      LinkDown(pAd, FALSE);
-//		AsicEnableBssSync(pAd);
-
-#if defined(LINUX) || defined(VXWORKS)
-		RTMP_OS_NETDEV_STOP_QUEUE(pAd->net_dev);
-#endif // defined(LINUX) || defined(VXWORKS) //
-
-		/*
-			If we skip "LinkDown()", we should disable protection
-			to prevent from sending out RTS or CTS-to-self.
-		*/
-		ATEDisableAsicProtect(pAd);
-		RTMPStationStop(pAd);
-#endif // CONFIG_STA_SUPPORT //
-
-		/* Disable Tx */
-		RTMP_IO_READ32(pAd, MAC_SYS_CTRL, &Value);
-		Value &= ~(1 << 2);
-		RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, Value);
-
-		/* Disable Rx */
-		RTMP_IO_READ32(pAd, MAC_SYS_CTRL, &Value);
-		Value &= ~(1 << 3);
-		RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, Value);
-	}
-	else if (!strcmp(arg, "ATESTOP"))
-	{
-		ATEDBGPRINT(RT_DEBUG_TRACE, ("ATE: ATESTOP\n"));
-
-		ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R22, BbpData);
-
-		// recover the MAC_SYS_CTRL register back
-		RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, MacData);
-
-		// disable Tx, Rx
-		RTMP_IO_READ32(pAd, MAC_SYS_CTRL, &Value);
-		Value &= (0xfffffff3);
-		RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, Value);
-
-		// abort Tx, RX DMA
-		RtmpDmaEnable(pAd, 0);
-
-#ifdef LINUX
-		pAd->ate.bFWLoading = TRUE;
-
-		Status = NICLoadFirmware(pAd);
-
-		if (Status != NDIS_STATUS_SUCCESS)
-		{
-			ATEDBGPRINT(RT_DEBUG_ERROR, ("NICLoadFirmware failed, Status[=0x%08x]\n", Status));
-			return FALSE;
-		}
-#endif // LINUX //
-		pAd->ate.Mode = ATE_STOP;
-
-		/*
-			Even the firmware has been loaded,
-			we still could use ATE_BBP_IO_READ8_BY_REG_ID().
-			But this is not suggested.
-		*/
-		BbpSoftReset(pAd);
-
-		RTMP_ASIC_INTERRUPT_DISABLE(pAd);
-
-		NICInitializeAdapter(pAd, TRUE);
-
-		/*
-			Reinitialize Rx Ring before Rx DMA is enabled.
-			>>>RxCoherent<<< was gone !
-		*/
-		for (index = 0; index < RX_RING_SIZE; index++)
-		{
-			pRxD = (PRXD_STRUC) pAd->RxRing.Cell[index].AllocVa;
-			pRxD->DDONE = 0;
-		}
-
-		// We should read EEPROM for all cases.
-		NICReadEEPROMParameters(pAd, NULL);
-		NICInitAsicFromEEPROM(pAd);
-
-		AsicSwitchChannel(pAd, pAd->CommonCfg.Channel, FALSE);
-
-		/* empty function */
-		AsicLockChannel(pAd, pAd->CommonCfg.Channel);
-
-		/* clear garbage interrupts */
-		RTMP_IO_WRITE32(pAd, INT_SOURCE_CSR, 0xffffffff);
-		/* Enable Interrupt */
-		RTMP_ASIC_INTERRUPT_ENABLE(pAd);
-
-		/* restore RX_FILTR_CFG */
-
-#ifdef CONFIG_STA_SUPPORT
-		/* restore RX_FILTR_CFG due to that QA maybe set it to 0x3 */
-		RTMP_IO_WRITE32(pAd, RX_FILTR_CFG, STANORMAL);
-#endif // CONFIG_STA_SUPPORT //
-
-		// Enable Tx
-		RTMP_IO_READ32(pAd, MAC_SYS_CTRL, &Value);
-		Value |= (1 << 2);
-		RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, Value);
-
-		// Enable Tx, Rx DMA.
-		RtmpDmaEnable(pAd, 1);
-
-		// Enable Rx
-		RTMP_IO_READ32(pAd, MAC_SYS_CTRL, &Value);
-		Value |= (1 << 3);
-		RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, Value);
-
-
-#ifdef CONFIG_STA_SUPPORT
-		RTMPStationStart(pAd);
-#endif // CONFIG_STA_SUPPORT //
-
-#if defined(LINUX) || defined(VXWORKS)
-		RTMP_OS_NETDEV_START_QUEUE(pAd->net_dev);
-#endif // defined(LINUX) || defined(VXWORKS) //
-	}
-	else if (!strcmp(arg, "TXCARR"))
-	{
-		ATEDBGPRINT(RT_DEBUG_TRACE, ("ATE: TXCARR\n"));
-		pAd->ate.Mode = ATE_TXCARR;
-
-		// QA has done the following steps if it is used.
-		if (pAd->ate.bQATxStart == FALSE)
-		{
-			// Soft reset BBP.
-			BbpSoftReset(pAd);
-
-			// Carrier Test set BBP R22 bit7=1, bit6=1, bit[5~0]=0x01
-			ATE_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R22, &BbpData);
-			BbpData &= 0xFFFFFF00; //clear bit7, bit6, bit[5~0]
-			BbpData |= 0x000000C1; //set bit7=1, bit6=1, bit[5~0]=0x01
-			ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R22, BbpData);
-
-			// set MAC_SYS_CTRL(0x1004) Continuous Tx Production Test (bit4) = 1
-			RTMP_IO_READ32(pAd, MAC_SYS_CTRL, &Value);
-			Value = Value | 0x00000010;
-			RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, Value);
-		}
-	}
-	else if (!strcmp(arg, "TXCONT"))
-	{
-		if (pAd->ate.bQATxStart == TRUE)
-		{
-			/*
-				set MAC_SYS_CTRL(0x1004) bit4(Continuous Tx Production Test)
-				and bit2(MAC TX enable) back to zero.
-			*/
-			RTMP_IO_READ32(pAd, MAC_SYS_CTRL, &MacData);
-			MacData &= 0xFFFFFFEB;
-			RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, MacData);
-
-			// set BBP R22 bit7=0
-			ATE_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R22, &BbpData);
-			BbpData &= 0xFFFFFF7F; //set bit7=0
-			ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R22, BbpData);
-		}
-
-		/*
-			for TxCont mode.
-			Step 1: Send 50 packets first then wait for a moment.
-			Step 2: Send more 50 packet then start continue mode.
-		*/
-		ATEDBGPRINT(RT_DEBUG_TRACE, ("ATE: TXCONT\n"));
-
-		// Step 1: send 50 packets first.
-		pAd->ate.Mode = ATE_TXCONT;
-		pAd->ate.TxCount = 50;
-
-		/* Do it after Tx/Rx DMA is aborted. */
-//		pAd->ate.TxDoneCount = 0;
-
-		// Soft reset BBP.
-		BbpSoftReset(pAd);
-
-		// Abort Tx, RX DMA.
-		RtmpDmaEnable(pAd, 0);
-
-		// Fix can't smooth kick
-		{
-			RTMP_IO_READ32(pAd, TX_DTX_IDX0 + QID_AC_BE * 0x10,  &pTxRing->TxDmaIdx);
-			pTxRing->TxSwFreeIdx = pTxRing->TxDmaIdx;
-			pTxRing->TxCpuIdx = pTxRing->TxDmaIdx;
-			RTMP_IO_WRITE32(pAd, TX_CTX_IDX0 + QID_AC_BE * 0x10, pTxRing->TxCpuIdx);
-		}
-
-		pAd->ate.TxDoneCount = 0;
-
-		/* Only needed if we have to send some normal frames. */
-		SetJapanFilter(pAd);
-
-		for (i = 0; (i < TX_RING_SIZE-1) && (i < pAd->ate.TxCount); i++)
-		{
-			PNDIS_PACKET pPacket;
-			UINT32 TxIdx = pTxRing->TxCpuIdx;
-
-#ifndef RT_BIG_ENDIAN
-			pTxD = (PTXD_STRUC)pTxRing->Cell[TxIdx].AllocVa;
-#else
-			pDestTxD = (PTXD_STRUC)pTxRing->Cell[TxIdx].AllocVa;
-			TxD = *pDestTxD;
-			pTxD = &TxD;
-			RTMPDescriptorEndianChange((PUCHAR)pTxD, TYPE_TXD);
-#endif
-			// Clean current cell.
-			pPacket = pTxRing->Cell[TxIdx].pNdisPacket;
-
-			if (pPacket)
-			{
-				PCI_UNMAP_SINGLE(pAd, pTxD->SDPtr0, pTxD->SDLen0, PCI_DMA_TODEVICE);
-				RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_SUCCESS);
-			}
-
-			// Always assign pNdisPacket as NULL after clear
-			pTxRing->Cell[TxIdx].pNdisPacket = NULL;
-
-			pPacket = pTxRing->Cell[TxIdx].pNextNdisPacket;
-
-			if (pPacket)
-			{
-				PCI_UNMAP_SINGLE(pAd, pTxD->SDPtr1, pTxD->SDLen1, PCI_DMA_TODEVICE);
-				RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_SUCCESS);
-			}
-
-			// Always assign pNextNdisPacket as NULL after clear
-			pTxRing->Cell[TxIdx].pNextNdisPacket = NULL;
-
-#ifdef RT_BIG_ENDIAN
-			RTMPDescriptorEndianChange((PUCHAR)pTxD, TYPE_TXD);
-			WriteBackToDescriptor((PUCHAR)pDestTxD, (PUCHAR)pTxD, FALSE, TYPE_TXD);
-#endif
-
-			if (ATESetUpFrame(pAd, TxIdx) != 0)
-				break;
-
-			INC_RING_INDEX(pTxRing->TxCpuIdx, TX_RING_SIZE);
-		}
-
-		// Setup frame format.
-		ATESetUpFrame(pAd, pTxRing->TxCpuIdx);
-
-		// Start Tx, RX DMA.
-		RtmpDmaEnable(pAd, 1);
-
-		// Enable Tx
-		RTMP_IO_READ32(pAd, MAC_SYS_CTRL, &Value);
-		Value |= (1 << 2);
-		RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, Value);
-
-		// Disable Rx
-		RTMP_IO_READ32(pAd, MAC_SYS_CTRL, &Value);
-		Value &= ~(1 << 3);
-		RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, Value);
-
-#ifdef RALINK_28xx_QA
-		if (pAd->ate.bQATxStart == TRUE)
-		{
-			pAd->ate.TxStatus = 1;
-		}
-#endif // RALINK_28xx_QA //
-
-		// kick Tx-Ring
-		RTMP_IO_WRITE32(pAd, TX_CTX_IDX0 + QID_AC_BE * RINGREG_DIFF, pAd->TxRing[QID_AC_BE].TxCpuIdx);
-
-		RTMPusecDelay(5000);
-
-
-		// Step 2: send more 50 packets then start continue mode.
-		// Abort Tx, RX DMA.
-		RtmpDmaEnable(pAd, 0);
-
-		// Cont. TX set BBP R22 bit7=1
-		ATE_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R22, &BbpData);
-		BbpData |= 0x00000080; //set bit7=1
-		ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R22, BbpData);
-
-		pAd->ate.TxCount = 50;
-
-		// Fix can't smooth kick
-		{
-			RTMP_IO_READ32(pAd, TX_DTX_IDX0 + QID_AC_BE * 0x10,  &pTxRing->TxDmaIdx);
-			pTxRing->TxSwFreeIdx = pTxRing->TxDmaIdx;
-			pTxRing->TxCpuIdx = pTxRing->TxDmaIdx;
-			RTMP_IO_WRITE32(pAd, TX_CTX_IDX0 + QID_AC_BE * 0x10, pTxRing->TxCpuIdx);
-		}
-
-		pAd->ate.TxDoneCount = 0;
-
-		SetJapanFilter(pAd);
-
-		for (i = 0; (i < TX_RING_SIZE-1) && (i < pAd->ate.TxCount); i++)
-		{
-			PNDIS_PACKET pPacket;
-			UINT32 TxIdx = pTxRing->TxCpuIdx;
-
-#ifndef RT_BIG_ENDIAN
-			pTxD = (PTXD_STRUC)pTxRing->Cell[TxIdx].AllocVa;
-#else
-			pDestTxD = (PTXD_STRUC)pTxRing->Cell[TxIdx].AllocVa;
-			TxD = *pDestTxD;
-			pTxD = &TxD;
-			RTMPDescriptorEndianChange((PUCHAR)pTxD, TYPE_TXD);
-#endif
-			// clean current cell.
-			pPacket = pTxRing->Cell[TxIdx].pNdisPacket;
-
-			if (pPacket)
-			{
-				PCI_UNMAP_SINGLE(pAd, pTxD->SDPtr0, pTxD->SDLen0, PCI_DMA_TODEVICE);
-				RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_SUCCESS);
-			}
-
-			// Always assign pNdisPacket as NULL after clear
-			pTxRing->Cell[TxIdx].pNdisPacket = NULL;
-
-			pPacket = pTxRing->Cell[TxIdx].pNextNdisPacket;
-
-			if (pPacket)
-			{
-				PCI_UNMAP_SINGLE(pAd, pTxD->SDPtr1, pTxD->SDLen1, PCI_DMA_TODEVICE);
-				RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_SUCCESS);
-			}
-
-			// Always assign pNextNdisPacket as NULL after clear
-			pTxRing->Cell[TxIdx].pNextNdisPacket = NULL;
-
-#ifdef RT_BIG_ENDIAN
-			RTMPDescriptorEndianChange((PUCHAR)pTxD, TYPE_TXD);
-			WriteBackToDescriptor((PUCHAR)pDestTxD, (PUCHAR)pTxD, FALSE, TYPE_TXD);
-#endif
-
-			if (ATESetUpFrame(pAd, TxIdx) != 0)
-				break;
-
-			INC_RING_INDEX(pTxRing->TxCpuIdx, TX_RING_SIZE);
-		}
-
-		ATESetUpFrame(pAd, pTxRing->TxCpuIdx);
-
-		// Start Tx, RX DMA.
-		RtmpDmaEnable(pAd, 1);
-
-		// Enable Tx
-		RTMP_IO_READ32(pAd, MAC_SYS_CTRL, &Value);
-		Value |= (1 << 2);
-		RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, Value);
-
-		// Disable Rx
-		RTMP_IO_READ32(pAd, MAC_SYS_CTRL, &Value);
-		Value &= ~(1 << 3);
-		RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, Value);
-
-#ifdef RALINK_28xx_QA
-		if (pAd->ate.bQATxStart == TRUE)
-		{
-			pAd->ate.TxStatus = 1;
-		}
-#endif // RALINK_28xx_QA //
-
-		// kick Tx-Ring.
-		RTMP_IO_WRITE32(pAd, TX_CTX_IDX0 + QID_AC_BE * RINGREG_DIFF, pAd->TxRing[QID_AC_BE].TxCpuIdx);
-
-		RTMPusecDelay(500);
-
-		RTMP_IO_READ32(pAd, MAC_SYS_CTRL, &MacData);
-		MacData |= 0x00000010;
-		RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, MacData);
-	}
-	else if (!strcmp(arg, "TXFRAME"))
-	{
-		ATEDBGPRINT(RT_DEBUG_TRACE, ("ATE: TXFRAME(Count=%d)\n", pAd->ate.TxCount));
-		pAd->ate.Mode |= ATE_TXFRAME;
-		ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R22, BbpData);
-
-		// Soft reset BBP.
-		BbpSoftReset(pAd);
-		RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, MacData);
-
-		// Abort Tx, RX DMA.
-		RtmpDmaEnable(pAd, 0);
-
-		// Fix can't smooth kick
-		{
-			RTMP_IO_READ32(pAd, TX_DTX_IDX0 + QID_AC_BE * 0x10,  &pTxRing->TxDmaIdx);
-			pTxRing->TxSwFreeIdx = pTxRing->TxDmaIdx;
-			pTxRing->TxCpuIdx = pTxRing->TxDmaIdx;
-			RTMP_IO_WRITE32(pAd, TX_CTX_IDX0 + QID_AC_BE * 0x10, pTxRing->TxCpuIdx);
-		}
-
-		pAd->ate.TxDoneCount = 0;
-
-		SetJapanFilter(pAd);
-
-		for (i = 0; (i < TX_RING_SIZE-1) && (i < pAd->ate.TxCount); i++)
-		{
-			PNDIS_PACKET pPacket;
-			UINT32 TxIdx = pTxRing->TxCpuIdx;
-
-#ifndef RT_BIG_ENDIAN
-			pTxD = (PTXD_STRUC)pTxRing->Cell[TxIdx].AllocVa;
-#else
-			pDestTxD = (PTXD_STRUC)pTxRing->Cell[TxIdx].AllocVa;
-			TxD = *pDestTxD;
-			pTxD = &TxD;
-			RTMPDescriptorEndianChange((PUCHAR)pTxD, TYPE_TXD);
-#endif
-			// Clean current cell.
-			pPacket = pTxRing->Cell[TxIdx].pNdisPacket;
-
-			if (pPacket)
-			{
-				PCI_UNMAP_SINGLE(pAd, pTxD->SDPtr0, pTxD->SDLen0, PCI_DMA_TODEVICE);
-				RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_SUCCESS);
-			}
-
-			// Always assign pNdisPacket as NULL after clear
-			pTxRing->Cell[TxIdx].pNdisPacket = NULL;
-
-			pPacket = pTxRing->Cell[TxIdx].pNextNdisPacket;
-
-			if (pPacket)
-			{
-				PCI_UNMAP_SINGLE(pAd, pTxD->SDPtr1, pTxD->SDLen1, PCI_DMA_TODEVICE);
-				RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_SUCCESS);
-			}
-
-			// Always assign pNextNdisPacket as NULL after clear
-			pTxRing->Cell[TxIdx].pNextNdisPacket = NULL;
-
-#ifdef RT_BIG_ENDIAN
-			RTMPDescriptorEndianChange((PUCHAR)pTxD, TYPE_TXD);
-			WriteBackToDescriptor((PUCHAR)pDestTxD, (PUCHAR)pTxD, FALSE, TYPE_TXD);
-#endif
-
-			if (ATESetUpFrame(pAd, TxIdx) != 0)
-				break;
-
-			INC_RING_INDEX(pTxRing->TxCpuIdx, TX_RING_SIZE);
-
-		}
-
-		ATESetUpFrame(pAd, pTxRing->TxCpuIdx);
-
-		// Start Tx, Rx DMA.
-		RtmpDmaEnable(pAd, 1);
-
-		// Enable Tx
-		RTMP_IO_READ32(pAd, MAC_SYS_CTRL, &Value);
-		Value |= (1 << 2);
-		RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, Value);
-
-#ifdef RALINK_28xx_QA
-		// add this for LoopBack mode
-		if (pAd->ate.bQARxStart == FALSE)
-		{
-			// Disable Rx
-			RTMP_IO_READ32(pAd, MAC_SYS_CTRL, &Value);
-			Value &= ~(1 << 3);
-			RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, Value);
-		}
-
-		if (pAd->ate.bQATxStart == TRUE)
-		{
-			pAd->ate.TxStatus = 1;
-		}
-#else
-		// Disable Rx
-		RTMP_IO_READ32(pAd, MAC_SYS_CTRL, &Value);
-		Value &= ~(1 << 3);
-		RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, Value);
-#endif // RALINK_28xx_QA //
-
-		RTMP_IO_READ32(pAd, TX_DTX_IDX0 + QID_AC_BE * RINGREG_DIFF, &pAd->TxRing[QID_AC_BE].TxDmaIdx);
-		// kick Tx-Ring.
-		RTMP_IO_WRITE32(pAd, TX_CTX_IDX0 + QID_AC_BE * RINGREG_DIFF, pAd->TxRing[QID_AC_BE].TxCpuIdx);
-
-		pAd->RalinkCounters.KickTxCount++;
-	}
-#ifdef RALINK_28xx_QA
-	else if (!strcmp(arg, "TXSTOP"))
-	{
-		ATEDBGPRINT(RT_DEBUG_TRACE, ("ATE: TXSTOP\n"));
-		atemode = pAd->ate.Mode;
-		pAd->ate.Mode &= ATE_TXSTOP;
-		pAd->ate.bQATxStart = FALSE;
-//		pAd->ate.TxDoneCount = pAd->ate.TxCount;
-
-		if (atemode == ATE_TXCARR)
-		{
-			// No Carrier Test set BBP R22 bit7=0, bit6=0, bit[5~0]=0x0
-			ATE_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R22, &BbpData);
-			BbpData &= 0xFFFFFF00; //clear bit7, bit6, bit[5~0]
-		    ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R22, BbpData);
-		}
-		else if (atemode == ATE_TXCARRSUPP)
-		{
-			// No Cont. TX set BBP R22 bit7=0
-			ATE_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R22, &BbpData);
-			BbpData &= ~(1 << 7); //set bit7=0
-			ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R22, BbpData);
-
-			// No Carrier Suppression set BBP R24 bit0=0
-			ATE_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R24, &BbpData);
-			BbpData &= 0xFFFFFFFE; //clear bit0
-		    ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R24, BbpData);
-		}
-
-		/*
-			We should free some resource which was allocated
-			when ATE_TXFRAME, ATE_STOP, and ATE_TXCONT.
-		*/
-		else if ((atemode & ATE_TXFRAME) || (atemode == ATE_STOP))
-		{
-			PRTMP_TX_RING pTxRing = &pAd->TxRing[QID_AC_BE];
-
-			if (atemode == ATE_TXCONT)
-			{
-				// No Cont. TX set BBP R22 bit7=0
-				ATE_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R22, &BbpData);
-				BbpData &= ~(1 << 7); //set bit7=0
-				ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R22, BbpData);
-			}
-
-			// Abort Tx, Rx DMA.
-			RtmpDmaEnable(pAd, 0);
-
-			for (i=0; i<TX_RING_SIZE; i++)
-			{
-				PNDIS_PACKET  pPacket;
-
-#ifndef RT_BIG_ENDIAN
-			    pTxD = (PTXD_STRUC)pAd->TxRing[QID_AC_BE].Cell[i].AllocVa;
-#else
-			pDestTxD = (PTXD_STRUC)pAd->TxRing[QID_AC_BE].Cell[i].AllocVa;
-			TxD = *pDestTxD;
-			pTxD = &TxD;
-			RTMPDescriptorEndianChange((PUCHAR)pTxD, TYPE_TXD);
-#endif
-				pTxD->DMADONE = 0;
-				pPacket = pTxRing->Cell[i].pNdisPacket;
-
-				if (pPacket)
-				{
-					PCI_UNMAP_SINGLE(pAd, pTxD->SDPtr0, pTxD->SDLen0, PCI_DMA_TODEVICE);
-					RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_SUCCESS);
-				}
-
-				// Always assign pNdisPacket as NULL after clear
-				pTxRing->Cell[i].pNdisPacket = NULL;
-
-				pPacket = pTxRing->Cell[i].pNextNdisPacket;
-
-				if (pPacket)
-				{
-					PCI_UNMAP_SINGLE(pAd, pTxD->SDPtr1, pTxD->SDLen1, PCI_DMA_TODEVICE);
-					RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_SUCCESS);
-				}
-
-				// Always assign pNextNdisPacket as NULL after clear
-				pTxRing->Cell[i].pNextNdisPacket = NULL;
-#ifdef RT_BIG_ENDIAN
-				RTMPDescriptorEndianChange((PUCHAR)pTxD, TYPE_TXD);
-				WriteBackToDescriptor((PUCHAR)pDestTxD, (PUCHAR)pTxD, FALSE, TYPE_TXD);
-#endif
-			}
-			// Enable Tx, Rx DMA
-			RtmpDmaEnable(pAd, 1);
-
-		}
-
-		// TxStatus : 0 --> task is idle, 1 --> task is running
-		pAd->ate.TxStatus = 0;
-
-		// Soft reset BBP.
-		BbpSoftReset(pAd);
-
-		// Disable Tx
-		RTMP_IO_READ32(pAd, MAC_SYS_CTRL, &Value);
-		Value &= ~(1 << 2);
-		RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, Value);
-	}
-	else if (!strcmp(arg, "RXSTOP"))
-	{
-		ATEDBGPRINT(RT_DEBUG_TRACE, ("ATE: RXSTOP\n"));
-		atemode = pAd->ate.Mode;
-		pAd->ate.Mode &= ATE_RXSTOP;
-		pAd->ate.bQARxStart = FALSE;
-//		pAd->ate.TxDoneCount = pAd->ate.TxCount;
-
-		if (atemode == ATE_TXCARR)
-		{
-			;
-		}
-		else if (atemode == ATE_TXCARRSUPP)
-		{
-			;
-		}
-
-		/*
-			We should free some resource which was allocated
-			when ATE_TXFRAME, ATE_STOP, and ATE_TXCONT.
-		*/
-		else if ((atemode & ATE_TXFRAME) || (atemode == ATE_STOP))
-		{
-			if (atemode == ATE_TXCONT)
-			{
-				;
-			}
-		}
-
-		// Soft reset BBP.
-		BbpSoftReset(pAd);
-
-		// Disable Rx
-		RTMP_IO_READ32(pAd, MAC_SYS_CTRL, &Value);
-		Value &= ~(1 << 3);
-		RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, Value);
-	}
-#endif // RALINK_28xx_QA //
-	else if (!strcmp(arg, "RXFRAME"))
-	{
-		ATEDBGPRINT(RT_DEBUG_TRACE, ("ATE: RXFRAME\n"));
-
-		ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R22, BbpData);
-		RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, MacData);
-
-		pAd->ate.Mode |= ATE_RXFRAME;
-
-		// Disable Tx of MAC block.
-		RTMP_IO_READ32(pAd, MAC_SYS_CTRL, &Value);
-		Value &= ~(1 << 2);
-		RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, Value);
-
-		// Enable Rx of MAC block.
-		RTMP_IO_READ32(pAd, MAC_SYS_CTRL, &Value);
-		Value |= (1 << 3);
-		RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, Value);
-	}
-	else
-	{
-		ATEDBGPRINT(RT_DEBUG_TRACE, ("ATE: Invalid arg!\n"));
-		return FALSE;
-	}
-	RTMPusecDelay(5000);
-
-	ATEDBGPRINT(RT_DEBUG_TRACE, ("<=== ATECmdHandler()\n"));
-
-	return TRUE;
-}
-/*=======================End of RTMP_MAC_PCI =======================*/
-#endif // RTMP_MAC_PCI //
-
-
-
-
-INT	Set_ATE_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	if (ATECmdHandler(pAd, arg))
-	{
-		ATEDBGPRINT(RT_DEBUG_TRACE, ("Ralink: Set_ATE_Proc Success\n"));
-
-
-		return TRUE;
-	}
-	else
-	{
-		ATEDBGPRINT(RT_DEBUG_TRACE, ("Ralink: Set_ATE_Proc Failed\n"));
-		return FALSE;
-	}
-}
-
-
-/*
-==========================================================================
-    Description:
-        Set ATE ADDR1=DA for TxFrame(AP  : To DS = 0 ; From DS = 1)
-        or
-        Set ATE ADDR3=DA for TxFrame(STA : To DS = 1 ; From DS = 0)
-
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-==========================================================================
-*/
-INT	Set_ATE_DA_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	PSTRING				value;
-	INT					i;
-
-	// Mac address acceptable format 01:02:03:04:05:06 length 17
-	if (strlen(arg) != 17)
-		return FALSE;
-
-    for (i = 0, value = rstrtok(arg, ":"); value; value = rstrtok(NULL, ":"))
-	{
-		/* sanity check */
-		if ((strlen(value) != 2) || (!isxdigit(*value)) || (!isxdigit(*(value+1))))
-		{
-			return FALSE;
-		}
-
-#ifdef CONFIG_STA_SUPPORT
-		AtoH(value, &pAd->ate.Addr3[i++], 1);
-#endif // CONFIG_STA_SUPPORT //
-	}
-
-	/* sanity check */
-	if (i != 6)
-	{
-		return FALSE;
-	}
-
-#ifdef CONFIG_STA_SUPPORT
-	ATEDBGPRINT(RT_DEBUG_TRACE, ("Set_ATE_DA_Proc (DA = %2X:%2X:%2X:%2X:%2X:%2X)\n", pAd->ate.Addr3[0],
-		pAd->ate.Addr3[1], pAd->ate.Addr3[2], pAd->ate.Addr3[3], pAd->ate.Addr3[4], pAd->ate.Addr3[5]));
-#endif // CONFIG_STA_SUPPORT //
-
-	ATEDBGPRINT(RT_DEBUG_TRACE, ("Ralink: Set_ATE_DA_Proc Success\n"));
-
-	return TRUE;
-}
-
-
-/*
-==========================================================================
-    Description:
-        Set ATE ADDR3=SA for TxFrame(AP  : To DS = 0 ; From DS = 1)
-        or
-        Set ATE ADDR2=SA for TxFrame(STA : To DS = 1 ; From DS = 0)
-
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-==========================================================================
-*/
-INT	Set_ATE_SA_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	PSTRING				value;
-	INT					i;
-
-	// Mac address acceptable format 01:02:03:04:05:06 length 17
-	if (strlen(arg) != 17)
-		return FALSE;
-
-    for (i=0, value = rstrtok(arg, ":"); value; value = rstrtok(NULL, ":"))
-	{
-		/* sanity check */
-		if ((strlen(value) != 2) || (!isxdigit(*value)) || (!isxdigit(*(value+1))))
-		{
-			return FALSE;
-		}
-
-#ifdef CONFIG_STA_SUPPORT
-		AtoH(value, &pAd->ate.Addr2[i++], 1);
-#endif // CONFIG_STA_SUPPORT //
-	}
-
-	/* sanity check */
-	if (i != 6)
-	{
-		return FALSE;
-	}
-
-#ifdef CONFIG_STA_SUPPORT
-	ATEDBGPRINT(RT_DEBUG_TRACE, ("Set_ATE_SA_Proc (SA = %2X:%2X:%2X:%2X:%2X:%2X)\n", pAd->ate.Addr2[0],
-		pAd->ate.Addr2[1], pAd->ate.Addr2[2], pAd->ate.Addr2[3], pAd->ate.Addr2[4], pAd->ate.Addr2[5]));
-#endif // CONFIG_STA_SUPPORT //
-
-	ATEDBGPRINT(RT_DEBUG_TRACE, ("Ralink: Set_ATE_SA_Proc Success\n"));
-
-	return TRUE;
-}
-
-
-/*
-==========================================================================
-    Description:
-        Set ATE ADDR2=BSSID for TxFrame(AP  : To DS = 0 ; From DS = 1)
-        or
-        Set ATE ADDR1=BSSID for TxFrame(STA : To DS = 1 ; From DS = 0)
-
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-==========================================================================
-*/
-INT	Set_ATE_BSSID_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	PSTRING				value;
-	INT					i;
-
-	// Mac address acceptable format 01:02:03:04:05:06 length 17
-	if (strlen(arg) != 17)
-		return FALSE;
-
-    for (i=0, value = rstrtok(arg, ":"); value; value = rstrtok(NULL, ":"))
-	{
-		/* sanity check */
-		if ((strlen(value) != 2) || (!isxdigit(*value)) || (!isxdigit(*(value+1))))
-		{
-			return FALSE;
-		}
-
-#ifdef CONFIG_STA_SUPPORT
-		AtoH(value, &pAd->ate.Addr1[i++], 1);
-#endif // CONFIG_STA_SUPPORT //
-	}
-
-	/* sanity check */
-	if(i != 6)
-	{
-		return FALSE;
-	}
-
-#ifdef CONFIG_STA_SUPPORT
-	ATEDBGPRINT(RT_DEBUG_TRACE, ("Set_ATE_BSSID_Proc (BSSID = %2X:%2X:%2X:%2X:%2X:%2X)\n",	pAd->ate.Addr1[0],
-		pAd->ate.Addr1[1], pAd->ate.Addr1[2], pAd->ate.Addr1[3], pAd->ate.Addr1[4], pAd->ate.Addr1[5]));
-#endif // CONFIG_STA_SUPPORT //
-
-	ATEDBGPRINT(RT_DEBUG_TRACE, ("Ralink: Set_ATE_BSSID_Proc Success\n"));
-
-	return TRUE;
-}
-
-
-/*
-==========================================================================
-    Description:
-        Set ATE Tx Channel
-
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-==========================================================================
-*/
-INT	Set_ATE_CHANNEL_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	UCHAR channel;
-
-	channel = simple_strtol(arg, 0, 10);
-
-	// to allow A band channel : ((channel < 1) || (channel > 14))
-	if ((channel < 1) || (channel > 216))
-	{
-		ATEDBGPRINT(RT_DEBUG_ERROR, ("Set_ATE_CHANNEL_Proc::Out of range, it should be in range of 1~14.\n"));
-		return FALSE;
-	}
-	pAd->ate.Channel = channel;
-
-	ATEDBGPRINT(RT_DEBUG_TRACE, ("Set_ATE_CHANNEL_Proc (ATE Channel = %d)\n", pAd->ate.Channel));
-	ATEDBGPRINT(RT_DEBUG_TRACE, ("Ralink: Set_ATE_CHANNEL_Proc Success\n"));
-
-
-	return TRUE;
-}
-
-
-/*
-==========================================================================
-    Description:
-        Set ATE Tx Power0
-
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-==========================================================================
-*/
-INT	Set_ATE_TX_POWER0_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	CHAR TxPower;
-
-	TxPower = simple_strtol(arg, 0, 10);
-
-	if (pAd->ate.Channel <= 14)
-	{
-		if ((TxPower > 31) || (TxPower < 0))
-		{
-			ATEDBGPRINT(RT_DEBUG_ERROR, ("Set_ATE_TX_POWER0_Proc::Out of range (Value=%d)\n", TxPower));
-			return FALSE;
-		}
-	}
-	else/* 5.5 GHz */
-	{
-		if ((TxPower > 15) || (TxPower < -7))
-		{
-			ATEDBGPRINT(RT_DEBUG_ERROR, ("Set_ATE_TX_POWER0_Proc::Out of range (Value=%d)\n", TxPower));
-			return FALSE;
-		}
-	}
-
-	pAd->ate.TxPower0 = TxPower;
-	ATETxPwrHandler(pAd, 0);
-	ATEDBGPRINT(RT_DEBUG_TRACE, ("Ralink: Set_ATE_TX_POWER0_Proc Success\n"));
-
-
-	return TRUE;
-}
-
-
-/*
-==========================================================================
-    Description:
-        Set ATE Tx Power1
-
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-==========================================================================
-*/
-INT	Set_ATE_TX_POWER1_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	CHAR TxPower;
-
-	TxPower = simple_strtol(arg, 0, 10);
-
-	if (pAd->ate.Channel <= 14)
-	{
-		if ((TxPower > 31) || (TxPower < 0))
-		{
-			ATEDBGPRINT(RT_DEBUG_ERROR, ("Set_ATE_TX_POWER1_Proc::Out of range (Value=%d)\n", TxPower));
-			return FALSE;
-		}
-	}
-	else
-	{
-		if ((TxPower > 15) || (TxPower < -7))
-		{
-			ATEDBGPRINT(RT_DEBUG_ERROR, ("Set_ATE_TX_POWER1_Proc::Out of range (Value=%d)\n", TxPower));
-			return FALSE;
-		}
-	}
-
-	pAd->ate.TxPower1 = TxPower;
-	ATETxPwrHandler(pAd, 1);
-	ATEDBGPRINT(RT_DEBUG_TRACE, ("Ralink: Set_ATE_TX_POWER1_Proc Success\n"));
-
-
-	return TRUE;
-}
-
-
-/*
-==========================================================================
-    Description:
-        Set ATE Tx Antenna
-
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-==========================================================================
-*/
-INT	Set_ATE_TX_Antenna_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	CHAR value;
-
-	value = simple_strtol(arg, 0, 10);
-
-	if ((value > 2) || (value < 0))
-	{
-		ATEDBGPRINT(RT_DEBUG_ERROR, ("Set_ATE_TX_Antenna_Proc::Out of range (Value=%d)\n", value));
-		return FALSE;
-	}
-
-	pAd->ate.TxAntennaSel = value;
-
-	ATEDBGPRINT(RT_DEBUG_TRACE, ("Set_ATE_TX_Antenna_Proc (Antenna = %d)\n", pAd->ate.TxAntennaSel));
-	ATEDBGPRINT(RT_DEBUG_TRACE,("Ralink: Set_ATE_TX_Antenna_Proc Success\n"));
-
-	// calibration power unbalance issues, merged from Arch Team
-	ATEAsicSwitchChannel(pAd);
-
-
-	return TRUE;
-}
-
-
-/*
-==========================================================================
-    Description:
-        Set ATE Rx Antenna
-
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-==========================================================================
-*/
-INT	Set_ATE_RX_Antenna_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	CHAR value;
-
-	value = simple_strtol(arg, 0, 10);
-
-	if ((value > 3) || (value < 0))
-	{
-		ATEDBGPRINT(RT_DEBUG_ERROR, ("Set_ATE_RX_Antenna_Proc::Out of range (Value=%d)\n", value));
-		return FALSE;
-	}
-
-	pAd->ate.RxAntennaSel = value;
-
-	ATEDBGPRINT(RT_DEBUG_TRACE, ("Set_ATE_RX_Antenna_Proc (Antenna = %d)\n", pAd->ate.RxAntennaSel));
-	ATEDBGPRINT(RT_DEBUG_TRACE, ("Ralink: Set_ATE_RX_Antenna_Proc Success\n"));
-
-	// calibration power unbalance issues, merged from Arch Team
-	ATEAsicSwitchChannel(pAd);
-
-
-	return TRUE;
-}
-
-
-/*
-==========================================================================
-    Description:
-        Set ATE RF frequence offset
-
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-==========================================================================
-*/
-INT	Set_ATE_TX_FREQOFFSET_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	UCHAR RFFreqOffset = 0;
-	ULONG R4 = 0;
-
-	RFFreqOffset = simple_strtol(arg, 0, 10);
-#ifndef RTMP_RF_RW_SUPPORT
-	if (RFFreqOffset >= 64)
-#endif // RTMP_RF_RW_SUPPORT //
-	/* RT35xx ATE will reuse this code segment. */
-#ifdef RTMP_RF_RW_SUPPORT
-//2008/08/06: KH modified the limit of offset value from 65 to 95(0x5F)
-	if (RFFreqOffset >= 95)
-#endif // RTMP_RF_RW_SUPPORT //
-	{
-		ATEDBGPRINT(RT_DEBUG_ERROR, ("Set_ATE_TX_FREQOFFSET_Proc::Out of range, it should be in range of 0~63.\n"));
-		return FALSE;
-	}
-
-	pAd->ate.RFFreqOffset = RFFreqOffset;
-#ifdef RTMP_RF_RW_SUPPORT
-	if (IS_RT30xx(pAd) || IS_RT3572(pAd))
-	{
-		// Set RF offset
-		UCHAR RFValue;
-		ATE_RF_IO_READ8_BY_REG_ID(pAd, RF_R23, (PUCHAR)&RFValue);
-//2008/08/06: KH modified "pAd->RFFreqOffset" to "pAd->ate.RFFreqOffset"
-		RFValue = ((RFValue & 0x80) | pAd->ate.RFFreqOffset);
-		ATE_RF_IO_WRITE8_BY_REG_ID(pAd, RF_R23, (UCHAR)RFValue);
-	}
-	else
-#endif // RTMP_RF_RW_SUPPORT //
-	{
-		// RT28xx
-		// shift TX power control to correct RF register bit position
-		R4 = pAd->ate.RFFreqOffset << 15;
-		R4 |= (pAd->LatchRfRegs.R4 & ((~0x001f8000)));
-		pAd->LatchRfRegs.R4 = R4;
-
-		RtmpRfIoWrite(pAd);
-	}
-	ATEDBGPRINT(RT_DEBUG_TRACE, ("Set_ATE_TX_FREQOFFSET_Proc (RFFreqOffset = %d)\n", pAd->ate.RFFreqOffset));
-	ATEDBGPRINT(RT_DEBUG_TRACE, ("Ralink: Set_ATE_TX_FREQOFFSET_Proc Success\n"));
-
-
-	return TRUE;
-}
-
-
-/*
-==========================================================================
-    Description:
-        Set ATE RF BW
-
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-==========================================================================
-*/
-INT	Set_ATE_TX_BW_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	INT i;
-	UCHAR value = 0;
-	UCHAR BBPCurrentBW;
-
-	BBPCurrentBW = simple_strtol(arg, 0, 10);
-
-	if ((BBPCurrentBW == 0)
-#ifdef RT30xx
-		|| IS_RT2070(pAd)
-#endif // RT30xx //
-		)
-	{
-		pAd->ate.TxWI.BW = BW_20;
-	}
-	else
-	{
-		pAd->ate.TxWI.BW = BW_40;
-	}
-
-	/* RT35xx ATE will reuse this code segment. */
-	// Fix the error spectrum of CCK-40MHZ
-	// Turn on BBP 20MHz mode by request here.
-	if ((pAd->ate.TxWI.PHYMODE == MODE_CCK) && (pAd->ate.TxWI.BW == BW_40))
-	{
-		ATEDBGPRINT(RT_DEBUG_ERROR, ("Set_ATE_TX_BW_Proc!! Warning!! CCK only supports 20MHZ!!\nBandwidth switch to 20\n"));
-		pAd->ate.TxWI.BW = BW_20;
-	}
-
-	if (pAd->ate.TxWI.BW == BW_20)
-	{
-		if (pAd->ate.Channel <= 14)
-		{
-			for (i=0; i<5; i++)
-			{
-				if (pAd->Tx20MPwrCfgGBand[i] != 0xffffffff)
-				{
-					RTMP_IO_WRITE32(pAd, TX_PWR_CFG_0 + i*4, pAd->Tx20MPwrCfgGBand[i]);
-					RTMPusecDelay(5000);
-				}
-			}
-		}
-		else
-		{
-			for (i=0; i<5; i++)
-			{
-				if (pAd->Tx20MPwrCfgABand[i] != 0xffffffff)
-				{
-					RTMP_IO_WRITE32(pAd, TX_PWR_CFG_0 + i*4, pAd->Tx20MPwrCfgABand[i]);
-					RTMPusecDelay(5000);
-				}
-			}
-		}
-
-		// Set BBP R4 bit[4:3]=0:0
-		ATE_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R4, &value);
-		value &= (~0x18);
-		ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R4, value);
-
-
-		// Set BBP R66=0x3C
-		value = 0x3C;
-		ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R66, value);
-
-		// Set BBP R68=0x0B
-		// to improve Rx sensitivity.
-		value = 0x0B;
-		ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R68, value);
-		// Set BBP R69=0x16
-		value = 0x16;
-		ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R69, value);
-		// Set BBP R70=0x08
-		value = 0x08;
-		ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R70, value);
-		// Set BBP R73=0x11
-		value = 0x11;
-		ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R73, value);
-
-	    /*
-			If Channel=14, Bandwidth=20M and Mode=CCK, Set BBP R4 bit5=1
-			(to set Japan filter coefficients).
-			This segment of code will only works when ATETXMODE and ATECHANNEL
-			were set to MODE_CCK and 14 respectively before ATETXBW is set to 0.
-	    */
-		if (pAd->ate.Channel == 14)
-		{
-			INT TxMode = pAd->ate.TxWI.PHYMODE;
-
-			if (TxMode == MODE_CCK)
-			{
-				// when Channel==14 && Mode==CCK && BandWidth==20M, BBP R4 bit5=1
-				ATE_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R4, &value);
-				value |= 0x20; //set bit5=1
-				ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R4, value);
-			}
-		}
-
-#ifdef RT30xx
-		// set BW = 20 MHz
-		if (IS_RT30xx(pAd))
-			ATE_RF_IO_WRITE8_BY_REG_ID(pAd, RF_R24, (UCHAR) pAd->Mlme.CaliBW20RfR24);
-		else
-#endif // RT30xx //
-		// set BW = 20 MHz
-		{
-			pAd->LatchRfRegs.R4 &= ~0x00200000;
-			RtmpRfIoWrite(pAd);
-		}
-
-	}
-	// If bandwidth = 40M, set RF Reg4 bit 21 = 0.
-	else if (pAd->ate.TxWI.BW == BW_40)
-	{
-		if (pAd->ate.Channel <= 14)
-		{
-			for (i=0; i<5; i++)
-			{
-				if (pAd->Tx40MPwrCfgGBand[i] != 0xffffffff)
-				{
-					RTMP_IO_WRITE32(pAd, TX_PWR_CFG_0 + i*4, pAd->Tx40MPwrCfgGBand[i]);
-					RTMPusecDelay(5000);
-				}
-			}
-		}
-		else
-		{
-			for (i=0; i<5; i++)
-			{
-				if (pAd->Tx40MPwrCfgABand[i] != 0xffffffff)
-				{
-					RTMP_IO_WRITE32(pAd, TX_PWR_CFG_0 + i*4, pAd->Tx40MPwrCfgABand[i]);
-					RTMPusecDelay(5000);
-				}
-			}
-#ifdef DOT11_N_SUPPORT
-			if ((pAd->ate.TxWI.PHYMODE >= MODE_HTMIX) && (pAd->ate.TxWI.MCS == 7))
-			{
-			value = 0x28;
-			ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R67, value);
-			}
-#endif // DOT11_N_SUPPORT //
-		}
-
-		// Set BBP R4 bit[4:3]=1:0
-		ATE_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R4, &value);
-		value &= (~0x18);
-		value |= 0x10;
-		ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R4, value);
-
-
-		// Set BBP R66=0x3C
-		value = 0x3C;
-		ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R66, value);
-
-		// Set BBP R68=0x0C
-		// to improve Rx sensitivity
-		value = 0x0C;
-		ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R68, value);
-		// Set BBP R69=0x1A
-		value = 0x1A;
-		ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R69, value);
-		// Set BBP R70=0x0A
-		value = 0x0A;
-		ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R70, value);
-		// Set BBP R73=0x16
-		value = 0x16;
-		ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R73, value);
-
-		// If bandwidth = 40M, set RF Reg4 bit 21 = 1.
-#ifdef RT30xx
-		// set BW = 40 MHz
-		if(IS_RT30xx(pAd))
-			ATE_RF_IO_WRITE8_BY_REG_ID(pAd, RF_R24, (UCHAR) pAd->Mlme.CaliBW40RfR24);
-		else
-#endif // RT30xx //
-		// set BW = 40 MHz
-		{
-		pAd->LatchRfRegs.R4 |= 0x00200000;
-		RtmpRfIoWrite(pAd);
-		}
-	}
-
-	ATEDBGPRINT(RT_DEBUG_TRACE, ("Set_ATE_TX_BW_Proc (BBPCurrentBW = %d)\n", pAd->ate.TxWI.BW));
-	ATEDBGPRINT(RT_DEBUG_TRACE, ("Ralink: Set_ATE_TX_BW_Proc Success\n"));
-
-
-	return TRUE;
-}
-
-
-/*
-==========================================================================
-    Description:
-        Set ATE Tx frame length
-
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-==========================================================================
-*/
-INT	Set_ATE_TX_LENGTH_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	pAd->ate.TxLength = simple_strtol(arg, 0, 10);
-
-	if ((pAd->ate.TxLength < 24) || (pAd->ate.TxLength > (MAX_FRAME_SIZE - 34/* == 2312 */)))
-	{
-		pAd->ate.TxLength = (MAX_FRAME_SIZE - 34/* == 2312 */);
-		ATEDBGPRINT(RT_DEBUG_ERROR, ("Set_ATE_TX_LENGTH_Proc::Out of range, it should be in range of 24~%d.\n", (MAX_FRAME_SIZE - 34/* == 2312 */)));
-		return FALSE;
-	}
-
-	ATEDBGPRINT(RT_DEBUG_TRACE, ("Set_ATE_TX_LENGTH_Proc (TxLength = %d)\n", pAd->ate.TxLength));
-	ATEDBGPRINT(RT_DEBUG_TRACE, ("Ralink: Set_ATE_TX_LENGTH_Proc Success\n"));
-
-
-	return TRUE;
-}
-
-
-/*
-==========================================================================
-    Description:
-        Set ATE Tx frame count
-
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-==========================================================================
-*/
-INT	Set_ATE_TX_COUNT_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	pAd->ate.TxCount = simple_strtol(arg, 0, 10);
-
-	ATEDBGPRINT(RT_DEBUG_TRACE, ("Set_ATE_TX_COUNT_Proc (TxCount = %d)\n", pAd->ate.TxCount));
-	ATEDBGPRINT(RT_DEBUG_TRACE, ("Ralink: Set_ATE_TX_COUNT_Proc Success\n"));
-
-
-	return TRUE;
-}
-
-
-/*
-==========================================================================
-    Description:
-        Set ATE Tx frame MCS
-
-        Return:
-		TRUE if all parameters are OK, FALSE otherwise
-==========================================================================
-*/
-INT	Set_ATE_TX_MCS_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	UCHAR MCS;
-	INT result;
-
-	MCS = simple_strtol(arg, 0, 10);
-#ifndef RT30xx
-	result = CheckMCSValid(pAd->ate.TxWI.PHYMODE, MCS);
-#endif // RT30xx //
-
-	/* RT35xx ATE will reuse this code segment. */
-#ifdef RT30xx
-	result = CheckMCSValid(pAd->ate.TxWI.PHYMODE, MCS, IS_RT2070(pAd));
-#endif // RT30xx //
-
-
-	if (result != -1)
-	{
-		pAd->ate.TxWI.MCS = (UCHAR)MCS;
-	}
-	else
-	{
-		ATEDBGPRINT(RT_DEBUG_ERROR, ("Set_ATE_TX_MCS_Proc::Out of range, refer to rate table.\n"));
-		return FALSE;
-	}
-
-	ATEDBGPRINT(RT_DEBUG_TRACE, ("Set_ATE_TX_MCS_Proc (MCS = %d)\n", pAd->ate.TxWI.MCS));
-	ATEDBGPRINT(RT_DEBUG_TRACE, ("Ralink: Set_ATE_TX_MCS_Proc Success\n"));
-
-
-	return TRUE;
-}
-
-
-/*
-==========================================================================
-    Description:
-        Set ATE Tx frame Mode
-        0: MODE_CCK
-        1: MODE_OFDM
-        2: MODE_HTMIX
-        3: MODE_HTGREENFIELD
-
-        Return:
-		TRUE if all parameters are OK, FALSE otherwise
-==========================================================================
-*/
-INT	Set_ATE_TX_MODE_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	UCHAR BbpData = 0;
-
-	pAd->ate.TxWI.PHYMODE = simple_strtol(arg, 0, 10);
-
-	if (pAd->ate.TxWI.PHYMODE > 3)
-	{
-		pAd->ate.TxWI.PHYMODE = 0;
-		ATEDBGPRINT(RT_DEBUG_ERROR, ("Set_ATE_TX_MODE_Proc::Out of range.\nIt should be in range of 0~3\n"));
-		ATEDBGPRINT(RT_DEBUG_ERROR, ("0: CCK, 1: OFDM, 2: HT_MIX, 3: HT_GREEN_FIELD.\n"));
-		return FALSE;
-	}
-
-	// Turn on BBP 20MHz mode by request here.
-	if (pAd->ate.TxWI.PHYMODE == MODE_CCK)
-	{
-		ATE_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R4, &BbpData);
-		BbpData &= (~0x18);
-		ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R4, BbpData);
-		pAd->ate.TxWI.BW = BW_20;
-		ATEDBGPRINT(RT_DEBUG_ERROR, ("Set_ATE_TX_MODE_Proc::CCK Only support 20MHZ. Switch to 20MHZ.\n"));
-	}
-
-	ATEDBGPRINT(RT_DEBUG_TRACE, ("Set_ATE_TX_MODE_Proc (TxMode = %d)\n", pAd->ate.TxWI.PHYMODE));
-	ATEDBGPRINT(RT_DEBUG_TRACE, ("Ralink: Set_ATE_TX_MODE_Proc Success\n"));
-
-
-	return TRUE;
-}
-
-
-/*
-==========================================================================
-    Description:
-        Set ATE Tx frame GI
-
-        Return:
-		TRUE if all parameters are OK, FALSE otherwise
-==========================================================================
-*/
-INT	Set_ATE_TX_GI_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	pAd->ate.TxWI.ShortGI = simple_strtol(arg, 0, 10);
-
-	if (pAd->ate.TxWI.ShortGI > 1)
-	{
-		pAd->ate.TxWI.ShortGI = 0;
-		ATEDBGPRINT(RT_DEBUG_ERROR, ("Set_ATE_TX_GI_Proc::Out of range\n"));
-		return FALSE;
-	}
-
-	ATEDBGPRINT(RT_DEBUG_TRACE, ("Set_ATE_TX_GI_Proc (GI = %d)\n", pAd->ate.TxWI.ShortGI));
-	ATEDBGPRINT(RT_DEBUG_TRACE, ("Ralink: Set_ATE_TX_GI_Proc Success\n"));
-
-
-	return TRUE;
-}
-
-
-INT	Set_ATE_RX_FER_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	pAd->ate.bRxFER = simple_strtol(arg, 0, 10);
-
-	if (pAd->ate.bRxFER == 1)
-	{
-		pAd->ate.RxCntPerSec = 0;
-		pAd->ate.RxTotalCnt = 0;
-	}
-
-	ATEDBGPRINT(RT_DEBUG_TRACE, ("Set_ATE_RX_FER_Proc (bRxFER = %d)\n", pAd->ate.bRxFER));
-	ATEDBGPRINT(RT_DEBUG_TRACE, ("Ralink: Set_ATE_RX_FER_Proc Success\n"));
-
-
-	return TRUE;
-}
-
-
-INT Set_ATE_Read_RF_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-#ifdef RTMP_RF_RW_SUPPORT
-//2008/07/10:KH add to support RT30xx ATE<--
-	if (IS_RT30xx(pAd) || IS_RT3572(pAd))
-	{
-		/* modify by WY for Read RF Reg. error */
-		UCHAR RFValue;
-		INT index=0;
-
-		for (index = 0; index < 32; index++)
-		{
-			ATE_RF_IO_READ8_BY_REG_ID(pAd, index, (PUCHAR)&RFValue);
-			ate_print("R%d=%d\n",index,RFValue);
-		}
-	}
-	else
-//2008/07/10:KH add to support RT30xx ATE-->
-#endif // RTMP_RF_RW_SUPPORT //
-	{
-		ate_print(KERN_EMERG "R1 = %lx\n", pAd->LatchRfRegs.R1);
-		ate_print(KERN_EMERG "R2 = %lx\n", pAd->LatchRfRegs.R2);
-		ate_print(KERN_EMERG "R3 = %lx\n", pAd->LatchRfRegs.R3);
-		ate_print(KERN_EMERG "R4 = %lx\n", pAd->LatchRfRegs.R4);
-	}
-	return TRUE;
-}
-
-
-INT Set_ATE_Write_RF1_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	UINT32 value = (UINT32) simple_strtol(arg, 0, 16);
-
-#ifdef RTMP_RF_RW_SUPPORT
-//2008/07/10:KH add to support 3070 ATE<--
-	if (IS_RT30xx(pAd) || IS_RT3572(pAd))
-	{
-		ate_print("Warning!! RT3xxx Don't Support !\n");
-		return FALSE;
-
-	}
-	else
-//2008/07/10:KH add to support 3070 ATE-->
-#endif // RTMP_RF_RW_SUPPORT //
-	{
-		pAd->LatchRfRegs.R1 = value;
-		RtmpRfIoWrite(pAd);
-	}
-	return TRUE;
-}
-
-
-INT Set_ATE_Write_RF2_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	UINT32 value = (UINT32) simple_strtol(arg, 0, 16);
-
-#ifdef RTMP_RF_RW_SUPPORT
-//2008/07/10:KH add to support 3070 ATE<--
-	if (IS_RT30xx(pAd) || IS_RT3572(pAd))
-	{
-		ate_print("Warning!! RT3xxx Don't Support !\n");
-		return FALSE;
-
-	}
-	else
-//2008/07/10:KH add to support 3070 ATE-->
-#endif // RTMP_RF_RW_SUPPORT //
-	{
-		pAd->LatchRfRegs.R2 = value;
-		RtmpRfIoWrite(pAd);
-	}
-	return TRUE;
-}
-
-
-INT Set_ATE_Write_RF3_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	UINT32 value = simple_strtol(arg, 0, 16);
-
-#ifdef RTMP_RF_RW_SUPPORT
-//2008/07/10:KH add to support 3070 ATE<--
-	if (IS_RT30xx(pAd) || IS_RT3572(pAd))
-	{
-		ate_print("Warning!! RT3xxx Don't Support !\n");
-		return FALSE;
-
-	}
-	else
-//2008/07/10:KH add to support 3070 ATE-->
-#endif // RTMP_RF_RW_SUPPORT //
-	{
-		pAd->LatchRfRegs.R3 = value;
-		RtmpRfIoWrite(pAd);
-	}
-	return TRUE;
-}
-
-
-INT Set_ATE_Write_RF4_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	UINT32 value = (UINT32) simple_strtol(arg, 0, 16);
-
-#ifdef RTMP_RF_RW_SUPPORT
-//2008/07/10:KH add to support 3070 ATE<--
-	if (IS_RT30xx(pAd) || IS_RT3572(pAd))
-	{
-		ate_print("Warning!! RT3xxx Don't Support !\n");
-		return FALSE;
-
-	}
-	else
-//2008/07/10:KH add to support 3070 ATE-->
-#endif // RTMP_RF_RW_SUPPORT //
-	{
-		pAd->LatchRfRegs.R4 = value;
-		RtmpRfIoWrite(pAd);
-	}
-	return TRUE;
-}
-
-
-/*
-==========================================================================
-    Description:
-        Load and Write EEPROM from a binary file prepared in advance.
-
-        Return:
-		TRUE if all parameters are OK, FALSE otherwise
-==========================================================================
-*/
-#if defined(LINUX) || defined(VXWORKS)
-INT Set_ATE_Load_E2P_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	BOOLEAN			ret = FALSE;
-	PSTRING			src = EEPROM_BIN_FILE_NAME;
-	RTMP_OS_FD		srcf;
-	INT32			retval;
-	USHORT			WriteEEPROM[(EEPROM_SIZE/2)];
-	INT				FileLength = 0;
-	UINT32			value = (UINT32) simple_strtol(arg, 0, 10);
-	RTMP_OS_FS_INFO	osFSInfo;
-
-	ATEDBGPRINT(RT_DEBUG_ERROR, ("===> %s (value=%d)\n\n", __FUNCTION__, value));
-
-	if (value > 0)
-	{
-		/* zero the e2p buffer */
-		NdisZeroMemory((PUCHAR)WriteEEPROM, EEPROM_SIZE);
-
-		RtmpOSFSInfoChange(&osFSInfo, TRUE);
-
-		do
-		{
-			/* open the bin file */
-			srcf = RtmpOSFileOpen(src, O_RDONLY, 0);
-
-			if (IS_FILE_OPEN_ERR(srcf))
-			{
-				ate_print("%s - Error opening file %s\n", __FUNCTION__, src);
-				break;
-			}
-
-			/* read the firmware from the file *.bin */
-			FileLength = RtmpOSFileRead(srcf, (PSTRING)WriteEEPROM, EEPROM_SIZE);
-
-			if (FileLength != EEPROM_SIZE)
-			{
-				ate_print("%s: error file length (=%d) in e2p.bin\n",
-					   __FUNCTION__, FileLength);
-				break;
-			}
-			else
-			{
-				/* write the content of .bin file to EEPROM */
-				rt_ee_write_all(pAd, WriteEEPROM);
-				ret = TRUE;
-			}
-			break;
-		} while(TRUE);
-
-		/* close firmware file */
-		if (IS_FILE_OPEN_ERR(srcf))
-		{
-				;
-		}
-		else
-		{
-			retval = RtmpOSFileClose(srcf);
-
-			if (retval)
-			{
-				ATEDBGPRINT(RT_DEBUG_ERROR, ("--> Error %d closing %s\n", -retval, src));
-
-			}
-		}
-
-		/* restore */
-		RtmpOSFSInfoChange(&osFSInfo, FALSE);
-	}
-
-    ATEDBGPRINT(RT_DEBUG_ERROR, ("<=== %s (ret=%d)\n", __FUNCTION__, ret));
-
-    return ret;
-
-}
-#endif // defined(LINUX) || defined(VXWORKS) //
-
-
-
-
-INT Set_ATE_Read_E2P_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	USHORT buffer[EEPROM_SIZE/2];
-	USHORT *p;
-	int i;
-
-	rt_ee_read_all(pAd, (USHORT *)buffer);
-	p = buffer;
-	for (i = 0; i < (EEPROM_SIZE/2); i++)
-	{
-		ate_print("%4.4x ", *p);
-		if (((i+1) % 16) == 0)
-			ate_print("\n");
-		p++;
-	}
-	return TRUE;
-}
-
-
-
-
-INT	Set_ATE_Show_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	ate_print("Mode=%d\n", pAd->ate.Mode);
-	ate_print("TxPower0=%d\n", pAd->ate.TxPower0);
-	ate_print("TxPower1=%d\n", pAd->ate.TxPower1);
-	ate_print("TxAntennaSel=%d\n", pAd->ate.TxAntennaSel);
-	ate_print("RxAntennaSel=%d\n", pAd->ate.RxAntennaSel);
-	ate_print("BBPCurrentBW=%d\n", pAd->ate.TxWI.BW);
-	ate_print("GI=%d\n", pAd->ate.TxWI.ShortGI);
-	ate_print("MCS=%d\n", pAd->ate.TxWI.MCS);
-	ate_print("TxMode=%d\n", pAd->ate.TxWI.PHYMODE);
-	ate_print("Addr1=%02x:%02x:%02x:%02x:%02x:%02x\n",
-		pAd->ate.Addr1[0], pAd->ate.Addr1[1], pAd->ate.Addr1[2], pAd->ate.Addr1[3], pAd->ate.Addr1[4], pAd->ate.Addr1[5]);
-	ate_print("Addr2=%02x:%02x:%02x:%02x:%02x:%02x\n",
-		pAd->ate.Addr2[0], pAd->ate.Addr2[1], pAd->ate.Addr2[2], pAd->ate.Addr2[3], pAd->ate.Addr2[4], pAd->ate.Addr2[5]);
-	ate_print("Addr3=%02x:%02x:%02x:%02x:%02x:%02x\n",
-		pAd->ate.Addr3[0], pAd->ate.Addr3[1], pAd->ate.Addr3[2], pAd->ate.Addr3[3], pAd->ate.Addr3[4], pAd->ate.Addr3[5]);
-	ate_print("Channel=%d\n", pAd->ate.Channel);
-	ate_print("TxLength=%d\n", pAd->ate.TxLength);
-	ate_print("TxCount=%u\n", pAd->ate.TxCount);
-	ate_print("RFFreqOffset=%d\n", pAd->ate.RFFreqOffset);
-	ate_print(KERN_EMERG "Set_ATE_Show_Proc Success\n");
-	return TRUE;
-}
-
-
-INT	Set_ATE_Help_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	ate_print("ATE=ATESTART, ATESTOP, TXCONT, TXCARR, TXFRAME, RXFRAME\n");
-	ate_print("ATEDA\n");
-	ate_print("ATESA\n");
-	ate_print("ATEBSSID\n");
-	ate_print("ATECHANNEL, range:0~14(unless A band !)\n");
-	ate_print("ATETXPOW0, set power level of antenna 1.\n");
-	ate_print("ATETXPOW1, set power level of antenna 2.\n");
-	ate_print("ATETXANT, set TX antenna. 0:all, 1:antenna one, 2:antenna two.\n");
-	ate_print("ATERXANT, set RX antenna.0:all, 1:antenna one, 2:antenna two, 3:antenna three.\n");
-	ate_print("ATETXFREQOFFSET, set frequency offset, range 0~63\n");
-	ate_print("ATETXBW, set BandWidth, 0:20MHz, 1:40MHz.\n");
-	ate_print("ATETXLEN, set Frame length, range 24~%d\n", (MAX_FRAME_SIZE - 34/* == 2312 */));
-	ate_print("ATETXCNT, set how many frame going to transmit.\n");
-	ate_print("ATETXMCS, set MCS, reference to rate table.\n");
-	ate_print("ATETXMODE, set Mode 0:CCK, 1:OFDM, 2:HT-Mix, 3:GreenField, reference to rate table.\n");
-	ate_print("ATETXGI, set GI interval, 0:Long, 1:Short\n");
-	ate_print("ATERXFER, 0:disable Rx Frame error rate. 1:enable Rx Frame error rate.\n");
-	ate_print("ATERRF, show all RF registers.\n");
-	ate_print("ATEWRF1, set RF1 register.\n");
-	ate_print("ATEWRF2, set RF2 register.\n");
-	ate_print("ATEWRF3, set RF3 register.\n");
-	ate_print("ATEWRF4, set RF4 register.\n");
-	ate_print("ATELDE2P, load EEPROM from .bin file.\n");
-	ate_print("ATERE2P, display all EEPROM content.\n");
-	ate_print("ATESHOW, display all parameters of ATE.\n");
-	ate_print("ATEHELP, online help.\n");
-
-	return TRUE;
-}
-
-
-
-
-/*
-==========================================================================
-    Description:
-
-	AsicSwitchChannel() dedicated for ATE.
-
-==========================================================================
-*/
-VOID ATEAsicSwitchChannel(
-    IN PRTMP_ADAPTER pAd)
-{
-	UINT32 R2 = 0, R3 = DEFAULT_RF_TX_POWER, R4 = 0, Value = 0;
-	CHAR TxPwer = 0, TxPwer2 = 0;
-	UCHAR index = 0, BbpValue = 0, R66 = 0x30;
-	RTMP_RF_REGS *RFRegTable;
-	UCHAR Channel = 0;
-
-	RFRegTable = NULL;
-
-#ifdef RALINK_28xx_QA
-	// for QA mode, TX power values are passed from UI
-	if ((pAd->ate.bQATxStart == TRUE) || (pAd->ate.bQARxStart == TRUE))
-	{
-		if (pAd->ate.Channel != pAd->LatchRfRegs.Channel)
-		{
-			pAd->ate.Channel = pAd->LatchRfRegs.Channel;
-		}
-		return;
-	}
-	else
-#endif // RALINK_28xx_QA //
-	Channel = pAd->ate.Channel;
-
-	// select antenna for RT3090
-	AsicAntennaSelect(pAd, Channel);
-
-	// fill Tx power value
-	TxPwer = pAd->ate.TxPower0;
-	TxPwer2 = pAd->ate.TxPower1;
-#ifdef RT30xx
-//2008/07/10:KH add to support 3070 ATE<--
-
-	/*
-		The RF programming sequence is difference between 3xxx and 2xxx.
-		The 3070 is 1T1R. Therefore, we don't need to set the number of Tx/Rx path
-		and the only job is to set the parameters of channels.
-	*/
-	if (IS_RT30xx(pAd) && ((pAd->RfIcType == RFIC_3020) ||
-			(pAd->RfIcType == RFIC_3021) || (pAd->RfIcType == RFIC_3022) ||
-			(pAd->RfIcType == RFIC_2020)))
-	{
-		/* modify by WY for Read RF Reg. error */
-		UCHAR RFValue = 0;
-
-		for (index = 0; index < NUM_OF_3020_CHNL; index++)
-		{
-			if (Channel == FreqItems3020[index].Channel)
-			{
-				// Programming channel parameters.
-				ATE_RF_IO_WRITE8_BY_REG_ID(pAd, RF_R02, FreqItems3020[index].N);
-				ATE_RF_IO_WRITE8_BY_REG_ID(pAd, RF_R03, FreqItems3020[index].K);
-
-				ATE_RF_IO_READ8_BY_REG_ID(pAd, RF_R06, (PUCHAR)&RFValue);
-				RFValue = (RFValue & 0xFC) | FreqItems3020[index].R;
-				ATE_RF_IO_WRITE8_BY_REG_ID(pAd, RF_R06, (UCHAR)RFValue);
-
-				// Set Tx Power.
-				ATE_RF_IO_READ8_BY_REG_ID(pAd, RF_R12, (PUCHAR)&RFValue);
-				RFValue = (RFValue & 0xE0) | TxPwer;
-				ATE_RF_IO_WRITE8_BY_REG_ID(pAd, RF_R12, (UCHAR)RFValue);
-
-				// Set RF offset.
-				ATE_RF_IO_READ8_BY_REG_ID(pAd, RF_R23, (PUCHAR)&RFValue);
-				//2008/08/06: KH modified "pAd->RFFreqOffset" to "pAd->ate.RFFreqOffset"
-				RFValue = (RFValue & 0x80) | pAd->ate.RFFreqOffset;
-				ATE_RF_IO_WRITE8_BY_REG_ID(pAd, RF_R23, (UCHAR)RFValue);
-
-				// Set BW.
-				if (pAd->ate.TxWI.BW == BW_40)
-				{
-					RFValue = pAd->Mlme.CaliBW40RfR24;
-//					DISABLE_11N_CHECK(pAd);
-				}
-				else
-				{
-					RFValue = pAd->Mlme.CaliBW20RfR24;
-				}
-				ATE_RF_IO_WRITE8_BY_REG_ID(pAd, RF_R24, (UCHAR)RFValue);
-
-				// Enable RF tuning
-				ATE_RF_IO_READ8_BY_REG_ID(pAd, RF_R07, (PUCHAR)&RFValue);
-				RFValue = RFValue | 0x1;
-				ATE_RF_IO_WRITE8_BY_REG_ID(pAd, RF_R07, (UCHAR)RFValue);
-
-				// latch channel for future usage
-				pAd->LatchRfRegs.Channel = Channel;
-
-				break;
-			}
-		}
-
-		ATEDBGPRINT(RT_DEBUG_TRACE, ("SwitchChannel#%d(RF=%d, Pwr0=%d, Pwr1=%d, %dT), N=0x%02X, K=0x%02X, R=0x%02X\n",
-			Channel,
-			pAd->RfIcType,
-			TxPwer,
-			TxPwer2,
-			pAd->Antenna.field.TxPath,
-			FreqItems3020[index].N,
-			FreqItems3020[index].K,
-			FreqItems3020[index].R));
-	}
-	else
-//2008/07/10:KH add to support 3070 ATE-->
-#endif // RT30xx //
-	{
-		/* RT28xx */
-		RFRegTable = RF2850RegTable;
-
-		switch (pAd->RfIcType)
-		{
-			/* But only 2850 and 2750 support 5.5GHz band... */
-			case RFIC_2820:
-			case RFIC_2850:
-			case RFIC_2720:
-			case RFIC_2750:
-
-				for (index = 0; index < NUM_OF_2850_CHNL; index++)
-				{
-					if (Channel == RFRegTable[index].Channel)
-					{
-						R2 = RFRegTable[index].R2;
-
-						// If TX path is 1, bit 14 = 1;
-						if (pAd->Antenna.field.TxPath == 1)
-						{
-							R2 |= 0x4000;
-						}
-
-						if (pAd->Antenna.field.RxPath == 2)
-						{
-							switch (pAd->ate.RxAntennaSel)
-							{
-								case 1:
-									R2 |= 0x20040;
-									ATE_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R3, &BbpValue);
-									BbpValue &= 0xE4;
-									BbpValue |= 0x00;
-									ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R3, BbpValue);
-									break;
-								case 2:
-									R2 |= 0x10040;
-									ATE_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R3, &BbpValue);
-									BbpValue &= 0xE4;
-									BbpValue |= 0x01;
-									ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R3, BbpValue);
-									break;
-								default:
-									R2 |= 0x40;
-									ATE_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R3, &BbpValue);
-									BbpValue &= 0xE4;
-									/* Only enable two Antenna to receive. */
-									BbpValue |= 0x08;
-									ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R3, BbpValue);
-									break;
-							}
-						}
-						else if (pAd->Antenna.field.RxPath == 1)
-						{
-							// write 1 to off RxPath
-							R2 |= 0x20040;
-						}
-
-						if (pAd->Antenna.field.TxPath == 2)
-						{
-							if (pAd->ate.TxAntennaSel == 1)
-							{
-								// If TX Antenna select is 1 , bit 14 = 1; Disable Ant 2
-								R2 |= 0x4000;
-								ATE_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R1, &BbpValue);
-								BbpValue &= 0xE7;		// 11100111B
-								ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R1, BbpValue);
-							}
-							else if (pAd->ate.TxAntennaSel == 2)
-							{
-								// If TX Antenna select is 2 , bit 15 = 1; Disable Ant 1
-								R2 |= 0x8000;
-								ATE_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R1, &BbpValue);
-								BbpValue &= 0xE7;
-								BbpValue |= 0x08;
-								ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R1, BbpValue);
-							}
-							else
-							{
-								ATE_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R1, &BbpValue);
-								BbpValue &= 0xE7;
-								BbpValue |= 0x10;
-								ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R1, BbpValue);
-							}
-						}
-						if (pAd->Antenna.field.RxPath == 3)
-						{
-							switch (pAd->ate.RxAntennaSel)
-							{
-								case 1:
-									R2 |= 0x20040;
-									ATE_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R3, &BbpValue);
-									BbpValue &= 0xE4;
-									BbpValue |= 0x00;
-									ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R3, BbpValue);
-									break;
-								case 2:
-									R2 |= 0x10040;
-									ATE_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R3, &BbpValue);
-									BbpValue &= 0xE4;
-									BbpValue |= 0x01;
-									ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R3, BbpValue);
-									break;
-								case 3:
-									R2 |= 0x30000;
-									ATE_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R3, &BbpValue);
-									BbpValue &= 0xE4;
-									BbpValue |= 0x02;
-									ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R3, BbpValue);
-									break;
-								default:
-									ATE_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R3, &BbpValue);
-									BbpValue &= 0xE4;
-									BbpValue |= 0x10;
-									ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R3, BbpValue);
-									break;
-							}
-						}
-
-						if (Channel > 14)
-						{
-							// initialize R3, R4
-							R3 = (RFRegTable[index].R3 & 0xffffc1ff);
-							R4 = (RFRegTable[index].R4 & (~0x001f87c0)) | (pAd->ate.RFFreqOffset << 15);
-
-		                    /*
-			                    According the Rory's suggestion to solve the middle range issue.
-
-								5.5G band power range : 0xF9~0X0F, TX0 Reg3 bit9/TX1 Reg4 bit6="0"
-														means the TX power reduce 7dB.
-							*/
-							// R3
-							if ((TxPwer >= -7) && (TxPwer < 0))
-							{
-								TxPwer = (7+TxPwer);
-								TxPwer = (TxPwer > 0xF) ? (0xF) : (TxPwer);
-								R3 |= (TxPwer << 10);
-								ATEDBGPRINT(RT_DEBUG_TRACE, ("ATEAsicSwitchChannel: TxPwer=%d \n", TxPwer));
-							}
-							else
-							{
-								TxPwer = (TxPwer > 0xF) ? (0xF) : (TxPwer);
-								R3 |= (TxPwer << 10) | (1 << 9);
-							}
-
-							// R4
-							if ((TxPwer2 >= -7) && (TxPwer2 < 0))
-							{
-								TxPwer2 = (7+TxPwer2);
-								TxPwer2 = (TxPwer2 > 0xF) ? (0xF) : (TxPwer2);
-								R4 |= (TxPwer2 << 7);
-								ATEDBGPRINT(RT_DEBUG_TRACE, ("ATEAsicSwitchChannel: TxPwer2=%d \n", TxPwer2));
-							}
-							else
-							{
-								TxPwer2 = (TxPwer2 > 0xF) ? (0xF) : (TxPwer2);
-								R4 |= (TxPwer2 << 7) | (1 << 6);
-							}
-						}
-						else
-						{
-							// Set TX power0.
-							R3 = (RFRegTable[index].R3 & 0xffffc1ff) | (TxPwer << 9);
-							// Set frequency offset and TX power1.
-							R4 = (RFRegTable[index].R4 & (~0x001f87c0)) | (pAd->ate.RFFreqOffset << 15) | (TxPwer2 <<6);
-						}
-
-						// based on BBP current mode before changing RF channel
-						if (pAd->ate.TxWI.BW == BW_40)
-						{
-							R4 |=0x200000;
-						}
-
-						// Update variables.
-						pAd->LatchRfRegs.Channel = Channel;
-						pAd->LatchRfRegs.R1 = RFRegTable[index].R1;
-						pAd->LatchRfRegs.R2 = R2;
-						pAd->LatchRfRegs.R3 = R3;
-						pAd->LatchRfRegs.R4 = R4;
-
-						RtmpRfIoWrite(pAd);
-
-						break;
-					}
-				}
-				break;
-
-			default:
-				break;
-		}
-	}
-
-	// Change BBP setting during switch from a->g, g->a
-	if (Channel <= 14)
-	{
-	    UINT32 TxPinCfg = 0x00050F0A;// 2007.10.09 by Brian : 0x0005050A ==> 0x00050F0A
-
-		ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R62, (0x37 - GET_LNA_GAIN(pAd)));
-		ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R63, (0x37 - GET_LNA_GAIN(pAd)));
-		ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R64, (0x37 - GET_LNA_GAIN(pAd)));
-
-		/* For 1T/2R chip only... */
-	    if (pAd->NicConfig2.field.ExternalLNAForG)
-	    {
-	        ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R82, 0x62);
-	    }
-	    else
-	    {
-	        ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R82, 0x84);
-	    }
-
-        // According the Rory's suggestion to solve the middle range issue.
-		ATE_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R86, &BbpValue);// may be removed for RT35xx ++
-
-		ASSERT((BbpValue == 0x00));
-		if ((BbpValue != 0x00))
-		{
-			ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R86, 0x00);
-		}// may be removed for RT35xx --
-
-		// 5.5 GHz band selection PIN, bit1 and bit2 are complement
-		RTMP_IO_READ32(pAd, TX_BAND_CFG, &Value);
-		Value &= (~0x6);
-		Value |= (0x04);
-		RTMP_IO_WRITE32(pAd, TX_BAND_CFG, Value);
-
-        // Turn off unused PA or LNA when only 1T or 1R.
-		if (pAd->Antenna.field.TxPath == 1)
-		{
-			TxPinCfg &= 0xFFFFFFF3;
-		}
-		if (pAd->Antenna.field.RxPath == 1)
-		{
-			TxPinCfg &= 0xFFFFF3FF;
-		}
-
-		// calibration power unbalance issues
-		if (pAd->Antenna.field.TxPath == 2)
-		{
-			if (pAd->ate.TxAntennaSel == 1)
-			{
-				TxPinCfg &= 0xFFFFFFF7;
-			}
-			else if (pAd->ate.TxAntennaSel == 2)
-			{
-				TxPinCfg &= 0xFFFFFFFD;
-			}
-		}
-
-		RTMP_IO_WRITE32(pAd, TX_PIN_CFG, TxPinCfg);
-	}
-	else
-	{
-	    UINT32	TxPinCfg = 0x00050F05;// 2007.10.09 by Brian : 0x00050505 ==> 0x00050F05
-
-		ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R62, (0x37 - GET_LNA_GAIN(pAd)));
-		ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R63, (0x37 - GET_LNA_GAIN(pAd)));
-		ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R64, (0x37 - GET_LNA_GAIN(pAd)));
-		ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R82, 0xF2);
-
-        // According the Rory's suggestion to solve the middle range issue.
-		ATE_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R86, &BbpValue);// may be removed for RT35xx ++
-
-		ASSERT((BbpValue == 0x00));
-		if ((BbpValue != 0x00))
-		{
-			ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R86, 0x00);
-		}
-
-		ATE_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R91, &BbpValue);
-		ASSERT((BbpValue == 0x04));
-
-		ATE_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R92, &BbpValue);
-		ASSERT((BbpValue == 0x00));// may be removed for RT35xx --
-
-		// 5.5 GHz band selection PIN, bit1 and bit2 are complement
-		RTMP_IO_READ32(pAd, TX_BAND_CFG, &Value);
-		Value &= (~0x6);
-		Value |= (0x02);
-		RTMP_IO_WRITE32(pAd, TX_BAND_CFG, Value);
-
-		// Turn off unused PA or LNA when only 1T or 1R.
-		if (pAd->Antenna.field.TxPath == 1)
-		{
-			TxPinCfg &= 0xFFFFFFF3;
-		}
-		if (pAd->Antenna.field.RxPath == 1)
-		{
-			TxPinCfg &= 0xFFFFF3FF;
-		}
-
-		RTMP_IO_WRITE32(pAd, TX_PIN_CFG, TxPinCfg);
-	}
-
-
-    // R66 should be set according to Channel and use 20MHz when scanning
-	if (Channel <= 14)
-	{
-		// BG band
-		R66 = 0x2E + GET_LNA_GAIN(pAd);
-		ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R66, R66);
-	}
-	else
-	{
-		// 5.5 GHz band
-		if (pAd->ate.TxWI.BW == BW_20)
-		{
-			R66 = (UCHAR)(0x32 + (GET_LNA_GAIN(pAd)*5)/3);
-		ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R66, R66);
-		}
-		else
-		{
-			R66 = (UCHAR)(0x3A + (GET_LNA_GAIN(pAd)*5)/3);
-			ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R66, R66);
-		}
-	}
-
-	/*
-		On 11A, We should delay and wait RF/BBP to be stable
-		and the appropriate time should be 1000 micro seconds.
-
-		2005/06/05 - On 11G, We also need this delay time. Otherwise it's difficult to pass the WHQL.
-	*/
-	RTMPusecDelay(1000);
-
-#ifndef RTMP_RF_RW_SUPPORT
-	if (Channel > 14)
-	{
-		// When 5.5GHz band the LSB of TxPwr will be used to reduced 7dB or not.
-		ATEDBGPRINT(RT_DEBUG_TRACE, ("SwitchChannel#%d(RF=%d, %dT) to , R1=0x%08lx, R2=0x%08lx, R3=0x%08lx, R4=0x%08lx\n",
-								  Channel,
-								  pAd->RfIcType,
-								  pAd->Antenna.field.TxPath,
-								  pAd->LatchRfRegs.R1,
-								  pAd->LatchRfRegs.R2,
-								  pAd->LatchRfRegs.R3,
-								  pAd->LatchRfRegs.R4));
-	}
-	else
-	{
-		ATEDBGPRINT(RT_DEBUG_TRACE, ("SwitchChannel#%d(RF=%d, Pwr0=%u, Pwr1=%u, %dT) to , R1=0x%08lx, R2=0x%08lx, R3=0x%08lx, R4=0x%08lx\n",
-								  Channel,
-								  pAd->RfIcType,
-								  (R3 & 0x00003e00) >> 9,
-								  (R4 & 0x000007c0) >> 6,
-								  pAd->Antenna.field.TxPath,
-								  pAd->LatchRfRegs.R1,
-								  pAd->LatchRfRegs.R2,
-								  pAd->LatchRfRegs.R3,
-								  pAd->LatchRfRegs.R4));
-    }
-#endif // RTMP_RF_RW_SUPPORT //
-}
-
-
-
-/* In fact, no one will call this routine so far ! */
-
-/*
-==========================================================================
-	Description:
-		Gives CCK TX rate 2 more dB TX power.
-		This routine works only in ATE mode.
-
-		calculate desired Tx power in RF R3.Tx0~5,	should consider -
-		0. if current radio is a noisy environment (pAd->DrsCounters.fNoisyEnvironment)
-		1. TxPowerPercentage
-		2. auto calibration based on TSSI feedback
-		3. extra 2 db for CCK
-		4. -10 db upon very-short distance (AvgRSSI >= -40db) to AP
-
-	NOTE: Since this routine requires the value of (pAd->DrsCounters.fNoisyEnvironment),
-		it should be called AFTER MlmeDynamicTxRateSwitching()
-==========================================================================
-*/
-VOID ATEAsicAdjustTxPower(
-	IN PRTMP_ADAPTER pAd)
-{
-	INT			i, j;
-	CHAR		DeltaPwr = 0;
-	BOOLEAN		bAutoTxAgc = FALSE;
-	UCHAR		TssiRef, *pTssiMinusBoundary, *pTssiPlusBoundary, TxAgcStep;
-	UCHAR		BbpR49 = 0, idx;
-	PCHAR		pTxAgcCompensate;
-	ULONG		TxPwr[5];
-	CHAR		Value;
-
-	/* no one calls this procedure so far */
-	if (pAd->ate.TxWI.BW == BW_40)
-	{
-		if (pAd->ate.Channel > 14)
-		{
-			TxPwr[0] = pAd->Tx40MPwrCfgABand[0];
-			TxPwr[1] = pAd->Tx40MPwrCfgABand[1];
-			TxPwr[2] = pAd->Tx40MPwrCfgABand[2];
-			TxPwr[3] = pAd->Tx40MPwrCfgABand[3];
-			TxPwr[4] = pAd->Tx40MPwrCfgABand[4];
-		}
-		else
-		{
-			TxPwr[0] = pAd->Tx40MPwrCfgGBand[0];
-			TxPwr[1] = pAd->Tx40MPwrCfgGBand[1];
-			TxPwr[2] = pAd->Tx40MPwrCfgGBand[2];
-			TxPwr[3] = pAd->Tx40MPwrCfgGBand[3];
-			TxPwr[4] = pAd->Tx40MPwrCfgGBand[4];
-		}
-	}
-	else
-	{
-		if (pAd->ate.Channel > 14)
-		{
-			TxPwr[0] = pAd->Tx20MPwrCfgABand[0];
-			TxPwr[1] = pAd->Tx20MPwrCfgABand[1];
-			TxPwr[2] = pAd->Tx20MPwrCfgABand[2];
-			TxPwr[3] = pAd->Tx20MPwrCfgABand[3];
-			TxPwr[4] = pAd->Tx20MPwrCfgABand[4];
-		}
-		else
-		{
-			TxPwr[0] = pAd->Tx20MPwrCfgGBand[0];
-			TxPwr[1] = pAd->Tx20MPwrCfgGBand[1];
-			TxPwr[2] = pAd->Tx20MPwrCfgGBand[2];
-			TxPwr[3] = pAd->Tx20MPwrCfgGBand[3];
-			TxPwr[4] = pAd->Tx20MPwrCfgGBand[4];
-		}
-	}
-
-	// TX power compensation for temperature variation based on TSSI.
-	// Do it per 4 seconds.
-	if (pAd->Mlme.OneSecPeriodicRound % 4 == 0)
-	{
-		if (pAd->ate.Channel <= 14)
-		{
-			/* bg channel */
-			bAutoTxAgc         = pAd->bAutoTxAgcG;
-			TssiRef            = pAd->TssiRefG;
-			pTssiMinusBoundary = &pAd->TssiMinusBoundaryG[0];
-			pTssiPlusBoundary  = &pAd->TssiPlusBoundaryG[0];
-			TxAgcStep          = pAd->TxAgcStepG;
-			pTxAgcCompensate   = &pAd->TxAgcCompensateG;
-		}
-		else
-		{
-			/* a channel */
-			bAutoTxAgc         = pAd->bAutoTxAgcA;
-			TssiRef            = pAd->TssiRefA;
-			pTssiMinusBoundary = &pAd->TssiMinusBoundaryA[0];
-			pTssiPlusBoundary  = &pAd->TssiPlusBoundaryA[0];
-			TxAgcStep          = pAd->TxAgcStepA;
-			pTxAgcCompensate   = &pAd->TxAgcCompensateA;
-		}
-
-		if (bAutoTxAgc)
-		{
-			/* BbpR49 is unsigned char. */
-			ATE_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R49, &BbpR49);
-
-			/* (p) TssiPlusBoundaryG[0] = 0 = (m) TssiMinusBoundaryG[0] */
-			/* compensate: +4     +3   +2   +1    0   -1   -2   -3   -4 * steps */
-			/* step value is defined in pAd->TxAgcStepG for tx power value */
-
-			/* [4]+1+[4]   p4     p3   p2   p1   o1   m1   m2   m3   m4 */
-			/* ex:         0x00 0x15 0x25 0x45 0x88 0xA0 0xB5 0xD0 0xF0
-			   above value are examined in mass factory production */
-			/*             [4]    [3]  [2]  [1]  [0]  [1]  [2]  [3]  [4] */
-
-			/* plus is 0x10 ~ 0x40, minus is 0x60 ~ 0x90 */
-			/* if value is between p1 ~ o1 or o1 ~ s1, no need to adjust tx power */
-			/* if value is 0x65, tx power will be -= TxAgcStep*(2-1) */
-
-			if (BbpR49 > pTssiMinusBoundary[1])
-			{
-				// Reading is larger than the reference value.
-				// Check for how large we need to decrease the Tx power.
-				for (idx = 1; idx < 5; idx++)
-				{
-					// Found the range.
-					if (BbpR49 <= pTssiMinusBoundary[idx])
-						break;
-				}
-
-				// The index is the step we should decrease, idx = 0 means there is nothing to compensate.
-//				if (R3 > (ULONG) (TxAgcStep * (idx-1)))
-					*pTxAgcCompensate = -(TxAgcStep * (idx-1));
-//				else
-//					*pTxAgcCompensate = -((UCHAR)R3);
-
-				DeltaPwr += (*pTxAgcCompensate);
-				ATEDBGPRINT(RT_DEBUG_TRACE, ("-- Tx Power, BBP R1=%x, TssiRef=%x, TxAgcStep=%x, step = -%d\n",
-					BbpR49, TssiRef, TxAgcStep, idx-1));
-			}
-			else if (BbpR49 < pTssiPlusBoundary[1])
-			{
-				// Reading is smaller than the reference value.
-				// Check for how large we need to increase the Tx power.
-				for (idx = 1; idx < 5; idx++)
-				{
-					// Found the range.
-					if (BbpR49 >= pTssiPlusBoundary[idx])
-						break;
-				}
-
-				// The index is the step we should increase, idx = 0 means there is nothing to compensate.
-				*pTxAgcCompensate = TxAgcStep * (idx-1);
-				DeltaPwr += (*pTxAgcCompensate);
-				ATEDBGPRINT(RT_DEBUG_TRACE, ("++ Tx Power, BBP R1=%x, TssiRef=%x, TxAgcStep=%x, step = +%d\n",
-					BbpR49, TssiRef, TxAgcStep, idx-1));
-			}
-			else
-			{
-				*pTxAgcCompensate = 0;
-				ATEDBGPRINT(RT_DEBUG_TRACE, ("   Tx Power, BBP R1=%x, TssiRef=%x, TxAgcStep=%x, step = +%d\n",
-					BbpR49, TssiRef, TxAgcStep, 0));
-			}
-		}
-	}
-	else
-	{
-		if (pAd->ate.Channel <= 14)
-		{
-			bAutoTxAgc         = pAd->bAutoTxAgcG;
-			pTxAgcCompensate   = &pAd->TxAgcCompensateG;
-		}
-		else
-		{
-			bAutoTxAgc         = pAd->bAutoTxAgcA;
-			pTxAgcCompensate   = &pAd->TxAgcCompensateA;
-		}
-
-		if (bAutoTxAgc)
-			DeltaPwr += (*pTxAgcCompensate);
-	}
-
-	/* Calculate delta power based on the percentage specified from UI. */
-	// E2PROM setting is calibrated for maximum TX power (i.e. 100%)
-	// We lower TX power here according to the percentage specified from UI.
-	if (pAd->CommonCfg.TxPowerPercentage == 0xffffffff)       // AUTO TX POWER control
-		;
-	else if (pAd->CommonCfg.TxPowerPercentage > 90)  // 91 ~ 100% & AUTO, treat as 100% in terms of mW
-		;
-	else if (pAd->CommonCfg.TxPowerPercentage > 60)  // 61 ~ 90%, treat as 75% in terms of mW
-	{
-		DeltaPwr -= 1;
-	}
-	else if (pAd->CommonCfg.TxPowerPercentage > 30)  // 31 ~ 60%, treat as 50% in terms of mW
-	{
-		DeltaPwr -= 3;
-	}
-	else if (pAd->CommonCfg.TxPowerPercentage > 15)  // 16 ~ 30%, treat as 25% in terms of mW
-	{
-		DeltaPwr -= 6;
-	}
-	else if (pAd->CommonCfg.TxPowerPercentage > 9)   // 10 ~ 15%, treat as 12.5% in terms of mW
-	{
-		DeltaPwr -= 9;
-	}
-	else                                           // 0 ~ 9 %, treat as MIN(~3%) in terms of mW
-	{
-		DeltaPwr -= 12;
-	}
-
-	/* Reset different new tx power for different TX rate. */
-	for (i=0; i<5; i++)
-	{
-		if (TxPwr[i] != 0xffffffff)
-		{
-			for (j=0; j<8; j++)
-			{
-				Value = (CHAR)((TxPwr[i] >> j*4) & 0x0F); /* 0 ~ 15 */
-
-				if ((Value + DeltaPwr) < 0)
-				{
-					Value = 0; /* min */
-				}
-				else if ((Value + DeltaPwr) > 0xF)
-				{
-					Value = 0xF; /* max */
-				}
-				else
-				{
-					Value += DeltaPwr; /* temperature compensation */
-				}
-
-				/* fill new value to CSR offset */
-				TxPwr[i] = (TxPwr[i] & ~(0x0000000F << j*4)) | (Value << j*4);
-			}
-
-			/* write tx power value to CSR */
-			/* TX_PWR_CFG_0 (8 tx rate) for	TX power for OFDM 12M/18M
-											TX power for OFDM 6M/9M
-											TX power for CCK5.5M/11M
-											TX power for CCK1M/2M */
-			/* TX_PWR_CFG_1 ~ TX_PWR_CFG_4 */
-			RTMP_IO_WRITE32(pAd, TX_PWR_CFG_0 + i*4, TxPwr[i]);
-
-
-		}
-	}
-
-}
-
-
-/*
-========================================================================
-	Routine Description:
-		Write TxWI for ATE mode.
-
-	Return Value:
-		None
-========================================================================
-*/
-#ifdef RTMP_MAC_PCI
-static VOID ATEWriteTxWI(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PTXWI_STRUC	pOutTxWI,
-	IN	BOOLEAN			FRAG,
-	IN	BOOLEAN			CFACK,
-	IN	BOOLEAN			InsTimestamp,
-	IN	BOOLEAN			AMPDU,
-	IN	BOOLEAN			Ack,
-	IN	BOOLEAN			NSeq,		// HW new a sequence.
-	IN	UCHAR			BASize,
-	IN	UCHAR			WCID,
-	IN	ULONG			Length,
-	IN	UCHAR			PID,
-	IN	UCHAR			TID,
-	IN	UCHAR			TxRate,
-	IN	UCHAR			Txopmode,
-	IN	BOOLEAN			CfAck,
-	IN	HTTRANSMIT_SETTING	*pTransmit)
-{
-	TXWI_STRUC		TxWI;
-	PTXWI_STRUC	pTxWI;
-
-	//
-	// Always use Long preamble before verifiation short preamble functionality works well.
-	// Todo: remove the following line if short preamble functionality works
-	//
-	OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_SHORT_PREAMBLE_INUSED);
-	NdisZeroMemory(&TxWI, TXWI_SIZE);
-	pTxWI = &TxWI;
-
-	pTxWI->FRAG= FRAG;
-
-	pTxWI->CFACK = CFACK;
-	pTxWI->TS= InsTimestamp;
-	pTxWI->AMPDU = AMPDU;
-	pTxWI->ACK = Ack;
-	pTxWI->txop= Txopmode;
-
-	pTxWI->NSEQ = NSeq;
-
-	// John tune the performace with Intel Client in 20 MHz performance
-	if ( BASize >7 )
-		BASize =7;
-
-	pTxWI->BAWinSize = BASize;
-	pTxWI->WirelessCliID = WCID;
-	pTxWI->MPDUtotalByteCount = Length;
-	pTxWI->PacketId = PID;
-
-	// If CCK or OFDM, BW must be 20
-	pTxWI->BW = (pTransmit->field.MODE <= MODE_OFDM) ? (BW_20) : (pTransmit->field.BW);
-	pTxWI->ShortGI = pTransmit->field.ShortGI;
-	pTxWI->STBC = pTransmit->field.STBC;
-
-	pTxWI->MCS = pTransmit->field.MCS;
-	pTxWI->PHYMODE = pTransmit->field.MODE;
-	pTxWI->CFACK = CfAck;
-	pTxWI->MIMOps = 0;
-	pTxWI->MpduDensity = 0;
-
-	pTxWI->PacketId = pTxWI->MCS;
-	NdisMoveMemory(pOutTxWI, &TxWI, sizeof(TXWI_STRUC));
-
-    return;
-}
-#endif // RTMP_MAC_PCI //
-
-
-
-
-/*
-========================================================================
-
-	Routine Description:
-		Disable protection for ATE.
-========================================================================
-*/
-VOID ATEDisableAsicProtect(
-	IN		PRTMP_ADAPTER	pAd)
-{
-	PROT_CFG_STRUC	ProtCfg, ProtCfg4;
-	UINT32 Protect[6];
-	USHORT			offset;
-	UCHAR			i;
-	UINT32 MacReg = 0;
-
-	// Config ASIC RTS threshold register
-	RTMP_IO_READ32(pAd, TX_RTS_CFG, &MacReg);
-	MacReg &= 0xFF0000FF;
-	MacReg |= (pAd->CommonCfg.RtsThreshold << 8);
-	RTMP_IO_WRITE32(pAd, TX_RTS_CFG, MacReg);
-
-	// Initial common protection settings
-	RTMPZeroMemory(Protect, sizeof(Protect));
-	ProtCfg4.word = 0;
-	ProtCfg.word = 0;
-	ProtCfg.field.TxopAllowGF40 = 1;
-	ProtCfg.field.TxopAllowGF20 = 1;
-	ProtCfg.field.TxopAllowMM40 = 1;
-	ProtCfg.field.TxopAllowMM20 = 1;
-	ProtCfg.field.TxopAllowOfdm = 1;
-	ProtCfg.field.TxopAllowCck = 1;
-	ProtCfg.field.RTSThEn = 1;
-	ProtCfg.field.ProtectNav = ASIC_SHORTNAV;
-
-	// Handle legacy(B/G) protection
-	ProtCfg.field.ProtectRate = pAd->CommonCfg.RtsRate;
-	ProtCfg.field.ProtectCtrl = 0;
-	Protect[0] = ProtCfg.word;
-	Protect[1] = ProtCfg.word;
-
-	// NO PROTECT
-	// 1.All STAs in the BSS are 20/40 MHz HT
-	// 2. in ai 20/40MHz BSS
-	// 3. all STAs are 20MHz in a 20MHz BSS
-	// Pure HT. no protection.
-
-	// MM20_PROT_CFG
-	//	Reserved (31:27)
-	//	PROT_TXOP(25:20) -- 010111
-	//	PROT_NAV(19:18)  -- 01 (Short NAV protection)
-	//  PROT_CTRL(17:16) -- 00 (None)
-	//	PROT_RATE(15:0)  -- 0x4004 (OFDM 24M)
-	Protect[2] = 0x01744004;
-
-	// MM40_PROT_CFG
-	//	Reserved (31:27)
-	//	PROT_TXOP(25:20) -- 111111
-	//	PROT_NAV(19:18)  -- 01 (Short NAV protection)
-	//  PROT_CTRL(17:16) -- 00 (None)
-	//	PROT_RATE(15:0)  -- 0x4084 (duplicate OFDM 24M)
-	Protect[3] = 0x03f44084;
-
-	// CF20_PROT_CFG
-	//	Reserved (31:27)
-	//	PROT_TXOP(25:20) -- 010111
-	//	PROT_NAV(19:18)  -- 01 (Short NAV protection)
-	//  PROT_CTRL(17:16) -- 00 (None)
-	//	PROT_RATE(15:0)  -- 0x4004 (OFDM 24M)
-	Protect[4] = 0x01744004;
-
-	// CF40_PROT_CFG
-	//	Reserved (31:27)
-	//	PROT_TXOP(25:20) -- 111111
-	//	PROT_NAV(19:18)  -- 01 (Short NAV protection)
-	//  PROT_CTRL(17:16) -- 00 (None)
-	//	PROT_RATE(15:0)  -- 0x4084 (duplicate OFDM 24M)
-	Protect[5] = 0x03f44084;
-
-	pAd->CommonCfg.IOTestParm.bRTSLongProtOn = FALSE;
-
-	offset = CCK_PROT_CFG;
-	for (i = 0;i < 6;i++)
-		RTMP_IO_WRITE32(pAd, offset + i*4, Protect[i]);
-
-}
-
-
-
-
-/* There are two ways to convert Rssi */
-/* the way used with GET_LNA_GAIN() */
-CHAR ATEConvertToRssi(
-	IN PRTMP_ADAPTER pAd,
-	IN	CHAR	Rssi,
-	IN  UCHAR   RssiNumber)
-{
-	UCHAR	RssiOffset, LNAGain;
-
-	// Rssi equals to zero should be an invalid value
-	if (Rssi == 0)
-		return -99;
-
-	LNAGain = GET_LNA_GAIN(pAd);
-	if (pAd->LatchRfRegs.Channel > 14)
-	{
-		if (RssiNumber == 0)
-			RssiOffset = pAd->ARssiOffset0;
-		else if (RssiNumber == 1)
-			RssiOffset = pAd->ARssiOffset1;
-		else
-			RssiOffset = pAd->ARssiOffset2;
-	}
-	else
-	{
-		if (RssiNumber == 0)
-			RssiOffset = pAd->BGRssiOffset0;
-		else if (RssiNumber == 1)
-			RssiOffset = pAd->BGRssiOffset1;
-		else
-			RssiOffset = pAd->BGRssiOffset2;
-	}
-
-	return (-12 - RssiOffset - LNAGain - Rssi);
-}
-
-
-/*
-========================================================================
-
-	Routine Description:
-		Set Japan filter coefficients if needed.
-	Note:
-		This routine should only be called when
-		entering TXFRAME mode or TXCONT mode.
-
-========================================================================
-*/
-static VOID SetJapanFilter(
-	IN		PRTMP_ADAPTER	pAd)
-{
-	UCHAR			BbpData = 0;
-
-	//
-	// If Channel=14 and Bandwidth=20M and Mode=CCK, set BBP R4 bit5=1
-	// (Japan Tx filter coefficients)when (TXFRAME or TXCONT).
-	//
-	ATE_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R4, &BbpData);
-
-    if ((pAd->ate.TxWI.PHYMODE == MODE_CCK) && (pAd->ate.Channel == 14) && (pAd->ate.TxWI.BW == BW_20))
-    {
-        BbpData |= 0x20;    // turn on
-        ATEDBGPRINT(RT_DEBUG_TRACE, ("SetJapanFilter!!!\n"));
-    }
-    else
-    {
-		BbpData &= 0xdf;    // turn off
-		ATEDBGPRINT(RT_DEBUG_TRACE, ("ClearJapanFilter!!!\n"));
-    }
-
-	ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R4, BbpData);
-}
-
-
-VOID ATESampleRssi(
-	IN PRTMP_ADAPTER	pAd,
-	IN PRXWI_STRUC		pRxWI)
-{
-	/* There are two ways to collect RSSI. */
-//	pAd->LastRxRate = (USHORT)((pRxWI->MCS) + (pRxWI->BW <<7) + (pRxWI->ShortGI <<8)+ (pRxWI->PHYMODE <<14)) ;
-	if (pRxWI->RSSI0 != 0)
-	{
-		pAd->ate.LastRssi0	= ATEConvertToRssi(pAd, (CHAR) pRxWI->RSSI0, RSSI_0);
-		pAd->ate.AvgRssi0X8	= (pAd->ate.AvgRssi0X8 - pAd->ate.AvgRssi0) + pAd->ate.LastRssi0;
-		pAd->ate.AvgRssi0	= pAd->ate.AvgRssi0X8 >> 3;
-	}
-	if (pRxWI->RSSI1 != 0)
-	{
-		pAd->ate.LastRssi1	= ATEConvertToRssi(pAd, (CHAR) pRxWI->RSSI1, RSSI_1);
-		pAd->ate.AvgRssi1X8	= (pAd->ate.AvgRssi1X8 - pAd->ate.AvgRssi1) + pAd->ate.LastRssi1;
-		pAd->ate.AvgRssi1	= pAd->ate.AvgRssi1X8 >> 3;
-	}
-	if (pRxWI->RSSI2 != 0)
-	{
-		pAd->ate.LastRssi2	= ATEConvertToRssi(pAd, (CHAR) pRxWI->RSSI2, RSSI_2);
-		pAd->ate.AvgRssi2X8	= (pAd->ate.AvgRssi2X8 - pAd->ate.AvgRssi2) + pAd->ate.LastRssi2;
-		pAd->ate.AvgRssi2	= pAd->ate.AvgRssi2X8 >> 3;
-	}
-
-	pAd->ate.LastSNR0 = (CHAR)(pRxWI->SNR0);// CHAR ==> UCHAR ?
-	pAd->ate.LastSNR1 = (CHAR)(pRxWI->SNR1);// CHAR ==> UCHAR ?
-
-	pAd->ate.NumOfAvgRssiSample ++;
-}
-
-
-#ifdef CONFIG_STA_SUPPORT
-VOID RTMPStationStop(
-    IN  PRTMP_ADAPTER   pAd)
-{
-//	BOOLEAN       Cancelled;
-
-    ATEDBGPRINT(RT_DEBUG_TRACE, ("==> RTMPStationStop\n"));
-
-	// For rx statistics, we need to keep this timer running.
-//	RTMPCancelTimer(&pAd->Mlme.PeriodicTimer,      &Cancelled);
-
-    ATEDBGPRINT(RT_DEBUG_TRACE, ("<== RTMPStationStop\n"));
-}
-
-
-VOID RTMPStationStart(
-    IN  PRTMP_ADAPTER   pAd)
-{
-    ATEDBGPRINT(RT_DEBUG_TRACE, ("==> RTMPStationStart\n"));
-
-#ifdef RTMP_MAC_PCI
-	pAd->Mlme.CntlMachine.CurrState = CNTL_IDLE;
-
-	/* We did not cancel this timer when entering ATE mode. */
-//	RTMPSetTimer(&pAd->Mlme.PeriodicTimer, MLME_TASK_EXEC_INTV);
-#endif // RTMP_MAC_PCI //
-
-	ATEDBGPRINT(RT_DEBUG_TRACE, ("<== RTMPStationStart\n"));
-}
-#endif // CONFIG_STA_SUPPORT //
-
-
-/*
-==========================================================================
-	Description:
-		Setup Frame format.
-	NOTE:
-		This routine should only be used in ATE mode.
-==========================================================================
-*/
-#ifdef RTMP_MAC_PCI
-static INT ATESetUpFrame(
-	IN PRTMP_ADAPTER pAd,
-	IN UINT32 TxIdx)
-{
-	UINT j;
-	PTXD_STRUC pTxD;
-#ifdef RT_BIG_ENDIAN
-    PTXD_STRUC      pDestTxD;
-    TXD_STRUC       TxD;
-#endif
-	PNDIS_PACKET pPacket;
-	PUCHAR pDest;
-	PVOID AllocVa;
-	NDIS_PHYSICAL_ADDRESS AllocPa;
-	HTTRANSMIT_SETTING	TxHTPhyMode;
-
-	PRTMP_TX_RING pTxRing = &pAd->TxRing[QID_AC_BE];
-	PTXWI_STRUC pTxWI = (PTXWI_STRUC) pTxRing->Cell[TxIdx].DmaBuf.AllocVa;
-	PUCHAR pDMAHeaderBufVA = (PUCHAR) pTxRing->Cell[TxIdx].DmaBuf.AllocVa;
-
-#ifdef RALINK_28xx_QA
-	PHEADER_802_11	pHeader80211;
-#endif // RALINK_28xx_QA //
-
-	if (pAd->ate.bQATxStart == TRUE)
-	{
-		// always use QID_AC_BE and FIFO_EDCA
-
-		// fill TxWI
-		TxHTPhyMode.field.BW = pAd->ate.TxWI.BW;
-		TxHTPhyMode.field.ShortGI = pAd->ate.TxWI.ShortGI;
-		TxHTPhyMode.field.STBC = 0;
-		TxHTPhyMode.field.MCS = pAd->ate.TxWI.MCS;
-		TxHTPhyMode.field.MODE = pAd->ate.TxWI.PHYMODE;
-
-		ATEWriteTxWI(pAd, pTxWI, pAd->ate.TxWI.FRAG, pAd->ate.TxWI.CFACK,
-			pAd->ate.TxWI.TS,  pAd->ate.TxWI.AMPDU, pAd->ate.TxWI.ACK, pAd->ate.TxWI.NSEQ,
-			pAd->ate.TxWI.BAWinSize, 0, pAd->ate.TxWI.MPDUtotalByteCount, pAd->ate.TxWI.PacketId, 0, 0,
-			pAd->ate.TxWI.txop/*IFS_HTTXOP*/, pAd->ate.TxWI.CFACK/*FALSE*/, &TxHTPhyMode);
-	}
-	else
-	{
-		TxHTPhyMode.field.BW = pAd->ate.TxWI.BW;
-		TxHTPhyMode.field.ShortGI = pAd->ate.TxWI.ShortGI;
-		TxHTPhyMode.field.STBC = 0;
-		TxHTPhyMode.field.MCS = pAd->ate.TxWI.MCS;
-		TxHTPhyMode.field.MODE = pAd->ate.TxWI.PHYMODE;
-		ATEWriteTxWI(pAd, pTxWI, FALSE, FALSE, FALSE,  FALSE, FALSE, FALSE,
-			4, 0, pAd->ate.TxLength, 0, 0, 0, IFS_HTTXOP, FALSE, &TxHTPhyMode);
-	}
-
-	// fill 802.11 header
-#ifdef RALINK_28xx_QA
-	if (pAd->ate.bQATxStart == TRUE)
-	{
-		NdisMoveMemory(pDMAHeaderBufVA+TXWI_SIZE, pAd->ate.Header, pAd->ate.HLen);
-	}
-	else
-#endif // RALINK_28xx_QA //
-	{
-		NdisMoveMemory(pDMAHeaderBufVA+TXWI_SIZE, TemplateFrame, LENGTH_802_11);
-		NdisMoveMemory(pDMAHeaderBufVA+TXWI_SIZE+4, pAd->ate.Addr1, ETH_LENGTH_OF_ADDRESS);
-		NdisMoveMemory(pDMAHeaderBufVA+TXWI_SIZE+10, pAd->ate.Addr2, ETH_LENGTH_OF_ADDRESS);
-		NdisMoveMemory(pDMAHeaderBufVA+TXWI_SIZE+16, pAd->ate.Addr3, ETH_LENGTH_OF_ADDRESS);
-	}
-
-#ifdef RT_BIG_ENDIAN
-	RTMPFrameEndianChange(pAd, (((PUCHAR)pDMAHeaderBufVA)+TXWI_SIZE), DIR_READ, FALSE);
-#endif // RT_BIG_ENDIAN //
-
-	/* alloc buffer for payload */
-#ifdef RALINK_28xx_QA
-	if (pAd->ate.bQATxStart == TRUE)
-	{
-		pPacket = RTMP_AllocateRxPacketBuffer(pAd, pAd->ate.DLen + 0x100, FALSE, &AllocVa, &AllocPa);
-	}
-	else
-#endif // RALINK_28xx_QA //
-	{
-		pPacket = RTMP_AllocateRxPacketBuffer(pAd, pAd->ate.TxLength, FALSE, &AllocVa, &AllocPa);
-	}
-
-	if (pPacket == NULL)
-	{
-		pAd->ate.TxCount = 0;
-		ATEDBGPRINT(RT_DEBUG_TRACE, ("%s fail to alloc packet space.\n", __FUNCTION__));
-		return -1;
-	}
-	pTxRing->Cell[TxIdx].pNextNdisPacket = pPacket;
-
-	pDest = (PUCHAR) AllocVa;
-
-#ifdef RALINK_28xx_QA
-	if (pAd->ate.bQATxStart == TRUE)
-	{
-		RTPKT_TO_OSPKT(pPacket)->len = pAd->ate.DLen;
-	}
-	else
-#endif // RALINK_28xx_QA //
-	{
-		RTPKT_TO_OSPKT(pPacket)->len = pAd->ate.TxLength - LENGTH_802_11;
-	}
-
-	// prepare frame payload
-#ifdef RALINK_28xx_QA
-	if (pAd->ate.bQATxStart == TRUE)
-	{
-		// copy pattern
-		if ((pAd->ate.PLen != 0))
-		{
-			int j;
-
-			for (j = 0; j < pAd->ate.DLen; j+=pAd->ate.PLen)
-			{
-				memcpy(RTPKT_TO_OSPKT(pPacket)->data + j, pAd->ate.Pattern, pAd->ate.PLen);
-			}
-		}
-	}
-	else
-#endif // RALINK_28xx_QA //
-	{
-		for (j = 0; j < RTPKT_TO_OSPKT(pPacket)->len; j++)
-		{
-			pDest[j] = 0xA5;
-		}
-	}
-
-	/* build Tx Descriptor */
-#ifndef RT_BIG_ENDIAN
-	pTxD = (PTXD_STRUC) pTxRing->Cell[TxIdx].AllocVa;
-#else
-    pDestTxD  = (PTXD_STRUC)pTxRing->Cell[TxIdx].AllocVa;
-    TxD = *pDestTxD;
-    pTxD = &TxD;
-#endif // !RT_BIG_ENDIAN //
-
-#ifdef RALINK_28xx_QA
-	if (pAd->ate.bQATxStart == TRUE)
-	{
-		// prepare TxD
-		NdisZeroMemory(pTxD, TXD_SIZE);
-		RTMPWriteTxDescriptor(pAd, pTxD, FALSE, FIFO_EDCA);
-		// build TX DESC
-		pTxD->SDPtr0 = RTMP_GetPhysicalAddressLow(pTxRing->Cell[TxIdx].DmaBuf.AllocPa);
-		pTxD->SDLen0 = TXWI_SIZE + pAd->ate.HLen;
-		pTxD->LastSec0 = 0;
-		pTxD->SDPtr1 = AllocPa;
-		pTxD->SDLen1 = RTPKT_TO_OSPKT(pPacket)->len;
-		pTxD->LastSec1 = 1;
-
-		pDest = (PUCHAR)pTxWI;
-		pDest += TXWI_SIZE;
-		pHeader80211 = (PHEADER_802_11)pDest;
-
-		// modify sequence number...
-		if (pAd->ate.TxDoneCount == 0)
-		{
-			pAd->ate.seq = pHeader80211->Sequence;
-		}
-		else
-			pHeader80211->Sequence = ++pAd->ate.seq;
-	}
-	else
-#endif // RALINK_28xx_QA //
-	{
-		NdisZeroMemory(pTxD, TXD_SIZE);
-		RTMPWriteTxDescriptor(pAd, pTxD, FALSE, FIFO_EDCA);
-		// build TX DESC
-		pTxD->SDPtr0 = RTMP_GetPhysicalAddressLow (pTxRing->Cell[TxIdx].DmaBuf.AllocPa);
-		pTxD->SDLen0 = TXWI_SIZE + LENGTH_802_11;
-		pTxD->LastSec0 = 0;
-		pTxD->SDPtr1 = AllocPa;
-		pTxD->SDLen1 = RTPKT_TO_OSPKT(pPacket)->len;
-		pTxD->LastSec1 = 1;
-	}
-
-#ifdef RT_BIG_ENDIAN
-	RTMPWIEndianChange((PUCHAR)pTxWI, TYPE_TXWI);
-	RTMPFrameEndianChange(pAd, (((PUCHAR)pDMAHeaderBufVA)+TXWI_SIZE), DIR_WRITE, FALSE);
-    RTMPDescriptorEndianChange((PUCHAR)pTxD, TYPE_TXD);
-    WriteBackToDescriptor((PUCHAR)pDestTxD, (PUCHAR)pTxD, FALSE, TYPE_TXD);
-#endif // RT_BIG_ENDIAN //
-
-	return 0;
-}
-/*=======================End of RTMP_MAC_PCI =======================*/
-#endif // RTMP_MAC_PCI //
-
-
-
-
-VOID rt_ee_read_all(PRTMP_ADAPTER pAd, USHORT *Data)
-{
-	USHORT i;
-	USHORT value;
-
-
-	for (i = 0 ; i < EEPROM_SIZE/2 ; )
-	{
-		/* "value" is especially for some compilers... */
-		RT28xx_EEPROM_READ16(pAd, i*2, value);
-		Data[i] = value;
-		i++;
-	}
-}
-
-
-VOID rt_ee_write_all(PRTMP_ADAPTER pAd, USHORT *Data)
-{
-	USHORT i;
-	USHORT value;
-
-
-	for (i = 0 ; i < EEPROM_SIZE/2 ; )
-	{
-		/* "value" is especially for some compilers... */
-		value = Data[i];
-		RT28xx_EEPROM_WRITE16(pAd, i*2, value);
-		i++;
-	}
-}
-
-
-#ifdef RALINK_28xx_QA
-VOID ATE_QA_Statistics(
-	IN PRTMP_ADAPTER			pAd,
-	IN PRXWI_STRUC				pRxWI,
-	IN PRT28XX_RXD_STRUC		pRxD,
-	IN PHEADER_802_11			pHeader)
-{
-	// update counter first
-	if (pHeader != NULL)
-	{
-		if (pHeader->FC.Type == BTYPE_DATA)
-		{
-			if (pRxD->U2M)
-				pAd->ate.U2M++;
-			else
-				pAd->ate.OtherData++;
-		}
-		else if (pHeader->FC.Type == BTYPE_MGMT)
-		{
-			if (pHeader->FC.SubType == SUBTYPE_BEACON)
-				pAd->ate.Beacon++;
-			else
-				pAd->ate.OtherCount++;
-		}
-		else if (pHeader->FC.Type == BTYPE_CNTL)
-		{
-			pAd->ate.OtherCount++;
-		}
-	}
-	pAd->ate.RSSI0 = pRxWI->RSSI0;
-	pAd->ate.RSSI1 = pRxWI->RSSI1;
-	pAd->ate.RSSI2 = pRxWI->RSSI2;
-	pAd->ate.SNR0 = pRxWI->SNR0;
-	pAd->ate.SNR1 = pRxWI->SNR1;
-}
-
-
-/* command id with Cmd Type == 0x0008(for 28xx)/0x0005(for iNIC) */
-#define RACFG_CMD_RF_WRITE_ALL		0x0000
-#define RACFG_CMD_E2PROM_READ16		0x0001
-#define RACFG_CMD_E2PROM_WRITE16	0x0002
-#define RACFG_CMD_E2PROM_READ_ALL	0x0003
-#define RACFG_CMD_E2PROM_WRITE_ALL	0x0004
-#define RACFG_CMD_IO_READ			0x0005
-#define RACFG_CMD_IO_WRITE			0x0006
-#define RACFG_CMD_IO_READ_BULK		0x0007
-#define RACFG_CMD_BBP_READ8			0x0008
-#define RACFG_CMD_BBP_WRITE8		0x0009
-#define RACFG_CMD_BBP_READ_ALL		0x000a
-#define RACFG_CMD_GET_COUNTER		0x000b
-#define RACFG_CMD_CLEAR_COUNTER		0x000c
-
-#define RACFG_CMD_RSV1				0x000d
-#define RACFG_CMD_RSV2				0x000e
-#define RACFG_CMD_RSV3				0x000f
-
-#define RACFG_CMD_TX_START			0x0010
-#define RACFG_CMD_GET_TX_STATUS		0x0011
-#define RACFG_CMD_TX_STOP			0x0012
-#define RACFG_CMD_RX_START			0x0013
-#define RACFG_CMD_RX_STOP			0x0014
-#define RACFG_CMD_GET_NOISE_LEVEL	0x0015
-
-#define RACFG_CMD_ATE_START			0x0080
-#define RACFG_CMD_ATE_STOP			0x0081
-
-#define RACFG_CMD_ATE_START_TX_CARRIER		0x0100
-#define RACFG_CMD_ATE_START_TX_CONT			0x0101
-#define RACFG_CMD_ATE_START_TX_FRAME		0x0102
-#define RACFG_CMD_ATE_SET_BW	            0x0103
-#define RACFG_CMD_ATE_SET_TX_POWER0	        0x0104
-#define RACFG_CMD_ATE_SET_TX_POWER1			0x0105
-#define RACFG_CMD_ATE_SET_FREQ_OFFSET		0x0106
-#define RACFG_CMD_ATE_GET_STATISTICS		0x0107
-#define RACFG_CMD_ATE_RESET_COUNTER			0x0108
-#define RACFG_CMD_ATE_SEL_TX_ANTENNA		0x0109
-#define RACFG_CMD_ATE_SEL_RX_ANTENNA		0x010a
-#define RACFG_CMD_ATE_SET_PREAMBLE			0x010b
-#define RACFG_CMD_ATE_SET_CHANNEL			0x010c
-#define RACFG_CMD_ATE_SET_ADDR1				0x010d
-#define RACFG_CMD_ATE_SET_ADDR2				0x010e
-#define RACFG_CMD_ATE_SET_ADDR3				0x010f
-#define RACFG_CMD_ATE_SET_RATE				0x0110
-#define RACFG_CMD_ATE_SET_TX_FRAME_LEN		0x0111
-#define RACFG_CMD_ATE_SET_TX_FRAME_COUNT	0x0112
-#define RACFG_CMD_ATE_START_RX_FRAME		0x0113
-#define RACFG_CMD_ATE_E2PROM_READ_BULK	0x0114
-#define RACFG_CMD_ATE_E2PROM_WRITE_BULK	0x0115
-#define RACFG_CMD_ATE_IO_WRITE_BULK		0x0116
-#define RACFG_CMD_ATE_BBP_READ_BULK		0x0117
-#define RACFG_CMD_ATE_BBP_WRITE_BULK	0x0118
-#define RACFG_CMD_ATE_RF_READ_BULK		0x0119
-#define RACFG_CMD_ATE_RF_WRITE_BULK		0x011a
-
-
-static VOID memcpy_exl(PRTMP_ADAPTER pAd, UCHAR *dst, UCHAR *src, ULONG len);
-static VOID memcpy_exs(PRTMP_ADAPTER pAd, UCHAR *dst, UCHAR *src, ULONG len);
-static VOID RTMP_IO_READ_BULK(PRTMP_ADAPTER pAd, UCHAR *dst, UCHAR *src, UINT32 len);
-
-
-
-VOID RtmpDoAte(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq)
-{
-	USHORT Command_Id;
-	INT	Status = NDIS_STATUS_SUCCESS;
-	struct ate_racfghdr *pRaCfg;
-
-
-	if ((pRaCfg = kmalloc(sizeof(struct ate_racfghdr), GFP_KERNEL)) == NULL)
-	{
-		Status = -EINVAL;
-		return;
-	}
-
-	NdisZeroMemory(pRaCfg, sizeof(struct ate_racfghdr));
-
-    if (copy_from_user((PUCHAR)pRaCfg, wrq->u.data.pointer, wrq->u.data.length))
-	{
-		Status = -EFAULT;
-		kfree(pRaCfg);
-		return;
-	}
-
-	Command_Id = ntohs(pRaCfg->command_id);
-
-	ATEDBGPRINT(RT_DEBUG_TRACE,("\n%s: Command_Id = 0x%04x !\n", __FUNCTION__, Command_Id));
-
-	switch (Command_Id)
-	{
-		/* We will get this command when QA starts. */
-		case RACFG_CMD_ATE_START:
-			Status=DO_RACFG_CMD_ATE_START(pAdapter,wrq,pRaCfg);
-			break;
-
-		/* We will get this command either QA is closed or ated is killed by user. */
-		case RACFG_CMD_ATE_STOP:
-			Status=DO_RACFG_CMD_ATE_STOP(pAdapter,wrq,pRaCfg);
-			break;
-
-		case RACFG_CMD_RF_WRITE_ALL:
-			Status=DO_RACFG_CMD_RF_WRITE_ALL(pAdapter,wrq,pRaCfg);
-			break;
-
-		case RACFG_CMD_E2PROM_READ16:
-			Status=DO_RACFG_CMD_E2PROM_READ16(pAdapter,wrq,pRaCfg);
-			break;
-
-		case RACFG_CMD_E2PROM_WRITE16:
-			Status=DO_RACFG_CMD_E2PROM_WRITE16(pAdapter,wrq,pRaCfg);
-			break;
-
-		case RACFG_CMD_E2PROM_READ_ALL:
-			Status=DO_RACFG_CMD_E2PROM_READ_ALL(pAdapter,wrq,pRaCfg);
-			break;
-
-		case RACFG_CMD_E2PROM_WRITE_ALL:
-			Status=DO_RACFG_CMD_E2PROM_WRITE_ALL(pAdapter,wrq,pRaCfg);
-			break;
-
-		case RACFG_CMD_IO_READ:
-			Status=DO_RACFG_CMD_IO_READ(pAdapter,wrq,pRaCfg);
-			break;
-
-		case RACFG_CMD_IO_WRITE:
-			Status=DO_RACFG_CMD_IO_WRITE(pAdapter,wrq,pRaCfg);
-			break;
-
-		case RACFG_CMD_IO_READ_BULK:
-			Status=DO_RACFG_CMD_IO_READ_BULK(pAdapter,wrq,pRaCfg);
-			break;
-
-		case RACFG_CMD_BBP_READ8:
-			Status=DO_RACFG_CMD_BBP_READ8(pAdapter,wrq,pRaCfg);
-			break;
-		case RACFG_CMD_BBP_WRITE8:
-			Status=DO_RACFG_CMD_BBP_WRITE8(pAdapter,wrq,pRaCfg);
-			break;
-
-		case RACFG_CMD_BBP_READ_ALL:
-			Status=DO_RACFG_CMD_BBP_READ_ALL(pAdapter,wrq,pRaCfg);
-			break;
-
-		case RACFG_CMD_ATE_E2PROM_READ_BULK:
-			Status=DO_RACFG_CMD_ATE_E2PROM_READ_BULK(pAdapter,wrq,pRaCfg);
-			break;
-
-		case RACFG_CMD_ATE_E2PROM_WRITE_BULK:
-			Status=DO_RACFG_CMD_ATE_E2PROM_WRITE_BULK(pAdapter,wrq,pRaCfg);
-			break;
-
-		case RACFG_CMD_ATE_IO_WRITE_BULK:
-			Status=DO_RACFG_CMD_ATE_IO_WRITE_BULK(pAdapter,wrq,pRaCfg);
-			break;
-
-		case RACFG_CMD_ATE_BBP_READ_BULK:
-			Status=DO_RACFG_CMD_ATE_BBP_READ_BULK(pAdapter,wrq,pRaCfg);
-			break;
-
-		case RACFG_CMD_ATE_BBP_WRITE_BULK:
-			Status=DO_RACFG_CMD_ATE_BBP_WRITE_BULK(pAdapter,wrq,pRaCfg);
-			break;
-
-
-		case RACFG_CMD_GET_NOISE_LEVEL:
-			Status=DO_RACFG_CMD_GET_NOISE_LEVEL(pAdapter,wrq,pRaCfg);
-			break;
-
-		case RACFG_CMD_GET_COUNTER:
-			Status=DO_RACFG_CMD_GET_COUNTER(pAdapter,wrq,pRaCfg);
-			break;
-
-		case RACFG_CMD_CLEAR_COUNTER:
-			Status=DO_RACFG_CMD_CLEAR_COUNTER(pAdapter,wrq,pRaCfg);
-			break;
-
-		case RACFG_CMD_TX_START:
-			Status=DO_RACFG_CMD_TX_START(pAdapter,wrq,pRaCfg);
-			break;
-
-		case RACFG_CMD_GET_TX_STATUS:
-			Status=DO_RACFG_CMD_GET_TX_STATUS(pAdapter,wrq,pRaCfg);
-			break;
-
-		case RACFG_CMD_TX_STOP:
-			Status=DO_RACFG_CMD_TX_STOP(pAdapter,wrq,pRaCfg);
-			break;
-
-		case RACFG_CMD_RX_START:
-			Status=DO_RACFG_CMD_RX_START(pAdapter,wrq,pRaCfg);
-			break;
-
-		case RACFG_CMD_RX_STOP:
-			Status=DO_RACFG_CMD_RX_STOP(pAdapter,wrq,pRaCfg);
-			break;
-
-		/* The following cases are for new ATE GUI(not QA). */
-		/*==================================================*/
-		case RACFG_CMD_ATE_START_TX_CARRIER:
-			Status=DO_RACFG_CMD_ATE_START_TX_CARRIER(pAdapter,wrq,pRaCfg);
-			break;
-
-		case RACFG_CMD_ATE_START_TX_CONT:
-			Status=DO_RACFG_CMD_ATE_START_TX_CONT(pAdapter,wrq,pRaCfg);
-			break;
-
-		case RACFG_CMD_ATE_START_TX_FRAME:
-			Status=DO_RACFG_CMD_ATE_START_TX_FRAME(pAdapter,wrq,pRaCfg);
-			break;
-
-		case RACFG_CMD_ATE_SET_BW:
-			Status=DO_RACFG_CMD_ATE_SET_BW(pAdapter,wrq,pRaCfg);
-			break;
-
-		case RACFG_CMD_ATE_SET_TX_POWER0:
-			Status=DO_RACFG_CMD_ATE_SET_TX_POWER0(pAdapter,wrq,pRaCfg);
-			break;
-
-		case RACFG_CMD_ATE_SET_TX_POWER1:
-			Status=DO_RACFG_CMD_ATE_SET_TX_POWER1(pAdapter,wrq,pRaCfg);
-			break;
-
-		case RACFG_CMD_ATE_SET_FREQ_OFFSET:
-			Status=DO_RACFG_CMD_ATE_SET_TX_POWER1(pAdapter,wrq,pRaCfg);
-			break;
-
-		case RACFG_CMD_ATE_GET_STATISTICS:
-			Status=DO_RACFG_CMD_ATE_GET_STATISTICS(pAdapter,wrq,pRaCfg);
-			break;
-
-		case RACFG_CMD_ATE_RESET_COUNTER:
-			Status=DO_RACFG_CMD_ATE_RESET_COUNTER(pAdapter,wrq,pRaCfg);
-			break;
-
-		case RACFG_CMD_ATE_SEL_TX_ANTENNA:
-			Status=DO_RACFG_CMD_ATE_SEL_TX_ANTENNA(pAdapter,wrq,pRaCfg);
-			break;
-
-		case RACFG_CMD_ATE_SEL_RX_ANTENNA:
-			Status=DO_RACFG_CMD_ATE_SEL_TX_ANTENNA(pAdapter,wrq,pRaCfg);
-			break;
-
-		case RACFG_CMD_ATE_SET_PREAMBLE:
-			Status=DO_RACFG_CMD_ATE_SET_PREAMBLE(pAdapter,wrq,pRaCfg);
-			break;
-
-		case RACFG_CMD_ATE_SET_CHANNEL:
-			Status=DO_RACFG_CMD_ATE_SET_CHANNEL(pAdapter,wrq,pRaCfg);
-			break;
-
-		case RACFG_CMD_ATE_SET_ADDR1:
-			Status=DO_RACFG_CMD_ATE_SET_ADDR1(pAdapter,wrq,pRaCfg);
-			break;
-
-		case RACFG_CMD_ATE_SET_ADDR2:
-			Status=DO_RACFG_CMD_ATE_SET_ADDR2(pAdapter,wrq,pRaCfg);
-			break;
-
-		case RACFG_CMD_ATE_SET_ADDR3:
-			Status=DO_RACFG_CMD_ATE_SET_ADDR3(pAdapter,wrq,pRaCfg);
-			break;
-
-		case RACFG_CMD_ATE_SET_RATE:
-			Status=DO_RACFG_CMD_ATE_SET_RATE(pAdapter,wrq,pRaCfg);
-			break;
-
-		case RACFG_CMD_ATE_SET_TX_FRAME_LEN:
-			Status=DO_RACFG_CMD_ATE_SET_TX_FRAME_LEN(pAdapter,wrq,pRaCfg);
-			break;
-
-		case RACFG_CMD_ATE_SET_TX_FRAME_COUNT:
-			Status=DO_RACFG_CMD_ATE_SET_TX_FRAME_COUNT(pAdapter,wrq,pRaCfg);
-			break;
-
-		case RACFG_CMD_ATE_START_RX_FRAME:
-			Status=DO_RACFG_CMD_ATE_START_RX_FRAME(pAdapter,wrq,pRaCfg);
-			break;
-		default:
-			break;
-	}
-
-    ASSERT(pRaCfg != NULL);
-
-    if (pRaCfg != NULL)
-	    kfree(pRaCfg);
-
-	return;
-}
-
-
-VOID BubbleSort(INT32 n, INT32 a[])
-{
-	INT32 k, j, temp;
-
-	for (k = n-1;  k>0;  k--)
-	{
-		for (j = 0; j<k; j++)
-		{
-			if (a[j] > a[j+1])
-			{
-				temp = a[j];
-				a[j]=a[j+1];
-				a[j+1]=temp;
-			}
-		}
-	}
-}
-
-
-VOID CalNoiseLevel(PRTMP_ADAPTER pAd, UCHAR channel, INT32 RSSI[3][10])
-{
-	INT32		RSSI0, RSSI1, RSSI2;
-	CHAR		Rssi0Offset, Rssi1Offset, Rssi2Offset;
-	UCHAR		BbpR50Rssi0 = 0, BbpR51Rssi1 = 0, BbpR52Rssi2 = 0;
-	UCHAR		Org_BBP66value = 0, Org_BBP69value = 0, Org_BBP70value = 0, data = 0;
-	USHORT		LNA_Gain = 0;
-	INT32       j = 0;
-	UCHAR		Org_Channel = pAd->ate.Channel;
-	USHORT	    GainValue = 0, OffsetValue = 0;
-
-	ATE_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R66, &Org_BBP66value);
-	ATE_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R69, &Org_BBP69value);
-	ATE_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R70, &Org_BBP70value);
-
-	//**********************************************************************
-	// Read the value of LNA gain and Rssi offset
-	//**********************************************************************
-	RT28xx_EEPROM_READ16(pAd, EEPROM_LNA_OFFSET, GainValue);
-
-	// for Noise Level
-	if (channel <= 14)
-	{
-		LNA_Gain = GainValue & 0x00FF;
-
-		RT28xx_EEPROM_READ16(pAd, EEPROM_RSSI_BG_OFFSET, OffsetValue);
-		Rssi0Offset = OffsetValue & 0x00FF;
-		Rssi1Offset = (OffsetValue & 0xFF00) >> 8;
-		RT28xx_EEPROM_READ16(pAd, (EEPROM_RSSI_BG_OFFSET + 2)/* 0x48 */, OffsetValue);
-		Rssi2Offset = OffsetValue & 0x00FF;
-	}
-	else
-	{
-		LNA_Gain = (GainValue & 0xFF00) >> 8;
-
-		RT28xx_EEPROM_READ16(pAd, EEPROM_RSSI_A_OFFSET, OffsetValue);
-		Rssi0Offset = OffsetValue & 0x00FF;
-		Rssi1Offset = (OffsetValue & 0xFF00) >> 8;
-		RT28xx_EEPROM_READ16(pAd, (EEPROM_RSSI_A_OFFSET + 2)/* 0x4C */, OffsetValue);
-		Rssi2Offset = OffsetValue & 0x00FF;
-	}
-	//**********************************************************************
-	{
-		pAd->ate.Channel = channel;
-		ATEAsicSwitchChannel(pAd);
-		mdelay(5);
-
-		data = 0x10;
-		ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R66, data);
-		data = 0x40;
-		ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R69, data);
-		data = 0x40;
-		ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R70, data);
-		mdelay(5);
-
-		// start Rx
-		pAd->ate.bQARxStart = TRUE;
-		Set_ATE_Proc(pAd, "RXFRAME");
-
-		mdelay(5);
-
-		for (j = 0; j < 10; j++)
-		{
-			ATE_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R50, &BbpR50Rssi0);
-			ATE_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R51, &BbpR51Rssi1);
-			ATE_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R52, &BbpR52Rssi2);
-
-			mdelay(10);
-
-			// calculate RSSI 0
-			if (BbpR50Rssi0 == 0)
-			{
-				RSSI0 = -100;
-			}
-			else
-			{
-				RSSI0 = (INT32)(-12 - BbpR50Rssi0 - LNA_Gain - Rssi0Offset);
-			}
-			RSSI[0][j] = RSSI0;
-
-			if ( pAd->Antenna.field.RxPath >= 2 ) // 2R
-			{
-				// calculate RSSI 1
-				if (BbpR51Rssi1 == 0)
-				{
-					RSSI1 = -100;
-				}
-				else
-				{
-					RSSI1 = (INT32)(-12 - BbpR51Rssi1 - LNA_Gain - Rssi1Offset);
-				}
-				RSSI[1][j] = RSSI1;
-			}
-
-			if ( pAd->Antenna.field.RxPath >= 3 ) // 3R
-			{
-				// calculate RSSI 2
-				if (BbpR52Rssi2 == 0)
-					RSSI2 = -100;
-				else
-					RSSI2 = (INT32)(-12 - BbpR52Rssi2 - LNA_Gain - Rssi2Offset);
-
-				RSSI[2][j] = RSSI2;
-			}
-		}
-
-		// stop Rx
-		Set_ATE_Proc(pAd, "RXSTOP");
-
-		mdelay(5);
-
-		BubbleSort(10, RSSI[0]);	// 1R
-
-		if ( pAd->Antenna.field.RxPath >= 2 ) // 2R
-		{
-			BubbleSort(10, RSSI[1]);
-		}
-
-		if ( pAd->Antenna.field.RxPath >= 3 ) // 3R
-		{
-			BubbleSort(10, RSSI[2]);
-		}
-	}
-
-	pAd->ate.Channel = Org_Channel;
-	ATEAsicSwitchChannel(pAd);
-
-	// restore original value
-    ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R66, Org_BBP66value);
-    ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R69, Org_BBP69value);
-    ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R70, Org_BBP70value);
-
-	return;
-}
-
-
-BOOLEAN SyncTxRxConfig(PRTMP_ADAPTER pAd, USHORT offset, UCHAR value)
-{
-	UCHAR tmp = 0, bbp_data = 0;
-
-	if (ATE_ON(pAd))
-	{
-		ATE_BBP_IO_READ8_BY_REG_ID(pAd, offset, &bbp_data);
-	}
-	else
-	{
-		RTMP_BBP_IO_READ8_BY_REG_ID(pAd, offset, &bbp_data);
-	}
-
-	/* confirm again */
-	ASSERT(bbp_data == value);
-
-	switch (offset)
-	{
-		case BBP_R1:
-			/* Need to synchronize tx configuration with legacy ATE. */
-			tmp = (bbp_data & ((1 << 4) | (1 << 3))/* 0x18 */) >> 3;
-		    switch (tmp)
-		    {
-				/* The BBP R1 bit[4:3] = 2 :: Both DACs will be used by QA. */
-		        case 2:
-					/* All */
-					pAd->ate.TxAntennaSel = 0;
-		            break;
-				/* The BBP R1 bit[4:3] = 0 :: DAC 0 will be used by QA. */
-		        case 0:
-					/* Antenna one */
-					pAd->ate.TxAntennaSel = 1;
-		            break;
-				/* The BBP R1 bit[4:3] = 1 :: DAC 1 will be used by QA. */
-		        case 1:
-					/* Antenna two */
-					pAd->ate.TxAntennaSel = 2;
-		            break;
-		        default:
-		            DBGPRINT(RT_DEBUG_TRACE, ("%s -- Sth. wrong!  : return FALSE; \n", __FUNCTION__));
-		            return FALSE;
-		    }
-			break;/* case BBP_R1 */
-
-		case BBP_R3:
-			/* Need to synchronize rx configuration with legacy ATE. */
-			tmp = (bbp_data & ((1 << 1) | (1 << 0))/* 0x03 */);
-		    switch(tmp)
-		    {
-				/* The BBP R3 bit[1:0] = 3 :: All ADCs will be used by QA. */
-		        case 3:
-					/* All */
-					pAd->ate.RxAntennaSel = 0;
-		            break;
-				/*
-					The BBP R3 bit[1:0] = 0 :: ADC 0 will be used by QA,
-					unless the BBP R3 bit[4:3] = 2
-				*/
-		        case 0:
-					/* Antenna one */
-					pAd->ate.RxAntennaSel = 1;
-					tmp = ((bbp_data & ((1 << 4) | (1 << 3))/* 0x03 */) >> 3);
-					if (tmp == 2)// 3R
-					{
-						/* Default : All ADCs will be used by QA */
-						pAd->ate.RxAntennaSel = 0;
-					}
-		            break;
-				/* The BBP R3 bit[1:0] = 1 :: ADC 1 will be used by QA. */
-		        case 1:
-					/* Antenna two */
-					pAd->ate.RxAntennaSel = 2;
-		            break;
-				/* The BBP R3 bit[1:0] = 2 :: ADC 2 will be used by QA. */
-		        case 2:
-					/* Antenna three */
-					pAd->ate.RxAntennaSel = 3;
-		            break;
-		        default:
-		            DBGPRINT(RT_DEBUG_ERROR, ("%s -- Impossible!  : return FALSE; \n", __FUNCTION__));
-		            return FALSE;
-		    }
-			break;/* case BBP_R3 */
-
-        default:
-            DBGPRINT(RT_DEBUG_ERROR, ("%s -- Sth. wrong!  : return FALSE; \n", __FUNCTION__));
-            return FALSE;
-
-	}
-	return TRUE;
-}
-
-
-static VOID memcpy_exl(PRTMP_ADAPTER pAd, UCHAR *dst, UCHAR *src, ULONG len)
-{
-	ULONG i, Value = 0;
-	ULONG *pDst, *pSrc;
-	UCHAR *p8;
-
-	p8 = src;
-	pDst = (ULONG *) dst;
-	pSrc = (ULONG *) src;
-
-	for (i = 0 ; i < (len/4); i++)
-	{
-		/* For alignment issue, we need a variable "Value". */
-		memmove(&Value, pSrc, 4);
-		Value = htonl(Value);
-		memmove(pDst, &Value, 4);
-		pDst++;
-		pSrc++;
-	}
-	if ((len % 4) != 0)
-	{
-		/* wish that it will never reach here */
-		memmove(&Value, pSrc, (len % 4));
-		Value = htonl(Value);
-		memmove(pDst, &Value, (len % 4));
-	}
-}
-
-
-static VOID memcpy_exs(PRTMP_ADAPTER pAd, UCHAR *dst, UCHAR *src, ULONG len)
-{
-	ULONG i;
-	UCHAR *pDst, *pSrc;
-
-	pDst = dst;
-	pSrc = src;
-
-	for (i = 0; i < (len/2); i++)
-	{
-		memmove(pDst, pSrc, 2);
-		*((USHORT *)pDst) = htons(*((USHORT *)pDst));
-		pDst+=2;
-		pSrc+=2;
-	}
-
-	if ((len % 2) != 0)
-	{
-		memmove(pDst, pSrc, 1);
-	}
-}
-
-
-static VOID RTMP_IO_READ_BULK(PRTMP_ADAPTER pAd, UCHAR *dst, UCHAR *src, UINT32 len)
-{
-	UINT32 i, Value;
-	UINT32 *pDst, *pSrc;
-
-	pDst = (UINT32 *) dst;
-	pSrc = (UINT32 *) src;
-
-	for (i = 0 ; i < (len/4); i++)
-	{
-		RTMP_IO_READ32(pAd, (ULONG)pSrc, &Value);
-		Value = htonl(Value);
-		memmove(pDst, &Value, 4);
-		pDst++;
-		pSrc++;
-	}
-	return;
-}
-
-
-INT Set_TxStop_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	ATEDBGPRINT(RT_DEBUG_TRACE,("Set_TxStop_Proc\n"));
-
-	if (Set_ATE_Proc(pAd, "TXSTOP"))
-	{
-		return TRUE;
-	}
-	else
-	{
-		return FALSE;
-	}
-}
-
-
-INT Set_RxStop_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	ATEDBGPRINT(RT_DEBUG_TRACE,("Set_RxStop_Proc\n"));
-
-	if (Set_ATE_Proc(pAd, "RXSTOP"))
-	{
-		return TRUE;
-	}
-	else
-	{
-		return FALSE;
-	}
-}
-
-
-#ifdef DBG
-INT Set_EERead_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	USHORT buffer[EEPROM_SIZE/2];
-	USHORT *p;
-	INT i;
-
-	rt_ee_read_all(pAd, (USHORT *)buffer);
-	p = buffer;
-
-	for (i = 0; i < (EEPROM_SIZE/2); i++)
-	{
-		ate_print(KERN_EMERG "%4.4x ", *p);
-		if (((i+1) % 16) == 0)
-			ate_print(KERN_EMERG "\n");
-		p++;
-	}
-
-	return TRUE;
-}
-
-
-INT Set_EEWrite_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	USHORT offset = 0, value;
-	PSTRING p2 = arg;
-
-	while ((*p2 != ':') && (*p2 != '\0'))
-	{
-		p2++;
-	}
-
-	if (*p2 == ':')
-	{
-		A2Hex(offset, arg);
-		A2Hex(value, p2 + 1);
-	}
-	else
-	{
-		A2Hex(value, arg);
-	}
-
-	if (offset >= EEPROM_SIZE)
-	{
-		ate_print(KERN_EMERG "Offset can not exceed EEPROM_SIZE( == 0x%04x)\n", EEPROM_SIZE);
-		return FALSE;
-	}
-
-	RT28xx_EEPROM_WRITE16(pAd, offset, value);
-
-	return TRUE;
-}
-
-
-INT Set_BBPRead_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	UCHAR value = 0, offset;
-
-	A2Hex(offset, arg);
-
-	if (ATE_ON(pAd))
-	{
-		ATE_BBP_IO_READ8_BY_REG_ID(pAd, offset,  &value);
-	}
-	else
-	{
-		RTMP_BBP_IO_READ8_BY_REG_ID(pAd, offset,  &value);
-	}
-
-	ate_print(KERN_EMERG "%x\n", value);
-
-	return TRUE;
-}
-
-
-INT Set_BBPWrite_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	USHORT offset = 0;
-	PSTRING p2 = arg;
-	UCHAR value;
-
-	while ((*p2 != ':') && (*p2 != '\0'))
-	{
-		p2++;
-	}
-
-	if (*p2 == ':')
-	{
-		A2Hex(offset, arg);
-		A2Hex(value, p2 + 1);
-	}
-	else
-	{
-		A2Hex(value, arg);
-	}
-
-	if (ATE_ON(pAd))
-	{
-		ATE_BBP_IO_WRITE8_BY_REG_ID(pAd, offset,  value);
-	}
-	else
-	{
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, offset,  value);
-	}
-
-	return TRUE;
-}
-
-
-INT Set_RFWrite_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	PSTRING p2, p3, p4;
-	UINT32 R1, R2, R3, R4;
-
-	p2 = arg;
-
-	while ((*p2 != ':') && (*p2 != '\0'))
-	{
-		p2++;
-	}
-
-	if (*p2 != ':')
-		return FALSE;
-
-	p3 = p2 + 1;
-
-	while((*p3 != ':') && (*p3 != '\0'))
-	{
-		p3++;
-	}
-
-	if (*p3 != ':')
-		return FALSE;
-
-	p4 = p3 + 1;
-
-	while ((*p4 != ':') && (*p4 != '\0'))
-	{
-		p4++;
-	}
-
-	if (*p4 != ':')
-		return FALSE;
-
-
-	A2Hex(R1, arg);
-	A2Hex(R2, p2 + 1);
-	A2Hex(R3, p3 + 1);
-	A2Hex(R4, p4 + 1);
-
-	RTMP_RF_IO_WRITE32(pAd, R1);
-	RTMP_RF_IO_WRITE32(pAd, R2);
-	RTMP_RF_IO_WRITE32(pAd, R3);
-	RTMP_RF_IO_WRITE32(pAd, R4);
-
-	return TRUE;
-}
-#endif // DBG //
-#endif // RALINK_28xx_QA //
-
-
-
-
-#ifdef RALINK_28xx_QA
-#define	LEN_OF_ARG 16
-
-#define RESPONSE_TO_GUI(__pRaCfg, __pwrq, __Length, __Status)									\
-	(__pRaCfg)->length = htons((__Length));														\
-	(__pRaCfg)->status = htons((__Status));														\
-	(__pwrq)->u.data.length = sizeof((__pRaCfg)->magic_no) + sizeof((__pRaCfg)->command_type)	\
-							+ sizeof((__pRaCfg)->command_id) + sizeof((__pRaCfg)->length)		\
-							+ sizeof((__pRaCfg)->sequence) + ntohs((__pRaCfg)->length);			\
-	ATEDBGPRINT(RT_DEBUG_TRACE, ("wrq->u.data.length = %d\n", (__pwrq)->u.data.length));		\
-	if (copy_to_user((__pwrq)->u.data.pointer, (UCHAR *)(__pRaCfg), (__pwrq)->u.data.length))	\
-	{																							\
-		ATEDBGPRINT(RT_DEBUG_ERROR, ("copy_to_user() fail in %s\n", __FUNCTION__));				\
-		return (-EFAULT);																		\
-	}																							\
-	else																						\
-	{																							\
-		ATEDBGPRINT(RT_DEBUG_TRACE, ("%s is done !\n", __FUNCTION__));							\
-	}
-
-static inline INT	DO_RACFG_CMD_ATE_START(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN  struct ate_racfghdr *pRaCfg)
-{
-	ATEDBGPRINT(RT_DEBUG_TRACE,("RACFG_CMD_ATE_START\n"));
-
-	/* Prepare feedback as soon as we can to avoid QA timeout. */
-	RESPONSE_TO_GUI(pRaCfg, wrq, sizeof(pRaCfg->status), NDIS_STATUS_SUCCESS);
-	Set_ATE_Proc(pAdapter, "ATESTART");
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-static inline INT DO_RACFG_CMD_ATE_STOP(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN  struct ate_racfghdr *pRaCfg)
-{
-	INT32 ret;
-
-	ATEDBGPRINT(RT_DEBUG_TRACE,("RACFG_CMD_ATE_STOP\n"));
-
-	/*
-		Distinguish this command came from QA(via ate agent)
-		or ate agent according to the existence of pid in payload.
-
-		No need to prepare feedback if this cmd came directly from ate agent,
-		not from QA.
-	*/
-	pRaCfg->length = ntohs(pRaCfg->length);
-
-	if (pRaCfg->length == sizeof(pAdapter->ate.AtePid))
-	{
-		/*
-			This command came from QA.
-			Get the pid of ATE agent.
-		*/
-		memcpy((UCHAR *)&pAdapter->ate.AtePid,
-						(&pRaCfg->data[0]) - 2/* == sizeof(pRaCfg->status) */,
-						sizeof(pAdapter->ate.AtePid));
-
-		/* Prepare feedback as soon as we can to avoid QA timeout. */
-		RESPONSE_TO_GUI(pRaCfg, wrq, sizeof(pRaCfg->status), NDIS_STATUS_SUCCESS);
-
-		/*
-			Kill ATE agent when leaving ATE mode.
-
-			We must kill ATE agent first before setting ATESTOP,
-			or Microsoft will report sth. wrong.
-		*/
-		ret = KILL_THREAD_PID(pAdapter->ate.AtePid, SIGTERM, 1);
-
-		if (ret)
-		{
-			ATEDBGPRINT(RT_DEBUG_ERROR, ("%s: unable to kill ate thread\n", pAdapter->net_dev->name));
-		}
-	}
-
-
-	/* AP/STA might have in ATE_STOP mode due to cmd from QA. */
-	if (ATE_ON(pAdapter))
-	{
-		/* Someone has killed ate agent while QA GUI is still open. */
-		Set_ATE_Proc(pAdapter, "ATESTOP");
-		ATEDBGPRINT(RT_DEBUG_TRACE, ("RACFG_CMD_AP_START is done !\n"));
-	}
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-static inline INT DO_RACFG_CMD_RF_WRITE_ALL(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN  struct ate_racfghdr *pRaCfg)
-{
-	UINT32 R1, R2, R3, R4;
-	USHORT channel;
-
-	memcpy(&R1, pRaCfg->data-2, 4);
-	memcpy(&R2, pRaCfg->data+2, 4);
-	memcpy(&R3, pRaCfg->data+6, 4);
-	memcpy(&R4, pRaCfg->data+10, 4);
-	memcpy(&channel, pRaCfg->data+14, 2);
-
-	pAdapter->LatchRfRegs.R1 = ntohl(R1);
-	pAdapter->LatchRfRegs.R2 = ntohl(R2);
-	pAdapter->LatchRfRegs.R3 = ntohl(R3);
-	pAdapter->LatchRfRegs.R4 = ntohl(R4);
-	pAdapter->LatchRfRegs.Channel = ntohs(channel);
-
-	RTMP_RF_IO_WRITE32(pAdapter, pAdapter->LatchRfRegs.R1);
-	RTMP_RF_IO_WRITE32(pAdapter, pAdapter->LatchRfRegs.R2);
-	RTMP_RF_IO_WRITE32(pAdapter, pAdapter->LatchRfRegs.R3);
-	RTMP_RF_IO_WRITE32(pAdapter, pAdapter->LatchRfRegs.R4);
-
-	RESPONSE_TO_GUI(pRaCfg, wrq, sizeof(pRaCfg->status), NDIS_STATUS_SUCCESS);
-
-	return  NDIS_STATUS_SUCCESS;
-}
-
-
-static inline INT DO_RACFG_CMD_E2PROM_READ16(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN  struct ate_racfghdr *pRaCfg)
-{
-	UINT16	offset=0, value=0;
-	USHORT  tmp=0;
-
-	offset = ntohs(pRaCfg->status);
-
-	/* "tmp" is especially for some compilers... */
-	RT28xx_EEPROM_READ16(pAdapter, offset, tmp);
-	value = tmp;
-	value = htons(value);
-
-	ATEDBGPRINT(RT_DEBUG_TRACE,("EEPROM Read offset = 0x%04x, value = 0x%04x\n", offset, value));
-	memcpy(pRaCfg->data, &value, 2);
-
-	RESPONSE_TO_GUI(pRaCfg, wrq, sizeof(pRaCfg->status)+2, NDIS_STATUS_SUCCESS);
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-static inline INT DO_RACFG_CMD_E2PROM_WRITE16(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN  struct ate_racfghdr *pRaCfg)
-{
-	USHORT	offset, value;
-
-	offset = ntohs(pRaCfg->status);
-	memcpy(&value, pRaCfg->data, 2);
-	value = ntohs(value);
-	RT28xx_EEPROM_WRITE16(pAdapter, offset, value);
-
-	RESPONSE_TO_GUI(pRaCfg, wrq, sizeof(pRaCfg->status), NDIS_STATUS_SUCCESS);
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-static inline INT DO_RACFG_CMD_E2PROM_READ_ALL(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN  struct ate_racfghdr *pRaCfg)
-{
-	USHORT buffer[EEPROM_SIZE/2];
-
-	rt_ee_read_all(pAdapter,(USHORT *)buffer);
-	memcpy_exs(pAdapter, pRaCfg->data, (UCHAR *)buffer, EEPROM_SIZE);
-
-	RESPONSE_TO_GUI(pRaCfg, wrq, sizeof(pRaCfg->status)+EEPROM_SIZE, NDIS_STATUS_SUCCESS);
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-static inline INT DO_RACFG_CMD_E2PROM_WRITE_ALL(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN  struct ate_racfghdr *pRaCfg)
-{
-	USHORT buffer[EEPROM_SIZE/2];
-
-	NdisZeroMemory((UCHAR *)buffer, EEPROM_SIZE);
-	memcpy_exs(pAdapter, (UCHAR *)buffer, (UCHAR *)&pRaCfg->status, EEPROM_SIZE);
-	rt_ee_write_all(pAdapter,(USHORT *)buffer);
-
-	RESPONSE_TO_GUI(pRaCfg, wrq, sizeof(pRaCfg->status), NDIS_STATUS_SUCCESS);
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-static inline INT DO_RACFG_CMD_IO_READ(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN  struct ate_racfghdr *pRaCfg)
-{
-	UINT32	offset;
-	UINT32	value;
-
-	memcpy(&offset, &pRaCfg->status, 4);
-	offset = ntohl(offset);
-
-	/*
-		We do not need the base address.
-		So just extract the offset out.
-	*/
-	offset &= 0x0000FFFF;
-	RTMP_IO_READ32(pAdapter, offset, &value);
-	value = htonl(value);
-	memcpy(pRaCfg->data, &value, 4);
-
-	RESPONSE_TO_GUI(pRaCfg, wrq, sizeof(pRaCfg->status)+4, NDIS_STATUS_SUCCESS);
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-static inline INT DO_RACFG_CMD_IO_WRITE(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN  struct ate_racfghdr *pRaCfg)
-{
-	UINT32	offset, value;
-
-	memcpy(&offset, pRaCfg->data-2, 4);
-	memcpy(&value, pRaCfg->data+2, 4);
-
-	offset = ntohl(offset);
-
-	/*
-		We do not need the base address.
-		So just extract the offset out.
-	*/
-	offset &= 0x0000FFFF;
-	value = ntohl(value);
-	ATEDBGPRINT(RT_DEBUG_TRACE,("RACFG_CMD_IO_WRITE: offset = %x, value = %x\n", offset, value));
-	RTMP_IO_WRITE32(pAdapter, offset, value);
-
-	RESPONSE_TO_GUI(pRaCfg, wrq, sizeof(pRaCfg->status), NDIS_STATUS_SUCCESS);
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-static inline INT DO_RACFG_CMD_IO_READ_BULK(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN  struct ate_racfghdr *pRaCfg)
-{
-	UINT32	offset;
-	USHORT	len;
-
-	memcpy(&offset, &pRaCfg->status, 4);
-	offset = ntohl(offset);
-
-	/*
-		We do not need the base address.
-		So just extract the offset out.
-	*/
-	offset &= 0x0000FFFF;
-	memcpy(&len, pRaCfg->data+2, 2);
-	len = ntohs(len);
-
-	if (len > 371)
-	{
-		ATEDBGPRINT(RT_DEBUG_TRACE,("length requested is too large, make it smaller\n"));
-		pRaCfg->length = htons(2);
-		pRaCfg->status = htons(1);
-		return -EFAULT;
-	}
-
-	RTMP_IO_READ_BULK(pAdapter, pRaCfg->data, (UCHAR *)offset, len*4);// unit in four bytes
-
-	RESPONSE_TO_GUI(pRaCfg, wrq, sizeof(pRaCfg->status)+(len*4), NDIS_STATUS_SUCCESS);
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-static inline INT DO_RACFG_CMD_BBP_READ8(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN  struct ate_racfghdr *pRaCfg)
-{
-	USHORT	offset;
-	UCHAR	value;
-
-	value = 0;
-	offset = ntohs(pRaCfg->status);
-
-	if (ATE_ON(pAdapter))
-	{
-		ATE_BBP_IO_READ8_BY_REG_ID(pAdapter, offset, &value);
-	}
-	else
-	{
-		RTMP_BBP_IO_READ8_BY_REG_ID(pAdapter, offset, &value);
-	}
-
-	pRaCfg->data[0] = value;
-
-	RESPONSE_TO_GUI(pRaCfg, wrq, sizeof(pRaCfg->status)+1, NDIS_STATUS_SUCCESS);
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-static inline INT DO_RACFG_CMD_BBP_WRITE8(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN  struct ate_racfghdr *pRaCfg)
-{
-	USHORT	offset;
-	UCHAR	value;
-
-	offset = ntohs(pRaCfg->status);
-	memcpy(&value, pRaCfg->data, 1);
-
-	if (ATE_ON(pAdapter))
-	{
-		ATE_BBP_IO_WRITE8_BY_REG_ID(pAdapter, offset, value);
-	}
-	else
-	{
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAdapter, offset, value);
-	}
-
-	if ((offset == BBP_R1) || (offset == BBP_R3))
-	{
-		SyncTxRxConfig(pAdapter, offset, value);
-	}
-
-	RESPONSE_TO_GUI(pRaCfg, wrq, sizeof(pRaCfg->status), NDIS_STATUS_SUCCESS);
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-static inline INT DO_RACFG_CMD_BBP_READ_ALL(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN  struct ate_racfghdr *pRaCfg)
-{
-	USHORT bbp_reg_index;
-
-	for (bbp_reg_index = 0; bbp_reg_index < MAX_BBP_ID+1; bbp_reg_index++)
-	{
-		pRaCfg->data[bbp_reg_index] = 0;
-
-		if (ATE_ON(pAdapter))
-		{
-			ATE_BBP_IO_READ8_BY_REG_ID(pAdapter, bbp_reg_index, &pRaCfg->data[bbp_reg_index]);
-		}
-		else
-		{
-			RTMP_BBP_IO_READ8_BY_REG_ID(pAdapter, bbp_reg_index, &pRaCfg->data[bbp_reg_index]);
-		}
-	}
-
-	RESPONSE_TO_GUI(pRaCfg, wrq, sizeof(pRaCfg->status)+MAX_BBP_ID+1, NDIS_STATUS_SUCCESS);
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-static inline INT DO_RACFG_CMD_GET_NOISE_LEVEL(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN  struct ate_racfghdr *pRaCfg)
-{
-	UCHAR	channel;
-	INT32   buffer[3][10];/* 3 : RxPath ; 10 : no. of per rssi samples */
-
-	channel = (ntohs(pRaCfg->status) & 0x00FF);
-	CalNoiseLevel(pAdapter, channel, buffer);
-	memcpy_exl(pAdapter, (UCHAR *)pRaCfg->data, (UCHAR *)&(buffer[0][0]), (sizeof(INT32)*3*10));
-
-	RESPONSE_TO_GUI(pRaCfg, wrq, sizeof(pRaCfg->status)+(sizeof(INT32)*3*10), NDIS_STATUS_SUCCESS);
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-static inline INT DO_RACFG_CMD_GET_COUNTER(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN  struct ate_racfghdr *pRaCfg)
-{
-	memcpy_exl(pAdapter, &pRaCfg->data[0], (UCHAR *)&pAdapter->ate.U2M, 4);
-	memcpy_exl(pAdapter, &pRaCfg->data[4], (UCHAR *)&pAdapter->ate.OtherData, 4);
-	memcpy_exl(pAdapter, &pRaCfg->data[8], (UCHAR *)&pAdapter->ate.Beacon, 4);
-	memcpy_exl(pAdapter, &pRaCfg->data[12], (UCHAR *)&pAdapter->ate.OtherCount, 4);
-	memcpy_exl(pAdapter, &pRaCfg->data[16], (UCHAR *)&pAdapter->ate.TxAc0, 4);
-	memcpy_exl(pAdapter, &pRaCfg->data[20], (UCHAR *)&pAdapter->ate.TxAc1, 4);
-	memcpy_exl(pAdapter, &pRaCfg->data[24], (UCHAR *)&pAdapter->ate.TxAc2, 4);
-	memcpy_exl(pAdapter, &pRaCfg->data[28], (UCHAR *)&pAdapter->ate.TxAc3, 4);
-	/*memcpy_exl(pAdapter, &pRaCfg->data[32], (UCHAR *)&pAdapter->ate.TxHCCA, 4);*/
-	memcpy_exl(pAdapter, &pRaCfg->data[36], (UCHAR *)&pAdapter->ate.TxMgmt, 4);
-	memcpy_exl(pAdapter, &pRaCfg->data[40], (UCHAR *)&pAdapter->ate.RSSI0, 4);
-	memcpy_exl(pAdapter, &pRaCfg->data[44], (UCHAR *)&pAdapter->ate.RSSI1, 4);
-	memcpy_exl(pAdapter, &pRaCfg->data[48], (UCHAR *)&pAdapter->ate.RSSI2, 4);
-	memcpy_exl(pAdapter, &pRaCfg->data[52], (UCHAR *)&pAdapter->ate.SNR0, 4);
-	memcpy_exl(pAdapter, &pRaCfg->data[56], (UCHAR *)&pAdapter->ate.SNR1, 4);
-
-	RESPONSE_TO_GUI(pRaCfg, wrq, sizeof(pRaCfg->status)+60, NDIS_STATUS_SUCCESS);
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-static inline INT DO_RACFG_CMD_CLEAR_COUNTER(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN  struct ate_racfghdr *pRaCfg)
-{
-	pAdapter->ate.U2M = 0;
-	pAdapter->ate.OtherData = 0;
-	pAdapter->ate.Beacon = 0;
-	pAdapter->ate.OtherCount = 0;
-	pAdapter->ate.TxAc0 = 0;
-	pAdapter->ate.TxAc1 = 0;
-	pAdapter->ate.TxAc2 = 0;
-	pAdapter->ate.TxAc3 = 0;
-	/*pAdapter->ate.TxHCCA = 0;*/
-	pAdapter->ate.TxMgmt = 0;
-	pAdapter->ate.TxDoneCount = 0;
-
-	RESPONSE_TO_GUI(pRaCfg, wrq, sizeof(pRaCfg->status), NDIS_STATUS_SUCCESS);
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-static inline INT DO_RACFG_CMD_TX_START(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN  struct ate_racfghdr *pRaCfg)
-{
-	USHORT *p;
-	USHORT	err = 1;
-	UCHAR   Bbp22Value = 0, Bbp24Value = 0;
-
-	if ((pAdapter->ate.TxStatus != 0) && (pAdapter->ate.Mode & ATE_TXFRAME))
-	{
-		ATEDBGPRINT(RT_DEBUG_TRACE,("Ate Tx is already running, to run next Tx, you must stop it first\n"));
-		err = 2;
-		goto TX_START_ERROR;
-	}
-	else if ((pAdapter->ate.TxStatus != 0) && !(pAdapter->ate.Mode & ATE_TXFRAME))
-	{
-		int i = 0;
-
-		while ((i++ < 10) && (pAdapter->ate.TxStatus != 0))
-		{
-			RTMPusecDelay(5000);
-		}
-
-		/* force it to stop */
-		pAdapter->ate.TxStatus = 0;
-		pAdapter->ate.TxDoneCount = 0;
-		pAdapter->ate.bQATxStart = FALSE;
-	}
-
-	/*
-		If pRaCfg->length == 0, this "RACFG_CMD_TX_START"
-		is for Carrier test or Carrier Suppression.
-	*/
-	if (ntohs(pRaCfg->length) != 0)
-	{
-		/* get frame info */
-
-		NdisMoveMemory(&pAdapter->ate.TxWI, pRaCfg->data + 2, 16);
-#ifdef RT_BIG_ENDIAN
-		RTMPWIEndianChange((PUCHAR)&pAdapter->ate.TxWI, TYPE_TXWI);
-#endif // RT_BIG_ENDIAN //
-
-		NdisMoveMemory(&pAdapter->ate.TxCount, pRaCfg->data + 18, 4);
-		pAdapter->ate.TxCount = ntohl(pAdapter->ate.TxCount);
-
-		p = (USHORT *)(&pRaCfg->data[22]);
-
-		/* always use QID_AC_BE */
-		pAdapter->ate.QID = 0;
-
-		p = (USHORT *)(&pRaCfg->data[24]);
-		pAdapter->ate.HLen = ntohs(*p);
-
-		if (pAdapter->ate.HLen > 32)
-		{
-			ATEDBGPRINT(RT_DEBUG_ERROR,("pAdapter->ate.HLen > 32\n"));
-			err = 3;
-			goto TX_START_ERROR;
-		}
-
-		NdisMoveMemory(&pAdapter->ate.Header, pRaCfg->data + 26, pAdapter->ate.HLen);
-
-		pAdapter->ate.PLen = ntohs(pRaCfg->length) - (pAdapter->ate.HLen + 28);
-
-		if (pAdapter->ate.PLen > 32)
-		{
-			ATEDBGPRINT(RT_DEBUG_ERROR,("pAdapter->ate.PLen > 32\n"));
-			err = 4;
-			goto TX_START_ERROR;
-		}
-
-		NdisMoveMemory(&pAdapter->ate.Pattern, pRaCfg->data + 26 + pAdapter->ate.HLen, pAdapter->ate.PLen);
-		pAdapter->ate.DLen = pAdapter->ate.TxWI.MPDUtotalByteCount - pAdapter->ate.HLen;
-	}
-
-	ATE_BBP_IO_READ8_BY_REG_ID(pAdapter, BBP_R22, &Bbp22Value);
-
-	switch (Bbp22Value)
-	{
-		case BBP22_TXFRAME:
-			{
-				if (pAdapter->ate.TxCount == 0)
-				{
-#ifdef RTMP_MAC_PCI
-					pAdapter->ate.TxCount = 0xFFFFFFFF;
-#endif // RTMP_MAC_PCI //
-				}
-				ATEDBGPRINT(RT_DEBUG_TRACE,("START TXFRAME\n"));
-				pAdapter->ate.bQATxStart = TRUE;
-				Set_ATE_Proc(pAdapter, "TXFRAME");
-			}
-			break;
-
-		case BBP22_TXCONT_OR_CARRSUPP:
-			{
-				ATEDBGPRINT(RT_DEBUG_TRACE,("BBP22_TXCONT_OR_CARRSUPP\n"));
-				ATE_BBP_IO_READ8_BY_REG_ID(pAdapter, BBP_R24, &Bbp24Value);
-
-				switch (Bbp24Value)
-				{
-					case BBP24_TXCONT:
-						{
-							ATEDBGPRINT(RT_DEBUG_TRACE,("START TXCONT\n"));
-							pAdapter->ate.bQATxStart = TRUE;
-							Set_ATE_Proc(pAdapter, "TXCONT");
-						}
-						break;
-
-					case BBP24_CARRSUPP:
-						{
-							ATEDBGPRINT(RT_DEBUG_TRACE,("START TXCARRSUPP\n"));
-							pAdapter->ate.bQATxStart = TRUE;
-							pAdapter->ate.Mode |= ATE_TXCARRSUPP;
-						}
-						break;
-
-					default:
-						{
-							ATEDBGPRINT(RT_DEBUG_ERROR,("Unknown TX subtype !"));
-						}
-						break;
-				}
-			}
-			break;
-
-		case BBP22_TXCARR:
-			{
-				ATEDBGPRINT(RT_DEBUG_TRACE,("START TXCARR\n"));
-				pAdapter->ate.bQATxStart = TRUE;
-				Set_ATE_Proc(pAdapter, "TXCARR");
-			}
-			break;
-
-		default:
-			{
-				ATEDBGPRINT(RT_DEBUG_ERROR,("Unknown Start TX subtype !"));
-			}
-			break;
-	}
-
-	if (pAdapter->ate.bQATxStart == TRUE)
-	{
-		RESPONSE_TO_GUI(pRaCfg, wrq, sizeof(pRaCfg->status), NDIS_STATUS_SUCCESS);
-		return NDIS_STATUS_SUCCESS;
-	}
-
-TX_START_ERROR:
-	RESPONSE_TO_GUI(pRaCfg, wrq, sizeof(pRaCfg->status), err);
-
-	return err;
-}
-
-
-static inline INT DO_RACFG_CMD_GET_TX_STATUS(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN  struct ate_racfghdr *pRaCfg)
-{
-	UINT32 count=0;
-
-	count = htonl(pAdapter->ate.TxDoneCount);
-	NdisMoveMemory(pRaCfg->data, &count, 4);
-
-	RESPONSE_TO_GUI(pRaCfg, wrq, sizeof(pRaCfg->status)+4, NDIS_STATUS_SUCCESS);
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-static inline INT DO_RACFG_CMD_TX_STOP(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN  struct ate_racfghdr *pRaCfg)
-{
-	ATEDBGPRINT(RT_DEBUG_TRACE,("RACFG_CMD_TX_STOP\n"));
-
-	Set_ATE_Proc(pAdapter, "TXSTOP");
-
-	RESPONSE_TO_GUI(pRaCfg, wrq, sizeof(pRaCfg->status), NDIS_STATUS_SUCCESS);
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-static inline INT DO_RACFG_CMD_RX_START(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN  struct ate_racfghdr *pRaCfg)
-{
-	ATEDBGPRINT(RT_DEBUG_TRACE,("RACFG_CMD_RX_START\n"));
-
-	pAdapter->ate.bQARxStart = TRUE;
-	Set_ATE_Proc(pAdapter, "RXFRAME");
-
-	RESPONSE_TO_GUI(pRaCfg, wrq, sizeof(pRaCfg->status), NDIS_STATUS_SUCCESS);
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-static inline INT DO_RACFG_CMD_RX_STOP(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN  struct ate_racfghdr *pRaCfg)
-{
-	ATEDBGPRINT(RT_DEBUG_TRACE,("RACFG_CMD_RX_STOP\n"));
-
-	Set_ATE_Proc(pAdapter, "RXSTOP");
-
-	RESPONSE_TO_GUI(pRaCfg, wrq, sizeof(pRaCfg->status), NDIS_STATUS_SUCCESS);
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-static inline INT DO_RACFG_CMD_ATE_START_TX_CARRIER(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN  struct ate_racfghdr *pRaCfg)
-{
-	ATEDBGPRINT(RT_DEBUG_TRACE,("RACFG_CMD_ATE_START_TX_CARRIER\n"));
-
-	Set_ATE_Proc(pAdapter, "TXCARR");
-
-	RESPONSE_TO_GUI(pRaCfg, wrq, sizeof(pRaCfg->status), NDIS_STATUS_SUCCESS);
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-static inline INT DO_RACFG_CMD_ATE_START_TX_CONT(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN  struct ate_racfghdr *pRaCfg)
-{
-	ATEDBGPRINT(RT_DEBUG_TRACE,("RACFG_CMD_ATE_START_TX_CONT\n"));
-
-	Set_ATE_Proc(pAdapter, "TXCONT");
-
-	RESPONSE_TO_GUI(pRaCfg, wrq, sizeof(pRaCfg->status), NDIS_STATUS_SUCCESS);
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-static inline INT DO_RACFG_CMD_ATE_START_TX_FRAME(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN  struct ate_racfghdr *pRaCfg)
-{
-	ATEDBGPRINT(RT_DEBUG_TRACE,("RACFG_CMD_ATE_START_TX_FRAME\n"));
-
-	Set_ATE_Proc(pAdapter, "TXFRAME");
-
-	RESPONSE_TO_GUI(pRaCfg, wrq, sizeof(pRaCfg->status), NDIS_STATUS_SUCCESS);
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-static inline INT DO_RACFG_CMD_ATE_SET_BW(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN  struct ate_racfghdr *pRaCfg)
-{
-	SHORT    value = 0;
-	STRING    str[LEN_OF_ARG];
-
-	NdisZeroMemory(str, LEN_OF_ARG);
-
-	ATEDBGPRINT(RT_DEBUG_TRACE,("RACFG_CMD_ATE_SET_BW\n"));
-
-	memcpy((PUCHAR)&value, (PUCHAR)&(pRaCfg->status), 2);
-	value = ntohs(value);
-	sprintf((char *)str, "%d", value);
-
-	Set_ATE_TX_BW_Proc(pAdapter, str);
-
-	RESPONSE_TO_GUI(pRaCfg, wrq, sizeof(pRaCfg->status), NDIS_STATUS_SUCCESS);
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-static inline INT DO_RACFG_CMD_ATE_SET_TX_POWER0(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN  struct ate_racfghdr *pRaCfg)
-{
-	SHORT    value = 0;
-	STRING    str[LEN_OF_ARG];
-
-	NdisZeroMemory(str, LEN_OF_ARG);
-
-	ATEDBGPRINT(RT_DEBUG_TRACE,("RACFG_CMD_ATE_SET_TX_POWER0\n"));
-
-	memcpy((PUCHAR)&value, (PUCHAR)&(pRaCfg->status), 2);
-	value = ntohs(value);
-	sprintf((char *)str, "%d", value);
-	Set_ATE_TX_POWER0_Proc(pAdapter, str);
-
-	RESPONSE_TO_GUI(pRaCfg, wrq, sizeof(pRaCfg->status), NDIS_STATUS_SUCCESS);
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-static inline INT DO_RACFG_CMD_ATE_SET_TX_POWER1(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN  struct ate_racfghdr *pRaCfg)
-{
-	SHORT    value = 0;
-	STRING    str[LEN_OF_ARG];
-
-	NdisZeroMemory(str, LEN_OF_ARG);
-
-	ATEDBGPRINT(RT_DEBUG_TRACE,("RACFG_CMD_ATE_SET_TX_POWER1\n"));
-
-	memcpy((PUCHAR)&value, (PUCHAR)&(pRaCfg->status), 2);
-	value = ntohs(value);
-	sprintf((char *)str, "%d", value);
-	Set_ATE_TX_POWER1_Proc(pAdapter, str);
-
-	RESPONSE_TO_GUI(pRaCfg, wrq, sizeof(pRaCfg->status), NDIS_STATUS_SUCCESS);
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-static inline INT DO_RACFG_CMD_ATE_SET_FREQ_OFFSET(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN  struct ate_racfghdr *pRaCfg)
-{
-	SHORT    value = 0;
-	STRING    str[LEN_OF_ARG];
-
-	NdisZeroMemory(str, LEN_OF_ARG);
-
-	ATEDBGPRINT(RT_DEBUG_TRACE,("RACFG_CMD_ATE_SET_FREQ_OFFSET\n"));
-
-	memcpy((PUCHAR)&value, (PUCHAR)&(pRaCfg->status), 2);
-	value = ntohs(value);
-	sprintf((char *)str, "%d", value);
-	Set_ATE_TX_FREQOFFSET_Proc(pAdapter, str);
-
-	RESPONSE_TO_GUI(pRaCfg, wrq, sizeof(pRaCfg->status), NDIS_STATUS_SUCCESS);
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-static inline INT DO_RACFG_CMD_ATE_GET_STATISTICS(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN  struct ate_racfghdr *pRaCfg)
-{
-	ATEDBGPRINT(RT_DEBUG_TRACE,("RACFG_CMD_ATE_GET_STATISTICS\n"));
-
-	memcpy_exl(pAdapter, &pRaCfg->data[0], (UCHAR *)&pAdapter->ate.TxDoneCount, 4);
-	memcpy_exl(pAdapter, &pRaCfg->data[4], (UCHAR *)&pAdapter->WlanCounters.RetryCount.u.LowPart, 4);
-	memcpy_exl(pAdapter, &pRaCfg->data[8], (UCHAR *)&pAdapter->WlanCounters.FailedCount.u.LowPart, 4);
-	memcpy_exl(pAdapter, &pRaCfg->data[12], (UCHAR *)&pAdapter->WlanCounters.RTSSuccessCount.u.LowPart, 4);
-	memcpy_exl(pAdapter, &pRaCfg->data[16], (UCHAR *)&pAdapter->WlanCounters.RTSFailureCount.u.LowPart, 4);
-	memcpy_exl(pAdapter, &pRaCfg->data[20], (UCHAR *)&pAdapter->WlanCounters.ReceivedFragmentCount.QuadPart, 4);
-	memcpy_exl(pAdapter, &pRaCfg->data[24], (UCHAR *)&pAdapter->WlanCounters.FCSErrorCount.u.LowPart, 4);
-	memcpy_exl(pAdapter, &pRaCfg->data[28], (UCHAR *)&pAdapter->Counters8023.RxNoBuffer, 4);
-	memcpy_exl(pAdapter, &pRaCfg->data[32], (UCHAR *)&pAdapter->WlanCounters.FrameDuplicateCount.u.LowPart, 4);
-	memcpy_exl(pAdapter, &pRaCfg->data[36], (UCHAR *)&pAdapter->RalinkCounters.OneSecFalseCCACnt, 4);
-
-	if (pAdapter->ate.RxAntennaSel == 0)
-	{
-		INT32 RSSI0 = 0;
-		INT32 RSSI1 = 0;
-		INT32 RSSI2 = 0;
-
-		RSSI0 = (INT32)(pAdapter->ate.LastRssi0 - pAdapter->BbpRssiToDbmDelta);
-		RSSI1 = (INT32)(pAdapter->ate.LastRssi1 - pAdapter->BbpRssiToDbmDelta);
-		RSSI2 = (INT32)(pAdapter->ate.LastRssi2 - pAdapter->BbpRssiToDbmDelta);
-		memcpy_exl(pAdapter, &pRaCfg->data[40], (UCHAR *)&RSSI0, 4);
-		memcpy_exl(pAdapter, &pRaCfg->data[44], (UCHAR *)&RSSI1, 4);
-		memcpy_exl(pAdapter, &pRaCfg->data[48], (UCHAR *)&RSSI2, 4);
-		RESPONSE_TO_GUI(pRaCfg, wrq, sizeof(pRaCfg->status)+52, NDIS_STATUS_SUCCESS);
-	}
-	else
-	{
-		INT32 RSSI0 = 0;
-
-		RSSI0 = (INT32)(pAdapter->ate.LastRssi0 - pAdapter->BbpRssiToDbmDelta);
-		memcpy_exl(pAdapter, &pRaCfg->data[40], (UCHAR *)&RSSI0, 4);
-		RESPONSE_TO_GUI(pRaCfg, wrq, sizeof(pRaCfg->status)+44, NDIS_STATUS_SUCCESS);
-	}
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-static inline INT DO_RACFG_CMD_ATE_RESET_COUNTER(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN  struct ate_racfghdr *pRaCfg)
-{
-	SHORT    value = 1;
-	STRING    str[LEN_OF_ARG];
-
-	NdisZeroMemory(str, LEN_OF_ARG);
-
-	ATEDBGPRINT(RT_DEBUG_TRACE,("RACFG_CMD_ATE_RESET_COUNTER\n"));
-
-	sprintf((char *)str, "%d", value);
-	Set_ResetStatCounter_Proc(pAdapter, str);
-
-	pAdapter->ate.TxDoneCount = 0;
-
-	RESPONSE_TO_GUI(pRaCfg, wrq, sizeof(pRaCfg->status), NDIS_STATUS_SUCCESS);
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-static inline INT DO_RACFG_CMD_ATE_SEL_TX_ANTENNA(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN  struct ate_racfghdr *pRaCfg)
-{
-	SHORT    value = 0;
-	STRING    str[LEN_OF_ARG];
-
-	NdisZeroMemory(str, LEN_OF_ARG);
-
-	ATEDBGPRINT(RT_DEBUG_TRACE,("RACFG_CMD_ATE_SEL_TX_ANTENNA\n"));
-
-	memcpy((PUCHAR)&value, (PUCHAR)&(pRaCfg->status), 2);
-	value = ntohs(value);
-	sprintf((char *)str, "%d", value);
-	Set_ATE_TX_Antenna_Proc(pAdapter, str);
-
-	RESPONSE_TO_GUI(pRaCfg, wrq, sizeof(pRaCfg->status), NDIS_STATUS_SUCCESS);
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-static inline INT DO_RACFG_CMD_ATE_SEL_RX_ANTENNA(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN  struct ate_racfghdr *pRaCfg)
-{
-	SHORT    value = 0;
-	STRING    str[LEN_OF_ARG];
-
-	NdisZeroMemory(str, LEN_OF_ARG);
-
-	ATEDBGPRINT(RT_DEBUG_TRACE,("RACFG_CMD_ATE_SEL_RX_ANTENNA\n"));
-
-	memcpy((PUCHAR)&value, (PUCHAR)&(pRaCfg->status), 2);
-	value = ntohs(value);
-	sprintf((char *)str, "%d", value);
-	Set_ATE_RX_Antenna_Proc(pAdapter, str);
-
-	RESPONSE_TO_GUI(pRaCfg, wrq, sizeof(pRaCfg->status), NDIS_STATUS_SUCCESS);
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-static inline INT DO_RACFG_CMD_ATE_SET_PREAMBLE(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN  struct ate_racfghdr *pRaCfg)
-{
-	SHORT    value = 0;
-	STRING    str[LEN_OF_ARG];
-
-	NdisZeroMemory(str, LEN_OF_ARG);
-
-	ATEDBGPRINT(RT_DEBUG_TRACE,("RACFG_CMD_ATE_SET_PREAMBLE\n"));
-
-	memcpy((PUCHAR)&value, (PUCHAR)&(pRaCfg->status), 2);
-	value = ntohs(value);
-	sprintf((char *)str, "%d", value);
-	Set_ATE_TX_MODE_Proc(pAdapter, str);
-
-	RESPONSE_TO_GUI(pRaCfg, wrq, sizeof(pRaCfg->status), NDIS_STATUS_SUCCESS);
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-static inline INT DO_RACFG_CMD_ATE_SET_CHANNEL(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN  struct ate_racfghdr *pRaCfg)
-{
-	SHORT    value = 0;
-	STRING    str[LEN_OF_ARG];
-
-	NdisZeroMemory(str, LEN_OF_ARG);
-
-	ATEDBGPRINT(RT_DEBUG_TRACE,("RACFG_CMD_ATE_SET_CHANNEL\n"));
-
-	memcpy((PUCHAR)&value, (PUCHAR)&(pRaCfg->status), 2);
-	value = ntohs(value);
-	sprintf((char *)str, "%d", value);
-	Set_ATE_CHANNEL_Proc(pAdapter, str);
-
-	RESPONSE_TO_GUI(pRaCfg, wrq, sizeof(pRaCfg->status), NDIS_STATUS_SUCCESS);
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-static inline INT DO_RACFG_CMD_ATE_SET_ADDR1(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN  struct ate_racfghdr *pRaCfg)
-{
-	ATEDBGPRINT(RT_DEBUG_TRACE,("RACFG_CMD_ATE_SET_ADDR1\n"));
-
-	/*
-		Addr is an array of UCHAR,
-		so no need to perform endian swap.
-	*/
-	memcpy(pAdapter->ate.Addr1, (PUCHAR)(pRaCfg->data - 2), MAC_ADDR_LEN);
-
-	RESPONSE_TO_GUI(pRaCfg, wrq, sizeof(pRaCfg->status), NDIS_STATUS_SUCCESS);
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-static inline INT DO_RACFG_CMD_ATE_SET_ADDR2(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN  struct ate_racfghdr *pRaCfg)
-{
-	ATEDBGPRINT(RT_DEBUG_TRACE,("RACFG_CMD_ATE_SET_ADDR2\n"));
-
-	/*
-		Addr is an array of UCHAR,
-		so no need to perform endian swap.
-	*/
-	memcpy(pAdapter->ate.Addr2, (PUCHAR)(pRaCfg->data - 2), MAC_ADDR_LEN);
-
-	RESPONSE_TO_GUI(pRaCfg, wrq, sizeof(pRaCfg->status), NDIS_STATUS_SUCCESS);
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-static inline INT DO_RACFG_CMD_ATE_SET_ADDR3(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN  struct ate_racfghdr *pRaCfg)
-{
-	ATEDBGPRINT(RT_DEBUG_TRACE,("RACFG_CMD_ATE_SET_ADDR3\n"));
-
-	/*
-		Addr is an array of UCHAR,
-		so no need to perform endian swap.
-	*/
-	memcpy(pAdapter->ate.Addr3, (PUCHAR)(pRaCfg->data - 2), MAC_ADDR_LEN);
-
-	RESPONSE_TO_GUI(pRaCfg, wrq, sizeof(pRaCfg->status), NDIS_STATUS_SUCCESS);
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-static inline INT DO_RACFG_CMD_ATE_SET_RATE(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN  struct ate_racfghdr *pRaCfg)
-{
-	SHORT    value = 0;
-	STRING    str[LEN_OF_ARG];
-
-	NdisZeroMemory(str, LEN_OF_ARG);
-
-	ATEDBGPRINT(RT_DEBUG_TRACE,("RACFG_CMD_ATE_SET_RATE\n"));
-
-	memcpy((PUCHAR)&value, (PUCHAR)&(pRaCfg->status), 2);
-	value = ntohs(value);
-	sprintf((char *)str, "%d", value);
-	Set_ATE_TX_MCS_Proc(pAdapter, str);
-
-	RESPONSE_TO_GUI(pRaCfg, wrq, sizeof(pRaCfg->status), NDIS_STATUS_SUCCESS);
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-static inline INT DO_RACFG_CMD_ATE_SET_TX_FRAME_LEN(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN  struct ate_racfghdr *pRaCfg)
-{
-	SHORT    value = 0;
-	STRING    str[LEN_OF_ARG];
-
-	NdisZeroMemory(str, LEN_OF_ARG);
-
-	ATEDBGPRINT(RT_DEBUG_TRACE,("RACFG_CMD_ATE_SET_TX_FRAME_LEN\n"));
-
-	memcpy((PUCHAR)&value, (PUCHAR)&(pRaCfg->status), 2);
-	value = ntohs(value);
-	sprintf((char *)str, "%d", value);
-	Set_ATE_TX_LENGTH_Proc(pAdapter, str);
-
-	RESPONSE_TO_GUI(pRaCfg, wrq, sizeof(pRaCfg->status), NDIS_STATUS_SUCCESS);
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-static inline INT DO_RACFG_CMD_ATE_SET_TX_FRAME_COUNT(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN  struct ate_racfghdr *pRaCfg)
-{
-	USHORT    value = 0;
-	STRING    str[LEN_OF_ARG];
-
-	NdisZeroMemory(str, LEN_OF_ARG);
-
-	ATEDBGPRINT(RT_DEBUG_TRACE,("RACFG_CMD_ATE_SET_TX_FRAME_COUNT\n"));
-
-	memcpy((PUCHAR)&value, (PUCHAR)&(pRaCfg->status), 2);
-	value = ntohs(value);
-
-#ifdef RTMP_MAC_PCI
-	/* TX_FRAME_COUNT == 0 means tx infinitely */
-	if (value == 0)
-	{
-		/* Use TxCount = 0xFFFFFFFF to approximate the infinity. */
-		pAdapter->ate.TxCount = 0xFFFFFFFF;
-		ATEDBGPRINT(RT_DEBUG_TRACE, ("Set_ATE_TX_COUNT_Proc (TxCount = %d)\n", pAdapter->ate.TxCount));
-		ATEDBGPRINT(RT_DEBUG_TRACE, ("Ralink: Set_ATE_TX_COUNT_Proc Success\n"));
-
-
-	}
-	else
-#endif // RTMP_MAC_PCI //
-	{
-		sprintf((char *)str, "%d", value);
-		Set_ATE_TX_COUNT_Proc(pAdapter, str);
-	}
-
-	RESPONSE_TO_GUI(pRaCfg, wrq, sizeof(pRaCfg->status), NDIS_STATUS_SUCCESS);
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-static inline INT DO_RACFG_CMD_ATE_START_RX_FRAME(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN  struct ate_racfghdr *pRaCfg)
-{
-	ATEDBGPRINT(RT_DEBUG_TRACE,("RACFG_CMD_RX_START\n"));
-
-	Set_ATE_Proc(pAdapter, "RXFRAME");
-
-	RESPONSE_TO_GUI(pRaCfg, wrq, sizeof(pRaCfg->status), NDIS_STATUS_SUCCESS);
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-static inline INT DO_RACFG_CMD_ATE_E2PROM_READ_BULK(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN  struct ate_racfghdr *pRaCfg)
-{
-	USHORT offset;
-	USHORT len;
-	USHORT buffer[EEPROM_SIZE/2];
-
-	offset = ntohs(pRaCfg->status);
-	memcpy(&len, pRaCfg->data, 2);
-	len = ntohs(len);
-
-	rt_ee_read_all(pAdapter, (USHORT *)buffer);
-
-	if (offset + len <= EEPROM_SIZE)
-		memcpy_exs(pAdapter, pRaCfg->data, (UCHAR *)buffer+offset, len);
-	else
-		ATEDBGPRINT(RT_DEBUG_ERROR, ("exceed EEPROM size\n"));
-
-	RESPONSE_TO_GUI(pRaCfg, wrq, sizeof(pRaCfg->status)+len, NDIS_STATUS_SUCCESS);
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-static inline INT DO_RACFG_CMD_ATE_E2PROM_WRITE_BULK(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN  struct ate_racfghdr *pRaCfg)
-{
-	USHORT offset;
-	USHORT len;
-	USHORT buffer[EEPROM_SIZE/2];
-
-	offset = ntohs(pRaCfg->status);
-	memcpy(&len, pRaCfg->data, 2);
-	len = ntohs(len);
-
-	rt_ee_read_all(pAdapter,(USHORT *)buffer);
-	memcpy_exs(pAdapter, (UCHAR *)buffer + offset, (UCHAR *)pRaCfg->data + 2, len);
-	rt_ee_write_all(pAdapter,(USHORT *)buffer);
-
-	RESPONSE_TO_GUI(pRaCfg, wrq, sizeof(pRaCfg->status), NDIS_STATUS_SUCCESS);
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-static inline INT DO_RACFG_CMD_ATE_IO_WRITE_BULK(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN  struct ate_racfghdr *pRaCfg)
-{
-	UINT32 offset, i, value;
-	USHORT len;
-
-	memcpy(&offset, &pRaCfg->status, 4);
-	offset = ntohl(offset);
-	memcpy(&len, pRaCfg->data+2, 2);
-	len = ntohs(len);
-
-	for (i = 0; i < len; i += 4)
-	{
-		memcpy_exl(pAdapter, (UCHAR *)&value, pRaCfg->data+4+i, 4);
-		ATEDBGPRINT(RT_DEBUG_TRACE,("Write %x %x\n", offset + i, value));
-		RTMP_IO_WRITE32(pAdapter, ((offset+i) & (0xffff)), value);
-	}
-
-	RESPONSE_TO_GUI(pRaCfg, wrq, sizeof(pRaCfg->status), NDIS_STATUS_SUCCESS);
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-static inline INT DO_RACFG_CMD_ATE_BBP_READ_BULK(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN  struct ate_racfghdr *pRaCfg)
-{
-	USHORT offset;
-	USHORT len;
-	USHORT j;
-
-	offset = ntohs(pRaCfg->status);
-	memcpy(&len, pRaCfg->data, 2);
-	len = ntohs(len);
-
-	for (j = offset; j < (offset+len); j++)
-	{
-		pRaCfg->data[j - offset] = 0;
-
-		if (pAdapter->ate.Mode == ATE_STOP)
-		{
-			RTMP_BBP_IO_READ8_BY_REG_ID(pAdapter, j, &pRaCfg->data[j - offset]);
-		}
-		else
-		{
-			ATE_BBP_IO_READ8_BY_REG_ID(pAdapter, j, &pRaCfg->data[j - offset]);
-		}
-	}
-
-	RESPONSE_TO_GUI(pRaCfg, wrq, sizeof(pRaCfg->status)+len, NDIS_STATUS_SUCCESS);
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-static inline INT DO_RACFG_CMD_ATE_BBP_WRITE_BULK(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq,
-	IN  struct ate_racfghdr *pRaCfg)
-{
-	USHORT offset;
-	USHORT len;
-	USHORT j;
-	UCHAR *value;
-
-	offset = ntohs(pRaCfg->status);
-	memcpy(&len, pRaCfg->data, 2);
-	len = ntohs(len);
-
-	for (j = offset; j < (offset+len); j++)
-	{
-		value = pRaCfg->data + 2 + (j - offset);
-		if (pAdapter->ate.Mode == ATE_STOP)
-		{
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAdapter, j,  *value);
-		}
-		else
-		{
-			ATE_BBP_IO_WRITE8_BY_REG_ID(pAdapter, j,  *value);
-		}
-	}
-
-	RESPONSE_TO_GUI(pRaCfg, wrq, sizeof(pRaCfg->status), NDIS_STATUS_SUCCESS);
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-#endif // RALINK_28xx_QA //
-#endif	// RALINK_ATE //
diff --git a/drivers/staging/rt3090/rt_ate.h b/drivers/staging/rt3090/rt_ate.h
deleted file mode 100644
index 38d596162e74..000000000000
--- a/drivers/staging/rt3090/rt_ate.h
+++ /dev/null
@@ -1,314 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
- */
-
-#ifndef __ATE_H__
-#define __ATE_H__
-
-
-#ifdef LINUX
-#define ate_print printk
-#define ATEDBGPRINT DBGPRINT
-#ifdef RTMP_MAC_PCI
-#define EEPROM_SIZE								0x200
-#ifdef CONFIG_STA_SUPPORT
-#define EEPROM_BIN_FILE_NAME  "/etc/Wireless/RT2860STA/e2p.bin"
-#endif // CONFIG_STA_SUPPORT //
-#endif // RTMP_MAC_PCI //
-#endif // LINUX //
-
-
-#define ATE_ON(_p)              (((_p)->ate.Mode) != ATE_STOP)
-
-#ifdef RTMP_MAC_PCI
-#define ATE_BBP_IO_READ8_BY_REG_ID(_A, _I, _pV)        \
-{                                                       \
-    BBP_CSR_CFG_STRUC  BbpCsr;                             \
-    int             j, k;                               \
-    for (j=0; j<MAX_BUSY_COUNT; j++)                    \
-    {                                                   \
-        RTMP_IO_READ32(_A, BBP_CSR_CFG, &BbpCsr.word);     \
-        if (BbpCsr.field.Busy == BUSY)                  \
-        {                                               \
-            continue;                                   \
-        }                                               \
-        BbpCsr.word = 0;                                \
-        BbpCsr.field.fRead = 1;                         \
-        BbpCsr.field.BBP_RW_MODE = 1;                         \
-        BbpCsr.field.Busy = 1;                          \
-        BbpCsr.field.RegNum = _I;                       \
-        RTMP_IO_WRITE32(_A, BBP_CSR_CFG, BbpCsr.word);     \
-        for (k=0; k<MAX_BUSY_COUNT; k++)                \
-        {                                               \
-            RTMP_IO_READ32(_A, BBP_CSR_CFG, &BbpCsr.word); \
-            if (BbpCsr.field.Busy == IDLE)              \
-                break;                                  \
-        }                                               \
-        if ((BbpCsr.field.Busy == IDLE) &&              \
-            (BbpCsr.field.RegNum == _I))                \
-        {                                               \
-            *(_pV) = (UCHAR)BbpCsr.field.Value;         \
-            break;                                      \
-        }                                               \
-    }                                                   \
-    if (BbpCsr.field.Busy == BUSY)                      \
-    {                                                   \
-        ATEDBGPRINT(RT_DEBUG_ERROR, ("BBP read R%d fail\n", _I));      \
-        *(_pV) = (_A)->BbpWriteLatch[_I];               \
-    }                                                   \
-}
-
-#define ATE_BBP_IO_WRITE8_BY_REG_ID(_A, _I, _V)        \
-{                                                       \
-    BBP_CSR_CFG_STRUC  BbpCsr;                             \
-    int             BusyCnt;                            \
-    for (BusyCnt=0; BusyCnt<MAX_BUSY_COUNT; BusyCnt++)  \
-    {                                                   \
-        RTMP_IO_READ32(_A, BBP_CSR_CFG, &BbpCsr.word);     \
-        if (BbpCsr.field.Busy == BUSY)                  \
-            continue;                                   \
-        BbpCsr.word = 0;                                \
-        BbpCsr.field.fRead = 0;                         \
-        BbpCsr.field.BBP_RW_MODE = 1;                         \
-        BbpCsr.field.Busy = 1;                          \
-        BbpCsr.field.Value = _V;                        \
-        BbpCsr.field.RegNum = _I;                       \
-        RTMP_IO_WRITE32(_A, BBP_CSR_CFG, BbpCsr.word);     \
-        (_A)->BbpWriteLatch[_I] = _V;                   \
-        break;                                          \
-    }                                                   \
-    if (BusyCnt == MAX_BUSY_COUNT)                      \
-    {                                                   \
-        ATEDBGPRINT(RT_DEBUG_ERROR, ("BBP write R%d fail\n", _I));     \
-    }                                                   \
-}
-#endif // RTMP_MAC_PCI //
-
-
-#ifdef RT30xx
-#define ATE_RF_IO_READ8_BY_REG_ID(_A, _I, _pV)     RTMP_RF_IO_READ8_BY_REG_ID(_A, _I, _pV)
-#define ATE_RF_IO_WRITE8_BY_REG_ID(_A, _I, _V)     RTMP_RF_IO_WRITE8_BY_REG_ID(_A, _I, _V)
-#endif // RT30xx //
-
-
-VOID rt_ee_read_all(
-	IN  PRTMP_ADAPTER   pAd,
-	OUT USHORT *Data);
-
-VOID rt_ee_write_all(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  USHORT *Data);
-
-INT Set_ATE_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT	Set_ATE_DA_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT	Set_ATE_SA_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT	Set_ATE_BSSID_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT	Set_ATE_CHANNEL_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT	Set_ATE_TX_POWER0_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT	Set_ATE_TX_POWER1_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT	Set_ATE_TX_Antenna_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT	Set_ATE_RX_Antenna_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT	Set_ATE_TX_FREQOFFSET_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT	Set_ATE_TX_BW_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT	Set_ATE_TX_LENGTH_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT	Set_ATE_TX_COUNT_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT	Set_ATE_TX_MCS_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT	Set_ATE_TX_MODE_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT	Set_ATE_TX_GI_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-
-INT	Set_ATE_RX_FER_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT Set_ATE_Read_RF_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT Set_ATE_Write_RF1_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT Set_ATE_Write_RF2_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT Set_ATE_Write_RF3_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT Set_ATE_Write_RF4_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT Set_ATE_Load_E2P_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT Set_ATE_Read_E2P_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-
-INT	Set_ATE_Show_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT	Set_ATE_Help_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-#ifdef RALINK_28xx_QA
-VOID ATE_QA_Statistics(
-	IN PRTMP_ADAPTER		pAd,
-	IN PRXWI_STRUC			pRxWI,
-	IN PRT28XX_RXD_STRUC    p28xxRxD,
-	IN PHEADER_802_11		pHeader);
-
-VOID RtmpDoAte(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq);
-
-VOID BubbleSort(
-	IN  INT32 n,
-	IN  INT32 a[]);
-
-VOID CalNoiseLevel(
-	IN  PRTMP_ADAPTER   pAdapter,
-	IN  UCHAR           channel,
-	OUT INT32           buffer[3][10]);
-
-BOOLEAN SyncTxRxConfig(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	USHORT			offset,
-	IN	UCHAR			value);
-
-INT Set_TxStop_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT Set_RxStop_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-#ifdef DBG
-INT Set_EERead_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT Set_EEWrite_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT Set_BBPRead_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT Set_BBPWrite_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT Set_RFWrite_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-#endif // DBG //
-#endif // RALINK_28xx_QA //
-
-
-VOID ATEAsicSwitchChannel(
-	IN PRTMP_ADAPTER pAd);
-
-VOID ATEAsicAdjustTxPower(
-	IN PRTMP_ADAPTER pAd);
-
-VOID ATEDisableAsicProtect(
-	IN		PRTMP_ADAPTER	pAd);
-
-CHAR ATEConvertToRssi(
-	IN PRTMP_ADAPTER  pAd,
-	IN CHAR				Rssi,
-	IN UCHAR    RssiNumber);
-
-VOID ATESampleRssi(
-	IN PRTMP_ADAPTER	pAd,
-	IN PRXWI_STRUC		pRxWI);
-
-
-#ifdef CONFIG_STA_SUPPORT
-VOID RTMPStationStop(
-    IN  PRTMP_ADAPTER   pAd);
-
-VOID RTMPStationStart(
-    IN  PRTMP_ADAPTER   pAd);
-#endif // CONFIG_STA_SUPPORT //
-#endif // __ATE_H__ //
diff --git a/drivers/staging/rt3090/rt_config.h b/drivers/staging/rt3090/rt_config.h
deleted file mode 100644
index 005142dfa257..000000000000
--- a/drivers/staging/rt3090/rt_config.h
+++ /dev/null
@@ -1,126 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-	Module Name:
-	rt_config.h
-
-	Abstract:
-	Central header file to maintain all include files for all NDIS
-	miniport driver routines.
-
-	Revision History:
-	Who         When          What
-	--------    ----------    ----------------------------------------------
-	Paul Lin    08-01-2002    created
-
-*/
-#ifndef	__RT_CONFIG_H__
-#define	__RT_CONFIG_H__
-
-#include "rtmp_type.h"
-#include "rtmp_os.h"
-
-#include "rtmp_def.h"
-#include "rtmp_chip.h"
-#include "rtmp_timer.h"
-
-#include "oid.h"
-#include "mlme.h"
-#include "wpa.h"
-#include "crypt_md5.h"
-#include "crypt_sha2.h"
-#include "crypt_hmac.h"
-#include "rtmp.h"
-#include "ap.h"
-#include "dfs.h"
-#include "chlist.h"
-#include "spectrum.h"
-
-#ifdef MLME_EX
-#include	"mlme_ex_def.h"
-#include	"mlme_ex.h"
-#endif // MLME_EX //
-
-#include "eeprom.h"
-#if defined(RTMP_PCI_SUPPORT) || defined(RTMP_USB_SUPPORT)
-#include "rtmp_mcu.h"
-#endif
-
-
-
-#undef AP_WSC_INCLUDED
-#undef STA_WSC_INCLUDED
-#undef WSC_INCLUDED
-
-
-
-#ifdef CONFIG_STA_SUPPORT
-#endif // CONFIG_STA_SUPPORT //
-
-#ifdef BLOCK_NET_IF
-#include "netif_block.h"
-#endif // BLOCK_NET_IF //
-
-#ifdef IGMP_SNOOP_SUPPORT
-#include "igmp_snoop.h"
-#endif // IGMP_SNOOP_SUPPORT //
-
-#ifdef RALINK_ATE
-#include "rt_ate.h"
-#endif // RALINK_ATE //
-
-#ifdef RALINK_28xx_QA
-#ifndef RALINK_ATE
-#error "For supporting QA GUI, please set HAS_ATE=y and HAS_28xx_QA=y."
-#endif // RALINK_ATE //
-#endif // RALINK_28xx_QA //
-
-
-
-
-#if defined(AP_WSC_INCLUDED) || defined(STA_WSC_INCLUDED)
-#define WSC_INCLUDED
-#endif
-
-
-#ifdef CONFIG_STA_SUPPORT
-#ifdef NATIVE_WPA_SUPPLICANT_SUPPORT
-#ifndef WPA_SUPPLICANT_SUPPORT
-#error "Build for being controlled by NetworkManager or wext, please set HAS_WPA_SUPPLICANT=y and HAS_NATIVE_WPA_SUPPLICANT_SUPPORT=y"
-#endif // WPA_SUPPLICANT_SUPPORT //
-#endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
-
-#endif // CONFIG_STA_SUPPORT //
-
-
-
-#ifdef IKANOS_VX_1X0
-#include "vr_ikans.h"
-#endif // IKANOS_VX_1X0 //
-
-
-
-#endif	// __RT_CONFIG_H__
diff --git a/drivers/staging/rt3090/rt_linux.c b/drivers/staging/rt3090/rt_linux.c
deleted file mode 100644
index 9b94aa6eb904..000000000000
--- a/drivers/staging/rt3090/rt_linux.c
+++ /dev/null
@@ -1,1624 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
- */
-
-#include <linux/sched.h>
-#include "rt_config.h"
-
-ULONG	RTDebugLevel = RT_DEBUG_ERROR;
-
-
-// for wireless system event message
-char const *pWirelessSysEventText[IW_SYS_EVENT_TYPE_NUM] = {
-	// system status event
-    "had associated successfully",							/* IW_ASSOC_EVENT_FLAG */
-    "had disassociated",									/* IW_DISASSOC_EVENT_FLAG */
-    "had deauthenticated",									/* IW_DEAUTH_EVENT_FLAG */
-    "had been aged-out and disassociated",					/* IW_AGEOUT_EVENT_FLAG */
-    "occurred CounterMeasures attack",						/* IW_COUNTER_MEASURES_EVENT_FLAG */
-    "occurred replay counter different in Key Handshaking",	/* IW_REPLAY_COUNTER_DIFF_EVENT_FLAG */
-    "occurred RSNIE different in Key Handshaking",			/* IW_RSNIE_DIFF_EVENT_FLAG */
-    "occurred MIC different in Key Handshaking",			/* IW_MIC_DIFF_EVENT_FLAG */
-    "occurred ICV error in RX",								/* IW_ICV_ERROR_EVENT_FLAG */
-    "occurred MIC error in RX",								/* IW_MIC_ERROR_EVENT_FLAG */
-	"Group Key Handshaking timeout",						/* IW_GROUP_HS_TIMEOUT_EVENT_FLAG */
-	"Pairwise Key Handshaking timeout",						/* IW_PAIRWISE_HS_TIMEOUT_EVENT_FLAG */
-	"RSN IE sanity check failure",							/* IW_RSNIE_SANITY_FAIL_EVENT_FLAG */
-	"set key done in WPA/WPAPSK",							/* IW_SET_KEY_DONE_WPA1_EVENT_FLAG */
-	"set key done in WPA2/WPA2PSK",                         /* IW_SET_KEY_DONE_WPA2_EVENT_FLAG */
-	"connects with our wireless client",                    /* IW_STA_LINKUP_EVENT_FLAG */
-	"disconnects with our wireless client",                 /* IW_STA_LINKDOWN_EVENT_FLAG */
-	"scan completed"										/* IW_SCAN_COMPLETED_EVENT_FLAG */
-	"scan terminate!! Busy!! Enqueue fail!!"				/* IW_SCAN_ENQUEUE_FAIL_EVENT_FLAG */
-	};
-
-// for wireless IDS_spoof_attack event message
-char const *pWirelessSpoofEventText[IW_SPOOF_EVENT_TYPE_NUM] = {
-    "detected conflict SSID",								/* IW_CONFLICT_SSID_EVENT_FLAG */
-    "detected spoofed association response",				/* IW_SPOOF_ASSOC_RESP_EVENT_FLAG */
-    "detected spoofed reassociation responses",				/* IW_SPOOF_REASSOC_RESP_EVENT_FLAG */
-    "detected spoofed probe response",						/* IW_SPOOF_PROBE_RESP_EVENT_FLAG */
-    "detected spoofed beacon",								/* IW_SPOOF_BEACON_EVENT_FLAG */
-    "detected spoofed disassociation",						/* IW_SPOOF_DISASSOC_EVENT_FLAG */
-    "detected spoofed authentication",						/* IW_SPOOF_AUTH_EVENT_FLAG */
-    "detected spoofed deauthentication",					/* IW_SPOOF_DEAUTH_EVENT_FLAG */
-    "detected spoofed unknown management frame",			/* IW_SPOOF_UNKNOWN_MGMT_EVENT_FLAG */
-	"detected replay attack"								/* IW_REPLAY_ATTACK_EVENT_FLAG */
-	};
-
-// for wireless IDS_flooding_attack event message
-char const *pWirelessFloodEventText[IW_FLOOD_EVENT_TYPE_NUM] = {
-	"detected authentication flooding",						/* IW_FLOOD_AUTH_EVENT_FLAG */
-    "detected association request flooding",				/* IW_FLOOD_ASSOC_REQ_EVENT_FLAG */
-    "detected reassociation request flooding",				/* IW_FLOOD_REASSOC_REQ_EVENT_FLAG */
-    "detected probe request flooding",						/* IW_FLOOD_PROBE_REQ_EVENT_FLAG */
-    "detected disassociation flooding",						/* IW_FLOOD_DISASSOC_EVENT_FLAG */
-    "detected deauthentication flooding",					/* IW_FLOOD_DEAUTH_EVENT_FLAG */
-    "detected 802.1x eap-request flooding"					/* IW_FLOOD_EAP_REQ_EVENT_FLAG */
-	};
-
-
-/* timeout -- ms */
-VOID RTMP_SetPeriodicTimer(
-	IN	NDIS_MINIPORT_TIMER *pTimer,
-	IN	unsigned long timeout)
-{
-	timeout = ((timeout*OS_HZ) / 1000);
-	pTimer->expires = jiffies + timeout;
-	add_timer(pTimer);
-}
-
-/* convert NdisMInitializeTimer --> RTMP_OS_Init_Timer */
-VOID RTMP_OS_Init_Timer(
-	IN	PRTMP_ADAPTER pAd,
-	IN	NDIS_MINIPORT_TIMER *pTimer,
-	IN	TIMER_FUNCTION function,
-	IN	PVOID data)
-{
-	init_timer(pTimer);
-    pTimer->data = (unsigned long)data;
-    pTimer->function = function;
-}
-
-
-VOID RTMP_OS_Add_Timer(
-	IN	NDIS_MINIPORT_TIMER		*pTimer,
-	IN	unsigned long timeout)
-{
-	if (timer_pending(pTimer))
-		return;
-
-	timeout = ((timeout*OS_HZ) / 1000);
-	pTimer->expires = jiffies + timeout;
-	add_timer(pTimer);
-}
-
-VOID RTMP_OS_Mod_Timer(
-	IN	NDIS_MINIPORT_TIMER		*pTimer,
-	IN	unsigned long timeout)
-{
-	timeout = ((timeout*OS_HZ) / 1000);
-	mod_timer(pTimer, jiffies + timeout);
-}
-
-VOID RTMP_OS_Del_Timer(
-	IN	NDIS_MINIPORT_TIMER		*pTimer,
-	OUT	BOOLEAN					*pCancelled)
-{
-	if (timer_pending(pTimer))
-	{
-		*pCancelled = del_timer_sync(pTimer);
-	}
-	else
-	{
-		*pCancelled = TRUE;
-	}
-
-}
-
-VOID RTMP_OS_Release_Packet(
-	IN	PRTMP_ADAPTER pAd,
-	IN	PQUEUE_ENTRY  pEntry)
-{
-	//RTMPFreeNdisPacket(pAd, (struct sk_buff *)pEntry);
-}
-
-// Unify all delay routine by using udelay
-VOID RTMPusecDelay(
-	IN	ULONG	usec)
-{
-	ULONG	i;
-
-	for (i = 0; i < (usec / 50); i++)
-		udelay(50);
-
-	if (usec % 50)
-		udelay(usec % 50);
-}
-
-void RTMP_GetCurrentSystemTime(LARGE_INTEGER *time)
-{
-	time->u.LowPart = jiffies;
-}
-
-// pAd MUST allow to be NULL
-NDIS_STATUS os_alloc_mem(
-	IN	RTMP_ADAPTER *pAd,
-	OUT	UCHAR **mem,
-	IN	ULONG  size)
-{
-	*mem = (PUCHAR) kmalloc(size, GFP_ATOMIC);
-	if (*mem)
-		return (NDIS_STATUS_SUCCESS);
-	else
-		return (NDIS_STATUS_FAILURE);
-}
-
-// pAd MUST allow to be NULL
-NDIS_STATUS os_free_mem(
-	IN	PRTMP_ADAPTER pAd,
-	IN	PVOID mem)
-{
-
-	ASSERT(mem);
-	kfree(mem);
-	return (NDIS_STATUS_SUCCESS);
-}
-
-
-
-
-PNDIS_PACKET RtmpOSNetPktAlloc(
-	IN RTMP_ADAPTER *pAd,
-	IN int size)
-{
-	struct sk_buff *skb;
-	/* Add 2 more bytes for ip header alignment*/
-	skb = dev_alloc_skb(size+2);
-
-	return ((PNDIS_PACKET)skb);
-}
-
-
-PNDIS_PACKET RTMP_AllocateFragPacketBuffer(
-	IN	PRTMP_ADAPTER pAd,
-	IN	ULONG	Length)
-{
-	struct sk_buff *pkt;
-
-	pkt = dev_alloc_skb(Length);
-
-	if (pkt == NULL)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("can't allocate frag rx %ld size packet\n",Length));
-	}
-
-	if (pkt)
-	{
-		RTMP_SET_PACKET_SOURCE(OSPKT_TO_RTPKT(pkt), PKTSRC_NDIS);
-	}
-
-	return (PNDIS_PACKET) pkt;
-}
-
-
-PNDIS_PACKET RTMP_AllocateTxPacketBuffer(
-	IN	PRTMP_ADAPTER pAd,
-	IN	ULONG	Length,
-	IN	BOOLEAN	Cached,
-	OUT	PVOID	*VirtualAddress)
-{
-	struct sk_buff *pkt;
-
-	pkt = dev_alloc_skb(Length);
-
-	if (pkt == NULL)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("can't allocate tx %ld size packet\n",Length));
-	}
-
-	if (pkt)
-	{
-		RTMP_SET_PACKET_SOURCE(OSPKT_TO_RTPKT(pkt), PKTSRC_NDIS);
-		*VirtualAddress = (PVOID) pkt->data;
-	}
-	else
-	{
-		*VirtualAddress = (PVOID) NULL;
-	}
-
-	return (PNDIS_PACKET) pkt;
-}
-
-
-VOID build_tx_packet(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PNDIS_PACKET	pPacket,
-	IN	PUCHAR	pFrame,
-	IN	ULONG	FrameLen)
-{
-
-	struct sk_buff	*pTxPkt;
-
-	ASSERT(pPacket);
-	pTxPkt = RTPKT_TO_OSPKT(pPacket);
-
-	NdisMoveMemory(skb_put(pTxPkt, FrameLen), pFrame, FrameLen);
-}
-
-VOID	RTMPFreeAdapter(
-	IN	PRTMP_ADAPTER	pAd)
-{
-	POS_COOKIE os_cookie;
-	int index;
-
-	os_cookie=(POS_COOKIE)pAd->OS_Cookie;
-
-	if (pAd->BeaconBuf)
-		kfree(pAd->BeaconBuf);
-
-
-	NdisFreeSpinLock(&pAd->MgmtRingLock);
-
-#ifdef RTMP_MAC_PCI
-	NdisFreeSpinLock(&pAd->RxRingLock);
-#ifdef RT3090
-NdisFreeSpinLock(&pAd->McuCmdLock);
-#endif // RT3090 //
-#endif // RTMP_MAC_PCI //
-
-	for (index =0 ; index < NUM_OF_TX_RING; index++)
-	{
-		NdisFreeSpinLock(&pAd->TxSwQueueLock[index]);
-		NdisFreeSpinLock(&pAd->DeQueueLock[index]);
-		pAd->DeQueueRunning[index] = FALSE;
-	}
-
-	NdisFreeSpinLock(&pAd->irq_lock);
-
-
-	vfree(pAd); // pci_free_consistent(os_cookie->pci_dev,sizeof(RTMP_ADAPTER),pAd,os_cookie->pAd_pa);
-	if (os_cookie)
-		kfree(os_cookie);
-}
-
-BOOLEAN OS_Need_Clone_Packet(void)
-{
-	return (FALSE);
-}
-
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		clone an input NDIS PACKET to another one. The new internally created NDIS PACKET
-		must have only one NDIS BUFFER
-		return - byte copied. 0 means can't create NDIS PACKET
-		NOTE: internally created NDIS_PACKET should be destroyed by RTMPFreeNdisPacket
-
-	Arguments:
-		pAd	Pointer to our adapter
-		pInsAMSDUHdr	EWC A-MSDU format has extra 14-bytes header. if TRUE, insert this 14-byte hdr in front of MSDU.
-		*pSrcTotalLen			return total packet length. This lenght is calculated with 802.3 format packet.
-
-	Return Value:
-		NDIS_STATUS_SUCCESS
-		NDIS_STATUS_FAILURE
-
-	Note:
-
-	========================================================================
-*/
-NDIS_STATUS RTMPCloneNdisPacket(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	BOOLEAN			pInsAMSDUHdr,
-	IN	PNDIS_PACKET	pInPacket,
-	OUT PNDIS_PACKET   *ppOutPacket)
-{
-
-	struct sk_buff *pkt;
-
-	ASSERT(pInPacket);
-	ASSERT(ppOutPacket);
-
-	// 1. Allocate a packet
-	pkt = dev_alloc_skb(2048);
-
-	if (pkt == NULL)
-	{
-		return NDIS_STATUS_FAILURE;
-	}
-
-	skb_put(pkt, GET_OS_PKT_LEN(pInPacket));
-	NdisMoveMemory(pkt->data, GET_OS_PKT_DATAPTR(pInPacket), GET_OS_PKT_LEN(pInPacket));
-	*ppOutPacket = OSPKT_TO_RTPKT(pkt);
-
-
-	RTMP_SET_PACKET_SOURCE(OSPKT_TO_RTPKT(pkt), PKTSRC_NDIS);
-
-	printk("###Clone###\n");
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-// the allocated NDIS PACKET must be freed via RTMPFreeNdisPacket()
-NDIS_STATUS RTMPAllocateNdisPacket(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT PNDIS_PACKET   *ppPacket,
-	IN	PUCHAR			pHeader,
-	IN	UINT			HeaderLen,
-	IN	PUCHAR			pData,
-	IN	UINT			DataLen)
-{
-	PNDIS_PACKET	pPacket;
-	ASSERT(pData);
-	ASSERT(DataLen);
-
-	// 1. Allocate a packet
-	pPacket = (PNDIS_PACKET *) dev_alloc_skb(HeaderLen + DataLen + RTMP_PKT_TAIL_PADDING);
-	if (pPacket == NULL)
-	{
-		*ppPacket = NULL;
-#ifdef DEBUG
-		printk("RTMPAllocateNdisPacket Fail\n\n");
-#endif
-		return NDIS_STATUS_FAILURE;
-	}
-
-	// 2. clone the frame content
-	if (HeaderLen > 0)
-		NdisMoveMemory(GET_OS_PKT_DATAPTR(pPacket), pHeader, HeaderLen);
-	if (DataLen > 0)
-		NdisMoveMemory(GET_OS_PKT_DATAPTR(pPacket) + HeaderLen, pData, DataLen);
-
-	// 3. update length of packet
-	skb_put(GET_OS_PKT_TYPE(pPacket), HeaderLen+DataLen);
-
-	RTMP_SET_PACKET_SOURCE(pPacket, PKTSRC_NDIS);
-//	printk("%s : pPacket = %p, len = %d\n", __FUNCTION__, pPacket, GET_OS_PKT_LEN(pPacket));
-	*ppPacket = pPacket;
-	return NDIS_STATUS_SUCCESS;
-}
-
-/*
-  ========================================================================
-  Description:
-	This routine frees a miniport internally allocated NDIS_PACKET and its
-	corresponding NDIS_BUFFER and allocated memory.
-  ========================================================================
-*/
-VOID RTMPFreeNdisPacket(
-	IN PRTMP_ADAPTER pAd,
-	IN PNDIS_PACKET  pPacket)
-{
-	dev_kfree_skb_any(RTPKT_TO_OSPKT(pPacket));
-}
-
-
-// IRQL = DISPATCH_LEVEL
-// NOTE: we do have an assumption here, that Byte0 and Byte1 always reasid at the same
-//			 scatter gather buffer
-NDIS_STATUS Sniff2BytesFromNdisBuffer(
-	IN	PNDIS_BUFFER	pFirstBuffer,
-	IN	UCHAR			DesiredOffset,
-	OUT PUCHAR			pByte0,
-	OUT PUCHAR			pByte1)
-{
-    *pByte0 = *(PUCHAR)(pFirstBuffer + DesiredOffset);
-    *pByte1 = *(PUCHAR)(pFirstBuffer + DesiredOffset + 1);
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-void RTMP_QueryPacketInfo(
-	IN  PNDIS_PACKET pPacket,
-	OUT PACKET_INFO  *pPacketInfo,
-	OUT PUCHAR		 *pSrcBufVA,
-	OUT	UINT		 *pSrcBufLen)
-{
-	pPacketInfo->BufferCount = 1;
-	pPacketInfo->pFirstBuffer = (PNDIS_BUFFER)GET_OS_PKT_DATAPTR(pPacket);
-	pPacketInfo->PhysicalBufferCount = 1;
-	pPacketInfo->TotalPacketLength = GET_OS_PKT_LEN(pPacket);
-
-	*pSrcBufVA = GET_OS_PKT_DATAPTR(pPacket);
-	*pSrcBufLen = GET_OS_PKT_LEN(pPacket);
-}
-
-void RTMP_QueryNextPacketInfo(
-	IN  PNDIS_PACKET *ppPacket,
-	OUT PACKET_INFO  *pPacketInfo,
-	OUT PUCHAR		 *pSrcBufVA,
-	OUT	UINT		 *pSrcBufLen)
-{
-	PNDIS_PACKET pPacket = NULL;
-
-	if (*ppPacket)
-		pPacket = GET_OS_PKT_NEXT(*ppPacket);
-
-	if (pPacket)
-	{
-		pPacketInfo->BufferCount = 1;
-		pPacketInfo->pFirstBuffer = (PNDIS_BUFFER)GET_OS_PKT_DATAPTR(pPacket);
-		pPacketInfo->PhysicalBufferCount = 1;
-		pPacketInfo->TotalPacketLength = GET_OS_PKT_LEN(pPacket);
-
-		*pSrcBufVA = GET_OS_PKT_DATAPTR(pPacket);
-		*pSrcBufLen = GET_OS_PKT_LEN(pPacket);
-		*ppPacket = GET_OS_PKT_NEXT(pPacket);
-	}
-	else
-	{
-		pPacketInfo->BufferCount = 0;
-		pPacketInfo->pFirstBuffer = NULL;
-		pPacketInfo->PhysicalBufferCount = 0;
-		pPacketInfo->TotalPacketLength = 0;
-
-		*pSrcBufVA = NULL;
-		*pSrcBufLen = 0;
-		*ppPacket = NULL;
-	}
-}
-
-
-PNDIS_PACKET DuplicatePacket(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PNDIS_PACKET	pPacket,
-	IN	UCHAR			FromWhichBSSID)
-{
-	struct sk_buff	*skb;
-	PNDIS_PACKET	pRetPacket = NULL;
-	USHORT			DataSize;
-	UCHAR			*pData;
-
-	DataSize = (USHORT) GET_OS_PKT_LEN(pPacket);
-	pData = (PUCHAR) GET_OS_PKT_DATAPTR(pPacket);
-
-
-	skb = skb_clone(RTPKT_TO_OSPKT(pPacket), MEM_ALLOC_FLAG);
-	if (skb)
-	{
-		skb->dev = get_netdev_from_bssid(pAd, FromWhichBSSID);
-		pRetPacket = OSPKT_TO_RTPKT(skb);
-	}
-
-
-	return pRetPacket;
-
-}
-
-PNDIS_PACKET duplicate_pkt(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			pHeader802_3,
-    IN  UINT            HdrLen,
-	IN	PUCHAR			pData,
-	IN	ULONG			DataSize,
-	IN	UCHAR			FromWhichBSSID)
-{
-	struct sk_buff	*skb;
-	PNDIS_PACKET	pPacket = NULL;
-
-
-	if ((skb = __dev_alloc_skb(HdrLen + DataSize + 2, MEM_ALLOC_FLAG)) != NULL)
-	{
-		skb_reserve(skb, 2);
-		NdisMoveMemory(skb_tail_pointer(skb), pHeader802_3, HdrLen);
-		skb_put(skb, HdrLen);
-		NdisMoveMemory(skb_tail_pointer(skb), pData, DataSize);
-		skb_put(skb, DataSize);
-		skb->dev = get_netdev_from_bssid(pAd, FromWhichBSSID);
-		pPacket = OSPKT_TO_RTPKT(skb);
-	}
-
-	return pPacket;
-}
-
-
-#define TKIP_TX_MIC_SIZE		8
-PNDIS_PACKET duplicate_pkt_with_TKIP_MIC(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PNDIS_PACKET	pPacket)
-{
-	struct sk_buff	*skb, *newskb;
-
-
-	skb = RTPKT_TO_OSPKT(pPacket);
-	if (skb_tailroom(skb) < TKIP_TX_MIC_SIZE)
-	{
-		// alloc a new skb and copy the packet
-		newskb = skb_copy_expand(skb, skb_headroom(skb), TKIP_TX_MIC_SIZE, GFP_ATOMIC);
-		dev_kfree_skb_any(skb);
-		if (newskb == NULL)
-		{
-			DBGPRINT(RT_DEBUG_ERROR, ("Extend Tx.MIC for packet failed!, dropping packet!\n"));
-			return NULL;
-		}
-		skb = newskb;
-	}
-
-	return OSPKT_TO_RTPKT(skb);
-
-
-}
-
-
-
-
-PNDIS_PACKET ClonePacket(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PNDIS_PACKET	pPacket,
-	IN	PUCHAR			pData,
-	IN	ULONG			DataSize)
-{
-	struct sk_buff	*pRxPkt;
-	struct sk_buff	*pClonedPkt;
-
-	ASSERT(pPacket);
-	pRxPkt = RTPKT_TO_OSPKT(pPacket);
-
-	// clone the packet
-	pClonedPkt = skb_clone(pRxPkt, MEM_ALLOC_FLAG);
-
-	if (pClonedPkt)
-	{
-	// set the correct dataptr and data len
-	pClonedPkt->dev = pRxPkt->dev;
-	pClonedPkt->data = pData;
-	pClonedPkt->len = DataSize;
-	pClonedPkt->tail = pClonedPkt->data + pClonedPkt->len;
-		ASSERT(DataSize < 1530);
-	}
-	return pClonedPkt;
-}
-
-//
-// change OS packet DataPtr and DataLen
-//
-void  update_os_packet_info(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	RX_BLK			*pRxBlk,
-	IN  UCHAR			FromWhichBSSID)
-{
-	struct sk_buff	*pOSPkt;
-
-	ASSERT(pRxBlk->pRxPacket);
-	pOSPkt = RTPKT_TO_OSPKT(pRxBlk->pRxPacket);
-
-	pOSPkt->dev = get_netdev_from_bssid(pAd, FromWhichBSSID);
-	pOSPkt->data = pRxBlk->pData;
-	pOSPkt->len = pRxBlk->DataSize;
-	pOSPkt->tail = pOSPkt->data + pOSPkt->len;
-}
-
-
-void wlan_802_11_to_802_3_packet(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	RX_BLK			*pRxBlk,
-	IN	PUCHAR			pHeader802_3,
-	IN  UCHAR			FromWhichBSSID)
-{
-	struct sk_buff	*pOSPkt;
-
-	ASSERT(pRxBlk->pRxPacket);
-	ASSERT(pHeader802_3);
-
-	pOSPkt = RTPKT_TO_OSPKT(pRxBlk->pRxPacket);
-
-	pOSPkt->dev = get_netdev_from_bssid(pAd, FromWhichBSSID);
-	pOSPkt->data = pRxBlk->pData;
-	pOSPkt->len = pRxBlk->DataSize;
-	pOSPkt->tail = pOSPkt->data + pOSPkt->len;
-
-	//
-	// copy 802.3 header
-	//
-	//
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		NdisMoveMemory(skb_push(pOSPkt, LENGTH_802_3), pHeader802_3, LENGTH_802_3);
-#endif // CONFIG_STA_SUPPORT //
-	}
-
-
-
-void announce_802_3_packet(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PNDIS_PACKET	pPacket)
-{
-
-	struct sk_buff	*pRxPkt;
-#ifdef INF_AMAZON_PPA
-        int             ret = 0;
-        unsigned int ppa_flags = 0; /* reserved for now */
-#endif // INF_AMAZON_PPA //
-
-	ASSERT(pPacket);
-
-	pRxPkt = RTPKT_TO_OSPKT(pPacket);
-
-#ifdef CONFIG_STA_SUPPORT
-#endif // CONFIG_STA_SUPPORT //
-
-    /* Push up the protocol stack */
-#ifdef IKANOS_VX_1X0
-	IKANOS_DataFrameRx(pAd, pRxPkt->dev, pRxPkt, pRxPkt->len);
-#else
-#ifdef INF_AMAZON_SE
-#ifdef BG_FT_SUPPORT
-            BG_FTPH_PacketFromApHandle(pRxPkt);
-            return;
-#endif // BG_FT_SUPPORT //
-#endif // INF_AMAZON_SE //
-	pRxPkt->protocol = eth_type_trans(pRxPkt, pRxPkt->dev);
-
-#ifdef INF_AMAZON_PPA
-	if (ppa_hook_directpath_send_fn && pAd->PPAEnable==TRUE )
-	{
-		memset(pRxPkt->head,0,pRxPkt->data-pRxPkt->head-14);
-		DBGPRINT(RT_DEBUG_TRACE, ("ppa_hook_directpath_send_fn rx :ret:%d headroom:%d dev:%s pktlen:%d<===\n",ret,skb_headroom(pRxPkt)
-			,pRxPkt->dev->name,pRxPkt->len));
-		hex_dump("rx packet", pRxPkt->data, 32);
-		ret = ppa_hook_directpath_send_fn(pAd->g_if_id, pRxPkt, pRxPkt->len, ppa_flags);
-		pRxPkt=NULL;
-		return;
-
-	}
-#endif // INF_AMAZON_PPA //
-
-//#ifdef CONFIG_5VT_ENHANCE
-//	*(int*)(pRxPkt->cb) = BRIDGE_TAG;
-//#endif
-
-	{
-		netif_rx(pRxPkt);
-	}
-
-#endif // IKANOS_VX_1X0 //
-}
-
-
-PRTMP_SCATTER_GATHER_LIST
-rt_get_sg_list_from_packet(PNDIS_PACKET pPacket, RTMP_SCATTER_GATHER_LIST *sg)
-{
-	sg->NumberOfElements = 1;
-	sg->Elements[0].Address =  GET_OS_PKT_DATAPTR(pPacket);
-	sg->Elements[0].Length = GET_OS_PKT_LEN(pPacket);
-	return (sg);
-}
-
-void hex_dump(char *str, unsigned char *pSrcBufVA, unsigned int SrcBufLen)
-{
-	unsigned char *pt;
-	int x;
-
-	if (RTDebugLevel < RT_DEBUG_TRACE)
-		return;
-
-	pt = pSrcBufVA;
-	printk("%s: %p, len = %d\n",str,  pSrcBufVA, SrcBufLen);
-	for (x=0; x<SrcBufLen; x++)
-	{
-		if (x % 16 == 0)
-			printk("0x%04x : ", x);
-		printk("%02x ", ((unsigned char)pt[x]));
-		if (x%16 == 15) printk("\n");
-	}
-	printk("\n");
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-		Send log message through wireless event
-
-		Support standard iw_event with IWEVCUSTOM. It is used below.
-
-		iwreq_data.data.flags is used to store event_flag that is defined by user.
-		iwreq_data.data.length is the length of the event log.
-
-		The format of the event log is composed of the entry's MAC address and
-		the desired log message (refer to pWirelessEventText).
-
-			ex: 11:22:33:44:55:66 has associated successfully
-
-		p.s. The requirement of Wireless Extension is v15 or newer.
-
-	========================================================================
-*/
-VOID RTMPSendWirelessEvent(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	USHORT			Event_flag,
-	IN	PUCHAR			pAddr,
-	IN	UCHAR			BssIdx,
-	IN	CHAR			Rssi)
-{
-#if WIRELESS_EXT >= 15
-
-	//union		iwreq_data      wrqu;
-	PSTRING	pBuf = NULL, pBufPtr = NULL;
-	USHORT	event, type, BufLen;
-	UCHAR	event_table_len = 0;
-
-	type = Event_flag & 0xFF00;
-	event = Event_flag & 0x00FF;
-
-	switch (type)
-	{
-		case IW_SYS_EVENT_FLAG_START:
-			event_table_len = IW_SYS_EVENT_TYPE_NUM;
-			break;
-
-		case IW_SPOOF_EVENT_FLAG_START:
-			event_table_len = IW_SPOOF_EVENT_TYPE_NUM;
-			break;
-
-		case IW_FLOOD_EVENT_FLAG_START:
-			event_table_len = IW_FLOOD_EVENT_TYPE_NUM;
-			break;
-	}
-
-	if (event_table_len == 0)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("%s : The type(%0x02x) is not valid.\n", __FUNCTION__, type));
-		return;
-	}
-
-	if (event >= event_table_len)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("%s : The event(%0x02x) is not valid.\n", __FUNCTION__, event));
-		return;
-	}
-
-	//Allocate memory and copy the msg.
-	if((pBuf = kmalloc(IW_CUSTOM_MAX_LEN, GFP_ATOMIC)) != NULL)
-	{
-		//Prepare the payload
-		memset(pBuf, 0, IW_CUSTOM_MAX_LEN);
-
-		pBufPtr = pBuf;
-
-		if (pAddr)
-			pBufPtr += sprintf(pBufPtr, "(RT2860) STA(%02x:%02x:%02x:%02x:%02x:%02x) ", PRINT_MAC(pAddr));
-		else if (BssIdx < MAX_MBSSID_NUM)
-			pBufPtr += sprintf(pBufPtr, "(RT2860) BSS(ra%d) ", BssIdx);
-		else
-			pBufPtr += sprintf(pBufPtr, "(RT2860) ");
-
-		if (type == IW_SYS_EVENT_FLAG_START)
-			pBufPtr += sprintf(pBufPtr, "%s", pWirelessSysEventText[event]);
-		else if (type == IW_SPOOF_EVENT_FLAG_START)
-			pBufPtr += sprintf(pBufPtr, "%s (RSSI=%d)", pWirelessSpoofEventText[event], Rssi);
-		else if (type == IW_FLOOD_EVENT_FLAG_START)
-			pBufPtr += sprintf(pBufPtr, "%s", pWirelessFloodEventText[event]);
-		else
-			pBufPtr += sprintf(pBufPtr, "%s", "unknown event");
-
-		pBufPtr[pBufPtr - pBuf] = '\0';
-		BufLen = pBufPtr - pBuf;
-
-		RtmpOSWrielessEventSend(pAd, IWEVCUSTOM, Event_flag, NULL, (PUCHAR)pBuf, BufLen);
-		//DBGPRINT(RT_DEBUG_TRACE, ("%s : %s\n", __FUNCTION__, pBuf));
-
-		kfree(pBuf);
-	}
-	else
-		DBGPRINT(RT_DEBUG_ERROR, ("%s : Can't allocate memory for wireless event.\n", __FUNCTION__));
-#else
-	DBGPRINT(RT_DEBUG_ERROR, ("%s : The Wireless Extension MUST be v15 or newer.\n", __FUNCTION__));
-#endif  /* WIRELESS_EXT >= 15 */
-}
-
-
-
-
-#ifdef CONFIG_STA_SUPPORT
-void send_monitor_packets(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	RX_BLK			*pRxBlk)
-{
-    struct sk_buff	*pOSPkt;
-    wlan_ng_prism2_header *ph;
-    int rate_index = 0;
-    USHORT header_len = 0;
-    UCHAR temp_header[40] = {0};
-
-    u_int32_t ralinkrate[256] = {2,4,11,22, 12,18,24,36,48,72,96,  108,   109, 110, 111, 112, 13, 26, 39, 52,78,104, 117, 130, 26, 52, 78,104, 156, 208, 234, 260, 27, 54,81,108,162, 216, 243, 270, // Last 38
-	54, 108, 162, 216, 324, 432, 486, 540,  14, 29, 43, 57, 87, 115, 130, 144, 29, 59,87,115, 173, 230,260, 288, 30, 60,90,120,180,240,270,300,60,120,180,240,360,480,540,600, 0,1,2,3,4,5,6,7,8,9,10,
-	11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80};
-
-
-    ASSERT(pRxBlk->pRxPacket);
-    if (pRxBlk->DataSize < 10)
-    {
-        DBGPRINT(RT_DEBUG_ERROR, ("%s : Size is too small! (%d)\n", __FUNCTION__, pRxBlk->DataSize));
-		goto err_free_sk_buff;
-    }
-
-    if (pRxBlk->DataSize + sizeof(wlan_ng_prism2_header) > RX_BUFFER_AGGRESIZE)
-    {
-        DBGPRINT(RT_DEBUG_ERROR, ("%s : Size is too large! (%d)\n", __FUNCTION__, pRxBlk->DataSize + sizeof(wlan_ng_prism2_header)));
-		goto err_free_sk_buff;
-    }
-
-    pOSPkt = RTPKT_TO_OSPKT(pRxBlk->pRxPacket);
-	pOSPkt->dev = get_netdev_from_bssid(pAd, BSS0);
-    if (pRxBlk->pHeader->FC.Type == BTYPE_DATA)
-    {
-        pRxBlk->DataSize -= LENGTH_802_11;
-        if ((pRxBlk->pHeader->FC.ToDs == 1) &&
-            (pRxBlk->pHeader->FC.FrDs == 1))
-            header_len = LENGTH_802_11_WITH_ADDR4;
-        else
-            header_len = LENGTH_802_11;
-
-        // QOS
-	if (pRxBlk->pHeader->FC.SubType & 0x08)
-	{
-	    header_len += 2;
-		// Data skip QOS contorl field
-		pRxBlk->DataSize -=2;
-	}
-
-	// Order bit: A-Ralink or HTC+
-	if (pRxBlk->pHeader->FC.Order)
-	{
-	    header_len += 4;
-			// Data skip HTC contorl field
-			pRxBlk->DataSize -= 4;
-	}
-
-        // Copy Header
-        if (header_len <= 40)
-            NdisMoveMemory(temp_header, pRxBlk->pData, header_len);
-
-        // skip HW padding
-	if (pRxBlk->RxD.L2PAD)
-	    pRxBlk->pData += (header_len + 2);
-        else
-            pRxBlk->pData += header_len;
-    } //end if
-
-
-	if (pRxBlk->DataSize < pOSPkt->len) {
-        skb_trim(pOSPkt,pRxBlk->DataSize);
-    } else {
-        skb_put(pOSPkt,(pRxBlk->DataSize - pOSPkt->len));
-    } //end if
-
-    if ((pRxBlk->pData - pOSPkt->data) > 0) {
-	    skb_put(pOSPkt,(pRxBlk->pData - pOSPkt->data));
-	    skb_pull(pOSPkt,(pRxBlk->pData - pOSPkt->data));
-    } //end if
-
-    if (skb_headroom(pOSPkt) < (sizeof(wlan_ng_prism2_header)+ header_len)) {
-        if (pskb_expand_head(pOSPkt, (sizeof(wlan_ng_prism2_header) + header_len), 0, GFP_ATOMIC)) {
-	        DBGPRINT(RT_DEBUG_ERROR, ("%s : Reallocate header size of sk_buff fail!\n", __FUNCTION__));
-			goto err_free_sk_buff;
-	    } //end if
-    } //end if
-
-    if (header_len > 0)
-        NdisMoveMemory(skb_push(pOSPkt, header_len), temp_header, header_len);
-
-    ph = (wlan_ng_prism2_header *) skb_push(pOSPkt, sizeof(wlan_ng_prism2_header));
-	NdisZeroMemory(ph, sizeof(wlan_ng_prism2_header));
-
-    ph->msgcode		    = DIDmsg_lnxind_wlansniffrm;
-	ph->msglen		    = sizeof(wlan_ng_prism2_header);
-	strcpy((PSTRING) ph->devname, (PSTRING) pAd->net_dev->name);
-
-    ph->hosttime.did = DIDmsg_lnxind_wlansniffrm_hosttime;
-	ph->hosttime.status = 0;
-	ph->hosttime.len = 4;
-	ph->hosttime.data = jiffies;
-
-	ph->mactime.did = DIDmsg_lnxind_wlansniffrm_mactime;
-	ph->mactime.status = 0;
-	ph->mactime.len = 0;
-	ph->mactime.data = 0;
-
-    ph->istx.did = DIDmsg_lnxind_wlansniffrm_istx;
-	ph->istx.status = 0;
-	ph->istx.len = 0;
-	ph->istx.data = 0;
-
-    ph->channel.did = DIDmsg_lnxind_wlansniffrm_channel;
-	ph->channel.status = 0;
-	ph->channel.len = 4;
-
-    ph->channel.data = (u_int32_t)pAd->CommonCfg.Channel;
-
-    ph->rssi.did = DIDmsg_lnxind_wlansniffrm_rssi;
-	ph->rssi.status = 0;
-	ph->rssi.len = 4;
-    ph->rssi.data = (u_int32_t)RTMPMaxRssi(pAd, ConvertToRssi(pAd, pRxBlk->pRxWI->RSSI0, RSSI_0), ConvertToRssi(pAd, pRxBlk->pRxWI->RSSI1, RSSI_1), ConvertToRssi(pAd, pRxBlk->pRxWI->RSSI2, RSSI_2));;
-
-	ph->signal.did = DIDmsg_lnxind_wlansniffrm_signal;
-	ph->signal.status = 0;
-	ph->signal.len = 4;
-	ph->signal.data = 0; //rssi + noise;
-
-	ph->noise.did = DIDmsg_lnxind_wlansniffrm_noise;
-	ph->noise.status = 0;
-	ph->noise.len = 4;
-	ph->noise.data = 0;
-
-#ifdef DOT11_N_SUPPORT
-    if (pRxBlk->pRxWI->PHYMODE >= MODE_HTMIX)
-    {
-	rate_index = 16 + ((UCHAR)pRxBlk->pRxWI->BW *16) + ((UCHAR)pRxBlk->pRxWI->ShortGI *32) + ((UCHAR)pRxBlk->pRxWI->MCS);
-    }
-    else
-#endif // DOT11_N_SUPPORT //
-	if (pRxBlk->pRxWI->PHYMODE == MODE_OFDM)
-	rate_index = (UCHAR)(pRxBlk->pRxWI->MCS) + 4;
-    else
-	rate_index = (UCHAR)(pRxBlk->pRxWI->MCS);
-    if (rate_index < 0)
-        rate_index = 0;
-    if (rate_index > 255)
-        rate_index = 255;
-
-	ph->rate.did = DIDmsg_lnxind_wlansniffrm_rate;
-	ph->rate.status = 0;
-	ph->rate.len = 4;
-    ph->rate.data = ralinkrate[rate_index];
-
-	ph->frmlen.did = DIDmsg_lnxind_wlansniffrm_frmlen;
-    ph->frmlen.status = 0;
-	ph->frmlen.len = 4;
-	ph->frmlen.data	= (u_int32_t)pRxBlk->DataSize;
-
-
-    pOSPkt->pkt_type = PACKET_OTHERHOST;
-    pOSPkt->protocol = eth_type_trans(pOSPkt, pOSPkt->dev);
-    pOSPkt->ip_summed = CHECKSUM_NONE;
-    netif_rx(pOSPkt);
-
-    return;
-
-err_free_sk_buff:
-	RELEASE_NDIS_PACKET(pAd, pRxBlk->pRxPacket, NDIS_STATUS_FAILURE);
-	return;
-
-}
-#endif // CONFIG_STA_SUPPORT //
-
-
-
-/*******************************************************************************
-
-	File open/close related functions.
-
- *******************************************************************************/
-RTMP_OS_FD RtmpOSFileOpen(char *pPath,  int flag, int mode)
-{
-	struct file	*filePtr;
-
-	filePtr = filp_open(pPath, flag, 0);
-	if (IS_ERR(filePtr))
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("%s(): Error %ld opening %s\n", __FUNCTION__, -PTR_ERR(filePtr), pPath));
-	}
-
-	return (RTMP_OS_FD)filePtr;
-}
-
-int RtmpOSFileClose(RTMP_OS_FD osfd)
-{
-	filp_close(osfd, NULL);
-	return 0;
-}
-
-
-void RtmpOSFileSeek(RTMP_OS_FD osfd, int offset)
-{
-	osfd->f_pos = offset;
-}
-
-
-int RtmpOSFileRead(RTMP_OS_FD osfd, char *pDataPtr, int readLen)
-{
-	// The object must have a read method
-	if (osfd->f_op && osfd->f_op->read)
-	{
-		return osfd->f_op->read(osfd,  pDataPtr, readLen, &osfd->f_pos);
-	}
-	else
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("no file read method\n"));
-		return -1;
-	}
-}
-
-
-int RtmpOSFileWrite(RTMP_OS_FD osfd, char *pDataPtr, int writeLen)
-{
-	return osfd->f_op->write(osfd, pDataPtr, (size_t)writeLen, &osfd->f_pos);
-}
-
-
-void RtmpOSFSInfoChange(RTMP_OS_FS_INFO *pOSFSInfo, BOOLEAN bSet)
-{
-	if (bSet)
-	{
-		// Save uid and gid used for filesystem access.
-		// Set user and group to 0 (root)
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,29)
-		pOSFSInfo->fsuid= current->fsuid;
-		pOSFSInfo->fsgid = current->fsgid;
-		current->fsuid = current->fsgid = 0;
-#else
-		pOSFSInfo->fsuid = current_fsuid();
-		pOSFSInfo->fsgid = current_fsgid();
-#endif
-		pOSFSInfo->fs = get_fs();
-		set_fs(KERNEL_DS);
-	}
-	else
-	{
-		set_fs(pOSFSInfo->fs);
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,29)
-		current->fsuid = pOSFSInfo->fsuid;
-		current->fsgid = pOSFSInfo->fsgid;
-#endif
-	}
-}
-
-
-
-/*******************************************************************************
-
-	Task create/management/kill related functions.
-
- *******************************************************************************/
-NDIS_STATUS RtmpOSTaskKill(
-	IN RTMP_OS_TASK *pTask)
-{
-	RTMP_ADAPTER *pAd;
-	int ret = NDIS_STATUS_FAILURE;
-
-	pAd = (RTMP_ADAPTER *)pTask->priv;
-
-#ifdef KTHREAD_SUPPORT
-	if (pTask->kthread_task)
-	{
-		kthread_stop(pTask->kthread_task);
-		ret = NDIS_STATUS_SUCCESS;
-	}
-#else
-	CHECK_PID_LEGALITY(pTask->taskPID)
-	{
-		printk("Terminate the task(%s) with pid(%d)!\n", pTask->taskName, GET_PID_NUMBER(pTask->taskPID));
-		mb();
-		pTask->task_killed = 1;
-		mb();
-		ret = KILL_THREAD_PID(pTask->taskPID, SIGTERM, 1);
-		if (ret)
-		{
-			printk(KERN_WARNING "kill task(%s) with pid(%d) failed(retVal=%d)!\n",
-				pTask->taskName, GET_PID_NUMBER(pTask->taskPID), ret);
-		}
-		else
-		{
-			wait_for_completion(&pTask->taskComplete);
-			pTask->taskPID = THREAD_PID_INIT_VALUE;
-			pTask->task_killed = 0;
-			ret = NDIS_STATUS_SUCCESS;
-		}
-	}
-#endif
-
-	return ret;
-
-}
-
-
-INT RtmpOSTaskNotifyToExit(
-	IN RTMP_OS_TASK *pTask)
-{
-
-#ifndef KTHREAD_SUPPORT
-	complete_and_exit(&pTask->taskComplete, 0);
-#endif
-
-	return 0;
-}
-
-
-void RtmpOSTaskCustomize(
-	IN RTMP_OS_TASK *pTask)
-{
-
-#ifndef KTHREAD_SUPPORT
-
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,5,0)
-	daemonize((PSTRING)&pTask->taskName[0]/*"%s",pAd->net_dev->name*/);
-
-	allow_signal(SIGTERM);
-	allow_signal(SIGKILL);
-	current->flags |= PF_NOFREEZE;
-#else
-	unsigned long flags;
-
-	daemonize();
-	reparent_to_init();
-	strcpy(current->comm, &pTask->taskName[0]);
-
-	siginitsetinv(&current->blocked, sigmask(SIGTERM) | sigmask(SIGKILL));
-
-	/* Allow interception of SIGKILL only
-	 * Don't allow other signals to interrupt the transmission */
-#if LINUX_VERSION_CODE > KERNEL_VERSION(2,4,22)
-	spin_lock_irqsave(&current->sigmask_lock, flags);
-	flush_signals(current);
-	recalc_sigpending(current);
-	spin_unlock_irqrestore(&current->sigmask_lock, flags);
-#endif
-#endif
-
-    /* signal that we've started the thread */
-	complete(&pTask->taskComplete);
-
-#endif
-}
-
-
-NDIS_STATUS RtmpOSTaskAttach(
-	IN RTMP_OS_TASK *pTask,
-	IN int (*fn)(void *),
-	IN void *arg)
-{
-	NDIS_STATUS status = NDIS_STATUS_SUCCESS;
-	pid_t pid_number = -1;
-
-#ifdef KTHREAD_SUPPORT
-	pTask->task_killed = 0;
-	pTask->kthread_task = NULL;
-	pTask->kthread_task = kthread_run(fn, arg, pTask->taskName);
-	if (IS_ERR(pTask->kthread_task))
-		status = NDIS_STATUS_FAILURE;
-#else
-	pid_number = kernel_thread(fn, arg, RTMP_OS_MGMT_TASK_FLAGS);
-	if (pid_number < 0)
-	{
-		DBGPRINT (RT_DEBUG_ERROR, ("Attach task(%s) failed!\n", pTask->taskName));
-		status = NDIS_STATUS_FAILURE;
-	}
-	else
-	{
-		pTask->taskPID = GET_PID(pid_number);
-
-		// Wait for the thread to start
-		wait_for_completion(&pTask->taskComplete);
-		status = NDIS_STATUS_SUCCESS;
-	}
-#endif
-	return status;
-}
-
-
-NDIS_STATUS RtmpOSTaskInit(
-	IN RTMP_OS_TASK *pTask,
-	IN PSTRING		pTaskName,
-	IN VOID			*pPriv)
-{
-	int len;
-
-	ASSERT(pTask);
-
-#ifndef KTHREAD_SUPPORT
-	NdisZeroMemory((PUCHAR)(pTask), sizeof(RTMP_OS_TASK));
-#endif
-
-	len = strlen(pTaskName);
-	len = len > (RTMP_OS_TASK_NAME_LEN -1) ? (RTMP_OS_TASK_NAME_LEN-1) : len;
-	NdisMoveMemory(&pTask->taskName[0], pTaskName, len);
-	pTask->priv = pPriv;
-
-#ifndef KTHREAD_SUPPORT
-	RTMP_SEM_EVENT_INIT_LOCKED(&(pTask->taskSema));
-	pTask->taskPID = THREAD_PID_INIT_VALUE;
-
-	init_completion (&pTask->taskComplete);
-#endif
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-void RTMP_IndicateMediaState(
-	IN	PRTMP_ADAPTER	pAd)
-{
-	if (pAd->CommonCfg.bWirelessEvent)
-	{
-		if (pAd->IndicateMediaState == NdisMediaStateConnected)
-		{
-			RTMPSendWirelessEvent(pAd, IW_STA_LINKUP_EVENT_FLAG, pAd->MacTab.Content[BSSID_WCID].Addr, BSS0, 0);
-		}
-		else
-		{
-			RTMPSendWirelessEvent(pAd, IW_STA_LINKDOWN_EVENT_FLAG, pAd->MacTab.Content[BSSID_WCID].Addr, BSS0, 0);
-		}
-	}
-}
-
-
-#if LINUX_VERSION_CODE <= 0x20402	// Red Hat 7.1
-//static struct net_device *alloc_netdev(int sizeof_priv, const char *mask, void (*setup)(struct net_device *)) //sample
-struct net_device *alloc_netdev(
-	int sizeof_priv,
-	const char *mask,
-	void (*setup)(struct net_device *))
-{
-    struct net_device	*dev;
-    INT					alloc_size;
-
-
-    /* ensure 32-byte alignment of the private area */
-    alloc_size = sizeof (*dev) + sizeof_priv + 31;
-
-    dev = (struct net_device *) kmalloc(alloc_size, GFP_KERNEL);
-    if (dev == NULL)
-    {
-        DBGPRINT(RT_DEBUG_ERROR,
-				("alloc_netdev: Unable to allocate device memory.\n"));
-        return NULL;
-    }
-
-    memset(dev, 0, alloc_size);
-
-    if (sizeof_priv)
-        dev->priv = (void *) (((long)(dev + 1) + 31) & ~31);
-
-    setup(dev);
-    strcpy(dev->name, mask);
-
-    return dev;
-}
-#endif // LINUX_VERSION_CODE //
-
-
-int RtmpOSWrielessEventSend(
-	IN RTMP_ADAPTER *pAd,
-	IN UINT32		eventType,
-	IN INT			flags,
-	IN PUCHAR		pSrcMac,
-	IN PUCHAR		pData,
-	IN UINT32		dataLen)
-{
-	union iwreq_data    wrqu;
-
-       memset(&wrqu, 0, sizeof(wrqu));
-
-	if (flags>-1)
-	       wrqu.data.flags = flags;
-
-	if (pSrcMac)
-		memcpy(wrqu.ap_addr.sa_data, pSrcMac, MAC_ADDR_LEN);
-
-	if ((pData!= NULL) && (dataLen > 0))
-		wrqu.data.length = dataLen;
-
-       wireless_send_event(pAd->net_dev, eventType, &wrqu, (char *)pData);
-	return 0;
-}
-
-
-int RtmpOSNetDevAddrSet(
-	IN PNET_DEV pNetDev,
-	IN PUCHAR	pMacAddr)
-{
-	struct net_device *net_dev;
-	RTMP_ADAPTER *pAd;
-
-	net_dev = pNetDev;
-	//pAd = (RTMP_ADAPTER *)net_dev->priv;
-	pAd=RTMP_OS_NETDEV_GET_PRIV(pNetDev);
-
-#ifdef CONFIG_STA_SUPPORT
-	// work-around for the SuSE due to it has it's own interface name management system.
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-		NdisZeroMemory(pAd->StaCfg.dev_name, 16);
-		NdisMoveMemory(pAd->StaCfg.dev_name, net_dev->name, strlen(net_dev->name));
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-	NdisMoveMemory(net_dev->dev_addr, pMacAddr, 6);
-
-	return 0;
-}
-
-
-
-/*
-  *	Assign the network dev name for created Ralink WiFi interface.
-  */
-static int RtmpOSNetDevRequestName(
-	IN RTMP_ADAPTER *pAd,
-	IN PNET_DEV dev,
-	IN PSTRING pPrefixStr,
-	IN INT	devIdx)
-{
-	PNET_DEV		existNetDev;
-	STRING		suffixName[IFNAMSIZ];
-	STRING		desiredName[IFNAMSIZ];
-	int	ifNameIdx, prefixLen, slotNameLen;
-	int Status;
-
-
-	prefixLen = strlen(pPrefixStr);
-	ASSERT((prefixLen < IFNAMSIZ));
-
-	for (ifNameIdx = devIdx; ifNameIdx < 32; ifNameIdx++)
-	{
-		memset(suffixName, 0, IFNAMSIZ);
-		memset(desiredName, 0, IFNAMSIZ);
-		strncpy(&desiredName[0], pPrefixStr, prefixLen);
-
-#ifdef MULTIPLE_CARD_SUPPORT
-		if (pAd->MC_RowID >= 0)
-			sprintf(suffixName, "%02d_%d", pAd->MC_RowID, ifNameIdx);
-		else
-#endif // MULTIPLE_CARD_SUPPORT //
-		sprintf(suffixName, "%d", ifNameIdx);
-
-		slotNameLen = strlen(suffixName);
-		ASSERT(((slotNameLen + prefixLen) < IFNAMSIZ));
-		strcat(desiredName, suffixName);
-
-		existNetDev = RtmpOSNetDevGetByName(dev, &desiredName[0]);
-		if (existNetDev == NULL)
-			break;
-		else
-			RtmpOSNetDeviceRefPut(existNetDev);
-	}
-
-	if(ifNameIdx < 32)
-	{
-		strcpy(&dev->name[0], &desiredName[0]);
-		Status = NDIS_STATUS_SUCCESS;
-	}
-	else
-	{
-		DBGPRINT(RT_DEBUG_ERROR,
-					("Cannot request DevName with preifx(%s) and in range(0~32) as suffix from OS!\n", pPrefixStr));
-		Status = NDIS_STATUS_FAILURE;
-	}
-
-	return Status;
-}
-
-
-void RtmpOSNetDevClose(
-	IN PNET_DEV pNetDev)
-{
-	dev_close(pNetDev);
-}
-
-
-void RtmpOSNetDevFree(PNET_DEV pNetDev)
-{
-	ASSERT(pNetDev);
-
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,5,0)
-	free_netdev(pNetDev);
-#else
-	kfree(pNetDev);
-#endif
-}
-
-
-INT RtmpOSNetDevAlloc(
-	IN PNET_DEV *new_dev_p,
-	IN UINT32	privDataSize)
-{
-	// assign it as null first.
-	*new_dev_p = NULL;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Allocate a net device with private data size=%d!\n", privDataSize));
-#if LINUX_VERSION_CODE <= 0x20402 // Red Hat 7.1
-	*new_dev_p = alloc_netdev(privDataSize, "eth%d", ether_setup);
-#else
-	*new_dev_p = alloc_etherdev(privDataSize);
-#endif // LINUX_VERSION_CODE //
-
-	if (*new_dev_p)
-		return NDIS_STATUS_SUCCESS;
-	else
-		return NDIS_STATUS_FAILURE;
-}
-
-
-PNET_DEV RtmpOSNetDevGetByName(PNET_DEV pNetDev, PSTRING pDevName)
-{
-	PNET_DEV	pTargetNetDev = NULL;
-
-
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,5,0)
-
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,24)
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,26)
-	pTargetNetDev = dev_get_by_name(dev_net(pNetDev), pDevName);
-#else
-	ASSERT(pNetDev);
-	pTargetNetDev = dev_get_by_name(pNetDev->nd_net, pDevName);
-#endif
-#else
-	pTargetNetDev = dev_get_by_name(pDevName);
-#endif // KERNEL_VERSION(2,6,24) //
-
-#else
-	int	devNameLen;
-
-	devNameLen = strlen(pDevName);
-	ASSERT((devNameLen <= IFNAMSIZ));
-
-	for(pTargetNetDev=dev_base; pTargetNetDev!=NULL; pTargetNetDev=pTargetNetDev->next)
-	{
-		if (strncmp(pTargetNetDev->name, pDevName, devNameLen) == 0)
-			break;
-	}
-#endif // KERNEL_VERSION(2,5,0) //
-
-	return pTargetNetDev;
-}
-
-
-void RtmpOSNetDeviceRefPut(PNET_DEV pNetDev)
-{
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,5,0)
-	/*
-		every time dev_get_by_name is called, and it has returned a valid struct
-		net_device*, dev_put should be called afterwards, because otherwise the
-		machine hangs when the device is unregistered (since dev->refcnt > 1).
-	*/
-	if(pNetDev)
-		dev_put(pNetDev);
-#endif // LINUX_VERSION_CODE //
-}
-
-
-INT RtmpOSNetDevDestory(
-	IN RTMP_ADAPTER *pAd,
-	IN PNET_DEV		pNetDev)
-{
-
-	// TODO: Need to fix this
-	printk("WARNING: This function(%s) not implement yet!!!\n", __FUNCTION__);
-	return 0;
-}
-
-
-void RtmpOSNetDevDetach(PNET_DEV pNetDev)
-{
-	unregister_netdev(pNetDev);
-}
-
-
-int RtmpOSNetDevAttach(
-	IN PNET_DEV pNetDev,
-	IN RTMP_OS_NETDEV_OP_HOOK *pDevOpHook)
-{
-	int ret, rtnl_locked = FALSE;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("RtmpOSNetDevAttach()--->\n"));
-	// If we need hook some callback function to the net device structrue, now do it.
-	if (pDevOpHook)
-	{
-		PRTMP_ADAPTER pAd = RTMP_OS_NETDEV_GET_PRIV(pNetDev);
-
-		pNetDev->netdev_ops = pDevOpHook->netdev_ops;
-
-		/* OS specific flags, here we used to indicate if we are virtual interface */
-		pNetDev->priv_flags = pDevOpHook->priv_flags;
-
-#if (WIRELESS_EXT < 21) && (WIRELESS_EXT >= 12)
-		pNetDev->get_wireless_stats = rt28xx_get_wireless_stats;
-#endif
-
-#ifdef CONFIG_STA_SUPPORT
-#if WIRELESS_EXT >= 12
-		if (pAd->OpMode == OPMODE_STA)
-		{
-			pNetDev->wireless_handlers = &rt28xx_iw_handler_def;
-		}
-#endif //WIRELESS_EXT >= 12
-#endif // CONFIG_STA_SUPPORT //
-
-#ifdef CONFIG_APSTA_MIXED_SUPPORT
-#if WIRELESS_EXT >= 12
-		if (pAd->OpMode == OPMODE_AP)
-		{
-			pNetDev->wireless_handlers = &rt28xx_ap_iw_handler_def;
-		}
-#endif //WIRELESS_EXT >= 12
-#endif // CONFIG_APSTA_MIXED_SUPPORT //
-
-		// copy the net device mac address to the net_device structure.
-		NdisMoveMemory(pNetDev->dev_addr, &pDevOpHook->devAddr[0], MAC_ADDR_LEN);
-
-		rtnl_locked = pDevOpHook->needProtcted;
-	}
-
-	if (rtnl_locked)
-		ret = register_netdevice(pNetDev);
-	else
-		ret = register_netdev(pNetDev);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("<---RtmpOSNetDevAttach(), ret=%d\n", ret));
-	if (ret == 0)
-		return NDIS_STATUS_SUCCESS;
-	else
-		return NDIS_STATUS_FAILURE;
-}
-
-
-PNET_DEV RtmpOSNetDevCreate(
-	IN RTMP_ADAPTER *pAd,
-	IN INT			devType,
-	IN INT			devNum,
-	IN INT			privMemSize,
-	IN PSTRING		pNamePrefix)
-{
-	struct net_device *pNetDev = NULL;
-	int status;
-
-
-	/* allocate a new network device */
-	status = RtmpOSNetDevAlloc(&pNetDev, 0 /*privMemSize*/);
-	if (status != NDIS_STATUS_SUCCESS)
-	{
-		/* allocation fail, exit */
-		DBGPRINT(RT_DEBUG_ERROR, ("Allocate network device fail (%s)...\n", pNamePrefix));
-		return NULL;
-	}
-
-
-	/* find a available interface name, max 32 interfaces */
-	status = RtmpOSNetDevRequestName(pAd, pNetDev, pNamePrefix, devNum);
-	if (status != NDIS_STATUS_SUCCESS)
-	{
-		/* error! no any available ra name can be used! */
-		DBGPRINT(RT_DEBUG_ERROR, ("Assign interface name (%s with suffix 0~32) failed...\n", pNamePrefix));
-		RtmpOSNetDevFree(pNetDev);
-
-		return NULL;
-	}
-	else
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("The name of the new %s interface is %s...\n", pNamePrefix, pNetDev->name));
-	}
-
-	return pNetDev;
-}
diff --git a/drivers/staging/rt3090/rt_linux.h b/drivers/staging/rt3090/rt_linux.h
deleted file mode 100644
index a970e780ef27..000000000000
--- a/drivers/staging/rt3090/rt_linux.h
+++ /dev/null
@@ -1,1034 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-    Module Name:
-	rt_linux.h
-
-    Abstract:
-
-    Revision History:
-    Who          When          What
-    ---------    ----------    ----------------------------------------------
-*/
-
-#ifndef __RT_LINUX_H__
-#define __RT_LINUX_H__
-
-#include <linux/module.h>
-#include <linux/version.h>
-#include <linux/kernel.h>
-#include <linux/spinlock.h>
-#include <linux/init.h>
-#include <linux/string.h>
-#include <linux/timer.h>
-#include <linux/errno.h>
-#include <linux/slab.h>
-#include <linux/interrupt.h>
-#include <linux/pci.h>
-#include <linux/netdevice.h>
-#include <linux/etherdevice.h>
-#include <linux/skbuff.h>
-#include <linux/ethtool.h>
-#include <linux/wireless.h>
-#include <linux/proc_fs.h>
-#include <linux/delay.h>
-#include <linux/if_arp.h>
-#include <linux/ctype.h>
-#include <linux/vmalloc.h>
-#include <linux/wireless.h>
-#include <net/iw_handler.h>
-
-#ifdef INF_AMAZON_PPA
-#include <asm/amazon_se/ifx_ppa_interface.h>
-#include <asm/amazon_se/ifx_ppa_hook.h>
-#endif // INF_AMAZON_PPA //
-
-// load firmware
-#define __KERNEL_SYSCALLS__
-#include <linux/unistd.h>
-#include <asm/uaccess.h>
-#include <asm/types.h>
-#include <asm/unaligned.h>	// for get_unaligned()
-
-#ifdef KTHREAD_SUPPORT
-#include <linux/err.h>
-#include <linux/kthread.h>
-#endif // KTHREAD_SUPPORT //
-
-#undef AP_WSC_INCLUDED
-#undef STA_WSC_INCLUDED
-#undef WSC_INCLUDED
-
-
-#ifdef CONFIG_STA_SUPPORT
-#endif // CONFIG_STA_SUPPORT //
-
-
-#ifdef KTHREAD_SUPPORT
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,4)
-#error "This kerne version doesn't support kthread!!"
-#endif
-#endif // KTHREAD_SUPPORT //
-
-/***********************************************************************************
- *	Profile related sections
- ***********************************************************************************/
-
-
-#ifdef CONFIG_STA_SUPPORT
-#ifdef RTMP_MAC_PCI
-#define STA_PROFILE_PATH			"/etc/Wireless/RT2860STA/RT2860STA.dat"
-#define STA_DRIVER_VERSION			"2.1.0.0"
-#ifdef MULTIPLE_CARD_SUPPORT
-#define CARD_INFO_PATH			"/etc/Wireless/RT2860STA/RT2860STACard.dat"
-#endif // MULTIPLE_CARD_SUPPORT //
-#endif // RTMP_MAC_PCI //
-
-
-
-extern	const struct iw_handler_def rt28xx_iw_handler_def;
-#endif // CONFIG_STA_SUPPORT //
-
-#ifdef CONFIG_APSTA_MIXED_SUPPORT
-extern	const struct iw_handler_def rt28xx_ap_iw_handler_def;
-#endif // CONFIG_APSTA_MIXED_SUPPORT //
-
-/***********************************************************************************
- *	Compiler related definitions
- ***********************************************************************************/
-#undef __inline
-#define __inline		static inline
-#define IN
-#define OUT
-#define INOUT
-#define NDIS_STATUS		INT
-
-
-/***********************************************************************************
- *	OS Specific definitions and data structures
- ***********************************************************************************/
-typedef struct pci_dev		* PPCI_DEV;
-typedef struct net_device	* PNET_DEV;
-typedef void				* PNDIS_PACKET;
-typedef char				NDIS_PACKET;
-typedef PNDIS_PACKET		* PPNDIS_PACKET;
-typedef	dma_addr_t			NDIS_PHYSICAL_ADDRESS;
-typedef	dma_addr_t			* PNDIS_PHYSICAL_ADDRESS;
-typedef void				* NDIS_HANDLE;
-typedef char				* PNDIS_BUFFER;
-
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,27)
-typedef	struct pid *	RTMP_OS_PID;
-#else
-typedef pid_t				RTMP_OS_PID;
-#endif
-
-typedef struct semaphore	RTMP_OS_SEM;
-
-#ifdef RTMP_MAC_PCI
-#ifndef PCI_DEVICE
-#define PCI_DEVICE(vend,dev) \
-	.vendor = (vend), .device = (dev), \
-	.subvendor = PCI_ANY_ID, .subdevice = PCI_ANY_ID
-#endif // PCI_DEVICE //
-#endif // RTMP_MAC_PCI //
-
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,5,0)
-#define RT_MOD_INC_USE_COUNT() \
-	if (!try_module_get(THIS_MODULE)) \
-	{ \
-		DBGPRINT(RT_DEBUG_ERROR, ("%s: cannot reserve module\n", __FUNCTION__)); \
-		return -1; \
-	}
-
-#define RT_MOD_DEC_USE_COUNT() module_put(THIS_MODULE);
-#else
-#define RT_MOD_INC_USE_COUNT()	MOD_INC_USE_COUNT;
-#define RT_MOD_DEC_USE_COUNT() MOD_DEC_USE_COUNT;
-#endif
-
-#define RTMP_INC_REF(_A)		0
-#define RTMP_DEC_REF(_A)		0
-#define RTMP_GET_REF(_A)		0
-
-
-#if WIRELESS_EXT >= 12
-// This function will be called when query /proc
-struct iw_statistics *rt28xx_get_wireless_stats(
-    IN struct net_device *net_dev);
-#endif
-
-
-/***********************************************************************************
- *	Network related constant definitions
- ***********************************************************************************/
-#ifndef IFNAMSIZ
-#define IFNAMSIZ 16
-#endif
-
-#define ETH_LENGTH_OF_ADDRESS	6
-
-#define NDIS_STATUS_SUCCESS                     0x00
-#define NDIS_STATUS_FAILURE                     0x01
-#define NDIS_STATUS_INVALID_DATA				0x02
-#define NDIS_STATUS_RESOURCES                   0x03
-
-#define NDIS_SET_PACKET_STATUS(_p, _status)			do{} while(0)
-#define NdisWriteErrorLogEntry(_a, _b, _c, _d)		do{} while(0)
-
-/* statistics counter */
-#define STATS_INC_RX_PACKETS(_pAd, _dev)
-#define STATS_INC_TX_PACKETS(_pAd, _dev)
-
-#define STATS_INC_RX_BYTESS(_pAd, _dev, len)
-#define STATS_INC_TX_BYTESS(_pAd, _dev, len)
-
-#define STATS_INC_RX_ERRORS(_pAd, _dev)
-#define STATS_INC_TX_ERRORS(_pAd, _dev)
-
-#define STATS_INC_RX_DROPPED(_pAd, _dev)
-#define STATS_INC_TX_DROPPED(_pAd, _dev)
-
-
-/***********************************************************************************
- *	Ralink Specific network related constant definitions
- ***********************************************************************************/
-#define MIN_NET_DEVICE_FOR_AID			0x00		//0x00~0x3f
-#define MIN_NET_DEVICE_FOR_MBSSID		0x00		//0x00,0x10,0x20,0x30
-#define MIN_NET_DEVICE_FOR_WDS			0x10		//0x40,0x50,0x60,0x70
-#define MIN_NET_DEVICE_FOR_APCLI		0x20
-#define MIN_NET_DEVICE_FOR_MESH			0x30
-#ifdef CONFIG_STA_SUPPORT
-#define MIN_NET_DEVICE_FOR_DLS			0x40
-#endif // CONFIG_STA_SUPPORT //
-#define NET_DEVICE_REAL_IDX_MASK		0x0f		// for each operation mode, we maximum support 15 entities.
-
-
-#ifdef CONFIG_STA_SUPPORT
-#define NDIS_PACKET_TYPE_DIRECTED		0
-#define NDIS_PACKET_TYPE_MULTICAST		1
-#define NDIS_PACKET_TYPE_BROADCAST		2
-#define NDIS_PACKET_TYPE_ALL_MULTICAST	3
-#define NDIS_PACKET_TYPE_PROMISCUOUS	4
-#endif // CONFIG_STA_SUPPORT //
-
-
-/***********************************************************************************
- *	OS signaling related constant definitions
- ***********************************************************************************/
-
-
-/***********************************************************************************
- *	OS file operation related data structure definitions
- ***********************************************************************************/
-typedef struct file* RTMP_OS_FD;
-
-typedef struct _RTMP_OS_FS_INFO_
-{
-	int				fsuid;
-	int				fsgid;
-	mm_segment_t	fs;
-}RTMP_OS_FS_INFO;
-
-#define IS_FILE_OPEN_ERR(_fd)	IS_ERR((_fd))
-
-
-/***********************************************************************************
- *	OS semaphore related data structure and definitions
- ***********************************************************************************/
-struct os_lock  {
-	spinlock_t		lock;
-	unsigned long	flags;
-};
-
-typedef spinlock_t			NDIS_SPIN_LOCK;
-
-//
-//  spin_lock enhanced for Nested spin lock
-//
-#define NdisAllocateSpinLock(__lock)      \
-{                                       \
-    spin_lock_init((spinlock_t *)(__lock));               \
-}
-
-#define NdisFreeSpinLock(lock)          \
-	do{}while(0)
-
-
-#define RTMP_SEM_LOCK(__lock)					\
-{												\
-	spin_lock_bh((spinlock_t *)(__lock));		\
-}
-
-#define RTMP_SEM_UNLOCK(__lock)					\
-{												\
-	spin_unlock_bh((spinlock_t *)(__lock));		\
-}
-
-
-// sample, use semaphore lock to replace IRQ lock, 2007/11/15
-#define RTMP_IRQ_LOCK(__lock, __irqflags)			\
-{													\
-	__irqflags = 0;									\
-	spin_lock_bh((spinlock_t *)(__lock));			\
-	pAd->irq_disabled |= 1; \
-}
-
-#define RTMP_IRQ_UNLOCK(__lock, __irqflag)			\
-{													\
-	pAd->irq_disabled &= 0;							\
-	spin_unlock_bh((spinlock_t *)(__lock));			\
-}
-
-#define RTMP_INT_LOCK(__lock, __irqflags)			\
-{													\
-	spin_lock_irqsave((spinlock_t *)__lock, __irqflags);	\
-}
-
-#define RTMP_INT_UNLOCK(__lock, __irqflag)			\
-{													\
-	spin_unlock_irqrestore((spinlock_t *)(__lock), ((unsigned long)__irqflag));	\
-}
-
-#define NdisAcquireSpinLock		RTMP_SEM_LOCK
-#define NdisReleaseSpinLock		RTMP_SEM_UNLOCK
-
-#ifndef wait_event_interruptible_timeout
-#define __wait_event_interruptible_timeout(wq, condition, ret) \
-do { \
-        wait_queue_t __wait; \
-        init_waitqueue_entry(&__wait, current); \
-        add_wait_queue(&wq, &__wait); \
-        for (;;) { \
-                set_current_state(TASK_INTERRUPTIBLE); \
-                if (condition) \
-                        break; \
-                if (!signal_pending(current)) { \
-                        ret = schedule_timeout(ret); \
-                        if (!ret) \
-                                break; \
-                        continue; \
-                } \
-                ret = -ERESTARTSYS; \
-                break; \
-        } \
-        current->state = TASK_RUNNING; \
-        remove_wait_queue(&wq, &__wait); \
-} while (0)
-
-#define wait_event_interruptible_timeout(wq, condition, timeout) \
-({ \
-        long __ret = timeout; \
-        if (!(condition)) \
-                __wait_event_interruptible_timeout(wq, condition, __ret); \
-        __ret; \
-})
-#endif
-
-#define RTMP_SEM_EVENT_INIT_LOCKED(_pSema)	sema_init((_pSema), 0)
-#define RTMP_SEM_EVENT_INIT(_pSema)			sema_init((_pSema), 1)
-#define RTMP_SEM_EVENT_WAIT(_pSema, _status)	((_status) = down_interruptible((_pSema)))
-#define RTMP_SEM_EVENT_UP(_pSema)			up(_pSema)
-
-#ifdef KTHREAD_SUPPORT
-#define RTMP_WAIT_EVENT_INTERRUPTIBLE(_pAd, _pTask) \
-{ \
-		wait_event_interruptible(_pTask->kthread_q, \
-								 _pTask->kthread_running || kthread_should_stop()); \
-		_pTask->kthread_running = FALSE; \
-		if (kthread_should_stop()) \
-		{ \
-			RTMP_SET_FLAG(_pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS); \
-			break; \
-		} \
-}
-#endif
-
-#ifdef KTHREAD_SUPPORT
-#define WAKE_UP(_pTask) \
-	do{ \
-		if ((_pTask)->kthread_task) \
-        { \
-			(_pTask)->kthread_running = TRUE; \
-	        wake_up(&(_pTask)->kthread_q); \
-		} \
-	}while(0)
-#endif
-
-/***********************************************************************************
- *	OS Memory Access related data structure and definitions
- ***********************************************************************************/
-#define MEM_ALLOC_FLAG      (GFP_ATOMIC) //(GFP_DMA | GFP_ATOMIC)
-
-#define NdisMoveMemory(Destination, Source, Length) memmove(Destination, Source, Length)
-#define NdisCopyMemory(Destination, Source, Length) memcpy(Destination, Source, Length)
-#define NdisZeroMemory(Destination, Length)         memset(Destination, 0, Length)
-#define NdisFillMemory(Destination, Length, Fill)   memset(Destination, Fill, Length)
-#define NdisCmpMemory(Destination, Source, Length)  memcmp(Destination, Source, Length)
-#define NdisEqualMemory(Source1, Source2, Length)   (!memcmp(Source1, Source2, Length))
-#define RTMPEqualMemory(Source1, Source2, Length)	(!memcmp(Source1, Source2, Length))
-
-#define MlmeAllocateMemory(_pAd, _ppVA)		os_alloc_mem(_pAd, _ppVA, MGMT_DMA_BUFFER_SIZE)
-#define MlmeFreeMemory(_pAd, _pVA)			os_free_mem(_pAd, _pVA)
-
-#define COPY_MAC_ADDR(Addr1, Addr2)             memcpy((Addr1), (Addr2), MAC_ADDR_LEN)
-
-
-/***********************************************************************************
- *	OS task related data structure and definitions
- ***********************************************************************************/
-#define RTMP_OS_MGMT_TASK_FLAGS	CLONE_VM
-
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,27)
-typedef	struct pid *	THREAD_PID;
-#define	THREAD_PID_INIT_VALUE	NULL
-#define	GET_PID(_v)	find_get_pid((_v))
-#define	GET_PID_NUMBER(_v)	pid_nr((_v))
-#define CHECK_PID_LEGALITY(_pid)	if (pid_nr((_pid)) >= 0)
-#define KILL_THREAD_PID(_A, _B, _C)	kill_pid((_A), (_B), (_C))
-#else
-typedef	pid_t	THREAD_PID;
-#define	THREAD_PID_INIT_VALUE	-1
-#define	GET_PID(_v)	(_v)
-#define	GET_PID_NUMBER(_v)	(_v)
-#define CHECK_PID_LEGALITY(_pid)	if ((_pid) >= 0)
-#define KILL_THREAD_PID(_A, _B, _C)	kill_proc((_A), (_B), (_C))
-#endif
-
-typedef struct tasklet_struct  RTMP_NET_TASK_STRUCT;
-typedef struct tasklet_struct  *PRTMP_NET_TASK_STRUCT;
-
-
-/***********************************************************************************
- * Timer related definitions and data structures.
- **********************************************************************************/
-#define OS_HZ			HZ
-
-typedef struct timer_list	NDIS_MINIPORT_TIMER;
-typedef struct timer_list	RTMP_OS_TIMER;
-typedef void (*TIMER_FUNCTION)(unsigned long);
-
-
-#define OS_WAIT(_time) \
-{	int _i; \
-	long _loop = ((_time)/(1000/OS_HZ)) > 0 ? ((_time)/(1000/OS_HZ)) : 1;\
-	wait_queue_head_t _wait; \
-	init_waitqueue_head(&_wait); \
-	for (_i=0; _i<(_loop); _i++) \
-		wait_event_interruptible_timeout(_wait, 0, ONE_TICK); }
-
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,5,0)
-#define RTMP_TIME_AFTER(a,b)		\
-	(typecheck(unsigned long, (unsigned long)a) && \
-	 typecheck(unsigned long, (unsigned long)b) && \
-	 ((long)(b) - (long)(a) < 0))
-
-#define RTMP_TIME_AFTER_EQ(a,b)	\
-	(typecheck(unsigned long, (unsigned long)a) && \
-	 typecheck(unsigned long, (unsigned long)b) && \
-	 ((long)(a) - (long)(b) >= 0))
-#define RTMP_TIME_BEFORE(a,b)	RTMP_TIME_AFTER_EQ(b,a)
-#else
-#define typecheck(type,x) \
-({      type __dummy; \
-        typeof(x) __dummy2; \
-        (void)(&__dummy == &__dummy2); \
-        1; \
-})
-#define RTMP_TIME_AFTER_EQ(a,b)	\
-	(typecheck(unsigned long, (unsigned long)a) && \
-	 typecheck(unsigned long, (unsigned long)b) && \
-	 ((long)(a) - (long)(b) >= 0))
-#define RTMP_TIME_BEFORE(a,b)	RTMP_TIME_AFTER_EQ(b,a)
-#define RTMP_TIME_AFTER(a,b) time_after(a, b)
-#endif
-
-#define ONE_TICK 1
-
-static inline void NdisGetSystemUpTime(ULONG *time)
-{
-	*time = jiffies;
-}
-
-
-/***********************************************************************************
- *	OS specific cookie data structure binding to RTMP_ADAPTER
- ***********************************************************************************/
-
-struct os_cookie {
-#ifdef RTMP_MAC_PCI
-	struct pci_dev			*pci_dev;
-	struct pci_dev			*parent_pci_dev;
-	USHORT                  DeviceID;
-	dma_addr_t				pAd_pa;
-#endif // RTMP_MAC_PCI //
-
-
-	RTMP_NET_TASK_STRUCT rx_done_task;
-	RTMP_NET_TASK_STRUCT mgmt_dma_done_task;
-	RTMP_NET_TASK_STRUCT ac0_dma_done_task;
-	RTMP_NET_TASK_STRUCT ac1_dma_done_task;
-	RTMP_NET_TASK_STRUCT ac2_dma_done_task;
-	RTMP_NET_TASK_STRUCT ac3_dma_done_task;
-	/*RTMP_NET_TASK_STRUCT hcca_dma_done_task;*/
-	RTMP_NET_TASK_STRUCT tbtt_task;
-#ifdef RTMP_MAC_PCI
-	RTMP_NET_TASK_STRUCT fifo_statistic_full_task;
-#endif // RTMP_MAC_PCI //
-
-
-
-	unsigned long			apd_pid; //802.1x daemon pid
-	INT						ioctl_if_type;
-	INT					ioctl_if;
-};
-
-typedef struct os_cookie	* POS_COOKIE;
-
-
-
-/***********************************************************************************
- *	OS debugging and printing related definitions and data structure
- ***********************************************************************************/
-#define PRINT_MAC(addr)	\
-	addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]
-
-#ifdef DBG
-extern ULONG		RTDebugLevel;
-
-#define DBGPRINT_RAW(Level, Fmt)    \
-do{                                   \
-    if (Level <= RTDebugLevel)      \
-    {                               \
-        printk Fmt;               \
-    }                               \
-}while(0)
-
-#define DBGPRINT(Level, Fmt)    DBGPRINT_RAW(Level, Fmt)
-
-
-#define DBGPRINT_ERR(Fmt)           \
-{                                   \
-    printk("ERROR!!! ");          \
-    printk Fmt;                  \
-}
-
-#define DBGPRINT_S(Status, Fmt)		\
-{									\
-	printk Fmt;					\
-}
-#else
-#define DBGPRINT(Level, Fmt)
-#define DBGPRINT_RAW(Level, Fmt)
-#define DBGPRINT_S(Status, Fmt)
-#define DBGPRINT_ERR(Fmt)
-#endif
-
-#undef  ASSERT
-#define ASSERT(x)                                                               \
-{                                                                               \
-    if (!(x))                                                                   \
-    {                                                                           \
-        printk(KERN_WARNING __FILE__ ":%d assert " #x "failed\n", __LINE__);    \
-    }                                                                           \
-}
-
-void hex_dump(char *str, unsigned char *pSrcBufVA, unsigned int SrcBufLen);
-
-
-/*********************************************************************************************************
-	The following code are not revised, temporary put it here.
-  *********************************************************************************************************/
-
-
-/***********************************************************************************
- * Device DMA Access related definitions and data structures.
- **********************************************************************************/
-#ifdef RTMP_MAC_PCI
-dma_addr_t linux_pci_map_single(void *handle, void *ptr, size_t size, int sd_idx, int direction);
-void linux_pci_unmap_single(void *handle, dma_addr_t dma_addr, size_t size, int direction);
-
-#define PCI_MAP_SINGLE(_handle, _ptr, _size, _sd_idx, _dir) \
-	linux_pci_map_single(_handle, _ptr, _size, _sd_idx, _dir)
-
-#define PCI_UNMAP_SINGLE(_handle, _ptr, _size, _dir) \
-	linux_pci_unmap_single(_handle, _ptr, _size, _dir)
-
-#define PCI_ALLOC_CONSISTENT(_pci_dev, _size, _ptr) \
-	pci_alloc_consistent(_pci_dev, _size, _ptr)
-
-#define PCI_FREE_CONSISTENT(_pci_dev, _size, _virtual_addr, _physical_addr) \
-	pci_free_consistent(_pci_dev, _size, _virtual_addr, _physical_addr)
-
-#define DEV_ALLOC_SKB(_length) \
-	dev_alloc_skb(_length)
-#endif // RTMP_MAC_PCI //
-
-
-
-/*
- * ULONG
- * RTMP_GetPhysicalAddressLow(
- *   IN NDIS_PHYSICAL_ADDRESS  PhysicalAddress);
- */
-#define RTMP_GetPhysicalAddressLow(PhysicalAddress)		(PhysicalAddress)
-
-/*
- * ULONG
- * RTMP_GetPhysicalAddressHigh(
- *   IN NDIS_PHYSICAL_ADDRESS  PhysicalAddress);
- */
-#define RTMP_GetPhysicalAddressHigh(PhysicalAddress)		(0)
-
-/*
- * VOID
- * RTMP_SetPhysicalAddressLow(
- *   IN NDIS_PHYSICAL_ADDRESS  PhysicalAddress,
- *   IN ULONG  Value);
- */
-#define RTMP_SetPhysicalAddressLow(PhysicalAddress, Value)	\
-			PhysicalAddress = Value;
-
-/*
- * VOID
- * RTMP_SetPhysicalAddressHigh(
- *   IN NDIS_PHYSICAL_ADDRESS  PhysicalAddress,
- *   IN ULONG  Value);
- */
-#define RTMP_SetPhysicalAddressHigh(PhysicalAddress, Value)
-
-#define NdisMIndicateStatus(_w, _x, _y, _z)
-
-
-
-/***********************************************************************************
- * Device Register I/O Access related definitions and data structures.
- **********************************************************************************/
-#ifdef RTMP_MAC_PCI
-#if defined(INF_TWINPASS) || defined(INF_DANUBE) || defined(IKANOS_VX_1X0)
-//Patch for ASIC turst read/write bug, needs to remove after metel fix
-#define RTMP_IO_READ32(_A, _R, _pV)									\
-{																	\
-    if ((_A)->bPCIclkOff == FALSE)                                      \
-    {                                                                   \
-	(*_pV = readl((void *)((_A)->CSRBaseAddress + MAC_CSR0)));		\
-	(*_pV = readl((void *)((_A)->CSRBaseAddress + (_R))));			\
-	(*_pV = SWAP32(*((UINT32 *)(_pV))));                           \
-    }                                                                   \
-}
-
-#define RTMP_IO_READ8(_A, _R, _pV)									\
-{																	\
-	(*_pV = readl((void *)((_A)->CSRBaseAddress + MAC_CSR0)));		\
-	(*_pV = readb((void *)((_A)->CSRBaseAddress + (_R))));			\
-}
-
-#define RTMP_IO_WRITE32(_A, _R, _V)									\
-{																	\
-    if ((_A)->bPCIclkOff == FALSE)                                      \
-    {                                                                   \
-	UINT32	_Val;													\
-	_Val = readl((void *)((_A)->CSRBaseAddress + MAC_CSR0));		\
-	_Val = SWAP32(_V);												\
-	writel(_Val, (void *)((_A)->CSRBaseAddress + (_R)));			\
-    }                                                                   \
-}
-
-#define RTMP_IO_WRITE8(_A, _R, _V)									\
-{																	\
-	UINT	Val;													\
-	Val = readl((void *)((_A)->CSRBaseAddress + MAC_CSR0));		\
-	writeb((_V), (PUCHAR)((_A)->CSRBaseAddress + (_R)));			\
-}
-
-#define RTMP_IO_WRITE16(_A, _R, _V)									\
-{																	\
-	UINT	Val;													\
-	Val = readl((void *)((_A)->CSRBaseAddress + MAC_CSR0));		\
-	writew(SWAP16((_V)), (PUSHORT)((_A)->CSRBaseAddress + (_R)));	\
-}
-#else
-//Patch for ASIC turst read/write bug, needs to remove after metel fix
-#define RTMP_IO_READ32(_A, _R, _pV)								\
-{																\
-    if ((_A)->bPCIclkOff == FALSE)                                  \
-    {                                                               \
-		(*_pV = readl((void *)((_A)->CSRBaseAddress + MAC_CSR0)));		\
-		(*_pV = readl((void *)((_A)->CSRBaseAddress + (_R))));			\
-    }                                                               \
-    else															\
-		*_pV = 0;													\
-}
-
-#define RTMP_IO_FORCE_READ32(_A, _R, _pV)							\
-{																	\
-	(*_pV = readl((void *)((_A)->CSRBaseAddress + MAC_CSR0)));		\
-	(*_pV = readl((void *)((_A)->CSRBaseAddress + (_R))));			\
-}
-
-#define RTMP_IO_READ8(_A, _R, _pV)								\
-{																\
-	(*_pV = readl((void *)((_A)->CSRBaseAddress + MAC_CSR0)));			\
-	(*_pV = readb((void *)((_A)->CSRBaseAddress + (_R))));				\
-}
-
-#define RTMP_IO_WRITE32(_A, _R, _V)												\
-{																				\
-    if ((_A)->bPCIclkOff == FALSE)                                  \
-    {                                                               \
-	UINT	Val;																\
-	Val = readl((void *)((_A)->CSRBaseAddress + MAC_CSR0));			\
-	writel((_V), (void *)((_A)->CSRBaseAddress + (_R)));								\
-    }                                                               \
-}
-
-#define RTMP_IO_FORCE_WRITE32(_A, _R, _V)												\
-{																				\
-	UINT	Val;																\
-	Val = readl((void *)((_A)->CSRBaseAddress + MAC_CSR0));			\
-	writel(_V, (void *)((_A)->CSRBaseAddress + (_R)));								\
-}
-
-
-
-#if defined(BRCM_6358) || defined(RALINK_2880) || defined(RALINK_3052)
-#define RTMP_IO_WRITE8(_A, _R, _V)            \
-{                    \
-	ULONG Val;                \
-	UCHAR _i;                \
-	_i = ((_R) & 0x3);             \
-	Val = readl((void *)((_A)->CSRBaseAddress + ((_R) - _i)));   \
-	Val = Val & (~(0x000000ff << ((_i)*8)));         \
-	Val = Val | ((ULONG)(_V) << ((_i)*8));         \
-	writel((Val), (void *)((_A)->CSRBaseAddress + ((_R) - _i)));    \
-}
-#else
-#define RTMP_IO_WRITE8(_A, _R, _V)							\
-{															\
-	UINT	Val;												\
-	Val = readl((void *)((_A)->CSRBaseAddress + MAC_CSR0));	\
-	writeb((_V), (PUCHAR)((_A)->CSRBaseAddress + (_R)));		\
-}
-#endif // #if defined(BRCM_6358) || defined(RALINK_2880) //
-
-#define RTMP_IO_WRITE16(_A, _R, _V)							\
-{															\
-	UINT	Val;											\
-	Val = readl((void *)((_A)->CSRBaseAddress + MAC_CSR0));	\
-	writew((_V), (PUSHORT)((_A)->CSRBaseAddress + (_R)));	\
-}
-#endif // #if defined(INF_TWINPASS) || defined(INF_DANUBE) || defined(IKANOS_VX_1X0) //
-#endif // RTMP_MAC_PCI //
-
-
-
-/***********************************************************************************
- *	Network Related data structure and marco definitions
- ***********************************************************************************/
-#define PKTSRC_NDIS             0x7f
-#define PKTSRC_DRIVER           0x0f
-
-
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,29)
-#define RTMP_OS_NETDEV_SET_PRIV(_pNetDev, _pPriv)	((_pNetDev)->priv = (_pPriv))
-#define RTMP_OS_NETDEV_GET_PRIV(_pNetDev)		((_pNetDev)->priv)
-#else
-#define RTMP_OS_NETDEV_SET_PRIV(_pNetDev, _pPriv)	((_pNetDev)->ml_priv = (_pPriv))
-#define RTMP_OS_NETDEV_GET_PRIV(_pNetDev)		((_pNetDev)->ml_priv)
-#endif
-#define RTMP_OS_NETDEV_GET_DEVNAME(_pNetDev)	((_pNetDev)->name)
-#define RTMP_OS_NETDEV_GET_PHYADDR(_PNETDEV)	((_PNETDEV)->dev_addr)
-
-#define RTMP_OS_NETDEV_START_QUEUE(_pNetDev)	netif_start_queue((_pNetDev))
-#define RTMP_OS_NETDEV_STOP_QUEUE(_pNetDev)	netif_stop_queue((_pNetDev))
-#define RTMP_OS_NETDEV_WAKE_QUEUE(_pNetDev)	netif_wake_queue((_pNetDev))
-#define RTMP_OS_NETDEV_CARRIER_OFF(_pNetDev)	netif_carrier_off((_pNetDev))
-
-#define QUEUE_ENTRY_TO_PACKET(pEntry) \
-	(PNDIS_PACKET)(pEntry)
-
-#define PACKET_TO_QUEUE_ENTRY(pPacket) \
-	(PQUEUE_ENTRY)(pPacket)
-
-#ifdef CONFIG_5VT_ENHANCE
-#define BRIDGE_TAG 0x35564252    // depends on 5VT define in br_input.c
-#endif
-
-#define GET_SG_LIST_FROM_PACKET(_p, _sc)	\
-    rt_get_sg_list_from_packet(_p, _sc)
-
-#define RELEASE_NDIS_PACKET(_pAd, _pPacket, _Status)                    \
-{                                                                       \
-        RTMPFreeNdisPacket(_pAd, _pPacket);                             \
-}
-
-/*
- * packet helper
- *	- convert internal rt packet to os packet or
- *             os packet to rt packet
- */
-#define RTPKT_TO_OSPKT(_p)		((struct sk_buff *)(_p))
-#define OSPKT_TO_RTPKT(_p)		((PNDIS_PACKET)(_p))
-
-#define GET_OS_PKT_DATAPTR(_pkt) \
-		(RTPKT_TO_OSPKT(_pkt)->data)
-#define SET_OS_PKT_DATAPTR(_pkt, _dataPtr)	\
-		(RTPKT_TO_OSPKT(_pkt)->data) = (_dataPtr)
-
-#define GET_OS_PKT_LEN(_pkt) \
-		(RTPKT_TO_OSPKT(_pkt)->len)
-#define SET_OS_PKT_LEN(_pkt, _len)	\
-		(RTPKT_TO_OSPKT(_pkt)->len) = (_len)
-
-#define GET_OS_PKT_DATATAIL(_pkt) \
-		(RTPKT_TO_OSPKT(_pkt)->tail)
-#define SET_OS_PKT_DATATAIL(_pkt, _start, _len)	\
-		((RTPKT_TO_OSPKT(_pkt))->tail) = (PUCHAR)((_start) + (_len))
-
-#define GET_OS_PKT_HEAD(_pkt) \
-		(RTPKT_TO_OSPKT(_pkt)->head)
-
-#define GET_OS_PKT_END(_pkt) \
-		(RTPKT_TO_OSPKT(_pkt)->end)
-
-#define GET_OS_PKT_NETDEV(_pkt) \
-		(RTPKT_TO_OSPKT(_pkt)->dev)
-#define SET_OS_PKT_NETDEV(_pkt, _pNetDev)	\
-		(RTPKT_TO_OSPKT(_pkt)->dev) = (_pNetDev)
-
-#define GET_OS_PKT_TYPE(_pkt) \
-		(RTPKT_TO_OSPKT(_pkt))
-
-#define GET_OS_PKT_NEXT(_pkt) \
-		(RTPKT_TO_OSPKT(_pkt)->next)
-
-
-#define OS_PKT_CLONED(_pkt)		skb_cloned(RTPKT_TO_OSPKT(_pkt))
-
-#define OS_NTOHS(_Val) \
-		(ntohs(_Val))
-#define OS_HTONS(_Val) \
-		(htons(_Val))
-#define OS_NTOHL(_Val) \
-		(ntohl(_Val))
-#define OS_HTONL(_Val) \
-		(htonl(_Val))
-
-#define CB_OFF  10
-
-// User Priority
-#define RTMP_SET_PACKET_UP(_p, _prio)			(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+0] = _prio)
-#define RTMP_GET_PACKET_UP(_p)					(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+0])
-
-// Fragment #
-#define RTMP_SET_PACKET_FRAGMENTS(_p, _num)		(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+1] = _num)
-#define RTMP_GET_PACKET_FRAGMENTS(_p)			(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+1])
-
-// 0x0 ~0x7f: TX to AP's own BSS which has the specified AID. if AID>127, set bit 7 in RTMP_SET_PACKET_EMACTAB too.
-//(this value also as MAC(on-chip WCID) table index)
-// 0x80~0xff: TX to a WDS link. b0~6: WDS index
-#define RTMP_SET_PACKET_WCID(_p, _wdsidx)		(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+2] = _wdsidx)
-#define RTMP_GET_PACKET_WCID(_p)			((UCHAR)(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+2]))
-
-// 0xff: PKTSRC_NDIS, others: local TX buffer index. This value affects how to a packet
-#define RTMP_SET_PACKET_SOURCE(_p, _pktsrc)		(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+3] = _pktsrc)
-#define RTMP_GET_PACKET_SOURCE(_p)			(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+3])
-
-// RTS/CTS-to-self protection method
-#define RTMP_SET_PACKET_RTS(_p, _num)			(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+4] = _num)
-#define RTMP_GET_PACKET_RTS(_p)				(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+4])
-// see RTMP_S(G)ET_PACKET_EMACTAB
-
-// TX rate index
-#define RTMP_SET_PACKET_TXRATE(_p, _rate)		(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+5] = _rate)
-#define RTMP_GET_PACKET_TXRATE(_p)				(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+5])
-
-// From which Interface
-#define RTMP_SET_PACKET_IF(_p, _ifdx)		(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+6] = _ifdx)
-#define RTMP_GET_PACKET_IF(_p)				(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+6])
-#define RTMP_SET_PACKET_NET_DEVICE_MBSSID(_p, _bss)		RTMP_SET_PACKET_IF((_p), (_bss))
-#define RTMP_SET_PACKET_NET_DEVICE_WDS(_p, _bss)		RTMP_SET_PACKET_IF((_p), ((_bss) + MIN_NET_DEVICE_FOR_WDS))
-#define RTMP_SET_PACKET_NET_DEVICE_APCLI(_p, _idx)	RTMP_SET_PACKET_IF((_p), ((_idx) + MIN_NET_DEVICE_FOR_APCLI))
-#define RTMP_SET_PACKET_NET_DEVICE_MESH(_p, _idx)	RTMP_SET_PACKET_IF((_p), ((_idx) + MIN_NET_DEVICE_FOR_MESH))
-#define RTMP_GET_PACKET_NET_DEVICE_MBSSID(_p)			RTMP_GET_PACKET_IF((_p))
-#define RTMP_GET_PACKET_NET_DEVICE(_p)					RTMP_GET_PACKET_IF((_p))
-
-#define RTMP_SET_PACKET_MOREDATA(_p, _morebit)		(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+7] = _morebit)
-#define RTMP_GET_PACKET_MOREDATA(_p)				(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+7])
-
-
-
-
-
-//
-//	Sepcific Pakcet Type definition
-//
-#define RTMP_PACKET_SPECIFIC_CB_OFFSET	11
-
-#define RTMP_PACKET_SPECIFIC_DHCP		0x01
-#define RTMP_PACKET_SPECIFIC_EAPOL		0x02
-#define RTMP_PACKET_SPECIFIC_IPV4		0x04
-#define RTMP_PACKET_SPECIFIC_WAI		0x08
-#define RTMP_PACKET_SPECIFIC_VLAN		0x10
-#define RTMP_PACKET_SPECIFIC_LLCSNAP	0x20
-
-//Specific
-#define RTMP_SET_PACKET_SPECIFIC(_p, _flg)		(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+11] = _flg)
-
-//DHCP
-#define RTMP_SET_PACKET_DHCP(_p, _flg)														\
-			do{																				\
-				if (_flg)																	\
-					(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+11]) |= (RTMP_PACKET_SPECIFIC_DHCP);		\
-				else																		\
-					(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+11]) &= (!RTMP_PACKET_SPECIFIC_DHCP);	\
-			}while(0)
-#define RTMP_GET_PACKET_DHCP(_p)		(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+11] & RTMP_PACKET_SPECIFIC_DHCP)
-
-//EAPOL
-#define RTMP_SET_PACKET_EAPOL(_p, _flg)														\
-			do{																				\
-				if (_flg)																	\
-					(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+11]) |= (RTMP_PACKET_SPECIFIC_EAPOL);		\
-				else																		\
-					(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+11]) &= (!RTMP_PACKET_SPECIFIC_EAPOL);	\
-			}while(0)
-#define RTMP_GET_PACKET_EAPOL(_p)		(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+11] & RTMP_PACKET_SPECIFIC_EAPOL)
-
-//WAI
-#define RTMP_SET_PACKET_WAI(_p, _flg)														\
-			do{																				\
-				if (_flg)																	\
-					(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+11]) |= (RTMP_PACKET_SPECIFIC_WAI);		\
-				else																		\
-					(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+11]) &= (!RTMP_PACKET_SPECIFIC_WAI);	\
-			}while(0)
-#define RTMP_GET_PACKET_WAI(_p)		(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+11] & RTMP_PACKET_SPECIFIC_WAI)
-
-#define RTMP_GET_PACKET_LOWRATE(_p)		(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+11] & (RTMP_PACKET_SPECIFIC_EAPOL | RTMP_PACKET_SPECIFIC_DHCP | RTMP_PACKET_SPECIFIC_WAI))
-
-//VLAN
-#define RTMP_SET_PACKET_VLAN(_p, _flg)														\
-			do{																				\
-				if (_flg)																	\
-					(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+11]) |= (RTMP_PACKET_SPECIFIC_VLAN);		\
-				else																		\
-					(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+11]) &= (!RTMP_PACKET_SPECIFIC_VLAN);	\
-			}while(0)
-#define RTMP_GET_PACKET_VLAN(_p)		(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+11] & RTMP_PACKET_SPECIFIC_VLAN)
-
-//LLC/SNAP
-#define RTMP_SET_PACKET_LLCSNAP(_p, _flg)													\
-			do{																				\
-				if (_flg)																	\
-					(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+11]) |= (RTMP_PACKET_SPECIFIC_LLCSNAP);		\
-				else																		\
-					(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+11]) &= (!RTMP_PACKET_SPECIFIC_LLCSNAP);		\
-			}while(0)
-
-#define RTMP_GET_PACKET_LLCSNAP(_p)		(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+11] & RTMP_PACKET_SPECIFIC_LLCSNAP)
-
-// IP
-#define RTMP_SET_PACKET_IPV4(_p, _flg)														\
-			do{																				\
-				if (_flg)																	\
-					(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+11]) |= (RTMP_PACKET_SPECIFIC_IPV4);		\
-				else																		\
-					(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+11]) &= (!RTMP_PACKET_SPECIFIC_IPV4);	\
-			}while(0)
-
-#define RTMP_GET_PACKET_IPV4(_p)		(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+11] & RTMP_PACKET_SPECIFIC_IPV4)
-
-
-// If this flag is set, it indicates that this EAPoL frame MUST be clear.
-#define RTMP_SET_PACKET_CLEAR_EAP_FRAME(_p, _flg)   (RTPKT_TO_OSPKT(_p)->cb[CB_OFF+12] = _flg)
-#define RTMP_GET_PACKET_CLEAR_EAP_FRAME(_p)         (RTPKT_TO_OSPKT(_p)->cb[CB_OFF+12])
-
-
-
-/* use bit3 of cb[CB_OFF+16] */
-
-#define RTMP_SET_PACKET_5VT(_p, _flg)   (RTPKT_TO_OSPKT(_p)->cb[CB_OFF+22] = _flg)
-#define RTMP_GET_PACKET_5VT(_p)         (RTPKT_TO_OSPKT(_p)->cb[CB_OFF+22])
-
-#ifdef INF_AMAZON_SE
-/* [CB_OFF+28], 1B, Iverson patch for WMM A5-T07 ,WirelessStaToWirelessSta do not bulk out aggregate */
-#define RTMP_SET_PACKET_NOBULKOUT(_p, _morebit)			(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+28] = _morebit)
-#define RTMP_GET_PACKET_NOBULKOUT(_p)					(RTPKT_TO_OSPKT(_p)->cb[CB_OFF+28])
-#endif // INF_AMAZON_SE //
-/* Max skb->cb = 48B = [CB_OFF+38] */
-
-
-
-/***********************************************************************************
- *	Other function prototypes definitions
- ***********************************************************************************/
-void RTMP_GetCurrentSystemTime(LARGE_INTEGER *time);
-int rt28xx_packet_xmit(struct sk_buff *skb);
-
-
-void FlashWrite(UCHAR * p, ULONG a, ULONG b);
-void FlashRead(UCHAR * p, ULONG a, ULONG b);
-
-#if LINUX_VERSION_CODE <= 0x20402	// Red Hat 7.1
-struct net_device *alloc_netdev(int sizeof_priv, const char *mask, void (*setup)(struct net_device *));
-#endif // LINUX_VERSION_CODE //
-
-
-#ifdef RTMP_MAC_PCI
-/* function declarations */
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,5,0)
-#define IRQ_HANDLE_TYPE  irqreturn_t
-#else
-#define IRQ_HANDLE_TYPE  void
-#endif
-
-IRQ_HANDLE_TYPE
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,19))
-rt2860_interrupt(int irq, void *dev_instance);
-#else
-rt2860_interrupt(int irq, void *dev_instance, struct pt_regs *regs);
-#endif
-
-#endif // RTMP_MAC_PCI //
-
-INT rt28xx_ioctl(
-	IN	PNET_DEV		net_dev,
-	IN	OUT	struct ifreq	*rq,
-	IN	INT			cmd);
-
-
-#ifdef CONFIG_STA_SUPPORT
-INT rt28xx_sta_ioctl(
-	IN	PNET_DEV		net_dev,
-	IN	OUT	struct ifreq	*rq,
-	IN	INT			cmd);
-#endif // CONFIG_STA_SUPPORT //
-
-extern int ra_mtd_write(int num, loff_t to, size_t len, const u_char *buf);
-extern int ra_mtd_read(int num, loff_t from, size_t len, u_char *buf);
-
-#endif // __RT_LINUX_H__ //
diff --git a/drivers/staging/rt3090/rt_main_dev.c b/drivers/staging/rt3090/rt_main_dev.c
deleted file mode 100644
index 3307a5f36847..000000000000
--- a/drivers/staging/rt3090/rt_main_dev.c
+++ /dev/null
@@ -1,897 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-    Module Name:
-    rt_main_dev.c
-
-    Abstract:
-    Create and register network interface.
-
-    Revision History:
-    Who         When            What
-    --------    ----------      ----------------------------------------------
-*/
-
-#include "rt_config.h"
-
-
-#ifdef CONFIG_APSTA_MIXED_SUPPORT
-UINT32 CW_MAX_IN_BITS;
-#endif // CONFIG_APSTA_MIXED_SUPPORT //
-
-/*---------------------------------------------------------------------*/
-/* Private Variables Used                                              */
-/*---------------------------------------------------------------------*/
-
-PSTRING mac = "";		   // default 00:00:00:00:00:00
-PSTRING hostname = "";		   // default CMPC
-#if LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,12)
-MODULE_PARM (mac, "s");
-#else
-module_param (mac, charp, 0);
-#endif
-MODULE_PARM_DESC (mac, "rt28xx: wireless mac addr");
-
-
-/*---------------------------------------------------------------------*/
-/* Prototypes of Functions Used                                        */
-/*---------------------------------------------------------------------*/
-
-// public function prototype
-int rt28xx_close(IN struct net_device *net_dev);
-int rt28xx_open(struct net_device *net_dev);
-
-// private function prototype
-static INT rt28xx_send_packets(IN struct sk_buff *skb_p, IN struct net_device *net_dev);
-
-
-static struct net_device_stats *RT28xx_get_ether_stats(
-    IN  struct net_device *net_dev);
-
-/*
-========================================================================
-Routine Description:
-    Close raxx interface.
-
-Arguments:
-	*net_dev			the raxx interface pointer
-
-Return Value:
-    0					Open OK
-	otherwise			Open Fail
-
-Note:
-	1. if open fail, kernel will not call the close function.
-	2. Free memory for
-		(1) Mlme Memory Handler:		MlmeHalt()
-		(2) TX & RX:					RTMPFreeTxRxRingMemory()
-		(3) BA Reordering:				ba_reordering_resource_release()
-========================================================================
-*/
-int MainVirtualIF_close(IN struct net_device *net_dev)
-{
-    RTMP_ADAPTER *pAd = RTMP_OS_NETDEV_GET_PRIV(net_dev);
-
-	// Sanity check for pAd
-	if (pAd == NULL)
-		return 0; // close ok
-
-	netif_carrier_off(pAd->net_dev);
-	netif_stop_queue(pAd->net_dev);
-
-
-
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-		BOOLEAN			Cancelled;
-#ifdef QOS_DLS_SUPPORT
-		// send DLS-TEAR_DOWN message,
-		if (pAd->CommonCfg.bDLSCapable)
-		{
-			UCHAR i;
-
-			// tear down local dls table entry
-			for (i=0; i<MAX_NUM_OF_INIT_DLS_ENTRY; i++)
-			{
-				if (pAd->StaCfg.DLSEntry[i].Valid && (pAd->StaCfg.DLSEntry[i].Status == DLS_FINISH))
-				{
-					RTMPSendDLSTearDownFrame(pAd, pAd->StaCfg.DLSEntry[i].MacAddr);
-					pAd->StaCfg.DLSEntry[i].Status	= DLS_NONE;
-					pAd->StaCfg.DLSEntry[i].Valid	= FALSE;
-				}
-			}
-
-			// tear down peer dls table entry
-			for (i=MAX_NUM_OF_INIT_DLS_ENTRY; i<MAX_NUM_OF_DLS_ENTRY; i++)
-			{
-				if (pAd->StaCfg.DLSEntry[i].Valid && (pAd->StaCfg.DLSEntry[i].Status == DLS_FINISH))
-				{
-					RTMPSendDLSTearDownFrame(pAd, pAd->StaCfg.DLSEntry[i].MacAddr);
-					pAd->StaCfg.DLSEntry[i].Status = DLS_NONE;
-					pAd->StaCfg.DLSEntry[i].Valid	= FALSE;
-				}
-			}
-			RTMP_MLME_HANDLER(pAd);
-		}
-#endif // QOS_DLS_SUPPORT //
-
-		if (INFRA_ON(pAd) &&
-			(!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_NIC_NOT_EXIST)))
-		{
-			MLME_DISASSOC_REQ_STRUCT	DisReq;
-			MLME_QUEUE_ELEM *MsgElem = (MLME_QUEUE_ELEM *) kmalloc(sizeof(MLME_QUEUE_ELEM), MEM_ALLOC_FLAG);
-
-			if (MsgElem)
-			{
-			COPY_MAC_ADDR(DisReq.Addr, pAd->CommonCfg.Bssid);
-			DisReq.Reason =  REASON_DEAUTH_STA_LEAVING;
-
-			MsgElem->Machine = ASSOC_STATE_MACHINE;
-			MsgElem->MsgType = MT2_MLME_DISASSOC_REQ;
-			MsgElem->MsgLen = sizeof(MLME_DISASSOC_REQ_STRUCT);
-			NdisMoveMemory(MsgElem->Msg, &DisReq, sizeof(MLME_DISASSOC_REQ_STRUCT));
-
-			// Prevent to connect AP again in STAMlmePeriodicExec
-			pAd->MlmeAux.AutoReconnectSsidLen= 32;
-			NdisZeroMemory(pAd->MlmeAux.AutoReconnectSsid, pAd->MlmeAux.AutoReconnectSsidLen);
-
-			pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_OID_DISASSOC;
-			MlmeDisassocReqAction(pAd, MsgElem);
-			kfree(MsgElem);
-			}
-
-			RTMPusecDelay(1000);
-		}
-
-		RTMPCancelTimer(&pAd->StaCfg.StaQuickResponeForRateUpTimer, &Cancelled);
-		RTMPCancelTimer(&pAd->StaCfg.WpaDisassocAndBlockAssocTimer, &Cancelled);
-
-#ifdef WPA_SUPPLICANT_SUPPORT
-#ifndef NATIVE_WPA_SUPPLICANT_SUPPORT
-		// send wireless event to wpa_supplicant for infroming interface down.
-		RtmpOSWrielessEventSend(pAd, IWEVCUSTOM, RT_INTERFACE_DOWN, NULL, NULL, 0);
-#endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
-#endif // WPA_SUPPLICANT_SUPPORT //
-
-
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-	VIRTUAL_IF_DOWN(pAd);
-
-	RT_MOD_DEC_USE_COUNT();
-
-	return 0; // close ok
-}
-
-/*
-========================================================================
-Routine Description:
-    Open raxx interface.
-
-Arguments:
-	*net_dev			the raxx interface pointer
-
-Return Value:
-    0					Open OK
-	otherwise			Open Fail
-
-Note:
-	1. if open fail, kernel will not call the close function.
-	2. Free memory for
-		(1) Mlme Memory Handler:		MlmeHalt()
-		(2) TX & RX:					RTMPFreeTxRxRingMemory()
-		(3) BA Reordering:				ba_reordering_resource_release()
-========================================================================
-*/
-int MainVirtualIF_open(IN struct net_device *net_dev)
-{
-    RTMP_ADAPTER *pAd = RTMP_OS_NETDEV_GET_PRIV(net_dev);
-
-	// Sanity check for pAd
-	if (pAd == NULL)
-		return 0; // close ok
-
-	if (VIRTUAL_IF_UP(pAd) != 0)
-		return -1;
-
-	// increase MODULE use count
-	RT_MOD_INC_USE_COUNT();
-
-	netif_start_queue(net_dev);
-	netif_carrier_on(net_dev);
-	netif_wake_queue(net_dev);
-
-	return 0;
-}
-
-/*
-========================================================================
-Routine Description:
-    Close raxx interface.
-
-Arguments:
-	*net_dev			the raxx interface pointer
-
-Return Value:
-    0					Open OK
-	otherwise			Open Fail
-
-Note:
-	1. if open fail, kernel will not call the close function.
-	2. Free memory for
-		(1) Mlme Memory Handler:		MlmeHalt()
-		(2) TX & RX:					RTMPFreeTxRxRingMemory()
-		(3) BA Reordering:				ba_reordering_resource_release()
-========================================================================
-*/
-int rt28xx_close(IN PNET_DEV dev)
-{
-	struct net_device * net_dev = (struct net_device *)dev;
-    RTMP_ADAPTER	*pAd = RTMP_OS_NETDEV_GET_PRIV(net_dev);
-	BOOLEAN			Cancelled;
-	UINT32			i = 0;
-
-
-	DBGPRINT(RT_DEBUG_TRACE, ("===> rt28xx_close\n"));
-
-	Cancelled = FALSE;
-	// Sanity check for pAd
-	if (pAd == NULL)
-		return 0; // close ok
-
-
-
-#ifdef WDS_SUPPORT
-	WdsDown(pAd);
-#endif // WDS_SUPPORT //
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-#ifdef RTMP_MAC_PCI
-		RTMPPCIeLinkCtrlValueRestore(pAd, RESTORE_CLOSE);
-#endif // RTMP_MAC_PCI //
-
-		// If dirver doesn't wake up firmware here,
-		// NICLoadFirmware will hang forever when interface is up again.
-		if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE))
-        {
-		    AsicForceWakeup(pAd, TRUE);
-        }
-
-
-		MlmeRadioOff(pAd);
-#ifdef RTMP_MAC_PCI
-		pAd->bPCIclkOff = FALSE;
-#endif // RTMP_MAC_PCI //
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-	RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS);
-
-	for (i = 0 ; i < NUM_OF_TX_RING; i++)
-	{
-		while (pAd->DeQueueRunning[i] == TRUE)
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("Waiting for TxQueue[%d] done..........\n", i));
-			RTMPusecDelay(1000);
-		}
-	}
-
-
-
-	// Stop Mlme state machine
-	MlmeHalt(pAd);
-
-	// Close net tasklets
-	RtmpNetTaskExit(pAd);
-
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-		MacTableReset(pAd);
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-
-	MeasureReqTabExit(pAd);
-	TpcReqTabExit(pAd);
-
-
-	// Close kernel threads
-	RtmpMgmtTaskExit(pAd);
-
-#ifdef RTMP_MAC_PCI
-	{
-			BOOLEAN brc;
-			//	ULONG			Value;
-
-			if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_INTERRUPT_ACTIVE))
-			{
-				RTMP_ASIC_INTERRUPT_DISABLE(pAd);
-			}
-
-			// Receive packets to clear DMA index after disable interrupt.
-			//RTMPHandleRxDoneInterrupt(pAd);
-			// put to radio off to save power when driver unload.  After radiooff, can't write /read register.  So need to finish all
-			// register access before Radio off.
-
-
-			brc=RT28xxPciAsicRadioOff(pAd, RTMP_HALT, 0);
-
-//In  solution 3 of 3090F, the bPCIclkOff will be set to TRUE after calling RT28xxPciAsicRadioOff
-			pAd->bPCIclkOff = FALSE;
-
-			if (brc==FALSE)
-			{
-				DBGPRINT(RT_DEBUG_ERROR,("%s call RT28xxPciAsicRadioOff fail !!\n", __FUNCTION__));
-			}
-	}
-
-
-/*
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_INTERRUPT_ACTIVE))
-	{
-		RTMP_ASIC_INTERRUPT_DISABLE(pAd);
-	}
-
-	// Disable Rx, register value supposed will remain after reset
-	NICIssueReset(pAd);
-*/
-#endif // RTMP_MAC_PCI //
-
-	// Free IRQ
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_INTERRUPT_IN_USE))
-	{
-#ifdef RTMP_MAC_PCI
-		// Deregister interrupt function
-		RTMP_IRQ_RELEASE(net_dev)
-#endif // RTMP_MAC_PCI //
-		RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_INTERRUPT_IN_USE);
-	}
-
-	// Free Ring or USB buffers
-	RTMPFreeTxRxRingMemory(pAd);
-
-	RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS);
-
-#ifdef DOT11_N_SUPPORT
-	// Free BA reorder resource
-	ba_reordering_resource_release(pAd);
-#endif // DOT11_N_SUPPORT //
-
-#ifdef CONFIG_STA_SUPPORT
-#endif // CONFIG_STA_SUPPORT //
-
-	RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_START_UP);
-
-/*+++Modify by woody to solve the bulk fail+++*/
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-	DBGPRINT(RT_DEBUG_TRACE, ("<=== rt28xx_close\n"));
-	return 0; // close ok
-} /* End of rt28xx_close */
-
-
-/*
-========================================================================
-Routine Description:
-    Open raxx interface.
-
-Arguments:
-	*net_dev			the raxx interface pointer
-
-Return Value:
-    0					Open OK
-	otherwise			Open Fail
-
-Note:
-========================================================================
-*/
-int rt28xx_open(IN PNET_DEV dev)
-{
-	struct net_device * net_dev = (struct net_device *)dev;
-	PRTMP_ADAPTER pAd = RTMP_OS_NETDEV_GET_PRIV(net_dev);
-	int retval = 0;
-	//POS_COOKIE pObj;
-
-
-	// Sanity check for pAd
-	if (pAd == NULL)
-	{
-		/* if 1st open fail, pAd will be free;
-		   So the net_dev->priv will be NULL in 2rd open */
-		return -1;
-	}
-
-#ifdef CONFIG_APSTA_MIXED_SUPPORT
-	if (pAd->OpMode == OPMODE_AP)
-	{
-		CW_MAX_IN_BITS = 6;
-	}
-	else if (pAd->OpMode == OPMODE_STA)
-	{
-		CW_MAX_IN_BITS = 10;
-	}
-#endif // CONFIG_APSTA_MIXED_SUPPORT //
-
-#if WIRELESS_EXT >= 12
-	if (net_dev->priv_flags == INT_MAIN)
-	{
-#ifdef CONFIG_APSTA_MIXED_SUPPORT
-		if (pAd->OpMode == OPMODE_AP)
-			net_dev->wireless_handlers = (struct iw_handler_def *) &rt28xx_ap_iw_handler_def;
-#endif // CONFIG_APSTA_MIXED_SUPPORT //
-#ifdef CONFIG_STA_SUPPORT
-		if (pAd->OpMode == OPMODE_STA)
-			net_dev->wireless_handlers = (struct iw_handler_def *) &rt28xx_iw_handler_def;
-#endif // CONFIG_STA_SUPPORT //
-	}
-#endif // WIRELESS_EXT >= 12 //
-
-	// Request interrupt service routine for PCI device
-	// register the interrupt routine with the os
-	RTMP_IRQ_REQUEST(net_dev);
-
-	// Init IRQ parameters stored in pAd
-	RTMP_IRQ_INIT(pAd);
-
-	// Chip & other init
-	if (rt28xx_init(pAd, mac, hostname) == FALSE)
-		goto err;
-
-#ifdef CONFIG_STA_SUPPORT
-#endif // CONFIG_STA_SUPPORT //
-
-	// Enable Interrupt
-	RTMP_IRQ_ENABLE(pAd);
-
-	// Now Enable RxTx
-	RTMPEnableRxTx(pAd);
-	RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_START_UP);
-
-	{
-	UINT32 reg = 0;
-	RTMP_IO_READ32(pAd, 0x1300, &reg);  // clear garbage interrupts
-	printk("0x1300 = %08x\n", reg);
-	}
-
-	{
-//	u32 reg;
-//	UINT8  byte;
-//	u16 tmp;
-
-//	RTMP_IO_READ32(pAd, XIFS_TIME_CFG, &reg);
-
-//	tmp = 0x0805;
-//	reg  = (reg & 0xffff0000) | tmp;
-//	RTMP_IO_WRITE32(pAd, XIFS_TIME_CFG, reg);
-
-	}
-
-
-#ifdef CONFIG_STA_SUPPORT
-#ifdef RTMP_MAC_PCI
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-        RTMPInitPCIeLinkCtrlValue(pAd);
-#endif // RTMP_MAC_PCI //
-#endif // CONFIG_STA_SUPPORT //
-
-	return (retval);
-
-err:
-//+++Add by shiang, move from rt28xx_init() to here.
-	RTMP_IRQ_RELEASE(net_dev);
-//---Add by shiang, move from rt28xx_init() to here.
-	return (-1);
-} /* End of rt28xx_open */
-
-static const struct net_device_ops rt3090_netdev_ops = {
-	.ndo_open		= MainVirtualIF_open,
-	.ndo_stop		= MainVirtualIF_close,
-	.ndo_do_ioctl		= rt28xx_ioctl,
-	.ndo_get_stats		= RT28xx_get_ether_stats,
-	.ndo_set_mac_address	= eth_mac_addr,
-	.ndo_change_mtu		= eth_change_mtu,
-#ifdef IKANOS_VX_1X0
-	.ndo_start_xmit		= IKANOS_DataFramesTx,
-#else
-	.ndo_start_xmit		= rt28xx_send_packets,
-#endif
-};
-
-PNET_DEV RtmpPhyNetDevInit(
-	IN RTMP_ADAPTER *pAd,
-	IN RTMP_OS_NETDEV_OP_HOOK *pNetDevHook)
-{
-	struct net_device	*net_dev = NULL;
-//	NDIS_STATUS		Status;
-
-	net_dev = RtmpOSNetDevCreate(pAd, INT_MAIN, 0, sizeof(PRTMP_ADAPTER), INF_MAIN_DEV_NAME);
-	if (net_dev == NULL)
-	{
-		printk("RtmpPhyNetDevInit(): creation failed for main physical net device!\n");
-		return NULL;
-	}
-
-	NdisZeroMemory((unsigned char *)pNetDevHook, sizeof(RTMP_OS_NETDEV_OP_HOOK));
-	pNetDevHook->netdev_ops = &rt3090_netdev_ops;
-	pNetDevHook->priv_flags = INT_MAIN;
-	pNetDevHook->needProtcted = FALSE;
-
-	RTMP_OS_NETDEV_SET_PRIV(net_dev, pAd);
-	//net_dev->priv = (PVOID)pAd;
-	pAd->net_dev = net_dev;
-
-
-
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,24)
-	SET_MODULE_OWNER(net_dev);
-#endif
-
-	netif_stop_queue(net_dev);
-
-	return net_dev;
-
-}
-
-
-/*
-========================================================================
-Routine Description:
-    The entry point for Linux kernel sent packet to our driver.
-
-Arguments:
-    sk_buff *skb		the pointer refer to a sk_buffer.
-
-Return Value:
-    0
-
-Note:
-	This function is the entry point of Tx Path for Os delivery packet to
-	our driver. You only can put OS-depened & STA/AP common handle procedures
-	in here.
-========================================================================
-*/
-int rt28xx_packet_xmit(struct sk_buff *skb)
-{
-	struct net_device *net_dev = skb->dev;
-	PRTMP_ADAPTER pAd = RTMP_OS_NETDEV_GET_PRIV(net_dev);
-	int status = 0;
-	PNDIS_PACKET pPacket = (PNDIS_PACKET) skb;
-
-	/* RT2870STA does this in RTMPSendPackets() */
-#ifdef RALINK_ATE
-	if (ATE_ON(pAd))
-	{
-		RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_RESOURCES);
-		return 0;
-	}
-#endif // RALINK_ATE //
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-		// Drop send request since we are in monitor mode
-		if (MONITOR_ON(pAd))
-		{
-			RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_FAILURE);
-			goto done;
-		}
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-        // EapolStart size is 18
-	if (skb->len < 14)
-	{
-		//printk("bad packet size: %d\n", pkt->len);
-		hex_dump("bad packet", skb->data, skb->len);
-		RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_FAILURE);
-		goto done;
-	}
-
-
-
-	RTMP_SET_PACKET_5VT(pPacket, 0);
-//	MiniportMMRequest(pAd, pkt->data, pkt->len);
-#ifdef CONFIG_5VT_ENHANCE
-    if (*(int*)(skb->cb) == BRIDGE_TAG) {
-		RTMP_SET_PACKET_5VT(pPacket, 1);
-    }
-#endif
-
-
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-
-		STASendPackets((NDIS_HANDLE)pAd, (PPNDIS_PACKET) &pPacket, 1);
-	}
-
-#endif // CONFIG_STA_SUPPORT //
-
-	status = 0;
-done:
-
-	return status;
-}
-
-
-/*
-========================================================================
-Routine Description:
-    Send a packet to WLAN.
-
-Arguments:
-    skb_p           points to our adapter
-    dev_p           which WLAN network interface
-
-Return Value:
-    0: transmit successfully
-    otherwise: transmit fail
-
-Note:
-========================================================================
-*/
-static int rt28xx_send_packets(
-	IN struct sk_buff		*skb_p,
-	IN struct net_device	*net_dev)
-{
-	RTMP_ADAPTER *pAd = RTMP_OS_NETDEV_GET_PRIV(net_dev);
-
-	if (!(net_dev->flags & IFF_UP))
-	{
-		RELEASE_NDIS_PACKET(pAd, (PNDIS_PACKET)skb_p, NDIS_STATUS_FAILURE);
-		return 0;
-	}
-
-	NdisZeroMemory((PUCHAR)&skb_p->cb[CB_OFF], 15);
-	RTMP_SET_PACKET_NET_DEVICE_MBSSID(skb_p, MAIN_MBSSID);
-
-	return rt28xx_packet_xmit(skb_p);
-}
-
-
-#if WIRELESS_EXT >= 12
-// This function will be called when query /proc
-struct iw_statistics *rt28xx_get_wireless_stats(
-    IN struct net_device *net_dev)
-{
-	PRTMP_ADAPTER pAd = RTMP_OS_NETDEV_GET_PRIV(net_dev);
-
-
-
-	DBGPRINT(RT_DEBUG_TRACE, ("rt28xx_get_wireless_stats --->\n"));
-
-	pAd->iw_stats.status = 0; // Status - device dependent for now
-
-	// link quality
-#ifdef CONFIG_STA_SUPPORT
-	if (pAd->OpMode == OPMODE_STA)
-	pAd->iw_stats.qual.qual = ((pAd->Mlme.ChannelQuality * 12)/10 + 10);
-#endif // CONFIG_STA_SUPPORT //
-
-	if(pAd->iw_stats.qual.qual > 100)
-		pAd->iw_stats.qual.qual = 100;
-
-#ifdef CONFIG_STA_SUPPORT
-	if (pAd->OpMode == OPMODE_STA)
-	{
-		pAd->iw_stats.qual.level =
-			RTMPMaxRssi(pAd, pAd->StaCfg.RssiSample.LastRssi0,
-							pAd->StaCfg.RssiSample.LastRssi1,
-							pAd->StaCfg.RssiSample.LastRssi2);
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-	pAd->iw_stats.qual.noise = pAd->BbpWriteLatch[66]; // noise level (dBm)
-
-	pAd->iw_stats.qual.noise += 256 - 143;
-	pAd->iw_stats.qual.updated = 1;     // Flags to know if updated
-#ifdef IW_QUAL_DBM
-	pAd->iw_stats.qual.updated |= IW_QUAL_DBM;	// Level + Noise are dBm
-#endif // IW_QUAL_DBM //
-
-	pAd->iw_stats.discard.nwid = 0;     // Rx : Wrong nwid/essid
-	pAd->iw_stats.miss.beacon = 0;      // Missed beacons/superframe
-
-	DBGPRINT(RT_DEBUG_TRACE, ("<--- rt28xx_get_wireless_stats\n"));
-	return &pAd->iw_stats;
-}
-#endif // WIRELESS_EXT //
-
-
-void tbtt_tasklet(unsigned long data)
-{
-//#define MAX_TX_IN_TBTT		(16)
-
-}
-
-INT rt28xx_ioctl(
-	IN	PNET_DEV	net_dev,
-	IN	OUT	struct ifreq	*rq,
-	IN	INT					cmd)
-{
-	RTMP_ADAPTER	*pAd = NULL;
-	INT				ret = 0;
-
-	pAd = RTMP_OS_NETDEV_GET_PRIV(net_dev);
-	if (pAd == NULL)
-	{
-		/* if 1st open fail, pAd will be free;
-		   So the net_dev->priv will be NULL in 2rd open */
-		return -ENETDOWN;
-	}
-
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-		ret = rt28xx_sta_ioctl(net_dev, rq, cmd);
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-	return ret;
-}
-
-
-/*
-    ========================================================================
-
-    Routine Description:
-        return ethernet statistics counter
-
-    Arguments:
-        net_dev                     Pointer to net_device
-
-    Return Value:
-        net_device_stats*
-
-    Note:
-
-    ========================================================================
-*/
-static struct net_device_stats *RT28xx_get_ether_stats(
-    IN  struct net_device *net_dev)
-{
-    RTMP_ADAPTER *pAd = NULL;
-
-	if (net_dev)
-		pAd = RTMP_OS_NETDEV_GET_PRIV(net_dev);
-
-	if (pAd)
-	{
-
-		pAd->stats.rx_packets = pAd->WlanCounters.ReceivedFragmentCount.QuadPart;
-		pAd->stats.tx_packets = pAd->WlanCounters.TransmittedFragmentCount.QuadPart;
-
-		pAd->stats.rx_bytes = pAd->RalinkCounters.ReceivedByteCount;
-		pAd->stats.tx_bytes = pAd->RalinkCounters.TransmittedByteCount;
-
-		pAd->stats.rx_errors = pAd->Counters8023.RxErrors;
-		pAd->stats.tx_errors = pAd->Counters8023.TxErrors;
-
-		pAd->stats.rx_dropped = 0;
-		pAd->stats.tx_dropped = 0;
-
-	    pAd->stats.multicast = pAd->WlanCounters.MulticastReceivedFrameCount.QuadPart;   // multicast packets received
-	    pAd->stats.collisions = pAd->Counters8023.OneCollision + pAd->Counters8023.MoreCollisions;  // Collision packets
-
-	    pAd->stats.rx_length_errors = 0;
-	    pAd->stats.rx_over_errors = pAd->Counters8023.RxNoBuffer;                   // receiver ring buff overflow
-	    pAd->stats.rx_crc_errors = 0;//pAd->WlanCounters.FCSErrorCount;     // recved pkt with crc error
-	    pAd->stats.rx_frame_errors = pAd->Counters8023.RcvAlignmentErrors;          // recv'd frame alignment error
-	    pAd->stats.rx_fifo_errors = pAd->Counters8023.RxNoBuffer;                   // recv'r fifo overrun
-	    pAd->stats.rx_missed_errors = 0;                                            // receiver missed packet
-
-	    // detailed tx_errors
-	    pAd->stats.tx_aborted_errors = 0;
-	    pAd->stats.tx_carrier_errors = 0;
-	    pAd->stats.tx_fifo_errors = 0;
-	    pAd->stats.tx_heartbeat_errors = 0;
-	    pAd->stats.tx_window_errors = 0;
-
-	    // for cslip etc
-	    pAd->stats.rx_compressed = 0;
-	    pAd->stats.tx_compressed = 0;
-
-		return &pAd->stats;
-	}
-	else
-	return NULL;
-}
-
-
-BOOLEAN RtmpPhyNetDevExit(
-	IN RTMP_ADAPTER *pAd,
-	IN PNET_DEV net_dev)
-{
-
-
-
-#ifdef INF_AMAZON_PPA
-	if (ppa_hook_directpath_register_dev_fn && pAd->PPAEnable==TRUE)
-	{
-		UINT status;
-		status=ppa_hook_directpath_register_dev_fn(&pAd->g_if_id, pAd->net_dev, NULL, PPA_F_DIRECTPATH_DEREGISTER);
-		printk("unregister PPA:g_if_id=%d status=%d\n",pAd->g_if_id,status);
-	}
-	kfree(pAd->pDirectpathCb);
-#endif // INF_AMAZON_PPA //
-
-	// Unregister network device
-	if (net_dev != NULL)
-	{
-		printk("RtmpOSNetDevDetach(): RtmpOSNetDeviceDetach(), dev->name=%s!\n", net_dev->name);
-		RtmpOSNetDevDetach(net_dev);
-	}
-
-	return TRUE;
-
-}
-
-
-/*
-========================================================================
-Routine Description:
-    Allocate memory for adapter control block.
-
-Arguments:
-    pAd					Pointer to our adapter
-
-Return Value:
-	NDIS_STATUS_SUCCESS
-	NDIS_STATUS_FAILURE
-	NDIS_STATUS_RESOURCES
-
-Note:
-========================================================================
-*/
-NDIS_STATUS AdapterBlockAllocateMemory(
-	IN PVOID	handle,
-	OUT	PVOID	*ppAd)
-{
-
-	*ppAd = (PVOID)vmalloc(sizeof(RTMP_ADAPTER)); //pci_alloc_consistent(pci_dev, sizeof(RTMP_ADAPTER), phy_addr);
-
-	if (*ppAd)
-	{
-		NdisZeroMemory(*ppAd, sizeof(RTMP_ADAPTER));
-		((PRTMP_ADAPTER)*ppAd)->OS_Cookie = handle;
-		return (NDIS_STATUS_SUCCESS);
-	} else {
-		return (NDIS_STATUS_FAILURE);
-	}
-}
diff --git a/drivers/staging/rt3090/rt_pci_rbus.c b/drivers/staging/rt3090/rt_pci_rbus.c
deleted file mode 100644
index 29913191273b..000000000000
--- a/drivers/staging/rt3090/rt_pci_rbus.c
+++ /dev/null
@@ -1,989 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-    Module Name:
-    rt_pci_rbus.c
-
-    Abstract:
-    Create and register network interface.
-
-    Revision History:
-    Who         When            What
-    --------    ----------      ----------------------------------------------
-*/
-
-#include "rt_config.h"
-#include <linux/pci.h>
-
-
-IRQ_HANDLE_TYPE
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,19))
-rt2860_interrupt(int irq, void *dev_instance);
-#else
-rt2860_interrupt(int irq, void *dev_instance, struct pt_regs *regs);
-#endif
-
-
-static void rx_done_tasklet(unsigned long data);
-static void mgmt_dma_done_tasklet(unsigned long data);
-static void ac0_dma_done_tasklet(unsigned long data);
-static void ac1_dma_done_tasklet(unsigned long data);
-static void ac2_dma_done_tasklet(unsigned long data);
-static void ac3_dma_done_tasklet(unsigned long data);
-/*static void hcca_dma_done_tasklet(unsigned long data);*/
-static void fifo_statistic_full_tasklet(unsigned long data);
-
-
-
-/*---------------------------------------------------------------------*/
-/* Symbol & Macro Definitions                                          */
-/*---------------------------------------------------------------------*/
-#define RT2860_INT_RX_DLY				(1<<0)		// bit 0
-#define RT2860_INT_TX_DLY				(1<<1)		// bit 1
-#define RT2860_INT_RX_DONE				(1<<2)		// bit 2
-#define RT2860_INT_AC0_DMA_DONE			(1<<3)		// bit 3
-#define RT2860_INT_AC1_DMA_DONE			(1<<4)		// bit 4
-#define RT2860_INT_AC2_DMA_DONE			(1<<5)		// bit 5
-#define RT2860_INT_AC3_DMA_DONE			(1<<6)		// bit 6
-#define RT2860_INT_HCCA_DMA_DONE		(1<<7)		// bit 7
-#define RT2860_INT_MGMT_DONE			(1<<8)		// bit 8
-#ifdef TONE_RADAR_DETECT_SUPPORT
-#define RT2860_INT_TONE_RADAR			(1<<20)		// bit 20
-#endif // TONE_RADAR_DETECT_SUPPORT //
-
-#define INT_RX			RT2860_INT_RX_DONE
-
-#define INT_AC0_DLY		(RT2860_INT_AC0_DMA_DONE) //| RT2860_INT_TX_DLY)
-#define INT_AC1_DLY		(RT2860_INT_AC1_DMA_DONE) //| RT2860_INT_TX_DLY)
-#define INT_AC2_DLY		(RT2860_INT_AC2_DMA_DONE) //| RT2860_INT_TX_DLY)
-#define INT_AC3_DLY		(RT2860_INT_AC3_DMA_DONE) //| RT2860_INT_TX_DLY)
-#define INT_HCCA_DLY	(RT2860_INT_HCCA_DMA_DONE) //| RT2860_INT_TX_DLY)
-#define INT_MGMT_DLY	RT2860_INT_MGMT_DONE
-#ifdef TONE_RADAR_DETECT_SUPPORT
-#define INT_TONE_RADAR	(RT2860_INT_TONE_RADAR)
-#endif // TONE_RADAR_DETECT_SUPPORT //
-
-
-/***************************************************************************
-  *
-  *	Interface-depended memory allocation/Free related procedures.
-  *		Mainly for Hardware TxDesc/RxDesc/MgmtDesc, DMA Memory for TxData/RxData, etc.,
-  *
-  **************************************************************************/
-// Function for TxDesc Memory allocation.
-void RTMP_AllocateTxDescMemory(
-	IN	PRTMP_ADAPTER pAd,
-	IN	UINT	Index,
-	IN	ULONG	Length,
-	IN	BOOLEAN	Cached,
-	OUT	PVOID	*VirtualAddress,
-	OUT	PNDIS_PHYSICAL_ADDRESS PhysicalAddress)
-{
-	POS_COOKIE pObj = (POS_COOKIE)pAd->OS_Cookie;
-
-	*VirtualAddress = (PVOID)pci_alloc_consistent(pObj->pci_dev,sizeof(char)*Length, PhysicalAddress);
-
-}
-
-
-// Function for MgmtDesc Memory allocation.
-void RTMP_AllocateMgmtDescMemory(
-	IN	PRTMP_ADAPTER pAd,
-	IN	ULONG	Length,
-	IN	BOOLEAN	Cached,
-	OUT	PVOID	*VirtualAddress,
-	OUT	PNDIS_PHYSICAL_ADDRESS PhysicalAddress)
-{
-	POS_COOKIE pObj = (POS_COOKIE)pAd->OS_Cookie;
-
-	*VirtualAddress = (PVOID)pci_alloc_consistent(pObj->pci_dev,sizeof(char)*Length, PhysicalAddress);
-
-}
-
-
-// Function for RxDesc Memory allocation.
-void RTMP_AllocateRxDescMemory(
-	IN	PRTMP_ADAPTER pAd,
-	IN	ULONG	Length,
-	IN	BOOLEAN	Cached,
-	OUT	PVOID	*VirtualAddress,
-	OUT	PNDIS_PHYSICAL_ADDRESS PhysicalAddress)
-{
-	POS_COOKIE pObj = (POS_COOKIE)pAd->OS_Cookie;
-
-	*VirtualAddress = (PVOID)pci_alloc_consistent(pObj->pci_dev,sizeof(char)*Length, PhysicalAddress);
-
-}
-
-
-// Function for free allocated Desc Memory.
-void RTMP_FreeDescMemory(
-	IN	PRTMP_ADAPTER pAd,
-	IN	ULONG	Length,
-	IN	PVOID	VirtualAddress,
-	IN	NDIS_PHYSICAL_ADDRESS PhysicalAddress)
-{
-	POS_COOKIE pObj = (POS_COOKIE)pAd->OS_Cookie;
-
-	pci_free_consistent(pObj->pci_dev, Length, VirtualAddress, PhysicalAddress);
-}
-
-
-// Function for TxData DMA Memory allocation.
-void RTMP_AllocateFirstTxBuffer(
-	IN	PRTMP_ADAPTER pAd,
-	IN	UINT	Index,
-	IN	ULONG	Length,
-	IN	BOOLEAN	Cached,
-	OUT	PVOID	*VirtualAddress,
-	OUT	PNDIS_PHYSICAL_ADDRESS PhysicalAddress)
-{
-	POS_COOKIE pObj = (POS_COOKIE)pAd->OS_Cookie;
-
-	*VirtualAddress = (PVOID)pci_alloc_consistent(pObj->pci_dev,sizeof(char)*Length, PhysicalAddress);
-}
-
-
-void RTMP_FreeFirstTxBuffer(
-	IN	PRTMP_ADAPTER pAd,
-	IN	ULONG	Length,
-	IN	BOOLEAN	Cached,
-	IN	PVOID	VirtualAddress,
-	IN	NDIS_PHYSICAL_ADDRESS PhysicalAddress)
-{
-	POS_COOKIE pObj = (POS_COOKIE)pAd->OS_Cookie;
-
-	pci_free_consistent(pObj->pci_dev, Length, VirtualAddress, PhysicalAddress);
-}
-
-
-/*
- * FUNCTION: Allocate a common buffer for DMA
- * ARGUMENTS:
- *     AdapterHandle:  AdapterHandle
- *     Length:  Number of bytes to allocate
- *     Cached:  Whether or not the memory can be cached
- *     VirtualAddress:  Pointer to memory is returned here
- *     PhysicalAddress:  Physical address corresponding to virtual address
- */
-void RTMP_AllocateSharedMemory(
-	IN	PRTMP_ADAPTER pAd,
-	IN	ULONG	Length,
-	IN	BOOLEAN	Cached,
-	OUT	PVOID	*VirtualAddress,
-	OUT	PNDIS_PHYSICAL_ADDRESS PhysicalAddress)
-{
-	POS_COOKIE pObj = (POS_COOKIE)pAd->OS_Cookie;
-
-	*VirtualAddress = (PVOID)pci_alloc_consistent(pObj->pci_dev,sizeof(char)*Length, PhysicalAddress);
-}
-
-
-/*
- * FUNCTION: Allocate a packet buffer for DMA
- * ARGUMENTS:
- *     AdapterHandle:  AdapterHandle
- *     Length:  Number of bytes to allocate
- *     Cached:  Whether or not the memory can be cached
- *     VirtualAddress:  Pointer to memory is returned here
- *     PhysicalAddress:  Physical address corresponding to virtual address
- * Notes:
- *     Cached is ignored: always cached memory
- */
-PNDIS_PACKET RTMP_AllocateRxPacketBuffer(
-	IN	PRTMP_ADAPTER pAd,
-	IN	ULONG	Length,
-	IN	BOOLEAN	Cached,
-	OUT	PVOID	*VirtualAddress,
-	OUT	PNDIS_PHYSICAL_ADDRESS PhysicalAddress)
-{
-	struct sk_buff *pkt;
-
-	pkt = dev_alloc_skb(Length);
-
-	if (pkt == NULL) {
-		DBGPRINT(RT_DEBUG_ERROR, ("can't allocate rx %ld size packet\n",Length));
-	}
-
-	if (pkt) {
-		RTMP_SET_PACKET_SOURCE(OSPKT_TO_RTPKT(pkt), PKTSRC_NDIS);
-		*VirtualAddress = (PVOID) pkt->data;
-//#ifdef CONFIG_5VT_ENHANCE
-//		*PhysicalAddress = PCI_MAP_SINGLE(pAd, *VirtualAddress, 1600, PCI_DMA_FROMDEVICE);
-//#else
-		*PhysicalAddress = PCI_MAP_SINGLE(pAd, *VirtualAddress, Length,  -1, PCI_DMA_FROMDEVICE);
-//#endif
-	} else {
-		*VirtualAddress = (PVOID) NULL;
-		*PhysicalAddress = (NDIS_PHYSICAL_ADDRESS) NULL;
-	}
-
-	return (PNDIS_PACKET) pkt;
-}
-
-
-VOID Invalid_Remaining_Packet(
-	IN	PRTMP_ADAPTER pAd,
-	IN	 ULONG VirtualAddress)
-{
-	NDIS_PHYSICAL_ADDRESS PhysicalAddress;
-
-	PhysicalAddress = PCI_MAP_SINGLE(pAd, (void *)(VirtualAddress+1600), RX_BUFFER_NORMSIZE-1600, -1, PCI_DMA_FROMDEVICE);
-}
-
-
-int RtmpOSIRQRequest(IN struct net_device *net_dev)
-{
-	PRTMP_ADAPTER pAd = (PRTMP_ADAPTER)(RTMP_OS_NETDEV_GET_PRIV(net_dev));
-	int retval = 0;
-
-	ASSERT(pAd);
-
-	if (pAd->infType != RTMP_DEV_INF_RBUS)
-	{
-		POS_COOKIE _pObj = (POS_COOKIE)(pAd->OS_Cookie);
-		RTMP_MSI_ENABLE(pAd);
-		retval = request_irq(_pObj->pci_dev->irq,  rt2860_interrupt, SA_SHIRQ, (net_dev)->name, (net_dev));
-		if (retval != 0)
-			printk("RT2860: request_irq  ERROR(%d)\n", retval);
-	}
-	else
-	{
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,22)
-		if ((retval = request_irq(net_dev->irq, rt2860_interrupt, IRQF_SHARED, net_dev->name ,net_dev)))
-#else
-		if ((retval = request_irq(net_dev->irq,rt2860_interrupt, SA_INTERRUPT, net_dev->name ,net_dev)))
-#endif
-		{
-			printk("RT2860: request_irq  ERROR(%d)\n", retval);
-		}
-	}
-
-	return retval;
-
-}
-
-
-int RtmpOSIRQRelease(IN struct net_device *net_dev)
-{
-	PRTMP_ADAPTER pAd = (PRTMP_ADAPTER)(RTMP_OS_NETDEV_GET_PRIV(net_dev));
-
-	ASSERT(pAd);
-	if (pAd->infType != RTMP_DEV_INF_RBUS)
-	{
-		POS_COOKIE pObj = (POS_COOKIE)(pAd->OS_Cookie);
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,5,0)
-		synchronize_irq(pObj->pci_dev->irq);
-#endif
-		free_irq(pObj->pci_dev->irq, (net_dev));
-		RTMP_MSI_DISABLE(pAd);
-	}
-	else
-	{
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,5,0)
-		synchronize_irq(net_dev->irq);
-#endif
-		free_irq(net_dev->irq, (net_dev));
-	}
-
-	return 0;
-}
-
-
-NDIS_STATUS RtmpNetTaskInit(IN RTMP_ADAPTER *pAd)
-{
-	POS_COOKIE pObj;
-
-	pObj = (POS_COOKIE) pAd->OS_Cookie;
-
-	tasklet_init(&pObj->rx_done_task, rx_done_tasklet, (unsigned long)pAd);
-	tasklet_init(&pObj->mgmt_dma_done_task, mgmt_dma_done_tasklet, (unsigned long)pAd);
-	tasklet_init(&pObj->ac0_dma_done_task, ac0_dma_done_tasklet, (unsigned long)pAd);
-	tasklet_init(&pObj->ac1_dma_done_task, ac1_dma_done_tasklet, (unsigned long)pAd);
-	tasklet_init(&pObj->ac2_dma_done_task, ac2_dma_done_tasklet, (unsigned long)pAd);
-	tasklet_init(&pObj->ac3_dma_done_task, ac3_dma_done_tasklet, (unsigned long)pAd);
-	/*tasklet_init(&pObj->hcca_dma_done_task, hcca_dma_done_tasklet, (unsigned long)pAd);*/
-	tasklet_init(&pObj->tbtt_task, tbtt_tasklet, (unsigned long)pAd);
-	tasklet_init(&pObj->fifo_statistic_full_task, fifo_statistic_full_tasklet, (unsigned long)pAd);
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-void RtmpNetTaskExit(IN RTMP_ADAPTER *pAd)
-{
-	POS_COOKIE pObj;
-
-	pObj = (POS_COOKIE) pAd->OS_Cookie;
-
-	tasklet_kill(&pObj->rx_done_task);
-	tasklet_kill(&pObj->mgmt_dma_done_task);
-	tasklet_kill(&pObj->ac0_dma_done_task);
-	tasklet_kill(&pObj->ac1_dma_done_task);
-	tasklet_kill(&pObj->ac2_dma_done_task);
-	tasklet_kill(&pObj->ac3_dma_done_task);
-	/*tasklet_kill(&pObj->hcca_dma_done_task);*/
-	tasklet_kill(&pObj->tbtt_task);
-	tasklet_kill(&pObj->fifo_statistic_full_task);
-}
-
-
-NDIS_STATUS RtmpMgmtTaskInit(IN RTMP_ADAPTER *pAd)
-{
-
-
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-/*
-========================================================================
-Routine Description:
-    Close kernel threads.
-
-Arguments:
-	*pAd				the raxx interface data pointer
-
-Return Value:
-    NONE
-
-Note:
-========================================================================
-*/
-VOID RtmpMgmtTaskExit(
-	IN RTMP_ADAPTER *pAd)
-{
-
-
-	return;
-}
-
-
-static inline void rt2860_int_enable(PRTMP_ADAPTER pAd, unsigned int mode)
-{
-	u32 regValue;
-
-	pAd->int_disable_mask &= ~(mode);
-	regValue = pAd->int_enable_reg & ~(pAd->int_disable_mask);
-	//if (!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE))
-	{
-		RTMP_IO_WRITE32(pAd, INT_MASK_CSR, regValue);     // 1:enable
-	}
-	//else
-	//	DBGPRINT(RT_DEBUG_TRACE, ("fOP_STATUS_DOZE !\n"));
-
-	if (regValue != 0)
-		RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_INTERRUPT_ACTIVE);
-}
-
-
-static inline void rt2860_int_disable(PRTMP_ADAPTER pAd, unsigned int mode)
-{
-	u32 regValue;
-
-	pAd->int_disable_mask |= mode;
-	regValue =	pAd->int_enable_reg & ~(pAd->int_disable_mask);
-	RTMP_IO_WRITE32(pAd, INT_MASK_CSR, regValue);     // 0: disable
-
-	if (regValue == 0)
-	{
-		RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_INTERRUPT_ACTIVE);
-	}
-}
-
-
-/***************************************************************************
-  *
-  *	tasklet related procedures.
-  *
-  **************************************************************************/
-static void mgmt_dma_done_tasklet(unsigned long data)
-{
-	unsigned long flags;
-	PRTMP_ADAPTER pAd = (PRTMP_ADAPTER) data;
-    INT_SOURCE_CSR_STRUC	IntSource;
-	POS_COOKIE pObj;
-
-	// Do nothing if the driver is starting halt state.
-	// This might happen when timer already been fired before cancel timer with mlmehalt
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
-		return;
-
-    pObj = (POS_COOKIE) pAd->OS_Cookie;
-
-//	printk("mgmt_dma_done_process\n");
-	IntSource.word = 0;
-	IntSource.field.MgmtDmaDone = 1;
-	pAd->int_pending &= ~INT_MGMT_DLY;
-
-	RTMPHandleMgmtRingDmaDoneInterrupt(pAd);
-
-	// if you use RTMP_SEM_LOCK, sometimes kernel will hang up, no any
-	// bug report output
-	RTMP_INT_LOCK(&pAd->irq_lock, flags);
-	/*
-	 * double check to avoid lose of interrupts
-	 */
-	if (pAd->int_pending & INT_MGMT_DLY)
-	{
-		tasklet_hi_schedule(&pObj->mgmt_dma_done_task);
-		RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
-		return;
-	}
-
-	/* enable TxDataInt again */
-	rt2860_int_enable(pAd, INT_MGMT_DLY);
-	RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
-}
-
-
-static void rx_done_tasklet(unsigned long data)
-{
-	unsigned long flags;
-	PRTMP_ADAPTER pAd = (PRTMP_ADAPTER) data;
-	BOOLEAN	bReschedule = 0;
-	POS_COOKIE pObj;
-
-	// Do nothing if the driver is starting halt state.
-	// This might happen when timer already been fired before cancel timer with mlmehalt
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
-		return;
-
-#ifdef UAPSD_AP_SUPPORT
-	UAPSD_TIMING_RECORD(pAd, UAPSD_TIMING_RECORD_TASKLET);
-#endif // UAPSD_AP_SUPPORT //
-
-    pObj = (POS_COOKIE) pAd->OS_Cookie;
-
-	pAd->int_pending &= ~(INT_RX);
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		bReschedule = STARxDoneInterruptHandle(pAd, 0);
-#endif // CONFIG_STA_SUPPORT //
-
-#ifdef UAPSD_AP_SUPPORT
-	UAPSD_TIMING_RECORD_STOP();
-#endif // UAPSD_AP_SUPPORT //
-
-	RTMP_INT_LOCK(&pAd->irq_lock, flags);
-	/*
-	 * double check to avoid rotting packet
-	 */
-	if (pAd->int_pending & INT_RX || bReschedule)
-	{
-		tasklet_hi_schedule(&pObj->rx_done_task);
-		RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
-		return;
-	}
-
-	/* enable RxINT again */
-	rt2860_int_enable(pAd, INT_RX);
-	RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
-
-}
-
-
-void fifo_statistic_full_tasklet(unsigned long data)
-{
-	unsigned long flags;
-	PRTMP_ADAPTER pAd = (PRTMP_ADAPTER) data;
-	POS_COOKIE pObj;
-
-	// Do nothing if the driver is starting halt state.
-	// This might happen when timer already been fired before cancel timer with mlmehalt
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
-		return;
-
-    pObj = (POS_COOKIE) pAd->OS_Cookie;
-
-	pAd->int_pending &= ~(FifoStaFullInt);
-	NICUpdateFifoStaCounters(pAd);
-
-	RTMP_INT_LOCK(&pAd->irq_lock, flags);
-	/*
-	 * double check to avoid rotting packet
-	 */
-	if (pAd->int_pending & FifoStaFullInt)
-	{
-		tasklet_hi_schedule(&pObj->fifo_statistic_full_task);
-		RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
-		return;
-	}
-
-	/* enable RxINT again */
-
-	rt2860_int_enable(pAd, FifoStaFullInt);
-	RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
-
-}
-
-
-
-
-static void ac3_dma_done_tasklet(unsigned long data)
-{
-	unsigned long flags;
-	PRTMP_ADAPTER pAd = (PRTMP_ADAPTER) data;
-    INT_SOURCE_CSR_STRUC	IntSource;
-	POS_COOKIE pObj;
-	BOOLEAN bReschedule = 0;
-
-	// Do nothing if the driver is starting halt state.
-	// This might happen when timer already been fired before cancel timer with mlmehalt
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
-		return;
-
-    pObj = (POS_COOKIE) pAd->OS_Cookie;
-
-//	printk("ac0_dma_done_process\n");
-	IntSource.word = 0;
-	IntSource.field.Ac3DmaDone = 1;
-	pAd->int_pending &= ~INT_AC3_DLY;
-
-	bReschedule = RTMPHandleTxRingDmaDoneInterrupt(pAd, IntSource);
-
-	RTMP_INT_LOCK(&pAd->irq_lock, flags);
-	/*
-	 * double check to avoid lose of interrupts
-	 */
-	if ((pAd->int_pending & INT_AC3_DLY) || bReschedule)
-	{
-		tasklet_hi_schedule(&pObj->ac3_dma_done_task);
-		RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
-		return;
-	}
-
-	/* enable TxDataInt again */
-	rt2860_int_enable(pAd, INT_AC3_DLY);
-	RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
-}
-
-
-static void ac2_dma_done_tasklet(unsigned long data)
-{
-	unsigned long flags;
-	PRTMP_ADAPTER pAd = (PRTMP_ADAPTER) data;
-    INT_SOURCE_CSR_STRUC	IntSource;
-	POS_COOKIE pObj;
-	BOOLEAN bReschedule = 0;
-
-	// Do nothing if the driver is starting halt state.
-	// This might happen when timer already been fired before cancel timer with mlmehalt
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
-		return;
-
-    pObj = (POS_COOKIE) pAd->OS_Cookie;
-
-	IntSource.word = 0;
-	IntSource.field.Ac2DmaDone = 1;
-	pAd->int_pending &= ~INT_AC2_DLY;
-
-	bReschedule = RTMPHandleTxRingDmaDoneInterrupt(pAd, IntSource);
-
-	RTMP_INT_LOCK(&pAd->irq_lock, flags);
-
-	/*
-	 * double check to avoid lose of interrupts
-	 */
-	if ((pAd->int_pending & INT_AC2_DLY) || bReschedule)
-	{
-		tasklet_hi_schedule(&pObj->ac2_dma_done_task);
-		RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
-		return;
-	}
-
-	/* enable TxDataInt again */
-	rt2860_int_enable(pAd, INT_AC2_DLY);
-	RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
-}
-
-
-static void ac1_dma_done_tasklet(unsigned long data)
-{
-	unsigned long flags;
-	PRTMP_ADAPTER pAd = (PRTMP_ADAPTER) data;
-    INT_SOURCE_CSR_STRUC	IntSource;
-	POS_COOKIE pObj;
-	BOOLEAN bReschedule = 0;
-
-	// Do nothing if the driver is starting halt state.
-	// This might happen when timer already been fired before cancel timer with mlmehalt
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
-		return;
-
-    pObj = (POS_COOKIE) pAd->OS_Cookie;
-
-//	printk("ac0_dma_done_process\n");
-	IntSource.word = 0;
-	IntSource.field.Ac1DmaDone = 1;
-	pAd->int_pending &= ~INT_AC1_DLY;
-
-	bReschedule = RTMPHandleTxRingDmaDoneInterrupt(pAd, IntSource);
-
-	RTMP_INT_LOCK(&pAd->irq_lock, flags);
-	/*
-	 * double check to avoid lose of interrupts
-	 */
-	if ((pAd->int_pending & INT_AC1_DLY) || bReschedule)
-	{
-		tasklet_hi_schedule(&pObj->ac1_dma_done_task);
-		RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
-		return;
-	}
-
-	/* enable TxDataInt again */
-	rt2860_int_enable(pAd, INT_AC1_DLY);
-	RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
-}
-
-
-static void ac0_dma_done_tasklet(unsigned long data)
-{
-	unsigned long flags;
-	PRTMP_ADAPTER pAd = (PRTMP_ADAPTER) data;
-	INT_SOURCE_CSR_STRUC	IntSource;
-	POS_COOKIE pObj;
-	BOOLEAN bReschedule = 0;
-
-	// Do nothing if the driver is starting halt state.
-	// This might happen when timer already been fired before cancel timer with mlmehalt
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
-		return;
-
-	pObj = (POS_COOKIE) pAd->OS_Cookie;
-
-//	printk("ac0_dma_done_process\n");
-	IntSource.word = 0;
-	IntSource.field.Ac0DmaDone = 1;
-	pAd->int_pending &= ~INT_AC0_DLY;
-
-//	RTMPHandleMgmtRingDmaDoneInterrupt(pAd);
-	bReschedule = RTMPHandleTxRingDmaDoneInterrupt(pAd, IntSource);
-
-	RTMP_INT_LOCK(&pAd->irq_lock, flags);
-	/*
-	 * double check to avoid lose of interrupts
-	 */
-	if ((pAd->int_pending & INT_AC0_DLY) || bReschedule)
-	{
-		tasklet_hi_schedule(&pObj->ac0_dma_done_task);
-		RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
-		return;
-	}
-
-	/* enable TxDataInt again */
-	rt2860_int_enable(pAd, INT_AC0_DLY);
-	RTMP_INT_UNLOCK(&pAd->irq_lock, flags);
-}
-
-
-
-
-/***************************************************************************
-  *
-  *	interrupt handler related procedures.
-  *
-  **************************************************************************/
-int print_int_count;
-
-IRQ_HANDLE_TYPE
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,19))
-rt2860_interrupt(int irq, void *dev_instance)
-#else
-rt2860_interrupt(int irq, void *dev_instance, struct pt_regs *regs)
-#endif
-{
-	struct net_device *net_dev = (struct net_device *) dev_instance;
-	PRTMP_ADAPTER pAd = (PRTMP_ADAPTER) RTMP_OS_NETDEV_GET_PRIV(net_dev);
-	INT_SOURCE_CSR_STRUC	IntSource;
-	POS_COOKIE pObj;
-
-	pObj = (POS_COOKIE) pAd->OS_Cookie;
-
-
-	/* Note 03312008: we can not return here before
-		RTMP_IO_READ32(pAd, INT_SOURCE_CSR, &IntSource.word);
-		RTMP_IO_WRITE32(pAd, INT_SOURCE_CSR, IntSource.word);
-		Or kernel will panic after ifconfig ra0 down sometimes */
-
-
-	//
-	// Inital the Interrupt source.
-	//
-	IntSource.word = 0x00000000L;
-//	McuIntSource.word = 0x00000000L;
-
-	//
-	// Get the interrupt sources & saved to local variable
-	//
-	//RTMP_IO_READ32(pAd, where, &McuIntSource.word);
-	//RTMP_IO_WRITE32(pAd, , McuIntSource.word);
-
-	//
-	// Flag fOP_STATUS_DOZE On, means ASIC put to sleep, elase means ASICK WakeUp
-	// And at the same time, clock maybe turned off that say there is no DMA service.
-	// when ASIC get to sleep.
-	// To prevent system hang on power saving.
-	// We need to check it before handle the INT_SOURCE_CSR, ASIC must be wake up.
-	//
-	// RT2661 => when ASIC is sleeping, MAC register cannot be read and written.
-	// RT2860 => when ASIC is sleeping, MAC register can be read and written.
-//	if (!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE))
-	{
-		RTMP_IO_READ32(pAd, INT_SOURCE_CSR, &IntSource.word);
-		RTMP_IO_WRITE32(pAd, INT_SOURCE_CSR, IntSource.word); // write 1 to clear
-	}
-//	else
-//		DBGPRINT(RT_DEBUG_TRACE, (">>>fOP_STATUS_DOZE<<<\n"));
-
-//	RTMP_IO_READ32(pAd, INT_SOURCE_CSR, &IsrAfterClear);
-//	RTMP_IO_READ32(pAd, MCU_INT_SOURCE_CSR, &McuIsrAfterClear);
-//	DBGPRINT(RT_DEBUG_INFO, ("====> RTMPHandleInterrupt(ISR=%08x,Mcu ISR=%08x, After clear ISR=%08x, MCU ISR=%08x)\n",
-//			IntSource.word, McuIntSource.word, IsrAfterClear, McuIsrAfterClear));
-
-	// Do nothing if Reset in progress
-	if (RTMP_TEST_FLAG(pAd, (fRTMP_ADAPTER_RESET_IN_PROGRESS |fRTMP_ADAPTER_HALT_IN_PROGRESS)))
-	{
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,5,0)
-        return  IRQ_HANDLED;
-#else
-        return;
-#endif
-	}
-
-	//
-	// Handle interrupt, walk through all bits
-	// Should start from highest priority interrupt
-	// The priority can be adjust by altering processing if statement
-	//
-
-#ifdef DBG
-
-#endif
-
-
-	pAd->bPCIclkOff = FALSE;
-
-	// If required spinlock, each interrupt service routine has to acquire
-	// and release itself.
-	//
-
-	// Do nothing if NIC doesn't exist
-	if (IntSource.word == 0xffffffff)
-	{
-		RTMP_SET_FLAG(pAd, (fRTMP_ADAPTER_NIC_NOT_EXIST | fRTMP_ADAPTER_HALT_IN_PROGRESS));
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,5,0)
-        return  IRQ_HANDLED;
-#else
-        return;
-#endif
-	}
-
-	if (IntSource.word & TxCoherent)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, (">>>TxCoherent<<<\n"));
-		RTMPHandleRxCoherentInterrupt(pAd);
-	}
-
-	if (IntSource.word & RxCoherent)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, (">>>RxCoherent<<<\n"));
-		RTMPHandleRxCoherentInterrupt(pAd);
-	}
-
-	if (IntSource.word & FifoStaFullInt)
-	{
-		if ((pAd->int_disable_mask & FifoStaFullInt) == 0)
-		{
-			/* mask FifoStaFullInt */
-			rt2860_int_disable(pAd, FifoStaFullInt);
-			tasklet_hi_schedule(&pObj->fifo_statistic_full_task);
-		}
-		pAd->int_pending |= FifoStaFullInt;
-	}
-
-	if (IntSource.word & INT_MGMT_DLY)
-	{
-		if ((pAd->int_disable_mask & INT_MGMT_DLY) ==0 )
-		{
-			rt2860_int_disable(pAd, INT_MGMT_DLY);
-			tasklet_hi_schedule(&pObj->mgmt_dma_done_task);
-		}
-		pAd->int_pending |= INT_MGMT_DLY ;
-	}
-
-	if (IntSource.word & INT_RX)
-	{
-		if ((pAd->int_disable_mask & INT_RX) == 0)
-		{
-
-			/* mask RxINT */
-			rt2860_int_disable(pAd, INT_RX);
-			tasklet_hi_schedule(&pObj->rx_done_task);
-		}
-		pAd->int_pending |= INT_RX;
-	}
-
-
-	if (IntSource.word & INT_AC3_DLY)
-	{
-
-		if ((pAd->int_disable_mask & INT_AC3_DLY) == 0)
-		{
-			/* mask TxDataInt */
-			rt2860_int_disable(pAd, INT_AC3_DLY);
-			tasklet_hi_schedule(&pObj->ac3_dma_done_task);
-		}
-		pAd->int_pending |= INT_AC3_DLY;
-	}
-
-	if (IntSource.word & INT_AC2_DLY)
-	{
-
-		if ((pAd->int_disable_mask & INT_AC2_DLY) == 0)
-		{
-			/* mask TxDataInt */
-			rt2860_int_disable(pAd, INT_AC2_DLY);
-			tasklet_hi_schedule(&pObj->ac2_dma_done_task);
-		}
-		pAd->int_pending |= INT_AC2_DLY;
-	}
-
-	if (IntSource.word & INT_AC1_DLY)
-	{
-
-		pAd->int_pending |= INT_AC1_DLY;
-
-		if ((pAd->int_disable_mask & INT_AC1_DLY) == 0)
-		{
-			/* mask TxDataInt */
-			rt2860_int_disable(pAd, INT_AC1_DLY);
-			tasklet_hi_schedule(&pObj->ac1_dma_done_task);
-		}
-
-	}
-
-	if (IntSource.word & INT_AC0_DLY)
-	{
-
-/*
-		if (IntSource.word & 0x2) {
-			u32 reg;
-			RTMP_IO_READ32(pAd, DELAY_INT_CFG, &reg);
-			printk("IntSource.word = %08x, DELAY_REG = %08x\n", IntSource.word, reg);
-		}
-*/
-		pAd->int_pending |= INT_AC0_DLY;
-
-		if ((pAd->int_disable_mask & INT_AC0_DLY) == 0)
-		{
-			/* mask TxDataInt */
-			rt2860_int_disable(pAd, INT_AC0_DLY);
-			tasklet_hi_schedule(&pObj->ac0_dma_done_task);
-		}
-
-	}
-
-
-	if (IntSource.word & PreTBTTInt)
-	{
-		RTMPHandlePreTBTTInterrupt(pAd);
-	}
-
-	if (IntSource.word & TBTTInt)
-	{
-		RTMPHandleTBTTInterrupt(pAd);
-	}
-
-
-
-
-#ifdef CONFIG_STA_SUPPORT
-	IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-	{
-		if (IntSource.word & AutoWakeupInt)
-			RTMPHandleTwakeupInterrupt(pAd);
-	}
-#endif // CONFIG_STA_SUPPORT //
-
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,5,0)
-	return  IRQ_HANDLED;
-#endif
-
-}
-
-/*
- * invaild or writeback cache
- * and convert virtual address to physical address
- */
-dma_addr_t linux_pci_map_single(void *handle, void *ptr, size_t size, int sd_idx, int direction)
-{
-	PRTMP_ADAPTER pAd;
-	POS_COOKIE pObj;
-
-	/*
-		------ Porting Information ------
-		> For Tx Alloc:
-			mgmt packets => sd_idx = 0
-			SwIdx: pAd->MgmtRing.TxCpuIdx
-			pTxD : pAd->MgmtRing.Cell[SwIdx].AllocVa;
-
-			data packets => sd_idx = 1
-			TxIdx : pAd->TxRing[pTxBlk->QueIdx].TxCpuIdx
-			QueIdx: pTxBlk->QueIdx
-			pTxD  : pAd->TxRing[pTxBlk->QueIdx].Cell[TxIdx].AllocVa;
-
-		> For Rx Alloc:
-			sd_idx = -1
-	*/
-
-	pAd = (PRTMP_ADAPTER)handle;
-	pObj = (POS_COOKIE)pAd->OS_Cookie;
-
-	if (sd_idx == 1)
-	{
-		PTX_BLK		pTxBlk;
-		pTxBlk = (PTX_BLK)ptr;
-		return pci_map_single(pObj->pci_dev, pTxBlk->pSrcBufData, pTxBlk->SrcBufLen, direction);
-	}
-	else
-	{
-		return pci_map_single(pObj->pci_dev, ptr, size, direction);
-	}
-
-}
-
-void linux_pci_unmap_single(void *handle, dma_addr_t dma_addr, size_t size, int direction)
-{
-	PRTMP_ADAPTER pAd;
-	POS_COOKIE pObj;
-
-	pAd=(PRTMP_ADAPTER)handle;
-	pObj = (POS_COOKIE)pAd->OS_Cookie;
-
-	pci_unmap_single(pObj->pci_dev, dma_addr, size, direction);
-
-}
diff --git a/drivers/staging/rt3090/rt_profile.c b/drivers/staging/rt3090/rt_profile.c
deleted file mode 100644
index 49a05901bad4..000000000000
--- a/drivers/staging/rt3090/rt_profile.c
+++ /dev/null
@@ -1,101 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-    Module Name:
-	rt_profile.c
-
-    Abstract:
-
-    Revision History:
-    Who          When          What
-    ---------    ----------    ----------------------------------------------
- */
-
-#include "rt_config.h"
-
-
-NDIS_STATUS	RTMPReadParametersHook(
-	IN	PRTMP_ADAPTER pAd)
-{
-	PSTRING					src = NULL;
-	RTMP_OS_FD				srcf;
-	RTMP_OS_FS_INFO			osFSInfo;
-	INT						retval = NDIS_STATUS_FAILURE;
-	PSTRING					buffer;
-
-	buffer = kmalloc(MAX_INI_BUFFER_SIZE, MEM_ALLOC_FLAG);
-	if(buffer == NULL)
-		return NDIS_STATUS_FAILURE;
-	memset(buffer, 0x00, MAX_INI_BUFFER_SIZE);
-
-	{
-
-#ifdef CONFIG_STA_SUPPORT
-		IF_DEV_CONFIG_OPMODE_ON_STA(pAd)
-		{
-			src = STA_PROFILE_PATH;
-		}
-#endif // CONFIG_STA_SUPPORT //
-#ifdef MULTIPLE_CARD_SUPPORT
-		src = (PSTRING)pAd->MC_FileName;
-#endif // MULTIPLE_CARD_SUPPORT //
-	}
-
-	if (src && *src)
-	{
-		RtmpOSFSInfoChange(&osFSInfo, TRUE);
-		srcf = RtmpOSFileOpen(src, O_RDONLY, 0);
-		if (IS_FILE_OPEN_ERR(srcf))
-		{
-			DBGPRINT(RT_DEBUG_ERROR, ("Open file \"%s\" failed!\n", src));
-		}
-		else
-		{
-			retval =RtmpOSFileRead(srcf, buffer, MAX_INI_BUFFER_SIZE);
-			if (retval > 0)
-			{
-				RTMPSetProfileParameters(pAd, buffer);
-				retval = NDIS_STATUS_SUCCESS;
-			}
-			else
-				DBGPRINT(RT_DEBUG_ERROR, ("Read file \"%s\" failed(errCode=%d)!\n", src, retval));
-
-			retval = RtmpOSFileClose(srcf);
-			if ( retval != 0)
-			{
-				retval = NDIS_STATUS_FAILURE;
-				DBGPRINT(RT_DEBUG_ERROR, ("Close file \"%s\" failed(errCode=%d)!\n", src, retval));
-			}
-		}
-
-		RtmpOSFSInfoChange(&osFSInfo, FALSE);
-	}
-
-	kfree(buffer);
-
-	return (retval);
-
-}
diff --git a/drivers/staging/rt3090/rtmp.h b/drivers/staging/rt3090/rtmp.h
deleted file mode 100644
index 8ef6d0bfdee6..000000000000
--- a/drivers/staging/rt3090/rtmp.h
+++ /dev/null
@@ -1,6873 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-    Module Name:
-    rtmp.h
-
-    Abstract:
-    Miniport generic portion header file
-
-    Revision History:
-    Who         When          What
-    --------    ----------    ----------------------------------------------
-    Paul Lin    2002-08-01    created
-    James Tan   2002-09-06    modified (Revise NTCRegTable)
-    John Chang  2004-09-06    modified for RT2600
-*/
-#ifndef __RTMP_H__
-#define __RTMP_H__
-
-#include "link_list.h"
-#include "spectrum_def.h"
-
-#include "rtmp_dot11.h"
-
-#ifdef MLME_EX
-#include "mlme_ex_def.h"
-#endif // MLME_EX //
-
-#ifdef CONFIG_STA_SUPPORT
-#endif // CONFIG_STA_SUPPORT //
-
-#undef AP_WSC_INCLUDED
-#undef STA_WSC_INCLUDED
-#undef WSC_INCLUDED
-
-
-#ifdef CONFIG_STA_SUPPORT
-#endif // CONFIG_STA_SUPPORT //
-
-#if defined(AP_WSC_INCLUDED) || defined(STA_WSC_INCLUDED)
-#define WSC_INCLUDED
-#endif
-
-
-
-
-
-#include "rtmp_chip.h"
-
-
-
-typedef struct _RTMP_ADAPTER		RTMP_ADAPTER;
-typedef struct _RTMP_ADAPTER		*PRTMP_ADAPTER;
-
-typedef struct _RTMP_CHIP_OP_ RTMP_CHIP_OP;
-
-
-//#define DBG		1
-
-//#define DBG_DIAGNOSE		1
-
-
-//+++Add by shiang for merge MiniportMMRequest() and MiniportDataMMRequest() into one function
-#define MAX_DATAMM_RETRY	3
-#define MGMT_USE_QUEUE_FLAG	0x80
-//---Add by shiang for merge MiniportMMRequest() and MiniportDataMMRequest() into one function
-
-#define	MAXSEQ		(0xFFF)
-
-
-#if defined(CONFIG_AP_SUPPORT) && defined(CONFIG_STA_SUPPORT)
-#define IF_DEV_CONFIG_OPMODE_ON_AP(_pAd)	if(_pAd->OpMode == OPMODE_AP)
-#define IF_DEV_CONFIG_OPMODE_ON_STA(_pAd)	if(_pAd->OpMode == OPMODE_STA)
-#else
-#define IF_DEV_CONFIG_OPMODE_ON_AP(_pAd)
-#define IF_DEV_CONFIG_OPMODE_ON_STA(_pAd)
-#endif
-
-extern  unsigned char   SNAP_AIRONET[];
-extern  unsigned char   CISCO_OUI[];
-extern  UCHAR	BaSizeArray[4];
-
-extern UCHAR BROADCAST_ADDR[MAC_ADDR_LEN];
-extern UCHAR ZERO_MAC_ADDR[MAC_ADDR_LEN];
-extern ULONG BIT32[32];
-extern UCHAR BIT8[8];
-extern char* CipherName[];
-extern char* MCSToMbps[];
-extern UCHAR	 RxwiMCSToOfdmRate[12];
-extern UCHAR SNAP_802_1H[6];
-extern UCHAR SNAP_BRIDGE_TUNNEL[6];
-extern UCHAR SNAP_AIRONET[8];
-extern UCHAR CKIP_LLC_SNAP[8];
-extern UCHAR EAPOL_LLC_SNAP[8];
-extern UCHAR EAPOL[2];
-extern UCHAR IPX[2];
-extern UCHAR APPLE_TALK[2];
-extern UCHAR RateIdToPlcpSignal[12]; // see IEEE802.11a-1999 p.14
-extern UCHAR	 OfdmRateToRxwiMCS[];
-extern UCHAR OfdmSignalToRateId[16] ;
-extern UCHAR default_cwmin[4];
-extern UCHAR default_cwmax[4];
-extern UCHAR default_sta_aifsn[4];
-extern UCHAR MapUserPriorityToAccessCategory[8];
-
-extern USHORT RateUpPER[];
-extern USHORT RateDownPER[];
-extern UCHAR  Phy11BNextRateDownward[];
-extern UCHAR  Phy11BNextRateUpward[];
-extern UCHAR  Phy11BGNextRateDownward[];
-extern UCHAR  Phy11BGNextRateUpward[];
-extern UCHAR  Phy11ANextRateDownward[];
-extern UCHAR  Phy11ANextRateUpward[];
-extern CHAR   RssiSafeLevelForTxRate[];
-extern UCHAR  RateIdToMbps[];
-extern USHORT RateIdTo500Kbps[];
-
-extern UCHAR  CipherSuiteWpaNoneTkip[];
-extern UCHAR  CipherSuiteWpaNoneTkipLen;
-
-extern UCHAR  CipherSuiteWpaNoneAes[];
-extern UCHAR  CipherSuiteWpaNoneAesLen;
-
-extern UCHAR  SsidIe;
-extern UCHAR  SupRateIe;
-extern UCHAR  ExtRateIe;
-
-#ifdef DOT11_N_SUPPORT
-extern UCHAR  HtCapIe;
-extern UCHAR  AddHtInfoIe;
-extern UCHAR  NewExtChanIe;
-#ifdef DOT11N_DRAFT3
-extern UCHAR  ExtHtCapIe;
-#endif // DOT11N_DRAFT3 //
-#endif // DOT11_N_SUPPORT //
-
-extern UCHAR  ErpIe;
-extern UCHAR  DsIe;
-extern UCHAR  TimIe;
-extern UCHAR  WpaIe;
-extern UCHAR  Wpa2Ie;
-extern UCHAR  IbssIe;
-extern UCHAR  Ccx2Ie;
-extern UCHAR  WapiIe;
-
-extern UCHAR  WPA_OUI[];
-extern UCHAR  RSN_OUI[];
-extern UCHAR  WAPI_OUI[];
-extern UCHAR  WME_INFO_ELEM[];
-extern UCHAR  WME_PARM_ELEM[];
-extern UCHAR  Ccx2QosInfo[];
-extern UCHAR  Ccx2IeInfo[];
-extern UCHAR  RALINK_OUI[];
-extern UCHAR  PowerConstraintIE[];
-
-
-extern UCHAR  RateSwitchTable[];
-extern UCHAR  RateSwitchTable11B[];
-extern UCHAR  RateSwitchTable11G[];
-extern UCHAR  RateSwitchTable11BG[];
-
-#ifdef DOT11_N_SUPPORT
-extern UCHAR  RateSwitchTable11BGN1S[];
-extern UCHAR  RateSwitchTable11BGN2S[];
-extern UCHAR  RateSwitchTable11BGN2SForABand[];
-extern UCHAR  RateSwitchTable11N1S[];
-extern UCHAR  RateSwitchTable11N2S[];
-extern UCHAR  RateSwitchTable11N2SForABand[];
-
-#ifdef CONFIG_STA_SUPPORT
-extern UCHAR  PRE_N_HT_OUI[];
-#endif // CONFIG_STA_SUPPORT //
-#endif // DOT11_N_SUPPORT //
-
-
-#ifdef RALINK_ATE
-typedef	struct _ATE_INFO {
-	UCHAR	Mode;
-	CHAR	TxPower0;
-	CHAR	TxPower1;
-	CHAR    TxAntennaSel;
-	CHAR    RxAntennaSel;
-	TXWI_STRUC  TxWI;	  // TXWI
-	USHORT	QID;
-	UCHAR	Addr1[MAC_ADDR_LEN];
-	UCHAR	Addr2[MAC_ADDR_LEN];
-	UCHAR	Addr3[MAC_ADDR_LEN];
-	UCHAR	Channel;
-	UINT32	TxLength;
-	UINT32	TxCount;
-	UINT32	TxDoneCount; // Tx DMA Done
-	UINT32	RFFreqOffset;
-	BOOLEAN	bRxFER;		// Show Rx Frame Error Rate
-	BOOLEAN	bQATxStart; // Have compiled QA in and use it to ATE tx.
-	BOOLEAN	bQARxStart;	// Have compiled QA in and use it to ATE rx.
-#ifdef RTMP_MAC_PCI
-	BOOLEAN	bFWLoading;	// Reload firmware when ATE is done.
-#endif // RTMP_MAC_PCI //
-	UINT32	RxTotalCnt;
-	UINT32	RxCntPerSec;
-
-	CHAR	LastSNR0;             // last received SNR
-	CHAR    LastSNR1;             // last received SNR for 2nd  antenna
-	CHAR    LastRssi0;            // last received RSSI
-	CHAR    LastRssi1;            // last received RSSI for 2nd  antenna
-	CHAR    LastRssi2;            // last received RSSI for 3rd  antenna
-	CHAR    AvgRssi0;             // last 8 frames' average RSSI
-	CHAR    AvgRssi1;             // last 8 frames' average RSSI
-	CHAR    AvgRssi2;             // last 8 frames' average RSSI
-	SHORT   AvgRssi0X8;           // sum of last 8 frames' RSSI
-	SHORT   AvgRssi1X8;           // sum of last 8 frames' RSSI
-	SHORT   AvgRssi2X8;           // sum of last 8 frames' RSSI
-
-	UINT32	NumOfAvgRssiSample;
-
-
-#ifdef RALINK_28xx_QA
-	// Tx frame
-	USHORT		HLen; // Header Length
-	USHORT		PLen; // Pattern Length
-	UCHAR		Header[32]; // Header buffer
-	UCHAR		Pattern[32]; // Pattern buffer
-	USHORT		DLen; // Data Length
-	USHORT		seq;
-	UINT32		CID;
-	RTMP_OS_PID	AtePid;
-	// counters
-	UINT32		U2M;
-	UINT32		OtherData;
-	UINT32		Beacon;
-	UINT32		OtherCount;
-	UINT32		TxAc0;
-	UINT32		TxAc1;
-	UINT32		TxAc2;
-	UINT32		TxAc3;
-	/*UINT32		TxHCCA;*/
-	UINT32		TxMgmt;
-	UINT32		RSSI0;
-	UINT32		RSSI1;
-	UINT32		RSSI2;
-	UINT32		SNR0;
-	UINT32		SNR1;
-	// TxStatus : 0 --> task is idle, 1 --> task is running
-	UCHAR		TxStatus;
-#endif // RALINK_28xx_QA //
-}	ATE_INFO, *PATE_INFO;
-
-#ifdef RALINK_28xx_QA
-struct ate_racfghdr {
-	UINT32		magic_no;
-	USHORT		command_type;
-	USHORT		command_id;
-	USHORT		length;
-	USHORT		sequence;
-	USHORT		status;
-	UCHAR		data[2046];
-}  __attribute__((packed));
-#endif // RALINK_28xx_QA //
-#endif // RALINK_ATE //
-
-
-typedef struct	_RSSI_SAMPLE {
-	CHAR			LastRssi0;             // last received RSSI
-	CHAR			LastRssi1;             // last received RSSI
-	CHAR			LastRssi2;             // last received RSSI
-	CHAR			AvgRssi0;
-	CHAR			AvgRssi1;
-	CHAR			AvgRssi2;
-	SHORT			AvgRssi0X8;
-	SHORT			AvgRssi1X8;
-	SHORT			AvgRssi2X8;
-} RSSI_SAMPLE;
-
-//
-//  Queue structure and macros
-//
-typedef struct  _QUEUE_ENTRY    {
-	struct _QUEUE_ENTRY     *Next;
-}   QUEUE_ENTRY, *PQUEUE_ENTRY;
-
-// Queue structure
-typedef struct  _QUEUE_HEADER   {
-	PQUEUE_ENTRY    Head;
-	PQUEUE_ENTRY    Tail;
-	ULONG           Number;
-}   QUEUE_HEADER, *PQUEUE_HEADER;
-
-#define InitializeQueueHeader(QueueHeader)              \
-{                                                       \
-	(QueueHeader)->Head = (QueueHeader)->Tail = NULL;   \
-	(QueueHeader)->Number = 0;                          \
-}
-
-#define RemoveHeadQueue(QueueHeader)                \
-(QueueHeader)->Head;                                \
-{                                                   \
-	PQUEUE_ENTRY pNext;                             \
-	if ((QueueHeader)->Head != NULL)				\
-	{												\
-		pNext = (QueueHeader)->Head->Next;          \
-		(QueueHeader)->Head->Next = NULL;		\
-		(QueueHeader)->Head = pNext;                \
-		if (pNext == NULL)                          \
-			(QueueHeader)->Tail = NULL;             \
-		(QueueHeader)->Number--;                    \
-	}												\
-}
-
-#define InsertHeadQueue(QueueHeader, QueueEntry)            \
-{                                                           \
-		((PQUEUE_ENTRY)QueueEntry)->Next = (QueueHeader)->Head; \
-		(QueueHeader)->Head = (PQUEUE_ENTRY)(QueueEntry);       \
-		if ((QueueHeader)->Tail == NULL)                        \
-			(QueueHeader)->Tail = (PQUEUE_ENTRY)(QueueEntry);   \
-		(QueueHeader)->Number++;                                \
-}
-
-#define InsertTailQueue(QueueHeader, QueueEntry)				\
-{                                                               \
-	((PQUEUE_ENTRY)QueueEntry)->Next = NULL;                    \
-	if ((QueueHeader)->Tail)                                    \
-		(QueueHeader)->Tail->Next = (PQUEUE_ENTRY)(QueueEntry); \
-	else                                                        \
-		(QueueHeader)->Head = (PQUEUE_ENTRY)(QueueEntry);       \
-	(QueueHeader)->Tail = (PQUEUE_ENTRY)(QueueEntry);           \
-	(QueueHeader)->Number++;                                    \
-}
-
-#define InsertTailQueueAc(pAd, pEntry, QueueHeader, QueueEntry)			\
-{																		\
-	((PQUEUE_ENTRY)QueueEntry)->Next = NULL;							\
-	if ((QueueHeader)->Tail)											\
-		(QueueHeader)->Tail->Next = (PQUEUE_ENTRY)(QueueEntry);			\
-	else																\
-		(QueueHeader)->Head = (PQUEUE_ENTRY)(QueueEntry);				\
-	(QueueHeader)->Tail = (PQUEUE_ENTRY)(QueueEntry);					\
-	(QueueHeader)->Number++;											\
-}
-
-
-
-//
-//  Macros for flag and ref count operations
-//
-#define RTMP_SET_FLAG(_M, _F)       ((_M)->Flags |= (_F))
-#define RTMP_CLEAR_FLAG(_M, _F)     ((_M)->Flags &= ~(_F))
-#define RTMP_CLEAR_FLAGS(_M)        ((_M)->Flags = 0)
-#define RTMP_TEST_FLAG(_M, _F)      (((_M)->Flags & (_F)) != 0)
-#define RTMP_TEST_FLAGS(_M, _F)     (((_M)->Flags & (_F)) == (_F))
-// Macro for power save flag.
-#define RTMP_SET_PSFLAG(_M, _F)       ((_M)->PSFlags |= (_F))
-#define RTMP_CLEAR_PSFLAG(_M, _F)     ((_M)->PSFlags &= ~(_F))
-#define RTMP_CLEAR_PSFLAGS(_M)        ((_M)->PSFlags = 0)
-#define RTMP_TEST_PSFLAG(_M, _F)      (((_M)->PSFlags & (_F)) != 0)
-#define RTMP_TEST_PSFLAGS(_M, _F)     (((_M)->PSFlags & (_F)) == (_F))
-
-#define OPSTATUS_SET_FLAG(_pAd, _F)     ((_pAd)->CommonCfg.OpStatusFlags |= (_F))
-#define OPSTATUS_CLEAR_FLAG(_pAd, _F)   ((_pAd)->CommonCfg.OpStatusFlags &= ~(_F))
-#define OPSTATUS_TEST_FLAG(_pAd, _F)    (((_pAd)->CommonCfg.OpStatusFlags & (_F)) != 0)
-
-#define CLIENT_STATUS_SET_FLAG(_pEntry,_F)      ((_pEntry)->ClientStatusFlags |= (_F))
-#define CLIENT_STATUS_CLEAR_FLAG(_pEntry,_F)    ((_pEntry)->ClientStatusFlags &= ~(_F))
-#define CLIENT_STATUS_TEST_FLAG(_pEntry,_F)     (((_pEntry)->ClientStatusFlags & (_F)) != 0)
-
-#define RX_FILTER_SET_FLAG(_pAd, _F)    ((_pAd)->CommonCfg.PacketFilter |= (_F))
-#define RX_FILTER_CLEAR_FLAG(_pAd, _F)  ((_pAd)->CommonCfg.PacketFilter &= ~(_F))
-#define RX_FILTER_TEST_FLAG(_pAd, _F)   (((_pAd)->CommonCfg.PacketFilter & (_F)) != 0)
-
-#ifdef CONFIG_STA_SUPPORT
-#define STA_NO_SECURITY_ON(_p)          (_p->StaCfg.WepStatus == Ndis802_11EncryptionDisabled)
-#define STA_WEP_ON(_p)                  (_p->StaCfg.WepStatus == Ndis802_11Encryption1Enabled)
-#define STA_TKIP_ON(_p)                 (_p->StaCfg.WepStatus == Ndis802_11Encryption2Enabled)
-#define STA_AES_ON(_p)                  (_p->StaCfg.WepStatus == Ndis802_11Encryption3Enabled)
-
-#define STA_TGN_WIFI_ON(_p)             (_p->StaCfg.bTGnWifiTest == TRUE)
-#endif // CONFIG_STA_SUPPORT //
-
-#define CKIP_KP_ON(_p)				((((_p)->StaCfg.CkipFlag) & 0x10) && ((_p)->StaCfg.bCkipCmicOn == TRUE))
-#define CKIP_CMIC_ON(_p)			((((_p)->StaCfg.CkipFlag) & 0x08) && ((_p)->StaCfg.bCkipCmicOn == TRUE))
-
-
-#define INC_RING_INDEX(_idx, _RingSize)    \
-{                                          \
-    (_idx) = (_idx+1) % (_RingSize);       \
-}
-
-
-#ifdef DOT11_N_SUPPORT
-// StaActive.SupportedHtPhy.MCSSet is copied from AP beacon.  Don't need to update here.
-#define COPY_HTSETTINGS_FROM_MLME_AUX_TO_ACTIVE_CFG(_pAd)                                 \
-{                                                                                       \
-	_pAd->StaActive.SupportedHtPhy.ChannelWidth = _pAd->MlmeAux.HtCapability.HtCapInfo.ChannelWidth;      \
-	_pAd->StaActive.SupportedHtPhy.MimoPs = _pAd->MlmeAux.HtCapability.HtCapInfo.MimoPs;      \
-	_pAd->StaActive.SupportedHtPhy.GF = _pAd->MlmeAux.HtCapability.HtCapInfo.GF;      \
-	_pAd->StaActive.SupportedHtPhy.ShortGIfor20 = _pAd->MlmeAux.HtCapability.HtCapInfo.ShortGIfor20;      \
-	_pAd->StaActive.SupportedHtPhy.ShortGIfor40 = _pAd->MlmeAux.HtCapability.HtCapInfo.ShortGIfor40;      \
-	_pAd->StaActive.SupportedHtPhy.TxSTBC = _pAd->MlmeAux.HtCapability.HtCapInfo.TxSTBC;      \
-	_pAd->StaActive.SupportedHtPhy.RxSTBC = _pAd->MlmeAux.HtCapability.HtCapInfo.RxSTBC;      \
-	_pAd->StaActive.SupportedHtPhy.ExtChanOffset = _pAd->MlmeAux.AddHtInfo.AddHtInfo.ExtChanOffset;      \
-	_pAd->StaActive.SupportedHtPhy.RecomWidth = _pAd->MlmeAux.AddHtInfo.AddHtInfo.RecomWidth;      \
-	_pAd->StaActive.SupportedHtPhy.OperaionMode = _pAd->MlmeAux.AddHtInfo.AddHtInfo2.OperaionMode;      \
-	_pAd->StaActive.SupportedHtPhy.NonGfPresent = _pAd->MlmeAux.AddHtInfo.AddHtInfo2.NonGfPresent;      \
-	NdisMoveMemory((_pAd)->MacTab.Content[BSSID_WCID].HTCapability.MCSSet, (_pAd)->StaActive.SupportedPhyInfo.MCSSet, sizeof(UCHAR) * 16);\
-}
-
-#define COPY_AP_HTSETTINGS_FROM_BEACON(_pAd, _pHtCapability)                                 \
-{                                                                                       \
-	_pAd->MacTab.Content[BSSID_WCID].AMsduSize = (UCHAR)(_pHtCapability->HtCapInfo.AMsduSize);	\
-	_pAd->MacTab.Content[BSSID_WCID].MmpsMode= (UCHAR)(_pHtCapability->HtCapInfo.MimoPs);	\
-	_pAd->MacTab.Content[BSSID_WCID].MaxRAmpduFactor = (UCHAR)(_pHtCapability->HtCapParm.MaxRAmpduFactor);	\
-}
-#endif // DOT11_N_SUPPORT //
-
-//
-// MACRO for 32-bit PCI register read / write
-//
-// Usage : RTMP_IO_READ32(
-//              PRTMP_ADAPTER pAd,
-//              ULONG Register_Offset,
-//              PULONG  pValue)
-//
-//         RTMP_IO_WRITE32(
-//              PRTMP_ADAPTER pAd,
-//              ULONG Register_Offset,
-//              ULONG Value)
-//
-
-
-//
-// Common fragment list structure -  Identical to the scatter gather frag list structure
-//
-//#define RTMP_SCATTER_GATHER_ELEMENT         SCATTER_GATHER_ELEMENT
-//#define PRTMP_SCATTER_GATHER_ELEMENT        PSCATTER_GATHER_ELEMENT
-#define NIC_MAX_PHYS_BUF_COUNT              8
-
-typedef struct _RTMP_SCATTER_GATHER_ELEMENT {
-    PVOID		Address;
-    ULONG		Length;
-    PULONG		Reserved;
-} RTMP_SCATTER_GATHER_ELEMENT, *PRTMP_SCATTER_GATHER_ELEMENT;
-
-
-typedef struct _RTMP_SCATTER_GATHER_LIST {
-    ULONG  NumberOfElements;
-    PULONG Reserved;
-    RTMP_SCATTER_GATHER_ELEMENT Elements[NIC_MAX_PHYS_BUF_COUNT];
-} RTMP_SCATTER_GATHER_LIST, *PRTMP_SCATTER_GATHER_LIST;
-
-
-//
-//  Some utility macros
-//
-#ifndef min
-#define min(_a, _b)     (((_a) < (_b)) ? (_a) : (_b))
-#endif
-
-#ifndef max
-#define max(_a, _b)     (((_a) > (_b)) ? (_a) : (_b))
-#endif
-
-#define GET_LNA_GAIN(_pAd)	((_pAd->LatchRfRegs.Channel <= 14) ? (_pAd->BLNAGain) : ((_pAd->LatchRfRegs.Channel <= 64) ? (_pAd->ALNAGain0) : ((_pAd->LatchRfRegs.Channel <= 128) ? (_pAd->ALNAGain1) : (_pAd->ALNAGain2))))
-
-#define INC_COUNTER64(Val)          (Val.QuadPart++)
-
-#define INFRA_ON(_p)                (OPSTATUS_TEST_FLAG(_p, fOP_STATUS_INFRA_ON))
-#define ADHOC_ON(_p)                (OPSTATUS_TEST_FLAG(_p, fOP_STATUS_ADHOC_ON))
-#define MONITOR_ON(_p)              (((_p)->StaCfg.BssType) == BSS_MONITOR)
-#define IDLE_ON(_p)                 (!INFRA_ON(_p) && !ADHOC_ON(_p))
-
-// Check LEAP & CCKM flags
-#define LEAP_ON(_p)                 (((_p)->StaCfg.LeapAuthMode) == CISCO_AuthModeLEAP)
-#define LEAP_CCKM_ON(_p)            ((((_p)->StaCfg.LeapAuthMode) == CISCO_AuthModeLEAP) && ((_p)->StaCfg.LeapAuthInfo.CCKM == TRUE))
-
-// if orginal Ethernet frame contains no LLC/SNAP, then an extra LLC/SNAP encap is required
-#define EXTRA_LLCSNAP_ENCAP_FROM_PKT_START(_pBufVA, _pExtraLlcSnapEncap)		\
-{																\
-	if (((*(_pBufVA + 12) << 8) + *(_pBufVA + 13)) > 1500)		\
-	{															\
-		_pExtraLlcSnapEncap = SNAP_802_1H;						\
-		if (NdisEqualMemory(IPX, _pBufVA + 12, 2) ||			\
-			NdisEqualMemory(APPLE_TALK, _pBufVA + 12, 2))		\
-		{														\
-			_pExtraLlcSnapEncap = SNAP_BRIDGE_TUNNEL;			\
-		}														\
-	}															\
-	else														\
-	{															\
-		_pExtraLlcSnapEncap = NULL;								\
-	}															\
-}
-
-// New Define for new Tx Path.
-#define EXTRA_LLCSNAP_ENCAP_FROM_PKT_OFFSET(_pBufVA, _pExtraLlcSnapEncap)	\
-{																\
-	if (((*(_pBufVA) << 8) + *(_pBufVA + 1)) > 1500)			\
-	{															\
-		_pExtraLlcSnapEncap = SNAP_802_1H;						\
-		if (NdisEqualMemory(IPX, _pBufVA, 2) ||					\
-			NdisEqualMemory(APPLE_TALK, _pBufVA, 2))			\
-		{														\
-			_pExtraLlcSnapEncap = SNAP_BRIDGE_TUNNEL;			\
-		}														\
-	}															\
-	else														\
-	{															\
-		_pExtraLlcSnapEncap = NULL;								\
-	}															\
-}
-
-
-#define MAKE_802_3_HEADER(_p, _pMac1, _pMac2, _pType)                   \
-{                                                                       \
-    NdisMoveMemory(_p, _pMac1, MAC_ADDR_LEN);                           \
-    NdisMoveMemory((_p + MAC_ADDR_LEN), _pMac2, MAC_ADDR_LEN);          \
-    NdisMoveMemory((_p + MAC_ADDR_LEN * 2), _pType, LENGTH_802_3_TYPE); \
-}
-
-// if pData has no LLC/SNAP (neither RFC1042 nor Bridge tunnel), keep it that way.
-// else if the received frame is LLC/SNAP-encaped IPX or APPLETALK, preserve the LLC/SNAP field
-// else remove the LLC/SNAP field from the result Ethernet frame
-// Patch for WHQL only, which did not turn on Netbios but use IPX within its payload
-// Note:
-//     _pData & _DataSize may be altered (remove 8-byte LLC/SNAP) by this MACRO
-//     _pRemovedLLCSNAP: pointer to removed LLC/SNAP; NULL is not removed
-#define CONVERT_TO_802_3(_p8023hdr, _pDA, _pSA, _pData, _DataSize, _pRemovedLLCSNAP)      \
-{                                                                       \
-    char LLC_Len[2];                                                    \
-                                                                        \
-    _pRemovedLLCSNAP = NULL;                                            \
-    if (NdisEqualMemory(SNAP_802_1H, _pData, 6)  ||                     \
-        NdisEqualMemory(SNAP_BRIDGE_TUNNEL, _pData, 6))                 \
-    {                                                                   \
-        PUCHAR pProto = _pData + 6;                                     \
-                                                                        \
-        if ((NdisEqualMemory(IPX, pProto, 2) || NdisEqualMemory(APPLE_TALK, pProto, 2)) &&  \
-            NdisEqualMemory(SNAP_802_1H, _pData, 6))                    \
-        {                                                               \
-            LLC_Len[0] = (UCHAR)(_DataSize / 256);                      \
-            LLC_Len[1] = (UCHAR)(_DataSize % 256);                      \
-            MAKE_802_3_HEADER(_p8023hdr, _pDA, _pSA, LLC_Len);          \
-        }                                                               \
-        else                                                            \
-        {                                                               \
-            MAKE_802_3_HEADER(_p8023hdr, _pDA, _pSA, pProto);           \
-            _pRemovedLLCSNAP = _pData;                                  \
-            _DataSize -= LENGTH_802_1_H;                                \
-            _pData += LENGTH_802_1_H;                                   \
-        }                                                               \
-    }                                                                   \
-    else                                                                \
-    {                                                                   \
-        LLC_Len[0] = (UCHAR)(_DataSize / 256);                          \
-        LLC_Len[1] = (UCHAR)(_DataSize % 256);                          \
-        MAKE_802_3_HEADER(_p8023hdr, _pDA, _pSA, LLC_Len);              \
-    }                                                                   \
-}
-
-
-// Enqueue this frame to MLME engine
-// We need to enqueue the whole frame because MLME need to pass data type
-// information from 802.11 header
-#ifdef RTMP_MAC_PCI
-#define REPORT_MGMT_FRAME_TO_MLME(_pAd, Wcid, _pFrame, _FrameSize, _Rssi0, _Rssi1, _Rssi2, _PlcpSignal)        \
-{                                                                                       \
-    UINT32 High32TSF, Low32TSF;                                                          \
-    RTMP_IO_READ32(_pAd, TSF_TIMER_DW1, &High32TSF);                                       \
-    RTMP_IO_READ32(_pAd, TSF_TIMER_DW0, &Low32TSF);                                        \
-    MlmeEnqueueForRecv(_pAd, Wcid, High32TSF, Low32TSF, (UCHAR)_Rssi0, (UCHAR)_Rssi1,(UCHAR)_Rssi2,_FrameSize, _pFrame, (UCHAR)_PlcpSignal);   \
-}
-#endif // RTMP_MAC_PCI //
-
-#define MAC_ADDR_EQUAL(pAddr1,pAddr2)           RTMPEqualMemory((PVOID)(pAddr1), (PVOID)(pAddr2), MAC_ADDR_LEN)
-#define SSID_EQUAL(ssid1, len1, ssid2, len2)    ((len1==len2) && (RTMPEqualMemory(ssid1, ssid2, len1)))
-
-//
-// Check if it is Japan W53(ch52,56,60,64) channel.
-//
-#define JapanChannelCheck(channel)  ((channel == 52) || (channel == 56) || (channel == 60) || (channel == 64))
-
-#ifdef CONFIG_STA_SUPPORT
-#define STA_EXTRA_SETTING(_pAd)
-
-#define STA_PORT_SECURED(_pAd) \
-{ \
-	BOOLEAN	Cancelled; \
-	(_pAd)->StaCfg.PortSecured = WPA_802_1X_PORT_SECURED; \
-	NdisAcquireSpinLock(&((_pAd)->MacTabLock)); \
-	(_pAd)->MacTab.Content[BSSID_WCID].PortSecured = (_pAd)->StaCfg.PortSecured; \
-	(_pAd)->MacTab.Content[BSSID_WCID].PrivacyFilter = Ndis802_11PrivFilterAcceptAll;\
-	NdisReleaseSpinLock(&(_pAd)->MacTabLock); \
-	RTMPCancelTimer(&((_pAd)->Mlme.LinkDownTimer), &Cancelled);\
-	STA_EXTRA_SETTING(_pAd); \
-}
-#endif // CONFIG_STA_SUPPORT //
-
-
-
-//
-//  Data buffer for DMA operation, the buffer must be contiguous physical memory
-//  Both DMA to / from CPU use the same structure.
-//
-typedef struct  _RTMP_DMABUF
-{
-	ULONG                   AllocSize;
-	PVOID                   AllocVa;            // TxBuf virtual address
-	NDIS_PHYSICAL_ADDRESS   AllocPa;            // TxBuf physical address
-} RTMP_DMABUF, *PRTMP_DMABUF;
-
-
-//
-// Control block (Descriptor) for all ring descriptor DMA operation, buffer must be
-// contiguous physical memory. NDIS_PACKET stored the binding Rx packet descriptor
-// which won't be released, driver has to wait until upper layer return the packet
-// before giveing up this rx ring descriptor to ASIC. NDIS_BUFFER is assocaited pair
-// to describe the packet buffer. For Tx, NDIS_PACKET stored the tx packet descriptor
-// which driver should ACK upper layer when the tx is physically done or failed.
-//
-typedef struct _RTMP_DMACB
-{
-	ULONG                   AllocSize;          // Control block size
-	PVOID                   AllocVa;            // Control block virtual address
-	NDIS_PHYSICAL_ADDRESS   AllocPa;            // Control block physical address
-	PNDIS_PACKET pNdisPacket;
-	PNDIS_PACKET pNextNdisPacket;
-
-	RTMP_DMABUF             DmaBuf;             // Associated DMA buffer structure
-} RTMP_DMACB, *PRTMP_DMACB;
-
-
-typedef struct _RTMP_TX_RING
-{
-	RTMP_DMACB  Cell[TX_RING_SIZE];
-	UINT32		TxCpuIdx;
-	UINT32		TxDmaIdx;
-	UINT32		TxSwFreeIdx;	// software next free tx index
-} RTMP_TX_RING, *PRTMP_TX_RING;
-
-typedef struct _RTMP_RX_RING
-{
-	RTMP_DMACB  Cell[RX_RING_SIZE];
-	UINT32		RxCpuIdx;
-	UINT32		RxDmaIdx;
-	INT32		RxSwReadIdx;	// software next read index
-} RTMP_RX_RING, *PRTMP_RX_RING;
-
-typedef struct _RTMP_MGMT_RING
-{
-	RTMP_DMACB  Cell[MGMT_RING_SIZE];
-	UINT32		TxCpuIdx;
-	UINT32		TxDmaIdx;
-	UINT32		TxSwFreeIdx; // software next free tx index
-} RTMP_MGMT_RING, *PRTMP_MGMT_RING;
-
-
-//
-//  Statistic counter structure
-//
-typedef struct _COUNTER_802_3
-{
-	// General Stats
-	ULONG       GoodTransmits;
-	ULONG       GoodReceives;
-	ULONG       TxErrors;
-	ULONG       RxErrors;
-	ULONG       RxNoBuffer;
-
-	// Ethernet Stats
-	ULONG       RcvAlignmentErrors;
-	ULONG       OneCollision;
-	ULONG       MoreCollisions;
-
-} COUNTER_802_3, *PCOUNTER_802_3;
-
-typedef struct _COUNTER_802_11 {
-	ULONG           Length;
-	LARGE_INTEGER   LastTransmittedFragmentCount;
-	LARGE_INTEGER   TransmittedFragmentCount;
-	LARGE_INTEGER   MulticastTransmittedFrameCount;
-	LARGE_INTEGER   FailedCount;
-	LARGE_INTEGER   RetryCount;
-	LARGE_INTEGER   MultipleRetryCount;
-	LARGE_INTEGER   RTSSuccessCount;
-	LARGE_INTEGER   RTSFailureCount;
-	LARGE_INTEGER   ACKFailureCount;
-	LARGE_INTEGER   FrameDuplicateCount;
-	LARGE_INTEGER   ReceivedFragmentCount;
-	LARGE_INTEGER   MulticastReceivedFrameCount;
-	LARGE_INTEGER   FCSErrorCount;
-} COUNTER_802_11, *PCOUNTER_802_11;
-
-typedef struct _COUNTER_RALINK {
-	ULONG           TransmittedByteCount;   // both successful and failure, used to calculate TX throughput
-	ULONG           ReceivedByteCount;      // both CRC okay and CRC error, used to calculate RX throughput
-	ULONG           BeenDisassociatedCount;
-	ULONG           BadCQIAutoRecoveryCount;
-	ULONG           PoorCQIRoamingCount;
-	ULONG           MgmtRingFullCount;
-	ULONG           RxCountSinceLastNULL;
-	ULONG           RxCount;
-	ULONG           RxRingErrCount;
-	ULONG           KickTxCount;
-	ULONG           TxRingErrCount;
-	LARGE_INTEGER   RealFcsErrCount;
-	ULONG           PendingNdisPacketCount;
-
-	ULONG           OneSecOsTxCount[NUM_OF_TX_RING];
-	ULONG           OneSecDmaDoneCount[NUM_OF_TX_RING];
-	UINT32          OneSecTxDoneCount;
-	ULONG           OneSecRxCount;
-	UINT32          OneSecTxAggregationCount;
-	UINT32          OneSecRxAggregationCount;
-	UINT32          OneSecReceivedByteCount;
-	UINT32			OneSecFrameDuplicateCount;
-
-	UINT32          OneSecTransmittedByteCount;   // both successful and failure, used to calculate TX throughput
-	UINT32          OneSecTxNoRetryOkCount;
-	UINT32          OneSecTxRetryOkCount;
-	UINT32          OneSecTxFailCount;
-	UINT32          OneSecFalseCCACnt;      // CCA error count, for debug purpose, might move to global counter
-	UINT32          OneSecRxOkCnt;          // RX without error
-	UINT32          OneSecRxOkDataCnt;      // unicast-to-me DATA frame count
-	UINT32          OneSecRxFcsErrCnt;      // CRC error
-	UINT32          OneSecBeaconSentCnt;
-	UINT32          LastOneSecTotalTxCount; // OneSecTxNoRetryOkCount + OneSecTxRetryOkCount + OneSecTxFailCount
-	UINT32          LastOneSecRxOkDataCnt;  // OneSecRxOkDataCnt
-	ULONG		DuplicateRcv;
-	ULONG		TxAggCount;
-	ULONG		TxNonAggCount;
-	ULONG		TxAgg1MPDUCount;
-	ULONG		TxAgg2MPDUCount;
-	ULONG		TxAgg3MPDUCount;
-	ULONG		TxAgg4MPDUCount;
-	ULONG		TxAgg5MPDUCount;
-	ULONG		TxAgg6MPDUCount;
-	ULONG		TxAgg7MPDUCount;
-	ULONG		TxAgg8MPDUCount;
-	ULONG		TxAgg9MPDUCount;
-	ULONG		TxAgg10MPDUCount;
-	ULONG		TxAgg11MPDUCount;
-	ULONG		TxAgg12MPDUCount;
-	ULONG		TxAgg13MPDUCount;
-	ULONG		TxAgg14MPDUCount;
-	ULONG		TxAgg15MPDUCount;
-	ULONG		TxAgg16MPDUCount;
-
-	LARGE_INTEGER       TransmittedOctetsInAMSDU;
-	LARGE_INTEGER       TransmittedAMSDUCount;
-	LARGE_INTEGER       ReceivedOctesInAMSDUCount;
-	LARGE_INTEGER       ReceivedAMSDUCount;
-	LARGE_INTEGER       TransmittedAMPDUCount;
-	LARGE_INTEGER       TransmittedMPDUsInAMPDUCount;
-	LARGE_INTEGER       TransmittedOctetsInAMPDUCount;
-	LARGE_INTEGER       MPDUInReceivedAMPDUCount;
-} COUNTER_RALINK, *PCOUNTER_RALINK;
-
-
-typedef struct _COUNTER_DRS {
-	// to record the each TX rate's quality. 0 is best, the bigger the worse.
-	USHORT          TxQuality[MAX_STEP_OF_TX_RATE_SWITCH];
-	UCHAR           PER[MAX_STEP_OF_TX_RATE_SWITCH];
-	UCHAR           TxRateUpPenalty;      // extra # of second penalty due to last unstable condition
-	ULONG           CurrTxRateStableTime; // # of second in current TX rate
-	BOOLEAN         fNoisyEnvironment;
-	BOOLEAN         fLastSecAccordingRSSI;
-	UCHAR           LastSecTxRateChangeAction; // 0: no change, 1:rate UP, 2:rate down
-	UCHAR			LastTimeTxRateChangeAction; //Keep last time value of LastSecTxRateChangeAction
-	ULONG			LastTxOkCount;
-} COUNTER_DRS, *PCOUNTER_DRS;
-
-
-
-
-/***************************************************************************
-  *	security key related data structure
-  **************************************************************************/
-typedef struct _CIPHER_KEY {
-	UCHAR   Key[16];            // right now we implement 4 keys, 128 bits max
-	UCHAR   RxMic[8];			// make alignment
-	UCHAR   TxMic[8];
-	UCHAR   TxTsc[6];           // 48bit TSC value
-	UCHAR   RxTsc[6];           // 48bit TSC value
-	UCHAR   CipherAlg;          // 0-none, 1:WEP64, 2:WEP128, 3:TKIP, 4:AES, 5:CKIP64, 6:CKIP128
-	UCHAR   KeyLen;
-#ifdef CONFIG_STA_SUPPORT
-	UCHAR   BssId[6];
-#endif // CONFIG_STA_SUPPORT //
-            // Key length for each key, 0: entry is invalid
-	UCHAR   Type;               // Indicate Pairwise/Group when reporting MIC error
-} CIPHER_KEY, *PCIPHER_KEY;
-
-
-// structure to define WPA Group Key Rekey Interval
-typedef struct PACKED _RT_802_11_WPA_REKEY {
-	ULONG ReKeyMethod;          // mechanism for rekeying: 0:disable, 1: time-based, 2: packet-based
-	ULONG ReKeyInterval;        // time-based: seconds, packet-based: kilo-packets
-} RT_WPA_REKEY,*PRT_WPA_REKEY, RT_802_11_WPA_REKEY, *PRT_802_11_WPA_REKEY;
-
-
-
-typedef struct {
-	UCHAR        Addr[MAC_ADDR_LEN];
-	UCHAR        ErrorCode[2];  //00 01-Invalid authentication type
-							//00 02-Authentication timeout
-							//00 03-Challenge from AP failed
-							//00 04-Challenge to AP failed
-	BOOLEAN      Reported;
-} ROGUEAP_ENTRY, *PROGUEAP_ENTRY;
-
-typedef struct {
-	UCHAR               RogueApNr;
-	ROGUEAP_ENTRY       RogueApEntry[MAX_LEN_OF_BSS_TABLE];
-} ROGUEAP_TABLE, *PROGUEAP_TABLE;
-
-//
-// Cisco IAPP format
-//
-typedef struct  _CISCO_IAPP_CONTENT_
-{
-	USHORT     Length;        //IAPP Length
-	UCHAR      MessageType;      //IAPP type
-	UCHAR      FunctionCode;     //IAPP function type
-	UCHAR      DestinaionMAC[MAC_ADDR_LEN];
-	UCHAR      SourceMAC[MAC_ADDR_LEN];
-	USHORT     Tag;           //Tag(element IE) - Adjacent AP report
-	USHORT     TagLength;     //Length of element not including 4 byte header
-	UCHAR      OUI[4];           //0x00, 0x40, 0x96, 0x00
-	UCHAR      PreviousAP[MAC_ADDR_LEN];       //MAC Address of access point
-	USHORT     Channel;
-	USHORT     SsidLen;
-	UCHAR      Ssid[MAX_LEN_OF_SSID];
-	USHORT     Seconds;          //Seconds that the client has been disassociated.
-} CISCO_IAPP_CONTENT, *PCISCO_IAPP_CONTENT;
-
-
-/*
-  *	Fragment Frame structure
-  */
-typedef struct  _FRAGMENT_FRAME {
-	PNDIS_PACKET    pFragPacket;
-	ULONG       RxSize;
-	USHORT      Sequence;
-	USHORT      LastFrag;
-	ULONG       Flags;          // Some extra frame information. bit 0: LLC presented
-} FRAGMENT_FRAME, *PFRAGMENT_FRAME;
-
-
-//
-// Packet information for NdisQueryPacket
-//
-typedef struct  _PACKET_INFO    {
-	UINT            PhysicalBufferCount;    // Physical breaks of buffer descripor chained
-	UINT            BufferCount ;           // Number of Buffer descriptor chained
-	UINT            TotalPacketLength ;     // Self explained
-	PNDIS_BUFFER    pFirstBuffer;           // Pointer to first buffer descriptor
-} PACKET_INFO, *PPACKET_INFO;
-
-
-//
-//  Arcfour Structure Added by PaulWu
-//
-typedef struct  _ARCFOUR
-{
-	UINT            X;
-	UINT            Y;
-	UCHAR           STATE[256];
-} ARCFOURCONTEXT, *PARCFOURCONTEXT;
-
-
-//
-// Tkip Key structure which RC4 key & MIC calculation
-//
-typedef struct  _TKIP_KEY_INFO  {
-	UINT        nBytesInM;  // # bytes in M for MICKEY
-	ULONG       IV16;
-	ULONG       IV32;
-	ULONG       K0;         // for MICKEY Low
-	ULONG       K1;         // for MICKEY Hig
-	ULONG       L;          // Current state for MICKEY
-	ULONG       R;          // Current state for MICKEY
-	ULONG       M;          // Message accumulator for MICKEY
-	UCHAR       RC4KEY[16];
-	UCHAR       MIC[8];
-} TKIP_KEY_INFO, *PTKIP_KEY_INFO;
-
-
-//
-// Private / Misc data, counters for driver internal use
-//
-typedef struct  __PRIVATE_STRUC {
-	UINT       SystemResetCnt;         // System reset counter
-	UINT       TxRingFullCnt;          // Tx ring full occurrance number
-	UINT       PhyRxErrCnt;            // PHY Rx error count, for debug purpose, might move to global counter
-	// Variables for WEP encryption / decryption in rtmp_wep.c
-	UINT       FCSCRC32;
-	ARCFOURCONTEXT  WEPCONTEXT;
-	// Tkip stuff
-	TKIP_KEY_INFO   Tx;
-	TKIP_KEY_INFO   Rx;
-} PRIVATE_STRUC, *PPRIVATE_STRUC;
-
-
-/***************************************************************************
-  *	Channel and BBP related data structures
-  **************************************************************************/
-// structure to tune BBP R66 (BBP TUNING)
-typedef struct _BBP_R66_TUNING {
-	BOOLEAN     bEnable;
-	USHORT      FalseCcaLowerThreshold;  // default 100
-	USHORT      FalseCcaUpperThreshold;  // default 512
-	UCHAR       R66Delta;
-	UCHAR       R66CurrentValue;
-	BOOLEAN		R66LowerUpperSelect; //Before LinkUp, Used LowerBound or UpperBound as R66 value.
-} BBP_R66_TUNING, *PBBP_R66_TUNING;
-
-// structure to store channel TX power
-typedef struct _CHANNEL_TX_POWER {
-	USHORT     RemainingTimeForUse;		//unit: sec
-	UCHAR      Channel;
-#ifdef DOT11N_DRAFT3
-	BOOLEAN       bEffectedChannel;	// For BW 40 operating in 2.4GHz , the "effected channel" is the channel that is covered in 40Mhz.
-#endif // DOT11N_DRAFT3 //
-	CHAR       Power;
-	CHAR       Power2;
-	UCHAR      MaxTxPwr;
-	UCHAR      DfsReq;
-} CHANNEL_TX_POWER, *PCHANNEL_TX_POWER;
-
-// structure to store 802.11j channel TX power
-typedef struct _CHANNEL_11J_TX_POWER {
-	UCHAR      Channel;
-	UCHAR      BW;	// BW_10 or BW_20
-	CHAR       Power;
-	CHAR       Power2;
-	USHORT     RemainingTimeForUse;		//unit: sec
-} CHANNEL_11J_TX_POWER, *PCHANNEL_11J_TX_POWER;
-
-typedef struct _SOFT_RX_ANT_DIVERSITY_STRUCT {
-	UCHAR     EvaluatePeriod;		 // 0:not evalute status, 1: evaluate status, 2: switching status
-	UCHAR     EvaluateStableCnt;
-	UCHAR     Pair1PrimaryRxAnt;     // 0:Ant-E1, 1:Ant-E2
-	UCHAR     Pair1SecondaryRxAnt;   // 0:Ant-E1, 1:Ant-E2
-	UCHAR     Pair2PrimaryRxAnt;     // 0:Ant-E3, 1:Ant-E4
-	UCHAR     Pair2SecondaryRxAnt;   // 0:Ant-E3, 1:Ant-E4
-#ifdef CONFIG_STA_SUPPORT
-	SHORT     Pair1AvgRssi[2];       // AvgRssi[0]:E1, AvgRssi[1]:E2
-	SHORT     Pair2AvgRssi[2];       // AvgRssi[0]:E3, AvgRssi[1]:E4
-#endif // CONFIG_STA_SUPPORT //
-	SHORT     Pair1LastAvgRssi;      //
-	SHORT     Pair2LastAvgRssi;      //
-	ULONG     RcvPktNumWhenEvaluate;
-	BOOLEAN   FirstPktArrivedWhenEvaluate;
-	RALINK_TIMER_STRUCT    RxAntDiversityTimer;
-} SOFT_RX_ANT_DIVERSITY, *PSOFT_RX_ANT_DIVERSITY;
-
-
-/***************************************************************************
-  *	structure for radar detection and channel switch
-  **************************************************************************/
-typedef struct _RADAR_DETECT_STRUCT {
-    //BOOLEAN		IEEE80211H;			// 0: disable, 1: enable IEEE802.11h
-	UCHAR		CSCount;			//Channel switch counter
-	UCHAR		CSPeriod;			//Channel switch period (beacon count)
-	UCHAR		RDCount;			//Radar detection counter
-	UCHAR		RDMode;				//Radar Detection mode
-	UCHAR		RDDurRegion;		//Radar detection duration region
-	UCHAR		BBPR16;
-	UCHAR		BBPR17;
-	UCHAR		BBPR18;
-	UCHAR		BBPR21;
-	UCHAR		BBPR22;
-	UCHAR		BBPR64;
-	ULONG		InServiceMonitorCount; // unit: sec
-	UINT8		DfsSessionTime;
-#ifdef DFS_FCC_BW40_FIX
-	CHAR		DfsSessionFccOff;
-#endif
-	BOOLEAN		bFastDfs;
-	UINT8		ChMovingTime;
-	UINT8		LongPulseRadarTh;
-#ifdef MERGE_ARCH_TEAM
-	CHAR		AvgRssiReq;
-	ULONG		DfsLowerLimit;
-	ULONG		DfsUpperLimit;
-	UINT8		FixDfsLimit;
-	ULONG		upperlimit;
-	ULONG		lowerlimit;
-#endif // MERGE_ARCH_TEAM //
-} RADAR_DETECT_STRUCT, *PRADAR_DETECT_STRUCT;
-
-#ifdef CARRIER_DETECTION_SUPPORT
-typedef enum CD_STATE_n
-{
-	CD_NORMAL,
-	CD_SILENCE,
-	CD_MAX_STATE
-} CD_STATE;
-
-#ifdef TONE_RADAR_DETECT_SUPPORT
-#define CARRIER_DETECT_RECHECK_TIME			3
-
-
-#ifdef CARRIER_SENSE_NEW_ALGO
-#define CARRIER_DETECT_CRITIRIA				400
-#define CARRIER_DETECT_STOP_RATIO				0x11
-#define	CARRIER_DETECT_STOP_RATIO_OLD_3090			2
-#endif // CARRIER_SENSE_NEW_ALGO //
-
-
-#define CARRIER_DETECT_STOP_RECHECK_TIME		4
-#define CARRIER_DETECT_CRITIRIA_A				230
-#define CARRIER_DETECT_DELTA					7
-#define CARRIER_DETECT_DIV_FLAG				0
-#ifdef RT3090
-#define CARRIER_DETECT_THRESHOLD_3090A			0x1fffffff
-#endif // RT3090 //
-#ifdef RT3390
-#define CARRIER_DETECT_THRESHOLD			0x0fffffff
-#endif // RT3390 //
-#ifndef RT3390
-#define CARRIER_DETECT_THRESHOLD			0x0fffffff
-#endif // RT3390 //
-#endif // TONE_RADAR_DETECT_SUPPORT //
-
-typedef struct CARRIER_DETECTION_s
-{
-	BOOLEAN					Enable;
-	UINT8					CDSessionTime;
-	UINT8					CDPeriod;
-	CD_STATE				CD_State;
-#ifdef TONE_RADAR_DETECT_SUPPORT
-	UINT8					delta;
-	UINT8					div_flag;
-	UINT32					threshold;
-	UINT8					recheck;
-	UINT8					recheck1;
-	UINT8					recheck2;
-	UINT32					TimeStamp;
-	UINT32					criteria;
-	UINT32					CarrierDebug;
-	ULONG					idle_time;
-	ULONG					busy_time;
-	ULONG					Debug;
-#endif // TONE_RADAR_DETECT_SUPPORT //
-}CARRIER_DETECTION_STRUCT, *PCARRIER_DETECTION_STRUCT;
-#endif // CARRIER_DETECTION_SUPPORT //
-
-
-#ifdef NEW_DFS
-typedef struct _NewDFSDebug
-{
-	UCHAR channel;
-	ULONG wait_time;
-	UCHAR delta_delay_range;
-	UCHAR delta_delay_step;
-	UCHAR EL_range;
-	UCHAR EL_step;
-	UCHAR EH_range;
-	UCHAR EH_step;
-	UCHAR WL_range;
-	UCHAR WL_step;
-	UCHAR WH_range;
-	UCHAR WH_step;
-	ULONG T_expected;
-	ULONG T_margin;
-	UCHAR start;
-	ULONG count;
-	ULONG idx;
-
-}NewDFSDebug, *pNewDFSDebug;
-
-#define NEW_DFS_FCC_5_ENT_NUM		5
-#define NEW_DFS_DBG_PORT_ENT_NUM_POWER	8
-#define NEW_DFS_DBG_PORT_ENT_NUM		(1 << NEW_DFS_DBG_PORT_ENT_NUM_POWER)  // CE Debug Port entry number, 256
-#define NEW_DFS_DBG_PORT_MASK	0xff
-
-// Matched Period definition
-#define NEW_DFS_MPERIOD_ENT_NUM_POWER		8
-#define NEW_DFS_MPERIOD_ENT_NUM		(1 << NEW_DFS_MPERIOD_ENT_NUM_POWER)	 // CE Period Table entry number, 512
-#define NEW_DFS_MAX_CHANNEL	4
-
-typedef struct _NewDFSDebugPort{
-	ULONG counter;
-	ULONG timestamp;
-	USHORT width;
-	USHORT start_idx; // start index to period table
-	USHORT end_idx; // end index to period table
-}NewDFSDebugPort, *pNewDFSDebugPort;
-
-// Matched Period Table
-typedef struct _NewDFSMPeriod{
-	USHORT	idx;
-	USHORT width;
-	USHORT	idx2;
-	USHORT width2;
-	ULONG period;
-}NewDFSMPeriod, *pNewDFSMPeriod;
-
-#endif // NEW_DFS //
-
-
-typedef enum _ABGBAND_STATE_ {
-	UNKNOWN_BAND,
-	BG_BAND,
-	A_BAND,
-} ABGBAND_STATE;
-
-#ifdef RTMP_MAC_PCI
-#ifdef CONFIG_STA_SUPPORT
-// Power save method control
-typedef	union	_PS_CONTROL	{
-	struct	{
-		ULONG		EnablePSinIdle:1;			// Enable radio off when not connect to AP. radio on only when sitesurvey,
-		ULONG		EnableNewPS:1;		// Enable new  Chip power save fucntion . New method can only be applied in chip version after 2872. and PCIe.
-		ULONG		rt30xxPowerMode:2;			// Power Level Mode for rt30xx chip
-		ULONG		rt30xxFollowHostASPM:1;			// Card Follows Host's setting for rt30xx chip.
-		ULONG		rt30xxForceASPMTest:1;			// Force enable L1 for rt30xx chip. This has higher priority than rt30xxFollowHostASPM Mode.
-		ULONG		rsv:26;			// Radio Measurement Enable
-	}	field;
-	ULONG			word;
-}	PS_CONTROL, *PPS_CONTROL;
-#endif // CONFIG_STA_SUPPORT //
-#endif // RTMP_MAC_PCI //
-/***************************************************************************
-  *	structure for MLME state machine
-  **************************************************************************/
-typedef struct _MLME_STRUCT {
-#ifdef CONFIG_STA_SUPPORT
-	// STA state machines
-	STATE_MACHINE           CntlMachine;
-	STATE_MACHINE           AssocMachine;
-	STATE_MACHINE           AuthMachine;
-	STATE_MACHINE           AuthRspMachine;
-	STATE_MACHINE           SyncMachine;
-	STATE_MACHINE           WpaPskMachine;
-	STATE_MACHINE           LeapMachine;
-	STATE_MACHINE_FUNC      AssocFunc[ASSOC_FUNC_SIZE];
-	STATE_MACHINE_FUNC      AuthFunc[AUTH_FUNC_SIZE];
-	STATE_MACHINE_FUNC      AuthRspFunc[AUTH_RSP_FUNC_SIZE];
-	STATE_MACHINE_FUNC      SyncFunc[SYNC_FUNC_SIZE];
-#endif // CONFIG_STA_SUPPORT //
-	STATE_MACHINE_FUNC      ActFunc[ACT_FUNC_SIZE];
-	// Action
-	STATE_MACHINE           ActMachine;
-
-
-#ifdef QOS_DLS_SUPPORT
-	STATE_MACHINE			DlsMachine;
-	STATE_MACHINE_FUNC      DlsFunc[DLS_FUNC_SIZE];
-#endif // QOS_DLS_SUPPORT //
-
-
-	// common WPA state machine
-	STATE_MACHINE           WpaMachine;
-	STATE_MACHINE_FUNC      WpaFunc[WPA_FUNC_SIZE];
-
-
-
-	ULONG                   ChannelQuality;  // 0..100, Channel Quality Indication for Roaming
-	ULONG                   Now32;           // latch the value of NdisGetSystemUpTime()
-	ULONG                   LastSendNULLpsmTime;
-
-	BOOLEAN                 bRunning;
-	NDIS_SPIN_LOCK          TaskLock;
-	MLME_QUEUE              Queue;
-
-	UINT                    ShiftReg;
-
-	RALINK_TIMER_STRUCT     PeriodicTimer;
-	RALINK_TIMER_STRUCT     APSDPeriodicTimer;
-	RALINK_TIMER_STRUCT     LinkDownTimer;
-	RALINK_TIMER_STRUCT     LinkUpTimer;
-#ifdef RTMP_MAC_PCI
-    UCHAR                   bPsPollTimerRunning;
-    RALINK_TIMER_STRUCT     PsPollTimer;
-	RALINK_TIMER_STRUCT     RadioOnOffTimer;
-#endif // RTMP_MAC_PCI //
-	ULONG                   PeriodicRound;
-	ULONG                   OneSecPeriodicRound;
-
-	UCHAR					RealRxPath;
-	BOOLEAN					bLowThroughput;
-	BOOLEAN					bEnableAutoAntennaCheck;
-	RALINK_TIMER_STRUCT		RxAntEvalTimer;
-
-#ifdef RT30xx
-	UCHAR CaliBW40RfR24;
-	UCHAR CaliBW20RfR24;
-#endif // RT30xx //
-
-} MLME_STRUCT, *PMLME_STRUCT;
-
-
-#ifdef DOT11_N_SUPPORT
-/***************************************************************************
-  *	802.11 N related data structures
-  **************************************************************************/
-struct reordering_mpdu
-{
-	struct reordering_mpdu	*next;
-	PNDIS_PACKET			pPacket;		/* coverted to 802.3 frame */
-	int						Sequence;		/* sequence number of MPDU */
-	BOOLEAN					bAMSDU;
-};
-
-struct reordering_list
-{
-	struct reordering_mpdu *next;
-	int	qlen;
-};
-
-struct reordering_mpdu_pool
-{
-	PVOID					mem;
-	NDIS_SPIN_LOCK			lock;
-	struct reordering_list	freelist;
-};
-
-typedef enum _REC_BLOCKACK_STATUS
-{
-    Recipient_NONE=0,
-	Recipient_USED,
-	Recipient_HandleRes,
-    Recipient_Accept
-} REC_BLOCKACK_STATUS, *PREC_BLOCKACK_STATUS;
-
-typedef enum _ORI_BLOCKACK_STATUS
-{
-    Originator_NONE=0,
-	Originator_USED,
-    Originator_WaitRes,
-    Originator_Done
-} ORI_BLOCKACK_STATUS, *PORI_BLOCKACK_STATUS;
-
-typedef struct _BA_ORI_ENTRY{
-	UCHAR   Wcid;
-	UCHAR   TID;
-	UCHAR   BAWinSize;
-	UCHAR   Token;
-// Sequence is to fill every outgoing QoS DATA frame's sequence field in 802.11 header.
-	USHORT	Sequence;
-	USHORT	TimeOutValue;
-	ORI_BLOCKACK_STATUS  ORI_BA_Status;
-	RALINK_TIMER_STRUCT ORIBATimer;
-	PVOID	pAdapter;
-} BA_ORI_ENTRY, *PBA_ORI_ENTRY;
-
-typedef struct _BA_REC_ENTRY {
-	UCHAR   Wcid;
-	UCHAR   TID;
-	UCHAR   BAWinSize;	// 7.3.1.14. each buffer is capable of holding a max AMSDU or MSDU.
-	//UCHAR	NumOfRxPkt;
-	//UCHAR    Curindidx; // the head in the RX reordering buffer
-	USHORT		LastIndSeq;
-//	USHORT		LastIndSeqAtTimer;
-	USHORT		TimeOutValue;
-	RALINK_TIMER_STRUCT RECBATimer;
-	ULONG		LastIndSeqAtTimer;
-	ULONG		nDropPacket;
-	ULONG		rcvSeq;
-	REC_BLOCKACK_STATUS  REC_BA_Status;
-//	UCHAR	RxBufIdxUsed;
-	// corresponding virtual address for RX reordering packet storage.
-	//RTMP_REORDERDMABUF MAP_RXBuf[MAX_RX_REORDERBUF];
-	NDIS_SPIN_LOCK          RxReRingLock;                 // Rx Ring spinlock
-//	struct _BA_REC_ENTRY *pNext;
-	PVOID	pAdapter;
-	struct reordering_list	list;
-} BA_REC_ENTRY, *PBA_REC_ENTRY;
-
-
-typedef struct {
-	ULONG		numAsRecipient;		// I am recipient of numAsRecipient clients. These client are in the BARecEntry[]
-	ULONG		numAsOriginator;	// I am originator of	numAsOriginator clients. These clients are in the BAOriEntry[]
-	ULONG		numDoneOriginator;	// count Done Originator sessions
-	BA_ORI_ENTRY       BAOriEntry[MAX_LEN_OF_BA_ORI_TABLE];
-	BA_REC_ENTRY       BARecEntry[MAX_LEN_OF_BA_REC_TABLE];
-} BA_TABLE, *PBA_TABLE;
-
-//For QureyBATableOID use;
-typedef struct  PACKED _OID_BA_REC_ENTRY{
-	UCHAR   MACAddr[MAC_ADDR_LEN];
-	UCHAR   BaBitmap;   // if (BaBitmap&(1<<TID)), this session with{MACAddr, TID}exists, so read BufSize[TID] for BufferSize
-	UCHAR   rsv;
-	UCHAR   BufSize[8];
-	REC_BLOCKACK_STATUS	REC_BA_Status[8];
-} OID_BA_REC_ENTRY, *POID_BA_REC_ENTRY;
-
-//For QureyBATableOID use;
-typedef struct  PACKED _OID_BA_ORI_ENTRY{
-	UCHAR   MACAddr[MAC_ADDR_LEN];
-	UCHAR   BaBitmap;  // if (BaBitmap&(1<<TID)), this session with{MACAddr, TID}exists, so read BufSize[TID] for BufferSize, read ORI_BA_Status[TID] for status
-	UCHAR   rsv;
-	UCHAR   BufSize[8];
-	ORI_BLOCKACK_STATUS  ORI_BA_Status[8];
-} OID_BA_ORI_ENTRY, *POID_BA_ORI_ENTRY;
-
-typedef struct _QUERYBA_TABLE{
-	OID_BA_ORI_ENTRY       BAOriEntry[32];
-	OID_BA_REC_ENTRY       BARecEntry[32];
-	UCHAR   OriNum;// Number of below BAOriEntry
-	UCHAR   RecNum;// Number of below BARecEntry
-} QUERYBA_TABLE, *PQUERYBA_TABLE;
-
-typedef	union	_BACAP_STRUC	{
-#ifdef RT_BIG_ENDIAN
-	struct	{
-		UINT32     :4;
-		UINT32     b2040CoexistScanSup:1;		//As Sta, support do 2040 coexistence scan for AP. As Ap, support monitor trigger event to check if can use BW 40MHz.
-		UINT32     bHtAdhoc:1;			// adhoc can use ht rate.
-		UINT32     MMPSmode:2;	// MIMO power save more, 0:static, 1:dynamic, 2:rsv, 3:mimo enable
-		UINT32     AmsduSize:1;	// 0:3839, 1:7935 bytes. UINT  MSDUSizeToBytes[]	= { 3839, 7935};
-		UINT32     AmsduEnable:1;	//Enable AMSDU transmisstion
-		UINT32		MpduDensity:3;
-		UINT32		Policy:2;	// 0: DELAY_BA 1:IMMED_BA  (//BA Policy subfiled value in ADDBA frame)   2:BA-not use
-		UINT32		AutoBA:1;	// automatically BA
-		UINT32		TxBAWinLimit:8;
-		UINT32		RxBAWinLimit:8;
-	}	field;
-#else
-	struct	{
-		UINT32		RxBAWinLimit:8;
-		UINT32		TxBAWinLimit:8;
-		UINT32		AutoBA:1;	// automatically BA
-		UINT32		Policy:2;	// 0: DELAY_BA 1:IMMED_BA  (//BA Policy subfiled value in ADDBA frame)   2:BA-not use
-		UINT32		MpduDensity:3;
-		UINT32		AmsduEnable:1;	//Enable AMSDU transmisstion
-		UINT32		AmsduSize:1;	// 0:3839, 1:7935 bytes. UINT  MSDUSizeToBytes[]	= { 3839, 7935};
-		UINT32		MMPSmode:2;	// MIMO power save more, 0:static, 1:dynamic, 2:rsv, 3:mimo enable
-		UINT32		bHtAdhoc:1;			// adhoc can use ht rate.
-		UINT32		b2040CoexistScanSup:1;		//As Sta, support do 2040 coexistence scan for AP. As Ap, support monitor trigger event to check if can use BW 40MHz.
-		UINT32		:4;
-	}	field;
-#endif
-	UINT32			word;
-} BACAP_STRUC, *PBACAP_STRUC;
-
-
-typedef struct {
-	BOOLEAN		IsRecipient;
-	UCHAR   MACAddr[MAC_ADDR_LEN];
-	UCHAR   TID;
-	UCHAR   nMSDU;
-	USHORT   TimeOut;
-	BOOLEAN bAllTid;  // If True, delete all TID for BA sessions with this MACaddr.
-} OID_ADD_BA_ENTRY, *POID_ADD_BA_ENTRY;
-
-
-#ifdef DOT11N_DRAFT3
-typedef enum _BSS2040COEXIST_FLAG{
-	BSS_2040_COEXIST_DISABLE = 0,
-	BSS_2040_COEXIST_TIMER_FIRED  = 1,
-	BSS_2040_COEXIST_INFO_SYNC = 2,
-	BSS_2040_COEXIST_INFO_NOTIFY = 4,
-}BSS2040COEXIST_FLAG;
-#endif // DOT11N_DRAFT3 //
-
-#define IS_HT_STA(_pMacEntry)	\
-	(_pMacEntry->MaxHTPhyMode.field.MODE >= MODE_HTMIX)
-
-#define IS_HT_RATE(_pMacEntry)	\
-	(_pMacEntry->HTPhyMode.field.MODE >= MODE_HTMIX)
-
-#define PEER_IS_HT_RATE(_pMacEntry)	\
-	(_pMacEntry->HTPhyMode.field.MODE >= MODE_HTMIX)
-
-#endif // DOT11_N_SUPPORT //
-
-
-//This structure is for all 802.11n card InterOptibilityTest action. Reset all Num every n second.  (Details see MLMEPeriodic)
-typedef	struct	_IOT_STRUC	{
-	UCHAR			Threshold[2];
-	UCHAR			ReorderTimeOutNum[MAX_LEN_OF_BA_REC_TABLE];	// compare with threshold[0]
-	UCHAR			RefreshNum[MAX_LEN_OF_BA_REC_TABLE];	// compare with threshold[1]
-	ULONG			OneSecInWindowCount;
-	ULONG			OneSecFrameDuplicateCount;
-	ULONG			OneSecOutWindowCount;
-	UCHAR			DelOriAct;
-	UCHAR			DelRecAct;
-	UCHAR			RTSShortProt;
-	UCHAR			RTSLongProt;
-	BOOLEAN			bRTSLongProtOn;
-#ifdef CONFIG_STA_SUPPORT
-	BOOLEAN			bLastAtheros;
-    BOOLEAN			bCurrentAtheros;
-    BOOLEAN         bNowAtherosBurstOn;
-	BOOLEAN			bNextDisableRxBA;
-    BOOLEAN			bToggle;
-#endif // CONFIG_STA_SUPPORT //
-} IOT_STRUC, *PIOT_STRUC;
-
-
-// This is the registry setting for 802.11n transmit setting.  Used in advanced page.
-typedef union _REG_TRANSMIT_SETTING {
-#ifdef RT_BIG_ENDIAN
- struct {
-         UINT32  rsv:13;
-		 UINT32  EXTCHA:2;
-		 UINT32  HTMODE:1;
-		 UINT32  TRANSNO:2;
-		 UINT32  STBC:1; //SPACE
-		 UINT32  ShortGI:1;
-		 UINT32  BW:1; //channel bandwidth 20MHz or 40 MHz
-		 UINT32  TxBF:1; // 3*3
-		 UINT32  rsv0:10;
-		 //UINT32  MCS:7;                 // MCS
-         //UINT32  PhyMode:4;
-    } field;
-#else
- struct {
-         //UINT32  PhyMode:4;
-         //UINT32  MCS:7;                 // MCS
-		 UINT32  rsv0:10;
-		 UINT32  TxBF:1;
-         UINT32  BW:1; //channel bandwidth 20MHz or 40 MHz
-         UINT32  ShortGI:1;
-         UINT32  STBC:1; //SPACE
-         UINT32  TRANSNO:2;
-         UINT32  HTMODE:1;
-         UINT32  EXTCHA:2;
-         UINT32  rsv:13;
-    } field;
-#endif
- UINT32   word;
-} REG_TRANSMIT_SETTING, *PREG_TRANSMIT_SETTING;
-
-
-typedef union  _DESIRED_TRANSMIT_SETTING {
-#ifdef RT_BIG_ENDIAN
-	struct	{
-			USHORT		rsv:3;
-			USHORT		FixedTxMode:2;			// If MCS isn't AUTO, fix rate in CCK, OFDM or HT mode.
-			USHORT		PhyMode:4;
-			USHORT		MCS:7;                 // MCS
-	}	field;
-#else
-	struct	{
-			USHORT		MCS:7;			// MCS
-			USHORT		PhyMode:4;
-			USHORT		FixedTxMode:2;			// If MCS isn't AUTO, fix rate in CCK, OFDM or HT mode.
-			USHORT		rsv:3;
-	}	field;
-#endif
-	USHORT		word;
- } DESIRED_TRANSMIT_SETTING, *PDESIRED_TRANSMIT_SETTING;
-
-
-
-
-/***************************************************************************
-  *	Multiple SSID related data structures
-  **************************************************************************/
-#define WLAN_MAX_NUM_OF_TIM			((MAX_LEN_OF_MAC_TABLE >> 3) + 1) /* /8 + 1 */
-#define WLAN_CT_TIM_BCMC_OFFSET		0 /* unit: 32B */
-
-/* clear bcmc TIM bit */
-#define WLAN_MR_TIM_BCMC_CLEAR(apidx) \
-	pAd->ApCfg.MBSSID[apidx].TimBitmaps[WLAN_CT_TIM_BCMC_OFFSET] &= ~BIT8[0];
-
-/* set bcmc TIM bit */
-#define WLAN_MR_TIM_BCMC_SET(apidx) \
-	pAd->ApCfg.MBSSID[apidx].TimBitmaps[WLAN_CT_TIM_BCMC_OFFSET] |= BIT8[0];
-
-/* clear a station PS TIM bit */
-#define WLAN_MR_TIM_BIT_CLEAR(ad_p, apidx, wcid) \
-	{	UCHAR tim_offset = wcid >> 3; \
-		UCHAR bit_offset = wcid & 0x7; \
-		ad_p->ApCfg.MBSSID[apidx].TimBitmaps[tim_offset] &= (~BIT8[bit_offset]); }
-
-/* set a station PS TIM bit */
-#define WLAN_MR_TIM_BIT_SET(ad_p, apidx, wcid) \
-	{	UCHAR tim_offset = wcid >> 3; \
-		UCHAR bit_offset = wcid & 0x7; \
-		ad_p->ApCfg.MBSSID[apidx].TimBitmaps[tim_offset] |= BIT8[bit_offset]; }
-
-
-// configuration common to OPMODE_AP as well as OPMODE_STA
-typedef struct _COMMON_CONFIG {
-
-	BOOLEAN		bCountryFlag;
-	UCHAR		CountryCode[3];
-	UCHAR		Geography;
-	UCHAR       CountryRegion;      // Enum of country region, 0:FCC, 1:IC, 2:ETSI, 3:SPAIN, 4:France, 5:MKK, 6:MKK1, 7:Israel
-	UCHAR       CountryRegionForABand;	// Enum of country region for A band
-	UCHAR       PhyMode;            // PHY_11A, PHY_11B, PHY_11BG_MIXED, PHY_ABG_MIXED
-	UCHAR       DesiredPhyMode;            // PHY_11A, PHY_11B, PHY_11BG_MIXED, PHY_ABG_MIXED
-	USHORT      Dsifs;              // in units of usec
-	ULONG       PacketFilter;       // Packet filter for receiving
-	UINT8		RegulatoryClass[MAX_NUM_OF_REGULATORY_CLASS];
-
-	CHAR        Ssid[MAX_LEN_OF_SSID]; // NOT NULL-terminated
-	UCHAR       SsidLen;               // the actual ssid length in used
-	UCHAR       LastSsidLen;               // the actual ssid length in used
-	CHAR        LastSsid[MAX_LEN_OF_SSID]; // NOT NULL-terminated
-	UCHAR		LastBssid[MAC_ADDR_LEN];
-
-	UCHAR       Bssid[MAC_ADDR_LEN];
-	USHORT      BeaconPeriod;
-	UCHAR       Channel;
-	UCHAR       CentralChannel;	// Central Channel when using 40MHz is indicating. not real channel.
-
-	UCHAR       SupRate[MAX_LEN_OF_SUPPORTED_RATES];
-	UCHAR       SupRateLen;
-	UCHAR       ExtRate[MAX_LEN_OF_SUPPORTED_RATES];
-	UCHAR       ExtRateLen;
-	UCHAR       DesireRate[MAX_LEN_OF_SUPPORTED_RATES];      // OID_802_11_DESIRED_RATES
-	UCHAR       MaxDesiredRate;
-	UCHAR       ExpectedACKRate[MAX_LEN_OF_SUPPORTED_RATES];
-
-	ULONG       BasicRateBitmap;        // backup basic ratebitmap
-
-	BOOLEAN		bAPSDCapable;
-	BOOLEAN		bInServicePeriod;
-	BOOLEAN		bAPSDAC_BE;
-	BOOLEAN		bAPSDAC_BK;
-	BOOLEAN		bAPSDAC_VI;
-	BOOLEAN		bAPSDAC_VO;
-
-	/* because TSPEC can modify the APSD flag, we need to keep the APSD flag
-		requested in association stage from the station;
-		we need to recover the APSD flag after the TSPEC is deleted. */
-	BOOLEAN		bACMAPSDBackup[4]; /* for delivery-enabled & trigger-enabled both */
-	BOOLEAN		bACMAPSDTr[4]; /* no use */
-
-	BOOLEAN		bNeedSendTriggerFrame;
-	BOOLEAN		bAPSDForcePowerSave;	// Force power save mode, should only use in APSD-STAUT
-	ULONG		TriggerTimerCount;
-	UCHAR		MaxSPLength;
-	UCHAR		BBPCurrentBW;	// BW_10,	BW_20, BW_40
-	// move to MULTISSID_STRUCT for MBSS
-	//HTTRANSMIT_SETTING	HTPhyMode, MaxHTPhyMode, MinHTPhyMode;// For transmit phy setting in TXWI.
-	REG_TRANSMIT_SETTING        RegTransmitSetting; //registry transmit setting. this is for reading registry setting only. not useful.
-	//UCHAR       FixedTxMode;              // Fixed Tx Mode (CCK, OFDM), for HT fixed tx mode (GF, MIX) , refer to RegTransmitSetting.field.HTMode
-	UCHAR       TxRate;                 // Same value to fill in TXD. TxRate is 6-bit
-	UCHAR       MaxTxRate;              // RATE_1, RATE_2, RATE_5_5, RATE_11
-	UCHAR       TxRateIndex;            // Tx rate index in RateSwitchTable
-	UCHAR       TxRateTableSize;        // Valid Tx rate table size in RateSwitchTable
-	//BOOLEAN		bAutoTxRateSwitch;
-	UCHAR       MinTxRate;              // RATE_1, RATE_2, RATE_5_5, RATE_11
-	UCHAR       RtsRate;                // RATE_xxx
-	HTTRANSMIT_SETTING	MlmeTransmit;   // MGMT frame PHY rate setting when operatin at Ht rate.
-	UCHAR       MlmeRate;               // RATE_xxx, used to send MLME frames
-	UCHAR       BasicMlmeRate;          // Default Rate for sending MLME frames
-
-	USHORT      RtsThreshold;           // in unit of BYTE
-	USHORT      FragmentThreshold;      // in unit of BYTE
-
-	UCHAR       TxPower;                // in unit of mW
-	ULONG       TxPowerPercentage;      // 0~100 %
-	ULONG       TxPowerDefault;         // keep for TxPowerPercentage
-	UINT8		PwrConstraint;
-
-#ifdef DOT11_N_SUPPORT
-	BACAP_STRUC        BACapability; //   NO USE = 0XFF  ;  IMMED_BA =1  ;  DELAY_BA=0
-	BACAP_STRUC        REGBACapability; //   NO USE = 0XFF  ;  IMMED_BA =1  ;  DELAY_BA=0
-#endif // DOT11_N_SUPPORT //
-	IOT_STRUC		IOTestParm;	// 802.11n InterOpbility Test Parameter;
-	ULONG       TxPreamble;             // Rt802_11PreambleLong, Rt802_11PreambleShort, Rt802_11PreambleAuto
-	BOOLEAN     bUseZeroToDisableFragment;     // Microsoft use 0 as disable
-	ULONG       UseBGProtection;        // 0: auto, 1: always use, 2: always not use
-	BOOLEAN     bUseShortSlotTime;      // 0: disable, 1 - use short slot (9us)
-	BOOLEAN     bEnableTxBurst;         // 1: enble TX PACKET BURST (when BA is established or AP is not a legacy WMM AP), 0: disable TX PACKET BURST
-	BOOLEAN     bAggregationCapable;      // 1: enable TX aggregation when the peer supports it
-	BOOLEAN     bPiggyBackCapable;		// 1: enable TX piggy-back according MAC's version
-	BOOLEAN     bIEEE80211H;			// 1: enable IEEE802.11h spec.
-	ULONG		DisableOLBCDetect;		// 0: enable OLBC detect; 1 disable OLBC detect
-
-#ifdef DOT11_N_SUPPORT
-	BOOLEAN				bRdg;
-#endif // DOT11_N_SUPPORT //
-	BOOLEAN             bWmmCapable;        // 0:disable WMM, 1:enable WMM
-	QOS_CAPABILITY_PARM APQosCapability;    // QOS capability of the current associated AP
-	EDCA_PARM           APEdcaParm;         // EDCA parameters of the current associated AP
-	QBSS_LOAD_PARM      APQbssLoad;         // QBSS load of the current associated AP
-	UCHAR               AckPolicy[4];       // ACK policy of the specified AC. see ACK_xxx
-#ifdef CONFIG_STA_SUPPORT
-	BOOLEAN				bDLSCapable;		// 0:disable DLS, 1:enable DLS
-#endif // CONFIG_STA_SUPPORT //
-	// a bitmap of BOOLEAN flags. each bit represent an operation status of a particular
-	// BOOLEAN control, either ON or OFF. These flags should always be accessed via
-	// OPSTATUS_TEST_FLAG(), OPSTATUS_SET_FLAG(), OP_STATUS_CLEAR_FLAG() macros.
-	// see fOP_STATUS_xxx in RTMP_DEF.C for detail bit definition
-	ULONG               OpStatusFlags;
-
-	BOOLEAN				NdisRadioStateOff; //For HCT 12.0, set this flag to TRUE instead of called MlmeRadioOff.
-	ABGBAND_STATE		BandState;		// For setting BBP used on B/G or A mode.
-#ifdef ANT_DIVERSITY_SUPPORT
-	UCHAR				bRxAntDiversity; // 0:disable, 1:enable Software Rx Antenna Diversity.
-#endif // ANT_DIVERSITY_SUPPORT //
-
-	// IEEE802.11H--DFS.
-	RADAR_DETECT_STRUCT	RadarDetect;
-
-#ifdef CARRIER_DETECTION_SUPPORT
-	CARRIER_DETECTION_STRUCT		CarrierDetect;
-#endif // CARRIER_DETECTION_SUPPORT //
-
-#ifdef DOT11_N_SUPPORT
-	// HT
-	UCHAR			BASize;		// USer desired BAWindowSize. Should not exceed our max capability
-	//RT_HT_CAPABILITY	SupportedHtPhy;
-	RT_HT_CAPABILITY	DesiredHtPhy;
-	HT_CAPABILITY_IE		HtCapability;
-	ADD_HT_INFO_IE		AddHTInfo;	// Useful as AP.
-	//This IE is used with channel switch announcement element when changing to a new 40MHz.
-	//This IE is included in channel switch ammouncement frames 7.4.1.5, beacons, probe Rsp.
-	NEW_EXT_CHAN_IE	NewExtChanOffset;	//7.3.2.20A, 1 if extension channel is above the control channel, 3 if below, 0 if not present
-
-#ifdef DOT11N_DRAFT3
-	UCHAR					Bss2040CoexistFlag;		// bit 0: bBssCoexistTimerRunning, bit 1: NeedSyncAddHtInfo.
-	RALINK_TIMER_STRUCT	Bss2040CoexistTimer;
-
-	//This IE is used for 20/40 BSS Coexistence.
-	BSS_2040_COEXIST_IE		BSS2040CoexistInfo;
-	// ====== 11n D3.0 =======================>
-	USHORT					Dot11OBssScanPassiveDwell;				// Unit : TU. 5~1000
-	USHORT					Dot11OBssScanActiveDwell;				// Unit : TU. 10~1000
-	USHORT					Dot11BssWidthTriggerScanInt;			// Unit : Second
-	USHORT					Dot11OBssScanPassiveTotalPerChannel;	// Unit : TU. 200~10000
-	USHORT					Dot11OBssScanActiveTotalPerChannel;	// Unit : TU. 20~10000
-	USHORT					Dot11BssWidthChanTranDelayFactor;
-	USHORT					Dot11OBssScanActivityThre;				// Unit : percentage
-
-	ULONG					Dot11BssWidthChanTranDelay;			// multiple of (Dot11BssWidthTriggerScanInt * Dot11BssWidthChanTranDelayFactor)
-	ULONG					CountDownCtr;	// CountDown Counter from (Dot11BssWidthTriggerScanInt * Dot11BssWidthChanTranDelayFactor)
-
-	NDIS_SPIN_LOCK          TriggerEventTabLock;
-	BSS_2040_COEXIST_IE		LastBSSCoexist2040;
-	BSS_2040_COEXIST_IE		BSSCoexist2040;
-	TRIGGER_EVENT_TAB		TriggerEventTab;
-	UCHAR					ChannelListIdx;
-	// <====== 11n D3.0 =======================
-	BOOLEAN					bOverlapScanning;
-#endif // DOT11N_DRAFT3 //
-
-    BOOLEAN                 bHTProtect;
-    BOOLEAN                 bMIMOPSEnable;
-    BOOLEAN					bBADecline;
-//2008/11/05: KH add to support Antenna power-saving of AP<--
-	BOOLEAN					bGreenAPEnable;
-	BOOLEAN					bBlockAntDivforGreenAP;
-//2008/11/05: KH add to support Antenna power-saving of AP-->
-	BOOLEAN					bDisableReordering;
-	BOOLEAN					bForty_Mhz_Intolerant;
-	BOOLEAN					bExtChannelSwitchAnnouncement;
-	BOOLEAN					bRcvBSSWidthTriggerEvents;
-	ULONG					LastRcvBSSWidthTriggerEventsTime;
-
-	UCHAR					TxBASize;
-#endif // DOT11_N_SUPPORT //
-
-	// Enable wireless event
-	BOOLEAN				bWirelessEvent;
-	BOOLEAN				bWiFiTest;				// Enable this parameter for WiFi test
-
-	// Tx & Rx Stream number selection
-	UCHAR				TxStream;
-	UCHAR				RxStream;
-
-	// transmit phy mode, trasmit rate for Multicast.
-#ifdef MCAST_RATE_SPECIFIC
-	UCHAR				McastTransmitMcs;
-	UCHAR				McastTransmitPhyMode;
-#endif // MCAST_RATE_SPECIFIC //
-
-	BOOLEAN			bHardwareRadio;     // Hardware controlled Radio enabled
-
-
-
-	NDIS_SPIN_LOCK			MeasureReqTabLock;
-	PMEASURE_REQ_TAB		pMeasureReqTab;
-
-	NDIS_SPIN_LOCK			TpcReqTabLock;
-	PTPC_REQ_TAB			pTpcReqTab;
-
-	// transmit phy mode, trasmit rate for Multicast.
-#ifdef MCAST_RATE_SPECIFIC
-	HTTRANSMIT_SETTING		MCastPhyMode;
-#endif // MCAST_RATE_SPECIFIC //
-
-#ifdef SINGLE_SKU
-	UINT16					DefineMaxTxPwr;
-#endif // SINGLE_SKU //
-
-
-	BOOLEAN				PSPXlink;  // 0: Disable. 1: Enable
-
-
-#if defined(RT305x)||defined(RT30xx)
-	// request by Gary, for High Power issue
-	UCHAR	HighPowerPatchDisabled;
-#endif
-
-	BOOLEAN		HT_DisallowTKIP;		/* Restrict the encryption type in 11n HT mode */
-} COMMON_CONFIG, *PCOMMON_CONFIG;
-
-
-#ifdef CONFIG_STA_SUPPORT
-/* Modified by Wu Xi-Kun 4/21/2006 */
-// STA configuration and status
-typedef struct _STA_ADMIN_CONFIG {
-	// GROUP 1 -
-	//   User configuration loaded from Registry, E2PROM or OID_xxx. These settings describe
-	//   the user intended configuration, but not necessary fully equal to the final
-	//   settings in ACTIVE BSS after negotiation/compromize with the BSS holder (either
-	//   AP or IBSS holder).
-	//   Once initialized, user configuration can only be changed via OID_xxx
-	UCHAR       BssType;              // BSS_INFRA or BSS_ADHOC
-	USHORT      AtimWin;          // used when starting a new IBSS
-
-	// GROUP 2 -
-	//   User configuration loaded from Registry, E2PROM or OID_xxx. These settings describe
-	//   the user intended configuration, and should be always applied to the final
-	//   settings in ACTIVE BSS without compromising with the BSS holder.
-	//   Once initialized, user configuration can only be changed via OID_xxx
-	UCHAR       RssiTrigger;
-	UCHAR       RssiTriggerMode;      // RSSI_TRIGGERED_UPON_BELOW_THRESHOLD or RSSI_TRIGGERED_UPON_EXCCEED_THRESHOLD
-	USHORT      DefaultListenCount;   // default listen count;
-	ULONG       WindowsPowerMode;           // Power mode for AC power
-	ULONG       WindowsBatteryPowerMode;    // Power mode for battery if exists
-	BOOLEAN     bWindowsACCAMEnable;        // Enable CAM power mode when AC on
-	BOOLEAN     bAutoReconnect;         // Set to TRUE when setting OID_802_11_SSID with no matching BSSID
-	ULONG       WindowsPowerProfile;    // Windows power profile, for NDIS5.1 PnP
-
-	// MIB:ieee802dot11.dot11smt(1).dot11StationConfigTable(1)
-	USHORT      Psm;                  // power management mode   (PWR_ACTIVE|PWR_SAVE)
-	USHORT      DisassocReason;
-	UCHAR       DisassocSta[MAC_ADDR_LEN];
-	USHORT      DeauthReason;
-	UCHAR       DeauthSta[MAC_ADDR_LEN];
-	USHORT      AuthFailReason;
-	UCHAR       AuthFailSta[MAC_ADDR_LEN];
-
-	NDIS_802_11_PRIVACY_FILTER          PrivacyFilter;  // PrivacyFilter enum for 802.1X
-	NDIS_802_11_AUTHENTICATION_MODE     AuthMode;       // This should match to whatever microsoft defined
-	NDIS_802_11_WEP_STATUS              WepStatus;
-	NDIS_802_11_WEP_STATUS				OrigWepStatus;	// Original wep status set from OID
-
-	// Add to support different cipher suite for WPA2/WPA mode
-	NDIS_802_11_ENCRYPTION_STATUS		GroupCipher;		// Multicast cipher suite
-	NDIS_802_11_ENCRYPTION_STATUS		PairCipher;			// Unicast cipher suite
-	BOOLEAN								bMixCipher;			// Indicate current Pair & Group use different cipher suites
-	USHORT								RsnCapability;
-
-	NDIS_802_11_WEP_STATUS              GroupKeyWepStatus;
-
-	UCHAR		WpaPassPhrase[64];		// WPA PSK pass phrase
-	UINT		WpaPassPhraseLen;		// the length of WPA PSK pass phrase
-	UCHAR		PMK[32];                // WPA PSK mode PMK
-	UCHAR       PTK[64];                // WPA PSK mode PTK
-	UCHAR		GTK[32];				// GTK from authenticator
-	BSSID_INFO	SavedPMK[PMKID_NO];
-	UINT		SavedPMKNum;			// Saved PMKID number
-
-	UCHAR		DefaultKeyId;
-
-
-	// WPA 802.1x port control, WPA_802_1X_PORT_SECURED, WPA_802_1X_PORT_NOT_SECURED
-	UCHAR       PortSecured;
-
-	// For WPA countermeasures
-	ULONG       LastMicErrorTime;   // record last MIC error time
-	ULONG       MicErrCnt;          // Should be 0, 1, 2, then reset to zero (after disassoiciation).
-	BOOLEAN     bBlockAssoc;        // Block associate attempt for 60 seconds after counter measure occurred.
-	// For WPA-PSK supplicant state
-	WPA_STATE   WpaState;           // Default is SS_NOTUSE and handled by microsoft 802.1x
-	UCHAR       ReplayCounter[8];
-	UCHAR       ANonce[32];         // ANonce for WPA-PSK from aurhenticator
-	UCHAR       SNonce[32];         // SNonce for WPA-PSK
-
-	UCHAR       LastSNR0;             // last received BEACON's SNR
-	UCHAR       LastSNR1;            // last received BEACON's SNR for 2nd  antenna
-	RSSI_SAMPLE RssiSample;
-	ULONG       NumOfAvgRssiSample;
-
-	ULONG       LastBeaconRxTime;     // OS's timestamp of the last BEACON RX time
-	ULONG       Last11bBeaconRxTime;  // OS's timestamp of the last 11B BEACON RX time
-	ULONG		Last11gBeaconRxTime;	// OS's timestamp of the last 11G BEACON RX time
-	ULONG		Last20NBeaconRxTime;	// OS's timestamp of the last 20MHz N BEACON RX time
-
-	ULONG       LastScanTime;       // Record last scan time for issue BSSID_SCAN_LIST
-	ULONG       ScanCnt;            // Scan counts since most recent SSID, BSSID, SCAN OID request
-	BOOLEAN     bSwRadio;           // Software controlled Radio On/Off, TRUE: On
-	BOOLEAN     bHwRadio;           // Hardware controlled Radio On/Off, TRUE: On
-	BOOLEAN     bRadio;             // Radio state, And of Sw & Hw radio state
-	BOOLEAN     bHardwareRadio;     // Hardware controlled Radio enabled
-	BOOLEAN     bShowHiddenSSID;    // Show all known SSID in SSID list get operation
-
-	// New for WPA, windows want us to to keep association information and
-	// Fixed IEs from last association response
-	NDIS_802_11_ASSOCIATION_INFORMATION     AssocInfo;
-	USHORT       ReqVarIELen;                // Length of next VIE include EID & Length
-	UCHAR       ReqVarIEs[MAX_VIE_LEN];		// The content saved here should be little-endian format.
-	USHORT       ResVarIELen;                // Length of next VIE include EID & Length
-	UCHAR       ResVarIEs[MAX_VIE_LEN];
-
-	UCHAR       RSNIE_Len;
-	UCHAR       RSN_IE[MAX_LEN_OF_RSNIE];	// The content saved here should be little-endian format.
-
-	ULONG               CLBusyBytes;                // Save the total bytes received durning channel load scan time
-	USHORT              RPIDensity[8];              // Array for RPI density collection
-
-	UCHAR               RMReqCnt;                   // Number of measurement request saved.
-	UCHAR               CurrentRMReqIdx;            // Number of measurement request saved.
-	BOOLEAN             ParallelReq;                // Parallel measurement, only one request performed,
-													// It must be the same channel with maximum duration
-	USHORT              ParallelDuration;           // Maximum duration for parallel measurement
-	UCHAR               ParallelChannel;            // Only one channel with parallel measurement
-	USHORT              IAPPToken;                  // IAPP dialog token
-	// Hack for channel load and noise histogram parameters
-	UCHAR               NHFactor;                   // Parameter for Noise histogram
-	UCHAR               CLFactor;                   // Parameter for channel load
-
-	RALINK_TIMER_STRUCT	StaQuickResponeForRateUpTimer;
-	BOOLEAN				StaQuickResponeForRateUpTimerRunning;
-
-	UCHAR			DtimCount;      // 0.. DtimPeriod-1
-	UCHAR			DtimPeriod;     // default = 3
-
-#ifdef QOS_DLS_SUPPORT
-	RT_802_11_DLS		DLSEntry[MAX_NUM_OF_DLS_ENTRY];
-	UCHAR				DlsReplayCounter[8];
-#endif // QOS_DLS_SUPPORT //
-	////////////////////////////////////////////////////////////////////////////////////////
-	// This is only for WHQL test.
-	BOOLEAN				WhqlTest;
-	////////////////////////////////////////////////////////////////////////////////////////
-
-    RALINK_TIMER_STRUCT WpaDisassocAndBlockAssocTimer;
-    // Fast Roaming
-	BOOLEAN		        bAutoRoaming;       // 0:disable auto roaming by RSSI, 1:enable auto roaming by RSSI
-	CHAR		        dBmToRoam;          // the condition to roam when receiving Rssi less than this value. It's negative value.
-
-#ifdef WPA_SUPPLICANT_SUPPORT
-    BOOLEAN             IEEE8021X;
-    BOOLEAN             IEEE8021x_required_keys;
-    CIPHER_KEY	        DesireSharedKey[4];	// Record user desired WEP keys
-    UCHAR               DesireSharedKeyId;
-
-    // 0: driver ignores wpa_supplicant
-    // 1: wpa_supplicant initiates scanning and AP selection
-    // 2: driver takes care of scanning, AP selection, and IEEE 802.11 association parameters
-    UCHAR               WpaSupplicantUP;
-	UCHAR				WpaSupplicantScanCount;
-	BOOLEAN				bRSN_IE_FromWpaSupplicant;
-#endif // WPA_SUPPLICANT_SUPPORT //
-
-    CHAR                dev_name[16];
-    USHORT              OriDevType;
-
-    BOOLEAN             bTGnWifiTest;
-	BOOLEAN			    bScanReqIsFromWebUI;
-
-	HTTRANSMIT_SETTING				HTPhyMode, MaxHTPhyMode, MinHTPhyMode;// For transmit phy setting in TXWI.
-	DESIRED_TRANSMIT_SETTING	DesiredTransmitSetting;
-	RT_HT_PHY_INFO					DesiredHtPhyInfo;
-	BOOLEAN							bAutoTxRateSwitch;
-
-#ifdef RTMP_MAC_PCI
-    UCHAR       BBPR3;
-	// PS Control has 2 meanings for advanced power save function.
-	// 1. EnablePSinIdle : When no connection, always radio off except need to do site survey.
-	// 2. EnableNewPS  : will save more current in sleep or radio off mode.
-	PS_CONTROL				PSControl;
-#endif // RTMP_MAC_PCI //
-
-#ifdef EXT_BUILD_CHANNEL_LIST
-	UCHAR				IEEE80211dClientMode;
-	UCHAR				StaOriCountryCode[3];
-	UCHAR				StaOriGeography;
-#endif // EXT_BUILD_CHANNEL_LIST //
-
-
-
-	BOOLEAN				bAutoConnectByBssid;
-	ULONG				BeaconLostTime;	// seconds
-	BOOLEAN			bForceTxBurst;          // 1: force enble TX PACKET BURST, 0: disable
-} STA_ADMIN_CONFIG, *PSTA_ADMIN_CONFIG;
-
-// This data structure keep the current active BSS/IBSS's configuration that this STA
-// had agreed upon joining the network. Which means these parameters are usually decided
-// by the BSS/IBSS creator instead of user configuration. Data in this data structurre
-// is valid only when either ADHOC_ON(pAd) or INFRA_ON(pAd) is TRUE.
-// Normally, after SCAN or failed roaming attempts, we need to recover back to
-// the current active settings.
-typedef struct _STA_ACTIVE_CONFIG {
-	USHORT      Aid;
-	USHORT      AtimWin;                // in kusec; IBSS parameter set element
-	USHORT      CapabilityInfo;
-	USHORT      CfpMaxDuration;
-	USHORT      CfpPeriod;
-
-	// Copy supported rate from desired AP's beacon. We are trying to match
-	// AP's supported and extended rate settings.
-	UCHAR       SupRate[MAX_LEN_OF_SUPPORTED_RATES];
-	UCHAR       ExtRate[MAX_LEN_OF_SUPPORTED_RATES];
-	UCHAR       SupRateLen;
-	UCHAR       ExtRateLen;
-	// Copy supported ht from desired AP's beacon. We are trying to match
-	RT_HT_PHY_INFO		SupportedPhyInfo;
-	RT_HT_CAPABILITY	SupportedHtPhy;
-} STA_ACTIVE_CONFIG, *PSTA_ACTIVE_CONFIG;
-
-
-
-#endif // CONFIG_STA_SUPPORT //
-
-
-
-typedef struct _MAC_TABLE_ENTRY {
-	//Choose 1 from ValidAsWDS and ValidAsCLI  to validize.
-	BOOLEAN		ValidAsCLI;		// Sta mode, set this TRUE after Linkup,too.
-	BOOLEAN		ValidAsWDS;	// This is WDS Entry. only for AP mode.
-	BOOLEAN		ValidAsApCli;   //This is a AP-Client entry, only for AP mode which enable AP-Client functions.
-	BOOLEAN		ValidAsMesh;
-	BOOLEAN		ValidAsDls;	// This is DLS Entry. only for STA mode.
-	BOOLEAN		isCached;
-	BOOLEAN		bIAmBadAtheros;	// Flag if this is Atheros chip that has IOT problem.  We need to turn on RTS/CTS protection.
-
-	UCHAR		EnqueueEapolStartTimerRunning;  // Enqueue EAPoL-Start for triggering EAP SM
-	//jan for wpa
-	// record which entry revoke MIC Failure , if it leaves the BSS itself, AP won't update aMICFailTime MIB
-	UCHAR           CMTimerRunning;
-	UCHAR           apidx;			// MBSS number
-	UCHAR           RSNIE_Len;
-	UCHAR           RSN_IE[MAX_LEN_OF_RSNIE];
-	UCHAR           ANonce[LEN_KEY_DESC_NONCE];
-	UCHAR           SNonce[LEN_KEY_DESC_NONCE];
-	UCHAR           R_Counter[LEN_KEY_DESC_REPLAY];
-	UCHAR           PTK[64];
-	UCHAR           ReTryCounter;
-	RALINK_TIMER_STRUCT                 RetryTimer;
-	RALINK_TIMER_STRUCT					EnqueueStartForPSKTimer;	// A timer which enqueue EAPoL-Start for triggering PSK SM
-	NDIS_802_11_AUTHENTICATION_MODE     AuthMode;   // This should match to whatever microsoft defined
-	NDIS_802_11_WEP_STATUS              WepStatus;
-	NDIS_802_11_WEP_STATUS              GroupKeyWepStatus;
-	AP_WPA_STATE    WpaState;
-	GTK_STATE       GTKState;
-	USHORT          PortSecured;
-	NDIS_802_11_PRIVACY_FILTER  PrivacyFilter;      // PrivacyFilter enum for 802.1X
-	CIPHER_KEY      PairwiseKey;
-	PVOID           pAd;
-	INT				PMKID_CacheIdx;
-	UCHAR			PMKID[LEN_PMKID];
-
-
-	UCHAR           Addr[MAC_ADDR_LEN];
-	UCHAR           PsMode;
-	SST             Sst;
-	AUTH_STATE      AuthState; // for SHARED KEY authentication state machine used only
-	BOOLEAN			IsReassocSta;	// Indicate whether this is a reassociation procedure
-	USHORT          Aid;
-	USHORT          CapabilityInfo;
-	UCHAR           LastRssi;
-	ULONG           NoDataIdleCount;
-	UINT16			StationKeepAliveCount; // unit: second
-	ULONG           PsQIdleCount;
-	QUEUE_HEADER    PsQueue;
-
-	UINT32			StaConnectTime;		// the live time of this station since associated with AP
-
-
-#ifdef DOT11_N_SUPPORT
-	BOOLEAN			bSendBAR;
-	USHORT			NoBADataCountDown;
-
-	UINT32			CachedBuf[16];		// UINT (4 bytes) for alignment
-	UINT			TxBFCount; // 3*3
-#endif // DOT11_N_SUPPORT //
-	UINT			FIFOCount;
-	UINT			DebugFIFOCount;
-	UINT			DebugTxCount;
-    BOOLEAN			bDlsInit;
-
-
-//====================================================
-//WDS entry needs these
-// if ValidAsWDS==TRUE, MatchWDSTabIdx is the index in WdsTab.MacTab
-	UINT			MatchWDSTabIdx;
-	UCHAR           MaxSupportedRate;
-	UCHAR           CurrTxRate;
-	UCHAR           CurrTxRateIndex;
-	// to record the each TX rate's quality. 0 is best, the bigger the worse.
-	USHORT          TxQuality[MAX_STEP_OF_TX_RATE_SWITCH];
-//	USHORT          OneSecTxOkCount;
-	UINT32			OneSecTxNoRetryOkCount;
-	UINT32          OneSecTxRetryOkCount;
-	UINT32          OneSecTxFailCount;
-	UINT32			ContinueTxFailCnt;
-	UINT32          CurrTxRateStableTime; // # of second in current TX rate
-	UCHAR           TxRateUpPenalty;      // extra # of second penalty due to last unstable condition
-#ifdef WDS_SUPPORT
-	BOOLEAN		LockEntryTx; // TRUE = block to WDS Entry traffic, FALSE = not.
-	UINT32		TimeStamp_toTxRing;
-#endif // WDS_SUPPORT //
-
-//====================================================
-
-
-
-#ifdef CONFIG_STA_SUPPORT
-#ifdef QOS_DLS_SUPPORT
-	UINT			MatchDlsEntryIdx; // indicate the index in pAd->StaCfg.DLSEntry
-#endif // QOS_DLS_SUPPORT //
-#endif // CONFIG_STA_SUPPORT //
-
-	BOOLEAN         fNoisyEnvironment;
-	BOOLEAN			fLastSecAccordingRSSI;
-	UCHAR           LastSecTxRateChangeAction; // 0: no change, 1:rate UP, 2:rate down
-	CHAR			LastTimeTxRateChangeAction; //Keep last time value of LastSecTxRateChangeAction
-	ULONG			LastTxOkCount;
-	UCHAR           PER[MAX_STEP_OF_TX_RATE_SWITCH];
-
-	// a bitmap of BOOLEAN flags. each bit represent an operation status of a particular
-	// BOOLEAN control, either ON or OFF. These flags should always be accessed via
-	// CLIENT_STATUS_TEST_FLAG(), CLIENT_STATUS_SET_FLAG(), CLIENT_STATUS_CLEAR_FLAG() macros.
-	// see fOP_STATUS_xxx in RTMP_DEF.C for detail bit definition. fCLIENT_STATUS_AMSDU_INUSED
-	ULONG           ClientStatusFlags;
-
-	HTTRANSMIT_SETTING	HTPhyMode, MaxHTPhyMode, MinHTPhyMode;// For transmit phy setting in TXWI.
-
-#ifdef DOT11_N_SUPPORT
-	// HT EWC MIMO-N used parameters
-	USHORT		RXBAbitmap;	// fill to on-chip  RXWI_BA_BITMASK in 8.1.3RX attribute entry format
-	USHORT		TXBAbitmap;	// This bitmap as originator, only keep in software used to mark AMPDU bit in TXWI
-	USHORT		TXAutoBAbitmap;
-	USHORT		BADeclineBitmap;
-	USHORT		BARecWcidArray[NUM_OF_TID];	// The mapping wcid of recipient session. if RXBAbitmap bit is masked
-	USHORT		BAOriWcidArray[NUM_OF_TID]; // The mapping wcid of originator session. if TXBAbitmap bit is masked
-	USHORT		BAOriSequence[NUM_OF_TID]; // The mapping wcid of originator session. if TXBAbitmap bit is masked
-
-	// 802.11n features.
-	UCHAR		MpduDensity;
-	UCHAR		MaxRAmpduFactor;
-	UCHAR		AMsduSize;
-	UCHAR		MmpsMode;	// MIMO power save more.
-
-	HT_CAPABILITY_IE		HTCapability;
-
-#ifdef DOT11N_DRAFT3
-	UCHAR		BSS2040CoexistenceMgmtSupport;
-#endif // DOT11N_DRAFT3 //
-#endif // DOT11_N_SUPPORT //
-
-	BOOLEAN		bAutoTxRateSwitch;
-
-	UCHAR       RateLen;
-	struct _MAC_TABLE_ENTRY *pNext;
-    USHORT      TxSeq[NUM_OF_TID];
-	USHORT		NonQosDataSeq;
-
-	RSSI_SAMPLE	RssiSample;
-
-	UINT32			TXMCSExpected[16];
-	UINT32			TXMCSSuccessful[16];
-	UINT32			TXMCSFailed[16];
-	UINT32			TXMCSAutoFallBack[16][16];
-
-#ifdef CONFIG_STA_SUPPORT
-	ULONG			LastBeaconRxTime;
-#endif // CONFIG_STA_SUPPORT //
-
-
-
-	ULONG AssocDeadLine;
-
-
-
-	ULONG ChannelQuality;  // 0..100, Channel Quality Indication for Roaming
-
-} MAC_TABLE_ENTRY, *PMAC_TABLE_ENTRY;
-
-typedef struct _MAC_TABLE {
-	USHORT			Size;
-	MAC_TABLE_ENTRY *Hash[HASH_TABLE_SIZE];
-	MAC_TABLE_ENTRY Content[MAX_LEN_OF_MAC_TABLE];
-	QUEUE_HEADER    McastPsQueue;
-	ULONG           PsQIdleCount;
-	BOOLEAN         fAnyStationInPsm;
-	BOOLEAN         fAnyStationBadAtheros;	// Check if any Station is atheros 802.11n Chip.  We need to use RTS/CTS with Atheros 802,.11n chip.
-	BOOLEAN			fAnyTxOPForceDisable;	// Check if it is necessary to disable BE TxOP
-	BOOLEAN			fAllStationAsRalink;	// Check if all stations are ralink-chipset
-#ifdef DOT11_N_SUPPORT
-	BOOLEAN         fAnyStationIsLegacy;	// Check if I use legacy rate to transmit to my BSS Station/
-	BOOLEAN         fAnyStationNonGF;		// Check if any Station can't support GF.
-	BOOLEAN         fAnyStation20Only;		// Check if any Station can't support GF.
-	BOOLEAN			fAnyStationMIMOPSDynamic; // Check if any Station is MIMO Dynamic
-	BOOLEAN         fAnyBASession;   // Check if there is BA session.  Force turn on RTS/CTS
-//2008/10/28: KH add to support Antenna power-saving of AP<--
-//2008/10/28: KH add to support Antenna power-saving of AP-->
-#endif // DOT11_N_SUPPORT //
-} MAC_TABLE, *PMAC_TABLE;
-
-
-
-
-#ifdef BLOCK_NET_IF
-typedef struct _BLOCK_QUEUE_ENTRY
-{
-	BOOLEAN SwTxQueueBlockFlag;
-	LIST_HEADER NetIfList;
-} BLOCK_QUEUE_ENTRY, *PBLOCK_QUEUE_ENTRY;
-#endif // BLOCK_NET_IF //
-
-
-struct wificonf
-{
-	BOOLEAN	bShortGI;
-	BOOLEAN bGreenField;
-};
-
-
-typedef struct _RTMP_DEV_INFO_
-{
-	UCHAR			chipName[16];
-	RTMP_INF_TYPE	infType;
-}RTMP_DEV_INFO;
-
-
-#ifdef DBG_DIAGNOSE
-#define DIAGNOSE_TIME	10   // 10 sec
-typedef struct _RtmpDiagStrcut_
-{	// Diagnosis Related element
-	unsigned char		inited;
-	unsigned char	qIdx;
-	unsigned char	ArrayStartIdx;
-	unsigned char		ArrayCurIdx;
-	// Tx Related Count
-	USHORT			TxDataCnt[DIAGNOSE_TIME];
-	USHORT			TxFailCnt[DIAGNOSE_TIME];
-//	USHORT			TxDescCnt[DIAGNOSE_TIME][16];		// TxDesc queue length in scale of 0~14, >=15
-	USHORT			TxDescCnt[DIAGNOSE_TIME][24]; // 3*3	// TxDesc queue length in scale of 0~14, >=15
-//	USHORT			TxMcsCnt[DIAGNOSE_TIME][16];			// TxDate MCS Count in range from 0 to 15, step in 1.
-	USHORT			TxMcsCnt[DIAGNOSE_TIME][24]; // 3*3
-	USHORT			TxSWQueCnt[DIAGNOSE_TIME][9];		// TxSwQueue length in scale of 0, 1, 2, 3, 4, 5, 6, 7, >=8
-
-	USHORT			TxAggCnt[DIAGNOSE_TIME];
-	USHORT			TxNonAggCnt[DIAGNOSE_TIME];
-//	USHORT			TxAMPDUCnt[DIAGNOSE_TIME][16];		// 10 sec, TxDMA APMDU Aggregation count in range from 0 to 15, in setp of 1.
-	USHORT			TxAMPDUCnt[DIAGNOSE_TIME][24]; // 3*3 // 10 sec, TxDMA APMDU Aggregation count in range from 0 to 15, in setp of 1.
-	USHORT			TxRalinkCnt[DIAGNOSE_TIME];			// TxRalink Aggregation Count in 1 sec scale.
-	USHORT			TxAMSDUCnt[DIAGNOSE_TIME];			// TxAMSUD Aggregation Count in 1 sec scale.
-
-	// Rx Related Count
-	USHORT			RxDataCnt[DIAGNOSE_TIME];			// Rx Total Data count.
-	USHORT			RxCrcErrCnt[DIAGNOSE_TIME];
-//	USHORT			RxMcsCnt[DIAGNOSE_TIME][16];		// Rx MCS Count in range from 0 to 15, step in 1.
-	USHORT			RxMcsCnt[DIAGNOSE_TIME][24]; // 3*3
-}RtmpDiagStruct;
-#endif // DBG_DIAGNOSE //
-
-
-struct _RTMP_CHIP_OP_
-{
-	/*  Calibration access related callback functions */
-	int (*eeinit)(RTMP_ADAPTER *pAd);										/* int (*eeinit)(RTMP_ADAPTER *pAd); */
-	int (*eeread)(RTMP_ADAPTER *pAd, USHORT offset, PUSHORT pValue);				/* int (*eeread)(RTMP_ADAPTER *pAd, int offset, PUSHORT pValue); */
-	int (*eewrite)(RTMP_ADAPTER *pAd, USHORT offset, USHORT value);;				/* int (*eewrite)(RTMP_ADAPTER *pAd, int offset, USHORT value); */
-
-	/* MCU related callback functions */
-	int (*loadFirmware)(RTMP_ADAPTER *pAd);								/* int (*loadFirmware)(RTMP_ADAPTER *pAd); */
-	int (*eraseFirmware)(RTMP_ADAPTER *pAd);								/* int (*eraseFirmware)(RTMP_ADAPTER *pAd); */
-	int (*sendCommandToMcu)(RTMP_ADAPTER *pAd, UCHAR cmd, UCHAR token, UCHAR arg0, UCHAR arg1);;	/* int (*sendCommandToMcu)(RTMP_ADAPTER *pAd, UCHAR cmd, UCHAR token, UCHAR arg0, UCHAR arg1); */
-
-	/* RF access related callback functions */
-	REG_PAIR *pRFRegTable;
-	void (*AsicRfInit)(RTMP_ADAPTER *pAd);
-	void (*AsicRfTurnOn)(RTMP_ADAPTER *pAd);
-	void (*AsicRfTurnOff)(RTMP_ADAPTER *pAd);
-	void (*AsicReverseRfFromSleepMode)(RTMP_ADAPTER *pAd);
-	void (*AsicHaltAction)(RTMP_ADAPTER *pAd);
-};
-
-
-//
-//  The miniport adapter structure
-//
-struct _RTMP_ADAPTER
-{
-	PVOID					OS_Cookie;	// save specific structure relative to OS
-	PNET_DEV				net_dev;
-	ULONG					VirtualIfCnt;
-
-	RTMP_CHIP_OP			chipOps;
-	USHORT					ThisTbttNumToNextWakeUp;
-
-#ifdef INF_AMAZON_PPA
-	UINT32  g_if_id;
-	BOOLEAN	PPAEnable;
-	PPA_DIRECTPATH_CB       *pDirectpathCb;
-#endif // INF_AMAZON_PPA //
-
-#ifdef RTMP_MAC_PCI
-/*****************************************************************************************/
-/*      PCI related parameters																  */
-/*****************************************************************************************/
-	PUCHAR                  CSRBaseAddress;     // PCI MMIO Base Address, all access will use
-	unsigned int			irq_num;
-
-	USHORT		            LnkCtrlBitMask;
-	USHORT		            RLnkCtrlConfiguration;
-	USHORT                  RLnkCtrlOffset;
-	USHORT		            HostLnkCtrlConfiguration;
-	USHORT                  HostLnkCtrlOffset;
-	USHORT		            PCIePowerSaveLevel;
-	ULONG				Rt3xxHostLinkCtrl;	// USed for 3090F chip
-	ULONG				Rt3xxRalinkLinkCtrl;	// USed for 3090F chip
-	USHORT				DeviceID;           // Read from PCI config
-	ULONG				AccessBBPFailCount;
-	BOOLEAN					bPCIclkOff;						// flag that indicate if the PICE power status in Configuration SPace..
-	BOOLEAN					bPCIclkOffDisableTx;			//
-
-	BOOLEAN					brt30xxBanMcuCmd;	//when = 0xff means all commands are ok to set .
-	BOOLEAN					b3090ESpecialChip;	//3090E special chip that write EEPROM 0x24=0x9280.
-	ULONG					CheckDmaBusyCount;  // Check Interrupt Status Register Count.
-
-	UINT					int_enable_reg;
-	UINT					int_disable_mask;
-	UINT					int_pending;
-
-
-	RTMP_DMABUF             TxBufSpace[NUM_OF_TX_RING]; // Shared memory of all 1st pre-allocated TxBuf associated with each TXD
-	RTMP_DMABUF             RxDescRing;                 // Shared memory for RX descriptors
-	RTMP_DMABUF             TxDescRing[NUM_OF_TX_RING];	// Shared memory for Tx descriptors
-	RTMP_TX_RING            TxRing[NUM_OF_TX_RING];		// AC0~4 + HCCA
-#endif // RTMP_MAC_PCI //
-
-
-	NDIS_SPIN_LOCK		irq_lock;
-	UCHAR				irq_disabled;
-
-
-/*****************************************************************************************/
-/*      RBUS related parameters																  */
-/*****************************************************************************************/
-
-
-/*****************************************************************************************/
-/*      Both PCI/USB related parameters														  */
-/*****************************************************************************************/
-	//RTMP_DEV_INFO			chipInfo;
-	RTMP_INF_TYPE			infType;
-
-/*****************************************************************************************/
-/*      Driver Mgmt related parameters														  */
-/*****************************************************************************************/
-	RTMP_OS_TASK			mlmeTask;
-#ifdef RTMP_TIMER_TASK_SUPPORT
-	// If you want use timer task to handle the timer related jobs, enable this.
-	RTMP_TIMER_TASK_QUEUE	TimerQ;
-	NDIS_SPIN_LOCK			TimerQLock;
-	RTMP_OS_TASK			timerTask;
-#endif // RTMP_TIMER_TASK_SUPPORT //
-
-
-/*****************************************************************************************/
-/*      Tx related parameters                                                           */
-/*****************************************************************************************/
-	BOOLEAN                 DeQueueRunning[NUM_OF_TX_RING];  // for ensuring RTUSBDeQueuePacket get call once
-	NDIS_SPIN_LOCK          DeQueueLock[NUM_OF_TX_RING];
-
-
-	// resource for software backlog queues
-	QUEUE_HEADER            TxSwQueue[NUM_OF_TX_RING];  // 4 AC + 1 HCCA
-	NDIS_SPIN_LOCK          TxSwQueueLock[NUM_OF_TX_RING];	// TxSwQueue spinlock
-
-	RTMP_DMABUF             MgmtDescRing;			// Shared memory for MGMT descriptors
-	RTMP_MGMT_RING          MgmtRing;
-	NDIS_SPIN_LOCK          MgmtRingLock;			// Prio Ring spinlock
-
-
-/*****************************************************************************************/
-/*      Rx related parameters                                                           */
-/*****************************************************************************************/
-
-#ifdef RTMP_MAC_PCI
-	RTMP_RX_RING            RxRing;
-	NDIS_SPIN_LOCK          RxRingLock;                 // Rx Ring spinlock
-#ifdef RT3090
-	NDIS_SPIN_LOCK          McuCmdLock;              //MCU Command Queue spinlock
-#endif // RT3090 //
-#endif // RTMP_MAC_PCI //
-
-
-
-/*****************************************************************************************/
-/*      ASIC related parameters                                                          */
-/*****************************************************************************************/
-	UINT32			MACVersion;		// MAC version. Record rt2860C(0x28600100) or rt2860D (0x28600101)..
-
-	// ---------------------------
-	// E2PROM
-	// ---------------------------
-	ULONG				EepromVersion;          // byte 0: version, byte 1: revision, byte 2~3: unused
-	ULONG				FirmwareVersion;        // byte 0: Minor version, byte 1: Major version, otherwise unused.
-	USHORT				EEPROMDefaultValue[NUM_EEPROM_BBP_PARMS];
-	UCHAR				EEPROMAddressNum;       // 93c46=6  93c66=8
-	BOOLEAN				EepromAccess;
-	UCHAR				EFuseTag;
-
-
-	// ---------------------------
-	// BBP Control
-	// ---------------------------
-#ifdef MERGE_ARCH_TEAM
-	UCHAR                   BbpWriteLatch[256];     // record last BBP register value written via BBP_IO_WRITE/BBP_IO_WRITE_VY_REG_ID
-#else
-	UCHAR                   BbpWriteLatch[140];     // record last BBP register value written via BBP_IO_WRITE/BBP_IO_WRITE_VY_REG_ID
-#endif // MERGE_ARCH_TEAM //
-	CHAR					BbpRssiToDbmDelta;		// change from UCHAR to CHAR for high power
-	BBP_R66_TUNING          BbpTuning;
-
-	// ----------------------------
-	// RFIC control
-	// ----------------------------
-	UCHAR                   RfIcType;       // RFIC_xxx
-	ULONG                   RfFreqOffset;   // Frequency offset for channel switching
-	RTMP_RF_REGS            LatchRfRegs;    // latch th latest RF programming value since RF IC doesn't support READ
-
-	EEPROM_ANTENNA_STRUC    Antenna;                            // Since ANtenna definition is different for a & g. We need to save it for future reference.
-	EEPROM_NIC_CONFIG2_STRUC    NicConfig2;
-
-	// This soft Rx Antenna Diversity mechanism is used only when user set
-	// RX Antenna = DIVERSITY ON
-	SOFT_RX_ANT_DIVERSITY   RxAnt;
-
-	UCHAR                   RFProgSeq;
-	CHANNEL_TX_POWER        TxPower[MAX_NUM_OF_CHANNELS];       // Store Tx power value for all channels.
-	CHANNEL_TX_POWER        ChannelList[MAX_NUM_OF_CHANNELS];   // list all supported channels for site survey
-	CHANNEL_11J_TX_POWER    TxPower11J[MAX_NUM_OF_11JCHANNELS];       // 802.11j channel and bw
-	CHANNEL_11J_TX_POWER    ChannelList11J[MAX_NUM_OF_11JCHANNELS];   // list all supported channels for site survey
-
-	UCHAR                   ChannelListNum;                     // number of channel in ChannelList[]
-	UCHAR					Bbp94;
-	BOOLEAN					BbpForCCK;
-	ULONG		Tx20MPwrCfgABand[5];
-	ULONG		Tx20MPwrCfgGBand[5];
-	ULONG		Tx40MPwrCfgABand[5];
-	ULONG		Tx40MPwrCfgGBand[5];
-
-	BOOLEAN     bAutoTxAgcA;                // Enable driver auto Tx Agc control
-	UCHAR	    TssiRefA;					// Store Tssi reference value as 25 temperature.
-	UCHAR	    TssiPlusBoundaryA[5];		// Tssi boundary for increase Tx power to compensate.
-	UCHAR	    TssiMinusBoundaryA[5];		// Tssi boundary for decrease Tx power to compensate.
-	UCHAR	    TxAgcStepA;					// Store Tx TSSI delta increment / decrement value
-	CHAR		TxAgcCompensateA;			// Store the compensation (TxAgcStep * (idx-1))
-
-	BOOLEAN     bAutoTxAgcG;                // Enable driver auto Tx Agc control
-	UCHAR	    TssiRefG;					// Store Tssi reference value as 25 temperature.
-	UCHAR	    TssiPlusBoundaryG[5];		// Tssi boundary for increase Tx power to compensate.
-	UCHAR	    TssiMinusBoundaryG[5];		// Tssi boundary for decrease Tx power to compensate.
-	UCHAR	    TxAgcStepG;					// Store Tx TSSI delta increment / decrement value
-	CHAR		TxAgcCompensateG;			// Store the compensation (TxAgcStep * (idx-1))
-
-	CHAR		BGRssiOffset0;				// Store B/G RSSI#0 Offset value on EEPROM 0x46h
-	CHAR		BGRssiOffset1;				// Store B/G RSSI#1 Offset value
-	CHAR		BGRssiOffset2;				// Store B/G RSSI#2 Offset value
-
-	CHAR		ARssiOffset0;				// Store A RSSI#0 Offset value on EEPROM 0x4Ah
-	CHAR		ARssiOffset1;				// Store A RSSI#1 Offset value
-	CHAR		ARssiOffset2;				// Store A RSSI#2 Offset value
-
-	CHAR		BLNAGain;					// Store B/G external LNA#0 value on EEPROM 0x44h
-	CHAR		ALNAGain0;					// Store A external LNA#0 value for ch36~64
-	CHAR		ALNAGain1;					// Store A external LNA#1 value for ch100~128
-	CHAR		ALNAGain2;					// Store A external LNA#2 value for ch132~165
-#ifdef RT30xx
-	// for 3572
-	UCHAR		Bbp25;
-	UCHAR		Bbp26;
-
-	UCHAR		TxMixerGain24G;				// Tx mixer gain value from EEPROM to improve Tx EVM / Tx DAC, 2.4G
-	UCHAR		TxMixerGain5G;
-#endif // RT30xx //
-	// ----------------------------
-	// LED control
-	// ----------------------------
-	MCU_LEDCS_STRUC		LedCntl;
-	USHORT				Led1;	// read from EEPROM 0x3c
-	USHORT				Led2;	// EEPROM 0x3e
-	USHORT				Led3;	// EEPROM 0x40
-	UCHAR				LedIndicatorStrength;
-	UCHAR				RssiSingalstrengthOffet;
-	BOOLEAN				bLedOnScanning;
-	UCHAR				LedStatus;
-
-/*****************************************************************************************/
-/*      802.11 related parameters                                                        */
-/*****************************************************************************************/
-	// outgoing BEACON frame buffer and corresponding TXD
-	TXWI_STRUC			BeaconTxWI;
-	PUCHAR						BeaconBuf;
-	USHORT						BeaconOffset[HW_BEACON_MAX_COUNT];
-
-	// pre-build PS-POLL and NULL frame upon link up. for efficiency purpose.
-	PSPOLL_FRAME			PsPollFrame;
-	HEADER_802_11			NullFrame;
-
-
-
-
-//=========AP===========
-
-
-//=======STA===========
-#ifdef CONFIG_STA_SUPPORT
-	// -----------------------------------------------
-	// STA specific configuration & operation status
-	// used only when pAd->OpMode == OPMODE_STA
-	// -----------------------------------------------
-	STA_ADMIN_CONFIG        StaCfg;		// user desired settings
-	STA_ACTIVE_CONFIG       StaActive;		// valid only when ADHOC_ON(pAd) || INFRA_ON(pAd)
-	CHAR                    nickname[IW_ESSID_MAX_SIZE+1]; // nickname, only used in the iwconfig i/f
-	NDIS_MEDIA_STATE        PreMediaState;
-#endif // CONFIG_STA_SUPPORT //
-
-//=======Common===========
-	// OP mode: either AP or STA
-	UCHAR                   OpMode;                     // OPMODE_STA, OPMODE_AP
-
-	NDIS_MEDIA_STATE        IndicateMediaState;			// Base on Indication state, default is NdisMediaStateDisConnected
-
-
-	/* MAT related parameters */
-
-	// configuration: read from Registry & E2PROM
-	BOOLEAN                 bLocalAdminMAC;             // Use user changed MAC
-	UCHAR                   PermanentAddress[MAC_ADDR_LEN];    // Factory default MAC address
-	UCHAR                   CurrentAddress[MAC_ADDR_LEN];      // User changed MAC address
-
-	// ------------------------------------------------------
-	// common configuration to both OPMODE_STA and OPMODE_AP
-	// ------------------------------------------------------
-	COMMON_CONFIG           CommonCfg;
-	MLME_STRUCT             Mlme;
-
-	// AP needs those vaiables for site survey feature.
-	MLME_AUX                MlmeAux;           // temporary settings used during MLME state machine
-	BSS_TABLE               ScanTab;           // store the latest SCAN result
-
-	//About MacTab, the sta driver will use #0 and #1 for multicast and AP.
-	MAC_TABLE                 MacTab;     // ASIC on-chip WCID entry table.  At TX, ASIC always use key according to this on-chip table.
-	NDIS_SPIN_LOCK          MacTabLock;
-
-#ifdef DOT11_N_SUPPORT
-	BA_TABLE			BATable;
-	NDIS_SPIN_LOCK          BATabLock;
-	RALINK_TIMER_STRUCT RECBATimer;
-#endif // DOT11_N_SUPPORT //
-
-	// encryption/decryption KEY tables
-	CIPHER_KEY              SharedKey[MAX_MBSSID_NUM][4]; // STA always use SharedKey[BSS0][0..3]
-
-	// RX re-assembly buffer for fragmentation
-	FRAGMENT_FRAME          FragFrame;                  // Frame storage for fragment frame
-
-	// various Counters
-	COUNTER_802_3           Counters8023;               // 802.3 counters
-	COUNTER_802_11          WlanCounters;               // 802.11 MIB counters
-	COUNTER_RALINK          RalinkCounters;             // Ralink propriety counters
-	COUNTER_DRS             DrsCounters;                // counters for Dynamic TX Rate Switching
-	PRIVATE_STRUC           PrivateInfo;                // Private information & counters
-
-	// flags, see fRTMP_ADAPTER_xxx flags
-	ULONG                   Flags;                      // Represent current device status
-	ULONG                   PSFlags;                    // Power Save operation flag.
-
-	// current TX sequence #
-	USHORT                  Sequence;
-
-	// Control disconnect / connect event generation
-	//+++Didn't used anymore
-	ULONG                   LinkDownTime;
-	//---
-	ULONG                   LastRxRate;
-	ULONG                   LastTxRate;
-	//+++Used only for Station
-	BOOLEAN                 bConfigChanged;         // Config Change flag for the same SSID setting
-	//---
-
-	ULONG                   ExtraInfo;              // Extra information for displaying status
-	ULONG                   SystemErrorBitmap;      // b0: E2PROM version error
-
-	//+++Didn't used anymore
-	ULONG                   MacIcVersion;           // MAC/BBP serial interface issue solved after ver.D
-	//---
-
-	// ---------------------------
-	// System event log
-	// ---------------------------
-	RT_802_11_EVENT_TABLE   EventTab;
-
-
-	BOOLEAN		HTCEnable;
-
-	/*****************************************************************************************/
-	/*      Statistic related parameters                                                     */
-	/*****************************************************************************************/
-
-	BOOLEAN						bUpdateBcnCntDone;
-	ULONG						watchDogMacDeadlock;	// prevent MAC/BBP into deadlock condition
-	// ----------------------------
-	// DEBUG paramerts
-	// ----------------------------
-	//ULONG		DebugSetting[4];
-	BOOLEAN		bBanAllBaSetup;
-	BOOLEAN		bPromiscuous;
-
-	// ----------------------------
-	// rt2860c emulation-use Parameters
-	// ----------------------------
-	//ULONG		rtsaccu[30];
-	//ULONG		ctsaccu[30];
-	//ULONG		cfendaccu[30];
-	//ULONG		bacontent[16];
-	//ULONG		rxint[RX_RING_SIZE+1];
-	//UCHAR		rcvba[60];
-	BOOLEAN		bLinkAdapt;
-	BOOLEAN		bForcePrintTX;
-	BOOLEAN		bForcePrintRX;
-	//BOOLEAN		bDisablescanning;		//defined in RT2870 USB
-	BOOLEAN		bStaFifoTest;
-	BOOLEAN		bProtectionTest;
-	/*
-	BOOLEAN		bHCCATest;
-	BOOLEAN		bGenOneHCCA;
-	*/
-	BOOLEAN		bBroadComHT;
-	//+++Following add from RT2870 USB.
-	ULONG		BulkOutReq;
-	ULONG		BulkOutComplete;
-	ULONG		BulkOutCompleteOther;
-	ULONG		BulkOutCompleteCancel;	// seems not use now?
-	ULONG		BulkInReq;
-	ULONG		BulkInComplete;
-	ULONG		BulkInCompleteFail;
-	//---
-
-    struct wificonf			WIFItestbed;
-
-#ifdef RALINK_ATE
-	ATE_INFO				ate;
-#endif // RALINK_ATE //
-
-#ifdef DOT11_N_SUPPORT
-	struct reordering_mpdu_pool mpdu_blk_pool;
-#endif // DOT11_N_SUPPORT //
-
-	ULONG					OneSecondnonBEpackets;		// record non BE packets per second
-
-#ifdef LINUX
-#if WIRELESS_EXT >= 12
-    struct iw_statistics    iw_stats;
-#endif
-
-	struct net_device_stats	stats;
-#endif // LINUX //
-
-#ifdef BLOCK_NET_IF
-	BLOCK_QUEUE_ENTRY		blockQueueTab[NUM_OF_TX_RING];
-#endif // BLOCK_NET_IF //
-
-
-
-#ifdef MULTIPLE_CARD_SUPPORT
-	INT32					MC_RowID;
-	STRING					MC_FileName[256];
-#endif // MULTIPLE_CARD_SUPPORT //
-
-	ULONG					TbttTickCount;
-#ifdef PCI_MSI_SUPPORT
-	BOOLEAN					HaveMsi;
-#endif // PCI_MSI_SUPPORT //
-
-
-	UCHAR					is_on;
-
-#define TIME_BASE			(1000000/OS_HZ)
-#define TIME_ONE_SECOND		(1000000/TIME_BASE)
-	UCHAR					flg_be_adjust;
-	ULONG					be_adjust_last_time;
-
-#ifdef NINTENDO_AP
-	NINDO_CTRL_BLOCK		nindo_ctrl_block;
-#endif // NINTENDO_AP //
-
-
-#ifdef IKANOS_VX_1X0
-	struct IKANOS_TX_INFO	IkanosTxInfo;
-	struct IKANOS_TX_INFO	IkanosRxInfo[MAX_MBSSID_NUM + MAX_WDS_ENTRY + MAX_APCLI_NUM + MAX_MESH_NUM];
-#endif // IKANOS_VX_1X0 //
-
-
-#ifdef DBG_DIAGNOSE
-	RtmpDiagStruct	DiagStruct;
-#endif // DBG_DIAGNOSE //
-
-
-	UINT8					FlgCtsEnabled;
-	UINT8					PM_FlgSuspend;
-
-#ifdef RT30xx
-#ifdef RTMP_EFUSE_SUPPORT
-	BOOLEAN		bUseEfuse;
-	BOOLEAN		bEEPROMFile;
-	BOOLEAN		bFroceEEPROMBuffer;
-	UCHAR		EEPROMImage[1024];
-#endif // RTMP_EFUSE_SUPPORT //
-#endif // RT30xx //
-
-#ifdef CONFIG_STA_SUPPORT
-#endif // CONFIG_STA_SUPPORT //
-
-};
-
-
-
-#ifdef TONE_RADAR_DETECT_SUPPORT
-#define DELAYINTMASK		0x0013fffb
-#define INTMASK				0x0013fffb
-#define IndMask				0x0013fffc
-#define RadarInt			0x00100000
-#else
-#define DELAYINTMASK		0x0003fffb
-#define INTMASK				0x0003fffb
-#define IndMask				0x0003fffc
-#endif // TONE_RADAR_DETECT_SUPPORT //
-
-#define RxINT				0x00000005	// Delayed Rx or indivi rx
-#define TxDataInt			0x000000fa	// Delayed Tx or indivi tx
-#define TxMgmtInt			0x00000102	// Delayed Tx or indivi tx
-#define TxCoherent			0x00020000	// tx coherent
-#define RxCoherent			0x00010000	// rx coherent
-#define McuCommand			0x00000200	// mcu
-#define PreTBTTInt			0x00001000	// Pre-TBTT interrupt
-#define TBTTInt				0x00000800		// TBTT interrupt
-#define GPTimeOutInt			0x00008000		// GPtimeout interrupt
-#define AutoWakeupInt		0x00004000		// AutoWakeupInt interrupt
-#define FifoStaFullInt			0x00002000	//  fifo statistics full interrupt
-
-
-/***************************************************************************
-  *	Rx Path software control block related data structures
-  **************************************************************************/
-typedef struct _RX_BLK_
-{
-//	RXD_STRUC		RxD; // sample
-	RT28XX_RXD_STRUC	RxD;
-	PRXWI_STRUC			pRxWI;
-	PHEADER_802_11		pHeader;
-	PNDIS_PACKET		pRxPacket;
-	UCHAR				*pData;
-	USHORT				DataSize;
-	USHORT				Flags;
-	UCHAR				UserPriority;	// for calculate TKIP MIC using
-} RX_BLK;
-
-
-#define RX_BLK_SET_FLAG(_pRxBlk, _flag)		(_pRxBlk->Flags |= _flag)
-#define RX_BLK_TEST_FLAG(_pRxBlk, _flag)	(_pRxBlk->Flags & _flag)
-#define RX_BLK_CLEAR_FLAG(_pRxBlk, _flag)	(_pRxBlk->Flags &= ~(_flag))
-
-
-#define fRX_WDS			0x0001
-#define fRX_AMSDU		0x0002
-#define fRX_ARALINK		0x0004
-#define fRX_HTC			0x0008
-#define fRX_PAD			0x0010
-#define fRX_AMPDU		0x0020
-#define fRX_QOS			0x0040
-#define fRX_INFRA		0x0080
-#define fRX_EAP			0x0100
-#define fRX_MESH		0x0200
-#define fRX_APCLI		0x0400
-#define fRX_DLS			0x0800
-#define fRX_WPI			0x1000
-
-#define LENGTH_AMSDU_SUBFRAMEHEAD	14
-#define LENGTH_ARALINK_SUBFRAMEHEAD	14
-#define LENGTH_ARALINK_HEADER_FIELD	 2
-
-
-/***************************************************************************
-  *	Tx Path software control block related data structures
-  **************************************************************************/
-#define TX_UNKOWN_FRAME		0x00
-#define TX_MCAST_FRAME			0x01
-#define TX_LEGACY_FRAME		0x02
-#define TX_AMPDU_FRAME		0x04
-#define TX_AMSDU_FRAME		0x08
-#define TX_RALINK_FRAME		0x10
-#define TX_FRAG_FRAME			0x20
-
-
-//	Currently the sizeof(TX_BLK) is 148 bytes.
-typedef struct _TX_BLK_
-{
-	UCHAR				QueIdx;
-	UCHAR				TxFrameType;				// Indicate the Transmission type of the all frames in one batch
-	UCHAR				TotalFrameNum;				// Total frame number want to send-out in one batch
-	USHORT				TotalFragNum;				// Total frame fragments required in one batch
-	USHORT				TotalFrameLen;				// Total length of all frames want to send-out in one batch
-
-	QUEUE_HEADER		TxPacketList;
-	MAC_TABLE_ENTRY		*pMacEntry;					// NULL: packet with 802.11 RA field is multicast/broadcast address
-	HTTRANSMIT_SETTING	*pTransmit;
-
-	// Following structure used for the characteristics of a specific packet.
-	PNDIS_PACKET		pPacket;
-	PUCHAR				pSrcBufHeader;				// Reference to the head of sk_buff->data
-	PUCHAR				pSrcBufData;				// Reference to the sk_buff->data, will changed depends on hanlding progresss
-	UINT				SrcBufLen;					// Length of packet payload which not including Layer 2 header
-	PUCHAR				pExtraLlcSnapEncap;			// NULL means no extra LLC/SNAP is required
-	UCHAR				HeaderBuf[96];				// TempBuffer for TX_INFO + TX_WI + 802.11 Header + padding + AMSDU SubHeader + LLC/SNAP
-	UCHAR				MpduHeaderLen;				// 802.11 header length NOT including the padding
-	UCHAR				HdrPadLen;					// recording Header Padding Length;
-	UCHAR				apidx;						// The interface associated to this packet
-	UCHAR				Wcid;						// The MAC entry associated to this packet
-	UCHAR				UserPriority;				// priority class of packet
-	UCHAR				FrameGap;					// what kind of IFS this packet use
-	UCHAR				MpduReqNum;					// number of fragments of this frame
-	UCHAR				TxRate;						// TODO: Obsoleted? Should change to MCS?
-	UCHAR				CipherAlg;					// cipher alogrithm
-	PCIPHER_KEY			pKey;
-
-
-
-	USHORT				Flags;						//See following definitions for detail.
-
-	//YOU SHOULD NOT TOUCH IT! Following parameters are used for hardware-depended layer.
-	ULONG				Priv;						// Hardware specific value saved in here.
-
-} TX_BLK, *PTX_BLK;
-
-
-#define fTX_bRtsRequired			0x0001	// Indicate if need send RTS frame for protection. Not used in RT2860/RT2870.
-#define fTX_bAckRequired			0x0002	// the packet need ack response
-#define fTX_bPiggyBack			0x0004	// Legacy device use Piggback or not
-#define fTX_bHTRate				0x0008	// allow to use HT rate
-#define fTX_bForceNonQoS		0x0010	// force to transmit frame without WMM-QoS in HT mode
-#define fTX_bAllowFrag			0x0020	// allow to fragment the packet, A-MPDU, A-MSDU, A-Ralink is not allowed to fragment
-#define fTX_bMoreData			0x0040	// there are more data packets in PowerSave Queue
-#define fTX_bWMM				0x0080	// QOS Data
-#define fTX_bClearEAPFrame		0x0100
-
-
-
-#ifdef CONFIG_STA_SUPPORT
-#endif // CONFIG_STA_SUPPORT //
-
-
-
-
-#define TX_BLK_SET_FLAG(_pTxBlk, _flag)		(_pTxBlk->Flags |= _flag)
-#define TX_BLK_TEST_FLAG(_pTxBlk, _flag)	(((_pTxBlk->Flags & _flag) == _flag) ? 1 : 0)
-#define TX_BLK_CLEAR_FLAG(_pTxBlk, _flag)	(_pTxBlk->Flags &= ~(_flag))
-
-
-
-
-#ifdef RT_BIG_ENDIAN
-/***************************************************************************
-  *	Endian conversion related functions
-  **************************************************************************/
-/*
-	========================================================================
-
-	Routine Description:
-		Endian conversion of Tx/Rx descriptor .
-
-	Arguments:
-		pAd	Pointer to our adapter
-		pData			Pointer to Tx/Rx descriptor
-		DescriptorType	Direction of the frame
-
-	Return Value:
-		None
-
-	Note:
-		Call this function when read or update descriptor
-	========================================================================
-*/
-static inline VOID	RTMPWIEndianChange(
-	IN	PUCHAR			pData,
-	IN	ULONG			DescriptorType)
-{
-	int size;
-	int i;
-
-	size = ((DescriptorType == TYPE_TXWI) ? TXWI_SIZE : RXWI_SIZE);
-
-	if(DescriptorType == TYPE_TXWI)
-	{
-		*((UINT32 *)(pData)) = SWAP32(*((UINT32 *)(pData)));		// Byte 0~3
-		*((UINT32 *)(pData + 4)) = SWAP32(*((UINT32 *)(pData+4)));	// Byte 4~7
-	}
-	else
-	{
-		for(i=0; i < size/4 ; i++)
-			*(((UINT32 *)pData) +i) = SWAP32(*(((UINT32 *)pData)+i));
-	}
-}
-
-
-#ifdef RTMP_MAC_PCI
-static inline VOID	WriteBackToDescriptor(
-	IN  PUCHAR			Dest,
-	IN	PUCHAR			Src,
-    IN  BOOLEAN			DoEncrypt,
-	IN  ULONG           DescriptorType)
-{
-	UINT32 *p1, *p2;
-
-	p1 = ((UINT32 *)Dest);
-	p2 = ((UINT32 *)Src);
-
-	*p1 = *p2;
-	*(p1+2) = *(p2+2);
-	*(p1+3) = *(p2+3);
-	*(p1+1) = *(p2+1); // Word 1; this must be written back last
-}
-#endif // RTMP_MAC_PCI //
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		Endian conversion of Tx/Rx descriptor .
-
-	Arguments:
-		pAd	Pointer to our adapter
-		pData			Pointer to Tx/Rx descriptor
-		DescriptorType	Direction of the frame
-
-	Return Value:
-		None
-
-	Note:
-		Call this function when read or update descriptor
-	========================================================================
-*/
-#ifdef RTMP_MAC_PCI
-static inline VOID	RTMPDescriptorEndianChange(
-	IN	PUCHAR			pData,
-	IN	ULONG			DescriptorType)
-{
-	*((UINT32 *)(pData)) = SWAP32(*((UINT32 *)(pData)));		// Byte 0~3
-	*((UINT32 *)(pData + 8)) = SWAP32(*((UINT32 *)(pData+8)));	// Byte 8~11
-	*((UINT32 *)(pData +12)) = SWAP32(*((UINT32 *)(pData + 12)));	// Byte 12~15
-	*((UINT32 *)(pData + 4)) = SWAP32(*((UINT32 *)(pData + 4)));				// Byte 4~7, this must be swapped last
-}
-#endif // RTMP_MAC_PCI //
-
-/*
-	========================================================================
-
-	Routine Description:
-		Endian conversion of all kinds of 802.11 frames .
-
-	Arguments:
-		pAd	Pointer to our adapter
-		pData			Pointer to the 802.11 frame structure
-		Dir			Direction of the frame
-		FromRxDoneInt	Caller is from RxDone interrupt
-
-	Return Value:
-		None
-
-	Note:
-		Call this function when read or update buffer data
-	========================================================================
-*/
-static inline VOID	RTMPFrameEndianChange(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			pData,
-	IN	ULONG			Dir,
-	IN	BOOLEAN			FromRxDoneInt)
-{
-	PHEADER_802_11 pFrame;
-	PUCHAR	pMacHdr;
-
-	// swab 16 bit fields - Frame Control field
-	if(Dir == DIR_READ)
-	{
-		*(USHORT *)pData = SWAP16(*(USHORT *)pData);
-	}
-
-	pFrame = (PHEADER_802_11) pData;
-	pMacHdr = (PUCHAR) pFrame;
-
-	// swab 16 bit fields - Duration/ID field
-	*(USHORT *)(pMacHdr + 2) = SWAP16(*(USHORT *)(pMacHdr + 2));
-
-	// swab 16 bit fields - Sequence Control field
-	*(USHORT *)(pMacHdr + 22) = SWAP16(*(USHORT *)(pMacHdr + 22));
-
-	if(pFrame->FC.Type == BTYPE_MGMT)
-	{
-		switch(pFrame->FC.SubType)
-		{
-			case SUBTYPE_ASSOC_REQ:
-			case SUBTYPE_REASSOC_REQ:
-				// swab 16 bit fields - CapabilityInfo field
-				pMacHdr += sizeof(HEADER_802_11);
-				*(USHORT *)pMacHdr = SWAP16(*(USHORT *)pMacHdr);
-
-				// swab 16 bit fields - Listen Interval field
-				pMacHdr += 2;
-				*(USHORT *)pMacHdr = SWAP16(*(USHORT *)pMacHdr);
-				break;
-
-			case SUBTYPE_ASSOC_RSP:
-			case SUBTYPE_REASSOC_RSP:
-				// swab 16 bit fields - CapabilityInfo field
-				pMacHdr += sizeof(HEADER_802_11);
-				*(USHORT *)pMacHdr = SWAP16(*(USHORT *)pMacHdr);
-
-				// swab 16 bit fields - Status Code field
-				pMacHdr += 2;
-				*(USHORT *)pMacHdr = SWAP16(*(USHORT *)pMacHdr);
-
-				// swab 16 bit fields - AID field
-				pMacHdr += 2;
-				*(USHORT *)pMacHdr = SWAP16(*(USHORT *)pMacHdr);
-				break;
-
-			case SUBTYPE_AUTH:
-				// If from APHandleRxDoneInterrupt routine, it is still a encrypt format.
-				// The convertion is delayed to RTMPHandleDecryptionDoneInterrupt.
-				if(!FromRxDoneInt && pFrame->FC.Wep == 1)
-					break;
-				else
-				{
-					// swab 16 bit fields - Auth Alg No. field
-					pMacHdr += sizeof(HEADER_802_11);
-					*(USHORT *)pMacHdr = SWAP16(*(USHORT *)pMacHdr);
-
-					// swab 16 bit fields - Auth Seq No. field
-					pMacHdr += 2;
-					*(USHORT *)pMacHdr = SWAP16(*(USHORT *)pMacHdr);
-
-					// swab 16 bit fields - Status Code field
-					pMacHdr += 2;
-					*(USHORT *)pMacHdr = SWAP16(*(USHORT *)pMacHdr);
-				}
-				break;
-
-			case SUBTYPE_BEACON:
-			case SUBTYPE_PROBE_RSP:
-				// swab 16 bit fields - BeaconInterval field
-				pMacHdr += (sizeof(HEADER_802_11) + TIMESTAMP_LEN);
-				*(USHORT *)pMacHdr = SWAP16(*(USHORT *)pMacHdr);
-
-				// swab 16 bit fields - CapabilityInfo field
-				pMacHdr += sizeof(USHORT);
-				*(USHORT *)pMacHdr = SWAP16(*(USHORT *)pMacHdr);
-				break;
-
-			case SUBTYPE_DEAUTH:
-			case SUBTYPE_DISASSOC:
-				// swab 16 bit fields - Reason code field
-				pMacHdr += sizeof(HEADER_802_11);
-				*(USHORT *)pMacHdr = SWAP16(*(USHORT *)pMacHdr);
-				break;
-		}
-	}
-	else if( pFrame->FC.Type == BTYPE_DATA )
-	{
-	}
-	else if(pFrame->FC.Type == BTYPE_CNTL)
-	{
-		switch(pFrame->FC.SubType)
-		{
-			case SUBTYPE_BLOCK_ACK_REQ:
-				{
-					PFRAME_BA_REQ pBAReq = (PFRAME_BA_REQ)pFrame;
-					*(USHORT *)(&pBAReq->BARControl) = SWAP16(*(USHORT *)(&pBAReq->BARControl));
-					pBAReq->BAStartingSeq.word = SWAP16(pBAReq->BAStartingSeq.word);
-				}
-				break;
-			case SUBTYPE_BLOCK_ACK:
-				// For Block Ack packet, the HT_CONTROL field is in the same offset with Addr3
-				*(UINT32 *)(&pFrame->Addr3[0]) = SWAP32(*(UINT32 *)(&pFrame->Addr3[0]));
-				break;
-
-			case SUBTYPE_ACK:
-				//For ACK packet, the HT_CONTROL field is in the same offset with Addr2
-				*(UINT32 *)(&pFrame->Addr2[0])=	SWAP32(*(UINT32 *)(&pFrame->Addr2[0]));
-				break;
-		}
-	}
-	else
-	{
-		DBGPRINT(RT_DEBUG_ERROR,("Invalid Frame Type!!!\n"));
-	}
-
-	// swab 16 bit fields - Frame Control
-	if(Dir == DIR_WRITE)
-	{
-		*(USHORT *)pData = SWAP16(*(USHORT *)pData);
-	}
-}
-#endif // RT_BIG_ENDIAN //
-
-
-/***************************************************************************
-  *	Other static inline function definitions
-  **************************************************************************/
-static inline VOID ConvertMulticastIP2MAC(
-	IN PUCHAR pIpAddr,
-	IN PUCHAR *ppMacAddr,
-	IN UINT16 ProtoType)
-{
-	if (pIpAddr == NULL)
-		return;
-
-	if (ppMacAddr == NULL || *ppMacAddr == NULL)
-		return;
-
-	switch (ProtoType)
-	{
-		case ETH_P_IPV6:
-//			memset(*ppMacAddr, 0, ETH_LENGTH_OF_ADDRESS);
-			*(*ppMacAddr) = 0x33;
-			*(*ppMacAddr + 1) = 0x33;
-			*(*ppMacAddr + 2) = pIpAddr[12];
-			*(*ppMacAddr + 3) = pIpAddr[13];
-			*(*ppMacAddr + 4) = pIpAddr[14];
-			*(*ppMacAddr + 5) = pIpAddr[15];
-			break;
-
-		case ETH_P_IP:
-		default:
-//			memset(*ppMacAddr, 0, ETH_LENGTH_OF_ADDRESS);
-			*(*ppMacAddr) = 0x01;
-			*(*ppMacAddr + 1) = 0x00;
-			*(*ppMacAddr + 2) = 0x5e;
-			*(*ppMacAddr + 3) = pIpAddr[1] & 0x7f;
-			*(*ppMacAddr + 4) = pIpAddr[2];
-			*(*ppMacAddr + 5) = pIpAddr[3];
-			break;
-	}
-
-	return;
-}
-
-
-char *GetPhyMode(int Mode);
-char* GetBW(int BW);
-
-
-
-BOOLEAN RTMPCheckForHang(
-	IN  NDIS_HANDLE MiniportAdapterContext);
-
-VOID  RTMPHalt(
-	IN  NDIS_HANDLE MiniportAdapterContext);
-
-//
-//  Private routines in rtmp_init.c
-//
-NDIS_STATUS RTMPAllocAdapterBlock(
-	IN PVOID			handle,
-	OUT PRTMP_ADAPTER   *ppAdapter);
-
-NDIS_STATUS RTMPAllocTxRxRingMemory(
-	IN  PRTMP_ADAPTER   pAd);
-
-NDIS_STATUS RTMPFindAdapter(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  NDIS_HANDLE     WrapperConfigurationContext);
-
-NDIS_STATUS	RTMPReadParametersHook(
-	IN	PRTMP_ADAPTER pAd);
-
-NDIS_STATUS	RTMPSetProfileParameters(
-	IN RTMP_ADAPTER *pAd,
-	IN PSTRING		pBuffer);
-
-INT RTMPGetKeyParameter(
-    IN PSTRING key,
-    OUT PSTRING dest,
-    IN INT destsize,
-    IN PSTRING buffer,
-    IN BOOLEAN bTrimSpace);
-
-VOID RTMPFreeAdapter(
-	IN  PRTMP_ADAPTER   pAd);
-
-NDIS_STATUS NICReadRegParameters(
-	IN  PRTMP_ADAPTER       pAd,
-	IN  NDIS_HANDLE         WrapperConfigurationContext);
-
-#ifdef RTMP_RF_RW_SUPPORT
-VOID NICInitRFRegisters(
-	IN PRTMP_ADAPTER pAd);
-
-VOID RtmpChipOpsRFHook(
-	IN RTMP_ADAPTER *pAd);
-
-NDIS_STATUS	RT30xxWriteRFRegister(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			regID,
-	IN	UCHAR			value);
-
-NDIS_STATUS	RT30xxReadRFRegister(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			regID,
-	IN	PUCHAR			pValue);
-#endif // RTMP_RF_RW_SUPPORT //
-
-VOID NICReadEEPROMParameters(
-	IN  PRTMP_ADAPTER       pAd,
-	IN	PUCHAR				mac_addr);
-
-VOID NICInitAsicFromEEPROM(
-	IN  PRTMP_ADAPTER       pAd);
-
-
-NDIS_STATUS NICInitializeAdapter(
-	IN  PRTMP_ADAPTER   pAd,
-	IN   BOOLEAN    bHardReset);
-
-NDIS_STATUS NICInitializeAsic(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  BOOLEAN		bHardReset);
-
-VOID NICIssueReset(
-	IN  PRTMP_ADAPTER   pAd);
-
-VOID RTMPRingCleanUp(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  UCHAR           RingType);
-
-VOID RxTest(
-	IN  PRTMP_ADAPTER   pAd);
-
-NDIS_STATUS DbgSendPacket(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PNDIS_PACKET    pPacket);
-
-VOID UserCfgInit(
-	IN  PRTMP_ADAPTER   pAd);
-
-VOID NICResetFromError(
-	IN  PRTMP_ADAPTER   pAd);
-
-NDIS_STATUS NICLoadFirmware(
-	IN  PRTMP_ADAPTER   pAd);
-
-VOID NICEraseFirmware(
-	IN PRTMP_ADAPTER pAd);
-
-NDIS_STATUS NICLoadRateSwitchingParams(
-	IN PRTMP_ADAPTER pAd);
-
-BOOLEAN NICCheckForHang(
-	IN  PRTMP_ADAPTER   pAd);
-
-VOID NICUpdateFifoStaCounters(
-	IN PRTMP_ADAPTER pAd);
-
-VOID NICUpdateRawCounters(
-	IN  PRTMP_ADAPTER   pAd);
-
-VOID RTMPZeroMemory(
-	IN  PVOID   pSrc,
-	IN  ULONG   Length);
-
-ULONG RTMPCompareMemory(
-	IN  PVOID   pSrc1,
-	IN  PVOID   pSrc2,
-	IN  ULONG   Length);
-
-VOID RTMPMoveMemory(
-	OUT PVOID   pDest,
-	IN  PVOID   pSrc,
-	IN  ULONG   Length);
-
-VOID AtoH(
-	PSTRING	src,
-	PUCHAR dest,
-	int		destlen);
-
-UCHAR BtoH(
-	char ch);
-
-VOID RTMPPatchMacBbpBug(
-	IN  PRTMP_ADAPTER   pAd);
-
-VOID RTMPPatchCardBus(
-	IN	PRTMP_ADAPTER	pAdapter);
-
-VOID RTMPPatchRalinkCardBus(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	ULONG			Bus);
-
-ULONG RTMPReadCBConfig(
-	IN	ULONG	Bus,
-	IN	ULONG	Slot,
-	IN	ULONG	Func,
-	IN	ULONG	Offset);
-
-VOID RTMPWriteCBConfig(
-	IN	ULONG	Bus,
-	IN	ULONG	Slot,
-	IN	ULONG	Func,
-	IN	ULONG	Offset,
-	IN	ULONG	Value);
-
-VOID RTMPInitTimer(
-	IN  PRTMP_ADAPTER           pAd,
-	IN  PRALINK_TIMER_STRUCT    pTimer,
-	IN  PVOID                   pTimerFunc,
-	IN	PVOID					pData,
-	IN  BOOLEAN                 Repeat);
-
-VOID RTMPSetTimer(
-	IN  PRALINK_TIMER_STRUCT    pTimer,
-	IN  ULONG                   Value);
-
-
-VOID RTMPModTimer(
-	IN	PRALINK_TIMER_STRUCT	pTimer,
-	IN	ULONG					Value);
-
-VOID RTMPCancelTimer(
-	IN  PRALINK_TIMER_STRUCT    pTimer,
-	OUT BOOLEAN                 *pCancelled);
-
-VOID RTMPSetLED(
-	IN PRTMP_ADAPTER	pAd,
-	IN UCHAR			Status);
-
-VOID RTMPSetSignalLED(
-	IN PRTMP_ADAPTER	pAd,
-	IN NDIS_802_11_RSSI Dbm);
-
-
-VOID RTMPEnableRxTx(
-	IN PRTMP_ADAPTER	pAd);
-
-//
-// prototype in action.c
-//
-VOID ActionStateMachineInit(
-    IN	PRTMP_ADAPTER	pAd,
-    IN  STATE_MACHINE *S,
-    OUT STATE_MACHINE_FUNC Trans[]);
-
-VOID MlmeADDBAAction(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem);
-
-VOID MlmeDELBAAction(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem);
-
-VOID MlmeDLSAction(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem);
-
-VOID MlmeInvalidAction(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem);
-
-VOID MlmeQOSAction(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem);
-
-#ifdef DOT11_N_SUPPORT
-VOID PeerAddBAReqAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem);
-
-VOID PeerAddBARspAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem);
-
-VOID PeerDelBAAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem);
-
-VOID PeerBAAction(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem);
-#endif // DOT11_N_SUPPORT //
-
-VOID SendPSMPAction(
-	IN PRTMP_ADAPTER	pAd,
-	IN UCHAR			Wcid,
-	IN UCHAR			Psmp);
-
-
-VOID PeerRMAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem);
-
-VOID PeerPublicAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem);
-
-#ifdef CONFIG_STA_SUPPORT
-VOID StaPublicAction(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR Bss2040Coexist);
-#endif // CONFIG_STA_SUPPORT //
-
-
-VOID PeerBSSTranAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem);
-
-#ifdef DOT11_N_SUPPORT
-VOID PeerHTAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem);
-#endif // DOT11_N_SUPPORT //
-
-VOID PeerQOSAction(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem);
-
-#ifdef QOS_DLS_SUPPORT
-VOID PeerDLSAction(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem);
-#endif // QOS_DLS_SUPPORT //
-
-#ifdef CONFIG_STA_SUPPORT
-#ifdef QOS_DLS_SUPPORT
-VOID DlsParmFill(
-	IN PRTMP_ADAPTER pAd,
-	IN OUT MLME_DLS_REQ_STRUCT *pDlsReq,
-	IN PRT_802_11_DLS pDls,
-	IN USHORT reason);
-#endif // QOS_DLS_SUPPORT //
-#endif // CONFIG_STA_SUPPORT //
-
-#ifdef DOT11_N_SUPPORT
-VOID RECBATimerTimeout(
-    IN PVOID SystemSpecific1,
-    IN PVOID FunctionContext,
-    IN PVOID SystemSpecific2,
-    IN PVOID SystemSpecific3);
-
-VOID ORIBATimerTimeout(
-	IN	PRTMP_ADAPTER	pAd);
-
-VOID SendRefreshBAR(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	MAC_TABLE_ENTRY	*pEntry);
-
-#ifdef DOT11N_DRAFT3
-VOID SendBSS2040CoexistMgmtAction(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR	Wcid,
-	IN	UCHAR	apidx,
-	IN	UCHAR	InfoReq);
-
-VOID SendNotifyBWActionFrame(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR  Wcid,
-	IN UCHAR apidx);
-
-BOOLEAN ChannelSwitchSanityCheck(
-	IN	PRTMP_ADAPTER	pAd,
-	IN    UCHAR  Wcid,
-	IN    UCHAR  NewChannel,
-	IN    UCHAR  Secondary);
-
-VOID ChannelSwitchAction(
-	IN	PRTMP_ADAPTER	pAd,
-	IN    UCHAR  Wcid,
-	IN    UCHAR  Channel,
-	IN    UCHAR  Secondary);
-
-ULONG BuildIntolerantChannelRep(
-	IN	PRTMP_ADAPTER	pAd,
-	IN    PUCHAR  pDest);
-
-VOID Update2040CoexistFrameAndNotify(
-	IN	PRTMP_ADAPTER	pAd,
-	IN    UCHAR  Wcid,
-	IN	BOOLEAN	bAddIntolerantCha);
-
-VOID Send2040CoexistAction(
-	IN	PRTMP_ADAPTER	pAd,
-	IN    UCHAR  Wcid,
-	IN	BOOLEAN	bAddIntolerantCha);
-#endif // DOT11N_DRAFT3 //
-#endif // DOT11_N_SUPPORT //
-
-VOID ActHeaderInit(
-    IN	PRTMP_ADAPTER	pAd,
-    IN OUT PHEADER_802_11 pHdr80211,
-    IN PUCHAR Addr1,
-    IN PUCHAR Addr2,
-    IN PUCHAR Addr3);
-
-VOID BarHeaderInit(
-	IN	PRTMP_ADAPTER	pAd,
-	IN OUT PFRAME_BAR pCntlBar,
-	IN PUCHAR pDA,
-	IN PUCHAR pSA);
-
-VOID InsertActField(
-	IN PRTMP_ADAPTER pAd,
-	OUT PUCHAR pFrameBuf,
-	OUT PULONG pFrameLen,
-	IN UINT8 Category,
-	IN UINT8 ActCode);
-
-BOOLEAN QosBADataParse(
-	IN PRTMP_ADAPTER	pAd,
-	IN BOOLEAN bAMSDU,
-	IN PUCHAR p8023Header,
-	IN UCHAR	WCID,
-	IN UCHAR	TID,
-	IN USHORT Sequence,
-	IN UCHAR DataOffset,
-	IN USHORT Datasize,
-	IN UINT   CurRxIndex);
-
-#ifdef DOT11_N_SUPPORT
-BOOLEAN CntlEnqueueForRecv(
-    IN	PRTMP_ADAPTER	pAd,
-	IN ULONG Wcid,
-    IN ULONG MsgLen,
-	IN PFRAME_BA_REQ pMsg);
-
-VOID BaAutoManSwitch(
-	IN	PRTMP_ADAPTER	pAd);
-#endif // DOT11_N_SUPPORT //
-
-VOID HTIOTCheck(
-	IN	PRTMP_ADAPTER	pAd,
-	IN    UCHAR     BatRecIdx);
-
-//
-// Private routines in rtmp_data.c
-//
-BOOLEAN RTMPHandleRxDoneInterrupt(
-	IN  PRTMP_ADAPTER   pAd);
-
-VOID RTMPHandleTxDoneInterrupt(
-	IN  PRTMP_ADAPTER   pAd);
-
-BOOLEAN RTMPHandleTxRingDmaDoneInterrupt(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  INT_SOURCE_CSR_STRUC TxRingBitmap);
-
-VOID RTMPHandleMgmtRingDmaDoneInterrupt(
-	IN  PRTMP_ADAPTER   pAd);
-
-VOID RTMPHandleTBTTInterrupt(
-	IN  PRTMP_ADAPTER   pAd);
-
-VOID RTMPHandlePreTBTTInterrupt(
-	IN  PRTMP_ADAPTER   pAd);
-
-void RTMPHandleTwakeupInterrupt(
-	IN PRTMP_ADAPTER pAd);
-
-VOID	RTMPHandleRxCoherentInterrupt(
-	IN	PRTMP_ADAPTER	pAd);
-
-
-BOOLEAN TxFrameIsAggregatible(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PUCHAR          pPrevAddr1,
-	IN  PUCHAR          p8023hdr);
-
-BOOLEAN PeerIsAggreOn(
-    IN  PRTMP_ADAPTER   pAd,
-    IN  ULONG          TxRate,
-    IN  PMAC_TABLE_ENTRY pMacEntry);
-
-
-NDIS_STATUS Sniff2BytesFromNdisBuffer(
-	IN  PNDIS_BUFFER    pFirstBuffer,
-	IN  UCHAR           DesiredOffset,
-	OUT PUCHAR          pByte0,
-	OUT PUCHAR          pByte1);
-
-NDIS_STATUS STASendPacket(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PNDIS_PACKET    pPacket);
-
-VOID STASendPackets(
-	IN  NDIS_HANDLE     MiniportAdapterContext,
-	IN  PPNDIS_PACKET   ppPacketArray,
-	IN  UINT            NumberOfPackets);
-
-VOID RTMPDeQueuePacket(
-	IN  PRTMP_ADAPTER   pAd,
-	IN	BOOLEAN			bIntContext,
-	IN  UCHAR			QueIdx,
-	IN	UCHAR			Max_Tx_Packets);
-
-NDIS_STATUS	RTMPHardTransmit(
-	IN PRTMP_ADAPTER	pAd,
-	IN PNDIS_PACKET		pPacket,
-	IN  UCHAR			QueIdx,
-	OUT	PULONG			pFreeTXDLeft);
-
-NDIS_STATUS	STAHardTransmit(
-	IN PRTMP_ADAPTER	pAd,
-	IN TX_BLK			*pTxBlk,
-	IN  UCHAR			QueIdx);
-
-VOID STARxEAPOLFrameIndicate(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	MAC_TABLE_ENTRY	*pEntry,
-	IN	RX_BLK			*pRxBlk,
-	IN	UCHAR			FromWhichBSSID);
-
-NDIS_STATUS RTMPFreeTXDRequest(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  UCHAR           RingType,
-	IN  UCHAR           NumberRequired,
-	IN	PUCHAR          FreeNumberIs);
-
-NDIS_STATUS MlmeHardTransmit(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  UCHAR	QueIdx,
-	IN  PNDIS_PACKET    pPacket);
-
-NDIS_STATUS MlmeHardTransmitMgmtRing(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  UCHAR	QueIdx,
-	IN  PNDIS_PACKET    pPacket);
-
-#ifdef RTMP_MAC_PCI
-NDIS_STATUS MlmeHardTransmitTxRing(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  UCHAR	QueIdx,
-	IN  PNDIS_PACKET    pPacket);
-
-NDIS_STATUS MlmeDataHardTransmit(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR	QueIdx,
-	IN	PNDIS_PACKET	pPacket);
-
-VOID RTMPWriteTxDescriptor(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PTXD_STRUC		pTxD,
-	IN	BOOLEAN			bWIV,
-	IN	UCHAR			QSEL);
-#endif // RTMP_MAC_PCI //
-
-USHORT  RTMPCalcDuration(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  UCHAR           Rate,
-	IN  ULONG           Size);
-
-VOID RTMPWriteTxWI(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PTXWI_STRUC		pTxWI,
-	IN  BOOLEAN		FRAG,
-	IN  BOOLEAN		CFACK,
-	IN  BOOLEAN		InsTimestamp,
-	IN	BOOLEAN			AMPDU,
-	IN	BOOLEAN			Ack,
-	IN	BOOLEAN			NSeq,		// HW new a sequence.
-	IN	UCHAR			BASize,
-	IN	UCHAR			WCID,
-	IN	ULONG			Length,
-	IN  UCHAR		PID,
-	IN	UCHAR			TID,
-	IN	UCHAR			TxRate,
-	IN	UCHAR			Txopmode,
-	IN	BOOLEAN			CfAck,
-	IN	HTTRANSMIT_SETTING	*pTransmit);
-
-
-VOID RTMPWriteTxWI_Data(
-	IN	PRTMP_ADAPTER		pAd,
-	IN	OUT PTXWI_STRUC		pTxWI,
-	IN	TX_BLK				*pTxBlk);
-
-
-VOID RTMPWriteTxWI_Cache(
-	IN	PRTMP_ADAPTER		pAd,
-	IN	OUT PTXWI_STRUC		pTxWI,
-	IN	TX_BLK				*pTxBlk);
-
-VOID RTMPSuspendMsduTransmission(
-	IN  PRTMP_ADAPTER   pAd);
-
-VOID RTMPResumeMsduTransmission(
-	IN  PRTMP_ADAPTER   pAd);
-
-NDIS_STATUS MiniportMMRequest(
-	IN  PRTMP_ADAPTER   pAd,
-	IN	UCHAR			QueIdx,
-	IN	PUCHAR			pData,
-	IN  UINT            Length);
-
-//+++mark by shiang, now this function merge to MiniportMMRequest()
-//---mark by shiang, now this function merge to MiniportMMRequest()
-
-VOID RTMPSendNullFrame(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  UCHAR           TxRate,
-	IN	BOOLEAN			bQosNull);
-
-VOID RTMPSendDisassociationFrame(
-	IN	PRTMP_ADAPTER	pAd);
-
-VOID RTMPSendRTSFrame(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PUCHAR          pDA,
-	IN	unsigned int	NextMpduSize,
-	IN  UCHAR           TxRate,
-	IN  UCHAR           RTSRate,
-	IN  USHORT          AckDuration,
-	IN  UCHAR           QueIdx,
-	IN  UCHAR			FrameGap);
-
-
-NDIS_STATUS RTMPApplyPacketFilter(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PRT28XX_RXD_STRUC      pRxD,
-	IN  PHEADER_802_11  pHeader);
-
-PQUEUE_HEADER   RTMPCheckTxSwQueue(
-	IN  PRTMP_ADAPTER   pAd,
-	OUT UCHAR           *QueIdx);
-
-#ifdef CONFIG_STA_SUPPORT
-VOID RTMPReportMicError(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PCIPHER_KEY     pWpaKey);
-
-VOID	WpaMicFailureReportFrame(
-	IN  PRTMP_ADAPTER    pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID    WpaDisassocApAndBlockAssoc(
-    IN  PVOID SystemSpecific1,
-    IN  PVOID FunctionContext,
-    IN  PVOID SystemSpecific2,
-    IN  PVOID SystemSpecific3);
-
-VOID WpaStaPairwiseKeySetting(
-	IN	PRTMP_ADAPTER	pAd);
-
-VOID WpaStaGroupKeySetting(
-	IN	PRTMP_ADAPTER	pAd);
-
-#endif // CONFIG_STA_SUPPORT //
-
-NDIS_STATUS RTMPCloneNdisPacket(
-	IN  PRTMP_ADAPTER   pAd,
-	IN	BOOLEAN    pInsAMSDUHdr,
-	IN  PNDIS_PACKET    pInPacket,
-	OUT PNDIS_PACKET   *ppOutPacket);
-
-NDIS_STATUS RTMPAllocateNdisPacket(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PNDIS_PACKET    *pPacket,
-	IN  PUCHAR          pHeader,
-	IN  UINT            HeaderLen,
-	IN  PUCHAR          pData,
-	IN  UINT            DataLen);
-
-VOID RTMPFreeNdisPacket(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PNDIS_PACKET    pPacket);
-
-BOOLEAN RTMPFreeTXDUponTxDmaDone(
-	IN PRTMP_ADAPTER    pAd,
-	IN UCHAR            QueIdx);
-
-BOOLEAN RTMPCheckDHCPFrame(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PNDIS_PACKET	pPacket);
-
-
-BOOLEAN RTMPCheckEtherType(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PNDIS_PACKET	pPacket);
-
-
-VOID RTMPCckBbpTuning(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UINT			TxRate);
-
-//
-// Private routines in rtmp_wep.c
-//
-VOID RTMPInitWepEngine(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PUCHAR          pKey,
-	IN  UCHAR           KeyId,
-	IN  UCHAR           KeyLen,
-	IN  PUCHAR          pDest);
-
-VOID RTMPEncryptData(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PUCHAR          pSrc,
-	IN  PUCHAR          pDest,
-	IN  UINT            Len);
-
-BOOLEAN	RTMPDecryptData(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	PUCHAR			pSrc,
-	IN	UINT			Len,
-	IN	UINT			idx);
-
-BOOLEAN	RTMPSoftDecryptWEP(
-	IN PRTMP_ADAPTER	pAd,
-	IN PUCHAR			pData,
-	IN ULONG			DataByteCnt,
-	IN PCIPHER_KEY		pGroupKey);
-
-VOID RTMPSetICV(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PUCHAR          pDest);
-
-VOID ARCFOUR_INIT(
-	IN  PARCFOURCONTEXT Ctx,
-	IN  PUCHAR          pKey,
-	IN  UINT            KeyLen);
-
-UCHAR   ARCFOUR_BYTE(
-	IN  PARCFOURCONTEXT     Ctx);
-
-VOID ARCFOUR_DECRYPT(
-	IN  PARCFOURCONTEXT Ctx,
-	IN  PUCHAR          pDest,
-	IN  PUCHAR          pSrc,
-	IN  UINT            Len);
-
-VOID ARCFOUR_ENCRYPT(
-	IN  PARCFOURCONTEXT Ctx,
-	IN  PUCHAR          pDest,
-	IN  PUCHAR          pSrc,
-	IN  UINT            Len);
-
-VOID WPAARCFOUR_ENCRYPT(
-	IN  PARCFOURCONTEXT Ctx,
-	IN  PUCHAR          pDest,
-	IN  PUCHAR          pSrc,
-	IN  UINT            Len);
-
-UINT RTMP_CALC_FCS32(
-	IN  UINT   Fcs,
-	IN  PUCHAR  Cp,
-	IN  INT     Len);
-
-//
-// MLME routines
-//
-
-// Asic/RF/BBP related functions
-
-VOID AsicAdjustTxPower(
-	IN PRTMP_ADAPTER pAd);
-
-VOID	AsicUpdateProtect(
-	IN		PRTMP_ADAPTER	pAd,
-	IN		USHORT			OperaionMode,
-	IN		UCHAR			SetMask,
-	IN		BOOLEAN			bDisableBGProtect,
-	IN		BOOLEAN			bNonGFExist);
-
-VOID AsicSwitchChannel(
-	IN  PRTMP_ADAPTER   pAd,
-	IN	UCHAR			Channel,
-	IN	BOOLEAN			bScan);
-
-VOID AsicLockChannel(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR Channel) ;
-
-VOID AsicAntennaSelect(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  UCHAR           Channel);
-
-VOID AsicAntennaSetting(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	ABGBAND_STATE	BandState);
-
-VOID AsicRfTuningExec(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3);
-
-#ifdef CONFIG_STA_SUPPORT
-
-VOID AsicResetBBPAgent(
-	IN PRTMP_ADAPTER pAd);
-
-VOID AsicSleepThenAutoWakeup(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  USHORT TbttNumToNextWakeUp);
-
-VOID AsicForceSleep(
-	IN PRTMP_ADAPTER pAd);
-
-VOID AsicForceWakeup(
-	IN PRTMP_ADAPTER pAd,
-	IN BOOLEAN    bFromTx);
-#endif // CONFIG_STA_SUPPORT //
-
-VOID AsicSetBssid(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PUCHAR pBssid);
-
-VOID AsicSetMcastWC(
-	IN PRTMP_ADAPTER pAd);
-
-
-VOID AsicDelWcidTab(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR	Wcid);
-
-VOID AsicEnableRDG(
-	IN PRTMP_ADAPTER pAd);
-
-VOID AsicDisableRDG(
-	IN PRTMP_ADAPTER pAd);
-
-VOID AsicDisableSync(
-	IN  PRTMP_ADAPTER   pAd);
-
-VOID AsicEnableBssSync(
-	IN  PRTMP_ADAPTER   pAd);
-
-VOID AsicEnableIbssSync(
-	IN  PRTMP_ADAPTER   pAd);
-
-VOID AsicSetEdcaParm(
-	IN PRTMP_ADAPTER pAd,
-	IN PEDCA_PARM    pEdcaParm);
-
-VOID AsicSetSlotTime(
-	IN PRTMP_ADAPTER pAd,
-	IN BOOLEAN bUseShortSlotTime);
-
-
-VOID AsicAddSharedKeyEntry(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR         BssIndex,
-	IN UCHAR         KeyIdx,
-	IN UCHAR         CipherAlg,
-	IN PUCHAR        pKey,
-	IN PUCHAR        pTxMic,
-	IN PUCHAR        pRxMic);
-
-VOID AsicRemoveSharedKeyEntry(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR         BssIndex,
-	IN UCHAR         KeyIdx);
-
-VOID AsicUpdateWCIDAttribute(
-	IN PRTMP_ADAPTER pAd,
-	IN USHORT		WCID,
-	IN UCHAR		BssIndex,
-	IN UCHAR        CipherAlg,
-	IN BOOLEAN		bUsePairewiseKeyTable);
-
-VOID AsicUpdateWCIDIVEIV(
-	IN PRTMP_ADAPTER pAd,
-	IN USHORT		WCID,
-	IN ULONG        uIV,
-	IN ULONG        uEIV);
-
-VOID AsicUpdateRxWCIDTable(
-	IN PRTMP_ADAPTER pAd,
-	IN USHORT		WCID,
-	IN PUCHAR        pAddr);
-
-VOID AsicAddKeyEntry(
-	IN PRTMP_ADAPTER pAd,
-	IN USHORT		WCID,
-	IN UCHAR		BssIndex,
-	IN UCHAR		KeyIdx,
-	IN PCIPHER_KEY	pCipherKey,
-	IN BOOLEAN		bUsePairewiseKeyTable,
-	IN BOOLEAN		bTxKey);
-
-VOID AsicAddPairwiseKeyEntry(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR        pAddr,
-	IN UCHAR		WCID,
-	IN CIPHER_KEY		 *pCipherKey);
-
-VOID AsicRemovePairwiseKeyEntry(
-	IN PRTMP_ADAPTER  pAd,
-	IN UCHAR		 BssIdx,
-	IN UCHAR		 Wcid);
-
-BOOLEAN AsicSendCommandToMcu(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR         Command,
-	IN UCHAR         Token,
-	IN UCHAR         Arg0,
-	IN UCHAR         Arg1);
-
-
-#ifdef RTMP_MAC_PCI
-BOOLEAN AsicCheckCommanOk(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR		 Command);
-#endif // RTMP_MAC_PCI //
-
-VOID MacAddrRandomBssid(
-	IN  PRTMP_ADAPTER   pAd,
-	OUT PUCHAR pAddr);
-
-VOID MgtMacHeaderInit(
-	IN  PRTMP_ADAPTER     pAd,
-	IN OUT PHEADER_802_11 pHdr80211,
-	IN UCHAR SubType,
-	IN UCHAR ToDs,
-	IN PUCHAR pDA,
-	IN PUCHAR pBssid);
-
-VOID MlmeRadioOff(
-	IN PRTMP_ADAPTER pAd);
-
-VOID MlmeRadioOn(
-	IN PRTMP_ADAPTER pAd);
-
-
-VOID BssTableInit(
-	IN BSS_TABLE *Tab);
-
-#ifdef DOT11_N_SUPPORT
-VOID BATableInit(
-	IN PRTMP_ADAPTER pAd,
-    IN BA_TABLE *Tab);
-#endif // DOT11_N_SUPPORT //
-
-ULONG BssTableSearch(
-	IN BSS_TABLE *Tab,
-	IN PUCHAR pBssid,
-	IN UCHAR Channel);
-
-ULONG BssSsidTableSearch(
-	IN BSS_TABLE *Tab,
-	IN PUCHAR    pBssid,
-	IN PUCHAR    pSsid,
-	IN UCHAR     SsidLen,
-	IN UCHAR     Channel);
-
-ULONG BssTableSearchWithSSID(
-	IN BSS_TABLE *Tab,
-	IN PUCHAR    Bssid,
-	IN PUCHAR    pSsid,
-	IN UCHAR     SsidLen,
-	IN UCHAR     Channel);
-
-ULONG BssSsidTableSearchBySSID(
-	IN BSS_TABLE *Tab,
-	IN PUCHAR	 pSsid,
-	IN UCHAR	 SsidLen);
-
-VOID BssTableDeleteEntry(
-	IN OUT  PBSS_TABLE pTab,
-	IN      PUCHAR pBssid,
-	IN      UCHAR Channel);
-
-#ifdef DOT11_N_SUPPORT
-VOID BATableDeleteORIEntry(
-	IN OUT	PRTMP_ADAPTER pAd,
-	IN		BA_ORI_ENTRY	*pBAORIEntry);
-
-VOID BATableDeleteRECEntry(
-	IN OUT	PRTMP_ADAPTER pAd,
-	IN		BA_REC_ENTRY	*pBARECEntry);
-
-VOID BATableTearORIEntry(
-	IN OUT	PRTMP_ADAPTER pAd,
-	IN		UCHAR TID,
-	IN		UCHAR Wcid,
-	IN		BOOLEAN bForceDelete,
-	IN		BOOLEAN ALL);
-
-VOID BATableTearRECEntry(
-	IN OUT	PRTMP_ADAPTER pAd,
-	IN		UCHAR TID,
-	IN		UCHAR WCID,
-	IN		BOOLEAN ALL);
-#endif // DOT11_N_SUPPORT //
-
-VOID  BssEntrySet(
-	IN  PRTMP_ADAPTER   pAd,
-	OUT PBSS_ENTRY pBss,
-	IN PUCHAR pBssid,
-	IN CHAR Ssid[],
-	IN UCHAR SsidLen,
-	IN UCHAR BssType,
-	IN USHORT BeaconPeriod,
-	IN PCF_PARM CfParm,
-	IN USHORT AtimWin,
-	IN USHORT CapabilityInfo,
-	IN UCHAR SupRate[],
-	IN UCHAR SupRateLen,
-	IN UCHAR ExtRate[],
-	IN UCHAR ExtRateLen,
-	IN HT_CAPABILITY_IE *pHtCapability,
-	IN ADD_HT_INFO_IE *pAddHtInfo,	// AP might use this additional ht info IE
-	IN UCHAR			HtCapabilityLen,
-	IN UCHAR			AddHtInfoLen,
-	IN UCHAR			NewExtChanOffset,
-	IN UCHAR Channel,
-	IN CHAR Rssi,
-	IN LARGE_INTEGER TimeStamp,
-	IN UCHAR CkipFlag,
-	IN PEDCA_PARM pEdcaParm,
-	IN PQOS_CAPABILITY_PARM pQosCapability,
-	IN PQBSS_LOAD_PARM pQbssLoad,
-	IN USHORT LengthVIE,
-	IN PNDIS_802_11_VARIABLE_IEs pVIE);
-
-ULONG  BssTableSetEntry(
-	IN  PRTMP_ADAPTER   pAd,
-	OUT PBSS_TABLE pTab,
-	IN PUCHAR pBssid,
-	IN CHAR Ssid[],
-	IN UCHAR SsidLen,
-	IN UCHAR BssType,
-	IN USHORT BeaconPeriod,
-	IN CF_PARM *CfParm,
-	IN USHORT AtimWin,
-	IN USHORT CapabilityInfo,
-	IN UCHAR SupRate[],
-	IN UCHAR SupRateLen,
-	IN UCHAR ExtRate[],
-	IN UCHAR ExtRateLen,
-	IN HT_CAPABILITY_IE *pHtCapability,
-	IN ADD_HT_INFO_IE *pAddHtInfo,	// AP might use this additional ht info IE
-	IN UCHAR			HtCapabilityLen,
-	IN UCHAR			AddHtInfoLen,
-	IN UCHAR			NewExtChanOffset,
-	IN UCHAR Channel,
-	IN CHAR Rssi,
-	IN LARGE_INTEGER TimeStamp,
-	IN UCHAR CkipFlag,
-	IN PEDCA_PARM pEdcaParm,
-	IN PQOS_CAPABILITY_PARM pQosCapability,
-	IN PQBSS_LOAD_PARM pQbssLoad,
-	IN USHORT LengthVIE,
-	IN PNDIS_802_11_VARIABLE_IEs pVIE);
-
-#ifdef DOT11_N_SUPPORT
-VOID BATableInsertEntry(
-    IN	PRTMP_ADAPTER	pAd,
-	IN USHORT Aid,
-    IN USHORT		TimeOutValue,
-	IN USHORT		StartingSeq,
-    IN UCHAR TID,
-	IN UCHAR BAWinSize,
-	IN UCHAR OriginatorStatus,
-    IN BOOLEAN IsRecipient);
-
-#ifdef DOT11N_DRAFT3
-VOID Bss2040CoexistTimeOut(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3);
-
-
-VOID  TriEventInit(
-	IN	PRTMP_ADAPTER	pAd);
-
-ULONG TriEventTableSetEntry(
-	IN	PRTMP_ADAPTER	pAd,
-	OUT TRIGGER_EVENT_TAB *Tab,
-	IN PUCHAR pBssid,
-	IN HT_CAPABILITY_IE *pHtCapability,
-	IN UCHAR			HtCapabilityLen,
-	IN UCHAR			RegClass,
-	IN UCHAR ChannelNo);
-
-VOID TriEventCounterMaintenance(
-	IN	PRTMP_ADAPTER	pAd);
-#endif // DOT11N_DRAFT3 //
-#endif // DOT11_N_SUPPORT //
-
-VOID BssTableSsidSort(
-	IN  PRTMP_ADAPTER   pAd,
-	OUT BSS_TABLE *OutTab,
-	IN  CHAR Ssid[],
-	IN  UCHAR SsidLen);
-
-VOID  BssTableSortByRssi(
-	IN OUT BSS_TABLE *OutTab);
-
-VOID BssCipherParse(
-	IN OUT  PBSS_ENTRY  pBss);
-
-NDIS_STATUS  MlmeQueueInit(
-	IN MLME_QUEUE *Queue);
-
-VOID  MlmeQueueDestroy(
-	IN MLME_QUEUE *Queue);
-
-BOOLEAN MlmeEnqueue(
-	IN PRTMP_ADAPTER pAd,
-	IN ULONG Machine,
-	IN ULONG MsgType,
-	IN ULONG MsgLen,
-	IN VOID *Msg);
-
-BOOLEAN MlmeEnqueueForRecv(
-	IN  PRTMP_ADAPTER   pAd,
-	IN ULONG Wcid,
-	IN ULONG TimeStampHigh,
-	IN ULONG TimeStampLow,
-	IN UCHAR Rssi0,
-	IN UCHAR Rssi1,
-	IN UCHAR Rssi2,
-	IN ULONG MsgLen,
-	IN PVOID Msg,
-	IN UCHAR Signal);
-
-
-BOOLEAN MlmeDequeue(
-	IN MLME_QUEUE *Queue,
-	OUT MLME_QUEUE_ELEM **Elem);
-
-VOID    MlmeRestartStateMachine(
-	IN  PRTMP_ADAPTER   pAd);
-
-BOOLEAN  MlmeQueueEmpty(
-	IN MLME_QUEUE *Queue);
-
-BOOLEAN  MlmeQueueFull(
-	IN MLME_QUEUE *Queue);
-
-BOOLEAN  MsgTypeSubst(
-	IN PRTMP_ADAPTER pAd,
-	IN PFRAME_802_11 pFrame,
-	OUT INT *Machine,
-	OUT INT *MsgType);
-
-VOID StateMachineInit(
-	IN STATE_MACHINE *Sm,
-	IN STATE_MACHINE_FUNC Trans[],
-	IN ULONG StNr,
-	IN ULONG MsgNr,
-	IN STATE_MACHINE_FUNC DefFunc,
-	IN ULONG InitState,
-	IN ULONG Base);
-
-VOID StateMachineSetAction(
-	IN STATE_MACHINE *S,
-	IN ULONG St,
-	ULONG Msg,
-	IN STATE_MACHINE_FUNC F);
-
-VOID StateMachinePerformAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN STATE_MACHINE *S,
-	IN MLME_QUEUE_ELEM *Elem);
-
-VOID Drop(
-	IN  PRTMP_ADAPTER   pAd,
-	IN MLME_QUEUE_ELEM *Elem);
-
-VOID AssocStateMachineInit(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  STATE_MACHINE *Sm,
-	OUT STATE_MACHINE_FUNC Trans[]);
-
-VOID ReassocTimeout(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3);
-
-VOID AssocTimeout(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3);
-
-VOID DisassocTimeout(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3);
-
-//----------------------------------------------
-VOID MlmeDisassocReqAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID MlmeAssocReqAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID MlmeReassocReqAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID MlmeDisassocReqAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID PeerAssocRspAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID PeerReassocRspAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID PeerDisassocAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID DisassocTimeoutAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID AssocTimeoutAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID  ReassocTimeoutAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID  Cls3errAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PUCHAR pAddr);
-
-VOID  InvalidStateWhenAssoc(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID  InvalidStateWhenReassoc(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID InvalidStateWhenDisassociate(
-	IN  PRTMP_ADAPTER pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-
-VOID  ComposePsPoll(
-	IN  PRTMP_ADAPTER   pAd);
-
-VOID  ComposeNullFrame(
-	IN  PRTMP_ADAPTER pAd);
-
-VOID  AssocPostProc(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PUCHAR pAddr2,
-	IN  USHORT CapabilityInfo,
-	IN  USHORT Aid,
-	IN  UCHAR SupRate[],
-	IN  UCHAR SupRateLen,
-	IN  UCHAR ExtRate[],
-	IN  UCHAR ExtRateLen,
-	IN PEDCA_PARM pEdcaParm,
-	IN HT_CAPABILITY_IE		*pHtCapability,
-	IN  UCHAR HtCapabilityLen,
-	IN ADD_HT_INFO_IE		*pAddHtInfo);
-
-VOID AuthStateMachineInit(
-	IN  PRTMP_ADAPTER   pAd,
-	IN PSTATE_MACHINE sm,
-	OUT STATE_MACHINE_FUNC Trans[]);
-
-VOID AuthTimeout(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3);
-
-VOID MlmeAuthReqAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID PeerAuthRspAtSeq2Action(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID PeerAuthRspAtSeq4Action(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID AuthTimeoutAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID Cls2errAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PUCHAR pAddr);
-
-VOID MlmeDeauthReqAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID InvalidStateWhenAuth(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-//=============================================
-
-VOID AuthRspStateMachineInit(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PSTATE_MACHINE Sm,
-	IN  STATE_MACHINE_FUNC Trans[]);
-
-VOID PeerDeauthAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem);
-
-VOID PeerAuthSimpleRspGenAndSend(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PHEADER_802_11  pHdr80211,
-	IN  USHORT Alg,
-	IN  USHORT Seq,
-	IN  USHORT Reason,
-	IN  USHORT Status);
-
-//
-// Private routines in dls.c
-//
-
-#ifdef CONFIG_STA_SUPPORT
-#ifdef QOS_DLS_SUPPORT
-void DlsStateMachineInit(
-    IN PRTMP_ADAPTER pAd,
-    IN STATE_MACHINE *Sm,
-    OUT STATE_MACHINE_FUNC Trans[]);
-
-VOID MlmeDlsReqAction(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem);
-
-VOID PeerDlsReqAction(
-    IN PRTMP_ADAPTER	pAd,
-    IN MLME_QUEUE_ELEM	*Elem);
-
-VOID PeerDlsRspAction(
-    IN PRTMP_ADAPTER	pAd,
-    IN MLME_QUEUE_ELEM	*Elem);
-
-VOID MlmeDlsTearDownAction(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem);
-
-VOID PeerDlsTearDownAction(
-    IN PRTMP_ADAPTER	pAd,
-    IN MLME_QUEUE_ELEM	*Elem);
-
-VOID RTMPCheckDLSTimeOut(
-	IN PRTMP_ADAPTER	pAd);
-
-BOOLEAN RTMPRcvFrameDLSCheck(
-	IN PRTMP_ADAPTER	pAd,
-	IN PHEADER_802_11	pHeader,
-	IN ULONG			Len,
-	IN PRT28XX_RXD_STRUC	pRxD);
-
-INT	RTMPCheckDLSFrame(
-	IN	PRTMP_ADAPTER	pAd,
-	IN  PUCHAR          pDA);
-
-VOID RTMPSendDLSTearDownFrame(
-	IN	PRTMP_ADAPTER	pAd,
-	IN  PUCHAR          pDA);
-
-NDIS_STATUS RTMPSendSTAKeyRequest(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			pDA);
-
-NDIS_STATUS RTMPSendSTAKeyHandShake(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			pDA);
-
-VOID DlsTimeoutAction(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3);
-
-BOOLEAN MlmeDlsReqSanity(
-	IN PRTMP_ADAPTER pAd,
-    IN VOID *Msg,
-    IN ULONG MsgLen,
-    OUT PRT_802_11_DLS *pDLS,
-    OUT PUSHORT pReason);
-
-INT Set_DlsEntryInfo_Display_Proc(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR arg);
-
-MAC_TABLE_ENTRY *MacTableInsertDlsEntry(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PUCHAR	pAddr,
-	IN  UINT	DlsEntryIdx);
-
-BOOLEAN MacTableDeleteDlsEntry(
-	IN PRTMP_ADAPTER pAd,
-	IN USHORT wcid,
-	IN PUCHAR pAddr);
-
-MAC_TABLE_ENTRY *DlsEntryTableLookup(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR	pAddr,
-	IN BOOLEAN	bResetIdelCount);
-
-MAC_TABLE_ENTRY *DlsEntryTableLookupByWcid(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR	wcid,
-	IN PUCHAR	pAddr,
-	IN BOOLEAN	bResetIdelCount);
-
-INT	Set_DlsAddEntry_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT	Set_DlsTearDownEntry_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-#endif // QOS_DLS_SUPPORT //
-#endif // CONFIG_STA_SUPPORT //
-
-#ifdef QOS_DLS_SUPPORT
-BOOLEAN PeerDlsReqSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN VOID *Msg,
-    IN ULONG MsgLen,
-    OUT PUCHAR pDA,
-    OUT PUCHAR pSA,
-    OUT USHORT *pCapabilityInfo,
-    OUT USHORT *pDlsTimeout,
-    OUT UCHAR *pRatesLen,
-    OUT UCHAR Rates[],
-    OUT UCHAR *pHtCapabilityLen,
-    OUT HT_CAPABILITY_IE *pHtCapability);
-
-BOOLEAN PeerDlsRspSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN VOID *Msg,
-    IN ULONG MsgLen,
-    OUT PUCHAR pDA,
-    OUT PUCHAR pSA,
-    OUT USHORT *pCapabilityInfo,
-    OUT USHORT *pStatus,
-    OUT UCHAR *pRatesLen,
-    OUT UCHAR Rates[],
-    OUT UCHAR *pHtCapabilityLen,
-    OUT HT_CAPABILITY_IE *pHtCapability);
-
-BOOLEAN PeerDlsTearDownSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN VOID *Msg,
-    IN ULONG MsgLen,
-    OUT PUCHAR pDA,
-    OUT PUCHAR pSA,
-    OUT USHORT *pReason);
-#endif // QOS_DLS_SUPPORT //
-
-//========================================
-
-VOID SyncStateMachineInit(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  STATE_MACHINE *Sm,
-	OUT STATE_MACHINE_FUNC Trans[]);
-
-VOID BeaconTimeout(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3);
-
-VOID ScanTimeout(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3);
-
-VOID MlmeScanReqAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID InvalidStateWhenScan(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID InvalidStateWhenJoin(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID InvalidStateWhenStart(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID PeerBeacon(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID EnqueueProbeRequest(
-	IN PRTMP_ADAPTER pAd);
-
-BOOLEAN ScanRunning(
-		IN PRTMP_ADAPTER pAd);
-//=========================================
-
-VOID MlmeCntlInit(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  STATE_MACHINE *S,
-	OUT STATE_MACHINE_FUNC Trans[]);
-
-VOID MlmeCntlMachinePerformAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  STATE_MACHINE *S,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID CntlIdleProc(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID CntlOidScanProc(
-	IN  PRTMP_ADAPTER pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID CntlOidSsidProc(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM * Elem);
-
-VOID CntlOidRTBssidProc(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM * Elem);
-
-VOID CntlMlmeRoamingProc(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM * Elem);
-
-VOID CntlWaitDisassocProc(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID CntlWaitJoinProc(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID CntlWaitReassocProc(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID CntlWaitStartProc(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID CntlWaitAuthProc(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID CntlWaitAuthProc2(
-	IN  PRTMP_ADAPTER pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID CntlWaitAssocProc(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-#ifdef QOS_DLS_SUPPORT
-VOID CntlOidDLSSetupProc(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem);
-#endif // QOS_DLS_SUPPORT //
-
-VOID LinkUp(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  UCHAR BssType);
-
-VOID LinkDown(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  BOOLEAN         IsReqFromAP);
-
-VOID IterateOnBssTab(
-	IN  PRTMP_ADAPTER   pAd);
-
-VOID IterateOnBssTab2(
-	IN  PRTMP_ADAPTER   pAd);;
-
-VOID JoinParmFill(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  OUT MLME_JOIN_REQ_STRUCT *JoinReq,
-	IN  ULONG BssIdx);
-
-VOID AssocParmFill(
-	IN  PRTMP_ADAPTER   pAd,
-	IN OUT MLME_ASSOC_REQ_STRUCT *AssocReq,
-	IN  PUCHAR pAddr,
-	IN  USHORT CapabilityInfo,
-	IN  ULONG Timeout,
-	IN  USHORT ListenIntv);
-
-VOID ScanParmFill(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  OUT MLME_SCAN_REQ_STRUCT *ScanReq,
-	IN  STRING Ssid[],
-	IN  UCHAR SsidLen,
-	IN  UCHAR BssType,
-	IN  UCHAR ScanType);
-
-VOID DisassocParmFill(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  OUT MLME_DISASSOC_REQ_STRUCT *DisassocReq,
-	IN  PUCHAR pAddr,
-	IN  USHORT Reason);
-
-VOID StartParmFill(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  OUT MLME_START_REQ_STRUCT *StartReq,
-	IN  CHAR Ssid[],
-	IN  UCHAR SsidLen);
-
-VOID AuthParmFill(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  OUT MLME_AUTH_REQ_STRUCT *AuthReq,
-	IN  PUCHAR pAddr,
-	IN  USHORT Alg);
-
-VOID EnqueuePsPoll(
-	IN  PRTMP_ADAPTER   pAd);
-
-VOID EnqueueBeaconFrame(
-	IN  PRTMP_ADAPTER   pAd);
-
-VOID MlmeJoinReqAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID MlmeScanReqAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID MlmeStartReqAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID ScanTimeoutAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID BeaconTimeoutAtJoinAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID PeerBeaconAtScanAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID PeerBeaconAtJoinAction(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID PeerBeacon(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID PeerProbeReqAction(
-	IN  PRTMP_ADAPTER pAd,
-	IN  MLME_QUEUE_ELEM *Elem);
-
-VOID ScanNextChannel(
-	IN  PRTMP_ADAPTER   pAd);
-
-ULONG MakeIbssBeacon(
-	IN  PRTMP_ADAPTER   pAd);
-
-VOID CCXAdjacentAPReport(
-	IN  PRTMP_ADAPTER   pAd);
-
-BOOLEAN MlmeScanReqSanity(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  VOID *Msg,
-	IN  ULONG MsgLen,
-	OUT UCHAR *BssType,
-	OUT CHAR ssid[],
-	OUT UCHAR *SsidLen,
-	OUT UCHAR *ScanType);
-
-BOOLEAN PeerBeaconAndProbeRspSanity(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  VOID *Msg,
-	IN  ULONG MsgLen,
-	IN  UCHAR MsgChannel,
-	OUT PUCHAR pAddr2,
-	OUT PUCHAR pBssid,
-	OUT CHAR Ssid[],
-	OUT UCHAR *pSsidLen,
-	OUT UCHAR *pBssType,
-	OUT USHORT *pBeaconPeriod,
-	OUT UCHAR *pChannel,
-	OUT UCHAR *pNewChannel,
-	OUT LARGE_INTEGER *pTimestamp,
-	OUT CF_PARM *pCfParm,
-	OUT USHORT *pAtimWin,
-	OUT USHORT *pCapabilityInfo,
-	OUT UCHAR *pErp,
-	OUT UCHAR *pDtimCount,
-	OUT UCHAR *pDtimPeriod,
-	OUT UCHAR *pBcastFlag,
-	OUT UCHAR *pMessageToMe,
-	OUT UCHAR SupRate[],
-	OUT UCHAR *pSupRateLen,
-	OUT UCHAR ExtRate[],
-	OUT UCHAR *pExtRateLen,
-	OUT	UCHAR *pCkipFlag,
-	OUT	UCHAR *pAironetCellPowerLimit,
-	OUT PEDCA_PARM       pEdcaParm,
-	OUT PQBSS_LOAD_PARM  pQbssLoad,
-	OUT PQOS_CAPABILITY_PARM pQosCapability,
-	OUT ULONG *pRalinkIe,
-	OUT UCHAR		 *pHtCapabilityLen,
-#ifdef CONFIG_STA_SUPPORT
-	OUT UCHAR		 *pPreNHtCapabilityLen,
-#endif // CONFIG_STA_SUPPORT //
-	OUT HT_CAPABILITY_IE *pHtCapability,
-	OUT UCHAR		 *AddHtInfoLen,
-	OUT ADD_HT_INFO_IE *AddHtInfo,
-	OUT UCHAR *NewExtChannel,
-	OUT USHORT *LengthVIE,
-	OUT PNDIS_802_11_VARIABLE_IEs pVIE);
-
-BOOLEAN PeerAddBAReqActionSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN VOID *pMsg,
-    IN ULONG MsgLen,
-	OUT PUCHAR pAddr2);
-
-BOOLEAN PeerAddBARspActionSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN VOID *pMsg,
-    IN ULONG MsgLen);
-
-BOOLEAN PeerDelBAActionSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN UCHAR Wcid,
-    IN VOID *pMsg,
-    IN ULONG MsgLen);
-
-BOOLEAN MlmeAssocReqSanity(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  VOID *Msg,
-	IN  ULONG MsgLen,
-	OUT PUCHAR pApAddr,
-	OUT USHORT *CapabilityInfo,
-	OUT ULONG *Timeout,
-	OUT USHORT *ListenIntv);
-
-BOOLEAN MlmeAuthReqSanity(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  VOID *Msg,
-	IN  ULONG MsgLen,
-	OUT PUCHAR pAddr,
-	OUT ULONG *Timeout,
-	OUT USHORT *Alg);
-
-BOOLEAN MlmeStartReqSanity(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  VOID *Msg,
-	IN  ULONG MsgLen,
-	OUT CHAR Ssid[],
-	OUT UCHAR *Ssidlen);
-
-BOOLEAN PeerAuthSanity(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  VOID *Msg,
-	IN  ULONG MsgLen,
-	OUT PUCHAR pAddr,
-	OUT USHORT *Alg,
-	OUT USHORT *Seq,
-	OUT USHORT *Status,
-	OUT CHAR ChlgText[]);
-
-BOOLEAN PeerAssocRspSanity(
-	IN  PRTMP_ADAPTER   pAd,
-    IN VOID *pMsg,
-	IN  ULONG MsgLen,
-	OUT PUCHAR pAddr2,
-	OUT USHORT *pCapabilityInfo,
-	OUT USHORT *pStatus,
-	OUT USHORT *pAid,
-	OUT UCHAR SupRate[],
-	OUT UCHAR *pSupRateLen,
-	OUT UCHAR ExtRate[],
-	OUT UCHAR *pExtRateLen,
-    OUT HT_CAPABILITY_IE		*pHtCapability,
-    OUT ADD_HT_INFO_IE		*pAddHtInfo,	// AP might use this additional ht info IE
-    OUT UCHAR			*pHtCapabilityLen,
-    OUT UCHAR			*pAddHtInfoLen,
-    OUT UCHAR			*pNewExtChannelOffset,
-	OUT PEDCA_PARM pEdcaParm,
-	OUT UCHAR *pCkipFlag);
-
-BOOLEAN PeerDisassocSanity(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  VOID *Msg,
-	IN  ULONG MsgLen,
-	OUT PUCHAR pAddr2,
-	OUT USHORT *Reason);
-
-BOOLEAN PeerWpaMessageSanity(
-    IN	PRTMP_ADAPTER		pAd,
-    IN	PEAPOL_PACKET		pMsg,
-    IN	ULONG				MsgLen,
-    IN	UCHAR				MsgType,
-    IN	MAC_TABLE_ENTRY		*pEntry);
-
-BOOLEAN PeerDeauthSanity(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  VOID *Msg,
-	IN  ULONG MsgLen,
-	OUT PUCHAR pAddr2,
-	OUT USHORT *Reason);
-
-BOOLEAN PeerProbeReqSanity(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  VOID *Msg,
-	IN  ULONG MsgLen,
-	OUT PUCHAR pAddr2,
-	OUT CHAR Ssid[],
-	OUT UCHAR *pSsidLen);
-
-BOOLEAN GetTimBit(
-	IN  CHAR *Ptr,
-	IN  USHORT Aid,
-	OUT UCHAR *TimLen,
-	OUT UCHAR *BcastFlag,
-	OUT UCHAR *DtimCount,
-	OUT UCHAR *DtimPeriod,
-	OUT UCHAR *MessageToMe);
-
-UCHAR ChannelSanity(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR channel);
-
-NDIS_802_11_NETWORK_TYPE NetworkTypeInUseSanity(
-	IN PBSS_ENTRY pBss);
-
-
-BOOLEAN MlmeDelBAReqSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN VOID *Msg,
-    IN ULONG MsgLen);
-
-BOOLEAN MlmeAddBAReqSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN VOID *Msg,
-    IN ULONG MsgLen,
-    OUT PUCHAR pAddr2);
-
-ULONG MakeOutgoingFrame(
-	OUT UCHAR *Buffer,
-	OUT ULONG *Length, ...);
-
-VOID  LfsrInit(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  ULONG Seed);
-
-UCHAR RandomByte(
-	IN  PRTMP_ADAPTER   pAd);
-
-VOID AsicUpdateAutoFallBackTable(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			pTxRate);
-
-VOID  MlmePeriodicExec(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3);
-
-VOID LinkDownExec(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3);
-
-VOID LinkUpExec(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3);
-
-VOID STAMlmePeriodicExec(
-	PRTMP_ADAPTER pAd);
-
-VOID MlmeAutoScan(
-	IN PRTMP_ADAPTER pAd);
-
-VOID MlmeAutoReconnectLastSSID(
-	IN PRTMP_ADAPTER pAd);
-
-BOOLEAN MlmeValidateSSID(
-	IN PUCHAR pSsid,
-	IN UCHAR  SsidLen);
-
-VOID MlmeCheckForRoaming(
-	IN PRTMP_ADAPTER pAd,
-	IN ULONG    Now32);
-
-BOOLEAN MlmeCheckForFastRoaming(
-	IN  PRTMP_ADAPTER   pAd);
-
-VOID MlmeDynamicTxRateSwitching(
-	IN PRTMP_ADAPTER pAd);
-
-VOID MlmeSetTxRate(
-	IN PRTMP_ADAPTER		pAd,
-	IN PMAC_TABLE_ENTRY		pEntry,
-	IN PRTMP_TX_RATE_SWITCH	pTxRate);
-
-VOID MlmeSelectTxRateTable(
-	IN PRTMP_ADAPTER		pAd,
-	IN PMAC_TABLE_ENTRY		pEntry,
-	IN PUCHAR				*ppTable,
-	IN PUCHAR				pTableSize,
-	IN PUCHAR				pInitTxRateIdx);
-
-VOID MlmeCalculateChannelQuality(
-	IN PRTMP_ADAPTER pAd,
-	IN PMAC_TABLE_ENTRY pMacEntry,
-	IN ULONG Now);
-
-VOID MlmeCheckPsmChange(
-	IN PRTMP_ADAPTER pAd,
-	IN ULONG    Now32);
-
-VOID MlmeSetPsmBit(
-	IN PRTMP_ADAPTER pAd,
-	IN USHORT psm);
-
-VOID MlmeSetTxPreamble(
-	IN PRTMP_ADAPTER pAd,
-	IN USHORT TxPreamble);
-
-VOID UpdateBasicRateBitmap(
-	IN	PRTMP_ADAPTER	pAd);
-
-VOID MlmeUpdateTxRates(
-	IN PRTMP_ADAPTER	pAd,
-	IN	BOOLEAN			bLinkUp,
-	IN	UCHAR			apidx);
-
-#ifdef DOT11_N_SUPPORT
-VOID MlmeUpdateHtTxRates(
-	IN PRTMP_ADAPTER		pAd,
-	IN	UCHAR				apidx);
-#endif // DOT11_N_SUPPORT //
-
-VOID    RTMPCheckRates(
-	IN      PRTMP_ADAPTER   pAd,
-	IN OUT  UCHAR           SupRate[],
-	IN OUT  UCHAR           *SupRateLen);
-
-#ifdef CONFIG_STA_SUPPORT
-BOOLEAN RTMPCheckChannel(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR		CentralChannel,
-	IN UCHAR		Channel);
-#endif // CONFIG_STA_SUPPORT //
-
-BOOLEAN		RTMPCheckHt(
-	IN		PRTMP_ADAPTER	pAd,
-	IN		UCHAR	Wcid,
-	IN OUT	HT_CAPABILITY_IE			*pHtCapability,
-	IN OUT	ADD_HT_INFO_IE			*pAddHtInfo);
-
-VOID StaQuickResponeForRateUpExec(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3);
-
-VOID AsicBbpTuning1(
-	IN PRTMP_ADAPTER pAd);
-
-VOID AsicBbpTuning2(
-	IN PRTMP_ADAPTER pAd);
-
-VOID RTMPUpdateMlmeRate(
-	IN PRTMP_ADAPTER	pAd);
-
-CHAR RTMPMaxRssi(
-	IN PRTMP_ADAPTER	pAd,
-	IN CHAR				Rssi0,
-	IN CHAR				Rssi1,
-	IN CHAR				Rssi2);
-
-#ifdef RT30xx
-VOID AsicSetRxAnt(
-	IN PRTMP_ADAPTER	pAd,
-	IN UCHAR			Ant);
-
-VOID RTMPFilterCalibration(
-	IN PRTMP_ADAPTER pAd);
-
-#ifdef RTMP_EFUSE_SUPPORT
-//2008/09/11:KH add to support efuse<--
-INT set_eFuseGetFreeBlockCount_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT set_eFusedump_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT set_eFuseLoadFromBin_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-VOID eFusePhysicalReadRegisters(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	USHORT Offset,
-	IN	USHORT Length,
-	OUT	USHORT* pData);
-
-int RtmpEfuseSupportCheck(
-	IN RTMP_ADAPTER *pAd);
-
-INT set_eFuseBufferModeWriteBack_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT eFuseLoadEEPROM(
-	IN PRTMP_ADAPTER pAd);
-
-INT eFuseWriteEeeppromBuf(
-	IN PRTMP_ADAPTER pAd);
-
-VOID eFuseGetFreeBlockCount(IN PRTMP_ADAPTER pAd,
-	PUINT EfuseFreeBlock);
-
-INT eFuse_init(
-	IN PRTMP_ADAPTER pAd);
-
-NTSTATUS eFuseRead(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	USHORT			Offset,
-	OUT	PUCHAR			pData,
-	IN	USHORT			Length);
-
-NTSTATUS eFuseWrite(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	USHORT			Offset,
-	IN	PUCHAR			pData,
-	IN	USHORT			length);
-//2008/09/11:KH add to support efuse-->
-#endif // RTMP_EFUSE_SUPPORT //
-
-// add by johnli, RF power sequence setup
-VOID RT30xxLoadRFNormalModeSetup(
-	IN PRTMP_ADAPTER	pAd);
-
-VOID RT30xxLoadRFSleepModeSetup(
-	IN PRTMP_ADAPTER	pAd);
-
-VOID RT30xxReverseRFSleepModeSetup(
-	IN PRTMP_ADAPTER	pAd);
-// end johnli
-
-
-#ifdef RT3090
-VOID NICInitRT3090RFRegisters(
-	IN RTMP_ADAPTER *pAd);
-#endif // RT3090 //
-
-VOID RT30xxHaltAction(
-	IN PRTMP_ADAPTER	pAd);
-
-VOID RT30xxSetRxAnt(
-	IN PRTMP_ADAPTER	pAd,
-	IN UCHAR			Ant);
-#endif // RT30xx //
-#ifdef RT33xx
-VOID RT33xxLoadRFNormalModeSetup(
-	IN PRTMP_ADAPTER	pAd);
-
-VOID RT33xxLoadRFSleepModeSetup(
-	IN PRTMP_ADAPTER	pAd);
-
-VOID RT33xxReverseRFSleepModeSetup(
-	IN PRTMP_ADAPTER	pAd);
-
-#ifdef RT3370
-VOID NICInitRT3370RFRegisters(
-	IN RTMP_ADAPTER *pAd);
-#endif // RT3070 //
-
-#ifdef RT3390
-VOID NICInitRT3390RFRegisters(
-	IN RTMP_ADAPTER *pAd);
-#endif // RT3090 //
-
-VOID RT33xxHaltAction(
-	IN PRTMP_ADAPTER	pAd);
-
-VOID RT33xxSetRxAnt(
-	IN PRTMP_ADAPTER	pAd,
-	IN UCHAR			Ant);
-
-#endif // RT33xx //
-
-
-
-VOID AsicEvaluateRxAnt(
-	IN PRTMP_ADAPTER	pAd);
-
-VOID AsicRxAntEvalTimeout(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3);
-
-VOID APSDPeriodicExec(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3);
-
-BOOLEAN RTMPCheckEntryEnableAutoRateSwitch(
-	IN PRTMP_ADAPTER    pAd,
-	IN PMAC_TABLE_ENTRY	pEntry);
-
-UCHAR RTMPStaFixedTxMode(
-	IN PRTMP_ADAPTER    pAd,
-	IN PMAC_TABLE_ENTRY	pEntry);
-
-VOID RTMPUpdateLegacyTxSetting(
-		UCHAR				fixed_tx_mode,
-		PMAC_TABLE_ENTRY	pEntry);
-
-BOOLEAN RTMPAutoRateSwitchCheck(
-	IN PRTMP_ADAPTER    pAd);
-
-NDIS_STATUS MlmeInit(
-	IN  PRTMP_ADAPTER   pAd);
-
-VOID MlmeHandler(
-	IN  PRTMP_ADAPTER   pAd);
-
-VOID MlmeHalt(
-	IN  PRTMP_ADAPTER   pAd);
-
-VOID MlmeResetRalinkCounters(
-	IN  PRTMP_ADAPTER   pAd);
-
-VOID BuildChannelList(
-	IN PRTMP_ADAPTER pAd);
-
-UCHAR FirstChannel(
-	IN  PRTMP_ADAPTER   pAd);
-
-UCHAR NextChannel(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  UCHAR channel);
-
-VOID ChangeToCellPowerLimit(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR         AironetCellPowerLimit);
-
-//
-// Prototypes of function definition in rtmp_tkip.c
-//
-VOID    RTMPInitTkipEngine(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PUCHAR          pTKey,
-	IN  UCHAR           KeyId,
-	IN  PUCHAR          pTA,
-	IN  PUCHAR          pMICKey,
-	IN  PUCHAR          pTSC,
-	OUT PULONG          pIV16,
-	OUT PULONG          pIV32);
-
-VOID    RTMPInitMICEngine(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PUCHAR          pKey,
-	IN  PUCHAR          pDA,
-	IN  PUCHAR          pSA,
-	IN  UCHAR           UserPriority,
-	IN  PUCHAR          pMICKey);
-
-BOOLEAN RTMPTkipCompareMICValue(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PUCHAR          pSrc,
-	IN  PUCHAR          pDA,
-	IN  PUCHAR          pSA,
-	IN  PUCHAR          pMICKey,
-	IN	UCHAR			UserPriority,
-	IN  UINT            Len);
-
-VOID    RTMPCalculateMICValue(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PNDIS_PACKET    pPacket,
-	IN  PUCHAR          pEncap,
-	IN  PCIPHER_KEY     pKey,
-	IN	UCHAR			apidx);
-
-BOOLEAN RTMPTkipCompareMICValueWithLLC(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PUCHAR          pLLC,
-	IN  PUCHAR          pSrc,
-	IN  PUCHAR          pDA,
-	IN  PUCHAR          pSA,
-	IN  PUCHAR          pMICKey,
-	IN  UINT            Len);
-
-VOID    RTMPTkipAppendByte(
-	IN  PTKIP_KEY_INFO  pTkip,
-	IN  UCHAR           uChar);
-
-VOID    RTMPTkipAppend(
-	IN  PTKIP_KEY_INFO  pTkip,
-	IN  PUCHAR          pSrc,
-	IN  UINT            nBytes);
-
-VOID    RTMPTkipGetMIC(
-	IN  PTKIP_KEY_INFO  pTkip);
-
-BOOLEAN RTMPSoftDecryptTKIP(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR	pData,
-	IN ULONG	DataByteCnt,
-	IN UCHAR    UserPriority,
-	IN PCIPHER_KEY	pWpaKey);
-
-BOOLEAN RTMPSoftDecryptAES(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR	pData,
-	IN ULONG	DataByteCnt,
-	IN PCIPHER_KEY	pWpaKey);
-
-
-
-//
-// Prototypes of function definition in cmm_info.c
-//
-INT RT_CfgSetCountryRegion(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg,
-	IN INT				band);
-
-INT RT_CfgSetWirelessMode(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT RT_CfgSetShortSlot(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT	RT_CfgSetWepKey(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			keyString,
-	IN	CIPHER_KEY		*pSharedKey,
-	IN	INT				keyIdx);
-
-INT RT_CfgSetWPAPSKKey(
-	IN RTMP_ADAPTER	*pAd,
-	IN PSTRING		keyString,
-	IN UCHAR		*pHashStr,
-	IN INT			hashStrLen,
-	OUT PUCHAR		pPMKBuf);
-
-
-
-//
-// Prototypes of function definition in cmm_info.c
-//
-NDIS_STATUS RTMPWPARemoveKeyProc(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PVOID           pBuf);
-
-VOID    RTMPWPARemoveAllKeys(
-	IN  PRTMP_ADAPTER   pAd);
-
-BOOLEAN RTMPCheckStrPrintAble(
-    IN  CHAR *pInPutStr,
-    IN  UCHAR strLen);
-
-VOID    RTMPSetPhyMode(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  ULONG phymode);
-
-VOID	RTMPUpdateHTIE(
-	IN	RT_HT_CAPABILITY	*pRtHt,
-	IN		UCHAR				*pMcsSet,
-	OUT		HT_CAPABILITY_IE *pHtCapability,
-	OUT		ADD_HT_INFO_IE		*pAddHtInfo);
-
-VOID	RTMPAddWcidAttributeEntry(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			BssIdx,
-	IN	UCHAR			KeyIdx,
-	IN	UCHAR			CipherAlg,
-	IN	MAC_TABLE_ENTRY *pEntry);
-
-PSTRING GetEncryptType(
-	CHAR enc);
-
-PSTRING GetAuthMode(
-	CHAR auth);
-
-
-VOID RTMPIndicateWPA2Status(
-	IN  PRTMP_ADAPTER  pAdapter);
-
-VOID	RTMPOPModeSwitching(
-	IN	PRTMP_ADAPTER	pAd);
-
-
-#ifdef DOT11_N_SUPPORT
-VOID	RTMPSetHT(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	OID_SET_HT_PHYMODE *pHTPhyMode);
-
-VOID	RTMPSetIndividualHT(
-	IN	PRTMP_ADAPTER		pAd,
-	IN	UCHAR				apidx);
-#endif // DOT11_N_SUPPORT //
-
-VOID RTMPSendWirelessEvent(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	USHORT			Event_flag,
-	IN	PUCHAR			pAddr,
-	IN  UCHAR			BssIdx,
-	IN	CHAR			Rssi);
-
-VOID	NICUpdateCntlCounters(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PHEADER_802_11	pHeader,
-	IN    UCHAR			SubType,
-	IN	PRXWI_STRUC	pRxWI);
-
-VOID    DBGPRINT_TX_RING(
-	IN PRTMP_ADAPTER  pAd,
-	IN UCHAR          QueIdx);
-
-VOID DBGPRINT_RX_RING(
-	IN PRTMP_ADAPTER  pAd);
-
-CHAR    ConvertToRssi(
-	IN PRTMP_ADAPTER  pAd,
-	IN CHAR				Rssi,
-	IN UCHAR    RssiNumber);
-
-
-#ifdef DOT11N_DRAFT3
-VOID BuildEffectedChannelList(
-	IN PRTMP_ADAPTER pAd);
-#endif // DOT11N_DRAFT3 //
-
-
-VOID APAsicEvaluateRxAnt(
-	IN PRTMP_ADAPTER	pAd);
-
-#ifdef ANT_DIVERSITY_SUPPORT
-VOID	APAsicAntennaAvg(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR	              AntSelect,
-	IN	SHORT	              *RssiAvg);
-#endif // ANT_DIVERSITY_SUPPORT //
-
-VOID APAsicRxAntEvalTimeout(
-	IN PRTMP_ADAPTER	pAd);
-
-/*===================================
-	Function prototype in cmm_wpa.c
-  =================================== */
-VOID	RTMPToWirelessSta(
-    IN  PRTMP_ADAPTER		pAd,
-    IN  PMAC_TABLE_ENTRY	pEntry,
-    IN  PUCHAR			pHeader802_3,
-    IN  UINT			HdrLen,
-    IN  PUCHAR			pData,
-    IN  UINT			DataLen,
-    IN	BOOLEAN				bClearFrame);
-
-VOID WpaDerivePTK(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  UCHAR   *PMK,
-	IN  UCHAR   *ANonce,
-	IN  UCHAR   *AA,
-	IN  UCHAR   *SNonce,
-	IN  UCHAR   *SA,
-	OUT UCHAR   *output,
-	IN  UINT    len);
-
-VOID    GenRandom(
-	IN  PRTMP_ADAPTER   pAd,
-	IN	UCHAR			*macAddr,
-	OUT	UCHAR			*random);
-
-BOOLEAN RTMPCheckWPAframe(
-	IN PRTMP_ADAPTER pAd,
-	IN PMAC_TABLE_ENTRY	pEntry,
-	IN PUCHAR			pData,
-	IN ULONG			DataByteCount,
-	IN UCHAR			FromWhichBSSID);
-
-VOID AES_GTK_KEY_UNWRAP(
-	IN  UCHAR   *key,
-	OUT UCHAR   *plaintext,
-	IN	UINT32	c_len,
-	IN  UCHAR   *ciphertext);
-
-BOOLEAN RTMPParseEapolKeyData(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PUCHAR          pKeyData,
-	IN  UCHAR           KeyDataLen,
-	IN	UCHAR			GroupKeyIndex,
-	IN	UCHAR			MsgType,
-	IN	BOOLEAN			bWPA2,
-	IN  MAC_TABLE_ENTRY *pEntry);
-
-VOID	ConstructEapolMsg(
-	IN	PMAC_TABLE_ENTRY	pEntry,
-    IN	UCHAR				GroupKeyWepStatus,
-    IN	UCHAR				MsgType,
-    IN	UCHAR				DefaultKeyIdx,
-	IN	UCHAR				*KeyNonce,
-	IN	UCHAR				*TxRSC,
-	IN	UCHAR				*GTK,
-	IN	UCHAR				*RSNIE,
-	IN	UCHAR				RSNIE_Len,
-    OUT PEAPOL_PACKET       pMsg);
-
-NDIS_STATUS	RTMPSoftDecryptBroadCastData(
-	IN	PRTMP_ADAPTER					pAd,
-	IN	RX_BLK							*pRxBlk,
-	IN  NDIS_802_11_ENCRYPTION_STATUS	GroupCipher,
-	IN  PCIPHER_KEY						pShard_key);
-
-VOID RTMPMakeRSNIE(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  UINT            AuthMode,
-	IN  UINT            WepStatus,
-	IN	UCHAR			apidx);
-
-//
-// function prototype in ap_wpa.c
-//
-VOID RTMPGetTxTscFromAsic(
-	IN  PRTMP_ADAPTER   pAd,
-	IN	UCHAR			apidx,
-	OUT	PUCHAR			pTxTsc);
-
-VOID APInstallPairwiseKey(
-	PRTMP_ADAPTER		pAd,
-	PMAC_TABLE_ENTRY	pEntry);
-
-MAC_TABLE_ENTRY *PACInquiry(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  ULONG           Wcid);
-
-UINT	APValidateRSNIE(
-	IN PRTMP_ADAPTER    pAd,
-	IN PMAC_TABLE_ENTRY pEntry,
-	IN PUCHAR			pRsnIe,
-	IN UCHAR			rsnie_len);
-
-VOID HandleCounterMeasure(
-	IN PRTMP_ADAPTER pAd,
-	IN MAC_TABLE_ENTRY  *pEntry);
-
-VOID WPAStart4WayHS(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MAC_TABLE_ENTRY *pEntry,
-	IN	ULONG			TimeInterval);
-
-VOID WPAStart2WayGroupHS(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  MAC_TABLE_ENTRY *pEntry);
-
-VOID PeerPairMsg1Action(
-	IN PRTMP_ADAPTER pAd,
-	IN MAC_TABLE_ENTRY  *pEntry,
-	IN MLME_QUEUE_ELEM *Elem);
-
-VOID PeerPairMsg2Action(
-	IN PRTMP_ADAPTER pAd,
-	IN MAC_TABLE_ENTRY  *pEntry,
-	IN MLME_QUEUE_ELEM *Elem);
-
-VOID PeerPairMsg3Action(
-	IN PRTMP_ADAPTER pAd,
-	IN MAC_TABLE_ENTRY  *pEntry,
-	IN MLME_QUEUE_ELEM *Elem);
-
-VOID PeerPairMsg4Action(
-	IN PRTMP_ADAPTER pAd,
-	IN MAC_TABLE_ENTRY  *pEntry,
-	IN MLME_QUEUE_ELEM *Elem);
-
-VOID PeerGroupMsg1Action(
-	IN  PRTMP_ADAPTER    pAd,
-	IN  PMAC_TABLE_ENTRY pEntry,
-    IN  MLME_QUEUE_ELEM  *Elem);
-
-VOID PeerGroupMsg2Action(
-	IN  PRTMP_ADAPTER    pAd,
-	IN  PMAC_TABLE_ENTRY pEntry,
-	IN  VOID             *Msg,
-	IN  UINT             MsgLen);
-
-VOID CMTimerExec(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3);
-
-VOID WPARetryExec(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3);
-
-VOID EnqueueStartForPSKExec(
-    IN PVOID SystemSpecific1,
-    IN PVOID FunctionContext,
-    IN PVOID SystemSpecific2,
-    IN PVOID SystemSpecific3);
-
-VOID RTMPHandleSTAKey(
-    IN PRTMP_ADAPTER    pAdapter,
-    IN MAC_TABLE_ENTRY  *pEntry,
-    IN MLME_QUEUE_ELEM  *Elem);
-
-VOID PairDisAssocAction(
-	IN  PRTMP_ADAPTER    pAd,
-	IN  PMAC_TABLE_ENTRY pEntry,
-	IN  USHORT           Reason);
-
-VOID MlmeDeAuthAction(
-	IN  PRTMP_ADAPTER    pAd,
-	IN  PMAC_TABLE_ENTRY pEntry,
-	IN  USHORT           Reason);
-
-VOID GREKEYPeriodicExec(
-	IN  PVOID   SystemSpecific1,
-	IN  PVOID   FunctionContext,
-	IN  PVOID   SystemSpecific2,
-	IN  PVOID   SystemSpecific3);
-
-VOID WpaDeriveGTK(
-	IN  UCHAR   *PMK,
-	IN  UCHAR   *GNonce,
-	IN  UCHAR   *AA,
-	OUT UCHAR   *output,
-	IN  UINT    len);
-
-VOID AES_GTK_KEY_WRAP(
-	IN UCHAR *key,
-	IN UCHAR *plaintext,
-	IN UINT32 p_len,
-	OUT UCHAR *ciphertext);
-
-VOID AES_128_CMAC(
-	IN	PUCHAR	key,
-	IN	PUCHAR	input,
-	IN	INT		len,
-	OUT	PUCHAR	mac);
-
-VOID    WpaSend(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  PUCHAR          pPacket,
-    IN  ULONG           Len);
-
-VOID RTMPAddPMKIDCache(
-	IN  PRTMP_ADAPTER		pAd,
-	IN	INT						apidx,
-	IN	PUCHAR				pAddr,
-	IN	UCHAR					*PMKID,
-	IN	UCHAR					*PMK);
-
-INT RTMPSearchPMKIDCache(
-	IN  PRTMP_ADAPTER   pAd,
-	IN	INT				apidx,
-	IN	PUCHAR		pAddr);
-
-VOID RTMPDeletePMKIDCache(
-	IN  PRTMP_ADAPTER   pAd,
-	IN	INT				apidx,
-	IN  INT				idx);
-
-VOID RTMPMaintainPMKIDCache(
-	IN  PRTMP_ADAPTER   pAd);
-
-VOID	RTMPSendTriggerFrame(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PVOID			pBuffer,
-	IN	ULONG			Length,
-	IN  UCHAR           TxRate,
-	IN	BOOLEAN			bQosNull);
-
-//typedef void (*TIMER_FUNCTION)(unsigned long);
-
-
-/* timeout -- ms */
-VOID RTMP_SetPeriodicTimer(
-	IN	NDIS_MINIPORT_TIMER *pTimer,
-	IN	unsigned long timeout);
-
-VOID RTMP_OS_Init_Timer(
-	IN	PRTMP_ADAPTER pAd,
-	IN	NDIS_MINIPORT_TIMER *pTimer,
-	IN	TIMER_FUNCTION function,
-	IN	PVOID data);
-
-VOID RTMP_OS_Add_Timer(
-	IN	NDIS_MINIPORT_TIMER	*pTimer,
-	IN	unsigned long timeout);
-
-VOID RTMP_OS_Mod_Timer(
-	IN	NDIS_MINIPORT_TIMER	*pTimer,
-	IN	unsigned long timeout);
-
-
-VOID RTMP_OS_Del_Timer(
-	IN	NDIS_MINIPORT_TIMER	*pTimer,
-	OUT	BOOLEAN				 *pCancelled);
-
-
-VOID RTMP_OS_Release_Packet(
-	IN	PRTMP_ADAPTER pAd,
-	IN	PQUEUE_ENTRY  pEntry);
-
-VOID RTMPusecDelay(
-	IN	ULONG	usec);
-
-NDIS_STATUS os_alloc_mem(
-	IN	RTMP_ADAPTER *pAd,
-	OUT	UCHAR **mem,
-	IN	ULONG  size);
-
-NDIS_STATUS os_free_mem(
-	IN	PRTMP_ADAPTER pAd,
-	IN	PVOID mem);
-
-
-void RTMP_AllocateSharedMemory(
-	IN	PRTMP_ADAPTER pAd,
-	IN	ULONG	Length,
-	IN	BOOLEAN	Cached,
-	OUT	PVOID	*VirtualAddress,
-	OUT	PNDIS_PHYSICAL_ADDRESS PhysicalAddress);
-
-VOID RTMPFreeTxRxRingMemory(
-    IN  PRTMP_ADAPTER   pAd);
-
-NDIS_STATUS AdapterBlockAllocateMemory(
-	IN PVOID	handle,
-	OUT	PVOID	*ppAd);
-
-void RTMP_AllocateTxDescMemory(
-	IN	PRTMP_ADAPTER pAd,
-	IN	UINT	Index,
-	IN	ULONG	Length,
-	IN	BOOLEAN	Cached,
-	OUT	PVOID	*VirtualAddress,
-	OUT	PNDIS_PHYSICAL_ADDRESS PhysicalAddress);
-
-void RTMP_AllocateFirstTxBuffer(
-	IN	PRTMP_ADAPTER pAd,
-	IN	UINT	Index,
-	IN	ULONG	Length,
-	IN	BOOLEAN	Cached,
-	OUT	PVOID	*VirtualAddress,
-	OUT	PNDIS_PHYSICAL_ADDRESS PhysicalAddress);
-
-void RTMP_FreeFirstTxBuffer(
-	IN	PRTMP_ADAPTER pAd,
-	IN	ULONG	Length,
-	IN	BOOLEAN	Cached,
-	IN	PVOID	VirtualAddress,
-	IN	NDIS_PHYSICAL_ADDRESS PhysicalAddress);
-
-void RTMP_AllocateMgmtDescMemory(
-	IN	PRTMP_ADAPTER pAd,
-	IN	ULONG	Length,
-	IN	BOOLEAN	Cached,
-	OUT	PVOID	*VirtualAddress,
-	OUT	PNDIS_PHYSICAL_ADDRESS PhysicalAddress);
-
-void RTMP_AllocateRxDescMemory(
-	IN	PRTMP_ADAPTER pAd,
-	IN	ULONG	Length,
-	IN	BOOLEAN	Cached,
-	OUT	PVOID	*VirtualAddress,
-	OUT	PNDIS_PHYSICAL_ADDRESS PhysicalAddress);
-
-void RTMP_FreeDescMemory(
-	IN	PRTMP_ADAPTER pAd,
-	IN	ULONG	Length,
-	IN	PVOID	VirtualAddress,
-	IN	NDIS_PHYSICAL_ADDRESS PhysicalAddress);
-
-PNDIS_PACKET RtmpOSNetPktAlloc(
-	IN RTMP_ADAPTER *pAd,
-	IN int size);
-
-PNDIS_PACKET RTMP_AllocateRxPacketBuffer(
-	IN	PRTMP_ADAPTER pAd,
-	IN	ULONG	Length,
-	IN	BOOLEAN	Cached,
-	OUT	PVOID	*VirtualAddress,
-	OUT	PNDIS_PHYSICAL_ADDRESS PhysicalAddress);
-
-PNDIS_PACKET RTMP_AllocateTxPacketBuffer(
-	IN	PRTMP_ADAPTER pAd,
-	IN	ULONG	Length,
-	IN	BOOLEAN	Cached,
-	OUT	PVOID	*VirtualAddress);
-
-PNDIS_PACKET RTMP_AllocateFragPacketBuffer(
-	IN	PRTMP_ADAPTER pAd,
-	IN	ULONG	Length);
-
-void RTMP_QueryPacketInfo(
-	IN  PNDIS_PACKET pPacket,
-	OUT PACKET_INFO  *pPacketInfo,
-	OUT PUCHAR		 *pSrcBufVA,
-	OUT	UINT		 *pSrcBufLen);
-
-void RTMP_QueryNextPacketInfo(
-	IN  PNDIS_PACKET *ppPacket,
-	OUT PACKET_INFO  *pPacketInfo,
-	OUT PUCHAR		 *pSrcBufVA,
-	OUT	UINT		 *pSrcBufLen);
-
-
-BOOLEAN RTMP_FillTxBlkInfo(
-	IN RTMP_ADAPTER *pAd,
-	IN TX_BLK *pTxBlk);
-
-
-PRTMP_SCATTER_GATHER_LIST
-rt_get_sg_list_from_packet(PNDIS_PACKET pPacket, RTMP_SCATTER_GATHER_LIST *sg);
-
-
- void announce_802_3_packet(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PNDIS_PACKET	pPacket);
-
-
-UINT BA_Reorder_AMSDU_Annnounce(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PNDIS_PACKET	pPacket);
-
-
-UINT Handle_AMSDU_Packet(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			pData,
-	IN	ULONG			DataSize,
-	IN  UCHAR			FromWhichBSSID);
-
-
-void convert_802_11_to_802_3_packet(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PNDIS_PACKET	pPacket,
-	IN	PUCHAR			p8023hdr,
-	IN	PUCHAR			pData,
-	IN	ULONG			DataSize,
-	IN  UCHAR			FromWhichBSSID);
-
-
-PNET_DEV get_netdev_from_bssid(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			FromWhichBSSID);
-
-
-PNDIS_PACKET duplicate_pkt(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			pHeader802_3,
-    IN  UINT            HdrLen,
-	IN	PUCHAR			pData,
-	IN	ULONG			DataSize,
-	IN	UCHAR			FromWhichBSSID);
-
-
-PNDIS_PACKET duplicate_pkt_with_TKIP_MIC(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PNDIS_PACKET	pOldPkt);
-
-PNDIS_PACKET duplicate_pkt_with_VLAN(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			pHeader802_3,
-    IN  UINT            HdrLen,
-	IN	PUCHAR			pData,
-	IN	ULONG			DataSize,
-	IN	UCHAR			FromWhichBSSID);
-
-
-UCHAR VLAN_8023_Header_Copy(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			pHeader802_3,
-	IN	UINT            HdrLen,
-	OUT PUCHAR			pData,
-	IN	UCHAR			FromWhichBSSID);
-
-#ifdef DOT11_N_SUPPORT
-void ba_flush_reordering_timeout_mpdus(
-	IN PRTMP_ADAPTER	pAd,
-	IN PBA_REC_ENTRY	pBAEntry,
-	IN ULONG			Now32);
-
-
-VOID BAOriSessionSetUp(
-			IN PRTMP_ADAPTER    pAd,
-			IN MAC_TABLE_ENTRY	*pEntry,
-			IN UCHAR			TID,
-			IN USHORT			TimeOut,
-			IN ULONG			DelayTime,
-			IN BOOLEAN		isForced);
-
-VOID BASessionTearDownALL(
-	IN OUT	PRTMP_ADAPTER pAd,
-	IN		UCHAR Wcid);
-#endif // DOT11_N_SUPPORT //
-
-BOOLEAN OS_Need_Clone_Packet(void);
-
-
-VOID build_tx_packet(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PNDIS_PACKET	pPacket,
-	IN	PUCHAR	pFrame,
-	IN	ULONG	FrameLen);
-
-
-VOID BAOriSessionTearDown(
-	IN OUT	PRTMP_ADAPTER	pAd,
-	IN		UCHAR			Wcid,
-	IN		UCHAR			TID,
-	IN		BOOLEAN			bPassive,
-	IN		BOOLEAN			bForceSend);
-
-VOID BARecSessionTearDown(
-	IN OUT	PRTMP_ADAPTER	pAd,
-	IN		UCHAR			Wcid,
-	IN		UCHAR			TID,
-	IN		BOOLEAN			bPassive);
-
-BOOLEAN ba_reordering_resource_init(PRTMP_ADAPTER pAd, int num);
-void ba_reordering_resource_release(PRTMP_ADAPTER pAd);
-
-
-
-#ifdef NINTENDO_AP
-VOID	InitNINTENDO_TABLE(
-	IN PRTMP_ADAPTER pAd);
-
-UCHAR	CheckNINTENDO_TABLE(
-	IN PRTMP_ADAPTER pAd,
-	PCHAR pDS_Ssid,
-	UCHAR DS_SsidLen,
-	PUCHAR pDS_Addr);
-
-UCHAR	DelNINTENDO_ENTRY(
-	IN	PRTMP_ADAPTER pAd,
-	UCHAR * pDS_Addr);
-
-VOID	RTMPIoctlNintendoCapable(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	struct iwreq	*wrq);
-
-VOID	RTMPIoctlNintendoGetTable(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	struct iwreq	*wrq);
-
-VOID	RTMPIoctlNintendoSetTable(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	struct iwreq	*wrq);
-
-#endif // NINTENDO_AP //
-
-BOOLEAN rtstrmactohex(
-	IN PSTRING s1,
-	IN PSTRING s2);
-
-BOOLEAN rtstrcasecmp(
-	IN PSTRING s1,
-	IN PSTRING s2);
-
-PSTRING rtstrstruncasecmp(
-	IN PSTRING s1,
-	IN PSTRING s2);
-
-PSTRING rtstrstr(
-	IN	const PSTRING s1,
-	IN	const PSTRING s2);
-
-PSTRING rstrtok(
-	IN PSTRING s,
-	IN const PSTRING ct);
-
-int rtinet_aton(
-	const PSTRING cp,
-	unsigned int *addr);
-
-////////// common ioctl functions //////////
-INT Set_DriverVersion_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT Set_CountryRegion_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT Set_CountryRegionABand_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT Set_WirelessMode_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT Set_Channel_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT	Set_ShortSlot_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT	Set_TxPower_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT Set_BGProtection_Proc(
-	IN  PRTMP_ADAPTER		pAd,
-	IN  PSTRING			arg);
-
-INT Set_TxPreamble_Proc(
-	IN  PRTMP_ADAPTER		pAd,
-	IN  PSTRING			arg);
-
-INT Set_RTSThreshold_Proc(
-	IN  PRTMP_ADAPTER		pAd,
-	IN  PSTRING			arg);
-
-INT Set_FragThreshold_Proc(
-	IN  PRTMP_ADAPTER		pAd,
-	IN  PSTRING			arg);
-
-INT Set_TxBurst_Proc(
-	IN  PRTMP_ADAPTER		pAd,
-	IN  PSTRING			arg);
-
-#ifdef AGGREGATION_SUPPORT
-INT	Set_PktAggregate_Proc(
-	IN  PRTMP_ADAPTER		pAd,
-	IN  PSTRING			arg);
-#endif // AGGREGATION_SUPPORT //
-
-#ifdef INF_AMAZON_PPA
-INT	Set_INF_AMAZON_SE_PPA_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg);
-
-#endif // INF_AMAZON_PPA //
-
-INT	Set_IEEE80211H_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-#ifdef DBG
-INT	Set_Debug_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-#endif
-
-INT	Show_DescInfo_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT	Set_ResetStatCounter_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-#ifdef DOT11_N_SUPPORT
-INT	Set_BASetup_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT	Set_BADecline_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT	Set_BAOriTearDown_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT	Set_BARecTearDown_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT	Set_HtBw_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT	Set_HtMcs_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT	Set_HtGi_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT	Set_HtOpMode_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT	Set_HtStbc_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT	Set_HtHtc_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT	Set_HtExtcha_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT	Set_HtMpduDensity_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT	Set_HtBaWinSize_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT	Set_HtRdg_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT	Set_HtLinkAdapt_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT	Set_HtAmsdu_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT	Set_HtAutoBa_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT	Set_HtProtect_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT	Set_HtMimoPs_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-
-INT	Set_ForceShortGI_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT	Set_ForceGF_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT	SetCommonHT(
-	IN	PRTMP_ADAPTER	pAd);
-
-INT	Set_SendPSMPAction_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT	Set_HtMIMOPSmode_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-
-INT	Set_HtTxBASize_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT	Set_HtDisallowTKIP_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-#endif // DOT11_N_SUPPORT //
-
-
-
-#ifdef CONFIG_STA_SUPPORT
-//Dls ,	kathy
-VOID RTMPSendDLSTearDownFrame(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			pDA);
-
-#ifdef DOT11_N_SUPPORT
-//Block ACK
-VOID QueryBATABLE(
-	IN  PRTMP_ADAPTER pAd,
-	OUT PQUERYBA_TABLE pBAT);
-#endif // DOT11_N_SUPPORT //
-
-#ifdef WPA_SUPPLICANT_SUPPORT
-INT	    WpaCheckEapCode(
-	IN  PRTMP_ADAPTER	pAd,
-	IN  PUCHAR				pFrame,
-	IN  USHORT				FrameLen,
-	IN  USHORT				OffSet);
-
-VOID    WpaSendMicFailureToWpaSupplicant(
-    IN  PRTMP_ADAPTER       pAd,
-    IN  BOOLEAN             bUnicast);
-
-VOID    SendAssocIEsToWpaSupplicant(
-    IN  PRTMP_ADAPTER       pAd);
-#endif // WPA_SUPPLICANT_SUPPORT //
-
-#ifdef NATIVE_WPA_SUPPLICANT_SUPPORT
-int wext_notify_event_assoc(
-	IN  RTMP_ADAPTER *pAd);
-#endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
-
-#endif // CONFIG_STA_SUPPORT //
-
-
-
-#ifdef DOT11_N_SUPPORT
-VOID Handle_BSS_Width_Trigger_Events(
-	IN PRTMP_ADAPTER pAd);
-
-void build_ext_channel_switch_ie(
-	IN PRTMP_ADAPTER pAd,
-	IN HT_EXT_CHANNEL_SWITCH_ANNOUNCEMENT_IE *pIE);
-#endif // DOT11_N_SUPPORT //
-
-
-BOOLEAN APRxDoneInterruptHandle(
-	IN	PRTMP_ADAPTER	pAd);
-
-BOOLEAN STARxDoneInterruptHandle(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	BOOLEAN			argc);
-
-#ifdef DOT11_N_SUPPORT
-// AMPDU packet indication
-VOID Indicate_AMPDU_Packet(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	RX_BLK			*pRxBlk,
-	IN	UCHAR			FromWhichBSSID);
-
-// AMSDU packet indication
-VOID Indicate_AMSDU_Packet(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	RX_BLK			*pRxBlk,
-	IN	UCHAR			FromWhichBSSID);
-#endif // DOT11_N_SUPPORT //
-
-// Normal legacy Rx packet indication
-VOID Indicate_Legacy_Packet(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	RX_BLK			*pRxBlk,
-	IN	UCHAR			FromWhichBSSID);
-
-VOID Indicate_EAPOL_Packet(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	RX_BLK			*pRxBlk,
-	IN	UCHAR			FromWhichBSSID);
-
-void  update_os_packet_info(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	RX_BLK			*pRxBlk,
-	IN	UCHAR			FromWhichBSSID);
-
-void wlan_802_11_to_802_3_packet(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	RX_BLK			*pRxBlk,
-	IN	PUCHAR			pHeader802_3,
-	IN  UCHAR			FromWhichBSSID);
-
-UINT deaggregate_AMSDU_announce(
-	IN	PRTMP_ADAPTER	pAd,
-	PNDIS_PACKET		pPacket,
-	IN	PUCHAR			pData,
-	IN	ULONG			DataSize);
-
-
-#ifdef CONFIG_STA_SUPPORT
-// remove LLC and get 802_3 Header
-#define  RTMP_802_11_REMOVE_LLC_AND_CONVERT_TO_802_3(_pRxBlk, _pHeader802_3)	\
-{																				\
-	PUCHAR _pRemovedLLCSNAP = NULL, _pDA, _pSA;                                 \
-																				\
-	if (RX_BLK_TEST_FLAG(_pRxBlk, fRX_MESH))                                    \
-	{                                                                           \
-		_pDA = _pRxBlk->pHeader->Addr3;                                         \
-		_pSA = (PUCHAR)_pRxBlk->pHeader + sizeof(HEADER_802_11);                \
-	}                                                                           \
-	else                                                                        \
-	{                                                                           \
-		if (RX_BLK_TEST_FLAG(_pRxBlk, fRX_INFRA))				\
-		{                                                                       \
-			_pDA = _pRxBlk->pHeader->Addr1;                                     \
-		if (RX_BLK_TEST_FLAG(_pRxBlk, fRX_DLS))									\
-			_pSA = _pRxBlk->pHeader->Addr2;										\
-		else																	\
-			_pSA = _pRxBlk->pHeader->Addr3;                                     \
-		}                                                                       \
-		else                                                                    \
-		{                                                                       \
-			_pDA = _pRxBlk->pHeader->Addr1;                                     \
-			_pSA = _pRxBlk->pHeader->Addr2;                                     \
-		}                                                                       \
-	}                                                                           \
-																				\
-	CONVERT_TO_802_3(_pHeader802_3, _pDA, _pSA, _pRxBlk->pData,				\
-		_pRxBlk->DataSize, _pRemovedLLCSNAP);                                   \
-}
-#endif // CONFIG_STA_SUPPORT //
-
-
-BOOLEAN APFowardWirelessStaToWirelessSta(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PNDIS_PACKET	pPacket,
-	IN	ULONG			FromWhichBSSID);
-
-VOID Announce_or_Forward_802_3_Packet(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PNDIS_PACKET	pPacket,
-	IN	UCHAR			FromWhichBSSID);
-
-VOID Sta_Announce_or_Forward_802_3_Packet(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PNDIS_PACKET	pPacket,
-	IN	UCHAR			FromWhichBSSID);
-
-
-#ifdef CONFIG_STA_SUPPORT
-#define ANNOUNCE_OR_FORWARD_802_3_PACKET(_pAd, _pPacket, _FromWhichBSS)\
-			Sta_Announce_or_Forward_802_3_Packet(_pAd, _pPacket, _FromWhichBSS);
-			//announce_802_3_packet(_pAd, _pPacket);
-#endif // CONFIG_STA_SUPPORT //
-
-
-PNDIS_PACKET DuplicatePacket(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PNDIS_PACKET	pPacket,
-	IN	UCHAR			FromWhichBSSID);
-
-
-PNDIS_PACKET ClonePacket(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PNDIS_PACKET	pPacket,
-	IN	PUCHAR			pData,
-	IN	ULONG			DataSize);
-
-
-// Normal, AMPDU or AMSDU
-VOID CmmRxnonRalinkFrameIndicate(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	RX_BLK			*pRxBlk,
-	IN	UCHAR			FromWhichBSSID);
-
-VOID CmmRxRalinkFrameIndicate(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	MAC_TABLE_ENTRY	*pEntry,
-	IN	RX_BLK			*pRxBlk,
-	IN	UCHAR			FromWhichBSSID);
-
-VOID Update_Rssi_Sample(
-	IN PRTMP_ADAPTER	pAd,
-	IN RSSI_SAMPLE		*pRssi,
-	IN PRXWI_STRUC		pRxWI);
-
-PNDIS_PACKET GetPacketFromRxRing(
-	IN		PRTMP_ADAPTER	pAd,
-	OUT		PRT28XX_RXD_STRUC		pSaveRxD,
-	OUT		BOOLEAN			*pbReschedule,
-	IN OUT	UINT32			*pRxPending);
-
-PNDIS_PACKET RTMPDeFragmentDataFrame(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	RX_BLK			*pRxBlk);
-
-////////////////////////////////////////
-
-VOID RTMPIoctlGetSiteSurvey(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq);
-
-
-
-
-
-#ifdef SNMP_SUPPORT
-//for snmp , kathy
-typedef struct _DefaultKeyIdxValue
-{
-	UCHAR	KeyIdx;
-	UCHAR	Value[16];
-} DefaultKeyIdxValue, *PDefaultKeyIdxValue;
-#endif
-
-
-#ifdef CONFIG_STA_SUPPORT
-enum {
-	DIDmsg_lnxind_wlansniffrm		= 0x00000044,
-	DIDmsg_lnxind_wlansniffrm_hosttime	= 0x00010044,
-	DIDmsg_lnxind_wlansniffrm_mactime	= 0x00020044,
-	DIDmsg_lnxind_wlansniffrm_channel	= 0x00030044,
-	DIDmsg_lnxind_wlansniffrm_rssi		= 0x00040044,
-	DIDmsg_lnxind_wlansniffrm_sq		= 0x00050044,
-	DIDmsg_lnxind_wlansniffrm_signal	= 0x00060044,
-	DIDmsg_lnxind_wlansniffrm_noise		= 0x00070044,
-	DIDmsg_lnxind_wlansniffrm_rate		= 0x00080044,
-	DIDmsg_lnxind_wlansniffrm_istx		= 0x00090044,
-	DIDmsg_lnxind_wlansniffrm_frmlen	= 0x000A0044
-};
-enum {
-	P80211ENUM_msgitem_status_no_value	= 0x00
-};
-enum {
-	P80211ENUM_truth_false			= 0x00,
-	P80211ENUM_truth_true			= 0x01
-};
-
-/* Definition from madwifi */
-typedef struct {
-        UINT32 did;
-        UINT16 status;
-        UINT16 len;
-        UINT32 data;
-} p80211item_uint32_t;
-
-typedef struct {
-        UINT32 msgcode;
-        UINT32 msglen;
-#define WLAN_DEVNAMELEN_MAX 16
-        UINT8 devname[WLAN_DEVNAMELEN_MAX];
-        p80211item_uint32_t hosttime;
-        p80211item_uint32_t mactime;
-        p80211item_uint32_t channel;
-        p80211item_uint32_t rssi;
-        p80211item_uint32_t sq;
-        p80211item_uint32_t signal;
-        p80211item_uint32_t noise;
-        p80211item_uint32_t rate;
-        p80211item_uint32_t istx;
-        p80211item_uint32_t frmlen;
-} wlan_ng_prism2_header;
-
-/* The radio capture header precedes the 802.11 header. */
-typedef struct PACKED _ieee80211_radiotap_header {
-    UINT8	it_version;	/* Version 0. Only increases
-				 * for drastic changes,
-				 * introduction of compatible
-				 * new fields does not count.
-				 */
-    UINT8	it_pad;
-    UINT16     it_len;         /* length of the whole
-				 * header in bytes, including
-				 * it_version, it_pad,
-				 * it_len, and data fields.
-				 */
-    UINT32   it_present;	/* A bitmap telling which
-					 * fields are present. Set bit 31
-					 * (0x80000000) to extend the
-					 * bitmap by another 32 bits.
-					 * Additional extensions are made
-					 * by setting bit 31.
-					 */
-}ieee80211_radiotap_header ;
-
-enum ieee80211_radiotap_type {
-    IEEE80211_RADIOTAP_TSFT = 0,
-    IEEE80211_RADIOTAP_FLAGS = 1,
-    IEEE80211_RADIOTAP_RATE = 2,
-    IEEE80211_RADIOTAP_CHANNEL = 3,
-    IEEE80211_RADIOTAP_FHSS = 4,
-    IEEE80211_RADIOTAP_DBM_ANTSIGNAL = 5,
-    IEEE80211_RADIOTAP_DBM_ANTNOISE = 6,
-    IEEE80211_RADIOTAP_LOCK_QUALITY = 7,
-    IEEE80211_RADIOTAP_TX_ATTENUATION = 8,
-    IEEE80211_RADIOTAP_DB_TX_ATTENUATION = 9,
-    IEEE80211_RADIOTAP_DBM_TX_POWER = 10,
-    IEEE80211_RADIOTAP_ANTENNA = 11,
-    IEEE80211_RADIOTAP_DB_ANTSIGNAL = 12,
-    IEEE80211_RADIOTAP_DB_ANTNOISE = 13
-};
-
-#define WLAN_RADIOTAP_PRESENT (			\
-	(1 << IEEE80211_RADIOTAP_TSFT)	|	\
-	(1 << IEEE80211_RADIOTAP_FLAGS) |	\
-	(1 << IEEE80211_RADIOTAP_RATE)  |	\
-	 0)
-
-typedef struct _wlan_radiotap_header {
-	ieee80211_radiotap_header wt_ihdr;
-	INT64 wt_tsft;
-	UINT8 wt_flags;
-	UINT8 wt_rate;
-} wlan_radiotap_header;
-/* Definition from madwifi */
-
-void send_monitor_packets(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	RX_BLK			*pRxBlk);
-
-
-VOID    RTMPSetDesiredRates(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  LONG            Rates);
-#endif // CONFIG_STA_SUPPORT //
-
-INT	Set_FixedTxMode_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-#ifdef CONFIG_APSTA_MIXED_SUPPORT
-INT	Set_OpMode_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-#endif // CONFIG_APSTA_MIXED_SUPPORT //
-
-INT Set_LongRetryLimit_Proc(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	PSTRING			arg);
-
-INT Set_ShortRetryLimit_Proc(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	PSTRING			arg);
-
-BOOLEAN RT28XXChipsetCheck(
-	IN void *_dev_p);
-
-
-VOID RT28XXDMADisable(
-	IN RTMP_ADAPTER			*pAd);
-
-VOID RT28XXDMAEnable(
-	IN RTMP_ADAPTER			*pAd);
-
-VOID RT28xx_UpdateBeaconToAsic(
-	IN RTMP_ADAPTER * pAd,
-	IN INT apidx,
-	IN ULONG BeaconLen,
-	IN ULONG UpdatePos);
-
-int rt28xx_init(
-	IN PRTMP_ADAPTER pAd,
-	IN PSTRING pDefaultMac,
-	IN PSTRING pHostName);
-
-BOOLEAN RT28XXSecurityKeyAdd(
-	IN		PRTMP_ADAPTER		pAd,
-	IN		ULONG				apidx,
-	IN		ULONG				KeyIdx,
-	IN		MAC_TABLE_ENTRY		*pEntry);
-
-NDIS_STATUS RtmpNetTaskInit(
-	IN RTMP_ADAPTER *pAd);
-
-VOID RtmpNetTaskExit(
-	IN PRTMP_ADAPTER pAd);
-
-NDIS_STATUS RtmpMgmtTaskInit(
-	IN RTMP_ADAPTER *pAd);
-
-VOID RtmpMgmtTaskExit(
-	IN RTMP_ADAPTER *pAd);
-
-void tbtt_tasklet(unsigned long data);
-
-
-PNET_DEV RtmpPhyNetDevInit(
-	IN RTMP_ADAPTER *pAd,
-	IN RTMP_OS_NETDEV_OP_HOOK *pNetHook);
-
-BOOLEAN RtmpPhyNetDevExit(
-	IN RTMP_ADAPTER *pAd,
-	IN PNET_DEV net_dev);
-
-INT RtmpRaDevCtrlInit(
-	IN RTMP_ADAPTER *pAd,
-	IN RTMP_INF_TYPE infType);
-
-BOOLEAN RtmpRaDevCtrlExit(
-	IN RTMP_ADAPTER *pAd);
-
-
-#ifdef RTMP_MAC_PCI
-//
-// Function Prototype in cmm_data_pci.c
-//
-USHORT RtmpPCI_WriteTxResource(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	TX_BLK			*pTxBlk,
-	IN	BOOLEAN			bIsLast,
-	OUT	USHORT			*FreeNumber);
-
-USHORT RtmpPCI_WriteSingleTxResource(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	TX_BLK			*pTxBlk,
-	IN	BOOLEAN			bIsLast,
-	OUT	USHORT			*FreeNumber);
-
-USHORT RtmpPCI_WriteMultiTxResource(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	TX_BLK			*pTxBlk,
-	IN	UCHAR			frameNum,
-	OUT	USHORT			*FreeNumber);
-
-USHORT	RtmpPCI_WriteFragTxResource(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	TX_BLK			*pTxBlk,
-	IN	UCHAR			fragNum,
-	OUT	USHORT			*FreeNumber);
-
-USHORT RtmpPCI_WriteSubTxResource(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	TX_BLK			*pTxBlk,
-	IN	BOOLEAN			bIsLast,
-	OUT	USHORT			*FreeNumber);
-
-VOID RtmpPCI_FinalWriteTxResource(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	TX_BLK			*pTxBlk,
-	IN	USHORT			totalMPDUSize,
-	IN	USHORT			FirstTxIdx);
-
-VOID RtmpPCIDataLastTxIdx(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			QueIdx,
-	IN	USHORT			LastTxIdx);
-
-VOID RtmpPCIDataKickOut(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	TX_BLK			*pTxBlk,
-	IN	UCHAR			QueIdx);
-
-
-int RtmpPCIMgmtKickOut(
-	IN RTMP_ADAPTER		*pAd,
-	IN UCHAR			QueIdx,
-	IN PNDIS_PACKET		pPacket,
-	IN PUCHAR			pSrcBufVA,
-	IN UINT				SrcBufLen);
-
-
-NDIS_STATUS RTMPCheckRxError(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PHEADER_802_11  pHeader,
-	IN	PRXWI_STRUC	pRxWI,
-	IN  PRT28XX_RXD_STRUC      pRxD);
-
-BOOLEAN RT28xxPciAsicRadioOff(
-	IN PRTMP_ADAPTER    pAd,
-	IN UCHAR            Level,
-	IN USHORT           TbttNumToNextWakeUp);
-
-BOOLEAN RT28xxPciAsicRadioOn(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR     Level);
-
-#ifdef CONFIG_STA_SUPPORT
-VOID RTMPInitPCIeLinkCtrlValue(
-	IN	PRTMP_ADAPTER	pAd);
-
-VOID RTMPFindHostPCIDev(
-    IN	PRTMP_ADAPTER	pAd);
-
-VOID RTMPPCIeLinkCtrlValueRestore(
-	IN	PRTMP_ADAPTER	pAd,
-	IN   UCHAR		Level);
-
-VOID RTMPPCIeLinkCtrlSetting(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	USHORT		Max);
-
-VOID RTMPrt3xSetPCIePowerLinkCtrl(
-	IN	PRTMP_ADAPTER	pAd);
-
-
-VOID RT28xxPciStaAsicForceWakeup(
-	IN PRTMP_ADAPTER pAd,
-	IN BOOLEAN       bFromTx);
-
-VOID RT28xxPciStaAsicSleepThenAutoWakeup(
-	IN PRTMP_ADAPTER pAd,
-	IN USHORT TbttNumToNextWakeUp);
-
-VOID PsPollWakeExec(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3);
-
-VOID  RadioOnExec(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3);
-#endif // CONFIG_STA_SUPPORT //
-
-VOID RT28xxPciMlmeRadioOn(
-	IN PRTMP_ADAPTER pAd);
-
-VOID RT28xxPciMlmeRadioOFF(
-	IN PRTMP_ADAPTER pAd);
-#endif // RTMP_MAC_PCI //
-
-VOID AsicTurnOffRFClk(
-	IN PRTMP_ADAPTER    pAd,
-	IN	UCHAR           Channel);
-
-VOID AsicTurnOnRFClk(
-	IN PRTMP_ADAPTER	pAd,
-	IN	UCHAR			Channel);
-
-
-
-#ifdef RTMP_TIMER_TASK_SUPPORT
-INT RtmpTimerQThread(
-	IN OUT PVOID Context);
-
-RTMP_TIMER_TASK_ENTRY *RtmpTimerQInsert(
-	IN RTMP_ADAPTER *pAd,
-	IN RALINK_TIMER_STRUCT *pTimer);
-
-BOOLEAN RtmpTimerQRemove(
-	IN RTMP_ADAPTER *pAd,
-	IN RALINK_TIMER_STRUCT *pTimer);
-
-void RtmpTimerQExit(
-	IN RTMP_ADAPTER *pAd);
-
-void RtmpTimerQInit(
-	IN RTMP_ADAPTER *pAd);
-#endif // RTMP_TIMER_TASK_SUPPORT //
-
-
-
-////////////////////////////////////////
-
-VOID QBSS_LoadInit(
-	IN		RTMP_ADAPTER	*pAd);
-
-UINT32 QBSS_LoadElementAppend(
-	IN		RTMP_ADAPTER	*pAd,
-	OUT		UINT8			*buf_p);
-
-VOID QBSS_LoadUpdate(
-	IN		RTMP_ADAPTER	*pAd);
-
-///////////////////////////////////////
-INT RTMPShowCfgValue(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			pName,
-	IN	PSTRING			pBuf);
-
-PSTRING RTMPGetRalinkAuthModeStr(
-    IN  NDIS_802_11_AUTHENTICATION_MODE authMode);
-
-PSTRING RTMPGetRalinkEncryModeStr(
-    IN  USHORT encryMode);
-//////////////////////////////////////
-
-#ifdef CONFIG_STA_SUPPORT
-VOID AsicStaBbpTuning(
-	IN PRTMP_ADAPTER pAd);
-
-BOOLEAN StaAddMacTableEntry(
-	IN  PRTMP_ADAPTER		pAd,
-	IN  PMAC_TABLE_ENTRY	pEntry,
-	IN  UCHAR				MaxSupportedRateIn500Kbps,
-	IN  HT_CAPABILITY_IE	*pHtCapability,
-	IN  UCHAR				HtCapabilityLen,
-	IN  ADD_HT_INFO_IE		*pAddHtInfo,
-	IN  UCHAR				AddHtInfoLen,
-	IN  USHORT			CapabilityInfo);
-
-
-BOOLEAN	AUTH_ReqSend(
-	IN  PRTMP_ADAPTER		pAd,
-	IN  PMLME_QUEUE_ELEM	pElem,
-	IN  PRALINK_TIMER_STRUCT pAuthTimer,
-	IN  PSTRING				pSMName,
-	IN  USHORT				SeqNo,
-	IN  PUCHAR				pNewElement,
-	IN  ULONG				ElementLen);
-#endif // CONFIG_STA_SUPPORT //
-
-void RTMP_IndicateMediaState(
-	IN	PRTMP_ADAPTER	pAd);
-
-VOID ReSyncBeaconTime(
-	IN  PRTMP_ADAPTER   pAd);
-
-VOID RTMPSetAGCInitValue(
-	IN PRTMP_ADAPTER	pAd,
-	IN UCHAR			BandWidth);
-
-int rt28xx_close(IN PNET_DEV dev);
-int rt28xx_open(IN PNET_DEV dev);
-
-
-#define VIRTUAL_IF_INC(__pAd) ((__pAd)->VirtualIfCnt++)
-#define VIRTUAL_IF_DEC(__pAd) ((__pAd)->VirtualIfCnt--)
-#define VIRTUAL_IF_NUM(__pAd) ((__pAd)->VirtualIfCnt)
-
-
-#ifdef LINUX
-__inline INT VIRTUAL_IF_UP(PRTMP_ADAPTER pAd)
-{
-	if (VIRTUAL_IF_NUM(pAd) == 0)
-	{
-		if (rt28xx_open(pAd->net_dev) != 0)
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("rt28xx_open return fail!\n"));
-			return -1;
-		}
-	}
-	else
-	{
-	}
-	VIRTUAL_IF_INC(pAd);
-	return 0;
-}
-
-__inline VOID VIRTUAL_IF_DOWN(PRTMP_ADAPTER pAd)
-{
-	VIRTUAL_IF_DEC(pAd);
-	if (VIRTUAL_IF_NUM(pAd) == 0)
-		rt28xx_close(pAd->net_dev);
-	return;
-}
-#endif // LINUX //
-
-
-
-
-/*
-	OS Related funciton prototype definitions.
-	TODO: Maybe we need to move these function prototypes to other proper place.
-*/
-int RtmpOSWrielessEventSend(
-	IN RTMP_ADAPTER *pAd,
-	IN UINT32		eventType,
-	IN INT			flags,
-	IN PUCHAR		pSrcMac,
-	IN PUCHAR		pData,
-	IN UINT32		dataLen);
-
-int RtmpOSNetDevAddrSet(
-	IN PNET_DEV pNetDev,
-	IN PUCHAR	pMacAddr);
-
-int RtmpOSNetDevAttach(
-	IN PNET_DEV pNetDev,
-	IN RTMP_OS_NETDEV_OP_HOOK *pDevOpHook);
-
-void RtmpOSNetDevClose(
-	IN PNET_DEV pNetDev);
-
-void RtmpOSNetDevDetach(
-	IN PNET_DEV pNetDev);
-
-INT RtmpOSNetDevAlloc(
-	IN PNET_DEV *pNewNetDev,
-	IN UINT32	privDataSize);
-
-void RtmpOSNetDevFree(
-	IN PNET_DEV pNetDev);
-
-PNET_DEV RtmpOSNetDevGetByName(
-	IN PNET_DEV pNetDev,
-	IN PSTRING	pDevName);
-
-void RtmpOSNetDeviceRefPut(
-	IN PNET_DEV pNetDev);
-
-PNET_DEV RtmpOSNetDevCreate(
-	IN RTMP_ADAPTER *pAd,
-	IN INT			devType,
-	IN INT			devNum,
-	IN INT			privMemSize,
-	IN PSTRING		pNamePrefix);
-
-/*
-	Task operation related function prototypes
-*/
-void RtmpOSTaskCustomize(
-	IN RTMP_OS_TASK *pTask);
-
-INT RtmpOSTaskNotifyToExit(
-	IN RTMP_OS_TASK *pTask);
-
-NDIS_STATUS RtmpOSTaskKill(
-	IN RTMP_OS_TASK *pTask);
-
-NDIS_STATUS RtmpOSTaskInit(
-	IN RTMP_OS_TASK *pTask,
-	PSTRING			 pTaskName,
-	VOID			 *pPriv);
-
-NDIS_STATUS RtmpOSTaskAttach(
-	IN RTMP_OS_TASK *pTask,
-	IN int (*fn)(void *),
-	IN void *arg);
-
-
-/*
-	File operation related function prototypes
-*/
-RTMP_OS_FD RtmpOSFileOpen(
-	IN char *pPath,
-	IN int flag,
-	IN int mode);
-
-int RtmpOSFileClose(
-	IN RTMP_OS_FD osfd);
-
-void RtmpOSFileSeek(
-	IN RTMP_OS_FD osfd,
-	IN int offset);
-
-int RtmpOSFileRead(
-	IN RTMP_OS_FD osfd,
-	IN char *pDataPtr,
-	IN int readLen);
-
-int RtmpOSFileWrite(
-	IN RTMP_OS_FD osfd,
-	IN char *pDataPtr,
-	IN int writeLen);
-
-void RtmpOSFSInfoChange(
-	IN RTMP_OS_FS_INFO *pOSFSInfo,
-	IN BOOLEAN bSet);
-
-
-#endif  // __RTMP_H__
diff --git a/drivers/staging/rt3090/rtmp_chip.h b/drivers/staging/rt3090/rtmp_chip.h
deleted file mode 100644
index a0b4bf06cca0..000000000000
--- a/drivers/staging/rt3090/rtmp_chip.h
+++ /dev/null
@@ -1,355 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-	Module Name:
-	rtmp_chip.h
-
-	Abstract:
-	Ralink Wireless Chip related definition & structures
-
-	Revision History:
-	Who			When		  What
-	--------	----------	  ----------------------------------------------
-*/
-
-#ifndef	__RTMP_CHIP_H__
-#define	__RTMP_CHIP_H__
-
-#include "rtmp_type.h"
-
-#ifdef RT3090
-#include "rt3090.h"
-#endif // RT3090 //
-
-#ifdef RT3370
-#include "rt3370.h"
-#endif // RT3370 //
-
-#ifdef RT3390
-#include "rt3390.h"
-#endif // RT3390 //
-
-// We will have a cost down version which mac version is 0x3090xxxx
-//
-// RT3090A facts
-//
-// a) 2.4 GHz
-// b) Replacement for RT3090
-// c) Internal LNA
-// d) Interference over channel #14
-// e) New BBP features (e.g., SIG re-modulation)
-//
-#define IS_RT3090A(_pAd)				((((_pAd)->MACVersion & 0xffff0000) == 0x30900000))
-
-// We will have a cost down version which mac version is 0x3090xxxx
-#define IS_RT3090(_pAd)				((((_pAd)->MACVersion & 0xffff0000) == 0x30710000) || (IS_RT3090A(_pAd)))
-
-#define IS_RT3070(_pAd)		(((_pAd)->MACVersion & 0xffff0000) == 0x30700000)
-#define IS_RT3071(_pAd)		(((_pAd)->MACVersion & 0xffff0000) == 0x30710000)
-#define IS_RT2070(_pAd)		(((_pAd)->RfIcType == RFIC_2020) || ((_pAd)->EFuseTag == 0x27))
-
-#define IS_RT30xx(_pAd)		(((_pAd)->MACVersion & 0xfff00000) == 0x30700000||IS_RT3090A(_pAd))
-//#define IS_RT305X(_pAd)		((_pAd)->MACVersion == 0x28720200)
-
-/* RT3572, 3592, 3562, 3062 share the same MAC version */
-#define IS_RT3572(_pAd)		(((_pAd)->MACVersion & 0xffff0000) == 0x35720000)
-#define IS_VERSION_BEFORE_F(_pAd)			(((_pAd)->MACVersion&0xffff) <= 0x0211)
-// F version is 0x0212, E version is 0x0211. 309x can save more power after F version.
-#define IS_VERSION_AFTER_F(_pAd)			((((_pAd)->MACVersion&0xffff) >= 0x0212) || (((_pAd)->b3090ESpecialChip == TRUE)))
-//
-// RT3390 facts
-//
-// a) Base on RT3090 (RF IC: RT3020)
-// b) 2.4 GHz
-// c) 1x1
-// d) Single chip
-// e) Internal components: PA and LNA
-//
-//RT3390,RT3370
-#define IS_RT3390(_pAd)				(((_pAd)->MACVersion & 0xFFFF0000) == 0x33900000)
-
-// ------------------------------------------------------
-// PCI registers - base address 0x0000
-// ------------------------------------------------------
-#define CHIP_PCI_CFG		0x0000
-#define CHIP_PCI_EECTRL		0x0004
-#define CHIP_PCI_MCUCTRL	0x0008
-
-#define OPT_14			0x114
-
-#define RETRY_LIMIT		10
-
-
-
-// ------------------------------------------------------
-// BBP & RF	definition
-// ------------------------------------------------------
-#define	BUSY		                1
-#define	IDLE		                0
-
-
-//-------------------------------------------------------------------------
-// EEPROM definition
-//-------------------------------------------------------------------------
-#define EEDO                        0x08
-#define EEDI                        0x04
-#define EECS                        0x02
-#define EESK                        0x01
-#define EERL                        0x80
-
-#define EEPROM_WRITE_OPCODE         0x05
-#define EEPROM_READ_OPCODE          0x06
-#define EEPROM_EWDS_OPCODE          0x10
-#define EEPROM_EWEN_OPCODE          0x13
-
-#define NUM_EEPROM_BBP_PARMS		19			// Include NIC Config 0, 1, CR, TX ALC step, BBPs
-#define NUM_EEPROM_TX_G_PARMS		7
-#define EEPROM_NIC1_OFFSET          0x34		// The address is from NIC config 0, not BBP register ID
-#define EEPROM_NIC2_OFFSET          0x36		// The address is from NIC config 0, not BBP register ID
-#define EEPROM_BBP_BASE_OFFSET		0xf0		// The address is from NIC config 0, not BBP register ID
-#define EEPROM_G_TX_PWR_OFFSET		0x52
-#define EEPROM_G_TX2_PWR_OFFSET		0x60
-#define EEPROM_LED1_OFFSET			0x3c
-#define EEPROM_LED2_OFFSET			0x3e
-#define EEPROM_LED3_OFFSET			0x40
-#define EEPROM_LNA_OFFSET			0x44
-#define EEPROM_RSSI_BG_OFFSET		0x46
-#define EEPROM_TXMIXER_GAIN_2_4G	0x48
-#define EEPROM_RSSI_A_OFFSET		0x4a
-#define EEPROM_TXMIXER_GAIN_5G		0x4c
-#define EEPROM_DEFINE_MAX_TXPWR		0x4e
-#define EEPROM_TXPOWER_BYRATE_20MHZ_2_4G	0xde	// 20MHZ 2.4G tx power.
-#define EEPROM_TXPOWER_BYRATE_40MHZ_2_4G	0xee	// 40MHZ 2.4G tx power.
-#define EEPROM_TXPOWER_BYRATE_20MHZ_5G		0xfa	// 20MHZ 5G tx power.
-#define EEPROM_TXPOWER_BYRATE_40MHZ_5G		0x10a	// 40MHZ 5G tx power.
-#define EEPROM_A_TX_PWR_OFFSET      0x78
-#define EEPROM_A_TX2_PWR_OFFSET      0xa6
-//#define EEPROM_Japan_TX_PWR_OFFSET      0x90 // 802.11j
-//#define EEPROM_Japan_TX2_PWR_OFFSET      0xbe
-//#define EEPROM_TSSI_REF_OFFSET	0x54
-//#define EEPROM_TSSI_DELTA_OFFSET	0x24
-//#define EEPROM_CCK_TX_PWR_OFFSET  0x62
-//#define EEPROM_CALIBRATE_OFFSET	0x7c
-#define EEPROM_VERSION_OFFSET       0x02
-#define EEPROM_FREQ_OFFSET			0x3a
-#define EEPROM_TXPOWER_BYRATE	0xde	// 20MHZ power.
-#define EEPROM_TXPOWER_DELTA		0x50	// 20MHZ AND 40 MHZ use different power. This is delta in 40MHZ.
-#define VALID_EEPROM_VERSION        1
-
-
-/*
-  *   EEPROM operation related marcos
-  */
-#define RT28xx_EEPROM_READ16(_pAd, _offset, _value)			\
-	(_pAd)->chipOps.eeread((RTMP_ADAPTER *)(_pAd), (USHORT)(_offset), (PUSHORT)&(_value))
-
-#define RT28xx_EEPROM_WRITE16(_pAd, _offset, _value)		\
-	(_pAd)->chipOps.eewrite((RTMP_ADAPTER *)(_pAd), (USHORT)(_offset), (USHORT)(_value))
-
-
-
-// -------------------------------------------------------------------
-//  E2PROM data layout
-// -------------------------------------------------------------------
-
-//
-// MCU_LEDCS: MCU LED Control Setting.
-//
-typedef union  _MCU_LEDCS_STRUC {
-	struct	{
-#ifdef RT_BIG_ENDIAN
-		UCHAR		Polarity:1;
-		UCHAR		LedMode:7;
-#else
-		UCHAR		LedMode:7;
-		UCHAR		Polarity:1;
-#endif // RT_BIG_ENDIAN //
-	} field;
-	UCHAR				word;
-} MCU_LEDCS_STRUC, *PMCU_LEDCS_STRUC;
-
-
-//
-// EEPROM antenna select format
-//
-#ifdef RT_BIG_ENDIAN
-typedef	union	_EEPROM_ANTENNA_STRUC	{
-	struct	{
-		USHORT      Rsv:4;
-		USHORT      RfIcType:4;             // see E2PROM document
-		USHORT		TxPath:4;	// 1: 1T, 2: 2T
-		USHORT		RxPath:4;	// 1: 1R, 2: 2R, 3: 3R
-	}	field;
-	USHORT			word;
-}	EEPROM_ANTENNA_STRUC, *PEEPROM_ANTENNA_STRUC;
-#else
-typedef	union	_EEPROM_ANTENNA_STRUC	{
-	struct	{
-		USHORT		RxPath:4;	// 1: 1R, 2: 2R, 3: 3R
-		USHORT		TxPath:4;	// 1: 1T, 2: 2T
-		USHORT      RfIcType:4;             // see E2PROM document
-		USHORT      Rsv:4;
-	}	field;
-	USHORT			word;
-}	EEPROM_ANTENNA_STRUC, *PEEPROM_ANTENNA_STRUC;
-#endif
-
-#ifdef RT_BIG_ENDIAN
-typedef	union _EEPROM_NIC_CINFIG2_STRUC	{
-	struct	{
-		USHORT		DACTestBit:1;			// control if driver should patch the DAC issue
-		USHORT		Rsv2:3;					// must be 0
-		USHORT		AntDiversity:1;			// Antenna diversity
-		USHORT		Rsv1:1;					// must be 0
-		USHORT		BW40MAvailForA:1;			// 0:enable, 1:disable
-		USHORT		BW40MAvailForG:1;			// 0:enable, 1:disable
-		USHORT		EnableWPSPBC:1;                 // WPS PBC Control bit
-		USHORT		BW40MSidebandForA:1;
-		USHORT		BW40MSidebandForG:1;
-		USHORT		CardbusAcceleration:1;	// !!! NOTE: 0 - enable, 1 - disable
-		USHORT		ExternalLNAForA:1;			// external LNA enable for 5G
-		USHORT		ExternalLNAForG:1;			// external LNA enable for 2.4G
-		USHORT		DynamicTxAgcControl:1;			//
-		USHORT		HardwareRadioControl:1;	// Whether RF is controlled by driver or HW. 1:enable hw control, 0:disable
-	}	field;
-	USHORT			word;
-}	EEPROM_NIC_CONFIG2_STRUC, *PEEPROM_NIC_CONFIG2_STRUC;
-#else
-typedef	union _EEPROM_NIC_CINFIG2_STRUC	{
-	struct {
-		USHORT		HardwareRadioControl:1;	// 1:enable, 0:disable
-		USHORT		DynamicTxAgcControl:1;			//
-		USHORT		ExternalLNAForG:1;				//
-		USHORT		ExternalLNAForA:1;			// external LNA enable for 2.4G
-		USHORT		CardbusAcceleration:1;	// !!! NOTE: 0 - enable, 1 - disable
-		USHORT		BW40MSidebandForG:1;
-		USHORT		BW40MSidebandForA:1;
-		USHORT		EnableWPSPBC:1;                 // WPS PBC Control bit
-		USHORT		BW40MAvailForG:1;			// 0:enable, 1:disable
-		USHORT		BW40MAvailForA:1;			// 0:enable, 1:disable
-		USHORT		Rsv1:1;					// must be 0
-		USHORT		AntDiversity:1;			// Antenna diversity
-		USHORT		Rsv2:3;					// must be 0
-		USHORT		DACTestBit:1;			// control if driver should patch the DAC issue
-	}	field;
-	USHORT			word;
-}	EEPROM_NIC_CONFIG2_STRUC, *PEEPROM_NIC_CONFIG2_STRUC;
-#endif
-
-//
-// TX_PWR Value valid range 0xFA(-6) ~ 0x24(36)
-//
-#ifdef RT_BIG_ENDIAN
-typedef	union	_EEPROM_TX_PWR_STRUC	{
-	struct	{
-		CHAR	Byte1;				// High Byte
-		CHAR	Byte0;				// Low Byte
-	}	field;
-	USHORT	word;
-}	EEPROM_TX_PWR_STRUC, *PEEPROM_TX_PWR_STRUC;
-#else
-typedef	union	_EEPROM_TX_PWR_STRUC	{
-	struct	{
-		CHAR	Byte0;				// Low Byte
-		CHAR	Byte1;				// High Byte
-	}	field;
-	USHORT	word;
-}	EEPROM_TX_PWR_STRUC, *PEEPROM_TX_PWR_STRUC;
-#endif
-
-#ifdef RT_BIG_ENDIAN
-typedef	union	_EEPROM_VERSION_STRUC	{
-	struct	{
-		UCHAR	Version;			// High Byte
-		UCHAR	FaeReleaseNumber;	// Low Byte
-	}	field;
-	USHORT	word;
-}	EEPROM_VERSION_STRUC, *PEEPROM_VERSION_STRUC;
-#else
-typedef	union	_EEPROM_VERSION_STRUC	{
-	struct	{
-		UCHAR	FaeReleaseNumber;	// Low Byte
-		UCHAR	Version;			// High Byte
-	}	field;
-	USHORT	word;
-}	EEPROM_VERSION_STRUC, *PEEPROM_VERSION_STRUC;
-#endif
-
-#ifdef RT_BIG_ENDIAN
-typedef	union	_EEPROM_LED_STRUC	{
-	struct	{
-		USHORT	Rsvd:3;				// Reserved
-		USHORT	LedMode:5;			// Led mode.
-		USHORT	PolarityGPIO_4:1;	// Polarity GPIO#4 setting.
-		USHORT	PolarityGPIO_3:1;	// Polarity GPIO#3 setting.
-		USHORT	PolarityGPIO_2:1;	// Polarity GPIO#2 setting.
-		USHORT	PolarityGPIO_1:1;	// Polarity GPIO#1 setting.
-		USHORT	PolarityGPIO_0:1;	// Polarity GPIO#0 setting.
-		USHORT	PolarityACT:1;		// Polarity ACT setting.
-		USHORT	PolarityRDY_A:1;		// Polarity RDY_A setting.
-		USHORT	PolarityRDY_G:1;		// Polarity RDY_G setting.
-	}	field;
-	USHORT	word;
-}	EEPROM_LED_STRUC, *PEEPROM_LED_STRUC;
-#else
-typedef	union	_EEPROM_LED_STRUC	{
-	struct	{
-		USHORT	PolarityRDY_G:1;		// Polarity RDY_G setting.
-		USHORT	PolarityRDY_A:1;		// Polarity RDY_A setting.
-		USHORT	PolarityACT:1;		// Polarity ACT setting.
-		USHORT	PolarityGPIO_0:1;	// Polarity GPIO#0 setting.
-		USHORT	PolarityGPIO_1:1;	// Polarity GPIO#1 setting.
-		USHORT	PolarityGPIO_2:1;	// Polarity GPIO#2 setting.
-		USHORT	PolarityGPIO_3:1;	// Polarity GPIO#3 setting.
-		USHORT	PolarityGPIO_4:1;	// Polarity GPIO#4 setting.
-		USHORT	LedMode:5;			// Led mode.
-		USHORT	Rsvd:3;				// Reserved
-	}	field;
-	USHORT	word;
-}	EEPROM_LED_STRUC, *PEEPROM_LED_STRUC;
-#endif
-
-#ifdef RT_BIG_ENDIAN
-typedef	union	_EEPROM_TXPOWER_DELTA_STRUC	{
-	struct	{
-		UCHAR	TxPowerEnable:1;// Enable
-		UCHAR	Type:1;			// 1: plus the delta value, 0: minus the delta value
-		UCHAR	DeltaValue:6;	// Tx Power dalta value (MAX=4)
-	}	field;
-	UCHAR	value;
-}	EEPROM_TXPOWER_DELTA_STRUC, *PEEPROM_TXPOWER_DELTA_STRUC;
-#else
-typedef	union	_EEPROM_TXPOWER_DELTA_STRUC	{
-	struct	{
-		UCHAR	DeltaValue:6;	// Tx Power dalta value (MAX=4)
-		UCHAR	Type:1;			// 1: plus the delta value, 0: minus the delta value
-		UCHAR	TxPowerEnable:1;// Enable
-	}	field;
-	UCHAR	value;
-}	EEPROM_TXPOWER_DELTA_STRUC, *PEEPROM_TXPOWER_DELTA_STRUC;
-#endif
-
-#endif	// __RTMP_CHIP_H__ //
diff --git a/drivers/staging/rt3090/rtmp_def.h b/drivers/staging/rt3090/rtmp_def.h
deleted file mode 100644
index aeb739d0935c..000000000000
--- a/drivers/staging/rt3090/rtmp_def.h
+++ /dev/null
@@ -1,1650 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-    Module Name:
-    rtmp_def.h
-
-    Abstract:
-    Miniport related definition header
-
-    Revision History:
-    Who         When          What
-    --------    ----------    ----------------------------------------------
-    Paul Lin    08-01-2002    created
-    John Chang  08-05-2003    add definition for 11g & other drafts
-*/
-#ifndef __RTMP_DEF_H__
-#define __RTMP_DEF_H__
-
-#include "oid.h"
-
-#undef AP_WSC_INCLUDED
-#undef STA_WSC_INCLUDED
-#undef WSC_INCLUDED
-
-
-#ifdef CONFIG_STA_SUPPORT
-#endif // CONFIG_STA_SUPPORT //
-
-#if defined(AP_WSC_INCLUDED) || defined(STA_WSC_INCLUDED)
-#define WSC_INCLUDED
-#endif
-//
-//  Debug information verbosity: lower values indicate higher urgency
-//
-#define RT_DEBUG_OFF        0
-#define RT_DEBUG_ERROR      1
-#define RT_DEBUG_WARN       2
-#define RT_DEBUG_TRACE      3
-#define RT_DEBUG_INFO       4
-#define RT_DEBUG_LOUD       5
-
-#define NIC_TAG             ((ULONG)'0682')
-#define NIC_DBG_STRING      ("**RT28xx**")
-
-#ifdef SNMP_SUPPORT
-// for snmp
-// to get manufacturer OUI, kathy, 2008_0220
-#define ManufacturerOUI_LEN			3
-#define ManufacturerNAME			("Ralink Technology Company.")
-#define	ResourceTypeIdName			("Ralink_ID")
-#endif
-
-
-//#define PACKED
-
-#define RALINK_2883_VERSION		((UINT32)0x28830300)
-#define RALINK_2880E_VERSION	((UINT32)0x28720200)
-#define RALINK_3070_VERSION		((UINT32)0x30700200)
-
-#define MAX_RX_PKT_LEN	1520
-
-//
-// Entry number for each DMA descriptor ring
-//
-
-#ifdef RTMP_MAC_PCI
-#define TX_RING_SIZE            64 //64
-#define MGMT_RING_SIZE          128
-#define RX_RING_SIZE            128 //64
-#define MAX_TX_PROCESS          TX_RING_SIZE //8
-#define MAX_DMA_DONE_PROCESS    TX_RING_SIZE
-#define MAX_TX_DONE_PROCESS     TX_RING_SIZE //8
-#define LOCAL_TXBUF_SIZE        2
-#endif // RTMP_MAC_PCI //
-
-#define PCI_VIRT_TO_PHYS(__Addr)	(((UINT32)(__Addr)) & 0x0FFFFFFF)
-
-
-#ifdef MULTIPLE_CARD_SUPPORT
-// MC: Multple Cards
-#define MAX_NUM_OF_MULTIPLE_CARD		32
-#endif // MULTIPLE_CARD_SUPPORT //
-
-#define MAX_RX_PROCESS          128 //64 //32
-#define NUM_OF_LOCAL_TXBUF      2
-#define TXD_SIZE                16
-#define TXWI_SIZE               16
-#define RXD_SIZE		16
-#define RXWI_SIZE		16
-// TXINFO_SIZE + TXWI_SIZE + 802.11 Header Size + AMSDU sub frame header
-#define TX_DMA_1ST_BUFFER_SIZE  96    // only the 1st physical buffer is pre-allocated
-#define MGMT_DMA_BUFFER_SIZE    1536 //2048
-#define RX_BUFFER_AGGRESIZE     3840 //3904 //3968 //4096 //2048 //4096
-#define RX_BUFFER_NORMSIZE      3840 //3904 //3968 //4096 //2048 //4096
-#define TX_BUFFER_NORMSIZE		RX_BUFFER_NORMSIZE
-#define MAX_FRAME_SIZE          2346                    // Maximum 802.11 frame size
-#define MAX_AGGREGATION_SIZE    3840 //3904 //3968 //4096
-#define MAX_NUM_OF_TUPLE_CACHE  2
-#define MAX_MCAST_LIST_SIZE     32
-#define MAX_LEN_OF_VENDOR_DESC  64
-//#define MAX_SIZE_OF_MCAST_PSQ   (NUM_OF_LOCAL_TXBUF >> 2) // AP won't spend more than 1/4 of total buffers on M/BCAST PSQ
-#define MAX_SIZE_OF_MCAST_PSQ               32
-
-#define MAX_RX_PROCESS_CNT	(RX_RING_SIZE)
-
-
-/*
-	WMM Note: If memory of your system is not much, please reduce the definition;
-	or when you do WMM test, the queue for low priority AC will be full, i.e.
-	TX_RING_SIZE + MAX_PACKETS_IN_QUEUE packets for the AC will be buffered in
-	WLAN, maybe no any packet buffer can be got in Ethernet driver.
-
-	Sometimes no packet buffer can be got in Ethernet driver, the system will
-	send flow control packet to the sender to slow down its sending rate.
-	So no WMM can be saw in the air.
-*/
-
-/*
-	Need to use 64 in vxworks for test case WMM A5-T07
-	Two dnlink (10Mbps) from a WMM station to a non-WMM station.
-	If use 256, queue is not enough.
-	And in rt_main_end.c, clConfig.clNum = RX_RING_SIZE * 3; is changed to
-	clConfig.clNum = RX_RING_SIZE * 4;
-*/
-// TODO: For VxWorks the size is 256. Shall we cahnge the value as 256 for all OS?????
-#define MAX_PACKETS_IN_QUEUE				(512) //(512)    // to pass WMM A5-WPAPSK
-
-#define MAX_PACKETS_IN_MCAST_PS_QUEUE		32
-#define MAX_PACKETS_IN_PS_QUEUE				128	//32
-#define WMM_NUM_OF_AC                       4  /* AC0, AC1, AC2, and AC3 */
-
-
-#ifdef RTMP_EFUSE_SUPPORT
-//2008/09/11:KH add to support efuse<--
-#define MAX_EEPROM_BIN_FILE_SIZE				1024
-#define EFUSE_BUFFER_PATH						"/tmp/RT30xxEEPROM.bin"
-//2008/09/11:KH add to support efuse-->
-#endif // RTMP_EFUSE_SUPPORT //
-
-// RxFilter
-#define STANORMAL	 0x17f97
-#define APNORMAL	 0x15f97
-#define PSPXLINK	 0x17f93
-//
-//  RTMP_ADAPTER flags
-//
-#define fRTMP_ADAPTER_MAP_REGISTER          0x00000001
-#define fRTMP_ADAPTER_INTERRUPT_IN_USE      0x00000002
-#define fRTMP_ADAPTER_HARDWARE_ERROR        0x00000004
-#define fRTMP_ADAPTER_SCATTER_GATHER        0x00000008
-#define fRTMP_ADAPTER_SEND_PACKET_ERROR     0x00000010
-#define fRTMP_ADAPTER_MLME_RESET_IN_PROGRESS 0x00000020
-#define fRTMP_ADAPTER_HALT_IN_PROGRESS      0x00000040
-#define fRTMP_ADAPTER_RESET_IN_PROGRESS     0x00000080
-#define fRTMP_ADAPTER_NIC_NOT_EXIST         0x00000100
-#define fRTMP_ADAPTER_TX_RING_ALLOCATED     0x00000200
-#define fRTMP_ADAPTER_REMOVE_IN_PROGRESS    0x00000400
-#define fRTMP_ADAPTER_MIMORATE_INUSED       0x00000800
-#define fRTMP_ADAPTER_RX_RING_ALLOCATED     0x00001000
-#define fRTMP_ADAPTER_INTERRUPT_ACTIVE      0x00002000
-#define fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS  0x00004000
-#define	fRTMP_ADAPTER_REASSOC_IN_PROGRESS	0x00008000
-#define	fRTMP_ADAPTER_MEDIA_STATE_PENDING	0x00010000
-#define	fRTMP_ADAPTER_RADIO_OFF				0x00020000
-#define fRTMP_ADAPTER_BULKOUT_RESET			0x00040000
-#define	fRTMP_ADAPTER_BULKIN_RESET			0x00080000
-#define fRTMP_ADAPTER_RDG_ACTIVE			0x00100000
-#define fRTMP_ADAPTER_DYNAMIC_BE_TXOP_ACTIVE 0x00200000
-#define fRTMP_ADAPTER_SCAN_2040				0x04000000
-#define	fRTMP_ADAPTER_RADIO_MEASUREMENT		0x08000000
-
-#define fRTMP_ADAPTER_START_UP			0x10000000	//Devive already initialized and enabled Tx/Rx.
-#define fRTMP_ADAPTER_MEDIA_STATE_CHANGE    0x20000000
-#define fRTMP_ADAPTER_IDLE_RADIO_OFF        0x40000000
-
-// Lock bit for accessing different ring buffers
-//#define fRTMP_ADAPTER_TX_RING_BUSY        0x80000000
-//#define fRTMP_ADAPTER_MGMT_RING_BUSY      0x40000000
-//#define fRTMP_ADAPTER_ATIM_RING_BUSY      0x20000000
-//#define fRTMP_ADAPTER_RX_RING_BUSY        0x10000000
-
-// Lock bit for accessing different queue
-//#define   fRTMP_ADAPTER_TX_QUEUE_BUSY     0x08000000
-//#define   fRTMP_ADAPTER_MGMT_QUEUE_BUSY   0x04000000
-
-//
-//  STA operation status flags
-//
-#define fOP_STATUS_INFRA_ON                 0x00000001
-#define fOP_STATUS_ADHOC_ON                 0x00000002
-#define fOP_STATUS_BG_PROTECTION_INUSED     0x00000004
-#define fOP_STATUS_SHORT_SLOT_INUSED        0x00000008
-#define fOP_STATUS_SHORT_PREAMBLE_INUSED    0x00000010
-#define fOP_STATUS_RECEIVE_DTIM             0x00000020
-//#define fOP_STATUS_TX_RATE_SWITCH_ENABLED   0x00000040
-#define fOP_STATUS_MEDIA_STATE_CONNECTED    0x00000080
-#define fOP_STATUS_WMM_INUSED               0x00000100
-#define fOP_STATUS_AGGREGATION_INUSED       0x00000200
-#define fOP_STATUS_DOZE                     0x00000400  // debug purpose
-#define fOP_STATUS_PIGGYBACK_INUSED         0x00000800  // piggy-back, and aggregation
-#define fOP_STATUS_APSD_INUSED				0x00001000
-#define fOP_STATUS_TX_AMSDU_INUSED			0x00002000
-#define fOP_STATUS_MAX_RETRY_ENABLED		0x00004000
-#define fOP_STATUS_WAKEUP_NOW               0x00008000
-#define fOP_STATUS_PCIE_DEVICE       0x00020000
-
-//
-//  RTMP_ADAPTER PSFlags : related to advanced power save.
-//
-// Indicate whether driver can go to sleep mode from now. This flag is useful AFTER link up
-#define fRTMP_PS_CAN_GO_SLEEP          0x00000001
-// Indicate whether driver has issue a LinkControl command to PCIe L1
-#define fRTMP_PS_SET_PCI_CLK_OFF_COMMAND          0x00000002
-// Indicate driver should disable kick off hardware to send packets from now.
-#define fRTMP_PS_DISABLE_TX         0x00000004
-// Indicate driver should IMMEDIATELY fo to sleep after receiving AP's beacon in which  doesn't indicate unicate nor multicast packets for me
-//. This flag is used ONLY in RTMPHandleRxDoneInterrupt routine.
-#define fRTMP_PS_GO_TO_SLEEP_NOW         0x00000008
-#define fRTMP_PS_TOGGLE_L1		0x00000010	// Use Toggle L1 mechanism for rt28xx PCIe
-#ifdef RT3090
-#define WAKE_MCU_CMD				0x31
-#define SLEEP_MCU_CMD					0x30
-#define RFOFF_MCU_CMD				0x35
-#endif // RT3090 //
-#ifdef DOT11N_DRAFT3
-#define fOP_STATUS_SCAN_2040			    0x00040000
-#endif // DOT11N_DRAFT3 //
-
-#define CCKSETPROTECT		0x1
-#define OFDMSETPROTECT		0x2
-#define MM20SETPROTECT		0x4
-#define MM40SETPROTECT		0x8
-#define GF20SETPROTECT		0x10
-#define GR40SETPROTECT		0x20
-#define ALLN_SETPROTECT		(GR40SETPROTECT | GF20SETPROTECT | MM40SETPROTECT | MM20SETPROTECT)
-
-//
-//  AP's client table operation status flags
-//
-#define fCLIENT_STATUS_WMM_CAPABLE          0x00000001  // CLIENT can parse QOS DATA frame
-#define fCLIENT_STATUS_AGGREGATION_CAPABLE  0x00000002  // CLIENT can receive Ralink's proprietary TX aggregation frame
-#define fCLIENT_STATUS_PIGGYBACK_CAPABLE    0x00000004  // CLIENT support piggy-back
-#define fCLIENT_STATUS_AMSDU_INUSED			0x00000008
-#define fCLIENT_STATUS_SGI20_CAPABLE		0x00000010
-#define fCLIENT_STATUS_SGI40_CAPABLE		0x00000020
-#define fCLIENT_STATUS_TxSTBC_CAPABLE		0x00000040
-#define fCLIENT_STATUS_RxSTBC_CAPABLE		0x00000080
-#define fCLIENT_STATUS_HTC_CAPABLE			0x00000100
-#define fCLIENT_STATUS_RDG_CAPABLE			0x00000200
-#define fCLIENT_STATUS_MCSFEEDBACK_CAPABLE  0x00000400
-#define fCLIENT_STATUS_APSD_CAPABLE         0x00000800  /* UAPSD STATION */
-
-#ifdef DOT11N_DRAFT3
-#define fCLIENT_STATUS_BSSCOEXIST_CAPABLE	0x00001000
-#endif // DOT11N_DRAFT3 //
-
-#define fCLIENT_STATUS_RALINK_CHIPSET		0x00100000
-//
-//  STA configuration flags
-//
-//#define fSTA_CFG_ENABLE_TX_BURST          0x00000001
-
-// 802.11n Operating Mode Definition. 0-3 also used in ASICUPdateProtect switch case
-#define HT_NO_PROTECT	0
-#define HT_LEGACY_PROTECT	1
-#define HT_40_PROTECT	2
-#define HT_2040_PROTECT	3
-#define HT_RTSCTS_6M	7
-//following is our own definition in order to turn on our ASIC protection register in INFRASTRUCTURE.
-#define HT_ATHEROS	8	// rt2860c has problem with atheros chip. we need to turn on RTS/CTS .
-#define HT_FORCERTSCTS	9	// Force turn on RTS/CTS first. then go to evaluate if this force RTS is necessary.
-
-//
-// RX Packet Filter control flags. Apply on pAd->PacketFilter
-//
-#define fRX_FILTER_ACCEPT_DIRECT            NDIS_PACKET_TYPE_DIRECTED
-#define fRX_FILTER_ACCEPT_MULTICAST         NDIS_PACKET_TYPE_MULTICAST
-#define fRX_FILTER_ACCEPT_BROADCAST         NDIS_PACKET_TYPE_BROADCAST
-#define fRX_FILTER_ACCEPT_ALL_MULTICAST     NDIS_PACKET_TYPE_ALL_MULTICAST
-#define fRX_FILTER_ACCEPT_PROMISCUOUS       NDIS_PACKET_TYPE_PROMISCUOUS
-
-//
-// Error code section
-//
-// NDIS_ERROR_CODE_ADAPTER_NOT_FOUND
-#define ERRLOG_READ_PCI_SLOT_FAILED     0x00000101L
-#define ERRLOG_WRITE_PCI_SLOT_FAILED    0x00000102L
-#define ERRLOG_VENDOR_DEVICE_NOMATCH    0x00000103L
-
-// NDIS_ERROR_CODE_ADAPTER_DISABLED
-#define ERRLOG_BUS_MASTER_DISABLED      0x00000201L
-
-// NDIS_ERROR_CODE_UNSUPPORTED_CONFIGURATION
-#define ERRLOG_INVALID_SPEED_DUPLEX     0x00000301L
-#define ERRLOG_SET_SECONDARY_FAILED     0x00000302L
-
-// NDIS_ERROR_CODE_OUT_OF_RESOURCES
-#define ERRLOG_OUT_OF_MEMORY            0x00000401L
-#define ERRLOG_OUT_OF_SHARED_MEMORY     0x00000402L
-#define ERRLOG_OUT_OF_MAP_REGISTERS     0x00000403L
-#define ERRLOG_OUT_OF_BUFFER_POOL       0x00000404L
-#define ERRLOG_OUT_OF_NDIS_BUFFER       0x00000405L
-#define ERRLOG_OUT_OF_PACKET_POOL       0x00000406L
-#define ERRLOG_OUT_OF_NDIS_PACKET       0x00000407L
-#define ERRLOG_OUT_OF_LOOKASIDE_MEMORY  0x00000408L
-
-// NDIS_ERROR_CODE_HARDWARE_FAILURE
-#define ERRLOG_SELFTEST_FAILED          0x00000501L
-#define ERRLOG_INITIALIZE_ADAPTER       0x00000502L
-#define ERRLOG_REMOVE_MINIPORT          0x00000503L
-
-// NDIS_ERROR_CODE_RESOURCE_CONFLICT
-#define ERRLOG_MAP_IO_SPACE             0x00000601L
-#define ERRLOG_QUERY_ADAPTER_RESOURCES  0x00000602L
-#define ERRLOG_NO_IO_RESOURCE           0x00000603L
-#define ERRLOG_NO_INTERRUPT_RESOURCE    0x00000604L
-#define ERRLOG_NO_MEMORY_RESOURCE       0x00000605L
-
-
-// WDS definition
-#define	MAX_WDS_ENTRY               4
-#define WDS_PAIRWISE_KEY_OFFSET     60    // WDS links uses pairwise key#60 ~ 63 in ASIC pairwise key table
-
-#define	WDS_DISABLE_MODE            0
-#define	WDS_RESTRICT_MODE           1
-#define	WDS_BRIDGE_MODE             2
-#define	WDS_REPEATER_MODE           3
-#define	WDS_LAZY_MODE               4
-
-
-#define MAX_MESH_NUM				0
-
-#define MAX_APCLI_NUM				0
-#ifdef APCLI_SUPPORT
-#undef	MAX_APCLI_NUM
-#define MAX_APCLI_NUM				1
-#endif // APCLI_SUPPORT //
-
-#define MAX_MBSSID_NUM				1
-#ifdef MBSS_SUPPORT
-#undef	MAX_MBSSID_NUM
-#define MAX_MBSSID_NUM				(8 - MAX_MESH_NUM - MAX_APCLI_NUM)
-#endif // MBSS_SUPPORT //
-
-/* sanity check for apidx */
-#define MBSS_MR_APIDX_SANITY_CHECK(apidx) \
-    { if (apidx > MAX_MBSSID_NUM) { \
-          DBGPRINT(RT_DEBUG_ERROR, ("%s> Error! apidx = %d > MAX_MBSSID_NUM!\n", __FUNCTION__, apidx)); \
-	  apidx = MAIN_MBSSID; } }
-
-#define VALID_WCID(_wcid)	((_wcid) > 0 && (_wcid) < MAX_LEN_OF_MAC_TABLE )
-
-#define MAIN_MBSSID                 0
-#define FIRST_MBSSID                1
-
-
-#define MAX_BEACON_SIZE				512
-// If the MAX_MBSSID_NUM is larger than 6,
-// it shall reserve some WCID space(wcid 222~253) for beacon frames.
-// -	these wcid 238~253 are reserved for beacon#6(ra6).
-// -	these wcid 222~237 are reserved for beacon#7(ra7).
-#if defined(MAX_MBSSID_NUM) && (MAX_MBSSID_NUM == 8)
-#define HW_RESERVED_WCID	222
-#elif defined(MAX_MBSSID_NUM) && (MAX_MBSSID_NUM == 7)
-#define HW_RESERVED_WCID	238
-#else
-#define HW_RESERVED_WCID	255
-#endif
-
-// Then dedicate wcid of DFS and Carrier-Sense.
-#define DFS_CTS_WCID		(HW_RESERVED_WCID - 1)
-#define CS_CTS_WCID		(HW_RESERVED_WCID - 2)
-#define LAST_SPECIFIC_WCID	(HW_RESERVED_WCID - 2)
-
-// If MAX_MBSSID_NUM is 8, the maximum available wcid for the associated STA is 211.
-// If MAX_MBSSID_NUM is 7, the maximum available wcid for the associated STA is 228.
-#define MAX_AVAILABLE_CLIENT_WCID	(LAST_SPECIFIC_WCID - MAX_MBSSID_NUM - 1)
-
-// TX need WCID to find Cipher Key
-// these wcid 212 ~ 219 are reserved for bc/mc packets if MAX_MBSSID_NUM is 8.
-#define GET_GroupKey_WCID(__wcid, __bssidx) \
-	{										\
-		__wcid = LAST_SPECIFIC_WCID - (MAX_MBSSID_NUM) + __bssidx;	\
-	}
-
-#define IsGroupKeyWCID(__wcid) (((__wcid) < LAST_SPECIFIC_WCID) && ((__wcid) >= (LAST_SPECIFIC_WCID - (MAX_MBSSID_NUM))))
-
-
-// definition to support multiple BSSID
-#define BSS0                            0
-#define BSS1                            1
-#define BSS2                            2
-#define BSS3                            3
-#define BSS4                            4
-#define BSS5                            5
-#define BSS6                            6
-#define BSS7                            7
-
-
-//============================================================
-// Length definitions
-#define PEER_KEY_NO                     2
-#define MAC_ADDR_LEN                    6
-#define TIMESTAMP_LEN                   8
-#define MAX_LEN_OF_SUPPORTED_RATES      MAX_LENGTH_OF_SUPPORT_RATES // 1, 2, 5.5, 11, 6, 9, 12, 18, 24, 36, 48, 54
-#define MAX_NUM_OF_REGULATORY_CLASS		16
-#define MAX_LEN_OF_KEY                  32      // 32 octets == 256 bits, Redefine for WPA
-#define MAX_NUM_OF_CHANNELS             MAX_NUM_OF_CHS      // 14 channels @2.4G +  12@UNII + 4 @MMAC + 11 @HiperLAN2 + 7 @Japan + 1 as NULL termination
-#define MAX_NUM_OF_11JCHANNELS             20      // 14 channels @2.4G +  12@UNII + 4 @MMAC + 11 @HiperLAN2 + 7 @Japan + 1 as NULL termination
-#define MAX_LEN_OF_SSID                 32
-#define CIPHER_TEXT_LEN                 128
-#define HASH_TABLE_SIZE                 256
-#define MAX_VIE_LEN                     1024   // New for WPA cipher suite variable IE sizes.
-#define MAX_SUPPORT_MCS             32
-#define MAX_NUM_OF_BBP_LATCH             140
-//============================================================
-// ASIC WCID Table definition.
-//============================================================
-#define BSSID_WCID		1	// in infra mode, always put bssid with this WCID
-#define MCAST_WCID	0x0
-#define BSS0Mcast_WCID	0x0
-#define BSS1Mcast_WCID	0xf8
-#define BSS2Mcast_WCID	0xf9
-#define BSS3Mcast_WCID	0xfa
-#define BSS4Mcast_WCID	0xfb
-#define BSS5Mcast_WCID	0xfc
-#define BSS6Mcast_WCID	0xfd
-#define BSS7Mcast_WCID	0xfe
-#define RESERVED_WCID		0xff
-
-#define MAX_NUM_OF_ACL_LIST				MAX_NUMBER_OF_ACL
-
-#define MAX_LEN_OF_MAC_TABLE            MAX_NUMBER_OF_MAC // if MAX_MBSSID_NUM is 8, this value can't be larger than 211
-
-#if MAX_LEN_OF_MAC_TABLE>MAX_AVAILABLE_CLIENT_WCID
-#error MAX_LEN_OF_MAC_TABLE can not be larger than MAX_AVAILABLE_CLIENT_WCID!!!!
-#endif
-
-#define MAX_NUM_OF_WDS_LINK_PERBSSID	            3
-#define MAX_NUM_OF_WDS_LINK	            (MAX_NUM_OF_WDS_LINK_PERBSSID*MAX_MBSSID_NUM)
-#define MAX_NUM_OF_EVENT                MAX_NUMBER_OF_EVENT
-#define WDS_LINK_START_WCID				(MAX_LEN_OF_MAC_TABLE-1)
-
-#define NUM_OF_TID			8
-#define MAX_AID_BA                    4
-#define MAX_LEN_OF_BA_REC_TABLE          ((NUM_OF_TID * MAX_LEN_OF_MAC_TABLE)/2)//   (NUM_OF_TID*MAX_AID_BA + 32)	 //Block ACK recipient
-#define MAX_LEN_OF_BA_ORI_TABLE          ((NUM_OF_TID * MAX_LEN_OF_MAC_TABLE)/2)//   (NUM_OF_TID*MAX_AID_BA + 32)   // Block ACK originator
-#define MAX_LEN_OF_BSS_TABLE             64
-#define MAX_REORDERING_MPDU_NUM			 512
-
-// key related definitions
-#define SHARE_KEY_NUM                   4
-#define MAX_LEN_OF_SHARE_KEY            16    // byte count
-#define MAX_LEN_OF_PEER_KEY             16    // byte count
-#define PAIRWISE_KEY_NUM                64    // in MAC ASIC pairwise key table
-#define GROUP_KEY_NUM                   4
-#define PMK_LEN                         32
-#define WDS_PAIRWISE_KEY_OFFSET         60    // WDS links uses pairwise key#60 ~ 63 in ASIC pairwise key table
-#define	PMKID_NO                        4     // Number of PMKID saved supported
-#define MAX_LEN_OF_MLME_BUFFER          2048
-
-// power status related definitions
-#define PWR_ACTIVE                      0
-#define PWR_SAVE                        1
-#define PWR_MMPS                        2			//MIMO power save
-//#define PWR_UNKNOWN                   2
-
-// Auth and Assoc mode related definitions
-#define AUTH_MODE_OPEN                  0x00
-#define AUTH_MODE_KEY                   0x01
-//#define AUTH_MODE_AUTO_SWITCH         0x03
-//#define AUTH_MODE_DEAUTH              0x04
-//#define AUTH_MODE_UPLAYER             0x05 // reserved for 802.11i use
-
-// BSS Type definitions
-#define BSS_ADHOC                       0  // = Ndis802_11IBSS
-#define BSS_INFRA                       1  // = Ndis802_11Infrastructure
-#define BSS_ANY                         2  // = Ndis802_11AutoUnknown
-#define BSS_MONITOR			            3  // = Ndis802_11Monitor
-
-
-// Reason code definitions
-#define REASON_RESERVED                 0
-#define REASON_UNSPECIFY                1
-#define REASON_NO_LONGER_VALID          2
-#define REASON_DEAUTH_STA_LEAVING       3
-#define REASON_DISASSOC_INACTIVE        4
-#define REASON_DISASSPC_AP_UNABLE       5
-#define REASON_CLS2ERR                  6
-#define REASON_CLS3ERR                  7
-#define REASON_DISASSOC_STA_LEAVING     8
-#define REASON_STA_REQ_ASSOC_NOT_AUTH   9
-#define REASON_INVALID_IE               13
-#define REASON_MIC_FAILURE              14
-#define REASON_4_WAY_TIMEOUT            15
-#define REASON_GROUP_KEY_HS_TIMEOUT     16
-#define REASON_IE_DIFFERENT             17
-#define REASON_MCIPHER_NOT_VALID        18
-#define REASON_UCIPHER_NOT_VALID        19
-#define REASON_AKMP_NOT_VALID           20
-#define REASON_UNSUPPORT_RSNE_VER       21
-#define REASON_INVALID_RSNE_CAP         22
-#define REASON_8021X_AUTH_FAIL          23
-#define REASON_CIPHER_SUITE_REJECTED    24
-#define REASON_DECLINED                 37
-
-#define REASON_QOS_UNSPECIFY              32
-#define REASON_QOS_LACK_BANDWIDTH         33
-#define REASON_POOR_CHANNEL_CONDITION     34
-#define REASON_QOS_OUTSIDE_TXOP_LIMITION  35
-#define REASON_QOS_QSTA_LEAVING_QBSS      36
-#define REASON_QOS_UNWANTED_MECHANISM     37
-#define REASON_QOS_MECH_SETUP_REQUIRED    38
-#define REASON_QOS_REQUEST_TIMEOUT        39
-#define REASON_QOS_CIPHER_NOT_SUPPORT     45
-
-// Status code definitions
-#define MLME_SUCCESS                    0
-#define MLME_UNSPECIFY_FAIL             1
-#define MLME_CANNOT_SUPPORT_CAP         10
-#define MLME_REASSOC_DENY_ASSOC_EXIST   11
-#define MLME_ASSOC_DENY_OUT_SCOPE       12
-#define MLME_ALG_NOT_SUPPORT            13
-#define MLME_SEQ_NR_OUT_OF_SEQUENCE     14
-#define MLME_REJ_CHALLENGE_FAILURE      15
-#define MLME_REJ_TIMEOUT                  16
-#define MLME_ASSOC_REJ_UNABLE_HANDLE_STA  17
-#define MLME_ASSOC_REJ_DATA_RATE          18
-
-#define MLME_ASSOC_REJ_NO_EXT_RATE        22
-#define MLME_ASSOC_REJ_NO_EXT_RATE_PBCC   23
-#define MLME_ASSOC_REJ_NO_CCK_OFDM        24
-
-#define MLME_QOS_UNSPECIFY                32
-#define MLME_REQUEST_DECLINED             37
-#define MLME_REQUEST_WITH_INVALID_PARAM   38
-#define MLME_INVALID_GROUP_CIPHER	  41
-#define MLME_INVALID_PAIRWISE_CIPHER	  42
-#define MLME_INVALID_AKMP			  43
-#define MLME_DLS_NOT_ALLOW_IN_QBSS        48
-#define MLME_DEST_STA_NOT_IN_QBSS         49
-#define MLME_DEST_STA_IS_NOT_A_QSTA       50
-
-#define MLME_INVALID_FORMAT             0x51
-#define MLME_FAIL_NO_RESOURCE           0x52
-#define MLME_STATE_MACHINE_REJECT       0x53
-#define MLME_MAC_TABLE_FAIL             0x54
-
-// IE code
-#define IE_SSID                         0
-#define IE_SUPP_RATES                   1
-#define IE_FH_PARM                      2
-#define IE_DS_PARM                      3
-#define IE_CF_PARM                      4
-#define IE_TIM                          5
-#define IE_IBSS_PARM                    6
-#define IE_COUNTRY                      7     // 802.11d
-#define IE_802_11D_REQUEST              10    // 802.11d
-#define IE_QBSS_LOAD                    11    // 802.11e d9
-#define IE_EDCA_PARAMETER               12    // 802.11e d9
-#define IE_TSPEC                        13    // 802.11e d9
-#define IE_TCLAS                        14    // 802.11e d9
-#define IE_SCHEDULE                     15    // 802.11e d9
-#define IE_CHALLENGE_TEXT               16
-#define IE_POWER_CONSTRAINT             32    // 802.11h d3.3
-#define IE_POWER_CAPABILITY             33    // 802.11h d3.3
-#define IE_TPC_REQUEST                  34    // 802.11h d3.3
-#define IE_TPC_REPORT                   35    // 802.11h d3.3
-#define IE_SUPP_CHANNELS                36    // 802.11h d3.3
-#define IE_CHANNEL_SWITCH_ANNOUNCEMENT  37    // 802.11h d3.3
-#define IE_MEASUREMENT_REQUEST          38    // 802.11h d3.3
-#define IE_MEASUREMENT_REPORT           39    // 802.11h d3.3
-#define IE_QUIET                        40    // 802.11h d3.3
-#define IE_IBSS_DFS                     41    // 802.11h d3.3
-#define IE_ERP                          42    // 802.11g
-#define IE_TS_DELAY                     43    // 802.11e d9
-#define IE_TCLAS_PROCESSING             44    // 802.11e d9
-#define IE_QOS_CAPABILITY               46    // 802.11e d6
-#define IE_HT_CAP                       45    // 802.11n d1. HT CAPABILITY. ELEMENT ID TBD
-#define IE_AP_CHANNEL_REPORT			51    // 802.11k d6
-#define IE_HT_CAP2                         52    // 802.11n d1. HT CAPABILITY. ELEMENT ID TBD
-#define IE_RSN                          48    // 802.11i d3.0
-#define IE_WPA2                         48    // WPA2
-#define IE_EXT_SUPP_RATES               50    // 802.11g
-#define IE_SUPP_REG_CLASS               59    // 802.11y. Supported regulatory classes.
-#define IE_EXT_CHANNEL_SWITCH_ANNOUNCEMENT	60	// 802.11n
-#define IE_ADD_HT                         61    // 802.11n d1. ADDITIONAL HT CAPABILITY. ELEMENT ID TBD
-#define IE_ADD_HT2                        53    // 802.11n d1. ADDITIONAL HT CAPABILITY. ELEMENT ID TBD
-
-
-// For 802.11n D3.03
-//#define IE_NEW_EXT_CHA_OFFSET             62    // 802.11n d1. New extension channel offset elemet
-#define IE_SECONDARY_CH_OFFSET		62	// 802.11n D3.03	Secondary Channel Offset element
-#define IE_WAPI							68		// WAPI information element
-#define IE_2040_BSS_COEXIST               72    // 802.11n D3.0.3
-#define IE_2040_BSS_INTOLERANT_REPORT     73    // 802.11n D3.03
-#define IE_OVERLAPBSS_SCAN_PARM           74    // 802.11n D3.03
-#define IE_EXT_CAPABILITY                127   // 802.11n D3.03
-
-
-#define IE_WPA                          221   // WPA
-#define IE_VENDOR_SPECIFIC              221   // Wifi WMM (WME)
-
-#define OUI_BROADCOM_HT              51   //
-#define OUI_BROADCOM_HTADD              52   //
-#define OUI_PREN_HT_CAP              51   //
-#define OUI_PREN_ADD_HT              52   //
-
-// CCX information
-#define IE_AIRONET_CKIP                 133   // CCX1.0 ID 85H for CKIP
-#define IE_AP_TX_POWER                  150   // CCX 2.0 for AP transmit power
-#define IE_MEASUREMENT_CAPABILITY       221   // CCX 2.0
-#define IE_CCX_V2                       221
-#define IE_AIRONET_IPADDRESS            149   // CCX ID 95H for IP Address
-#define IE_AIRONET_CCKMREASSOC          156   // CCX ID 9CH for CCKM Reassociation Request element
-#define CKIP_NEGOTIATION_LENGTH         30
-#define AIRONET_IPADDRESS_LENGTH        10
-#define AIRONET_CCKMREASSOC_LENGTH      24
-
-// ========================================================
-// MLME state machine definition
-// ========================================================
-
-// STA MLME state mahcines
-#define ASSOC_STATE_MACHINE             1
-#define AUTH_STATE_MACHINE              2
-#define AUTH_RSP_STATE_MACHINE          3
-#define SYNC_STATE_MACHINE              4
-#define MLME_CNTL_STATE_MACHINE         5
-#define WPA_PSK_STATE_MACHINE           6
-//#define LEAP_STATE_MACHINE              7
-#define AIRONET_STATE_MACHINE           8
-#define ACTION_STATE_MACHINE           9
-
-// AP MLME state machines
-#define AP_ASSOC_STATE_MACHINE          11
-#define AP_AUTH_STATE_MACHINE           12
-#define AP_SYNC_STATE_MACHINE           14
-#define AP_CNTL_STATE_MACHINE           15
-#define WSC_STATE_MACHINE            17
-#define WSC_UPNP_STATE_MACHINE		    18
-
-
-#define WPA_STATE_MACHINE			23
-
-
-#ifdef QOS_DLS_SUPPORT
-#define DLS_STATE_MACHINE               26
-#endif // QOS_DLS_SUPPORT //
-
-//
-// STA's CONTROL/CONNECT state machine: states, events, total function #
-//
-#define CNTL_IDLE                       0
-#define CNTL_WAIT_DISASSOC              1
-#define CNTL_WAIT_JOIN                  2
-#define CNTL_WAIT_REASSOC               3
-#define CNTL_WAIT_START                 4
-#define CNTL_WAIT_AUTH                  5
-#define CNTL_WAIT_ASSOC                 6
-#define CNTL_WAIT_AUTH2                 7
-#define CNTL_WAIT_OID_LIST_SCAN         8
-#define CNTL_WAIT_OID_DISASSOC          9
-
-#define MT2_ASSOC_CONF                  34
-#define MT2_AUTH_CONF                   35
-#define MT2_DEAUTH_CONF                 36
-#define MT2_DISASSOC_CONF               37
-#define MT2_REASSOC_CONF                38
-#define MT2_PWR_MGMT_CONF               39
-#define MT2_JOIN_CONF                   40
-#define MT2_SCAN_CONF                   41
-#define MT2_START_CONF                  42
-#define MT2_GET_CONF                    43
-#define MT2_SET_CONF                    44
-#define MT2_RESET_CONF                  45
-#define MT2_FT_OTD_CONF					46
-#define MT2_MLME_ROAMING_REQ            52
-
-#define CNTL_FUNC_SIZE                  1
-
-//
-// STA's ASSOC state machine: states, events, total function #
-//
-#define ASSOC_IDLE                      0
-#define ASSOC_WAIT_RSP                  1
-#define REASSOC_WAIT_RSP                2
-#define DISASSOC_WAIT_RSP               3
-#define MAX_ASSOC_STATE                 4
-
-#define ASSOC_MACHINE_BASE              0
-#define MT2_MLME_ASSOC_REQ              0
-#define MT2_MLME_REASSOC_REQ            1
-#define MT2_MLME_DISASSOC_REQ           2
-#define MT2_PEER_DISASSOC_REQ           3
-#define MT2_PEER_ASSOC_REQ              4
-#define MT2_PEER_ASSOC_RSP              5
-#define MT2_PEER_REASSOC_REQ            6
-#define MT2_PEER_REASSOC_RSP            7
-#define MT2_DISASSOC_TIMEOUT            8
-#define MT2_ASSOC_TIMEOUT               9
-#define MT2_REASSOC_TIMEOUT             10
-#define MAX_ASSOC_MSG                   11
-
-#define ASSOC_FUNC_SIZE                 (MAX_ASSOC_STATE * MAX_ASSOC_MSG)
-
-//
-// ACT state machine: states, events, total function #
-//
-#define ACT_IDLE                      0
-#define MAX_ACT_STATE                 1
-
-#define ACT_MACHINE_BASE              0
-
-//Those PEER_xx_CATE number is based on real Categary value in IEEE spec. Please don'es modify it by your self.
-//Category
-#define MT2_PEER_SPECTRUM_CATE              0
-#define MT2_PEER_QOS_CATE              1
-#define MT2_PEER_DLS_CATE             2
-#define MT2_PEER_BA_CATE             3
-#define MT2_PEER_PUBLIC_CATE             4
-#define MT2_PEER_RM_CATE             5
-/* "FT_CATEGORY_BSS_TRANSITION equal to 6" is defined file of "dot11r_ft.h" */
-#define MT2_PEER_HT_CATE             7	//	7.4.7
-#define MAX_PEER_CATE_MSG                   7
-
-
-#define MT2_MLME_ADD_BA_CATE             8
-#define MT2_MLME_ORI_DELBA_CATE             9
-#define MT2_MLME_REC_DELBA_CATE             10
-#define MT2_MLME_QOS_CATE              11
-#define MT2_MLME_DLS_CATE             12
-#define MT2_ACT_INVALID             13
-
-#define MAX_ACT_MSG                   14
-
-
-//Category field
-#define CATEGORY_SPECTRUM		0
-#define CATEGORY_QOS			1
-#define CATEGORY_DLS			2
-#define CATEGORY_BA			3
-#define CATEGORY_PUBLIC		4
-#define CATEGORY_RM			5
-#define CATEGORY_HT			7
-
-
-// DLS Action frame definition
-#define ACTION_DLS_REQUEST			0
-#define ACTION_DLS_RESPONSE			1
-#define ACTION_DLS_TEARDOWN			2
-
-//Spectrum  Action field value 802.11h 7.4.1
-#define SPEC_MRQ	0	// Request
-#define SPEC_MRP	1	//Report
-#define SPEC_TPCRQ	2
-#define SPEC_TPCRP	3
-#define SPEC_CHANNEL_SWITCH	4
-
-
-//BA  Action field value
-#define ADDBA_REQ	0
-#define ADDBA_RESP	1
-#define DELBA   2
-
-//Public's  Action field value in Public Category.  Some in 802.11y and some in 11n
-#define ACTION_BSS_2040_COEXIST				0	// 11n
-#define ACTION_DSE_ENABLEMENT					1	// 11y D9.0
-#define ACTION_DSE_DEENABLEMENT				2	// 11y D9.0
-#define ACTION_DSE_REG_LOCATION_ANNOUNCE	3	// 11y D9.0
-#define ACTION_EXT_CH_SWITCH_ANNOUNCE		4	// 11y D9.0
-#define ACTION_DSE_MEASUREMENT_REQ			5	// 11y D9.0
-#define ACTION_DSE_MEASUREMENT_REPORT		6	// 11y D9.0
-#define ACTION_MEASUREMENT_PILOT_ACTION		7	// 11y D9.0
-#define ACTION_DSE_POWER_CONSTRAINT			8	// 11y D9.0
-
-
-//HT  Action field value
-#define NOTIFY_BW_ACTION				0
-#define SMPS_ACTION						1
-#define PSMP_ACTION					2
-#define SETPCO_ACTION					3
-#define MIMO_CHA_MEASURE_ACTION			4
-#define MIMO_N_BEACONFORM				5
-#define MIMO_BEACONFORM					6
-#define ANTENNA_SELECT					7
-#define HT_INFO_EXCHANGE				8
-
-#define ACT_FUNC_SIZE                 (MAX_ACT_STATE * MAX_ACT_MSG)
-//
-// STA's AUTHENTICATION state machine: states, evvents, total function #
-//
-#define AUTH_REQ_IDLE                   0
-#define AUTH_WAIT_SEQ2                  1
-#define AUTH_WAIT_SEQ4                  2
-#define MAX_AUTH_STATE                  3
-
-#define AUTH_MACHINE_BASE               0
-#define MT2_MLME_AUTH_REQ               0
-#define MT2_PEER_AUTH_EVEN              1
-#define MT2_AUTH_TIMEOUT                2
-#define MAX_AUTH_MSG                    3
-
-#define AUTH_FUNC_SIZE                  (MAX_AUTH_STATE * MAX_AUTH_MSG)
-
-//
-// STA's AUTH_RSP state machine: states, events, total function #
-//
-#define AUTH_RSP_IDLE                   0
-#define AUTH_RSP_WAIT_CHAL              1
-#define MAX_AUTH_RSP_STATE              2
-
-#define AUTH_RSP_MACHINE_BASE           0
-#define MT2_AUTH_CHALLENGE_TIMEOUT      0
-#define MT2_PEER_AUTH_ODD               1
-#define MT2_PEER_DEAUTH                 2
-#define MAX_AUTH_RSP_MSG                3
-
-#define AUTH_RSP_FUNC_SIZE              (MAX_AUTH_RSP_STATE * MAX_AUTH_RSP_MSG)
-
-//
-// STA's SYNC state machine: states, events, total function #
-//
-#define SYNC_IDLE                       0  // merge NO_BSS,IBSS_IDLE,IBSS_ACTIVE and BSS in to 1 state
-#define JOIN_WAIT_BEACON                1
-#define SCAN_LISTEN                     2
-#define MAX_SYNC_STATE                  3
-
-#define SYNC_MACHINE_BASE               0
-#define MT2_MLME_SCAN_REQ               0
-#define MT2_MLME_JOIN_REQ               1
-#define MT2_MLME_START_REQ              2
-#define MT2_PEER_BEACON                 3
-#define MT2_PEER_PROBE_RSP              4
-#define MT2_PEER_ATIM                   5
-#define MT2_SCAN_TIMEOUT                6
-#define MT2_BEACON_TIMEOUT              7
-#define MT2_ATIM_TIMEOUT                8
-#define MT2_PEER_PROBE_REQ              9
-#define MAX_SYNC_MSG                    10
-
-#define SYNC_FUNC_SIZE                  (MAX_SYNC_STATE * MAX_SYNC_MSG)
-
-//Messages for the DLS state machine
-#define DLS_IDLE						0
-#define MAX_DLS_STATE					1
-
-#define DLS_MACHINE_BASE				0
-#define MT2_MLME_DLS_REQ			    0
-#define MT2_PEER_DLS_REQ			    1
-#define MT2_PEER_DLS_RSP			    2
-#define MT2_MLME_DLS_TEAR_DOWN		    3
-#define MT2_PEER_DLS_TEAR_DOWN		    4
-#define MAX_DLS_MSG				        5
-
-#define DLS_FUNC_SIZE					(MAX_DLS_STATE * MAX_DLS_MSG)
-
-//
-// WSC State machine: states, events, total function #
-//
-
-//
-// AP's CONTROL/CONNECT state machine: states, events, total function #
-//
-#define AP_CNTL_FUNC_SIZE               1
-
-//
-// AP's ASSOC state machine: states, events, total function #
-//
-#define AP_ASSOC_IDLE                   0
-#define AP_MAX_ASSOC_STATE              1
-
-#define AP_ASSOC_MACHINE_BASE           0
-#define APMT2_MLME_DISASSOC_REQ         0
-#define APMT2_PEER_DISASSOC_REQ         1
-#define APMT2_PEER_ASSOC_REQ            2
-#define APMT2_PEER_REASSOC_REQ          3
-#define APMT2_CLS3ERR                   4
-#define AP_MAX_ASSOC_MSG                5
-
-#define AP_ASSOC_FUNC_SIZE              (AP_MAX_ASSOC_STATE * AP_MAX_ASSOC_MSG)
-
-//
-// AP's AUTHENTICATION state machine: states, events, total function #
-//
-#define AP_AUTH_REQ_IDLE                0
-#define AP_MAX_AUTH_STATE               1
-
-#define AP_AUTH_MACHINE_BASE            0
-#define APMT2_MLME_DEAUTH_REQ           0
-#define APMT2_CLS2ERR                   1
-#define APMT2_PEER_DEAUTH				2
-#define APMT2_PEER_AUTH_REQ				3
-#define APMT2_PEER_AUTH_CONFIRM			4
-#define AP_MAX_AUTH_MSG                 5
-
-#define AP_AUTH_FUNC_SIZE               (AP_MAX_AUTH_STATE * AP_MAX_AUTH_MSG)
-
-//
-// AP's SYNC state machine: states, events, total function #
-//
-#define AP_SYNC_IDLE                    0
-#define AP_SCAN_LISTEN					1
-#define AP_MAX_SYNC_STATE               2
-
-#define AP_SYNC_MACHINE_BASE            0
-#define APMT2_PEER_PROBE_REQ            0
-#define APMT2_PEER_BEACON               1
-#define APMT2_MLME_SCAN_REQ				2
-#define APMT2_PEER_PROBE_RSP			3
-#define APMT2_SCAN_TIMEOUT				4
-#define APMT2_MLME_SCAN_CNCL			5
-#define AP_MAX_SYNC_MSG                 6
-
-#define AP_SYNC_FUNC_SIZE               (AP_MAX_SYNC_STATE * AP_MAX_SYNC_MSG)
-
-//
-// Common WPA state machine: states, events, total function #
-//
-#define WPA_PTK                      0
-#define MAX_WPA_PTK_STATE            1
-
-#define WPA_MACHINE_BASE             0
-#define MT2_EAPPacket                0
-#define MT2_EAPOLStart               1
-#define MT2_EAPOLLogoff              2
-#define MT2_EAPOLKey                 3
-#define MT2_EAPOLASFAlert            4
-#define MAX_WPA_MSG                  5
-
-#define WPA_FUNC_SIZE                (MAX_WPA_PTK_STATE * MAX_WPA_MSG)
-
-#ifdef APCLI_SUPPORT
-//ApCli authentication state machine
-#define APCLI_AUTH_REQ_IDLE                0
-#define APCLI_AUTH_WAIT_SEQ2               1
-#define APCLI_AUTH_WAIT_SEQ4               2
-#define APCLI_MAX_AUTH_STATE               3
-
-#define APCLI_AUTH_MACHINE_BASE            0
-#define APCLI_MT2_MLME_AUTH_REQ            0
-#define APCLI_MT2_MLME_DEAUTH_REQ          1
-#define APCLI_MT2_PEER_AUTH_EVEN           2
-#define APCLI_MT2_PEER_DEAUTH              3
-#define APCLI_MT2_AUTH_TIMEOUT             4
-#define APCLI_MAX_AUTH_MSG                 5
-
-#define APCLI_AUTH_FUNC_SIZE               (APCLI_MAX_AUTH_STATE * APCLI_MAX_AUTH_MSG)
-
-//ApCli association state machine
-#define APCLI_ASSOC_IDLE                   0
-#define APCLI_ASSOC_WAIT_RSP               1
-#define APCLI_MAX_ASSOC_STATE              2
-
-#define APCLI_ASSOC_MACHINE_BASE           0
-#define APCLI_MT2_MLME_ASSOC_REQ           0
-#define APCLI_MT2_MLME_DISASSOC_REQ        1
-#define APCLI_MT2_PEER_DISASSOC_REQ        2
-#define APCLI_MT2_PEER_ASSOC_RSP           3
-#define APCLI_MT2_ASSOC_TIMEOUT            4
-#define APCLI_MAX_ASSOC_MSG                5
-
-#define APCLI_ASSOC_FUNC_SIZE              (APCLI_MAX_ASSOC_STATE * APCLI_MAX_ASSOC_MSG)
-
-//ApCli sync state machine
-#define APCLI_SYNC_IDLE                   0  // merge NO_BSS,IBSS_IDLE,IBSS_ACTIVE and BSS in to 1 state
-#define APCLI_JOIN_WAIT_PROBE_RSP         1
-#define APCLI_MAX_SYNC_STATE              2
-
-#define APCLI_SYNC_MACHINE_BASE           0
-#define APCLI_MT2_MLME_PROBE_REQ          0
-#define APCLI_MT2_PEER_PROBE_RSP          1
-#define APCLI_MT2_PROBE_TIMEOUT           2
-#define APCLI_MAX_SYNC_MSG                3
-
-#define APCLI_SYNC_FUNC_SIZE              (APCLI_MAX_SYNC_STATE * APCLI_MAX_SYNC_MSG)
-
-//ApCli ctrl state machine
-#define APCLI_CTRL_DISCONNECTED           0  // merge NO_BSS,IBSS_IDLE,IBSS_ACTIVE and BSS in to 1 state
-#define APCLI_CTRL_PROBE                  1
-#define APCLI_CTRL_AUTH                   2
-#define APCLI_CTRL_AUTH_2                 3
-#define APCLI_CTRL_ASSOC                  4
-#define APCLI_CTRL_DEASSOC                5
-#define APCLI_CTRL_CONNECTED              6
-#define APCLI_MAX_CTRL_STATE              7
-
-#define APCLI_CTRL_MACHINE_BASE           0
-#define APCLI_CTRL_JOIN_REQ               0
-#define APCLI_CTRL_PROBE_RSP              1
-#define APCLI_CTRL_AUTH_RSP               2
-#define APCLI_CTRL_DISCONNECT_REQ         3
-#define APCLI_CTRL_PEER_DISCONNECT_REQ    4
-#define APCLI_CTRL_ASSOC_RSP              5
-#define APCLI_CTRL_DEASSOC_RSP            6
-#define APCLI_CTRL_JOIN_REQ_TIMEOUT       7
-#define APCLI_CTRL_AUTH_REQ_TIMEOUT       8
-#define APCLI_CTRL_ASSOC_REQ_TIMEOUT      9
-#define APCLI_MAX_CTRL_MSG                10
-
-#define APCLI_CTRL_FUNC_SIZE              (APCLI_MAX_CTRL_STATE * APCLI_MAX_CTRL_MSG)
-
-
-#endif // APCLI_SUPPORT //
-
-
-// =============================================================================
-
-// value domain of 802.11 header FC.Tyte, which is b3..b2 of the 1st-byte of MAC header
-#define BTYPE_MGMT                  0
-#define BTYPE_CNTL                  1
-#define BTYPE_DATA                  2
-
-// value domain of 802.11 MGMT frame's FC.subtype, which is b7..4 of the 1st-byte of MAC header
-#define SUBTYPE_ASSOC_REQ           0
-#define SUBTYPE_ASSOC_RSP           1
-#define SUBTYPE_REASSOC_REQ         2
-#define SUBTYPE_REASSOC_RSP         3
-#define SUBTYPE_PROBE_REQ           4
-#define SUBTYPE_PROBE_RSP           5
-#define SUBTYPE_BEACON              8
-#define SUBTYPE_ATIM                9
-#define SUBTYPE_DISASSOC            10
-#define SUBTYPE_AUTH                11
-#define SUBTYPE_DEAUTH              12
-#define SUBTYPE_ACTION              13
-#define SUBTYPE_ACTION_NO_ACK              14
-
-// value domain of 802.11 CNTL frame's FC.subtype, which is b7..4 of the 1st-byte of MAC header
-#define SUBTYPE_WRAPPER		7
-#define SUBTYPE_BLOCK_ACK_REQ       8
-#define SUBTYPE_BLOCK_ACK           9
-#define SUBTYPE_PS_POLL             10
-#define SUBTYPE_RTS                 11
-#define SUBTYPE_CTS                 12
-#define SUBTYPE_ACK                 13
-#define SUBTYPE_CFEND               14
-#define SUBTYPE_CFEND_CFACK         15
-
-// value domain of 802.11 DATA frame's FC.subtype, which is b7..4 of the 1st-byte of MAC header
-#define SUBTYPE_DATA                0
-#define SUBTYPE_DATA_CFACK          1
-#define SUBTYPE_DATA_CFPOLL         2
-#define SUBTYPE_DATA_CFACK_CFPOLL   3
-#define SUBTYPE_NULL_FUNC           4
-#define SUBTYPE_CFACK               5
-#define SUBTYPE_CFPOLL              6
-#define SUBTYPE_CFACK_CFPOLL        7
-#define SUBTYPE_QDATA               8
-#define SUBTYPE_QDATA_CFACK         9
-#define SUBTYPE_QDATA_CFPOLL        10
-#define SUBTYPE_QDATA_CFACK_CFPOLL  11
-#define SUBTYPE_QOS_NULL            12
-#define SUBTYPE_QOS_CFACK           13
-#define SUBTYPE_QOS_CFPOLL          14
-#define SUBTYPE_QOS_CFACK_CFPOLL    15
-
-// ACK policy of QOS Control field bit 6:5
-#define NORMAL_ACK                  0x00  // b6:5 = 00
-#define NO_ACK                      0x20  // b6:5 = 01
-#define NO_EXPLICIT_ACK             0x40  // b6:5 = 10
-#define BLOCK_ACK                   0x60  // b6:5 = 11
-
-//
-// rtmp_data.c use these definition
-//
-#define LENGTH_802_11               24
-#define LENGTH_802_11_AND_H         30
-#define LENGTH_802_11_CRC_H         34
-#define LENGTH_802_11_CRC           28
-#define LENGTH_802_11_WITH_ADDR4    30
-#define LENGTH_802_3                14
-#define LENGTH_802_3_TYPE           2
-#define LENGTH_802_1_H              8
-#define LENGTH_EAPOL_H              4
-#define LENGTH_WMMQOS_H				2
-#define LENGTH_CRC                  4
-#define MAX_SEQ_NUMBER              0x0fff
-#define LENGTH_802_3_NO_TYPE		12
-#define LENGTH_802_1Q				4 /* VLAN related */
-
-// STA_CSR4.field.TxResult
-#define TX_RESULT_SUCCESS           0
-#define TX_RESULT_ZERO_LENGTH       1
-#define TX_RESULT_UNDER_RUN         2
-#define TX_RESULT_OHY_ERROR         4
-#define TX_RESULT_RETRY_FAIL        6
-
-// All PHY rate summary in TXD
-// Preamble MODE in TxD
-#define MODE_CCK	0
-#define MODE_OFDM   1
-#ifdef DOT11_N_SUPPORT
-#define MODE_HTMIX	2
-#define MODE_HTGREENFIELD	3
-#endif // DOT11_N_SUPPORT //
-// MCS for CCK.  BW.SGI.STBC are reserved
-#define MCS_LONGP_RATE_1                      0	 // long preamble CCK 1Mbps
-#define MCS_LONGP_RATE_2                      1	// long preamble CCK 1Mbps
-#define MCS_LONGP_RATE_5_5                    2
-#define MCS_LONGP_RATE_11                     3
-#define MCS_SHORTP_RATE_1                      4	 // long preamble CCK 1Mbps. short is forbidden in 1Mbps
-#define MCS_SHORTP_RATE_2                      5	// short preamble CCK 2Mbps
-#define MCS_SHORTP_RATE_5_5                    6
-#define MCS_SHORTP_RATE_11                     7
-// To send duplicate legacy OFDM. set BW=BW_40.  SGI.STBC are reserved
-#define MCS_RATE_6                      0   // legacy OFDM
-#define MCS_RATE_9                      1   // OFDM
-#define MCS_RATE_12                     2   // OFDM
-#define MCS_RATE_18                     3   // OFDM
-#define MCS_RATE_24                     4  // OFDM
-#define MCS_RATE_36                     5   // OFDM
-#define MCS_RATE_48                     6  // OFDM
-#define MCS_RATE_54                     7 // OFDM
-// HT
-#define MCS_0		0	// 1S
-#define MCS_1		1
-#define MCS_2		2
-#define MCS_3		3
-#define MCS_4		4
-#define MCS_5		5
-#define MCS_6		6
-#define MCS_7		7
-#define MCS_8		8	// 2S
-#define MCS_9		9
-#define MCS_10		10
-#define MCS_11		11
-#define MCS_12		12
-#define MCS_13		13
-#define MCS_14		14
-#define MCS_15		15
-#define MCS_16		16	// 3*3
-#define MCS_17		17
-#define MCS_18		18
-#define MCS_19		19
-#define MCS_20		20
-#define MCS_21		21
-#define MCS_22		22
-#define MCS_23		23
-#define MCS_32		32
-#define MCS_AUTO		33
-
-#ifdef DOT11_N_SUPPORT
-// OID_HTPHYMODE
-// MODE
-#define HTMODE_MM	0
-#define HTMODE_GF	1
-#endif // DOT11_N_SUPPORT //
-
-// Fixed Tx MODE - HT, CCK or OFDM
-#define FIXED_TXMODE_HT		0
-#define FIXED_TXMODE_CCK	1
-#define FIXED_TXMODE_OFDM	2
-// BW
-#define BW_20		BAND_WIDTH_20
-#define BW_40		BAND_WIDTH_40
-#define BW_BOTH		BAND_WIDTH_BOTH
-#define BW_10		BAND_WIDTH_10	// 802.11j has 10MHz. This definition is for internal usage. doesn't fill in the IE or other field.
-
-#ifdef DOT11_N_SUPPORT
-// SHORTGI
-#define GI_400		GAP_INTERVAL_400	// only support in HT mode
-#define GI_BOTH		GAP_INTERVAL_BOTH
-#endif // DOT11_N_SUPPORT //
-#define GI_800		GAP_INTERVAL_800
-// STBC
-#define STBC_NONE	0
-#ifdef DOT11_N_SUPPORT
-#define STBC_USE	1	// limited use in rt2860b phy
-#define RXSTBC_ONE	1	// rx support of one spatial stream
-#define RXSTBC_TWO	2	// rx support of 1 and 2 spatial stream
-#define RXSTBC_THR	3	// rx support of 1~3 spatial stream
-// MCS FEEDBACK
-#define MCSFBK_NONE	0  // not support mcs feedback /
-#define MCSFBK_RSV	1	// reserved
-#define MCSFBK_UNSOLICIT	2	// only support unsolict mcs feedback
-#define MCSFBK_MRQ	3	// response to both MRQ and unsolict mcs feedback
-
-// MIMO power safe
-#define	MMPS_STATIC	0
-#define	MMPS_DYNAMIC		1
-#define   MMPS_RSV		2
-#define MMPS_ENABLE		3
-
-
-// A-MSDU size
-#define	AMSDU_0	0
-#define	AMSDU_1		1
-
-#endif // DOT11_N_SUPPORT //
-
-// MCS use 7 bits
-#define TXRATEMIMO		0x80
-#define TXRATEMCS		0x7F
-#define TXRATEOFDM		0x7F
-#define RATE_1                      0
-#define RATE_2                      1
-#define RATE_5_5                    2
-#define RATE_11                     3
-#define RATE_6                      4   // OFDM
-#define RATE_9                      5   // OFDM
-#define RATE_12                     6   // OFDM
-#define RATE_18                     7   // OFDM
-#define RATE_24                     8   // OFDM
-#define RATE_36                     9   // OFDM
-#define RATE_48                     10  // OFDM
-#define RATE_54                     11  // OFDM
-#define RATE_FIRST_OFDM_RATE        RATE_6
-#define RATE_LAST_OFDM_RATE		RATE_54
-#define RATE_6_5                    12  // HT mix
-#define RATE_13                     13  // HT mix
-#define RATE_19_5                   14  // HT mix
-#define RATE_26                     15  // HT mix
-#define RATE_39                     16  // HT mix
-#define RATE_52                     17  // HT mix
-#define RATE_58_5                   18  // HT mix
-#define RATE_65                     19  // HT mix
-#define RATE_78                     20  // HT mix
-#define RATE_104                    21  // HT mix
-#define RATE_117                    22  // HT mix
-#define RATE_130                    23  // HT mix
-//#define RATE_AUTO_SWITCH            255 // for StaCfg.FixedTxRate only
-#define HTRATE_0                      12
-#define RATE_FIRST_MM_RATE        HTRATE_0
-#define RATE_FIRST_HT_RATE        HTRATE_0
-#define RATE_LAST_HT_RATE        HTRATE_0
-
-// pTxWI->txop
-#define IFS_HTTXOP                 0	// The txop will be handles by ASIC.
-#define IFS_PIFS                    1
-#define IFS_SIFS                    2
-#define IFS_BACKOFF                 3
-
-// pTxD->RetryMode
-#define LONG_RETRY                  1
-#define SHORT_RETRY                 0
-
-// Country Region definition
-#define REGION_MINIMUM_BG_BAND            0
-#define REGION_0_BG_BAND                  0       // 1-11
-#define REGION_1_BG_BAND                  1       // 1-13
-#define REGION_2_BG_BAND                  2       // 10-11
-#define REGION_3_BG_BAND                  3       // 10-13
-#define REGION_4_BG_BAND                  4       // 14
-#define REGION_5_BG_BAND                  5       // 1-14
-#define REGION_6_BG_BAND                  6       // 3-9
-#define REGION_7_BG_BAND                  7       // 5-13
-#define REGION_31_BG_BAND                 31       // 5-13
-#define REGION_MAXIMUM_BG_BAND            7
-
-#define REGION_MINIMUM_A_BAND             0
-#define REGION_0_A_BAND                   0       // 36, 40, 44, 48, 52, 56, 60, 64, 149, 153, 157, 161, 165
-#define REGION_1_A_BAND                   1       // 36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140
-#define REGION_2_A_BAND                   2       // 36, 40, 44, 48, 52, 56, 60, 64
-#define REGION_3_A_BAND                   3       // 52, 56, 60, 64, 149, 153, 157, 161
-#define REGION_4_A_BAND                   4       // 149, 153, 157, 161, 165
-#define REGION_5_A_BAND                   5       // 149, 153, 157, 161
-#define REGION_6_A_BAND                   6       // 36, 40, 44, 48
-#define REGION_7_A_BAND                   7       // 36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 149, 153, 157, 161, 165, 169, 173
-#define REGION_8_A_BAND                   8       // 52, 56, 60, 64
-#define REGION_9_A_BAND                   9       // 36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 132, 136, 140, 149, 153, 157, 161, 165
-#define REGION_10_A_BAND                  10	  // 36, 40, 44, 48, 149, 153, 157, 161, 165
-#define REGION_11_A_BAND                  11	  // 36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 149, 153, 157, 161
-#define REGION_12_A_BAND                  12       // 36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140
-#define REGION_13_A_BAND                  13       // 52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 149, 153, 157, 161
-#define REGION_14_A_BAND                  14       // 36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 136, 140, 149, 153, 157, 161, 165
-#define REGION_15_A_BAND                  15       // 149, 153, 157, 161, 165, 169, 173
-#define REGION_MAXIMUM_A_BAND             15
-
-// pTxD->CipherAlg
-#define CIPHER_NONE                 0
-#define CIPHER_WEP64                1
-#define CIPHER_WEP128               2
-#define CIPHER_TKIP                 3
-#define CIPHER_AES                  4
-#define CIPHER_CKIP64               5
-#define CIPHER_CKIP128              6
-#define CIPHER_TKIP_NO_MIC          7       // MIC appended by driver: not a valid value in hardware key table
-#define CIPHER_SMS4					8
-
-
-// LED Status.
-#define LED_LINK_DOWN               0
-#define LED_LINK_UP                 1
-#define LED_RADIO_OFF               2
-#define LED_RADIO_ON                3
-#define LED_HALT                    4
-#define LED_WPS                     5
-#define LED_ON_SITE_SURVEY          6
-#define LED_POWER_UP                7
-
-
-// value domain of pAd->LedCntl.LedMode and E2PROM
-#define LED_MODE_DEFAULT            0
-#define LED_MODE_TWO_LED			1
-//#define LED_MODE_SIGNAL_STREGTH		8  // EEPROM define =8
-#define LED_MODE_SIGNAL_STREGTH		0x40 // EEPROM define = 64
-
-// RC4 init value, used fro WEP & TKIP
-#define PPPINITFCS32                0xffffffff   /* Initial FCS value */
-
-// value domain of pAd->StaCfg.PortSecured. 802.1X controlled port definition
-#define WPA_802_1X_PORT_SECURED     1
-#define WPA_802_1X_PORT_NOT_SECURED 2
-
-#define PAIRWISE_KEY                1
-#define GROUP_KEY                   2
-
-//definition of DRS
-#define MAX_STEP_OF_TX_RATE_SWITCH	32
-
-
-// pre-allocated free NDIS PACKET/BUFFER poll for internal usage
-#define MAX_NUM_OF_FREE_NDIS_PACKET 128
-
-//Block ACK
-#define MAX_TX_REORDERBUF   64
-#define MAX_RX_REORDERBUF   64
-#define DEFAULT_TX_TIMEOUT   30
-#define DEFAULT_RX_TIMEOUT   30
-
-// definition of Recipient or Originator
-#define I_RECIPIENT                  TRUE
-#define I_ORIGINATOR                   FALSE
-
-#define DEFAULT_BBP_TX_POWER        0
-#define DEFAULT_RF_TX_POWER         5
-
-#define MAX_INI_BUFFER_SIZE		4096
-#define MAX_PARAM_BUFFER_SIZE		(2048) // enough for ACL (18*64)
-											//18 : the length of Mac address acceptable format "01:02:03:04:05:06;")
-											//64 : MAX_NUM_OF_ACL_LIST
-// definition of pAd->OpMode
-#define OPMODE_STA                  0
-#define OPMODE_AP                   1
-//#define OPMODE_L3_BRG               2       // as AP and STA at the same time
-
-#ifdef RT_BIG_ENDIAN
-#define DIR_READ                    0
-#define DIR_WRITE                   1
-#define TYPE_TXD                    0
-#define TYPE_RXD                    1
-#define TYPE_TXINFO					0
-#define TYPE_RXINFO					1
-#define TYPE_TXWI					0
-#define TYPE_RXWI					1
-#endif
-
-// ========================= AP rtmp_def.h ===========================
-// value domain for pAd->EventTab.Log[].Event
-#define EVENT_RESET_ACCESS_POINT    0 // Log = "hh:mm:ss   Restart Access Point"
-#define EVENT_ASSOCIATED            1 // Log = "hh:mm:ss   STA 00:01:02:03:04:05 associated"
-#define EVENT_DISASSOCIATED         2 // Log = "hh:mm:ss   STA 00:01:02:03:04:05 left this BSS"
-#define EVENT_AGED_OUT              3 // Log = "hh:mm:ss   STA 00:01:02:03:04:05 was aged-out and removed from this BSS"
-#define EVENT_COUNTER_M             4
-#define EVENT_INVALID_PSK           5
-#define EVENT_MAX_EVENT_TYPE        6
-// ==== end of AP rtmp_def.h ============
-
-// definition RSSI Number
-#define RSSI_0					0
-#define RSSI_1					1
-#define RSSI_2					2
-
-// definition of radar detection
-#define RD_NORMAL_MODE				0	// Not found radar signal
-#define RD_SWITCHING_MODE			1	// Found radar signal, and doing channel switch
-#define RD_SILENCE_MODE				2	// After channel switch, need to be silence a while to ensure radar not found
-
-//Driver defined cid for mapping status and command.
-#define  SLEEPCID	0x11
-#define  WAKECID	0x22
-#define  QUERYPOWERCID	0x33
-#define  OWNERMCU	0x1
-#define  OWNERCPU	0x0
-
-// MBSSID definition
-#define ENTRY_NOT_FOUND             0xFF
-
-
-/* After Linux 2.6.9,
- * VLAN module use Private (from user) interface flags (netdevice->priv_flags).
- * #define IFF_802_1Q_VLAN 0x1         --    802.1Q VLAN device.  in if.h
- * ref to ip_sabotage_out() [ out->priv_flags & IFF_802_1Q_VLAN ] in br_netfilter.c
- *
- * For this reason, we MUST use EVEN value in priv_flags
- */
-#define INT_MAIN			0x0100
-#define INT_MBSSID			0x0200
-#define INT_WDS				0x0300
-#define INT_APCLI			0x0400
-#define INT_MESH			0x0500
-
-#define INF_MAIN_DEV_NAME		"wlan"
-#define INF_MBSSID_DEV_NAME		"wlan"
-#define INF_WDS_DEV_NAME		"wds"
-#define INF_APCLI_DEV_NAME		"apcli"
-#define INF_MESH_DEV_NAME		"mesh"
-
-// Use bitmap to allow coexist of ATE_TXFRAME and ATE_RXFRAME(i.e.,to support LoopBack mode).
-#ifdef RALINK_ATE
-#define	ATE_START                   0x00   // Start ATE
-#define	ATE_STOP                    0x80   // Stop ATE
-#define	ATE_TXCONT                  0x05   // Continuous Transmit
-#define	ATE_TXCARR                  0x09   // Transmit Carrier
-#define	ATE_TXCARRSUPP              0x11   // Transmit Carrier Suppression
-#define	ATE_TXFRAME                 0x01   // Transmit Frames
-#define	ATE_RXFRAME                 0x02   // Receive Frames
-#ifdef RALINK_28xx_QA
-#define ATE_TXSTOP                  0xe2   // Stop Transmition(i.e., TXCONT, TXCARR, TXCARRSUPP, and TXFRAME)
-#define ATE_RXSTOP					0xfd   // Stop receiving Frames
-#define	BBP22_TXFRAME				0x00   // Transmit Frames
-#define	BBP22_TXCONT_OR_CARRSUPP    0x80   // Continuous Transmit or Carrier Suppression
-#define	BBP22_TXCARR                0xc1   // Transmit Carrier
-#define	BBP24_TXCONT                0x00   // Continuous Transmit
-#define	BBP24_CARRSUPP              0x01   // Carrier Suppression
-#endif // RALINK_28xx_QA //
-#endif // RALINK_ATE //
-
-// WEP Key TYPE
-#define WEP_HEXADECIMAL_TYPE    0
-#define WEP_ASCII_TYPE          1
-
-
-
-// WIRELESS EVENTS definition
-/* Max number of char in custom event, refer to wireless_tools.28/wireless.20.h */
-#define IW_CUSTOM_MAX_LEN							255	/* In bytes */
-
-// For system event - start
-#define	IW_SYS_EVENT_FLAG_START                     0x0200
-#define	IW_ASSOC_EVENT_FLAG                         0x0200
-#define	IW_DISASSOC_EVENT_FLAG                      0x0201
-#define	IW_DEAUTH_EVENT_FLAG				0x0202
-#define	IW_AGEOUT_EVENT_FLAG				0x0203
-#define	IW_COUNTER_MEASURES_EVENT_FLAG              0x0204
-#define	IW_REPLAY_COUNTER_DIFF_EVENT_FLAG           0x0205
-#define	IW_RSNIE_DIFF_EVENT_FLAG				0x0206
-#define	IW_MIC_DIFF_EVENT_FLAG					0x0207
-#define IW_ICV_ERROR_EVENT_FLAG						0x0208
-#define IW_MIC_ERROR_EVENT_FLAG						0x0209
-#define IW_GROUP_HS_TIMEOUT_EVENT_FLAG				0x020A
-#define	IW_PAIRWISE_HS_TIMEOUT_EVENT_FLAG			0x020B
-#define IW_RSNIE_SANITY_FAIL_EVENT_FLAG				0x020C
-#define IW_SET_KEY_DONE_WPA1_EVENT_FLAG				0x020D
-#define IW_SET_KEY_DONE_WPA2_EVENT_FLAG				0x020E
-#define IW_STA_LINKUP_EVENT_FLAG					0x020F
-#define IW_STA_LINKDOWN_EVENT_FLAG					0x0210
-#define IW_SCAN_COMPLETED_EVENT_FLAG				0x0211
-#define IW_SCAN_ENQUEUE_FAIL_EVENT_FLAG				0x0212
-// if add new system event flag, please upadte the IW_SYS_EVENT_FLAG_END
-#define	IW_SYS_EVENT_FLAG_END                       0x0212
-#define	IW_SYS_EVENT_TYPE_NUM						(IW_SYS_EVENT_FLAG_END - IW_SYS_EVENT_FLAG_START + 1)
-// For system event - end
-
-// For spoof attack event - start
-#define	IW_SPOOF_EVENT_FLAG_START                   0x0300
-#define IW_CONFLICT_SSID_EVENT_FLAG					0x0300
-#define IW_SPOOF_ASSOC_RESP_EVENT_FLAG				0x0301
-#define IW_SPOOF_REASSOC_RESP_EVENT_FLAG			0x0302
-#define IW_SPOOF_PROBE_RESP_EVENT_FLAG				0x0303
-#define IW_SPOOF_BEACON_EVENT_FLAG					0x0304
-#define IW_SPOOF_DISASSOC_EVENT_FLAG				0x0305
-#define IW_SPOOF_AUTH_EVENT_FLAG					0x0306
-#define IW_SPOOF_DEAUTH_EVENT_FLAG					0x0307
-#define IW_SPOOF_UNKNOWN_MGMT_EVENT_FLAG			0x0308
-#define IW_REPLAY_ATTACK_EVENT_FLAG					0x0309
-// if add new spoof attack event flag, please upadte the IW_SPOOF_EVENT_FLAG_END
-#define	IW_SPOOF_EVENT_FLAG_END                     0x0309
-#define	IW_SPOOF_EVENT_TYPE_NUM						(IW_SPOOF_EVENT_FLAG_END - IW_SPOOF_EVENT_FLAG_START + 1)
-// For spoof attack event - end
-
-// For flooding attack event - start
-#define	IW_FLOOD_EVENT_FLAG_START                   0x0400
-#define IW_FLOOD_AUTH_EVENT_FLAG					0x0400
-#define IW_FLOOD_ASSOC_REQ_EVENT_FLAG				0x0401
-#define IW_FLOOD_REASSOC_REQ_EVENT_FLAG				0x0402
-#define IW_FLOOD_PROBE_REQ_EVENT_FLAG				0x0403
-#define IW_FLOOD_DISASSOC_EVENT_FLAG				0x0404
-#define IW_FLOOD_DEAUTH_EVENT_FLAG					0x0405
-#define IW_FLOOD_EAP_REQ_EVENT_FLAG					0x0406
-// if add new flooding attack event flag, please upadte the IW_FLOOD_EVENT_FLAG_END
-#define	IW_FLOOD_EVENT_FLAG_END				0x0406
-#define	IW_FLOOD_EVENT_TYPE_NUM						(IW_FLOOD_EVENT_FLAG_END - IW_FLOOD_EVENT_FLAG_START + 1)
-// For flooding attack - end
-
-// End - WIRELESS EVENTS definition
-
-#ifdef CONFIG_STA_SUPPORT
-// definition for DLS, kathy
-#define	MAX_NUM_OF_INIT_DLS_ENTRY   1
-#define	MAX_NUM_OF_DLS_ENTRY        MAX_NUMBER_OF_DLS_ENTRY
-
-//Block ACK, kathy
-#define MAX_TX_REORDERBUF		64
-#define MAX_RX_REORDERBUF		64
-#define DEFAULT_TX_TIMEOUT		30
-#define DEFAULT_RX_TIMEOUT		30
-#define MAX_BARECI_SESSION		8
-
-#ifndef IW_ESSID_MAX_SIZE
-/* Maximum size of the ESSID and pAd->nickname strings */
-#define IW_ESSID_MAX_SIZE		32
-#endif
-#endif // CONFIG_STA_SUPPORT //
-
-#ifdef MCAST_RATE_SPECIFIC
-#define MCAST_DISABLE	0
-#define MCAST_CCK		1
-#define MCAST_OFDM		2
-#define MCAST_HTMIX		3
-#endif // MCAST_RATE_SPECIFIC //
-
-// For AsicRadioOff/AsicRadioOn function
-#define DOT11POWERSAVE		0
-#define GUIRADIO_OFF		1
-#define RTMP_HALT		    2
-#define GUI_IDLE_POWER_SAVE		3
-// --
-
-
-// definition for WpaSupport flag
-#define WPA_SUPPLICANT_DISABLE				0
-#define WPA_SUPPLICANT_ENABLE				1
-#define	WPA_SUPPLICANT_ENABLE_WITH_WEB_UI	2
-
-// definition for Antenna Diversity flag
-#ifdef ANT_DIVERSITY_SUPPORT
-enum ANT_DIVERSITY_TYPE {
-    ANT_DIVERSITY_DISABLE = 0,
-    ANT_DIVERSITY_ENABLE = 1,
-    ANT_FIX_ANT1 = 2,
-    ANT_FIX_ANT2 = 3
-};
-#endif // ANT_DIVERSITY_SUPPORT //
-
-// Endian byte swapping codes
-#define SWAP16(x) \
-    ((UINT16)( \
-    (((UINT16)(x) & (UINT16) 0x00ffU) << 8) | \
-    (((UINT16)(x) & (UINT16) 0xff00U) >> 8) ))
-
-#define SWAP32(x) \
-    ((UINT32)( \
-    (((UINT32)(x) & (UINT32) 0x000000ffUL) << 24) | \
-    (((UINT32)(x) & (UINT32) 0x0000ff00UL) <<  8) | \
-    (((UINT32)(x) & (UINT32) 0x00ff0000UL) >>  8) | \
-    (((UINT32)(x) & (UINT32) 0xff000000UL) >> 24) ))
-
-#define SWAP64(x) \
-    ((UINT64)( \
-    (UINT64)(((UINT64)(x) & (UINT64) 0x00000000000000ffULL) << 56) | \
-    (UINT64)(((UINT64)(x) & (UINT64) 0x000000000000ff00ULL) << 40) | \
-    (UINT64)(((UINT64)(x) & (UINT64) 0x0000000000ff0000ULL) << 24) | \
-    (UINT64)(((UINT64)(x) & (UINT64) 0x00000000ff000000ULL) <<  8) | \
-    (UINT64)(((UINT64)(x) & (UINT64) 0x000000ff00000000ULL) >>  8) | \
-    (UINT64)(((UINT64)(x) & (UINT64) 0x0000ff0000000000ULL) >> 24) | \
-    (UINT64)(((UINT64)(x) & (UINT64) 0x00ff000000000000ULL) >> 40) | \
-    (UINT64)(((UINT64)(x) & (UINT64) 0xff00000000000000ULL) >> 56) ))
-
-#ifdef RT_BIG_ENDIAN
-
-#define cpu2le64(x) SWAP64((x))
-#define le2cpu64(x) SWAP64((x))
-#define cpu2le32(x) SWAP32((x))
-#define le2cpu32(x) SWAP32((x))
-#define cpu2le16(x) SWAP16((x))
-#define le2cpu16(x) SWAP16((x))
-#define cpu2be64(x) ((UINT64)(x))
-#define be2cpu64(x) ((UINT64)(x))
-#define cpu2be32(x) ((UINT32)(x))
-#define be2cpu32(x) ((UINT32)(x))
-#define cpu2be16(x) ((UINT16)(x))
-#define be2cpu16(x) ((UINT16)(x))
-
-#else   // Little_Endian
-
-#define cpu2le64(x) ((UINT64)(x))
-#define le2cpu64(x) ((UINT64)(x))
-#define cpu2le32(x) ((UINT32)(x))
-#define le2cpu32(x) ((UINT32)(x))
-#define cpu2le16(x) ((UINT16)(x))
-#define le2cpu16(x) ((UINT16)(x))
-#define cpu2be64(x) SWAP64((x))
-#define be2cpu64(x) SWAP64((x))
-#define cpu2be32(x) SWAP32((x))
-#define be2cpu32(x) SWAP32((x))
-#define cpu2be16(x) SWAP16((x))
-#define be2cpu16(x) SWAP16((x))
-
-#endif  // RT_BIG_ENDIAN
-
-#define ABS(_x, _y) ((_x) > (_y)) ? ((_x) -(_y)) : ((_y) -(_x))
-
-
-#define A2Dec(_X, _p)				\
-{									\
-	UCHAR *p;						\
-	_X = 0;							\
-	p = _p;							\
-	while (((*p >= '0') && (*p <= '9')))		\
-	{												\
-		if ((*p >= '0') && (*p <= '9'))		\
-			_X = _X * 10 + *p - 48;					\
-		p++;										\
-	}												\
-}
-
-
-#define A2Hex(_X, _p)				\
-do{									\
-	char *__p;						\
-	(_X) = 0;							\
-	__p = (char *)(_p);							\
-	while (((*__p >= 'a') && (*__p <= 'f')) || ((*__p >= 'A') && (*__p <= 'F')) || ((*__p >= '0') && (*__p <= '9')))		\
-	{												\
-		if ((*__p >= 'a') && (*__p <= 'f'))				\
-			(_X) = (_X) * 16 + *__p - 87;					\
-		else if ((*__p >= 'A') && (*__p <= 'F'))		\
-			(_X) = (_X) * 16 + *__p - 55;					\
-		else if ((*__p >= '0') && (*__p <= '9'))		\
-			(_X) = (_X) * 16 + *__p - 48;					\
-		__p++;										\
-	}												\
-}while(0)
-
-#endif  // __RTMP_DEF_H__
diff --git a/drivers/staging/rt3090/rtmp_dot11.h b/drivers/staging/rt3090/rtmp_dot11.h
deleted file mode 100644
index a637825afe9c..000000000000
--- a/drivers/staging/rt3090/rtmp_dot11.h
+++ /dev/null
@@ -1,146 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-*/
-
-#ifndef __DOT11_BASE_H__
-#define __DOT11_BASE_H__
-
-#include "rtmp_type.h"
-
-
-// 4-byte HTC field.  maybe included in any frame except non-QOS data frame.  The Order bit must set 1.
-typedef struct PACKED {
-#ifdef RT_BIG_ENDIAN
-    UINT32		RDG:1;	//RDG / More PPDU
-    UINT32		ACConstraint:1;	//feedback request
-    UINT32		rsv:5;  //calibration sequence
-    UINT32		ZLFAnnouce:1;	// ZLF announcement
-    UINT32		CSISTEERING:2;	//CSI/ STEERING
-    UINT32		FBKReq:2;	//feedback request
-    UINT32		CalSeq:2;  //calibration sequence
-    UINT32		CalPos:2;	// calibration position
-    UINT32		MFBorASC:7;	//Link adaptation feedback containing recommended MCS. 0x7f for no feedback or not available
-    UINT32		MFS:3;	//SET to the received value of MRS. 0x111 for unsolicited MFB.
-    UINT32		MRSorASI:3;	// MRQ Sequence identifier. unchanged during entire procedure. 0x000-0x110.
-    UINT32		MRQ:1;	//MCS feedback. Request for a MCS feedback
-    UINT32		TRQ:1;	//sounding request
-    UINT32		MA:1;	//management action payload exist in (QoS Null+HTC)
-#else
-    UINT32		MA:1;	//management action payload exist in (QoS Null+HTC)
-    UINT32		TRQ:1;	//sounding request
-    UINT32		MRQ:1;	//MCS feedback. Request for a MCS feedback
-    UINT32		MRSorASI:3;	// MRQ Sequence identifier. unchanged during entire procedure. 0x000-0x110.
-    UINT32		MFS:3;	//SET to the received value of MRS. 0x111 for unsolicited MFB.
-    UINT32		MFBorASC:7;	//Link adaptation feedback containing recommended MCS. 0x7f for no feedback or not available
-    UINT32		CalPos:2;	// calibration position
-    UINT32		CalSeq:2;  //calibration sequence
-    UINT32		FBKReq:2;	//feedback request
-    UINT32		CSISTEERING:2;	//CSI/ STEERING
-    UINT32		ZLFAnnouce:1;	// ZLF announcement
-    UINT32		rsv:5;  //calibration sequence
-    UINT32		ACConstraint:1;	//feedback request
-    UINT32		RDG:1;	//RDG / More PPDU
-#endif /* !RT_BIG_ENDIAN */
-} HT_CONTROL, *PHT_CONTROL;
-
-// 2-byte QOS CONTROL field
-typedef struct PACKED {
-#ifdef RT_BIG_ENDIAN
-    USHORT      Txop_QueueSize:8;
-    USHORT      AMsduPresent:1;
-    USHORT      AckPolicy:2;  //0: normal ACK 1:No ACK 2:scheduled under MTBA/PSMP  3: BA
-    USHORT      EOSP:1;
-    USHORT      TID:4;
-#else
-    USHORT      TID:4;
-    USHORT      EOSP:1;
-    USHORT      AckPolicy:2;  //0: normal ACK 1:No ACK 2:scheduled under MTBA/PSMP  3: BA
-    USHORT      AMsduPresent:1;
-    USHORT      Txop_QueueSize:8;
-#endif /* !RT_BIG_ENDIAN */
-} QOS_CONTROL, *PQOS_CONTROL;
-
-
-// 2-byte Frame control field
-typedef	struct	PACKED {
-#ifdef RT_BIG_ENDIAN
-	USHORT		Order:1;			// Strict order expected
-	USHORT		Wep:1;				// Wep data
-	USHORT		MoreData:1;			// More data bit
-	USHORT		PwrMgmt:1;			// Power management bit
-	USHORT		Retry:1;			// Retry status bit
-	USHORT		MoreFrag:1;			// More fragment bit
-	USHORT		FrDs:1;				// From DS indication
-	USHORT		ToDs:1;				// To DS indication
-	USHORT		SubType:4;			// MSDU subtype
-	USHORT		Type:2;				// MSDU type
-	USHORT		Ver:2;				// Protocol version
-#else
-	USHORT		Ver:2;				// Protocol version
-	USHORT		Type:2;				// MSDU type
-	USHORT		SubType:4;			// MSDU subtype
-	USHORT		ToDs:1;				// To DS indication
-	USHORT		FrDs:1;				// From DS indication
-	USHORT		MoreFrag:1;			// More fragment bit
-	USHORT		Retry:1;			// Retry status bit
-	USHORT		PwrMgmt:1;			// Power management bit
-	USHORT		MoreData:1;			// More data bit
-	USHORT		Wep:1;				// Wep data
-	USHORT		Order:1;			// Strict order expected
-#endif /* !RT_BIG_ENDIAN */
-} FRAME_CONTROL, *PFRAME_CONTROL;
-
-typedef	struct	PACKED _HEADER_802_11	{
-    FRAME_CONTROL   FC;
-    USHORT          Duration;
-    UCHAR           Addr1[MAC_ADDR_LEN];
-    UCHAR           Addr2[MAC_ADDR_LEN];
-	UCHAR			Addr3[MAC_ADDR_LEN];
-#ifdef RT_BIG_ENDIAN
-	USHORT			Sequence:12;
-	USHORT			Frag:4;
-#else
-	USHORT			Frag:4;
-	USHORT			Sequence:12;
-#endif /* !RT_BIG_ENDIAN */
-	UCHAR			Octet[0];
-}	HEADER_802_11, *PHEADER_802_11;
-
-typedef struct PACKED _PSPOLL_FRAME {
-    FRAME_CONTROL   FC;
-    USHORT          Aid;
-    UCHAR           Bssid[MAC_ADDR_LEN];
-    UCHAR           Ta[MAC_ADDR_LEN];
-}   PSPOLL_FRAME, *PPSPOLL_FRAME;
-
-typedef	struct	PACKED _RTS_FRAME	{
-    FRAME_CONTROL   FC;
-    USHORT          Duration;
-    UCHAR           Addr1[MAC_ADDR_LEN];
-    UCHAR           Addr2[MAC_ADDR_LEN];
-}RTS_FRAME, *PRTS_FRAME;
-
-#endif // __DOT11_BASE_H__ //
diff --git a/drivers/staging/rt3090/rtmp_mac.h b/drivers/staging/rt3090/rtmp_mac.h
deleted file mode 100644
index c57b2959777e..000000000000
--- a/drivers/staging/rt3090/rtmp_mac.h
+++ /dev/null
@@ -1,2304 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-	Module Name:
-	rtmp_mac.h
-
-	Abstract:
-	Ralink Wireless Chip MAC related definition & structures
-
-	Revision History:
-	Who			When		  What
-	--------	----------	  ----------------------------------------------
-*/
-
-#ifndef __RTMP_MAC_H__
-#define __RTMP_MAC_H__
-
-
-
-// =================================================================================
-// TX / RX ring descriptor format
-// =================================================================================
-
-// the first 24-byte in TXD is called TXINFO and will be DMAed to MAC block through TXFIFO.
-// MAC block use this TXINFO to control the transmission behavior of this frame.
-#define FIFO_MGMT                 0
-#define FIFO_HCCA                 1
-#define FIFO_EDCA                 2
-
-
-//
-// TXD Wireless Information format for Tx ring and Mgmt Ring
-//
-//txop : for txop mode
-// 0:txop for the MPDU frame will be handles by ASIC by register
-// 1/2/3:the MPDU frame is send after PIFS/backoff/SIFS
-#ifdef RT_BIG_ENDIAN
-typedef	struct	PACKED _TXWI_STRUC {
-	// Word 0
-	UINT32		PHYMODE:2;
-	UINT32		TxBF:1;	// 3*3
-	UINT32		rsv2:1;
-//	UINT32		rsv2:2;
-	UINT32		Ifs:1;	//
-	UINT32		STBC:2;	//channel bandwidth 20MHz or 40 MHz
-	UINT32		ShortGI:1;
-	UINT32		BW:1;	//channel bandwidth 20MHz or 40 MHz
-	UINT32		MCS:7;
-
-	UINT32		rsv:6;
-	UINT32		txop:2;	//tx back off mode 0:HT TXOP rule , 1:PIFS TX ,2:Backoff, 3:sifs only when previous frame exchange is successful.
-	UINT32		MpduDensity:3;
-	UINT32		AMPDU:1;
-
-	UINT32		TS:1;
-	UINT32		CFACK:1;
-	UINT32		MIMOps:1;	// the remote peer is in dynamic MIMO-PS mode
-	UINT32		FRAG:1;		// 1 to inform TKIP engine this is a fragment.
-	// Word 1
-	UINT32		PacketId:4;
-	UINT32		MPDUtotalByteCount:12;
-	UINT32		WirelessCliID:8;
-	UINT32		BAWinSize:6;
-	UINT32		NSEQ:1;
-	UINT32		ACK:1;
-	// Word 2
-	UINT32		IV;
-	// Word 3
-	UINT32		EIV;
-}	TXWI_STRUC, *PTXWI_STRUC;
-#else
-typedef	struct	PACKED _TXWI_STRUC {
-	// Word	0
-	// ex: 00 03 00 40 means txop = 3, PHYMODE = 1
-	UINT32		FRAG:1;		// 1 to inform TKIP engine this is a fragment.
-	UINT32		MIMOps:1;	// the remote peer is in dynamic MIMO-PS mode
-	UINT32		CFACK:1;
-	UINT32		TS:1;
-
-	UINT32		AMPDU:1;
-	UINT32		MpduDensity:3;
-	UINT32		txop:2;	//FOR "THIS" frame. 0:HT TXOP rule , 1:PIFS TX ,2:Backoff, 3:sifs only when previous frame exchange is successful.
-	UINT32		rsv:6;
-
-	UINT32		MCS:7;
-	UINT32		BW:1;	//channel bandwidth 20MHz or 40 MHz
-	UINT32		ShortGI:1;
-	UINT32		STBC:2;	// 1: STBC support MCS =0-7,   2,3 : RESERVE
-	UINT32		Ifs:1;	//
-//	UINT32		rsv2:2;	//channel bandwidth 20MHz or 40 MHz
-	UINT32		rsv2:1;
-	UINT32		TxBF:1;	// 3*3
-	UINT32		PHYMODE:2;
-	// Word1
-	// ex:  1c ff 38 00 means ACK=0, BAWinSize=7, MPDUtotalByteCount = 0x38
-	UINT32		ACK:1;
-	UINT32		NSEQ:1;
-	UINT32		BAWinSize:6;
-	UINT32		WirelessCliID:8;
-	UINT32		MPDUtotalByteCount:12;
-	UINT32		PacketId:4;
-	//Word2
-	UINT32		IV;
-	//Word3
-	UINT32		EIV;
-}	TXWI_STRUC, *PTXWI_STRUC;
-#endif
-
-
-//
-// RXWI wireless information format, in PBF. invisible in driver.
-//
-#ifdef RT_BIG_ENDIAN
-typedef	struct	PACKED _RXWI_STRUC {
-	// Word 0
-	UINT32		TID:4;
-	UINT32		MPDUtotalByteCount:12;
-	UINT32		UDF:3;
-	UINT32		BSSID:3;
-	UINT32		KeyIndex:2;
-	UINT32		WirelessCliID:8;
-	// Word 1
-	UINT32		PHYMODE:2;              // 1: this RX frame is unicast to me
-	UINT32		rsv:3;
-	UINT32		STBC:2;
-	UINT32		ShortGI:1;
-	UINT32		BW:1;
-	UINT32		MCS:7;
-	UINT32		SEQUENCE:12;
-	UINT32		FRAG:4;
-	// Word 2
-	UINT32		rsv1:8;
-	UINT32		RSSI2:8;
-	UINT32		RSSI1:8;
-	UINT32		RSSI0:8;
-	// Word 3
-	/*UINT32		rsv2:16;*/
-	UINT32		rsv2:8;
-	UINT32		FOFFSET:8;	// RT35xx
-	UINT32		SNR1:8;
-	UINT32		SNR0:8;
-}	RXWI_STRUC, *PRXWI_STRUC;
-#else
-typedef	struct	PACKED _RXWI_STRUC {
-	// Word	0
-	UINT32		WirelessCliID:8;
-	UINT32		KeyIndex:2;
-	UINT32		BSSID:3;
-	UINT32		UDF:3;
-	UINT32		MPDUtotalByteCount:12;
-	UINT32		TID:4;
-	// Word	1
-	UINT32		FRAG:4;
-	UINT32		SEQUENCE:12;
-	UINT32		MCS:7;
-	UINT32		BW:1;
-	UINT32		ShortGI:1;
-	UINT32		STBC:2;
-	UINT32		rsv:3;
-	UINT32		PHYMODE:2;              // 1: this RX frame is unicast to me
-	//Word2
-	UINT32		RSSI0:8;
-	UINT32		RSSI1:8;
-	UINT32		RSSI2:8;
-	UINT32		rsv1:8;
-	//Word3
-	UINT32		SNR0:8;
-	UINT32		SNR1:8;
-	UINT32		FOFFSET:8;	// RT35xx
-	UINT32		rsv2:8;
-	/*UINT32		rsv2:16;*/
-}	RXWI_STRUC, *PRXWI_STRUC;
-#endif
-
-
-// =================================================================================
-// Register format
-// =================================================================================
-
-
-//
-// SCH/DMA registers - base address 0x0200
-//
-// INT_SOURCE_CSR: Interrupt source register. Write one to clear corresponding bit
-//
-#define DMA_CSR0		0x200
-#define INT_SOURCE_CSR		0x200
-#ifdef RT_BIG_ENDIAN
-typedef	union	_INT_SOURCE_CSR_STRUC	{
-	struct	{
-#ifdef TONE_RADAR_DETECT_SUPPORT
-		UINT32			:11;
-		UINT32			RadarINT:1;
-		UINT32		rsv:2;
-#else // original source code
-		UINT32		:14;
-#endif // TONE_RADAR_DETECT_SUPPORT //
-		UINT32		TxCoherent:1;
-		UINT32		RxCoherent:1;
-		UINT32		GPTimer:1;
-		UINT32		AutoWakeup:1;//bit14
-		UINT32		TXFifoStatusInt:1;//FIFO Statistics is full, sw should read 0x171c
-		UINT32		PreTBTT:1;
-		UINT32		TBTTInt:1;
-		UINT32		RxTxCoherent:1;
-		UINT32		MCUCommandINT:1;
-		UINT32		MgmtDmaDone:1;
-		UINT32		HccaDmaDone:1;
-		UINT32		Ac3DmaDone:1;
-		UINT32		Ac2DmaDone:1;
-		UINT32		Ac1DmaDone:1;
-		UINT32		Ac0DmaDone:1;
-		UINT32		RxDone:1;
-		UINT32		TxDelayINT:1;	//delayed interrupt, not interrupt until several int or time limit hit
-		UINT32		RxDelayINT:1; //dealyed interrupt
-	}	field;
-	UINT32			word;
-}	INT_SOURCE_CSR_STRUC, *PINT_SOURCE_CSR_STRUC;
-#else
-typedef	union	_INT_SOURCE_CSR_STRUC	{
-	struct	{
-		UINT32		RxDelayINT:1;
-		UINT32		TxDelayINT:1;
-		UINT32		RxDone:1;
-		UINT32		Ac0DmaDone:1;//4
-		UINT32		Ac1DmaDone:1;
-		UINT32		Ac2DmaDone:1;
-		UINT32		Ac3DmaDone:1;
-		UINT32		HccaDmaDone:1; // bit7
-		UINT32		MgmtDmaDone:1;
-		UINT32		MCUCommandINT:1;//bit 9
-		UINT32		RxTxCoherent:1;
-		UINT32		TBTTInt:1;
-		UINT32		PreTBTT:1;
-		UINT32		TXFifoStatusInt:1;//FIFO Statistics is full, sw should read 0x171c
-		UINT32		AutoWakeup:1;//bit14
-		UINT32		GPTimer:1;
-		UINT32		RxCoherent:1;//bit16
-		UINT32		TxCoherent:1;
-#ifdef TONE_RADAR_DETECT_SUPPORT
-		UINT32		rsv:2;
-		UINT32			RadarINT:1;
-		UINT32			:11;
-#else
-		UINT32		:14;
-#endif // TONE_RADAR_DETECT_SUPPORT //
-	}	field;
-	UINT32			word;
-} INT_SOURCE_CSR_STRUC, *PINT_SOURCE_CSR_STRUC;
-#endif
-
-//
-// INT_MASK_CSR:   Interrupt MASK register.   1: the interrupt is mask OFF
-//
-#define INT_MASK_CSR        0x204
-#ifdef RT_BIG_ENDIAN
-typedef	union	_INT_MASK_CSR_STRUC	{
-	struct	{
-		UINT32		TxCoherent:1;
-		UINT32		RxCoherent:1;
-#ifdef TONE_RADAR_DETECT_SUPPORT
-		UINT32			:9;
-		UINT32			RadarINT:1;
-		UINT32		rsv:10;
-#else
-		UINT32		:20;
-#endif // TONE_RADAR_DETECT_SUPPORT //
-		UINT32		MCUCommandINT:1;
-		UINT32		MgmtDmaDone:1;
-		UINT32		HccaDmaDone:1;
-		UINT32		Ac3DmaDone:1;
-		UINT32		Ac2DmaDone:1;
-		UINT32		Ac1DmaDone:1;
-		UINT32		Ac0DmaDone:1;
-		UINT32		RxDone:1;
-		UINT32		TxDelay:1;
-		UINT32		RXDelay_INT_MSK:1;
-	}	field;
-	UINT32			word;
-}INT_MASK_CSR_STRUC, *PINT_MASK_CSR_STRUC;
-#else
-typedef	union	_INT_MASK_CSR_STRUC	{
-	struct	{
-		UINT32		RXDelay_INT_MSK:1;
-		UINT32		TxDelay:1;
-		UINT32		RxDone:1;
-		UINT32		Ac0DmaDone:1;
-		UINT32		Ac1DmaDone:1;
-		UINT32		Ac2DmaDone:1;
-		UINT32		Ac3DmaDone:1;
-		UINT32		HccaDmaDone:1;
-		UINT32		MgmtDmaDone:1;
-		UINT32		MCUCommandINT:1;
-#ifdef TONE_RADAR_DETECT_SUPPORT
-		UINT32		rsv:10;
-		UINT32			RadarINT:1;
-		UINT32			:9;
-#else
-		UINT32		:20;
-#endif // TONE_RADAR_DETECT_SUPPORT //
-		UINT32		RxCoherent:1;
-		UINT32		TxCoherent:1;
-	}	field;
-	UINT32			word;
-} INT_MASK_CSR_STRUC, *PINT_MASK_CSR_STRUC;
-#endif
-
-#define WPDMA_GLO_CFG	0x208
-#ifdef RT_BIG_ENDIAN
-typedef	union	_WPDMA_GLO_CFG_STRUC	{
-	struct	{
-		UINT32		HDR_SEG_LEN:16;
-		UINT32		RXHdrScater:8;
-		UINT32		BigEndian:1;
-		UINT32		EnTXWriteBackDDONE:1;
-		UINT32		WPDMABurstSIZE:2;
-		UINT32		RxDMABusy:1;
-		UINT32		EnableRxDMA:1;
-		UINT32		TxDMABusy:1;
-		UINT32		EnableTxDMA:1;
-	}	field;
-	UINT32			word;
-}WPDMA_GLO_CFG_STRUC, *PWPDMA_GLO_CFG_STRUC;
-#else
-typedef	union	_WPDMA_GLO_CFG_STRUC	{
-	struct	{
-		UINT32		EnableTxDMA:1;
-		UINT32		TxDMABusy:1;
-		UINT32		EnableRxDMA:1;
-		UINT32		RxDMABusy:1;
-		UINT32		WPDMABurstSIZE:2;
-		UINT32		EnTXWriteBackDDONE:1;
-		UINT32		BigEndian:1;
-		UINT32		RXHdrScater:8;
-		UINT32		HDR_SEG_LEN:16;
-	}	field;
-	UINT32			word;
-} WPDMA_GLO_CFG_STRUC, *PWPDMA_GLO_CFG_STRUC;
-#endif
-
-#define WPDMA_RST_IDX	0x20c
-#ifdef RT_BIG_ENDIAN
-typedef	union	_WPDMA_RST_IDX_STRUC	{
-	struct	{
-		UINT32		:15;
-		UINT32		RST_DRX_IDX0:1;
-		UINT32		rsv:10;
-		UINT32		RST_DTX_IDX5:1;
-		UINT32		RST_DTX_IDX4:1;
-		UINT32		RST_DTX_IDX3:1;
-		UINT32		RST_DTX_IDX2:1;
-		UINT32		RST_DTX_IDX1:1;
-		UINT32		RST_DTX_IDX0:1;
-	}	field;
-	UINT32			word;
-}WPDMA_RST_IDX_STRUC, *PWPDMA_RST_IDX_STRUC;
-#else
-typedef	union	_WPDMA_RST_IDX_STRUC	{
-	struct	{
-		UINT32		RST_DTX_IDX0:1;
-		UINT32		RST_DTX_IDX1:1;
-		UINT32		RST_DTX_IDX2:1;
-		UINT32		RST_DTX_IDX3:1;
-		UINT32		RST_DTX_IDX4:1;
-		UINT32		RST_DTX_IDX5:1;
-		UINT32		rsv:10;
-		UINT32		RST_DRX_IDX0:1;
-		UINT32		:15;
-	}	field;
-	UINT32			word;
-} WPDMA_RST_IDX_STRUC, *PWPDMA_RST_IDX_STRUC;
-#endif
-#define DELAY_INT_CFG  0x0210
-#ifdef RT_BIG_ENDIAN
-typedef	union	_DELAY_INT_CFG_STRUC	{
-	struct	{
-		UINT32		TXDLY_INT_EN:1;
-		UINT32		TXMAX_PINT:7;
-		UINT32		TXMAX_PTIME:8;
-		UINT32		RXDLY_INT_EN:1;
-		UINT32		RXMAX_PINT:7;
-		UINT32		RXMAX_PTIME:8;
-	}	field;
-	UINT32			word;
-}DELAY_INT_CFG_STRUC, *PDELAY_INT_CFG_STRUC;
-#else
-typedef	union	_DELAY_INT_CFG_STRUC	{
-	struct	{
-		UINT32		RXMAX_PTIME:8;
-		UINT32		RXMAX_PINT:7;
-		UINT32		RXDLY_INT_EN:1;
-		UINT32		TXMAX_PTIME:8;
-		UINT32		TXMAX_PINT:7;
-		UINT32		TXDLY_INT_EN:1;
-	}	field;
-	UINT32			word;
-} DELAY_INT_CFG_STRUC, *PDELAY_INT_CFG_STRUC;
-#endif
-#define WMM_AIFSN_CFG   0x0214
-#ifdef RT_BIG_ENDIAN
-typedef	union	_AIFSN_CSR_STRUC	{
-	struct	{
-	    UINT32   Rsv:16;
-	    UINT32   Aifsn3:4;       // for AC_VO
-	    UINT32   Aifsn2:4;       // for AC_VI
-	    UINT32   Aifsn1:4;       // for AC_BK
-	    UINT32   Aifsn0:4;       // for AC_BE
-	}	field;
-	UINT32			word;
-}	AIFSN_CSR_STRUC, *PAIFSN_CSR_STRUC;
-#else
-typedef	union	_AIFSN_CSR_STRUC	{
-	struct	{
-	    UINT32   Aifsn0:4;       // for AC_BE
-	    UINT32   Aifsn1:4;       // for AC_BK
-	    UINT32   Aifsn2:4;       // for AC_VI
-	    UINT32   Aifsn3:4;       // for AC_VO
-	    UINT32   Rsv:16;
-	}	field;
-	UINT32			word;
-}	AIFSN_CSR_STRUC, *PAIFSN_CSR_STRUC;
-#endif
-//
-// CWMIN_CSR: CWmin for each EDCA AC
-//
-#define WMM_CWMIN_CFG   0x0218
-#ifdef RT_BIG_ENDIAN
-typedef	union	_CWMIN_CSR_STRUC	{
-	struct	{
-	    UINT32   Rsv:16;
-	    UINT32   Cwmin3:4;       // for AC_VO
-	    UINT32   Cwmin2:4;       // for AC_VI
-	    UINT32   Cwmin1:4;       // for AC_BK
-	    UINT32   Cwmin0:4;       // for AC_BE
-	}	field;
-	UINT32			word;
-}	CWMIN_CSR_STRUC, *PCWMIN_CSR_STRUC;
-#else
-typedef	union	_CWMIN_CSR_STRUC	{
-	struct	{
-	    UINT32   Cwmin0:4;       // for AC_BE
-	    UINT32   Cwmin1:4;       // for AC_BK
-	    UINT32   Cwmin2:4;       // for AC_VI
-	    UINT32   Cwmin3:4;       // for AC_VO
-	    UINT32   Rsv:16;
-	}	field;
-	UINT32			word;
-}	CWMIN_CSR_STRUC, *PCWMIN_CSR_STRUC;
-#endif
-
-//
-// CWMAX_CSR: CWmin for each EDCA AC
-//
-#define WMM_CWMAX_CFG   0x021c
-#ifdef RT_BIG_ENDIAN
-typedef	union	_CWMAX_CSR_STRUC	{
-	struct	{
-	    UINT32   Rsv:16;
-	    UINT32   Cwmax3:4;       // for AC_VO
-	    UINT32   Cwmax2:4;       // for AC_VI
-	    UINT32   Cwmax1:4;       // for AC_BK
-	    UINT32   Cwmax0:4;       // for AC_BE
-	}	field;
-	UINT32			word;
-}	CWMAX_CSR_STRUC, *PCWMAX_CSR_STRUC;
-#else
-typedef	union	_CWMAX_CSR_STRUC	{
-	struct	{
-	    UINT32   Cwmax0:4;       // for AC_BE
-	    UINT32   Cwmax1:4;       // for AC_BK
-	    UINT32   Cwmax2:4;       // for AC_VI
-	    UINT32   Cwmax3:4;       // for AC_VO
-	    UINT32   Rsv:16;
-	}	field;
-	UINT32			word;
-}	CWMAX_CSR_STRUC, *PCWMAX_CSR_STRUC;
-#endif
-
-
-//
-// AC_TXOP_CSR0: AC_BK/AC_BE TXOP register
-//
-#define WMM_TXOP0_CFG    0x0220
-#ifdef RT_BIG_ENDIAN
-typedef	union	_AC_TXOP_CSR0_STRUC	{
-	struct	{
-	    USHORT  Ac1Txop;        // for AC_BE, in unit of 32us
-	    USHORT  Ac0Txop;        // for AC_BK, in unit of 32us
-	}	field;
-	UINT32			word;
-}	AC_TXOP_CSR0_STRUC, *PAC_TXOP_CSR0_STRUC;
-#else
-typedef	union	_AC_TXOP_CSR0_STRUC	{
-	struct	{
-	    USHORT  Ac0Txop;        // for AC_BK, in unit of 32us
-	    USHORT  Ac1Txop;        // for AC_BE, in unit of 32us
-	}	field;
-	UINT32			word;
-}	AC_TXOP_CSR0_STRUC, *PAC_TXOP_CSR0_STRUC;
-#endif
-
-//
-// AC_TXOP_CSR1: AC_VO/AC_VI TXOP register
-//
-#define WMM_TXOP1_CFG    0x0224
-#ifdef RT_BIG_ENDIAN
-typedef	union	_AC_TXOP_CSR1_STRUC	{
-	struct	{
-	    USHORT  Ac3Txop;        // for AC_VO, in unit of 32us
-	    USHORT  Ac2Txop;        // for AC_VI, in unit of 32us
-	}	field;
-	UINT32			word;
-}	AC_TXOP_CSR1_STRUC, *PAC_TXOP_CSR1_STRUC;
-#else
-typedef	union	_AC_TXOP_CSR1_STRUC	{
-	struct	{
-	    USHORT  Ac2Txop;        // for AC_VI, in unit of 32us
-	    USHORT  Ac3Txop;        // for AC_VO, in unit of 32us
-	}	field;
-	UINT32			word;
-}	AC_TXOP_CSR1_STRUC, *PAC_TXOP_CSR1_STRUC;
-#endif
-
-
-#define RINGREG_DIFF			0x10
-#define GPIO_CTRL_CFG    0x0228	//MAC_CSR13
-#define MCU_CMD_CFG    0x022c
-#define TX_BASE_PTR0     0x0230	//AC_BK base address
-#define TX_MAX_CNT0      0x0234
-#define TX_CTX_IDX0       0x0238
-#define TX_DTX_IDX0      0x023c
-#define TX_BASE_PTR1     0x0240		//AC_BE base address
-#define TX_MAX_CNT1      0x0244
-#define TX_CTX_IDX1       0x0248
-#define TX_DTX_IDX1      0x024c
-#define TX_BASE_PTR2     0x0250		//AC_VI base address
-#define TX_MAX_CNT2      0x0254
-#define TX_CTX_IDX2       0x0258
-#define TX_DTX_IDX2      0x025c
-#define TX_BASE_PTR3     0x0260		//AC_VO base address
-#define TX_MAX_CNT3      0x0264
-#define TX_CTX_IDX3       0x0268
-#define TX_DTX_IDX3      0x026c
-#define TX_BASE_PTR4     0x0270		//HCCA base address
-#define TX_MAX_CNT4      0x0274
-#define TX_CTX_IDX4       0x0278
-#define TX_DTX_IDX4      0x027c
-#define TX_BASE_PTR5     0x0280		//MGMT base address
-#define  TX_MAX_CNT5     0x0284
-#define TX_CTX_IDX5       0x0288
-#define TX_DTX_IDX5      0x028c
-#define TX_MGMTMAX_CNT      TX_MAX_CNT5
-#define TX_MGMTCTX_IDX       TX_CTX_IDX5
-#define TX_MGMTDTX_IDX      TX_DTX_IDX5
-#define RX_BASE_PTR     0x0290	//RX base address
-#define RX_MAX_CNT      0x0294
-#define RX_CRX_IDX       0x0298
-#define RX_DRX_IDX      0x029c
-
-
-#define USB_DMA_CFG      0x02a0
-#ifdef RT_BIG_ENDIAN
-typedef	union	_USB_DMA_CFG_STRUC	{
-	struct	{
-	    UINT32  TxBusy:1;		//USB DMA TX FSM busy . debug only
-	    UINT32  RxBusy:1;        //USB DMA RX FSM busy . debug only
-	    UINT32  EpoutValid:6;        //OUT endpoint data valid. debug only
-	    UINT32  TxBulkEn:1;        //Enable USB DMA Tx
-	    UINT32  RxBulkEn:1;        //Enable USB DMA Rx
-	    UINT32  RxBulkAggEn:1;        //Enable Rx Bulk Aggregation
-	    UINT32  TxopHalt:1;        //Halt TXOP count down when TX buffer is full.
-	    UINT32  TxClear:1;        //Clear USB DMA TX path
-	    UINT32  rsv:2;
-	    UINT32  phyclear:1;			//phy watch dog enable. write 1
-	    UINT32  RxBulkAggLmt:8;        //Rx Bulk Aggregation Limit  in unit of 1024 bytes
-	    UINT32  RxBulkAggTOut:8;        //Rx Bulk Aggregation TimeOut  in unit of 33ns
-	}	field;
-	UINT32			word;
-}	USB_DMA_CFG_STRUC, *PUSB_DMA_CFG_STRUC;
-#else
-typedef	union	_USB_DMA_CFG_STRUC	{
-	struct	{
-	    UINT32  RxBulkAggTOut:8;        //Rx Bulk Aggregation TimeOut  in unit of 33ns
-	    UINT32  RxBulkAggLmt:8;        //Rx Bulk Aggregation Limit  in unit of 256 bytes
-	    UINT32  phyclear:1;			//phy watch dog enable. write 1
-	    UINT32  rsv:2;
-	    UINT32  TxClear:1;        //Clear USB DMA TX path
-	    UINT32  TxopHalt:1;        //Halt TXOP count down when TX buffer is full.
-	    UINT32  RxBulkAggEn:1;        //Enable Rx Bulk Aggregation
-	    UINT32  RxBulkEn:1;        //Enable USB DMA Rx
-	    UINT32  TxBulkEn:1;        //Enable USB DMA Tx
-	    UINT32  EpoutValid:6;        //OUT endpoint data valid
-	    UINT32  RxBusy:1;        //USB DMA RX FSM busy
-	    UINT32  TxBusy:1;		//USB DMA TX FSM busy
-	}	field;
-	UINT32			word;
-}	USB_DMA_CFG_STRUC, *PUSB_DMA_CFG_STRUC;
-#endif
-
-
-//
-//  3  PBF  registers
-//
-//
-// Most are for debug. Driver doesn't touch PBF register.
-#define PBF_SYS_CTRL	 0x0400
-#define PBF_CFG                 0x0408
-#define PBF_MAX_PCNT	 0x040C
-#define PBF_CTRL		0x0410
-#define PBF_INT_STA	 0x0414
-#define PBF_INT_ENA	 0x0418
-#define TXRXQ_PCNT	 0x0438
-#define PBF_DBG			 0x043c
-#define PBF_CAP_CTRL     0x0440
-
-#ifdef RT30xx
-#ifdef RTMP_EFUSE_SUPPORT
-// eFuse registers
-#define EFUSE_CTRL				0x0580
-#define EFUSE_DATA0				0x0590
-#define EFUSE_DATA1				0x0594
-#define EFUSE_DATA2				0x0598
-#define EFUSE_DATA3				0x059c
-#endif // RTMP_EFUSE_SUPPORT //
-#endif // RT30xx //
-
-#define OSC_CTRL		0x5a4
-#define PCIE_PHY_TX_ATTENUATION_CTRL	0x05C8
-#define LDO_CFG0				0x05d4
-#define GPIO_SWITCH				0x05dc
-
-
-//
-//  4  MAC  registers
-//
-//
-//  4.1 MAC SYSTEM  configuration registers (offset:0x1000)
-//
-#define MAC_CSR0            0x1000
-#ifdef RT_BIG_ENDIAN
-typedef	union	_ASIC_VER_ID_STRUC	{
-	struct	{
-	    USHORT  ASICVer;        // version : 2860
-	    USHORT  ASICRev;        // reversion  : 0
-	}	field;
-	UINT32			word;
-}	ASIC_VER_ID_STRUC, *PASIC_VER_ID_STRUC;
-#else
-typedef	union	_ASIC_VER_ID_STRUC	{
-	struct	{
-	    USHORT  ASICRev;        // reversion  : 0
-	    USHORT  ASICVer;        // version : 2860
-	}	field;
-	UINT32			word;
-}	ASIC_VER_ID_STRUC, *PASIC_VER_ID_STRUC;
-#endif
-#define MAC_SYS_CTRL            0x1004		//MAC_CSR1
-#define MAC_ADDR_DW0				0x1008		// MAC ADDR DW0
-#define MAC_ADDR_DW1			 0x100c		// MAC ADDR DW1
-//
-// MAC_CSR2: STA MAC register 0
-//
-#ifdef RT_BIG_ENDIAN
-typedef	union	_MAC_DW0_STRUC	{
-	struct	{
-		UCHAR		Byte3;		// MAC address byte 3
-		UCHAR		Byte2;		// MAC address byte 2
-		UCHAR		Byte1;		// MAC address byte 1
-		UCHAR		Byte0;		// MAC address byte 0
-	}	field;
-	UINT32			word;
-}	MAC_DW0_STRUC, *PMAC_DW0_STRUC;
-#else
-typedef	union	_MAC_DW0_STRUC	{
-	struct	{
-		UCHAR		Byte0;		// MAC address byte 0
-		UCHAR		Byte1;		// MAC address byte 1
-		UCHAR		Byte2;		// MAC address byte 2
-		UCHAR		Byte3;		// MAC address byte 3
-	}	field;
-	UINT32			word;
-}	MAC_DW0_STRUC, *PMAC_DW0_STRUC;
-#endif
-
-//
-// MAC_CSR3: STA MAC register 1
-//
-#ifdef RT_BIG_ENDIAN
-typedef	union	_MAC_DW1_STRUC	{
-	struct	{
-		UCHAR		Rsvd1;
-		UCHAR		U2MeMask;
-		UCHAR		Byte5;		// MAC address byte 5
-		UCHAR		Byte4;		// MAC address byte 4
-	}	field;
-	UINT32			word;
-}	MAC_DW1_STRUC, *PMAC_DW1_STRUC;
-#else
-typedef	union	_MAC_DW1_STRUC	{
-	struct	{
-		UCHAR		Byte4;		// MAC address byte 4
-		UCHAR		Byte5;		// MAC address byte 5
-		UCHAR		U2MeMask;
-		UCHAR		Rsvd1;
-	}	field;
-	UINT32			word;
-}	MAC_DW1_STRUC, *PMAC_DW1_STRUC;
-#endif
-
-#define MAC_BSSID_DW0				0x1010		// MAC BSSID DW0
-#define MAC_BSSID_DW1				0x1014		// MAC BSSID DW1
-
-//
-// MAC_CSR5: BSSID register 1
-//
-#ifdef RT_BIG_ENDIAN
-typedef	union	_MAC_CSR5_STRUC	{
-	struct	{
-		USHORT		Rsvd:11;
-		USHORT		MBssBcnNum:3;
-		USHORT		BssIdMode:2; // 0: one BSSID, 10: 4 BSSID,  01: 2 BSSID , 11: 8BSSID
-		UCHAR		Byte5;		 // BSSID byte 5
-		UCHAR		Byte4;		 // BSSID byte 4
-	}	field;
-	UINT32			word;
-}	MAC_CSR5_STRUC, *PMAC_CSR5_STRUC;
-#else
-typedef	union	_MAC_CSR5_STRUC	{
-	struct	{
-		UCHAR		Byte4;		 // BSSID byte 4
-		UCHAR		Byte5;		 // BSSID byte 5
-		USHORT		BssIdMask:2; // 0: one BSSID, 10: 4 BSSID,  01: 2 BSSID , 11: 8BSSID
-		USHORT		MBssBcnNum:3;
-		USHORT		Rsvd:11;
-	}	field;
-	UINT32			word;
-}	MAC_CSR5_STRUC, *PMAC_CSR5_STRUC;
-#endif
-
-#define MAX_LEN_CFG              0x1018		// rt2860b max 16k bytes. bit12:13 Maximum PSDU length (power factor) 0:2^13, 1:2^14, 2:2^15, 3:2^16
-#define BBP_CSR_CFG			0x101c		//
-//
-// BBP_CSR_CFG: BBP serial control register
-//
-#ifdef RT_BIG_ENDIAN
-typedef	union	_BBP_CSR_CFG_STRUC	{
-	struct	{
-		UINT32		:12;
-		UINT32		BBP_RW_MODE:1;		// 0: use serial mode  1:parallel
-		UINT32		BBP_PAR_DUR:1;		    // 0: 4 MAC clock cycles  1: 8 MAC clock cycles
-		UINT32		Busy:1;				// 1: ASIC is busy execute BBP programming.
-		UINT32		fRead:1;		    // 0: Write	BBP, 1:	Read BBP
-		UINT32		RegNum:8;			// Selected	BBP	register
-		UINT32		Value:8;			// Register	value to program into BBP
-	}	field;
-	UINT32			word;
-}	BBP_CSR_CFG_STRUC, *PBBP_CSR_CFG_STRUC;
-#else
-typedef	union	_BBP_CSR_CFG_STRUC	{
-	struct	{
-		UINT32		Value:8;			// Register	value to program into BBP
-		UINT32		RegNum:8;			// Selected	BBP	register
-		UINT32		fRead:1;		    // 0: Write	BBP, 1:	Read BBP
-		UINT32		Busy:1;				// 1: ASIC is busy execute BBP programming.
-		UINT32		BBP_PAR_DUR:1;		     // 0: 4 MAC clock cycles  1: 8 MAC clock cycles
-		UINT32		BBP_RW_MODE:1;		// 0: use serial mode  1:parallel
-		UINT32		:12;
-	}	field;
-	UINT32			word;
-}	BBP_CSR_CFG_STRUC, *PBBP_CSR_CFG_STRUC;
-#endif
-#define RF_CSR_CFG0			0x1020
-//
-// RF_CSR_CFG: RF control register
-//
-#ifdef RT_BIG_ENDIAN
-typedef	union	_RF_CSR_CFG0_STRUC	{
-	struct	{
-		UINT32		Busy:1;		    // 0: idle 1: 8busy
-		UINT32		Sel:1;				// 0:RF_LE0 activate  1:RF_LE1 activate
-		UINT32		StandbyMode:1;		    // 0: high when stand by 1:	low when standby
-		UINT32		bitwidth:5;			// Selected	BBP	register
-		UINT32		RegIdAndContent:24;			// Register	value to program into BBP
-	}	field;
-	UINT32			word;
-}	RF_CSR_CFG0_STRUC, *PRF_CSR_CFG0_STRUC;
-#else
-typedef	union	_RF_CSR_CFG0_STRUC	{
-	struct	{
-		UINT32		RegIdAndContent:24;			// Register	value to program into BBP
-		UINT32		bitwidth:5;			// Selected	BBP	register
-		UINT32		StandbyMode:1;		    // 0: high when stand by 1:	low when standby
-		UINT32		Sel:1;				// 0:RF_LE0 activate  1:RF_LE1 activate
-		UINT32		Busy:1;		    // 0: idle 1: 8busy
-	}	field;
-	UINT32			word;
-}	RF_CSR_CFG0_STRUC, *PRF_CSR_CFG0_STRUC;
-#endif
-#define RF_CSR_CFG1			0x1024
-#ifdef RT_BIG_ENDIAN
-typedef	union	_RF_CSR_CFG1_STRUC	{
-	struct	{
-		UINT32		rsv:7;		    // 0: idle 1: 8busy
-		UINT32		RFGap:5;			// Gap between BB_CONTROL_RF and RF_LE. 0: 3 system clock cycle (37.5usec) 1: 5 system clock cycle (62.5usec)
-		UINT32		RegIdAndContent:24;			// Register	value to program into BBP
-	}	field;
-	UINT32			word;
-}	RF_CSR_CFG1_STRUC, *PRF_CSR_CFG1_STRUC;
-#else
-typedef	union	_RF_CSR_CFG1_STRUC	{
-	struct	{
-		UINT32		RegIdAndContent:24;			// Register	value to program into BBP
-		UINT32		RFGap:5;			// Gap between BB_CONTROL_RF and RF_LE. 0: 3 system clock cycle (37.5usec) 1: 5 system clock cycle (62.5usec)
-		UINT32		rsv:7;		    // 0: idle 1: 8busy
-	}	field;
-	UINT32			word;
-}	RF_CSR_CFG1_STRUC, *PRF_CSR_CFG1_STRUC;
-#endif
-#define RF_CSR_CFG2			0x1028		//
-#ifdef RT_BIG_ENDIAN
-typedef	union	_RF_CSR_CFG2_STRUC	{
-	struct	{
-		UINT32		rsv:8;		    // 0: idle 1: 8busy
-		UINT32		RegIdAndContent:24;			// Register	value to program into BBP
-	}	field;
-	UINT32			word;
-}	RF_CSR_CFG2_STRUC, *PRF_CSR_CFG2_STRUC;
-#else
-typedef	union	_RF_CSR_CFG2_STRUC	{
-	struct	{
-		UINT32		RegIdAndContent:24;			// Register	value to program into BBP
-		UINT32		rsv:8;		    // 0: idle 1: 8busy
-	}	field;
-	UINT32			word;
-}	RF_CSR_CFG2_STRUC, *PRF_CSR_CFG2_STRUC;
-#endif
-#define LED_CFG				0x102c		//  MAC_CSR14
-#ifdef RT_BIG_ENDIAN
-typedef	union	_LED_CFG_STRUC	{
-	struct	{
-		UINT32		:1;
-		UINT32		LedPolar:1;			// Led Polarity.  0: active low1: active high
-		UINT32		YLedMode:2;			// yellow Led Mode
-		UINT32		GLedMode:2;			// green Led Mode
-		UINT32		RLedMode:2;			// red Led Mode    0: off1: blinking upon TX2: periodic slow blinking3: always on
-		UINT32		rsv:2;
-		UINT32		SlowBlinkPeriod:6;			// slow blinking period. unit:1ms
-		UINT32		OffPeriod:8;			// blinking off period unit 1ms
-		UINT32		OnPeriod:8;			// blinking on period unit 1ms
-	}	field;
-	UINT32			word;
-}	LED_CFG_STRUC, *PLED_CFG_STRUC;
-#else
-typedef	union	_LED_CFG_STRUC	{
-	struct	{
-		UINT32		OnPeriod:8;			// blinking on period unit 1ms
-		UINT32		OffPeriod:8;			// blinking off period unit 1ms
-		UINT32		SlowBlinkPeriod:6;			// slow blinking period. unit:1ms
-		UINT32		rsv:2;
-		UINT32		RLedMode:2;			// red Led Mode    0: off1: blinking upon TX2: periodic slow blinking3: always on
-		UINT32		GLedMode:2;			// green Led Mode
-		UINT32		YLedMode:2;			// yellow Led Mode
-		UINT32		LedPolar:1;			// Led Polarity.  0: active low1: active high
-		UINT32		:1;
-	}	field;
-	UINT32			word;
-}	LED_CFG_STRUC, *PLED_CFG_STRUC;
-#endif
-//
-//  4.2 MAC TIMING  configuration registers (offset:0x1100)
-//
-#define XIFS_TIME_CFG             0x1100		 // MAC_CSR8  MAC_CSR9
-#ifdef RT_BIG_ENDIAN
-typedef	union	_IFS_SLOT_CFG_STRUC	{
-	struct	{
-	    UINT32  rsv:2;
-	    UINT32  BBRxendEnable:1;        //  reference RXEND signal to begin XIFS defer
-	    UINT32  EIFS:9;        //  unit 1us
-	    UINT32  OfdmXifsTime:4;        //OFDM SIFS. unit 1us. Applied after OFDM RX when MAC doesn't reference BBP signal BBRXEND
-	    UINT32  OfdmSifsTime:8;        //  unit 1us. Applied after OFDM RX/TX
-	    UINT32  CckmSifsTime:8;        //  unit 1us. Applied after CCK RX/TX
-	}	field;
-	UINT32			word;
-}	IFS_SLOT_CFG_STRUC, *PIFS_SLOT_CFG_STRUC;
-#else
-typedef	union	_IFS_SLOT_CFG_STRUC	{
-	struct	{
-	    UINT32  CckmSifsTime:8;        //  unit 1us. Applied after CCK RX/TX
-	    UINT32  OfdmSifsTime:8;        //  unit 1us. Applied after OFDM RX/TX
-	    UINT32  OfdmXifsTime:4;        //OFDM SIFS. unit 1us. Applied after OFDM RX when MAC doesn't reference BBP signal BBRXEND
-	    UINT32  EIFS:9;        //  unit 1us
-	    UINT32  BBRxendEnable:1;        //  reference RXEND signal to begin XIFS defer
-	    UINT32  rsv:2;
-	}	field;
-	UINT32			word;
-}	IFS_SLOT_CFG_STRUC, *PIFS_SLOT_CFG_STRUC;
-#endif
-
-#define BKOFF_SLOT_CFG             0x1104		 //  mac_csr9 last 8 bits
-#define NAV_TIME_CFG             0x1108		 // NAV  (MAC_CSR15)
-#define CH_TIME_CFG             0x110C			// Count as channel busy
-#define PBF_LIFE_TIMER             0x1110		 //TX/RX MPDU timestamp timer (free run)Unit: 1us
-#define BCN_TIME_CFG             0x1114		 // TXRX_CSR9
-
-#define BCN_OFFSET0				0x042C
-#define BCN_OFFSET1				0x0430
-
-//
-// BCN_TIME_CFG : Synchronization control register
-//
-#ifdef RT_BIG_ENDIAN
-typedef	union	_BCN_TIME_CFG_STRUC	{
-	struct	{
-		UINT32		TxTimestampCompensate:8;
-        UINT32       :3;
-		UINT32		bBeaconGen:1;		// Enable beacon generator
-        UINT32       bTBTTEnable:1;
-		UINT32		TsfSyncMode:2;		// Enable TSF sync, 00: disable, 01: infra mode, 10: ad-hoc mode
-		UINT32		bTsfTicking:1;		// Enable TSF auto counting
-		UINT32       BeaconInterval:16;  // in unit of 1/16 TU
-	}	field;
-	UINT32			word;
-}	BCN_TIME_CFG_STRUC, *PBCN_TIME_CFG_STRUC;
-#else
-typedef	union	_BCN_TIME_CFG_STRUC	{
-	struct	{
-		UINT32       BeaconInterval:16;  // in unit of 1/16 TU
-		UINT32		bTsfTicking:1;		// Enable TSF auto counting
-		UINT32		TsfSyncMode:2;		// Enable TSF sync, 00: disable, 01: infra mode, 10: ad-hoc mode
-        UINT32       bTBTTEnable:1;
-		UINT32		bBeaconGen:1;		// Enable beacon generator
-        UINT32       :3;
-		UINT32		TxTimestampCompensate:8;
-	}	field;
-	UINT32			word;
-}	BCN_TIME_CFG_STRUC, *PBCN_TIME_CFG_STRUC;
-#endif
-#define TBTT_SYNC_CFG            0x1118			// txrx_csr10
-#define TSF_TIMER_DW0             0x111C		// Local TSF timer lsb 32 bits. Read-only
-#define TSF_TIMER_DW1             0x1120		// msb 32 bits. Read-only.
-#define TBTT_TIMER		0x1124			// TImer remains till next TBTT. Read-only.  TXRX_CSR14
-#define INT_TIMER_CFG			0x1128			//
-#define INT_TIMER_EN			0x112c			//  GP-timer and pre-tbtt Int enable
-#define CH_IDLE_STA			0x1130			//  channel idle time
-#define CH_BUSY_STA			0x1134			//  channle busy time
-//
-//  4.2 MAC POWER  configuration registers (offset:0x1200)
-//
-#define MAC_STATUS_CFG             0x1200		 // old MAC_CSR12
-#define PWR_PIN_CFG             0x1204		 // old MAC_CSR12
-#define AUTO_WAKEUP_CFG             0x1208		 // old MAC_CSR10
-//
-// AUTO_WAKEUP_CFG: Manual power control / status register
-//
-#ifdef RT_BIG_ENDIAN
-typedef	union	_AUTO_WAKEUP_STRUC	{
-	struct	{
-		UINT32		:16;
-		UINT32		EnableAutoWakeup:1;	// 0:sleep, 1:awake
-		UINT32       NumofSleepingTbtt:7;          // ForceWake has high privilege than PutToSleep when both set
-		UINT32       AutoLeadTime:8;
-	}	field;
-	UINT32			word;
-}	AUTO_WAKEUP_STRUC, *PAUTO_WAKEUP_STRUC;
-#else
-typedef	union	_AUTO_WAKEUP_STRUC	{
-	struct	{
-		UINT32       AutoLeadTime:8;
-		UINT32       NumofSleepingTbtt:7;          // ForceWake has high privilege than PutToSleep when both set
-		UINT32		EnableAutoWakeup:1;	// 0:sleep, 1:awake
-		UINT32		:16;
-	}	field;
-	UINT32			word;
-}	AUTO_WAKEUP_STRUC, *PAUTO_WAKEUP_STRUC;
-#endif
-//
-//  4.3 MAC TX  configuration registers (offset:0x1300)
-//
-
-#define EDCA_AC0_CFG	0x1300		//AC_TXOP_CSR0 0x3474
-#define EDCA_AC1_CFG	0x1304
-#define EDCA_AC2_CFG	0x1308
-#define EDCA_AC3_CFG	0x130c
-#ifdef RT_BIG_ENDIAN
-typedef	union	_EDCA_AC_CFG_STRUC	{
-	struct	{
-	    UINT32  :12;        //
-	    UINT32  Cwmax:4;        //unit power of 2
-	    UINT32  Cwmin:4;        //
-	    UINT32  Aifsn:4;        // # of slot time
-	    UINT32  AcTxop:8;        //  in unit of 32us
-	}	field;
-	UINT32			word;
-}	EDCA_AC_CFG_STRUC, *PEDCA_AC_CFG_STRUC;
-#else
-typedef	union	_EDCA_AC_CFG_STRUC	{
-	struct	{
-	    UINT32  AcTxop:8;        //  in unit of 32us
-	    UINT32  Aifsn:4;        // # of slot time
-	    UINT32  Cwmin:4;        //
-	    UINT32  Cwmax:4;        //unit power of 2
-	    UINT32  :12;       //
-	}	field;
-	UINT32			word;
-}	EDCA_AC_CFG_STRUC, *PEDCA_AC_CFG_STRUC;
-#endif
-
-#define EDCA_TID_AC_MAP	0x1310
-#define TX_PWR_CFG_0	0x1314
-#define TX_PWR_CFG_1	0x1318
-#define TX_PWR_CFG_2	0x131C
-#define TX_PWR_CFG_3	0x1320
-#define TX_PWR_CFG_4	0x1324
-#define TX_PIN_CFG		0x1328
-#define TX_BAND_CFG	0x132c		// 0x1 use upper 20MHz. 0 juse lower 20MHz
-#define TX_SW_CFG0		0x1330
-#define TX_SW_CFG1		0x1334
-#define TX_SW_CFG2		0x1338
-#define TXOP_THRES_CFG		0x133c
-#define TXOP_CTRL_CFG		0x1340
-#define TX_RTS_CFG		0x1344
-
-#ifdef RT_BIG_ENDIAN
-typedef	union	_TX_RTS_CFG_STRUC	{
-	struct	{
-	    UINT32       rsv:7;
-	    UINT32       RtsFbkEn:1;    // enable rts rate fallback
-	    UINT32       RtsThres:16;    // unit:byte
-	    UINT32       AutoRtsRetryLimit:8;
-	}	field;
-	UINT32			word;
-}	TX_RTS_CFG_STRUC, *PTX_RTS_CFG_STRUC;
-#else
-typedef	union	_TX_RTS_CFG_STRUC	{
-	struct	{
-	    UINT32       AutoRtsRetryLimit:8;
-	    UINT32       RtsThres:16;    // unit:byte
-	    UINT32       RtsFbkEn:1;    // enable rts rate fallback
-	    UINT32       rsv:7;     // 1: HT non-STBC control frame enable
-	}	field;
-	UINT32			word;
-}	TX_RTS_CFG_STRUC, *PTX_RTS_CFG_STRUC;
-#endif
-#define TX_TIMEOUT_CFG	0x1348
-#ifdef RT_BIG_ENDIAN
-typedef	union	_TX_TIMEOUT_CFG_STRUC	{
-	struct	{
-	    UINT32       rsv2:8;
-	    UINT32       TxopTimeout:8;	//TXOP timeout value for TXOP truncation.  It is recommended that (SLOT_TIME) > (TX_OP_TIMEOUT) > (RX_ACK_TIMEOUT)
-	    UINT32       RxAckTimeout:8;	// unit:slot. Used for TX precedure
-	    UINT32       MpduLifeTime:4;    //  expiration time = 2^(9+MPDU LIFE TIME)  us
-	    UINT32       rsv:4;
-	}	field;
-	UINT32			word;
-}	TX_TIMEOUT_CFG_STRUC, *PTX_TIMEOUT_CFG_STRUC;
-#else
-typedef	union	_TX_TIMEOUT_CFG_STRUC	{
-	struct	{
-	    UINT32       rsv:4;
-	    UINT32       MpduLifeTime:4;    //  expiration time = 2^(9+MPDU LIFE TIME)  us
-	    UINT32       RxAckTimeout:8;	// unit:slot. Used for TX precedure
-	    UINT32       TxopTimeout:8;	//TXOP timeout value for TXOP truncation.  It is recommended that (SLOT_TIME) > (TX_OP_TIMEOUT) > (RX_ACK_TIMEOUT)
-	    UINT32       rsv2:8;     // 1: HT non-STBC control frame enable
-	}	field;
-	UINT32			word;
-}	TX_TIMEOUT_CFG_STRUC, *PTX_TIMEOUT_CFG_STRUC;
-#endif
-#define TX_RTY_CFG	0x134c
-#ifdef RT_BIG_ENDIAN
-typedef	union PACKED _TX_RTY_CFG_STRUC	{
-	struct	{
-	    UINT32       rsv:1;
-	    UINT32       TxautoFBEnable:1;    // Tx retry PHY rate auto fallback enable
-	    UINT32       AggRtyMode:1;	// Aggregate MPDU retry mode.  0:expired by retry limit, 1: expired by mpdu life timer
-	    UINT32       NonAggRtyMode:1;	// Non-Aggregate MPDU retry mode.  0:expired by retry limit, 1: expired by mpdu life timer
-	    UINT32       LongRtyThre:12;	// Long retry threshoold
-	    UINT32       LongRtyLimit:8;	//long retry limit
-	    UINT32       ShortRtyLimit:8;	//  short retry limit
-
-	}	field;
-	UINT32			word;
-}	TX_RTY_CFG_STRUC, *PTX_RTY_CFG_STRUC;
-#else
-typedef	union PACKED _TX_RTY_CFG_STRUC	{
-	struct	{
-	    UINT32       ShortRtyLimit:8;	//  short retry limit
-	    UINT32       LongRtyLimit:8;	//long retry limit
-	    UINT32       LongRtyThre:12;	// Long retry threshoold
-	    UINT32       NonAggRtyMode:1;	// Non-Aggregate MPDU retry mode.  0:expired by retry limit, 1: expired by mpdu life timer
-	    UINT32       AggRtyMode:1;	// Aggregate MPDU retry mode.  0:expired by retry limit, 1: expired by mpdu life timer
-	    UINT32       TxautoFBEnable:1;    // Tx retry PHY rate auto fallback enable
-	    UINT32       rsv:1;     // 1: HT non-STBC control frame enable
-	}	field;
-	UINT32			word;
-}	TX_RTY_CFG_STRUC, *PTX_RTY_CFG_STRUC;
-#endif
-#define TX_LINK_CFG	0x1350
-#ifdef RT_BIG_ENDIAN
-typedef	union	PACKED _TX_LINK_CFG_STRUC	{
-	struct PACKED {
-	    UINT32       RemotMFS:8;	//remote MCS feedback sequence number
-	    UINT32       RemotMFB:8;    //  remote MCS feedback
-	    UINT32       rsv:3;	//
-	    UINT32       TxCFAckEn:1;	//   Piggyback CF-ACK enable
-	    UINT32       TxRDGEn:1;	// RDG TX enable
-	    UINT32       TxMRQEn:1;	//  MCS request TX enable
-	    UINT32       RemoteUMFSEnable:1;	//  remote unsolicit  MFB enable.  0: not apply remote remote unsolicit (MFS=7)
-	    UINT32       MFBEnable:1;	//  TX apply remote MFB 1:enable
-	    UINT32       RemoteMFBLifeTime:8;	//remote MFB life time. unit : 32us
-	}	field;
-	UINT32			word;
-}	TX_LINK_CFG_STRUC, *PTX_LINK_CFG_STRUC;
-#else
-typedef	union	PACKED _TX_LINK_CFG_STRUC	{
-	struct PACKED {
-	    UINT32       RemoteMFBLifeTime:8;	//remote MFB life time. unit : 32us
-	    UINT32       MFBEnable:1;	//  TX apply remote MFB 1:enable
-	    UINT32       RemoteUMFSEnable:1;	//  remote unsolicit  MFB enable.  0: not apply remote remote unsolicit (MFS=7)
-	    UINT32       TxMRQEn:1;	//  MCS request TX enable
-	    UINT32       TxRDGEn:1;	// RDG TX enable
-	    UINT32       TxCFAckEn:1;	//   Piggyback CF-ACK enable
-	    UINT32       rsv:3;	//
-	    UINT32       RemotMFB:8;    //  remote MCS feedback
-	    UINT32       RemotMFS:8;	//remote MCS feedback sequence number
-	}	field;
-	UINT32			word;
-}	TX_LINK_CFG_STRUC, *PTX_LINK_CFG_STRUC;
-#endif
-#define HT_FBK_CFG0	0x1354
-#ifdef RT_BIG_ENDIAN
-typedef	union PACKED _HT_FBK_CFG0_STRUC	{
-	struct	{
-	    UINT32       HTMCS7FBK:4;
-	    UINT32       HTMCS6FBK:4;
-	    UINT32       HTMCS5FBK:4;
-	    UINT32       HTMCS4FBK:4;
-	    UINT32       HTMCS3FBK:4;
-	    UINT32       HTMCS2FBK:4;
-	    UINT32       HTMCS1FBK:4;
-	    UINT32       HTMCS0FBK:4;
-	}	field;
-	UINT32			word;
-}	HT_FBK_CFG0_STRUC, *PHT_FBK_CFG0_STRUC;
-#else
-typedef	union PACKED _HT_FBK_CFG0_STRUC	{
-	struct	{
-	    UINT32       HTMCS0FBK:4;
-	    UINT32       HTMCS1FBK:4;
-	    UINT32       HTMCS2FBK:4;
-	    UINT32       HTMCS3FBK:4;
-	    UINT32       HTMCS4FBK:4;
-	    UINT32       HTMCS5FBK:4;
-	    UINT32       HTMCS6FBK:4;
-	    UINT32       HTMCS7FBK:4;
-	}	field;
-	UINT32			word;
-}	HT_FBK_CFG0_STRUC, *PHT_FBK_CFG0_STRUC;
-#endif
-#define HT_FBK_CFG1	0x1358
-#ifdef RT_BIG_ENDIAN
-typedef	union	_HT_FBK_CFG1_STRUC	{
-	struct	{
-	    UINT32       HTMCS15FBK:4;
-	    UINT32       HTMCS14FBK:4;
-	    UINT32       HTMCS13FBK:4;
-	    UINT32       HTMCS12FBK:4;
-	    UINT32       HTMCS11FBK:4;
-	    UINT32       HTMCS10FBK:4;
-	    UINT32       HTMCS9FBK:4;
-	    UINT32       HTMCS8FBK:4;
-	}	field;
-	UINT32			word;
-}	HT_FBK_CFG1_STRUC, *PHT_FBK_CFG1_STRUC;
-#else
-typedef	union	_HT_FBK_CFG1_STRUC	{
-	struct	{
-	    UINT32       HTMCS8FBK:4;
-	    UINT32       HTMCS9FBK:4;
-	    UINT32       HTMCS10FBK:4;
-	    UINT32       HTMCS11FBK:4;
-	    UINT32       HTMCS12FBK:4;
-	    UINT32       HTMCS13FBK:4;
-	    UINT32       HTMCS14FBK:4;
-	    UINT32       HTMCS15FBK:4;
-	}	field;
-	UINT32			word;
-}	HT_FBK_CFG1_STRUC, *PHT_FBK_CFG1_STRUC;
-#endif
-#define LG_FBK_CFG0	0x135c
-#ifdef RT_BIG_ENDIAN
-typedef	union	_LG_FBK_CFG0_STRUC	{
-	struct	{
-	    UINT32       OFDMMCS7FBK:4;	//initial value is 6
-	    UINT32       OFDMMCS6FBK:4;	//initial value is 5
-	    UINT32       OFDMMCS5FBK:4;	//initial value is 4
-	    UINT32       OFDMMCS4FBK:4;	//initial value is 3
-	    UINT32       OFDMMCS3FBK:4;	//initial value is 2
-	    UINT32       OFDMMCS2FBK:4;	//initial value is 1
-	    UINT32       OFDMMCS1FBK:4;	//initial value is 0
-	    UINT32       OFDMMCS0FBK:4;	//initial value is 0
-	}	field;
-	UINT32			word;
-}	LG_FBK_CFG0_STRUC, *PLG_FBK_CFG0_STRUC;
-#else
-typedef	union	_LG_FBK_CFG0_STRUC	{
-	struct	{
-	    UINT32       OFDMMCS0FBK:4;	//initial value is 0
-	    UINT32       OFDMMCS1FBK:4;	//initial value is 0
-	    UINT32       OFDMMCS2FBK:4;	//initial value is 1
-	    UINT32       OFDMMCS3FBK:4;	//initial value is 2
-	    UINT32       OFDMMCS4FBK:4;	//initial value is 3
-	    UINT32       OFDMMCS5FBK:4;	//initial value is 4
-	    UINT32       OFDMMCS6FBK:4;	//initial value is 5
-	    UINT32       OFDMMCS7FBK:4;	//initial value is 6
-	}	field;
-	UINT32			word;
-}	LG_FBK_CFG0_STRUC, *PLG_FBK_CFG0_STRUC;
-#endif
-#define LG_FBK_CFG1		0x1360
-#ifdef RT_BIG_ENDIAN
-typedef	union	_LG_FBK_CFG1_STRUC	{
-	struct	{
-	    UINT32       rsv:16;
-	    UINT32       CCKMCS3FBK:4;	//initial value is 2
-	    UINT32       CCKMCS2FBK:4;	//initial value is 1
-	    UINT32       CCKMCS1FBK:4;	//initial value is 0
-	    UINT32       CCKMCS0FBK:4;	//initial value is 0
-	}	field;
-	UINT32			word;
-}	LG_FBK_CFG1_STRUC, *PLG_FBK_CFG1_STRUC;
-#else
-typedef	union	_LG_FBK_CFG1_STRUC	{
-	struct	{
-	    UINT32       CCKMCS0FBK:4;	//initial value is 0
-	    UINT32       CCKMCS1FBK:4;	//initial value is 0
-	    UINT32       CCKMCS2FBK:4;	//initial value is 1
-	    UINT32       CCKMCS3FBK:4;	//initial value is 2
-	    UINT32       rsv:16;
-	}	field;
-	UINT32			word;
-}	LG_FBK_CFG1_STRUC, *PLG_FBK_CFG1_STRUC;
-#endif
-
-
-//=======================================================
-//================ Protection Paramater================================
-//=======================================================
-#define CCK_PROT_CFG	0x1364		//CCK Protection
-#define ASIC_SHORTNAV		1
-#define ASIC_LONGNAV		2
-#define ASIC_RTS		1
-#define ASIC_CTS		2
-#ifdef RT_BIG_ENDIAN
-typedef	union	_PROT_CFG_STRUC	{
-	struct	{
-	    UINT32       rsv:5;
-	    UINT32       RTSThEn:1;	//RTS threshold enable on CCK TX
-	    UINT32       TxopAllowGF40:1;	//CCK TXOP allowance.0:disallow.
-	    UINT32       TxopAllowGF20:1;	//CCK TXOP allowance.0:disallow.
-	    UINT32       TxopAllowMM40:1;	//CCK TXOP allowance.0:disallow.
-	    UINT32       TxopAllowMM20:1;	//CCK TXOP allowance. 0:disallow.
-	    UINT32       TxopAllowOfdm:1;	//CCK TXOP allowance.0:disallow.
-	    UINT32       TxopAllowCck:1;	//CCK TXOP allowance.0:disallow.
-	    UINT32       ProtectNav:2;	//TXOP protection type for CCK TX. 0:None, 1:ShortNAVprotect,  2:LongNAVProtect, 3:rsv
-	    UINT32       ProtectCtrl:2;	//Protection control frame type for CCK TX. 1:RTS/CTS, 2:CTS-to-self, 0:None, 3:rsv
-	    UINT32       ProtectRate:16;	//Protection control frame rate for CCK TX(RTS/CTS/CFEnd).
-	}	field;
-	UINT32			word;
-}	PROT_CFG_STRUC, *PPROT_CFG_STRUC;
-#else
-typedef	union	_PROT_CFG_STRUC	{
-	struct	{
-	    UINT32       ProtectRate:16;	//Protection control frame rate for CCK TX(RTS/CTS/CFEnd).
-	    UINT32       ProtectCtrl:2;	//Protection control frame type for CCK TX. 1:RTS/CTS, 2:CTS-to-self, 0:None, 3:rsv
-	    UINT32       ProtectNav:2;	//TXOP protection type for CCK TX. 0:None, 1:ShortNAVprotect,  2:LongNAVProtect, 3:rsv
-	    UINT32       TxopAllowCck:1;	//CCK TXOP allowance.0:disallow.
-	    UINT32       TxopAllowOfdm:1;	//CCK TXOP allowance.0:disallow.
-	    UINT32       TxopAllowMM20:1;	//CCK TXOP allowance. 0:disallow.
-	    UINT32       TxopAllowMM40:1;	//CCK TXOP allowance.0:disallow.
-	    UINT32       TxopAllowGF20:1;	//CCK TXOP allowance.0:disallow.
-	    UINT32       TxopAllowGF40:1;	//CCK TXOP allowance.0:disallow.
-	    UINT32       RTSThEn:1;	//RTS threshold enable on CCK TX
-	    UINT32       rsv:5;
-	}	field;
-	UINT32			word;
-}	PROT_CFG_STRUC, *PPROT_CFG_STRUC;
-#endif
-
-#define OFDM_PROT_CFG	0x1368		//OFDM Protection
-#define MM20_PROT_CFG	0x136C		//MM20 Protection
-#define MM40_PROT_CFG	0x1370		//MM40 Protection
-#define GF20_PROT_CFG	0x1374		//GF20 Protection
-#define GF40_PROT_CFG	0x1378		//GR40 Protection
-#define EXP_CTS_TIME	0x137C		//
-#define EXP_ACK_TIME	0x1380		//
-
-//
-//  4.4 MAC RX configuration registers (offset:0x1400)
-//
-#define RX_FILTR_CFG	0x1400			//TXRX_CSR0
-#define AUTO_RSP_CFG	0x1404			//TXRX_CSR4
-//
-// TXRX_CSR4: Auto-Responder/
-//
-#ifdef RT_BIG_ENDIAN
-typedef union _AUTO_RSP_CFG_STRUC {
- struct {
-     UINT32        :24;
-     UINT32       AckCtsPsmBit:1;   // Power bit value in conrtrol frame
-     UINT32       DualCTSEn:1;   // Power bit value in conrtrol frame
-     UINT32       rsv:1;   // Power bit value in conrtrol frame
-     UINT32       AutoResponderPreamble:1;    // 0:long, 1:short preamble
-     UINT32       CTS40MRef:1;  // Response CTS 40MHz duplicate mode
-     UINT32       CTS40MMode:1;  // Response CTS 40MHz duplicate mode
-     UINT32       BACAckPolicyEnable:1;    // 0:long, 1:short preamble
-     UINT32       AutoResponderEnable:1;
- } field;
- UINT32   word;
-} AUTO_RSP_CFG_STRUC, *PAUTO_RSP_CFG_STRUC;
-#else
-typedef union _AUTO_RSP_CFG_STRUC {
- struct {
-     UINT32       AutoResponderEnable:1;
-     UINT32       BACAckPolicyEnable:1;    // 0:long, 1:short preamble
-     UINT32       CTS40MMode:1;  // Response CTS 40MHz duplicate mode
-     UINT32       CTS40MRef:1;  // Response CTS 40MHz duplicate mode
-     UINT32       AutoResponderPreamble:1;    // 0:long, 1:short preamble
-     UINT32       rsv:1;   // Power bit value in conrtrol frame
-     UINT32       DualCTSEn:1;   // Power bit value in conrtrol frame
-     UINT32       AckCtsPsmBit:1;   // Power bit value in conrtrol frame
-     UINT32        :24;
- } field;
- UINT32   word;
-} AUTO_RSP_CFG_STRUC, *PAUTO_RSP_CFG_STRUC;
-#endif
-
-#define LEGACY_BASIC_RATE	0x1408	//  TXRX_CSR5           0x3054
-#define HT_BASIC_RATE		0x140c
-#define HT_CTRL_CFG		0x1410
-#define SIFS_COST_CFG		0x1414
-#define RX_PARSER_CFG		0x1418	//Set NAV for all received frames
-
-//
-//  4.5 MAC Security configuration (offset:0x1500)
-//
-#define TX_SEC_CNT0		0x1500		//
-#define RX_SEC_CNT0		0x1504		//
-#define CCMP_FC_MUTE		0x1508		//
-//
-//  4.6 HCCA/PSMP (offset:0x1600)
-//
-#define TXOP_HLDR_ADDR0		0x1600
-#define TXOP_HLDR_ADDR1		0x1604
-#define TXOP_HLDR_ET		0x1608
-#define QOS_CFPOLL_RA_DW0		0x160c
-#define QOS_CFPOLL_A1_DW1		0x1610
-#define QOS_CFPOLL_QC		0x1614
-//
-//  4.7 MAC Statistis registers (offset:0x1700)
-//
-#define RX_STA_CNT0		0x1700		//
-#define RX_STA_CNT1		0x1704		//
-#define RX_STA_CNT2		0x1708		//
-
-//
-// RX_STA_CNT0_STRUC: RX PLCP error count & RX CRC error count
-//
-#ifdef RT_BIG_ENDIAN
-typedef	union	_RX_STA_CNT0_STRUC	{
-	struct	{
-	    USHORT  PhyErr;
-	    USHORT  CrcErr;
-	}	field;
-	UINT32			word;
-}	RX_STA_CNT0_STRUC, *PRX_STA_CNT0_STRUC;
-#else
-typedef	union	_RX_STA_CNT0_STRUC	{
-	struct	{
-	    USHORT  CrcErr;
-	    USHORT  PhyErr;
-	}	field;
-	UINT32			word;
-}	RX_STA_CNT0_STRUC, *PRX_STA_CNT0_STRUC;
-#endif
-
-//
-// RX_STA_CNT1_STRUC: RX False CCA count & RX LONG frame count
-//
-#ifdef RT_BIG_ENDIAN
-typedef	union	_RX_STA_CNT1_STRUC	{
-	struct	{
-	    USHORT  PlcpErr;
-	    USHORT  FalseCca;
-	}	field;
-	UINT32			word;
-}	RX_STA_CNT1_STRUC, *PRX_STA_CNT1_STRUC;
-#else
-typedef	union	_RX_STA_CNT1_STRUC	{
-	struct	{
-	    USHORT  FalseCca;
-	    USHORT  PlcpErr;
-	}	field;
-	UINT32			word;
-}	RX_STA_CNT1_STRUC, *PRX_STA_CNT1_STRUC;
-#endif
-
-//
-// RX_STA_CNT2_STRUC:
-//
-#ifdef RT_BIG_ENDIAN
-typedef	union	_RX_STA_CNT2_STRUC	{
-	struct	{
-	    USHORT  RxFifoOverflowCount;
-	    USHORT  RxDupliCount;
-	}	field;
-	UINT32			word;
-}	RX_STA_CNT2_STRUC, *PRX_STA_CNT2_STRUC;
-#else
-typedef	union	_RX_STA_CNT2_STRUC	{
-	struct	{
-	    USHORT  RxDupliCount;
-	    USHORT  RxFifoOverflowCount;
-	}	field;
-	UINT32			word;
-}	RX_STA_CNT2_STRUC, *PRX_STA_CNT2_STRUC;
-#endif
-#define TX_STA_CNT0		0x170C		//
-//
-// STA_CSR3: TX Beacon count
-//
-#ifdef RT_BIG_ENDIAN
-typedef	union	_TX_STA_CNT0_STRUC	{
-	struct	{
-	    USHORT  TxBeaconCount;
-	    USHORT  TxFailCount;
-	}	field;
-	UINT32			word;
-}	TX_STA_CNT0_STRUC, *PTX_STA_CNT0_STRUC;
-#else
-typedef	union	_TX_STA_CNT0_STRUC	{
-	struct	{
-	    USHORT  TxFailCount;
-	    USHORT  TxBeaconCount;
-	}	field;
-	UINT32			word;
-}	TX_STA_CNT0_STRUC, *PTX_STA_CNT0_STRUC;
-#endif
-#define TX_STA_CNT1		0x1710		//
-//
-// TX_STA_CNT1: TX tx count
-//
-#ifdef RT_BIG_ENDIAN
-typedef	union	_TX_STA_CNT1_STRUC	{
-	struct	{
-	    USHORT  TxRetransmit;
-	    USHORT  TxSuccess;
-	}	field;
-	UINT32			word;
-}	TX_STA_CNT1_STRUC, *PTX_STA_CNT1_STRUC;
-#else
-typedef	union	_TX_STA_CNT1_STRUC	{
-	struct	{
-	    USHORT  TxSuccess;
-	    USHORT  TxRetransmit;
-	}	field;
-	UINT32			word;
-}	TX_STA_CNT1_STRUC, *PTX_STA_CNT1_STRUC;
-#endif
-#define TX_STA_CNT2		0x1714		//
-//
-// TX_STA_CNT2: TX tx count
-//
-#ifdef RT_BIG_ENDIAN
-typedef	union	_TX_STA_CNT2_STRUC	{
-	struct	{
-	    USHORT  TxUnderFlowCount;
-	    USHORT  TxZeroLenCount;
-	}	field;
-	UINT32			word;
-}	TX_STA_CNT2_STRUC, *PTX_STA_CNT2_STRUC;
-#else
-typedef	union	_TX_STA_CNT2_STRUC	{
-	struct	{
-	    USHORT  TxZeroLenCount;
-	    USHORT  TxUnderFlowCount;
-	}	field;
-	UINT32			word;
-}	TX_STA_CNT2_STRUC, *PTX_STA_CNT2_STRUC;
-#endif
-#define TX_STA_FIFO		0x1718		//
-//
-// TX_STA_FIFO_STRUC: TX Result for specific PID status fifo register
-//
-#ifdef RT_BIG_ENDIAN
-typedef	union PACKED _TX_STA_FIFO_STRUC	{
-	struct	{
-		UINT32		Reserve:2;
-		UINT32		TxBF:1; // 3*3
-		UINT32		SuccessRate:13;	//include MCS, mode ,shortGI, BW settingSame format as TXWI Word 0 Bit 31-16.
-//		UINT32		SuccessRate:16;	//include MCS, mode ,shortGI, BW settingSame format as TXWI Word 0 Bit 31-16.
-		UINT32		wcid:8;		//wireless client index
-		UINT32		TxAckRequired:1;    // ack required
-		UINT32		TxAggre:1;    // Tx is aggregated
-		UINT32		TxSuccess:1;   // Tx success. whether success or not
-		UINT32		PidType:4;
-		UINT32		bValid:1;   // 1:This register contains a valid TX result
-	}	field;
-	UINT32			word;
-}	TX_STA_FIFO_STRUC, *PTX_STA_FIFO_STRUC;
-#else
-typedef	union PACKED _TX_STA_FIFO_STRUC	{
-	struct	{
-		UINT32		bValid:1;   // 1:This register contains a valid TX result
-		UINT32		PidType:4;
-		UINT32		TxSuccess:1;   // Tx No retry success
-		UINT32		TxAggre:1;    // Tx Retry Success
-		UINT32		TxAckRequired:1;    // Tx fail
-		UINT32		wcid:8;		//wireless client index
-//		UINT32		SuccessRate:16;	//include MCS, mode ,shortGI, BW settingSame format as TXWI Word 0 Bit 31-16.
-		UINT32		SuccessRate:13;	//include MCS, mode ,shortGI, BW settingSame format as TXWI Word 0 Bit 31-16.
-		UINT32		TxBF:1;
-		UINT32		Reserve:2;
-	}	field;
-	UINT32			word;
-}	TX_STA_FIFO_STRUC, *PTX_STA_FIFO_STRUC;
-#endif
-// Debug counter
-#define TX_AGG_CNT	0x171c
-#ifdef RT_BIG_ENDIAN
-typedef	union	_TX_AGG_CNT_STRUC	{
-	struct	{
-	    USHORT  AggTxCount;
-	    USHORT  NonAggTxCount;
-	}	field;
-	UINT32			word;
-}	TX_AGG_CNT_STRUC, *PTX_AGG_CNT_STRUC;
-#else
-typedef	union	_TX_AGG_CNT_STRUC	{
-	struct	{
-	    USHORT  NonAggTxCount;
-	    USHORT  AggTxCount;
-	}	field;
-	UINT32			word;
-}	TX_AGG_CNT_STRUC, *PTX_AGG_CNT_STRUC;
-#endif
-// Debug counter
-#define TX_AGG_CNT0	0x1720
-#ifdef RT_BIG_ENDIAN
-typedef	union	_TX_AGG_CNT0_STRUC	{
-	struct	{
-	    USHORT  AggSize2Count;
-	    USHORT  AggSize1Count;
-	}	field;
-	UINT32			word;
-}	TX_AGG_CNT0_STRUC, *PTX_AGG_CNT0_STRUC;
-#else
-typedef	union	_TX_AGG_CNT0_STRUC	{
-	struct	{
-	    USHORT  AggSize1Count;
-	    USHORT  AggSize2Count;
-	}	field;
-	UINT32			word;
-}	TX_AGG_CNT0_STRUC, *PTX_AGG_CNT0_STRUC;
-#endif
-// Debug counter
-#define TX_AGG_CNT1	0x1724
-#ifdef RT_BIG_ENDIAN
-typedef	union	_TX_AGG_CNT1_STRUC	{
-	struct	{
-	    USHORT  AggSize4Count;
-	    USHORT  AggSize3Count;
-	}	field;
-	UINT32			word;
-}	TX_AGG_CNT1_STRUC, *PTX_AGG_CNT1_STRUC;
-#else
-typedef	union	_TX_AGG_CNT1_STRUC	{
-	struct	{
-	    USHORT  AggSize3Count;
-	    USHORT  AggSize4Count;
-	}	field;
-	UINT32			word;
-}	TX_AGG_CNT1_STRUC, *PTX_AGG_CNT1_STRUC;
-#endif
-#define TX_AGG_CNT2	0x1728
-#ifdef RT_BIG_ENDIAN
-typedef	union	_TX_AGG_CNT2_STRUC	{
-	struct	{
-	    USHORT  AggSize6Count;
-	    USHORT  AggSize5Count;
-	}	field;
-	UINT32			word;
-}	TX_AGG_CNT2_STRUC, *PTX_AGG_CNT2_STRUC;
-#else
-typedef	union	_TX_AGG_CNT2_STRUC	{
-	struct	{
-	    USHORT  AggSize5Count;
-	    USHORT  AggSize6Count;
-	}	field;
-	UINT32			word;
-}	TX_AGG_CNT2_STRUC, *PTX_AGG_CNT2_STRUC;
-#endif
-// Debug counter
-#define TX_AGG_CNT3	0x172c
-#ifdef RT_BIG_ENDIAN
-typedef	union	_TX_AGG_CNT3_STRUC	{
-	struct	{
-	    USHORT  AggSize8Count;
-	    USHORT  AggSize7Count;
-	}	field;
-	UINT32			word;
-}	TX_AGG_CNT3_STRUC, *PTX_AGG_CNT3_STRUC;
-#else
-typedef	union	_TX_AGG_CNT3_STRUC	{
-	struct	{
-	    USHORT  AggSize7Count;
-	    USHORT  AggSize8Count;
-	}	field;
-	UINT32			word;
-}	TX_AGG_CNT3_STRUC, *PTX_AGG_CNT3_STRUC;
-#endif
-// Debug counter
-#define TX_AGG_CNT4	0x1730
-#ifdef RT_BIG_ENDIAN
-typedef	union	_TX_AGG_CNT4_STRUC	{
-	struct	{
-	    USHORT  AggSize10Count;
-	    USHORT  AggSize9Count;
-	}	field;
-	UINT32			word;
-}	TX_AGG_CNT4_STRUC, *PTX_AGG_CNT4_STRUC;
-#else
-typedef	union	_TX_AGG_CNT4_STRUC	{
-	struct	{
-	    USHORT  AggSize9Count;
-	    USHORT  AggSize10Count;
-	}	field;
-	UINT32			word;
-}	TX_AGG_CNT4_STRUC, *PTX_AGG_CNT4_STRUC;
-#endif
-#define TX_AGG_CNT5	0x1734
-#ifdef RT_BIG_ENDIAN
-typedef	union	_TX_AGG_CNT5_STRUC	{
-	struct	{
-	    USHORT  AggSize12Count;
-	    USHORT  AggSize11Count;
-	}	field;
-	UINT32			word;
-}	TX_AGG_CNT5_STRUC, *PTX_AGG_CNT5_STRUC;
-#else
-typedef	union	_TX_AGG_CNT5_STRUC	{
-	struct	{
-	    USHORT  AggSize11Count;
-	    USHORT  AggSize12Count;
-	}	field;
-	UINT32			word;
-}	TX_AGG_CNT5_STRUC, *PTX_AGG_CNT5_STRUC;
-#endif
-#define TX_AGG_CNT6		0x1738
-#ifdef RT_BIG_ENDIAN
-typedef	union	_TX_AGG_CNT6_STRUC	{
-	struct	{
-	    USHORT  AggSize14Count;
-	    USHORT  AggSize13Count;
-	}	field;
-	UINT32			word;
-}	TX_AGG_CNT6_STRUC, *PTX_AGG_CNT6_STRUC;
-#else
-typedef	union	_TX_AGG_CNT6_STRUC	{
-	struct	{
-	    USHORT  AggSize13Count;
-	    USHORT  AggSize14Count;
-	}	field;
-	UINT32			word;
-}	TX_AGG_CNT6_STRUC, *PTX_AGG_CNT6_STRUC;
-#endif
-#define TX_AGG_CNT7		0x173c
-#ifdef RT_BIG_ENDIAN
-typedef	union	_TX_AGG_CNT7_STRUC	{
-	struct	{
-	    USHORT  AggSize16Count;
-	    USHORT  AggSize15Count;
-	}	field;
-	UINT32			word;
-}	TX_AGG_CNT7_STRUC, *PTX_AGG_CNT7_STRUC;
-#else
-typedef	union	_TX_AGG_CNT7_STRUC	{
-	struct	{
-	    USHORT  AggSize15Count;
-	    USHORT  AggSize16Count;
-	}	field;
-	UINT32			word;
-}	TX_AGG_CNT7_STRUC, *PTX_AGG_CNT7_STRUC;
-#endif
-#define MPDU_DENSITY_CNT		0x1740
-#ifdef RT_BIG_ENDIAN
-typedef	union	_MPDU_DEN_CNT_STRUC	{
-	struct	{
-	    USHORT  RXZeroDelCount;	//RX zero length delimiter count
-	    USHORT  TXZeroDelCount;	//TX zero length delimiter count
-	}	field;
-	UINT32			word;
-}	MPDU_DEN_CNT_STRUC, *PMPDU_DEN_CNT_STRUC;
-#else
-typedef	union	_MPDU_DEN_CNT_STRUC	{
-	struct	{
-	    USHORT  TXZeroDelCount;	//TX zero length delimiter count
-	    USHORT  RXZeroDelCount;	//RX zero length delimiter count
-	}	field;
-	UINT32			word;
-}	MPDU_DEN_CNT_STRUC, *PMPDU_DEN_CNT_STRUC;
-#endif
-//
-// TXRX control registers - base address 0x3000
-//
-// rt2860b  UNKNOWN reg use R/O Reg Addr 0x77d0 first..
-#define TXRX_CSR1           0x77d0
-
-//
-// Security key table memory, base address = 0x1000
-//
-#define MAC_WCID_BASE		0x1800 //8-bytes(use only 6-bytes) * 256 entry =
-#define HW_WCID_ENTRY_SIZE   8
-#define PAIRWISE_KEY_TABLE_BASE     0x4000      // 32-byte * 256-entry =  -byte
-#define HW_KEY_ENTRY_SIZE           0x20
-#define PAIRWISE_IVEIV_TABLE_BASE     0x6000      // 8-byte * 256-entry =  -byte
-#define MAC_IVEIV_TABLE_BASE     0x6000      // 8-byte * 256-entry =  -byte
-#define HW_IVEIV_ENTRY_SIZE   8
-#define MAC_WCID_ATTRIBUTE_BASE     0x6800      // 4-byte * 256-entry =  -byte
-#define HW_WCID_ATTRI_SIZE   4
-#define WCID_RESERVED			0x6bfc
-#define SHARED_KEY_TABLE_BASE       0x6c00      // 32-byte * 16-entry = 512-byte
-#define SHARED_KEY_MODE_BASE       0x7000      // 32-byte * 16-entry = 512-byte
-#define HW_SHARED_KEY_MODE_SIZE   4
-#define SHAREDKEYTABLE			0
-#define PAIRWISEKEYTABLE			1
-
-
-#ifdef RT_BIG_ENDIAN
-typedef	union	_SHAREDKEY_MODE_STRUC	{
-	struct	{
-		UINT32       :1;
-		UINT32       Bss1Key3CipherAlg:3;
-		UINT32       :1;
-		UINT32       Bss1Key2CipherAlg:3;
-		UINT32       :1;
-		UINT32       Bss1Key1CipherAlg:3;
-		UINT32       :1;
-		UINT32       Bss1Key0CipherAlg:3;
-		UINT32       :1;
-		UINT32       Bss0Key3CipherAlg:3;
-		UINT32       :1;
-		UINT32       Bss0Key2CipherAlg:3;
-		UINT32       :1;
-		UINT32       Bss0Key1CipherAlg:3;
-		UINT32       :1;
-		UINT32       Bss0Key0CipherAlg:3;
-	}	field;
-	UINT32			word;
-}	SHAREDKEY_MODE_STRUC, *PSHAREDKEY_MODE_STRUC;
-#else
-typedef	union	_SHAREDKEY_MODE_STRUC	{
-	struct	{
-		UINT32       Bss0Key0CipherAlg:3;
-		UINT32       :1;
-		UINT32       Bss0Key1CipherAlg:3;
-		UINT32       :1;
-		UINT32       Bss0Key2CipherAlg:3;
-		UINT32       :1;
-		UINT32       Bss0Key3CipherAlg:3;
-		UINT32       :1;
-		UINT32       Bss1Key0CipherAlg:3;
-		UINT32       :1;
-		UINT32       Bss1Key1CipherAlg:3;
-		UINT32       :1;
-		UINT32       Bss1Key2CipherAlg:3;
-		UINT32       :1;
-		UINT32       Bss1Key3CipherAlg:3;
-		UINT32       :1;
-	}	field;
-	UINT32			word;
-}	SHAREDKEY_MODE_STRUC, *PSHAREDKEY_MODE_STRUC;
-#endif
-// 64-entry for pairwise key table
-typedef struct _HW_WCID_ENTRY {  // 8-byte per entry
-    UCHAR   Address[6];
-    UCHAR   Rsv[2];
-} HW_WCID_ENTRY, PHW_WCID_ENTRY;
-
-
-// =================================================================================
-// WCID  format
-// =================================================================================
-//7.1	WCID  ENTRY  format  : 8bytes
-typedef	struct	_WCID_ENTRY_STRUC {
-	UCHAR		RXBABitmap7;    // bit0 for TID8, bit7 for TID 15
-	UCHAR		RXBABitmap0;    // bit0 for TID0, bit7 for TID 7
-	UCHAR		MAC[6];	// 0 for shared key table.  1 for pairwise key table
-}	WCID_ENTRY_STRUC, *PWCID_ENTRY_STRUC;
-
-//8.1.1	SECURITY  KEY  format  : 8DW
-// 32-byte per entry, total 16-entry for shared key table, 64-entry for pairwise key table
-typedef struct _HW_KEY_ENTRY {          // 32-byte per entry
-    UCHAR   Key[16];
-    UCHAR   TxMic[8];
-    UCHAR   RxMic[8];
-} HW_KEY_ENTRY, *PHW_KEY_ENTRY;
-
-//8.1.2	IV/EIV  format  : 2DW
-
-//8.1.3	RX attribute entry format  : 1DW
-#ifdef RT_BIG_ENDIAN
-typedef	struct	_MAC_ATTRIBUTE_STRUC {
-	UINT32		rsv:22;
-	UINT32		RXWIUDF:3;
-	UINT32		BSSIDIdx:3; //multipleBSS index for the WCID
-	UINT32		PairKeyMode:3;
-	UINT32		KeyTab:1;	// 0 for shared key table.  1 for pairwise key table
-}	MAC_ATTRIBUTE_STRUC, *PMAC_ATTRIBUTE_STRUC;
-#else
-typedef	struct	_MAC_ATTRIBUTE_STRUC {
-	UINT32		KeyTab:1;	// 0 for shared key table.  1 for pairwise key table
-	UINT32		PairKeyMode:3;
-	UINT32		BSSIDIdx:3; //multipleBSS index for the WCID
-	UINT32		RXWIUDF:3;
-	UINT32		rsv:22;
-}	MAC_ATTRIBUTE_STRUC, *PMAC_ATTRIBUTE_STRUC;
-#endif
-
-
-// =================================================================================
-// HOST-MCU communication data structure
-// =================================================================================
-
-//
-// H2M_MAILBOX_CSR: Host-to-MCU Mailbox
-//
-#ifdef RT_BIG_ENDIAN
-typedef union  _H2M_MAILBOX_STRUC {
-    struct {
-        UINT32       Owner:8;
-        UINT32       CmdToken:8;    // 0xff tells MCU not to report CmdDoneInt after excuting the command
-        UINT32       HighByte:8;
-        UINT32       LowByte:8;
-    }   field;
-    UINT32           word;
-} H2M_MAILBOX_STRUC, *PH2M_MAILBOX_STRUC;
-#else
-typedef union  _H2M_MAILBOX_STRUC {
-    struct {
-        UINT32       LowByte:8;
-        UINT32       HighByte:8;
-        UINT32       CmdToken:8;
-        UINT32       Owner:8;
-    }   field;
-    UINT32           word;
-} H2M_MAILBOX_STRUC, *PH2M_MAILBOX_STRUC;
-#endif
-
-//
-// M2H_CMD_DONE_CSR: MCU-to-Host command complete indication
-//
-#ifdef RT_BIG_ENDIAN
-typedef union _M2H_CMD_DONE_STRUC {
-    struct  {
-        UINT32       CmdToken3;
-        UINT32       CmdToken2;
-        UINT32       CmdToken1;
-        UINT32       CmdToken0;
-    } field;
-    UINT32           word;
-} M2H_CMD_DONE_STRUC, *PM2H_CMD_DONE_STRUC;
-#else
-typedef union _M2H_CMD_DONE_STRUC {
-    struct  {
-        UINT32       CmdToken0;
-        UINT32       CmdToken1;
-        UINT32       CmdToken2;
-        UINT32       CmdToken3;
-    } field;
-    UINT32           word;
-} M2H_CMD_DONE_STRUC, *PM2H_CMD_DONE_STRUC;
-#endif
-
-
-//NAV_TIME_CFG :NAV
-#ifdef RT_BIG_ENDIAN
-typedef	union	_NAV_TIME_CFG_STRUC	{
-	struct	{
-		USHORT		rsv:6;
-		USHORT		ZeroSifs:1;               // Applied zero SIFS timer after OFDM RX 0: disable
-		USHORT		Eifs:9;               // in unit of 1-us
-		UCHAR       SlotTime;    // in unit of 1-us
-		UCHAR		Sifs;               // in unit of 1-us
-	}	field;
-	UINT32			word;
-}	NAV_TIME_CFG_STRUC, *PNAV_TIME_CFG_STRUC;
-#else
-typedef	union	_NAV_TIME_CFG_STRUC	{
-	struct	{
-		UCHAR		Sifs;               // in unit of 1-us
-		UCHAR       SlotTime;    // in unit of 1-us
-		USHORT		Eifs:9;               // in unit of 1-us
-		USHORT		ZeroSifs:1;               // Applied zero SIFS timer after OFDM RX 0: disable
-		USHORT		rsv:6;
-	}	field;
-	UINT32			word;
-}	NAV_TIME_CFG_STRUC, *PNAV_TIME_CFG_STRUC;
-#endif
-
-
-//
-// RX_FILTR_CFG:  /RX configuration register
-//
-#ifdef RT_BIG_ENDIAN
-typedef	union	RX_FILTR_CFG_STRUC	{
-	struct	{
-		UINT32		:15;
-		UINT32       DropRsvCntlType:1;
-
-		UINT32		DropBAR:1;       //
-		UINT32		DropBA:1;		//
-		UINT32		DropPsPoll:1;		// Drop Ps-Poll
-		UINT32		DropRts:1;		// Drop Ps-Poll
-
-		UINT32		DropCts:1;		// Drop Ps-Poll
-		UINT32		DropAck:1;		// Drop Ps-Poll
-		UINT32		DropCFEnd:1;		// Drop Ps-Poll
-		UINT32		DropCFEndAck:1;		// Drop Ps-Poll
-
-		UINT32		DropDuplicate:1;		// Drop duplicate frame
-		UINT32		DropBcast:1;		// Drop broadcast frames
-		UINT32		DropMcast:1;		// Drop multicast frames
-		UINT32		DropVerErr:1;	    // Drop version error frame
-
-		UINT32		DropNotMyBSSID:1;			// Drop fram ToDs bit is true
-		UINT32		DropNotToMe:1;		// Drop not to me unicast frame
-		UINT32		DropPhyErr:1;		// Drop physical error
-		UINT32		DropCRCErr:1;		// Drop CRC error
-	}	field;
-	UINT32			word;
-}	RX_FILTR_CFG_STRUC, *PRX_FILTR_CFG_STRUC;
-#else
-typedef	union	_RX_FILTR_CFG_STRUC	{
-	struct	{
-		UINT32		DropCRCErr:1;		// Drop CRC error
-		UINT32		DropPhyErr:1;		// Drop physical error
-		UINT32		DropNotToMe:1;		// Drop not to me unicast frame
-		UINT32		DropNotMyBSSID:1;			// Drop fram ToDs bit is true
-
-		UINT32		DropVerErr:1;	    // Drop version error frame
-		UINT32		DropMcast:1;		// Drop multicast frames
-		UINT32		DropBcast:1;		// Drop broadcast frames
-		UINT32		DropDuplicate:1;		// Drop duplicate frame
-
-		UINT32		DropCFEndAck:1;		// Drop Ps-Poll
-		UINT32		DropCFEnd:1;		// Drop Ps-Poll
-		UINT32		DropAck:1;		// Drop Ps-Poll
-		UINT32		DropCts:1;		// Drop Ps-Poll
-
-		UINT32		DropRts:1;		// Drop Ps-Poll
-		UINT32		DropPsPoll:1;		// Drop Ps-Poll
-		UINT32		DropBA:1;		//
-		UINT32		DropBAR:1;       //
-
-		UINT32		DropRsvCntlType:1;
-		UINT32		:15;
-	}	field;
-	UINT32			word;
-}	RX_FILTR_CFG_STRUC, *PRX_FILTR_CFG_STRUC;
-#endif
-
-
-
-
-//
-// PHY_CSR4: RF serial control register
-//
-#ifdef RT_BIG_ENDIAN
-typedef	union	_PHY_CSR4_STRUC	{
-	struct	{
-		UINT32		Busy:1;				// 1: ASIC is busy execute RF programming.
-		UINT32		PLL_LD:1;			// RF PLL_LD status
-		UINT32		IFSelect:1;			// 1: select IF	to program,	0: select RF to	program
-		UINT32		NumberOfBits:5;		// Number of bits used in RFRegValue (I:20,	RFMD:22)
-		UINT32		RFRegValue:24;		// Register	value (include register	id)	serial out to RF/IF	chip.
-	}	field;
-	UINT32			word;
-}	PHY_CSR4_STRUC, *PPHY_CSR4_STRUC;
-#else
-typedef	union	_PHY_CSR4_STRUC	{
-	struct	{
-		UINT32		RFRegValue:24;		// Register	value (include register	id)	serial out to RF/IF	chip.
-		UINT32		NumberOfBits:5;		// Number of bits used in RFRegValue (I:20,	RFMD:22)
-		UINT32		IFSelect:1;			// 1: select IF	to program,	0: select RF to	program
-		UINT32		PLL_LD:1;			// RF PLL_LD status
-		UINT32		Busy:1;				// 1: ASIC is busy execute RF programming.
-	}	field;
-	UINT32			word;
-}	PHY_CSR4_STRUC, *PPHY_CSR4_STRUC;
-#endif
-
-
-//
-// SEC_CSR5: shared key table security mode register
-//
-#ifdef RT_BIG_ENDIAN
-typedef	union	_SEC_CSR5_STRUC	{
-	struct	{
-        UINT32       :1;
-        UINT32       Bss3Key3CipherAlg:3;
-        UINT32       :1;
-        UINT32       Bss3Key2CipherAlg:3;
-        UINT32       :1;
-        UINT32       Bss3Key1CipherAlg:3;
-        UINT32       :1;
-        UINT32       Bss3Key0CipherAlg:3;
-        UINT32       :1;
-        UINT32       Bss2Key3CipherAlg:3;
-        UINT32       :1;
-        UINT32       Bss2Key2CipherAlg:3;
-        UINT32       :1;
-        UINT32       Bss2Key1CipherAlg:3;
-        UINT32       :1;
-        UINT32       Bss2Key0CipherAlg:3;
-	}	field;
-	UINT32			word;
-}	SEC_CSR5_STRUC, *PSEC_CSR5_STRUC;
-#else
-typedef	union	_SEC_CSR5_STRUC	{
-	struct	{
-        UINT32       Bss2Key0CipherAlg:3;
-        UINT32       :1;
-        UINT32       Bss2Key1CipherAlg:3;
-        UINT32       :1;
-        UINT32       Bss2Key2CipherAlg:3;
-        UINT32       :1;
-        UINT32       Bss2Key3CipherAlg:3;
-        UINT32       :1;
-        UINT32       Bss3Key0CipherAlg:3;
-        UINT32       :1;
-        UINT32       Bss3Key1CipherAlg:3;
-        UINT32       :1;
-        UINT32       Bss3Key2CipherAlg:3;
-        UINT32       :1;
-        UINT32       Bss3Key3CipherAlg:3;
-        UINT32       :1;
-	}	field;
-	UINT32			word;
-}	SEC_CSR5_STRUC, *PSEC_CSR5_STRUC;
-#endif
-
-
-//
-// HOST_CMD_CSR: For HOST to interrupt embedded processor
-//
-#ifdef RT_BIG_ENDIAN
-typedef	union	_HOST_CMD_CSR_STRUC	{
-	struct	{
-	    UINT32   Rsv:24;
-	    UINT32   HostCommand:8;
-	}	field;
-	UINT32			word;
-}	HOST_CMD_CSR_STRUC, *PHOST_CMD_CSR_STRUC;
-#else
-typedef	union	_HOST_CMD_CSR_STRUC	{
-	struct	{
-	    UINT32   HostCommand:8;
-	    UINT32   Rsv:24;
-	}	field;
-	UINT32			word;
-}	HOST_CMD_CSR_STRUC, *PHOST_CMD_CSR_STRUC;
-#endif
-
-
-//
-// AIFSN_CSR: AIFSN for each EDCA AC
-//
-
-
-
-//
-// E2PROM_CSR: EEPROM control register
-//
-#ifdef RT_BIG_ENDIAN
-typedef	union	_E2PROM_CSR_STRUC	{
-	struct	{
-		UINT32		Rsvd:25;
-		UINT32       LoadStatus:1;   // 1:loading, 0:done
-		UINT32		Type:1;			// 1: 93C46, 0:93C66
-		UINT32		EepromDO:1;
-		UINT32		EepromDI:1;
-		UINT32		EepromCS:1;
-		UINT32		EepromSK:1;
-		UINT32		Reload:1;		// Reload EEPROM content, write one to reload, self-cleared.
-	}	field;
-	UINT32			word;
-}	E2PROM_CSR_STRUC, *PE2PROM_CSR_STRUC;
-#else
-typedef	union	_E2PROM_CSR_STRUC	{
-	struct	{
-		UINT32		Reload:1;		// Reload EEPROM content, write one to reload, self-cleared.
-		UINT32		EepromSK:1;
-		UINT32		EepromCS:1;
-		UINT32		EepromDI:1;
-		UINT32		EepromDO:1;
-		UINT32		Type:1;			// 1: 93C46, 0:93C66
-		UINT32       LoadStatus:1;   // 1:loading, 0:done
-		UINT32		Rsvd:25;
-	}	field;
-	UINT32			word;
-}	E2PROM_CSR_STRUC, *PE2PROM_CSR_STRUC;
-#endif
-
-//
-// QOS_CSR0: TXOP holder address0 register
-//
-#ifdef RT_BIG_ENDIAN
-typedef	union	_QOS_CSR0_STRUC	{
-	struct	{
-		UCHAR		Byte3;		// MAC address byte 3
-		UCHAR		Byte2;		// MAC address byte 2
-		UCHAR		Byte1;		// MAC address byte 1
-		UCHAR		Byte0;		// MAC address byte 0
-	}	field;
-	UINT32			word;
-}	QOS_CSR0_STRUC, *PQOS_CSR0_STRUC;
-#else
-typedef	union	_QOS_CSR0_STRUC	{
-	struct	{
-		UCHAR		Byte0;		// MAC address byte 0
-		UCHAR		Byte1;		// MAC address byte 1
-		UCHAR		Byte2;		// MAC address byte 2
-		UCHAR		Byte3;		// MAC address byte 3
-	}	field;
-	UINT32			word;
-}	QOS_CSR0_STRUC, *PQOS_CSR0_STRUC;
-#endif
-
-//
-// QOS_CSR1: TXOP holder address1 register
-//
-#ifdef RT_BIG_ENDIAN
-typedef	union	_QOS_CSR1_STRUC	{
-	struct	{
-		UCHAR		Rsvd1;
-		UCHAR		Rsvd0;
-		UCHAR		Byte5;		// MAC address byte 5
-		UCHAR		Byte4;		// MAC address byte 4
-	}	field;
-	UINT32			word;
-}	QOS_CSR1_STRUC, *PQOS_CSR1_STRUC;
-#else
-typedef	union	_QOS_CSR1_STRUC	{
-	struct	{
-		UCHAR		Byte4;		// MAC address byte 4
-		UCHAR		Byte5;		// MAC address byte 5
-		UCHAR		Rsvd0;
-		UCHAR		Rsvd1;
-	}	field;
-	UINT32			word;
-}	QOS_CSR1_STRUC, *PQOS_CSR1_STRUC;
-#endif
-
-#define	RF_CSR_CFG	0x500
-#ifdef RT_BIG_ENDIAN
-typedef	union	_RF_CSR_CFG_STRUC	{
-	struct	{
-		UINT	Rsvd1:14;				// Reserved
-		UINT	RF_CSR_KICK:1;			// kick RF register read/write
-		UINT	RF_CSR_WR:1;			// 0: read  1: write
-		UINT	Rsvd2:3;				// Reserved
-		UINT	TESTCSR_RFACC_REGNUM:5;	// RF register ID
-		UINT	RF_CSR_DATA:8;			// DATA
-	}	field;
-	UINT	word;
-}	RF_CSR_CFG_STRUC, *PRF_CSR_CFG_STRUC;
-#else
-typedef	union	_RF_CSR_CFG_STRUC	{
-	struct	{
-		UINT	RF_CSR_DATA:8;			// DATA
-		UINT	TESTCSR_RFACC_REGNUM:5;	// RF register ID
-		UINT	Rsvd2:3;				// Reserved
-		UINT	RF_CSR_WR:1;			// 0: read  1: write
-		UINT	RF_CSR_KICK:1;			// kick RF register read/write
-		UINT	Rsvd1:14;				// Reserved
-	}	field;
-	UINT	word;
-}	RF_CSR_CFG_STRUC, *PRF_CSR_CFG_STRUC;
-#endif
-
-
-//
-// Other on-chip shared memory space, base = 0x2000
-//
-
-// CIS space - base address = 0x2000
-#define HW_CIS_BASE             0x2000
-
-// Carrier-sense CTS frame base address. It's where mac stores carrier-sense frame for carrier-sense function.
-#define HW_CS_CTS_BASE			0x7700
-// DFS CTS frame base address. It's where mac stores CTS frame for DFS.
-#define HW_DFS_CTS_BASE			0x7780
-#define HW_CTS_FRAME_SIZE		0x80
-
-// 2004-11-08 john - since NULL frame won't be that long (256 byte). We steal 16 tail bytes
-// to save debugging settings
-#define HW_DEBUG_SETTING_BASE   0x77f0  // 0x77f0~0x77ff total 16 bytes
-#define HW_DEBUG_SETTING_BASE2   0x7770  // 0x77f0~0x77ff total 16 bytes
-
-// In order to support maximum 8 MBSS and its maximum length is 512 for each beacon
-// Three section discontinue memory segments will be used.
-// 1. The original region for BCN 0~3
-// 2. Extract memory from FCE table for BCN 4~5
-// 3. Extract memory from Pair-wise key table for BCN 6~7
-//	  It occupied those memory of wcid 238~253 for BCN 6
-//						      and wcid 222~237 for BCN 7
-#define HW_BEACON_MAX_SIZE      0x1000 /* unit: byte */
-#define HW_BEACON_BASE0         0x7800
-#define HW_BEACON_BASE1         0x7A00
-#define HW_BEACON_BASE2         0x7C00
-#define HW_BEACON_BASE3         0x7E00
-#define HW_BEACON_BASE4         0x7200
-#define HW_BEACON_BASE5         0x7400
-#define HW_BEACON_BASE6         0x5DC0
-#define HW_BEACON_BASE7         0x5BC0
-
-#define HW_BEACON_MAX_COUNT     8
-#define HW_BEACON_OFFSET		0x0200
-#define HW_BEACON_CONTENT_LEN	(HW_BEACON_OFFSET - TXWI_SIZE)
-
-// HOST-MCU shared memory - base address = 0x2100
-#define HOST_CMD_CSR		0x404
-#define H2M_MAILBOX_CSR         0x7010
-#define H2M_MAILBOX_CID         0x7014
-#define H2M_MAILBOX_STATUS      0x701c
-#define H2M_INT_SRC             0x7024
-#define H2M_BBP_AGENT           0x7028
-#define M2H_CMD_DONE_CSR        0x000c
-#define MCU_TXOP_ARRAY_BASE     0x000c   // TODO: to be provided by Albert
-#define MCU_TXOP_ENTRY_SIZE     32       // TODO: to be provided by Albert
-#define MAX_NUM_OF_TXOP_ENTRY   16       // TODO: must be same with 8051 firmware
-#define MCU_MBOX_VERSION        0x01     // TODO: to be confirmed by Albert
-#define MCU_MBOX_VERSION_OFFSET 5        // TODO: to be provided by Albert
-
-//
-// Host DMA registers - base address 0x200 .  TX0-3=EDCAQid0-3, TX4=HCCA, TX5=MGMT,
-//
-//
-//  DMA RING DESCRIPTOR
-//
-#define E2PROM_CSR          0x0004
-#define IO_CNTL_CSR         0x77d0
-
-
-
-// ================================================================
-// Tx /	Rx / Mgmt ring descriptor definition
-// ================================================================
-
-// the following PID values are used to mark outgoing frame type in TXD->PID so that
-// proper TX statistics can be collected based on these categories
-// b3-2 of PID field -
-#define PID_MGMT			0x05
-#define PID_BEACON			0x0c
-#define PID_DATA_NORMALUCAST		0x02
-#define PID_DATA_AMPDU		0x04
-#define PID_DATA_NO_ACK		0x08
-#define PID_DATA_NOT_NORM_ACK		0x03
-// value domain of pTxD->HostQId (4-bit: 0~15)
-#define QID_AC_BK               1   // meet ACI definition in 802.11e
-#define QID_AC_BE               0   // meet ACI definition in 802.11e
-#define QID_AC_VI               2
-#define QID_AC_VO               3
-#define QID_HCCA                4
-//#define NUM_OF_TX_RING          5
-#define NUM_OF_TX_RING          4
-#define QID_MGMT                13
-#define QID_RX                  14
-#define QID_OTHER               15
-
-#endif // __RTMP_MAC_H__ //
diff --git a/drivers/staging/rt3090/rtmp_type.h b/drivers/staging/rt3090/rtmp_type.h
deleted file mode 100644
index d8b571e6f801..000000000000
--- a/drivers/staging/rt3090/rtmp_type.h
+++ /dev/null
@@ -1,147 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-    Module Name:
-    rtmp_type.h
-
-    Abstract:
-
-    Revision History:
-    Who         When            What
-    --------    ----------      ----------------------------------------------
-    Name        Date            Modification logs
-    Paul Lin    1-2-2004
-*/
-
-#ifndef __RTMP_TYPE_H__
-#define __RTMP_TYPE_H__
-
-
-#define PACKED  __attribute__ ((packed))
-
-#ifdef LINUX
-// Put platform dependent declaration here
-// For example, linux type definition
-typedef unsigned char			UINT8;
-typedef unsigned short			UINT16;
-typedef unsigned int			UINT32;
-typedef unsigned long long		UINT64;
-typedef int					INT32;
-typedef long long				INT64;
-#endif // LINUX //
-
-typedef unsigned char *		PUINT8;
-typedef unsigned short *		PUINT16;
-typedef unsigned int *			PUINT32;
-typedef unsigned long long *	PUINT64;
-typedef int	*				PINT32;
-typedef long long *			PINT64;
-
-// modified for fixing compile warning on Sigma 8634 platform
-typedef char					STRING;
-typedef signed char			CHAR;
-
-typedef signed short			SHORT;
-typedef signed int				INT;
-typedef signed long			LONG;
-typedef signed long long		LONGLONG;
-
-
-#ifdef LINUX
-typedef unsigned char			UCHAR;
-typedef unsigned short			USHORT;
-typedef unsigned int			UINT;
-typedef unsigned long			ULONG;
-#endif // LINUX //
-typedef unsigned long long		ULONGLONG;
-
-typedef unsigned char			BOOLEAN;
-#ifdef LINUX
-typedef void					VOID;
-#endif // LINUX //
-
-typedef char *				PSTRING;
-typedef VOID *				PVOID;
-typedef CHAR *				PCHAR;
-typedef UCHAR *					PUCHAR;
-typedef USHORT *			PUSHORT;
-typedef LONG *				PLONG;
-typedef ULONG *				PULONG;
-typedef UINT *				PUINT;
-
-typedef unsigned int			NDIS_MEDIA_STATE;
-
-typedef union _LARGE_INTEGER {
-    struct {
-        UINT LowPart;
-        INT32 HighPart;
-    } u;
-    INT64 QuadPart;
-} LARGE_INTEGER;
-
-
-//
-// Register set pair for initialzation register set definition
-//
-typedef struct  _RTMP_REG_PAIR
-{
-	ULONG   Register;
-	ULONG   Value;
-} RTMP_REG_PAIR, *PRTMP_REG_PAIR;
-
-typedef struct  _REG_PAIR
-{
-	UCHAR   Register;
-	UCHAR   Value;
-} REG_PAIR, *PREG_PAIR;
-
-//
-// Register set pair for initialzation register set definition
-//
-typedef struct  _RTMP_RF_REGS
-{
-	UCHAR   Channel;
-	ULONG   R1;
-	ULONG   R2;
-	ULONG   R3;
-	ULONG   R4;
-} RTMP_RF_REGS, *PRTMP_RF_REGS;
-
-typedef struct _FREQUENCY_ITEM {
-	UCHAR	Channel;
-	UCHAR	N;
-	UCHAR	R;
-	UCHAR	K;
-} FREQUENCY_ITEM, *PFREQUENCY_ITEM;
-
-
-typedef int				NTSTATUS;
-
-
-#define STATUS_SUCCESS				0x00
-#define STATUS_UNSUCCESSFUL		0x01
-
-#endif  // __RTMP_TYPE_H__ //
diff --git a/drivers/staging/rt3090/spectrum.h b/drivers/staging/rt3090/spectrum.h
deleted file mode 100644
index be9bae5b88c2..000000000000
--- a/drivers/staging/rt3090/spectrum.h
+++ /dev/null
@@ -1,234 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
- */
-
-#ifndef __SPECTRUM_H__
-#define __SPECTRUM_H__
-
-#include "rtmp_type.h"
-#include "spectrum_def.h"
-
-
-CHAR RTMP_GetTxPwr(
-	IN PRTMP_ADAPTER pAd,
-	IN HTTRANSMIT_SETTING HTTxMode);
-
-/*
-	==========================================================================
-	Description:
-		Prepare Measurement request action frame and enqueue it into
-		management queue waiting for transmition.
-
-	Parametrs:
-		1. the destination mac address of the frame.
-
-	Return	: None.
-	==========================================================================
- */
-VOID MakeMeasurementReqFrame(
-	IN PRTMP_ADAPTER pAd,
-	OUT PUCHAR pOutBuffer,
-	OUT PULONG pFrameLen,
-	IN UINT8 TotalLen,
-	IN UINT8 Category,
-	IN UINT8 Action,
-	IN UINT8 MeasureToken,
-	IN UINT8 MeasureReqMode,
-	IN UINT8 MeasureReqType,
-	IN UINT8 NumOfRepetitions);
-
-/*
-	==========================================================================
-	Description:
-		Prepare Measurement report action frame and enqueue it into
-		management queue waiting for transmition.
-
-	Parametrs:
-		1. the destination mac address of the frame.
-
-	Return	: None.
-	==========================================================================
- */
-VOID EnqueueMeasurementRep(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR pDA,
-	IN UINT8 DialogToken,
-	IN UINT8 MeasureToken,
-	IN UINT8 MeasureReqMode,
-	IN UINT8 MeasureReqType,
-	IN UINT8 ReportInfoLen,
-	IN PUINT8 pReportInfo);
-
-/*
-	==========================================================================
-	Description:
-		Prepare TPC Request action frame and enqueue it into
-		management queue waiting for transmition.
-
-	Parametrs:
-		1. the destination mac address of the frame.
-
-	Return	: None.
-	==========================================================================
- */
-VOID EnqueueTPCReq(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR pDA,
-	IN UCHAR DialogToken);
-
-/*
-	==========================================================================
-	Description:
-		Prepare TPC Report action frame and enqueue it into
-		management queue waiting for transmition.
-
-	Parametrs:
-		1. the destination mac address of the frame.
-
-	Return	: None.
-	==========================================================================
- */
-VOID EnqueueTPCRep(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR pDA,
-	IN UINT8 DialogToken,
-	IN UINT8 TxPwr,
-	IN UINT8 LinkMargin);
-
-/*
-	==========================================================================
-	Description:
-		Prepare Channel Switch Announcement action frame and enqueue it into
-		management queue waiting for transmition.
-
-	Parametrs:
-		1. the destination mac address of the frame.
-		2. Channel switch announcement mode.
-		2. a New selected channel.
-
-	Return	: None.
-	==========================================================================
- */
-VOID EnqueueChSwAnn(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR pDA,
-	IN UINT8 ChSwMode,
-	IN UINT8 NewCh);
-
-/*
-	==========================================================================
-	Description:
-		Spectrun action frames Handler such as channel switch annoucement,
-		measurement report, measurement request actions frames.
-
-	Parametrs:
-		Elme - MLME message containing the received frame
-
-	Return	: None.
-	==========================================================================
- */
-VOID PeerSpectrumAction(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem);
-
-/*
-	==========================================================================
-	Description:
-
-	Parametrs:
-
-	Return	: None.
-	==========================================================================
- */
-INT Set_MeasureReq_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT Set_TpcReq_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT Set_PwrConstraint(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-
-VOID MeasureReqTabInit(
-	IN PRTMP_ADAPTER pAd);
-
-VOID MeasureReqTabExit(
-	IN PRTMP_ADAPTER pAd);
-
-PMEASURE_REQ_ENTRY MeasureReqLookUp(
-	IN PRTMP_ADAPTER	pAd,
-	IN UINT8			DialogToken);
-
-PMEASURE_REQ_ENTRY MeasureReqInsert(
-	IN PRTMP_ADAPTER	pAd,
-	IN UINT8			DialogToken);
-
-VOID MeasureReqDelete(
-	IN PRTMP_ADAPTER	pAd,
-	IN UINT8			DialogToken);
-
-VOID InsertChannelRepIE(
-	IN PRTMP_ADAPTER pAd,
-	OUT PUCHAR pFrameBuf,
-	OUT PULONG pFrameLen,
-	IN PSTRING pCountry,
-	IN UINT8 RegulatoryClass);
-
-VOID InsertTpcReportIE(
-	IN PRTMP_ADAPTER pAd,
-	OUT PUCHAR pFrameBuf,
-	OUT PULONG pFrameLen,
-	IN UINT8 TxPwr,
-	IN UINT8 LinkMargin);
-
-VOID InsertDialogToken(
-	IN PRTMP_ADAPTER pAd,
-	OUT PUCHAR pFrameBuf,
-	OUT PULONG pFrameLen,
-	IN UINT8 DialogToken);
-
-VOID TpcReqTabInit(
-	IN PRTMP_ADAPTER pAd);
-
-VOID TpcReqTabExit(
-	IN PRTMP_ADAPTER pAd);
-
-VOID NotifyChSwAnnToPeerAPs(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR pRA,
-	IN PUCHAR pTA,
-	IN UINT8 ChSwMode,
-	IN UINT8 Channel);
-
-VOID RguClass_BuildBcnChList(
-	IN PRTMP_ADAPTER pAd,
-	OUT PUCHAR pBuf,
-	OUT	PULONG pBufLen);
-#endif // __SPECTRUM_H__ //
diff --git a/drivers/staging/rt3090/spectrum_def.h b/drivers/staging/rt3090/spectrum_def.h
deleted file mode 100644
index 0389b0921486..000000000000
--- a/drivers/staging/rt3090/spectrum_def.h
+++ /dev/null
@@ -1,257 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-    Module Name:
-	spectrum_def.h
-
-    Abstract:
-    Handle association related requests either from WSTA or from local MLME
-
-    Revision History:
-    Who          When          What
-    ---------    ----------    ----------------------------------------------
-	Fonchi Wu    2008		   created for 802.11h
- */
-
-#ifndef __SPECTRUM_DEF_H__
-#define __SPECTRUM_DEF_H__
-
-
-#define MAX_MEASURE_REQ_TAB_SIZE		32
-#define MAX_HASH_MEASURE_REQ_TAB_SIZE	MAX_MEASURE_REQ_TAB_SIZE
-
-#define MAX_TPC_REQ_TAB_SIZE			32
-#define MAX_HASH_TPC_REQ_TAB_SIZE		MAX_TPC_REQ_TAB_SIZE
-
-#define MIN_RCV_PWR				100		/* Negative value ((dBm) */
-
-#define TPC_REQ_AGE_OUT			500		/* ms */
-#define MQ_REQ_AGE_OUT			500		/* ms */
-
-#define TPC_DIALOGTOKEN_HASH_INDEX(_DialogToken)	((_DialogToken) % MAX_HASH_TPC_REQ_TAB_SIZE)
-#define MQ_DIALOGTOKEN_HASH_INDEX(_DialogToken)		((_DialogToken) % MAX_MEASURE_REQ_TAB_SIZE)
-
-typedef struct _MEASURE_REQ_ENTRY
-{
-	struct _MEASURE_REQ_ENTRY *pNext;
-	ULONG lastTime;
-	BOOLEAN	Valid;
-	UINT8 DialogToken;
-	UINT8 MeasureDialogToken[3];	// 0:basic measure, 1: CCA measure, 2: RPI_Histogram measure.
-} MEASURE_REQ_ENTRY, *PMEASURE_REQ_ENTRY;
-
-typedef struct _MEASURE_REQ_TAB
-{
-	UCHAR Size;
-	PMEASURE_REQ_ENTRY Hash[MAX_HASH_MEASURE_REQ_TAB_SIZE];
-	MEASURE_REQ_ENTRY Content[MAX_MEASURE_REQ_TAB_SIZE];
-} MEASURE_REQ_TAB, *PMEASURE_REQ_TAB;
-
-typedef struct _TPC_REQ_ENTRY
-{
-	struct _TPC_REQ_ENTRY *pNext;
-	ULONG lastTime;
-	BOOLEAN Valid;
-	UINT8 DialogToken;
-} TPC_REQ_ENTRY, *PTPC_REQ_ENTRY;
-
-typedef struct _TPC_REQ_TAB
-{
-	UCHAR Size;
-	PTPC_REQ_ENTRY Hash[MAX_HASH_TPC_REQ_TAB_SIZE];
-	TPC_REQ_ENTRY Content[MAX_TPC_REQ_TAB_SIZE];
-} TPC_REQ_TAB, *PTPC_REQ_TAB;
-
-
-/* The regulatory information */
-typedef struct _DOT11_CHANNEL_SET
-{
-	UCHAR NumberOfChannels;
-	UINT8 MaxTxPwr;
-	UCHAR ChannelList[16];
-} DOT11_CHANNEL_SET, *PDOT11_CHANNEL_SET;
-
-typedef struct _DOT11_REGULATORY_INFORMATION
-{
-	UCHAR RegulatoryClass;
-	DOT11_CHANNEL_SET ChannelSet;
-} DOT11_REGULATORY_INFORMATION, *PDOT11_REGULATORY_INFORMATION;
-
-
-
-#define RM_TPC_REQ				0
-#define RM_MEASURE_REQ			1
-
-#define RM_BASIC				0
-#define RM_CCA					1
-#define RM_RPI_HISTOGRAM		2
-#define RM_CH_LOAD				3
-#define RM_NOISE_HISTOGRAM		4
-
-
-typedef struct PACKED _TPC_REPORT_INFO
-{
-	UINT8 TxPwr;
-	UINT8 LinkMargin;
-} TPC_REPORT_INFO, *PTPC_REPORT_INFO;
-
-typedef struct PACKED _CH_SW_ANN_INFO
-{
-	UINT8 ChSwMode;
-	UINT8 Channel;
-	UINT8 ChSwCnt;
-} CH_SW_ANN_INFO, *PCH_SW_ANN_INFO;
-
-typedef union PACKED _MEASURE_REQ_MODE
-{
-#ifdef RT_BIG_ENDIAN
-	struct PACKED
-	{
-
-		UINT8 :3;
-		UINT8 DurationMandatory:1;
-		UINT8 Report:1;
-		UINT8 Request:1;
-		UINT8 Enable:1;
-		UINT8 Parallel:1;
-	} field;
-#else
-	struct PACKED
-	{
-		UINT8 Parallel:1;
-		UINT8 Enable:1;
-		UINT8 Request:1;
-		UINT8 Report:1;
-		UINT8 DurationMandatory:1;
-		UINT8 :3;
-	} field;
-#endif // RT_BIG_ENDIAN //
-	UINT8 word;
-} MEASURE_REQ_MODE, *PMEASURE_REQ_MODE;
-
-typedef struct PACKED _MEASURE_REQ
-{
-	UINT8 ChNum;
-	UINT64 MeasureStartTime;
-	UINT16 MeasureDuration;
-} MEASURE_REQ, *PMEASURE_REQ;
-
-typedef struct PACKED _MEASURE_REQ_INFO
-{
-	UINT8 Token;
-	MEASURE_REQ_MODE ReqMode;
-	UINT8 ReqType;
-	UINT8 Oct[0];
-} MEASURE_REQ_INFO, *PMEASURE_REQ_INFO;
-
-typedef union PACKED _MEASURE_BASIC_REPORT_MAP
-{
-#ifdef RT_BIG_ENDIAN
-	struct PACKED
-	{
-		UINT8 Rev:3;
-
-		UINT8 Unmeasure:1;
-		UINT8 Radar:1;
-		UINT8 UnidentifiedSignal:1;
-		UINT8 OfdmPreamble:1;
-		UINT8 BSS:1;
-	} field;
-#else
-	struct PACKED
-	{
-		UINT8 BSS:1;
-
-		UINT8 OfdmPreamble:1;
-		UINT8 UnidentifiedSignal:1;
-		UINT8 Radar:1;
-		UINT8 Unmeasure:1;
-		UINT8 Rev:3;
-	} field;
-#endif // RT_BIG_ENDIAN //
-	UINT8 word;
-} MEASURE_BASIC_REPORT_MAP, *PMEASURE_BASIC_REPORT_MAP;
-
-typedef struct PACKED _MEASURE_BASIC_REPORT
-{
-	UINT8 ChNum;
-	UINT64 MeasureStartTime;
-	UINT16 MeasureDuration;
-	MEASURE_BASIC_REPORT_MAP Map;
-} MEASURE_BASIC_REPORT, *PMEASURE_BASIC_REPORT;
-
-typedef struct PACKED _MEASURE_CCA_REPORT
-{
-	UINT8 ChNum;
-	UINT64 MeasureStartTime;
-	UINT16 MeasureDuration;
-	UINT8 CCA_Busy_Fraction;
-} MEASURE_CCA_REPORT, *PMEASURE_CCA_REPORT;
-
-typedef struct PACKED _MEASURE_RPI_REPORT
-{
-	UINT8 ChNum;
-	UINT64 MeasureStartTime;
-	UINT16 MeasureDuration;
-	UINT8 RPI_Density[8];
-} MEASURE_RPI_REPORT, *PMEASURE_RPI_REPORT;
-
-typedef union PACKED _MEASURE_REPORT_MODE
-{
-	struct PACKED
-	{
-#ifdef RT_BIG_ENDIAN
-		UINT8 Rev:5;
-		UINT8 Refused:1;
-		UINT8 Incapable:1;
-		UINT8 Late:1;
-#else
-		UINT8 Late:1;
-		UINT8 Incapable:1;
-		UINT8 Refused:1;
-		UINT8 Rev:5;
-#endif // RT_BIG_ENDIAN //
-	} field;
-	UINT8 word;
-} MEASURE_REPORT_MODE, *PMEASURE_REPORT_MODE;
-
-typedef struct PACKED _MEASURE_REPORT_INFO
-{
-	UINT8 Token;
-	UINT8 ReportMode;
-	UINT8 ReportType;
-	UINT8 Octect[0];
-} MEASURE_REPORT_INFO, *PMEASURE_REPORT_INFO;
-
-typedef struct PACKED _QUIET_INFO
-{
-	UINT8 QuietCnt;
-	UINT8 QuietPeriod;
-	UINT16 QuietDuration;
-	UINT16 QuietOffset;
-} QUIET_INFO, *PQUIET_INFO;
-
-#endif // __SPECTRUM_DEF_H__ //
diff --git a/drivers/staging/rt3090/sta/assoc.c b/drivers/staging/rt3090/sta/assoc.c
deleted file mode 100644
index 012ed2b06083..000000000000
--- a/drivers/staging/rt3090/sta/assoc.c
+++ /dev/null
@@ -1,1673 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-	Module Name:
-	assoc.c
-
-	Abstract:
-
-	Revision History:
-	Who			When			What
-	--------	----------		----------------------------------------------
-	John		2004-9-3		porting from RT2500
-*/
-
-#include "../rt_config.h"
-
-
-UCHAR	CipherWpaTemplate[] = {
-		0xdd,					// WPA IE
-		0x16,					// Length
-		0x00, 0x50, 0xf2, 0x01,	// oui
-		0x01, 0x00,				// Version
-		0x00, 0x50, 0xf2, 0x02,	// Multicast
-		0x01, 0x00,				// Number of unicast
-		0x00, 0x50, 0xf2, 0x02,	// unicast
-		0x01, 0x00,				// number of authentication method
-		0x00, 0x50, 0xf2, 0x01	// authentication
-		};
-
-UCHAR	CipherWpa2Template[] = {
-		0x30,					// RSN IE
-		0x14,					// Length
-		0x01, 0x00,				// Version
-		0x00, 0x0f, 0xac, 0x02,	// group cipher, TKIP
-		0x01, 0x00,				// number of pairwise
-		0x00, 0x0f, 0xac, 0x02,	// unicast
-		0x01, 0x00,				// number of authentication method
-		0x00, 0x0f, 0xac, 0x02,	// authentication
-		0x00, 0x00,				// RSN capability
-		};
-
-UCHAR	Ccx2IeInfo[] = { 0x00, 0x40, 0x96, 0x03, 0x02};
-
-/*
-	==========================================================================
-	Description:
-		association state machine init, including state transition and timer init
-	Parameters:
-		S - pointer to the association state machine
-
-	IRQL = PASSIVE_LEVEL
-
-	==========================================================================
- */
-VOID AssocStateMachineInit(
-	IN	PRTMP_ADAPTER	pAd,
-	IN  STATE_MACHINE *S,
-	OUT STATE_MACHINE_FUNC Trans[])
-{
-	StateMachineInit(S, Trans, MAX_ASSOC_STATE, MAX_ASSOC_MSG, (STATE_MACHINE_FUNC)Drop, ASSOC_IDLE, ASSOC_MACHINE_BASE);
-
-	// first column
-	StateMachineSetAction(S, ASSOC_IDLE, MT2_MLME_ASSOC_REQ, (STATE_MACHINE_FUNC)MlmeAssocReqAction);
-	StateMachineSetAction(S, ASSOC_IDLE, MT2_MLME_REASSOC_REQ, (STATE_MACHINE_FUNC)MlmeReassocReqAction);
-	StateMachineSetAction(S, ASSOC_IDLE, MT2_MLME_DISASSOC_REQ, (STATE_MACHINE_FUNC)MlmeDisassocReqAction);
-	StateMachineSetAction(S, ASSOC_IDLE, MT2_PEER_DISASSOC_REQ, (STATE_MACHINE_FUNC)PeerDisassocAction);
-
-	// second column
-	StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_MLME_ASSOC_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenAssoc);
-	StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_MLME_REASSOC_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenReassoc);
-	StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_MLME_DISASSOC_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenDisassociate);
-	StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_PEER_DISASSOC_REQ, (STATE_MACHINE_FUNC)PeerDisassocAction);
-	StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_PEER_ASSOC_RSP, (STATE_MACHINE_FUNC)PeerAssocRspAction);
-	//
-	// Patch 3Com AP MOde:3CRWE454G72
-	// We send Assoc request frame to this AP, it always send Reassoc Rsp not Associate Rsp.
-	//
-	StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_PEER_REASSOC_RSP, (STATE_MACHINE_FUNC)PeerAssocRspAction);
-	StateMachineSetAction(S, ASSOC_WAIT_RSP, MT2_ASSOC_TIMEOUT, (STATE_MACHINE_FUNC)AssocTimeoutAction);
-
-	// third column
-	StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_MLME_ASSOC_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenAssoc);
-	StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_MLME_REASSOC_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenReassoc);
-	StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_MLME_DISASSOC_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenDisassociate);
-	StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_PEER_DISASSOC_REQ, (STATE_MACHINE_FUNC)PeerDisassocAction);
-	StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_PEER_REASSOC_RSP, (STATE_MACHINE_FUNC)PeerReassocRspAction);
-	//
-	// Patch, AP doesn't send Reassociate Rsp frame to Station.
-	//
-	StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_PEER_ASSOC_RSP, (STATE_MACHINE_FUNC)PeerReassocRspAction);
-	StateMachineSetAction(S, REASSOC_WAIT_RSP, MT2_REASSOC_TIMEOUT, (STATE_MACHINE_FUNC)ReassocTimeoutAction);
-
-	// fourth column
-	StateMachineSetAction(S, DISASSOC_WAIT_RSP, MT2_MLME_ASSOC_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenAssoc);
-	StateMachineSetAction(S, DISASSOC_WAIT_RSP, MT2_MLME_REASSOC_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenReassoc);
-	StateMachineSetAction(S, DISASSOC_WAIT_RSP, MT2_MLME_DISASSOC_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenDisassociate);
-	StateMachineSetAction(S, DISASSOC_WAIT_RSP, MT2_PEER_DISASSOC_REQ, (STATE_MACHINE_FUNC)PeerDisassocAction);
-	StateMachineSetAction(S, DISASSOC_WAIT_RSP, MT2_DISASSOC_TIMEOUT, (STATE_MACHINE_FUNC)DisassocTimeoutAction);
-
-	// initialize the timer
-	RTMPInitTimer(pAd, &pAd->MlmeAux.AssocTimer, GET_TIMER_FUNCTION(AssocTimeout), pAd, FALSE);
-	RTMPInitTimer(pAd, &pAd->MlmeAux.ReassocTimer, GET_TIMER_FUNCTION(ReassocTimeout), pAd, FALSE);
-	RTMPInitTimer(pAd, &pAd->MlmeAux.DisassocTimer, GET_TIMER_FUNCTION(DisassocTimeout), pAd, FALSE);
-}
-
-/*
-	==========================================================================
-	Description:
-		Association timeout procedure. After association timeout, this function
-		will be called and it will put a message into the MLME queue
-	Parameters:
-		Standard timer parameters
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-VOID AssocTimeout(IN PVOID SystemSpecific1,
-				 IN PVOID FunctionContext,
-				 IN PVOID SystemSpecific2,
-				 IN PVOID SystemSpecific3)
-{
-	RTMP_ADAPTER *pAd = (RTMP_ADAPTER *)FunctionContext;
-
-	// Do nothing if the driver is starting halt state.
-	// This might happen when timer already been fired before cancel timer with mlmehalt
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
-		return;
-
-	MlmeEnqueue(pAd, ASSOC_STATE_MACHINE, MT2_ASSOC_TIMEOUT, 0, NULL);
-	RTMP_MLME_HANDLER(pAd);
-}
-
-/*
-	==========================================================================
-	Description:
-		Reassociation timeout procedure. After reassociation timeout, this
-		function will be called and put a message into the MLME queue
-	Parameters:
-		Standard timer parameters
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-VOID ReassocTimeout(IN PVOID SystemSpecific1,
-					IN PVOID FunctionContext,
-					IN PVOID SystemSpecific2,
-					IN PVOID SystemSpecific3)
-{
-	RTMP_ADAPTER *pAd = (RTMP_ADAPTER *)FunctionContext;
-
-	// Do nothing if the driver is starting halt state.
-	// This might happen when timer already been fired before cancel timer with mlmehalt
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
-		return;
-
-	MlmeEnqueue(pAd, ASSOC_STATE_MACHINE, MT2_REASSOC_TIMEOUT, 0, NULL);
-	RTMP_MLME_HANDLER(pAd);
-}
-
-/*
-	==========================================================================
-	Description:
-		Disassociation timeout procedure. After disassociation timeout, this
-		function will be called and put a message into the MLME queue
-	Parameters:
-		Standard timer parameters
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-VOID DisassocTimeout(IN PVOID SystemSpecific1,
-					IN PVOID FunctionContext,
-					IN PVOID SystemSpecific2,
-					IN PVOID SystemSpecific3)
-{
-	RTMP_ADAPTER *pAd = (RTMP_ADAPTER *)FunctionContext;
-
-	// Do nothing if the driver is starting halt state.
-	// This might happen when timer already been fired before cancel timer with mlmehalt
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
-		return;
-
-	MlmeEnqueue(pAd, ASSOC_STATE_MACHINE, MT2_DISASSOC_TIMEOUT, 0, NULL);
-	RTMP_MLME_HANDLER(pAd);
-}
-
-/*
-	==========================================================================
-	Description:
-		mlme assoc req handling procedure
-	Parameters:
-		Adapter - Adapter pointer
-		Elem - MLME Queue Element
-	Pre:
-		the station has been authenticated and the following information is stored in the config
-			-# SSID
-			-# supported rates and their length
-			-# listen interval (Adapter->StaCfg.default_listen_count)
-			-# Transmit power  (Adapter->StaCfg.tx_power)
-	Post  :
-		-# An association request frame is generated and sent to the air
-		-# Association timer starts
-		-# Association state -> ASSOC_WAIT_RSP
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-VOID MlmeAssocReqAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-	UCHAR			ApAddr[6];
-	HEADER_802_11	AssocHdr;
-	UCHAR			WmeIe[9] = {IE_VENDOR_SPECIFIC, 0x07, 0x00, 0x50, 0xf2, 0x02, 0x00, 0x01, 0x00};
-	USHORT			ListenIntv;
-	ULONG			Timeout;
-	USHORT			CapabilityInfo;
-	BOOLEAN			TimerCancelled;
-	PUCHAR			pOutBuffer = NULL;
-	NDIS_STATUS		NStatus;
-	ULONG			FrameLen = 0;
-	ULONG			tmp;
-	USHORT			VarIesOffset;
-	USHORT			Status;
-
-	// Block all authentication request durning WPA block period
-	if (pAd->StaCfg.bBlockAssoc == TRUE)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - Block Assoc request durning WPA block period!\n"));
-		pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
-		Status = MLME_STATE_MACHINE_REJECT;
-		MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_ASSOC_CONF, 2, &Status);
-	}
-	// check sanity first
-	else if (MlmeAssocReqSanity(pAd, Elem->Msg, Elem->MsgLen, ApAddr, &CapabilityInfo, &Timeout, &ListenIntv))
-	{
-		RTMPCancelTimer(&pAd->MlmeAux.AssocTimer, &TimerCancelled);
-		COPY_MAC_ADDR(pAd->MlmeAux.Bssid, ApAddr);
-
-		// Get an unused nonpaged memory
-		NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);
-		if (NStatus != NDIS_STATUS_SUCCESS)
-		{
-			DBGPRINT(RT_DEBUG_TRACE,("ASSOC - MlmeAssocReqAction() allocate memory failed \n"));
-			pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
-			Status = MLME_FAIL_NO_RESOURCE;
-			MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_ASSOC_CONF, 2, &Status);
-			return;
-		}
-
-		// Add by James 03/06/27
-		pAd->StaCfg.AssocInfo.Length = sizeof(NDIS_802_11_ASSOCIATION_INFORMATION);
-		// Association don't need to report MAC address
-		pAd->StaCfg.AssocInfo.AvailableRequestFixedIEs =
-			NDIS_802_11_AI_REQFI_CAPABILITIES | NDIS_802_11_AI_REQFI_LISTENINTERVAL;
-		pAd->StaCfg.AssocInfo.RequestFixedIEs.Capabilities = CapabilityInfo;
-		pAd->StaCfg.AssocInfo.RequestFixedIEs.ListenInterval = ListenIntv;
-		// Only reassociate need this
-		//COPY_MAC_ADDR(pAd->StaCfg.AssocInfo.RequestFixedIEs.CurrentAPAddress, ApAddr);
-		pAd->StaCfg.AssocInfo.OffsetRequestIEs = sizeof(NDIS_802_11_ASSOCIATION_INFORMATION);
-
-        NdisZeroMemory(pAd->StaCfg.ReqVarIEs, MAX_VIE_LEN);
-		// First add SSID
-		VarIesOffset = 0;
-		NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, &SsidIe, 1);
-		VarIesOffset += 1;
-		NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, &pAd->MlmeAux.SsidLen, 1);
-		VarIesOffset += 1;
-		NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, pAd->MlmeAux.Ssid, pAd->MlmeAux.SsidLen);
-		VarIesOffset += pAd->MlmeAux.SsidLen;
-
-		// Second add Supported rates
-		NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, &SupRateIe, 1);
-		VarIesOffset += 1;
-		NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, &pAd->MlmeAux.SupRateLen, 1);
-		VarIesOffset += 1;
-		NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, pAd->MlmeAux.SupRate, pAd->MlmeAux.SupRateLen);
-		VarIesOffset += pAd->MlmeAux.SupRateLen;
-		// End Add by James
-
-        if ((pAd->CommonCfg.Channel > 14) &&
-            (pAd->CommonCfg.bIEEE80211H == TRUE))
-            CapabilityInfo |= 0x0100;
-
-		DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - Send ASSOC request...\n"));
-		MgtMacHeaderInit(pAd, &AssocHdr, SUBTYPE_ASSOC_REQ, 0, ApAddr, ApAddr);
-
-		// Build basic frame first
-		MakeOutgoingFrame(pOutBuffer,				&FrameLen,
-						  sizeof(HEADER_802_11),	&AssocHdr,
-						  2,						&CapabilityInfo,
-						  2,						&ListenIntv,
-						  1,						&SsidIe,
-						  1,						&pAd->MlmeAux.SsidLen,
-						  pAd->MlmeAux.SsidLen,		pAd->MlmeAux.Ssid,
-						  1,						&SupRateIe,
-						  1,						&pAd->MlmeAux.SupRateLen,
-						  pAd->MlmeAux.SupRateLen,  pAd->MlmeAux.SupRate,
-						  END_OF_ARGS);
-
-		if (pAd->MlmeAux.ExtRateLen != 0)
-		{
-			MakeOutgoingFrame(pOutBuffer + FrameLen,    &tmp,
-							  1,                        &ExtRateIe,
-							  1,                        &pAd->MlmeAux.ExtRateLen,
-							  pAd->MlmeAux.ExtRateLen,  pAd->MlmeAux.ExtRate,
-							  END_OF_ARGS);
-			FrameLen += tmp;
-		}
-
-
-#ifdef DOT11_N_SUPPORT
-		// HT
-		if ((pAd->MlmeAux.HtCapabilityLen > 0) && (pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED))
-		{
-			ULONG TmpLen;
-			UCHAR HtLen;
-			UCHAR BROADCOM[4] = {0x0, 0x90, 0x4c, 0x33};
-			if (pAd->StaActive.SupportedPhyInfo.bPreNHt == TRUE)
-			{
-				HtLen = SIZE_HT_CAP_IE + 4;
-				MakeOutgoingFrame(pOutBuffer + FrameLen,            &TmpLen,
-							  1,                                &WpaIe,
-							  1,                                &HtLen,
-							  4,                                &BROADCOM[0],
-							 pAd->MlmeAux.HtCapabilityLen,          &pAd->MlmeAux.HtCapability,
-							  END_OF_ARGS);
-			}
-			else
-			{
-#ifdef RT_BIG_ENDIAN
-		        HT_CAPABILITY_IE HtCapabilityTmp;
-#endif
-
-#ifndef RT_BIG_ENDIAN
-				MakeOutgoingFrame(pOutBuffer + FrameLen,            &TmpLen,
-							  1,                                &HtCapIe,
-							  1,                                &pAd->MlmeAux.HtCapabilityLen,
-							 pAd->MlmeAux.HtCapabilityLen,          &pAd->MlmeAux.HtCapability,
-							  END_OF_ARGS);
-#else
-                NdisZeroMemory(&HtCapabilityTmp, sizeof(HT_CAPABILITY_IE));
-                NdisMoveMemory(&HtCapabilityTmp, &pAd->MlmeAux.HtCapability, pAd->MlmeAux.HtCapabilityLen);
-			*(USHORT *)(&HtCapabilityTmp.HtCapInfo) = SWAP16(*(USHORT *)(&HtCapabilityTmp.HtCapInfo));
-			*(USHORT *)(&HtCapabilityTmp.ExtHtCapInfo) = SWAP16(*(USHORT *)(&HtCapabilityTmp.ExtHtCapInfo));
-
-			MakeOutgoingFrame(pOutBuffer + FrameLen,         &TmpLen,
-								1,                           &HtCapIe,
-								1,                           &pAd->MlmeAux.HtCapabilityLen,
-								pAd->MlmeAux.HtCapabilityLen,&HtCapabilityTmp,
-								END_OF_ARGS);
-#endif
-			}
-			FrameLen += TmpLen;
-		}
-#endif // DOT11_N_SUPPORT //
-
-		// add Ralink proprietary IE to inform AP this STA is going to use AGGREGATION or PIGGY-BACK+AGGREGATION
-		// Case I: (Aggregation + Piggy-Back)
-		// 1. user enable aggregation, AND
-		// 2. Mac support piggy-back
-		// 3. AP annouces it's PIGGY-BACK+AGGREGATION-capable in BEACON
-		// Case II: (Aggregation)
-		// 1. user enable aggregation, AND
-		// 2. AP annouces it's AGGREGATION-capable in BEACON
-		if (pAd->CommonCfg.bAggregationCapable)
-		{
-			if ((pAd->CommonCfg.bPiggyBackCapable) && ((pAd->MlmeAux.APRalinkIe & 0x00000003) == 3))
-			{
-				ULONG TmpLen;
-				UCHAR RalinkIe[9] = {IE_VENDOR_SPECIFIC, 7, 0x00, 0x0c, 0x43, 0x03, 0x00, 0x00, 0x00};
-				MakeOutgoingFrame(pOutBuffer+FrameLen,           &TmpLen,
-								  9,                             RalinkIe,
-								  END_OF_ARGS);
-				FrameLen += TmpLen;
-			}
-			else if (pAd->MlmeAux.APRalinkIe & 0x00000001)
-			{
-				ULONG TmpLen;
-				UCHAR RalinkIe[9] = {IE_VENDOR_SPECIFIC, 7, 0x00, 0x0c, 0x43, 0x01, 0x00, 0x00, 0x00};
-				MakeOutgoingFrame(pOutBuffer+FrameLen,           &TmpLen,
-								  9,                             RalinkIe,
-								  END_OF_ARGS);
-				FrameLen += TmpLen;
-			}
-		}
-		else
-		{
-			ULONG TmpLen;
-			UCHAR RalinkIe[9] = {IE_VENDOR_SPECIFIC, 7, 0x00, 0x0c, 0x43, 0x06, 0x00, 0x00, 0x00};
-			MakeOutgoingFrame(pOutBuffer+FrameLen,		 &TmpLen,
-							  9,						 RalinkIe,
-							  END_OF_ARGS);
-			FrameLen += TmpLen;
-		}
-
-		if (pAd->MlmeAux.APEdcaParm.bValid)
-		{
-			if (pAd->CommonCfg.bAPSDCapable && pAd->MlmeAux.APEdcaParm.bAPSDCapable)
-			{
-				QBSS_STA_INFO_PARM QosInfo;
-
-				NdisZeroMemory(&QosInfo, sizeof(QBSS_STA_INFO_PARM));
-				QosInfo.UAPSD_AC_BE = pAd->CommonCfg.bAPSDAC_BE;
-				QosInfo.UAPSD_AC_BK = pAd->CommonCfg.bAPSDAC_BK;
-				QosInfo.UAPSD_AC_VI = pAd->CommonCfg.bAPSDAC_VI;
-				QosInfo.UAPSD_AC_VO = pAd->CommonCfg.bAPSDAC_VO;
-				QosInfo.MaxSPLength = pAd->CommonCfg.MaxSPLength;
-				WmeIe[8] |= *(PUCHAR)&QosInfo;
-			}
-			else
-			{
-                // The Parameter Set Count is set to ��0�� in the association request frames
-                // WmeIe[8] |= (pAd->MlmeAux.APEdcaParm.EdcaUpdateCount & 0x0f);
-			}
-
-			MakeOutgoingFrame(pOutBuffer + FrameLen,    &tmp,
-							  9,                        &WmeIe[0],
-							  END_OF_ARGS);
-			FrameLen += tmp;
-		}
-
-		//
-		// Let WPA(#221) Element ID on the end of this association frame.
-		// Otherwise some AP will fail on parsing Element ID and set status fail on Assoc Rsp.
-		// For example: Put Vendor Specific IE on the front of WPA IE.
-		// This happens on AP (Model No:Linksys WRK54G)
-		//
-		if (((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPAPSK) ||
-            (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK) ||
-            (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA) ||
-            (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2)
-			)
-            )
-		{
-			UCHAR RSNIe = IE_WPA;
-
-			if ((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK) ||
-                (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2))
-			{
-				RSNIe = IE_WPA2;
-			}
-
-#ifdef NATIVE_WPA_SUPPLICANT_SUPPORT
-#ifdef SIOCSIWGENIE
-			if ((pAd->StaCfg.WpaSupplicantUP != WPA_SUPPLICANT_ENABLE) &&
-				(pAd->StaCfg.bRSN_IE_FromWpaSupplicant == FALSE))
-#endif // SIOCSIWGENIE //
-#endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
-            RTMPMakeRSNIE(pAd, pAd->StaCfg.AuthMode, pAd->StaCfg.WepStatus, BSS0);
-
-            // Check for WPA PMK cache list
-			if (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2)
-			{
-			    INT     idx;
-                BOOLEAN FoundPMK = FALSE;
-				// Search chched PMKID, append it if existed
-				for (idx = 0; idx < PMKID_NO; idx++)
-				{
-					if (NdisEqualMemory(ApAddr, &pAd->StaCfg.SavedPMK[idx].BSSID, 6))
-					{
-						FoundPMK = TRUE;
-						break;
-					}
-				}
-
-				if (FoundPMK)
-				{
-					// Set PMK number
-					*(PUSHORT) &pAd->StaCfg.RSN_IE[pAd->StaCfg.RSNIE_Len] = 1;
-					NdisMoveMemory(&pAd->StaCfg.RSN_IE[pAd->StaCfg.RSNIE_Len + 2], &pAd->StaCfg.SavedPMK[idx].PMKID, 16);
-                    pAd->StaCfg.RSNIE_Len += 18;
-				}
-			}
-
-#ifdef NATIVE_WPA_SUPPLICANT_SUPPORT
-#ifdef SIOCSIWGENIE
-			if ((pAd->StaCfg.WpaSupplicantUP == WPA_SUPPLICANT_ENABLE) &&
-				(pAd->StaCfg.bRSN_IE_FromWpaSupplicant == TRUE))
-			{
-				MakeOutgoingFrame(pOutBuffer + FrameLen,		&tmp,
-						pAd->StaCfg.RSNIE_Len,			pAd->StaCfg.RSN_IE,
-						END_OF_ARGS);
-			}
-			else
-#endif
-#endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
-			{
-			MakeOutgoingFrame(pOutBuffer + FrameLen,		&tmp,
-						1,                              &RSNIe,
-					1,                              &pAd->StaCfg.RSNIE_Len,
-					pAd->StaCfg.RSNIE_Len,			pAd->StaCfg.RSN_IE,
-					END_OF_ARGS);
-			}
-
-			FrameLen += tmp;
-
-#ifdef NATIVE_WPA_SUPPLICANT_SUPPORT
-#ifdef SIOCSIWGENIE
-			if ((pAd->StaCfg.WpaSupplicantUP != WPA_SUPPLICANT_ENABLE) ||
-				(pAd->StaCfg.bRSN_IE_FromWpaSupplicant == FALSE))
-#endif
-#endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
-			{
-            // Append Variable IE
-            NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, &RSNIe, 1);
-            VarIesOffset += 1;
-            NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, &pAd->StaCfg.RSNIE_Len, 1);
-            VarIesOffset += 1;
-			}
-			NdisMoveMemory(pAd->StaCfg.ReqVarIEs + VarIesOffset, pAd->StaCfg.RSN_IE, pAd->StaCfg.RSNIE_Len);
-			VarIesOffset += pAd->StaCfg.RSNIE_Len;
-
-			// Set Variable IEs Length
-			pAd->StaCfg.ReqVarIELen = VarIesOffset;
-		}
-
-
-		MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
-		MlmeFreeMemory(pAd, pOutBuffer);
-
-		RTMPSetTimer(&pAd->MlmeAux.AssocTimer, Timeout);
-		pAd->Mlme.AssocMachine.CurrState = ASSOC_WAIT_RSP;
-	}
-	else
-	{
-		DBGPRINT(RT_DEBUG_TRACE,("ASSOC - MlmeAssocReqAction() sanity check failed. BUG!!!!!! \n"));
-		pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
-		Status = MLME_INVALID_FORMAT;
-		MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_ASSOC_CONF, 2, &Status);
-	}
-
-}
-
-/*
-	==========================================================================
-	Description:
-		mlme reassoc req handling procedure
-	Parameters:
-		Elem -
-	Pre:
-		-# SSID  (Adapter->StaCfg.ssid[])
-		-# BSSID (AP address, Adapter->StaCfg.bssid)
-		-# Supported rates (Adapter->StaCfg.supported_rates[])
-		-# Supported rates length (Adapter->StaCfg.supported_rates_len)
-		-# Tx power (Adapter->StaCfg.tx_power)
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-VOID MlmeReassocReqAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-	UCHAR			ApAddr[6];
-	HEADER_802_11	ReassocHdr;
-	UCHAR			WmeIe[9] = {IE_VENDOR_SPECIFIC, 0x07, 0x00, 0x50, 0xf2, 0x02, 0x00, 0x01, 0x00};
-	USHORT			CapabilityInfo, ListenIntv;
-	ULONG			Timeout;
-	ULONG			FrameLen = 0;
-	BOOLEAN			TimerCancelled;
-	NDIS_STATUS		NStatus;
-	ULONG			tmp;
-	PUCHAR			pOutBuffer = NULL;
-	USHORT			Status;
-
-	// Block all authentication request durning WPA block period
-	if (pAd->StaCfg.bBlockAssoc == TRUE)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - Block ReAssoc request durning WPA block period!\n"));
-		pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
-		Status = MLME_STATE_MACHINE_REJECT;
-		MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_REASSOC_CONF, 2, &Status);
-	}
-	// the parameters are the same as the association
-	else if(MlmeAssocReqSanity(pAd, Elem->Msg, Elem->MsgLen, ApAddr, &CapabilityInfo, &Timeout, &ListenIntv))
-	{
-		RTMPCancelTimer(&pAd->MlmeAux.ReassocTimer, &TimerCancelled);
-
-		NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);  //Get an unused nonpaged memory
-		if(NStatus != NDIS_STATUS_SUCCESS)
-		{
-			DBGPRINT(RT_DEBUG_TRACE,("ASSOC - MlmeReassocReqAction() allocate memory failed \n"));
-			pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
-			Status = MLME_FAIL_NO_RESOURCE;
-			MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_REASSOC_CONF, 2, &Status);
-			return;
-		}
-
-		COPY_MAC_ADDR(pAd->MlmeAux.Bssid, ApAddr);
-
-		// make frame, use bssid as the AP address??
-		DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - Send RE-ASSOC request...\n"));
-		MgtMacHeaderInit(pAd, &ReassocHdr, SUBTYPE_REASSOC_REQ, 0, ApAddr, ApAddr);
-		MakeOutgoingFrame(pOutBuffer,               &FrameLen,
-						  sizeof(HEADER_802_11),    &ReassocHdr,
-						  2,                        &CapabilityInfo,
-						  2,                        &ListenIntv,
-						  MAC_ADDR_LEN,             ApAddr,
-						  1,                        &SsidIe,
-						  1,                        &pAd->MlmeAux.SsidLen,
-						  pAd->MlmeAux.SsidLen,     pAd->MlmeAux.Ssid,
-						  1,                        &SupRateIe,
-						  1,						&pAd->MlmeAux.SupRateLen,
-						  pAd->MlmeAux.SupRateLen,  pAd->MlmeAux.SupRate,
-						  END_OF_ARGS);
-
-		if (pAd->MlmeAux.ExtRateLen != 0)
-		{
-			MakeOutgoingFrame(pOutBuffer + FrameLen,        &tmp,
-							  1,                            &ExtRateIe,
-							  1,                            &pAd->MlmeAux.ExtRateLen,
-							  pAd->MlmeAux.ExtRateLen,	    pAd->MlmeAux.ExtRate,
-							  END_OF_ARGS);
-			FrameLen += tmp;
-		}
-
-
-		if (pAd->MlmeAux.APEdcaParm.bValid)
-		{
-			if (pAd->CommonCfg.bAPSDCapable && pAd->MlmeAux.APEdcaParm.bAPSDCapable)
-			{
-				QBSS_STA_INFO_PARM QosInfo;
-
-				NdisZeroMemory(&QosInfo, sizeof(QBSS_STA_INFO_PARM));
-				QosInfo.UAPSD_AC_BE = pAd->CommonCfg.bAPSDAC_BE;
-				QosInfo.UAPSD_AC_BK = pAd->CommonCfg.bAPSDAC_BK;
-				QosInfo.UAPSD_AC_VI = pAd->CommonCfg.bAPSDAC_VI;
-				QosInfo.UAPSD_AC_VO = pAd->CommonCfg.bAPSDAC_VO;
-				QosInfo.MaxSPLength = pAd->CommonCfg.MaxSPLength;
-				WmeIe[8] |= *(PUCHAR)&QosInfo;
-			}
-
-			MakeOutgoingFrame(pOutBuffer + FrameLen,    &tmp,
-							  9,                        &WmeIe[0],
-							  END_OF_ARGS);
-			FrameLen += tmp;
-		}
-
-#ifdef DOT11_N_SUPPORT
-		// HT
-		if ((pAd->MlmeAux.HtCapabilityLen > 0) && (pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED))
-		{
-			ULONG TmpLen;
-			UCHAR HtLen;
-			UCHAR BROADCOM[4] = {0x0, 0x90, 0x4c, 0x33};
-			if (pAd->StaActive.SupportedPhyInfo.bPreNHt == TRUE)
-			{
-				HtLen = SIZE_HT_CAP_IE + 4;
-				MakeOutgoingFrame(pOutBuffer + FrameLen,            &TmpLen,
-							  1,                                &WpaIe,
-							  1,                                &HtLen,
-							  4,                                &BROADCOM[0],
-							 pAd->MlmeAux.HtCapabilityLen,          &pAd->MlmeAux.HtCapability,
-							  END_OF_ARGS);
-			}
-			else
-			{
-				MakeOutgoingFrame(pOutBuffer + FrameLen,            &TmpLen,
-							  1,                                &HtCapIe,
-							  1,                                &pAd->MlmeAux.HtCapabilityLen,
-							 pAd->MlmeAux.HtCapabilityLen,          &pAd->MlmeAux.HtCapability,
-							  END_OF_ARGS);
-			}
-			FrameLen += TmpLen;
-		}
-#endif // DOT11_N_SUPPORT //
-
-		// add Ralink proprietary IE to inform AP this STA is going to use AGGREGATION or PIGGY-BACK+AGGREGATION
-		// Case I: (Aggregation + Piggy-Back)
-		// 1. user enable aggregation, AND
-		// 2. Mac support piggy-back
-		// 3. AP annouces it's PIGGY-BACK+AGGREGATION-capable in BEACON
-		// Case II: (Aggregation)
-		// 1. user enable aggregation, AND
-		// 2. AP annouces it's AGGREGATION-capable in BEACON
-		if (pAd->CommonCfg.bAggregationCapable)
-		{
-			if ((pAd->CommonCfg.bPiggyBackCapable) && ((pAd->MlmeAux.APRalinkIe & 0x00000003) == 3))
-			{
-				ULONG TmpLen;
-				UCHAR RalinkIe[9] = {IE_VENDOR_SPECIFIC, 7, 0x00, 0x0c, 0x43, 0x03, 0x00, 0x00, 0x00};
-				MakeOutgoingFrame(pOutBuffer+FrameLen,           &TmpLen,
-								  9,                             RalinkIe,
-								  END_OF_ARGS);
-				FrameLen += TmpLen;
-			}
-			else if (pAd->MlmeAux.APRalinkIe & 0x00000001)
-			{
-				ULONG TmpLen;
-				UCHAR RalinkIe[9] = {IE_VENDOR_SPECIFIC, 7, 0x00, 0x0c, 0x43, 0x01, 0x00, 0x00, 0x00};
-				MakeOutgoingFrame(pOutBuffer+FrameLen,           &TmpLen,
-								  9,                             RalinkIe,
-								  END_OF_ARGS);
-				FrameLen += TmpLen;
-			}
-		}
-		else
-		{
-			ULONG TmpLen;
-			UCHAR RalinkIe[9] = {IE_VENDOR_SPECIFIC, 7, 0x00, 0x0c, 0x43, 0x04, 0x00, 0x00, 0x00};
-			MakeOutgoingFrame(pOutBuffer+FrameLen,		 &TmpLen,
-							  9,						 RalinkIe,
-							  END_OF_ARGS);
-			FrameLen += TmpLen;
-		}
-
-		MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
-		MlmeFreeMemory(pAd, pOutBuffer);
-
-		RTMPSetTimer(&pAd->MlmeAux.ReassocTimer, Timeout); /* in mSec */
-		pAd->Mlme.AssocMachine.CurrState = REASSOC_WAIT_RSP;
-	}
-	else
-	{
-		DBGPRINT(RT_DEBUG_TRACE,("ASSOC - MlmeReassocReqAction() sanity check failed. BUG!!!! \n"));
-		pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
-		Status = MLME_INVALID_FORMAT;
-		MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_REASSOC_CONF, 2, &Status);
-	}
-}
-
-/*
-	==========================================================================
-	Description:
-		Upper layer issues disassoc request
-	Parameters:
-		Elem -
-
-	IRQL = PASSIVE_LEVEL
-
-	==========================================================================
- */
-VOID MlmeDisassocReqAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-	PMLME_DISASSOC_REQ_STRUCT pDisassocReq;
-	HEADER_802_11         DisassocHdr;
-	PHEADER_802_11        pDisassocHdr;
-	PUCHAR                pOutBuffer = NULL;
-	ULONG                 FrameLen = 0;
-	NDIS_STATUS           NStatus;
-	BOOLEAN               TimerCancelled;
-	ULONG                 Timeout = 500;
-	USHORT                Status;
-
-#ifdef QOS_DLS_SUPPORT
-	// send DLS-TEAR_DOWN message,
-	if (pAd->CommonCfg.bDLSCapable)
-	{
-		UCHAR i;
-
-		// tear down local dls table entry
-		for (i=0; i<MAX_NUM_OF_INIT_DLS_ENTRY; i++)
-		{
-			if (pAd->StaCfg.DLSEntry[i].Valid && (pAd->StaCfg.DLSEntry[i].Status == DLS_FINISH))
-			{
-				RTMPSendDLSTearDownFrame(pAd, pAd->StaCfg.DLSEntry[i].MacAddr);
-				pAd->StaCfg.DLSEntry[i].Status	= DLS_NONE;
-				pAd->StaCfg.DLSEntry[i].Valid	= FALSE;
-			}
-		}
-
-		// tear down peer dls table entry
-		for (i=MAX_NUM_OF_INIT_DLS_ENTRY; i<MAX_NUM_OF_DLS_ENTRY; i++)
-		{
-			if (pAd->StaCfg.DLSEntry[i].Valid && (pAd->StaCfg.DLSEntry[i].Status == DLS_FINISH))
-			{
-				RTMPSendDLSTearDownFrame(pAd, pAd->StaCfg.DLSEntry[i].MacAddr);
-				pAd->StaCfg.DLSEntry[i].Status = DLS_NONE;
-				pAd->StaCfg.DLSEntry[i].Valid	= FALSE;
-			}
-		}
-	}
-#endif // QOS_DLS_SUPPORT //
-
-	// skip sanity check
-	pDisassocReq = (PMLME_DISASSOC_REQ_STRUCT)(Elem->Msg);
-
-	NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);  //Get an unused nonpaged memory
-	if (NStatus != NDIS_STATUS_SUCCESS)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - MlmeDisassocReqAction() allocate memory failed\n"));
-		pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
-		Status = MLME_FAIL_NO_RESOURCE;
-		MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_DISASSOC_CONF, 2, &Status);
-		return;
-	}
-
-
-
-
-	RTMPCancelTimer(&pAd->MlmeAux.DisassocTimer, &TimerCancelled);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - Send DISASSOC request[BSSID::%02x:%02x:%02x:%02x:%02x:%02x (Reason=%d)\n",
-				pDisassocReq->Addr[0], pDisassocReq->Addr[1], pDisassocReq->Addr[2],
-				pDisassocReq->Addr[3], pDisassocReq->Addr[4], pDisassocReq->Addr[5], pDisassocReq->Reason));
-	MgtMacHeaderInit(pAd, &DisassocHdr, SUBTYPE_DISASSOC, 0, pDisassocReq->Addr, pDisassocReq->Addr);	// patch peap ttls switching issue
-	MakeOutgoingFrame(pOutBuffer,           &FrameLen,
-					  sizeof(HEADER_802_11),&DisassocHdr,
-					  2,                    &pDisassocReq->Reason,
-					  END_OF_ARGS);
-	MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
-
-	// To patch Instance and Buffalo(N) AP
-	// Driver has to send deauth to Instance AP, but Buffalo(N) needs to send disassoc to reset Authenticator's state machine
-	// Therefore, we send both of them.
-	pDisassocHdr = (PHEADER_802_11)pOutBuffer;
-	pDisassocHdr->FC.SubType = SUBTYPE_DEAUTH;
-	MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
-
-	MlmeFreeMemory(pAd, pOutBuffer);
-
-	pAd->StaCfg.DisassocReason = REASON_DISASSOC_STA_LEAVING;
-	COPY_MAC_ADDR(pAd->StaCfg.DisassocSta, pDisassocReq->Addr);
-
-	RTMPSetTimer(&pAd->MlmeAux.DisassocTimer, Timeout); /* in mSec */
-	pAd->Mlme.AssocMachine.CurrState = DISASSOC_WAIT_RSP;
-
-#ifdef WPA_SUPPLICANT_SUPPORT
-#ifndef NATIVE_WPA_SUPPLICANT_SUPPORT
-	if (pAd->StaCfg.WpaSupplicantUP != WPA_SUPPLICANT_DISABLE)
-	{
-		//send disassociate event to wpa_supplicant
-		RtmpOSWrielessEventSend(pAd, IWEVCUSTOM, RT_DISASSOC_EVENT_FLAG, NULL, NULL, 0);
-	}
-#endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
-#endif // WPA_SUPPLICANT_SUPPORT //
-
-#ifdef NATIVE_WPA_SUPPLICANT_SUPPORT
-	RtmpOSWrielessEventSend(pAd, SIOCGIWAP, -1, NULL, NULL, 0);
-#endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
-
-}
-
-/*
-	==========================================================================
-	Description:
-		peer sends assoc rsp back
-	Parameters:
-		Elme - MLME message containing the received frame
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-VOID PeerAssocRspAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-	USHORT        CapabilityInfo, Status, Aid;
-	UCHAR         SupRate[MAX_LEN_OF_SUPPORTED_RATES], SupRateLen;
-	UCHAR         ExtRate[MAX_LEN_OF_SUPPORTED_RATES], ExtRateLen;
-	UCHAR         Addr2[MAC_ADDR_LEN];
-	BOOLEAN       TimerCancelled;
-	UCHAR         CkipFlag;
-	EDCA_PARM     EdcaParm;
-	HT_CAPABILITY_IE		HtCapability;
-	ADD_HT_INFO_IE		AddHtInfo;	// AP might use this additional ht info IE
-	UCHAR			HtCapabilityLen;
-	UCHAR			AddHtInfoLen;
-	UCHAR			NewExtChannelOffset = 0xff;
-
-	if (PeerAssocRspSanity(pAd, Elem->Msg, Elem->MsgLen, Addr2, &CapabilityInfo, &Status, &Aid, SupRate, &SupRateLen, ExtRate, &ExtRateLen,
-		&HtCapability,&AddHtInfo, &HtCapabilityLen,&AddHtInfoLen,&NewExtChannelOffset, &EdcaParm, &CkipFlag))
-	{
-		// The frame is for me ?
-		if(MAC_ADDR_EQUAL(Addr2, pAd->MlmeAux.Bssid))
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("PeerAssocRspAction():ASSOC - receive ASSOC_RSP to me (status=%d)\n", Status));
-#ifdef DOT11_N_SUPPORT
-			DBGPRINT(RT_DEBUG_TRACE, ("PeerAssocRspAction():MacTable [%d].AMsduSize = %d. ClientStatusFlags = 0x%lx \n",Elem->Wcid, pAd->MacTab.Content[BSSID_WCID].AMsduSize, pAd->MacTab.Content[BSSID_WCID].ClientStatusFlags));
-#endif // DOT11_N_SUPPORT //
-			RTMPCancelTimer(&pAd->MlmeAux.AssocTimer, &TimerCancelled);
-
-
-			if(Status == MLME_SUCCESS)
-			{
-				UCHAR			MaxSupportedRateIn500Kbps = 0;
-				UCHAR			idx;
-
-				// supported rates array may not be sorted. sort it and find the maximum rate
-			    for (idx=0; idx<SupRateLen; idx++)
-			    {
-			        if (MaxSupportedRateIn500Kbps < (SupRate[idx] & 0x7f))
-			            MaxSupportedRateIn500Kbps = SupRate[idx] & 0x7f;
-			    }
-
-				for (idx=0; idx<ExtRateLen; idx++)
-			    {
-			        if (MaxSupportedRateIn500Kbps < (ExtRate[idx] & 0x7f))
-			            MaxSupportedRateIn500Kbps = ExtRate[idx] & 0x7f;
-			    }
-				// go to procedure listed on page 376
-				AssocPostProc(pAd, Addr2, CapabilityInfo, Aid, SupRate, SupRateLen, ExtRate, ExtRateLen,
-					&EdcaParm, &HtCapability, HtCapabilityLen, &AddHtInfo);
-
-				StaAddMacTableEntry(pAd,
-									&pAd->MacTab.Content[BSSID_WCID],
-									MaxSupportedRateIn500Kbps,
-									&HtCapability,
-									HtCapabilityLen,
-									&AddHtInfo,
-									AddHtInfoLen,
-									CapabilityInfo);
-			}
-			pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
-			MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_ASSOC_CONF, 2, &Status);
-		}
-	}
-	else
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - PeerAssocRspAction() sanity check fail\n"));
-	}
-}
-
-/*
-	==========================================================================
-	Description:
-		peer sends reassoc rsp
-	Parametrs:
-		Elem - MLME message cntaining the received frame
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-VOID PeerReassocRspAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-	USHORT      CapabilityInfo;
-	USHORT      Status;
-	USHORT      Aid;
-	UCHAR       SupRate[MAX_LEN_OF_SUPPORTED_RATES], SupRateLen;
-	UCHAR       ExtRate[MAX_LEN_OF_SUPPORTED_RATES], ExtRateLen;
-	UCHAR       Addr2[MAC_ADDR_LEN];
-	UCHAR       CkipFlag;
-	BOOLEAN     TimerCancelled;
-	EDCA_PARM   EdcaParm;
-	HT_CAPABILITY_IE		HtCapability;
-	ADD_HT_INFO_IE		AddHtInfo;	// AP might use this additional ht info IE
-	UCHAR			HtCapabilityLen;
-	UCHAR			AddHtInfoLen;
-	UCHAR			NewExtChannelOffset = 0xff;
-
-	if(PeerAssocRspSanity(pAd, Elem->Msg, Elem->MsgLen, Addr2, &CapabilityInfo, &Status, &Aid, SupRate, &SupRateLen, ExtRate, &ExtRateLen,
-								&HtCapability,	&AddHtInfo, &HtCapabilityLen, &AddHtInfoLen,&NewExtChannelOffset, &EdcaParm, &CkipFlag))
-	{
-		if(MAC_ADDR_EQUAL(Addr2, pAd->MlmeAux.Bssid)) // The frame is for me ?
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - receive REASSOC_RSP to me (status=%d)\n", Status));
-			RTMPCancelTimer(&pAd->MlmeAux.ReassocTimer, &TimerCancelled);
-
-			if(Status == MLME_SUCCESS)
-			{
-				// go to procedure listed on page 376
-				AssocPostProc(pAd, Addr2, CapabilityInfo, Aid, SupRate, SupRateLen, ExtRate, ExtRateLen,
-					 &EdcaParm, &HtCapability, HtCapabilityLen, &AddHtInfo);
-
-#ifdef WPA_SUPPLICANT_SUPPORT
-#ifndef NATIVE_WPA_SUPPLICANT_SUPPORT
-                if (pAd->StaCfg.WpaSupplicantUP != WPA_SUPPLICANT_DISABLE)
-			{
-				SendAssocIEsToWpaSupplicant(pAd);
-				RtmpOSWrielessEventSend(pAd, IWEVCUSTOM, RT_ASSOC_EVENT_FLAG, NULL, NULL, 0);
-			}
-#endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
-#endif // WPA_SUPPLICANT_SUPPORT //
-
-#ifdef NATIVE_WPA_SUPPLICANT_SUPPORT
-                {
-                    wext_notify_event_assoc(pAd);
-                    RtmpOSWrielessEventSend(pAd, SIOCGIWAP, -1, &pAd->MlmeAux.Bssid[0], NULL, 0);
-                }
-#endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
-
-			}
-
-			// CkipFlag is no use for reassociate
-			pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
-			MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_REASSOC_CONF, 2, &Status);
-		}
-	}
-	else
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - PeerReassocRspAction() sanity check fail\n"));
-	}
-
-}
-
-/*
-	==========================================================================
-	Description:
-		procedures on IEEE 802.11/1999 p.376
-	Parametrs:
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-VOID AssocPostProc(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR pAddr2,
-	IN USHORT CapabilityInfo,
-	IN USHORT Aid,
-	IN UCHAR SupRate[],
-	IN UCHAR SupRateLen,
-	IN UCHAR ExtRate[],
-	IN UCHAR ExtRateLen,
-	IN PEDCA_PARM pEdcaParm,
-	IN HT_CAPABILITY_IE		*pHtCapability,
-	IN UCHAR HtCapabilityLen,
-	IN ADD_HT_INFO_IE		*pAddHtInfo)	// AP might use this additional ht info IE
-{
-	ULONG Idx;
-
-	pAd->MlmeAux.BssType = BSS_INFRA;
-	COPY_MAC_ADDR(pAd->MlmeAux.Bssid, pAddr2);
-	pAd->MlmeAux.Aid = Aid;
-	pAd->MlmeAux.CapabilityInfo = CapabilityInfo & SUPPORTED_CAPABILITY_INFO;
-
-#ifdef DOT11_N_SUPPORT
-	// Some HT AP might lost WMM IE. We add WMM ourselves. beacuase HT requires QoS on.
-	if ((HtCapabilityLen > 0) && (pEdcaParm->bValid == FALSE))
-	{
-		pEdcaParm->bValid = TRUE;
-		pEdcaParm->Aifsn[0] = 3;
-		pEdcaParm->Aifsn[1] = 7;
-		pEdcaParm->Aifsn[2] = 2;
-		pEdcaParm->Aifsn[3] = 2;
-
-		pEdcaParm->Cwmin[0] = 4;
-		pEdcaParm->Cwmin[1] = 4;
-		pEdcaParm->Cwmin[2] = 3;
-		pEdcaParm->Cwmin[3] = 2;
-
-		pEdcaParm->Cwmax[0] = 10;
-		pEdcaParm->Cwmax[1] = 10;
-		pEdcaParm->Cwmax[2] = 4;
-		pEdcaParm->Cwmax[3] = 3;
-
-		pEdcaParm->Txop[0]  = 0;
-		pEdcaParm->Txop[1]  = 0;
-		pEdcaParm->Txop[2]  = 96;
-		pEdcaParm->Txop[3]  = 48;
-
-	}
-#endif // DOT11_N_SUPPORT //
-
-	NdisMoveMemory(&pAd->MlmeAux.APEdcaParm, pEdcaParm, sizeof(EDCA_PARM));
-
-	// filter out un-supported rates
-	pAd->MlmeAux.SupRateLen = SupRateLen;
-	NdisMoveMemory(pAd->MlmeAux.SupRate, SupRate, SupRateLen);
-	RTMPCheckRates(pAd, pAd->MlmeAux.SupRate, &pAd->MlmeAux.SupRateLen);
-
-	// filter out un-supported rates
-	pAd->MlmeAux.ExtRateLen = ExtRateLen;
-	NdisMoveMemory(pAd->MlmeAux.ExtRate, ExtRate, ExtRateLen);
-	RTMPCheckRates(pAd, pAd->MlmeAux.ExtRate, &pAd->MlmeAux.ExtRateLen);
-
-#ifdef DOT11_N_SUPPORT
-	if (HtCapabilityLen > 0)
-	{
-		RTMPCheckHt(pAd, BSSID_WCID, pHtCapability, pAddHtInfo);
-	}
-	DBGPRINT(RT_DEBUG_TRACE, ("AssocPostProc===>  AP.AMsduSize = %d. ClientStatusFlags = 0x%lx \n", pAd->MacTab.Content[BSSID_WCID].AMsduSize, pAd->MacTab.Content[BSSID_WCID].ClientStatusFlags));
-
-	DBGPRINT(RT_DEBUG_TRACE, ("AssocPostProc===>    (Mmps=%d, AmsduSize=%d, )\n",
-		pAd->MacTab.Content[BSSID_WCID].MmpsMode, pAd->MacTab.Content[BSSID_WCID].AMsduSize));
-#endif // DOT11_N_SUPPORT //
-
-	// Set New WPA information
-	Idx = BssTableSearch(&pAd->ScanTab, pAddr2, pAd->MlmeAux.Channel);
-	if (Idx == BSS_NOT_FOUND)
-	{
-		DBGPRINT_ERR(("ASSOC - Can't find BSS after receiving Assoc response\n"));
-	}
-	else
-	{
-		// Init variable
-		pAd->MacTab.Content[BSSID_WCID].RSNIE_Len = 0;
-		NdisZeroMemory(pAd->MacTab.Content[BSSID_WCID].RSN_IE, MAX_LEN_OF_RSNIE);
-
-		// Store appropriate RSN_IE for WPA SM negotiation later
-		if ((pAd->StaCfg.AuthMode >= Ndis802_11AuthModeWPA) && (pAd->ScanTab.BssEntry[Idx].VarIELen != 0))
-		{
-			PUCHAR              pVIE;
-			USHORT              len;
-			PEID_STRUCT         pEid;
-
-			pVIE = pAd->ScanTab.BssEntry[Idx].VarIEs;
-			len	 = pAd->ScanTab.BssEntry[Idx].VarIELen;
-			//KH need to check again
-			// Don't allow to go to sleep mode if authmode is WPA-related.
-			//This can make Authentication process more smoothly.
-			RTMP_CLEAR_PSFLAG(pAd, fRTMP_PS_CAN_GO_SLEEP);
-
-			while (len > 0)
-			{
-				pEid = (PEID_STRUCT) pVIE;
-				// For WPA/WPAPSK
-				if ((pEid->Eid == IE_WPA) && (NdisEqualMemory(pEid->Octet, WPA_OUI, 4))
-					&& (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA || pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPAPSK))
-				{
-					NdisMoveMemory(pAd->MacTab.Content[BSSID_WCID].RSN_IE, pVIE, (pEid->Len + 2));
-					pAd->MacTab.Content[BSSID_WCID].RSNIE_Len = (pEid->Len + 2);
-					DBGPRINT(RT_DEBUG_TRACE, ("AssocPostProc===> Store RSN_IE for WPA SM negotiation \n"));
-				}
-				// For WPA2/WPA2PSK
-				else if ((pEid->Eid == IE_RSN) && (NdisEqualMemory(pEid->Octet + 2, RSN_OUI, 3))
-					&& (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2 || pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK))
-				{
-					NdisMoveMemory(pAd->MacTab.Content[BSSID_WCID].RSN_IE, pVIE, (pEid->Len + 2));
-					pAd->MacTab.Content[BSSID_WCID].RSNIE_Len = (pEid->Len + 2);
-					DBGPRINT(RT_DEBUG_TRACE, ("AssocPostProc===> Store RSN_IE for WPA2 SM negotiation \n"));
-				}
-
-				pVIE += (pEid->Len + 2);
-				len  -= (pEid->Len + 2);
-			}
-
-
-		}
-
-		if (pAd->MacTab.Content[BSSID_WCID].RSNIE_Len == 0)
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("AssocPostProc===> no RSN_IE \n"));
-		}
-		else
-		{
-			hex_dump("RSN_IE", pAd->MacTab.Content[BSSID_WCID].RSN_IE, pAd->MacTab.Content[BSSID_WCID].RSNIE_Len);
-		}
-	}
-}
-
-/*
-	==========================================================================
-	Description:
-		left part of IEEE 802.11/1999 p.374
-	Parameters:
-		Elem - MLME message containing the received frame
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-VOID PeerDisassocAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-	UCHAR         Addr2[MAC_ADDR_LEN];
-	USHORT        Reason;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - PeerDisassocAction()\n"));
-	if(PeerDisassocSanity(pAd, Elem->Msg, Elem->MsgLen, Addr2, &Reason))
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - PeerDisassocAction() Reason = %d\n", Reason));
-		if (INFRA_ON(pAd) && MAC_ADDR_EQUAL(pAd->CommonCfg.Bssid, Addr2))
-		{
-
-			if (pAd->CommonCfg.bWirelessEvent)
-			{
-				RTMPSendWirelessEvent(pAd, IW_DISASSOC_EVENT_FLAG, pAd->MacTab.Content[BSSID_WCID].Addr, BSS0, 0);
-			}
-
-
-			LinkDown(pAd, TRUE);
-			pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
-
-#ifdef WPA_SUPPLICANT_SUPPORT
-#ifndef NATIVE_WPA_SUPPLICANT_SUPPORT
-            if (pAd->StaCfg.WpaSupplicantUP != WPA_SUPPLICANT_DISABLE)
-			{
-				//send disassociate event to wpa_supplicant
-				RtmpOSWrielessEventSend(pAd, IWEVCUSTOM, RT_DISASSOC_EVENT_FLAG, NULL, NULL, 0);
-			}
-#endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
-#endif // WPA_SUPPLICANT_SUPPORT //
-
-#ifdef NATIVE_WPA_SUPPLICANT_SUPPORT
-			RtmpOSWrielessEventSend(pAd, SIOCGIWAP, -1, NULL, NULL, 0);
-#endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
-		}
-	}
-	else
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - PeerDisassocAction() sanity check fail\n"));
-	}
-
-}
-
-/*
-	==========================================================================
-	Description:
-		what the state machine will do after assoc timeout
-	Parameters:
-		Elme -
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-VOID AssocTimeoutAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-	USHORT  Status;
-	DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - AssocTimeoutAction\n"));
-	pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
-	Status = MLME_REJ_TIMEOUT;
-	MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_ASSOC_CONF, 2, &Status);
-}
-
-/*
-	==========================================================================
-	Description:
-		what the state machine will do after reassoc timeout
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-VOID ReassocTimeoutAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-	USHORT  Status;
-	DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - ReassocTimeoutAction\n"));
-	pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
-	Status = MLME_REJ_TIMEOUT;
-	MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_REASSOC_CONF, 2, &Status);
-}
-
-/*
-	==========================================================================
-	Description:
-		what the state machine will do after disassoc timeout
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-VOID DisassocTimeoutAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-	USHORT  Status;
-	DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - DisassocTimeoutAction\n"));
-	pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
-	Status = MLME_SUCCESS;
-	MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_DISASSOC_CONF, 2, &Status);
-}
-
-VOID InvalidStateWhenAssoc(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-	USHORT  Status;
-	DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - InvalidStateWhenAssoc(state=%ld), reset ASSOC state machine\n",
-		pAd->Mlme.AssocMachine.CurrState));
-	pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
-	Status = MLME_STATE_MACHINE_REJECT;
-	MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_ASSOC_CONF, 2, &Status);
-}
-
-VOID InvalidStateWhenReassoc(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-	USHORT Status;
-	DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - InvalidStateWhenReassoc(state=%ld), reset ASSOC state machine\n",
-		pAd->Mlme.AssocMachine.CurrState));
-	pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
-	Status = MLME_STATE_MACHINE_REJECT;
-	MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_REASSOC_CONF, 2, &Status);
-}
-
-VOID InvalidStateWhenDisassociate(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-	USHORT Status;
-	DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - InvalidStateWhenDisassoc(state=%ld), reset ASSOC state machine\n",
-		pAd->Mlme.AssocMachine.CurrState));
-	pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
-	Status = MLME_STATE_MACHINE_REJECT;
-	MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_DISASSOC_CONF, 2, &Status);
-}
-
-/*
-	==========================================================================
-	Description:
-		right part of IEEE 802.11/1999 page 374
-	Note:
-		This event should never cause ASSOC state machine perform state
-		transition, and has no relationship with CNTL machine. So we separate
-		this routine as a service outside of ASSOC state transition table.
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-VOID Cls3errAction(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR        pAddr)
-{
-	HEADER_802_11         DisassocHdr;
-	PHEADER_802_11        pDisassocHdr;
-	PUCHAR                pOutBuffer = NULL;
-	ULONG                 FrameLen = 0;
-	NDIS_STATUS           NStatus;
-	USHORT                Reason = REASON_CLS3ERR;
-
-	NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);  //Get an unused nonpaged memory
-	if (NStatus != NDIS_STATUS_SUCCESS)
-		return;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("ASSOC - Class 3 Error, Send DISASSOC frame\n"));
-	MgtMacHeaderInit(pAd, &DisassocHdr, SUBTYPE_DISASSOC, 0, pAddr, pAd->CommonCfg.Bssid);	// patch peap ttls switching issue
-	MakeOutgoingFrame(pOutBuffer,           &FrameLen,
-					  sizeof(HEADER_802_11),&DisassocHdr,
-					  2,                    &Reason,
-					  END_OF_ARGS);
-	MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
-
-	// To patch Instance and Buffalo(N) AP
-	// Driver has to send deauth to Instance AP, but Buffalo(N) needs to send disassoc to reset Authenticator's state machine
-	// Therefore, we send both of them.
-	pDisassocHdr = (PHEADER_802_11)pOutBuffer;
-	pDisassocHdr->FC.SubType = SUBTYPE_DEAUTH;
-	MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
-
-	MlmeFreeMemory(pAd, pOutBuffer);
-
-	pAd->StaCfg.DisassocReason = REASON_CLS3ERR;
-	COPY_MAC_ADDR(pAd->StaCfg.DisassocSta, pAddr);
-}
-
-#ifdef WPA_SUPPLICANT_SUPPORT
-#ifndef NATIVE_WPA_SUPPLICANT_SUPPORT
-VOID    SendAssocIEsToWpaSupplicant(
-    IN  PRTMP_ADAPTER pAd)
-{
-	STRING custom[IW_CUSTOM_MAX] = {0};
-
-	if ((pAd->StaCfg.ReqVarIELen + 17) <= IW_CUSTOM_MAX)
-	{
-		sprintf(custom, "ASSOCINFO_ReqIEs=");
-		NdisMoveMemory(custom+17, pAd->StaCfg.ReqVarIEs, pAd->StaCfg.ReqVarIELen);
-		RtmpOSWrielessEventSend(pAd, IWEVCUSTOM, RT_REQIE_EVENT_FLAG, NULL, (PUCHAR)custom, pAd->StaCfg.ReqVarIELen + 17);
-
-		RtmpOSWrielessEventSend(pAd, IWEVCUSTOM, RT_ASSOCINFO_EVENT_FLAG, NULL, NULL, 0);
-	}
-	else
-		DBGPRINT(RT_DEBUG_TRACE, ("pAd->StaCfg.ReqVarIELen + 17 > MAX_CUSTOM_LEN\n"));
-
-	return;
-}
-#endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
-#endif // WPA_SUPPLICANT_SUPPORT //
-
-#ifdef NATIVE_WPA_SUPPLICANT_SUPPORT
-int wext_notify_event_assoc(
-	IN  RTMP_ADAPTER *pAd)
-{
-	char custom[IW_CUSTOM_MAX] = {0};
-
-#if WIRELESS_EXT > 17
-	if (pAd->StaCfg.ReqVarIELen <= IW_CUSTOM_MAX)
-	{
-		NdisMoveMemory(custom, pAd->StaCfg.ReqVarIEs, pAd->StaCfg.ReqVarIELen);
-		RtmpOSWrielessEventSend(pAd, IWEVASSOCREQIE, -1, NULL, custom, pAd->StaCfg.ReqVarIELen);
-	}
-	else
-	    DBGPRINT(RT_DEBUG_TRACE, ("pAd->StaCfg.ReqVarIELen > MAX_CUSTOM_LEN\n"));
-#else
-	int len;
-
-	len = (pAd->StaCfg.ReqVarIELen*2) + 17;
-	if (len <= IW_CUSTOM_MAX)
-	{
-		UCHAR   idx;
-		sprintf(custom, "ASSOCINFO(ReqIEs=");
-		for (idx=0; idx<pAd->StaCfg.ReqVarIELen; idx++)
-		        sprintf(custom, "%s%02x", custom, pAd->StaCfg.ReqVarIEs[idx]);
-		RtmpOSWrielessEventSend(pAd, IWEVCUSTOM, -1, NULL, custom, len);
-	}
-	else
-		DBGPRINT(RT_DEBUG_TRACE, ("len(%d) > MAX_CUSTOM_LEN\n", len));
-#endif
-
-	return 0;
-
-}
-#endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
-
-
-BOOLEAN StaAddMacTableEntry(
-	IN  PRTMP_ADAPTER		pAd,
-	IN  PMAC_TABLE_ENTRY	pEntry,
-	IN  UCHAR				MaxSupportedRateIn500Kbps,
-	IN  HT_CAPABILITY_IE	*pHtCapability,
-	IN  UCHAR				HtCapabilityLen,
-	IN  ADD_HT_INFO_IE		*pAddHtInfo,
-	IN  UCHAR				AddHtInfoLen,
-	IN  USHORT			CapabilityInfo)
-{
-	UCHAR            MaxSupportedRate = RATE_11;
-
-	if (ADHOC_ON(pAd))
-		CLIENT_STATUS_CLEAR_FLAG(pEntry, fCLIENT_STATUS_WMM_CAPABLE);
-
-	switch (MaxSupportedRateIn500Kbps)
-    {
-        case 108: MaxSupportedRate = RATE_54;   break;
-        case 96:  MaxSupportedRate = RATE_48;   break;
-        case 72:  MaxSupportedRate = RATE_36;   break;
-        case 48:  MaxSupportedRate = RATE_24;   break;
-        case 36:  MaxSupportedRate = RATE_18;   break;
-        case 24:  MaxSupportedRate = RATE_12;   break;
-        case 18:  MaxSupportedRate = RATE_9;    break;
-        case 12:  MaxSupportedRate = RATE_6;    break;
-        case 22:  MaxSupportedRate = RATE_11;   break;
-        case 11:  MaxSupportedRate = RATE_5_5;  break;
-        case 4:   MaxSupportedRate = RATE_2;    break;
-        case 2:   MaxSupportedRate = RATE_1;    break;
-        default:  MaxSupportedRate = RATE_11;   break;
-    }
-
-    if ((pAd->CommonCfg.PhyMode == PHY_11G) && (MaxSupportedRate < RATE_FIRST_OFDM_RATE))
-        return FALSE;
-
-#ifdef DOT11_N_SUPPORT
-	// 11n only
-	if (((pAd->CommonCfg.PhyMode == PHY_11N_2_4G) || (pAd->CommonCfg.PhyMode == PHY_11N_5G))&& (HtCapabilityLen == 0))
-		return FALSE;
-#endif // DOT11_N_SUPPORT //
-
-	if (!pEntry)
-        return FALSE;
-
-	NdisAcquireSpinLock(&pAd->MacTabLock);
-	if (pEntry)
-	{
-		pEntry->PortSecured = WPA_802_1X_PORT_SECURED;
-		if ((MaxSupportedRate < RATE_FIRST_OFDM_RATE) ||
-			(pAd->CommonCfg.PhyMode == PHY_11B))
-		{
-			pEntry->RateLen = 4;
-			if (MaxSupportedRate >= RATE_FIRST_OFDM_RATE)
-				MaxSupportedRate = RATE_11;
-		}
-		else
-			pEntry->RateLen = 12;
-
-		pEntry->MaxHTPhyMode.word = 0;
-		pEntry->MinHTPhyMode.word = 0;
-		pEntry->HTPhyMode.word = 0;
-		pEntry->MaxSupportedRate = MaxSupportedRate;
-		if (pEntry->MaxSupportedRate < RATE_FIRST_OFDM_RATE)
-		{
-			pEntry->MaxHTPhyMode.field.MODE = MODE_CCK;
-			pEntry->MaxHTPhyMode.field.MCS = pEntry->MaxSupportedRate;
-			pEntry->MinHTPhyMode.field.MODE = MODE_CCK;
-			pEntry->MinHTPhyMode.field.MCS = pEntry->MaxSupportedRate;
-			pEntry->HTPhyMode.field.MODE = MODE_CCK;
-			pEntry->HTPhyMode.field.MCS = pEntry->MaxSupportedRate;
-		}
-		else
-		{
-			pEntry->MaxHTPhyMode.field.MODE = MODE_OFDM;
-			pEntry->MaxHTPhyMode.field.MCS = OfdmRateToRxwiMCS[pEntry->MaxSupportedRate];
-			pEntry->MinHTPhyMode.field.MODE = MODE_OFDM;
-			pEntry->MinHTPhyMode.field.MCS = OfdmRateToRxwiMCS[pEntry->MaxSupportedRate];
-			pEntry->HTPhyMode.field.MODE = MODE_OFDM;
-			pEntry->HTPhyMode.field.MCS = OfdmRateToRxwiMCS[pEntry->MaxSupportedRate];
-		}
-		pEntry->CapabilityInfo = CapabilityInfo;
-		CLIENT_STATUS_CLEAR_FLAG(pEntry, fCLIENT_STATUS_AGGREGATION_CAPABLE);
-		CLIENT_STATUS_CLEAR_FLAG(pEntry, fCLIENT_STATUS_PIGGYBACK_CAPABLE);
-	}
-
-#ifdef DOT11_N_SUPPORT
-	NdisZeroMemory(&pEntry->HTCapability, sizeof(pEntry->HTCapability));
-	// If this Entry supports 802.11n, upgrade to HT rate.
-	if ((HtCapabilityLen != 0) && (pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED))
-	{
-		UCHAR	j, bitmask; //k,bitmask;
-		CHAR    i;
-
-		if (ADHOC_ON(pAd))
-			CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_WMM_CAPABLE);
-		if ((pHtCapability->HtCapInfo.GF) && (pAd->CommonCfg.DesiredHtPhy.GF))
-		{
-			pEntry->MaxHTPhyMode.field.MODE = MODE_HTGREENFIELD;
-		}
-		else
-		{
-			pEntry->MaxHTPhyMode.field.MODE = MODE_HTMIX;
-			pAd->MacTab.fAnyStationNonGF = TRUE;
-			pAd->CommonCfg.AddHTInfo.AddHtInfo2.NonGfPresent = 1;
-		}
-
-		if ((pHtCapability->HtCapInfo.ChannelWidth) &&
-			(pAd->CommonCfg.DesiredHtPhy.ChannelWidth) &&
-			((pAd->StaCfg.BssType == BSS_INFRA) || ((pAd->StaCfg.BssType == BSS_ADHOC) && (pAddHtInfo->AddHtInfo.ExtChanOffset == pAd->CommonCfg.AddHTInfo.AddHtInfo.ExtChanOffset))))
-		{
-			pEntry->MaxHTPhyMode.field.BW= BW_40;
-			pEntry->MaxHTPhyMode.field.ShortGI = ((pAd->CommonCfg.DesiredHtPhy.ShortGIfor40)&(pHtCapability->HtCapInfo.ShortGIfor40));
-		}
-		else
-		{
-			pEntry->MaxHTPhyMode.field.BW = BW_20;
-			pEntry->MaxHTPhyMode.field.ShortGI = ((pAd->CommonCfg.DesiredHtPhy.ShortGIfor20)&(pHtCapability->HtCapInfo.ShortGIfor20));
-			pAd->MacTab.fAnyStation20Only = TRUE;
-		}
-
-		// 3*3
-		if (pAd->MACVersion >= RALINK_2883_VERSION && pAd->MACVersion < RALINK_3070_VERSION)
-			pEntry->MaxHTPhyMode.field.TxBF = pAd->CommonCfg.RegTransmitSetting.field.TxBF;
-
-		// find max fixed rate
-		for (i=23; i>=0; i--) // 3*3
-		{
-			j = i/8;
-			bitmask = (1<<(i-(j*8)));
-			if ((pAd->StaCfg.DesiredHtPhyInfo.MCSSet[j] & bitmask) && (pHtCapability->MCSSet[j] & bitmask))
-			{
-				pEntry->MaxHTPhyMode.field.MCS = i;
-				break;
-			}
-			if (i==0)
-				break;
-		}
-
-
-		if (pAd->StaCfg.DesiredTransmitSetting.field.MCS != MCS_AUTO)
-		{
-			if (pAd->StaCfg.DesiredTransmitSetting.field.MCS == 32)
-			{
-				// Fix MCS as HT Duplicated Mode
-				pEntry->MaxHTPhyMode.field.BW = 1;
-				pEntry->MaxHTPhyMode.field.MODE = MODE_HTMIX;
-				pEntry->MaxHTPhyMode.field.STBC = 0;
-				pEntry->MaxHTPhyMode.field.ShortGI = 0;
-				pEntry->MaxHTPhyMode.field.MCS = 32;
-			}
-			else if (pEntry->MaxHTPhyMode.field.MCS > pAd->StaCfg.HTPhyMode.field.MCS)
-			{
-				// STA supports fixed MCS
-				pEntry->MaxHTPhyMode.field.MCS = pAd->StaCfg.HTPhyMode.field.MCS;
-			}
-		}
-
-		pEntry->MaxHTPhyMode.field.STBC = (pHtCapability->HtCapInfo.RxSTBC & (pAd->CommonCfg.DesiredHtPhy.TxSTBC));
-		pEntry->MpduDensity = pHtCapability->HtCapParm.MpduDensity;
-		pEntry->MaxRAmpduFactor = pHtCapability->HtCapParm.MaxRAmpduFactor;
-		pEntry->MmpsMode = (UCHAR)pHtCapability->HtCapInfo.MimoPs;
-		pEntry->AMsduSize = (UCHAR)pHtCapability->HtCapInfo.AMsduSize;
-		pEntry->HTPhyMode.word = pEntry->MaxHTPhyMode.word;
-
-		if (pAd->CommonCfg.DesiredHtPhy.AmsduEnable && (pAd->CommonCfg.REGBACapability.field.AutoBA == FALSE))
-			CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_AMSDU_INUSED);
-		if (pHtCapability->HtCapInfo.ShortGIfor20)
-			CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_SGI20_CAPABLE);
-		if (pHtCapability->HtCapInfo.ShortGIfor40)
-			CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_SGI40_CAPABLE);
-		if (pHtCapability->HtCapInfo.TxSTBC)
-			CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_TxSTBC_CAPABLE);
-		if (pHtCapability->HtCapInfo.RxSTBC)
-			CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_RxSTBC_CAPABLE);
-		if (pHtCapability->ExtHtCapInfo.PlusHTC)
-			CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_HTC_CAPABLE);
-		if (pAd->CommonCfg.bRdg && pHtCapability->ExtHtCapInfo.RDGSupport)
-			CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_RDG_CAPABLE);
-		if (pHtCapability->ExtHtCapInfo.MCSFeedback == 0x03)
-			CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_MCSFEEDBACK_CAPABLE);
-		NdisMoveMemory(&pEntry->HTCapability, pHtCapability, HtCapabilityLen);
-	}
-	else
-	{
-		pAd->MacTab.fAnyStationIsLegacy = TRUE;
-	}
-#endif // DOT11_N_SUPPORT //
-
-	pEntry->HTPhyMode.word = pEntry->MaxHTPhyMode.word;
-	pEntry->CurrTxRate = pEntry->MaxSupportedRate;
-
-	// Set asic auto fall back
-	if (pAd->StaCfg.bAutoTxRateSwitch == TRUE)
-	{
-		PUCHAR					pTable;
-		UCHAR					TableSize = 0;
-
-		MlmeSelectTxRateTable(pAd, pEntry, &pTable, &TableSize, &pEntry->CurrTxRateIndex);
-		pEntry->bAutoTxRateSwitch = TRUE;
-	}
-	else
-	{
-		pEntry->HTPhyMode.field.MODE	= pAd->StaCfg.HTPhyMode.field.MODE;
-		pEntry->HTPhyMode.field.MCS	= pAd->StaCfg.HTPhyMode.field.MCS;
-		pEntry->bAutoTxRateSwitch = FALSE;
-
-		// If the legacy mode is set, overwrite the transmit setting of this entry.
-		RTMPUpdateLegacyTxSetting((UCHAR)pAd->StaCfg.DesiredTransmitSetting.field.FixedTxMode, pEntry);
-	}
-
-	pEntry->PortSecured = WPA_802_1X_PORT_SECURED;
-	pEntry->Sst = SST_ASSOC;
-	pEntry->AuthState = AS_AUTH_OPEN;
-	pEntry->AuthMode = pAd->StaCfg.AuthMode;
-	pEntry->WepStatus = pAd->StaCfg.WepStatus;
-
-	NdisReleaseSpinLock(&pAd->MacTabLock);
-
-#ifdef WPA_SUPPLICANT_SUPPORT
-#ifndef NATIVE_WPA_SUPPLICANT_SUPPORT
-    if (pAd->StaCfg.WpaSupplicantUP)
-    {
-        union iwreq_data    wrqu;
-
-        SendAssocIEsToWpaSupplicant(pAd);
-        memset(&wrqu, 0, sizeof(wrqu));
-        wrqu.data.flags = RT_ASSOC_EVENT_FLAG;
-        wireless_send_event(pAd->net_dev, IWEVCUSTOM, &wrqu, NULL);
-    }
-#endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
-#endif // WPA_SUPPLICANT_SUPPORT //
-
-#ifdef NATIVE_WPA_SUPPLICANT_SUPPORT
-    {
-        union iwreq_data    wrqu;
-        wext_notify_event_assoc(pAd);
-
-        memset(wrqu.ap_addr.sa_data, 0, MAC_ADDR_LEN);
-        memcpy(wrqu.ap_addr.sa_data, pAd->MlmeAux.Bssid, MAC_ADDR_LEN);
-        wireless_send_event(pAd->net_dev, SIOCGIWAP, &wrqu, NULL);
-
-    }
-#endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
-	return TRUE;
-}
diff --git a/drivers/staging/rt3090/sta/auth.c b/drivers/staging/rt3090/sta/auth.c
deleted file mode 100644
index 157e2999fa19..000000000000
--- a/drivers/staging/rt3090/sta/auth.c
+++ /dev/null
@@ -1,491 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-	Module Name:
-	auth.c
-
-	Abstract:
-
-	Revision History:
-	Who			When			What
-	--------	----------		----------------------------------------------
-	John		2004-9-3		porting from RT2500
-*/
-
-#include "../rt_config.h"
-
-
-/*
-    ==========================================================================
-    Description:
-        authenticate state machine init, including state transition and timer init
-    Parameters:
-        Sm - pointer to the auth state machine
-    Note:
-        The state machine looks like this
-
-                        AUTH_REQ_IDLE           AUTH_WAIT_SEQ2                   AUTH_WAIT_SEQ4
-    MT2_MLME_AUTH_REQ   mlme_auth_req_action    invalid_state_when_auth          invalid_state_when_auth
-    MT2_PEER_AUTH_EVEN  drop                    peer_auth_even_at_seq2_action    peer_auth_even_at_seq4_action
-    MT2_AUTH_TIMEOUT    Drop                    auth_timeout_action              auth_timeout_action
-
-	IRQL = PASSIVE_LEVEL
-
-    ==========================================================================
- */
-
-void AuthStateMachineInit(
-    IN PRTMP_ADAPTER pAd,
-    IN STATE_MACHINE *Sm,
-    OUT STATE_MACHINE_FUNC Trans[])
-{
-    StateMachineInit(Sm, Trans, MAX_AUTH_STATE, MAX_AUTH_MSG, (STATE_MACHINE_FUNC)Drop, AUTH_REQ_IDLE, AUTH_MACHINE_BASE);
-
-    // the first column
-    StateMachineSetAction(Sm, AUTH_REQ_IDLE, MT2_MLME_AUTH_REQ, (STATE_MACHINE_FUNC)MlmeAuthReqAction);
-
-    // the second column
-    StateMachineSetAction(Sm, AUTH_WAIT_SEQ2, MT2_MLME_AUTH_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenAuth);
-    StateMachineSetAction(Sm, AUTH_WAIT_SEQ2, MT2_PEER_AUTH_EVEN, (STATE_MACHINE_FUNC)PeerAuthRspAtSeq2Action);
-    StateMachineSetAction(Sm, AUTH_WAIT_SEQ2, MT2_AUTH_TIMEOUT, (STATE_MACHINE_FUNC)AuthTimeoutAction);
-
-    // the third column
-    StateMachineSetAction(Sm, AUTH_WAIT_SEQ4, MT2_MLME_AUTH_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenAuth);
-    StateMachineSetAction(Sm, AUTH_WAIT_SEQ4, MT2_PEER_AUTH_EVEN, (STATE_MACHINE_FUNC)PeerAuthRspAtSeq4Action);
-    StateMachineSetAction(Sm, AUTH_WAIT_SEQ4, MT2_AUTH_TIMEOUT, (STATE_MACHINE_FUNC)AuthTimeoutAction);
-
-	RTMPInitTimer(pAd, &pAd->MlmeAux.AuthTimer, GET_TIMER_FUNCTION(AuthTimeout), pAd, FALSE);
-}
-
-/*
-    ==========================================================================
-    Description:
-        function to be executed at timer thread when auth timer expires
-
-	IRQL = DISPATCH_LEVEL
-
-    ==========================================================================
- */
-VOID AuthTimeout(
-    IN PVOID SystemSpecific1,
-    IN PVOID FunctionContext,
-    IN PVOID SystemSpecific2,
-    IN PVOID SystemSpecific3)
-{
-    RTMP_ADAPTER *pAd = (RTMP_ADAPTER *)FunctionContext;
-
-    DBGPRINT(RT_DEBUG_TRACE,("AUTH - AuthTimeout\n"));
-
-	// Do nothing if the driver is starting halt state.
-	// This might happen when timer already been fired before cancel timer with mlmehalt
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS | fRTMP_ADAPTER_NIC_NOT_EXIST))
-		return;
-
-	// send a de-auth to reset AP's state machine (Patch AP-Dir635)
-	if (pAd->Mlme.AuthMachine.CurrState == AUTH_WAIT_SEQ2)
-		Cls2errAction(pAd, pAd->MlmeAux.Bssid);
-
-
-    MlmeEnqueue(pAd, AUTH_STATE_MACHINE, MT2_AUTH_TIMEOUT, 0, NULL);
-    RTMP_MLME_HANDLER(pAd);
-}
-
-
-/*
-    ==========================================================================
-    Description:
-
-	IRQL = DISPATCH_LEVEL
-
-    ==========================================================================
- */
-VOID MlmeAuthReqAction(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem)
-{
-	if (AUTH_ReqSend(pAd, Elem, &pAd->MlmeAux.AuthTimer, "AUTH", 1, NULL, 0))
-        pAd->Mlme.AuthMachine.CurrState = AUTH_WAIT_SEQ2;
-    else
-    {
-		USHORT Status;
-
-        pAd->Mlme.AuthMachine.CurrState = AUTH_REQ_IDLE;
-        Status = MLME_INVALID_FORMAT;
-        MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_AUTH_CONF, 2, &Status);
-    }
-}
-
-/*
-    ==========================================================================
-    Description:
-
-	IRQL = DISPATCH_LEVEL
-
-    ==========================================================================
- */
-VOID PeerAuthRspAtSeq2Action(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem)
-{
-    UCHAR         Addr2[MAC_ADDR_LEN];
-    USHORT        Seq, Status, RemoteStatus, Alg;
-    UCHAR         ChlgText[CIPHER_TEXT_LEN];
-    UCHAR         CyperChlgText[CIPHER_TEXT_LEN + 8 + 8];
-    UCHAR         Element[2];
-    HEADER_802_11 AuthHdr;
-    BOOLEAN       TimerCancelled;
-    PUCHAR        pOutBuffer = NULL;
-    NDIS_STATUS   NStatus;
-    ULONG         FrameLen = 0;
-    USHORT        Status2;
-
-    if (PeerAuthSanity(pAd, Elem->Msg, Elem->MsgLen, Addr2, &Alg, &Seq, &Status, (PCHAR)ChlgText))
-    {
-        if (MAC_ADDR_EQUAL(pAd->MlmeAux.Bssid, Addr2) && Seq == 2)
-        {
-            DBGPRINT(RT_DEBUG_TRACE, ("AUTH - Receive AUTH_RSP seq#2 to me (Alg=%d, Status=%d)\n", Alg, Status));
-            RTMPCancelTimer(&pAd->MlmeAux.AuthTimer, &TimerCancelled);
-
-            if (Status == MLME_SUCCESS)
-            {
-                // Authentication Mode "LEAP" has allow for CCX 1.X
-                if (pAd->MlmeAux.Alg == Ndis802_11AuthModeOpen)
-                {
-                    pAd->Mlme.AuthMachine.CurrState = AUTH_REQ_IDLE;
-                    MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_AUTH_CONF, 2, &Status);
-                }
-                else
-                {
-                    // 2. shared key, need to be challenged
-                    Seq++;
-                    RemoteStatus = MLME_SUCCESS;
-
-					// Get an unused nonpaged memory
-                    NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);
-                    if(NStatus != NDIS_STATUS_SUCCESS)
-                    {
-                        DBGPRINT(RT_DEBUG_TRACE, ("AUTH - PeerAuthRspAtSeq2Action() allocate memory fail\n"));
-                        pAd->Mlme.AuthMachine.CurrState = AUTH_REQ_IDLE;
-                        Status2 = MLME_FAIL_NO_RESOURCE;
-                        MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_AUTH_CONF, 2, &Status2);
-                        return;
-                    }
-
-                    DBGPRINT(RT_DEBUG_TRACE, ("AUTH - Send AUTH request seq#3...\n"));
-                    MgtMacHeaderInit(pAd, &AuthHdr, SUBTYPE_AUTH, 0, Addr2, pAd->MlmeAux.Bssid);
-                    AuthHdr.FC.Wep = 1;
-                    // Encrypt challenge text & auth information
-                    RTMPInitWepEngine(
-			pAd,
-			pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].Key,
-			pAd->StaCfg.DefaultKeyId,
-			pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].KeyLen,
-			CyperChlgText);
-
-					Alg = cpu2le16(*(USHORT *)&Alg);
-					Seq = cpu2le16(*(USHORT *)&Seq);
-					RemoteStatus= cpu2le16(*(USHORT *)&RemoteStatus);
-
-					RTMPEncryptData(pAd, (PUCHAR) &Alg, CyperChlgText + 4, 2);
-					RTMPEncryptData(pAd, (PUCHAR) &Seq, CyperChlgText + 6, 2);
-					RTMPEncryptData(pAd, (PUCHAR) &RemoteStatus, CyperChlgText + 8, 2);
-					Element[0] = 16;
-					Element[1] = 128;
-					RTMPEncryptData(pAd, Element, CyperChlgText + 10, 2);
-					RTMPEncryptData(pAd, ChlgText, CyperChlgText + 12, 128);
-					RTMPSetICV(pAd, CyperChlgText + 140);
-                    MakeOutgoingFrame(pOutBuffer,               &FrameLen,
-                                      sizeof(HEADER_802_11),    &AuthHdr,
-                                      CIPHER_TEXT_LEN + 16,     CyperChlgText,
-                                      END_OF_ARGS);
-                    MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
-			MlmeFreeMemory(pAd, pOutBuffer);
-
-                    RTMPSetTimer(&pAd->MlmeAux.AuthTimer, AUTH_TIMEOUT);
-                    pAd->Mlme.AuthMachine.CurrState = AUTH_WAIT_SEQ4;
-                }
-            }
-            else
-            {
-                pAd->StaCfg.AuthFailReason = Status;
-                COPY_MAC_ADDR(pAd->StaCfg.AuthFailSta, Addr2);
-                pAd->Mlme.AuthMachine.CurrState = AUTH_REQ_IDLE;
-                MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_AUTH_CONF, 2, &Status);
-            }
-        }
-    }
-    else
-    {
-        DBGPRINT(RT_DEBUG_TRACE, ("AUTH - PeerAuthSanity() sanity check fail\n"));
-    }
-}
-
-/*
-    ==========================================================================
-    Description:
-
-	IRQL = DISPATCH_LEVEL
-
-    ==========================================================================
- */
-VOID PeerAuthRspAtSeq4Action(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem)
-{
-    UCHAR         Addr2[MAC_ADDR_LEN];
-    USHORT        Alg, Seq, Status;
-    CHAR          ChlgText[CIPHER_TEXT_LEN];
-    BOOLEAN       TimerCancelled;
-
-    if(PeerAuthSanity(pAd, Elem->Msg, Elem->MsgLen, Addr2, &Alg, &Seq, &Status, ChlgText))
-    {
-        if(MAC_ADDR_EQUAL(pAd->MlmeAux.Bssid, Addr2) && Seq == 4)
-        {
-            DBGPRINT(RT_DEBUG_TRACE, ("AUTH - Receive AUTH_RSP seq#4 to me\n"));
-            RTMPCancelTimer(&pAd->MlmeAux.AuthTimer, &TimerCancelled);
-
-            if (Status != MLME_SUCCESS)
-            {
-                pAd->StaCfg.AuthFailReason = Status;
-                COPY_MAC_ADDR(pAd->StaCfg.AuthFailSta, Addr2);
-            }
-
-            pAd->Mlme.AuthMachine.CurrState = AUTH_REQ_IDLE;
-            MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_AUTH_CONF, 2, &Status);
-        }
-    }
-    else
-    {
-        DBGPRINT(RT_DEBUG_TRACE, ("AUTH - PeerAuthRspAtSeq4Action() sanity check fail\n"));
-    }
-}
-
-/*
-    ==========================================================================
-    Description:
-
-	IRQL = DISPATCH_LEVEL
-
-    ==========================================================================
- */
-VOID MlmeDeauthReqAction(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem)
-{
-    MLME_DEAUTH_REQ_STRUCT *pInfo;
-    HEADER_802_11 DeauthHdr;
-    PUCHAR        pOutBuffer = NULL;
-    NDIS_STATUS   NStatus;
-    ULONG         FrameLen = 0;
-    USHORT        Status;
-
-    pInfo = (MLME_DEAUTH_REQ_STRUCT *)Elem->Msg;
-
-    NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);  //Get an unused nonpaged memory
-    if (NStatus != NDIS_STATUS_SUCCESS)
-    {
-        DBGPRINT(RT_DEBUG_TRACE, ("AUTH - MlmeDeauthReqAction() allocate memory fail\n"));
-        pAd->Mlme.AuthMachine.CurrState = AUTH_REQ_IDLE;
-        Status = MLME_FAIL_NO_RESOURCE;
-        MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_DEAUTH_CONF, 2, &Status);
-        return;
-    }
-
-
-    DBGPRINT(RT_DEBUG_TRACE, ("AUTH - Send DE-AUTH request (Reason=%d)...\n", pInfo->Reason));
-    MgtMacHeaderInit(pAd, &DeauthHdr, SUBTYPE_DEAUTH, 0, pInfo->Addr, pAd->MlmeAux.Bssid);
-    MakeOutgoingFrame(pOutBuffer,           &FrameLen,
-                      sizeof(HEADER_802_11),&DeauthHdr,
-                      2,                    &pInfo->Reason,
-                      END_OF_ARGS);
-    MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
-	MlmeFreeMemory(pAd, pOutBuffer);
-
-    pAd->StaCfg.DeauthReason = pInfo->Reason;
-    COPY_MAC_ADDR(pAd->StaCfg.DeauthSta, pInfo->Addr);
-    pAd->Mlme.AuthMachine.CurrState = AUTH_REQ_IDLE;
-    Status = MLME_SUCCESS;
-    MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_DEAUTH_CONF, 2, &Status);
-
-	// send wireless event - for deauthentication
-	if (pAd->CommonCfg.bWirelessEvent)
-		RTMPSendWirelessEvent(pAd, IW_DEAUTH_EVENT_FLAG, pAd->MacTab.Content[BSSID_WCID].Addr, BSS0, 0);
-}
-
-/*
-    ==========================================================================
-    Description:
-
-	IRQL = DISPATCH_LEVEL
-
-    ==========================================================================
- */
-VOID AuthTimeoutAction(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem)
-{
-    USHORT Status;
-    DBGPRINT(RT_DEBUG_TRACE, ("AUTH - AuthTimeoutAction\n"));
-    pAd->Mlme.AuthMachine.CurrState = AUTH_REQ_IDLE;
-    Status = MLME_REJ_TIMEOUT;
-    MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_AUTH_CONF, 2, &Status);
-}
-
-/*
-    ==========================================================================
-    Description:
-
-	IRQL = DISPATCH_LEVEL
-
-    ==========================================================================
- */
-VOID InvalidStateWhenAuth(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem)
-{
-    USHORT Status;
-    DBGPRINT(RT_DEBUG_TRACE, ("AUTH - InvalidStateWhenAuth (state=%ld), reset AUTH state machine\n", pAd->Mlme.AuthMachine.CurrState));
-    pAd->Mlme.AuthMachine.CurrState = AUTH_REQ_IDLE;
-    Status = MLME_STATE_MACHINE_REJECT;
-    MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_AUTH_CONF, 2, &Status);
-}
-
-/*
-    ==========================================================================
-    Description:
-        Some STA/AP
-    Note:
-        This action should never trigger AUTH state transition, therefore we
-        separate it from AUTH state machine, and make it as a standalone service
-
-	IRQL = DISPATCH_LEVEL
-
-    ==========================================================================
- */
-VOID Cls2errAction(
-    IN PRTMP_ADAPTER pAd,
-    IN PUCHAR pAddr)
-{
-    HEADER_802_11 DeauthHdr;
-    PUCHAR        pOutBuffer = NULL;
-    NDIS_STATUS   NStatus;
-    ULONG         FrameLen = 0;
-    USHORT        Reason = REASON_CLS2ERR;
-
-    NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);  //Get an unused nonpaged memory
-    if (NStatus != NDIS_STATUS_SUCCESS)
-        return;
-
-    DBGPRINT(RT_DEBUG_TRACE, ("AUTH - Class 2 error, Send DEAUTH frame...\n"));
-    MgtMacHeaderInit(pAd, &DeauthHdr, SUBTYPE_DEAUTH, 0, pAddr, pAd->MlmeAux.Bssid);
-    MakeOutgoingFrame(pOutBuffer,           &FrameLen,
-                      sizeof(HEADER_802_11),&DeauthHdr,
-                      2,                    &Reason,
-                      END_OF_ARGS);
-    MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
-	MlmeFreeMemory(pAd, pOutBuffer);
-
-    pAd->StaCfg.DeauthReason = Reason;
-    COPY_MAC_ADDR(pAd->StaCfg.DeauthSta, pAddr);
-}
-
-BOOLEAN	AUTH_ReqSend(
-	IN  PRTMP_ADAPTER		pAd,
-	IN  PMLME_QUEUE_ELEM	pElem,
-	IN  PRALINK_TIMER_STRUCT pAuthTimer,
-	IN  PSTRING				pSMName,
-	IN  USHORT				SeqNo,
-	IN  PUCHAR				pNewElement,
-	IN  ULONG				ElementLen)
-{
-	USHORT             Alg, Seq, Status;
-	UCHAR              Addr[6];
-    ULONG              Timeout;
-    HEADER_802_11      AuthHdr;
-    BOOLEAN            TimerCancelled;
-    NDIS_STATUS        NStatus;
-    PUCHAR             pOutBuffer = NULL;
-    ULONG              FrameLen = 0, tmp = 0;
-
-	// Block all authentication request durning WPA block period
-	if (pAd->StaCfg.bBlockAssoc == TRUE)
-	{
-        DBGPRINT(RT_DEBUG_TRACE, ("%s - Block Auth request durning WPA block period!\n", pSMName));
-        pAd->Mlme.AuthMachine.CurrState = AUTH_REQ_IDLE;
-        Status = MLME_STATE_MACHINE_REJECT;
-        MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_AUTH_CONF, 2, &Status);
-	}
-    else if(MlmeAuthReqSanity(pAd, pElem->Msg, pElem->MsgLen, Addr, &Timeout, &Alg))
-    {
-	/* reset timer */
-		RTMPCancelTimer(pAuthTimer, &TimerCancelled);
-
-        COPY_MAC_ADDR(pAd->MlmeAux.Bssid, Addr);
-        pAd->MlmeAux.Alg  = Alg;
-        Seq = SeqNo;
-        Status = MLME_SUCCESS;
-
-        NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);  //Get an unused nonpaged memory
-        if(NStatus != NDIS_STATUS_SUCCESS)
-        {
-            DBGPRINT(RT_DEBUG_TRACE, ("%s - MlmeAuthReqAction(Alg:%d) allocate memory failed\n", pSMName, Alg));
-            pAd->Mlme.AuthMachine.CurrState = AUTH_REQ_IDLE;
-            Status = MLME_FAIL_NO_RESOURCE;
-            MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_AUTH_CONF, 2, &Status);
-            return FALSE;
-        }
-
-        DBGPRINT(RT_DEBUG_TRACE, ("%s - Send AUTH request seq#1 (Alg=%d)...\n", pSMName, Alg));
-        MgtMacHeaderInit(pAd, &AuthHdr, SUBTYPE_AUTH, 0, Addr, pAd->MlmeAux.Bssid);
-        MakeOutgoingFrame(pOutBuffer,           &FrameLen,
-                          sizeof(HEADER_802_11),&AuthHdr,
-                          2,                    &Alg,
-                          2,                    &Seq,
-                          2,                    &Status,
-                          END_OF_ARGS);
-
-		if (pNewElement && ElementLen)
-		{
-			MakeOutgoingFrame(pOutBuffer+FrameLen,	&tmp,
-							  ElementLen,			pNewElement,
-				  END_OF_ARGS);
-			FrameLen += tmp;
-		}
-
-        MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
-	MlmeFreeMemory(pAd, pOutBuffer);
-
-		RTMPSetTimer(pAuthTimer, Timeout);
-		return TRUE;
-    }
-    else
-    {
-        DBGPRINT_ERR(("%s - MlmeAuthReqAction() sanity check failed\n", pSMName));
-		return FALSE;
-    }
-
-	return TRUE;
-}
diff --git a/drivers/staging/rt3090/sta/auth_rsp.c b/drivers/staging/rt3090/sta/auth_rsp.c
deleted file mode 100644
index 207bfeada1e4..000000000000
--- a/drivers/staging/rt3090/sta/auth_rsp.c
+++ /dev/null
@@ -1,151 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-	Module Name:
-	auth_rsp.c
-
-	Abstract:
-
-	Revision History:
-	Who			When			What
-	--------	----------		----------------------------------------------
-	John		2004-10-1		copy from RT2560
-*/
-
-#include "../rt_config.h"
-
-
-/*
-    ==========================================================================
-    Description:
-        authentication state machine init procedure
-    Parameters:
-        Sm - the state machine
-
-	IRQL = PASSIVE_LEVEL
-
-    ==========================================================================
- */
-VOID AuthRspStateMachineInit(
-    IN PRTMP_ADAPTER pAd,
-    IN PSTATE_MACHINE Sm,
-    IN STATE_MACHINE_FUNC Trans[])
-{
-    StateMachineInit(Sm, Trans, MAX_AUTH_RSP_STATE, MAX_AUTH_RSP_MSG, (STATE_MACHINE_FUNC)Drop, AUTH_RSP_IDLE, AUTH_RSP_MACHINE_BASE);
-
-    // column 1
-    StateMachineSetAction(Sm, AUTH_RSP_IDLE, MT2_PEER_DEAUTH, (STATE_MACHINE_FUNC)PeerDeauthAction);
-
-    // column 2
-    StateMachineSetAction(Sm, AUTH_RSP_WAIT_CHAL, MT2_PEER_DEAUTH, (STATE_MACHINE_FUNC)PeerDeauthAction);
-
-}
-
-/*
-    ==========================================================================
-    Description:
-
-	IRQL = DISPATCH_LEVEL
-
-    ==========================================================================
-*/
-VOID PeerAuthSimpleRspGenAndSend(
-    IN PRTMP_ADAPTER pAd,
-    IN PHEADER_802_11 pHdr80211,
-    IN USHORT Alg,
-    IN USHORT Seq,
-    IN USHORT Reason,
-    IN USHORT Status)
-{
-    HEADER_802_11     AuthHdr;
-    ULONG             FrameLen = 0;
-    PUCHAR            pOutBuffer = NULL;
-    NDIS_STATUS       NStatus;
-
-    if (Reason != MLME_SUCCESS)
-    {
-        DBGPRINT(RT_DEBUG_TRACE, ("Peer AUTH fail...\n"));
-        return;
-    }
-
-	//Get an unused nonpaged memory
-    NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);
-    if (NStatus != NDIS_STATUS_SUCCESS)
-        return;
-
-    DBGPRINT(RT_DEBUG_TRACE, ("Send AUTH response (seq#2)...\n"));
-    MgtMacHeaderInit(pAd, &AuthHdr, SUBTYPE_AUTH, 0, pHdr80211->Addr2, pAd->MlmeAux.Bssid);
-    MakeOutgoingFrame(pOutBuffer,               &FrameLen,
-                      sizeof(HEADER_802_11),    &AuthHdr,
-                      2,                        &Alg,
-                      2,                        &Seq,
-                      2,                        &Reason,
-                      END_OF_ARGS);
-    MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
-	MlmeFreeMemory(pAd, pOutBuffer);
-}
-
-/*
-    ==========================================================================
-    Description:
-
-	IRQL = DISPATCH_LEVEL
-
-    ==========================================================================
-*/
-VOID PeerDeauthAction(
-    IN PRTMP_ADAPTER pAd,
-    IN PMLME_QUEUE_ELEM Elem)
-{
-    UCHAR       Addr2[MAC_ADDR_LEN];
-    USHORT      Reason;
-
-    if (PeerDeauthSanity(pAd, Elem->Msg, Elem->MsgLen, Addr2, &Reason))
-    {
-        if (INFRA_ON(pAd)
-			&& MAC_ADDR_EQUAL(Addr2, pAd->CommonCfg.Bssid)
-			)
-        {
-            DBGPRINT(RT_DEBUG_TRACE,("AUTH_RSP - receive DE-AUTH from our AP (Reason=%d)\n", Reason));
-
-
-#ifdef NATIVE_WPA_SUPPLICANT_SUPPORT
-		RtmpOSWrielessEventSend(pAd, SIOCGIWAP, -1, NULL, NULL, 0);
-#endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
-
-
-			// send wireless event - for deauthentication
-			if (pAd->CommonCfg.bWirelessEvent)
-				RTMPSendWirelessEvent(pAd, IW_DEAUTH_EVENT_FLAG, pAd->MacTab.Content[BSSID_WCID].Addr, BSS0, 0);
-
-            LinkDown(pAd, TRUE);
-        }
-    }
-    else
-    {
-        DBGPRINT(RT_DEBUG_TRACE,("AUTH_RSP - PeerDeauthAction() sanity check fail\n"));
-    }
-}
diff --git a/drivers/staging/rt3090/sta/connect.c b/drivers/staging/rt3090/sta/connect.c
deleted file mode 100644
index 4aa35ee3ade1..000000000000
--- a/drivers/staging/rt3090/sta/connect.c
+++ /dev/null
@@ -1,2759 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-	Module Name:
-	connect.c
-
-	Abstract:
-
-	Revision History:
-	Who			When			What
-	--------	----------		----------------------------------------------
-	John			2004-08-08			Major modification from RT2560
-*/
-
-#include "../rt_config.h"
-
-
-UCHAR	CipherSuiteWpaNoneTkip[] = {
-		0x00, 0x50, 0xf2, 0x01,	// oui
-		0x01, 0x00,				// Version
-		0x00, 0x50, 0xf2, 0x02,	// Multicast
-		0x01, 0x00,				// Number of unicast
-		0x00, 0x50, 0xf2, 0x02,	// unicast
-		0x01, 0x00,				// number of authentication method
-		0x00, 0x50, 0xf2, 0x00	// authentication
-		};
-UCHAR	CipherSuiteWpaNoneTkipLen = (sizeof(CipherSuiteWpaNoneTkip) / sizeof(UCHAR));
-
-UCHAR	CipherSuiteWpaNoneAes[] = {
-		0x00, 0x50, 0xf2, 0x01,	// oui
-		0x01, 0x00,				// Version
-		0x00, 0x50, 0xf2, 0x04,	// Multicast
-		0x01, 0x00,				// Number of unicast
-		0x00, 0x50, 0xf2, 0x04,	// unicast
-		0x01, 0x00,				// number of authentication method
-		0x00, 0x50, 0xf2, 0x00	// authentication
-		};
-UCHAR	CipherSuiteWpaNoneAesLen = (sizeof(CipherSuiteWpaNoneAes) / sizeof(UCHAR));
-
-// The following MACRO is called after 1. starting an new IBSS, 2. succesfully JOIN an IBSS,
-// or 3. succesfully ASSOCIATE to a BSS, 4. successfully RE_ASSOCIATE to a BSS
-// All settings successfuly negotiated furing MLME state machines become final settings
-// and are copied to pAd->StaActive
-#define COPY_SETTINGS_FROM_MLME_AUX_TO_ACTIVE_CFG(_pAd)                                 \
-{                                                                                       \
-	NdisZeroMemory((_pAd)->CommonCfg.Ssid, MAX_LEN_OF_SSID);							\
-	(_pAd)->CommonCfg.SsidLen = (_pAd)->MlmeAux.SsidLen;                                \
-	NdisMoveMemory((_pAd)->CommonCfg.Ssid, (_pAd)->MlmeAux.Ssid, (_pAd)->MlmeAux.SsidLen); \
-	COPY_MAC_ADDR((_pAd)->CommonCfg.Bssid, (_pAd)->MlmeAux.Bssid);                      \
-	(_pAd)->CommonCfg.Channel = (_pAd)->MlmeAux.Channel;                                \
-	(_pAd)->CommonCfg.CentralChannel = (_pAd)->MlmeAux.CentralChannel;                  \
-	(_pAd)->StaActive.Aid = (_pAd)->MlmeAux.Aid;                                        \
-	(_pAd)->StaActive.AtimWin = (_pAd)->MlmeAux.AtimWin;                                \
-	(_pAd)->StaActive.CapabilityInfo = (_pAd)->MlmeAux.CapabilityInfo;                  \
-	(_pAd)->CommonCfg.BeaconPeriod = (_pAd)->MlmeAux.BeaconPeriod;                      \
-	(_pAd)->StaActive.CfpMaxDuration = (_pAd)->MlmeAux.CfpMaxDuration;                  \
-	(_pAd)->StaActive.CfpPeriod = (_pAd)->MlmeAux.CfpPeriod;                            \
-	(_pAd)->StaActive.SupRateLen = (_pAd)->MlmeAux.SupRateLen;                          \
-	NdisMoveMemory((_pAd)->StaActive.SupRate, (_pAd)->MlmeAux.SupRate, (_pAd)->MlmeAux.SupRateLen);\
-	(_pAd)->StaActive.ExtRateLen = (_pAd)->MlmeAux.ExtRateLen;                          \
-	NdisMoveMemory((_pAd)->StaActive.ExtRate, (_pAd)->MlmeAux.ExtRate, (_pAd)->MlmeAux.ExtRateLen);\
-	NdisMoveMemory(&(_pAd)->CommonCfg.APEdcaParm, &(_pAd)->MlmeAux.APEdcaParm, sizeof(EDCA_PARM));\
-	NdisMoveMemory(&(_pAd)->CommonCfg.APQosCapability, &(_pAd)->MlmeAux.APQosCapability, sizeof(QOS_CAPABILITY_PARM));\
-	NdisMoveMemory(&(_pAd)->CommonCfg.APQbssLoad, &(_pAd)->MlmeAux.APQbssLoad, sizeof(QBSS_LOAD_PARM));\
-	COPY_MAC_ADDR((_pAd)->MacTab.Content[BSSID_WCID].Addr, (_pAd)->MlmeAux.Bssid);      \
-	(_pAd)->MacTab.Content[BSSID_WCID].Aid = (_pAd)->MlmeAux.Aid;                       \
-	(_pAd)->MacTab.Content[BSSID_WCID].PairwiseKey.CipherAlg = (_pAd)->StaCfg.PairCipher;\
-	COPY_MAC_ADDR((_pAd)->MacTab.Content[BSSID_WCID].PairwiseKey.BssId, (_pAd)->MlmeAux.Bssid);\
-	(_pAd)->MacTab.Content[BSSID_WCID].RateLen = (_pAd)->StaActive.SupRateLen + (_pAd)->StaActive.ExtRateLen;\
-}
-
-/*
-	==========================================================================
-	Description:
-
-	IRQL = PASSIVE_LEVEL
-
-	==========================================================================
-*/
-VOID MlmeCntlInit(
-	IN PRTMP_ADAPTER pAd,
-	IN STATE_MACHINE *S,
-	OUT STATE_MACHINE_FUNC Trans[])
-{
-	// Control state machine differs from other state machines, the interface
-	// follows the standard interface
-	pAd->Mlme.CntlMachine.CurrState = CNTL_IDLE;
-}
-
-/*
-	==========================================================================
-	Description:
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
-*/
-VOID MlmeCntlMachinePerformAction(
-	IN PRTMP_ADAPTER pAd,
-	IN STATE_MACHINE *S,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-	switch(pAd->Mlme.CntlMachine.CurrState)
-	{
-		case CNTL_IDLE:
-			CntlIdleProc(pAd, Elem);
-			break;
-		case CNTL_WAIT_DISASSOC:
-			CntlWaitDisassocProc(pAd, Elem);
-			break;
-		case CNTL_WAIT_JOIN:
-			CntlWaitJoinProc(pAd, Elem);
-			break;
-
-		// CNTL_WAIT_REASSOC is the only state in CNTL machine that does
-		// not triggered directly or indirectly by "RTMPSetInformation(OID_xxx)".
-		// Therefore not protected by NDIS's "only one outstanding OID request"
-		// rule. Which means NDIS may SET OID in the middle of ROAMing attempts.
-		// Current approach is to block new SET request at RTMPSetInformation()
-		// when CntlMachine.CurrState is not CNTL_IDLE
-		case CNTL_WAIT_REASSOC:
-			CntlWaitReassocProc(pAd, Elem);
-			break;
-
-		case CNTL_WAIT_START:
-			CntlWaitStartProc(pAd, Elem);
-			break;
-		case CNTL_WAIT_AUTH:
-			CntlWaitAuthProc(pAd, Elem);
-			break;
-		case CNTL_WAIT_AUTH2:
-			CntlWaitAuthProc2(pAd, Elem);
-			break;
-		case CNTL_WAIT_ASSOC:
-			CntlWaitAssocProc(pAd, Elem);
-			break;
-
-		case CNTL_WAIT_OID_LIST_SCAN:
-			if(Elem->MsgType == MT2_SCAN_CONF)
-			{
-				// Resume TxRing after SCANING complete. We hope the out-of-service time
-				// won't be too long to let upper layer time-out the waiting frames
-				RTMPResumeMsduTransmission(pAd);
-
-				pAd->Mlme.CntlMachine.CurrState = CNTL_IDLE;
-
-                //
-				// Set LED status to previous status.
-				//
-				if (pAd->bLedOnScanning)
-				{
-					pAd->bLedOnScanning = FALSE;
-					RTMPSetLED(pAd, pAd->LedStatus);
-				}
-#ifdef DOT11N_DRAFT3
-				// AP sent a 2040Coexistence mgmt frame, then station perform a scan, and then send back the respone.
-				if (pAd->CommonCfg.BSSCoexist2040.field.InfoReq == 1)
-				{
-					Update2040CoexistFrameAndNotify(pAd, BSSID_WCID, TRUE);
-				}
-#endif // DOT11N_DRAFT3 //
-			}
-			break;
-
-		case CNTL_WAIT_OID_DISASSOC:
-			if (Elem->MsgType == MT2_DISASSOC_CONF)
-			{
-				LinkDown(pAd, FALSE);
-				pAd->Mlme.CntlMachine.CurrState = CNTL_IDLE;
-			}
-			break;
-		default:
-			DBGPRINT_ERR(("!ERROR! CNTL - Illegal message type(=%ld)", Elem->MsgType));
-			break;
-	}
-}
-
-
-/*
-	==========================================================================
-	Description:
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
-*/
-VOID CntlIdleProc(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-	MLME_DISASSOC_REQ_STRUCT   DisassocReq;
-
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RADIO_OFF))
-		return;
-
-	switch(Elem->MsgType)
-	{
-		case OID_802_11_SSID:
-			CntlOidSsidProc(pAd, Elem);
-			break;
-
-		case OID_802_11_BSSID:
-			CntlOidRTBssidProc(pAd,Elem);
-			break;
-
-		case OID_802_11_BSSID_LIST_SCAN:
-			CntlOidScanProc(pAd,Elem);
-			break;
-
-		case OID_802_11_DISASSOCIATE:
-			DisassocParmFill(pAd, &DisassocReq, pAd->CommonCfg.Bssid, REASON_DISASSOC_STA_LEAVING);
-			MlmeEnqueue(pAd, ASSOC_STATE_MACHINE, MT2_MLME_DISASSOC_REQ, sizeof(MLME_DISASSOC_REQ_STRUCT), &DisassocReq);
-			pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_OID_DISASSOC;
-#ifdef WPA_SUPPLICANT_SUPPORT
-            if (pAd->StaCfg.WpaSupplicantUP != WPA_SUPPLICANT_ENABLE_WITH_WEB_UI)
-#endif // WPA_SUPPLICANT_SUPPORT //
-            {
-			// Set the AutoReconnectSsid to prevent it reconnect to old SSID
-			// Since calling this indicate user don't want to connect to that SSID anymore.
-			pAd->MlmeAux.AutoReconnectSsidLen= 32;
-			NdisZeroMemory(pAd->MlmeAux.AutoReconnectSsid, pAd->MlmeAux.AutoReconnectSsidLen);
-            }
-			break;
-
-		case MT2_MLME_ROAMING_REQ:
-			CntlMlmeRoamingProc(pAd, Elem);
-			break;
-
-        case OID_802_11_MIC_FAILURE_REPORT_FRAME:
-            WpaMicFailureReportFrame(pAd, Elem);
-            break;
-
-#ifdef QOS_DLS_SUPPORT
-		case RT_OID_802_11_SET_DLS_PARAM:
-			CntlOidDLSSetupProc(pAd, Elem);
-			break;
-#endif // QOS_DLS_SUPPORT //
-
-		default:
-			DBGPRINT(RT_DEBUG_TRACE, ("CNTL - Illegal message in CntlIdleProc(MsgType=%ld)\n",Elem->MsgType));
-			break;
-	}
-}
-
-VOID CntlOidScanProc(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-	MLME_SCAN_REQ_STRUCT       ScanReq;
-	ULONG                      BssIdx = BSS_NOT_FOUND;
-	BSS_ENTRY                  CurrBss;
-
-#ifdef RALINK_ATE
-/* Disable scanning when ATE is running. */
-	if (ATE_ON(pAd))
-		return;
-#endif // RALINK_ATE //
-
-
-	// record current BSS if network is connected.
-	// 2003-2-13 do not include current IBSS if this is the only STA in this IBSS.
-	if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED))
-	{
-		BssIdx = BssSsidTableSearch(&pAd->ScanTab, pAd->CommonCfg.Bssid, (PUCHAR)pAd->CommonCfg.Ssid, pAd->CommonCfg.SsidLen, pAd->CommonCfg.Channel);
-		if (BssIdx != BSS_NOT_FOUND)
-		{
-			NdisMoveMemory(&CurrBss, &pAd->ScanTab.BssEntry[BssIdx], sizeof(BSS_ENTRY));
-		}
-	}
-
-	// clean up previous SCAN result, add current BSS back to table if any
-	BssTableInit(&pAd->ScanTab);
-	if (BssIdx != BSS_NOT_FOUND)
-	{
-		// DDK Note: If the NIC is associated with a particular BSSID and SSID
-		//    that are not contained in the list of BSSIDs generated by this scan, the
-		//    BSSID description of the currently associated BSSID and SSID should be
-		//    appended to the list of BSSIDs in the NIC's database.
-		// To ensure this, we append this BSS as the first entry in SCAN result
-		NdisMoveMemory(&pAd->ScanTab.BssEntry[0], &CurrBss, sizeof(BSS_ENTRY));
-		pAd->ScanTab.BssNr = 1;
-	}
-
-	ScanParmFill(pAd, &ScanReq, (PSTRING) Elem->Msg, Elem->MsgLen, BSS_ANY, SCAN_ACTIVE);
-	MlmeEnqueue(pAd, SYNC_STATE_MACHINE, MT2_MLME_SCAN_REQ,
-		sizeof(MLME_SCAN_REQ_STRUCT), &ScanReq);
-	pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_OID_LIST_SCAN;
-}
-
-/*
-	==========================================================================
-	Description:
-		Before calling this routine, user desired SSID should already been
-		recorded in CommonCfg.Ssid[]
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
-*/
-VOID CntlOidSsidProc(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM * Elem)
-{
-	PNDIS_802_11_SSID          pOidSsid = (NDIS_802_11_SSID *)Elem->Msg;
-	MLME_DISASSOC_REQ_STRUCT   DisassocReq;
-	ULONG					   Now;
-
-
-	// Step 1. record the desired user settings to MlmeAux
-	NdisZeroMemory(pAd->MlmeAux.Ssid, MAX_LEN_OF_SSID);
-	NdisMoveMemory(pAd->MlmeAux.Ssid, pOidSsid->Ssid, pOidSsid->SsidLength);
-	pAd->MlmeAux.SsidLen = (UCHAR)pOidSsid->SsidLength;
-	NdisZeroMemory(pAd->MlmeAux.Bssid, MAC_ADDR_LEN);
-	pAd->MlmeAux.BssType = pAd->StaCfg.BssType;
-
-	pAd->StaCfg.bAutoConnectByBssid = FALSE;
-
-	//
-	// Update Reconnect Ssid, that user desired to connect.
-	//
-	NdisZeroMemory(pAd->MlmeAux.AutoReconnectSsid, MAX_LEN_OF_SSID);
-	NdisMoveMemory(pAd->MlmeAux.AutoReconnectSsid, pAd->MlmeAux.Ssid, pAd->MlmeAux.SsidLen);
-	pAd->MlmeAux.AutoReconnectSsidLen = pAd->MlmeAux.SsidLen;
-
-	// step 2. find all matching BSS in the lastest SCAN result (inBssTab)
-	//    & log them into MlmeAux.SsidBssTab for later-on iteration. Sort by RSSI order
-	BssTableSsidSort(pAd, &pAd->MlmeAux.SsidBssTab, (PCHAR)pAd->MlmeAux.Ssid, pAd->MlmeAux.SsidLen);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("CntlOidSsidProc():CNTL - %d BSS of %d BSS match the desire (%d)SSID - %s\n",
-			pAd->MlmeAux.SsidBssTab.BssNr, pAd->ScanTab.BssNr, pAd->MlmeAux.SsidLen, pAd->MlmeAux.Ssid));
-	NdisGetSystemUpTime(&Now);
-
-	if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED) &&
-		(pAd->CommonCfg.SsidLen == pAd->MlmeAux.SsidBssTab.BssEntry[0].SsidLen) &&
-		NdisEqualMemory(pAd->CommonCfg.Ssid, pAd->MlmeAux.SsidBssTab.BssEntry[0].Ssid, pAd->CommonCfg.SsidLen) &&
-		MAC_ADDR_EQUAL(pAd->CommonCfg.Bssid, pAd->MlmeAux.SsidBssTab.BssEntry[0].Bssid))
-	{
-		// Case 1. already connected with an AP who has the desired SSID
-		//         with highest RSSI
-
-		// Add checking Mode "LEAP" for CCX 1.0
-		if (((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA) ||
-			 (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPAPSK) ||
-			 (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2) ||
-			 (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK)
-			 ) &&
-			(pAd->StaCfg.PortSecured == WPA_802_1X_PORT_NOT_SECURED))
-		{
-			// case 1.1 For WPA, WPA-PSK, if the 1x port is not secured, we have to redo
-			//          connection process
-			DBGPRINT(RT_DEBUG_TRACE, ("CntlOidSsidProc():CNTL - disassociate with current AP...\n"));
-			DisassocParmFill(pAd, &DisassocReq, pAd->CommonCfg.Bssid, REASON_DISASSOC_STA_LEAVING);
-			MlmeEnqueue(pAd, ASSOC_STATE_MACHINE, MT2_MLME_DISASSOC_REQ,
-						sizeof(MLME_DISASSOC_REQ_STRUCT), &DisassocReq);
-			pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_DISASSOC;
-		}
-		else if (pAd->bConfigChanged == TRUE)
-		{
-			// case 1.2 Important Config has changed, we have to reconnect to the same AP
-			DBGPRINT(RT_DEBUG_TRACE, ("CntlOidSsidProc():CNTL - disassociate with current AP Because config changed...\n"));
-			DisassocParmFill(pAd, &DisassocReq, pAd->CommonCfg.Bssid, REASON_DISASSOC_STA_LEAVING);
-			MlmeEnqueue(pAd, ASSOC_STATE_MACHINE, MT2_MLME_DISASSOC_REQ,
-						sizeof(MLME_DISASSOC_REQ_STRUCT), &DisassocReq);
-			pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_DISASSOC;
-		}
-		else
-		{
-			// case 1.3. already connected to the SSID with highest RSSI.
-			DBGPRINT(RT_DEBUG_TRACE, ("CntlOidSsidProc():CNTL - already with this BSSID. ignore this SET_SSID request\n"));
-			//
-			// (HCT 12.1) 1c_wlan_mediaevents required
-			// media connect events are indicated when associating with the same AP
-			//
-			if (INFRA_ON(pAd))
-			{
-				//
-				// Since MediaState already is NdisMediaStateConnected
-				// We just indicate the connect event again to meet the WHQL required.
-				//
-				pAd->IndicateMediaState = NdisMediaStateConnected;
-				RTMP_IndicateMediaState(pAd);
-                pAd->ExtraInfo = GENERAL_LINK_UP;   // Update extra information to link is up
-			}
-
-			pAd->Mlme.CntlMachine.CurrState = CNTL_IDLE;
-#ifdef NATIVE_WPA_SUPPLICANT_SUPPORT
-			RtmpOSWrielessEventSend(pAd, SIOCGIWAP, -1, &pAd->MlmeAux.Bssid[0], NULL, 0);
-#endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
-		}
-	}
-	else if (INFRA_ON(pAd))
-	{
-		//
-		// For RT61
-		// [88888] OID_802_11_SSID should have returned NDTEST_WEP_AP2(Returned: )
-		// RT61 may lost SSID, and not connect to NDTEST_WEP_AP2 and will connect to NDTEST_WEP_AP2 by Autoreconnect
-		// But media status is connected, so the SSID not report correctly.
-		//
-		if (!SSID_EQUAL(pAd->CommonCfg.Ssid, pAd->CommonCfg.SsidLen, pAd->MlmeAux.Ssid, pAd->MlmeAux.SsidLen))
-		{
-			//
-			// Different SSID means not Roaming case, so we let LinkDown() to Indicate a disconnect event.
-			//
-			pAd->MlmeAux.CurrReqIsFromNdis = TRUE;
-		}
-		// case 2. active INFRA association existent
-		//    roaming is done within miniport driver, nothing to do with configuration
-		//    utility. so upon a new SET(OID_802_11_SSID) is received, we just
-		//    disassociate with the current associated AP,
-		//    then perform a new association with this new SSID, no matter the
-		//    new/old SSID are the same or not.
-		DBGPRINT(RT_DEBUG_TRACE, ("CntlOidSsidProc():CNTL - disassociate with current AP...\n"));
-		DisassocParmFill(pAd, &DisassocReq, pAd->CommonCfg.Bssid, REASON_DISASSOC_STA_LEAVING);
-		MlmeEnqueue(pAd, ASSOC_STATE_MACHINE, MT2_MLME_DISASSOC_REQ,
-					sizeof(MLME_DISASSOC_REQ_STRUCT), &DisassocReq);
-		pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_DISASSOC;
-	}
-	else
-	{
-		if (ADHOC_ON(pAd))
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("CntlOidSsidProc():CNTL - drop current ADHOC\n"));
-			LinkDown(pAd, FALSE);
-			OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED);
-			pAd->IndicateMediaState = NdisMediaStateDisconnected;
-			RTMP_IndicateMediaState(pAd);
-            pAd->ExtraInfo = GENERAL_LINK_DOWN;
-			DBGPRINT(RT_DEBUG_TRACE, ("CntlOidSsidProc():NDIS_STATUS_MEDIA_DISCONNECT Event C!\n"));
-		}
-
-		if ((pAd->MlmeAux.SsidBssTab.BssNr == 0) &&
-			(pAd->StaCfg.bAutoReconnect == TRUE) &&
-			(pAd->MlmeAux.BssType == BSS_INFRA) &&
-			(MlmeValidateSSID(pAd->MlmeAux.Ssid, pAd->MlmeAux.SsidLen) == TRUE)
-			)
-		{
-			MLME_SCAN_REQ_STRUCT       ScanReq;
-
-			DBGPRINT(RT_DEBUG_TRACE, ("CntlOidSsidProc():CNTL - No matching BSS, start a new scan\n"));
-			ScanParmFill(pAd, &ScanReq, (PSTRING) pAd->MlmeAux.Ssid, pAd->MlmeAux.SsidLen, BSS_ANY, SCAN_ACTIVE);
-			MlmeEnqueue(pAd, SYNC_STATE_MACHINE, MT2_MLME_SCAN_REQ, sizeof(MLME_SCAN_REQ_STRUCT), &ScanReq);
-			pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_OID_LIST_SCAN;
-			// Reset Missed scan number
-			pAd->StaCfg.LastScanTime = Now;
-		}
-		else
-		{
-
-			pAd->MlmeAux.BssIdx = 0;
-			IterateOnBssTab(pAd);
-		}
-	}
-}
-
-
-/*
-	==========================================================================
-	Description:
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
-*/
-VOID CntlOidRTBssidProc(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM * Elem)
-{
-	ULONG       BssIdx;
-	PUCHAR      pOidBssid = (PUCHAR)Elem->Msg;
-	MLME_DISASSOC_REQ_STRUCT    DisassocReq;
-	MLME_JOIN_REQ_STRUCT        JoinReq;
-
-#ifdef RALINK_ATE
-/* No need to perform this routine when ATE is running. */
-	if (ATE_ON(pAd))
-		return;
-#endif // RALINK_ATE //
-
-	// record user desired settings
-	COPY_MAC_ADDR(pAd->MlmeAux.Bssid, pOidBssid);
-	pAd->MlmeAux.BssType = pAd->StaCfg.BssType;
-
-	// find the desired BSS in the latest SCAN result table
-	BssIdx = BssTableSearch(&pAd->ScanTab, pOidBssid, pAd->MlmeAux.Channel);
-	if (BssIdx == BSS_NOT_FOUND)
-	{
-		MLME_SCAN_REQ_STRUCT       ScanReq;
-
-		DBGPRINT(RT_DEBUG_TRACE, ("CNTL - BSSID not found. reply NDIS_STATUS_NOT_ACCEPTED\n"));
-		//pAd->Mlme.CntlMachine.CurrState = CNTL_IDLE;
-
-		DBGPRINT(RT_DEBUG_TRACE, ("CNTL - BSSID not found. start a new scan\n"));
-		ScanParmFill(pAd, &ScanReq, (PSTRING) pAd->MlmeAux.Ssid, pAd->MlmeAux.SsidLen, BSS_ANY, SCAN_ACTIVE);
-		MlmeEnqueue(pAd, SYNC_STATE_MACHINE, MT2_MLME_SCAN_REQ, sizeof(MLME_SCAN_REQ_STRUCT), &ScanReq);
-		pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_OID_LIST_SCAN;
-		// Reset Missed scan number
-		NdisGetSystemUpTime(&pAd->StaCfg.LastScanTime);
-		return;
-	}
-
-	//
-	// Update Reconnect Ssid, that user desired to connect.
-	//
-	NdisZeroMemory(pAd->MlmeAux.AutoReconnectSsid, MAX_LEN_OF_SSID);
-	pAd->MlmeAux.AutoReconnectSsidLen = pAd->ScanTab.BssEntry[BssIdx].SsidLen;
-	NdisMoveMemory(pAd->MlmeAux.AutoReconnectSsid, pAd->ScanTab.BssEntry[BssIdx].Ssid, pAd->ScanTab.BssEntry[BssIdx].SsidLen);
-
-	// copy the matched BSS entry from ScanTab to MlmeAux.SsidBssTab. Why?
-	// Because we need this entry to become the JOIN target in later on SYNC state machine
-	pAd->MlmeAux.BssIdx = 0;
-	pAd->MlmeAux.SsidBssTab.BssNr = 1;
-	NdisMoveMemory(&pAd->MlmeAux.SsidBssTab.BssEntry[0], &pAd->ScanTab.BssEntry[BssIdx], sizeof(BSS_ENTRY));
-
-	// Add SSID into MlmeAux for site surey joining hidden SSID
-	pAd->MlmeAux.SsidLen = pAd->ScanTab.BssEntry[BssIdx].SsidLen;
-	NdisMoveMemory(pAd->MlmeAux.Ssid, pAd->ScanTab.BssEntry[BssIdx].Ssid, pAd->MlmeAux.SsidLen);
-
-	{
-		if (INFRA_ON(pAd))
-		{
-			// disassoc from current AP first
-			DBGPRINT(RT_DEBUG_TRACE, ("CNTL - disassociate with current AP ...\n"));
-			DisassocParmFill(pAd, &DisassocReq, pAd->CommonCfg.Bssid, REASON_DISASSOC_STA_LEAVING);
-			MlmeEnqueue(pAd, ASSOC_STATE_MACHINE, MT2_MLME_DISASSOC_REQ,
-						sizeof(MLME_DISASSOC_REQ_STRUCT), &DisassocReq);
-
-			pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_DISASSOC;
-		}
-		else
-		{
-			if (ADHOC_ON(pAd))
-			{
-				DBGPRINT(RT_DEBUG_TRACE, ("CNTL - drop current ADHOC\n"));
-				LinkDown(pAd, FALSE);
-				OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED);
-				pAd->IndicateMediaState = NdisMediaStateDisconnected;
-				RTMP_IndicateMediaState(pAd);
-                pAd->ExtraInfo = GENERAL_LINK_DOWN;
-				DBGPRINT(RT_DEBUG_TRACE, ("NDIS_STATUS_MEDIA_DISCONNECT Event C!\n"));
-			}
-
-			// Change the wepstatus to original wepstatus
-			pAd->StaCfg.WepStatus   = pAd->StaCfg.OrigWepStatus;
-			pAd->StaCfg.PairCipher  = pAd->StaCfg.OrigWepStatus;
-			pAd->StaCfg.GroupCipher = pAd->StaCfg.OrigWepStatus;
-
-			// Check cipher suite, AP must have more secured cipher than station setting
-			// Set the Pairwise and Group cipher to match the intended AP setting
-			// We can only connect to AP with less secured cipher setting
-			if ((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA) || (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPAPSK))
-			{
-				pAd->StaCfg.GroupCipher = pAd->ScanTab.BssEntry[BssIdx].WPA.GroupCipher;
-
-				if (pAd->StaCfg.WepStatus == pAd->ScanTab.BssEntry[BssIdx].WPA.PairCipher)
-					pAd->StaCfg.PairCipher = pAd->ScanTab.BssEntry[BssIdx].WPA.PairCipher;
-				else if (pAd->ScanTab.BssEntry[BssIdx].WPA.PairCipherAux != Ndis802_11WEPDisabled)
-					pAd->StaCfg.PairCipher = pAd->ScanTab.BssEntry[BssIdx].WPA.PairCipherAux;
-				else	// There is no PairCipher Aux, downgrade our capability to TKIP
-					pAd->StaCfg.PairCipher = Ndis802_11Encryption2Enabled;
-			}
-			else if ((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2) || (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK))
-			{
-				pAd->StaCfg.GroupCipher = pAd->ScanTab.BssEntry[BssIdx].WPA2.GroupCipher;
-
-				if (pAd->StaCfg.WepStatus == pAd->ScanTab.BssEntry[BssIdx].WPA2.PairCipher)
-					pAd->StaCfg.PairCipher = pAd->ScanTab.BssEntry[BssIdx].WPA2.PairCipher;
-				else if (pAd->ScanTab.BssEntry[BssIdx].WPA2.PairCipherAux != Ndis802_11WEPDisabled)
-					pAd->StaCfg.PairCipher = pAd->ScanTab.BssEntry[BssIdx].WPA2.PairCipherAux;
-				else	// There is no PairCipher Aux, downgrade our capability to TKIP
-					pAd->StaCfg.PairCipher = Ndis802_11Encryption2Enabled;
-
-				// RSN capability
-				pAd->StaCfg.RsnCapability = pAd->ScanTab.BssEntry[BssIdx].WPA2.RsnCapability;
-			}
-
-			// Set Mix cipher flag
-			pAd->StaCfg.bMixCipher = (pAd->StaCfg.PairCipher == pAd->StaCfg.GroupCipher) ? FALSE : TRUE;
-			/*if (pAd->StaCfg.bMixCipher == TRUE)
-			{
-				// If mix cipher, re-build RSNIE
-				RTMPMakeRSNIE(pAd, pAd->StaCfg.AuthMode, pAd->StaCfg.WepStatus, 0);
-			}*/
-			// No active association, join the BSS immediately
-			DBGPRINT(RT_DEBUG_TRACE, ("CNTL - joining %02x:%02x:%02x:%02x:%02x:%02x ...\n",
-				pOidBssid[0],pOidBssid[1],pOidBssid[2],pOidBssid[3],pOidBssid[4],pOidBssid[5]));
-
-			JoinParmFill(pAd, &JoinReq, pAd->MlmeAux.BssIdx);
-			MlmeEnqueue(pAd, SYNC_STATE_MACHINE, MT2_MLME_JOIN_REQ, sizeof(MLME_JOIN_REQ_STRUCT), &JoinReq);
-
-			pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_JOIN;
-		}
-	}
-}
-
-// Roaming is the only external request triggering CNTL state machine
-// despite of other "SET OID" operation. All "SET OID" related oerations
-// happen in sequence, because no other SET OID will be sent to this device
-// until the the previous SET operation is complete (successful o failed).
-// So, how do we quarantee this ROAMING request won't corrupt other "SET OID"?
-// or been corrupted by other "SET OID"?
-//
-// IRQL = DISPATCH_LEVEL
-VOID CntlMlmeRoamingProc(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-	UCHAR BBPValue = 0;
-
-	DBGPRINT(RT_DEBUG_TRACE,("CNTL - Roaming in MlmeAux.RoamTab...\n"));
-
-	{
-		//Let BBP register at 20MHz to do (fast) roaming.
-		RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R4, &BBPValue);
-		BBPValue &= (~0x18);
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R4, BBPValue);
-
-		NdisMoveMemory(&pAd->MlmeAux.SsidBssTab, &pAd->MlmeAux.RoamTab, sizeof(pAd->MlmeAux.RoamTab));
-		pAd->MlmeAux.SsidBssTab.BssNr = pAd->MlmeAux.RoamTab.BssNr;
-
-		BssTableSortByRssi(&pAd->MlmeAux.SsidBssTab);
-		pAd->MlmeAux.BssIdx = 0;
-		IterateOnBssTab(pAd);
-	}
-}
-
-#ifdef QOS_DLS_SUPPORT
-/*
-	==========================================================================
-	Description:
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
-*/
-VOID CntlOidDLSSetupProc(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-	PRT_802_11_DLS		pDLS = (PRT_802_11_DLS)Elem->Msg;
-	MLME_DLS_REQ_STRUCT	MlmeDlsReq;
-	INT					i;
-	USHORT				reason = REASON_UNSPECIFY;
-
-	DBGPRINT(RT_DEBUG_TRACE,("CNTL - (OID set %02x:%02x:%02x:%02x:%02x:%02x with Valid=%d, Status=%d, TimeOut=%d, CountDownTimer=%d)\n",
-		pDLS->MacAddr[0], pDLS->MacAddr[1], pDLS->MacAddr[2], pDLS->MacAddr[3], pDLS->MacAddr[4], pDLS->MacAddr[5],
-		pDLS->Valid, pDLS->Status, pDLS->TimeOut, pDLS->CountDownTimer));
-
-	if (!pAd->CommonCfg.bDLSCapable)
-		return;
-
-	// DLS will not be supported when Adhoc mode
-	if (INFRA_ON(pAd))
-	{
-		for (i = 0; i < MAX_NUM_OF_DLS_ENTRY; i++)
-		{
-			if (pDLS->Valid && pAd->StaCfg.DLSEntry[i].Valid && (pAd->StaCfg.DLSEntry[i].Status == DLS_FINISH) &&
-				(pDLS->TimeOut == pAd->StaCfg.DLSEntry[i].TimeOut) && MAC_ADDR_EQUAL(pDLS->MacAddr, pAd->StaCfg.DLSEntry[i].MacAddr))
-			{
-				// 1. Same setting, just drop it
-				DBGPRINT(RT_DEBUG_TRACE,("CNTL - setting unchanged\n"));
-				break;
-			}
-			else if (!pDLS->Valid && pAd->StaCfg.DLSEntry[i].Valid && (pAd->StaCfg.DLSEntry[i].Status == DLS_FINISH) &&
-				MAC_ADDR_EQUAL(pDLS->MacAddr, pAd->StaCfg.DLSEntry[i].MacAddr))
-			{
-				// 2. Disable DLS link case, just tear down DLS link
-				reason = REASON_QOS_UNWANTED_MECHANISM;
-				pAd->StaCfg.DLSEntry[i].Valid	= FALSE;
-				pAd->StaCfg.DLSEntry[i].Status	= DLS_NONE;
-				DlsParmFill(pAd, &MlmeDlsReq, &pAd->StaCfg.DLSEntry[i], reason);
-				MlmeEnqueue(pAd, DLS_STATE_MACHINE, MT2_MLME_DLS_TEAR_DOWN, sizeof(MLME_DLS_REQ_STRUCT), &MlmeDlsReq);
-				DBGPRINT(RT_DEBUG_TRACE,("CNTL - start tear down procedure\n"));
-				break;
-			}
-			else if ((i < MAX_NUM_OF_DLS_ENTRY) && pDLS->Valid && !pAd->StaCfg.DLSEntry[i].Valid)
-			{
-				// 3. Enable case, start DLS setup procedure
-				NdisMoveMemory(&pAd->StaCfg.DLSEntry[i], pDLS, sizeof(RT_802_11_DLS_UI));
-
-				//Update countdown timer
-				pAd->StaCfg.DLSEntry[i].CountDownTimer = pAd->StaCfg.DLSEntry[i].TimeOut;
-				DlsParmFill(pAd, &MlmeDlsReq, &pAd->StaCfg.DLSEntry[i], reason);
-				MlmeEnqueue(pAd, DLS_STATE_MACHINE, MT2_MLME_DLS_REQ, sizeof(MLME_DLS_REQ_STRUCT), &MlmeDlsReq);
-				DBGPRINT(RT_DEBUG_TRACE,("CNTL - DLS setup case\n"));
-				break;
-			}
-			else if ((i < MAX_NUM_OF_DLS_ENTRY) && pDLS->Valid && pAd->StaCfg.DLSEntry[i].Valid &&
-				(pAd->StaCfg.DLSEntry[i].Status == DLS_FINISH) && !MAC_ADDR_EQUAL(pDLS->MacAddr, pAd->StaCfg.DLSEntry[i].MacAddr))
-			{
-				// 4. update mac case, tear down old DLS and setup new DLS
-				reason = REASON_QOS_UNWANTED_MECHANISM;
-				pAd->StaCfg.DLSEntry[i].Valid	= FALSE;
-				pAd->StaCfg.DLSEntry[i].Status	= DLS_NONE;
-				DlsParmFill(pAd, &MlmeDlsReq, &pAd->StaCfg.DLSEntry[i], reason);
-				MlmeEnqueue(pAd, DLS_STATE_MACHINE, MT2_MLME_DLS_TEAR_DOWN, sizeof(MLME_DLS_REQ_STRUCT), &MlmeDlsReq);
-				NdisMoveMemory(&pAd->StaCfg.DLSEntry[i], pDLS, sizeof(RT_802_11_DLS_UI));
-				DlsParmFill(pAd, &MlmeDlsReq, &pAd->StaCfg.DLSEntry[i], reason);
-				MlmeEnqueue(pAd, DLS_STATE_MACHINE, MT2_MLME_DLS_REQ, sizeof(MLME_DLS_REQ_STRUCT), &MlmeDlsReq);
-				DBGPRINT(RT_DEBUG_TRACE,("CNTL - DLS tear down and restart case\n"));
-				break;
-			}
-			else if (pDLS->Valid && pAd->StaCfg.DLSEntry[i].Valid &&
-				MAC_ADDR_EQUAL(pDLS->MacAddr, pAd->StaCfg.DLSEntry[i].MacAddr) && (pAd->StaCfg.DLSEntry[i].TimeOut != pDLS->TimeOut))
-			{
-				// 5. update timeout case, start DLS setup procedure (no tear down)
-				pAd->StaCfg.DLSEntry[i].TimeOut	= pDLS->TimeOut;
-				//Update countdown timer
-				pAd->StaCfg.DLSEntry[i].CountDownTimer = pAd->StaCfg.DLSEntry[i].TimeOut;
-				DlsParmFill(pAd, &MlmeDlsReq, &pAd->StaCfg.DLSEntry[i], reason);
-				MlmeEnqueue(pAd, DLS_STATE_MACHINE, MT2_MLME_DLS_REQ, sizeof(MLME_DLS_REQ_STRUCT), &MlmeDlsReq);
-				DBGPRINT(RT_DEBUG_TRACE,("CNTL - DLS update timeout case\n"));
-				break;
-			}
-			else if (pDLS->Valid && pAd->StaCfg.DLSEntry[i].Valid &&
-				(pAd->StaCfg.DLSEntry[i].Status != DLS_FINISH) && MAC_ADDR_EQUAL(pDLS->MacAddr, pAd->StaCfg.DLSEntry[i].MacAddr))
-			{
-				// 6. re-setup case, start DLS setup procedure (no tear down)
-				DlsParmFill(pAd, &MlmeDlsReq, &pAd->StaCfg.DLSEntry[i], reason);
-				MlmeEnqueue(pAd, DLS_STATE_MACHINE, MT2_MLME_DLS_REQ, sizeof(MLME_DLS_REQ_STRUCT), &MlmeDlsReq);
-				DBGPRINT(RT_DEBUG_TRACE,("CNTL - DLS retry setup procedure\n"));
-				break;
-			}
-			else
-			{
-				DBGPRINT(RT_DEBUG_WARN,("CNTL - DLS not changed in entry - %d - Valid=%d, Status=%d, TimeOut=%d\n",
-					i, pAd->StaCfg.DLSEntry[i].Valid, pAd->StaCfg.DLSEntry[i].Status, pAd->StaCfg.DLSEntry[i].TimeOut));
-			}
-		}
-	}
-}
-#endif // QOS_DLS_SUPPORT //
-
-/*
-	==========================================================================
-	Description:
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
-*/
-VOID CntlWaitDisassocProc(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-	MLME_START_REQ_STRUCT     StartReq;
-
-	if (Elem->MsgType == MT2_DISASSOC_CONF)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("CNTL - Dis-associate successful\n"));
-
-	    if (pAd->CommonCfg.bWirelessEvent)
-		{
-			RTMPSendWirelessEvent(pAd, IW_DISASSOC_EVENT_FLAG, pAd->MacTab.Content[BSSID_WCID].Addr, BSS0, 0);
-		}
-
-		LinkDown(pAd, FALSE);
-
-		// case 1. no matching BSS, and user wants ADHOC, so we just start a new one
-		if ((pAd->MlmeAux.SsidBssTab.BssNr==0) && (pAd->StaCfg.BssType == BSS_ADHOC))
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("CNTL - No matching BSS, start a new ADHOC (Ssid=%s)...\n",pAd->MlmeAux.Ssid));
-			StartParmFill(pAd, &StartReq, (PCHAR)pAd->MlmeAux.Ssid, pAd->MlmeAux.SsidLen);
-			MlmeEnqueue(pAd, SYNC_STATE_MACHINE, MT2_MLME_START_REQ, sizeof(MLME_START_REQ_STRUCT), &StartReq);
-			pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_START;
-		}
-		// case 2. try each matched BSS
-		else
-		{
-			pAd->MlmeAux.BssIdx = 0;
-
-			IterateOnBssTab(pAd);
-		}
-	}
-}
-
-/*
-	==========================================================================
-	Description:
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
-*/
-VOID CntlWaitJoinProc(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-	USHORT                      Reason;
-	MLME_AUTH_REQ_STRUCT        AuthReq;
-
-	if (Elem->MsgType == MT2_JOIN_CONF)
-	{
-		NdisMoveMemory(&Reason, Elem->Msg, sizeof(USHORT));
-		if (Reason == MLME_SUCCESS)
-		{
-			// 1. joined an IBSS, we are pretty much done here
-			if (pAd->MlmeAux.BssType == BSS_ADHOC)
-			{
-			    //
-				// 5G bands rules of Japan:
-				// Ad hoc must be disabled in W53(ch52,56,60,64) channels.
-				//
-				if ( (pAd->CommonCfg.bIEEE80211H == 1) &&
-                      RadarChannelCheck(pAd, pAd->CommonCfg.Channel)
-				   )
-				{
-					pAd->Mlme.CntlMachine.CurrState = CNTL_IDLE;
-					DBGPRINT(RT_DEBUG_TRACE, ("CNTL - Channel=%d, Join adhoc on W53(52,56,60,64) Channels are not accepted\n", pAd->CommonCfg.Channel));
-					return;
-				}
-
-				LinkUp(pAd, BSS_ADHOC);
-				pAd->Mlme.CntlMachine.CurrState = CNTL_IDLE;
-				DBGPRINT(RT_DEBUG_TRACE, ("CNTL - join the IBSS = %02x:%02x:%02x:%02x:%02x:%02x ...\n",
-				pAd->CommonCfg.Bssid[0],pAd->CommonCfg.Bssid[1],pAd->CommonCfg.Bssid[2],
-				pAd->CommonCfg.Bssid[3],pAd->CommonCfg.Bssid[4],pAd->CommonCfg.Bssid[5]));
-
-                pAd->IndicateMediaState = NdisMediaStateConnected;
-                pAd->ExtraInfo = GENERAL_LINK_UP;
-			}
-			// 2. joined a new INFRA network, start from authentication
-			else
-			{
-				{
-					// either Ndis802_11AuthModeShared or Ndis802_11AuthModeAutoSwitch, try shared key first
-					if ((pAd->StaCfg.AuthMode == Ndis802_11AuthModeShared) ||
-						(pAd->StaCfg.AuthMode == Ndis802_11AuthModeAutoSwitch))
-					{
-						AuthParmFill(pAd, &AuthReq, pAd->MlmeAux.Bssid, AUTH_MODE_KEY);
-					}
-					else
-					{
-						AuthParmFill(pAd, &AuthReq, pAd->MlmeAux.Bssid, AUTH_MODE_OPEN);
-					}
-					MlmeEnqueue(pAd, AUTH_STATE_MACHINE, MT2_MLME_AUTH_REQ,
-							sizeof(MLME_AUTH_REQ_STRUCT), &AuthReq);
-				}
-
-				pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_AUTH;
-			}
-		}
-		else
-		{
-			// 3. failed, try next BSS
-			pAd->MlmeAux.BssIdx++;
-			IterateOnBssTab(pAd);
-		}
-	}
-}
-
-
-/*
-	==========================================================================
-	Description:
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
-*/
-VOID CntlWaitStartProc(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-	USHORT      Result;
-
-	if (Elem->MsgType == MT2_START_CONF)
-	{
-		NdisMoveMemory(&Result, Elem->Msg, sizeof(USHORT));
-		if (Result == MLME_SUCCESS)
-		{
-		    //
-			// 5G bands rules of Japan:
-			// Ad hoc must be disabled in W53(ch52,56,60,64) channels.
-			//
-			if ( (pAd->CommonCfg.bIEEE80211H == 1) &&
-                  RadarChannelCheck(pAd, pAd->CommonCfg.Channel)
-			   )
-			{
-				pAd->Mlme.CntlMachine.CurrState = CNTL_IDLE;
-				DBGPRINT(RT_DEBUG_TRACE, ("CNTL - Channel=%d, Start adhoc on W53(52,56,60,64) Channels are not accepted\n", pAd->CommonCfg.Channel));
-				return;
-			}
-#ifdef DOT11_N_SUPPORT
-			NdisZeroMemory(&pAd->StaActive.SupportedPhyInfo.MCSSet[0], 16);
-			if (pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED)
-			{
-				N_ChannelCheck(pAd);
-				SetCommonHT(pAd);
-				NdisMoveMemory(&pAd->MlmeAux.AddHtInfo, &pAd->CommonCfg.AddHTInfo, sizeof(ADD_HT_INFO_IE));
-				RTMPCheckHt(pAd, BSSID_WCID, &pAd->CommonCfg.HtCapability, &pAd->CommonCfg.AddHTInfo);
-				pAd->StaActive.SupportedPhyInfo.bHtEnable = TRUE;
-				NdisMoveMemory(&pAd->StaActive.SupportedPhyInfo.MCSSet[0], &pAd->CommonCfg.HtCapability.MCSSet[0], 16);
-				COPY_HTSETTINGS_FROM_MLME_AUX_TO_ACTIVE_CFG(pAd);
-
-				if ((pAd->CommonCfg.HtCapability.HtCapInfo.ChannelWidth  == BW_40) &&
-					(pAd->CommonCfg.AddHTInfo.AddHtInfo.ExtChanOffset == EXTCHA_ABOVE))
-				{
-					pAd->MlmeAux.CentralChannel = pAd->CommonCfg.Channel + 2;
-				}
-				else if ((pAd->CommonCfg.HtCapability.HtCapInfo.ChannelWidth  == BW_40) &&
-						 (pAd->CommonCfg.AddHTInfo.AddHtInfo.ExtChanOffset == EXTCHA_BELOW))
-				{
-					pAd->MlmeAux.CentralChannel = pAd->CommonCfg.Channel - 2;
-				}
-			}
-			else
-#endif // DOT11_N_SUPPORT //
-			{
-				pAd->StaActive.SupportedPhyInfo.bHtEnable = FALSE;
-			}
-			LinkUp(pAd, BSS_ADHOC);
-			pAd->Mlme.CntlMachine.CurrState = CNTL_IDLE;
-			// Before send beacon, driver need do radar detection
-			if ((pAd->CommonCfg.Channel > 14 )
-				&& (pAd->CommonCfg.bIEEE80211H == 1)
-				&& RadarChannelCheck(pAd, pAd->CommonCfg.Channel))
-			{
-				pAd->CommonCfg.RadarDetect.RDMode = RD_SILENCE_MODE;
-				pAd->CommonCfg.RadarDetect.RDCount = 0;
-#ifdef DFS_SUPPORT
-				BbpRadarDetectionStart(pAd);
-#endif // DFS_SUPPORT //
-			}
-
-			DBGPRINT(RT_DEBUG_TRACE, ("CNTL - start a new IBSS = %02x:%02x:%02x:%02x:%02x:%02x ...\n",
-				pAd->CommonCfg.Bssid[0],pAd->CommonCfg.Bssid[1],pAd->CommonCfg.Bssid[2],
-				pAd->CommonCfg.Bssid[3],pAd->CommonCfg.Bssid[4],pAd->CommonCfg.Bssid[5]));
-		}
-		else
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("CNTL - Start IBSS fail. BUG!!!!!\n"));
-			pAd->Mlme.CntlMachine.CurrState = CNTL_IDLE;
-		}
-	}
-}
-
-/*
-	==========================================================================
-	Description:
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
-*/
-VOID CntlWaitAuthProc(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-	USHORT                       Reason;
-	MLME_ASSOC_REQ_STRUCT        AssocReq;
-	MLME_AUTH_REQ_STRUCT         AuthReq;
-
-	if (Elem->MsgType == MT2_AUTH_CONF)
-	{
-		NdisMoveMemory(&Reason, Elem->Msg, sizeof(USHORT));
-		if (Reason == MLME_SUCCESS)
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("CNTL - AUTH OK\n"));
-			AssocParmFill(pAd, &AssocReq, pAd->MlmeAux.Bssid, pAd->MlmeAux.CapabilityInfo,
-						  ASSOC_TIMEOUT, pAd->StaCfg.DefaultListenCount);
-
-			{
-				MlmeEnqueue(pAd, ASSOC_STATE_MACHINE, MT2_MLME_ASSOC_REQ,
-							sizeof(MLME_ASSOC_REQ_STRUCT), &AssocReq);
-
-				pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_ASSOC;
-			}
-		}
-		else
-		{
-			// This fail may because of the AP already keep us in its MAC table without
-			// ageing-out. The previous authentication attempt must have let it remove us.
-			// so try Authentication again may help. For D-Link DWL-900AP+ compatibility.
-			DBGPRINT(RT_DEBUG_TRACE, ("CNTL - AUTH FAIL, try again...\n"));
-			{
-				if ((pAd->StaCfg.AuthMode == Ndis802_11AuthModeShared) ||
-					(pAd->StaCfg.AuthMode == Ndis802_11AuthModeAutoSwitch))
-				{
-					// either Ndis802_11AuthModeShared or Ndis802_11AuthModeAutoSwitch, try shared key first
-					AuthParmFill(pAd, &AuthReq, pAd->MlmeAux.Bssid, AUTH_MODE_KEY);
-				}
-				else
-				{
-					AuthParmFill(pAd, &AuthReq, pAd->MlmeAux.Bssid, AUTH_MODE_OPEN);
-				}
-				MlmeEnqueue(pAd, AUTH_STATE_MACHINE, MT2_MLME_AUTH_REQ,
-							sizeof(MLME_AUTH_REQ_STRUCT), &AuthReq);
-
-			}
-			pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_AUTH2;
-		}
-	}
-}
-
-/*
-	==========================================================================
-	Description:
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
-*/
-VOID CntlWaitAuthProc2(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-	USHORT                       Reason;
-	MLME_ASSOC_REQ_STRUCT        AssocReq;
-	MLME_AUTH_REQ_STRUCT         AuthReq;
-
-	if (Elem->MsgType == MT2_AUTH_CONF)
-	{
-		NdisMoveMemory(&Reason, Elem->Msg, sizeof(USHORT));
-		if (Reason == MLME_SUCCESS)
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("CNTL - AUTH OK\n"));
-			AssocParmFill(pAd, &AssocReq, pAd->MlmeAux.Bssid, pAd->MlmeAux.CapabilityInfo,
-							  ASSOC_TIMEOUT, pAd->StaCfg.DefaultListenCount);
-			{
-				MlmeEnqueue(pAd, ASSOC_STATE_MACHINE, MT2_MLME_ASSOC_REQ,
-							sizeof(MLME_ASSOC_REQ_STRUCT), &AssocReq);
-
-				pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_ASSOC;
-			}
-		}
-		else
-		{
-			if ((pAd->StaCfg.AuthMode == Ndis802_11AuthModeAutoSwitch) &&
-				 (pAd->MlmeAux.Alg == Ndis802_11AuthModeShared))
-			{
-				DBGPRINT(RT_DEBUG_TRACE, ("CNTL - AUTH FAIL, try OPEN system...\n"));
-				AuthParmFill(pAd, &AuthReq, pAd->MlmeAux.Bssid, Ndis802_11AuthModeOpen);
-				MlmeEnqueue(pAd, AUTH_STATE_MACHINE, MT2_MLME_AUTH_REQ,
-							sizeof(MLME_AUTH_REQ_STRUCT), &AuthReq);
-
-				pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_AUTH2;
-			}
-			else
-			{
-				// not success, try next BSS
-				DBGPRINT(RT_DEBUG_TRACE, ("CNTL - AUTH FAIL, give up; try next BSS\n"));
-				pAd->Mlme.CntlMachine.CurrState = CNTL_IDLE; //???????
-				pAd->MlmeAux.BssIdx++;
-				IterateOnBssTab(pAd);
-			}
-		}
-	}
-}
-
-/*
-	==========================================================================
-	Description:
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
-*/
-VOID CntlWaitAssocProc(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-	USHORT      Reason;
-
-	if (Elem->MsgType == MT2_ASSOC_CONF)
-	{
-		NdisMoveMemory(&Reason, Elem->Msg, sizeof(USHORT));
-		if (Reason == MLME_SUCCESS)
-		{
-			if (pAd->CommonCfg.bWirelessEvent)
-			{
-				RTMPSendWirelessEvent(pAd, IW_ASSOC_EVENT_FLAG, pAd->MacTab.Content[BSSID_WCID].Addr, BSS0, 0);
-			}
-
-			LinkUp(pAd, BSS_INFRA);
-			pAd->Mlme.CntlMachine.CurrState = CNTL_IDLE;
-			DBGPRINT(RT_DEBUG_TRACE, ("CNTL - Association successful on BSS #%ld\n",pAd->MlmeAux.BssIdx));
-		}
-		else
-		{
-			// not success, try next BSS
-			DBGPRINT(RT_DEBUG_TRACE, ("CNTL - Association fails on BSS #%ld\n",pAd->MlmeAux.BssIdx));
-			pAd->MlmeAux.BssIdx++;
-			IterateOnBssTab(pAd);
-		}
-	}
-}
-
-/*
-	==========================================================================
-	Description:
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
-*/
-VOID CntlWaitReassocProc(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-	USHORT      Result;
-
-	if (Elem->MsgType == MT2_REASSOC_CONF)
-	{
-		NdisMoveMemory(&Result, Elem->Msg, sizeof(USHORT));
-		if (Result == MLME_SUCCESS)
-		{
-			// send wireless event - for association
-			if (pAd->CommonCfg.bWirelessEvent)
-				RTMPSendWirelessEvent(pAd, IW_ASSOC_EVENT_FLAG, pAd->MacTab.Content[BSSID_WCID].Addr, BSS0, 0);
-
-			//
-			// NDIS requires a new Link UP indication but no Link Down for RE-ASSOC
-			//
-			LinkUp(pAd, BSS_INFRA);
-
-			pAd->Mlme.CntlMachine.CurrState = CNTL_IDLE;
-			DBGPRINT(RT_DEBUG_TRACE, ("CNTL - Re-assocition successful on BSS #%ld\n", pAd->MlmeAux.RoamIdx));
-		}
-		else
-		{
-			// reassoc failed, try to pick next BSS in the BSS Table
-			DBGPRINT(RT_DEBUG_TRACE, ("CNTL - Re-assocition fails on BSS #%ld\n", pAd->MlmeAux.RoamIdx));
-			{
-				pAd->MlmeAux.RoamIdx++;
-				IterateOnBssTab2(pAd);
-			}
-		}
-	}
-}
-
-
-VOID	AdhocTurnOnQos(
-	IN  PRTMP_ADAPTER pAd)
-{
-#define AC0_DEF_TXOP		0
-#define AC1_DEF_TXOP		0
-#define AC2_DEF_TXOP		94
-#define AC3_DEF_TXOP		47
-
-	// Turn on QOs if use HT rate.
-	if (pAd->CommonCfg.APEdcaParm.bValid == FALSE)
-	{
-		pAd->CommonCfg.APEdcaParm.bValid = TRUE;
-		pAd->CommonCfg.APEdcaParm.Aifsn[0] = 3;
-		pAd->CommonCfg.APEdcaParm.Aifsn[1] = 7;
-		pAd->CommonCfg.APEdcaParm.Aifsn[2] = 1;
-		pAd->CommonCfg.APEdcaParm.Aifsn[3] = 1;
-
-		pAd->CommonCfg.APEdcaParm.Cwmin[0] = 4;
-		pAd->CommonCfg.APEdcaParm.Cwmin[1] = 4;
-		pAd->CommonCfg.APEdcaParm.Cwmin[2] = 3;
-		pAd->CommonCfg.APEdcaParm.Cwmin[3] = 2;
-
-		pAd->CommonCfg.APEdcaParm.Cwmax[0] = 10;
-		pAd->CommonCfg.APEdcaParm.Cwmax[1] = 6;
-		pAd->CommonCfg.APEdcaParm.Cwmax[2] = 4;
-		pAd->CommonCfg.APEdcaParm.Cwmax[3] = 3;
-
-		pAd->CommonCfg.APEdcaParm.Txop[0]  = 0;
-		pAd->CommonCfg.APEdcaParm.Txop[1]  = 0;
-		pAd->CommonCfg.APEdcaParm.Txop[2]  = AC2_DEF_TXOP;
-		pAd->CommonCfg.APEdcaParm.Txop[3]  = AC3_DEF_TXOP;
-	}
-	AsicSetEdcaParm(pAd, &pAd->CommonCfg.APEdcaParm);
-}
-
-/*
-	==========================================================================
-	Description:
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
-*/
-VOID LinkUp(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR BssType)
-{
-	ULONG	Now;
-	UINT32	Data;
-	BOOLEAN	Cancelled;
-	UCHAR	Value = 0, idx = 0, HashIdx = 0;
-	MAC_TABLE_ENTRY *pEntry = NULL, *pCurrEntry = NULL;
-
-	// Init ChannelQuality to prevent DEAD_CQI at initial LinkUp
-	pAd->Mlme.ChannelQuality = 50;
-
-	pEntry = MacTableLookup(pAd, pAd->CommonCfg.Bssid);
-	if (pEntry)
-	{
-		MacTableDeleteEntry(pAd, pEntry->Aid, pEntry->Addr);
-		pEntry = NULL;
-	}
-
-
-	pEntry = &pAd->MacTab.Content[BSSID_WCID];
-
-	//
-	// ASSOC - DisassocTimeoutAction
-	// CNTL - Dis-associate successful
-	// !!! LINK DOWN !!!
-	// [88888] OID_802_11_SSID should have returned NDTEST_WEP_AP2(Returned: )
-	//
-	// To prevent DisassocTimeoutAction to call Link down after we link up,
-	// cancel the DisassocTimer no matter what it start or not.
-	//
-	RTMPCancelTimer(&pAd->MlmeAux.DisassocTimer,  &Cancelled);
-
-	COPY_SETTINGS_FROM_MLME_AUX_TO_ACTIVE_CFG(pAd);
-
-#ifdef DOT11_N_SUPPORT
-	COPY_HTSETTINGS_FROM_MLME_AUX_TO_ACTIVE_CFG(pAd);
-#endif // DOT11_N_SUPPORT //
-
-#ifdef RTMP_MAC_PCI
-	// Before power save before link up function, We will force use 1R.
-	// So after link up, check Rx antenna # again.
-	RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R3, &Value);
-	if(pAd->Antenna.field.RxPath == 3)
-	{
-		Value |= (0x10);
-	}
-	else if(pAd->Antenna.field.RxPath == 2)
-	{
-		Value |= (0x8);
-	}
-	else if(pAd->Antenna.field.RxPath == 1)
-	{
-		Value |= (0x0);
-	}
-	RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R3, Value);
-	pAd->StaCfg.BBPR3 = Value;
-#endif // RTMP_MAC_PCI //
-
-	if (BssType == BSS_ADHOC)
-	{
-		OPSTATUS_SET_FLAG(pAd, fOP_STATUS_ADHOC_ON);
-		OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_INFRA_ON);
-
-#ifdef CARRIER_DETECTION_SUPPORT // Roger sync Carrier
-		// No carrier detection when adhoc
-		// CarrierDetectionStop(pAd);
-		pAd->CommonCfg.CarrierDetect.CD_State = CD_NORMAL;
-#endif // CARRIER_DETECTION_SUPPORT //
-
-#ifdef DOT11_N_SUPPORT
-		if (pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED)
-			AdhocTurnOnQos(pAd);
-#endif // DOT11_N_SUPPORT //
-
-		DBGPRINT(RT_DEBUG_TRACE, ("!!!Adhoc LINK UP !!! \n" ));
-	}
-	else
-	{
-		OPSTATUS_SET_FLAG(pAd, fOP_STATUS_INFRA_ON);
-		OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_ADHOC_ON);
-
-		DBGPRINT(RT_DEBUG_TRACE, ("!!!Infra LINK UP !!! \n" ));
-	}
-
-		// 3*3
-		// reset Tx beamforming bit
-		RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R4, &Value);
-		Value &= (~0x01);
-		Value |= pAd->CommonCfg.RegTransmitSetting.field.TxBF;
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R4, Value);
-
-#ifdef DOT11_N_SUPPORT
-	// Change to AP channel
-        if ((pAd->CommonCfg.CentralChannel > pAd->CommonCfg.Channel) && (pAd->MlmeAux.HtCapability.HtCapInfo.ChannelWidth == BW_40))
-	{
-		// Must using 40MHz.
-		pAd->CommonCfg.BBPCurrentBW = BW_40;
-		AsicSwitchChannel(pAd, pAd->CommonCfg.CentralChannel, FALSE);
-		AsicLockChannel(pAd, pAd->CommonCfg.CentralChannel);
-
-		RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R4, &Value);
-		Value &= (~0x18);
-		Value |= 0x10;
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R4, Value);
-
-		//  RX : control channel at lower
-		RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R3, &Value);
-		Value &= (~0x20);
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R3, Value);
-#ifdef RTMP_MAC_PCI
-            pAd->StaCfg.BBPR3 = Value;
-#endif // RTMP_MAC_PCI //
-
-		RTMP_IO_READ32(pAd, TX_BAND_CFG, &Data);
-		Data &= 0xfffffffe;
-		RTMP_IO_WRITE32(pAd, TX_BAND_CFG, Data);
-
-		if (pAd->MACVersion == 0x28600100)
-		{
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R69, 0x1A);
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R70, 0x0A);
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R73, 0x16);
-                DBGPRINT(RT_DEBUG_TRACE, ("!!!rt2860C !!! \n" ));
-		}
-
-		DBGPRINT(RT_DEBUG_TRACE, ("!!!40MHz Lower LINK UP !!! Control Channel at Below. Central = %d \n", pAd->CommonCfg.CentralChannel ));
-	}
-		else if ((pAd->CommonCfg.CentralChannel < pAd->CommonCfg.Channel) && (pAd->MlmeAux.HtCapability.HtCapInfo.ChannelWidth == BW_40))
-	    {
-		    // Must using 40MHz.
-			pAd->CommonCfg.BBPCurrentBW = BW_40;
-			AsicSwitchChannel(pAd, pAd->CommonCfg.CentralChannel, FALSE);
-		    AsicLockChannel(pAd, pAd->CommonCfg.CentralChannel);
-
-			RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R4, &Value);
-		Value &= (~0x18);
-		Value |= 0x10;
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R4, Value);
-
-		RTMP_IO_READ32(pAd, TX_BAND_CFG, &Data);
-		Data |= 0x1;
-		RTMP_IO_WRITE32(pAd, TX_BAND_CFG, Data);
-
-			RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R3, &Value);
-		    Value |= (0x20);
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R3, Value);
-#ifdef RTMP_MAC_PCI
-            pAd->StaCfg.BBPR3 = Value;
-#endif // RTMP_MAC_PCI //
-
-		if (pAd->MACVersion == 0x28600100)
-		{
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R69, 0x1A);
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R70, 0x0A);
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R73, 0x16);
-			    DBGPRINT(RT_DEBUG_TRACE, ("!!!rt2860C !!! \n" ));
-		}
-
-		    DBGPRINT(RT_DEBUG_TRACE, ("!!! 40MHz Upper LINK UP !!! Control Channel at UpperCentral = %d \n", pAd->CommonCfg.CentralChannel ));
-	    }
-	    else
-#endif // DOT11_N_SUPPORT //
-	    {
-		    pAd->CommonCfg.BBPCurrentBW = BW_20;
-		pAd->CommonCfg.CentralChannel = pAd->CommonCfg.Channel;
-			AsicSwitchChannel(pAd, pAd->CommonCfg.Channel, FALSE);
-			AsicLockChannel(pAd, pAd->CommonCfg.Channel);
-
-			RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R4, &Value);
-			Value &= (~0x18);
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R4, Value);
-
-			RTMP_IO_READ32(pAd, TX_BAND_CFG, &Data);
-			Data &= 0xfffffffe;
-			RTMP_IO_WRITE32(pAd, TX_BAND_CFG, Data);
-
-			RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R3, &Value);
-			Value &= (~0x20);
-			RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R3, Value);
-#ifdef RTMP_MAC_PCI
-            pAd->StaCfg.BBPR3 = Value;
-#endif // RTMP_MAC_PCI //
-
-			if (pAd->MACVersion == 0x28600100)
-			{
-				RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R69, 0x16);
-				RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R70, 0x08);
-				RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R73, 0x11);
-				DBGPRINT(RT_DEBUG_TRACE, ("!!!rt2860C !!! \n" ));
-			}
-
-		    DBGPRINT(RT_DEBUG_TRACE, ("!!! 20MHz LINK UP !!! \n" ));
-	}
-
-	RTMPSetAGCInitValue(pAd, pAd->CommonCfg.BBPCurrentBW);
-	//
-	// Save BBP_R66 value, it will be used in RTUSBResumeMsduTransmission
-	//
-	RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R66, &pAd->BbpTuning.R66CurrentValue);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("!!! LINK UP !!! (BssType=%d, AID=%d, ssid=%s, Channel=%d, CentralChannel = %d)\n",
-		BssType, pAd->StaActive.Aid, pAd->CommonCfg.Ssid, pAd->CommonCfg.Channel, pAd->CommonCfg.CentralChannel));
-
-#ifdef DOT11_N_SUPPORT
-	DBGPRINT(RT_DEBUG_TRACE, ("!!! LINK UP !!! (Density =%d, )\n", pAd->MacTab.Content[BSSID_WCID].MpduDensity));
-#endif // DOT11_N_SUPPORT //
-
-		AsicSetBssid(pAd, pAd->CommonCfg.Bssid);
-
-	AsicSetSlotTime(pAd, TRUE);
-	AsicSetEdcaParm(pAd, &pAd->CommonCfg.APEdcaParm);
-
-
-	// Call this for RTS protectionfor legacy rate, we will always enable RTS threshold, but normally it will not hit
-	AsicUpdateProtect(pAd, 0, (OFDMSETPROTECT | CCKSETPROTECT), TRUE, FALSE);
-
-#ifdef DOT11_N_SUPPORT
-	if ((pAd->StaActive.SupportedPhyInfo.bHtEnable == TRUE))
-	{
-		// Update HT protectionfor based on AP's operating mode.
-	if (pAd->MlmeAux.AddHtInfo.AddHtInfo2.NonGfPresent == 1)
-	{
-		AsicUpdateProtect(pAd, pAd->MlmeAux.AddHtInfo.AddHtInfo2.OperaionMode,  ALLN_SETPROTECT, FALSE, TRUE);
-	}
-	else
-			AsicUpdateProtect(pAd, pAd->MlmeAux.AddHtInfo.AddHtInfo2.OperaionMode,  ALLN_SETPROTECT, FALSE, FALSE);
-	}
-#endif // DOT11_N_SUPPORT //
-
-	NdisZeroMemory(&pAd->DrsCounters, sizeof(COUNTER_DRS));
-
-	NdisGetSystemUpTime(&Now);
-	pAd->StaCfg.LastBeaconRxTime = Now;   // last RX timestamp
-
-	if ((pAd->CommonCfg.TxPreamble != Rt802_11PreambleLong) &&
-		CAP_IS_SHORT_PREAMBLE_ON(pAd->StaActive.CapabilityInfo))
-	{
-		MlmeSetTxPreamble(pAd, Rt802_11PreambleShort);
-	}
-
-	OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_AGGREGATION_INUSED);
-
-	if (pAd->CommonCfg.RadarDetect.RDMode == RD_SILENCE_MODE)
-	{
-#ifdef DFS_SUPPORT
-		RadarDetectionStop(pAd);
-#endif // DFS_SUPPORT //
-	}
-	pAd->CommonCfg.RadarDetect.RDMode = RD_NORMAL_MODE;
-
-	if (BssType == BSS_ADHOC)
-	{
-		MakeIbssBeacon(pAd);
-		if ((pAd->CommonCfg.Channel > 14)
-			&& (pAd->CommonCfg.bIEEE80211H == 1)
-			&& RadarChannelCheck(pAd, pAd->CommonCfg.Channel))
-		{
-			; //Do nothing
-		}
-		else
-		{
-			AsicEnableIbssSync(pAd);
-		}
-
-		// In ad hoc mode, use MAC table from index 1.
-		// p.s ASIC use all 0xff as termination of WCID table search.To prevent it's 0xff-ff-ff-ff-ff-ff, Write 0 here.
-		RTMP_IO_WRITE32(pAd, MAC_WCID_BASE, 0x00);
-		RTMP_IO_WRITE32(pAd, 0x1808, 0x00);
-
-		// If WEP is enabled, add key material and cipherAlg into Asic
-		// Fill in Shared Key Table(offset: 0x6c00) and Shared Key Mode(offset: 0x7000)
-
-		if (pAd->StaCfg.WepStatus == Ndis802_11WEPEnabled)
-		{
-			PUCHAR	Key;
-			UCHAR	CipherAlg;
-
-			for (idx=0; idx < SHARE_KEY_NUM; idx++)
-		{
-				CipherAlg = pAd->SharedKey[BSS0][idx].CipherAlg;
-			Key = pAd->SharedKey[BSS0][idx].Key;
-
-				if (pAd->SharedKey[BSS0][idx].KeyLen > 0)
-				{
-					// Set key material and cipherAlg to Asic
-				AsicAddSharedKeyEntry(pAd, BSS0, idx, CipherAlg, Key, NULL, NULL);
-
-                    if (idx == pAd->StaCfg.DefaultKeyId)
-					{
-						// Update WCID attribute table and IVEIV table for this group key table
-						RTMPAddWcidAttributeEntry(pAd, BSS0, idx, CipherAlg, NULL);
-					}
-				}
-
-
-			}
-		}
-		// If WPANone is enabled, add key material and cipherAlg into Asic
-		// Fill in Shared Key Table(offset: 0x6c00) and Shared Key Mode(offset: 0x7000)
-		else if (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPANone)
-		{
-			pAd->StaCfg.DefaultKeyId = 0;	// always be zero
-
-            NdisZeroMemory(&pAd->SharedKey[BSS0][0], sizeof(CIPHER_KEY));
-							pAd->SharedKey[BSS0][0].KeyLen = LEN_TKIP_EK;
-			NdisMoveMemory(pAd->SharedKey[BSS0][0].Key, pAd->StaCfg.PMK, LEN_TKIP_EK);
-
-            if (pAd->StaCfg.PairCipher == Ndis802_11Encryption2Enabled)
-            {
-			NdisMoveMemory(pAd->SharedKey[BSS0][0].RxMic, &pAd->StaCfg.PMK[16], LEN_TKIP_RXMICK);
-			NdisMoveMemory(pAd->SharedKey[BSS0][0].TxMic, &pAd->StaCfg.PMK[16], LEN_TKIP_TXMICK);
-            }
-
-			// Decide its ChiperAlg
-			if (pAd->StaCfg.PairCipher == Ndis802_11Encryption2Enabled)
-				pAd->SharedKey[BSS0][0].CipherAlg = CIPHER_TKIP;
-			else if (pAd->StaCfg.PairCipher == Ndis802_11Encryption3Enabled)
-				pAd->SharedKey[BSS0][0].CipherAlg = CIPHER_AES;
-			else
-            {
-                DBGPRINT(RT_DEBUG_TRACE, ("Unknow Cipher (=%d), set Cipher to AES\n", pAd->StaCfg.PairCipher));
-				pAd->SharedKey[BSS0][0].CipherAlg = CIPHER_AES;
-            }
-
-			// Set key material and cipherAlg to Asic
-			AsicAddSharedKeyEntry(pAd,
-								  BSS0,
-								  0,
-								  pAd->SharedKey[BSS0][0].CipherAlg,
-								  pAd->SharedKey[BSS0][0].Key,
-								  pAd->SharedKey[BSS0][0].TxMic,
-								  pAd->SharedKey[BSS0][0].RxMic);
-
-            // Update WCID attribute table and IVEIV table for this group key table
-			RTMPAddWcidAttributeEntry(pAd, BSS0, 0, pAd->SharedKey[BSS0][0].CipherAlg, NULL);
-
-		}
-
-	}
-	else // BSS_INFRA
-	{
-		// Check the new SSID with last SSID
-		while (Cancelled == TRUE)
-		{
-			if (pAd->CommonCfg.LastSsidLen == pAd->CommonCfg.SsidLen)
-			{
-				if (RTMPCompareMemory(pAd->CommonCfg.LastSsid, pAd->CommonCfg.Ssid, pAd->CommonCfg.LastSsidLen) == 0)
-				{
-					// Link to the old one no linkdown is required.
-					break;
-				}
-			}
-			// Send link down event before set to link up
-			pAd->IndicateMediaState = NdisMediaStateDisconnected;
-			RTMP_IndicateMediaState(pAd);
-            pAd->ExtraInfo = GENERAL_LINK_DOWN;
-			DBGPRINT(RT_DEBUG_TRACE, ("NDIS_STATUS_MEDIA_DISCONNECT Event AA!\n"));
-			break;
-		}
-
-		//
-		// On WPA mode, Remove All Keys if not connect to the last BSSID
-		// Key will be set after 4-way handshake.
-		//
-		if (pAd->StaCfg.AuthMode >= Ndis802_11AuthModeWPA)
-		{
-			ULONG		IV;
-
-			// Remove all WPA keys
-			RTMP_CLEAR_PSFLAG(pAd, fRTMP_PS_CAN_GO_SLEEP);
-			RTMPWPARemoveAllKeys(pAd);
-			pAd->StaCfg.PortSecured = WPA_802_1X_PORT_NOT_SECURED;
-			pAd->StaCfg.PrivacyFilter = Ndis802_11PrivFilter8021xWEP;
-
-			// Fixed connection failed with Range Maximizer - 515 AP (Marvell Chip) when security is WPAPSK/TKIP
-			// If IV related values are too large in GroupMsg2, AP would ignore this message.
-			IV = 1;
-			IV |= (pAd->StaCfg.DefaultKeyId << 30);
-			AsicUpdateWCIDIVEIV(pAd, BSSID_WCID, IV, 0);
-			//RTMP_CLEAR_PSFLAG(pAd, fRTMP_PS_CAN_GO_SLEEP);
-		}
-
-		// NOTE:
-		// the decision of using "short slot time" or not may change dynamically due to
-		// new STA association to the AP. so we have to decide that upon parsing BEACON, not here
-
-		// NOTE:
-		// the decision to use "RTC/CTS" or "CTS-to-self" protection or not may change dynamically
-		// due to new STA association to the AP. so we have to decide that upon parsing BEACON, not here
-
-		ComposePsPoll(pAd);
-		ComposeNullFrame(pAd);
-
-			AsicEnableBssSync(pAd);
-
-		// Add BSSID to WCID search table
-		AsicUpdateRxWCIDTable(pAd, BSSID_WCID, pAd->CommonCfg.Bssid);
-
-		// If WEP is enabled, add paiewise and shared key
-#ifdef WPA_SUPPLICANT_SUPPORT
-        if (((pAd->StaCfg.WpaSupplicantUP)&&
-             (pAd->StaCfg.WepStatus == Ndis802_11WEPEnabled)&&
-             (pAd->StaCfg.PortSecured == WPA_802_1X_PORT_SECURED)) ||
-            ((pAd->StaCfg.WpaSupplicantUP == WPA_SUPPLICANT_DISABLE)&&
-              (pAd->StaCfg.WepStatus == Ndis802_11WEPEnabled)))
-#else
-		if (pAd->StaCfg.WepStatus == Ndis802_11WEPEnabled)
-#endif // WPA_SUPPLICANT_SUPPORT //
-		{
-			PUCHAR	Key;
-			UCHAR	CipherAlg;
-
-			for (idx=0; idx < SHARE_KEY_NUM; idx++)
-		{
-				CipherAlg = pAd->SharedKey[BSS0][idx].CipherAlg;
-			Key = pAd->SharedKey[BSS0][idx].Key;
-
-				if (pAd->SharedKey[BSS0][idx].KeyLen > 0)
-				{
-					// Set key material and cipherAlg to Asic
-				AsicAddSharedKeyEntry(pAd, BSS0, idx, CipherAlg, Key, NULL, NULL);
-
-					if (idx == pAd->StaCfg.DefaultKeyId)
-					{
-						// Assign group key info
-						RTMPAddWcidAttributeEntry(pAd, BSS0, idx, CipherAlg, NULL);
-
-						pEntry->Aid = BSSID_WCID;
-						// Assign pairwise key info
-						RTMPAddWcidAttributeEntry(pAd, BSS0, idx, CipherAlg, pEntry);
-					}
-				}
-			}
-		}
-
-		// only INFRASTRUCTURE mode need to indicate connectivity immediately; ADHOC mode
-		// should wait until at least 2 active nodes in this BSSID.
-		OPSTATUS_SET_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED);
-
-        // For GUI ++
-		if (pAd->StaCfg.AuthMode < Ndis802_11AuthModeWPA)
-		{
-			pAd->IndicateMediaState = NdisMediaStateConnected;
-			pAd->ExtraInfo = GENERAL_LINK_UP;
-			RTMP_IndicateMediaState(pAd);
-		}
-		else if ((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPAPSK) ||
-				 (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK))
-		{
-#ifdef WPA_SUPPLICANT_SUPPORT
-			if (pAd->StaCfg.WpaSupplicantUP == WPA_SUPPLICANT_DISABLE)
-#endif // WPA_SUPPLICANT_SUPPORT //
-				RTMPSetTimer(&pAd->Mlme.LinkDownTimer, LINK_DOWN_TIMEOUT);
-		}
-        // --
-
-		// Add BSSID in my MAC Table.
-        NdisAcquireSpinLock(&pAd->MacTabLock);
-		// add this MAC entry into HASH table
-		if (pEntry)
-		{
-			HashIdx = MAC_ADDR_HASH_INDEX(pAd->CommonCfg.Bssid);
-			if (pAd->MacTab.Hash[HashIdx] == NULL)
-			{
-				pAd->MacTab.Hash[HashIdx] = pEntry;
-			}
-			else
-			{
-				pCurrEntry = pAd->MacTab.Hash[HashIdx];
-				while (pCurrEntry->pNext != NULL)
-				{
-					pCurrEntry = pCurrEntry->pNext;
-				}
-				pCurrEntry->pNext = pEntry;
-			}
-		}
-		RTMPMoveMemory(pEntry->Addr, pAd->CommonCfg.Bssid, MAC_ADDR_LEN);
-		pEntry->Aid = BSSID_WCID;
-		pEntry->pAd = pAd;
-		pEntry->ValidAsCLI = TRUE;	//Although this is bssid..still set ValidAsCl
-		pAd->MacTab.Size = 1;	// infra mode always set MACtab size =1.
-		pEntry->Sst = SST_ASSOC;
-		pEntry->AuthState = SST_ASSOC;
-		pEntry->AuthMode = pAd->StaCfg.AuthMode;
-		pEntry->WepStatus = pAd->StaCfg.WepStatus;
-		if (pEntry->AuthMode < Ndis802_11AuthModeWPA)
-		{
-			pEntry->WpaState = AS_NOTUSE;
-			pEntry->PrivacyFilter = Ndis802_11PrivFilterAcceptAll;
-		}
-		else
-		{
-			pEntry->WpaState = AS_PTKSTART;
-			pEntry->PrivacyFilter = Ndis802_11PrivFilter8021xWEP;
-		}
-		NdisReleaseSpinLock(&pAd->MacTabLock);
-
-		DBGPRINT(RT_DEBUG_TRACE, ("!!! LINK UP !!!  ClientStatusFlags=%lx)\n",
-			pAd->MacTab.Content[BSSID_WCID].ClientStatusFlags));
-
-
-		MlmeUpdateTxRates(pAd, TRUE, BSS0);
-#ifdef DOT11_N_SUPPORT
-		MlmeUpdateHtTxRates(pAd, BSS0);
-		DBGPRINT(RT_DEBUG_TRACE, ("!!! LINK UP !! (StaActive.bHtEnable =%d, )\n", pAd->StaActive.SupportedPhyInfo.bHtEnable));
-#endif // DOT11_N_SUPPORT //
-
-
-		if (pAd->CommonCfg.bAggregationCapable)
-		{
-			if ((pAd->CommonCfg.bPiggyBackCapable) && (pAd->MlmeAux.APRalinkIe & 0x00000003) == 3)
-			{
-
-				OPSTATUS_SET_FLAG(pAd, fOP_STATUS_PIGGYBACK_INUSED);
-				OPSTATUS_SET_FLAG(pAd, fOP_STATUS_AGGREGATION_INUSED);
-				CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_AGGREGATION_CAPABLE);
-				CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_PIGGYBACK_CAPABLE);
-				RTMPSetPiggyBack(pAd, TRUE);
-				DBGPRINT(RT_DEBUG_TRACE, ("Turn on Piggy-Back\n"));
-			}
-			else if (pAd->MlmeAux.APRalinkIe & 0x00000001)
-			{
-				CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_AGGREGATION_CAPABLE);
-				OPSTATUS_SET_FLAG(pAd, fOP_STATUS_AGGREGATION_INUSED);
-			}
-		}
-
-		if (pAd->MlmeAux.APRalinkIe != 0x0)
-		{
-#ifdef DOT11_N_SUPPORT
-			if (CLIENT_STATUS_TEST_FLAG(&pAd->MacTab.Content[BSSID_WCID], fCLIENT_STATUS_RDG_CAPABLE))
-			{
-				AsicEnableRDG(pAd);
-			}
-#endif // DOT11_N_SUPPORT //
-			OPSTATUS_SET_FLAG(pAd, fCLIENT_STATUS_RALINK_CHIPSET);
-			CLIENT_STATUS_SET_FLAG(&pAd->MacTab.Content[BSSID_WCID], fCLIENT_STATUS_RALINK_CHIPSET);
-		}
-		else
-		{
-			OPSTATUS_CLEAR_FLAG(pAd, fCLIENT_STATUS_RALINK_CHIPSET);
-			CLIENT_STATUS_CLEAR_FLAG(&pAd->MacTab.Content[BSSID_WCID], fCLIENT_STATUS_RALINK_CHIPSET);
-		}
-	}
-
-
-#ifdef DOT11_N_SUPPORT
-	DBGPRINT(RT_DEBUG_TRACE, ("NDIS_STATUS_MEDIA_CONNECT Event B!.BACapability = %x. ClientStatusFlags = %lx\n", pAd->CommonCfg.BACapability.word, pAd->MacTab.Content[BSSID_WCID].ClientStatusFlags));
-#endif // DOT11_N_SUPPORT //
-
-	// Set LED
-	RTMPSetLED(pAd, LED_LINK_UP);
-
-	pAd->Mlme.PeriodicRound = 0;
-	pAd->Mlme.OneSecPeriodicRound = 0;
-	pAd->bConfigChanged = FALSE;        // Reset config flag
-	pAd->ExtraInfo = GENERAL_LINK_UP;   // Update extra information to link is up
-
-	// Set asic auto fall back
-	{
-		PUCHAR					pTable;
-		UCHAR					TableSize = 0;
-
-		MlmeSelectTxRateTable(pAd, &pAd->MacTab.Content[BSSID_WCID], &pTable, &TableSize, &pAd->CommonCfg.TxRateIndex);
-		AsicUpdateAutoFallBackTable(pAd, pTable);
-	}
-
-	NdisAcquireSpinLock(&pAd->MacTabLock);
-    pEntry->HTPhyMode.word = pAd->StaCfg.HTPhyMode.word;
-    pEntry->MaxHTPhyMode.word = pAd->StaCfg.HTPhyMode.word;
-	if (pAd->StaCfg.bAutoTxRateSwitch == FALSE)
-	{
-		pEntry->bAutoTxRateSwitch = FALSE;
-#ifdef DOT11_N_SUPPORT
-		if (pEntry->HTPhyMode.field.MCS == 32)
-			pEntry->HTPhyMode.field.ShortGI = GI_800;
-
-		if ((pEntry->HTPhyMode.field.MCS > MCS_7) || (pEntry->HTPhyMode.field.MCS == 32))
-			pEntry->HTPhyMode.field.STBC = STBC_NONE;
-#endif // DOT11_N_SUPPORT //
-		// If the legacy mode is set, overwrite the transmit setting of this entry.
-		if (pEntry->HTPhyMode.field.MODE <= MODE_OFDM)
-			RTMPUpdateLegacyTxSetting((UCHAR)pAd->StaCfg.DesiredTransmitSetting.field.FixedTxMode, pEntry);
-	}
-	else
-		pEntry->bAutoTxRateSwitch = TRUE;
-	NdisReleaseSpinLock(&pAd->MacTabLock);
-
-	//  Let Link Status Page display first initial rate.
-	pAd->LastTxRate = (USHORT)(pEntry->HTPhyMode.word);
-	// Select DAC according to HT or Legacy
-	if (pAd->StaActive.SupportedPhyInfo.MCSSet[0] != 0x00)
-	{
-		RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R1, &Value);
-		Value &= (~0x18);
-		if (pAd->Antenna.field.TxPath == 2)
-		{
-		    Value |= 0x10;
-		}
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R1, Value);
-	}
-	else
-	{
-		RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R1, &Value);
-		Value &= (~0x18);
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R1, Value);
-	}
-
-#ifdef DOT11_N_SUPPORT
-	if (pAd->StaActive.SupportedPhyInfo.bHtEnable == FALSE)
-	{
-	}
-	else if (pEntry->MaxRAmpduFactor == 0)
-	{
-	    // If HT AP doesn't support MaxRAmpduFactor = 1, we need to set max PSDU to 0.
-	    // Because our Init value is 1 at MACRegTable.
-		RTMP_IO_WRITE32(pAd, MAX_LEN_CFG, 0x0fff);
-	}
-#endif // DOT11_N_SUPPORT //
-
-	// Patch for Marvel AP to gain high throughput
-	// Need to set as following,
-	// 1. Set txop in register-EDCA_AC0_CFG as 0x60
-	// 2. Set EnTXWriteBackDDONE in register-WPDMA_GLO_CFG as zero
-	// 3. PBF_MAX_PCNT as 0x1F3FBF9F
-	// 4. kick per two packets when dequeue
-	//
-	// Txop can only be modified when RDG is off, WMM is disable and TxBurst is enable
-	//
-	// if 1. Legacy AP WMM on,  or 2. 11n AP, AMPDU disable.  Force turn off burst no matter what bEnableTxBurst is.
-#ifdef DOT11_N_SUPPORT
-	if (!((pAd->CommonCfg.RxStream == 1)&&(pAd->CommonCfg.TxStream == 1)) &&
-		(pAd->StaCfg.bForceTxBurst == FALSE) &&
-		(((pAd->StaActive.SupportedPhyInfo.bHtEnable == FALSE) && OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_WMM_INUSED))
-		|| ((pAd->StaActive.SupportedPhyInfo.bHtEnable == TRUE) && (pAd->CommonCfg.BACapability.field.Policy == BA_NOTUSE))))
-	{
-		RTMP_IO_READ32(pAd, EDCA_AC0_CFG, &Data);
-		Data  &= 0xFFFFFF00;
-		RTMP_IO_WRITE32(pAd, EDCA_AC0_CFG, Data);
-
-		RTMP_IO_WRITE32(pAd, PBF_MAX_PCNT, 0x1F3F7F9F);
-		DBGPRINT(RT_DEBUG_TRACE, ("Txburst 1\n"));
-	}
-	else
-#endif // DOT11_N_SUPPORT //
-	if (pAd->CommonCfg.bEnableTxBurst)
-	{
-		RTMP_IO_READ32(pAd, EDCA_AC0_CFG, &Data);
-		Data  &= 0xFFFFFF00;
-		Data  |= 0x60;
-		RTMP_IO_WRITE32(pAd, EDCA_AC0_CFG, Data);
-		pAd->CommonCfg.IOTestParm.bNowAtherosBurstOn = TRUE;
-
-		RTMP_IO_WRITE32(pAd, PBF_MAX_PCNT, 0x1F3FBF9F);
-		DBGPRINT(RT_DEBUG_TRACE, ("Txburst 2\n"));
-	}
-	else
-	{
-		RTMP_IO_READ32(pAd, EDCA_AC0_CFG, &Data);
-		Data  &= 0xFFFFFF00;
-		RTMP_IO_WRITE32(pAd, EDCA_AC0_CFG, Data);
-
-		RTMP_IO_WRITE32(pAd, PBF_MAX_PCNT, 0x1F3F7F9F);
-		DBGPRINT(RT_DEBUG_TRACE, ("Txburst 3\n"));
-	}
-
-#ifdef DOT11_N_SUPPORT
-	// Re-check to turn on TX burst or not.
-	if ((pAd->CommonCfg.IOTestParm.bLastAtheros == TRUE) && ((STA_WEP_ON(pAd))||(STA_TKIP_ON(pAd))))
-	{
-		pAd->CommonCfg.IOTestParm.bNextDisableRxBA = TRUE;
-		if (pAd->CommonCfg.bEnableTxBurst)
-		{
-		    UINT32 MACValue = 0;
-			// Force disable  TXOP value in this case. The same action in MLMEUpdateProtect too.
-			// I didn't change PBF_MAX_PCNT setting.
-			RTMP_IO_READ32(pAd, EDCA_AC0_CFG, &MACValue);
-			MACValue  &= 0xFFFFFF00;
-			RTMP_IO_WRITE32(pAd, EDCA_AC0_CFG, MACValue);
-			pAd->CommonCfg.IOTestParm.bNowAtherosBurstOn = FALSE;
-		}
-	}
-	else
-	{
-		pAd->CommonCfg.IOTestParm.bNextDisableRxBA = FALSE;
-	}
-#endif // DOT11_N_SUPPORT //
-
-	pAd->CommonCfg.IOTestParm.bLastAtheros = FALSE;
-	COPY_MAC_ADDR(pAd->CommonCfg.LastBssid, pAd->CommonCfg.Bssid);
-	DBGPRINT(RT_DEBUG_TRACE, ("!!!pAd->bNextDisableRxBA= %d \n", pAd->CommonCfg.IOTestParm.bNextDisableRxBA));
-	// BSSID add in one MAC entry too.  Because in Tx, ASIC need to check Cipher and IV/EIV, BAbitmap
-	// Pther information in MACTab.Content[BSSID_WCID] is not necessary for driver.
-	// Note: As STA, The MACTab.Content[BSSID_WCID]. PairwiseKey and Shared Key for BSS0 are the same.
-
-	if (pAd->StaCfg.WepStatus <= Ndis802_11WEPDisabled)
-	{
-#ifdef WPA_SUPPLICANT_SUPPORT
-		if (pAd->StaCfg.WpaSupplicantUP &&
-			(pAd->StaCfg.WepStatus == Ndis802_11WEPEnabled) &&
-			(pAd->StaCfg.IEEE8021X == TRUE))
-			;
-		else
-#endif // WPA_SUPPLICANT_SUPPORT //
-		{
-			pAd->StaCfg.PortSecured = WPA_802_1X_PORT_SECURED;
-			pAd->StaCfg.PrivacyFilter = Ndis802_11PrivFilterAcceptAll;
-		}
-	}
-
-	NdisAcquireSpinLock(&pAd->MacTabLock);
-	pEntry->PortSecured = pAd->StaCfg.PortSecured;
-	NdisReleaseSpinLock(&pAd->MacTabLock);
-
-    //
-	// Patch Atheros AP TX will breakdown issue.
-	// AP Model: DLink DWL-8200AP
-	//
-	if (INFRA_ON(pAd) && OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_WMM_INUSED) && STA_TKIP_ON(pAd))
-	{
-		RTMP_IO_WRITE32(pAd, RX_PARSER_CFG, 0x01);
-	}
-	else
-	{
-		RTMP_IO_WRITE32(pAd, RX_PARSER_CFG, 0x00);
-	}
-
-	RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS);
-	RTMP_CLEAR_PSFLAG(pAd, fRTMP_PS_GO_TO_SLEEP_NOW);
-
-#ifdef DOT11_N_SUPPORT
-#ifdef DOT11N_DRAFT3
-	if ((pAd->CommonCfg.BACapability.field.b2040CoexistScanSup) && (pAd->CommonCfg.Channel <= 11))
-	{
-		OPSTATUS_SET_FLAG(pAd, fOP_STATUS_SCAN_2040);
-		BuildEffectedChannelList(pAd);
-	}
-#endif // DOT11N_DRAFT3 //
-#endif // DOT11_N_SUPPORT //
-}
-
-/*
-	==========================================================================
-
-	Routine	Description:
-		Disconnect current BSSID
-
-	Arguments:
-		pAd				- Pointer to our adapter
-		IsReqFromAP		- Request from AP
-
-	Return Value:
-		None
-
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-		We need more information to know it's this requst from AP.
-		If yes! we need to do extra handling, for example, remove the WPA key.
-		Otherwise on 4-way handshaking will faied, since the WPA key didn't be
-		remove while auto reconnect.
-		Disconnect request from AP, it means we will start afresh 4-way handshaking
-		on WPA mode.
-
-	==========================================================================
-*/
-VOID LinkDown(
-	IN PRTMP_ADAPTER pAd,
-	IN  BOOLEAN      IsReqFromAP)
-{
-	UCHAR			    i, ByteValue = 0;
-
-	BOOLEAN		Cancelled;
-
-	// Do nothing if monitor mode is on
-	if (MONITOR_ON(pAd))
-		return;
-
-#ifdef RALINK_ATE
-	// Nothing to do in ATE mode.
-	if (ATE_ON(pAd))
-		return;
-#endif // RALINK_ATE //
-	RTMP_CLEAR_PSFLAG(pAd, fRTMP_PS_GO_TO_SLEEP_NOW);
-	//Comment the codes, beasue the line 2291 call the same function.
-	//RTMPCancelTimer(&pAd->Mlme.PsPollTimer,		&Cancelled);
-	// Not allow go to sleep within linkdown function.
-	RTMP_CLEAR_PSFLAG(pAd, fRTMP_PS_CAN_GO_SLEEP);
-
-    if (pAd->CommonCfg.bWirelessEvent)
-	{
-		RTMPSendWirelessEvent(pAd, IW_STA_LINKDOWN_EVENT_FLAG, pAd->MacTab.Content[BSSID_WCID].Addr, BSS0, 0);
-	}
-
-	DBGPRINT(RT_DEBUG_TRACE, ("!!! LINK DOWN !!!\n"));
-	OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_AGGREGATION_INUSED);
-
-#ifdef RTMP_MAC_PCI
-    if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE))
-    {
-	    BOOLEAN Cancelled;
-        pAd->Mlme.bPsPollTimerRunning = FALSE;
-        RTMPCancelTimer(&pAd->Mlme.PsPollTimer,	&Cancelled);
-    }
-
-	pAd->bPCIclkOff = FALSE;
-#endif // RTMP_MAC_PCI //
-
-    if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE)
-||	RTMP_TEST_PSFLAG(pAd, fRTMP_PS_SET_PCI_CLK_OFF_COMMAND)
-		|| RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_IDLE_RADIO_OFF))
-    {
-        AUTO_WAKEUP_STRUC AutoWakeupCfg;
-		AsicForceWakeup(pAd, TRUE);
-        AutoWakeupCfg.word = 0;
-	    RTMP_IO_WRITE32(pAd, AUTO_WAKEUP_CFG, AutoWakeupCfg.word);
-        OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_DOZE);
-    }
-#ifdef RTMP_MAC_PCI
-	pAd->bPCIclkOff = FALSE;
-#endif // RTMP_MAC_PCI //
-	if (ADHOC_ON(pAd))		// Adhoc mode link down
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("!!! LINK DOWN 1!!!\n"));
-
-		OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_ADHOC_ON);
-			OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED);
-			pAd->IndicateMediaState = NdisMediaStateDisconnected;
-		RTMP_IndicateMediaState(pAd);
-            pAd->ExtraInfo = GENERAL_LINK_DOWN;
-			BssTableDeleteEntry(&pAd->ScanTab, pAd->CommonCfg.Bssid, pAd->CommonCfg.Channel);
-		DBGPRINT(RT_DEBUG_TRACE, ("!!! MacTab.Size=%d !!!\n", pAd->MacTab.Size));
-	}
-	else					// Infra structure mode
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("!!! LINK DOWN 2!!!\n"));
-
-#ifdef QOS_DLS_SUPPORT
-		// DLS tear down frame must be sent before link down
-		// send DLS-TEAR_DOWN message
-		if (pAd->CommonCfg.bDLSCapable)
-		{
-			// tear down local dls table entry
-			for (i=0; i<MAX_NUM_OF_INIT_DLS_ENTRY; i++)
-			{
-				if (pAd->StaCfg.DLSEntry[i].Valid && (pAd->StaCfg.DLSEntry[i].Status == DLS_FINISH))
-				{
-					pAd->StaCfg.DLSEntry[i].Status = DLS_NONE;
-					RTMPSendDLSTearDownFrame(pAd, pAd->StaCfg.DLSEntry[i].MacAddr);
-				}
-			}
-
-			// tear down peer dls table entry
-			for (i=MAX_NUM_OF_INIT_DLS_ENTRY; i<MAX_NUM_OF_DLS_ENTRY; i++)
-			{
-				if (pAd->StaCfg.DLSEntry[i].Valid && (pAd->StaCfg.DLSEntry[i].Status ==  DLS_FINISH))
-				{
-					pAd->StaCfg.DLSEntry[i].Status = DLS_NONE;
-					RTMPSendDLSTearDownFrame(pAd, pAd->StaCfg.DLSEntry[i].MacAddr);
-				}
-			}
-		}
-#endif // QOS_DLS_SUPPORT //
-
-		OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_INFRA_ON);
-		OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED);
-
-		// Saved last SSID for linkup comparison
-		pAd->CommonCfg.LastSsidLen = pAd->CommonCfg.SsidLen;
-		NdisMoveMemory(pAd->CommonCfg.LastSsid, pAd->CommonCfg.Ssid, pAd->CommonCfg.LastSsidLen);
-		COPY_MAC_ADDR(pAd->CommonCfg.LastBssid, pAd->CommonCfg.Bssid);
-		if (pAd->MlmeAux.CurrReqIsFromNdis == TRUE)
-		{
-			pAd->IndicateMediaState = NdisMediaStateDisconnected;
-			RTMP_IndicateMediaState(pAd);
-            pAd->ExtraInfo = GENERAL_LINK_DOWN;
-			DBGPRINT(RT_DEBUG_TRACE, ("NDIS_STATUS_MEDIA_DISCONNECT Event A!\n"));
-			pAd->MlmeAux.CurrReqIsFromNdis = FALSE;
-		}
-		else
-		{
-            //
-			// If disassociation request is from NDIS, then we don't need to delete BSSID from entry.
-			// Otherwise lost beacon or receive De-Authentication from AP,
-			// then we should delete BSSID from BssTable.
-			// If we don't delete from entry, roaming will fail.
-			//
-			BssTableDeleteEntry(&pAd->ScanTab, pAd->CommonCfg.Bssid, pAd->CommonCfg.Channel);
-		}
-
-		// restore back to -
-		//      1. long slot (20 us) or short slot (9 us) time
-		//      2. turn on/off RTS/CTS and/or CTS-to-self protection
-		//      3. short preamble
-		OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_BG_PROTECTION_INUSED);
-
-#ifdef EXT_BUILD_CHANNEL_LIST
-		// Country IE of the AP will be evaluated and will be used.
-		if (pAd->StaCfg.IEEE80211dClientMode != Rt802_11_D_None)
-		{
-			NdisMoveMemory(&pAd->CommonCfg.CountryCode[0], &pAd->StaCfg.StaOriCountryCode[0], 2);
-			pAd->CommonCfg.Geography = pAd->StaCfg.StaOriGeography;
-			BuildChannelListEx(pAd);
-		}
-#endif // EXT_BUILD_CHANNEL_LIST //
-
-	}
-
-
-	for (i=1; i<MAX_LEN_OF_MAC_TABLE; i++)
-	{
-		if (pAd->MacTab.Content[i].ValidAsCLI == TRUE)
-			MacTableDeleteEntry(pAd, pAd->MacTab.Content[i].Aid, pAd->MacTab.Content[i].Addr);
-	}
-
-	AsicSetSlotTime(pAd, TRUE); //FALSE);
-	AsicSetEdcaParm(pAd, NULL);
-
-	// Set LED
-	RTMPSetLED(pAd, LED_LINK_DOWN);
-    pAd->LedIndicatorStrength = 0xF0;
-    RTMPSetSignalLED(pAd, -100);	// Force signal strength Led to be turned off, firmware is not done it.
-
-		AsicDisableSync(pAd);
-
-	pAd->Mlme.PeriodicRound = 0;
-	pAd->Mlme.OneSecPeriodicRound = 0;
-
-	if (pAd->StaCfg.BssType == BSS_INFRA)
-	{
-	// Remove StaCfg Information after link down
-	NdisZeroMemory(pAd->CommonCfg.Bssid, MAC_ADDR_LEN);
-	NdisZeroMemory(pAd->CommonCfg.Ssid, MAX_LEN_OF_SSID);
-		pAd->CommonCfg.SsidLen = 0;
-	}
-#ifdef DOT11_N_SUPPORT
-	NdisZeroMemory(&pAd->MlmeAux.HtCapability, sizeof(HT_CAPABILITY_IE));
-	NdisZeroMemory(&pAd->MlmeAux.AddHtInfo, sizeof(ADD_HT_INFO_IE));
-	pAd->MlmeAux.HtCapabilityLen = 0;
-	pAd->MlmeAux.NewExtChannelOffset = 0xff;
-#endif // DOT11_N_SUPPORT //
-
-	// Reset WPA-PSK state. Only reset when supplicant enabled
-	if (pAd->StaCfg.WpaState != SS_NOTUSE)
-	{
-		pAd->StaCfg.WpaState = SS_START;
-		// Clear Replay counter
-		NdisZeroMemory(pAd->StaCfg.ReplayCounter, 8);
-
-#ifdef QOS_DLS_SUPPORT
-		if (pAd->CommonCfg.bDLSCapable)
-			NdisZeroMemory(pAd->StaCfg.DlsReplayCounter, 8);
-#endif // QOS_DLS_SUPPORT //
-	}
-
-	//
-	// if link down come from AP, we need to remove all WPA keys on WPA mode.
-	// otherwise will cause 4-way handshaking failed, since the WPA key not empty.
-	//
-	if ((IsReqFromAP) && (pAd->StaCfg.AuthMode >= Ndis802_11AuthModeWPA))
-	{
-		// Remove all WPA keys
-		RTMPWPARemoveAllKeys(pAd);
-	}
-
-	// 802.1x port control
-#ifdef WPA_SUPPLICANT_SUPPORT
-	// Prevent clear PortSecured here with static WEP
-	// NetworkManger set security policy first then set SSID to connect AP.
-	if (pAd->StaCfg.WpaSupplicantUP &&
-		(pAd->StaCfg.WepStatus == Ndis802_11WEPEnabled) &&
-		(pAd->StaCfg.IEEE8021X == FALSE))
-	{
-		pAd->StaCfg.PortSecured = WPA_802_1X_PORT_SECURED;
-	}
-	else
-#endif // WPA_SUPPLICANT_SUPPORT //
-	{
-		pAd->StaCfg.PortSecured = WPA_802_1X_PORT_NOT_SECURED;
-		pAd->StaCfg.PrivacyFilter = Ndis802_11PrivFilter8021xWEP;
-	}
-
-	NdisAcquireSpinLock(&pAd->MacTabLock);
-	NdisZeroMemory(&pAd->MacTab, sizeof(MAC_TABLE));
-	pAd->MacTab.Content[BSSID_WCID].PortSecured = pAd->StaCfg.PortSecured;
-	NdisReleaseSpinLock(&pAd->MacTabLock);
-
-	pAd->StaCfg.MicErrCnt = 0;
-
-    pAd->IndicateMediaState = NdisMediaStateDisconnected;
-	// Update extra information to link is up
-	pAd->ExtraInfo = GENERAL_LINK_DOWN;
-
-    pAd->StaActive.SupportedPhyInfo.bHtEnable = FALSE;
-
-
-	// Clean association information
-	NdisZeroMemory(&pAd->StaCfg.AssocInfo, sizeof(NDIS_802_11_ASSOCIATION_INFORMATION));
-	pAd->StaCfg.AssocInfo.Length = sizeof(NDIS_802_11_ASSOCIATION_INFORMATION);
-	pAd->StaCfg.ReqVarIELen = 0;
-	pAd->StaCfg.ResVarIELen = 0;
-
-	//
-	// Reset RSSI value after link down
-	//
-	pAd->StaCfg.RssiSample.AvgRssi0 = 0;
-	pAd->StaCfg.RssiSample.AvgRssi0X8 = 0;
-	pAd->StaCfg.RssiSample.AvgRssi1 = 0;
-	pAd->StaCfg.RssiSample.AvgRssi1X8 = 0;
-	pAd->StaCfg.RssiSample.AvgRssi2 = 0;
-	pAd->StaCfg.RssiSample.AvgRssi2X8 = 0;
-
-	// Restore MlmeRate
-	pAd->CommonCfg.MlmeRate = pAd->CommonCfg.BasicMlmeRate;
-	pAd->CommonCfg.RtsRate = pAd->CommonCfg.BasicMlmeRate;
-
-#ifdef DOT11_N_SUPPORT
-	//
-	// After Link down, reset piggy-back setting in ASIC. Disable RDG.
-	//
-	if (pAd->CommonCfg.BBPCurrentBW == BW_40)
-	{
-		pAd->CommonCfg.BBPCurrentBW = BW_20;
-		RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R4, &ByteValue);
-		ByteValue &= (~0x18);
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R4, ByteValue);
-	}
-#endif // DOT11_N_SUPPORT //
-	// Reset DAC
-	RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R1, &ByteValue);
-	ByteValue &= (~0x18);
-	if (pAd->Antenna.field.TxPath == 2)
-	{
-	ByteValue |= 0x10;
-	}
-	RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R1, ByteValue);
-
-		RTMPSetPiggyBack(pAd,FALSE);
-		OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_PIGGYBACK_INUSED);
-
-#ifdef DOT11_N_SUPPORT
-	pAd->CommonCfg.BACapability.word = pAd->CommonCfg.REGBACapability.word;
-#endif // DOT11_N_SUPPORT //
-
-	// Restore all settings in the following.
-	AsicUpdateProtect(pAd, 0, (ALLN_SETPROTECT|CCKSETPROTECT|OFDMSETPROTECT), TRUE, FALSE);
-	AsicDisableRDG(pAd);
-	pAd->CommonCfg.IOTestParm.bCurrentAtheros = FALSE;
-	pAd->CommonCfg.IOTestParm.bNowAtherosBurstOn = FALSE;
-
-#ifdef DOT11_N_SUPPORT
-#ifdef DOT11N_DRAFT3
-	OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_SCAN_2040);
-	pAd->CommonCfg.BSSCoexist2040.word = 0;
-	TriEventInit(pAd);
-	for (i = 0; i < (pAd->ChannelListNum - 1); i++)
-	{
-		pAd->ChannelList[i].bEffectedChannel = FALSE;
-	}
-#endif // DOT11N_DRAFT3 //
-#endif // DOT11_N_SUPPORT //
-
-	RTMP_IO_WRITE32(pAd, MAX_LEN_CFG, 0x1fff);
-	RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS);
-// Allow go to sleep after linkdown steps.
-	RTMP_SET_PSFLAG(pAd, fRTMP_PS_CAN_GO_SLEEP);
-#ifdef WPA_SUPPLICANT_SUPPORT
-#ifndef NATIVE_WPA_SUPPLICANT_SUPPORT
-	if (pAd->StaCfg.WpaSupplicantUP) {
-		//send disassociate event to wpa_supplicant
-		RtmpOSWrielessEventSend(pAd, IWEVCUSTOM, RT_DISASSOC_EVENT_FLAG, NULL, NULL, 0);
-	}
-#endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
-#endif // WPA_SUPPLICANT_SUPPORT //
-
-#ifdef NATIVE_WPA_SUPPLICANT_SUPPORT
-	RtmpOSWrielessEventSend(pAd, SIOCGIWAP, -1, NULL, NULL, 0);
-#endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
-
-#ifdef RT30xx
-	if ((IS_RT30xx(pAd) || IS_RT3090(pAd)||IS_RT3390(pAd))
-		&&(pAd->Antenna.field.RxPath>1||pAd->Antenna.field.TxPath>1))
-	{
-		RTMP_ASIC_MMPS_DISABLE(pAd);
-	}
-#endif // RT30xx //
-
-}
-
-/*
-	==========================================================================
-	Description:
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
-*/
-VOID IterateOnBssTab(
-	IN PRTMP_ADAPTER pAd)
-{
-	MLME_START_REQ_STRUCT   StartReq;
-	MLME_JOIN_REQ_STRUCT    JoinReq;
-	ULONG                   BssIdx;
-
-	// Change the wepstatus to original wepstatus
-	pAd->StaCfg.WepStatus   = pAd->StaCfg.OrigWepStatus;
-	pAd->StaCfg.PairCipher  = pAd->StaCfg.OrigWepStatus;
-	pAd->StaCfg.GroupCipher = pAd->StaCfg.OrigWepStatus;
-
-	BssIdx = pAd->MlmeAux.BssIdx;
-	if (BssIdx < pAd->MlmeAux.SsidBssTab.BssNr)
-	{
-		// Check cipher suite, AP must have more secured cipher than station setting
-		// Set the Pairwise and Group cipher to match the intended AP setting
-		// We can only connect to AP with less secured cipher setting
-		if ((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA) || (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPAPSK))
-		{
-			pAd->StaCfg.GroupCipher = pAd->MlmeAux.SsidBssTab.BssEntry[BssIdx].WPA.GroupCipher;
-
-			if (pAd->StaCfg.WepStatus == pAd->MlmeAux.SsidBssTab.BssEntry[BssIdx].WPA.PairCipher)
-				pAd->StaCfg.PairCipher = pAd->MlmeAux.SsidBssTab.BssEntry[BssIdx].WPA.PairCipher;
-			else if (pAd->MlmeAux.SsidBssTab.BssEntry[BssIdx].WPA.PairCipherAux != Ndis802_11WEPDisabled)
-				pAd->StaCfg.PairCipher = pAd->MlmeAux.SsidBssTab.BssEntry[BssIdx].WPA.PairCipherAux;
-			else	// There is no PairCipher Aux, downgrade our capability to TKIP
-				pAd->StaCfg.PairCipher = Ndis802_11Encryption2Enabled;
-		}
-		else if ((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2) || (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK))
-		{
-			pAd->StaCfg.GroupCipher = pAd->MlmeAux.SsidBssTab.BssEntry[BssIdx].WPA2.GroupCipher;
-
-			if (pAd->StaCfg.WepStatus == pAd->MlmeAux.SsidBssTab.BssEntry[BssIdx].WPA2.PairCipher)
-				pAd->StaCfg.PairCipher = pAd->MlmeAux.SsidBssTab.BssEntry[BssIdx].WPA2.PairCipher;
-			else if (pAd->MlmeAux.SsidBssTab.BssEntry[BssIdx].WPA2.PairCipherAux != Ndis802_11WEPDisabled)
-				pAd->StaCfg.PairCipher = pAd->MlmeAux.SsidBssTab.BssEntry[BssIdx].WPA2.PairCipherAux;
-			else	// There is no PairCipher Aux, downgrade our capability to TKIP
-				pAd->StaCfg.PairCipher = Ndis802_11Encryption2Enabled;
-
-			// RSN capability
-			pAd->StaCfg.RsnCapability = pAd->MlmeAux.SsidBssTab.BssEntry[BssIdx].WPA2.RsnCapability;
-		}
-
-		// Set Mix cipher flag
-		pAd->StaCfg.bMixCipher = (pAd->StaCfg.PairCipher == pAd->StaCfg.GroupCipher) ? FALSE : TRUE;
-		/*if (pAd->StaCfg.bMixCipher == TRUE)
-		{
-			// If mix cipher, re-build RSNIE
-			RTMPMakeRSNIE(pAd, pAd->StaCfg.AuthMode, pAd->StaCfg.WepStatus, 0);
-		}*/
-
-		DBGPRINT(RT_DEBUG_TRACE, ("CNTL - iterate BSS %ld of %d\n", BssIdx, pAd->MlmeAux.SsidBssTab.BssNr));
-		JoinParmFill(pAd, &JoinReq, BssIdx);
-		MlmeEnqueue(pAd, SYNC_STATE_MACHINE, MT2_MLME_JOIN_REQ, sizeof(MLME_JOIN_REQ_STRUCT),
-					&JoinReq);
-		pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_JOIN;
-	}
-	else if (pAd->StaCfg.BssType == BSS_ADHOC)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("CNTL - All BSS fail; start a new ADHOC (Ssid=%s)...\n",pAd->MlmeAux.Ssid));
-		StartParmFill(pAd, &StartReq, (PCHAR)pAd->MlmeAux.Ssid, pAd->MlmeAux.SsidLen);
-		MlmeEnqueue(pAd, SYNC_STATE_MACHINE, MT2_MLME_START_REQ, sizeof(MLME_START_REQ_STRUCT), &StartReq);
-		pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_START;
-	}
-	else // no more BSS
-	{
-
-#ifdef DOT11_N_SUPPORT
-#endif // DOT11_N_SUPPORT //
-		{
-			AsicSwitchChannel(pAd, pAd->CommonCfg.Channel, FALSE);
-			AsicLockChannel(pAd, pAd->CommonCfg.Channel);
-			DBGPRINT(RT_DEBUG_TRACE, ("CNTL - All roaming failed, restore to channel %d, Total BSS[%02d]\n",pAd->CommonCfg.Channel, pAd->ScanTab.BssNr));
-		}
-
-		pAd->Mlme.CntlMachine.CurrState = CNTL_IDLE;
-	}
-}
-
-// for re-association only
-// IRQL = DISPATCH_LEVEL
-VOID IterateOnBssTab2(
-	IN PRTMP_ADAPTER pAd)
-{
-	MLME_REASSOC_REQ_STRUCT ReassocReq;
-	ULONG                   BssIdx;
-	BSS_ENTRY               *pBss;
-
-	BssIdx = pAd->MlmeAux.RoamIdx;
-	pBss = &pAd->MlmeAux.RoamTab.BssEntry[BssIdx];
-
-	if (BssIdx < pAd->MlmeAux.RoamTab.BssNr)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("CNTL - iterate BSS %ld of %d\n", BssIdx, pAd->MlmeAux.RoamTab.BssNr));
-
-		AsicSwitchChannel(pAd, pBss->Channel, FALSE);
-		AsicLockChannel(pAd, pBss->Channel);
-
-		// reassociate message has the same structure as associate message
-		AssocParmFill(pAd, &ReassocReq, pBss->Bssid, pBss->CapabilityInfo,
-					  ASSOC_TIMEOUT, pAd->StaCfg.DefaultListenCount);
-		MlmeEnqueue(pAd, ASSOC_STATE_MACHINE, MT2_MLME_REASSOC_REQ,
-					sizeof(MLME_REASSOC_REQ_STRUCT), &ReassocReq);
-
-		pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_REASSOC;
-	}
-	else // no more BSS
-	{
-
-#ifdef DOT11_N_SUPPORT
-#endif // DOT11_N_SUPPORT //
-		{
-			AsicSwitchChannel(pAd, pAd->CommonCfg.Channel, FALSE);
-			AsicLockChannel(pAd, pAd->CommonCfg.Channel);
-			DBGPRINT(RT_DEBUG_TRACE, ("CNTL - All roaming failed, restore to channel %d, Total BSS[%02d]\n",pAd->CommonCfg.Channel, pAd->ScanTab.BssNr));
-		}
-
-		pAd->Mlme.CntlMachine.CurrState = CNTL_IDLE;
-	}
-}
-
-/*
-	==========================================================================
-	Description:
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
-*/
-VOID JoinParmFill(
-	IN PRTMP_ADAPTER pAd,
-	IN OUT MLME_JOIN_REQ_STRUCT *JoinReq,
-	IN ULONG BssIdx)
-{
-	JoinReq->BssIdx = BssIdx;
-}
-
-/*
-	==========================================================================
-	Description:
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
-*/
-VOID ScanParmFill(
-	IN PRTMP_ADAPTER pAd,
-	IN OUT MLME_SCAN_REQ_STRUCT *ScanReq,
-	IN STRING Ssid[],
-	IN UCHAR SsidLen,
-	IN UCHAR BssType,
-	IN UCHAR ScanType)
-{
-    NdisZeroMemory(ScanReq->Ssid, MAX_LEN_OF_SSID);
-	ScanReq->SsidLen = SsidLen;
-	NdisMoveMemory(ScanReq->Ssid, Ssid, SsidLen);
-	ScanReq->BssType = BssType;
-	ScanReq->ScanType = ScanType;
-}
-
-#ifdef QOS_DLS_SUPPORT
-/*
-	==========================================================================
-	Description:
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
-*/
-VOID DlsParmFill(
-	IN PRTMP_ADAPTER pAd,
-	IN OUT MLME_DLS_REQ_STRUCT *pDlsReq,
-	IN PRT_802_11_DLS pDls,
-	IN USHORT reason)
-{
-	pDlsReq->pDLS = pDls;
-	pDlsReq->Reason = reason;
-}
-#endif // QOS_DLS_SUPPORT //
-
-/*
-	==========================================================================
-	Description:
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
-*/
-VOID StartParmFill(
-	IN PRTMP_ADAPTER pAd,
-	IN OUT MLME_START_REQ_STRUCT *StartReq,
-	IN CHAR Ssid[],
-	IN UCHAR SsidLen)
-{
-	ASSERT(SsidLen <= MAX_LEN_OF_SSID);
-	NdisMoveMemory(StartReq->Ssid, Ssid, SsidLen);
-	StartReq->SsidLen = SsidLen;
-}
-
-/*
-	==========================================================================
-	Description:
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
-*/
-VOID AuthParmFill(
-	IN PRTMP_ADAPTER pAd,
-	IN OUT MLME_AUTH_REQ_STRUCT *AuthReq,
-	IN PUCHAR pAddr,
-	IN USHORT Alg)
-{
-	COPY_MAC_ADDR(AuthReq->Addr, pAddr);
-	AuthReq->Alg = Alg;
-	AuthReq->Timeout = AUTH_TIMEOUT;
-}
-
-/*
-	==========================================================================
-	Description:
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-#ifdef RTMP_MAC_PCI
-VOID ComposePsPoll(
-	IN PRTMP_ADAPTER pAd)
-{
-	NdisZeroMemory(&pAd->PsPollFrame, sizeof(PSPOLL_FRAME));
-	pAd->PsPollFrame.FC.Type = BTYPE_CNTL;
-	pAd->PsPollFrame.FC.SubType = SUBTYPE_PS_POLL;
-	pAd->PsPollFrame.Aid = pAd->StaActive.Aid | 0xC000;
-	COPY_MAC_ADDR(pAd->PsPollFrame.Bssid, pAd->CommonCfg.Bssid);
-	COPY_MAC_ADDR(pAd->PsPollFrame.Ta, pAd->CurrentAddress);
-}
-
-// IRQL = DISPATCH_LEVEL
-VOID ComposeNullFrame(
-	IN PRTMP_ADAPTER pAd)
-{
-	NdisZeroMemory(&pAd->NullFrame, sizeof(HEADER_802_11));
-	pAd->NullFrame.FC.Type = BTYPE_DATA;
-	pAd->NullFrame.FC.SubType = SUBTYPE_NULL_FUNC;
-	pAd->NullFrame.FC.ToDs = 1;
-	COPY_MAC_ADDR(pAd->NullFrame.Addr1, pAd->CommonCfg.Bssid);
-	COPY_MAC_ADDR(pAd->NullFrame.Addr2, pAd->CurrentAddress);
-	COPY_MAC_ADDR(pAd->NullFrame.Addr3, pAd->CommonCfg.Bssid);
-}
-#endif // RTMP_MAC_PCI //
-
-
-
-
-/*
-	==========================================================================
-	Description:
-		Pre-build a BEACON frame in the shared memory
-
-	IRQL = PASSIVE_LEVEL
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
-*/
-ULONG MakeIbssBeacon(
-	IN PRTMP_ADAPTER pAd)
-{
-	UCHAR         DsLen = 1, IbssLen = 2;
-	UCHAR         LocalErpIe[3] = {IE_ERP, 1, 0x04};
-	HEADER_802_11 BcnHdr;
-	USHORT        CapabilityInfo;
-	LARGE_INTEGER FakeTimestamp;
-	ULONG         FrameLen = 0;
-	PTXWI_STRUC	  pTxWI = &pAd->BeaconTxWI;
-	UCHAR         *pBeaconFrame = pAd->BeaconBuf;
-	BOOLEAN       Privacy;
-	UCHAR         SupRate[MAX_LEN_OF_SUPPORTED_RATES];
-	UCHAR         SupRateLen = 0;
-	UCHAR         ExtRate[MAX_LEN_OF_SUPPORTED_RATES];
-	UCHAR         ExtRateLen = 0;
-	UCHAR         RSNIe = IE_WPA;
-
-	if ((pAd->CommonCfg.PhyMode == PHY_11B) && (pAd->CommonCfg.Channel <= 14))
-	{
-		SupRate[0] = 0x82; // 1 mbps
-		SupRate[1] = 0x84; // 2 mbps
-		SupRate[2] = 0x8b; // 5.5 mbps
-		SupRate[3] = 0x96; // 11 mbps
-		SupRateLen = 4;
-		ExtRateLen = 0;
-	}
-	else if (pAd->CommonCfg.Channel > 14)
-	{
-		SupRate[0]  = 0x8C;    // 6 mbps, in units of 0.5 Mbps, basic rate
-		SupRate[1]  = 0x12;    // 9 mbps, in units of 0.5 Mbps
-		SupRate[2]  = 0x98;    // 12 mbps, in units of 0.5 Mbps, basic rate
-		SupRate[3]  = 0x24;    // 18 mbps, in units of 0.5 Mbps
-		SupRate[4]  = 0xb0;    // 24 mbps, in units of 0.5 Mbps, basic rate
-		SupRate[5]  = 0x48;    // 36 mbps, in units of 0.5 Mbps
-		SupRate[6]  = 0x60;    // 48 mbps, in units of 0.5 Mbps
-		SupRate[7]  = 0x6c;    // 54 mbps, in units of 0.5 Mbps
-		SupRateLen  = 8;
-		ExtRateLen  = 0;
-
-		//
-		// Also Update MlmeRate & RtsRate for G only & A only
-		//
-		pAd->CommonCfg.MlmeRate = RATE_6;
-		pAd->CommonCfg.RtsRate = RATE_6;
-		pAd->CommonCfg.MlmeTransmit.field.MODE = MODE_OFDM;
-		pAd->CommonCfg.MlmeTransmit.field.MCS = OfdmRateToRxwiMCS[pAd->CommonCfg.MlmeRate];
-		pAd->MacTab.Content[BSS0Mcast_WCID].HTPhyMode.field.MODE = MODE_OFDM;
-		pAd->MacTab.Content[BSS0Mcast_WCID].HTPhyMode.field.MCS = OfdmRateToRxwiMCS[pAd->CommonCfg.MlmeRate];
-	}
-	else
-	{
-		SupRate[0] = 0x82; // 1 mbps
-		SupRate[1] = 0x84; // 2 mbps
-		SupRate[2] = 0x8b; // 5.5 mbps
-		SupRate[3] = 0x96; // 11 mbps
-		SupRateLen = 4;
-
-		ExtRate[0]  = 0x0C;    // 6 mbps, in units of 0.5 Mbps,
-		ExtRate[1]  = 0x12;    // 9 mbps, in units of 0.5 Mbps
-		ExtRate[2]  = 0x18;    // 12 mbps, in units of 0.5 Mbps,
-		ExtRate[3]  = 0x24;    // 18 mbps, in units of 0.5 Mbps
-		ExtRate[4]  = 0x30;    // 24 mbps, in units of 0.5 Mbps,
-		ExtRate[5]  = 0x48;    // 36 mbps, in units of 0.5 Mbps
-		ExtRate[6]  = 0x60;    // 48 mbps, in units of 0.5 Mbps
-		ExtRate[7]  = 0x6c;    // 54 mbps, in units of 0.5 Mbps
-		ExtRateLen  = 8;
-	}
-
-	pAd->StaActive.SupRateLen = SupRateLen;
-	NdisMoveMemory(pAd->StaActive.SupRate, SupRate, SupRateLen);
-	pAd->StaActive.ExtRateLen = ExtRateLen;
-	NdisMoveMemory(pAd->StaActive.ExtRate, ExtRate, ExtRateLen);
-
-	// compose IBSS beacon frame
-	MgtMacHeaderInit(pAd, &BcnHdr, SUBTYPE_BEACON, 0, BROADCAST_ADDR, pAd->CommonCfg.Bssid);
-	Privacy = (pAd->StaCfg.WepStatus == Ndis802_11Encryption1Enabled) ||
-			  (pAd->StaCfg.WepStatus == Ndis802_11Encryption2Enabled) ||
-			  (pAd->StaCfg.WepStatus == Ndis802_11Encryption3Enabled);
-	CapabilityInfo = CAP_GENERATE(0, 1, Privacy, (pAd->CommonCfg.TxPreamble == Rt802_11PreambleShort), 0, 0);
-
-	MakeOutgoingFrame(pBeaconFrame,                &FrameLen,
-					  sizeof(HEADER_802_11),           &BcnHdr,
-					  TIMESTAMP_LEN,                   &FakeTimestamp,
-					  2,                               &pAd->CommonCfg.BeaconPeriod,
-					  2,                               &CapabilityInfo,
-					  1,                               &SsidIe,
-					  1,                               &pAd->CommonCfg.SsidLen,
-					  pAd->CommonCfg.SsidLen,          pAd->CommonCfg.Ssid,
-					  1,                               &SupRateIe,
-					  1,                               &SupRateLen,
-					  SupRateLen,                      SupRate,
-					  1,                               &DsIe,
-					  1,                               &DsLen,
-					  1,                               &pAd->CommonCfg.Channel,
-					  1,                               &IbssIe,
-					  1,                               &IbssLen,
-					  2,                               &pAd->StaActive.AtimWin,
-					  END_OF_ARGS);
-
-	// add ERP_IE and EXT_RAE IE of in 802.11g
-	if (ExtRateLen)
-	{
-		ULONG	tmp;
-
-		MakeOutgoingFrame(pBeaconFrame + FrameLen,         &tmp,
-						  3,                               LocalErpIe,
-						  1,                               &ExtRateIe,
-						  1,                               &ExtRateLen,
-						  ExtRateLen,                      ExtRate,
-						  END_OF_ARGS);
-		FrameLen += tmp;
-	}
-
-	// If adhoc secruity is set for WPA-None, append the cipher suite IE
-	if (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPANone)
-	{
-		ULONG tmp;
-        RTMPMakeRSNIE(pAd, pAd->StaCfg.AuthMode, pAd->StaCfg.WepStatus, BSS0);
-
-		MakeOutgoingFrame(pBeaconFrame + FrameLen,		&tmp,
-						  1,					&RSNIe,
-						  1,					&pAd->StaCfg.RSNIE_Len,
-						  pAd->StaCfg.RSNIE_Len,		pAd->StaCfg.RSN_IE,
-						  END_OF_ARGS);
-		FrameLen += tmp;
-	}
-
-#ifdef DOT11_N_SUPPORT
-	if ((pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED))
-	{
-		ULONG TmpLen;
-		UCHAR HtLen, HtLen1;
-
-#ifdef RT_BIG_ENDIAN
-		HT_CAPABILITY_IE HtCapabilityTmp;
-		ADD_HT_INFO_IE	addHTInfoTmp;
-		USHORT	b2lTmp, b2lTmp2;
-#endif
-
-		// add HT Capability IE
-		HtLen = sizeof(pAd->CommonCfg.HtCapability);
-		HtLen1 = sizeof(pAd->CommonCfg.AddHTInfo);
-#ifndef RT_BIG_ENDIAN
-		MakeOutgoingFrame(pBeaconFrame+FrameLen,	&TmpLen,
-						  1,						&HtCapIe,
-						  1,						&HtLen,
-						  HtLen,					&pAd->CommonCfg.HtCapability,
-						  1,						&AddHtInfoIe,
-						  1,						&HtLen1,
-						  HtLen1,					&pAd->CommonCfg.AddHTInfo,
-						  END_OF_ARGS);
-#else
-		NdisMoveMemory(&HtCapabilityTmp, &pAd->CommonCfg.HtCapability, HtLen);
-		*(USHORT *)(&HtCapabilityTmp.HtCapInfo) = SWAP16(*(USHORT *)(&HtCapabilityTmp.HtCapInfo));
-		*(USHORT *)(&HtCapabilityTmp.ExtHtCapInfo) = SWAP16(*(USHORT *)(&HtCapabilityTmp.ExtHtCapInfo));
-
-		NdisMoveMemory(&addHTInfoTmp, &pAd->CommonCfg.AddHTInfo, HtLen1);
-		*(USHORT *)(&addHTInfoTmp.AddHtInfo2) = SWAP16(*(USHORT *)(&addHTInfoTmp.AddHtInfo2));
-		*(USHORT *)(&addHTInfoTmp.AddHtInfo3) = SWAP16(*(USHORT *)(&addHTInfoTmp.AddHtInfo3));
-
-		MakeOutgoingFrame(pBeaconFrame+FrameLen,	&TmpLen,
-						  1,						&HtCapIe,
-						  1,						&HtLen,
-						  HtLen,					&HtCapabilityTmp,
-						  1,						&AddHtInfoIe,
-						  1,						&HtLen1,
-						  HtLen1,					&addHTInfoTmp,
-						  END_OF_ARGS);
-#endif
-		FrameLen += TmpLen;
-	}
-#endif // DOT11_N_SUPPORT //
-
-	//beacon use reserved WCID 0xff
-    if (pAd->CommonCfg.Channel > 14)
-    {
-	RTMPWriteTxWI(pAd, pTxWI, FALSE, FALSE,  TRUE, FALSE, FALSE, TRUE, 0, 0xff, FrameLen,
-		PID_MGMT, PID_BEACON, RATE_1, IFS_HTTXOP, FALSE, &pAd->CommonCfg.MlmeTransmit);
-    }
-    else
-    {
-        // Set to use 1Mbps for Adhoc beacon.
-		HTTRANSMIT_SETTING Transmit;
-        Transmit.word = 0;
-        RTMPWriteTxWI(pAd, pTxWI, FALSE, FALSE,  TRUE, FALSE, FALSE, TRUE, 0, 0xff, FrameLen,
-		PID_MGMT, PID_BEACON, RATE_1, IFS_HTTXOP, FALSE, &Transmit);
-    }
-
-#ifdef RT_BIG_ENDIAN
-	RTMPFrameEndianChange(pAd, pBeaconFrame, DIR_WRITE, FALSE);
-	RTMPWIEndianChange((PUCHAR)pTxWI, TYPE_TXWI);
-#endif
-
-    DBGPRINT(RT_DEBUG_TRACE, ("MakeIbssBeacon (len=%ld), SupRateLen=%d, ExtRateLen=%d, Channel=%d, PhyMode=%d\n",
-					FrameLen, SupRateLen, ExtRateLen, pAd->CommonCfg.Channel, pAd->CommonCfg.PhyMode));
-	return FrameLen;
-}
diff --git a/drivers/staging/rt3090/sta/dls.c b/drivers/staging/rt3090/sta/dls.c
deleted file mode 100644
index 306e16fdeeae..000000000000
--- a/drivers/staging/rt3090/sta/dls.c
+++ /dev/null
@@ -1,2207 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-    Module Name:
-    dls.c
-
-    Abstract:
-    Handle WMM-DLS state machine
-
-    Revision History:
-    Who         When          What
-    --------    ----------    ----------------------------------------------
-    Rory Chen   02-14-2006
-	Arvin Tai	06-03-2008	  Modified for RT28xx
- */
-
-#include "../rt_config.h"
-
-
-/*
-    ==========================================================================
-    Description:
-        dls state machine init, including state transition and timer init
-    Parameters:
-        Sm - pointer to the dls state machine
-    Note:
-        The state machine looks like this
-
-                            DLS_IDLE
-    MT2_MLME_DLS_REQUEST   MlmeDlsReqAction
-    MT2_PEER_DLS_REQUEST   PeerDlsReqAction
-    MT2_PEER_DLS_RESPONSE  PeerDlsRspAction
-    MT2_MLME_DLS_TEARDOWN  MlmeTearDownAction
-    MT2_PEER_DLS_TEARDOWN  PeerTearDownAction
-
-	IRQL = PASSIVE_LEVEL
-
-    ==========================================================================
- */
-void DlsStateMachineInit(
-    IN PRTMP_ADAPTER pAd,
-    IN STATE_MACHINE *Sm,
-    OUT STATE_MACHINE_FUNC Trans[])
-{
-	UCHAR	i;
-
-    StateMachineInit(Sm, (STATE_MACHINE_FUNC*)Trans, MAX_DLS_STATE, MAX_DLS_MSG, (STATE_MACHINE_FUNC)Drop, DLS_IDLE, DLS_MACHINE_BASE);
-
-    // the first column
-    StateMachineSetAction(Sm, DLS_IDLE, MT2_MLME_DLS_REQ, (STATE_MACHINE_FUNC)MlmeDlsReqAction);
-    StateMachineSetAction(Sm, DLS_IDLE, MT2_PEER_DLS_REQ, (STATE_MACHINE_FUNC)PeerDlsReqAction);
-    StateMachineSetAction(Sm, DLS_IDLE, MT2_PEER_DLS_RSP, (STATE_MACHINE_FUNC)PeerDlsRspAction);
-    StateMachineSetAction(Sm, DLS_IDLE, MT2_MLME_DLS_TEAR_DOWN, (STATE_MACHINE_FUNC)MlmeDlsTearDownAction);
-    StateMachineSetAction(Sm, DLS_IDLE, MT2_PEER_DLS_TEAR_DOWN, (STATE_MACHINE_FUNC)PeerDlsTearDownAction);
-
-	for (i=0; i<MAX_NUM_OF_DLS_ENTRY; i++)
-	{
-		pAd->StaCfg.DLSEntry[i].pAd = pAd;
-		RTMPInitTimer(pAd, &pAd->StaCfg.DLSEntry[i].Timer, GET_TIMER_FUNCTION(DlsTimeoutAction), pAd, FALSE);
-	}
-}
-
-/*
-    ==========================================================================
-    Description:
-
-	IRQL = DISPATCH_LEVEL
-
-    ==========================================================================
- */
-VOID MlmeDlsReqAction(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem)
-{
-	PUCHAR			pOutBuffer = NULL;
-	NDIS_STATUS		NStatus;
-	ULONG			FrameLen = 0;
-	HEADER_802_11	DlsReqHdr;
-	PRT_802_11_DLS	pDLS = NULL;
-	UCHAR			Category = CATEGORY_DLS;
-	UCHAR			Action = ACTION_DLS_REQUEST;
-	ULONG			tmp;
-	USHORT			reason;
-	ULONG			Timeout;
-	BOOLEAN			TimerCancelled;
-
-	if(!MlmeDlsReqSanity(pAd, Elem->Msg, Elem->MsgLen, &pDLS, &reason))
-		return;
-
-	DBGPRINT(RT_DEBUG_TRACE,("DLS - MlmeDlsReqAction() \n"));
-
-	NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);  //Get an unused nonpaged memory
-	if (NStatus != NDIS_STATUS_SUCCESS)
-	{
-		DBGPRINT(RT_DEBUG_ERROR,("DLS - MlmeDlsReqAction() allocate memory failed \n"));
-		return;
-	}
-
-	ActHeaderInit(pAd, &DlsReqHdr, pAd->CommonCfg.Bssid, pAd->CurrentAddress, pAd->CommonCfg.Bssid);
-
-	// Build basic frame first
-	MakeOutgoingFrame(pOutBuffer,				&FrameLen,
-					sizeof(HEADER_802_11),		&DlsReqHdr,
-					1,							&Category,
-					1,							&Action,
-					6,							&pDLS->MacAddr,
-					6,							pAd->CurrentAddress,
-					2,							&pAd->StaActive.CapabilityInfo,
-					2,							&pDLS->TimeOut,
-					1,							&SupRateIe,
-					1,							&pAd->MlmeAux.SupRateLen,
-					pAd->MlmeAux.SupRateLen,	pAd->MlmeAux.SupRate,
-					END_OF_ARGS);
-
-	if (pAd->MlmeAux.ExtRateLen != 0)
-	{
-		MakeOutgoingFrame(pOutBuffer + FrameLen,	&tmp,
-						  1,						&ExtRateIe,
-						  1,						&pAd->MlmeAux.ExtRateLen,
-						  pAd->MlmeAux.ExtRateLen,	pAd->MlmeAux.ExtRate,
-						  END_OF_ARGS);
-		FrameLen += tmp;
-	}
-
-#ifdef DOT11_N_SUPPORT
-	if ((pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED))
-	{
-		UCHAR HtLen;
-
-#ifdef RT_BIG_ENDIAN
-		HT_CAPABILITY_IE HtCapabilityTmp;
-#endif
-
-		// add HT Capability IE
-		HtLen = sizeof(HT_CAPABILITY_IE);
-#ifndef RT_BIG_ENDIAN
-		MakeOutgoingFrame(pOutBuffer + FrameLen,	&tmp,
-							1,						&HtCapIe,
-							1,						&HtLen,
-							HtLen,					&pAd->CommonCfg.HtCapability,
-							END_OF_ARGS);
-#else
-		NdisMoveMemory(&HtCapabilityTmp, &pAd->CommonCfg.HtCapability, HtLen);
-							*(USHORT *)(&HtCapabilityTmp.HtCapInfo) = SWAP16(*(USHORT *)(&HtCapabilityTmp.HtCapInfo));
-							*(USHORT *)(&HtCapabilityTmp.ExtHtCapInfo) = SWAP16(*(USHORT *)(&HtCapabilityTmp.ExtHtCapInfo));
-
-		MakeOutgoingFrame(pOutBuffer + FrameLen,	&tmp,
-							1,						&HtCapIe,
-							1,						&HtLen,
-							HtLen,					&HtCapabilityTmp,
-							END_OF_ARGS);
-#endif
-		FrameLen = FrameLen + tmp;
-	}
-#endif // DOT11_N_SUPPORT //
-
-	RTMPCancelTimer(&pDLS->Timer, &TimerCancelled);
-	Timeout = DLS_TIMEOUT;
-	RTMPSetTimer(&pDLS->Timer, Timeout);
-
-	MiniportMMRequest(pAd, QID_AC_BE, pOutBuffer, FrameLen);
-	MlmeFreeMemory(pAd, pOutBuffer);
-}
-
-/*
-    ==========================================================================
-    Description:
-
-	IRQL = DISPATCH_LEVEL
-
-    ==========================================================================
- */
-VOID PeerDlsReqAction(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem)
-{
-	PUCHAR			pOutBuffer = NULL;
-	NDIS_STATUS		NStatus;
-	ULONG			FrameLen = 0;
-	USHORT			StatusCode = MLME_SUCCESS;
-	HEADER_802_11	DlsRspHdr;
-	UCHAR			Category = CATEGORY_DLS;
-	UCHAR			Action = ACTION_DLS_RESPONSE;
-	ULONG			tmp;
-	USHORT			CapabilityInfo;
-	UCHAR			DA[MAC_ADDR_LEN], SA[MAC_ADDR_LEN];
-	USHORT			DLSTimeOut;
-	SHORT			i;
-	ULONG			Timeout;
-	BOOLEAN			TimerCancelled;
-	PRT_802_11_DLS	pDLS = NULL;
-	UCHAR			MaxSupportedRateIn500Kbps = 0;
-    UCHAR			SupportedRatesLen;
-    UCHAR			SupportedRates[MAX_LEN_OF_SUPPORTED_RATES];
-	UCHAR			HtCapabilityLen;
-	HT_CAPABILITY_IE	HtCapability;
-
-	if (!PeerDlsReqSanity(pAd, Elem->Msg, Elem->MsgLen, DA, SA, &CapabilityInfo, &DLSTimeOut,
-							&SupportedRatesLen, &SupportedRates[0], &HtCapabilityLen, &HtCapability))
-		return;
-
-    // supported rates array may not be sorted. sort it and find the maximum rate
-    for (i = 0; i < SupportedRatesLen; i++)
-    {
-        if (MaxSupportedRateIn500Kbps < (SupportedRates[i] & 0x7f))
-            MaxSupportedRateIn500Kbps = SupportedRates[i] & 0x7f;
-    }
-
-	DBGPRINT(RT_DEBUG_TRACE,("DLS - PeerDlsReqAction() from %02x:%02x:%02x:%02x:%02x:%02x\n", SA[0], SA[1], SA[2], SA[3], SA[4], SA[5]));
-
-	NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);  //Get an unused nonpaged memory
-	if (NStatus != NDIS_STATUS_SUCCESS)
-	{
-		DBGPRINT(RT_DEBUG_ERROR,("DLS - PeerDlsReqAction() allocate memory failed \n"));
-		return;
-	}
-
-	if (!INFRA_ON(pAd))
-	{
-		StatusCode = MLME_REQUEST_DECLINED;
-	}
-	else if (!pAd->CommonCfg.bWmmCapable)
-	{
-		StatusCode = MLME_DEST_STA_IS_NOT_A_QSTA;
-	}
-	else if (!pAd->CommonCfg.bDLSCapable)
-	{
-		StatusCode = MLME_REQUEST_DECLINED;
-	}
-	else
-	{
-		// find table to update parameters
-		for (i = (MAX_NUM_OF_DLS_ENTRY-1); i >= 0; i--)
-		{
-			if (pAd->StaCfg.DLSEntry[i].Valid && MAC_ADDR_EQUAL(SA, pAd->StaCfg.DLSEntry[i].MacAddr))
-			{
-				if (pAd->StaCfg.AuthMode >= Ndis802_11AuthModeWPA)
-					pAd->StaCfg.DLSEntry[i].Status = DLS_WAIT_KEY;
-				else
-				{
-					RTMPCancelTimer(&pAd->StaCfg.DLSEntry[i].Timer, &TimerCancelled);
-					pAd->StaCfg.DLSEntry[i].Status = DLS_FINISH;
-				}
-
-				pAd->StaCfg.DLSEntry[i].Sequence = 0;
-				pAd->StaCfg.DLSEntry[i].TimeOut = DLSTimeOut;
-				pAd->StaCfg.DLSEntry[i].CountDownTimer = DLSTimeOut;
-				if (HtCapabilityLen != 0)
-					pAd->StaCfg.DLSEntry[i].bHTCap = TRUE;
-				else
-					pAd->StaCfg.DLSEntry[i].bHTCap = FALSE;
-				pDLS = &pAd->StaCfg.DLSEntry[i];
-				break;
-			}
-		}
-
-		// can not find in table, create a new one
-		if (i < 0)
-		{
-			DBGPRINT(RT_DEBUG_TRACE,("DLS - PeerDlsReqAction() can not find same entry \n"));
-			for (i=(MAX_NUM_OF_DLS_ENTRY - 1); i >= MAX_NUM_OF_INIT_DLS_ENTRY; i--)
-			{
-				if (!pAd->StaCfg.DLSEntry[i].Valid)
-				{
-					MAC_TABLE_ENTRY *pEntry;
-					UCHAR MaxSupportedRate = RATE_11;
-
-					if (pAd->StaCfg.AuthMode >= Ndis802_11AuthModeWPA)
-					{
-						pAd->StaCfg.DLSEntry[i].Status = DLS_WAIT_KEY;
-					}
-					else
-					{
-						RTMPCancelTimer(&pAd->StaCfg.DLSEntry[i].Timer, &TimerCancelled);
-						pAd->StaCfg.DLSEntry[i].Status = DLS_FINISH;
-					}
-
-					pAd->StaCfg.DLSEntry[i].Sequence = 0;
-					pAd->StaCfg.DLSEntry[i].Valid = TRUE;
-					pAd->StaCfg.DLSEntry[i].TimeOut = DLSTimeOut;
-					pAd->StaCfg.DLSEntry[i].CountDownTimer = DLSTimeOut;
-					NdisMoveMemory(pAd->StaCfg.DLSEntry[i].MacAddr, SA, MAC_ADDR_LEN);
-					if (HtCapabilityLen != 0)
-						pAd->StaCfg.DLSEntry[i].bHTCap = TRUE;
-					else
-						pAd->StaCfg.DLSEntry[i].bHTCap = FALSE;
-					pDLS = &pAd->StaCfg.DLSEntry[i];
-					pEntry = MacTableInsertDlsEntry(pAd, SA, i);
-
-					switch (MaxSupportedRateIn500Kbps)
-					{
-						case 108: MaxSupportedRate = RATE_54;   break;
-						case 96:  MaxSupportedRate = RATE_48;   break;
-						case 72:  MaxSupportedRate = RATE_36;   break;
-						case 48:  MaxSupportedRate = RATE_24;   break;
-						case 36:  MaxSupportedRate = RATE_18;   break;
-						case 24:  MaxSupportedRate = RATE_12;   break;
-						case 18:  MaxSupportedRate = RATE_9;    break;
-						case 12:  MaxSupportedRate = RATE_6;    break;
-						case 22:  MaxSupportedRate = RATE_11;   break;
-						case 11:  MaxSupportedRate = RATE_5_5;  break;
-						case 4:   MaxSupportedRate = RATE_2;    break;
-						case 2:   MaxSupportedRate = RATE_1;    break;
-						default:  MaxSupportedRate = RATE_11;   break;
-					}
-
-					pEntry->MaxSupportedRate = min(pAd->CommonCfg.MaxTxRate, MaxSupportedRate);
-
-					if (pEntry->MaxSupportedRate < RATE_FIRST_OFDM_RATE)
-					{
-						pEntry->MaxHTPhyMode.field.MODE = MODE_CCK;
-						pEntry->MaxHTPhyMode.field.MCS = pEntry->MaxSupportedRate;
-						pEntry->MinHTPhyMode.field.MODE = MODE_CCK;
-						pEntry->MinHTPhyMode.field.MCS = pEntry->MaxSupportedRate;
-						pEntry->HTPhyMode.field.MODE = MODE_CCK;
-						pEntry->HTPhyMode.field.MCS = pEntry->MaxSupportedRate;
-					}
-					else
-					{
-						pEntry->MaxHTPhyMode.field.MODE = MODE_OFDM;
-						pEntry->MaxHTPhyMode.field.MCS = OfdmRateToRxwiMCS[pEntry->MaxSupportedRate];
-						pEntry->MinHTPhyMode.field.MODE = MODE_OFDM;
-						pEntry->MinHTPhyMode.field.MCS = OfdmRateToRxwiMCS[pEntry->MaxSupportedRate];
-						pEntry->HTPhyMode.field.MODE = MODE_OFDM;
-						pEntry->HTPhyMode.field.MCS = OfdmRateToRxwiMCS[pEntry->MaxSupportedRate];
-					}
-
-					pEntry->MaxHTPhyMode.field.BW = BW_20;
-					pEntry->MinHTPhyMode.field.BW = BW_20;
-
-#ifdef DOT11_N_SUPPORT
-					pEntry->HTCapability.MCSSet[0] = 0;
-					pEntry->HTCapability.MCSSet[1] = 0;
-
-					// If this Entry supports 802.11n, upgrade to HT rate.
-					if ((HtCapabilityLen != 0) && (pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED))
-					{
-						UCHAR	j, bitmask; //k,bitmask;
-						CHAR    ii;
-
-						DBGPRINT(RT_DEBUG_TRACE, ("DLS - PeerDlsReqAction() Receive Peer HT Capable STA from %02x:%02x:%02x:%02x:%02x:%02x\n",
-									SA[0], SA[1], SA[2], SA[3], SA[4], SA[5]));
-
-						if ((HtCapability.HtCapInfo.GF) && (pAd->CommonCfg.DesiredHtPhy.GF))
-						{
-							pEntry->MaxHTPhyMode.field.MODE = MODE_HTGREENFIELD;
-						}
-						else
-						{
-							pEntry->MaxHTPhyMode.field.MODE = MODE_HTMIX;
-							pAd->MacTab.fAnyStationNonGF = TRUE;
-							pAd->CommonCfg.AddHTInfo.AddHtInfo2.NonGfPresent = 1;
-						}
-
-						if ((HtCapability.HtCapInfo.ChannelWidth) && (pAd->CommonCfg.DesiredHtPhy.ChannelWidth))
-						{
-							pEntry->MaxHTPhyMode.field.BW= BW_40;
-							pEntry->MaxHTPhyMode.field.ShortGI = ((pAd->CommonCfg.DesiredHtPhy.ShortGIfor40)&(HtCapability.HtCapInfo.ShortGIfor40));
-						}
-						else
-						{
-							pEntry->MaxHTPhyMode.field.BW = BW_20;
-							pEntry->MaxHTPhyMode.field.ShortGI = ((pAd->CommonCfg.DesiredHtPhy.ShortGIfor20)&(HtCapability.HtCapInfo.ShortGIfor20));
-							pAd->MacTab.fAnyStation20Only = TRUE;
-						}
-
-						// find max fixed rate
-						for (ii=15; ii>=0; ii--)
-						{
-							j = ii/8;
-							bitmask = (1<<(ii-(j*8)));
-							if ( (pAd->StaCfg.DesiredHtPhyInfo.MCSSet[j]&bitmask) && (HtCapability.MCSSet[j]&bitmask))
-							{
-								pEntry->MaxHTPhyMode.field.MCS = ii;
-								break;
-							}
-							if (ii==0)
-								break;
-						}
-
-
-						if (pAd->StaCfg.DesiredTransmitSetting.field.MCS != MCS_AUTO)
-						{
-
-							DBGPRINT(RT_DEBUG_OFF, ("@@@ pAd->CommonCfg.RegTransmitSetting.field.MCS = %d\n",
-										pAd->StaCfg.DesiredTransmitSetting.field.MCS));
-							if (pAd->StaCfg.DesiredTransmitSetting.field.MCS == 32)
-							{
-								// Fix MCS as HT Duplicated Mode
-								pEntry->MaxHTPhyMode.field.BW = 1;
-								pEntry->MaxHTPhyMode.field.MODE = MODE_HTMIX;
-								pEntry->MaxHTPhyMode.field.STBC = 0;
-								pEntry->MaxHTPhyMode.field.ShortGI = 0;
-								pEntry->MaxHTPhyMode.field.MCS = 32;
-							}
-							else if (pEntry->MaxHTPhyMode.field.MCS > pAd->StaCfg.HTPhyMode.field.MCS)
-							{
-								// STA supports fixed MCS
-								pEntry->MaxHTPhyMode.field.MCS = pAd->StaCfg.HTPhyMode.field.MCS;
-							}
-						}
-
-						pEntry->MaxHTPhyMode.field.STBC = (HtCapability.HtCapInfo.RxSTBC & (pAd->CommonCfg.DesiredHtPhy.TxSTBC));
-						pEntry->MpduDensity = HtCapability.HtCapParm.MpduDensity;
-						pEntry->MaxRAmpduFactor = HtCapability.HtCapParm.MaxRAmpduFactor;
-						pEntry->MmpsMode = (UCHAR)HtCapability.HtCapInfo.MimoPs;
-						pEntry->AMsduSize = (UCHAR)HtCapability.HtCapInfo.AMsduSize;
-						pEntry->HTPhyMode.word = pEntry->MaxHTPhyMode.word;
-
-						if (HtCapability.HtCapInfo.ShortGIfor20)
-							CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_SGI20_CAPABLE);
-						if (HtCapability.HtCapInfo.ShortGIfor40)
-							CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_SGI40_CAPABLE);
-						if (HtCapability.HtCapInfo.TxSTBC)
-							CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_TxSTBC_CAPABLE);
-						if (HtCapability.HtCapInfo.RxSTBC)
-							CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_RxSTBC_CAPABLE);
-						if (HtCapability.ExtHtCapInfo.PlusHTC)
-							CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_HTC_CAPABLE);
-						if (pAd->CommonCfg.bRdg && HtCapability.ExtHtCapInfo.RDGSupport)
-							CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_RDG_CAPABLE);
-						if (HtCapability.ExtHtCapInfo.MCSFeedback == 0x03)
-							CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_MCSFEEDBACK_CAPABLE);
-
-						NdisMoveMemory(&pEntry->HTCapability, &HtCapability, sizeof(HT_CAPABILITY_IE));
-					}
-#endif // DOT11_N_SUPPORT //
-
-					pEntry->HTPhyMode.word = pEntry->MaxHTPhyMode.word;
-					pEntry->CurrTxRate = pEntry->MaxSupportedRate;
-					CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_WMM_CAPABLE);
-
-					if (pAd->StaCfg.bAutoTxRateSwitch == TRUE)
-					{
-						PUCHAR pTable;
-						UCHAR TableSize = 0;
-
-						MlmeSelectTxRateTable(pAd, pEntry, &pTable, &TableSize, &pEntry->CurrTxRateIndex);
-						pEntry->bAutoTxRateSwitch = TRUE;
-					}
-					else
-					{
-						pEntry->HTPhyMode.field.MODE	= pAd->StaCfg.HTPhyMode.field.MODE;
-						pEntry->HTPhyMode.field.MCS	= pAd->StaCfg.HTPhyMode.field.MCS;
-						pEntry->bAutoTxRateSwitch = FALSE;
-
-						RTMPUpdateLegacyTxSetting((UCHAR)pAd->StaCfg.DesiredTransmitSetting.field.FixedTxMode, pEntry);
-					}
-					pEntry->RateLen = SupportedRatesLen;
-
-					break;
-				}
-			}
-		}
-		StatusCode = MLME_SUCCESS;
-
-		// can not find in table, create a new one
-		if (i < 0)
-		{
-			StatusCode = MLME_QOS_UNSPECIFY;
-			DBGPRINT(RT_DEBUG_ERROR,("DLS - PeerDlsReqAction() DLSEntry table full(only can support %d DLS session) \n", MAX_NUM_OF_DLS_ENTRY - MAX_NUM_OF_INIT_DLS_ENTRY));
-		}
-		else
-		{
-			DBGPRINT(RT_DEBUG_TRACE,("DLS - PeerDlsReqAction() use entry(%d) %02x:%02x:%02x:%02x:%02x:%02x\n",
-				i, SA[0], SA[1], SA[2], SA[3], SA[4], SA[5]));
-		}
-	}
-
-	ActHeaderInit(pAd, &DlsRspHdr, pAd->CommonCfg.Bssid, pAd->CurrentAddress, pAd->CommonCfg.Bssid);
-
-	// Build basic frame first
-	if (StatusCode == MLME_SUCCESS)
-	{
-		MakeOutgoingFrame(pOutBuffer,				&FrameLen,
-						sizeof(HEADER_802_11),		&DlsRspHdr,
-						1,							&Category,
-						1,							&Action,
-						2,							&StatusCode,
-						6,							SA,
-						6,							pAd->CurrentAddress,
-						2,							&pAd->StaActive.CapabilityInfo,
-						1,							&SupRateIe,
-						1,							&pAd->MlmeAux.SupRateLen,
-						pAd->MlmeAux.SupRateLen,	pAd->MlmeAux.SupRate,
-						END_OF_ARGS);
-
-		if (pAd->MlmeAux.ExtRateLen != 0)
-		{
-			MakeOutgoingFrame(pOutBuffer + FrameLen,	&tmp,
-							  1,						&ExtRateIe,
-							  1,						&pAd->MlmeAux.ExtRateLen,
-							  pAd->MlmeAux.ExtRateLen,	pAd->MlmeAux.ExtRate,
-							  END_OF_ARGS);
-			FrameLen += tmp;
-		}
-
-#ifdef DOT11_N_SUPPORT
-		if ((pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED))
-		{
-			UCHAR HtLen;
-
-#ifdef RT_BIG_ENDIAN
-			HT_CAPABILITY_IE HtCapabilityTmp;
-#endif
-
-			// add HT Capability IE
-			HtLen = sizeof(HT_CAPABILITY_IE);
-#ifndef RT_BIG_ENDIAN
-			MakeOutgoingFrame(pOutBuffer + FrameLen,	&tmp,
-								1,						&HtCapIe,
-								1,						&HtLen,
-								HtLen,					&pAd->CommonCfg.HtCapability,
-								END_OF_ARGS);
-#else
-			NdisMoveMemory(&HtCapabilityTmp, &pAd->CommonCfg.HtCapability, HtLen);
-								*(USHORT *)(&HtCapabilityTmp.HtCapInfo) = SWAP16(*(USHORT *)(&HtCapabilityTmp.HtCapInfo));
-								*(USHORT *)(&HtCapabilityTmp.ExtHtCapInfo) = SWAP16(*(USHORT *)(&HtCapabilityTmp.ExtHtCapInfo));
-
-			MakeOutgoingFrame(pOutBuffer + FrameLen,	&tmp,
-								1,						&HtCapIe,
-								1,						&HtLen,
-								HtLen,					&HtCapabilityTmp,
-								END_OF_ARGS);
-#endif
-			FrameLen = FrameLen + tmp;
-		}
-#endif // DOT11_N_SUPPORT //
-
-		if (pDLS && (pDLS->Status != DLS_FINISH))
-		{
-			RTMPCancelTimer(&pDLS->Timer, &TimerCancelled);
-			Timeout = DLS_TIMEOUT;
-			RTMPSetTimer(&pDLS->Timer, Timeout);
-		}
-	}
-	else
-	{
-		MakeOutgoingFrame(pOutBuffer,				&FrameLen,
-						sizeof(HEADER_802_11),		&DlsRspHdr,
-						1,							&Category,
-						1,							&Action,
-						2,							&StatusCode,
-						6,							SA,
-						6,							pAd->CurrentAddress,
-						END_OF_ARGS);
-	}
-
-	MiniportMMRequest(pAd, QID_AC_BE, pOutBuffer, FrameLen);
-	MlmeFreeMemory(pAd, pOutBuffer);
-}
-
-/*
-    ==========================================================================
-    Description:
-
-	IRQL = DISPATCH_LEVEL
-
-    ==========================================================================
- */
-VOID PeerDlsRspAction(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem)
-{
-	USHORT		CapabilityInfo;
-	UCHAR		DA[MAC_ADDR_LEN], SA[MAC_ADDR_LEN];
-	USHORT		StatusCode;
-	SHORT		i;
-	BOOLEAN		TimerCancelled;
-	UCHAR		MaxSupportedRateIn500Kbps = 0;
-    UCHAR		SupportedRatesLen;
-    UCHAR		SupportedRates[MAX_LEN_OF_SUPPORTED_RATES];
-	UCHAR		HtCapabilityLen;
-	HT_CAPABILITY_IE	HtCapability;
-
-	if (!pAd->CommonCfg.bDLSCapable)
-		return;
-
-	if (!INFRA_ON(pAd))
-		return;
-
-	if (!PeerDlsRspSanity(pAd, Elem->Msg, Elem->MsgLen, DA, SA, &CapabilityInfo, &StatusCode,
-							&SupportedRatesLen, &SupportedRates[0], &HtCapabilityLen, &HtCapability))
-		return;
-
-    // supported rates array may not be sorted. sort it and find the maximum rate
-    for (i=0; i<SupportedRatesLen; i++)
-    {
-        if (MaxSupportedRateIn500Kbps < (SupportedRates[i] & 0x7f))
-            MaxSupportedRateIn500Kbps = SupportedRates[i] & 0x7f;
-    }
-
-	DBGPRINT(RT_DEBUG_TRACE,("DLS - PeerDlsRspAction() from %02x:%02x:%02x:%02x:%02x:%02x with StatusCode=%d, CapabilityInfo=0x%x\n",
-		SA[0], SA[1], SA[2], SA[3], SA[4], SA[5], StatusCode, CapabilityInfo));
-
-	for (i = 0; i < MAX_NUM_OF_INIT_DLS_ENTRY; i++)
-	{
-		if (pAd->StaCfg.DLSEntry[i].Valid && MAC_ADDR_EQUAL(SA, pAd->StaCfg.DLSEntry[i].MacAddr))
-		{
-			if (StatusCode == MLME_SUCCESS)
-			{
-				MAC_TABLE_ENTRY *pEntry;
-				UCHAR MaxSupportedRate = RATE_11;
-
-				pEntry = MacTableInsertDlsEntry(pAd, SA, i);
-
-				switch (MaxSupportedRateIn500Kbps)
-				{
-					case 108: MaxSupportedRate = RATE_54;   break;
-					case 96:  MaxSupportedRate = RATE_48;   break;
-					case 72:  MaxSupportedRate = RATE_36;   break;
-					case 48:  MaxSupportedRate = RATE_24;   break;
-					case 36:  MaxSupportedRate = RATE_18;   break;
-					case 24:  MaxSupportedRate = RATE_12;   break;
-					case 18:  MaxSupportedRate = RATE_9;    break;
-					case 12:  MaxSupportedRate = RATE_6;    break;
-					case 22:  MaxSupportedRate = RATE_11;   break;
-					case 11:  MaxSupportedRate = RATE_5_5;  break;
-					case 4:   MaxSupportedRate = RATE_2;    break;
-					case 2:   MaxSupportedRate = RATE_1;    break;
-					default:  MaxSupportedRate = RATE_11;   break;
-				}
-
-				pEntry->MaxSupportedRate = min(pAd->CommonCfg.MaxTxRate, MaxSupportedRate);
-
-				if (pEntry->MaxSupportedRate < RATE_FIRST_OFDM_RATE)
-				{
-					pEntry->MaxHTPhyMode.field.MODE = MODE_CCK;
-					pEntry->MaxHTPhyMode.field.MCS = pEntry->MaxSupportedRate;
-					pEntry->MinHTPhyMode.field.MODE = MODE_CCK;
-					pEntry->MinHTPhyMode.field.MCS = pEntry->MaxSupportedRate;
-					pEntry->HTPhyMode.field.MODE = MODE_CCK;
-					pEntry->HTPhyMode.field.MCS = pEntry->MaxSupportedRate;
-				}
-				else
-				{
-					pEntry->MaxHTPhyMode.field.MODE = MODE_OFDM;
-					pEntry->MaxHTPhyMode.field.MCS = OfdmRateToRxwiMCS[pEntry->MaxSupportedRate];
-					pEntry->MinHTPhyMode.field.MODE = MODE_OFDM;
-					pEntry->MinHTPhyMode.field.MCS = OfdmRateToRxwiMCS[pEntry->MaxSupportedRate];
-					pEntry->HTPhyMode.field.MODE = MODE_OFDM;
-					pEntry->HTPhyMode.field.MCS = OfdmRateToRxwiMCS[pEntry->MaxSupportedRate];
-				}
-
-				pEntry->MaxHTPhyMode.field.BW = BW_20;
-				pEntry->MinHTPhyMode.field.BW = BW_20;
-
-#ifdef DOT11_N_SUPPORT
-				pEntry->HTCapability.MCSSet[0] = 0;
-				pEntry->HTCapability.MCSSet[1] = 0;
-
-				// If this Entry supports 802.11n, upgrade to HT rate.
-				if ((HtCapabilityLen != 0) && (pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED))
-				{
-					UCHAR	j, bitmask; //k,bitmask;
-					CHAR    ii;
-
-					DBGPRINT(RT_DEBUG_OFF, ("DLS - PeerDlsRspAction Receive Peer HT Capable STA from %02x:%02x:%02x:%02x:%02x:%02x\n",
-								SA[0], SA[1], SA[2], SA[3], SA[4], SA[5]));
-
-					if ((HtCapability.HtCapInfo.GF) && (pAd->CommonCfg.DesiredHtPhy.GF))
-					{
-						pEntry->MaxHTPhyMode.field.MODE = MODE_HTGREENFIELD;
-					}
-					else
-					{
-						pEntry->MaxHTPhyMode.field.MODE = MODE_HTMIX;
-						pAd->MacTab.fAnyStationNonGF = TRUE;
-						pAd->CommonCfg.AddHTInfo.AddHtInfo2.NonGfPresent = 1;
-					}
-
-					if ((HtCapability.HtCapInfo.ChannelWidth) && (pAd->CommonCfg.DesiredHtPhy.ChannelWidth))
-					{
-						pEntry->MaxHTPhyMode.field.BW= BW_40;
-						pEntry->MaxHTPhyMode.field.ShortGI = ((pAd->CommonCfg.DesiredHtPhy.ShortGIfor40)&(HtCapability.HtCapInfo.ShortGIfor40));
-					}
-					else
-					{
-						pEntry->MaxHTPhyMode.field.BW = BW_20;
-						pEntry->MaxHTPhyMode.field.ShortGI = ((pAd->CommonCfg.DesiredHtPhy.ShortGIfor20)&(HtCapability.HtCapInfo.ShortGIfor20));
-						pAd->MacTab.fAnyStation20Only = TRUE;
-					}
-
-					// find max fixed rate
-					for (ii=15; ii>=0; ii--)
-					{
-						j = ii/8;
-						bitmask = (1<<(ii-(j*8)));
-						if ( (pAd->StaCfg.DesiredHtPhyInfo.MCSSet[j]&bitmask) && (HtCapability.MCSSet[j]&bitmask))
-						{
-							pEntry->MaxHTPhyMode.field.MCS = ii;
-							break;
-						}
-						if (ii==0)
-							break;
-					}
-
-					if (pAd->StaCfg.DesiredTransmitSetting.field.MCS != MCS_AUTO)
-					{
-						if (pAd->StaCfg.DesiredTransmitSetting.field.MCS == 32)
-						{
-							// Fix MCS as HT Duplicated Mode
-							pEntry->MaxHTPhyMode.field.BW = 1;
-							pEntry->MaxHTPhyMode.field.MODE = MODE_HTMIX;
-							pEntry->MaxHTPhyMode.field.STBC = 0;
-							pEntry->MaxHTPhyMode.field.ShortGI = 0;
-							pEntry->MaxHTPhyMode.field.MCS = 32;
-						}
-						else if (pEntry->MaxHTPhyMode.field.MCS > pAd->StaCfg.HTPhyMode.field.MCS)
-						{
-							// STA supports fixed MCS
-							pEntry->MaxHTPhyMode.field.MCS = pAd->StaCfg.HTPhyMode.field.MCS;
-						}
-					}
-
-					pEntry->MaxHTPhyMode.field.STBC = (HtCapability.HtCapInfo.RxSTBC & (pAd->CommonCfg.DesiredHtPhy.TxSTBC));
-					pEntry->MpduDensity = HtCapability.HtCapParm.MpduDensity;
-					pEntry->MaxRAmpduFactor = HtCapability.HtCapParm.MaxRAmpduFactor;
-					pEntry->MmpsMode = (UCHAR)HtCapability.HtCapInfo.MimoPs;
-					pEntry->AMsduSize = (UCHAR)HtCapability.HtCapInfo.AMsduSize;
-					pEntry->HTPhyMode.word = pEntry->MaxHTPhyMode.word;
-
-					if (HtCapability.HtCapInfo.ShortGIfor20)
-						CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_SGI20_CAPABLE);
-					if (HtCapability.HtCapInfo.ShortGIfor40)
-						CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_SGI40_CAPABLE);
-					if (HtCapability.HtCapInfo.TxSTBC)
-						CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_TxSTBC_CAPABLE);
-					if (HtCapability.HtCapInfo.RxSTBC)
-						CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_RxSTBC_CAPABLE);
-					if (HtCapability.ExtHtCapInfo.PlusHTC)
-						CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_HTC_CAPABLE);
-					if (pAd->CommonCfg.bRdg && HtCapability.ExtHtCapInfo.RDGSupport)
-						CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_RDG_CAPABLE);
-					if (HtCapability.ExtHtCapInfo.MCSFeedback == 0x03)
-						CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_MCSFEEDBACK_CAPABLE);
-
-					NdisMoveMemory(&pEntry->HTCapability, &HtCapability, sizeof(HT_CAPABILITY_IE));
-				}
-#endif // DOT11_N_SUPPORT //
-				pEntry->HTPhyMode.word = pEntry->MaxHTPhyMode.word;
-				pEntry->CurrTxRate = pEntry->MaxSupportedRate;
-				CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_WMM_CAPABLE);
-
-				if (pAd->StaCfg.bAutoTxRateSwitch == TRUE)
-				{
-					PUCHAR pTable;
-					UCHAR TableSize = 0;
-
-					MlmeSelectTxRateTable(pAd, pEntry, &pTable, &TableSize, &pEntry->CurrTxRateIndex);
-					pEntry->bAutoTxRateSwitch = TRUE;
-				}
-				else
-				{
-					pEntry->HTPhyMode.field.MODE	= pAd->StaCfg.HTPhyMode.field.MODE;
-					pEntry->HTPhyMode.field.MCS	= pAd->StaCfg.HTPhyMode.field.MCS;
-					pEntry->bAutoTxRateSwitch = FALSE;
-
-					RTMPUpdateLegacyTxSetting((UCHAR)pAd->StaCfg.DesiredTransmitSetting.field.FixedTxMode, pEntry);
-				}
-				pEntry->RateLen = SupportedRatesLen;
-
-				if (pAd->StaCfg.AuthMode >= Ndis802_11AuthModeWPA)
-				{
-					// If support WPA or WPA2, start STAKey hand shake,
-					// If failed hand shake, just tear down peer DLS
-					if (RTMPSendSTAKeyRequest(pAd, pAd->StaCfg.DLSEntry[i].MacAddr) != NDIS_STATUS_SUCCESS)
-					{
-						MLME_DLS_REQ_STRUCT	MlmeDlsReq;
-						USHORT				reason = REASON_QOS_CIPHER_NOT_SUPPORT;
-
-						DlsParmFill(pAd, &MlmeDlsReq, &pAd->StaCfg.DLSEntry[i], reason);
-						MlmeEnqueue(pAd, DLS_STATE_MACHINE, MT2_MLME_DLS_TEAR_DOWN, sizeof(MLME_DLS_REQ_STRUCT), &MlmeDlsReq);
-						pAd->StaCfg.DLSEntry[i].Status = DLS_NONE;
-						pAd->StaCfg.DLSEntry[i].Valid	= FALSE;
-						DBGPRINT(RT_DEBUG_ERROR,("DLS - PeerDlsRspAction failed when call RTMPSendSTAKeyRequest \n"));
-					}
-					else
-					{
-						pAd->StaCfg.DLSEntry[i].Status = DLS_WAIT_KEY;
-						DBGPRINT(RT_DEBUG_TRACE,("DLS - waiting for STAKey handshake procedure\n"));
-					}
-				}
-				else
-				{
-					RTMPCancelTimer(&pAd->StaCfg.DLSEntry[i].Timer, &TimerCancelled);
-					pAd->StaCfg.DLSEntry[i].Status = DLS_FINISH;
-					DBGPRINT(RT_DEBUG_TRACE,("DLS - PeerDlsRspAction() from %02x:%02x:%02x:%02x:%02x:%02x Succeed with WEP or no security\n", SA[0], SA[1], SA[2], SA[3], SA[4], SA[5]));
-				}
-
-				//initialize seq no for DLS frames.
-				pAd->StaCfg.DLSEntry[i].Sequence = 0;
-				if (HtCapabilityLen != 0)
-					pAd->StaCfg.DLSEntry[i].bHTCap = TRUE;
-				else
-					pAd->StaCfg.DLSEntry[i].bHTCap = FALSE;
-			}
-			else
-			{
-				// DLS setup procedure failed.
-				pAd->StaCfg.DLSEntry[i].Status = DLS_NONE;
-				pAd->StaCfg.DLSEntry[i].Valid	= FALSE;
-				RTMPCancelTimer(&pAd->StaCfg.DLSEntry[i].Timer, &TimerCancelled);
-				DBGPRINT(RT_DEBUG_ERROR,("DLS - PeerDlsRspAction failed with StatusCode=%d \n", StatusCode));
-			}
-		}
-	}
-
-	if (i >= MAX_NUM_OF_INIT_DLS_ENTRY)
-	{
-		DBGPRINT(RT_DEBUG_TRACE,("DLS - PeerDlsRspAction() update timeout value \n"));
-		for (i=(MAX_NUM_OF_DLS_ENTRY-1); i>=MAX_NUM_OF_INIT_DLS_ENTRY; i--)
-		{
-			if (pAd->StaCfg.DLSEntry[i].Valid && MAC_ADDR_EQUAL(SA, pAd->StaCfg.DLSEntry[i].MacAddr))
-			{
-				if (StatusCode == MLME_SUCCESS)
-				{
-					MAC_TABLE_ENTRY *pEntry;
-					UCHAR MaxSupportedRate = RATE_11;
-
-					pEntry = MacTableInsertDlsEntry(pAd, SA, i);
-
-					switch (MaxSupportedRateIn500Kbps)
-					{
-						case 108: MaxSupportedRate = RATE_54;   break;
-						case 96:  MaxSupportedRate = RATE_48;   break;
-						case 72:  MaxSupportedRate = RATE_36;   break;
-						case 48:  MaxSupportedRate = RATE_24;   break;
-						case 36:  MaxSupportedRate = RATE_18;   break;
-						case 24:  MaxSupportedRate = RATE_12;   break;
-						case 18:  MaxSupportedRate = RATE_9;    break;
-						case 12:  MaxSupportedRate = RATE_6;    break;
-						case 22:  MaxSupportedRate = RATE_11;   break;
-						case 11:  MaxSupportedRate = RATE_5_5;  break;
-						case 4:   MaxSupportedRate = RATE_2;    break;
-						case 2:   MaxSupportedRate = RATE_1;    break;
-						default:  MaxSupportedRate = RATE_11;   break;
-					}
-
-					pEntry->MaxSupportedRate = min(pAd->CommonCfg.MaxTxRate, MaxSupportedRate);
-
-					if (pEntry->MaxSupportedRate < RATE_FIRST_OFDM_RATE)
-					{
-						pEntry->MaxHTPhyMode.field.MODE = MODE_CCK;
-						pEntry->MaxHTPhyMode.field.MCS = pEntry->MaxSupportedRate;
-						pEntry->MinHTPhyMode.field.MODE = MODE_CCK;
-						pEntry->MinHTPhyMode.field.MCS = pEntry->MaxSupportedRate;
-						pEntry->HTPhyMode.field.MODE = MODE_CCK;
-						pEntry->HTPhyMode.field.MCS = pEntry->MaxSupportedRate;
-					}
-					else
-					{
-						pEntry->MaxHTPhyMode.field.MODE = MODE_OFDM;
-						pEntry->MaxHTPhyMode.field.MCS = OfdmRateToRxwiMCS[pEntry->MaxSupportedRate];
-						pEntry->MinHTPhyMode.field.MODE = MODE_OFDM;
-						pEntry->MinHTPhyMode.field.MCS = OfdmRateToRxwiMCS[pEntry->MaxSupportedRate];
-						pEntry->HTPhyMode.field.MODE = MODE_OFDM;
-						pEntry->HTPhyMode.field.MCS = OfdmRateToRxwiMCS[pEntry->MaxSupportedRate];
-					}
-
-					pEntry->MaxHTPhyMode.field.BW = BW_20;
-					pEntry->MinHTPhyMode.field.BW = BW_20;
-
-#ifdef DOT11_N_SUPPORT
-					pEntry->HTCapability.MCSSet[0] = 0;
-					pEntry->HTCapability.MCSSet[1] = 0;
-
-					// If this Entry supports 802.11n, upgrade to HT rate.
-					if ((HtCapabilityLen != 0) && (pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED))
-					{
-						UCHAR	j, bitmask; //k,bitmask;
-						CHAR    ii;
-
-						DBGPRINT(RT_DEBUG_TRACE, ("DLS - PeerDlsRspAction Receive Peer HT Capable STA from %02x:%02x:%02x:%02x:%02x:%02x\n",
-									SA[0], SA[1], SA[2], SA[3], SA[4], SA[5]));
-
-						if ((HtCapability.HtCapInfo.GF) && (pAd->CommonCfg.DesiredHtPhy.GF))
-						{
-							pEntry->MaxHTPhyMode.field.MODE = MODE_HTGREENFIELD;
-						}
-						else
-						{
-							pEntry->MaxHTPhyMode.field.MODE = MODE_HTMIX;
-							pAd->MacTab.fAnyStationNonGF = TRUE;
-							pAd->CommonCfg.AddHTInfo.AddHtInfo2.NonGfPresent = 1;
-						}
-
-						if ((HtCapability.HtCapInfo.ChannelWidth) && (pAd->CommonCfg.DesiredHtPhy.ChannelWidth))
-						{
-							pEntry->MaxHTPhyMode.field.BW= BW_40;
-							pEntry->MaxHTPhyMode.field.ShortGI = ((pAd->CommonCfg.DesiredHtPhy.ShortGIfor40)&(HtCapability.HtCapInfo.ShortGIfor40));
-						}
-						else
-						{
-							pEntry->MaxHTPhyMode.field.BW = BW_20;
-							pEntry->MaxHTPhyMode.field.ShortGI = ((pAd->CommonCfg.DesiredHtPhy.ShortGIfor20)&(HtCapability.HtCapInfo.ShortGIfor20));
-							pAd->MacTab.fAnyStation20Only = TRUE;
-						}
-
-						// find max fixed rate
-						for (ii=15; ii>=0; ii--)
-						{
-							j = ii/8;
-							bitmask = (1<<(ii-(j*8)));
-							if ( (pAd->StaCfg.DesiredHtPhyInfo.MCSSet[j]&bitmask) && (HtCapability.MCSSet[j]&bitmask))
-							{
-								pEntry->MaxHTPhyMode.field.MCS = ii;
-								break;
-							}
-							if (ii==0)
-								break;
-						}
-
-						if (pAd->StaCfg.DesiredTransmitSetting.field.MCS != MCS_AUTO)
-						{
-							DBGPRINT(RT_DEBUG_OFF, ("@@@ pAd->CommonCfg.RegTransmitSetting.field.MCS = %d\n",
-													pAd->StaCfg.DesiredTransmitSetting.field.MCS));
-							if (pAd->StaCfg.DesiredTransmitSetting.field.MCS == 32)
-							{
-								// Fix MCS as HT Duplicated Mode
-								pEntry->MaxHTPhyMode.field.BW = 1;
-								pEntry->MaxHTPhyMode.field.MODE = MODE_HTMIX;
-								pEntry->MaxHTPhyMode.field.STBC = 0;
-								pEntry->MaxHTPhyMode.field.ShortGI = 0;
-								pEntry->MaxHTPhyMode.field.MCS = 32;
-							}
-							else if (pEntry->MaxHTPhyMode.field.MCS > pAd->StaCfg.HTPhyMode.field.MCS)
-							{
-								// STA supports fixed MCS
-								pEntry->MaxHTPhyMode.field.MCS = pAd->StaCfg.HTPhyMode.field.MCS;
-							}
-						}
-
-						pEntry->MaxHTPhyMode.field.STBC = (HtCapability.HtCapInfo.RxSTBC & (pAd->CommonCfg.DesiredHtPhy.TxSTBC));
-						pEntry->MpduDensity = HtCapability.HtCapParm.MpduDensity;
-						pEntry->MaxRAmpduFactor = HtCapability.HtCapParm.MaxRAmpduFactor;
-						pEntry->MmpsMode = (UCHAR)HtCapability.HtCapInfo.MimoPs;
-						pEntry->AMsduSize = (UCHAR)HtCapability.HtCapInfo.AMsduSize;
-						pEntry->HTPhyMode.word = pEntry->MaxHTPhyMode.word;
-
-						if (HtCapability.HtCapInfo.ShortGIfor20)
-							CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_SGI20_CAPABLE);
-						if (HtCapability.HtCapInfo.ShortGIfor40)
-							CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_SGI40_CAPABLE);
-						if (HtCapability.HtCapInfo.TxSTBC)
-							CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_TxSTBC_CAPABLE);
-						if (HtCapability.HtCapInfo.RxSTBC)
-							CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_RxSTBC_CAPABLE);
-						if (HtCapability.ExtHtCapInfo.PlusHTC)
-							CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_HTC_CAPABLE);
-						if (pAd->CommonCfg.bRdg && HtCapability.ExtHtCapInfo.RDGSupport)
-							CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_RDG_CAPABLE);
-						if (HtCapability.ExtHtCapInfo.MCSFeedback == 0x03)
-							CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_MCSFEEDBACK_CAPABLE);
-
-						NdisMoveMemory(&pEntry->HTCapability, &HtCapability, sizeof(HT_CAPABILITY_IE));
-					}
-#endif // DOT11_N_SUPPORT //
-
-					pEntry->HTPhyMode.word = pEntry->MaxHTPhyMode.word;
-					pEntry->CurrTxRate = pEntry->MaxSupportedRate;
-					CLIENT_STATUS_SET_FLAG(pEntry, fCLIENT_STATUS_WMM_CAPABLE);
-
-					if (pAd->StaCfg.bAutoTxRateSwitch == TRUE)
-					{
-						PUCHAR pTable;
-						UCHAR TableSize = 0;
-
-						MlmeSelectTxRateTable(pAd, pEntry, &pTable, &TableSize, &pEntry->CurrTxRateIndex);
-						pEntry->bAutoTxRateSwitch = TRUE;
-					}
-					else
-					{
-						pEntry->HTPhyMode.field.MODE	= pAd->StaCfg.HTPhyMode.field.MODE;
-						pEntry->HTPhyMode.field.MCS	= pAd->StaCfg.HTPhyMode.field.MCS;
-						pEntry->bAutoTxRateSwitch = FALSE;
-
-						RTMPUpdateLegacyTxSetting((UCHAR)pAd->StaCfg.DesiredTransmitSetting.field.FixedTxMode, pEntry);
-					}
-					pEntry->RateLen = SupportedRatesLen;
-
-					if (pAd->StaCfg.AuthMode >= Ndis802_11AuthModeWPA)
-					{
-						// If support WPA or WPA2, start STAKey hand shake,
-						// If failed hand shake, just tear down peer DLS
-						if (RTMPSendSTAKeyRequest(pAd, pAd->StaCfg.DLSEntry[i].MacAddr) != NDIS_STATUS_SUCCESS)
-						{
-							MLME_DLS_REQ_STRUCT	MlmeDlsReq;
-							USHORT				reason = REASON_QOS_CIPHER_NOT_SUPPORT;
-
-							DlsParmFill(pAd, &MlmeDlsReq, &pAd->StaCfg.DLSEntry[i], reason);
-							MlmeEnqueue(pAd, DLS_STATE_MACHINE, MT2_MLME_DLS_TEAR_DOWN, sizeof(MLME_DLS_REQ_STRUCT), &MlmeDlsReq);
-							pAd->StaCfg.DLSEntry[i].Status = DLS_NONE;
-							pAd->StaCfg.DLSEntry[i].Valid	= FALSE;
-							DBGPRINT(RT_DEBUG_ERROR,("DLS - PeerDlsRspAction failed when call RTMPSendSTAKeyRequest \n"));
-						}
-						else
-						{
-							pAd->StaCfg.DLSEntry[i].Status = DLS_WAIT_KEY;
-							DBGPRINT(RT_DEBUG_TRACE,("DLS - waiting for STAKey handshake procedure\n"));
-						}
-					}
-					else
-					{
-						RTMPCancelTimer(&pAd->StaCfg.DLSEntry[i].Timer, &TimerCancelled);
-						pAd->StaCfg.DLSEntry[i].Status = DLS_FINISH;
-						DBGPRINT(RT_DEBUG_TRACE,("DLS - PeerDlsRspAction() from %02x:%02x:%02x:%02x:%02x:%02x Succeed with WEP or no security\n", SA[0], SA[1], SA[2], SA[3], SA[4], SA[5]));
-					}
-					pAd->StaCfg.DLSEntry[i].Sequence = 0;
-					if (HtCapabilityLen != 0)
-						pAd->StaCfg.DLSEntry[i].bHTCap = TRUE;
-					else
-						pAd->StaCfg.DLSEntry[i].bHTCap = FALSE;
-				}
-				else
-				{
-					// DLS setup procedure failed.
-					pAd->StaCfg.DLSEntry[i].Status = DLS_NONE;
-					pAd->StaCfg.DLSEntry[i].Valid	= FALSE;
-					RTMPCancelTimer(&pAd->StaCfg.DLSEntry[i].Timer, &TimerCancelled);
-					DBGPRINT(RT_DEBUG_ERROR,("DLS - PeerDlsRspAction failed with StatusCode=%d \n", StatusCode));
-				}
-			}
-		}
-	}
-}
-
-/*
-    ==========================================================================
-    Description:
-
-	IRQL = DISPATCH_LEVEL
-
-    ==========================================================================
- */
-VOID MlmeDlsTearDownAction(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem)
-{
-	PUCHAR			pOutBuffer = NULL;
-	NDIS_STATUS		NStatus;
-	ULONG			FrameLen = 0;
-	UCHAR			Category = CATEGORY_DLS;
-	UCHAR			Action = ACTION_DLS_TEARDOWN;
-	USHORT			ReasonCode = REASON_QOS_UNSPECIFY;
-	HEADER_802_11	DlsTearDownHdr;
-	PRT_802_11_DLS	pDLS;
-	BOOLEAN			TimerCancelled;
-	UCHAR			i;
-
-	if(!MlmeDlsReqSanity(pAd, Elem->Msg, Elem->MsgLen, &pDLS, &ReasonCode))
-		return;
-
-	DBGPRINT(RT_DEBUG_TRACE,("DLS - MlmeDlsTearDownAction() with ReasonCode=%d \n", ReasonCode));
-
-	NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);  //Get an unused nonpaged memory
-	if (NStatus != NDIS_STATUS_SUCCESS)
-	{
-		DBGPRINT(RT_DEBUG_ERROR,("DLS - MlmeDlsTearDownAction() allocate memory failed \n"));
-		return;
-	}
-
-	ActHeaderInit(pAd, &DlsTearDownHdr, pAd->CommonCfg.Bssid, pAd->CurrentAddress, pAd->CommonCfg.Bssid);
-
-	// Build basic frame first
-	MakeOutgoingFrame(pOutBuffer,				&FrameLen,
-					sizeof(HEADER_802_11),		&DlsTearDownHdr,
-					1,							&Category,
-					1,							&Action,
-					6,							&pDLS->MacAddr,
-					6,							pAd->CurrentAddress,
-					2,							&ReasonCode,
-					END_OF_ARGS);
-
-	MiniportMMRequest(pAd, QID_AC_BE, pOutBuffer, FrameLen);
-	MlmeFreeMemory(pAd, pOutBuffer);
-	RTMPCancelTimer(&pDLS->Timer, &TimerCancelled);
-
-	// Remove key in local dls table entry
-	for (i = 0; i < MAX_NUM_OF_INIT_DLS_ENTRY; i++)
-	{
-		if (MAC_ADDR_EQUAL(pDLS->MacAddr, pAd->StaCfg.DLSEntry[i].MacAddr))
-		{
-			MacTableDeleteDlsEntry(pAd, pAd->StaCfg.DLSEntry[i].MacTabMatchWCID, pAd->StaCfg.DLSEntry[i].MacAddr);
-		}
-	}
-
-	// clear peer dls table entry
-	for (i = MAX_NUM_OF_INIT_DLS_ENTRY; i < MAX_NUM_OF_DLS_ENTRY; i++)
-	{
-		if (MAC_ADDR_EQUAL(pDLS->MacAddr, pAd->StaCfg.DLSEntry[i].MacAddr))
-		{
-			pAd->StaCfg.DLSEntry[i].Status	= DLS_NONE;
-			pAd->StaCfg.DLSEntry[i].Valid	= FALSE;
-			RTMPCancelTimer(&pAd->StaCfg.DLSEntry[i].Timer, &TimerCancelled);
-			MacTableDeleteDlsEntry(pAd, pAd->StaCfg.DLSEntry[i].MacTabMatchWCID, pAd->StaCfg.DLSEntry[i].MacAddr);
-		}
-	}
-}
-
-/*
-    ==========================================================================
-    Description:
-
-	IRQL = DISPATCH_LEVEL
-
-    ==========================================================================
- */
-VOID PeerDlsTearDownAction(
-    IN PRTMP_ADAPTER pAd,
-    IN MLME_QUEUE_ELEM *Elem)
-{
-	UCHAR			DA[MAC_ADDR_LEN], SA[MAC_ADDR_LEN];
-	USHORT			ReasonCode;
-	UINT			i;
-	BOOLEAN			TimerCancelled;
-
-	if (!pAd->CommonCfg.bDLSCapable)
-		return;
-
-	if (!INFRA_ON(pAd))
-		return;
-
-	if (!PeerDlsTearDownSanity(pAd, Elem->Msg, Elem->MsgLen, DA, SA, &ReasonCode))
-		return;
-
-	DBGPRINT(RT_DEBUG_TRACE,("DLS - PeerDlsTearDownAction() from %02x:%02x:%02x:%02x:%02x:%02x with ReasonCode=%d\n", SA[0], SA[1], SA[2], SA[3], SA[4], SA[5], ReasonCode));
-
-	// clear local dls table entry
-	for (i=0; i<MAX_NUM_OF_INIT_DLS_ENTRY; i++)
-	{
-		if (pAd->StaCfg.DLSEntry[i].Valid && MAC_ADDR_EQUAL(SA, pAd->StaCfg.DLSEntry[i].MacAddr))
-		{
-			pAd->StaCfg.DLSEntry[i].Status	= DLS_NONE;
-			pAd->StaCfg.DLSEntry[i].Valid	= FALSE;
-			RTMPCancelTimer(&pAd->StaCfg.DLSEntry[i].Timer, &TimerCancelled);
-			//AsicDelWcidTab(pAd, pAd->StaCfg.DLSEntry[i].MacTabMatchWCID);
-			//AsicRemovePairwiseKeyEntry(pAd, BSS0, pAd->StaCfg.DLSEntry[i].MacTabMatchWCID);
-			MacTableDeleteDlsEntry(pAd, pAd->StaCfg.DLSEntry[i].MacTabMatchWCID, pAd->StaCfg.DLSEntry[i].MacAddr);
-		}
-	}
-
-	// clear peer dls table entry
-	for (i=MAX_NUM_OF_INIT_DLS_ENTRY; i<MAX_NUM_OF_DLS_ENTRY; i++)
-	{
-		if (pAd->StaCfg.DLSEntry[i].Valid && MAC_ADDR_EQUAL(SA, pAd->StaCfg.DLSEntry[i].MacAddr))
-		{
-			pAd->StaCfg.DLSEntry[i].Status	= DLS_NONE;
-			pAd->StaCfg.DLSEntry[i].Valid	= FALSE;
-			RTMPCancelTimer(&pAd->StaCfg.DLSEntry[i].Timer, &TimerCancelled);
-			//AsicDelWcidTab(pAd, pAd->StaCfg.DLSEntry[i].MacTabMatchWCID);
-			//AsicRemovePairwiseKeyEntry(pAd, BSS0, pAd->StaCfg.DLSEntry[i].MacTabMatchWCID);
-			MacTableDeleteDlsEntry(pAd, pAd->StaCfg.DLSEntry[i].MacTabMatchWCID, pAd->StaCfg.DLSEntry[i].MacAddr);
-		}
-	}
-}
-
-/*
-    ==========================================================================
-    Description:
-
-	IRQL = DISPATCH_LEVEL
-
-    ==========================================================================
- */
-VOID RTMPCheckDLSTimeOut(
-	IN PRTMP_ADAPTER	pAd)
-{
-	ULONG				i;
-	MLME_DLS_REQ_STRUCT	MlmeDlsReq;
-	USHORT				reason = REASON_QOS_UNSPECIFY;
-
-	if (! pAd->CommonCfg.bDLSCapable)
-		return;
-
-	if (! INFRA_ON(pAd))
-		return;
-
-	// If timeout value is equaled to zero, it means always not be timeout.
-
-	// update local dls table entry
-	for (i=0; i<MAX_NUM_OF_INIT_DLS_ENTRY; i++)
-	{
-		if ((pAd->StaCfg.DLSEntry[i].Valid) && (pAd->StaCfg.DLSEntry[i].Status == DLS_FINISH)
-			&& (pAd->StaCfg.DLSEntry[i].TimeOut != 0))
-		{
-			pAd->StaCfg.DLSEntry[i].CountDownTimer --;
-
-			if (pAd->StaCfg.DLSEntry[i].CountDownTimer == 0)
-			{
-				reason = REASON_QOS_REQUEST_TIMEOUT;
-				pAd->StaCfg.DLSEntry[i].Valid	= FALSE;
-				pAd->StaCfg.DLSEntry[i].Status	= DLS_NONE;
-				DlsParmFill(pAd, &MlmeDlsReq, &pAd->StaCfg.DLSEntry[i], reason);
-				MlmeEnqueue(pAd, DLS_STATE_MACHINE, MT2_MLME_DLS_TEAR_DOWN, sizeof(MLME_DLS_REQ_STRUCT), &MlmeDlsReq);
-			}
-		}
-	}
-
-	// update peer dls table entry
-	for (i=MAX_NUM_OF_INIT_DLS_ENTRY; i<MAX_NUM_OF_DLS_ENTRY; i++)
-	{
-		if ((pAd->StaCfg.DLSEntry[i].Valid) && (pAd->StaCfg.DLSEntry[i].Status == DLS_FINISH)
-			&& (pAd->StaCfg.DLSEntry[i].TimeOut != 0))
-		{
-			pAd->StaCfg.DLSEntry[i].CountDownTimer --;
-
-			if (pAd->StaCfg.DLSEntry[i].CountDownTimer == 0)
-			{
-				reason = REASON_QOS_REQUEST_TIMEOUT;
-				pAd->StaCfg.DLSEntry[i].Valid	= FALSE;
-				pAd->StaCfg.DLSEntry[i].Status	= DLS_NONE;
-				DlsParmFill(pAd, &MlmeDlsReq, &pAd->StaCfg.DLSEntry[i], reason);
-				MlmeEnqueue(pAd, DLS_STATE_MACHINE, MT2_MLME_DLS_TEAR_DOWN, sizeof(MLME_DLS_REQ_STRUCT), &MlmeDlsReq);
-			}
-		}
-	}
-}
-
-/*
-    ==========================================================================
-    Description:
-
-	IRQL = DISPATCH_LEVEL
-
-    ==========================================================================
- */
-BOOLEAN RTMPRcvFrameDLSCheck(
-	IN PRTMP_ADAPTER	pAd,
-	IN PHEADER_802_11	pHeader,
-	IN ULONG			Len,
-	IN PRT28XX_RXD_STRUC	pRxD)
-{
-	ULONG			i;
-	BOOLEAN			bFindEntry = FALSE;
-	BOOLEAN			bSTAKeyFrame = FALSE;
-	PEAPOL_PACKET	pEap;
-	PUCHAR			pProto, pAddr = NULL;
-	PUCHAR			pSTAKey = NULL;
-	UCHAR			ZeroReplay[LEN_KEY_DESC_REPLAY];
-	UCHAR			Mic[16], OldMic[16];
-	UCHAR			digest[80];
-	UCHAR			DlsPTK[80];
-	UCHAR			temp[64];
-	BOOLEAN			TimerCancelled;
-	CIPHER_KEY		PairwiseKey;
-
-
-	if (! pAd->CommonCfg.bDLSCapable)
-		return bSTAKeyFrame;
-
-	if (! INFRA_ON(pAd))
-		return bSTAKeyFrame;
-
-	if (Len < LENGTH_802_11 + 6 + 2) /* LENGTH_802_11 + LLC + EAPOL protocol type */
-		return bSTAKeyFrame;
-
-	pProto	= (PUCHAR)pHeader + LENGTH_802_11;
-
-	if ((pHeader->FC.SubType & 0x08))
-		pProto	+= 2;	/* QOS Control field */
-
-     /* Skip 4-bytes for HTC */
-     if (pHeader->FC.Order && (!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_AGGREGATION_INUSED)))
-     {
-          pProto += 4;
-     }
-
-	/* L2PAD bit on will pad 2 bytes at LLC */
-	if (pRxD->L2PAD)
-	{
-		pProto += 2;
-	}
-
-	pProto	+= 6;	/* 0xAA 0xAA 0xAA 0x00 0x00 0x00 */
-
-	if ((!(pHeader->FC.SubType & 0x08)) && (!RTMPEqualMemory(EAPOL, pProto, 2)))
-		return bSTAKeyFrame;
-
-	pAddr	= pHeader->Addr2;
-
-	if (RTMPEqualMemory(EAPOL, pProto, 2) && (pAd->StaCfg.AuthMode >=  Ndis802_11AuthModeWPA))
-	{
-		pEap = (PEAPOL_PACKET) (pProto + 2);
-
-		DBGPRINT(RT_DEBUG_TRACE,("DLS - Sniff Len=%ld, DataLen=%d, KeyMic=%d, Install=%d, KeyAck=%d, Secure=%d, EKD_DL=%d, Error=%d, Request=%d\n", Len,
-			                                                             (LENGTH_802_11 + 6 + 2 + 2 + sizeof(EAPOL_PACKET) - MAX_LEN_OF_RSNIE + 16),
-			                                                             pEap->KeyDesc.KeyInfo.KeyMic,
-			                                                             pEap->KeyDesc.KeyInfo.Install,
-			                                                             pEap->KeyDesc.KeyInfo.KeyAck,
-			                                                             pEap->KeyDesc.KeyInfo.Secure,
-			                                                             pEap->KeyDesc.KeyInfo.EKD_DL,
-			                                                             pEap->KeyDesc.KeyInfo.Error,
-			                                                             pEap->KeyDesc.KeyInfo.Request));
-
-		if ((Len >= (LENGTH_802_11 + 6 + 2 + 2 + sizeof(EAPOL_PACKET) - MAX_LEN_OF_RSNIE + 16)) && pEap->KeyDesc.KeyInfo.KeyMic
-			&& pEap->KeyDesc.KeyInfo.Install && pEap->KeyDesc.KeyInfo.KeyAck && pEap->KeyDesc.KeyInfo.Secure
-			&& pEap->KeyDesc.KeyInfo.EKD_DL && !pEap->KeyDesc.KeyInfo.Error && !pEap->KeyDesc.KeyInfo.Request)
-		{
-			// First validate replay counter, only accept message with larger replay counter
-			// Let equal pass, some AP start with all zero replay counter
-			NdisZeroMemory(ZeroReplay, LEN_KEY_DESC_REPLAY);
-			if ((RTMPCompareMemory(pEap->KeyDesc.ReplayCounter, pAd->StaCfg.ReplayCounter, LEN_KEY_DESC_REPLAY) != 1) &&
-				(RTMPCompareMemory(pEap->KeyDesc.ReplayCounter, ZeroReplay, LEN_KEY_DESC_REPLAY) != 0))
-				return bSTAKeyFrame;
-
-			//RTMPMoveMemory(pAd->StaCfg.ReplayCounter, pEap->KeyDesc.ReplayCounter, LEN_KEY_DESC_REPLAY);
-			RTMPMoveMemory(pAd->StaCfg.DlsReplayCounter, pEap->KeyDesc.ReplayCounter, LEN_KEY_DESC_REPLAY);
-			DBGPRINT(RT_DEBUG_TRACE,("DLS - Sniff replay counter (%02x-%02x-%02x-%02x-%02x-%02x-%02x-%02x) Len=%ld, KeyDataLen=%d\n",
-				pAd->StaCfg.ReplayCounter[0], pAd->StaCfg.ReplayCounter[1], pAd->StaCfg.ReplayCounter[2],
-				pAd->StaCfg.ReplayCounter[3], pAd->StaCfg.ReplayCounter[4],	pAd->StaCfg.ReplayCounter[5],
-				pAd->StaCfg.ReplayCounter[6], pAd->StaCfg.ReplayCounter[7], Len, pEap->KeyDesc.KeyData[1]));
-
-			// put these code segment to get the replay counter
-			if (pAd->StaCfg.PortSecured == WPA_802_1X_PORT_NOT_SECURED)
-				return bSTAKeyFrame;
-
-			// Check MIC value
-			// Save the MIC and replace with zero
-			// use proprietary PTK
-			NdisZeroMemory(temp, 64);
-			NdisMoveMemory(temp, "IEEE802.11 WIRELESS ACCESS POINT", 32);
-			WpaDerivePTK(pAd, temp, temp, pAd->CommonCfg.Bssid, temp, pAd->CurrentAddress, DlsPTK, LEN_PTK);
-
-			NdisMoveMemory(OldMic, pEap->KeyDesc.KeyMic, LEN_KEY_DESC_MIC);
-			NdisZeroMemory(pEap->KeyDesc.KeyMic, LEN_KEY_DESC_MIC);
-			if (pAd->StaCfg.WepStatus == Ndis802_11Encryption3Enabled)
-			{
-				// AES
-				HMAC_SHA1(DlsPTK, LEN_EAP_MICK, (PUCHAR) pEap, pEap->Body_Len[1] + 4, digest, SHA1_DIGEST_SIZE);
-				NdisMoveMemory(Mic,	digest,	LEN_KEY_DESC_MIC);
-			}
-			else
-			{
-				HMAC_MD5(DlsPTK, LEN_EAP_MICK, (PUCHAR) pEap, pEap->Body_Len[1] + 4, Mic, MD5_DIGEST_SIZE);
-			}
-
-			if (!NdisEqualMemory(OldMic, Mic, LEN_KEY_DESC_MIC))
-			{
-				DBGPRINT(RT_DEBUG_ERROR, ("MIC Different in Msg1 of STAKey handshake! \n"));
-				return bSTAKeyFrame;
-			}
-			else
-				DBGPRINT(RT_DEBUG_TRACE, ("MIC VALID in Msg1 of STAKey handshake! \n"));
-			if ((pEap->KeyDesc.KeyData[0] == 0xDD) && (pEap->KeyDesc.KeyData[2] == 0x00) && (pEap->KeyDesc.KeyData[3] == 0x0C)
-				&& (pEap->KeyDesc.KeyData[4] == 0x43) && (pEap->KeyDesc.KeyData[5] == 0x02))
-			{
-				pAddr			= pEap->KeyDesc.KeyData + 8;		// Tpe(1), Len(1), OUI(3), DataType(1), Reserved(2)
-				pSTAKey			= pEap->KeyDesc.KeyData + 14;	// Tpe(1), Len(1), OUI(3), DataType(1), Reserved(2), STAKey_Mac_Addr(6)
-
-				DBGPRINT(RT_DEBUG_TRACE,("DLS - Receive STAKey Message-1 from %02x:%02x:%02x:%02x:%02x:%02x Len=%ld, KeyDataLen=%d\n",
-					pAddr[0], pAddr[1], pAddr[2], pAddr[3], pAddr[4], pAddr[5], Len, pEap->KeyDesc.KeyData[1]));
-
-				bSTAKeyFrame = TRUE;
-			}
-
-		}
-		else if (Len >= (LENGTH_802_11 + 6 + 2 + 2 + sizeof(EAPOL_PACKET) - MAX_LEN_OF_RSNIE))
-		{
-			RTMPMoveMemory(pAd->StaCfg.DlsReplayCounter, pEap->KeyDesc.ReplayCounter, LEN_KEY_DESC_REPLAY);
-			DBGPRINT(RT_DEBUG_TRACE,("DLS - Sniff replay counter 2(%02x-%02x-%02x-%02x-%02x-%02x-%02x-%02x) Len=%ld, KeyDataLen=%d\n",
-				pAd->StaCfg.ReplayCounter[0], pAd->StaCfg.ReplayCounter[1], pAd->StaCfg.ReplayCounter[2],
-				pAd->StaCfg.ReplayCounter[3], pAd->StaCfg.ReplayCounter[4],	pAd->StaCfg.ReplayCounter[5],
-				pAd->StaCfg.ReplayCounter[6], pAd->StaCfg.ReplayCounter[7], Len, pEap->KeyDesc.KeyData[1]));
-		}
-	}
-
-	// If timeout value is equaled to zero, it means always not be timeout.
-	// update local dls table entry
-	for (i= 0; i < MAX_NUM_OF_INIT_DLS_ENTRY; i++)
-	{
-		if (pAd->StaCfg.DLSEntry[i].Valid && MAC_ADDR_EQUAL(pAddr, pAd->StaCfg.DLSEntry[i].MacAddr))
-		{
-			if (bSTAKeyFrame)
-			{
-				PMAC_TABLE_ENTRY pEntry;
-
-				// STAKey frame, add pairwise key table
-				pAd->StaCfg.DLSEntry[i].Status = DLS_FINISH;
-				RTMPCancelTimer(&pAd->StaCfg.DLSEntry[i].Timer, &TimerCancelled);
-
-				PairwiseKey.KeyLen = LEN_TKIP_EK;
-				NdisMoveMemory(PairwiseKey.Key, &pSTAKey[0], LEN_TKIP_EK);
-				NdisMoveMemory(PairwiseKey.TxMic, &pSTAKey[16], LEN_TKIP_RXMICK);
-				NdisMoveMemory(PairwiseKey.RxMic, &pSTAKey[24], LEN_TKIP_TXMICK);
-
-				//PairwiseKey.CipherAlg = pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].CipherAlg;
-				if (pAd->StaCfg.PairCipher == Ndis802_11Encryption2Enabled)
-					PairwiseKey.CipherAlg = CIPHER_TKIP;
-				else if (pAd->StaCfg.PairCipher == Ndis802_11Encryption3Enabled)
-					PairwiseKey.CipherAlg = CIPHER_AES;
-
-				pEntry = DlsEntryTableLookup(pAd, pAd->StaCfg.DLSEntry[i].MacAddr, TRUE);
-				//AsicAddKeyEntry(pAd, (USHORT)(i + 2), BSS0, 0, &PairwiseKey, TRUE, TRUE);	// reserve 0 for multicast, 1 for unicast
-				//AsicUpdateRxWCIDTable(pAd, (USHORT)(i + 2), pAddr);
-				// Add Pair-wise key to Asic
-#ifdef RTMP_MAC_PCI
-				AsicAddPairwiseKeyEntry(pAd,
-										pAd->StaCfg.DLSEntry[i].MacAddr,
-										(UCHAR)pAd->StaCfg.DLSEntry[i].MacTabMatchWCID,
-										&PairwiseKey);
-
-				RTMPAddWcidAttributeEntry(pAd,
-										  BSS0,
-										  0,
-										  PairwiseKey.CipherAlg,
-										  pEntry);
-
-#endif // RTMP_MAC_PCI //
-				NdisMoveMemory(&pEntry->PairwiseKey, &PairwiseKey, sizeof(CIPHER_KEY));
-				DBGPRINT(RT_DEBUG_TRACE,("DLS - Receive STAKey Message-1 (Peer STA MAC Address STAKey) \n"));
-
-				RTMPSendSTAKeyHandShake(pAd, pAd->StaCfg.DLSEntry[i].MacAddr);
-
-				DBGPRINT(RT_DEBUG_TRACE,("DLS - Finish STAKey handshake procedure (Initiator side)\n"));
-			}
-			else
-			{
-				// Data frame, update timeout value
-				if (pAd->StaCfg.DLSEntry[i].Status == DLS_FINISH)
-				{
-					pAd->StaCfg.DLSEntry[i].CountDownTimer = pAd->StaCfg.DLSEntry[i].TimeOut;
-					//AsicUpdateRxWCIDTable(pAd, (USHORT)(i + 2), pAddr);
-				}
-			}
-
-			bFindEntry = TRUE;
-		}
-	}
-
-	// update peer dls table entry
-	for (i=MAX_NUM_OF_INIT_DLS_ENTRY; i<MAX_NUM_OF_DLS_ENTRY; i++)
-	{
-		if (pAd->StaCfg.DLSEntry[i].Valid && MAC_ADDR_EQUAL(pAddr, pAd->StaCfg.DLSEntry[i].MacAddr))
-		{
-			if (bSTAKeyFrame)
-			{
-				PMAC_TABLE_ENTRY pEntry = NULL;
-
-				// STAKey frame, add pairwise key table, and send STAkey Msg-2
-				pAd->StaCfg.DLSEntry[i].Status = DLS_FINISH;
-				RTMPCancelTimer(&pAd->StaCfg.DLSEntry[i].Timer, &TimerCancelled);
-
-				PairwiseKey.KeyLen = LEN_TKIP_EK;
-				NdisMoveMemory(PairwiseKey.Key, &pSTAKey[0], LEN_TKIP_EK);
-				NdisMoveMemory(PairwiseKey.TxMic, &pSTAKey[16], LEN_TKIP_RXMICK);
-				NdisMoveMemory(PairwiseKey.RxMic, &pSTAKey[24], LEN_TKIP_TXMICK);
-
-				//PairwiseKey.CipherAlg = pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].CipherAlg;
-				if (pAd->StaCfg.PairCipher == Ndis802_11Encryption2Enabled)
-					PairwiseKey.CipherAlg = CIPHER_TKIP;
-				else if (pAd->StaCfg.PairCipher == Ndis802_11Encryption3Enabled)
-					PairwiseKey.CipherAlg = CIPHER_AES;
-
-				pEntry = DlsEntryTableLookup(pAd, pAd->StaCfg.DLSEntry[i].MacAddr, TRUE);
-				//AsicAddKeyEntry(pAd, (USHORT)(i + 2), BSS0, 0, &PairwiseKey, TRUE, TRUE);	// reserve 0 for multicast, 1 for unicast
-				//AsicUpdateRxWCIDTable(pAd, (USHORT)(i + 2), pAddr);
-				// Add Pair-wise key to Asic
-#ifdef RTMP_MAC_PCI
-		AsicAddPairwiseKeyEntry(pAd,
-										pAd->StaCfg.DLSEntry[i].MacAddr,
-										(UCHAR)pAd->StaCfg.DLSEntry[i].MacTabMatchWCID,
-										&PairwiseKey);
-
-				RTMPAddWcidAttributeEntry(pAd,
-										  BSS0,
-										  0,
-										  PairwiseKey.CipherAlg,
-										  pEntry);
-#endif // RTMP_MAC_PCI //
-				NdisMoveMemory(&pEntry->PairwiseKey, &PairwiseKey, sizeof(CIPHER_KEY));
-				DBGPRINT(RT_DEBUG_TRACE,("DLS - Receive STAKey Message-1 (Initiator STA MAC Address STAKey)\n"));
-
-				// If support WPA or WPA2, start STAKey hand shake,
-				// If failed hand shake, just tear down peer DLS
-				if (RTMPSendSTAKeyHandShake(pAd, pAddr) != NDIS_STATUS_SUCCESS)
-				{
-					MLME_DLS_REQ_STRUCT	MlmeDlsReq;
-					USHORT				reason = REASON_QOS_CIPHER_NOT_SUPPORT;
-
-					pAd->StaCfg.DLSEntry[i].Valid	= FALSE;
-					pAd->StaCfg.DLSEntry[i].Status	= DLS_NONE;
-					DlsParmFill(pAd, &MlmeDlsReq, &pAd->StaCfg.DLSEntry[i], reason);
-					MlmeEnqueue(pAd, DLS_STATE_MACHINE, MT2_MLME_DLS_TEAR_DOWN, sizeof(MLME_DLS_REQ_STRUCT), &MlmeDlsReq);
-				}
-				else
-				{
-					DBGPRINT(RT_DEBUG_TRACE,("DLS - Finish STAKey handshake procedure (Peer side)\n"));
-				}
-			}
-			else
-			{
-				// Data frame, update timeout value
-				if (pAd->StaCfg.DLSEntry[i].Status == DLS_FINISH)
-				{
-					pAd->StaCfg.DLSEntry[i].CountDownTimer = pAd->StaCfg.DLSEntry[i].TimeOut;
-				}
-			}
-
-			bFindEntry = TRUE;
-		}
-	}
-
-
-	return bSTAKeyFrame;
-}
-
-/*
-	========================================================================
-
-	Routine	Description:
-		Check if the frame can be sent through DLS direct link interface
-
-	Arguments:
-		pAd		Pointer	to adapter
-
-	Return Value:
-		DLS entry index
-
-	Note:
-
-	========================================================================
-*/
-INT	RTMPCheckDLSFrame(
-	IN	PRTMP_ADAPTER	pAd,
-	IN  PUCHAR          pDA)
-{
-	INT rval = -1;
-	INT	i;
-
-	if (!pAd->CommonCfg.bDLSCapable)
-		return rval;
-
-	if (!INFRA_ON(pAd))
-		return rval;
-
-	do{
-		// check local dls table entry
-		for (i=0; i<MAX_NUM_OF_INIT_DLS_ENTRY; i++)
-		{
-			if (pAd->StaCfg.DLSEntry[i].Valid && (pAd->StaCfg.DLSEntry[i].Status == DLS_FINISH) &&
-				MAC_ADDR_EQUAL(pDA, pAd->StaCfg.DLSEntry[i].MacAddr))
-			{
-				rval = i;
-				break;
-			}
-		}
-
-		// check peer dls table entry
-		for (i=MAX_NUM_OF_INIT_DLS_ENTRY; i<MAX_NUM_OF_DLS_ENTRY; i++)
-		{
-			if (pAd->StaCfg.DLSEntry[i].Valid && (pAd->StaCfg.DLSEntry[i].Status == DLS_FINISH) &&
-				MAC_ADDR_EQUAL(pDA, pAd->StaCfg.DLSEntry[i].MacAddr))
-			{
-				rval = i;
-				break;
-			}
-		}
-	} while (FALSE);
-
-	return rval;
-}
-
-/*
-    ==========================================================================
-    Description:
-
-	IRQL = DISPATCH_LEVEL
-
-    ==========================================================================
- */
-VOID RTMPSendDLSTearDownFrame(
-	IN	PRTMP_ADAPTER	pAd,
-	IN  PUCHAR          pDA)
-{
-	PUCHAR			pOutBuffer = NULL;
-	NDIS_STATUS		NStatus;
-	HEADER_802_11	DlsTearDownHdr;
-	ULONG			FrameLen = 0;
-	USHORT			Reason = REASON_QOS_QSTA_LEAVING_QBSS;
-	UCHAR			Category = CATEGORY_DLS;
-	UCHAR			Action = ACTION_DLS_TEARDOWN;
-	UCHAR			i = 0;
-
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RESET_IN_PROGRESS) ||
-		RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS))
-		return;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Send DLS TearDown Frame \n"));
-
-	NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);  //Get an unused nonpaged memory
-	if (NStatus != NDIS_STATUS_SUCCESS)
-	{
-		DBGPRINT(RT_DEBUG_ERROR,("ASSOC - RTMPSendDLSTearDownFrame() allocate memory failed \n"));
-		return;
-	}
-
-	ActHeaderInit(pAd, &DlsTearDownHdr, pAd->CommonCfg.Bssid, pAd->CurrentAddress, pAd->CommonCfg.Bssid);
-	MakeOutgoingFrame(pOutBuffer,				&FrameLen,
-					sizeof(HEADER_802_11),		&DlsTearDownHdr,
-					1,							&Category,
-					1,							&Action,
-					6,							pDA,
-					6,							pAd->CurrentAddress,
-					2,							&Reason,
-					END_OF_ARGS);
-
-	MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
-	MlmeFreeMemory(pAd, pOutBuffer);
-
-	// Remove key in local dls table entry
-	for (i = 0; i < MAX_NUM_OF_INIT_DLS_ENTRY; i++)
-	{
-		if (pAd->StaCfg.DLSEntry[i].Valid && (pAd->StaCfg.DLSEntry[i].Status == DLS_FINISH)
-			&& MAC_ADDR_EQUAL(pDA, pAd->StaCfg.DLSEntry[i].MacAddr))
-		{
-			MacTableDeleteDlsEntry(pAd, pAd->StaCfg.DLSEntry[i].MacTabMatchWCID, pAd->StaCfg.DLSEntry[i].MacAddr);
-		}
-	}
-
-	// Remove key in peer dls table entry
-	for (i=MAX_NUM_OF_INIT_DLS_ENTRY; i<MAX_NUM_OF_DLS_ENTRY; i++)
-	{
-		if (pAd->StaCfg.DLSEntry[i].Valid && (pAd->StaCfg.DLSEntry[i].Status == DLS_FINISH)
-			&& MAC_ADDR_EQUAL(pDA, pAd->StaCfg.DLSEntry[i].MacAddr))
-		{
-			MacTableDeleteDlsEntry(pAd, pAd->StaCfg.DLSEntry[i].MacTabMatchWCID, pAd->StaCfg.DLSEntry[i].MacAddr);
-		}
-	}
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Send DLS TearDown Frame and remove key in (i=%d) \n", i));
-}
-
-/*
-    ==========================================================================
-    Description:
-
-	IRQL = DISPATCH_LEVEL
-
-    ==========================================================================
- */
-NDIS_STATUS RTMPSendSTAKeyRequest(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			pDA)
-{
-	UCHAR				Header802_3[14];
-	NDIS_STATUS			NStatus;
-	ULONG				FrameLen = 0;
-	EAPOL_PACKET		Packet;
-	UCHAR				Mic[16];
-	UCHAR				digest[80];
-	PUCHAR				pOutBuffer = NULL;
-	PNDIS_PACKET		pNdisPacket;
-	UCHAR				temp[64];
-	UCHAR				DlsPTK[80];
-
-	DBGPRINT(RT_DEBUG_TRACE,("DLS - RTMPSendSTAKeyRequest() to %02x:%02x:%02x:%02x:%02x:%02x\n", pDA[0], pDA[1], pDA[2], pDA[3], pDA[4], pDA[5]));
-
-	pAd->Sequence ++;
-	MAKE_802_3_HEADER(Header802_3, pAd->CommonCfg.Bssid, pAd->CurrentAddress, EAPOL);
-
-	// Zero message body
-	NdisZeroMemory(&Packet, sizeof(Packet));
-	Packet.ProVer = EAPOL_VER;
-	Packet.ProType    = EAPOLKey;
-	Packet.Body_Len[1]  = sizeof(KEY_DESCRIPTER) - MAX_LEN_OF_RSNIE + 6 + MAC_ADDR_LEN;		// data field contain KDE andPeer MAC address
-
-	// STAKey Message is as EAPOL-Key(1,1,0,0,G/0,0,0, MIC, 0,Peer MAC KDE)
-	if ((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA) || (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPAPSK))
-    {
-        Packet.KeyDesc.Type = WPA1_KEY_DESC;
-    }
-    else if ((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2) || (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK))
-    {
-        Packet.KeyDesc.Type = WPA2_KEY_DESC;
-    }
-
-	// Key descriptor version
-	Packet.KeyDesc.KeyInfo.KeyDescVer =
-		(((pAd->StaCfg.PairCipher == Ndis802_11Encryption3Enabled) || (pAd->StaCfg.GroupCipher == Ndis802_11Encryption3Enabled)) ? (DESC_TYPE_AES) : (DESC_TYPE_TKIP));
-
-	Packet.KeyDesc.KeyInfo.KeyMic	= 1;
-	Packet.KeyDesc.KeyInfo.Secure	= 1;
-	Packet.KeyDesc.KeyInfo.Request	= 1;
-
-	Packet.KeyDesc.KeyDataLen[1]	= 12;
-
-	// use our own OUI to distinguish proprietary with standard.
-	Packet.KeyDesc.KeyData[0]		= 0xDD;
-	Packet.KeyDesc.KeyData[1]		= 0x0A;
-	Packet.KeyDesc.KeyData[2]		= 0x00;
-	Packet.KeyDesc.KeyData[3]		= 0x0C;
-	Packet.KeyDesc.KeyData[4]		= 0x43;
-	Packet.KeyDesc.KeyData[5]		= 0x03;
-	NdisMoveMemory(&Packet.KeyDesc.KeyData[6], pDA, MAC_ADDR_LEN);
-
-	NdisMoveMemory(Packet.KeyDesc.ReplayCounter, pAd->StaCfg.DlsReplayCounter, LEN_KEY_DESC_REPLAY);
-
-	// Allocate buffer for transmitting message
-	NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);
-	if (NStatus	!= NDIS_STATUS_SUCCESS)
-		return NStatus;
-
-	// Prepare EAPOL frame for MIC calculation
-	// Be careful, only EAPOL frame is counted for MIC calculation
-	MakeOutgoingFrame(pOutBuffer,           &FrameLen,
-		              Packet.Body_Len[1] + 4,    &Packet,
-		              END_OF_ARGS);
-
-	// use proprietary PTK
-	NdisZeroMemory(temp, 64);
-	NdisMoveMemory(temp, "IEEE802.11 WIRELESS ACCESS POINT", 32);
-	WpaDerivePTK(pAd, temp, temp, pAd->CommonCfg.Bssid, temp, pAd->CurrentAddress, DlsPTK, LEN_PTK);
-
-	// calculate MIC
-	if (pAd->StaCfg.WepStatus == Ndis802_11Encryption3Enabled)
-	{
-		// AES
-		NdisZeroMemory(digest,	sizeof(digest));
-		HMAC_SHA1(DlsPTK, LEN_EAP_MICK, pOutBuffer, FrameLen, digest, SHA1_DIGEST_SIZE);
-		NdisMoveMemory(Packet.KeyDesc.KeyMic, digest, LEN_KEY_DESC_MIC);
-	}
-	else
-	{
-		NdisZeroMemory(Mic,	sizeof(Mic));
-		HMAC_MD5(DlsPTK, LEN_EAP_MICK, pOutBuffer, FrameLen, Mic, MD5_DIGEST_SIZE);
-		NdisMoveMemory(Packet.KeyDesc.KeyMic, Mic, LEN_KEY_DESC_MIC);
-	}
-
-	MakeOutgoingFrame(pOutBuffer,           &FrameLen,
-	                  sizeof(Header802_3),	Header802_3,
-		              Packet.Body_Len[1] + 4,	&Packet,
-		              END_OF_ARGS);
-
-	NStatus = RTMPAllocateNdisPacket(pAd, &pNdisPacket, NULL, 0, pOutBuffer, FrameLen);
-	if (NStatus == NDIS_STATUS_SUCCESS)
-	{
-		RTMP_SET_PACKET_WCID(pNdisPacket, BSSID_WCID);
-		STASendPacket(pAd, pNdisPacket);
-		RTMPDeQueuePacket(pAd, FALSE, NUM_OF_TX_RING, MAX_TX_PROCESS);
-	}
-
-	MlmeFreeMemory(pAd, pOutBuffer);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("RTMPSendSTAKeyRequest- Send STAKey request (NStatus=%x, FrameLen=%ld)\n", NStatus, FrameLen));
-
-	return NStatus;
-}
-
-/*
-    ==========================================================================
-    Description:
-
-	IRQL = DISPATCH_LEVEL
-
-    ==========================================================================
- */
-NDIS_STATUS RTMPSendSTAKeyHandShake(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			pDA)
-{
-	UCHAR				Header802_3[14];
-	NDIS_STATUS			NStatus;
-	ULONG				FrameLen = 0;
-	EAPOL_PACKET		Packet;
-	UCHAR				Mic[16];
-	UCHAR				digest[80];
-	PUCHAR				pOutBuffer = NULL;
-	PNDIS_PACKET		pNdisPacket;
-	UCHAR				temp[64];
-	UCHAR				DlsPTK[80];			// Due to dirver can not get PTK, use proprietary PTK
-
-	DBGPRINT(RT_DEBUG_TRACE,("DLS - RTMPSendSTAKeyHandShake() to %02x:%02x:%02x:%02x:%02x:%02x\n", pDA[0], pDA[1], pDA[2], pDA[3], pDA[4], pDA[5]));
-
-	pAd->Sequence ++;
-	MAKE_802_3_HEADER(Header802_3, pAd->CommonCfg.Bssid, pAd->CurrentAddress, EAPOL);
-
-	// Zero message body
-	NdisZeroMemory(&Packet, sizeof(Packet));
-	Packet.ProVer = EAPOL_VER;
-	Packet.ProType    = EAPOLKey;
-	Packet.Body_Len[1]  = sizeof(KEY_DESCRIPTER) - MAX_LEN_OF_RSNIE + 6 + MAC_ADDR_LEN;		// data field contain KDE and Peer MAC address
-
-	// STAKey Message is as EAPOL-Key(1,1,0,0,G/0,0,0, MIC, 0,Peer MAC KDE)
-	if ((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA) || (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPAPSK))
-    {
-        Packet.KeyDesc.Type = WPA1_KEY_DESC;
-    }
-    else if ((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2) || (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK))
-    {
-        Packet.KeyDesc.Type = WPA2_KEY_DESC;
-    }
-
-	// Key descriptor version
-	Packet.KeyDesc.KeyInfo.KeyDescVer =
-		(((pAd->StaCfg.PairCipher == Ndis802_11Encryption3Enabled) || (pAd->StaCfg.GroupCipher == Ndis802_11Encryption3Enabled)) ? (DESC_TYPE_AES) : (DESC_TYPE_TKIP));
-
-	Packet.KeyDesc.KeyInfo.KeyMic	= 1;
-	Packet.KeyDesc.KeyInfo.Secure	= 1;
-
-	Packet.KeyDesc.KeyDataLen[1]	= 12;
-
-	// use our own OUI to distinguish proprietary with standard.
-	Packet.KeyDesc.KeyData[0]		= 0xDD;
-	Packet.KeyDesc.KeyData[1]		= 0x0A;
-	Packet.KeyDesc.KeyData[2]		= 0x00;
-	Packet.KeyDesc.KeyData[3]		= 0x0C;
-	Packet.KeyDesc.KeyData[4]		= 0x43;
-	Packet.KeyDesc.KeyData[5]		= 0x03;
-	NdisMoveMemory(&Packet.KeyDesc.KeyData[6], pDA, MAC_ADDR_LEN);
-
-	NdisMoveMemory(Packet.KeyDesc.ReplayCounter, pAd->StaCfg.DlsReplayCounter, LEN_KEY_DESC_REPLAY);
-
-	// Allocate buffer for transmitting message
-	NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);
-	if (NStatus	!= NDIS_STATUS_SUCCESS)
-		return NStatus;
-
-	// Prepare EAPOL frame for MIC calculation
-	// Be careful, only EAPOL frame is counted for MIC calculation
-	MakeOutgoingFrame(pOutBuffer,           &FrameLen,
-		              Packet.Body_Len[1] + 4,    &Packet,
-		              END_OF_ARGS);
-
-	// use proprietary PTK
-	NdisZeroMemory(temp, 64);
-	NdisMoveMemory(temp, "IEEE802.11 WIRELESS ACCESS POINT", 32);
-	WpaDerivePTK(pAd, temp, temp, pAd->CommonCfg.Bssid, temp, pAd->CurrentAddress, DlsPTK, LEN_PTK);
-
-	// calculate MIC
-	if (pAd->StaCfg.WepStatus == Ndis802_11Encryption3Enabled)
-	{
-		// AES
-		NdisZeroMemory(digest,	sizeof(digest));
-		HMAC_SHA1(DlsPTK, LEN_EAP_MICK, pOutBuffer, FrameLen, digest, SHA1_DIGEST_SIZE);
-		NdisMoveMemory(Packet.KeyDesc.KeyMic, digest, LEN_KEY_DESC_MIC);
-	}
-	else
-	{
-		NdisZeroMemory(Mic,	sizeof(Mic));
-		HMAC_MD5(DlsPTK, LEN_EAP_MICK, pOutBuffer, FrameLen, Mic, MD5_DIGEST_SIZE);
-		NdisMoveMemory(Packet.KeyDesc.KeyMic, Mic, LEN_KEY_DESC_MIC);
-	}
-
-	MakeOutgoingFrame(pOutBuffer,           &FrameLen,
-	                  sizeof(Header802_3),	Header802_3,
-		              Packet.Body_Len[1] + 4,	&Packet,
-		              END_OF_ARGS);
-
-	NStatus = RTMPAllocateNdisPacket(pAd, &pNdisPacket, NULL, 0, pOutBuffer, FrameLen);
-	if (NStatus == NDIS_STATUS_SUCCESS)
-	{
-		RTMP_SET_PACKET_WCID(pNdisPacket, BSSID_WCID);
-		STASendPacket(pAd, pNdisPacket);
-		RTMPDeQueuePacket(pAd, FALSE, NUM_OF_TX_RING, MAX_TX_PROCESS);
-	}
-
-	MlmeFreeMemory(pAd, pOutBuffer);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("RTMPSendSTAKeyHandShake- Send STAKey Message-2 (NStatus=%x, FrameLen=%ld)\n", NStatus, FrameLen));
-
-	return NStatus;
-}
-
-VOID DlsTimeoutAction(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3)
-{
-	MLME_DLS_REQ_STRUCT		MlmeDlsReq;
-	USHORT					reason;
-	PRT_802_11_DLS			pDLS = (PRT_802_11_DLS)FunctionContext;
-	PRTMP_ADAPTER			pAd = pDLS->pAd;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("DlsTimeout - Tear down DLS links (%02x:%02x:%02x:%02x:%02x:%02x)\n",
-		pDLS->MacAddr[0], pDLS->MacAddr[1], pDLS->MacAddr[2], pDLS->MacAddr[3], pDLS->MacAddr[4], pDLS->MacAddr[5]));
-
-	if ((pDLS) && (pDLS->Valid))
-	{
-		reason			= REASON_QOS_REQUEST_TIMEOUT;
-		pDLS->Valid		= FALSE;
-		pDLS->Status	= DLS_NONE;
-		DlsParmFill(pAd, &MlmeDlsReq, pDLS, reason);
-		MlmeEnqueue(pAd, DLS_STATE_MACHINE, MT2_MLME_DLS_TEAR_DOWN, sizeof(MLME_DLS_REQ_STRUCT), &MlmeDlsReq);
-		RTMP_MLME_HANDLER(pAd);
-	}
-}
-
-/*
-================================================================
-Description : because DLS and CLI share the same WCID table in ASIC.
-Mesh entry also insert to pAd->MacTab.content[].  Such is marked as ValidAsDls = TRUE.
-Also fills the pairwise key.
-Because front MAX_AID_BA entries have direct mapping to BAEntry, which is only used as CLI. So we insert Dls
-from index MAX_AID_BA.
-================================================================
-*/
-MAC_TABLE_ENTRY *MacTableInsertDlsEntry(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  PUCHAR	pAddr,
-	IN  UINT	DlsEntryIdx)
-{
-	PMAC_TABLE_ENTRY pEntry = NULL;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("====> MacTableInsertDlsEntry\n"));
-	// if FULL, return
-	if (pAd->MacTab.Size >= MAX_LEN_OF_MAC_TABLE)
-		return NULL;
-
-	do
-	{
-		if((pEntry = DlsEntryTableLookup(pAd, pAddr, TRUE)) != NULL)
-			break;
-
-		// allocate one MAC entry
-		pEntry = MacTableInsertEntry(pAd, pAddr, DlsEntryIdx + MIN_NET_DEVICE_FOR_DLS, TRUE);
-		if (pEntry)
-		{
-			pAd->StaCfg.DLSEntry[DlsEntryIdx].MacTabMatchWCID = pEntry->Aid;
-			pEntry->MatchDlsEntryIdx = DlsEntryIdx;
-			pEntry->AuthMode = pAd->StaCfg.AuthMode;
-			pEntry->WepStatus = pAd->StaCfg.WepStatus;
-			pEntry->PortSecured = WPA_802_1X_PORT_SECURED;
-
-			DBGPRINT(RT_DEBUG_TRACE, ("MacTableInsertDlsEntry - allocate entry #%d, Total= %d\n",pEntry->Aid, pAd->MacTab.Size));
-
-			// If legacy WEP is used, set pair-wise cipherAlg into WCID attribute table for this entry
-			if ((pEntry->ValidAsDls) && (pAd->StaCfg.WepStatus == Ndis802_11WEPEnabled))
-			{
-				UCHAR KeyIdx = 0;
-				UCHAR CipherAlg = 0;
-
-				KeyIdx	= pAd->StaCfg.DefaultKeyId;
-
-				CipherAlg	= pAd->SharedKey[BSS0][KeyIdx].CipherAlg;
-
-				RTMPAddWcidAttributeEntry(pAd,
-											BSS0,
-											pAd->StaCfg.DefaultKeyId,
-											pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].CipherAlg,
-											pEntry);
-			}
-
-			break;
-		}
-	} while(FALSE);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("<==== MacTableInsertDlsEntry\n"));
-
-	return pEntry;
-}
-
-
-/*
-	==========================================================================
-	Description:
-		Delete all Mesh Entry in pAd->MacTab
-	==========================================================================
- */
-BOOLEAN MacTableDeleteDlsEntry(
-	IN PRTMP_ADAPTER pAd,
-	IN USHORT wcid,
-	IN PUCHAR pAddr)
-{
-	DBGPRINT(RT_DEBUG_TRACE, ("====> MacTableDeleteDlsEntry\n"));
-
-	if (!VALID_WCID(wcid))
-		return FALSE;
-
-	MacTableDeleteEntry(pAd, wcid, pAddr);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("<==== MacTableDeleteDlsEntry\n"));
-
-	return TRUE;
-}
-
-MAC_TABLE_ENTRY *DlsEntryTableLookup(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR	pAddr,
-	IN BOOLEAN	bResetIdelCount)
-{
-	ULONG HashIdx;
-	MAC_TABLE_ENTRY *pEntry = NULL;
-
-	RTMP_SEM_LOCK(&pAd->MacTabLock);
-	HashIdx = MAC_ADDR_HASH_INDEX(pAddr);
-	pEntry = pAd->MacTab.Hash[HashIdx];
-
-	while (pEntry)
-	{
-		if ((pEntry->ValidAsDls == TRUE)
-			&& MAC_ADDR_EQUAL(pEntry->Addr, pAddr))
-		{
-			if(bResetIdelCount)
-				pEntry->NoDataIdleCount = 0;
-			break;
-		}
-		else
-			pEntry = pEntry->pNext;
-	}
-
-	RTMP_SEM_UNLOCK(&pAd->MacTabLock);
-	return pEntry;
-}
-
-MAC_TABLE_ENTRY *DlsEntryTableLookupByWcid(
-	IN PRTMP_ADAPTER pAd,
-	IN UCHAR	wcid,
-	IN PUCHAR	pAddr,
-	IN BOOLEAN	bResetIdelCount)
-{
-	ULONG DLsIndex;
-	PMAC_TABLE_ENTRY pCurEntry = NULL;
-	PMAC_TABLE_ENTRY pEntry = NULL;
-
-	if (!VALID_WCID(wcid))
-		return NULL;
-
-	RTMP_SEM_LOCK(&pAd->MacTabLock);
-
-	do
-	{
-		pCurEntry = &pAd->MacTab.Content[wcid];
-
-		DLsIndex = 0xff;
-		if ((pCurEntry) && (pCurEntry->ValidAsDls== TRUE))
-		{
-			DLsIndex = pCurEntry->MatchDlsEntryIdx;
-		}
-
-		if (DLsIndex == 0xff)
-			break;
-
-		if (MAC_ADDR_EQUAL(pCurEntry->Addr, pAddr))
-		{
-			if(bResetIdelCount)
-				pCurEntry->NoDataIdleCount = 0;
-			pEntry = pCurEntry;
-			break;
-		}
-	} while(FALSE);
-
-	RTMP_SEM_UNLOCK(&pAd->MacTabLock);
-
-	return pEntry;
-}
-
-INT Set_DlsEntryInfo_Display_Proc(
-	IN PRTMP_ADAPTER pAd,
-	IN PUCHAR arg)
-{
-	INT i;
-
-	DBGPRINT(RT_DEBUG_OFF, ("\n%-19s%-8s\n", "MAC", "TIMEOUT\n"));
-	for (i=0; i<MAX_NUM_OF_DLS_ENTRY; i++)
-	{
-		if ((pAd->StaCfg.DLSEntry[i].Valid) && (pAd->StaCfg.DLSEntry[i].Status == DLS_FINISH))
-		{
-			PMAC_TABLE_ENTRY pEntry = &pAd->MacTab.Content[pAd->StaCfg.DLSEntry[i].MacTabMatchWCID];
-
-			DBGPRINT(RT_DEBUG_OFF, ("%02x:%02x:%02x:%02x:%02x:%02x  ",
-				pAd->StaCfg.DLSEntry[i].MacAddr[0], pAd->StaCfg.DLSEntry[i].MacAddr[1], pAd->StaCfg.DLSEntry[i].MacAddr[2],
-				pAd->StaCfg.DLSEntry[i].MacAddr[3], pAd->StaCfg.DLSEntry[i].MacAddr[4], pAd->StaCfg.DLSEntry[i].MacAddr[5]));
-			DBGPRINT(RT_DEBUG_OFF, ("%-8d\n", pAd->StaCfg.DLSEntry[i].TimeOut));
-
-			DBGPRINT(RT_DEBUG_OFF, ("\n"));
-			DBGPRINT(RT_DEBUG_OFF, ("\n%-19s%-4s%-4s%-4s%-4s%-7s%-7s%-7s","MAC", "AID", "BSS", "PSM", "WMM", "RSSI0", "RSSI1", "RSSI2"));
-#ifdef DOT11_N_SUPPORT
-			DBGPRINT(RT_DEBUG_OFF, ("%-8s%-10s%-6s%-6s%-6s%-6s", "MIMOPS", "PhMd", "BW", "MCS", "SGI", "STBC"));
-#endif // DOT11_N_SUPPORT //
-			DBGPRINT(RT_DEBUG_OFF, ("\n%02X:%02X:%02X:%02X:%02X:%02X  ",
-				pEntry->Addr[0], pEntry->Addr[1], pEntry->Addr[2],
-				pEntry->Addr[3], pEntry->Addr[4], pEntry->Addr[5]));
-			DBGPRINT(RT_DEBUG_OFF, ("%-4d", (int)pEntry->Aid));
-			DBGPRINT(RT_DEBUG_OFF, ("%-4d", (int)pEntry->apidx));
-			DBGPRINT(RT_DEBUG_OFF, ("%-4d", (int)pEntry->PsMode));
-			DBGPRINT(RT_DEBUG_OFF, ("%-4d", (int)CLIENT_STATUS_TEST_FLAG(pEntry, fCLIENT_STATUS_WMM_CAPABLE)));
-			DBGPRINT(RT_DEBUG_OFF, ("%-7d", pEntry->RssiSample.AvgRssi0));
-			DBGPRINT(RT_DEBUG_OFF, ("%-7d", pEntry->RssiSample.AvgRssi1));
-			DBGPRINT(RT_DEBUG_OFF, ("%-7d", pEntry->RssiSample.AvgRssi2));
-#ifdef DOT11_N_SUPPORT
-			DBGPRINT(RT_DEBUG_OFF, ("%-8d", (int)pEntry->MmpsMode));
-			DBGPRINT(RT_DEBUG_OFF, ("%-10s", GetPhyMode(pEntry->HTPhyMode.field.MODE)));
-			DBGPRINT(RT_DEBUG_OFF, ("%-6s", GetBW(pEntry->HTPhyMode.field.BW)));
-			DBGPRINT(RT_DEBUG_OFF, ("%-6d", pEntry->HTPhyMode.field.MCS));
-			DBGPRINT(RT_DEBUG_OFF, ("%-6d", pEntry->HTPhyMode.field.ShortGI));
-			DBGPRINT(RT_DEBUG_OFF, ("%-6d", pEntry->HTPhyMode.field.STBC));
-#endif // DOT11_N_SUPPORT //
-			DBGPRINT(RT_DEBUG_OFF, ("%-10d, %d, %d%%\n", pEntry->DebugFIFOCount, pEntry->DebugTxCount,
-						(pEntry->DebugTxCount) ? ((pEntry->DebugTxCount-pEntry->DebugFIFOCount)*100/pEntry->DebugTxCount) : 0));
-			DBGPRINT(RT_DEBUG_OFF, ("\n"));
-
-		}
-	}
-
-	return TRUE;
-}
-
-INT	Set_DlsAddEntry_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-    UCHAR	mac[MAC_ADDR_LEN];
-	USHORT	Timeout;
-	PSTRING token;
-	STRING sepValue[] = ":", DASH = '-';
-	INT i;
-    RT_802_11_DLS	Dls;
-
-    if(strlen(arg) < 19)  //Mac address acceptable format 01:02:03:04:05:06 length 17 plus the "-" and timeout value in decimal format.
-		return FALSE;
-
-	token = strchr(arg, DASH);
-	if ((token != NULL) && (strlen(token)>1))
-	{
-		Timeout = (USHORT) simple_strtol((token+1), 0, 10);
-
-		*token = '\0';
-		for (i = 0, token = rstrtok(arg, &sepValue[0]); token; token = rstrtok(NULL, &sepValue[0]), i++)
-		{
-			if((strlen(token) != 2) || (!isxdigit(*token)) || (!isxdigit(*(token+1))))
-				return FALSE;
-			AtoH(token, (&mac[i]), 1);
-		}
-		if(i != 6)
-			return FALSE;
-
-	    DBGPRINT(RT_DEBUG_OFF, ("\n%02x:%02x:%02x:%02x:%02x:%02x-%d", mac[0], mac[1],
-	           mac[2], mac[3], mac[4], mac[5], (int)Timeout));
-
-		NdisZeroMemory(&Dls, sizeof(RT_802_11_DLS));
-		Dls.TimeOut = Timeout;
-		COPY_MAC_ADDR(Dls.MacAddr, mac);
-		Dls.Valid = 1;
-
-		MlmeEnqueue(pAd,
-					MLME_CNTL_STATE_MACHINE,
-					RT_OID_802_11_SET_DLS_PARAM,
-					sizeof(RT_802_11_DLS),
-					&Dls);
-
-		return TRUE;
-	}
-
-	return FALSE;
-
-}
-
-INT	Set_DlsTearDownEntry_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	UCHAR			macAddr[MAC_ADDR_LEN];
-	PSTRING			value;
-	INT				i;
-	RT_802_11_DLS	Dls;
-
-	if(strlen(arg) != 17)  //Mac address acceptable format 01:02:03:04:05:06 length 17
-		return FALSE;
-
-	for (i=0, value = rstrtok(arg,":"); value; value = rstrtok(NULL,":"))
-	{
-		if((strlen(value) != 2) || (!isxdigit(*value)) || (!isxdigit(*(value+1))) )
-			return FALSE;  //Invalid
-
-		AtoH(value, &macAddr[i++], 2);
-	}
-
-	DBGPRINT(RT_DEBUG_OFF, ("\n%02x:%02x:%02x:%02x:%02x:%02x", macAddr[0], macAddr[1],
-	           macAddr[2], macAddr[3], macAddr[4], macAddr[5]));
-
-	NdisZeroMemory(&Dls, sizeof(RT_802_11_DLS));
-	COPY_MAC_ADDR(Dls.MacAddr, macAddr);
-	Dls.Valid = 0;
-
-	MlmeEnqueue(pAd,
-				MLME_CNTL_STATE_MACHINE,
-				RT_OID_802_11_SET_DLS_PARAM,
-				sizeof(RT_802_11_DLS),
-				&Dls);
-
-	return TRUE;
-}
diff --git a/drivers/staging/rt3090/sta/rtmp_ckipmic.c b/drivers/staging/rt3090/sta/rtmp_ckipmic.c
deleted file mode 100644
index 5f6dbd7cf057..000000000000
--- a/drivers/staging/rt3090/sta/rtmp_ckipmic.c
+++ /dev/null
@@ -1,579 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-	Module Name:
-	rtmp_ckipmic.c
-
-	Abstract:
-	Data path subroutines
-
-	Revision History:
-	Who		When			What
-	--------	----------		----------------------------------------------
-*/
-
-#include "../rt_config.h"
-#include "../rtmp_ckipmic.h"
-
-
-#define MIC_ACCUM(v)            pContext->accum += (ULONGLONG)v * RTMPMicGetCoefficient(pContext)
-#define GB(p,i,s)               ( ((ULONG) *((UCHAR*)(p)+i) ) << (s) )
-#define GETBIG32(p)             GB(p,0,24)|GB(p,1,16)|GB(p,2,8)|GB(p,3,0)
-
-/*****************************/
-/******** SBOX Table *********/
-/*****************************/
-
-UCHAR SboxTable[256] =
-{
-    0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5,
-    0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7, 0xab, 0x76,
-    0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0,
-    0xad, 0xd4, 0xa2, 0xaf, 0x9c, 0xa4, 0x72, 0xc0,
-    0xb7, 0xfd, 0x93, 0x26, 0x36, 0x3f, 0xf7, 0xcc,
-    0x34, 0xa5, 0xe5, 0xf1, 0x71, 0xd8, 0x31, 0x15,
-    0x04, 0xc7, 0x23, 0xc3, 0x18, 0x96, 0x05, 0x9a,
-    0x07, 0x12, 0x80, 0xe2, 0xeb, 0x27, 0xb2, 0x75,
-    0x09, 0x83, 0x2c, 0x1a, 0x1b, 0x6e, 0x5a, 0xa0,
-    0x52, 0x3b, 0xd6, 0xb3, 0x29, 0xe3, 0x2f, 0x84,
-    0x53, 0xd1, 0x00, 0xed, 0x20, 0xfc, 0xb1, 0x5b,
-    0x6a, 0xcb, 0xbe, 0x39, 0x4a, 0x4c, 0x58, 0xcf,
-    0xd0, 0xef, 0xaa, 0xfb, 0x43, 0x4d, 0x33, 0x85,
-    0x45, 0xf9, 0x02, 0x7f, 0x50, 0x3c, 0x9f, 0xa8,
-    0x51, 0xa3, 0x40, 0x8f, 0x92, 0x9d, 0x38, 0xf5,
-    0xbc, 0xb6, 0xda, 0x21, 0x10, 0xff, 0xf3, 0xd2,
-    0xcd, 0x0c, 0x13, 0xec, 0x5f, 0x97, 0x44, 0x17,
-    0xc4, 0xa7, 0x7e, 0x3d, 0x64, 0x5d, 0x19, 0x73,
-    0x60, 0x81, 0x4f, 0xdc, 0x22, 0x2a, 0x90, 0x88,
-    0x46, 0xee, 0xb8, 0x14, 0xde, 0x5e, 0x0b, 0xdb,
-    0xe0, 0x32, 0x3a, 0x0a, 0x49, 0x06, 0x24, 0x5c,
-    0xc2, 0xd3, 0xac, 0x62, 0x91, 0x95, 0xe4, 0x79,
-    0xe7, 0xc8, 0x37, 0x6d, 0x8d, 0xd5, 0x4e, 0xa9,
-    0x6c, 0x56, 0xf4, 0xea, 0x65, 0x7a, 0xae, 0x08,
-    0xba, 0x78, 0x25, 0x2e, 0x1c, 0xa6, 0xb4, 0xc6,
-    0xe8, 0xdd, 0x74, 0x1f, 0x4b, 0xbd, 0x8b, 0x8a,
-    0x70, 0x3e, 0xb5, 0x66, 0x48, 0x03, 0xf6, 0x0e,
-    0x61, 0x35, 0x57, 0xb9, 0x86, 0xc1, 0x1d, 0x9e,
-    0xe1, 0xf8, 0x98, 0x11, 0x69, 0xd9, 0x8e, 0x94,
-    0x9b, 0x1e, 0x87, 0xe9, 0xce, 0x55, 0x28, 0xdf,
-    0x8c, 0xa1, 0x89, 0x0d, 0xbf, 0xe6, 0x42, 0x68,
-    0x41, 0x99, 0x2d, 0x0f, 0xb0, 0x54, 0xbb, 0x16
-};
-
-/*===========================================================================*/
-/*=================== CKIP KEY PERMUTATION ==================================*/
-/*===========================================================================*/
-
-/* 2-byte by 2-byte subset of the full AES table */
-static const USHORT Sbox[256] =
-{
-    0xC6A5,0xF884,0xEE99,0xF68D,0xFF0D,0xD6BD,0xDEB1,0x9154,
-    0x6050,0x0203,0xCEA9,0x567D,0xE719,0xB562,0x4DE6,0xEC9A,
-    0x8F45,0x1F9D,0x8940,0xFA87,0xEF15,0xB2EB,0x8EC9,0xFB0B,
-    0x41EC,0xB367,0x5FFD,0x45EA,0x23BF,0x53F7,0xE496,0x9B5B,
-    0x75C2,0xE11C,0x3DAE,0x4C6A,0x6C5A,0x7E41,0xF502,0x834F,
-    0x685C,0x51F4,0xD134,0xF908,0xE293,0xAB73,0x6253,0x2A3F,
-    0x080C,0x9552,0x4665,0x9D5E,0x3028,0x37A1,0x0A0F,0x2FB5,
-    0x0E09,0x2436,0x1B9B,0xDF3D,0xCD26,0x4E69,0x7FCD,0xEA9F,
-    0x121B,0x1D9E,0x5874,0x342E,0x362D,0xDCB2,0xB4EE,0x5BFB,
-    0xA4F6,0x764D,0xB761,0x7DCE,0x527B,0xDD3E,0x5E71,0x1397,
-    0xA6F5,0xB968,0x0000,0xC12C,0x4060,0xE31F,0x79C8,0xB6ED,
-    0xD4BE,0x8D46,0x67D9,0x724B,0x94DE,0x98D4,0xB0E8,0x854A,
-    0xBB6B,0xC52A,0x4FE5,0xED16,0x86C5,0x9AD7,0x6655,0x1194,
-    0x8ACF,0xE910,0x0406,0xFE81,0xA0F0,0x7844,0x25BA,0x4BE3,
-    0xA2F3,0x5DFE,0x80C0,0x058A,0x3FAD,0x21BC,0x7048,0xF104,
-    0x63DF,0x77C1,0xAF75,0x4263,0x2030,0xE51A,0xFD0E,0xBF6D,
-    0x814C,0x1814,0x2635,0xC32F,0xBEE1,0x35A2,0x88CC,0x2E39,
-    0x9357,0x55F2,0xFC82,0x7A47,0xC8AC,0xBAE7,0x322B,0xE695,
-    0xC0A0,0x1998,0x9ED1,0xA37F,0x4466,0x547E,0x3BAB,0x0B83,
-    0x8CCA,0xC729,0x6BD3,0x283C,0xA779,0xBCE2,0x161D,0xAD76,
-    0xDB3B,0x6456,0x744E,0x141E,0x92DB,0x0C0A,0x486C,0xB8E4,
-    0x9F5D,0xBD6E,0x43EF,0xC4A6,0x39A8,0x31A4,0xD337,0xF28B,
-    0xD532,0x8B43,0x6E59,0xDAB7,0x018C,0xB164,0x9CD2,0x49E0,
-    0xD8B4,0xACFA,0xF307,0xCF25,0xCAAF,0xF48E,0x47E9,0x1018,
-    0x6FD5,0xF088,0x4A6F,0x5C72,0x3824,0x57F1,0x73C7,0x9751,
-    0xCB23,0xA17C,0xE89C,0x3E21,0x96DD,0x61DC,0x0D86,0x0F85,
-    0xE090,0x7C42,0x71C4,0xCCAA,0x90D8,0x0605,0xF701,0x1C12,
-    0xC2A3,0x6A5F,0xAEF9,0x69D0,0x1791,0x9958,0x3A27,0x27B9,
-    0xD938,0xEB13,0x2BB3,0x2233,0xD2BB,0xA970,0x0789,0x33A7,
-    0x2DB6,0x3C22,0x1592,0xC920,0x8749,0xAAFF,0x5078,0xA57A,
-    0x038F,0x59F8,0x0980,0x1A17,0x65DA,0xD731,0x84C6,0xD0B8,
-    0x82C3,0x29B0,0x5A77,0x1E11,0x7BCB,0xA8FC,0x6DD6,0x2C3A
-    };
-
-#define Lo8(v16)     ((v16)       & 0xFF)
-#define Hi8(v16)    (((v16) >> 8) & 0xFF)
-#define u16Swap(i)  ( (((i) >> 8) & 0xFF) | (((i) << 8) & 0xFF00) )
-#define _S_(i)      (Sbox[Lo8(i)] ^ u16Swap(Sbox[Hi8(i)]))
-
-#define rotLeft_1(x) ((((x) << 1) | ((x) >> 15)) & 0xFFFF)
-VOID CKIP_key_permute
-    (
-     OUT UCHAR  *PK,           /* output permuted key */
-     IN UCHAR *CK,           /* input CKIP key */
-     IN UCHAR  toDsFromDs,    /* input toDs/FromDs bits */
-     IN UCHAR *piv           /* input pointer to IV */
-     )
-{
-    int i;
-    USHORT H[2], tmp;          /* H=32-bits of per-packet hash value */
-    USHORT L[8], R[8];         /* L=u16 array of CK, R=u16 array of PK */
-
-    /* build L from input key */
-    memset(L, 0, sizeof(L));
-    for (i=0; i<16; i++) {
-        L[i>>1] |= ( ((USHORT)(CK[i])) << ( i & 1 ? 8 : 0) );
-    }
-
-    H[0] = (((USHORT)piv[0]) << 8) + piv[1];
-    H[1] = ( ((USHORT)toDsFromDs) << 8) | piv[2];
-
-    for (i=0; i<8; i++) {
-        H[0] ^= L[i];           /* 16-bits of key material */
-        tmp   = _S_(H[0]);      /* 16x16 permutation */
-        H[0]  = tmp ^ H[1];     /* set up for next round */
-        H[1]  = tmp;
-        R[i]  = H[0];           /* store into key array  */
-    }
-
-    /* sweep in the other direction */
-    tmp=L[0];
-    for (i=7; i>0; i--) {
-        R[i] = tmp = rotLeft_1(tmp) + R[i];
-    }
-
-    /* IV of the permuted key is unchanged */
-    PK[0] = piv[0];
-    PK[1] = piv[1];
-    PK[2] = piv[2];
-
-    /* key portion of the permuted key is changed */
-    for (i=3; i<16; i++) {
-        PK[i] = (UCHAR) (R[i>>1] >> (i & 1 ? 8 : 0));
-    }
-}
-
-/* prepare for calculation of a new mic */
-VOID RTMPCkipMicInit(
-    IN  PMIC_CONTEXT        pContext,
-    IN  PUCHAR              CK)
-{
-    /* prepare for new mic calculation */
-    NdisMoveMemory(pContext->CK, CK, sizeof(pContext->CK));
-    pContext->accum = 0;
-    pContext->position = 0;
-}
-
-/* add some bytes to the mic calculation */
-VOID RTMPMicUpdate(
-    IN  PMIC_CONTEXT        pContext,
-    IN  PUCHAR              pOctets,
-    IN  INT                 len)
-{
-    INT     byte_position;
-    ULONG   val;
-
-    byte_position = (pContext->position & 3);
-    while (len > 0) {
-        /* build a 32-bit word for MIC multiply accumulate */
-        do {
-            if (len == 0) return;
-            pContext->part[byte_position++] = *pOctets++;
-            pContext->position++;
-            len--;
-        } while (byte_position < 4);
-        /* have a full 32-bit word to process */
-        val = GETBIG32(&pContext->part[0]);
-        MIC_ACCUM(val);
-        byte_position = 0;
-    }
-}
-
-ULONG RTMPMicGetCoefficient(
-    IN  PMIC_CONTEXT         pContext)
-{
-    UCHAR   aes_counter[16];
-    INT     coeff_position;
-    UCHAR   *p;
-
-    coeff_position = (pContext->position - 1) >> 2;
-    if ( (coeff_position & 3) == 0) {
-        /* fetching the first coefficient -- get new 16-byte aes counter output */
-        u32 counter = (coeff_position >> 2);
-
-        /* new counter value */
-        memset(&aes_counter[0], 0, sizeof(aes_counter));
-        aes_counter[15] = (UINT8)(counter >> 0);
-        aes_counter[14] = (UINT8)(counter >> 8);
-        aes_counter[13] = (UINT8)(counter >> 16);
-        aes_counter[12] = (UINT8)(counter >> 24);
-
-        RTMPAesEncrypt(&pContext->CK[0], &aes_counter[0], pContext->coefficient);
-    }
-    p = &(pContext->coefficient[ (coeff_position & 3) << 2 ]);
-    return GETBIG32(p);
-}
-
-/****************************************/
-/* aes128k128d()                        */
-/* Performs a 128 bit AES encrypt with  */
-/* 128 bit data.                        */
-/****************************************/
-VOID xor_128(
-    IN  PUCHAR  a,
-    IN  PUCHAR  b,
-    OUT PUCHAR  out)
-{
-    INT i;
-
-    for (i=0;i<16; i++)
-    {
-        out[i] = a[i] ^ b[i];
-    }
-}
-
-UCHAR RTMPCkipSbox(
-    IN  UCHAR   a)
-{
-    return SboxTable[(int)a];
-}
-
-VOID xor_32(
-    IN  PUCHAR  a,
-    IN  PUCHAR  b,
-    OUT PUCHAR  out)
-{
-    INT i;
-
-    for (i=0;i<4; i++)
-    {
-        out[i] = a[i] ^ b[i];
-    }
-}
-
-VOID next_key(
-    IN  PUCHAR  key,
-    IN  INT     round)
-{
-    UCHAR       rcon;
-    UCHAR       sbox_key[4];
-    UCHAR       rcon_table[12] =
-    {
-        0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80,
-        0x1b, 0x36, 0x36, 0x36
-    };
-
-    sbox_key[0] = RTMPCkipSbox(key[13]);
-    sbox_key[1] = RTMPCkipSbox(key[14]);
-    sbox_key[2] = RTMPCkipSbox(key[15]);
-    sbox_key[3] = RTMPCkipSbox(key[12]);
-
-    rcon = rcon_table[round];
-
-    xor_32(&key[0], sbox_key, &key[0]);
-    key[0] = key[0] ^ rcon;
-
-    xor_32(&key[4], &key[0], &key[4]);
-    xor_32(&key[8], &key[4], &key[8]);
-    xor_32(&key[12], &key[8], &key[12]);
-}
-
-VOID byte_sub(
-    IN  PUCHAR  in,
-    OUT PUCHAR  out)
-{
-    INT i;
-
-    for (i=0; i< 16; i++)
-    {
-        out[i] = RTMPCkipSbox(in[i]);
-    }
-}
-
-VOID shift_row(
-    IN  PUCHAR  in,
-    OUT PUCHAR  out)
-{
-    out[0] =  in[0];
-    out[1] =  in[5];
-    out[2] =  in[10];
-    out[3] =  in[15];
-    out[4] =  in[4];
-    out[5] =  in[9];
-    out[6] =  in[14];
-    out[7] =  in[3];
-    out[8] =  in[8];
-    out[9] =  in[13];
-    out[10] = in[2];
-    out[11] = in[7];
-    out[12] = in[12];
-    out[13] = in[1];
-    out[14] = in[6];
-    out[15] = in[11];
-}
-
-VOID mix_column(
-    IN  PUCHAR  in,
-    OUT PUCHAR  out)
-{
-    INT         i;
-    UCHAR       add1b[4];
-    UCHAR       add1bf7[4];
-    UCHAR       rotl[4];
-    UCHAR       swap_halfs[4];
-    UCHAR       andf7[4];
-    UCHAR       rotr[4];
-    UCHAR       temp[4];
-    UCHAR       tempb[4];
-
-    for (i=0 ; i<4; i++)
-    {
-        if ((in[i] & 0x80)== 0x80)
-            add1b[i] = 0x1b;
-        else
-            add1b[i] = 0x00;
-    }
-
-    swap_halfs[0] = in[2];    /* Swap halfs */
-    swap_halfs[1] = in[3];
-    swap_halfs[2] = in[0];
-    swap_halfs[3] = in[1];
-
-    rotl[0] = in[3];        /* Rotate left 8 bits */
-    rotl[1] = in[0];
-    rotl[2] = in[1];
-    rotl[3] = in[2];
-
-    andf7[0] = in[0] & 0x7f;
-    andf7[1] = in[1] & 0x7f;
-    andf7[2] = in[2] & 0x7f;
-    andf7[3] = in[3] & 0x7f;
-
-    for (i = 3; i>0; i--)    /* logical shift left 1 bit */
-    {
-        andf7[i] = andf7[i] << 1;
-        if ((andf7[i-1] & 0x80) == 0x80)
-        {
-            andf7[i] = (andf7[i] | 0x01);
-        }
-    }
-    andf7[0] = andf7[0] << 1;
-    andf7[0] = andf7[0] & 0xfe;
-
-    xor_32(add1b, andf7, add1bf7);
-
-    xor_32(in, add1bf7, rotr);
-
-    temp[0] = rotr[0];         /* Rotate right 8 bits */
-    rotr[0] = rotr[1];
-    rotr[1] = rotr[2];
-    rotr[2] = rotr[3];
-    rotr[3] = temp[0];
-
-    xor_32(add1bf7, rotr, temp);
-    xor_32(swap_halfs, rotl,tempb);
-    xor_32(temp, tempb, out);
-}
-
-VOID RTMPAesEncrypt(
-    IN  PUCHAR  key,
-    IN  PUCHAR  data,
-    IN  PUCHAR  ciphertext)
-{
-    INT             round;
-    INT             i;
-    UCHAR           intermediatea[16];
-    UCHAR           intermediateb[16];
-    UCHAR           round_key[16];
-
-    for(i=0; i<16; i++) round_key[i] = key[i];
-
-    for (round = 0; round < 11; round++)
-    {
-        if (round == 0)
-        {
-            xor_128(round_key, data, ciphertext);
-            next_key(round_key, round);
-        }
-        else if (round == 10)
-        {
-            byte_sub(ciphertext, intermediatea);
-            shift_row(intermediatea, intermediateb);
-            xor_128(intermediateb, round_key, ciphertext);
-        }
-        else    /* 1 - 9 */
-        {
-            byte_sub(ciphertext, intermediatea);
-            shift_row(intermediatea, intermediateb);
-            mix_column(&intermediateb[0], &intermediatea[0]);
-            mix_column(&intermediateb[4], &intermediatea[4]);
-            mix_column(&intermediateb[8], &intermediatea[8]);
-            mix_column(&intermediateb[12], &intermediatea[12]);
-            xor_128(intermediatea, round_key, ciphertext);
-            next_key(round_key, round);
-        }
-    }
-
-}
-
-/* calculate the mic */
-VOID RTMPMicFinal(
-    IN  PMIC_CONTEXT    pContext,
-    OUT UCHAR           digest[4])
-{
-    INT             byte_position;
-    ULONG           val;
-    ULONGLONG       sum, utmp;
-    LONGLONG        stmp;
-
-    /* deal with partial 32-bit word left over from last update */
-    if ( (byte_position = (pContext->position & 3)) != 0) {
-        /* have a partial word in part to deal with -- zero unused bytes */
-        do {
-            pContext->part[byte_position++] = 0;
-            pContext->position++;
-        } while (byte_position < 4);
-        val = GETBIG32(&pContext->part[0]);
-        MIC_ACCUM(val);
-    }
-
-    /* reduce the accumulated u64 to a 32-bit MIC */
-    sum = pContext->accum;
-    stmp = (sum  & 0xffffffffL) - ((sum >> 32)  * 15);
-    utmp = (stmp & 0xffffffffL) - ((stmp >> 32) * 15);
-    sum = utmp & 0xffffffffL;
-    if (utmp > 0x10000000fL)
-        sum -= 15;
-
-    val = (ULONG)sum;
-    digest[0] = (UCHAR)((val>>24) & 0xFF);
-    digest[1] = (UCHAR) ((val>>16) & 0xFF);
-    digest[2] = (UCHAR) ((val>>8) & 0xFF);
-    digest[3] = (UCHAR)((val>>0) & 0xFF);
-}
-
-VOID RTMPCkipInsertCMIC(
-    IN  PRTMP_ADAPTER   pAd,
-    OUT PUCHAR          pMIC,
-    IN  PUCHAR          p80211hdr,
-    IN  PNDIS_PACKET    pPacket,
-    IN  PCIPHER_KEY     pKey,
-    IN  PUCHAR          mic_snap)
-{
-	PACKET_INFO		PacketInfo;
-	PUCHAR			pSrcBufVA;
-	ULONG			SrcBufLen;
-    PUCHAR          pDA, pSA, pProto;
-    UCHAR           bigethlen[2];
-	UCHAR			ckip_ck[16];
-    MIC_CONTEXT     mic_ctx;
-    USHORT          payloadlen;
-	UCHAR			i;
-
-	if (pKey == NULL)
-	{
-		DBGPRINT_ERR(("RTMPCkipInsertCMIC, Before to form the CKIP key (CK), pKey can't be NULL\n"));
-		return;
-	}
-
-    switch (*(p80211hdr+1) & 3)
-    {
-        case 0: /* FromDs=0, ToDs=0 */
-            pDA = p80211hdr+4;
-            pSA = p80211hdr+10;
-            break;
-        case 1: /* FromDs=0, ToDs=1 */
-            pDA = p80211hdr+16;
-            pSA = p80211hdr+10;
-            break;
-        case 2: /* FromDs=1, ToDs=0 */
-            pDA = p80211hdr+4;
-            pSA = p80211hdr+16;
-            break;
-        case 3: /* FromDs=1, ToDs=1 */
-            pDA = p80211hdr+16;
-            pSA = p80211hdr+24;
-            break;
-    }
-
-	RTMP_QueryPacketInfo(pPacket, &PacketInfo, &pSrcBufVA, &SrcBufLen);
-
-    if (SrcBufLen < LENGTH_802_3)
-        return;
-
-    pProto = pSrcBufVA + 12;
-    payloadlen = PacketInfo.TotalPacketLength - LENGTH_802_3 + 18; // CKIP_LLC(8)+CMIC(4)+TxSEQ(4)+PROTO(2)=18
-
-    bigethlen[0] = (unsigned char)(payloadlen >> 8);
-    bigethlen[1] = (unsigned char)payloadlen;
-
-	//
-	// Encryption Key expansion to form the CKIP Key (CKIP_CK).
-	//
-	if (pKey->KeyLen < 16)
-	{
-		for(i = 0; i < (16 / pKey->KeyLen); i++)
-		{
-			NdisMoveMemory(ckip_ck + i * pKey->KeyLen,
-							pKey->Key,
-							pKey->KeyLen);
-		}
-		NdisMoveMemory(ckip_ck + i * pKey->KeyLen,
-						pKey->Key,
-						16 - (i * pKey->KeyLen));
-	}
-	else
-	{
-		NdisMoveMemory(ckip_ck, pKey->Key, pKey->KeyLen);
-	}
-    RTMPCkipMicInit(&mic_ctx, ckip_ck);
-    RTMPMicUpdate(&mic_ctx, pDA, MAC_ADDR_LEN);            // MIC <-- DA
-    RTMPMicUpdate(&mic_ctx, pSA, MAC_ADDR_LEN);            // MIC <-- SA
-    RTMPMicUpdate(&mic_ctx, bigethlen, 2);                 // MIC <-- payload length starting from CKIP SNAP
-    RTMPMicUpdate(&mic_ctx, mic_snap, 8);                  // MIC <-- snap header
-    RTMPMicUpdate(&mic_ctx, pAd->StaCfg.TxSEQ, 4);   // MIC <-- TxSEQ
-    RTMPMicUpdate(&mic_ctx, pProto, 2);                    // MIC <-- Protocol
-
-    pSrcBufVA += LENGTH_802_3;
-    SrcBufLen -= LENGTH_802_3;
-
-    // Mic <-- original payload. loop until all payload processed
-    do
-    {
-        if (SrcBufLen > 0)
-            RTMPMicUpdate(&mic_ctx, pSrcBufVA, SrcBufLen);
-
-		NdisGetNextBuffer(PacketInfo.pFirstBuffer, &PacketInfo.pFirstBuffer);
-        if (PacketInfo.pFirstBuffer)
-        {
-            NDIS_QUERY_BUFFER(PacketInfo.pFirstBuffer, &pSrcBufVA, &SrcBufLen);
-        }
-        else
-            break;
-    } while (TRUE);
-
-    RTMPMicFinal(&mic_ctx, pMIC);                          // update MIC
-}
diff --git a/drivers/staging/rt3090/sta/rtmp_data.c b/drivers/staging/rt3090/sta/rtmp_data.c
deleted file mode 100644
index 559136409ff2..000000000000
--- a/drivers/staging/rt3090/sta/rtmp_data.c
+++ /dev/null
@@ -1,2661 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-	Module Name:
-	rtmp_data.c
-
-	Abstract:
-	Data path subroutines
-
-	Revision History:
-	Who		When			What
-	--------	----------		----------------------------------------------
-*/
-
-#include "../rt_config.h"
-
-
-VOID STARxEAPOLFrameIndicate(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	MAC_TABLE_ENTRY	*pEntry,
-	IN	RX_BLK			*pRxBlk,
-	IN	UCHAR			FromWhichBSSID)
-{
-	PRT28XX_RXD_STRUC	pRxD = &(pRxBlk->RxD);
-	PRXWI_STRUC		pRxWI = pRxBlk->pRxWI;
-	UCHAR			*pTmpBuf;
-
-
-#ifdef WPA_SUPPLICANT_SUPPORT
-	if (pAd->StaCfg.WpaSupplicantUP)
-	{
-		// All EAPoL frames have to pass to upper layer (ex. WPA_SUPPLICANT daemon)
-		// TBD : process fragmented EAPol frames
-		{
-			// In 802.1x mode, if the received frame is EAP-SUCCESS packet, turn on the PortSecured variable
-			if ( pAd->StaCfg.IEEE8021X == TRUE &&
-				 (EAP_CODE_SUCCESS == WpaCheckEapCode(pAd, pRxBlk->pData, pRxBlk->DataSize, LENGTH_802_1_H)))
-			{
-				PUCHAR	Key;
-				UCHAR	CipherAlg;
-				int     idx = 0;
-
-				DBGPRINT_RAW(RT_DEBUG_TRACE, ("Receive EAP-SUCCESS Packet\n"));
-				//pAd->StaCfg.PortSecured = WPA_802_1X_PORT_SECURED;
-				STA_PORT_SECURED(pAd);
-
-                if (pAd->StaCfg.IEEE8021x_required_keys == FALSE)
-                {
-                    idx = pAd->StaCfg.DesireSharedKeyId;
-                    CipherAlg = pAd->StaCfg.DesireSharedKey[idx].CipherAlg;
-					Key = pAd->StaCfg.DesireSharedKey[idx].Key;
-
-                    if (pAd->StaCfg.DesireSharedKey[idx].KeyLen > 0)
-				{
-#ifdef RTMP_MAC_PCI
-						MAC_TABLE_ENTRY *pEntry = &pAd->MacTab.Content[BSSID_WCID];
-
-						// Set key material and cipherAlg to Asic
-						AsicAddSharedKeyEntry(pAd, BSS0, idx, CipherAlg, Key, NULL, NULL);
-
-						// Assign group key info
-						RTMPAddWcidAttributeEntry(pAd, BSS0, idx, CipherAlg, NULL);
-
-						// Assign pairwise key info
-						RTMPAddWcidAttributeEntry(pAd, BSS0, idx, CipherAlg, pEntry);
-
-                        pAd->IndicateMediaState = NdisMediaStateConnected;
-                        pAd->ExtraInfo = GENERAL_LINK_UP;
-#endif // RTMP_MAC_PCI //
-						// For Preventing ShardKey Table is cleared by remove key procedure.
-					pAd->SharedKey[BSS0][idx].CipherAlg = CipherAlg;
-						pAd->SharedKey[BSS0][idx].KeyLen = pAd->StaCfg.DesireSharedKey[idx].KeyLen;
-						NdisMoveMemory(pAd->SharedKey[BSS0][idx].Key,
-									   pAd->StaCfg.DesireSharedKey[idx].Key,
-									   pAd->StaCfg.DesireSharedKey[idx].KeyLen);
-				}
-				}
-			}
-
-			Indicate_Legacy_Packet(pAd, pRxBlk, FromWhichBSSID);
-			return;
-		}
-	}
-	else
-#endif // WPA_SUPPLICANT_SUPPORT //
-	{
-		// Special DATA frame that has to pass to MLME
-		//	 1. Cisco Aironet frames for CCX2. We need pass it to MLME for special process
-		//	 2. EAPOL handshaking frames when driver supplicant enabled, pass to MLME for special process
-		{
-			pTmpBuf = pRxBlk->pData - LENGTH_802_11;
-			NdisMoveMemory(pTmpBuf, pRxBlk->pHeader, LENGTH_802_11);
-			REPORT_MGMT_FRAME_TO_MLME(pAd, pRxWI->WirelessCliID, pTmpBuf, pRxBlk->DataSize + LENGTH_802_11, pRxWI->RSSI0, pRxWI->RSSI1, pRxWI->RSSI2, pRxD->PlcpSignal);
-			DBGPRINT_RAW(RT_DEBUG_TRACE, ("!!! report EAPOL/AIRONET DATA to MLME (len=%d) !!!\n", pRxBlk->DataSize));
-		}
-	}
-
-	RELEASE_NDIS_PACKET(pAd, pRxBlk->pRxPacket, NDIS_STATUS_FAILURE);
-	return;
-
-}
-
-VOID STARxDataFrameAnnounce(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	MAC_TABLE_ENTRY	*pEntry,
-	IN	RX_BLK			*pRxBlk,
-	IN	UCHAR			FromWhichBSSID)
-{
-
-	// non-EAP frame
-	if (!RTMPCheckWPAframe(pAd, pEntry, pRxBlk->pData, pRxBlk->DataSize, FromWhichBSSID))
-	{
-
-		{
-			// drop all non-EAP DATA frame before
-			// this client's Port-Access-Control is secured
-			if (pRxBlk->pHeader->FC.Wep)
-			{
-				// unsupported cipher suite
-				if (pAd->StaCfg.WepStatus == Ndis802_11EncryptionDisabled)
-				{
-					// release packet
-					RELEASE_NDIS_PACKET(pAd, pRxBlk->pRxPacket, NDIS_STATUS_FAILURE);
-					return;
-				}
-			}
-			else
-			{
-				// encryption in-use but receive a non-EAPOL clear text frame, drop it
-				if ((pAd->StaCfg.WepStatus != Ndis802_11EncryptionDisabled) &&
-					(pAd->StaCfg.PortSecured == WPA_802_1X_PORT_NOT_SECURED))
-				{
-					// release packet
-					RELEASE_NDIS_PACKET(pAd, pRxBlk->pRxPacket, NDIS_STATUS_FAILURE);
-					return;
-				}
-			}
-		}
-		RX_BLK_CLEAR_FLAG(pRxBlk, fRX_EAP);
-
-
-		if (!RX_BLK_TEST_FLAG(pRxBlk, fRX_ARALINK))
-		{
-			// Normal legacy, AMPDU or AMSDU
-			CmmRxnonRalinkFrameIndicate(pAd, pRxBlk, FromWhichBSSID);
-
-		}
-		else
-		{
-			// ARALINK
-			CmmRxRalinkFrameIndicate(pAd, pEntry, pRxBlk, FromWhichBSSID);
-		}
-#ifdef QOS_DLS_SUPPORT
-		RX_BLK_CLEAR_FLAG(pRxBlk, fRX_DLS);
-#endif // QOS_DLS_SUPPORT //
-	}
-	else
-	{
-		RX_BLK_SET_FLAG(pRxBlk, fRX_EAP);
-#ifdef DOT11_N_SUPPORT
-		if (RX_BLK_TEST_FLAG(pRxBlk, fRX_AMPDU) && (pAd->CommonCfg.bDisableReordering == 0))
-		{
-			Indicate_AMPDU_Packet(pAd, pRxBlk, FromWhichBSSID);
-		}
-		else
-#endif // DOT11_N_SUPPORT //
-		{
-			// Determin the destination of the EAP frame
-			//  to WPA state machine or upper layer
-			STARxEAPOLFrameIndicate(pAd, pEntry, pRxBlk, FromWhichBSSID);
-		}
-	}
-}
-
-
-// For TKIP frame, calculate the MIC value
-BOOLEAN STACheckTkipMICValue(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	MAC_TABLE_ENTRY	*pEntry,
-	IN	RX_BLK			*pRxBlk)
-{
-	PHEADER_802_11	pHeader = pRxBlk->pHeader;
-	UCHAR			*pData = pRxBlk->pData;
-	USHORT			DataSize = pRxBlk->DataSize;
-	UCHAR			UserPriority = pRxBlk->UserPriority;
-	PCIPHER_KEY		pWpaKey;
-	UCHAR			*pDA, *pSA;
-
-	pWpaKey = &pAd->SharedKey[BSS0][pRxBlk->pRxWI->KeyIndex];
-
-	pDA = pHeader->Addr1;
-	if (RX_BLK_TEST_FLAG(pRxBlk, fRX_INFRA))
-	{
-		pSA = pHeader->Addr3;
-	}
-	else
-	{
-		pSA = pHeader->Addr2;
-	}
-
-	if (RTMPTkipCompareMICValue(pAd,
-								pData,
-								pDA,
-								pSA,
-								pWpaKey->RxMic,
-								UserPriority,
-								DataSize) == FALSE)
-	{
-		DBGPRINT_RAW(RT_DEBUG_ERROR,("Rx MIC Value error 2\n"));
-
-#ifdef WPA_SUPPLICANT_SUPPORT
-		if (pAd->StaCfg.WpaSupplicantUP)
-		{
-			WpaSendMicFailureToWpaSupplicant(pAd, (pWpaKey->Type == PAIRWISEKEY) ? TRUE : FALSE);
-		}
-		else
-#endif // WPA_SUPPLICANT_SUPPORT //
-		{
-			RTMPReportMicError(pAd, pWpaKey);
-		}
-
-		// release packet
-		RELEASE_NDIS_PACKET(pAd, pRxBlk->pRxPacket, NDIS_STATUS_FAILURE);
-		return FALSE;
-	}
-
-	return TRUE;
-}
-
-
-//
-// All Rx routines use RX_BLK structure to hande rx events
-// It is very important to build pRxBlk attributes
-//  1. pHeader pointer to 802.11 Header
-//  2. pData pointer to payload including LLC (just skip Header)
-//  3. set payload size including LLC to DataSize
-//  4. set some flags with RX_BLK_SET_FLAG()
-//
-VOID STAHandleRxDataFrame(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	RX_BLK			*pRxBlk)
-{
-	PRT28XX_RXD_STRUC				pRxD = &(pRxBlk->RxD);
-	PRXWI_STRUC						pRxWI = pRxBlk->pRxWI;
-	PHEADER_802_11					pHeader = pRxBlk->pHeader;
-	PNDIS_PACKET					pRxPacket = pRxBlk->pRxPacket;
-	BOOLEAN							bFragment = FALSE;
-	MAC_TABLE_ENTRY				*pEntry = NULL;
-	UCHAR							FromWhichBSSID = BSS0;
-	UCHAR                           UserPriority = 0;
-
-	{
-		// before LINK UP, all DATA frames are rejected
-		if (!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED))
-		{
-			// release packet
-			RELEASE_NDIS_PACKET(pAd, pRxPacket, NDIS_STATUS_FAILURE);
-			return;
-		}
-
-#ifdef QOS_DLS_SUPPORT
-		//if ((pHeader->FC.FrDs == 0) && (pHeader->FC.ToDs == 0))
-		if (RTMPRcvFrameDLSCheck(pAd, pHeader, pRxWI->MPDUtotalByteCount, pRxD))
-		{
-			return;
-		}
-#endif // QOS_DLS_SUPPORT //
-
-		// Drop not my BSS frames
-		if (pRxD->MyBss == 0)
-		{
-			{
-				// release packet
-				RELEASE_NDIS_PACKET(pAd, pRxPacket, NDIS_STATUS_FAILURE);
-				return;
-			}
-		}
-
-		pAd->RalinkCounters.RxCountSinceLastNULL++;
-		if (pAd->CommonCfg.bAPSDCapable && pAd->CommonCfg.APEdcaParm.bAPSDCapable && (pHeader->FC.SubType & 0x08))
-		{
-			UCHAR *pData;
-			DBGPRINT(RT_DEBUG_INFO,("bAPSDCapable\n"));
-
-			// Qos bit 4
-			pData = (PUCHAR)pHeader + LENGTH_802_11;
-			if ((*pData >> 4) & 0x01)
-			{
-				DBGPRINT(RT_DEBUG_INFO,("RxDone- Rcv EOSP frame, driver may fall into sleep\n"));
-				pAd->CommonCfg.bInServicePeriod = FALSE;
-
-				// Force driver to fall into sleep mode when rcv EOSP frame
-				if (!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE))
-				{
-					USHORT  TbttNumToNextWakeUp;
-					USHORT  NextDtim = pAd->StaCfg.DtimPeriod;
-					ULONG   Now;
-
-					NdisGetSystemUpTime(&Now);
-					NextDtim -= (USHORT)(Now - pAd->StaCfg.LastBeaconRxTime)/pAd->CommonCfg.BeaconPeriod;
-
-					TbttNumToNextWakeUp = pAd->StaCfg.DefaultListenCount;
-					if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_RECEIVE_DTIM) && (TbttNumToNextWakeUp > NextDtim))
-						TbttNumToNextWakeUp = NextDtim;
-
-					RTMP_SET_PSM_BIT(pAd, PWR_SAVE);
-					// if WMM-APSD is failed, try to disable following line
-					AsicSleepThenAutoWakeup(pAd, TbttNumToNextWakeUp);
-				}
-			}
-
-			if ((pHeader->FC.MoreData) && (pAd->CommonCfg.bInServicePeriod))
-			{
-				DBGPRINT(RT_DEBUG_TRACE,("Sending another trigger frame when More Data bit is set to 1\n"));
-			}
-		}
-
-		// Drop NULL, CF-ACK(no data), CF-POLL(no data), and CF-ACK+CF-POLL(no data) data frame
-		if ((pHeader->FC.SubType & 0x04)) // bit 2 : no DATA
-		{
-			// release packet
-			RELEASE_NDIS_PACKET(pAd, pRxPacket, NDIS_STATUS_FAILURE);
-			return;
-		}
-
-	    // Drop not my BSS frame (we can not only check the MyBss bit in RxD)
-#ifdef QOS_DLS_SUPPORT
-	    if (!pAd->CommonCfg.bDLSCapable)
-	    {
-#endif // QOS_DLS_SUPPORT //
-		if (INFRA_ON(pAd))
-		{
-			// Infrastructure mode, check address 2 for BSSID
-			if (!RTMPEqualMemory(&pHeader->Addr2, &pAd->CommonCfg.Bssid, 6))
-			{
-				// Receive frame not my BSSID
-	            // release packet
-	            RELEASE_NDIS_PACKET(pAd, pRxPacket, NDIS_STATUS_FAILURE);
-				return;
-			}
-		}
-		else	// Ad-Hoc mode or Not associated
-		{
-			// Ad-Hoc mode, check address 3 for BSSID
-			if (!RTMPEqualMemory(&pHeader->Addr3, &pAd->CommonCfg.Bssid, 6))
-			{
-				// Receive frame not my BSSID
-	            // release packet
-	            RELEASE_NDIS_PACKET(pAd, pRxPacket, NDIS_STATUS_FAILURE);
-				return;
-			}
-		}
-#ifdef QOS_DLS_SUPPORT
-	    }
-#endif // QOS_DLS_SUPPORT //
-
-		//
-		// find pEntry
-		//
-		if (pRxWI->WirelessCliID < MAX_LEN_OF_MAC_TABLE)
-		{
-			pEntry = &pAd->MacTab.Content[pRxWI->WirelessCliID];
-
-		}
-		else
-		{
-			// 1. release packet if infra mode
-			// 2. new a pEntry if ad-hoc mode
-			RELEASE_NDIS_PACKET(pAd, pRxPacket, NDIS_STATUS_FAILURE);
-			return;
-		}
-
-		// infra or ad-hoc
-		if (INFRA_ON(pAd))
-		{
-			RX_BLK_SET_FLAG(pRxBlk, fRX_INFRA);
-#ifdef QOS_DLS_SUPPORT
-			if ((pHeader->FC.FrDs == 0) && (pHeader->FC.ToDs == 0))
-				RX_BLK_SET_FLAG(pRxBlk, fRX_DLS);
-			else
-#endif // QOS_DLS_SUPPORT //
-			ASSERT(pRxWI->WirelessCliID == BSSID_WCID);
-		}
-
-		// check Atheros Client
-		if ((pEntry->bIAmBadAtheros == FALSE) &&  (pRxD->AMPDU == 1) && (pHeader->FC.Retry ))
-		{
-			pEntry->bIAmBadAtheros = TRUE;
-			pAd->CommonCfg.IOTestParm.bCurrentAtheros = TRUE;
-			pAd->CommonCfg.IOTestParm.bLastAtheros = TRUE;
-			if (!STA_AES_ON(pAd))
-			{
-				AsicUpdateProtect(pAd, 8, ALLN_SETPROTECT, TRUE, FALSE);
-			}
-		}
-	}
-
-	pRxBlk->pData = (UCHAR *)pHeader;
-
-	//
-	// update RxBlk->pData, DataSize
-	// 802.11 Header, QOS, HTC, Hw Padding
-	//
-
-	// 1. skip 802.11 HEADER
-	{
-		pRxBlk->pData += LENGTH_802_11;
-		pRxBlk->DataSize -= LENGTH_802_11;
-	}
-
-	// 2. QOS
-	if (pHeader->FC.SubType & 0x08)
-	{
-		RX_BLK_SET_FLAG(pRxBlk, fRX_QOS);
-		UserPriority = *(pRxBlk->pData) & 0x0f;
-		// bit 7 in QoS Control field signals the HT A-MSDU format
-		if ((*pRxBlk->pData) & 0x80)
-		{
-			RX_BLK_SET_FLAG(pRxBlk, fRX_AMSDU);
-		}
-
-		// skip QOS contorl field
-		pRxBlk->pData += 2;
-		pRxBlk->DataSize -=2;
-	}
-	pRxBlk->UserPriority = UserPriority;
-
-	/* check if need to resend PS Poll when received packet with MoreData = 1 */
-	if ((pAd->StaCfg.Psm == PWR_SAVE) && (pHeader->FC.MoreData == 1))
-	{
-		if ((((UserPriority == 0) || (UserPriority == 3)) &&
-			pAd->CommonCfg.bAPSDAC_BE == 0) ||
-			(((UserPriority == 1) || (UserPriority == 2)) &&
-			pAd->CommonCfg.bAPSDAC_BK == 0) ||
-			(((UserPriority == 4) || (UserPriority == 5)) &&
-			pAd->CommonCfg.bAPSDAC_VI == 0) ||
-			(((UserPriority == 6) || (UserPriority == 7)) &&
-			pAd->CommonCfg.bAPSDAC_VO == 0))
-		{
-			/* non-UAPSD delivery-enabled AC */
-			RTMP_PS_POLL_ENQUEUE(pAd);
-		}
-	}
-
-	// 3. Order bit: A-Ralink or HTC+
-	if (pHeader->FC.Order)
-	{
-#ifdef AGGREGATION_SUPPORT
-		if ((pRxWI->PHYMODE <= MODE_OFDM) && (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_AGGREGATION_INUSED)))
-		{
-			RX_BLK_SET_FLAG(pRxBlk, fRX_ARALINK);
-		}
-		else
-#endif // AGGREGATION_SUPPORT //
-		{
-#ifdef DOT11_N_SUPPORT
-			RX_BLK_SET_FLAG(pRxBlk, fRX_HTC);
-			// skip HTC contorl field
-			pRxBlk->pData += 4;
-			pRxBlk->DataSize -= 4;
-#endif // DOT11_N_SUPPORT //
-		}
-	}
-
-	// 4. skip HW padding
-	if (pRxD->L2PAD)
-	{
-		// just move pData pointer
-		// because DataSize excluding HW padding
-		RX_BLK_SET_FLAG(pRxBlk, fRX_PAD);
-		pRxBlk->pData += 2;
-	}
-
-#ifdef DOT11_N_SUPPORT
-	if (pRxD->BA)
-	{
-		RX_BLK_SET_FLAG(pRxBlk, fRX_AMPDU);
-	}
-#endif // DOT11_N_SUPPORT //
-
-
-	//
-	// Case I  Process Broadcast & Multicast data frame
-	//
-	if (pRxD->Bcast || pRxD->Mcast)
-	{
-		INC_COUNTER64(pAd->WlanCounters.MulticastReceivedFrameCount);
-
-		// Drop Mcast/Bcast frame with fragment bit on
-		if (pHeader->FC.MoreFrag)
-		{
-			// release packet
-			RELEASE_NDIS_PACKET(pAd, pRxPacket, NDIS_STATUS_FAILURE);
-			return;
-		}
-
-		// Filter out Bcast frame which AP relayed for us
-		if (pHeader->FC.FrDs && MAC_ADDR_EQUAL(pHeader->Addr3, pAd->CurrentAddress))
-		{
-			// release packet
-			RELEASE_NDIS_PACKET(pAd, pRxPacket, NDIS_STATUS_FAILURE);
-			return;
-		}
-
-		Indicate_Legacy_Packet(pAd, pRxBlk, FromWhichBSSID);
-		return;
-	}
-	else if (pRxD->U2M)
-	{
-		pAd->LastRxRate = (USHORT)((pRxWI->MCS) + (pRxWI->BW <<7) + (pRxWI->ShortGI <<8)+ (pRxWI->PHYMODE <<14)) ;
-
-
-#ifdef QOS_DLS_SUPPORT
-        if (RX_BLK_TEST_FLAG(pRxBlk, fRX_DLS))
-		{
-			MAC_TABLE_ENTRY *pDlsEntry = NULL;
-
-			pDlsEntry = DlsEntryTableLookupByWcid(pAd, pRxWI->WirelessCliID, pHeader->Addr2, TRUE);
-										                        if(pDlsEntry)
-			Update_Rssi_Sample(pAd, &pDlsEntry->RssiSample, pRxWI);
-		}
-		else
-#endif // QOS_DLS_SUPPORT //
-		if (ADHOC_ON(pAd))
-		{
-			pEntry = MacTableLookup(pAd, pHeader->Addr2);
-			if (pEntry)
-				Update_Rssi_Sample(pAd, &pEntry->RssiSample, pRxWI);
-		}
-
-
-		Update_Rssi_Sample(pAd, &pAd->StaCfg.RssiSample, pRxWI);
-
-		pAd->StaCfg.LastSNR0 = (UCHAR)(pRxWI->SNR0);
-		pAd->StaCfg.LastSNR1 = (UCHAR)(pRxWI->SNR1);
-
-		pAd->RalinkCounters.OneSecRxOkDataCnt++;
-
-
-	if (!((pHeader->Frag == 0) && (pHeader->FC.MoreFrag == 0)))
-	{
-		// re-assemble the fragmented packets
-		// return complete frame (pRxPacket) or NULL
-		bFragment = TRUE;
-		pRxPacket = RTMPDeFragmentDataFrame(pAd, pRxBlk);
-	}
-
-	if (pRxPacket)
-	{
-		pEntry = &pAd->MacTab.Content[pRxWI->WirelessCliID];
-
-		// process complete frame
-		if (bFragment && (pRxD->Decrypted) && (pEntry->WepStatus == Ndis802_11Encryption2Enabled))
-		{
-			// Minus MIC length
-			pRxBlk->DataSize -= 8;
-
-			// For TKIP frame, calculate the MIC value
-			if (STACheckTkipMICValue(pAd, pEntry, pRxBlk) == FALSE)
-			{
-				return;
-			}
-		}
-
-		STARxDataFrameAnnounce(pAd, pEntry, pRxBlk, FromWhichBSSID);
-			return;
-	}
-	else
-	{
-		// just return
-		// because RTMPDeFragmentDataFrame() will release rx packet,
-		// if packet is fragmented
-		return;
-	}
-	}
-
-	ASSERT(0);
-	// release packet
-	RELEASE_NDIS_PACKET(pAd, pRxPacket, NDIS_STATUS_FAILURE);
-}
-
-VOID STAHandleRxMgmtFrame(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	RX_BLK			*pRxBlk)
-{
-	PRT28XX_RXD_STRUC	pRxD = &(pRxBlk->RxD);
-	PRXWI_STRUC		pRxWI = pRxBlk->pRxWI;
-	PHEADER_802_11	pHeader = pRxBlk->pHeader;
-	PNDIS_PACKET	pRxPacket = pRxBlk->pRxPacket;
-
-	do
-	{
-
-
-		/* check if need to resend PS Poll when received packet with MoreData = 1 */
-		if ((pAd->StaCfg.Psm == PWR_SAVE) && (pHeader->FC.MoreData == 1))
-		{
-			/* for UAPSD, all management frames will be VO priority */
-			if (pAd->CommonCfg.bAPSDAC_VO == 0)
-			{
-				/* non-UAPSD delivery-enabled AC */
-				RTMP_PS_POLL_ENQUEUE(pAd);
-			}
-		}
-
-		/* TODO: if MoreData == 0, station can go to sleep */
-
-
-		// We should collect RSSI not only U2M data but also my beacon
-		if ((pHeader->FC.SubType == SUBTYPE_BEACON) && (MAC_ADDR_EQUAL(&pAd->CommonCfg.Bssid, &pHeader->Addr2))
-			&& (pAd->RxAnt.EvaluatePeriod == 0))
-		{
-			Update_Rssi_Sample(pAd, &pAd->StaCfg.RssiSample, pRxWI);
-
-			pAd->StaCfg.LastSNR0 = (UCHAR)(pRxWI->SNR0);
-			pAd->StaCfg.LastSNR1 = (UCHAR)(pRxWI->SNR1);
-		}
-
-#ifdef RT30xx
-#ifdef ANT_DIVERSITY_SUPPORT
-		// collect rssi information for antenna diversity
-		if ((pAd->NicConfig2.field.AntDiversity) &&
-			(pAd->CommonCfg.bRxAntDiversity != ANT_DIVERSITY_DISABLE))
-		{
-			if ((pRxD->U2M) || ((pHeader->FC.SubType == SUBTYPE_BEACON) && (MAC_ADDR_EQUAL(&pAd->CommonCfg.Bssid, &pHeader->Addr2))))
-			{
-					COLLECT_RX_ANTENNA_AVERAGE_RSSI(pAd, ConvertToRssi(pAd, (UCHAR)pRxWI->RSSI0, RSSI_0), 0); //Note: RSSI2 not used on RT73
-					pAd->StaCfg.NumOfAvgRssiSample ++;
-			}
-		}
-#endif // ANT_DIVERSITY_SUPPORT //
-#endif // RT30xx //
-
-		// First check the size, it MUST not exceed the mlme queue size
-		if (pRxWI->MPDUtotalByteCount > MGMT_DMA_BUFFER_SIZE)
-		{
-			DBGPRINT_ERR(("STAHandleRxMgmtFrame: frame too large, size = %d \n", pRxWI->MPDUtotalByteCount));
-			break;
-		}
-
-		REPORT_MGMT_FRAME_TO_MLME(pAd, pRxWI->WirelessCliID, pHeader, pRxWI->MPDUtotalByteCount,
-									pRxWI->RSSI0, pRxWI->RSSI1, pRxWI->RSSI2, pRxD->PlcpSignal);
-	} while (FALSE);
-
-	RELEASE_NDIS_PACKET(pAd, pRxPacket, NDIS_STATUS_SUCCESS);
-}
-
-VOID STAHandleRxControlFrame(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	RX_BLK			*pRxBlk)
-{
-#ifdef DOT11_N_SUPPORT
-	PRXWI_STRUC		pRxWI = pRxBlk->pRxWI;
-#endif // DOT11_N_SUPPORT //
-	PHEADER_802_11	pHeader = pRxBlk->pHeader;
-	PNDIS_PACKET	pRxPacket = pRxBlk->pRxPacket;
-
-	switch (pHeader->FC.SubType)
-	{
-		case SUBTYPE_BLOCK_ACK_REQ:
-#ifdef DOT11_N_SUPPORT
-			{
-				CntlEnqueueForRecv(pAd, pRxWI->WirelessCliID, (pRxWI->MPDUtotalByteCount), (PFRAME_BA_REQ)pHeader);
-			}
-			break;
-#endif // DOT11_N_SUPPORT //
-		case SUBTYPE_BLOCK_ACK:
-		case SUBTYPE_ACK:
-		default:
-			break;
-	}
-
-	RELEASE_NDIS_PACKET(pAd, pRxPacket, NDIS_STATUS_FAILURE);
-}
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		Process RxDone interrupt, running in DPC level
-
-	Arguments:
-		pAd Pointer to our adapter
-
-	Return Value:
-		None
-
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-		This routine has to maintain Rx ring read pointer.
-		Need to consider QOS DATA format when converting to 802.3
-	========================================================================
-*/
-BOOLEAN STARxDoneInterruptHandle(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	BOOLEAN			argc)
-{
-	NDIS_STATUS			Status;
-	UINT32			RxProcessed, RxPending;
-	BOOLEAN			bReschedule = FALSE;
-	RT28XX_RXD_STRUC	*pRxD;
-	UCHAR			*pData;
-	PRXWI_STRUC		pRxWI;
-	PNDIS_PACKET	pRxPacket;
-	PHEADER_802_11	pHeader;
-	RX_BLK			RxCell;
-
-	RxProcessed = RxPending = 0;
-
-	// process whole rx ring
-	while (1)
-	{
-
-		if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RADIO_OFF |
-								fRTMP_ADAPTER_RESET_IN_PROGRESS |
-								fRTMP_ADAPTER_HALT_IN_PROGRESS |
-								fRTMP_ADAPTER_NIC_NOT_EXIST) ||
-			!RTMP_TEST_FLAG(pAd,fRTMP_ADAPTER_START_UP))
-		{
-			break;
-		}
-
-#ifdef RTMP_MAC_PCI
-		if (RxProcessed++ > MAX_RX_PROCESS_CNT)
-		{
-			// need to reschedule rx handle
-			bReschedule = TRUE;
-			break;
-		}
-#endif // RTMP_MAC_PCI //
-
-		RxProcessed ++; // test
-
-		// 1. allocate a new data packet into rx ring to replace received packet
-		//    then processing the received packet
-		// 2. the callee must take charge of release of packet
-		// 3. As far as driver is concerned ,
-		//    the rx packet must
-		//      a. be indicated to upper layer or
-		//      b. be released if it is discarded
-		pRxPacket = GetPacketFromRxRing(pAd, &(RxCell.RxD), &bReschedule, &RxPending);
-		if (pRxPacket == NULL)
-		{
-			// no more packet to process
-			break;
-		}
-
-		// get rx ring descriptor
-		pRxD = &(RxCell.RxD);
-		// get rx data buffer
-		pData	= GET_OS_PKT_DATAPTR(pRxPacket);
-		pRxWI	= (PRXWI_STRUC) pData;
-		pHeader = (PHEADER_802_11) (pData+RXWI_SIZE) ;
-
-#ifdef RT_BIG_ENDIAN
-	    RTMPFrameEndianChange(pAd, (PUCHAR)pHeader, DIR_READ, TRUE);
-		RTMPWIEndianChange((PUCHAR)pRxWI, TYPE_RXWI);
-#endif
-
-		// build RxCell
-		RxCell.pRxWI = pRxWI;
-		RxCell.pHeader = pHeader;
-		RxCell.pRxPacket = pRxPacket;
-		RxCell.pData = (UCHAR *) pHeader;
-		RxCell.DataSize = pRxWI->MPDUtotalByteCount;
-		RxCell.Flags = 0;
-
-		// Increase Total receive byte counter after real data received no mater any error or not
-		pAd->RalinkCounters.ReceivedByteCount +=  pRxWI->MPDUtotalByteCount;
-		pAd->RalinkCounters.OneSecReceivedByteCount +=  pRxWI->MPDUtotalByteCount;
-		pAd->RalinkCounters.RxCount ++;
-
-		INC_COUNTER64(pAd->WlanCounters.ReceivedFragmentCount);
-
-		if (pRxWI->MPDUtotalByteCount < 14)
-			Status = NDIS_STATUS_FAILURE;
-
-        if (MONITOR_ON(pAd))
-		{
-            send_monitor_packets(pAd, &RxCell);
-			break;
-		}
-
-		/* STARxDoneInterruptHandle() is called in rtusb_bulk.c */
-#ifdef RALINK_ATE
-		if (ATE_ON(pAd))
-		{
-			pAd->ate.RxCntPerSec++;
-			ATESampleRssi(pAd, pRxWI);
-#ifdef RALINK_28xx_QA
-			if (pAd->ate.bQARxStart == TRUE)
-			{
-				/* (*pRxD) has been swapped in GetPacketFromRxRing() */
-				ATE_QA_Statistics(pAd, pRxWI, pRxD,	pHeader);
-			}
-#endif // RALINK_28xx_QA //
-			RELEASE_NDIS_PACKET(pAd, pRxPacket, NDIS_STATUS_SUCCESS);
-			continue;
-		}
-#endif // RALINK_ATE //
-
-		// Check for all RxD errors
-		Status = RTMPCheckRxError(pAd, pHeader, pRxWI, pRxD);
-
-		// Handle the received frame
-		if (Status == NDIS_STATUS_SUCCESS)
-		{
-			switch (pHeader->FC.Type)
-			{
-				// CASE I, receive a DATA frame
-				case BTYPE_DATA:
-				{
-					// process DATA frame
-					STAHandleRxDataFrame(pAd, &RxCell);
-				}
-				break;
-				// CASE II, receive a MGMT frame
-				case BTYPE_MGMT:
-				{
-					STAHandleRxMgmtFrame(pAd, &RxCell);
-				}
-				break;
-				// CASE III. receive a CNTL frame
-				case BTYPE_CNTL:
-				{
-					STAHandleRxControlFrame(pAd, &RxCell);
-				}
-				break;
-				// discard other type
-				default:
-					RELEASE_NDIS_PACKET(pAd, pRxPacket, NDIS_STATUS_FAILURE);
-					break;
-			}
-		}
-		else
-		{
-			pAd->Counters8023.RxErrors++;
-			// discard this frame
-			RELEASE_NDIS_PACKET(pAd, pRxPacket, NDIS_STATUS_FAILURE);
-		}
-	}
-
-	return bReschedule;
-}
-
-/*
-	========================================================================
-
-	Routine Description:
-	Arguments:
-		pAd	Pointer to our adapter
-
-	IRQL = DISPATCH_LEVEL
-
-	========================================================================
-*/
-VOID	RTMPHandleTwakeupInterrupt(
-	IN PRTMP_ADAPTER pAd)
-{
-	AsicForceWakeup(pAd, FALSE);
-}
-
-/*
-========================================================================
-Routine Description:
-    Early checking and OS-depened parsing for Tx packet send to our STA driver.
-
-Arguments:
-    NDIS_HANDLE		MiniportAdapterContext	Pointer refer to the device handle, i.e., the pAd.
-	PPNDIS_PACKET	ppPacketArray			The packet array need to do transmission.
-	UINT			NumberOfPackets			Number of packet in packet array.
-
-Return Value:
-	NONE
-
-Note:
-	This function do early checking and classification for send-out packet.
-	You only can put OS-depened & STA related code in here.
-========================================================================
-*/
-VOID STASendPackets(
-	IN	NDIS_HANDLE		MiniportAdapterContext,
-	IN	PPNDIS_PACKET	ppPacketArray,
-	IN	UINT			NumberOfPackets)
-{
-	UINT			Index;
-	PRTMP_ADAPTER	pAd = (PRTMP_ADAPTER) MiniportAdapterContext;
-	PNDIS_PACKET	pPacket;
-	BOOLEAN			allowToSend = FALSE;
-
-
-	for (Index = 0; Index < NumberOfPackets; Index++)
-	{
-		pPacket = ppPacketArray[Index];
-
-		do
-		{
-
-			if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RESET_IN_PROGRESS) ||
-				RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS) ||
-				RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RADIO_OFF))
-			{
-				// Drop send request since hardware is in reset state
-					break;
-			}
-			else if (!INFRA_ON(pAd) && !ADHOC_ON(pAd))
-			{
-				// Drop send request since there are no physical connection yet
-					break;
-			}
-			else
-			{
-				// Record that orignal packet source is from NDIS layer,so that
-				// later on driver knows how to release this NDIS PACKET
-#ifdef QOS_DLS_SUPPORT
-				MAC_TABLE_ENTRY *pEntry;
-				PUCHAR pSrcBufVA = GET_OS_PKT_DATAPTR(pPacket);
-
-				pEntry = MacTableLookup(pAd, pSrcBufVA);
-				if (pEntry && (pEntry->ValidAsDls == TRUE))
-				{
-					RTMP_SET_PACKET_WCID(pPacket, pEntry->Aid);
-				}
-				else
-#endif // QOS_DLS_SUPPORT //
-				RTMP_SET_PACKET_WCID(pPacket, 0); // this field is useless when in STA mode
-				RTMP_SET_PACKET_SOURCE(pPacket, PKTSRC_NDIS);
-				NDIS_SET_PACKET_STATUS(pPacket, NDIS_STATUS_PENDING);
-				pAd->RalinkCounters.PendingNdisPacketCount++;
-
-				allowToSend = TRUE;
-			}
-		} while(FALSE);
-
-		if (allowToSend == TRUE)
-			STASendPacket(pAd, pPacket);
-		else
-			RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_FAILURE);
-	}
-
-	// Dequeue outgoing frames from TxSwQueue[] and process it
-	RTMPDeQueuePacket(pAd, FALSE, NUM_OF_TX_RING, MAX_TX_PROCESS);
-
-}
-
-
-/*
-========================================================================
-Routine Description:
-	This routine is used to do packet parsing and classification for Tx packet
-	to STA device, and it will en-queue packets to our TxSwQueue depends on AC
-	class.
-
-Arguments:
-	pAd		Pointer to our adapter
-	pPacket		Pointer to send packet
-
-Return Value:
-	NDIS_STATUS_SUCCESS			If succes to queue the packet into TxSwQueue.
-	NDIS_STATUS_FAILURE			If failed to do en-queue.
-
-Note:
-	You only can put OS-indepened & STA related code in here.
-========================================================================
-*/
-NDIS_STATUS STASendPacket(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PNDIS_PACKET	pPacket)
-{
-	PACKET_INFO	PacketInfo;
-	PUCHAR			pSrcBufVA;
-	UINT			SrcBufLen;
-	UINT			AllowFragSize;
-	UCHAR			NumberOfFrag;
-	UCHAR			RTSRequired;
-	UCHAR			QueIdx, UserPriority;
-	MAC_TABLE_ENTRY *pEntry = NULL;
-	unsigned int	IrqFlags;
-	UCHAR			FlgIsIP = 0;
-	UCHAR			Rate;
-
-	// Prepare packet information structure for buffer descriptor
-	// chained within a single NDIS packet.
-	RTMP_QueryPacketInfo(pPacket, &PacketInfo, &pSrcBufVA, &SrcBufLen);
-
-	if (pSrcBufVA == NULL)
-	{
-		DBGPRINT(RT_DEBUG_ERROR,("STASendPacket --> pSrcBufVA == NULL !!!SrcBufLen=%x\n",SrcBufLen));
-		// Resourece is low, system did not allocate virtual address
-		// return NDIS_STATUS_FAILURE directly to upper layer
-		RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_FAILURE);
-		return NDIS_STATUS_FAILURE;
-	}
-
-
-	if (SrcBufLen < 14)
-	{
-		DBGPRINT(RT_DEBUG_ERROR,("STASendPacket --> Ndis Packet buffer error !!!\n"));
-		RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_FAILURE);
-		return (NDIS_STATUS_FAILURE);
-	}
-
-	// In HT rate adhoc mode, A-MPDU is often used. So need to lookup BA Table and MAC Entry.
-	// Note multicast packets in adhoc also use BSSID_WCID index.
-	{
-		if(INFRA_ON(pAd))
-		{
-#ifdef QOS_DLS_SUPPORT
-			USHORT	tmpWcid;
-
-			tmpWcid = RTMP_GET_PACKET_WCID(pPacket);
-			if (VALID_WCID(tmpWcid) &&
-				(pAd->MacTab.Content[tmpWcid].ValidAsDls== TRUE))
-			{
-				pEntry = &pAd->MacTab.Content[tmpWcid];
-				Rate = pAd->MacTab.Content[tmpWcid].CurrTxRate;
-			}
-			else
-#endif // QOS_DLS_SUPPORT //
-			{
-			pEntry = &pAd->MacTab.Content[BSSID_WCID];
-			RTMP_SET_PACKET_WCID(pPacket, BSSID_WCID);
-			Rate = pAd->CommonCfg.TxRate;
-		}
-		}
-		else if (ADHOC_ON(pAd))
-		{
-			if (*pSrcBufVA & 0x01)
-			{
-				RTMP_SET_PACKET_WCID(pPacket, MCAST_WCID);
-				pEntry = &pAd->MacTab.Content[MCAST_WCID];
-			}
-			else
-			{
-				pEntry = MacTableLookup(pAd, pSrcBufVA);
-			}
-			Rate = pAd->CommonCfg.TxRate;
-		}
-	}
-
-	if (!pEntry)
-	{
-		DBGPRINT(RT_DEBUG_ERROR,("STASendPacket->Cannot find pEntry(%2x:%2x:%2x:%2x:%2x:%2x) in MacTab!\n", PRINT_MAC(pSrcBufVA)));
-		// Resourece is low, system did not allocate virtual address
-		// return NDIS_STATUS_FAILURE directly to upper layer
-		RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_FAILURE);
-		return NDIS_STATUS_FAILURE;
-	}
-
-	if (ADHOC_ON(pAd)
-		)
-	{
-		RTMP_SET_PACKET_WCID(pPacket, (UCHAR)pEntry->Aid);
-	}
-
-	//
-	// Check the Ethernet Frame type of this packet, and set the RTMP_SET_PACKET_SPECIFIC flags.
-	//		Here we set the PACKET_SPECIFIC flags(LLC, VLAN, DHCP/ARP, EAPOL).
-	RTMPCheckEtherType(pAd, pPacket);
-
-
-
-	//
-	// WPA 802.1x secured port control - drop all non-802.1x frame before port secured
-	//
-	if (((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA) ||
-		 (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPAPSK) ||
-		 (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2) ||
-		 (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK)
-#ifdef WPA_SUPPLICANT_SUPPORT
-		  || (pAd->StaCfg.IEEE8021X == TRUE)
-#endif // WPA_SUPPLICANT_SUPPORT //
-		  )
-		  && ((pAd->StaCfg.PortSecured == WPA_802_1X_PORT_NOT_SECURED) || (pAd->StaCfg.MicErrCnt >= 2))
-		  && (RTMP_GET_PACKET_EAPOL(pPacket)== FALSE)
-		  )
-	{
-		DBGPRINT(RT_DEBUG_TRACE,("STASendPacket --> Drop packet before port secured !!!\n"));
-		RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_FAILURE);
-
-		return (NDIS_STATUS_FAILURE);
-	}
-
-
-	// STEP 1. Decide number of fragments required to deliver this MSDU.
-	//	   The estimation here is not very accurate because difficult to
-	//	   take encryption overhead into consideration here. The result
-	//	   "NumberOfFrag" is then just used to pre-check if enough free
-	//	   TXD are available to hold this MSDU.
-
-
-	if (*pSrcBufVA & 0x01)	// fragmentation not allowed on multicast & broadcast
-		NumberOfFrag = 1;
-	else if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_AGGREGATION_INUSED))
-		NumberOfFrag = 1;	// Aggregation overwhelms fragmentation
-	else if (CLIENT_STATUS_TEST_FLAG(pEntry, fCLIENT_STATUS_AMSDU_INUSED))
-		NumberOfFrag = 1;	// Aggregation overwhelms fragmentation
-#ifdef DOT11_N_SUPPORT
-	else if ((pAd->StaCfg.HTPhyMode.field.MODE == MODE_HTMIX) || (pAd->StaCfg.HTPhyMode.field.MODE == MODE_HTGREENFIELD))
-		NumberOfFrag = 1;	// MIMO RATE overwhelms fragmentation
-#endif // DOT11_N_SUPPORT //
-	else
-	{
-		// The calculated "NumberOfFrag" is a rough estimation because of various
-		// encryption/encapsulation overhead not taken into consideration. This number is just
-		// used to make sure enough free TXD are available before fragmentation takes place.
-		// In case the actual required number of fragments of an NDIS packet
-		// excceeds "NumberOfFrag"caculated here and not enough free TXD available, the
-		// last fragment (i.e. last MPDU) will be dropped in RTMPHardTransmit() due to out of
-		// resource, and the NDIS packet will be indicated NDIS_STATUS_FAILURE. This should
-		// rarely happen and the penalty is just like a TX RETRY fail. Affordable.
-
-		AllowFragSize = (pAd->CommonCfg.FragmentThreshold) - LENGTH_802_11 - LENGTH_CRC;
-		NumberOfFrag = ((PacketInfo.TotalPacketLength - LENGTH_802_3 + LENGTH_802_1_H) / AllowFragSize) + 1;
-		// To get accurate number of fragmentation, Minus 1 if the size just match to allowable fragment size
-		if (((PacketInfo.TotalPacketLength - LENGTH_802_3 + LENGTH_802_1_H) % AllowFragSize) == 0)
-		{
-			NumberOfFrag--;
-		}
-	}
-
-	// Save fragment number to Ndis packet reserved field
-	RTMP_SET_PACKET_FRAGMENTS(pPacket, NumberOfFrag);
-
-
-	// STEP 2. Check the requirement of RTS:
-	//	   If multiple fragment required, RTS is required only for the first fragment
-	//	   if the fragment size large than RTS threshold
-	//     For RT28xx, Let ASIC send RTS/CTS
-//	RTMP_SET_PACKET_RTS(pPacket, 0);
-	if (NumberOfFrag > 1)
-		RTSRequired = (pAd->CommonCfg.FragmentThreshold > pAd->CommonCfg.RtsThreshold) ? 1 : 0;
-	else
-		RTSRequired = (PacketInfo.TotalPacketLength > pAd->CommonCfg.RtsThreshold) ? 1 : 0;
-
-	// Save RTS requirement to Ndis packet reserved field
-	RTMP_SET_PACKET_RTS(pPacket, RTSRequired);
-	RTMP_SET_PACKET_TXRATE(pPacket, pAd->CommonCfg.TxRate);
-
-	//
-	// STEP 3. Traffic classification. outcome = <UserPriority, QueIdx>
-	//
-	UserPriority = 0;
-	QueIdx		 = QID_AC_BE;
-	if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_WMM_INUSED) &&
-		CLIENT_STATUS_TEST_FLAG(pEntry, fCLIENT_STATUS_WMM_CAPABLE))
-	{
-		USHORT Protocol;
-		UCHAR  LlcSnapLen = 0, Byte0, Byte1;
-		do
-		{
-			// get Ethernet protocol field
-			Protocol = (USHORT)((pSrcBufVA[12] << 8) + pSrcBufVA[13]);
-			if (Protocol <= 1500)
-			{
-				// get Ethernet protocol field from LLC/SNAP
-				if (Sniff2BytesFromNdisBuffer(PacketInfo.pFirstBuffer, LENGTH_802_3 + 6, &Byte0, &Byte1) != NDIS_STATUS_SUCCESS)
-					break;
-
-				Protocol = (USHORT)((Byte0 << 8) + Byte1);
-				LlcSnapLen = 8;
-			}
-
-			// always AC_BE for non-IP packet
-			if (Protocol != 0x0800)
-				break;
-
-			// get IP header
-			if (Sniff2BytesFromNdisBuffer(PacketInfo.pFirstBuffer, LENGTH_802_3 + LlcSnapLen, &Byte0, &Byte1) != NDIS_STATUS_SUCCESS)
-				break;
-
-			// return AC_BE if packet is not IPv4
-			if ((Byte0 & 0xf0) != 0x40)
-				break;
-
-			FlgIsIP = 1;
-			UserPriority = (Byte1 & 0xe0) >> 5;
-			QueIdx = MapUserPriorityToAccessCategory[UserPriority];
-
-			// TODO: have to check ACM bit. apply TSPEC if ACM is ON
-			// TODO: downgrade UP & QueIdx before passing ACM
-			/*
-				Under WMM ACM control, we dont need to check the bit;
-				Or when a TSPEC is built for VO but we will change to issue
-				BA session for BE here, so we will not use BA to send VO packets.
-			*/
-			if (pAd->CommonCfg.APEdcaParm.bACM[QueIdx])
-			{
-				UserPriority = 0;
-				QueIdx		 = QID_AC_BE;
-			}
-		} while (FALSE);
-	}
-
-	RTMP_SET_PACKET_UP(pPacket, UserPriority);
-
-
-
-	// Make sure SendTxWait queue resource won't be used by other threads
-	RTMP_IRQ_LOCK(&pAd->irq_lock, IrqFlags);
-	if (pAd->TxSwQueue[QueIdx].Number >= MAX_PACKETS_IN_QUEUE)
-	{
-		RTMP_IRQ_UNLOCK(&pAd->irq_lock, IrqFlags);
-#ifdef BLOCK_NET_IF
-		StopNetIfQueue(pAd, QueIdx, pPacket);
-#endif // BLOCK_NET_IF //
-		RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_FAILURE);
-
-		return NDIS_STATUS_FAILURE;
-	}
-	else
-	{
-		InsertTailQueueAc(pAd, pEntry, &pAd->TxSwQueue[QueIdx], PACKET_TO_QUEUE_ENTRY(pPacket));
-	}
-	RTMP_IRQ_UNLOCK(&pAd->irq_lock, IrqFlags);
-
-#ifdef DOT11_N_SUPPORT
-    if ((pAd->CommonCfg.BACapability.field.AutoBA == TRUE)&&
-        IS_HT_STA(pEntry))
-	{
-	    //PMAC_TABLE_ENTRY pMacEntry = &pAd->MacTab.Content[BSSID_WCID];
-		if (((pEntry->TXBAbitmap & (1<<UserPriority)) == 0) &&
-            ((pEntry->BADeclineBitmap & (1<<UserPriority)) == 0) &&
-            (pEntry->PortSecured == WPA_802_1X_PORT_SECURED)
-			 // For IOT compatibility, if
-			 // 1. It is Ralink chip or
-			 // 2. It is OPEN or AES mode,
-			 // then BA session can be bulit.
-			 && ((pEntry->ValidAsCLI && pAd->MlmeAux.APRalinkIe != 0x0) ||
-				 (pEntry->WepStatus != Ndis802_11WEPEnabled && pEntry->WepStatus != Ndis802_11Encryption2Enabled))
-			)
-		{
-			BAOriSessionSetUp(pAd, pEntry, UserPriority, 0, 10, FALSE);
-		}
-	}
-#endif // DOT11_N_SUPPORT //
-
-	pAd->RalinkCounters.OneSecOsTxCount[QueIdx]++; // TODO: for debug only. to be removed
-	return NDIS_STATUS_SUCCESS;
-}
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		This subroutine will scan through releative ring descriptor to find
-		out avaliable free ring descriptor and compare with request size.
-
-	Arguments:
-		pAd Pointer to our adapter
-		QueIdx		Selected TX Ring
-
-	Return Value:
-		NDIS_STATUS_FAILURE	Not enough free descriptor
-		NDIS_STATUS_SUCCESS	Enough free descriptor
-
-	IRQL = PASSIVE_LEVEL
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-#ifdef RTMP_MAC_PCI
-NDIS_STATUS RTMPFreeTXDRequest(
-	IN		PRTMP_ADAPTER	pAd,
-	IN		UCHAR			QueIdx,
-	IN		UCHAR			NumberRequired,
-	IN		PUCHAR			FreeNumberIs)
-{
-	ULONG		FreeNumber = 0;
-	NDIS_STATUS	Status = NDIS_STATUS_FAILURE;
-
-	switch (QueIdx)
-	{
-		case QID_AC_BK:
-		case QID_AC_BE:
-		case QID_AC_VI:
-		case QID_AC_VO:
-		/*case QID_HCCA:*/
-			if (pAd->TxRing[QueIdx].TxSwFreeIdx > pAd->TxRing[QueIdx].TxCpuIdx)
-				FreeNumber = pAd->TxRing[QueIdx].TxSwFreeIdx - pAd->TxRing[QueIdx].TxCpuIdx - 1;
-			else
-				FreeNumber = pAd->TxRing[QueIdx].TxSwFreeIdx + TX_RING_SIZE - pAd->TxRing[QueIdx].TxCpuIdx - 1;
-
-			if (FreeNumber >= NumberRequired)
-				Status = NDIS_STATUS_SUCCESS;
-			break;
-
-		case QID_MGMT:
-			if (pAd->MgmtRing.TxSwFreeIdx > pAd->MgmtRing.TxCpuIdx)
-				FreeNumber = pAd->MgmtRing.TxSwFreeIdx - pAd->MgmtRing.TxCpuIdx - 1;
-			else
-				FreeNumber = pAd->MgmtRing.TxSwFreeIdx + MGMT_RING_SIZE - pAd->MgmtRing.TxCpuIdx - 1;
-
-			if (FreeNumber >= NumberRequired)
-				Status = NDIS_STATUS_SUCCESS;
-			break;
-
-		default:
-			DBGPRINT(RT_DEBUG_ERROR,("RTMPFreeTXDRequest::Invalid QueIdx(=%d)\n", QueIdx));
-			break;
-	}
-	*FreeNumberIs = (UCHAR)FreeNumber;
-
-	return (Status);
-}
-#endif // RTMP_MAC_PCI //
-
-
-
-VOID RTMPSendDisassociationFrame(
-	IN	PRTMP_ADAPTER	pAd)
-{
-}
-
-VOID	RTMPSendNullFrame(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	UCHAR			TxRate,
-	IN	BOOLEAN			bQosNull)
-{
-	UCHAR	NullFrame[48];
-	ULONG	Length;
-	PHEADER_802_11	pHeader_802_11;
-
-
-#ifdef RALINK_ATE
-	if(ATE_ON(pAd))
-	{
-		return;
-	}
-#endif // RALINK_ATE //
-
-    // WPA 802.1x secured port control
-    if (((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA) ||
-         (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPAPSK) ||
-         (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2) ||
-         (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK)
-#ifdef WPA_SUPPLICANT_SUPPORT
-			  || (pAd->StaCfg.IEEE8021X == TRUE)
-#endif
-        ) &&
-       (pAd->StaCfg.PortSecured == WPA_802_1X_PORT_NOT_SECURED))
-	{
-		return;
-	}
-
-	NdisZeroMemory(NullFrame, 48);
-	Length = sizeof(HEADER_802_11);
-
-	pHeader_802_11 = (PHEADER_802_11) NullFrame;
-
-	pHeader_802_11->FC.Type = BTYPE_DATA;
-	pHeader_802_11->FC.SubType = SUBTYPE_NULL_FUNC;
-	pHeader_802_11->FC.ToDs = 1;
-	COPY_MAC_ADDR(pHeader_802_11->Addr1, pAd->CommonCfg.Bssid);
-	COPY_MAC_ADDR(pHeader_802_11->Addr2, pAd->CurrentAddress);
-	COPY_MAC_ADDR(pHeader_802_11->Addr3, pAd->CommonCfg.Bssid);
-
-	if (pAd->CommonCfg.bAPSDForcePowerSave)
-	{
-		pHeader_802_11->FC.PwrMgmt = PWR_SAVE;
-	}
-	else
-	{
-		pHeader_802_11->FC.PwrMgmt = (pAd->StaCfg.Psm == PWR_SAVE) ? 1: 0;
-	}
-	pHeader_802_11->Duration = pAd->CommonCfg.Dsifs + RTMPCalcDuration(pAd, TxRate, 14);
-
-	pAd->Sequence++;
-	pHeader_802_11->Sequence = pAd->Sequence;
-
-	// Prepare QosNull function frame
-	if (bQosNull)
-	{
-		pHeader_802_11->FC.SubType = SUBTYPE_QOS_NULL;
-
-		// copy QOS control bytes
-		NullFrame[Length]	=  0;
-		NullFrame[Length+1] =  0;
-		Length += 2;// if pad with 2 bytes for alignment, APSD will fail
-	}
-
-	HAL_KickOutNullFrameTx(pAd, 0, NullFrame, Length);
-
-}
-
-// IRQL = DISPATCH_LEVEL
-VOID	RTMPSendRTSFrame(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			pDA,
-	IN	unsigned int	NextMpduSize,
-	IN	UCHAR			TxRate,
-	IN	UCHAR			RTSRate,
-	IN	USHORT			AckDuration,
-	IN	UCHAR			QueIdx,
-	IN	UCHAR			FrameGap)
-{
-}
-
-
-
-// --------------------------------------------------------
-//  FIND ENCRYPT KEY AND DECIDE CIPHER ALGORITHM
-//		Find the WPA key, either Group or Pairwise Key
-//		LEAP + TKIP also use WPA key.
-// --------------------------------------------------------
-// Decide WEP bit and cipher suite to be used. Same cipher suite should be used for whole fragment burst
-// In Cisco CCX 2.0 Leap Authentication
-//		   WepStatus is Ndis802_11Encryption1Enabled but the key will use PairwiseKey
-//		   Instead of the SharedKey, SharedKey Length may be Zero.
-VOID STAFindCipherAlgorithm(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	TX_BLK			*pTxBlk)
-{
-	NDIS_802_11_ENCRYPTION_STATUS	Cipher;				// To indicate cipher used for this packet
-	UCHAR							CipherAlg = CIPHER_NONE;		// cipher alogrithm
-	UCHAR							KeyIdx = 0xff;
-	PUCHAR							pSrcBufVA;
-	PCIPHER_KEY						pKey = NULL;
-
-	pSrcBufVA = GET_OS_PKT_DATAPTR(pTxBlk->pPacket);
-
-	{
-	    // Select Cipher
-	    if ((*pSrcBufVA & 0x01) && (ADHOC_ON(pAd)))
-	        Cipher = pAd->StaCfg.GroupCipher; // Cipher for Multicast or Broadcast
-	    else
-	        Cipher = pAd->StaCfg.PairCipher; // Cipher for Unicast
-
-		if (RTMP_GET_PACKET_EAPOL(pTxBlk->pPacket))
-		{
-			ASSERT(pAd->SharedKey[BSS0][0].CipherAlg <= CIPHER_CKIP128);
-
-			// 4-way handshaking frame must be clear
-			if (!(TX_BLK_TEST_FLAG(pTxBlk, fTX_bClearEAPFrame)) && (pAd->SharedKey[BSS0][0].CipherAlg) &&
-				(pAd->SharedKey[BSS0][0].KeyLen))
-			{
-				CipherAlg = pAd->SharedKey[BSS0][0].CipherAlg;
-				KeyIdx = 0;
-			}
-		}
-		else if (Cipher == Ndis802_11Encryption1Enabled)
-		{
-				KeyIdx = pAd->StaCfg.DefaultKeyId;
-		}
-		else if ((Cipher == Ndis802_11Encryption2Enabled) ||
-				 (Cipher == Ndis802_11Encryption3Enabled))
-		{
-			if ((*pSrcBufVA & 0x01) && (ADHOC_ON(pAd))) // multicast
-				KeyIdx = pAd->StaCfg.DefaultKeyId;
-			else if (pAd->SharedKey[BSS0][0].KeyLen)
-				KeyIdx = 0;
-			else
-				KeyIdx = pAd->StaCfg.DefaultKeyId;
-		}
-
-		if (KeyIdx == 0xff)
-			CipherAlg = CIPHER_NONE;
-		else if ((Cipher == Ndis802_11EncryptionDisabled) || (pAd->SharedKey[BSS0][KeyIdx].KeyLen == 0))
-			CipherAlg = CIPHER_NONE;
-#ifdef WPA_SUPPLICANT_SUPPORT
-	    else if ( pAd->StaCfg.WpaSupplicantUP &&
-	             (Cipher == Ndis802_11Encryption1Enabled) &&
-	             (pAd->StaCfg.IEEE8021X == TRUE) &&
-	             (pAd->StaCfg.PortSecured == WPA_802_1X_PORT_NOT_SECURED))
-	        CipherAlg = CIPHER_NONE;
-#endif // WPA_SUPPLICANT_SUPPORT //
-		else
-		{
-			//Header_802_11.FC.Wep = 1;
-			CipherAlg = pAd->SharedKey[BSS0][KeyIdx].CipherAlg;
-			pKey = &pAd->SharedKey[BSS0][KeyIdx];
-		}
-	}
-
-	pTxBlk->CipherAlg = CipherAlg;
-	pTxBlk->pKey = pKey;
-}
-
-
-VOID STABuildCommon802_11Header(
-	IN  PRTMP_ADAPTER   pAd,
-	IN  TX_BLK          *pTxBlk)
-{
-
-	HEADER_802_11	*pHeader_802_11;
-#ifdef QOS_DLS_SUPPORT
-	BOOLEAN	bDLSFrame = FALSE;
-	INT	DlsEntryIndex = 0;
-#endif // QOS_DLS_SUPPORT //
-
-	//
-	// MAKE A COMMON 802.11 HEADER
-	//
-
-	// normal wlan header size : 24 octets
-	pTxBlk->MpduHeaderLen = sizeof(HEADER_802_11);
-
-	pHeader_802_11 = (HEADER_802_11 *) &pTxBlk->HeaderBuf[TXINFO_SIZE + TXWI_SIZE];
-
-	NdisZeroMemory(pHeader_802_11, sizeof(HEADER_802_11));
-
-	pHeader_802_11->FC.FrDs = 0;
-	pHeader_802_11->FC.Type = BTYPE_DATA;
-	pHeader_802_11->FC.SubType = ((TX_BLK_TEST_FLAG(pTxBlk, fTX_bWMM)) ? SUBTYPE_QDATA : SUBTYPE_DATA);
-
-#ifdef QOS_DLS_SUPPORT
-	if (INFRA_ON(pAd))
-	{
-		// Check if the frame can be sent through DLS direct link interface
-		// If packet can be sent through DLS, then force aggregation disable. (Hard to determine peer STA's capability)
-		DlsEntryIndex = RTMPCheckDLSFrame(pAd, pTxBlk->pSrcBufHeader);
-		if (DlsEntryIndex >= 0)
-			bDLSFrame = TRUE;
-		else
-			bDLSFrame = FALSE;
-	}
-#endif // QOS_DLS_SUPPORT //
-
-    if (pTxBlk->pMacEntry)
-	{
-		if (TX_BLK_TEST_FLAG(pTxBlk, fTX_bForceNonQoS))
-		{
-			pHeader_802_11->Sequence = pTxBlk->pMacEntry->NonQosDataSeq;
-			pTxBlk->pMacEntry->NonQosDataSeq = (pTxBlk->pMacEntry->NonQosDataSeq+1) & MAXSEQ;
-		}
-		else
-		{
-			{
-	    pHeader_802_11->Sequence = pTxBlk->pMacEntry->TxSeq[pTxBlk->UserPriority];
-	    pTxBlk->pMacEntry->TxSeq[pTxBlk->UserPriority] = (pTxBlk->pMacEntry->TxSeq[pTxBlk->UserPriority]+1) & MAXSEQ;
-	}
-	}
-	}
-	else
-	{
-		pHeader_802_11->Sequence = pAd->Sequence;
-		pAd->Sequence = (pAd->Sequence+1) & MAXSEQ; // next sequence
-	}
-
-	pHeader_802_11->Frag = 0;
-
-	pHeader_802_11->FC.MoreData = TX_BLK_TEST_FLAG(pTxBlk, fTX_bMoreData);
-
-	{
-		if (INFRA_ON(pAd))
-		{
-#ifdef QOS_DLS_SUPPORT
-			if (bDLSFrame)
-			{
-				COPY_MAC_ADDR(pHeader_802_11->Addr1, pTxBlk->pSrcBufHeader);
-				COPY_MAC_ADDR(pHeader_802_11->Addr2, pAd->CurrentAddress);
-				COPY_MAC_ADDR(pHeader_802_11->Addr3, pAd->CommonCfg.Bssid);
-				pHeader_802_11->FC.ToDs = 0;
-			}
-			else
-#endif // QOS_DLS_SUPPORT //
-			{
-			COPY_MAC_ADDR(pHeader_802_11->Addr1, pAd->CommonCfg.Bssid);
-			COPY_MAC_ADDR(pHeader_802_11->Addr2, pAd->CurrentAddress);
-			COPY_MAC_ADDR(pHeader_802_11->Addr3, pTxBlk->pSrcBufHeader);
-			pHeader_802_11->FC.ToDs = 1;
-		}
-		}
-		else if (ADHOC_ON(pAd))
-		{
-			COPY_MAC_ADDR(pHeader_802_11->Addr1, pTxBlk->pSrcBufHeader);
-			COPY_MAC_ADDR(pHeader_802_11->Addr2, pAd->CurrentAddress);
-			COPY_MAC_ADDR(pHeader_802_11->Addr3, pAd->CommonCfg.Bssid);
-			pHeader_802_11->FC.ToDs = 0;
-		}
-	}
-
-	if (pTxBlk->CipherAlg != CIPHER_NONE)
-		pHeader_802_11->FC.Wep = 1;
-
-	// -----------------------------------------------------------------
-	// STEP 2. MAKE A COMMON 802.11 HEADER SHARED BY ENTIRE FRAGMENT BURST. Fill sequence later.
-	// -----------------------------------------------------------------
-	if (pAd->CommonCfg.bAPSDForcePowerSave)
-	pHeader_802_11->FC.PwrMgmt = PWR_SAVE;
-	else
-	pHeader_802_11->FC.PwrMgmt = (pAd->StaCfg.Psm == PWR_SAVE);
-}
-
-#ifdef DOT11_N_SUPPORT
-VOID STABuildCache802_11Header(
-	IN RTMP_ADAPTER		*pAd,
-	IN TX_BLK			*pTxBlk,
-	IN UCHAR			*pHeader)
-{
-	MAC_TABLE_ENTRY	*pMacEntry;
-	PHEADER_802_11	pHeader80211;
-
-	pHeader80211 = (PHEADER_802_11)pHeader;
-	pMacEntry = pTxBlk->pMacEntry;
-
-	//
-	// Update the cached 802.11 HEADER
-	//
-
-	// normal wlan header size : 24 octets
-	pTxBlk->MpduHeaderLen = sizeof(HEADER_802_11);
-
-	// More Bit
-	pHeader80211->FC.MoreData = TX_BLK_TEST_FLAG(pTxBlk, fTX_bMoreData);
-
-	// Sequence
-	pHeader80211->Sequence = pMacEntry->TxSeq[pTxBlk->UserPriority];
-    pMacEntry->TxSeq[pTxBlk->UserPriority] = (pMacEntry->TxSeq[pTxBlk->UserPriority]+1) & MAXSEQ;
-
-	{
-		// Check if the frame can be sent through DLS direct link interface
-		// If packet can be sent through DLS, then force aggregation disable. (Hard to determine peer STA's capability)
-#ifdef QOS_DLS_SUPPORT
-		BOOLEAN	bDLSFrame = FALSE;
-		INT	DlsEntryIndex = 0;
-
-		DlsEntryIndex = RTMPCheckDLSFrame(pAd, pTxBlk->pSrcBufHeader);
-		if (DlsEntryIndex >= 0)
-			bDLSFrame = TRUE;
-		else
-			bDLSFrame = FALSE;
-#endif // QOS_DLS_SUPPORT //
-
-		// The addr3 of normal packet send from DS is Dest Mac address.
-#ifdef QOS_DLS_SUPPORT
-		if (bDLSFrame)
-		{
-			COPY_MAC_ADDR(pHeader80211->Addr1, pTxBlk->pSrcBufHeader);
-			COPY_MAC_ADDR(pHeader80211->Addr3, pAd->CommonCfg.Bssid);
-			pHeader80211->FC.ToDs = 0;
-		}
-		else
-#endif // QOS_DLS_SUPPORT //
-		if (ADHOC_ON(pAd))
-			COPY_MAC_ADDR(pHeader80211->Addr3, pAd->CommonCfg.Bssid);
-		else
-		COPY_MAC_ADDR(pHeader80211->Addr3, pTxBlk->pSrcBufHeader);
-	}
-
-	// -----------------------------------------------------------------
-	// STEP 2. MAKE A COMMON 802.11 HEADER SHARED BY ENTIRE FRAGMENT BURST. Fill sequence later.
-	// -----------------------------------------------------------------
-	if (pAd->CommonCfg.bAPSDForcePowerSave)
-	pHeader80211->FC.PwrMgmt = PWR_SAVE;
-	else
-	pHeader80211->FC.PwrMgmt = (pAd->StaCfg.Psm == PWR_SAVE);
-}
-#endif // DOT11_N_SUPPORT //
-
-static inline PUCHAR STA_Build_ARalink_Frame_Header(
-	IN RTMP_ADAPTER *pAd,
-	IN TX_BLK		*pTxBlk)
-{
-	PUCHAR			pHeaderBufPtr;
-	HEADER_802_11	*pHeader_802_11;
-	PNDIS_PACKET	pNextPacket;
-	UINT32			nextBufLen;
-	PQUEUE_ENTRY	pQEntry;
-
-	STAFindCipherAlgorithm(pAd, pTxBlk);
-	STABuildCommon802_11Header(pAd, pTxBlk);
-
-
-	pHeaderBufPtr = &pTxBlk->HeaderBuf[TXINFO_SIZE + TXWI_SIZE];
-	pHeader_802_11 = (HEADER_802_11 *) pHeaderBufPtr;
-
-	// steal "order" bit to mark "aggregation"
-	pHeader_802_11->FC.Order = 1;
-
-	// skip common header
-	pHeaderBufPtr += pTxBlk->MpduHeaderLen;
-
-	if (TX_BLK_TEST_FLAG(pTxBlk, fTX_bWMM))
-	{
-		//
-		// build QOS Control bytes
-		//
-		*pHeaderBufPtr = (pTxBlk->UserPriority & 0x0F);
-
-		*(pHeaderBufPtr+1) = 0;
-		pHeaderBufPtr +=2;
-		pTxBlk->MpduHeaderLen += 2;
-	}
-
-	// padding at front of LLC header. LLC header should at 4-bytes aligment.
-	pTxBlk->HdrPadLen = (ULONG)pHeaderBufPtr;
-	pHeaderBufPtr = (PUCHAR)ROUND_UP(pHeaderBufPtr, 4);
-	pTxBlk->HdrPadLen = (ULONG)(pHeaderBufPtr - pTxBlk->HdrPadLen);
-
-	// For RA Aggregation,
-	// put the 2nd MSDU length(extra 2-byte field) after QOS_CONTROL in little endian format
-	pQEntry = pTxBlk->TxPacketList.Head;
-	pNextPacket = QUEUE_ENTRY_TO_PACKET(pQEntry);
-	nextBufLen = GET_OS_PKT_LEN(pNextPacket);
-	if (RTMP_GET_PACKET_VLAN(pNextPacket))
-		nextBufLen -= LENGTH_802_1Q;
-
-	*pHeaderBufPtr = (UCHAR)nextBufLen & 0xff;
-	*(pHeaderBufPtr+1) = (UCHAR)(nextBufLen >> 8);
-
-	pHeaderBufPtr += 2;
-	pTxBlk->MpduHeaderLen += 2;
-
-	return pHeaderBufPtr;
-
-}
-
-#ifdef DOT11_N_SUPPORT
-static inline PUCHAR STA_Build_AMSDU_Frame_Header(
-	IN RTMP_ADAPTER *pAd,
-	IN TX_BLK		*pTxBlk)
-{
-	PUCHAR			pHeaderBufPtr;//, pSaveBufPtr;
-	HEADER_802_11	*pHeader_802_11;
-
-
-	STAFindCipherAlgorithm(pAd, pTxBlk);
-	STABuildCommon802_11Header(pAd, pTxBlk);
-
-	pHeaderBufPtr = &pTxBlk->HeaderBuf[TXINFO_SIZE + TXWI_SIZE];
-	pHeader_802_11 = (HEADER_802_11 *) pHeaderBufPtr;
-
-	// skip common header
-	pHeaderBufPtr += pTxBlk->MpduHeaderLen;
-
-	//
-	// build QOS Control bytes
-	//
-	*pHeaderBufPtr = (pTxBlk->UserPriority & 0x0F);
-
-	//
-	// A-MSDU packet
-	//
-	*pHeaderBufPtr |= 0x80;
-
-	*(pHeaderBufPtr+1) = 0;
-	pHeaderBufPtr +=2;
-	pTxBlk->MpduHeaderLen += 2;
-
-	//pSaveBufPtr = pHeaderBufPtr;
-
-	//
-	// padding at front of LLC header
-	// LLC header should locate at 4-octets aligment
-	//
-	// @@@ MpduHeaderLen excluding padding @@@
-	//
-	pTxBlk->HdrPadLen = (ULONG)pHeaderBufPtr;
-	pHeaderBufPtr = (PUCHAR) ROUND_UP(pHeaderBufPtr, 4);
-	pTxBlk->HdrPadLen = (ULONG)(pHeaderBufPtr - pTxBlk->HdrPadLen);
-
-	return pHeaderBufPtr;
-
-}
-
-
-VOID STA_AMPDU_Frame_Tx(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	TX_BLK			*pTxBlk)
-{
-	HEADER_802_11	*pHeader_802_11;
-	PUCHAR			pHeaderBufPtr;
-	USHORT			FreeNumber;
-	MAC_TABLE_ENTRY	*pMacEntry;
-	BOOLEAN			bVLANPkt;
-	PQUEUE_ENTRY	pQEntry;
-
-	ASSERT(pTxBlk);
-
-	while(pTxBlk->TxPacketList.Head)
-	{
-		pQEntry = RemoveHeadQueue(&pTxBlk->TxPacketList);
-		pTxBlk->pPacket = QUEUE_ENTRY_TO_PACKET(pQEntry);
-		if ( RTMP_FillTxBlkInfo(pAd, pTxBlk) != TRUE)
-		{
-			RELEASE_NDIS_PACKET(pAd, pTxBlk->pPacket, NDIS_STATUS_FAILURE);
-			continue;
-		}
-
-		bVLANPkt = (RTMP_GET_PACKET_VLAN(pTxBlk->pPacket) ? TRUE : FALSE);
-
-		pMacEntry = pTxBlk->pMacEntry;
-		if (pMacEntry->isCached)
-		{
-			// NOTE: Please make sure the size of pMacEntry->CachedBuf[] is smaller than pTxBlk->HeaderBuf[]!!!!
-			NdisMoveMemory((PUCHAR)&pTxBlk->HeaderBuf[TXINFO_SIZE], (PUCHAR)&pMacEntry->CachedBuf[0], TXWI_SIZE + sizeof(HEADER_802_11));
-			pHeaderBufPtr = (PUCHAR)(&pTxBlk->HeaderBuf[TXINFO_SIZE + TXWI_SIZE]);
-			STABuildCache802_11Header(pAd, pTxBlk, pHeaderBufPtr);
-		}
-		else
-		{
-			STAFindCipherAlgorithm(pAd, pTxBlk);
-			STABuildCommon802_11Header(pAd, pTxBlk);
-
-			pHeaderBufPtr = &pTxBlk->HeaderBuf[TXINFO_SIZE + TXWI_SIZE];
-		}
-
-
-		pHeader_802_11 = (HEADER_802_11 *) pHeaderBufPtr;
-
-		// skip common header
-		pHeaderBufPtr += pTxBlk->MpduHeaderLen;
-
-		//
-		// build QOS Control bytes
-		//
-		*pHeaderBufPtr = (pTxBlk->UserPriority & 0x0F);
-		*(pHeaderBufPtr+1) = 0;
-		pHeaderBufPtr +=2;
-		pTxBlk->MpduHeaderLen += 2;
-
-		//
-		// build HTC+
-		// HTC control filed following QoS field
-		//
-		if ((pAd->CommonCfg.bRdg == TRUE) && CLIENT_STATUS_TEST_FLAG(pTxBlk->pMacEntry, fCLIENT_STATUS_RDG_CAPABLE))
-		{
-			if (pMacEntry->isCached == FALSE)
-			{
-				// mark HTC bit
-				pHeader_802_11->FC.Order = 1;
-
-				NdisZeroMemory(pHeaderBufPtr, 4);
-				*(pHeaderBufPtr+3) |= 0x80;
-			}
-			pHeaderBufPtr += 4;
-			pTxBlk->MpduHeaderLen += 4;
-		}
-
-		//pTxBlk->MpduHeaderLen = pHeaderBufPtr - pTxBlk->HeaderBuf - TXWI_SIZE - TXINFO_SIZE;
-		ASSERT(pTxBlk->MpduHeaderLen >= 24);
-
-		// skip 802.3 header
-		pTxBlk->pSrcBufData = pTxBlk->pSrcBufHeader + LENGTH_802_3;
-		pTxBlk->SrcBufLen  -= LENGTH_802_3;
-
-		// skip vlan tag
-		if (bVLANPkt)
-		{
-			pTxBlk->pSrcBufData	+= LENGTH_802_1Q;
-			pTxBlk->SrcBufLen	-= LENGTH_802_1Q;
-		}
-
-		//
-		// padding at front of LLC header
-		// LLC header should locate at 4-octets aligment
-		//
-		// @@@ MpduHeaderLen excluding padding @@@
-		//
-		pTxBlk->HdrPadLen = (ULONG)pHeaderBufPtr;
-		pHeaderBufPtr = (PUCHAR) ROUND_UP(pHeaderBufPtr, 4);
-		pTxBlk->HdrPadLen = (ULONG)(pHeaderBufPtr - pTxBlk->HdrPadLen);
-
-		{
-
-			//
-			// Insert LLC-SNAP encapsulation - 8 octets
-			//
-			EXTRA_LLCSNAP_ENCAP_FROM_PKT_OFFSET(pTxBlk->pSrcBufData-2, pTxBlk->pExtraLlcSnapEncap);
-			if (pTxBlk->pExtraLlcSnapEncap)
-			{
-				NdisMoveMemory(pHeaderBufPtr, pTxBlk->pExtraLlcSnapEncap, 6);
-				pHeaderBufPtr += 6;
-				// get 2 octets (TypeofLen)
-				NdisMoveMemory(pHeaderBufPtr, pTxBlk->pSrcBufData-2, 2);
-				pHeaderBufPtr += 2;
-				pTxBlk->MpduHeaderLen += LENGTH_802_1_H;
-			}
-
-		}
-
-		if (pMacEntry->isCached)
-		{
-            RTMPWriteTxWI_Cache(pAd, (PTXWI_STRUC)(&pTxBlk->HeaderBuf[TXINFO_SIZE]), pTxBlk);
-		}
-		else
-		{
-			RTMPWriteTxWI_Data(pAd, (PTXWI_STRUC)(&pTxBlk->HeaderBuf[TXINFO_SIZE]), pTxBlk);
-
-			NdisZeroMemory((PUCHAR)(&pMacEntry->CachedBuf[0]), sizeof(pMacEntry->CachedBuf));
-			NdisMoveMemory((PUCHAR)(&pMacEntry->CachedBuf[0]), (PUCHAR)(&pTxBlk->HeaderBuf[TXINFO_SIZE]), (pHeaderBufPtr - (PUCHAR)(&pTxBlk->HeaderBuf[TXINFO_SIZE])));
-			pMacEntry->isCached = TRUE;
-		}
-
-		// calculate Transmitted AMPDU count and ByteCount
-		{
-			pAd->RalinkCounters.TransmittedMPDUsInAMPDUCount.u.LowPart ++;
-			pAd->RalinkCounters.TransmittedOctetsInAMPDUCount.QuadPart += pTxBlk->SrcBufLen;
-		}
-
-		//FreeNumber = GET_TXRING_FREENO(pAd, QueIdx);
-
-		HAL_WriteTxResource(pAd, pTxBlk, TRUE, &FreeNumber);
-
-		//
-		// Kick out Tx
-		//
-                if (!RTMP_TEST_PSFLAG(pAd, fRTMP_PS_DISABLE_TX))
-		HAL_KickOutTx(pAd, pTxBlk, pTxBlk->QueIdx);
-
-		pAd->RalinkCounters.KickTxCount++;
-		pAd->RalinkCounters.OneSecTxDoneCount++;
-	}
-
-}
-
-
-VOID STA_AMSDU_Frame_Tx(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	TX_BLK			*pTxBlk)
-{
-	PUCHAR			pHeaderBufPtr;
-	USHORT			FreeNumber;
-	USHORT			subFramePayloadLen = 0;	// AMSDU Subframe length without AMSDU-Header / Padding.
-	USHORT			totalMPDUSize=0;
-	UCHAR			*subFrameHeader;
-	UCHAR			padding = 0;
-	USHORT			FirstTx = 0, LastTxIdx = 0;
-	BOOLEAN			bVLANPkt;
-	int			frameNum = 0;
-	PQUEUE_ENTRY	pQEntry;
-
-
-	ASSERT(pTxBlk);
-
-	ASSERT((pTxBlk->TxPacketList.Number > 1));
-
-	while(pTxBlk->TxPacketList.Head)
-	{
-		pQEntry = RemoveHeadQueue(&pTxBlk->TxPacketList);
-		pTxBlk->pPacket = QUEUE_ENTRY_TO_PACKET(pQEntry);
-		if (RTMP_FillTxBlkInfo(pAd, pTxBlk) != TRUE)
-		{
-			RELEASE_NDIS_PACKET(pAd, pTxBlk->pPacket, NDIS_STATUS_FAILURE);
-			continue;
-		}
-
-		bVLANPkt = (RTMP_GET_PACKET_VLAN(pTxBlk->pPacket) ? TRUE : FALSE);
-
-		// skip 802.3 header
-		pTxBlk->pSrcBufData = pTxBlk->pSrcBufHeader + LENGTH_802_3;
-		pTxBlk->SrcBufLen  -= LENGTH_802_3;
-
-		// skip vlan tag
-		if (bVLANPkt)
-		{
-			pTxBlk->pSrcBufData	+= LENGTH_802_1Q;
-			pTxBlk->SrcBufLen	-= LENGTH_802_1Q;
-		}
-
-		if (frameNum == 0)
-		{
-			pHeaderBufPtr = STA_Build_AMSDU_Frame_Header(pAd, pTxBlk);
-
-			// NOTE: TxWI->MPDUtotalByteCount will be updated after final frame was handled.
-			RTMPWriteTxWI_Data(pAd, (PTXWI_STRUC)(&pTxBlk->HeaderBuf[TXINFO_SIZE]), pTxBlk);
-		}
-		else
-		{
-			pHeaderBufPtr = &pTxBlk->HeaderBuf[0];
-			padding = ROUND_UP(LENGTH_AMSDU_SUBFRAMEHEAD + subFramePayloadLen, 4) - (LENGTH_AMSDU_SUBFRAMEHEAD + subFramePayloadLen);
-			NdisZeroMemory(pHeaderBufPtr, padding + LENGTH_AMSDU_SUBFRAMEHEAD);
-			pHeaderBufPtr += padding;
-			pTxBlk->MpduHeaderLen = padding;
-		}
-
-		//
-		// A-MSDU subframe
-		//   DA(6)+SA(6)+Length(2) + LLC/SNAP Encap
-		//
-		subFrameHeader = pHeaderBufPtr;
-		subFramePayloadLen = pTxBlk->SrcBufLen;
-
-		NdisMoveMemory(subFrameHeader, pTxBlk->pSrcBufHeader, 12);
-
-
-		pHeaderBufPtr += LENGTH_AMSDU_SUBFRAMEHEAD;
-		pTxBlk->MpduHeaderLen += LENGTH_AMSDU_SUBFRAMEHEAD;
-
-
-		//
-		// Insert LLC-SNAP encapsulation - 8 octets
-		//
-		EXTRA_LLCSNAP_ENCAP_FROM_PKT_OFFSET(pTxBlk->pSrcBufData-2, pTxBlk->pExtraLlcSnapEncap);
-
-		subFramePayloadLen = pTxBlk->SrcBufLen;
-
-		if (pTxBlk->pExtraLlcSnapEncap)
-		{
-			NdisMoveMemory(pHeaderBufPtr, pTxBlk->pExtraLlcSnapEncap, 6);
-			pHeaderBufPtr += 6;
-			// get 2 octets (TypeofLen)
-			NdisMoveMemory(pHeaderBufPtr, pTxBlk->pSrcBufData-2, 2);
-			pHeaderBufPtr += 2;
-			pTxBlk->MpduHeaderLen += LENGTH_802_1_H;
-			subFramePayloadLen += LENGTH_802_1_H;
-		}
-
-		// update subFrame Length field
-		subFrameHeader[12] = (subFramePayloadLen & 0xFF00) >> 8;
-		subFrameHeader[13] = subFramePayloadLen & 0xFF;
-
-		totalMPDUSize += pTxBlk->MpduHeaderLen + pTxBlk->SrcBufLen;
-
-		if (frameNum ==0)
-			FirstTx = HAL_WriteMultiTxResource(pAd, pTxBlk, frameNum, &FreeNumber);
-		else
-			LastTxIdx = HAL_WriteMultiTxResource(pAd, pTxBlk, frameNum, &FreeNumber);
-
-		frameNum++;
-
-		pAd->RalinkCounters.KickTxCount++;
-		pAd->RalinkCounters.OneSecTxDoneCount++;
-
-		// calculate Transmitted AMSDU Count and ByteCount
-		{
-			pAd->RalinkCounters.TransmittedAMSDUCount.u.LowPart ++;
-			pAd->RalinkCounters.TransmittedOctetsInAMSDU.QuadPart += totalMPDUSize;
-		}
-
-	}
-
-	HAL_FinalWriteTxResource(pAd, pTxBlk, totalMPDUSize, FirstTx);
-	HAL_LastTxIdx(pAd, pTxBlk->QueIdx, LastTxIdx);
-
-	//
-	// Kick out Tx
-	//
-        if (!RTMP_TEST_PSFLAG(pAd, fRTMP_PS_DISABLE_TX))
-	HAL_KickOutTx(pAd, pTxBlk, pTxBlk->QueIdx);
-}
-#endif // DOT11_N_SUPPORT //
-
-VOID STA_Legacy_Frame_Tx(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	TX_BLK			*pTxBlk)
-{
-	HEADER_802_11	*pHeader_802_11;
-	PUCHAR			pHeaderBufPtr;
-	USHORT			FreeNumber;
-	BOOLEAN			bVLANPkt;
-	PQUEUE_ENTRY	pQEntry;
-
-	ASSERT(pTxBlk);
-
-
-	pQEntry = RemoveHeadQueue(&pTxBlk->TxPacketList);
-	pTxBlk->pPacket = QUEUE_ENTRY_TO_PACKET(pQEntry);
-	if (RTMP_FillTxBlkInfo(pAd, pTxBlk) != TRUE)
-	{
-		RELEASE_NDIS_PACKET(pAd, pTxBlk->pPacket, NDIS_STATUS_FAILURE);
-		return;
-	}
-
-	if (pTxBlk->TxFrameType == TX_MCAST_FRAME)
-	{
-		INC_COUNTER64(pAd->WlanCounters.MulticastTransmittedFrameCount);
-	}
-
-	if (RTMP_GET_PACKET_RTS(pTxBlk->pPacket))
-		TX_BLK_SET_FLAG(pTxBlk, fTX_bRtsRequired);
-	else
-		TX_BLK_CLEAR_FLAG(pTxBlk, fTX_bRtsRequired);
-
-	bVLANPkt = (RTMP_GET_PACKET_VLAN(pTxBlk->pPacket) ? TRUE : FALSE);
-
-	if (pTxBlk->TxRate < pAd->CommonCfg.MinTxRate)
-		pTxBlk->TxRate = pAd->CommonCfg.MinTxRate;
-
-	STAFindCipherAlgorithm(pAd, pTxBlk);
-	STABuildCommon802_11Header(pAd, pTxBlk);
-
-
-	// skip 802.3 header
-	pTxBlk->pSrcBufData = pTxBlk->pSrcBufHeader + LENGTH_802_3;
-	pTxBlk->SrcBufLen  -= LENGTH_802_3;
-
-	// skip vlan tag
-	if (bVLANPkt)
-	{
-		pTxBlk->pSrcBufData	+= LENGTH_802_1Q;
-		pTxBlk->SrcBufLen	-= LENGTH_802_1Q;
-	}
-
-	pHeaderBufPtr = &pTxBlk->HeaderBuf[TXINFO_SIZE + TXWI_SIZE];
-	pHeader_802_11 = (HEADER_802_11 *) pHeaderBufPtr;
-
-	// skip common header
-	pHeaderBufPtr += pTxBlk->MpduHeaderLen;
-
-	if (TX_BLK_TEST_FLAG(pTxBlk, fTX_bWMM))
-	{
-		//
-		// build QOS Control bytes
-		//
-		*(pHeaderBufPtr) = ((pTxBlk->UserPriority & 0x0F) | (pAd->CommonCfg.AckPolicy[pTxBlk->QueIdx]<<5));
-		*(pHeaderBufPtr+1) = 0;
-		pHeaderBufPtr +=2;
-		pTxBlk->MpduHeaderLen += 2;
-	}
-
-	// The remaining content of MPDU header should locate at 4-octets aligment
-	pTxBlk->HdrPadLen = (ULONG)pHeaderBufPtr;
-	pHeaderBufPtr = (PUCHAR) ROUND_UP(pHeaderBufPtr, 4);
-	pTxBlk->HdrPadLen = (ULONG)(pHeaderBufPtr - pTxBlk->HdrPadLen);
-
-	{
-
-		//
-		// Insert LLC-SNAP encapsulation - 8 octets
-		//
-		//
-		// if original Ethernet frame contains no LLC/SNAP,
-		// then an extra LLC/SNAP encap is required
-		//
-		EXTRA_LLCSNAP_ENCAP_FROM_PKT_START(pTxBlk->pSrcBufHeader, pTxBlk->pExtraLlcSnapEncap);
-		if (pTxBlk->pExtraLlcSnapEncap)
-		{
-			UCHAR vlan_size;
-
-			NdisMoveMemory(pHeaderBufPtr, pTxBlk->pExtraLlcSnapEncap, 6);
-			pHeaderBufPtr += 6;
-			// skip vlan tag
-			vlan_size =  (bVLANPkt) ? LENGTH_802_1Q : 0;
-			// get 2 octets (TypeofLen)
-			NdisMoveMemory(pHeaderBufPtr, pTxBlk->pSrcBufHeader+12+vlan_size, 2);
-			pHeaderBufPtr += 2;
-			pTxBlk->MpduHeaderLen += LENGTH_802_1_H;
-		}
-
-	}
-
-	//
-	// prepare for TXWI
-	// use Wcid as Key Index
-	//
-
-	RTMPWriteTxWI_Data(pAd, (PTXWI_STRUC)(&pTxBlk->HeaderBuf[TXINFO_SIZE]), pTxBlk);
-
-	//FreeNumber = GET_TXRING_FREENO(pAd, QueIdx);
-
-	HAL_WriteTxResource(pAd, pTxBlk, TRUE, &FreeNumber);
-
-	pAd->RalinkCounters.KickTxCount++;
-	pAd->RalinkCounters.OneSecTxDoneCount++;
-
-	//
-	// Kick out Tx
-	//
-	if (!RTMP_TEST_PSFLAG(pAd, fRTMP_PS_DISABLE_TX))
-	HAL_KickOutTx(pAd, pTxBlk, pTxBlk->QueIdx);
-}
-
-
-VOID STA_ARalink_Frame_Tx(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	TX_BLK			*pTxBlk)
-{
-	PUCHAR			pHeaderBufPtr;
-	USHORT			FreeNumber;
-	USHORT			totalMPDUSize=0;
-	USHORT			FirstTx, LastTxIdx;
-	int			frameNum = 0;
-	BOOLEAN			bVLANPkt;
-	PQUEUE_ENTRY	pQEntry;
-
-
-	ASSERT(pTxBlk);
-
-	ASSERT((pTxBlk->TxPacketList.Number== 2));
-
-
-	FirstTx = LastTxIdx = 0;  // Is it ok init they as 0?
-	while(pTxBlk->TxPacketList.Head)
-	{
-		pQEntry = RemoveHeadQueue(&pTxBlk->TxPacketList);
-		pTxBlk->pPacket = QUEUE_ENTRY_TO_PACKET(pQEntry);
-
-		if (RTMP_FillTxBlkInfo(pAd, pTxBlk) != TRUE)
-		{
-			RELEASE_NDIS_PACKET(pAd, pTxBlk->pPacket, NDIS_STATUS_FAILURE);
-			continue;
-		}
-
-		bVLANPkt = (RTMP_GET_PACKET_VLAN(pTxBlk->pPacket) ? TRUE : FALSE);
-
-		// skip 802.3 header
-		pTxBlk->pSrcBufData = pTxBlk->pSrcBufHeader + LENGTH_802_3;
-		pTxBlk->SrcBufLen  -= LENGTH_802_3;
-
-		// skip vlan tag
-		if (bVLANPkt)
-		{
-			pTxBlk->pSrcBufData	+= LENGTH_802_1Q;
-			pTxBlk->SrcBufLen	-= LENGTH_802_1Q;
-		}
-
-		if (frameNum == 0)
-		{	// For first frame, we need to create the 802.11 header + padding(optional) + RA-AGG-LEN + SNAP Header
-
-			pHeaderBufPtr = STA_Build_ARalink_Frame_Header(pAd, pTxBlk);
-
-			// It's ok write the TxWI here, because the TxWI->MPDUtotalByteCount
-			//	will be updated after final frame was handled.
-			RTMPWriteTxWI_Data(pAd, (PTXWI_STRUC)(&pTxBlk->HeaderBuf[TXINFO_SIZE]), pTxBlk);
-
-
-			//
-			// Insert LLC-SNAP encapsulation - 8 octets
-			//
-			EXTRA_LLCSNAP_ENCAP_FROM_PKT_OFFSET(pTxBlk->pSrcBufData-2, pTxBlk->pExtraLlcSnapEncap);
-
-			if (pTxBlk->pExtraLlcSnapEncap)
-			{
-				NdisMoveMemory(pHeaderBufPtr, pTxBlk->pExtraLlcSnapEncap, 6);
-				pHeaderBufPtr += 6;
-				// get 2 octets (TypeofLen)
-				NdisMoveMemory(pHeaderBufPtr, pTxBlk->pSrcBufData-2, 2);
-				pHeaderBufPtr += 2;
-				pTxBlk->MpduHeaderLen += LENGTH_802_1_H;
-			}
-		}
-		else
-		{	// For second aggregated frame, we need create the 802.3 header to headerBuf, because PCI will copy it to SDPtr0.
-
-			pHeaderBufPtr = &pTxBlk->HeaderBuf[0];
-			pTxBlk->MpduHeaderLen = 0;
-
-			// A-Ralink sub-sequent frame header is the same as 802.3 header.
-			//   DA(6)+SA(6)+FrameType(2)
-			NdisMoveMemory(pHeaderBufPtr, pTxBlk->pSrcBufHeader, 12);
-			pHeaderBufPtr += 12;
-			// get 2 octets (TypeofLen)
-			NdisMoveMemory(pHeaderBufPtr, pTxBlk->pSrcBufData-2, 2);
-			pHeaderBufPtr += 2;
-			pTxBlk->MpduHeaderLen = LENGTH_ARALINK_SUBFRAMEHEAD;
-		}
-
-		totalMPDUSize += pTxBlk->MpduHeaderLen + pTxBlk->SrcBufLen;
-
-		//FreeNumber = GET_TXRING_FREENO(pAd, QueIdx);
-		if (frameNum ==0)
-			FirstTx = HAL_WriteMultiTxResource(pAd, pTxBlk, frameNum, &FreeNumber);
-		else
-			LastTxIdx = HAL_WriteMultiTxResource(pAd, pTxBlk, frameNum, &FreeNumber);
-
-		frameNum++;
-
-		pAd->RalinkCounters.OneSecTxAggregationCount++;
-		pAd->RalinkCounters.KickTxCount++;
-		pAd->RalinkCounters.OneSecTxDoneCount++;
-
-	}
-
-	HAL_FinalWriteTxResource(pAd, pTxBlk, totalMPDUSize, FirstTx);
-	HAL_LastTxIdx(pAd, pTxBlk->QueIdx, LastTxIdx);
-
-	//
-	// Kick out Tx
-	//
-	if (!RTMP_TEST_PSFLAG(pAd, fRTMP_PS_DISABLE_TX))
-	HAL_KickOutTx(pAd, pTxBlk, pTxBlk->QueIdx);
-
-}
-
-
-VOID STA_Fragment_Frame_Tx(
-	IN RTMP_ADAPTER *pAd,
-	IN TX_BLK		*pTxBlk)
-{
-	HEADER_802_11	*pHeader_802_11;
-	PUCHAR			pHeaderBufPtr;
-	USHORT			FreeNumber;
-	UCHAR			fragNum = 0;
-	PACKET_INFO		PacketInfo;
-	USHORT			EncryptionOverhead = 0;
-	UINT32			FreeMpduSize, SrcRemainingBytes;
-	USHORT			AckDuration;
-	UINT			NextMpduSize;
-	BOOLEAN			bVLANPkt;
-	PQUEUE_ENTRY	pQEntry;
-	HTTRANSMIT_SETTING	*pTransmit;
-
-
-	ASSERT(pTxBlk);
-
-	pQEntry = RemoveHeadQueue(&pTxBlk->TxPacketList);
-	pTxBlk->pPacket = QUEUE_ENTRY_TO_PACKET(pQEntry);
-	if (RTMP_FillTxBlkInfo(pAd, pTxBlk) != TRUE)
-	{
-		RELEASE_NDIS_PACKET(pAd, pTxBlk->pPacket, NDIS_STATUS_FAILURE);
-		return;
-	}
-
-	ASSERT(TX_BLK_TEST_FLAG(pTxBlk, fTX_bAllowFrag));
-	bVLANPkt = (RTMP_GET_PACKET_VLAN(pTxBlk->pPacket) ? TRUE : FALSE);
-
-	STAFindCipherAlgorithm(pAd, pTxBlk);
-	STABuildCommon802_11Header(pAd, pTxBlk);
-
-	if (pTxBlk->CipherAlg == CIPHER_TKIP)
-	{
-		pTxBlk->pPacket = duplicate_pkt_with_TKIP_MIC(pAd, pTxBlk->pPacket);
-		if (pTxBlk->pPacket == NULL)
-			return;
-		RTMP_QueryPacketInfo(pTxBlk->pPacket, &PacketInfo, &pTxBlk->pSrcBufHeader, &pTxBlk->SrcBufLen);
-	}
-
-	// skip 802.3 header
-	pTxBlk->pSrcBufData = pTxBlk->pSrcBufHeader + LENGTH_802_3;
-	pTxBlk->SrcBufLen  -= LENGTH_802_3;
-
-
-	// skip vlan tag
-	if (bVLANPkt)
-	{
-		pTxBlk->pSrcBufData	+= LENGTH_802_1Q;
-		pTxBlk->SrcBufLen	-= LENGTH_802_1Q;
-	}
-
-	pHeaderBufPtr = &pTxBlk->HeaderBuf[TXINFO_SIZE + TXWI_SIZE];
-	pHeader_802_11 = (HEADER_802_11 *)pHeaderBufPtr;
-
-
-	// skip common header
-	pHeaderBufPtr += pTxBlk->MpduHeaderLen;
-
-	if (TX_BLK_TEST_FLAG(pTxBlk, fTX_bWMM))
-	{
-		//
-		// build QOS Control bytes
-		//
-		*pHeaderBufPtr = (pTxBlk->UserPriority & 0x0F);
-
-		*(pHeaderBufPtr+1) = 0;
-		pHeaderBufPtr +=2;
-		pTxBlk->MpduHeaderLen += 2;
-	}
-
-	//
-	// padding at front of LLC header
-	// LLC header should locate at 4-octets aligment
-	//
-	pTxBlk->HdrPadLen = (ULONG)pHeaderBufPtr;
-	pHeaderBufPtr = (PUCHAR) ROUND_UP(pHeaderBufPtr, 4);
-	pTxBlk->HdrPadLen = (ULONG)(pHeaderBufPtr - pTxBlk->HdrPadLen);
-
-
-
-	//
-	// Insert LLC-SNAP encapsulation - 8 octets
-	//
-	//
-	// if original Ethernet frame contains no LLC/SNAP,
-	// then an extra LLC/SNAP encap is required
-	//
-	EXTRA_LLCSNAP_ENCAP_FROM_PKT_START(pTxBlk->pSrcBufHeader, pTxBlk->pExtraLlcSnapEncap);
-	if (pTxBlk->pExtraLlcSnapEncap)
-	{
-		UCHAR vlan_size;
-
-		NdisMoveMemory(pHeaderBufPtr, pTxBlk->pExtraLlcSnapEncap, 6);
-		pHeaderBufPtr += 6;
-		// skip vlan tag
-		vlan_size =  (bVLANPkt) ? LENGTH_802_1Q : 0;
-		// get 2 octets (TypeofLen)
-		NdisMoveMemory(pHeaderBufPtr, pTxBlk->pSrcBufHeader+12+vlan_size, 2);
-		pHeaderBufPtr += 2;
-		pTxBlk->MpduHeaderLen += LENGTH_802_1_H;
-	}
-
-
-	// If TKIP is used and fragmentation is required. Driver has to
-	//	append TKIP MIC at tail of the scatter buffer
-	//	MAC ASIC will only perform IV/EIV/ICV insertion but no TKIP MIC
-	if (pTxBlk->CipherAlg == CIPHER_TKIP)
-	{
-		RTMPCalculateMICValue(pAd, pTxBlk->pPacket, pTxBlk->pExtraLlcSnapEncap, pTxBlk->pKey, 0);
-
-		// NOTE: DON'T refer the skb->len directly after following copy. Becasue the length is not adjust
-		//			to correct lenght, refer to pTxBlk->SrcBufLen for the packet length in following progress.
-		NdisMoveMemory(pTxBlk->pSrcBufData + pTxBlk->SrcBufLen, &pAd->PrivateInfo.Tx.MIC[0], 8);
-		//skb_put((RTPKT_TO_OSPKT(pTxBlk->pPacket))->tail, 8);
-		pTxBlk->SrcBufLen += 8;
-		pTxBlk->TotalFrameLen += 8;
-		pTxBlk->CipherAlg = CIPHER_TKIP_NO_MIC;
-	}
-
-	//
-	// calcuate the overhead bytes that encryption algorithm may add. This
-	// affects the calculate of "duration" field
-	//
-	if ((pTxBlk->CipherAlg == CIPHER_WEP64) || (pTxBlk->CipherAlg == CIPHER_WEP128))
-		EncryptionOverhead = 8; //WEP: IV[4] + ICV[4];
-	else if (pTxBlk->CipherAlg == CIPHER_TKIP_NO_MIC)
-		EncryptionOverhead = 12;//TKIP: IV[4] + EIV[4] + ICV[4], MIC will be added to TotalPacketLength
-	else if (pTxBlk->CipherAlg == CIPHER_TKIP)
-		EncryptionOverhead = 20;//TKIP: IV[4] + EIV[4] + ICV[4] + MIC[8]
-	else if (pTxBlk->CipherAlg == CIPHER_AES)
-		EncryptionOverhead = 16;	// AES: IV[4] + EIV[4] + MIC[8]
-	else
-		EncryptionOverhead = 0;
-
-	pTransmit = pTxBlk->pTransmit;
-	// Decide the TX rate
-	if (pTransmit->field.MODE == MODE_CCK)
-		pTxBlk->TxRate = pTransmit->field.MCS;
-	else if (pTransmit->field.MODE == MODE_OFDM)
-		pTxBlk->TxRate = pTransmit->field.MCS + RATE_FIRST_OFDM_RATE;
-	else
-		pTxBlk->TxRate = RATE_6_5;
-
-	// decide how much time an ACK/CTS frame will consume in the air
-	if (pTxBlk->TxRate <= RATE_LAST_OFDM_RATE)
-		AckDuration = RTMPCalcDuration(pAd, pAd->CommonCfg.ExpectedACKRate[pTxBlk->TxRate], 14);
-	else
-		AckDuration = RTMPCalcDuration(pAd, RATE_6_5, 14);
-
-	// Init the total payload length of this frame.
-	SrcRemainingBytes = pTxBlk->SrcBufLen;
-
-	pTxBlk->TotalFragNum = 0xff;
-
-	do {
-
-		FreeMpduSize = pAd->CommonCfg.FragmentThreshold - LENGTH_CRC;
-
-		FreeMpduSize -= pTxBlk->MpduHeaderLen;
-
-		if (SrcRemainingBytes <= FreeMpduSize)
-		{	// this is the last or only fragment
-
-			pTxBlk->SrcBufLen = SrcRemainingBytes;
-
-			pHeader_802_11->FC.MoreFrag = 0;
-			pHeader_802_11->Duration = pAd->CommonCfg.Dsifs + AckDuration;
-
-			// Indicate the lower layer that this's the last fragment.
-			pTxBlk->TotalFragNum = fragNum;
-		}
-		else
-		{	// more fragment is required
-
-			pTxBlk->SrcBufLen = FreeMpduSize;
-
-			NextMpduSize = min(((UINT)SrcRemainingBytes - pTxBlk->SrcBufLen), ((UINT)pAd->CommonCfg.FragmentThreshold));
-			pHeader_802_11->FC.MoreFrag = 1;
-			pHeader_802_11->Duration = (3 * pAd->CommonCfg.Dsifs) + (2 * AckDuration) + RTMPCalcDuration(pAd, pTxBlk->TxRate, NextMpduSize + EncryptionOverhead);
-		}
-
-		if (fragNum == 0)
-			pTxBlk->FrameGap = IFS_HTTXOP;
-		else
-			pTxBlk->FrameGap = IFS_SIFS;
-
-		RTMPWriteTxWI_Data(pAd, (PTXWI_STRUC)(&pTxBlk->HeaderBuf[TXINFO_SIZE]), pTxBlk);
-
-		HAL_WriteFragTxResource(pAd, pTxBlk, fragNum, &FreeNumber);
-
-		pAd->RalinkCounters.KickTxCount++;
-		pAd->RalinkCounters.OneSecTxDoneCount++;
-
-		// Update the frame number, remaining size of the NDIS packet payload.
-
-		// space for 802.11 header.
-		if (fragNum == 0 && pTxBlk->pExtraLlcSnapEncap)
-			pTxBlk->MpduHeaderLen -= LENGTH_802_1_H;
-
-		fragNum++;
-		SrcRemainingBytes -= pTxBlk->SrcBufLen;
-		pTxBlk->pSrcBufData += pTxBlk->SrcBufLen;
-
-		pHeader_802_11->Frag++;	 // increase Frag #
-
-	}while(SrcRemainingBytes > 0);
-
-	//
-	// Kick out Tx
-	//
-	if (!RTMP_TEST_PSFLAG(pAd, fRTMP_PS_DISABLE_TX))
-	HAL_KickOutTx(pAd, pTxBlk, pTxBlk->QueIdx);
-}
-
-
-#define RELEASE_FRAMES_OF_TXBLK(_pAd, _pTxBlk, _pQEntry, _Status)										\
-		while(_pTxBlk->TxPacketList.Head)														\
-		{																						\
-			_pQEntry = RemoveHeadQueue(&_pTxBlk->TxPacketList);									\
-			RELEASE_NDIS_PACKET(_pAd, QUEUE_ENTRY_TO_PACKET(_pQEntry), _Status);	\
-		}
-
-
-/*
-	========================================================================
-
-	Routine Description:
-		Copy frame from waiting queue into relative ring buffer and set
-	appropriate ASIC register to kick hardware encryption before really
-	sent out to air.
-
-	Arguments:
-		pAd	Pointer to our adapter
-		PNDIS_PACKET	Pointer to outgoing Ndis frame
-		NumberOfFrag	Number of fragment required
-
-	Return Value:
-		None
-
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-NDIS_STATUS STAHardTransmit(
-	IN PRTMP_ADAPTER	pAd,
-	IN TX_BLK			*pTxBlk,
-	IN	UCHAR			QueIdx)
-{
-	NDIS_PACKET		*pPacket;
-	PQUEUE_ENTRY	pQEntry;
-
-	// ---------------------------------------------
-	// STEP 0. DO SANITY CHECK AND SOME EARLY PREPARATION.
-	// ---------------------------------------------
-	//
-	ASSERT(pTxBlk->TxPacketList.Number);
-	if (pTxBlk->TxPacketList.Head == NULL)
-	{
-		DBGPRINT(RT_DEBUG_ERROR, ("pTxBlk->TotalFrameNum == %ld!\n", pTxBlk->TxPacketList.Number));
-		return NDIS_STATUS_FAILURE;
-	}
-
-	pPacket = QUEUE_ENTRY_TO_PACKET(pTxBlk->TxPacketList.Head);
-
-
-	// ------------------------------------------------------------------
-	// STEP 1. WAKE UP PHY
-	//		outgoing frame always wakeup PHY to prevent frame lost and
-	//		turn off PSM bit to improve performance
-	// ------------------------------------------------------------------
-	// not to change PSM bit, just send this frame out?
-	if ((pAd->StaCfg.Psm == PWR_SAVE) && OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE))
-	{
-	    DBGPRINT_RAW(RT_DEBUG_INFO, ("AsicForceWakeup At HardTx\n"));
-#ifdef RTMP_MAC_PCI
-		AsicForceWakeup(pAd, TRUE);
-#endif // RTMP_MAC_PCI //
-	}
-
-	// It should not change PSM bit, when APSD turn on.
-	if ((!(pAd->CommonCfg.bAPSDCapable && pAd->CommonCfg.APEdcaParm.bAPSDCapable) && (pAd->CommonCfg.bAPSDForcePowerSave == FALSE))
-		|| (RTMP_GET_PACKET_EAPOL(pTxBlk->pPacket))
-		|| (RTMP_GET_PACKET_WAI(pTxBlk->pPacket)))
-	{
-		if ((pAd->StaCfg.Psm == PWR_SAVE) &&
-            (pAd->StaCfg.WindowsPowerMode == Ndis802_11PowerModeFast_PSP))
-			RTMP_SET_PSM_BIT(pAd, PWR_ACTIVE);
-	}
-
-	switch (pTxBlk->TxFrameType)
-	{
-#ifdef DOT11_N_SUPPORT
-		case TX_AMPDU_FRAME:
-				STA_AMPDU_Frame_Tx(pAd, pTxBlk);
-			break;
-		case TX_AMSDU_FRAME:
-				STA_AMSDU_Frame_Tx(pAd, pTxBlk);
-			break;
-#endif // DOT11_N_SUPPORT //
-		case TX_LEGACY_FRAME:
-				STA_Legacy_Frame_Tx(pAd, pTxBlk);
-			break;
-		case TX_MCAST_FRAME:
-				STA_Legacy_Frame_Tx(pAd, pTxBlk);
-			break;
-		case TX_RALINK_FRAME:
-				STA_ARalink_Frame_Tx(pAd, pTxBlk);
-			break;
-		case TX_FRAG_FRAME:
-				STA_Fragment_Frame_Tx(pAd, pTxBlk);
-			break;
-		default:
-			{
-				// It should not happened!
-				DBGPRINT(RT_DEBUG_ERROR, ("Send a pacekt was not classified!! It should not happen!\n"));
-				while(pTxBlk->TxPacketList.Number)
-				{
-					pQEntry = RemoveHeadQueue(&pTxBlk->TxPacketList);
-					pPacket = QUEUE_ENTRY_TO_PACKET(pQEntry);
-					if (pPacket)
-						RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_FAILURE);
-				}
-			}
-			break;
-	}
-
-	return (NDIS_STATUS_SUCCESS);
-
-}
-
-ULONG  HashBytesPolynomial(UCHAR *value, unsigned int len)
-{
-   unsigned char *word = value;
-   unsigned int ret = 0;
-   unsigned int i;
-
-   for(i=0; i < len; i++)
-   {
-	  int mod = i % 32;
-	  ret ^=(unsigned int) (word[i]) << mod;
-	  ret ^=(unsigned int) (word[i]) >> (32 - mod);
-   }
-   return ret;
-}
-
-VOID Sta_Announce_or_Forward_802_3_Packet(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PNDIS_PACKET	pPacket,
-	IN	UCHAR			FromWhichBSSID)
-{
-	if (TRUE
-		)
-	{
-		announce_802_3_packet(pAd, pPacket);
-	}
-	else
-	{
-		// release packet
-		RELEASE_NDIS_PACKET(pAd, pPacket, NDIS_STATUS_FAILURE);
-	}
-}
diff --git a/drivers/staging/rt3090/sta/sanity.c b/drivers/staging/rt3090/sta/sanity.c
deleted file mode 100644
index aeda15bd5bca..000000000000
--- a/drivers/staging/rt3090/sta/sanity.c
+++ /dev/null
@@ -1,382 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-	Module Name:
-	sanity.c
-
-	Abstract:
-
-	Revision History:
-	Who			When			What
-	--------	----------		----------------------------------------------
-	John Chang  2004-09-01      add WMM support
-*/
-
-#include "../rt_config.h"
-
-
-extern UCHAR	CISCO_OUI[];
-
-extern UCHAR	WPA_OUI[];
-extern UCHAR	RSN_OUI[];
-extern UCHAR	WME_INFO_ELEM[];
-extern UCHAR	WME_PARM_ELEM[];
-extern UCHAR	Ccx2QosInfo[];
-extern UCHAR	RALINK_OUI[];
-extern UCHAR	BROADCOM_OUI[];
-
-/*
-    ==========================================================================
-    Description:
-        MLME message sanity check
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
- */
-BOOLEAN MlmeStartReqSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN VOID *Msg,
-    IN ULONG MsgLen,
-    OUT CHAR Ssid[],
-    OUT UCHAR *pSsidLen)
-{
-    MLME_START_REQ_STRUCT *Info;
-
-    Info = (MLME_START_REQ_STRUCT *)(Msg);
-
-    if (Info->SsidLen > MAX_LEN_OF_SSID)
-    {
-        DBGPRINT(RT_DEBUG_TRACE, ("MlmeStartReqSanity fail - wrong SSID length\n"));
-        return FALSE;
-    }
-
-    *pSsidLen = Info->SsidLen;
-    NdisMoveMemory(Ssid, Info->Ssid, *pSsidLen);
-
-    return TRUE;
-}
-
-/*
-    ==========================================================================
-    Description:
-        MLME message sanity check
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-
-    IRQL = DISPATCH_LEVEL
-
-    ==========================================================================
- */
-BOOLEAN PeerAssocRspSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN VOID *pMsg,
-    IN ULONG MsgLen,
-    OUT PUCHAR pAddr2,
-    OUT USHORT *pCapabilityInfo,
-    OUT USHORT *pStatus,
-    OUT USHORT *pAid,
-    OUT UCHAR SupRate[],
-    OUT UCHAR *pSupRateLen,
-    OUT UCHAR ExtRate[],
-    OUT UCHAR *pExtRateLen,
-    OUT HT_CAPABILITY_IE		*pHtCapability,
-    OUT ADD_HT_INFO_IE		*pAddHtInfo,	// AP might use this additional ht info IE
-    OUT UCHAR			*pHtCapabilityLen,
-    OUT UCHAR			*pAddHtInfoLen,
-    OUT UCHAR			*pNewExtChannelOffset,
-    OUT PEDCA_PARM pEdcaParm,
-    OUT UCHAR *pCkipFlag)
-{
-    CHAR          IeType, *Ptr;
-    PFRAME_802_11 pFrame = (PFRAME_802_11)pMsg;
-    PEID_STRUCT   pEid;
-    ULONG         Length = 0;
-
-	*pNewExtChannelOffset = 0xff;
-	*pHtCapabilityLen = 0;
-	*pAddHtInfoLen = 0;
-    COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
-    Ptr = (PCHAR)pFrame->Octet;
-    Length += LENGTH_802_11;
-
-    NdisMoveMemory(pCapabilityInfo, &pFrame->Octet[0], 2);
-    Length += 2;
-    NdisMoveMemory(pStatus,         &pFrame->Octet[2], 2);
-    Length += 2;
-    *pCkipFlag = 0;
-    *pExtRateLen = 0;
-    pEdcaParm->bValid = FALSE;
-
-    if (*pStatus != MLME_SUCCESS)
-        return TRUE;
-
-    NdisMoveMemory(pAid, &pFrame->Octet[4], 2);
-    Length += 2;
-
-    // Aid already swaped byte order in RTMPFrameEndianChange() for big endian platform
-    *pAid = (*pAid) & 0x3fff; // AID is low 14-bit
-
-    // -- get supported rates from payload and advance the pointer
-    IeType = pFrame->Octet[6];
-    *pSupRateLen = pFrame->Octet[7];
-    if ((IeType != IE_SUPP_RATES) || (*pSupRateLen > MAX_LEN_OF_SUPPORTED_RATES))
-    {
-        DBGPRINT(RT_DEBUG_TRACE, ("PeerAssocRspSanity fail - wrong SupportedRates IE\n"));
-        return FALSE;
-    }
-    else
-        NdisMoveMemory(SupRate, &pFrame->Octet[8], *pSupRateLen);
-
-
-    Length = Length + 2 + *pSupRateLen;
-
-    // many AP implement proprietary IEs in non-standard order, we'd better
-    // tolerate mis-ordered IEs to get best compatibility
-    pEid = (PEID_STRUCT) &pFrame->Octet[8 + (*pSupRateLen)];
-
-    // get variable fields from payload and advance the pointer
-    while ((Length + 2 + pEid->Len) <= MsgLen)
-    {
-        switch (pEid->Eid)
-        {
-            case IE_EXT_SUPP_RATES:
-                if (pEid->Len <= MAX_LEN_OF_SUPPORTED_RATES)
-                {
-                    NdisMoveMemory(ExtRate, pEid->Octet, pEid->Len);
-                    *pExtRateLen = pEid->Len;
-                }
-                break;
-
-             case IE_HT_CAP:
-            case IE_HT_CAP2:
-			if (pEid->Len >= SIZE_HT_CAP_IE)  //Note: allow extension.!!
-			{
-				NdisMoveMemory(pHtCapability, pEid->Octet, SIZE_HT_CAP_IE);
-
-				*(USHORT *)(&pHtCapability->HtCapInfo) = cpu2le16(*(USHORT *)(&pHtCapability->HtCapInfo));
-				*(USHORT *)(&pHtCapability->ExtHtCapInfo) = cpu2le16(*(USHORT *)(&pHtCapability->ExtHtCapInfo));
-
-				*pHtCapabilityLen = SIZE_HT_CAP_IE;
-			}
-			else
-			{
-				DBGPRINT(RT_DEBUG_WARN, ("PeerAssocRspSanity - wrong IE_HT_CAP. \n"));
-			}
-
-		break;
-#ifdef DOT11_N_SUPPORT
-            case IE_ADD_HT:
-            case IE_ADD_HT2:
-			if (pEid->Len >= sizeof(ADD_HT_INFO_IE))
-			{
-				// This IE allows extension, but we can ignore extra bytes beyond our knowledge , so only
-				// copy first sizeof(ADD_HT_INFO_IE)
-				NdisMoveMemory(pAddHtInfo, pEid->Octet, sizeof(ADD_HT_INFO_IE));
-
-				*(USHORT *)(&pAddHtInfo->AddHtInfo2) = cpu2le16(*(USHORT *)(&pAddHtInfo->AddHtInfo2));
-				*(USHORT *)(&pAddHtInfo->AddHtInfo3) = cpu2le16(*(USHORT *)(&pAddHtInfo->AddHtInfo3));
-
-				*pAddHtInfoLen = SIZE_ADD_HT_INFO_IE;
-			}
-			else
-			{
-				DBGPRINT(RT_DEBUG_WARN, ("PeerAssocRspSanity - wrong IE_ADD_HT. \n"));
-			}
-
-		break;
-            case IE_SECONDARY_CH_OFFSET:
-			if (pEid->Len == 1)
-			{
-				*pNewExtChannelOffset = pEid->Octet[0];
-			}
-			else
-			{
-				DBGPRINT(RT_DEBUG_WARN, ("PeerAssocRspSanity - wrong IE_SECONDARY_CH_OFFSET. \n"));
-			}
-#endif // DOT11_N_SUPPORT //
-		break;
-
-            case IE_VENDOR_SPECIFIC:
-                // handle WME PARAMTER ELEMENT
-                if (NdisEqualMemory(pEid->Octet, WME_PARM_ELEM, 6) && (pEid->Len == 24))
-                {
-                    PUCHAR ptr;
-                    int i;
-
-                    // parsing EDCA parameters
-                    pEdcaParm->bValid          = TRUE;
-                    pEdcaParm->bQAck           = FALSE; // pEid->Octet[0] & 0x10;
-                    pEdcaParm->bQueueRequest   = FALSE; // pEid->Octet[0] & 0x20;
-                    pEdcaParm->bTxopRequest    = FALSE; // pEid->Octet[0] & 0x40;
-                    //pEdcaParm->bMoreDataAck    = FALSE; // pEid->Octet[0] & 0x80;
-                    pEdcaParm->EdcaUpdateCount = pEid->Octet[6] & 0x0f;
-                    pEdcaParm->bAPSDCapable    = (pEid->Octet[6] & 0x80) ? 1 : 0;
-                    ptr = (PUCHAR)&pEid->Octet[8];
-                    for (i=0; i<4; i++)
-                    {
-                        UCHAR aci = (*ptr & 0x60) >> 5; // b5~6 is AC INDEX
-                        pEdcaParm->bACM[aci]  = (((*ptr) & 0x10) == 0x10);   // b5 is ACM
-                        pEdcaParm->Aifsn[aci] = (*ptr) & 0x0f;               // b0~3 is AIFSN
-                        pEdcaParm->Cwmin[aci] = *(ptr+1) & 0x0f;             // b0~4 is Cwmin
-                        pEdcaParm->Cwmax[aci] = *(ptr+1) >> 4;               // b5~8 is Cwmax
-                        pEdcaParm->Txop[aci]  = *(ptr+2) + 256 * (*(ptr+3)); // in unit of 32-us
-                        ptr += 4; // point to next AC
-                    }
-                }
-                break;
-            default:
-                DBGPRINT(RT_DEBUG_TRACE, ("PeerAssocRspSanity - ignore unrecognized EID = %d\n", pEid->Eid));
-                break;
-        }
-
-        Length = Length + 2 + pEid->Len;
-        pEid = (PEID_STRUCT)((UCHAR*)pEid + 2 + pEid->Len);
-    }
-
-
-    return TRUE;
-}
-
-/*
-    ==========================================================================
-    Description:
-        MLME message sanity check
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-
-	IRQL = DISPATCH_LEVEL
-
-    ==========================================================================
- */
-BOOLEAN PeerProbeReqSanity(
-    IN PRTMP_ADAPTER pAd,
-    IN VOID *Msg,
-    IN ULONG MsgLen,
-    OUT PUCHAR pAddr2,
-    OUT CHAR Ssid[],
-    OUT UCHAR *pSsidLen)
-{
-    UCHAR         Idx;
-    UCHAR	      RateLen;
-    CHAR          IeType;
-    PFRAME_802_11 pFrame = (PFRAME_802_11)Msg;
-
-    COPY_MAC_ADDR(pAddr2, pFrame->Hdr.Addr2);
-
-    if ((pFrame->Octet[0] != IE_SSID) || (pFrame->Octet[1] > MAX_LEN_OF_SSID))
-    {
-        DBGPRINT(RT_DEBUG_TRACE, ("PeerProbeReqSanity fail - wrong SSID IE(Type=%d,Len=%d)\n",pFrame->Octet[0],pFrame->Octet[1]));
-        return FALSE;
-    }
-
-    *pSsidLen = pFrame->Octet[1];
-    NdisMoveMemory(Ssid, &pFrame->Octet[2], *pSsidLen);
-
-    Idx = *pSsidLen + 2;
-
-    // -- get supported rates from payload and advance the pointer
-    IeType = pFrame->Octet[Idx];
-    RateLen = pFrame->Octet[Idx + 1];
-    if (IeType != IE_SUPP_RATES)
-    {
-        DBGPRINT(RT_DEBUG_TRACE, ("PeerProbeReqSanity fail - wrong SupportRates IE(Type=%d,Len=%d)\n",pFrame->Octet[Idx],pFrame->Octet[Idx+1]));
-        return FALSE;
-    }
-    else
-    {
-        if ((pAd->CommonCfg.PhyMode == PHY_11G) && (RateLen < 8))
-            return (FALSE);
-    }
-
-    return TRUE;
-}
-
-/*
-    ==========================================================================
-    Description:
-
-	IRQL = DISPATCH_LEVEL
-
-    ==========================================================================
- */
-BOOLEAN GetTimBit(
-    IN CHAR *Ptr,
-    IN USHORT Aid,
-    OUT UCHAR *TimLen,
-    OUT UCHAR *BcastFlag,
-    OUT UCHAR *DtimCount,
-    OUT UCHAR *DtimPeriod,
-    OUT UCHAR *MessageToMe)
-{
-    UCHAR          BitCntl, N1, N2, MyByte, MyBit;
-    CHAR          *IdxPtr;
-
-    IdxPtr = Ptr;
-
-    IdxPtr ++;
-    *TimLen = *IdxPtr;
-
-    // get DTIM Count from TIM element
-    IdxPtr ++;
-    *DtimCount = *IdxPtr;
-
-    // get DTIM Period from TIM element
-    IdxPtr++;
-    *DtimPeriod = *IdxPtr;
-
-    // get Bitmap Control from TIM element
-    IdxPtr++;
-    BitCntl = *IdxPtr;
-
-    if ((*DtimCount == 0) && (BitCntl & 0x01))
-        *BcastFlag = TRUE;
-    else
-        *BcastFlag = FALSE;
-
-    // Parse Partial Virtual Bitmap from TIM element
-    N1 = BitCntl & 0xfe;    // N1 is the first bitmap byte#
-    N2 = *TimLen - 4 + N1;  // N2 is the last bitmap byte#
-
-    if ((Aid < (N1 << 3)) || (Aid >= ((N2 + 1) << 3)))
-        *MessageToMe = FALSE;
-    else
-    {
-        MyByte = (Aid >> 3) - N1;                       // my byte position in the bitmap byte-stream
-        MyBit = Aid % 16 - ((MyByte & 0x01)? 8:0);
-
-        IdxPtr += (MyByte + 1);
-
-        //if (*IdxPtr)
-        //    DBGPRINT(RT_DEBUG_WARN, ("TIM bitmap = 0x%02x\n", *IdxPtr));
-
-        if (*IdxPtr & (0x01 << MyBit))
-            *MessageToMe = TRUE;
-        else
-            *MessageToMe = FALSE;
-    }
-
-    return TRUE;
-}
diff --git a/drivers/staging/rt3090/sta/sync.c b/drivers/staging/rt3090/sta/sync.c
deleted file mode 100644
index 2520e038cb82..000000000000
--- a/drivers/staging/rt3090/sta/sync.c
+++ /dev/null
@@ -1,1840 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-	Module Name:
-	sync.c
-
-	Abstract:
-
-	Revision History:
-	Who			When			What
-	--------	----------		----------------------------------------------
-	John Chang	2004-09-01      modified for rt2561/2661
-	Jan Lee		2006-08-01      modified for rt2860 for 802.11n
-*/
-
-#include "../rt_config.h"
-
-
-#define ADHOC_ENTRY_BEACON_LOST_TIME	(2*OS_HZ)	// 2 sec
-
-/*
-	==========================================================================
-	Description:
-		The sync state machine,
-	Parameters:
-		Sm - pointer to the state machine
-	Note:
-		the state machine looks like the following
-
-	==========================================================================
- */
-VOID SyncStateMachineInit(
-	IN PRTMP_ADAPTER pAd,
-	IN STATE_MACHINE *Sm,
-	OUT STATE_MACHINE_FUNC Trans[])
-{
-	StateMachineInit(Sm, Trans, MAX_SYNC_STATE, MAX_SYNC_MSG, (STATE_MACHINE_FUNC)Drop, SYNC_IDLE, SYNC_MACHINE_BASE);
-
-	// column 1
-	StateMachineSetAction(Sm, SYNC_IDLE, MT2_MLME_SCAN_REQ, (STATE_MACHINE_FUNC)MlmeScanReqAction);
-	StateMachineSetAction(Sm, SYNC_IDLE, MT2_MLME_JOIN_REQ, (STATE_MACHINE_FUNC)MlmeJoinReqAction);
-	StateMachineSetAction(Sm, SYNC_IDLE, MT2_MLME_START_REQ, (STATE_MACHINE_FUNC)MlmeStartReqAction);
-	StateMachineSetAction(Sm, SYNC_IDLE, MT2_PEER_BEACON, (STATE_MACHINE_FUNC)PeerBeacon);
-	StateMachineSetAction(Sm, SYNC_IDLE, MT2_PEER_PROBE_REQ, (STATE_MACHINE_FUNC)PeerProbeReqAction);
-
-	//column 2
-	StateMachineSetAction(Sm, JOIN_WAIT_BEACON, MT2_MLME_SCAN_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenScan);
-	StateMachineSetAction(Sm, JOIN_WAIT_BEACON, MT2_MLME_JOIN_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenJoin);
-	StateMachineSetAction(Sm, JOIN_WAIT_BEACON, MT2_MLME_START_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenStart);
-	StateMachineSetAction(Sm, JOIN_WAIT_BEACON, MT2_PEER_BEACON, (STATE_MACHINE_FUNC)PeerBeaconAtJoinAction);
-	StateMachineSetAction(Sm, JOIN_WAIT_BEACON, MT2_BEACON_TIMEOUT, (STATE_MACHINE_FUNC)BeaconTimeoutAtJoinAction);
-
-	// column 3
-	StateMachineSetAction(Sm, SCAN_LISTEN, MT2_MLME_SCAN_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenScan);
-	StateMachineSetAction(Sm, SCAN_LISTEN, MT2_MLME_JOIN_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenJoin);
-	StateMachineSetAction(Sm, SCAN_LISTEN, MT2_MLME_START_REQ, (STATE_MACHINE_FUNC)InvalidStateWhenStart);
-	StateMachineSetAction(Sm, SCAN_LISTEN, MT2_PEER_BEACON, (STATE_MACHINE_FUNC)PeerBeaconAtScanAction);
-	StateMachineSetAction(Sm, SCAN_LISTEN, MT2_PEER_PROBE_RSP, (STATE_MACHINE_FUNC)PeerBeaconAtScanAction);
-	StateMachineSetAction(Sm, SCAN_LISTEN, MT2_SCAN_TIMEOUT, (STATE_MACHINE_FUNC)ScanTimeoutAction);
-
-	// timer init
-	RTMPInitTimer(pAd, &pAd->MlmeAux.BeaconTimer, GET_TIMER_FUNCTION(BeaconTimeout), pAd, FALSE);
-	RTMPInitTimer(pAd, &pAd->MlmeAux.ScanTimer, GET_TIMER_FUNCTION(ScanTimeout), pAd, FALSE);
-}
-
-/*
-	==========================================================================
-	Description:
-		Beacon timeout handler, executed in timer thread
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-VOID BeaconTimeout(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3)
-{
-	RTMP_ADAPTER *pAd = (RTMP_ADAPTER *)FunctionContext;
-
-	DBGPRINT(RT_DEBUG_TRACE,("SYNC - BeaconTimeout\n"));
-
-	// Do nothing if the driver is starting halt state.
-	// This might happen when timer already been fired before cancel timer with mlmehalt
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS))
-		return;
-
-#ifdef DOT11_N_SUPPORT
-	if ((pAd->CommonCfg.BBPCurrentBW == BW_40)
-		)
-	{
-		UCHAR        BBPValue = 0;
-		AsicSwitchChannel(pAd, pAd->CommonCfg.CentralChannel, FALSE);
-		AsicLockChannel(pAd, pAd->CommonCfg.CentralChannel);
-		RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R4, &BBPValue);
-		BBPValue &= (~0x18);
-		BBPValue |= 0x10;
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R4, BBPValue);
-		DBGPRINT(RT_DEBUG_TRACE, ("SYNC - End of SCAN, restore to 40MHz channel %d, Total BSS[%02d]\n",pAd->CommonCfg.CentralChannel, pAd->ScanTab.BssNr));
-	}
-#endif // DOT11_N_SUPPORT //
-
-	MlmeEnqueue(pAd, SYNC_STATE_MACHINE, MT2_BEACON_TIMEOUT, 0, NULL);
-	RTMP_MLME_HANDLER(pAd);
-}
-
-/*
-	==========================================================================
-	Description:
-		Scan timeout handler, executed in timer thread
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-VOID ScanTimeout(
-	IN PVOID SystemSpecific1,
-	IN PVOID FunctionContext,
-	IN PVOID SystemSpecific2,
-	IN PVOID SystemSpecific3)
-{
-	RTMP_ADAPTER *pAd = (RTMP_ADAPTER *)FunctionContext;
-
-
-	// Do nothing if the driver is starting halt state.
-	// This might happen when timer already been fired before cancel timer with mlmehalt
-	if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_HALT_IN_PROGRESS))
-		return;
-
-	if (MlmeEnqueue(pAd, SYNC_STATE_MACHINE, MT2_SCAN_TIMEOUT, 0, NULL))
-	{
-	RTMP_MLME_HANDLER(pAd);
-}
-	else
-	{
-		// To prevent SyncMachine.CurrState is SCAN_LISTEN forever.
-		pAd->MlmeAux.Channel = 0;
-		ScanNextChannel(pAd);
-		if (pAd->CommonCfg.bWirelessEvent)
-		{
-			RTMPSendWirelessEvent(pAd, IW_SCAN_ENQUEUE_FAIL_EVENT_FLAG, pAd->MacTab.Content[BSSID_WCID].Addr, BSS0, 0);
-		}
-	}
-}
-
-/*
-	==========================================================================
-	Description:
-		MLME SCAN req state machine procedure
-	==========================================================================
- */
-VOID MlmeScanReqAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-	UCHAR          Ssid[MAX_LEN_OF_SSID], SsidLen, ScanType, BssType, BBPValue = 0;
-	BOOLEAN        TimerCancelled;
-	ULONG		   Now;
-	USHORT         Status;
-	PHEADER_802_11 pHdr80211;
-	PUCHAR         pOutBuffer = NULL;
-	NDIS_STATUS    NStatus;
-
-	// Check the total scan tries for one single OID command
-	// If this is the CCX 2.0 Case, skip that!
-	if ( !RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_START_UP))
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("SYNC - MlmeScanReqAction before Startup\n"));
-		return;
-	}
-
-	// Increase the scan retry counters.
-	pAd->StaCfg.ScanCnt++;
-
-#ifdef RTMP_MAC_PCI
-    if ((OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE)) &&
-        (IDLE_ON(pAd)) &&
-		(pAd->StaCfg.bRadio == TRUE) &&
-		(RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_IDLE_RADIO_OFF)))
-	{
-	        if (pAd->StaCfg.PSControl.field.EnableNewPS == FALSE)
-		{
-			AsicSendCommandToMcu(pAd, 0x31, PowerWakeCID, 0x00, 0x02);
-			AsicCheckCommanOk(pAd, PowerWakeCID);
-			RTMP_CLEAR_FLAG(pAd, fRTMP_ADAPTER_IDLE_RADIO_OFF);
-			DBGPRINT(RT_DEBUG_TRACE, ("PSM - Issue Wake up command \n"));
-		}
-		else
-		{
-		RT28xxPciAsicRadioOn(pAd, GUI_IDLE_POWER_SAVE);
-	}
-	}
-#endif // RTMP_MAC_PCI //
-
-	// first check the parameter sanity
-	if (MlmeScanReqSanity(pAd,
-						  Elem->Msg,
-						  Elem->MsgLen,
-						  &BssType,
-						  (PCHAR)Ssid,
-						  &SsidLen,
-						  &ScanType))
-	{
-
-		// Check for channel load and noise hist request
-		// Suspend MSDU only at scan request, not the last two mentioned
-		// Suspend MSDU transmission here
-		RTMPSuspendMsduTransmission(pAd);
-
-		//
-		// To prevent data lost.
-		// Send an NULL data with turned PSM bit on to current associated AP before SCAN progress.
-		// And should send an NULL data with turned PSM bit off to AP, when scan progress done
-		//
-		if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED) && (INFRA_ON(pAd)))
-		{
-			NStatus = MlmeAllocateMemory(pAd, (PVOID)&pOutBuffer);
-			if (NStatus	== NDIS_STATUS_SUCCESS)
-			{
-				pHdr80211 = (PHEADER_802_11) pOutBuffer;
-				MgtMacHeaderInit(pAd, pHdr80211, SUBTYPE_NULL_FUNC, 1, pAd->CommonCfg.Bssid, pAd->CommonCfg.Bssid);
-				pHdr80211->Duration = 0;
-				pHdr80211->FC.Type = BTYPE_DATA;
-				pHdr80211->FC.PwrMgmt = PWR_SAVE;
-
-				// Send using priority queue
-				MiniportMMRequest(pAd, 0, pOutBuffer, sizeof(HEADER_802_11));
-				DBGPRINT(RT_DEBUG_TRACE, ("MlmeScanReqAction -- Send PSM Data frame for off channel RM\n"));
-				MlmeFreeMemory(pAd, pOutBuffer);
-				RTMPusecDelay(5000);
-			}
-		}
-
-		NdisGetSystemUpTime(&Now);
-		pAd->StaCfg.LastScanTime = Now;
-		// reset all the timers
-		RTMPCancelTimer(&pAd->MlmeAux.BeaconTimer, &TimerCancelled);
-		RTMPCancelTimer(&pAd->MlmeAux.ScanTimer, &TimerCancelled);
-
-		// record desired BSS parameters
-		pAd->MlmeAux.BssType = BssType;
-		pAd->MlmeAux.ScanType = ScanType;
-		pAd->MlmeAux.SsidLen = SsidLen;
-        NdisZeroMemory(pAd->MlmeAux.Ssid, MAX_LEN_OF_SSID);
-		NdisMoveMemory(pAd->MlmeAux.Ssid, Ssid, SsidLen);
-
-		// start from the first channel
-		pAd->MlmeAux.Channel = FirstChannel(pAd);
-
-		// Let BBP register at 20MHz to do scan
-		RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R4, &BBPValue);
-		BBPValue &= (~0x18);
-		RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R4, BBPValue);
-		DBGPRINT(RT_DEBUG_TRACE, ("SYNC - BBP R4 to 20MHz.l\n"));
-		ScanNextChannel(pAd);
-	}
-	else
-	{
-		DBGPRINT_ERR(("SYNC - MlmeScanReqAction() sanity check fail\n"));
-		pAd->Mlme.SyncMachine.CurrState = SYNC_IDLE;
-		Status = MLME_INVALID_FORMAT;
-		MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_SCAN_CONF, 2, &Status);
-	}
-}
-
-/*
-	==========================================================================
-	Description:
-		MLME JOIN req state machine procedure
-	==========================================================================
- */
-VOID MlmeJoinReqAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-	UCHAR        BBPValue = 0;
-	BSS_ENTRY    *pBss;
-	BOOLEAN       TimerCancelled;
-	HEADER_802_11 Hdr80211;
-	NDIS_STATUS   NStatus;
-	ULONG         FrameLen = 0;
-	PUCHAR        pOutBuffer = NULL;
-	PUCHAR        pSupRate = NULL;
-	UCHAR         SupRateLen;
-	PUCHAR        pExtRate = NULL;
-	UCHAR         ExtRateLen;
-	UCHAR         ASupRate[] = {0x8C, 0x12, 0x98, 0x24, 0xb0, 0x48, 0x60, 0x6C};
-	UCHAR         ASupRateLen = sizeof(ASupRate)/sizeof(UCHAR);
-	MLME_JOIN_REQ_STRUCT *pInfo = (MLME_JOIN_REQ_STRUCT *)(Elem->Msg);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("SYNC - MlmeJoinReqAction(BSS #%ld)\n", pInfo->BssIdx));
-
-#ifdef RTMP_MAC_PCI
-    if ((OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE)) &&
-        (IDLE_ON(pAd)) &&
-		(pAd->StaCfg.bRadio == TRUE) &&
-		(RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_IDLE_RADIO_OFF)))
-	{
-		RT28xxPciAsicRadioOn(pAd, GUI_IDLE_POWER_SAVE);
-	}
-#endif // RTMP_MAC_PCI //
-
-	// reset all the timers
-	RTMPCancelTimer(&pAd->MlmeAux.ScanTimer, &TimerCancelled);
-	RTMPCancelTimer(&pAd->MlmeAux.BeaconTimer, &TimerCancelled);
-
-	pBss = &pAd->MlmeAux.SsidBssTab.BssEntry[pInfo->BssIdx];
-
-	// record the desired SSID & BSSID we're waiting for
-	COPY_MAC_ADDR(pAd->MlmeAux.Bssid, pBss->Bssid);
-
-	// If AP's SSID is not hidden, it is OK for updating ssid to MlmeAux again.
-	if (pBss->Hidden == 0)
-	{
-		RTMPZeroMemory(pAd->MlmeAux.Ssid, MAX_LEN_OF_SSID);
-		NdisMoveMemory(pAd->MlmeAux.Ssid, pBss->Ssid, pBss->SsidLen);
-	pAd->MlmeAux.SsidLen = pBss->SsidLen;
-	}
-
-	pAd->MlmeAux.BssType = pBss->BssType;
-	pAd->MlmeAux.Channel = pBss->Channel;
-	pAd->MlmeAux.CentralChannel = pBss->CentralChannel;
-
-#ifdef EXT_BUILD_CHANNEL_LIST
-	// Country IE of the AP will be evaluated and will be used.
-	if ((pAd->StaCfg.IEEE80211dClientMode != Rt802_11_D_None) &&
-		(pBss->bHasCountryIE == TRUE))
-	{
-		NdisMoveMemory(&pAd->CommonCfg.CountryCode[0], &pBss->CountryString[0], 2);
-		if (pBss->CountryString[2] == 'I')
-			pAd->CommonCfg.Geography = IDOR;
-		else if (pBss->CountryString[2] == 'O')
-			pAd->CommonCfg.Geography = ODOR;
-		else
-			pAd->CommonCfg.Geography = BOTH;
-		BuildChannelListEx(pAd);
-	}
-#endif // EXT_BUILD_CHANNEL_LIST //
-
-	// Let BBP register at 20MHz to do scan
-	RTMP_BBP_IO_READ8_BY_REG_ID(pAd, BBP_R4, &BBPValue);
-	BBPValue &= (~0x18);
-	RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R4, BBPValue);
-	DBGPRINT(RT_DEBUG_TRACE, ("SYNC - BBP R4 to 20MHz.l\n"));
-
-	// switch channel and waiting for beacon timer
-	AsicSwitchChannel(pAd, pAd->MlmeAux.Channel, FALSE);
-	AsicLockChannel(pAd, pAd->MlmeAux.Channel);
-
-
-	RTMPSetTimer(&pAd->MlmeAux.BeaconTimer, JOIN_TIMEOUT);
-
-    do
-	{
-		if (((pAd->CommonCfg.bIEEE80211H == 1) &&
-            (pAd->MlmeAux.Channel > 14) &&
-             RadarChannelCheck(pAd, pAd->MlmeAux.Channel))
-#ifdef CARRIER_DETECTION_SUPPORT // Roger sync Carrier
-             || (pAd->CommonCfg.CarrierDetect.Enable == TRUE)
-#endif // CARRIER_DETECTION_SUPPORT //
-            )
-		{
-			//
-			// We can't send any Probe request frame to meet 802.11h.
-			//
-			if (pBss->Hidden == 0)
-			break;
-		}
-
-	//
-	// send probe request
-	//
-	NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);
-	if (NStatus == NDIS_STATUS_SUCCESS)
-	{
-		if (pAd->MlmeAux.Channel <= 14)
-		{
-			pSupRate = pAd->CommonCfg.SupRate;
-			SupRateLen = pAd->CommonCfg.SupRateLen;
-			pExtRate = pAd->CommonCfg.ExtRate;
-			ExtRateLen = pAd->CommonCfg.ExtRateLen;
-		}
-		else
-		{
-			//
-			// Overwrite Support Rate, CCK rate are not allowed
-			//
-			pSupRate = ASupRate;
-			SupRateLen = ASupRateLen;
-			ExtRateLen = 0;
-		}
-
-		if (pAd->MlmeAux.BssType == BSS_INFRA)
-			MgtMacHeaderInit(pAd, &Hdr80211, SUBTYPE_PROBE_REQ, 0, pAd->MlmeAux.Bssid, pAd->MlmeAux.Bssid);
-		else
-			MgtMacHeaderInit(pAd, &Hdr80211, SUBTYPE_PROBE_REQ, 0, BROADCAST_ADDR, BROADCAST_ADDR);
-
-		MakeOutgoingFrame(pOutBuffer,               &FrameLen,
-						  sizeof(HEADER_802_11),    &Hdr80211,
-						  1,                        &SsidIe,
-						  1,                        &pAd->MlmeAux.SsidLen,
-						  pAd->MlmeAux.SsidLen,	    pAd->MlmeAux.Ssid,
-						  1,                        &SupRateIe,
-						  1,                        &SupRateLen,
-						  SupRateLen,               pSupRate,
-						  END_OF_ARGS);
-
-		if (ExtRateLen)
-		{
-			ULONG Tmp;
-			MakeOutgoingFrame(pOutBuffer + FrameLen,            &Tmp,
-							  1,                                &ExtRateIe,
-							  1,                                &ExtRateLen,
-							  ExtRateLen,                       pExtRate,
-							  END_OF_ARGS);
-			FrameLen += Tmp;
-		}
-
-
-		MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
-		MlmeFreeMemory(pAd, pOutBuffer);
-	}
-    } while (FALSE);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("SYNC - Switch to ch %d, Wait BEACON from %02x:%02x:%02x:%02x:%02x:%02x\n",
-		pBss->Channel, pBss->Bssid[0], pBss->Bssid[1], pBss->Bssid[2], pBss->Bssid[3], pBss->Bssid[4], pBss->Bssid[5]));
-
-	pAd->Mlme.SyncMachine.CurrState = JOIN_WAIT_BEACON;
-}
-
-/*
-	==========================================================================
-	Description:
-		MLME START Request state machine procedure, starting an IBSS
-	==========================================================================
- */
-VOID MlmeStartReqAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-	UCHAR         Ssid[MAX_LEN_OF_SSID], SsidLen;
-	BOOLEAN       TimerCancelled;
-
-	// New for WPA security suites
-	UCHAR						VarIE[MAX_VIE_LEN];	// Total VIE length = MAX_VIE_LEN - -5
-	NDIS_802_11_VARIABLE_IEs	*pVIE = NULL;
-	LARGE_INTEGER				TimeStamp;
-	BOOLEAN Privacy;
-	USHORT Status;
-
-	// Init Variable IE structure
-	pVIE = (PNDIS_802_11_VARIABLE_IEs) VarIE;
-	pVIE->Length = 0;
-	TimeStamp.u.LowPart  = 0;
-	TimeStamp.u.HighPart = 0;
-
-	if (MlmeStartReqSanity(pAd, Elem->Msg, Elem->MsgLen, (PCHAR)Ssid, &SsidLen))
-	{
-		// reset all the timers
-		RTMPCancelTimer(&pAd->MlmeAux.ScanTimer, &TimerCancelled);
-		RTMPCancelTimer(&pAd->MlmeAux.BeaconTimer, &TimerCancelled);
-
-		//
-		// Start a new IBSS. All IBSS parameters are decided now....
-		//
-		DBGPRINT(RT_DEBUG_TRACE, ("MlmeStartReqAction - Start a new IBSS. All IBSS parameters are decided now.... \n"));
-		pAd->MlmeAux.BssType           = BSS_ADHOC;
-		NdisMoveMemory(pAd->MlmeAux.Ssid, Ssid, SsidLen);
-		pAd->MlmeAux.SsidLen           = SsidLen;
-
-		// generate a radom number as BSSID
-		MacAddrRandomBssid(pAd, pAd->MlmeAux.Bssid);
-		DBGPRINT(RT_DEBUG_TRACE, ("MlmeStartReqAction - generate a radom number as BSSID \n"));
-
-		Privacy = (pAd->StaCfg.WepStatus == Ndis802_11Encryption1Enabled) ||
-				  (pAd->StaCfg.WepStatus == Ndis802_11Encryption2Enabled) ||
-				  (pAd->StaCfg.WepStatus == Ndis802_11Encryption3Enabled);
-		pAd->MlmeAux.CapabilityInfo    = CAP_GENERATE(0,1,Privacy, (pAd->CommonCfg.TxPreamble == Rt802_11PreambleShort), 1, 0);
-		pAd->MlmeAux.BeaconPeriod      = pAd->CommonCfg.BeaconPeriod;
-		pAd->MlmeAux.AtimWin           = pAd->StaCfg.AtimWin;
-		pAd->MlmeAux.Channel           = pAd->CommonCfg.Channel;
-
-		pAd->CommonCfg.CentralChannel  = pAd->CommonCfg.Channel;
-		pAd->MlmeAux.CentralChannel    = pAd->CommonCfg.CentralChannel;
-
-		pAd->MlmeAux.SupRateLen= pAd->CommonCfg.SupRateLen;
-		NdisMoveMemory(pAd->MlmeAux.SupRate, pAd->CommonCfg.SupRate, MAX_LEN_OF_SUPPORTED_RATES);
-		RTMPCheckRates(pAd, pAd->MlmeAux.SupRate, &pAd->MlmeAux.SupRateLen);
-		pAd->MlmeAux.ExtRateLen = pAd->CommonCfg.ExtRateLen;
-		NdisMoveMemory(pAd->MlmeAux.ExtRate, pAd->CommonCfg.ExtRate, MAX_LEN_OF_SUPPORTED_RATES);
-		RTMPCheckRates(pAd, pAd->MlmeAux.ExtRate, &pAd->MlmeAux.ExtRateLen);
-#ifdef DOT11_N_SUPPORT
-		if (pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED)
-		{
-			RTMPUpdateHTIE(&pAd->CommonCfg.DesiredHtPhy, &pAd->StaCfg.DesiredHtPhyInfo.MCSSet[0], &pAd->MlmeAux.HtCapability, &pAd->MlmeAux.AddHtInfo);
-			pAd->MlmeAux.HtCapabilityLen = sizeof(HT_CAPABILITY_IE);
-			// Not turn pAd->StaActive.SupportedHtPhy.bHtEnable = TRUE here.
-			DBGPRINT(RT_DEBUG_TRACE, ("SYNC -pAd->StaActive.SupportedHtPhy.bHtEnable = TRUE\n"));
-		}
-		else
-#endif // DOT11_N_SUPPORT //
-		{
-			pAd->MlmeAux.HtCapabilityLen = 0;
-			pAd->StaActive.SupportedPhyInfo.bHtEnable = FALSE;
-			NdisZeroMemory(&pAd->StaActive.SupportedPhyInfo.MCSSet[0], 16);
-		}
-		// temporarily not support QOS in IBSS
-		NdisZeroMemory(&pAd->MlmeAux.APEdcaParm, sizeof(EDCA_PARM));
-		NdisZeroMemory(&pAd->MlmeAux.APQbssLoad, sizeof(QBSS_LOAD_PARM));
-		NdisZeroMemory(&pAd->MlmeAux.APQosCapability, sizeof(QOS_CAPABILITY_PARM));
-
-		AsicSwitchChannel(pAd, pAd->MlmeAux.Channel, FALSE);
-		AsicLockChannel(pAd, pAd->MlmeAux.Channel);
-
-		DBGPRINT(RT_DEBUG_TRACE, ("SYNC - MlmeStartReqAction(ch= %d,sup rates= %d, ext rates=%d)\n",
-			pAd->MlmeAux.Channel, pAd->MlmeAux.SupRateLen, pAd->MlmeAux.ExtRateLen));
-
-		pAd->Mlme.SyncMachine.CurrState = SYNC_IDLE;
-		Status = MLME_SUCCESS;
-		MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_START_CONF, 2, &Status);
-	}
-	else
-	{
-		DBGPRINT_ERR(("SYNC - MlmeStartReqAction() sanity check fail.\n"));
-		pAd->Mlme.SyncMachine.CurrState = SYNC_IDLE;
-		Status = MLME_INVALID_FORMAT;
-		MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_START_CONF, 2, &Status);
-	}
-}
-
-/*
-	==========================================================================
-	Description:
-		peer sends beacon back when scanning
-	==========================================================================
- */
-VOID PeerBeaconAtScanAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-	UCHAR           Bssid[MAC_ADDR_LEN], Addr2[MAC_ADDR_LEN];
-	UCHAR           Ssid[MAX_LEN_OF_SSID], BssType, Channel, NewChannel,
-					SsidLen, DtimCount, DtimPeriod, BcastFlag, MessageToMe;
-	CF_PARM         CfParm;
-	USHORT          BeaconPeriod, AtimWin, CapabilityInfo;
-	PFRAME_802_11   pFrame;
-	LARGE_INTEGER   TimeStamp;
-	UCHAR           Erp;
-	UCHAR		SupRate[MAX_LEN_OF_SUPPORTED_RATES], ExtRate[MAX_LEN_OF_SUPPORTED_RATES];
-	UCHAR			SupRateLen, ExtRateLen;
-	USHORT			LenVIE;
-	UCHAR			CkipFlag;
-	UCHAR			AironetCellPowerLimit;
-	EDCA_PARM       EdcaParm;
-	QBSS_LOAD_PARM  QbssLoad;
-	QOS_CAPABILITY_PARM QosCapability;
-	ULONG						RalinkIe;
-	UCHAR						VarIE[MAX_VIE_LEN];		// Total VIE length = MAX_VIE_LEN - -5
-	NDIS_802_11_VARIABLE_IEs	*pVIE = NULL;
-	HT_CAPABILITY_IE		HtCapability;
-	ADD_HT_INFO_IE		AddHtInfo;	// AP might use this additional ht info IE
-	UCHAR			HtCapabilityLen = 0, PreNHtCapabilityLen = 0;
-	UCHAR			AddHtInfoLen;
-	UCHAR			NewExtChannelOffset = 0xff;
-
-
-	// NdisFillMemory(Ssid, MAX_LEN_OF_SSID, 0x00);
-	pFrame = (PFRAME_802_11) Elem->Msg;
-	// Init Variable IE structure
-	pVIE = (PNDIS_802_11_VARIABLE_IEs) VarIE;
-	pVIE->Length = 0;
-#ifdef DOT11_N_SUPPORT
-    RTMPZeroMemory(&HtCapability, sizeof(HtCapability));
-	RTMPZeroMemory(&AddHtInfo, sizeof(ADD_HT_INFO_IE));
-#endif // DOT11_N_SUPPORT //
-
-	if (PeerBeaconAndProbeRspSanity(pAd,
-								Elem->Msg,
-								Elem->MsgLen,
-								Elem->Channel,
-								Addr2,
-								Bssid,
-								(PCHAR)Ssid,
-								&SsidLen,
-								&BssType,
-								&BeaconPeriod,
-								&Channel,
-								&NewChannel,
-								&TimeStamp,
-								&CfParm,
-								&AtimWin,
-								&CapabilityInfo,
-								&Erp,
-								&DtimCount,
-								&DtimPeriod,
-								&BcastFlag,
-								&MessageToMe,
-								SupRate,
-								&SupRateLen,
-								ExtRate,
-								&ExtRateLen,
-								&CkipFlag,
-								&AironetCellPowerLimit,
-								&EdcaParm,
-								&QbssLoad,
-								&QosCapability,
-								&RalinkIe,
-								&HtCapabilityLen,
-								&PreNHtCapabilityLen,
-								&HtCapability,
-								&AddHtInfoLen,
-								&AddHtInfo,
-								&NewExtChannelOffset,
-								&LenVIE,
-								pVIE))
-	{
-		ULONG Idx;
-		CHAR Rssi = 0;
-
-		Idx = BssTableSearch(&pAd->ScanTab, Bssid, Channel);
-		if (Idx != BSS_NOT_FOUND)
-			Rssi = pAd->ScanTab.BssEntry[Idx].Rssi;
-
-		Rssi = RTMPMaxRssi(pAd, ConvertToRssi(pAd, Elem->Rssi0, RSSI_0), ConvertToRssi(pAd, Elem->Rssi1, RSSI_1), ConvertToRssi(pAd, Elem->Rssi2, RSSI_2));
-
-
-#ifdef DOT11_N_SUPPORT
-		if ((HtCapabilityLen > 0) || (PreNHtCapabilityLen > 0))
-			HtCapabilityLen = SIZE_HT_CAP_IE;
-#endif // DOT11_N_SUPPORT //
-
-		Idx = BssTableSetEntry(pAd, &pAd->ScanTab, Bssid, (PCHAR)Ssid, SsidLen, BssType, BeaconPeriod,
-					  &CfParm, AtimWin, CapabilityInfo, SupRate, SupRateLen, ExtRate, ExtRateLen,  &HtCapability,
-					 &AddHtInfo, HtCapabilityLen, AddHtInfoLen, NewExtChannelOffset, Channel, Rssi, TimeStamp, CkipFlag,
-					 &EdcaParm, &QosCapability, &QbssLoad, LenVIE, pVIE);
-#ifdef DOT11_N_SUPPORT
-#ifdef DOT11N_DRAFT3
-		if (pAd->ChannelList[pAd->CommonCfg.ChannelListIdx].bEffectedChannel == TRUE)
-		{
-			UCHAR		RegClass;
-			PeerBeaconAndProbeRspSanity2(pAd, Elem->Msg, Elem->MsgLen, &RegClass);
-			TriEventTableSetEntry(pAd, &pAd->CommonCfg.TriggerEventTab, Bssid, &HtCapability, HtCapabilityLen, RegClass, Channel);
-		}
-#endif // DOT11N_DRAFT3 //
-#endif // DOT11_N_SUPPORT //
-		if (Idx != BSS_NOT_FOUND)
-		{
-			NdisMoveMemory(pAd->ScanTab.BssEntry[Idx].PTSF, &Elem->Msg[24], 4);
-			NdisMoveMemory(&pAd->ScanTab.BssEntry[Idx].TTSF[0], &Elem->TimeStamp.u.LowPart, 4);
-			NdisMoveMemory(&pAd->ScanTab.BssEntry[Idx].TTSF[4], &Elem->TimeStamp.u.LowPart, 4);
-		}
-
-	}
-	// sanity check fail, ignored
-}
-
-/*
-	==========================================================================
-	Description:
-		When waiting joining the (I)BSS, beacon received from external
-	==========================================================================
- */
-VOID PeerBeaconAtJoinAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-	UCHAR         Bssid[MAC_ADDR_LEN], Addr2[MAC_ADDR_LEN];
-	UCHAR         Ssid[MAX_LEN_OF_SSID], SsidLen, BssType, Channel, MessageToMe,
-				  DtimCount, DtimPeriod, BcastFlag, NewChannel;
-	LARGE_INTEGER TimeStamp;
-	USHORT        BeaconPeriod, AtimWin, CapabilityInfo;
-	CF_PARM       Cf;
-	BOOLEAN       TimerCancelled;
-	UCHAR         Erp;
-	UCHAR         SupRate[MAX_LEN_OF_SUPPORTED_RATES], ExtRate[MAX_LEN_OF_SUPPORTED_RATES];
-	UCHAR		  SupRateLen, ExtRateLen;
-	UCHAR         CkipFlag;
-	USHORT		  LenVIE;
-	UCHAR		  AironetCellPowerLimit;
-	EDCA_PARM       EdcaParm;
-	QBSS_LOAD_PARM  QbssLoad;
-	QOS_CAPABILITY_PARM QosCapability;
-	USHORT        Status;
-	UCHAR						VarIE[MAX_VIE_LEN];		// Total VIE length = MAX_VIE_LEN - -5
-	NDIS_802_11_VARIABLE_IEs	*pVIE = NULL;
-	ULONG           RalinkIe;
-	ULONG         Idx;
-	HT_CAPABILITY_IE		HtCapability;
-	ADD_HT_INFO_IE		AddHtInfo;	// AP might use this additional ht info IE
-	UCHAR				HtCapabilityLen = 0, PreNHtCapabilityLen = 0;
-	UCHAR			AddHtInfoLen;
-	UCHAR			NewExtChannelOffset = 0xff;
-#ifdef DOT11_N_SUPPORT
-	UCHAR			CentralChannel;
-	BOOLEAN			bAllowNrate = FALSE;
-#endif // DOT11_N_SUPPORT //
-
-	// Init Variable IE structure
-	pVIE = (PNDIS_802_11_VARIABLE_IEs) VarIE;
-	pVIE->Length = 0;
-    RTMPZeroMemory(&HtCapability, sizeof(HtCapability));
-	RTMPZeroMemory(&AddHtInfo, sizeof(ADD_HT_INFO_IE));
-
-
-	if (PeerBeaconAndProbeRspSanity(pAd,
-								Elem->Msg,
-								Elem->MsgLen,
-								Elem->Channel,
-								Addr2,
-								Bssid,
-								(PCHAR)Ssid,
-								&SsidLen,
-								&BssType,
-								&BeaconPeriod,
-								&Channel,
-								&NewChannel,
-								&TimeStamp,
-								&Cf,
-								&AtimWin,
-								&CapabilityInfo,
-								&Erp,
-								&DtimCount,
-								&DtimPeriod,
-								&BcastFlag,
-								&MessageToMe,
-								SupRate,
-								&SupRateLen,
-								ExtRate,
-								&ExtRateLen,
-								&CkipFlag,
-								&AironetCellPowerLimit,
-								&EdcaParm,
-								&QbssLoad,
-								&QosCapability,
-								&RalinkIe,
-								&HtCapabilityLen,
-								&PreNHtCapabilityLen,
-								&HtCapability,
-								&AddHtInfoLen,
-								&AddHtInfo,
-								&NewExtChannelOffset,
-								&LenVIE,
-								pVIE))
-	{
-		// Disqualify 11b only adhoc when we are in 11g only adhoc mode
-		if ((BssType == BSS_ADHOC) && (pAd->CommonCfg.PhyMode == PHY_11G) && ((SupRateLen+ExtRateLen)< 12))
-			return;
-
-		// BEACON from desired BSS/IBSS found. We should be able to decide most
-		// BSS parameters here.
-		// Q. But what happen if this JOIN doesn't conclude a successful ASSOCIATEION?
-		//    Do we need to receover back all parameters belonging to previous BSS?
-		// A. Should be not. There's no back-door recover to previous AP. It still need
-		//    a new JOIN-AUTH-ASSOC sequence.
-		if (MAC_ADDR_EQUAL(pAd->MlmeAux.Bssid, Bssid))
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("SYNC - receive desired BEACON at JoinWaitBeacon... Channel = %d\n", Channel));
-			RTMPCancelTimer(&pAd->MlmeAux.BeaconTimer, &TimerCancelled);
-
-			// Update RSSI to prevent No signal display when cards first initialized
-			pAd->StaCfg.RssiSample.LastRssi0	= ConvertToRssi(pAd, Elem->Rssi0, RSSI_0);
-			pAd->StaCfg.RssiSample.LastRssi1	= ConvertToRssi(pAd, Elem->Rssi1, RSSI_1);
-			pAd->StaCfg.RssiSample.LastRssi2	= ConvertToRssi(pAd, Elem->Rssi2, RSSI_2);
-			pAd->StaCfg.RssiSample.AvgRssi0	= pAd->StaCfg.RssiSample.LastRssi0;
-			pAd->StaCfg.RssiSample.AvgRssi0X8	= pAd->StaCfg.RssiSample.AvgRssi0 << 3;
-			pAd->StaCfg.RssiSample.AvgRssi1	= pAd->StaCfg.RssiSample.LastRssi1;
-			pAd->StaCfg.RssiSample.AvgRssi1X8	= pAd->StaCfg.RssiSample.AvgRssi1 << 3;
-			pAd->StaCfg.RssiSample.AvgRssi2	= pAd->StaCfg.RssiSample.LastRssi2;
-			pAd->StaCfg.RssiSample.AvgRssi2X8	= pAd->StaCfg.RssiSample.AvgRssi2 << 3;
-
-			//
-			// We need to check if SSID only set to any, then we can record the current SSID.
-			// Otherwise will cause hidden SSID association failed.
-			//
-			if (pAd->MlmeAux.SsidLen == 0)
-			{
-				NdisMoveMemory(pAd->MlmeAux.Ssid, Ssid, SsidLen);
-				pAd->MlmeAux.SsidLen = SsidLen;
-			}
-			else
-			{
-				Idx = BssSsidTableSearch(&pAd->ScanTab, Bssid, pAd->MlmeAux.Ssid, pAd->MlmeAux.SsidLen, Channel);
-
-				if (Idx == BSS_NOT_FOUND)
-				{
-					CHAR Rssi = 0;
-					Rssi = RTMPMaxRssi(pAd, ConvertToRssi(pAd, Elem->Rssi0, RSSI_0), ConvertToRssi(pAd, Elem->Rssi1, RSSI_1), ConvertToRssi(pAd, Elem->Rssi2, RSSI_2));
-					Idx = BssTableSetEntry(pAd, &pAd->ScanTab, Bssid, (CHAR *) Ssid, SsidLen, BssType, BeaconPeriod,
-										&Cf, AtimWin, CapabilityInfo, SupRate, SupRateLen, ExtRate, ExtRateLen,  &HtCapability,
-										&AddHtInfo, HtCapabilityLen, AddHtInfoLen, NewExtChannelOffset, Channel, Rssi, TimeStamp, CkipFlag,
-										&EdcaParm, &QosCapability, &QbssLoad, LenVIE, pVIE);
-					if (Idx != BSS_NOT_FOUND)
-					{
-						NdisMoveMemory(pAd->ScanTab.BssEntry[Idx].PTSF, &Elem->Msg[24], 4);
-						NdisMoveMemory(&pAd->ScanTab.BssEntry[Idx].TTSF[0], &Elem->TimeStamp.u.LowPart, 4);
-						NdisMoveMemory(&pAd->ScanTab.BssEntry[Idx].TTSF[4], &Elem->TimeStamp.u.LowPart, 4);
-						CapabilityInfo = pAd->ScanTab.BssEntry[Idx].CapabilityInfo;
-					}
-				}
-				else
-				{
-					//
-					// Multiple SSID case, used correct CapabilityInfo
-					//
-					CapabilityInfo = pAd->ScanTab.BssEntry[Idx].CapabilityInfo;
-				}
-			}
-			NdisMoveMemory(pAd->MlmeAux.Bssid, Bssid, MAC_ADDR_LEN);
-			pAd->MlmeAux.CapabilityInfo = CapabilityInfo & SUPPORTED_CAPABILITY_INFO;
-			pAd->MlmeAux.BssType = BssType;
-			pAd->MlmeAux.BeaconPeriod = BeaconPeriod;
-			pAd->MlmeAux.Channel = Channel;
-			pAd->MlmeAux.AtimWin = AtimWin;
-			pAd->MlmeAux.CfpPeriod = Cf.CfpPeriod;
-			pAd->MlmeAux.CfpMaxDuration = Cf.CfpMaxDuration;
-			pAd->MlmeAux.APRalinkIe = RalinkIe;
-
-			// Copy AP's supported rate to MlmeAux for creating assoication request
-			// Also filter out not supported rate
-			pAd->MlmeAux.SupRateLen = SupRateLen;
-			NdisMoveMemory(pAd->MlmeAux.SupRate, SupRate, SupRateLen);
-			RTMPCheckRates(pAd, pAd->MlmeAux.SupRate, &pAd->MlmeAux.SupRateLen);
-			pAd->MlmeAux.ExtRateLen = ExtRateLen;
-			NdisMoveMemory(pAd->MlmeAux.ExtRate, ExtRate, ExtRateLen);
-			RTMPCheckRates(pAd, pAd->MlmeAux.ExtRate, &pAd->MlmeAux.ExtRateLen);
-
-            NdisZeroMemory(pAd->StaActive.SupportedPhyInfo.MCSSet, 16);
-
-
-#ifdef DOT11_N_SUPPORT
-			if (((pAd->StaCfg.WepStatus != Ndis802_11WEPEnabled) && (pAd->StaCfg.WepStatus != Ndis802_11Encryption2Enabled))
-				|| (pAd->CommonCfg.HT_DisallowTKIP == FALSE))
-			{
-				bAllowNrate = TRUE;
-			}
-
-			pAd->MlmeAux.NewExtChannelOffset = NewExtChannelOffset;
-			pAd->MlmeAux.HtCapabilityLen = HtCapabilityLen;
-
-			RTMPZeroMemory(&pAd->MlmeAux.HtCapability, SIZE_HT_CAP_IE);
-			// filter out un-supported ht rates
-			if (((HtCapabilityLen > 0) || (PreNHtCapabilityLen > 0)) &&
-				((pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED) && (bAllowNrate)))
-			{
-				RTMPMoveMemory(&pAd->MlmeAux.AddHtInfo, &AddHtInfo, SIZE_ADD_HT_INFO_IE);
-
-				// StaActive.SupportedHtPhy.MCSSet stores Peer AP's 11n Rx capability
-				NdisMoveMemory(pAd->StaActive.SupportedPhyInfo.MCSSet, HtCapability.MCSSet, 16);
-				pAd->MlmeAux.NewExtChannelOffset = NewExtChannelOffset;
-				pAd->MlmeAux.HtCapabilityLen = SIZE_HT_CAP_IE;
-				pAd->StaActive.SupportedPhyInfo.bHtEnable = TRUE;
-				if (PreNHtCapabilityLen > 0)
-					pAd->StaActive.SupportedPhyInfo.bPreNHt = TRUE;
-				RTMPCheckHt(pAd, BSSID_WCID, &HtCapability, &AddHtInfo);
-				// Copy AP Parameter to StaActive.  This is also in LinkUp.
-				DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAtJoinAction! (MpduDensity=%d, MaxRAmpduFactor=%d, BW=%d)\n",
-					pAd->StaActive.SupportedHtPhy.MpduDensity, pAd->StaActive.SupportedHtPhy.MaxRAmpduFactor, HtCapability.HtCapInfo.ChannelWidth));
-
-				if (AddHtInfoLen > 0)
-				{
-					CentralChannel = AddHtInfo.ControlChan;
-					// Check again the Bandwidth capability of this AP.
-					if ((AddHtInfo.ControlChan > 2)&& (AddHtInfo.AddHtInfo.ExtChanOffset == EXTCHA_BELOW) && (HtCapability.HtCapInfo.ChannelWidth == BW_40))
-					{
-						CentralChannel = AddHtInfo.ControlChan - 2;
-					}
-					else if ((AddHtInfo.AddHtInfo.ExtChanOffset == EXTCHA_ABOVE) && (HtCapability.HtCapInfo.ChannelWidth == BW_40))
-					{
-						CentralChannel = AddHtInfo.ControlChan + 2;
-					}
-
-                    // Check Error .
-					if (pAd->MlmeAux.CentralChannel != CentralChannel)
-						DBGPRINT(RT_DEBUG_ERROR, ("PeerBeaconAtJoinAction HT===>Beacon Central Channel = %d, Control Channel = %d. Mlmeaux CentralChannel = %d\n", CentralChannel, AddHtInfo.ControlChan, pAd->MlmeAux.CentralChannel));
-
-					DBGPRINT(RT_DEBUG_TRACE, ("PeerBeaconAtJoinAction HT===>Central Channel = %d, Control Channel = %d,  .\n", CentralChannel, AddHtInfo.ControlChan));
-
-				}
-
-			}
-			else
-#endif // DOT11_N_SUPPORT //
-			{
-				// To prevent error, let legacy AP must have same CentralChannel and Channel.
-				if ((HtCapabilityLen == 0) && (PreNHtCapabilityLen == 0))
-					pAd->MlmeAux.CentralChannel = pAd->MlmeAux.Channel;
-
-				pAd->StaActive.SupportedPhyInfo.bHtEnable = FALSE;
-				pAd->MlmeAux.NewExtChannelOffset = 0xff;
-				RTMPZeroMemory(&pAd->MlmeAux.HtCapability, SIZE_HT_CAP_IE);
-				pAd->MlmeAux.HtCapabilityLen = 0;
-				RTMPZeroMemory(&pAd->MlmeAux.AddHtInfo, SIZE_ADD_HT_INFO_IE);
-			}
-
-			RTMPUpdateMlmeRate(pAd);
-
-			// copy QOS related information
-			if ((pAd->CommonCfg.bWmmCapable)
-#ifdef DOT11_N_SUPPORT
-				 || (pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED)
-#endif // DOT11_N_SUPPORT //
-				)
-			{
-				NdisMoveMemory(&pAd->MlmeAux.APEdcaParm, &EdcaParm, sizeof(EDCA_PARM));
-				NdisMoveMemory(&pAd->MlmeAux.APQbssLoad, &QbssLoad, sizeof(QBSS_LOAD_PARM));
-				NdisMoveMemory(&pAd->MlmeAux.APQosCapability, &QosCapability, sizeof(QOS_CAPABILITY_PARM));
-			}
-			else
-			{
-				NdisZeroMemory(&pAd->MlmeAux.APEdcaParm, sizeof(EDCA_PARM));
-				NdisZeroMemory(&pAd->MlmeAux.APQbssLoad, sizeof(QBSS_LOAD_PARM));
-				NdisZeroMemory(&pAd->MlmeAux.APQosCapability, sizeof(QOS_CAPABILITY_PARM));
-			}
-
-			DBGPRINT(RT_DEBUG_TRACE, ("SYNC - after JOIN, SupRateLen=%d, ExtRateLen=%d\n",
-				pAd->MlmeAux.SupRateLen, pAd->MlmeAux.ExtRateLen));
-
-			if (AironetCellPowerLimit != 0xFF)
-			{
-				//We need to change our TxPower for CCX 2.0 AP Control of Client Transmit Power
-				ChangeToCellPowerLimit(pAd, AironetCellPowerLimit);
-			}
-			else  //Used the default TX Power Percentage.
-				pAd->CommonCfg.TxPowerPercentage = pAd->CommonCfg.TxPowerDefault;
-
-			pAd->Mlme.SyncMachine.CurrState = SYNC_IDLE;
-			Status = MLME_SUCCESS;
-			MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_JOIN_CONF, 2, &Status);
-		}
-		// not to me BEACON, ignored
-	}
-	// sanity check fail, ignore this frame
-}
-
-/*
-	==========================================================================
-	Description:
-		receive BEACON from peer
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-VOID PeerBeacon(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-	UCHAR         Bssid[MAC_ADDR_LEN], Addr2[MAC_ADDR_LEN];
-	CHAR          Ssid[MAX_LEN_OF_SSID];
-	CF_PARM       CfParm;
-	UCHAR         SsidLen, MessageToMe=0, BssType, Channel, NewChannel, index=0;
-	UCHAR         DtimCount=0, DtimPeriod=0, BcastFlag=0;
-	USHORT        CapabilityInfo, AtimWin, BeaconPeriod;
-	LARGE_INTEGER TimeStamp;
-	USHORT        TbttNumToNextWakeUp;
-	UCHAR         Erp;
-	UCHAR         SupRate[MAX_LEN_OF_SUPPORTED_RATES], ExtRate[MAX_LEN_OF_SUPPORTED_RATES];
-	UCHAR		  SupRateLen, ExtRateLen;
-	UCHAR		  CkipFlag;
-	USHORT        LenVIE;
-	UCHAR		  AironetCellPowerLimit;
-	EDCA_PARM       EdcaParm;
-	QBSS_LOAD_PARM  QbssLoad;
-	QOS_CAPABILITY_PARM QosCapability;
-	ULONG           RalinkIe;
-	// New for WPA security suites
-	UCHAR						VarIE[MAX_VIE_LEN];		// Total VIE length = MAX_VIE_LEN - -5
-	NDIS_802_11_VARIABLE_IEs	*pVIE = NULL;
-	HT_CAPABILITY_IE		HtCapability;
-	ADD_HT_INFO_IE		AddHtInfo;	// AP might use this additional ht info IE
-	UCHAR			HtCapabilityLen, PreNHtCapabilityLen;
-	UCHAR			AddHtInfoLen;
-	UCHAR			NewExtChannelOffset = 0xff;
-
-
-#ifdef RALINK_ATE
-    if (ATE_ON(pAd))
-    {
-		return;
-    }
-#endif // RALINK_ATE //
-
-	if (!(INFRA_ON(pAd) || ADHOC_ON(pAd)
-		))
-		return;
-
-	// Init Variable IE structure
-	pVIE = (PNDIS_802_11_VARIABLE_IEs) VarIE;
-	pVIE->Length = 0;
-    RTMPZeroMemory(&HtCapability, sizeof(HtCapability));
-	RTMPZeroMemory(&AddHtInfo, sizeof(ADD_HT_INFO_IE));
-
-	if (PeerBeaconAndProbeRspSanity(pAd,
-								Elem->Msg,
-								Elem->MsgLen,
-								Elem->Channel,
-								Addr2,
-								Bssid,
-								Ssid,
-								&SsidLen,
-								&BssType,
-								&BeaconPeriod,
-								&Channel,
-								&NewChannel,
-								&TimeStamp,
-								&CfParm,
-								&AtimWin,
-								&CapabilityInfo,
-								&Erp,
-								&DtimCount,
-								&DtimPeriod,
-								&BcastFlag,
-								&MessageToMe,
-								SupRate,
-								&SupRateLen,
-								ExtRate,
-								&ExtRateLen,
-								&CkipFlag,
-								&AironetCellPowerLimit,
-								&EdcaParm,
-								&QbssLoad,
-								&QosCapability,
-								&RalinkIe,
-								&HtCapabilityLen,
-								&PreNHtCapabilityLen,
-								&HtCapability,
-								&AddHtInfoLen,
-								&AddHtInfo,
-								&NewExtChannelOffset,
-								&LenVIE,
-								pVIE))
-	{
-		BOOLEAN is_my_bssid, is_my_ssid;
-		ULONG   Bssidx, Now;
-		BSS_ENTRY *pBss;
-		CHAR		RealRssi = RTMPMaxRssi(pAd, ConvertToRssi(pAd, Elem->Rssi0, RSSI_0), ConvertToRssi(pAd, Elem->Rssi1, RSSI_1), ConvertToRssi(pAd, Elem->Rssi2, RSSI_2));
-
-		is_my_bssid = MAC_ADDR_EQUAL(Bssid, pAd->CommonCfg.Bssid)? TRUE : FALSE;
-		is_my_ssid = SSID_EQUAL(Ssid, SsidLen, pAd->CommonCfg.Ssid, pAd->CommonCfg.SsidLen)? TRUE:FALSE;
-
-
-		// ignore BEACON not for my SSID
-		if ((! is_my_ssid) && (! is_my_bssid))
-			return;
-
-		// It means STA waits disassoc completely from this AP, ignores this beacon.
-		if (pAd->Mlme.CntlMachine.CurrState == CNTL_WAIT_DISASSOC)
-			return;
-
-#ifdef DOT11_N_SUPPORT
-		// Copy Control channel for this BSSID.
-		if (AddHtInfoLen != 0)
-			Channel = AddHtInfo.ControlChan;
-
-		if ((HtCapabilityLen > 0) || (PreNHtCapabilityLen > 0))
-			HtCapabilityLen = SIZE_HT_CAP_IE;
-#endif // DOT11_N_SUPPORT //
-
-		//
-		// Housekeeping "SsidBssTab" table for later-on ROAMing usage.
-		//
-		Bssidx = BssTableSearch(&pAd->ScanTab, Bssid, Channel);
-		if (Bssidx == BSS_NOT_FOUND)
-		{
-			// discover new AP of this network, create BSS entry
-			Bssidx = BssTableSetEntry(pAd, &pAd->ScanTab, Bssid, Ssid, SsidLen, BssType, BeaconPeriod,
-						 &CfParm, AtimWin, CapabilityInfo, SupRate, SupRateLen, ExtRate, ExtRateLen,
-						&HtCapability, &AddHtInfo,HtCapabilityLen,AddHtInfoLen,NewExtChannelOffset, Channel,
-						RealRssi, TimeStamp, CkipFlag, &EdcaParm, &QosCapability,
-						&QbssLoad, LenVIE, pVIE);
-			if (Bssidx == BSS_NOT_FOUND) // return if BSS table full
-				return;
-
-			NdisMoveMemory(pAd->ScanTab.BssEntry[Bssidx].PTSF, &Elem->Msg[24], 4);
-			NdisMoveMemory(&pAd->ScanTab.BssEntry[Bssidx].TTSF[0], &Elem->TimeStamp.u.LowPart, 4);
-			NdisMoveMemory(&pAd->ScanTab.BssEntry[Bssidx].TTSF[4], &Elem->TimeStamp.u.LowPart, 4);
-
-
-
-		}
-
-		if ((pAd->CommonCfg.bIEEE80211H == 1) && (NewChannel != 0) && (Channel != NewChannel))
-		{
-			// Switching to channel 1 can prevent from rescanning the current channel immediately (by auto reconnection).
-			// In addition, clear the MLME queue and the scan table to discard the RX packets and previous scanning results.
-			AsicSwitchChannel(pAd, 1, FALSE);
-			AsicLockChannel(pAd, 1);
-		    LinkDown(pAd, FALSE);
-			MlmeQueueInit(&pAd->Mlme.Queue);
-			BssTableInit(&pAd->ScanTab);
-		    RTMPusecDelay(1000000);		// use delay to prevent STA do reassoc
-
-			// channel sanity check
-			for (index = 0 ; index < pAd->ChannelListNum; index++)
-			{
-				if (pAd->ChannelList[index].Channel == NewChannel)
-				{
-					pAd->ScanTab.BssEntry[Bssidx].Channel = NewChannel;
-					pAd->CommonCfg.Channel = NewChannel;
-					AsicSwitchChannel(pAd, pAd->CommonCfg.Channel, FALSE);
-					AsicLockChannel(pAd, pAd->CommonCfg.Channel);
-					DBGPRINT(RT_DEBUG_TRACE, ("PeerBeacon - STA receive channel switch announcement IE (New Channel =%d)\n", NewChannel));
-					break;
-				}
-			}
-
-			if (index >= pAd->ChannelListNum)
-			{
-				DBGPRINT_ERR(("PeerBeacon(can not find New Channel=%d in ChannelList[%d]\n", pAd->CommonCfg.Channel, pAd->ChannelListNum));
-			}
-		}
-
-		// if the ssid matched & bssid unmatched, we should select the bssid with large value.
-		// This might happened when two STA start at the same time
-		if ((! is_my_bssid) && ADHOC_ON(pAd))
-		{
-			INT	i;
-
-			// Add the safeguard against the mismatch of adhoc wep status
-			if (pAd->StaCfg.WepStatus != pAd->ScanTab.BssEntry[Bssidx].WepStatus)
-			{
-				return;
-			}
-
-			// collapse into the ADHOC network which has bigger BSSID value.
-			for (i = 0; i < 6; i++)
-			{
-				if (Bssid[i] > pAd->CommonCfg.Bssid[i])
-				{
-					DBGPRINT(RT_DEBUG_TRACE, ("SYNC - merge to the IBSS with bigger BSSID=%02x:%02x:%02x:%02x:%02x:%02x\n",
-						Bssid[0], Bssid[1], Bssid[2], Bssid[3], Bssid[4], Bssid[5]));
-					AsicDisableSync(pAd);
-					COPY_MAC_ADDR(pAd->CommonCfg.Bssid, Bssid);
-					AsicSetBssid(pAd, pAd->CommonCfg.Bssid);
-					MakeIbssBeacon(pAd);        // re-build BEACON frame
-					AsicEnableIbssSync(pAd);    // copy BEACON frame to on-chip memory
-					is_my_bssid = TRUE;
-					break;
-				}
-				else if (Bssid[i] < pAd->CommonCfg.Bssid[i])
-					break;
-			}
-		}
-
-
-		NdisGetSystemUpTime(&Now);
-		pBss = &pAd->ScanTab.BssEntry[Bssidx];
-		pBss->Rssi = RealRssi;       // lastest RSSI
-		pBss->LastBeaconRxTime = Now;   // last RX timestamp
-
-		//
-		// BEACON from my BSSID - either IBSS or INFRA network
-		//
-		if (is_my_bssid)
-		{
-			RXWI_STRUC	RxWI;
-
-			pAd->StaCfg.DtimCount = DtimCount;
-			pAd->StaCfg.DtimPeriod = DtimPeriod;
-			pAd->StaCfg.LastBeaconRxTime = Now;
-
-
-			RxWI.RSSI0 = Elem->Rssi0;
-			RxWI.RSSI1 = Elem->Rssi1;
-			RxWI.RSSI2 = Elem->Rssi2;
-
-			Update_Rssi_Sample(pAd, &pAd->StaCfg.RssiSample, &RxWI);
-			if (AironetCellPowerLimit != 0xFF)
-			{
-				//
-				// We get the Cisco (ccx) "TxPower Limit" required
-				// Changed to appropriate TxPower Limit for Ciso Compatible Extensions
-				//
-				ChangeToCellPowerLimit(pAd, AironetCellPowerLimit);
-			}
-			else
-			{
-				//
-				// AironetCellPowerLimit equal to 0xFF means the Cisco (ccx) "TxPower Limit" not exist.
-				// Used the default TX Power Percentage, that set from UI.
-				//
-				pAd->CommonCfg.TxPowerPercentage = pAd->CommonCfg.TxPowerDefault;
-			}
-
-			if (ADHOC_ON(pAd) && (CAP_IS_IBSS_ON(CapabilityInfo)))
-			{
-				UCHAR			MaxSupportedRateIn500Kbps = 0;
-				UCHAR			idx;
-				MAC_TABLE_ENTRY *pEntry;
-
-				// supported rates array may not be sorted. sort it and find the maximum rate
-			    for (idx=0; idx<SupRateLen; idx++)
-				{
-			        if (MaxSupportedRateIn500Kbps < (SupRate[idx] & 0x7f))
-			            MaxSupportedRateIn500Kbps = SupRate[idx] & 0x7f;
-						}
-
-				for (idx=0; idx<ExtRateLen; idx++)
-			    {
-			        if (MaxSupportedRateIn500Kbps < (ExtRate[idx] & 0x7f))
-			            MaxSupportedRateIn500Kbps = ExtRate[idx] & 0x7f;
-					}
-
-				// look up the existing table
-				pEntry = MacTableLookup(pAd, Addr2);
-
-				// Ad-hoc mode is using MAC address as BA session. So we need to continuously find newly joined adhoc station by receiving beacon.
-				// To prevent always check this, we use wcid == RESERVED_WCID to recognize it as newly joined adhoc station.
-				if ((ADHOC_ON(pAd) && (Elem->Wcid == RESERVED_WCID)) ||
-					(pEntry && ((pEntry->LastBeaconRxTime + ADHOC_ENTRY_BEACON_LOST_TIME) < Now)))
-						{
-					if (pEntry == NULL)
-						// Another adhoc joining, add to our MAC table.
-						pEntry = MacTableInsertEntry(pAd, Addr2, BSS0, FALSE);
-
-					if (StaAddMacTableEntry(pAd,
-											pEntry,
-											MaxSupportedRateIn500Kbps,
-											&HtCapability,
-											HtCapabilityLen,
-											&AddHtInfo,
-											AddHtInfoLen,
-											CapabilityInfo) == FALSE)
-					{
-						DBGPRINT(RT_DEBUG_TRACE, ("ADHOC - Add Entry failed.\n"));
-						return;
-					}
-
-					if (pEntry &&
-						(Elem->Wcid == RESERVED_WCID))
-				{
-						idx = pAd->StaCfg.DefaultKeyId;
-						RTMP_STA_SECURITY_INFO_ADD(pAd, BSS0, idx, pEntry);
-				}
-				}
-
-				if (pEntry && pEntry->ValidAsCLI)
-					pEntry->LastBeaconRxTime = Now;
-
-				// At least another peer in this IBSS, declare MediaState as CONNECTED
-				if (!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED))
-				{
-					OPSTATUS_SET_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED);
-
-					pAd->IndicateMediaState = NdisMediaStateConnected;
-					RTMP_IndicateMediaState(pAd);
-	                pAd->ExtraInfo = GENERAL_LINK_UP;
-					AsicSetBssid(pAd, pAd->CommonCfg.Bssid);
-
-					// 2003/03/12 - john
-					// Make sure this entry in "ScanTab" table, thus complies to Microsoft's policy that
-					// "site survey" result should always include the current connected network.
-					//
-					Bssidx = BssTableSearch(&pAd->ScanTab, Bssid, Channel);
-					if (Bssidx == BSS_NOT_FOUND)
-					{
-						Bssidx = BssTableSetEntry(pAd, &pAd->ScanTab, Bssid, Ssid, SsidLen, BssType, BeaconPeriod,
-									&CfParm, AtimWin, CapabilityInfo, SupRate, SupRateLen, ExtRate, ExtRateLen, &HtCapability,
-									&AddHtInfo, HtCapabilityLen, AddHtInfoLen, NewExtChannelOffset, Channel, RealRssi, TimeStamp, 0,
-									&EdcaParm, &QosCapability, &QbssLoad, LenVIE, pVIE);
-					}
-					DBGPRINT(RT_DEBUG_TRACE, ("ADHOC  fOP_STATUS_MEDIA_STATE_CONNECTED.\n"));
-				}
-			}
-
-			if (INFRA_ON(pAd))
-			{
-				BOOLEAN bUseShortSlot, bUseBGProtection;
-
-				// decide to use/change to -
-				//      1. long slot (20 us) or short slot (9 us) time
-				//      2. turn on/off RTS/CTS and/or CTS-to-self protection
-				//      3. short preamble
-
-				//bUseShortSlot = pAd->CommonCfg.bUseShortSlotTime && CAP_IS_SHORT_SLOT(CapabilityInfo);
-				bUseShortSlot = CAP_IS_SHORT_SLOT(CapabilityInfo);
-				if (bUseShortSlot != OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_SHORT_SLOT_INUSED))
-					AsicSetSlotTime(pAd, bUseShortSlot);
-
-				bUseBGProtection = (pAd->CommonCfg.UseBGProtection == 1) ||    // always use
-								   ((pAd->CommonCfg.UseBGProtection == 0) && ERP_IS_USE_PROTECTION(Erp));
-
-				if (pAd->CommonCfg.Channel > 14) // always no BG protection in A-band. falsely happened when switching A/G band to a dual-band AP
-					bUseBGProtection = FALSE;
-
-				if (bUseBGProtection != OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_BG_PROTECTION_INUSED))
-				{
-					if (bUseBGProtection)
-					{
-						OPSTATUS_SET_FLAG(pAd, fOP_STATUS_BG_PROTECTION_INUSED);
-						AsicUpdateProtect(pAd, pAd->MlmeAux.AddHtInfo.AddHtInfo2.OperaionMode, (OFDMSETPROTECT|CCKSETPROTECT|ALLN_SETPROTECT),FALSE,(pAd->MlmeAux.AddHtInfo.AddHtInfo2.NonGfPresent == 1));
-					}
-					else
-					{
-						OPSTATUS_CLEAR_FLAG(pAd, fOP_STATUS_BG_PROTECTION_INUSED);
-						AsicUpdateProtect(pAd, pAd->MlmeAux.AddHtInfo.AddHtInfo2.OperaionMode, (OFDMSETPROTECT|CCKSETPROTECT|ALLN_SETPROTECT),TRUE,(pAd->MlmeAux.AddHtInfo.AddHtInfo2.NonGfPresent == 1));
-					}
-
-					DBGPRINT(RT_DEBUG_WARN, ("SYNC - AP changed B/G protection to %d\n", bUseBGProtection));
-				}
-
-#ifdef DOT11_N_SUPPORT
-				// check Ht protection mode. and adhere to the Non-GF device indication by AP.
-				if ((AddHtInfoLen != 0) &&
-					((AddHtInfo.AddHtInfo2.OperaionMode != pAd->MlmeAux.AddHtInfo.AddHtInfo2.OperaionMode) ||
-					(AddHtInfo.AddHtInfo2.NonGfPresent != pAd->MlmeAux.AddHtInfo.AddHtInfo2.NonGfPresent)))
-				{
-					pAd->MlmeAux.AddHtInfo.AddHtInfo2.NonGfPresent = AddHtInfo.AddHtInfo2.NonGfPresent;
-					pAd->MlmeAux.AddHtInfo.AddHtInfo2.OperaionMode = AddHtInfo.AddHtInfo2.OperaionMode;
-					if (pAd->MlmeAux.AddHtInfo.AddHtInfo2.NonGfPresent == 1)
-				{
-						AsicUpdateProtect(pAd, pAd->MlmeAux.AddHtInfo.AddHtInfo2.OperaionMode, ALLN_SETPROTECT, FALSE, TRUE);
-					}
-					else
-						AsicUpdateProtect(pAd, pAd->MlmeAux.AddHtInfo.AddHtInfo2.OperaionMode, ALLN_SETPROTECT, FALSE, FALSE);
-
-					DBGPRINT(RT_DEBUG_TRACE, ("SYNC - AP changed N OperaionMode to %d\n", pAd->MlmeAux.AddHtInfo.AddHtInfo2.OperaionMode));
-				}
-#endif // DOT11_N_SUPPORT //
-
-				if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_SHORT_PREAMBLE_INUSED) &&
-					ERP_IS_USE_BARKER_PREAMBLE(Erp))
-				{
-					MlmeSetTxPreamble(pAd, Rt802_11PreambleLong);
-					DBGPRINT(RT_DEBUG_TRACE, ("SYNC - AP forced to use LONG preamble\n"));
-				}
-
-				if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_WMM_INUSED)    &&
-					(EdcaParm.bValid == TRUE)                          &&
-					(EdcaParm.EdcaUpdateCount != pAd->CommonCfg.APEdcaParm.EdcaUpdateCount))
-				{
-					DBGPRINT(RT_DEBUG_TRACE, ("SYNC - AP change EDCA parameters(from %d to %d)\n",
-						pAd->CommonCfg.APEdcaParm.EdcaUpdateCount,
-						EdcaParm.EdcaUpdateCount));
-					AsicSetEdcaParm(pAd, &EdcaParm);
-				}
-
-				// copy QOS related information
-				NdisMoveMemory(&pAd->CommonCfg.APQbssLoad, &QbssLoad, sizeof(QBSS_LOAD_PARM));
-				NdisMoveMemory(&pAd->CommonCfg.APQosCapability, &QosCapability, sizeof(QOS_CAPABILITY_PARM));
-			}
-
-			// only INFRASTRUCTURE mode support power-saving feature
-			if ((INFRA_ON(pAd) && (pAd->StaCfg.Psm == PWR_SAVE)) || (pAd->CommonCfg.bAPSDForcePowerSave))
-			{
-				UCHAR FreeNumber;
-				//  1. AP has backlogged unicast-to-me frame, stay AWAKE, send PSPOLL
-				//  2. AP has backlogged broadcast/multicast frame and we want those frames, stay AWAKE
-				//  3. we have outgoing frames in TxRing or MgmtRing, better stay AWAKE
-				//  4. Psm change to PWR_SAVE, but AP not been informed yet, we better stay AWAKE
-				//  5. otherwise, put PHY back to sleep to save battery.
-				if (MessageToMe)
-				{
-#ifdef RTMP_MAC_PCI
-					if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE))
-					{
-						// Restore to correct BBP R3 value
-						if (pAd->Antenna.field.RxPath > 1)
-						RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R3, pAd->StaCfg.BBPR3);
-						// Turn clk to 80Mhz.
-					}
-#endif // RTMP_MAC_PCI //
-					if (pAd->CommonCfg.bAPSDCapable && pAd->CommonCfg.APEdcaParm.bAPSDCapable &&
-						pAd->CommonCfg.bAPSDAC_BE && pAd->CommonCfg.bAPSDAC_BK && pAd->CommonCfg.bAPSDAC_VI && pAd->CommonCfg.bAPSDAC_VO)
-					{
-						pAd->CommonCfg.bNeedSendTriggerFrame = TRUE;
-					}
-					else
-						RTMP_PS_POLL_ENQUEUE(pAd);
-				}
-				else if (BcastFlag && (DtimCount == 0) && OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_RECEIVE_DTIM))
-				{
-#ifdef RTMP_MAC_PCI
-					if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE))
-					{
-						if (pAd->Antenna.field.RxPath > 1)
-						RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R3, pAd->StaCfg.BBPR3);
-					}
-#endif // RTMP_MAC_PCI //
-				}
-				else if ((pAd->TxSwQueue[QID_AC_BK].Number != 0)													||
-						(pAd->TxSwQueue[QID_AC_BE].Number != 0)														||
-						(pAd->TxSwQueue[QID_AC_VI].Number != 0)														||
-						(pAd->TxSwQueue[QID_AC_VO].Number != 0)														||
-						(RTMPFreeTXDRequest(pAd, QID_AC_BK, TX_RING_SIZE - 1, &FreeNumber) != NDIS_STATUS_SUCCESS)	||
-						(RTMPFreeTXDRequest(pAd, QID_AC_BE, TX_RING_SIZE - 1, &FreeNumber) != NDIS_STATUS_SUCCESS)	||
-						(RTMPFreeTXDRequest(pAd, QID_AC_VI, TX_RING_SIZE - 1, &FreeNumber) != NDIS_STATUS_SUCCESS)	||
-						(RTMPFreeTXDRequest(pAd, QID_AC_VO, TX_RING_SIZE - 1, &FreeNumber) != NDIS_STATUS_SUCCESS)	||
-						(RTMPFreeTXDRequest(pAd, QID_MGMT, MGMT_RING_SIZE - 1, &FreeNumber) != NDIS_STATUS_SUCCESS))
-				{
-					// TODO: consider scheduled HCCA. might not be proper to use traditional DTIM-based power-saving scheme
-					// can we cheat here (i.e. just check MGMT & AC_BE) for better performance?
-#ifdef RTMP_MAC_PCI
-					if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_PCIE_DEVICE))
-					{
-						if (pAd->Antenna.field.RxPath > 1)
-						RTMP_BBP_IO_WRITE8_BY_REG_ID(pAd, BBP_R3, pAd->StaCfg.BBPR3);
-					}
-#endif // RTMP_MAC_PCI //
-				}
-				else
-				{
-					if ((pAd->CommonCfg.bACMAPSDTr[QID_AC_VO]) ||
-						(pAd->CommonCfg.bACMAPSDTr[QID_AC_VI]) ||
-						(pAd->CommonCfg.bACMAPSDTr[QID_AC_BK]) ||
-						(pAd->CommonCfg.bACMAPSDTr[QID_AC_BE]))
-					{
-						/*
-							WMM Spec v1.0 3.6.2.4,
-							The WMM STA shall remain awake until it receives a
-							QoS Data or Null frame addressed to it, with the
-							EOSP subfield in QoS Control field set to 1.
-
-							So we can not sleep here or we will suffer a case:
-
-							PS Management Frame -->
-							Trigger frame -->
-							Beacon (TIM=0) (Beacon is closer to Trig frame) -->
-							Station goes to sleep -->
-							AP delivery queued UAPSD packets -->
-							Station can NOT receive the reply
-
-							Maybe we need a timeout timer to avoid that we do
-							NOT receive the EOSP frame.
-
-							We can not use More Data to check if SP is ended
-							due to MaxSPLength.
-						*/
-					}
-					else
-					{
-						USHORT NextDtim = DtimCount;
-
-
-						if (NextDtim == 0)
-							NextDtim = DtimPeriod;
-
-						TbttNumToNextWakeUp = pAd->StaCfg.DefaultListenCount;
-						if (OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_RECEIVE_DTIM) && (TbttNumToNextWakeUp > NextDtim))
-							TbttNumToNextWakeUp = NextDtim;
-
-						if (!OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_DOZE))
-						{
-							// Set a flag to go to sleep . Then after parse this RxDoneInterrupt, will go to sleep mode.
-							pAd->ThisTbttNumToNextWakeUp = TbttNumToNextWakeUp;
-		                                        AsicSleepThenAutoWakeup(pAd, pAd->ThisTbttNumToNextWakeUp);
-
-						}
-					}
-				}
-			}
-		}
-		// not my BSSID, ignore it
-	}
-	// sanity check fail, ignore this frame
-}
-
-/*
-	==========================================================================
-	Description:
-		Receive PROBE REQ from remote peer when operating in IBSS mode
-	==========================================================================
- */
-VOID PeerProbeReqAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-	UCHAR         Addr2[MAC_ADDR_LEN];
-	CHAR          Ssid[MAX_LEN_OF_SSID];
-	UCHAR         SsidLen;
-#ifdef DOT11_N_SUPPORT
-	UCHAR		  HtLen, AddHtLen, NewExtLen;
-#endif // DOT11_N_SUPPORT //
-	HEADER_802_11 ProbeRspHdr;
-	NDIS_STATUS   NStatus;
-	PUCHAR        pOutBuffer = NULL;
-	ULONG         FrameLen = 0;
-	LARGE_INTEGER FakeTimestamp;
-	UCHAR         DsLen = 1, IbssLen = 2;
-	UCHAR         LocalErpIe[3] = {IE_ERP, 1, 0};
-	BOOLEAN       Privacy;
-	USHORT        CapabilityInfo;
-	UCHAR		  RSNIe = IE_WPA;
-
-	if (! ADHOC_ON(pAd))
-		return;
-
-	if (PeerProbeReqSanity(pAd, Elem->Msg, Elem->MsgLen, Addr2, Ssid, &SsidLen))
-	{
-		if ((SsidLen == 0) || SSID_EQUAL(Ssid, SsidLen, pAd->CommonCfg.Ssid, pAd->CommonCfg.SsidLen))
-		{
-			// allocate and send out ProbeRsp frame
-			NStatus = MlmeAllocateMemory(pAd, &pOutBuffer);  //Get an unused nonpaged memory
-			if (NStatus != NDIS_STATUS_SUCCESS)
-				return;
-
-			//pAd->StaCfg.AtimWin = 0;  // ??????
-
-			Privacy = (pAd->StaCfg.WepStatus == Ndis802_11Encryption1Enabled) ||
-					  (pAd->StaCfg.WepStatus == Ndis802_11Encryption2Enabled) ||
-					  (pAd->StaCfg.WepStatus == Ndis802_11Encryption3Enabled);
-			CapabilityInfo = CAP_GENERATE(0, 1, Privacy, (pAd->CommonCfg.TxPreamble == Rt802_11PreambleShort), 0, 0);
-
-			MakeOutgoingFrame(pOutBuffer,                   &FrameLen,
-							  sizeof(HEADER_802_11),        &ProbeRspHdr,
-							  TIMESTAMP_LEN,                &FakeTimestamp,
-							  2,                            &pAd->CommonCfg.BeaconPeriod,
-							  2,                            &CapabilityInfo,
-							  1,                            &SsidIe,
-							  1,                            &pAd->CommonCfg.SsidLen,
-							  pAd->CommonCfg.SsidLen,       pAd->CommonCfg.Ssid,
-							  1,                            &SupRateIe,
-							  1,                            &pAd->StaActive.SupRateLen,
-							  pAd->StaActive.SupRateLen,    pAd->StaActive.SupRate,
-							  1,                            &DsIe,
-							  1,                            &DsLen,
-							  1,                            &pAd->CommonCfg.Channel,
-							  1,                            &IbssIe,
-							  1,                            &IbssLen,
-							  2,                            &pAd->StaActive.AtimWin,
-							  END_OF_ARGS);
-
-			if (pAd->StaActive.ExtRateLen)
-			{
-				ULONG tmp;
-				MakeOutgoingFrame(pOutBuffer + FrameLen,        &tmp,
-								  3,                            LocalErpIe,
-								  1,                            &ExtRateIe,
-								  1,                            &pAd->StaActive.ExtRateLen,
-								  pAd->StaActive.ExtRateLen,    &pAd->StaActive.ExtRate,
-								  END_OF_ARGS);
-				FrameLen += tmp;
-			}
-
-			// If adhoc secruity is set for WPA-None, append the cipher suite IE
-			if (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPANone)
-			{
-				ULONG tmp;
-				MakeOutgoingFrame(pOutBuffer + FrameLen,		&tmp,
-									1,                              &RSNIe,
-									1,				&pAd->StaCfg.RSNIE_Len,
-									pAd->StaCfg.RSNIE_Len,		pAd->StaCfg.RSN_IE,
-									END_OF_ARGS);
-				FrameLen += tmp;
-			}
-#ifdef DOT11_N_SUPPORT
-			if (pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED)
-			{
-				ULONG TmpLen;
-				UCHAR	BROADCOM[4] = {0x0, 0x90, 0x4c, 0x33};
-				HtLen = sizeof(pAd->CommonCfg.HtCapability);
-				AddHtLen = sizeof(pAd->CommonCfg.AddHTInfo);
-				NewExtLen = 1;
-				//New extension channel offset IE is included in Beacon, Probe Rsp or channel Switch Announcement Frame
-				if (pAd->bBroadComHT == TRUE)
-				{
-					MakeOutgoingFrame(pOutBuffer + FrameLen,            &TmpLen,
-								  1,                                &WpaIe,
-								  4,                                &BROADCOM[0],
-								 pAd->MlmeAux.HtCapabilityLen,          &pAd->MlmeAux.HtCapability,
-								  END_OF_ARGS);
-				}
-				else
-				{
-				MakeOutgoingFrame(pOutBuffer + FrameLen,            &TmpLen,
-								  1,                                &HtCapIe,
-								  1,                                &HtLen,
-								 sizeof(HT_CAPABILITY_IE),          &pAd->CommonCfg.HtCapability,
-								  1,                                &AddHtInfoIe,
-								  1,                                &AddHtLen,
-								 sizeof(ADD_HT_INFO_IE),          &pAd->CommonCfg.AddHTInfo,
-								  1,                                &NewExtChanIe,
-								  1,                                &NewExtLen,
-								 sizeof(NEW_EXT_CHAN_IE),          &pAd->CommonCfg.NewExtChanOffset,
-								  END_OF_ARGS);
-				}
-				FrameLen += TmpLen;
-			}
-#endif // DOT11_N_SUPPORT //
-			MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
-			MlmeFreeMemory(pAd, pOutBuffer);
-		}
-	}
-}
-
-VOID BeaconTimeoutAtJoinAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-	USHORT Status;
-	DBGPRINT(RT_DEBUG_TRACE, ("SYNC - BeaconTimeoutAtJoinAction\n"));
-	pAd->Mlme.SyncMachine.CurrState = SYNC_IDLE;
-	Status = MLME_REJ_TIMEOUT;
-	MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_JOIN_CONF, 2, &Status);
-}
-
-/*
-	==========================================================================
-	Description:
-		Scan timeout procedure. basically add channel index by 1 and rescan
-	==========================================================================
- */
-VOID ScanTimeoutAction(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-	pAd->MlmeAux.Channel = NextChannel(pAd, pAd->MlmeAux.Channel);
-
-	// Only one channel scanned for CISCO beacon request
-	if ((pAd->MlmeAux.ScanType == SCAN_CISCO_ACTIVE) ||
-		(pAd->MlmeAux.ScanType == SCAN_CISCO_PASSIVE) ||
-		(pAd->MlmeAux.ScanType == SCAN_CISCO_NOISE) ||
-		(pAd->MlmeAux.ScanType == SCAN_CISCO_CHANNEL_LOAD))
-		pAd->MlmeAux.Channel = 0;
-
-	// this routine will stop if pAd->MlmeAux.Channel == 0
-	ScanNextChannel(pAd);
-}
-
-/*
-	==========================================================================
-	Description:
-	==========================================================================
- */
-VOID InvalidStateWhenScan(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-	USHORT Status;
-	DBGPRINT(RT_DEBUG_TRACE, ("AYNC - InvalidStateWhenScan(state=%ld). Reset SYNC machine\n", pAd->Mlme.SyncMachine.CurrState));
-	pAd->Mlme.SyncMachine.CurrState = SYNC_IDLE;
-	Status = MLME_STATE_MACHINE_REJECT;
-	MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_SCAN_CONF, 2, &Status);
-}
-
-/*
-	==========================================================================
-	Description:
-	==========================================================================
- */
-VOID InvalidStateWhenJoin(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-	USHORT Status;
-	DBGPRINT(RT_DEBUG_TRACE, ("InvalidStateWhenJoin(state=%ld). Reset SYNC machine\n", pAd->Mlme.SyncMachine.CurrState));
-	pAd->Mlme.SyncMachine.CurrState = SYNC_IDLE;
-	Status = MLME_STATE_MACHINE_REJECT;
-	MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_JOIN_CONF, 2, &Status);
-}
-
-/*
-	==========================================================================
-	Description:
-	==========================================================================
- */
-VOID InvalidStateWhenStart(
-	IN PRTMP_ADAPTER pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-	USHORT Status;
-	DBGPRINT(RT_DEBUG_TRACE, ("InvalidStateWhenStart(state=%ld). Reset SYNC machine\n", pAd->Mlme.SyncMachine.CurrState));
-	pAd->Mlme.SyncMachine.CurrState = SYNC_IDLE;
-	Status = MLME_STATE_MACHINE_REJECT;
-	MlmeEnqueue(pAd, MLME_CNTL_STATE_MACHINE, MT2_START_CONF, 2, &Status);
-}
-
-/*
-	==========================================================================
-	Description:
-
-	IRQL = DISPATCH_LEVEL
-
-	==========================================================================
- */
-VOID EnqueuePsPoll(
-	IN PRTMP_ADAPTER pAd)
-{
-#ifdef RALINK_ATE
-    if (ATE_ON(pAd))
-    {
-		return;
-    }
-#endif // RALINK_ATE //
-
-
-	if (pAd->StaCfg.WindowsPowerMode == Ndis802_11PowerModeLegacy_PSP)
-	pAd->PsPollFrame.FC.PwrMgmt = PWR_SAVE;
-	MiniportMMRequest(pAd, 0, (PUCHAR)&pAd->PsPollFrame, sizeof(PSPOLL_FRAME));
-}
-
-
-/*
-	==========================================================================
-	Description:
-	==========================================================================
- */
-VOID EnqueueProbeRequest(
-	IN PRTMP_ADAPTER pAd)
-{
-	NDIS_STATUS     NState;
-	PUCHAR          pOutBuffer;
-	ULONG           FrameLen = 0;
-	HEADER_802_11   Hdr80211;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("force out a ProbeRequest ...\n"));
-
-	NState = MlmeAllocateMemory(pAd, &pOutBuffer);  //Get an unused nonpaged memory
-	if (NState == NDIS_STATUS_SUCCESS)
-	{
-		MgtMacHeaderInit(pAd, &Hdr80211, SUBTYPE_PROBE_REQ, 0, BROADCAST_ADDR, BROADCAST_ADDR);
-
-		// this ProbeRequest explicitly specify SSID to reduce unwanted ProbeResponse
-		MakeOutgoingFrame(pOutBuffer,                     &FrameLen,
-						  sizeof(HEADER_802_11),          &Hdr80211,
-						  1,                              &SsidIe,
-						  1,                              &pAd->CommonCfg.SsidLen,
-						  pAd->CommonCfg.SsidLen,		  pAd->CommonCfg.Ssid,
-						  1,                              &SupRateIe,
-						  1,                              &pAd->StaActive.SupRateLen,
-						  pAd->StaActive.SupRateLen,      pAd->StaActive.SupRate,
-						  END_OF_ARGS);
-		MiniportMMRequest(pAd, 0, pOutBuffer, FrameLen);
-		MlmeFreeMemory(pAd, pOutBuffer);
-	}
-
-}
-
-#ifdef DOT11_N_SUPPORT
-#ifdef DOT11N_DRAFT3
-VOID BuildEffectedChannelList(
-	IN PRTMP_ADAPTER pAd)
-{
-	UCHAR		EChannel[11];
-	UCHAR		i, j, k;
-	UCHAR		UpperChannel = 0, LowerChannel = 0;
-
-	RTMPZeroMemory(EChannel, 11);
-	i = 0;
-	// Find upper channel and lower channel.
-	if (pAd->CommonCfg.CentralChannel < pAd->CommonCfg.Channel)
-	{
-		UpperChannel = pAd->CommonCfg.Channel;
-		LowerChannel = pAd->CommonCfg.CentralChannel;
-	}
-	else if (pAd->CommonCfg.CentralChannel > pAd->CommonCfg.Channel)
-	{
-		UpperChannel = pAd->CommonCfg.CentralChannel;
-		LowerChannel = pAd->CommonCfg.Channel;
-	}
-	else
-	{
-		return;
-	}
-
-	// Record channels that is below lower channel..
-	if (LowerChannel > 1)
-	{
-		EChannel[0] = LowerChannel - 1;
-		i = 1;
-		if (LowerChannel > 2)
-		{
-			EChannel[1] = LowerChannel - 2;
-			i = 2;
-			if (LowerChannel > 3)
-			{
-				EChannel[2] = LowerChannel - 3;
-				i = 3;
-			}
-		}
-	}
-	// Record channels that is between  lower channel and upper channel.
-	for (k = LowerChannel;k < UpperChannel;k++)
-	{
-		EChannel[i] = k;
-		i++;
-	}
-	// Record channels that is above upper channel..
-	if (LowerChannel < 11)
-	{
-		EChannel[i] = UpperChannel + 1;
-		i++;
-		if (LowerChannel < 10)
-		{
-			EChannel[i] = LowerChannel + 2;
-			i++;
-			if (LowerChannel < 9)
-			{
-				EChannel[i] = LowerChannel + 3;
-				i++;
-			}
-		}
-	}
-	//
-	for (j = 0;j < i;j++)
-	{
-		for (k = 0;k < pAd->ChannelListNum;k++)
-		{
-			if (pAd->ChannelList[k].Channel == EChannel[j])
-			{
-				pAd->ChannelList[k].bEffectedChannel = TRUE;
-				DBGPRINT(RT_DEBUG_TRACE,(" EffectedChannel( =%d)\n", EChannel[j]));
-				break;
-			}
-		}
-	}
-}
-#endif // DOT11N_DRAFT3 //
-#endif // DOT11_N_SUPPORT //
-
-BOOLEAN ScanRunning(
-		IN PRTMP_ADAPTER pAd)
-{
-	return (pAd->Mlme.SyncMachine.CurrState == SCAN_LISTEN) ? TRUE : FALSE;
-}
diff --git a/drivers/staging/rt3090/sta/wpa.c b/drivers/staging/rt3090/sta/wpa.c
deleted file mode 100644
index 2dbdba541c3f..000000000000
--- a/drivers/staging/rt3090/sta/wpa.c
+++ /dev/null
@@ -1,396 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-	Module Name:
-	wpa.c
-
-	Abstract:
-
-	Revision History:
-	Who			When			What
-	--------	----------		----------------------------------------------
-	Jan	Lee		03-07-22		Initial
-	Paul Lin	03-11-28		Modify for supplicant
-*/
-
-#include "../rt_config.h"
-
-
-void inc_byte_array(UCHAR *counter, int len);
-
-/*
-	========================================================================
-
-	Routine Description:
-		Process MIC error indication and record MIC error timer.
-
-	Arguments:
-		pAd	Pointer to our adapter
-		pWpaKey			Pointer to the WPA key structure
-
-	Return Value:
-		None
-
-	IRQL = DISPATCH_LEVEL
-
-	Note:
-
-	========================================================================
-*/
-VOID	RTMPReportMicError(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PCIPHER_KEY	pWpaKey)
-{
-	ULONG	Now;
-    UCHAR   unicastKey = (pWpaKey->Type == PAIRWISE_KEY ? 1:0);
-
-	// Record Last MIC error time and count
-	NdisGetSystemUpTime(&Now);
-	if (pAd->StaCfg.MicErrCnt == 0)
-	{
-		pAd->StaCfg.MicErrCnt++;
-		pAd->StaCfg.LastMicErrorTime = Now;
-        NdisZeroMemory(pAd->StaCfg.ReplayCounter, 8);
-	}
-	else if (pAd->StaCfg.MicErrCnt == 1)
-	{
-		if ((pAd->StaCfg.LastMicErrorTime + (60 * OS_HZ)) < Now)
-		{
-			// Update Last MIC error time, this did not violate two MIC errors within 60 seconds
-			pAd->StaCfg.LastMicErrorTime = Now;
-		}
-		else
-		{
-
-			if (pAd->CommonCfg.bWirelessEvent)
-				RTMPSendWirelessEvent(pAd, IW_COUNTER_MEASURES_EVENT_FLAG, pAd->MacTab.Content[BSSID_WCID].Addr, BSS0, 0);
-
-			pAd->StaCfg.LastMicErrorTime = Now;
-			// Violate MIC error counts, MIC countermeasures kicks in
-			pAd->StaCfg.MicErrCnt++;
-			// We shall block all reception
-			// We shall clean all Tx ring and disassoicate from AP after next EAPOL frame
-			//
-			// No necessary to clean all Tx ring, on RTMPHardTransmit will stop sending non-802.1X EAPOL packets
-			// if pAd->StaCfg.MicErrCnt greater than 2.
-			//
-			// RTMPRingCleanUp(pAd, QID_AC_BK);
-			// RTMPRingCleanUp(pAd, QID_AC_BE);
-			// RTMPRingCleanUp(pAd, QID_AC_VI);
-			// RTMPRingCleanUp(pAd, QID_AC_VO);
-			// RTMPRingCleanUp(pAd, QID_HCCA);
-		}
-	}
-	else
-	{
-		// MIC error count >= 2
-		// This should not happen
-		;
-	}
-    MlmeEnqueue(pAd,
-				MLME_CNTL_STATE_MACHINE,
-				OID_802_11_MIC_FAILURE_REPORT_FRAME,
-				1,
-				&unicastKey);
-
-    if (pAd->StaCfg.MicErrCnt == 2)
-    {
-        RTMPSetTimer(&pAd->StaCfg.WpaDisassocAndBlockAssocTimer, 100);
-    }
-}
-
-
-#ifdef WPA_SUPPLICANT_SUPPORT
-#define	LENGTH_EAP_H    4
-// If the received frame is EAP-Packet ,find out its EAP-Code (Request(0x01), Response(0x02), Success(0x03), Failure(0x04)).
-INT	    WpaCheckEapCode(
-	IN  PRTMP_ADAPTER		pAd,
-	IN  PUCHAR				pFrame,
-	IN  USHORT				FrameLen,
-	IN  USHORT				OffSet)
-{
-
-	PUCHAR	pData;
-	INT	result = 0;
-
-	if( FrameLen < OffSet + LENGTH_EAPOL_H + LENGTH_EAP_H )
-		return result;
-
-	pData = pFrame + OffSet; // skip offset bytes
-
-	if(*(pData+1) == EAPPacket)	// 802.1x header - Packet Type
-	{
-		 result = *(pData+4);		// EAP header - Code
-	}
-
-	return result;
-}
-
-VOID    WpaSendMicFailureToWpaSupplicant(
-    IN  PRTMP_ADAPTER    pAd,
-    IN  BOOLEAN          bUnicast)
-{
-	char custom[IW_CUSTOM_MAX] = {0};
-
-	sprintf(custom, "MLME-MICHAELMICFAILURE.indication");
-	if(bUnicast)
-		sprintf(custom, "%s unicast", custom);
-
-	RtmpOSWrielessEventSend(pAd, IWEVCUSTOM, -1, NULL, (PUCHAR)custom, strlen(custom));
-
-	return;
-}
-#endif // WPA_SUPPLICANT_SUPPORT //
-
-VOID	WpaMicFailureReportFrame(
-	IN  PRTMP_ADAPTER   pAd,
-	IN MLME_QUEUE_ELEM *Elem)
-{
-	PUCHAR              pOutBuffer = NULL;
-	UCHAR               Header802_3[14];
-	ULONG               FrameLen = 0;
-	EAPOL_PACKET        Packet;
-	UCHAR               Mic[16];
-    BOOLEAN             bUnicast;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("WpaMicFailureReportFrame ----->\n"));
-
-    bUnicast = (Elem->Msg[0] == 1 ? TRUE:FALSE);
-	pAd->Sequence = ((pAd->Sequence) + 1) & (MAX_SEQ_NUMBER);
-
-	// init 802.3 header and Fill Packet
-	MAKE_802_3_HEADER(Header802_3, pAd->CommonCfg.Bssid, pAd->CurrentAddress, EAPOL);
-
-	NdisZeroMemory(&Packet, sizeof(Packet));
-	Packet.ProVer	= EAPOL_VER;
-	Packet.ProType	= EAPOLKey;
-
-	Packet.KeyDesc.Type = WPA1_KEY_DESC;
-
-    // Request field presented
-    Packet.KeyDesc.KeyInfo.Request = 1;
-
-	if(pAd->StaCfg.WepStatus  == Ndis802_11Encryption3Enabled)
-	{
-		Packet.KeyDesc.KeyInfo.KeyDescVer = 2;
-	}
-	else	  // TKIP
-	{
-		Packet.KeyDesc.KeyInfo.KeyDescVer = 1;
-	}
-
-    Packet.KeyDesc.KeyInfo.KeyType = (bUnicast ? PAIRWISEKEY : GROUPKEY);
-
-	// KeyMic field presented
-	Packet.KeyDesc.KeyInfo.KeyMic  = 1;
-
-    // Error field presented
-	Packet.KeyDesc.KeyInfo.Error  = 1;
-
-	// Update packet length after decide Key data payload
-	SET_UINT16_TO_ARRARY(Packet.Body_Len, LEN_EAPOL_KEY_MSG)
-
-	// Key Replay Count
-	NdisMoveMemory(Packet.KeyDesc.ReplayCounter, pAd->StaCfg.ReplayCounter, LEN_KEY_DESC_REPLAY);
-    inc_byte_array(pAd->StaCfg.ReplayCounter, 8);
-
-	// Convert to little-endian format.
-	*((USHORT *)&Packet.KeyDesc.KeyInfo) = cpu2le16(*((USHORT *)&Packet.KeyDesc.KeyInfo));
-
-
-	MlmeAllocateMemory(pAd, (PUCHAR *)&pOutBuffer);  // allocate memory
-	if(pOutBuffer == NULL)
-	{
-		return;
-	}
-
-	// Prepare EAPOL frame for MIC calculation
-	// Be careful, only EAPOL frame is counted for MIC calculation
-	MakeOutgoingFrame(pOutBuffer,               &FrameLen,
-		              CONV_ARRARY_TO_UINT16(Packet.Body_Len) + 4,   &Packet,
-		              END_OF_ARGS);
-
-	// Prepare and Fill MIC value
-	NdisZeroMemory(Mic, sizeof(Mic));
-	if(pAd->StaCfg.WepStatus  == Ndis802_11Encryption3Enabled)
-	{	// AES
-        UCHAR digest[20] = {0};
-		HMAC_SHA1(pAd->StaCfg.PTK, LEN_EAP_MICK, pOutBuffer, FrameLen, digest, SHA1_DIGEST_SIZE);
-		NdisMoveMemory(Mic, digest, LEN_KEY_DESC_MIC);
-	}
-	else
-	{	// TKIP
-		HMAC_MD5(pAd->StaCfg.PTK,  LEN_EAP_MICK, pOutBuffer, FrameLen, Mic, MD5_DIGEST_SIZE);
-	}
-	NdisMoveMemory(Packet.KeyDesc.KeyMic, Mic, LEN_KEY_DESC_MIC);
-
-	// copy frame to Tx ring and send MIC failure report frame to authenticator
-	RTMPToWirelessSta(pAd, &pAd->MacTab.Content[BSSID_WCID],
-					  Header802_3, LENGTH_802_3,
-					  (PUCHAR)&Packet,
-					  CONV_ARRARY_TO_UINT16(Packet.Body_Len) + 4, FALSE);
-
-	MlmeFreeMemory(pAd, (PUCHAR)pOutBuffer);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("WpaMicFailureReportFrame <-----\n"));
-}
-
-/** from wpa_supplicant
- * inc_byte_array - Increment arbitrary length byte array by one
- * @counter: Pointer to byte array
- * @len: Length of the counter in bytes
- *
- * This function increments the last byte of the counter by one and continues
- * rolling over to more significant bytes if the byte was incremented from
- * 0xff to 0x00.
- */
-void inc_byte_array(UCHAR *counter, int len)
-{
-	int pos = len - 1;
-	while (pos >= 0) {
-		counter[pos]++;
-		if (counter[pos] != 0)
-			break;
-		pos--;
-	}
-}
-
-VOID WpaDisassocApAndBlockAssoc(
-    IN PVOID SystemSpecific1,
-    IN PVOID FunctionContext,
-    IN PVOID SystemSpecific2,
-    IN PVOID SystemSpecific3)
-{
-    RTMP_ADAPTER                *pAd = (PRTMP_ADAPTER)FunctionContext;
-    MLME_DISASSOC_REQ_STRUCT    DisassocReq;
-
-	// disassoc from current AP first
-	DBGPRINT(RT_DEBUG_TRACE, ("RTMPReportMicError - disassociate with current AP after sending second continuous EAPOL frame\n"));
-	DisassocParmFill(pAd, &DisassocReq, pAd->CommonCfg.Bssid, REASON_MIC_FAILURE);
-	MlmeEnqueue(pAd, ASSOC_STATE_MACHINE, MT2_MLME_DISASSOC_REQ, sizeof(MLME_DISASSOC_REQ_STRUCT), &DisassocReq);
-
-	pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_DISASSOC;
-	pAd->StaCfg.bBlockAssoc = TRUE;
-}
-
-VOID WpaStaPairwiseKeySetting(
-	IN	PRTMP_ADAPTER	pAd)
-{
-	PCIPHER_KEY pSharedKey;
-	PMAC_TABLE_ENTRY pEntry;
-
-	pEntry = &pAd->MacTab.Content[BSSID_WCID];
-
-	// Pairwise key shall use key#0
-	pSharedKey = &pAd->SharedKey[BSS0][0];
-
-	NdisMoveMemory(pAd->StaCfg.PTK, pEntry->PTK, LEN_PTK);
-
-	// Prepare pair-wise key information into shared key table
-	NdisZeroMemory(pSharedKey, sizeof(CIPHER_KEY));
-	pSharedKey->KeyLen = LEN_TKIP_EK;
-    NdisMoveMemory(pSharedKey->Key, &pAd->StaCfg.PTK[32], LEN_TKIP_EK);
-	NdisMoveMemory(pSharedKey->RxMic, &pAd->StaCfg.PTK[48], LEN_TKIP_RXMICK);
-	NdisMoveMemory(pSharedKey->TxMic, &pAd->StaCfg.PTK[48+LEN_TKIP_RXMICK], LEN_TKIP_TXMICK);
-
-	// Decide its ChiperAlg
-	if (pAd->StaCfg.PairCipher == Ndis802_11Encryption2Enabled)
-		pSharedKey->CipherAlg = CIPHER_TKIP;
-	else if (pAd->StaCfg.PairCipher == Ndis802_11Encryption3Enabled)
-		pSharedKey->CipherAlg = CIPHER_AES;
-	else
-		pSharedKey->CipherAlg = CIPHER_NONE;
-
-	// Update these related information to MAC_TABLE_ENTRY
-	NdisMoveMemory(pEntry->PairwiseKey.Key, &pAd->StaCfg.PTK[32], LEN_TKIP_EK);
-	NdisMoveMemory(pEntry->PairwiseKey.RxMic, &pAd->StaCfg.PTK[48], LEN_TKIP_RXMICK);
-	NdisMoveMemory(pEntry->PairwiseKey.TxMic, &pAd->StaCfg.PTK[48+LEN_TKIP_RXMICK], LEN_TKIP_TXMICK);
-	pEntry->PairwiseKey.CipherAlg = pSharedKey->CipherAlg;
-
-	// Update pairwise key information to ASIC Shared Key Table
-	AsicAddSharedKeyEntry(pAd,
-						  BSS0,
-						  0,
-						  pSharedKey->CipherAlg,
-						  pSharedKey->Key,
-						  pSharedKey->TxMic,
-						  pSharedKey->RxMic);
-
-	// Update ASIC WCID attribute table and IVEIV table
-	RTMPAddWcidAttributeEntry(pAd,
-							  BSS0,
-							  0,
-							  pSharedKey->CipherAlg,
-							  pEntry);
-	STA_PORT_SECURED(pAd);
-	pAd->IndicateMediaState = NdisMediaStateConnected;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("%s : AID(%d) port secured\n", __FUNCTION__, pEntry->Aid));
-
-}
-
-VOID WpaStaGroupKeySetting(
-	IN	PRTMP_ADAPTER	pAd)
-{
-	PCIPHER_KEY		pSharedKey;
-
-	pSharedKey = &pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId];
-
-	// Prepare pair-wise key information into shared key table
-	NdisZeroMemory(pSharedKey, sizeof(CIPHER_KEY));
-	pSharedKey->KeyLen = LEN_TKIP_EK;
-	NdisMoveMemory(pSharedKey->Key, pAd->StaCfg.GTK, LEN_TKIP_EK);
-	NdisMoveMemory(pSharedKey->RxMic, &pAd->StaCfg.GTK[16], LEN_TKIP_RXMICK);
-	NdisMoveMemory(pSharedKey->TxMic, &pAd->StaCfg.GTK[24], LEN_TKIP_TXMICK);
-
-	// Update Shared Key CipherAlg
-	pSharedKey->CipherAlg = CIPHER_NONE;
-	if (pAd->StaCfg.GroupCipher == Ndis802_11Encryption2Enabled)
-		pSharedKey->CipherAlg = CIPHER_TKIP;
-	else if (pAd->StaCfg.GroupCipher == Ndis802_11Encryption3Enabled)
-		pSharedKey->CipherAlg = CIPHER_AES;
-	else if (pAd->StaCfg.GroupCipher == Ndis802_11GroupWEP40Enabled)
-		pSharedKey->CipherAlg = CIPHER_WEP64;
-	else if (pAd->StaCfg.GroupCipher == Ndis802_11GroupWEP104Enabled)
-		pSharedKey->CipherAlg = CIPHER_WEP128;
-
-	// Update group key information to ASIC Shared Key Table
-	AsicAddSharedKeyEntry(pAd,
-						  BSS0,
-						  pAd->StaCfg.DefaultKeyId,
-						  pSharedKey->CipherAlg,
-						  pSharedKey->Key,
-						  pSharedKey->TxMic,
-						  pSharedKey->RxMic);
-
-	// Update ASIC WCID attribute table and IVEIV table
-	RTMPAddWcidAttributeEntry(pAd,
-							  BSS0,
-							  pAd->StaCfg.DefaultKeyId,
-							  pSharedKey->CipherAlg,
-							  NULL);
-
-}
diff --git a/drivers/staging/rt3090/sta_ioctl.c b/drivers/staging/rt3090/sta_ioctl.c
deleted file mode 100644
index b8ab84a0469b..000000000000
--- a/drivers/staging/rt3090/sta_ioctl.c
+++ /dev/null
@@ -1,7557 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-    Module Name:
-    sta_ioctl.c
-
-    Abstract:
-    IOCTL related subroutines
-
-    Revision History:
-    Who         When          What
-    --------    ----------    ----------------------------------------------
-    Rory Chen   01-03-2003    created
-	Rory Chen   02-14-2005    modify to support RT61
-*/
-
-#include	"rt_config.h"
-
-#ifdef DBG
-extern ULONG    RTDebugLevel;
-#endif
-
-#define NR_WEP_KEYS				4
-#define WEP_SMALL_KEY_LEN			(40/8)
-#define WEP_LARGE_KEY_LEN			(104/8)
-
-#define GROUP_KEY_NO                4
-
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,27)
-#define IWE_STREAM_ADD_EVENT(_A, _B, _C, _D, _E)		iwe_stream_add_event(_A, _B, _C, _D, _E)
-#define IWE_STREAM_ADD_POINT(_A, _B, _C, _D, _E)		iwe_stream_add_point(_A, _B, _C, _D, _E)
-#define IWE_STREAM_ADD_VALUE(_A, _B, _C, _D, _E, _F)	iwe_stream_add_value(_A, _B, _C, _D, _E, _F)
-#else
-#define IWE_STREAM_ADD_EVENT(_A, _B, _C, _D, _E)		iwe_stream_add_event(_B, _C, _D, _E)
-#define IWE_STREAM_ADD_POINT(_A, _B, _C, _D, _E)		iwe_stream_add_point(_B, _C, _D, _E)
-#define IWE_STREAM_ADD_VALUE(_A, _B, _C, _D, _E, _F)	iwe_stream_add_value(_B, _C, _D, _E, _F)
-#endif
-
-extern UCHAR    CipherWpa2Template[];
-
-typedef struct PACKED _RT_VERSION_INFO{
-    UCHAR       DriverVersionW;
-    UCHAR       DriverVersionX;
-    UCHAR       DriverVersionY;
-    UCHAR       DriverVersionZ;
-    UINT        DriverBuildYear;
-    UINT        DriverBuildMonth;
-    UINT        DriverBuildDay;
-} RT_VERSION_INFO, *PRT_VERSION_INFO;
-
-struct iw_priv_args privtab[] = {
-{ RTPRIV_IOCTL_SET,
-  IW_PRIV_TYPE_CHAR | 1024, 0,
-  "set"},
-
-{ RTPRIV_IOCTL_SHOW, IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK,
-  ""},
-/* --- sub-ioctls definitions --- */
-    { SHOW_CONN_STATUS,
-	  IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "connStatus" },
-	{ SHOW_DRVIER_VERION,
-	  IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "driverVer" },
-    { SHOW_BA_INFO,
-	  IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "bainfo" },
-	{ SHOW_DESC_INFO,
-	  IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "descinfo" },
-    { RAIO_OFF,
-	  IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "radio_off" },
-	{ RAIO_ON,
-	  IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "radio_on" },
-#ifdef QOS_DLS_SUPPORT
-	{ SHOW_DLS_ENTRY_INFO,
-	  IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "dlsentryinfo" },
-#endif // QOS_DLS_SUPPORT //
-	{ SHOW_CFG_VALUE,
-	  IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "show" },
-	{ SHOW_ADHOC_ENTRY_INFO,
-	  IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, "adhocEntry" },
-/* --- sub-ioctls relations --- */
-
-#ifdef DBG
-{ RTPRIV_IOCTL_BBP,
-  IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK,
-  "bbp"},
-{ RTPRIV_IOCTL_MAC,
-  IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | 1024,
-  "mac"},
-#ifdef RTMP_RF_RW_SUPPORT
-{ RTPRIV_IOCTL_RF,
-  IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK,
-  "rf"},
-#endif // RTMP_RF_RW_SUPPORT //
-{ RTPRIV_IOCTL_E2P,
-  IW_PRIV_TYPE_CHAR | 1024, IW_PRIV_TYPE_CHAR | 1024,
-  "e2p"},
-#endif  /* DBG */
-
-{ RTPRIV_IOCTL_STATISTICS,
-  0, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_MASK,
-  "stat"},
-{ RTPRIV_IOCTL_GSITESURVEY,
-  0, IW_PRIV_TYPE_CHAR | 1024,
-  "get_site_survey"},
-
-
-};
-
-static __s32 ralinkrate[] =
-	{2,  4,   11,  22, // CCK
-	12, 18,   24,  36, 48, 72, 96, 108, // OFDM
-	13, 26,   39,  52,  78, 104, 117, 130, 26,  52,  78, 104, 156, 208, 234, 260, // 20MHz, 800ns GI, MCS: 0 ~ 15
-	39, 78,  117, 156, 234, 312, 351, 390,										  // 20MHz, 800ns GI, MCS: 16 ~ 23
-	27, 54,   81, 108, 162, 216, 243, 270, 54, 108, 162, 216, 324, 432, 486, 540, // 40MHz, 800ns GI, MCS: 0 ~ 15
-	81, 162, 243, 324, 486, 648, 729, 810,										  // 40MHz, 800ns GI, MCS: 16 ~ 23
-	14, 29,   43,  57,  87, 115, 130, 144, 29, 59,   87, 115, 173, 230, 260, 288, // 20MHz, 400ns GI, MCS: 0 ~ 15
-	43, 87,  130, 173, 260, 317, 390, 433,										  // 20MHz, 400ns GI, MCS: 16 ~ 23
-	30, 60,   90, 120, 180, 240, 270, 300, 60, 120, 180, 240, 360, 480, 540, 600, // 40MHz, 400ns GI, MCS: 0 ~ 15
-	90, 180, 270, 360, 540, 720, 810, 900};
-
-
-
-INT Set_SSID_Proc(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  PSTRING          arg);
-
-#ifdef WMM_SUPPORT
-INT	Set_WmmCapable_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-#endif
-
-INT Set_NetworkType_Proc(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  PSTRING          arg);
-
-INT Set_AuthMode_Proc(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  PSTRING          arg);
-
-INT Set_EncrypType_Proc(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  PSTRING          arg);
-
-INT Set_DefaultKeyID_Proc(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  PSTRING          arg);
-
-INT Set_Key1_Proc(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  PSTRING          arg);
-
-INT Set_Key2_Proc(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  PSTRING          arg);
-
-INT Set_Key3_Proc(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  PSTRING          arg);
-
-INT Set_Key4_Proc(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  PSTRING          arg);
-
-INT Set_WPAPSK_Proc(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  PSTRING          arg);
-
-
-INT Set_PSMode_Proc(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  PSTRING          arg);
-
-#ifdef RT3090
-INT Set_PCIePSLevel_Proc(
-IN  PRTMP_ADAPTER   pAdapter,
-IN  PUCHAR          arg);
-#endif // RT3090 //
-#ifdef WPA_SUPPLICANT_SUPPORT
-INT Set_Wpa_Support(
-    IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-#endif // WPA_SUPPLICANT_SUPPORT //
-
-#ifdef DBG
-
-VOID RTMPIoctlMAC(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq);
-
-VOID RTMPIoctlE2PROM(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  struct iwreq    *wrq);
-#endif // DBG //
-
-
-NDIS_STATUS RTMPWPANoneAddKeyProc(
-    IN  PRTMP_ADAPTER   pAd,
-    IN	PVOID			pBuf);
-
-INT Set_FragTest_Proc(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  PSTRING          arg);
-
-#ifdef DOT11_N_SUPPORT
-INT Set_TGnWifiTest_Proc(
-    IN  PRTMP_ADAPTER   pAd,
-    IN  PSTRING          arg);
-#endif // DOT11_N_SUPPORT //
-
-INT Set_LongRetryLimit_Proc(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	PSTRING			arg);
-
-INT Set_ShortRetryLimit_Proc(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	PSTRING			arg);
-
-#ifdef EXT_BUILD_CHANNEL_LIST
-INT Set_Ieee80211dClientMode_Proc(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  PSTRING          arg);
-#endif // EXT_BUILD_CHANNEL_LIST //
-
-#ifdef CARRIER_DETECTION_SUPPORT
-INT Set_CarrierDetect_Proc(
-    IN  PRTMP_ADAPTER   pAd,
-    IN  PSTRING          arg);
-#endif // CARRIER_DETECTION_SUPPORT //
-
-INT	Show_Adhoc_MacTable_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			extra);
-
-#ifdef RTMP_RF_RW_SUPPORT
-VOID RTMPIoctlRF(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq);
-#endif // RTMP_RF_RW_SUPPORT //
-
-
-INT Set_BeaconLostTime_Proc(
-    IN  PRTMP_ADAPTER   pAd,
-    IN  PSTRING         arg);
-
-INT Set_AutoRoaming_Proc(
-    IN  PRTMP_ADAPTER   pAd,
-    IN  PSTRING         arg);
-
-INT Set_SiteSurvey_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg);
-
-INT Set_ForceTxBurst_Proc(
-    IN  PRTMP_ADAPTER   pAd,
-    IN  PSTRING         arg);
-
-#ifdef ANT_DIVERSITY_SUPPORT
-INT	Set_Antenna_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg);
-#endif // ANT_DIVERSITY_SUPPORT //
-
-static struct {
-	PSTRING name;
-	INT (*set_proc)(PRTMP_ADAPTER pAdapter, PSTRING arg);
-} *PRTMP_PRIVATE_SET_PROC, RTMP_PRIVATE_SUPPORT_PROC[] = {
-	{"DriverVersion",				Set_DriverVersion_Proc},
-	{"CountryRegion",				Set_CountryRegion_Proc},
-	{"CountryRegionABand",			Set_CountryRegionABand_Proc},
-	{"SSID",						Set_SSID_Proc},
-	{"WirelessMode",				Set_WirelessMode_Proc},
-	{"TxBurst",					Set_TxBurst_Proc},
-	{"TxPreamble",				Set_TxPreamble_Proc},
-	{"TxPower",					Set_TxPower_Proc},
-	{"Channel",					Set_Channel_Proc},
-	{"BGProtection",				Set_BGProtection_Proc},
-	{"RTSThreshold",				Set_RTSThreshold_Proc},
-	{"FragThreshold",				Set_FragThreshold_Proc},
-#ifdef DOT11_N_SUPPORT
-	{"HtBw",		                Set_HtBw_Proc},
-	{"HtMcs",		                Set_HtMcs_Proc},
-	{"HtGi",		                Set_HtGi_Proc},
-	{"HtOpMode",		            Set_HtOpMode_Proc},
-	{"HtExtcha",		            Set_HtExtcha_Proc},
-	{"HtMpduDensity",		        Set_HtMpduDensity_Proc},
-	{"HtBaWinSize",				Set_HtBaWinSize_Proc},
-	{"HtRdg",					Set_HtRdg_Proc},
-	{"HtAmsdu",					Set_HtAmsdu_Proc},
-	{"HtAutoBa",				Set_HtAutoBa_Proc},
-	{"HtBaDecline",					Set_BADecline_Proc},
-	{"HtProtect",				Set_HtProtect_Proc},
-	{"HtMimoPs",				Set_HtMimoPs_Proc},
-	{"HtDisallowTKIP",				Set_HtDisallowTKIP_Proc},
-#endif // DOT11_N_SUPPORT //
-
-#ifdef AGGREGATION_SUPPORT
-	{"PktAggregate",				Set_PktAggregate_Proc},
-#endif // AGGREGATION_SUPPORT //
-
-#ifdef WMM_SUPPORT
-	{"WmmCapable",					Set_WmmCapable_Proc},
-#endif
-	{"IEEE80211H",					Set_IEEE80211H_Proc},
-    {"NetworkType",                 Set_NetworkType_Proc},
-	{"AuthMode",					Set_AuthMode_Proc},
-	{"EncrypType",					Set_EncrypType_Proc},
-	{"DefaultKeyID",				Set_DefaultKeyID_Proc},
-	{"Key1",						Set_Key1_Proc},
-	{"Key2",						Set_Key2_Proc},
-	{"Key3",						Set_Key3_Proc},
-	{"Key4",						Set_Key4_Proc},
-	{"WPAPSK",						Set_WPAPSK_Proc},
-	{"ResetCounter",				Set_ResetStatCounter_Proc},
-	{"PSMode",                      Set_PSMode_Proc},
-#ifdef DBG
-	{"Debug",						Set_Debug_Proc},
-#endif // DBG //
-
-#ifdef RALINK_ATE
-	{"ATE",							Set_ATE_Proc},
-	{"ATEDA",						Set_ATE_DA_Proc},
-	{"ATESA",						Set_ATE_SA_Proc},
-	{"ATEBSSID",					Set_ATE_BSSID_Proc},
-	{"ATECHANNEL",					Set_ATE_CHANNEL_Proc},
-	{"ATETXPOW0",					Set_ATE_TX_POWER0_Proc},
-	{"ATETXPOW1",					Set_ATE_TX_POWER1_Proc},
-	{"ATETXANT",					Set_ATE_TX_Antenna_Proc},
-	{"ATERXANT",					Set_ATE_RX_Antenna_Proc},
-	{"ATETXFREQOFFSET",				Set_ATE_TX_FREQOFFSET_Proc},
-	{"ATETXBW",						Set_ATE_TX_BW_Proc},
-	{"ATETXLEN",					Set_ATE_TX_LENGTH_Proc},
-	{"ATETXCNT",					Set_ATE_TX_COUNT_Proc},
-	{"ATETXMCS",					Set_ATE_TX_MCS_Proc},
-	{"ATETXMODE",					Set_ATE_TX_MODE_Proc},
-	{"ATETXGI",						Set_ATE_TX_GI_Proc},
-	{"ATERXFER",					Set_ATE_RX_FER_Proc},
-	{"ATERRF",						Set_ATE_Read_RF_Proc},
-	{"ATEWRF1",						Set_ATE_Write_RF1_Proc},
-	{"ATEWRF2",						Set_ATE_Write_RF2_Proc},
-	{"ATEWRF3",						Set_ATE_Write_RF3_Proc},
-	{"ATEWRF4",						Set_ATE_Write_RF4_Proc},
-	{"ATELDE2P",				    Set_ATE_Load_E2P_Proc},
-	{"ATERE2P",						Set_ATE_Read_E2P_Proc},
-	{"ATESHOW",						Set_ATE_Show_Proc},
-	{"ATEHELP",						Set_ATE_Help_Proc},
-
-#ifdef RALINK_28xx_QA
-	{"TxStop",						Set_TxStop_Proc},
-	{"RxStop",						Set_RxStop_Proc},
-#endif // RALINK_28xx_QA //
-#endif // RALINK_ATE //
-
-#ifdef WPA_SUPPLICANT_SUPPORT
-    {"WpaSupport",                  Set_Wpa_Support},
-#endif // WPA_SUPPLICANT_SUPPORT //
-
-
-
-
-
-	{"FixedTxMode",                 Set_FixedTxMode_Proc},
-#ifdef CONFIG_APSTA_MIXED_SUPPORT
-	{"OpMode",						Set_OpMode_Proc},
-#endif // CONFIG_APSTA_MIXED_SUPPORT //
-#ifdef DOT11_N_SUPPORT
-    {"TGnWifiTest",                 Set_TGnWifiTest_Proc},
-    {"ForceGF",					Set_ForceGF_Proc},
-#endif // DOT11_N_SUPPORT //
-#ifdef QOS_DLS_SUPPORT
-	{"DlsAddEntry",					Set_DlsAddEntry_Proc},
-	{"DlsTearDownEntry",			Set_DlsTearDownEntry_Proc},
-#endif // QOS_DLS_SUPPORT //
-	{"LongRetry",				Set_LongRetryLimit_Proc},
-	{"ShortRetry",				Set_ShortRetryLimit_Proc},
-#ifdef EXT_BUILD_CHANNEL_LIST
-	{"11dClientMode",				Set_Ieee80211dClientMode_Proc},
-#endif // EXT_BUILD_CHANNEL_LIST //
-#ifdef CARRIER_DETECTION_SUPPORT
-	{"CarrierDetect",				Set_CarrierDetect_Proc},
-#endif // CARRIER_DETECTION_SUPPORT //
-
-
-//2008/09/11:KH add to support efuse<--
-#ifdef RT30xx
-#ifdef RTMP_EFUSE_SUPPORT
-	{"efuseFreeNumber",				set_eFuseGetFreeBlockCount_Proc},
-	{"efuseDump",					set_eFusedump_Proc},
-	{"efuseLoadFromBin",				set_eFuseLoadFromBin_Proc},
-	{"efuseBufferModeWriteBack",		set_eFuseBufferModeWriteBack_Proc},
-#endif // RTMP_EFUSE_SUPPORT //
-#ifdef ANT_DIVERSITY_SUPPORT
-	{"ant",					Set_Antenna_Proc},
-#endif // ANT_DIVERSITY_SUPPORT //
-#endif // RT30xx //
-//2008/09/11:KH add to support efuse-->
-
-	{"BeaconLostTime",				Set_BeaconLostTime_Proc},
-	{"AutoRoaming",					Set_AutoRoaming_Proc},
-	{"SiteSurvey",					Set_SiteSurvey_Proc},
-	{"ForceTxBurst",				Set_ForceTxBurst_Proc},
-
-	{NULL,}
-};
-
-
-VOID RTMPAddKey(
-	IN	PRTMP_ADAPTER	    pAd,
-	IN	PNDIS_802_11_KEY    pKey)
-{
-	ULONG				KeyIdx;
-	MAC_TABLE_ENTRY		*pEntry;
-
-    DBGPRINT(RT_DEBUG_TRACE, ("RTMPAddKey ------>\n"));
-
-	if (pAd->StaCfg.AuthMode >= Ndis802_11AuthModeWPA)
-	{
-		if (pKey->KeyIndex & 0x80000000)
-		{
-		    if (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPANone)
-            {
-                NdisZeroMemory(pAd->StaCfg.PMK, 32);
-                NdisMoveMemory(pAd->StaCfg.PMK, pKey->KeyMaterial, pKey->KeyLength);
-                goto end;
-            }
-		    // Update PTK
-		    NdisZeroMemory(&pAd->SharedKey[BSS0][0], sizeof(CIPHER_KEY));
-            pAd->SharedKey[BSS0][0].KeyLen = LEN_TKIP_EK;
-            NdisMoveMemory(pAd->SharedKey[BSS0][0].Key, pKey->KeyMaterial, LEN_TKIP_EK);
-#ifdef WPA_SUPPLICANT_SUPPORT
-            if (pAd->StaCfg.PairCipher == Ndis802_11Encryption2Enabled)
-            {
-                NdisMoveMemory(pAd->SharedKey[BSS0][0].RxMic, pKey->KeyMaterial + LEN_TKIP_EK, LEN_TKIP_TXMICK);
-                NdisMoveMemory(pAd->SharedKey[BSS0][0].TxMic, pKey->KeyMaterial + LEN_TKIP_EK + LEN_TKIP_TXMICK, LEN_TKIP_RXMICK);
-            }
-            else
-#endif // WPA_SUPPLICANT_SUPPORT //
-            {
-		NdisMoveMemory(pAd->SharedKey[BSS0][0].TxMic, pKey->KeyMaterial + LEN_TKIP_EK, LEN_TKIP_TXMICK);
-                NdisMoveMemory(pAd->SharedKey[BSS0][0].RxMic, pKey->KeyMaterial + LEN_TKIP_EK + LEN_TKIP_TXMICK, LEN_TKIP_RXMICK);
-            }
-
-            // Decide its ChiperAlg
-		if (pAd->StaCfg.PairCipher == Ndis802_11Encryption2Enabled)
-			pAd->SharedKey[BSS0][0].CipherAlg = CIPHER_TKIP;
-		else if (pAd->StaCfg.PairCipher == Ndis802_11Encryption3Enabled)
-			pAd->SharedKey[BSS0][0].CipherAlg = CIPHER_AES;
-		else
-			pAd->SharedKey[BSS0][0].CipherAlg = CIPHER_NONE;
-
-            // Update these related information to MAC_TABLE_ENTRY
-		pEntry = &pAd->MacTab.Content[BSSID_WCID];
-            NdisMoveMemory(pEntry->PairwiseKey.Key, pAd->SharedKey[BSS0][0].Key, LEN_TKIP_EK);
-		NdisMoveMemory(pEntry->PairwiseKey.RxMic, pAd->SharedKey[BSS0][0].RxMic, LEN_TKIP_RXMICK);
-		NdisMoveMemory(pEntry->PairwiseKey.TxMic, pAd->SharedKey[BSS0][0].TxMic, LEN_TKIP_TXMICK);
-		pEntry->PairwiseKey.CipherAlg = pAd->SharedKey[BSS0][0].CipherAlg;
-
-		// Update pairwise key information to ASIC Shared Key Table
-		AsicAddSharedKeyEntry(pAd,
-							  BSS0,
-							  0,
-							  pAd->SharedKey[BSS0][0].CipherAlg,
-							  pAd->SharedKey[BSS0][0].Key,
-							  pAd->SharedKey[BSS0][0].TxMic,
-							  pAd->SharedKey[BSS0][0].RxMic);
-
-		// Update ASIC WCID attribute table and IVEIV table
-		RTMPAddWcidAttributeEntry(pAd,
-								  BSS0,
-								  0,
-								  pAd->SharedKey[BSS0][0].CipherAlg,
-								  pEntry);
-
-            if (pAd->StaCfg.AuthMode >= Ndis802_11AuthModeWPA2)
-            {
-                // set 802.1x port control
-	            //pAd->StaCfg.PortSecured = WPA_802_1X_PORT_SECURED;
-				STA_PORT_SECURED(pAd);
-
-                // Indicate Connected for GUI
-                pAd->IndicateMediaState = NdisMediaStateConnected;
-            }
-		}
-        else
-        {
-            // Update GTK
-            pAd->StaCfg.DefaultKeyId = (pKey->KeyIndex & 0xFF);
-            NdisZeroMemory(&pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId], sizeof(CIPHER_KEY));
-            pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].KeyLen = LEN_TKIP_EK;
-            NdisMoveMemory(pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].Key, pKey->KeyMaterial, LEN_TKIP_EK);
-#ifdef WPA_SUPPLICANT_SUPPORT
-            if (pAd->StaCfg.GroupCipher == Ndis802_11Encryption2Enabled)
-            {
-                NdisMoveMemory(pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].RxMic, pKey->KeyMaterial + LEN_TKIP_EK, LEN_TKIP_TXMICK);
-                NdisMoveMemory(pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].TxMic, pKey->KeyMaterial + LEN_TKIP_EK + LEN_TKIP_TXMICK, LEN_TKIP_RXMICK);
-            }
-            else
-#endif // WPA_SUPPLICANT_SUPPORT //
-            {
-		NdisMoveMemory(pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].TxMic, pKey->KeyMaterial + LEN_TKIP_EK, LEN_TKIP_TXMICK);
-                NdisMoveMemory(pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].RxMic, pKey->KeyMaterial + LEN_TKIP_EK + LEN_TKIP_TXMICK, LEN_TKIP_RXMICK);
-            }
-
-            // Update Shared Key CipherAlg
-		pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].CipherAlg = CIPHER_NONE;
-		if (pAd->StaCfg.GroupCipher == Ndis802_11Encryption2Enabled)
-			pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].CipherAlg = CIPHER_TKIP;
-		else if (pAd->StaCfg.GroupCipher == Ndis802_11Encryption3Enabled)
-			pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].CipherAlg = CIPHER_AES;
-
-            // Update group key information to ASIC Shared Key Table
-		AsicAddSharedKeyEntry(pAd,
-							  BSS0,
-							  pAd->StaCfg.DefaultKeyId,
-							  pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].CipherAlg,
-							  pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].Key,
-							  pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].TxMic,
-							  pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].RxMic);
-
-		// Update ASIC WCID attribute table and IVEIV table
-		RTMPAddWcidAttributeEntry(pAd,
-								  BSS0,
-								  pAd->StaCfg.DefaultKeyId,
-								  pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].CipherAlg,
-								  NULL);
-
-            // set 802.1x port control
-	        //pAd->StaCfg.PortSecured = WPA_802_1X_PORT_SECURED;
-			STA_PORT_SECURED(pAd);
-
-            // Indicate Connected for GUI
-            pAd->IndicateMediaState = NdisMediaStateConnected;
-        }
-	}
-	else	// dynamic WEP from wpa_supplicant
-	{
-		UCHAR	CipherAlg;
-	PUCHAR	Key;
-
-		if(pKey->KeyLength == 32)
-			goto end;
-
-		KeyIdx = pKey->KeyIndex & 0x0fffffff;
-
-		if (KeyIdx < 4)
-		{
-			// it is a default shared key, for Pairwise key setting
-			if (pKey->KeyIndex & 0x80000000)
-			{
-				pEntry = MacTableLookup(pAd, pKey->BSSID);
-
-				if (pEntry)
-				{
-					DBGPRINT(RT_DEBUG_TRACE, ("RTMPAddKey: Set Pair-wise Key\n"));
-
-					// set key material and key length
-					pEntry->PairwiseKey.KeyLen = (UCHAR)pKey->KeyLength;
-					NdisMoveMemory(pEntry->PairwiseKey.Key, &pKey->KeyMaterial, pKey->KeyLength);
-
-					// set Cipher type
-					if (pKey->KeyLength == 5)
-						pEntry->PairwiseKey.CipherAlg = CIPHER_WEP64;
-					else
-						pEntry->PairwiseKey.CipherAlg = CIPHER_WEP128;
-
-					// Add Pair-wise key to Asic
-					AsicAddPairwiseKeyEntry(
-						pAd,
-						pEntry->Addr,
-						(UCHAR)pEntry->Aid,
-				&pEntry->PairwiseKey);
-
-					// update WCID attribute table and IVEIV table for this entry
-					RTMPAddWcidAttributeEntry(
-						pAd,
-						BSS0,
-						KeyIdx, // The value may be not zero
-						pEntry->PairwiseKey.CipherAlg,
-						pEntry);
-
-				}
-			}
-			else
-            {
-				// Default key for tx (shared key)
-				pAd->StaCfg.DefaultKeyId = (UCHAR) KeyIdx;
-
-				// set key material and key length
-				pAd->SharedKey[BSS0][KeyIdx].KeyLen = (UCHAR) pKey->KeyLength;
-				NdisMoveMemory(pAd->SharedKey[BSS0][KeyIdx].Key, &pKey->KeyMaterial, pKey->KeyLength);
-
-				// Set Ciper type
-				if (pKey->KeyLength == 5)
-					pAd->SharedKey[BSS0][KeyIdx].CipherAlg = CIPHER_WEP64;
-				else
-					pAd->SharedKey[BSS0][KeyIdx].CipherAlg = CIPHER_WEP128;
-
-			CipherAlg = pAd->SharedKey[BSS0][KeyIdx].CipherAlg;
-			Key = pAd->SharedKey[BSS0][KeyIdx].Key;
-
-				// Set Group key material to Asic
-			AsicAddSharedKeyEntry(pAd, BSS0, KeyIdx, CipherAlg, Key, NULL, NULL);
-
-				// Update WCID attribute table and IVEIV table for this group key table
-				RTMPAddWcidAttributeEntry(pAd, BSS0, KeyIdx, CipherAlg, NULL);
-
-			}
-		}
-	}
-end:
-	return;
-}
-
-char * rtstrchr(const char * s, int c)
-{
-    for(; *s != (char) c; ++s)
-        if (*s == '\0')
-            return NULL;
-    return (char *) s;
-}
-
-/*
-This is required for LinEX2004/kernel2.6.7 to provide iwlist scanning function
-*/
-
-int
-rt_ioctl_giwname(struct net_device *dev,
-		   struct iw_request_info *info,
-		   char *name, char *extra)
-{
-
-#ifdef RTMP_MAC_PCI
-    strncpy(name, "RT2860 Wireless", IFNAMSIZ);
-#endif // RTMP_MAC_PCI //
-	return 0;
-}
-
-int rt_ioctl_siwfreq(struct net_device *dev,
-			struct iw_request_info *info,
-			struct iw_freq *freq, char *extra)
-{
-	PRTMP_ADAPTER pAdapter = RTMP_OS_NETDEV_GET_PRIV(dev);
-	int	chan = -1;
-
-    //check if the interface is down
-    if(!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE))
-    {
-        DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
-        return -ENETDOWN;
-    }
-
-
-	if (freq->e > 1)
-		return -EINVAL;
-
-	if((freq->e == 0) && (freq->m <= 1000))
-		chan = freq->m;	// Setting by channel number
-	else
-		MAP_KHZ_TO_CHANNEL_ID( (freq->m /100) , chan); // Setting by frequency - search the table , like 2.412G, 2.422G,
-
-    if (ChannelSanity(pAdapter, chan) == TRUE)
-    {
-	pAdapter->CommonCfg.Channel = chan;
-	DBGPRINT(RT_DEBUG_ERROR, ("==>rt_ioctl_siwfreq::SIOCSIWFREQ[cmd=0x%x] (Channel=%d)\n", SIOCSIWFREQ, pAdapter->CommonCfg.Channel));
-    }
-    else
-        return -EINVAL;
-
-	return 0;
-}
-
-
-int rt_ioctl_giwfreq(struct net_device *dev,
-		   struct iw_request_info *info,
-		   struct iw_freq *freq, char *extra)
-{
-	PRTMP_ADAPTER pAdapter = NULL;
-	UCHAR ch;
-	ULONG	m = 2412000;
-
-	pAdapter = RTMP_OS_NETDEV_GET_PRIV(dev);
-	if (pAdapter == NULL)
-	{
-		/* if 1st open fail, pAd will be free;
-		   So the net_dev->priv will be NULL in 2rd open */
-		return -ENETDOWN;
-	}
-
-		ch = pAdapter->CommonCfg.Channel;
-
-	DBGPRINT(RT_DEBUG_TRACE,("==>rt_ioctl_giwfreq  %d\n", ch));
-
-	MAP_CHANNEL_ID_TO_KHZ(ch, m);
-	freq->m = m * 100;
-	freq->e = 1;
-	return 0;
-}
-
-
-int rt_ioctl_siwmode(struct net_device *dev,
-		   struct iw_request_info *info,
-		   __u32 *mode, char *extra)
-{
-	PRTMP_ADAPTER pAdapter = RTMP_OS_NETDEV_GET_PRIV(dev);
-
-	//check if the interface is down
-    if(!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE))
-    {
-	DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
-	return -ENETDOWN;
-    }
-
-	switch (*mode)
-	{
-		case IW_MODE_ADHOC:
-			Set_NetworkType_Proc(pAdapter, "Adhoc");
-			break;
-		case IW_MODE_INFRA:
-			Set_NetworkType_Proc(pAdapter, "Infra");
-			break;
-#if (LINUX_VERSION_CODE > KERNEL_VERSION(2,4,20))
-        case IW_MODE_MONITOR:
-			Set_NetworkType_Proc(pAdapter, "Monitor");
-			break;
-#endif
-		default:
-			DBGPRINT(RT_DEBUG_TRACE, ("===>rt_ioctl_siwmode::SIOCSIWMODE (unknown %d)\n", *mode));
-			return -EINVAL;
-	}
-
-	// Reset Ralink supplicant to not use, it will be set to start when UI set PMK key
-	pAdapter->StaCfg.WpaState = SS_NOTUSE;
-
-	return 0;
-}
-
-
-int rt_ioctl_giwmode(struct net_device *dev,
-		   struct iw_request_info *info,
-		   __u32 *mode, char *extra)
-{
-	PRTMP_ADAPTER pAdapter = RTMP_OS_NETDEV_GET_PRIV(dev);
-
-	if (pAdapter == NULL)
-	{
-		/* if 1st open fail, pAd will be free;
-		   So the net_dev->priv will be NULL in 2rd open */
-		return -ENETDOWN;
-	}
-
-	if (ADHOC_ON(pAdapter))
-		*mode = IW_MODE_ADHOC;
-    else if (INFRA_ON(pAdapter))
-		*mode = IW_MODE_INFRA;
-#if (LINUX_VERSION_CODE > KERNEL_VERSION(2,4,20))
-    else if (MONITOR_ON(pAdapter))
-    {
-        *mode = IW_MODE_MONITOR;
-    }
-#endif
-    else
-        *mode = IW_MODE_AUTO;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("==>rt_ioctl_giwmode(mode=%d)\n", *mode));
-	return 0;
-}
-
-int rt_ioctl_siwsens(struct net_device *dev,
-		   struct iw_request_info *info,
-		   char *name, char *extra)
-{
-	PRTMP_ADAPTER pAdapter = RTMP_OS_NETDEV_GET_PRIV(dev);
-
-	//check if the interface is down
-	if(!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE))
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
-		return -ENETDOWN;
-	}
-
-	return 0;
-}
-
-int rt_ioctl_giwsens(struct net_device *dev,
-		   struct iw_request_info *info,
-		   char *name, char *extra)
-{
-	return 0;
-}
-
-int rt_ioctl_giwrange(struct net_device *dev,
-		   struct iw_request_info *info,
-		   struct iw_point *data, char *extra)
-{
-	PRTMP_ADAPTER pAdapter = RTMP_OS_NETDEV_GET_PRIV(dev);
-	struct iw_range *range = (struct iw_range *) extra;
-	u16 val;
-	int i;
-
-	if (pAdapter == NULL)
-	{
-		/* if 1st open fail, pAd will be free;
-		   So the net_dev->priv will be NULL in 2rd open */
-		return -ENETDOWN;
-	}
-
-	DBGPRINT(RT_DEBUG_TRACE ,("===>rt_ioctl_giwrange\n"));
-	data->length = sizeof(struct iw_range);
-	memset(range, 0, sizeof(struct iw_range));
-
-	range->txpower_capa = IW_TXPOW_DBM;
-
-	if (INFRA_ON(pAdapter)||ADHOC_ON(pAdapter))
-	{
-		range->min_pmp = 1 * 1024;
-		range->max_pmp = 65535 * 1024;
-		range->min_pmt = 1 * 1024;
-		range->max_pmt = 1000 * 1024;
-		range->pmp_flags = IW_POWER_PERIOD;
-		range->pmt_flags = IW_POWER_TIMEOUT;
-		range->pm_capa = IW_POWER_PERIOD | IW_POWER_TIMEOUT |
-			IW_POWER_UNICAST_R | IW_POWER_ALL_R;
-	}
-
-	range->we_version_compiled = WIRELESS_EXT;
-	range->we_version_source = 14;
-
-	range->retry_capa = IW_RETRY_LIMIT;
-	range->retry_flags = IW_RETRY_LIMIT;
-	range->min_retry = 0;
-	range->max_retry = 255;
-
-	range->num_channels =  pAdapter->ChannelListNum;
-
-	val = 0;
-	for (i = 1; i <= range->num_channels; i++)
-	{
-		u32 m = 2412000;
-		range->freq[val].i = pAdapter->ChannelList[i-1].Channel;
-		MAP_CHANNEL_ID_TO_KHZ(pAdapter->ChannelList[i-1].Channel, m);
-		range->freq[val].m = m * 100; /* OS_HZ */
-
-		range->freq[val].e = 1;
-		val++;
-		if (val == IW_MAX_FREQUENCIES)
-			break;
-	}
-	range->num_frequency = val;
-
-	range->max_qual.qual = 100; /* what is correct max? This was not
-					* documented exactly. At least
-					* 69 has been observed. */
-	range->max_qual.level = 0; /* dB */
-	range->max_qual.noise = 0; /* dB */
-
-	/* What would be suitable values for "average/typical" qual? */
-	range->avg_qual.qual = 20;
-	range->avg_qual.level = -60;
-	range->avg_qual.noise = -95;
-	range->sensitivity = 3;
-
-	range->max_encoding_tokens = NR_WEP_KEYS;
-	range->num_encoding_sizes = 2;
-	range->encoding_size[0] = 5;
-	range->encoding_size[1] = 13;
-
-	range->min_rts = 0;
-	range->max_rts = 2347;
-	range->min_frag = 256;
-	range->max_frag = 2346;
-
-#if WIRELESS_EXT > 17
-	/* IW_ENC_CAPA_* bit field */
-	range->enc_capa = IW_ENC_CAPA_WPA | IW_ENC_CAPA_WPA2 |
-					IW_ENC_CAPA_CIPHER_TKIP | IW_ENC_CAPA_CIPHER_CCMP;
-#endif
-
-	return 0;
-}
-
-int rt_ioctl_siwap(struct net_device *dev,
-		      struct iw_request_info *info,
-		      struct sockaddr *ap_addr, char *extra)
-{
-	PRTMP_ADAPTER pAdapter = RTMP_OS_NETDEV_GET_PRIV(dev);
-    NDIS_802_11_MAC_ADDRESS Bssid;
-
-	//check if the interface is down
-	if(!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE))
-	{
-	DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
-	return -ENETDOWN;
-    }
-
-	if (pAdapter->Mlme.CntlMachine.CurrState != CNTL_IDLE)
-    {
-        RTMP_MLME_RESET_STATE_MACHINE(pAdapter);
-        DBGPRINT(RT_DEBUG_TRACE, ("!!! MLME busy, reset MLME state machine !!!\n"));
-    }
-
-    // tell CNTL state machine to call NdisMSetInformationComplete() after completing
-    // this request, because this request is initiated by NDIS.
-    pAdapter->MlmeAux.CurrReqIsFromNdis = FALSE;
-	// Prevent to connect AP again in STAMlmePeriodicExec
-	pAdapter->MlmeAux.AutoReconnectSsidLen= 32;
-
-    memset(Bssid, 0, MAC_ADDR_LEN);
-    memcpy(Bssid, ap_addr->sa_data, MAC_ADDR_LEN);
-    MlmeEnqueue(pAdapter,
-                MLME_CNTL_STATE_MACHINE,
-                OID_802_11_BSSID,
-                sizeof(NDIS_802_11_MAC_ADDRESS),
-                (VOID *)&Bssid);
-
-    DBGPRINT(RT_DEBUG_TRACE, ("IOCTL::SIOCSIWAP %02x:%02x:%02x:%02x:%02x:%02x\n",
-        Bssid[0], Bssid[1], Bssid[2], Bssid[3], Bssid[4], Bssid[5]));
-
-	return 0;
-}
-
-int rt_ioctl_giwap(struct net_device *dev,
-		      struct iw_request_info *info,
-		      struct sockaddr *ap_addr, char *extra)
-{
-	PRTMP_ADAPTER pAdapter = RTMP_OS_NETDEV_GET_PRIV(dev);
-
-	if (pAdapter == NULL)
-	{
-		/* if 1st open fail, pAd will be free;
-		   So the net_dev->priv will be NULL in 2rd open */
-		return -ENETDOWN;
-	}
-
-	if (INFRA_ON(pAdapter) || ADHOC_ON(pAdapter))
-	{
-		ap_addr->sa_family = ARPHRD_ETHER;
-		memcpy(ap_addr->sa_data, &pAdapter->CommonCfg.Bssid, ETH_ALEN);
-	}
-#ifdef WPA_SUPPLICANT_SUPPORT
-    // Add for RT2870
-    else if (pAdapter->StaCfg.WpaSupplicantUP != WPA_SUPPLICANT_DISABLE)
-    {
-        ap_addr->sa_family = ARPHRD_ETHER;
-        memcpy(ap_addr->sa_data, &pAdapter->MlmeAux.Bssid, ETH_ALEN);
-    }
-#endif // WPA_SUPPLICANT_SUPPORT //
-	else
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("IOCTL::SIOCGIWAP(=EMPTY)\n"));
-		return -ENOTCONN;
-	}
-
-	return 0;
-}
-
-/*
- * Units are in db above the noise floor. That means the
- * rssi values reported in the tx/rx descriptors in the
- * driver are the SNR expressed in db.
- *
- * If you assume that the noise floor is -95, which is an
- * excellent assumption 99.5 % of the time, then you can
- * derive the absolute signal level (i.e. -95 + rssi).
- * There are some other slight factors to take into account
- * depending on whether the rssi measurement is from 11b,
- * 11g, or 11a.   These differences are at most 2db and
- * can be documented.
- *
- * NB: various calculations are based on the orinoco/wavelan
- *     drivers for compatibility
- */
-static void set_quality(PRTMP_ADAPTER pAdapter,
-                        struct iw_quality *iq,
-                        signed char rssi)
-{
-	__u8 ChannelQuality;
-
-	// Normalize Rssi
-	if (rssi >= -50)
-        ChannelQuality = 100;
-	else if (rssi >= -80) // between -50 ~ -80dbm
-		ChannelQuality = (__u8)(24 + ((rssi + 80) * 26)/10);
-	else if (rssi >= -90)   // between -80 ~ -90dbm
-        ChannelQuality = (__u8)((rssi + 90) * 26)/10;
-	else
-		ChannelQuality = 0;
-
-    iq->qual = (__u8)ChannelQuality;
-
-    iq->level = (__u8)(rssi);
-    iq->noise = (pAdapter->BbpWriteLatch[66] > pAdapter->BbpTuning.FalseCcaUpperThreshold) ? ((__u8)pAdapter->BbpTuning.FalseCcaUpperThreshold) : ((__u8) pAdapter->BbpWriteLatch[66]);		// noise level (dBm)
-    iq->noise += 256 - 143;
-    iq->updated = pAdapter->iw_stats.qual.updated;
-}
-
-int rt_ioctl_iwaplist(struct net_device *dev,
-			struct iw_request_info *info,
-			struct iw_point *data, char *extra)
-{
-	PRTMP_ADAPTER pAdapter = RTMP_OS_NETDEV_GET_PRIV(dev);
-
-	struct sockaddr addr[IW_MAX_AP];
-	struct iw_quality qual[IW_MAX_AP];
-	int i;
-
-	//check if the interface is down
-    if(!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE))
-    {
-	DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
-		data->length = 0;
-		return 0;
-        //return -ENETDOWN;
-	}
-
-	for (i = 0; i <IW_MAX_AP ; i++)
-	{
-		if (i >=  pAdapter->ScanTab.BssNr)
-			break;
-		addr[i].sa_family = ARPHRD_ETHER;
-			memcpy(addr[i].sa_data, &pAdapter->ScanTab.BssEntry[i].Bssid, MAC_ADDR_LEN);
-		set_quality(pAdapter, &qual[i], pAdapter->ScanTab.BssEntry[i].Rssi);
-	}
-	data->length = i;
-	memcpy(extra, &addr, i*sizeof(addr[0]));
-	data->flags = 1;		/* signal quality present (sort of) */
-	memcpy(extra + i*sizeof(addr[0]), &qual, i*sizeof(qual[i]));
-
-	return 0;
-}
-
-#ifdef SIOCGIWSCAN
-int rt_ioctl_siwscan(struct net_device *dev,
-			struct iw_request_info *info,
-			struct iw_point *data, char *extra)
-{
-	PRTMP_ADAPTER pAdapter = RTMP_OS_NETDEV_GET_PRIV(dev);
-
-	ULONG								Now;
-	int Status = NDIS_STATUS_SUCCESS;
-
-	//check if the interface is down
-	if(!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE))
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
-		return -ENETDOWN;
-	}
-
-	if (MONITOR_ON(pAdapter))
-    {
-        DBGPRINT(RT_DEBUG_TRACE, ("!!! Driver is in Monitor Mode now !!!\n"));
-        return -EINVAL;
-    }
-
-
-#ifdef WPA_SUPPLICANT_SUPPORT
-	if (pAdapter->StaCfg.WpaSupplicantUP == WPA_SUPPLICANT_ENABLE)
-	{
-		pAdapter->StaCfg.WpaSupplicantScanCount++;
-	}
-#endif // WPA_SUPPLICANT_SUPPORT //
-
-    pAdapter->StaCfg.bScanReqIsFromWebUI = TRUE;
-	if (RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS))
-		return NDIS_STATUS_SUCCESS;
-	do{
-		Now = jiffies;
-
-#ifdef WPA_SUPPLICANT_SUPPORT
-		if ((pAdapter->StaCfg.WpaSupplicantUP == WPA_SUPPLICANT_ENABLE) &&
-			(pAdapter->StaCfg.WpaSupplicantScanCount > 3))
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("!!! WpaSupplicantScanCount > 3\n"));
-			Status = NDIS_STATUS_SUCCESS;
-			break;
-		}
-#endif // WPA_SUPPLICANT_SUPPORT //
-
-		if ((OPSTATUS_TEST_FLAG(pAdapter, fOP_STATUS_MEDIA_STATE_CONNECTED)) &&
-			((pAdapter->StaCfg.AuthMode == Ndis802_11AuthModeWPA) ||
-			(pAdapter->StaCfg.AuthMode == Ndis802_11AuthModeWPAPSK)) &&
-			(pAdapter->StaCfg.PortSecured == WPA_802_1X_PORT_NOT_SECURED))
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("!!! Link UP, Port Not Secured! ignore this set::OID_802_11_BSSID_LIST_SCAN\n"));
-			Status = NDIS_STATUS_SUCCESS;
-			break;
-		}
-
-		if (pAdapter->Mlme.CntlMachine.CurrState != CNTL_IDLE)
-		{
-			RTMP_MLME_RESET_STATE_MACHINE(pAdapter);
-			DBGPRINT(RT_DEBUG_TRACE, ("!!! MLME busy, reset MLME state machine !!!\n"));
-		}
-
-		// tell CNTL state machine to call NdisMSetInformationComplete() after completing
-		// this request, because this request is initiated by NDIS.
-		pAdapter->MlmeAux.CurrReqIsFromNdis = FALSE;
-		// Reset allowed scan retries
-		pAdapter->StaCfg.ScanCnt = 0;
-		pAdapter->StaCfg.LastScanTime = Now;
-
-		MlmeEnqueue(pAdapter,
-			MLME_CNTL_STATE_MACHINE,
-			OID_802_11_BSSID_LIST_SCAN,
-			0,
-			NULL);
-
-		Status = NDIS_STATUS_SUCCESS;
-		RTMP_MLME_HANDLER(pAdapter);
-	}while(0);
-	return NDIS_STATUS_SUCCESS;
-}
-
-int rt_ioctl_giwscan(struct net_device *dev,
-			struct iw_request_info *info,
-			struct iw_point *data, char *extra)
-{
-
-	PRTMP_ADAPTER pAdapter = RTMP_OS_NETDEV_GET_PRIV(dev);
-	int i=0;
-	PSTRING current_ev = extra, previous_ev = extra;
-	PSTRING end_buf;
-	PSTRING current_val;
-	STRING custom[MAX_CUSTOM_LEN] = {0};
-#ifndef IWEVGENIE
-	unsigned char idx;
-#endif // IWEVGENIE //
-	struct iw_event iwe;
-
-	if (RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS))
-    {
-		/*
-		 * Still scanning, indicate the caller should try again.
-		 */
-		return -EAGAIN;
-	}
-
-
-#ifdef WPA_SUPPLICANT_SUPPORT
-	if (pAdapter->StaCfg.WpaSupplicantUP == WPA_SUPPLICANT_ENABLE)
-	{
-		pAdapter->StaCfg.WpaSupplicantScanCount = 0;
-	}
-#endif // WPA_SUPPLICANT_SUPPORT //
-
-	if (pAdapter->ScanTab.BssNr == 0)
-	{
-		data->length = 0;
-		return 0;
-	}
-
-#if WIRELESS_EXT >= 17
-    if (data->length > 0)
-        end_buf = extra + data->length;
-    else
-        end_buf = extra + IW_SCAN_MAX_DATA;
-#else
-    end_buf = extra + IW_SCAN_MAX_DATA;
-#endif
-
-	for (i = 0; i < pAdapter->ScanTab.BssNr; i++)
-	{
-		if (current_ev >= end_buf)
-        {
-#if WIRELESS_EXT >= 17
-            return -E2BIG;
-#else
-			break;
-#endif
-        }
-
-		//MAC address
-		//================================
-		memset(&iwe, 0, sizeof(iwe));
-		iwe.cmd = SIOCGIWAP;
-		iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
-				memcpy(iwe.u.ap_addr.sa_data, &pAdapter->ScanTab.BssEntry[i].Bssid, ETH_ALEN);
-
-        previous_ev = current_ev;
-		current_ev = IWE_STREAM_ADD_EVENT(info, current_ev,end_buf, &iwe, IW_EV_ADDR_LEN);
-        if (current_ev == previous_ev)
-#if WIRELESS_EXT >= 17
-            return -E2BIG;
-#else
-			break;
-#endif
-
-		/*
-		Protocol:
-			it will show scanned AP's WirelessMode .
-			it might be
-					802.11a
-					802.11a/n
-					802.11g/n
-					802.11b/g/n
-					802.11g
-					802.11b/g
-		*/
-		memset(&iwe, 0, sizeof(iwe));
-		iwe.cmd = SIOCGIWNAME;
-
-
-	{
-		PBSS_ENTRY pBssEntry=&pAdapter->ScanTab.BssEntry[i];
-		BOOLEAN isGonly=FALSE;
-		int rateCnt=0;
-
-		if (pBssEntry->Channel>14)
-		{
-			if (pBssEntry->HtCapabilityLen!=0)
-				strcpy(iwe.u.name,"802.11a/n");
-			else
-				strcpy(iwe.u.name,"802.11a");
-		}
-		else
-		{
-			/*
-				if one of non B mode rate is set supported rate . it mean G only.
-			*/
-			for (rateCnt=0;rateCnt<pBssEntry->SupRateLen;rateCnt++)
-			{
-				/*
-					6Mbps(140) 9Mbps(146) and >=12Mbps(152) are supported rate , it mean G only.
-				*/
-				if (pBssEntry->SupRate[rateCnt]==140 || pBssEntry->SupRate[rateCnt]==146 || pBssEntry->SupRate[rateCnt]>=152)
-					isGonly=TRUE;
-			}
-
-			for (rateCnt=0;rateCnt<pBssEntry->ExtRateLen;rateCnt++)
-			{
-				if (pBssEntry->ExtRate[rateCnt]==140 || pBssEntry->ExtRate[rateCnt]==146 || pBssEntry->ExtRate[rateCnt]>=152)
-					isGonly=TRUE;
-			}
-
-
-			if (pBssEntry->HtCapabilityLen!=0)
-			{
-				if (isGonly==TRUE)
-					strcpy(iwe.u.name,"802.11g/n");
-				else
-					strcpy(iwe.u.name,"802.11b/g/n");
-			}
-			else
-			{
-				if (isGonly==TRUE)
-					strcpy(iwe.u.name,"802.11g");
-				else
-				{
-					if (pBssEntry->SupRateLen==4 && pBssEntry->ExtRateLen==0)
-						strcpy(iwe.u.name,"802.11b");
-					else
-						strcpy(iwe.u.name,"802.11b/g");
-				}
-			}
-		}
-	}
-
-		previous_ev = current_ev;
-		current_ev = IWE_STREAM_ADD_EVENT(info, current_ev,end_buf, &iwe, IW_EV_ADDR_LEN);
-		if (current_ev == previous_ev)
-#if WIRELESS_EXT >= 17
-			return -E2BIG;
-#else
-			break;
-#endif
-
-		//ESSID
-		//================================
-		memset(&iwe, 0, sizeof(iwe));
-		iwe.cmd = SIOCGIWESSID;
-		iwe.u.data.length = pAdapter->ScanTab.BssEntry[i].SsidLen;
-		iwe.u.data.flags = 1;
-
-        previous_ev = current_ev;
-		current_ev = IWE_STREAM_ADD_POINT(info, current_ev,end_buf, &iwe, (PSTRING) pAdapter->ScanTab.BssEntry[i].Ssid);
-        if (current_ev == previous_ev)
-#if WIRELESS_EXT >= 17
-            return -E2BIG;
-#else
-			break;
-#endif
-
-		//Network Type
-		//================================
-		memset(&iwe, 0, sizeof(iwe));
-		iwe.cmd = SIOCGIWMODE;
-		if (pAdapter->ScanTab.BssEntry[i].BssType == Ndis802_11IBSS)
-		{
-			iwe.u.mode = IW_MODE_ADHOC;
-		}
-		else if (pAdapter->ScanTab.BssEntry[i].BssType == Ndis802_11Infrastructure)
-		{
-			iwe.u.mode = IW_MODE_INFRA;
-		}
-		else
-		{
-			iwe.u.mode = IW_MODE_AUTO;
-		}
-		iwe.len = IW_EV_UINT_LEN;
-
-        previous_ev = current_ev;
-		current_ev = IWE_STREAM_ADD_EVENT(info, current_ev, end_buf, &iwe,  IW_EV_UINT_LEN);
-        if (current_ev == previous_ev)
-#if WIRELESS_EXT >= 17
-            return -E2BIG;
-#else
-			break;
-#endif
-
-		//Channel and Frequency
-		//================================
-		memset(&iwe, 0, sizeof(iwe));
-		iwe.cmd = SIOCGIWFREQ;
-		if (INFRA_ON(pAdapter) || ADHOC_ON(pAdapter))
-			iwe.u.freq.m = pAdapter->ScanTab.BssEntry[i].Channel;
-		else
-			iwe.u.freq.m = pAdapter->ScanTab.BssEntry[i].Channel;
-		iwe.u.freq.e = 0;
-		iwe.u.freq.i = 0;
-
-		previous_ev = current_ev;
-		current_ev = IWE_STREAM_ADD_EVENT(info, current_ev,end_buf, &iwe, IW_EV_FREQ_LEN);
-        if (current_ev == previous_ev)
-#if WIRELESS_EXT >= 17
-            return -E2BIG;
-#else
-			break;
-#endif
-
-        //Add quality statistics
-        //================================
-        memset(&iwe, 0, sizeof(iwe));
-	iwe.cmd = IWEVQUAL;
-	iwe.u.qual.level = 0;
-	iwe.u.qual.noise = 0;
-	set_quality(pAdapter, &iwe.u.qual, pAdapter->ScanTab.BssEntry[i].Rssi);
-	current_ev = IWE_STREAM_ADD_EVENT(info, current_ev, end_buf, &iwe, IW_EV_QUAL_LEN);
-	if (current_ev == previous_ev)
-#if WIRELESS_EXT >= 17
-            return -E2BIG;
-#else
-			break;
-#endif
-
-		//Encyption key
-		//================================
-		memset(&iwe, 0, sizeof(iwe));
-		iwe.cmd = SIOCGIWENCODE;
-		if (CAP_IS_PRIVACY_ON (pAdapter->ScanTab.BssEntry[i].CapabilityInfo ))
-			iwe.u.data.flags =IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
-		else
-			iwe.u.data.flags = IW_ENCODE_DISABLED;
-
-        previous_ev = current_ev;
-        current_ev = IWE_STREAM_ADD_POINT(info, current_ev, end_buf,&iwe, (char *)pAdapter->SharedKey[BSS0][(iwe.u.data.flags & IW_ENCODE_INDEX)-1].Key);
-        if (current_ev == previous_ev)
-#if WIRELESS_EXT >= 17
-            return -E2BIG;
-#else
-			break;
-#endif
-
-		//Bit Rate
-		//================================
-		if (pAdapter->ScanTab.BssEntry[i].SupRateLen)
-        {
-            UCHAR tmpRate = pAdapter->ScanTab.BssEntry[i].SupRate[pAdapter->ScanTab.BssEntry[i].SupRateLen-1];
-			memset(&iwe, 0, sizeof(iwe));
-			iwe.cmd = SIOCGIWRATE;
-		current_val = current_ev + IW_EV_LCP_LEN;
-            if (tmpRate == 0x82)
-                iwe.u.bitrate.value =  1 * 1000000;
-            else if (tmpRate == 0x84)
-                iwe.u.bitrate.value =  2 * 1000000;
-            else if (tmpRate == 0x8B)
-                iwe.u.bitrate.value =  5.5 * 1000000;
-            else if (tmpRate == 0x96)
-                iwe.u.bitrate.value =  11 * 1000000;
-            else
-		    iwe.u.bitrate.value =  (tmpRate/2) * 1000000;
-
-			if (tmpRate == 0x6c && pAdapter->ScanTab.BssEntry[i].HtCapabilityLen > 0)
-			{
-				int rate_count = sizeof(ralinkrate)/sizeof(__s32);
-				HT_CAP_INFO capInfo = pAdapter->ScanTab.BssEntry[i].HtCapability.HtCapInfo;
-				int shortGI = capInfo.ChannelWidth ? capInfo.ShortGIfor40 : capInfo.ShortGIfor20;
-				int maxMCS = pAdapter->ScanTab.BssEntry[i].HtCapability.MCSSet[1] ?  15 : 7;
-				int rate_index = 12 + ((UCHAR)capInfo.ChannelWidth * 24) + ((UCHAR)shortGI *48) + ((UCHAR)maxMCS);
-				if (rate_index < 0)
-					rate_index = 0;
-				if (rate_index > rate_count)
-					rate_index = rate_count;
-				iwe.u.bitrate.value	=  ralinkrate[rate_index] * 500000;
-			}
-
-			iwe.u.bitrate.disabled = 0;
-			current_val = IWE_STREAM_ADD_VALUE(info, current_ev,
-				current_val, end_buf, &iwe,
-			IW_EV_PARAM_LEN);
-
-		if((current_val-current_ev)>IW_EV_LCP_LEN)
-		current_ev = current_val;
-		else
-#if WIRELESS_EXT >= 17
-                return -E2BIG;
-#else
-			    break;
-#endif
-        }
-
-#ifdef IWEVGENIE
-        //WPA IE
-		if (pAdapter->ScanTab.BssEntry[i].WpaIE.IELen > 0)
-        {
-			memset(&iwe, 0, sizeof(iwe));
-			memset(&custom[0], 0, MAX_CUSTOM_LEN);
-			memcpy(custom, &(pAdapter->ScanTab.BssEntry[i].WpaIE.IE[0]),
-						   pAdapter->ScanTab.BssEntry[i].WpaIE.IELen);
-			iwe.cmd = IWEVGENIE;
-			iwe.u.data.length = pAdapter->ScanTab.BssEntry[i].WpaIE.IELen;
-			current_ev = IWE_STREAM_ADD_POINT(info, current_ev, end_buf, &iwe, custom);
-			if (current_ev == previous_ev)
-#if WIRELESS_EXT >= 17
-                return -E2BIG;
-#else
-			    break;
-#endif
-		}
-
-		//WPA2 IE
-        if (pAdapter->ScanTab.BssEntry[i].RsnIE.IELen > 0)
-        {
-		memset(&iwe, 0, sizeof(iwe));
-			memset(&custom[0], 0, MAX_CUSTOM_LEN);
-			memcpy(custom, &(pAdapter->ScanTab.BssEntry[i].RsnIE.IE[0]),
-						   pAdapter->ScanTab.BssEntry[i].RsnIE.IELen);
-			iwe.cmd = IWEVGENIE;
-			iwe.u.data.length = pAdapter->ScanTab.BssEntry[i].RsnIE.IELen;
-			current_ev = IWE_STREAM_ADD_POINT(info, current_ev, end_buf, &iwe, custom);
-			if (current_ev == previous_ev)
-#if WIRELESS_EXT >= 17
-                return -E2BIG;
-#else
-			    break;
-#endif
-        }
-#else
-        //WPA IE
-		//================================
-        if (pAdapter->ScanTab.BssEntry[i].WpaIE.IELen > 0)
-        {
-		NdisZeroMemory(&iwe, sizeof(iwe));
-			memset(&custom[0], 0, MAX_CUSTOM_LEN);
-		iwe.cmd = IWEVCUSTOM;
-            iwe.u.data.length = (pAdapter->ScanTab.BssEntry[i].WpaIE.IELen * 2) + 7;
-            NdisMoveMemory(custom, "wpa_ie=", 7);
-            for (idx = 0; idx < pAdapter->ScanTab.BssEntry[i].WpaIE.IELen; idx++)
-                sprintf(custom, "%s%02x", custom, pAdapter->ScanTab.BssEntry[i].WpaIE.IE[idx]);
-            previous_ev = current_ev;
-		current_ev = IWE_STREAM_ADD_POINT(info, current_ev, end_buf, &iwe,  custom);
-            if (current_ev == previous_ev)
-#if WIRELESS_EXT >= 17
-                return -E2BIG;
-#else
-			    break;
-#endif
-        }
-
-        //WPA2 IE
-        if (pAdapter->ScanTab.BssEntry[i].RsnIE.IELen > 0)
-        {
-		NdisZeroMemory(&iwe, sizeof(iwe));
-			memset(&custom[0], 0, MAX_CUSTOM_LEN);
-		iwe.cmd = IWEVCUSTOM;
-            iwe.u.data.length = (pAdapter->ScanTab.BssEntry[i].RsnIE.IELen * 2) + 7;
-            NdisMoveMemory(custom, "rsn_ie=", 7);
-			for (idx = 0; idx < pAdapter->ScanTab.BssEntry[i].RsnIE.IELen; idx++)
-                sprintf(custom, "%s%02x", custom, pAdapter->ScanTab.BssEntry[i].RsnIE.IE[idx]);
-            previous_ev = current_ev;
-		current_ev = IWE_STREAM_ADD_POINT(info, current_ev, end_buf, &iwe,  custom);
-            if (current_ev == previous_ev)
-#if WIRELESS_EXT >= 17
-                return -E2BIG;
-#else
-			    break;
-#endif
-        }
-#endif // IWEVGENIE //
-	}
-
-	data->length = current_ev - extra;
-    pAdapter->StaCfg.bScanReqIsFromWebUI = FALSE;
-	DBGPRINT(RT_DEBUG_ERROR ,("===>rt_ioctl_giwscan. %d(%d) BSS returned, data->length = %d\n",i , pAdapter->ScanTab.BssNr, data->length));
-	return 0;
-}
-#endif
-
-int rt_ioctl_siwessid(struct net_device *dev,
-			 struct iw_request_info *info,
-			 struct iw_point *data, char *essid)
-{
-	PRTMP_ADAPTER pAdapter = RTMP_OS_NETDEV_GET_PRIV(dev);
-
-	//check if the interface is down
-    if(!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE))
-    {
-	DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
-	return -ENETDOWN;
-    }
-
-	if (data->flags)
-	{
-		PSTRING	pSsidString = NULL;
-
-		// Includes null character.
-		if (data->length > (IW_ESSID_MAX_SIZE + 1))
-			return -E2BIG;
-
-		pSsidString = kmalloc(MAX_LEN_OF_SSID+1, MEM_ALLOC_FLAG);
-		if (pSsidString)
-        {
-			NdisZeroMemory(pSsidString, MAX_LEN_OF_SSID+1);
-			NdisMoveMemory(pSsidString, essid, data->length);
-			if (Set_SSID_Proc(pAdapter, pSsidString) == FALSE)
-				return -EINVAL;
-		}
-		else
-			return -ENOMEM;
-		}
-	else
-    {
-		// ANY ssid
-		if (Set_SSID_Proc(pAdapter, "") == FALSE)
-			return -EINVAL;
-    }
-	return 0;
-}
-
-int rt_ioctl_giwessid(struct net_device *dev,
-			 struct iw_request_info *info,
-			 struct iw_point *data, char *essid)
-{
-	PRTMP_ADAPTER pAdapter = RTMP_OS_NETDEV_GET_PRIV(dev);
-
-	if (pAdapter == NULL)
-	{
-		/* if 1st open fail, pAd will be free;
-		   So the net_dev->priv will be NULL in 2rd open */
-		return -ENETDOWN;
-	}
-
-	data->flags = 1;
-    if (MONITOR_ON(pAdapter))
-    {
-        data->length  = 0;
-        return 0;
-    }
-
-	if (OPSTATUS_TEST_FLAG(pAdapter, fOP_STATUS_MEDIA_STATE_CONNECTED))
-	{
-		DBGPRINT(RT_DEBUG_TRACE ,("MediaState is connected\n"));
-		data->length = pAdapter->CommonCfg.SsidLen;
-		memcpy(essid, pAdapter->CommonCfg.Ssid, pAdapter->CommonCfg.SsidLen);
-	}
-	else
-	{//the ANY ssid was specified
-		data->length  = 0;
-		DBGPRINT(RT_DEBUG_TRACE ,("MediaState is not connected, ess\n"));
-	}
-
-	return 0;
-
-}
-
-int rt_ioctl_siwnickn(struct net_device *dev,
-			 struct iw_request_info *info,
-			 struct iw_point *data, char *nickname)
-{
-	PRTMP_ADAPTER pAdapter = RTMP_OS_NETDEV_GET_PRIV(dev);
-
-    //check if the interface is down
-    if(!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE))
-    {
-        DBGPRINT(RT_DEBUG_TRACE ,("INFO::Network is down!\n"));
-        return -ENETDOWN;
-    }
-
-	if (data->length > IW_ESSID_MAX_SIZE)
-		return -EINVAL;
-
-	memset(pAdapter->nickname, 0, IW_ESSID_MAX_SIZE + 1);
-	memcpy(pAdapter->nickname, nickname, data->length);
-
-
-	return 0;
-}
-
-int rt_ioctl_giwnickn(struct net_device *dev,
-			 struct iw_request_info *info,
-			 struct iw_point *data, char *nickname)
-{
-	PRTMP_ADAPTER pAdapter = RTMP_OS_NETDEV_GET_PRIV(dev);
-
-	if (pAdapter == NULL)
-	{
-		/* if 1st open fail, pAd will be free;
-		   So the net_dev->priv will be NULL in 2rd open */
-		return -ENETDOWN;
-	}
-
-	if (data->length > strlen((PSTRING) pAdapter->nickname) + 1)
-		data->length = strlen((PSTRING) pAdapter->nickname) + 1;
-	if (data->length > 0) {
-		memcpy(nickname, pAdapter->nickname, data->length-1);
-		nickname[data->length-1] = '\0';
-	}
-	return 0;
-}
-
-int rt_ioctl_siwrts(struct net_device *dev,
-		       struct iw_request_info *info,
-		       struct iw_param *rts, char *extra)
-{
-	PRTMP_ADAPTER pAdapter = RTMP_OS_NETDEV_GET_PRIV(dev);
-	u16 val;
-
-    //check if the interface is down
-    if(!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE))
-    {
-        DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
-        return -ENETDOWN;
-    }
-
-	if (rts->disabled)
-		val = MAX_RTS_THRESHOLD;
-	else if (rts->value < 0 || rts->value > MAX_RTS_THRESHOLD)
-		return -EINVAL;
-	else if (rts->value == 0)
-	    val = MAX_RTS_THRESHOLD;
-	else
-		val = rts->value;
-
-	if (val != pAdapter->CommonCfg.RtsThreshold)
-		pAdapter->CommonCfg.RtsThreshold = val;
-
-	return 0;
-}
-
-int rt_ioctl_giwrts(struct net_device *dev,
-		       struct iw_request_info *info,
-		       struct iw_param *rts, char *extra)
-{
-	PRTMP_ADAPTER pAdapter = RTMP_OS_NETDEV_GET_PRIV(dev);
-
-	if (pAdapter == NULL)
-	{
-		/* if 1st open fail, pAd will be free;
-		   So the net_dev->priv will be NULL in 2rd open */
-		return -ENETDOWN;
-	}
-
-	//check if the interface is down
-	if(!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE))
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
-		return -ENETDOWN;
-	}
-
-	rts->value = pAdapter->CommonCfg.RtsThreshold;
-	rts->disabled = (rts->value == MAX_RTS_THRESHOLD);
-	rts->fixed = 1;
-
-	return 0;
-}
-
-int rt_ioctl_siwfrag(struct net_device *dev,
-			struct iw_request_info *info,
-			struct iw_param *frag, char *extra)
-{
-	PRTMP_ADAPTER pAdapter = RTMP_OS_NETDEV_GET_PRIV(dev);
-	u16 val;
-
-	//check if the interface is down
-	if(!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE))
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
-		return -ENETDOWN;
-	}
-
-	if (frag->disabled)
-		val = MAX_FRAG_THRESHOLD;
-	else if (frag->value >= MIN_FRAG_THRESHOLD || frag->value <= MAX_FRAG_THRESHOLD)
-        val = __cpu_to_le16(frag->value & ~0x1); /* even numbers only */
-	else if (frag->value == 0)
-	    val = MAX_FRAG_THRESHOLD;
-	else
-		return -EINVAL;
-
-	pAdapter->CommonCfg.FragmentThreshold = val;
-	return 0;
-}
-
-int rt_ioctl_giwfrag(struct net_device *dev,
-			struct iw_request_info *info,
-			struct iw_param *frag, char *extra)
-{
-	PRTMP_ADAPTER pAdapter = RTMP_OS_NETDEV_GET_PRIV(dev);
-
-	if (pAdapter == NULL)
-	{
-		/* if 1st open fail, pAd will be free;
-		   So the net_dev->priv will be NULL in 2rd open */
-		return -ENETDOWN;
-	}
-
-	//check if the interface is down
-	if(!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE))
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
-		return -ENETDOWN;
-	}
-
-	frag->value = pAdapter->CommonCfg.FragmentThreshold;
-	frag->disabled = (frag->value == MAX_FRAG_THRESHOLD);
-	frag->fixed = 1;
-
-	return 0;
-}
-
-#define MAX_WEP_KEY_SIZE 13
-#define MIN_WEP_KEY_SIZE 5
-int rt_ioctl_siwencode(struct net_device *dev,
-			  struct iw_request_info *info,
-			  struct iw_point *erq, char *extra)
-{
-	PRTMP_ADAPTER pAdapter = RTMP_OS_NETDEV_GET_PRIV(dev);
-
-	//check if the interface is down
-	if(!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE))
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
-		return -ENETDOWN;
-	}
-
-	if ((erq->length == 0) &&
-        (erq->flags & IW_ENCODE_DISABLED))
-	{
-		pAdapter->StaCfg.PairCipher = Ndis802_11WEPDisabled;
-		pAdapter->StaCfg.GroupCipher = Ndis802_11WEPDisabled;
-		pAdapter->StaCfg.WepStatus = Ndis802_11WEPDisabled;
-        pAdapter->StaCfg.OrigWepStatus = pAdapter->StaCfg.WepStatus;
-        pAdapter->StaCfg.AuthMode = Ndis802_11AuthModeOpen;
-        goto done;
-	}
-	else if (erq->flags & IW_ENCODE_RESTRICTED || erq->flags & IW_ENCODE_OPEN)
-	{
-	    //pAdapter->StaCfg.PortSecured = WPA_802_1X_PORT_SECURED;
-		STA_PORT_SECURED(pAdapter);
-		pAdapter->StaCfg.PairCipher = Ndis802_11WEPEnabled;
-		pAdapter->StaCfg.GroupCipher = Ndis802_11WEPEnabled;
-		pAdapter->StaCfg.WepStatus = Ndis802_11WEPEnabled;
-        pAdapter->StaCfg.OrigWepStatus = pAdapter->StaCfg.WepStatus;
-		if (erq->flags & IW_ENCODE_RESTRICTED)
-			pAdapter->StaCfg.AuthMode = Ndis802_11AuthModeShared;
-	else
-			pAdapter->StaCfg.AuthMode = Ndis802_11AuthModeOpen;
-	}
-
-    if (erq->length > 0)
-	{
-		int keyIdx = (erq->flags & IW_ENCODE_INDEX) - 1;
-		/* Check the size of the key */
-		if (erq->length > MAX_WEP_KEY_SIZE)
-		{
-			return -EINVAL;
-		}
-		/* Check key index */
-		if ((keyIdx < 0) || (keyIdx >= NR_WEP_KEYS))
-        {
-            DBGPRINT(RT_DEBUG_TRACE ,("==>rt_ioctl_siwencode::Wrong keyIdx=%d! Using default key instead (%d)\n",
-                                        keyIdx, pAdapter->StaCfg.DefaultKeyId));
-
-            //Using default key
-			keyIdx = pAdapter->StaCfg.DefaultKeyId;
-        }
-		else
-			pAdapter->StaCfg.DefaultKeyId = keyIdx;
-
-        NdisZeroMemory(pAdapter->SharedKey[BSS0][keyIdx].Key,  16);
-
-		if (erq->length == MAX_WEP_KEY_SIZE)
-        {
-			pAdapter->SharedKey[BSS0][keyIdx].KeyLen = MAX_WEP_KEY_SIZE;
-            pAdapter->SharedKey[BSS0][keyIdx].CipherAlg = CIPHER_WEP128;
-		}
-		else if (erq->length == MIN_WEP_KEY_SIZE)
-        {
-            pAdapter->SharedKey[BSS0][keyIdx].KeyLen = MIN_WEP_KEY_SIZE;
-            pAdapter->SharedKey[BSS0][keyIdx].CipherAlg = CIPHER_WEP64;
-		}
-		else
-			/* Disable the key */
-			pAdapter->SharedKey[BSS0][keyIdx].KeyLen = 0;
-
-		/* Check if the key is not marked as invalid */
-		if(!(erq->flags & IW_ENCODE_NOKEY))
-		{
-			/* Copy the key in the driver */
-			NdisMoveMemory(pAdapter->SharedKey[BSS0][keyIdx].Key, extra, erq->length);
-        }
-	}
-    else
-			{
-		/* Do we want to just set the transmit key index ? */
-		int index = (erq->flags & IW_ENCODE_INDEX) - 1;
-		if ((index >= 0) && (index < 4))
-        {
-			pAdapter->StaCfg.DefaultKeyId = index;
-            }
-        else
-			/* Don't complain if only change the mode */
-		if (!(erq->flags & IW_ENCODE_MODE))
-			return -EINVAL;
-	}
-
-done:
-    DBGPRINT(RT_DEBUG_TRACE ,("==>rt_ioctl_siwencode::erq->flags=%x\n",erq->flags));
-	DBGPRINT(RT_DEBUG_TRACE ,("==>rt_ioctl_siwencode::AuthMode=%x\n",pAdapter->StaCfg.AuthMode));
-	DBGPRINT(RT_DEBUG_TRACE ,("==>rt_ioctl_siwencode::DefaultKeyId=%x, KeyLen = %d\n",pAdapter->StaCfg.DefaultKeyId , pAdapter->SharedKey[BSS0][pAdapter->StaCfg.DefaultKeyId].KeyLen));
-	DBGPRINT(RT_DEBUG_TRACE ,("==>rt_ioctl_siwencode::WepStatus=%x\n",pAdapter->StaCfg.WepStatus));
-	return 0;
-}
-
-int
-rt_ioctl_giwencode(struct net_device *dev,
-			  struct iw_request_info *info,
-			  struct iw_point *erq, char *key)
-{
-	int kid;
-	PRTMP_ADAPTER pAdapter = RTMP_OS_NETDEV_GET_PRIV(dev);
-
-	if (pAdapter == NULL)
-	{
-		/* if 1st open fail, pAd will be free;
-		   So the net_dev->priv will be NULL in 2rd open */
-		return -ENETDOWN;
-	}
-
-	//check if the interface is down
-	if(!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE))
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
-	return -ENETDOWN;
-	}
-
-	kid = erq->flags & IW_ENCODE_INDEX;
-	DBGPRINT(RT_DEBUG_TRACE, ("===>rt_ioctl_giwencode %d\n", erq->flags & IW_ENCODE_INDEX));
-
-	if (pAdapter->StaCfg.WepStatus == Ndis802_11WEPDisabled)
-	{
-		erq->length = 0;
-		erq->flags = IW_ENCODE_DISABLED;
-	}
-	else if ((kid > 0) && (kid <=4))
-	{
-		// copy wep key
-		erq->flags = kid ;			/* NB: base 1 */
-		if (erq->length > pAdapter->SharedKey[BSS0][kid-1].KeyLen)
-			erq->length = pAdapter->SharedKey[BSS0][kid-1].KeyLen;
-		memcpy(key, pAdapter->SharedKey[BSS0][kid-1].Key, erq->length);
-		//if ((kid == pAdapter->PortCfg.DefaultKeyId))
-		//erq->flags |= IW_ENCODE_ENABLED;	/* XXX */
-		if (pAdapter->StaCfg.AuthMode == Ndis802_11AuthModeShared)
-			erq->flags |= IW_ENCODE_RESTRICTED;		/* XXX */
-		else
-			erq->flags |= IW_ENCODE_OPEN;		/* XXX */
-
-	}
-	else if (kid == 0)
-	{
-		if (pAdapter->StaCfg.AuthMode == Ndis802_11AuthModeShared)
-			erq->flags |= IW_ENCODE_RESTRICTED;		/* XXX */
-		else
-			erq->flags |= IW_ENCODE_OPEN;		/* XXX */
-		erq->length = pAdapter->SharedKey[BSS0][pAdapter->StaCfg.DefaultKeyId].KeyLen;
-		memcpy(key, pAdapter->SharedKey[BSS0][pAdapter->StaCfg.DefaultKeyId].Key, erq->length);
-		// copy default key ID
-		if (pAdapter->StaCfg.AuthMode == Ndis802_11AuthModeShared)
-			erq->flags |= IW_ENCODE_RESTRICTED;		/* XXX */
-		else
-			erq->flags |= IW_ENCODE_OPEN;		/* XXX */
-		erq->flags = pAdapter->StaCfg.DefaultKeyId + 1;			/* NB: base 1 */
-		erq->flags |= IW_ENCODE_ENABLED;	/* XXX */
-	}
-
-	return 0;
-
-}
-
-static int
-rt_ioctl_setparam(struct net_device *dev, struct iw_request_info *info,
-			 void *w, char *extra)
-{
-	PRTMP_ADAPTER pAdapter;
-	POS_COOKIE pObj;
-	PSTRING this_char = extra;
-	PSTRING value;
-	int  Status=0;
-
-	pAdapter = RTMP_OS_NETDEV_GET_PRIV(dev);
-	if (pAdapter == NULL)
-	{
-		/* if 1st open fail, pAd will be free;
-		   So the net_dev->priv will be NULL in 2rd open */
-		return -ENETDOWN;
-	}
-
-	pObj = (POS_COOKIE) pAdapter->OS_Cookie;
-	{
-		pObj->ioctl_if_type = INT_MAIN;
-        pObj->ioctl_if = MAIN_MBSSID;
-	}
-
-	//check if the interface is down
-	if(!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE))
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
-			return -ENETDOWN;
-	}
-
-	if (!*this_char)
-		return -EINVAL;
-
-	if ((value = rtstrchr(this_char, '=')) != NULL)
-	    *value++ = 0;
-
-	if (!value && (strcmp(this_char, "SiteSurvey") != 0))
-	    return -EINVAL;
-	else
-		goto SET_PROC;
-
-	// reject setting nothing besides ANY ssid(ssidLen=0)
-    if (!*value && (strcmp(this_char, "SSID") != 0))
-        return -EINVAL;
-
-SET_PROC:
-	for (PRTMP_PRIVATE_SET_PROC = RTMP_PRIVATE_SUPPORT_PROC; PRTMP_PRIVATE_SET_PROC->name; PRTMP_PRIVATE_SET_PROC++)
-	{
-	    if (strcmp(this_char, PRTMP_PRIVATE_SET_PROC->name) == 0)
-	    {
-	        if(!PRTMP_PRIVATE_SET_PROC->set_proc(pAdapter, value))
-	        {	//FALSE:Set private failed then return Invalid argument
-			    Status = -EINVAL;
-	        }
-		    break;	//Exit for loop.
-	    }
-	}
-
-	if(PRTMP_PRIVATE_SET_PROC->name == NULL)
-	{  //Not found argument
-	    Status = -EINVAL;
-	    DBGPRINT(RT_DEBUG_TRACE, ("===>rt_ioctl_setparam:: (iwpriv) Not Support Set Command [%s=%s]\n", this_char, value));
-	}
-
-    return Status;
-}
-
-
-static int
-rt_private_get_statistics(struct net_device *dev, struct iw_request_info *info,
-		struct iw_point *wrq, char *extra)
-{
-	INT				Status = 0;
-    PRTMP_ADAPTER   pAd = RTMP_OS_NETDEV_GET_PRIV(dev);
-
-    if (extra == NULL)
-    {
-        wrq->length = 0;
-        return -EIO;
-    }
-
-    memset(extra, 0x00, IW_PRIV_SIZE_MASK);
-    sprintf(extra, "\n\n");
-
-#ifdef RALINK_ATE
-	if (ATE_ON(pAd))
-	{
-	    sprintf(extra+strlen(extra), "Tx success                      = %ld\n", (ULONG)pAd->ate.TxDoneCount);
-	    //sprintf(extra+strlen(extra), "Tx success without retry        = %ld\n", (ULONG)pAd->ate.TxDoneCount);
-	}
-	else
-#endif // RALINK_ATE //
-	{
-    sprintf(extra+strlen(extra), "Tx success                      = %ld\n", (ULONG)pAd->WlanCounters.TransmittedFragmentCount.QuadPart);
-    sprintf(extra+strlen(extra), "Tx success without retry        = %ld\n", (ULONG)pAd->WlanCounters.TransmittedFragmentCount.QuadPart - (ULONG)pAd->WlanCounters.RetryCount.QuadPart);
-	}
-    sprintf(extra+strlen(extra), "Tx success after retry          = %ld\n", (ULONG)pAd->WlanCounters.RetryCount.QuadPart);
-    sprintf(extra+strlen(extra), "Tx fail to Rcv ACK after retry  = %ld\n", (ULONG)pAd->WlanCounters.FailedCount.QuadPart);
-    sprintf(extra+strlen(extra), "RTS Success Rcv CTS             = %ld\n", (ULONG)pAd->WlanCounters.RTSSuccessCount.QuadPart);
-    sprintf(extra+strlen(extra), "RTS Fail Rcv CTS                = %ld\n", (ULONG)pAd->WlanCounters.RTSFailureCount.QuadPart);
-
-    sprintf(extra+strlen(extra), "Rx success                      = %ld\n", (ULONG)pAd->WlanCounters.ReceivedFragmentCount.QuadPart);
-    sprintf(extra+strlen(extra), "Rx with CRC                     = %ld\n", (ULONG)pAd->WlanCounters.FCSErrorCount.QuadPart);
-    sprintf(extra+strlen(extra), "Rx drop due to out of resource  = %ld\n", (ULONG)pAd->Counters8023.RxNoBuffer);
-    sprintf(extra+strlen(extra), "Rx duplicate frame              = %ld\n", (ULONG)pAd->WlanCounters.FrameDuplicateCount.QuadPart);
-
-    sprintf(extra+strlen(extra), "False CCA (one second)          = %ld\n", (ULONG)pAd->RalinkCounters.OneSecFalseCCACnt);
-
-#ifdef RALINK_ATE
-	if (ATE_ON(pAd))
-	{
-		if (pAd->ate.RxAntennaSel == 0)
-		{
-		sprintf(extra+strlen(extra), "RSSI-A                          = %ld\n", (LONG)(pAd->ate.LastRssi0 - pAd->BbpRssiToDbmDelta));
-			sprintf(extra+strlen(extra), "RSSI-B (if available)           = %ld\n", (LONG)(pAd->ate.LastRssi1 - pAd->BbpRssiToDbmDelta));
-			sprintf(extra+strlen(extra), "RSSI-C (if available)           = %ld\n\n", (LONG)(pAd->ate.LastRssi2 - pAd->BbpRssiToDbmDelta));
-		}
-		else
-		{
-		sprintf(extra+strlen(extra), "RSSI                            = %ld\n", (LONG)(pAd->ate.LastRssi0 - pAd->BbpRssiToDbmDelta));
-		}
-	}
-	else
-#endif // RALINK_ATE //
-	{
-	sprintf(extra+strlen(extra), "RSSI-A                          = %ld\n", (LONG)(pAd->StaCfg.RssiSample.LastRssi0 - pAd->BbpRssiToDbmDelta));
-        sprintf(extra+strlen(extra), "RSSI-B (if available)           = %ld\n", (LONG)(pAd->StaCfg.RssiSample.LastRssi1 - pAd->BbpRssiToDbmDelta));
-        sprintf(extra+strlen(extra), "RSSI-C (if available)           = %ld\n\n", (LONG)(pAd->StaCfg.RssiSample.LastRssi2 - pAd->BbpRssiToDbmDelta));
-	}
-#ifdef WPA_SUPPLICANT_SUPPORT
-    sprintf(extra+strlen(extra), "WpaSupplicantUP                 = %d\n\n", pAd->StaCfg.WpaSupplicantUP);
-#endif // WPA_SUPPLICANT_SUPPORT //
-
-
-
-    wrq->length = strlen(extra) + 1; // 1: size of '\0'
-    DBGPRINT(RT_DEBUG_TRACE, ("<== rt_private_get_statistics, wrq->length = %d\n", wrq->length));
-
-    return Status;
-}
-
-#ifdef DOT11_N_SUPPORT
-void	getBaInfo(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			pOutBuf)
-{
-	INT i, j;
-	BA_ORI_ENTRY *pOriBAEntry;
-	BA_REC_ENTRY *pRecBAEntry;
-
-	for (i=0; i<MAX_LEN_OF_MAC_TABLE; i++)
-	{
-		PMAC_TABLE_ENTRY pEntry = &pAd->MacTab.Content[i];
-		if (((pEntry->ValidAsCLI || pEntry->ValidAsApCli) && (pEntry->Sst == SST_ASSOC))
-			|| (pEntry->ValidAsWDS) || (pEntry->ValidAsMesh))
-		{
-			sprintf(pOutBuf, "%s\n%02X:%02X:%02X:%02X:%02X:%02X (Aid = %d) (AP) -\n",
-                pOutBuf,
-				pEntry->Addr[0], pEntry->Addr[1], pEntry->Addr[2],
-				pEntry->Addr[3], pEntry->Addr[4], pEntry->Addr[5], pEntry->Aid);
-
-			sprintf(pOutBuf, "%s[Recipient]\n", pOutBuf);
-			for (j=0; j < NUM_OF_TID; j++)
-			{
-				if (pEntry->BARecWcidArray[j] != 0)
-				{
-					pRecBAEntry =&pAd->BATable.BARecEntry[pEntry->BARecWcidArray[j]];
-					sprintf(pOutBuf, "%sTID=%d, BAWinSize=%d, LastIndSeq=%d, ReorderingPkts=%d\n", pOutBuf, j, pRecBAEntry->BAWinSize, pRecBAEntry->LastIndSeq, pRecBAEntry->list.qlen);
-				}
-			}
-			sprintf(pOutBuf, "%s\n", pOutBuf);
-
-			sprintf(pOutBuf, "%s[Originator]\n", pOutBuf);
-			for (j=0; j < NUM_OF_TID; j++)
-			{
-				if (pEntry->BAOriWcidArray[j] != 0)
-				{
-					pOriBAEntry =&pAd->BATable.BAOriEntry[pEntry->BAOriWcidArray[j]];
-					sprintf(pOutBuf, "%sTID=%d, BAWinSize=%d, StartSeq=%d, CurTxSeq=%d\n", pOutBuf, j, pOriBAEntry->BAWinSize, pOriBAEntry->Sequence, pEntry->TxSeq[j]);
-				}
-			}
-			sprintf(pOutBuf, "%s\n\n", pOutBuf);
-		}
-        if (strlen(pOutBuf) > (IW_PRIV_SIZE_MASK - 30))
-                break;
-	}
-
-	return;
-}
-#endif // DOT11_N_SUPPORT //
-
-static int
-rt_private_show(struct net_device *dev, struct iw_request_info *info,
-		struct iw_point *wrq, PSTRING extra)
-{
-	INT				Status = 0;
-	PRTMP_ADAPTER   pAd;
-	POS_COOKIE		pObj;
-	u32             subcmd = wrq->flags;
-
-	pAd = RTMP_OS_NETDEV_GET_PRIV(dev);
-	if (pAd == NULL)
-	{
-		/* if 1st open fail, pAd will be free;
-		   So the net_dev->priv will be NULL in 2rd open */
-		return -ENETDOWN;
-	}
-
-	pObj = (POS_COOKIE) pAd->OS_Cookie;
-	if (extra == NULL)
-	{
-		wrq->length = 0;
-		return -EIO;
-	}
-	memset(extra, 0x00, IW_PRIV_SIZE_MASK);
-
-	{
-		pObj->ioctl_if_type = INT_MAIN;
-		pObj->ioctl_if = MAIN_MBSSID;
-	}
-
-    switch(subcmd)
-    {
-
-        case SHOW_CONN_STATUS:
-            if (MONITOR_ON(pAd))
-            {
-#ifdef DOT11_N_SUPPORT
-                if (pAd->CommonCfg.PhyMode >= PHY_11ABGN_MIXED &&
-                    pAd->CommonCfg.RegTransmitSetting.field.BW)
-                    sprintf(extra, "Monitor Mode(CentralChannel %d)\n", pAd->CommonCfg.CentralChannel);
-                else
-#endif // DOT11_N_SUPPORT //
-                    sprintf(extra, "Monitor Mode(Channel %d)\n", pAd->CommonCfg.Channel);
-            }
-            else
-            {
-                if (pAd->IndicateMediaState == NdisMediaStateConnected)
-		{
-		    if (INFRA_ON(pAd))
-                    {
-                    sprintf(extra, "Connected(AP: %s[%02X:%02X:%02X:%02X:%02X:%02X])\n",
-                                    pAd->CommonCfg.Ssid,
-                                    pAd->CommonCfg.Bssid[0],
-                                    pAd->CommonCfg.Bssid[1],
-                                    pAd->CommonCfg.Bssid[2],
-                                    pAd->CommonCfg.Bssid[3],
-                                    pAd->CommonCfg.Bssid[4],
-                                    pAd->CommonCfg.Bssid[5]);
-			DBGPRINT(RT_DEBUG_TRACE ,("Ssid=%s ,Ssidlen = %d\n",pAd->CommonCfg.Ssid, pAd->CommonCfg.SsidLen));
-		}
-                    else if (ADHOC_ON(pAd))
-                        sprintf(extra, "Connected\n");
-		}
-		else
-		{
-		    sprintf(extra, "Disconnected\n");
-			DBGPRINT(RT_DEBUG_TRACE ,("ConnStatus is not connected\n"));
-		}
-            }
-            wrq->length = strlen(extra) + 1; // 1: size of '\0'
-            break;
-        case SHOW_DRVIER_VERION:
-            sprintf(extra, "Driver version-%s, %s %s\n", STA_DRIVER_VERSION, __DATE__, __TIME__ );
-            wrq->length = strlen(extra) + 1; // 1: size of '\0'
-            break;
-#ifdef DOT11_N_SUPPORT
-        case SHOW_BA_INFO:
-            getBaInfo(pAd, extra);
-            wrq->length = strlen(extra) + 1; // 1: size of '\0'
-            break;
-#endif // DOT11_N_SUPPORT //
-		case SHOW_DESC_INFO:
-			{
-				Show_DescInfo_Proc(pAd, NULL);
-				wrq->length = 0; // 1: size of '\0'
-			}
-			break;
-        case RAIO_OFF:
-            if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS))
-            {
-                if (pAd->Mlme.CntlMachine.CurrState != CNTL_IDLE)
-		        {
-		            RTMP_MLME_RESET_STATE_MACHINE(pAd);
-		            DBGPRINT(RT_DEBUG_TRACE, ("!!! MLME busy, reset MLME state machine !!!\n"));
-		        }
-            }
-            pAd->StaCfg.bSwRadio = FALSE;
-            if (pAd->StaCfg.bRadio != (pAd->StaCfg.bHwRadio && pAd->StaCfg.bSwRadio))
-            {
-                pAd->StaCfg.bRadio = (pAd->StaCfg.bHwRadio && pAd->StaCfg.bSwRadio);
-                if (pAd->StaCfg.bRadio == FALSE)
-                {
-                    MlmeRadioOff(pAd);
-                    // Update extra information
-					pAd->ExtraInfo = SW_RADIO_OFF;
-                }
-            }
-            sprintf(extra, "Radio Off\n");
-            wrq->length = strlen(extra) + 1; // 1: size of '\0'
-            break;
-        case RAIO_ON:
-            pAd->StaCfg.bSwRadio = TRUE;
-            //if (pAd->StaCfg.bRadio != (pAd->StaCfg.bHwRadio && pAd->StaCfg.bSwRadio))
-            {
-                pAd->StaCfg.bRadio = (pAd->StaCfg.bHwRadio && pAd->StaCfg.bSwRadio);
-                if (pAd->StaCfg.bRadio == TRUE)
-                {
-                    MlmeRadioOn(pAd);
-                    // Update extra information
-					pAd->ExtraInfo = EXTRA_INFO_CLEAR;
-                }
-            }
-            sprintf(extra, "Radio On\n");
-            wrq->length = strlen(extra) + 1; // 1: size of '\0'
-            break;
-
-
-#ifdef QOS_DLS_SUPPORT
-		case SHOW_DLS_ENTRY_INFO:
-			{
-				Set_DlsEntryInfo_Display_Proc(pAd, NULL);
-				wrq->length = 0; // 1: size of '\0'
-			}
-			break;
-#endif // QOS_DLS_SUPPORT //
-
-		case SHOW_CFG_VALUE:
-			{
-				Status = RTMPShowCfgValue(pAd, (PSTRING) wrq->pointer, extra);
-				if (Status == 0)
-					wrq->length = strlen(extra) + 1; // 1: size of '\0'
-			}
-			break;
-		case SHOW_ADHOC_ENTRY_INFO:
-			Show_Adhoc_MacTable_Proc(pAd, extra);
-			wrq->length = strlen(extra) + 1; // 1: size of '\0'
-			break;
-        default:
-            DBGPRINT(RT_DEBUG_TRACE, ("%s - unknow subcmd = %d\n", __FUNCTION__, subcmd));
-            break;
-    }
-
-    return Status;
-}
-
-#ifdef SIOCSIWMLME
-int rt_ioctl_siwmlme(struct net_device *dev,
-			   struct iw_request_info *info,
-			   union iwreq_data *wrqu,
-			   char *extra)
-{
-	PRTMP_ADAPTER   pAd = RTMP_OS_NETDEV_GET_PRIV(dev);
-	struct iw_mlme *pMlme = (struct iw_mlme *)wrqu->data.pointer;
-	MLME_QUEUE_ELEM				MsgElem;
-	MLME_DISASSOC_REQ_STRUCT	DisAssocReq;
-	MLME_DEAUTH_REQ_STRUCT      DeAuthReq;
-
-	DBGPRINT(RT_DEBUG_TRACE, ("====> %s\n", __FUNCTION__));
-
-	if (pMlme == NULL)
-		return -EINVAL;
-
-	switch(pMlme->cmd)
-	{
-#ifdef IW_MLME_DEAUTH
-		case IW_MLME_DEAUTH:
-			DBGPRINT(RT_DEBUG_TRACE, ("====> %s - IW_MLME_DEAUTH\n", __FUNCTION__));
-			COPY_MAC_ADDR(DeAuthReq.Addr, pAd->CommonCfg.Bssid);
-			DeAuthReq.Reason = pMlme->reason_code;
-			MsgElem.MsgLen = sizeof(MLME_DEAUTH_REQ_STRUCT);
-			NdisMoveMemory(MsgElem.Msg, &DeAuthReq, sizeof(MLME_DEAUTH_REQ_STRUCT));
-			MlmeDeauthReqAction(pAd, &MsgElem);
-			if (INFRA_ON(pAd))
-			{
-			    LinkDown(pAd, FALSE);
-			    pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
-			}
-			break;
-#endif // IW_MLME_DEAUTH //
-#ifdef IW_MLME_DISASSOC
-		case IW_MLME_DISASSOC:
-			DBGPRINT(RT_DEBUG_TRACE, ("====> %s - IW_MLME_DISASSOC\n", __FUNCTION__));
-			COPY_MAC_ADDR(DisAssocReq.Addr, pAd->CommonCfg.Bssid);
-			DisAssocReq.Reason =  pMlme->reason_code;
-
-			MsgElem.Machine = ASSOC_STATE_MACHINE;
-			MsgElem.MsgType = MT2_MLME_DISASSOC_REQ;
-			MsgElem.MsgLen = sizeof(MLME_DISASSOC_REQ_STRUCT);
-			NdisMoveMemory(MsgElem.Msg, &DisAssocReq, sizeof(MLME_DISASSOC_REQ_STRUCT));
-
-			pAd->Mlme.CntlMachine.CurrState = CNTL_WAIT_OID_DISASSOC;
-			MlmeDisassocReqAction(pAd, &MsgElem);
-			break;
-#endif // IW_MLME_DISASSOC //
-		default:
-			DBGPRINT(RT_DEBUG_TRACE, ("====> %s - Unknow Command\n", __FUNCTION__));
-			break;
-	}
-
-	return 0;
-}
-#endif // SIOCSIWMLME //
-
-#if WIRELESS_EXT > 17
-int rt_ioctl_siwauth(struct net_device *dev,
-			  struct iw_request_info *info,
-			  union iwreq_data *wrqu, char *extra)
-{
-	PRTMP_ADAPTER   pAdapter = RTMP_OS_NETDEV_GET_PRIV(dev);
-	struct iw_param *param = &wrqu->param;
-
-    //check if the interface is down
-	if(!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE))
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
-	return -ENETDOWN;
-	}
-	switch (param->flags & IW_AUTH_INDEX) {
-	case IW_AUTH_WPA_VERSION:
-            if (param->value == IW_AUTH_WPA_VERSION_WPA)
-            {
-                pAdapter->StaCfg.AuthMode = Ndis802_11AuthModeWPAPSK;
-				if (pAdapter->StaCfg.BssType == BSS_ADHOC)
-					pAdapter->StaCfg.AuthMode = Ndis802_11AuthModeWPANone;
-            }
-            else if (param->value == IW_AUTH_WPA_VERSION_WPA2)
-                pAdapter->StaCfg.AuthMode = Ndis802_11AuthModeWPA2PSK;
-
-            DBGPRINT(RT_DEBUG_TRACE, ("%s::IW_AUTH_WPA_VERSION - param->value = %d!\n", __FUNCTION__, param->value));
-            break;
-	case IW_AUTH_CIPHER_PAIRWISE:
-            if (param->value == IW_AUTH_CIPHER_NONE)
-            {
-                pAdapter->StaCfg.WepStatus = Ndis802_11WEPDisabled;
-                pAdapter->StaCfg.OrigWepStatus = pAdapter->StaCfg.WepStatus;
-                pAdapter->StaCfg.PairCipher = Ndis802_11WEPDisabled;
-            }
-            else if (param->value == IW_AUTH_CIPHER_WEP40 ||
-                     param->value == IW_AUTH_CIPHER_WEP104)
-            {
-                pAdapter->StaCfg.WepStatus = Ndis802_11WEPEnabled;
-                pAdapter->StaCfg.OrigWepStatus = pAdapter->StaCfg.WepStatus;
-                pAdapter->StaCfg.PairCipher = Ndis802_11WEPEnabled;
-#ifdef WPA_SUPPLICANT_SUPPORT
-                pAdapter->StaCfg.IEEE8021X = FALSE;
-#endif // WPA_SUPPLICANT_SUPPORT //
-            }
-            else if (param->value == IW_AUTH_CIPHER_TKIP)
-            {
-                pAdapter->StaCfg.WepStatus = Ndis802_11Encryption2Enabled;
-                pAdapter->StaCfg.OrigWepStatus = pAdapter->StaCfg.WepStatus;
-                pAdapter->StaCfg.PairCipher = Ndis802_11Encryption2Enabled;
-            }
-            else if (param->value == IW_AUTH_CIPHER_CCMP)
-            {
-                pAdapter->StaCfg.WepStatus = Ndis802_11Encryption3Enabled;
-                pAdapter->StaCfg.OrigWepStatus = pAdapter->StaCfg.WepStatus;
-                pAdapter->StaCfg.PairCipher = Ndis802_11Encryption3Enabled;
-            }
-            DBGPRINT(RT_DEBUG_TRACE, ("%s::IW_AUTH_CIPHER_PAIRWISE - param->value = %d!\n", __FUNCTION__, param->value));
-            break;
-	case IW_AUTH_CIPHER_GROUP:
-            if (param->value == IW_AUTH_CIPHER_NONE)
-            {
-                pAdapter->StaCfg.GroupCipher = Ndis802_11WEPDisabled;
-            }
-            else if (param->value == IW_AUTH_CIPHER_WEP40 ||
-                     param->value == IW_AUTH_CIPHER_WEP104)
-            {
-                pAdapter->StaCfg.GroupCipher = Ndis802_11WEPEnabled;
-            }
-            else if (param->value == IW_AUTH_CIPHER_TKIP)
-            {
-                pAdapter->StaCfg.GroupCipher = Ndis802_11Encryption2Enabled;
-            }
-            else if (param->value == IW_AUTH_CIPHER_CCMP)
-            {
-                pAdapter->StaCfg.GroupCipher = Ndis802_11Encryption3Enabled;
-            }
-            DBGPRINT(RT_DEBUG_TRACE, ("%s::IW_AUTH_CIPHER_GROUP - param->value = %d!\n", __FUNCTION__, param->value));
-            break;
-	case IW_AUTH_KEY_MGMT:
-            if (param->value == IW_AUTH_KEY_MGMT_802_1X)
-            {
-                if (pAdapter->StaCfg.AuthMode == Ndis802_11AuthModeWPAPSK)
-                {
-                    pAdapter->StaCfg.AuthMode = Ndis802_11AuthModeWPA;
-#ifdef WPA_SUPPLICANT_SUPPORT
-                    pAdapter->StaCfg.IEEE8021X = FALSE;
-#endif // WPA_SUPPLICANT_SUPPORT //
-                }
-                else if (pAdapter->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK)
-                {
-                    pAdapter->StaCfg.AuthMode = Ndis802_11AuthModeWPA2;
-#ifdef WPA_SUPPLICANT_SUPPORT
-                    pAdapter->StaCfg.IEEE8021X = FALSE;
-#endif // WPA_SUPPLICANT_SUPPORT //
-                }
-#ifdef WPA_SUPPLICANT_SUPPORT
-                else
-                    // WEP 1x
-                    pAdapter->StaCfg.IEEE8021X = TRUE;
-#endif // WPA_SUPPLICANT_SUPPORT //
-            }
-            else if (param->value == 0)
-            {
-                //pAdapter->StaCfg.PortSecured = WPA_802_1X_PORT_SECURED;
-				STA_PORT_SECURED(pAdapter);
-            }
-            DBGPRINT(RT_DEBUG_TRACE, ("%s::IW_AUTH_KEY_MGMT - param->value = %d!\n", __FUNCTION__, param->value));
-            break;
-	case IW_AUTH_RX_UNENCRYPTED_EAPOL:
-            break;
-	case IW_AUTH_PRIVACY_INVOKED:
-            /*if (param->value == 0)
-			{
-                pAdapter->StaCfg.AuthMode = Ndis802_11AuthModeOpen;
-                pAdapter->StaCfg.WepStatus = Ndis802_11WEPDisabled;
-                pAdapter->StaCfg.OrigWepStatus = pAdapter->StaCfg.WepStatus;
-                pAdapter->StaCfg.PairCipher = Ndis802_11WEPDisabled;
-		    pAdapter->StaCfg.GroupCipher = Ndis802_11WEPDisabled;
-            }*/
-            DBGPRINT(RT_DEBUG_TRACE, ("%s::IW_AUTH_PRIVACY_INVOKED - param->value = %d!\n", __FUNCTION__, param->value));
-		break;
-	case IW_AUTH_DROP_UNENCRYPTED:
-            if (param->value != 0)
-                pAdapter->StaCfg.PortSecured = WPA_802_1X_PORT_NOT_SECURED;
-			else
-			{
-                //pAdapter->StaCfg.PortSecured = WPA_802_1X_PORT_SECURED;
-				STA_PORT_SECURED(pAdapter);
-			}
-            DBGPRINT(RT_DEBUG_TRACE, ("%s::IW_AUTH_WPA_VERSION - param->value = %d!\n", __FUNCTION__, param->value));
-		break;
-	case IW_AUTH_80211_AUTH_ALG:
-			if (param->value & IW_AUTH_ALG_SHARED_KEY)
-            {
-				pAdapter->StaCfg.AuthMode = Ndis802_11AuthModeShared;
-			}
-            else if (param->value & IW_AUTH_ALG_OPEN_SYSTEM)
-            {
-				pAdapter->StaCfg.AuthMode = Ndis802_11AuthModeOpen;
-			}
-            else
-				return -EINVAL;
-            DBGPRINT(RT_DEBUG_TRACE, ("%s::IW_AUTH_80211_AUTH_ALG - param->value = %d!\n", __FUNCTION__, param->value));
-			break;
-	case IW_AUTH_WPA_ENABLED:
-		DBGPRINT(RT_DEBUG_TRACE, ("%s::IW_AUTH_WPA_ENABLED - Driver supports WPA!(param->value = %d)\n", __FUNCTION__, param->value));
-		break;
-	default:
-		return -EOPNOTSUPP;
-}
-
-	return 0;
-}
-
-int rt_ioctl_giwauth(struct net_device *dev,
-			       struct iw_request_info *info,
-			       union iwreq_data *wrqu, char *extra)
-{
-	PRTMP_ADAPTER   pAdapter = RTMP_OS_NETDEV_GET_PRIV(dev);
-	struct iw_param *param = &wrqu->param;
-
-    //check if the interface is down
-	if(!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE))
-    {
-		DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
-	return -ENETDOWN;
-    }
-
-	switch (param->flags & IW_AUTH_INDEX) {
-	case IW_AUTH_DROP_UNENCRYPTED:
-        param->value = (pAdapter->StaCfg.WepStatus == Ndis802_11WEPDisabled) ? 0 : 1;
-		break;
-
-	case IW_AUTH_80211_AUTH_ALG:
-        param->value = (pAdapter->StaCfg.AuthMode == Ndis802_11AuthModeShared) ? IW_AUTH_ALG_SHARED_KEY : IW_AUTH_ALG_OPEN_SYSTEM;
-		break;
-
-	case IW_AUTH_WPA_ENABLED:
-		param->value = (pAdapter->StaCfg.AuthMode >= Ndis802_11AuthModeWPA) ? 1 : 0;
-		break;
-
-	default:
-		return -EOPNOTSUPP;
-	}
-    DBGPRINT(RT_DEBUG_TRACE, ("rt_ioctl_giwauth::param->value = %d!\n", param->value));
-	return 0;
-}
-
-void fnSetCipherKey(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  INT             keyIdx,
-    IN  UCHAR           CipherAlg,
-    IN  BOOLEAN         bGTK,
-    IN  struct iw_encode_ext *ext)
-{
-    NdisZeroMemory(&pAdapter->SharedKey[BSS0][keyIdx], sizeof(CIPHER_KEY));
-    pAdapter->SharedKey[BSS0][keyIdx].KeyLen = LEN_TKIP_EK;
-    NdisMoveMemory(pAdapter->SharedKey[BSS0][keyIdx].Key, ext->key, LEN_TKIP_EK);
-    NdisMoveMemory(pAdapter->SharedKey[BSS0][keyIdx].TxMic, ext->key + LEN_TKIP_EK, LEN_TKIP_TXMICK);
-    NdisMoveMemory(pAdapter->SharedKey[BSS0][keyIdx].RxMic, ext->key + LEN_TKIP_EK + LEN_TKIP_TXMICK, LEN_TKIP_RXMICK);
-    pAdapter->SharedKey[BSS0][keyIdx].CipherAlg = CipherAlg;
-
-    // Update group key information to ASIC Shared Key Table
-	AsicAddSharedKeyEntry(pAdapter,
-						  BSS0,
-						  keyIdx,
-						  pAdapter->SharedKey[BSS0][keyIdx].CipherAlg,
-						  pAdapter->SharedKey[BSS0][keyIdx].Key,
-						  pAdapter->SharedKey[BSS0][keyIdx].TxMic,
-						  pAdapter->SharedKey[BSS0][keyIdx].RxMic);
-
-    if (bGTK)
-        // Update ASIC WCID attribute table and IVEIV table
-	RTMPAddWcidAttributeEntry(pAdapter,
-							  BSS0,
-							  keyIdx,
-							  pAdapter->SharedKey[BSS0][keyIdx].CipherAlg,
-							  NULL);
-    else
-        // Update ASIC WCID attribute table and IVEIV table
-	RTMPAddWcidAttributeEntry(pAdapter,
-							  BSS0,
-							  keyIdx,
-							  pAdapter->SharedKey[BSS0][keyIdx].CipherAlg,
-							  &pAdapter->MacTab.Content[BSSID_WCID]);
-}
-
-int rt_ioctl_siwencodeext(struct net_device *dev,
-			   struct iw_request_info *info,
-			   union iwreq_data *wrqu,
-			   char *extra)
-			{
-    PRTMP_ADAPTER   pAdapter = RTMP_OS_NETDEV_GET_PRIV(dev);
-	struct iw_point *encoding = &wrqu->encoding;
-	struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
-    int keyIdx, alg = ext->alg;
-
-    //check if the interface is down
-	if(!RTMP_TEST_FLAG(pAdapter, fRTMP_ADAPTER_INTERRUPT_IN_USE))
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
-	return -ENETDOWN;
-	}
-
-    if (encoding->flags & IW_ENCODE_DISABLED)
-	{
-        keyIdx = (encoding->flags & IW_ENCODE_INDEX) - 1;
-        // set BSSID wcid entry of the Pair-wise Key table as no-security mode
-	    AsicRemovePairwiseKeyEntry(pAdapter, BSS0, BSSID_WCID);
-        pAdapter->SharedKey[BSS0][keyIdx].KeyLen = 0;
-		pAdapter->SharedKey[BSS0][keyIdx].CipherAlg = CIPHER_NONE;
-		AsicRemoveSharedKeyEntry(pAdapter, 0, (UCHAR)keyIdx);
-        NdisZeroMemory(&pAdapter->SharedKey[BSS0][keyIdx], sizeof(CIPHER_KEY));
-        DBGPRINT(RT_DEBUG_TRACE, ("%s::Remove all keys!(encoding->flags = %x)\n", __FUNCTION__, encoding->flags));
-    }
-					else
-    {
-        // Get Key Index and convet to our own defined key index
-	keyIdx = (encoding->flags & IW_ENCODE_INDEX) - 1;
-	if((keyIdx < 0) || (keyIdx >= NR_WEP_KEYS))
-		return -EINVAL;
-
-        if (ext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY)
-        {
-            pAdapter->StaCfg.DefaultKeyId = keyIdx;
-            DBGPRINT(RT_DEBUG_TRACE, ("%s::DefaultKeyId = %d\n", __FUNCTION__, pAdapter->StaCfg.DefaultKeyId));
-        }
-
-        switch (alg) {
-		case IW_ENCODE_ALG_NONE:
-                DBGPRINT(RT_DEBUG_TRACE, ("%s::IW_ENCODE_ALG_NONE\n", __FUNCTION__));
-			break;
-		case IW_ENCODE_ALG_WEP:
-                DBGPRINT(RT_DEBUG_TRACE, ("%s::IW_ENCODE_ALG_WEP - ext->key_len = %d, keyIdx = %d\n", __FUNCTION__, ext->key_len, keyIdx));
-			if (ext->key_len == MAX_WEP_KEY_SIZE)
-                {
-				pAdapter->SharedKey[BSS0][keyIdx].KeyLen = MAX_WEP_KEY_SIZE;
-                    pAdapter->SharedKey[BSS0][keyIdx].CipherAlg = CIPHER_WEP128;
-				}
-			else if (ext->key_len == MIN_WEP_KEY_SIZE)
-                {
-                    pAdapter->SharedKey[BSS0][keyIdx].KeyLen = MIN_WEP_KEY_SIZE;
-                    pAdapter->SharedKey[BSS0][keyIdx].CipherAlg = CIPHER_WEP64;
-			}
-			else
-                    return -EINVAL;
-
-                NdisZeroMemory(pAdapter->SharedKey[BSS0][keyIdx].Key,  16);
-			    NdisMoveMemory(pAdapter->SharedKey[BSS0][keyIdx].Key, ext->key, ext->key_len);
-
-				if (pAdapter->StaCfg.GroupCipher == Ndis802_11GroupWEP40Enabled ||
-					pAdapter->StaCfg.GroupCipher == Ndis802_11GroupWEP104Enabled)
-				{
-					// Set Group key material to Asic
-					AsicAddSharedKeyEntry(pAdapter, BSS0, keyIdx, pAdapter->SharedKey[BSS0][keyIdx].CipherAlg, pAdapter->SharedKey[BSS0][keyIdx].Key, NULL, NULL);
-					// Update WCID attribute table and IVEIV table for this group key table
-					RTMPAddWcidAttributeEntry(pAdapter, BSS0, keyIdx, pAdapter->SharedKey[BSS0][keyIdx].CipherAlg, NULL);
-					STA_PORT_SECURED(pAdapter);
-					// Indicate Connected for GUI
-					pAdapter->IndicateMediaState = NdisMediaStateConnected;
-				}
-			break;
-            case IW_ENCODE_ALG_TKIP:
-                DBGPRINT(RT_DEBUG_TRACE, ("%s::IW_ENCODE_ALG_TKIP - keyIdx = %d, ext->key_len = %d\n", __FUNCTION__, keyIdx, ext->key_len));
-                if (ext->key_len == 32)
-                {
-                    if (ext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY)
-                    {
-                        fnSetCipherKey(pAdapter, keyIdx, CIPHER_TKIP, FALSE, ext);
-                        if (pAdapter->StaCfg.AuthMode >= Ndis802_11AuthModeWPA2)
-                        {
-                            //pAdapter->StaCfg.PortSecured = WPA_802_1X_PORT_SECURED;
-                            STA_PORT_SECURED(pAdapter);
-                            pAdapter->IndicateMediaState = NdisMediaStateConnected;
-                        }
-		}
-                    else if (ext->ext_flags & IW_ENCODE_EXT_GROUP_KEY)
-                    {
-                        fnSetCipherKey(pAdapter, keyIdx, CIPHER_TKIP, TRUE, ext);
-
-                        // set 802.1x port control
-		        //pAdapter->StaCfg.PortSecured = WPA_802_1X_PORT_SECURED;
-		        STA_PORT_SECURED(pAdapter);
-		        pAdapter->IndicateMediaState = NdisMediaStateConnected;
-                    }
-                }
-                else
-                    return -EINVAL;
-                break;
-            case IW_ENCODE_ALG_CCMP:
-                if (ext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY)
-		{
-                    fnSetCipherKey(pAdapter, keyIdx, CIPHER_AES, FALSE, ext);
-                    if (pAdapter->StaCfg.AuthMode >= Ndis802_11AuthModeWPA2)
-			//pAdapter->StaCfg.PortSecured = WPA_802_1X_PORT_SECURED;
-			STA_PORT_SECURED(pAdapter);
-			pAdapter->IndicateMediaState = NdisMediaStateConnected;
-                }
-                else if (ext->ext_flags & IW_ENCODE_EXT_GROUP_KEY)
-                {
-                    fnSetCipherKey(pAdapter, keyIdx, CIPHER_AES, TRUE, ext);
-
-                    // set 802.1x port control
-		        //pAdapter->StaCfg.PortSecured = WPA_802_1X_PORT_SECURED;
-		        STA_PORT_SECURED(pAdapter);
-		        pAdapter->IndicateMediaState = NdisMediaStateConnected;
-                }
-                break;
-		default:
-			return -EINVAL;
-		}
-    }
-
-    return 0;
-}
-
-int
-rt_ioctl_giwencodeext(struct net_device *dev,
-			  struct iw_request_info *info,
-			  union iwreq_data *wrqu, char *extra)
-{
-	PRTMP_ADAPTER pAd = RTMP_OS_NETDEV_GET_PRIV(dev);
-	PCHAR pKey = NULL;
-	struct iw_point *encoding = &wrqu->encoding;
-	struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
-	int idx, max_key_len;
-
-	DBGPRINT(RT_DEBUG_TRACE ,("===> rt_ioctl_giwencodeext\n"));
-
-	max_key_len = encoding->length - sizeof(*ext);
-	if (max_key_len < 0)
-		return -EINVAL;
-
-	idx = encoding->flags & IW_ENCODE_INDEX;
-	if (idx)
-	{
-		if (idx < 1 || idx > 4)
-			return -EINVAL;
-		idx--;
-
-		if ((pAd->StaCfg.WepStatus == Ndis802_11Encryption2Enabled) ||
-			(pAd->StaCfg.WepStatus == Ndis802_11Encryption3Enabled))
-		{
-			if (idx != pAd->StaCfg.DefaultKeyId)
-			{
-				ext->key_len = 0;
-				return 0;
-			}
-		}
-	}
-	else
-		idx = pAd->StaCfg.DefaultKeyId;
-
-	encoding->flags = idx + 1;
-	memset(ext, 0, sizeof(*ext));
-
-	ext->key_len = 0;
-	switch(pAd->StaCfg.WepStatus) {
-		case Ndis802_11WEPDisabled:
-			ext->alg = IW_ENCODE_ALG_NONE;
-			encoding->flags |= IW_ENCODE_DISABLED;
-			break;
-		case Ndis802_11WEPEnabled:
-			ext->alg = IW_ENCODE_ALG_WEP;
-			if (pAd->SharedKey[BSS0][idx].KeyLen > max_key_len)
-				return -E2BIG;
-			else
-			{
-				ext->key_len = pAd->SharedKey[BSS0][idx].KeyLen;
-				pKey = (PCHAR)&(pAd->SharedKey[BSS0][idx].Key[0]);
-			}
-			break;
-		case Ndis802_11Encryption2Enabled:
-		case Ndis802_11Encryption3Enabled:
-			if (pAd->StaCfg.WepStatus == Ndis802_11Encryption2Enabled)
-				ext->alg = IW_ENCODE_ALG_TKIP;
-			else
-				ext->alg = IW_ENCODE_ALG_CCMP;
-
-			if (max_key_len < 32)
-				return -E2BIG;
-			else
-			{
-				ext->key_len = 32;
-				pKey = (PCHAR)&pAd->StaCfg.PMK[0];
-			}
-			break;
-		default:
-			return -EINVAL;
-	}
-
-	if (ext->key_len && pKey)
-	{
-		encoding->flags |= IW_ENCODE_ENABLED;
-		memcpy(ext->key, pKey, ext->key_len);
-	}
-
-	return 0;
-}
-
-#ifdef SIOCSIWGENIE
-int rt_ioctl_siwgenie(struct net_device *dev,
-			  struct iw_request_info *info,
-			  union iwreq_data *wrqu, char *extra)
-{
-	PRTMP_ADAPTER   pAd = RTMP_OS_NETDEV_GET_PRIV(dev);
-
-	DBGPRINT(RT_DEBUG_TRACE ,("===> rt_ioctl_siwgenie\n"));
-#ifdef NATIVE_WPA_SUPPLICANT_SUPPORT
-	pAd->StaCfg.bRSN_IE_FromWpaSupplicant = FALSE;
-#endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
-	if (wrqu->data.length > MAX_LEN_OF_RSNIE ||
-	    (wrqu->data.length && extra == NULL))
-		return -EINVAL;
-
-	if (wrqu->data.length)
-	{
-		pAd->StaCfg.RSNIE_Len = wrqu->data.length;
-		NdisMoveMemory(&pAd->StaCfg.RSN_IE[0], extra, pAd->StaCfg.RSNIE_Len);
-#ifdef NATIVE_WPA_SUPPLICANT_SUPPORT
-		pAd->StaCfg.bRSN_IE_FromWpaSupplicant = TRUE;
-#endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
-	}
-	else
-	{
-		pAd->StaCfg.RSNIE_Len = 0;
-		NdisZeroMemory(&pAd->StaCfg.RSN_IE[0], MAX_LEN_OF_RSNIE);
-	}
-
-	return 0;
-}
-#endif // SIOCSIWGENIE //
-
-int rt_ioctl_giwgenie(struct net_device *dev,
-			       struct iw_request_info *info,
-			       union iwreq_data *wrqu, char *extra)
-{
-	PRTMP_ADAPTER   pAd = RTMP_OS_NETDEV_GET_PRIV(dev);
-
-	if ((pAd->StaCfg.RSNIE_Len == 0) ||
-		(pAd->StaCfg.AuthMode < Ndis802_11AuthModeWPA))
-	{
-		wrqu->data.length = 0;
-		return 0;
-	}
-
-#ifdef NATIVE_WPA_SUPPLICANT_SUPPORT
-#ifdef SIOCSIWGENIE
-	if (pAd->StaCfg.WpaSupplicantUP == WPA_SUPPLICANT_ENABLE)
-	{
-	if (wrqu->data.length < pAd->StaCfg.RSNIE_Len)
-		return -E2BIG;
-
-	wrqu->data.length = pAd->StaCfg.RSNIE_Len;
-	memcpy(extra, &pAd->StaCfg.RSN_IE[0], pAd->StaCfg.RSNIE_Len);
-	}
-	else
-#endif // SIOCSIWGENIE //
-#endif // NATIVE_WPA_SUPPLICANT_SUPPORT //
-	{
-		UCHAR RSNIe = IE_WPA;
-
-		if (wrqu->data.length < (pAd->StaCfg.RSNIE_Len + 2)) // ID, Len
-			return -E2BIG;
-		wrqu->data.length = pAd->StaCfg.RSNIE_Len + 2;
-
-		if ((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK) ||
-            (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2))
-			RSNIe = IE_RSN;
-
-		extra[0] = (char)RSNIe;
-		extra[1] = pAd->StaCfg.RSNIE_Len;
-		memcpy(extra+2, &pAd->StaCfg.RSN_IE[0], pAd->StaCfg.RSNIE_Len);
-	}
-
-	return 0;
-}
-
-int rt_ioctl_siwpmksa(struct net_device *dev,
-			   struct iw_request_info *info,
-			   union iwreq_data *wrqu,
-			   char *extra)
-{
-	PRTMP_ADAPTER   pAd = RTMP_OS_NETDEV_GET_PRIV(dev);
-	struct iw_pmksa *pPmksa = (struct iw_pmksa *)wrqu->data.pointer;
-	INT	CachedIdx = 0, idx = 0;
-
-	if (pPmksa == NULL)
-		return -EINVAL;
-
-	DBGPRINT(RT_DEBUG_TRACE ,("===> rt_ioctl_siwpmksa\n"));
-	switch(pPmksa->cmd)
-	{
-		case IW_PMKSA_FLUSH:
-			NdisZeroMemory(pAd->StaCfg.SavedPMK, sizeof(BSSID_INFO)*PMKID_NO);
-			DBGPRINT(RT_DEBUG_TRACE ,("rt_ioctl_siwpmksa - IW_PMKSA_FLUSH\n"));
-			break;
-		case IW_PMKSA_REMOVE:
-			for (CachedIdx = 0; CachedIdx < pAd->StaCfg.SavedPMKNum; CachedIdx++)
-			{
-		        // compare the BSSID
-		        if (NdisEqualMemory(pPmksa->bssid.sa_data, pAd->StaCfg.SavedPMK[CachedIdx].BSSID, MAC_ADDR_LEN))
-		        {
-				NdisZeroMemory(pAd->StaCfg.SavedPMK[CachedIdx].BSSID, MAC_ADDR_LEN);
-					NdisZeroMemory(pAd->StaCfg.SavedPMK[CachedIdx].PMKID, 16);
-					for (idx = CachedIdx; idx < (pAd->StaCfg.SavedPMKNum - 1); idx++)
-					{
-						NdisMoveMemory(&pAd->StaCfg.SavedPMK[idx].BSSID[0], &pAd->StaCfg.SavedPMK[idx+1].BSSID[0], MAC_ADDR_LEN);
-						NdisMoveMemory(&pAd->StaCfg.SavedPMK[idx].PMKID[0], &pAd->StaCfg.SavedPMK[idx+1].PMKID[0], 16);
-					}
-					pAd->StaCfg.SavedPMKNum--;
-			        break;
-		        }
-	        }
-
-			DBGPRINT(RT_DEBUG_TRACE ,("rt_ioctl_siwpmksa - IW_PMKSA_REMOVE\n"));
-			break;
-		case IW_PMKSA_ADD:
-			for (CachedIdx = 0; CachedIdx < pAd->StaCfg.SavedPMKNum; CachedIdx++)
-			{
-		        // compare the BSSID
-		        if (NdisEqualMemory(pPmksa->bssid.sa_data, pAd->StaCfg.SavedPMK[CachedIdx].BSSID, MAC_ADDR_LEN))
-			        break;
-	        }
-
-	        // Found, replace it
-	        if (CachedIdx < PMKID_NO)
-	        {
-		        DBGPRINT(RT_DEBUG_OFF, ("Update PMKID, idx = %d\n", CachedIdx));
-		        NdisMoveMemory(&pAd->StaCfg.SavedPMK[CachedIdx].BSSID[0], pPmksa->bssid.sa_data, MAC_ADDR_LEN);
-				NdisMoveMemory(&pAd->StaCfg.SavedPMK[CachedIdx].PMKID[0], pPmksa->pmkid, 16);
-		        pAd->StaCfg.SavedPMKNum++;
-	        }
-	        // Not found, replace the last one
-	        else
-	        {
-		        // Randomly replace one
-		        CachedIdx = (pPmksa->bssid.sa_data[5] % PMKID_NO);
-		        DBGPRINT(RT_DEBUG_OFF, ("Update PMKID, idx = %d\n", CachedIdx));
-		        NdisMoveMemory(&pAd->StaCfg.SavedPMK[CachedIdx].BSSID[0], pPmksa->bssid.sa_data, MAC_ADDR_LEN);
-				NdisMoveMemory(&pAd->StaCfg.SavedPMK[CachedIdx].PMKID[0], pPmksa->pmkid, 16);
-	        }
-
-			DBGPRINT(RT_DEBUG_TRACE ,("rt_ioctl_siwpmksa - IW_PMKSA_ADD\n"));
-			break;
-		default:
-			DBGPRINT(RT_DEBUG_TRACE ,("rt_ioctl_siwpmksa - Unknow Command!!\n"));
-			break;
-	}
-
-	return 0;
-}
-#endif // #if WIRELESS_EXT > 17
-
-#ifdef DBG
-static int
-rt_private_ioctl_bbp(struct net_device *dev, struct iw_request_info *info,
-		struct iw_point *wrq, char *extra)
-			{
-	PSTRING				this_char;
-	PSTRING				value = NULL;
-	UCHAR				regBBP = 0;
-//	CHAR				arg[255]={0};
-	UINT32				bbpId;
-	UINT32				bbpValue;
-	BOOLEAN				bIsPrintAllBBP = FALSE;
-	INT					Status = 0;
-    PRTMP_ADAPTER       pAdapter = RTMP_OS_NETDEV_GET_PRIV(dev);
-
-
-	memset(extra, 0x00, IW_PRIV_SIZE_MASK);
-
-	if (wrq->length > 1) //No parameters.
-				{
-		sprintf(extra, "\n");
-
-		//Parsing Read or Write
-		this_char = wrq->pointer;
-		DBGPRINT(RT_DEBUG_TRACE, ("this_char=%s\n", this_char));
-		if (!*this_char)
-			goto next;
-
-		if ((value = rtstrchr(this_char, '=')) != NULL)
-			*value++ = 0;
-
-		if (!value || !*value)
-		{ //Read
-			DBGPRINT(RT_DEBUG_TRACE, ("this_char=%s, value=%s\n", this_char, value));
-			if (sscanf(this_char, "%d", &(bbpId)) == 1)
-			{
-				if (bbpId <= MAX_BBP_ID)
-				{
-#ifdef RALINK_ATE
-					if (ATE_ON(pAdapter))
-					{
-						ATE_BBP_IO_READ8_BY_REG_ID(pAdapter, bbpId, &regBBP);
-					}
-					else
-#endif // RALINK_ATE //
-					{
-					RTMP_BBP_IO_READ8_BY_REG_ID(pAdapter, bbpId, &regBBP);
-					}
-					sprintf(extra+strlen(extra), "R%02d[0x%02X]:%02X\n", bbpId, bbpId, regBBP);
-                    wrq->length = strlen(extra) + 1; // 1: size of '\0'
-					DBGPRINT(RT_DEBUG_TRACE, ("msg=%s\n", extra));
-				}
-				else
-				{//Invalid parametes, so default printk all bbp
-					bIsPrintAllBBP = TRUE;
-					goto next;
-				}
-			}
-			else
-			{ //Invalid parametes, so default printk all bbp
-				bIsPrintAllBBP = TRUE;
-				goto next;
-			}
-		}
-		else
-		{ //Write
-			if ((sscanf(this_char, "%d", &(bbpId)) == 1) && (sscanf(value, "%x", &(bbpValue)) == 1))
-			{
-				if (bbpId <= MAX_BBP_ID)
-				{
-#ifdef RALINK_ATE
-					if (ATE_ON(pAdapter))
-					{
-						ATE_BBP_IO_WRITE8_BY_REG_ID(pAdapter, bbpId, bbpValue);
-						/* read it back for showing */
-						ATE_BBP_IO_READ8_BY_REG_ID(pAdapter, bbpId, &regBBP);
-					}
-					else
-#endif // RALINK_ATE //
-					{
-					    RTMP_BBP_IO_WRITE8_BY_REG_ID(pAdapter, bbpId, bbpValue);
-					/* read it back for showing */
-					RTMP_BBP_IO_READ8_BY_REG_ID(pAdapter, bbpId, &regBBP);
-			}
-					sprintf(extra+strlen(extra), "R%02d[0x%02X]:%02X\n", bbpId, bbpId, regBBP);
-                    wrq->length = strlen(extra) + 1; // 1: size of '\0'
-					DBGPRINT(RT_DEBUG_TRACE, ("msg=%s\n", extra));
-				}
-				else
-				{//Invalid parametes, so default printk all bbp
-					bIsPrintAllBBP = TRUE;
-					goto next;
-				}
-			}
-			else
-			{ //Invalid parametes, so default printk all bbp
-				bIsPrintAllBBP = TRUE;
-				goto next;
-			}
-		}
-		}
-	else
-		bIsPrintAllBBP = TRUE;
-
-next:
-	if (bIsPrintAllBBP)
-	{
-		memset(extra, 0x00, IW_PRIV_SIZE_MASK);
-		sprintf(extra, "\n");
-		for (bbpId = 0; bbpId <= MAX_BBP_ID; bbpId++)
-		{
-		    if (strlen(extra) >= (IW_PRIV_SIZE_MASK - 20))
-                break;
-#ifdef RALINK_ATE
-			if (ATE_ON(pAdapter))
-			{
-				ATE_BBP_IO_READ8_BY_REG_ID(pAdapter, bbpId, &regBBP);
-			}
-			else
-#endif // RALINK_ATE //
-			RTMP_BBP_IO_READ8_BY_REG_ID(pAdapter, bbpId, &regBBP);
-			sprintf(extra+strlen(extra), "R%02d[0x%02X]:%02X    ", bbpId, bbpId, regBBP);
-			if (bbpId%5 == 4)
-			sprintf(extra+strlen(extra), "%03d = %02X\n", bbpId, regBBP);  // edit by johnli, change display format
-		}
-
-        wrq->length = strlen(extra) + 1; // 1: size of '\0'
-        DBGPRINT(RT_DEBUG_TRACE, ("wrq->length = %d\n", wrq->length));
-	}
-
-	DBGPRINT(RT_DEBUG_TRACE, ("<==rt_private_ioctl_bbp\n\n"));
-
-    return Status;
-}
-#endif // DBG //
-
-int rt_ioctl_siwrate(struct net_device *dev,
-			struct iw_request_info *info,
-			union iwreq_data *wrqu, char *extra)
-{
-    PRTMP_ADAPTER   pAd = RTMP_OS_NETDEV_GET_PRIV(dev);
-    UINT32          rate = wrqu->bitrate.value, fixed = wrqu->bitrate.fixed;
-
-    //check if the interface is down
-	if(!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_INTERRUPT_IN_USE))
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("rt_ioctl_siwrate::Network is down!\n"));
-	return -ENETDOWN;
-	}
-
-    DBGPRINT(RT_DEBUG_TRACE, ("rt_ioctl_siwrate::(rate = %d, fixed = %d)\n", rate, fixed));
-    /* rate = -1 => auto rate
-       rate = X, fixed = 1 => (fixed rate X)
-    */
-    if (rate == -1)
-    {
-        //Auto Rate
-        pAd->StaCfg.DesiredTransmitSetting.field.MCS = MCS_AUTO;
-		pAd->StaCfg.bAutoTxRateSwitch = TRUE;
-		if ((pAd->CommonCfg.PhyMode <= PHY_11G) ||
-		    (pAd->MacTab.Content[BSSID_WCID].HTPhyMode.field.MODE <= MODE_OFDM))
-            RTMPSetDesiredRates(pAd, -1);
-
-#ifdef DOT11_N_SUPPORT
-            SetCommonHT(pAd);
-#endif // DOT11_N_SUPPORT //
-    }
-    else
-    {
-        if (fixed)
-        {
-		pAd->StaCfg.bAutoTxRateSwitch = FALSE;
-            if ((pAd->CommonCfg.PhyMode <= PHY_11G) ||
-                (pAd->MacTab.Content[BSSID_WCID].HTPhyMode.field.MODE <= MODE_OFDM))
-                RTMPSetDesiredRates(pAd, rate);
-            else
-            {
-                pAd->StaCfg.DesiredTransmitSetting.field.MCS = MCS_AUTO;
-#ifdef DOT11_N_SUPPORT
-                SetCommonHT(pAd);
-#endif // DOT11_N_SUPPORT //
-            }
-            DBGPRINT(RT_DEBUG_TRACE, ("rt_ioctl_siwrate::(HtMcs=%d)\n",pAd->StaCfg.DesiredTransmitSetting.field.MCS));
-        }
-        else
-        {
-            // TODO: rate = X, fixed = 0 => (rates <= X)
-            return -EOPNOTSUPP;
-        }
-    }
-
-    return 0;
-}
-
-int rt_ioctl_giwrate(struct net_device *dev,
-			       struct iw_request_info *info,
-			       union iwreq_data *wrqu, char *extra)
-{
-    PRTMP_ADAPTER   pAd = RTMP_OS_NETDEV_GET_PRIV(dev);
-    int rate_index = 0, rate_count = 0;
-    HTTRANSMIT_SETTING ht_setting;
-/* Remove to global variable
-    __s32 ralinkrate[] =
-	{2,  4,   11,  22, // CCK
-	12, 18,   24,  36, 48, 72, 96, 108, // OFDM
-	13, 26,   39,  52,  78, 104, 117, 130, 26,  52,  78, 104, 156, 208, 234, 260, // 20MHz, 800ns GI, MCS: 0 ~ 15
-	39, 78,  117, 156, 234, 312, 351, 390,										  // 20MHz, 800ns GI, MCS: 16 ~ 23
-	27, 54,   81, 108, 162, 216, 243, 270, 54, 108, 162, 216, 324, 432, 486, 540, // 40MHz, 800ns GI, MCS: 0 ~ 15
-	81, 162, 243, 324, 486, 648, 729, 810,										  // 40MHz, 800ns GI, MCS: 16 ~ 23
-	14, 29,   43,  57,  87, 115, 130, 144, 29, 59,   87, 115, 173, 230, 260, 288, // 20MHz, 400ns GI, MCS: 0 ~ 15
-	43, 87,  130, 173, 260, 317, 390, 433,										  // 20MHz, 400ns GI, MCS: 16 ~ 23
-	30, 60,   90, 120, 180, 240, 270, 300, 60, 120, 180, 240, 360, 480, 540, 600, // 40MHz, 400ns GI, MCS: 0 ~ 15
-	90, 180, 270, 360, 540, 720, 810, 900};										  // 40MHz, 400ns GI, MCS: 16 ~ 23
-*/
-
-    rate_count = sizeof(ralinkrate)/sizeof(__s32);
-    //check if the interface is down
-	if(!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_INTERRUPT_IN_USE))
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
-	return -ENETDOWN;
-	}
-
-    if ((pAd->StaCfg.bAutoTxRateSwitch == FALSE) &&
-        (INFRA_ON(pAd)) &&
-        ((pAd->CommonCfg.PhyMode <= PHY_11G) || (pAd->MacTab.Content[BSSID_WCID].HTPhyMode.field.MODE <= MODE_OFDM)))
-        ht_setting.word = pAd->StaCfg.HTPhyMode.word;
-    else
-        ht_setting.word = pAd->MacTab.Content[BSSID_WCID].HTPhyMode.word;
-
-#ifdef DOT11_N_SUPPORT
-    if (ht_setting.field.MODE >= MODE_HTMIX)
-    {
-//	rate_index = 12 + ((UCHAR)ht_setting.field.BW *16) + ((UCHAR)ht_setting.field.ShortGI *32) + ((UCHAR)ht_setting.field.MCS);
-	rate_index = 12 + ((UCHAR)ht_setting.field.BW *24) + ((UCHAR)ht_setting.field.ShortGI *48) + ((UCHAR)ht_setting.field.MCS);
-    }
-    else
-#endif // DOT11_N_SUPPORT //
-    if (ht_setting.field.MODE == MODE_OFDM)
-	rate_index = (UCHAR)(ht_setting.field.MCS) + 4;
-    else if (ht_setting.field.MODE == MODE_CCK)
-	rate_index = (UCHAR)(ht_setting.field.MCS);
-
-    if (rate_index < 0)
-        rate_index = 0;
-
-    if (rate_index > rate_count)
-        rate_index = rate_count;
-
-    wrqu->bitrate.value = ralinkrate[rate_index] * 500000;
-    wrqu->bitrate.disabled = 0;
-
-    return 0;
-}
-
-static const iw_handler rt_handler[] =
-{
-	(iw_handler) NULL,			            /* SIOCSIWCOMMIT */
-	(iw_handler) rt_ioctl_giwname,			/* SIOCGIWNAME   */
-	(iw_handler) NULL,			            /* SIOCSIWNWID   */
-	(iw_handler) NULL,			            /* SIOCGIWNWID   */
-	(iw_handler) rt_ioctl_siwfreq,		    /* SIOCSIWFREQ   */
-	(iw_handler) rt_ioctl_giwfreq,		    /* SIOCGIWFREQ   */
-	(iw_handler) rt_ioctl_siwmode,		    /* SIOCSIWMODE   */
-	(iw_handler) rt_ioctl_giwmode,		    /* SIOCGIWMODE   */
-	(iw_handler) NULL,		                /* SIOCSIWSENS   */
-	(iw_handler) NULL,		                /* SIOCGIWSENS   */
-	(iw_handler) NULL /* not used */,		/* SIOCSIWRANGE  */
-	(iw_handler) rt_ioctl_giwrange,		    /* SIOCGIWRANGE  */
-	(iw_handler) NULL /* not used */,		/* SIOCSIWPRIV   */
-	(iw_handler) NULL /* kernel code */,    /* SIOCGIWPRIV   */
-	(iw_handler) NULL /* not used */,		/* SIOCSIWSTATS  */
-	(iw_handler) rt28xx_get_wireless_stats /* kernel code */,    /* SIOCGIWSTATS  */
-	(iw_handler) NULL,		                /* SIOCSIWSPY    */
-	(iw_handler) NULL,		                /* SIOCGIWSPY    */
-	(iw_handler) NULL,				        /* SIOCSIWTHRSPY */
-	(iw_handler) NULL,				        /* SIOCGIWTHRSPY */
-	(iw_handler) rt_ioctl_siwap,            /* SIOCSIWAP     */
-	(iw_handler) rt_ioctl_giwap,		    /* SIOCGIWAP     */
-#ifdef SIOCSIWMLME
-	(iw_handler) rt_ioctl_siwmlme,	        /* SIOCSIWMLME   */
-#else
-	(iw_handler) NULL,				        /* SIOCSIWMLME */
-#endif // SIOCSIWMLME //
-	(iw_handler) rt_ioctl_iwaplist,		    /* SIOCGIWAPLIST */
-#ifdef SIOCGIWSCAN
-	(iw_handler) rt_ioctl_siwscan,		    /* SIOCSIWSCAN   */
-	(iw_handler) rt_ioctl_giwscan,		    /* SIOCGIWSCAN   */
-#else
-	(iw_handler) NULL,				        /* SIOCSIWSCAN   */
-	(iw_handler) NULL,				        /* SIOCGIWSCAN   */
-#endif /* SIOCGIWSCAN */
-	(iw_handler) rt_ioctl_siwessid,		    /* SIOCSIWESSID  */
-	(iw_handler) rt_ioctl_giwessid,		    /* SIOCGIWESSID  */
-	(iw_handler) rt_ioctl_siwnickn,		    /* SIOCSIWNICKN  */
-	(iw_handler) rt_ioctl_giwnickn,		    /* SIOCGIWNICKN  */
-	(iw_handler) NULL,				        /* -- hole --    */
-	(iw_handler) NULL,				        /* -- hole --    */
-	(iw_handler) rt_ioctl_siwrate,          /* SIOCSIWRATE   */
-	(iw_handler) rt_ioctl_giwrate,          /* SIOCGIWRATE   */
-	(iw_handler) rt_ioctl_siwrts,		    /* SIOCSIWRTS    */
-	(iw_handler) rt_ioctl_giwrts,		    /* SIOCGIWRTS    */
-	(iw_handler) rt_ioctl_siwfrag,		    /* SIOCSIWFRAG   */
-	(iw_handler) rt_ioctl_giwfrag,		    /* SIOCGIWFRAG   */
-	(iw_handler) NULL,		                /* SIOCSIWTXPOW  */
-	(iw_handler) NULL,		                /* SIOCGIWTXPOW  */
-	(iw_handler) NULL,		                /* SIOCSIWRETRY  */
-	(iw_handler) NULL,		                /* SIOCGIWRETRY  */
-	(iw_handler) rt_ioctl_siwencode,		/* SIOCSIWENCODE */
-	(iw_handler) rt_ioctl_giwencode,		/* SIOCGIWENCODE */
-	(iw_handler) NULL,		                /* SIOCSIWPOWER  */
-	(iw_handler) NULL,		                /* SIOCGIWPOWER  */
-	(iw_handler) NULL,						/* -- hole -- */
-	(iw_handler) NULL,						/* -- hole -- */
-#if WIRELESS_EXT > 17
-    (iw_handler) rt_ioctl_siwgenie,         /* SIOCSIWGENIE  */
-	(iw_handler) rt_ioctl_giwgenie,         /* SIOCGIWGENIE  */
-	(iw_handler) rt_ioctl_siwauth,		    /* SIOCSIWAUTH   */
-	(iw_handler) rt_ioctl_giwauth,		    /* SIOCGIWAUTH   */
-	(iw_handler) rt_ioctl_siwencodeext,	    /* SIOCSIWENCODEEXT */
-	(iw_handler) rt_ioctl_giwencodeext,		/* SIOCGIWENCODEEXT */
-	(iw_handler) rt_ioctl_siwpmksa,         /* SIOCSIWPMKSA  */
-#endif
-};
-
-static const iw_handler rt_priv_handlers[] = {
-	(iw_handler) NULL, /* + 0x00 */
-	(iw_handler) NULL, /* + 0x01 */
-	(iw_handler) rt_ioctl_setparam, /* + 0x02 */
-#ifdef DBG
-	(iw_handler) rt_private_ioctl_bbp, /* + 0x03 */
-#else
-	(iw_handler) NULL, /* + 0x03 */
-#endif
-	(iw_handler) NULL, /* + 0x04 */
-	(iw_handler) NULL, /* + 0x05 */
-	(iw_handler) NULL, /* + 0x06 */
-	(iw_handler) NULL, /* + 0x07 */
-	(iw_handler) NULL, /* + 0x08 */
-	(iw_handler) rt_private_get_statistics, /* + 0x09 */
-	(iw_handler) NULL, /* + 0x0A */
-	(iw_handler) NULL, /* + 0x0B */
-	(iw_handler) NULL, /* + 0x0C */
-	(iw_handler) NULL, /* + 0x0D */
-	(iw_handler) NULL, /* + 0x0E */
-	(iw_handler) NULL, /* + 0x0F */
-	(iw_handler) NULL, /* + 0x10 */
-	(iw_handler) rt_private_show, /* + 0x11 */
-    (iw_handler) NULL, /* + 0x12 */
-	(iw_handler) NULL, /* + 0x13 */
-    (iw_handler) NULL, /* + 0x14 */
-	(iw_handler) NULL, /* + 0x15 */
-    (iw_handler) NULL, /* + 0x16 */
-	(iw_handler) NULL, /* + 0x17 */
-	(iw_handler) NULL, /* + 0x18 */
-};
-
-const struct iw_handler_def rt28xx_iw_handler_def =
-{
-#define	N(a)	(sizeof (a) / sizeof (a[0]))
-	.standard	= (iw_handler *) rt_handler,
-	.num_standard	= sizeof(rt_handler) / sizeof(iw_handler),
-	.private	= (iw_handler *) rt_priv_handlers,
-	.num_private		= N(rt_priv_handlers),
-	.private_args	= (struct iw_priv_args *) privtab,
-	.num_private_args	= N(privtab),
-#if IW_HANDLER_VERSION >= 7
-    .get_wireless_stats = rt28xx_get_wireless_stats,
-#endif
-};
-
-INT RTMPSetInformation(
-    IN  PRTMP_ADAPTER pAd,
-    IN  OUT struct ifreq    *rq,
-    IN  INT                 cmd)
-{
-    struct iwreq                        *wrq = (struct iwreq *) rq;
-    NDIS_802_11_SSID                    Ssid;
-    NDIS_802_11_MAC_ADDRESS             Bssid;
-    RT_802_11_PHY_MODE                  PhyMode;
-    RT_802_11_STA_CONFIG                StaConfig;
-    NDIS_802_11_RATES                   aryRates;
-    RT_802_11_PREAMBLE                  Preamble;
-    NDIS_802_11_WEP_STATUS              WepStatus;
-    NDIS_802_11_AUTHENTICATION_MODE     AuthMode = Ndis802_11AuthModeMax;
-    NDIS_802_11_NETWORK_INFRASTRUCTURE  BssType;
-    NDIS_802_11_RTS_THRESHOLD           RtsThresh;
-    NDIS_802_11_FRAGMENTATION_THRESHOLD FragThresh;
-    NDIS_802_11_POWER_MODE              PowerMode;
-    PNDIS_802_11_KEY                    pKey = NULL;
-    PNDIS_802_11_WEP			        pWepKey =NULL;
-    PNDIS_802_11_REMOVE_KEY             pRemoveKey = NULL;
-    NDIS_802_11_CONFIGURATION           Config, *pConfig = NULL;
-    NDIS_802_11_NETWORK_TYPE            NetType;
-    ULONG                               Now;
-    UINT                                KeyIdx = 0;
-    INT                                 Status = NDIS_STATUS_SUCCESS, MaxPhyMode = PHY_11G;
-    ULONG                               PowerTemp;
-    BOOLEAN                             RadioState;
-    BOOLEAN                             StateMachineTouched = FALSE;
-     PNDIS_802_11_PASSPHRASE                    ppassphrase = NULL;
-#ifdef DOT11_N_SUPPORT
-	OID_SET_HT_PHYMODE					HT_PhyMode;	//11n ,kathy
-#endif // DOT11_N_SUPPORT //
-#ifdef WPA_SUPPLICANT_SUPPORT
-    PNDIS_802_11_PMKID                  pPmkId = NULL;
-    BOOLEAN				                IEEE8021xState = FALSE;
-    BOOLEAN				                IEEE8021x_required_keys = FALSE;
-    UCHAR                               wpa_supplicant_enable = 0;
-#endif // WPA_SUPPLICANT_SUPPORT //
-
-#ifdef SNMP_SUPPORT
-	TX_RTY_CFG_STRUC			tx_rty_cfg;
-	ULONG						ShortRetryLimit, LongRetryLimit;
-	UCHAR						ctmp;
-#endif // SNMP_SUPPORT //
-
-
-
-
-#ifdef DOT11_N_SUPPORT
-	MaxPhyMode = PHY_11N_5G;
-#endif // DOT11_N_SUPPORT //
-
-	DBGPRINT(RT_DEBUG_TRACE, ("-->RTMPSetInformation(),	0x%08x\n", cmd&0x7FFF));
-	switch(cmd & 0x7FFF) {
-		case RT_OID_802_11_COUNTRY_REGION:
-			if (wrq->u.data.length < sizeof(UCHAR))
-				Status = -EINVAL;
-			// Only avaliable when EEPROM not programming
-            else if (!(pAd->CommonCfg.CountryRegion & 0x80) && !(pAd->CommonCfg.CountryRegionForABand & 0x80))
-			{
-				ULONG   Country;
-				UCHAR	TmpPhy;
-
-				Status = copy_from_user(&Country, wrq->u.data.pointer, wrq->u.data.length);
-				pAd->CommonCfg.CountryRegion = (UCHAR)(Country & 0x000000FF);
-				pAd->CommonCfg.CountryRegionForABand = (UCHAR)((Country >> 8) & 0x000000FF);
-                TmpPhy = pAd->CommonCfg.PhyMode;
-				pAd->CommonCfg.PhyMode = 0xff;
-				// Build all corresponding channel information
-				RTMPSetPhyMode(pAd, TmpPhy);
-#ifdef DOT11_N_SUPPORT
-				SetCommonHT(pAd);
-#endif // DOT11_N_SUPPORT //
-				DBGPRINT(RT_DEBUG_TRACE, ("Set::RT_OID_802_11_COUNTRY_REGION (A:%d  B/G:%d)\n", pAd->CommonCfg.CountryRegionForABand,
-				    pAd->CommonCfg.CountryRegion));
-            }
-            break;
-        case OID_802_11_BSSID_LIST_SCAN:
-            Now = jiffies;
-			DBGPRINT(RT_DEBUG_TRACE, ("Set::OID_802_11_BSSID_LIST_SCAN, TxCnt = %d \n", pAd->RalinkCounters.LastOneSecTotalTxCount));
-
-            if (MONITOR_ON(pAd))
-            {
-                DBGPRINT(RT_DEBUG_TRACE, ("!!! Driver is in Monitor Mode now !!!\n"));
-                break;
-            }
-
-			//Benson add 20080527, when radio off, sta don't need to scan
-			if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_RADIO_OFF))
-				break;
-
-			if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS))
-			{
-                DBGPRINT(RT_DEBUG_TRACE, ("!!! Driver is scanning now !!!\n"));
-				pAd->StaCfg.bScanReqIsFromWebUI = TRUE;
-				Status = NDIS_STATUS_SUCCESS;
-                break;
-            }
-
-			if (pAd->RalinkCounters.LastOneSecTotalTxCount > 100)
-            {
-                DBGPRINT(RT_DEBUG_TRACE, ("!!! Link UP, ignore this set::OID_802_11_BSSID_LIST_SCAN\n"));
-				Status = NDIS_STATUS_SUCCESS;
-				pAd->StaCfg.ScanCnt = 99;		// Prevent auto scan triggered by this OID
-				break;
-            }
-
-            if ((OPSTATUS_TEST_FLAG(pAd, fOP_STATUS_MEDIA_STATE_CONNECTED)) &&
-				((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA) ||
-				(pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPAPSK) ||
-				(pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2) ||
-				(pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK)) &&
-                (pAd->StaCfg.PortSecured == WPA_802_1X_PORT_NOT_SECURED))
-            {
-                DBGPRINT(RT_DEBUG_TRACE, ("!!! Link UP, Port Not Secured! ignore this set::OID_802_11_BSSID_LIST_SCAN\n"));
-				Status = NDIS_STATUS_SUCCESS;
-				pAd->StaCfg.ScanCnt = 99;		// Prevent auto scan triggered by this OID
-				break;
-            }
-
-
-            if (pAd->Mlme.CntlMachine.CurrState != CNTL_IDLE)
-            {
-                RTMP_MLME_RESET_STATE_MACHINE(pAd);
-                DBGPRINT(RT_DEBUG_TRACE, ("!!! MLME busy, reset MLME state machine !!!\n"));
-            }
-
-            // tell CNTL state machine to call NdisMSetInformationComplete() after completing
-            // this request, because this request is initiated by NDIS.
-            pAd->MlmeAux.CurrReqIsFromNdis = FALSE;
-            // Reset allowed scan retries
-            pAd->StaCfg.ScanCnt = 0;
-            pAd->StaCfg.LastScanTime = Now;
-
-			pAd->StaCfg.bScanReqIsFromWebUI = TRUE;
-            RTMP_SET_FLAG(pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS);
-            MlmeEnqueue(pAd,
-                        MLME_CNTL_STATE_MACHINE,
-                        OID_802_11_BSSID_LIST_SCAN,
-                        0,
-                        NULL);
-
-            Status = NDIS_STATUS_SUCCESS;
-            StateMachineTouched = TRUE;
-            break;
-        case OID_802_11_SSID:
-            if (wrq->u.data.length != sizeof(NDIS_802_11_SSID))
-                Status = -EINVAL;
-            else
-            {
-		PSTRING pSsidString = NULL;
-                Status = copy_from_user(&Ssid, wrq->u.data.pointer, wrq->u.data.length);
-
-				DBGPRINT(RT_DEBUG_TRACE, ("Set::OID_802_11_SSID (Len=%d,Ssid=%s)\n", Ssid.SsidLength, Ssid.Ssid));
-                if (Ssid.SsidLength > MAX_LEN_OF_SSID)
-                    Status = -EINVAL;
-                else
-                {
-			if (Ssid.SsidLength == 0)
-				{
-				Set_SSID_Proc(pAd, "");
-				}
-					else
-                    {
-				pSsidString = (PSTRING)kmalloc(MAX_LEN_OF_SSID+1, MEM_ALLOC_FLAG);
-						if (pSsidString)
-						{
-							NdisZeroMemory(pSsidString, MAX_LEN_OF_SSID+1);
-							NdisMoveMemory(pSsidString, Ssid.Ssid, Ssid.SsidLength);
-							Set_SSID_Proc(pAd, pSsidString);
-							kfree(pSsidString);
-						}
-						else
-							Status = -ENOMEM;
-                    }
-                }
-            }
-            break;
-		case OID_802_11_SET_PASSPHRASE:
-	    ppassphrase= kmalloc(wrq->u.data.length, MEM_ALLOC_FLAG);
-
-	    if(ppassphrase== NULL)
-            {
-		Status = -ENOMEM;
-				DBGPRINT(RT_DEBUG_TRACE, ("Set::OID_802_11_SET_PASSPHRASE, Failed!!\n"));
-		break;
-            }
-			else
-		{
-		Status = copy_from_user(ppassphrase, wrq->u.data.pointer, wrq->u.data.length);
-
-				if (Status)
-		{
-			Status  = -EINVAL;
-			DBGPRINT(RT_DEBUG_TRACE, ("Set::OID_802_11_SET_PASSPHRASE, Failed (length mismatch)!!\n"));
-			}
-			else
-			{
-					if(ppassphrase->KeyLength < 8 || ppassphrase->KeyLength > 64)
-					{
-						Status  = -EINVAL;
-			DBGPRINT(RT_DEBUG_TRACE, ("Set::OID_802_11_SET_PASSPHRASE, Failed (len less than 8 or greater than 64)!!\n"));
-					}
-					else
-					{
-						// set key passphrase and length
-						NdisZeroMemory(pAd->StaCfg.WpaPassPhrase, 64);
-					NdisMoveMemory(pAd->StaCfg.WpaPassPhrase, &ppassphrase->KeyMaterial, ppassphrase->KeyLength);
-						pAd->StaCfg.WpaPassPhraseLen = ppassphrase->KeyLength;
-						hex_dump("pAd->StaCfg.WpaPassPhrase", pAd->StaCfg.WpaPassPhrase, 64);
-						printk("WpaPassPhrase=%s\n",pAd->StaCfg.WpaPassPhrase);
-					}
-                }
-            }
-		kfree(ppassphrase);
-			break;
-
-        case OID_802_11_BSSID:
-            if (wrq->u.data.length != sizeof(NDIS_802_11_MAC_ADDRESS))
-                Status  = -EINVAL;
-            else
-            {
-                Status = copy_from_user(&Bssid, wrq->u.data.pointer, wrq->u.data.length);
-
-                // tell CNTL state machine to call NdisMSetInformationComplete() after completing
-                // this request, because this request is initiated by NDIS.
-                pAd->MlmeAux.CurrReqIsFromNdis = FALSE;
-
-				// Prevent to connect AP again in STAMlmePeriodicExec
-				pAd->MlmeAux.AutoReconnectSsidLen= 32;
-
-                // Reset allowed scan retries
-				pAd->StaCfg.ScanCnt = 0;
-
-                if (pAd->Mlme.CntlMachine.CurrState != CNTL_IDLE)
-                {
-                    RTMP_MLME_RESET_STATE_MACHINE(pAd);
-                    DBGPRINT(RT_DEBUG_TRACE, ("!!! MLME busy, reset MLME state machine !!!\n"));
-                }
-                MlmeEnqueue(pAd,
-                            MLME_CNTL_STATE_MACHINE,
-                            OID_802_11_BSSID,
-                            sizeof(NDIS_802_11_MAC_ADDRESS),
-                            (VOID *)&Bssid);
-                Status = NDIS_STATUS_SUCCESS;
-                StateMachineTouched = TRUE;
-
-                DBGPRINT(RT_DEBUG_TRACE, ("Set::OID_802_11_BSSID %02x:%02x:%02x:%02x:%02x:%02x\n",
-                                        Bssid[0], Bssid[1], Bssid[2], Bssid[3], Bssid[4], Bssid[5]));
-            }
-            break;
-        case RT_OID_802_11_RADIO:
-            if (wrq->u.data.length != sizeof(BOOLEAN))
-                Status  = -EINVAL;
-            else
-            {
-                Status = copy_from_user(&RadioState, wrq->u.data.pointer, wrq->u.data.length);
-                DBGPRINT(RT_DEBUG_TRACE, ("Set::RT_OID_802_11_RADIO (=%d)\n", RadioState));
-                if (pAd->StaCfg.bSwRadio != RadioState)
-                {
-                    pAd->StaCfg.bSwRadio = RadioState;
-                    if (pAd->StaCfg.bRadio != (pAd->StaCfg.bHwRadio && pAd->StaCfg.bSwRadio))
-                    {
-                        pAd->StaCfg.bRadio = (pAd->StaCfg.bHwRadio && pAd->StaCfg.bSwRadio);
-                        if (pAd->StaCfg.bRadio == TRUE)
-                        {
-                            MlmeRadioOn(pAd);
-                            // Update extra information
-							pAd->ExtraInfo = EXTRA_INFO_CLEAR;
-                        }
-                        else
-                        {
-				if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS))
-				            {
-				                if (pAd->Mlme.CntlMachine.CurrState != CNTL_IDLE)
-						        {
-						            RTMP_MLME_RESET_STATE_MACHINE(pAd);
-						            DBGPRINT(RT_DEBUG_TRACE, ("!!! MLME busy, reset MLME state machine !!!\n"));
-						        }
-				            }
-
-                            MlmeRadioOff(pAd);
-                            // Update extra information
-							pAd->ExtraInfo = SW_RADIO_OFF;
-                        }
-                    }
-                }
-            }
-            break;
-        case RT_OID_802_11_PHY_MODE:
-            if (wrq->u.data.length != sizeof(RT_802_11_PHY_MODE))
-                Status  = -EINVAL;
-            else
-            {
-                Status = copy_from_user(&PhyMode, wrq->u.data.pointer, wrq->u.data.length);
-				if (PhyMode <= MaxPhyMode)
-				{
-                RTMPSetPhyMode(pAd, PhyMode);
-#ifdef DOT11_N_SUPPORT
-				SetCommonHT(pAd);
-#endif // DOT11_N_SUPPORT //
-				}
-                DBGPRINT(RT_DEBUG_TRACE, ("Set::RT_OID_802_11_PHY_MODE (=%d)\n", PhyMode));
-            }
-            break;
-        case RT_OID_802_11_STA_CONFIG:
-            if (wrq->u.data.length != sizeof(RT_802_11_STA_CONFIG))
-                Status  = -EINVAL;
-            else
-            {
-		UINT32	Value;
-
-                Status = copy_from_user(&StaConfig, wrq->u.data.pointer, wrq->u.data.length);
-                pAd->CommonCfg.bEnableTxBurst = StaConfig.EnableTxBurst;
-                pAd->CommonCfg.UseBGProtection = StaConfig.UseBGProtection;
-                pAd->CommonCfg.bUseShortSlotTime = 1; // 2003-10-30 always SHORT SLOT capable
-                if ((pAd->CommonCfg.PhyMode != StaConfig.AdhocMode) &&
-					(StaConfig.AdhocMode <= MaxPhyMode))
-                {
-                    // allow dynamic change of "USE OFDM rate or not" in ADHOC mode
-                    // if setting changed, need to reset current TX rate as well as BEACON frame format
-                    if (pAd->StaCfg.BssType == BSS_ADHOC)
-                    {
-			pAd->CommonCfg.PhyMode = StaConfig.AdhocMode;
-			RTMPSetPhyMode(pAd, PhyMode);
-                        MlmeUpdateTxRates(pAd, FALSE, 0);
-                        MakeIbssBeacon(pAd);           // re-build BEACON frame
-                        AsicEnableIbssSync(pAd);   // copy to on-chip memory
-                    }
-                }
-                DBGPRINT(RT_DEBUG_TRACE, ("Set::RT_OID_802_11_SET_STA_CONFIG (Burst=%d, Protection=%ld,ShortSlot=%d\n",
-                                        pAd->CommonCfg.bEnableTxBurst,
-                                        pAd->CommonCfg.UseBGProtection,
-                                        pAd->CommonCfg.bUseShortSlotTime));
-
-				if (pAd->CommonCfg.PSPXlink)
-					Value = PSPXLINK;
-				else
-					Value = STANORMAL;
-				RTMP_IO_WRITE32(pAd, RX_FILTR_CFG, Value);
-				Value = 0;
-				RTMP_IO_READ32(pAd, MAC_SYS_CTRL, &Value);
-				Value &= (~0x80);
-				RTMP_IO_WRITE32(pAd, MAC_SYS_CTRL, Value);
-            }
-            break;
-        case OID_802_11_DESIRED_RATES:
-            if (wrq->u.data.length != sizeof(NDIS_802_11_RATES))
-                Status  = -EINVAL;
-            else
-            {
-                Status = copy_from_user(&aryRates, wrq->u.data.pointer, wrq->u.data.length);
-                NdisZeroMemory(pAd->CommonCfg.DesireRate, MAX_LEN_OF_SUPPORTED_RATES);
-                NdisMoveMemory(pAd->CommonCfg.DesireRate, &aryRates, sizeof(NDIS_802_11_RATES));
-                DBGPRINT(RT_DEBUG_TRACE, ("Set::OID_802_11_DESIRED_RATES (%02x,%02x,%02x,%02x,%02x,%02x,%02x,%02x)\n",
-                    pAd->CommonCfg.DesireRate[0],pAd->CommonCfg.DesireRate[1],
-                    pAd->CommonCfg.DesireRate[2],pAd->CommonCfg.DesireRate[3],
-                    pAd->CommonCfg.DesireRate[4],pAd->CommonCfg.DesireRate[5],
-                    pAd->CommonCfg.DesireRate[6],pAd->CommonCfg.DesireRate[7] ));
-                // Changing DesiredRate may affect the MAX TX rate we used to TX frames out
-                MlmeUpdateTxRates(pAd, FALSE, 0);
-            }
-            break;
-        case RT_OID_802_11_PREAMBLE:
-            if (wrq->u.data.length != sizeof(RT_802_11_PREAMBLE))
-                Status  = -EINVAL;
-            else
-            {
-                Status = copy_from_user(&Preamble, wrq->u.data.pointer, wrq->u.data.length);
-                if (Preamble == Rt802_11PreambleShort)
-                {
-                    pAd->CommonCfg.TxPreamble = Preamble;
-                    MlmeSetTxPreamble(pAd, Rt802_11PreambleShort);
-                }
-                else if ((Preamble == Rt802_11PreambleLong) || (Preamble == Rt802_11PreambleAuto))
-                {
-                    // if user wants AUTO, initialize to LONG here, then change according to AP's
-                    // capability upon association.
-                    pAd->CommonCfg.TxPreamble = Preamble;
-                    MlmeSetTxPreamble(pAd, Rt802_11PreambleLong);
-                }
-                else
-                {
-                    Status = -EINVAL;
-                    break;
-                }
-                DBGPRINT(RT_DEBUG_TRACE, ("Set::RT_OID_802_11_PREAMBLE (=%d)\n", Preamble));
-            }
-            break;
-        case OID_802_11_WEP_STATUS:
-            if (wrq->u.data.length != sizeof(NDIS_802_11_WEP_STATUS))
-                Status  = -EINVAL;
-            else
-            {
-                Status = copy_from_user(&WepStatus, wrq->u.data.pointer, wrq->u.data.length);
-                // Since TKIP, AES, WEP are all supported. It should not have any invalid setting
-                if (WepStatus <= Ndis802_11Encryption3KeyAbsent)
-                {
-                    if (pAd->StaCfg.WepStatus != WepStatus)
-                    {
-                        // Config has changed
-                        pAd->bConfigChanged = TRUE;
-                    }
-                    pAd->StaCfg.WepStatus     = WepStatus;
-                    pAd->StaCfg.OrigWepStatus = WepStatus;
-                    pAd->StaCfg.PairCipher    = WepStatus;
-			pAd->StaCfg.GroupCipher   = WepStatus;
-                }
-                else
-                {
-                    Status  = -EINVAL;
-                    break;
-                }
-                DBGPRINT(RT_DEBUG_TRACE, ("Set::OID_802_11_WEP_STATUS (=%d)\n",WepStatus));
-            }
-            break;
-        case OID_802_11_AUTHENTICATION_MODE:
-            if (wrq->u.data.length != sizeof(NDIS_802_11_AUTHENTICATION_MODE))
-                Status  = -EINVAL;
-            else
-            {
-                Status = copy_from_user(&AuthMode, wrq->u.data.pointer, wrq->u.data.length);
-                if (AuthMode > Ndis802_11AuthModeMax)
-                {
-                    Status  = -EINVAL;
-                    break;
-                }
-                else
-                {
-                    if (pAd->StaCfg.AuthMode != AuthMode)
-                    {
-                        // Config has changed
-                        pAd->bConfigChanged = TRUE;
-                    }
-                    pAd->StaCfg.AuthMode = AuthMode;
-                }
-                pAd->StaCfg.PortSecured = WPA_802_1X_PORT_NOT_SECURED;
-                DBGPRINT(RT_DEBUG_TRACE, ("Set::OID_802_11_AUTHENTICATION_MODE (=%d) \n",pAd->StaCfg.AuthMode));
-            }
-            break;
-        case OID_802_11_INFRASTRUCTURE_MODE:
-            if (wrq->u.data.length != sizeof(NDIS_802_11_NETWORK_INFRASTRUCTURE))
-                Status  = -EINVAL;
-            else
-            {
-                Status = copy_from_user(&BssType, wrq->u.data.pointer, wrq->u.data.length);
-
-				if (BssType == Ndis802_11IBSS)
-					Set_NetworkType_Proc(pAd, "Adhoc");
-				else if (BssType == Ndis802_11Infrastructure)
-					Set_NetworkType_Proc(pAd, "Infra");
-                else if (BssType == Ndis802_11Monitor)
-					Set_NetworkType_Proc(pAd, "Monitor");
-                else
-                {
-                    Status  = -EINVAL;
-                    DBGPRINT(RT_DEBUG_TRACE, ("Set::OID_802_11_INFRASTRUCTURE_MODE (unknown)\n"));
-                }
-            }
-            break;
-	 case OID_802_11_REMOVE_WEP:
-            DBGPRINT(RT_DEBUG_TRACE, ("Set::OID_802_11_REMOVE_WEP\n"));
-            if (wrq->u.data.length != sizeof(NDIS_802_11_KEY_INDEX))
-            {
-				Status = -EINVAL;
-            }
-            else
-            {
-		KeyIdx = *(NDIS_802_11_KEY_INDEX *) wrq->u.data.pointer;
-
-		if (KeyIdx & 0x80000000)
-		{
-			// Should never set default bit when remove key
-			Status = -EINVAL;
-		}
-		else
-		{
-			KeyIdx = KeyIdx & 0x0fffffff;
-			if (KeyIdx >= 4){
-				Status = -EINVAL;
-			}
-			else
-			{
-						pAd->SharedKey[BSS0][KeyIdx].KeyLen = 0;
-						pAd->SharedKey[BSS0][KeyIdx].CipherAlg = CIPHER_NONE;
-						AsicRemoveSharedKeyEntry(pAd, 0, (UCHAR)KeyIdx);
-			}
-		}
-            }
-            break;
-        case RT_OID_802_11_RESET_COUNTERS:
-            NdisZeroMemory(&pAd->WlanCounters, sizeof(COUNTER_802_11));
-            NdisZeroMemory(&pAd->Counters8023, sizeof(COUNTER_802_3));
-            NdisZeroMemory(&pAd->RalinkCounters, sizeof(COUNTER_RALINK));
-            pAd->Counters8023.RxNoBuffer   = 0;
-			pAd->Counters8023.GoodReceives = 0;
-			pAd->Counters8023.RxNoBuffer   = 0;
-            DBGPRINT(RT_DEBUG_TRACE, ("Set::RT_OID_802_11_RESET_COUNTERS \n"));
-            break;
-        case OID_802_11_RTS_THRESHOLD:
-            if (wrq->u.data.length != sizeof(NDIS_802_11_RTS_THRESHOLD))
-                Status  = -EINVAL;
-            else
-            {
-                Status = copy_from_user(&RtsThresh, wrq->u.data.pointer, wrq->u.data.length);
-                if (RtsThresh > MAX_RTS_THRESHOLD)
-                    Status  = -EINVAL;
-                else
-                    pAd->CommonCfg.RtsThreshold = (USHORT)RtsThresh;
-            }
-            DBGPRINT(RT_DEBUG_TRACE, ("Set::OID_802_11_RTS_THRESHOLD (=%ld)\n",RtsThresh));
-            break;
-        case OID_802_11_FRAGMENTATION_THRESHOLD:
-            if (wrq->u.data.length != sizeof(NDIS_802_11_FRAGMENTATION_THRESHOLD))
-                Status  = -EINVAL;
-            else
-            {
-                Status = copy_from_user(&FragThresh, wrq->u.data.pointer, wrq->u.data.length);
-                pAd->CommonCfg.bUseZeroToDisableFragment = FALSE;
-                if (FragThresh > MAX_FRAG_THRESHOLD || FragThresh < MIN_FRAG_THRESHOLD)
-                {
-                    if (FragThresh == 0)
-                    {
-                        pAd->CommonCfg.FragmentThreshold = MAX_FRAG_THRESHOLD;
-                        pAd->CommonCfg.bUseZeroToDisableFragment = TRUE;
-                    }
-                    else
-                        Status  = -EINVAL;
-                }
-                else
-                    pAd->CommonCfg.FragmentThreshold = (USHORT)FragThresh;
-            }
-            DBGPRINT(RT_DEBUG_TRACE, ("Set::OID_802_11_FRAGMENTATION_THRESHOLD (=%ld) \n",FragThresh));
-            break;
-        case OID_802_11_POWER_MODE:
-            if (wrq->u.data.length != sizeof(NDIS_802_11_POWER_MODE))
-                Status = -EINVAL;
-            else
-            {
-                Status = copy_from_user(&PowerMode, wrq->u.data.pointer, wrq->u.data.length);
-                if (PowerMode == Ndis802_11PowerModeCAM)
-			Set_PSMode_Proc(pAd, "CAM");
-                else if (PowerMode == Ndis802_11PowerModeMAX_PSP)
-			Set_PSMode_Proc(pAd, "Max_PSP");
-                else if (PowerMode == Ndis802_11PowerModeFast_PSP)
-					Set_PSMode_Proc(pAd, "Fast_PSP");
-                else if (PowerMode == Ndis802_11PowerModeLegacy_PSP)
-					Set_PSMode_Proc(pAd, "Legacy_PSP");
-                else
-                    Status = -EINVAL;
-            }
-            DBGPRINT(RT_DEBUG_TRACE, ("Set::OID_802_11_POWER_MODE (=%d)\n",PowerMode));
-            break;
-         case RT_OID_802_11_TX_POWER_LEVEL_1:
-			if (wrq->u.data.length  < sizeof(ULONG))
-				Status = -EINVAL;
-			else
-			{
-				Status = copy_from_user(&PowerTemp, wrq->u.data.pointer, wrq->u.data.length);
-				if (PowerTemp > 100)
-					PowerTemp = 0xffffffff;  // AUTO
-				pAd->CommonCfg.TxPowerDefault = PowerTemp; //keep current setting.
-				pAd->CommonCfg.TxPowerPercentage = pAd->CommonCfg.TxPowerDefault;
-                DBGPRINT(RT_DEBUG_TRACE, ("Set::RT_OID_802_11_TX_POWER_LEVEL_1 (=%ld)\n", pAd->CommonCfg.TxPowerPercentage));
-			}
-	        break;
-		case OID_802_11_NETWORK_TYPE_IN_USE:
-			if (wrq->u.data.length != sizeof(NDIS_802_11_NETWORK_TYPE))
-				Status = -EINVAL;
-			else
-			{
-				Status = copy_from_user(&NetType, wrq->u.data.pointer, wrq->u.data.length);
-
-				if (NetType == Ndis802_11DS)
-					RTMPSetPhyMode(pAd, PHY_11B);
-				else if (NetType == Ndis802_11OFDM24)
-					RTMPSetPhyMode(pAd, PHY_11BG_MIXED);
-				else if (NetType == Ndis802_11OFDM5)
-					RTMPSetPhyMode(pAd, PHY_11A);
-				else
-					Status = -EINVAL;
-#ifdef DOT11_N_SUPPORT
-				if (Status == NDIS_STATUS_SUCCESS)
-					SetCommonHT(pAd);
-#endif // DOT11_N_SUPPORT //
-                DBGPRINT(RT_DEBUG_TRACE, ("Set::OID_802_11_NETWORK_TYPE_IN_USE (=%d)\n",NetType));
-		    }
-			break;
-        // For WPA PSK PMK key
-        case RT_OID_802_11_ADD_WPA:
-            pKey = kmalloc(wrq->u.data.length, MEM_ALLOC_FLAG);
-            if(pKey == NULL)
-            {
-                Status = -ENOMEM;
-                break;
-            }
-
-            Status = copy_from_user(pKey, wrq->u.data.pointer, wrq->u.data.length);
-            if (pKey->Length != wrq->u.data.length)
-            {
-                Status  = -EINVAL;
-                DBGPRINT(RT_DEBUG_TRACE, ("Set::RT_OID_802_11_ADD_WPA, Failed!!\n"));
-            }
-            else
-            {
-                if ((pAd->StaCfg.AuthMode != Ndis802_11AuthModeWPAPSK) &&
-				    (pAd->StaCfg.AuthMode != Ndis802_11AuthModeWPA2PSK) &&
-				    (pAd->StaCfg.AuthMode != Ndis802_11AuthModeWPANone) )
-                {
-                    Status = -EOPNOTSUPP;
-                    DBGPRINT(RT_DEBUG_TRACE, ("Set::RT_OID_802_11_ADD_WPA, Failed!! [AuthMode != WPAPSK/WPA2PSK/WPANONE]\n"));
-                }
-                else if ((pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPAPSK) ||
-						 (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPA2PSK) ||
-						 (pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPANone) )     // Only for WPA PSK mode
-				{
-                    NdisMoveMemory(pAd->StaCfg.PMK, &pKey->KeyMaterial, pKey->KeyLength);
-                    // Use RaConfig as PSK agent.
-                    // Start STA supplicant state machine
-                    if (pAd->StaCfg.AuthMode != Ndis802_11AuthModeWPANone)
-                        pAd->StaCfg.WpaState = SS_START;
-
-                    DBGPRINT(RT_DEBUG_TRACE, ("Set::RT_OID_802_11_ADD_WPA (id=0x%x, Len=%d-byte)\n", pKey->KeyIndex, pKey->KeyLength));
-                }
-                else
-                {
-                    pAd->StaCfg.WpaState = SS_NOTUSE;
-                    DBGPRINT(RT_DEBUG_TRACE, ("Set::RT_OID_802_11_ADD_WPA (id=0x%x, Len=%d-byte)\n", pKey->KeyIndex, pKey->KeyLength));
-                }
-            }
-            kfree(pKey);
-            break;
-        case OID_802_11_REMOVE_KEY:
-            pRemoveKey = kmalloc(wrq->u.data.length, MEM_ALLOC_FLAG);
-            if(pRemoveKey == NULL)
-            {
-                Status = -ENOMEM;
-                break;
-            }
-
-            Status = copy_from_user(pRemoveKey, wrq->u.data.pointer, wrq->u.data.length);
-            if (pRemoveKey->Length != wrq->u.data.length)
-            {
-                Status  = -EINVAL;
-                DBGPRINT(RT_DEBUG_TRACE, ("Set::OID_802_11_REMOVE_KEY, Failed!!\n"));
-            }
-            else
-            {
-                if (pAd->StaCfg.AuthMode >= Ndis802_11AuthModeWPA)
-                {
-                    RTMPWPARemoveKeyProc(pAd, pRemoveKey);
-                    DBGPRINT(RT_DEBUG_TRACE, ("Set::OID_802_11_REMOVE_KEY, Remove WPA Key!!\n"));
-                }
-                else
-                {
-                    KeyIdx = pRemoveKey->KeyIndex;
-
-                    if (KeyIdx & 0x80000000)
-                    {
-                        // Should never set default bit when remove key
-                        Status  = -EINVAL;
-                        DBGPRINT(RT_DEBUG_TRACE, ("Set::OID_802_11_REMOVE_KEY, Failed!!(Should never set default bit when remove key)\n"));
-                    }
-                    else
-                    {
-                        KeyIdx = KeyIdx & 0x0fffffff;
-                        if (KeyIdx > 3)
-                        {
-                            Status  = -EINVAL;
-                            DBGPRINT(RT_DEBUG_TRACE, ("Set::OID_802_11_REMOVE_KEY, Failed!!(KeyId[%d] out of range)\n", KeyIdx));
-                        }
-                        else
-                        {
-                            pAd->SharedKey[BSS0][KeyIdx].KeyLen = 0;
-                            pAd->SharedKey[BSS0][KeyIdx].CipherAlg = CIPHER_NONE;
-                            AsicRemoveSharedKeyEntry(pAd, 0, (UCHAR)KeyIdx);
-                            DBGPRINT(RT_DEBUG_TRACE, ("Set::OID_802_11_REMOVE_KEY (id=0x%x, Len=%d-byte)\n", pRemoveKey->KeyIndex, pRemoveKey->Length));
-                        }
-                    }
-                }
-            }
-            kfree(pRemoveKey);
-            break;
-        // New for WPA
-        case OID_802_11_ADD_KEY:
-            pKey = kmalloc(wrq->u.data.length, MEM_ALLOC_FLAG);
-            if(pKey == NULL)
-            {
-                Status = -ENOMEM;
-                break;
-            }
-            Status = copy_from_user(pKey, wrq->u.data.pointer, wrq->u.data.length);
-            if (pKey->Length != wrq->u.data.length)
-            {
-                Status  = -EINVAL;
-                DBGPRINT(RT_DEBUG_TRACE, ("Set::OID_802_11_ADD_KEY, Failed!!\n"));
-            }
-            else
-            {
-                RTMPAddKey(pAd, pKey);
-                DBGPRINT(RT_DEBUG_TRACE, ("Set::OID_802_11_ADD_KEY (id=0x%x, Len=%d-byte)\n", pKey->KeyIndex, pKey->KeyLength));
-            }
-            kfree(pKey);
-            break;
-        case OID_802_11_CONFIGURATION:
-            if (wrq->u.data.length != sizeof(NDIS_802_11_CONFIGURATION))
-                Status  = -EINVAL;
-            else
-            {
-                Status = copy_from_user(&Config, wrq->u.data.pointer, wrq->u.data.length);
-                pConfig = &Config;
-
-                if ((pConfig->BeaconPeriod >= 20) && (pConfig->BeaconPeriod <=400))
-                     pAd->CommonCfg.BeaconPeriod = (USHORT) pConfig->BeaconPeriod;
-
-                pAd->StaActive.AtimWin = (USHORT) pConfig->ATIMWindow;
-                MAP_KHZ_TO_CHANNEL_ID(pConfig->DSConfig, pAd->CommonCfg.Channel);
-                //
-				// Save the channel on MlmeAux for CntlOidRTBssidProc used.
-				//
-				pAd->MlmeAux.Channel = pAd->CommonCfg.Channel;
-
-                DBGPRINT(RT_DEBUG_TRACE, ("Set::OID_802_11_CONFIGURATION (BeacnPeriod=%ld,AtimW=%ld,Ch=%d)\n",
-                    pConfig->BeaconPeriod, pConfig->ATIMWindow, pAd->CommonCfg.Channel));
-                // Config has changed
-                pAd->bConfigChanged = TRUE;
-            }
-            break;
-#ifdef DOT11_N_SUPPORT
-		case RT_OID_802_11_SET_HT_PHYMODE:
-			if (wrq->u.data.length	!= sizeof(OID_SET_HT_PHYMODE))
-				Status = -EINVAL;
-			else
-			{
-			    POID_SET_HT_PHYMODE	pHTPhyMode = &HT_PhyMode;
-
-				Status = copy_from_user(&HT_PhyMode, wrq->u.data.pointer, wrq->u.data.length);
-				DBGPRINT(RT_DEBUG_TRACE, ("Set::pHTPhyMode	(PhyMode = %d,TransmitNo = %d, HtMode =	%d,	ExtOffset =	%d , MCS = %d, BW =	%d,	STBC = %d, SHORTGI = %d) \n",
-				pHTPhyMode->PhyMode, pHTPhyMode->TransmitNo,pHTPhyMode->HtMode,pHTPhyMode->ExtOffset,
-				pHTPhyMode->MCS, pHTPhyMode->BW, pHTPhyMode->STBC,	pHTPhyMode->SHORTGI));
-				if (pAd->CommonCfg.PhyMode	>= PHY_11ABGN_MIXED)
-					RTMPSetHT(pAd,	pHTPhyMode);
-			}
-			DBGPRINT(RT_DEBUG_TRACE, ("Set::RT_OID_802_11_SET_HT_PHYMODE(MCS=%d,BW=%d,SGI=%d,STBC=%d)\n",
-				pAd->StaCfg.HTPhyMode.field.MCS, pAd->StaCfg.HTPhyMode.field.BW, pAd->StaCfg.HTPhyMode.field.ShortGI,
-				pAd->StaCfg.HTPhyMode.field.STBC));
-			break;
-#endif // DOT11_N_SUPPORT //
-		case RT_OID_802_11_SET_APSD_SETTING:
-			if (wrq->u.data.length != sizeof(ULONG))
-				Status = -EINVAL;
-			else
-			{
-				ULONG apsd ;
-				Status = copy_from_user(&apsd, wrq->u.data.pointer,	wrq->u.data.length);
-
-				/*-------------------------------------------------------------------
-				|B31~B7	|	B6~B5	 |	 B4	 |	 B3	 |	B2	 |	B1	 |	   B0		|
-				---------------------------------------------------------------------
-				| Rsvd	| Max SP Len | AC_VO | AC_VI | AC_BK | AC_BE | APSD	Capable	|
-				---------------------------------------------------------------------*/
-				pAd->CommonCfg.bAPSDCapable = (apsd & 0x00000001) ? TRUE :	FALSE;
-				pAd->CommonCfg.bAPSDAC_BE = ((apsd	& 0x00000002) >> 1)	? TRUE : FALSE;
-				pAd->CommonCfg.bAPSDAC_BK = ((apsd	& 0x00000004) >> 2)	? TRUE : FALSE;
-				pAd->CommonCfg.bAPSDAC_VI = ((apsd	& 0x00000008) >> 3)	? TRUE : FALSE;
-				pAd->CommonCfg.bAPSDAC_VO = ((apsd	& 0x00000010) >> 4)	? TRUE : FALSE;
-				pAd->CommonCfg.MaxSPLength	= (UCHAR)((apsd	& 0x00000060) >> 5);
-
-				DBGPRINT(RT_DEBUG_TRACE, ("Set::RT_OID_802_11_SET_APSD_SETTING (apsd=0x%lx, APSDCap=%d, [BE,BK,VI,VO]=[%d/%d/%d/%d],	MaxSPLen=%d)\n", apsd, pAd->CommonCfg.bAPSDCapable,
-					pAd->CommonCfg.bAPSDAC_BE,	pAd->CommonCfg.bAPSDAC_BK,	pAd->CommonCfg.bAPSDAC_VI,	pAd->CommonCfg.bAPSDAC_VO,	pAd->CommonCfg.MaxSPLength));
-			}
-			break;
-
-		case RT_OID_802_11_SET_APSD_PSM:
-			if (wrq->u.data.length	!= sizeof(ULONG))
-				Status = -EINVAL;
-			else
-			{
-				// Driver needs	to notify AP when PSM changes
-				Status = copy_from_user(&pAd->CommonCfg.bAPSDForcePowerSave, wrq->u.data.pointer, wrq->u.data.length);
-				if (pAd->CommonCfg.bAPSDForcePowerSave	!= pAd->StaCfg.Psm)
-				{
-					RTMP_SET_PSM_BIT(pAd,	pAd->CommonCfg.bAPSDForcePowerSave);
-					RTMPSendNullFrame(pAd,	pAd->CommonCfg.TxRate,	TRUE);
-				}
-				DBGPRINT(RT_DEBUG_TRACE, ("Set::RT_OID_802_11_SET_APSD_PSM (bAPSDForcePowerSave:%d)\n",	pAd->CommonCfg.bAPSDForcePowerSave));
-			}
-			break;
-#ifdef QOS_DLS_SUPPORT
-		case RT_OID_802_11_SET_DLS:
-			if (wrq->u.data.length != sizeof(ULONG))
-				Status = -EINVAL;
-			else
-			{
-				BOOLEAN	oldvalue = pAd->CommonCfg.bDLSCapable;
-				Status = copy_from_user(&pAd->CommonCfg.bDLSCapable, wrq->u.data.pointer, wrq->u.data.length);
-				if (oldvalue &&	!pAd->CommonCfg.bDLSCapable)
-				{
-					int	i;
-					// tear	down local dls table entry
-					for	(i=0; i<MAX_NUM_OF_INIT_DLS_ENTRY; i++)
-					{
-						if (pAd->StaCfg.DLSEntry[i].Valid && (pAd->StaCfg.DLSEntry[i].Status == DLS_FINISH))
-						{
-							pAd->StaCfg.DLSEntry[i].Status	= DLS_NONE;
-							pAd->StaCfg.DLSEntry[i].Valid	= FALSE;
-							RTMPSendDLSTearDownFrame(pAd, pAd->StaCfg.DLSEntry[i].MacAddr);
-						}
-					}
-
-					// tear	down peer dls table	entry
-					for	(i=MAX_NUM_OF_INIT_DLS_ENTRY; i<MAX_NUM_OF_DLS_ENTRY; i++)
-					{
-						if (pAd->StaCfg.DLSEntry[i].Valid && (pAd->StaCfg.DLSEntry[i].Status == DLS_FINISH))
-						{
-							pAd->StaCfg.DLSEntry[i].Status	= DLS_NONE;
-							pAd->StaCfg.DLSEntry[i].Valid	= FALSE;
-							RTMPSendDLSTearDownFrame(pAd, pAd->StaCfg.DLSEntry[i].MacAddr);
-						}
-					}
-				}
-
-				DBGPRINT(RT_DEBUG_TRACE,("Set::RT_OID_802_11_SET_DLS (=%d)\n", pAd->CommonCfg.bDLSCapable));
-			}
-			break;
-
-		case RT_OID_802_11_SET_DLS_PARAM:
-			if (wrq->u.data.length	!= sizeof(RT_802_11_DLS_UI))
-				Status = -EINVAL;
-			else
-			{
-				RT_802_11_DLS	Dls;
-
-				NdisZeroMemory(&Dls, sizeof(RT_802_11_DLS));
-				RTMPMoveMemory(&Dls, wrq->u.data.pointer, sizeof(RT_802_11_DLS_UI));
-				MlmeEnqueue(pAd,
-							MLME_CNTL_STATE_MACHINE,
-							RT_OID_802_11_SET_DLS_PARAM,
-							sizeof(RT_802_11_DLS),
-							&Dls);
-				DBGPRINT(RT_DEBUG_TRACE,("Set::RT_OID_802_11_SET_DLS_PARAM \n"));
-			}
-			break;
-#endif // QOS_DLS_SUPPORT //
-		case RT_OID_802_11_SET_WMM:
-			if (wrq->u.data.length	!= sizeof(BOOLEAN))
-				Status = -EINVAL;
-			else
-			{
-				Status = copy_from_user(&pAd->CommonCfg.bWmmCapable, wrq->u.data.pointer, wrq->u.data.length);
-				DBGPRINT(RT_DEBUG_TRACE, ("Set::RT_OID_802_11_SET_WMM (=%d)	\n", pAd->CommonCfg.bWmmCapable));
-			}
-			break;
-
-		case OID_802_11_DISASSOCIATE:
-			//
-			// Set NdisRadioStateOff to	TRUE, instead of called	MlmeRadioOff.
-			// Later on, NDIS_802_11_BSSID_LIST_EX->NumberOfItems should be	0
-			// when	query OID_802_11_BSSID_LIST.
-			//
-			// TRUE:  NumberOfItems	will set to	0.
-			// FALSE: NumberOfItems	no change.
-			//
-			pAd->CommonCfg.NdisRadioStateOff =	TRUE;
-			// Set to immediately send the media disconnect	event
-			pAd->MlmeAux.CurrReqIsFromNdis	= TRUE;
-			DBGPRINT(RT_DEBUG_TRACE, ("Set::OID_802_11_DISASSOCIATE	\n"));
-
-
-			if (INFRA_ON(pAd))
-			{
-				if (pAd->Mlme.CntlMachine.CurrState !=	CNTL_IDLE)
-				{
-					RTMP_MLME_RESET_STATE_MACHINE(pAd);
-					DBGPRINT(RT_DEBUG_TRACE, ("!!! MLME	busy, reset	MLME state machine !!!\n"));
-				}
-
-				MlmeEnqueue(pAd,
-					MLME_CNTL_STATE_MACHINE,
-					OID_802_11_DISASSOCIATE,
-					0,
-					NULL);
-
-				StateMachineTouched	= TRUE;
-			}
-			break;
-
-#ifdef DOT11_N_SUPPORT
-		case RT_OID_802_11_SET_IMME_BA_CAP:
-				if (wrq->u.data.length != sizeof(OID_BACAP_STRUC))
-					Status = -EINVAL;
-				else
-				{
-					OID_BACAP_STRUC Orde ;
-					Status = copy_from_user(&Orde, wrq->u.data.pointer, wrq->u.data.length);
-					if (Orde.Policy > BA_NOTUSE)
-					{
-						Status = NDIS_STATUS_INVALID_DATA;
-					}
-					else if (Orde.Policy == BA_NOTUSE)
-					{
-						pAd->CommonCfg.BACapability.field.Policy = BA_NOTUSE;
-						pAd->CommonCfg.BACapability.field.MpduDensity = Orde.MpduDensity;
-						pAd->CommonCfg.DesiredHtPhy.MpduDensity = Orde.MpduDensity;
-						pAd->CommonCfg.DesiredHtPhy.AmsduEnable = Orde.AmsduEnable;
-						pAd->CommonCfg.DesiredHtPhy.AmsduSize= Orde.AmsduSize;
-						pAd->CommonCfg.DesiredHtPhy.MimoPs= Orde.MMPSmode;
-						pAd->CommonCfg.BACapability.field.MMPSmode = Orde.MMPSmode;
-						// UPdata to HT IE
-						pAd->CommonCfg.HtCapability.HtCapInfo.MimoPs = Orde.MMPSmode;
-						pAd->CommonCfg.HtCapability.HtCapInfo.AMsduSize = Orde.AmsduSize;
-						pAd->CommonCfg.HtCapability.HtCapParm.MpduDensity = Orde.MpduDensity;
-					}
-					else
-					{
-                        pAd->CommonCfg.BACapability.field.AutoBA = Orde.AutoBA;
-						pAd->CommonCfg.BACapability.field.Policy = IMMED_BA; // we only support immediate BA.
-						pAd->CommonCfg.BACapability.field.MpduDensity = Orde.MpduDensity;
-						pAd->CommonCfg.DesiredHtPhy.MpduDensity = Orde.MpduDensity;
-						pAd->CommonCfg.DesiredHtPhy.AmsduEnable = Orde.AmsduEnable;
-						pAd->CommonCfg.DesiredHtPhy.AmsduSize= Orde.AmsduSize;
-						pAd->CommonCfg.DesiredHtPhy.MimoPs = Orde.MMPSmode;
-						pAd->CommonCfg.BACapability.field.MMPSmode = Orde.MMPSmode;
-
-						// UPdata to HT IE
-						pAd->CommonCfg.HtCapability.HtCapInfo.MimoPs = Orde.MMPSmode;
-						pAd->CommonCfg.HtCapability.HtCapInfo.AMsduSize = Orde.AmsduSize;
-						pAd->CommonCfg.HtCapability.HtCapParm.MpduDensity = Orde.MpduDensity;
-
-						if (pAd->CommonCfg.BACapability.field.RxBAWinLimit > MAX_RX_REORDERBUF)
-							pAd->CommonCfg.BACapability.field.RxBAWinLimit = MAX_RX_REORDERBUF;
-
-					}
-
-					pAd->CommonCfg.REGBACapability.word = pAd->CommonCfg.BACapability.word;
-					DBGPRINT(RT_DEBUG_TRACE, ("Set::(Orde.AutoBA = %d) (Policy=%d)(ReBAWinLimit=%d)(TxBAWinLimit=%d)(AutoMode=%d)\n",Orde.AutoBA, pAd->CommonCfg.BACapability.field.Policy,
-						pAd->CommonCfg.BACapability.field.RxBAWinLimit,pAd->CommonCfg.BACapability.field.TxBAWinLimit, pAd->CommonCfg.BACapability.field.AutoBA));
-					DBGPRINT(RT_DEBUG_TRACE, ("Set::(MimoPs = %d)(AmsduEnable = %d) (AmsduSize=%d)(MpduDensity=%d)\n",pAd->CommonCfg.DesiredHtPhy.MimoPs, pAd->CommonCfg.DesiredHtPhy.AmsduEnable,
-						pAd->CommonCfg.DesiredHtPhy.AmsduSize, pAd->CommonCfg.DesiredHtPhy.MpduDensity));
-				}
-
-				break;
-		case RT_OID_802_11_ADD_IMME_BA:
-			DBGPRINT(RT_DEBUG_TRACE, (" Set :: RT_OID_802_11_ADD_IMME_BA \n"));
-			if (wrq->u.data.length != sizeof(OID_ADD_BA_ENTRY))
-					Status = -EINVAL;
-			else
-			{
-				UCHAR		        index;
-				OID_ADD_BA_ENTRY    BA;
-				MAC_TABLE_ENTRY     *pEntry;
-
-				Status = copy_from_user(&BA, wrq->u.data.pointer, wrq->u.data.length);
-				if (BA.TID > 15)
-				{
-					Status = NDIS_STATUS_INVALID_DATA;
-					break;
-				}
-				else
-				{
-					//BATableInsertEntry
-					//As ad-hoc mode, BA pair is not limited to only BSSID. so add via OID.
-					index = BA.TID;
-					// in ad hoc mode, when adding BA pair, we should insert this entry into MACEntry too
-					pEntry = MacTableLookup(pAd, BA.MACAddr);
-					if (!pEntry)
-					{
-						DBGPRINT(RT_DEBUG_TRACE, ("RT_OID_802_11_ADD_IMME_BA. break on no connection.----:%x:%x\n", BA.MACAddr[4], BA.MACAddr[5]));
-						break;
-					}
-					if (BA.IsRecipient == FALSE)
-					{
-					    if (pEntry->bIAmBadAtheros == TRUE)
-							pAd->CommonCfg.BACapability.field.RxBAWinLimit = 0x10;
-
-						BAOriSessionSetUp(pAd, pEntry, index, 0, 100, TRUE);
-					}
-					else
-					{
-						//BATableInsertEntry(pAd, pEntry->Aid, BA.MACAddr, 0, 0xffff, BA.TID, BA.nMSDU, BA.IsRecipient);
-					}
-
-					DBGPRINT(RT_DEBUG_TRACE, ("Set::RT_OID_802_11_ADD_IMME_BA. Rec = %d. Mac = %x:%x:%x:%x:%x:%x . \n",
-						BA.IsRecipient, BA.MACAddr[0], BA.MACAddr[1], BA.MACAddr[2], BA.MACAddr[2]
-						, BA.MACAddr[4], BA.MACAddr[5]));
-				}
-			}
-			break;
-
-		case RT_OID_802_11_TEAR_IMME_BA:
-			DBGPRINT(RT_DEBUG_TRACE, ("Set :: RT_OID_802_11_TEAR_IMME_BA \n"));
-			if (wrq->u.data.length != sizeof(OID_ADD_BA_ENTRY))
-					Status = -EINVAL;
-			else
-			{
-				POID_ADD_BA_ENTRY	pBA;
-				MAC_TABLE_ENTRY *pEntry;
-
-				pBA = kmalloc(wrq->u.data.length, MEM_ALLOC_FLAG);
-
-				if (pBA == NULL)
-				{
-					DBGPRINT(RT_DEBUG_TRACE, ("Set :: RT_OID_802_11_TEAR_IMME_BA kmalloc() can't allocate enough memory\n"));
-					Status = NDIS_STATUS_FAILURE;
-				}
-				else
-				{
-					Status = copy_from_user(pBA, wrq->u.data.pointer, wrq->u.data.length);
-					DBGPRINT(RT_DEBUG_TRACE, ("Set :: RT_OID_802_11_TEAR_IMME_BA(TID=%d, bAllTid=%d)\n", pBA->TID, pBA->bAllTid));
-
-					if (!pBA->bAllTid && (pBA->TID > NUM_OF_TID))
-					{
-						Status = NDIS_STATUS_INVALID_DATA;
-						break;
-					}
-
-					if (pBA->IsRecipient == FALSE)
-					{
-						pEntry = MacTableLookup(pAd, pBA->MACAddr);
-						DBGPRINT(RT_DEBUG_TRACE, (" pBA->IsRecipient == FALSE\n"));
-						if (pEntry)
-						{
-							DBGPRINT(RT_DEBUG_TRACE, (" pBA->pEntry\n"));
-							BAOriSessionTearDown(pAd, pEntry->Aid, pBA->TID, FALSE, TRUE);
-						}
-						else
-							DBGPRINT(RT_DEBUG_TRACE, ("Set :: Not found pEntry \n"));
-					}
-					else
-					{
-						pEntry = MacTableLookup(pAd, pBA->MACAddr);
-						if (pEntry)
-						{
-							BARecSessionTearDown( pAd, (UCHAR)pEntry->Aid, pBA->TID, TRUE);
-						}
-						else
-							DBGPRINT(RT_DEBUG_TRACE, ("Set :: Not found pEntry \n"));
-					}
-					kfree(pBA);
-				}
-            }
-            break;
-#endif // DOT11_N_SUPPORT //
-
-        // For WPA_SUPPLICANT to set static wep key
-	case OID_802_11_ADD_WEP:
-	    pWepKey = kmalloc(wrq->u.data.length, MEM_ALLOC_FLAG);
-
-	    if(pWepKey == NULL)
-            {
-                Status = -ENOMEM;
-				DBGPRINT(RT_DEBUG_TRACE, ("Set::OID_802_11_ADD_WEP, Failed!!\n"));
-                break;
-            }
-            Status = copy_from_user(pWepKey, wrq->u.data.pointer, wrq->u.data.length);
-            if (Status)
-            {
-                Status  = -EINVAL;
-                DBGPRINT(RT_DEBUG_TRACE, ("Set::OID_802_11_ADD_WEP, Failed (length mismatch)!!\n"));
-            }
-            else
-            {
-		        KeyIdx = pWepKey->KeyIndex & 0x0fffffff;
-                // KeyIdx must be 0 ~ 3
-                if (KeyIdx > 4)
-			{
-                    Status  = -EINVAL;
-                    DBGPRINT(RT_DEBUG_TRACE, ("Set::OID_802_11_ADD_WEP, Failed (KeyIdx must be smaller than 4)!!\n"));
-                }
-                else
-                {
-                    UCHAR CipherAlg = 0;
-                    PUCHAR Key;
-
-                    // set key material and key length
-                    NdisZeroMemory(pAd->SharedKey[BSS0][KeyIdx].Key, 16);
-                    pAd->SharedKey[BSS0][KeyIdx].KeyLen = (UCHAR) pWepKey->KeyLength;
-                    NdisMoveMemory(pAd->SharedKey[BSS0][KeyIdx].Key, &pWepKey->KeyMaterial, pWepKey->KeyLength);
-
-                    switch(pWepKey->KeyLength)
-                    {
-                        case 5:
-                            CipherAlg = CIPHER_WEP64;
-                            break;
-                        case 13:
-                            CipherAlg = CIPHER_WEP128;
-                            break;
-                        default:
-                            DBGPRINT(RT_DEBUG_TRACE, ("Set::OID_802_11_ADD_WEP, only support CIPHER_WEP64(len:5) & CIPHER_WEP128(len:13)!!\n"));
-                            Status = -EINVAL;
-                            break;
-                    }
-                    pAd->SharedKey[BSS0][KeyIdx].CipherAlg = CipherAlg;
-
-                    // Default key for tx (shared key)
-                    if (pWepKey->KeyIndex & 0x80000000)
-                    {
-#ifdef WPA_SUPPLICANT_SUPPORT
-                        // set key material and key length
-                        NdisZeroMemory(pAd->StaCfg.DesireSharedKey[KeyIdx].Key, 16);
-                        pAd->StaCfg.DesireSharedKey[KeyIdx].KeyLen = (UCHAR) pWepKey->KeyLength;
-                        NdisMoveMemory(pAd->StaCfg.DesireSharedKey[KeyIdx].Key, &pWepKey->KeyMaterial, pWepKey->KeyLength);
-                        pAd->StaCfg.DesireSharedKeyId = KeyIdx;
-                        pAd->StaCfg.DesireSharedKey[KeyIdx].CipherAlg = CipherAlg;
-#endif // WPA_SUPPLICANT_SUPPORT //
-                        pAd->StaCfg.DefaultKeyId = (UCHAR) KeyIdx;
-                    }
-
-#ifdef WPA_SUPPLICANT_SUPPORT
-					if ((pAd->StaCfg.WpaSupplicantUP != WPA_SUPPLICANT_DISABLE) &&
-						(pAd->StaCfg.AuthMode >= Ndis802_11AuthModeWPA))
-					{
-						Key = pWepKey->KeyMaterial;
-
-						// Set Group key material to Asic
-					AsicAddSharedKeyEntry(pAd, BSS0, KeyIdx, CipherAlg, Key, NULL, NULL);
-
-						// Update WCID attribute table and IVEIV table for this group key table
-						RTMPAddWcidAttributeEntry(pAd, BSS0, KeyIdx, CipherAlg, NULL);
-
-						STA_PORT_SECURED(pAd);
-
-					// Indicate Connected for GUI
-					pAd->IndicateMediaState = NdisMediaStateConnected;
-					}
-                    else if (pAd->StaCfg.PortSecured == WPA_802_1X_PORT_SECURED)
-#endif // WPA_SUPPLICANT_SUPPORT
-                    {
-                        Key = pAd->SharedKey[BSS0][KeyIdx].Key;
-
-                        // Set key material and cipherAlg to Asic
-					AsicAddSharedKeyEntry(pAd, BSS0, KeyIdx, CipherAlg, Key, NULL, NULL);
-
-                        if (pWepKey->KeyIndex & 0x80000000)
-                        {
-                            PMAC_TABLE_ENTRY pEntry = &pAd->MacTab.Content[BSSID_WCID];
-                            // Assign group key info
-						RTMPAddWcidAttributeEntry(pAd, BSS0, KeyIdx, CipherAlg, NULL);
-						// Assign pairwise key info
-						RTMPAddWcidAttributeEntry(pAd, BSS0, KeyIdx, CipherAlg, pEntry);
-                        }
-                    }
-					DBGPRINT(RT_DEBUG_TRACE, ("Set::OID_802_11_ADD_WEP (id=0x%x, Len=%d-byte), %s\n", pWepKey->KeyIndex, pWepKey->KeyLength, (pAd->StaCfg.PortSecured == WPA_802_1X_PORT_SECURED) ? "Port Secured":"Port NOT Secured"));
-				}
-            }
-            kfree(pWepKey);
-            break;
-#ifdef WPA_SUPPLICANT_SUPPORT
-	    case OID_SET_COUNTERMEASURES:
-            if (wrq->u.data.length != sizeof(int))
-                Status  = -EINVAL;
-            else
-            {
-                int enabled = 0;
-                Status = copy_from_user(&enabled, wrq->u.data.pointer, wrq->u.data.length);
-                if (enabled == 1)
-                    pAd->StaCfg.bBlockAssoc = TRUE;
-                else
-                    // WPA MIC error should block association attempt for 60 seconds
-                    pAd->StaCfg.bBlockAssoc = FALSE;
-                DBGPRINT(RT_DEBUG_TRACE, ("Set::OID_SET_COUNTERMEASURES bBlockAssoc=%s\n", pAd->StaCfg.bBlockAssoc ? "TRUE":"FALSE"));
-            }
-	        break;
-        case RT_OID_WPA_SUPPLICANT_SUPPORT:
-			if (wrq->u.data.length != sizeof(UCHAR))
-                Status  = -EINVAL;
-            else
-            {
-                Status = copy_from_user(&wpa_supplicant_enable, wrq->u.data.pointer, wrq->u.data.length);
-			pAd->StaCfg.WpaSupplicantUP = wpa_supplicant_enable;
-			DBGPRINT(RT_DEBUG_TRACE, ("Set::RT_OID_WPA_SUPPLICANT_SUPPORT (=%d)\n", pAd->StaCfg.WpaSupplicantUP));
-			}
-            break;
-        case OID_802_11_DEAUTHENTICATION:
-            if (wrq->u.data.length != sizeof(MLME_DEAUTH_REQ_STRUCT))
-                Status  = -EINVAL;
-            else
-            {
-                MLME_DEAUTH_REQ_STRUCT      *pInfo;
-		MLME_QUEUE_ELEM *MsgElem = (MLME_QUEUE_ELEM *) kmalloc(sizeof(MLME_QUEUE_ELEM), MEM_ALLOC_FLAG);
-                if (MsgElem == NULL)
-                {
-			DBGPRINT(RT_DEBUG_ERROR, ("%s():alloc memory failed!\n", __FUNCTION__));
-                        return -EINVAL;
-                }
-
-                pInfo = (MLME_DEAUTH_REQ_STRUCT *) MsgElem->Msg;
-                Status = copy_from_user(pInfo, wrq->u.data.pointer, wrq->u.data.length);
-                MlmeDeauthReqAction(pAd, MsgElem);
-				kfree(MsgElem);
-
-                if (INFRA_ON(pAd))
-                {
-                    LinkDown(pAd, FALSE);
-                    pAd->Mlme.AssocMachine.CurrState = ASSOC_IDLE;
-                }
-                DBGPRINT(RT_DEBUG_TRACE, ("Set::OID_802_11_DEAUTHENTICATION (Reason=%d)\n", pInfo->Reason));
-            }
-            break;
-        case OID_802_11_DROP_UNENCRYPTED:
-            if (wrq->u.data.length != sizeof(int))
-                Status  = -EINVAL;
-            else
-            {
-                int enabled = 0;
-                Status = copy_from_user(&enabled, wrq->u.data.pointer, wrq->u.data.length);
-                if (enabled == 1)
-                    pAd->StaCfg.PortSecured = WPA_802_1X_PORT_NOT_SECURED;
-                else
-                    pAd->StaCfg.PortSecured = WPA_802_1X_PORT_SECURED;
-				NdisAcquireSpinLock(&pAd->MacTabLock);
-				pAd->MacTab.Content[BSSID_WCID].PortSecured = pAd->StaCfg.PortSecured;
-				NdisReleaseSpinLock(&pAd->MacTabLock);
-                DBGPRINT(RT_DEBUG_TRACE, ("Set::OID_802_11_DROP_UNENCRYPTED (=%d)\n", enabled));
-            }
-            break;
-        case OID_802_11_SET_IEEE8021X:
-            if (wrq->u.data.length != sizeof(BOOLEAN))
-                Status  = -EINVAL;
-            else
-            {
-                Status = copy_from_user(&IEEE8021xState, wrq->u.data.pointer, wrq->u.data.length);
-		        pAd->StaCfg.IEEE8021X = IEEE8021xState;
-                DBGPRINT(RT_DEBUG_TRACE, ("Set::OID_802_11_SET_IEEE8021X (=%d)\n", IEEE8021xState));
-            }
-            break;
-        case OID_802_11_SET_IEEE8021X_REQUIRE_KEY:
-			if (wrq->u.data.length != sizeof(BOOLEAN))
-				 Status  = -EINVAL;
-            else
-            {
-                Status = copy_from_user(&IEEE8021x_required_keys, wrq->u.data.pointer, wrq->u.data.length);
-				pAd->StaCfg.IEEE8021x_required_keys = IEEE8021x_required_keys;
-				DBGPRINT(RT_DEBUG_TRACE, ("Set::OID_802_11_SET_IEEE8021X_REQUIRE_KEY (%d)\n", IEEE8021x_required_keys));
-			}
-			break;
-        case OID_802_11_PMKID:
-	        pPmkId = kmalloc(wrq->u.data.length, MEM_ALLOC_FLAG);
-
-	        if(pPmkId == NULL) {
-                Status = -ENOMEM;
-                break;
-            }
-            Status = copy_from_user(pPmkId, wrq->u.data.pointer, wrq->u.data.length);
-
-	        // check the PMKID information
-	        if (pPmkId->BSSIDInfoCount == 0)
-                NdisZeroMemory(pAd->StaCfg.SavedPMK, sizeof(BSSID_INFO)*PMKID_NO);
-	        else
-	        {
-		        PBSSID_INFO	pBssIdInfo;
-		        UINT		BssIdx;
-		        UINT		CachedIdx;
-
-		        for (BssIdx = 0; BssIdx < pPmkId->BSSIDInfoCount; BssIdx++)
-		        {
-			        // point to the indexed BSSID_INFO structure
-			        pBssIdInfo = (PBSSID_INFO) ((PUCHAR) pPmkId + 2 * sizeof(UINT) + BssIdx * sizeof(BSSID_INFO));
-			        // Find the entry in the saved data base.
-			        for (CachedIdx = 0; CachedIdx < pAd->StaCfg.SavedPMKNum; CachedIdx++)
-			        {
-				        // compare the BSSID
-				        if (NdisEqualMemory(pBssIdInfo->BSSID, pAd->StaCfg.SavedPMK[CachedIdx].BSSID, sizeof(NDIS_802_11_MAC_ADDRESS)))
-					        break;
-			        }
-
-			        // Found, replace it
-			        if (CachedIdx < PMKID_NO)
-			        {
-				        DBGPRINT(RT_DEBUG_OFF, ("Update OID_802_11_PMKID, idx = %d\n", CachedIdx));
-				        NdisMoveMemory(&pAd->StaCfg.SavedPMK[CachedIdx], pBssIdInfo, sizeof(BSSID_INFO));
-				        pAd->StaCfg.SavedPMKNum++;
-			        }
-			        // Not found, replace the last one
-			        else
-			        {
-				        // Randomly replace one
-				        CachedIdx = (pBssIdInfo->BSSID[5] % PMKID_NO);
-				        DBGPRINT(RT_DEBUG_OFF, ("Update OID_802_11_PMKID, idx = %d\n", CachedIdx));
-				        NdisMoveMemory(&pAd->StaCfg.SavedPMK[CachedIdx], pBssIdInfo, sizeof(BSSID_INFO));
-			        }
-		        }
-			}
-			if(pPmkId)
-				kfree(pPmkId);
-	        break;
-#endif // WPA_SUPPLICANT_SUPPORT //
-
-
-
-#ifdef SNMP_SUPPORT
-		case OID_802_11_SHORTRETRYLIMIT:
-			if (wrq->u.data.length != sizeof(ULONG))
-				Status = -EINVAL;
-			else
-			{
-				Status = copy_from_user(&ShortRetryLimit, wrq->u.data.pointer, wrq->u.data.length);
-				RTMP_IO_READ32(pAd, TX_RTY_CFG, &tx_rty_cfg.word);
-				tx_rty_cfg.field.ShortRtyLimit = ShortRetryLimit;
-				RTMP_IO_WRITE32(pAd, TX_RTY_CFG, tx_rty_cfg.word);
-				DBGPRINT(RT_DEBUG_TRACE, ("Set::OID_802_11_SHORTRETRYLIMIT (tx_rty_cfg.field.ShortRetryLimit=%d, ShortRetryLimit=%ld)\n", tx_rty_cfg.field.ShortRtyLimit, ShortRetryLimit));
-			}
-			break;
-
-		case OID_802_11_LONGRETRYLIMIT:
-			DBGPRINT(RT_DEBUG_TRACE, ("Set::OID_802_11_LONGRETRYLIMIT \n"));
-			if (wrq->u.data.length != sizeof(ULONG))
-				Status = -EINVAL;
-			else
-			{
-				Status = copy_from_user(&LongRetryLimit, wrq->u.data.pointer, wrq->u.data.length);
-				RTMP_IO_READ32(pAd, TX_RTY_CFG, &tx_rty_cfg.word);
-				tx_rty_cfg.field.LongRtyLimit = LongRetryLimit;
-				RTMP_IO_WRITE32(pAd, TX_RTY_CFG, tx_rty_cfg.word);
-				DBGPRINT(RT_DEBUG_TRACE, ("Set::OID_802_11_LONGRETRYLIMIT (tx_rty_cfg.field.LongRetryLimit= %d,LongRetryLimit=%ld)\n", tx_rty_cfg.field.LongRtyLimit, LongRetryLimit));
-			}
-			break;
-
-		case OID_802_11_WEPDEFAULTKEYVALUE:
-			DBGPRINT(RT_DEBUG_TRACE, ("Set::OID_802_11_WEPDEFAULTKEYVALUE\n"));
-			pKey = kmalloc(wrq->u.data.length, GFP_KERNEL);
-			Status = copy_from_user(pKey, wrq->u.data.pointer, wrq->u.data.length);
-			//pKey = &WepKey;
-
-			if ( pKey->Length != wrq->u.data.length)
-			{
-				Status = -EINVAL;
-				DBGPRINT(RT_DEBUG_TRACE, ("Set::OID_802_11_WEPDEFAULTKEYVALUE, Failed!!\n"));
-			}
-			KeyIdx = pKey->KeyIndex & 0x0fffffff;
-			DBGPRINT(RT_DEBUG_TRACE,("pKey->KeyIndex =%d, pKey->KeyLength=%d\n", pKey->KeyIndex, pKey->KeyLength));
-
-			// it is a shared key
-			if (KeyIdx > 4)
-				Status = -EINVAL;
-			else
-			{
-				pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].KeyLen = (UCHAR) pKey->KeyLength;
-				NdisMoveMemory(&pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].Key, &pKey->KeyMaterial, pKey->KeyLength);
-				if (pKey->KeyIndex & 0x80000000)
-				{
-					// Default key for tx (shared key)
-					pAd->StaCfg.DefaultKeyId = (UCHAR) KeyIdx;
-				}
-				//RestartAPIsRequired = TRUE;
-			}
-			break;
-
-
-		case OID_802_11_WEPDEFAULTKEYID:
-			DBGPRINT(RT_DEBUG_TRACE, ("Set::OID_802_11_WEPDEFAULTKEYID \n"));
-
-			if (wrq->u.data.length != sizeof(UCHAR))
-				Status = -EINVAL;
-			else
-				Status = copy_from_user(&pAd->StaCfg.DefaultKeyId, wrq->u.data.pointer, wrq->u.data.length);
-
-			break;
-
-
-		case OID_802_11_CURRENTCHANNEL:
-			DBGPRINT(RT_DEBUG_TRACE, ("Set::OID_802_11_CURRENTCHANNEL \n"));
-			if (wrq->u.data.length != sizeof(UCHAR))
-				Status = -EINVAL;
-			else
-			{
-				Status = copy_from_user(&ctmp, wrq->u.data.pointer, wrq->u.data.length);
-				sprintf((PSTRING)&ctmp,"%d", ctmp);
-				Set_Channel_Proc(pAd, (PSTRING)&ctmp);
-			}
-			break;
-#endif
-
-
-
-		case RT_OID_802_11_SET_PSPXLINK_MODE:
-			if (wrq->u.data.length != sizeof(BOOLEAN))
-                Status  = -EINVAL;
-            else
-            {
-                Status = copy_from_user(&pAd->CommonCfg.PSPXlink, wrq->u.data.pointer, wrq->u.data.length);
-				/*if (pAd->CommonCfg.PSPXlink)
-					RX_FILTER_SET_FLAG(pAd, fRX_FILTER_ACCEPT_PROMISCUOUS)*/
-				DBGPRINT(RT_DEBUG_TRACE,("Set::RT_OID_802_11_SET_PSPXLINK_MODE(=%d) \n", pAd->CommonCfg.PSPXlink));
-            }
-			break;
-
-
-        default:
-            DBGPRINT(RT_DEBUG_TRACE, ("Set::unknown IOCTL's subcmd = 0x%08x\n", cmd));
-            Status = -EOPNOTSUPP;
-            break;
-    }
-
-
-    return Status;
-}
-
-INT RTMPQueryInformation(
-    IN  PRTMP_ADAPTER pAd,
-    IN  OUT struct ifreq    *rq,
-    IN  INT                 cmd)
-{
-    struct iwreq                        *wrq = (struct iwreq *) rq;
-    NDIS_802_11_BSSID_LIST_EX           *pBssidList = NULL;
-    PNDIS_WLAN_BSSID_EX                 pBss;
-    NDIS_802_11_SSID                    Ssid;
-    NDIS_802_11_CONFIGURATION           *pConfiguration = NULL;
-    RT_802_11_LINK_STATUS               *pLinkStatus = NULL;
-    RT_802_11_STA_CONFIG                *pStaConfig = NULL;
-    NDIS_802_11_STATISTICS              *pStatistics = NULL;
-    NDIS_802_11_RTS_THRESHOLD           RtsThresh;
-    NDIS_802_11_FRAGMENTATION_THRESHOLD FragThresh;
-    NDIS_802_11_POWER_MODE              PowerMode;
-    NDIS_802_11_NETWORK_INFRASTRUCTURE  BssType;
-    RT_802_11_PREAMBLE                  PreamType;
-    NDIS_802_11_AUTHENTICATION_MODE     AuthMode;
-    NDIS_802_11_WEP_STATUS              WepStatus;
-    NDIS_MEDIA_STATE                    MediaState;
-    ULONG                               BssBufSize, ulInfo=0, NetworkTypeList[4], apsd = 0;
-    USHORT                              BssLen = 0;
-    PUCHAR                              pBuf = NULL, pPtr;
-    INT                                 Status = NDIS_STATUS_SUCCESS;
-    UINT                                we_version_compiled;
-    UCHAR                               i, Padding = 0;
-    BOOLEAN                             RadioState;
-	STRING								driverVersion[8];
-    OID_SET_HT_PHYMODE			        *pHTPhyMode = NULL;
-
-
-#ifdef SNMP_SUPPORT
-	//for snmp, kathy
-	DefaultKeyIdxValue			*pKeyIdxValue;
-	INT							valueLen;
-	TX_RTY_CFG_STRUC			tx_rty_cfg;
-	ULONG						ShortRetryLimit, LongRetryLimit;
-	UCHAR						tmp[64];
-#endif //SNMP
-
-    switch(cmd)
-    {
-        case RT_OID_DEVICE_NAME:
-            wrq->u.data.length = sizeof(pAd->nickname);
-            Status = copy_to_user(wrq->u.data.pointer, pAd->nickname, wrq->u.data.length);
-            break;
-        case RT_OID_VERSION_INFO:
-			DBGPRINT(RT_DEBUG_TRACE, ("Query::RT_OID_VERSION_INFO \n"));
-			wrq->u.data.length = 8*sizeof(CHAR);
-			sprintf(&driverVersion[0], "%s", STA_DRIVER_VERSION);
-			driverVersion[7] = '\0';
-			if (copy_to_user(wrq->u.data.pointer, &driverVersion[0], wrq->u.data.length))
-            {
-				Status = -EFAULT;
-            }
-            break;
-
-        case OID_802_11_BSSID_LIST:
-            if (RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_BSS_SCAN_IN_PROGRESS))
-            {
-		/*
-		 * Still scanning, indicate the caller should try again.
-		 */
-		DBGPRINT(RT_DEBUG_TRACE, ("Query::OID_802_11_BSSID_LIST (Still scanning)\n"));
-				return -EAGAIN;
-            }
-            DBGPRINT(RT_DEBUG_TRACE, ("Query::OID_802_11_BSSID_LIST (%d BSS returned)\n",pAd->ScanTab.BssNr));
-			pAd->StaCfg.bScanReqIsFromWebUI = FALSE;
-            // Claculate total buffer size required
-            BssBufSize = sizeof(ULONG);
-
-            for (i = 0; i < pAd->ScanTab.BssNr; i++)
-            {
-                // Align pointer to 4 bytes boundary.
-                //Padding = 4 - (pAdapter->ScanTab.BssEntry[i].VarIELen & 0x0003);
-                //if (Padding == 4)
-                //    Padding = 0;
-                BssBufSize += (sizeof(NDIS_WLAN_BSSID_EX) - 1 + sizeof(NDIS_802_11_FIXED_IEs) + pAd->ScanTab.BssEntry[i].VarIELen + Padding);
-            }
-
-            // For safety issue, we add 256 bytes just in case
-            BssBufSize += 256;
-            // Allocate the same size as passed from higher layer
-            pBuf = kmalloc(BssBufSize, MEM_ALLOC_FLAG);
-            if(pBuf == NULL)
-            {
-                Status = -ENOMEM;
-                break;
-            }
-            // Init 802_11_BSSID_LIST_EX structure
-            NdisZeroMemory(pBuf, BssBufSize);
-            pBssidList = (PNDIS_802_11_BSSID_LIST_EX) pBuf;
-            pBssidList->NumberOfItems = pAd->ScanTab.BssNr;
-
-            // Calculate total buffer length
-            BssLen = 4; // Consist of NumberOfItems
-            // Point to start of NDIS_WLAN_BSSID_EX
-            // pPtr = pBuf + sizeof(ULONG);
-            pPtr = (PUCHAR) &pBssidList->Bssid[0];
-            for (i = 0; i < pAd->ScanTab.BssNr; i++)
-            {
-                pBss = (PNDIS_WLAN_BSSID_EX) pPtr;
-                NdisMoveMemory(&pBss->MacAddress, &pAd->ScanTab.BssEntry[i].Bssid, MAC_ADDR_LEN);
-                if ((pAd->ScanTab.BssEntry[i].Hidden == 1) && (pAd->StaCfg.bShowHiddenSSID == FALSE))
-                {
-                    //
-					// We must return this SSID during 4way handshaking, otherwise Aegis will failed to parse WPA infomation
-					// and then failed to send EAPOl farame.
-					//
-					if ((pAd->StaCfg.AuthMode >= Ndis802_11AuthModeWPA) && (pAd->StaCfg.PortSecured != WPA_802_1X_PORT_SECURED))
-					{
-						pBss->Ssid.SsidLength = pAd->ScanTab.BssEntry[i].SsidLen;
-						NdisMoveMemory(pBss->Ssid.Ssid, pAd->ScanTab.BssEntry[i].Ssid, pAd->ScanTab.BssEntry[i].SsidLen);
-					}
-					else
-			pBss->Ssid.SsidLength = 0;
-                }
-                else
-                {
-                    pBss->Ssid.SsidLength = pAd->ScanTab.BssEntry[i].SsidLen;
-                    NdisMoveMemory(pBss->Ssid.Ssid, pAd->ScanTab.BssEntry[i].Ssid, pAd->ScanTab.BssEntry[i].SsidLen);
-                }
-                pBss->Privacy = pAd->ScanTab.BssEntry[i].Privacy;
-                pBss->Rssi = pAd->ScanTab.BssEntry[i].Rssi - pAd->BbpRssiToDbmDelta;
-                pBss->NetworkTypeInUse = NetworkTypeInUseSanity(&pAd->ScanTab.BssEntry[i]);
-                pBss->Configuration.Length = sizeof(NDIS_802_11_CONFIGURATION);
-                pBss->Configuration.BeaconPeriod = pAd->ScanTab.BssEntry[i].BeaconPeriod;
-                pBss->Configuration.ATIMWindow = pAd->ScanTab.BssEntry[i].AtimWin;
-
-                MAP_CHANNEL_ID_TO_KHZ(pAd->ScanTab.BssEntry[i].Channel, pBss->Configuration.DSConfig);
-
-                if (pAd->ScanTab.BssEntry[i].BssType == BSS_INFRA)
-                    pBss->InfrastructureMode = Ndis802_11Infrastructure;
-                else
-                    pBss->InfrastructureMode = Ndis802_11IBSS;
-
-                NdisMoveMemory(pBss->SupportedRates, pAd->ScanTab.BssEntry[i].SupRate, pAd->ScanTab.BssEntry[i].SupRateLen);
-                NdisMoveMemory(pBss->SupportedRates + pAd->ScanTab.BssEntry[i].SupRateLen,
-                               pAd->ScanTab.BssEntry[i].ExtRate,
-                               pAd->ScanTab.BssEntry[i].ExtRateLen);
-
-                if (pAd->ScanTab.BssEntry[i].VarIELen == 0)
-                {
-                    pBss->IELength = sizeof(NDIS_802_11_FIXED_IEs);
-                    NdisMoveMemory(pBss->IEs, &pAd->ScanTab.BssEntry[i].FixIEs, sizeof(NDIS_802_11_FIXED_IEs));
-                    pPtr = pPtr + sizeof(NDIS_WLAN_BSSID_EX) - 1 + sizeof(NDIS_802_11_FIXED_IEs);
-                }
-                else
-                {
-                    pBss->IELength = (ULONG)(sizeof(NDIS_802_11_FIXED_IEs) + pAd->ScanTab.BssEntry[i].VarIELen);
-                    pPtr = pPtr + sizeof(NDIS_WLAN_BSSID_EX) - 1 + sizeof(NDIS_802_11_FIXED_IEs);
-                    NdisMoveMemory(pBss->IEs, &pAd->ScanTab.BssEntry[i].FixIEs, sizeof(NDIS_802_11_FIXED_IEs));
-                    NdisMoveMemory(pBss->IEs + sizeof(NDIS_802_11_FIXED_IEs), pAd->ScanTab.BssEntry[i].VarIEs, pAd->ScanTab.BssEntry[i].VarIELen);
-                    pPtr += pAd->ScanTab.BssEntry[i].VarIELen;
-                }
-                pBss->Length = (ULONG)(sizeof(NDIS_WLAN_BSSID_EX) - 1 + sizeof(NDIS_802_11_FIXED_IEs) + pAd->ScanTab.BssEntry[i].VarIELen + Padding);
-
-#if WIRELESS_EXT < 17
-                if ((BssLen + pBss->Length) < wrq->u.data.length)
-                BssLen += pBss->Length;
-                else
-                {
-                    pBssidList->NumberOfItems = i;
-                    break;
-                }
-#else
-                BssLen += pBss->Length;
-#endif
-            }
-
-#if WIRELESS_EXT < 17
-            wrq->u.data.length = BssLen;
-#else
-            if (BssLen > wrq->u.data.length)
-            {
-                kfree(pBssidList);
-                return -E2BIG;
-            }
-            else
-                wrq->u.data.length = BssLen;
-#endif
-            Status = copy_to_user(wrq->u.data.pointer, pBssidList, BssLen);
-            kfree(pBssidList);
-            break;
-        case OID_802_3_CURRENT_ADDRESS:
-            wrq->u.data.length = MAC_ADDR_LEN;
-            Status = copy_to_user(wrq->u.data.pointer, &pAd->CurrentAddress, wrq->u.data.length);
-            break;
-        case OID_GEN_MEDIA_CONNECT_STATUS:
-            if (pAd->IndicateMediaState == NdisMediaStateConnected)
-                MediaState = NdisMediaStateConnected;
-            else
-                MediaState = NdisMediaStateDisconnected;
-
-            wrq->u.data.length = sizeof(NDIS_MEDIA_STATE);
-            Status = copy_to_user(wrq->u.data.pointer, &MediaState, wrq->u.data.length);
-            break;
-        case OID_802_11_BSSID:
-            if (INFRA_ON(pAd) || ADHOC_ON(pAd))
-            {
-                Status = copy_to_user(wrq->u.data.pointer, &pAd->CommonCfg.Bssid, sizeof(NDIS_802_11_MAC_ADDRESS));
-
-            }
-            else
-            {
-                DBGPRINT(RT_DEBUG_TRACE, ("Query::OID_802_11_BSSID(=EMPTY)\n"));
-                Status = -ENOTCONN;
-            }
-            break;
-        case OID_802_11_SSID:
-			NdisZeroMemory(&Ssid, sizeof(NDIS_802_11_SSID));
-			NdisZeroMemory(Ssid.Ssid, MAX_LEN_OF_SSID);
-            Ssid.SsidLength = pAd->CommonCfg.SsidLen;
-			memcpy(Ssid.Ssid, pAd->CommonCfg.Ssid,	Ssid.SsidLength);
-            wrq->u.data.length = sizeof(NDIS_802_11_SSID);
-            Status = copy_to_user(wrq->u.data.pointer, &Ssid, wrq->u.data.length);
-            DBGPRINT(RT_DEBUG_TRACE, ("Query::OID_802_11_SSID (Len=%d, ssid=%s)\n", Ssid.SsidLength,Ssid.Ssid));
-            break;
-        case RT_OID_802_11_QUERY_LINK_STATUS:
-            pLinkStatus = (RT_802_11_LINK_STATUS *) kmalloc(sizeof(RT_802_11_LINK_STATUS), MEM_ALLOC_FLAG);
-            if (pLinkStatus)
-            {
-                pLinkStatus->CurrTxRate = RateIdTo500Kbps[pAd->CommonCfg.TxRate];   // unit : 500 kbps
-                pLinkStatus->ChannelQuality = pAd->Mlme.ChannelQuality;
-                pLinkStatus->RxByteCount = pAd->RalinkCounters.ReceivedByteCount;
-                pLinkStatus->TxByteCount = pAd->RalinkCounters.TransmittedByteCount;
-			pLinkStatus->CentralChannel = pAd->CommonCfg.CentralChannel;
-                wrq->u.data.length = sizeof(RT_802_11_LINK_STATUS);
-                Status = copy_to_user(wrq->u.data.pointer, pLinkStatus, wrq->u.data.length);
-                kfree(pLinkStatus);
-                DBGPRINT(RT_DEBUG_TRACE, ("Query::RT_OID_802_11_QUERY_LINK_STATUS\n"));
-            }
-            else
-            {
-                DBGPRINT(RT_DEBUG_TRACE, ("Query::RT_OID_802_11_QUERY_LINK_STATUS(kmalloc failed)\n"));
-                Status = -EFAULT;
-            }
-            break;
-        case OID_802_11_CONFIGURATION:
-            pConfiguration = (NDIS_802_11_CONFIGURATION *) kmalloc(sizeof(NDIS_802_11_CONFIGURATION), MEM_ALLOC_FLAG);
-            if (pConfiguration)
-            {
-                pConfiguration->Length = sizeof(NDIS_802_11_CONFIGURATION);
-                pConfiguration->BeaconPeriod = pAd->CommonCfg.BeaconPeriod;
-                pConfiguration->ATIMWindow = pAd->StaActive.AtimWin;
-                MAP_CHANNEL_ID_TO_KHZ(pAd->CommonCfg.Channel, pConfiguration->DSConfig);
-                wrq->u.data.length = sizeof(NDIS_802_11_CONFIGURATION);
-                Status = copy_to_user(wrq->u.data.pointer, pConfiguration, wrq->u.data.length);
-                DBGPRINT(RT_DEBUG_TRACE, ("Query::OID_802_11_CONFIGURATION(BeaconPeriod=%ld,AtimW=%ld,Channel=%d) \n",
-                                        pConfiguration->BeaconPeriod, pConfiguration->ATIMWindow, pAd->CommonCfg.Channel));
-				kfree(pConfiguration);
-            }
-            else
-            {
-                DBGPRINT(RT_DEBUG_TRACE, ("Query::OID_802_11_CONFIGURATION(kmalloc failed)\n"));
-                Status = -EFAULT;
-            }
-            break;
-		case RT_OID_802_11_SNR_0:
-			if ((pAd->StaCfg.LastSNR0 > 0))
-			{
-				ulInfo = ((0xeb	- pAd->StaCfg.LastSNR0) * 3) /	16 ;
-				wrq->u.data.length = sizeof(ulInfo);
-				Status = copy_to_user(wrq->u.data.pointer, &ulInfo,	wrq->u.data.length);
-				DBGPRINT(RT_DEBUG_TRACE, ("Query::RT_OID_802_11_SNR_0(0x=%lx)\n", ulInfo));
-			}
-            else
-			    Status = -EFAULT;
-			break;
-		case RT_OID_802_11_SNR_1:
-			if ((pAd->Antenna.field.RxPath	> 1) &&
-                (pAd->StaCfg.LastSNR1 > 0))
-			{
-				ulInfo = ((0xeb	- pAd->StaCfg.LastSNR1) * 3) /	16 ;
-				wrq->u.data.length = sizeof(ulInfo);
-				Status = copy_to_user(wrq->u.data.pointer, &ulInfo,	wrq->u.data.length);
-				DBGPRINT(RT_DEBUG_TRACE,("Query::RT_OID_802_11_SNR_1(0x=%lx)\n",ulInfo));
-			}
-			else
-				Status = -EFAULT;
-            DBGPRINT(RT_DEBUG_TRACE,("Query::RT_OID_802_11_SNR_1(pAd->StaCfg.LastSNR1=%d)\n",pAd->StaCfg.LastSNR1));
-			break;
-        case OID_802_11_RSSI_TRIGGER:
-            ulInfo = pAd->StaCfg.RssiSample.LastRssi0 - pAd->BbpRssiToDbmDelta;
-            wrq->u.data.length = sizeof(ulInfo);
-            Status = copy_to_user(wrq->u.data.pointer, &ulInfo, wrq->u.data.length);
-            DBGPRINT(RT_DEBUG_TRACE, ("Query::OID_802_11_RSSI_TRIGGER(=%ld)\n", ulInfo));
-            break;
-		case OID_802_11_RSSI:
-        case RT_OID_802_11_RSSI:
-			ulInfo = pAd->StaCfg.RssiSample.LastRssi0;
-			wrq->u.data.length = sizeof(ulInfo);
-			Status = copy_to_user(wrq->u.data.pointer, &ulInfo,	wrq->u.data.length);
-			break;
-		case RT_OID_802_11_RSSI_1:
-            ulInfo = pAd->StaCfg.RssiSample.LastRssi1;
-			wrq->u.data.length = sizeof(ulInfo);
-			Status = copy_to_user(wrq->u.data.pointer, &ulInfo,	wrq->u.data.length);
-			break;
-        case RT_OID_802_11_RSSI_2:
-            ulInfo = pAd->StaCfg.RssiSample.LastRssi2;
-			wrq->u.data.length = sizeof(ulInfo);
-			Status = copy_to_user(wrq->u.data.pointer, &ulInfo,	wrq->u.data.length);
-			break;
-        case OID_802_11_STATISTICS:
-            pStatistics = (NDIS_802_11_STATISTICS *) kmalloc(sizeof(NDIS_802_11_STATISTICS), MEM_ALLOC_FLAG);
-            if (pStatistics)
-            {
-                DBGPRINT(RT_DEBUG_TRACE, ("Query::OID_802_11_STATISTICS \n"));
-                // add the most up-to-date h/w raw counters into software counters
-			    NICUpdateRawCounters(pAd);
-
-                // Sanity check for calculation of sucessful count
-                if (pAd->WlanCounters.TransmittedFragmentCount.QuadPart < pAd->WlanCounters.RetryCount.QuadPart)
-                    pAd->WlanCounters.TransmittedFragmentCount.QuadPart = pAd->WlanCounters.RetryCount.QuadPart;
-
-                pStatistics->TransmittedFragmentCount.QuadPart = pAd->WlanCounters.TransmittedFragmentCount.QuadPart;
-                pStatistics->MulticastTransmittedFrameCount.QuadPart = pAd->WlanCounters.MulticastTransmittedFrameCount.QuadPart;
-                pStatistics->FailedCount.QuadPart = pAd->WlanCounters.FailedCount.QuadPart;
-                pStatistics->RetryCount.QuadPart = pAd->WlanCounters.RetryCount.QuadPart;
-                pStatistics->MultipleRetryCount.QuadPart = pAd->WlanCounters.MultipleRetryCount.QuadPart;
-                pStatistics->RTSSuccessCount.QuadPart = pAd->WlanCounters.RTSSuccessCount.QuadPart;
-                pStatistics->RTSFailureCount.QuadPart = pAd->WlanCounters.RTSFailureCount.QuadPart;
-                pStatistics->ACKFailureCount.QuadPart = pAd->WlanCounters.ACKFailureCount.QuadPart;
-                pStatistics->FrameDuplicateCount.QuadPart = pAd->WlanCounters.FrameDuplicateCount.QuadPart;
-                pStatistics->ReceivedFragmentCount.QuadPart = pAd->WlanCounters.ReceivedFragmentCount.QuadPart;
-                pStatistics->MulticastReceivedFrameCount.QuadPart = pAd->WlanCounters.MulticastReceivedFrameCount.QuadPart;
-#ifdef DBG
-                pStatistics->FCSErrorCount = pAd->RalinkCounters.RealFcsErrCount;
-#else
-                pStatistics->FCSErrorCount.QuadPart = pAd->WlanCounters.FCSErrorCount.QuadPart;
-                pStatistics->FrameDuplicateCount.u.LowPart = pAd->WlanCounters.FrameDuplicateCount.u.LowPart / 100;
-#endif
-                wrq->u.data.length = sizeof(NDIS_802_11_STATISTICS);
-                Status = copy_to_user(wrq->u.data.pointer, pStatistics, wrq->u.data.length);
-                kfree(pStatistics);
-            }
-            else
-            {
-                DBGPRINT(RT_DEBUG_TRACE, ("Query::OID_802_11_STATISTICS(kmalloc failed)\n"));
-                Status = -EFAULT;
-            }
-            break;
-        case OID_GEN_RCV_OK:
-            ulInfo = pAd->Counters8023.GoodReceives;
-            wrq->u.data.length = sizeof(ulInfo);
-            Status = copy_to_user(wrq->u.data.pointer, &ulInfo, wrq->u.data.length);
-            break;
-        case OID_GEN_RCV_NO_BUFFER:
-            ulInfo = pAd->Counters8023.RxNoBuffer;
-            wrq->u.data.length = sizeof(ulInfo);
-            Status = copy_to_user(wrq->u.data.pointer, &ulInfo, wrq->u.data.length);
-            break;
-        case RT_OID_802_11_PHY_MODE:
-            ulInfo = (ULONG)pAd->CommonCfg.PhyMode;
-            wrq->u.data.length = sizeof(ulInfo);
-            Status = copy_to_user(wrq->u.data.pointer, &ulInfo, wrq->u.data.length);
-            DBGPRINT(RT_DEBUG_TRACE, ("Query::RT_OID_802_11_PHY_MODE (=%ld)\n", ulInfo));
-            break;
-        case RT_OID_802_11_STA_CONFIG:
-            pStaConfig = (RT_802_11_STA_CONFIG *) kmalloc(sizeof(RT_802_11_STA_CONFIG), MEM_ALLOC_FLAG);
-            if (pStaConfig)
-            {
-                DBGPRINT(RT_DEBUG_TRACE, ("Query::RT_OID_802_11_STA_CONFIG\n"));
-                pStaConfig->EnableTxBurst = pAd->CommonCfg.bEnableTxBurst;
-                pStaConfig->EnableTurboRate = 0;
-                pStaConfig->UseBGProtection = pAd->CommonCfg.UseBGProtection;
-                pStaConfig->UseShortSlotTime = pAd->CommonCfg.bUseShortSlotTime;
-                //pStaConfig->AdhocMode = pAd->StaCfg.AdhocMode;
-                pStaConfig->HwRadioStatus = (pAd->StaCfg.bHwRadio == TRUE) ? 1 : 0;
-                pStaConfig->Rsv1 = 0;
-                pStaConfig->SystemErrorBitmap = pAd->SystemErrorBitmap;
-                wrq->u.data.length = sizeof(RT_802_11_STA_CONFIG);
-                Status = copy_to_user(wrq->u.data.pointer, pStaConfig, wrq->u.data.length);
-                kfree(pStaConfig);
-            }
-            else
-            {
-                DBGPRINT(RT_DEBUG_TRACE, ("Query::RT_OID_802_11_STA_CONFIG(kmalloc failed)\n"));
-                Status = -EFAULT;
-            }
-            break;
-        case OID_802_11_RTS_THRESHOLD:
-            RtsThresh = pAd->CommonCfg.RtsThreshold;
-            wrq->u.data.length = sizeof(RtsThresh);
-            Status = copy_to_user(wrq->u.data.pointer, &RtsThresh, wrq->u.data.length);
-            DBGPRINT(RT_DEBUG_TRACE, ("Query::OID_802_11_RTS_THRESHOLD(=%ld)\n", RtsThresh));
-            break;
-        case OID_802_11_FRAGMENTATION_THRESHOLD:
-            FragThresh = pAd->CommonCfg.FragmentThreshold;
-            if (pAd->CommonCfg.bUseZeroToDisableFragment == TRUE)
-                FragThresh = 0;
-            wrq->u.data.length = sizeof(FragThresh);
-            Status = copy_to_user(wrq->u.data.pointer, &FragThresh, wrq->u.data.length);
-            DBGPRINT(RT_DEBUG_TRACE, ("Query::OID_802_11_FRAGMENTATION_THRESHOLD(=%ld)\n", FragThresh));
-            break;
-        case OID_802_11_POWER_MODE:
-            PowerMode = pAd->StaCfg.WindowsPowerMode;
-            wrq->u.data.length = sizeof(PowerMode);
-            Status = copy_to_user(wrq->u.data.pointer, &PowerMode, wrq->u.data.length);
-            DBGPRINT(RT_DEBUG_TRACE, ("Query::OID_802_11_POWER_MODE(=%d)\n", PowerMode));
-            break;
-        case RT_OID_802_11_RADIO:
-            RadioState = (BOOLEAN) pAd->StaCfg.bSwRadio;
-            wrq->u.data.length = sizeof(RadioState);
-            Status = copy_to_user(wrq->u.data.pointer, &RadioState, wrq->u.data.length);
-            DBGPRINT(RT_DEBUG_TRACE, ("Query::RT_OID_802_11_QUERY_RADIO (=%d)\n", RadioState));
-            break;
-        case OID_802_11_INFRASTRUCTURE_MODE:
-            if (pAd->StaCfg.BssType == BSS_ADHOC)
-                BssType = Ndis802_11IBSS;
-            else if (pAd->StaCfg.BssType == BSS_INFRA)
-                BssType = Ndis802_11Infrastructure;
-            else if (pAd->StaCfg.BssType == BSS_MONITOR)
-                BssType = Ndis802_11Monitor;
-            else
-                BssType = Ndis802_11AutoUnknown;
-
-            wrq->u.data.length = sizeof(BssType);
-            Status = copy_to_user(wrq->u.data.pointer, &BssType, wrq->u.data.length);
-            DBGPRINT(RT_DEBUG_TRACE, ("Query::OID_802_11_INFRASTRUCTURE_MODE(=%d)\n", BssType));
-            break;
-        case RT_OID_802_11_PREAMBLE:
-            PreamType = pAd->CommonCfg.TxPreamble;
-            wrq->u.data.length = sizeof(PreamType);
-            Status = copy_to_user(wrq->u.data.pointer, &PreamType, wrq->u.data.length);
-            DBGPRINT(RT_DEBUG_TRACE, ("Query::RT_OID_802_11_PREAMBLE(=%d)\n", PreamType));
-            break;
-        case OID_802_11_AUTHENTICATION_MODE:
-            AuthMode = pAd->StaCfg.AuthMode;
-            wrq->u.data.length = sizeof(AuthMode);
-            Status = copy_to_user(wrq->u.data.pointer, &AuthMode, wrq->u.data.length);
-            DBGPRINT(RT_DEBUG_TRACE, ("Query::OID_802_11_AUTHENTICATION_MODE(=%d)\n", AuthMode));
-            break;
-        case OID_802_11_WEP_STATUS:
-            WepStatus = pAd->StaCfg.WepStatus;
-            wrq->u.data.length = sizeof(WepStatus);
-            Status = copy_to_user(wrq->u.data.pointer, &WepStatus, wrq->u.data.length);
-            DBGPRINT(RT_DEBUG_TRACE, ("Query::OID_802_11_WEP_STATUS(=%d)\n", WepStatus));
-            break;
-        case OID_802_11_TX_POWER_LEVEL:
-			wrq->u.data.length = sizeof(ULONG);
-			Status = copy_to_user(wrq->u.data.pointer, &pAd->CommonCfg.TxPower, wrq->u.data.length);
-			DBGPRINT(RT_DEBUG_TRACE, ("Query::OID_802_11_TX_POWER_LEVEL %x\n",pAd->CommonCfg.TxPower));
-			break;
-        case RT_OID_802_11_TX_POWER_LEVEL_1:
-            wrq->u.data.length = sizeof(ULONG);
-            Status = copy_to_user(wrq->u.data.pointer, &pAd->CommonCfg.TxPowerPercentage, wrq->u.data.length);
-			DBGPRINT(RT_DEBUG_TRACE, ("Query::RT_OID_802_11_TX_POWER_LEVEL_1 (=%ld)\n", pAd->CommonCfg.TxPowerPercentage));
-			break;
-        case OID_802_11_NETWORK_TYPES_SUPPORTED:
-			if ((pAd->RfIcType	== RFIC_2850) || (pAd->RfIcType ==	RFIC_2750) || (pAd->RfIcType == RFIC_3052))
-			{
-				NetworkTypeList[0] = 3;                 // NumberOfItems = 3
-				NetworkTypeList[1] = Ndis802_11DS;      // NetworkType[1] = 11b
-				NetworkTypeList[2] = Ndis802_11OFDM24;  // NetworkType[2] = 11g
-				NetworkTypeList[3] = Ndis802_11OFDM5;   // NetworkType[3] = 11a
-                wrq->u.data.length = 16;
-				Status = copy_to_user(wrq->u.data.pointer, &NetworkTypeList[0], wrq->u.data.length);
-			}
-			else
-			{
-				NetworkTypeList[0] = 2;                 // NumberOfItems = 2
-				NetworkTypeList[1] = Ndis802_11DS;      // NetworkType[1] = 11b
-				NetworkTypeList[2] = Ndis802_11OFDM24;  // NetworkType[2] = 11g
-			    wrq->u.data.length = 12;
-				Status = copy_to_user(wrq->u.data.pointer, &NetworkTypeList[0], wrq->u.data.length);
-			}
-			DBGPRINT(RT_DEBUG_TRACE, ("Query::OID_802_11_NETWORK_TYPES_SUPPORTED\n"));
-				break;
-	    case OID_802_11_NETWORK_TYPE_IN_USE:
-            wrq->u.data.length = sizeof(ULONG);
-			if (pAd->CommonCfg.PhyMode == PHY_11A)
-				ulInfo = Ndis802_11OFDM5;
-			else if ((pAd->CommonCfg.PhyMode == PHY_11BG_MIXED) || (pAd->CommonCfg.PhyMode == PHY_11G))
-				ulInfo = Ndis802_11OFDM24;
-			else
-				ulInfo = Ndis802_11DS;
-            Status = copy_to_user(wrq->u.data.pointer, &ulInfo, wrq->u.data.length);
-			break;
-        case RT_OID_802_11_QUERY_LAST_RX_RATE:
-            ulInfo = (ULONG)pAd->LastRxRate;
-            wrq->u.data.length = sizeof(ulInfo);
-			Status = copy_to_user(wrq->u.data.pointer, &ulInfo, wrq->u.data.length);
-			DBGPRINT(RT_DEBUG_TRACE, ("Query::RT_OID_802_11_QUERY_LAST_RX_RATE (=%ld)\n", ulInfo));
-			break;
-		case RT_OID_802_11_QUERY_LAST_TX_RATE:
-			//ulInfo = (ULONG)pAd->LastTxRate;
-			ulInfo = (ULONG)pAd->MacTab.Content[BSSID_WCID].HTPhyMode.word;
-			wrq->u.data.length = sizeof(ulInfo);
-			Status = copy_to_user(wrq->u.data.pointer, &ulInfo,	wrq->u.data.length);
-			DBGPRINT(RT_DEBUG_TRACE, ("Query::RT_OID_802_11_QUERY_LAST_TX_RATE (=%lx)\n", ulInfo));
-			break;
-        case RT_OID_802_11_QUERY_EEPROM_VERSION:
-            wrq->u.data.length = sizeof(ULONG);
-            Status = copy_to_user(wrq->u.data.pointer, &pAd->EepromVersion, wrq->u.data.length);
-            break;
-        case RT_OID_802_11_QUERY_FIRMWARE_VERSION:
-            wrq->u.data.length = sizeof(ULONG);
-            Status = copy_to_user(wrq->u.data.pointer, &pAd->FirmwareVersion, wrq->u.data.length);
-			break;
-	    case RT_OID_802_11_QUERY_NOISE_LEVEL:
-			wrq->u.data.length = sizeof(UCHAR);
-			Status = copy_to_user(wrq->u.data.pointer, &pAd->BbpWriteLatch[66], wrq->u.data.length);
-			DBGPRINT(RT_DEBUG_TRACE, ("Query::RT_OID_802_11_QUERY_NOISE_LEVEL (=%d)\n", pAd->BbpWriteLatch[66]));
-			break;
-	    case RT_OID_802_11_EXTRA_INFO:
-			wrq->u.data.length = sizeof(ULONG);
-			Status = copy_to_user(wrq->u.data.pointer, &pAd->ExtraInfo, wrq->u.data.length);
-	        DBGPRINT(RT_DEBUG_TRACE, ("Query::RT_OID_802_11_EXTRA_INFO (=%ld)\n", pAd->ExtraInfo));
-	        break;
-	    case RT_OID_WE_VERSION_COMPILED:
-	        wrq->u.data.length = sizeof(UINT);
-	        we_version_compiled = WIRELESS_EXT;
-	        Status = copy_to_user(wrq->u.data.pointer, &we_version_compiled, wrq->u.data.length);
-	        break;
-		case RT_OID_802_11_QUERY_APSD_SETTING:
-			apsd = (pAd->CommonCfg.bAPSDCapable | (pAd->CommonCfg.bAPSDAC_BE << 1) | (pAd->CommonCfg.bAPSDAC_BK << 2)
-				| (pAd->CommonCfg.bAPSDAC_VI << 3)	| (pAd->CommonCfg.bAPSDAC_VO << 4)	| (pAd->CommonCfg.MaxSPLength << 5));
-
-			wrq->u.data.length = sizeof(ULONG);
-			Status = copy_to_user(wrq->u.data.pointer, &apsd, wrq->u.data.length);
-			DBGPRINT(RT_DEBUG_TRACE, ("Query::RT_OID_802_11_QUERY_APSD_SETTING (=0x%lx,APSDCap=%d,AC_BE=%d,AC_BK=%d,AC_VI=%d,AC_VO=%d,MAXSPLen=%d)\n",
-				apsd,pAd->CommonCfg.bAPSDCapable,pAd->CommonCfg.bAPSDAC_BE,pAd->CommonCfg.bAPSDAC_BK,pAd->CommonCfg.bAPSDAC_VI,pAd->CommonCfg.bAPSDAC_VO,pAd->CommonCfg.MaxSPLength));
-			break;
-		case RT_OID_802_11_QUERY_APSD_PSM:
-			wrq->u.data.length = sizeof(ULONG);
-			Status = copy_to_user(wrq->u.data.pointer, &pAd->CommonCfg.bAPSDForcePowerSave, wrq->u.data.length);
-			DBGPRINT(RT_DEBUG_TRACE, ("Query::RT_OID_802_11_QUERY_APSD_PSM (=%d)\n", pAd->CommonCfg.bAPSDForcePowerSave));
-			break;
-		case RT_OID_802_11_QUERY_WMM:
-			wrq->u.data.length = sizeof(BOOLEAN);
-			Status = copy_to_user(wrq->u.data.pointer, &pAd->CommonCfg.bWmmCapable, wrq->u.data.length);
-			DBGPRINT(RT_DEBUG_TRACE, ("Query::RT_OID_802_11_QUERY_WMM (=%d)\n",	pAd->CommonCfg.bWmmCapable));
-			break;
-#ifdef WPA_SUPPLICANT_SUPPORT
-        case RT_OID_NEW_DRIVER:
-            {
-                UCHAR enabled = 1;
-	        wrq->u.data.length = sizeof(UCHAR);
-	        Status = copy_to_user(wrq->u.data.pointer, &enabled, wrq->u.data.length);
-                DBGPRINT(RT_DEBUG_TRACE, ("Query::RT_OID_NEW_DRIVER (=%d)\n", enabled));
-            }
-	        break;
-        case RT_OID_WPA_SUPPLICANT_SUPPORT:
-	        wrq->u.data.length = sizeof(UCHAR);
-	        Status = copy_to_user(wrq->u.data.pointer, &pAd->StaCfg.WpaSupplicantUP, wrq->u.data.length);
-            DBGPRINT(RT_DEBUG_TRACE, ("Query::RT_OID_WPA_SUPPLICANT_SUPPORT (=%d)\n", pAd->StaCfg.WpaSupplicantUP));
-	        break;
-#endif // WPA_SUPPLICANT_SUPPORT //
-
-        case RT_OID_DRIVER_DEVICE_NAME:
-            DBGPRINT(RT_DEBUG_TRACE, ("Query::RT_OID_DRIVER_DEVICE_NAME \n"));
-			wrq->u.data.length = 16;
-			if (copy_to_user(wrq->u.data.pointer, pAd->StaCfg.dev_name, wrq->u.data.length))
-			{
-				Status = -EFAULT;
-			}
-            break;
-        case RT_OID_802_11_QUERY_HT_PHYMODE:
-            pHTPhyMode = (OID_SET_HT_PHYMODE *) kmalloc(sizeof(OID_SET_HT_PHYMODE), MEM_ALLOC_FLAG);
-            if (pHTPhyMode)
-            {
-                pHTPhyMode->PhyMode = pAd->CommonCfg.PhyMode;
-			pHTPhyMode->HtMode = (UCHAR)pAd->MacTab.Content[BSSID_WCID].HTPhyMode.field.MODE;
-			pHTPhyMode->BW = (UCHAR)pAd->MacTab.Content[BSSID_WCID].HTPhyMode.field.BW;
-			pHTPhyMode->MCS= (UCHAR)pAd->MacTab.Content[BSSID_WCID].HTPhyMode.field.MCS;
-			pHTPhyMode->SHORTGI= (UCHAR)pAd->MacTab.Content[BSSID_WCID].HTPhyMode.field.ShortGI;
-			pHTPhyMode->STBC= (UCHAR)pAd->MacTab.Content[BSSID_WCID].HTPhyMode.field.STBC;
-
-			pHTPhyMode->ExtOffset = ((pAd->CommonCfg.CentralChannel < pAd->CommonCfg.Channel) ? (EXTCHA_BELOW) : (EXTCHA_ABOVE));
-                wrq->u.data.length = sizeof(OID_SET_HT_PHYMODE);
-                if (copy_to_user(wrq->u.data.pointer, pHTPhyMode, wrq->u.data.length))
-			{
-				Status = -EFAULT;
-			}
-			DBGPRINT(RT_DEBUG_TRACE, ("Query::RT_OID_802_11_QUERY_HT_PHYMODE (PhyMode = %d, MCS =%d, BW = %d, STBC = %d, ExtOffset=%d)\n",
-				pHTPhyMode->HtMode, pHTPhyMode->MCS, pHTPhyMode->BW, pHTPhyMode->STBC, pHTPhyMode->ExtOffset));
-			DBGPRINT(RT_DEBUG_TRACE, (" MlmeUpdateTxRates (.word = %x )\n", pAd->MacTab.Content[BSSID_WCID].HTPhyMode.word));
-            }
-            else
-            {
-                DBGPRINT(RT_DEBUG_TRACE, ("Query::RT_OID_802_11_STA_CONFIG(kmalloc failed)\n"));
-                Status = -EFAULT;
-            }
-            break;
-        case RT_OID_802_11_COUNTRY_REGION:
-            DBGPRINT(RT_DEBUG_TRACE, ("Query::RT_OID_802_11_COUNTRY_REGION \n"));
-			wrq->u.data.length = sizeof(ulInfo);
-            ulInfo = pAd->CommonCfg.CountryRegionForABand;
-            ulInfo = (ulInfo << 8)|(pAd->CommonCfg.CountryRegion);
-			if (copy_to_user(wrq->u.data.pointer, &ulInfo, wrq->u.data.length))
-            {
-				Status = -EFAULT;
-            }
-            break;
-        case RT_OID_802_11_QUERY_DAT_HT_PHYMODE:
-            pHTPhyMode = (OID_SET_HT_PHYMODE *) kmalloc(sizeof(OID_SET_HT_PHYMODE), MEM_ALLOC_FLAG);
-            if (pHTPhyMode)
-            {
-                pHTPhyMode->PhyMode = pAd->CommonCfg.PhyMode;
-			pHTPhyMode->HtMode = (UCHAR)pAd->CommonCfg.RegTransmitSetting.field.HTMODE;
-			pHTPhyMode->BW = (UCHAR)pAd->CommonCfg.RegTransmitSetting.field.BW;
-			pHTPhyMode->MCS= (UCHAR)pAd->StaCfg.DesiredTransmitSetting.field.MCS;
-			pHTPhyMode->SHORTGI= (UCHAR)pAd->CommonCfg.RegTransmitSetting.field.ShortGI;
-			pHTPhyMode->STBC= (UCHAR)pAd->CommonCfg.RegTransmitSetting.field.STBC;
-
-                wrq->u.data.length = sizeof(OID_SET_HT_PHYMODE);
-                if (copy_to_user(wrq->u.data.pointer, pHTPhyMode, wrq->u.data.length))
-			{
-				Status = -EFAULT;
-			}
-			DBGPRINT(RT_DEBUG_TRACE, ("Query::RT_OID_802_11_QUERY_HT_PHYMODE (PhyMode = %d, MCS =%d, BW = %d, STBC = %d, ExtOffset=%d)\n",
-				pHTPhyMode->HtMode, pHTPhyMode->MCS, pHTPhyMode->BW, pHTPhyMode->STBC, pHTPhyMode->ExtOffset));
-			DBGPRINT(RT_DEBUG_TRACE, (" MlmeUpdateTxRates (.word = %x )\n", pAd->MacTab.Content[BSSID_WCID].HTPhyMode.word));
-            }
-            else
-            {
-                DBGPRINT(RT_DEBUG_TRACE, ("Query::RT_OID_802_11_STA_CONFIG(kmalloc failed)\n"));
-                Status = -EFAULT;
-            }
-            break;
-        case RT_OID_QUERY_MULTIPLE_CARD_SUPPORT:
-			wrq->u.data.length = sizeof(UCHAR);
-            i = 0;
-#ifdef MULTIPLE_CARD_SUPPORT
-            i = 1;
-#endif // MULTIPLE_CARD_SUPPORT //
-			if (copy_to_user(wrq->u.data.pointer, &i, wrq->u.data.length))
-            {
-				Status = -EFAULT;
-            }
-            DBGPRINT(RT_DEBUG_TRACE, ("Query::RT_OID_QUERY_MULTIPLE_CARD_SUPPORT(=%d) \n", i));
-            break;
-#ifdef SNMP_SUPPORT
-		case RT_OID_802_11_MAC_ADDRESS:
-            wrq->u.data.length = MAC_ADDR_LEN;
-            Status = copy_to_user(wrq->u.data.pointer, &pAd->CurrentAddress, wrq->u.data.length);
-			break;
-
-		case RT_OID_802_11_MANUFACTUREROUI:
-			DBGPRINT(RT_DEBUG_TRACE, ("Query::RT_OID_802_11_MANUFACTUREROUI \n"));
-			wrq->u.data.length = ManufacturerOUI_LEN;
-			Status = copy_to_user(wrq->u.data.pointer, &pAd->CurrentAddress, wrq->u.data.length);
-			break;
-
-		case RT_OID_802_11_MANUFACTURERNAME:
-			DBGPRINT(RT_DEBUG_TRACE, ("Query::RT_OID_802_11_MANUFACTURERNAME \n"));
-			wrq->u.data.length = strlen(ManufacturerNAME);
-			Status = copy_to_user(wrq->u.data.pointer, ManufacturerNAME, wrq->u.data.length);
-			break;
-
-		case RT_OID_802_11_RESOURCETYPEIDNAME:
-			DBGPRINT(RT_DEBUG_TRACE, ("Query::RT_OID_802_11_RESOURCETYPEIDNAME \n"));
-			wrq->u.data.length = strlen(ResourceTypeIdName);
-			Status = copy_to_user(wrq->u.data.pointer, ResourceTypeIdName, wrq->u.data.length);
-			break;
-
-		case RT_OID_802_11_PRIVACYOPTIONIMPLEMENTED:
-			DBGPRINT(RT_DEBUG_TRACE, ("Query::RT_OID_802_11_PRIVACYOPTIONIMPLEMENTED \n"));
-			ulInfo = 1; // 1 is support wep else 2 is not support.
-			wrq->u.data.length = sizeof(ulInfo);
-			Status = copy_to_user(wrq->u.data.pointer, &ulInfo, wrq->u.data.length);
-			break;
-
-		case RT_OID_802_11_POWERMANAGEMENTMODE:
-			DBGPRINT(RT_DEBUG_TRACE, ("Query::RT_OID_802_11_POWERMANAGEMENTMODE \n"));
-			if (pAd->StaCfg.Psm == PSMP_ACTION)
-				ulInfo = 1; // 1 is power active else 2 is power save.
-			else
-				ulInfo = 2;
-
-			wrq->u.data.length = sizeof(ulInfo);
-			Status = copy_to_user(wrq->u.data.pointer, &ulInfo, wrq->u.data.length);
-			break;
-
-		case OID_802_11_WEPDEFAULTKEYVALUE:
-			DBGPRINT(RT_DEBUG_TRACE, ("Query::OID_802_11_WEPDEFAULTKEYVALUE \n"));
-			//KeyIdxValue.KeyIdx = pAd->PortCfg.MBSSID[pAd->IoctlIF].DefaultKeyId;
-			pKeyIdxValue = wrq->u.data.pointer;
-			DBGPRINT(RT_DEBUG_TRACE,("KeyIdxValue.KeyIdx = %d, \n",pKeyIdxValue->KeyIdx));
-			valueLen = pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].KeyLen;
-			NdisMoveMemory(pKeyIdxValue->Value,
-						   &pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].Key,
-						   valueLen);
-			pKeyIdxValue->Value[valueLen]='\0';
-
-			wrq->u.data.length = sizeof(DefaultKeyIdxValue);
-
-			Status = copy_to_user(wrq->u.data.pointer, pKeyIdxValue, wrq->u.data.length);
-			DBGPRINT(RT_DEBUG_TRACE,("DefaultKeyId = %d, total len = %d, str len=%d, KeyValue= %02x %02x %02x %02x \n",
-										pAd->StaCfg.DefaultKeyId,
-										wrq->u.data.length,
-										pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].KeyLen,
-										pAd->SharedKey[BSS0][0].Key[0],
-										pAd->SharedKey[BSS0][1].Key[0],
-										pAd->SharedKey[BSS0][2].Key[0],
-										pAd->SharedKey[BSS0][3].Key[0]));
-			break;
-
-		case OID_802_11_WEPDEFAULTKEYID:
-			DBGPRINT(RT_DEBUG_TRACE, ("Query::RT_OID_802_11_WEPDEFAULTKEYID \n"));
-			wrq->u.data.length = sizeof(UCHAR);
-			Status = copy_to_user(wrq->u.data.pointer, &pAd->StaCfg.DefaultKeyId, wrq->u.data.length);
-			DBGPRINT(RT_DEBUG_TRACE, ("DefaultKeyId =%d \n", pAd->StaCfg.DefaultKeyId));
-			break;
-
-		case RT_OID_802_11_WEPKEYMAPPINGLENGTH:
-			DBGPRINT(RT_DEBUG_TRACE, ("Query::RT_OID_802_11_WEPKEYMAPPINGLENGTH \n"));
-			wrq->u.data.length = sizeof(UCHAR);
-			Status = copy_to_user(wrq->u.data.pointer,
-									&pAd->SharedKey[BSS0][pAd->StaCfg.DefaultKeyId].KeyLen,
-									wrq->u.data.length);
-			break;
-
-		case OID_802_11_SHORTRETRYLIMIT:
-			DBGPRINT(RT_DEBUG_TRACE, ("Query::OID_802_11_SHORTRETRYLIMIT \n"));
-			wrq->u.data.length = sizeof(ULONG);
-			RTMP_IO_READ32(pAd, TX_RTY_CFG, &tx_rty_cfg.word);
-			ShortRetryLimit = tx_rty_cfg.field.ShortRtyLimit;
-			DBGPRINT(RT_DEBUG_TRACE, ("ShortRetryLimit =%ld,  tx_rty_cfg.field.ShortRetryLimit=%d\n", ShortRetryLimit, tx_rty_cfg.field.ShortRtyLimit));
-			Status = copy_to_user(wrq->u.data.pointer, &ShortRetryLimit, wrq->u.data.length);
-			break;
-
-		case OID_802_11_LONGRETRYLIMIT:
-			DBGPRINT(RT_DEBUG_TRACE, ("Query::OID_802_11_LONGRETRYLIMIT \n"));
-			wrq->u.data.length = sizeof(ULONG);
-			RTMP_IO_READ32(pAd, TX_RTY_CFG, &tx_rty_cfg.word);
-			LongRetryLimit = tx_rty_cfg.field.LongRtyLimit;
-			DBGPRINT(RT_DEBUG_TRACE, ("LongRetryLimit =%ld,  tx_rty_cfg.field.LongRtyLimit=%d\n", LongRetryLimit, tx_rty_cfg.field.LongRtyLimit));
-			Status = copy_to_user(wrq->u.data.pointer, &LongRetryLimit, wrq->u.data.length);
-			break;
-
-		case RT_OID_802_11_PRODUCTID:
-			DBGPRINT(RT_DEBUG_TRACE, ("Query::RT_OID_802_11_PRODUCTID \n"));
-
-#ifdef RTMP_MAC_PCI
-			{
-
-				USHORT  device_id;
-				if (((POS_COOKIE)pAd->OS_Cookie)->pci_dev != NULL)
-				pci_read_config_word(((POS_COOKIE)pAd->OS_Cookie)->pci_dev, PCI_DEVICE_ID, &device_id);
-				else
-					DBGPRINT(RT_DEBUG_TRACE, (" pci_dev = NULL\n"));
-				sprintf((PSTRING)tmp, "%04x %04x\n", NIC_PCI_VENDOR_ID, device_id);
-			}
-#endif // RTMP_MAC_PCI //
-			wrq->u.data.length = strlen((PSTRING)tmp);
-			Status = copy_to_user(wrq->u.data.pointer, tmp, wrq->u.data.length);
-			break;
-
-		case RT_OID_802_11_MANUFACTUREID:
-			DBGPRINT(RT_DEBUG_TRACE, ("Query::RT_OID_802_11_MANUFACTUREID \n"));
-			wrq->u.data.length = strlen(ManufacturerNAME);
-			Status = copy_to_user(wrq->u.data.pointer, ManufacturerNAME, wrq->u.data.length);
-			break;
-
-		case OID_802_11_CURRENTCHANNEL:
-			DBGPRINT(RT_DEBUG_TRACE, ("Query::OID_802_11_CURRENTCHANNEL \n"));
-			wrq->u.data.length = sizeof(UCHAR);
-			DBGPRINT(RT_DEBUG_TRACE, ("sizeof UCHAR=%d, channel=%d \n", sizeof(UCHAR), pAd->CommonCfg.Channel));
-			Status = copy_to_user(wrq->u.data.pointer, &pAd->CommonCfg.Channel, wrq->u.data.length);
-			DBGPRINT(RT_DEBUG_TRACE, ("Status=%d\n", Status));
-			break;
-#endif //SNMP_SUPPORT
-
-		case OID_802_11_BUILD_CHANNEL_EX:
-			{
-				UCHAR value;
-				DBGPRINT(RT_DEBUG_TRACE, ("Query::OID_802_11_BUILD_CHANNEL_EX \n"));
-				wrq->u.data.length = sizeof(UCHAR);
-#ifdef EXT_BUILD_CHANNEL_LIST
-				DBGPRINT(RT_DEBUG_TRACE, ("Support EXT_BUILD_CHANNEL_LIST.\n"));
-				value = 1;
-#else
-				DBGPRINT(RT_DEBUG_TRACE, ("Doesn't support EXT_BUILD_CHANNEL_LIST.\n"));
-				value = 0;
-#endif // EXT_BUILD_CHANNEL_LIST //
-				Status = copy_to_user(wrq->u.data.pointer, &value, 1);
-				DBGPRINT(RT_DEBUG_TRACE, ("Status=%d\n", Status));
-			}
-			break;
-
-		case OID_802_11_GET_CH_LIST:
-			{
-				PRT_CHANNEL_LIST_INFO pChListBuf;
-
-				DBGPRINT(RT_DEBUG_TRACE, ("Query::OID_802_11_GET_CH_LIST \n"));
-				if (pAd->ChannelListNum == 0)
-				{
-					wrq->u.data.length = 0;
-					break;
-				}
-
-				pChListBuf = (RT_CHANNEL_LIST_INFO *) kmalloc(sizeof(RT_CHANNEL_LIST_INFO), MEM_ALLOC_FLAG);
-				if (pChListBuf == NULL)
-				{
-					wrq->u.data.length = 0;
-					break;
-				}
-
-				pChListBuf->ChannelListNum = pAd->ChannelListNum;
-				for (i = 0; i < pChListBuf->ChannelListNum; i++)
-					pChListBuf->ChannelList[i] = pAd->ChannelList[i].Channel;
-
-				wrq->u.data.length = sizeof(RT_CHANNEL_LIST_INFO);
-				Status = copy_to_user(wrq->u.data.pointer, pChListBuf, sizeof(RT_CHANNEL_LIST_INFO));
-				DBGPRINT(RT_DEBUG_TRACE, ("Status=%d\n", Status));
-
-				if (pChListBuf)
-					kfree(pChListBuf);
-			}
-			break;
-
-		case OID_802_11_GET_COUNTRY_CODE:
-			DBGPRINT(RT_DEBUG_TRACE, ("Query::OID_802_11_GET_COUNTRY_CODE \n"));
-			wrq->u.data.length = 2;
-			Status = copy_to_user(wrq->u.data.pointer, &pAd->CommonCfg.CountryCode, 2);
-			DBGPRINT(RT_DEBUG_TRACE, ("Status=%d\n", Status));
-			break;
-
-		case OID_802_11_GET_CHANNEL_GEOGRAPHY:
-			DBGPRINT(RT_DEBUG_TRACE, ("Query::OID_802_11_GET_CHANNEL_GEOGRAPHY \n"));
-			wrq->u.data.length = 1;
-			Status = copy_to_user(wrq->u.data.pointer, &pAd->CommonCfg.Geography, 1);
-			DBGPRINT(RT_DEBUG_TRACE, ("Status=%d\n", Status));
-			break;
-
-
-#ifdef QOS_DLS_SUPPORT
-		case RT_OID_802_11_QUERY_DLS:
-			wrq->u.data.length = sizeof(BOOLEAN);
-			Status = copy_to_user(wrq->u.data.pointer, &pAd->CommonCfg.bDLSCapable, wrq->u.data.length);
-			DBGPRINT(RT_DEBUG_TRACE, ("Query::RT_OID_802_11_QUERY_DLS(=%d)\n", pAd->CommonCfg.bDLSCapable));
-			break;
-
-		case RT_OID_802_11_QUERY_DLS_PARAM:
-			{
-				PRT_802_11_DLS_INFO	pDlsInfo = kmalloc(sizeof(RT_802_11_DLS_INFO), GFP_ATOMIC);
-				if (pDlsInfo == NULL)
-					break;
-
-				for (i=0; i<MAX_NUM_OF_DLS_ENTRY; i++)
-				{
-					RTMPMoveMemory(&pDlsInfo->Entry[i], &pAd->StaCfg.DLSEntry[i], sizeof(RT_802_11_DLS_UI));
-				}
-
-				pDlsInfo->num = MAX_NUM_OF_DLS_ENTRY;
-				wrq->u.data.length = sizeof(RT_802_11_DLS_INFO);
-				Status = copy_to_user(wrq->u.data.pointer, pDlsInfo, wrq->u.data.length);
-				DBGPRINT(RT_DEBUG_TRACE, ("Query::RT_OID_802_11_QUERY_DLS_PARAM\n"));
-
-				if (pDlsInfo)
-					kfree(pDlsInfo);
-			}
-			break;
-#endif // QOS_DLS_SUPPORT //
-
-		case OID_802_11_SET_PSPXLINK_MODE:
-			wrq->u.data.length = sizeof(BOOLEAN);
-            Status = copy_to_user(wrq->u.data.pointer, &pAd->CommonCfg.PSPXlink, wrq->u.data.length);
-			DBGPRINT(RT_DEBUG_TRACE, ("Query::OID_802_11_SET_PSPXLINK_MODE(=%d)\n", pAd->CommonCfg.PSPXlink));
-			break;
-
-
-        default:
-            DBGPRINT(RT_DEBUG_TRACE, ("Query::unknown IOCTL's subcmd = 0x%08x\n", cmd));
-            Status = -EOPNOTSUPP;
-            break;
-    }
-    return Status;
-}
-
-INT rt28xx_sta_ioctl(
-	IN	struct net_device	*net_dev,
-	IN	OUT	struct ifreq	*rq,
-	IN	INT					cmd)
-{
-	POS_COOKIE			pObj;
-	RTMP_ADAPTER        *pAd = NULL;
-	struct iwreq        *wrq = (struct iwreq *) rq;
-	BOOLEAN				StateMachineTouched = FALSE;
-	INT					Status = NDIS_STATUS_SUCCESS;
-	USHORT				subcmd;
-
-
-	pAd = RTMP_OS_NETDEV_GET_PRIV(net_dev);
-	if (pAd == NULL)
-	{
-		/* if 1st open fail, pAd will be free;
-		   So the net_dev->priv will be NULL in 2rd open */
-		return -ENETDOWN;
-	}
-	pObj = (POS_COOKIE) pAd->OS_Cookie;
-
-    //check if the interface is down
-    if(!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_INTERRUPT_IN_USE))
-    {
-#ifdef CONFIG_APSTA_MIXED_SUPPORT
-	    if (wrq->u.data.pointer == NULL)
-	    {
-		    return Status;
-	    }
-
-	    if (strstr(wrq->u.data.pointer, "OpMode") == NULL)
-#endif // CONFIG_APSTA_MIXED_SUPPORT //
-		{
-            DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
-		    return -ENETDOWN;
-        }
-    }
-
-	{	// determine this ioctl command is comming from which interface.
-		pObj->ioctl_if_type = INT_MAIN;
-		pObj->ioctl_if = MAIN_MBSSID;
-	}
-
-	switch(cmd)
-	{
-#ifdef RALINK_ATE
-#ifdef RALINK_28xx_QA
-		case RTPRIV_IOCTL_ATE:
-			{
-				RtmpDoAte(pAd, wrq);
-			}
-			break;
-#endif // RALINK_28xx_QA //
-#endif // RALINK_ATE //
-        case SIOCGIFHWADDR:
-			DBGPRINT(RT_DEBUG_TRACE, ("IOCTL::SIOCGIFHWADDR\n"));
-			memcpy(wrq->u.name, pAd->CurrentAddress, ETH_ALEN);
-			break;
-		case SIOCGIWNAME:
-        {
-		char *name=&wrq->u.name[0];
-		rt_ioctl_giwname(net_dev, NULL, name, NULL);
-            break;
-		}
-		case SIOCGIWESSID:  //Get ESSID
-        {
-		struct iw_point *essid=&wrq->u.essid;
-		rt_ioctl_giwessid(net_dev, NULL, essid, essid->pointer);
-            break;
-		}
-		case SIOCSIWESSID:  //Set ESSID
-		{
-		struct iw_point	*essid=&wrq->u.essid;
-		rt_ioctl_siwessid(net_dev, NULL, essid, essid->pointer);
-            break;
-		}
-		case SIOCSIWNWID:   // set network id (the cell)
-		case SIOCGIWNWID:   // get network id
-			Status = -EOPNOTSUPP;
-			break;
-		case SIOCSIWFREQ:   //set channel/frequency (Hz)
-		{
-		struct iw_freq *freq=&wrq->u.freq;
-		rt_ioctl_siwfreq(net_dev, NULL, freq, NULL);
-			break;
-		}
-		case SIOCGIWFREQ:   // get channel/frequency (Hz)
-		{
-		struct iw_freq *freq=&wrq->u.freq;
-		rt_ioctl_giwfreq(net_dev, NULL, freq, NULL);
-			break;
-		}
-		case SIOCSIWNICKN: //set node name/nickname
-		{
-		//struct iw_point *data=&wrq->u.data;
-		//rt_ioctl_siwnickn(net_dev, NULL, data, NULL);
-			break;
-			}
-		case SIOCGIWNICKN: //get node name/nickname
-        {
-			struct iw_point	*erq = NULL;
-		erq = &wrq->u.data;
-            erq->length = strlen((PSTRING) pAd->nickname);
-            Status = copy_to_user(erq->pointer, pAd->nickname, erq->length);
-			break;
-		}
-		case SIOCGIWRATE:   //get default bit rate (bps)
-		    rt_ioctl_giwrate(net_dev, NULL, &wrq->u, NULL);
-            break;
-	    case SIOCSIWRATE:  //set default bit rate (bps)
-	        rt_ioctl_siwrate(net_dev, NULL, &wrq->u, NULL);
-            break;
-        case SIOCGIWRTS:  // get RTS/CTS threshold (bytes)
-		{
-		struct iw_param *rts=&wrq->u.rts;
-		rt_ioctl_giwrts(net_dev, NULL, rts, NULL);
-            break;
-		}
-        case SIOCSIWRTS:  //set RTS/CTS threshold (bytes)
-		{
-		struct iw_param *rts=&wrq->u.rts;
-		rt_ioctl_siwrts(net_dev, NULL, rts, NULL);
-            break;
-		}
-        case SIOCGIWFRAG:  //get fragmentation thr (bytes)
-		{
-		struct iw_param *frag=&wrq->u.frag;
-		rt_ioctl_giwfrag(net_dev, NULL, frag, NULL);
-            break;
-		}
-        case SIOCSIWFRAG:  //set fragmentation thr (bytes)
-		{
-		struct iw_param *frag=&wrq->u.frag;
-		rt_ioctl_siwfrag(net_dev, NULL, frag, NULL);
-            break;
-		}
-        case SIOCGIWENCODE:  //get encoding token & mode
-		{
-		struct iw_point *erq=&wrq->u.encoding;
-		if(erq)
-			rt_ioctl_giwencode(net_dev, NULL, erq, erq->pointer);
-            break;
-		}
-        case SIOCSIWENCODE:  //set encoding token & mode
-		{
-		struct iw_point *erq=&wrq->u.encoding;
-		if(erq)
-			rt_ioctl_siwencode(net_dev, NULL, erq, erq->pointer);
-            break;
-		}
-		case SIOCGIWAP:     //get access point MAC addresses
-		{
-		struct sockaddr *ap_addr=&wrq->u.ap_addr;
-		rt_ioctl_giwap(net_dev, NULL, ap_addr, ap_addr->sa_data);
-			break;
-		}
-	    case SIOCSIWAP:  //set access point MAC addresses
-		{
-		struct sockaddr *ap_addr=&wrq->u.ap_addr;
-		rt_ioctl_siwap(net_dev, NULL, ap_addr, ap_addr->sa_data);
-            break;
-		}
-		case SIOCGIWMODE:   //get operation mode
-		{
-		__u32 *mode=&wrq->u.mode;
-		rt_ioctl_giwmode(net_dev, NULL, mode, NULL);
-            break;
-		}
-		case SIOCSIWMODE:   //set operation mode
-		{
-		__u32 *mode=&wrq->u.mode;
-		rt_ioctl_siwmode(net_dev, NULL, mode, NULL);
-            break;
-		}
-		case SIOCGIWSENS:   //get sensitivity (dBm)
-		case SIOCSIWSENS:	//set sensitivity (dBm)
-		case SIOCGIWPOWER:  //get Power Management settings
-		case SIOCSIWPOWER:  //set Power Management settings
-		case SIOCGIWTXPOW:  //get transmit power (dBm)
-		case SIOCSIWTXPOW:  //set transmit power (dBm)
-		case SIOCGIWRANGE:	//Get range of parameters
-		case SIOCGIWRETRY:	//get retry limits and lifetime
-		case SIOCSIWRETRY:	//set retry limits and lifetime
-			Status = -EOPNOTSUPP;
-			break;
-		case RT_PRIV_IOCTL:
-        case RT_PRIV_IOCTL_EXT:
-			subcmd = wrq->u.data.flags;
-			if( subcmd & OID_GET_SET_TOGGLE)
-				Status = RTMPSetInformation(pAd, rq, subcmd);
-			else
-				Status = RTMPQueryInformation(pAd, rq, subcmd);
-			break;
-		case SIOCGIWPRIV:
-			if (wrq->u.data.pointer)
-			{
-				if ( access_ok(VERIFY_WRITE, wrq->u.data.pointer, sizeof(privtab)) != TRUE)
-					break;
-				wrq->u.data.length = sizeof(privtab) / sizeof(privtab[0]);
-				if (copy_to_user(wrq->u.data.pointer, privtab, sizeof(privtab)))
-					Status = -EFAULT;
-			}
-			break;
-		case RTPRIV_IOCTL_SET:
-			if(access_ok(VERIFY_READ, wrq->u.data.pointer, wrq->u.data.length) != TRUE)
-					break;
-			rt_ioctl_setparam(net_dev, NULL, NULL, wrq->u.data.pointer);
-			break;
-		case RTPRIV_IOCTL_GSITESURVEY:
-			RTMPIoctlGetSiteSurvey(pAd, wrq);
-		    break;
-#ifdef DBG
-		case RTPRIV_IOCTL_MAC:
-			RTMPIoctlMAC(pAd, wrq);
-			break;
-		case RTPRIV_IOCTL_E2P:
-			RTMPIoctlE2PROM(pAd, wrq);
-			break;
-#ifdef RTMP_RF_RW_SUPPORT
-		case RTPRIV_IOCTL_RF:
-			RTMPIoctlRF(pAd, wrq);
-			break;
-#endif // RTMP_RF_RW_SUPPORT //
-#endif // DBG //
-
-        case SIOCETHTOOL:
-                break;
-		default:
-			DBGPRINT(RT_DEBUG_ERROR, ("IOCTL::unknown IOCTL's cmd = 0x%08x\n", cmd));
-			Status = -EOPNOTSUPP;
-			break;
-	}
-
-    if(StateMachineTouched) // Upper layer sent a MLME-related operations
-	RTMP_MLME_HANDLER(pAd);
-
-	return Status;
-}
-
-/*
-    ==========================================================================
-    Description:
-        Set SSID
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT Set_SSID_Proc(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  PSTRING          arg)
-{
-    NDIS_802_11_SSID                    Ssid, *pSsid=NULL;
-    BOOLEAN                             StateMachineTouched = FALSE;
-    int                                 success = TRUE;
-
-    if( strlen(arg) <= MAX_LEN_OF_SSID)
-    {
-        NdisZeroMemory(&Ssid, sizeof(NDIS_802_11_SSID));
-        if (strlen(arg) != 0)
-        {
-            NdisMoveMemory(Ssid.Ssid, arg, strlen(arg));
-            Ssid.SsidLength = strlen(arg);
-        }
-        else   //ANY ssid
-        {
-            Ssid.SsidLength = 0;
-	    memcpy(Ssid.Ssid, "", 0);
-		pAdapter->StaCfg.BssType = BSS_INFRA;
-		pAdapter->StaCfg.AuthMode = Ndis802_11AuthModeOpen;
-        pAdapter->StaCfg.WepStatus  = Ndis802_11EncryptionDisabled;
-	}
-        pSsid = &Ssid;
-
-        if (pAdapter->Mlme.CntlMachine.CurrState != CNTL_IDLE)
-        {
-            RTMP_MLME_RESET_STATE_MACHINE(pAdapter);
-            DBGPRINT(RT_DEBUG_TRACE, ("!!! MLME busy, reset MLME state machine !!!\n"));
-        }
-
-		if ((pAdapter->StaCfg.WpaPassPhraseLen >= 8) &&
-			(pAdapter->StaCfg.WpaPassPhraseLen <= 64))
-		{
-			STRING passphrase_str[65] = {0};
-			UCHAR keyMaterial[40];
-
-			RTMPMoveMemory(passphrase_str, pAdapter->StaCfg.WpaPassPhrase, pAdapter->StaCfg.WpaPassPhraseLen);
-			RTMPZeroMemory(pAdapter->StaCfg.PMK, 32);
-			if (pAdapter->StaCfg.WpaPassPhraseLen == 64)
-			{
-			    AtoH((PSTRING) pAdapter->StaCfg.WpaPassPhrase, pAdapter->StaCfg.PMK, 32);
-			}
-			else
-			{
-			    PasswordHash((PSTRING) pAdapter->StaCfg.WpaPassPhrase, Ssid.Ssid, Ssid.SsidLength, keyMaterial);
-			    NdisMoveMemory(pAdapter->StaCfg.PMK, keyMaterial, 32);
-			}
-		}
-
-        pAdapter->MlmeAux.CurrReqIsFromNdis = TRUE;
-        pAdapter->StaCfg.bScanReqIsFromWebUI = FALSE;
-		pAdapter->bConfigChanged = TRUE;
-
-        MlmeEnqueue(pAdapter,
-                    MLME_CNTL_STATE_MACHINE,
-                    OID_802_11_SSID,
-                    sizeof(NDIS_802_11_SSID),
-                    (VOID *)pSsid);
-
-        StateMachineTouched = TRUE;
-        DBGPRINT(RT_DEBUG_TRACE, ("Set_SSID_Proc::(Len=%d,Ssid=%s)\n", Ssid.SsidLength, Ssid.Ssid));
-    }
-    else
-        success = FALSE;
-
-    if (StateMachineTouched) // Upper layer sent a MLME-related operations
-	RTMP_MLME_HANDLER(pAdapter);
-
-    return success;
-}
-
-#ifdef WMM_SUPPORT
-/*
-    ==========================================================================
-    Description:
-        Set WmmCapable Enable or Disable
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT	Set_WmmCapable_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	BOOLEAN	bWmmCapable;
-
-	bWmmCapable = simple_strtol(arg, 0, 10);
-
-	if ((bWmmCapable == 1)
-		)
-		pAd->CommonCfg.bWmmCapable = TRUE;
-	else if (bWmmCapable == 0)
-		pAd->CommonCfg.bWmmCapable = FALSE;
-	else
-		return FALSE;  //Invalid argument
-
-	DBGPRINT(RT_DEBUG_TRACE, ("Set_WmmCapable_Proc::(bWmmCapable=%d)\n",
-		pAd->CommonCfg.bWmmCapable));
-
-	return TRUE;
-}
-#endif // WMM_SUPPORT //
-
-/*
-    ==========================================================================
-    Description:
-        Set Network Type(Infrastructure/Adhoc mode)
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT Set_NetworkType_Proc(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  PSTRING          arg)
-{
-    UINT32	Value = 0;
-
-    if (strcmp(arg, "Adhoc") == 0)
-	{
-		if (pAdapter->StaCfg.BssType != BSS_ADHOC)
-		{
-			// Config has changed
-			pAdapter->bConfigChanged = TRUE;
-            if (MONITOR_ON(pAdapter))
-            {
-                RTMP_IO_WRITE32(pAdapter, RX_FILTR_CFG, STANORMAL);
-                RTMP_IO_READ32(pAdapter, MAC_SYS_CTRL, &Value);
-				Value &= (~0x80);
-				RTMP_IO_WRITE32(pAdapter, MAC_SYS_CTRL, Value);
-                OPSTATUS_CLEAR_FLAG(pAdapter, fOP_STATUS_MEDIA_STATE_CONNECTED);
-                pAdapter->StaCfg.bAutoReconnect = TRUE;
-                LinkDown(pAdapter, FALSE);
-            }
-			if (INFRA_ON(pAdapter))
-			{
-				//BOOLEAN Cancelled;
-				// Set the AutoReconnectSsid to prevent it reconnect to old SSID
-				// Since calling this indicate user don't want to connect to that SSID anymore.
-				pAdapter->MlmeAux.AutoReconnectSsidLen= 32;
-				NdisZeroMemory(pAdapter->MlmeAux.AutoReconnectSsid, pAdapter->MlmeAux.AutoReconnectSsidLen);
-
-				LinkDown(pAdapter, FALSE);
-
-				DBGPRINT(RT_DEBUG_TRACE, ("NDIS_STATUS_MEDIA_DISCONNECT Event BB!\n"));
-			}
-		}
-		pAdapter->StaCfg.BssType = BSS_ADHOC;
-        pAdapter->net_dev->type = pAdapter->StaCfg.OriDevType;
-		DBGPRINT(RT_DEBUG_TRACE, ("===>Set_NetworkType_Proc::(AD-HOC)\n"));
-	}
-    else if (strcmp(arg, "Infra") == 0)
-	{
-		if (pAdapter->StaCfg.BssType != BSS_INFRA)
-		{
-			// Config has changed
-			pAdapter->bConfigChanged = TRUE;
-            if (MONITOR_ON(pAdapter))
-            {
-                RTMP_IO_WRITE32(pAdapter, RX_FILTR_CFG, STANORMAL);
-                RTMP_IO_READ32(pAdapter, MAC_SYS_CTRL, &Value);
-				Value &= (~0x80);
-				RTMP_IO_WRITE32(pAdapter, MAC_SYS_CTRL, Value);
-                OPSTATUS_CLEAR_FLAG(pAdapter, fOP_STATUS_MEDIA_STATE_CONNECTED);
-                pAdapter->StaCfg.bAutoReconnect = TRUE;
-                LinkDown(pAdapter, FALSE);
-            }
-			if (ADHOC_ON(pAdapter))
-			{
-				// Set the AutoReconnectSsid to prevent it reconnect to old SSID
-				// Since calling this indicate user don't want to connect to that SSID anymore.
-				pAdapter->MlmeAux.AutoReconnectSsidLen= 32;
-				NdisZeroMemory(pAdapter->MlmeAux.AutoReconnectSsid, pAdapter->MlmeAux.AutoReconnectSsidLen);
-
-				LinkDown(pAdapter, FALSE);
-			}
-		}
-		pAdapter->StaCfg.BssType = BSS_INFRA;
-        pAdapter->net_dev->type = pAdapter->StaCfg.OriDevType;
-		DBGPRINT(RT_DEBUG_TRACE, ("===>Set_NetworkType_Proc::(INFRA)\n"));
-	}
-    else if (strcmp(arg, "Monitor") == 0)
-    {
-			UCHAR	bbpValue = 0;
-			BCN_TIME_CFG_STRUC csr;
-			OPSTATUS_CLEAR_FLAG(pAdapter, fOP_STATUS_INFRA_ON);
-            OPSTATUS_CLEAR_FLAG(pAdapter, fOP_STATUS_ADHOC_ON);
-			OPSTATUS_SET_FLAG(pAdapter, fOP_STATUS_MEDIA_STATE_CONNECTED);
-			// disable all periodic state machine
-			pAdapter->StaCfg.bAutoReconnect = FALSE;
-			// reset all mlme state machine
-			RTMP_MLME_RESET_STATE_MACHINE(pAdapter);
-			DBGPRINT(RT_DEBUG_TRACE, ("fOP_STATUS_MEDIA_STATE_CONNECTED \n"));
-            if (pAdapter->CommonCfg.CentralChannel == 0)
-            {
-#ifdef DOT11_N_SUPPORT
-                if (pAdapter->CommonCfg.PhyMode == PHY_11AN_MIXED)
-                    pAdapter->CommonCfg.CentralChannel = 36;
-                else
-#endif // DOT11_N_SUPPORT //
-                    pAdapter->CommonCfg.CentralChannel = 6;
-            }
-#ifdef DOT11_N_SUPPORT
-            else
-                N_ChannelCheck(pAdapter);
-#endif // DOT11_N_SUPPORT //
-
-#ifdef DOT11_N_SUPPORT
-			if (pAdapter->CommonCfg.PhyMode >= PHY_11ABGN_MIXED &&
-                pAdapter->CommonCfg.RegTransmitSetting.field.BW == BW_40 &&
-                pAdapter->CommonCfg.RegTransmitSetting.field.EXTCHA == EXTCHA_ABOVE)
-			{
-				// 40MHz ,control channel at lower
-				RTMP_BBP_IO_READ8_BY_REG_ID(pAdapter, BBP_R4, &bbpValue);
-				bbpValue &= (~0x18);
-				bbpValue |= 0x10;
-				RTMP_BBP_IO_WRITE8_BY_REG_ID(pAdapter, BBP_R4, bbpValue);
-				pAdapter->CommonCfg.BBPCurrentBW = BW_40;
-				//  RX : control channel at lower
-				RTMP_BBP_IO_READ8_BY_REG_ID(pAdapter, BBP_R3, &bbpValue);
-				bbpValue &= (~0x20);
-				RTMP_BBP_IO_WRITE8_BY_REG_ID(pAdapter, BBP_R3, bbpValue);
-
-				RTMP_IO_READ32(pAdapter, TX_BAND_CFG, &Value);
-				Value &= 0xfffffffe;
-				RTMP_IO_WRITE32(pAdapter, TX_BAND_CFG, Value);
-				pAdapter->CommonCfg.CentralChannel = pAdapter->CommonCfg.Channel + 2;
-                AsicSwitchChannel(pAdapter, pAdapter->CommonCfg.CentralChannel, FALSE);
-			    AsicLockChannel(pAdapter, pAdapter->CommonCfg.CentralChannel);
-                DBGPRINT(RT_DEBUG_TRACE, ("BW_40 ,control_channel(%d), CentralChannel(%d) \n",
-                                           pAdapter->CommonCfg.Channel,
-                                           pAdapter->CommonCfg.CentralChannel));
-			}
-			else if (pAdapter->CommonCfg.PhyMode >= PHY_11ABGN_MIXED &&
-                     pAdapter->CommonCfg.RegTransmitSetting.field.BW == BW_40 &&
-                     pAdapter->CommonCfg.RegTransmitSetting.field.EXTCHA == EXTCHA_BELOW)
-			{
-				// 40MHz ,control channel at upper
-				RTMP_BBP_IO_READ8_BY_REG_ID(pAdapter, BBP_R4, &bbpValue);
-				bbpValue &= (~0x18);
-				bbpValue |= 0x10;
-				RTMP_BBP_IO_WRITE8_BY_REG_ID(pAdapter, BBP_R4, bbpValue);
-				pAdapter->CommonCfg.BBPCurrentBW = BW_40;
-				RTMP_IO_READ32(pAdapter, TX_BAND_CFG, &Value);
-				Value |= 0x1;
-				RTMP_IO_WRITE32(pAdapter, TX_BAND_CFG, Value);
-
-				RTMP_BBP_IO_READ8_BY_REG_ID(pAdapter, BBP_R3, &bbpValue);
-				bbpValue |= (0x20);
-				RTMP_BBP_IO_WRITE8_BY_REG_ID(pAdapter, BBP_R3, bbpValue);
-				pAdapter->CommonCfg.CentralChannel = pAdapter->CommonCfg.Channel - 2;
-                AsicSwitchChannel(pAdapter, pAdapter->CommonCfg.CentralChannel, FALSE);
-			    AsicLockChannel(pAdapter, pAdapter->CommonCfg.CentralChannel);
-                DBGPRINT(RT_DEBUG_TRACE, ("BW_40 ,control_channel(%d), CentralChannel(%d) \n",
-                                           pAdapter->CommonCfg.Channel,
-                                           pAdapter->CommonCfg.CentralChannel));
-			}
-			else
-#endif // DOT11_N_SUPPORT //
-			{
-				// 20MHz
-				RTMP_BBP_IO_READ8_BY_REG_ID(pAdapter, BBP_R4, &bbpValue);
-				bbpValue &= (~0x18);
-				RTMP_BBP_IO_WRITE8_BY_REG_ID(pAdapter, BBP_R4, bbpValue);
-				pAdapter->CommonCfg.BBPCurrentBW = BW_20;
-                AsicSwitchChannel(pAdapter, pAdapter->CommonCfg.Channel, FALSE);
-			    AsicLockChannel(pAdapter, pAdapter->CommonCfg.Channel);
-				DBGPRINT(RT_DEBUG_TRACE, ("BW_20, Channel(%d)\n", pAdapter->CommonCfg.Channel));
-			}
-			// Enable Rx with promiscuous reception
-			RTMP_IO_WRITE32(pAdapter, RX_FILTR_CFG, 0x3);
-			// ASIC supporsts sniffer function with replacing RSSI with timestamp.
-			//RTMP_IO_READ32(pAdapter, MAC_SYS_CTRL, &Value);
-			//Value |= (0x80);
-			//RTMP_IO_WRITE32(pAdapter, MAC_SYS_CTRL, Value);
-			// disable sync
-			RTMP_IO_READ32(pAdapter, BCN_TIME_CFG, &csr.word);
-			csr.field.bBeaconGen = 0;
-			csr.field.bTBTTEnable = 0;
-			csr.field.TsfSyncMode = 0;
-			RTMP_IO_WRITE32(pAdapter, BCN_TIME_CFG, csr.word);
-
-			pAdapter->StaCfg.BssType = BSS_MONITOR;
-            pAdapter->net_dev->type = ARPHRD_IEEE80211_PRISM; //ARPHRD_IEEE80211; // IEEE80211
-			DBGPRINT(RT_DEBUG_TRACE, ("===>Set_NetworkType_Proc::(MONITOR)\n"));
-    }
-
-    // Reset Ralink supplicant to not use, it will be set to start when UI set PMK key
-    pAdapter->StaCfg.WpaState = SS_NOTUSE;
-
-    DBGPRINT(RT_DEBUG_TRACE, ("Set_NetworkType_Proc::(NetworkType=%d)\n", pAdapter->StaCfg.BssType));
-
-    return TRUE;
-}
-
-/*
-    ==========================================================================
-    Description:
-        Set Authentication mode
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT Set_AuthMode_Proc(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  PSTRING          arg)
-{
-    if ((strcmp(arg, "WEPAUTO") == 0) || (strcmp(arg, "wepauto") == 0))
-        pAdapter->StaCfg.AuthMode = Ndis802_11AuthModeAutoSwitch;
-    else if ((strcmp(arg, "OPEN") == 0) || (strcmp(arg, "open") == 0))
-        pAdapter->StaCfg.AuthMode = Ndis802_11AuthModeOpen;
-    else if ((strcmp(arg, "SHARED") == 0) || (strcmp(arg, "shared") == 0))
-        pAdapter->StaCfg.AuthMode = Ndis802_11AuthModeShared;
-    else if ((strcmp(arg, "WPAPSK") == 0) || (strcmp(arg, "wpapsk") == 0))
-        pAdapter->StaCfg.AuthMode = Ndis802_11AuthModeWPAPSK;
-    else if ((strcmp(arg, "WPANONE") == 0) || (strcmp(arg, "wpanone") == 0))
-        pAdapter->StaCfg.AuthMode = Ndis802_11AuthModeWPANone;
-    else if ((strcmp(arg, "WPA2PSK") == 0) || (strcmp(arg, "wpa2psk") == 0))
-        pAdapter->StaCfg.AuthMode = Ndis802_11AuthModeWPA2PSK;
-#ifdef WPA_SUPPLICANT_SUPPORT
-    else if ((strcmp(arg, "WPA") == 0) || (strcmp(arg, "wpa") == 0))
-        pAdapter->StaCfg.AuthMode = Ndis802_11AuthModeWPA;
-    else if ((strcmp(arg, "WPA2") == 0) || (strcmp(arg, "wpa2") == 0))
-        pAdapter->StaCfg.AuthMode = Ndis802_11AuthModeWPA2;
-#endif // WPA_SUPPLICANT_SUPPORT //
-    else
-        return FALSE;
-
-    pAdapter->StaCfg.PortSecured = WPA_802_1X_PORT_NOT_SECURED;
-
-    DBGPRINT(RT_DEBUG_TRACE, ("Set_AuthMode_Proc::(AuthMode=%d)\n", pAdapter->StaCfg.AuthMode));
-
-    return TRUE;
-}
-
-/*
-    ==========================================================================
-    Description:
-        Set Encryption Type
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT Set_EncrypType_Proc(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  PSTRING          arg)
-{
-    if ((strcmp(arg, "NONE") == 0) || (strcmp(arg, "none") == 0))
-    {
-        if (pAdapter->StaCfg.AuthMode >= Ndis802_11AuthModeWPA)
-            return TRUE;    // do nothing
-
-        pAdapter->StaCfg.WepStatus     = Ndis802_11WEPDisabled;
-        pAdapter->StaCfg.PairCipher    = Ndis802_11WEPDisabled;
-	    pAdapter->StaCfg.GroupCipher   = Ndis802_11WEPDisabled;
-    }
-    else if ((strcmp(arg, "WEP") == 0) || (strcmp(arg, "wep") == 0))
-    {
-        if (pAdapter->StaCfg.AuthMode >= Ndis802_11AuthModeWPA)
-            return TRUE;    // do nothing
-
-        pAdapter->StaCfg.WepStatus     = Ndis802_11WEPEnabled;
-        pAdapter->StaCfg.PairCipher    = Ndis802_11WEPEnabled;
-	    pAdapter->StaCfg.GroupCipher   = Ndis802_11WEPEnabled;
-    }
-    else if ((strcmp(arg, "TKIP") == 0) || (strcmp(arg, "tkip") == 0))
-    {
-        if (pAdapter->StaCfg.AuthMode < Ndis802_11AuthModeWPA)
-            return TRUE;    // do nothing
-
-        pAdapter->StaCfg.WepStatus     = Ndis802_11Encryption2Enabled;
-        pAdapter->StaCfg.PairCipher    = Ndis802_11Encryption2Enabled;
-	    pAdapter->StaCfg.GroupCipher   = Ndis802_11Encryption2Enabled;
-    }
-    else if ((strcmp(arg, "AES") == 0) || (strcmp(arg, "aes") == 0))
-    {
-        if (pAdapter->StaCfg.AuthMode < Ndis802_11AuthModeWPA)
-            return TRUE;    // do nothing
-
-        pAdapter->StaCfg.WepStatus     = Ndis802_11Encryption3Enabled;
-        pAdapter->StaCfg.PairCipher    = Ndis802_11Encryption3Enabled;
-	    pAdapter->StaCfg.GroupCipher   = Ndis802_11Encryption3Enabled;
-    }
-    else
-        return FALSE;
-
-    pAdapter->StaCfg.OrigWepStatus = pAdapter->StaCfg.WepStatus;
-
-    DBGPRINT(RT_DEBUG_TRACE, ("Set_EncrypType_Proc::(EncrypType=%d)\n", pAdapter->StaCfg.WepStatus));
-
-    return TRUE;
-}
-
-/*
-    ==========================================================================
-    Description:
-        Set Default Key ID
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT Set_DefaultKeyID_Proc(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  PSTRING          arg)
-{
-    ULONG                               KeyIdx;
-
-    KeyIdx = simple_strtol(arg, 0, 10);
-    if((KeyIdx >= 1 ) && (KeyIdx <= 4))
-        pAdapter->StaCfg.DefaultKeyId = (UCHAR) (KeyIdx - 1 );
-    else
-        return FALSE;  //Invalid argument
-
-    DBGPRINT(RT_DEBUG_TRACE, ("Set_DefaultKeyID_Proc::(DefaultKeyID=%d)\n", pAdapter->StaCfg.DefaultKeyId));
-
-    return TRUE;
-}
-
-/*
-    ==========================================================================
-    Description:
-        Set WEP KEY1
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT Set_Key1_Proc(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  PSTRING          arg)
-{
-    int                                 KeyLen;
-    int                                 i;
-    UCHAR                               CipherAlg=CIPHER_WEP64;
-
-    if (pAdapter->StaCfg.AuthMode >= Ndis802_11AuthModeWPA)
-        return TRUE;    // do nothing
-
-    KeyLen = strlen(arg);
-
-    switch (KeyLen)
-    {
-        case 5: //wep 40 Ascii type
-            pAdapter->SharedKey[BSS0][0].KeyLen = KeyLen;
-            memcpy(pAdapter->SharedKey[BSS0][0].Key, arg, KeyLen);
-            CipherAlg = CIPHER_WEP64;
-            DBGPRINT(RT_DEBUG_TRACE, ("Set_Key1_Proc::(Key1=%s and type=%s)\n", arg, "Ascii"));
-            break;
-        case 10: //wep 40 Hex type
-            for(i=0; i < KeyLen; i++)
-            {
-                if( !isxdigit(*(arg+i)) )
-                    return FALSE;  //Not Hex value;
-            }
-            pAdapter->SharedKey[BSS0][0].KeyLen = KeyLen / 2 ;
-            AtoH(arg, pAdapter->SharedKey[BSS0][0].Key, KeyLen / 2);
-            CipherAlg = CIPHER_WEP64;
-            DBGPRINT(RT_DEBUG_TRACE, ("Set_Key1_Proc::(Key1=%s and type=%s)\n", arg, "Hex"));
-            break;
-        case 13: //wep 104 Ascii type
-            pAdapter->SharedKey[BSS0][0].KeyLen = KeyLen;
-            memcpy(pAdapter->SharedKey[BSS0][0].Key, arg, KeyLen);
-            CipherAlg = CIPHER_WEP128;
-            DBGPRINT(RT_DEBUG_TRACE, ("Set_Key1_Proc::(Key1=%s and type=%s)\n", arg, "Ascii"));
-            break;
-        case 26: //wep 104 Hex type
-            for(i=0; i < KeyLen; i++)
-            {
-                if( !isxdigit(*(arg+i)) )
-                    return FALSE;  //Not Hex value;
-            }
-            pAdapter->SharedKey[BSS0][0].KeyLen = KeyLen / 2 ;
-            AtoH(arg, pAdapter->SharedKey[BSS0][0].Key, KeyLen / 2);
-            CipherAlg = CIPHER_WEP128;
-            DBGPRINT(RT_DEBUG_TRACE, ("Set_Key1_Proc::(Key1=%s and type=%s)\n", arg, "Hex"));
-            break;
-        default: //Invalid argument
-            DBGPRINT(RT_DEBUG_TRACE, ("Set_Key1_Proc::Invalid argument (=%s)\n", arg));
-            return FALSE;
-    }
-
-    pAdapter->SharedKey[BSS0][0].CipherAlg = CipherAlg;
-
-    // Set keys (into ASIC)
-    if (pAdapter->StaCfg.AuthMode >= Ndis802_11AuthModeWPA)
-        ;   // not support
-    else    // Old WEP stuff
-    {
-        AsicAddSharedKeyEntry(pAdapter,
-                              0,
-                              0,
-                              pAdapter->SharedKey[BSS0][0].CipherAlg,
-                              pAdapter->SharedKey[BSS0][0].Key,
-                              NULL,
-                              NULL);
-    }
-
-    return TRUE;
-}
-/*
-    ==========================================================================
-
-    Description:
-        Set WEP KEY2
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT Set_Key2_Proc(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  PSTRING          arg)
-{
-    int                                 KeyLen;
-    int                                 i;
-    UCHAR                               CipherAlg=CIPHER_WEP64;
-
-    if (pAdapter->StaCfg.AuthMode >= Ndis802_11AuthModeWPA)
-        return TRUE;    // do nothing
-
-    KeyLen = strlen(arg);
-
-    switch (KeyLen)
-    {
-        case 5: //wep 40 Ascii type
-            pAdapter->SharedKey[BSS0][1].KeyLen = KeyLen;
-            memcpy(pAdapter->SharedKey[BSS0][1].Key, arg, KeyLen);
-            CipherAlg = CIPHER_WEP64;
-            DBGPRINT(RT_DEBUG_TRACE, ("Set_Key2_Proc::(Key2=%s and type=%s)\n", arg, "Ascii"));
-            break;
-        case 10: //wep 40 Hex type
-            for(i=0; i < KeyLen; i++)
-            {
-                if( !isxdigit(*(arg+i)) )
-                    return FALSE;  //Not Hex value;
-            }
-            pAdapter->SharedKey[BSS0][1].KeyLen = KeyLen / 2 ;
-            AtoH(arg, pAdapter->SharedKey[BSS0][1].Key, KeyLen / 2);
-            CipherAlg = CIPHER_WEP64;
-            DBGPRINT(RT_DEBUG_TRACE, ("Set_Key2_Proc::(Key2=%s and type=%s)\n", arg, "Hex"));
-            break;
-        case 13: //wep 104 Ascii type
-            pAdapter->SharedKey[BSS0][1].KeyLen = KeyLen;
-            memcpy(pAdapter->SharedKey[BSS0][1].Key, arg, KeyLen);
-            CipherAlg = CIPHER_WEP128;
-            DBGPRINT(RT_DEBUG_TRACE, ("Set_Key2_Proc::(Key2=%s and type=%s)\n", arg, "Ascii"));
-            break;
-        case 26: //wep 104 Hex type
-            for(i=0; i < KeyLen; i++)
-            {
-                if( !isxdigit(*(arg+i)) )
-                    return FALSE;  //Not Hex value;
-            }
-            pAdapter->SharedKey[BSS0][1].KeyLen = KeyLen / 2 ;
-            AtoH(arg, pAdapter->SharedKey[BSS0][1].Key, KeyLen / 2);
-            CipherAlg = CIPHER_WEP128;
-            DBGPRINT(RT_DEBUG_TRACE, ("Set_Key2_Proc::(Key2=%s and type=%s)\n", arg, "Hex"));
-            break;
-        default: //Invalid argument
-            DBGPRINT(RT_DEBUG_TRACE, ("Set_Key2_Proc::Invalid argument (=%s)\n", arg));
-            return FALSE;
-    }
-    pAdapter->SharedKey[BSS0][1].CipherAlg = CipherAlg;
-
-    // Set keys (into ASIC)
-    if (pAdapter->StaCfg.AuthMode >= Ndis802_11AuthModeWPA)
-        ;   // not support
-    else    // Old WEP stuff
-    {
-        AsicAddSharedKeyEntry(pAdapter,
-                              0,
-                              1,
-                              pAdapter->SharedKey[BSS0][1].CipherAlg,
-                              pAdapter->SharedKey[BSS0][1].Key,
-                              NULL,
-                              NULL);
-    }
-
-    return TRUE;
-}
-/*
-    ==========================================================================
-    Description:
-        Set WEP KEY3
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT Set_Key3_Proc(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  PSTRING          arg)
-{
-    int                                 KeyLen;
-    int                                 i;
-    UCHAR                               CipherAlg=CIPHER_WEP64;
-
-    if (pAdapter->StaCfg.AuthMode >= Ndis802_11AuthModeWPA)
-        return TRUE;    // do nothing
-
-    KeyLen = strlen(arg);
-
-    switch (KeyLen)
-    {
-        case 5: //wep 40 Ascii type
-            pAdapter->SharedKey[BSS0][2].KeyLen = KeyLen;
-            memcpy(pAdapter->SharedKey[BSS0][2].Key, arg, KeyLen);
-            CipherAlg = CIPHER_WEP64;
-            DBGPRINT(RT_DEBUG_TRACE, ("Set_Key3_Proc::(Key3=%s and type=Ascii)\n", arg));
-            break;
-        case 10: //wep 40 Hex type
-            for(i=0; i < KeyLen; i++)
-            {
-                if( !isxdigit(*(arg+i)) )
-                    return FALSE;  //Not Hex value;
-            }
-            pAdapter->SharedKey[BSS0][2].KeyLen = KeyLen / 2 ;
-            AtoH(arg, pAdapter->SharedKey[BSS0][2].Key, KeyLen / 2);
-            CipherAlg = CIPHER_WEP64;
-            DBGPRINT(RT_DEBUG_TRACE, ("Set_Key3_Proc::(Key3=%s and type=Hex)\n", arg));
-            break;
-        case 13: //wep 104 Ascii type
-            pAdapter->SharedKey[BSS0][2].KeyLen = KeyLen;
-            memcpy(pAdapter->SharedKey[BSS0][2].Key, arg, KeyLen);
-            CipherAlg = CIPHER_WEP128;
-            DBGPRINT(RT_DEBUG_TRACE, ("Set_Key3_Proc::(Key3=%s and type=Ascii)\n", arg));
-            break;
-        case 26: //wep 104 Hex type
-            for(i=0; i < KeyLen; i++)
-            {
-                if( !isxdigit(*(arg+i)) )
-                    return FALSE;  //Not Hex value;
-            }
-            pAdapter->SharedKey[BSS0][2].KeyLen = KeyLen / 2 ;
-            AtoH(arg, pAdapter->SharedKey[BSS0][2].Key, KeyLen / 2);
-            CipherAlg = CIPHER_WEP128;
-            DBGPRINT(RT_DEBUG_TRACE, ("Set_Key3_Proc::(Key3=%s and type=Hex)\n", arg));
-            break;
-        default: //Invalid argument
-            DBGPRINT(RT_DEBUG_TRACE, ("Set_Key3_Proc::Invalid argument (=%s)\n", arg));
-            return FALSE;
-    }
-    pAdapter->SharedKey[BSS0][2].CipherAlg = CipherAlg;
-
-    // Set keys (into ASIC)
-    if (pAdapter->StaCfg.AuthMode >= Ndis802_11AuthModeWPA)
-        ;   // not support
-    else    // Old WEP stuff
-    {
-        AsicAddSharedKeyEntry(pAdapter,
-                              0,
-                              2,
-                              pAdapter->SharedKey[BSS0][2].CipherAlg,
-                              pAdapter->SharedKey[BSS0][2].Key,
-                              NULL,
-                              NULL);
-    }
-
-    return TRUE;
-}
-/*
-    ==========================================================================
-    Description:
-        Set WEP KEY4
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT Set_Key4_Proc(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  PSTRING          arg)
-{
-    int                                 KeyLen;
-    int                                 i;
-    UCHAR                               CipherAlg=CIPHER_WEP64;
-
-    if (pAdapter->StaCfg.AuthMode >= Ndis802_11AuthModeWPA)
-        return TRUE;    // do nothing
-
-    KeyLen = strlen(arg);
-
-    switch (KeyLen)
-    {
-        case 5: //wep 40 Ascii type
-            pAdapter->SharedKey[BSS0][3].KeyLen = KeyLen;
-            memcpy(pAdapter->SharedKey[BSS0][3].Key, arg, KeyLen);
-            CipherAlg = CIPHER_WEP64;
-            DBGPRINT(RT_DEBUG_TRACE, ("Set_Key4_Proc::(Key4=%s and type=%s)\n", arg, "Ascii"));
-            break;
-        case 10: //wep 40 Hex type
-            for(i=0; i < KeyLen; i++)
-            {
-                if( !isxdigit(*(arg+i)) )
-                    return FALSE;  //Not Hex value;
-            }
-            pAdapter->SharedKey[BSS0][3].KeyLen = KeyLen / 2 ;
-            AtoH(arg, pAdapter->SharedKey[BSS0][3].Key, KeyLen / 2);
-            CipherAlg = CIPHER_WEP64;
-            DBGPRINT(RT_DEBUG_TRACE, ("Set_Key4_Proc::(Key4=%s and type=%s)\n", arg, "Hex"));
-            break;
-        case 13: //wep 104 Ascii type
-            pAdapter->SharedKey[BSS0][3].KeyLen = KeyLen;
-            memcpy(pAdapter->SharedKey[BSS0][3].Key, arg, KeyLen);
-            CipherAlg = CIPHER_WEP128;
-            DBGPRINT(RT_DEBUG_TRACE, ("Set_Key4_Proc::(Key4=%s and type=%s)\n", arg, "Ascii"));
-            break;
-        case 26: //wep 104 Hex type
-            for(i=0; i < KeyLen; i++)
-            {
-                if( !isxdigit(*(arg+i)) )
-                    return FALSE;  //Not Hex value;
-            }
-            pAdapter->SharedKey[BSS0][3].KeyLen = KeyLen / 2 ;
-            AtoH(arg, pAdapter->SharedKey[BSS0][3].Key, KeyLen / 2);
-            CipherAlg = CIPHER_WEP128;
-            DBGPRINT(RT_DEBUG_TRACE, ("Set_Key4_Proc::(Key4=%s and type=%s)\n", arg, "Hex"));
-            break;
-        default: //Invalid argument
-            DBGPRINT(RT_DEBUG_TRACE, ("Set_Key4_Proc::Invalid argument (=%s)\n", arg));
-            return FALSE;
-    }
-    pAdapter->SharedKey[BSS0][3].CipherAlg = CipherAlg;
-
-    // Set keys (into ASIC)
-    if (pAdapter->StaCfg.AuthMode >= Ndis802_11AuthModeWPA)
-        ;   // not support
-    else    // Old WEP stuff
-    {
-        AsicAddSharedKeyEntry(pAdapter,
-                              0,
-                              3,
-                              pAdapter->SharedKey[BSS0][3].CipherAlg,
-                              pAdapter->SharedKey[BSS0][3].Key,
-                              NULL,
-                              NULL);
-    }
-
-    return TRUE;
-}
-
-/*
-    ==========================================================================
-    Description:
-        Set WPA PSK key
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT Set_WPAPSK_Proc(
-    IN  PRTMP_ADAPTER   pAd,
-    IN  PSTRING          arg)
-{
-    int status;
-
-    if ((pAd->StaCfg.AuthMode != Ndis802_11AuthModeWPAPSK) &&
-        (pAd->StaCfg.AuthMode != Ndis802_11AuthModeWPA2PSK) &&
-	    (pAd->StaCfg.AuthMode != Ndis802_11AuthModeWPANone)
-		)
-        return TRUE;    // do nothing
-
-    DBGPRINT(RT_DEBUG_TRACE, ("Set_WPAPSK_Proc::(WPAPSK=%s)\n", arg));
-
-	status = RT_CfgSetWPAPSKKey(pAd, arg, pAd->MlmeAux.Ssid, pAd->MlmeAux.SsidLen, pAd->StaCfg.PMK);
-	if (status == FALSE)
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("Set_WPAPSK_Proc(): Set key failed!\n"));
-		return FALSE;
-	}
-	NdisZeroMemory(pAd->StaCfg.WpaPassPhrase, 64);
-    NdisMoveMemory(pAd->StaCfg.WpaPassPhrase, arg, strlen(arg));
-    pAd->StaCfg.WpaPassPhraseLen = (UINT)strlen(arg);
-
-
-
-    if(pAd->StaCfg.BssType == BSS_ADHOC &&
-       pAd->StaCfg.AuthMode == Ndis802_11AuthModeWPANone)
-    {
-        pAd->StaCfg.WpaState = SS_NOTUSE;
-    }
-    else
-    {
-        // Start STA supplicant state machine
-        pAd->StaCfg.WpaState = SS_START;
-    }
-
-    return TRUE;
-}
-
-/*
-    ==========================================================================
-    Description:
-        Set Power Saving mode
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT Set_PSMode_Proc(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  PSTRING          arg)
-{
-    if (pAdapter->StaCfg.BssType == BSS_INFRA)
-    {
-        if ((strcmp(arg, "Max_PSP") == 0) ||
-			(strcmp(arg, "max_psp") == 0) ||
-			(strcmp(arg, "MAX_PSP") == 0))
-        {
-            // do NOT turn on PSM bit here, wait until MlmeCheckPsmChange()
-            // to exclude certain situations.
-            if (pAdapter->StaCfg.bWindowsACCAMEnable == FALSE)
-                pAdapter->StaCfg.WindowsPowerMode = Ndis802_11PowerModeMAX_PSP;
-            pAdapter->StaCfg.WindowsBatteryPowerMode = Ndis802_11PowerModeMAX_PSP;
-            OPSTATUS_SET_FLAG(pAdapter, fOP_STATUS_RECEIVE_DTIM);
-            pAdapter->StaCfg.DefaultListenCount = 5;
-
-        }
-        else if ((strcmp(arg, "Fast_PSP") == 0) ||
-				 (strcmp(arg, "fast_psp") == 0) ||
-                 (strcmp(arg, "FAST_PSP") == 0))
-        {
-            // do NOT turn on PSM bit here, wait until MlmeCheckPsmChange()
-            // to exclude certain situations.
-            OPSTATUS_SET_FLAG(pAdapter, fOP_STATUS_RECEIVE_DTIM);
-            if (pAdapter->StaCfg.bWindowsACCAMEnable == FALSE)
-                pAdapter->StaCfg.WindowsPowerMode = Ndis802_11PowerModeFast_PSP;
-            pAdapter->StaCfg.WindowsBatteryPowerMode = Ndis802_11PowerModeFast_PSP;
-            pAdapter->StaCfg.DefaultListenCount = 3;
-        }
-        else if ((strcmp(arg, "Legacy_PSP") == 0) ||
-                 (strcmp(arg, "legacy_psp") == 0) ||
-                 (strcmp(arg, "LEGACY_PSP") == 0))
-        {
-            // do NOT turn on PSM bit here, wait until MlmeCheckPsmChange()
-            // to exclude certain situations.
-            OPSTATUS_SET_FLAG(pAdapter, fOP_STATUS_RECEIVE_DTIM);
-            if (pAdapter->StaCfg.bWindowsACCAMEnable == FALSE)
-                pAdapter->StaCfg.WindowsPowerMode = Ndis802_11PowerModeLegacy_PSP;
-            pAdapter->StaCfg.WindowsBatteryPowerMode = Ndis802_11PowerModeLegacy_PSP;
-            pAdapter->StaCfg.DefaultListenCount = 3;
-        }
-        else
-        {
-            //Default Ndis802_11PowerModeCAM
-            // clear PSM bit immediately
-            RTMP_SET_PSM_BIT(pAdapter, PWR_ACTIVE);
-            OPSTATUS_SET_FLAG(pAdapter, fOP_STATUS_RECEIVE_DTIM);
-            if (pAdapter->StaCfg.bWindowsACCAMEnable == FALSE)
-                pAdapter->StaCfg.WindowsPowerMode = Ndis802_11PowerModeCAM;
-            pAdapter->StaCfg.WindowsBatteryPowerMode = Ndis802_11PowerModeCAM;
-        }
-
-        DBGPRINT(RT_DEBUG_TRACE, ("Set_PSMode_Proc::(PSMode=%ld)\n", pAdapter->StaCfg.WindowsPowerMode));
-    }
-    else
-        return FALSE;
-
-
-    return TRUE;
-}
-//Add to suport the function which clould dynamicallly enable/disable PCIe Power Saving
-
-#ifdef WPA_SUPPLICANT_SUPPORT
-/*
-    ==========================================================================
-    Description:
-        Set WpaSupport flag.
-    Value:
-        0: Driver ignore wpa_supplicant.
-        1: wpa_supplicant initiates scanning and AP selection.
-        2: driver takes care of scanning, AP selection, and IEEE 802.11 association parameters.
-    Return:
-        TRUE if all parameters are OK, FALSE otherwise
-    ==========================================================================
-*/
-INT Set_Wpa_Support(
-    IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-
-    if ( simple_strtol(arg, 0, 10) == 0)
-        pAd->StaCfg.WpaSupplicantUP = WPA_SUPPLICANT_DISABLE;
-    else if ( simple_strtol(arg, 0, 10) == 1)
-        pAd->StaCfg.WpaSupplicantUP = WPA_SUPPLICANT_ENABLE;
-    else if ( simple_strtol(arg, 0, 10) == 2)
-        pAd->StaCfg.WpaSupplicantUP = WPA_SUPPLICANT_ENABLE_WITH_WEB_UI;
-    else
-        pAd->StaCfg.WpaSupplicantUP = WPA_SUPPLICANT_DISABLE;
-
-    DBGPRINT(RT_DEBUG_TRACE, ("Set_Wpa_Support::(WpaSupplicantUP=%d)\n", pAd->StaCfg.WpaSupplicantUP));
-
-    return TRUE;
-}
-#endif // WPA_SUPPLICANT_SUPPORT //
-
-#ifdef DBG
-/*
-    ==========================================================================
-    Description:
-        Read / Write MAC
-    Arguments:
-        pAdapter                    Pointer to our adapter
-        wrq                         Pointer to the ioctl argument
-
-    Return Value:
-        None
-
-    Note:
-        Usage:
-               1.) iwpriv ra0 mac 0        ==> read MAC where Addr=0x0
-               2.) iwpriv ra0 mac 0=12     ==> write MAC where Addr=0x0, value=12
-    ==========================================================================
-*/
-VOID RTMPIoctlMAC(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq)
-{
-	PSTRING				this_char;
-	PSTRING				value;
-	INT					j = 0, k = 0;
-	STRING				msg[1024];
-	STRING				arg[255];
-	ULONG				macAddr = 0;
-	UCHAR				temp[16];
-	STRING				temp2[16];
-	UINT32				macValue = 0;
-	INT					Status;
-	BOOLEAN				bIsPrintAllMAC = FALSE;
-
-
-	memset(msg, 0x00, 1024);
-	if (wrq->u.data.length > 1) //No parameters.
-	{
-	    Status = copy_from_user(arg, wrq->u.data.pointer, (wrq->u.data.length > 255) ? 255 : wrq->u.data.length);
-		sprintf(msg, "\n");
-
-		//Parsing Read or Write
-	    this_char = arg;
-		if (!*this_char)
-			goto next;
-
-		if ((value = rtstrchr(this_char, '=')) != NULL)
-			*value++ = 0;
-
-		if (!value || !*value)
-		{ //Read
-			// Sanity check
-			if(strlen(this_char) > 4)
-				goto next;
-
-			j = strlen(this_char);
-			while(j-- > 0)
-			{
-				if(this_char[j] > 'f' || this_char[j] < '0')
-					return;
-			}
-
-			// Mac Addr
-			k = j = strlen(this_char);
-			while(j-- > 0)
-			{
-				this_char[4-k+j] = this_char[j];
-			}
-
-			while(k < 4)
-				this_char[3-k++]='0';
-			this_char[4]='\0';
-
-			if(strlen(this_char) == 4)
-			{
-				AtoH(this_char, temp, 2);
-				macAddr = *temp*256 + temp[1];
-				if (macAddr < 0xFFFF)
-				{
-					RTMP_IO_READ32(pAdapter, macAddr, &macValue);
-					DBGPRINT(RT_DEBUG_TRACE, ("MacAddr=%lx, MacValue=%x\n", macAddr, macValue));
-					sprintf(msg+strlen(msg), "[0x%08lX]:%08X  ", macAddr , macValue);
-				}
-				else
-				{//Invalid parametes, so default printk all mac
-					bIsPrintAllMAC = TRUE;
-					goto next;
-				}
-			}
-		}
-		else
-		{ //Write
-			memcpy(&temp2, value, strlen(value));
-			temp2[strlen(value)] = '\0';
-
-			// Sanity check
-			if((strlen(this_char) > 4) || strlen(temp2) > 8)
-				goto next;
-
-			j = strlen(this_char);
-			while(j-- > 0)
-			{
-				if(this_char[j] > 'f' || this_char[j] < '0')
-					return;
-			}
-
-			j = strlen(temp2);
-			while(j-- > 0)
-			{
-				if(temp2[j] > 'f' || temp2[j] < '0')
-					return;
-			}
-
-			//MAC Addr
-			k = j = strlen(this_char);
-			while(j-- > 0)
-			{
-				this_char[4-k+j] = this_char[j];
-			}
-
-			while(k < 4)
-				this_char[3-k++]='0';
-			this_char[4]='\0';
-
-			//MAC value
-			k = j = strlen(temp2);
-			while(j-- > 0)
-			{
-				temp2[8-k+j] = temp2[j];
-			}
-
-			while(k < 8)
-				temp2[7-k++]='0';
-			temp2[8]='\0';
-
-			{
-				AtoH(this_char, temp, 2);
-				macAddr = *temp*256 + temp[1];
-
-				AtoH(temp2, temp, 4);
-				macValue = *temp*256*256*256 + temp[1]*256*256 + temp[2]*256 + temp[3];
-
-				// debug mode
-				if (macAddr == (HW_DEBUG_SETTING_BASE + 4))
-				{
-					// 0x2bf4: byte0 non-zero: enable R17 tuning, 0: disable R17 tuning
-                    if (macValue & 0x000000ff)
-                    {
-                        pAdapter->BbpTuning.bEnable = TRUE;
-                        DBGPRINT(RT_DEBUG_TRACE,("turn on R17 tuning\n"));
-                    }
-                    else
-                    {
-                        UCHAR R66;
-                        pAdapter->BbpTuning.bEnable = FALSE;
-                        R66 = 0x26 + GET_LNA_GAIN(pAdapter);
-#ifdef RALINK_ATE
-						if (ATE_ON(pAdapter))
-						{
-							ATE_BBP_IO_WRITE8_BY_REG_ID(pAdapter, BBP_R66, (0x26 + GET_LNA_GAIN(pAdapter)));
-						}
-						else
-#endif // RALINK_ATE //
-
-							RTMP_BBP_IO_WRITE8_BY_REG_ID(pAdapter, BBP_R66, (0x26 + GET_LNA_GAIN(pAdapter)));
-                        DBGPRINT(RT_DEBUG_TRACE,("turn off R17 tuning, restore to 0x%02x\n", R66));
-                    }
-					return;
-				}
-
-				DBGPRINT(RT_DEBUG_TRACE, ("MacAddr=%02lx, MacValue=0x%x\n", macAddr, macValue));
-
-				RTMP_IO_WRITE32(pAdapter, macAddr, macValue);
-				sprintf(msg+strlen(msg), "[0x%08lX]:%08X  ", macAddr, macValue);
-			}
-		}
-	}
-	else
-		bIsPrintAllMAC = TRUE;
-next:
-	if (bIsPrintAllMAC)
-	{
-		struct file		*file_w;
-		PSTRING			fileName = "MacDump.txt";
-		mm_segment_t	orig_fs;
-
-		orig_fs = get_fs();
-		set_fs(KERNEL_DS);
-
-		// open file
-		file_w = filp_open(fileName, O_WRONLY|O_CREAT, 0);
-		if (IS_ERR(file_w))
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("-->2) %s: Error %ld opening %s\n", __FUNCTION__, -PTR_ERR(file_w), fileName));
-		}
-		else
-		{
-			if (file_w->f_op && file_w->f_op->write)
-			{
-				file_w->f_pos = 0;
-				macAddr = 0x1000;
-
-				while (macAddr <= 0x1800)
-				{
-					RTMP_IO_READ32(pAdapter, macAddr, &macValue);
-					sprintf(msg, "%08lx = %08X\n", macAddr, macValue);
-
-					// write data to file
-					file_w->f_op->write(file_w, msg, strlen(msg), &file_w->f_pos);
-
-					printk("%s", msg);
-					macAddr += 4;
-				}
-				sprintf(msg, "\nDump all MAC values to %s\n", fileName);
-			}
-			filp_close(file_w, NULL);
-		}
-		set_fs(orig_fs);
-	}
-	if(strlen(msg) == 1)
-		sprintf(msg+strlen(msg), "===>Error command format!");
-
-	// Copy the information into the user buffer
-	wrq->u.data.length = strlen(msg);
-	Status = copy_to_user(wrq->u.data.pointer, msg, wrq->u.data.length);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("<==RTMPIoctlMAC\n\n"));
-}
-
-/*
-    ==========================================================================
-    Description:
-        Read / Write E2PROM
-    Arguments:
-        pAdapter                    Pointer to our adapter
-        wrq                         Pointer to the ioctl argument
-
-    Return Value:
-        None
-
-    Note:
-        Usage:
-               1.) iwpriv ra0 e2p 0		==> read E2PROM where Addr=0x0
-               2.) iwpriv ra0 e2p 0=1234    ==> write E2PROM where Addr=0x0, value=1234
-    ==========================================================================
-*/
-VOID RTMPIoctlE2PROM(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq)
-{
-	PSTRING				this_char;
-	PSTRING				value;
-	INT					j = 0, k = 0;
-	STRING				msg[1024];
-	STRING				arg[255];
-	USHORT				eepAddr = 0;
-	UCHAR				temp[16];
-	STRING				temp2[16];
-	USHORT				eepValue;
-	int					Status;
-	BOOLEAN				bIsPrintAllE2P = FALSE;
-
-
-	memset(msg, 0x00, 1024);
-	if (wrq->u.data.length > 1) //No parameters.
-	{
-	    Status = copy_from_user(arg, wrq->u.data.pointer, (wrq->u.data.length > 255) ? 255 : wrq->u.data.length);
-		sprintf(msg, "\n");
-
-	    //Parsing Read or Write
-		this_char = arg;
-
-
-		if (!*this_char)
-			goto next;
-
-		if ((value = rtstrchr(this_char, '=')) != NULL)
-			*value++ = 0;
-
-		if (!value || !*value)
-		{ //Read
-
-			// Sanity check
-			if(strlen(this_char) > 4)
-				goto next;
-
-			j = strlen(this_char);
-			while(j-- > 0)
-			{
-				if(this_char[j] > 'f' || this_char[j] < '0')
-					return;
-			}
-
-			// E2PROM addr
-			k = j = strlen(this_char);
-			while(j-- > 0)
-			{
-				this_char[4-k+j] = this_char[j];
-			}
-
-			while(k < 4)
-				this_char[3-k++]='0';
-			this_char[4]='\0';
-
-			if(strlen(this_char) == 4)
-			{
-				AtoH(this_char, temp, 2);
-				eepAddr = *temp*256 + temp[1];
-				if (eepAddr < 0xFFFF)
-				{
-					RT28xx_EEPROM_READ16(pAdapter, eepAddr, eepValue);
-					sprintf(msg+strlen(msg), "[0x%04X]:0x%04X  ", eepAddr , eepValue);
-				}
-				else
-				{//Invalid parametes, so default printk all bbp
-					bIsPrintAllE2P = TRUE;
-					goto next;
-				}
-			}
-		}
-		else
-		{ //Write
-			memcpy(&temp2, value, strlen(value));
-			temp2[strlen(value)] = '\0';
-
-			// Sanity check
-			if((strlen(this_char) > 4) || strlen(temp2) > 8)
-				goto next;
-
-			j = strlen(this_char);
-			while(j-- > 0)
-			{
-				if(this_char[j] > 'f' || this_char[j] < '0')
-					return;
-			}
-			j = strlen(temp2);
-			while(j-- > 0)
-			{
-				if(temp2[j] > 'f' || temp2[j] < '0')
-					return;
-			}
-
-			//MAC Addr
-			k = j = strlen(this_char);
-			while(j-- > 0)
-			{
-				this_char[4-k+j] = this_char[j];
-			}
-
-			while(k < 4)
-				this_char[3-k++]='0';
-			this_char[4]='\0';
-
-			//MAC value
-			k = j = strlen(temp2);
-			while(j-- > 0)
-			{
-				temp2[4-k+j] = temp2[j];
-			}
-
-			while(k < 4)
-				temp2[3-k++]='0';
-			temp2[4]='\0';
-
-			AtoH(this_char, temp, 2);
-			eepAddr = *temp*256 + temp[1];
-
-			AtoH(temp2, temp, 2);
-			eepValue = *temp*256 + temp[1];
-
-			RT28xx_EEPROM_WRITE16(pAdapter, eepAddr, eepValue);
-			sprintf(msg+strlen(msg), "[0x%02X]:%02X  ", eepAddr, eepValue);
-		}
-	}
-	else
-		bIsPrintAllE2P = TRUE;
-next:
-	if (bIsPrintAllE2P)
-	{
-		struct file		*file_w;
-		PSTRING			fileName = "EEPROMDump.txt";
-		mm_segment_t	orig_fs;
-
-		orig_fs = get_fs();
-		set_fs(KERNEL_DS);
-
-		// open file
-		file_w = filp_open(fileName, O_WRONLY|O_CREAT, 0);
-		if (IS_ERR(file_w))
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("-->2) %s: Error %ld opening %s\n", __FUNCTION__, -PTR_ERR(file_w), fileName));
-		}
-		else
-		{
-			if (file_w->f_op && file_w->f_op->write)
-			{
-				file_w->f_pos = 0;
-				eepAddr = 0x00;
-
-				while (eepAddr <= 0xFE)
-				{
-					RT28xx_EEPROM_READ16(pAdapter, eepAddr, eepValue);
-					sprintf(msg, "%08x = %04x\n", eepAddr , eepValue);
-
-					// write data to file
-					file_w->f_op->write(file_w, msg, strlen(msg), &file_w->f_pos);
-
-					printk("%s", msg);
-					eepAddr += 2;
-				}
-				sprintf(msg, "\nDump all EEPROM values to %s\n", fileName);
-			}
-			filp_close(file_w, NULL);
-		}
-		set_fs(orig_fs);
-	}
-	if(strlen(msg) == 1)
-		sprintf(msg+strlen(msg), "===>Error command format!");
-
-
-	// Copy the information into the user buffer
-	wrq->u.data.length = strlen(msg);
-	Status = copy_to_user(wrq->u.data.pointer, msg, wrq->u.data.length);
-
-	DBGPRINT(RT_DEBUG_TRACE, ("<==RTMPIoctlE2PROM\n"));
-}
-
-
-#ifdef RT30xx
-/*
-    ==========================================================================
-    Description:
-        Read / Write RF register
-Arguments:
-    pAdapter                    Pointer to our adapter
-    wrq                         Pointer to the ioctl argument
-
-    Return Value:
-        None
-
-    Note:
-        Usage:
-               1.) iwpriv ra0 rf                ==> read all RF registers
-               2.) iwpriv ra0 rf 1              ==> read RF where RegID=1
-               3.) iwpriv ra0 rf 1=10		    ==> write RF R1=0x10
-    ==========================================================================
-*/
-VOID RTMPIoctlRF(
-	IN	PRTMP_ADAPTER	pAdapter,
-	IN	struct iwreq	*wrq)
-{
-	CHAR				*this_char;
-	CHAR				*value;
-	UCHAR				regRF = 0;
-	STRING				msg[2048];
-	CHAR				arg[255];
-	INT					rfId;
-	LONG				rfValue;
-	int					Status;
-	BOOLEAN				bIsPrintAllRF = FALSE;
-
-
-	memset(msg, 0x00, 2048);
-	if (wrq->u.data.length > 1) //No parameters.
-	{
-	    Status = copy_from_user(arg, wrq->u.data.pointer, (wrq->u.data.length > 255) ? 255 : wrq->u.data.length);
-		sprintf(msg, "\n");
-
-	    //Parsing Read or Write
-		this_char = arg;
-		if (!*this_char)
-			goto next;
-
-		if ((value = strchr(this_char, '=')) != NULL)
-			*value++ = 0;
-
-		if (!value || !*value)
-		{ //Read
-			if (sscanf((PSTRING) this_char, "%d", &(rfId)) == 1)
-			{
-				if (rfId <= 31)
-				{
-#ifdef RALINK_ATE
-					/*
-						In RT2860 ATE mode, we do not load 8051 firmware.
-	                    We must access RF directly.
-						For RT2870 ATE mode, ATE_RF_IO_WRITE8(/READ8)_BY_REG_ID are redefined.
-					*/
-					if (ATE_ON(pAdapter))
-					{
-						ATE_RF_IO_READ8_BY_REG_ID(pAdapter, rfId, &regRF);
-					}
-					else
-#endif // RALINK_ATE //
-					// according to Andy, Gary, David require.
-					// the command rf shall read rf register directly for dubug.
-					// BBP_IO_READ8_BY_REG_ID(pAdapter, bbpId, &regBBP);
-					RT30xxReadRFRegister(pAdapter, rfId, &regRF);
-
-					sprintf(msg+strlen(msg), "R%02d[0x%02x]:%02X  ", rfId, rfId, regRF);
-				}
-				else
-				{//Invalid parametes, so default printk all RF
-					bIsPrintAllRF = TRUE;
-					goto next;
-				}
-			}
-			else
-			{ //Invalid parametes, so default printk all RF
-				bIsPrintAllRF = TRUE;
-				goto next;
-			}
-		}
-		else
-		{ //Write
-			if ((sscanf((PSTRING) this_char, "%d", &(rfId)) == 1) && (sscanf((PSTRING) value, "%lx", &(rfValue)) == 1))
-			{
-				if (rfId <= 31)
-				{
-#ifdef RALINK_ATE
-						/*
-							In RT2860 ATE mode, we do not load 8051 firmware.
-		                    We must access RF directly.
-							For RT2870 ATE mode, ATE_RF_IO_WRITE8(/READ8)_BY_REG_ID are redefined.
-						*/
-						if (ATE_ON(pAdapter))
-						{
-							ATE_RF_IO_READ8_BY_REG_ID(pAdapter, rfId, &regRF);
-							ATE_RF_IO_WRITE8_BY_REG_ID(pAdapter, (UCHAR)rfId,(UCHAR) rfValue);
-							//Read it back for showing
-							ATE_RF_IO_READ8_BY_REG_ID(pAdapter, rfId, &regRF);
-							sprintf(msg+strlen(msg), "R%02d[0x%02X]:%02X\n", rfId, rfId, regRF);
-						}
-						else
-#endif // RALINK_ATE //
-						{
-							// according to Andy, Gary, David require.
-							// the command RF shall read/write RF register directly for dubug.
-							//BBP_IO_READ8_BY_REG_ID(pAdapter, bbpId, &regBBP);
-							//BBP_IO_WRITE8_BY_REG_ID(pAdapter, (UCHAR)bbpId,(UCHAR) bbpValue);
-							RT30xxReadRFRegister(pAdapter, rfId, &regRF);
-							RT30xxWriteRFRegister(pAdapter, (UCHAR)rfId,(UCHAR) rfValue);
-							//Read it back for showing
-							//BBP_IO_READ8_BY_REG_ID(pAdapter, bbpId, &regBBP);
-							RT30xxReadRFRegister(pAdapter, rfId, &regRF);
-			                sprintf(msg+strlen(msg), "R%02d[0x%02X]:%02X\n", rfId, rfId, regRF);
-				                }
-				}
-				else
-				{//Invalid parametes, so default printk all RF
-					bIsPrintAllRF = TRUE;
-				}
-			}
-			else
-			{ //Invalid parametes, so default printk all RF
-				bIsPrintAllRF = TRUE;
-			}
-		}
-	}
-	else
-		bIsPrintAllRF = TRUE;
-next:
-	if (bIsPrintAllRF)
-	{
-		memset(msg, 0x00, 2048);
-		sprintf(msg, "\n");
-		for (rfId = 0; rfId <= 31; rfId++)
-		{
-#ifdef RALINK_ATE
-			/*
-				In RT2860 ATE mode, we do not load 8051 firmware.
-                We must access RF directly.
-				For RT2870 ATE mode, ATE_RF_IO_WRITE8(/READ8)_BY_REG_ID are redefined.
-			*/
-			if (ATE_ON(pAdapter))
-			{
-				ATE_RF_IO_READ8_BY_REG_ID(pAdapter, rfId, &regRF);
-			}
-			else
-#endif // RALINK_ATE //
-
-			// according to Andy, Gary, David require.
-			// the command RF shall read/write RF register directly for dubug.
-			RT30xxReadRFRegister(pAdapter, rfId, &regRF);
-			sprintf(msg+strlen(msg), "%03d = %02X\n", rfId, regRF);
-		}
-		// Copy the information into the user buffer
-		DBGPRINT(RT_DEBUG_TRACE, ("strlen(msg)=%d\n", (UINT32)strlen(msg)));
-		wrq->u.data.length = strlen(msg);
-		if (copy_to_user(wrq->u.data.pointer, msg, wrq->u.data.length))
-		{
-			DBGPRINT(RT_DEBUG_TRACE, ("%s: copy_to_user() fail\n", __FUNCTION__));
-		}
-	}
-	else
-	{
-		if(strlen(msg) == 1)
-			sprintf(msg+strlen(msg), "===>Error command format!");
-
-		DBGPRINT(RT_DEBUG_TRACE, ("copy to user [msg=%s]\n", msg));
-		// Copy the information into the user buffer
-		DBGPRINT(RT_DEBUG_TRACE, ("strlen(msg) =%d\n", (UINT32)strlen(msg)));
-
-		// Copy the information into the user buffer
-		wrq->u.data.length = strlen(msg);
-		Status = copy_to_user(wrq->u.data.pointer, msg, wrq->u.data.length);
-	}
-
-	DBGPRINT(RT_DEBUG_TRACE, ("<==RTMPIoctlRF\n\n"));
-}
-#endif // RT30xx //
-#endif // DBG //
-
-
-
-
-INT Set_TGnWifiTest_Proc(
-    IN  PRTMP_ADAPTER   pAd,
-    IN  PSTRING          arg)
-{
-    if (simple_strtol(arg, 0, 10) == 0)
-        pAd->StaCfg.bTGnWifiTest = FALSE;
-    else
-        pAd->StaCfg.bTGnWifiTest = TRUE;
-
-    DBGPRINT(RT_DEBUG_TRACE, ("IF Set_TGnWifiTest_Proc::(bTGnWifiTest=%d)\n", pAd->StaCfg.bTGnWifiTest));
-	return TRUE;
-}
-
-#ifdef EXT_BUILD_CHANNEL_LIST
-INT Set_Ieee80211dClientMode_Proc(
-    IN  PRTMP_ADAPTER   pAdapter,
-    IN  PSTRING          arg)
-{
-    if (simple_strtol(arg, 0, 10) == 0)
-        pAdapter->StaCfg.IEEE80211dClientMode = Rt802_11_D_None;
-    else if (simple_strtol(arg, 0, 10) == 1)
-        pAdapter->StaCfg.IEEE80211dClientMode = Rt802_11_D_Flexible;
-    else if (simple_strtol(arg, 0, 10) == 2)
-        pAdapter->StaCfg.IEEE80211dClientMode = Rt802_11_D_Strict;
-    else
-        return FALSE;
-
-    DBGPRINT(RT_DEBUG_TRACE, ("Set_Ieee802dMode_Proc::(IEEEE0211dMode=%d)\n", pAdapter->StaCfg.IEEE80211dClientMode));
-    return TRUE;
-}
-#endif // EXT_BUILD_CHANNEL_LIST //
-
-#ifdef CARRIER_DETECTION_SUPPORT
-INT Set_CarrierDetect_Proc(
-    IN  PRTMP_ADAPTER   pAd,
-    IN  PSTRING         arg)
-{
-    if (simple_strtol(arg, 0, 10) == 0)
-        pAd->CommonCfg.CarrierDetect.Enable = FALSE;
-    else
-        pAd->CommonCfg.CarrierDetect.Enable = TRUE;
-
-    DBGPRINT(RT_DEBUG_TRACE, ("IF Set_CarrierDetect_Proc::(CarrierDetect.Enable=%d)\n", pAd->CommonCfg.CarrierDetect.Enable));
-	return TRUE;
-}
-#endif // CARRIER_DETECTION_SUPPORT //
-
-
-INT	Show_Adhoc_MacTable_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			extra)
-{
-	INT i;
-
-	sprintf(extra, "\n");
-
-#ifdef DOT11_N_SUPPORT
-	sprintf(extra, "%sHT Operating Mode : %d\n", extra, pAd->CommonCfg.AddHTInfo.AddHtInfo2.OperaionMode);
-#endif // DOT11_N_SUPPORT //
-
-	sprintf(extra, "%s\n%-19s%-4s%-4s%-7s%-7s%-7s%-10s%-6s%-6s%-6s%-6s\n", extra,
-			"MAC", "AID", "BSS", "RSSI0", "RSSI1", "RSSI2", "PhMd", "BW", "MCS", "SGI", "STBC");
-
-	for (i=1; i<MAX_LEN_OF_MAC_TABLE; i++)
-	{
-		PMAC_TABLE_ENTRY pEntry = &pAd->MacTab.Content[i];
-
-		if (strlen(extra) > (IW_PRIV_SIZE_MASK - 30))
-		    break;
-		if ((pEntry->ValidAsCLI || pEntry->ValidAsApCli) && (pEntry->Sst == SST_ASSOC))
-		{
-			sprintf(extra, "%s%02X:%02X:%02X:%02X:%02X:%02X  ", extra,
-				pEntry->Addr[0], pEntry->Addr[1], pEntry->Addr[2],
-				pEntry->Addr[3], pEntry->Addr[4], pEntry->Addr[5]);
-			sprintf(extra, "%s%-4d", extra, (int)pEntry->Aid);
-			sprintf(extra, "%s%-4d", extra, (int)pEntry->apidx);
-			sprintf(extra, "%s%-7d", extra, pEntry->RssiSample.AvgRssi0);
-			sprintf(extra, "%s%-7d", extra, pEntry->RssiSample.AvgRssi1);
-			sprintf(extra, "%s%-7d", extra, pEntry->RssiSample.AvgRssi2);
-			sprintf(extra, "%s%-10s", extra, GetPhyMode(pEntry->HTPhyMode.field.MODE));
-			sprintf(extra, "%s%-6s", extra, GetBW(pEntry->HTPhyMode.field.BW));
-			sprintf(extra, "%s%-6d", extra, pEntry->HTPhyMode.field.MCS);
-			sprintf(extra, "%s%-6d", extra, pEntry->HTPhyMode.field.ShortGI);
-			sprintf(extra, "%s%-6d", extra, pEntry->HTPhyMode.field.STBC);
-			sprintf(extra, "%s%-10d, %d, %d%%\n", extra, pEntry->DebugFIFOCount, pEntry->DebugTxCount,
-						(pEntry->DebugTxCount) ? ((pEntry->DebugTxCount-pEntry->DebugFIFOCount)*100/pEntry->DebugTxCount) : 0);
-			sprintf(extra, "%s\n", extra);
-		}
-	}
-
-	return TRUE;
-}
-
-
-INT Set_BeaconLostTime_Proc(
-    IN  PRTMP_ADAPTER   pAd,
-    IN  PSTRING         arg)
-{
-	ULONG ltmp = (ULONG)simple_strtol(arg, 0, 10);
-
-	if ((ltmp != 0) && (ltmp <= 60))
-		pAd->StaCfg.BeaconLostTime = (ltmp * OS_HZ);
-
-    DBGPRINT(RT_DEBUG_TRACE, ("IF Set_BeaconLostTime_Proc::(BeaconLostTime=%ld)\n", pAd->StaCfg.BeaconLostTime));
-	return TRUE;
-}
-
-INT Set_AutoRoaming_Proc(
-    IN  PRTMP_ADAPTER   pAd,
-    IN  PSTRING         arg)
-{
-    if (simple_strtol(arg, 0, 10) == 0)
-        pAd->StaCfg.bAutoRoaming = FALSE;
-    else
-        pAd->StaCfg.bAutoRoaming = TRUE;
-
-    DBGPRINT(RT_DEBUG_TRACE, ("IF Set_AutoRoaming_Proc::(bAutoRoaming=%d)\n", pAd->StaCfg.bAutoRoaming));
-	return TRUE;
-}
-
-
-/*
-    ==========================================================================
-    Description:
-        Issue a site survey command to driver
-	Arguments:
-	    pAdapter                    Pointer to our adapter
-	    wrq                         Pointer to the ioctl argument
-
-    Return Value:
-        None
-
-    Note:
-        Usage:
-               1.) iwpriv ra0 set site_survey
-    ==========================================================================
-*/
-INT Set_SiteSurvey_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PSTRING			arg)
-{
-	NDIS_802_11_SSID Ssid;
-
-	//check if the interface is down
-	if (!RTMP_TEST_FLAG(pAd, fRTMP_ADAPTER_INTERRUPT_IN_USE))
-	{
-		DBGPRINT(RT_DEBUG_TRACE, ("INFO::Network is down!\n"));
-		return -ENETDOWN;
-	}
-
-	if (MONITOR_ON(pAd))
-    {
-        DBGPRINT(RT_DEBUG_TRACE, ("!!! Driver is in Monitor Mode now !!!\n"));
-        return -EINVAL;
-    }
-
-	RTMPZeroMemory(&Ssid, sizeof(NDIS_802_11_SSID));
-	Ssid.SsidLength = 0;
-	if ((arg != NULL) &&
-		(strlen(arg) <= MAX_LEN_OF_SSID))
-    {
-        RTMPMoveMemory(Ssid.Ssid, arg, strlen(arg));
-        Ssid.SsidLength = strlen(arg);
-	}
-
-	pAd->StaCfg.bScanReqIsFromWebUI = TRUE;
-
-	if (pAd->Mlme.CntlMachine.CurrState != CNTL_IDLE)
-	{
-		RTMP_MLME_RESET_STATE_MACHINE(pAd);
-		DBGPRINT(RT_DEBUG_TRACE, ("!!! MLME busy, reset MLME state machine !!!\n"));
-	}
-
-	// tell CNTL state machine to call NdisMSetInformationComplete() after completing
-	// this request, because this request is initiated by NDIS.
-	pAd->MlmeAux.CurrReqIsFromNdis = FALSE;
-	// Reset allowed scan retries
-	pAd->StaCfg.ScanCnt = 0;
-	NdisGetSystemUpTime(&pAd->StaCfg.LastScanTime);
-
-	MlmeEnqueue(pAd,
-		MLME_CNTL_STATE_MACHINE,
-		OID_802_11_BSSID_LIST_SCAN,
-		Ssid.SsidLength,
-		Ssid.Ssid);
-
-	RTMP_MLME_HANDLER(pAd);
-
-    DBGPRINT(RT_DEBUG_TRACE, ("Set_SiteSurvey_Proc\n"));
-
-    return TRUE;
-}
-
-INT Set_ForceTxBurst_Proc(
-    IN  PRTMP_ADAPTER   pAd,
-    IN  PSTRING         arg)
-{
-    if (simple_strtol(arg, 0, 10) == 0)
-        pAd->StaCfg.bForceTxBurst = FALSE;
-    else
-        pAd->StaCfg.bForceTxBurst = TRUE;
-
-    DBGPRINT(RT_DEBUG_TRACE, ("IF Set_ForceTxBurst_Proc::(bForceTxBurst=%d)\n", pAd->StaCfg.bForceTxBurst));
-	return TRUE;
-}
-
-#ifdef ANT_DIVERSITY_SUPPORT
-INT	Set_Antenna_Proc(
-	IN	PRTMP_ADAPTER	pAd,
-	IN	PUCHAR			arg)
-{
-    UCHAR UsedAnt;
-	DBGPRINT(RT_DEBUG_TRACE, ("==> Set_Antenna_Proc *******************\n"));
-
-    if(simple_strtol(arg, 0, 10) <= 3)
-        UsedAnt = simple_strtol(arg, 0, 10);
-
-    pAd->CommonCfg.bRxAntDiversity = UsedAnt; // Auto switch
-    if (UsedAnt == ANT_DIVERSITY_ENABLE)
-    {
-            pAd->RxAnt.EvaluateStableCnt = 0;
-            DBGPRINT(RT_DEBUG_TRACE, ("<== Set_Antenna_Proc(Auto Switch Mode), (%d,%d)\n", pAd->RxAnt.Pair1PrimaryRxAnt, pAd->RxAnt.Pair1SecondaryRxAnt));
-    }
-    /* 2: Fix in the PHY Antenna CON1*/
-    if (UsedAnt == ANT_FIX_ANT1)
-    {
-            AsicSetRxAnt(pAd, 0);
-            DBGPRINT(RT_DEBUG_TRACE, ("<== Set_Antenna_Proc(Fix in Ant CON1), (%d,%d)\n", pAd->RxAnt.Pair1PrimaryRxAnt, pAd->RxAnt.Pair1SecondaryRxAnt));
-    }
-    /* 3: Fix in the PHY Antenna CON2*/
-    if (UsedAnt == ANT_FIX_ANT2)
-    {
-            AsicSetRxAnt(pAd, 1);
-            DBGPRINT(RT_DEBUG_TRACE, ("<== Set_Antenna_Proc(Fix in Ant CON2), (%d,%d)\n", pAd->RxAnt.Pair1PrimaryRxAnt, pAd->RxAnt.Pair1SecondaryRxAnt));
-    }
-
-	return TRUE;
-}
-#endif // ANT_DIVERSITY_SUPPORT //
\ No newline at end of file
diff --git a/drivers/staging/rt3090/wpa.h b/drivers/staging/rt3090/wpa.h
deleted file mode 100644
index 8baa28774e30..000000000000
--- a/drivers/staging/rt3090/wpa.h
+++ /dev/null
@@ -1,447 +0,0 @@
-/*
- *************************************************************************
- * Ralink Tech Inc.
- * 5F., No.36, Taiyuan St., Jhubei City,
- * Hsinchu County 302,
- * Taiwan, R.O.C.
- *
- * (c) Copyright 2002-2007, Ralink Technology, Inc.
- *
- * This program is free software; you can redistribute it and/or modify  *
- * it under the terms of the GNU General Public License as published by  *
- * the Free Software Foundation; either version 2 of the License, or     *
- * (at your option) any later version.                                   *
- *                                                                       *
- * This program is distributed in the hope that it will be useful,       *
- * but WITHOUT ANY WARRANTY; without even the implied warranty of        *
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
- * GNU General Public License for more details.                          *
- *                                                                       *
- * You should have received a copy of the GNU General Public License     *
- * along with this program; if not, write to the                         *
- * Free Software Foundation, Inc.,                                       *
- * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
- *                                                                       *
- *************************************************************************
-
-	Module Name:
-	wpa.h
-
-	Abstract:
-
-	Revision History:
-	Who			When			What
-	--------	----------		----------------------------------------------
-	Name		Date			Modification logs
-*/
-
-#ifndef	__WPA_H__
-#define	__WPA_H__
-
-// EAPOL Key descripter frame format related length
-#define LEN_KEY_DESC_NONCE			32
-#define LEN_KEY_DESC_IV				16
-#define LEN_KEY_DESC_RSC			8
-#define LEN_KEY_DESC_ID				8
-#define LEN_KEY_DESC_REPLAY			8
-#define LEN_KEY_DESC_MIC			16
-
-// The length is the EAPoL-Key frame except key data field.
-// Please refer to 802.11i-2004 ,Figure 43u in p.78
-#define LEN_EAPOL_KEY_MSG			(sizeof(KEY_DESCRIPTER) - MAX_LEN_OF_RSNIE)
-
-// EAP Code Type.
-#define EAP_CODE_REQUEST	1
-#define EAP_CODE_RESPONSE	2
-#define EAP_CODE_SUCCESS    3
-#define EAP_CODE_FAILURE    4
-
-// EAPOL frame Protocol Version
-#define	EAPOL_VER					1
-#define	EAPOL_VER2					2
-
-// EAPOL-KEY Descriptor Type
-#define	WPA1_KEY_DESC				0xfe
-#define WPA2_KEY_DESC               0x02
-
-// Key Descriptor Version of Key Information
-#define	DESC_TYPE_TKIP				1
-#define	DESC_TYPE_AES				2
-
-#define LEN_MSG1_2WAY               0x7f
-#define MAX_LEN_OF_EAP_HS           256
-
-#define LEN_MASTER_KEY				32
-
-// EAPOL EK, MK
-#define LEN_EAP_EK					16
-#define LEN_EAP_MICK				16
-#define LEN_EAP_KEY					((LEN_EAP_EK)+(LEN_EAP_MICK))
-// TKIP key related
-#define LEN_PMKID					16
-#define LEN_TKIP_EK					16
-#define LEN_TKIP_RXMICK				8
-#define LEN_TKIP_TXMICK				8
-#define LEN_AES_EK					16
-#define LEN_AES_KEY					LEN_AES_EK
-#define LEN_TKIP_KEY				((LEN_TKIP_EK)+(LEN_TKIP_RXMICK)+(LEN_TKIP_TXMICK))
-#define TKIP_AP_TXMICK_OFFSET		((LEN_EAP_KEY)+(LEN_TKIP_EK))
-#define TKIP_AP_RXMICK_OFFSET		(TKIP_AP_TXMICK_OFFSET+LEN_TKIP_TXMICK)
-#define TKIP_GTK_LENGTH				((LEN_TKIP_EK)+(LEN_TKIP_RXMICK)+(LEN_TKIP_TXMICK))
-#define LEN_PTK						((LEN_EAP_KEY)+(LEN_TKIP_KEY))
-#define MIN_LEN_OF_GTK				5
-#define LEN_PMK						32
-#define LEN_PMK_NAME				16
-#define LEN_NONCE					32
-
-// RSN IE Length definition
-#define MAX_LEN_OF_RSNIE		255
-#define MIN_LEN_OF_RSNIE		8
-
-#define KEY_LIFETIME				3600
-
-//EAP Packet Type
-#define	EAPPacket		0
-#define	EAPOLStart		1
-#define	EAPOLLogoff		2
-#define	EAPOLKey		3
-#define	EAPOLASFAlert	4
-#define	EAPTtypeMax		5
-
-#define	EAPOL_MSG_INVALID	0
-#define	EAPOL_PAIR_MSG_1	1
-#define	EAPOL_PAIR_MSG_2	2
-#define	EAPOL_PAIR_MSG_3	3
-#define	EAPOL_PAIR_MSG_4	4
-#define	EAPOL_GROUP_MSG_1	5
-#define	EAPOL_GROUP_MSG_2	6
-
-#define PAIRWISEKEY					1
-#define GROUPKEY					0
-
-// Retry timer counter initial value
-#define PEER_MSG1_RETRY_TIMER_CTR           0
-#define PEER_MSG3_RETRY_TIMER_CTR           10
-#define GROUP_MSG1_RETRY_TIMER_CTR          20
-
-// WPA mechanism retry timer interval
-#define PEER_MSG1_RETRY_EXEC_INTV           1000			// 1 sec
-#define PEER_MSG3_RETRY_EXEC_INTV           3000			// 3 sec
-#define GROUP_KEY_UPDATE_EXEC_INTV          1000				// 1 sec
-#define PEER_GROUP_KEY_UPDATE_INIV			2000				// 2 sec
-
-#define ENQUEUE_EAPOL_START_TIMER			200					// 200 ms
-
-// group rekey interval
-#define TIME_REKEY                          0
-#define PKT_REKEY                           1
-#define DISABLE_REKEY                       2
-#define MAX_REKEY                           2
-
-#define MAX_REKEY_INTER                     0x3ffffff
-
-#define GROUP_SUITE					0
-#define PAIRWISE_SUITE				1
-#define AKM_SUITE					2
-#define PMKID_LIST					3
-
-
-#define EAPOL_START_DISABLE					0
-#define EAPOL_START_PSK						1
-#define EAPOL_START_1X						2
-
-#define MIX_CIPHER_WPA_TKIP_ON(x)       (((x) & 0x08) != 0)
-#define MIX_CIPHER_WPA_AES_ON(x)        (((x) & 0x04) != 0)
-#define MIX_CIPHER_WPA2_TKIP_ON(x)      (((x) & 0x02) != 0)
-#define MIX_CIPHER_WPA2_AES_ON(x)       (((x) & 0x01) != 0)
-
-#ifndef ROUND_UP
-#define ROUND_UP(__x, __y) \
-	(((ULONG)((__x)+((__y)-1))) & ((ULONG)~((__y)-1)))
-#endif
-
-#define	SET_UINT16_TO_ARRARY(_V, _LEN)		\
-{											\
-	_V[0] = (_LEN & 0xFF00) >> 8;			\
-	_V[1] = (_LEN & 0xFF);					\
-}
-
-#define	INC_UINT16_TO_ARRARY(_V, _LEN)			\
-{												\
-	UINT16	var_len;							\
-												\
-	var_len = (_V[0]<<8) | (_V[1]);				\
-	var_len += _LEN;							\
-												\
-	_V[0] = (var_len & 0xFF00) >> 8;			\
-	_V[1] = (var_len & 0xFF);					\
-}
-
-#define	CONV_ARRARY_TO_UINT16(_V)	((_V[0]<<8) | (_V[1]))
-
-
-#define	ADD_ONE_To_64BIT_VAR(_V)		\
-{										\
-	UCHAR	cnt = LEN_KEY_DESC_REPLAY;	\
-	do									\
-	{									\
-		cnt--;							\
-		_V[cnt]++;						\
-		if (cnt == 0)					\
-			break;						\
-	}while (_V[cnt] == 0);				\
-}
-
-#define IS_WPA_CAPABILITY(a)       (((a) >= Ndis802_11AuthModeWPA) && ((a) <= Ndis802_11AuthModeWPA1PSKWPA2PSK))
-
-// EAPOL Key Information definition within Key descriptor format
-typedef	struct PACKED _KEY_INFO
-{
-#ifdef RT_BIG_ENDIAN
-	UCHAR	KeyAck:1;
-    UCHAR	Install:1;
-    UCHAR	KeyIndex:2;
-    UCHAR	KeyType:1;
-    UCHAR	KeyDescVer:3;
-    UCHAR	Rsvd:3;
-    UCHAR	EKD_DL:1;		// EKD for AP; DL for STA
-    UCHAR	Request:1;
-    UCHAR	Error:1;
-    UCHAR	Secure:1;
-    UCHAR	KeyMic:1;
-#else
-	UCHAR	KeyMic:1;
-	UCHAR	Secure:1;
-	UCHAR	Error:1;
-	UCHAR	Request:1;
-	UCHAR	EKD_DL:1;       // EKD for AP; DL for STA
-	UCHAR	Rsvd:3;
-	UCHAR	KeyDescVer:3;
-	UCHAR	KeyType:1;
-	UCHAR	KeyIndex:2;
-	UCHAR	Install:1;
-	UCHAR	KeyAck:1;
-#endif
-}	KEY_INFO, *PKEY_INFO;
-
-// EAPOL Key descriptor format
-typedef	struct PACKED _KEY_DESCRIPTER
-{
-	UCHAR		Type;
-	KEY_INFO	KeyInfo;
-	UCHAR		KeyLength[2];
-	UCHAR		ReplayCounter[LEN_KEY_DESC_REPLAY];
-	UCHAR		KeyNonce[LEN_KEY_DESC_NONCE];
-	UCHAR		KeyIv[LEN_KEY_DESC_IV];
-	UCHAR		KeyRsc[LEN_KEY_DESC_RSC];
-	UCHAR		KeyId[LEN_KEY_DESC_ID];
-	UCHAR		KeyMic[LEN_KEY_DESC_MIC];
-	UCHAR		KeyDataLen[2];
-	UCHAR		KeyData[MAX_LEN_OF_RSNIE];
-}	KEY_DESCRIPTER, *PKEY_DESCRIPTER;
-
-typedef	struct PACKED _EAPOL_PACKET
-{
-	UCHAR				ProVer;
-	UCHAR				ProType;
-	UCHAR				Body_Len[2];
-	KEY_DESCRIPTER		KeyDesc;
-}	EAPOL_PACKET, *PEAPOL_PACKET;
-
-//802.11i D10 page 83
-typedef struct PACKED _GTK_ENCAP
-{
-#ifndef RT_BIG_ENDIAN
-    UCHAR               Kid:2;
-    UCHAR               tx:1;
-    UCHAR               rsv:5;
-    UCHAR               rsv1;
-#else
-    UCHAR               rsv:5;
-    UCHAR               tx:1;
-    UCHAR               Kid:2;
-    UCHAR               rsv1;
-#endif
-    UCHAR               GTK[TKIP_GTK_LENGTH];
-}   GTK_ENCAP, *PGTK_ENCAP;
-
-typedef struct PACKED _KDE_ENCAP
-{
-    UCHAR               Type;
-    UCHAR               Len;
-    UCHAR               OUI[3];
-    UCHAR               DataType;
-    GTK_ENCAP      GTKEncap;
-}   KDE_ENCAP, *PKDE_ENCAP;
-
-// For WPA1
-typedef struct PACKED _RSNIE {
-    UCHAR   oui[4];
-    USHORT  version;
-    UCHAR   mcast[4];
-    USHORT  ucount;
-    struct PACKED {
-        UCHAR oui[4];
-    }ucast[1];
-} RSNIE, *PRSNIE;
-
-// For WPA2
-typedef struct PACKED _RSNIE2 {
-    USHORT  version;
-    UCHAR   mcast[4];
-    USHORT  ucount;
-    struct PACKED {
-        UCHAR oui[4];
-    }ucast[1];
-} RSNIE2, *PRSNIE2;
-
-// AKM Suite
-typedef struct PACKED _RSNIE_AUTH {
-    USHORT acount;
-    struct PACKED {
-        UCHAR oui[4];
-    }auth[1];
-} RSNIE_AUTH,*PRSNIE_AUTH;
-
-typedef	union PACKED _RSN_CAPABILITIES	{
-	struct	PACKED {
-#ifdef RT_BIG_ENDIAN
-        USHORT		Rsvd:10;
-        USHORT		GTKSA_R_Counter:2;
-        USHORT		PTKSA_R_Counter:2;
-        USHORT		No_Pairwise:1;
-		USHORT		PreAuth:1;
-#else
-        USHORT		PreAuth:1;
-		USHORT		No_Pairwise:1;
-		USHORT		PTKSA_R_Counter:2;
-		USHORT		GTKSA_R_Counter:2;
-		USHORT		Rsvd:10;
-#endif
-	}	field;
-	USHORT			word;
-}	RSN_CAPABILITIES, *PRSN_CAPABILITIES;
-
-typedef struct PACKED _EAP_HDR {
-    UCHAR   ProVer;
-    UCHAR   ProType;
-    UCHAR   Body_Len[2];
-    UCHAR   code;
-    UCHAR   identifier;
-    UCHAR   length[2]; // including code and identifier, followed by length-2 octets of data
-} EAP_HDR, *PEAP_HDR;
-
-// For supplicant state machine states. 802.11i Draft 4.1, p. 97
-// We simplified it
-typedef	enum	_WpaState
-{
-	SS_NOTUSE,				// 0
-	SS_START,				// 1
-	SS_WAIT_MSG_3,			// 2
-	SS_WAIT_GROUP,			// 3
-	SS_FINISH,			// 4
-	SS_KEYUPDATE,			// 5
-}	WPA_STATE;
-
-//
-//	The definition of the cipher combination
-//
-//	 bit3	bit2  bit1   bit0
-//	+------------+------------+
-//	|	  WPA	 |	   WPA2   |
-//	+------+-----+------+-----+
-//	| TKIP | AES | TKIP | AES |
-//	|	0  |  1  |   1  |  0  | -> 0x06
-//	|	0  |  1  |   1  |  1  | -> 0x07
-//	|	1  |  0  |   0  |  1  | -> 0x09
-//	|	1  |  0  |   1  |  1  | -> 0x0B
-//	|	1  |  1  |   0  |  1  | -> 0x0D
-//	|	1  |  1  |   1  |  0  | -> 0x0E
-//	|	1  |  1  |   1  |  1  |	-> 0x0F
-//	+------+-----+------+-----+
-//
-typedef	enum	_WpaMixPairCipher
-{
-	MIX_CIPHER_NOTUSE			= 0x00,
-	WPA_NONE_WPA2_TKIPAES		= 0x03,		// WPA2-TKIPAES
-	WPA_AES_WPA2_TKIP			= 0x06,
-	WPA_AES_WPA2_TKIPAES		= 0x07,
-	WPA_TKIP_WPA2_AES			= 0x09,
-	WPA_TKIP_WPA2_TKIPAES		= 0x0B,
-	WPA_TKIPAES_WPA2_NONE		= 0x0C,		// WPA-TKIPAES
-	WPA_TKIPAES_WPA2_AES		= 0x0D,
-	WPA_TKIPAES_WPA2_TKIP		= 0x0E,
-	WPA_TKIPAES_WPA2_TKIPAES	= 0x0F,
-}	WPA_MIX_PAIR_CIPHER;
-
-typedef struct PACKED _RSN_IE_HEADER_STRUCT	{
-	UCHAR		Eid;
-	UCHAR		Length;
-	USHORT		Version;	// Little endian format
-}	RSN_IE_HEADER_STRUCT, *PRSN_IE_HEADER_STRUCT;
-
-// Cipher suite selector types
-typedef struct PACKED _CIPHER_SUITE_STRUCT	{
-	UCHAR		Oui[3];
-	UCHAR		Type;
-}	CIPHER_SUITE_STRUCT, *PCIPHER_SUITE_STRUCT;
-
-// Authentication and Key Management suite selector
-typedef struct PACKED _AKM_SUITE_STRUCT	{
-	UCHAR		Oui[3];
-	UCHAR		Type;
-}	AKM_SUITE_STRUCT, *PAKM_SUITE_STRUCT;
-
-// RSN capability
-typedef struct	PACKED _RSN_CAPABILITY	{
-	USHORT		Rsv:10;
-	USHORT		GTKSAReplayCnt:2;
-	USHORT		PTKSAReplayCnt:2;
-	USHORT		NoPairwise:1;
-	USHORT		PreAuth:1;
-}	RSN_CAPABILITY, *PRSN_CAPABILITY;
-
-
-/*========================================
-	The prototype is defined in cmm_wpa.c
-  ========================================*/
-BOOLEAN WpaMsgTypeSubst(
-	IN  UCHAR   EAPType,
-	OUT INT		*MsgType);
-
-VOID    PRF(
-	IN  UCHAR   *key,
-	IN  INT     key_len,
-	IN  UCHAR   *prefix,
-	IN  INT     prefix_len,
-	IN  UCHAR   *data,
-	IN  INT     data_len,
-	OUT UCHAR   *output,
-	IN  INT     len);
-
-int PasswordHash(
-	char *password,
-	unsigned char *ssid,
-	int ssidlength,
-	unsigned char *output);
-
-PUINT8	GetSuiteFromRSNIE(
-		IN	PUINT8	rsnie,
-		IN	UINT	rsnie_len,
-		IN	UINT8	type,
-		OUT	UINT8	*count);
-
-VOID WpaShowAllsuite(
-	IN	PUINT8	rsnie,
-	IN	UINT	rsnie_len);
-
-VOID RTMPInsertRSNIE(
-	IN PUCHAR pFrameBuf,
-	OUT PULONG pFrameLen,
-	IN PUINT8 rsnie_ptr,
-	IN UINT8  rsnie_len,
-	IN PUINT8 pmkid_ptr,
-	IN UINT8  pmkid_len);
-
-
-#endif
diff --git a/drivers/staging/rtl8187se/Kconfig b/drivers/staging/rtl8187se/Kconfig
index 3211dd3765a0..e24a6f7a0d85 100644
--- a/drivers/staging/rtl8187se/Kconfig
+++ b/drivers/staging/rtl8187se/Kconfig
@@ -1,7 +1,8 @@
-config RTL8187SE
+config R8187SE
 	tristate "RealTek RTL8187SE Wireless LAN NIC driver"
 	depends on PCI && WLAN
 	select WIRELESS_EXT
 	select WEXT_PRIV
 	default N
 	---help---
+	  If built as a module, it will be called r8187se.ko.
diff --git a/drivers/staging/rtl8187se/Makefile b/drivers/staging/rtl8187se/Makefile
index ac35cffe5d4a..b395acf5a38e 100644
--- a/drivers/staging/rtl8187se/Makefile
+++ b/drivers/staging/rtl8187se/Makefile
@@ -16,7 +16,7 @@ EXTRA_CFLAGS += -DENABLE_LPS
 
 #EXTRA_CFLAGS += -mhard-float -DCONFIG_FORCE_HARD_FLOAT=y
 
-rtl8187se-objs :=			\
+r8187se-objs :=			\
 		r8180_core.o		\
 		r8180_93cx6.o		\
 		r8180_wx.o		\
@@ -35,5 +35,5 @@ rtl8187se-objs :=			\
 		ieee80211/ieee80211_crypt_ccmp.o	\
 		ieee80211/ieee80211_crypt_wep.o
 
-obj-$(CONFIG_RTL8187SE)	+= rtl8187se.o
+obj-$(CONFIG_R8187SE)	+= r8187se.o
 
diff --git a/drivers/staging/rtl8187se/ieee80211/ieee80211.h b/drivers/staging/rtl8187se/ieee80211/ieee80211.h
index 3222c22152fb..0d490c164db6 100644
--- a/drivers/staging/rtl8187se/ieee80211/ieee80211.h
+++ b/drivers/staging/rtl8187se/ieee80211/ieee80211.h
@@ -1318,13 +1318,13 @@ extern int ieee80211_encrypt_fragment(
 	struct sk_buff *frag,
 	int hdr_len);
 
-extern int ieee80211_xmit(struct sk_buff *skb,
+extern int ieee80211_rtl_xmit(struct sk_buff *skb,
 			  struct net_device *dev);
 extern void ieee80211_txb_free(struct ieee80211_txb *);
 
 
 /* ieee80211_rx.c */
-extern int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
+extern int ieee80211_rtl_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
 			struct ieee80211_rx_stats *rx_stats);
 extern void ieee80211_rx_mgt(struct ieee80211_device *ieee,
 			     struct ieee80211_hdr_4addr *header,
@@ -1376,8 +1376,8 @@ extern void ieee80211_stop_protocol(struct ieee80211_device *ieee);
 extern void ieee80211_softmac_start_protocol(struct ieee80211_device *ieee);
 extern void ieee80211_softmac_stop_protocol(struct ieee80211_device *ieee);
 extern void ieee80211_reset_queue(struct ieee80211_device *ieee);
-extern void ieee80211_wake_queue(struct ieee80211_device *ieee);
-extern void ieee80211_stop_queue(struct ieee80211_device *ieee);
+extern void ieee80211_rtl_wake_queue(struct ieee80211_device *ieee);
+extern void ieee80211_rtl_stop_queue(struct ieee80211_device *ieee);
 extern struct sk_buff *ieee80211_get_beacon(struct ieee80211_device *ieee);
 extern void ieee80211_start_send_beacons(struct ieee80211_device *ieee);
 extern void ieee80211_stop_send_beacons(struct ieee80211_device *ieee);
@@ -1385,7 +1385,7 @@ extern int ieee80211_wpa_supplicant_ioctl(struct ieee80211_device *ieee, struct
 extern void notify_wx_assoc_event(struct ieee80211_device *ieee);
 extern void ieee80211_ps_tx_ack(struct ieee80211_device *ieee, short success);
 extern void SendDisassociation(struct ieee80211_device *ieee,u8* asSta,u8 asRsn);
-extern void ieee80211_start_scan(struct ieee80211_device *ieee);
+extern void ieee80211_rtl_start_scan(struct ieee80211_device *ieee);
 
 //Add for RF power on power off by lizhaoming 080512
 extern void SendDisassociation(struct ieee80211_device *ieee,
diff --git a/drivers/staging/rtl8187se/ieee80211/ieee80211_rx.c b/drivers/staging/rtl8187se/ieee80211/ieee80211_rx.c
index 5e2e79b1e341..9128c181bc7d 100644
--- a/drivers/staging/rtl8187se/ieee80211/ieee80211_rx.c
+++ b/drivers/staging/rtl8187se/ieee80211/ieee80211_rx.c
@@ -37,7 +37,6 @@
 #include <linux/slab.h>
 #include <linux/tcp.h>
 #include <linux/types.h>
-#include <linux/version.h>
 #include <linux/wireless.h>
 #include <linux/etherdevice.h>
 #include <asm/uaccess.h>
@@ -470,7 +469,7 @@ drop:
 /* All received frames are sent to this function. @skb contains the frame in
  * IEEE 802.11 format, i.e., in the format it was sent over air.
  * This function is called only as a tasklet (software IRQ). */
-int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
+int ieee80211_rtl_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
 		 struct ieee80211_rx_stats *rx_stats)
 {
 	struct net_device *dev = ieee->dev;
diff --git a/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac.c b/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac.c
index 334e4c7ec61b..c7c645af0ebb 100644
--- a/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac.c
+++ b/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac.c
@@ -689,7 +689,7 @@ void ieee80211_stop_scan(struct ieee80211_device *ieee)
 }
 
 /* called with ieee->lock held */
-void ieee80211_start_scan(struct ieee80211_device *ieee)
+void ieee80211_rtl_start_scan(struct ieee80211_device *ieee)
 {
 	if(IS_DOT11D_ENABLE(ieee) )
 	{
@@ -1196,7 +1196,7 @@ void ieee80211_associate_step1(struct ieee80211_device *ieee)
 	}
 }
 
-void ieee80211_auth_challenge(struct ieee80211_device *ieee, u8 *challenge, int chlen)
+void ieee80211_rtl_auth_challenge(struct ieee80211_device *ieee, u8 *challenge, int chlen)
 {
 	u8 *c;
 	struct sk_buff *skb;
@@ -1837,7 +1837,7 @@ ieee80211_rx_frame_softmac(struct ieee80211_device *ieee, struct sk_buff *skb,
 
 					 	            if (((ieee->current_network.wmm_info^info_element->data[6])& \
 										    0x0f)||(!ieee->init_wmmparam_flag)) {
-						   	      //refresh paramete element for current network
+						   	      // refresh parameter element for current network
 							      // update the register parameter for hardware
 							      ieee->init_wmmparam_flag = 1;
 							      queue_work(ieee->wq, &ieee->wmm_param_update_wq);
@@ -1898,7 +1898,7 @@ associate_complete:
 
 								ieee80211_associate_step2(ieee);
 							}else{
-								ieee80211_auth_challenge(ieee, challenge, chlen);
+								ieee80211_rtl_auth_challenge(ieee, challenge, chlen);
 							}
 						}else{
 							ieee->softmac_stats.rx_auth_rs_err++;
@@ -1958,10 +1958,10 @@ associate_complete:
  * care of the ieee802.11 fragmentation.
  * So the driver receives a fragment per time and might
  * call the stop function when it want without take care
- * to have enought room to TX an entire packet.
+ * to have enough room to TX an entire packet.
  * This might be useful if each fragment need it's own
  * descriptor, thus just keep a total free memory > than
- * the max fragmentation treshold is not enought.. If the
+ * the max fragmentation threshold is not enough.. If the
  * ieee802.11 stack passed a TXB struct then you needed
  * to keep N free descriptors where
  * N = MAX_PACKET_SIZE / MIN_FRAG_TRESHOLD
@@ -2047,7 +2047,7 @@ void ieee80211_reset_queue(struct ieee80211_device *ieee)
 
 }
 
-void ieee80211_wake_queue(struct ieee80211_device *ieee)
+void ieee80211_rtl_wake_queue(struct ieee80211_device *ieee)
 {
 
 	unsigned long flags;
@@ -2089,7 +2089,7 @@ exit :
 }
 
 
-void ieee80211_stop_queue(struct ieee80211_device *ieee)
+void ieee80211_rtl_stop_queue(struct ieee80211_device *ieee)
 {
 	//unsigned long flags;
 	//spin_lock_irqsave(&ieee->lock,flags);
@@ -2301,7 +2301,7 @@ void ieee80211_start_bss(struct ieee80211_device *ieee)
 //#else
 	if (ieee->state == IEEE80211_NOLINK){
 		ieee->actscanning = true;
-		ieee80211_start_scan(ieee);
+		ieee80211_rtl_start_scan(ieee);
 	}
 //#endif
 	spin_unlock_irqrestore(&ieee->lock, flags);
@@ -2357,7 +2357,7 @@ void ieee80211_associate_retry_wq(struct work_struct *work)
 	if(ieee->state == IEEE80211_NOLINK){
 		ieee->beinretry = false;
 		ieee->actscanning = true;
-		ieee80211_start_scan(ieee);
+		ieee80211_rtl_start_scan(ieee);
 	}
 	//YJ,add,080828, notify os here
 	if(ieee->state == IEEE80211_NOLINK)
diff --git a/drivers/staging/rtl8187se/ieee80211/ieee80211_tx.c b/drivers/staging/rtl8187se/ieee80211/ieee80211_tx.c
index e2945db61795..69bd02164b0c 100644
--- a/drivers/staging/rtl8187se/ieee80211/ieee80211_tx.c
+++ b/drivers/staging/rtl8187se/ieee80211/ieee80211_tx.c
@@ -47,7 +47,6 @@
 #include <linux/slab.h>
 #include <linux/tcp.h>
 #include <linux/types.h>
-#include <linux/version.h>
 #include <linux/wireless.h>
 #include <linux/etherdevice.h>
 #include <asm/uaccess.h>
@@ -305,7 +304,7 @@ ieee80211_classify(struct sk_buff *skb, struct ieee80211_network *network)
 }
 
 /* SKBs are added to the ieee->tx_queue. */
-int ieee80211_xmit(struct sk_buff *skb,
+int ieee80211_rtl_xmit(struct sk_buff *skb,
 		   struct net_device *dev)
 {
 	struct ieee80211_device *ieee = netdev_priv(dev);
diff --git a/drivers/staging/rtl8187se/ieee80211/ieee80211_wx.c b/drivers/staging/rtl8187se/ieee80211/ieee80211_wx.c
index a08b97a09512..6aad48fe2e18 100644
--- a/drivers/staging/rtl8187se/ieee80211/ieee80211_wx.c
+++ b/drivers/staging/rtl8187se/ieee80211/ieee80211_wx.c
@@ -30,7 +30,6 @@
 
 ******************************************************************************/
 #include <linux/wireless.h>
-#include <linux/version.h>
 #include <linux/kmod.h>
 #include <linux/module.h>
 
diff --git a/drivers/staging/rtl8187se/r8180.h b/drivers/staging/rtl8187se/r8180.h
index 8216d7e96d60..ce828885b64f 100644
--- a/drivers/staging/rtl8187se/r8180.h
+++ b/drivers/staging/rtl8187se/r8180.h
@@ -77,21 +77,6 @@ typedef enum _WIRELESS_MODE {
 	WIRELESS_MODE_AUTO = 0x08,
 } WIRELESS_MODE;
 
-typedef enum _VERSION_8185{
-	// RTL8185
-	VERSION_8185_UNKNOWN,
-	VERSION_8185_C, // C-cut
-	VERSION_8185_D, // D-cut
-	// RTL8185B
-	VERSION_8185B_B, // B-cut
-	VERSION_8185B_D, // D-cut
-	VERSION_8185B_E, // E-cut
-	//RTL8187S-PCIE
-	VERSION_8187S_B, // B-cut
-	VERSION_8187S_C, // C-cut
-	VERSION_8187S_D, // D-cut
-
-}VERSION_8185,*PVERSION_8185;
 typedef struct 	ChnlAccessSetting {
 	u16 SIFS_Timer;
 	u16 DIFS_Timer;
@@ -341,11 +326,8 @@ typedef struct r8180_priv
 	int irq;
 	struct ieee80211_device *ieee80211;
 
-        short card_8185; /* O: rtl8180, 1:rtl8185 V B/C, 2:rtl8185 V D, 3:rtl8185B */
-	short card_8185_Bversion; /* if TCR reports card V B/C this discriminates */
 	short phy_ver; /* meaningful for rtl8225 1:A 2:B 3:C */
 	short enable_gpio0;
-	enum card_type {PCI,MINIPCI,CARDBUS,USB/*rtl8187*/}card_type;
 	short hw_plcp_len;
 	short plcp_preamble_mode; // 0:auto 1:short 2:long
 
@@ -521,7 +503,7 @@ typedef struct r8180_priv
 	//u32 NumTxOkInPeriod;   //YJ,del,080828
 	u8   TxPollingTimes;
 
-	bool	bApBufOurFrame;// TRUE if AP buffer our unicast data , we will keep eAwake untill receive data or timeout.
+	bool	bApBufOurFrame;// TRUE if AP buffer our unicast data , we will keep eAwake until receive data or timeout.
 	u8	WaitBufDataBcnCount;
 	u8	WaitBufDataTimeOut;
 
@@ -599,7 +581,7 @@ typedef struct r8180_priv
 	u8						RSSI;
 	char					RxPower;
 	 u8 InitialGain;
-	 //For adjust Dig Threshhold during Legacy/Leisure Power Save Mode
+	 //For adjust Dig Threshold during Legacy/Leisure Power Save Mode
 	u32				DozePeriodInPast2Sec;
 	 // Don't access BB/RF under disable PLL situation.
 	u8					InitialGainBackUp;
diff --git a/drivers/staging/rtl8187se/r8180_core.c b/drivers/staging/rtl8187se/r8180_core.c
index 53e654d0d4fa..e0f13efdb15a 100644
--- a/drivers/staging/rtl8187se/r8180_core.c
+++ b/drivers/staging/rtl8187se/r8180_core.c
@@ -886,8 +886,6 @@ void rtl8180_rx_enable(struct net_device *dev)
 		rxconf = rxconf | (1<<ACCEPT_ALLMAC_FRAME_SHIFT);
 	}else{
 		rxconf = rxconf | (1<<ACCEPT_NICMAC_FRAME_SHIFT);
-		if(priv->card_8185 == 0)
-			rxconf = rxconf | (1<<RX_CHECK_BSSID_SHIFT);
 	}
 
 	if(priv->ieee80211->iw_mode == IW_MODE_MONITOR){
@@ -910,9 +908,6 @@ void rtl8180_rx_enable(struct net_device *dev)
 
 	rxconf = rxconf &~ RCR_CS_MASK;
 
-	if (!priv->card_8185)
-		rxconf |= (priv->rcr_csense<<RCR_CS_SHIFT);
-
 	write_nic_dword(dev, RX_CONF, rxconf);
 
 	fix_rx_fifo(dev);
@@ -964,28 +959,19 @@ void rtl8180_tx_enable(struct net_device *dev)
 
 	txconf = read_nic_dword(dev, TX_CONF);
 
-	if (priv->card_8185) {
-		byte = read_nic_byte(dev,CW_CONF);
-		byte &= ~(1<<CW_CONF_PERPACKET_CW_SHIFT);
-		byte &= ~(1<<CW_CONF_PERPACKET_RETRY_SHIFT);
-		write_nic_byte(dev, CW_CONF, byte);
-
-		tx_agc_ctl = read_nic_byte(dev, TX_AGC_CTL);
-		tx_agc_ctl &= ~(1<<TX_AGC_CTL_PERPACKET_GAIN_SHIFT);
-		tx_agc_ctl &= ~(1<<TX_AGC_CTL_PERPACKET_ANTSEL_SHIFT);
-		tx_agc_ctl |=(1<<TX_AGC_CTL_FEEDBACK_ANT);
-		write_nic_byte(dev, TX_AGC_CTL, tx_agc_ctl);
-		write_nic_byte(dev, 0xec, 0x3f); /* Disable early TX */
-	}
+	byte = read_nic_byte(dev, CW_CONF);
+	byte &= ~(1<<CW_CONF_PERPACKET_CW_SHIFT);
+	byte &= ~(1<<CW_CONF_PERPACKET_RETRY_SHIFT);
+	write_nic_byte(dev, CW_CONF, byte);
 
-	if (priv->card_8185)
-		txconf = txconf &~ (1<<TCR_PROBE_NOTIMESTAMP_SHIFT);
-	else {
-		if(hwseqnum)
-			txconf= txconf &~ (1<<TX_CONF_HEADER_AUTOICREMENT_SHIFT);
-		else
-			txconf= txconf | (1<<TX_CONF_HEADER_AUTOICREMENT_SHIFT);
-	}
+	tx_agc_ctl = read_nic_byte(dev, TX_AGC_CTL);
+	tx_agc_ctl &= ~(1<<TX_AGC_CTL_PERPACKET_GAIN_SHIFT);
+	tx_agc_ctl &= ~(1<<TX_AGC_CTL_PERPACKET_ANTSEL_SHIFT);
+	tx_agc_ctl |= (1<<TX_AGC_CTL_FEEDBACK_ANT);
+	write_nic_byte(dev, TX_AGC_CTL, tx_agc_ctl);
+	write_nic_byte(dev, 0xec, 0x3f); /* Disable early TX */
+
+	txconf = txconf & ~(1<<TCR_PROBE_NOTIMESTAMP_SHIFT);
 
 	txconf = txconf &~ TX_LOOPBACK_MASK;
 	txconf = txconf | (TX_LOOPBACK_NONE <<TX_LOOPBACK_SHIFT);
@@ -995,13 +981,10 @@ void rtl8180_tx_enable(struct net_device *dev)
 	txconf = txconf | (priv->retry_rts<<TX_RTSRETRY_SHIFT);
 	txconf = txconf &~ (1<<TX_NOCRC_SHIFT);
 
-	if (priv->card_8185) {
-		if (priv->hw_plcp_len)
-			txconf = txconf &~ TCR_PLCP_LEN;
-		else
-			txconf = txconf | TCR_PLCP_LEN;
-	} else
-		txconf = txconf &~ TCR_SAT;
+	if (priv->hw_plcp_len)
+		txconf = txconf & ~TCR_PLCP_LEN;
+	else
+		txconf = txconf | TCR_PLCP_LEN;
 
 	txconf = txconf &~ TCR_MXDMA_MASK;
 	txconf = txconf | (TCR_MXDMA_2048<<TCR_MXDMA_SHIFT);
@@ -1720,8 +1703,6 @@ void rtl8180_rx(struct net_device *dev)
 		else
 			quality = 127 - quality;
 		priv->SignalQuality = quality;
-		if(!priv->card_8185)
-			printk("check your card type\n");
 
 		stats.signal = (u8)quality;//priv->wstats.qual.level = priv->SignalStrength;
 		stats.signalstrength = RXAGC;
@@ -1830,7 +1811,7 @@ void rtl8180_rx(struct net_device *dev)
 			if(priv->rx_skb->len > 4)
 				skb_trim(priv->rx_skb,priv->rx_skb->len-4);
 #ifndef RX_DONT_PASS_UL
-			if(!ieee80211_rx(priv->ieee80211,
+			if(!ieee80211_rtl_rx(priv->ieee80211,
 					 priv->rx_skb, &stats)){
 #endif // RX_DONT_PASS_UL
 
@@ -1848,7 +1829,7 @@ void rtl8180_rx(struct net_device *dev)
 				    sizeof(u8),
 				    PCI_DMA_FROMDEVICE);
 
-drop: // this is used when we have not enought mem
+drop: // this is used when we have not enough mem
 		/* restore the descriptor */
 		*(priv->rxringtail+2)=priv->rxbuffer->dma;
 		*(priv->rxringtail)=*(priv->rxringtail) &~ 0xfff;
@@ -1919,8 +1900,8 @@ rate)
 	/*
 	* This function doesn't require lock because we make
 	* sure it's called with the tx_lock already acquired.
-	* this come from the kernel's hard_xmit callback (trought
-	* the ieee stack, or from the try_wake_queue (again trought
+	* this come from the kernel's hard_xmit callback (through
+	* the ieee stack, or from the try_wake_queue (again through
 	* the ieee stack.
 	*/
 	priority = AC2Q(skb->priority);
@@ -1936,11 +1917,11 @@ rate)
 	if (!check_nic_enought_desc(dev, priority)){
 		DMESGW("Error: no descriptor left by previous TX (avail %d) ",
 			get_curr_tx_free_desc(dev, priority));
-		ieee80211_stop_queue(priv->ieee80211);
+		ieee80211_rtl_stop_queue(priv->ieee80211);
 	}
 	rtl8180_tx(dev, skb->data, skb->len, priority, morefrag,0,rate);
 	if (!check_nic_enought_desc(dev, priority))
-		ieee80211_stop_queue(priv->ieee80211);
+		ieee80211_rtl_stop_queue(priv->ieee80211);
 
 	spin_unlock_irqrestore(&priv->tx_lock,flags);
 }
@@ -2221,10 +2202,8 @@ short rtl8180_tx(struct net_device *dev, u8* txbuf, int len, int priority,
 		*(tail+6) = 0;
 		*(tail+7) = 0;
 
-		if(priv->card_8185){
-			//FIXME: this should be triggered by HW encryption parameters.
-			*tail |= (1<<15); //no encrypt
-		}
+		/*FIXME: this should be triggered by HW encryption parameters.*/
+		*tail |= (1<<15); /* no encrypt */
 
 		if(remain==len && !descfrag) {
 			ownbit_flag = false;	//added by david woo,2007.12.14
@@ -2266,7 +2245,7 @@ short rtl8180_tx(struct net_device *dev, u8* txbuf, int len, int priority,
 
 		/* hw_plcp_len is not used for rtl8180 chip */
 		/* FIXME */
-		if(priv->card_8185 == 0 || !priv->hw_plcp_len){
+		if (!priv->hw_plcp_len) {
 			duration = rtl8180_len2duration(len, rate, &ext);
 			*(tail+1) = *(tail+1) | ((duration & 0x7fff)<<16);
 			if(ext) *(tail+1) = *(tail+1) |(1<<31); //plcp length extension
@@ -2355,8 +2334,7 @@ void rtl8180_link_change(struct net_device *dev)
 
 	rtl8180_set_mode(dev, EPROM_CMD_NORMAL);
 
-	if(priv->card_8185)
-		rtl8180_set_chan(dev, priv->chan);
+	rtl8180_set_chan(dev, priv->chan);
 }
 
 void rtl8180_rq_tx_ack(struct net_device *dev){
@@ -2702,8 +2680,6 @@ short rtl8180_init(struct net_device *dev)
 	struct r8180_priv *priv = ieee80211_priv(dev);
 	u16 word;
 	u16 version;
-	u8 hw_version;
-	//u8 config3;
 	u32 usValue;
 	u16 tmpu16;
 	int i, j;
@@ -2928,50 +2904,13 @@ short rtl8180_init(struct net_device *dev)
 
 	priv->InitialGain = 6;
 
-	hw_version =( read_nic_dword(dev, TCR) & TCR_HWVERID_MASK)>>TCR_HWVERID_SHIFT;
-
-	switch (hw_version){
-		case HW_VERID_R8185B_B:
-                        priv->card_8185 = VERSION_8187S_C;
-		        DMESG("MAC controller is a RTL8187SE b/g");
-			priv->phy_ver = 2;
-			break;
-		case HW_VERID_R8185_ABC:
-			DMESG("MAC controller is a RTL8185 b/g");
-			priv->card_8185 = 1;
-			/* you should not find a card with 8225 PHY ver < C*/
-			priv->phy_ver = 2;
-			break;
-		case HW_VERID_R8185_D:
-			DMESG("MAC controller is a RTL8185 b/g (V. D)");
-			priv->card_8185 = 2;
-			/* you should not find a card with 8225 PHY ver < C*/
-			priv->phy_ver = 2;
-			break;
-		case HW_VERID_R8180_ABCD:
-			DMESG("MAC controller is a RTL8180");
-			priv->card_8185 = 0;
-			break;
-		case HW_VERID_R8180_F:
-			DMESG("MAC controller is a RTL8180 (v. F)");
-			priv->card_8185 = 0;
-			break;
-		default:
-			DMESGW("MAC chip not recognized: version %x. Assuming RTL8180",hw_version);
-			priv->card_8185 = 0;
-			break;
-	}
+	DMESG("MAC controller is a RTL8187SE b/g");
+	priv->phy_ver = 2;
 
-	if(priv->card_8185){
-		priv->ieee80211->modulation |= IEEE80211_OFDM_MODULATION;
-		priv->ieee80211->short_slot = 1;
-	}
-	/* you should not found any 8185 Ver B Card */
-	priv->card_8185_Bversion = 0;
+	priv->ieee80211->modulation |= IEEE80211_OFDM_MODULATION;
+	priv->ieee80211->short_slot = 1;
 
 	// just for sync 85
-	priv->card_type = PCI;
-        DMESG("This is a PCI NIC");
 	priv->enable_gpio0 = 0;
 
 	usValue = eprom_read(dev, EEPROM_SW_REVD_OFFSET);
@@ -3026,12 +2965,10 @@ short rtl8180_init(struct net_device *dev)
 		priv->chtxpwr[i]=word & 0xff;
 		priv->chtxpwr[i+1]=(word & 0xff00)>>8;
 	}
-	if(priv->card_8185){
-		for(i=1,j=0; i<14; i+=2,j++){
-			word = eprom_read(dev,EPROM_TXPW_OFDM_CH1_2 + j);
-			priv->chtxpwr_ofdm[i]=word & 0xff;
-			priv->chtxpwr_ofdm[i+1]=(word & 0xff00)>>8;
-		}
+	for (i = 1, j = 0; i < 14; i += 2, j++) {
+		word = eprom_read(dev, EPROM_TXPW_OFDM_CH1_2 + j);
+		priv->chtxpwr_ofdm[i] = word & 0xff;
+		priv->chtxpwr_ofdm[i+1] = (word & 0xff00)>>8;
 	}
 
 	//3Read crystal calibtration and thermal meter indication on 87SE.
@@ -3057,37 +2994,11 @@ short rtl8180_init(struct net_device *dev)
 
 	version = eprom_read(dev,EPROM_VERSION);
 	DMESG("EEPROM version %x",version);
-	if( (!priv->card_8185) && version < 0x0101){
-		DMESG ("EEPROM version too old, assuming defaults");
-		DMESG ("If you see this message *plase* send your \
-DMESG output to andreamrl@tiscali.it THANKS");
-		priv->digphy=1;
-		priv->antb=0;
-		priv->diversity=1;
-		priv->cs_treshold=0xc;
-		priv->rcr_csense=1;
-		priv->rf_chip=RFCHIPID_PHILIPS;
-	}else{
-		if(!priv->card_8185){
-			u8 rfparam = eprom_read(dev,RF_PARAM);
-			DMESG("RfParam: %x",rfparam);
+	priv->rcr_csense = 3;
 
-			priv->digphy = rfparam & (1<<RF_PARAM_DIGPHY_SHIFT) ? 0:1;
-			priv->antb =  rfparam & (1<<RF_PARAM_ANTBDEFAULT_SHIFT) ? 1:0;
+	priv->cs_treshold = (eprom_read(dev, ENERGY_TRESHOLD) & 0xff00) >> 8;
 
-			priv->rcr_csense = (rfparam & RF_PARAM_CARRIERSENSE_MASK) >>
-					RF_PARAM_CARRIERSENSE_SHIFT;
-
-			priv->diversity =
-				(read_nic_byte(dev,CONFIG2)&(1<<CONFIG2_ANTENNA_SHIFT)) ? 1:0;
-		}else{
-			priv->rcr_csense = 3;
-		}
-
-		priv->cs_treshold = (eprom_read(dev,ENERGY_TRESHOLD)&0xff00) >>8;
-
-		priv->rf_chip = 0xff & eprom_read(dev,RFCHIPID);
-	}
+	priv->rf_chip = 0xff & eprom_read(dev, RFCHIPID);
 
 	priv->rf_chip = RF_ZEBRA4;
 	priv->rf_sleep = rtl8225z4_rf_sleep;
@@ -3099,19 +3010,6 @@ DMESG output to andreamrl@tiscali.it THANKS");
 	priv->rf_set_chan = rtl8225z2_rf_set_chan;
 	priv->rf_set_sens = NULL;
 
-	if(!priv->card_8185){
-		if(priv->antb)
-			DMESG ("Antenna B is default antenna");
-		else
-			DMESG ("Antenna A is default antenna");
-
-		if(priv->diversity)
-			DMESG ("Antenna diversity is enabled");
-		else
-			DMESG("Antenna diversity is disabled");
-
-		DMESG("Carrier sense %d",priv->rcr_csense);
-	}
 
 	if (0!=alloc_rx_desc_ring(dev, priv->rxbuffersize, priv->rxringcount))
 		return -ENOMEM;
@@ -3144,17 +3042,6 @@ DMESG output to andreamrl@tiscali.it THANKS");
 				  TX_BEACON_RING_ADDR))
 		return -ENOMEM;
 
-	if(!priv->card_8185){
-		if(read_nic_byte(dev, CONFIG0) & (1<<CONFIG0_WEP40_SHIFT))
-			DMESG ("40-bit WEP is supported in hardware");
-		else
-			DMESG ("40-bit WEP is NOT supported in hardware");
-
-		if(read_nic_byte(dev,CONFIG0) & (1<<CONFIG0_WEP104_SHIFT))
-			DMESG ("104-bit WEP is supported in hardware");
-		else
-			DMESG ("104-bit WEP is NOT supported in hardware");
-	}
 #if !defined(SA_SHIRQ)
         if(request_irq(dev->irq, (void *)rtl8180_interrupt, IRQF_SHARED, dev->name, dev)){
 #else
@@ -3172,17 +3059,6 @@ DMESG output to andreamrl@tiscali.it THANKS");
 
 void rtl8180_no_hw_wep(struct net_device *dev)
 {
-	struct r8180_priv *priv = ieee80211_priv(dev);
-
-	if (!priv->card_8185) {
-		u8 security;
-
-		security  = read_nic_byte(dev, SECURITY);
-		security &=~(1<<SECURITY_WEP_TX_ENABLE_SHIFT);
-		security &=~(1<<SECURITY_WEP_RX_ENABLE_SHIFT);
-
-		write_nic_byte(dev, SECURITY, security);
-	}
 }
 
 void rtl8180_set_hw_wep(struct net_device *dev)
@@ -3355,9 +3231,6 @@ void rtl8185_set_rate(struct net_device *dev)
 void rtl8180_adapter_start(struct net_device *dev)
 {
         struct r8180_priv *priv = ieee80211_priv(dev);
-	u32 anaparam;
-	u16 word;
-	u8 config3;
 
 	rtl8180_rtx_disable(dev);
 	rtl8180_reset(dev);
@@ -3371,12 +3244,6 @@ void rtl8180_adapter_start(struct net_device *dev)
 
 	rtl8180_beacon_tx_disable(dev);
 
-	if(priv->card_type == CARDBUS ){
-		config3=read_nic_byte(dev, CONFIG3);
-		write_nic_byte(dev,CONFIG3,config3 | CONFIG3_FuncRegEn);
-		write_nic_word(dev,FEMR, FEMR_INTR | FEMR_WKUP | FEMR_GWAKE |
-			read_nic_word(dev, FEMR));
-	}
 	rtl8180_set_mode(dev, EPROM_CMD_CONFIG);
 	write_nic_dword(dev, MAC0, ((u32*)dev->dev_addr)[0]);
 	write_nic_word(dev, MAC4, ((u32*)dev->dev_addr)[1] & 0xffff );
@@ -3384,12 +3251,6 @@ void rtl8180_adapter_start(struct net_device *dev)
 
 	rtl8180_update_msr(dev);
 
-	if(!priv->card_8185){
-		anaparam  = eprom_read(dev,EPROM_ANAPARAM_ADDRLWORD);
-		anaparam |= eprom_read(dev,EPROM_ANAPARAM_ADDRHWORD)<<16;
-
-		rtl8180_set_anaparam(dev,anaparam);
-	}
 	/* These might be unnecessary since we do in rx_enable / tx_enable */
 	fix_rx_fifo(dev);
 	fix_tx_fifo(dev);
@@ -3399,61 +3260,34 @@ void rtl8180_adapter_start(struct net_device *dev)
 	/*
 	   The following is very strange. seems to be that 1 means test mode,
 	   but we need to acknolwledges the nic when a packet is ready
-	   altought we set it to 0
+	   although we set it to 0
 	*/
 
 	write_nic_byte(dev,
 		       CONFIG2, read_nic_byte(dev,CONFIG2) &~\
 		       (1<<CONFIG2_DMA_POLLING_MODE_SHIFT));
 	//^the nic isn't in test mode
-	if(priv->card_8185)
-			write_nic_byte(dev,
+	write_nic_byte(dev,
 		       CONFIG2, read_nic_byte(dev,CONFIG2)|(1<<4));
 
 	rtl8180_set_mode(dev,EPROM_CMD_NORMAL);
 
 	write_nic_dword(dev,INT_TIMEOUT,0);
 
-	if(!priv->card_8185)
-	{
-		/*
-		experimental - this might be needed to calibrate AGC,
-		anyway it shouldn't hurt
-		*/
-		write_nic_byte(dev, CONFIG5,
-			read_nic_byte(dev, CONFIG5) | (1<<AGCRESET_SHIFT));
-		read_nic_byte(dev, CONFIG5);
-		udelay(15);
-		write_nic_byte(dev, CONFIG5,
-			read_nic_byte(dev, CONFIG5) &~ (1<<AGCRESET_SHIFT));
-	}else{
-		write_nic_byte(dev, WPA_CONFIG, 0);
-		//write_nic_byte(dev, TESTR, 0xd);
-	}
+	write_nic_byte(dev, WPA_CONFIG, 0);
 
 	rtl8180_no_hw_wep(dev);
 
-	if(priv->card_8185){
-		rtl8185_set_rate(dev);
-		write_nic_byte(dev, RATE_FALLBACK, 0x81);
-	}else{
-		word  = read_nic_word(dev, BRSR);
-		word &= ~BRSR_MBR;
-		word &= ~BRSR_BPLCP;
-		word |= ieeerate2rtlrate(priv->ieee80211->basic_rate);
-		word |= 0x0f;
-		write_nic_word(dev, BRSR, word);
-	}
+	rtl8185_set_rate(dev);
+	write_nic_byte(dev, RATE_FALLBACK, 0x81);
 
-	if(priv->card_8185){
-		write_nic_byte(dev, GP_ENABLE,read_nic_byte(dev, GP_ENABLE) & ~(1<<6));
+	write_nic_byte(dev, GP_ENABLE, read_nic_byte(dev, GP_ENABLE) & ~(1<<6));
 
-		//FIXME cfg 3 ClkRun enable - isn't it ReadOnly ?
-		rtl8180_set_mode(dev, EPROM_CMD_CONFIG);
-		write_nic_byte(dev,CONFIG3, read_nic_byte(dev, CONFIG3)
-			       | (1 << CONFIG3_CLKRUN_SHIFT));
-		rtl8180_set_mode(dev, EPROM_CMD_NORMAL);
-	}
+	/*FIXME cfg 3 ClkRun enable - isn't it ReadOnly ? */
+	rtl8180_set_mode(dev, EPROM_CMD_CONFIG);
+	write_nic_byte(dev, CONFIG3, read_nic_byte(dev, CONFIG3)
+		       | (1 << CONFIG3_CLKRUN_SHIFT));
+	rtl8180_set_mode(dev, EPROM_CMD_NORMAL);
 
 	priv->rf_init(dev);
 
@@ -3846,7 +3680,7 @@ static const struct net_device_ops rtl8180_netdev_ops = {
 	.ndo_set_mac_address	= r8180_set_mac_adr,
 	.ndo_validate_addr	= eth_validate_addr,
 	.ndo_change_mtu		= eth_change_mtu,
-	.ndo_start_xmit		= ieee80211_xmit,
+	.ndo_start_xmit		= ieee80211_rtl_xmit,
 };
 
 static int __devinit rtl8180_pci_probe(struct pci_dev *pdev,
@@ -4066,7 +3900,7 @@ void rtl8180_try_wake_queue(struct net_device *dev, int pri)
 	spin_unlock_irqrestore(&priv->tx_lock,flags);
 
 	if(enough_desc)
-		ieee80211_wake_queue(priv->ieee80211);
+		ieee80211_rtl_wake_queue(priv->ieee80211);
 }
 
 void rtl8180_tx_isr(struct net_device *dev, int pri,short error)
@@ -4144,7 +3978,7 @@ void rtl8180_tx_isr(struct net_device *dev, int pri,short error)
 		}
 
 	/* we check all the descriptors between the head and the nic,
-	 * but not the currenly pointed by the nic (the next to be txed)
+	 * but not the currently pointed by the nic (the next to be txed)
 	 * and the previous of the pointed (might be in process ??)
 	*/
 	offs = (nic - nicbegin);
diff --git a/drivers/staging/rtl8187se/r8180_dm.c b/drivers/staging/rtl8187se/r8180_dm.c
index b6eeeeccff9e..cbca58db85e1 100644
--- a/drivers/staging/rtl8187se/r8180_dm.c
+++ b/drivers/staging/rtl8187se/r8180_dm.c
@@ -36,7 +36,7 @@ bool CheckHighPower(struct net_device *dev)
 //
 //	Note:
 //		The reason why we udpate Tx power level here instead of DoRxHighPower()
-//		is the number of IO to change Tx power is much more than chane TR switch
+//		is the number of IO to change Tx power is much more than channel TR switch
 //		and they are related to OFDM and MAC registers.
 //		So, we don't want to update it so frequently in per-Rx packet base.
 //
@@ -197,7 +197,6 @@ DIG_Zebra(
 	{ // Advised from SD3 DZ
 		priv->InitialGain = 4; // In 87B, m74dBm means State 4 (m82dBm)
 	}
-	//if(pHalData->VersionID != VERSION_8187B_B)
 	{ // Advised from SD3 DZ
 		OfdmFA1 =  0x20;
 	}
@@ -1326,7 +1325,7 @@ SetAntenna8185(
 			break;
 
 		default:
-			printk("SetAntenna8185: unkown RFChipID(%d)\n", priv->rf_chip);
+			printk("SetAntenna8185: unknown RFChipID(%d)\n", priv->rf_chip);
 			break;
 		}
 		break;
@@ -1346,13 +1345,13 @@ SetAntenna8185(
 			break;
 
 		default:
-			printk("SetAntenna8185: unkown RFChipID(%d)\n", priv->rf_chip);
+			printk("SetAntenna8185: unknown RFChipID(%d)\n", priv->rf_chip);
 			break;
 		}
 		break;
 
 	default:
-		printk("SetAntenna8185: unkown u1bAntennaIndex(%d)\n", u1bAntennaIndex);
+		printk("SetAntenna8185: unknown u1bAntennaIndex(%d)\n", u1bAntennaIndex);
 		break;
 	}
 
@@ -1448,7 +1447,7 @@ SwAntennaDiversity(
 
 		priv->bAdSwitchedChecking = false;
 
-		// Adjust Rx signal strength threashold.
+		// Adjust Rx signal strength threshold.
 		priv->AdRxSsThreshold = (priv->AdRxSignalStrength + priv->AdRxSsBeforeSwitched) / 2;
 
 		priv->AdRxSsThreshold = (priv->AdRxSsThreshold > priv->AdMaxRxSsThreshold) ?
@@ -1562,7 +1561,7 @@ SwAntennaDiversity(
 //				priv->AdRxSignalStrength, priv->AdRxSsThreshold);
 
 			priv->bAdSwitchedChecking = false;
-			// Increase Rx signal strength threashold if necessary.
+			// Increase Rx signal strength threshold if necessary.
 			if(	(priv->AdRxSignalStrength > (priv->AdRxSsThreshold + 10)) && // Signal is much stronger than current threshold
 				priv->AdRxSsThreshold <= priv->AdMaxRxSsThreshold) // Current threhold is not yet reach upper limit.
 			{
diff --git a/drivers/staging/rtl8187se/r8180_rtl8225z2.c b/drivers/staging/rtl8187se/r8180_rtl8225z2.c
index b648751cdaa3..afe10f0b75a8 100644
--- a/drivers/staging/rtl8187se/r8180_rtl8225z2.c
+++ b/drivers/staging/rtl8187se/r8180_rtl8225z2.c
@@ -23,7 +23,6 @@ static void write_rtl8225(struct net_device *dev, u8 adr, u16 data)
 	u16 out, select;
 	u8 bit;
 	u32 bangdata = (data << 4) | (adr & 0xf);
-	struct r8180_priv *priv = ieee80211_priv(dev);
 
 	out = read_nic_word(dev, RFPinsOutput) & 0xfff3;
 
@@ -33,7 +32,7 @@ static void write_rtl8225(struct net_device *dev, u8 adr, u16 data)
 	select = read_nic_word(dev, RFPinsSelect);
 
 	write_nic_word(dev, RFPinsSelect, select | 0x7 |
-		((priv->card_type == USB) ? 0 : SW_CONTROL_GPIO));
+		       SW_CONTROL_GPIO);
 
 	force_pci_posting(dev);
 	udelay(10);
@@ -71,16 +70,11 @@ static void write_rtl8225(struct net_device *dev, u8 adr, u16 data)
 	force_pci_posting(dev);
 	udelay(10);
 
-	write_nic_word(dev, RFPinsOutput, out |
-		((priv->card_type == USB) ? 4 : BB_HOST_BANG_EN));
+	write_nic_word(dev, RFPinsOutput, out | BB_HOST_BANG_EN);
 
-	write_nic_word(dev, RFPinsSelect, select |
-		((priv->card_type == USB) ? 0 : SW_CONTROL_GPIO));
+	write_nic_word(dev, RFPinsSelect, select | SW_CONTROL_GPIO);
 
-	if (priv->card_type == USB)
-		mdelay(2);
-	else
-		rtl8185_rf_pins_enable(dev);
+	rtl8185_rf_pins_enable(dev);
 }
 
 static const u16 rtl8225bcd_rxgain[] = {
@@ -174,15 +168,9 @@ static void rtl8225_SetTXPowerLevel(struct net_device *dev, short ch)
 	u8 cck_power_level = 0xff & priv->chtxpwr[ch];
 	u8 ofdm_power_level = 0xff & priv->chtxpwr_ofdm[ch];
 
-	if (priv->card_type == USB) {
-		max_cck_power_level = 11;
-		max_ofdm_power_level = 25;
-		min_ofdm_power_level = 10;
-	} else {
-		max_cck_power_level = 35;
-		max_ofdm_power_level = 35;
-		min_ofdm_power_level = 0;
-	}
+	max_cck_power_level = 35;
+	max_ofdm_power_level = 35;
+	min_ofdm_power_level = 0;
 
 	if (cck_power_level > max_cck_power_level)
 		cck_power_level = max_cck_power_level;
@@ -445,30 +433,28 @@ s8 DbmToTxPwrIdx(struct r8180_priv *priv, WIRELESS_MODE WirelessMode,
 	 * OFDM Power in dBm = Index * 0.5 + 0
 	 * CCK Power in dBm = Index * 0.25 + 13
 	 */
-	if (priv->card_8185 >= VERSION_8187S_B) {
-		s32 tmp = 0;
-
-		if (WirelessMode == WIRELESS_MODE_G) {
-			bUseDefault = false;
-			tmp = (2 * PowerInDbm);
-
-			if (tmp < 0)
-				TxPwrIdx = 0;
-			else if (tmp > 40) /* 40 means 20 dBm. */
-				TxPwrIdx = 40;
-			else
-				TxPwrIdx = (s8)tmp;
-		} else if (WirelessMode == WIRELESS_MODE_B) {
-			bUseDefault = false;
-			tmp = (4 * PowerInDbm) - 52;
-
-			if(tmp < 0)
-				TxPwrIdx = 0;
-			else if (tmp > 28) /* 28 means 20 dBm. */
-				TxPwrIdx = 28;
-			else
-				TxPwrIdx = (s8)tmp;
-		}
+	s32 tmp = 0;
+
+	if (WirelessMode == WIRELESS_MODE_G) {
+		bUseDefault = false;
+		tmp = (2 * PowerInDbm);
+
+		if (tmp < 0)
+			TxPwrIdx = 0;
+		else if (tmp > 40) /* 40 means 20 dBm. */
+			TxPwrIdx = 40;
+		else
+			TxPwrIdx = (s8)tmp;
+	} else if (WirelessMode == WIRELESS_MODE_B) {
+		bUseDefault = false;
+		tmp = (4 * PowerInDbm) - 52;
+
+		if (tmp < 0)
+			TxPwrIdx = 0;
+		else if (tmp > 28) /* 28 means 20 dBm. */
+			TxPwrIdx = 28;
+		else
+			TxPwrIdx = (s8)tmp;
 	}
 
 	/*
@@ -631,8 +617,7 @@ void rtl8225z2_rf_init(struct net_device *dev)
 
 	priv->chan = channel;
 
-	if (priv->card_type != USB)
-		rtl8225_host_pci_init(dev);
+	rtl8225_host_pci_init(dev);
 
 	write_nic_dword(dev, RF_TIMING, 0x000a8008);
 
@@ -655,7 +640,7 @@ void rtl8225z2_rf_init(struct net_device *dev)
 	write_rtl8225(dev, 0x4, 0x8c3); mdelay(1);
 	write_rtl8225(dev, 0x5, 0xc72); mdelay(1);
 	write_rtl8225(dev, 0x6, 0xe6);  mdelay(1);
-	write_rtl8225(dev, 0x7, ((priv->card_type == USB)? 0x82a : rtl8225_chan[channel]));  mdelay(1);
+	write_rtl8225(dev, 0x7, rtl8225_chan[channel]);  mdelay(1);
 	write_rtl8225(dev, 0x8, 0x3f);  mdelay(1);
 	write_rtl8225(dev, 0x9, 0x335); mdelay(1);
 	write_rtl8225(dev, 0xa, 0x9d4); mdelay(1);
@@ -681,13 +666,6 @@ void rtl8225z2_rf_init(struct net_device *dev)
 
 	write_rtl8225(dev, 0x2, 0xc4d);
 
-	if (priv->card_type == USB) {
-		mdelay(200);
-
-		write_rtl8225(dev, 0x2, 0x44d);
-		mdelay(100);
-	}
-
 	/* FIXME!! rtl8187 we have to check if calibrarion
 	 * is successful and eventually cal. again (repeat
 	 * the two write on reg 2)
@@ -707,9 +685,6 @@ void rtl8225z2_rf_init(struct net_device *dev)
 
 	write_rtl8225(dev, 0x0, 0x2bf);
 
-	if (priv->card_type != USB)
-		rtl8185_rf_pins_enable(dev);
-
 	for (i = 0; i < 128; i++) {
 		data = rtl8225_agc[i];
 
@@ -726,7 +701,7 @@ void rtl8225z2_rf_init(struct net_device *dev)
 
 	write_phy_ofdm(dev, 0x00, 0x01); mdelay(1);
 	write_phy_ofdm(dev, 0x01, 0x02); mdelay(1);
-	write_phy_ofdm(dev, 0x02, ((priv->card_type == USB) ? 0x42 : 0x62)); mdelay(1);
+	write_phy_ofdm(dev, 0x02, 0x62); mdelay(1);
 	write_phy_ofdm(dev, 0x03, 0x00); mdelay(1);
 	write_phy_ofdm(dev, 0x04, 0x00); mdelay(1);
 	write_phy_ofdm(dev, 0x05, 0x00); mdelay(1);
@@ -774,7 +749,7 @@ void rtl8225z2_rf_init(struct net_device *dev)
 	write_phy_cck(dev, 0x6, 0xfc); mdelay(1);
 	write_phy_cck(dev, 0x7, 0x78); mdelay(1);
 	write_phy_cck(dev, 0x8, 0x2e); mdelay(1);
-	write_phy_cck(dev, 0x10, ((priv->card_type == USB) ? 0x9b: 0x93)); mdelay(1);
+	write_phy_cck(dev, 0x10, 0x93); mdelay(1);
 	write_phy_cck(dev, 0x11, 0x88); mdelay(1);
 	write_phy_cck(dev, 0x12, 0x47); mdelay(1);
 	write_phy_cck(dev, 0x13, 0xd0);
@@ -808,12 +783,8 @@ void rtl8225z2_rf_init(struct net_device *dev)
 	/* switch to high-speed 3-wire
 	 * last digit. 2 for both cck and ofdm
 	 */
-	if (priv->card_type == USB)
-		write_nic_dword(dev, 0x94, 0x3dc00002);
-	else {
-		write_nic_dword(dev, 0x94, 0x15c00002);
-		rtl8185_rf_pins_enable(dev);
-	}
+	write_nic_dword(dev, 0x94, 0x15c00002);
+	rtl8185_rf_pins_enable(dev);
 
 	rtl8225_rf_set_chan(dev, priv->chan);
 }
@@ -1058,7 +1029,7 @@ bool SetZebraRFPowerState8185(struct net_device *dev,
 			break;
 		default:
 			bResult = false;
-			printk("SetZebraRFPowerState8185(): unknow state to set: 0x%X!!!\n", eRFPowerState);
+			printk("SetZebraRFPowerState8185(): unknown state to set: 0x%X!!!\n", eRFPowerState);
 			break;
 		}
 		break;
diff --git a/drivers/staging/rtl8187se/r8180_wx.c b/drivers/staging/rtl8187se/r8180_wx.c
index 766892e31f52..124cde356cbc 100644
--- a/drivers/staging/rtl8187se/r8180_wx.c
+++ b/drivers/staging/rtl8187se/r8180_wx.c
@@ -276,7 +276,7 @@ static int rtl8180_wx_get_range(struct net_device *dev,
 	range->max_qual.updated = 7; /* Updated all three */
 
 	range->avg_qual.qual = 92; /* > 8% missed beacons is 'bad' */
-	/* TODO: Find real 'good' to 'bad' threshol value for RSSI */
+	/* TODO: Find real 'good' to 'bad' threshold value for RSSI */
 	range->avg_qual.level = 20 + -98;
 	range->avg_qual.noise = 0;
 	range->avg_qual.updated = 7; /* Updated all three */
@@ -377,7 +377,7 @@ static int r8180_wx_set_scan(struct net_device *dev, struct iw_request_info *a,
 	//	queue_work(priv->ieee80211->wq, &priv->ieee80211->wx_sync_scan_wq);
 		//printk("start scan============================>\n");
 		ieee80211_softmac_ips_scan_syncro(priv->ieee80211);
-//ieee80211_start_scan(priv->ieee80211);
+//ieee80211_rtl_start_scan(priv->ieee80211);
 		/* intentionally forget to up sem */
 //			up(&priv->ieee80211->wx_sem);
 			ret = 0;
diff --git a/drivers/staging/rtl8187se/r8185b_init.c b/drivers/staging/rtl8187se/r8185b_init.c
index cd07059b25b5..50309f2da9c1 100644
--- a/drivers/staging/rtl8187se/r8185b_init.c
+++ b/drivers/staging/rtl8187se/r8185b_init.c
@@ -1023,6 +1023,7 @@ ZEBRA_Config_85BASIC_HardCode(
 	u32	addr,data;
 	u32	u4bRegOffset, u4bRegValue, u4bRF23, u4bRF24;
        u8			u1b24E;
+	int d_cut = 0;
 
 
 	//=============================================================================
@@ -1035,8 +1036,10 @@ ZEBRA_Config_85BASIC_HardCode(
 	u4bRF23= RF_ReadReg(dev, 0x08);			mdelay(1);
 	u4bRF24= RF_ReadReg(dev, 0x09);			mdelay(1);
 
-	if (u4bRF23==0x818 && u4bRF24==0x70C && priv->card_8185 == VERSION_8187S_C)
-		priv->card_8185 = VERSION_8187S_D;
+	if (u4bRF23 == 0x818 && u4bRF24 == 0x70C) {
+		d_cut = 1;
+		printk(KERN_INFO "rtl8187se: card type changed from C- to D-cut\n");
+	}
 
 	// Page0 : reg0-reg15
 
@@ -1070,18 +1073,9 @@ ZEBRA_Config_85BASIC_HardCode(
 
 	RF_WriteReg(dev, 0x03, 0x0806);			mdelay(1);
 
-	if(priv->card_8185 < VERSION_8187S_C)
-	{
-		RF_WriteReg(dev, 0x04, 0x03f7);			mdelay(1);
-		RF_WriteReg(dev, 0x05, 0x05ab);			mdelay(1);
-		RF_WriteReg(dev, 0x06, 0x00c1);			mdelay(1);
-	}
-	else
-	{
-		RF_WriteReg(dev, 0x04, 0x03a7);			mdelay(1);
-		RF_WriteReg(dev, 0x05, 0x059b);			mdelay(1);
-		RF_WriteReg(dev, 0x06, 0x0081);			mdelay(1);
-	}
+	RF_WriteReg(dev, 0x04, 0x03a7);			mdelay(1);
+	RF_WriteReg(dev, 0x05, 0x059b);			mdelay(1);
+	RF_WriteReg(dev, 0x06, 0x0081);			mdelay(1);
 
 
 	RF_WriteReg(dev, 0x07, 0x01A0);			mdelay(1);
@@ -1091,14 +1085,11 @@ ZEBRA_Config_85BASIC_HardCode(
 	RF_WriteReg(dev, 0x0a, 0x0001);			mdelay(1);
 	RF_WriteReg(dev, 0x0b, 0x0418);			mdelay(1);
 
-	if(priv->card_8185 == VERSION_8187S_D)
-	{
+	if (d_cut) {
 		RF_WriteReg(dev, 0x0c, 0x0fbe);			mdelay(1);
 		RF_WriteReg(dev, 0x0d, 0x0008);			mdelay(1);
 		RF_WriteReg(dev, 0x0e, 0x0807);			mdelay(1); // RX LO buffer
-	}
-	else
-	{
+	} else {
 		RF_WriteReg(dev, 0x0c, 0x0fbe);			mdelay(1);
 		RF_WriteReg(dev, 0x0d, 0x0008);			mdelay(1);
 		RF_WriteReg(dev, 0x0e, 0x0806);			mdelay(1); // RX LO buffer
@@ -2493,8 +2484,8 @@ void rtl8185b_adapter_start(struct net_device *dev)
 	PhyConfig8185(dev);
 
 	// We assume RegWirelessMode has already been initialized before,
-	// however, we has to validate the wireless mode here and provide a reasonble
-	// initialized value if necessary. 2005.01.13, by rcnjko.
+	// however, we has to validate the wireless mode here and provide a
+	// reasonable initialized value if necessary. 2005.01.13, by rcnjko.
 	SupportedWirelessMode = GetSupportedWirelessMode8185(dev);
 	if(	(ieee->mode != WIRELESS_MODE_B) &&
 		(ieee->mode != WIRELESS_MODE_G) &&
diff --git a/drivers/staging/rtl8192e/ieee80211.h b/drivers/staging/rtl8192e/ieee80211.h
index 97137ddefff4..3ba9e9e90bda 100644
--- a/drivers/staging/rtl8192e/ieee80211.h
+++ b/drivers/staging/rtl8192e/ieee80211.h
@@ -303,8 +303,8 @@ enum	_ReasonCode{
 #define ieee80211_rx_mgt		ieee80211_rx_mgt_rsl
 
 #define ieee80211_get_beacon		ieee80211_get_beacon_rsl
-#define ieee80211_wake_queue		ieee80211_wake_queue_rsl
-#define ieee80211_stop_queue		ieee80211_stop_queue_rsl
+#define ieee80211_rtl_wake_queue		ieee80211_rtl_wake_queue_rsl
+#define ieee80211_rtl_stop_queue		ieee80211_rtl_stop_queue_rsl
 #define ieee80211_reset_queue		ieee80211_reset_queue_rsl
 #define ieee80211_softmac_stop_protocol	ieee80211_softmac_stop_protocol_rsl
 #define ieee80211_softmac_start_protocol ieee80211_softmac_start_protocol_rsl
@@ -2435,13 +2435,13 @@ extern int ieee80211_encrypt_fragment(
 	struct sk_buff *frag,
 	int hdr_len);
 
-extern int ieee80211_xmit(struct sk_buff *skb,
+extern int ieee80211_rtl_xmit(struct sk_buff *skb,
 			  struct net_device *dev);
 extern void ieee80211_txb_free(struct ieee80211_txb *);
 
 
 /* ieee80211_rx.c */
-extern int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
+extern int ieee80211_rtl_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
 			struct ieee80211_rx_stats *rx_stats);
 extern void ieee80211_rx_mgt(struct ieee80211_device *ieee,
 			     struct ieee80211_hdr_4addr *header,
@@ -2502,8 +2502,8 @@ extern void ieee80211_stop_protocol(struct ieee80211_device *ieee);
 extern void ieee80211_softmac_start_protocol(struct ieee80211_device *ieee);
 extern void ieee80211_softmac_stop_protocol(struct ieee80211_device *ieee);
 extern void ieee80211_reset_queue(struct ieee80211_device *ieee);
-extern void ieee80211_wake_queue(struct ieee80211_device *ieee);
-extern void ieee80211_stop_queue(struct ieee80211_device *ieee);
+extern void ieee80211_rtl_wake_queue(struct ieee80211_device *ieee);
+extern void ieee80211_rtl_stop_queue(struct ieee80211_device *ieee);
 extern struct sk_buff *ieee80211_get_beacon(struct ieee80211_device *ieee);
 extern void ieee80211_start_send_beacons(struct ieee80211_device *ieee);
 extern void ieee80211_stop_send_beacons(struct ieee80211_device *ieee);
diff --git a/drivers/staging/rtl8192e/ieee80211/ieee80211.h b/drivers/staging/rtl8192e/ieee80211/ieee80211.h
index 83c8452de378..aa76390487bb 100644
--- a/drivers/staging/rtl8192e/ieee80211/ieee80211.h
+++ b/drivers/staging/rtl8192e/ieee80211/ieee80211.h
@@ -333,8 +333,8 @@ enum	_ReasonCode{
 #define ieee80211_rx_mgt		ieee80211_rx_mgt_rsl
 
 #define ieee80211_get_beacon		ieee80211_get_beacon_rsl
-#define ieee80211_wake_queue		ieee80211_wake_queue_rsl
-#define ieee80211_stop_queue		ieee80211_stop_queue_rsl
+#define ieee80211_rtl_wake_queue		ieee80211_rtl_wake_queue_rsl
+#define ieee80211_rtl_stop_queue		ieee80211_rtl_stop_queue_rsl
 #define ieee80211_reset_queue		ieee80211_reset_queue_rsl
 #define ieee80211_softmac_stop_protocol	ieee80211_softmac_stop_protocol_rsl
 #define ieee80211_softmac_start_protocol ieee80211_softmac_start_protocol_rsl
@@ -2546,13 +2546,13 @@ extern int ieee80211_encrypt_fragment(
 	struct sk_buff *frag,
 	int hdr_len);
 
-extern int ieee80211_xmit(struct sk_buff *skb,
+extern int ieee80211_rtl_xmit(struct sk_buff *skb,
 			  struct net_device *dev);
 extern void ieee80211_txb_free(struct ieee80211_txb *);
 
 
 /* ieee80211_rx.c */
-extern int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
+extern int ieee80211_rtl_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
 			struct ieee80211_rx_stats *rx_stats);
 extern void ieee80211_rx_mgt(struct ieee80211_device *ieee,
 			     struct ieee80211_hdr_4addr *header,
@@ -2613,8 +2613,8 @@ extern void ieee80211_stop_protocol(struct ieee80211_device *ieee);
 extern void ieee80211_softmac_start_protocol(struct ieee80211_device *ieee);
 extern void ieee80211_softmac_stop_protocol(struct ieee80211_device *ieee);
 extern void ieee80211_reset_queue(struct ieee80211_device *ieee);
-extern void ieee80211_wake_queue(struct ieee80211_device *ieee);
-extern void ieee80211_stop_queue(struct ieee80211_device *ieee);
+extern void ieee80211_rtl_wake_queue(struct ieee80211_device *ieee);
+extern void ieee80211_rtl_stop_queue(struct ieee80211_device *ieee);
 extern struct sk_buff *ieee80211_get_beacon(struct ieee80211_device *ieee);
 extern void ieee80211_start_send_beacons(struct ieee80211_device *ieee);
 extern void ieee80211_stop_send_beacons(struct ieee80211_device *ieee);
diff --git a/drivers/staging/rtl8192e/ieee80211/ieee80211_module.c b/drivers/staging/rtl8192e/ieee80211/ieee80211_module.c
index 12c2a18e1fa2..f43a7db5c78b 100644
--- a/drivers/staging/rtl8192e/ieee80211/ieee80211_module.c
+++ b/drivers/staging/rtl8192e/ieee80211/ieee80211_module.c
@@ -119,7 +119,7 @@ struct net_device *alloc_ieee80211(int sizeof_priv)
 	ieee = (struct ieee80211_device *)dev->priv;
 #endif
 #if 0
-	dev->hard_start_xmit = ieee80211_xmit;
+	dev->hard_start_xmit = ieee80211_rtl_xmit;
 #endif
 
 	memset(ieee, 0, sizeof(struct ieee80211_device)+sizeof_priv);
@@ -164,7 +164,7 @@ struct net_device *alloc_ieee80211(int sizeof_priv)
  	ieee->privacy_invoked = 0;
  	ieee->ieee802_1x = 1;
 	ieee->raw_tx = 0;
-	//ieee->hwsec_support = 1; //defalt support hw security. //use module_param instead.
+	//ieee->hwsec_support = 1; //default support hw security. //use module_param instead.
 	ieee->hwsec_active = 0; //disable hwsec, switch it on when necessary.
 
 	ieee80211_softmac_init(ieee);
@@ -333,7 +333,7 @@ extern void ieee80211_crypto_ccmp_exit(void);
 extern int ieee80211_crypto_wep_init(void);
 extern void ieee80211_crypto_wep_exit(void);
 
-int __init ieee80211_init(void)
+int __init ieee80211_rtl_init(void)
 {
 	struct proc_dir_entry *e;
 	int retval;
@@ -389,7 +389,7 @@ int __init ieee80211_init(void)
 	return 0;
 }
 
-void __exit ieee80211_exit(void)
+void __exit ieee80211_rtl_exit(void)
 {
 	if (ieee80211_proc) {
 		remove_proc_entry("debug_level", ieee80211_proc);
@@ -412,8 +412,8 @@ module_param(debug, int, 0444);
 MODULE_PARM_DESC(debug, "debug output mask");
 
 
-//module_exit(ieee80211_exit);
-//module_init(ieee80211_init);
+//module_exit(ieee80211_rtl_exit);
+//module_init(ieee80211_rtl_init);
 #endif
 #endif
 
diff --git a/drivers/staging/rtl8192e/ieee80211/ieee80211_rx.c b/drivers/staging/rtl8192e/ieee80211/ieee80211_rx.c
index 5dc478b86375..06d91715143c 100644
--- a/drivers/staging/rtl8192e/ieee80211/ieee80211_rx.c
+++ b/drivers/staging/rtl8192e/ieee80211/ieee80211_rx.c
@@ -923,7 +923,7 @@ u8 parse_subframe(struct sk_buff *skb,
 /* All received frames are sent to this function. @skb contains the frame in
  * IEEE 802.11 format, i.e., in the format it was sent over air.
  * This function is called only as a tasklet (software IRQ). */
-int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
+int ieee80211_rtl_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
 		 struct ieee80211_rx_stats *rx_stats)
 {
 	struct net_device *dev = ieee->dev;
diff --git a/drivers/staging/rtl8192e/ieee80211/ieee80211_softmac.c b/drivers/staging/rtl8192e/ieee80211/ieee80211_softmac.c
index eae7c4579a68..6d1ddec39f0e 100644
--- a/drivers/staging/rtl8192e/ieee80211/ieee80211_softmac.c
+++ b/drivers/staging/rtl8192e/ieee80211/ieee80211_softmac.c
@@ -684,7 +684,7 @@ void ieee80211_stop_scan(struct ieee80211_device *ieee)
 }
 
 /* called with ieee->lock held */
-void ieee80211_start_scan(struct ieee80211_device *ieee)
+void ieee80211_rtl_start_scan(struct ieee80211_device *ieee)
 {
 #ifdef ENABLE_DOT11D
 	if(IS_DOT11D_ENABLE(ieee) )
@@ -1430,7 +1430,7 @@ void ieee80211_associate_step1(struct ieee80211_device *ieee)
 	}
 }
 
-void ieee80211_auth_challenge(struct ieee80211_device *ieee, u8 *challenge, int chlen)
+void ieee80211_rtl_auth_challenge(struct ieee80211_device *ieee, u8 *challenge, int chlen)
 {
 	u8 *c;
 	struct sk_buff *skb;
@@ -2262,7 +2262,7 @@ ieee80211_rx_frame_softmac(struct ieee80211_device *ieee, struct sk_buff *skb,
 
 								ieee80211_associate_step2(ieee);
 							}else{
-								ieee80211_auth_challenge(ieee, challenge, chlen);
+								ieee80211_rtl_auth_challenge(ieee, challenge, chlen);
 							}
 						}else{
 							ieee->softmac_stats.rx_auth_rs_err++;
@@ -2330,10 +2330,10 @@ ieee80211_rx_frame_softmac(struct ieee80211_device *ieee, struct sk_buff *skb,
  * care of the ieee802.11 fragmentation.
  * So the driver receives a fragment per time and might
  * call the stop function when it want without take care
- * to have enought room to TX an entire packet.
+ * to have enough room to TX an entire packet.
  * This might be useful if each fragment need it's own
  * descriptor, thus just keep a total free memory > than
- * the max fragmentation treshold is not enought.. If the
+ * the max fragmentation threshold is not enough.. If the
  * ieee802.11 stack passed a TXB struct then you needed
  * to keep N free descriptors where
  * N = MAX_PACKET_SIZE / MIN_FRAG_TRESHOLD
@@ -2376,7 +2376,7 @@ void ieee80211_softmac_xmit(struct ieee80211_txb *txb, struct ieee80211_device *
 			 * to check it any more.
 			 * */
 			//printk("error:no descriptor left@queue_index %d\n", queue_index);
-			//ieee80211_stop_queue(ieee);
+			//ieee80211_rtl_stop_queue(ieee);
 #ifdef USB_TX_DRIVER_AGGREGATION_ENABLE
 			skb_queue_tail(&ieee->skb_drv_aggQ[queue_index], txb->fragments[i]);
 #else
@@ -2440,7 +2440,7 @@ void ieee80211_reset_queue(struct ieee80211_device *ieee)
 
 }
 
-void ieee80211_wake_queue(struct ieee80211_device *ieee)
+void ieee80211_rtl_wake_queue(struct ieee80211_device *ieee)
 {
 
 	unsigned long flags;
@@ -2481,7 +2481,7 @@ exit :
 }
 
 
-void ieee80211_stop_queue(struct ieee80211_device *ieee)
+void ieee80211_rtl_stop_queue(struct ieee80211_device *ieee)
 {
 	//unsigned long flags;
 	//spin_lock_irqsave(&ieee->lock,flags);
@@ -2706,7 +2706,7 @@ void ieee80211_start_bss(struct ieee80211_device *ieee)
 
 	if (ieee->state == IEEE80211_NOLINK){
 		ieee->actscanning = true;
-		ieee80211_start_scan(ieee);
+		ieee80211_rtl_start_scan(ieee);
 	}
 	spin_unlock_irqrestore(&ieee->lock, flags);
 }
@@ -2775,7 +2775,7 @@ void ieee80211_associate_retry_wq(struct ieee80211_device *ieee)
 	{
 		ieee->is_roaming= false;
 		ieee->actscanning = true;
-		ieee80211_start_scan(ieee);
+		ieee80211_rtl_start_scan(ieee);
 	}
 	spin_unlock_irqrestore(&ieee->lock, flags);
 
@@ -3497,8 +3497,8 @@ void notify_wx_assoc_event(struct ieee80211_device *ieee)
 
 #if (LINUX_VERSION_CODE > KERNEL_VERSION(2,5,0))
 //EXPORT_SYMBOL(ieee80211_get_beacon);
-//EXPORT_SYMBOL(ieee80211_wake_queue);
-//EXPORT_SYMBOL(ieee80211_stop_queue);
+//EXPORT_SYMBOL(ieee80211_rtl_wake_queue);
+//EXPORT_SYMBOL(ieee80211_rtl_stop_queue);
 //EXPORT_SYMBOL(ieee80211_reset_queue);
 //EXPORT_SYMBOL(ieee80211_softmac_stop_protocol);
 //EXPORT_SYMBOL(ieee80211_softmac_start_protocol);
@@ -3518,8 +3518,8 @@ void notify_wx_assoc_event(struct ieee80211_device *ieee)
 //EXPORT_SYMBOL(ieee80211_start_scan_syncro);
 #else
 EXPORT_SYMBOL_NOVERS(ieee80211_get_beacon);
-EXPORT_SYMBOL_NOVERS(ieee80211_wake_queue);
-EXPORT_SYMBOL_NOVERS(ieee80211_stop_queue);
+EXPORT_SYMBOL_NOVERS(ieee80211_rtl_wake_queue);
+EXPORT_SYMBOL_NOVERS(ieee80211_rtl_stop_queue);
 EXPORT_SYMBOL_NOVERS(ieee80211_reset_queue);
 EXPORT_SYMBOL_NOVERS(ieee80211_softmac_stop_protocol);
 EXPORT_SYMBOL_NOVERS(ieee80211_softmac_start_protocol);
diff --git a/drivers/staging/rtl8192e/ieee80211/ieee80211_tx.c b/drivers/staging/rtl8192e/ieee80211/ieee80211_tx.c
index 103b33c093f5..798fb4154c25 100644
--- a/drivers/staging/rtl8192e/ieee80211/ieee80211_tx.c
+++ b/drivers/staging/rtl8192e/ieee80211/ieee80211_tx.c
@@ -604,7 +604,7 @@ void ieee80211_query_seqnum(struct ieee80211_device*ieee, struct sk_buff* skb, u
 	}
 }
 
-int ieee80211_xmit(struct sk_buff *skb, struct net_device *dev)
+int ieee80211_rtl_xmit(struct sk_buff *skb, struct net_device *dev)
 {
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,5,0))
 	struct ieee80211_device *ieee = netdev_priv(dev);
diff --git a/drivers/staging/rtl8192e/ieee80211/ieee80211_wx.c b/drivers/staging/rtl8192e/ieee80211/ieee80211_wx.c
index 4e34a1f4c66b..3441b72dd8fa 100644
--- a/drivers/staging/rtl8192e/ieee80211/ieee80211_wx.c
+++ b/drivers/staging/rtl8192e/ieee80211/ieee80211_wx.c
@@ -976,7 +976,7 @@ int ieee80211_wx_set_gen_ie(struct ieee80211_device *ieee, u8 *ie, size_t len)
 	{
 		if (len != ie[1]+2)
 		{
-			printk("len:%d, ie:%d\n", len, ie[1]);
+			printk("len:%zu, ie:%d\n", len, ie[1]);
 			return -EINVAL;
 		}
 		buf = kmalloc(len, GFP_KERNEL);
diff --git a/drivers/staging/rtl8192e/ieee80211/rtl819x_BAProc.c b/drivers/staging/rtl8192e/ieee80211/rtl819x_BAProc.c
index 98b3bb6b6d69..e41e8a0c739c 100644
--- a/drivers/staging/rtl8192e/ieee80211/rtl819x_BAProc.c
+++ b/drivers/staging/rtl8192e/ieee80211/rtl819x_BAProc.c
@@ -382,7 +382,7 @@ int ieee80211_rx_ADDBAReq( struct ieee80211_device* ieee, struct sk_buff *skb)
 
 	if (skb->len < sizeof( struct ieee80211_hdr_3addr) + 9)
 	{
-		IEEE80211_DEBUG(IEEE80211_DL_ERR, " Invalid skb len in BAREQ(%d / %d)\n", skb->len, 	(sizeof( struct ieee80211_hdr_3addr) + 9));
+		IEEE80211_DEBUG(IEEE80211_DL_ERR, " Invalid skb len in BAREQ(%d / %zu)\n", skb->len, 	(sizeof( struct ieee80211_hdr_3addr) + 9));
 		return -1;
 	}
 
@@ -481,7 +481,7 @@ int ieee80211_rx_ADDBARsp( struct ieee80211_device* ieee, struct sk_buff *skb)
 
 	if (skb->len < sizeof( struct ieee80211_hdr_3addr) + 9)
 	{
-		IEEE80211_DEBUG(IEEE80211_DL_ERR, " Invalid skb len in BARSP(%d / %d)\n", skb->len, 	(sizeof( struct ieee80211_hdr_3addr) + 9));
+		IEEE80211_DEBUG(IEEE80211_DL_ERR, " Invalid skb len in BARSP(%d / %zu)\n", skb->len, 	(sizeof( struct ieee80211_hdr_3addr) + 9));
 		return -1;
 	}
 	rsp = ( struct ieee80211_hdr_3addr*)skb->data;
@@ -611,7 +611,7 @@ int ieee80211_rx_DELBA(struct ieee80211_device* ieee,struct sk_buff *skb)
 
 	if (skb->len < sizeof( struct ieee80211_hdr_3addr) + 6)
 	{
-		IEEE80211_DEBUG(IEEE80211_DL_ERR, " Invalid skb len in DELBA(%d / %d)\n", skb->len, 	(sizeof( struct ieee80211_hdr_3addr) + 6));
+		IEEE80211_DEBUG(IEEE80211_DL_ERR, " Invalid skb len in DELBA(%d / %zu)\n", skb->len, 	(sizeof( struct ieee80211_hdr_3addr) + 6));
 		return -1;
 	}
 
diff --git a/drivers/staging/rtl8192e/r8190_rtl8256.c b/drivers/staging/rtl8192e/r8190_rtl8256.c
index 0eaee3ad2230..3d67fbb65b96 100644
--- a/drivers/staging/rtl8192e/r8190_rtl8256.c
+++ b/drivers/staging/rtl8192e/r8190_rtl8256.c
@@ -629,7 +629,7 @@ SetRFPowerState8190(
 
 			default:
 					bResult = false;
-					RT_TRACE(COMP_ERR, "SetRFPowerState8190(): unknow state to set: 0x%X!!!\n", eRFPowerState);
+					RT_TRACE(COMP_ERR, "SetRFPowerState8190(): unknown state to set: 0x%X!!!\n", eRFPowerState);
 					break;
 		}
 
diff --git a/drivers/staging/rtl8192e/r8192E_core.c b/drivers/staging/rtl8192e/r8192E_core.c
index b0802a7aeb5f..0ca5d8b4f746 100644
--- a/drivers/staging/rtl8192e/r8192E_core.c
+++ b/drivers/staging/rtl8192e/r8192E_core.c
@@ -1041,7 +1041,7 @@ static void rtl8192_tx_isr(struct net_device *dev, int prio)
         tx_desc_819x_pci *entry = &ring->desc[ring->idx];
         struct sk_buff *skb;
 
-        /* beacon packet will only use the first descriptor defautly,
+        /* beacon packet will only use the first descriptor defaultly,
          * and the OWN may not be cleared by the hardware
          * */
         if(prio != BEACON_QUEUE) {
@@ -2562,7 +2562,7 @@ static void rtl8192_read_eeprom_info(struct net_device* dev)
 		priv->bTXPowerDataReadFromEEPORM = false;
 	}
 
-	// 2007/11/15 MH 8190PCI Default=2T4R, 8192PCIE dafault=1T2R
+	// 2007/11/15 MH 8190PCI Default=2T4R, 8192PCIE default=1T2R
 	priv->rf_type = RTL819X_DEFAULT_RF_TYPE;
 
 	if(priv->card_8192_version > VERSION_8190_BD)
@@ -3554,7 +3554,7 @@ void rtl8192_prepare_beacon(struct r8192_priv *priv)
 	//spin_lock_irqsave(&priv->tx_lock,flags);
 	/* prepare misc info for the beacon xmit */
 	tcb_desc->queue_index = BEACON_QUEUE;
-	/* IBSS does not support HT yet, use 1M defautly */
+	/* IBSS does not support HT yet, use 1M defaultly */
 	tcb_desc->data_rate = 2;
 	tcb_desc->RATRIndex = 7;
 	tcb_desc->bTxDisableRateFallBack = 1;
@@ -5795,7 +5795,7 @@ static void rtl8192_rx(struct net_device *dev)
                 stats.fragoffset = 0;
                 stats.ntotalfrag = 1;
 
-                if(!ieee80211_rx(priv->ieee80211, skb, &stats)){
+                if(!ieee80211_rtl_rx(priv->ieee80211, skb, &stats)){
                     dev_kfree_skb_any(skb);
                 } else {
                     priv->stats.rxok++;
@@ -5837,7 +5837,7 @@ static const struct net_device_ops rtl8192_netdev_ops = {
 	.ndo_do_ioctl =			rtl8192_ioctl,
 	.ndo_set_multicast_list =	r8192_set_multicast,
 	.ndo_set_mac_address =		r8192_set_mac_adr,
-	.ndo_start_xmit = 		ieee80211_xmit,
+	.ndo_start_xmit = 		ieee80211_rtl_xmit,
 };
 
 /****************************************************************************
@@ -6121,14 +6121,14 @@ static void __devexit rtl8192_pci_disconnect(struct pci_dev *pdev)
 	RT_TRACE(COMP_DOWN, "wlan driver removed\n");
 }
 
-extern int ieee80211_init(void);
-extern void ieee80211_exit(void);
+extern int ieee80211_rtl_init(void);
+extern void ieee80211_rtl_exit(void);
 
 static int __init rtl8192_pci_module_init(void)
 {
 	int retval;
 
-	retval = ieee80211_init();
+	retval = ieee80211_rtl_init();
 	if (retval)
 		return retval;
 
@@ -6153,7 +6153,7 @@ static void __exit rtl8192_pci_module_exit(void)
 
 	RT_TRACE(COMP_DOWN, "Exiting");
 	rtl8192_proc_module_remove();
-	ieee80211_exit();
+	ieee80211_rtl_exit();
 }
 
 //warning message WB
@@ -6313,7 +6313,7 @@ void rtl8192_try_wake_queue(struct net_device *dev, int pri)
         spin_unlock_irqrestore(&priv->tx_lock,flags);
 
 	if(enough_desc)
-		ieee80211_wake_queue(priv->ieee80211);
+		ieee80211_rtl_wake_queue(priv->ieee80211);
 #endif
 }
 
diff --git a/drivers/staging/rtl8192e/r8192E_dm.c b/drivers/staging/rtl8192e/r8192E_dm.c
index bf876322dac2..5ffb4f74055b 100644
--- a/drivers/staging/rtl8192e/r8192E_dm.c
+++ b/drivers/staging/rtl8192e/r8192E_dm.c
@@ -455,7 +455,7 @@ static void dm_check_rate_adaptive(struct net_device * dev)
 					(pra->low_rssi_thresh_for_ra40M):(pra->low_rssi_thresh_for_ra20M);
 		}
 
-		//DbgPrint("[DM] THresh H/L=%d/%d\n\r", RATR.HighRSSIThreshForRA, RATR.LowRSSIThreshForRA);
+		//DbgPrint("[DM] Thresh H/L=%d/%d\n\r", RATR.HighRSSIThreshForRA, RATR.LowRSSIThreshForRA);
 		if(priv->undecorated_smoothed_pwdb >= (long)HighRSSIThreshForRA)
 		{
 			//DbgPrint("[DM] RSSI=%d STA=HIGH\n\r", pHalData->UndecoratedSmoothedPWDB);
@@ -571,7 +571,7 @@ static u32 OFDMSwingTable[OFDM_Table_Length] = {
 	0x5a400169,	// 3, +3db
 	0x50800142,	// 4, +2db
 	0x47c0011f,	// 5, +1db
-	0x40000100,	// 6, +0db ===> default, upper for higher temprature, lower for low temprature
+	0x40000100,	// 6, +0db ===> default, upper for higher temperature, lower for low temperature
 	0x390000e4,	// 7, -1db
 	0x32c000cb,	// 8, -2db
 	0x2d4000b5,	// 9, -3db
@@ -932,14 +932,14 @@ static void dm_TXPowerTrackingCallback_ThermalMeter(struct net_device * dev)
 	RT_TRACE(COMP_POWER_TRACKING, "Readback ThermalMeterA = %d \n", tmpRegA);
 	if(tmpRegA < 3 || tmpRegA > 13)
 		return;
-	if(tmpRegA >= 12)	// if over 12, TP will be bad when high temprature
+	if(tmpRegA >= 12)	// if over 12, TP will be bad when high temperature
 		tmpRegA = 12;
 	RT_TRACE(COMP_POWER_TRACKING, "Valid ThermalMeterA = %d \n", tmpRegA);
 	priv->ThermalMeter[0] = ThermalMeterVal;	//We use fixed value by Bryant's suggestion
 	priv->ThermalMeter[1] = ThermalMeterVal;	//We use fixed value by Bryant's suggestion
 
-	//Get current RF-A temprature index
-	if(priv->ThermalMeter[0] >= (u8)tmpRegA)	//lower temprature
+	//Get current RF-A temperature index
+	if(priv->ThermalMeter[0] >= (u8)tmpRegA)	//lower temperature
 	{
 		tmpOFDMindex = tmpCCK20Mindex = 6+(priv->ThermalMeter[0]-(u8)tmpRegA);
 		tmpCCK40Mindex = tmpCCK20Mindex - 6;
@@ -953,7 +953,7 @@ static void dm_TXPowerTrackingCallback_ThermalMeter(struct net_device * dev)
 	else
 	{
 		tmpval = ((u8)tmpRegA - priv->ThermalMeter[0]);
-		if(tmpval >= 6)								// higher temprature
+		if(tmpval >= 6)								// higher temperature
 			tmpOFDMindex = tmpCCK20Mindex = 0;		// max to +6dB
 		else
 			tmpOFDMindex = tmpCCK20Mindex = 6 - tmpval;
@@ -2017,7 +2017,7 @@ static void dm_dig_init(struct net_device *dev)
 	dm_digtable.dbg_mode = DM_DBG_OFF;	//off=by real rssi value, on=by DM_DigTable.Rssi_val for new dig
 	dm_digtable.dig_algorithm_switch = 0;
 
-	/* 2007/10/04 MH Define init gain threshol. */
+	/* 2007/10/04 MH Define init gain threshold. */
 	dm_digtable.dig_state		= DM_STA_DIG_MAX;
 	dm_digtable.dig_highpwr_state	= DM_STA_DIG_MAX;
 	dm_digtable.initialgain_lowerbound_state = false;
@@ -2145,7 +2145,7 @@ static void dm_ctrl_initgain_byrssi_by_fwfalse_alarm(
 	/*DbgPrint("DIG Check\n\r RSSI=%d LOW=%d HIGH=%d STATE=%d",
 	pHalData->UndecoratedSmoothedPWDB, DM_DigTable.RssiLowThresh,
 	DM_DigTable.RssiHighThresh, DM_DigTable.Dig_State);*/
-	/* 1. When RSSI decrease, We have to judge if it is smaller than a treshold
+	/* 1. When RSSI decrease, We have to judge if it is smaller than a threshold
 		  and then execute below step. */
 	if ((priv->undecorated_smoothed_pwdb <= dm_digtable.rssi_low_thresh))
 	{
@@ -2205,7 +2205,7 @@ static void dm_ctrl_initgain_byrssi_by_fwfalse_alarm(
 
 	}
 
-	/* 2. When RSSI increase, We have to judge if it is larger than a treshold
+	/* 2. When RSSI increase, We have to judge if it is larger than a threshold
 		  and then execute below step.  */
 	if ((priv->undecorated_smoothed_pwdb >= dm_digtable.rssi_high_thresh) )
 	{
@@ -2314,7 +2314,7 @@ static void dm_ctrl_initgain_byrssi_highpwr(
 	}
 
 	/* 3. When RSSI >75% or <70%, it is a high power issue. We have to judge if
-		  it is larger than a treshold and then execute below step.  */
+		  it is larger than a threshold and then execute below step.  */
 	// 2008/02/05 MH SD3-Jerry Modify PD_TH for high power issue.
 	if (priv->undecorated_smoothed_pwdb >= dm_digtable.rssi_high_power_highthresh)
 	{
diff --git a/drivers/staging/rtl8192e/r8192E_wx.c b/drivers/staging/rtl8192e/r8192E_wx.c
index e9e799c22863..d1eb89229cdf 100644
--- a/drivers/staging/rtl8192e/r8192E_wx.c
+++ b/drivers/staging/rtl8192e/r8192E_wx.c
@@ -446,7 +446,7 @@ static int rtl8180_wx_get_range(struct net_device *dev,
 	range->max_qual.updated = 7; /* Updated all three */
 
 	range->avg_qual.qual = 92; /* > 8% missed beacons is 'bad' */
-	/* TODO: Find real 'good' to 'bad' threshol value for RSSI */
+	/* TODO: Find real 'good' to 'bad' threshold value for RSSI */
 	range->avg_qual.level = 20 + -98;
 	range->avg_qual.noise = 0;
 	range->avg_qual.updated = 7; /* Updated all three */
diff --git a/drivers/staging/rtl8192e/r819xE_cmdpkt.c b/drivers/staging/rtl8192e/r819xE_cmdpkt.c
index d6b7d2f39e3e..2aaa4e1bb375 100644
--- a/drivers/staging/rtl8192e/r819xE_cmdpkt.c
+++ b/drivers/staging/rtl8192e/r819xE_cmdpkt.c
@@ -783,7 +783,7 @@ u32 cmpk_message_handle_rx(struct net_device *dev, struct ieee80211_rx_stats *ps
 
 			default:
 
-			        RT_TRACE(COMP_EVENTS, "---->cmpk_message_handle_rx():unknow CMD Element\n");
+			        RT_TRACE(COMP_EVENTS, "---->cmpk_message_handle_rx():unknown CMD Element\n");
 				return 1;	/* This is a command packet. */
 		}
 		// 2007/01/22 MH Display received rx command packet info.
diff --git a/drivers/staging/rtl8192e/r819xE_phyreg.h b/drivers/staging/rtl8192e/r819xE_phyreg.h
index d4a439275eff..37f0feefaf2c 100644
--- a/drivers/staging/rtl8192e/r819xE_phyreg.h
+++ b/drivers/staging/rtl8192e/r819xE_phyreg.h
@@ -294,7 +294,7 @@
 #define bR2RCCAMask               		0x00000f00
 #define bHSSI_R2TDelay            		0xf8000000
 #define bHSSI_T2RDelay            		0xf80000
-#define bContTxHSSI               		0x400     //chane gain at continue Tx
+#define bContTxHSSI               		0x400     //channel gain at continue Tx
 #define bIGFromCCK                		0x200
 #define bAGCAddress               		0x3f
 #define bRxHPTx                   			0x7000
diff --git a/drivers/staging/rtl8192su/Kconfig b/drivers/staging/rtl8192su/Kconfig
index b8c95f942069..123fa6d6a93b 100644
--- a/drivers/staging/rtl8192su/Kconfig
+++ b/drivers/staging/rtl8192su/Kconfig
@@ -1,6 +1,6 @@
 config RTL8192SU
 	tristate "RealTek RTL8192SU Wireless LAN NIC driver"
-	depends on PCI && WLAN
+	depends on PCI && WLAN && USB
 	depends on WIRELESS_EXT
 	default N
 	---help---
diff --git a/drivers/staging/rtl8192su/ieee80211/ieee80211.h b/drivers/staging/rtl8192su/ieee80211/ieee80211.h
index f22d024b1c39..9a4c858b0666 100644
--- a/drivers/staging/rtl8192su/ieee80211/ieee80211.h
+++ b/drivers/staging/rtl8192su/ieee80211/ieee80211.h
@@ -1721,13 +1721,13 @@ extern int ieee80211_encrypt_fragment(
 	struct sk_buff *frag,
 	int hdr_len);
 
-extern int rtl8192_ieee80211_xmit(struct sk_buff *skb,
+extern int rtl8192_ieee80211_rtl_xmit(struct sk_buff *skb,
 			  struct net_device *dev);
 extern void ieee80211_txb_free(struct ieee80211_txb *);
 
 
 /* ieee80211_rx.c */
-extern int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
+extern int ieee80211_rtl_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
 			struct ieee80211_rx_stats *rx_stats);
 extern void ieee80211_rx_mgt(struct ieee80211_device *ieee,
 			     struct ieee80211_hdr_4addr *header,
@@ -1783,8 +1783,8 @@ extern void ieee80211_stop_protocol(struct ieee80211_device *ieee);
 extern void ieee80211_softmac_start_protocol(struct ieee80211_device *ieee);
 extern void ieee80211_softmac_stop_protocol(struct ieee80211_device *ieee);
 extern void ieee80211_reset_queue(struct ieee80211_device *ieee);
-extern void ieee80211_wake_queue(struct ieee80211_device *ieee);
-extern void ieee80211_stop_queue(struct ieee80211_device *ieee);
+extern void ieee80211_rtl_wake_queue(struct ieee80211_device *ieee);
+extern void ieee80211_rtl_stop_queue(struct ieee80211_device *ieee);
 extern struct sk_buff *ieee80211_get_beacon(struct ieee80211_device *ieee);
 extern void ieee80211_start_send_beacons(struct ieee80211_device *ieee);
 extern void ieee80211_stop_send_beacons(struct ieee80211_device *ieee);
diff --git a/drivers/staging/rtl8192su/ieee80211/ieee80211_module.c b/drivers/staging/rtl8192su/ieee80211/ieee80211_module.c
index c3383bb8b760..e8c67d5dfb76 100644
--- a/drivers/staging/rtl8192su/ieee80211/ieee80211_module.c
+++ b/drivers/staging/rtl8192su/ieee80211/ieee80211_module.c
@@ -156,7 +156,7 @@ struct net_device *alloc_ieee80211(int sizeof_priv)
  	ieee->privacy_invoked = 0;
  	ieee->ieee802_1x = 1;
 	ieee->raw_tx = 0;
-	//ieee->hwsec_support = 1; //defalt support hw security. //use module_param instead.
+	//ieee->hwsec_support = 1; //default support hw security. //use module_param instead.
 	ieee->hwsec_active = 0; //disable hwsec, switch it on when necessary.
 
 	ieee80211_softmac_init(ieee);
diff --git a/drivers/staging/rtl8192su/ieee80211/ieee80211_rx.c b/drivers/staging/rtl8192su/ieee80211/ieee80211_rx.c
index 8e56f97a8f57..fecfa120ff48 100644
--- a/drivers/staging/rtl8192su/ieee80211/ieee80211_rx.c
+++ b/drivers/staging/rtl8192su/ieee80211/ieee80211_rx.c
@@ -37,7 +37,6 @@
 #include <linux/slab.h>
 #include <linux/tcp.h>
 #include <linux/types.h>
-#include <linux/version.h>
 #include <linux/wireless.h>
 #include <linux/etherdevice.h>
 #include <asm/uaccess.h>
@@ -209,7 +208,7 @@ static int ieee80211_frag_cache_invalidate(struct ieee80211_device *ieee,
  *
  * Responsible for handling management control frames
  *
- * Called by ieee80211_rx */
+ * Called by ieee80211_rtl_rx */
 static inline int
 ieee80211_rx_frame_mgmt(struct ieee80211_device *ieee, struct sk_buff *skb,
 			struct ieee80211_rx_stats *rx_stats, u16 type,
@@ -290,7 +289,7 @@ static int ieee80211_is_eapol_frame(struct ieee80211_device *ieee,
 	return 0;
 }
 
-/* Called only as a tasklet (software IRQ), by ieee80211_rx */
+/* Called only as a tasklet (software IRQ), by ieee80211_rtl_rx */
 static inline int
 ieee80211_rx_frame_decrypt(struct ieee80211_device* ieee, struct sk_buff *skb,
 			   struct ieee80211_crypt_data *crypt)
@@ -859,7 +858,7 @@ u8 parse_subframe(struct sk_buff *skb,
 /* All received frames are sent to this function. @skb contains the frame in
  * IEEE 802.11 format, i.e., in the format it was sent over air.
  * This function is called only as a tasklet (software IRQ). */
-int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
+int ieee80211_rtl_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
 		 struct ieee80211_rx_stats *rx_stats)
 {
 	struct net_device *dev = ieee->dev;
diff --git a/drivers/staging/rtl8192su/ieee80211/ieee80211_softmac.c b/drivers/staging/rtl8192su/ieee80211/ieee80211_softmac.c
index fd8e11252f1b..95d4f84dcf3f 100644
--- a/drivers/staging/rtl8192su/ieee80211/ieee80211_softmac.c
+++ b/drivers/staging/rtl8192su/ieee80211/ieee80211_softmac.c
@@ -610,7 +610,7 @@ void ieee80211_stop_scan(struct ieee80211_device *ieee)
 }
 
 /* called with ieee->lock held */
-void ieee80211_start_scan(struct ieee80211_device *ieee)
+void ieee80211_rtl_start_scan(struct ieee80211_device *ieee)
 {
 	if(IS_DOT11D_ENABLE(ieee) )
 	{
@@ -1281,7 +1281,7 @@ void ieee80211_associate_step1(struct ieee80211_device *ieee)
 	}
 }
 
-void ieee80211_auth_challenge(struct ieee80211_device *ieee, u8 *challenge, int chlen)
+void ieee80211_rtl_auth_challenge(struct ieee80211_device *ieee, u8 *challenge, int chlen)
 {
 	u8 *c;
 	struct sk_buff *skb;
@@ -2054,7 +2054,7 @@ ieee80211_rx_frame_softmac(struct ieee80211_device *ieee, struct sk_buff *skb,
 
 								ieee80211_associate_step2(ieee);
 							}else{
-								ieee80211_auth_challenge(ieee, challenge, chlen);
+								ieee80211_rtl_auth_challenge(ieee, challenge, chlen);
 							}
 						}else{
 							ieee->softmac_stats.rx_auth_rs_err++;
@@ -2120,10 +2120,10 @@ ieee80211_rx_frame_softmac(struct ieee80211_device *ieee, struct sk_buff *skb,
  * care of the ieee802.11 fragmentation.
  * So the driver receives a fragment per time and might
  * call the stop function when it want without take care
- * to have enought room to TX an entire packet.
+ * to have enough room to TX an entire packet.
  * This might be useful if each fragment need it's own
  * descriptor, thus just keep a total free memory > than
- * the max fragmentation treshold is not enought.. If the
+ * the max fragmentation threshold is not enough.. If the
  * ieee802.11 stack passed a TXB struct then you needed
  * to keep N free descriptors where
  * N = MAX_PACKET_SIZE / MIN_FRAG_TRESHOLD
@@ -2162,7 +2162,7 @@ void ieee80211_softmac_xmit(struct ieee80211_txb *txb, struct ieee80211_device *
 			 * to check it any more.
 			 * */
 			//printk("error:no descriptor left@queue_index %d, %d, %d\n", queue_index, skb_queue_len(&ieee->skb_waitQ[queue_index]), ieee->check_nic_enough_desc(ieee->dev,queue_index));
-			//ieee80211_stop_queue(ieee);
+			//ieee80211_rtl_stop_queue(ieee);
 			skb_queue_tail(&ieee->skb_waitQ[queue_index], txb->fragments[i]);
 		}else{
 			ieee->softmac_data_hard_start_xmit(
@@ -2222,7 +2222,7 @@ void ieee80211_reset_queue(struct ieee80211_device *ieee)
 
 }
 
-void ieee80211_wake_queue(struct ieee80211_device *ieee)
+void ieee80211_rtl_wake_queue(struct ieee80211_device *ieee)
 {
 
 	unsigned long flags;
@@ -2263,7 +2263,7 @@ exit :
 }
 
 
-void ieee80211_stop_queue(struct ieee80211_device *ieee)
+void ieee80211_rtl_stop_queue(struct ieee80211_device *ieee)
 {
 	//unsigned long flags;
 	//spin_lock_irqsave(&ieee->lock,flags);
@@ -2479,7 +2479,7 @@ void ieee80211_start_bss(struct ieee80211_device *ieee)
 
 	if (ieee->state == IEEE80211_NOLINK){
 		ieee->actscanning = true;
-		ieee80211_start_scan(ieee);
+		ieee80211_rtl_start_scan(ieee);
 	}
 	spin_unlock_irqrestore(&ieee->lock, flags);
 }
@@ -2552,7 +2552,7 @@ void ieee80211_associate_retry_wq(struct work_struct *work)
 	if(ieee->state == IEEE80211_NOLINK)
 	{
 		ieee->actscanning = true;
-		ieee80211_start_scan(ieee);
+		ieee80211_rtl_start_scan(ieee);
 	}
 	spin_unlock_irqrestore(&ieee->lock, flags);
 
diff --git a/drivers/staging/rtl8192su/ieee80211/ieee80211_tx.c b/drivers/staging/rtl8192su/ieee80211/ieee80211_tx.c
index 47ff0efb6370..4d54e1e62d22 100644
--- a/drivers/staging/rtl8192su/ieee80211/ieee80211_tx.c
+++ b/drivers/staging/rtl8192su/ieee80211/ieee80211_tx.c
@@ -47,7 +47,6 @@
 #include <linux/slab.h>
 #include <linux/tcp.h>
 #include <linux/types.h>
-#include <linux/version.h>
 #include <linux/wireless.h>
 #include <linux/etherdevice.h>
 #include <asm/uaccess.h>
@@ -605,7 +604,7 @@ void ieee80211_query_seqnum(struct ieee80211_device*ieee, struct sk_buff* skb, u
 	}
 }
 
-int rtl8192_ieee80211_xmit(struct sk_buff *skb, struct net_device *dev)
+int rtl8192_ieee80211_rtl_xmit(struct sk_buff *skb, struct net_device *dev)
 {
 	struct ieee80211_device *ieee = netdev_priv(dev);
 	struct ieee80211_txb *txb = NULL;
diff --git a/drivers/staging/rtl8192su/ieee80211/ieee80211_wx.c b/drivers/staging/rtl8192su/ieee80211/ieee80211_wx.c
index 6146c6435dde..85c7e96b622d 100644
--- a/drivers/staging/rtl8192su/ieee80211/ieee80211_wx.c
+++ b/drivers/staging/rtl8192su/ieee80211/ieee80211_wx.c
@@ -30,7 +30,6 @@
 
 ******************************************************************************/
 #include <linux/wireless.h>
-#include <linux/version.h>
 #include <linux/kmod.h>
 #include <linux/module.h>
 
diff --git a/drivers/staging/rtl8192su/ieee80211/readme b/drivers/staging/rtl8192su/ieee80211/readme
index 5764f2859286..7ba177ba3e33 100644
--- a/drivers/staging/rtl8192su/ieee80211/readme
+++ b/drivers/staging/rtl8192su/ieee80211/readme
@@ -37,7 +37,7 @@ What this layer doesn't do (yet)
   disassociate clients, and it is really prone to always allow access.
   In bss client mode it is a bit rough with AP deauth and disassoc requests.
 - It has not any entry point to view the collected stats.
-- Altought it takes care of the card supported rates in the management frame
+- Although it takes care of the card supported rates in the management frame
   it sends, support for rate changing on TXed packet is not complete.
 - Give up once associated in bss client mode (it never detect a
   signal loss condition to disassociate and restart scanning)
diff --git a/drivers/staging/rtl8192su/r8192S_phy.c b/drivers/staging/rtl8192su/r8192S_phy.c
index 2c111d712f8f..77ab026288d3 100644
--- a/drivers/staging/rtl8192su/r8192S_phy.c
+++ b/drivers/staging/rtl8192su/r8192S_phy.c
@@ -1728,7 +1728,7 @@ static bool phy_SetRFPowerState8192SU(struct net_device* dev,RT_RF_POWER_STATE e
 
 			default:
 				bResult = FALSE;
-				//RT_ASSERT(FALSE, ("phy_SetRFPowerState8192SU(): unknow state to set: 0x%X!!!\n", eRFPowerState));
+				//RT_ASSERT(FALSE, ("phy_SetRFPowerState8192SU(): unknown state to set: 0x%X!!!\n", eRFPowerState));
 				break;
 		}
 		break;
@@ -2711,7 +2711,7 @@ u8 rtl8192_phy_SwChnl(struct net_device* dev, u8 channel)
 // However, this procedure is performed synchronously  which should be running under
 // passive level.
 //
-//not understant it
+//not understand it
 void PHY_SwChnlPhy8192S(	// Only called during initialize
 	struct net_device* dev,
 	u8		channel
diff --git a/drivers/staging/rtl8192su/r8192S_phyreg.h b/drivers/staging/rtl8192su/r8192S_phyreg.h
index 96c7cfa92542..2e4d76d196aa 100644
--- a/drivers/staging/rtl8192su/r8192S_phyreg.h
+++ b/drivers/staging/rtl8192su/r8192S_phyreg.h
@@ -38,7 +38,7 @@
 // 2. 0x800/0x900/0xA00/0xC00/0xD00/0xE00
 // 3. RF register 0x00-2E
 // 4. Bit Mask for BB/RF register
-// 5. Other defintion for BB/RF R/W
+// 5. Other definition for BB/RF R/W
 //
 
 
@@ -453,7 +453,7 @@
 #define		bR2RCCAMask               			0x00000f00
 #define		bHSSI_R2TDelay            		0xf8000000
 #define		bHSSI_T2RDelay            		0xf80000
-#define		bContTxHSSI               			0x400     //chane gain at continue Tx
+#define		bContTxHSSI               			0x400     //channel gain at continue Tx
 #define		bIGFromCCK                			0x200
 #define		bAGCAddress               			0x3f
 #define		bRxHPTx                   			0x7000
diff --git a/drivers/staging/rtl8192su/r8192S_rtl6052.c b/drivers/staging/rtl8192su/r8192S_rtl6052.c
index 69ef6dfc588b..22398099adae 100644
--- a/drivers/staging/rtl8192su/r8192S_rtl6052.c
+++ b/drivers/staging/rtl8192su/r8192S_rtl6052.c
@@ -326,7 +326,7 @@ extern void PHY_RF6052SetOFDMTxPower(struct net_device* dev, u8 powerlevel)
 
 		//
 		// If path A and Path B coexist, we must limit Path A tx power.
-		// Protect Path B pwr over or under flow. We need to calculate upper and
+		// Protect Path B pwr over or underflow. We need to calculate upper and
 		// lower bound of path A tx power.
 		//
 		if (priv->rf_type == RF_2T2R)
@@ -354,7 +354,7 @@ extern void PHY_RF6052SetOFDMTxPower(struct net_device* dev, u8 powerlevel)
 
 			//
 			// If path A and Path B coexist, we must limit Path A tx power.
-			// Protect Path B pwr over or under flow. We need to calculate upper and
+			// Protect Path B pwr under/over flow. We need to calculate upper and
 			// lower bound of path A tx power.
 			//
 			if (priv->rf_type == RF_2T2R)
diff --git a/drivers/staging/rtl8192su/r8192U_core.c b/drivers/staging/rtl8192su/r8192U_core.c
index 66274d7666ff..ccb9d5b8cd44 100644
--- a/drivers/staging/rtl8192su/r8192U_core.c
+++ b/drivers/staging/rtl8192su/r8192U_core.c
@@ -126,6 +126,8 @@ static struct usb_device_id rtl8192_usb_id_tbl[] = {
 	{USB_DEVICE(0x2001, 0x3301)},
 	/* Zinwell */
 	{USB_DEVICE(0x5a57, 0x0290)},
+	/* Guillemot */
+	{USB_DEVICE(0x06f8, 0xe031)},
 	//92SU
 	{USB_DEVICE(0x0bda, 0x8172)},
 	{}
@@ -1501,7 +1503,7 @@ static void rtl8192_rx_isr(struct urb *urb)
         urb->context = skb;
         skb_queue_tail(&priv->rx_queue, skb);
         err = usb_submit_urb(urb, GFP_ATOMIC);
-	if(err && err != EPERM)
+	if(err && err != -EPERM)
 		printk("can not submit rxurb, err is %x,URB status is %x\n",err,urb->status);
 }
 
@@ -7155,7 +7157,7 @@ void rtl8192SU_rx_nomal(struct sk_buff* skb)
 			unicast_packet = true;
 		}
 
-		if(!ieee80211_rx(priv->ieee80211,skb, &stats)) {
+		if(!ieee80211_rtl_rx(priv->ieee80211,skb, &stats)) {
 			dev_kfree_skb_any(skb);
 		} else {
 		//	priv->stats.rxoktotal++;  //YJ,test,090108
@@ -7426,7 +7428,7 @@ static const struct net_device_ops rtl8192_netdev_ops = {
 	.ndo_set_mac_address	= r8192_set_mac_adr,
 	.ndo_validate_addr	= eth_validate_addr,
 	.ndo_change_mtu		= eth_change_mtu,
-	.ndo_start_xmit		= rtl8192_ieee80211_xmit,
+	.ndo_start_xmit		= rtl8192_ieee80211_rtl_xmit,
 };
 
 static int __devinit rtl8192_usb_probe(struct usb_interface *intf,
@@ -7619,7 +7621,7 @@ void rtl8192_try_wake_queue(struct net_device *dev, int pri)
         spin_unlock_irqrestore(&priv->tx_lock,flags);
 
 	if(enough_desc)
-		ieee80211_wake_queue(priv->ieee80211);
+		ieee80211_rtl_wake_queue(priv->ieee80211);
 }
 
 void EnableHWSecurityConfig8192(struct net_device *dev)
diff --git a/drivers/staging/rtl8192su/r8192U_dm.c b/drivers/staging/rtl8192su/r8192U_dm.c
index 5358ae8ba616..7891e9640272 100644
--- a/drivers/staging/rtl8192su/r8192U_dm.c
+++ b/drivers/staging/rtl8192su/r8192U_dm.c
@@ -593,7 +593,7 @@ static u32 OFDMSwingTable[OFDM_Table_Length] = {
 	0x5a400169,	// 3, +3db
 	0x50800142,	// 4, +2db
 	0x47c0011f,	// 5, +1db
-	0x40000100,	// 6, +0db ===> default, upper for higher temprature, lower for low temprature
+	0x40000100,	// 6, +0db ===> default, upper for higher temperature, lower for low temperature
 	0x390000e4,	// 7, -1db
 	0x32c000cb,	// 8, -2db
 	0x2d4000b5,	// 9, -3db
@@ -912,14 +912,14 @@ static void dm_TXPowerTrackingCallback_ThermalMeter(struct net_device * dev)
 	RT_TRACE(COMP_POWER_TRACKING, "Readback ThermalMeterA = %d \n", tmpRegA);
 	if(tmpRegA < 3 || tmpRegA > 13)
 		return;
-	if(tmpRegA >= 12)	// if over 12, TP will be bad when high temprature
+	if(tmpRegA >= 12)	// if over 12, TP will be bad when high temperature
 		tmpRegA = 12;
 	RT_TRACE(COMP_POWER_TRACKING, "Valid ThermalMeterA = %d \n", tmpRegA);
 	priv->ThermalMeter[0] = ThermalMeterVal;	//We use fixed value by Bryant's suggestion
 	priv->ThermalMeter[1] = ThermalMeterVal;	//We use fixed value by Bryant's suggestion
 
-	//Get current RF-A temprature index
-	if(priv->ThermalMeter[0] >= (u8)tmpRegA)	//lower temprature
+	//Get current RF-A temperature index
+	if(priv->ThermalMeter[0] >= (u8)tmpRegA)	//lower temperature
 	{
 		tmpOFDMindex = tmpCCK20Mindex = 6+(priv->ThermalMeter[0]-(u8)tmpRegA);
 		tmpCCK40Mindex = tmpCCK20Mindex - 6;
@@ -933,7 +933,7 @@ static void dm_TXPowerTrackingCallback_ThermalMeter(struct net_device * dev)
 	else
 	{
 		tmpval = ((u8)tmpRegA - priv->ThermalMeter[0]);
-		if(tmpval >= 6)								// higher temprature
+		if(tmpval >= 6)								// higher temperature
 			tmpOFDMindex = tmpCCK20Mindex = 0;		// max to +6dB
 		else
 			tmpOFDMindex = tmpCCK20Mindex = 6 - tmpval;
diff --git a/drivers/staging/rtl8192su/r8192U_wx.c b/drivers/staging/rtl8192su/r8192U_wx.c
index 2208c9b1e726..a7cc6f9a4739 100644
--- a/drivers/staging/rtl8192su/r8192U_wx.c
+++ b/drivers/staging/rtl8192su/r8192U_wx.c
@@ -435,7 +435,7 @@ static int rtl8180_wx_get_range(struct net_device *dev,
 	range->max_qual.updated = 7; /* Updated all three */
 
 	range->avg_qual.qual = 92; /* > 8% missed beacons is 'bad' */
-	/* TODO: Find real 'good' to 'bad' threshol value for RSSI */
+	/* TODO: Find real 'good' to 'bad' threshold value for RSSI */
 	range->avg_qual.level = 20 + -98;
 	range->avg_qual.noise = 0;
 	range->avg_qual.updated = 7; /* Updated all three */
diff --git a/drivers/staging/rtl8192su/r819xU_cmdpkt.c b/drivers/staging/rtl8192su/r819xU_cmdpkt.c
index e2ba93e30757..3ebfe79bb663 100644
--- a/drivers/staging/rtl8192su/r819xU_cmdpkt.c
+++ b/drivers/staging/rtl8192su/r819xU_cmdpkt.c
@@ -697,7 +697,7 @@ cmpk_message_handle_rx(
 
 			default:
 
-			        RT_TRACE(COMP_ERR, "---->cmpk_message_handle_rx():unknow CMD Element\n");
+			        RT_TRACE(COMP_ERR, "---->cmpk_message_handle_rx():unknown CMD Element\n");
 				return 1;	/* This is a command packet. */
 		}
 		// 2007/01/22 MH Display received rx command packet info.
diff --git a/drivers/staging/rtl8192u/Kconfig b/drivers/staging/rtl8192u/Kconfig
new file mode 100644
index 000000000000..9913ab8fb359
--- /dev/null
+++ b/drivers/staging/rtl8192u/Kconfig
@@ -0,0 +1,6 @@
+config RTL8192U
+	tristate "RealTek RTL8192U Wireless LAN NIC driver"
+	depends on PCI && WLAN && USB
+	depends on WIRELESS_EXT
+	default N
+	---help---
diff --git a/drivers/staging/rtl8192u/Makefile b/drivers/staging/rtl8192u/Makefile
new file mode 100644
index 000000000000..2d59c4ef6c5b
--- /dev/null
+++ b/drivers/staging/rtl8192u/Makefile
@@ -0,0 +1,33 @@
+NIC_SELECT = RTL8192U
+
+EXTRA_CFLAGS += -std=gnu89
+EXTRA_CFLAGS += -O2
+
+EXTRA_CFLAGS += -mhard-float -DCONFIG_FORCE_HARD_FLOAT=y
+EXTRA_CFLAGS += -DJACKSON_NEW_8187 -DJACKSON_NEW_RX
+EXTRA_CFLAGS += -DTHOMAS_BEACON -DTHOMAS_TASKLET -DTHOMAS_SKB -DTHOMAS_TURBO
+#EXTRA_CFLAGS += -DUSB_TX_DRIVER_AGGREGATION_ENABLE
+#EXTRA_CFLAGS += -DUSB_RX_AGGREGATION_SUPPORT
+EXTRA_CFLAGS += -DUSE_ONE_PIPE
+EXTRA_CFLAGS += -DENABLE_DOT11D
+EXTRA_CFLAGS += -Idrivers/staging/rtl8192u/ieee80211
+
+r8192u_usb-objs := r8192U_core.o r8180_93cx6.o r8192U_wx.o		\
+		  r8190_rtl8256.o r819xU_phy.o r819xU_firmware.o	\
+		  r819xU_cmdpkt.o r8192U_dm.o r819xU_firmware_img.o	\
+		  ieee80211/ieee80211_crypt.o				\
+		  ieee80211/ieee80211_crypt_tkip.o			\
+		  ieee80211/ieee80211_crypt_ccmp.o			\
+		  ieee80211/ieee80211_crypt_wep.o			\
+		  ieee80211/ieee80211_rx.o				\
+		  ieee80211/ieee80211_softmac.o				\
+		  ieee80211/ieee80211_tx.o				\
+		  ieee80211/ieee80211_wx.o				\
+		  ieee80211/ieee80211_module.o				\
+		  ieee80211/ieee80211_softmac_wx.o			\
+		  ieee80211/rtl819x_HTProc.o				\
+		  ieee80211/rtl819x_TSProc.o				\
+		  ieee80211/rtl819x_BAProc.o				\
+		  ieee80211/dot11d.o
+
+obj-$(CONFIG_RTL8192U) += r8192u_usb.o
diff --git a/drivers/staging/rtl8192u/authors b/drivers/staging/rtl8192u/authors
new file mode 100644
index 000000000000..b08bbae39e72
--- /dev/null
+++ b/drivers/staging/rtl8192u/authors
@@ -0,0 +1 @@
+Andrea Merello <andreamrl@tiscali.it>
diff --git a/drivers/staging/rtl8192u/changes b/drivers/staging/rtl8192u/changes
new file mode 100644
index 000000000000..87c33fdb9526
--- /dev/null
+++ b/drivers/staging/rtl8192u/changes
@@ -0,0 +1,5 @@
+v 0.1
+
+First version.
+This is based on the rtl8180-sa2400 pre-0.22-CVS code..
+
diff --git a/drivers/staging/rtl8192u/copying b/drivers/staging/rtl8192u/copying
new file mode 100644
index 000000000000..d60c31a97a54
--- /dev/null
+++ b/drivers/staging/rtl8192u/copying
@@ -0,0 +1,340 @@
+		    GNU GENERAL PUBLIC LICENSE
+		       Version 2, June 1991
+
+ Copyright (C) 1989, 1991 Free Software Foundation, Inc.
+     59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+			    Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+License is intended to guarantee your freedom to share and change free
+software--to make sure the software is free for all its users.  This
+General Public License applies to most of the Free Software
+Foundation's software and to any other program whose authors commit to
+using it.  (Some other Free Software Foundation software is covered by
+the GNU Library General Public License instead.)  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+this service if you wish), that you receive source code or can get it
+if you want it, that you can change the software or use pieces of it
+in new free programs; and that you know you can do these things.
+
+  To protect your rights, we need to make restrictions that forbid
+anyone to deny you these rights or to ask you to surrender the rights.
+These restrictions translate to certain responsibilities for you if you
+distribute copies of the software, or if you modify it.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must give the recipients all the rights that
+you have.  You must make sure that they, too, receive or can get the
+source code.  And you must show them these terms so they know their
+rights.
+
+  We protect your rights with two steps: (1) copyright the software, and
+(2) offer you this license which gives you legal permission to copy,
+distribute and/or modify the software.
+
+  Also, for each author's protection and ours, we want to make certain
+that everyone understands that there is no warranty for this free
+software.  If the software is modified by someone else and passed on, we
+want its recipients to know that what they have is not the original, so
+that any problems introduced by others will not reflect on the original
+authors' reputations.
+
+  Finally, any free program is threatened constantly by software
+patents.  We wish to avoid the danger that redistributors of a free
+program will individually obtain patent licenses, in effect making the
+program proprietary.  To prevent this, we have made it clear that any
+patent must be licensed for everyone's free use or not licensed at all.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+		    GNU GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License applies to any program or other work which contains
+a notice placed by the copyright holder saying it may be distributed
+under the terms of this General Public License.  The "Program", below,
+refers to any such program or work, and a "work based on the Program"
+means either the Program or any derivative work under copyright law:
+that is to say, a work containing the Program or a portion of it,
+either verbatim or with modifications and/or translated into another
+language.  (Hereinafter, translation is included without limitation in
+the term "modification".)  Each licensee is addressed as "you".
+
+Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running the Program is not restricted, and the output from the Program
+is covered only if its contents constitute a work based on the
+Program (independent of having been made by running the Program).
+Whether that is true depends on what the Program does.
+
+  1. You may copy and distribute verbatim copies of the Program's
+source code as you receive it, in any medium, provided that you
+conspicuously and appropriately publish on each copy an appropriate
+copyright notice and disclaimer of warranty; keep intact all the
+notices that refer to this License and to the absence of any warranty;
+and give any other recipients of the Program a copy of this License
+along with the Program.
+
+You may charge a fee for the physical act of transferring a copy, and
+you may at your option offer warranty protection in exchange for a fee.
+
+  2. You may modify your copy or copies of the Program or any portion
+of it, thus forming a work based on the Program, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) You must cause the modified files to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    b) You must cause any work that you distribute or publish, that in
+    whole or in part contains or is derived from the Program or any
+    part thereof, to be licensed as a whole at no charge to all third
+    parties under the terms of this License.
+
+    c) If the modified program normally reads commands interactively
+    when run, you must cause it, when started running for such
+    interactive use in the most ordinary way, to print or display an
+    announcement including an appropriate copyright notice and a
+    notice that there is no warranty (or else, saying that you provide
+    a warranty) and that users may redistribute the program under
+    these conditions, and telling the user how to view a copy of this
+    License.  (Exception: if the Program itself is interactive but
+    does not normally print such an announcement, your work based on
+    the Program is not required to print an announcement.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Program,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Program, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Program.
+
+In addition, mere aggregation of another work not based on the Program
+with the Program (or with a work based on the Program) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may copy and distribute the Program (or a work based on it,
+under Section 2) in object code or executable form under the terms of
+Sections 1 and 2 above provided that you also do one of the following:
+
+    a) Accompany it with the complete corresponding machine-readable
+    source code, which must be distributed under the terms of Sections
+    1 and 2 above on a medium customarily used for software interchange; or,
+
+    b) Accompany it with a written offer, valid for at least three
+    years, to give any third party, for a charge no more than your
+    cost of physically performing source distribution, a complete
+    machine-readable copy of the corresponding source code, to be
+    distributed under the terms of Sections 1 and 2 above on a medium
+    customarily used for software interchange; or,
+
+    c) Accompany it with the information you received as to the offer
+    to distribute corresponding source code.  (This alternative is
+    allowed only for noncommercial distribution and only if you
+    received the program in object code or executable form with such
+    an offer, in accord with Subsection b above.)
+
+The source code for a work means the preferred form of the work for
+making modifications to it.  For an executable work, complete source
+code means all the source code for all modules it contains, plus any
+associated interface definition files, plus the scripts used to
+control compilation and installation of the executable.  However, as a
+special exception, the source code distributed need not include
+anything that is normally distributed (in either source or binary
+form) with the major components (compiler, kernel, and so on) of the
+operating system on which the executable runs, unless that component
+itself accompanies the executable.
+
+If distribution of executable or object code is made by offering
+access to copy from a designated place, then offering equivalent
+access to copy the source code from the same place counts as
+distribution of the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  4. You may not copy, modify, sublicense, or distribute the Program
+except as expressly provided under this License.  Any attempt
+otherwise to copy, modify, sublicense or distribute the Program is
+void, and will automatically terminate your rights under this License.
+However, parties who have received copies, or rights, from you under
+this License will not have their licenses terminated so long as such
+parties remain in full compliance.
+
+  5. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Program or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Program (or any work based on the
+Program), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Program or works based on it.
+
+  6. Each time you redistribute the Program (or any work based on the
+Program), the recipient automatically receives a license from the
+original licensor to copy, distribute or modify the Program subject to
+these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties to
+this License.
+
+  7. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Program at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Program by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Program.
+
+If any portion of this section is held invalid or unenforceable under
+any particular circumstance, the balance of the section is intended to
+apply and the section as a whole is intended to apply in other
+circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system, which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  8. If the distribution and/or use of the Program is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Program under this License
+may add an explicit geographical distribution limitation excluding
+those countries, so that distribution is permitted only in or among
+countries not thus excluded.  In such case, this License incorporates
+the limitation as if written in the body of this License.
+
+  9. The Free Software Foundation may publish revised and/or new versions
+of the General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Program
+specifies a version number of this License which applies to it and "any
+later version", you have the option of following the terms and conditions
+either of that version or of any later version published by the Free
+Software Foundation.  If the Program does not specify a version number of
+this License, you may choose any version ever published by the Free Software
+Foundation.
+
+  10. If you wish to incorporate parts of the Program into other free
+programs whose distribution conditions are different, write to the author
+to ask for permission.  For software which is copyrighted by the Free
+Software Foundation, write to the Free Software Foundation; we sometimes
+make exceptions for this.  Our decision will be guided by the two goals
+of preserving the free status of all derivatives of our free software and
+of promoting the sharing and reuse of software generally.
+
+			    NO WARRANTY
+
+  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
+FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
+OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
+PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
+OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
+TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
+PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
+REPAIR OR CORRECTION.
+
+  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
+REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
+OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
+TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
+YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
+PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGES.
+
+		     END OF TERMS AND CONDITIONS
+
+	    How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program; if not, write to the Free Software
+    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+
+
+Also add information on how to contact you by electronic and paper mail.
+
+If the program is interactive, make it output a short notice like this
+when it starts in an interactive mode:
+
+    Gnomovision version 69, Copyright (C) year  name of author
+    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, the commands you use may
+be called something other than `show w' and `show c'; they could even be
+mouse-clicks or menu items--whatever suits your program.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a "copyright disclaimer" for the program, if
+necessary.  Here is a sample; alter the names:
+
+  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
+  `Gnomovision' (which makes passes at compilers) written by James Hacker.
+
+  <signature of Ty Coon>, 1 April 1989
+  Ty Coon, President of Vice
+
+This General Public License does not permit incorporating your program into
+proprietary programs.  If your program is a subroutine library, you may
+consider it more useful to permit linking proprietary applications with the
+library.  If this is what you want to do, use the GNU Library General
+Public License instead of this License.
diff --git a/drivers/staging/rtl8192u/dot11d.h b/drivers/staging/rtl8192u/dot11d.h
new file mode 100644
index 000000000000..15b7a4ba37b6
--- /dev/null
+++ b/drivers/staging/rtl8192u/dot11d.h
@@ -0,0 +1,102 @@
+#ifndef __INC_DOT11D_H
+#define __INC_DOT11D_H
+
+#ifdef ENABLE_DOT11D
+#include "ieee80211.h"
+
+//#define ENABLE_DOT11D
+
+//#define DOT11D_MAX_CHNL_NUM 83
+
+typedef struct _CHNL_TXPOWER_TRIPLE {
+	u8 FirstChnl;
+	u8  NumChnls;
+	u8  MaxTxPowerInDbm;
+}CHNL_TXPOWER_TRIPLE, *PCHNL_TXPOWER_TRIPLE;
+
+typedef enum _DOT11D_STATE {
+	DOT11D_STATE_NONE = 0,
+	DOT11D_STATE_LEARNED,
+	DOT11D_STATE_DONE,
+}DOT11D_STATE;
+
+typedef struct _RT_DOT11D_INFO {
+	//DECLARE_RT_OBJECT(RT_DOT11D_INFO);
+
+	bool bEnabled; // dot11MultiDomainCapabilityEnabled
+
+	u16 CountryIeLen; // > 0 if CountryIeBuf[] contains valid country information element.
+	u8  CountryIeBuf[MAX_IE_LEN];
+	u8  CountryIeSrcAddr[6]; // Source AP of the country IE.
+	u8  CountryIeWatchdog;
+
+	u8  channel_map[MAX_CHANNEL_NUMBER+1];  //!!!Value 0: Invalid, 1: Valid (active scan), 2: Valid (passive scan)
+	//u8  ChnlListLen; // #Bytes valid in ChnlList[].
+	//u8  ChnlList[DOT11D_MAX_CHNL_NUM];
+	u8  MaxTxPwrDbmList[MAX_CHANNEL_NUMBER+1];
+
+	DOT11D_STATE State;
+}RT_DOT11D_INFO, *PRT_DOT11D_INFO;
+#define eqMacAddr(a,b)		( ((a)[0]==(b)[0] && (a)[1]==(b)[1] && (a)[2]==(b)[2] && (a)[3]==(b)[3] && (a)[4]==(b)[4] && (a)[5]==(b)[5]) ? 1:0 )
+#define cpMacAddr(des,src)	      ((des)[0]=(src)[0],(des)[1]=(src)[1],(des)[2]=(src)[2],(des)[3]=(src)[3],(des)[4]=(src)[4],(des)[5]=(src)[5])
+#define GET_DOT11D_INFO(__pIeeeDev) ((PRT_DOT11D_INFO)((__pIeeeDev)->pDot11dInfo))
+
+#define IS_DOT11D_ENABLE(__pIeeeDev) GET_DOT11D_INFO(__pIeeeDev)->bEnabled
+#define IS_COUNTRY_IE_VALID(__pIeeeDev) (GET_DOT11D_INFO(__pIeeeDev)->CountryIeLen > 0)
+
+#define IS_EQUAL_CIE_SRC(__pIeeeDev, __pTa) eqMacAddr(GET_DOT11D_INFO(__pIeeeDev)->CountryIeSrcAddr, __pTa)
+#define UPDATE_CIE_SRC(__pIeeeDev, __pTa) cpMacAddr(GET_DOT11D_INFO(__pIeeeDev)->CountryIeSrcAddr, __pTa)
+
+#define IS_COUNTRY_IE_CHANGED(__pIeeeDev, __Ie) \
+	(((__Ie).Length == 0 || (__Ie).Length != GET_DOT11D_INFO(__pIeeeDev)->CountryIeLen) ? \
+	FALSE : \
+	(!memcmp(GET_DOT11D_INFO(__pIeeeDev)->CountryIeBuf, (__Ie).Octet, (__Ie).Length)))
+
+#define CIE_WATCHDOG_TH 1
+#define GET_CIE_WATCHDOG(__pIeeeDev) GET_DOT11D_INFO(__pIeeeDev)->CountryIeWatchdog
+#define RESET_CIE_WATCHDOG(__pIeeeDev) GET_CIE_WATCHDOG(__pIeeeDev) = 0
+#define UPDATE_CIE_WATCHDOG(__pIeeeDev) ++GET_CIE_WATCHDOG(__pIeeeDev)
+
+#define IS_DOT11D_STATE_DONE(__pIeeeDev) (GET_DOT11D_INFO(__pIeeeDev)->State == DOT11D_STATE_DONE)
+
+
+void
+Dot11d_Init(
+	struct ieee80211_device *dev
+	);
+
+void
+Dot11d_Reset(
+	struct ieee80211_device *dev
+	);
+
+void
+Dot11d_UpdateCountryIe(
+	struct ieee80211_device *dev,
+	u8 *		pTaddr,
+	u16	CoutryIeLen,
+	u8 * pCoutryIe
+	);
+
+u8
+DOT11D_GetMaxTxPwrInDbm(
+	struct ieee80211_device *dev,
+	u8 Channel
+	);
+
+void
+DOT11D_ScanComplete(
+	struct ieee80211_device * dev
+	);
+
+int IsLegalChannel(
+	struct ieee80211_device * dev,
+	u8 channel
+);
+
+int ToLegalChannel(
+	struct ieee80211_device * dev,
+	u8 channel
+);
+#endif //ENABLE_DOT11D
+#endif // #ifndef __INC_DOT11D_H
diff --git a/drivers/staging/rtl8192u/ieee80211.h b/drivers/staging/rtl8192u/ieee80211.h
new file mode 100644
index 000000000000..3a47f1213e85
--- /dev/null
+++ b/drivers/staging/rtl8192u/ieee80211.h
@@ -0,0 +1,2638 @@
+/*
+ * Merged with mainline ieee80211.h in Aug 2004.  Original ieee802_11
+ * remains copyright by the original authors
+ *
+ * Portions of the merged code are based on Host AP (software wireless
+ * LAN access point) driver for Intersil Prism2/2.5/3.
+ *
+ * Copyright (c) 2001-2002, SSH Communications Security Corp and Jouni Malinen
+ * <jkmaline@cc.hut.fi>
+ * Copyright (c) 2002-2003, Jouni Malinen <jkmaline@cc.hut.fi>
+ *
+ * Adaption to a generic IEEE 802.11 stack by James Ketrenos
+ * <jketreno@linux.intel.com>
+ * Copyright (c) 2004, Intel Corporation
+ *
+ * Modified for Realtek's wi-fi cards by Andrea Merello
+ * <andreamrl@tiscali.it>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation. See README and COPYING for
+ * more details.
+ */
+#ifndef IEEE80211_H
+#define IEEE80211_H
+#include <linux/if_ether.h> /* ETH_ALEN */
+#include <linux/kernel.h>   /* ARRAY_SIZE */
+#include <linux/version.h>
+#include <linux/module.h>
+#include <linux/jiffies.h>
+#include <linux/timer.h>
+#include <linux/sched.h>
+
+#include <linux/delay.h>
+#include <linux/wireless.h>
+
+#include "ieee80211/rtl819x_HT.h"
+#include "ieee80211/rtl819x_BA.h"
+#include "ieee80211/rtl819x_TS.h"
+
+
+#ifndef IW_MODE_MONITOR
+#define IW_MODE_MONITOR 6
+#endif
+
+#ifndef IWEVCUSTOM
+#define IWEVCUSTOM 0x8c02
+#endif
+
+
+#ifndef container_of
+/**
+ * container_of - cast a member of a structure out to the containing structure
+ *
+ * @ptr:        the pointer to the member.
+ * @type:       the type of the container struct this is embedded in.
+ * @member:     the name of the member within the struct.
+ *
+ */
+#define container_of(ptr, type, member) ({                      \
+	const typeof( ((type *)0)->member ) *__mptr = (ptr);    \
+	(type *)( (char *)__mptr - offsetof(type,member) );})
+#endif
+
+#define KEY_TYPE_NA		0x0
+#define KEY_TYPE_WEP40 		0x1
+#define KEY_TYPE_TKIP		0x2
+#define KEY_TYPE_CCMP		0x4
+#define KEY_TYPE_WEP104		0x5
+
+/* added for rtl819x tx procedure */
+#define MAX_QUEUE_SIZE		0x10
+
+//
+// 8190 queue mapping
+//
+#define BK_QUEUE                               0
+#define BE_QUEUE                               1
+#define VI_QUEUE                               2
+#define VO_QUEUE                               3
+#define HCCA_QUEUE                             4
+#define TXCMD_QUEUE                            5
+#define MGNT_QUEUE                             6
+#define HIGH_QUEUE                             7
+#define BEACON_QUEUE                           8
+
+#define LOW_QUEUE                              BE_QUEUE
+#define NORMAL_QUEUE                           MGNT_QUEUE
+
+//added by amy for ps
+#define SWRF_TIMEOUT				50
+
+//added by amy for LEAP related
+#define IE_CISCO_FLAG_POSITION		0x08	// Flag byte: byte 8, numbered from 0.
+#define SUPPORT_CKIP_MIC			0x08	// bit3
+#define SUPPORT_CKIP_PK			0x10	// bit4
+/* defined for skb cb field */
+/* At most 28 byte */
+typedef struct cb_desc {
+	/* Tx Desc Related flags (8-9) */
+	u8 bLastIniPkt:1;
+	u8 bCmdOrInit:1;
+	u8 bFirstSeg:1;
+	u8 bLastSeg:1;
+	u8 bEncrypt:1;
+	u8 bTxDisableRateFallBack:1;
+	u8 bTxUseDriverAssingedRate:1;
+	u8 bHwSec:1; //indicate whether use Hw security. WB
+
+	u8 reserved1;
+
+	/* Tx Firmware Relaged flags (10-11)*/
+	u8 bCTSEnable:1;
+	u8 bRTSEnable:1;
+	u8 bUseShortGI:1;
+	u8 bUseShortPreamble:1;
+	u8 bTxEnableFwCalcDur:1;
+	u8 bAMPDUEnable:1;
+	u8 bRTSSTBC:1;
+	u8 RTSSC:1;
+
+	u8 bRTSBW:1;
+	u8 bPacketBW:1;
+	u8 bRTSUseShortPreamble:1;
+	u8 bRTSUseShortGI:1;
+	u8 bMulticast:1;
+	u8 bBroadcast:1;
+	//u8 reserved2:2;
+	u8 drv_agg_enable:1;
+	u8 reserved2:1;
+
+	/* Tx Desc related element(12-19) */
+	u8 rata_index;
+	u8 queue_index;
+	//u8 reserved3;
+	//u8 reserved4;
+	u16 txbuf_size;
+	//u8 reserved5;
+	u8 RATRIndex;
+	u8 reserved6;
+	u8 reserved7;
+	u8 reserved8;
+
+	/* Tx firmware related element(20-27) */
+	u8 data_rate;
+	u8 rts_rate;
+	u8 ampdu_factor;
+	u8 ampdu_density;
+	//u8 reserved9;
+	//u8 reserved10;
+	//u8 reserved11;
+	u8 DrvAggrNum;
+	u16 pkt_size;
+	u8 reserved12;
+}cb_desc, *pcb_desc;
+
+/*--------------------------Define -------------------------------------------*/
+#define MGN_1M                  0x02
+#define MGN_2M                  0x04
+#define MGN_5_5M                0x0b
+#define MGN_11M                 0x16
+
+#define MGN_6M                  0x0c
+#define MGN_9M                  0x12
+#define MGN_12M                 0x18
+#define MGN_18M                 0x24
+#define MGN_24M                 0x30
+#define MGN_36M                 0x48
+#define MGN_48M                 0x60
+#define MGN_54M                 0x6c
+
+#define MGN_MCS0                0x80
+#define MGN_MCS1                0x81
+#define MGN_MCS2                0x82
+#define MGN_MCS3                0x83
+#define MGN_MCS4                0x84
+#define MGN_MCS5                0x85
+#define MGN_MCS6                0x86
+#define MGN_MCS7                0x87
+#define MGN_MCS8                0x88
+#define MGN_MCS9                0x89
+#define MGN_MCS10               0x8a
+#define MGN_MCS11               0x8b
+#define MGN_MCS12               0x8c
+#define MGN_MCS13               0x8d
+#define MGN_MCS14               0x8e
+#define MGN_MCS15               0x8f
+
+//----------------------------------------------------------------------------
+//		802.11 Management frame Reason Code field
+//----------------------------------------------------------------------------
+enum	_ReasonCode{
+	unspec_reason	= 0x1,
+	auth_not_valid	= 0x2,
+	deauth_lv_ss	= 0x3,
+	inactivity		= 0x4,
+	ap_overload 	= 0x5,
+	class2_err		= 0x6,
+	class3_err		= 0x7,
+	disas_lv_ss 	= 0x8,
+	asoc_not_auth	= 0x9,
+
+	//----MIC_CHECK
+	mic_failure 	= 0xe,
+	//----END MIC_CHECK
+
+	// Reason code defined in 802.11i D10.0 p.28.
+	invalid_IE		= 0x0d,
+	four_way_tmout	= 0x0f,
+	two_way_tmout	= 0x10,
+	IE_dismatch 	= 0x11,
+	invalid_Gcipher = 0x12,
+	invalid_Pcipher = 0x13,
+	invalid_AKMP	= 0x14,
+	unsup_RSNIEver = 0x15,
+	invalid_RSNIE	= 0x16,
+	auth_802_1x_fail= 0x17,
+	ciper_reject		= 0x18,
+
+	// Reason code defined in 7.3.1.7, 802.1e D13.0, p.42. Added by Annie, 2005-11-15.
+	QoS_unspec		= 0x20, // 32
+	QAP_bandwidth	= 0x21, // 33
+	poor_condition	= 0x22, // 34
+	no_facility 	= 0x23, // 35
+							// Where is 36???
+	req_declined	= 0x25, // 37
+	invalid_param	= 0x26, // 38
+	req_not_honored= 0x27,	// 39
+	TS_not_created	= 0x2F, // 47
+	DL_not_allowed	= 0x30, // 48
+	dest_not_exist	= 0x31, // 49
+	dest_not_QSTA	= 0x32, // 50
+};
+
+
+
+#define aSifsTime	 ((priv->ieee80211->current_network.mode == IEEE_A)||(priv->ieee80211->current_network.mode == IEEE_N_24G)||(priv->ieee80211->current_network.mode == IEEE_N_5G))? 16 : 10
+
+#define MGMT_QUEUE_NUM 5
+
+#define IEEE_CMD_SET_WPA_PARAM			1
+#define	IEEE_CMD_SET_WPA_IE			2
+#define IEEE_CMD_SET_ENCRYPTION			3
+#define IEEE_CMD_MLME				4
+
+#define IEEE_PARAM_WPA_ENABLED			1
+#define IEEE_PARAM_TKIP_COUNTERMEASURES		2
+#define IEEE_PARAM_DROP_UNENCRYPTED		3
+#define IEEE_PARAM_PRIVACY_INVOKED		4
+#define IEEE_PARAM_AUTH_ALGS			5
+#define IEEE_PARAM_IEEE_802_1X			6
+//It should consistent with the driver_XXX.c
+//   David, 2006.9.26
+#define IEEE_PARAM_WPAX_SELECT			7
+//Added for notify the encryption type selection
+//   David, 2006.9.26
+#define IEEE_PROTO_WPA				1
+#define IEEE_PROTO_RSN				2
+//Added for notify the encryption type selection
+//   David, 2006.9.26
+#define IEEE_WPAX_USEGROUP			0
+#define IEEE_WPAX_WEP40				1
+#define IEEE_WPAX_TKIP				2
+#define IEEE_WPAX_WRAP   			3
+#define IEEE_WPAX_CCMP				4
+#define IEEE_WPAX_WEP104			5
+
+#define IEEE_KEY_MGMT_IEEE8021X			1
+#define IEEE_KEY_MGMT_PSK			2
+
+#define IEEE_MLME_STA_DEAUTH			1
+#define IEEE_MLME_STA_DISASSOC			2
+
+
+#define IEEE_CRYPT_ERR_UNKNOWN_ALG		2
+#define IEEE_CRYPT_ERR_UNKNOWN_ADDR		3
+#define IEEE_CRYPT_ERR_CRYPT_INIT_FAILED	4
+#define IEEE_CRYPT_ERR_KEY_SET_FAILED		5
+#define IEEE_CRYPT_ERR_TX_KEY_SET_FAILED	6
+#define IEEE_CRYPT_ERR_CARD_CONF_FAILED		7
+
+
+#define	IEEE_CRYPT_ALG_NAME_LEN			16
+
+#define MAX_IE_LEN  0xff
+
+// added for kernel conflict
+#define ieee80211_crypt_deinit_entries 	ieee80211_crypt_deinit_entries_rsl
+#define ieee80211_crypt_deinit_handler 	ieee80211_crypt_deinit_handler_rsl
+#define ieee80211_crypt_delayed_deinit 	ieee80211_crypt_delayed_deinit_rsl
+#define ieee80211_register_crypto_ops  	ieee80211_register_crypto_ops_rsl
+#define ieee80211_unregister_crypto_ops ieee80211_unregister_crypto_ops_rsl
+#define ieee80211_get_crypto_ops 	ieee80211_get_crypto_ops_rsl
+
+#define ieee80211_ccmp_null		ieee80211_ccmp_null_rsl
+
+#define ieee80211_tkip_null		ieee80211_tkip_null_rsl
+
+#define ieee80211_wep_null		ieee80211_wep_null_rsl
+
+#define free_ieee80211          	free_ieee80211_rsl
+#define alloc_ieee80211        		alloc_ieee80211_rsl
+
+#define ieee80211_rx 			ieee80211_rx_rsl
+#define ieee80211_rx_mgt		ieee80211_rx_mgt_rsl
+
+#define ieee80211_get_beacon		ieee80211_get_beacon_rsl
+#define ieee80211_wake_queue		ieee80211_wake_queue_rsl
+#define ieee80211_stop_queue		ieee80211_stop_queue_rsl
+#define ieee80211_reset_queue		ieee80211_reset_queue_rsl
+#define ieee80211_softmac_stop_protocol	ieee80211_softmac_stop_protocol_rsl
+#define ieee80211_softmac_start_protocol ieee80211_softmac_start_protocol_rsl
+#define ieee80211_is_shortslot		ieee80211_is_shortslot_rsl
+#define ieee80211_is_54g		ieee80211_is_54g_rsl
+#define ieee80211_wpa_supplicant_ioctl	ieee80211_wpa_supplicant_ioctl_rsl
+#define ieee80211_ps_tx_ack		ieee80211_ps_tx_ack_rsl
+#define ieee80211_softmac_xmit		ieee80211_softmac_xmit_rsl
+#define ieee80211_stop_send_beacons	ieee80211_stop_send_beacons_rsl
+#define notify_wx_assoc_event		notify_wx_assoc_event_rsl
+#define SendDisassociation		SendDisassociation_rsl
+#define ieee80211_disassociate		ieee80211_disassociate_rsl
+#define ieee80211_start_send_beacons	ieee80211_start_send_beacons_rsl
+#define ieee80211_stop_scan		ieee80211_stop_scan_rsl
+#define ieee80211_send_probe_requests	ieee80211_send_probe_requests_rsl
+#define ieee80211_softmac_scan_syncro	ieee80211_softmac_scan_syncro_rsl
+#define ieee80211_start_scan_syncro	ieee80211_start_scan_syncro_rsl
+
+#define ieee80211_wx_get_essid		ieee80211_wx_get_essid_rsl
+#define ieee80211_wx_set_essid		ieee80211_wx_set_essid_rsl
+#define ieee80211_wx_set_rate		ieee80211_wx_set_rate_rsl
+#define ieee80211_wx_get_rate		ieee80211_wx_get_rate_rsl
+#define ieee80211_wx_set_wap		ieee80211_wx_set_wap_rsl
+#define ieee80211_wx_get_wap		ieee80211_wx_get_wap_rsl
+#define ieee80211_wx_set_mode		ieee80211_wx_set_mode_rsl
+#define ieee80211_wx_get_mode		ieee80211_wx_get_mode_rsl
+#define ieee80211_wx_set_scan		ieee80211_wx_set_scan_rsl
+#define ieee80211_wx_get_freq		ieee80211_wx_get_freq_rsl
+#define ieee80211_wx_set_freq		ieee80211_wx_set_freq_rsl
+#define ieee80211_wx_set_rawtx		ieee80211_wx_set_rawtx_rsl
+#define ieee80211_wx_get_name		ieee80211_wx_get_name_rsl
+#define ieee80211_wx_set_power		ieee80211_wx_set_power_rsl
+#define ieee80211_wx_get_power		ieee80211_wx_get_power_rsl
+#define ieee80211_wlan_frequencies	ieee80211_wlan_frequencies_rsl
+#define ieee80211_wx_set_rts		ieee80211_wx_set_rts_rsl
+#define ieee80211_wx_get_rts		ieee80211_wx_get_rts_rsl
+
+#define ieee80211_txb_free		ieee80211_txb_free_rsl
+
+#define ieee80211_wx_set_gen_ie		ieee80211_wx_set_gen_ie_rsl
+#define ieee80211_wx_get_scan		ieee80211_wx_get_scan_rsl
+#define ieee80211_wx_set_encode		ieee80211_wx_set_encode_rsl
+#define ieee80211_wx_get_encode		ieee80211_wx_get_encode_rsl
+#if WIRELESS_EXT >= 18
+#define ieee80211_wx_set_mlme		ieee80211_wx_set_mlme_rsl
+#define ieee80211_wx_set_auth		ieee80211_wx_set_auth_rsl
+#define ieee80211_wx_set_encode_ext	ieee80211_wx_set_encode_ext_rsl
+#define ieee80211_wx_get_encode_ext	ieee80211_wx_get_encode_ext_rsl
+#endif
+
+
+typedef struct ieee_param {
+	u32 cmd;
+	u8 sta_addr[ETH_ALEN];
+	union {
+		struct {
+			u8 name;
+			u32 value;
+		} wpa_param;
+		struct {
+			u32 len;
+			u8 reserved[32];
+			u8 data[0];
+		} wpa_ie;
+		struct{
+			int command;
+			int reason_code;
+		} mlme;
+		struct {
+			u8 alg[IEEE_CRYPT_ALG_NAME_LEN];
+			u8 set_tx;
+			u32 err;
+			u8 idx;
+			u8 seq[8]; /* sequence counter (set: RX, get: TX) */
+			u16 key_len;
+			u8 key[0];
+		} crypt;
+	} u;
+}ieee_param;
+
+
+#if WIRELESS_EXT < 17
+#define IW_QUAL_QUAL_INVALID   0x10
+#define IW_QUAL_LEVEL_INVALID  0x20
+#define IW_QUAL_NOISE_INVALID  0x40
+#define IW_QUAL_QUAL_UPDATED   0x1
+#define IW_QUAL_LEVEL_UPDATED  0x2
+#define IW_QUAL_NOISE_UPDATED  0x4
+#endif
+
+
+// linux under 2.6.9 release may not support it, so modify it for common use
+#define MSECS(t) msecs_to_jiffies(t)
+#define msleep_interruptible_rsl  msleep_interruptible
+
+#define IEEE80211_DATA_LEN		2304
+/* Maximum size for the MA-UNITDATA primitive, 802.11 standard section
+   6.2.1.1.2.
+
+   The figure in section 7.1.2 suggests a body size of up to 2312
+   bytes is allowed, which is a bit confusing, I suspect this
+   represents the 2304 bytes of real data, plus a possible 8 bytes of
+   WEP IV and ICV. (this interpretation suggested by Ramiro Barreiro) */
+#define IEEE80211_1ADDR_LEN 10
+#define IEEE80211_2ADDR_LEN 16
+#define IEEE80211_3ADDR_LEN 24
+#define IEEE80211_4ADDR_LEN 30
+#define IEEE80211_FCS_LEN    4
+#define IEEE80211_HLEN                  (IEEE80211_4ADDR_LEN)
+#define IEEE80211_FRAME_LEN             (IEEE80211_DATA_LEN + IEEE80211_HLEN)
+#define IEEE80211_MGMT_HDR_LEN 24
+#define IEEE80211_DATA_HDR3_LEN 24
+#define IEEE80211_DATA_HDR4_LEN 30
+
+#define MIN_FRAG_THRESHOLD     256U
+#define MAX_FRAG_THRESHOLD     2346U
+
+
+/* Frame control field constants */
+#define IEEE80211_FCTL_VERS		0x0003
+#define IEEE80211_FCTL_FTYPE		0x000c
+#define IEEE80211_FCTL_STYPE		0x00f0
+#define IEEE80211_FCTL_FRAMETYPE	0x00fc
+#define IEEE80211_FCTL_TODS		0x0100
+#define IEEE80211_FCTL_FROMDS		0x0200
+#define IEEE80211_FCTL_DSTODS		0x0300 //added by david
+#define IEEE80211_FCTL_MOREFRAGS	0x0400
+#define IEEE80211_FCTL_RETRY		0x0800
+#define IEEE80211_FCTL_PM		0x1000
+#define IEEE80211_FCTL_MOREDATA		0x2000
+#define IEEE80211_FCTL_WEP		0x4000
+#define IEEE80211_FCTL_ORDER		0x8000
+
+#define IEEE80211_FTYPE_MGMT		0x0000
+#define IEEE80211_FTYPE_CTL		0x0004
+#define IEEE80211_FTYPE_DATA		0x0008
+
+/* management */
+#define IEEE80211_STYPE_ASSOC_REQ	0x0000
+#define IEEE80211_STYPE_ASSOC_RESP 	0x0010
+#define IEEE80211_STYPE_REASSOC_REQ	0x0020
+#define IEEE80211_STYPE_REASSOC_RESP	0x0030
+#define IEEE80211_STYPE_PROBE_REQ	0x0040
+#define IEEE80211_STYPE_PROBE_RESP	0x0050
+#define IEEE80211_STYPE_BEACON		0x0080
+#define IEEE80211_STYPE_ATIM		0x0090
+#define IEEE80211_STYPE_DISASSOC	0x00A0
+#define IEEE80211_STYPE_AUTH		0x00B0
+#define IEEE80211_STYPE_DEAUTH		0x00C0
+#define IEEE80211_STYPE_MANAGE_ACT	0x00D0
+
+/* control */
+#define IEEE80211_STYPE_PSPOLL		0x00A0
+#define IEEE80211_STYPE_RTS		0x00B0
+#define IEEE80211_STYPE_CTS		0x00C0
+#define IEEE80211_STYPE_ACK		0x00D0
+#define IEEE80211_STYPE_CFEND		0x00E0
+#define IEEE80211_STYPE_CFENDACK	0x00F0
+#define IEEE80211_STYPE_BLOCKACK   0x0094
+
+/* data */
+#define IEEE80211_STYPE_DATA		0x0000
+#define IEEE80211_STYPE_DATA_CFACK	0x0010
+#define IEEE80211_STYPE_DATA_CFPOLL	0x0020
+#define IEEE80211_STYPE_DATA_CFACKPOLL	0x0030
+#define IEEE80211_STYPE_NULLFUNC	0x0040
+#define IEEE80211_STYPE_CFACK		0x0050
+#define IEEE80211_STYPE_CFPOLL		0x0060
+#define IEEE80211_STYPE_CFACKPOLL	0x0070
+#define IEEE80211_STYPE_QOS_DATA	0x0080 //added for WMM 2006/8/2
+#define IEEE80211_STYPE_QOS_NULL	0x00C0
+
+#define IEEE80211_SCTL_FRAG		0x000F
+#define IEEE80211_SCTL_SEQ		0xFFF0
+
+/* QOS control */
+#define IEEE80211_QCTL_TID              0x000F
+
+#define	FC_QOS_BIT					BIT7
+#define IsDataFrame(pdu)			( ((pdu[0] & 0x0C)==0x08) ? true : false )
+#define	IsLegacyDataFrame(pdu)	(IsDataFrame(pdu) && (!(pdu[0]&FC_QOS_BIT)) )
+//added by wb. Is this right?
+#define IsQoSDataFrame(pframe)  ((*(u16*)pframe&(IEEE80211_STYPE_QOS_DATA|IEEE80211_FTYPE_DATA)) == (IEEE80211_STYPE_QOS_DATA|IEEE80211_FTYPE_DATA))
+#define Frame_Order(pframe)     (*(u16*)pframe&IEEE80211_FCTL_ORDER)
+#define SN_LESS(a, b)		(((a-b)&0x800)!=0)
+#define SN_EQUAL(a, b)	(a == b)
+#define MAX_DEV_ADDR_SIZE 8
+typedef enum _ACT_CATEGORY{
+	ACT_CAT_QOS = 1,
+	ACT_CAT_DLS = 2,
+	ACT_CAT_BA  = 3,
+	ACT_CAT_HT  = 7,
+	ACT_CAT_WMM = 17,
+} ACT_CATEGORY, *PACT_CATEGORY;
+
+typedef enum _TS_ACTION{
+	ACT_ADDTSREQ = 0,
+	ACT_ADDTSRSP = 1,
+	ACT_DELTS    = 2,
+	ACT_SCHEDULE = 3,
+} TS_ACTION, *PTS_ACTION;
+
+typedef enum _BA_ACTION{
+	ACT_ADDBAREQ = 0,
+	ACT_ADDBARSP = 1,
+	ACT_DELBA    = 2,
+} BA_ACTION, *PBA_ACTION;
+
+typedef enum _InitialGainOpType{
+	IG_Backup=0,
+	IG_Restore,
+	IG_Max
+}InitialGainOpType;
+
+/* debug macros */
+#define CONFIG_IEEE80211_DEBUG
+#ifdef CONFIG_IEEE80211_DEBUG
+extern u32 ieee80211_debug_level;
+#define IEEE80211_DEBUG(level, fmt, args...) \
+do { if (ieee80211_debug_level & (level)) \
+  printk(KERN_DEBUG "ieee80211: " fmt, ## args); } while (0)
+//wb added to debug out data buf
+//if you want print DATA buffer related BA, please set ieee80211_debug_level to DATA|BA
+#define IEEE80211_DEBUG_DATA(level, data, datalen)	\
+	do{ if ((ieee80211_debug_level & (level)) == (level))	\
+		{ 	\
+			int i;					\
+			u8* pdata = (u8*) data;			\
+			printk(KERN_DEBUG "ieee80211: %s()\n", __FUNCTION__);	\
+			for(i=0; i<(int)(datalen); i++)			\
+			{						\
+				printk("%2x ", pdata[i]);		\
+				if ((i+1)%16 == 0) printk("\n");	\
+			}				\
+			printk("\n");			\
+		}					\
+	} while (0)
+#else
+#define IEEE80211_DEBUG(level, fmt, args...) do {} while (0)
+#define IEEE80211_DEBUG_DATA(level, data, datalen) do {} while(0)
+#endif	/* CONFIG_IEEE80211_DEBUG */
+
+/* debug macros not dependent on CONFIG_IEEE80211_DEBUG */
+
+#define MAC_FMT "%02x:%02x:%02x:%02x:%02x:%02x"
+#define MAC_ARG(x) ((u8*)(x))[0],((u8*)(x))[1],((u8*)(x))[2],((u8*)(x))[3],((u8*)(x))[4],((u8*)(x))[5]
+
+/*
+ * To use the debug system;
+ *
+ * If you are defining a new debug classification, simply add it to the #define
+ * list here in the form of:
+ *
+ * #define IEEE80211_DL_xxxx VALUE
+ *
+ * shifting value to the left one bit from the previous entry.  xxxx should be
+ * the name of the classification (for example, WEP)
+ *
+ * You then need to either add a IEEE80211_xxxx_DEBUG() macro definition for your
+ * classification, or use IEEE80211_DEBUG(IEEE80211_DL_xxxx, ...) whenever you want
+ * to send output to that classification.
+ *
+ * To add your debug level to the list of levels seen when you perform
+ *
+ * % cat /proc/net/ipw/debug_level
+ *
+ * you simply need to add your entry to the ipw_debug_levels array.
+ *
+ * If you do not see debug_level in /proc/net/ipw then you do not have
+ * CONFIG_IEEE80211_DEBUG defined in your kernel configuration
+ *
+ */
+
+#define IEEE80211_DL_INFO          (1<<0)
+#define IEEE80211_DL_WX            (1<<1)
+#define IEEE80211_DL_SCAN          (1<<2)
+#define IEEE80211_DL_STATE         (1<<3)
+#define IEEE80211_DL_MGMT          (1<<4)
+#define IEEE80211_DL_FRAG          (1<<5)
+#define IEEE80211_DL_EAP           (1<<6)
+#define IEEE80211_DL_DROP          (1<<7)
+
+#define IEEE80211_DL_TX            (1<<8)
+#define IEEE80211_DL_RX            (1<<9)
+
+#define IEEE80211_DL_HT		   (1<<10)  //HT
+#define IEEE80211_DL_BA		   (1<<11)  //ba
+#define IEEE80211_DL_TS		   (1<<12)  //TS
+#define IEEE80211_DL_QOS           (1<<13)
+#define IEEE80211_DL_REORDER	   (1<<14)
+#define IEEE80211_DL_IOT	   (1<<15)
+#define IEEE80211_DL_IPS	   (1<<16)
+#define IEEE80211_DL_TRACE	   (1<<29)  //trace function, need to user net_ratelimit() together in order not to print too much to the screen
+#define IEEE80211_DL_DATA	   (1<<30)   //use this flag to control whether print data buf out.
+#define IEEE80211_DL_ERR	   (1<<31)   //always open
+#define IEEE80211_ERROR(f, a...) printk(KERN_ERR "ieee80211: " f, ## a)
+#define IEEE80211_WARNING(f, a...) printk(KERN_WARNING "ieee80211: " f, ## a)
+#define IEEE80211_DEBUG_INFO(f, a...)   IEEE80211_DEBUG(IEEE80211_DL_INFO, f, ## a)
+
+#define IEEE80211_DEBUG_WX(f, a...)     IEEE80211_DEBUG(IEEE80211_DL_WX, f, ## a)
+#define IEEE80211_DEBUG_SCAN(f, a...)   IEEE80211_DEBUG(IEEE80211_DL_SCAN, f, ## a)
+#define IEEE80211_DEBUG_STATE(f, a...)  IEEE80211_DEBUG(IEEE80211_DL_STATE, f, ## a)
+#define IEEE80211_DEBUG_MGMT(f, a...)  IEEE80211_DEBUG(IEEE80211_DL_MGMT, f, ## a)
+#define IEEE80211_DEBUG_FRAG(f, a...)  IEEE80211_DEBUG(IEEE80211_DL_FRAG, f, ## a)
+#define IEEE80211_DEBUG_EAP(f, a...)  IEEE80211_DEBUG(IEEE80211_DL_EAP, f, ## a)
+#define IEEE80211_DEBUG_DROP(f, a...)  IEEE80211_DEBUG(IEEE80211_DL_DROP, f, ## a)
+#define IEEE80211_DEBUG_TX(f, a...)  IEEE80211_DEBUG(IEEE80211_DL_TX, f, ## a)
+#define IEEE80211_DEBUG_RX(f, a...)  IEEE80211_DEBUG(IEEE80211_DL_RX, f, ## a)
+#define IEEE80211_DEBUG_QOS(f, a...)  IEEE80211_DEBUG(IEEE80211_DL_QOS, f, ## a)
+
+#ifdef CONFIG_IEEE80211_DEBUG
+/* Added by Annie, 2005-11-22. */
+#define MAX_STR_LEN     64
+/* I want to see ASCII 33 to 126 only. Otherwise, I print '?'. Annie, 2005-11-22.*/
+#define PRINTABLE(_ch)  (_ch>'!' && _ch<'~')
+#define IEEE80211_PRINT_STR(_Comp, _TitleString, _Ptr, _Len)                            	\
+			if((_Comp) & level)   							\
+			{                                                                       \
+				int             __i;                                            \
+				u8  buffer[MAX_STR_LEN];                                    	\
+				int length = (_Len<MAX_STR_LEN)? _Len : (MAX_STR_LEN-1) ;  	\
+				memset(buffer, 0, MAX_STR_LEN);                      		\
+				memcpy(buffer, (u8 *)_Ptr, length );            		\
+				for( __i=0; __i<MAX_STR_LEN; __i++ )                            \
+				{                                                               \
+				     if( !PRINTABLE(buffer[__i]) )   buffer[__i] = '?';     	\
+				}                                                               \
+				buffer[length] = '\0';                                          \
+				printk("Rtl819x: ");                                         	\
+				printk(_TitleString);                                         \
+				printk(": %d, <%s>\n", _Len, buffer);                         \
+			}
+#else
+#define IEEE80211_PRINT_STR(_Comp, _TitleString, _Ptr, _Len)  do {} while (0)
+#endif
+
+#include <linux/netdevice.h>
+#include <linux/if_arp.h> /* ARPHRD_ETHER */
+
+#ifndef WIRELESS_SPY
+#define WIRELESS_SPY		// enable iwspy support
+#endif
+#include <net/iw_handler.h>	// new driver API
+
+#ifndef ETH_P_PAE
+#define ETH_P_PAE 0x888E /* Port Access Entity (IEEE 802.1X) */
+#endif /* ETH_P_PAE */
+
+#define ETH_P_PREAUTH 0x88C7 /* IEEE 802.11i pre-authentication */
+
+#ifndef ETH_P_80211_RAW
+#define ETH_P_80211_RAW (ETH_P_ECONET + 1)
+#endif
+
+/* IEEE 802.11 defines */
+
+#define P80211_OUI_LEN 3
+
+struct ieee80211_snap_hdr {
+
+	u8    dsap;   /* always 0xAA */
+	u8    ssap;   /* always 0xAA */
+	u8    ctrl;   /* always 0x03 */
+	u8    oui[P80211_OUI_LEN];    /* organizational universal id */
+
+} __attribute__ ((packed));
+
+#define SNAP_SIZE sizeof(struct ieee80211_snap_hdr)
+
+#define WLAN_FC_GET_VERS(fc) ((fc) & IEEE80211_FCTL_VERS)
+#define WLAN_FC_GET_TYPE(fc) ((fc) & IEEE80211_FCTL_FTYPE)
+#define WLAN_FC_GET_STYPE(fc) ((fc) & IEEE80211_FCTL_STYPE)
+
+#define WLAN_FC_GET_FRAMETYPE(fc) ((fc) & IEEE80211_FCTL_FRAMETYPE)
+#define WLAN_GET_SEQ_FRAG(seq) ((seq) & IEEE80211_SCTL_FRAG)
+#define WLAN_GET_SEQ_SEQ(seq)  (((seq) & IEEE80211_SCTL_SEQ) >> 4)
+
+/* Authentication algorithms */
+#define WLAN_AUTH_OPEN 0
+#define WLAN_AUTH_SHARED_KEY 1
+#define WLAN_AUTH_LEAP 2
+
+#define WLAN_AUTH_CHALLENGE_LEN 128
+
+#define WLAN_CAPABILITY_BSS (1<<0)
+#define WLAN_CAPABILITY_IBSS (1<<1)
+#define WLAN_CAPABILITY_CF_POLLABLE (1<<2)
+#define WLAN_CAPABILITY_CF_POLL_REQUEST (1<<3)
+#define WLAN_CAPABILITY_PRIVACY (1<<4)
+#define WLAN_CAPABILITY_SHORT_PREAMBLE (1<<5)
+#define WLAN_CAPABILITY_PBCC (1<<6)
+#define WLAN_CAPABILITY_CHANNEL_AGILITY (1<<7)
+#define WLAN_CAPABILITY_SPECTRUM_MGMT (1<<8)
+#define WLAN_CAPABILITY_QOS (1<<9)
+#define WLAN_CAPABILITY_SHORT_SLOT (1<<10)
+#define WLAN_CAPABILITY_DSSS_OFDM (1<<13)
+
+/* 802.11g ERP information element */
+#define WLAN_ERP_NON_ERP_PRESENT (1<<0)
+#define WLAN_ERP_USE_PROTECTION (1<<1)
+#define WLAN_ERP_BARKER_PREAMBLE (1<<2)
+
+/* Status codes */
+enum ieee80211_statuscode {
+	WLAN_STATUS_SUCCESS = 0,
+	WLAN_STATUS_UNSPECIFIED_FAILURE = 1,
+	WLAN_STATUS_CAPS_UNSUPPORTED = 10,
+	WLAN_STATUS_REASSOC_NO_ASSOC = 11,
+	WLAN_STATUS_ASSOC_DENIED_UNSPEC = 12,
+	WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG = 13,
+	WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION = 14,
+	WLAN_STATUS_CHALLENGE_FAIL = 15,
+	WLAN_STATUS_AUTH_TIMEOUT = 16,
+	WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA = 17,
+	WLAN_STATUS_ASSOC_DENIED_RATES = 18,
+	/* 802.11b */
+	WLAN_STATUS_ASSOC_DENIED_NOSHORTPREAMBLE = 19,
+	WLAN_STATUS_ASSOC_DENIED_NOPBCC = 20,
+	WLAN_STATUS_ASSOC_DENIED_NOAGILITY = 21,
+	/* 802.11h */
+	WLAN_STATUS_ASSOC_DENIED_NOSPECTRUM = 22,
+	WLAN_STATUS_ASSOC_REJECTED_BAD_POWER = 23,
+	WLAN_STATUS_ASSOC_REJECTED_BAD_SUPP_CHAN = 24,
+	/* 802.11g */
+	WLAN_STATUS_ASSOC_DENIED_NOSHORTTIME = 25,
+	WLAN_STATUS_ASSOC_DENIED_NODSSSOFDM = 26,
+	/* 802.11i */
+	WLAN_STATUS_INVALID_IE = 40,
+	WLAN_STATUS_INVALID_GROUP_CIPHER = 41,
+	WLAN_STATUS_INVALID_PAIRWISE_CIPHER = 42,
+	WLAN_STATUS_INVALID_AKMP = 43,
+	WLAN_STATUS_UNSUPP_RSN_VERSION = 44,
+	WLAN_STATUS_INVALID_RSN_IE_CAP = 45,
+	WLAN_STATUS_CIPHER_SUITE_REJECTED = 46,
+};
+
+/* Reason codes */
+enum ieee80211_reasoncode {
+	WLAN_REASON_UNSPECIFIED = 1,
+	WLAN_REASON_PREV_AUTH_NOT_VALID = 2,
+	WLAN_REASON_DEAUTH_LEAVING = 3,
+	WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY = 4,
+	WLAN_REASON_DISASSOC_AP_BUSY = 5,
+	WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA = 6,
+	WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA = 7,
+	WLAN_REASON_DISASSOC_STA_HAS_LEFT = 8,
+	WLAN_REASON_STA_REQ_ASSOC_WITHOUT_AUTH = 9,
+	/* 802.11h */
+	WLAN_REASON_DISASSOC_BAD_POWER = 10,
+	WLAN_REASON_DISASSOC_BAD_SUPP_CHAN = 11,
+	/* 802.11i */
+	WLAN_REASON_INVALID_IE = 13,
+	WLAN_REASON_MIC_FAILURE = 14,
+	WLAN_REASON_4WAY_HANDSHAKE_TIMEOUT = 15,
+	WLAN_REASON_GROUP_KEY_HANDSHAKE_TIMEOUT = 16,
+	WLAN_REASON_IE_DIFFERENT = 17,
+	WLAN_REASON_INVALID_GROUP_CIPHER = 18,
+	WLAN_REASON_INVALID_PAIRWISE_CIPHER = 19,
+	WLAN_REASON_INVALID_AKMP = 20,
+	WLAN_REASON_UNSUPP_RSN_VERSION = 21,
+	WLAN_REASON_INVALID_RSN_IE_CAP = 22,
+	WLAN_REASON_IEEE8021X_FAILED = 23,
+	WLAN_REASON_CIPHER_SUITE_REJECTED = 24,
+};
+
+#define IEEE80211_STATMASK_SIGNAL (1<<0)
+#define IEEE80211_STATMASK_RSSI (1<<1)
+#define IEEE80211_STATMASK_NOISE (1<<2)
+#define IEEE80211_STATMASK_RATE (1<<3)
+#define IEEE80211_STATMASK_WEMASK 0x7
+
+#define IEEE80211_CCK_MODULATION    (1<<0)
+#define IEEE80211_OFDM_MODULATION   (1<<1)
+
+#define IEEE80211_24GHZ_BAND     (1<<0)
+#define IEEE80211_52GHZ_BAND     (1<<1)
+
+#define IEEE80211_CCK_RATE_LEN  		4
+#define IEEE80211_CCK_RATE_1MB			0x02
+#define IEEE80211_CCK_RATE_2MB			0x04
+#define IEEE80211_CCK_RATE_5MB			0x0B
+#define IEEE80211_CCK_RATE_11MB			0x16
+#define IEEE80211_OFDM_RATE_LEN 		8
+#define IEEE80211_OFDM_RATE_6MB			0x0C
+#define IEEE80211_OFDM_RATE_9MB			0x12
+#define IEEE80211_OFDM_RATE_12MB		0x18
+#define IEEE80211_OFDM_RATE_18MB		0x24
+#define IEEE80211_OFDM_RATE_24MB		0x30
+#define IEEE80211_OFDM_RATE_36MB		0x48
+#define IEEE80211_OFDM_RATE_48MB		0x60
+#define IEEE80211_OFDM_RATE_54MB		0x6C
+#define IEEE80211_BASIC_RATE_MASK		0x80
+
+#define IEEE80211_CCK_RATE_1MB_MASK		(1<<0)
+#define IEEE80211_CCK_RATE_2MB_MASK		(1<<1)
+#define IEEE80211_CCK_RATE_5MB_MASK		(1<<2)
+#define IEEE80211_CCK_RATE_11MB_MASK		(1<<3)
+#define IEEE80211_OFDM_RATE_6MB_MASK		(1<<4)
+#define IEEE80211_OFDM_RATE_9MB_MASK		(1<<5)
+#define IEEE80211_OFDM_RATE_12MB_MASK		(1<<6)
+#define IEEE80211_OFDM_RATE_18MB_MASK		(1<<7)
+#define IEEE80211_OFDM_RATE_24MB_MASK		(1<<8)
+#define IEEE80211_OFDM_RATE_36MB_MASK		(1<<9)
+#define IEEE80211_OFDM_RATE_48MB_MASK		(1<<10)
+#define IEEE80211_OFDM_RATE_54MB_MASK		(1<<11)
+
+#define IEEE80211_CCK_RATES_MASK		0x0000000F
+#define IEEE80211_CCK_BASIC_RATES_MASK	(IEEE80211_CCK_RATE_1MB_MASK | \
+	IEEE80211_CCK_RATE_2MB_MASK)
+#define IEEE80211_CCK_DEFAULT_RATES_MASK	(IEEE80211_CCK_BASIC_RATES_MASK | \
+	IEEE80211_CCK_RATE_5MB_MASK | \
+	IEEE80211_CCK_RATE_11MB_MASK)
+
+#define IEEE80211_OFDM_RATES_MASK		0x00000FF0
+#define IEEE80211_OFDM_BASIC_RATES_MASK	(IEEE80211_OFDM_RATE_6MB_MASK | \
+	IEEE80211_OFDM_RATE_12MB_MASK | \
+	IEEE80211_OFDM_RATE_24MB_MASK)
+#define IEEE80211_OFDM_DEFAULT_RATES_MASK	(IEEE80211_OFDM_BASIC_RATES_MASK | \
+	IEEE80211_OFDM_RATE_9MB_MASK  | \
+	IEEE80211_OFDM_RATE_18MB_MASK | \
+	IEEE80211_OFDM_RATE_36MB_MASK | \
+	IEEE80211_OFDM_RATE_48MB_MASK | \
+	IEEE80211_OFDM_RATE_54MB_MASK)
+#define IEEE80211_DEFAULT_RATES_MASK (IEEE80211_OFDM_DEFAULT_RATES_MASK | \
+				IEEE80211_CCK_DEFAULT_RATES_MASK)
+
+#define IEEE80211_NUM_OFDM_RATES	    8
+#define IEEE80211_NUM_CCK_RATES		    4
+#define IEEE80211_OFDM_SHIFT_MASK_A         4
+
+
+/* this is stolen and modified from the madwifi driver*/
+#define IEEE80211_FC0_TYPE_MASK		0x0c
+#define IEEE80211_FC0_TYPE_DATA		0x08
+#define IEEE80211_FC0_SUBTYPE_MASK	0xB0
+#define IEEE80211_FC0_SUBTYPE_QOS	0x80
+
+#define IEEE80211_QOS_HAS_SEQ(fc) \
+	(((fc) & (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) == \
+	 (IEEE80211_FC0_TYPE_DATA | IEEE80211_FC0_SUBTYPE_QOS))
+
+/* this is stolen from ipw2200 driver */
+#define IEEE_IBSS_MAC_HASH_SIZE 31
+struct ieee_ibss_seq {
+	u8 mac[ETH_ALEN];
+	u16 seq_num[17];
+	u16 frag_num[17];
+	unsigned long packet_time[17];
+	struct list_head list;
+};
+
+/* NOTE: This data is for statistical purposes; not all hardware provides this
+ *       information for frames received.  Not setting these will not cause
+ *       any adverse affects. */
+struct ieee80211_rx_stats {
+	u32 mac_time[2];
+	s8 rssi;
+	u8 signal;
+	u8 noise;
+	u16 rate; /* in 100 kbps */
+	u8 received_channel;
+	u8 control;
+	u8 mask;
+	u8 freq;
+	u16 len;
+	u64 tsf;
+	u32 beacon_time;
+	u8 nic_type;
+	u16       Length;
+	//      u8        DataRate;      // In 0.5 Mbps
+	u8        SignalQuality; // in 0-100 index.
+	s32       RecvSignalPower; // Real power in dBm for this packet, no beautification and aggregation.
+	s8        RxPower; // in dBm Translate from PWdB
+	u8        SignalStrength; // in 0-100 index.
+	u16       bHwError:1;
+	u16       bCRC:1;
+	u16       bICV:1;
+	u16       bShortPreamble:1;
+	u16       Antenna:1;      //for rtl8185
+	u16       Decrypted:1;    //for rtl8185, rtl8187
+	u16       Wakeup:1;       //for rtl8185
+	u16       Reserved0:1;    //for rtl8185
+	u8        AGC;
+	u32       TimeStampLow;
+	u32       TimeStampHigh;
+	bool      bShift;
+	bool      bIsQosData;             // Added by Annie, 2005-12-22.
+	u8        UserPriority;
+
+	//1!!!!!!!!!!!!!!!!!!!!!!!!!!!
+	//1Attention Please!!!<11n or 8190 specific code should be put below this line>
+	//1!!!!!!!!!!!!!!!!!!!!!!!!!!!
+
+	u8        RxDrvInfoSize;
+	u8        RxBufShift;
+	bool      bIsAMPDU;
+	bool      bFirstMPDU;
+	bool      bContainHTC;
+	bool      RxIs40MHzPacket;
+	u32       RxPWDBAll;
+	u8        RxMIMOSignalStrength[4];        // in 0~100 index
+	s8        RxMIMOSignalQuality[2];
+	bool      bPacketMatchBSSID;
+	bool      bIsCCK;
+	bool      bPacketToSelf;
+	//added by amy
+	u8*       virtual_address;
+	u16          packetlength;              // Total packet length: Must equal to sum of all FragLength
+	u16          fraglength;                        // FragLength should equal to PacketLength in non-fragment case
+	u16          fragoffset;                        // Data offset for this fragment
+	u16          ntotalfrag;
+	bool      	  bisrxaggrsubframe;
+	bool		  bPacketBeacon;	//cosa add for rssi
+	bool		  bToSelfBA;		//cosa add for rssi
+	char 	  cck_adc_pwdb[4];	//cosa add for rx path selection
+	u16		  Seq_Num;
+
+};
+
+/* IEEE 802.11 requires that STA supports concurrent reception of at least
+ * three fragmented frames. This define can be increased to support more
+ * concurrent frames, but it should be noted that each entry can consume about
+ * 2 kB of RAM and increasing cache size will slow down frame reassembly. */
+#define IEEE80211_FRAG_CACHE_LEN 4
+
+struct ieee80211_frag_entry {
+	unsigned long first_frag_time;
+	unsigned int seq;
+	unsigned int last_frag;
+	struct sk_buff *skb;
+	u8 src_addr[ETH_ALEN];
+	u8 dst_addr[ETH_ALEN];
+};
+
+struct ieee80211_stats {
+	unsigned int tx_unicast_frames;
+	unsigned int tx_multicast_frames;
+	unsigned int tx_fragments;
+	unsigned int tx_unicast_octets;
+	unsigned int tx_multicast_octets;
+	unsigned int tx_deferred_transmissions;
+	unsigned int tx_single_retry_frames;
+	unsigned int tx_multiple_retry_frames;
+	unsigned int tx_retry_limit_exceeded;
+	unsigned int tx_discards;
+	unsigned int rx_unicast_frames;
+	unsigned int rx_multicast_frames;
+	unsigned int rx_fragments;
+	unsigned int rx_unicast_octets;
+	unsigned int rx_multicast_octets;
+	unsigned int rx_fcs_errors;
+	unsigned int rx_discards_no_buffer;
+	unsigned int tx_discards_wrong_sa;
+	unsigned int rx_discards_undecryptable;
+	unsigned int rx_message_in_msg_fragments;
+	unsigned int rx_message_in_bad_msg_fragments;
+};
+
+struct ieee80211_device;
+
+#include "ieee80211_crypt.h"
+
+#define SEC_KEY_1         (1<<0)
+#define SEC_KEY_2         (1<<1)
+#define SEC_KEY_3         (1<<2)
+#define SEC_KEY_4         (1<<3)
+#define SEC_ACTIVE_KEY    (1<<4)
+#define SEC_AUTH_MODE     (1<<5)
+#define SEC_UNICAST_GROUP (1<<6)
+#define SEC_LEVEL         (1<<7)
+#define SEC_ENABLED       (1<<8)
+#define SEC_ENCRYPT       (1<<9)
+
+#define SEC_LEVEL_0      0 /* None */
+#define SEC_LEVEL_1      1 /* WEP 40 and 104 bit */
+#define SEC_LEVEL_2      2 /* Level 1 + TKIP */
+#define SEC_LEVEL_2_CKIP 3 /* Level 1 + CKIP */
+#define SEC_LEVEL_3      4 /* Level 2 + CCMP */
+
+#define SEC_ALG_NONE            0
+#define SEC_ALG_WEP             1
+#define SEC_ALG_TKIP            2
+#define SEC_ALG_CCMP            3
+
+#define WEP_KEYS 		4
+#define WEP_KEY_LEN		13
+#define SCM_KEY_LEN             32
+#define SCM_TEMPORAL_KEY_LENGTH 16
+
+struct ieee80211_security {
+	u16 active_key:2,
+	    enabled:1,
+	    auth_mode:2,
+	    auth_algo:4,
+	    unicast_uses_group:1,
+	    encrypt:1;
+	u8 key_sizes[WEP_KEYS];
+	u8 keys[WEP_KEYS][SCM_KEY_LEN];
+	u8 level;
+	u16 flags;
+} __attribute__ ((packed));
+
+
+/*
+ 802.11 data frame from AP
+      ,-------------------------------------------------------------------.
+Bytes |  2   |  2   |    6    |    6    |    6    |  2   | 0..2312 |   4  |
+      |------|------|---------|---------|---------|------|---------|------|
+Desc. | ctrl | dura |  DA/RA  |   TA    |    SA   | Sequ |  frame  |  fcs |
+      |      | tion | (BSSID) |         |         | ence |  data   |      |
+      `-------------------------------------------------------------------'
+Total: 28-2340 bytes
+*/
+
+/* Management Frame Information Element Types */
+enum ieee80211_mfie {
+	MFIE_TYPE_SSID = 0,
+	MFIE_TYPE_RATES = 1,
+	MFIE_TYPE_FH_SET = 2,
+	MFIE_TYPE_DS_SET = 3,
+	MFIE_TYPE_CF_SET = 4,
+	MFIE_TYPE_TIM = 5,
+	MFIE_TYPE_IBSS_SET = 6,
+	MFIE_TYPE_COUNTRY = 7,
+	MFIE_TYPE_HOP_PARAMS = 8,
+	MFIE_TYPE_HOP_TABLE = 9,
+	MFIE_TYPE_REQUEST = 10,
+	MFIE_TYPE_CHALLENGE = 16,
+	MFIE_TYPE_POWER_CONSTRAINT = 32,
+	MFIE_TYPE_POWER_CAPABILITY = 33,
+	MFIE_TYPE_TPC_REQUEST = 34,
+	MFIE_TYPE_TPC_REPORT = 35,
+	MFIE_TYPE_SUPP_CHANNELS = 36,
+	MFIE_TYPE_CSA = 37,
+	MFIE_TYPE_MEASURE_REQUEST = 38,
+	MFIE_TYPE_MEASURE_REPORT = 39,
+	MFIE_TYPE_QUIET = 40,
+	MFIE_TYPE_IBSS_DFS = 41,
+	MFIE_TYPE_ERP = 42,
+	MFIE_TYPE_RSN = 48,
+	MFIE_TYPE_RATES_EX = 50,
+	MFIE_TYPE_HT_CAP= 45,
+	 MFIE_TYPE_HT_INFO= 61,
+	 MFIE_TYPE_AIRONET=133,
+	MFIE_TYPE_GENERIC = 221,
+	MFIE_TYPE_QOS_PARAMETER = 222,
+};
+
+/* Minimal header; can be used for passing 802.11 frames with sufficient
+ * information to determine what type of underlying data type is actually
+ * stored in the data. */
+struct ieee80211_hdr {
+	__le16 frame_ctl;
+	__le16 duration_id;
+	u8 payload[0];
+} __attribute__ ((packed));
+
+struct ieee80211_hdr_1addr {
+	__le16 frame_ctl;
+	__le16 duration_id;
+	u8 addr1[ETH_ALEN];
+	u8 payload[0];
+} __attribute__ ((packed));
+
+struct ieee80211_hdr_2addr {
+	__le16 frame_ctl;
+	__le16 duration_id;
+	u8 addr1[ETH_ALEN];
+	u8 addr2[ETH_ALEN];
+	u8 payload[0];
+} __attribute__ ((packed));
+
+struct ieee80211_hdr_3addr {
+	__le16 frame_ctl;
+	__le16 duration_id;
+	u8 addr1[ETH_ALEN];
+	u8 addr2[ETH_ALEN];
+	u8 addr3[ETH_ALEN];
+	__le16 seq_ctl;
+	u8 payload[0];
+} __attribute__ ((packed));
+
+struct ieee80211_hdr_4addr {
+	__le16 frame_ctl;
+	__le16 duration_id;
+	u8 addr1[ETH_ALEN];
+	u8 addr2[ETH_ALEN];
+	u8 addr3[ETH_ALEN];
+	__le16 seq_ctl;
+	u8 addr4[ETH_ALEN];
+	u8 payload[0];
+} __attribute__ ((packed));
+
+struct ieee80211_hdr_3addrqos {
+	__le16 frame_ctl;
+	__le16 duration_id;
+	u8 addr1[ETH_ALEN];
+	u8 addr2[ETH_ALEN];
+	u8 addr3[ETH_ALEN];
+	__le16 seq_ctl;
+	u8 payload[0];
+	__le16 qos_ctl;
+} __attribute__ ((packed));
+
+struct ieee80211_hdr_4addrqos {
+	__le16 frame_ctl;
+	__le16 duration_id;
+	u8 addr1[ETH_ALEN];
+	u8 addr2[ETH_ALEN];
+	u8 addr3[ETH_ALEN];
+	__le16 seq_ctl;
+	u8 addr4[ETH_ALEN];
+	u8 payload[0];
+	__le16 qos_ctl;
+} __attribute__ ((packed));
+
+struct ieee80211_info_element {
+	u8 id;
+	u8 len;
+	u8 data[0];
+} __attribute__ ((packed));
+
+struct ieee80211_authentication {
+	struct ieee80211_hdr_3addr header;
+	__le16 algorithm;
+	__le16 transaction;
+	__le16 status;
+	/*challenge*/
+	struct ieee80211_info_element info_element[0];
+} __attribute__ ((packed));
+
+struct ieee80211_disassoc {
+	struct ieee80211_hdr_3addr header;
+	__le16 reason;
+} __attribute__ ((packed));
+
+struct ieee80211_probe_request {
+	struct ieee80211_hdr_3addr header;
+	/* SSID, supported rates */
+	struct ieee80211_info_element info_element[0];
+} __attribute__ ((packed));
+
+struct ieee80211_probe_response {
+	struct ieee80211_hdr_3addr header;
+	u32 time_stamp[2];
+	__le16 beacon_interval;
+	__le16 capability;
+	/* SSID, supported rates, FH params, DS params,
+	 * CF params, IBSS params, TIM (if beacon), RSN */
+	struct ieee80211_info_element info_element[0];
+} __attribute__ ((packed));
+
+/* Alias beacon for probe_response */
+#define ieee80211_beacon ieee80211_probe_response
+
+struct ieee80211_assoc_request_frame {
+	struct ieee80211_hdr_3addr header;
+	__le16 capability;
+	__le16 listen_interval;
+	/* SSID, supported rates, RSN */
+	struct ieee80211_info_element info_element[0];
+} __attribute__ ((packed));
+
+struct ieee80211_reassoc_request_frame {
+	struct ieee80211_hdr_3addr header;
+	__le16 capability;
+	__le16 listen_interval;
+	u8 current_ap[ETH_ALEN];
+	/* SSID, supported rates, RSN */
+	struct ieee80211_info_element info_element[0];
+} __attribute__ ((packed));
+
+struct ieee80211_assoc_response_frame {
+	struct ieee80211_hdr_3addr header;
+	__le16 capability;
+	__le16 status;
+	__le16 aid;
+	struct ieee80211_info_element info_element[0]; /* supported rates */
+} __attribute__ ((packed));
+
+struct ieee80211_txb {
+	u8 nr_frags;
+	u8 encrypted;
+	u8 queue_index;
+	u8 rts_included;
+	u16 reserved;
+	__le16 frag_size;
+	__le16 payload_size;
+	struct sk_buff *fragments[0];
+};
+
+#define MAX_TX_AGG_COUNT		  16
+struct ieee80211_drv_agg_txb {
+	u8 nr_drv_agg_frames;
+	struct sk_buff *tx_agg_frames[MAX_TX_AGG_COUNT];
+}__attribute__((packed));
+
+#define MAX_SUBFRAME_COUNT 		  64
+struct ieee80211_rxb {
+	u8 nr_subframes;
+	struct sk_buff *subframes[MAX_SUBFRAME_COUNT];
+	u8 dst[ETH_ALEN];
+	u8 src[ETH_ALEN];
+}__attribute__((packed));
+
+typedef union _frameqos {
+	u16 shortdata;
+	u8  chardata[2];
+	struct {
+		u16 tid:4;
+		u16 eosp:1;
+		u16 ack_policy:2;
+		u16 reserved:1;
+		u16 txop:8;
+	}field;
+}frameqos,*pframeqos;
+
+/* SWEEP TABLE ENTRIES NUMBER*/
+#define MAX_SWEEP_TAB_ENTRIES		  42
+#define MAX_SWEEP_TAB_ENTRIES_PER_PACKET  7
+/* MAX_RATES_LENGTH needs to be 12.  The spec says 8, and many APs
+ * only use 8, and then use extended rates for the remaining supported
+ * rates.  Other APs, however, stick all of their supported rates on the
+ * main rates information element... */
+#define MAX_RATES_LENGTH                  ((u8)12)
+#define MAX_RATES_EX_LENGTH               ((u8)16)
+#define MAX_NETWORK_COUNT                  128
+
+#define MAX_CHANNEL_NUMBER                 161
+#define IEEE80211_SOFTMAC_SCAN_TIME	   100
+//(HZ / 2)
+#define IEEE80211_SOFTMAC_ASSOC_RETRY_TIME (HZ * 2)
+
+#define CRC_LENGTH                 4U
+
+#define MAX_WPA_IE_LEN 64
+
+#define NETWORK_EMPTY_ESSID (1<<0)
+#define NETWORK_HAS_OFDM    (1<<1)
+#define NETWORK_HAS_CCK     (1<<2)
+
+/* QoS structure */
+#define NETWORK_HAS_QOS_PARAMETERS      (1<<3)
+#define NETWORK_HAS_QOS_INFORMATION     (1<<4)
+#define NETWORK_HAS_QOS_MASK            (NETWORK_HAS_QOS_PARAMETERS | \
+					 NETWORK_HAS_QOS_INFORMATION)
+/* 802.11h */
+#define NETWORK_HAS_POWER_CONSTRAINT    (1<<5)
+#define NETWORK_HAS_CSA                 (1<<6)
+#define NETWORK_HAS_QUIET               (1<<7)
+#define NETWORK_HAS_IBSS_DFS            (1<<8)
+#define NETWORK_HAS_TPC_REPORT          (1<<9)
+
+#define NETWORK_HAS_ERP_VALUE           (1<<10)
+
+#define QOS_QUEUE_NUM                   4
+#define QOS_OUI_LEN                     3
+#define QOS_OUI_TYPE                    2
+#define QOS_ELEMENT_ID                  221
+#define QOS_OUI_INFO_SUB_TYPE           0
+#define QOS_OUI_PARAM_SUB_TYPE          1
+#define QOS_VERSION_1                   1
+#define QOS_AIFSN_MIN_VALUE             2
+struct ieee80211_qos_information_element {
+	u8 elementID;
+	u8 length;
+	u8 qui[QOS_OUI_LEN];
+	u8 qui_type;
+	u8 qui_subtype;
+	u8 version;
+	u8 ac_info;
+} __attribute__ ((packed));
+
+struct ieee80211_qos_ac_parameter {
+	u8 aci_aifsn;
+	u8 ecw_min_max;
+	__le16 tx_op_limit;
+} __attribute__ ((packed));
+
+struct ieee80211_qos_parameter_info {
+	struct ieee80211_qos_information_element info_element;
+	u8 reserved;
+	struct ieee80211_qos_ac_parameter ac_params_record[QOS_QUEUE_NUM];
+} __attribute__ ((packed));
+
+struct ieee80211_qos_parameters {
+	__le16 cw_min[QOS_QUEUE_NUM];
+	__le16 cw_max[QOS_QUEUE_NUM];
+	u8 aifs[QOS_QUEUE_NUM];
+	u8 flag[QOS_QUEUE_NUM];
+	__le16 tx_op_limit[QOS_QUEUE_NUM];
+} __attribute__ ((packed));
+
+struct ieee80211_qos_data {
+	struct ieee80211_qos_parameters parameters;
+	int active;
+	int supported;
+	u8 param_count;
+	u8 old_param_count;
+};
+
+struct ieee80211_tim_parameters {
+	u8 tim_count;
+	u8 tim_period;
+} __attribute__ ((packed));
+
+//#else
+struct ieee80211_wmm_ac_param {
+	u8 ac_aci_acm_aifsn;
+	u8 ac_ecwmin_ecwmax;
+	u16 ac_txop_limit;
+};
+
+struct ieee80211_wmm_ts_info {
+	u8 ac_dir_tid;
+	u8 ac_up_psb;
+	u8 reserved;
+} __attribute__ ((packed));
+
+struct ieee80211_wmm_tspec_elem {
+	struct ieee80211_wmm_ts_info ts_info;
+	u16 norm_msdu_size;
+	u16 max_msdu_size;
+	u32 min_serv_inter;
+	u32 max_serv_inter;
+	u32 inact_inter;
+	u32 suspen_inter;
+	u32 serv_start_time;
+	u32 min_data_rate;
+	u32 mean_data_rate;
+	u32 peak_data_rate;
+	u32 max_burst_size;
+	u32 delay_bound;
+	u32 min_phy_rate;
+	u16 surp_band_allow;
+	u16 medium_time;
+}__attribute__((packed));
+enum eap_type {
+	EAP_PACKET = 0,
+	EAPOL_START,
+	EAPOL_LOGOFF,
+	EAPOL_KEY,
+	EAPOL_ENCAP_ASF_ALERT
+};
+
+static const char *eap_types[] = {
+	[EAP_PACKET]		= "EAP-Packet",
+	[EAPOL_START]		= "EAPOL-Start",
+	[EAPOL_LOGOFF]		= "EAPOL-Logoff",
+	[EAPOL_KEY]		= "EAPOL-Key",
+	[EAPOL_ENCAP_ASF_ALERT]	= "EAPOL-Encap-ASF-Alert"
+};
+
+static inline const char *eap_get_type(int type)
+{
+	return ((u32)type >= ARRAY_SIZE(eap_types)) ? "Unknown" : eap_types[type];
+}
+//added by amy for reorder
+static inline u8 Frame_QoSTID(u8* buf)
+{
+	struct ieee80211_hdr_3addr *hdr;
+	u16 fc;
+	hdr = (struct ieee80211_hdr_3addr *)buf;
+	fc = le16_to_cpu(hdr->frame_ctl);
+	return (u8)((frameqos*)(buf + (((fc & IEEE80211_FCTL_TODS)&&(fc & IEEE80211_FCTL_FROMDS))? 30 : 24)))->field.tid;
+}
+
+//added by amy for reorder
+
+struct eapol {
+	u8 snap[6];
+	u16 ethertype;
+	u8 version;
+	u8 type;
+	u16 length;
+} __attribute__ ((packed));
+
+struct ieee80211_softmac_stats{
+	unsigned int rx_ass_ok;
+	unsigned int rx_ass_err;
+	unsigned int rx_probe_rq;
+	unsigned int tx_probe_rs;
+	unsigned int tx_beacons;
+	unsigned int rx_auth_rq;
+	unsigned int rx_auth_rs_ok;
+	unsigned int rx_auth_rs_err;
+	unsigned int tx_auth_rq;
+	unsigned int no_auth_rs;
+	unsigned int no_ass_rs;
+	unsigned int tx_ass_rq;
+	unsigned int rx_ass_rq;
+	unsigned int tx_probe_rq;
+	unsigned int reassoc;
+	unsigned int swtxstop;
+	unsigned int swtxawake;
+	unsigned char CurrentShowTxate;
+	unsigned char last_packet_rate;
+	unsigned int txretrycount;
+};
+
+#define BEACON_PROBE_SSID_ID_POSITION 12
+
+struct ieee80211_info_element_hdr {
+	u8 id;
+	u8 len;
+} __attribute__ ((packed));
+
+/*
+ * These are the data types that can make up management packets
+ *
+	u16 auth_algorithm;
+	u16 auth_sequence;
+	u16 beacon_interval;
+	u16 capability;
+	u8 current_ap[ETH_ALEN];
+	u16 listen_interval;
+	struct {
+		u16 association_id:14, reserved:2;
+	} __attribute__ ((packed));
+	u32 time_stamp[2];
+	u16 reason;
+	u16 status;
+*/
+
+#define IEEE80211_DEFAULT_TX_ESSID "Penguin"
+#define IEEE80211_DEFAULT_BASIC_RATE 2 //1Mbps
+
+enum {WMM_all_frame, WMM_two_frame, WMM_four_frame, WMM_six_frame};
+#define MAX_SP_Len  (WMM_all_frame << 4)
+#define IEEE80211_QOS_TID 0x0f
+#define QOS_CTL_NOTCONTAIN_ACK (0x01 << 5)
+
+#define IEEE80211_DTIM_MBCAST 4
+#define IEEE80211_DTIM_UCAST 2
+#define IEEE80211_DTIM_VALID 1
+#define IEEE80211_DTIM_INVALID 0
+
+#define IEEE80211_PS_DISABLED 0
+#define IEEE80211_PS_UNICAST IEEE80211_DTIM_UCAST
+#define IEEE80211_PS_MBCAST IEEE80211_DTIM_MBCAST
+
+//added by David for QoS 2006/6/30
+//#define WMM_Hang_8187
+#ifdef WMM_Hang_8187
+#undef WMM_Hang_8187
+#endif
+
+#define WME_AC_BK   0x00
+#define WME_AC_BE   0x01
+#define WME_AC_VI   0x02
+#define WME_AC_VO   0x03
+#define WME_ACI_MASK 0x03
+#define WME_AIFSN_MASK 0x03
+#define WME_AC_PRAM_LEN 16
+
+#define MAX_RECEIVE_BUFFER_SIZE 9100
+
+//UP Mapping to AC, using in MgntQuery_SequenceNumber() and maybe for DSCP
+//#define UP2AC(up)	((up<3) ? ((up==0)?1:0) : (up>>1))
+#define UP2AC(up) (		   \
+	((up) < 1) ? WME_AC_BE : \
+	((up) < 3) ? WME_AC_BK : \
+	((up) < 4) ? WME_AC_BE : \
+	((up) < 6) ? WME_AC_VI : \
+	WME_AC_VO)
+//AC Mapping to UP, using in Tx part for selecting the corresponding TX queue
+#define AC2UP(_ac)	(       \
+	((_ac) == WME_AC_VO) ? 6 : \
+	((_ac) == WME_AC_VI) ? 5 : \
+	((_ac) == WME_AC_BK) ? 1 : \
+	0)
+
+#define	ETHER_ADDR_LEN		6	/* length of an Ethernet address */
+#define ETHERNET_HEADER_SIZE    14      /* length of two Ethernet address plus ether type*/
+
+struct	ether_header {
+	u8 ether_dhost[ETHER_ADDR_LEN];
+	u8 ether_shost[ETHER_ADDR_LEN];
+	u16 ether_type;
+} __attribute__((packed));
+
+#ifndef ETHERTYPE_PAE
+#define	ETHERTYPE_PAE	0x888e		/* EAPOL PAE/802.1x */
+#endif
+#ifndef ETHERTYPE_IP
+#define	ETHERTYPE_IP	0x0800		/* IP protocol */
+#endif
+
+typedef struct _bss_ht{
+
+	bool				support_ht;
+
+	// HT related elements
+	u8					ht_cap_buf[32];
+	u16					ht_cap_len;
+	u8					ht_info_buf[32];
+	u16					ht_info_len;
+
+	HT_SPEC_VER			ht_spec_ver;
+	//HT_CAPABILITY_ELE			bdHTCapEle;
+	//HT_INFORMATION_ELE		bdHTInfoEle;
+
+	bool				aggregation;
+	bool				long_slot_time;
+}bss_ht, *pbss_ht;
+
+typedef enum _erp_t{
+	ERP_NonERPpresent	= 0x01,
+	ERP_UseProtection	= 0x02,
+	ERP_BarkerPreambleMode = 0x04,
+} erp_t;
+
+
+struct ieee80211_network {
+	/* These entries are used to identify a unique network */
+	u8 bssid[ETH_ALEN];
+	u8 channel;
+	/* Ensure null-terminated for any debug msgs */
+	u8 ssid[IW_ESSID_MAX_SIZE + 1];
+	u8 ssid_len;
+	struct ieee80211_qos_data qos_data;
+	//added by amy for LEAP
+	bool	bWithAironetIE;
+	bool	bCkipSupported;
+	bool	bCcxRmEnable;
+	u16 	CcxRmState[2];
+	// CCXv4 S59, MBSSID.
+	bool	bMBssidValid;
+	u8	MBssidMask;
+	u8	MBssid[6];
+	// CCX 2 S38, WLAN Device Version Number element. Annie, 2006-08-20.
+	bool	bWithCcxVerNum;
+	u8	BssCcxVerNumber;
+	/* These are network statistics */
+	struct ieee80211_rx_stats stats;
+	u16 capability;
+	u8  rates[MAX_RATES_LENGTH];
+	u8  rates_len;
+	u8  rates_ex[MAX_RATES_EX_LENGTH];
+	u8  rates_ex_len;
+	unsigned long last_scanned;
+	u8  mode;
+	u32 flags;
+	u32 last_associate;
+	u32 time_stamp[2];
+	u16 beacon_interval;
+	u16 listen_interval;
+	u16 atim_window;
+	u8  erp_value;
+	u8  wpa_ie[MAX_WPA_IE_LEN];
+	size_t wpa_ie_len;
+	u8  rsn_ie[MAX_WPA_IE_LEN];
+	size_t rsn_ie_len;
+
+	struct ieee80211_tim_parameters tim;
+	u8  dtim_period;
+	u8  dtim_data;
+	u32 last_dtim_sta_time[2];
+
+	//appeded for QoS
+	u8 wmm_info;
+	struct ieee80211_wmm_ac_param wmm_param[4];
+	u8 QoS_Enable;
+#ifdef THOMAS_TURBO
+	u8 Turbo_Enable;//enable turbo mode, added by thomas
+#endif
+#ifdef ENABLE_DOT11D
+	u16 CountryIeLen;
+	u8 CountryIeBuf[MAX_IE_LEN];
+#endif
+	// HT Related, by amy, 2008.04.29
+	BSS_HT	bssht;
+	// Add to handle broadcom AP management frame CCK rate.
+	bool broadcom_cap_exist;
+	bool ralink_cap_exist;
+	bool atheros_cap_exist;
+	bool cisco_cap_exist;
+	bool unknown_cap_exist;
+//	u8	berp_info;
+	bool	berp_info_valid;
+	bool buseprotection;
+	//put at the end of the structure.
+	struct list_head list;
+};
+
+enum ieee80211_state {
+
+	/* the card is not linked at all */
+	IEEE80211_NOLINK = 0,
+
+	/* IEEE80211_ASSOCIATING* are for BSS client mode
+	 * the driver shall not perform RX filtering unless
+	 * the state is LINKED.
+	 * The driver shall just check for the state LINKED and
+	 * defaults to NOLINK for ALL the other states (including
+	 * LINKED_SCANNING)
+	 */
+
+	/* the association procedure will start (wq scheduling)*/
+	IEEE80211_ASSOCIATING,
+	IEEE80211_ASSOCIATING_RETRY,
+
+	/* the association procedure is sending AUTH request*/
+	IEEE80211_ASSOCIATING_AUTHENTICATING,
+
+	/* the association procedure has successfully authentcated
+	 * and is sending association request
+	 */
+	IEEE80211_ASSOCIATING_AUTHENTICATED,
+
+	/* the link is ok. the card associated to a BSS or linked
+	 * to a ibss cell or acting as an AP and creating the bss
+	 */
+	IEEE80211_LINKED,
+
+	/* same as LINKED, but the driver shall apply RX filter
+	 * rules as we are in NO_LINK mode. As the card is still
+	 * logically linked, but it is doing a syncro site survey
+	 * then it will be back to LINKED state.
+	 */
+	IEEE80211_LINKED_SCANNING,
+
+};
+
+#define DEFAULT_MAX_SCAN_AGE (15 * HZ)
+#define DEFAULT_FTS 2346
+
+#define CFG_IEEE80211_RESERVE_FCS (1<<0)
+#define CFG_IEEE80211_COMPUTE_FCS (1<<1)
+#define CFG_IEEE80211_RTS (1<<2)
+
+#define IEEE80211_24GHZ_MIN_CHANNEL 1
+#define IEEE80211_24GHZ_MAX_CHANNEL 14
+#define IEEE80211_24GHZ_CHANNELS (IEEE80211_24GHZ_MAX_CHANNEL - \
+				  IEEE80211_24GHZ_MIN_CHANNEL + 1)
+
+#define IEEE80211_52GHZ_MIN_CHANNEL 34
+#define IEEE80211_52GHZ_MAX_CHANNEL 165
+#define IEEE80211_52GHZ_CHANNELS (IEEE80211_52GHZ_MAX_CHANNEL - \
+				  IEEE80211_52GHZ_MIN_CHANNEL + 1)
+
+
+
+typedef struct tx_pending_t{
+	int frag;
+	struct ieee80211_txb *txb;
+}tx_pending_t;
+
+typedef struct _bandwidth_autoswitch
+{
+	long threshold_20Mhzto40Mhz;
+	long	threshold_40Mhzto20Mhz;
+	bool bforced_tx20Mhz;
+	bool bautoswitch_enable;
+}bandwidth_autoswitch,*pbandwidth_autoswitch;
+
+
+//added by amy for order
+
+#define REORDER_WIN_SIZE	128
+#define REORDER_ENTRY_NUM	128
+typedef struct _RX_REORDER_ENTRY
+{
+	struct list_head	List;
+	u16			SeqNum;
+	struct ieee80211_rxb* prxb;
+} RX_REORDER_ENTRY, *PRX_REORDER_ENTRY;
+//added by amy for order
+typedef enum _Fsync_State{
+	Default_Fsync,
+	HW_Fsync,
+	SW_Fsync
+}Fsync_State;
+
+// Power save mode configured.
+typedef	enum _RT_PS_MODE
+{
+	eActive,	// Active/Continuous access.
+	eMaxPs,		// Max power save mode.
+	eFastPs		// Fast power save mode.
+}RT_PS_MODE;
+
+typedef enum _IPS_CALLBACK_FUNCION
+{
+	IPS_CALLBACK_NONE = 0,
+	IPS_CALLBACK_MGNT_LINK_REQUEST = 1,
+	IPS_CALLBACK_JOIN_REQUEST = 2,
+}IPS_CALLBACK_FUNCION;
+
+typedef enum _RT_JOIN_ACTION{
+	RT_JOIN_INFRA   = 1,
+	RT_JOIN_IBSS  = 2,
+	RT_START_IBSS = 3,
+	RT_NO_ACTION  = 4,
+}RT_JOIN_ACTION;
+
+typedef struct _IbssParms{
+	u16   atimWin;
+}IbssParms, *PIbssParms;
+#define MAX_NUM_RATES	264 // Max num of support rates element: 8,  Max num of ext. support rate: 255. 061122, by rcnjko.
+
+// RF state.
+typedef	enum _RT_RF_POWER_STATE
+{
+	eRfOn,
+	eRfSleep,
+	eRfOff
+}RT_RF_POWER_STATE;
+
+typedef struct _RT_POWER_SAVE_CONTROL
+{
+
+	//
+	// Inactive Power Save(IPS) : Disable RF when disconnected
+	//
+	bool				bInactivePs;
+	bool				bIPSModeBackup;
+	bool				bSwRfProcessing;
+	RT_RF_POWER_STATE	eInactivePowerState;
+	struct work_struct 	InactivePsWorkItem;
+	struct timer_list	InactivePsTimer;
+
+	// Return point for join action
+	IPS_CALLBACK_FUNCION	ReturnPoint;
+
+	// Recored Parameters for rescheduled JoinRequest
+	bool				bTmpBssDesc;
+	RT_JOIN_ACTION		tmpJoinAction;
+	struct ieee80211_network tmpBssDesc;
+
+	// Recored Parameters for rescheduled MgntLinkRequest
+	bool				bTmpScanOnly;
+	bool				bTmpActiveScan;
+	bool				bTmpFilterHiddenAP;
+	bool				bTmpUpdateParms;
+	u8					tmpSsidBuf[33];
+	OCTET_STRING			tmpSsid2Scan;
+	bool				bTmpSsid2Scan;
+	u8					tmpNetworkType;
+	u8					tmpChannelNumber;
+	u16					tmpBcnPeriod;
+	u8					tmpDtimPeriod;
+	u16					tmpmCap;
+	OCTET_STRING			tmpSuppRateSet;
+	u8					tmpSuppRateBuf[MAX_NUM_RATES];
+	bool				bTmpSuppRate;
+	IbssParms				tmpIbpm;
+	bool				bTmpIbpm;
+
+	//
+	// Leisre Poswer Save : Disable RF if connected but traffic is not busy
+	//
+	bool				bLeisurePs;
+
+}RT_POWER_SAVE_CONTROL,*PRT_POWER_SAVE_CONTROL;
+
+typedef u32 RT_RF_CHANGE_SOURCE;
+#define RF_CHANGE_BY_SW BIT31
+#define RF_CHANGE_BY_HW BIT30
+#define RF_CHANGE_BY_PS BIT29
+#define RF_CHANGE_BY_IPS BIT28
+#define RF_CHANGE_BY_INIT	0	// Do not change the RFOff reason. Defined by Bruce, 2008-01-17.
+
+#ifdef ENABLE_DOT11D
+typedef enum
+{
+	COUNTRY_CODE_FCC = 0,
+	COUNTRY_CODE_IC = 1,
+	COUNTRY_CODE_ETSI = 2,
+	COUNTRY_CODE_SPAIN = 3,
+	COUNTRY_CODE_FRANCE = 4,
+	COUNTRY_CODE_MKK = 5,
+	COUNTRY_CODE_MKK1 = 6,
+	COUNTRY_CODE_ISRAEL = 7,
+	COUNTRY_CODE_TELEC,
+	COUNTRY_CODE_MIC,
+	COUNTRY_CODE_GLOBAL_DOMAIN
+}country_code_type_t;
+#endif
+
+#define RT_MAX_LD_SLOT_NUM	10
+typedef struct _RT_LINK_DETECT_T{
+
+	u32				NumRecvBcnInPeriod;
+	u32				NumRecvDataInPeriod;
+
+	u32				RxBcnNum[RT_MAX_LD_SLOT_NUM];	// number of Rx beacon / CheckForHang_period  to determine link status
+	u32				RxDataNum[RT_MAX_LD_SLOT_NUM];	// number of Rx data / CheckForHang_period  to determine link status
+	u16				SlotNum;	// number of CheckForHang period to determine link status
+	u16				SlotIndex;
+
+	u32				NumTxOkInPeriod;
+	u32				NumRxOkInPeriod;
+	bool				bBusyTraffic;
+}RT_LINK_DETECT_T, *PRT_LINK_DETECT_T;
+
+
+struct ieee80211_device {
+	struct net_device *dev;
+	struct ieee80211_security sec;
+
+	//hw security related
+//	u8 hwsec_support; //support?
+	u8 hwsec_active;  //hw security active.
+	bool is_silent_reset;
+	bool ieee_up;
+	//added by amy
+	bool bSupportRemoteWakeUp;
+	RT_PS_MODE	dot11PowerSaveMode; // Power save mode configured.
+	bool actscanning;
+	bool beinretry;
+	RT_RF_POWER_STATE		eRFPowerState;
+	RT_RF_CHANGE_SOURCE	RfOffReason;
+	bool is_set_key;
+	//11n spec related I wonder if These info structure need to be moved out of ieee80211_device
+
+	//11n HT below
+	PRT_HIGH_THROUGHPUT	pHTInfo;
+	//struct timer_list		SwBwTimer;
+//	spinlock_t chnlop_spinlock;
+	spinlock_t bw_spinlock;
+
+	spinlock_t reorder_spinlock;
+	// for HT operation rate set.  we use this one for HT data rate to seperate different descriptors
+	//the way fill this is the same as in the IE
+	u8	Regdot11HTOperationalRateSet[16];		//use RATR format
+	u8	dot11HTOperationalRateSet[16];		//use RATR format
+	u8	RegHTSuppRateSet[16];
+	u8				HTCurrentOperaRate;
+	u8				HTHighestOperaRate;
+	//wb added for rate operation mode to firmware
+	u8	bTxDisableRateFallBack;
+	u8 	bTxUseDriverAssingedRate;
+	atomic_t	atm_chnlop;
+	atomic_t	atm_swbw;
+//	u8	HTHighestOperaRate;
+//	u8 	HTCurrentOperaRate;
+
+	// 802.11e and WMM Traffic Stream Info (TX)
+	struct list_head		Tx_TS_Admit_List;
+	struct list_head		Tx_TS_Pending_List;
+	struct list_head		Tx_TS_Unused_List;
+	TX_TS_RECORD		TxTsRecord[TOTAL_TS_NUM];
+	// 802.11e and WMM Traffic Stream Info (RX)
+	struct list_head		Rx_TS_Admit_List;
+	struct list_head		Rx_TS_Pending_List;
+	struct list_head		Rx_TS_Unused_List;
+	RX_TS_RECORD		RxTsRecord[TOTAL_TS_NUM];
+//#ifdef TO_DO_LIST
+	RX_REORDER_ENTRY	RxReorderEntry[128];
+	struct list_head		RxReorder_Unused_List;
+//#endif
+	// Qos related. Added by Annie, 2005-11-01.
+//	PSTA_QOS			pStaQos;
+	u8				ForcedPriority;		// Force per-packet priority 1~7. (default: 0, not to force it.)
+
+
+	/* Bookkeeping structures */
+	struct net_device_stats stats;
+	struct ieee80211_stats ieee_stats;
+	struct ieee80211_softmac_stats softmac_stats;
+
+	/* Probe / Beacon management */
+	struct list_head network_free_list;
+	struct list_head network_list;
+	struct ieee80211_network *networks;
+	int scans;
+	int scan_age;
+
+	int iw_mode; /* operating mode (IW_MODE_*) */
+	struct iw_spy_data spy_data;
+
+	spinlock_t lock;
+	spinlock_t wpax_suitlist_lock;
+
+	int tx_headroom; /* Set to size of any additional room needed at front
+			  * of allocated Tx SKBs */
+	u32 config;
+
+	/* WEP and other encryption related settings at the device level */
+	int open_wep; /* Set to 1 to allow unencrypted frames */
+	int auth_mode;
+	int reset_on_keychange; /* Set to 1 if the HW needs to be reset on
+				 * WEP key changes */
+
+	/* If the host performs {en,de}cryption, then set to 1 */
+	int host_encrypt;
+	int host_encrypt_msdu;
+	int host_decrypt;
+	/* host performs multicast decryption */
+	int host_mc_decrypt;
+
+	/* host should strip IV and ICV from protected frames */
+	/* meaningful only when hardware decryption is being used */
+	int host_strip_iv_icv;
+
+	int host_open_frag;
+	int host_build_iv;
+	int ieee802_1x; /* is IEEE 802.1X used */
+
+	/* WPA data */
+	bool bHalfWirelessN24GMode;
+	int wpa_enabled;
+	int drop_unencrypted;
+	int tkip_countermeasures;
+	int privacy_invoked;
+	size_t wpa_ie_len;
+	u8 *wpa_ie;
+	u8 ap_mac_addr[6];
+	u16 pairwise_key_type;
+	u16 group_key_type;
+	struct list_head crypt_deinit_list;
+	struct ieee80211_crypt_data *crypt[WEP_KEYS];
+	int tx_keyidx; /* default TX key index (crypt[tx_keyidx]) */
+	struct timer_list crypt_deinit_timer;
+	int crypt_quiesced;
+
+	int bcrx_sta_key; /* use individual keys to override default keys even
+			   * with RX of broad/multicast frames */
+
+	/* Fragmentation structures */
+	// each streaming contain a entry
+	struct ieee80211_frag_entry frag_cache[17][IEEE80211_FRAG_CACHE_LEN];
+	unsigned int frag_next_idx[17];
+	u16 fts; /* Fragmentation Threshold */
+#define DEFAULT_RTS_THRESHOLD 2346U
+#define MIN_RTS_THRESHOLD 1
+#define MAX_RTS_THRESHOLD 2346U
+	u16 rts; /* RTS threshold */
+
+	/* Association info */
+	u8 bssid[ETH_ALEN];
+
+	/* This stores infos for the current network.
+	 * Either the network we are associated in INFRASTRUCTURE
+	 * or the network that we are creating in MASTER mode.
+	 * ad-hoc is a mixture ;-).
+	 * Note that in infrastructure mode, even when not associated,
+	 * fields bssid and essid may be valid (if wpa_set and essid_set
+	 * are true) as thy carry the value set by the user via iwconfig
+	 */
+	struct ieee80211_network current_network;
+
+	enum ieee80211_state state;
+
+	int short_slot;
+	int reg_mode;
+	int mode;       /* A, B, G */
+	int modulation; /* CCK, OFDM */
+	int freq_band;  /* 2.4Ghz, 5.2Ghz, Mixed */
+	int abg_true;   /* ABG flag              */
+
+	/* used for forcing the ibss workqueue to terminate
+	 * without wait for the syncro scan to terminate
+	 */
+	short sync_scan_hurryup;
+
+	int perfect_rssi;
+	int worst_rssi;
+
+	u16 prev_seq_ctl;       /* used to drop duplicate frames */
+
+	/* map of allowed channels. 0 is dummy */
+	// FIXME: remeber to default to a basic channel plan depending of the PHY type
+#ifdef ENABLE_DOT11D
+	void* pDot11dInfo;
+	bool bGlobalDomain;
+#else
+	int channel_map[MAX_CHANNEL_NUMBER+1];
+#endif
+	int rate;       /* current rate */
+	int basic_rate;
+	//FIXME: pleace callback, see if redundant with softmac_features
+	short active_scan;
+
+	/* this contains flags for selectively enable softmac support */
+	u16 softmac_features;
+
+	/* if the sequence control field is not filled by HW */
+	u16 seq_ctrl[5];
+
+	/* association procedure transaction sequence number */
+	u16 associate_seq;
+
+	/* AID for RTXed association responses */
+	u16 assoc_id;
+
+	/* power save mode related*/
+	short ps;
+	short sta_sleep;
+	int ps_timeout;
+	int ps_period;
+	struct tasklet_struct ps_task;
+	u32 ps_th;
+	u32 ps_tl;
+
+	short raw_tx;
+	/* used if IEEE_SOFTMAC_TX_QUEUE is set */
+	short queue_stop;
+	short scanning;
+	short proto_started;
+
+	struct semaphore wx_sem;
+	struct semaphore scan_sem;
+
+	spinlock_t mgmt_tx_lock;
+	spinlock_t beacon_lock;
+
+	short beacon_txing;
+
+	short wap_set;
+	short ssid_set;
+
+	u8  wpax_type_set;    //{added by David, 2006.9.28}
+	u32 wpax_type_notify; //{added by David, 2006.9.26}
+
+	/* QoS related flag */
+	char init_wmmparam_flag;
+	/* set on initialization */
+	u8  qos_support;
+
+	/* for discarding duplicated packets in IBSS */
+	struct list_head ibss_mac_hash[IEEE_IBSS_MAC_HASH_SIZE];
+
+	/* for discarding duplicated packets in BSS */
+	u16 last_rxseq_num[17]; /* rx seq previous per-tid */
+	u16 last_rxfrag_num[17];/* tx frag previous per-tid */
+	unsigned long last_packet_time[17];
+
+	/* for PS mode */
+	unsigned long last_rx_ps_time;
+
+	/* used if IEEE_SOFTMAC_SINGLE_QUEUE is set */
+	struct sk_buff *mgmt_queue_ring[MGMT_QUEUE_NUM];
+	int mgmt_queue_head;
+	int mgmt_queue_tail;
+//{ added for rtl819x
+#define IEEE80211_QUEUE_LIMIT 128
+	u8 AsocRetryCount;
+	unsigned int hw_header;
+	struct sk_buff_head skb_waitQ[MAX_QUEUE_SIZE];
+	struct sk_buff_head  skb_aggQ[MAX_QUEUE_SIZE];
+	struct sk_buff_head  skb_drv_aggQ[MAX_QUEUE_SIZE];
+	u32	sta_edca_param[4];
+	bool aggregation;
+	// Enable/Disable Rx immediate BA capability.
+	bool enable_rx_imm_BA;
+	bool bibsscoordinator;
+
+	//+by amy for DM ,080515
+	//Dynamic Tx power for near/far range enable/Disable  , by amy , 2008-05-15
+	bool	bdynamic_txpower_enable;
+
+	bool bCTSToSelfEnable;
+	u8 	CTSToSelfTH;
+
+	u32 	fsync_time_interval;
+	u32	fsync_rate_bitmap;
+	u8	fsync_rssi_threshold;
+	bool	bfsync_enable;
+
+	u8	fsync_multiple_timeinterval;		// FsyncMultipleTimeInterval * FsyncTimeInterval
+	u32	fsync_firstdiff_ratethreshold;		// low threshold
+	u32	fsync_seconddiff_ratethreshold;	 // decrease threshold
+	Fsync_State			fsync_state;
+	bool		bis_any_nonbepkts;
+	//20Mhz 40Mhz AutoSwitch Threshold
+	bandwidth_autoswitch bandwidth_auto_switch;
+	//for txpower tracking
+	bool FwRWRF;
+
+	//added by amy for AP roaming
+	RT_LINK_DETECT_T	LinkDetectInfo;
+	//added by amy for ps
+	RT_POWER_SAVE_CONTROL	PowerSaveControl;
+//}
+	/* used if IEEE_SOFTMAC_TX_QUEUE is set */
+	struct  tx_pending_t tx_pending;
+
+	/* used if IEEE_SOFTMAC_ASSOCIATE is set */
+	struct timer_list associate_timer;
+
+	/* used if IEEE_SOFTMAC_BEACONS is set */
+	struct timer_list beacon_timer;
+	struct work_struct associate_complete_wq;
+	struct work_struct associate_procedure_wq;
+	struct delayed_work softmac_scan_wq;
+	struct delayed_work associate_retry_wq;
+	 struct delayed_work start_ibss_wq;
+	struct work_struct wx_sync_scan_wq;
+	struct workqueue_struct *wq;
+	// Qos related. Added by Annie, 2005-11-01.
+	//STA_QOS  StaQos;
+
+	//u32 STA_EDCA_PARAM[4];
+	//CHANNEL_ACCESS_SETTING ChannelAccessSetting;
+
+
+	/* Callback functions */
+	void (*set_security)(struct net_device *dev,
+			     struct ieee80211_security *sec);
+
+	/* Used to TX data frame by using txb structs.
+	 * this is not used if in the softmac_features
+	 * is set the flag IEEE_SOFTMAC_TX_QUEUE
+	 */
+	int (*hard_start_xmit)(struct ieee80211_txb *txb,
+			       struct net_device *dev);
+
+	int (*reset_port)(struct net_device *dev);
+	int (*is_queue_full) (struct net_device * dev, int pri);
+
+	int (*handle_management) (struct net_device * dev,
+				  struct ieee80211_network * network, u16 type);
+	int (*is_qos_active) (struct net_device *dev, struct sk_buff *skb);
+
+	/* Softmac-generated frames (mamagement) are TXed via this
+	 * callback if the flag IEEE_SOFTMAC_SINGLE_QUEUE is
+	 * not set. As some cards may have different HW queues that
+	 * one might want to use for data and management frames
+	 * the option to have two callbacks might be useful.
+	 * This fucntion can't sleep.
+	 */
+	int (*softmac_hard_start_xmit)(struct sk_buff *skb,
+			       struct net_device *dev);
+
+	/* used instead of hard_start_xmit (not softmac_hard_start_xmit)
+	 * if the IEEE_SOFTMAC_TX_QUEUE feature is used to TX data
+	 * frames. I the option IEEE_SOFTMAC_SINGLE_QUEUE is also set
+	 * then also management frames are sent via this callback.
+	 * This function can't sleep.
+	 */
+	void (*softmac_data_hard_start_xmit)(struct sk_buff *skb,
+			       struct net_device *dev,int rate);
+
+	/* stops the HW queue for DATA frames. Useful to avoid
+	 * waste time to TX data frame when we are reassociating
+	 * This function can sleep.
+	 */
+	void (*data_hard_stop)(struct net_device *dev);
+
+	/* OK this is complementar to data_poll_hard_stop */
+	void (*data_hard_resume)(struct net_device *dev);
+
+	/* ask to the driver to retune the radio .
+	 * This function can sleep. the driver should ensure
+	 * the radio has been swithced before return.
+	 */
+	void (*set_chan)(struct net_device *dev,short ch);
+
+	/* These are not used if the ieee stack takes care of
+	 * scanning (IEEE_SOFTMAC_SCAN feature set).
+	 * In this case only the set_chan is used.
+	 *
+	 * The syncro version is similar to the start_scan but
+	 * does not return until all channels has been scanned.
+	 * this is called in user context and should sleep,
+	 * it is called in a work_queue when swithcing to ad-hoc mode
+	 * or in behalf of iwlist scan when the card is associated
+	 * and root user ask for a scan.
+	 * the fucntion stop_scan should stop both the syncro and
+	 * background scanning and can sleep.
+	 * The fucntion start_scan should initiate the background
+	 * scanning and can't sleep.
+	 */
+	void (*scan_syncro)(struct net_device *dev);
+	void (*start_scan)(struct net_device *dev);
+	void (*stop_scan)(struct net_device *dev);
+
+	/* indicate the driver that the link state is changed
+	 * for example it may indicate the card is associated now.
+	 * Driver might be interested in this to apply RX filter
+	 * rules or simply light the LINK led
+	 */
+	void (*link_change)(struct net_device *dev);
+
+	/* these two function indicates to the HW when to start
+	 * and stop to send beacons. This is used when the
+	 * IEEE_SOFTMAC_BEACONS is not set. For now the
+	 * stop_send_bacons is NOT guaranteed to be called only
+	 * after start_send_beacons.
+	 */
+	void (*start_send_beacons) (struct net_device *dev,u16 tx_rate);
+	void (*stop_send_beacons) (struct net_device *dev);
+
+	/* power save mode related */
+	void (*sta_wake_up) (struct net_device *dev);
+	void (*ps_request_tx_ack) (struct net_device *dev);
+	void (*enter_sleep_state) (struct net_device *dev, u32 th, u32 tl);
+	short (*ps_is_queue_empty) (struct net_device *dev);
+	int (*handle_beacon) (struct net_device * dev, struct ieee80211_beacon * beacon, struct ieee80211_network * network);
+	int (*handle_assoc_response) (struct net_device * dev, struct ieee80211_assoc_response_frame * resp, struct ieee80211_network * network);
+
+
+	/* check whether Tx hw resouce available */
+	short (*check_nic_enough_desc)(struct net_device *dev, int queue_index);
+	//added by wb for HT related
+//	void (*SwChnlByTimerHandler)(struct net_device *dev, int channel);
+	void (*SetBWModeHandler)(struct net_device *dev, HT_CHANNEL_WIDTH Bandwidth, HT_EXTCHNL_OFFSET Offset);
+//	void (*UpdateHalRATRTableHandler)(struct net_device* dev, u8* pMcsRate);
+	bool (*GetNmodeSupportBySecCfg)(struct net_device* dev);
+	void (*SetWirelessMode)(struct net_device* dev, u8 wireless_mode);
+	bool (*GetHalfNmodeSupportByAPsHandler)(struct net_device* dev);
+	void (*InitialGainHandler)(struct net_device *dev, u8 Operation);
+
+	/* This must be the last item so that it points to the data
+	 * allocated beyond this structure by alloc_ieee80211 */
+	u8 priv[0];
+};
+
+#define IEEE_A            (1<<0)
+#define IEEE_B            (1<<1)
+#define IEEE_G            (1<<2)
+#define IEEE_N_24G 		  (1<<4)
+#define	IEEE_N_5G		  (1<<5)
+#define IEEE_MODE_MASK    (IEEE_A|IEEE_B|IEEE_G)
+
+/* Generate a 802.11 header */
+
+/* Uses the channel change callback directly
+ * instead of [start/stop] scan callbacks
+ */
+#define IEEE_SOFTMAC_SCAN (1<<2)
+
+/* Perform authentication and association handshake */
+#define IEEE_SOFTMAC_ASSOCIATE (1<<3)
+
+/* Generate probe requests */
+#define IEEE_SOFTMAC_PROBERQ (1<<4)
+
+/* Generate respones to probe requests */
+#define IEEE_SOFTMAC_PROBERS (1<<5)
+
+/* The ieee802.11 stack will manages the netif queue
+ * wake/stop for the driver, taking care of 802.11
+ * fragmentation. See softmac.c for details. */
+#define IEEE_SOFTMAC_TX_QUEUE (1<<7)
+
+/* Uses only the softmac_data_hard_start_xmit
+ * even for TX management frames.
+ */
+#define IEEE_SOFTMAC_SINGLE_QUEUE (1<<8)
+
+/* Generate beacons.  The stack will enqueue beacons
+ * to the card
+ */
+#define IEEE_SOFTMAC_BEACONS (1<<6)
+
+static inline void *ieee80211_priv(struct net_device *dev)
+{
+	return ((struct ieee80211_device *)netdev_priv(dev))->priv;
+}
+
+extern inline int ieee80211_is_empty_essid(const char *essid, int essid_len)
+{
+	/* Single white space is for Linksys APs */
+	if (essid_len == 1 && essid[0] == ' ')
+		return 1;
+
+	/* Otherwise, if the entire essid is 0, we assume it is hidden */
+	while (essid_len) {
+		essid_len--;
+		if (essid[essid_len] != '\0')
+			return 0;
+	}
+
+	return 1;
+}
+
+extern inline int ieee80211_is_valid_mode(struct ieee80211_device *ieee, int mode)
+{
+	/*
+	 * It is possible for both access points and our device to support
+	 * combinations of modes, so as long as there is one valid combination
+	 * of ap/device supported modes, then return success
+	 *
+	 */
+	if ((mode & IEEE_A) &&
+	    (ieee->modulation & IEEE80211_OFDM_MODULATION) &&
+	    (ieee->freq_band & IEEE80211_52GHZ_BAND))
+		return 1;
+
+	if ((mode & IEEE_G) &&
+	    (ieee->modulation & IEEE80211_OFDM_MODULATION) &&
+	    (ieee->freq_band & IEEE80211_24GHZ_BAND))
+		return 1;
+
+	if ((mode & IEEE_B) &&
+	    (ieee->modulation & IEEE80211_CCK_MODULATION) &&
+	    (ieee->freq_band & IEEE80211_24GHZ_BAND))
+		return 1;
+
+	return 0;
+}
+
+extern inline int ieee80211_get_hdrlen(u16 fc)
+{
+	int hdrlen = IEEE80211_3ADDR_LEN;
+
+	switch (WLAN_FC_GET_TYPE(fc)) {
+	case IEEE80211_FTYPE_DATA:
+		if ((fc & IEEE80211_FCTL_FROMDS) && (fc & IEEE80211_FCTL_TODS))
+			hdrlen = IEEE80211_4ADDR_LEN; /* Addr4 */
+		if(IEEE80211_QOS_HAS_SEQ(fc))
+			hdrlen += 2; /* QOS ctrl*/
+		break;
+	case IEEE80211_FTYPE_CTL:
+		switch (WLAN_FC_GET_STYPE(fc)) {
+		case IEEE80211_STYPE_CTS:
+		case IEEE80211_STYPE_ACK:
+			hdrlen = IEEE80211_1ADDR_LEN;
+			break;
+		default:
+			hdrlen = IEEE80211_2ADDR_LEN;
+			break;
+		}
+		break;
+	}
+
+	return hdrlen;
+}
+
+static inline u8 *ieee80211_get_payload(struct ieee80211_hdr *hdr)
+{
+	switch (ieee80211_get_hdrlen(le16_to_cpu(hdr->frame_ctl))) {
+	case IEEE80211_1ADDR_LEN:
+		return ((struct ieee80211_hdr_1addr *)hdr)->payload;
+	case IEEE80211_2ADDR_LEN:
+		return ((struct ieee80211_hdr_2addr *)hdr)->payload;
+	case IEEE80211_3ADDR_LEN:
+		return ((struct ieee80211_hdr_3addr *)hdr)->payload;
+	case IEEE80211_4ADDR_LEN:
+		return ((struct ieee80211_hdr_4addr *)hdr)->payload;
+	}
+	return NULL;
+}
+
+static inline int ieee80211_is_ofdm_rate(u8 rate)
+{
+	switch (rate & ~IEEE80211_BASIC_RATE_MASK) {
+	case IEEE80211_OFDM_RATE_6MB:
+	case IEEE80211_OFDM_RATE_9MB:
+	case IEEE80211_OFDM_RATE_12MB:
+	case IEEE80211_OFDM_RATE_18MB:
+	case IEEE80211_OFDM_RATE_24MB:
+	case IEEE80211_OFDM_RATE_36MB:
+	case IEEE80211_OFDM_RATE_48MB:
+	case IEEE80211_OFDM_RATE_54MB:
+		return 1;
+	}
+	return 0;
+}
+
+static inline int ieee80211_is_cck_rate(u8 rate)
+{
+	switch (rate & ~IEEE80211_BASIC_RATE_MASK) {
+	case IEEE80211_CCK_RATE_1MB:
+	case IEEE80211_CCK_RATE_2MB:
+	case IEEE80211_CCK_RATE_5MB:
+	case IEEE80211_CCK_RATE_11MB:
+		return 1;
+	}
+	return 0;
+}
+
+
+/* ieee80211.c */
+extern void free_ieee80211(struct net_device *dev);
+extern struct net_device *alloc_ieee80211(int sizeof_priv);
+
+extern int ieee80211_set_encryption(struct ieee80211_device *ieee);
+
+/* ieee80211_tx.c */
+
+extern int ieee80211_encrypt_fragment(
+	struct ieee80211_device *ieee,
+	struct sk_buff *frag,
+	int hdr_len);
+
+extern int ieee80211_xmit(struct sk_buff *skb,
+			  struct net_device *dev);
+extern void ieee80211_txb_free(struct ieee80211_txb *);
+
+
+/* ieee80211_rx.c */
+extern int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
+			struct ieee80211_rx_stats *rx_stats);
+extern void ieee80211_rx_mgt(struct ieee80211_device *ieee,
+			     struct ieee80211_hdr_4addr *header,
+			     struct ieee80211_rx_stats *stats);
+
+/* ieee80211_wx.c */
+extern int ieee80211_wx_get_scan(struct ieee80211_device *ieee,
+				 struct iw_request_info *info,
+				 union iwreq_data *wrqu, char *key);
+extern int ieee80211_wx_set_encode(struct ieee80211_device *ieee,
+				   struct iw_request_info *info,
+				   union iwreq_data *wrqu, char *key);
+extern int ieee80211_wx_get_encode(struct ieee80211_device *ieee,
+				   struct iw_request_info *info,
+				   union iwreq_data *wrqu, char *key);
+#if WIRELESS_EXT >= 18
+extern int ieee80211_wx_get_encode_ext(struct ieee80211_device *ieee,
+			    struct iw_request_info *info,
+			    union iwreq_data* wrqu, char *extra);
+extern int ieee80211_wx_set_encode_ext(struct ieee80211_device *ieee,
+			    struct iw_request_info *info,
+			    union iwreq_data* wrqu, char *extra);
+extern int ieee80211_wx_set_auth(struct ieee80211_device *ieee,
+			       struct iw_request_info *info,
+			       struct iw_param *data, char *extra);
+extern int ieee80211_wx_set_mlme(struct ieee80211_device *ieee,
+			       struct iw_request_info *info,
+			       union iwreq_data *wrqu, char *extra);
+#endif
+extern int ieee80211_wx_set_gen_ie(struct ieee80211_device *ieee, u8 *ie, size_t len);
+
+/* ieee80211_softmac.c */
+extern short ieee80211_is_54g(struct ieee80211_network net);
+extern short ieee80211_is_shortslot(struct ieee80211_network net);
+extern int ieee80211_rx_frame_softmac(struct ieee80211_device *ieee, struct sk_buff *skb,
+			struct ieee80211_rx_stats *rx_stats, u16 type,
+			u16 stype);
+extern void ieee80211_softmac_new_net(struct ieee80211_device *ieee, struct ieee80211_network *net);
+
+void SendDisassociation(struct ieee80211_device *ieee, u8* asSta, u8 asRsn);
+extern void ieee80211_softmac_xmit(struct ieee80211_txb *txb, struct ieee80211_device *ieee);
+
+extern void ieee80211_stop_send_beacons(struct ieee80211_device *ieee);
+extern void notify_wx_assoc_event(struct ieee80211_device *ieee);
+extern void ieee80211_softmac_check_all_nets(struct ieee80211_device *ieee);
+extern void ieee80211_start_bss(struct ieee80211_device *ieee);
+extern void ieee80211_start_master_bss(struct ieee80211_device *ieee);
+extern void ieee80211_start_ibss(struct ieee80211_device *ieee);
+extern void ieee80211_softmac_init(struct ieee80211_device *ieee);
+extern void ieee80211_softmac_free(struct ieee80211_device *ieee);
+extern void ieee80211_associate_abort(struct ieee80211_device *ieee);
+extern void ieee80211_disassociate(struct ieee80211_device *ieee);
+extern void ieee80211_stop_scan(struct ieee80211_device *ieee);
+extern void ieee80211_start_scan_syncro(struct ieee80211_device *ieee);
+extern void ieee80211_check_all_nets(struct ieee80211_device *ieee);
+extern void ieee80211_start_protocol(struct ieee80211_device *ieee);
+extern void ieee80211_stop_protocol(struct ieee80211_device *ieee);
+extern void ieee80211_softmac_start_protocol(struct ieee80211_device *ieee);
+extern void ieee80211_softmac_stop_protocol(struct ieee80211_device *ieee);
+extern void ieee80211_reset_queue(struct ieee80211_device *ieee);
+extern void ieee80211_wake_queue(struct ieee80211_device *ieee);
+extern void ieee80211_stop_queue(struct ieee80211_device *ieee);
+extern struct sk_buff *ieee80211_get_beacon(struct ieee80211_device *ieee);
+extern void ieee80211_start_send_beacons(struct ieee80211_device *ieee);
+extern void ieee80211_stop_send_beacons(struct ieee80211_device *ieee);
+extern int ieee80211_wpa_supplicant_ioctl(struct ieee80211_device *ieee, struct iw_point *p);
+extern void notify_wx_assoc_event(struct ieee80211_device *ieee);
+extern void ieee80211_ps_tx_ack(struct ieee80211_device *ieee, short success);
+
+extern void softmac_mgmt_xmit(struct sk_buff *skb, struct ieee80211_device *ieee);
+
+/* ieee80211_crypt_ccmp&tkip&wep.c */
+extern void ieee80211_tkip_null(void);
+extern void ieee80211_wep_null(void);
+extern void ieee80211_ccmp_null(void);
+
+/* ieee80211_softmac_wx.c */
+
+extern int ieee80211_wx_get_wap(struct ieee80211_device *ieee,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu, char *ext);
+
+extern int ieee80211_wx_set_wap(struct ieee80211_device *ieee,
+			 struct iw_request_info *info,
+			 union iwreq_data *awrq,
+			 char *extra);
+
+extern int ieee80211_wx_get_essid(struct ieee80211_device *ieee, struct iw_request_info *a,union iwreq_data *wrqu,char *b);
+
+extern int ieee80211_wx_set_rate(struct ieee80211_device *ieee,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra);
+
+extern int ieee80211_wx_get_rate(struct ieee80211_device *ieee,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra);
+
+extern int ieee80211_wx_set_mode(struct ieee80211_device *ieee, struct iw_request_info *a,
+			     union iwreq_data *wrqu, char *b);
+
+extern int ieee80211_wx_set_scan(struct ieee80211_device *ieee, struct iw_request_info *a,
+			     union iwreq_data *wrqu, char *b);
+
+extern int ieee80211_wx_set_essid(struct ieee80211_device *ieee,
+			      struct iw_request_info *a,
+			      union iwreq_data *wrqu, char *extra);
+
+extern int ieee80211_wx_get_mode(struct ieee80211_device *ieee, struct iw_request_info *a,
+			     union iwreq_data *wrqu, char *b);
+
+extern int ieee80211_wx_set_freq(struct ieee80211_device *ieee, struct iw_request_info *a,
+			     union iwreq_data *wrqu, char *b);
+
+extern int ieee80211_wx_get_freq(struct ieee80211_device *ieee, struct iw_request_info *a,
+			     union iwreq_data *wrqu, char *b);
+
+//extern void ieee80211_wx_sync_scan_wq(struct ieee80211_device *ieee);
+extern void ieee80211_wx_sync_scan_wq(struct work_struct *work);
+
+
+extern int ieee80211_wx_set_rawtx(struct ieee80211_device *ieee,
+			       struct iw_request_info *info,
+			       union iwreq_data *wrqu, char *extra);
+
+extern int ieee80211_wx_get_name(struct ieee80211_device *ieee,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra);
+
+extern int ieee80211_wx_set_power(struct ieee80211_device *ieee,
+				 struct iw_request_info *info,
+				 union iwreq_data *wrqu, char *extra);
+
+extern int ieee80211_wx_get_power(struct ieee80211_device *ieee,
+				 struct iw_request_info *info,
+				 union iwreq_data *wrqu, char *extra);
+
+extern int ieee80211_wx_set_rts(struct ieee80211_device *ieee,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra);
+
+extern int ieee80211_wx_get_rts(struct ieee80211_device *ieee,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra);
+//HT
+#define MAX_RECEIVE_BUFFER_SIZE 9100  //
+extern void HTDebugHTCapability(u8* CapIE, u8* TitleString );
+extern void HTDebugHTInfo(u8*  InfoIE, u8* TitleString);
+
+void HTSetConnectBwMode(struct ieee80211_device* ieee, HT_CHANNEL_WIDTH Bandwidth, HT_EXTCHNL_OFFSET    Offset);
+extern void HTUpdateDefaultSetting(struct ieee80211_device* ieee);
+extern void HTConstructCapabilityElement(struct ieee80211_device* ieee, u8* posHTCap, u8* len, u8 isEncrypt);
+extern void HTConstructInfoElement(struct ieee80211_device* ieee, u8* posHTInfo, u8* len, u8 isEncrypt);
+extern void HTConstructRT2RTAggElement(struct ieee80211_device* ieee, u8* posRT2RTAgg, u8* len);
+extern void HTOnAssocRsp(struct ieee80211_device *ieee);
+extern void HTInitializeHTInfo(struct ieee80211_device* ieee);
+extern void HTInitializeBssDesc(PBSS_HT pBssHT);
+extern void HTResetSelfAndSavePeerSetting(struct ieee80211_device* ieee, struct ieee80211_network * pNetwork);
+extern void HTUpdateSelfAndPeerSetting(struct ieee80211_device* ieee,   struct ieee80211_network * pNetwork);
+extern u8 HTGetHighestMCSRate(struct ieee80211_device* ieee, u8* pMCSRateSet, u8* pMCSFilter);
+extern u8 MCS_FILTER_ALL[];
+extern u16 MCS_DATA_RATE[2][2][77] ;
+extern u8 HTCCheck(struct ieee80211_device* ieee, u8*   pFrame);
+//extern void HTSetConnectBwModeCallback(unsigned long data);
+extern void HTResetIOTSetting(PRT_HIGH_THROUGHPUT  pHTInfo);
+extern bool IsHTHalfNmodeAPs(struct ieee80211_device* ieee);
+extern u16 HTHalfMcsToDataRate(struct ieee80211_device* ieee,  u8      nMcsRate);
+extern u16 HTMcsToDataRate( struct ieee80211_device* ieee, u8 nMcsRate);
+extern u16  TxCountToDataRate( struct ieee80211_device* ieee, u8 nDataRate);
+//function in BAPROC.c
+extern int ieee80211_rx_ADDBAReq( struct ieee80211_device* ieee, struct sk_buff *skb);
+extern int ieee80211_rx_ADDBARsp( struct ieee80211_device* ieee, struct sk_buff *skb);
+extern int ieee80211_rx_DELBA(struct ieee80211_device* ieee,struct sk_buff *skb);
+extern void TsInitAddBA( struct ieee80211_device* ieee, PTX_TS_RECORD   pTS, u8 Policy, u8 bOverwritePending);
+extern void TsInitDelBA( struct ieee80211_device* ieee, PTS_COMMON_INFO pTsCommonInfo, TR_SELECT TxRxSelect);
+extern void BaSetupTimeOut(unsigned long data);
+extern void TxBaInactTimeout(unsigned long data);
+extern void RxBaInactTimeout(unsigned long data);
+extern void ResetBaEntry( PBA_RECORD pBA);
+//function in TS.c
+extern bool GetTs(
+	struct ieee80211_device*        ieee,
+	PTS_COMMON_INFO                 *ppTS,
+	u8*                             Addr,
+	u8                              TID,
+	TR_SELECT                       TxRxSelect,  //Rx:1, Tx:0
+	bool                            bAddNewTs
+	);
+extern void TSInitialize(struct ieee80211_device *ieee);
+extern  void TsStartAddBaProcess(struct ieee80211_device* ieee, PTX_TS_RECORD   pTxTS);
+extern void RemovePeerTS(struct ieee80211_device* ieee, u8* Addr);
+extern void RemoveAllTS(struct ieee80211_device* ieee);
+void ieee80211_softmac_scan_syncro(struct ieee80211_device *ieee);
+
+extern const long ieee80211_wlan_frequencies[];
+
+extern inline void ieee80211_increment_scans(struct ieee80211_device *ieee)
+{
+	ieee->scans++;
+}
+
+extern inline int ieee80211_get_scans(struct ieee80211_device *ieee)
+{
+	return ieee->scans;
+}
+
+static inline const char *escape_essid(const char *essid, u8 essid_len) {
+	static char escaped[IW_ESSID_MAX_SIZE * 2 + 1];
+	const char *s = essid;
+	char *d = escaped;
+
+	if (ieee80211_is_empty_essid(essid, essid_len)) {
+		memcpy(escaped, "<hidden>", sizeof("<hidden>"));
+		return escaped;
+	}
+
+	essid_len = min(essid_len, (u8)IW_ESSID_MAX_SIZE);
+	while (essid_len--) {
+		if (*s == '\0') {
+			*d++ = '\\';
+			*d++ = '0';
+			s++;
+		} else {
+			*d++ = *s++;
+		}
+	}
+	*d = '\0';
+	return escaped;
+}
+
+/* For the function is more related to hardware setting, it's better to use the
+ * ieee handler to refer to it.
+ */
+extern short check_nic_enough_desc(struct net_device *dev, int queue_index);
+extern int ieee80211_data_xmit(struct sk_buff *skb, struct net_device *dev);
+extern int ieee80211_parse_info_param(struct ieee80211_device *ieee,
+		struct ieee80211_info_element *info_element,
+		u16 length,
+		struct ieee80211_network *network,
+		struct ieee80211_rx_stats *stats);
+
+void ieee80211_indicate_packets(struct ieee80211_device *ieee, struct ieee80211_rxb** prxbIndicateArray,u8  index);
+#define RT_ASOC_RETRY_LIMIT	5
+#endif /* IEEE80211_H */
diff --git a/drivers/staging/rtl8192u/ieee80211/EndianFree.h b/drivers/staging/rtl8192u/ieee80211/EndianFree.h
new file mode 100644
index 000000000000..dc85fb913dc2
--- /dev/null
+++ b/drivers/staging/rtl8192u/ieee80211/EndianFree.h
@@ -0,0 +1,194 @@
+#ifndef __INC_ENDIANFREE_H
+#define __INC_ENDIANFREE_H
+
+/*
+ *	Call endian free function when
+ *		1. Read/write packet content.
+ *		2. Before write integer to IO.
+ *		3. After read integer from IO.
+ */
+
+#define __MACHINE_LITTLE_ENDIAN 1234    /* LSB first: i386, vax */
+#define __MACHINE_BIG_ENDIAN    4321    /* MSB first: 68000, ibm, net, ppc */
+
+#define BYTE_ORDER __MACHINE_LITTLE_ENDIAN
+
+#if BYTE_ORDER == __MACHINE_LITTLE_ENDIAN
+// Convert data
+#define EF1Byte(_val)				((u8)(_val))
+#define EF2Byte(_val)				((u16)(_val))
+#define EF4Byte(_val)				((u32)(_val))
+
+#else
+// Convert data
+#define EF1Byte(_val)				((u8)(_val))
+#define EF2Byte(_val)				(((((u16)(_val))&0x00ff)<<8)|((((u16)(_val))&0xff00)>>8))
+#define EF4Byte(_val)				(((((u32)(_val))&0x000000ff)<<24)|\
+						((((u32)(_val))&0x0000ff00)<<8)|\
+						((((u32)(_val))&0x00ff0000)>>8)|\
+						((((u32)(_val))&0xff000000)>>24))
+#endif
+
+// Read data from memory
+#define ReadEF1Byte(_ptr)		EF1Byte(*((u8 *)(_ptr)))
+#define ReadEF2Byte(_ptr)		EF2Byte(*((u16 *)(_ptr)))
+#define ReadEF4Byte(_ptr)		EF4Byte(*((u32 *)(_ptr)))
+
+// Write data to memory
+#define WriteEF1Byte(_ptr, _val)	(*((u8 *)(_ptr)))=EF1Byte(_val)
+#define WriteEF2Byte(_ptr, _val)	(*((u16 *)(_ptr)))=EF2Byte(_val)
+#define WriteEF4Byte(_ptr, _val)	(*((u32 *)(_ptr)))=EF4Byte(_val)
+// Convert Host system specific byte ording (litten or big endia) to Network byte ording (big endian).
+// 2006.05.07, by rcnjko.
+#if BYTE_ORDER == __MACHINE_LITTLE_ENDIAN
+#define H2N1BYTE(_val)	((u8)(_val))
+#define H2N2BYTE(_val)	(((((u16)(_val))&0x00ff)<<8)|\
+			((((u16)(_val))&0xff00)>>8))
+#define H2N4BYTE(_val)	(((((u32)(_val))&0x000000ff)<<24)|\
+			((((u32)(_val))&0x0000ff00)<<8)	|\
+			((((u32)(_val))&0x00ff0000)>>8)	|\
+			((((u32)(_val))&0xff000000)>>24))
+#else
+#define H2N1BYTE(_val)			((u8)(_val))
+#define H2N2BYTE(_val)			((u16)(_val))
+#define H2N4BYTE(_val)			((u32)(_val))
+#endif
+
+// Convert from Network byte ording (big endian) to Host system specific byte ording (litten or big endia).
+// 2006.05.07, by rcnjko.
+#if BYTE_ORDER == __MACHINE_LITTLE_ENDIAN
+#define N2H1BYTE(_val)	((u8)(_val))
+#define N2H2BYTE(_val)	(((((u16)(_val))&0x00ff)<<8)|\
+			((((u16)(_val))&0xff00)>>8))
+#define N2H4BYTE(_val)	(((((u32)(_val))&0x000000ff)<<24)|\
+			((((u32)(_val))&0x0000ff00)<<8)	|\
+			((((u32)(_val))&0x00ff0000)>>8)	|\
+			((((u32)(_val))&0xff000000)>>24))
+#else
+#define N2H1BYTE(_val)			((u8)(_val))
+#define N2H2BYTE(_val)			((u16)(_val))
+#define N2H4BYTE(_val)			((u32)(_val))
+#endif
+
+//
+//	Example:
+//		BIT_LEN_MASK_32(0) => 0x00000000
+//		BIT_LEN_MASK_32(1) => 0x00000001
+//		BIT_LEN_MASK_32(2) => 0x00000003
+//		BIT_LEN_MASK_32(32) => 0xFFFFFFFF
+//
+#define BIT_LEN_MASK_32(__BitLen) (0xFFFFFFFF >> (32 - (__BitLen)))
+//
+//	Example:
+//		BIT_OFFSET_LEN_MASK_32(0, 2) => 0x00000003
+//		BIT_OFFSET_LEN_MASK_32(16, 2) => 0x00030000
+//
+#define BIT_OFFSET_LEN_MASK_32(__BitOffset, __BitLen) (BIT_LEN_MASK_32(__BitLen) << (__BitOffset))
+
+//
+//	Description:
+//		Return 4-byte value in host byte ordering from
+//		4-byte pointer in litten-endian system.
+//
+#define LE_P4BYTE_TO_HOST_4BYTE(__pStart) (EF4Byte(*((u32 *)(__pStart))))
+
+//
+//	Description:
+//		Translate subfield (continuous bits in little-endian) of 4-byte value in litten byte to
+//		4-byte value in host byte ordering.
+//
+#define LE_BITS_TO_4BYTE(__pStart, __BitOffset, __BitLen) \
+	( \
+	  ( LE_P4BYTE_TO_HOST_4BYTE(__pStart) >> (__BitOffset) ) \
+	  & \
+	  BIT_LEN_MASK_32(__BitLen) \
+	)
+
+//
+//	Description:
+//		Mask subfield (continuous bits in little-endian) of 4-byte value in litten byte oredering
+//		and return the result in 4-byte value in host byte ordering.
+//
+#define LE_BITS_CLEARED_TO_4BYTE(__pStart, __BitOffset, __BitLen) \
+	( \
+	  LE_P4BYTE_TO_HOST_4BYTE(__pStart) \
+	  & \
+	  ( ~BIT_OFFSET_LEN_MASK_32(__BitOffset, __BitLen) ) \
+	)
+
+//
+//	Description:
+//		Set subfield of little-endian 4-byte value to specified value.
+//
+#define SET_BITS_TO_LE_4BYTE(__pStart, __BitOffset, __BitLen, __Value) \
+	*((u32 *)(__pStart)) = \
+	EF4Byte( \
+	LE_BITS_CLEARED_TO_4BYTE(__pStart, __BitOffset, __BitLen) \
+	| \
+	( (((u32)__Value) & BIT_LEN_MASK_32(__BitLen)) << (__BitOffset) ) \
+       );
+
+
+#define BIT_LEN_MASK_16(__BitLen) \
+	(0xFFFF >> (16 - (__BitLen)))
+
+#define BIT_OFFSET_LEN_MASK_16(__BitOffset, __BitLen) \
+	(BIT_LEN_MASK_16(__BitLen) << (__BitOffset))
+
+#define LE_P2BYTE_TO_HOST_2BYTE(__pStart) \
+	(EF2Byte(*((u16 *)(__pStart))))
+
+#define LE_BITS_TO_2BYTE(__pStart, __BitOffset, __BitLen) \
+	( \
+	  ( LE_P2BYTE_TO_HOST_2BYTE(__pStart) >> (__BitOffset) ) \
+	  & \
+	  BIT_LEN_MASK_16(__BitLen) \
+	)
+
+#define LE_BITS_CLEARED_TO_2BYTE(__pStart, __BitOffset, __BitLen) \
+	( \
+	  LE_P2BYTE_TO_HOST_2BYTE(__pStart) \
+	  & \
+	  ( ~BIT_OFFSET_LEN_MASK_16(__BitOffset, __BitLen) ) \
+	)
+
+#define SET_BITS_TO_LE_2BYTE(__pStart, __BitOffset, __BitLen, __Value) \
+	*((u16 *)(__pStart)) = \
+	EF2Byte( \
+		LE_BITS_CLEARED_TO_2BYTE(__pStart, __BitOffset, __BitLen) \
+		| \
+		( (((u16)__Value) & BIT_LEN_MASK_16(__BitLen)) << (__BitOffset) ) \
+       );
+
+#define BIT_LEN_MASK_8(__BitLen) \
+	(0xFF >> (8 - (__BitLen)))
+
+#define BIT_OFFSET_LEN_MASK_8(__BitOffset, __BitLen) \
+	(BIT_LEN_MASK_8(__BitLen) << (__BitOffset))
+
+#define LE_P1BYTE_TO_HOST_1BYTE(__pStart) \
+	(EF1Byte(*((u8 *)(__pStart))))
+
+#define LE_BITS_TO_1BYTE(__pStart, __BitOffset, __BitLen) \
+	( \
+	  ( LE_P1BYTE_TO_HOST_1BYTE(__pStart) >> (__BitOffset) ) \
+	  & \
+	  BIT_LEN_MASK_8(__BitLen) \
+	)
+
+#define LE_BITS_CLEARED_TO_1BYTE(__pStart, __BitOffset, __BitLen) \
+	( \
+	  LE_P1BYTE_TO_HOST_1BYTE(__pStart) \
+	  & \
+	  ( ~BIT_OFFSET_LEN_MASK_8(__BitOffset, __BitLen) ) \
+	)
+
+#define SET_BITS_TO_LE_1BYTE(__pStart, __BitOffset, __BitLen, __Value) \
+	*((u8 *)(__pStart)) = \
+	EF1Byte( \
+		LE_BITS_CLEARED_TO_1BYTE(__pStart, __BitOffset, __BitLen) \
+		| \
+		( (((u8)__Value) & BIT_LEN_MASK_8(__BitLen)) << (__BitOffset) ) \
+       );
+
+#endif // #ifndef __INC_ENDIANFREE_H
diff --git a/drivers/staging/rtl8192u/ieee80211/Makefile b/drivers/staging/rtl8192u/ieee80211/Makefile
new file mode 100644
index 000000000000..71ca5d93a1b7
--- /dev/null
+++ b/drivers/staging/rtl8192u/ieee80211/Makefile
@@ -0,0 +1,139 @@
+NIC_SELECT = RTL8192U
+
+KVER  := $(shell uname -r)
+MODDESTDIR := /lib/modules/$(KVER)/kernel/drivers/net/wireless/$(NIC_SELECT)
+
+CC = gcc
+ifneq ($(shell uname -r|cut -d. -f1,2), 2.4)
+EXTRA_CFLAGS += -I$(TOPDIR)/drivers/net/wireless
+EXTRA_CFLAGS += -O2
+EXTRA_CFLAGS += -DJACKSON_NEW_8187 -DJACKSON_NEW_RX
+
+#it will fail to compile in suse linux enterprise 10 sp2. This flag is to solve this problem.
+ifeq ($(shell uname -r | cut -d. -f1,2,3,4), 2.6.16.60-0)
+EXTRA_CFLAGS += -DOPENSUSE_SLED
+endif
+
+ifeq ($(NIC_SELECT),RTL8192U)
+#EXTRA_CFLAGS += -DUSB_TX_DRIVER_AGGREGATION_ENABLE
+#EXTRA_CFLAGS += -DUSB_RX_AGGREGATION_SUPPORT
+endif
+#EXTRA_CFLAGS += -DJOHN_NOCPY
+#flags to enable or disble 80211D feature
+EXTRA_CFLAGS += -DENABLE_DOT11D
+ieee80211-rsl-objs := ieee80211_rx.o \
+		      ieee80211_softmac.o \
+		      ieee80211_tx.o \
+		      ieee80211_wx.o \
+		      ieee80211_module.o \
+		      ieee80211_softmac_wx.o\
+		      rtl819x_HTProc.o\
+		      rtl819x_TSProc.o\
+		      rtl819x_BAProc.o\
+		      dot11d.o
+
+ieee80211_crypt-rsl-objs := ieee80211_crypt.o
+ieee80211_crypt_tkip-rsl-objs := ieee80211_crypt_tkip.o
+ieee80211_crypt_ccmp-rsl-objs := ieee80211_crypt_ccmp.o
+ieee80211_crypt_wep-rsl-objs := ieee80211_crypt_wep.o
+
+obj-m +=ieee80211-rsl.o
+obj-m +=ieee80211_crypt-rsl.o
+obj-m +=ieee80211_crypt_wep-rsl.o
+obj-m +=ieee80211_crypt_tkip-rsl.o
+obj-m +=ieee80211_crypt_ccmp-rsl.o
+
+KSRC := /lib/modules/$(KVER)/build
+INSTALL_PREFIX :=
+
+all: modules
+
+modules:
+	$(MAKE) -C $(KSRC) M=$(PWD) CC=$(CC) modules
+
+install: modules
+	rm -fr $(MODDESTDIR)
+	mkdir -p $(MODDESTDIR)
+	@install -p -m 644 ieee80211_crypt-rsl.ko $(MODDESTDIR)
+	@install -p -m 644 ieee80211_crypt_wep-rsl.ko $(MODDESTDIR)
+	@install -p -m 644 ieee80211_crypt_tkip-rsl.ko $(MODDESTDIR)
+	@install -p -m 644 ieee80211_crypt_ccmp-rsl.ko $(MODDESTDIR)
+	@install -p -m 644 ieee80211-rsl.ko $(MODDESTDIR)
+	depmod -a
+uninstall:
+	rm -fr $(MODDESTDIR)
+	depmod -a
+
+else
+LD := ld
+KSRC := /lib/modules/$(KVER)/build
+CONFIG_FILE := $(KSRC)/include/linux/autoconf.h
+
+CFLAGS += -DLINUX -D__KERNEL__ -DMODULE -O2 -pipe -Wall
+CFLAGS += -I$(KSRC)/include -I.
+#Kernel 2.4.31
+CFLAGS += -DMODVERSIONS -DEXPORT_SYMTAB -include $(KSRC)/include/linux/modversions.h
+#Kernel 2.4.20
+#CFLAGS += -D__NO_VERSION__ -DEXPORT_SYMTAB
+#CFLAGS += -DENABLE_DOT11D
+SMP := $(shell $(CC) $(MODCFLAGS) -E -dM $(CONFIG_FILE) | \
+   grep CONFIG_SMP | awk '{print $$3}')
+ifneq ($(SMP),1)
+   SMP := 0
+endif
+ifeq ($(SMP),1)
+   CFLAGS    += -D__SMP__
+endif
+
+#CFLAGS += -DJOHN_NOCPY
+
+OBJS := ${patsubst %.c, %.o, ${wildcard *.c}}
+all:${OBJS} ieee80211_crypt-rsl.o michael_mic-rsl.o aes-rsl.o ieee80211_crypt_wep-rsl.o ieee80211_crypt_tkip-rsl.o ieee80211_crypt_ccmp-rsl.o crypto-rsl.o ieee80211-rsl.o
+
+ieee80211_crypt-rsl.o: ieee80211_crypt.o
+	mv $^ $@
+
+michael_mic-rsl.o: michael_mic.o
+	mv $^ $@
+
+aes-rsl.o: aes.o
+	mv $^ $@
+
+ieee80211_crypt_wep-rsl.o: ieee80211_crypt_wep.o
+	mv $^ $@
+
+ieee80211_crypt_tkip-rsl.o: ieee80211_crypt_tkip.o
+	mv $^ $@
+
+ieee80211_crypt_ccmp-rsl.o: ieee80211_crypt_ccmp.o
+	mv $^ $@
+
+crypto-rsl.o: arc4.o api.o autoload.o cipher.o compress.o digest.o scatterwalk.o proc.o
+	$(LD) -r $^ -o $@
+
+ieee80211-rsl.o: ieee80211_rx.o ieee80211_tx.o ieee80211_wx.o ieee80211_module.o ieee80211_softmac_wx.o ieee80211_softmac.o rtl819x_HTProc.o rtl819x_TSProc.o rtl819x_BAProc.o dot11d.o
+	$(LD) -r $^ -o $@
+install:
+	rm -fr $(MODDESTDIR)
+	mkdir -p $(MODDESTDIR)
+	@install -p -m 644 ieee80211_crypt-rsl.o $(MODDESTDIR)
+	@install -p -m 644 crypto-rsl.o $(MODDESTDIR)
+	@install -p -m 644 michael_mic-rsl.o $(MODDESTDIR)
+	@install -p -m 644 aes-rsl.o $(MODDESTDIR)
+	@install -p -m 644 ieee80211_crypt_wep-rsl.o $(MODDESTDIR)
+	@install -p -m 644 ieee80211_crypt_tkip-rsl.o $(MODDESTDIR)
+	@install -p -m 644 ieee80211_crypt_ccmp-rsl.o $(MODDESTDIR)
+	@install -p -m 644 ieee80211-rsl.o $(MODDESTDIR)
+	/sbin/depmod -a ${shell uname -r}
+
+uninstall:
+	rm -fr $(MODDESTDIR)
+	/sbin/depmod -a ${shell uname -r}
+
+endif
+
+.PHONY: clean
+clean:
+	rm -fr *.mod.c *.mod *.o .*.cmd *.mod.* *.ko *.o *~
+	rm -rf .tmp_versions
+	rm -rf Module.symvers
diff --git a/drivers/staging/rtl8192u/ieee80211/aes.c b/drivers/staging/rtl8192u/ieee80211/aes.c
new file mode 100644
index 000000000000..a6bb6c9207d3
--- /dev/null
+++ b/drivers/staging/rtl8192u/ieee80211/aes.c
@@ -0,0 +1,469 @@
+/*
+ * Cryptographic API.
+ *
+ * AES Cipher Algorithm.
+ *
+ * Based on Brian Gladman's code.
+ *
+ * Linux developers:
+ *  Alexander Kjeldaas <astor@fast.no>
+ *  Herbert Valerio Riedel <hvr@hvrlab.org>
+ *  Kyle McMartin <kyle@debian.org>
+ *  Adam J. Richter <adam@yggdrasil.com> (conversion to 2.5 API).
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * ---------------------------------------------------------------------------
+ * Copyright (c) 2002, Dr Brian Gladman <brg@gladman.me.uk>, Worcester, UK.
+ * All rights reserved.
+ *
+ * LICENSE TERMS
+ *
+ * The free distribution and use of this software in both source and binary
+ * form is allowed (with or without changes) provided that:
+ *
+ *   1. distributions of this source code include the above copyright
+ *      notice, this list of conditions and the following disclaimer;
+ *
+ *   2. distributions in binary form include the above copyright
+ *      notice, this list of conditions and the following disclaimer
+ *      in the documentation and/or other associated materials;
+ *
+ *   3. the copyright holder's name is not used to endorse products
+ *      built using this software without specific written permission.
+ *
+ * ALTERNATIVELY, provided that this notice is retained in full, this product
+ * may be distributed under the terms of the GNU General Public License (GPL),
+ * in which case the provisions of the GPL apply INSTEAD OF those given above.
+ *
+ * DISCLAIMER
+ *
+ * This software is provided 'as is' with no explicit or implied warranties
+ * in respect of its properties, including, but not limited to, correctness
+ * and/or fitness for purpose.
+ * ---------------------------------------------------------------------------
+ */
+
+/* Some changes from the Gladman version:
+    s/RIJNDAEL(e_key)/E_KEY/g
+    s/RIJNDAEL(d_key)/D_KEY/g
+*/
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/types.h>
+#include <linux/errno.h>
+//#include <linux/crypto.h>
+#include "rtl_crypto.h"
+#include <asm/byteorder.h>
+
+#define AES_MIN_KEY_SIZE	16
+#define AES_MAX_KEY_SIZE	32
+
+#define AES_BLOCK_SIZE		16
+
+static inline
+u32 generic_rotr32 (const u32 x, const unsigned bits)
+{
+	const unsigned n = bits % 32;
+	return (x >> n) | (x << (32 - n));
+}
+
+static inline
+u32 generic_rotl32 (const u32 x, const unsigned bits)
+{
+	const unsigned n = bits % 32;
+	return (x << n) | (x >> (32 - n));
+}
+
+#define rotl generic_rotl32
+#define rotr generic_rotr32
+
+/*
+ * #define byte(x, nr) ((unsigned char)((x) >> (nr*8)))
+ */
+inline static u8
+byte(const u32 x, const unsigned n)
+{
+	return x >> (n << 3);
+}
+
+#define u32_in(x) le32_to_cpu(*(const u32 *)(x))
+#define u32_out(to, from) (*(u32 *)(to) = cpu_to_le32(from))
+
+struct aes_ctx {
+	int key_length;
+	u32 E[60];
+	u32 D[60];
+};
+
+#define E_KEY ctx->E
+#define D_KEY ctx->D
+
+static u8 pow_tab[256] __initdata;
+static u8 log_tab[256] __initdata;
+static u8 sbx_tab[256] __initdata;
+static u8 isb_tab[256] __initdata;
+static u32 rco_tab[10];
+static u32 ft_tab[4][256];
+static u32 it_tab[4][256];
+
+static u32 fl_tab[4][256];
+static u32 il_tab[4][256];
+
+static inline u8 __init
+f_mult (u8 a, u8 b)
+{
+	u8 aa = log_tab[a], cc = aa + log_tab[b];
+
+	return pow_tab[cc + (cc < aa ? 1 : 0)];
+}
+
+#define ff_mult(a,b)    (a && b ? f_mult(a, b) : 0)
+
+#define f_rn(bo, bi, n, k)					\
+    bo[n] =  ft_tab[0][byte(bi[n],0)] ^				\
+	     ft_tab[1][byte(bi[(n + 1) & 3],1)] ^		\
+	     ft_tab[2][byte(bi[(n + 2) & 3],2)] ^		\
+	     ft_tab[3][byte(bi[(n + 3) & 3],3)] ^ *(k + n)
+
+#define i_rn(bo, bi, n, k)					\
+    bo[n] =  it_tab[0][byte(bi[n],0)] ^				\
+	     it_tab[1][byte(bi[(n + 3) & 3],1)] ^		\
+	     it_tab[2][byte(bi[(n + 2) & 3],2)] ^		\
+	     it_tab[3][byte(bi[(n + 1) & 3],3)] ^ *(k + n)
+
+#define ls_box(x)				\
+    ( fl_tab[0][byte(x, 0)] ^			\
+      fl_tab[1][byte(x, 1)] ^			\
+      fl_tab[2][byte(x, 2)] ^			\
+      fl_tab[3][byte(x, 3)] )
+
+#define f_rl(bo, bi, n, k)					\
+    bo[n] =  fl_tab[0][byte(bi[n],0)] ^				\
+	     fl_tab[1][byte(bi[(n + 1) & 3],1)] ^		\
+	     fl_tab[2][byte(bi[(n + 2) & 3],2)] ^		\
+	     fl_tab[3][byte(bi[(n + 3) & 3],3)] ^ *(k + n)
+
+#define i_rl(bo, bi, n, k)					\
+    bo[n] =  il_tab[0][byte(bi[n],0)] ^				\
+	     il_tab[1][byte(bi[(n + 3) & 3],1)] ^		\
+	     il_tab[2][byte(bi[(n + 2) & 3],2)] ^		\
+	     il_tab[3][byte(bi[(n + 1) & 3],3)] ^ *(k + n)
+
+static void __init
+gen_tabs (void)
+{
+	u32 i, t;
+	u8 p, q;
+
+	/* log and power tables for GF(2**8) finite field with
+	   0x011b as modular polynomial - the simplest primitive
+	   root is 0x03, used here to generate the tables */
+
+	for (i = 0, p = 1; i < 256; ++i) {
+		pow_tab[i] = (u8) p;
+		log_tab[p] = (u8) i;
+
+		p ^= (p << 1) ^ (p & 0x80 ? 0x01b : 0);
+	}
+
+	log_tab[1] = 0;
+
+	for (i = 0, p = 1; i < 10; ++i) {
+		rco_tab[i] = p;
+
+		p = (p << 1) ^ (p & 0x80 ? 0x01b : 0);
+	}
+
+	for (i = 0; i < 256; ++i) {
+		p = (i ? pow_tab[255 - log_tab[i]] : 0);
+		q = ((p >> 7) | (p << 1)) ^ ((p >> 6) | (p << 2));
+		p ^= 0x63 ^ q ^ ((q >> 6) | (q << 2));
+		sbx_tab[i] = p;
+		isb_tab[p] = (u8) i;
+	}
+
+	for (i = 0; i < 256; ++i) {
+		p = sbx_tab[i];
+
+		t = p;
+		fl_tab[0][i] = t;
+		fl_tab[1][i] = rotl (t, 8);
+		fl_tab[2][i] = rotl (t, 16);
+		fl_tab[3][i] = rotl (t, 24);
+
+		t = ((u32) ff_mult (2, p)) |
+		    ((u32) p << 8) |
+		    ((u32) p << 16) | ((u32) ff_mult (3, p) << 24);
+
+		ft_tab[0][i] = t;
+		ft_tab[1][i] = rotl (t, 8);
+		ft_tab[2][i] = rotl (t, 16);
+		ft_tab[3][i] = rotl (t, 24);
+
+		p = isb_tab[i];
+
+		t = p;
+		il_tab[0][i] = t;
+		il_tab[1][i] = rotl (t, 8);
+		il_tab[2][i] = rotl (t, 16);
+		il_tab[3][i] = rotl (t, 24);
+
+		t = ((u32) ff_mult (14, p)) |
+		    ((u32) ff_mult (9, p) << 8) |
+		    ((u32) ff_mult (13, p) << 16) |
+		    ((u32) ff_mult (11, p) << 24);
+
+		it_tab[0][i] = t;
+		it_tab[1][i] = rotl (t, 8);
+		it_tab[2][i] = rotl (t, 16);
+		it_tab[3][i] = rotl (t, 24);
+	}
+}
+
+#define star_x(x) (((x) & 0x7f7f7f7f) << 1) ^ ((((x) & 0x80808080) >> 7) * 0x1b)
+
+#define imix_col(y,x)       \
+    u   = star_x(x);        \
+    v   = star_x(u);        \
+    w   = star_x(v);        \
+    t   = w ^ (x);          \
+   (y)  = u ^ v ^ w;        \
+   (y) ^= rotr(u ^ t,  8) ^ \
+	  rotr(v ^ t, 16) ^ \
+	  rotr(t,24)
+
+/* initialise the key schedule from the user supplied key */
+
+#define loop4(i)                                    \
+{   t = rotr(t,  8); t = ls_box(t) ^ rco_tab[i];    \
+    t ^= E_KEY[4 * i];     E_KEY[4 * i + 4] = t;    \
+    t ^= E_KEY[4 * i + 1]; E_KEY[4 * i + 5] = t;    \
+    t ^= E_KEY[4 * i + 2]; E_KEY[4 * i + 6] = t;    \
+    t ^= E_KEY[4 * i + 3]; E_KEY[4 * i + 7] = t;    \
+}
+
+#define loop6(i)                                    \
+{   t = rotr(t,  8); t = ls_box(t) ^ rco_tab[i];    \
+    t ^= E_KEY[6 * i];     E_KEY[6 * i + 6] = t;    \
+    t ^= E_KEY[6 * i + 1]; E_KEY[6 * i + 7] = t;    \
+    t ^= E_KEY[6 * i + 2]; E_KEY[6 * i + 8] = t;    \
+    t ^= E_KEY[6 * i + 3]; E_KEY[6 * i + 9] = t;    \
+    t ^= E_KEY[6 * i + 4]; E_KEY[6 * i + 10] = t;   \
+    t ^= E_KEY[6 * i + 5]; E_KEY[6 * i + 11] = t;   \
+}
+
+#define loop8(i)                                    \
+{   t = rotr(t,  8); ; t = ls_box(t) ^ rco_tab[i];  \
+    t ^= E_KEY[8 * i];     E_KEY[8 * i + 8] = t;    \
+    t ^= E_KEY[8 * i + 1]; E_KEY[8 * i + 9] = t;    \
+    t ^= E_KEY[8 * i + 2]; E_KEY[8 * i + 10] = t;   \
+    t ^= E_KEY[8 * i + 3]; E_KEY[8 * i + 11] = t;   \
+    t  = E_KEY[8 * i + 4] ^ ls_box(t);    \
+    E_KEY[8 * i + 12] = t;                \
+    t ^= E_KEY[8 * i + 5]; E_KEY[8 * i + 13] = t;   \
+    t ^= E_KEY[8 * i + 6]; E_KEY[8 * i + 14] = t;   \
+    t ^= E_KEY[8 * i + 7]; E_KEY[8 * i + 15] = t;   \
+}
+
+static int
+aes_set_key(void *ctx_arg, const u8 *in_key, unsigned int key_len, u32 *flags)
+{
+	struct aes_ctx *ctx = ctx_arg;
+	u32 i, t, u, v, w;
+
+	if (key_len != 16 && key_len != 24 && key_len != 32) {
+		*flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
+		return -EINVAL;
+	}
+
+	ctx->key_length = key_len;
+
+	E_KEY[0] = u32_in (in_key);
+	E_KEY[1] = u32_in (in_key + 4);
+	E_KEY[2] = u32_in (in_key + 8);
+	E_KEY[3] = u32_in (in_key + 12);
+
+	switch (key_len) {
+	case 16:
+		t = E_KEY[3];
+		for (i = 0; i < 10; ++i)
+			loop4 (i);
+		break;
+
+	case 24:
+		E_KEY[4] = u32_in (in_key + 16);
+		t = E_KEY[5] = u32_in (in_key + 20);
+		for (i = 0; i < 8; ++i)
+			loop6 (i);
+		break;
+
+	case 32:
+		E_KEY[4] = u32_in (in_key + 16);
+		E_KEY[5] = u32_in (in_key + 20);
+		E_KEY[6] = u32_in (in_key + 24);
+		t = E_KEY[7] = u32_in (in_key + 28);
+		for (i = 0; i < 7; ++i)
+			loop8 (i);
+		break;
+	}
+
+	D_KEY[0] = E_KEY[0];
+	D_KEY[1] = E_KEY[1];
+	D_KEY[2] = E_KEY[2];
+	D_KEY[3] = E_KEY[3];
+
+	for (i = 4; i < key_len + 24; ++i) {
+		imix_col (D_KEY[i], E_KEY[i]);
+	}
+
+	return 0;
+}
+
+/* encrypt a block of text */
+
+#define f_nround(bo, bi, k) \
+    f_rn(bo, bi, 0, k);     \
+    f_rn(bo, bi, 1, k);     \
+    f_rn(bo, bi, 2, k);     \
+    f_rn(bo, bi, 3, k);     \
+    k += 4
+
+#define f_lround(bo, bi, k) \
+    f_rl(bo, bi, 0, k);     \
+    f_rl(bo, bi, 1, k);     \
+    f_rl(bo, bi, 2, k);     \
+    f_rl(bo, bi, 3, k)
+
+static void aes_encrypt(void *ctx_arg, u8 *out, const u8 *in)
+{
+	const struct aes_ctx *ctx = ctx_arg;
+	u32 b0[4], b1[4];
+	const u32 *kp = E_KEY + 4;
+
+	b0[0] = u32_in (in) ^ E_KEY[0];
+	b0[1] = u32_in (in + 4) ^ E_KEY[1];
+	b0[2] = u32_in (in + 8) ^ E_KEY[2];
+	b0[3] = u32_in (in + 12) ^ E_KEY[3];
+
+	if (ctx->key_length > 24) {
+		f_nround (b1, b0, kp);
+		f_nround (b0, b1, kp);
+	}
+
+	if (ctx->key_length > 16) {
+		f_nround (b1, b0, kp);
+		f_nround (b0, b1, kp);
+	}
+
+	f_nround (b1, b0, kp);
+	f_nround (b0, b1, kp);
+	f_nround (b1, b0, kp);
+	f_nround (b0, b1, kp);
+	f_nround (b1, b0, kp);
+	f_nround (b0, b1, kp);
+	f_nround (b1, b0, kp);
+	f_nround (b0, b1, kp);
+	f_nround (b1, b0, kp);
+	f_lround (b0, b1, kp);
+
+	u32_out (out, b0[0]);
+	u32_out (out + 4, b0[1]);
+	u32_out (out + 8, b0[2]);
+	u32_out (out + 12, b0[3]);
+}
+
+/* decrypt a block of text */
+
+#define i_nround(bo, bi, k) \
+    i_rn(bo, bi, 0, k);     \
+    i_rn(bo, bi, 1, k);     \
+    i_rn(bo, bi, 2, k);     \
+    i_rn(bo, bi, 3, k);     \
+    k -= 4
+
+#define i_lround(bo, bi, k) \
+    i_rl(bo, bi, 0, k);     \
+    i_rl(bo, bi, 1, k);     \
+    i_rl(bo, bi, 2, k);     \
+    i_rl(bo, bi, 3, k)
+
+static void aes_decrypt(void *ctx_arg, u8 *out, const u8 *in)
+{
+	const struct aes_ctx *ctx = ctx_arg;
+	u32 b0[4], b1[4];
+	const int key_len = ctx->key_length;
+	const u32 *kp = D_KEY + key_len + 20;
+
+	b0[0] = u32_in (in) ^ E_KEY[key_len + 24];
+	b0[1] = u32_in (in + 4) ^ E_KEY[key_len + 25];
+	b0[2] = u32_in (in + 8) ^ E_KEY[key_len + 26];
+	b0[3] = u32_in (in + 12) ^ E_KEY[key_len + 27];
+
+	if (key_len > 24) {
+		i_nround (b1, b0, kp);
+		i_nround (b0, b1, kp);
+	}
+
+	if (key_len > 16) {
+		i_nround (b1, b0, kp);
+		i_nround (b0, b1, kp);
+	}
+
+	i_nround (b1, b0, kp);
+	i_nround (b0, b1, kp);
+	i_nround (b1, b0, kp);
+	i_nround (b0, b1, kp);
+	i_nround (b1, b0, kp);
+	i_nround (b0, b1, kp);
+	i_nround (b1, b0, kp);
+	i_nround (b0, b1, kp);
+	i_nround (b1, b0, kp);
+	i_lround (b0, b1, kp);
+
+	u32_out (out, b0[0]);
+	u32_out (out + 4, b0[1]);
+	u32_out (out + 8, b0[2]);
+	u32_out (out + 12, b0[3]);
+}
+
+
+static struct crypto_alg aes_alg = {
+	.cra_name		=	"aes",
+	.cra_flags		=	CRYPTO_ALG_TYPE_CIPHER,
+	.cra_blocksize		=	AES_BLOCK_SIZE,
+	.cra_ctxsize		=	sizeof(struct aes_ctx),
+	.cra_module		=	THIS_MODULE,
+	.cra_list		=	LIST_HEAD_INIT(aes_alg.cra_list),
+	.cra_u			=	{
+		.cipher = {
+			.cia_min_keysize	=	AES_MIN_KEY_SIZE,
+			.cia_max_keysize	=	AES_MAX_KEY_SIZE,
+			.cia_setkey		= 	aes_set_key,
+			.cia_encrypt		=	aes_encrypt,
+			.cia_decrypt		=	aes_decrypt
+		}
+	}
+};
+
+static int __init aes_init(void)
+{
+	gen_tabs();
+	return crypto_register_alg(&aes_alg);
+}
+
+static void __exit aes_fini(void)
+{
+	crypto_unregister_alg(&aes_alg);
+}
+
+module_init(aes_init);
+module_exit(aes_fini);
+
+MODULE_DESCRIPTION("Rijndael (AES) Cipher Algorithm");
+MODULE_LICENSE("Dual BSD/GPL");
+
diff --git a/drivers/staging/rtl8192u/ieee80211/api.c b/drivers/staging/rtl8192u/ieee80211/api.c
new file mode 100644
index 000000000000..c627d029528b
--- /dev/null
+++ b/drivers/staging/rtl8192u/ieee80211/api.c
@@ -0,0 +1,246 @@
+/*
+ * Scatterlist Cryptographic API.
+ *
+ * Copyright (c) 2002 James Morris <jmorris@intercode.com.au>
+ * Copyright (c) 2002 David S. Miller (davem@redhat.com)
+ *
+ * Portions derived from Cryptoapi, by Alexander Kjeldaas <astor@fast.no>
+ * and Nettle, by Niels Mé°ˆler.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2 of the License, or (at your option)
+ * any later version.
+ *
+ */
+#include "kmap_types.h"
+
+#include <linux/init.h>
+#include <linux/module.h>
+//#include <linux/crypto.h>
+#include "rtl_crypto.h"
+#include <linux/errno.h>
+#include <linux/rwsem.h>
+#include <linux/slab.h>
+#include "internal.h"
+
+LIST_HEAD(crypto_alg_list);
+DECLARE_RWSEM(crypto_alg_sem);
+
+static inline int crypto_alg_get(struct crypto_alg *alg)
+{
+	return try_inc_mod_count(alg->cra_module);
+}
+
+static inline void crypto_alg_put(struct crypto_alg *alg)
+{
+	if (alg->cra_module)
+		__MOD_DEC_USE_COUNT(alg->cra_module);
+}
+
+struct crypto_alg *crypto_alg_lookup(const char *name)
+{
+	struct crypto_alg *q, *alg = NULL;
+
+	if (!name)
+		return NULL;
+
+	down_read(&crypto_alg_sem);
+
+	list_for_each_entry(q, &crypto_alg_list, cra_list) {
+		if (!(strcmp(q->cra_name, name))) {
+			if (crypto_alg_get(q))
+				alg = q;
+			break;
+		}
+	}
+
+	up_read(&crypto_alg_sem);
+	return alg;
+}
+
+static int crypto_init_flags(struct crypto_tfm *tfm, u32 flags)
+{
+	tfm->crt_flags = 0;
+
+	switch (crypto_tfm_alg_type(tfm)) {
+	case CRYPTO_ALG_TYPE_CIPHER:
+		return crypto_init_cipher_flags(tfm, flags);
+
+	case CRYPTO_ALG_TYPE_DIGEST:
+		return crypto_init_digest_flags(tfm, flags);
+
+	case CRYPTO_ALG_TYPE_COMPRESS:
+		return crypto_init_compress_flags(tfm, flags);
+
+	default:
+		break;
+	}
+
+	BUG();
+	return -EINVAL;
+}
+
+static int crypto_init_ops(struct crypto_tfm *tfm)
+{
+	switch (crypto_tfm_alg_type(tfm)) {
+	case CRYPTO_ALG_TYPE_CIPHER:
+		return crypto_init_cipher_ops(tfm);
+
+	case CRYPTO_ALG_TYPE_DIGEST:
+		return crypto_init_digest_ops(tfm);
+
+	case CRYPTO_ALG_TYPE_COMPRESS:
+		return crypto_init_compress_ops(tfm);
+
+	default:
+		break;
+	}
+
+	BUG();
+	return -EINVAL;
+}
+
+static void crypto_exit_ops(struct crypto_tfm *tfm)
+{
+	switch (crypto_tfm_alg_type(tfm)) {
+	case CRYPTO_ALG_TYPE_CIPHER:
+		crypto_exit_cipher_ops(tfm);
+		break;
+
+	case CRYPTO_ALG_TYPE_DIGEST:
+		crypto_exit_digest_ops(tfm);
+		break;
+
+	case CRYPTO_ALG_TYPE_COMPRESS:
+		crypto_exit_compress_ops(tfm);
+		break;
+
+	default:
+		BUG();
+
+	}
+}
+
+struct crypto_tfm *crypto_alloc_tfm(const char *name, u32 flags)
+{
+	struct crypto_tfm *tfm = NULL;
+	struct crypto_alg *alg;
+
+	alg = crypto_alg_mod_lookup(name);
+	if (alg == NULL)
+		goto out;
+
+	tfm = kmalloc(sizeof(*tfm) + alg->cra_ctxsize, GFP_KERNEL);
+	if (tfm == NULL)
+		goto out_put;
+
+	memset(tfm, 0, sizeof(*tfm) + alg->cra_ctxsize);
+
+	tfm->__crt_alg = alg;
+
+	if (crypto_init_flags(tfm, flags))
+		goto out_free_tfm;
+
+	if (crypto_init_ops(tfm)) {
+		crypto_exit_ops(tfm);
+		goto out_free_tfm;
+	}
+
+	goto out;
+
+out_free_tfm:
+	kfree(tfm);
+	tfm = NULL;
+out_put:
+	crypto_alg_put(alg);
+out:
+	return tfm;
+}
+
+void crypto_free_tfm(struct crypto_tfm *tfm)
+{
+	struct crypto_alg *alg = tfm->__crt_alg;
+	int size = sizeof(*tfm) + alg->cra_ctxsize;
+
+	crypto_exit_ops(tfm);
+	crypto_alg_put(alg);
+	memset(tfm, 0, size);
+	kfree(tfm);
+}
+
+int crypto_register_alg(struct crypto_alg *alg)
+{
+	int ret = 0;
+	struct crypto_alg *q;
+
+	down_write(&crypto_alg_sem);
+
+	list_for_each_entry(q, &crypto_alg_list, cra_list) {
+		if (!(strcmp(q->cra_name, alg->cra_name))) {
+			ret = -EEXIST;
+			goto out;
+		}
+	}
+
+	list_add_tail(&alg->cra_list, &crypto_alg_list);
+out:
+	up_write(&crypto_alg_sem);
+	return ret;
+}
+
+int crypto_unregister_alg(struct crypto_alg *alg)
+{
+	int ret = -ENOENT;
+	struct crypto_alg *q;
+
+	BUG_ON(!alg->cra_module);
+
+	down_write(&crypto_alg_sem);
+	list_for_each_entry(q, &crypto_alg_list, cra_list) {
+		if (alg == q) {
+			list_del(&alg->cra_list);
+			ret = 0;
+			goto out;
+		}
+	}
+out:
+	up_write(&crypto_alg_sem);
+	return ret;
+}
+
+int crypto_alg_available(const char *name, u32 flags)
+{
+	int ret = 0;
+	struct crypto_alg *alg = crypto_alg_mod_lookup(name);
+
+	if (alg) {
+		crypto_alg_put(alg);
+		ret = 1;
+	}
+
+	return ret;
+}
+
+static int __init init_crypto(void)
+{
+	printk(KERN_INFO "Initializing Cryptographic API\n");
+	crypto_init_proc();
+	return 0;
+}
+
+__initcall(init_crypto);
+
+/*
+EXPORT_SYMBOL_GPL(crypto_register_alg);
+EXPORT_SYMBOL_GPL(crypto_unregister_alg);
+EXPORT_SYMBOL_GPL(crypto_alloc_tfm);
+EXPORT_SYMBOL_GPL(crypto_free_tfm);
+EXPORT_SYMBOL_GPL(crypto_alg_available);
+*/
+
+EXPORT_SYMBOL_NOVERS(crypto_register_alg);
+EXPORT_SYMBOL_NOVERS(crypto_unregister_alg);
+EXPORT_SYMBOL_NOVERS(crypto_alloc_tfm);
+EXPORT_SYMBOL_NOVERS(crypto_free_tfm);
+EXPORT_SYMBOL_NOVERS(crypto_alg_available);
diff --git a/drivers/staging/rtl8192u/ieee80211/arc4.c b/drivers/staging/rtl8192u/ieee80211/arc4.c
new file mode 100644
index 000000000000..e3ad8d2f415e
--- /dev/null
+++ b/drivers/staging/rtl8192u/ieee80211/arc4.c
@@ -0,0 +1,103 @@
+/*
+ * Cryptographic API
+ *
+ * ARC4 Cipher Algorithm
+ *
+ * Jon Oberheide <jon@oberheide.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ */
+#include <linux/module.h>
+#include <linux/init.h>
+#include "rtl_crypto.h"
+
+#define ARC4_MIN_KEY_SIZE	1
+#define ARC4_MAX_KEY_SIZE	256
+#define ARC4_BLOCK_SIZE		1
+
+struct arc4_ctx {
+	u8 S[256];
+	u8 x, y;
+};
+
+static int arc4_set_key(void *ctx_arg, const u8 *in_key, unsigned int key_len, u32 *flags)
+{
+	struct arc4_ctx *ctx = ctx_arg;
+	int i, j = 0, k = 0;
+
+	ctx->x = 1;
+	ctx->y = 0;
+
+	for(i = 0; i < 256; i++)
+		ctx->S[i] = i;
+
+	for(i = 0; i < 256; i++)
+	{
+		u8 a = ctx->S[i];
+		j = (j + in_key[k] + a) & 0xff;
+		ctx->S[i] = ctx->S[j];
+		ctx->S[j] = a;
+		if((unsigned int)++k >= key_len)
+			k = 0;
+	}
+
+	return 0;
+}
+
+static void arc4_crypt(void *ctx_arg, u8 *out, const u8 *in)
+{
+	struct arc4_ctx *ctx = ctx_arg;
+
+	u8 *const S = ctx->S;
+	u8 x = ctx->x;
+	u8 y = ctx->y;
+	u8 a, b;
+
+	a = S[x];
+	y = (y + a) & 0xff;
+	b = S[y];
+	S[x] = b;
+	S[y] = a;
+	x = (x + 1) & 0xff;
+	*out++ = *in ^ S[(a + b) & 0xff];
+
+	ctx->x = x;
+	ctx->y = y;
+}
+
+static struct crypto_alg arc4_alg = {
+	.cra_name		=	"arc4",
+	.cra_flags		=	CRYPTO_ALG_TYPE_CIPHER,
+	.cra_blocksize		=	ARC4_BLOCK_SIZE,
+	.cra_ctxsize		=	sizeof(struct arc4_ctx),
+	.cra_module		=	THIS_MODULE,
+	.cra_list		=	LIST_HEAD_INIT(arc4_alg.cra_list),
+	.cra_u			=	{ .cipher = {
+	.cia_min_keysize	=	ARC4_MIN_KEY_SIZE,
+	.cia_max_keysize	=	ARC4_MAX_KEY_SIZE,
+	.cia_setkey		= 	arc4_set_key,
+	.cia_encrypt		=	arc4_crypt,
+	.cia_decrypt		=	arc4_crypt } }
+};
+
+static int __init arc4_init(void)
+{
+	return crypto_register_alg(&arc4_alg);
+}
+
+
+static void __exit arc4_exit(void)
+{
+	crypto_unregister_alg(&arc4_alg);
+}
+
+module_init(arc4_init);
+module_exit(arc4_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("ARC4 Cipher Algorithm");
+MODULE_AUTHOR("Jon Oberheide <jon@oberheide.org>");
diff --git a/drivers/staging/rtl8192u/ieee80211/autoload.c b/drivers/staging/rtl8192u/ieee80211/autoload.c
new file mode 100644
index 000000000000..c97756f3b2ea
--- /dev/null
+++ b/drivers/staging/rtl8192u/ieee80211/autoload.c
@@ -0,0 +1,40 @@
+/*
+ * Cryptographic API.
+ *
+ * Algorithm autoloader.
+ *
+ * Copyright (c) 2002 James Morris <jmorris@intercode.com.au>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2 of the License, or (at your option)
+ * any later version.
+ *
+ */
+#include "kmap_types.h"
+
+#include <linux/kernel.h>
+//#include <linux/crypto.h>
+#include "rtl_crypto.h"
+#include <linux/string.h>
+#include <linux/kmod.h>
+#include "internal.h"
+
+/*
+ * A far more intelligent version of this is planned.  For now, just
+ * try an exact match on the name of the algorithm.
+ */
+void crypto_alg_autoload(const char *name)
+{
+	request_module(name);
+}
+
+struct crypto_alg *crypto_alg_mod_lookup(const char *name)
+{
+	struct crypto_alg *alg = crypto_alg_lookup(name);
+	if (alg == NULL) {
+		crypto_alg_autoload(name);
+		alg = crypto_alg_lookup(name);
+	}
+	return alg;
+}
diff --git a/drivers/staging/rtl8192u/ieee80211/cipher.c b/drivers/staging/rtl8192u/ieee80211/cipher.c
new file mode 100644
index 000000000000..0b9e8a4ae7b5
--- /dev/null
+++ b/drivers/staging/rtl8192u/ieee80211/cipher.c
@@ -0,0 +1,299 @@
+/*
+ * Cryptographic API.
+ *
+ * Cipher operations.
+ *
+ * Copyright (c) 2002 James Morris <jmorris@intercode.com.au>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2 of the License, or (at your option)
+ * any later version.
+ *
+ */
+#include <linux/kernel.h>
+//#include <linux/crypto.h>
+#include "rtl_crypto.h"
+#include <linux/errno.h>
+#include <linux/mm.h>
+#include <linux/slab.h>
+#include <asm/scatterlist.h>
+#include "internal.h"
+#include "scatterwalk.h"
+
+typedef void (cryptfn_t)(void *, u8 *, const u8 *);
+typedef void (procfn_t)(struct crypto_tfm *, u8 *,
+			u8*, cryptfn_t, int enc, void *, int);
+
+static inline void xor_64(u8 *a, const u8 *b)
+{
+	((u32 *)a)[0] ^= ((u32 *)b)[0];
+	((u32 *)a)[1] ^= ((u32 *)b)[1];
+}
+
+static inline void xor_128(u8 *a, const u8 *b)
+{
+	((u32 *)a)[0] ^= ((u32 *)b)[0];
+	((u32 *)a)[1] ^= ((u32 *)b)[1];
+	((u32 *)a)[2] ^= ((u32 *)b)[2];
+	((u32 *)a)[3] ^= ((u32 *)b)[3];
+}
+
+
+/*
+ * Generic encrypt/decrypt wrapper for ciphers, handles operations across
+ * multiple page boundaries by using temporary blocks.  In user context,
+ * the kernel is given a chance to schedule us once per block.
+ */
+static int crypt(struct crypto_tfm *tfm,
+		 struct scatterlist *dst,
+		 struct scatterlist *src,
+		 unsigned int nbytes, cryptfn_t crfn,
+		 procfn_t prfn, int enc, void *info)
+{
+	struct scatter_walk walk_in, walk_out;
+	const unsigned int bsize = crypto_tfm_alg_blocksize(tfm);
+	u8 tmp_src[bsize];
+	u8 tmp_dst[bsize];
+
+	if (!nbytes)
+		return 0;
+
+	if (nbytes % bsize) {
+		tfm->crt_flags |= CRYPTO_TFM_RES_BAD_BLOCK_LEN;
+		return -EINVAL;
+	}
+
+	scatterwalk_start(&walk_in, src);
+	scatterwalk_start(&walk_out, dst);
+
+	for(;;) {
+		u8 *src_p, *dst_p;
+		int in_place;
+
+		scatterwalk_map(&walk_in, 0);
+		scatterwalk_map(&walk_out, 1);
+		src_p = scatterwalk_whichbuf(&walk_in, bsize, tmp_src);
+		dst_p = scatterwalk_whichbuf(&walk_out, bsize, tmp_dst);
+		in_place = scatterwalk_samebuf(&walk_in, &walk_out,
+					       src_p, dst_p);
+
+		nbytes -= bsize;
+
+		scatterwalk_copychunks(src_p, &walk_in, bsize, 0);
+
+		prfn(tfm, dst_p, src_p, crfn, enc, info, in_place);
+
+		scatterwalk_done(&walk_in, 0, nbytes);
+
+		scatterwalk_copychunks(dst_p, &walk_out, bsize, 1);
+		scatterwalk_done(&walk_out, 1, nbytes);
+
+		if (!nbytes)
+			return 0;
+
+		crypto_yield(tfm);
+	}
+}
+
+static void cbc_process(struct crypto_tfm *tfm, u8 *dst, u8 *src,
+			cryptfn_t fn, int enc, void *info, int in_place)
+{
+	u8 *iv = info;
+
+	/* Null encryption */
+	if (!iv)
+		return;
+
+	if (enc) {
+		tfm->crt_u.cipher.cit_xor_block(iv, src);
+		fn(crypto_tfm_ctx(tfm), dst, iv);
+		memcpy(iv, dst, crypto_tfm_alg_blocksize(tfm));
+	} else {
+		u8 stack[in_place ? crypto_tfm_alg_blocksize(tfm) : 0];
+		u8 *buf = in_place ? stack : dst;
+
+		fn(crypto_tfm_ctx(tfm), buf, src);
+		tfm->crt_u.cipher.cit_xor_block(buf, iv);
+		memcpy(iv, src, crypto_tfm_alg_blocksize(tfm));
+		if (buf != dst)
+			memcpy(dst, buf, crypto_tfm_alg_blocksize(tfm));
+	}
+}
+
+static void ecb_process(struct crypto_tfm *tfm, u8 *dst, u8 *src,
+			cryptfn_t fn, int enc, void *info, int in_place)
+{
+	fn(crypto_tfm_ctx(tfm), dst, src);
+}
+
+static int setkey(struct crypto_tfm *tfm, const u8 *key, unsigned int keylen)
+{
+	struct cipher_alg *cia = &tfm->__crt_alg->cra_cipher;
+
+	if (keylen < cia->cia_min_keysize || keylen > cia->cia_max_keysize) {
+		tfm->crt_flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
+		return -EINVAL;
+	} else
+		return cia->cia_setkey(crypto_tfm_ctx(tfm), key, keylen,
+				       &tfm->crt_flags);
+}
+
+static int ecb_encrypt(struct crypto_tfm *tfm,
+		       struct scatterlist *dst,
+		       struct scatterlist *src, unsigned int nbytes)
+{
+	return crypt(tfm, dst, src, nbytes,
+		     tfm->__crt_alg->cra_cipher.cia_encrypt,
+		     ecb_process, 1, NULL);
+}
+
+static int ecb_decrypt(struct crypto_tfm *tfm,
+		       struct scatterlist *dst,
+		       struct scatterlist *src,
+		       unsigned int nbytes)
+{
+	return crypt(tfm, dst, src, nbytes,
+		     tfm->__crt_alg->cra_cipher.cia_decrypt,
+		     ecb_process, 1, NULL);
+}
+
+static int cbc_encrypt(struct crypto_tfm *tfm,
+		       struct scatterlist *dst,
+		       struct scatterlist *src,
+		       unsigned int nbytes)
+{
+	return crypt(tfm, dst, src, nbytes,
+		     tfm->__crt_alg->cra_cipher.cia_encrypt,
+		     cbc_process, 1, tfm->crt_cipher.cit_iv);
+}
+
+static int cbc_encrypt_iv(struct crypto_tfm *tfm,
+			  struct scatterlist *dst,
+			  struct scatterlist *src,
+			  unsigned int nbytes, u8 *iv)
+{
+	return crypt(tfm, dst, src, nbytes,
+		     tfm->__crt_alg->cra_cipher.cia_encrypt,
+		     cbc_process, 1, iv);
+}
+
+static int cbc_decrypt(struct crypto_tfm *tfm,
+		       struct scatterlist *dst,
+		       struct scatterlist *src,
+		       unsigned int nbytes)
+{
+	return crypt(tfm, dst, src, nbytes,
+		     tfm->__crt_alg->cra_cipher.cia_decrypt,
+		     cbc_process, 0, tfm->crt_cipher.cit_iv);
+}
+
+static int cbc_decrypt_iv(struct crypto_tfm *tfm,
+			  struct scatterlist *dst,
+			  struct scatterlist *src,
+			  unsigned int nbytes, u8 *iv)
+{
+	return crypt(tfm, dst, src, nbytes,
+		     tfm->__crt_alg->cra_cipher.cia_decrypt,
+		     cbc_process, 0, iv);
+}
+
+static int nocrypt(struct crypto_tfm *tfm,
+		   struct scatterlist *dst,
+		   struct scatterlist *src,
+		   unsigned int nbytes)
+{
+	return -ENOSYS;
+}
+
+static int nocrypt_iv(struct crypto_tfm *tfm,
+		      struct scatterlist *dst,
+		      struct scatterlist *src,
+		      unsigned int nbytes, u8 *iv)
+{
+	return -ENOSYS;
+}
+
+int crypto_init_cipher_flags(struct crypto_tfm *tfm, u32 flags)
+{
+	u32 mode = flags & CRYPTO_TFM_MODE_MASK;
+
+	tfm->crt_cipher.cit_mode = mode ? mode : CRYPTO_TFM_MODE_ECB;
+	if (flags & CRYPTO_TFM_REQ_WEAK_KEY)
+		tfm->crt_flags = CRYPTO_TFM_REQ_WEAK_KEY;
+
+	return 0;
+}
+
+int crypto_init_cipher_ops(struct crypto_tfm *tfm)
+{
+	int ret = 0;
+	struct cipher_tfm *ops = &tfm->crt_cipher;
+
+	ops->cit_setkey = setkey;
+
+	switch (tfm->crt_cipher.cit_mode) {
+	case CRYPTO_TFM_MODE_ECB:
+		ops->cit_encrypt = ecb_encrypt;
+		ops->cit_decrypt = ecb_decrypt;
+		break;
+
+	case CRYPTO_TFM_MODE_CBC:
+		ops->cit_encrypt = cbc_encrypt;
+		ops->cit_decrypt = cbc_decrypt;
+		ops->cit_encrypt_iv = cbc_encrypt_iv;
+		ops->cit_decrypt_iv = cbc_decrypt_iv;
+		break;
+
+	case CRYPTO_TFM_MODE_CFB:
+		ops->cit_encrypt = nocrypt;
+		ops->cit_decrypt = nocrypt;
+		ops->cit_encrypt_iv = nocrypt_iv;
+		ops->cit_decrypt_iv = nocrypt_iv;
+		break;
+
+	case CRYPTO_TFM_MODE_CTR:
+		ops->cit_encrypt = nocrypt;
+		ops->cit_decrypt = nocrypt;
+		ops->cit_encrypt_iv = nocrypt_iv;
+		ops->cit_decrypt_iv = nocrypt_iv;
+		break;
+
+	default:
+		BUG();
+	}
+
+	if (ops->cit_mode == CRYPTO_TFM_MODE_CBC) {
+
+		switch (crypto_tfm_alg_blocksize(tfm)) {
+		case 8:
+			ops->cit_xor_block = xor_64;
+			break;
+
+		case 16:
+			ops->cit_xor_block = xor_128;
+			break;
+
+		default:
+			printk(KERN_WARNING "%s: block size %u not supported\n",
+			       crypto_tfm_alg_name(tfm),
+			       crypto_tfm_alg_blocksize(tfm));
+			ret = -EINVAL;
+			goto out;
+		}
+
+		ops->cit_ivsize = crypto_tfm_alg_blocksize(tfm);
+		ops->cit_iv = kmalloc(ops->cit_ivsize, GFP_KERNEL);
+		if (ops->cit_iv == NULL)
+			ret = -ENOMEM;
+	}
+
+out:
+	return ret;
+}
+
+void crypto_exit_cipher_ops(struct crypto_tfm *tfm)
+{
+	if (tfm->crt_cipher.cit_iv)
+		kfree(tfm->crt_cipher.cit_iv);
+}
diff --git a/drivers/staging/rtl8192u/ieee80211/compress.c b/drivers/staging/rtl8192u/ieee80211/compress.c
new file mode 100644
index 000000000000..86c23c9223f2
--- /dev/null
+++ b/drivers/staging/rtl8192u/ieee80211/compress.c
@@ -0,0 +1,64 @@
+/*
+ * Cryptographic API.
+ *
+ * Compression operations.
+ *
+ * Copyright (c) 2002 James Morris <jmorris@intercode.com.au>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2 of the License, or (at your option)
+ * any later version.
+ *
+ */
+#include <linux/types.h>
+//#include <linux/crypto.h>
+#include "rtl_crypto.h"
+#include <linux/errno.h>
+#include <asm/scatterlist.h>
+#include <linux/string.h>
+#include "internal.h"
+
+static int crypto_compress(struct crypto_tfm *tfm,
+			    const u8 *src, unsigned int slen,
+			    u8 *dst, unsigned int *dlen)
+{
+	return tfm->__crt_alg->cra_compress.coa_compress(crypto_tfm_ctx(tfm),
+							 src, slen, dst,
+							 dlen);
+}
+
+static int crypto_decompress(struct crypto_tfm *tfm,
+			     const u8 *src, unsigned int slen,
+			     u8 *dst, unsigned int *dlen)
+{
+	return tfm->__crt_alg->cra_compress.coa_decompress(crypto_tfm_ctx(tfm),
+							   src, slen, dst,
+							   dlen);
+}
+
+int crypto_init_compress_flags(struct crypto_tfm *tfm, u32 flags)
+{
+	return flags ? -EINVAL : 0;
+}
+
+int crypto_init_compress_ops(struct crypto_tfm *tfm)
+{
+	int ret = 0;
+	struct compress_tfm *ops = &tfm->crt_compress;
+
+	ret = tfm->__crt_alg->cra_compress.coa_init(crypto_tfm_ctx(tfm));
+	if (ret)
+		goto out;
+
+	ops->cot_compress = crypto_compress;
+	ops->cot_decompress = crypto_decompress;
+
+out:
+	return ret;
+}
+
+void crypto_exit_compress_ops(struct crypto_tfm *tfm)
+{
+	tfm->__crt_alg->cra_compress.coa_exit(crypto_tfm_ctx(tfm));
+}
diff --git a/drivers/staging/rtl8192u/ieee80211/crypto_compat.h b/drivers/staging/rtl8192u/ieee80211/crypto_compat.h
new file mode 100644
index 000000000000..da486588f1c0
--- /dev/null
+++ b/drivers/staging/rtl8192u/ieee80211/crypto_compat.h
@@ -0,0 +1,60 @@
+/*
+ * Header file to maintain compatibility among different kernel versions.
+ *
+ * Copyright (c) 2004-2006  <lawrence_wang@realsil.com.cn>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation. See README and COPYING for
+ * more details.
+ */
+
+#include <linux/crypto.h>
+
+static inline int crypto_cipher_encrypt(struct crypto_tfm *tfm,
+					struct scatterlist *dst,
+					struct scatterlist *src,
+					unsigned int nbytes)
+{
+	BUG_ON(crypto_tfm_alg_type(tfm) != CRYPTO_ALG_TYPE_CIPHER);
+	return tfm->crt_cipher.cit_encrypt(tfm, dst, src, nbytes);
+}
+
+
+static inline int crypto_cipher_decrypt(struct crypto_tfm *tfm,
+					struct scatterlist *dst,
+					struct scatterlist *src,
+					unsigned int nbytes)
+{
+	BUG_ON(crypto_tfm_alg_type(tfm) != CRYPTO_ALG_TYPE_CIPHER);
+	return tfm->crt_cipher.cit_decrypt(tfm, dst, src, nbytes);
+}
+
+ struct crypto_tfm *crypto_alloc_tfm(const char *name, u32 flags)
+{
+	struct crypto_tfm *tfm = NULL;
+	int err;
+	printk("call crypto_alloc_tfm!!!\n");
+	do {
+		struct crypto_alg *alg;
+
+		alg = crypto_alg_mod_lookup(name, 0, CRYPTO_ALG_ASYNC);
+		err = PTR_ERR(alg);
+		if (IS_ERR(alg))
+			continue;
+
+		tfm = __crypto_alloc_tfm(alg, flags);
+		err = 0;
+		if (IS_ERR(tfm)) {
+			crypto_mod_put(alg);
+			err = PTR_ERR(tfm);
+			tfm = NULL;
+		}
+	} while (err == -EAGAIN && !signal_pending(current));
+
+	return tfm;
+}
+//EXPORT_SYMBOL_GPL(crypto_alloc_tfm);
+//EXPORT_SYMBOL_GPL(crypto_free_tfm);
+
+
diff --git a/drivers/staging/rtl8192u/ieee80211/digest.c b/drivers/staging/rtl8192u/ieee80211/digest.c
new file mode 100644
index 000000000000..301ed514ac9e
--- /dev/null
+++ b/drivers/staging/rtl8192u/ieee80211/digest.c
@@ -0,0 +1,108 @@
+/*
+ * Cryptographic API.
+ *
+ * Digest operations.
+ *
+ * Copyright (c) 2002 James Morris <jmorris@intercode.com.au>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2 of the License, or (at your option)
+ * any later version.
+ *
+ */
+//#include <linux/crypto.h>
+#include "rtl_crypto.h"
+#include <linux/mm.h>
+#include <linux/errno.h>
+#include <linux/highmem.h>
+#include <asm/scatterlist.h>
+#include "internal.h"
+
+static void init(struct crypto_tfm *tfm)
+{
+	tfm->__crt_alg->cra_digest.dia_init(crypto_tfm_ctx(tfm));
+}
+
+static void update(struct crypto_tfm *tfm,
+		   struct scatterlist *sg, unsigned int nsg)
+{
+	unsigned int i;
+
+	for (i = 0; i < nsg; i++) {
+
+		struct page *pg = sg[i].page;
+		unsigned int offset = sg[i].offset;
+		unsigned int l = sg[i].length;
+
+		do {
+			unsigned int bytes_from_page = min(l, ((unsigned int)
+							   (PAGE_SIZE)) -
+							   offset);
+			char *p = crypto_kmap(pg, 0) + offset;
+
+			tfm->__crt_alg->cra_digest.dia_update
+					(crypto_tfm_ctx(tfm), p,
+					 bytes_from_page);
+			crypto_kunmap(p, 0);
+			crypto_yield(tfm);
+			offset = 0;
+			pg++;
+			l -= bytes_from_page;
+		} while (l > 0);
+	}
+}
+
+static void final(struct crypto_tfm *tfm, u8 *out)
+{
+	tfm->__crt_alg->cra_digest.dia_final(crypto_tfm_ctx(tfm), out);
+}
+
+static int setkey(struct crypto_tfm *tfm, const u8 *key, unsigned int keylen)
+{
+	u32 flags;
+	if (tfm->__crt_alg->cra_digest.dia_setkey == NULL)
+		return -ENOSYS;
+	return tfm->__crt_alg->cra_digest.dia_setkey(crypto_tfm_ctx(tfm),
+						     key, keylen, &flags);
+}
+
+static void digest(struct crypto_tfm *tfm,
+		   struct scatterlist *sg, unsigned int nsg, u8 *out)
+{
+	unsigned int i;
+
+	tfm->crt_digest.dit_init(tfm);
+
+	for (i = 0; i < nsg; i++) {
+		char *p = crypto_kmap(sg[i].page, 0) + sg[i].offset;
+		tfm->__crt_alg->cra_digest.dia_update(crypto_tfm_ctx(tfm),
+						      p, sg[i].length);
+		crypto_kunmap(p, 0);
+		crypto_yield(tfm);
+	}
+	crypto_digest_final(tfm, out);
+}
+
+int crypto_init_digest_flags(struct crypto_tfm *tfm, u32 flags)
+{
+	return flags ? -EINVAL : 0;
+}
+
+int crypto_init_digest_ops(struct crypto_tfm *tfm)
+{
+	struct digest_tfm *ops = &tfm->crt_digest;
+
+	ops->dit_init	= init;
+	ops->dit_update	= update;
+	ops->dit_final	= final;
+	ops->dit_digest	= digest;
+	ops->dit_setkey	= setkey;
+
+	return crypto_alloc_hmac_block(tfm);
+}
+
+void crypto_exit_digest_ops(struct crypto_tfm *tfm)
+{
+	crypto_free_hmac_block(tfm);
+}
diff --git a/drivers/staging/rtl8192u/ieee80211/dot11d.c b/drivers/staging/rtl8192u/ieee80211/dot11d.c
new file mode 100644
index 000000000000..b91cbfcfa71f
--- /dev/null
+++ b/drivers/staging/rtl8192u/ieee80211/dot11d.c
@@ -0,0 +1,223 @@
+#ifdef ENABLE_DOT11D
+//-----------------------------------------------------------------------------
+//	File:
+//		Dot11d.c
+//
+//	Description:
+//		Implement 802.11d.
+//
+//-----------------------------------------------------------------------------
+
+#include "dot11d.h"
+
+void
+Dot11d_Init(struct ieee80211_device *ieee)
+{
+	PRT_DOT11D_INFO pDot11dInfo = GET_DOT11D_INFO(ieee);
+
+	pDot11dInfo->bEnabled = 0;
+
+	pDot11dInfo->State = DOT11D_STATE_NONE;
+	pDot11dInfo->CountryIeLen = 0;
+	memset(pDot11dInfo->channel_map, 0, MAX_CHANNEL_NUMBER+1);
+	memset(pDot11dInfo->MaxTxPwrDbmList, 0xFF, MAX_CHANNEL_NUMBER+1);
+	RESET_CIE_WATCHDOG(ieee);
+
+	printk("Dot11d_Init()\n");
+}
+
+//
+//	Description:
+//		Reset to the state as we are just entering a regulatory domain.
+//
+void
+Dot11d_Reset(struct ieee80211_device *ieee)
+{
+	u32 i;
+	PRT_DOT11D_INFO pDot11dInfo = GET_DOT11D_INFO(ieee);
+	// Clear old channel map
+	memset(pDot11dInfo->channel_map, 0, MAX_CHANNEL_NUMBER+1);
+	memset(pDot11dInfo->MaxTxPwrDbmList, 0xFF, MAX_CHANNEL_NUMBER+1);
+	// Set new channel map
+	for (i=1; i<=11; i++) {
+		(pDot11dInfo->channel_map)[i] = 1;
+	}
+	for (i=12; i<=14; i++) {
+		(pDot11dInfo->channel_map)[i] = 2;
+	}
+
+	pDot11dInfo->State = DOT11D_STATE_NONE;
+	pDot11dInfo->CountryIeLen = 0;
+	RESET_CIE_WATCHDOG(ieee);
+
+	//printk("Dot11d_Reset()\n");
+}
+
+//
+//	Description:
+//		Update country IE from Beacon or Probe Resopnse
+//		and configure PHY for operation in the regulatory domain.
+//
+//	TODO:
+//		Configure Tx power.
+//
+//	Assumption:
+//		1. IS_DOT11D_ENABLE() is TRUE.
+//		2. Input IE is an valid one.
+//
+void
+Dot11d_UpdateCountryIe(
+	struct ieee80211_device *dev,
+	u8 *		pTaddr,
+	u16	CoutryIeLen,
+	u8 * pCoutryIe
+	)
+{
+	PRT_DOT11D_INFO pDot11dInfo = GET_DOT11D_INFO(dev);
+	u8 i, j, NumTriples, MaxChnlNum;
+	PCHNL_TXPOWER_TRIPLE pTriple;
+
+	memset(pDot11dInfo->channel_map, 0, MAX_CHANNEL_NUMBER+1);
+	memset(pDot11dInfo->MaxTxPwrDbmList, 0xFF, MAX_CHANNEL_NUMBER+1);
+	MaxChnlNum = 0;
+	NumTriples = (CoutryIeLen - 3) / 3; // skip 3-byte country string.
+	pTriple = (PCHNL_TXPOWER_TRIPLE)(pCoutryIe + 3);
+	for(i = 0; i < NumTriples; i++)
+	{
+		if(MaxChnlNum >= pTriple->FirstChnl)
+		{ // It is not in a monotonically increasing order, so stop processing.
+			printk("Dot11d_UpdateCountryIe(): Invalid country IE, skip it........1\n");
+			return;
+		}
+		if(MAX_CHANNEL_NUMBER < (pTriple->FirstChnl + pTriple->NumChnls))
+		{ // It is not a valid set of channel id, so stop processing.
+			printk("Dot11d_UpdateCountryIe(): Invalid country IE, skip it........2\n");
+			return;
+		}
+
+		for(j = 0 ; j < pTriple->NumChnls; j++)
+		{
+			pDot11dInfo->channel_map[pTriple->FirstChnl + j] = 1;
+			pDot11dInfo->MaxTxPwrDbmList[pTriple->FirstChnl + j] = pTriple->MaxTxPowerInDbm;
+			MaxChnlNum = pTriple->FirstChnl + j;
+		}
+
+		pTriple = (PCHNL_TXPOWER_TRIPLE)((u8*)pTriple + 3);
+	}
+	//printk("Dot11d_UpdateCountryIe(): Channel List:\n");
+	printk("Channel List:");
+	for(i=1; i<= MAX_CHANNEL_NUMBER; i++)
+		if(pDot11dInfo->channel_map[i] > 0)
+			printk(" %d", i);
+	printk("\n");
+
+	UPDATE_CIE_SRC(dev, pTaddr);
+
+	pDot11dInfo->CountryIeLen = CoutryIeLen;
+	memcpy(pDot11dInfo->CountryIeBuf, pCoutryIe,CoutryIeLen);
+	pDot11dInfo->State = DOT11D_STATE_LEARNED;
+}
+
+
+u8
+DOT11D_GetMaxTxPwrInDbm(
+	struct ieee80211_device *dev,
+	u8 Channel
+	)
+{
+	PRT_DOT11D_INFO pDot11dInfo = GET_DOT11D_INFO(dev);
+	u8 MaxTxPwrInDbm = 255;
+
+	if(MAX_CHANNEL_NUMBER < Channel)
+	{
+		printk("DOT11D_GetMaxTxPwrInDbm(): Invalid Channel\n");
+		return MaxTxPwrInDbm;
+	}
+	if(pDot11dInfo->channel_map[Channel])
+	{
+		MaxTxPwrInDbm = pDot11dInfo->MaxTxPwrDbmList[Channel];
+	}
+
+	return MaxTxPwrInDbm;
+}
+
+
+void
+DOT11D_ScanComplete(
+	struct ieee80211_device * dev
+	)
+{
+	PRT_DOT11D_INFO pDot11dInfo = GET_DOT11D_INFO(dev);
+
+	switch(pDot11dInfo->State)
+	{
+	case DOT11D_STATE_LEARNED:
+		pDot11dInfo->State = DOT11D_STATE_DONE;
+		break;
+
+	case DOT11D_STATE_DONE:
+		if( GET_CIE_WATCHDOG(dev) == 0 )
+		{ // Reset country IE if previous one is gone.
+			Dot11d_Reset(dev);
+		}
+		break;
+	case DOT11D_STATE_NONE:
+		break;
+	}
+}
+
+int IsLegalChannel(
+	struct ieee80211_device * dev,
+	u8 channel
+)
+{
+	PRT_DOT11D_INFO pDot11dInfo = GET_DOT11D_INFO(dev);
+
+	if(MAX_CHANNEL_NUMBER < channel)
+	{
+		printk("IsLegalChannel(): Invalid Channel\n");
+		return 0;
+	}
+	if(pDot11dInfo->channel_map[channel] > 0)
+		return 1;
+	return 0;
+}
+
+int ToLegalChannel(
+	struct ieee80211_device * dev,
+	u8 channel
+)
+{
+	PRT_DOT11D_INFO pDot11dInfo = GET_DOT11D_INFO(dev);
+	u8 default_chn = 0;
+	u32 i = 0;
+
+	for (i=1; i<= MAX_CHANNEL_NUMBER; i++)
+	{
+		if(pDot11dInfo->channel_map[i] > 0)
+		{
+			default_chn = i;
+			break;
+		}
+	}
+
+	if(MAX_CHANNEL_NUMBER < channel)
+	{
+		printk("IsLegalChannel(): Invalid Channel\n");
+		return default_chn;
+	}
+
+	if(pDot11dInfo->channel_map[channel] > 0)
+		return channel;
+
+	return default_chn;
+}
+EXPORT_SYMBOL(Dot11d_Init);
+EXPORT_SYMBOL(Dot11d_Reset);
+EXPORT_SYMBOL(Dot11d_UpdateCountryIe);
+EXPORT_SYMBOL(DOT11D_GetMaxTxPwrInDbm);
+EXPORT_SYMBOL(DOT11D_ScanComplete);
+EXPORT_SYMBOL(IsLegalChannel);
+EXPORT_SYMBOL(ToLegalChannel);
+
+#endif
diff --git a/drivers/staging/rtl8192u/ieee80211/dot11d.h b/drivers/staging/rtl8192u/ieee80211/dot11d.h
new file mode 100644
index 000000000000..15b7a4ba37b6
--- /dev/null
+++ b/drivers/staging/rtl8192u/ieee80211/dot11d.h
@@ -0,0 +1,102 @@
+#ifndef __INC_DOT11D_H
+#define __INC_DOT11D_H
+
+#ifdef ENABLE_DOT11D
+#include "ieee80211.h"
+
+//#define ENABLE_DOT11D
+
+//#define DOT11D_MAX_CHNL_NUM 83
+
+typedef struct _CHNL_TXPOWER_TRIPLE {
+	u8 FirstChnl;
+	u8  NumChnls;
+	u8  MaxTxPowerInDbm;
+}CHNL_TXPOWER_TRIPLE, *PCHNL_TXPOWER_TRIPLE;
+
+typedef enum _DOT11D_STATE {
+	DOT11D_STATE_NONE = 0,
+	DOT11D_STATE_LEARNED,
+	DOT11D_STATE_DONE,
+}DOT11D_STATE;
+
+typedef struct _RT_DOT11D_INFO {
+	//DECLARE_RT_OBJECT(RT_DOT11D_INFO);
+
+	bool bEnabled; // dot11MultiDomainCapabilityEnabled
+
+	u16 CountryIeLen; // > 0 if CountryIeBuf[] contains valid country information element.
+	u8  CountryIeBuf[MAX_IE_LEN];
+	u8  CountryIeSrcAddr[6]; // Source AP of the country IE.
+	u8  CountryIeWatchdog;
+
+	u8  channel_map[MAX_CHANNEL_NUMBER+1];  //!!!Value 0: Invalid, 1: Valid (active scan), 2: Valid (passive scan)
+	//u8  ChnlListLen; // #Bytes valid in ChnlList[].
+	//u8  ChnlList[DOT11D_MAX_CHNL_NUM];
+	u8  MaxTxPwrDbmList[MAX_CHANNEL_NUMBER+1];
+
+	DOT11D_STATE State;
+}RT_DOT11D_INFO, *PRT_DOT11D_INFO;
+#define eqMacAddr(a,b)		( ((a)[0]==(b)[0] && (a)[1]==(b)[1] && (a)[2]==(b)[2] && (a)[3]==(b)[3] && (a)[4]==(b)[4] && (a)[5]==(b)[5]) ? 1:0 )
+#define cpMacAddr(des,src)	      ((des)[0]=(src)[0],(des)[1]=(src)[1],(des)[2]=(src)[2],(des)[3]=(src)[3],(des)[4]=(src)[4],(des)[5]=(src)[5])
+#define GET_DOT11D_INFO(__pIeeeDev) ((PRT_DOT11D_INFO)((__pIeeeDev)->pDot11dInfo))
+
+#define IS_DOT11D_ENABLE(__pIeeeDev) GET_DOT11D_INFO(__pIeeeDev)->bEnabled
+#define IS_COUNTRY_IE_VALID(__pIeeeDev) (GET_DOT11D_INFO(__pIeeeDev)->CountryIeLen > 0)
+
+#define IS_EQUAL_CIE_SRC(__pIeeeDev, __pTa) eqMacAddr(GET_DOT11D_INFO(__pIeeeDev)->CountryIeSrcAddr, __pTa)
+#define UPDATE_CIE_SRC(__pIeeeDev, __pTa) cpMacAddr(GET_DOT11D_INFO(__pIeeeDev)->CountryIeSrcAddr, __pTa)
+
+#define IS_COUNTRY_IE_CHANGED(__pIeeeDev, __Ie) \
+	(((__Ie).Length == 0 || (__Ie).Length != GET_DOT11D_INFO(__pIeeeDev)->CountryIeLen) ? \
+	FALSE : \
+	(!memcmp(GET_DOT11D_INFO(__pIeeeDev)->CountryIeBuf, (__Ie).Octet, (__Ie).Length)))
+
+#define CIE_WATCHDOG_TH 1
+#define GET_CIE_WATCHDOG(__pIeeeDev) GET_DOT11D_INFO(__pIeeeDev)->CountryIeWatchdog
+#define RESET_CIE_WATCHDOG(__pIeeeDev) GET_CIE_WATCHDOG(__pIeeeDev) = 0
+#define UPDATE_CIE_WATCHDOG(__pIeeeDev) ++GET_CIE_WATCHDOG(__pIeeeDev)
+
+#define IS_DOT11D_STATE_DONE(__pIeeeDev) (GET_DOT11D_INFO(__pIeeeDev)->State == DOT11D_STATE_DONE)
+
+
+void
+Dot11d_Init(
+	struct ieee80211_device *dev
+	);
+
+void
+Dot11d_Reset(
+	struct ieee80211_device *dev
+	);
+
+void
+Dot11d_UpdateCountryIe(
+	struct ieee80211_device *dev,
+	u8 *		pTaddr,
+	u16	CoutryIeLen,
+	u8 * pCoutryIe
+	);
+
+u8
+DOT11D_GetMaxTxPwrInDbm(
+	struct ieee80211_device *dev,
+	u8 Channel
+	);
+
+void
+DOT11D_ScanComplete(
+	struct ieee80211_device * dev
+	);
+
+int IsLegalChannel(
+	struct ieee80211_device * dev,
+	u8 channel
+);
+
+int ToLegalChannel(
+	struct ieee80211_device * dev,
+	u8 channel
+);
+#endif //ENABLE_DOT11D
+#endif // #ifndef __INC_DOT11D_H
diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211.h b/drivers/staging/rtl8192u/ieee80211/ieee80211.h
new file mode 100644
index 000000000000..10908e123b86
--- /dev/null
+++ b/drivers/staging/rtl8192u/ieee80211/ieee80211.h
@@ -0,0 +1,2639 @@
+/*
+ * Merged with mainline ieee80211.h in Aug 2004.  Original ieee802_11
+ * remains copyright by the original authors
+ *
+ * Portions of the merged code are based on Host AP (software wireless
+ * LAN access point) driver for Intersil Prism2/2.5/3.
+ *
+ * Copyright (c) 2001-2002, SSH Communications Security Corp and Jouni Malinen
+ * <jkmaline@cc.hut.fi>
+ * Copyright (c) 2002-2003, Jouni Malinen <jkmaline@cc.hut.fi>
+ *
+ * Adaption to a generic IEEE 802.11 stack by James Ketrenos
+ * <jketreno@linux.intel.com>
+ * Copyright (c) 2004, Intel Corporation
+ *
+ * Modified for Realtek's wi-fi cards by Andrea Merello
+ * <andreamrl@tiscali.it>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation. See README and COPYING for
+ * more details.
+ */
+#ifndef IEEE80211_H
+#define IEEE80211_H
+#include <linux/if_ether.h> /* ETH_ALEN */
+#include <linux/kernel.h>   /* ARRAY_SIZE */
+#include <linux/version.h>
+#include <linux/module.h>
+#include <linux/jiffies.h>
+#include <linux/timer.h>
+#include <linux/sched.h>
+
+#include <linux/delay.h>
+#include <linux/wireless.h>
+
+#include "rtl819x_HT.h"
+#include "rtl819x_BA.h"
+#include "rtl819x_TS.h"
+
+
+#ifndef IW_MODE_MONITOR
+#define IW_MODE_MONITOR 6
+#endif
+
+#ifndef IWEVCUSTOM
+#define IWEVCUSTOM 0x8c02
+#endif
+
+
+#ifndef container_of
+/**
+ * container_of - cast a member of a structure out to the containing structure
+ *
+ * @ptr:        the pointer to the member.
+ * @type:       the type of the container struct this is embedded in.
+ * @member:     the name of the member within the struct.
+ *
+ */
+#define container_of(ptr, type, member) ({                      \
+	const typeof( ((type *)0)->member ) *__mptr = (ptr);    \
+	(type *)( (char *)__mptr - offsetof(type,member) );})
+#endif
+
+#define KEY_TYPE_NA		0x0
+#define KEY_TYPE_WEP40 		0x1
+#define KEY_TYPE_TKIP		0x2
+#define KEY_TYPE_CCMP		0x4
+#define KEY_TYPE_WEP104		0x5
+
+/* added for rtl819x tx procedure */
+#define MAX_QUEUE_SIZE		0x10
+
+//
+// 8190 queue mapping
+//
+#define BK_QUEUE                               0
+#define BE_QUEUE                               1
+#define VI_QUEUE                               2
+#define VO_QUEUE                               3
+#define HCCA_QUEUE                             4
+#define TXCMD_QUEUE                            5
+#define MGNT_QUEUE                             6
+#define HIGH_QUEUE                             7
+#define BEACON_QUEUE                           8
+
+#define LOW_QUEUE                              BE_QUEUE
+#define NORMAL_QUEUE                           MGNT_QUEUE
+
+//added by amy for ps
+#define SWRF_TIMEOUT				50
+
+//added by amy for LEAP related
+#define IE_CISCO_FLAG_POSITION		0x08	// Flag byte: byte 8, numbered from 0.
+#define SUPPORT_CKIP_MIC			0x08	// bit3
+#define SUPPORT_CKIP_PK			0x10	// bit4
+/* defined for skb cb field */
+/* At most 28 byte */
+typedef struct cb_desc {
+	/* Tx Desc Related flags (8-9) */
+	u8 bLastIniPkt:1;
+	u8 bCmdOrInit:1;
+	u8 bFirstSeg:1;
+	u8 bLastSeg:1;
+	u8 bEncrypt:1;
+	u8 bTxDisableRateFallBack:1;
+	u8 bTxUseDriverAssingedRate:1;
+	u8 bHwSec:1; //indicate whether use Hw security. WB
+
+	u8 reserved1;
+
+	/* Tx Firmware Relaged flags (10-11)*/
+	u8 bCTSEnable:1;
+	u8 bRTSEnable:1;
+	u8 bUseShortGI:1;
+	u8 bUseShortPreamble:1;
+	u8 bTxEnableFwCalcDur:1;
+	u8 bAMPDUEnable:1;
+	u8 bRTSSTBC:1;
+	u8 RTSSC:1;
+
+	u8 bRTSBW:1;
+	u8 bPacketBW:1;
+	u8 bRTSUseShortPreamble:1;
+	u8 bRTSUseShortGI:1;
+	u8 bMulticast:1;
+	u8 bBroadcast:1;
+	//u8 reserved2:2;
+	u8 drv_agg_enable:1;
+	u8 reserved2:1;
+
+	/* Tx Desc related element(12-19) */
+	u8 rata_index;
+	u8 queue_index;
+	//u8 reserved3;
+	//u8 reserved4;
+	u16 txbuf_size;
+	//u8 reserved5;
+	u8 RATRIndex;
+	u8 reserved6;
+	u8 reserved7;
+	u8 reserved8;
+
+	/* Tx firmware related element(20-27) */
+	u8 data_rate;
+	u8 rts_rate;
+	u8 ampdu_factor;
+	u8 ampdu_density;
+	//u8 reserved9;
+	//u8 reserved10;
+	//u8 reserved11;
+	u8 DrvAggrNum;
+	u16 pkt_size;
+	u8 reserved12;
+}cb_desc, *pcb_desc;
+
+/*--------------------------Define -------------------------------------------*/
+#define MGN_1M                  0x02
+#define MGN_2M                  0x04
+#define MGN_5_5M                0x0b
+#define MGN_11M                 0x16
+
+#define MGN_6M                  0x0c
+#define MGN_9M                  0x12
+#define MGN_12M                 0x18
+#define MGN_18M                 0x24
+#define MGN_24M                 0x30
+#define MGN_36M                 0x48
+#define MGN_48M                 0x60
+#define MGN_54M                 0x6c
+
+#define MGN_MCS0                0x80
+#define MGN_MCS1                0x81
+#define MGN_MCS2                0x82
+#define MGN_MCS3                0x83
+#define MGN_MCS4                0x84
+#define MGN_MCS5                0x85
+#define MGN_MCS6                0x86
+#define MGN_MCS7                0x87
+#define MGN_MCS8                0x88
+#define MGN_MCS9                0x89
+#define MGN_MCS10               0x8a
+#define MGN_MCS11               0x8b
+#define MGN_MCS12               0x8c
+#define MGN_MCS13               0x8d
+#define MGN_MCS14               0x8e
+#define MGN_MCS15               0x8f
+
+//----------------------------------------------------------------------------
+//		802.11 Management frame Reason Code field
+//----------------------------------------------------------------------------
+enum	_ReasonCode{
+	unspec_reason	= 0x1,
+	auth_not_valid	= 0x2,
+	deauth_lv_ss	= 0x3,
+	inactivity		= 0x4,
+	ap_overload 	= 0x5,
+	class2_err		= 0x6,
+	class3_err		= 0x7,
+	disas_lv_ss 	= 0x8,
+	asoc_not_auth	= 0x9,
+
+	//----MIC_CHECK
+	mic_failure 	= 0xe,
+	//----END MIC_CHECK
+
+	// Reason code defined in 802.11i D10.0 p.28.
+	invalid_IE		= 0x0d,
+	four_way_tmout	= 0x0f,
+	two_way_tmout	= 0x10,
+	IE_dismatch 	= 0x11,
+	invalid_Gcipher = 0x12,
+	invalid_Pcipher = 0x13,
+	invalid_AKMP	= 0x14,
+	unsup_RSNIEver = 0x15,
+	invalid_RSNIE	= 0x16,
+	auth_802_1x_fail= 0x17,
+	ciper_reject		= 0x18,
+
+	// Reason code defined in 7.3.1.7, 802.1e D13.0, p.42. Added by Annie, 2005-11-15.
+	QoS_unspec		= 0x20, // 32
+	QAP_bandwidth	= 0x21, // 33
+	poor_condition	= 0x22, // 34
+	no_facility 	= 0x23, // 35
+							// Where is 36???
+	req_declined	= 0x25, // 37
+	invalid_param	= 0x26, // 38
+	req_not_honored= 0x27,	// 39
+	TS_not_created	= 0x2F, // 47
+	DL_not_allowed	= 0x30, // 48
+	dest_not_exist	= 0x31, // 49
+	dest_not_QSTA	= 0x32, // 50
+};
+
+
+
+#define aSifsTime	 ((priv->ieee80211->current_network.mode == IEEE_A)||(priv->ieee80211->current_network.mode == IEEE_N_24G)||(priv->ieee80211->current_network.mode == IEEE_N_5G))? 16 : 10
+
+#define MGMT_QUEUE_NUM 5
+
+#define IEEE_CMD_SET_WPA_PARAM			1
+#define	IEEE_CMD_SET_WPA_IE			2
+#define IEEE_CMD_SET_ENCRYPTION			3
+#define IEEE_CMD_MLME				4
+
+#define IEEE_PARAM_WPA_ENABLED			1
+#define IEEE_PARAM_TKIP_COUNTERMEASURES		2
+#define IEEE_PARAM_DROP_UNENCRYPTED		3
+#define IEEE_PARAM_PRIVACY_INVOKED		4
+#define IEEE_PARAM_AUTH_ALGS			5
+#define IEEE_PARAM_IEEE_802_1X			6
+//It should consistent with the driver_XXX.c
+//   David, 2006.9.26
+#define IEEE_PARAM_WPAX_SELECT			7
+//Added for notify the encryption type selection
+//   David, 2006.9.26
+#define IEEE_PROTO_WPA				1
+#define IEEE_PROTO_RSN				2
+//Added for notify the encryption type selection
+//   David, 2006.9.26
+#define IEEE_WPAX_USEGROUP			0
+#define IEEE_WPAX_WEP40				1
+#define IEEE_WPAX_TKIP				2
+#define IEEE_WPAX_WRAP   			3
+#define IEEE_WPAX_CCMP				4
+#define IEEE_WPAX_WEP104			5
+
+#define IEEE_KEY_MGMT_IEEE8021X			1
+#define IEEE_KEY_MGMT_PSK			2
+
+#define IEEE_MLME_STA_DEAUTH			1
+#define IEEE_MLME_STA_DISASSOC			2
+
+
+#define IEEE_CRYPT_ERR_UNKNOWN_ALG		2
+#define IEEE_CRYPT_ERR_UNKNOWN_ADDR		3
+#define IEEE_CRYPT_ERR_CRYPT_INIT_FAILED	4
+#define IEEE_CRYPT_ERR_KEY_SET_FAILED		5
+#define IEEE_CRYPT_ERR_TX_KEY_SET_FAILED	6
+#define IEEE_CRYPT_ERR_CARD_CONF_FAILED		7
+
+
+#define	IEEE_CRYPT_ALG_NAME_LEN			16
+
+#define MAX_IE_LEN  0xff
+
+// added for kernel conflict
+#define ieee80211_crypt_deinit_entries 	ieee80211_crypt_deinit_entries_rsl
+#define ieee80211_crypt_deinit_handler 	ieee80211_crypt_deinit_handler_rsl
+#define ieee80211_crypt_delayed_deinit 	ieee80211_crypt_delayed_deinit_rsl
+#define ieee80211_register_crypto_ops  	ieee80211_register_crypto_ops_rsl
+#define ieee80211_unregister_crypto_ops ieee80211_unregister_crypto_ops_rsl
+#define ieee80211_get_crypto_ops 	ieee80211_get_crypto_ops_rsl
+
+#define ieee80211_ccmp_null		ieee80211_ccmp_null_rsl
+
+#define ieee80211_tkip_null		ieee80211_tkip_null_rsl
+
+#define ieee80211_wep_null		ieee80211_wep_null_rsl
+
+#define free_ieee80211          	free_ieee80211_rsl
+#define alloc_ieee80211        		alloc_ieee80211_rsl
+
+#define ieee80211_rx 			ieee80211_rx_rsl
+#define ieee80211_rx_mgt		ieee80211_rx_mgt_rsl
+
+#define ieee80211_get_beacon		ieee80211_get_beacon_rsl
+#define ieee80211_wake_queue		ieee80211_wake_queue_rsl
+#define ieee80211_stop_queue		ieee80211_stop_queue_rsl
+#define ieee80211_reset_queue		ieee80211_reset_queue_rsl
+#define ieee80211_softmac_stop_protocol	ieee80211_softmac_stop_protocol_rsl
+#define ieee80211_softmac_start_protocol ieee80211_softmac_start_protocol_rsl
+#define ieee80211_is_shortslot		ieee80211_is_shortslot_rsl
+#define ieee80211_is_54g		ieee80211_is_54g_rsl
+#define ieee80211_wpa_supplicant_ioctl	ieee80211_wpa_supplicant_ioctl_rsl
+#define ieee80211_ps_tx_ack		ieee80211_ps_tx_ack_rsl
+#define ieee80211_softmac_xmit		ieee80211_softmac_xmit_rsl
+#define ieee80211_stop_send_beacons	ieee80211_stop_send_beacons_rsl
+#define notify_wx_assoc_event		notify_wx_assoc_event_rsl
+#define SendDisassociation		SendDisassociation_rsl
+#define ieee80211_disassociate		ieee80211_disassociate_rsl
+#define ieee80211_start_send_beacons	ieee80211_start_send_beacons_rsl
+#define ieee80211_stop_scan		ieee80211_stop_scan_rsl
+#define ieee80211_send_probe_requests	ieee80211_send_probe_requests_rsl
+#define ieee80211_softmac_scan_syncro	ieee80211_softmac_scan_syncro_rsl
+#define ieee80211_start_scan_syncro	ieee80211_start_scan_syncro_rsl
+
+#define ieee80211_wx_get_essid		ieee80211_wx_get_essid_rsl
+#define ieee80211_wx_set_essid		ieee80211_wx_set_essid_rsl
+#define ieee80211_wx_set_rate		ieee80211_wx_set_rate_rsl
+#define ieee80211_wx_get_rate		ieee80211_wx_get_rate_rsl
+#define ieee80211_wx_set_wap		ieee80211_wx_set_wap_rsl
+#define ieee80211_wx_get_wap		ieee80211_wx_get_wap_rsl
+#define ieee80211_wx_set_mode		ieee80211_wx_set_mode_rsl
+#define ieee80211_wx_get_mode		ieee80211_wx_get_mode_rsl
+#define ieee80211_wx_set_scan		ieee80211_wx_set_scan_rsl
+#define ieee80211_wx_get_freq		ieee80211_wx_get_freq_rsl
+#define ieee80211_wx_set_freq		ieee80211_wx_set_freq_rsl
+#define ieee80211_wx_set_rawtx		ieee80211_wx_set_rawtx_rsl
+#define ieee80211_wx_get_name		ieee80211_wx_get_name_rsl
+#define ieee80211_wx_set_power		ieee80211_wx_set_power_rsl
+#define ieee80211_wx_get_power		ieee80211_wx_get_power_rsl
+#define ieee80211_wlan_frequencies	ieee80211_wlan_frequencies_rsl
+#define ieee80211_wx_set_rts		ieee80211_wx_set_rts_rsl
+#define ieee80211_wx_get_rts		ieee80211_wx_get_rts_rsl
+
+#define ieee80211_txb_free		ieee80211_txb_free_rsl
+
+#define ieee80211_wx_set_gen_ie		ieee80211_wx_set_gen_ie_rsl
+#define ieee80211_wx_get_scan		ieee80211_wx_get_scan_rsl
+#define ieee80211_wx_set_encode		ieee80211_wx_set_encode_rsl
+#define ieee80211_wx_get_encode		ieee80211_wx_get_encode_rsl
+#if WIRELESS_EXT >= 18
+#define ieee80211_wx_set_mlme		ieee80211_wx_set_mlme_rsl
+#define ieee80211_wx_set_auth		ieee80211_wx_set_auth_rsl
+#define ieee80211_wx_set_encode_ext	ieee80211_wx_set_encode_ext_rsl
+#define ieee80211_wx_get_encode_ext	ieee80211_wx_get_encode_ext_rsl
+#endif
+
+
+typedef struct ieee_param {
+	u32 cmd;
+	u8 sta_addr[ETH_ALEN];
+	union {
+		struct {
+			u8 name;
+			u32 value;
+		} wpa_param;
+		struct {
+			u32 len;
+			u8 reserved[32];
+			u8 data[0];
+		} wpa_ie;
+		struct{
+			int command;
+			int reason_code;
+		} mlme;
+		struct {
+			u8 alg[IEEE_CRYPT_ALG_NAME_LEN];
+			u8 set_tx;
+			u32 err;
+			u8 idx;
+			u8 seq[8]; /* sequence counter (set: RX, get: TX) */
+			u16 key_len;
+			u8 key[0];
+		} crypt;
+	} u;
+}ieee_param;
+
+
+#if WIRELESS_EXT < 17
+#define IW_QUAL_QUAL_INVALID   0x10
+#define IW_QUAL_LEVEL_INVALID  0x20
+#define IW_QUAL_NOISE_INVALID  0x40
+#define IW_QUAL_QUAL_UPDATED   0x1
+#define IW_QUAL_LEVEL_UPDATED  0x2
+#define IW_QUAL_NOISE_UPDATED  0x4
+#endif
+
+
+// linux under 2.6.9 release may not support it, so modify it for common use
+#define MSECS(t) msecs_to_jiffies(t)
+#define msleep_interruptible_rsl  msleep_interruptible
+
+#define IEEE80211_DATA_LEN		2304
+/* Maximum size for the MA-UNITDATA primitive, 802.11 standard section
+   6.2.1.1.2.
+
+   The figure in section 7.1.2 suggests a body size of up to 2312
+   bytes is allowed, which is a bit confusing, I suspect this
+   represents the 2304 bytes of real data, plus a possible 8 bytes of
+   WEP IV and ICV. (this interpretation suggested by Ramiro Barreiro) */
+#define IEEE80211_1ADDR_LEN 10
+#define IEEE80211_2ADDR_LEN 16
+#define IEEE80211_3ADDR_LEN 24
+#define IEEE80211_4ADDR_LEN 30
+#define IEEE80211_FCS_LEN    4
+#define IEEE80211_HLEN                  (IEEE80211_4ADDR_LEN)
+#define IEEE80211_FRAME_LEN             (IEEE80211_DATA_LEN + IEEE80211_HLEN)
+#define IEEE80211_MGMT_HDR_LEN 24
+#define IEEE80211_DATA_HDR3_LEN 24
+#define IEEE80211_DATA_HDR4_LEN 30
+
+#define MIN_FRAG_THRESHOLD     256U
+#define MAX_FRAG_THRESHOLD     2346U
+
+
+/* Frame control field constants */
+#define IEEE80211_FCTL_VERS		0x0003
+#define IEEE80211_FCTL_FTYPE		0x000c
+#define IEEE80211_FCTL_STYPE		0x00f0
+#define IEEE80211_FCTL_FRAMETYPE	0x00fc
+#define IEEE80211_FCTL_TODS		0x0100
+#define IEEE80211_FCTL_FROMDS		0x0200
+#define IEEE80211_FCTL_DSTODS		0x0300 //added by david
+#define IEEE80211_FCTL_MOREFRAGS	0x0400
+#define IEEE80211_FCTL_RETRY		0x0800
+#define IEEE80211_FCTL_PM		0x1000
+#define IEEE80211_FCTL_MOREDATA		0x2000
+#define IEEE80211_FCTL_WEP		0x4000
+#define IEEE80211_FCTL_ORDER		0x8000
+
+#define IEEE80211_FTYPE_MGMT		0x0000
+#define IEEE80211_FTYPE_CTL		0x0004
+#define IEEE80211_FTYPE_DATA		0x0008
+
+/* management */
+#define IEEE80211_STYPE_ASSOC_REQ	0x0000
+#define IEEE80211_STYPE_ASSOC_RESP 	0x0010
+#define IEEE80211_STYPE_REASSOC_REQ	0x0020
+#define IEEE80211_STYPE_REASSOC_RESP	0x0030
+#define IEEE80211_STYPE_PROBE_REQ	0x0040
+#define IEEE80211_STYPE_PROBE_RESP	0x0050
+#define IEEE80211_STYPE_BEACON		0x0080
+#define IEEE80211_STYPE_ATIM		0x0090
+#define IEEE80211_STYPE_DISASSOC	0x00A0
+#define IEEE80211_STYPE_AUTH		0x00B0
+#define IEEE80211_STYPE_DEAUTH		0x00C0
+#define IEEE80211_STYPE_MANAGE_ACT	0x00D0
+
+/* control */
+#define IEEE80211_STYPE_PSPOLL		0x00A0
+#define IEEE80211_STYPE_RTS		0x00B0
+#define IEEE80211_STYPE_CTS		0x00C0
+#define IEEE80211_STYPE_ACK		0x00D0
+#define IEEE80211_STYPE_CFEND		0x00E0
+#define IEEE80211_STYPE_CFENDACK	0x00F0
+#define IEEE80211_STYPE_BLOCKACK   0x0094
+
+/* data */
+#define IEEE80211_STYPE_DATA		0x0000
+#define IEEE80211_STYPE_DATA_CFACK	0x0010
+#define IEEE80211_STYPE_DATA_CFPOLL	0x0020
+#define IEEE80211_STYPE_DATA_CFACKPOLL	0x0030
+#define IEEE80211_STYPE_NULLFUNC	0x0040
+#define IEEE80211_STYPE_CFACK		0x0050
+#define IEEE80211_STYPE_CFPOLL		0x0060
+#define IEEE80211_STYPE_CFACKPOLL	0x0070
+#define IEEE80211_STYPE_QOS_DATA	0x0080 //added for WMM 2006/8/2
+#define IEEE80211_STYPE_QOS_NULL	0x00C0
+
+#define IEEE80211_SCTL_FRAG		0x000F
+#define IEEE80211_SCTL_SEQ		0xFFF0
+
+/* QOS control */
+#define IEEE80211_QCTL_TID              0x000F
+
+#define	FC_QOS_BIT					BIT7
+#define IsDataFrame(pdu)			( ((pdu[0] & 0x0C)==0x08) ? true : false )
+#define	IsLegacyDataFrame(pdu)	(IsDataFrame(pdu) && (!(pdu[0]&FC_QOS_BIT)) )
+//added by wb. Is this right?
+#define IsQoSDataFrame(pframe)  ((*(u16*)pframe&(IEEE80211_STYPE_QOS_DATA|IEEE80211_FTYPE_DATA)) == (IEEE80211_STYPE_QOS_DATA|IEEE80211_FTYPE_DATA))
+#define Frame_Order(pframe)     (*(u16*)pframe&IEEE80211_FCTL_ORDER)
+#define SN_LESS(a, b)		(((a-b)&0x800)!=0)
+#define SN_EQUAL(a, b)	(a == b)
+#define MAX_DEV_ADDR_SIZE 8
+typedef enum _ACT_CATEGORY{
+	ACT_CAT_QOS = 1,
+	ACT_CAT_DLS = 2,
+	ACT_CAT_BA  = 3,
+	ACT_CAT_HT  = 7,
+	ACT_CAT_WMM = 17,
+} ACT_CATEGORY, *PACT_CATEGORY;
+
+typedef enum _TS_ACTION{
+	ACT_ADDTSREQ = 0,
+	ACT_ADDTSRSP = 1,
+	ACT_DELTS    = 2,
+	ACT_SCHEDULE = 3,
+} TS_ACTION, *PTS_ACTION;
+
+typedef enum _BA_ACTION{
+	ACT_ADDBAREQ = 0,
+	ACT_ADDBARSP = 1,
+	ACT_DELBA    = 2,
+} BA_ACTION, *PBA_ACTION;
+
+typedef enum _InitialGainOpType{
+	IG_Backup=0,
+	IG_Restore,
+	IG_Max
+}InitialGainOpType;
+
+/* debug macros */
+#define CONFIG_IEEE80211_DEBUG
+#ifdef CONFIG_IEEE80211_DEBUG
+extern u32 ieee80211_debug_level;
+#define IEEE80211_DEBUG(level, fmt, args...) \
+do { if (ieee80211_debug_level & (level)) \
+  printk(KERN_DEBUG "ieee80211: " fmt, ## args); } while (0)
+//wb added to debug out data buf
+//if you want print DATA buffer related BA, please set ieee80211_debug_level to DATA|BA
+#define IEEE80211_DEBUG_DATA(level, data, datalen)	\
+	do{ if ((ieee80211_debug_level & (level)) == (level))	\
+		{ 	\
+			int i;					\
+			u8* pdata = (u8*) data;			\
+			printk(KERN_DEBUG "ieee80211: %s()\n", __FUNCTION__);	\
+			for(i=0; i<(int)(datalen); i++)			\
+			{						\
+				printk("%2x ", pdata[i]);		\
+				if ((i+1)%16 == 0) printk("\n");	\
+			}				\
+			printk("\n");			\
+		}					\
+	} while (0)
+#else
+#define IEEE80211_DEBUG(level, fmt, args...) do {} while (0)
+#define IEEE80211_DEBUG_DATA(level, data, datalen) do {} while(0)
+#endif	/* CONFIG_IEEE80211_DEBUG */
+
+/* debug macros not dependent on CONFIG_IEEE80211_DEBUG */
+
+#define MAC_FMT "%02x:%02x:%02x:%02x:%02x:%02x"
+#define MAC_ARG(x) ((u8*)(x))[0],((u8*)(x))[1],((u8*)(x))[2],((u8*)(x))[3],((u8*)(x))[4],((u8*)(x))[5]
+
+/*
+ * To use the debug system;
+ *
+ * If you are defining a new debug classification, simply add it to the #define
+ * list here in the form of:
+ *
+ * #define IEEE80211_DL_xxxx VALUE
+ *
+ * shifting value to the left one bit from the previous entry.  xxxx should be
+ * the name of the classification (for example, WEP)
+ *
+ * You then need to either add a IEEE80211_xxxx_DEBUG() macro definition for your
+ * classification, or use IEEE80211_DEBUG(IEEE80211_DL_xxxx, ...) whenever you want
+ * to send output to that classification.
+ *
+ * To add your debug level to the list of levels seen when you perform
+ *
+ * % cat /proc/net/ipw/debug_level
+ *
+ * you simply need to add your entry to the ipw_debug_levels array.
+ *
+ * If you do not see debug_level in /proc/net/ipw then you do not have
+ * CONFIG_IEEE80211_DEBUG defined in your kernel configuration
+ *
+ */
+
+#define IEEE80211_DL_INFO          (1<<0)
+#define IEEE80211_DL_WX            (1<<1)
+#define IEEE80211_DL_SCAN          (1<<2)
+#define IEEE80211_DL_STATE         (1<<3)
+#define IEEE80211_DL_MGMT          (1<<4)
+#define IEEE80211_DL_FRAG          (1<<5)
+#define IEEE80211_DL_EAP           (1<<6)
+#define IEEE80211_DL_DROP          (1<<7)
+
+#define IEEE80211_DL_TX            (1<<8)
+#define IEEE80211_DL_RX            (1<<9)
+
+#define IEEE80211_DL_HT		   (1<<10)  //HT
+#define IEEE80211_DL_BA		   (1<<11)  //ba
+#define IEEE80211_DL_TS		   (1<<12)  //TS
+#define IEEE80211_DL_QOS           (1<<13)
+#define IEEE80211_DL_REORDER	   (1<<14)
+#define IEEE80211_DL_IOT	   (1<<15)
+#define IEEE80211_DL_IPS	   (1<<16)
+#define IEEE80211_DL_TRACE	   (1<<29)  //trace function, need to user net_ratelimit() together in order not to print too much to the screen
+#define IEEE80211_DL_DATA	   (1<<30)   //use this flag to control whether print data buf out.
+#define IEEE80211_DL_ERR	   (1<<31)   //always open
+#define IEEE80211_ERROR(f, a...) printk(KERN_ERR "ieee80211: " f, ## a)
+#define IEEE80211_WARNING(f, a...) printk(KERN_WARNING "ieee80211: " f, ## a)
+#define IEEE80211_DEBUG_INFO(f, a...)   IEEE80211_DEBUG(IEEE80211_DL_INFO, f, ## a)
+
+#define IEEE80211_DEBUG_WX(f, a...)     IEEE80211_DEBUG(IEEE80211_DL_WX, f, ## a)
+#define IEEE80211_DEBUG_SCAN(f, a...)   IEEE80211_DEBUG(IEEE80211_DL_SCAN, f, ## a)
+#define IEEE80211_DEBUG_STATE(f, a...)  IEEE80211_DEBUG(IEEE80211_DL_STATE, f, ## a)
+#define IEEE80211_DEBUG_MGMT(f, a...)  IEEE80211_DEBUG(IEEE80211_DL_MGMT, f, ## a)
+#define IEEE80211_DEBUG_FRAG(f, a...)  IEEE80211_DEBUG(IEEE80211_DL_FRAG, f, ## a)
+#define IEEE80211_DEBUG_EAP(f, a...)  IEEE80211_DEBUG(IEEE80211_DL_EAP, f, ## a)
+#define IEEE80211_DEBUG_DROP(f, a...)  IEEE80211_DEBUG(IEEE80211_DL_DROP, f, ## a)
+#define IEEE80211_DEBUG_TX(f, a...)  IEEE80211_DEBUG(IEEE80211_DL_TX, f, ## a)
+#define IEEE80211_DEBUG_RX(f, a...)  IEEE80211_DEBUG(IEEE80211_DL_RX, f, ## a)
+#define IEEE80211_DEBUG_QOS(f, a...)  IEEE80211_DEBUG(IEEE80211_DL_QOS, f, ## a)
+
+#ifdef CONFIG_IEEE80211_DEBUG
+/* Added by Annie, 2005-11-22. */
+#define MAX_STR_LEN     64
+/* I want to see ASCII 33 to 126 only. Otherwise, I print '?'. Annie, 2005-11-22.*/
+#define PRINTABLE(_ch)  (_ch>'!' && _ch<'~')
+#define IEEE80211_PRINT_STR(_Comp, _TitleString, _Ptr, _Len)                            	\
+			if((_Comp) & level)   							\
+			{                                                                       \
+				int             __i;                                            \
+				u8  buffer[MAX_STR_LEN];                                    	\
+				int length = (_Len<MAX_STR_LEN)? _Len : (MAX_STR_LEN-1) ;  	\
+				memset(buffer, 0, MAX_STR_LEN);                      		\
+				memcpy(buffer, (u8 *)_Ptr, length );            		\
+				for( __i=0; __i<MAX_STR_LEN; __i++ )                            \
+				{                                                               \
+				     if( !PRINTABLE(buffer[__i]) )   buffer[__i] = '?';     	\
+				}                                                               \
+				buffer[length] = '\0';                                          \
+				printk("Rtl819x: ");                                         	\
+				printk(_TitleString);                                         \
+				printk(": %d, <%s>\n", _Len, buffer);                         \
+			}
+#else
+#define IEEE80211_PRINT_STR(_Comp, _TitleString, _Ptr, _Len)  do {} while (0)
+#endif
+
+#include <linux/netdevice.h>
+#include <linux/if_arp.h> /* ARPHRD_ETHER */
+
+#ifndef WIRELESS_SPY
+#define WIRELESS_SPY		// enable iwspy support
+#endif
+#include <net/iw_handler.h>	// new driver API
+
+#ifndef ETH_P_PAE
+#define ETH_P_PAE 0x888E /* Port Access Entity (IEEE 802.1X) */
+#endif /* ETH_P_PAE */
+
+#define ETH_P_PREAUTH 0x88C7 /* IEEE 802.11i pre-authentication */
+
+#ifndef ETH_P_80211_RAW
+#define ETH_P_80211_RAW (ETH_P_ECONET + 1)
+#endif
+
+/* IEEE 802.11 defines */
+
+#define P80211_OUI_LEN 3
+
+struct ieee80211_snap_hdr {
+
+	u8    dsap;   /* always 0xAA */
+	u8    ssap;   /* always 0xAA */
+	u8    ctrl;   /* always 0x03 */
+	u8    oui[P80211_OUI_LEN];    /* organizational universal id */
+
+} __attribute__ ((packed));
+
+#define SNAP_SIZE sizeof(struct ieee80211_snap_hdr)
+
+#define WLAN_FC_GET_VERS(fc) ((fc) & IEEE80211_FCTL_VERS)
+#define WLAN_FC_GET_TYPE(fc) ((fc) & IEEE80211_FCTL_FTYPE)
+#define WLAN_FC_GET_STYPE(fc) ((fc) & IEEE80211_FCTL_STYPE)
+
+#define WLAN_FC_GET_FRAMETYPE(fc) ((fc) & IEEE80211_FCTL_FRAMETYPE)
+#define WLAN_GET_SEQ_FRAG(seq) ((seq) & IEEE80211_SCTL_FRAG)
+#define WLAN_GET_SEQ_SEQ(seq)  (((seq) & IEEE80211_SCTL_SEQ) >> 4)
+
+/* Authentication algorithms */
+#define WLAN_AUTH_OPEN 0
+#define WLAN_AUTH_SHARED_KEY 1
+#define WLAN_AUTH_LEAP 2
+
+#define WLAN_AUTH_CHALLENGE_LEN 128
+
+#define WLAN_CAPABILITY_BSS (1<<0)
+#define WLAN_CAPABILITY_IBSS (1<<1)
+#define WLAN_CAPABILITY_CF_POLLABLE (1<<2)
+#define WLAN_CAPABILITY_CF_POLL_REQUEST (1<<3)
+#define WLAN_CAPABILITY_PRIVACY (1<<4)
+#define WLAN_CAPABILITY_SHORT_PREAMBLE (1<<5)
+#define WLAN_CAPABILITY_PBCC (1<<6)
+#define WLAN_CAPABILITY_CHANNEL_AGILITY (1<<7)
+#define WLAN_CAPABILITY_SPECTRUM_MGMT (1<<8)
+#define WLAN_CAPABILITY_QOS (1<<9)
+#define WLAN_CAPABILITY_SHORT_SLOT (1<<10)
+#define WLAN_CAPABILITY_DSSS_OFDM (1<<13)
+
+/* 802.11g ERP information element */
+#define WLAN_ERP_NON_ERP_PRESENT (1<<0)
+#define WLAN_ERP_USE_PROTECTION (1<<1)
+#define WLAN_ERP_BARKER_PREAMBLE (1<<2)
+
+/* Status codes */
+enum ieee80211_statuscode {
+	WLAN_STATUS_SUCCESS = 0,
+	WLAN_STATUS_UNSPECIFIED_FAILURE = 1,
+	WLAN_STATUS_CAPS_UNSUPPORTED = 10,
+	WLAN_STATUS_REASSOC_NO_ASSOC = 11,
+	WLAN_STATUS_ASSOC_DENIED_UNSPEC = 12,
+	WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG = 13,
+	WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION = 14,
+	WLAN_STATUS_CHALLENGE_FAIL = 15,
+	WLAN_STATUS_AUTH_TIMEOUT = 16,
+	WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA = 17,
+	WLAN_STATUS_ASSOC_DENIED_RATES = 18,
+	/* 802.11b */
+	WLAN_STATUS_ASSOC_DENIED_NOSHORTPREAMBLE = 19,
+	WLAN_STATUS_ASSOC_DENIED_NOPBCC = 20,
+	WLAN_STATUS_ASSOC_DENIED_NOAGILITY = 21,
+	/* 802.11h */
+	WLAN_STATUS_ASSOC_DENIED_NOSPECTRUM = 22,
+	WLAN_STATUS_ASSOC_REJECTED_BAD_POWER = 23,
+	WLAN_STATUS_ASSOC_REJECTED_BAD_SUPP_CHAN = 24,
+	/* 802.11g */
+	WLAN_STATUS_ASSOC_DENIED_NOSHORTTIME = 25,
+	WLAN_STATUS_ASSOC_DENIED_NODSSSOFDM = 26,
+	/* 802.11i */
+	WLAN_STATUS_INVALID_IE = 40,
+	WLAN_STATUS_INVALID_GROUP_CIPHER = 41,
+	WLAN_STATUS_INVALID_PAIRWISE_CIPHER = 42,
+	WLAN_STATUS_INVALID_AKMP = 43,
+	WLAN_STATUS_UNSUPP_RSN_VERSION = 44,
+	WLAN_STATUS_INVALID_RSN_IE_CAP = 45,
+	WLAN_STATUS_CIPHER_SUITE_REJECTED = 46,
+};
+
+/* Reason codes */
+enum ieee80211_reasoncode {
+	WLAN_REASON_UNSPECIFIED = 1,
+	WLAN_REASON_PREV_AUTH_NOT_VALID = 2,
+	WLAN_REASON_DEAUTH_LEAVING = 3,
+	WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY = 4,
+	WLAN_REASON_DISASSOC_AP_BUSY = 5,
+	WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA = 6,
+	WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA = 7,
+	WLAN_REASON_DISASSOC_STA_HAS_LEFT = 8,
+	WLAN_REASON_STA_REQ_ASSOC_WITHOUT_AUTH = 9,
+	/* 802.11h */
+	WLAN_REASON_DISASSOC_BAD_POWER = 10,
+	WLAN_REASON_DISASSOC_BAD_SUPP_CHAN = 11,
+	/* 802.11i */
+	WLAN_REASON_INVALID_IE = 13,
+	WLAN_REASON_MIC_FAILURE = 14,
+	WLAN_REASON_4WAY_HANDSHAKE_TIMEOUT = 15,
+	WLAN_REASON_GROUP_KEY_HANDSHAKE_TIMEOUT = 16,
+	WLAN_REASON_IE_DIFFERENT = 17,
+	WLAN_REASON_INVALID_GROUP_CIPHER = 18,
+	WLAN_REASON_INVALID_PAIRWISE_CIPHER = 19,
+	WLAN_REASON_INVALID_AKMP = 20,
+	WLAN_REASON_UNSUPP_RSN_VERSION = 21,
+	WLAN_REASON_INVALID_RSN_IE_CAP = 22,
+	WLAN_REASON_IEEE8021X_FAILED = 23,
+	WLAN_REASON_CIPHER_SUITE_REJECTED = 24,
+};
+
+#define IEEE80211_STATMASK_SIGNAL (1<<0)
+#define IEEE80211_STATMASK_RSSI (1<<1)
+#define IEEE80211_STATMASK_NOISE (1<<2)
+#define IEEE80211_STATMASK_RATE (1<<3)
+#define IEEE80211_STATMASK_WEMASK 0x7
+
+#define IEEE80211_CCK_MODULATION    (1<<0)
+#define IEEE80211_OFDM_MODULATION   (1<<1)
+
+#define IEEE80211_24GHZ_BAND     (1<<0)
+#define IEEE80211_52GHZ_BAND     (1<<1)
+
+#define IEEE80211_CCK_RATE_LEN  		4
+#define IEEE80211_CCK_RATE_1MB			0x02
+#define IEEE80211_CCK_RATE_2MB			0x04
+#define IEEE80211_CCK_RATE_5MB			0x0B
+#define IEEE80211_CCK_RATE_11MB			0x16
+#define IEEE80211_OFDM_RATE_LEN 		8
+#define IEEE80211_OFDM_RATE_6MB			0x0C
+#define IEEE80211_OFDM_RATE_9MB			0x12
+#define IEEE80211_OFDM_RATE_12MB		0x18
+#define IEEE80211_OFDM_RATE_18MB		0x24
+#define IEEE80211_OFDM_RATE_24MB		0x30
+#define IEEE80211_OFDM_RATE_36MB		0x48
+#define IEEE80211_OFDM_RATE_48MB		0x60
+#define IEEE80211_OFDM_RATE_54MB		0x6C
+#define IEEE80211_BASIC_RATE_MASK		0x80
+
+#define IEEE80211_CCK_RATE_1MB_MASK		(1<<0)
+#define IEEE80211_CCK_RATE_2MB_MASK		(1<<1)
+#define IEEE80211_CCK_RATE_5MB_MASK		(1<<2)
+#define IEEE80211_CCK_RATE_11MB_MASK		(1<<3)
+#define IEEE80211_OFDM_RATE_6MB_MASK		(1<<4)
+#define IEEE80211_OFDM_RATE_9MB_MASK		(1<<5)
+#define IEEE80211_OFDM_RATE_12MB_MASK		(1<<6)
+#define IEEE80211_OFDM_RATE_18MB_MASK		(1<<7)
+#define IEEE80211_OFDM_RATE_24MB_MASK		(1<<8)
+#define IEEE80211_OFDM_RATE_36MB_MASK		(1<<9)
+#define IEEE80211_OFDM_RATE_48MB_MASK		(1<<10)
+#define IEEE80211_OFDM_RATE_54MB_MASK		(1<<11)
+
+#define IEEE80211_CCK_RATES_MASK		0x0000000F
+#define IEEE80211_CCK_BASIC_RATES_MASK	(IEEE80211_CCK_RATE_1MB_MASK | \
+	IEEE80211_CCK_RATE_2MB_MASK)
+#define IEEE80211_CCK_DEFAULT_RATES_MASK	(IEEE80211_CCK_BASIC_RATES_MASK | \
+	IEEE80211_CCK_RATE_5MB_MASK | \
+	IEEE80211_CCK_RATE_11MB_MASK)
+
+#define IEEE80211_OFDM_RATES_MASK		0x00000FF0
+#define IEEE80211_OFDM_BASIC_RATES_MASK	(IEEE80211_OFDM_RATE_6MB_MASK | \
+	IEEE80211_OFDM_RATE_12MB_MASK | \
+	IEEE80211_OFDM_RATE_24MB_MASK)
+#define IEEE80211_OFDM_DEFAULT_RATES_MASK	(IEEE80211_OFDM_BASIC_RATES_MASK | \
+	IEEE80211_OFDM_RATE_9MB_MASK  | \
+	IEEE80211_OFDM_RATE_18MB_MASK | \
+	IEEE80211_OFDM_RATE_36MB_MASK | \
+	IEEE80211_OFDM_RATE_48MB_MASK | \
+	IEEE80211_OFDM_RATE_54MB_MASK)
+#define IEEE80211_DEFAULT_RATES_MASK (IEEE80211_OFDM_DEFAULT_RATES_MASK | \
+				IEEE80211_CCK_DEFAULT_RATES_MASK)
+
+#define IEEE80211_NUM_OFDM_RATES	    8
+#define IEEE80211_NUM_CCK_RATES		    4
+#define IEEE80211_OFDM_SHIFT_MASK_A         4
+
+
+/* this is stolen and modified from the madwifi driver*/
+#define IEEE80211_FC0_TYPE_MASK		0x0c
+#define IEEE80211_FC0_TYPE_DATA		0x08
+#define IEEE80211_FC0_SUBTYPE_MASK	0xB0
+#define IEEE80211_FC0_SUBTYPE_QOS	0x80
+
+#define IEEE80211_QOS_HAS_SEQ(fc) \
+	(((fc) & (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) == \
+	 (IEEE80211_FC0_TYPE_DATA | IEEE80211_FC0_SUBTYPE_QOS))
+
+/* this is stolen from ipw2200 driver */
+#define IEEE_IBSS_MAC_HASH_SIZE 31
+struct ieee_ibss_seq {
+	u8 mac[ETH_ALEN];
+	u16 seq_num[17];
+	u16 frag_num[17];
+	unsigned long packet_time[17];
+	struct list_head list;
+};
+
+/* NOTE: This data is for statistical purposes; not all hardware provides this
+ *       information for frames received.  Not setting these will not cause
+ *       any adverse affects. */
+struct ieee80211_rx_stats {
+	u32 mac_time[2];
+	s8 rssi;
+	u8 signal;
+	u8 noise;
+	u16 rate; /* in 100 kbps */
+	u8 received_channel;
+	u8 control;
+	u8 mask;
+	u8 freq;
+	u16 len;
+	u64 tsf;
+	u32 beacon_time;
+	u8 nic_type;
+	u16       Length;
+	//      u8        DataRate;      // In 0.5 Mbps
+	u8        SignalQuality; // in 0-100 index.
+	s32       RecvSignalPower; // Real power in dBm for this packet, no beautification and aggregation.
+	s8        RxPower; // in dBm Translate from PWdB
+	u8        SignalStrength; // in 0-100 index.
+	u16       bHwError:1;
+	u16       bCRC:1;
+	u16       bICV:1;
+	u16       bShortPreamble:1;
+	u16       Antenna:1;      //for rtl8185
+	u16       Decrypted:1;    //for rtl8185, rtl8187
+	u16       Wakeup:1;       //for rtl8185
+	u16       Reserved0:1;    //for rtl8185
+	u8        AGC;
+	u32       TimeStampLow;
+	u32       TimeStampHigh;
+	bool      bShift;
+	bool      bIsQosData;             // Added by Annie, 2005-12-22.
+	u8        UserPriority;
+
+	//1!!!!!!!!!!!!!!!!!!!!!!!!!!!
+	//1Attention Please!!!<11n or 8190 specific code should be put below this line>
+	//1!!!!!!!!!!!!!!!!!!!!!!!!!!!
+
+	u8        RxDrvInfoSize;
+	u8        RxBufShift;
+	bool      bIsAMPDU;
+	bool      bFirstMPDU;
+	bool      bContainHTC;
+	bool      RxIs40MHzPacket;
+	u32       RxPWDBAll;
+	u8        RxMIMOSignalStrength[4];        // in 0~100 index
+	s8        RxMIMOSignalQuality[2];
+	bool      bPacketMatchBSSID;
+	bool      bIsCCK;
+	bool      bPacketToSelf;
+	//added by amy
+	u8*       virtual_address;
+	u16          packetlength;              // Total packet length: Must equal to sum of all FragLength
+	u16          fraglength;                        // FragLength should equal to PacketLength in non-fragment case
+	u16          fragoffset;                        // Data offset for this fragment
+	u16          ntotalfrag;
+	bool      	  bisrxaggrsubframe;
+	bool		  bPacketBeacon;	//cosa add for rssi
+	bool		  bToSelfBA;		//cosa add for rssi
+	char 	  cck_adc_pwdb[4];	//cosa add for rx path selection
+	u16		  Seq_Num;
+
+};
+
+/* IEEE 802.11 requires that STA supports concurrent reception of at least
+ * three fragmented frames. This define can be increased to support more
+ * concurrent frames, but it should be noted that each entry can consume about
+ * 2 kB of RAM and increasing cache size will slow down frame reassembly. */
+#define IEEE80211_FRAG_CACHE_LEN 4
+
+struct ieee80211_frag_entry {
+	unsigned long first_frag_time;
+	unsigned int seq;
+	unsigned int last_frag;
+	struct sk_buff *skb;
+	u8 src_addr[ETH_ALEN];
+	u8 dst_addr[ETH_ALEN];
+};
+
+struct ieee80211_stats {
+	unsigned int tx_unicast_frames;
+	unsigned int tx_multicast_frames;
+	unsigned int tx_fragments;
+	unsigned int tx_unicast_octets;
+	unsigned int tx_multicast_octets;
+	unsigned int tx_deferred_transmissions;
+	unsigned int tx_single_retry_frames;
+	unsigned int tx_multiple_retry_frames;
+	unsigned int tx_retry_limit_exceeded;
+	unsigned int tx_discards;
+	unsigned int rx_unicast_frames;
+	unsigned int rx_multicast_frames;
+	unsigned int rx_fragments;
+	unsigned int rx_unicast_octets;
+	unsigned int rx_multicast_octets;
+	unsigned int rx_fcs_errors;
+	unsigned int rx_discards_no_buffer;
+	unsigned int tx_discards_wrong_sa;
+	unsigned int rx_discards_undecryptable;
+	unsigned int rx_message_in_msg_fragments;
+	unsigned int rx_message_in_bad_msg_fragments;
+};
+
+struct ieee80211_device;
+
+#include "ieee80211_crypt.h"
+
+#define SEC_KEY_1         (1<<0)
+#define SEC_KEY_2         (1<<1)
+#define SEC_KEY_3         (1<<2)
+#define SEC_KEY_4         (1<<3)
+#define SEC_ACTIVE_KEY    (1<<4)
+#define SEC_AUTH_MODE     (1<<5)
+#define SEC_UNICAST_GROUP (1<<6)
+#define SEC_LEVEL         (1<<7)
+#define SEC_ENABLED       (1<<8)
+#define SEC_ENCRYPT       (1<<9)
+
+#define SEC_LEVEL_0      0 /* None */
+#define SEC_LEVEL_1      1 /* WEP 40 and 104 bit */
+#define SEC_LEVEL_2      2 /* Level 1 + TKIP */
+#define SEC_LEVEL_2_CKIP 3 /* Level 1 + CKIP */
+#define SEC_LEVEL_3      4 /* Level 2 + CCMP */
+
+#define SEC_ALG_NONE            0
+#define SEC_ALG_WEP             1
+#define SEC_ALG_TKIP            2
+#define SEC_ALG_CCMP            3
+
+#define WEP_KEYS 		4
+#define WEP_KEY_LEN		13
+#define SCM_KEY_LEN             32
+#define SCM_TEMPORAL_KEY_LENGTH 16
+
+struct ieee80211_security {
+	u16 active_key:2,
+	    enabled:1,
+	    auth_mode:2,
+	    auth_algo:4,
+	    unicast_uses_group:1,
+	    encrypt:1;
+	u8 key_sizes[WEP_KEYS];
+	u8 keys[WEP_KEYS][SCM_KEY_LEN];
+	u8 level;
+	u16 flags;
+} __attribute__ ((packed));
+
+
+/*
+ 802.11 data frame from AP
+      ,-------------------------------------------------------------------.
+Bytes |  2   |  2   |    6    |    6    |    6    |  2   | 0..2312 |   4  |
+      |------|------|---------|---------|---------|------|---------|------|
+Desc. | ctrl | dura |  DA/RA  |   TA    |    SA   | Sequ |  frame  |  fcs |
+      |      | tion | (BSSID) |         |         | ence |  data   |      |
+      `-------------------------------------------------------------------'
+Total: 28-2340 bytes
+*/
+
+/* Management Frame Information Element Types */
+enum ieee80211_mfie {
+	MFIE_TYPE_SSID = 0,
+	MFIE_TYPE_RATES = 1,
+	MFIE_TYPE_FH_SET = 2,
+	MFIE_TYPE_DS_SET = 3,
+	MFIE_TYPE_CF_SET = 4,
+	MFIE_TYPE_TIM = 5,
+	MFIE_TYPE_IBSS_SET = 6,
+	MFIE_TYPE_COUNTRY = 7,
+	MFIE_TYPE_HOP_PARAMS = 8,
+	MFIE_TYPE_HOP_TABLE = 9,
+	MFIE_TYPE_REQUEST = 10,
+	MFIE_TYPE_CHALLENGE = 16,
+	MFIE_TYPE_POWER_CONSTRAINT = 32,
+	MFIE_TYPE_POWER_CAPABILITY = 33,
+	MFIE_TYPE_TPC_REQUEST = 34,
+	MFIE_TYPE_TPC_REPORT = 35,
+	MFIE_TYPE_SUPP_CHANNELS = 36,
+	MFIE_TYPE_CSA = 37,
+	MFIE_TYPE_MEASURE_REQUEST = 38,
+	MFIE_TYPE_MEASURE_REPORT = 39,
+	MFIE_TYPE_QUIET = 40,
+	MFIE_TYPE_IBSS_DFS = 41,
+	MFIE_TYPE_ERP = 42,
+	MFIE_TYPE_RSN = 48,
+	MFIE_TYPE_RATES_EX = 50,
+	MFIE_TYPE_HT_CAP= 45,
+	 MFIE_TYPE_HT_INFO= 61,
+	 MFIE_TYPE_AIRONET=133,
+	MFIE_TYPE_GENERIC = 221,
+	MFIE_TYPE_QOS_PARAMETER = 222,
+};
+
+/* Minimal header; can be used for passing 802.11 frames with sufficient
+ * information to determine what type of underlying data type is actually
+ * stored in the data. */
+struct ieee80211_hdr {
+	__le16 frame_ctl;
+	__le16 duration_id;
+	u8 payload[0];
+} __attribute__ ((packed));
+
+struct ieee80211_hdr_1addr {
+	__le16 frame_ctl;
+	__le16 duration_id;
+	u8 addr1[ETH_ALEN];
+	u8 payload[0];
+} __attribute__ ((packed));
+
+struct ieee80211_hdr_2addr {
+	__le16 frame_ctl;
+	__le16 duration_id;
+	u8 addr1[ETH_ALEN];
+	u8 addr2[ETH_ALEN];
+	u8 payload[0];
+} __attribute__ ((packed));
+
+struct ieee80211_hdr_3addr {
+	__le16 frame_ctl;
+	__le16 duration_id;
+	u8 addr1[ETH_ALEN];
+	u8 addr2[ETH_ALEN];
+	u8 addr3[ETH_ALEN];
+	__le16 seq_ctl;
+	u8 payload[0];
+} __attribute__ ((packed));
+
+struct ieee80211_hdr_4addr {
+	__le16 frame_ctl;
+	__le16 duration_id;
+	u8 addr1[ETH_ALEN];
+	u8 addr2[ETH_ALEN];
+	u8 addr3[ETH_ALEN];
+	__le16 seq_ctl;
+	u8 addr4[ETH_ALEN];
+	u8 payload[0];
+} __attribute__ ((packed));
+
+struct ieee80211_hdr_3addrqos {
+	__le16 frame_ctl;
+	__le16 duration_id;
+	u8 addr1[ETH_ALEN];
+	u8 addr2[ETH_ALEN];
+	u8 addr3[ETH_ALEN];
+	__le16 seq_ctl;
+	u8 payload[0];
+	__le16 qos_ctl;
+} __attribute__ ((packed));
+
+struct ieee80211_hdr_4addrqos {
+	__le16 frame_ctl;
+	__le16 duration_id;
+	u8 addr1[ETH_ALEN];
+	u8 addr2[ETH_ALEN];
+	u8 addr3[ETH_ALEN];
+	__le16 seq_ctl;
+	u8 addr4[ETH_ALEN];
+	u8 payload[0];
+	__le16 qos_ctl;
+} __attribute__ ((packed));
+
+struct ieee80211_info_element {
+	u8 id;
+	u8 len;
+	u8 data[0];
+} __attribute__ ((packed));
+
+struct ieee80211_authentication {
+	struct ieee80211_hdr_3addr header;
+	__le16 algorithm;
+	__le16 transaction;
+	__le16 status;
+	/*challenge*/
+	struct ieee80211_info_element info_element[0];
+} __attribute__ ((packed));
+
+struct ieee80211_disassoc {
+	struct ieee80211_hdr_3addr header;
+	__le16 reason;
+} __attribute__ ((packed));
+
+struct ieee80211_probe_request {
+	struct ieee80211_hdr_3addr header;
+	/* SSID, supported rates */
+	struct ieee80211_info_element info_element[0];
+} __attribute__ ((packed));
+
+struct ieee80211_probe_response {
+	struct ieee80211_hdr_3addr header;
+	u32 time_stamp[2];
+	__le16 beacon_interval;
+	__le16 capability;
+	/* SSID, supported rates, FH params, DS params,
+	 * CF params, IBSS params, TIM (if beacon), RSN */
+	struct ieee80211_info_element info_element[0];
+} __attribute__ ((packed));
+
+/* Alias beacon for probe_response */
+#define ieee80211_beacon ieee80211_probe_response
+
+struct ieee80211_assoc_request_frame {
+	struct ieee80211_hdr_3addr header;
+	__le16 capability;
+	__le16 listen_interval;
+	/* SSID, supported rates, RSN */
+	struct ieee80211_info_element info_element[0];
+} __attribute__ ((packed));
+
+struct ieee80211_reassoc_request_frame {
+	struct ieee80211_hdr_3addr header;
+	__le16 capability;
+	__le16 listen_interval;
+	u8 current_ap[ETH_ALEN];
+	/* SSID, supported rates, RSN */
+	struct ieee80211_info_element info_element[0];
+} __attribute__ ((packed));
+
+struct ieee80211_assoc_response_frame {
+	struct ieee80211_hdr_3addr header;
+	__le16 capability;
+	__le16 status;
+	__le16 aid;
+	struct ieee80211_info_element info_element[0]; /* supported rates */
+} __attribute__ ((packed));
+
+struct ieee80211_txb {
+	u8 nr_frags;
+	u8 encrypted;
+	u8 queue_index;
+	u8 rts_included;
+	u16 reserved;
+	__le16 frag_size;
+	__le16 payload_size;
+	struct sk_buff *fragments[0];
+};
+
+#define MAX_TX_AGG_COUNT		  16
+struct ieee80211_drv_agg_txb {
+	u8 nr_drv_agg_frames;
+	struct sk_buff *tx_agg_frames[MAX_TX_AGG_COUNT];
+}__attribute__((packed));
+
+#define MAX_SUBFRAME_COUNT 		  64
+struct ieee80211_rxb {
+	u8 nr_subframes;
+	struct sk_buff *subframes[MAX_SUBFRAME_COUNT];
+	u8 dst[ETH_ALEN];
+	u8 src[ETH_ALEN];
+}__attribute__((packed));
+
+typedef union _frameqos {
+	u16 shortdata;
+	u8  chardata[2];
+	struct {
+		u16 tid:4;
+		u16 eosp:1;
+		u16 ack_policy:2;
+		u16 reserved:1;
+		u16 txop:8;
+	}field;
+}frameqos,*pframeqos;
+
+/* SWEEP TABLE ENTRIES NUMBER*/
+#define MAX_SWEEP_TAB_ENTRIES		  42
+#define MAX_SWEEP_TAB_ENTRIES_PER_PACKET  7
+/* MAX_RATES_LENGTH needs to be 12.  The spec says 8, and many APs
+ * only use 8, and then use extended rates for the remaining supported
+ * rates.  Other APs, however, stick all of their supported rates on the
+ * main rates information element... */
+#define MAX_RATES_LENGTH                  ((u8)12)
+#define MAX_RATES_EX_LENGTH               ((u8)16)
+#define MAX_NETWORK_COUNT                  128
+
+#define MAX_CHANNEL_NUMBER                 161
+#define IEEE80211_SOFTMAC_SCAN_TIME	   100
+//(HZ / 2)
+#define IEEE80211_SOFTMAC_ASSOC_RETRY_TIME (HZ * 2)
+
+#define CRC_LENGTH                 4U
+
+#define MAX_WPA_IE_LEN 64
+
+#define NETWORK_EMPTY_ESSID (1<<0)
+#define NETWORK_HAS_OFDM    (1<<1)
+#define NETWORK_HAS_CCK     (1<<2)
+
+/* QoS structure */
+#define NETWORK_HAS_QOS_PARAMETERS      (1<<3)
+#define NETWORK_HAS_QOS_INFORMATION     (1<<4)
+#define NETWORK_HAS_QOS_MASK            (NETWORK_HAS_QOS_PARAMETERS | \
+					 NETWORK_HAS_QOS_INFORMATION)
+/* 802.11h */
+#define NETWORK_HAS_POWER_CONSTRAINT    (1<<5)
+#define NETWORK_HAS_CSA                 (1<<6)
+#define NETWORK_HAS_QUIET               (1<<7)
+#define NETWORK_HAS_IBSS_DFS            (1<<8)
+#define NETWORK_HAS_TPC_REPORT          (1<<9)
+
+#define NETWORK_HAS_ERP_VALUE           (1<<10)
+
+#define QOS_QUEUE_NUM                   4
+#define QOS_OUI_LEN                     3
+#define QOS_OUI_TYPE                    2
+#define QOS_ELEMENT_ID                  221
+#define QOS_OUI_INFO_SUB_TYPE           0
+#define QOS_OUI_PARAM_SUB_TYPE          1
+#define QOS_VERSION_1                   1
+#define QOS_AIFSN_MIN_VALUE             2
+struct ieee80211_qos_information_element {
+	u8 elementID;
+	u8 length;
+	u8 qui[QOS_OUI_LEN];
+	u8 qui_type;
+	u8 qui_subtype;
+	u8 version;
+	u8 ac_info;
+} __attribute__ ((packed));
+
+struct ieee80211_qos_ac_parameter {
+	u8 aci_aifsn;
+	u8 ecw_min_max;
+	__le16 tx_op_limit;
+} __attribute__ ((packed));
+
+struct ieee80211_qos_parameter_info {
+	struct ieee80211_qos_information_element info_element;
+	u8 reserved;
+	struct ieee80211_qos_ac_parameter ac_params_record[QOS_QUEUE_NUM];
+} __attribute__ ((packed));
+
+struct ieee80211_qos_parameters {
+	__le16 cw_min[QOS_QUEUE_NUM];
+	__le16 cw_max[QOS_QUEUE_NUM];
+	u8 aifs[QOS_QUEUE_NUM];
+	u8 flag[QOS_QUEUE_NUM];
+	__le16 tx_op_limit[QOS_QUEUE_NUM];
+} __attribute__ ((packed));
+
+struct ieee80211_qos_data {
+	struct ieee80211_qos_parameters parameters;
+	int active;
+	int supported;
+	u8 param_count;
+	u8 old_param_count;
+};
+
+struct ieee80211_tim_parameters {
+	u8 tim_count;
+	u8 tim_period;
+} __attribute__ ((packed));
+
+//#else
+struct ieee80211_wmm_ac_param {
+	u8 ac_aci_acm_aifsn;
+	u8 ac_ecwmin_ecwmax;
+	u16 ac_txop_limit;
+};
+
+struct ieee80211_wmm_ts_info {
+	u8 ac_dir_tid;
+	u8 ac_up_psb;
+	u8 reserved;
+} __attribute__ ((packed));
+
+struct ieee80211_wmm_tspec_elem {
+	struct ieee80211_wmm_ts_info ts_info;
+	u16 norm_msdu_size;
+	u16 max_msdu_size;
+	u32 min_serv_inter;
+	u32 max_serv_inter;
+	u32 inact_inter;
+	u32 suspen_inter;
+	u32 serv_start_time;
+	u32 min_data_rate;
+	u32 mean_data_rate;
+	u32 peak_data_rate;
+	u32 max_burst_size;
+	u32 delay_bound;
+	u32 min_phy_rate;
+	u16 surp_band_allow;
+	u16 medium_time;
+}__attribute__((packed));
+enum eap_type {
+	EAP_PACKET = 0,
+	EAPOL_START,
+	EAPOL_LOGOFF,
+	EAPOL_KEY,
+	EAPOL_ENCAP_ASF_ALERT
+};
+
+static const char *eap_types[] = {
+	[EAP_PACKET]		= "EAP-Packet",
+	[EAPOL_START]		= "EAPOL-Start",
+	[EAPOL_LOGOFF]		= "EAPOL-Logoff",
+	[EAPOL_KEY]		= "EAPOL-Key",
+	[EAPOL_ENCAP_ASF_ALERT]	= "EAPOL-Encap-ASF-Alert"
+};
+
+static inline const char *eap_get_type(int type)
+{
+	return ((u32)type >= ARRAY_SIZE(eap_types)) ? "Unknown" : eap_types[type];
+}
+//added by amy for reorder
+static inline u8 Frame_QoSTID(u8* buf)
+{
+	struct ieee80211_hdr_3addr *hdr;
+	u16 fc;
+	hdr = (struct ieee80211_hdr_3addr *)buf;
+	fc = le16_to_cpu(hdr->frame_ctl);
+	return (u8)((frameqos*)(buf + (((fc & IEEE80211_FCTL_TODS)&&(fc & IEEE80211_FCTL_FROMDS))? 30 : 24)))->field.tid;
+}
+
+//added by amy for reorder
+
+struct eapol {
+	u8 snap[6];
+	u16 ethertype;
+	u8 version;
+	u8 type;
+	u16 length;
+} __attribute__ ((packed));
+
+struct ieee80211_softmac_stats{
+	unsigned int rx_ass_ok;
+	unsigned int rx_ass_err;
+	unsigned int rx_probe_rq;
+	unsigned int tx_probe_rs;
+	unsigned int tx_beacons;
+	unsigned int rx_auth_rq;
+	unsigned int rx_auth_rs_ok;
+	unsigned int rx_auth_rs_err;
+	unsigned int tx_auth_rq;
+	unsigned int no_auth_rs;
+	unsigned int no_ass_rs;
+	unsigned int tx_ass_rq;
+	unsigned int rx_ass_rq;
+	unsigned int tx_probe_rq;
+	unsigned int reassoc;
+	unsigned int swtxstop;
+	unsigned int swtxawake;
+	unsigned char CurrentShowTxate;
+	unsigned char last_packet_rate;
+	unsigned int txretrycount;
+};
+
+#define BEACON_PROBE_SSID_ID_POSITION 12
+
+struct ieee80211_info_element_hdr {
+	u8 id;
+	u8 len;
+} __attribute__ ((packed));
+
+/*
+ * These are the data types that can make up management packets
+ *
+	u16 auth_algorithm;
+	u16 auth_sequence;
+	u16 beacon_interval;
+	u16 capability;
+	u8 current_ap[ETH_ALEN];
+	u16 listen_interval;
+	struct {
+		u16 association_id:14, reserved:2;
+	} __attribute__ ((packed));
+	u32 time_stamp[2];
+	u16 reason;
+	u16 status;
+*/
+
+#define IEEE80211_DEFAULT_TX_ESSID "Penguin"
+#define IEEE80211_DEFAULT_BASIC_RATE 2 //1Mbps
+
+enum {WMM_all_frame, WMM_two_frame, WMM_four_frame, WMM_six_frame};
+#define MAX_SP_Len  (WMM_all_frame << 4)
+#define IEEE80211_QOS_TID 0x0f
+#define QOS_CTL_NOTCONTAIN_ACK (0x01 << 5)
+
+#define IEEE80211_DTIM_MBCAST 4
+#define IEEE80211_DTIM_UCAST 2
+#define IEEE80211_DTIM_VALID 1
+#define IEEE80211_DTIM_INVALID 0
+
+#define IEEE80211_PS_DISABLED 0
+#define IEEE80211_PS_UNICAST IEEE80211_DTIM_UCAST
+#define IEEE80211_PS_MBCAST IEEE80211_DTIM_MBCAST
+
+//added by David for QoS 2006/6/30
+//#define WMM_Hang_8187
+#ifdef WMM_Hang_8187
+#undef WMM_Hang_8187
+#endif
+
+#define WME_AC_BK   0x00
+#define WME_AC_BE   0x01
+#define WME_AC_VI   0x02
+#define WME_AC_VO   0x03
+#define WME_ACI_MASK 0x03
+#define WME_AIFSN_MASK 0x03
+#define WME_AC_PRAM_LEN 16
+
+#define MAX_RECEIVE_BUFFER_SIZE 9100
+
+//UP Mapping to AC, using in MgntQuery_SequenceNumber() and maybe for DSCP
+//#define UP2AC(up)	((up<3) ? ((up==0)?1:0) : (up>>1))
+#define UP2AC(up) (		   \
+	((up) < 1) ? WME_AC_BE : \
+	((up) < 3) ? WME_AC_BK : \
+	((up) < 4) ? WME_AC_BE : \
+	((up) < 6) ? WME_AC_VI : \
+	WME_AC_VO)
+//AC Mapping to UP, using in Tx part for selecting the corresponding TX queue
+#define AC2UP(_ac)	(       \
+	((_ac) == WME_AC_VO) ? 6 : \
+	((_ac) == WME_AC_VI) ? 5 : \
+	((_ac) == WME_AC_BK) ? 1 : \
+	0)
+
+#define	ETHER_ADDR_LEN		6	/* length of an Ethernet address */
+#define ETHERNET_HEADER_SIZE    14      /* length of two Ethernet address plus ether type*/
+
+struct	ether_header {
+	u8 ether_dhost[ETHER_ADDR_LEN];
+	u8 ether_shost[ETHER_ADDR_LEN];
+	u16 ether_type;
+} __attribute__((packed));
+
+#ifndef ETHERTYPE_PAE
+#define	ETHERTYPE_PAE	0x888e		/* EAPOL PAE/802.1x */
+#endif
+#ifndef ETHERTYPE_IP
+#define	ETHERTYPE_IP	0x0800		/* IP protocol */
+#endif
+
+typedef struct _bss_ht{
+
+	bool				support_ht;
+
+	// HT related elements
+	u8					ht_cap_buf[32];
+	u16					ht_cap_len;
+	u8					ht_info_buf[32];
+	u16					ht_info_len;
+
+	HT_SPEC_VER			ht_spec_ver;
+	//HT_CAPABILITY_ELE			bdHTCapEle;
+	//HT_INFORMATION_ELE		bdHTInfoEle;
+
+	bool				aggregation;
+	bool				long_slot_time;
+}bss_ht, *pbss_ht;
+
+typedef enum _erp_t{
+	ERP_NonERPpresent	= 0x01,
+	ERP_UseProtection	= 0x02,
+	ERP_BarkerPreambleMode = 0x04,
+} erp_t;
+
+
+struct ieee80211_network {
+	/* These entries are used to identify a unique network */
+	u8 bssid[ETH_ALEN];
+	u8 channel;
+	/* Ensure null-terminated for any debug msgs */
+	u8 ssid[IW_ESSID_MAX_SIZE + 1];
+	u8 ssid_len;
+	struct ieee80211_qos_data qos_data;
+
+	//added by amy for LEAP
+	bool	bWithAironetIE;
+	bool	bCkipSupported;
+	bool	bCcxRmEnable;
+	u16 	CcxRmState[2];
+	// CCXv4 S59, MBSSID.
+	bool	bMBssidValid;
+	u8	MBssidMask;
+	u8	MBssid[6];
+	// CCX 2 S38, WLAN Device Version Number element. Annie, 2006-08-20.
+	bool	bWithCcxVerNum;
+	u8	BssCcxVerNumber;
+	/* These are network statistics */
+	struct ieee80211_rx_stats stats;
+	u16 capability;
+	u8  rates[MAX_RATES_LENGTH];
+	u8  rates_len;
+	u8  rates_ex[MAX_RATES_EX_LENGTH];
+	u8  rates_ex_len;
+	unsigned long last_scanned;
+	u8  mode;
+	u32 flags;
+	u32 last_associate;
+	u32 time_stamp[2];
+	u16 beacon_interval;
+	u16 listen_interval;
+	u16 atim_window;
+	u8  erp_value;
+	u8  wpa_ie[MAX_WPA_IE_LEN];
+	size_t wpa_ie_len;
+	u8  rsn_ie[MAX_WPA_IE_LEN];
+	size_t rsn_ie_len;
+
+	struct ieee80211_tim_parameters tim;
+	u8  dtim_period;
+	u8  dtim_data;
+	u32 last_dtim_sta_time[2];
+
+	//appeded for QoS
+	u8 wmm_info;
+	struct ieee80211_wmm_ac_param wmm_param[4];
+	u8 QoS_Enable;
+#ifdef THOMAS_TURBO
+	u8 Turbo_Enable;//enable turbo mode, added by thomas
+#endif
+#ifdef ENABLE_DOT11D
+	u16 CountryIeLen;
+	u8 CountryIeBuf[MAX_IE_LEN];
+#endif
+	// HT Related, by amy, 2008.04.29
+	BSS_HT	bssht;
+	// Add to handle broadcom AP management frame CCK rate.
+	bool broadcom_cap_exist;
+	bool ralink_cap_exist;
+	bool atheros_cap_exist;
+	bool cisco_cap_exist;
+	bool unknown_cap_exist;
+//	u8	berp_info;
+	bool	berp_info_valid;
+	bool buseprotection;
+	//put at the end of the structure.
+	struct list_head list;
+};
+
+enum ieee80211_state {
+
+	/* the card is not linked at all */
+	IEEE80211_NOLINK = 0,
+
+	/* IEEE80211_ASSOCIATING* are for BSS client mode
+	 * the driver shall not perform RX filtering unless
+	 * the state is LINKED.
+	 * The driver shall just check for the state LINKED and
+	 * defaults to NOLINK for ALL the other states (including
+	 * LINKED_SCANNING)
+	 */
+
+	/* the association procedure will start (wq scheduling)*/
+	IEEE80211_ASSOCIATING,
+	IEEE80211_ASSOCIATING_RETRY,
+
+	/* the association procedure is sending AUTH request*/
+	IEEE80211_ASSOCIATING_AUTHENTICATING,
+
+	/* the association procedure has successfully authentcated
+	 * and is sending association request
+	 */
+	IEEE80211_ASSOCIATING_AUTHENTICATED,
+
+	/* the link is ok. the card associated to a BSS or linked
+	 * to a ibss cell or acting as an AP and creating the bss
+	 */
+	IEEE80211_LINKED,
+
+	/* same as LINKED, but the driver shall apply RX filter
+	 * rules as we are in NO_LINK mode. As the card is still
+	 * logically linked, but it is doing a syncro site survey
+	 * then it will be back to LINKED state.
+	 */
+	IEEE80211_LINKED_SCANNING,
+
+};
+
+#define DEFAULT_MAX_SCAN_AGE (15 * HZ)
+#define DEFAULT_FTS 2346
+
+#define CFG_IEEE80211_RESERVE_FCS (1<<0)
+#define CFG_IEEE80211_COMPUTE_FCS (1<<1)
+#define CFG_IEEE80211_RTS (1<<2)
+
+#define IEEE80211_24GHZ_MIN_CHANNEL 1
+#define IEEE80211_24GHZ_MAX_CHANNEL 14
+#define IEEE80211_24GHZ_CHANNELS (IEEE80211_24GHZ_MAX_CHANNEL - \
+				  IEEE80211_24GHZ_MIN_CHANNEL + 1)
+
+#define IEEE80211_52GHZ_MIN_CHANNEL 34
+#define IEEE80211_52GHZ_MAX_CHANNEL 165
+#define IEEE80211_52GHZ_CHANNELS (IEEE80211_52GHZ_MAX_CHANNEL - \
+				  IEEE80211_52GHZ_MIN_CHANNEL + 1)
+
+
+
+typedef struct tx_pending_t{
+	int frag;
+	struct ieee80211_txb *txb;
+}tx_pending_t;
+
+typedef struct _bandwidth_autoswitch
+{
+	long threshold_20Mhzto40Mhz;
+	long	threshold_40Mhzto20Mhz;
+	bool bforced_tx20Mhz;
+	bool bautoswitch_enable;
+}bandwidth_autoswitch,*pbandwidth_autoswitch;
+
+
+//added by amy for order
+
+#define REORDER_WIN_SIZE	128
+#define REORDER_ENTRY_NUM	128
+typedef struct _RX_REORDER_ENTRY
+{
+	struct list_head	List;
+	u16			SeqNum;
+	struct ieee80211_rxb* prxb;
+} RX_REORDER_ENTRY, *PRX_REORDER_ENTRY;
+//added by amy for order
+typedef enum _Fsync_State{
+	Default_Fsync,
+	HW_Fsync,
+	SW_Fsync
+}Fsync_State;
+
+// Power save mode configured.
+typedef	enum _RT_PS_MODE
+{
+	eActive,	// Active/Continuous access.
+	eMaxPs,		// Max power save mode.
+	eFastPs		// Fast power save mode.
+}RT_PS_MODE;
+
+typedef enum _IPS_CALLBACK_FUNCION
+{
+	IPS_CALLBACK_NONE = 0,
+	IPS_CALLBACK_MGNT_LINK_REQUEST = 1,
+	IPS_CALLBACK_JOIN_REQUEST = 2,
+}IPS_CALLBACK_FUNCION;
+
+typedef enum _RT_JOIN_ACTION{
+	RT_JOIN_INFRA   = 1,
+	RT_JOIN_IBSS  = 2,
+	RT_START_IBSS = 3,
+	RT_NO_ACTION  = 4,
+}RT_JOIN_ACTION;
+
+typedef struct _IbssParms{
+	u16   atimWin;
+}IbssParms, *PIbssParms;
+#define MAX_NUM_RATES	264 // Max num of support rates element: 8,  Max num of ext. support rate: 255. 061122, by rcnjko.
+
+// RF state.
+typedef	enum _RT_RF_POWER_STATE
+{
+	eRfOn,
+	eRfSleep,
+	eRfOff
+}RT_RF_POWER_STATE;
+
+typedef struct _RT_POWER_SAVE_CONTROL
+{
+
+	//
+	// Inactive Power Save(IPS) : Disable RF when disconnected
+	//
+	bool				bInactivePs;
+	bool				bIPSModeBackup;
+	bool				bSwRfProcessing;
+	RT_RF_POWER_STATE	eInactivePowerState;
+	struct work_struct 	InactivePsWorkItem;
+	struct timer_list	InactivePsTimer;
+
+	// Return point for join action
+	IPS_CALLBACK_FUNCION	ReturnPoint;
+
+	// Recored Parameters for rescheduled JoinRequest
+	bool				bTmpBssDesc;
+	RT_JOIN_ACTION		tmpJoinAction;
+	struct ieee80211_network tmpBssDesc;
+
+	// Recored Parameters for rescheduled MgntLinkRequest
+	bool				bTmpScanOnly;
+	bool				bTmpActiveScan;
+	bool				bTmpFilterHiddenAP;
+	bool				bTmpUpdateParms;
+	u8					tmpSsidBuf[33];
+	OCTET_STRING			tmpSsid2Scan;
+	bool				bTmpSsid2Scan;
+	u8					tmpNetworkType;
+	u8					tmpChannelNumber;
+	u16					tmpBcnPeriod;
+	u8					tmpDtimPeriod;
+	u16					tmpmCap;
+	OCTET_STRING			tmpSuppRateSet;
+	u8					tmpSuppRateBuf[MAX_NUM_RATES];
+	bool				bTmpSuppRate;
+	IbssParms				tmpIbpm;
+	bool				bTmpIbpm;
+
+	//
+	// Leisre Poswer Save : Disable RF if connected but traffic is not busy
+	//
+	bool				bLeisurePs;
+
+}RT_POWER_SAVE_CONTROL,*PRT_POWER_SAVE_CONTROL;
+
+typedef u32 RT_RF_CHANGE_SOURCE;
+#define RF_CHANGE_BY_SW BIT31
+#define RF_CHANGE_BY_HW BIT30
+#define RF_CHANGE_BY_PS BIT29
+#define RF_CHANGE_BY_IPS BIT28
+#define RF_CHANGE_BY_INIT	0	// Do not change the RFOff reason. Defined by Bruce, 2008-01-17.
+
+#ifdef ENABLE_DOT11D
+typedef enum
+{
+	COUNTRY_CODE_FCC = 0,
+	COUNTRY_CODE_IC = 1,
+	COUNTRY_CODE_ETSI = 2,
+	COUNTRY_CODE_SPAIN = 3,
+	COUNTRY_CODE_FRANCE = 4,
+	COUNTRY_CODE_MKK = 5,
+	COUNTRY_CODE_MKK1 = 6,
+	COUNTRY_CODE_ISRAEL = 7,
+	COUNTRY_CODE_TELEC,
+	COUNTRY_CODE_MIC,
+	COUNTRY_CODE_GLOBAL_DOMAIN
+}country_code_type_t;
+#endif
+
+#define RT_MAX_LD_SLOT_NUM	10
+typedef struct _RT_LINK_DETECT_T{
+
+	u32				NumRecvBcnInPeriod;
+	u32				NumRecvDataInPeriod;
+
+	u32				RxBcnNum[RT_MAX_LD_SLOT_NUM];	// number of Rx beacon / CheckForHang_period  to determine link status
+	u32				RxDataNum[RT_MAX_LD_SLOT_NUM];	// number of Rx data / CheckForHang_period  to determine link status
+	u16				SlotNum;	// number of CheckForHang period to determine link status
+	u16				SlotIndex;
+
+	u32				NumTxOkInPeriod;
+	u32				NumRxOkInPeriod;
+	bool				bBusyTraffic;
+}RT_LINK_DETECT_T, *PRT_LINK_DETECT_T;
+
+
+struct ieee80211_device {
+	struct net_device *dev;
+	struct ieee80211_security sec;
+
+	//hw security related
+//	u8 hwsec_support; //support?
+	u8 hwsec_active;  //hw security active.
+	bool is_silent_reset;
+	bool ieee_up;
+	//added by amy
+	bool bSupportRemoteWakeUp;
+	RT_PS_MODE	dot11PowerSaveMode; // Power save mode configured.
+	bool actscanning;
+	bool beinretry;
+	RT_RF_POWER_STATE		eRFPowerState;
+	RT_RF_CHANGE_SOURCE	RfOffReason;
+	bool is_set_key;
+	//11n spec related I wonder if These info structure need to be moved out of ieee80211_device
+
+	//11n HT below
+	PRT_HIGH_THROUGHPUT	pHTInfo;
+	//struct timer_list		SwBwTimer;
+//	spinlock_t chnlop_spinlock;
+	spinlock_t bw_spinlock;
+
+	spinlock_t reorder_spinlock;
+	// for HT operation rate set.  we use this one for HT data rate to seperate different descriptors
+	//the way fill this is the same as in the IE
+	u8	Regdot11HTOperationalRateSet[16];		//use RATR format
+	u8	dot11HTOperationalRateSet[16];		//use RATR format
+	u8	RegHTSuppRateSet[16];
+	u8				HTCurrentOperaRate;
+	u8				HTHighestOperaRate;
+	//wb added for rate operation mode to firmware
+	u8	bTxDisableRateFallBack;
+	u8 	bTxUseDriverAssingedRate;
+	atomic_t	atm_chnlop;
+	atomic_t	atm_swbw;
+//	u8	HTHighestOperaRate;
+//	u8 	HTCurrentOperaRate;
+
+	// 802.11e and WMM Traffic Stream Info (TX)
+	struct list_head		Tx_TS_Admit_List;
+	struct list_head		Tx_TS_Pending_List;
+	struct list_head		Tx_TS_Unused_List;
+	TX_TS_RECORD		TxTsRecord[TOTAL_TS_NUM];
+	// 802.11e and WMM Traffic Stream Info (RX)
+	struct list_head		Rx_TS_Admit_List;
+	struct list_head		Rx_TS_Pending_List;
+	struct list_head		Rx_TS_Unused_List;
+	RX_TS_RECORD		RxTsRecord[TOTAL_TS_NUM];
+//#ifdef TO_DO_LIST
+	RX_REORDER_ENTRY	RxReorderEntry[128];
+	struct list_head		RxReorder_Unused_List;
+//#endif
+	// Qos related. Added by Annie, 2005-11-01.
+//	PSTA_QOS			pStaQos;
+	u8				ForcedPriority;		// Force per-packet priority 1~7. (default: 0, not to force it.)
+
+
+	/* Bookkeeping structures */
+	struct net_device_stats stats;
+	struct ieee80211_stats ieee_stats;
+	struct ieee80211_softmac_stats softmac_stats;
+
+	/* Probe / Beacon management */
+	struct list_head network_free_list;
+	struct list_head network_list;
+	struct ieee80211_network *networks;
+	int scans;
+	int scan_age;
+
+	int iw_mode; /* operating mode (IW_MODE_*) */
+	struct iw_spy_data spy_data;
+
+	spinlock_t lock;
+	spinlock_t wpax_suitlist_lock;
+
+	int tx_headroom; /* Set to size of any additional room needed at front
+			  * of allocated Tx SKBs */
+	u32 config;
+
+	/* WEP and other encryption related settings at the device level */
+	int open_wep; /* Set to 1 to allow unencrypted frames */
+	int auth_mode;
+	int reset_on_keychange; /* Set to 1 if the HW needs to be reset on
+				 * WEP key changes */
+
+	/* If the host performs {en,de}cryption, then set to 1 */
+	int host_encrypt;
+	int host_encrypt_msdu;
+	int host_decrypt;
+	/* host performs multicast decryption */
+	int host_mc_decrypt;
+
+	/* host should strip IV and ICV from protected frames */
+	/* meaningful only when hardware decryption is being used */
+	int host_strip_iv_icv;
+
+	int host_open_frag;
+	int host_build_iv;
+	int ieee802_1x; /* is IEEE 802.1X used */
+
+	/* WPA data */
+	bool bHalfWirelessN24GMode;
+	int wpa_enabled;
+	int drop_unencrypted;
+	int tkip_countermeasures;
+	int privacy_invoked;
+	size_t wpa_ie_len;
+	u8 *wpa_ie;
+	u8 ap_mac_addr[6];
+	u16 pairwise_key_type;
+	u16 group_key_type;
+	struct list_head crypt_deinit_list;
+	struct ieee80211_crypt_data *crypt[WEP_KEYS];
+	int tx_keyidx; /* default TX key index (crypt[tx_keyidx]) */
+	struct timer_list crypt_deinit_timer;
+	int crypt_quiesced;
+
+	int bcrx_sta_key; /* use individual keys to override default keys even
+			   * with RX of broad/multicast frames */
+
+	/* Fragmentation structures */
+	// each streaming contain a entry
+	struct ieee80211_frag_entry frag_cache[17][IEEE80211_FRAG_CACHE_LEN];
+	unsigned int frag_next_idx[17];
+	u16 fts; /* Fragmentation Threshold */
+#define DEFAULT_RTS_THRESHOLD 2346U
+#define MIN_RTS_THRESHOLD 1
+#define MAX_RTS_THRESHOLD 2346U
+	u16 rts; /* RTS threshold */
+
+	/* Association info */
+	u8 bssid[ETH_ALEN];
+
+	/* This stores infos for the current network.
+	 * Either the network we are associated in INFRASTRUCTURE
+	 * or the network that we are creating in MASTER mode.
+	 * ad-hoc is a mixture ;-).
+	 * Note that in infrastructure mode, even when not associated,
+	 * fields bssid and essid may be valid (if wpa_set and essid_set
+	 * are true) as thy carry the value set by the user via iwconfig
+	 */
+	struct ieee80211_network current_network;
+
+	enum ieee80211_state state;
+
+	int short_slot;
+	int reg_mode;
+	int mode;       /* A, B, G */
+	int modulation; /* CCK, OFDM */
+	int freq_band;  /* 2.4Ghz, 5.2Ghz, Mixed */
+	int abg_true;   /* ABG flag              */
+
+	/* used for forcing the ibss workqueue to terminate
+	 * without wait for the syncro scan to terminate
+	 */
+	short sync_scan_hurryup;
+
+	int perfect_rssi;
+	int worst_rssi;
+
+	u16 prev_seq_ctl;       /* used to drop duplicate frames */
+
+	/* map of allowed channels. 0 is dummy */
+	// FIXME: remeber to default to a basic channel plan depending of the PHY type
+#ifdef ENABLE_DOT11D
+	void* pDot11dInfo;
+	bool bGlobalDomain;
+#else
+	int channel_map[MAX_CHANNEL_NUMBER+1];
+#endif
+	int rate;       /* current rate */
+	int basic_rate;
+	//FIXME: pleace callback, see if redundant with softmac_features
+	short active_scan;
+
+	/* this contains flags for selectively enable softmac support */
+	u16 softmac_features;
+
+	/* if the sequence control field is not filled by HW */
+	u16 seq_ctrl[5];
+
+	/* association procedure transaction sequence number */
+	u16 associate_seq;
+
+	/* AID for RTXed association responses */
+	u16 assoc_id;
+
+	/* power save mode related*/
+	short ps;
+	short sta_sleep;
+	int ps_timeout;
+	int ps_period;
+	struct tasklet_struct ps_task;
+	u32 ps_th;
+	u32 ps_tl;
+
+	short raw_tx;
+	/* used if IEEE_SOFTMAC_TX_QUEUE is set */
+	short queue_stop;
+	short scanning;
+	short proto_started;
+
+	struct semaphore wx_sem;
+	struct semaphore scan_sem;
+
+	spinlock_t mgmt_tx_lock;
+	spinlock_t beacon_lock;
+
+	short beacon_txing;
+
+	short wap_set;
+	short ssid_set;
+
+	u8  wpax_type_set;    //{added by David, 2006.9.28}
+	u32 wpax_type_notify; //{added by David, 2006.9.26}
+
+	/* QoS related flag */
+	char init_wmmparam_flag;
+	/* set on initialization */
+	u8  qos_support;
+
+	/* for discarding duplicated packets in IBSS */
+	struct list_head ibss_mac_hash[IEEE_IBSS_MAC_HASH_SIZE];
+
+	/* for discarding duplicated packets in BSS */
+	u16 last_rxseq_num[17]; /* rx seq previous per-tid */
+	u16 last_rxfrag_num[17];/* tx frag previous per-tid */
+	unsigned long last_packet_time[17];
+
+	/* for PS mode */
+	unsigned long last_rx_ps_time;
+
+	/* used if IEEE_SOFTMAC_SINGLE_QUEUE is set */
+	struct sk_buff *mgmt_queue_ring[MGMT_QUEUE_NUM];
+	int mgmt_queue_head;
+	int mgmt_queue_tail;
+//{ added for rtl819x
+#define IEEE80211_QUEUE_LIMIT 128
+	u8 AsocRetryCount;
+	unsigned int hw_header;
+	struct sk_buff_head skb_waitQ[MAX_QUEUE_SIZE];
+	struct sk_buff_head  skb_aggQ[MAX_QUEUE_SIZE];
+	struct sk_buff_head  skb_drv_aggQ[MAX_QUEUE_SIZE];
+	u32	sta_edca_param[4];
+	bool aggregation;
+	// Enable/Disable Rx immediate BA capability.
+	bool enable_rx_imm_BA;
+	bool bibsscoordinator;
+
+	//+by amy for DM ,080515
+	//Dynamic Tx power for near/far range enable/Disable  , by amy , 2008-05-15
+	bool	bdynamic_txpower_enable;
+
+	bool bCTSToSelfEnable;
+	u8 	CTSToSelfTH;
+
+	u32 	fsync_time_interval;
+	u32	fsync_rate_bitmap;
+	u8	fsync_rssi_threshold;
+	bool	bfsync_enable;
+
+	u8	fsync_multiple_timeinterval;		// FsyncMultipleTimeInterval * FsyncTimeInterval
+	u32	fsync_firstdiff_ratethreshold;		// low threshold
+	u32	fsync_seconddiff_ratethreshold;	 // decrease threshold
+	Fsync_State			fsync_state;
+	bool		bis_any_nonbepkts;
+	//20Mhz 40Mhz AutoSwitch Threshold
+	bandwidth_autoswitch bandwidth_auto_switch;
+	//for txpower tracking
+	bool FwRWRF;
+
+	//added by amy for AP roaming
+	RT_LINK_DETECT_T	LinkDetectInfo;
+	//added by amy for ps
+	RT_POWER_SAVE_CONTROL	PowerSaveControl;
+//}
+	/* used if IEEE_SOFTMAC_TX_QUEUE is set */
+	struct  tx_pending_t tx_pending;
+
+	/* used if IEEE_SOFTMAC_ASSOCIATE is set */
+	struct timer_list associate_timer;
+
+	/* used if IEEE_SOFTMAC_BEACONS is set */
+	struct timer_list beacon_timer;
+	struct work_struct associate_complete_wq;
+	struct work_struct associate_procedure_wq;
+	struct delayed_work softmac_scan_wq;
+	struct delayed_work associate_retry_wq;
+	 struct delayed_work start_ibss_wq;
+	struct work_struct wx_sync_scan_wq;
+	struct workqueue_struct *wq;
+        // Qos related. Added by Annie, 2005-11-01.
+        //STA_QOS  StaQos;
+
+        //u32 STA_EDCA_PARAM[4];
+	//CHANNEL_ACCESS_SETTING ChannelAccessSetting;
+
+
+	/* Callback functions */
+	void (*set_security)(struct net_device *dev,
+			     struct ieee80211_security *sec);
+
+	/* Used to TX data frame by using txb structs.
+	 * this is not used if in the softmac_features
+	 * is set the flag IEEE_SOFTMAC_TX_QUEUE
+	 */
+	int (*hard_start_xmit)(struct ieee80211_txb *txb,
+			       struct net_device *dev);
+
+	int (*reset_port)(struct net_device *dev);
+        int (*is_queue_full) (struct net_device * dev, int pri);
+
+        int (*handle_management) (struct net_device * dev,
+                                  struct ieee80211_network * network, u16 type);
+        int (*is_qos_active) (struct net_device *dev, struct sk_buff *skb);
+
+	/* Softmac-generated frames (mamagement) are TXed via this
+	 * callback if the flag IEEE_SOFTMAC_SINGLE_QUEUE is
+	 * not set. As some cards may have different HW queues that
+	 * one might want to use for data and management frames
+	 * the option to have two callbacks might be useful.
+	 * This fucntion can't sleep.
+	 */
+	int (*softmac_hard_start_xmit)(struct sk_buff *skb,
+			       struct net_device *dev);
+
+	/* used instead of hard_start_xmit (not softmac_hard_start_xmit)
+	 * if the IEEE_SOFTMAC_TX_QUEUE feature is used to TX data
+	 * frames. I the option IEEE_SOFTMAC_SINGLE_QUEUE is also set
+	 * then also management frames are sent via this callback.
+	 * This function can't sleep.
+	 */
+	void (*softmac_data_hard_start_xmit)(struct sk_buff *skb,
+			       struct net_device *dev,int rate);
+
+	/* stops the HW queue for DATA frames. Useful to avoid
+	 * waste time to TX data frame when we are reassociating
+	 * This function can sleep.
+	 */
+	void (*data_hard_stop)(struct net_device *dev);
+
+	/* OK this is complementar to data_poll_hard_stop */
+	void (*data_hard_resume)(struct net_device *dev);
+
+	/* ask to the driver to retune the radio .
+	 * This function can sleep. the driver should ensure
+	 * the radio has been swithced before return.
+	 */
+	void (*set_chan)(struct net_device *dev,short ch);
+
+	/* These are not used if the ieee stack takes care of
+	 * scanning (IEEE_SOFTMAC_SCAN feature set).
+	 * In this case only the set_chan is used.
+	 *
+	 * The syncro version is similar to the start_scan but
+	 * does not return until all channels has been scanned.
+	 * this is called in user context and should sleep,
+	 * it is called in a work_queue when swithcing to ad-hoc mode
+	 * or in behalf of iwlist scan when the card is associated
+	 * and root user ask for a scan.
+	 * the fucntion stop_scan should stop both the syncro and
+	 * background scanning and can sleep.
+	 * The fucntion start_scan should initiate the background
+	 * scanning and can't sleep.
+	 */
+	void (*scan_syncro)(struct net_device *dev);
+	void (*start_scan)(struct net_device *dev);
+	void (*stop_scan)(struct net_device *dev);
+
+	/* indicate the driver that the link state is changed
+	 * for example it may indicate the card is associated now.
+	 * Driver might be interested in this to apply RX filter
+	 * rules or simply light the LINK led
+	 */
+	void (*link_change)(struct net_device *dev);
+
+	/* these two function indicates to the HW when to start
+	 * and stop to send beacons. This is used when the
+	 * IEEE_SOFTMAC_BEACONS is not set. For now the
+	 * stop_send_bacons is NOT guaranteed to be called only
+	 * after start_send_beacons.
+	 */
+	void (*start_send_beacons) (struct net_device *dev,u16 tx_rate);
+	void (*stop_send_beacons) (struct net_device *dev);
+
+	/* power save mode related */
+	void (*sta_wake_up) (struct net_device *dev);
+	void (*ps_request_tx_ack) (struct net_device *dev);
+	void (*enter_sleep_state) (struct net_device *dev, u32 th, u32 tl);
+	short (*ps_is_queue_empty) (struct net_device *dev);
+	int (*handle_beacon) (struct net_device * dev, struct ieee80211_beacon * beacon, struct ieee80211_network * network);
+	int (*handle_assoc_response) (struct net_device * dev, struct ieee80211_assoc_response_frame * resp, struct ieee80211_network * network);
+
+
+	/* check whether Tx hw resouce available */
+	short (*check_nic_enough_desc)(struct net_device *dev, int queue_index);
+	//added by wb for HT related
+//	void (*SwChnlByTimerHandler)(struct net_device *dev, int channel);
+	void (*SetBWModeHandler)(struct net_device *dev, HT_CHANNEL_WIDTH Bandwidth, HT_EXTCHNL_OFFSET Offset);
+//	void (*UpdateHalRATRTableHandler)(struct net_device* dev, u8* pMcsRate);
+	bool (*GetNmodeSupportBySecCfg)(struct net_device* dev);
+	void (*SetWirelessMode)(struct net_device* dev, u8 wireless_mode);
+	bool (*GetHalfNmodeSupportByAPsHandler)(struct net_device* dev);
+	void (*InitialGainHandler)(struct net_device *dev, u8 Operation);
+
+	/* This must be the last item so that it points to the data
+	 * allocated beyond this structure by alloc_ieee80211 */
+	u8 priv[0];
+};
+
+#define IEEE_A            (1<<0)
+#define IEEE_B            (1<<1)
+#define IEEE_G            (1<<2)
+#define IEEE_N_24G 		  (1<<4)
+#define	IEEE_N_5G		  (1<<5)
+#define IEEE_MODE_MASK    (IEEE_A|IEEE_B|IEEE_G)
+
+/* Generate a 802.11 header */
+
+/* Uses the channel change callback directly
+ * instead of [start/stop] scan callbacks
+ */
+#define IEEE_SOFTMAC_SCAN (1<<2)
+
+/* Perform authentication and association handshake */
+#define IEEE_SOFTMAC_ASSOCIATE (1<<3)
+
+/* Generate probe requests */
+#define IEEE_SOFTMAC_PROBERQ (1<<4)
+
+/* Generate respones to probe requests */
+#define IEEE_SOFTMAC_PROBERS (1<<5)
+
+/* The ieee802.11 stack will manages the netif queue
+ * wake/stop for the driver, taking care of 802.11
+ * fragmentation. See softmac.c for details. */
+#define IEEE_SOFTMAC_TX_QUEUE (1<<7)
+
+/* Uses only the softmac_data_hard_start_xmit
+ * even for TX management frames.
+ */
+#define IEEE_SOFTMAC_SINGLE_QUEUE (1<<8)
+
+/* Generate beacons.  The stack will enqueue beacons
+ * to the card
+ */
+#define IEEE_SOFTMAC_BEACONS (1<<6)
+
+static inline void *ieee80211_priv(struct net_device *dev)
+{
+	return ((struct ieee80211_device *)netdev_priv(dev))->priv;
+}
+
+extern inline int ieee80211_is_empty_essid(const char *essid, int essid_len)
+{
+	/* Single white space is for Linksys APs */
+	if (essid_len == 1 && essid[0] == ' ')
+		return 1;
+
+	/* Otherwise, if the entire essid is 0, we assume it is hidden */
+	while (essid_len) {
+		essid_len--;
+		if (essid[essid_len] != '\0')
+			return 0;
+	}
+
+	return 1;
+}
+
+extern inline int ieee80211_is_valid_mode(struct ieee80211_device *ieee, int mode)
+{
+	/*
+	 * It is possible for both access points and our device to support
+	 * combinations of modes, so as long as there is one valid combination
+	 * of ap/device supported modes, then return success
+	 *
+	 */
+	if ((mode & IEEE_A) &&
+	    (ieee->modulation & IEEE80211_OFDM_MODULATION) &&
+	    (ieee->freq_band & IEEE80211_52GHZ_BAND))
+		return 1;
+
+	if ((mode & IEEE_G) &&
+	    (ieee->modulation & IEEE80211_OFDM_MODULATION) &&
+	    (ieee->freq_band & IEEE80211_24GHZ_BAND))
+		return 1;
+
+	if ((mode & IEEE_B) &&
+	    (ieee->modulation & IEEE80211_CCK_MODULATION) &&
+	    (ieee->freq_band & IEEE80211_24GHZ_BAND))
+		return 1;
+
+	return 0;
+}
+
+extern inline int ieee80211_get_hdrlen(u16 fc)
+{
+	int hdrlen = IEEE80211_3ADDR_LEN;
+
+	switch (WLAN_FC_GET_TYPE(fc)) {
+	case IEEE80211_FTYPE_DATA:
+		if ((fc & IEEE80211_FCTL_FROMDS) && (fc & IEEE80211_FCTL_TODS))
+			hdrlen = IEEE80211_4ADDR_LEN; /* Addr4 */
+		if(IEEE80211_QOS_HAS_SEQ(fc))
+			hdrlen += 2; /* QOS ctrl*/
+		break;
+	case IEEE80211_FTYPE_CTL:
+		switch (WLAN_FC_GET_STYPE(fc)) {
+		case IEEE80211_STYPE_CTS:
+		case IEEE80211_STYPE_ACK:
+			hdrlen = IEEE80211_1ADDR_LEN;
+			break;
+		default:
+			hdrlen = IEEE80211_2ADDR_LEN;
+			break;
+		}
+		break;
+	}
+
+	return hdrlen;
+}
+
+static inline u8 *ieee80211_get_payload(struct ieee80211_hdr *hdr)
+{
+	switch (ieee80211_get_hdrlen(le16_to_cpu(hdr->frame_ctl))) {
+	case IEEE80211_1ADDR_LEN:
+		return ((struct ieee80211_hdr_1addr *)hdr)->payload;
+	case IEEE80211_2ADDR_LEN:
+		return ((struct ieee80211_hdr_2addr *)hdr)->payload;
+	case IEEE80211_3ADDR_LEN:
+		return ((struct ieee80211_hdr_3addr *)hdr)->payload;
+	case IEEE80211_4ADDR_LEN:
+		return ((struct ieee80211_hdr_4addr *)hdr)->payload;
+	}
+	return NULL;
+}
+
+static inline int ieee80211_is_ofdm_rate(u8 rate)
+{
+	switch (rate & ~IEEE80211_BASIC_RATE_MASK) {
+	case IEEE80211_OFDM_RATE_6MB:
+	case IEEE80211_OFDM_RATE_9MB:
+	case IEEE80211_OFDM_RATE_12MB:
+	case IEEE80211_OFDM_RATE_18MB:
+	case IEEE80211_OFDM_RATE_24MB:
+	case IEEE80211_OFDM_RATE_36MB:
+	case IEEE80211_OFDM_RATE_48MB:
+	case IEEE80211_OFDM_RATE_54MB:
+		return 1;
+	}
+	return 0;
+}
+
+static inline int ieee80211_is_cck_rate(u8 rate)
+{
+	switch (rate & ~IEEE80211_BASIC_RATE_MASK) {
+	case IEEE80211_CCK_RATE_1MB:
+	case IEEE80211_CCK_RATE_2MB:
+	case IEEE80211_CCK_RATE_5MB:
+	case IEEE80211_CCK_RATE_11MB:
+		return 1;
+	}
+	return 0;
+}
+
+
+/* ieee80211.c */
+extern void free_ieee80211(struct net_device *dev);
+extern struct net_device *alloc_ieee80211(int sizeof_priv);
+
+extern int ieee80211_set_encryption(struct ieee80211_device *ieee);
+
+/* ieee80211_tx.c */
+
+extern int ieee80211_encrypt_fragment(
+	struct ieee80211_device *ieee,
+	struct sk_buff *frag,
+	int hdr_len);
+
+extern int ieee80211_xmit(struct sk_buff *skb,
+			  struct net_device *dev);
+extern void ieee80211_txb_free(struct ieee80211_txb *);
+
+
+/* ieee80211_rx.c */
+extern int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
+			struct ieee80211_rx_stats *rx_stats);
+extern void ieee80211_rx_mgt(struct ieee80211_device *ieee,
+			     struct ieee80211_hdr_4addr *header,
+			     struct ieee80211_rx_stats *stats);
+
+/* ieee80211_wx.c */
+extern int ieee80211_wx_get_scan(struct ieee80211_device *ieee,
+				 struct iw_request_info *info,
+				 union iwreq_data *wrqu, char *key);
+extern int ieee80211_wx_set_encode(struct ieee80211_device *ieee,
+				   struct iw_request_info *info,
+				   union iwreq_data *wrqu, char *key);
+extern int ieee80211_wx_get_encode(struct ieee80211_device *ieee,
+				   struct iw_request_info *info,
+				   union iwreq_data *wrqu, char *key);
+#if WIRELESS_EXT >= 18
+extern int ieee80211_wx_get_encode_ext(struct ieee80211_device *ieee,
+			    struct iw_request_info *info,
+			    union iwreq_data* wrqu, char *extra);
+extern int ieee80211_wx_set_encode_ext(struct ieee80211_device *ieee,
+			    struct iw_request_info *info,
+			    union iwreq_data* wrqu, char *extra);
+extern int ieee80211_wx_set_auth(struct ieee80211_device *ieee,
+			       struct iw_request_info *info,
+			       struct iw_param *data, char *extra);
+extern int ieee80211_wx_set_mlme(struct ieee80211_device *ieee,
+			       struct iw_request_info *info,
+			       union iwreq_data *wrqu, char *extra);
+#endif
+extern int ieee80211_wx_set_gen_ie(struct ieee80211_device *ieee, u8 *ie, size_t len);
+
+/* ieee80211_softmac.c */
+extern short ieee80211_is_54g(struct ieee80211_network net);
+extern short ieee80211_is_shortslot(struct ieee80211_network net);
+extern int ieee80211_rx_frame_softmac(struct ieee80211_device *ieee, struct sk_buff *skb,
+			struct ieee80211_rx_stats *rx_stats, u16 type,
+			u16 stype);
+extern void ieee80211_softmac_new_net(struct ieee80211_device *ieee, struct ieee80211_network *net);
+
+void SendDisassociation(struct ieee80211_device *ieee, u8* asSta, u8 asRsn);
+extern void ieee80211_softmac_xmit(struct ieee80211_txb *txb, struct ieee80211_device *ieee);
+
+extern void ieee80211_stop_send_beacons(struct ieee80211_device *ieee);
+extern void notify_wx_assoc_event(struct ieee80211_device *ieee);
+extern void ieee80211_softmac_check_all_nets(struct ieee80211_device *ieee);
+extern void ieee80211_start_bss(struct ieee80211_device *ieee);
+extern void ieee80211_start_master_bss(struct ieee80211_device *ieee);
+extern void ieee80211_start_ibss(struct ieee80211_device *ieee);
+extern void ieee80211_softmac_init(struct ieee80211_device *ieee);
+extern void ieee80211_softmac_free(struct ieee80211_device *ieee);
+extern void ieee80211_associate_abort(struct ieee80211_device *ieee);
+extern void ieee80211_disassociate(struct ieee80211_device *ieee);
+extern void ieee80211_stop_scan(struct ieee80211_device *ieee);
+extern void ieee80211_start_scan_syncro(struct ieee80211_device *ieee);
+extern void ieee80211_check_all_nets(struct ieee80211_device *ieee);
+extern void ieee80211_start_protocol(struct ieee80211_device *ieee);
+extern void ieee80211_stop_protocol(struct ieee80211_device *ieee);
+extern void ieee80211_softmac_start_protocol(struct ieee80211_device *ieee);
+extern void ieee80211_softmac_stop_protocol(struct ieee80211_device *ieee);
+extern void ieee80211_reset_queue(struct ieee80211_device *ieee);
+extern void ieee80211_wake_queue(struct ieee80211_device *ieee);
+extern void ieee80211_stop_queue(struct ieee80211_device *ieee);
+extern struct sk_buff *ieee80211_get_beacon(struct ieee80211_device *ieee);
+extern void ieee80211_start_send_beacons(struct ieee80211_device *ieee);
+extern void ieee80211_stop_send_beacons(struct ieee80211_device *ieee);
+extern int ieee80211_wpa_supplicant_ioctl(struct ieee80211_device *ieee, struct iw_point *p);
+extern void notify_wx_assoc_event(struct ieee80211_device *ieee);
+extern void ieee80211_ps_tx_ack(struct ieee80211_device *ieee, short success);
+
+extern void softmac_mgmt_xmit(struct sk_buff *skb, struct ieee80211_device *ieee);
+
+/* ieee80211_crypt_ccmp&tkip&wep.c */
+extern void ieee80211_tkip_null(void);
+extern void ieee80211_wep_null(void);
+extern void ieee80211_ccmp_null(void);
+
+/* ieee80211_softmac_wx.c */
+
+extern int ieee80211_wx_get_wap(struct ieee80211_device *ieee,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu, char *ext);
+
+extern int ieee80211_wx_set_wap(struct ieee80211_device *ieee,
+			 struct iw_request_info *info,
+			 union iwreq_data *awrq,
+			 char *extra);
+
+extern int ieee80211_wx_get_essid(struct ieee80211_device *ieee, struct iw_request_info *a,union iwreq_data *wrqu,char *b);
+
+extern int ieee80211_wx_set_rate(struct ieee80211_device *ieee,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra);
+
+extern int ieee80211_wx_get_rate(struct ieee80211_device *ieee,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra);
+
+extern int ieee80211_wx_set_mode(struct ieee80211_device *ieee, struct iw_request_info *a,
+			     union iwreq_data *wrqu, char *b);
+
+extern int ieee80211_wx_set_scan(struct ieee80211_device *ieee, struct iw_request_info *a,
+			     union iwreq_data *wrqu, char *b);
+
+extern int ieee80211_wx_set_essid(struct ieee80211_device *ieee,
+			      struct iw_request_info *a,
+			      union iwreq_data *wrqu, char *extra);
+
+extern int ieee80211_wx_get_mode(struct ieee80211_device *ieee, struct iw_request_info *a,
+			     union iwreq_data *wrqu, char *b);
+
+extern int ieee80211_wx_set_freq(struct ieee80211_device *ieee, struct iw_request_info *a,
+			     union iwreq_data *wrqu, char *b);
+
+extern int ieee80211_wx_get_freq(struct ieee80211_device *ieee, struct iw_request_info *a,
+			     union iwreq_data *wrqu, char *b);
+
+//extern void ieee80211_wx_sync_scan_wq(struct ieee80211_device *ieee);
+extern void ieee80211_wx_sync_scan_wq(struct work_struct *work);
+
+
+extern int ieee80211_wx_set_rawtx(struct ieee80211_device *ieee,
+			       struct iw_request_info *info,
+			       union iwreq_data *wrqu, char *extra);
+
+extern int ieee80211_wx_get_name(struct ieee80211_device *ieee,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra);
+
+extern int ieee80211_wx_set_power(struct ieee80211_device *ieee,
+				 struct iw_request_info *info,
+				 union iwreq_data *wrqu, char *extra);
+
+extern int ieee80211_wx_get_power(struct ieee80211_device *ieee,
+				 struct iw_request_info *info,
+				 union iwreq_data *wrqu, char *extra);
+
+extern int ieee80211_wx_set_rts(struct ieee80211_device *ieee,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra);
+
+extern int ieee80211_wx_get_rts(struct ieee80211_device *ieee,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra);
+//HT
+#define MAX_RECEIVE_BUFFER_SIZE 9100  //
+extern void HTDebugHTCapability(u8* CapIE, u8* TitleString );
+extern void HTDebugHTInfo(u8*  InfoIE, u8* TitleString);
+
+void HTSetConnectBwMode(struct ieee80211_device* ieee, HT_CHANNEL_WIDTH Bandwidth, HT_EXTCHNL_OFFSET    Offset);
+extern void HTUpdateDefaultSetting(struct ieee80211_device* ieee);
+extern void HTConstructCapabilityElement(struct ieee80211_device* ieee, u8* posHTCap, u8* len, u8 isEncrypt);
+extern void HTConstructInfoElement(struct ieee80211_device* ieee, u8* posHTInfo, u8* len, u8 isEncrypt);
+extern void HTConstructRT2RTAggElement(struct ieee80211_device* ieee, u8* posRT2RTAgg, u8* len);
+extern void HTOnAssocRsp(struct ieee80211_device *ieee);
+extern void HTInitializeHTInfo(struct ieee80211_device* ieee);
+extern void HTInitializeBssDesc(PBSS_HT pBssHT);
+extern void HTResetSelfAndSavePeerSetting(struct ieee80211_device* ieee, struct ieee80211_network * pNetwork);
+extern void HTUpdateSelfAndPeerSetting(struct ieee80211_device* ieee,   struct ieee80211_network * pNetwork);
+extern u8 HTGetHighestMCSRate(struct ieee80211_device* ieee, u8* pMCSRateSet, u8* pMCSFilter);
+extern u8 MCS_FILTER_ALL[];
+extern u16 MCS_DATA_RATE[2][2][77] ;
+extern u8 HTCCheck(struct ieee80211_device* ieee, u8*   pFrame);
+//extern void HTSetConnectBwModeCallback(unsigned long data);
+extern void HTResetIOTSetting(PRT_HIGH_THROUGHPUT  pHTInfo);
+extern bool IsHTHalfNmodeAPs(struct ieee80211_device* ieee);
+extern u16 HTHalfMcsToDataRate(struct ieee80211_device* ieee,  u8      nMcsRate);
+extern u16 HTMcsToDataRate( struct ieee80211_device* ieee, u8 nMcsRate);
+extern u16  TxCountToDataRate( struct ieee80211_device* ieee, u8 nDataRate);
+//function in BAPROC.c
+extern int ieee80211_rx_ADDBAReq( struct ieee80211_device* ieee, struct sk_buff *skb);
+extern int ieee80211_rx_ADDBARsp( struct ieee80211_device* ieee, struct sk_buff *skb);
+extern int ieee80211_rx_DELBA(struct ieee80211_device* ieee,struct sk_buff *skb);
+extern void TsInitAddBA( struct ieee80211_device* ieee, PTX_TS_RECORD   pTS, u8 Policy, u8 bOverwritePending);
+extern void TsInitDelBA( struct ieee80211_device* ieee, PTS_COMMON_INFO pTsCommonInfo, TR_SELECT TxRxSelect);
+extern void BaSetupTimeOut(unsigned long data);
+extern void TxBaInactTimeout(unsigned long data);
+extern void RxBaInactTimeout(unsigned long data);
+extern void ResetBaEntry( PBA_RECORD pBA);
+//function in TS.c
+extern bool GetTs(
+	struct ieee80211_device*        ieee,
+	PTS_COMMON_INFO                 *ppTS,
+	u8*                             Addr,
+	u8                              TID,
+	TR_SELECT                       TxRxSelect,  //Rx:1, Tx:0
+	bool                            bAddNewTs
+	);
+extern void TSInitialize(struct ieee80211_device *ieee);
+extern  void TsStartAddBaProcess(struct ieee80211_device* ieee, PTX_TS_RECORD   pTxTS);
+extern void RemovePeerTS(struct ieee80211_device* ieee, u8* Addr);
+extern void RemoveAllTS(struct ieee80211_device* ieee);
+void ieee80211_softmac_scan_syncro(struct ieee80211_device *ieee);
+
+extern const long ieee80211_wlan_frequencies[];
+
+extern inline void ieee80211_increment_scans(struct ieee80211_device *ieee)
+{
+	ieee->scans++;
+}
+
+extern inline int ieee80211_get_scans(struct ieee80211_device *ieee)
+{
+	return ieee->scans;
+}
+
+static inline const char *escape_essid(const char *essid, u8 essid_len) {
+	static char escaped[IW_ESSID_MAX_SIZE * 2 + 1];
+	const char *s = essid;
+	char *d = escaped;
+
+	if (ieee80211_is_empty_essid(essid, essid_len)) {
+		memcpy(escaped, "<hidden>", sizeof("<hidden>"));
+		return escaped;
+	}
+
+	essid_len = min(essid_len, (u8)IW_ESSID_MAX_SIZE);
+	while (essid_len--) {
+		if (*s == '\0') {
+			*d++ = '\\';
+			*d++ = '0';
+			s++;
+		} else {
+			*d++ = *s++;
+		}
+	}
+	*d = '\0';
+	return escaped;
+}
+
+/* For the function is more related to hardware setting, it's better to use the
+ * ieee handler to refer to it.
+ */
+extern short check_nic_enough_desc(struct net_device *dev, int queue_index);
+extern int ieee80211_data_xmit(struct sk_buff *skb, struct net_device *dev);
+extern int ieee80211_parse_info_param(struct ieee80211_device *ieee,
+		struct ieee80211_info_element *info_element,
+		u16 length,
+		struct ieee80211_network *network,
+		struct ieee80211_rx_stats *stats);
+
+void ieee80211_indicate_packets(struct ieee80211_device *ieee, struct ieee80211_rxb** prxbIndicateArray,u8  index);
+#define RT_ASOC_RETRY_LIMIT	5
+#endif /* IEEE80211_H */
diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_crypt.c b/drivers/staging/rtl8192u/ieee80211/ieee80211_crypt.c
new file mode 100644
index 000000000000..521e7b989934
--- /dev/null
+++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_crypt.c
@@ -0,0 +1,244 @@
+/*
+ * Host AP crypto routines
+ *
+ * Copyright (c) 2002-2003, Jouni Malinen <jkmaline@cc.hut.fi>
+ * Portions Copyright (C) 2004, Intel Corporation <jketreno@linux.intel.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation. See README and COPYING for
+ * more details.
+ *
+ */
+
+//#include <linux/config.h>
+#include <linux/version.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <asm/string.h>
+#include <asm/errno.h>
+
+#include "ieee80211.h"
+
+MODULE_AUTHOR("Jouni Malinen");
+MODULE_DESCRIPTION("HostAP crypto");
+MODULE_LICENSE("GPL");
+
+struct ieee80211_crypto_alg {
+	struct list_head list;
+	struct ieee80211_crypto_ops *ops;
+};
+
+
+struct ieee80211_crypto {
+	struct list_head algs;
+	spinlock_t lock;
+};
+
+static struct ieee80211_crypto *hcrypt;
+
+void ieee80211_crypt_deinit_entries(struct ieee80211_device *ieee,
+					   int force)
+{
+	struct list_head *ptr, *n;
+	struct ieee80211_crypt_data *entry;
+
+	for (ptr = ieee->crypt_deinit_list.next, n = ptr->next;
+	     ptr != &ieee->crypt_deinit_list; ptr = n, n = ptr->next) {
+		entry = list_entry(ptr, struct ieee80211_crypt_data, list);
+
+		if (atomic_read(&entry->refcnt) != 0 && !force)
+			continue;
+
+		list_del(ptr);
+
+		if (entry->ops)
+			entry->ops->deinit(entry->priv);
+		kfree(entry);
+	}
+}
+
+void ieee80211_crypt_deinit_handler(unsigned long data)
+{
+	struct ieee80211_device *ieee = (struct ieee80211_device *)data;
+	unsigned long flags;
+
+	spin_lock_irqsave(&ieee->lock, flags);
+	ieee80211_crypt_deinit_entries(ieee, 0);
+	if (!list_empty(&ieee->crypt_deinit_list)) {
+		printk(KERN_DEBUG "%s: entries remaining in delayed crypt "
+		       "deletion list\n", ieee->dev->name);
+		ieee->crypt_deinit_timer.expires = jiffies + HZ;
+		add_timer(&ieee->crypt_deinit_timer);
+	}
+	spin_unlock_irqrestore(&ieee->lock, flags);
+
+}
+
+void ieee80211_crypt_delayed_deinit(struct ieee80211_device *ieee,
+				    struct ieee80211_crypt_data **crypt)
+{
+	struct ieee80211_crypt_data *tmp;
+	unsigned long flags;
+
+	if (*crypt == NULL)
+		return;
+
+	tmp = *crypt;
+	*crypt = NULL;
+
+	/* must not run ops->deinit() while there may be pending encrypt or
+	 * decrypt operations. Use a list of delayed deinits to avoid needing
+	 * locking. */
+
+	spin_lock_irqsave(&ieee->lock, flags);
+	list_add(&tmp->list, &ieee->crypt_deinit_list);
+	if (!timer_pending(&ieee->crypt_deinit_timer)) {
+		ieee->crypt_deinit_timer.expires = jiffies + HZ;
+		add_timer(&ieee->crypt_deinit_timer);
+	}
+	spin_unlock_irqrestore(&ieee->lock, flags);
+}
+
+int ieee80211_register_crypto_ops(struct ieee80211_crypto_ops *ops)
+{
+	unsigned long flags;
+	struct ieee80211_crypto_alg *alg;
+
+	if (hcrypt == NULL)
+		return -1;
+
+	alg = kmalloc(sizeof(*alg), GFP_KERNEL);
+	if (alg == NULL)
+		return -ENOMEM;
+
+	memset(alg, 0, sizeof(*alg));
+	alg->ops = ops;
+
+	spin_lock_irqsave(&hcrypt->lock, flags);
+	list_add(&alg->list, &hcrypt->algs);
+	spin_unlock_irqrestore(&hcrypt->lock, flags);
+
+	printk(KERN_DEBUG "ieee80211_crypt: registered algorithm '%s'\n",
+	       ops->name);
+
+	return 0;
+}
+
+int ieee80211_unregister_crypto_ops(struct ieee80211_crypto_ops *ops)
+{
+	unsigned long flags;
+	struct list_head *ptr;
+	struct ieee80211_crypto_alg *del_alg = NULL;
+
+	if (hcrypt == NULL)
+		return -1;
+
+	spin_lock_irqsave(&hcrypt->lock, flags);
+	for (ptr = hcrypt->algs.next; ptr != &hcrypt->algs; ptr = ptr->next) {
+		struct ieee80211_crypto_alg *alg =
+			(struct ieee80211_crypto_alg *) ptr;
+		if (alg->ops == ops) {
+			list_del(&alg->list);
+			del_alg = alg;
+			break;
+		}
+	}
+	spin_unlock_irqrestore(&hcrypt->lock, flags);
+
+	if (del_alg) {
+		printk(KERN_DEBUG "ieee80211_crypt: unregistered algorithm "
+		       "'%s'\n", ops->name);
+		kfree(del_alg);
+	}
+
+	return del_alg ? 0 : -1;
+}
+
+
+struct ieee80211_crypto_ops * ieee80211_get_crypto_ops(const char *name)
+{
+	unsigned long flags;
+	struct list_head *ptr;
+	struct ieee80211_crypto_alg *found_alg = NULL;
+
+	if (hcrypt == NULL)
+		return NULL;
+
+	spin_lock_irqsave(&hcrypt->lock, flags);
+	for (ptr = hcrypt->algs.next; ptr != &hcrypt->algs; ptr = ptr->next) {
+		struct ieee80211_crypto_alg *alg =
+			(struct ieee80211_crypto_alg *) ptr;
+		if (strcmp(alg->ops->name, name) == 0) {
+			found_alg = alg;
+			break;
+		}
+	}
+	spin_unlock_irqrestore(&hcrypt->lock, flags);
+
+	if (found_alg)
+		return found_alg->ops;
+	else
+		return NULL;
+}
+
+
+static void * ieee80211_crypt_null_init(int keyidx) { return (void *) 1; }
+static void ieee80211_crypt_null_deinit(void *priv) {}
+
+static struct ieee80211_crypto_ops ieee80211_crypt_null = {
+	.name			= "NULL",
+	.init			= ieee80211_crypt_null_init,
+	.deinit			= ieee80211_crypt_null_deinit,
+	.encrypt_mpdu		= NULL,
+	.decrypt_mpdu		= NULL,
+	.encrypt_msdu		= NULL,
+	.decrypt_msdu		= NULL,
+	.set_key		= NULL,
+	.get_key		= NULL,
+	.extra_prefix_len	= 0,
+	.extra_postfix_len	= 0,
+	.owner			= THIS_MODULE,
+};
+
+int __init ieee80211_crypto_init(void)
+{
+	int ret = -ENOMEM;
+
+	hcrypt = kmalloc(sizeof(*hcrypt), GFP_KERNEL);
+	if (!hcrypt)
+		goto out;
+
+	memset(hcrypt, 0, sizeof(*hcrypt));
+	INIT_LIST_HEAD(&hcrypt->algs);
+	spin_lock_init(&hcrypt->lock);
+
+	ret = ieee80211_register_crypto_ops(&ieee80211_crypt_null);
+	if (ret < 0) {
+		kfree(hcrypt);
+		hcrypt = NULL;
+	}
+out:
+	return ret;
+}
+
+void __exit ieee80211_crypto_deinit(void)
+{
+	struct list_head *ptr, *n;
+
+	if (hcrypt == NULL)
+		return;
+
+	for (ptr = hcrypt->algs.next, n = ptr->next; ptr != &hcrypt->algs;
+	     ptr = n, n = ptr->next) {
+		struct ieee80211_crypto_alg *alg =
+			(struct ieee80211_crypto_alg *) ptr;
+		list_del(ptr);
+		printk(KERN_DEBUG "ieee80211_crypt: unregistered algorithm "
+		       "'%s' (deinit)\n", alg->ops->name);
+		kfree(alg);
+	}
+
+	kfree(hcrypt);
+}
diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_crypt.h b/drivers/staging/rtl8192u/ieee80211/ieee80211_crypt.h
new file mode 100644
index 000000000000..b58a3bcc0dc0
--- /dev/null
+++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_crypt.h
@@ -0,0 +1,86 @@
+/*
+ * Original code based on Host AP (software wireless LAN access point) driver
+ * for Intersil Prism2/2.5/3.
+ *
+ * Copyright (c) 2001-2002, SSH Communications Security Corp and Jouni Malinen
+ * <jkmaline@cc.hut.fi>
+ * Copyright (c) 2002-2003, Jouni Malinen <jkmaline@cc.hut.fi>
+ *
+ * Adaption to a generic IEEE 802.11 stack by James Ketrenos
+ * <jketreno@linux.intel.com>
+ *
+ * Copyright (c) 2004, Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation. See README and COPYING for
+ * more details.
+ */
+
+/*
+ * This file defines the interface to the ieee80211 crypto module.
+ */
+#ifndef IEEE80211_CRYPT_H
+#define IEEE80211_CRYPT_H
+
+#include <linux/skbuff.h>
+
+struct ieee80211_crypto_ops {
+	const char *name;
+
+	/* init new crypto context (e.g., allocate private data space,
+	 * select IV, etc.); returns NULL on failure or pointer to allocated
+	 * private data on success */
+	void * (*init)(int keyidx);
+
+	/* deinitialize crypto context and free allocated private data */
+	void (*deinit)(void *priv);
+
+	/* encrypt/decrypt return < 0 on error or >= 0 on success. The return
+	 * value from decrypt_mpdu is passed as the keyidx value for
+	 * decrypt_msdu. skb must have enough head and tail room for the
+	 * encryption; if not, error will be returned; these functions are
+	 * called for all MPDUs (i.e., fragments).
+	 */
+	int (*encrypt_mpdu)(struct sk_buff *skb, int hdr_len, void *priv);
+	int (*decrypt_mpdu)(struct sk_buff *skb, int hdr_len, void *priv);
+
+	/* These functions are called for full MSDUs, i.e. full frames.
+	 * These can be NULL if full MSDU operations are not needed. */
+	int (*encrypt_msdu)(struct sk_buff *skb, int hdr_len, void *priv);
+	int (*decrypt_msdu)(struct sk_buff *skb, int keyidx, int hdr_len,
+			    void *priv);
+
+	int (*set_key)(void *key, int len, u8 *seq, void *priv);
+	int (*get_key)(void *key, int len, u8 *seq, void *priv);
+
+	/* procfs handler for printing out key information and possible
+	 * statistics */
+	char * (*print_stats)(char *p, void *priv);
+
+	/* maximum number of bytes added by encryption; encrypt buf is
+	 * allocated with extra_prefix_len bytes, copy of in_buf, and
+	 * extra_postfix_len; encrypt need not use all this space, but
+	 * the result must start at the beginning of the buffer and correct
+	 * length must be returned */
+	int extra_prefix_len, extra_postfix_len;
+
+	struct module *owner;
+};
+
+struct ieee80211_crypt_data {
+	struct list_head list; /* delayed deletion list */
+	struct ieee80211_crypto_ops *ops;
+	void *priv;
+	atomic_t refcnt;
+};
+
+int ieee80211_register_crypto_ops(struct ieee80211_crypto_ops *ops);
+int ieee80211_unregister_crypto_ops(struct ieee80211_crypto_ops *ops);
+struct ieee80211_crypto_ops * ieee80211_get_crypto_ops(const char *name);
+void ieee80211_crypt_deinit_entries(struct ieee80211_device *, int);
+void ieee80211_crypt_deinit_handler(unsigned long);
+void ieee80211_crypt_delayed_deinit(struct ieee80211_device *ieee,
+				    struct ieee80211_crypt_data **crypt);
+
+#endif
diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_ccmp.c b/drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_ccmp.c
new file mode 100644
index 000000000000..0b33bf463320
--- /dev/null
+++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_ccmp.c
@@ -0,0 +1,480 @@
+/*
+ * Host AP crypt: host-based CCMP encryption implementation for Host AP driver
+ *
+ * Copyright (c) 2003-2004, Jouni Malinen <jkmaline@cc.hut.fi>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation. See README and COPYING for
+ * more details.
+ */
+
+//#include <linux/config.h>
+#include <linux/version.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/random.h>
+#include <linux/skbuff.h>
+#include <linux/netdevice.h>
+#include <linux/if_ether.h>
+#include <linux/if_arp.h>
+#include <asm/string.h>
+#include <linux/wireless.h>
+
+#include "ieee80211.h"
+
+#include <linux/crypto.h>
+    #include <linux/scatterlist.h>
+
+MODULE_AUTHOR("Jouni Malinen");
+MODULE_DESCRIPTION("Host AP crypt: CCMP");
+MODULE_LICENSE("GPL");
+
+#define AES_BLOCK_LEN 16
+#define CCMP_HDR_LEN 8
+#define CCMP_MIC_LEN 8
+#define CCMP_TK_LEN 16
+#define CCMP_PN_LEN 6
+
+struct ieee80211_ccmp_data {
+	u8 key[CCMP_TK_LEN];
+	int key_set;
+
+	u8 tx_pn[CCMP_PN_LEN];
+	u8 rx_pn[CCMP_PN_LEN];
+
+	u32 dot11RSNAStatsCCMPFormatErrors;
+	u32 dot11RSNAStatsCCMPReplays;
+	u32 dot11RSNAStatsCCMPDecryptErrors;
+
+	int key_idx;
+
+	struct crypto_tfm *tfm;
+
+	/* scratch buffers for virt_to_page() (crypto API) */
+	u8 tx_b0[AES_BLOCK_LEN], tx_b[AES_BLOCK_LEN],
+		tx_e[AES_BLOCK_LEN], tx_s0[AES_BLOCK_LEN];
+	u8 rx_b0[AES_BLOCK_LEN], rx_b[AES_BLOCK_LEN], rx_a[AES_BLOCK_LEN];
+};
+
+void ieee80211_ccmp_aes_encrypt(struct crypto_tfm *tfm,
+			     const u8 pt[16], u8 ct[16])
+{
+	crypto_cipher_encrypt_one((void*)tfm, ct, pt);
+}
+
+static void * ieee80211_ccmp_init(int key_idx)
+{
+	struct ieee80211_ccmp_data *priv;
+
+	priv = kmalloc(sizeof(*priv), GFP_ATOMIC);
+	if (priv == NULL)
+		goto fail;
+	memset(priv, 0, sizeof(*priv));
+	priv->key_idx = key_idx;
+
+       priv->tfm = (void*)crypto_alloc_cipher("aes", 0, CRYPTO_ALG_ASYNC);
+	if (IS_ERR(priv->tfm)) {
+		printk(KERN_DEBUG "ieee80211_crypt_ccmp: could not allocate "
+		       "crypto API aes\n");
+		priv->tfm = NULL;
+		goto fail;
+	}
+
+	return priv;
+
+fail:
+	if (priv) {
+		if (priv->tfm)
+			crypto_free_cipher((void*)priv->tfm);
+		kfree(priv);
+	}
+
+	return NULL;
+}
+
+
+static void ieee80211_ccmp_deinit(void *priv)
+{
+	struct ieee80211_ccmp_data *_priv = priv;
+
+	if (_priv && _priv->tfm)
+		crypto_free_cipher((void*)_priv->tfm);
+	kfree(priv);
+}
+
+
+static inline void xor_block(u8 *b, u8 *a, size_t len)
+{
+	int i;
+	for (i = 0; i < len; i++)
+		b[i] ^= a[i];
+}
+
+
+
+static void ccmp_init_blocks(struct crypto_tfm *tfm,
+			     struct ieee80211_hdr_4addr *hdr,
+			     u8 *pn, size_t dlen, u8 *b0, u8 *auth,
+			     u8 *s0)
+{
+	u8 *pos, qc = 0;
+	size_t aad_len;
+	u16 fc;
+	int a4_included, qc_included;
+	u8 aad[2 * AES_BLOCK_LEN];
+
+	fc = le16_to_cpu(hdr->frame_ctl);
+	a4_included = ((fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) ==
+		       (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS));
+	/*
+	qc_included = ((WLAN_FC_GET_TYPE(fc) == IEEE80211_FTYPE_DATA) &&
+		       (WLAN_FC_GET_STYPE(fc) & 0x08));
+	*/
+	// fixed by David :2006.9.6
+	qc_included = ((WLAN_FC_GET_TYPE(fc) == IEEE80211_FTYPE_DATA) &&
+		       (WLAN_FC_GET_STYPE(fc) & 0x80));
+	aad_len = 22;
+	if (a4_included)
+		aad_len += 6;
+	if (qc_included) {
+		pos = (u8 *) &hdr->addr4;
+		if (a4_included)
+			pos += 6;
+		qc = *pos & 0x0f;
+		aad_len += 2;
+	}
+	/* CCM Initial Block:
+	 * Flag (Include authentication header, M=3 (8-octet MIC),
+	 *       L=1 (2-octet Dlen))
+	 * Nonce: 0x00 | A2 | PN
+	 * Dlen */
+	b0[0] = 0x59;
+	b0[1] = qc;
+	memcpy(b0 + 2, hdr->addr2, ETH_ALEN);
+	memcpy(b0 + 8, pn, CCMP_PN_LEN);
+	b0[14] = (dlen >> 8) & 0xff;
+	b0[15] = dlen & 0xff;
+
+	/* AAD:
+	 * FC with bits 4..6 and 11..13 masked to zero; 14 is always one
+	 * A1 | A2 | A3
+	 * SC with bits 4..15 (seq#) masked to zero
+	 * A4 (if present)
+	 * QC (if present)
+	 */
+	pos = (u8 *) hdr;
+	aad[0] = 0; /* aad_len >> 8 */
+	aad[1] = aad_len & 0xff;
+	aad[2] = pos[0] & 0x8f;
+	aad[3] = pos[1] & 0xc7;
+	memcpy(aad + 4, hdr->addr1, 3 * ETH_ALEN);
+	pos = (u8 *) &hdr->seq_ctl;
+	aad[22] = pos[0] & 0x0f;
+	aad[23] = 0; /* all bits masked */
+	memset(aad + 24, 0, 8);
+	if (a4_included)
+		memcpy(aad + 24, hdr->addr4, ETH_ALEN);
+	if (qc_included) {
+		aad[a4_included ? 30 : 24] = qc;
+		/* rest of QC masked */
+	}
+
+	/* Start with the first block and AAD */
+	ieee80211_ccmp_aes_encrypt(tfm, b0, auth);
+	xor_block(auth, aad, AES_BLOCK_LEN);
+	ieee80211_ccmp_aes_encrypt(tfm, auth, auth);
+	xor_block(auth, &aad[AES_BLOCK_LEN], AES_BLOCK_LEN);
+	ieee80211_ccmp_aes_encrypt(tfm, auth, auth);
+	b0[0] &= 0x07;
+	b0[14] = b0[15] = 0;
+	ieee80211_ccmp_aes_encrypt(tfm, b0, s0);
+}
+
+
+
+static int ieee80211_ccmp_encrypt(struct sk_buff *skb, int hdr_len, void *priv)
+{
+	struct ieee80211_ccmp_data *key = priv;
+	int data_len, i;
+	u8 *pos;
+	struct ieee80211_hdr_4addr *hdr;
+	cb_desc *tcb_desc = (cb_desc *)(skb->cb + MAX_DEV_ADDR_SIZE);
+
+	if (skb_headroom(skb) < CCMP_HDR_LEN ||
+	    skb_tailroom(skb) < CCMP_MIC_LEN ||
+	    skb->len < hdr_len)
+		return -1;
+
+	data_len = skb->len - hdr_len;
+	pos = skb_push(skb, CCMP_HDR_LEN);
+	memmove(pos, pos + CCMP_HDR_LEN, hdr_len);
+	pos += hdr_len;
+//	mic = skb_put(skb, CCMP_MIC_LEN);
+
+	i = CCMP_PN_LEN - 1;
+	while (i >= 0) {
+		key->tx_pn[i]++;
+		if (key->tx_pn[i] != 0)
+			break;
+		i--;
+	}
+
+	*pos++ = key->tx_pn[5];
+	*pos++ = key->tx_pn[4];
+	*pos++ = 0;
+	*pos++ = (key->key_idx << 6) | (1 << 5) /* Ext IV included */;
+	*pos++ = key->tx_pn[3];
+	*pos++ = key->tx_pn[2];
+	*pos++ = key->tx_pn[1];
+	*pos++ = key->tx_pn[0];
+
+
+	hdr = (struct ieee80211_hdr_4addr *) skb->data;
+	if (!tcb_desc->bHwSec)
+	{
+		int blocks, last, len;
+		u8 *mic;
+		u8 *b0 = key->tx_b0;
+		u8 *b = key->tx_b;
+		u8 *e = key->tx_e;
+		u8 *s0 = key->tx_s0;
+
+		//mic is moved to here by john
+		mic = skb_put(skb, CCMP_MIC_LEN);
+
+		ccmp_init_blocks(key->tfm, hdr, key->tx_pn, data_len, b0, b, s0);
+
+		blocks = (data_len + AES_BLOCK_LEN - 1) / AES_BLOCK_LEN;
+		last = data_len % AES_BLOCK_LEN;
+
+		for (i = 1; i <= blocks; i++) {
+			len = (i == blocks && last) ? last : AES_BLOCK_LEN;
+			/* Authentication */
+			xor_block(b, pos, len);
+			ieee80211_ccmp_aes_encrypt(key->tfm, b, b);
+			/* Encryption, with counter */
+			b0[14] = (i >> 8) & 0xff;
+			b0[15] = i & 0xff;
+			ieee80211_ccmp_aes_encrypt(key->tfm, b0, e);
+			xor_block(pos, e, len);
+			pos += len;
+		}
+
+		for (i = 0; i < CCMP_MIC_LEN; i++)
+			mic[i] = b[i] ^ s0[i];
+	}
+	return 0;
+}
+
+
+static int ieee80211_ccmp_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
+{
+	struct ieee80211_ccmp_data *key = priv;
+	u8 keyidx, *pos;
+	struct ieee80211_hdr_4addr *hdr;
+	cb_desc *tcb_desc = (cb_desc *)(skb->cb + MAX_DEV_ADDR_SIZE);
+	u8 pn[6];
+
+	if (skb->len < hdr_len + CCMP_HDR_LEN + CCMP_MIC_LEN) {
+		key->dot11RSNAStatsCCMPFormatErrors++;
+		return -1;
+	}
+
+	hdr = (struct ieee80211_hdr_4addr *) skb->data;
+	pos = skb->data + hdr_len;
+	keyidx = pos[3];
+	if (!(keyidx & (1 << 5))) {
+		if (net_ratelimit()) {
+			printk(KERN_DEBUG "CCMP: received packet without ExtIV"
+			       " flag from " MAC_FMT "\n", MAC_ARG(hdr->addr2));
+		}
+		key->dot11RSNAStatsCCMPFormatErrors++;
+		return -2;
+	}
+	keyidx >>= 6;
+	if (key->key_idx != keyidx) {
+		printk(KERN_DEBUG "CCMP: RX tkey->key_idx=%d frame "
+		       "keyidx=%d priv=%p\n", key->key_idx, keyidx, priv);
+		return -6;
+	}
+	if (!key->key_set) {
+		if (net_ratelimit()) {
+			printk(KERN_DEBUG "CCMP: received packet from " MAC_FMT
+			       " with keyid=%d that does not have a configured"
+			       " key\n", MAC_ARG(hdr->addr2), keyidx);
+		}
+		return -3;
+	}
+
+	pn[0] = pos[7];
+	pn[1] = pos[6];
+	pn[2] = pos[5];
+	pn[3] = pos[4];
+	pn[4] = pos[1];
+	pn[5] = pos[0];
+	pos += 8;
+
+	if (memcmp(pn, key->rx_pn, CCMP_PN_LEN) <= 0) {
+		if (net_ratelimit()) {
+			printk(KERN_DEBUG "CCMP: replay detected: STA=" MAC_FMT
+			       " previous PN %02x%02x%02x%02x%02x%02x "
+			       "received PN %02x%02x%02x%02x%02x%02x\n",
+			       MAC_ARG(hdr->addr2), MAC_ARG(key->rx_pn),
+			       MAC_ARG(pn));
+		}
+		key->dot11RSNAStatsCCMPReplays++;
+		return -4;
+	}
+	if (!tcb_desc->bHwSec)
+	{
+		size_t data_len = skb->len - hdr_len - CCMP_HDR_LEN - CCMP_MIC_LEN;
+		u8 *mic = skb->data + skb->len - CCMP_MIC_LEN;
+		u8 *b0 = key->rx_b0;
+		u8 *b = key->rx_b;
+		u8 *a = key->rx_a;
+		int i, blocks, last, len;
+
+
+		ccmp_init_blocks(key->tfm, hdr, pn, data_len, b0, a, b);
+		xor_block(mic, b, CCMP_MIC_LEN);
+
+		blocks = (data_len + AES_BLOCK_LEN - 1) / AES_BLOCK_LEN;
+		last = data_len % AES_BLOCK_LEN;
+
+		for (i = 1; i <= blocks; i++) {
+			len = (i == blocks && last) ? last : AES_BLOCK_LEN;
+			/* Decrypt, with counter */
+			b0[14] = (i >> 8) & 0xff;
+			b0[15] = i & 0xff;
+			ieee80211_ccmp_aes_encrypt(key->tfm, b0, b);
+			xor_block(pos, b, len);
+			/* Authentication */
+			xor_block(a, pos, len);
+			ieee80211_ccmp_aes_encrypt(key->tfm, a, a);
+			pos += len;
+		}
+
+		if (memcmp(mic, a, CCMP_MIC_LEN) != 0) {
+			if (net_ratelimit()) {
+				printk(KERN_DEBUG "CCMP: decrypt failed: STA="
+				MAC_FMT "\n", MAC_ARG(hdr->addr2));
+			}
+			key->dot11RSNAStatsCCMPDecryptErrors++;
+			return -5;
+		}
+
+		memcpy(key->rx_pn, pn, CCMP_PN_LEN);
+	}
+	/* Remove hdr and MIC */
+	memmove(skb->data + CCMP_HDR_LEN, skb->data, hdr_len);
+	skb_pull(skb, CCMP_HDR_LEN);
+	skb_trim(skb, skb->len - CCMP_MIC_LEN);
+
+	return keyidx;
+}
+
+
+static int ieee80211_ccmp_set_key(void *key, int len, u8 *seq, void *priv)
+{
+	struct ieee80211_ccmp_data *data = priv;
+	int keyidx;
+	struct crypto_tfm *tfm = data->tfm;
+
+	keyidx = data->key_idx;
+	memset(data, 0, sizeof(*data));
+	data->key_idx = keyidx;
+	data->tfm = tfm;
+	if (len == CCMP_TK_LEN) {
+		memcpy(data->key, key, CCMP_TK_LEN);
+		data->key_set = 1;
+		if (seq) {
+			data->rx_pn[0] = seq[5];
+			data->rx_pn[1] = seq[4];
+			data->rx_pn[2] = seq[3];
+			data->rx_pn[3] = seq[2];
+			data->rx_pn[4] = seq[1];
+			data->rx_pn[5] = seq[0];
+		}
+		crypto_cipher_setkey((void*)data->tfm, data->key, CCMP_TK_LEN);
+	} else if (len == 0)
+		data->key_set = 0;
+	else
+		return -1;
+
+	return 0;
+}
+
+
+static int ieee80211_ccmp_get_key(void *key, int len, u8 *seq, void *priv)
+{
+	struct ieee80211_ccmp_data *data = priv;
+
+	if (len < CCMP_TK_LEN)
+		return -1;
+
+	if (!data->key_set)
+		return 0;
+	memcpy(key, data->key, CCMP_TK_LEN);
+
+	if (seq) {
+		seq[0] = data->tx_pn[5];
+		seq[1] = data->tx_pn[4];
+		seq[2] = data->tx_pn[3];
+		seq[3] = data->tx_pn[2];
+		seq[4] = data->tx_pn[1];
+		seq[5] = data->tx_pn[0];
+	}
+
+	return CCMP_TK_LEN;
+}
+
+
+static char * ieee80211_ccmp_print_stats(char *p, void *priv)
+{
+	struct ieee80211_ccmp_data *ccmp = priv;
+	p += sprintf(p, "key[%d] alg=CCMP key_set=%d "
+		     "tx_pn=%02x%02x%02x%02x%02x%02x "
+		     "rx_pn=%02x%02x%02x%02x%02x%02x "
+		     "format_errors=%d replays=%d decrypt_errors=%d\n",
+		     ccmp->key_idx, ccmp->key_set,
+		     MAC_ARG(ccmp->tx_pn), MAC_ARG(ccmp->rx_pn),
+		     ccmp->dot11RSNAStatsCCMPFormatErrors,
+		     ccmp->dot11RSNAStatsCCMPReplays,
+		     ccmp->dot11RSNAStatsCCMPDecryptErrors);
+
+	return p;
+}
+
+void ieee80211_ccmp_null(void)
+{
+//    printk("============>%s()\n", __FUNCTION__);
+	return;
+}
+
+static struct ieee80211_crypto_ops ieee80211_crypt_ccmp = {
+	.name			= "CCMP",
+	.init			= ieee80211_ccmp_init,
+	.deinit			= ieee80211_ccmp_deinit,
+	.encrypt_mpdu		= ieee80211_ccmp_encrypt,
+	.decrypt_mpdu		= ieee80211_ccmp_decrypt,
+	.encrypt_msdu		= NULL,
+	.decrypt_msdu		= NULL,
+	.set_key		= ieee80211_ccmp_set_key,
+	.get_key		= ieee80211_ccmp_get_key,
+	.print_stats		= ieee80211_ccmp_print_stats,
+	.extra_prefix_len	= CCMP_HDR_LEN,
+	.extra_postfix_len	= CCMP_MIC_LEN,
+	.owner			= THIS_MODULE,
+};
+
+int __init ieee80211_crypto_ccmp_init(void)
+{
+	return ieee80211_register_crypto_ops(&ieee80211_crypt_ccmp);
+}
+
+void __exit ieee80211_crypto_ccmp_exit(void)
+{
+	ieee80211_unregister_crypto_ops(&ieee80211_crypt_ccmp);
+}
diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_tkip.c b/drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_tkip.c
new file mode 100644
index 000000000000..841b99955b79
--- /dev/null
+++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_tkip.c
@@ -0,0 +1,780 @@
+/*
+ * Host AP crypt: host-based TKIP encryption implementation for Host AP driver
+ *
+ * Copyright (c) 2003-2004, Jouni Malinen <jkmaline@cc.hut.fi>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation. See README and COPYING for
+ * more details.
+ */
+
+//#include <linux/config.h>
+#include <linux/version.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/random.h>
+#include <linux/skbuff.h>
+#include <linux/netdevice.h>
+#include <linux/if_ether.h>
+#include <linux/if_arp.h>
+#include <asm/string.h>
+
+#include "ieee80211.h"
+
+#include <linux/crypto.h>
+	#include <linux/scatterlist.h>
+#include <linux/crc32.h>
+
+MODULE_AUTHOR("Jouni Malinen");
+MODULE_DESCRIPTION("Host AP crypt: TKIP");
+MODULE_LICENSE("GPL");
+
+struct ieee80211_tkip_data {
+#define TKIP_KEY_LEN 32
+	u8 key[TKIP_KEY_LEN];
+	int key_set;
+
+	u32 tx_iv32;
+	u16 tx_iv16;
+	u16 tx_ttak[5];
+	int tx_phase1_done;
+
+	u32 rx_iv32;
+	u16 rx_iv16;
+	u16 rx_ttak[5];
+	int rx_phase1_done;
+	u32 rx_iv32_new;
+	u16 rx_iv16_new;
+
+	u32 dot11RSNAStatsTKIPReplays;
+	u32 dot11RSNAStatsTKIPICVErrors;
+	u32 dot11RSNAStatsTKIPLocalMICFailures;
+
+	int key_idx;
+
+	struct crypto_blkcipher *rx_tfm_arc4;
+	struct crypto_hash *rx_tfm_michael;
+	struct crypto_blkcipher *tx_tfm_arc4;
+	struct crypto_hash *tx_tfm_michael;
+
+	/* scratch buffers for virt_to_page() (crypto API) */
+	u8 rx_hdr[16], tx_hdr[16];
+};
+
+static void * ieee80211_tkip_init(int key_idx)
+{
+	struct ieee80211_tkip_data *priv;
+
+	priv = kmalloc(sizeof(*priv), GFP_ATOMIC);
+	if (priv == NULL)
+		goto fail;
+	memset(priv, 0, sizeof(*priv));
+	priv->key_idx = key_idx;
+
+	priv->tx_tfm_arc4 = crypto_alloc_blkcipher("ecb(arc4)", 0,
+			CRYPTO_ALG_ASYNC);
+	if (IS_ERR(priv->tx_tfm_arc4)) {
+		printk(KERN_DEBUG "ieee80211_crypt_tkip: could not allocate "
+				"crypto API arc4\n");
+		priv->tx_tfm_arc4 = NULL;
+		goto fail;
+	}
+
+	priv->tx_tfm_michael = crypto_alloc_hash("michael_mic", 0,
+			CRYPTO_ALG_ASYNC);
+	if (IS_ERR(priv->tx_tfm_michael)) {
+		printk(KERN_DEBUG "ieee80211_crypt_tkip: could not allocate "
+				"crypto API michael_mic\n");
+		priv->tx_tfm_michael = NULL;
+		goto fail;
+	}
+
+	priv->rx_tfm_arc4 = crypto_alloc_blkcipher("ecb(arc4)", 0,
+			CRYPTO_ALG_ASYNC);
+	if (IS_ERR(priv->rx_tfm_arc4)) {
+		printk(KERN_DEBUG "ieee80211_crypt_tkip: could not allocate "
+				"crypto API arc4\n");
+		priv->rx_tfm_arc4 = NULL;
+		goto fail;
+	}
+
+	priv->rx_tfm_michael = crypto_alloc_hash("michael_mic", 0,
+			CRYPTO_ALG_ASYNC);
+	if (IS_ERR(priv->rx_tfm_michael)) {
+		printk(KERN_DEBUG "ieee80211_crypt_tkip: could not allocate "
+				"crypto API michael_mic\n");
+		priv->rx_tfm_michael = NULL;
+		goto fail;
+	}
+
+	return priv;
+
+fail:
+	if (priv) {
+		if (priv->tx_tfm_michael)
+			crypto_free_hash(priv->tx_tfm_michael);
+		if (priv->tx_tfm_arc4)
+			crypto_free_blkcipher(priv->tx_tfm_arc4);
+		if (priv->rx_tfm_michael)
+			crypto_free_hash(priv->rx_tfm_michael);
+		if (priv->rx_tfm_arc4)
+			crypto_free_blkcipher(priv->rx_tfm_arc4);
+		kfree(priv);
+	}
+
+	return NULL;
+}
+
+
+static void ieee80211_tkip_deinit(void *priv)
+{
+	struct ieee80211_tkip_data *_priv = priv;
+
+	if (_priv) {
+		if (_priv->tx_tfm_michael)
+			crypto_free_hash(_priv->tx_tfm_michael);
+		if (_priv->tx_tfm_arc4)
+			crypto_free_blkcipher(_priv->tx_tfm_arc4);
+		if (_priv->rx_tfm_michael)
+			crypto_free_hash(_priv->rx_tfm_michael);
+		if (_priv->rx_tfm_arc4)
+			crypto_free_blkcipher(_priv->rx_tfm_arc4);
+	}
+	kfree(priv);
+}
+
+
+static inline u16 RotR1(u16 val)
+{
+	return (val >> 1) | (val << 15);
+}
+
+
+static inline u8 Lo8(u16 val)
+{
+	return val & 0xff;
+}
+
+
+static inline u8 Hi8(u16 val)
+{
+	return val >> 8;
+}
+
+
+static inline u16 Lo16(u32 val)
+{
+	return val & 0xffff;
+}
+
+
+static inline u16 Hi16(u32 val)
+{
+	return val >> 16;
+}
+
+
+static inline u16 Mk16(u8 hi, u8 lo)
+{
+	return lo | (((u16) hi) << 8);
+}
+
+
+static inline u16 Mk16_le(u16 *v)
+{
+	return le16_to_cpu(*v);
+}
+
+
+static const u16 Sbox[256] =
+{
+	0xC6A5, 0xF884, 0xEE99, 0xF68D, 0xFF0D, 0xD6BD, 0xDEB1, 0x9154,
+	0x6050, 0x0203, 0xCEA9, 0x567D, 0xE719, 0xB562, 0x4DE6, 0xEC9A,
+	0x8F45, 0x1F9D, 0x8940, 0xFA87, 0xEF15, 0xB2EB, 0x8EC9, 0xFB0B,
+	0x41EC, 0xB367, 0x5FFD, 0x45EA, 0x23BF, 0x53F7, 0xE496, 0x9B5B,
+	0x75C2, 0xE11C, 0x3DAE, 0x4C6A, 0x6C5A, 0x7E41, 0xF502, 0x834F,
+	0x685C, 0x51F4, 0xD134, 0xF908, 0xE293, 0xAB73, 0x6253, 0x2A3F,
+	0x080C, 0x9552, 0x4665, 0x9D5E, 0x3028, 0x37A1, 0x0A0F, 0x2FB5,
+	0x0E09, 0x2436, 0x1B9B, 0xDF3D, 0xCD26, 0x4E69, 0x7FCD, 0xEA9F,
+	0x121B, 0x1D9E, 0x5874, 0x342E, 0x362D, 0xDCB2, 0xB4EE, 0x5BFB,
+	0xA4F6, 0x764D, 0xB761, 0x7DCE, 0x527B, 0xDD3E, 0x5E71, 0x1397,
+	0xA6F5, 0xB968, 0x0000, 0xC12C, 0x4060, 0xE31F, 0x79C8, 0xB6ED,
+	0xD4BE, 0x8D46, 0x67D9, 0x724B, 0x94DE, 0x98D4, 0xB0E8, 0x854A,
+	0xBB6B, 0xC52A, 0x4FE5, 0xED16, 0x86C5, 0x9AD7, 0x6655, 0x1194,
+	0x8ACF, 0xE910, 0x0406, 0xFE81, 0xA0F0, 0x7844, 0x25BA, 0x4BE3,
+	0xA2F3, 0x5DFE, 0x80C0, 0x058A, 0x3FAD, 0x21BC, 0x7048, 0xF104,
+	0x63DF, 0x77C1, 0xAF75, 0x4263, 0x2030, 0xE51A, 0xFD0E, 0xBF6D,
+	0x814C, 0x1814, 0x2635, 0xC32F, 0xBEE1, 0x35A2, 0x88CC, 0x2E39,
+	0x9357, 0x55F2, 0xFC82, 0x7A47, 0xC8AC, 0xBAE7, 0x322B, 0xE695,
+	0xC0A0, 0x1998, 0x9ED1, 0xA37F, 0x4466, 0x547E, 0x3BAB, 0x0B83,
+	0x8CCA, 0xC729, 0x6BD3, 0x283C, 0xA779, 0xBCE2, 0x161D, 0xAD76,
+	0xDB3B, 0x6456, 0x744E, 0x141E, 0x92DB, 0x0C0A, 0x486C, 0xB8E4,
+	0x9F5D, 0xBD6E, 0x43EF, 0xC4A6, 0x39A8, 0x31A4, 0xD337, 0xF28B,
+	0xD532, 0x8B43, 0x6E59, 0xDAB7, 0x018C, 0xB164, 0x9CD2, 0x49E0,
+	0xD8B4, 0xACFA, 0xF307, 0xCF25, 0xCAAF, 0xF48E, 0x47E9, 0x1018,
+	0x6FD5, 0xF088, 0x4A6F, 0x5C72, 0x3824, 0x57F1, 0x73C7, 0x9751,
+	0xCB23, 0xA17C, 0xE89C, 0x3E21, 0x96DD, 0x61DC, 0x0D86, 0x0F85,
+	0xE090, 0x7C42, 0x71C4, 0xCCAA, 0x90D8, 0x0605, 0xF701, 0x1C12,
+	0xC2A3, 0x6A5F, 0xAEF9, 0x69D0, 0x1791, 0x9958, 0x3A27, 0x27B9,
+	0xD938, 0xEB13, 0x2BB3, 0x2233, 0xD2BB, 0xA970, 0x0789, 0x33A7,
+	0x2DB6, 0x3C22, 0x1592, 0xC920, 0x8749, 0xAAFF, 0x5078, 0xA57A,
+	0x038F, 0x59F8, 0x0980, 0x1A17, 0x65DA, 0xD731, 0x84C6, 0xD0B8,
+	0x82C3, 0x29B0, 0x5A77, 0x1E11, 0x7BCB, 0xA8FC, 0x6DD6, 0x2C3A,
+};
+
+
+static inline u16 _S_(u16 v)
+{
+	u16 t = Sbox[Hi8(v)];
+	return Sbox[Lo8(v)] ^ ((t << 8) | (t >> 8));
+}
+
+
+#define PHASE1_LOOP_COUNT 8
+
+
+static void tkip_mixing_phase1(u16 *TTAK, const u8 *TK, const u8 *TA, u32 IV32)
+{
+	int i, j;
+
+	/* Initialize the 80-bit TTAK from TSC (IV32) and TA[0..5] */
+	TTAK[0] = Lo16(IV32);
+	TTAK[1] = Hi16(IV32);
+	TTAK[2] = Mk16(TA[1], TA[0]);
+	TTAK[3] = Mk16(TA[3], TA[2]);
+	TTAK[4] = Mk16(TA[5], TA[4]);
+
+	for (i = 0; i < PHASE1_LOOP_COUNT; i++) {
+		j = 2 * (i & 1);
+		TTAK[0] += _S_(TTAK[4] ^ Mk16(TK[1 + j], TK[0 + j]));
+		TTAK[1] += _S_(TTAK[0] ^ Mk16(TK[5 + j], TK[4 + j]));
+		TTAK[2] += _S_(TTAK[1] ^ Mk16(TK[9 + j], TK[8 + j]));
+		TTAK[3] += _S_(TTAK[2] ^ Mk16(TK[13 + j], TK[12 + j]));
+		TTAK[4] += _S_(TTAK[3] ^ Mk16(TK[1 + j], TK[0 + j])) + i;
+	}
+}
+
+
+static void tkip_mixing_phase2(u8 *WEPSeed, const u8 *TK, const u16 *TTAK,
+			       u16 IV16)
+{
+	/* Make temporary area overlap WEP seed so that the final copy can be
+	 * avoided on little endian hosts. */
+	u16 *PPK = (u16 *) &WEPSeed[4];
+
+	/* Step 1 - make copy of TTAK and bring in TSC */
+	PPK[0] = TTAK[0];
+	PPK[1] = TTAK[1];
+	PPK[2] = TTAK[2];
+	PPK[3] = TTAK[3];
+	PPK[4] = TTAK[4];
+	PPK[5] = TTAK[4] + IV16;
+
+	/* Step 2 - 96-bit bijective mixing using S-box */
+	PPK[0] += _S_(PPK[5] ^ Mk16_le((u16 *) &TK[0]));
+	PPK[1] += _S_(PPK[0] ^ Mk16_le((u16 *) &TK[2]));
+	PPK[2] += _S_(PPK[1] ^ Mk16_le((u16 *) &TK[4]));
+	PPK[3] += _S_(PPK[2] ^ Mk16_le((u16 *) &TK[6]));
+	PPK[4] += _S_(PPK[3] ^ Mk16_le((u16 *) &TK[8]));
+	PPK[5] += _S_(PPK[4] ^ Mk16_le((u16 *) &TK[10]));
+
+	PPK[0] += RotR1(PPK[5] ^ Mk16_le((u16 *) &TK[12]));
+	PPK[1] += RotR1(PPK[0] ^ Mk16_le((u16 *) &TK[14]));
+	PPK[2] += RotR1(PPK[1]);
+	PPK[3] += RotR1(PPK[2]);
+	PPK[4] += RotR1(PPK[3]);
+	PPK[5] += RotR1(PPK[4]);
+
+	/* Step 3 - bring in last of TK bits, assign 24-bit WEP IV value
+	 * WEPSeed[0..2] is transmitted as WEP IV */
+	WEPSeed[0] = Hi8(IV16);
+	WEPSeed[1] = (Hi8(IV16) | 0x20) & 0x7F;
+	WEPSeed[2] = Lo8(IV16);
+	WEPSeed[3] = Lo8((PPK[5] ^ Mk16_le((u16 *) &TK[0])) >> 1);
+
+#ifdef __BIG_ENDIAN
+	{
+		int i;
+		for (i = 0; i < 6; i++)
+			PPK[i] = (PPK[i] << 8) | (PPK[i] >> 8);
+	}
+#endif
+}
+
+
+static int ieee80211_tkip_encrypt(struct sk_buff *skb, int hdr_len, void *priv)
+{
+	struct ieee80211_tkip_data *tkey = priv;
+		int len;
+	u8 *pos;
+	struct ieee80211_hdr_4addr *hdr;
+	cb_desc *tcb_desc = (cb_desc *)(skb->cb + MAX_DEV_ADDR_SIZE);
+	struct blkcipher_desc desc = {.tfm = tkey->tx_tfm_arc4};
+	int ret = 0;
+	u8 rc4key[16],  *icv;
+	u32 crc;
+	struct scatterlist sg;
+
+	if (skb_headroom(skb) < 8 || skb_tailroom(skb) < 4 ||
+	    skb->len < hdr_len)
+		return -1;
+
+	hdr = (struct ieee80211_hdr_4addr *) skb->data;
+
+	if (!tcb_desc->bHwSec)
+	{
+		if (!tkey->tx_phase1_done) {
+			tkip_mixing_phase1(tkey->tx_ttak, tkey->key, hdr->addr2,
+					tkey->tx_iv32);
+			tkey->tx_phase1_done = 1;
+		}
+		tkip_mixing_phase2(rc4key, tkey->key, tkey->tx_ttak, tkey->tx_iv16);
+	}
+	else
+	tkey->tx_phase1_done = 1;
+
+
+	len = skb->len - hdr_len;
+	pos = skb_push(skb, 8);
+	memmove(pos, pos + 8, hdr_len);
+	pos += hdr_len;
+
+	if (tcb_desc->bHwSec)
+	{
+		*pos++ = Hi8(tkey->tx_iv16);
+		*pos++ = (Hi8(tkey->tx_iv16) | 0x20) & 0x7F;
+		*pos++ = Lo8(tkey->tx_iv16);
+	}
+	else
+	{
+		*pos++ = rc4key[0];
+		*pos++ = rc4key[1];
+		*pos++ = rc4key[2];
+	}
+
+	*pos++ = (tkey->key_idx << 6) | (1 << 5) /* Ext IV included */;
+	*pos++ = tkey->tx_iv32 & 0xff;
+	*pos++ = (tkey->tx_iv32 >> 8) & 0xff;
+	*pos++ = (tkey->tx_iv32 >> 16) & 0xff;
+	*pos++ = (tkey->tx_iv32 >> 24) & 0xff;
+
+	if (!tcb_desc->bHwSec)
+	{
+		icv = skb_put(skb, 4);
+		crc = ~crc32_le(~0, pos, len);
+		icv[0] = crc;
+		icv[1] = crc >> 8;
+		icv[2] = crc >> 16;
+		icv[3] = crc >> 24;
+		crypto_blkcipher_setkey(tkey->tx_tfm_arc4, rc4key, 16);
+		sg_init_one(&sg, pos, len+4);
+		ret= crypto_blkcipher_encrypt(&desc, &sg, &sg, len + 4);
+	}
+
+	tkey->tx_iv16++;
+	if (tkey->tx_iv16 == 0) {
+		tkey->tx_phase1_done = 0;
+		tkey->tx_iv32++;
+	}
+
+	if (!tcb_desc->bHwSec)
+		return ret;
+	else
+		return 0;
+
+
+}
+
+static int ieee80211_tkip_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
+{
+	struct ieee80211_tkip_data *tkey = priv;
+	u8 keyidx, *pos;
+	u32 iv32;
+	u16 iv16;
+	struct ieee80211_hdr_4addr *hdr;
+	cb_desc *tcb_desc = (cb_desc *)(skb->cb + MAX_DEV_ADDR_SIZE);
+	struct blkcipher_desc desc = {.tfm = tkey->rx_tfm_arc4};
+	u8 rc4key[16];
+	u8 icv[4];
+	u32 crc;
+	struct scatterlist sg;
+	int plen;
+	if (skb->len < hdr_len + 8 + 4)
+		return -1;
+
+	hdr = (struct ieee80211_hdr_4addr *) skb->data;
+	pos = skb->data + hdr_len;
+	keyidx = pos[3];
+	if (!(keyidx & (1 << 5))) {
+		if (net_ratelimit()) {
+			printk(KERN_DEBUG "TKIP: received packet without ExtIV"
+			       " flag from " MAC_FMT "\n", MAC_ARG(hdr->addr2));
+		}
+		return -2;
+	}
+	keyidx >>= 6;
+	if (tkey->key_idx != keyidx) {
+		printk(KERN_DEBUG "TKIP: RX tkey->key_idx=%d frame "
+		       "keyidx=%d priv=%p\n", tkey->key_idx, keyidx, priv);
+		return -6;
+	}
+	if (!tkey->key_set) {
+		if (net_ratelimit()) {
+			printk(KERN_DEBUG "TKIP: received packet from " MAC_FMT
+			       " with keyid=%d that does not have a configured"
+			       " key\n", MAC_ARG(hdr->addr2), keyidx);
+		}
+		return -3;
+	}
+	iv16 = (pos[0] << 8) | pos[2];
+	iv32 = pos[4] | (pos[5] << 8) | (pos[6] << 16) | (pos[7] << 24);
+	pos += 8;
+
+	if (!tcb_desc->bHwSec)
+	{
+		if (iv32 < tkey->rx_iv32 ||
+		(iv32 == tkey->rx_iv32 && iv16 <= tkey->rx_iv16)) {
+			if (net_ratelimit()) {
+				printk(KERN_DEBUG "TKIP: replay detected: STA=" MAC_FMT
+				" previous TSC %08x%04x received TSC "
+				"%08x%04x\n", MAC_ARG(hdr->addr2),
+				tkey->rx_iv32, tkey->rx_iv16, iv32, iv16);
+			}
+			tkey->dot11RSNAStatsTKIPReplays++;
+			return -4;
+		}
+
+		if (iv32 != tkey->rx_iv32 || !tkey->rx_phase1_done) {
+			tkip_mixing_phase1(tkey->rx_ttak, tkey->key, hdr->addr2, iv32);
+			tkey->rx_phase1_done = 1;
+		}
+		tkip_mixing_phase2(rc4key, tkey->key, tkey->rx_ttak, iv16);
+
+		plen = skb->len - hdr_len - 12;
+
+		crypto_blkcipher_setkey(tkey->rx_tfm_arc4, rc4key, 16);
+		sg_init_one(&sg, pos, plen+4);
+
+		if (crypto_blkcipher_decrypt(&desc, &sg, &sg, plen + 4)) {
+			if (net_ratelimit()) {
+				printk(KERN_DEBUG ": TKIP: failed to decrypt "
+						"received packet from " MAC_FMT "\n",
+						MAC_ARG(hdr->addr2));
+			}
+			return -7;
+		}
+
+		crc = ~crc32_le(~0, pos, plen);
+		icv[0] = crc;
+		icv[1] = crc >> 8;
+		icv[2] = crc >> 16;
+		icv[3] = crc >> 24;
+
+		if (memcmp(icv, pos + plen, 4) != 0) {
+			if (iv32 != tkey->rx_iv32) {
+				/* Previously cached Phase1 result was already lost, so
+				* it needs to be recalculated for the next packet. */
+				tkey->rx_phase1_done = 0;
+			}
+			if (net_ratelimit()) {
+				printk(KERN_DEBUG "TKIP: ICV error detected: STA="
+				MAC_FMT "\n", MAC_ARG(hdr->addr2));
+			}
+			tkey->dot11RSNAStatsTKIPICVErrors++;
+			return -5;
+		}
+
+	}
+
+	/* Update real counters only after Michael MIC verification has
+	 * completed */
+	tkey->rx_iv32_new = iv32;
+	tkey->rx_iv16_new = iv16;
+
+	/* Remove IV and ICV */
+	memmove(skb->data + 8, skb->data, hdr_len);
+	skb_pull(skb, 8);
+	skb_trim(skb, skb->len - 4);
+
+	return keyidx;
+}
+
+static int michael_mic(struct crypto_hash *tfm_michael, u8 * key, u8 * hdr,
+		       u8 * data, size_t data_len, u8 * mic)
+{
+	struct hash_desc desc;
+	struct scatterlist sg[2];
+
+	if (tfm_michael == NULL) {
+		printk(KERN_WARNING "michael_mic: tfm_michael == NULL\n");
+		return -1;
+	}
+
+	sg_init_table(sg, 2);
+	sg_set_buf(&sg[0], hdr, 16);
+	sg_set_buf(&sg[1], data, data_len);
+
+	if (crypto_hash_setkey(tfm_michael, key, 8))
+		return -1;
+
+	desc.tfm = tfm_michael;
+	desc.flags = 0;
+	return crypto_hash_digest(&desc, sg, data_len + 16, mic);
+}
+
+static void michael_mic_hdr(struct sk_buff *skb, u8 *hdr)
+{
+	struct ieee80211_hdr_4addr *hdr11;
+
+	hdr11 = (struct ieee80211_hdr_4addr *) skb->data;
+	switch (le16_to_cpu(hdr11->frame_ctl) &
+		(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS)) {
+	case IEEE80211_FCTL_TODS:
+		memcpy(hdr, hdr11->addr3, ETH_ALEN); /* DA */
+		memcpy(hdr + ETH_ALEN, hdr11->addr2, ETH_ALEN); /* SA */
+		break;
+	case IEEE80211_FCTL_FROMDS:
+		memcpy(hdr, hdr11->addr1, ETH_ALEN); /* DA */
+		memcpy(hdr + ETH_ALEN, hdr11->addr3, ETH_ALEN); /* SA */
+		break;
+	case IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS:
+		memcpy(hdr, hdr11->addr3, ETH_ALEN); /* DA */
+		memcpy(hdr + ETH_ALEN, hdr11->addr4, ETH_ALEN); /* SA */
+		break;
+	case 0:
+		memcpy(hdr, hdr11->addr1, ETH_ALEN); /* DA */
+		memcpy(hdr + ETH_ALEN, hdr11->addr2, ETH_ALEN); /* SA */
+		break;
+	}
+
+	hdr[12] = 0; /* priority */
+
+	hdr[13] = hdr[14] = hdr[15] = 0; /* reserved */
+}
+
+
+static int ieee80211_michael_mic_add(struct sk_buff *skb, int hdr_len, void *priv)
+{
+	struct ieee80211_tkip_data *tkey = priv;
+	u8 *pos;
+	struct ieee80211_hdr_4addr *hdr;
+
+	hdr = (struct ieee80211_hdr_4addr *) skb->data;
+
+	if (skb_tailroom(skb) < 8 || skb->len < hdr_len) {
+		printk(KERN_DEBUG "Invalid packet for Michael MIC add "
+		       "(tailroom=%d hdr_len=%d skb->len=%d)\n",
+		       skb_tailroom(skb), hdr_len, skb->len);
+		return -1;
+	}
+
+	michael_mic_hdr(skb, tkey->tx_hdr);
+
+	// { david, 2006.9.1
+	// fix the wpa process with wmm enabled.
+	if(IEEE80211_QOS_HAS_SEQ(le16_to_cpu(hdr->frame_ctl))) {
+		tkey->tx_hdr[12] = *(skb->data + hdr_len - 2) & 0x07;
+	}
+	// }
+	pos = skb_put(skb, 8);
+
+	if (michael_mic(tkey->tx_tfm_michael, &tkey->key[16], tkey->tx_hdr,
+				skb->data + hdr_len, skb->len - 8 - hdr_len, pos))
+		return -1;
+
+	return 0;
+}
+
+static void ieee80211_michael_mic_failure(struct net_device *dev,
+				       struct ieee80211_hdr_4addr *hdr,
+				       int keyidx)
+{
+	union iwreq_data wrqu;
+	struct iw_michaelmicfailure ev;
+
+	/* TODO: needed parameters: count, keyid, key type, TSC */
+	memset(&ev, 0, sizeof(ev));
+	ev.flags = keyidx & IW_MICFAILURE_KEY_ID;
+	if (hdr->addr1[0] & 0x01)
+		ev.flags |= IW_MICFAILURE_GROUP;
+	else
+		ev.flags |= IW_MICFAILURE_PAIRWISE;
+	ev.src_addr.sa_family = ARPHRD_ETHER;
+	memcpy(ev.src_addr.sa_data, hdr->addr2, ETH_ALEN);
+	memset(&wrqu, 0, sizeof(wrqu));
+	wrqu.data.length = sizeof(ev);
+	wireless_send_event(dev, IWEVMICHAELMICFAILURE, &wrqu, (char *) &ev);
+}
+
+static int ieee80211_michael_mic_verify(struct sk_buff *skb, int keyidx,
+				     int hdr_len, void *priv)
+{
+	struct ieee80211_tkip_data *tkey = priv;
+	u8 mic[8];
+	struct ieee80211_hdr_4addr *hdr;
+
+	hdr = (struct ieee80211_hdr_4addr *) skb->data;
+
+	if (!tkey->key_set)
+		return -1;
+
+	michael_mic_hdr(skb, tkey->rx_hdr);
+	// { david, 2006.9.1
+	// fix the wpa process with wmm enabled.
+	if(IEEE80211_QOS_HAS_SEQ(le16_to_cpu(hdr->frame_ctl))) {
+		tkey->rx_hdr[12] = *(skb->data + hdr_len - 2) & 0x07;
+	}
+	// }
+
+	if (michael_mic(tkey->rx_tfm_michael, &tkey->key[24], tkey->rx_hdr,
+				skb->data + hdr_len, skb->len - 8 - hdr_len, mic))
+		return -1;
+	if (memcmp(mic, skb->data + skb->len - 8, 8) != 0) {
+		struct ieee80211_hdr_4addr *hdr;
+		hdr = (struct ieee80211_hdr_4addr *) skb->data;
+		printk(KERN_DEBUG "%s: Michael MIC verification failed for "
+		       "MSDU from " MAC_FMT " keyidx=%d\n",
+		       skb->dev ? skb->dev->name : "N/A", MAC_ARG(hdr->addr2),
+		       keyidx);
+		if (skb->dev)
+			ieee80211_michael_mic_failure(skb->dev, hdr, keyidx);
+		tkey->dot11RSNAStatsTKIPLocalMICFailures++;
+		return -1;
+	}
+
+	/* Update TSC counters for RX now that the packet verification has
+	 * completed. */
+	tkey->rx_iv32 = tkey->rx_iv32_new;
+	tkey->rx_iv16 = tkey->rx_iv16_new;
+
+	skb_trim(skb, skb->len - 8);
+
+	return 0;
+}
+
+
+static int ieee80211_tkip_set_key(void *key, int len, u8 *seq, void *priv)
+{
+	struct ieee80211_tkip_data *tkey = priv;
+	int keyidx;
+	struct crypto_hash *tfm = tkey->tx_tfm_michael;
+	struct crypto_blkcipher *tfm2 = tkey->tx_tfm_arc4;
+	struct crypto_hash *tfm3 = tkey->rx_tfm_michael;
+	struct crypto_blkcipher *tfm4 = tkey->rx_tfm_arc4;
+
+	keyidx = tkey->key_idx;
+	memset(tkey, 0, sizeof(*tkey));
+	tkey->key_idx = keyidx;
+	tkey->tx_tfm_michael = tfm;
+	tkey->tx_tfm_arc4 = tfm2;
+	tkey->rx_tfm_michael = tfm3;
+	tkey->rx_tfm_arc4 = tfm4;
+
+	if (len == TKIP_KEY_LEN) {
+		memcpy(tkey->key, key, TKIP_KEY_LEN);
+		tkey->key_set = 1;
+		tkey->tx_iv16 = 1; /* TSC is initialized to 1 */
+		if (seq) {
+			tkey->rx_iv32 = (seq[5] << 24) | (seq[4] << 16) |
+				(seq[3] << 8) | seq[2];
+			tkey->rx_iv16 = (seq[1] << 8) | seq[0];
+		}
+	} else if (len == 0)
+		tkey->key_set = 0;
+	else
+		return -1;
+
+	return 0;
+}
+
+
+static int ieee80211_tkip_get_key(void *key, int len, u8 *seq, void *priv)
+{
+	struct ieee80211_tkip_data *tkey = priv;
+
+	if (len < TKIP_KEY_LEN)
+		return -1;
+
+	if (!tkey->key_set)
+		return 0;
+	memcpy(key, tkey->key, TKIP_KEY_LEN);
+
+	if (seq) {
+		/* Return the sequence number of the last transmitted frame. */
+		u16 iv16 = tkey->tx_iv16;
+		u32 iv32 = tkey->tx_iv32;
+		if (iv16 == 0)
+			iv32--;
+		iv16--;
+		seq[0] = tkey->tx_iv16;
+		seq[1] = tkey->tx_iv16 >> 8;
+		seq[2] = tkey->tx_iv32;
+		seq[3] = tkey->tx_iv32 >> 8;
+		seq[4] = tkey->tx_iv32 >> 16;
+		seq[5] = tkey->tx_iv32 >> 24;
+	}
+
+	return TKIP_KEY_LEN;
+}
+
+
+static char * ieee80211_tkip_print_stats(char *p, void *priv)
+{
+	struct ieee80211_tkip_data *tkip = priv;
+	p += sprintf(p, "key[%d] alg=TKIP key_set=%d "
+		     "tx_pn=%02x%02x%02x%02x%02x%02x "
+		     "rx_pn=%02x%02x%02x%02x%02x%02x "
+		     "replays=%d icv_errors=%d local_mic_failures=%d\n",
+		     tkip->key_idx, tkip->key_set,
+		     (tkip->tx_iv32 >> 24) & 0xff,
+		     (tkip->tx_iv32 >> 16) & 0xff,
+		     (tkip->tx_iv32 >> 8) & 0xff,
+		     tkip->tx_iv32 & 0xff,
+		     (tkip->tx_iv16 >> 8) & 0xff,
+		     tkip->tx_iv16 & 0xff,
+		     (tkip->rx_iv32 >> 24) & 0xff,
+		     (tkip->rx_iv32 >> 16) & 0xff,
+		     (tkip->rx_iv32 >> 8) & 0xff,
+		     tkip->rx_iv32 & 0xff,
+		     (tkip->rx_iv16 >> 8) & 0xff,
+		     tkip->rx_iv16 & 0xff,
+		     tkip->dot11RSNAStatsTKIPReplays,
+		     tkip->dot11RSNAStatsTKIPICVErrors,
+		     tkip->dot11RSNAStatsTKIPLocalMICFailures);
+	return p;
+}
+
+
+static struct ieee80211_crypto_ops ieee80211_crypt_tkip = {
+	.name			= "TKIP",
+	.init			= ieee80211_tkip_init,
+	.deinit			= ieee80211_tkip_deinit,
+	.encrypt_mpdu		= ieee80211_tkip_encrypt,
+	.decrypt_mpdu		= ieee80211_tkip_decrypt,
+	.encrypt_msdu		= ieee80211_michael_mic_add,
+	.decrypt_msdu		= ieee80211_michael_mic_verify,
+	.set_key		= ieee80211_tkip_set_key,
+	.get_key		= ieee80211_tkip_get_key,
+	.print_stats		= ieee80211_tkip_print_stats,
+	.extra_prefix_len	= 4 + 4, /* IV + ExtIV */
+	.extra_postfix_len	= 8 + 4, /* MIC + ICV */
+	.owner			= THIS_MODULE,
+};
+
+int __init ieee80211_crypto_tkip_init(void)
+{
+	return ieee80211_register_crypto_ops(&ieee80211_crypt_tkip);
+}
+
+void __exit ieee80211_crypto_tkip_exit(void)
+{
+	ieee80211_unregister_crypto_ops(&ieee80211_crypt_tkip);
+}
+
+void ieee80211_tkip_null(void)
+{
+//    printk("============>%s()\n", __FUNCTION__);
+	return;
+}
diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_wep.c b/drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_wep.c
new file mode 100644
index 000000000000..61ad11cae38c
--- /dev/null
+++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_wep.c
@@ -0,0 +1,297 @@
+/*
+ * Host AP crypt: host-based WEP encryption implementation for Host AP driver
+ *
+ * Copyright (c) 2002-2004, Jouni Malinen <jkmaline@cc.hut.fi>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation. See README and COPYING for
+ * more details.
+ */
+
+//#include <linux/config.h>
+#include <linux/version.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/random.h>
+#include <linux/skbuff.h>
+#include <asm/string.h>
+
+#include "ieee80211.h"
+
+#include <linux/crypto.h>
+    #include <linux/scatterlist.h>
+#include <linux/crc32.h>
+
+MODULE_AUTHOR("Jouni Malinen");
+MODULE_DESCRIPTION("Host AP crypt: WEP");
+MODULE_LICENSE("GPL");
+
+struct prism2_wep_data {
+	u32 iv;
+#define WEP_KEY_LEN 13
+	u8 key[WEP_KEY_LEN + 1];
+	u8 key_len;
+	u8 key_idx;
+	struct crypto_blkcipher *tx_tfm;
+	struct crypto_blkcipher *rx_tfm;
+};
+
+
+static void * prism2_wep_init(int keyidx)
+{
+	struct prism2_wep_data *priv;
+
+	priv = kmalloc(sizeof(*priv), GFP_ATOMIC);
+	if (priv == NULL)
+		goto fail;
+	memset(priv, 0, sizeof(*priv));
+	priv->key_idx = keyidx;
+
+	priv->tx_tfm = crypto_alloc_blkcipher("ecb(arc4)", 0, CRYPTO_ALG_ASYNC);
+	if (IS_ERR(priv->tx_tfm)) {
+		printk(KERN_DEBUG "ieee80211_crypt_wep: could not allocate "
+		       "crypto API arc4\n");
+		priv->tx_tfm = NULL;
+		goto fail;
+	}
+	priv->rx_tfm = crypto_alloc_blkcipher("ecb(arc4)", 0, CRYPTO_ALG_ASYNC);
+	if (IS_ERR(priv->rx_tfm)) {
+		printk(KERN_DEBUG "ieee80211_crypt_wep: could not allocate "
+		       "crypto API arc4\n");
+		priv->rx_tfm = NULL;
+		goto fail;
+	}
+
+	/* start WEP IV from a random value */
+	get_random_bytes(&priv->iv, 4);
+
+	return priv;
+
+fail:
+	if (priv) {
+		if (priv->tx_tfm)
+			crypto_free_blkcipher(priv->tx_tfm);
+		if (priv->rx_tfm)
+			crypto_free_blkcipher(priv->rx_tfm);
+		kfree(priv);
+	}
+
+	return NULL;
+}
+
+
+static void prism2_wep_deinit(void *priv)
+{
+	struct prism2_wep_data *_priv = priv;
+
+	if (_priv) {
+		if (_priv->tx_tfm)
+			crypto_free_blkcipher(_priv->tx_tfm);
+		if (_priv->rx_tfm)
+			crypto_free_blkcipher(_priv->rx_tfm);
+	}
+	kfree(priv);
+}
+
+/* Perform WEP encryption on given skb that has at least 4 bytes of headroom
+ * for IV and 4 bytes of tailroom for ICV. Both IV and ICV will be transmitted,
+ * so the payload length increases with 8 bytes.
+ *
+ * WEP frame payload: IV + TX key idx, RC4(data), ICV = RC4(CRC32(data))
+ */
+static int prism2_wep_encrypt(struct sk_buff *skb, int hdr_len, void *priv)
+{
+	struct prism2_wep_data *wep = priv;
+	u32 klen, len;
+	u8 key[WEP_KEY_LEN + 3];
+	u8 *pos;
+	cb_desc *tcb_desc = (cb_desc *)(skb->cb + MAX_DEV_ADDR_SIZE);
+	struct blkcipher_desc desc = {.tfm = wep->tx_tfm};
+	u32 crc;
+	u8 *icv;
+	struct scatterlist sg;
+	if (skb_headroom(skb) < 4 || skb_tailroom(skb) < 4 ||
+	    skb->len < hdr_len)
+		return -1;
+
+	len = skb->len - hdr_len;
+	pos = skb_push(skb, 4);
+	memmove(pos, pos + 4, hdr_len);
+	pos += hdr_len;
+
+	klen = 3 + wep->key_len;
+
+	wep->iv++;
+
+	/* Fluhrer, Mantin, and Shamir have reported weaknesses in the key
+	 * scheduling algorithm of RC4. At least IVs (KeyByte + 3, 0xff, N)
+	 * can be used to speedup attacks, so avoid using them. */
+	if ((wep->iv & 0xff00) == 0xff00) {
+		u8 B = (wep->iv >> 16) & 0xff;
+		if (B >= 3 && B < klen)
+			wep->iv += 0x0100;
+	}
+
+	/* Prepend 24-bit IV to RC4 key and TX frame */
+	*pos++ = key[0] = (wep->iv >> 16) & 0xff;
+	*pos++ = key[1] = (wep->iv >> 8) & 0xff;
+	*pos++ = key[2] = wep->iv & 0xff;
+	*pos++ = wep->key_idx << 6;
+
+	/* Copy rest of the WEP key (the secret part) */
+	memcpy(key + 3, wep->key, wep->key_len);
+
+	if (!tcb_desc->bHwSec)
+	{
+
+		/* Append little-endian CRC32 and encrypt it to produce ICV */
+		crc = ~crc32_le(~0, pos, len);
+		icv = skb_put(skb, 4);
+		icv[0] = crc;
+		icv[1] = crc >> 8;
+		icv[2] = crc >> 16;
+		icv[3] = crc >> 24;
+
+		crypto_blkcipher_setkey(wep->tx_tfm, key, klen);
+		sg_init_one(&sg, pos, len+4);
+
+		return crypto_blkcipher_encrypt(&desc, &sg, &sg, len + 4);
+	}
+
+	return 0;
+}
+
+
+/* Perform WEP decryption on given buffer. Buffer includes whole WEP part of
+ * the frame: IV (4 bytes), encrypted payload (including SNAP header),
+ * ICV (4 bytes). len includes both IV and ICV.
+ *
+ * Returns 0 if frame was decrypted successfully and ICV was correct and -1 on
+ * failure. If frame is OK, IV and ICV will be removed.
+ */
+static int prism2_wep_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
+{
+	struct prism2_wep_data *wep = priv;
+	u32  klen, plen;
+	u8 key[WEP_KEY_LEN + 3];
+	u8 keyidx, *pos;
+	cb_desc *tcb_desc = (cb_desc *)(skb->cb + MAX_DEV_ADDR_SIZE);
+	struct blkcipher_desc desc = {.tfm = wep->rx_tfm};
+	u32 crc;
+	u8 icv[4];
+	struct scatterlist sg;
+	if (skb->len < hdr_len + 8)
+		return -1;
+
+	pos = skb->data + hdr_len;
+	key[0] = *pos++;
+	key[1] = *pos++;
+	key[2] = *pos++;
+	keyidx = *pos++ >> 6;
+	if (keyidx != wep->key_idx)
+		return -1;
+
+	klen = 3 + wep->key_len;
+
+	/* Copy rest of the WEP key (the secret part) */
+	memcpy(key + 3, wep->key, wep->key_len);
+
+	/* Apply RC4 to data and compute CRC32 over decrypted data */
+	plen = skb->len - hdr_len - 8;
+
+	if (!tcb_desc->bHwSec)
+	{
+		crypto_blkcipher_setkey(wep->rx_tfm, key, klen);
+		sg_init_one(&sg, pos, plen+4);
+
+		if (crypto_blkcipher_decrypt(&desc, &sg, &sg, plen + 4))
+			return -7;
+
+		crc = ~crc32_le(~0, pos, plen);
+		icv[0] = crc;
+		icv[1] = crc >> 8;
+		icv[2] = crc >> 16;
+		icv[3] = crc >> 24;
+		if (memcmp(icv, pos + plen, 4) != 0) {
+			/* ICV mismatch - drop frame */
+			return -2;
+		}
+	}
+	/* Remove IV and ICV */
+	memmove(skb->data + 4, skb->data, hdr_len);
+	skb_pull(skb, 4);
+	skb_trim(skb, skb->len - 4);
+
+	return 0;
+}
+
+
+static int prism2_wep_set_key(void *key, int len, u8 *seq, void *priv)
+{
+	struct prism2_wep_data *wep = priv;
+
+	if (len < 0 || len > WEP_KEY_LEN)
+		return -1;
+
+	memcpy(wep->key, key, len);
+	wep->key_len = len;
+
+	return 0;
+}
+
+
+static int prism2_wep_get_key(void *key, int len, u8 *seq, void *priv)
+{
+	struct prism2_wep_data *wep = priv;
+
+	if (len < wep->key_len)
+		return -1;
+
+	memcpy(key, wep->key, wep->key_len);
+
+	return wep->key_len;
+}
+
+
+static char * prism2_wep_print_stats(char *p, void *priv)
+{
+	struct prism2_wep_data *wep = priv;
+	p += sprintf(p, "key[%d] alg=WEP len=%d\n",
+		     wep->key_idx, wep->key_len);
+	return p;
+}
+
+
+static struct ieee80211_crypto_ops ieee80211_crypt_wep = {
+	.name			= "WEP",
+	.init			= prism2_wep_init,
+	.deinit			= prism2_wep_deinit,
+	.encrypt_mpdu		= prism2_wep_encrypt,
+	.decrypt_mpdu		= prism2_wep_decrypt,
+	.encrypt_msdu		= NULL,
+	.decrypt_msdu		= NULL,
+	.set_key		= prism2_wep_set_key,
+	.get_key		= prism2_wep_get_key,
+	.print_stats		= prism2_wep_print_stats,
+	.extra_prefix_len	= 4, /* IV */
+	.extra_postfix_len	= 4, /* ICV */
+	.owner			= THIS_MODULE,
+};
+
+int __init ieee80211_crypto_wep_init(void)
+{
+	return ieee80211_register_crypto_ops(&ieee80211_crypt_wep);
+}
+
+void __exit ieee80211_crypto_wep_exit(void)
+{
+	ieee80211_unregister_crypto_ops(&ieee80211_crypt_wep);
+}
+
+void ieee80211_wep_null(void)
+{
+//	printk("============>%s()\n", __FUNCTION__);
+	return;
+}
diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_module.c b/drivers/staging/rtl8192u/ieee80211/ieee80211_module.c
new file mode 100644
index 000000000000..7a8690f449b4
--- /dev/null
+++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_module.c
@@ -0,0 +1,324 @@
+/*******************************************************************************
+
+  Copyright(c) 2004 Intel Corporation. All rights reserved.
+
+  Portions of this file are based on the WEP enablement code provided by the
+  Host AP project hostap-drivers v0.1.3
+  Copyright (c) 2001-2002, SSH Communications Security Corp and Jouni Malinen
+  <jkmaline@cc.hut.fi>
+  Copyright (c) 2002-2003, Jouni Malinen <jkmaline@cc.hut.fi>
+
+  This program is free software; you can redistribute it and/or modify it
+  under the terms of version 2 of the GNU General Public License as
+  published by the Free Software Foundation.
+
+  This program is distributed in the hope that it will be useful, but WITHOUT
+  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+  more details.
+
+  You should have received a copy of the GNU General Public License along with
+  this program; if not, write to the Free Software Foundation, Inc., 59
+  Temple Place - Suite 330, Boston, MA  02111-1307, USA.
+
+  The full GNU General Public License is included in this distribution in the
+  file called LICENSE.
+
+  Contact Information:
+  James P. Ketrenos <ipw2100-admin@linux.intel.com>
+  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+
+*******************************************************************************/
+
+#include <linux/compiler.h>
+//#include <linux/config.h>
+#include <linux/errno.h>
+#include <linux/if_arp.h>
+#include <linux/in6.h>
+#include <linux/in.h>
+#include <linux/ip.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/netdevice.h>
+#include <linux/pci.h>
+#include <linux/proc_fs.h>
+#include <linux/skbuff.h>
+#include <linux/slab.h>
+#include <linux/tcp.h>
+#include <linux/types.h>
+#include <linux/version.h>
+#include <linux/wireless.h>
+#include <linux/etherdevice.h>
+#include <asm/uaccess.h>
+#include <net/arp.h>
+
+#include "ieee80211.h"
+
+MODULE_DESCRIPTION("802.11 data/management/control stack");
+MODULE_AUTHOR("Copyright (C) 2004 Intel Corporation <jketreno@linux.intel.com>");
+MODULE_LICENSE("GPL");
+
+#define DRV_NAME "ieee80211"
+
+static inline int ieee80211_networks_allocate(struct ieee80211_device *ieee)
+{
+	if (ieee->networks)
+		return 0;
+
+	ieee->networks = kmalloc(
+		MAX_NETWORK_COUNT * sizeof(struct ieee80211_network),
+		GFP_KERNEL);
+	if (!ieee->networks) {
+		printk(KERN_WARNING "%s: Out of memory allocating beacons\n",
+		       ieee->dev->name);
+		return -ENOMEM;
+	}
+
+	memset(ieee->networks, 0,
+	       MAX_NETWORK_COUNT * sizeof(struct ieee80211_network));
+
+	return 0;
+}
+
+static inline void ieee80211_networks_free(struct ieee80211_device *ieee)
+{
+	if (!ieee->networks)
+		return;
+	kfree(ieee->networks);
+	ieee->networks = NULL;
+}
+
+static inline void ieee80211_networks_initialize(struct ieee80211_device *ieee)
+{
+	int i;
+
+	INIT_LIST_HEAD(&ieee->network_free_list);
+	INIT_LIST_HEAD(&ieee->network_list);
+	for (i = 0; i < MAX_NETWORK_COUNT; i++)
+		list_add_tail(&ieee->networks[i].list, &ieee->network_free_list);
+}
+
+
+struct net_device *alloc_ieee80211(int sizeof_priv)
+{
+	struct ieee80211_device *ieee;
+	struct net_device *dev;
+	int i,err;
+
+	IEEE80211_DEBUG_INFO("Initializing...\n");
+
+	dev = alloc_etherdev(sizeof(struct ieee80211_device) + sizeof_priv);
+	if (!dev) {
+		IEEE80211_ERROR("Unable to network device.\n");
+		goto failed;
+	}
+
+	ieee = netdev_priv(dev);
+	memset(ieee, 0, sizeof(struct ieee80211_device)+sizeof_priv);
+	ieee->dev = dev;
+
+	err = ieee80211_networks_allocate(ieee);
+	if (err) {
+		IEEE80211_ERROR("Unable to allocate beacon storage: %d\n",
+				err);
+		goto failed;
+	}
+	ieee80211_networks_initialize(ieee);
+
+
+	/* Default fragmentation threshold is maximum payload size */
+	ieee->fts = DEFAULT_FTS;
+	ieee->scan_age = DEFAULT_MAX_SCAN_AGE;
+	ieee->open_wep = 1;
+
+	/* Default to enabling full open WEP with host based encrypt/decrypt */
+	ieee->host_encrypt = 1;
+	ieee->host_decrypt = 1;
+	ieee->ieee802_1x = 1; /* Default to supporting 802.1x */
+
+	INIT_LIST_HEAD(&ieee->crypt_deinit_list);
+	init_timer(&ieee->crypt_deinit_timer);
+	ieee->crypt_deinit_timer.data = (unsigned long)ieee;
+	ieee->crypt_deinit_timer.function = ieee80211_crypt_deinit_handler;
+
+	spin_lock_init(&ieee->lock);
+	spin_lock_init(&ieee->wpax_suitlist_lock);
+	spin_lock_init(&ieee->bw_spinlock);
+	spin_lock_init(&ieee->reorder_spinlock);
+	//added by WB
+	atomic_set(&(ieee->atm_chnlop), 0);
+	atomic_set(&(ieee->atm_swbw), 0);
+
+	ieee->wpax_type_set = 0;
+	ieee->wpa_enabled = 0;
+	ieee->tkip_countermeasures = 0;
+	ieee->drop_unencrypted = 0;
+	ieee->privacy_invoked = 0;
+	ieee->ieee802_1x = 1;
+	ieee->raw_tx = 0;
+	//ieee->hwsec_support = 1; //defalt support hw security. //use module_param instead.
+	ieee->hwsec_active = 0; //disable hwsec, switch it on when necessary.
+
+	ieee80211_softmac_init(ieee);
+
+	ieee->pHTInfo = (RT_HIGH_THROUGHPUT*)kzalloc(sizeof(RT_HIGH_THROUGHPUT), GFP_KERNEL);
+	if (ieee->pHTInfo == NULL)
+	{
+		IEEE80211_DEBUG(IEEE80211_DL_ERR, "can't alloc memory for HTInfo\n");
+		return NULL;
+	}
+	HTUpdateDefaultSetting(ieee);
+	HTInitializeHTInfo(ieee); //may move to other place.
+	TSInitialize(ieee);
+
+	for (i = 0; i < IEEE_IBSS_MAC_HASH_SIZE; i++)
+		INIT_LIST_HEAD(&ieee->ibss_mac_hash[i]);
+
+	for (i = 0; i < 17; i++) {
+	  ieee->last_rxseq_num[i] = -1;
+	  ieee->last_rxfrag_num[i] = -1;
+	  ieee->last_packet_time[i] = 0;
+	}
+
+//These function were added to load crypte module autoly
+	ieee80211_tkip_null();
+	ieee80211_wep_null();
+	ieee80211_ccmp_null();
+
+	return dev;
+
+ failed:
+	if (dev)
+		free_netdev(dev);
+
+	return NULL;
+}
+
+
+void free_ieee80211(struct net_device *dev)
+{
+	struct ieee80211_device *ieee = netdev_priv(dev);
+	int i;
+	//struct list_head *p, *q;
+//	del_timer_sync(&ieee->SwBwTimer);
+	if (ieee->pHTInfo != NULL)
+	{
+		kfree(ieee->pHTInfo);
+		ieee->pHTInfo = NULL;
+	}
+	RemoveAllTS(ieee);
+	ieee80211_softmac_free(ieee);
+	del_timer_sync(&ieee->crypt_deinit_timer);
+	ieee80211_crypt_deinit_entries(ieee, 1);
+
+	for (i = 0; i < WEP_KEYS; i++) {
+		struct ieee80211_crypt_data *crypt = ieee->crypt[i];
+		if (crypt) {
+			if (crypt->ops)
+				crypt->ops->deinit(crypt->priv);
+			kfree(crypt);
+			ieee->crypt[i] = NULL;
+		}
+	}
+
+	ieee80211_networks_free(ieee);
+	free_netdev(dev);
+}
+
+#ifdef CONFIG_IEEE80211_DEBUG
+
+u32 ieee80211_debug_level = 0;
+static int debug = \
+	//		    IEEE80211_DL_INFO	|
+	//		    IEEE80211_DL_WX	|
+	//		    IEEE80211_DL_SCAN	|
+	//		    IEEE80211_DL_STATE	|
+	//		    IEEE80211_DL_MGMT	|
+	//		    IEEE80211_DL_FRAG	|
+	//		    IEEE80211_DL_EAP	|
+	//		    IEEE80211_DL_DROP	|
+	//		    IEEE80211_DL_TX	|
+	//		    IEEE80211_DL_RX	|
+			    //IEEE80211_DL_QOS    |
+	//		    IEEE80211_DL_HT 	|
+	//		    IEEE80211_DL_TS	|
+//			    IEEE80211_DL_BA 	|
+	//		    IEEE80211_DL_REORDER|
+//			    IEEE80211_DL_TRACE  |
+			    //IEEE80211_DL_DATA	|
+			    IEEE80211_DL_ERR	  //awayls open this flags to show error out
+			    ;
+struct proc_dir_entry *ieee80211_proc = NULL;
+
+static int show_debug_level(char *page, char **start, off_t offset,
+			    int count, int *eof, void *data)
+{
+	return snprintf(page, count, "0x%08X\n", ieee80211_debug_level);
+}
+
+static int store_debug_level(struct file *file, const char *buffer,
+			     unsigned long count, void *data)
+{
+	char buf[] = "0x00000000";
+	unsigned long len = min(sizeof(buf) - 1, count);
+	char *p = (char *)buf;
+	unsigned long val;
+
+	if (copy_from_user(buf, buffer, len))
+		return count;
+	buf[len] = 0;
+	if (p[1] == 'x' || p[1] == 'X' || p[0] == 'x' || p[0] == 'X') {
+		p++;
+		if (p[0] == 'x' || p[0] == 'X')
+			p++;
+		val = simple_strtoul(p, &p, 16);
+	} else
+		val = simple_strtoul(p, &p, 10);
+	if (p == buf)
+		printk(KERN_INFO DRV_NAME
+		       ": %s is not in hex or decimal form.\n", buf);
+	else
+		ieee80211_debug_level = val;
+
+	return strnlen(buf, count);
+}
+
+int __init ieee80211_debug_init(void)
+{
+	struct proc_dir_entry *e;
+
+	ieee80211_debug_level = debug;
+
+	ieee80211_proc = create_proc_entry(DRV_NAME, S_IFDIR, init_net.proc_net);
+	if (ieee80211_proc == NULL) {
+		IEEE80211_ERROR("Unable to create " DRV_NAME
+				" proc directory\n");
+		return -EIO;
+	}
+	e = create_proc_entry("debug_level", S_IFREG | S_IRUGO | S_IWUSR,
+			      ieee80211_proc);
+	if (!e) {
+		remove_proc_entry(DRV_NAME, init_net.proc_net);
+		ieee80211_proc = NULL;
+		return -EIO;
+	}
+	e->read_proc = show_debug_level;
+	e->write_proc = store_debug_level;
+	e->data = NULL;
+
+	return 0;
+}
+
+void __exit ieee80211_debug_exit(void)
+{
+	if (ieee80211_proc) {
+		remove_proc_entry("debug_level", ieee80211_proc);
+		remove_proc_entry(DRV_NAME, init_net.proc_net);
+		ieee80211_proc = NULL;
+	}
+}
+
+#include <linux/moduleparam.h>
+module_param(debug, int, 0444);
+MODULE_PARM_DESC(debug, "debug output mask");
+#endif
diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c b/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c
new file mode 100644
index 000000000000..0e003c5bb000
--- /dev/null
+++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c
@@ -0,0 +1,2668 @@
+/*
+ * Original code based Host AP (software wireless LAN access point) driver
+ * for Intersil Prism2/2.5/3 - hostap.o module, common routines
+ *
+ * Copyright (c) 2001-2002, SSH Communications Security Corp and Jouni Malinen
+ * <jkmaline@cc.hut.fi>
+ * Copyright (c) 2002-2003, Jouni Malinen <jkmaline@cc.hut.fi>
+ * Copyright (c) 2004, Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation. See README and COPYING for
+ * more details.
+ ******************************************************************************
+
+  Few modifications for Realtek's Wi-Fi drivers by
+  Andrea Merello <andreamrl@tiscali.it>
+
+  A special thanks goes to Realtek for their support !
+
+******************************************************************************/
+
+
+#include <linux/compiler.h>
+//#include <linux/config.h>
+#include <linux/errno.h>
+#include <linux/if_arp.h>
+#include <linux/in6.h>
+#include <linux/in.h>
+#include <linux/ip.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/netdevice.h>
+#include <linux/pci.h>
+#include <linux/proc_fs.h>
+#include <linux/skbuff.h>
+#include <linux/slab.h>
+#include <linux/tcp.h>
+#include <linux/types.h>
+#include <linux/version.h>
+#include <linux/wireless.h>
+#include <linux/etherdevice.h>
+#include <asm/uaccess.h>
+#include <linux/ctype.h>
+
+#include "ieee80211.h"
+#ifdef ENABLE_DOT11D
+#include "dot11d.h"
+#endif
+static inline void ieee80211_monitor_rx(struct ieee80211_device *ieee,
+					struct sk_buff *skb,
+					struct ieee80211_rx_stats *rx_stats)
+{
+	struct ieee80211_hdr_4addr *hdr = (struct ieee80211_hdr_4addr *)skb->data;
+	u16 fc = le16_to_cpu(hdr->frame_ctl);
+
+	skb->dev = ieee->dev;
+        skb_reset_mac_header(skb);
+
+	skb_pull(skb, ieee80211_get_hdrlen(fc));
+	skb->pkt_type = PACKET_OTHERHOST;
+	skb->protocol = __constant_htons(ETH_P_80211_RAW);
+	memset(skb->cb, 0, sizeof(skb->cb));
+	netif_rx(skb);
+}
+
+
+/* Called only as a tasklet (software IRQ) */
+static struct ieee80211_frag_entry *
+ieee80211_frag_cache_find(struct ieee80211_device *ieee, unsigned int seq,
+			  unsigned int frag, u8 tid,u8 *src, u8 *dst)
+{
+	struct ieee80211_frag_entry *entry;
+	int i;
+
+	for (i = 0; i < IEEE80211_FRAG_CACHE_LEN; i++) {
+		entry = &ieee->frag_cache[tid][i];
+		if (entry->skb != NULL &&
+		    time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
+			IEEE80211_DEBUG_FRAG(
+				"expiring fragment cache entry "
+				"seq=%u last_frag=%u\n",
+				entry->seq, entry->last_frag);
+			dev_kfree_skb_any(entry->skb);
+			entry->skb = NULL;
+		}
+
+		if (entry->skb != NULL && entry->seq == seq &&
+		    (entry->last_frag + 1 == frag || frag == -1) &&
+		    memcmp(entry->src_addr, src, ETH_ALEN) == 0 &&
+		    memcmp(entry->dst_addr, dst, ETH_ALEN) == 0)
+			return entry;
+	}
+
+	return NULL;
+}
+
+/* Called only as a tasklet (software IRQ) */
+static struct sk_buff *
+ieee80211_frag_cache_get(struct ieee80211_device *ieee,
+			 struct ieee80211_hdr_4addr *hdr)
+{
+	struct sk_buff *skb = NULL;
+	u16 fc = le16_to_cpu(hdr->frame_ctl);
+	u16 sc = le16_to_cpu(hdr->seq_ctl);
+	unsigned int frag = WLAN_GET_SEQ_FRAG(sc);
+	unsigned int seq = WLAN_GET_SEQ_SEQ(sc);
+	struct ieee80211_frag_entry *entry;
+	struct ieee80211_hdr_3addrqos *hdr_3addrqos;
+	struct ieee80211_hdr_4addrqos *hdr_4addrqos;
+	u8 tid;
+
+	if (((fc & IEEE80211_FCTL_DSTODS) == IEEE80211_FCTL_DSTODS)&&IEEE80211_QOS_HAS_SEQ(fc)) {
+	  hdr_4addrqos = (struct ieee80211_hdr_4addrqos *)hdr;
+	  tid = le16_to_cpu(hdr_4addrqos->qos_ctl) & IEEE80211_QCTL_TID;
+	  tid = UP2AC(tid);
+	  tid ++;
+	} else if (IEEE80211_QOS_HAS_SEQ(fc)) {
+	  hdr_3addrqos = (struct ieee80211_hdr_3addrqos *)hdr;
+	  tid = le16_to_cpu(hdr_3addrqos->qos_ctl) & IEEE80211_QCTL_TID;
+	  tid = UP2AC(tid);
+	  tid ++;
+	} else {
+	  tid = 0;
+	}
+
+	if (frag == 0) {
+		/* Reserve enough space to fit maximum frame length */
+		skb = dev_alloc_skb(ieee->dev->mtu +
+				    sizeof(struct ieee80211_hdr_4addr) +
+				    8 /* LLC */ +
+				    2 /* alignment */ +
+				    8 /* WEP */ +
+				    ETH_ALEN /* WDS */ +
+				    (IEEE80211_QOS_HAS_SEQ(fc)?2:0) /* QOS Control */);
+		if (skb == NULL)
+			return NULL;
+
+		entry = &ieee->frag_cache[tid][ieee->frag_next_idx[tid]];
+		ieee->frag_next_idx[tid]++;
+		if (ieee->frag_next_idx[tid] >= IEEE80211_FRAG_CACHE_LEN)
+			ieee->frag_next_idx[tid] = 0;
+
+		if (entry->skb != NULL)
+			dev_kfree_skb_any(entry->skb);
+
+		entry->first_frag_time = jiffies;
+		entry->seq = seq;
+		entry->last_frag = frag;
+		entry->skb = skb;
+		memcpy(entry->src_addr, hdr->addr2, ETH_ALEN);
+		memcpy(entry->dst_addr, hdr->addr1, ETH_ALEN);
+	} else {
+		/* received a fragment of a frame for which the head fragment
+		 * should have already been received */
+		entry = ieee80211_frag_cache_find(ieee, seq, frag, tid,hdr->addr2,
+						  hdr->addr1);
+		if (entry != NULL) {
+			entry->last_frag = frag;
+			skb = entry->skb;
+		}
+	}
+
+	return skb;
+}
+
+
+/* Called only as a tasklet (software IRQ) */
+static int ieee80211_frag_cache_invalidate(struct ieee80211_device *ieee,
+					   struct ieee80211_hdr_4addr *hdr)
+{
+	u16 fc = le16_to_cpu(hdr->frame_ctl);
+	u16 sc = le16_to_cpu(hdr->seq_ctl);
+	unsigned int seq = WLAN_GET_SEQ_SEQ(sc);
+	struct ieee80211_frag_entry *entry;
+	struct ieee80211_hdr_3addrqos *hdr_3addrqos;
+	struct ieee80211_hdr_4addrqos *hdr_4addrqos;
+	u8 tid;
+
+	if(((fc & IEEE80211_FCTL_DSTODS) == IEEE80211_FCTL_DSTODS)&&IEEE80211_QOS_HAS_SEQ(fc)) {
+	  hdr_4addrqos = (struct ieee80211_hdr_4addrqos *)hdr;
+	  tid = le16_to_cpu(hdr_4addrqos->qos_ctl) & IEEE80211_QCTL_TID;
+	  tid = UP2AC(tid);
+	  tid ++;
+	} else if (IEEE80211_QOS_HAS_SEQ(fc)) {
+	  hdr_3addrqos = (struct ieee80211_hdr_3addrqos *)hdr;
+	  tid = le16_to_cpu(hdr_3addrqos->qos_ctl) & IEEE80211_QCTL_TID;
+	  tid = UP2AC(tid);
+	  tid ++;
+	} else {
+	  tid = 0;
+	}
+
+	entry = ieee80211_frag_cache_find(ieee, seq, -1, tid,hdr->addr2,
+					  hdr->addr1);
+
+	if (entry == NULL) {
+		IEEE80211_DEBUG_FRAG(
+			"could not invalidate fragment cache "
+			"entry (seq=%u)\n", seq);
+		return -1;
+	}
+
+	entry->skb = NULL;
+	return 0;
+}
+
+
+
+/* ieee80211_rx_frame_mgtmt
+ *
+ * Responsible for handling management control frames
+ *
+ * Called by ieee80211_rx */
+static inline int
+ieee80211_rx_frame_mgmt(struct ieee80211_device *ieee, struct sk_buff *skb,
+			struct ieee80211_rx_stats *rx_stats, u16 type,
+			u16 stype)
+{
+	/* On the struct stats definition there is written that
+	 * this is not mandatory.... but seems that the probe
+	 * response parser uses it
+	 */
+        struct ieee80211_hdr_3addr * hdr = (struct ieee80211_hdr_3addr *)skb->data;
+
+	rx_stats->len = skb->len;
+	ieee80211_rx_mgt(ieee,(struct ieee80211_hdr_4addr *)skb->data,rx_stats);
+        //if ((ieee->state == IEEE80211_LINKED) && (memcmp(hdr->addr3, ieee->current_network.bssid, ETH_ALEN)))
+        if ((memcmp(hdr->addr1, ieee->dev->dev_addr, ETH_ALEN)))//use ADDR1 to perform address matching for Management frames
+        {
+                dev_kfree_skb_any(skb);
+                return 0;
+        }
+
+	ieee80211_rx_frame_softmac(ieee, skb, rx_stats, type, stype);
+
+	dev_kfree_skb_any(skb);
+
+	return 0;
+
+	#ifdef NOT_YET
+	if (ieee->iw_mode == IW_MODE_MASTER) {
+		printk(KERN_DEBUG "%s: Master mode not yet suppported.\n",
+		       ieee->dev->name);
+		return 0;
+/*
+  hostap_update_sta_ps(ieee, (struct hostap_ieee80211_hdr_4addr *)
+  skb->data);*/
+	}
+
+	if (ieee->hostapd && type == IEEE80211_TYPE_MGMT) {
+		if (stype == WLAN_FC_STYPE_BEACON &&
+		    ieee->iw_mode == IW_MODE_MASTER) {
+			struct sk_buff *skb2;
+			/* Process beacon frames also in kernel driver to
+			 * update STA(AP) table statistics */
+			skb2 = skb_clone(skb, GFP_ATOMIC);
+			if (skb2)
+				hostap_rx(skb2->dev, skb2, rx_stats);
+		}
+
+		/* send management frames to the user space daemon for
+		 * processing */
+		ieee->apdevstats.rx_packets++;
+		ieee->apdevstats.rx_bytes += skb->len;
+		prism2_rx_80211(ieee->apdev, skb, rx_stats, PRISM2_RX_MGMT);
+		return 0;
+	}
+
+	    if (ieee->iw_mode == IW_MODE_MASTER) {
+		if (type != WLAN_FC_TYPE_MGMT && type != WLAN_FC_TYPE_CTRL) {
+			printk(KERN_DEBUG "%s: unknown management frame "
+			       "(type=0x%02x, stype=0x%02x) dropped\n",
+			       skb->dev->name, type, stype);
+			return -1;
+		}
+
+		hostap_rx(skb->dev, skb, rx_stats);
+		return 0;
+	}
+
+	printk(KERN_DEBUG "%s: hostap_rx_frame_mgmt: management frame "
+	       "received in non-Host AP mode\n", skb->dev->name);
+	return -1;
+	#endif
+}
+
+
+
+/* See IEEE 802.1H for LLC/SNAP encapsulation/decapsulation */
+/* Ethernet-II snap header (RFC1042 for most EtherTypes) */
+static unsigned char rfc1042_header[] =
+{ 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
+/* Bridge-Tunnel header (for EtherTypes ETH_P_AARP and ETH_P_IPX) */
+static unsigned char bridge_tunnel_header[] =
+{ 0xaa, 0xaa, 0x03, 0x00, 0x00, 0xf8 };
+/* No encapsulation header if EtherType < 0x600 (=length) */
+
+/* Called by ieee80211_rx_frame_decrypt */
+static int ieee80211_is_eapol_frame(struct ieee80211_device *ieee,
+				    struct sk_buff *skb, size_t hdrlen)
+{
+	struct net_device *dev = ieee->dev;
+	u16 fc, ethertype;
+	struct ieee80211_hdr_4addr *hdr;
+	u8 *pos;
+
+	if (skb->len < 24)
+		return 0;
+
+	hdr = (struct ieee80211_hdr_4addr *) skb->data;
+	fc = le16_to_cpu(hdr->frame_ctl);
+
+	/* check that the frame is unicast frame to us */
+	if ((fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) ==
+	    IEEE80211_FCTL_TODS &&
+	    memcmp(hdr->addr1, dev->dev_addr, ETH_ALEN) == 0 &&
+	    memcmp(hdr->addr3, dev->dev_addr, ETH_ALEN) == 0) {
+		/* ToDS frame with own addr BSSID and DA */
+	} else if ((fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) ==
+		   IEEE80211_FCTL_FROMDS &&
+		   memcmp(hdr->addr1, dev->dev_addr, ETH_ALEN) == 0) {
+		/* FromDS frame with own addr as DA */
+	} else
+		return 0;
+
+	if (skb->len < 24 + 8)
+		return 0;
+
+	/* check for port access entity Ethernet type */
+//	pos = skb->data + 24;
+	pos = skb->data + hdrlen;
+	ethertype = (pos[6] << 8) | pos[7];
+	if (ethertype == ETH_P_PAE)
+		return 1;
+
+	return 0;
+}
+
+/* Called only as a tasklet (software IRQ), by ieee80211_rx */
+static inline int
+ieee80211_rx_frame_decrypt(struct ieee80211_device* ieee, struct sk_buff *skb,
+			   struct ieee80211_crypt_data *crypt)
+{
+	struct ieee80211_hdr_4addr *hdr;
+	int res, hdrlen;
+
+	if (crypt == NULL || crypt->ops->decrypt_mpdu == NULL)
+		return 0;
+	if (ieee->hwsec_active)
+	{
+		cb_desc *tcb_desc = (cb_desc *)(skb->cb+ MAX_DEV_ADDR_SIZE);
+		tcb_desc->bHwSec = 1;
+	}
+	hdr = (struct ieee80211_hdr_4addr *) skb->data;
+	hdrlen = ieee80211_get_hdrlen(le16_to_cpu(hdr->frame_ctl));
+
+#ifdef CONFIG_IEEE80211_CRYPT_TKIP
+	if (ieee->tkip_countermeasures &&
+	    strcmp(crypt->ops->name, "TKIP") == 0) {
+		if (net_ratelimit()) {
+			printk(KERN_DEBUG "%s: TKIP countermeasures: dropped "
+			       "received packet from " MAC_FMT "\n",
+			       ieee->dev->name, MAC_ARG(hdr->addr2));
+		}
+		return -1;
+	}
+#endif
+
+	atomic_inc(&crypt->refcnt);
+	res = crypt->ops->decrypt_mpdu(skb, hdrlen, crypt->priv);
+	atomic_dec(&crypt->refcnt);
+	if (res < 0) {
+		IEEE80211_DEBUG_DROP(
+			"decryption failed (SA=" MAC_FMT
+			") res=%d\n", MAC_ARG(hdr->addr2), res);
+		if (res == -2)
+			IEEE80211_DEBUG_DROP("Decryption failed ICV "
+					     "mismatch (key %d)\n",
+					     skb->data[hdrlen + 3] >> 6);
+		ieee->ieee_stats.rx_discards_undecryptable++;
+		return -1;
+	}
+
+	return res;
+}
+
+
+/* Called only as a tasklet (software IRQ), by ieee80211_rx */
+static inline int
+ieee80211_rx_frame_decrypt_msdu(struct ieee80211_device* ieee, struct sk_buff *skb,
+			     int keyidx, struct ieee80211_crypt_data *crypt)
+{
+	struct ieee80211_hdr_4addr *hdr;
+	int res, hdrlen;
+
+	if (crypt == NULL || crypt->ops->decrypt_msdu == NULL)
+		return 0;
+	if (ieee->hwsec_active)
+	{
+		cb_desc *tcb_desc = (cb_desc *)(skb->cb+ MAX_DEV_ADDR_SIZE);
+		tcb_desc->bHwSec = 1;
+	}
+
+	hdr = (struct ieee80211_hdr_4addr *) skb->data;
+	hdrlen = ieee80211_get_hdrlen(le16_to_cpu(hdr->frame_ctl));
+
+	atomic_inc(&crypt->refcnt);
+	res = crypt->ops->decrypt_msdu(skb, keyidx, hdrlen, crypt->priv);
+	atomic_dec(&crypt->refcnt);
+	if (res < 0) {
+		printk(KERN_DEBUG "%s: MSDU decryption/MIC verification failed"
+		       " (SA=" MAC_FMT " keyidx=%d)\n",
+		       ieee->dev->name, MAC_ARG(hdr->addr2), keyidx);
+		return -1;
+	}
+
+	return 0;
+}
+
+
+/* this function is stolen from ipw2200 driver*/
+#define IEEE_PACKET_RETRY_TIME (5*HZ)
+static int is_duplicate_packet(struct ieee80211_device *ieee,
+				      struct ieee80211_hdr_4addr *header)
+{
+	u16 fc = le16_to_cpu(header->frame_ctl);
+	u16 sc = le16_to_cpu(header->seq_ctl);
+	u16 seq = WLAN_GET_SEQ_SEQ(sc);
+	u16 frag = WLAN_GET_SEQ_FRAG(sc);
+	u16 *last_seq, *last_frag;
+	unsigned long *last_time;
+	struct ieee80211_hdr_3addrqos *hdr_3addrqos;
+	struct ieee80211_hdr_4addrqos *hdr_4addrqos;
+	u8 tid;
+
+
+	//TO2DS and QoS
+	if(((fc & IEEE80211_FCTL_DSTODS) == IEEE80211_FCTL_DSTODS)&&IEEE80211_QOS_HAS_SEQ(fc)) {
+	  hdr_4addrqos = (struct ieee80211_hdr_4addrqos *)header;
+	  tid = le16_to_cpu(hdr_4addrqos->qos_ctl) & IEEE80211_QCTL_TID;
+	  tid = UP2AC(tid);
+	  tid ++;
+	} else if(IEEE80211_QOS_HAS_SEQ(fc)) { //QoS
+	  hdr_3addrqos = (struct ieee80211_hdr_3addrqos*)header;
+	  tid = le16_to_cpu(hdr_3addrqos->qos_ctl) & IEEE80211_QCTL_TID;
+	  tid = UP2AC(tid);
+	  tid ++;
+	} else { // no QoS
+	  tid = 0;
+	}
+
+	switch (ieee->iw_mode) {
+	case IW_MODE_ADHOC:
+	{
+		struct list_head *p;
+		struct ieee_ibss_seq *entry = NULL;
+		u8 *mac = header->addr2;
+		int index = mac[5] % IEEE_IBSS_MAC_HASH_SIZE;
+		//for (pos = (head)->next; pos != (head); pos = pos->next)
+		//__list_for_each(p, &ieee->ibss_mac_hash[index]) {
+		list_for_each(p, &ieee->ibss_mac_hash[index]) {
+			entry = list_entry(p, struct ieee_ibss_seq, list);
+			if (!memcmp(entry->mac, mac, ETH_ALEN))
+				break;
+		}
+	//	if (memcmp(entry->mac, mac, ETH_ALEN)){
+		if (p == &ieee->ibss_mac_hash[index]) {
+			entry = kmalloc(sizeof(struct ieee_ibss_seq), GFP_ATOMIC);
+			if (!entry) {
+				printk(KERN_WARNING "Cannot malloc new mac entry\n");
+				return 0;
+			}
+			memcpy(entry->mac, mac, ETH_ALEN);
+			entry->seq_num[tid] = seq;
+			entry->frag_num[tid] = frag;
+			entry->packet_time[tid] = jiffies;
+			list_add(&entry->list, &ieee->ibss_mac_hash[index]);
+			return 0;
+		}
+		last_seq = &entry->seq_num[tid];
+		last_frag = &entry->frag_num[tid];
+		last_time = &entry->packet_time[tid];
+		break;
+	}
+
+	case IW_MODE_INFRA:
+		last_seq = &ieee->last_rxseq_num[tid];
+		last_frag = &ieee->last_rxfrag_num[tid];
+		last_time = &ieee->last_packet_time[tid];
+
+		break;
+	default:
+		return 0;
+	}
+
+//	if(tid != 0) {
+//		printk(KERN_WARNING ":)))))))))))%x %x %x, fc(%x)\n", tid, *last_seq, seq, header->frame_ctl);
+//	}
+	if ((*last_seq == seq) &&
+	    time_after(*last_time + IEEE_PACKET_RETRY_TIME, jiffies)) {
+		if (*last_frag == frag){
+			//printk(KERN_WARNING "[1] go drop!\n");
+			goto drop;
+
+		}
+		if (*last_frag + 1 != frag)
+			/* out-of-order fragment */
+			//printk(KERN_WARNING "[2] go drop!\n");
+			goto drop;
+	} else
+		*last_seq = seq;
+
+	*last_frag = frag;
+	*last_time = jiffies;
+	return 0;
+
+drop:
+//	BUG_ON(!(fc & IEEE80211_FCTL_RETRY));
+//	printk("DUP\n");
+
+	return 1;
+}
+bool
+AddReorderEntry(
+	PRX_TS_RECORD			pTS,
+	PRX_REORDER_ENTRY		pReorderEntry
+	)
+{
+	struct list_head *pList = &pTS->RxPendingPktList;
+	while(pList->next != &pTS->RxPendingPktList)
+	{
+		if( SN_LESS(pReorderEntry->SeqNum, ((PRX_REORDER_ENTRY)list_entry(pList->next,RX_REORDER_ENTRY,List))->SeqNum) )
+		{
+			pList = pList->next;
+		}
+		else if( SN_EQUAL(pReorderEntry->SeqNum, ((PRX_REORDER_ENTRY)list_entry(pList->next,RX_REORDER_ENTRY,List))->SeqNum) )
+		{
+			return false;
+		}
+		else
+		{
+			break;
+		}
+	}
+	pReorderEntry->List.next = pList->next;
+	pReorderEntry->List.next->prev = &pReorderEntry->List;
+	pReorderEntry->List.prev = pList;
+	pList->next = &pReorderEntry->List;
+
+	return true;
+}
+
+void ieee80211_indicate_packets(struct ieee80211_device *ieee, struct ieee80211_rxb** prxbIndicateArray,u8  index)
+{
+	u8 i = 0 , j=0;
+	u16 ethertype;
+//	if(index > 1)
+//		IEEE80211_DEBUG(IEEE80211_DL_REORDER,"%s(): hahahahhhh, We indicate packet from reorder list, index is %u\n",__FUNCTION__,index);
+	for(j = 0; j<index; j++)
+	{
+//added by amy for reorder
+		struct ieee80211_rxb* prxb = prxbIndicateArray[j];
+		for(i = 0; i<prxb->nr_subframes; i++) {
+			struct sk_buff *sub_skb = prxb->subframes[i];
+
+		/* convert hdr + possible LLC headers into Ethernet header */
+			ethertype = (sub_skb->data[6] << 8) | sub_skb->data[7];
+			if (sub_skb->len >= 8 &&
+				((memcmp(sub_skb->data, rfc1042_header, SNAP_SIZE) == 0 &&
+				  ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
+				 memcmp(sub_skb->data, bridge_tunnel_header, SNAP_SIZE) == 0)) {
+			/* remove RFC1042 or Bridge-Tunnel encapsulation and
+			 * replace EtherType */
+				skb_pull(sub_skb, SNAP_SIZE);
+				memcpy(skb_push(sub_skb, ETH_ALEN), prxb->src, ETH_ALEN);
+				memcpy(skb_push(sub_skb, ETH_ALEN), prxb->dst, ETH_ALEN);
+			} else {
+				u16 len;
+			/* Leave Ethernet header part of hdr and full payload */
+				len = htons(sub_skb->len);
+				memcpy(skb_push(sub_skb, 2), &len, 2);
+				memcpy(skb_push(sub_skb, ETH_ALEN), prxb->src, ETH_ALEN);
+				memcpy(skb_push(sub_skb, ETH_ALEN), prxb->dst, ETH_ALEN);
+			}
+			//stats->rx_packets++;
+			//stats->rx_bytes += sub_skb->len;
+
+		/* Indicat the packets to upper layer */
+			if (sub_skb) {
+				//printk("0skb_len(%d)\n", skb->len);
+				sub_skb->protocol = eth_type_trans(sub_skb, ieee->dev);
+				memset(sub_skb->cb, 0, sizeof(sub_skb->cb));
+				sub_skb->dev = ieee->dev;
+				sub_skb->ip_summed = CHECKSUM_NONE; /* 802.11 crc not sufficient */
+				//skb->ip_summed = CHECKSUM_UNNECESSARY; /* 802.11 crc not sufficient */
+				ieee->last_rx_ps_time = jiffies;
+				//printk("1skb_len(%d)\n", skb->len);
+				netif_rx(sub_skb);
+			}
+		}
+		kfree(prxb);
+		prxb = NULL;
+	}
+}
+
+
+void RxReorderIndicatePacket( struct ieee80211_device *ieee,
+		struct ieee80211_rxb* prxb,
+		PRX_TS_RECORD		pTS,
+		u16			SeqNum)
+{
+	PRT_HIGH_THROUGHPUT	pHTInfo = ieee->pHTInfo;
+	PRX_REORDER_ENTRY 	pReorderEntry = NULL;
+	struct ieee80211_rxb* prxbIndicateArray[REORDER_WIN_SIZE];
+	u8			WinSize = pHTInfo->RxReorderWinSize;
+	u16			WinEnd = (pTS->RxIndicateSeq + WinSize -1)%4096;
+	u8			index = 0;
+	bool			bMatchWinStart = false, bPktInBuf = false;
+	IEEE80211_DEBUG(IEEE80211_DL_REORDER,"%s(): Seq is %d,pTS->RxIndicateSeq is %d, WinSize is %d\n",__FUNCTION__,SeqNum,pTS->RxIndicateSeq,WinSize);
+	/* Rx Reorder initialize condition.*/
+	if(pTS->RxIndicateSeq == 0xffff) {
+		pTS->RxIndicateSeq = SeqNum;
+	}
+
+	/* Drop out the packet which SeqNum is smaller than WinStart */
+	if(SN_LESS(SeqNum, pTS->RxIndicateSeq)) {
+		IEEE80211_DEBUG(IEEE80211_DL_REORDER,"Packet Drop! IndicateSeq: %d, NewSeq: %d\n",
+				 pTS->RxIndicateSeq, SeqNum);
+		pHTInfo->RxReorderDropCounter++;
+		{
+			int i;
+			for(i =0; i < prxb->nr_subframes; i++) {
+				dev_kfree_skb(prxb->subframes[i]);
+			}
+			kfree(prxb);
+			prxb = NULL;
+		}
+		return;
+	}
+
+	/*
+	 * Sliding window manipulation. Conditions includes:
+	 * 1. Incoming SeqNum is equal to WinStart =>Window shift 1
+	 * 2. Incoming SeqNum is larger than the WinEnd => Window shift N
+	 */
+	if(SN_EQUAL(SeqNum, pTS->RxIndicateSeq)) {
+		pTS->RxIndicateSeq = (pTS->RxIndicateSeq + 1) % 4096;
+		bMatchWinStart = true;
+	} else if(SN_LESS(WinEnd, SeqNum)) {
+		if(SeqNum >= (WinSize - 1)) {
+			pTS->RxIndicateSeq = SeqNum + 1 -WinSize;
+		} else {
+			pTS->RxIndicateSeq = 4095 - (WinSize - (SeqNum +1)) + 1;
+		}
+		IEEE80211_DEBUG(IEEE80211_DL_REORDER, "Window Shift! IndicateSeq: %d, NewSeq: %d\n",pTS->RxIndicateSeq, SeqNum);
+	}
+
+	/*
+	 * Indication process.
+	 * After Packet dropping and Sliding Window shifting as above, we can now just indicate the packets
+	 * with the SeqNum smaller than latest WinStart and buffer other packets.
+	 */
+	/* For Rx Reorder condition:
+	 * 1. All packets with SeqNum smaller than WinStart => Indicate
+	 * 2. All packets with SeqNum larger than or equal to WinStart => Buffer it.
+	 */
+	if(bMatchWinStart) {
+		/* Current packet is going to be indicated.*/
+		IEEE80211_DEBUG(IEEE80211_DL_REORDER, "Packets indication!! IndicateSeq: %d, NewSeq: %d\n",\
+				pTS->RxIndicateSeq, SeqNum);
+		prxbIndicateArray[0] = prxb;
+//		printk("========================>%s(): SeqNum is %d\n",__FUNCTION__,SeqNum);
+		index = 1;
+	} else {
+		/* Current packet is going to be inserted into pending list.*/
+		//IEEE80211_DEBUG(IEEE80211_DL_REORDER,"%s(): We RX no ordered packed, insert to orderd list\n",__FUNCTION__);
+		if(!list_empty(&ieee->RxReorder_Unused_List)) {
+			pReorderEntry = (PRX_REORDER_ENTRY)list_entry(ieee->RxReorder_Unused_List.next,RX_REORDER_ENTRY,List);
+			list_del_init(&pReorderEntry->List);
+
+			/* Make a reorder entry and insert into a the packet list.*/
+			pReorderEntry->SeqNum = SeqNum;
+			pReorderEntry->prxb = prxb;
+	//		IEEE80211_DEBUG(IEEE80211_DL_REORDER,"%s(): pREorderEntry->SeqNum is %d\n",__FUNCTION__,pReorderEntry->SeqNum);
+
+			if(!AddReorderEntry(pTS, pReorderEntry)) {
+				IEEE80211_DEBUG(IEEE80211_DL_REORDER, "%s(): Duplicate packet is dropped!! IndicateSeq: %d, NewSeq: %d\n",
+					__FUNCTION__, pTS->RxIndicateSeq, SeqNum);
+				list_add_tail(&pReorderEntry->List,&ieee->RxReorder_Unused_List);
+				{
+					int i;
+					for(i =0; i < prxb->nr_subframes; i++) {
+						dev_kfree_skb(prxb->subframes[i]);
+					}
+					kfree(prxb);
+					prxb = NULL;
+				}
+			} else {
+				IEEE80211_DEBUG(IEEE80211_DL_REORDER,
+					 "Pkt insert into buffer!! IndicateSeq: %d, NewSeq: %d\n",pTS->RxIndicateSeq, SeqNum);
+			}
+		}
+		else {
+			/*
+			 * Packets are dropped if there is not enough reorder entries.
+			 * This part shall be modified!! We can just indicate all the
+			 * packets in buffer and get reorder entries.
+			 */
+			IEEE80211_DEBUG(IEEE80211_DL_ERR, "RxReorderIndicatePacket(): There is no reorder entry!! Packet is dropped!!\n");
+			{
+				int i;
+				for(i =0; i < prxb->nr_subframes; i++) {
+					dev_kfree_skb(prxb->subframes[i]);
+				}
+				kfree(prxb);
+				prxb = NULL;
+			}
+		}
+	}
+
+	/* Check if there is any packet need indicate.*/
+	while(!list_empty(&pTS->RxPendingPktList)) {
+		IEEE80211_DEBUG(IEEE80211_DL_REORDER,"%s(): start RREORDER indicate\n",__FUNCTION__);
+		pReorderEntry = (PRX_REORDER_ENTRY)list_entry(pTS->RxPendingPktList.prev,RX_REORDER_ENTRY,List);
+		if( SN_LESS(pReorderEntry->SeqNum, pTS->RxIndicateSeq) ||
+				SN_EQUAL(pReorderEntry->SeqNum, pTS->RxIndicateSeq))
+		{
+			/* This protect buffer from overflow. */
+			if(index >= REORDER_WIN_SIZE) {
+				IEEE80211_DEBUG(IEEE80211_DL_ERR, "RxReorderIndicatePacket(): Buffer overflow!! \n");
+				bPktInBuf = true;
+				break;
+			}
+
+			list_del_init(&pReorderEntry->List);
+
+			if(SN_EQUAL(pReorderEntry->SeqNum, pTS->RxIndicateSeq))
+				pTS->RxIndicateSeq = (pTS->RxIndicateSeq + 1) % 4096;
+
+			IEEE80211_DEBUG(IEEE80211_DL_REORDER,"Packets indication!! IndicateSeq: %d, NewSeq: %d\n",pTS->RxIndicateSeq, SeqNum);
+			prxbIndicateArray[index] = pReorderEntry->prxb;
+		//	printk("========================>%s(): pReorderEntry->SeqNum is %d\n",__FUNCTION__,pReorderEntry->SeqNum);
+			index++;
+
+			list_add_tail(&pReorderEntry->List,&ieee->RxReorder_Unused_List);
+		} else {
+			bPktInBuf = true;
+			break;
+		}
+	}
+
+	/* Handling pending timer. Set this timer to prevent from long time Rx buffering.*/
+	if(index>0) {
+		// Cancel previous pending timer.
+	//	del_timer_sync(&pTS->RxPktPendingTimer);
+		pTS->RxTimeoutIndicateSeq = 0xffff;
+
+		// Indicate packets
+		if(index>REORDER_WIN_SIZE){
+			IEEE80211_DEBUG(IEEE80211_DL_ERR, "RxReorderIndicatePacket(): Rx Reorer buffer full!! \n");
+			return;
+		}
+		ieee80211_indicate_packets(ieee, prxbIndicateArray, index);
+	}
+
+	if(bPktInBuf && pTS->RxTimeoutIndicateSeq==0xffff) {
+		// Set new pending timer.
+		IEEE80211_DEBUG(IEEE80211_DL_REORDER,"%s(): SET rx timeout timer\n", __FUNCTION__);
+		pTS->RxTimeoutIndicateSeq = pTS->RxIndicateSeq;
+		if(timer_pending(&pTS->RxPktPendingTimer))
+			del_timer_sync(&pTS->RxPktPendingTimer);
+		pTS->RxPktPendingTimer.expires = jiffies + MSECS(pHTInfo->RxReorderPendingTime);
+		add_timer(&pTS->RxPktPendingTimer);
+	}
+}
+
+u8 parse_subframe(struct sk_buff *skb,
+                  struct ieee80211_rx_stats *rx_stats,
+		  struct ieee80211_rxb *rxb,u8* src,u8* dst)
+{
+	struct ieee80211_hdr_3addr  *hdr = (struct ieee80211_hdr_3addr* )skb->data;
+	u16		fc = le16_to_cpu(hdr->frame_ctl);
+
+	u16		LLCOffset= sizeof(struct ieee80211_hdr_3addr);
+	u16		ChkLength;
+	bool		bIsAggregateFrame = false;
+	u16		nSubframe_Length;
+	u8		nPadding_Length = 0;
+	u16		SeqNum=0;
+
+	struct sk_buff *sub_skb;
+	u8             *data_ptr;
+	/* just for debug purpose */
+	SeqNum = WLAN_GET_SEQ_SEQ(le16_to_cpu(hdr->seq_ctl));
+
+	if((IEEE80211_QOS_HAS_SEQ(fc))&&\
+			(((frameqos *)(skb->data + IEEE80211_3ADDR_LEN))->field.reserved)) {
+		bIsAggregateFrame = true;
+	}
+
+	if(IEEE80211_QOS_HAS_SEQ(fc)) {
+		LLCOffset += 2;
+	}
+
+	if(rx_stats->bContainHTC) {
+		LLCOffset += sHTCLng;
+	}
+	//printk("ChkLength = %d\n", LLCOffset);
+	// Null packet, don't indicate it to upper layer
+	ChkLength = LLCOffset;/* + (Frame_WEP(frame)!=0 ?Adapter->MgntInfo.SecurityInfo.EncryptionHeadOverhead:0);*/
+
+	if( skb->len <= ChkLength ) {
+		return 0;
+	}
+
+	skb_pull(skb, LLCOffset);
+
+	if(!bIsAggregateFrame) {
+		rxb->nr_subframes = 1;
+#ifdef JOHN_NOCPY
+		rxb->subframes[0] = skb;
+#else
+		rxb->subframes[0] = skb_copy(skb, GFP_ATOMIC);
+#endif
+
+		memcpy(rxb->src,src,ETH_ALEN);
+		memcpy(rxb->dst,dst,ETH_ALEN);
+		//IEEE80211_DEBUG_DATA(IEEE80211_DL_RX,skb->data,skb->len);
+		return 1;
+	} else {
+		rxb->nr_subframes = 0;
+		memcpy(rxb->src,src,ETH_ALEN);
+		memcpy(rxb->dst,dst,ETH_ALEN);
+		while(skb->len > ETHERNET_HEADER_SIZE) {
+			/* Offset 12 denote 2 mac address */
+			nSubframe_Length = *((u16*)(skb->data + 12));
+			//==m==>change the length order
+			nSubframe_Length = (nSubframe_Length>>8) + (nSubframe_Length<<8);
+
+			if(skb->len<(ETHERNET_HEADER_SIZE + nSubframe_Length)) {
+				printk("%s: A-MSDU parse error!! pRfd->nTotalSubframe : %d\n",\
+						__FUNCTION__,rxb->nr_subframes);
+				printk("%s: A-MSDU parse error!! Subframe Length: %d\n",__FUNCTION__, nSubframe_Length);
+				printk("nRemain_Length is %d and nSubframe_Length is : %d\n",skb->len,nSubframe_Length);
+				printk("The Packet SeqNum is %d\n",SeqNum);
+				return 0;
+			}
+
+			/* move the data point to data content */
+			skb_pull(skb, ETHERNET_HEADER_SIZE);
+
+#ifdef JOHN_NOCPY
+			sub_skb = skb_clone(skb, GFP_ATOMIC);
+			sub_skb->len = nSubframe_Length;
+			sub_skb->tail = sub_skb->data + nSubframe_Length;
+#else
+			/* Allocate new skb for releasing to upper layer */
+			sub_skb = dev_alloc_skb(nSubframe_Length + 12);
+			skb_reserve(sub_skb, 12);
+			data_ptr = (u8 *)skb_put(sub_skb, nSubframe_Length);
+			memcpy(data_ptr,skb->data,nSubframe_Length);
+#endif
+			rxb->subframes[rxb->nr_subframes++] = sub_skb;
+			if(rxb->nr_subframes >= MAX_SUBFRAME_COUNT) {
+				IEEE80211_DEBUG_RX("ParseSubframe(): Too many Subframes! Packets dropped!\n");
+				break;
+			}
+			skb_pull(skb,nSubframe_Length);
+
+			if(skb->len != 0) {
+				nPadding_Length = 4 - ((nSubframe_Length + ETHERNET_HEADER_SIZE) % 4);
+				if(nPadding_Length == 4) {
+					nPadding_Length = 0;
+				}
+
+				if(skb->len < nPadding_Length) {
+					return 0;
+				}
+
+				skb_pull(skb,nPadding_Length);
+			}
+		}
+#ifdef JOHN_NOCPY
+		dev_kfree_skb(skb);
+#endif
+		//{just for debug added by david
+		//printk("AMSDU::rxb->nr_subframes = %d\n",rxb->nr_subframes);
+		//}
+		return rxb->nr_subframes;
+	}
+}
+
+/* All received frames are sent to this function. @skb contains the frame in
+ * IEEE 802.11 format, i.e., in the format it was sent over air.
+ * This function is called only as a tasklet (software IRQ). */
+int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
+		 struct ieee80211_rx_stats *rx_stats)
+{
+	struct net_device *dev = ieee->dev;
+	struct ieee80211_hdr_4addr *hdr;
+	//struct ieee80211_hdr_3addrqos *hdr;
+
+	size_t hdrlen;
+	u16 fc, type, stype, sc;
+	struct net_device_stats *stats;
+	unsigned int frag;
+	u8 *payload;
+	u16 ethertype;
+	//added by amy for reorder
+	u8	TID = 0;
+	u16	SeqNum = 0;
+	PRX_TS_RECORD pTS = NULL;
+	//bool bIsAggregateFrame = false;
+	//added by amy for reorder
+#ifdef NOT_YET
+	struct net_device *wds = NULL;
+	struct sk_buff *skb2 = NULL;
+	struct net_device *wds = NULL;
+	int frame_authorized = 0;
+	int from_assoc_ap = 0;
+	void *sta = NULL;
+#endif
+//	u16 qos_ctl = 0;
+	u8 dst[ETH_ALEN];
+	u8 src[ETH_ALEN];
+	u8 bssid[ETH_ALEN];
+	struct ieee80211_crypt_data *crypt = NULL;
+	int keyidx = 0;
+
+	int i;
+	struct ieee80211_rxb* rxb = NULL;
+	// cheat the the hdr type
+	hdr = (struct ieee80211_hdr_4addr *)skb->data;
+	stats = &ieee->stats;
+
+	if (skb->len < 10) {
+		printk(KERN_INFO "%s: SKB length < 10\n",
+		       dev->name);
+		goto rx_dropped;
+	}
+
+	fc = le16_to_cpu(hdr->frame_ctl);
+	type = WLAN_FC_GET_TYPE(fc);
+	stype = WLAN_FC_GET_STYPE(fc);
+	sc = le16_to_cpu(hdr->seq_ctl);
+
+	frag = WLAN_GET_SEQ_FRAG(sc);
+	hdrlen = ieee80211_get_hdrlen(fc);
+
+	if(HTCCheck(ieee, skb->data))
+	{
+		if(net_ratelimit())
+		printk("find HTCControl\n");
+		hdrlen += 4;
+		rx_stats->bContainHTC = 1;
+	}
+
+	//IEEE80211_DEBUG_DATA(IEEE80211_DL_DATA, skb->data, skb->len);
+#ifdef NOT_YET
+#if WIRELESS_EXT > 15
+	/* Put this code here so that we avoid duplicating it in all
+	 * Rx paths. - Jean II */
+#ifdef IW_WIRELESS_SPY		/* defined in iw_handler.h */
+	/* If spy monitoring on */
+	if (iface->spy_data.spy_number > 0) {
+		struct iw_quality wstats;
+		wstats.level = rx_stats->rssi;
+		wstats.noise = rx_stats->noise;
+		wstats.updated = 6;	/* No qual value */
+		/* Update spy records */
+		wireless_spy_update(dev, hdr->addr2, &wstats);
+	}
+#endif /* IW_WIRELESS_SPY */
+#endif /* WIRELESS_EXT > 15 */
+	hostap_update_rx_stats(local->ap, hdr, rx_stats);
+#endif
+
+#if WIRELESS_EXT > 15
+	if (ieee->iw_mode == IW_MODE_MONITOR) {
+		ieee80211_monitor_rx(ieee, skb, rx_stats);
+		stats->rx_packets++;
+		stats->rx_bytes += skb->len;
+		return 1;
+	}
+#endif
+	if (ieee->host_decrypt) {
+		int idx = 0;
+		if (skb->len >= hdrlen + 3)
+			idx = skb->data[hdrlen + 3] >> 6;
+		crypt = ieee->crypt[idx];
+#ifdef NOT_YET
+		sta = NULL;
+
+		/* Use station specific key to override default keys if the
+		 * receiver address is a unicast address ("individual RA"). If
+		 * bcrx_sta_key parameter is set, station specific key is used
+		 * even with broad/multicast targets (this is against IEEE
+		 * 802.11, but makes it easier to use different keys with
+		 * stations that do not support WEP key mapping). */
+
+		if (!(hdr->addr1[0] & 0x01) || local->bcrx_sta_key)
+			(void) hostap_handle_sta_crypto(local, hdr, &crypt,
+							&sta);
+#endif
+
+		/* allow NULL decrypt to indicate an station specific override
+		 * for default encryption */
+		if (crypt && (crypt->ops == NULL ||
+			      crypt->ops->decrypt_mpdu == NULL))
+			crypt = NULL;
+
+		if (!crypt && (fc & IEEE80211_FCTL_WEP)) {
+			/* This seems to be triggered by some (multicast?)
+			 * frames from other than current BSS, so just drop the
+			 * frames silently instead of filling system log with
+			 * these reports. */
+			IEEE80211_DEBUG_DROP("Decryption failed (not set)"
+					     " (SA=" MAC_FMT ")\n",
+					     MAC_ARG(hdr->addr2));
+			ieee->ieee_stats.rx_discards_undecryptable++;
+			goto rx_dropped;
+		}
+	}
+
+	if (skb->len < IEEE80211_DATA_HDR3_LEN)
+		goto rx_dropped;
+
+	// if QoS enabled, should check the sequence for each of the AC
+	if( (ieee->pHTInfo->bCurRxReorderEnable == false) || !ieee->current_network.qos_data.active|| !IsDataFrame(skb->data) || IsLegacyDataFrame(skb->data)){
+		if (is_duplicate_packet(ieee, hdr))
+		goto rx_dropped;
+
+	}
+	else
+	{
+		PRX_TS_RECORD pRxTS = NULL;
+			//IEEE80211_DEBUG(IEEE80211_DL_REORDER,"%s(): QOS ENABLE AND RECEIVE QOS DATA , we will get Ts, tid:%d\n",__FUNCTION__, tid);
+		if(GetTs(
+				ieee,
+				(PTS_COMMON_INFO*) &pRxTS,
+				hdr->addr2,
+				(u8)Frame_QoSTID((u8*)(skb->data)),
+				RX_DIR,
+				true))
+		{
+
+		//	IEEE80211_DEBUG(IEEE80211_DL_REORDER,"%s(): pRxTS->RxLastFragNum is %d,frag is %d,pRxTS->RxLastSeqNum is %d,seq is %d\n",__FUNCTION__,pRxTS->RxLastFragNum,frag,pRxTS->RxLastSeqNum,WLAN_GET_SEQ_SEQ(sc));
+			if( 	(fc & (1<<11))  &&
+					(frag == pRxTS->RxLastFragNum) &&
+					(WLAN_GET_SEQ_SEQ(sc) == pRxTS->RxLastSeqNum)	)
+			{
+				goto rx_dropped;
+			}
+			else
+			{
+				pRxTS->RxLastFragNum = frag;
+				pRxTS->RxLastSeqNum = WLAN_GET_SEQ_SEQ(sc);
+			}
+		}
+		else
+		{
+			IEEE80211_DEBUG(IEEE80211_DL_ERR, "%s(): No TS!! Skip the check!!\n",__FUNCTION__);
+			goto rx_dropped;
+		}
+	}
+	if (type == IEEE80211_FTYPE_MGMT) {
+
+
+	//IEEE80211_DEBUG_DATA(IEEE80211_DL_DATA, skb->data, skb->len);
+		if (ieee80211_rx_frame_mgmt(ieee, skb, rx_stats, type, stype))
+			goto rx_dropped;
+		else
+			goto rx_exit;
+	}
+
+	/* Data frame - extract src/dst addresses */
+	switch (fc & (IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS)) {
+	case IEEE80211_FCTL_FROMDS:
+		memcpy(dst, hdr->addr1, ETH_ALEN);
+		memcpy(src, hdr->addr3, ETH_ALEN);
+		memcpy(bssid, hdr->addr2, ETH_ALEN);
+		break;
+	case IEEE80211_FCTL_TODS:
+		memcpy(dst, hdr->addr3, ETH_ALEN);
+		memcpy(src, hdr->addr2, ETH_ALEN);
+		memcpy(bssid, hdr->addr1, ETH_ALEN);
+		break;
+	case IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS:
+		if (skb->len < IEEE80211_DATA_HDR4_LEN)
+			goto rx_dropped;
+		memcpy(dst, hdr->addr3, ETH_ALEN);
+		memcpy(src, hdr->addr4, ETH_ALEN);
+		memcpy(bssid, ieee->current_network.bssid, ETH_ALEN);
+		break;
+	case 0:
+		memcpy(dst, hdr->addr1, ETH_ALEN);
+		memcpy(src, hdr->addr2, ETH_ALEN);
+		memcpy(bssid, hdr->addr3, ETH_ALEN);
+		break;
+	}
+
+#ifdef NOT_YET
+	if (hostap_rx_frame_wds(ieee, hdr, fc, &wds))
+		goto rx_dropped;
+	if (wds) {
+		skb->dev = dev = wds;
+		stats = hostap_get_stats(dev);
+	}
+
+	if (ieee->iw_mode == IW_MODE_MASTER && !wds &&
+	    (fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) == IEEE80211_FCTL_FROMDS &&
+	    ieee->stadev &&
+	    memcmp(hdr->addr2, ieee->assoc_ap_addr, ETH_ALEN) == 0) {
+		/* Frame from BSSID of the AP for which we are a client */
+		skb->dev = dev = ieee->stadev;
+		stats = hostap_get_stats(dev);
+		from_assoc_ap = 1;
+	}
+#endif
+
+	dev->last_rx = jiffies;
+
+#ifdef NOT_YET
+	if ((ieee->iw_mode == IW_MODE_MASTER ||
+	     ieee->iw_mode == IW_MODE_REPEAT) &&
+	    !from_assoc_ap) {
+		switch (hostap_handle_sta_rx(ieee, dev, skb, rx_stats,
+					     wds != NULL)) {
+		case AP_RX_CONTINUE_NOT_AUTHORIZED:
+			frame_authorized = 0;
+			break;
+		case AP_RX_CONTINUE:
+			frame_authorized = 1;
+			break;
+		case AP_RX_DROP:
+			goto rx_dropped;
+		case AP_RX_EXIT:
+			goto rx_exit;
+		}
+	}
+#endif
+	//IEEE80211_DEBUG_DATA(IEEE80211_DL_DATA, skb->data, skb->len);
+	/* Nullfunc frames may have PS-bit set, so they must be passed to
+	 * hostap_handle_sta_rx() before being dropped here. */
+	if (stype != IEEE80211_STYPE_DATA &&
+	    stype != IEEE80211_STYPE_DATA_CFACK &&
+	    stype != IEEE80211_STYPE_DATA_CFPOLL &&
+	    stype != IEEE80211_STYPE_DATA_CFACKPOLL&&
+	    stype != IEEE80211_STYPE_QOS_DATA//add by David,2006.8.4
+	    ) {
+		if (stype != IEEE80211_STYPE_NULLFUNC)
+			IEEE80211_DEBUG_DROP(
+				"RX: dropped data frame "
+				"with no data (type=0x%02x, "
+				"subtype=0x%02x, len=%d)\n",
+				type, stype, skb->len);
+		goto rx_dropped;
+	}
+        if (memcmp(bssid, ieee->current_network.bssid, ETH_ALEN))
+                goto rx_dropped;
+
+	/* skb: hdr + (possibly fragmented, possibly encrypted) payload */
+
+	if (ieee->host_decrypt && (fc & IEEE80211_FCTL_WEP) &&
+	    (keyidx = ieee80211_rx_frame_decrypt(ieee, skb, crypt)) < 0)
+	{
+		printk("decrypt frame error\n");
+		goto rx_dropped;
+	}
+
+
+	hdr = (struct ieee80211_hdr_4addr *) skb->data;
+
+	/* skb: hdr + (possibly fragmented) plaintext payload */
+	// PR: FIXME: hostap has additional conditions in the "if" below:
+	// ieee->host_decrypt && (fc & IEEE80211_FCTL_WEP) &&
+	if ((frag != 0 || (fc & IEEE80211_FCTL_MOREFRAGS))) {
+		int flen;
+		struct sk_buff *frag_skb = ieee80211_frag_cache_get(ieee, hdr);
+		IEEE80211_DEBUG_FRAG("Rx Fragment received (%u)\n", frag);
+
+		if (!frag_skb) {
+			IEEE80211_DEBUG(IEEE80211_DL_RX | IEEE80211_DL_FRAG,
+					"Rx cannot get skb from fragment "
+					"cache (morefrag=%d seq=%u frag=%u)\n",
+					(fc & IEEE80211_FCTL_MOREFRAGS) != 0,
+					WLAN_GET_SEQ_SEQ(sc), frag);
+			goto rx_dropped;
+		}
+		flen = skb->len;
+		if (frag != 0)
+			flen -= hdrlen;
+
+		if (frag_skb->tail + flen > frag_skb->end) {
+			printk(KERN_WARNING "%s: host decrypted and "
+			       "reassembled frame did not fit skb\n",
+			       dev->name);
+			ieee80211_frag_cache_invalidate(ieee, hdr);
+			goto rx_dropped;
+		}
+
+		if (frag == 0) {
+			/* copy first fragment (including full headers) into
+			 * beginning of the fragment cache skb */
+			memcpy(skb_put(frag_skb, flen), skb->data, flen);
+		} else {
+			/* append frame payload to the end of the fragment
+			 * cache skb */
+			memcpy(skb_put(frag_skb, flen), skb->data + hdrlen,
+			       flen);
+		}
+		dev_kfree_skb_any(skb);
+		skb = NULL;
+
+		if (fc & IEEE80211_FCTL_MOREFRAGS) {
+			/* more fragments expected - leave the skb in fragment
+			 * cache for now; it will be delivered to upper layers
+			 * after all fragments have been received */
+			goto rx_exit;
+		}
+
+		/* this was the last fragment and the frame will be
+		 * delivered, so remove skb from fragment cache */
+		skb = frag_skb;
+		hdr = (struct ieee80211_hdr_4addr *) skb->data;
+		ieee80211_frag_cache_invalidate(ieee, hdr);
+	}
+
+	/* skb: hdr + (possible reassembled) full MSDU payload; possibly still
+	 * encrypted/authenticated */
+	if (ieee->host_decrypt && (fc & IEEE80211_FCTL_WEP) &&
+	    ieee80211_rx_frame_decrypt_msdu(ieee, skb, keyidx, crypt))
+	{
+		printk("==>decrypt msdu error\n");
+		goto rx_dropped;
+	}
+
+	//added by amy for AP roaming
+	ieee->LinkDetectInfo.NumRecvDataInPeriod++;
+	ieee->LinkDetectInfo.NumRxOkInPeriod++;
+
+	hdr = (struct ieee80211_hdr_4addr *) skb->data;
+	if (crypt && !(fc & IEEE80211_FCTL_WEP) && !ieee->open_wep) {
+		if (/*ieee->ieee802_1x &&*/
+		    ieee80211_is_eapol_frame(ieee, skb, hdrlen)) {
+
+#ifdef CONFIG_IEEE80211_DEBUG
+			/* pass unencrypted EAPOL frames even if encryption is
+			 * configured */
+			struct eapol *eap = (struct eapol *)(skb->data +
+				24);
+			IEEE80211_DEBUG_EAP("RX: IEEE 802.1X EAPOL frame: %s\n",
+						eap_get_type(eap->type));
+#endif
+		} else {
+			IEEE80211_DEBUG_DROP(
+				"encryption configured, but RX "
+				"frame not encrypted (SA=" MAC_FMT ")\n",
+				MAC_ARG(hdr->addr2));
+			goto rx_dropped;
+		}
+	}
+
+#ifdef CONFIG_IEEE80211_DEBUG
+	if (crypt && !(fc & IEEE80211_FCTL_WEP) &&
+	    ieee80211_is_eapol_frame(ieee, skb, hdrlen)) {
+			struct eapol *eap = (struct eapol *)(skb->data +
+				24);
+			IEEE80211_DEBUG_EAP("RX: IEEE 802.1X EAPOL frame: %s\n",
+						eap_get_type(eap->type));
+	}
+#endif
+
+	if (crypt && !(fc & IEEE80211_FCTL_WEP) && !ieee->open_wep &&
+	    !ieee80211_is_eapol_frame(ieee, skb, hdrlen)) {
+		IEEE80211_DEBUG_DROP(
+			"dropped unencrypted RX data "
+			"frame from " MAC_FMT
+			" (drop_unencrypted=1)\n",
+			MAC_ARG(hdr->addr2));
+		goto rx_dropped;
+	}
+/*
+	if(ieee80211_is_eapol_frame(ieee, skb, hdrlen)) {
+		printk(KERN_WARNING "RX: IEEE802.1X EPAOL frame!\n");
+	}
+*/
+//added by amy for reorder
+	if(ieee->current_network.qos_data.active && IsQoSDataFrame(skb->data)
+		&& !is_multicast_ether_addr(hdr->addr1) && !is_broadcast_ether_addr(hdr->addr1))
+	{
+		TID = Frame_QoSTID(skb->data);
+		SeqNum = WLAN_GET_SEQ_SEQ(sc);
+		GetTs(ieee,(PTS_COMMON_INFO*) &pTS,hdr->addr2,TID,RX_DIR,true);
+		if(TID !=0 && TID !=3)
+		{
+			ieee->bis_any_nonbepkts = true;
+		}
+	}
+//added by amy for reorder
+	/* skb: hdr + (possible reassembled) full plaintext payload */
+	payload = skb->data + hdrlen;
+	//ethertype = (payload[6] << 8) | payload[7];
+	rxb = (struct ieee80211_rxb*)kmalloc(sizeof(struct ieee80211_rxb),GFP_ATOMIC);
+	if(rxb == NULL)
+	{
+		IEEE80211_DEBUG(IEEE80211_DL_ERR,"%s(): kmalloc rxb error\n",__FUNCTION__);
+		goto rx_dropped;
+	}
+	/* to parse amsdu packets */
+	/* qos data packets & reserved bit is 1 */
+	if(parse_subframe(skb,rx_stats,rxb,src,dst) == 0) {
+		/* only to free rxb, and not submit the packets to upper layer */
+		for(i =0; i < rxb->nr_subframes; i++) {
+			dev_kfree_skb(rxb->subframes[i]);
+		}
+		kfree(rxb);
+		rxb = NULL;
+		goto rx_dropped;
+	}
+
+//added by amy for reorder
+	if(ieee->pHTInfo->bCurRxReorderEnable == false ||pTS == NULL){
+//added by amy for reorder
+		for(i = 0; i<rxb->nr_subframes; i++) {
+			struct sk_buff *sub_skb = rxb->subframes[i];
+
+			if (sub_skb) {
+				/* convert hdr + possible LLC headers into Ethernet header */
+				ethertype = (sub_skb->data[6] << 8) | sub_skb->data[7];
+				if (sub_skb->len >= 8 &&
+						((memcmp(sub_skb->data, rfc1042_header, SNAP_SIZE) == 0 &&
+						  ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
+						 memcmp(sub_skb->data, bridge_tunnel_header, SNAP_SIZE) == 0)) {
+					/* remove RFC1042 or Bridge-Tunnel encapsulation and
+					 * replace EtherType */
+					skb_pull(sub_skb, SNAP_SIZE);
+					memcpy(skb_push(sub_skb, ETH_ALEN), src, ETH_ALEN);
+					memcpy(skb_push(sub_skb, ETH_ALEN), dst, ETH_ALEN);
+				} else {
+					u16 len;
+					/* Leave Ethernet header part of hdr and full payload */
+					len = htons(sub_skb->len);
+					memcpy(skb_push(sub_skb, 2), &len, 2);
+					memcpy(skb_push(sub_skb, ETH_ALEN), src, ETH_ALEN);
+					memcpy(skb_push(sub_skb, ETH_ALEN), dst, ETH_ALEN);
+				}
+
+				stats->rx_packets++;
+				stats->rx_bytes += sub_skb->len;
+				if(is_multicast_ether_addr(dst)) {
+					stats->multicast++;
+				}
+
+				/* Indicat the packets to upper layer */
+				//printk("0skb_len(%d)\n", skb->len);
+				sub_skb->protocol = eth_type_trans(sub_skb, dev);
+				memset(sub_skb->cb, 0, sizeof(sub_skb->cb));
+				sub_skb->dev = dev;
+				sub_skb->ip_summed = CHECKSUM_NONE; /* 802.11 crc not sufficient */
+				//skb->ip_summed = CHECKSUM_UNNECESSARY; /* 802.11 crc not sufficient */
+				ieee->last_rx_ps_time = jiffies;
+				//printk("1skb_len(%d)\n", skb->len);
+				netif_rx(sub_skb);
+			}
+		}
+		kfree(rxb);
+		rxb = NULL;
+
+	}
+	else
+	{
+		IEEE80211_DEBUG(IEEE80211_DL_REORDER,"%s(): REORDER ENABLE AND PTS not NULL, and we will enter RxReorderIndicatePacket()\n",__FUNCTION__);
+		RxReorderIndicatePacket(ieee, rxb, pTS, SeqNum);
+	}
+#ifndef JOHN_NOCPY
+	dev_kfree_skb(skb);
+#endif
+
+ rx_exit:
+#ifdef NOT_YET
+	if (sta)
+		hostap_handle_sta_release(sta);
+#endif
+	return 1;
+
+ rx_dropped:
+	if (rxb != NULL)
+	{
+		kfree(rxb);
+		rxb = NULL;
+	}
+	stats->rx_dropped++;
+
+	/* Returning 0 indicates to caller that we have not handled the SKB--
+	 * so it is still allocated and can be used again by underlying
+	 * hardware as a DMA target */
+	return 0;
+}
+
+#define MGMT_FRAME_FIXED_PART_LENGTH            0x24
+
+static u8 qos_oui[QOS_OUI_LEN] = { 0x00, 0x50, 0xF2 };
+
+/*
+* Make ther structure we read from the beacon packet has
+* the right values
+*/
+static int ieee80211_verify_qos_info(struct ieee80211_qos_information_element
+                                     *info_element, int sub_type)
+{
+
+        if (info_element->qui_subtype != sub_type)
+                return -1;
+        if (memcmp(info_element->qui, qos_oui, QOS_OUI_LEN))
+                return -1;
+        if (info_element->qui_type != QOS_OUI_TYPE)
+                return -1;
+        if (info_element->version != QOS_VERSION_1)
+                return -1;
+
+        return 0;
+}
+
+
+/*
+ * Parse a QoS parameter element
+ */
+static int ieee80211_read_qos_param_element(struct ieee80211_qos_parameter_info
+                                            *element_param, struct ieee80211_info_element
+                                            *info_element)
+{
+        int ret = 0;
+        u16 size = sizeof(struct ieee80211_qos_parameter_info) - 2;
+
+        if ((info_element == NULL) || (element_param == NULL))
+                return -1;
+
+        if (info_element->id == QOS_ELEMENT_ID && info_element->len == size) {
+                memcpy(element_param->info_element.qui, info_element->data,
+                       info_element->len);
+                element_param->info_element.elementID = info_element->id;
+                element_param->info_element.length = info_element->len;
+        } else
+                ret = -1;
+        if (ret == 0)
+                ret = ieee80211_verify_qos_info(&element_param->info_element,
+                                                QOS_OUI_PARAM_SUB_TYPE);
+        return ret;
+}
+
+/*
+ * Parse a QoS information element
+ */
+static int ieee80211_read_qos_info_element(struct
+                                           ieee80211_qos_information_element
+                                           *element_info, struct ieee80211_info_element
+                                           *info_element)
+{
+        int ret = 0;
+        u16 size = sizeof(struct ieee80211_qos_information_element) - 2;
+
+        if (element_info == NULL)
+                return -1;
+        if (info_element == NULL)
+                return -1;
+
+        if ((info_element->id == QOS_ELEMENT_ID) && (info_element->len == size)) {
+                memcpy(element_info->qui, info_element->data,
+                       info_element->len);
+                element_info->elementID = info_element->id;
+                element_info->length = info_element->len;
+        } else
+                ret = -1;
+
+        if (ret == 0)
+                ret = ieee80211_verify_qos_info(element_info,
+                                                QOS_OUI_INFO_SUB_TYPE);
+        return ret;
+}
+
+
+/*
+ * Write QoS parameters from the ac parameters.
+ */
+static int ieee80211_qos_convert_ac_to_parameters(struct
+                                                  ieee80211_qos_parameter_info
+                                                  *param_elm, struct
+                                                  ieee80211_qos_parameters
+                                                  *qos_param)
+{
+        int rc = 0;
+        int i;
+        struct ieee80211_qos_ac_parameter *ac_params;
+	u8 aci;
+        //u8 cw_min;
+        //u8 cw_max;
+
+        for (i = 0; i < QOS_QUEUE_NUM; i++) {
+                ac_params = &(param_elm->ac_params_record[i]);
+
+		aci = (ac_params->aci_aifsn & 0x60) >> 5;
+
+		if(aci >= QOS_QUEUE_NUM)
+			continue;
+                qos_param->aifs[aci] = (ac_params->aci_aifsn) & 0x0f;
+
+		/* WMM spec P.11: The minimum value for AIFSN shall be 2 */
+                qos_param->aifs[aci] = (qos_param->aifs[aci] < 2) ? 2:qos_param->aifs[aci];
+
+                qos_param->cw_min[aci] = ac_params->ecw_min_max & 0x0F;
+
+                qos_param->cw_max[aci] = (ac_params->ecw_min_max & 0xF0) >> 4;
+
+                qos_param->flag[aci] =
+                    (ac_params->aci_aifsn & 0x10) ? 0x01 : 0x00;
+                qos_param->tx_op_limit[aci] = le16_to_cpu(ac_params->tx_op_limit);
+        }
+        return rc;
+}
+
+/*
+ * we have a generic data element which it may contain QoS information or
+ * parameters element. check the information element length to decide
+ * which type to read
+ */
+static int ieee80211_parse_qos_info_param_IE(struct ieee80211_info_element
+                                             *info_element,
+                                             struct ieee80211_network *network)
+{
+        int rc = 0;
+        struct ieee80211_qos_parameters *qos_param = NULL;
+        struct ieee80211_qos_information_element qos_info_element;
+
+        rc = ieee80211_read_qos_info_element(&qos_info_element, info_element);
+
+        if (rc == 0) {
+                network->qos_data.param_count = qos_info_element.ac_info & 0x0F;
+                network->flags |= NETWORK_HAS_QOS_INFORMATION;
+        } else {
+                struct ieee80211_qos_parameter_info param_element;
+
+                rc = ieee80211_read_qos_param_element(&param_element,
+                                                      info_element);
+                if (rc == 0) {
+                        qos_param = &(network->qos_data.parameters);
+                        ieee80211_qos_convert_ac_to_parameters(&param_element,
+                                                               qos_param);
+                        network->flags |= NETWORK_HAS_QOS_PARAMETERS;
+                        network->qos_data.param_count =
+                            param_element.info_element.ac_info & 0x0F;
+                }
+        }
+
+        if (rc == 0) {
+                IEEE80211_DEBUG_QOS("QoS is supported\n");
+                network->qos_data.supported = 1;
+        }
+        return rc;
+}
+
+#ifdef CONFIG_IEEE80211_DEBUG
+#define MFIE_STRING(x) case MFIE_TYPE_ ##x: return #x
+
+static const char *get_info_element_string(u16 id)
+{
+        switch (id) {
+                MFIE_STRING(SSID);
+                MFIE_STRING(RATES);
+                MFIE_STRING(FH_SET);
+                MFIE_STRING(DS_SET);
+                MFIE_STRING(CF_SET);
+                MFIE_STRING(TIM);
+                MFIE_STRING(IBSS_SET);
+                MFIE_STRING(COUNTRY);
+                MFIE_STRING(HOP_PARAMS);
+                MFIE_STRING(HOP_TABLE);
+                MFIE_STRING(REQUEST);
+                MFIE_STRING(CHALLENGE);
+                MFIE_STRING(POWER_CONSTRAINT);
+                MFIE_STRING(POWER_CAPABILITY);
+                MFIE_STRING(TPC_REQUEST);
+                MFIE_STRING(TPC_REPORT);
+                MFIE_STRING(SUPP_CHANNELS);
+                MFIE_STRING(CSA);
+                MFIE_STRING(MEASURE_REQUEST);
+                MFIE_STRING(MEASURE_REPORT);
+                MFIE_STRING(QUIET);
+                MFIE_STRING(IBSS_DFS);
+               // MFIE_STRING(ERP_INFO);
+                MFIE_STRING(RSN);
+                MFIE_STRING(RATES_EX);
+                MFIE_STRING(GENERIC);
+                MFIE_STRING(QOS_PARAMETER);
+        default:
+                return "UNKNOWN";
+        }
+}
+#endif
+
+#ifdef ENABLE_DOT11D
+static inline void ieee80211_extract_country_ie(
+	struct ieee80211_device *ieee,
+	struct ieee80211_info_element *info_element,
+	struct ieee80211_network *network,
+	u8 * addr2
+)
+{
+	if(IS_DOT11D_ENABLE(ieee))
+	{
+		if(info_element->len!= 0)
+		{
+			memcpy(network->CountryIeBuf, info_element->data, info_element->len);
+			network->CountryIeLen = info_element->len;
+
+			if(!IS_COUNTRY_IE_VALID(ieee))
+			{
+				Dot11d_UpdateCountryIe(ieee, addr2, info_element->len, info_element->data);
+			}
+		}
+
+		//
+		// 070305, rcnjko: I update country IE watch dog here because
+		// some AP (e.g. Cisco 1242) don't include country IE in their
+		// probe response frame.
+		//
+		if(IS_EQUAL_CIE_SRC(ieee, addr2) )
+		{
+			UPDATE_CIE_WATCHDOG(ieee);
+		}
+	}
+
+}
+#endif
+
+int ieee80211_parse_info_param(struct ieee80211_device *ieee,
+		struct ieee80211_info_element *info_element,
+		u16 length,
+		struct ieee80211_network *network,
+		struct ieee80211_rx_stats *stats)
+{
+	u8 i;
+	short offset;
+        u16	tmp_htcap_len=0;
+	u16	tmp_htinfo_len=0;
+	u16 ht_realtek_agg_len=0;
+	u8  ht_realtek_agg_buf[MAX_IE_LEN];
+//	u16 broadcom_len = 0;
+#ifdef CONFIG_IEEE80211_DEBUG
+	char rates_str[64];
+	char *p;
+#endif
+
+	while (length >= sizeof(*info_element)) {
+		if (sizeof(*info_element) + info_element->len > length) {
+			IEEE80211_DEBUG_MGMT("Info elem: parse failed: "
+					     "info_element->len + 2 > left : "
+					     "info_element->len+2=%zd left=%d, id=%d.\n",
+					     info_element->len +
+					     sizeof(*info_element),
+					     length, info_element->id);
+			/* We stop processing but don't return an error here
+			 * because some misbehaviour APs break this rule. ie.
+			 * Orinoco AP1000. */
+			break;
+		}
+
+		switch (info_element->id) {
+		case MFIE_TYPE_SSID:
+			if (ieee80211_is_empty_essid(info_element->data,
+						     info_element->len)) {
+				network->flags |= NETWORK_EMPTY_ESSID;
+				break;
+			}
+
+			network->ssid_len = min(info_element->len,
+						(u8) IW_ESSID_MAX_SIZE);
+			memcpy(network->ssid, info_element->data, network->ssid_len);
+			if (network->ssid_len < IW_ESSID_MAX_SIZE)
+				memset(network->ssid + network->ssid_len, 0,
+				       IW_ESSID_MAX_SIZE - network->ssid_len);
+
+			IEEE80211_DEBUG_MGMT("MFIE_TYPE_SSID: '%s' len=%d.\n",
+					     network->ssid, network->ssid_len);
+			break;
+
+		case MFIE_TYPE_RATES:
+#ifdef CONFIG_IEEE80211_DEBUG
+			p = rates_str;
+#endif
+			network->rates_len = min(info_element->len,
+						 MAX_RATES_LENGTH);
+			for (i = 0; i < network->rates_len; i++) {
+				network->rates[i] = info_element->data[i];
+#ifdef CONFIG_IEEE80211_DEBUG
+				p += snprintf(p, sizeof(rates_str) -
+					      (p - rates_str), "%02X ",
+					      network->rates[i]);
+#endif
+				if (ieee80211_is_ofdm_rate
+				    (info_element->data[i])) {
+					network->flags |= NETWORK_HAS_OFDM;
+					if (info_element->data[i] &
+					    IEEE80211_BASIC_RATE_MASK)
+						network->flags &=
+						    ~NETWORK_HAS_CCK;
+				}
+			}
+
+			IEEE80211_DEBUG_MGMT("MFIE_TYPE_RATES: '%s' (%d)\n",
+					     rates_str, network->rates_len);
+			break;
+
+		case MFIE_TYPE_RATES_EX:
+#ifdef CONFIG_IEEE80211_DEBUG
+			p = rates_str;
+#endif
+			network->rates_ex_len = min(info_element->len,
+						    MAX_RATES_EX_LENGTH);
+			for (i = 0; i < network->rates_ex_len; i++) {
+				network->rates_ex[i] = info_element->data[i];
+#ifdef CONFIG_IEEE80211_DEBUG
+				p += snprintf(p, sizeof(rates_str) -
+					      (p - rates_str), "%02X ",
+					      network->rates[i]);
+#endif
+				if (ieee80211_is_ofdm_rate
+				    (info_element->data[i])) {
+					network->flags |= NETWORK_HAS_OFDM;
+					if (info_element->data[i] &
+					    IEEE80211_BASIC_RATE_MASK)
+						network->flags &=
+						    ~NETWORK_HAS_CCK;
+				}
+			}
+
+			IEEE80211_DEBUG_MGMT("MFIE_TYPE_RATES_EX: '%s' (%d)\n",
+					     rates_str, network->rates_ex_len);
+			break;
+
+		case MFIE_TYPE_DS_SET:
+			IEEE80211_DEBUG_MGMT("MFIE_TYPE_DS_SET: %d\n",
+					     info_element->data[0]);
+			network->channel = info_element->data[0];
+			break;
+
+		case MFIE_TYPE_FH_SET:
+			IEEE80211_DEBUG_MGMT("MFIE_TYPE_FH_SET: ignored\n");
+			break;
+
+		case MFIE_TYPE_CF_SET:
+			IEEE80211_DEBUG_MGMT("MFIE_TYPE_CF_SET: ignored\n");
+			break;
+
+		case MFIE_TYPE_TIM:
+			if(info_element->len < 4)
+				break;
+
+			network->tim.tim_count = info_element->data[0];
+			network->tim.tim_period = info_element->data[1];
+
+                        network->dtim_period = info_element->data[1];
+                        if(ieee->state != IEEE80211_LINKED)
+                                break;
+
+                        network->last_dtim_sta_time[0] = stats->mac_time[0];
+                        network->last_dtim_sta_time[1] = stats->mac_time[1];
+
+                        network->dtim_data = IEEE80211_DTIM_VALID;
+
+                        if(info_element->data[0] != 0)
+                                break;
+
+                        if(info_element->data[2] & 1)
+                                network->dtim_data |= IEEE80211_DTIM_MBCAST;
+
+                        offset = (info_element->data[2] >> 1)*2;
+
+                        //printk("offset1:%x aid:%x\n",offset, ieee->assoc_id);
+
+                        if(ieee->assoc_id < 8*offset ||
+                                ieee->assoc_id > 8*(offset + info_element->len -3))
+
+                                break;
+
+                        offset = (ieee->assoc_id / 8) - offset;// + ((aid % 8)? 0 : 1) ;
+
+                        if(info_element->data[3+offset] & (1<<(ieee->assoc_id%8)))
+                                network->dtim_data |= IEEE80211_DTIM_UCAST;
+
+			//IEEE80211_DEBUG_MGMT("MFIE_TYPE_TIM: partially ignored\n");
+			break;
+
+		case MFIE_TYPE_ERP:
+			network->erp_value = info_element->data[0];
+			network->flags |= NETWORK_HAS_ERP_VALUE;
+			IEEE80211_DEBUG_MGMT("MFIE_TYPE_ERP_SET: %d\n",
+					     network->erp_value);
+			break;
+		case MFIE_TYPE_IBSS_SET:
+			network->atim_window = info_element->data[0];
+			IEEE80211_DEBUG_MGMT("MFIE_TYPE_IBSS_SET: %d\n",
+					     network->atim_window);
+			break;
+
+		case MFIE_TYPE_CHALLENGE:
+			IEEE80211_DEBUG_MGMT("MFIE_TYPE_CHALLENGE: ignored\n");
+			break;
+
+		case MFIE_TYPE_GENERIC:
+			IEEE80211_DEBUG_MGMT("MFIE_TYPE_GENERIC: %d bytes\n",
+					     info_element->len);
+			if (!ieee80211_parse_qos_info_param_IE(info_element,
+							       network))
+				break;
+
+			if (info_element->len >= 4 &&
+			    info_element->data[0] == 0x00 &&
+			    info_element->data[1] == 0x50 &&
+			    info_element->data[2] == 0xf2 &&
+			    info_element->data[3] == 0x01) {
+				network->wpa_ie_len = min(info_element->len + 2,
+							  MAX_WPA_IE_LEN);
+				memcpy(network->wpa_ie, info_element,
+				       network->wpa_ie_len);
+				break;
+			}
+
+#ifdef THOMAS_TURBO
+                        if (info_element->len == 7 &&
+                            info_element->data[0] == 0x00 &&
+                            info_element->data[1] == 0xe0 &&
+                            info_element->data[2] == 0x4c &&
+                            info_element->data[3] == 0x01 &&
+                            info_element->data[4] == 0x02) {
+                                network->Turbo_Enable = 1;
+                        }
+#endif
+
+                        //for HTcap and HTinfo parameters
+			if(tmp_htcap_len == 0){
+				if(info_element->len >= 4 &&
+				   info_element->data[0] == 0x00 &&
+				   info_element->data[1] == 0x90 &&
+				   info_element->data[2] == 0x4c &&
+				   info_element->data[3] == 0x033){
+
+						tmp_htcap_len = min(info_element->len,(u8)MAX_IE_LEN);
+				   		if(tmp_htcap_len != 0){
+				   			network->bssht.bdHTSpecVer = HT_SPEC_VER_EWC;
+							network->bssht.bdHTCapLen = tmp_htcap_len > sizeof(network->bssht.bdHTCapBuf)?\
+								sizeof(network->bssht.bdHTCapBuf):tmp_htcap_len;
+							memcpy(network->bssht.bdHTCapBuf,info_element->data,network->bssht.bdHTCapLen);
+				   		}
+				}
+				if(tmp_htcap_len != 0)
+					network->bssht.bdSupportHT = true;
+				else
+					network->bssht.bdSupportHT = false;
+			}
+
+
+			if(tmp_htinfo_len == 0){
+				if(info_element->len >= 4 &&
+					info_element->data[0] == 0x00 &&
+				   	info_element->data[1] == 0x90 &&
+				   	info_element->data[2] == 0x4c &&
+				   	info_element->data[3] == 0x034){
+
+						tmp_htinfo_len = min(info_element->len,(u8)MAX_IE_LEN);
+						if(tmp_htinfo_len != 0){
+							network->bssht.bdHTSpecVer = HT_SPEC_VER_EWC;
+							if(tmp_htinfo_len){
+								network->bssht.bdHTInfoLen = tmp_htinfo_len > sizeof(network->bssht.bdHTInfoBuf)?\
+									sizeof(network->bssht.bdHTInfoBuf):tmp_htinfo_len;
+								memcpy(network->bssht.bdHTInfoBuf,info_element->data,network->bssht.bdHTInfoLen);
+							}
+
+						}
+
+				}
+			}
+
+			if(ieee->aggregation){
+				if(network->bssht.bdSupportHT){
+					if(info_element->len >= 4 &&
+						info_element->data[0] == 0x00 &&
+						info_element->data[1] == 0xe0 &&
+						info_element->data[2] == 0x4c &&
+						info_element->data[3] == 0x02){
+
+						ht_realtek_agg_len = min(info_element->len,(u8)MAX_IE_LEN);
+						memcpy(ht_realtek_agg_buf,info_element->data,info_element->len);
+
+					}
+					if(ht_realtek_agg_len >= 5){
+						network->bssht.bdRT2RTAggregation = true;
+
+						if((ht_realtek_agg_buf[4] == 1) && (ht_realtek_agg_buf[5] & 0x02))
+						network->bssht.bdRT2RTLongSlotTime = true;
+					}
+				}
+
+			}
+
+			//if(tmp_htcap_len !=0  ||  tmp_htinfo_len != 0)
+			{
+				if((info_element->len >= 3 &&
+					 info_element->data[0] == 0x00 &&
+					 info_element->data[1] == 0x05 &&
+					 info_element->data[2] == 0xb5) ||
+					 (info_element->len >= 3 &&
+					 info_element->data[0] == 0x00 &&
+					 info_element->data[1] == 0x0a &&
+					 info_element->data[2] == 0xf7) ||
+					 (info_element->len >= 3 &&
+					 info_element->data[0] == 0x00 &&
+					 info_element->data[1] == 0x10 &&
+					 info_element->data[2] == 0x18)){
+
+						network->broadcom_cap_exist = true;
+
+				}
+			}
+			if(info_element->len >= 3 &&
+				info_element->data[0] == 0x00 &&
+				info_element->data[1] == 0x0c &&
+				info_element->data[2] == 0x43)
+			{
+				network->ralink_cap_exist = true;
+			}
+			else
+				network->ralink_cap_exist = false;
+			//added by amy for atheros AP
+			if((info_element->len >= 3 &&
+				info_element->data[0] == 0x00 &&
+				info_element->data[1] == 0x03 &&
+				info_element->data[2] == 0x7f) ||
+				(info_element->len >= 3 &&
+				info_element->data[0] == 0x00 &&
+				info_element->data[1] == 0x13 &&
+				info_element->data[2] == 0x74))
+			{
+				printk("========>%s(): athros AP is exist\n",__FUNCTION__);
+				network->atheros_cap_exist = true;
+			}
+			else
+				network->atheros_cap_exist = false;
+
+			if(info_element->len >= 3 &&
+				info_element->data[0] == 0x00 &&
+				info_element->data[1] == 0x40 &&
+				info_element->data[2] == 0x96)
+			{
+				network->cisco_cap_exist = true;
+			}
+			else
+				network->cisco_cap_exist = false;
+			//added by amy for LEAP of cisco
+			if(info_element->len > 4 &&
+				info_element->data[0] == 0x00 &&
+				info_element->data[1] == 0x40 &&
+				info_element->data[2] == 0x96 &&
+				info_element->data[3] == 0x01)
+			{
+				if(info_element->len == 6)
+				{
+					memcpy(network->CcxRmState, &info_element[4], 2);
+					if(network->CcxRmState[0] != 0)
+					{
+						network->bCcxRmEnable = true;
+					}
+					else
+						network->bCcxRmEnable = false;
+					//
+					// CCXv4 Table 59-1 MBSSID Masks.
+					//
+					network->MBssidMask = network->CcxRmState[1] & 0x07;
+					if(network->MBssidMask != 0)
+					{
+						network->bMBssidValid = true;
+						network->MBssidMask = 0xff << (network->MBssidMask);
+						cpMacAddr(network->MBssid, network->bssid);
+						network->MBssid[5] &= network->MBssidMask;
+					}
+					else
+					{
+						network->bMBssidValid = false;
+					}
+				}
+				else
+				{
+					network->bCcxRmEnable = false;
+				}
+			}
+			if(info_element->len > 4  &&
+				info_element->data[0] == 0x00 &&
+				info_element->data[1] == 0x40 &&
+				info_element->data[2] == 0x96 &&
+				info_element->data[3] == 0x03)
+			{
+				if(info_element->len == 5)
+				{
+					network->bWithCcxVerNum = true;
+					network->BssCcxVerNumber = info_element->data[4];
+				}
+				else
+				{
+					network->bWithCcxVerNum = false;
+					network->BssCcxVerNumber = 0;
+				}
+			}
+			break;
+
+		case MFIE_TYPE_RSN:
+			IEEE80211_DEBUG_MGMT("MFIE_TYPE_RSN: %d bytes\n",
+					     info_element->len);
+			network->rsn_ie_len = min(info_element->len + 2,
+						  MAX_WPA_IE_LEN);
+			memcpy(network->rsn_ie, info_element,
+			       network->rsn_ie_len);
+			break;
+
+                        //HT related element.
+		case MFIE_TYPE_HT_CAP:
+			IEEE80211_DEBUG_SCAN("MFIE_TYPE_HT_CAP: %d bytes\n",
+					     info_element->len);
+			tmp_htcap_len = min(info_element->len,(u8)MAX_IE_LEN);
+			if(tmp_htcap_len != 0){
+				network->bssht.bdHTSpecVer = HT_SPEC_VER_EWC;
+				network->bssht.bdHTCapLen = tmp_htcap_len > sizeof(network->bssht.bdHTCapBuf)?\
+					sizeof(network->bssht.bdHTCapBuf):tmp_htcap_len;
+				memcpy(network->bssht.bdHTCapBuf,info_element->data,network->bssht.bdHTCapLen);
+
+				//If peer is HT, but not WMM, call QosSetLegacyWMMParamWithHT()
+				// windows driver will update WMM parameters each beacon received once connected
+                                // Linux driver is a bit different.
+				network->bssht.bdSupportHT = true;
+			}
+			else
+				network->bssht.bdSupportHT = false;
+			break;
+
+
+		case MFIE_TYPE_HT_INFO:
+			IEEE80211_DEBUG_SCAN("MFIE_TYPE_HT_INFO: %d bytes\n",
+					     info_element->len);
+			tmp_htinfo_len = min(info_element->len,(u8)MAX_IE_LEN);
+			if(tmp_htinfo_len){
+				network->bssht.bdHTSpecVer = HT_SPEC_VER_IEEE;
+				network->bssht.bdHTInfoLen = tmp_htinfo_len > sizeof(network->bssht.bdHTInfoBuf)?\
+					sizeof(network->bssht.bdHTInfoBuf):tmp_htinfo_len;
+				memcpy(network->bssht.bdHTInfoBuf,info_element->data,network->bssht.bdHTInfoLen);
+			}
+			break;
+
+		case MFIE_TYPE_AIRONET:
+			IEEE80211_DEBUG_SCAN("MFIE_TYPE_AIRONET: %d bytes\n",
+					     info_element->len);
+			if(info_element->len >IE_CISCO_FLAG_POSITION)
+			{
+				network->bWithAironetIE = true;
+
+				// CCX 1 spec v1.13, A01.1 CKIP Negotiation (page23):
+				// "A Cisco access point advertises support for CKIP in beacon and probe response packets,
+				//  by adding an Aironet element and setting one or both of the CKIP negotiation bits."
+				if(	(info_element->data[IE_CISCO_FLAG_POSITION]&SUPPORT_CKIP_MIC)	||
+					(info_element->data[IE_CISCO_FLAG_POSITION]&SUPPORT_CKIP_PK)	)
+				{
+		 			network->bCkipSupported = true;
+				}
+				else
+				{
+					network->bCkipSupported = false;
+				}
+			}
+			else
+			{
+				network->bWithAironetIE = false;
+		 		network->bCkipSupported = false;
+			}
+			break;
+		case MFIE_TYPE_QOS_PARAMETER:
+			printk(KERN_ERR
+			       "QoS Error need to parse QOS_PARAMETER IE\n");
+			break;
+
+#ifdef ENABLE_DOT11D
+		case MFIE_TYPE_COUNTRY:
+			IEEE80211_DEBUG_SCAN("MFIE_TYPE_COUNTRY: %d bytes\n",
+					     info_element->len);
+			//printk("=====>Receive <%s> Country IE\n",network->ssid);
+			ieee80211_extract_country_ie(ieee, info_element, network, network->bssid);//addr2 is same as addr3 when from an AP
+			break;
+#endif
+/* TODO */
+		default:
+			IEEE80211_DEBUG_MGMT
+			    ("Unsupported info element: %s (%d)\n",
+			     get_info_element_string(info_element->id),
+			     info_element->id);
+			break;
+		}
+
+		length -= sizeof(*info_element) + info_element->len;
+		info_element =
+		    (struct ieee80211_info_element *)&info_element->
+		    data[info_element->len];
+	}
+
+	if(!network->atheros_cap_exist && !network->broadcom_cap_exist &&
+		!network->cisco_cap_exist && !network->ralink_cap_exist && !network->bssht.bdRT2RTAggregation)
+	{
+		network->unknown_cap_exist = true;
+	}
+	else
+	{
+		network->unknown_cap_exist = false;
+	}
+	return 0;
+}
+
+static inline u8 ieee80211_SignalStrengthTranslate(
+	u8  CurrSS
+	)
+{
+	u8 RetSS;
+
+	// Step 1. Scale mapping.
+	if(CurrSS >= 71 && CurrSS <= 100)
+	{
+		RetSS = 90 + ((CurrSS - 70) / 3);
+	}
+	else if(CurrSS >= 41 && CurrSS <= 70)
+	{
+		RetSS = 78 + ((CurrSS - 40) / 3);
+	}
+	else if(CurrSS >= 31 && CurrSS <= 40)
+	{
+		RetSS = 66 + (CurrSS - 30);
+	}
+	else if(CurrSS >= 21 && CurrSS <= 30)
+	{
+		RetSS = 54 + (CurrSS - 20);
+	}
+	else if(CurrSS >= 5 && CurrSS <= 20)
+	{
+		RetSS = 42 + (((CurrSS - 5) * 2) / 3);
+	}
+	else if(CurrSS == 4)
+	{
+		RetSS = 36;
+	}
+	else if(CurrSS == 3)
+	{
+		RetSS = 27;
+	}
+	else if(CurrSS == 2)
+	{
+		RetSS = 18;
+	}
+	else if(CurrSS == 1)
+	{
+		RetSS = 9;
+	}
+	else
+	{
+		RetSS = CurrSS;
+	}
+	//RT_TRACE(COMP_DBG, DBG_LOUD, ("##### After Mapping:  LastSS: %d, CurrSS: %d, RetSS: %d\n", LastSS, CurrSS, RetSS));
+
+	// Step 2. Smoothing.
+
+	//RT_TRACE(COMP_DBG, DBG_LOUD, ("$$$$$ After Smoothing:  LastSS: %d, CurrSS: %d, RetSS: %d\n", LastSS, CurrSS, RetSS));
+
+	return RetSS;
+}
+
+long ieee80211_translate_todbm(u8 signal_strength_index	)// 0-100 index.
+{
+	long	signal_power; // in dBm.
+
+	// Translate to dBm (x=0.5y-95).
+	signal_power = (long)((signal_strength_index + 1) >> 1);
+	signal_power -= 95;
+
+	return signal_power;
+}
+
+static inline int ieee80211_network_init(
+	struct ieee80211_device *ieee,
+	struct ieee80211_probe_response *beacon,
+	struct ieee80211_network *network,
+	struct ieee80211_rx_stats *stats)
+{
+#ifdef CONFIG_IEEE80211_DEBUG
+	//char rates_str[64];
+	//char *p;
+#endif
+
+        network->qos_data.active = 0;
+        network->qos_data.supported = 0;
+        network->qos_data.param_count = 0;
+        network->qos_data.old_param_count = 0;
+
+	/* Pull out fixed field data */
+	memcpy(network->bssid, beacon->header.addr3, ETH_ALEN);
+	network->capability = le16_to_cpu(beacon->capability);
+	network->last_scanned = jiffies;
+	network->time_stamp[0] = le32_to_cpu(beacon->time_stamp[0]);
+	network->time_stamp[1] = le32_to_cpu(beacon->time_stamp[1]);
+	network->beacon_interval = le32_to_cpu(beacon->beacon_interval);
+	/* Where to pull this? beacon->listen_interval;*/
+	network->listen_interval = 0x0A;
+	network->rates_len = network->rates_ex_len = 0;
+	network->last_associate = 0;
+	network->ssid_len = 0;
+	network->flags = 0;
+	network->atim_window = 0;
+	network->erp_value = (network->capability & WLAN_CAPABILITY_IBSS) ?
+            0x3 : 0x0;
+	network->berp_info_valid = false;
+        network->broadcom_cap_exist = false;
+	network->ralink_cap_exist = false;
+	network->atheros_cap_exist = false;
+	network->cisco_cap_exist = false;
+	network->unknown_cap_exist = false;
+#ifdef THOMAS_TURBO
+	network->Turbo_Enable = 0;
+#endif
+#ifdef ENABLE_DOT11D
+	network->CountryIeLen = 0;
+	memset(network->CountryIeBuf, 0, MAX_IE_LEN);
+#endif
+//Initialize HT parameters
+	//ieee80211_ht_initialize(&network->bssht);
+	HTInitializeBssDesc(&network->bssht);
+	if (stats->freq == IEEE80211_52GHZ_BAND) {
+		/* for A band (No DS info) */
+		network->channel = stats->received_channel;
+	} else
+		network->flags |= NETWORK_HAS_CCK;
+
+ 	network->wpa_ie_len = 0;
+ 	network->rsn_ie_len = 0;
+
+        if (ieee80211_parse_info_param
+            (ieee,beacon->info_element, stats->len - sizeof(*beacon), network, stats))
+                return 1;
+
+	network->mode = 0;
+	if (stats->freq == IEEE80211_52GHZ_BAND)
+		network->mode = IEEE_A;
+	else {
+		if (network->flags & NETWORK_HAS_OFDM)
+			network->mode |= IEEE_G;
+		if (network->flags & NETWORK_HAS_CCK)
+			network->mode |= IEEE_B;
+	}
+
+	if (network->mode == 0) {
+		IEEE80211_DEBUG_SCAN("Filtered out '%s (" MAC_FMT ")' "
+				     "network.\n",
+				     escape_essid(network->ssid,
+						  network->ssid_len),
+				     MAC_ARG(network->bssid));
+		return 1;
+	}
+
+	if(network->bssht.bdSupportHT){
+		if(network->mode == IEEE_A)
+			network->mode = IEEE_N_5G;
+		else if(network->mode & (IEEE_G | IEEE_B))
+			network->mode = IEEE_N_24G;
+	}
+	if (ieee80211_is_empty_essid(network->ssid, network->ssid_len))
+		network->flags |= NETWORK_EMPTY_ESSID;
+
+	stats->signal = 30 + (stats->SignalStrength * 70) / 100;
+	//stats->signal = ieee80211_SignalStrengthTranslate(stats->signal);
+	stats->noise = ieee80211_translate_todbm((u8)(100-stats->signal)) -25;
+
+	memcpy(&network->stats, stats, sizeof(network->stats));
+
+	return 0;
+}
+
+static inline int is_same_network(struct ieee80211_network *src,
+				  struct ieee80211_network *dst, struct ieee80211_device* ieee)
+{
+	/* A network is only a duplicate if the channel, BSSID, ESSID
+	 * and the capability field (in particular IBSS and BSS) all match.
+	 * We treat all <hidden> with the same BSSID and channel
+	 * as one network */
+	return //((src->ssid_len == dst->ssid_len) &&
+		(((src->ssid_len == dst->ssid_len) || (ieee->iw_mode == IW_MODE_INFRA)) &&
+		(src->channel == dst->channel) &&
+		!memcmp(src->bssid, dst->bssid, ETH_ALEN) &&
+		//!memcmp(src->ssid, dst->ssid, src->ssid_len) &&
+		(!memcmp(src->ssid, dst->ssid, src->ssid_len) || (ieee->iw_mode == IW_MODE_INFRA)) &&
+		((src->capability & WLAN_CAPABILITY_IBSS) ==
+		(dst->capability & WLAN_CAPABILITY_IBSS)) &&
+		((src->capability & WLAN_CAPABILITY_BSS) ==
+		(dst->capability & WLAN_CAPABILITY_BSS)));
+}
+
+static inline void update_network(struct ieee80211_network *dst,
+				  struct ieee80211_network *src)
+{
+	int qos_active;
+	u8 old_param;
+
+	memcpy(&dst->stats, &src->stats, sizeof(struct ieee80211_rx_stats));
+	dst->capability = src->capability;
+	memcpy(dst->rates, src->rates, src->rates_len);
+	dst->rates_len = src->rates_len;
+	memcpy(dst->rates_ex, src->rates_ex, src->rates_ex_len);
+	dst->rates_ex_len = src->rates_ex_len;
+	if(src->ssid_len > 0)
+	{
+		memset(dst->ssid, 0, dst->ssid_len);
+		dst->ssid_len = src->ssid_len;
+		memcpy(dst->ssid, src->ssid, src->ssid_len);
+	}
+	dst->mode = src->mode;
+	dst->flags = src->flags;
+	dst->time_stamp[0] = src->time_stamp[0];
+	dst->time_stamp[1] = src->time_stamp[1];
+	if (src->flags & NETWORK_HAS_ERP_VALUE)
+	{
+		dst->erp_value = src->erp_value;
+		dst->berp_info_valid = src->berp_info_valid = true;
+	}
+	dst->beacon_interval = src->beacon_interval;
+	dst->listen_interval = src->listen_interval;
+	dst->atim_window = src->atim_window;
+	dst->dtim_period = src->dtim_period;
+	dst->dtim_data = src->dtim_data;
+	dst->last_dtim_sta_time[0] = src->last_dtim_sta_time[0];
+	dst->last_dtim_sta_time[1] = src->last_dtim_sta_time[1];
+	memcpy(&dst->tim, &src->tim, sizeof(struct ieee80211_tim_parameters));
+
+        dst->bssht.bdSupportHT = src->bssht.bdSupportHT;
+	dst->bssht.bdRT2RTAggregation = src->bssht.bdRT2RTAggregation;
+	dst->bssht.bdHTCapLen= src->bssht.bdHTCapLen;
+	memcpy(dst->bssht.bdHTCapBuf,src->bssht.bdHTCapBuf,src->bssht.bdHTCapLen);
+	dst->bssht.bdHTInfoLen= src->bssht.bdHTInfoLen;
+	memcpy(dst->bssht.bdHTInfoBuf,src->bssht.bdHTInfoBuf,src->bssht.bdHTInfoLen);
+	dst->bssht.bdHTSpecVer = src->bssht.bdHTSpecVer;
+	dst->bssht.bdRT2RTLongSlotTime = src->bssht.bdRT2RTLongSlotTime;
+	dst->broadcom_cap_exist = src->broadcom_cap_exist;
+	dst->ralink_cap_exist = src->ralink_cap_exist;
+	dst->atheros_cap_exist = src->atheros_cap_exist;
+	dst->cisco_cap_exist = src->cisco_cap_exist;
+	dst->unknown_cap_exist = src->unknown_cap_exist;
+	memcpy(dst->wpa_ie, src->wpa_ie, src->wpa_ie_len);
+	dst->wpa_ie_len = src->wpa_ie_len;
+	memcpy(dst->rsn_ie, src->rsn_ie, src->rsn_ie_len);
+	dst->rsn_ie_len = src->rsn_ie_len;
+
+	dst->last_scanned = jiffies;
+	/* qos related parameters */
+	//qos_active = src->qos_data.active;
+	qos_active = dst->qos_data.active;
+	//old_param = dst->qos_data.old_param_count;
+	old_param = dst->qos_data.param_count;
+	if(dst->flags & NETWORK_HAS_QOS_MASK)
+		memcpy(&dst->qos_data, &src->qos_data,
+			sizeof(struct ieee80211_qos_data));
+	else {
+		dst->qos_data.supported = src->qos_data.supported;
+		dst->qos_data.param_count = src->qos_data.param_count;
+	}
+
+	if(dst->qos_data.supported == 1) {
+		dst->QoS_Enable = 1;
+		if(dst->ssid_len)
+			IEEE80211_DEBUG_QOS
+				("QoS the network %s is QoS supported\n",
+				dst->ssid);
+		else
+			IEEE80211_DEBUG_QOS
+				("QoS the network is QoS supported\n");
+	}
+	dst->qos_data.active = qos_active;
+	dst->qos_data.old_param_count = old_param;
+
+	/* dst->last_associate is not overwritten */
+	dst->wmm_info = src->wmm_info; //sure to exist in beacon or probe response frame.
+	if(src->wmm_param[0].ac_aci_acm_aifsn|| \
+	   src->wmm_param[1].ac_aci_acm_aifsn|| \
+	   src->wmm_param[2].ac_aci_acm_aifsn|| \
+	   src->wmm_param[1].ac_aci_acm_aifsn) {
+	  memcpy(dst->wmm_param, src->wmm_param, WME_AC_PRAM_LEN);
+	}
+	//dst->QoS_Enable = src->QoS_Enable;
+#ifdef THOMAS_TURBO
+	dst->Turbo_Enable = src->Turbo_Enable;
+#endif
+
+#ifdef ENABLE_DOT11D
+	dst->CountryIeLen = src->CountryIeLen;
+	memcpy(dst->CountryIeBuf, src->CountryIeBuf, src->CountryIeLen);
+#endif
+
+	//added by amy for LEAP
+	dst->bWithAironetIE = src->bWithAironetIE;
+	dst->bCkipSupported = src->bCkipSupported;
+	memcpy(dst->CcxRmState,src->CcxRmState,2);
+	dst->bCcxRmEnable = src->bCcxRmEnable;
+	dst->MBssidMask = src->MBssidMask;
+	dst->bMBssidValid = src->bMBssidValid;
+	memcpy(dst->MBssid,src->MBssid,6);
+	dst->bWithCcxVerNum = src->bWithCcxVerNum;
+	dst->BssCcxVerNumber = src->BssCcxVerNumber;
+
+}
+
+static inline int is_beacon(__le16 fc)
+{
+	return (WLAN_FC_GET_STYPE(le16_to_cpu(fc)) == IEEE80211_STYPE_BEACON);
+}
+
+static inline void ieee80211_process_probe_response(
+	struct ieee80211_device *ieee,
+	struct ieee80211_probe_response *beacon,
+	struct ieee80211_rx_stats *stats)
+{
+	struct ieee80211_network network;
+	struct ieee80211_network *target;
+	struct ieee80211_network *oldest = NULL;
+#ifdef CONFIG_IEEE80211_DEBUG
+	struct ieee80211_info_element *info_element = &beacon->info_element[0];
+#endif
+	unsigned long flags;
+	short renew;
+	//u8 wmm_info;
+
+	memset(&network, 0, sizeof(struct ieee80211_network));
+	IEEE80211_DEBUG_SCAN(
+		"'%s' (" MAC_FMT "): %c%c%c%c %c%c%c%c-%c%c%c%c %c%c%c%c\n",
+		escape_essid(info_element->data, info_element->len),
+		MAC_ARG(beacon->header.addr3),
+		(beacon->capability & (1<<0xf)) ? '1' : '0',
+		(beacon->capability & (1<<0xe)) ? '1' : '0',
+		(beacon->capability & (1<<0xd)) ? '1' : '0',
+		(beacon->capability & (1<<0xc)) ? '1' : '0',
+		(beacon->capability & (1<<0xb)) ? '1' : '0',
+		(beacon->capability & (1<<0xa)) ? '1' : '0',
+		(beacon->capability & (1<<0x9)) ? '1' : '0',
+		(beacon->capability & (1<<0x8)) ? '1' : '0',
+		(beacon->capability & (1<<0x7)) ? '1' : '0',
+		(beacon->capability & (1<<0x6)) ? '1' : '0',
+		(beacon->capability & (1<<0x5)) ? '1' : '0',
+		(beacon->capability & (1<<0x4)) ? '1' : '0',
+		(beacon->capability & (1<<0x3)) ? '1' : '0',
+		(beacon->capability & (1<<0x2)) ? '1' : '0',
+		(beacon->capability & (1<<0x1)) ? '1' : '0',
+		(beacon->capability & (1<<0x0)) ? '1' : '0');
+
+	if (ieee80211_network_init(ieee, beacon, &network, stats)) {
+		IEEE80211_DEBUG_SCAN("Dropped '%s' (" MAC_FMT ") via %s.\n",
+				     escape_essid(info_element->data,
+						  info_element->len),
+				     MAC_ARG(beacon->header.addr3),
+				     WLAN_FC_GET_STYPE(beacon->header.frame_ctl) ==
+				     IEEE80211_STYPE_PROBE_RESP ?
+				     "PROBE RESPONSE" : "BEACON");
+		return;
+	}
+
+#ifdef ENABLE_DOT11D
+	// For Asus EeePc request,
+	// (1) if wireless adapter receive get any 802.11d country code in AP beacon,
+	//	   wireless adapter should follow the country code.
+	// (2)  If there is no any country code in beacon,
+	//       then wireless adapter should do active scan from ch1~11 and
+	//       passive scan from ch12~14
+
+	if( !IsLegalChannel(ieee, network.channel) )
+		return;
+	if(ieee->bGlobalDomain)
+	{
+		if (WLAN_FC_GET_STYPE(beacon->header.frame_ctl) == IEEE80211_STYPE_PROBE_RESP)
+		{
+			// Case 1: Country code
+			if(IS_COUNTRY_IE_VALID(ieee) )
+			{
+				if( !IsLegalChannel(ieee, network.channel) )
+				{
+					printk("GetScanInfo(): For Country code, filter probe response at channel(%d).\n", network.channel);
+					return;
+				}
+			}
+			// Case 2: No any country code.
+			else
+			{
+				// Filter over channel ch12~14
+				if(network.channel > 11)
+				{
+					printk("GetScanInfo(): For Global Domain, filter probe response at channel(%d).\n", network.channel);
+					return;
+				}
+			}
+		}
+		else
+		{
+			// Case 1: Country code
+			if(IS_COUNTRY_IE_VALID(ieee) )
+			{
+				if( !IsLegalChannel(ieee, network.channel) )
+				{
+					printk("GetScanInfo(): For Country code, filter beacon at channel(%d).\n",network.channel);
+					return;
+				}
+			}
+			// Case 2: No any country code.
+			else
+			{
+				// Filter over channel ch12~14
+				if(network.channel > 14)
+				{
+					printk("GetScanInfo(): For Global Domain, filter beacon at channel(%d).\n",network.channel);
+					return;
+				}
+			}
+		}
+	}
+#endif
+
+	/* The network parsed correctly -- so now we scan our known networks
+	 * to see if we can find it in our list.
+	 *
+	 * NOTE:  This search is definitely not optimized.  Once its doing
+	 *        the "right thing" we'll optimize it for efficiency if
+	 *        necessary */
+
+	/* Search for this entry in the list and update it if it is
+	 * already there. */
+
+	spin_lock_irqsave(&ieee->lock, flags);
+
+	if(is_same_network(&ieee->current_network, &network, ieee)) {
+		update_network(&ieee->current_network, &network);
+		if((ieee->current_network.mode == IEEE_N_24G || ieee->current_network.mode == IEEE_G)
+		&& ieee->current_network.berp_info_valid){
+		if(ieee->current_network.erp_value& ERP_UseProtection)
+			ieee->current_network.buseprotection = true;
+		else
+			ieee->current_network.buseprotection = false;
+		}
+		if(is_beacon(beacon->header.frame_ctl))
+		{
+			if(ieee->state == IEEE80211_LINKED)
+				ieee->LinkDetectInfo.NumRecvBcnInPeriod++;
+		}
+		else //hidden AP
+			network.flags = (~NETWORK_EMPTY_ESSID & network.flags)|(NETWORK_EMPTY_ESSID & ieee->current_network.flags);
+	}
+
+	list_for_each_entry(target, &ieee->network_list, list) {
+		if (is_same_network(target, &network, ieee))
+			break;
+		if ((oldest == NULL) ||
+		    (target->last_scanned < oldest->last_scanned))
+			oldest = target;
+	}
+
+	/* If we didn't find a match, then get a new network slot to initialize
+	 * with this beacon's information */
+	if (&target->list == &ieee->network_list) {
+		if (list_empty(&ieee->network_free_list)) {
+			/* If there are no more slots, expire the oldest */
+			list_del(&oldest->list);
+			target = oldest;
+			IEEE80211_DEBUG_SCAN("Expired '%s' (" MAC_FMT ") from "
+					     "network list.\n",
+					     escape_essid(target->ssid,
+							  target->ssid_len),
+					     MAC_ARG(target->bssid));
+		} else {
+			/* Otherwise just pull from the free list */
+			target = list_entry(ieee->network_free_list.next,
+					    struct ieee80211_network, list);
+			list_del(ieee->network_free_list.next);
+		}
+
+
+#ifdef CONFIG_IEEE80211_DEBUG
+		IEEE80211_DEBUG_SCAN("Adding '%s' (" MAC_FMT ") via %s.\n",
+				     escape_essid(network.ssid,
+						  network.ssid_len),
+				     MAC_ARG(network.bssid),
+				     WLAN_FC_GET_STYPE(beacon->header.frame_ctl) ==
+				     IEEE80211_STYPE_PROBE_RESP ?
+				     "PROBE RESPONSE" : "BEACON");
+#endif
+		memcpy(target, &network, sizeof(*target));
+		list_add_tail(&target->list, &ieee->network_list);
+		if(ieee->softmac_features & IEEE_SOFTMAC_ASSOCIATE)
+			ieee80211_softmac_new_net(ieee,&network);
+	} else {
+		IEEE80211_DEBUG_SCAN("Updating '%s' (" MAC_FMT ") via %s.\n",
+				     escape_essid(target->ssid,
+						  target->ssid_len),
+				     MAC_ARG(target->bssid),
+				     WLAN_FC_GET_STYPE(beacon->header.frame_ctl) ==
+				     IEEE80211_STYPE_PROBE_RESP ?
+				     "PROBE RESPONSE" : "BEACON");
+
+		/* we have an entry and we are going to update it. But this entry may
+		 * be already expired. In this case we do the same as we found a new
+		 * net and call the new_net handler
+		 */
+		renew = !time_after(target->last_scanned + ieee->scan_age, jiffies);
+		//YJ,add,080819,for hidden ap
+		if(is_beacon(beacon->header.frame_ctl) == 0)
+			network.flags = (~NETWORK_EMPTY_ESSID & network.flags)|(NETWORK_EMPTY_ESSID & target->flags);
+		//if(strncmp(network.ssid, "linksys-c",9) == 0)
+		//	printk("====>2 network.ssid=%s FLAG=%d target.ssid=%s FLAG=%d\n", network.ssid, network.flags, target->ssid, target->flags);
+		if(((network.flags & NETWORK_EMPTY_ESSID) == NETWORK_EMPTY_ESSID) \
+		    && (((network.ssid_len > 0) && (strncmp(target->ssid, network.ssid, network.ssid_len)))\
+		    ||((ieee->current_network.ssid_len == network.ssid_len)&&(strncmp(ieee->current_network.ssid, network.ssid, network.ssid_len) == 0)&&(ieee->state == IEEE80211_NOLINK))))
+			renew = 1;
+		//YJ,add,080819,for hidden ap,end
+
+		update_network(target, &network);
+		if(renew && (ieee->softmac_features & IEEE_SOFTMAC_ASSOCIATE))
+			ieee80211_softmac_new_net(ieee,&network);
+	}
+
+	spin_unlock_irqrestore(&ieee->lock, flags);
+	if (is_beacon(beacon->header.frame_ctl)&&is_same_network(&ieee->current_network, &network, ieee)&&\
+		(ieee->state == IEEE80211_LINKED)) {
+		if(ieee->handle_beacon != NULL) {
+			ieee->handle_beacon(ieee->dev,beacon,&ieee->current_network);
+		}
+	}
+}
+
+void ieee80211_rx_mgt(struct ieee80211_device *ieee,
+		      struct ieee80211_hdr_4addr *header,
+		      struct ieee80211_rx_stats *stats)
+{
+	switch (WLAN_FC_GET_STYPE(header->frame_ctl)) {
+
+	case IEEE80211_STYPE_BEACON:
+		IEEE80211_DEBUG_MGMT("received BEACON (%d)\n",
+				     WLAN_FC_GET_STYPE(header->frame_ctl));
+		IEEE80211_DEBUG_SCAN("Beacon\n");
+		ieee80211_process_probe_response(
+			ieee, (struct ieee80211_probe_response *)header, stats);
+		break;
+
+	case IEEE80211_STYPE_PROBE_RESP:
+		IEEE80211_DEBUG_MGMT("received PROBE RESPONSE (%d)\n",
+				     WLAN_FC_GET_STYPE(header->frame_ctl));
+		IEEE80211_DEBUG_SCAN("Probe response\n");
+		ieee80211_process_probe_response(
+			ieee, (struct ieee80211_probe_response *)header, stats);
+		break;
+
+	}
+}
+
+EXPORT_SYMBOL(ieee80211_rx_mgt);
+EXPORT_SYMBOL(ieee80211_rx);
diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c b/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c
new file mode 100644
index 000000000000..8a86e93465c8
--- /dev/null
+++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c
@@ -0,0 +1,3287 @@
+/* IEEE 802.11 SoftMAC layer
+ * Copyright (c) 2005 Andrea Merello <andreamrl@tiscali.it>
+ *
+ * Mostly extracted from the rtl8180-sa2400 driver for the
+ * in-kernel generic ieee802.11 stack.
+ *
+ * Few lines might be stolen from other part of the ieee80211
+ * stack. Copyright who own it's copyright
+ *
+ * WPA code stolen from the ipw2200 driver.
+ * Copyright who own it's copyright.
+ *
+ * released under the GPL
+ */
+
+
+#include "ieee80211.h"
+
+#include <linux/random.h>
+#include <linux/delay.h>
+#include <linux/version.h>
+#include <asm/uaccess.h>
+#ifdef ENABLE_DOT11D
+#include "dot11d.h"
+#endif
+
+u8 rsn_authen_cipher_suite[16][4] = {
+	{0x00,0x0F,0xAC,0x00}, //Use group key, //Reserved
+	{0x00,0x0F,0xAC,0x01}, //WEP-40         //RSNA default
+	{0x00,0x0F,0xAC,0x02}, //TKIP           //NONE		//{used just as default}
+	{0x00,0x0F,0xAC,0x03}, //WRAP-historical
+	{0x00,0x0F,0xAC,0x04}, //CCMP
+	{0x00,0x0F,0xAC,0x05}, //WEP-104
+};
+
+short ieee80211_is_54g(struct ieee80211_network net)
+{
+	return ((net.rates_ex_len > 0) || (net.rates_len > 4));
+}
+
+short ieee80211_is_shortslot(struct ieee80211_network net)
+{
+	return (net.capability & WLAN_CAPABILITY_SHORT_SLOT);
+}
+
+/* returns the total length needed for pleacing the RATE MFIE
+ * tag and the EXTENDED RATE MFIE tag if needed.
+ * It encludes two bytes per tag for the tag itself and its len
+ */
+unsigned int ieee80211_MFIE_rate_len(struct ieee80211_device *ieee)
+{
+	unsigned int rate_len = 0;
+
+	if (ieee->modulation & IEEE80211_CCK_MODULATION)
+		rate_len = IEEE80211_CCK_RATE_LEN + 2;
+
+	if (ieee->modulation & IEEE80211_OFDM_MODULATION)
+
+		rate_len += IEEE80211_OFDM_RATE_LEN + 2;
+
+	return rate_len;
+}
+
+/* pleace the MFIE rate, tag to the memory (double) poined.
+ * Then it updates the pointer so that
+ * it points after the new MFIE tag added.
+ */
+void ieee80211_MFIE_Brate(struct ieee80211_device *ieee, u8 **tag_p)
+{
+	u8 *tag = *tag_p;
+
+	if (ieee->modulation & IEEE80211_CCK_MODULATION){
+		*tag++ = MFIE_TYPE_RATES;
+		*tag++ = 4;
+		*tag++ = IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_1MB;
+		*tag++ = IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_2MB;
+		*tag++ = IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_5MB;
+		*tag++ = IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_11MB;
+	}
+
+	/* We may add an option for custom rates that specific HW might support */
+	*tag_p = tag;
+}
+
+void ieee80211_MFIE_Grate(struct ieee80211_device *ieee, u8 **tag_p)
+{
+	u8 *tag = *tag_p;
+
+		if (ieee->modulation & IEEE80211_OFDM_MODULATION){
+
+		*tag++ = MFIE_TYPE_RATES_EX;
+		*tag++ = 8;
+		*tag++ = IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_6MB;
+		*tag++ = IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_9MB;
+		*tag++ = IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_12MB;
+		*tag++ = IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_18MB;
+		*tag++ = IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_24MB;
+		*tag++ = IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_36MB;
+		*tag++ = IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_48MB;
+		*tag++ = IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_54MB;
+
+	}
+
+	/* We may add an option for custom rates that specific HW might support */
+	*tag_p = tag;
+}
+
+
+void ieee80211_WMM_Info(struct ieee80211_device *ieee, u8 **tag_p) {
+	u8 *tag = *tag_p;
+
+	*tag++ = MFIE_TYPE_GENERIC; //0
+	*tag++ = 7;
+	*tag++ = 0x00;
+	*tag++ = 0x50;
+	*tag++ = 0xf2;
+	*tag++ = 0x02;//5
+	*tag++ = 0x00;
+	*tag++ = 0x01;
+#ifdef SUPPORT_USPD
+	if(ieee->current_network.wmm_info & 0x80) {
+		*tag++ = 0x0f|MAX_SP_Len;
+	} else {
+		*tag++ = MAX_SP_Len;
+	}
+#else
+	*tag++ = MAX_SP_Len;
+#endif
+	*tag_p = tag;
+}
+
+#ifdef THOMAS_TURBO
+void ieee80211_TURBO_Info(struct ieee80211_device *ieee, u8 **tag_p) {
+	u8 *tag = *tag_p;
+
+	*tag++ = MFIE_TYPE_GENERIC; //0
+	*tag++ = 7;
+	*tag++ = 0x00;
+	*tag++ = 0xe0;
+	*tag++ = 0x4c;
+	*tag++ = 0x01;//5
+	*tag++ = 0x02;
+	*tag++ = 0x11;
+	*tag++ = 0x00;
+
+	*tag_p = tag;
+	printk(KERN_ALERT "This is enable turbo mode IE process\n");
+}
+#endif
+
+void enqueue_mgmt(struct ieee80211_device *ieee, struct sk_buff *skb)
+{
+	int nh;
+	nh = (ieee->mgmt_queue_head +1) % MGMT_QUEUE_NUM;
+
+/*
+ * if the queue is full but we have newer frames then
+ * just overwrites the oldest.
+ *
+ * if (nh == ieee->mgmt_queue_tail)
+ *		return -1;
+ */
+	ieee->mgmt_queue_head = nh;
+	ieee->mgmt_queue_ring[nh] = skb;
+
+	//return 0;
+}
+
+struct sk_buff *dequeue_mgmt(struct ieee80211_device *ieee)
+{
+	struct sk_buff *ret;
+
+	if(ieee->mgmt_queue_tail == ieee->mgmt_queue_head)
+		return NULL;
+
+	ret = ieee->mgmt_queue_ring[ieee->mgmt_queue_tail];
+
+	ieee->mgmt_queue_tail =
+		(ieee->mgmt_queue_tail+1) % MGMT_QUEUE_NUM;
+
+	return ret;
+}
+
+void init_mgmt_queue(struct ieee80211_device *ieee)
+{
+	ieee->mgmt_queue_tail = ieee->mgmt_queue_head = 0;
+}
+
+u8 MgntQuery_MgntFrameTxRate(struct ieee80211_device *ieee)
+{
+	PRT_HIGH_THROUGHPUT      pHTInfo = ieee->pHTInfo;
+	u8 rate;
+
+	// 2008/01/25 MH For broadcom, MGNT frame set as OFDM 6M.
+	if(pHTInfo->IOTAction & HT_IOT_ACT_MGNT_USE_CCK_6M)
+		rate = 0x0c;
+	else
+		rate = ieee->basic_rate & 0x7f;
+
+	if(rate == 0){
+		// 2005.01.26, by rcnjko.
+		if(ieee->mode == IEEE_A||
+		   ieee->mode== IEEE_N_5G||
+		   (ieee->mode== IEEE_N_24G&&!pHTInfo->bCurSuppCCK))
+			rate = 0x0c;
+		else
+			rate = 0x02;
+	}
+
+	/*
+	// Data rate of ProbeReq is already decided. Annie, 2005-03-31
+	if( pMgntInfo->bScanInProgress || (pMgntInfo->bDualModeScanStep!=0) )
+	{
+	if(pMgntInfo->dot11CurrentWirelessMode==WIRELESS_MODE_A)
+	rate = 0x0c;
+	else
+	rate = 0x02;
+	}
+	 */
+	return rate;
+}
+
+
+void ieee80211_sta_wakeup(struct ieee80211_device *ieee, short nl);
+
+inline void softmac_mgmt_xmit(struct sk_buff *skb, struct ieee80211_device *ieee)
+{
+	unsigned long flags;
+	short single = ieee->softmac_features & IEEE_SOFTMAC_SINGLE_QUEUE;
+	struct ieee80211_hdr_3addr  *header=
+		(struct ieee80211_hdr_3addr  *) skb->data;
+
+	cb_desc *tcb_desc = (cb_desc *)(skb->cb + 8);
+	spin_lock_irqsave(&ieee->lock, flags);
+
+	/* called with 2nd param 0, no mgmt lock required */
+	ieee80211_sta_wakeup(ieee,0);
+
+	tcb_desc->queue_index = MGNT_QUEUE;
+	tcb_desc->data_rate = MgntQuery_MgntFrameTxRate(ieee);
+	tcb_desc->RATRIndex = 7;
+	tcb_desc->bTxDisableRateFallBack = 1;
+	tcb_desc->bTxUseDriverAssingedRate = 1;
+
+	if(single){
+		if(ieee->queue_stop){
+			enqueue_mgmt(ieee,skb);
+		}else{
+			header->seq_ctl = cpu_to_le16(ieee->seq_ctrl[0]<<4);
+
+			if (ieee->seq_ctrl[0] == 0xFFF)
+				ieee->seq_ctrl[0] = 0;
+			else
+				ieee->seq_ctrl[0]++;
+
+			/* avoid watchdog triggers */
+			ieee->dev->trans_start = jiffies;
+			ieee->softmac_data_hard_start_xmit(skb,ieee->dev,ieee->basic_rate);
+			//dev_kfree_skb_any(skb);//edit by thomas
+		}
+
+		spin_unlock_irqrestore(&ieee->lock, flags);
+	}else{
+		spin_unlock_irqrestore(&ieee->lock, flags);
+		spin_lock_irqsave(&ieee->mgmt_tx_lock, flags);
+
+		header->seq_ctl = cpu_to_le16(ieee->seq_ctrl[0] << 4);
+
+		if (ieee->seq_ctrl[0] == 0xFFF)
+			ieee->seq_ctrl[0] = 0;
+		else
+			ieee->seq_ctrl[0]++;
+
+		/* check wether the managed packet queued greater than 5 */
+		if(!ieee->check_nic_enough_desc(ieee->dev,tcb_desc->queue_index)||\
+				(skb_queue_len(&ieee->skb_waitQ[tcb_desc->queue_index]) != 0)||\
+				(ieee->queue_stop) ) {
+			/* insert the skb packet to the management queue */
+			/* as for the completion function, it does not need
+			 * to check it any more.
+			 * */
+			printk("%s():insert to waitqueue!\n",__FUNCTION__);
+			skb_queue_tail(&ieee->skb_waitQ[tcb_desc->queue_index], skb);
+		} else {
+			//printk("TX packet!\n");
+			ieee->softmac_hard_start_xmit(skb,ieee->dev);
+			//dev_kfree_skb_any(skb);//edit by thomas
+		}
+		spin_unlock_irqrestore(&ieee->mgmt_tx_lock, flags);
+	}
+}
+
+inline void softmac_ps_mgmt_xmit(struct sk_buff *skb, struct ieee80211_device *ieee)
+{
+
+	short single = ieee->softmac_features & IEEE_SOFTMAC_SINGLE_QUEUE;
+	struct ieee80211_hdr_3addr  *header =
+		(struct ieee80211_hdr_3addr  *) skb->data;
+
+
+	if(single){
+
+		header->seq_ctl = cpu_to_le16(ieee->seq_ctrl[0] << 4);
+
+		if (ieee->seq_ctrl[0] == 0xFFF)
+			ieee->seq_ctrl[0] = 0;
+		else
+			ieee->seq_ctrl[0]++;
+
+		/* avoid watchdog triggers */
+		ieee->dev->trans_start = jiffies;
+		ieee->softmac_data_hard_start_xmit(skb,ieee->dev,ieee->basic_rate);
+
+	}else{
+
+		header->seq_ctl = cpu_to_le16(ieee->seq_ctrl[0] << 4);
+
+		if (ieee->seq_ctrl[0] == 0xFFF)
+			ieee->seq_ctrl[0] = 0;
+		else
+			ieee->seq_ctrl[0]++;
+
+		ieee->softmac_hard_start_xmit(skb,ieee->dev);
+
+	}
+	//dev_kfree_skb_any(skb);//edit by thomas
+}
+
+inline struct sk_buff *ieee80211_probe_req(struct ieee80211_device *ieee)
+{
+	unsigned int len,rate_len;
+	u8 *tag;
+	struct sk_buff *skb;
+	struct ieee80211_probe_request *req;
+
+	len = ieee->current_network.ssid_len;
+
+	rate_len = ieee80211_MFIE_rate_len(ieee);
+
+	skb = dev_alloc_skb(sizeof(struct ieee80211_probe_request) +
+			    2 + len + rate_len + ieee->tx_headroom);
+	if (!skb)
+		return NULL;
+
+	skb_reserve(skb, ieee->tx_headroom);
+
+	req = (struct ieee80211_probe_request *) skb_put(skb,sizeof(struct ieee80211_probe_request));
+	req->header.frame_ctl = cpu_to_le16(IEEE80211_STYPE_PROBE_REQ);
+	req->header.duration_id = 0; //FIXME: is this OK ?
+
+	memset(req->header.addr1, 0xff, ETH_ALEN);
+	memcpy(req->header.addr2, ieee->dev->dev_addr, ETH_ALEN);
+	memset(req->header.addr3, 0xff, ETH_ALEN);
+
+	tag = (u8 *) skb_put(skb,len+2+rate_len);
+
+	*tag++ = MFIE_TYPE_SSID;
+	*tag++ = len;
+	memcpy(tag, ieee->current_network.ssid, len);
+	tag += len;
+
+	ieee80211_MFIE_Brate(ieee,&tag);
+	ieee80211_MFIE_Grate(ieee,&tag);
+	return skb;
+}
+
+struct sk_buff *ieee80211_get_beacon_(struct ieee80211_device *ieee);
+void ieee80211_send_beacon(struct ieee80211_device *ieee)
+{
+	struct sk_buff *skb;
+	if(!ieee->ieee_up)
+		return;
+	//unsigned long flags;
+	skb = ieee80211_get_beacon_(ieee);
+
+	if (skb){
+		softmac_mgmt_xmit(skb, ieee);
+		ieee->softmac_stats.tx_beacons++;
+		//dev_kfree_skb_any(skb);//edit by thomas
+	}
+//	ieee->beacon_timer.expires = jiffies +
+//		(MSECS( ieee->current_network.beacon_interval -5));
+
+	//spin_lock_irqsave(&ieee->beacon_lock,flags);
+	if(ieee->beacon_txing && ieee->ieee_up){
+//		if(!timer_pending(&ieee->beacon_timer))
+//			add_timer(&ieee->beacon_timer);
+		mod_timer(&ieee->beacon_timer,jiffies+(MSECS(ieee->current_network.beacon_interval-5)));
+	}
+	//spin_unlock_irqrestore(&ieee->beacon_lock,flags);
+}
+
+
+void ieee80211_send_beacon_cb(unsigned long _ieee)
+{
+	struct ieee80211_device *ieee =
+		(struct ieee80211_device *) _ieee;
+	unsigned long flags;
+
+	spin_lock_irqsave(&ieee->beacon_lock, flags);
+	ieee80211_send_beacon(ieee);
+	spin_unlock_irqrestore(&ieee->beacon_lock, flags);
+}
+
+
+void ieee80211_send_probe(struct ieee80211_device *ieee)
+{
+	struct sk_buff *skb;
+
+	skb = ieee80211_probe_req(ieee);
+	if (skb){
+		softmac_mgmt_xmit(skb, ieee);
+		ieee->softmac_stats.tx_probe_rq++;
+		//dev_kfree_skb_any(skb);//edit by thomas
+	}
+}
+
+void ieee80211_send_probe_requests(struct ieee80211_device *ieee)
+{
+	if (ieee->active_scan && (ieee->softmac_features & IEEE_SOFTMAC_PROBERQ)){
+		ieee80211_send_probe(ieee);
+		ieee80211_send_probe(ieee);
+	}
+}
+
+/* this performs syncro scan blocking the caller until all channels
+ * in the allowed channel map has been checked.
+ */
+void ieee80211_softmac_scan_syncro(struct ieee80211_device *ieee)
+{
+	short ch = 0;
+#ifdef ENABLE_DOT11D
+	u8 channel_map[MAX_CHANNEL_NUMBER+1];
+	memcpy(channel_map, GET_DOT11D_INFO(ieee)->channel_map, MAX_CHANNEL_NUMBER+1);
+#endif
+	down(&ieee->scan_sem);
+
+	while(1)
+	{
+
+		do{
+			ch++;
+			if (ch > MAX_CHANNEL_NUMBER)
+				goto out; /* scan completed */
+#ifdef ENABLE_DOT11D
+		}while(!channel_map[ch]);
+#else
+		}while(!ieee->channel_map[ch]);
+#endif
+
+		/* this fuction can be called in two situations
+		 * 1- We have switched to ad-hoc mode and we are
+		 *    performing a complete syncro scan before conclude
+		 *    there are no interesting cell and to create a
+		 *    new one. In this case the link state is
+		 *    IEEE80211_NOLINK until we found an interesting cell.
+		 *    If so the ieee8021_new_net, called by the RX path
+		 *    will set the state to IEEE80211_LINKED, so we stop
+		 *    scanning
+		 * 2- We are linked and the root uses run iwlist scan.
+		 *    So we switch to IEEE80211_LINKED_SCANNING to remember
+		 *    that we are still logically linked (not interested in
+		 *    new network events, despite for updating the net list,
+		 *    but we are temporarly 'unlinked' as the driver shall
+		 *    not filter RX frames and the channel is changing.
+		 * So the only situation in witch are interested is to check
+		 * if the state become LINKED because of the #1 situation
+		 */
+
+		if (ieee->state == IEEE80211_LINKED)
+			goto out;
+		ieee->set_chan(ieee->dev, ch);
+#ifdef ENABLE_DOT11D
+		if(channel_map[ch] == 1)
+#endif
+		ieee80211_send_probe_requests(ieee);
+
+		/* this prevent excessive time wait when we
+		 * need to wait for a syncro scan to end..
+		 */
+		if(ieee->state < IEEE80211_LINKED)
+			;
+		else
+		if (ieee->sync_scan_hurryup)
+			goto out;
+
+
+		msleep_interruptible_rsl(IEEE80211_SOFTMAC_SCAN_TIME);
+
+	}
+out:
+	if(ieee->state < IEEE80211_LINKED){
+		ieee->actscanning = false;
+		up(&ieee->scan_sem);
+	}
+	else{
+	ieee->sync_scan_hurryup = 0;
+#ifdef ENABLE_DOT11D
+	if(IS_DOT11D_ENABLE(ieee))
+		DOT11D_ScanComplete(ieee);
+#endif
+	up(&ieee->scan_sem);
+}
+}
+
+
+void ieee80211_softmac_scan_wq(struct work_struct *work)
+{
+	struct delayed_work *dwork = container_of(work, struct delayed_work, work);
+	struct ieee80211_device *ieee = container_of(dwork, struct ieee80211_device, softmac_scan_wq);
+	static short watchdog = 0;
+#ifdef ENABLE_DOT11D
+	u8 channel_map[MAX_CHANNEL_NUMBER+1];
+	memcpy(channel_map, GET_DOT11D_INFO(ieee)->channel_map, MAX_CHANNEL_NUMBER+1);
+#endif
+	if(!ieee->ieee_up)
+		return;
+	down(&ieee->scan_sem);
+	do{
+		ieee->current_network.channel =
+			(ieee->current_network.channel + 1) % MAX_CHANNEL_NUMBER;
+		if (watchdog++ > MAX_CHANNEL_NUMBER)
+		{
+		//if current channel is not in channel map, set to default channel.
+		#ifdef ENABLE_DOT11D
+			if (!channel_map[ieee->current_network.channel]);
+		#else
+			if (!ieee->channel_map[ieee->current_network.channel]);
+		#endif
+				ieee->current_network.channel = 6;
+				goto out; /* no good chans */
+		}
+#ifdef ENABLE_DOT11D
+	}while(!channel_map[ieee->current_network.channel]);
+#else
+	}while(!ieee->channel_map[ieee->current_network.channel]);
+#endif
+	if (ieee->scanning == 0 )
+		goto out;
+	ieee->set_chan(ieee->dev, ieee->current_network.channel);
+#ifdef ENABLE_DOT11D
+	if(channel_map[ieee->current_network.channel] == 1)
+#endif
+	ieee80211_send_probe_requests(ieee);
+
+
+	queue_delayed_work(ieee->wq, &ieee->softmac_scan_wq, IEEE80211_SOFTMAC_SCAN_TIME);
+
+	up(&ieee->scan_sem);
+	return;
+out:
+#ifdef ENABLE_DOT11D
+	if(IS_DOT11D_ENABLE(ieee))
+		DOT11D_ScanComplete(ieee);
+#endif
+	ieee->actscanning = false;
+	watchdog = 0;
+	ieee->scanning = 0;
+	up(&ieee->scan_sem);
+}
+
+
+
+void ieee80211_beacons_start(struct ieee80211_device *ieee)
+{
+	unsigned long flags;
+	spin_lock_irqsave(&ieee->beacon_lock,flags);
+
+	ieee->beacon_txing = 1;
+	ieee80211_send_beacon(ieee);
+
+	spin_unlock_irqrestore(&ieee->beacon_lock,flags);
+}
+
+void ieee80211_beacons_stop(struct ieee80211_device *ieee)
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(&ieee->beacon_lock,flags);
+
+	ieee->beacon_txing = 0;
+	del_timer_sync(&ieee->beacon_timer);
+
+	spin_unlock_irqrestore(&ieee->beacon_lock,flags);
+
+}
+
+
+void ieee80211_stop_send_beacons(struct ieee80211_device *ieee)
+{
+	if(ieee->stop_send_beacons)
+		ieee->stop_send_beacons(ieee->dev);
+	if (ieee->softmac_features & IEEE_SOFTMAC_BEACONS)
+		ieee80211_beacons_stop(ieee);
+}
+
+
+void ieee80211_start_send_beacons(struct ieee80211_device *ieee)
+{
+	if(ieee->start_send_beacons)
+		ieee->start_send_beacons(ieee->dev,ieee->basic_rate);
+	if(ieee->softmac_features & IEEE_SOFTMAC_BEACONS)
+		ieee80211_beacons_start(ieee);
+}
+
+
+void ieee80211_softmac_stop_scan(struct ieee80211_device *ieee)
+{
+//	unsigned long flags;
+
+	//ieee->sync_scan_hurryup = 1;
+
+	down(&ieee->scan_sem);
+//	spin_lock_irqsave(&ieee->lock, flags);
+
+	if (ieee->scanning == 1){
+		ieee->scanning = 0;
+
+		cancel_delayed_work(&ieee->softmac_scan_wq);
+	}
+
+//	spin_unlock_irqrestore(&ieee->lock, flags);
+	up(&ieee->scan_sem);
+}
+
+void ieee80211_stop_scan(struct ieee80211_device *ieee)
+{
+	if (ieee->softmac_features & IEEE_SOFTMAC_SCAN)
+		ieee80211_softmac_stop_scan(ieee);
+	else
+		ieee->stop_scan(ieee->dev);
+}
+
+/* called with ieee->lock held */
+void ieee80211_start_scan(struct ieee80211_device *ieee)
+{
+#ifdef ENABLE_DOT11D
+	if(IS_DOT11D_ENABLE(ieee) )
+	{
+		if(IS_COUNTRY_IE_VALID(ieee))
+		{
+			RESET_CIE_WATCHDOG(ieee);
+		}
+	}
+#endif
+	if (ieee->softmac_features & IEEE_SOFTMAC_SCAN){
+		if (ieee->scanning == 0){
+			ieee->scanning = 1;
+			queue_delayed_work(ieee->wq, &ieee->softmac_scan_wq, 0);
+		}
+	}else
+		ieee->start_scan(ieee->dev);
+
+}
+
+/* called with wx_sem held */
+void ieee80211_start_scan_syncro(struct ieee80211_device *ieee)
+{
+#ifdef ENABLE_DOT11D
+	if(IS_DOT11D_ENABLE(ieee) )
+	{
+		if(IS_COUNTRY_IE_VALID(ieee))
+		{
+			RESET_CIE_WATCHDOG(ieee);
+		}
+	}
+#endif
+	ieee->sync_scan_hurryup = 0;
+	if (ieee->softmac_features & IEEE_SOFTMAC_SCAN)
+		ieee80211_softmac_scan_syncro(ieee);
+	else
+		ieee->scan_syncro(ieee->dev);
+
+}
+
+inline struct sk_buff *ieee80211_authentication_req(struct ieee80211_network *beacon,
+	struct ieee80211_device *ieee, int challengelen)
+{
+	struct sk_buff *skb;
+	struct ieee80211_authentication *auth;
+	int len = sizeof(struct ieee80211_authentication) + challengelen + ieee->tx_headroom;
+
+
+	skb = dev_alloc_skb(len);
+	if (!skb) return NULL;
+
+	skb_reserve(skb, ieee->tx_headroom);
+	auth = (struct ieee80211_authentication *)
+		skb_put(skb, sizeof(struct ieee80211_authentication));
+
+	auth->header.frame_ctl = IEEE80211_STYPE_AUTH;
+	if (challengelen) auth->header.frame_ctl |= IEEE80211_FCTL_WEP;
+
+	auth->header.duration_id = 0x013a; //FIXME
+
+	memcpy(auth->header.addr1, beacon->bssid, ETH_ALEN);
+	memcpy(auth->header.addr2, ieee->dev->dev_addr, ETH_ALEN);
+	memcpy(auth->header.addr3, beacon->bssid, ETH_ALEN);
+
+	//auth->algorithm = ieee->open_wep ? WLAN_AUTH_OPEN : WLAN_AUTH_SHARED_KEY;
+	if(ieee->auth_mode == 0)
+		auth->algorithm = WLAN_AUTH_OPEN;
+	else if(ieee->auth_mode == 1)
+		auth->algorithm = WLAN_AUTH_SHARED_KEY;
+	else if(ieee->auth_mode == 2)
+		auth->algorithm = WLAN_AUTH_OPEN;//0x80;
+	printk("=================>%s():auth->algorithm is %d\n",__FUNCTION__,auth->algorithm);
+	auth->transaction = cpu_to_le16(ieee->associate_seq);
+	ieee->associate_seq++;
+
+	auth->status = cpu_to_le16(WLAN_STATUS_SUCCESS);
+
+	return skb;
+
+}
+
+
+static struct sk_buff* ieee80211_probe_resp(struct ieee80211_device *ieee, u8 *dest)
+{
+	u8 *tag;
+	int beacon_size;
+	struct ieee80211_probe_response *beacon_buf;
+	struct sk_buff *skb = NULL;
+	int encrypt;
+	int atim_len,erp_len;
+	struct ieee80211_crypt_data* crypt;
+
+	char *ssid = ieee->current_network.ssid;
+	int ssid_len = ieee->current_network.ssid_len;
+	int rate_len = ieee->current_network.rates_len+2;
+	int rate_ex_len = ieee->current_network.rates_ex_len;
+	int wpa_ie_len = ieee->wpa_ie_len;
+	u8 erpinfo_content = 0;
+
+	u8* tmp_ht_cap_buf;
+	u8 tmp_ht_cap_len=0;
+	u8* tmp_ht_info_buf;
+	u8 tmp_ht_info_len=0;
+	PRT_HIGH_THROUGHPUT	pHTInfo = ieee->pHTInfo;
+	u8* tmp_generic_ie_buf=NULL;
+	u8 tmp_generic_ie_len=0;
+
+	if(rate_ex_len > 0) rate_ex_len+=2;
+
+	if(ieee->current_network.capability & WLAN_CAPABILITY_IBSS)
+		atim_len = 4;
+	else
+		atim_len = 0;
+
+	if(ieee80211_is_54g(ieee->current_network))
+		erp_len = 3;
+	else
+		erp_len = 0;
+
+
+	crypt = ieee->crypt[ieee->tx_keyidx];
+
+
+	encrypt = ieee->host_encrypt && crypt && crypt->ops &&
+		((0 == strcmp(crypt->ops->name, "WEP") || wpa_ie_len));
+	//HT ralated element
+	tmp_ht_cap_buf =(u8*) &(ieee->pHTInfo->SelfHTCap);
+	tmp_ht_cap_len = sizeof(ieee->pHTInfo->SelfHTCap);
+	tmp_ht_info_buf =(u8*) &(ieee->pHTInfo->SelfHTInfo);
+	tmp_ht_info_len = sizeof(ieee->pHTInfo->SelfHTInfo);
+	HTConstructCapabilityElement(ieee, tmp_ht_cap_buf, &tmp_ht_cap_len,encrypt);
+	HTConstructInfoElement(ieee,tmp_ht_info_buf,&tmp_ht_info_len, encrypt);
+
+
+	if(pHTInfo->bRegRT2RTAggregation)
+	{
+		tmp_generic_ie_buf = ieee->pHTInfo->szRT2RTAggBuffer;
+		tmp_generic_ie_len = sizeof(ieee->pHTInfo->szRT2RTAggBuffer);
+		HTConstructRT2RTAggElement(ieee, tmp_generic_ie_buf, &tmp_generic_ie_len);
+	}
+//	printk("===============>tmp_ht_cap_len is %d,tmp_ht_info_len is %d, tmp_generic_ie_len is %d\n",tmp_ht_cap_len,tmp_ht_info_len,tmp_generic_ie_len);
+	beacon_size = sizeof(struct ieee80211_probe_response)+2+
+		ssid_len
+		+3 //channel
+		+rate_len
+		+rate_ex_len
+		+atim_len
+		+erp_len
+		+wpa_ie_len
+	//	+tmp_ht_cap_len
+	//	+tmp_ht_info_len
+	//	+tmp_generic_ie_len
+//		+wmm_len+2
+		+ieee->tx_headroom;
+	skb = dev_alloc_skb(beacon_size);
+	if (!skb)
+		return NULL;
+	skb_reserve(skb, ieee->tx_headroom);
+	beacon_buf = (struct ieee80211_probe_response*) skb_put(skb, (beacon_size - ieee->tx_headroom));
+	memcpy (beacon_buf->header.addr1, dest,ETH_ALEN);
+	memcpy (beacon_buf->header.addr2, ieee->dev->dev_addr, ETH_ALEN);
+	memcpy (beacon_buf->header.addr3, ieee->current_network.bssid, ETH_ALEN);
+
+	beacon_buf->header.duration_id = 0; //FIXME
+	beacon_buf->beacon_interval =
+		cpu_to_le16(ieee->current_network.beacon_interval);
+	beacon_buf->capability =
+		cpu_to_le16(ieee->current_network.capability & WLAN_CAPABILITY_IBSS);
+	beacon_buf->capability |=
+		cpu_to_le16(ieee->current_network.capability & WLAN_CAPABILITY_SHORT_PREAMBLE); //add short preamble here
+
+	if(ieee->short_slot && (ieee->current_network.capability & WLAN_CAPABILITY_SHORT_SLOT))
+		cpu_to_le16((beacon_buf->capability |= WLAN_CAPABILITY_SHORT_SLOT));
+
+	crypt = ieee->crypt[ieee->tx_keyidx];
+	if (encrypt)
+		beacon_buf->capability |= cpu_to_le16(WLAN_CAPABILITY_PRIVACY);
+
+
+	beacon_buf->header.frame_ctl = cpu_to_le16(IEEE80211_STYPE_PROBE_RESP);
+	beacon_buf->info_element[0].id = MFIE_TYPE_SSID;
+	beacon_buf->info_element[0].len = ssid_len;
+
+	tag = (u8*) beacon_buf->info_element[0].data;
+
+	memcpy(tag, ssid, ssid_len);
+
+	tag += ssid_len;
+
+	*(tag++) = MFIE_TYPE_RATES;
+	*(tag++) = rate_len-2;
+	memcpy(tag,ieee->current_network.rates,rate_len-2);
+	tag+=rate_len-2;
+
+	*(tag++) = MFIE_TYPE_DS_SET;
+	*(tag++) = 1;
+	*(tag++) = ieee->current_network.channel;
+
+	if(atim_len){
+	u16 val16;
+		*(tag++) = MFIE_TYPE_IBSS_SET;
+		*(tag++) = 2;
+		//*((u16*)(tag)) = cpu_to_le16(ieee->current_network.atim_window);
+		 val16 = cpu_to_le16(ieee->current_network.atim_window);
+		memcpy((u8 *)tag, (u8 *)&val16, 2);
+		tag+=2;
+	}
+
+	if(erp_len){
+		*(tag++) = MFIE_TYPE_ERP;
+		*(tag++) = 1;
+		*(tag++) = erpinfo_content;
+	}
+	if(rate_ex_len){
+		*(tag++) = MFIE_TYPE_RATES_EX;
+		*(tag++) = rate_ex_len-2;
+		memcpy(tag,ieee->current_network.rates_ex,rate_ex_len-2);
+		tag+=rate_ex_len-2;
+	}
+
+	if (wpa_ie_len)
+	{
+		if (ieee->iw_mode == IW_MODE_ADHOC)
+		{//as Windows will set pairwise key same as the group key which is not allowed in Linux, so set this for IOT issue. WB 2008.07.07
+			memcpy(&ieee->wpa_ie[14], &ieee->wpa_ie[8], 4);
+		}
+		memcpy(tag, ieee->wpa_ie, ieee->wpa_ie_len);
+		tag += wpa_ie_len;
+	}
+
+	//skb->dev = ieee->dev;
+	return skb;
+}
+
+
+struct sk_buff* ieee80211_assoc_resp(struct ieee80211_device *ieee, u8 *dest)
+{
+	struct sk_buff *skb;
+	u8* tag;
+
+	struct ieee80211_crypt_data* crypt;
+	struct ieee80211_assoc_response_frame *assoc;
+	short encrypt;
+
+	unsigned int rate_len = ieee80211_MFIE_rate_len(ieee);
+	int len = sizeof(struct ieee80211_assoc_response_frame) + rate_len + ieee->tx_headroom;
+
+	skb = dev_alloc_skb(len);
+
+	if (!skb)
+		return NULL;
+
+	skb_reserve(skb, ieee->tx_headroom);
+
+	assoc = (struct ieee80211_assoc_response_frame *)
+		skb_put(skb,sizeof(struct ieee80211_assoc_response_frame));
+
+	assoc->header.frame_ctl = cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP);
+	memcpy(assoc->header.addr1, dest,ETH_ALEN);
+	memcpy(assoc->header.addr3, ieee->dev->dev_addr, ETH_ALEN);
+	memcpy(assoc->header.addr2, ieee->dev->dev_addr, ETH_ALEN);
+	assoc->capability = cpu_to_le16(ieee->iw_mode == IW_MODE_MASTER ?
+		WLAN_CAPABILITY_BSS : WLAN_CAPABILITY_IBSS);
+
+
+	if(ieee->short_slot)
+		assoc->capability |= cpu_to_le16(WLAN_CAPABILITY_SHORT_SLOT);
+
+	if (ieee->host_encrypt)
+		crypt = ieee->crypt[ieee->tx_keyidx];
+	else crypt = NULL;
+
+	encrypt = ( crypt && crypt->ops);
+
+	if (encrypt)
+		assoc->capability |= cpu_to_le16(WLAN_CAPABILITY_PRIVACY);
+
+	assoc->status = 0;
+	assoc->aid = cpu_to_le16(ieee->assoc_id);
+	if (ieee->assoc_id == 0x2007) ieee->assoc_id=0;
+	else ieee->assoc_id++;
+
+	tag = (u8*) skb_put(skb, rate_len);
+
+	ieee80211_MFIE_Brate(ieee, &tag);
+	ieee80211_MFIE_Grate(ieee, &tag);
+
+	return skb;
+}
+
+struct sk_buff* ieee80211_auth_resp(struct ieee80211_device *ieee,int status, u8 *dest)
+{
+	struct sk_buff *skb;
+	struct ieee80211_authentication *auth;
+	int len = ieee->tx_headroom + sizeof(struct ieee80211_authentication)+1;
+
+	skb = dev_alloc_skb(len);
+
+	if (!skb)
+		return NULL;
+
+	skb->len = sizeof(struct ieee80211_authentication);
+
+	auth = (struct ieee80211_authentication *)skb->data;
+
+	auth->status = cpu_to_le16(status);
+	auth->transaction = cpu_to_le16(2);
+	auth->algorithm = cpu_to_le16(WLAN_AUTH_OPEN);
+
+	memcpy(auth->header.addr3, ieee->dev->dev_addr, ETH_ALEN);
+	memcpy(auth->header.addr2, ieee->dev->dev_addr, ETH_ALEN);
+	memcpy(auth->header.addr1, dest, ETH_ALEN);
+	auth->header.frame_ctl = cpu_to_le16(IEEE80211_STYPE_AUTH);
+	return skb;
+
+
+}
+
+struct sk_buff* ieee80211_null_func(struct ieee80211_device *ieee,short pwr)
+{
+	struct sk_buff *skb;
+	struct ieee80211_hdr_3addr* hdr;
+
+	skb = dev_alloc_skb(sizeof(struct ieee80211_hdr_3addr));
+
+	if (!skb)
+		return NULL;
+
+	hdr = (struct ieee80211_hdr_3addr*)skb_put(skb,sizeof(struct ieee80211_hdr_3addr));
+
+	memcpy(hdr->addr1, ieee->current_network.bssid, ETH_ALEN);
+	memcpy(hdr->addr2, ieee->dev->dev_addr, ETH_ALEN);
+	memcpy(hdr->addr3, ieee->current_network.bssid, ETH_ALEN);
+
+	hdr->frame_ctl = cpu_to_le16(IEEE80211_FTYPE_DATA |
+		IEEE80211_STYPE_NULLFUNC | IEEE80211_FCTL_TODS |
+		(pwr ? IEEE80211_FCTL_PM:0));
+
+	return skb;
+
+
+}
+
+
+void ieee80211_resp_to_assoc_rq(struct ieee80211_device *ieee, u8* dest)
+{
+	struct sk_buff *buf = ieee80211_assoc_resp(ieee, dest);
+
+	if (buf)
+		softmac_mgmt_xmit(buf, ieee);
+}
+
+
+void ieee80211_resp_to_auth(struct ieee80211_device *ieee, int s, u8* dest)
+{
+	struct sk_buff *buf = ieee80211_auth_resp(ieee, s, dest);
+
+	if (buf)
+		softmac_mgmt_xmit(buf, ieee);
+}
+
+
+void ieee80211_resp_to_probe(struct ieee80211_device *ieee, u8 *dest)
+{
+
+
+	struct sk_buff *buf = ieee80211_probe_resp(ieee, dest);
+	if (buf)
+		softmac_mgmt_xmit(buf, ieee);
+}
+
+
+inline struct sk_buff *ieee80211_association_req(struct ieee80211_network *beacon,struct ieee80211_device *ieee)
+{
+	struct sk_buff *skb;
+	//unsigned long flags;
+
+	struct ieee80211_assoc_request_frame *hdr;
+	u8 *tag;//,*rsn_ie;
+	//short info_addr = 0;
+	//int i;
+	//u16 suite_count = 0;
+	//u8 suit_select = 0;
+	//unsigned int wpa_len = beacon->wpa_ie_len;
+	//for HT
+	u8* ht_cap_buf = NULL;
+	u8 ht_cap_len=0;
+	u8* realtek_ie_buf=NULL;
+	u8 realtek_ie_len=0;
+	int wpa_ie_len= ieee->wpa_ie_len;
+	unsigned int ckip_ie_len=0;
+	unsigned int ccxrm_ie_len=0;
+	unsigned int cxvernum_ie_len=0;
+	struct ieee80211_crypt_data* crypt;
+	int encrypt;
+
+	unsigned int rate_len = ieee80211_MFIE_rate_len(ieee);
+	unsigned int wmm_info_len = beacon->qos_data.supported?9:0;
+#ifdef THOMAS_TURBO
+	unsigned int turbo_info_len = beacon->Turbo_Enable?9:0;
+#endif
+
+	int len = 0;
+
+	crypt = ieee->crypt[ieee->tx_keyidx];
+	encrypt = ieee->host_encrypt && crypt && crypt->ops && ((0 == strcmp(crypt->ops->name,"WEP") || wpa_ie_len));
+
+	//Include High Throuput capability && Realtek proprietary
+	if(ieee->pHTInfo->bCurrentHTSupport&&ieee->pHTInfo->bEnableHT)
+	{
+		ht_cap_buf = (u8*)&(ieee->pHTInfo->SelfHTCap);
+		ht_cap_len = sizeof(ieee->pHTInfo->SelfHTCap);
+		HTConstructCapabilityElement(ieee, ht_cap_buf, &ht_cap_len, encrypt);
+		if(ieee->pHTInfo->bCurrentRT2RTAggregation)
+		{
+			realtek_ie_buf = ieee->pHTInfo->szRT2RTAggBuffer;
+			realtek_ie_len = sizeof( ieee->pHTInfo->szRT2RTAggBuffer);
+			HTConstructRT2RTAggElement(ieee, realtek_ie_buf, &realtek_ie_len);
+
+		}
+	}
+	if(ieee->qos_support){
+		wmm_info_len = beacon->qos_data.supported?9:0;
+	}
+
+
+	if(beacon->bCkipSupported)
+	{
+		ckip_ie_len = 30+2;
+	}
+	if(beacon->bCcxRmEnable)
+	{
+		ccxrm_ie_len = 6+2;
+	}
+	if( beacon->BssCcxVerNumber >= 2 )
+	{
+		cxvernum_ie_len = 5+2;
+	}
+#ifdef THOMAS_TURBO
+	len = sizeof(struct ieee80211_assoc_request_frame)+ 2
+		+ beacon->ssid_len//essid tagged val
+		+ rate_len//rates tagged val
+		+ wpa_ie_len
+		+ wmm_info_len
+		+ turbo_info_len
+		+ ht_cap_len
+		+ realtek_ie_len
+		+ ckip_ie_len
+		+ ccxrm_ie_len
+		+ cxvernum_ie_len
+		+ ieee->tx_headroom;
+#else
+	len = sizeof(struct ieee80211_assoc_request_frame)+ 2
+		+ beacon->ssid_len//essid tagged val
+		+ rate_len//rates tagged val
+		+ wpa_ie_len
+		+ wmm_info_len
+		+ ht_cap_len
+		+ realtek_ie_len
+		+ ckip_ie_len
+		+ ccxrm_ie_len
+		+ cxvernum_ie_len
+		+ ieee->tx_headroom;
+#endif
+
+	skb = dev_alloc_skb(len);
+
+	if (!skb)
+		return NULL;
+
+	skb_reserve(skb, ieee->tx_headroom);
+
+	hdr = (struct ieee80211_assoc_request_frame *)
+		skb_put(skb, sizeof(struct ieee80211_assoc_request_frame)+2);
+
+
+	hdr->header.frame_ctl = IEEE80211_STYPE_ASSOC_REQ;
+	hdr->header.duration_id= 37; //FIXME
+	memcpy(hdr->header.addr1, beacon->bssid, ETH_ALEN);
+	memcpy(hdr->header.addr2, ieee->dev->dev_addr, ETH_ALEN);
+	memcpy(hdr->header.addr3, beacon->bssid, ETH_ALEN);
+
+	memcpy(ieee->ap_mac_addr, beacon->bssid, ETH_ALEN);//for HW security, John
+
+	hdr->capability = cpu_to_le16(WLAN_CAPABILITY_BSS);
+	if (beacon->capability & WLAN_CAPABILITY_PRIVACY )
+		hdr->capability |= cpu_to_le16(WLAN_CAPABILITY_PRIVACY);
+
+	if (beacon->capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
+		hdr->capability |= cpu_to_le16(WLAN_CAPABILITY_SHORT_PREAMBLE); //add short_preamble here
+
+	if(ieee->short_slot)
+		hdr->capability |= cpu_to_le16(WLAN_CAPABILITY_SHORT_SLOT);
+	if (wmm_info_len) //QOS
+	hdr->capability |= cpu_to_le16(WLAN_CAPABILITY_QOS);
+
+	hdr->listen_interval = 0xa; //FIXME
+
+	hdr->info_element[0].id = MFIE_TYPE_SSID;
+
+	hdr->info_element[0].len = beacon->ssid_len;
+	tag = skb_put(skb, beacon->ssid_len);
+	memcpy(tag, beacon->ssid, beacon->ssid_len);
+
+	tag = skb_put(skb, rate_len);
+
+	ieee80211_MFIE_Brate(ieee, &tag);
+	ieee80211_MFIE_Grate(ieee, &tag);
+	// For CCX 1 S13, CKIP. Added by Annie, 2006-08-14.
+	if( beacon->bCkipSupported )
+	{
+		static u8	AironetIeOui[] = {0x00, 0x01, 0x66}; // "4500-client"
+		u8	CcxAironetBuf[30];
+		OCTET_STRING	osCcxAironetIE;
+
+		memset(CcxAironetBuf, 0,30);
+		osCcxAironetIE.Octet = CcxAironetBuf;
+		osCcxAironetIE.Length = sizeof(CcxAironetBuf);
+		//
+		// Ref. CCX test plan v3.61, 3.2.3.1 step 13.
+		// We want to make the device type as "4500-client". 060926, by CCW.
+		//
+		memcpy(osCcxAironetIE.Octet, AironetIeOui, sizeof(AironetIeOui));
+
+		// CCX1 spec V1.13, A01.1 CKIP Negotiation (page23):
+		// "The CKIP negotiation is started with the associate request from the client to the access point,
+		//  containing an Aironet element with both the MIC and KP bits set."
+		osCcxAironetIE.Octet[IE_CISCO_FLAG_POSITION] |=  (SUPPORT_CKIP_PK|SUPPORT_CKIP_MIC) ;
+		tag = skb_put(skb, ckip_ie_len);
+		*tag++ = MFIE_TYPE_AIRONET;
+		*tag++ = osCcxAironetIE.Length;
+		memcpy(tag,osCcxAironetIE.Octet,osCcxAironetIE.Length);
+		tag += osCcxAironetIE.Length;
+	}
+
+	if(beacon->bCcxRmEnable)
+	{
+		static u8 CcxRmCapBuf[] = {0x00, 0x40, 0x96, 0x01, 0x01, 0x00};
+		OCTET_STRING osCcxRmCap;
+
+		osCcxRmCap.Octet = CcxRmCapBuf;
+		osCcxRmCap.Length = sizeof(CcxRmCapBuf);
+		tag = skb_put(skb,ccxrm_ie_len);
+		*tag++ = MFIE_TYPE_GENERIC;
+		*tag++ = osCcxRmCap.Length;
+		memcpy(tag,osCcxRmCap.Octet,osCcxRmCap.Length);
+		tag += osCcxRmCap.Length;
+	}
+
+	if( beacon->BssCcxVerNumber >= 2 )
+	{
+		u8			CcxVerNumBuf[] = {0x00, 0x40, 0x96, 0x03, 0x00};
+		OCTET_STRING	osCcxVerNum;
+		CcxVerNumBuf[4] = beacon->BssCcxVerNumber;
+		osCcxVerNum.Octet = CcxVerNumBuf;
+		osCcxVerNum.Length = sizeof(CcxVerNumBuf);
+		tag = skb_put(skb,cxvernum_ie_len);
+		*tag++ = MFIE_TYPE_GENERIC;
+		*tag++ = osCcxVerNum.Length;
+		memcpy(tag,osCcxVerNum.Octet,osCcxVerNum.Length);
+		tag += osCcxVerNum.Length;
+	}
+	//HT cap element
+	if(ieee->pHTInfo->bCurrentHTSupport&&ieee->pHTInfo->bEnableHT){
+		if(ieee->pHTInfo->ePeerHTSpecVer != HT_SPEC_VER_EWC)
+		{
+			tag = skb_put(skb, ht_cap_len);
+			*tag++ = MFIE_TYPE_HT_CAP;
+			*tag++ = ht_cap_len - 2;
+			memcpy(tag, ht_cap_buf,ht_cap_len -2);
+			tag += ht_cap_len -2;
+		}
+	}
+
+
+	//choose what wpa_supplicant gives to associate.
+	tag = skb_put(skb, wpa_ie_len);
+	if (wpa_ie_len){
+		memcpy(tag, ieee->wpa_ie, ieee->wpa_ie_len);
+	}
+
+	tag = skb_put(skb,wmm_info_len);
+	if(wmm_info_len) {
+	  ieee80211_WMM_Info(ieee, &tag);
+	}
+#ifdef THOMAS_TURBO
+	tag = skb_put(skb,turbo_info_len);
+	if(turbo_info_len) {
+		ieee80211_TURBO_Info(ieee, &tag);
+	}
+#endif
+
+	if(ieee->pHTInfo->bCurrentHTSupport&&ieee->pHTInfo->bEnableHT){
+		if(ieee->pHTInfo->ePeerHTSpecVer == HT_SPEC_VER_EWC)
+		{
+			tag = skb_put(skb, ht_cap_len);
+			*tag++ = MFIE_TYPE_GENERIC;
+			*tag++ = ht_cap_len - 2;
+			memcpy(tag, ht_cap_buf,ht_cap_len - 2);
+			tag += ht_cap_len -2;
+		}
+
+		if(ieee->pHTInfo->bCurrentRT2RTAggregation){
+			tag = skb_put(skb, realtek_ie_len);
+			*tag++ = MFIE_TYPE_GENERIC;
+			*tag++ = realtek_ie_len - 2;
+			memcpy(tag, realtek_ie_buf,realtek_ie_len -2 );
+		}
+	}
+//	printk("<=====%s(), %p, %p\n", __FUNCTION__, ieee->dev, ieee->dev->dev_addr);
+//	IEEE80211_DEBUG_DATA(IEEE80211_DL_DATA, skb->data, skb->len);
+	return skb;
+}
+
+void ieee80211_associate_abort(struct ieee80211_device *ieee)
+{
+
+	unsigned long flags;
+	spin_lock_irqsave(&ieee->lock, flags);
+
+	ieee->associate_seq++;
+
+	/* don't scan, and avoid to have the RX path possibily
+	 * try again to associate. Even do not react to AUTH or
+	 * ASSOC response. Just wait for the retry wq to be scheduled.
+	 * Here we will check if there are good nets to associate
+	 * with, so we retry or just get back to NO_LINK and scanning
+	 */
+	if (ieee->state == IEEE80211_ASSOCIATING_AUTHENTICATING){
+		IEEE80211_DEBUG_MGMT("Authentication failed\n");
+		ieee->softmac_stats.no_auth_rs++;
+	}else{
+		IEEE80211_DEBUG_MGMT("Association failed\n");
+		ieee->softmac_stats.no_ass_rs++;
+	}
+
+	ieee->state = IEEE80211_ASSOCIATING_RETRY;
+
+	queue_delayed_work(ieee->wq, &ieee->associate_retry_wq, \
+			   IEEE80211_SOFTMAC_ASSOC_RETRY_TIME);
+
+	spin_unlock_irqrestore(&ieee->lock, flags);
+}
+
+void ieee80211_associate_abort_cb(unsigned long dev)
+{
+	ieee80211_associate_abort((struct ieee80211_device *) dev);
+}
+
+
+void ieee80211_associate_step1(struct ieee80211_device *ieee)
+{
+	struct ieee80211_network *beacon = &ieee->current_network;
+	struct sk_buff *skb;
+
+	IEEE80211_DEBUG_MGMT("Stopping scan\n");
+
+	ieee->softmac_stats.tx_auth_rq++;
+	skb=ieee80211_authentication_req(beacon, ieee, 0);
+
+	if (!skb)
+		ieee80211_associate_abort(ieee);
+	else{
+		ieee->state = IEEE80211_ASSOCIATING_AUTHENTICATING ;
+		IEEE80211_DEBUG_MGMT("Sending authentication request\n");
+		//printk(KERN_WARNING "Sending authentication request\n");
+		softmac_mgmt_xmit(skb, ieee);
+		//BUGON when you try to add_timer twice, using mod_timer may be better, john0709
+		if(!timer_pending(&ieee->associate_timer)){
+			ieee->associate_timer.expires = jiffies + (HZ / 2);
+			add_timer(&ieee->associate_timer);
+		}
+		//dev_kfree_skb_any(skb);//edit by thomas
+	}
+}
+
+void ieee80211_auth_challenge(struct ieee80211_device *ieee, u8 *challenge, int chlen)
+{
+	u8 *c;
+	struct sk_buff *skb;
+	struct ieee80211_network *beacon = &ieee->current_network;
+//	int hlen = sizeof(struct ieee80211_authentication);
+
+	ieee->associate_seq++;
+	ieee->softmac_stats.tx_auth_rq++;
+
+	skb = ieee80211_authentication_req(beacon, ieee, chlen+2);
+	if (!skb)
+		ieee80211_associate_abort(ieee);
+	else{
+		c = skb_put(skb, chlen+2);
+		*(c++) = MFIE_TYPE_CHALLENGE;
+		*(c++) = chlen;
+		memcpy(c, challenge, chlen);
+
+		IEEE80211_DEBUG_MGMT("Sending authentication challenge response\n");
+
+		ieee80211_encrypt_fragment(ieee, skb, sizeof(struct ieee80211_hdr_3addr  ));
+
+		softmac_mgmt_xmit(skb, ieee);
+		mod_timer(&ieee->associate_timer, jiffies + (HZ/2));
+		//dev_kfree_skb_any(skb);//edit by thomas
+	}
+	kfree(challenge);
+}
+
+void ieee80211_associate_step2(struct ieee80211_device *ieee)
+{
+	struct sk_buff* skb;
+	struct ieee80211_network *beacon = &ieee->current_network;
+
+	del_timer_sync(&ieee->associate_timer);
+
+	IEEE80211_DEBUG_MGMT("Sending association request\n");
+
+	ieee->softmac_stats.tx_ass_rq++;
+	skb=ieee80211_association_req(beacon, ieee);
+	if (!skb)
+		ieee80211_associate_abort(ieee);
+	else{
+		softmac_mgmt_xmit(skb, ieee);
+		mod_timer(&ieee->associate_timer, jiffies + (HZ/2));
+		//dev_kfree_skb_any(skb);//edit by thomas
+	}
+}
+void ieee80211_associate_complete_wq(struct work_struct *work)
+{
+	struct ieee80211_device *ieee = container_of(work, struct ieee80211_device, associate_complete_wq);
+	printk(KERN_INFO "Associated successfully\n");
+	if(ieee80211_is_54g(ieee->current_network) &&
+		(ieee->modulation & IEEE80211_OFDM_MODULATION)){
+
+		ieee->rate = 108;
+		printk(KERN_INFO"Using G rates:%d\n", ieee->rate);
+	}else{
+		ieee->rate = 22;
+		printk(KERN_INFO"Using B rates:%d\n", ieee->rate);
+	}
+	if (ieee->pHTInfo->bCurrentHTSupport&&ieee->pHTInfo->bEnableHT)
+	{
+		printk("Successfully associated, ht enabled\n");
+		HTOnAssocRsp(ieee);
+	}
+	else
+	{
+		printk("Successfully associated, ht not enabled(%d, %d)\n", ieee->pHTInfo->bCurrentHTSupport, ieee->pHTInfo->bEnableHT);
+		memset(ieee->dot11HTOperationalRateSet, 0, 16);
+		//HTSetConnectBwMode(ieee, HT_CHANNEL_WIDTH_20, HT_EXTCHNL_OFFSET_NO_EXT);
+	}
+	ieee->LinkDetectInfo.SlotNum = 2 * (1 + ieee->current_network.beacon_interval/500);
+	// To prevent the immediately calling watch_dog after association.
+	if(ieee->LinkDetectInfo.NumRecvBcnInPeriod==0||ieee->LinkDetectInfo.NumRecvDataInPeriod==0 )
+	{
+		ieee->LinkDetectInfo.NumRecvBcnInPeriod = 1;
+		ieee->LinkDetectInfo.NumRecvDataInPeriod= 1;
+	}
+	ieee->link_change(ieee->dev);
+	if(ieee->is_silent_reset == 0){
+		printk("============>normal associate\n");
+	notify_wx_assoc_event(ieee);
+	}
+	else if(ieee->is_silent_reset == 1)
+	{
+		printk("==================>silent reset associate\n");
+		ieee->is_silent_reset = 0;
+	}
+
+	if (ieee->data_hard_resume)
+		ieee->data_hard_resume(ieee->dev);
+	netif_carrier_on(ieee->dev);
+}
+
+void ieee80211_associate_complete(struct ieee80211_device *ieee)
+{
+//	int i;
+//	struct net_device* dev = ieee->dev;
+	del_timer_sync(&ieee->associate_timer);
+
+	ieee->state = IEEE80211_LINKED;
+	//ieee->UpdateHalRATRTableHandler(dev, ieee->dot11HTOperationalRateSet);
+	queue_work(ieee->wq, &ieee->associate_complete_wq);
+}
+
+void ieee80211_associate_procedure_wq(struct work_struct *work)
+{
+	struct ieee80211_device *ieee = container_of(work, struct ieee80211_device, associate_procedure_wq);
+	ieee->sync_scan_hurryup = 1;
+	down(&ieee->wx_sem);
+
+	if (ieee->data_hard_stop)
+		ieee->data_hard_stop(ieee->dev);
+
+	ieee80211_stop_scan(ieee);
+	printk("===>%s(), chan:%d\n", __FUNCTION__, ieee->current_network.channel);
+	//ieee->set_chan(ieee->dev, ieee->current_network.channel);
+	HTSetConnectBwMode(ieee, HT_CHANNEL_WIDTH_20, HT_EXTCHNL_OFFSET_NO_EXT);
+
+	ieee->associate_seq = 1;
+	ieee80211_associate_step1(ieee);
+
+	up(&ieee->wx_sem);
+}
+
+inline void ieee80211_softmac_new_net(struct ieee80211_device *ieee, struct ieee80211_network *net)
+{
+	u8 tmp_ssid[IW_ESSID_MAX_SIZE+1];
+	int tmp_ssid_len = 0;
+
+	short apset,ssidset,ssidbroad,apmatch,ssidmatch;
+
+	/* we are interested in new new only if we are not associated
+	 * and we are not associating / authenticating
+	 */
+	if (ieee->state != IEEE80211_NOLINK)
+		return;
+
+	if ((ieee->iw_mode == IW_MODE_INFRA) && !(net->capability & WLAN_CAPABILITY_BSS))
+		return;
+
+	if ((ieee->iw_mode == IW_MODE_ADHOC) && !(net->capability & WLAN_CAPABILITY_IBSS))
+		return;
+
+
+	if (ieee->iw_mode == IW_MODE_INFRA || ieee->iw_mode == IW_MODE_ADHOC){
+		/* if the user specified the AP MAC, we need also the essid
+		 * This could be obtained by beacons or, if the network does not
+		 * broadcast it, it can be put manually.
+		 */
+		apset = ieee->wap_set;//(memcmp(ieee->current_network.bssid, zero,ETH_ALEN)!=0 );
+		ssidset = ieee->ssid_set;//ieee->current_network.ssid[0] != '\0';
+		ssidbroad =  !(net->ssid_len == 0 || net->ssid[0]== '\0');
+		apmatch = (memcmp(ieee->current_network.bssid, net->bssid, ETH_ALEN)==0);
+		ssidmatch = (ieee->current_network.ssid_len == net->ssid_len)&&\
+				(!strncmp(ieee->current_network.ssid, net->ssid, net->ssid_len));
+
+
+		if (	/* if the user set the AP check if match.
+			 * if the network does not broadcast essid we check the user supplyed ANY essid
+			 * if the network does broadcast and the user does not set essid it is OK
+			 * if the network does broadcast and the user did set essid chech if essid match
+			 */
+			( apset && apmatch &&
+				((ssidset && ssidbroad && ssidmatch) || (ssidbroad && !ssidset) || (!ssidbroad && ssidset)) ) ||
+			/* if the ap is not set, check that the user set the bssid
+			 * and the network does bradcast and that those two bssid matches
+			 */
+			(!apset && ssidset && ssidbroad && ssidmatch)
+			){
+				/* if the essid is hidden replace it with the
+				* essid provided by the user.
+				*/
+				if (!ssidbroad){
+					strncpy(tmp_ssid, ieee->current_network.ssid, IW_ESSID_MAX_SIZE);
+					tmp_ssid_len = ieee->current_network.ssid_len;
+				}
+				memcpy(&ieee->current_network, net, sizeof(struct ieee80211_network));
+
+				if (!ssidbroad){
+					strncpy(ieee->current_network.ssid, tmp_ssid, IW_ESSID_MAX_SIZE);
+					ieee->current_network.ssid_len = tmp_ssid_len;
+				}
+				printk(KERN_INFO"Linking with %s,channel:%d, qos:%d, myHT:%d, networkHT:%d\n",ieee->current_network.ssid,ieee->current_network.channel, ieee->current_network.qos_data.supported, ieee->pHTInfo->bEnableHT, ieee->current_network.bssht.bdSupportHT);
+
+				//ieee->pHTInfo->IOTAction = 0;
+				HTResetIOTSetting(ieee->pHTInfo);
+				if (ieee->iw_mode == IW_MODE_INFRA){
+					/* Join the network for the first time */
+					ieee->AsocRetryCount = 0;
+					//for HT by amy 080514
+					if((ieee->current_network.qos_data.supported == 1) &&
+					  // (ieee->pHTInfo->bEnableHT && ieee->current_network.bssht.bdSupportHT))
+					   ieee->current_network.bssht.bdSupportHT)
+/*WB, 2008.09.09:bCurrentHTSupport and bEnableHT two flags are going to put together to check whether we are in HT now, so needn't to check bEnableHT flags here. That's is to say we will set to HT support whenever joined AP has the ability to support HT. And whether we are in HT or not, please check bCurrentHTSupport&&bEnableHT now please.*/
+					{
+					//	ieee->pHTInfo->bCurrentHTSupport = true;
+						HTResetSelfAndSavePeerSetting(ieee, &(ieee->current_network));
+					}
+					else
+					{
+						ieee->pHTInfo->bCurrentHTSupport = false;
+					}
+
+					ieee->state = IEEE80211_ASSOCIATING;
+					queue_work(ieee->wq, &ieee->associate_procedure_wq);
+				}else{
+					if(ieee80211_is_54g(ieee->current_network) &&
+						(ieee->modulation & IEEE80211_OFDM_MODULATION)){
+						ieee->rate = 108;
+						ieee->SetWirelessMode(ieee->dev, IEEE_G);
+						printk(KERN_INFO"Using G rates\n");
+					}else{
+						ieee->rate = 22;
+						ieee->SetWirelessMode(ieee->dev, IEEE_B);
+						printk(KERN_INFO"Using B rates\n");
+					}
+					memset(ieee->dot11HTOperationalRateSet, 0, 16);
+					//HTSetConnectBwMode(ieee, HT_CHANNEL_WIDTH_20, HT_EXTCHNL_OFFSET_NO_EXT);
+					ieee->state = IEEE80211_LINKED;
+				}
+
+		}
+	}
+
+}
+
+void ieee80211_softmac_check_all_nets(struct ieee80211_device *ieee)
+{
+	unsigned long flags;
+	struct ieee80211_network *target;
+
+	spin_lock_irqsave(&ieee->lock, flags);
+
+	list_for_each_entry(target, &ieee->network_list, list) {
+
+		/* if the state become different that NOLINK means
+		 * we had found what we are searching for
+		 */
+
+		if (ieee->state != IEEE80211_NOLINK)
+			break;
+
+		if (ieee->scan_age == 0 || time_after(target->last_scanned + ieee->scan_age, jiffies))
+		ieee80211_softmac_new_net(ieee, target);
+	}
+
+	spin_unlock_irqrestore(&ieee->lock, flags);
+
+}
+
+
+static inline u16 auth_parse(struct sk_buff *skb, u8** challenge, int *chlen)
+{
+	struct ieee80211_authentication *a;
+	u8 *t;
+	if (skb->len <  (sizeof(struct ieee80211_authentication)-sizeof(struct ieee80211_info_element))){
+		IEEE80211_DEBUG_MGMT("invalid len in auth resp: %d\n",skb->len);
+		return 0xcafe;
+	}
+	*challenge = NULL;
+	a = (struct ieee80211_authentication*) skb->data;
+	if(skb->len > (sizeof(struct ieee80211_authentication) +3)){
+		t = skb->data + sizeof(struct ieee80211_authentication);
+
+		if(*(t++) == MFIE_TYPE_CHALLENGE){
+			*chlen = *(t++);
+			*challenge = (u8*)kmalloc(*chlen, GFP_ATOMIC);
+			memcpy(*challenge, t, *chlen);
+		}
+	}
+
+	return cpu_to_le16(a->status);
+
+}
+
+
+int auth_rq_parse(struct sk_buff *skb,u8* dest)
+{
+	struct ieee80211_authentication *a;
+
+	if (skb->len <  (sizeof(struct ieee80211_authentication)-sizeof(struct ieee80211_info_element))){
+		IEEE80211_DEBUG_MGMT("invalid len in auth request: %d\n",skb->len);
+		return -1;
+	}
+	a = (struct ieee80211_authentication*) skb->data;
+
+	memcpy(dest,a->header.addr2, ETH_ALEN);
+
+	if (le16_to_cpu(a->algorithm) != WLAN_AUTH_OPEN)
+		return  WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG;
+
+	return WLAN_STATUS_SUCCESS;
+}
+
+static short probe_rq_parse(struct ieee80211_device *ieee, struct sk_buff *skb, u8 *src)
+{
+	u8 *tag;
+	u8 *skbend;
+	u8 *ssid=NULL;
+	u8 ssidlen = 0;
+
+	struct ieee80211_hdr_3addr   *header =
+		(struct ieee80211_hdr_3addr   *) skb->data;
+
+	if (skb->len < sizeof (struct ieee80211_hdr_3addr  ))
+		return -1; /* corrupted */
+
+	memcpy(src,header->addr2, ETH_ALEN);
+
+	skbend = (u8*)skb->data + skb->len;
+
+	tag = skb->data + sizeof (struct ieee80211_hdr_3addr  );
+
+	while (tag+1 < skbend){
+		if (*tag == 0){
+			ssid = tag+2;
+			ssidlen = *(tag+1);
+			break;
+		}
+		tag++; /* point to the len field */
+		tag = tag + *(tag); /* point to the last data byte of the tag */
+		tag++; /* point to the next tag */
+	}
+
+	//IEEE80211DMESG("Card MAC address is "MACSTR, MAC2STR(src));
+	if (ssidlen == 0) return 1;
+
+	if (!ssid) return 1; /* ssid not found in tagged param */
+	return (!strncmp(ssid, ieee->current_network.ssid, ssidlen));
+
+}
+
+int assoc_rq_parse(struct sk_buff *skb,u8* dest)
+{
+	struct ieee80211_assoc_request_frame *a;
+
+	if (skb->len < (sizeof(struct ieee80211_assoc_request_frame) -
+		sizeof(struct ieee80211_info_element))) {
+
+		IEEE80211_DEBUG_MGMT("invalid len in auth request:%d \n", skb->len);
+		return -1;
+	}
+
+	a = (struct ieee80211_assoc_request_frame*) skb->data;
+
+	memcpy(dest,a->header.addr2,ETH_ALEN);
+
+	return 0;
+}
+
+static inline u16 assoc_parse(struct ieee80211_device *ieee, struct sk_buff *skb, int *aid)
+{
+	struct ieee80211_assoc_response_frame *response_head;
+	u16 status_code;
+
+	if (skb->len <  sizeof(struct ieee80211_assoc_response_frame)){
+		IEEE80211_DEBUG_MGMT("invalid len in auth resp: %d\n", skb->len);
+		return 0xcafe;
+	}
+
+	response_head = (struct ieee80211_assoc_response_frame*) skb->data;
+	*aid = le16_to_cpu(response_head->aid) & 0x3fff;
+
+	status_code = le16_to_cpu(response_head->status);
+	if((status_code==WLAN_STATUS_ASSOC_DENIED_RATES || \
+	   status_code==WLAN_STATUS_CAPS_UNSUPPORTED)&&
+	   ((ieee->mode == IEEE_G) &&
+	    (ieee->current_network.mode == IEEE_N_24G) &&
+	    (ieee->AsocRetryCount++ < (RT_ASOC_RETRY_LIMIT-1)))) {
+		 ieee->pHTInfo->IOTAction |= HT_IOT_ACT_PURE_N_MODE;
+	}else {
+		 ieee->AsocRetryCount = 0;
+	}
+
+	return le16_to_cpu(response_head->status);
+}
+
+static inline void
+ieee80211_rx_probe_rq(struct ieee80211_device *ieee, struct sk_buff *skb)
+{
+	u8 dest[ETH_ALEN];
+
+	//IEEE80211DMESG("Rx probe");
+	ieee->softmac_stats.rx_probe_rq++;
+	//DMESG("Dest is "MACSTR, MAC2STR(dest));
+	if (probe_rq_parse(ieee, skb, dest)){
+		//IEEE80211DMESG("Was for me!");
+		ieee->softmac_stats.tx_probe_rs++;
+		ieee80211_resp_to_probe(ieee, dest);
+	}
+}
+
+static inline void
+ieee80211_rx_auth_rq(struct ieee80211_device *ieee, struct sk_buff *skb)
+{
+	u8 dest[ETH_ALEN];
+	int status;
+	//IEEE80211DMESG("Rx probe");
+	ieee->softmac_stats.rx_auth_rq++;
+
+	if ((status = auth_rq_parse(skb, dest))!= -1){
+		ieee80211_resp_to_auth(ieee, status, dest);
+	}
+	//DMESG("Dest is "MACSTR, MAC2STR(dest));
+
+}
+
+static inline void
+ieee80211_rx_assoc_rq(struct ieee80211_device *ieee, struct sk_buff *skb)
+{
+
+	u8 dest[ETH_ALEN];
+	//unsigned long flags;
+
+	ieee->softmac_stats.rx_ass_rq++;
+	if (assoc_rq_parse(skb,dest) != -1){
+		ieee80211_resp_to_assoc_rq(ieee, dest);
+	}
+
+	printk(KERN_INFO"New client associated: "MAC_FMT"\n", MAC_ARG(dest));
+	//FIXME
+}
+
+
+
+void ieee80211_sta_ps_send_null_frame(struct ieee80211_device *ieee, short pwr)
+{
+
+	struct sk_buff *buf = ieee80211_null_func(ieee, pwr);
+
+	if (buf)
+		softmac_ps_mgmt_xmit(buf, ieee);
+
+}
+
+
+short ieee80211_sta_ps_sleep(struct ieee80211_device *ieee, u32 *time_h, u32 *time_l)
+{
+	int timeout = ieee->ps_timeout;
+	u8 dtim;
+	/*if(ieee->ps == IEEE80211_PS_DISABLED ||
+		ieee->iw_mode != IW_MODE_INFRA ||
+		ieee->state != IEEE80211_LINKED)
+
+		return 0;
+	*/
+	dtim = ieee->current_network.dtim_data;
+	//printk("DTIM\n");
+	if(!(dtim & IEEE80211_DTIM_VALID))
+		return 0;
+	timeout = ieee->current_network.beacon_interval; //should we use ps_timeout value or beacon_interval
+	//printk("VALID\n");
+	ieee->current_network.dtim_data = IEEE80211_DTIM_INVALID;
+
+	if(dtim & ((IEEE80211_DTIM_UCAST | IEEE80211_DTIM_MBCAST)& ieee->ps))
+		return 2;
+
+	if(!time_after(jiffies, ieee->dev->trans_start + MSECS(timeout)))
+		return 0;
+
+	if(!time_after(jiffies, ieee->last_rx_ps_time + MSECS(timeout)))
+		return 0;
+
+	if((ieee->softmac_features & IEEE_SOFTMAC_SINGLE_QUEUE ) &&
+		(ieee->mgmt_queue_tail != ieee->mgmt_queue_head))
+		return 0;
+
+	if(time_l){
+		*time_l = ieee->current_network.last_dtim_sta_time[0]
+			+ (ieee->current_network.beacon_interval
+			* ieee->current_network.dtim_period) * 1000;
+	}
+
+	if(time_h){
+		*time_h = ieee->current_network.last_dtim_sta_time[1];
+		if(time_l && *time_l < ieee->current_network.last_dtim_sta_time[0])
+			*time_h += 1;
+	}
+
+	return 1;
+
+
+}
+
+inline void ieee80211_sta_ps(struct ieee80211_device *ieee)
+{
+
+	u32 th,tl;
+	short sleep;
+
+	unsigned long flags,flags2;
+
+	spin_lock_irqsave(&ieee->lock, flags);
+
+	if((ieee->ps == IEEE80211_PS_DISABLED ||
+		ieee->iw_mode != IW_MODE_INFRA ||
+		ieee->state != IEEE80211_LINKED)){
+
+	//	#warning CHECK_LOCK_HERE
+		spin_lock_irqsave(&ieee->mgmt_tx_lock, flags2);
+
+		ieee80211_sta_wakeup(ieee, 1);
+
+		spin_unlock_irqrestore(&ieee->mgmt_tx_lock, flags2);
+	}
+
+	sleep = ieee80211_sta_ps_sleep(ieee,&th, &tl);
+	/* 2 wake, 1 sleep, 0 do nothing */
+	if(sleep == 0)
+		goto out;
+
+	if(sleep == 1){
+
+		if(ieee->sta_sleep == 1)
+			ieee->enter_sleep_state(ieee->dev,th,tl);
+
+		else if(ieee->sta_sleep == 0){
+		//	printk("send null 1\n");
+			spin_lock_irqsave(&ieee->mgmt_tx_lock, flags2);
+
+			if(ieee->ps_is_queue_empty(ieee->dev)){
+
+
+				ieee->sta_sleep = 2;
+
+				ieee->ps_request_tx_ack(ieee->dev);
+
+				ieee80211_sta_ps_send_null_frame(ieee,1);
+
+				ieee->ps_th = th;
+				ieee->ps_tl = tl;
+			}
+			spin_unlock_irqrestore(&ieee->mgmt_tx_lock, flags2);
+
+		}
+
+
+	}else if(sleep == 2){
+//#warning CHECK_LOCK_HERE
+		spin_lock_irqsave(&ieee->mgmt_tx_lock, flags2);
+
+		ieee80211_sta_wakeup(ieee,1);
+
+		spin_unlock_irqrestore(&ieee->mgmt_tx_lock, flags2);
+	}
+
+out:
+	spin_unlock_irqrestore(&ieee->lock, flags);
+
+}
+
+void ieee80211_sta_wakeup(struct ieee80211_device *ieee, short nl)
+{
+	if(ieee->sta_sleep == 0){
+		if(nl){
+			printk("Warning: driver is probably failing to report TX ps error\n");
+			ieee->ps_request_tx_ack(ieee->dev);
+			ieee80211_sta_ps_send_null_frame(ieee, 0);
+		}
+		return;
+
+	}
+
+	if(ieee->sta_sleep == 1)
+		ieee->sta_wake_up(ieee->dev);
+
+	ieee->sta_sleep = 0;
+
+	if(nl){
+		ieee->ps_request_tx_ack(ieee->dev);
+		ieee80211_sta_ps_send_null_frame(ieee, 0);
+	}
+}
+
+void ieee80211_ps_tx_ack(struct ieee80211_device *ieee, short success)
+{
+	unsigned long flags,flags2;
+
+	spin_lock_irqsave(&ieee->lock, flags);
+
+	if(ieee->sta_sleep == 2){
+		/* Null frame with PS bit set */
+		if(success){
+			ieee->sta_sleep = 1;
+			ieee->enter_sleep_state(ieee->dev,ieee->ps_th,ieee->ps_tl);
+		}
+		/* if the card report not success we can't be sure the AP
+		 * has not RXed so we can't assume the AP believe us awake
+		 */
+	}
+	/* 21112005 - tx again null without PS bit if lost */
+	else {
+
+		if((ieee->sta_sleep == 0) && !success){
+			spin_lock_irqsave(&ieee->mgmt_tx_lock, flags2);
+			ieee80211_sta_ps_send_null_frame(ieee, 0);
+			spin_unlock_irqrestore(&ieee->mgmt_tx_lock, flags2);
+		}
+	}
+	spin_unlock_irqrestore(&ieee->lock, flags);
+}
+void ieee80211_process_action(struct ieee80211_device* ieee, struct sk_buff* skb)
+{
+	struct ieee80211_hdr* header = (struct ieee80211_hdr*)skb->data;
+	u8* act = ieee80211_get_payload(header);
+	u8 tmp = 0;
+//	IEEE80211_DEBUG_DATA(IEEE80211_DL_DATA|IEEE80211_DL_BA, skb->data, skb->len);
+	if (act == NULL)
+	{
+		IEEE80211_DEBUG(IEEE80211_DL_ERR, "error to get payload of action frame\n");
+		return;
+	}
+	tmp = *act;
+	act ++;
+	switch (tmp)
+	{
+		case ACT_CAT_BA:
+			if (*act == ACT_ADDBAREQ)
+			ieee80211_rx_ADDBAReq(ieee, skb);
+			else if (*act == ACT_ADDBARSP)
+			ieee80211_rx_ADDBARsp(ieee, skb);
+			else if (*act == ACT_DELBA)
+			ieee80211_rx_DELBA(ieee, skb);
+			break;
+		default:
+//			if (net_ratelimit())
+//			IEEE80211_DEBUG(IEEE80211_DL_BA, "unknown action frame(%d)\n", tmp);
+			break;
+	}
+	return;
+
+}
+inline int
+ieee80211_rx_frame_softmac(struct ieee80211_device *ieee, struct sk_buff *skb,
+			struct ieee80211_rx_stats *rx_stats, u16 type,
+			u16 stype)
+{
+	struct ieee80211_hdr_3addr *header = (struct ieee80211_hdr_3addr *) skb->data;
+	u16 errcode;
+	u8* challenge;
+	int chlen=0;
+	int aid;
+	struct ieee80211_assoc_response_frame *assoc_resp;
+//	struct ieee80211_info_element *info_element;
+	bool bSupportNmode = true, bHalfSupportNmode = false; //default support N mode, disable halfNmode
+
+	if(!ieee->proto_started)
+		return 0;
+
+	if(ieee->sta_sleep || (ieee->ps != IEEE80211_PS_DISABLED &&
+		ieee->iw_mode == IW_MODE_INFRA &&
+		ieee->state == IEEE80211_LINKED))
+
+		tasklet_schedule(&ieee->ps_task);
+
+	if(WLAN_FC_GET_STYPE(header->frame_ctl) != IEEE80211_STYPE_PROBE_RESP &&
+		WLAN_FC_GET_STYPE(header->frame_ctl) != IEEE80211_STYPE_BEACON)
+		ieee->last_rx_ps_time = jiffies;
+
+	switch (WLAN_FC_GET_STYPE(header->frame_ctl)) {
+
+		case IEEE80211_STYPE_ASSOC_RESP:
+		case IEEE80211_STYPE_REASSOC_RESP:
+
+			IEEE80211_DEBUG_MGMT("received [RE]ASSOCIATION RESPONSE (%d)\n",
+					WLAN_FC_GET_STYPE(header->frame_ctl));
+			if ((ieee->softmac_features & IEEE_SOFTMAC_ASSOCIATE) &&
+				ieee->state == IEEE80211_ASSOCIATING_AUTHENTICATED &&
+				ieee->iw_mode == IW_MODE_INFRA){
+				struct ieee80211_network network_resp;
+				struct ieee80211_network *network = &network_resp;
+
+				if (0 == (errcode=assoc_parse(ieee,skb, &aid))){
+					ieee->state=IEEE80211_LINKED;
+					ieee->assoc_id = aid;
+					ieee->softmac_stats.rx_ass_ok++;
+					/* station support qos */
+					/* Let the register setting defaultly with Legacy station */
+					if(ieee->qos_support) {
+						assoc_resp = (struct ieee80211_assoc_response_frame*)skb->data;
+						memset(network, 0, sizeof(*network));
+						if (ieee80211_parse_info_param(ieee,assoc_resp->info_element,\
+									rx_stats->len - sizeof(*assoc_resp),\
+									network,rx_stats)){
+							return 1;
+						}
+						else
+						{	//filling the PeerHTCap. //maybe not neccesary as we can get its info from current_network.
+							memcpy(ieee->pHTInfo->PeerHTCapBuf, network->bssht.bdHTCapBuf, network->bssht.bdHTCapLen);
+							memcpy(ieee->pHTInfo->PeerHTInfoBuf, network->bssht.bdHTInfoBuf, network->bssht.bdHTInfoLen);
+						}
+						if (ieee->handle_assoc_response != NULL)
+							ieee->handle_assoc_response(ieee->dev, (struct ieee80211_assoc_response_frame*)header, network);
+					}
+					ieee80211_associate_complete(ieee);
+				} else {
+					/* aid could not been allocated */
+					ieee->softmac_stats.rx_ass_err++;
+					printk(
+						"Association response status code 0x%x\n",
+						errcode);
+					IEEE80211_DEBUG_MGMT(
+						"Association response status code 0x%x\n",
+						errcode);
+					if(ieee->AsocRetryCount < RT_ASOC_RETRY_LIMIT) {
+						queue_work(ieee->wq, &ieee->associate_procedure_wq);
+					} else {
+						ieee80211_associate_abort(ieee);
+					}
+				}
+			}
+			break;
+
+		case IEEE80211_STYPE_ASSOC_REQ:
+		case IEEE80211_STYPE_REASSOC_REQ:
+
+			if ((ieee->softmac_features & IEEE_SOFTMAC_ASSOCIATE) &&
+				ieee->iw_mode == IW_MODE_MASTER)
+
+				ieee80211_rx_assoc_rq(ieee, skb);
+			break;
+
+		case IEEE80211_STYPE_AUTH:
+
+			if (ieee->softmac_features & IEEE_SOFTMAC_ASSOCIATE){
+				if (ieee->state == IEEE80211_ASSOCIATING_AUTHENTICATING &&
+				ieee->iw_mode == IW_MODE_INFRA){
+
+						IEEE80211_DEBUG_MGMT("Received authentication response");
+
+						if (0 == (errcode=auth_parse(skb, &challenge, &chlen))){
+							if(ieee->open_wep || !challenge){
+								ieee->state = IEEE80211_ASSOCIATING_AUTHENTICATED;
+								ieee->softmac_stats.rx_auth_rs_ok++;
+								if(!(ieee->pHTInfo->IOTAction&HT_IOT_ACT_PURE_N_MODE))
+								{
+									if (!ieee->GetNmodeSupportBySecCfg(ieee->dev))
+									{
+												// WEP or TKIP encryption
+										if(IsHTHalfNmodeAPs(ieee))
+										{
+											bSupportNmode = true;
+											bHalfSupportNmode = true;
+										}
+										else
+										{
+											bSupportNmode = false;
+											bHalfSupportNmode = false;
+										}
+									printk("==========>to link with AP using SEC(%d, %d)", bSupportNmode, bHalfSupportNmode);
+									}
+								}
+								/* Dummy wirless mode setting to avoid encryption issue */
+								if(bSupportNmode) {
+									//N mode setting
+									ieee->SetWirelessMode(ieee->dev, \
+											ieee->current_network.mode);
+								}else{
+									//b/g mode setting
+									/*TODO*/
+									ieee->SetWirelessMode(ieee->dev, IEEE_G);
+								}
+
+								if (ieee->current_network.mode == IEEE_N_24G && bHalfSupportNmode == true)
+								{
+									printk("===============>entern half N mode\n");
+									ieee->bHalfWirelessN24GMode = true;
+								}
+								else
+									ieee->bHalfWirelessN24GMode = false;
+
+								ieee80211_associate_step2(ieee);
+							}else{
+								ieee80211_auth_challenge(ieee, challenge, chlen);
+							}
+						}else{
+							ieee->softmac_stats.rx_auth_rs_err++;
+							IEEE80211_DEBUG_MGMT("Authentication respose status code 0x%x",errcode);
+							ieee80211_associate_abort(ieee);
+						}
+
+					}else if (ieee->iw_mode == IW_MODE_MASTER){
+						ieee80211_rx_auth_rq(ieee, skb);
+					}
+				}
+			break;
+
+		case IEEE80211_STYPE_PROBE_REQ:
+
+			if ((ieee->softmac_features & IEEE_SOFTMAC_PROBERS) &&
+				((ieee->iw_mode == IW_MODE_ADHOC ||
+				ieee->iw_mode == IW_MODE_MASTER) &&
+				ieee->state == IEEE80211_LINKED)){
+				ieee80211_rx_probe_rq(ieee, skb);
+			}
+			break;
+
+		case IEEE80211_STYPE_DISASSOC:
+		case IEEE80211_STYPE_DEAUTH:
+			/* FIXME for now repeat all the association procedure
+			* both for disassociation and deauthentication
+			*/
+			if ((ieee->softmac_features & IEEE_SOFTMAC_ASSOCIATE) &&
+				ieee->state == IEEE80211_LINKED &&
+				ieee->iw_mode == IW_MODE_INFRA){
+
+				ieee->state = IEEE80211_ASSOCIATING;
+				ieee->softmac_stats.reassoc++;
+
+				notify_wx_assoc_event(ieee);
+				//HTSetConnectBwMode(ieee, HT_CHANNEL_WIDTH_20, HT_EXTCHNL_OFFSET_NO_EXT);
+				RemovePeerTS(ieee, header->addr2);
+				queue_work(ieee->wq, &ieee->associate_procedure_wq);
+			}
+			break;
+		case IEEE80211_STYPE_MANAGE_ACT:
+			ieee80211_process_action(ieee,skb);
+			break;
+		default:
+			return -1;
+			break;
+	}
+
+	//dev_kfree_skb_any(skb);
+	return 0;
+}
+
+/* following are for a simplier TX queue management.
+ * Instead of using netif_[stop/wake]_queue the driver
+ * will uses these two function (plus a reset one), that
+ * will internally uses the kernel netif_* and takes
+ * care of the ieee802.11 fragmentation.
+ * So the driver receives a fragment per time and might
+ * call the stop function when it want without take care
+ * to have enought room to TX an entire packet.
+ * This might be useful if each fragment need it's own
+ * descriptor, thus just keep a total free memory > than
+ * the max fragmentation treshold is not enought.. If the
+ * ieee802.11 stack passed a TXB struct then you needed
+ * to keep N free descriptors where
+ * N = MAX_PACKET_SIZE / MIN_FRAG_TRESHOLD
+ * In this way you need just one and the 802.11 stack
+ * will take care of buffering fragments and pass them to
+ * to the driver later, when it wakes the queue.
+ */
+void ieee80211_softmac_xmit(struct ieee80211_txb *txb, struct ieee80211_device *ieee)
+{
+
+	unsigned int queue_index = txb->queue_index;
+	unsigned long flags;
+	int  i;
+	cb_desc *tcb_desc = NULL;
+
+	spin_lock_irqsave(&ieee->lock,flags);
+
+	/* called with 2nd parm 0, no tx mgmt lock required */
+	ieee80211_sta_wakeup(ieee,0);
+
+	/* update the tx status */
+	ieee->stats.tx_bytes += txb->payload_size;
+	ieee->stats.tx_packets++;
+	tcb_desc = (cb_desc *)(txb->fragments[0]->cb + MAX_DEV_ADDR_SIZE);
+	if(tcb_desc->bMulticast) {
+		ieee->stats.multicast++;
+	}
+	/* if xmit available, just xmit it immediately, else just insert it to the wait queue */
+	for(i = 0; i < txb->nr_frags; i++) {
+#ifdef USB_TX_DRIVER_AGGREGATION_ENABLE
+		if ((skb_queue_len(&ieee->skb_drv_aggQ[queue_index]) != 0) ||
+#else
+		if ((skb_queue_len(&ieee->skb_waitQ[queue_index]) != 0) ||
+#endif
+		(!ieee->check_nic_enough_desc(ieee->dev,queue_index))||\
+		     (ieee->queue_stop)) {
+			/* insert the skb packet to the wait queue */
+			/* as for the completion function, it does not need
+			 * to check it any more.
+			 * */
+			//printk("error:no descriptor left@queue_index %d\n", queue_index);
+			//ieee80211_stop_queue(ieee);
+#ifdef USB_TX_DRIVER_AGGREGATION_ENABLE
+			skb_queue_tail(&ieee->skb_drv_aggQ[queue_index], txb->fragments[i]);
+#else
+			skb_queue_tail(&ieee->skb_waitQ[queue_index], txb->fragments[i]);
+#endif
+		}else{
+			ieee->softmac_data_hard_start_xmit(
+					txb->fragments[i],
+					ieee->dev,ieee->rate);
+			//ieee->stats.tx_packets++;
+			//ieee->stats.tx_bytes += txb->fragments[i]->len;
+			//ieee->dev->trans_start = jiffies;
+		}
+	}
+	ieee80211_txb_free(txb);
+
+//exit:
+	spin_unlock_irqrestore(&ieee->lock,flags);
+
+}
+
+/* called with ieee->lock acquired */
+void ieee80211_resume_tx(struct ieee80211_device *ieee)
+{
+	int i;
+	for(i = ieee->tx_pending.frag; i < ieee->tx_pending.txb->nr_frags; i++) {
+
+		if (ieee->queue_stop){
+			ieee->tx_pending.frag = i;
+			return;
+		}else{
+
+			ieee->softmac_data_hard_start_xmit(
+				ieee->tx_pending.txb->fragments[i],
+				ieee->dev,ieee->rate);
+				//(i+1)<ieee->tx_pending.txb->nr_frags);
+			ieee->stats.tx_packets++;
+			ieee->dev->trans_start = jiffies;
+		}
+	}
+
+
+	ieee80211_txb_free(ieee->tx_pending.txb);
+	ieee->tx_pending.txb = NULL;
+}
+
+
+void ieee80211_reset_queue(struct ieee80211_device *ieee)
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(&ieee->lock,flags);
+	init_mgmt_queue(ieee);
+	if (ieee->tx_pending.txb){
+		ieee80211_txb_free(ieee->tx_pending.txb);
+		ieee->tx_pending.txb = NULL;
+	}
+	ieee->queue_stop = 0;
+	spin_unlock_irqrestore(&ieee->lock,flags);
+
+}
+
+void ieee80211_wake_queue(struct ieee80211_device *ieee)
+{
+
+	unsigned long flags;
+	struct sk_buff *skb;
+	struct ieee80211_hdr_3addr  *header;
+
+	spin_lock_irqsave(&ieee->lock,flags);
+	if (! ieee->queue_stop) goto exit;
+
+	ieee->queue_stop = 0;
+
+	if(ieee->softmac_features & IEEE_SOFTMAC_SINGLE_QUEUE){
+		while (!ieee->queue_stop && (skb = dequeue_mgmt(ieee))){
+
+			header = (struct ieee80211_hdr_3addr  *) skb->data;
+
+			header->seq_ctl = cpu_to_le16(ieee->seq_ctrl[0] << 4);
+
+			if (ieee->seq_ctrl[0] == 0xFFF)
+				ieee->seq_ctrl[0] = 0;
+			else
+				ieee->seq_ctrl[0]++;
+
+			ieee->softmac_data_hard_start_xmit(skb,ieee->dev,ieee->basic_rate);
+			//dev_kfree_skb_any(skb);//edit by thomas
+		}
+	}
+	if (!ieee->queue_stop && ieee->tx_pending.txb)
+		ieee80211_resume_tx(ieee);
+
+	if (!ieee->queue_stop && netif_queue_stopped(ieee->dev)){
+		ieee->softmac_stats.swtxawake++;
+		netif_wake_queue(ieee->dev);
+	}
+
+exit :
+	spin_unlock_irqrestore(&ieee->lock,flags);
+}
+
+
+void ieee80211_stop_queue(struct ieee80211_device *ieee)
+{
+	//unsigned long flags;
+	//spin_lock_irqsave(&ieee->lock,flags);
+
+	if (! netif_queue_stopped(ieee->dev)){
+		netif_stop_queue(ieee->dev);
+		ieee->softmac_stats.swtxstop++;
+	}
+	ieee->queue_stop = 1;
+	//spin_unlock_irqrestore(&ieee->lock,flags);
+
+}
+
+
+inline void ieee80211_randomize_cell(struct ieee80211_device *ieee)
+{
+
+	get_random_bytes(ieee->current_network.bssid, ETH_ALEN);
+
+	/* an IBSS cell address must have the two less significant
+	 * bits of the first byte = 2
+	 */
+	ieee->current_network.bssid[0] &= ~0x01;
+	ieee->current_network.bssid[0] |= 0x02;
+}
+
+/* called in user context only */
+void ieee80211_start_master_bss(struct ieee80211_device *ieee)
+{
+	ieee->assoc_id = 1;
+
+	if (ieee->current_network.ssid_len == 0){
+		strncpy(ieee->current_network.ssid,
+			IEEE80211_DEFAULT_TX_ESSID,
+			IW_ESSID_MAX_SIZE);
+
+		ieee->current_network.ssid_len = strlen(IEEE80211_DEFAULT_TX_ESSID);
+		ieee->ssid_set = 1;
+	}
+
+	memcpy(ieee->current_network.bssid, ieee->dev->dev_addr, ETH_ALEN);
+
+	ieee->set_chan(ieee->dev, ieee->current_network.channel);
+	ieee->state = IEEE80211_LINKED;
+	ieee->link_change(ieee->dev);
+	notify_wx_assoc_event(ieee);
+
+	if (ieee->data_hard_resume)
+		ieee->data_hard_resume(ieee->dev);
+
+	netif_carrier_on(ieee->dev);
+}
+
+void ieee80211_start_monitor_mode(struct ieee80211_device *ieee)
+{
+	if(ieee->raw_tx){
+
+		if (ieee->data_hard_resume)
+			ieee->data_hard_resume(ieee->dev);
+
+		netif_carrier_on(ieee->dev);
+	}
+}
+void ieee80211_start_ibss_wq(struct work_struct *work)
+{
+
+	struct delayed_work *dwork = container_of(work, struct delayed_work, work);
+	struct ieee80211_device *ieee = container_of(dwork, struct ieee80211_device, start_ibss_wq);
+	/* iwconfig mode ad-hoc will schedule this and return
+	 * on the other hand this will block further iwconfig SET
+	 * operations because of the wx_sem hold.
+	 * Anyway some most set operations set a flag to speed-up
+	 * (abort) this wq (when syncro scanning) before sleeping
+	 * on the semaphore
+	 */
+	if(!ieee->proto_started){
+		printk("==========oh driver down return\n");
+		return;
+	}
+	down(&ieee->wx_sem);
+
+	if (ieee->current_network.ssid_len == 0){
+		strcpy(ieee->current_network.ssid,IEEE80211_DEFAULT_TX_ESSID);
+		ieee->current_network.ssid_len = strlen(IEEE80211_DEFAULT_TX_ESSID);
+		ieee->ssid_set = 1;
+	}
+
+	/* check if we have this cell in our network list */
+	ieee80211_softmac_check_all_nets(ieee);
+
+
+#ifdef ENABLE_DOT11D //if creating an ad-hoc, set its channel to 10 temporarily--this is the requirement for ASUS, not 11D, so disable 11d.
+//	if((IS_DOT11D_ENABLE(ieee)) && (ieee->state == IEEE80211_NOLINK))
+	if (ieee->state == IEEE80211_NOLINK)
+		ieee->current_network.channel = 6;
+#endif
+	/* if not then the state is not linked. Maybe the user swithced to
+	 * ad-hoc mode just after being in monitor mode, or just after
+	 * being very few time in managed mode (so the card have had no
+	 * time to scan all the chans..) or we have just run up the iface
+	 * after setting ad-hoc mode. So we have to give another try..
+	 * Here, in ibss mode, should be safe to do this without extra care
+	 * (in bss mode we had to make sure no-one tryed to associate when
+	 * we had just checked the ieee->state and we was going to start the
+	 * scan) beacause in ibss mode the ieee80211_new_net function, when
+	 * finds a good net, just set the ieee->state to IEEE80211_LINKED,
+	 * so, at worst, we waste a bit of time to initiate an unneeded syncro
+	 * scan, that will stop at the first round because it sees the state
+	 * associated.
+	 */
+	if (ieee->state == IEEE80211_NOLINK)
+		ieee80211_start_scan_syncro(ieee);
+
+	/* the network definitively is not here.. create a new cell */
+	if (ieee->state == IEEE80211_NOLINK){
+		printk("creating new IBSS cell\n");
+		if(!ieee->wap_set)
+			ieee80211_randomize_cell(ieee);
+
+		if(ieee->modulation & IEEE80211_CCK_MODULATION){
+
+			ieee->current_network.rates_len = 4;
+
+			ieee->current_network.rates[0] = IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_1MB;
+			ieee->current_network.rates[1] = IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_2MB;
+			ieee->current_network.rates[2] = IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_5MB;
+			ieee->current_network.rates[3] = IEEE80211_BASIC_RATE_MASK | IEEE80211_CCK_RATE_11MB;
+
+		}else
+			ieee->current_network.rates_len = 0;
+
+		if(ieee->modulation & IEEE80211_OFDM_MODULATION){
+			ieee->current_network.rates_ex_len = 8;
+
+			ieee->current_network.rates_ex[0] = IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_6MB;
+			ieee->current_network.rates_ex[1] = IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_9MB;
+			ieee->current_network.rates_ex[2] = IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_12MB;
+			ieee->current_network.rates_ex[3] = IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_18MB;
+			ieee->current_network.rates_ex[4] = IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_24MB;
+			ieee->current_network.rates_ex[5] = IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_36MB;
+			ieee->current_network.rates_ex[6] = IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_48MB;
+			ieee->current_network.rates_ex[7] = IEEE80211_BASIC_RATE_MASK | IEEE80211_OFDM_RATE_54MB;
+
+			ieee->rate = 108;
+		}else{
+			ieee->current_network.rates_ex_len = 0;
+			ieee->rate = 22;
+		}
+
+		// By default, WMM function will be disabled in IBSS mode
+		ieee->current_network.QoS_Enable = 0;
+		ieee->SetWirelessMode(ieee->dev, IEEE_G);
+		ieee->current_network.atim_window = 0;
+		ieee->current_network.capability = WLAN_CAPABILITY_IBSS;
+		if(ieee->short_slot)
+			ieee->current_network.capability |= WLAN_CAPABILITY_SHORT_SLOT;
+
+	}
+
+	ieee->state = IEEE80211_LINKED;
+
+	ieee->set_chan(ieee->dev, ieee->current_network.channel);
+	ieee->link_change(ieee->dev);
+
+	notify_wx_assoc_event(ieee);
+
+	ieee80211_start_send_beacons(ieee);
+
+	if (ieee->data_hard_resume)
+		ieee->data_hard_resume(ieee->dev);
+	netif_carrier_on(ieee->dev);
+
+	up(&ieee->wx_sem);
+}
+
+inline void ieee80211_start_ibss(struct ieee80211_device *ieee)
+{
+	queue_delayed_work(ieee->wq, &ieee->start_ibss_wq, 150);
+}
+
+/* this is called only in user context, with wx_sem held */
+void ieee80211_start_bss(struct ieee80211_device *ieee)
+{
+	unsigned long flags;
+#ifdef ENABLE_DOT11D
+	//
+	// Ref: 802.11d 11.1.3.3
+	// STA shall not start a BSS unless properly formed Beacon frame including a Country IE.
+	//
+	if(IS_DOT11D_ENABLE(ieee) && !IS_COUNTRY_IE_VALID(ieee))
+	{
+		if(! ieee->bGlobalDomain)
+		{
+			return;
+		}
+	}
+#endif
+	/* check if we have already found the net we
+	 * are interested in (if any).
+	 * if not (we are disassociated and we are not
+	 * in associating / authenticating phase) start the background scanning.
+	 */
+	ieee80211_softmac_check_all_nets(ieee);
+
+	/* ensure no-one start an associating process (thus setting
+	 * the ieee->state to ieee80211_ASSOCIATING) while we
+	 * have just cheked it and we are going to enable scan.
+	 * The ieee80211_new_net function is always called with
+	 * lock held (from both ieee80211_softmac_check_all_nets and
+	 * the rx path), so we cannot be in the middle of such function
+	 */
+	spin_lock_irqsave(&ieee->lock, flags);
+
+	if (ieee->state == IEEE80211_NOLINK){
+		ieee->actscanning = true;
+		ieee80211_start_scan(ieee);
+	}
+	spin_unlock_irqrestore(&ieee->lock, flags);
+}
+
+/* called only in userspace context */
+void ieee80211_disassociate(struct ieee80211_device *ieee)
+{
+
+
+	netif_carrier_off(ieee->dev);
+	if (ieee->softmac_features & IEEE_SOFTMAC_TX_QUEUE)
+			ieee80211_reset_queue(ieee);
+
+	if (ieee->data_hard_stop)
+			ieee->data_hard_stop(ieee->dev);
+#ifdef ENABLE_DOT11D
+	if(IS_DOT11D_ENABLE(ieee))
+		Dot11d_Reset(ieee);
+#endif
+	ieee->state = IEEE80211_NOLINK;
+	ieee->is_set_key = false;
+	ieee->link_change(ieee->dev);
+	//HTSetConnectBwMode(ieee, HT_CHANNEL_WIDTH_20, HT_EXTCHNL_OFFSET_NO_EXT);
+	notify_wx_assoc_event(ieee);
+
+}
+void ieee80211_associate_retry_wq(struct work_struct *work)
+{
+        struct delayed_work *dwork = container_of(work, struct delayed_work, work);
+        struct ieee80211_device *ieee = container_of(dwork, struct ieee80211_device, associate_retry_wq);
+	unsigned long flags;
+
+	down(&ieee->wx_sem);
+	if(!ieee->proto_started)
+		goto exit;
+
+	if(ieee->state != IEEE80211_ASSOCIATING_RETRY)
+		goto exit;
+
+	/* until we do not set the state to IEEE80211_NOLINK
+	* there are no possibility to have someone else trying
+	* to start an association procdure (we get here with
+	* ieee->state = IEEE80211_ASSOCIATING).
+	* When we set the state to IEEE80211_NOLINK it is possible
+	* that the RX path run an attempt to associate, but
+	* both ieee80211_softmac_check_all_nets and the
+	* RX path works with ieee->lock held so there are no
+	* problems. If we are still disassociated then start a scan.
+	* the lock here is necessary to ensure no one try to start
+	* an association procedure when we have just checked the
+	* state and we are going to start the scan.
+	*/
+	ieee->state = IEEE80211_NOLINK;
+
+	ieee80211_softmac_check_all_nets(ieee);
+
+	spin_lock_irqsave(&ieee->lock, flags);
+
+	if(ieee->state == IEEE80211_NOLINK)
+		ieee80211_start_scan(ieee);
+
+	spin_unlock_irqrestore(&ieee->lock, flags);
+
+exit:
+	up(&ieee->wx_sem);
+}
+
+struct sk_buff *ieee80211_get_beacon_(struct ieee80211_device *ieee)
+{
+	u8 broadcast_addr[] = {0xff,0xff,0xff,0xff,0xff,0xff};
+
+	struct sk_buff *skb;
+	struct ieee80211_probe_response *b;
+
+	skb = ieee80211_probe_resp(ieee, broadcast_addr);
+
+	if (!skb)
+		return NULL;
+
+	b = (struct ieee80211_probe_response *) skb->data;
+	b->header.frame_ctl = cpu_to_le16(IEEE80211_STYPE_BEACON);
+
+	return skb;
+
+}
+
+struct sk_buff *ieee80211_get_beacon(struct ieee80211_device *ieee)
+{
+	struct sk_buff *skb;
+	struct ieee80211_probe_response *b;
+
+	skb = ieee80211_get_beacon_(ieee);
+	if(!skb)
+		return NULL;
+
+	b = (struct ieee80211_probe_response *) skb->data;
+	b->header.seq_ctl = cpu_to_le16(ieee->seq_ctrl[0] << 4);
+
+	if (ieee->seq_ctrl[0] == 0xFFF)
+		ieee->seq_ctrl[0] = 0;
+	else
+		ieee->seq_ctrl[0]++;
+
+	return skb;
+}
+
+void ieee80211_softmac_stop_protocol(struct ieee80211_device *ieee)
+{
+	ieee->sync_scan_hurryup = 1;
+	down(&ieee->wx_sem);
+	ieee80211_stop_protocol(ieee);
+	up(&ieee->wx_sem);
+}
+
+
+void ieee80211_stop_protocol(struct ieee80211_device *ieee)
+{
+	if (!ieee->proto_started)
+		return;
+
+	ieee->proto_started = 0;
+
+	ieee80211_stop_send_beacons(ieee);
+	del_timer_sync(&ieee->associate_timer);
+	cancel_delayed_work(&ieee->associate_retry_wq);
+	cancel_delayed_work(&ieee->start_ibss_wq);
+	ieee80211_stop_scan(ieee);
+
+	ieee80211_disassociate(ieee);
+	RemoveAllTS(ieee); //added as we disconnect from the previous BSS, Remove all TS
+}
+
+void ieee80211_softmac_start_protocol(struct ieee80211_device *ieee)
+{
+	ieee->sync_scan_hurryup = 0;
+	down(&ieee->wx_sem);
+	ieee80211_start_protocol(ieee);
+	up(&ieee->wx_sem);
+}
+
+void ieee80211_start_protocol(struct ieee80211_device *ieee)
+{
+	short ch = 0;
+	int i = 0;
+	if (ieee->proto_started)
+		return;
+
+	ieee->proto_started = 1;
+
+	if (ieee->current_network.channel == 0){
+		do{
+			ch++;
+			if (ch > MAX_CHANNEL_NUMBER)
+				return; /* no channel found */
+#ifdef ENABLE_DOT11D
+		}while(!GET_DOT11D_INFO(ieee)->channel_map[ch]);
+#else
+		}while(!ieee->channel_map[ch]);
+#endif
+		ieee->current_network.channel = ch;
+	}
+
+	if (ieee->current_network.beacon_interval == 0)
+		ieee->current_network.beacon_interval = 100;
+//	printk("===>%s(), chan:%d\n", __FUNCTION__, ieee->current_network.channel);
+//	ieee->set_chan(ieee->dev,ieee->current_network.channel);
+
+	for(i = 0; i < 17; i++) {
+	  ieee->last_rxseq_num[i] = -1;
+	  ieee->last_rxfrag_num[i] = -1;
+	  ieee->last_packet_time[i] = 0;
+	}
+
+	ieee->init_wmmparam_flag = 0;//reinitialize AC_xx_PARAM registers.
+
+
+	/* if the user set the MAC of the ad-hoc cell and then
+	 * switch to managed mode, shall we  make sure that association
+	 * attempts does not fail just because the user provide the essid
+	 * and the nic is still checking for the AP MAC ??
+	 */
+	if (ieee->iw_mode == IW_MODE_INFRA)
+		ieee80211_start_bss(ieee);
+
+	else if (ieee->iw_mode == IW_MODE_ADHOC)
+		ieee80211_start_ibss(ieee);
+
+	else if (ieee->iw_mode == IW_MODE_MASTER)
+		ieee80211_start_master_bss(ieee);
+
+	else if(ieee->iw_mode == IW_MODE_MONITOR)
+		ieee80211_start_monitor_mode(ieee);
+}
+
+
+#define DRV_NAME  "Ieee80211"
+void ieee80211_softmac_init(struct ieee80211_device *ieee)
+{
+	int i;
+	memset(&ieee->current_network, 0, sizeof(struct ieee80211_network));
+
+	ieee->state = IEEE80211_NOLINK;
+	ieee->sync_scan_hurryup = 0;
+	for(i = 0; i < 5; i++) {
+	  ieee->seq_ctrl[i] = 0;
+	}
+#ifdef ENABLE_DOT11D
+	ieee->pDot11dInfo = kmalloc(sizeof(RT_DOT11D_INFO), GFP_ATOMIC);
+	if (!ieee->pDot11dInfo)
+		IEEE80211_DEBUG(IEEE80211_DL_ERR, "can't alloc memory for DOT11D\n");
+	memset(ieee->pDot11dInfo, 0, sizeof(RT_DOT11D_INFO));
+#endif
+	//added for  AP roaming
+	ieee->LinkDetectInfo.SlotNum = 2;
+	ieee->LinkDetectInfo.NumRecvBcnInPeriod=0;
+	ieee->LinkDetectInfo.NumRecvDataInPeriod=0;
+
+	ieee->assoc_id = 0;
+	ieee->queue_stop = 0;
+	ieee->scanning = 0;
+	ieee->softmac_features = 0; //so IEEE2100-like driver are happy
+	ieee->wap_set = 0;
+	ieee->ssid_set = 0;
+	ieee->proto_started = 0;
+	ieee->basic_rate = IEEE80211_DEFAULT_BASIC_RATE;
+	ieee->rate = 22;
+	ieee->ps = IEEE80211_PS_DISABLED;
+	ieee->sta_sleep = 0;
+	ieee->Regdot11HTOperationalRateSet[0]= 0xff;//support MCS 0~7
+	ieee->Regdot11HTOperationalRateSet[1]= 0xff;//support MCS 8~15
+	ieee->Regdot11HTOperationalRateSet[4]= 0x01;
+	//added by amy
+	ieee->actscanning = false;
+	ieee->beinretry = false;
+	ieee->is_set_key = false;
+	init_mgmt_queue(ieee);
+
+	ieee->sta_edca_param[0] = 0x0000A403;
+	ieee->sta_edca_param[1] = 0x0000A427;
+	ieee->sta_edca_param[2] = 0x005E4342;
+	ieee->sta_edca_param[3] = 0x002F3262;
+	ieee->aggregation = true;
+	ieee->enable_rx_imm_BA = 1;
+	ieee->tx_pending.txb = NULL;
+
+	init_timer(&ieee->associate_timer);
+	ieee->associate_timer.data = (unsigned long)ieee;
+	ieee->associate_timer.function = ieee80211_associate_abort_cb;
+
+	init_timer(&ieee->beacon_timer);
+	ieee->beacon_timer.data = (unsigned long) ieee;
+	ieee->beacon_timer.function = ieee80211_send_beacon_cb;
+
+#ifdef PF_SYNCTHREAD
+	ieee->wq = create_workqueue(DRV_NAME,0);
+#else
+	ieee->wq = create_workqueue(DRV_NAME);
+#endif
+
+	INIT_DELAYED_WORK(&ieee->start_ibss_wq,ieee80211_start_ibss_wq);
+	INIT_WORK(&ieee->associate_complete_wq, ieee80211_associate_complete_wq);
+	INIT_WORK(&ieee->associate_procedure_wq, ieee80211_associate_procedure_wq);
+	INIT_DELAYED_WORK(&ieee->softmac_scan_wq,ieee80211_softmac_scan_wq);
+	INIT_DELAYED_WORK(&ieee->associate_retry_wq, ieee80211_associate_retry_wq);
+	INIT_WORK(&ieee->wx_sync_scan_wq,ieee80211_wx_sync_scan_wq);
+
+
+	sema_init(&ieee->wx_sem, 1);
+	sema_init(&ieee->scan_sem, 1);
+
+	spin_lock_init(&ieee->mgmt_tx_lock);
+	spin_lock_init(&ieee->beacon_lock);
+
+	tasklet_init(&ieee->ps_task,
+	     (void(*)(unsigned long)) ieee80211_sta_ps,
+	     (unsigned long)ieee);
+
+}
+
+void ieee80211_softmac_free(struct ieee80211_device *ieee)
+{
+	down(&ieee->wx_sem);
+#ifdef ENABLE_DOT11D
+	if(NULL != ieee->pDot11dInfo)
+	{
+		kfree(ieee->pDot11dInfo);
+		ieee->pDot11dInfo = NULL;
+	}
+#endif
+	del_timer_sync(&ieee->associate_timer);
+
+	cancel_delayed_work(&ieee->associate_retry_wq);
+	destroy_workqueue(ieee->wq);
+
+	up(&ieee->wx_sem);
+}
+
+/********************************************************
+ * Start of WPA code.                                   *
+ * this is stolen from the ipw2200 driver               *
+ ********************************************************/
+
+
+static int ieee80211_wpa_enable(struct ieee80211_device *ieee, int value)
+{
+	/* This is called when wpa_supplicant loads and closes the driver
+	 * interface. */
+	printk("%s WPA\n",value ? "enabling" : "disabling");
+	ieee->wpa_enabled = value;
+	return 0;
+}
+
+
+void ieee80211_wpa_assoc_frame(struct ieee80211_device *ieee, char *wpa_ie, int wpa_ie_len)
+{
+	/* make sure WPA is enabled */
+	ieee80211_wpa_enable(ieee, 1);
+
+	ieee80211_disassociate(ieee);
+}
+
+
+static int ieee80211_wpa_mlme(struct ieee80211_device *ieee, int command, int reason)
+{
+
+	int ret = 0;
+
+	switch (command) {
+	case IEEE_MLME_STA_DEAUTH:
+		// silently ignore
+		break;
+
+	case IEEE_MLME_STA_DISASSOC:
+		ieee80211_disassociate(ieee);
+		break;
+
+	default:
+		printk("Unknown MLME request: %d\n", command);
+		ret = -EOPNOTSUPP;
+	}
+
+	return ret;
+}
+
+
+static int ieee80211_wpa_set_wpa_ie(struct ieee80211_device *ieee,
+			      struct ieee_param *param, int plen)
+{
+	u8 *buf;
+
+	if (param->u.wpa_ie.len > MAX_WPA_IE_LEN ||
+	    (param->u.wpa_ie.len && param->u.wpa_ie.data == NULL))
+		return -EINVAL;
+
+	if (param->u.wpa_ie.len) {
+		buf = kmalloc(param->u.wpa_ie.len, GFP_KERNEL);
+		if (buf == NULL)
+			return -ENOMEM;
+
+		memcpy(buf, param->u.wpa_ie.data, param->u.wpa_ie.len);
+		kfree(ieee->wpa_ie);
+		ieee->wpa_ie = buf;
+		ieee->wpa_ie_len = param->u.wpa_ie.len;
+	} else {
+		kfree(ieee->wpa_ie);
+		ieee->wpa_ie = NULL;
+		ieee->wpa_ie_len = 0;
+	}
+
+	ieee80211_wpa_assoc_frame(ieee, ieee->wpa_ie, ieee->wpa_ie_len);
+	return 0;
+}
+
+#define AUTH_ALG_OPEN_SYSTEM			0x1
+#define AUTH_ALG_SHARED_KEY			0x2
+
+static int ieee80211_wpa_set_auth_algs(struct ieee80211_device *ieee, int value)
+{
+
+	struct ieee80211_security sec = {
+		.flags = SEC_AUTH_MODE,
+	};
+	int ret = 0;
+
+	if (value & AUTH_ALG_SHARED_KEY) {
+		sec.auth_mode = WLAN_AUTH_SHARED_KEY;
+		ieee->open_wep = 0;
+		ieee->auth_mode = 1;
+	} else if (value & AUTH_ALG_OPEN_SYSTEM){
+		sec.auth_mode = WLAN_AUTH_OPEN;
+		ieee->open_wep = 1;
+		ieee->auth_mode = 0;
+	}
+	else if (value & IW_AUTH_ALG_LEAP){
+		sec.auth_mode = WLAN_AUTH_LEAP;
+		ieee->open_wep = 1;
+		ieee->auth_mode = 2;
+	}
+
+
+	if (ieee->set_security)
+		ieee->set_security(ieee->dev, &sec);
+	//else
+	//	ret = -EOPNOTSUPP;
+
+	return ret;
+}
+
+static int ieee80211_wpa_set_param(struct ieee80211_device *ieee, u8 name, u32 value)
+{
+	int ret=0;
+	unsigned long flags;
+
+	switch (name) {
+	case IEEE_PARAM_WPA_ENABLED:
+		ret = ieee80211_wpa_enable(ieee, value);
+		break;
+
+	case IEEE_PARAM_TKIP_COUNTERMEASURES:
+		ieee->tkip_countermeasures=value;
+		break;
+
+	case IEEE_PARAM_DROP_UNENCRYPTED: {
+		/* HACK:
+		 *
+		 * wpa_supplicant calls set_wpa_enabled when the driver
+		 * is loaded and unloaded, regardless of if WPA is being
+		 * used.  No other calls are made which can be used to
+		 * determine if encryption will be used or not prior to
+		 * association being expected.  If encryption is not being
+		 * used, drop_unencrypted is set to false, else true -- we
+		 * can use this to determine if the CAP_PRIVACY_ON bit should
+		 * be set.
+		 */
+		struct ieee80211_security sec = {
+			.flags = SEC_ENABLED,
+			.enabled = value,
+		};
+		ieee->drop_unencrypted = value;
+		/* We only change SEC_LEVEL for open mode. Others
+		 * are set by ipw_wpa_set_encryption.
+		 */
+		if (!value) {
+			sec.flags |= SEC_LEVEL;
+			sec.level = SEC_LEVEL_0;
+		}
+		else {
+			sec.flags |= SEC_LEVEL;
+			sec.level = SEC_LEVEL_1;
+		}
+		if (ieee->set_security)
+			ieee->set_security(ieee->dev, &sec);
+		break;
+	}
+
+	case IEEE_PARAM_PRIVACY_INVOKED:
+		ieee->privacy_invoked=value;
+		break;
+
+	case IEEE_PARAM_AUTH_ALGS:
+		ret = ieee80211_wpa_set_auth_algs(ieee, value);
+		break;
+
+	case IEEE_PARAM_IEEE_802_1X:
+		ieee->ieee802_1x=value;
+		break;
+	case IEEE_PARAM_WPAX_SELECT:
+		// added for WPA2 mixed mode
+		spin_lock_irqsave(&ieee->wpax_suitlist_lock,flags);
+		ieee->wpax_type_set = 1;
+		ieee->wpax_type_notify = value;
+		spin_unlock_irqrestore(&ieee->wpax_suitlist_lock,flags);
+		break;
+
+	default:
+		printk("Unknown WPA param: %d\n",name);
+		ret = -EOPNOTSUPP;
+	}
+
+	return ret;
+}
+
+/* implementation borrowed from hostap driver */
+
+static int ieee80211_wpa_set_encryption(struct ieee80211_device *ieee,
+				  struct ieee_param *param, int param_len)
+{
+	int ret = 0;
+
+	struct ieee80211_crypto_ops *ops;
+	struct ieee80211_crypt_data **crypt;
+
+	struct ieee80211_security sec = {
+		.flags = 0,
+	};
+
+	param->u.crypt.err = 0;
+	param->u.crypt.alg[IEEE_CRYPT_ALG_NAME_LEN - 1] = '\0';
+
+	if (param_len !=
+	    (int) ((char *) param->u.crypt.key - (char *) param) +
+	    param->u.crypt.key_len) {
+		printk("Len mismatch %d, %d\n", param_len,
+			       param->u.crypt.key_len);
+		return -EINVAL;
+	}
+	if (param->sta_addr[0] == 0xff && param->sta_addr[1] == 0xff &&
+	    param->sta_addr[2] == 0xff && param->sta_addr[3] == 0xff &&
+	    param->sta_addr[4] == 0xff && param->sta_addr[5] == 0xff) {
+		if (param->u.crypt.idx >= WEP_KEYS)
+			return -EINVAL;
+		crypt = &ieee->crypt[param->u.crypt.idx];
+	} else {
+		return -EINVAL;
+	}
+
+	if (strcmp(param->u.crypt.alg, "none") == 0) {
+		if (crypt) {
+			sec.enabled = 0;
+			// FIXME FIXME
+			//sec.encrypt = 0;
+			sec.level = SEC_LEVEL_0;
+			sec.flags |= SEC_ENABLED | SEC_LEVEL;
+			ieee80211_crypt_delayed_deinit(ieee, crypt);
+		}
+		goto done;
+	}
+	sec.enabled = 1;
+// FIXME FIXME
+//	sec.encrypt = 1;
+	sec.flags |= SEC_ENABLED;
+
+	/* IPW HW cannot build TKIP MIC, host decryption still needed. */
+	if (!(ieee->host_encrypt || ieee->host_decrypt) &&
+	    strcmp(param->u.crypt.alg, "TKIP"))
+		goto skip_host_crypt;
+
+	ops = ieee80211_get_crypto_ops(param->u.crypt.alg);
+	if (ops == NULL && strcmp(param->u.crypt.alg, "WEP") == 0) {
+		request_module("ieee80211_crypt_wep");
+		ops = ieee80211_get_crypto_ops(param->u.crypt.alg);
+		//set WEP40 first, it will be modified according to WEP104 or WEP40 at other place
+	} else if (ops == NULL && strcmp(param->u.crypt.alg, "TKIP") == 0) {
+		request_module("ieee80211_crypt_tkip");
+		ops = ieee80211_get_crypto_ops(param->u.crypt.alg);
+	} else if (ops == NULL && strcmp(param->u.crypt.alg, "CCMP") == 0) {
+		request_module("ieee80211_crypt_ccmp");
+		ops = ieee80211_get_crypto_ops(param->u.crypt.alg);
+	}
+	if (ops == NULL) {
+		printk("unknown crypto alg '%s'\n", param->u.crypt.alg);
+		param->u.crypt.err = IEEE_CRYPT_ERR_UNKNOWN_ALG;
+		ret = -EINVAL;
+		goto done;
+	}
+
+	if (*crypt == NULL || (*crypt)->ops != ops) {
+		struct ieee80211_crypt_data *new_crypt;
+
+		ieee80211_crypt_delayed_deinit(ieee, crypt);
+
+		new_crypt = (struct ieee80211_crypt_data *)
+			kmalloc(sizeof(*new_crypt), GFP_KERNEL);
+		if (new_crypt == NULL) {
+			ret = -ENOMEM;
+			goto done;
+		}
+		memset(new_crypt, 0, sizeof(struct ieee80211_crypt_data));
+		new_crypt->ops = ops;
+		if (new_crypt->ops && try_module_get(new_crypt->ops->owner))
+			new_crypt->priv =
+				new_crypt->ops->init(param->u.crypt.idx);
+
+		if (new_crypt->priv == NULL) {
+			kfree(new_crypt);
+			param->u.crypt.err = IEEE_CRYPT_ERR_CRYPT_INIT_FAILED;
+			ret = -EINVAL;
+			goto done;
+		}
+
+		*crypt = new_crypt;
+	}
+
+	if (param->u.crypt.key_len > 0 && (*crypt)->ops->set_key &&
+	    (*crypt)->ops->set_key(param->u.crypt.key,
+				   param->u.crypt.key_len, param->u.crypt.seq,
+				   (*crypt)->priv) < 0) {
+		printk("key setting failed\n");
+		param->u.crypt.err = IEEE_CRYPT_ERR_KEY_SET_FAILED;
+		ret = -EINVAL;
+		goto done;
+	}
+
+ skip_host_crypt:
+	if (param->u.crypt.set_tx) {
+		ieee->tx_keyidx = param->u.crypt.idx;
+		sec.active_key = param->u.crypt.idx;
+		sec.flags |= SEC_ACTIVE_KEY;
+	} else
+		sec.flags &= ~SEC_ACTIVE_KEY;
+
+	if (param->u.crypt.alg != NULL) {
+		memcpy(sec.keys[param->u.crypt.idx],
+		       param->u.crypt.key,
+		       param->u.crypt.key_len);
+		sec.key_sizes[param->u.crypt.idx] = param->u.crypt.key_len;
+		sec.flags |= (1 << param->u.crypt.idx);
+
+		if (strcmp(param->u.crypt.alg, "WEP") == 0) {
+			sec.flags |= SEC_LEVEL;
+			sec.level = SEC_LEVEL_1;
+		} else if (strcmp(param->u.crypt.alg, "TKIP") == 0) {
+			sec.flags |= SEC_LEVEL;
+			sec.level = SEC_LEVEL_2;
+		} else if (strcmp(param->u.crypt.alg, "CCMP") == 0) {
+			sec.flags |= SEC_LEVEL;
+			sec.level = SEC_LEVEL_3;
+		}
+	}
+ done:
+	if (ieee->set_security)
+		ieee->set_security(ieee->dev, &sec);
+
+	/* Do not reset port if card is in Managed mode since resetting will
+	 * generate new IEEE 802.11 authentication which may end up in looping
+	 * with IEEE 802.1X.  If your hardware requires a reset after WEP
+	 * configuration (for example... Prism2), implement the reset_port in
+	 * the callbacks structures used to initialize the 802.11 stack. */
+	if (ieee->reset_on_keychange &&
+	    ieee->iw_mode != IW_MODE_INFRA &&
+	    ieee->reset_port &&
+	    ieee->reset_port(ieee->dev)) {
+		printk("reset_port failed\n");
+		param->u.crypt.err = IEEE_CRYPT_ERR_CARD_CONF_FAILED;
+		return -EINVAL;
+	}
+
+	return ret;
+}
+
+inline struct sk_buff *ieee80211_disassociate_skb(
+							struct ieee80211_network *beacon,
+							struct ieee80211_device *ieee,
+							u8	asRsn)
+{
+	struct sk_buff *skb;
+	struct ieee80211_disassoc *disass;
+
+	skb = dev_alloc_skb(sizeof(struct ieee80211_disassoc));
+	if (!skb)
+		return NULL;
+
+	disass = (struct ieee80211_disassoc *) skb_put(skb,sizeof(struct ieee80211_disassoc));
+	disass->header.frame_ctl = cpu_to_le16(IEEE80211_STYPE_DISASSOC);
+	disass->header.duration_id = 0;
+
+	memcpy(disass->header.addr1, beacon->bssid, ETH_ALEN);
+	memcpy(disass->header.addr2, ieee->dev->dev_addr, ETH_ALEN);
+	memcpy(disass->header.addr3, beacon->bssid, ETH_ALEN);
+
+	disass->reason = asRsn;
+	return skb;
+}
+
+
+void
+SendDisassociation(
+		struct ieee80211_device *ieee,
+		u8* 					asSta,
+		u8						asRsn
+)
+{
+		struct ieee80211_network *beacon = &ieee->current_network;
+		struct sk_buff *skb;
+		skb = ieee80211_disassociate_skb(beacon,ieee,asRsn);
+		if (skb){
+				softmac_mgmt_xmit(skb, ieee);
+				//dev_kfree_skb_any(skb);//edit by thomas
+		}
+}
+
+int ieee80211_wpa_supplicant_ioctl(struct ieee80211_device *ieee, struct iw_point *p)
+{
+	struct ieee_param *param;
+	int ret=0;
+
+	down(&ieee->wx_sem);
+	//IEEE_DEBUG_INFO("wpa_supplicant: len=%d\n", p->length);
+
+	if (p->length < sizeof(struct ieee_param) || !p->pointer){
+		ret = -EINVAL;
+		goto out;
+	}
+
+	param = (struct ieee_param *)kmalloc(p->length, GFP_KERNEL);
+	if (param == NULL){
+		ret = -ENOMEM;
+		goto out;
+	}
+	if (copy_from_user(param, p->pointer, p->length)) {
+		kfree(param);
+		ret = -EFAULT;
+		goto out;
+	}
+
+	switch (param->cmd) {
+
+	case IEEE_CMD_SET_WPA_PARAM:
+		ret = ieee80211_wpa_set_param(ieee, param->u.wpa_param.name,
+					param->u.wpa_param.value);
+		break;
+
+	case IEEE_CMD_SET_WPA_IE:
+		ret = ieee80211_wpa_set_wpa_ie(ieee, param, p->length);
+		break;
+
+	case IEEE_CMD_SET_ENCRYPTION:
+		ret = ieee80211_wpa_set_encryption(ieee, param, p->length);
+		break;
+
+	case IEEE_CMD_MLME:
+		ret = ieee80211_wpa_mlme(ieee, param->u.mlme.command,
+				   param->u.mlme.reason_code);
+		break;
+
+	default:
+		printk("Unknown WPA supplicant request: %d\n",param->cmd);
+		ret = -EOPNOTSUPP;
+		break;
+	}
+
+	if (ret == 0 && copy_to_user(p->pointer, param, p->length))
+		ret = -EFAULT;
+
+	kfree(param);
+out:
+	up(&ieee->wx_sem);
+
+	return ret;
+}
+
+void notify_wx_assoc_event(struct ieee80211_device *ieee)
+{
+	union iwreq_data wrqu;
+	wrqu.ap_addr.sa_family = ARPHRD_ETHER;
+	if (ieee->state == IEEE80211_LINKED)
+		memcpy(wrqu.ap_addr.sa_data, ieee->current_network.bssid, ETH_ALEN);
+	else
+		memset(wrqu.ap_addr.sa_data, 0, ETH_ALEN);
+	wireless_send_event(ieee->dev, SIOCGIWAP, &wrqu, NULL);
+}
+
+EXPORT_SYMBOL(ieee80211_get_beacon);
+EXPORT_SYMBOL(ieee80211_wake_queue);
+EXPORT_SYMBOL(ieee80211_stop_queue);
+EXPORT_SYMBOL(ieee80211_reset_queue);
+EXPORT_SYMBOL(ieee80211_softmac_stop_protocol);
+EXPORT_SYMBOL(ieee80211_softmac_start_protocol);
+EXPORT_SYMBOL(ieee80211_is_shortslot);
+EXPORT_SYMBOL(ieee80211_is_54g);
+EXPORT_SYMBOL(ieee80211_wpa_supplicant_ioctl);
+EXPORT_SYMBOL(ieee80211_ps_tx_ack);
+EXPORT_SYMBOL(ieee80211_softmac_xmit);
+EXPORT_SYMBOL(ieee80211_stop_send_beacons);
+EXPORT_SYMBOL(notify_wx_assoc_event);
+EXPORT_SYMBOL(SendDisassociation);
+EXPORT_SYMBOL(ieee80211_disassociate);
+EXPORT_SYMBOL(ieee80211_start_send_beacons);
+EXPORT_SYMBOL(ieee80211_stop_scan);
+EXPORT_SYMBOL(ieee80211_send_probe_requests);
+EXPORT_SYMBOL(ieee80211_softmac_scan_syncro);
+EXPORT_SYMBOL(ieee80211_start_scan_syncro);
+//EXPORT_SYMBOL(ieee80211_sta_ps_send_null_frame);
diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac_wx.c b/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac_wx.c
new file mode 100644
index 000000000000..f335c258ba84
--- /dev/null
+++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac_wx.c
@@ -0,0 +1,615 @@
+/* IEEE 802.11 SoftMAC layer
+ * Copyright (c) 2005 Andrea Merello <andreamrl@tiscali.it>
+ *
+ * Mostly extracted from the rtl8180-sa2400 driver for the
+ * in-kernel generic ieee802.11 stack.
+ *
+ * Some pieces of code might be stolen from ipw2100 driver
+ * copyright of who own it's copyright ;-)
+ *
+ * PS wx handler mostly stolen from hostap, copyright who
+ * own it's copyright ;-)
+ *
+ * released under the GPL
+ */
+
+
+#include "ieee80211.h"
+#ifdef ENABLE_DOT11D
+#include "dot11d.h"
+#endif
+/* FIXME: add A freqs */
+
+const long ieee80211_wlan_frequencies[] = {
+	2412, 2417, 2422, 2427,
+	2432, 2437, 2442, 2447,
+	2452, 2457, 2462, 2467,
+	2472, 2484
+};
+
+
+int ieee80211_wx_set_freq(struct ieee80211_device *ieee, struct iw_request_info *a,
+			     union iwreq_data *wrqu, char *b)
+{
+	int ret;
+	struct iw_freq *fwrq = & wrqu->freq;
+
+	down(&ieee->wx_sem);
+
+	if(ieee->iw_mode == IW_MODE_INFRA){
+		ret = -EOPNOTSUPP;
+		goto out;
+	}
+
+	/* if setting by freq convert to channel */
+	if (fwrq->e == 1) {
+		if ((fwrq->m >= (int) 2.412e8 &&
+		     fwrq->m <= (int) 2.487e8)) {
+			int f = fwrq->m / 100000;
+			int c = 0;
+
+			while ((c < 14) && (f != ieee80211_wlan_frequencies[c]))
+				c++;
+
+			/* hack to fall through */
+			fwrq->e = 0;
+			fwrq->m = c + 1;
+		}
+	}
+
+	if (fwrq->e > 0 || fwrq->m > 14 || fwrq->m < 1 ){
+		ret = -EOPNOTSUPP;
+		goto out;
+
+	}else { /* Set the channel */
+
+#ifdef ENABLE_DOT11D
+		if (!(GET_DOT11D_INFO(ieee)->channel_map)[fwrq->m]) {
+			ret = -EINVAL;
+			goto out;
+		}
+#endif
+		ieee->current_network.channel = fwrq->m;
+		ieee->set_chan(ieee->dev, ieee->current_network.channel);
+
+		if(ieee->iw_mode == IW_MODE_ADHOC || ieee->iw_mode == IW_MODE_MASTER)
+			if(ieee->state == IEEE80211_LINKED){
+
+			ieee80211_stop_send_beacons(ieee);
+			ieee80211_start_send_beacons(ieee);
+			}
+	}
+
+	ret = 0;
+out:
+	up(&ieee->wx_sem);
+	return ret;
+}
+
+
+int ieee80211_wx_get_freq(struct ieee80211_device *ieee,
+			     struct iw_request_info *a,
+			     union iwreq_data *wrqu, char *b)
+{
+	struct iw_freq *fwrq = & wrqu->freq;
+
+	if (ieee->current_network.channel == 0)
+		return -1;
+	//NM 0.7.0 will not accept channel any more.
+	fwrq->m = ieee80211_wlan_frequencies[ieee->current_network.channel-1] * 100000;
+	fwrq->e = 1;
+//	fwrq->m = ieee->current_network.channel;
+//	fwrq->e = 0;
+
+	return 0;
+}
+
+int ieee80211_wx_get_wap(struct ieee80211_device *ieee,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu, char *extra)
+{
+	unsigned long flags;
+
+	wrqu->ap_addr.sa_family = ARPHRD_ETHER;
+
+	if (ieee->iw_mode == IW_MODE_MONITOR)
+		return -1;
+
+	/* We want avoid to give to the user inconsistent infos*/
+	spin_lock_irqsave(&ieee->lock, flags);
+
+	if (ieee->state != IEEE80211_LINKED &&
+		ieee->state != IEEE80211_LINKED_SCANNING &&
+		ieee->wap_set == 0)
+
+		memset(wrqu->ap_addr.sa_data, 0, ETH_ALEN);
+	else
+		memcpy(wrqu->ap_addr.sa_data,
+		       ieee->current_network.bssid, ETH_ALEN);
+
+	spin_unlock_irqrestore(&ieee->lock, flags);
+
+	return 0;
+}
+
+
+int ieee80211_wx_set_wap(struct ieee80211_device *ieee,
+			 struct iw_request_info *info,
+			 union iwreq_data *awrq,
+			 char *extra)
+{
+
+	int ret = 0;
+	u8 zero[] = {0,0,0,0,0,0};
+	unsigned long flags;
+
+	short ifup = ieee->proto_started;//dev->flags & IFF_UP;
+	struct sockaddr *temp = (struct sockaddr *)awrq;
+
+	ieee->sync_scan_hurryup = 1;
+
+	down(&ieee->wx_sem);
+	/* use ifconfig hw ether */
+	if (ieee->iw_mode == IW_MODE_MASTER){
+		ret = -1;
+		goto out;
+	}
+
+	if (temp->sa_family != ARPHRD_ETHER){
+		ret = -EINVAL;
+		goto out;
+	}
+
+	if (ifup)
+		ieee80211_stop_protocol(ieee);
+
+	/* just to avoid to give inconsistent infos in the
+	 * get wx method. not really needed otherwise
+	 */
+	spin_lock_irqsave(&ieee->lock, flags);
+
+	memcpy(ieee->current_network.bssid, temp->sa_data, ETH_ALEN);
+	ieee->wap_set = memcmp(temp->sa_data, zero,ETH_ALEN)!=0;
+
+	spin_unlock_irqrestore(&ieee->lock, flags);
+
+	if (ifup)
+		ieee80211_start_protocol(ieee);
+out:
+	up(&ieee->wx_sem);
+	return ret;
+}
+
+ int ieee80211_wx_get_essid(struct ieee80211_device *ieee, struct iw_request_info *a,union iwreq_data *wrqu,char *b)
+{
+	int len,ret = 0;
+	unsigned long flags;
+
+	if (ieee->iw_mode == IW_MODE_MONITOR)
+		return -1;
+
+	/* We want avoid to give to the user inconsistent infos*/
+	spin_lock_irqsave(&ieee->lock, flags);
+
+	if (ieee->current_network.ssid[0] == '\0' ||
+		ieee->current_network.ssid_len == 0){
+		ret = -1;
+		goto out;
+	}
+
+	if (ieee->state != IEEE80211_LINKED &&
+		ieee->state != IEEE80211_LINKED_SCANNING &&
+		ieee->ssid_set == 0){
+		ret = -1;
+		goto out;
+	}
+	len = ieee->current_network.ssid_len;
+	wrqu->essid.length = len;
+	strncpy(b,ieee->current_network.ssid,len);
+	wrqu->essid.flags = 1;
+
+out:
+	spin_unlock_irqrestore(&ieee->lock, flags);
+
+	return ret;
+
+}
+
+int ieee80211_wx_set_rate(struct ieee80211_device *ieee,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+
+	u32 target_rate = wrqu->bitrate.value;
+
+	ieee->rate = target_rate/100000;
+	//FIXME: we might want to limit rate also in management protocols.
+	return 0;
+}
+
+
+
+int ieee80211_wx_get_rate(struct ieee80211_device *ieee,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	u32 tmp_rate;
+	tmp_rate = TxCountToDataRate(ieee, ieee->softmac_stats.CurrentShowTxate);
+
+	wrqu->bitrate.value = tmp_rate * 500000;
+
+	return 0;
+}
+
+
+int ieee80211_wx_set_rts(struct ieee80211_device *ieee,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	if (wrqu->rts.disabled || !wrqu->rts.fixed)
+		ieee->rts = DEFAULT_RTS_THRESHOLD;
+	else
+	{
+		if (wrqu->rts.value < MIN_RTS_THRESHOLD ||
+				wrqu->rts.value > MAX_RTS_THRESHOLD)
+			return -EINVAL;
+		ieee->rts = wrqu->rts.value;
+	}
+	return 0;
+}
+
+int ieee80211_wx_get_rts(struct ieee80211_device *ieee,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	wrqu->rts.value = ieee->rts;
+	wrqu->rts.fixed = 0;	/* no auto select */
+	wrqu->rts.disabled = (wrqu->rts.value == DEFAULT_RTS_THRESHOLD);
+	return 0;
+}
+int ieee80211_wx_set_mode(struct ieee80211_device *ieee, struct iw_request_info *a,
+			     union iwreq_data *wrqu, char *b)
+{
+
+	ieee->sync_scan_hurryup = 1;
+
+	down(&ieee->wx_sem);
+
+	if (wrqu->mode == ieee->iw_mode)
+		goto out;
+
+	if (wrqu->mode == IW_MODE_MONITOR){
+
+		ieee->dev->type = ARPHRD_IEEE80211;
+	}else{
+		ieee->dev->type = ARPHRD_ETHER;
+	}
+
+	if (!ieee->proto_started){
+		ieee->iw_mode = wrqu->mode;
+	}else{
+		ieee80211_stop_protocol(ieee);
+		ieee->iw_mode = wrqu->mode;
+		ieee80211_start_protocol(ieee);
+	}
+
+out:
+	up(&ieee->wx_sem);
+	return 0;
+}
+
+void ieee80211_wx_sync_scan_wq(struct work_struct *work)
+{
+	struct ieee80211_device *ieee = container_of(work, struct ieee80211_device, wx_sync_scan_wq);
+	short chan;
+	HT_EXTCHNL_OFFSET chan_offset=0;
+	HT_CHANNEL_WIDTH bandwidth=0;
+	int b40M = 0;
+	static int count = 0;
+	chan = ieee->current_network.channel;
+	netif_carrier_off(ieee->dev);
+
+	if (ieee->data_hard_stop)
+		ieee->data_hard_stop(ieee->dev);
+
+	ieee80211_stop_send_beacons(ieee);
+
+	ieee->state = IEEE80211_LINKED_SCANNING;
+	ieee->link_change(ieee->dev);
+	ieee->InitialGainHandler(ieee->dev,IG_Backup);
+	if (ieee->pHTInfo->bCurrentHTSupport && ieee->pHTInfo->bEnableHT && ieee->pHTInfo->bCurBW40MHz) {
+		b40M = 1;
+		chan_offset = ieee->pHTInfo->CurSTAExtChnlOffset;
+		bandwidth = (HT_CHANNEL_WIDTH)ieee->pHTInfo->bCurBW40MHz;
+		printk("Scan in 40M, force to 20M first:%d, %d\n", chan_offset, bandwidth);
+		ieee->SetBWModeHandler(ieee->dev, HT_CHANNEL_WIDTH_20, HT_EXTCHNL_OFFSET_NO_EXT);
+		}
+	ieee80211_start_scan_syncro(ieee);
+	if (b40M) {
+		printk("Scan in 20M, back to 40M\n");
+		if (chan_offset == HT_EXTCHNL_OFFSET_UPPER)
+			ieee->set_chan(ieee->dev, chan + 2);
+		else if (chan_offset == HT_EXTCHNL_OFFSET_LOWER)
+			ieee->set_chan(ieee->dev, chan - 2);
+		else
+			ieee->set_chan(ieee->dev, chan);
+		ieee->SetBWModeHandler(ieee->dev, bandwidth, chan_offset);
+	} else {
+		ieee->set_chan(ieee->dev, chan);
+	}
+
+	ieee->InitialGainHandler(ieee->dev,IG_Restore);
+	ieee->state = IEEE80211_LINKED;
+	ieee->link_change(ieee->dev);
+	// To prevent the immediately calling watch_dog after scan.
+	if(ieee->LinkDetectInfo.NumRecvBcnInPeriod==0||ieee->LinkDetectInfo.NumRecvDataInPeriod==0 )
+	{
+		ieee->LinkDetectInfo.NumRecvBcnInPeriod = 1;
+		ieee->LinkDetectInfo.NumRecvDataInPeriod= 1;
+	}
+	if (ieee->data_hard_resume)
+		ieee->data_hard_resume(ieee->dev);
+
+	if(ieee->iw_mode == IW_MODE_ADHOC || ieee->iw_mode == IW_MODE_MASTER)
+		ieee80211_start_send_beacons(ieee);
+
+	netif_carrier_on(ieee->dev);
+	count = 0;
+	up(&ieee->wx_sem);
+
+}
+
+int ieee80211_wx_set_scan(struct ieee80211_device *ieee, struct iw_request_info *a,
+			     union iwreq_data *wrqu, char *b)
+{
+	int ret = 0;
+
+	down(&ieee->wx_sem);
+
+	if (ieee->iw_mode == IW_MODE_MONITOR || !(ieee->proto_started)){
+		ret = -1;
+		goto out;
+	}
+
+	if ( ieee->state == IEEE80211_LINKED){
+		queue_work(ieee->wq, &ieee->wx_sync_scan_wq);
+		/* intentionally forget to up sem */
+		return 0;
+	}
+
+out:
+	up(&ieee->wx_sem);
+	return ret;
+}
+
+int ieee80211_wx_set_essid(struct ieee80211_device *ieee,
+			      struct iw_request_info *a,
+			      union iwreq_data *wrqu, char *extra)
+{
+
+	int ret=0,len;
+	short proto_started;
+	unsigned long flags;
+
+	ieee->sync_scan_hurryup = 1;
+	down(&ieee->wx_sem);
+
+	proto_started = ieee->proto_started;
+
+	if (wrqu->essid.length > IW_ESSID_MAX_SIZE){
+		ret= -E2BIG;
+		goto out;
+	}
+
+	if (ieee->iw_mode == IW_MODE_MONITOR){
+		ret= -1;
+		goto out;
+	}
+
+	if(proto_started)
+		ieee80211_stop_protocol(ieee);
+
+
+	/* this is just to be sure that the GET wx callback
+	 * has consisten infos. not needed otherwise
+	 */
+	spin_lock_irqsave(&ieee->lock, flags);
+
+	if (wrqu->essid.flags && wrqu->essid.length) {
+		//first flush current network.ssid
+		len = ((wrqu->essid.length-1) < IW_ESSID_MAX_SIZE) ? (wrqu->essid.length-1) : IW_ESSID_MAX_SIZE;
+		strncpy(ieee->current_network.ssid, extra, len+1);
+		ieee->current_network.ssid_len = len+1;
+		ieee->ssid_set = 1;
+	}
+	else{
+		ieee->ssid_set = 0;
+		ieee->current_network.ssid[0] = '\0';
+		ieee->current_network.ssid_len = 0;
+	}
+	spin_unlock_irqrestore(&ieee->lock, flags);
+
+	if (proto_started)
+		ieee80211_start_protocol(ieee);
+out:
+	up(&ieee->wx_sem);
+	return ret;
+}
+
+ int ieee80211_wx_get_mode(struct ieee80211_device *ieee, struct iw_request_info *a,
+			     union iwreq_data *wrqu, char *b)
+{
+
+	wrqu->mode = ieee->iw_mode;
+	return 0;
+}
+
+ int ieee80211_wx_set_rawtx(struct ieee80211_device *ieee,
+			       struct iw_request_info *info,
+			       union iwreq_data *wrqu, char *extra)
+{
+
+	int *parms = (int *)extra;
+	int enable = (parms[0] > 0);
+	short prev = ieee->raw_tx;
+
+	down(&ieee->wx_sem);
+
+	if(enable)
+		ieee->raw_tx = 1;
+	else
+		ieee->raw_tx = 0;
+
+	printk(KERN_INFO"raw TX is %s\n",
+	      ieee->raw_tx ? "enabled" : "disabled");
+
+	if(ieee->iw_mode == IW_MODE_MONITOR)
+	{
+		if(prev == 0 && ieee->raw_tx){
+			if (ieee->data_hard_resume)
+				ieee->data_hard_resume(ieee->dev);
+
+			netif_carrier_on(ieee->dev);
+		}
+
+		if(prev && ieee->raw_tx == 1)
+			netif_carrier_off(ieee->dev);
+	}
+
+	up(&ieee->wx_sem);
+
+	return 0;
+}
+
+int ieee80211_wx_get_name(struct ieee80211_device *ieee,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	strcpy(wrqu->name, "802.11");
+	if(ieee->modulation & IEEE80211_CCK_MODULATION){
+		strcat(wrqu->name, "b");
+		if(ieee->modulation & IEEE80211_OFDM_MODULATION)
+			strcat(wrqu->name, "/g");
+	}else if(ieee->modulation & IEEE80211_OFDM_MODULATION)
+		strcat(wrqu->name, "g");
+	if (ieee->mode & (IEEE_N_24G | IEEE_N_5G))
+		strcat(wrqu->name, "/n");
+
+	if((ieee->state == IEEE80211_LINKED) ||
+		(ieee->state == IEEE80211_LINKED_SCANNING))
+		strcat(wrqu->name," linked");
+	else if(ieee->state != IEEE80211_NOLINK)
+		strcat(wrqu->name," link..");
+
+
+	return 0;
+}
+
+
+/* this is mostly stolen from hostap */
+int ieee80211_wx_set_power(struct ieee80211_device *ieee,
+				 struct iw_request_info *info,
+				 union iwreq_data *wrqu, char *extra)
+{
+	int ret = 0;
+	down(&ieee->wx_sem);
+
+	if (wrqu->power.disabled){
+		ieee->ps = IEEE80211_PS_DISABLED;
+		goto exit;
+	}
+	if (wrqu->power.flags & IW_POWER_TIMEOUT) {
+		//ieee->ps_period = wrqu->power.value / 1000;
+		ieee->ps_timeout = wrqu->power.value / 1000;
+	}
+
+	if (wrqu->power.flags & IW_POWER_PERIOD) {
+
+		//ieee->ps_timeout = wrqu->power.value / 1000;
+		ieee->ps_period = wrqu->power.value / 1000;
+		//wrq->value / 1024;
+
+	}
+	switch (wrqu->power.flags & IW_POWER_MODE) {
+	case IW_POWER_UNICAST_R:
+		ieee->ps = IEEE80211_PS_UNICAST;
+		break;
+	case IW_POWER_MULTICAST_R:
+		ieee->ps = IEEE80211_PS_MBCAST;
+		break;
+	case IW_POWER_ALL_R:
+		ieee->ps = IEEE80211_PS_UNICAST | IEEE80211_PS_MBCAST;
+		break;
+
+	case IW_POWER_ON:
+	//	ieee->ps = IEEE80211_PS_DISABLED;
+		break;
+
+	default:
+		ret = -EINVAL;
+		goto exit;
+
+	}
+exit:
+	up(&ieee->wx_sem);
+	return ret;
+
+}
+
+/* this is stolen from hostap */
+int ieee80211_wx_get_power(struct ieee80211_device *ieee,
+				 struct iw_request_info *info,
+				 union iwreq_data *wrqu, char *extra)
+{
+	int ret =0;
+
+	down(&ieee->wx_sem);
+
+	if(ieee->ps == IEEE80211_PS_DISABLED){
+		wrqu->power.disabled = 1;
+		goto exit;
+	}
+
+	wrqu->power.disabled = 0;
+
+	if ((wrqu->power.flags & IW_POWER_TYPE) == IW_POWER_TIMEOUT) {
+		wrqu->power.flags = IW_POWER_TIMEOUT;
+		wrqu->power.value = ieee->ps_timeout * 1000;
+	} else {
+//		ret = -EOPNOTSUPP;
+//		goto exit;
+		wrqu->power.flags = IW_POWER_PERIOD;
+		wrqu->power.value = ieee->ps_period * 1000;
+//ieee->current_network.dtim_period * ieee->current_network.beacon_interval * 1024;
+	}
+
+       if ((ieee->ps & (IEEE80211_PS_MBCAST | IEEE80211_PS_UNICAST)) == (IEEE80211_PS_MBCAST | IEEE80211_PS_UNICAST))
+		wrqu->power.flags |= IW_POWER_ALL_R;
+	else if (ieee->ps & IEEE80211_PS_MBCAST)
+		wrqu->power.flags |= IW_POWER_MULTICAST_R;
+	else
+		wrqu->power.flags |= IW_POWER_UNICAST_R;
+
+exit:
+	up(&ieee->wx_sem);
+	return ret;
+
+}
+EXPORT_SYMBOL(ieee80211_wx_get_essid);
+EXPORT_SYMBOL(ieee80211_wx_set_essid);
+EXPORT_SYMBOL(ieee80211_wx_set_rate);
+EXPORT_SYMBOL(ieee80211_wx_get_rate);
+EXPORT_SYMBOL(ieee80211_wx_set_wap);
+EXPORT_SYMBOL(ieee80211_wx_get_wap);
+EXPORT_SYMBOL(ieee80211_wx_set_mode);
+EXPORT_SYMBOL(ieee80211_wx_get_mode);
+EXPORT_SYMBOL(ieee80211_wx_set_scan);
+EXPORT_SYMBOL(ieee80211_wx_get_freq);
+EXPORT_SYMBOL(ieee80211_wx_set_freq);
+EXPORT_SYMBOL(ieee80211_wx_set_rawtx);
+EXPORT_SYMBOL(ieee80211_wx_get_name);
+EXPORT_SYMBOL(ieee80211_wx_set_power);
+EXPORT_SYMBOL(ieee80211_wx_get_power);
+EXPORT_SYMBOL(ieee80211_wlan_frequencies);
+EXPORT_SYMBOL(ieee80211_wx_set_rts);
+EXPORT_SYMBOL(ieee80211_wx_get_rts);
diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_tx.c b/drivers/staging/rtl8192u/ieee80211/ieee80211_tx.c
new file mode 100644
index 000000000000..b29c36bac377
--- /dev/null
+++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_tx.c
@@ -0,0 +1,912 @@
+/******************************************************************************
+
+  Copyright(c) 2003 - 2004 Intel Corporation. All rights reserved.
+
+  This program is free software; you can redistribute it and/or modify it
+  under the terms of version 2 of the GNU General Public License as
+  published by the Free Software Foundation.
+
+  This program is distributed in the hope that it will be useful, but WITHOUT
+  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+  more details.
+
+  You should have received a copy of the GNU General Public License along with
+  this program; if not, write to the Free Software Foundation, Inc., 59
+  Temple Place - Suite 330, Boston, MA  02111-1307, USA.
+
+  The full GNU General Public License is included in this distribution in the
+  file called LICENSE.
+
+  Contact Information:
+  James P. Ketrenos <ipw2100-admin@linux.intel.com>
+  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+
+******************************************************************************
+
+  Few modifications for Realtek's Wi-Fi drivers by
+  Andrea Merello <andreamrl@tiscali.it>
+
+  A special thanks goes to Realtek for their support !
+
+******************************************************************************/
+
+#include <linux/compiler.h>
+//#include <linux/config.h>
+#include <linux/errno.h>
+#include <linux/if_arp.h>
+#include <linux/in6.h>
+#include <linux/in.h>
+#include <linux/ip.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/netdevice.h>
+#include <linux/pci.h>
+#include <linux/proc_fs.h>
+#include <linux/skbuff.h>
+#include <linux/slab.h>
+#include <linux/tcp.h>
+#include <linux/types.h>
+#include <linux/version.h>
+#include <linux/wireless.h>
+#include <linux/etherdevice.h>
+#include <asm/uaccess.h>
+#include <linux/if_vlan.h>
+
+#include "ieee80211.h"
+
+
+/*
+
+
+802.11 Data Frame
+
+
+802.11 frame_contorl for data frames - 2 bytes
+     ,-----------------------------------------------------------------------------------------.
+bits | 0  |  1  |  2  |  3  |  4  |  5  |  6  |  7  |  8  |  9  |  a  |  b  |  c  |  d  |  e   |
+     |----|-----|-----|-----|-----|-----|-----|-----|-----|-----|-----|-----|-----|-----|------|
+val  | 0  |  0  |  0  |  1  |  x  |  0  |  0  |  0  |  1  |  0  |  x  |  x  |  x  |  x  |  x   |
+     |----|-----|-----|-----|-----|-----|-----|-----|-----|-----|-----|-----|-----|-----|------|
+desc | ^-ver-^  |  ^type-^  |  ^-----subtype-----^  | to  |from |more |retry| pwr |more |wep   |
+     |          |           | x=0 data,x=1 data+ack | DS  | DS  |frag |     | mgm |data |      |
+     '-----------------------------------------------------------------------------------------'
+		                                    /\
+                                                    |
+802.11 Data Frame                                   |
+           ,--------- 'ctrl' expands to >-----------'
+          |
+      ,--'---,-------------------------------------------------------------.
+Bytes |  2   |  2   |    6    |    6    |    6    |  2   | 0..2312 |   4  |
+      |------|------|---------|---------|---------|------|---------|------|
+Desc. | ctrl | dura |  DA/RA  |   TA    |    SA   | Sequ |  Frame  |  fcs |
+      |      | tion | (BSSID) |         |         | ence |  data   |      |
+      `--------------------------------------------------|         |------'
+Total: 28 non-data bytes                                 `----.----'
+                                                              |
+       .- 'Frame data' expands to <---------------------------'
+       |
+       V
+      ,---------------------------------------------------.
+Bytes |  1   |  1   |    1    |    3     |  2   |  0-2304 |
+      |------|------|---------|----------|------|---------|
+Desc. | SNAP | SNAP | Control |Eth Tunnel| Type | IP      |
+      | DSAP | SSAP |         |          |      | Packet  |
+      | 0xAA | 0xAA |0x03 (UI)|0x00-00-F8|      |         |
+      `-----------------------------------------|         |
+Total: 8 non-data bytes                         `----.----'
+                                                     |
+       .- 'IP Packet' expands, if WEP enabled, to <--'
+       |
+       V
+      ,-----------------------.
+Bytes |  4  |   0-2296  |  4  |
+      |-----|-----------|-----|
+Desc. | IV  | Encrypted | ICV |
+      |     | IP Packet |     |
+      `-----------------------'
+Total: 8 non-data bytes
+
+
+802.3 Ethernet Data Frame
+
+      ,-----------------------------------------.
+Bytes |   6   |   6   |  2   |  Variable |   4  |
+      |-------|-------|------|-----------|------|
+Desc. | Dest. | Source| Type | IP Packet |  fcs |
+      |  MAC  |  MAC  |      |           |      |
+      `-----------------------------------------'
+Total: 18 non-data bytes
+
+In the event that fragmentation is required, the incoming payload is split into
+N parts of size ieee->fts.  The first fragment contains the SNAP header and the
+remaining packets are just data.
+
+If encryption is enabled, each fragment payload size is reduced by enough space
+to add the prefix and postfix (IV and ICV totalling 8 bytes in the case of WEP)
+So if you have 1500 bytes of payload with ieee->fts set to 500 without
+encryption it will take 3 frames.  With WEP it will take 4 frames as the
+payload of each frame is reduced to 492 bytes.
+
+* SKB visualization
+*
+*  ,- skb->data
+* |
+* |    ETHERNET HEADER        ,-<-- PAYLOAD
+* |                           |     14 bytes from skb->data
+* |  2 bytes for Type --> ,T. |     (sizeof ethhdr)
+* |                       | | |
+* |,-Dest.--. ,--Src.---. | | |
+* |  6 bytes| | 6 bytes | | | |
+* v         | |         | | | |
+* 0         | v       1 | v | v           2
+* 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5
+*     ^     | ^         | ^ |
+*     |     | |         | | |
+*     |     | |         | `T' <---- 2 bytes for Type
+*     |     | |         |
+*     |     | '---SNAP--' <-------- 6 bytes for SNAP
+*     |     |
+*     `-IV--' <-------------------- 4 bytes for IV (WEP)
+*
+*      SNAP HEADER
+*
+*/
+
+static u8 P802_1H_OUI[P80211_OUI_LEN] = { 0x00, 0x00, 0xf8 };
+static u8 RFC1042_OUI[P80211_OUI_LEN] = { 0x00, 0x00, 0x00 };
+
+static inline int ieee80211_put_snap(u8 *data, u16 h_proto)
+{
+	struct ieee80211_snap_hdr *snap;
+	u8 *oui;
+
+	snap = (struct ieee80211_snap_hdr *)data;
+	snap->dsap = 0xaa;
+	snap->ssap = 0xaa;
+	snap->ctrl = 0x03;
+
+	if (h_proto == 0x8137 || h_proto == 0x80f3)
+		oui = P802_1H_OUI;
+	else
+		oui = RFC1042_OUI;
+	snap->oui[0] = oui[0];
+	snap->oui[1] = oui[1];
+	snap->oui[2] = oui[2];
+
+	*(u16 *)(data + SNAP_SIZE) = htons(h_proto);
+
+	return SNAP_SIZE + sizeof(u16);
+}
+
+int ieee80211_encrypt_fragment(
+	struct ieee80211_device *ieee,
+	struct sk_buff *frag,
+	int hdr_len)
+{
+	struct ieee80211_crypt_data* crypt = ieee->crypt[ieee->tx_keyidx];
+	int res;
+
+	if (!(crypt && crypt->ops))
+	{
+		printk("=========>%s(), crypt is null\n", __FUNCTION__);
+		return -1;
+	}
+#ifdef CONFIG_IEEE80211_CRYPT_TKIP
+	struct ieee80211_hdr *header;
+
+	if (ieee->tkip_countermeasures &&
+	    crypt && crypt->ops && strcmp(crypt->ops->name, "TKIP") == 0) {
+		header = (struct ieee80211_hdr *) frag->data;
+		if (net_ratelimit()) {
+			printk(KERN_DEBUG "%s: TKIP countermeasures: dropped "
+			       "TX packet to " MAC_FMT "\n",
+			       ieee->dev->name, MAC_ARG(header->addr1));
+		}
+		return -1;
+	}
+#endif
+	/* To encrypt, frame format is:
+	 * IV (4 bytes), clear payload (including SNAP), ICV (4 bytes) */
+
+	// PR: FIXME: Copied from hostap. Check fragmentation/MSDU/MPDU encryption.
+	/* Host-based IEEE 802.11 fragmentation for TX is not yet supported, so
+	 * call both MSDU and MPDU encryption functions from here. */
+	atomic_inc(&crypt->refcnt);
+	res = 0;
+	if (crypt->ops->encrypt_msdu)
+		res = crypt->ops->encrypt_msdu(frag, hdr_len, crypt->priv);
+	if (res == 0 && crypt->ops->encrypt_mpdu)
+		res = crypt->ops->encrypt_mpdu(frag, hdr_len, crypt->priv);
+
+	atomic_dec(&crypt->refcnt);
+	if (res < 0) {
+		printk(KERN_INFO "%s: Encryption failed: len=%d.\n",
+		       ieee->dev->name, frag->len);
+		ieee->ieee_stats.tx_discards++;
+		return -1;
+	}
+
+	return 0;
+}
+
+
+void ieee80211_txb_free(struct ieee80211_txb *txb) {
+	//int i;
+	if (unlikely(!txb))
+		return;
+	kfree(txb);
+}
+
+struct ieee80211_txb *ieee80211_alloc_txb(int nr_frags, int txb_size,
+					  int gfp_mask)
+{
+	struct ieee80211_txb *txb;
+	int i;
+	txb = kmalloc(
+		sizeof(struct ieee80211_txb) + (sizeof(u8*) * nr_frags),
+		gfp_mask);
+	if (!txb)
+		return NULL;
+
+	memset(txb, 0, sizeof(struct ieee80211_txb));
+	txb->nr_frags = nr_frags;
+	txb->frag_size = txb_size;
+
+	for (i = 0; i < nr_frags; i++) {
+		txb->fragments[i] = dev_alloc_skb(txb_size);
+		if (unlikely(!txb->fragments[i])) {
+			i--;
+			break;
+		}
+		memset(txb->fragments[i]->cb, 0, sizeof(txb->fragments[i]->cb));
+	}
+	if (unlikely(i != nr_frags)) {
+		while (i >= 0)
+			dev_kfree_skb_any(txb->fragments[i--]);
+		kfree(txb);
+		return NULL;
+	}
+	return txb;
+}
+
+// Classify the to-be send data packet
+// Need to acquire the sent queue index.
+static int
+ieee80211_classify(struct sk_buff *skb, struct ieee80211_network *network)
+{
+	struct ethhdr *eth;
+	struct iphdr *ip;
+	eth = (struct ethhdr *)skb->data;
+	if (eth->h_proto != htons(ETH_P_IP))
+		return 0;
+
+//	IEEE80211_DEBUG_DATA(IEEE80211_DL_DATA, skb->data, skb->len);
+	ip = ip_hdr(skb);
+	switch (ip->tos & 0xfc) {
+		case 0x20:
+			return 2;
+		case 0x40:
+			return 1;
+		case 0x60:
+			return 3;
+		case 0x80:
+			return 4;
+		case 0xa0:
+			return 5;
+		case 0xc0:
+			return 6;
+		case 0xe0:
+			return 7;
+		default:
+			return 0;
+	}
+}
+
+#define SN_LESS(a, b)		(((a-b)&0x800)!=0)
+void ieee80211_tx_query_agg_cap(struct ieee80211_device* ieee, struct sk_buff* skb, cb_desc* tcb_desc)
+{
+	PRT_HIGH_THROUGHPUT	pHTInfo = ieee->pHTInfo;
+	PTX_TS_RECORD			pTxTs = NULL;
+	struct ieee80211_hdr_1addr* hdr = (struct ieee80211_hdr_1addr*)skb->data;
+
+	if (!pHTInfo->bCurrentHTSupport||!pHTInfo->bEnableHT)
+		return;
+	if (!IsQoSDataFrame(skb->data))
+		return;
+
+	if (is_multicast_ether_addr(hdr->addr1) || is_broadcast_ether_addr(hdr->addr1))
+		return;
+	//check packet and mode later
+#ifdef TO_DO_LIST
+	if(pTcb->PacketLength >= 4096)
+		return;
+	// For RTL819X, if pairwisekey = wep/tkip, we don't aggrregation.
+	if(!Adapter->HalFunc.GetNmodeSupportBySecCfgHandler(Adapter))
+		return;
+#endif
+	if(!ieee->GetNmodeSupportBySecCfg(ieee->dev))
+	{
+		return;
+	}
+	if(pHTInfo->bCurrentAMPDUEnable)
+	{
+		if (!GetTs(ieee, (PTS_COMMON_INFO*)(&pTxTs), hdr->addr1, skb->priority, TX_DIR, true))
+		{
+			printk("===>can't get TS\n");
+			return;
+		}
+		if (pTxTs->TxAdmittedBARecord.bValid == false)
+		{
+			TsStartAddBaProcess(ieee, pTxTs);
+			goto FORCED_AGG_SETTING;
+		}
+		else if (pTxTs->bUsingBa == false)
+		{
+			if (SN_LESS(pTxTs->TxAdmittedBARecord.BaStartSeqCtrl.field.SeqNum, (pTxTs->TxCurSeq+1)%4096))
+				pTxTs->bUsingBa = true;
+			else
+				goto FORCED_AGG_SETTING;
+		}
+
+		if (ieee->iw_mode == IW_MODE_INFRA)
+		{
+			tcb_desc->bAMPDUEnable = true;
+			tcb_desc->ampdu_factor = pHTInfo->CurrentAMPDUFactor;
+			tcb_desc->ampdu_density = pHTInfo->CurrentMPDUDensity;
+		}
+	}
+FORCED_AGG_SETTING:
+	switch(pHTInfo->ForcedAMPDUMode )
+	{
+		case HT_AGG_AUTO:
+			break;
+
+		case HT_AGG_FORCE_ENABLE:
+			tcb_desc->bAMPDUEnable = true;
+			tcb_desc->ampdu_density = pHTInfo->ForcedMPDUDensity;
+			tcb_desc->ampdu_factor = pHTInfo->ForcedAMPDUFactor;
+			break;
+
+		case HT_AGG_FORCE_DISABLE:
+			tcb_desc->bAMPDUEnable = false;
+			tcb_desc->ampdu_density = 0;
+			tcb_desc->ampdu_factor = 0;
+			break;
+
+	}
+		return;
+}
+
+extern void ieee80211_qurey_ShortPreambleMode(struct ieee80211_device* ieee, cb_desc* tcb_desc)
+{
+	tcb_desc->bUseShortPreamble = false;
+	if (tcb_desc->data_rate == 2)
+	{//// 1M can only use Long Preamble. 11B spec
+		return;
+	}
+	else if (ieee->current_network.capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
+	{
+		tcb_desc->bUseShortPreamble = true;
+	}
+	return;
+}
+extern	void
+ieee80211_query_HTCapShortGI(struct ieee80211_device *ieee, cb_desc *tcb_desc)
+{
+	PRT_HIGH_THROUGHPUT		pHTInfo = ieee->pHTInfo;
+
+	tcb_desc->bUseShortGI 		= false;
+
+	if(!pHTInfo->bCurrentHTSupport||!pHTInfo->bEnableHT)
+		return;
+
+	if(pHTInfo->bForcedShortGI)
+	{
+		tcb_desc->bUseShortGI = true;
+		return;
+	}
+
+	if((pHTInfo->bCurBW40MHz==true) && pHTInfo->bCurShortGI40MHz)
+		tcb_desc->bUseShortGI = true;
+	else if((pHTInfo->bCurBW40MHz==false) && pHTInfo->bCurShortGI20MHz)
+		tcb_desc->bUseShortGI = true;
+}
+
+void ieee80211_query_BandwidthMode(struct ieee80211_device* ieee, cb_desc *tcb_desc)
+{
+	PRT_HIGH_THROUGHPUT	pHTInfo = ieee->pHTInfo;
+
+	tcb_desc->bPacketBW = false;
+
+	if(!pHTInfo->bCurrentHTSupport||!pHTInfo->bEnableHT)
+		return;
+
+	if(tcb_desc->bMulticast || tcb_desc->bBroadcast)
+		return;
+
+	if((tcb_desc->data_rate & 0x80)==0) // If using legacy rate, it shall use 20MHz channel.
+		return;
+	//BandWidthAutoSwitch is for auto switch to 20 or 40 in long distance
+	if(pHTInfo->bCurBW40MHz && pHTInfo->bCurTxBW40MHz && !ieee->bandwidth_auto_switch.bforced_tx20Mhz)
+		tcb_desc->bPacketBW = true;
+	return;
+}
+
+void ieee80211_query_protectionmode(struct ieee80211_device* ieee, cb_desc* tcb_desc, struct sk_buff* skb)
+{
+	// Common Settings
+	tcb_desc->bRTSSTBC			= false;
+	tcb_desc->bRTSUseShortGI		= false; // Since protection frames are always sent by legacy rate, ShortGI will never be used.
+	tcb_desc->bCTSEnable			= false; // Most of protection using RTS/CTS
+	tcb_desc->RTSSC				= 0;		// 20MHz: Don't care;  40MHz: Duplicate.
+	tcb_desc->bRTSBW			= false; // RTS frame bandwidth is always 20MHz
+
+	if(tcb_desc->bBroadcast || tcb_desc->bMulticast)//only unicast frame will use rts/cts
+		return;
+
+	if (is_broadcast_ether_addr(skb->data+16))  //check addr3 as infrastructure add3 is DA.
+		return;
+
+	if (ieee->mode < IEEE_N_24G) //b, g mode
+	{
+			// (1) RTS_Threshold is compared to the MPDU, not MSDU.
+			// (2) If there are more than one frag in  this MSDU, only the first frag uses protection frame.
+			//		Other fragments are protected by previous fragment.
+			//		So we only need to check the length of first fragment.
+		if (skb->len > ieee->rts)
+		{
+			tcb_desc->bRTSEnable = true;
+			tcb_desc->rts_rate = MGN_24M;
+		}
+		else if (ieee->current_network.buseprotection)
+		{
+			// Use CTS-to-SELF in protection mode.
+			tcb_desc->bRTSEnable = true;
+			tcb_desc->bCTSEnable = true;
+			tcb_desc->rts_rate = MGN_24M;
+		}
+		//otherwise return;
+		return;
+	}
+	else
+	{// 11n High throughput case.
+		PRT_HIGH_THROUGHPUT pHTInfo = ieee->pHTInfo;
+		while (true)
+		{
+			//check ERP protection
+			if (ieee->current_network.buseprotection)
+			{// CTS-to-SELF
+				tcb_desc->bRTSEnable = true;
+				tcb_desc->bCTSEnable = true;
+				tcb_desc->rts_rate = MGN_24M;
+				break;
+			}
+			//check HT op mode
+			if(pHTInfo->bCurrentHTSupport  && pHTInfo->bEnableHT)
+			{
+				u8 HTOpMode = pHTInfo->CurrentOpMode;
+				if((pHTInfo->bCurBW40MHz && (HTOpMode == 2 || HTOpMode == 3)) ||
+							(!pHTInfo->bCurBW40MHz && HTOpMode == 3) )
+				{
+					tcb_desc->rts_rate = MGN_24M; // Rate is 24Mbps.
+					tcb_desc->bRTSEnable = true;
+					break;
+				}
+			}
+			//check rts
+			if (skb->len > ieee->rts)
+			{
+				tcb_desc->rts_rate = MGN_24M; // Rate is 24Mbps.
+				tcb_desc->bRTSEnable = true;
+				break;
+			}
+			//to do list: check MIMO power save condition.
+			//check AMPDU aggregation for TXOP
+			if(tcb_desc->bAMPDUEnable)
+			{
+				tcb_desc->rts_rate = MGN_24M; // Rate is 24Mbps.
+				// According to 8190 design, firmware sends CF-End only if RTS/CTS is enabled. However, it degrads
+				// throughput around 10M, so we disable of this mechanism. 2007.08.03 by Emily
+				tcb_desc->bRTSEnable = false;
+				break;
+			}
+			//check IOT action
+			if(pHTInfo->IOTAction & HT_IOT_ACT_FORCED_CTS2SELF)
+			{
+				tcb_desc->bCTSEnable	= true;
+				tcb_desc->rts_rate  = 	MGN_24M;
+				tcb_desc->bRTSEnable = true;
+				break;
+			}
+			// Totally no protection case!!
+			goto NO_PROTECTION;
+		}
+		}
+	// For test , CTS replace with RTS
+	if( 0 )
+	{
+		tcb_desc->bCTSEnable	= true;
+		tcb_desc->rts_rate = MGN_24M;
+		tcb_desc->bRTSEnable 	= true;
+	}
+	if (ieee->current_network.capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
+		tcb_desc->bUseShortPreamble = true;
+	if (ieee->mode == IW_MODE_MASTER)
+			goto NO_PROTECTION;
+	return;
+NO_PROTECTION:
+	tcb_desc->bRTSEnable	= false;
+	tcb_desc->bCTSEnable	= false;
+	tcb_desc->rts_rate		= 0;
+	tcb_desc->RTSSC		= 0;
+	tcb_desc->bRTSBW		= false;
+}
+
+
+void ieee80211_txrate_selectmode(struct ieee80211_device* ieee, cb_desc* tcb_desc)
+{
+#ifdef TO_DO_LIST
+	if(!IsDataFrame(pFrame))
+	{
+		pTcb->bTxDisableRateFallBack = TRUE;
+		pTcb->bTxUseDriverAssingedRate = TRUE;
+		pTcb->RATRIndex = 7;
+		return;
+	}
+
+	if(pMgntInfo->ForcedDataRate!= 0)
+	{
+		pTcb->bTxDisableRateFallBack = TRUE;
+		pTcb->bTxUseDriverAssingedRate = TRUE;
+		return;
+	}
+#endif
+	if(ieee->bTxDisableRateFallBack)
+		tcb_desc->bTxDisableRateFallBack = true;
+
+	if(ieee->bTxUseDriverAssingedRate)
+		tcb_desc->bTxUseDriverAssingedRate = true;
+	if(!tcb_desc->bTxDisableRateFallBack || !tcb_desc->bTxUseDriverAssingedRate)
+	{
+		if (ieee->iw_mode == IW_MODE_INFRA || ieee->iw_mode == IW_MODE_ADHOC)
+			tcb_desc->RATRIndex = 0;
+	}
+}
+
+void ieee80211_query_seqnum(struct ieee80211_device*ieee, struct sk_buff* skb, u8* dst)
+{
+	if (is_multicast_ether_addr(dst) || is_broadcast_ether_addr(dst))
+		return;
+	if (IsQoSDataFrame(skb->data)) //we deal qos data only
+	{
+		PTX_TS_RECORD pTS = NULL;
+		if (!GetTs(ieee, (PTS_COMMON_INFO*)(&pTS), dst, skb->priority, TX_DIR, true))
+		{
+			return;
+		}
+		pTS->TxCurSeq = (pTS->TxCurSeq+1)%4096;
+	}
+}
+
+int ieee80211_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+	struct ieee80211_device *ieee = netdev_priv(dev);
+	struct ieee80211_txb *txb = NULL;
+	struct ieee80211_hdr_3addrqos *frag_hdr;
+	int i, bytes_per_frag, nr_frags, bytes_last_frag, frag_size;
+	unsigned long flags;
+	struct net_device_stats *stats = &ieee->stats;
+	int ether_type = 0, encrypt;
+	int bytes, fc, qos_ctl = 0, hdr_len;
+	struct sk_buff *skb_frag;
+	struct ieee80211_hdr_3addrqos header = { /* Ensure zero initialized */
+		.duration_id = 0,
+		.seq_ctl = 0,
+		.qos_ctl = 0
+	};
+	u8 dest[ETH_ALEN], src[ETH_ALEN];
+	int qos_actived = ieee->current_network.qos_data.active;
+
+	struct ieee80211_crypt_data* crypt;
+
+	cb_desc *tcb_desc;
+
+	spin_lock_irqsave(&ieee->lock, flags);
+
+	/* If there is no driver handler to take the TXB, dont' bother
+	 * creating it... */
+	if ((!ieee->hard_start_xmit && !(ieee->softmac_features & IEEE_SOFTMAC_TX_QUEUE))||
+	   ((!ieee->softmac_data_hard_start_xmit && (ieee->softmac_features & IEEE_SOFTMAC_TX_QUEUE)))) {
+		printk(KERN_WARNING "%s: No xmit handler.\n",
+		       ieee->dev->name);
+		goto success;
+	}
+
+
+	if(likely(ieee->raw_tx == 0)){
+		if (unlikely(skb->len < SNAP_SIZE + sizeof(u16))) {
+			printk(KERN_WARNING "%s: skb too small (%d).\n",
+			ieee->dev->name, skb->len);
+			goto success;
+		}
+
+		memset(skb->cb, 0, sizeof(skb->cb));
+		ether_type = ntohs(((struct ethhdr *)skb->data)->h_proto);
+
+		crypt = ieee->crypt[ieee->tx_keyidx];
+
+		encrypt = !(ether_type == ETH_P_PAE && ieee->ieee802_1x) &&
+			ieee->host_encrypt && crypt && crypt->ops;
+
+		if (!encrypt && ieee->ieee802_1x &&
+		ieee->drop_unencrypted && ether_type != ETH_P_PAE) {
+			stats->tx_dropped++;
+			goto success;
+		}
+	#ifdef CONFIG_IEEE80211_DEBUG
+		if (crypt && !encrypt && ether_type == ETH_P_PAE) {
+			struct eapol *eap = (struct eapol *)(skb->data +
+				sizeof(struct ethhdr) - SNAP_SIZE - sizeof(u16));
+			IEEE80211_DEBUG_EAP("TX: IEEE 802.11 EAPOL frame: %s\n",
+				eap_get_type(eap->type));
+		}
+	#endif
+
+		/* Save source and destination addresses */
+		memcpy(&dest, skb->data, ETH_ALEN);
+		memcpy(&src, skb->data+ETH_ALEN, ETH_ALEN);
+
+                /* Advance the SKB to the start of the payload */
+                skb_pull(skb, sizeof(struct ethhdr));
+
+                /* Determine total amount of storage required for TXB packets */
+                bytes = skb->len + SNAP_SIZE + sizeof(u16);
+
+		if (encrypt)
+			fc = IEEE80211_FTYPE_DATA | IEEE80211_FCTL_WEP;
+		else
+
+                        fc = IEEE80211_FTYPE_DATA;
+
+		//if(ieee->current_network.QoS_Enable)
+		if(qos_actived)
+			fc |= IEEE80211_STYPE_QOS_DATA;
+		else
+			fc |= IEEE80211_STYPE_DATA;
+
+		if (ieee->iw_mode == IW_MODE_INFRA) {
+			fc |= IEEE80211_FCTL_TODS;
+			/* To DS: Addr1 = BSSID, Addr2 = SA,
+			Addr3 = DA */
+			memcpy(&header.addr1, ieee->current_network.bssid, ETH_ALEN);
+			memcpy(&header.addr2, &src, ETH_ALEN);
+			memcpy(&header.addr3, &dest, ETH_ALEN);
+		} else if (ieee->iw_mode == IW_MODE_ADHOC) {
+			/* not From/To DS: Addr1 = DA, Addr2 = SA,
+			Addr3 = BSSID */
+			memcpy(&header.addr1, dest, ETH_ALEN);
+			memcpy(&header.addr2, src, ETH_ALEN);
+			memcpy(&header.addr3, ieee->current_network.bssid, ETH_ALEN);
+		}
+
+                header.frame_ctl = cpu_to_le16(fc);
+
+		/* Determine fragmentation size based on destination (multicast
+		* and broadcast are not fragmented) */
+		if (is_multicast_ether_addr(header.addr1) ||
+		is_broadcast_ether_addr(header.addr1)) {
+			frag_size = MAX_FRAG_THRESHOLD;
+			qos_ctl |= QOS_CTL_NOTCONTAIN_ACK;
+		}
+		else {
+			frag_size = ieee->fts;//default:392
+			qos_ctl = 0;
+		}
+
+		//if (ieee->current_network.QoS_Enable)
+		if(qos_actived)
+		{
+			hdr_len = IEEE80211_3ADDR_LEN + 2;
+
+			skb->priority = ieee80211_classify(skb, &ieee->current_network);
+			qos_ctl |= skb->priority; //set in the ieee80211_classify
+			header.qos_ctl = cpu_to_le16(qos_ctl & IEEE80211_QOS_TID);
+		} else {
+			hdr_len = IEEE80211_3ADDR_LEN;
+		}
+		/* Determine amount of payload per fragment.  Regardless of if
+		* this stack is providing the full 802.11 header, one will
+		* eventually be affixed to this fragment -- so we must account for
+		* it when determining the amount of payload space. */
+		bytes_per_frag = frag_size - hdr_len;
+		if (ieee->config &
+		(CFG_IEEE80211_COMPUTE_FCS | CFG_IEEE80211_RESERVE_FCS))
+			bytes_per_frag -= IEEE80211_FCS_LEN;
+
+		/* Each fragment may need to have room for encryptiong pre/postfix */
+		if (encrypt)
+			bytes_per_frag -= crypt->ops->extra_prefix_len +
+				crypt->ops->extra_postfix_len;
+
+		/* Number of fragments is the total bytes_per_frag /
+		* payload_per_fragment */
+		nr_frags = bytes / bytes_per_frag;
+		bytes_last_frag = bytes % bytes_per_frag;
+		if (bytes_last_frag)
+			nr_frags++;
+		else
+			bytes_last_frag = bytes_per_frag;
+
+		/* When we allocate the TXB we allocate enough space for the reserve
+		* and full fragment bytes (bytes_per_frag doesn't include prefix,
+		* postfix, header, FCS, etc.) */
+		txb = ieee80211_alloc_txb(nr_frags, frag_size + ieee->tx_headroom, GFP_ATOMIC);
+		if (unlikely(!txb)) {
+			printk(KERN_WARNING "%s: Could not allocate TXB\n",
+			ieee->dev->name);
+			goto failed;
+		}
+		txb->encrypted = encrypt;
+		txb->payload_size = bytes;
+
+		//if (ieee->current_network.QoS_Enable)
+		if(qos_actived)
+		{
+			txb->queue_index = UP2AC(skb->priority);
+		} else {
+			txb->queue_index = WME_AC_BK;;
+		}
+
+
+
+		for (i = 0; i < nr_frags; i++) {
+			skb_frag = txb->fragments[i];
+			tcb_desc = (cb_desc *)(skb_frag->cb + MAX_DEV_ADDR_SIZE);
+			if(qos_actived){
+				skb_frag->priority = skb->priority;//UP2AC(skb->priority);
+				tcb_desc->queue_index =  UP2AC(skb->priority);
+			} else {
+				skb_frag->priority = WME_AC_BK;
+				tcb_desc->queue_index = WME_AC_BK;
+			}
+			skb_reserve(skb_frag, ieee->tx_headroom);
+
+			if (encrypt){
+				if (ieee->hwsec_active)
+					tcb_desc->bHwSec = 1;
+				else
+					tcb_desc->bHwSec = 0;
+				skb_reserve(skb_frag, crypt->ops->extra_prefix_len);
+			}
+			else
+			{
+				tcb_desc->bHwSec = 0;
+			}
+			frag_hdr = (struct ieee80211_hdr_3addrqos *)skb_put(skb_frag, hdr_len);
+			memcpy(frag_hdr, &header, hdr_len);
+
+			/* If this is not the last fragment, then add the MOREFRAGS
+			* bit to the frame control */
+			if (i != nr_frags - 1) {
+				frag_hdr->frame_ctl = cpu_to_le16(
+					fc | IEEE80211_FCTL_MOREFRAGS);
+				bytes = bytes_per_frag;
+
+			} else {
+				/* The last fragment takes the remaining length */
+				bytes = bytes_last_frag;
+			}
+			//if(ieee->current_network.QoS_Enable)
+			if(qos_actived)
+			{
+				// add 1 only indicate to corresponding seq number control 2006/7/12
+				frag_hdr->seq_ctl = cpu_to_le16(ieee->seq_ctrl[UP2AC(skb->priority)+1]<<4 | i);
+			} else {
+				frag_hdr->seq_ctl = cpu_to_le16(ieee->seq_ctrl[0]<<4 | i);
+			}
+
+			/* Put a SNAP header on the first fragment */
+			if (i == 0) {
+				ieee80211_put_snap(
+					skb_put(skb_frag, SNAP_SIZE + sizeof(u16)),
+					ether_type);
+				bytes -= SNAP_SIZE + sizeof(u16);
+			}
+
+			memcpy(skb_put(skb_frag, bytes), skb->data, bytes);
+
+			/* Advance the SKB... */
+			skb_pull(skb, bytes);
+
+			/* Encryption routine will move the header forward in order
+			* to insert the IV between the header and the payload */
+			if (encrypt)
+				ieee80211_encrypt_fragment(ieee, skb_frag, hdr_len);
+			if (ieee->config &
+			(CFG_IEEE80211_COMPUTE_FCS | CFG_IEEE80211_RESERVE_FCS))
+				skb_put(skb_frag, 4);
+		}
+
+		if(qos_actived)
+		{
+		  if (ieee->seq_ctrl[UP2AC(skb->priority) + 1] == 0xFFF)
+			ieee->seq_ctrl[UP2AC(skb->priority) + 1] = 0;
+		  else
+			ieee->seq_ctrl[UP2AC(skb->priority) + 1]++;
+		} else {
+  		  if (ieee->seq_ctrl[0] == 0xFFF)
+			ieee->seq_ctrl[0] = 0;
+		  else
+			ieee->seq_ctrl[0]++;
+		}
+	}else{
+		if (unlikely(skb->len < sizeof(struct ieee80211_hdr_3addr))) {
+			printk(KERN_WARNING "%s: skb too small (%d).\n",
+			ieee->dev->name, skb->len);
+			goto success;
+		}
+
+		txb = ieee80211_alloc_txb(1, skb->len, GFP_ATOMIC);
+		if(!txb){
+			printk(KERN_WARNING "%s: Could not allocate TXB\n",
+			ieee->dev->name);
+			goto failed;
+		}
+
+		txb->encrypted = 0;
+		txb->payload_size = skb->len;
+		memcpy(skb_put(txb->fragments[0],skb->len), skb->data, skb->len);
+	}
+
+ success:
+//WB add to fill data tcb_desc here. only first fragment is considered, need to change, and you may remove to other place.
+	if (txb)
+	{
+		cb_desc *tcb_desc = (cb_desc *)(txb->fragments[0]->cb + MAX_DEV_ADDR_SIZE);
+		tcb_desc->bTxEnableFwCalcDur = 1;
+		if (is_multicast_ether_addr(header.addr1))
+			tcb_desc->bMulticast = 1;
+		if (is_broadcast_ether_addr(header.addr1))
+			tcb_desc->bBroadcast = 1;
+		ieee80211_txrate_selectmode(ieee, tcb_desc);
+		if ( tcb_desc->bMulticast ||  tcb_desc->bBroadcast)
+			tcb_desc->data_rate = ieee->basic_rate;
+		else
+			//tcb_desc->data_rate = CURRENT_RATE(ieee->current_network.mode, ieee->rate, ieee->HTCurrentOperaRate);
+			tcb_desc->data_rate = CURRENT_RATE(ieee->mode, ieee->rate, ieee->HTCurrentOperaRate);
+		ieee80211_qurey_ShortPreambleMode(ieee, tcb_desc);
+		ieee80211_tx_query_agg_cap(ieee, txb->fragments[0], tcb_desc);
+		ieee80211_query_HTCapShortGI(ieee, tcb_desc);
+		ieee80211_query_BandwidthMode(ieee, tcb_desc);
+		ieee80211_query_protectionmode(ieee, tcb_desc, txb->fragments[0]);
+		ieee80211_query_seqnum(ieee, txb->fragments[0], header.addr1);
+//		IEEE80211_DEBUG_DATA(IEEE80211_DL_DATA, txb->fragments[0]->data, txb->fragments[0]->len);
+		//IEEE80211_DEBUG_DATA(IEEE80211_DL_DATA, tcb_desc, sizeof(cb_desc));
+	}
+	spin_unlock_irqrestore(&ieee->lock, flags);
+	dev_kfree_skb_any(skb);
+	if (txb) {
+		if (ieee->softmac_features & IEEE_SOFTMAC_TX_QUEUE){
+			ieee80211_softmac_xmit(txb, ieee);
+		}else{
+			if ((*ieee->hard_start_xmit)(txb, dev) == 0) {
+				stats->tx_packets++;
+				stats->tx_bytes += txb->payload_size;
+				return 0;
+			}
+			ieee80211_txb_free(txb);
+		}
+	}
+
+	return 0;
+
+ failed:
+	spin_unlock_irqrestore(&ieee->lock, flags);
+	netif_stop_queue(dev);
+	stats->tx_errors++;
+	return 1;
+
+}
+
+EXPORT_SYMBOL(ieee80211_txb_free);
diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_wx.c b/drivers/staging/rtl8192u/ieee80211/ieee80211_wx.c
new file mode 100644
index 000000000000..5f12d62658c9
--- /dev/null
+++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_wx.c
@@ -0,0 +1,878 @@
+/******************************************************************************
+
+  Copyright(c) 2004 Intel Corporation. All rights reserved.
+
+  Portions of this file are based on the WEP enablement code provided by the
+  Host AP project hostap-drivers v0.1.3
+  Copyright (c) 2001-2002, SSH Communications Security Corp and Jouni Malinen
+  <jkmaline@cc.hut.fi>
+  Copyright (c) 2002-2003, Jouni Malinen <jkmaline@cc.hut.fi>
+
+  This program is free software; you can redistribute it and/or modify it
+  under the terms of version 2 of the GNU General Public License as
+  published by the Free Software Foundation.
+
+  This program is distributed in the hope that it will be useful, but WITHOUT
+  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+  more details.
+
+  You should have received a copy of the GNU General Public License along with
+  this program; if not, write to the Free Software Foundation, Inc., 59
+  Temple Place - Suite 330, Boston, MA  02111-1307, USA.
+
+  The full GNU General Public License is included in this distribution in the
+  file called LICENSE.
+
+  Contact Information:
+  James P. Ketrenos <ipw2100-admin@linux.intel.com>
+  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+
+******************************************************************************/
+#include <linux/wireless.h>
+#include <linux/version.h>
+#include <linux/kmod.h>
+#include <linux/module.h>
+
+#include "ieee80211.h"
+struct modes_unit {
+	char *mode_string;
+	int mode_size;
+};
+struct modes_unit ieee80211_modes[] = {
+	{"a",1},
+	{"b",1},
+	{"g",1},
+	{"?",1},
+	{"N-24G",5},
+	{"N-5G",4},
+};
+
+#define iwe_stream_add_event_rsl iwe_stream_add_event
+
+#define MAX_CUSTOM_LEN 64
+static inline char *rtl819x_translate_scan(struct ieee80211_device *ieee,
+					   char *start, char *stop,
+					   struct ieee80211_network *network,
+					   struct iw_request_info *info)
+{
+	char custom[MAX_CUSTOM_LEN];
+	char proto_name[IFNAMSIZ];
+	char *pname = proto_name;
+	char *p;
+	struct iw_event iwe;
+	int i, j;
+	u16 max_rate, rate;
+	static u8	EWC11NHTCap[] = {0x00, 0x90, 0x4c, 0x33};
+
+	/* First entry *MUST* be the AP MAC address */
+	iwe.cmd = SIOCGIWAP;
+	iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
+	memcpy(iwe.u.ap_addr.sa_data, network->bssid, ETH_ALEN);
+	start = iwe_stream_add_event_rsl(info, start, stop, &iwe, IW_EV_ADDR_LEN);
+	/* Remaining entries will be displayed in the order we provide them */
+
+	/* Add the ESSID */
+	iwe.cmd = SIOCGIWESSID;
+	iwe.u.data.flags = 1;
+//	if (network->flags & NETWORK_EMPTY_ESSID) {
+	if (network->ssid_len == 0) {
+		iwe.u.data.length = sizeof("<hidden>");
+		start = iwe_stream_add_point(info, start, stop, &iwe, "<hidden>");
+	} else {
+		iwe.u.data.length = min(network->ssid_len, (u8)32);
+		start = iwe_stream_add_point(info, start, stop, &iwe, network->ssid);
+	}
+	/* Add the protocol name */
+	iwe.cmd = SIOCGIWNAME;
+	for(i=0; i<(sizeof(ieee80211_modes)/sizeof(ieee80211_modes[0])); i++) {
+		if(network->mode&(1<<i)) {
+			sprintf(pname,ieee80211_modes[i].mode_string,ieee80211_modes[i].mode_size);
+			pname +=ieee80211_modes[i].mode_size;
+		}
+	}
+	*pname = '\0';
+	snprintf(iwe.u.name, IFNAMSIZ, "IEEE802.11%s", proto_name);
+	start = iwe_stream_add_event_rsl(info, start, stop, &iwe, IW_EV_CHAR_LEN);
+	/* Add mode */
+	iwe.cmd = SIOCGIWMODE;
+	if (network->capability &
+	    (WLAN_CAPABILITY_BSS | WLAN_CAPABILITY_IBSS)) {
+		if (network->capability & WLAN_CAPABILITY_BSS)
+			iwe.u.mode = IW_MODE_MASTER;
+		else
+			iwe.u.mode = IW_MODE_ADHOC;
+		start = iwe_stream_add_event_rsl(info, start, stop, &iwe, IW_EV_UINT_LEN);
+	}
+
+	/* Add frequency/channel */
+	iwe.cmd = SIOCGIWFREQ;
+/*	iwe.u.freq.m = ieee80211_frequency(network->channel, network->mode);
+	iwe.u.freq.e = 3; */
+	iwe.u.freq.m = network->channel;
+	iwe.u.freq.e = 0;
+	iwe.u.freq.i = 0;
+	start = iwe_stream_add_event_rsl(info, start, stop, &iwe, IW_EV_FREQ_LEN);
+	/* Add encryption capability */
+	iwe.cmd = SIOCGIWENCODE;
+	if (network->capability & WLAN_CAPABILITY_PRIVACY)
+		iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
+	else
+		iwe.u.data.flags = IW_ENCODE_DISABLED;
+	iwe.u.data.length = 0;
+	start = iwe_stream_add_point(info, start, stop, &iwe, network->ssid);
+	/* Add basic and extended rates */
+	max_rate = 0;
+	p = custom;
+	p += snprintf(p, MAX_CUSTOM_LEN - (p - custom), " Rates (Mb/s): ");
+	for (i = 0, j = 0; i < network->rates_len; ) {
+		if (j < network->rates_ex_len &&
+		    ((network->rates_ex[j] & 0x7F) <
+		     (network->rates[i] & 0x7F)))
+			rate = network->rates_ex[j++] & 0x7F;
+		else
+			rate = network->rates[i++] & 0x7F;
+		if (rate > max_rate)
+			max_rate = rate;
+		p += snprintf(p, MAX_CUSTOM_LEN - (p - custom),
+			      "%d%s ", rate >> 1, (rate & 1) ? ".5" : "");
+	}
+	for (; j < network->rates_ex_len; j++) {
+		rate = network->rates_ex[j] & 0x7F;
+		p += snprintf(p, MAX_CUSTOM_LEN - (p - custom),
+			      "%d%s ", rate >> 1, (rate & 1) ? ".5" : "");
+		if (rate > max_rate)
+			max_rate = rate;
+	}
+
+	if (network->mode >= IEEE_N_24G)//add N rate here;
+	{
+		PHT_CAPABILITY_ELE ht_cap = NULL;
+		bool is40M = false, isShortGI = false;
+		u8 max_mcs = 0;
+		if (!memcmp(network->bssht.bdHTCapBuf, EWC11NHTCap, 4))
+			ht_cap = (PHT_CAPABILITY_ELE)&network->bssht.bdHTCapBuf[4];
+		else
+			ht_cap = (PHT_CAPABILITY_ELE)&network->bssht.bdHTCapBuf[0];
+		is40M = (ht_cap->ChlWidth)?1:0;
+		isShortGI = (ht_cap->ChlWidth)?
+						((ht_cap->ShortGI40Mhz)?1:0):
+						((ht_cap->ShortGI20Mhz)?1:0);
+
+		max_mcs = HTGetHighestMCSRate(ieee, ht_cap->MCS, MCS_FILTER_ALL);
+		rate = MCS_DATA_RATE[is40M][isShortGI][max_mcs&0x7f];
+		if (rate > max_rate)
+			max_rate = rate;
+	}
+	iwe.cmd = SIOCGIWRATE;
+	iwe.u.bitrate.fixed = iwe.u.bitrate.disabled = 0;
+	iwe.u.bitrate.value = max_rate * 500000;
+	start = iwe_stream_add_event_rsl(info, start, stop, &iwe,
+				     IW_EV_PARAM_LEN);
+	iwe.cmd = IWEVCUSTOM;
+	iwe.u.data.length = p - custom;
+	if (iwe.u.data.length)
+	start = iwe_stream_add_point(info, start, stop, &iwe, custom);
+	/* Add quality statistics */
+	/* TODO: Fix these values... */
+	iwe.cmd = IWEVQUAL;
+	iwe.u.qual.qual = network->stats.signal;
+	iwe.u.qual.level = network->stats.rssi;
+	iwe.u.qual.noise = network->stats.noise;
+	iwe.u.qual.updated = network->stats.mask & IEEE80211_STATMASK_WEMASK;
+	if (!(network->stats.mask & IEEE80211_STATMASK_RSSI))
+		iwe.u.qual.updated |= IW_QUAL_LEVEL_INVALID;
+	if (!(network->stats.mask & IEEE80211_STATMASK_NOISE))
+		iwe.u.qual.updated |= IW_QUAL_NOISE_INVALID;
+	if (!(network->stats.mask & IEEE80211_STATMASK_SIGNAL))
+		iwe.u.qual.updated |= IW_QUAL_QUAL_INVALID;
+	iwe.u.qual.updated = 7;
+	start = iwe_stream_add_event_rsl(info, start, stop, &iwe, IW_EV_QUAL_LEN);
+	iwe.cmd = IWEVCUSTOM;
+	p = custom;
+
+	iwe.u.data.length = p - custom;
+	if (iwe.u.data.length)
+	    start = iwe_stream_add_point(info, start, stop, &iwe, custom);
+#if (WIRELESS_EXT < 18)
+	if (ieee->wpa_enabled && network->wpa_ie_len){
+		char buf[MAX_WPA_IE_LEN * 2 + 30];
+	//	printk("WPA IE\n");
+		u8 *p = buf;
+		p += sprintf(p, "wpa_ie=");
+		for (i = 0; i < network->wpa_ie_len; i++) {
+			p += sprintf(p, "%02x", network->wpa_ie[i]);
+		}
+
+		memset(&iwe, 0, sizeof(iwe));
+		iwe.cmd = IWEVCUSTOM;
+		iwe.u.data.length = strlen(buf);
+		start = iwe_stream_add_point(info, start, stop, &iwe, buf);
+	}
+
+	if (ieee->wpa_enabled && network->rsn_ie_len){
+		char buf[MAX_WPA_IE_LEN * 2 + 30];
+
+		u8 *p = buf;
+		p += sprintf(p, "rsn_ie=");
+		for (i = 0; i < network->rsn_ie_len; i++) {
+			p += sprintf(p, "%02x", network->rsn_ie[i]);
+		}
+
+		memset(&iwe, 0, sizeof(iwe));
+		iwe.cmd = IWEVCUSTOM;
+		iwe.u.data.length = strlen(buf);
+		start = iwe_stream_add_point(info, start, stop, &iwe, buf);
+	}
+#else
+	memset(&iwe, 0, sizeof(iwe));
+	if (network->wpa_ie_len)
+	{
+		char buf[MAX_WPA_IE_LEN];
+		memcpy(buf, network->wpa_ie, network->wpa_ie_len);
+		iwe.cmd = IWEVGENIE;
+		iwe.u.data.length = network->wpa_ie_len;
+		start = iwe_stream_add_point(info, start, stop, &iwe, buf);
+	}
+	memset(&iwe, 0, sizeof(iwe));
+	if (network->rsn_ie_len)
+	{
+		char buf[MAX_WPA_IE_LEN];
+		memcpy(buf, network->rsn_ie, network->rsn_ie_len);
+		iwe.cmd = IWEVGENIE;
+		iwe.u.data.length = network->rsn_ie_len;
+		start = iwe_stream_add_point(info, start, stop, &iwe, buf);
+	}
+#endif
+
+
+	/* Add EXTRA: Age to display seconds since last beacon/probe response
+	 * for given network. */
+	iwe.cmd = IWEVCUSTOM;
+	p = custom;
+	p += snprintf(p, MAX_CUSTOM_LEN - (p - custom),
+		      " Last beacon: %lums ago", (jiffies - network->last_scanned) / (HZ / 100));
+	iwe.u.data.length = p - custom;
+	if (iwe.u.data.length)
+	    start = iwe_stream_add_point(info, start, stop, &iwe, custom);
+
+	return start;
+}
+
+int ieee80211_wx_get_scan(struct ieee80211_device *ieee,
+			  struct iw_request_info *info,
+			  union iwreq_data *wrqu, char *extra)
+{
+	struct ieee80211_network *network;
+	unsigned long flags;
+
+	char *ev = extra;
+//	char *stop = ev + IW_SCAN_MAX_DATA;
+	char *stop = ev + wrqu->data.length;//IW_SCAN_MAX_DATA;
+	//char *stop = ev + IW_SCAN_MAX_DATA;
+	int i = 0;
+	int err = 0;
+	IEEE80211_DEBUG_WX("Getting scan\n");
+	down(&ieee->wx_sem);
+	spin_lock_irqsave(&ieee->lock, flags);
+
+	list_for_each_entry(network, &ieee->network_list, list) {
+		i++;
+		if((stop-ev)<200)
+		{
+			err = -E2BIG;
+			break;
+												}
+		if (ieee->scan_age == 0 ||
+		    time_after(network->last_scanned + ieee->scan_age, jiffies))
+			ev = rtl819x_translate_scan(ieee, ev, stop, network, info);
+		else
+			IEEE80211_DEBUG_SCAN(
+				"Not showing network '%s ("
+				MAC_FMT ")' due to age (%lums).\n",
+				escape_essid(network->ssid,
+					     network->ssid_len),
+				MAC_ARG(network->bssid),
+				(jiffies - network->last_scanned) / (HZ / 100));
+	}
+
+	spin_unlock_irqrestore(&ieee->lock, flags);
+	up(&ieee->wx_sem);
+	wrqu->data.length = ev -  extra;
+	wrqu->data.flags = 0;
+
+	IEEE80211_DEBUG_WX("exit: %d networks returned.\n", i);
+
+	return err;
+}
+
+int ieee80211_wx_set_encode(struct ieee80211_device *ieee,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu, char *keybuf)
+{
+	struct iw_point *erq = &(wrqu->encoding);
+	struct net_device *dev = ieee->dev;
+	struct ieee80211_security sec = {
+		.flags = 0
+	};
+	int i, key, key_provided, len;
+	struct ieee80211_crypt_data **crypt;
+
+	IEEE80211_DEBUG_WX("SET_ENCODE\n");
+
+	key = erq->flags & IW_ENCODE_INDEX;
+	if (key) {
+		if (key > WEP_KEYS)
+			return -EINVAL;
+		key--;
+		key_provided = 1;
+	} else {
+		key_provided = 0;
+		key = ieee->tx_keyidx;
+	}
+
+	IEEE80211_DEBUG_WX("Key: %d [%s]\n", key, key_provided ?
+			   "provided" : "default");
+	crypt = &ieee->crypt[key];
+
+	if (erq->flags & IW_ENCODE_DISABLED) {
+		if (key_provided && *crypt) {
+			IEEE80211_DEBUG_WX("Disabling encryption on key %d.\n",
+					   key);
+			ieee80211_crypt_delayed_deinit(ieee, crypt);
+		} else
+			IEEE80211_DEBUG_WX("Disabling encryption.\n");
+
+		/* Check all the keys to see if any are still configured,
+		 * and if no key index was provided, de-init them all */
+		for (i = 0; i < WEP_KEYS; i++) {
+			if (ieee->crypt[i] != NULL) {
+				if (key_provided)
+					break;
+				ieee80211_crypt_delayed_deinit(
+					ieee, &ieee->crypt[i]);
+			}
+		}
+
+		if (i == WEP_KEYS) {
+			sec.enabled = 0;
+			sec.level = SEC_LEVEL_0;
+			sec.flags |= SEC_ENABLED | SEC_LEVEL;
+		}
+
+		goto done;
+	}
+
+
+
+	sec.enabled = 1;
+	sec.flags |= SEC_ENABLED;
+
+	if (*crypt != NULL && (*crypt)->ops != NULL &&
+	    strcmp((*crypt)->ops->name, "WEP") != 0) {
+		/* changing to use WEP; deinit previously used algorithm
+		 * on this key */
+		ieee80211_crypt_delayed_deinit(ieee, crypt);
+	}
+
+	if (*crypt == NULL) {
+		struct ieee80211_crypt_data *new_crypt;
+
+		/* take WEP into use */
+		new_crypt = kmalloc(sizeof(struct ieee80211_crypt_data),
+				    GFP_KERNEL);
+		if (new_crypt == NULL)
+			return -ENOMEM;
+		memset(new_crypt, 0, sizeof(struct ieee80211_crypt_data));
+		new_crypt->ops = ieee80211_get_crypto_ops("WEP");
+		if (!new_crypt->ops) {
+			request_module("ieee80211_crypt_wep");
+			new_crypt->ops = ieee80211_get_crypto_ops("WEP");
+		}
+		if (new_crypt->ops && try_module_get(new_crypt->ops->owner))
+			new_crypt->priv = new_crypt->ops->init(key);
+
+		if (!new_crypt->ops || !new_crypt->priv) {
+			kfree(new_crypt);
+			new_crypt = NULL;
+
+			printk(KERN_WARNING "%s: could not initialize WEP: "
+			       "load module ieee80211_crypt_wep\n",
+			       dev->name);
+			return -EOPNOTSUPP;
+		}
+		*crypt = new_crypt;
+	}
+
+	/* If a new key was provided, set it up */
+	if (erq->length > 0) {
+		len = erq->length <= 5 ? 5 : 13;
+		memcpy(sec.keys[key], keybuf, erq->length);
+		if (len > erq->length)
+			memset(sec.keys[key] + erq->length, 0,
+			       len - erq->length);
+		IEEE80211_DEBUG_WX("Setting key %d to '%s' (%d:%d bytes)\n",
+				   key, escape_essid(sec.keys[key], len),
+				   erq->length, len);
+		sec.key_sizes[key] = len;
+		(*crypt)->ops->set_key(sec.keys[key], len, NULL,
+				       (*crypt)->priv);
+		sec.flags |= (1 << key);
+		/* This ensures a key will be activated if no key is
+		 * explicitely set */
+		if (key == sec.active_key)
+			sec.flags |= SEC_ACTIVE_KEY;
+		ieee->tx_keyidx = key;
+
+	} else {
+		len = (*crypt)->ops->get_key(sec.keys[key], WEP_KEY_LEN,
+					     NULL, (*crypt)->priv);
+		if (len == 0) {
+			/* Set a default key of all 0 */
+			printk("Setting key %d to all zero.\n",
+					   key);
+
+			IEEE80211_DEBUG_WX("Setting key %d to all zero.\n",
+					   key);
+			memset(sec.keys[key], 0, 13);
+			(*crypt)->ops->set_key(sec.keys[key], 13, NULL,
+					       (*crypt)->priv);
+			sec.key_sizes[key] = 13;
+			sec.flags |= (1 << key);
+		}
+
+		/* No key data - just set the default TX key index */
+		if (key_provided) {
+			IEEE80211_DEBUG_WX(
+				"Setting key %d to default Tx key.\n", key);
+			ieee->tx_keyidx = key;
+			sec.active_key = key;
+			sec.flags |= SEC_ACTIVE_KEY;
+		}
+	}
+
+ done:
+	ieee->open_wep = !(erq->flags & IW_ENCODE_RESTRICTED);
+	ieee->auth_mode = ieee->open_wep ? WLAN_AUTH_OPEN : WLAN_AUTH_SHARED_KEY;
+	sec.auth_mode = ieee->open_wep ? WLAN_AUTH_OPEN : WLAN_AUTH_SHARED_KEY;
+	sec.flags |= SEC_AUTH_MODE;
+	IEEE80211_DEBUG_WX("Auth: %s\n", sec.auth_mode == WLAN_AUTH_OPEN ?
+			   "OPEN" : "SHARED KEY");
+
+	/* For now we just support WEP, so only set that security level...
+	 * TODO: When WPA is added this is one place that needs to change */
+	sec.flags |= SEC_LEVEL;
+	sec.level = SEC_LEVEL_1; /* 40 and 104 bit WEP */
+
+	if (ieee->set_security)
+		ieee->set_security(dev, &sec);
+
+	/* Do not reset port if card is in Managed mode since resetting will
+	 * generate new IEEE 802.11 authentication which may end up in looping
+	 * with IEEE 802.1X.  If your hardware requires a reset after WEP
+	 * configuration (for example... Prism2), implement the reset_port in
+	 * the callbacks structures used to initialize the 802.11 stack. */
+	if (ieee->reset_on_keychange &&
+	    ieee->iw_mode != IW_MODE_INFRA &&
+	    ieee->reset_port && ieee->reset_port(dev)) {
+		printk(KERN_DEBUG "%s: reset_port failed\n", dev->name);
+		return -EINVAL;
+	}
+	return 0;
+}
+
+int ieee80211_wx_get_encode(struct ieee80211_device *ieee,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu, char *keybuf)
+{
+	struct iw_point *erq = &(wrqu->encoding);
+	int len, key;
+	struct ieee80211_crypt_data *crypt;
+
+	IEEE80211_DEBUG_WX("GET_ENCODE\n");
+
+	if(ieee->iw_mode == IW_MODE_MONITOR)
+		return -1;
+
+	key = erq->flags & IW_ENCODE_INDEX;
+	if (key) {
+		if (key > WEP_KEYS)
+			return -EINVAL;
+		key--;
+	} else
+		key = ieee->tx_keyidx;
+
+	crypt = ieee->crypt[key];
+	erq->flags = key + 1;
+
+	if (crypt == NULL || crypt->ops == NULL) {
+		erq->length = 0;
+		erq->flags |= IW_ENCODE_DISABLED;
+		return 0;
+	}
+	len = crypt->ops->get_key(keybuf, SCM_KEY_LEN, NULL, crypt->priv);
+	erq->length = (len >= 0 ? len : 0);
+
+	erq->flags |= IW_ENCODE_ENABLED;
+
+	if (ieee->open_wep)
+		erq->flags |= IW_ENCODE_OPEN;
+	else
+		erq->flags |= IW_ENCODE_RESTRICTED;
+
+	return 0;
+}
+#if (WIRELESS_EXT >= 18)
+int ieee80211_wx_set_encode_ext(struct ieee80211_device *ieee,
+			       struct iw_request_info *info,
+			       union iwreq_data *wrqu, char *extra)
+{
+	int ret = 0;
+	struct net_device *dev = ieee->dev;
+	struct iw_point *encoding = &wrqu->encoding;
+	struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
+	int i, idx;
+	int group_key = 0;
+	const char *alg, *module;
+	struct ieee80211_crypto_ops *ops;
+	struct ieee80211_crypt_data **crypt;
+
+	struct ieee80211_security sec = {
+		.flags = 0,
+	};
+	//printk("======>encoding flag:%x,ext flag:%x, ext alg:%d\n", encoding->flags,ext->ext_flags, ext->alg);
+	idx = encoding->flags & IW_ENCODE_INDEX;
+	if (idx) {
+		if (idx < 1 || idx > WEP_KEYS)
+			return -EINVAL;
+		idx--;
+	} else
+		idx = ieee->tx_keyidx;
+
+	if (ext->ext_flags & IW_ENCODE_EXT_GROUP_KEY) {
+
+		crypt = &ieee->crypt[idx];
+
+		group_key = 1;
+	} else {
+		/* some Cisco APs use idx>0 for unicast in dynamic WEP */
+		//printk("not group key, flags:%x, ext->alg:%d\n", ext->ext_flags, ext->alg);
+		if (idx != 0 && ext->alg != IW_ENCODE_ALG_WEP)
+			return -EINVAL;
+		if (ieee->iw_mode == IW_MODE_INFRA)
+
+			crypt = &ieee->crypt[idx];
+
+		else
+			return -EINVAL;
+	}
+
+	sec.flags |= SEC_ENABLED;// | SEC_ENCRYPT;
+	if ((encoding->flags & IW_ENCODE_DISABLED) ||
+	    ext->alg == IW_ENCODE_ALG_NONE) {
+		if (*crypt)
+			ieee80211_crypt_delayed_deinit(ieee, crypt);
+
+		for (i = 0; i < WEP_KEYS; i++)
+
+			if (ieee->crypt[i] != NULL)
+
+				break;
+
+		if (i == WEP_KEYS) {
+			sec.enabled = 0;
+		      //  sec.encrypt = 0;
+			sec.level = SEC_LEVEL_0;
+			sec.flags |= SEC_LEVEL;
+		}
+		//printk("disabled: flag:%x\n", encoding->flags);
+		goto done;
+	}
+
+	sec.enabled = 1;
+    //    sec.encrypt = 1;
+	switch (ext->alg) {
+	case IW_ENCODE_ALG_WEP:
+		alg = "WEP";
+		module = "ieee80211_crypt_wep";
+		break;
+	case IW_ENCODE_ALG_TKIP:
+		alg = "TKIP";
+		module = "ieee80211_crypt_tkip";
+		break;
+	case IW_ENCODE_ALG_CCMP:
+		alg = "CCMP";
+		module = "ieee80211_crypt_ccmp";
+		break;
+	default:
+		IEEE80211_DEBUG_WX("%s: unknown crypto alg %d\n",
+				   dev->name, ext->alg);
+		ret = -EINVAL;
+		goto done;
+	}
+	printk("alg name:%s\n",alg);
+
+	 ops = ieee80211_get_crypto_ops(alg);
+	if (ops == NULL) {
+		request_module(module);
+		ops = ieee80211_get_crypto_ops(alg);
+	}
+	if (ops == NULL) {
+		IEEE80211_DEBUG_WX("%s: unknown crypto alg %d\n",
+				   dev->name, ext->alg);
+		printk("========>unknown crypto alg %d\n", ext->alg);
+		ret = -EINVAL;
+		goto done;
+	}
+
+	if (*crypt == NULL || (*crypt)->ops != ops) {
+		struct ieee80211_crypt_data *new_crypt;
+
+		ieee80211_crypt_delayed_deinit(ieee, crypt);
+
+		new_crypt = kzalloc(sizeof(*new_crypt), GFP_KERNEL);
+		if (new_crypt == NULL) {
+			ret = -ENOMEM;
+			goto done;
+		}
+		new_crypt->ops = ops;
+		if (new_crypt->ops && try_module_get(new_crypt->ops->owner))
+			new_crypt->priv = new_crypt->ops->init(idx);
+		if (new_crypt->priv == NULL) {
+			kfree(new_crypt);
+			ret = -EINVAL;
+			goto done;
+		}
+		*crypt = new_crypt;
+
+	}
+
+	if (ext->key_len > 0 && (*crypt)->ops->set_key &&
+	    (*crypt)->ops->set_key(ext->key, ext->key_len, ext->rx_seq,
+				   (*crypt)->priv) < 0) {
+		IEEE80211_DEBUG_WX("%s: key setting failed\n", dev->name);
+		printk("key setting failed\n");
+		ret = -EINVAL;
+		goto done;
+	}
+ //skip_host_crypt:
+	//printk("skip_host_crypt:ext_flags:%x\n", ext->ext_flags);
+	if (ext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY) {
+		ieee->tx_keyidx = idx;
+		sec.active_key = idx;
+		sec.flags |= SEC_ACTIVE_KEY;
+	}
+
+	if (ext->alg != IW_ENCODE_ALG_NONE) {
+		//memcpy(sec.keys[idx], ext->key, ext->key_len);
+		sec.key_sizes[idx] = ext->key_len;
+		sec.flags |= (1 << idx);
+		if (ext->alg == IW_ENCODE_ALG_WEP) {
+		      //  sec.encode_alg[idx] = SEC_ALG_WEP;
+			sec.flags |= SEC_LEVEL;
+			sec.level = SEC_LEVEL_1;
+		} else if (ext->alg == IW_ENCODE_ALG_TKIP) {
+		      //  sec.encode_alg[idx] = SEC_ALG_TKIP;
+			sec.flags |= SEC_LEVEL;
+			sec.level = SEC_LEVEL_2;
+		} else if (ext->alg == IW_ENCODE_ALG_CCMP) {
+		       // sec.encode_alg[idx] = SEC_ALG_CCMP;
+			sec.flags |= SEC_LEVEL;
+			sec.level = SEC_LEVEL_3;
+		}
+		/* Don't set sec level for group keys. */
+		if (group_key)
+			sec.flags &= ~SEC_LEVEL;
+	}
+done:
+	if (ieee->set_security)
+		ieee->set_security(ieee->dev, &sec);
+
+	 if (ieee->reset_on_keychange &&
+	    ieee->iw_mode != IW_MODE_INFRA &&
+	    ieee->reset_port && ieee->reset_port(dev)) {
+		IEEE80211_DEBUG_WX("%s: reset_port failed\n", dev->name);
+		return -EINVAL;
+	}
+	return ret;
+}
+
+int ieee80211_wx_get_encode_ext(struct ieee80211_device *ieee,
+			       struct iw_request_info *info,
+			       union iwreq_data *wrqu, char *extra)
+{
+	struct iw_point *encoding = &wrqu->encoding;
+	struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
+	struct ieee80211_crypt_data *crypt;
+	int idx, max_key_len;
+
+	max_key_len = encoding->length - sizeof(*ext);
+	if (max_key_len < 0)
+		return -EINVAL;
+
+	idx = encoding->flags & IW_ENCODE_INDEX;
+	if (idx) {
+		if (idx < 1 || idx > WEP_KEYS)
+			return -EINVAL;
+		idx--;
+	} else
+		idx = ieee->tx_keyidx;
+
+	if (!ext->ext_flags & IW_ENCODE_EXT_GROUP_KEY &&
+	    ext->alg != IW_ENCODE_ALG_WEP)
+		if (idx != 0 || ieee->iw_mode != IW_MODE_INFRA)
+			return -EINVAL;
+
+	crypt = ieee->crypt[idx];
+	encoding->flags = idx + 1;
+	memset(ext, 0, sizeof(*ext));
+
+	if (crypt == NULL || crypt->ops == NULL ) {
+		ext->alg = IW_ENCODE_ALG_NONE;
+		ext->key_len = 0;
+		encoding->flags |= IW_ENCODE_DISABLED;
+	} else {
+		if (strcmp(crypt->ops->name, "WEP") == 0 )
+			ext->alg = IW_ENCODE_ALG_WEP;
+		else if (strcmp(crypt->ops->name, "TKIP"))
+			ext->alg = IW_ENCODE_ALG_TKIP;
+		else if (strcmp(crypt->ops->name, "CCMP"))
+			ext->alg = IW_ENCODE_ALG_CCMP;
+		else
+			return -EINVAL;
+		ext->key_len = crypt->ops->get_key(ext->key, SCM_KEY_LEN, NULL, crypt->priv);
+		encoding->flags |= IW_ENCODE_ENABLED;
+		if (ext->key_len &&
+		    (ext->alg == IW_ENCODE_ALG_TKIP ||
+		     ext->alg == IW_ENCODE_ALG_CCMP))
+			ext->ext_flags |= IW_ENCODE_EXT_TX_SEQ_VALID;
+
+	}
+
+	return 0;
+}
+
+int ieee80211_wx_set_mlme(struct ieee80211_device *ieee,
+			       struct iw_request_info *info,
+			       union iwreq_data *wrqu, char *extra)
+{
+	struct iw_mlme *mlme = (struct iw_mlme *) extra;
+	switch (mlme->cmd) {
+	case IW_MLME_DEAUTH:
+	case IW_MLME_DISASSOC:
+		ieee80211_disassociate(ieee);
+		break;
+	 default:
+		return -EOPNOTSUPP;
+	}
+	return 0;
+}
+
+int ieee80211_wx_set_auth(struct ieee80211_device *ieee,
+			       struct iw_request_info *info,
+			       struct iw_param *data, char *extra)
+{
+	switch (data->flags & IW_AUTH_INDEX) {
+	case IW_AUTH_WPA_VERSION:
+	     /*need to support wpa2 here*/
+		//printk("wpa version:%x\n", data->value);
+		break;
+	case IW_AUTH_CIPHER_PAIRWISE:
+	case IW_AUTH_CIPHER_GROUP:
+	case IW_AUTH_KEY_MGMT:
+		/*
+ *                  * Host AP driver does not use these parameters and allows
+ *                                   * wpa_supplicant to control them internally.
+ *                                                    */
+		break;
+	case IW_AUTH_TKIP_COUNTERMEASURES:
+		ieee->tkip_countermeasures = data->value;
+		break;
+	case IW_AUTH_DROP_UNENCRYPTED:
+		ieee->drop_unencrypted = data->value;
+		break;
+
+	case IW_AUTH_80211_AUTH_ALG:
+		//printk("======>%s():data->value is %d\n",__FUNCTION__,data->value);
+	//	ieee->open_wep = (data->value&IW_AUTH_ALG_OPEN_SYSTEM)?1:0;
+		if(data->value & IW_AUTH_ALG_SHARED_KEY){
+			ieee->open_wep = 0;
+			ieee->auth_mode = 1;
+		}
+		else if(data->value & IW_AUTH_ALG_OPEN_SYSTEM){
+			ieee->open_wep = 1;
+			ieee->auth_mode = 0;
+		}
+		else if(data->value & IW_AUTH_ALG_LEAP){
+			ieee->open_wep = 1;
+			ieee->auth_mode = 2;
+			//printk("hahahaa:LEAP\n");
+		}
+		else
+			return -EINVAL;
+		//printk("open_wep:%d\n", ieee->open_wep);
+		break;
+
+	case IW_AUTH_WPA_ENABLED:
+		ieee->wpa_enabled = (data->value)?1:0;
+		//printk("enalbe wpa:%d\n", ieee->wpa_enabled);
+		break;
+
+	case IW_AUTH_RX_UNENCRYPTED_EAPOL:
+		ieee->ieee802_1x = data->value;
+		break;
+	case IW_AUTH_PRIVACY_INVOKED:
+		ieee->privacy_invoked = data->value;
+		break;
+	default:
+		return -EOPNOTSUPP;
+	}
+	return 0;
+}
+#endif
+int ieee80211_wx_set_gen_ie(struct ieee80211_device *ieee, u8 *ie, size_t len)
+{
+	u8 *buf;
+
+	if (len>MAX_WPA_IE_LEN || (len && ie == NULL))
+	{
+	//	printk("return error out, len:%d\n", len);
+	return -EINVAL;
+	}
+
+
+	if (len)
+	{
+		if (len != ie[1]+2)
+		{
+			printk("len:%zu, ie:%d\n", len, ie[1]);
+			return -EINVAL;
+		}
+		buf = kmalloc(len, GFP_KERNEL);
+		if (buf == NULL)
+			return -ENOMEM;
+		memcpy(buf, ie, len);
+		kfree(ieee->wpa_ie);
+		ieee->wpa_ie = buf;
+		ieee->wpa_ie_len = len;
+	}
+	else{
+		if (ieee->wpa_ie)
+		kfree(ieee->wpa_ie);
+		ieee->wpa_ie = NULL;
+		ieee->wpa_ie_len = 0;
+	}
+	return 0;
+
+}
+
+EXPORT_SYMBOL(ieee80211_wx_set_gen_ie);
+#if (WIRELESS_EXT >= 18)
+EXPORT_SYMBOL(ieee80211_wx_set_mlme);
+EXPORT_SYMBOL(ieee80211_wx_set_auth);
+EXPORT_SYMBOL(ieee80211_wx_set_encode_ext);
+EXPORT_SYMBOL(ieee80211_wx_get_encode_ext);
+#endif
+EXPORT_SYMBOL(ieee80211_wx_get_scan);
+EXPORT_SYMBOL(ieee80211_wx_set_encode);
+EXPORT_SYMBOL(ieee80211_wx_get_encode);
diff --git a/drivers/staging/rtl8192u/ieee80211/internal.h b/drivers/staging/rtl8192u/ieee80211/internal.h
new file mode 100644
index 000000000000..a7c096eb269f
--- /dev/null
+++ b/drivers/staging/rtl8192u/ieee80211/internal.h
@@ -0,0 +1,99 @@
+/*
+ * Cryptographic API.
+ *
+ * Copyright (c) 2002 James Morris <jmorris@intercode.com.au>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2 of the License, or (at your option)
+ * any later version.
+ *
+ */
+#ifndef _CRYPTO_INTERNAL_H
+#define _CRYPTO_INTERNAL_H
+
+
+//#include <linux/crypto.h>
+#include "rtl_crypto.h"
+#include <linux/mm.h>
+#include <linux/highmem.h>
+#include <linux/init.h>
+#include <asm/hardirq.h>
+#include <asm/softirq.h>
+#include <asm/kmap_types.h>
+
+
+extern enum km_type crypto_km_types[];
+
+static inline enum km_type crypto_kmap_type(int out)
+{
+	return crypto_km_types[(in_softirq() ? 2 : 0) + out];
+}
+
+static inline void *crypto_kmap(struct page *page, int out)
+{
+	return kmap_atomic(page, crypto_kmap_type(out));
+}
+
+static inline void crypto_kunmap(void *vaddr, int out)
+{
+	kunmap_atomic(vaddr, crypto_kmap_type(out));
+}
+
+static inline void crypto_yield(struct crypto_tfm *tfm)
+{
+	if (!in_softirq())
+		cond_resched();
+}
+
+static inline void *crypto_tfm_ctx(struct crypto_tfm *tfm)
+{
+	return (void *)&tfm[1];
+}
+
+struct crypto_alg *crypto_alg_lookup(const char *name);
+
+#ifdef CONFIG_KMOD
+void crypto_alg_autoload(const char *name);
+struct crypto_alg *crypto_alg_mod_lookup(const char *name);
+#else
+static inline struct crypto_alg *crypto_alg_mod_lookup(const char *name)
+{
+	return crypto_alg_lookup(name);
+}
+#endif
+
+#ifdef CONFIG_CRYPTO_HMAC
+int crypto_alloc_hmac_block(struct crypto_tfm *tfm);
+void crypto_free_hmac_block(struct crypto_tfm *tfm);
+#else
+static inline int crypto_alloc_hmac_block(struct crypto_tfm *tfm)
+{
+	return 0;
+}
+
+static inline void crypto_free_hmac_block(struct crypto_tfm *tfm)
+{ }
+#endif
+
+#ifdef CONFIG_PROC_FS
+void __init crypto_init_proc(void);
+#else
+static inline void crypto_init_proc(void)
+{ }
+#endif
+
+int crypto_init_digest_flags(struct crypto_tfm *tfm, u32 flags);
+int crypto_init_cipher_flags(struct crypto_tfm *tfm, u32 flags);
+int crypto_init_compress_flags(struct crypto_tfm *tfm, u32 flags);
+
+int crypto_init_digest_ops(struct crypto_tfm *tfm);
+int crypto_init_cipher_ops(struct crypto_tfm *tfm);
+int crypto_init_compress_ops(struct crypto_tfm *tfm);
+
+void crypto_exit_digest_ops(struct crypto_tfm *tfm);
+void crypto_exit_cipher_ops(struct crypto_tfm *tfm);
+void crypto_exit_compress_ops(struct crypto_tfm *tfm);
+
+#endif	/* _CRYPTO_INTERNAL_H */
+
diff --git a/drivers/staging/rtl8192u/ieee80211/kmap_types.h b/drivers/staging/rtl8192u/ieee80211/kmap_types.h
new file mode 100644
index 000000000000..de67bb01b5f5
--- /dev/null
+++ b/drivers/staging/rtl8192u/ieee80211/kmap_types.h
@@ -0,0 +1,20 @@
+#ifndef __KMAP_TYPES_H
+
+#define __KMAP_TYPES_H
+
+
+enum km_type {
+	KM_BOUNCE_READ,
+	KM_SKB_SUNRPC_DATA,
+	KM_SKB_DATA_SOFTIRQ,
+	KM_USER0,
+	KM_USER1,
+	KM_BH_IRQ,
+	KM_SOFTIRQ0,
+	KM_SOFTIRQ1,
+	KM_TYPE_NR
+};
+
+#define _ASM_KMAP_TYPES_H
+
+#endif
diff --git a/drivers/staging/rtl8192u/ieee80211/michael_mic.c b/drivers/staging/rtl8192u/ieee80211/michael_mic.c
new file mode 100644
index 000000000000..df256e487c20
--- /dev/null
+++ b/drivers/staging/rtl8192u/ieee80211/michael_mic.c
@@ -0,0 +1,194 @@
+/*
+ * Cryptographic API
+ *
+ * Michael MIC (IEEE 802.11i/TKIP) keyed digest
+ *
+ * Copyright (c) 2004 Jouni Malinen <jkmaline@cc.hut.fi>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/string.h>
+//#include <linux/crypto.h>
+#include "rtl_crypto.h"
+
+
+struct michael_mic_ctx {
+	u8 pending[4];
+	size_t pending_len;
+
+	u32 l, r;
+};
+
+
+static inline u32 rotl(u32 val, int bits)
+{
+	return (val << bits) | (val >> (32 - bits));
+}
+
+
+static inline u32 rotr(u32 val, int bits)
+{
+	return (val >> bits) | (val << (32 - bits));
+}
+
+
+static inline u32 xswap(u32 val)
+{
+	return ((val & 0x00ff00ff) << 8) | ((val & 0xff00ff00) >> 8);
+}
+
+
+#define michael_block(l, r)	\
+do {				\
+	r ^= rotl(l, 17);	\
+	l += r;			\
+	r ^= xswap(l);		\
+	l += r;			\
+	r ^= rotl(l, 3);	\
+	l += r;			\
+	r ^= rotr(l, 2);	\
+	l += r;			\
+} while (0)
+
+
+static inline u32 get_le32(const u8 *p)
+{
+	return p[0] | (p[1] << 8) | (p[2] << 16) | (p[3] << 24);
+}
+
+
+static inline void put_le32(u8 *p, u32 v)
+{
+	p[0] = v;
+	p[1] = v >> 8;
+	p[2] = v >> 16;
+	p[3] = v >> 24;
+}
+
+
+static void michael_init(void *ctx)
+{
+	struct michael_mic_ctx *mctx = ctx;
+	mctx->pending_len = 0;
+}
+
+
+static void michael_update(void *ctx, const u8 *data, unsigned int len)
+{
+	struct michael_mic_ctx *mctx = ctx;
+
+	if (mctx->pending_len) {
+		int flen = 4 - mctx->pending_len;
+		if (flen > len)
+			flen = len;
+		memcpy(&mctx->pending[mctx->pending_len], data, flen);
+		mctx->pending_len += flen;
+		data += flen;
+		len -= flen;
+
+		if (mctx->pending_len < 4)
+			return;
+
+		mctx->l ^= get_le32(mctx->pending);
+		michael_block(mctx->l, mctx->r);
+		mctx->pending_len = 0;
+	}
+
+	while (len >= 4) {
+		mctx->l ^= get_le32(data);
+		michael_block(mctx->l, mctx->r);
+		data += 4;
+		len -= 4;
+	}
+
+	if (len > 0) {
+		mctx->pending_len = len;
+		memcpy(mctx->pending, data, len);
+	}
+}
+
+
+static void michael_final(void *ctx, u8 *out)
+{
+	struct michael_mic_ctx *mctx = ctx;
+	u8 *data = mctx->pending;
+
+	/* Last block and padding (0x5a, 4..7 x 0) */
+	switch (mctx->pending_len) {
+	case 0:
+		mctx->l ^= 0x5a;
+		break;
+	case 1:
+		mctx->l ^= data[0] | 0x5a00;
+		break;
+	case 2:
+		mctx->l ^= data[0] | (data[1] << 8) | 0x5a0000;
+		break;
+	case 3:
+		mctx->l ^= data[0] | (data[1] << 8) | (data[2] << 16) |
+			0x5a000000;
+		break;
+	}
+	michael_block(mctx->l, mctx->r);
+	/* l ^= 0; */
+	michael_block(mctx->l, mctx->r);
+
+	put_le32(out, mctx->l);
+	put_le32(out + 4, mctx->r);
+}
+
+
+static int michael_setkey(void *ctx, const u8 *key, unsigned int keylen,
+			  u32 *flags)
+{
+	struct michael_mic_ctx *mctx = ctx;
+	if (keylen != 8) {
+		if (flags)
+			*flags = CRYPTO_TFM_RES_BAD_KEY_LEN;
+		return -EINVAL;
+	}
+	mctx->l = get_le32(key);
+	mctx->r = get_le32(key + 4);
+	return 0;
+}
+
+
+static struct crypto_alg michael_mic_alg = {
+	.cra_name	= "michael_mic",
+	.cra_flags	= CRYPTO_ALG_TYPE_DIGEST,
+	.cra_blocksize	= 8,
+	.cra_ctxsize	= sizeof(struct michael_mic_ctx),
+	.cra_module	= THIS_MODULE,
+	.cra_list	= LIST_HEAD_INIT(michael_mic_alg.cra_list),
+	.cra_u		= { .digest = {
+	.dia_digestsize	= 8,
+	.dia_init	= michael_init,
+	.dia_update	= michael_update,
+	.dia_final	= michael_final,
+	.dia_setkey	= michael_setkey } }
+};
+
+
+static int __init michael_mic_init(void)
+{
+	return crypto_register_alg(&michael_mic_alg);
+}
+
+
+static void __exit michael_mic_exit(void)
+{
+	crypto_unregister_alg(&michael_mic_alg);
+}
+
+
+module_init(michael_mic_init);
+module_exit(michael_mic_exit);
+
+MODULE_LICENSE("GPL v2");
+MODULE_DESCRIPTION("Michael MIC");
+MODULE_AUTHOR("Jouni Malinen <jkmaline@cc.hut.fi>");
diff --git a/drivers/staging/rtl8192u/ieee80211/proc.c b/drivers/staging/rtl8192u/ieee80211/proc.c
new file mode 100644
index 000000000000..6eda928e4090
--- /dev/null
+++ b/drivers/staging/rtl8192u/ieee80211/proc.c
@@ -0,0 +1,116 @@
+/*
+ * Scatterlist Cryptographic API.
+ *
+ * Procfs information.
+ *
+ * Copyright (c) 2002 James Morris <jmorris@intercode.com.au>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2 of the License, or (at your option)
+ * any later version.
+ *
+ */
+#include <linux/init.h>
+//#include <linux/crypto.h>
+#include "rtl_crypto.h"
+#include <linux/rwsem.h>
+#include <linux/proc_fs.h>
+#include <linux/seq_file.h>
+#include "internal.h"
+
+extern struct list_head crypto_alg_list;
+extern struct rw_semaphore crypto_alg_sem;
+
+static void *c_start(struct seq_file *m, loff_t *pos)
+{
+	struct list_head *v;
+	loff_t n = *pos;
+
+	down_read(&crypto_alg_sem);
+	list_for_each(v, &crypto_alg_list)
+		if (!n--)
+			return list_entry(v, struct crypto_alg, cra_list);
+	return NULL;
+}
+
+static void *c_next(struct seq_file *m, void *p, loff_t *pos)
+{
+	struct list_head *v = p;
+
+	(*pos)++;
+	v = v->next;
+	return (v == &crypto_alg_list) ?
+		NULL : list_entry(v, struct crypto_alg, cra_list);
+}
+
+static void c_stop(struct seq_file *m, void *p)
+{
+	up_read(&crypto_alg_sem);
+}
+
+static int c_show(struct seq_file *m, void *p)
+{
+	struct crypto_alg *alg = (struct crypto_alg *)p;
+
+	seq_printf(m, "name         : %s\n", alg->cra_name);
+	seq_printf(m, "module       : %s\n",
+		   (alg->cra_module ?
+		    alg->cra_module->name :
+		    "kernel"));
+
+	switch (alg->cra_flags & CRYPTO_ALG_TYPE_MASK) {
+	case CRYPTO_ALG_TYPE_CIPHER:
+		seq_printf(m, "type         : cipher\n");
+		seq_printf(m, "blocksize    : %u\n", alg->cra_blocksize);
+		seq_printf(m, "min keysize  : %u\n",
+					alg->cra_cipher.cia_min_keysize);
+		seq_printf(m, "max keysize  : %u\n",
+					alg->cra_cipher.cia_max_keysize);
+		break;
+
+	case CRYPTO_ALG_TYPE_DIGEST:
+		seq_printf(m, "type         : digest\n");
+		seq_printf(m, "blocksize    : %u\n", alg->cra_blocksize);
+		seq_printf(m, "digestsize   : %u\n",
+			   alg->cra_digest.dia_digestsize);
+		break;
+	case CRYPTO_ALG_TYPE_COMPRESS:
+		seq_printf(m, "type         : compression\n");
+		break;
+	default:
+		seq_printf(m, "type         : unknown\n");
+		break;
+	}
+
+	seq_putc(m, '\n');
+	return 0;
+}
+
+static struct seq_operations crypto_seq_ops = {
+	.start		= c_start,
+	.next		= c_next,
+	.stop		= c_stop,
+	.show		= c_show
+};
+
+static int crypto_info_open(struct inode *inode, struct file *file)
+{
+	return seq_open(file, &crypto_seq_ops);
+}
+
+static struct file_operations proc_crypto_ops = {
+	.open		= crypto_info_open,
+	.read		= seq_read,
+	.llseek		= seq_lseek,
+	.release	= seq_release
+};
+
+void __init crypto_init_proc(void)
+{
+	struct proc_dir_entry *proc;
+
+	proc = create_proc_entry("crypto", 0, NULL);
+	if (proc)
+		proc->proc_fops = &proc_crypto_ops;
+}
diff --git a/drivers/staging/rtl8192u/ieee80211/rtl819x_BA.h b/drivers/staging/rtl8192u/ieee80211/rtl819x_BA.h
new file mode 100644
index 000000000000..8ddc8bf9dc26
--- /dev/null
+++ b/drivers/staging/rtl8192u/ieee80211/rtl819x_BA.h
@@ -0,0 +1,69 @@
+#ifndef _BATYPE_H_
+#define _BATYPE_H_
+
+#define 	TOTAL_TXBA_NUM	16
+#define	TOTAL_RXBA_NUM	16
+
+#define	BA_SETUP_TIMEOUT	200
+#define	BA_INACT_TIMEOUT	60000
+
+#define	BA_POLICY_DELAYED		0
+#define	BA_POLICY_IMMEDIATE	1
+
+#define	ADDBA_STATUS_SUCCESS			0
+#define	ADDBA_STATUS_REFUSED		37
+#define	ADDBA_STATUS_INVALID_PARAM	38
+
+#define	DELBA_REASON_QSTA_LEAVING	36
+#define	DELBA_REASON_END_BA			37
+#define	DELBA_REASON_UNKNOWN_BA	38
+#define	DELBA_REASON_TIMEOUT			39
+/*  whether need define BA Action frames here?
+struct ieee80211_ADDBA_Req{
+	struct ieee80211_header_data header;
+	u8	category;
+	u8
+} __attribute__ ((packed));
+*/
+//Is this need?I put here just to make it easier to define structure BA_RECORD //WB
+typedef union _SEQUENCE_CONTROL{
+	u16 ShortData;
+	struct
+	{
+		u16	FragNum:4;
+		u16	SeqNum:12;
+	}field;
+}SEQUENCE_CONTROL, *PSEQUENCE_CONTROL;
+
+typedef union _BA_PARAM_SET {
+	u8 charData[2];
+	u16 shortData;
+	struct {
+		u16 AMSDU_Support:1;
+		u16 BAPolicy:1;
+		u16 TID:4;
+		u16 BufferSize:10;
+	} field;
+} BA_PARAM_SET, *PBA_PARAM_SET;
+
+typedef union _DELBA_PARAM_SET {
+	u8 charData[2];
+	u16 shortData;
+	struct {
+		u16 Reserved:11;
+		u16 Initiator:1;
+		u16 TID:4;
+	} field;
+} DELBA_PARAM_SET, *PDELBA_PARAM_SET;
+
+typedef struct _BA_RECORD {
+	struct timer_list		Timer;
+	u8				bValid;
+	u8				DialogToken;
+	BA_PARAM_SET		BaParamSet;
+	u16				BaTimeoutValue;
+	SEQUENCE_CONTROL	BaStartSeqCtrl;
+} BA_RECORD, *PBA_RECORD;
+
+#endif //end _BATYPE_H_
+
diff --git a/drivers/staging/rtl8192u/ieee80211/rtl819x_BAProc.c b/drivers/staging/rtl8192u/ieee80211/rtl819x_BAProc.c
new file mode 100644
index 000000000000..512a57aebde3
--- /dev/null
+++ b/drivers/staging/rtl8192u/ieee80211/rtl819x_BAProc.c
@@ -0,0 +1,737 @@
+/********************************************************************************************************************************
+ * This file is created to process BA Action Frame. According to 802.11 spec, there are 3 BA action types at all. And as BA is
+ * related to TS, this part need some struture defined in QOS side code. Also TX RX is going to be resturctured, so how to send
+ * ADDBAREQ ADDBARSP and DELBA packet is still on consideration. Temporarily use MANAGE QUEUE instead of Normal Queue.
+ * WB 2008-05-27
+ * *****************************************************************************************************************************/
+#include "ieee80211.h"
+#include "rtl819x_BA.h"
+
+/********************************************************************************************************************
+ *function:  Activate BA entry. And if Time is nozero, start timer.
+ *   input:  PBA_RECORD 		pBA  //BA entry to be enabled
+ *   	     u16 			Time //indicate time delay.
+ *  output:  none
+********************************************************************************************************************/
+void ActivateBAEntry(struct ieee80211_device* ieee, PBA_RECORD pBA, u16 Time)
+{
+	pBA->bValid = true;
+	if(Time != 0)
+		mod_timer(&pBA->Timer, jiffies + MSECS(Time));
+}
+
+/********************************************************************************************************************
+ *function:  deactivate BA entry, including its timer.
+ *   input:  PBA_RECORD 		pBA  //BA entry to be disabled
+ *  output:  none
+********************************************************************************************************************/
+void DeActivateBAEntry( struct ieee80211_device* ieee, PBA_RECORD pBA)
+{
+	pBA->bValid = false;
+	del_timer_sync(&pBA->Timer);
+}
+/********************************************************************************************************************
+ *function: deactivete BA entry in Tx Ts, and send DELBA.
+ *   input:
+ *   	     PTX_TS_RECORD		pTxTs //Tx Ts which is to deactivate BA entry.
+ *  output:  none
+ *  notice:  As PTX_TS_RECORD structure will be defined in QOS, so wait to be merged. //FIXME
+********************************************************************************************************************/
+u8 TxTsDeleteBA( struct ieee80211_device* ieee, PTX_TS_RECORD	pTxTs)
+{
+	PBA_RECORD		pAdmittedBa = &pTxTs->TxAdmittedBARecord;  //These two BA entries must exist in TS structure
+	PBA_RECORD		pPendingBa = &pTxTs->TxPendingBARecord;
+	u8			bSendDELBA = false;
+
+	// Delete pending BA
+	if(pPendingBa->bValid)
+	{
+		DeActivateBAEntry(ieee, pPendingBa);
+		bSendDELBA = true;
+	}
+
+	// Delete admitted BA
+	if(pAdmittedBa->bValid)
+	{
+		DeActivateBAEntry(ieee, pAdmittedBa);
+		bSendDELBA = true;
+	}
+
+	return bSendDELBA;
+}
+
+/********************************************************************************************************************
+ *function: deactivete BA entry in Tx Ts, and send DELBA.
+ *   input:
+ *   	     PRX_TS_RECORD		pRxTs //Rx Ts which is to deactivate BA entry.
+ *  output:  none
+ *  notice:  As PRX_TS_RECORD structure will be defined in QOS, so wait to be merged. //FIXME, same with above
+********************************************************************************************************************/
+u8 RxTsDeleteBA( struct ieee80211_device* ieee, PRX_TS_RECORD	pRxTs)
+{
+	PBA_RECORD		pBa = &pRxTs->RxAdmittedBARecord;
+	u8			bSendDELBA = false;
+
+	if(pBa->bValid)
+	{
+		DeActivateBAEntry(ieee, pBa);
+		bSendDELBA = true;
+	}
+
+	return bSendDELBA;
+}
+
+/********************************************************************************************************************
+ *function: reset BA entry
+ *   input:
+ *   	     PBA_RECORD		pBA //entry to be reset
+ *  output:  none
+********************************************************************************************************************/
+void ResetBaEntry( PBA_RECORD pBA)
+{
+	pBA->bValid			= false;
+	pBA->BaParamSet.shortData	= 0;
+	pBA->BaTimeoutValue		= 0;
+	pBA->DialogToken		= 0;
+	pBA->BaStartSeqCtrl.ShortData	= 0;
+}
+//These functions need porting here or not?
+/*******************************************************************************************************************************
+ *function:  construct ADDBAREQ and ADDBARSP frame here together.
+ *   input:  u8* 		Dst 	//ADDBA frame's destination
+ *   	     PBA_RECORD 	pBA	//BA_RECORD entry which stores the necessary information for BA.
+ *   	     u16 		StatusCode  //status code in RSP and I will use it to indicate whether it's RSP or REQ(will I?)
+ *   	     u8			type	//indicate whether it's RSP(ACT_ADDBARSP) ow REQ(ACT_ADDBAREQ)
+ *  output:  none
+ *  return:  sk_buff* 		skb     //return constructed skb to xmit
+*******************************************************************************************************************************/
+static struct sk_buff* ieee80211_ADDBA(struct ieee80211_device* ieee, u8* Dst, PBA_RECORD pBA, u16 StatusCode, u8 type)
+{
+	struct sk_buff *skb = NULL;
+	 struct ieee80211_hdr_3addr* BAReq = NULL;
+	u8* tag = NULL;
+	u16 tmp = 0;
+	u16 len = ieee->tx_headroom + 9;
+	//category(1) + action field(1) + Dialog Token(1) + BA Parameter Set(2) +  BA Timeout Value(2) +  BA Start SeqCtrl(2)(or StatusCode(2))
+	IEEE80211_DEBUG(IEEE80211_DL_TRACE | IEEE80211_DL_BA, "========>%s(), frame(%d) sentd to:"MAC_FMT", ieee->dev:%p\n", __FUNCTION__, type, MAC_ARG(Dst), ieee->dev);
+	if (pBA == NULL||ieee == NULL)
+	{
+		IEEE80211_DEBUG(IEEE80211_DL_ERR, "pBA(%p) is NULL or ieee(%p) is NULL\n", pBA, ieee);
+		return NULL;
+	}
+	skb = dev_alloc_skb(len + sizeof( struct ieee80211_hdr_3addr)); //need to add something others? FIXME
+	if (skb == NULL)
+	{
+		IEEE80211_DEBUG(IEEE80211_DL_ERR, "can't alloc skb for ADDBA_REQ\n");
+		return NULL;
+	}
+
+	memset(skb->data, 0, sizeof( struct ieee80211_hdr_3addr));  	//I wonder whether it's necessary. Apparently kernel will not do it when alloc a skb.
+	skb_reserve(skb, ieee->tx_headroom);
+
+	BAReq = ( struct ieee80211_hdr_3addr *) skb_put(skb,sizeof( struct ieee80211_hdr_3addr));
+
+	memcpy(BAReq->addr1, Dst, ETH_ALEN);
+	memcpy(BAReq->addr2, ieee->dev->dev_addr, ETH_ALEN);
+
+	memcpy(BAReq->addr3, ieee->current_network.bssid, ETH_ALEN);
+
+	BAReq->frame_ctl = cpu_to_le16(IEEE80211_STYPE_MANAGE_ACT); //action frame
+
+	//tag += sizeof( struct ieee80211_hdr_3addr); //move to action field
+	tag = (u8*)skb_put(skb, 9);
+	*tag ++= ACT_CAT_BA;
+	*tag ++= type;
+	// Dialog Token
+	*tag ++= pBA->DialogToken;
+
+	if (ACT_ADDBARSP == type)
+	{
+		// Status Code
+		printk("=====>to send ADDBARSP\n");
+		tmp = cpu_to_le16(StatusCode);
+		memcpy(tag, (u8*)&tmp, 2);
+		tag += 2;
+	}
+	// BA Parameter Set
+	tmp = cpu_to_le16(pBA->BaParamSet.shortData);
+	memcpy(tag, (u8*)&tmp, 2);
+	tag += 2;
+	// BA Timeout Value
+	tmp = cpu_to_le16(pBA->BaTimeoutValue);
+	memcpy(tag, (u8*)&tmp, 2);
+	tag += 2;
+
+	if (ACT_ADDBAREQ == type)
+	{
+	// BA Start SeqCtrl
+		memcpy(tag,(u8*)&(pBA->BaStartSeqCtrl), 2);
+		tag += 2;
+	}
+
+	IEEE80211_DEBUG_DATA(IEEE80211_DL_DATA|IEEE80211_DL_BA, skb->data, skb->len);
+	return skb;
+	//return NULL;
+}
+
+
+/********************************************************************************************************************
+ *function:  construct DELBA frame
+ *   input:  u8* 		dst 	//DELBA frame's destination
+ *   	     PBA_RECORD 	pBA	//BA_RECORD entry which stores the necessary information for BA
+ *   	     TR_SELECT	        TxRxSelect  //TX RX direction
+ *   	     u16 		ReasonCode  //status code.
+ *  output:  none
+ *  return:  sk_buff* 		skb     //return constructed skb to xmit
+********************************************************************************************************************/
+static struct sk_buff* ieee80211_DELBA(
+	struct ieee80211_device* ieee,
+	u8*		         dst,
+	PBA_RECORD		 pBA,
+	TR_SELECT		 TxRxSelect,
+	u16			 ReasonCode
+	)
+{
+	DELBA_PARAM_SET	DelbaParamSet;
+	struct sk_buff *skb = NULL;
+	 struct ieee80211_hdr_3addr* Delba = NULL;
+	u8* tag = NULL;
+	u16 tmp = 0;
+	//len = head len + DELBA Parameter Set(2) + Reason Code(2)
+	u16 len = 6 + ieee->tx_headroom;
+
+	if (net_ratelimit())
+	IEEE80211_DEBUG(IEEE80211_DL_TRACE | IEEE80211_DL_BA, "========>%s(), ReasonCode(%d) sentd to:"MAC_FMT"\n", __FUNCTION__, ReasonCode, MAC_ARG(dst));
+
+	memset(&DelbaParamSet, 0, 2);
+
+	DelbaParamSet.field.Initiator	= (TxRxSelect==TX_DIR)?1:0;
+	DelbaParamSet.field.TID	= pBA->BaParamSet.field.TID;
+
+	skb = dev_alloc_skb(len + sizeof( struct ieee80211_hdr_3addr)); //need to add something others? FIXME
+	if (skb == NULL)
+	{
+		IEEE80211_DEBUG(IEEE80211_DL_ERR, "can't alloc skb for ADDBA_REQ\n");
+		return NULL;
+	}
+//	memset(skb->data, 0, len+sizeof( struct ieee80211_hdr_3addr));
+	skb_reserve(skb, ieee->tx_headroom);
+
+	Delba = ( struct ieee80211_hdr_3addr *) skb_put(skb,sizeof( struct ieee80211_hdr_3addr));
+
+	memcpy(Delba->addr1, dst, ETH_ALEN);
+	memcpy(Delba->addr2, ieee->dev->dev_addr, ETH_ALEN);
+	memcpy(Delba->addr3, ieee->current_network.bssid, ETH_ALEN);
+	Delba->frame_ctl = cpu_to_le16(IEEE80211_STYPE_MANAGE_ACT); //action frame
+
+	tag = (u8*)skb_put(skb, 6);
+
+	*tag ++= ACT_CAT_BA;
+	*tag ++= ACT_DELBA;
+
+	// DELBA Parameter Set
+	tmp = cpu_to_le16(DelbaParamSet.shortData);
+	memcpy(tag, (u8*)&tmp, 2);
+	tag += 2;
+	// Reason Code
+	tmp = cpu_to_le16(ReasonCode);
+	memcpy(tag, (u8*)&tmp, 2);
+	tag += 2;
+
+	IEEE80211_DEBUG_DATA(IEEE80211_DL_DATA|IEEE80211_DL_BA, skb->data, skb->len);
+	if (net_ratelimit())
+	IEEE80211_DEBUG(IEEE80211_DL_TRACE | IEEE80211_DL_BA, "<=====%s()\n", __FUNCTION__);
+	return skb;
+}
+
+/********************************************************************************************************************
+ *function: send ADDBAReq frame out
+ *   input:  u8* 		dst 	//ADDBAReq frame's destination
+ *   	     PBA_RECORD 	pBA	//BA_RECORD entry which stores the necessary information for BA
+ *  output:  none
+ *  notice: If any possible, please hide pBA in ieee. And temporarily use Manage Queue as softmac_mgmt_xmit() usually does
+********************************************************************************************************************/
+void ieee80211_send_ADDBAReq(struct ieee80211_device* ieee, u8*	dst, PBA_RECORD	pBA)
+{
+	struct sk_buff *skb = NULL;
+	skb = ieee80211_ADDBA(ieee, dst, pBA, 0, ACT_ADDBAREQ); //construct ACT_ADDBAREQ frames so set statuscode zero.
+
+	if (skb)
+	{
+		softmac_mgmt_xmit(skb, ieee);
+		//add statistic needed here.
+		//and skb will be freed in softmac_mgmt_xmit(), so omit all dev_kfree_skb_any() outside softmac_mgmt_xmit()
+		//WB
+	}
+	else
+	{
+		IEEE80211_DEBUG(IEEE80211_DL_ERR, "alloc skb error in function %s()\n", __FUNCTION__);
+	}
+	return;
+}
+
+/********************************************************************************************************************
+ *function: send ADDBARSP frame out
+ *   input:  u8* 		dst 	//DELBA frame's destination
+ *   	     PBA_RECORD 	pBA	//BA_RECORD entry which stores the necessary information for BA
+ *   	     u16		StatusCode //RSP StatusCode
+ *  output:  none
+ *  notice: If any possible, please hide pBA in ieee. And temporarily use Manage Queue as softmac_mgmt_xmit() usually does
+********************************************************************************************************************/
+void ieee80211_send_ADDBARsp(struct ieee80211_device* ieee, u8* dst, PBA_RECORD pBA, u16 StatusCode)
+{
+	struct sk_buff *skb = NULL;
+	skb = ieee80211_ADDBA(ieee, dst, pBA, StatusCode, ACT_ADDBARSP); //construct ACT_ADDBARSP frames
+	if (skb)
+	{
+		softmac_mgmt_xmit(skb, ieee);
+		//same above
+	}
+	else
+	{
+		IEEE80211_DEBUG(IEEE80211_DL_ERR, "alloc skb error in function %s()\n", __FUNCTION__);
+	}
+
+	return;
+
+}
+/********************************************************************************************************************
+ *function: send ADDBARSP frame out
+ *   input:  u8* 		dst 	//DELBA frame's destination
+ *   	     PBA_RECORD 	pBA	//BA_RECORD entry which stores the necessary information for BA
+ *   	     TR_SELECT          TxRxSelect //TX or RX
+ *   	     u16		ReasonCode //DEL ReasonCode
+ *  output:  none
+ *  notice: If any possible, please hide pBA in ieee. And temporarily use Manage Queue as softmac_mgmt_xmit() usually does
+********************************************************************************************************************/
+
+void ieee80211_send_DELBA(struct ieee80211_device* ieee, u8* dst, PBA_RECORD pBA, TR_SELECT TxRxSelect, u16 ReasonCode)
+{
+	struct sk_buff *skb = NULL;
+	skb = ieee80211_DELBA(ieee, dst, pBA, TxRxSelect, ReasonCode); //construct ACT_ADDBARSP frames
+	if (skb)
+	{
+		softmac_mgmt_xmit(skb, ieee);
+		//same above
+	}
+	else
+	{
+		IEEE80211_DEBUG(IEEE80211_DL_ERR, "alloc skb error in function %s()\n", __FUNCTION__);
+	}
+	return ;
+}
+
+/********************************************************************************************************************
+ *function: RX ADDBAReq
+ *   input:  struct sk_buff *   skb	//incoming ADDBAReq skb.
+ *  return:  0(pass), other(fail)
+ *  notice:  As this function need support of QOS, I comment some code out. And when qos is ready, this code need to be support.
+********************************************************************************************************************/
+int ieee80211_rx_ADDBAReq( struct ieee80211_device* ieee, struct sk_buff *skb)
+{
+	 struct ieee80211_hdr_3addr* req = NULL;
+	u16 rc = 0;
+	u8 * dst = NULL, *pDialogToken = NULL, *tag = NULL;
+	PBA_RECORD pBA = NULL;
+	PBA_PARAM_SET	pBaParamSet = NULL;
+	u16* pBaTimeoutVal = NULL;
+	PSEQUENCE_CONTROL pBaStartSeqCtrl = NULL;
+	PRX_TS_RECORD	pTS = NULL;
+
+	if (skb->len < sizeof( struct ieee80211_hdr_3addr) + 9)
+	{
+		IEEE80211_DEBUG(IEEE80211_DL_ERR, " Invalid skb len in BAREQ(%d / %zu)\n", skb->len, 	(sizeof( struct ieee80211_hdr_3addr) + 9));
+		return -1;
+	}
+
+	IEEE80211_DEBUG_DATA(IEEE80211_DL_DATA|IEEE80211_DL_BA, skb->data, skb->len);
+
+	req = ( struct ieee80211_hdr_3addr*) skb->data;
+	tag = (u8*)req;
+	dst = (u8*)(&req->addr2[0]);
+	tag += sizeof( struct ieee80211_hdr_3addr);
+	pDialogToken = tag + 2;  //category+action
+	pBaParamSet = (PBA_PARAM_SET)(tag + 3);   //+DialogToken
+	pBaTimeoutVal = (u16*)(tag + 5);
+	pBaStartSeqCtrl = (PSEQUENCE_CONTROL)(req + 7);
+
+	printk("====================>rx ADDBAREQ from :"MAC_FMT"\n", MAC_ARG(dst));
+//some other capability is not ready now.
+	if(	(ieee->current_network.qos_data.active == 0) ||
+		(ieee->pHTInfo->bCurrentHTSupport == false)) //||
+	//	(ieee->pStaQos->bEnableRxImmBA == false)	)
+	{
+		rc = ADDBA_STATUS_REFUSED;
+		IEEE80211_DEBUG(IEEE80211_DL_ERR, "Failed to reply on ADDBA_REQ as some capability is not ready(%d, %d)\n", ieee->current_network.qos_data.active, ieee->pHTInfo->bCurrentHTSupport);
+		goto OnADDBAReq_Fail;
+	}
+	// Search for related traffic stream.
+	// If there is no matched TS, reject the ADDBA request.
+	if(	!GetTs(
+			ieee,
+			(PTS_COMMON_INFO*)(&pTS),
+			dst,
+			(u8)(pBaParamSet->field.TID),
+			RX_DIR,
+			true)	)
+	{
+		rc = ADDBA_STATUS_REFUSED;
+		IEEE80211_DEBUG(IEEE80211_DL_ERR, "can't get TS in %s()\n", __FUNCTION__);
+		goto OnADDBAReq_Fail;
+	}
+	pBA = &pTS->RxAdmittedBARecord;
+	// To Determine the ADDBA Req content
+	// We can do much more check here, including BufferSize, AMSDU_Support, Policy, StartSeqCtrl...
+	// I want to check StartSeqCtrl to make sure when we start aggregation!!!
+	//
+	if(pBaParamSet->field.BAPolicy == BA_POLICY_DELAYED)
+	{
+		rc = ADDBA_STATUS_INVALID_PARAM;
+		IEEE80211_DEBUG(IEEE80211_DL_ERR, "BA Policy is not correct in %s()\n", __FUNCTION__);
+		goto OnADDBAReq_Fail;
+	}
+		// Admit the ADDBA Request
+	//
+	DeActivateBAEntry(ieee, pBA);
+	pBA->DialogToken = *pDialogToken;
+	pBA->BaParamSet = *pBaParamSet;
+	pBA->BaTimeoutValue = *pBaTimeoutVal;
+	pBA->BaStartSeqCtrl = *pBaStartSeqCtrl;
+	//for half N mode we only aggregate 1 frame
+	if (ieee->GetHalfNmodeSupportByAPsHandler(ieee->dev))
+	pBA->BaParamSet.field.BufferSize = 1;
+	else
+	pBA->BaParamSet.field.BufferSize = 32;
+	ActivateBAEntry(ieee, pBA, pBA->BaTimeoutValue);
+	ieee80211_send_ADDBARsp(ieee, dst, pBA, ADDBA_STATUS_SUCCESS);
+
+	// End of procedure.
+	return 0;
+
+OnADDBAReq_Fail:
+	{
+		BA_RECORD	BA;
+		BA.BaParamSet = *pBaParamSet;
+		BA.BaTimeoutValue = *pBaTimeoutVal;
+		BA.DialogToken = *pDialogToken;
+		BA.BaParamSet.field.BAPolicy = BA_POLICY_IMMEDIATE;
+		ieee80211_send_ADDBARsp(ieee, dst, &BA, rc);
+		return 0; //we send RSP out.
+	}
+
+}
+
+/********************************************************************************************************************
+ *function: RX ADDBARSP
+ *   input:  struct sk_buff *   skb	//incoming ADDBAReq skb.
+ *  return:  0(pass), other(fail)
+ *  notice:  As this function need support of QOS, I comment some code out. And when qos is ready, this code need to be support.
+********************************************************************************************************************/
+int ieee80211_rx_ADDBARsp( struct ieee80211_device* ieee, struct sk_buff *skb)
+{
+	 struct ieee80211_hdr_3addr* rsp = NULL;
+	PBA_RECORD		pPendingBA, pAdmittedBA;
+	PTX_TS_RECORD		pTS = NULL;
+	u8* dst = NULL, *pDialogToken = NULL, *tag = NULL;
+	u16* pStatusCode = NULL, *pBaTimeoutVal = NULL;
+	PBA_PARAM_SET		pBaParamSet = NULL;
+	u16			ReasonCode;
+
+	if (skb->len < sizeof( struct ieee80211_hdr_3addr) + 9)
+	{
+		IEEE80211_DEBUG(IEEE80211_DL_ERR, " Invalid skb len in BARSP(%d / %zu)\n", skb->len, 	(sizeof( struct ieee80211_hdr_3addr) + 9));
+		return -1;
+	}
+	rsp = ( struct ieee80211_hdr_3addr*)skb->data;
+	tag = (u8*)rsp;
+	dst = (u8*)(&rsp->addr2[0]);
+	tag += sizeof( struct ieee80211_hdr_3addr);
+	pDialogToken = tag + 2;
+	pStatusCode = (u16*)(tag + 3);
+	pBaParamSet = (PBA_PARAM_SET)(tag + 5);
+	pBaTimeoutVal = (u16*)(tag + 7);
+
+	// Check the capability
+	// Since we can always receive A-MPDU, we just check if it is under HT mode.
+	if(     ieee->current_network.qos_data.active == 0  ||
+		ieee->pHTInfo->bCurrentHTSupport == false ||
+		ieee->pHTInfo->bCurrentAMPDUEnable == false )
+	{
+		IEEE80211_DEBUG(IEEE80211_DL_ERR, "reject to ADDBA_RSP as some capability is not ready(%d, %d, %d)\n",ieee->current_network.qos_data.active, ieee->pHTInfo->bCurrentHTSupport, ieee->pHTInfo->bCurrentAMPDUEnable);
+		ReasonCode = DELBA_REASON_UNKNOWN_BA;
+		goto OnADDBARsp_Reject;
+	}
+
+
+	//
+	// Search for related TS.
+	// If there is no TS found, we wil reject ADDBA Rsp by sending DELBA frame.
+	//
+	if (!GetTs(
+			ieee,
+			(PTS_COMMON_INFO*)(&pTS),
+			dst,
+			(u8)(pBaParamSet->field.TID),
+			TX_DIR,
+			false)	)
+	{
+		IEEE80211_DEBUG(IEEE80211_DL_ERR, "can't get TS in %s()\n", __FUNCTION__);
+		ReasonCode = DELBA_REASON_UNKNOWN_BA;
+		goto OnADDBARsp_Reject;
+	}
+
+	pTS->bAddBaReqInProgress = false;
+	pPendingBA = &pTS->TxPendingBARecord;
+	pAdmittedBA = &pTS->TxAdmittedBARecord;
+
+
+	//
+	// Check if related BA is waiting for setup.
+	// If not, reject by sending DELBA frame.
+	//
+	if((pAdmittedBA->bValid==true))
+	{
+		// Since BA is already setup, we ignore all other ADDBA Response.
+		IEEE80211_DEBUG(IEEE80211_DL_BA, "OnADDBARsp(): Recv ADDBA Rsp. Drop because already admit it! \n");
+		return -1;
+	}
+	else if((pPendingBA->bValid == false) ||(*pDialogToken != pPendingBA->DialogToken))
+	{
+		IEEE80211_DEBUG(IEEE80211_DL_ERR,  "OnADDBARsp(): Recv ADDBA Rsp. BA invalid, DELBA! \n");
+		ReasonCode = DELBA_REASON_UNKNOWN_BA;
+		goto OnADDBARsp_Reject;
+	}
+	else
+	{
+		IEEE80211_DEBUG(IEEE80211_DL_BA, "OnADDBARsp(): Recv ADDBA Rsp. BA is admitted! Status code:%X\n", *pStatusCode);
+		DeActivateBAEntry(ieee, pPendingBA);
+	}
+
+
+	if(*pStatusCode == ADDBA_STATUS_SUCCESS)
+	{
+		//
+		// Determine ADDBA Rsp content here.
+		// We can compare the value of BA parameter set that Peer returned and Self sent.
+		// If it is OK, then admitted. Or we can send DELBA to cancel BA mechanism.
+		//
+		if(pBaParamSet->field.BAPolicy == BA_POLICY_DELAYED)
+		{
+			// Since this is a kind of ADDBA failed, we delay next ADDBA process.
+			pTS->bAddBaReqDelayed = true;
+			DeActivateBAEntry(ieee, pAdmittedBA);
+			ReasonCode = DELBA_REASON_END_BA;
+			goto OnADDBARsp_Reject;
+		}
+
+
+		//
+		// Admitted condition
+		//
+		pAdmittedBA->DialogToken = *pDialogToken;
+		pAdmittedBA->BaTimeoutValue = *pBaTimeoutVal;
+		pAdmittedBA->BaStartSeqCtrl = pPendingBA->BaStartSeqCtrl;
+		pAdmittedBA->BaParamSet = *pBaParamSet;
+		DeActivateBAEntry(ieee, pAdmittedBA);
+		ActivateBAEntry(ieee, pAdmittedBA, *pBaTimeoutVal);
+	}
+	else
+	{
+		// Delay next ADDBA process.
+		pTS->bAddBaReqDelayed = true;
+	}
+
+	// End of procedure
+	return 0;
+
+OnADDBARsp_Reject:
+	{
+		BA_RECORD	BA;
+		BA.BaParamSet = *pBaParamSet;
+		ieee80211_send_DELBA(ieee, dst, &BA, TX_DIR, ReasonCode);
+		return 0;
+	}
+
+}
+
+/********************************************************************************************************************
+ *function: RX DELBA
+ *   input:  struct sk_buff *   skb	//incoming ADDBAReq skb.
+ *  return:  0(pass), other(fail)
+ *  notice:  As this function need support of QOS, I comment some code out. And when qos is ready, this code need to be support.
+********************************************************************************************************************/
+int ieee80211_rx_DELBA(struct ieee80211_device* ieee,struct sk_buff *skb)
+{
+	 struct ieee80211_hdr_3addr* delba = NULL;
+	PDELBA_PARAM_SET	pDelBaParamSet = NULL;
+	u16*			pReasonCode = NULL;
+	u8*			dst = NULL;
+
+	if (skb->len < sizeof( struct ieee80211_hdr_3addr) + 6)
+	{
+		IEEE80211_DEBUG(IEEE80211_DL_ERR, " Invalid skb len in DELBA(%d / %zu)\n", skb->len, 	(sizeof( struct ieee80211_hdr_3addr) + 6));
+		return -1;
+	}
+
+	if(ieee->current_network.qos_data.active == 0 ||
+		ieee->pHTInfo->bCurrentHTSupport == false )
+	{
+		IEEE80211_DEBUG(IEEE80211_DL_ERR, "received DELBA while QOS or HT is not supported(%d, %d)\n",ieee->current_network.qos_data.active, ieee->pHTInfo->bCurrentHTSupport);
+		return -1;
+	}
+
+	IEEE80211_DEBUG_DATA(IEEE80211_DL_DATA|IEEE80211_DL_BA, skb->data, skb->len);
+	delba = ( struct ieee80211_hdr_3addr*)skb->data;
+	dst = (u8*)(&delba->addr2[0]);
+	delba += sizeof( struct ieee80211_hdr_3addr);
+	pDelBaParamSet = (PDELBA_PARAM_SET)(delba+2);
+	pReasonCode = (u16*)(delba+4);
+
+	if(pDelBaParamSet->field.Initiator == 1)
+	{
+		PRX_TS_RECORD 	pRxTs;
+
+		if( !GetTs(
+				ieee,
+				(PTS_COMMON_INFO*)&pRxTs,
+				dst,
+				(u8)pDelBaParamSet->field.TID,
+				RX_DIR,
+				false)	)
+		{
+			IEEE80211_DEBUG(IEEE80211_DL_ERR,  "can't get TS for RXTS in %s()\n", __FUNCTION__);
+			return -1;
+		}
+
+		RxTsDeleteBA(ieee, pRxTs);
+	}
+	else
+	{
+		PTX_TS_RECORD	pTxTs;
+
+		if(!GetTs(
+			ieee,
+			(PTS_COMMON_INFO*)&pTxTs,
+			dst,
+			(u8)pDelBaParamSet->field.TID,
+			TX_DIR,
+			false)	)
+		{
+			IEEE80211_DEBUG(IEEE80211_DL_ERR,  "can't get TS for TXTS in %s()\n", __FUNCTION__);
+			return -1;
+		}
+
+		pTxTs->bUsingBa = false;
+		pTxTs->bAddBaReqInProgress = false;
+		pTxTs->bAddBaReqDelayed = false;
+		del_timer_sync(&pTxTs->TsAddBaTimer);
+		//PlatformCancelTimer(Adapter, &pTxTs->TsAddBaTimer);
+		TxTsDeleteBA(ieee, pTxTs);
+	}
+	return 0;
+}
+
+//
+// ADDBA initiate. This can only be called by TX side.
+//
+void
+TsInitAddBA(
+	struct ieee80211_device* ieee,
+	PTX_TS_RECORD	pTS,
+	u8		Policy,
+	u8		bOverwritePending
+	)
+{
+	PBA_RECORD			pBA = &pTS->TxPendingBARecord;
+
+	if(pBA->bValid==true && bOverwritePending==false)
+		return;
+
+	// Set parameters to "Pending" variable set
+	DeActivateBAEntry(ieee, pBA);
+
+	pBA->DialogToken++;						// DialogToken: Only keep the latest dialog token
+	pBA->BaParamSet.field.AMSDU_Support = 0;	// Do not support A-MSDU with A-MPDU now!!
+	pBA->BaParamSet.field.BAPolicy = Policy;	// Policy: Delayed or Immediate
+	pBA->BaParamSet.field.TID = pTS->TsCommonInfo.TSpec.f.TSInfo.field.ucTSID;	// TID
+	// BufferSize: This need to be set according to A-MPDU vector
+	pBA->BaParamSet.field.BufferSize = 32;		// BufferSize: This need to be set according to A-MPDU vector
+	pBA->BaTimeoutValue = 0;					// Timeout value: Set 0 to disable Timer
+	pBA->BaStartSeqCtrl.field.SeqNum = (pTS->TxCurSeq + 3) % 4096; 	// Block Ack will start after 3 packets later.
+
+	ActivateBAEntry(ieee, pBA, BA_SETUP_TIMEOUT);
+
+	ieee80211_send_ADDBAReq(ieee, pTS->TsCommonInfo.Addr, pBA);
+}
+
+void
+TsInitDelBA( struct ieee80211_device* ieee, PTS_COMMON_INFO pTsCommonInfo, TR_SELECT TxRxSelect)
+{
+
+	if(TxRxSelect == TX_DIR)
+	{
+		PTX_TS_RECORD	pTxTs = (PTX_TS_RECORD)pTsCommonInfo;
+
+		if(TxTsDeleteBA(ieee, pTxTs))
+			ieee80211_send_DELBA(
+				ieee,
+				pTsCommonInfo->Addr,
+				(pTxTs->TxAdmittedBARecord.bValid)?(&pTxTs->TxAdmittedBARecord):(&pTxTs->TxPendingBARecord),
+				TxRxSelect,
+				DELBA_REASON_END_BA);
+	}
+	else if(TxRxSelect == RX_DIR)
+	{
+		PRX_TS_RECORD	pRxTs = (PRX_TS_RECORD)pTsCommonInfo;
+		if(RxTsDeleteBA(ieee, pRxTs))
+			ieee80211_send_DELBA(
+				ieee,
+				pTsCommonInfo->Addr,
+				&pRxTs->RxAdmittedBARecord,
+				TxRxSelect,
+				DELBA_REASON_END_BA	);
+	}
+}
+/********************************************************************************************************************
+ *function:  BA setup timer
+ *   input:  unsigned long	 data		//acturally we send TX_TS_RECORD or RX_TS_RECORD to these timer
+ *  return:  NULL
+ *  notice:
+********************************************************************************************************************/
+void BaSetupTimeOut(unsigned long data)
+{
+	PTX_TS_RECORD	pTxTs = (PTX_TS_RECORD)data;
+
+	pTxTs->bAddBaReqInProgress = false;
+	pTxTs->bAddBaReqDelayed = true;
+	pTxTs->TxPendingBARecord.bValid = false;
+}
+
+void TxBaInactTimeout(unsigned long data)
+{
+	PTX_TS_RECORD	pTxTs = (PTX_TS_RECORD)data;
+	struct ieee80211_device *ieee = container_of(pTxTs, struct ieee80211_device, TxTsRecord[pTxTs->num]);
+	TxTsDeleteBA(ieee, pTxTs);
+	ieee80211_send_DELBA(
+		ieee,
+		pTxTs->TsCommonInfo.Addr,
+		&pTxTs->TxAdmittedBARecord,
+		TX_DIR,
+		DELBA_REASON_TIMEOUT);
+}
+
+void RxBaInactTimeout(unsigned long data)
+{
+	PRX_TS_RECORD	pRxTs = (PRX_TS_RECORD)data;
+	struct ieee80211_device *ieee = container_of(pRxTs, struct ieee80211_device, RxTsRecord[pRxTs->num]);
+
+	RxTsDeleteBA(ieee, pRxTs);
+	ieee80211_send_DELBA(
+		ieee,
+		pRxTs->TsCommonInfo.Addr,
+		&pRxTs->RxAdmittedBARecord,
+		RX_DIR,
+		DELBA_REASON_TIMEOUT);
+	return ;
+}
+
diff --git a/drivers/staging/rtl8192u/ieee80211/rtl819x_HT.h b/drivers/staging/rtl8192u/ieee80211/rtl819x_HT.h
new file mode 100644
index 000000000000..cde603f67f43
--- /dev/null
+++ b/drivers/staging/rtl8192u/ieee80211/rtl819x_HT.h
@@ -0,0 +1,481 @@
+#ifndef _RTL819XU_HTTYPE_H_
+#define _RTL819XU_HTTYPE_H_
+
+//------------------------------------------------------------
+// The HT Capability element is present in beacons, association request,
+//	reassociation request and probe response frames
+//------------------------------------------------------------
+
+//
+// Operation mode value
+//
+#define HT_OPMODE_NO_PROTECT		0
+#define HT_OPMODE_OPTIONAL		1
+#define HT_OPMODE_40MHZ_PROTECT	2
+#define HT_OPMODE_MIXED			3
+
+//
+// MIMO Power Save Setings
+//
+#define MIMO_PS_STATIC				0
+#define MIMO_PS_DYNAMIC			1
+#define MIMO_PS_NOLIMIT			3
+
+
+//
+//	There should be 128 bits to cover all of the MCS rates. However, since
+//	8190 does not support too much rates, one integer is quite enough.
+//
+
+#define sHTCLng	4
+
+
+#define HT_SUPPORTED_MCS_1SS_BITMAP					0x000000ff
+#define HT_SUPPORTED_MCS_2SS_BITMAP					0x0000ff00
+#define HT_SUPPORTED_MCS_1SS_2SS_BITMAP			HT_MCS_1SS_BITMAP|HT_MCS_1SS_2SS_BITMAP
+
+
+typedef enum _HT_MCS_RATE{
+	HT_MCS0   = 0x00000001,
+	HT_MCS1   = 0x00000002,
+	HT_MCS2   = 0x00000004,
+	HT_MCS3   = 0x00000008,
+	HT_MCS4   = 0x00000010,
+	HT_MCS5   = 0x00000020,
+	HT_MCS6   = 0x00000040,
+	HT_MCS7   = 0x00000080,
+	HT_MCS8   = 0x00000100,
+	HT_MCS9   = 0x00000200,
+	HT_MCS10 = 0x00000400,
+	HT_MCS11 = 0x00000800,
+	HT_MCS12 = 0x00001000,
+	HT_MCS13 = 0x00002000,
+	HT_MCS14 = 0x00004000,
+	HT_MCS15 = 0x00008000,
+	// Do not define MCS32 here although 8190 support MCS32
+}HT_MCS_RATE,*PHT_MCS_RATE;
+
+//
+// Represent Channel Width in HT Capabilities
+//
+typedef enum _HT_CHANNEL_WIDTH{
+	HT_CHANNEL_WIDTH_20 = 0,
+	HT_CHANNEL_WIDTH_20_40 = 1,
+}HT_CHANNEL_WIDTH, *PHT_CHANNEL_WIDTH;
+
+//
+// Represent Extention Channel Offset in HT Capabilities
+// This is available only in 40Mhz mode.
+//
+typedef enum _HT_EXTCHNL_OFFSET{
+	HT_EXTCHNL_OFFSET_NO_EXT = 0,
+	HT_EXTCHNL_OFFSET_UPPER = 1,
+	HT_EXTCHNL_OFFSET_NO_DEF = 2,
+	HT_EXTCHNL_OFFSET_LOWER = 3,
+}HT_EXTCHNL_OFFSET, *PHT_EXTCHNL_OFFSET;
+
+typedef enum _CHNLOP{
+	CHNLOP_NONE = 0, // No Action now
+	CHNLOP_SCAN = 1, // Scan in progress
+	CHNLOP_SWBW = 2, // Bandwidth switching in progress
+	CHNLOP_SWCHNL = 3, // Software Channel switching in progress
+} CHNLOP, *PCHNLOP;
+
+// Determine if the Channel Operation is in progress
+#define CHHLOP_IN_PROGRESS(_pHTInfo)	\
+		((_pHTInfo)->ChnlOp > CHNLOP_NONE) ? TRUE : FALSE
+
+/*
+typedef	union _HT_CAPABILITY{
+	u16	ShortData;
+	u8	CharData[2];
+	struct
+	{
+		u16	AdvCoding:1;
+		u16	ChlWidth:1;
+		u16	MimoPwrSave:2;
+		u16	GreenField:1;
+		u16	ShortGI20Mhz:1;
+		u16	ShortGI40Mhz:1;
+		u16	STBC:1;
+		u16	BeamForm:1;
+		u16	DelayBA:1;
+		u16	MaxAMSDUSize:1;
+		u16	DssCCk:1;
+		u16	PSMP:1;
+		u16	Rsvd:3;
+	}Field;
+}HT_CAPABILITY, *PHT_CAPABILITY;
+
+typedef	union _HT_CAPABILITY_MACPARA{
+	u8	ShortData;
+	u8	CharData[1];
+	struct
+	{
+		u8	MaxRxAMPDU:2;
+		u8	MPDUDensity:2;
+		u8	Rsvd:4;
+	}Field;
+}HT_CAPABILITY_MACPARA, *PHT_CAPABILITY_MACPARA;
+*/
+
+typedef enum _HT_ACTION{
+	ACT_RECOMMAND_WIDTH		= 0,
+	ACT_MIMO_PWR_SAVE 		= 1,
+	ACT_PSMP					= 2,
+	ACT_SET_PCO_PHASE		= 3,
+	ACT_MIMO_CHL_MEASURE	= 4,
+	ACT_RECIPROCITY_CORRECT	= 5,
+	ACT_MIMO_CSI_MATRICS		= 6,
+	ACT_MIMO_NOCOMPR_STEER	= 7,
+	ACT_MIMO_COMPR_STEER		= 8,
+	ACT_ANTENNA_SELECT		= 9,
+} HT_ACTION, *PHT_ACTION;
+
+
+/* 2007/06/07 MH Define sub-carrier mode for 40MHZ. */
+typedef enum _HT_Bandwidth_40MHZ_Sub_Carrier{
+	SC_MODE_DUPLICATE = 0,
+	SC_MODE_LOWER = 1,
+	SC_MODE_UPPER = 2,
+	SC_MODE_FULL40MHZ = 3,
+}HT_BW40_SC_E;
+
+typedef	struct _HT_CAPABILITY_ELE{
+
+	//HT capability info
+	u8	AdvCoding:1;
+	u8	ChlWidth:1;
+	u8	MimoPwrSave:2;
+	u8	GreenField:1;
+	u8	ShortGI20Mhz:1;
+	u8	ShortGI40Mhz:1;
+	u8	TxSTBC:1;
+	u8	RxSTBC:2;
+	u8	DelayBA:1;
+	u8	MaxAMSDUSize:1;
+	u8	DssCCk:1;
+	u8	PSMP:1;
+	u8	Rsvd1:1;
+	u8	LSigTxopProtect:1;
+
+	//MAC HT parameters info
+	u8	MaxRxAMPDUFactor:2;
+	u8	MPDUDensity:3;
+	u8	Rsvd2:3;
+
+	//Supported MCS set
+	u8	MCS[16];
+
+
+	//Extended HT Capability Info
+	u16	ExtHTCapInfo;
+
+	//TXBF Capabilities
+	u8	TxBFCap[4];
+
+	//Antenna Selection Capabilities
+	u8	ASCap;
+
+} __attribute__ ((packed)) HT_CAPABILITY_ELE, *PHT_CAPABILITY_ELE;
+
+//------------------------------------------------------------
+// The HT Information element is present in beacons
+// Only AP is required to include this element
+//------------------------------------------------------------
+
+typedef struct _HT_INFORMATION_ELE{
+	u8	ControlChl;
+
+	u8	ExtChlOffset:2;
+	u8	RecommemdedTxWidth:1;
+	u8	RIFS:1;
+	u8	PSMPAccessOnly:1;
+	u8	SrvIntGranularity:3;
+
+	u8	OptMode:2;
+	u8	NonGFDevPresent:1;
+	u8	Revd1:5;
+	u8	Revd2:8;
+
+	u8	Rsvd3:6;
+	u8	DualBeacon:1;
+	u8	DualCTSProtect:1;
+
+	u8	SecondaryBeacon:1;
+	u8	LSigTxopProtectFull:1;
+	u8	PcoActive:1;
+	u8	PcoPhase:1;
+	u8	Rsvd4:4;
+
+	u8	BasicMSC[16];
+} __attribute__ ((packed)) HT_INFORMATION_ELE, *PHT_INFORMATION_ELE;
+
+//
+// MIMO Power Save control field.
+// This is appear in MIMO Power Save Action Frame
+//
+typedef struct _MIMOPS_CTRL{
+	u8	MimoPsEnable:1;
+	u8	MimoPsMode:1;
+	u8	Reserved:6;
+} MIMOPS_CTRL, *PMIMOPS_CTRL;
+
+typedef enum _HT_SPEC_VER{
+	HT_SPEC_VER_IEEE = 0,
+	HT_SPEC_VER_EWC = 1,
+}HT_SPEC_VER, *PHT_SPEC_VER;
+
+typedef enum _HT_AGGRE_MODE_E{
+	HT_AGG_AUTO = 0,
+	HT_AGG_FORCE_ENABLE = 1,
+	HT_AGG_FORCE_DISABLE = 2,
+}HT_AGGRE_MODE_E, *PHT_AGGRE_MODE_E;
+
+//------------------------------------------------------------
+//  The Data structure is used to keep HT related variables when card is
+//  configured as non-AP STA mode.  **Note**  Current_xxx should be set
+//	to default value in HTInitializeHTInfo()
+//------------------------------------------------------------
+
+typedef struct _RT_HIGH_THROUGHPUT{
+	u8				bEnableHT;
+	u8				bCurrentHTSupport;
+
+	u8				bRegBW40MHz;				// Tx 40MHz channel capablity
+	u8				bCurBW40MHz;				// Tx 40MHz channel capability
+
+	u8				bRegShortGI40MHz;			// Tx Short GI for 40Mhz
+	u8				bCurShortGI40MHz;			// Tx Short GI for 40MHz
+
+	u8				bRegShortGI20MHz;			// Tx Short GI for 20MHz
+	u8				bCurShortGI20MHz;			// Tx Short GI for 20MHz
+
+	u8				bRegSuppCCK;				// Tx CCK rate capability
+	u8				bCurSuppCCK;				// Tx CCK rate capability
+
+	// 802.11n spec version for "peer"
+	HT_SPEC_VER			ePeerHTSpecVer;
+
+
+	// HT related information for "Self"
+	HT_CAPABILITY_ELE	SelfHTCap;		// This is HT cap element sent to peer STA, which also indicate HT Rx capabilities.
+	HT_INFORMATION_ELE	SelfHTInfo;		// This is HT info element sent to peer STA, which also indicate HT Rx capabilities.
+
+	// HT related information for "Peer"
+	u8				PeerHTCapBuf[32];
+	u8				PeerHTInfoBuf[32];
+
+
+	// A-MSDU related
+	u8				bAMSDU_Support;			// This indicates Tx A-MSDU capability
+	u16				nAMSDU_MaxSize;			// This indicates Tx A-MSDU capability
+	u8				bCurrent_AMSDU_Support;	// This indicates Tx A-MSDU capability
+	u16				nCurrent_AMSDU_MaxSize;	// This indicates Tx A-MSDU capability
+
+
+	// AMPDU  related <2006.08.10 Emily>
+	u8				bAMPDUEnable;				// This indicate Tx A-MPDU capability
+	u8				bCurrentAMPDUEnable;		// This indicate Tx A-MPDU capability
+	u8				AMPDU_Factor;				// This indicate Tx A-MPDU capability
+	u8				CurrentAMPDUFactor;		// This indicate Tx A-MPDU capability
+	u8				MPDU_Density;				// This indicate Tx A-MPDU capability
+	u8				CurrentMPDUDensity;			// This indicate Tx A-MPDU capability
+
+	// Forced A-MPDU enable
+	HT_AGGRE_MODE_E	ForcedAMPDUMode;
+	u8				ForcedAMPDUFactor;
+	u8				ForcedMPDUDensity;
+
+	// Forced A-MSDU enable
+	HT_AGGRE_MODE_E	ForcedAMSDUMode;
+	u16				ForcedAMSDUMaxSize;
+
+	u8				bForcedShortGI;
+
+	u8				CurrentOpMode;
+
+	// MIMO PS related
+	u8				SelfMimoPs;
+	u8				PeerMimoPs;
+
+	// 40MHz Channel Offset settings.
+	HT_EXTCHNL_OFFSET	CurSTAExtChnlOffset;
+	u8				bCurTxBW40MHz;	// If we use 40 MHz to Tx
+	u8				PeerBandwidth;
+
+	// For Bandwidth Switching
+	u8				bSwBwInProgress;
+	CHNLOP				ChnlOp; // software switching channel in progress. By Bruce, 2008-02-15.
+	u8				SwBwStep;
+	//struct timer_list		SwBwTimer;  //moved to ieee80211_device. as timer_list need include some header file here.
+
+	// For Realtek proprietary A-MPDU factor for aggregation
+	u8				bRegRT2RTAggregation;
+	u8				bCurrentRT2RTAggregation;
+	u8				bCurrentRT2RTLongSlotTime;
+	u8				szRT2RTAggBuffer[10];
+
+	// Rx Reorder control
+	u8				bRegRxReorderEnable;
+	u8				bCurRxReorderEnable;
+	u8				RxReorderWinSize;
+	u8				RxReorderPendingTime;
+	u16				RxReorderDropCounter;
+
+#ifdef USB_TX_DRIVER_AGGREGATION_ENABLE
+	u8				UsbTxAggrNum;
+#endif
+#ifdef USB_RX_AGGREGATION_SUPPORT
+	u8				UsbRxFwAggrEn;
+	u8				UsbRxFwAggrPageNum;
+	u8				UsbRxFwAggrPacketNum;
+	u8				UsbRxFwAggrTimeout;
+#endif
+
+	// Add for Broadcom(Linksys) IOT. Joseph
+	u8				bIsPeerBcm;
+
+	// For IOT issue.
+	u8				IOTPeer;
+	u32				IOTAction;
+} __attribute__ ((packed)) RT_HIGH_THROUGHPUT, *PRT_HIGH_THROUGHPUT;
+
+
+//------------------------------------------------------------
+// The Data structure is used to keep HT related variable for "each Sta"
+// when card is configured as "AP mode"
+//------------------------------------------------------------
+
+typedef struct _RT_HTINFO_STA_ENTRY{
+	u8			bEnableHT;
+
+	u8			bSupportCck;
+
+	u16			AMSDU_MaxSize;
+
+	u8			AMPDU_Factor;
+	u8			MPDU_Density;
+
+	u8			HTHighestOperaRate;
+
+	u8			bBw40MHz;
+
+	u8			MimoPs;
+
+	u8			McsRateSet[16];
+
+
+}RT_HTINFO_STA_ENTRY, *PRT_HTINFO_STA_ENTRY;
+
+
+
+
+
+//------------------------------------------------------------
+// The Data structure is used to keep HT related variable for "each AP"
+// when card is configured as "STA mode"
+//------------------------------------------------------------
+
+typedef struct _BSS_HT{
+
+	u8				bdSupportHT;
+
+	// HT related elements
+	u8					bdHTCapBuf[32];
+	u16					bdHTCapLen;
+	u8					bdHTInfoBuf[32];
+	u16					bdHTInfoLen;
+
+	HT_SPEC_VER				bdHTSpecVer;
+	//HT_CAPABILITY_ELE			bdHTCapEle;
+	//HT_INFORMATION_ELE		bdHTInfoEle;
+
+	u8					bdRT2RTAggregation;
+	u8					bdRT2RTLongSlotTime;
+} __attribute__ ((packed)) BSS_HT, *PBSS_HT;
+
+typedef struct _MIMO_RSSI{
+	u32	EnableAntenna;
+	u32	AntennaA;
+	u32 	AntennaB;
+	u32 	AntennaC;
+	u32 	AntennaD;
+	u32	Average;
+}MIMO_RSSI, *PMIMO_RSSI;
+
+typedef struct _MIMO_EVM{
+	u32	EVM1;
+	u32    EVM2;
+}MIMO_EVM, *PMIMO_EVM;
+
+typedef struct _FALSE_ALARM_STATISTICS{
+	u32	Cnt_Parity_Fail;
+	u32    Cnt_Rate_Illegal;
+	u32	Cnt_Crc8_fail;
+	u32	Cnt_all;
+}FALSE_ALARM_STATISTICS, *PFALSE_ALARM_STATISTICS;
+
+
+extern u8 MCS_FILTER_ALL[16];
+extern u8 MCS_FILTER_1SS[16];
+
+/* 2007/07/11 MH Modify the macro. Becaus STA may link with a N-AP. If we set
+   STA in A/B/G mode and AP is still in N mode. The macro will be wrong. We have
+   to add a macro to judge wireless mode. */
+#define PICK_RATE(_nLegacyRate, _nMcsRate)	\
+		(_nMcsRate==0)?(_nLegacyRate&0x7f):(_nMcsRate)
+/* 2007/07/12 MH We only define legacy and HT wireless mode now. */
+#define	LEGACY_WIRELESS_MODE	IEEE_MODE_MASK
+
+#define CURRENT_RATE(WirelessMode, LegacyRate, HTRate)	\
+					((WirelessMode & (LEGACY_WIRELESS_MODE))!=0)?\
+						(LegacyRate):\
+						(PICK_RATE(LegacyRate, HTRate))
+
+
+
+// MCS Bw 40 {1~7, 12~15,32}
+#define	RATE_ADPT_1SS_MASK 		0xFF
+#define	RATE_ADPT_2SS_MASK		0xF0 //Skip MCS8~11 because mcs7 > mcs6, 9, 10, 11. 2007.01.16 by Emily
+#define	RATE_ADPT_MCS32_MASK		0x01
+
+#define 	IS_11N_MCS_RATE(rate)		(rate&0x80)
+
+typedef enum _HT_AGGRE_SIZE{
+	HT_AGG_SIZE_8K = 0,
+	HT_AGG_SIZE_16K = 1,
+	HT_AGG_SIZE_32K = 2,
+	HT_AGG_SIZE_64K = 3,
+}HT_AGGRE_SIZE_E, *PHT_AGGRE_SIZE_E;
+
+/* Indicate different AP vendor for IOT issue */
+typedef enum _HT_IOT_PEER
+{
+	HT_IOT_PEER_UNKNOWN = 0,
+	HT_IOT_PEER_REALTEK = 1,
+	HT_IOT_PEER_BROADCOM = 2,
+	HT_IOT_PEER_RALINK = 3,
+	HT_IOT_PEER_ATHEROS = 4,
+	HT_IOT_PEER_CISCO= 5,
+	HT_IOT_PEER_MAX = 6
+}HT_IOT_PEER_E, *PHTIOT_PEER_E;
+
+//
+// IOT Action for different AP
+//
+typedef enum _HT_IOT_ACTION{
+	HT_IOT_ACT_TX_USE_AMSDU_4K = 0x00000001,
+	HT_IOT_ACT_TX_USE_AMSDU_8K = 0x00000002,
+	HT_IOT_ACT_DISABLE_MCS14 = 0x00000004,
+	HT_IOT_ACT_DISABLE_MCS15 = 0x00000008,
+	HT_IOT_ACT_DISABLE_ALL_2SS = 0x00000010,
+	HT_IOT_ACT_DISABLE_EDCA_TURBO = 0x00000020,
+	HT_IOT_ACT_MGNT_USE_CCK_6M = 0x00000040,
+	HT_IOT_ACT_CDD_FSYNC = 0x00000080,
+	HT_IOT_ACT_PURE_N_MODE = 0x00000100,
+	HT_IOT_ACT_FORCED_CTS2SELF = 0x00000200,
+}HT_IOT_ACTION_E, *PHT_IOT_ACTION_E;
+
+#endif //_RTL819XU_HTTYPE_H_
+
diff --git a/drivers/staging/rtl8192u/ieee80211/rtl819x_HTProc.c b/drivers/staging/rtl8192u/ieee80211/rtl819x_HTProc.c
new file mode 100644
index 000000000000..2c4eb38c89a8
--- /dev/null
+++ b/drivers/staging/rtl8192u/ieee80211/rtl819x_HTProc.c
@@ -0,0 +1,1462 @@
+
+//As this function is mainly ported from Windows driver, so leave the name little changed. If any confusion caused, tell me. Created by WB. 2008.05.08
+#include "ieee80211.h"
+#include "rtl819x_HT.h"
+u8 MCS_FILTER_ALL[16] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x1f, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
+
+u8 MCS_FILTER_1SS[16] = {0xff, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
+
+u16 MCS_DATA_RATE[2][2][77] =
+	{	{	{13, 26, 39, 52, 78, 104, 117, 130, 26, 52, 78 ,104, 156, 208, 234, 260,
+			39, 78, 117, 234, 312, 351, 390, 52, 104, 156, 208, 312, 416, 468, 520,
+			0, 78, 104, 130, 117, 156, 195, 104, 130, 130, 156, 182, 182, 208, 156, 195,
+			195, 234, 273, 273, 312, 130, 156, 181, 156, 181, 208, 234, 208, 234, 260, 260,
+			286, 195, 234, 273, 234, 273, 312, 351, 312, 351, 390, 390, 429},			// Long GI, 20MHz
+			{14, 29, 43, 58, 87, 116, 130, 144, 29, 58, 87, 116, 173, 231, 260, 289,
+			43, 87, 130, 173, 260, 347, 390, 433, 58, 116, 173, 231, 347, 462, 520, 578,
+			0, 87, 116, 144, 130, 173, 217, 116, 144, 144, 173, 202, 202, 231, 173, 217,
+			217, 260, 303, 303, 347, 144, 173, 202, 173, 202, 231, 260, 231, 260, 289, 289,
+			318, 217, 260, 303, 260, 303, 347, 390, 347, 390, 433, 433, 477}	},		// Short GI, 20MHz
+		{	{27, 54, 81, 108, 162, 216, 243, 270, 54, 108, 162, 216, 324, 432, 486, 540,
+			81, 162, 243, 324, 486, 648, 729, 810, 108, 216, 324, 432, 648, 864, 972, 1080,
+			12, 162, 216, 270, 243, 324, 405, 216, 270, 270, 324, 378, 378, 432, 324, 405,
+			405, 486, 567, 567, 648, 270, 324, 378, 324, 378, 432, 486, 432, 486, 540, 540,
+			594, 405, 486, 567, 486, 567, 648, 729, 648, 729, 810, 810, 891}, 	// Long GI, 40MHz
+			{30, 60, 90, 120, 180, 240, 270, 300, 60, 120, 180, 240, 360, 480, 540, 600,
+			90, 180, 270, 360, 540, 720, 810, 900, 120, 240, 360, 480, 720, 960, 1080, 1200,
+			13, 180, 240, 300, 270, 360, 450, 240, 300, 300, 360, 420, 420, 480, 360, 450,
+			450, 540, 630, 630, 720, 300, 360, 420, 360, 420, 480, 540, 480, 540, 600, 600,
+			660, 450, 540, 630, 540, 630, 720, 810, 720, 810, 900, 900, 990}	}	// Short GI, 40MHz
+	};
+
+static u8 UNKNOWN_BORADCOM[3] = {0x00, 0x14, 0xbf};
+static u8 LINKSYSWRT330_LINKSYSWRT300_BROADCOM[3] = {0x00, 0x1a, 0x70};
+static u8 LINKSYSWRT350_LINKSYSWRT150_BROADCOM[3] = {0x00, 0x1d, 0x7e};
+static u8 NETGEAR834Bv2_BROADCOM[3] = {0x00, 0x1b, 0x2f};
+static u8 BELKINF5D8233V1_RALINK[3] = {0x00, 0x17, 0x3f};	//cosa 03202008
+static u8 BELKINF5D82334V3_RALINK[3] = {0x00, 0x1c, 0xdf};
+static u8 PCI_RALINK[3] = {0x00, 0x90, 0xcc};
+static u8 EDIMAX_RALINK[3] = {0x00, 0x0e, 0x2e};
+static u8 AIRLINK_RALINK[3] = {0x00, 0x18, 0x02};
+//static u8 DLINK_ATHEROS[3] = {0x00, 0x1c, 0xf0};
+static u8 CISCO_BROADCOM[3] = {0x00, 0x17, 0x94};
+
+// 2008/04/01 MH For Cisco G mode RX TP We need to change FW duration. Shoud we put the
+// code in other place??
+//static u8 WIFI_CISCO_G_AP[3] = {0x00, 0x40, 0x96};
+/********************************************************************************************************************
+ *function:  This function update default settings in pHTInfo structure
+ *   input:  PRT_HIGH_THROUGHPUT	pHTInfo
+ *  output:  none
+ *  return:  none
+ *  notice:  These value need be modified if any changes.
+ * *****************************************************************************************************************/
+void HTUpdateDefaultSetting(struct ieee80211_device* ieee)
+{
+	PRT_HIGH_THROUGHPUT	pHTInfo = ieee->pHTInfo;
+	//const typeof( ((struct ieee80211_device *)0)->pHTInfo ) *__mptr = &pHTInfo;
+
+	//printk("pHTinfo:%p, &pHTinfo:%p, mptr:%p,  offsetof:%x\n", pHTInfo, &pHTInfo, __mptr, offsetof(struct ieee80211_device, pHTInfo));
+	//printk("===>ieee:%p,\n", ieee);
+	// ShortGI support
+	pHTInfo->bRegShortGI20MHz= 1;
+	pHTInfo->bRegShortGI40MHz= 1;
+
+	// 40MHz channel support
+	pHTInfo->bRegBW40MHz = 1;
+
+	// CCK rate support in 40MHz channel
+	if(pHTInfo->bRegBW40MHz)
+		pHTInfo->bRegSuppCCK = 1;
+	else
+		pHTInfo->bRegSuppCCK = true;
+
+	// AMSDU related
+	pHTInfo->nAMSDU_MaxSize = 7935UL;
+	pHTInfo->bAMSDU_Support = 0;
+
+	// AMPDU related
+	pHTInfo->bAMPDUEnable = 1;
+	pHTInfo->AMPDU_Factor = 2; //// 0: 2n13(8K), 1:2n14(16K), 2:2n15(32K), 3:2n16(64k)
+	pHTInfo->MPDU_Density = 0;// 0: No restriction, 1: 1/8usec, 2: 1/4usec, 3: 1/2usec, 4: 1usec, 5: 2usec, 6: 4usec, 7:8usec
+
+	// MIMO Power Save
+	pHTInfo->SelfMimoPs = 3;// 0: Static Mimo Ps, 1: Dynamic Mimo Ps, 3: No Limitation, 2: Reserved(Set to 3 automatically.)
+	if(pHTInfo->SelfMimoPs == 2)
+		pHTInfo->SelfMimoPs = 3;
+	// 8190 only. Assign rate operation mode to firmware
+	ieee->bTxDisableRateFallBack = 0;
+	ieee->bTxUseDriverAssingedRate = 0;
+
+#ifdef 	TO_DO_LIST
+	// 8190 only. Assign duration operation mode to firmware
+	pMgntInfo->bTxEnableFwCalcDur = (BOOLEAN)pNdisCommon->bRegTxEnableFwCalcDur;
+#endif
+	// 8190 only, Realtek proprietary aggregation mode
+	// Set MPDUDensity=2,   1: Set MPDUDensity=2(32k)  for Realtek AP and set MPDUDensity=0(8k) for others
+	pHTInfo->bRegRT2RTAggregation = 1;//0: Set MPDUDensity=2,   1: Set MPDUDensity=2(32k)  for Realtek AP and set MPDUDensity=0(8k) for others
+
+	// For Rx Reorder Control
+	pHTInfo->bRegRxReorderEnable = 1;
+	pHTInfo->RxReorderWinSize = 64;
+	pHTInfo->RxReorderPendingTime = 30;
+
+#ifdef USB_TX_DRIVER_AGGREGATION_ENABLE
+	pHTInfo->UsbTxAggrNum = 4;
+#endif
+#ifdef USB_RX_AGGREGATION_SUPPORT
+	pHTInfo->UsbRxFwAggrEn = 1;
+	pHTInfo->UsbRxFwAggrPageNum = 24;
+	pHTInfo->UsbRxFwAggrPacketNum = 8;
+	pHTInfo->UsbRxFwAggrTimeout = 16; ////usb rx FW aggregation timeout threshold.It's in units of 64us
+#endif
+
+
+}
+/********************************************************************************************************************
+ *function:  This function print out each field on HT capability IE mainly from (Beacon/ProbeRsp/AssocReq)
+ *   input:  u8*	CapIE       //Capability IE to be printed out
+ *   	     u8* 	TitleString //mainly print out caller function
+ *  output:  none
+ *  return:  none
+ *  notice:  Driver should not print out this message by default.
+ * *****************************************************************************************************************/
+void HTDebugHTCapability(u8* CapIE, u8* TitleString )
+{
+
+	static u8	EWC11NHTCap[] = {0x00, 0x90, 0x4c, 0x33};	// For 11n EWC definition, 2007.07.17, by Emily
+	PHT_CAPABILITY_ELE 		pCapELE;
+
+	if(!memcmp(CapIE, EWC11NHTCap, sizeof(EWC11NHTCap)))
+	{
+		//EWC IE
+		IEEE80211_DEBUG(IEEE80211_DL_HT, "EWC IE in %s()\n", __FUNCTION__);
+		pCapELE = (PHT_CAPABILITY_ELE)(&CapIE[4]);
+	}else
+		pCapELE = (PHT_CAPABILITY_ELE)(&CapIE[0]);
+
+	IEEE80211_DEBUG(IEEE80211_DL_HT, "<Log HT Capability>. Called by %s\n", TitleString );
+
+	IEEE80211_DEBUG(IEEE80211_DL_HT,  "\tSupported Channel Width = %s\n", (pCapELE->ChlWidth)?"20MHz": "20/40MHz");
+	IEEE80211_DEBUG(IEEE80211_DL_HT,  "\tSupport Short GI for 20M = %s\n", (pCapELE->ShortGI20Mhz)?"YES": "NO");
+	IEEE80211_DEBUG(IEEE80211_DL_HT,  "\tSupport Short GI for 40M = %s\n", (pCapELE->ShortGI40Mhz)?"YES": "NO");
+	IEEE80211_DEBUG(IEEE80211_DL_HT,  "\tSupport TX STBC = %s\n", (pCapELE->TxSTBC)?"YES": "NO");
+	IEEE80211_DEBUG(IEEE80211_DL_HT,  "\tMax AMSDU Size = %s\n", (pCapELE->MaxAMSDUSize)?"3839": "7935");
+	IEEE80211_DEBUG(IEEE80211_DL_HT,  "\tSupport CCK in 20/40 mode = %s\n", (pCapELE->DssCCk)?"YES": "NO");
+	IEEE80211_DEBUG(IEEE80211_DL_HT,  "\tMax AMPDU Factor = %d\n", pCapELE->MaxRxAMPDUFactor);
+	IEEE80211_DEBUG(IEEE80211_DL_HT,  "\tMPDU Density = %d\n", pCapELE->MPDUDensity);
+	IEEE80211_DEBUG(IEEE80211_DL_HT,  "\tMCS Rate Set = [%x][%x][%x][%x][%x]\n", pCapELE->MCS[0],\
+				pCapELE->MCS[1], pCapELE->MCS[2], pCapELE->MCS[3], pCapELE->MCS[4]);
+	return;
+
+}
+/********************************************************************************************************************
+ *function:  This function print out each field on HT Information IE mainly from (Beacon/ProbeRsp)
+ *   input:  u8*	InfoIE       //Capability IE to be printed out
+ *   	     u8* 	TitleString //mainly print out caller function
+ *  output:  none
+ *  return:  none
+ *  notice:  Driver should not print out this message by default.
+ * *****************************************************************************************************************/
+void HTDebugHTInfo(u8*	InfoIE, u8* TitleString)
+{
+
+	static u8	EWC11NHTInfo[] = {0x00, 0x90, 0x4c, 0x34};	// For 11n EWC definition, 2007.07.17, by Emily
+	PHT_INFORMATION_ELE		pHTInfoEle;
+
+	if(!memcmp(InfoIE, EWC11NHTInfo, sizeof(EWC11NHTInfo)))
+	{
+		// Not EWC IE
+		IEEE80211_DEBUG(IEEE80211_DL_HT, "EWC IE in %s()\n", __FUNCTION__);
+		pHTInfoEle = (PHT_INFORMATION_ELE)(&InfoIE[4]);
+	}else
+		pHTInfoEle = (PHT_INFORMATION_ELE)(&InfoIE[0]);
+
+
+	IEEE80211_DEBUG(IEEE80211_DL_HT, "<Log HT Information Element>. Called by %s\n", TitleString);
+
+	IEEE80211_DEBUG(IEEE80211_DL_HT, "\tPrimary channel = %d\n", pHTInfoEle->ControlChl);
+	IEEE80211_DEBUG(IEEE80211_DL_HT, "\tSenondary channel =");
+	switch(pHTInfoEle->ExtChlOffset)
+	{
+		case 0:
+			IEEE80211_DEBUG(IEEE80211_DL_HT, "Not Present\n");
+			break;
+		case 1:
+			IEEE80211_DEBUG(IEEE80211_DL_HT, "Upper channel\n");
+			break;
+		case 2:
+			IEEE80211_DEBUG(IEEE80211_DL_HT, "Reserved. Eooro!!!\n");
+			break;
+		case 3:
+			IEEE80211_DEBUG(IEEE80211_DL_HT, "Lower Channel\n");
+			break;
+	}
+	IEEE80211_DEBUG(IEEE80211_DL_HT, "\tRecommended channel width = %s\n", (pHTInfoEle->RecommemdedTxWidth)?"20Mhz": "40Mhz");
+
+	IEEE80211_DEBUG(IEEE80211_DL_HT, "\tOperation mode for protection = ");
+	switch(pHTInfoEle->OptMode)
+	{
+		case 0:
+			IEEE80211_DEBUG(IEEE80211_DL_HT, "No Protection\n");
+			break;
+		case 1:
+			IEEE80211_DEBUG(IEEE80211_DL_HT, "HT non-member protection mode\n");
+			break;
+		case 2:
+			IEEE80211_DEBUG(IEEE80211_DL_HT, "Suggest to open protection\n");
+			break;
+		case 3:
+			IEEE80211_DEBUG(IEEE80211_DL_HT, "HT mixed mode\n");
+			break;
+	}
+
+	IEEE80211_DEBUG(IEEE80211_DL_HT, "\tBasic MCS Rate Set = [%x][%x][%x][%x][%x]\n", pHTInfoEle->BasicMSC[0],\
+				pHTInfoEle->BasicMSC[1], pHTInfoEle->BasicMSC[2], pHTInfoEle->BasicMSC[3], pHTInfoEle->BasicMSC[4]);
+	return;
+}
+
+/*
+*	Return:     	true if station in half n mode and AP supports 40 bw
+*/
+bool IsHTHalfNmode40Bandwidth(struct ieee80211_device* ieee)
+{
+	bool			retValue = false;
+	PRT_HIGH_THROUGHPUT	 pHTInfo = ieee->pHTInfo;
+
+	if(pHTInfo->bCurrentHTSupport == false )	// wireless is n mode
+		retValue = false;
+	else if(pHTInfo->bRegBW40MHz == false)	// station supports 40 bw
+		retValue = false;
+	else if(!ieee->GetHalfNmodeSupportByAPsHandler(ieee->dev)) 	// station in half n mode
+		retValue = false;
+	else if(((PHT_CAPABILITY_ELE)(pHTInfo->PeerHTCapBuf))->ChlWidth) // ap support 40 bw
+		retValue = true;
+	else
+		retValue = false;
+
+	return retValue;
+}
+
+bool IsHTHalfNmodeSGI(struct ieee80211_device* ieee, bool is40MHz)
+{
+	bool			retValue = false;
+	PRT_HIGH_THROUGHPUT	 pHTInfo = ieee->pHTInfo;
+
+	if(pHTInfo->bCurrentHTSupport == false )	// wireless is n mode
+		retValue = false;
+	else if(!ieee->GetHalfNmodeSupportByAPsHandler(ieee->dev)) 	// station in half n mode
+		retValue = false;
+	else if(is40MHz) // ap support 40 bw
+	{
+		if(((PHT_CAPABILITY_ELE)(pHTInfo->PeerHTCapBuf))->ShortGI40Mhz) // ap support 40 bw short GI
+			retValue = true;
+		else
+			retValue = false;
+	}
+	else
+	{
+		if(((PHT_CAPABILITY_ELE)(pHTInfo->PeerHTCapBuf))->ShortGI20Mhz) // ap support 40 bw short GI
+			retValue = true;
+		else
+			retValue = false;
+	}
+
+	return retValue;
+}
+
+u16 HTHalfMcsToDataRate(struct ieee80211_device* ieee, 	u8	nMcsRate)
+{
+
+	u8	is40MHz;
+	u8	isShortGI;
+
+	is40MHz  =  (IsHTHalfNmode40Bandwidth(ieee))?1:0;
+	isShortGI = (IsHTHalfNmodeSGI(ieee, is40MHz))? 1:0;
+
+	return MCS_DATA_RATE[is40MHz][isShortGI][(nMcsRate&0x7f)];
+}
+
+
+u16 HTMcsToDataRate( struct ieee80211_device* ieee, u8 nMcsRate)
+{
+	PRT_HIGH_THROUGHPUT	pHTInfo = ieee->pHTInfo;
+
+	u8	is40MHz = (pHTInfo->bCurBW40MHz)?1:0;
+	u8	isShortGI = (pHTInfo->bCurBW40MHz)?
+						((pHTInfo->bCurShortGI40MHz)?1:0):
+						((pHTInfo->bCurShortGI20MHz)?1:0);
+	return MCS_DATA_RATE[is40MHz][isShortGI][(nMcsRate&0x7f)];
+}
+
+/********************************************************************************************************************
+ *function:  This function returns current datarate.
+ *   input:  struct ieee80211_device* 	ieee
+ *   	     u8 			nDataRate
+ *  output:  none
+ *  return:  tx rate
+ *  notice:  quite unsure about how to use this function //wb
+ * *****************************************************************************************************************/
+u16  TxCountToDataRate( struct ieee80211_device* ieee, u8 nDataRate)
+{
+	//PRT_HIGH_THROUGHPUT	pHTInfo = ieee->pHTInfo;
+	u16		CCKOFDMRate[12] = {0x02 , 0x04 , 0x0b , 0x16 , 0x0c , 0x12 , 0x18 , 0x24 , 0x30 , 0x48 , 0x60 , 0x6c};
+	u8	is40MHz = 0;
+	u8	isShortGI = 0;
+
+	if(nDataRate < 12)
+	{
+		return CCKOFDMRate[nDataRate];
+	}
+	else
+	{
+		if (nDataRate >= 0x10 && nDataRate <= 0x1f)//if(nDataRate > 11 && nDataRate < 28 )
+		{
+			is40MHz = 0;
+			isShortGI = 0;
+
+		      // nDataRate = nDataRate - 12;
+		}
+		else if(nDataRate >=0x20  && nDataRate <= 0x2f ) //(27, 44)
+		{
+			is40MHz = 1;
+			isShortGI = 0;
+
+			//nDataRate = nDataRate - 28;
+		}
+		else if(nDataRate >= 0x30  && nDataRate <= 0x3f )  //(43, 60)
+		{
+			is40MHz = 0;
+			isShortGI = 1;
+
+			//nDataRate = nDataRate - 44;
+		}
+		else if(nDataRate >= 0x40  && nDataRate <= 0x4f ) //(59, 76)
+		{
+			is40MHz = 1;
+			isShortGI = 1;
+
+			//nDataRate = nDataRate - 60;
+		}
+		return MCS_DATA_RATE[is40MHz][isShortGI][nDataRate&0xf];
+	}
+}
+
+
+
+bool IsHTHalfNmodeAPs(struct ieee80211_device* ieee)
+{
+	bool			retValue = false;
+	struct ieee80211_network* net = &ieee->current_network;
+	if((memcmp(net->bssid, BELKINF5D8233V1_RALINK, 3)==0) ||
+		     (memcmp(net->bssid, BELKINF5D82334V3_RALINK, 3)==0) ||
+		     (memcmp(net->bssid, PCI_RALINK, 3)==0) ||
+		     (memcmp(net->bssid, EDIMAX_RALINK, 3)==0) ||
+		     (memcmp(net->bssid, AIRLINK_RALINK, 3)==0) ||
+		     (net->ralink_cap_exist))
+		retValue = true;
+	else if((memcmp(net->bssid, UNKNOWN_BORADCOM, 3)==0) ||
+		    (memcmp(net->bssid, LINKSYSWRT330_LINKSYSWRT300_BROADCOM, 3)==0)||
+		    (memcmp(net->bssid, LINKSYSWRT350_LINKSYSWRT150_BROADCOM, 3)==0)||
+		    (memcmp(net->bssid, NETGEAR834Bv2_BROADCOM, 3)==0) ||
+		    (net->broadcom_cap_exist))
+		  retValue = true;
+	else if(net->bssht.bdRT2RTAggregation)
+		retValue = true;
+	else
+		retValue = false;
+
+	return retValue;
+}
+
+/********************************************************************************************************************
+ *function:  This function returns peer IOT.
+ *   input:  struct ieee80211_device* 	ieee
+ *  output:  none
+ *  return:
+ *  notice:
+ * *****************************************************************************************************************/
+void HTIOTPeerDetermine(struct ieee80211_device* ieee)
+{
+	PRT_HIGH_THROUGHPUT	pHTInfo = ieee->pHTInfo;
+	struct ieee80211_network* net = &ieee->current_network;
+	if(net->bssht.bdRT2RTAggregation)
+		pHTInfo->IOTPeer = HT_IOT_PEER_REALTEK;
+	else if(net->broadcom_cap_exist)
+		pHTInfo->IOTPeer = HT_IOT_PEER_BROADCOM;
+	else if((memcmp(net->bssid, UNKNOWN_BORADCOM, 3)==0) ||
+			(memcmp(net->bssid, LINKSYSWRT330_LINKSYSWRT300_BROADCOM, 3)==0)||
+			(memcmp(net->bssid, LINKSYSWRT350_LINKSYSWRT150_BROADCOM, 3)==0)||
+			(memcmp(net->bssid, NETGEAR834Bv2_BROADCOM, 3)==0) )
+		pHTInfo->IOTPeer = HT_IOT_PEER_BROADCOM;
+	else if((memcmp(net->bssid, BELKINF5D8233V1_RALINK, 3)==0) ||
+			(memcmp(net->bssid, BELKINF5D82334V3_RALINK, 3)==0) ||
+			(memcmp(net->bssid, PCI_RALINK, 3)==0) ||
+			(memcmp(net->bssid, EDIMAX_RALINK, 3)==0) ||
+			(memcmp(net->bssid, AIRLINK_RALINK, 3)==0) ||
+			 net->ralink_cap_exist)
+		pHTInfo->IOTPeer = HT_IOT_PEER_RALINK;
+	else if(net->atheros_cap_exist)
+		pHTInfo->IOTPeer = HT_IOT_PEER_ATHEROS;
+	else if(memcmp(net->bssid, CISCO_BROADCOM, 3)==0)
+		pHTInfo->IOTPeer = HT_IOT_PEER_CISCO;
+	else
+		pHTInfo->IOTPeer = HT_IOT_PEER_UNKNOWN;
+
+	IEEE80211_DEBUG(IEEE80211_DL_IOT, "Joseph debug!! IOTPEER: %x\n", pHTInfo->IOTPeer);
+}
+/********************************************************************************************************************
+ *function:  Check whether driver should declare received rate up to MCS13 only since some chipset is not good
+ *	     at receiving MCS14~15 frame from some AP.
+ *   input:  struct ieee80211_device* 	ieee
+ *   	     u8 *			PeerMacAddr
+ *  output:  none
+ *  return:  return 1 if driver should declare MCS13 only(otherwise return 0)
+  * *****************************************************************************************************************/
+u8 HTIOTActIsDisableMCS14(struct ieee80211_device* ieee, u8* PeerMacAddr)
+{
+	u8 ret = 0;
+	return ret;
+ }
+
+
+/**
+* Function:	HTIOTActIsDisableMCS15
+*
+* Overview:	Check whether driver should declare capability of receving MCS15
+*
+* Input:
+*			PADAPTER		Adapter,
+*
+* Output:		None
+* Return:     	true if driver should disable MCS15
+* 2008.04.15	Emily
+*/
+bool HTIOTActIsDisableMCS15(struct ieee80211_device* ieee)
+{
+	bool retValue = false;
+
+#ifdef TODO
+	// Apply for 819u only
+#if (HAL_CODE_BASE==RTL8192)
+
+#if (DEV_BUS_TYPE == USB_INTERFACE)
+	// Alway disable MCS15 by Jerry Chang's request.by Emily, 2008.04.15
+	retValue = true;
+#elif (DEV_BUS_TYPE == PCI_INTERFACE)
+	// Enable MCS15 if the peer is Cisco AP. by Emily, 2008.05.12
+//	if(pBssDesc->bCiscoCapExist)
+//		retValue = false;
+//	else
+		retValue = false;
+#endif
+#endif
+#endif
+	// Jerry Chang suggest that 8190 1x2 does not need to disable MCS15
+
+	return retValue;
+}
+
+/**
+* Function:	HTIOTActIsDisableMCSTwoSpatialStream
+*
+* Overview:	Check whether driver should declare capability of receving All 2 ss packets
+*
+* Input:
+*			PADAPTER		Adapter,
+*
+* Output:		None
+* Return:     	true if driver should disable all two spatial stream packet
+* 2008.04.21	Emily
+*/
+bool HTIOTActIsDisableMCSTwoSpatialStream(struct ieee80211_device* ieee, u8 *PeerMacAddr)
+{
+	bool retValue = false;
+
+#ifdef TODO
+	// Apply for 819u only
+#endif
+	return retValue;
+}
+
+/********************************************************************************************************************
+ *function:  Check whether driver should disable EDCA turbo mode
+ *   input:  struct ieee80211_device* 	ieee
+ *   	     u8* 			PeerMacAddr
+ *  output:  none
+ *  return:  return 1 if driver should disable EDCA turbo mode(otherwise return 0)
+  * *****************************************************************************************************************/
+u8 HTIOTActIsDisableEDCATurbo(struct ieee80211_device* 	ieee, u8* PeerMacAddr)
+{
+	u8	retValue = false;	// default enable EDCA Turbo mode.
+	// Set specific EDCA parameter for different AP in DM handler.
+
+	return retValue;
+}
+
+/********************************************************************************************************************
+ *function:  Check whether we need to use OFDM to sned MGNT frame for broadcom AP
+ *   input:  struct ieee80211_network *network   //current network we live
+ *  output:  none
+ *  return:  return 1 if true
+  * *****************************************************************************************************************/
+u8 HTIOTActIsMgntUseCCK6M(struct ieee80211_network *network)
+{
+	u8	retValue = 0;
+
+	// 2008/01/25 MH Judeg if we need to use OFDM to sned MGNT frame for broadcom AP.
+	// 2008/01/28 MH We must prevent that we select null bssid to link.
+
+	if(network->broadcom_cap_exist)
+	{
+		retValue = 1;
+	}
+
+	return retValue;
+}
+
+u8 HTIOTActIsCCDFsync(u8* PeerMacAddr)
+{
+	u8	retValue = 0;
+	if(	(memcmp(PeerMacAddr, UNKNOWN_BORADCOM, 3)==0) ||
+		(memcmp(PeerMacAddr, LINKSYSWRT330_LINKSYSWRT300_BROADCOM, 3)==0) ||
+		(memcmp(PeerMacAddr, LINKSYSWRT350_LINKSYSWRT150_BROADCOM, 3) ==0))
+	{
+		retValue = 1;
+	}
+
+	return retValue;
+}
+
+void HTResetIOTSetting(
+	PRT_HIGH_THROUGHPUT		pHTInfo
+)
+{
+	pHTInfo->IOTAction = 0;
+	pHTInfo->IOTPeer = HT_IOT_PEER_UNKNOWN;
+}
+
+
+/********************************************************************************************************************
+ *function:  Construct Capablility Element in Beacon... if HTEnable is turned on
+ *   input:  struct ieee80211_device* 	ieee
+ *   	     u8* 			posHTCap //pointer to store Capability Ele
+ *   	     u8*			len //store length of CE
+ *   	     u8				IsEncrypt //whether encrypt, needed further
+ *  output:  none
+ *  return:  none
+ *  notice:  posHTCap can't be null and should be initialized before.
+  * *****************************************************************************************************************/
+void HTConstructCapabilityElement(struct ieee80211_device* ieee, u8* posHTCap, u8* len, u8 IsEncrypt)
+{
+	PRT_HIGH_THROUGHPUT	pHT = ieee->pHTInfo;
+	PHT_CAPABILITY_ELE 	pCapELE = NULL;
+	//u8 bIsDeclareMCS13;
+
+	if ((posHTCap == NULL) || (pHT == NULL))
+	{
+		IEEE80211_DEBUG(IEEE80211_DL_ERR, "posHTCap or pHTInfo can't be null in HTConstructCapabilityElement()\n");
+		return;
+	}
+	memset(posHTCap, 0, *len);
+	if(pHT->ePeerHTSpecVer == HT_SPEC_VER_EWC)
+	{
+		u8	EWC11NHTCap[] = {0x00, 0x90, 0x4c, 0x33};	// For 11n EWC definition, 2007.07.17, by Emily
+		memcpy(posHTCap, EWC11NHTCap, sizeof(EWC11NHTCap));
+		pCapELE = (PHT_CAPABILITY_ELE)&(posHTCap[4]);
+	}else
+	{
+		pCapELE = (PHT_CAPABILITY_ELE)posHTCap;
+	}
+
+
+	//HT capability info
+	pCapELE->AdvCoding 		= 0; // This feature is not supported now!!
+	if(ieee->GetHalfNmodeSupportByAPsHandler(ieee->dev))
+	{
+		pCapELE->ChlWidth = 0;
+	}
+	else
+	{
+		pCapELE->ChlWidth = (pHT->bRegBW40MHz?1:0);
+	}
+
+//	pCapELE->ChlWidth 		= (pHT->bRegBW40MHz?1:0);
+	pCapELE->MimoPwrSave 		= pHT->SelfMimoPs;
+	pCapELE->GreenField		= 0; // This feature is not supported now!!
+	pCapELE->ShortGI20Mhz		= 1; // We can receive Short GI!!
+	pCapELE->ShortGI40Mhz		= 1; // We can receive Short GI!!
+	//DbgPrint("TX HT cap/info ele BW=%d SG20=%d SG40=%d\n\r",
+		//pCapELE->ChlWidth, pCapELE->ShortGI20Mhz, pCapELE->ShortGI40Mhz);
+	pCapELE->TxSTBC 		= 1;
+	pCapELE->RxSTBC 		= 0;
+	pCapELE->DelayBA		= 0;	// Do not support now!!
+	pCapELE->MaxAMSDUSize	= (MAX_RECEIVE_BUFFER_SIZE>=7935)?1:0;
+	pCapELE->DssCCk 		= ((pHT->bRegBW40MHz)?(pHT->bRegSuppCCK?1:0):0);
+	pCapELE->PSMP			= 0; // Do not support now!!
+	pCapELE->LSigTxopProtect	= 0; // Do not support now!!
+
+
+	//MAC HT parameters info
+	// TODO: Nedd to take care of this part
+	IEEE80211_DEBUG(IEEE80211_DL_HT, "TX HT cap/info ele BW=%d MaxAMSDUSize:%d DssCCk:%d\n", pCapELE->ChlWidth, pCapELE->MaxAMSDUSize, pCapELE->DssCCk);
+
+	if( IsEncrypt)
+	{
+		pCapELE->MPDUDensity 	= 7; // 8us
+		pCapELE->MaxRxAMPDUFactor 	= 2; // 2 is for 32 K and 3 is 64K
+	}
+	else
+	{
+		pCapELE->MaxRxAMPDUFactor 	= 3; // 2 is for 32 K and 3 is 64K
+		pCapELE->MPDUDensity 	= 0; // no density
+	}
+
+	//Supported MCS set
+	memcpy(pCapELE->MCS, ieee->Regdot11HTOperationalRateSet, 16);
+	if(pHT->IOTAction & HT_IOT_ACT_DISABLE_MCS15)
+		pCapELE->MCS[1] &= 0x7f;
+
+	if(pHT->IOTAction & HT_IOT_ACT_DISABLE_MCS14)
+		pCapELE->MCS[1] &= 0xbf;
+
+	if(pHT->IOTAction & HT_IOT_ACT_DISABLE_ALL_2SS)
+		pCapELE->MCS[1] &= 0x00;
+
+	// 2008.06.12
+	// For RTL819X, if pairwisekey = wep/tkip, ap is ralink, we support only MCS0~7.
+	if(ieee->GetHalfNmodeSupportByAPsHandler(ieee->dev))
+	{
+		int i;
+		for(i = 1; i< 16; i++)
+			pCapELE->MCS[i] = 0;
+	}
+
+	//Extended HT Capability Info
+	memset(&pCapELE->ExtHTCapInfo, 0, 2);
+
+
+	//TXBF Capabilities
+	memset(pCapELE->TxBFCap, 0, 4);
+
+	//Antenna Selection Capabilities
+	pCapELE->ASCap = 0;
+//add 2 to give space for element ID and len when construct frames
+	if(pHT->ePeerHTSpecVer == HT_SPEC_VER_EWC)
+		*len = 30 + 2;
+	else
+		*len = 26 + 2;
+
+
+
+//	IEEE80211_DEBUG_DATA(IEEE80211_DL_DATA | IEEE80211_DL_HT, posHTCap, *len -2);
+
+	//Print each field in detail. Driver should not print out this message by default
+//	HTDebugHTCapability(posHTCap, (u8*)"HTConstructCapability()");
+	return;
+
+}
+/********************************************************************************************************************
+ *function:  Construct  Information Element in Beacon... if HTEnable is turned on
+ *   input:  struct ieee80211_device* 	ieee
+ *   	     u8* 			posHTCap //pointer to store Information Ele
+ *   	     u8*			len   //store len of
+ *   	     u8				IsEncrypt //whether encrypt, needed further
+ *  output:  none
+ *  return:  none
+ *  notice:  posHTCap can't be null and be initialized before. only AP and IBSS sta should do this
+  * *****************************************************************************************************************/
+void HTConstructInfoElement(struct ieee80211_device* ieee, u8* posHTInfo, u8* len, u8 IsEncrypt)
+{
+	PRT_HIGH_THROUGHPUT	pHT = ieee->pHTInfo;
+	PHT_INFORMATION_ELE		pHTInfoEle = (PHT_INFORMATION_ELE)posHTInfo;
+	if ((posHTInfo == NULL) || (pHTInfoEle == NULL))
+	{
+		IEEE80211_DEBUG(IEEE80211_DL_ERR, "posHTInfo or pHTInfoEle can't be null in HTConstructInfoElement()\n");
+		return;
+	}
+
+	memset(posHTInfo, 0, *len);
+	if ( (ieee->iw_mode == IW_MODE_ADHOC) || (ieee->iw_mode == IW_MODE_MASTER)) //ap mode is not currently supported
+	{
+		pHTInfoEle->ControlChl 			= ieee->current_network.channel;
+		pHTInfoEle->ExtChlOffset 			= ((pHT->bRegBW40MHz == false)?HT_EXTCHNL_OFFSET_NO_EXT:
+											(ieee->current_network.channel<=6)?
+												HT_EXTCHNL_OFFSET_UPPER:HT_EXTCHNL_OFFSET_LOWER);
+		pHTInfoEle->RecommemdedTxWidth	= pHT->bRegBW40MHz;
+		pHTInfoEle->RIFS 					= 0;
+		pHTInfoEle->PSMPAccessOnly		= 0;
+		pHTInfoEle->SrvIntGranularity		= 0;
+		pHTInfoEle->OptMode				= pHT->CurrentOpMode;
+		pHTInfoEle->NonGFDevPresent		= 0;
+		pHTInfoEle->DualBeacon			= 0;
+		pHTInfoEle->SecondaryBeacon		= 0;
+		pHTInfoEle->LSigTxopProtectFull		= 0;
+		pHTInfoEle->PcoActive				= 0;
+		pHTInfoEle->PcoPhase				= 0;
+
+		memset(pHTInfoEle->BasicMSC, 0, 16);
+
+
+		*len = 22 + 2; //same above
+
+	}
+	else
+	{
+		//STA should not generate High Throughput Information Element
+		*len = 0;
+	}
+	//IEEE80211_DEBUG_DATA(IEEE80211_DL_DATA | IEEE80211_DL_HT, posHTInfo, *len - 2);
+	//HTDebugHTInfo(posHTInfo, "HTConstructInforElement");
+	return;
+}
+
+/*
+  *  According to experiment, Realtek AP to STA (based on rtl8190) may achieve best performance
+  *  if both STA and AP set limitation of aggregation size to 32K, that is, set AMPDU density to 2
+  *  (Ref: IEEE 11n specification). However, if Realtek STA associates to other AP, STA should set
+  *  limitation of aggregation size to 8K, otherwise, performance of traffic stream from STA to AP
+  *  will be much less than the traffic stream from AP to STA if both of the stream runs concurrently
+  *  at the same time.
+  *
+  *  Frame Format
+  *  Element ID		Length		OUI			Type1		Reserved
+  *  1 byte			1 byte		3 bytes		1 byte		1 byte
+  *
+  *  OUI 		= 0x00, 0xe0, 0x4c,
+  *  Type 	= 0x02
+  *  Reserved 	= 0x00
+  *
+  *  2007.8.21 by Emily
+*/
+/********************************************************************************************************************
+ *function:  Construct  Information Element in Beacon... in RT2RT condition
+ *   input:  struct ieee80211_device* 	ieee
+ *   	     u8* 			posRT2RTAgg //pointer to store Information Ele
+ *   	     u8*			len   //store len
+ *  output:  none
+ *  return:  none
+ *  notice:
+  * *****************************************************************************************************************/
+void HTConstructRT2RTAggElement(struct ieee80211_device* ieee, u8* posRT2RTAgg, u8* len)
+{
+	if (posRT2RTAgg == NULL) {
+		IEEE80211_DEBUG(IEEE80211_DL_ERR, "posRT2RTAgg can't be null in HTConstructRT2RTAggElement()\n");
+		return;
+	}
+	memset(posRT2RTAgg, 0, *len);
+	*posRT2RTAgg++ = 0x00;
+	*posRT2RTAgg++ = 0xe0;
+	*posRT2RTAgg++ = 0x4c;
+	*posRT2RTAgg++ = 0x02;
+	*posRT2RTAgg++ = 0x01;
+	*posRT2RTAgg = 0x10;//*posRT2RTAgg = 0x02;
+
+	if(ieee->bSupportRemoteWakeUp) {
+		*posRT2RTAgg |= 0x08;//RT_HT_CAP_USE_WOW;
+	}
+
+	*len = 6 + 2;
+	return;
+#ifdef TODO
+#if (HAL_CODE_BASE == RTL8192 && DEV_BUS_TYPE == USB_INTERFACE)
+	/*
+	//Emily. If it is required to Ask Realtek AP to send AMPDU during AES mode, enable this
+	   section of code.
+	if(IS_UNDER_11N_AES_MODE(Adapter))
+	{
+		posRT2RTAgg->Octet[5] |=RT_HT_CAP_USE_AMPDU;
+	}else
+	{
+		posRT2RTAgg->Octet[5] &= 0xfb;
+	}
+	*/
+
+#else
+	// Do Nothing
+#endif
+
+	posRT2RTAgg->Length = 6;
+#endif
+
+
+
+
+}
+
+
+/********************************************************************************************************************
+ *function:  Pick the right Rate Adaptive table to use
+ *   input:  struct ieee80211_device* 	ieee
+ *   	     u8* 			pOperateMCS //A pointer to MCS rate bitmap
+ *  return:  always we return true
+ *  notice:
+  * *****************************************************************************************************************/
+u8 HT_PickMCSRate(struct ieee80211_device* ieee, u8* pOperateMCS)
+{
+	u8					i;
+	if (pOperateMCS == NULL)
+	{
+		IEEE80211_DEBUG(IEEE80211_DL_ERR, "pOperateMCS can't be null in HT_PickMCSRate()\n");
+		return false;
+	}
+
+	switch(ieee->mode)
+	{
+	case IEEE_A:
+	case IEEE_B:
+	case IEEE_G:
+			//legacy rate routine handled at selectedrate
+
+			//no MCS rate
+			for(i=0;i<=15;i++){
+				pOperateMCS[i] = 0;
+			}
+			break;
+
+	case IEEE_N_24G:	//assume CCK rate ok
+	case IEEE_N_5G:
+			// Legacy part we only use 6, 5.5,2,1 for N_24G and 6 for N_5G.
+			// Legacy part shall be handled at SelectRateSet().
+
+			//HT part
+			// TODO: may be different if we have different number of antenna
+			pOperateMCS[0] &=RATE_ADPT_1SS_MASK;	//support MCS 0~7
+			pOperateMCS[1] &=RATE_ADPT_2SS_MASK;
+			pOperateMCS[3] &=RATE_ADPT_MCS32_MASK;
+			break;
+
+	//should never reach here
+	default:
+
+			break;
+
+	}
+
+	return true;
+}
+
+/*
+*	Description:
+*		This function will get the highest speed rate in input MCS set.
+*
+*	/param 	Adapter			Pionter to Adapter entity
+*			pMCSRateSet		Pointer to MCS rate bitmap
+*			pMCSFilter		Pointer to MCS rate filter
+*
+*	/return	Highest MCS rate included in pMCSRateSet and filtered by pMCSFilter.
+*
+*/
+/********************************************************************************************************************
+ *function:  This function will get the highest speed rate in input MCS set.
+ *   input:  struct ieee80211_device* 	ieee
+ *   	     u8* 			pMCSRateSet //Pointer to MCS rate bitmap
+ *   	     u8*			pMCSFilter //Pointer to MCS rate filter
+ *  return:  Highest MCS rate included in pMCSRateSet and filtered by pMCSFilter
+ *  notice:
+  * *****************************************************************************************************************/
+u8 HTGetHighestMCSRate(struct ieee80211_device* ieee, u8* pMCSRateSet, u8* pMCSFilter)
+{
+	u8		i, j;
+	u8		bitMap;
+	u8		mcsRate = 0;
+	u8		availableMcsRate[16];
+	if (pMCSRateSet == NULL || pMCSFilter == NULL)
+	{
+		IEEE80211_DEBUG(IEEE80211_DL_ERR, "pMCSRateSet or pMCSFilter can't be null in HTGetHighestMCSRate()\n");
+		return false;
+	}
+	for(i=0; i<16; i++)
+		availableMcsRate[i] = pMCSRateSet[i] & pMCSFilter[i];
+
+	for(i = 0; i < 16; i++)
+	{
+		if(availableMcsRate[i] != 0)
+			break;
+	}
+	if(i == 16)
+		return false;
+
+	for(i = 0; i < 16; i++)
+	{
+		if(availableMcsRate[i] != 0)
+		{
+			bitMap = availableMcsRate[i];
+			for(j = 0; j < 8; j++)
+			{
+				if((bitMap%2) != 0)
+				{
+					if(HTMcsToDataRate(ieee, (8*i+j)) > HTMcsToDataRate(ieee, mcsRate))
+						mcsRate = (8*i+j);
+				}
+				bitMap = bitMap>>1;
+			}
+		}
+	}
+	return (mcsRate|0x80);
+}
+
+
+
+/*
+**
+**1.Filter our operation rate set with AP's rate set
+**2.shall reference channel bandwidth, STBC, Antenna number
+**3.generate rate adative table for firmware
+**David 20060906
+**
+** \pHTSupportedCap: the connected STA's supported rate Capability element
+*/
+u8 HTFilterMCSRate( struct ieee80211_device* ieee, u8* pSupportMCS, u8* pOperateMCS)
+{
+
+	u8 i=0;
+
+	// filter out operational rate set not supported by AP, the lenth of it is 16
+	for(i=0;i<=15;i++){
+		pOperateMCS[i] = ieee->Regdot11HTOperationalRateSet[i]&pSupportMCS[i];
+	}
+
+
+	// TODO: adjust our operational rate set  according to our channel bandwidth, STBC and Antenna number
+
+	// TODO: fill suggested rate adaptive rate index and give firmware info using Tx command packet
+	// we also shall suggested the first start rate set according to our singal strength
+	HT_PickMCSRate(ieee, pOperateMCS);
+
+	// For RTL819X, if pairwisekey = wep/tkip, we support only MCS0~7.
+	if(ieee->GetHalfNmodeSupportByAPsHandler(ieee->dev))
+		pOperateMCS[1] = 0;
+
+	//
+	// For RTL819X, we support only MCS0~15.
+	// And also, we do not know how to use MCS32 now.
+	//
+	for(i=2; i<=15; i++)
+		pOperateMCS[i] = 0;
+
+	return true;
+}
+void HTSetConnectBwMode(struct ieee80211_device* ieee, HT_CHANNEL_WIDTH	Bandwidth, HT_EXTCHNL_OFFSET	Offset);
+void HTOnAssocRsp(struct ieee80211_device *ieee)
+{
+	PRT_HIGH_THROUGHPUT	pHTInfo = ieee->pHTInfo;
+	PHT_CAPABILITY_ELE		pPeerHTCap = NULL;
+	PHT_INFORMATION_ELE		pPeerHTInfo = NULL;
+	u16	nMaxAMSDUSize = 0;
+	u8*	pMcsFilter = NULL;
+
+	static u8				EWC11NHTCap[] = {0x00, 0x90, 0x4c, 0x33};		// For 11n EWC definition, 2007.07.17, by Emily
+	static u8				EWC11NHTInfo[] = {0x00, 0x90, 0x4c, 0x34};	// For 11n EWC definition, 2007.07.17, by Emily
+
+	if( pHTInfo->bCurrentHTSupport == false )
+	{
+		IEEE80211_DEBUG(IEEE80211_DL_ERR, "<=== HTOnAssocRsp(): HT_DISABLE\n");
+		return;
+	}
+	IEEE80211_DEBUG(IEEE80211_DL_HT, "===> HTOnAssocRsp_wq(): HT_ENABLE\n");
+//	IEEE80211_DEBUG_DATA(IEEE80211_DL_DATA, pHTInfo->PeerHTCapBuf, sizeof(HT_CAPABILITY_ELE));
+//	IEEE80211_DEBUG_DATA(IEEE80211_DL_DATA, pHTInfo->PeerHTInfoBuf, sizeof(HT_INFORMATION_ELE));
+
+//	HTDebugHTCapability(pHTInfo->PeerHTCapBuf,"HTOnAssocRsp_wq");
+//	HTDebugHTInfo(pHTInfo->PeerHTInfoBuf,"HTOnAssocRsp_wq");
+	//
+	if(!memcmp(pHTInfo->PeerHTCapBuf,EWC11NHTCap, sizeof(EWC11NHTCap)))
+		pPeerHTCap = (PHT_CAPABILITY_ELE)(&pHTInfo->PeerHTCapBuf[4]);
+	else
+		pPeerHTCap = (PHT_CAPABILITY_ELE)(pHTInfo->PeerHTCapBuf);
+
+	if(!memcmp(pHTInfo->PeerHTInfoBuf, EWC11NHTInfo, sizeof(EWC11NHTInfo)))
+		pPeerHTInfo = (PHT_INFORMATION_ELE)(&pHTInfo->PeerHTInfoBuf[4]);
+	else
+		pPeerHTInfo = (PHT_INFORMATION_ELE)(pHTInfo->PeerHTInfoBuf);
+
+
+	////////////////////////////////////////////////////////
+	// Configurations:
+	////////////////////////////////////////////////////////
+	IEEE80211_DEBUG_DATA(IEEE80211_DL_DATA|IEEE80211_DL_HT, pPeerHTCap, sizeof(HT_CAPABILITY_ELE));
+//	IEEE80211_DEBUG_DATA(IEEE80211_DL_DATA|IEEE80211_DL_HT, pPeerHTInfo, sizeof(HT_INFORMATION_ELE));
+	// Config Supported Channel Width setting
+	//
+	HTSetConnectBwMode(ieee, (HT_CHANNEL_WIDTH)(pPeerHTCap->ChlWidth), (HT_EXTCHNL_OFFSET)(pPeerHTInfo->ExtChlOffset));
+
+//	if(pHTInfo->bCurBW40MHz == true)
+		pHTInfo->bCurTxBW40MHz = ((pPeerHTInfo->RecommemdedTxWidth == 1)?true:false);
+
+	//
+	// Update short GI/ long GI setting
+	//
+	// TODO:
+	pHTInfo->bCurShortGI20MHz=
+		((pHTInfo->bRegShortGI20MHz)?((pPeerHTCap->ShortGI20Mhz==1)?true:false):false);
+	pHTInfo->bCurShortGI40MHz=
+		((pHTInfo->bRegShortGI40MHz)?((pPeerHTCap->ShortGI40Mhz==1)?true:false):false);
+
+	//
+	// Config TX STBC setting
+	//
+	// TODO:
+
+	//
+	// Config DSSS/CCK  mode in 40MHz mode
+	//
+	// TODO:
+	pHTInfo->bCurSuppCCK =
+		((pHTInfo->bRegSuppCCK)?((pPeerHTCap->DssCCk==1)?true:false):false);
+
+
+	//
+	// Config and configure A-MSDU setting
+	//
+	pHTInfo->bCurrent_AMSDU_Support = pHTInfo->bAMSDU_Support;
+
+	nMaxAMSDUSize = (pPeerHTCap->MaxAMSDUSize==0)?3839:7935;
+
+	if(pHTInfo->nAMSDU_MaxSize > nMaxAMSDUSize )
+		pHTInfo->nCurrent_AMSDU_MaxSize = nMaxAMSDUSize;
+	else
+		pHTInfo->nCurrent_AMSDU_MaxSize = pHTInfo->nAMSDU_MaxSize;
+
+
+	//
+	// Config A-MPDU setting
+	//
+	pHTInfo->bCurrentAMPDUEnable = pHTInfo->bAMPDUEnable;
+
+	// <1> Decide AMPDU Factor
+
+	// By Emily
+	if(!pHTInfo->bRegRT2RTAggregation)
+	{
+		// Decide AMPDU Factor according to protocol handshake
+		if(pHTInfo->AMPDU_Factor > pPeerHTCap->MaxRxAMPDUFactor)
+			pHTInfo->CurrentAMPDUFactor = pPeerHTCap->MaxRxAMPDUFactor;
+		else
+			pHTInfo->CurrentAMPDUFactor = pHTInfo->AMPDU_Factor;
+
+	}else
+	{
+		// Set MPDU density to 2 to Realtek AP, and set it to 0 for others
+		// Replace MPDU factor declared in original association response frame format. 2007.08.20 by Emily
+		if (ieee->current_network.bssht.bdRT2RTAggregation)
+		{
+			if( ieee->pairwise_key_type != KEY_TYPE_NA)
+				// Realtek may set 32k in security mode and 64k for others
+				pHTInfo->CurrentAMPDUFactor = pPeerHTCap->MaxRxAMPDUFactor;
+			else
+				pHTInfo->CurrentAMPDUFactor = HT_AGG_SIZE_64K;
+		}else
+		{
+			if(pPeerHTCap->MaxRxAMPDUFactor < HT_AGG_SIZE_32K)
+				pHTInfo->CurrentAMPDUFactor = pPeerHTCap->MaxRxAMPDUFactor;
+			else
+				pHTInfo->CurrentAMPDUFactor = HT_AGG_SIZE_32K;
+		}
+	}
+
+	// <2> Set AMPDU Minimum MPDU Start Spacing
+	// 802.11n 3.0 section 9.7d.3
+	if(pHTInfo->MPDU_Density > pPeerHTCap->MPDUDensity)
+		pHTInfo->CurrentMPDUDensity = pHTInfo->MPDU_Density;
+	else
+		pHTInfo->CurrentMPDUDensity = pPeerHTCap->MPDUDensity;
+	if(ieee->pairwise_key_type != KEY_TYPE_NA )
+		pHTInfo->CurrentMPDUDensity 	= 7; // 8us
+	// Force TX AMSDU
+
+	// Lanhsin: mark for tmp to avoid deauth by ap from  s3
+	//if(memcmp(pMgntInfo->Bssid, NETGEAR834Bv2_BROADCOM, 3)==0)
+	if(0)
+		{
+
+			pHTInfo->bCurrentAMPDUEnable = false;
+			pHTInfo->ForcedAMSDUMode = HT_AGG_FORCE_ENABLE;
+			pHTInfo->ForcedAMSDUMaxSize = 7935;
+
+		pHTInfo->IOTAction |=  HT_IOT_ACT_TX_USE_AMSDU_8K;
+	}
+
+	// Rx Reorder Setting
+	pHTInfo->bCurRxReorderEnable = pHTInfo->bRegRxReorderEnable;
+
+	//
+	// Filter out unsupported HT rate for this AP
+	// Update RATR table
+	// This is only for 8190 ,8192 or later product which using firmware to handle rate adaptive mechanism.
+	//
+
+	// Handle Ralink AP bad MCS rate set condition. Joseph.
+	// This fix the bug of Ralink AP. This may be removed in the future.
+	if(pPeerHTCap->MCS[0] == 0)
+		pPeerHTCap->MCS[0] = 0xff;
+
+	HTFilterMCSRate(ieee, pPeerHTCap->MCS, ieee->dot11HTOperationalRateSet);
+
+	//
+	// Config MIMO Power Save setting
+	//
+	pHTInfo->PeerMimoPs = pPeerHTCap->MimoPwrSave;
+	if(pHTInfo->PeerMimoPs == MIMO_PS_STATIC)
+		pMcsFilter = MCS_FILTER_1SS;
+	else
+		pMcsFilter = MCS_FILTER_ALL;
+	//WB add for MCS8 bug
+//	pMcsFilter = MCS_FILTER_1SS;
+	ieee->HTHighestOperaRate = HTGetHighestMCSRate(ieee, ieee->dot11HTOperationalRateSet, pMcsFilter);
+	ieee->HTCurrentOperaRate = ieee->HTHighestOperaRate;
+
+	//
+	// Config current operation mode.
+	//
+	pHTInfo->CurrentOpMode = pPeerHTInfo->OptMode;
+
+
+
+}
+
+void HTSetConnectBwModeCallback(struct ieee80211_device* ieee);
+/********************************************************************************************************************
+ *function:  initialize HT info(struct PRT_HIGH_THROUGHPUT)
+ *   input:  struct ieee80211_device* 	ieee
+ *  output:  none
+ *  return:  none
+ *  notice: This function is called when *  (1) MPInitialization Phase *  (2) Receiving of Deauthentication from AP
+********************************************************************************************************************/
+// TODO: Should this funciton be called when receiving of Disassociation?
+void HTInitializeHTInfo(struct ieee80211_device* ieee)
+{
+	PRT_HIGH_THROUGHPUT pHTInfo = ieee->pHTInfo;
+
+	//
+	// These parameters will be reset when receiving deauthentication packet
+	//
+	IEEE80211_DEBUG(IEEE80211_DL_HT, "===========>%s()\n", __FUNCTION__);
+	pHTInfo->bCurrentHTSupport = false;
+
+	// 40MHz channel support
+	pHTInfo->bCurBW40MHz = false;
+	pHTInfo->bCurTxBW40MHz = false;
+
+	// Short GI support
+	pHTInfo->bCurShortGI20MHz = false;
+	pHTInfo->bCurShortGI40MHz = false;
+	pHTInfo->bForcedShortGI = false;
+
+	// CCK rate support
+	// This flag is set to true to support CCK rate by default.
+	// It will be affected by "pHTInfo->bRegSuppCCK" and AP capabilities only when associate to
+	// 11N BSS.
+	pHTInfo->bCurSuppCCK = true;
+
+	// AMSDU related
+	pHTInfo->bCurrent_AMSDU_Support = false;
+	pHTInfo->nCurrent_AMSDU_MaxSize = pHTInfo->nAMSDU_MaxSize;
+
+	// AMPUD related
+	pHTInfo->CurrentMPDUDensity = pHTInfo->MPDU_Density;
+	pHTInfo->CurrentAMPDUFactor = pHTInfo->AMPDU_Factor;
+
+
+
+	// Initialize all of the parameters related to 11n
+	memset((void*)(&(pHTInfo->SelfHTCap)), 0, sizeof(pHTInfo->SelfHTCap));
+	memset((void*)(&(pHTInfo->SelfHTInfo)), 0, sizeof(pHTInfo->SelfHTInfo));
+	memset((void*)(&(pHTInfo->PeerHTCapBuf)), 0, sizeof(pHTInfo->PeerHTCapBuf));
+	memset((void*)(&(pHTInfo->PeerHTInfoBuf)), 0, sizeof(pHTInfo->PeerHTInfoBuf));
+
+	pHTInfo->bSwBwInProgress = false;
+	pHTInfo->ChnlOp = CHNLOP_NONE;
+
+	// Set default IEEE spec for Draft N
+	pHTInfo->ePeerHTSpecVer = HT_SPEC_VER_IEEE;
+
+	// Realtek proprietary aggregation mode
+	pHTInfo->bCurrentRT2RTAggregation = false;
+	pHTInfo->bCurrentRT2RTLongSlotTime = false;
+	pHTInfo->IOTPeer = 0;
+	pHTInfo->IOTAction = 0;
+
+	//MCS rate initialized here
+	{
+		u8* RegHTSuppRateSets = &(ieee->RegHTSuppRateSet[0]);
+		RegHTSuppRateSets[0] = 0xFF;	//support MCS 0~7
+		RegHTSuppRateSets[1] = 0xFF;	//support MCS 8~15
+		RegHTSuppRateSets[4] = 0x01;	//support MCS 32
+	}
+}
+/********************************************************************************************************************
+ *function:  initialize Bss HT structure(struct PBSS_HT)
+ *   input:  PBSS_HT pBssHT //to be initialized
+ *  output:  none
+ *  return:  none
+ *  notice: This function is called when initialize network structure
+********************************************************************************************************************/
+void HTInitializeBssDesc(PBSS_HT pBssHT)
+{
+
+	pBssHT->bdSupportHT = false;
+	memset(pBssHT->bdHTCapBuf, 0, sizeof(pBssHT->bdHTCapBuf));
+	pBssHT->bdHTCapLen = 0;
+	memset(pBssHT->bdHTInfoBuf, 0, sizeof(pBssHT->bdHTInfoBuf));
+	pBssHT->bdHTInfoLen = 0;
+
+	pBssHT->bdHTSpecVer= HT_SPEC_VER_IEEE;
+
+	pBssHT->bdRT2RTAggregation = false;
+	pBssHT->bdRT2RTLongSlotTime = false;
+}
+/********************************************************************************************************************
+ *function:  initialize Bss HT structure(struct PBSS_HT)
+ *   input:  struct ieee80211_device 	*ieee
+ *   	     struct ieee80211_network 	*pNetwork //usually current network we are live in
+ *  output:  none
+ *  return:  none
+ *  notice: This function should ONLY be called before association
+********************************************************************************************************************/
+void HTResetSelfAndSavePeerSetting(struct ieee80211_device* ieee, 	struct ieee80211_network * pNetwork)
+{
+	PRT_HIGH_THROUGHPUT		pHTInfo = ieee->pHTInfo;
+//	u16						nMaxAMSDUSize;
+//	PHT_CAPABILITY_ELE		pPeerHTCap = (PHT_CAPABILITY_ELE)pNetwork->bssht.bdHTCapBuf;
+//	PHT_INFORMATION_ELE		pPeerHTInfo = (PHT_INFORMATION_ELE)pNetwork->bssht.bdHTInfoBuf;
+//	u8*	pMcsFilter;
+	u8	bIOTAction = 0;
+
+	//
+	//  Save Peer Setting before Association
+	//
+	IEEE80211_DEBUG(IEEE80211_DL_HT, "==============>%s()\n", __FUNCTION__);
+	/*unmark bEnableHT flag here is the same reason why unmarked in function ieee80211_softmac_new_net. WB 2008.09.10*/
+//	if( pHTInfo->bEnableHT &&  pNetwork->bssht.bdSupportHT)
+	if (pNetwork->bssht.bdSupportHT)
+	{
+		pHTInfo->bCurrentHTSupport = true;
+		pHTInfo->ePeerHTSpecVer = pNetwork->bssht.bdHTSpecVer;
+
+		// Save HTCap and HTInfo information Element
+		if(pNetwork->bssht.bdHTCapLen > 0 && 	pNetwork->bssht.bdHTCapLen <= sizeof(pHTInfo->PeerHTCapBuf))
+			memcpy(pHTInfo->PeerHTCapBuf, pNetwork->bssht.bdHTCapBuf, pNetwork->bssht.bdHTCapLen);
+
+		if(pNetwork->bssht.bdHTInfoLen > 0 && pNetwork->bssht.bdHTInfoLen <= sizeof(pHTInfo->PeerHTInfoBuf))
+			memcpy(pHTInfo->PeerHTInfoBuf, pNetwork->bssht.bdHTInfoBuf, pNetwork->bssht.bdHTInfoLen);
+
+		// Check whether RT to RT aggregation mode is enabled
+		if(pHTInfo->bRegRT2RTAggregation)
+		{
+			pHTInfo->bCurrentRT2RTAggregation = pNetwork->bssht.bdRT2RTAggregation;
+			pHTInfo->bCurrentRT2RTLongSlotTime = pNetwork->bssht.bdRT2RTLongSlotTime;
+		}
+		else
+		{
+			pHTInfo->bCurrentRT2RTAggregation = false;
+			pHTInfo->bCurrentRT2RTLongSlotTime = false;
+		}
+
+		// Determine the IOT Peer Vendor.
+		HTIOTPeerDetermine(ieee);
+
+		// Decide IOT Action
+		// Must be called after the parameter of pHTInfo->bCurrentRT2RTAggregation is decided
+		pHTInfo->IOTAction = 0;
+		bIOTAction = HTIOTActIsDisableMCS14(ieee, pNetwork->bssid);
+		if(bIOTAction)
+			pHTInfo->IOTAction |= HT_IOT_ACT_DISABLE_MCS14;
+
+		bIOTAction = HTIOTActIsDisableMCS15(ieee);
+		if(bIOTAction)
+			pHTInfo->IOTAction |= HT_IOT_ACT_DISABLE_MCS15;
+
+		bIOTAction = HTIOTActIsDisableMCSTwoSpatialStream(ieee, pNetwork->bssid);
+		if(bIOTAction)
+			pHTInfo->IOTAction |= HT_IOT_ACT_DISABLE_ALL_2SS;
+
+
+		bIOTAction = HTIOTActIsDisableEDCATurbo(ieee, pNetwork->bssid);
+		if(bIOTAction)
+			pHTInfo->IOTAction |= HT_IOT_ACT_DISABLE_EDCA_TURBO;
+
+		bIOTAction = HTIOTActIsMgntUseCCK6M(pNetwork);
+		if(bIOTAction)
+			pHTInfo->IOTAction |= HT_IOT_ACT_MGNT_USE_CCK_6M;
+
+		bIOTAction = HTIOTActIsCCDFsync(pNetwork->bssid);
+		if(bIOTAction)
+			pHTInfo->IOTAction |= HT_IOT_ACT_CDD_FSYNC;
+
+
+	}
+	else
+	{
+		pHTInfo->bCurrentHTSupport = false;
+		pHTInfo->bCurrentRT2RTAggregation = false;
+		pHTInfo->bCurrentRT2RTLongSlotTime = false;
+
+		pHTInfo->IOTAction = 0;
+	}
+
+}
+
+void HTUpdateSelfAndPeerSetting(struct ieee80211_device* ieee, 	struct ieee80211_network * pNetwork)
+{
+	PRT_HIGH_THROUGHPUT	pHTInfo = ieee->pHTInfo;
+//	PHT_CAPABILITY_ELE		pPeerHTCap = (PHT_CAPABILITY_ELE)pNetwork->bssht.bdHTCapBuf;
+	PHT_INFORMATION_ELE		pPeerHTInfo = (PHT_INFORMATION_ELE)pNetwork->bssht.bdHTInfoBuf;
+
+	if(pHTInfo->bCurrentHTSupport)
+	{
+		//
+		// Config current operation mode.
+		//
+		if(pNetwork->bssht.bdHTInfoLen != 0)
+			pHTInfo->CurrentOpMode = pPeerHTInfo->OptMode;
+
+		//
+		// <TODO: Config according to OBSS non-HT STA present!!>
+		//
+	}
+}
+
+void HTUseDefaultSetting(struct ieee80211_device* ieee)
+{
+	PRT_HIGH_THROUGHPUT pHTInfo = ieee->pHTInfo;
+//	u8	regBwOpMode;
+
+	if(pHTInfo->bEnableHT)
+	{
+		pHTInfo->bCurrentHTSupport = true;
+
+		pHTInfo->bCurSuppCCK = pHTInfo->bRegSuppCCK;
+
+		pHTInfo->bCurBW40MHz = pHTInfo->bRegBW40MHz;
+
+		pHTInfo->bCurShortGI20MHz= pHTInfo->bRegShortGI20MHz;
+
+		pHTInfo->bCurShortGI40MHz= pHTInfo->bRegShortGI40MHz;
+
+		pHTInfo->bCurrent_AMSDU_Support = pHTInfo->bAMSDU_Support;
+
+		pHTInfo->nCurrent_AMSDU_MaxSize = pHTInfo->nAMSDU_MaxSize;
+
+		pHTInfo->bCurrentAMPDUEnable = pHTInfo->bAMPDUEnable;
+
+		pHTInfo->CurrentAMPDUFactor = pHTInfo->AMPDU_Factor;
+
+		pHTInfo->CurrentMPDUDensity = pHTInfo->CurrentMPDUDensity;
+
+		// Set BWOpMode register
+
+		//update RATR index0
+		HTFilterMCSRate(ieee, ieee->Regdot11HTOperationalRateSet, ieee->dot11HTOperationalRateSet);
+	//function below is not implemented at all. WB
+#ifdef TODO
+		Adapter->HalFunc.InitHalRATRTableHandler( Adapter, &pMgntInfo->dot11OperationalRateSet, pMgntInfo->dot11HTOperationalRateSet);
+#endif
+		ieee->HTHighestOperaRate = HTGetHighestMCSRate(ieee, ieee->dot11HTOperationalRateSet, MCS_FILTER_ALL);
+		ieee->HTCurrentOperaRate = ieee->HTHighestOperaRate;
+
+	}
+	else
+	{
+		pHTInfo->bCurrentHTSupport = false;
+	}
+	return;
+}
+/********************************************************************************************************************
+ *function:  check whether HT control field exists
+ *   input:  struct ieee80211_device 	*ieee
+ *   	     u8*			pFrame //coming skb->data
+ *  output:  none
+ *  return:  return true if HT control field exists(false otherwise)
+ *  notice:
+********************************************************************************************************************/
+u8 HTCCheck(struct ieee80211_device* ieee, u8*	pFrame)
+{
+	if(ieee->pHTInfo->bCurrentHTSupport)
+	{
+		if( (IsQoSDataFrame(pFrame) && Frame_Order(pFrame)) == 1)
+		{
+			IEEE80211_DEBUG(IEEE80211_DL_HT, "HT CONTROL FILED EXIST!!\n");
+			return true;
+		}
+	}
+	return false;
+}
+
+//
+// This function set bandwidth mode in protocol layer.
+//
+void HTSetConnectBwMode(struct ieee80211_device* ieee, HT_CHANNEL_WIDTH	Bandwidth, HT_EXTCHNL_OFFSET	Offset)
+{
+	PRT_HIGH_THROUGHPUT pHTInfo = ieee->pHTInfo;
+//	u32 flags = 0;
+
+	if(pHTInfo->bRegBW40MHz == false)
+		return;
+
+
+
+	// To reduce dummy operation
+//	if((pHTInfo->bCurBW40MHz==false && Bandwidth==HT_CHANNEL_WIDTH_20) ||
+//	   (pHTInfo->bCurBW40MHz==true && Bandwidth==HT_CHANNEL_WIDTH_20_40 && Offset==pHTInfo->CurSTAExtChnlOffset))
+//		return;
+
+//	spin_lock_irqsave(&(ieee->bw_spinlock), flags);
+	if(pHTInfo->bSwBwInProgress) {
+//		spin_unlock_irqrestore(&(ieee->bw_spinlock), flags);
+		return;
+	}
+	//if in half N mode, set to 20M bandwidth please 09.08.2008 WB.
+	if(Bandwidth==HT_CHANNEL_WIDTH_20_40 && (!ieee->GetHalfNmodeSupportByAPsHandler(ieee->dev)))
+	 {
+			// Handle Illegal extention channel offset!!
+		if(ieee->current_network.channel<2 && Offset==HT_EXTCHNL_OFFSET_LOWER)
+			Offset = HT_EXTCHNL_OFFSET_NO_EXT;
+		if(Offset==HT_EXTCHNL_OFFSET_UPPER || Offset==HT_EXTCHNL_OFFSET_LOWER) {
+			pHTInfo->bCurBW40MHz = true;
+			pHTInfo->CurSTAExtChnlOffset = Offset;
+		} else {
+			pHTInfo->bCurBW40MHz = false;
+			pHTInfo->CurSTAExtChnlOffset = HT_EXTCHNL_OFFSET_NO_EXT;
+		}
+	} else {
+		pHTInfo->bCurBW40MHz = false;
+		pHTInfo->CurSTAExtChnlOffset = HT_EXTCHNL_OFFSET_NO_EXT;
+	}
+
+	pHTInfo->bSwBwInProgress = true;
+
+	// TODO: 2007.7.13 by Emily Wait 2000ms  in order to garantee that switching
+	//   bandwidth is executed after scan is finished. It is a temporal solution
+	//   because software should ganrantee the last operation of switching bandwidth
+	//   is executed properlly.
+	HTSetConnectBwModeCallback(ieee);
+
+//	spin_unlock_irqrestore(&(ieee->bw_spinlock), flags);
+}
+
+void HTSetConnectBwModeCallback(struct ieee80211_device* ieee)
+{
+	PRT_HIGH_THROUGHPUT pHTInfo = ieee->pHTInfo;
+
+	IEEE80211_DEBUG(IEEE80211_DL_HT, "======>%s()\n", __FUNCTION__);
+
+	if(pHTInfo->bCurBW40MHz)
+	{
+		if(pHTInfo->CurSTAExtChnlOffset==HT_EXTCHNL_OFFSET_UPPER)
+			ieee->set_chan(ieee->dev, ieee->current_network.channel+2);
+		else if(pHTInfo->CurSTAExtChnlOffset==HT_EXTCHNL_OFFSET_LOWER)
+			ieee->set_chan(ieee->dev, ieee->current_network.channel-2);
+		else
+			ieee->set_chan(ieee->dev, ieee->current_network.channel);
+
+		ieee->SetBWModeHandler(ieee->dev, HT_CHANNEL_WIDTH_20_40, pHTInfo->CurSTAExtChnlOffset);
+	} else {
+		ieee->set_chan(ieee->dev, ieee->current_network.channel);
+		ieee->SetBWModeHandler(ieee->dev, HT_CHANNEL_WIDTH_20, HT_EXTCHNL_OFFSET_NO_EXT);
+	}
+
+	pHTInfo->bSwBwInProgress = false;
+}
+
+EXPORT_SYMBOL(HTUpdateSelfAndPeerSetting);
diff --git a/drivers/staging/rtl8192u/ieee80211/rtl819x_Qos.h b/drivers/staging/rtl8192u/ieee80211/rtl819x_Qos.h
new file mode 100644
index 000000000000..13b1e5ca436d
--- /dev/null
+++ b/drivers/staging/rtl8192u/ieee80211/rtl819x_Qos.h
@@ -0,0 +1,583 @@
+#ifndef __INC_QOS_TYPE_H
+#define __INC_QOS_TYPE_H
+
+//#include "EndianFree.h"
+#define BIT0                    0x00000001
+#define BIT1                    0x00000002
+#define BIT2                    0x00000004
+#define BIT3                    0x00000008
+#define BIT4                    0x00000010
+#define BIT5                    0x00000020
+#define BIT6                    0x00000040
+#define BIT7                    0x00000080
+#define BIT8                    0x00000100
+#define BIT9                    0x00000200
+#define BIT10                   0x00000400
+#define BIT11                   0x00000800
+#define BIT12                   0x00001000
+#define BIT13                   0x00002000
+#define BIT14                   0x00004000
+#define BIT15                   0x00008000
+#define BIT16                   0x00010000
+#define BIT17                   0x00020000
+#define BIT18                   0x00040000
+#define BIT19                   0x00080000
+#define BIT20                   0x00100000
+#define BIT21                   0x00200000
+#define BIT22                   0x00400000
+#define BIT23                   0x00800000
+#define BIT24                   0x01000000
+#define BIT25                   0x02000000
+#define BIT26                   0x04000000
+#define BIT27                   0x08000000
+#define BIT28                   0x10000000
+#define BIT29                   0x20000000
+#define BIT30                   0x40000000
+#define BIT31                   0x80000000
+
+#define	MAX_WMMELE_LENGTH	64
+
+//
+// QoS mode.
+// enum 0, 1, 2, 4: since we can use the OR(|) operation.
+//
+// QOS_MODE is redefined for enum can't be ++, | under C++ compiler, 2006.05.17, by rcnjko.
+//typedef	enum _QOS_MODE{
+//	QOS_DISABLE		= 0,
+//	QOS_WMM			= 1,
+//	QOS_EDCA			= 2,
+//	QOS_HCCA			= 4,
+//}QOS_MODE,*PQOS_MODE;
+//
+typedef u32 QOS_MODE, *PQOS_MODE;
+#define QOS_DISABLE		0
+#define QOS_WMM			1
+#define QOS_WMMSA		2
+#define QOS_EDCA		4
+#define QOS_HCCA		8
+#define QOS_WMM_UAPSD		16   //WMM Power Save, 2006-06-14 Isaiah
+
+#define AC_PARAM_SIZE	4
+#define WMM_PARAM_ELE_BODY_LEN	18
+
+//
+// QoS ACK Policy Field Values
+// Ref: WMM spec 2.1.6: QoS Control Field, p.10.
+//
+typedef	enum _ACK_POLICY{
+	eAckPlc0_ACK		= 0x00,
+	eAckPlc1_NoACK		= 0x01,
+}ACK_POLICY,*PACK_POLICY;
+
+#define WMM_PARAM_ELEMENT_SIZE	(8+(4*AC_PARAM_SIZE))
+
+//
+// QoS Control Field
+// Ref:
+//	1. WMM spec 2.1.6: QoS Control Field, p.9.
+//	2. 802.11e/D13.0 7.1.3.5, p.26.
+//
+typedef	union _QOS_CTRL_FIELD{
+	u8	charData[2];
+	u16	shortData;
+
+	// WMM spec
+	struct
+	{
+		u8		UP:3;
+		u8		usRsvd1:1;
+		u8		EOSP:1;
+		u8		AckPolicy:2;
+		u8		usRsvd2:1;
+		u8		ucRsvdByte;
+	}WMM;
+
+	// 802.11e: QoS data type frame sent by non-AP QSTAs.
+	struct
+	{
+		u8		TID:4;
+		u8		bIsQsize:1;// 0: BIT[8:15] is TXOP Duration Requested, 1: BIT[8:15] is Queue Size.
+		u8		AckPolicy:2;
+		u8		usRsvd:1;
+		u8		TxopOrQsize;	// (BIT4=0)TXOP Duration Requested or (BIT4=1)Queue Size.
+	}BySta;
+
+	// 802.11e: QoS data, QoS Null, and QoS Data+CF-Ack frames sent by HC.
+	struct
+	{
+		u8		TID:4;
+		u8		EOSP:1;
+		u8		AckPolicy:2;
+		u8		usRsvd:1;
+		u8		PSBufState;		// QAP PS Buffer State.
+	}ByHc_Data;
+
+	// 802.11e: QoS (+) CF-Poll frames sent by HC.
+	struct
+	{
+		u8		TID:4;
+		u8		EOSP:1;
+		u8		AckPolicy:2;
+		u8		usRsvd:1;
+		u8		TxopLimit;		// TXOP Limit.
+	}ByHc_CFP;
+
+}QOS_CTRL_FIELD, *PQOS_CTRL_FIELD;
+
+
+//
+// QoS Info Field
+// Ref:
+//	1. WMM spec 2.2.1: WME Information Element, p.11.
+//	2. 8185 QoS code: QOS_INFO [def. in QoS_mp.h]
+//
+typedef	union _QOS_INFO_FIELD{
+	u8	charData;
+
+	struct
+	{
+		u8		ucParameterSetCount:4;
+		u8		ucReserved:4;
+	}WMM;
+
+	struct
+	{
+		//Ref WMM_Specification_1-1.pdf, 2006-06-13 Isaiah
+		u8		ucAC_VO_UAPSD:1;
+		u8		ucAC_VI_UAPSD:1;
+		u8		ucAC_BE_UAPSD:1;
+		u8		ucAC_BK_UAPSD:1;
+		u8		ucReserved1:1;
+		u8		ucMaxSPLen:2;
+		u8		ucReserved2:1;
+
+	}ByWmmPsSta;
+
+	struct
+	{
+		//Ref WMM_Specification_1-1.pdf, 2006-06-13 Isaiah
+		u8		ucParameterSetCount:4;
+		u8		ucReserved:3;
+		u8		ucApUapsd:1;
+	}ByWmmPsAp;
+
+	struct
+	{
+		u8		ucAC3_UAPSD:1;
+		u8		ucAC2_UAPSD:1;
+		u8		ucAC1_UAPSD:1;
+		u8		ucAC0_UAPSD:1;
+		u8		ucQAck:1;
+		u8		ucMaxSPLen:2;
+		u8		ucMoreDataAck:1;
+	} By11eSta;
+
+	struct
+	{
+		u8		ucParameterSetCount:4;
+		u8		ucQAck:1;
+		u8		ucQueueReq:1;
+		u8		ucTXOPReq:1;
+		u8		ucReserved:1;
+	} By11eAp;
+
+	struct
+	{
+		u8		ucReserved1:4;
+		u8		ucQAck:1;
+		u8		ucReserved2:2;
+		u8		ucMoreDataAck:1;
+	} ByWmmsaSta;
+
+	struct
+	{
+		u8		ucReserved1:4;
+		u8		ucQAck:1;
+		u8		ucQueueReq:1;
+		u8		ucTXOPReq:1;
+		u8		ucReserved2:1;
+	} ByWmmsaAp;
+
+	struct
+	{
+		u8		ucAC3_UAPSD:1;
+		u8		ucAC2_UAPSD:1;
+		u8		ucAC1_UAPSD:1;
+		u8		ucAC0_UAPSD:1;
+		u8		ucQAck:1;
+		u8		ucMaxSPLen:2;
+		u8		ucMoreDataAck:1;
+	} ByAllSta;
+
+	struct
+	{
+		u8		ucParameterSetCount:4;
+		u8		ucQAck:1;
+		u8		ucQueueReq:1;
+		u8		ucTXOPReq:1;
+		u8		ucApUapsd:1;
+	} ByAllAp;
+
+}QOS_INFO_FIELD, *PQOS_INFO_FIELD;
+
+
+//
+// ACI to AC coding.
+// Ref: WMM spec 2.2.2: WME Parameter Element, p.13.
+//
+// AC_CODING is redefined for enum can't be ++, | under C++ compiler, 2006.05.17, by rcnjko.
+//typedef	enum _AC_CODING{
+//	AC0_BE	= 0,		// ACI: 0x00	// Best Effort
+//	AC1_BK	= 1,		// ACI: 0x01	// Background
+//	AC2_VI	= 2,		// ACI: 0x10	// Video
+//	AC3_VO	= 3,		// ACI: 0x11	// Voice
+//	AC_MAX = 4,		// Max: define total number; Should not to be used as a real enum.
+//}AC_CODING,*PAC_CODING;
+//
+typedef u32 AC_CODING;
+#define AC0_BE	0		// ACI: 0x00	// Best Effort
+#define AC1_BK	1		// ACI: 0x01	// Background
+#define AC2_VI	2		// ACI: 0x10	// Video
+#define AC3_VO	3		// ACI: 0x11	// Voice
+#define AC_MAX	4		// Max: define total number; Should not to be used as a real enum.
+
+//
+// ACI/AIFSN Field.
+// Ref: WMM spec 2.2.2: WME Parameter Element, p.12.
+//
+typedef	union _ACI_AIFSN{
+	u8	charData;
+
+	struct
+	{
+		u8	AIFSN:4;
+		u8	ACM:1;
+		u8	ACI:2;
+		u8	Reserved:1;
+	}f;	// Field
+}ACI_AIFSN, *PACI_AIFSN;
+
+//
+// ECWmin/ECWmax field.
+// Ref: WMM spec 2.2.2: WME Parameter Element, p.13.
+//
+typedef	union _ECW{
+	u8	charData;
+	struct
+	{
+		u8	ECWmin:4;
+		u8	ECWmax:4;
+	}f;	// Field
+}ECW, *PECW;
+
+//
+// AC Parameters Record Format.
+// Ref: WMM spec 2.2.2: WME Parameter Element, p.12.
+//
+typedef	union _AC_PARAM{
+	u32	longData;
+	u8	charData[4];
+
+	struct
+	{
+		ACI_AIFSN	AciAifsn;
+		ECW		Ecw;
+		u16		TXOPLimit;
+	}f;	// Field
+}AC_PARAM, *PAC_PARAM;
+
+
+
+//
+// QoS element subtype
+//
+typedef	enum _QOS_ELE_SUBTYPE{
+	QOSELE_TYPE_INFO	= 0x00,		// 0x00: Information element
+	QOSELE_TYPE_PARAM	= 0x01,		// 0x01: parameter element
+}QOS_ELE_SUBTYPE,*PQOS_ELE_SUBTYPE;
+
+
+//
+// Direction Field Values.
+// Ref: WMM spec 2.2.11: WME TSPEC Element, p.18.
+//
+typedef	enum _DIRECTION_VALUE{
+	DIR_UP			= 0,		// 0x00	// UpLink
+	DIR_DOWN		= 1,		// 0x01	// DownLink
+	DIR_DIRECT		= 2,		// 0x10	// DirectLink
+	DIR_BI_DIR		= 3,		// 0x11	// Bi-Direction
+}DIRECTION_VALUE,*PDIRECTION_VALUE;
+
+
+//
+// TS Info field in WMM TSPEC Element.
+// Ref:
+//	1. WMM spec 2.2.11: WME TSPEC Element, p.18.
+//	2. 8185 QoS code: QOS_TSINFO [def. in QoS_mp.h]
+//
+typedef union _QOS_TSINFO{
+	u8		charData[3];
+	struct {
+		u8		ucTrafficType:1;			//WMM is reserved
+		u8		ucTSID:4;
+		u8		ucDirection:2;
+		u8		ucAccessPolicy:2;	//WMM: bit8=0, bit7=1
+		u8		ucAggregation:1;		//WMM is reserved
+		u8		ucPSB:1;				//WMMSA is APSD
+		u8		ucUP:3;
+		u8		ucTSInfoAckPolicy:2;		//WMM is reserved
+		u8		ucSchedule:1;			//WMM is reserved
+		u8		ucReserved:7;
+	}field;
+}QOS_TSINFO, *PQOS_TSINFO;
+
+//
+// WMM TSPEC Body.
+// Ref: WMM spec 2.2.11: WME TSPEC Element, p.16.
+//
+typedef union _TSPEC_BODY{
+	u8		charData[55];
+
+	struct
+	{
+		QOS_TSINFO	TSInfo;	//u8	TSInfo[3];
+		u16	NominalMSDUsize;
+		u16	MaxMSDUsize;
+		u32	MinServiceItv;
+		u32	MaxServiceItv;
+		u32	InactivityItv;
+		u32	SuspenItv;
+		u32	ServiceStartTime;
+		u32	MinDataRate;
+		u32	MeanDataRate;
+		u32	PeakDataRate;
+		u32	MaxBurstSize;
+		u32	DelayBound;
+		u32	MinPhyRate;
+		u16	SurplusBandwidthAllowance;
+		u16	MediumTime;
+	} f;	// Field
+}TSPEC_BODY, *PTSPEC_BODY;
+
+
+//
+// WMM TSPEC Element.
+// Ref: WMM spec 2.2.11: WME TSPEC Element, p.16.
+//
+typedef struct _WMM_TSPEC{
+	u8		ID;
+	u8		Length;
+	u8		OUI[3];
+	u8		OUI_Type;
+	u8		OUI_SubType;
+	u8		Version;
+	TSPEC_BODY	Body;
+} WMM_TSPEC, *PWMM_TSPEC;
+
+//
+// ACM implementation method.
+// Annie, 2005-12-13.
+//
+typedef	enum _ACM_METHOD{
+	eAcmWay0_SwAndHw		= 0,		// By SW and HW.
+	eAcmWay1_HW			= 1,		// By HW.
+	eAcmWay2_SW			= 2,		// By SW.
+}ACM_METHOD,*PACM_METHOD;
+
+
+typedef struct _ACM{
+//	u8		RegEnableACM;
+	u64		UsedTime;
+	u64		MediumTime;
+	u8		HwAcmCtl;	// TRUE: UsedTime exceed => Do NOT USE this AC. It wll be written to ACM_CONTROL(0xBF BIT 0/1/2 in 8185B).
+}ACM, *PACM;
+
+typedef	u8		AC_UAPSD, *PAC_UAPSD;
+
+#define	GET_VO_UAPSD(_apsd) ((_apsd) & BIT0)
+#define	SET_VO_UAPSD(_apsd) ((_apsd) |= BIT0)
+
+#define	GET_VI_UAPSD(_apsd) ((_apsd) & BIT1)
+#define	SET_VI_UAPSD(_apsd) ((_apsd) |= BIT1)
+
+#define	GET_BK_UAPSD(_apsd) ((_apsd) & BIT2)
+#define	SET_BK_UAPSD(_apsd) ((_apsd) |= BIT2)
+
+#define	GET_BE_UAPSD(_apsd) ((_apsd) & BIT3)
+#define	SET_BE_UAPSD(_apsd) ((_apsd) |= BIT3)
+
+
+//typedef struct _TCLASS{
+// TODO
+//} TCLASS, *PTCLASS;
+typedef union _QOS_TCLAS{
+
+	struct _TYPE_GENERAL{
+		u8		Priority;
+		u8 		ClassifierType;
+		u8 		Mask;
+	} TYPE_GENERAL;
+
+	struct _TYPE0_ETH{
+		u8		Priority;
+		u8 		ClassifierType;
+		u8 		Mask;
+		u8		SrcAddr[6];
+		u8		DstAddr[6];
+		u16		Type;
+	} TYPE0_ETH;
+
+	struct _TYPE1_IPV4{
+		u8		Priority;
+		u8 		ClassifierType;
+		u8 		Mask;
+		u8 		Version;
+		u8		SrcIP[4];
+		u8		DstIP[4];
+		u16		SrcPort;
+		u16		DstPort;
+		u8		DSCP;
+		u8		Protocol;
+		u8		Reserved;
+	} TYPE1_IPV4;
+
+	struct _TYPE1_IPV6{
+		u8		Priority;
+		u8 		ClassifierType;
+		u8 		Mask;
+		u8 		Version;
+		u8		SrcIP[16];
+		u8		DstIP[16];
+		u16		SrcPort;
+		u16		DstPort;
+		u8		FlowLabel[3];
+	} TYPE1_IPV6;
+
+	struct _TYPE2_8021Q{
+		u8		Priority;
+		u8 		ClassifierType;
+		u8 		Mask;
+		u16		TagType;
+	} TYPE2_8021Q;
+} QOS_TCLAS, *PQOS_TCLAS;
+
+//typedef struct _WMM_TSTREAM{
+//
+//- TSPEC
+//- AC (which to mapping)
+//} WMM_TSTREAM, *PWMM_TSTREAM;
+typedef struct _QOS_TSTREAM{
+	u8			AC;
+	WMM_TSPEC		TSpec;
+	QOS_TCLAS		TClass;
+} QOS_TSTREAM, *PQOS_TSTREAM;
+
+//typedef struct _U_APSD{
+//- TriggerEnable [4]
+//- MaxSPLength
+//- HighestAcBuffered
+//} U_APSD, *PU_APSD;
+
+//joseph TODO:
+//	UAPSD function should be implemented by 2 data structure
+//	"Qos control field" and "Qos info field"
+//typedef struct _QOS_UAPSD{
+//	u8			bTriggerEnable[4];
+//	u8 			MaxSPLength;
+//	u8			HighestBufAC;
+//} QOS_UAPSD, *PQOS_APSD;
+
+//----------------------------------------------------------------------------
+//      802.11 Management frame Status Code field
+//----------------------------------------------------------------------------
+typedef struct _OCTET_STRING{
+	u8        	*Octet;
+	u16             Length;
+}OCTET_STRING, *POCTET_STRING;
+//
+// STA QoS data.
+// Ref: DOT11_QOS in 8185 code. [def. in QoS_mp.h]
+//
+typedef struct _STA_QOS{
+	//DECLARE_RT_OBJECT(STA_QOS);
+	u8				WMMIEBuf[MAX_WMMELE_LENGTH];
+	u8*				WMMIE;
+
+	// Part 1. Self QoS Mode.
+	QOS_MODE			QosCapability; //QoS Capability, 2006-06-14 Isaiah
+	QOS_MODE			CurrentQosMode;
+
+	// For WMM Power Save Mode :
+	// ACs are trigger/delivery enabled or legacy power save enabled. 2006-06-13 Isaiah
+	AC_UAPSD			b4ac_Uapsd;  //VoUapsd(bit0), ViUapsd(bit1),  BkUapsd(bit2), BeUapsd(bit3),
+	AC_UAPSD			Curr4acUapsd;
+	u8				bInServicePeriod;
+	u8				MaxSPLength;
+	int 				NumBcnBeforeTrigger;
+
+	// Part 2. EDCA Parameter (perAC)
+	u8 *				pWMMInfoEle;
+	u8				WMMParamEle[WMM_PARAM_ELEMENT_SIZE];
+	u8				WMMPELength;
+
+	// <Bruce_Note>
+	//2 ToDo: remove the Qos Info Field and replace it by the above WMM Info element.
+	// By Bruce, 2008-01-30.
+	// Part 2. EDCA Parameter (perAC)
+	QOS_INFO_FIELD			QosInfoField_STA; 	// Maintained by STA
+	QOS_INFO_FIELD			QosInfoField_AP;	// Retrieved from AP
+
+	AC_PARAM			CurAcParameters[4];
+
+	// Part 3. ACM
+	ACM				acm[4];
+	ACM_METHOD			AcmMethod;
+
+	// Part 4. Per TID (Part 5: TCLASS will be described by TStream)
+	QOS_TSTREAM			TStream[16];
+	WMM_TSPEC			TSpec;
+
+	u32				QBssWirelessMode;
+
+	// No Ack Setting
+	u8				bNoAck;
+
+	// Enable/Disable Rx immediate BA capability.
+	u8				bEnableRxImmBA;
+
+}STA_QOS, *PSTA_QOS;
+
+//
+// BSS QOS data.
+// Ref: BssDscr in 8185 code. [def. in BssDscr.h]
+//
+typedef struct _BSS_QOS{
+	QOS_MODE		bdQoSMode;
+
+	u8			bdWMMIEBuf[MAX_WMMELE_LENGTH];
+	u8*		bdWMMIE;
+
+	QOS_ELE_SUBTYPE		EleSubType;
+
+	u8 *			pWMMInfoEle;
+	u8 *			pWMMParamEle;
+
+	QOS_INFO_FIELD		QosInfoField;
+	AC_PARAM		AcParameter[4];
+}BSS_QOS, *PBSS_QOS;
+
+
+//
+// Ref: sQoSCtlLng and QoSCtl definition in 8185 QoS code.
+//#define QoSCtl   ((	(Adapter->bRegQoS) && (Adapter->dot11QoS.QoSMode &(QOS_EDCA|QOS_HCCA))	  )  ?sQoSCtlLng:0)
+//
+#define sQoSCtlLng			2
+#define	QOS_CTRL_LEN(_QosMode)		((_QosMode > QOS_DISABLE)? sQoSCtlLng : 0)
+
+
+//Added by joseph
+//UP Mapping to AC, using in MgntQuery_SequenceNumber() and maybe for DSCP
+//#define UP2AC(up)			((up<3)?((up==0)?1:0):(up>>1))
+#define IsACValid(ac)			((ac<=7 )?true:false )
+
+#endif // #ifndef __INC_QOS_TYPE_H
diff --git a/drivers/staging/rtl8192u/ieee80211/rtl819x_TS.h b/drivers/staging/rtl8192u/ieee80211/rtl819x_TS.h
new file mode 100644
index 000000000000..baaac2149de1
--- /dev/null
+++ b/drivers/staging/rtl8192u/ieee80211/rtl819x_TS.h
@@ -0,0 +1,56 @@
+#ifndef _TSTYPE_H_
+#define _TSTYPE_H_
+#include "rtl819x_Qos.h"
+#define TS_SETUP_TIMEOUT	60  // In millisecond
+#define TS_INACT_TIMEOUT	60
+#define TS_ADDBA_DELAY		60
+
+#define TOTAL_TS_NUM		16
+#define TCLAS_NUM		4
+
+// This define the Tx/Rx directions
+typedef enum _TR_SELECT {
+	TX_DIR = 0,
+	RX_DIR = 1,
+} TR_SELECT, *PTR_SELECT;
+
+typedef struct _TS_COMMON_INFO{
+	struct list_head		List;
+	struct timer_list		SetupTimer;
+	struct timer_list		InactTimer;
+	u8				Addr[6];
+	TSPEC_BODY			TSpec;
+	QOS_TCLAS			TClass[TCLAS_NUM];
+	u8				TClasProc;
+	u8				TClasNum;
+} TS_COMMON_INFO, *PTS_COMMON_INFO;
+
+typedef struct _TX_TS_RECORD{
+	TS_COMMON_INFO		TsCommonInfo;
+	u16				TxCurSeq;
+	BA_RECORD			TxPendingBARecord;  	// For BA Originator
+	BA_RECORD			TxAdmittedBARecord;	// For BA Originator
+//	QOS_DL_RECORD		DLRecord;
+	u8				bAddBaReqInProgress;
+	u8				bAddBaReqDelayed;
+	u8				bUsingBa;
+	struct timer_list		TsAddBaTimer;
+	u8				num;
+} TX_TS_RECORD, *PTX_TS_RECORD;
+
+typedef struct _RX_TS_RECORD {
+	TS_COMMON_INFO		TsCommonInfo;
+	u16				RxIndicateSeq;
+	u16				RxTimeoutIndicateSeq;
+	struct list_head		RxPendingPktList;
+	struct timer_list		RxPktPendingTimer;
+	BA_RECORD			RxAdmittedBARecord;	 // For BA Recepient
+	u16				RxLastSeqNum;
+	u8				RxLastFragNum;
+	u8				num;
+//	QOS_DL_RECORD		DLRecord;
+} RX_TS_RECORD, *PRX_TS_RECORD;
+
+
+#endif
+
diff --git a/drivers/staging/rtl8192u/ieee80211/rtl819x_TSProc.c b/drivers/staging/rtl8192u/ieee80211/rtl819x_TSProc.c
new file mode 100644
index 000000000000..5373d565af24
--- /dev/null
+++ b/drivers/staging/rtl8192u/ieee80211/rtl819x_TSProc.c
@@ -0,0 +1,628 @@
+#include "ieee80211.h"
+#include <linux/etherdevice.h>
+#include "rtl819x_TS.h"
+
+void TsSetupTimeOut(unsigned long data)
+{
+	// Not implement yet
+	// This is used for WMMSA and ACM , that would send ADDTSReq frame.
+}
+
+void TsInactTimeout(unsigned long data)
+{
+	// Not implement yet
+	// This is used for WMMSA and ACM.
+	// This function would be call when TS is no Tx/Rx for some period of time.
+}
+
+/********************************************************************************************************************
+ *function:  I still not understand this function, so wait for further implementation
+ *   input:  unsigned long	 data		//acturally we send TX_TS_RECORD or RX_TS_RECORD to these timer
+ *  return:  NULL
+ *  notice:
+********************************************************************************************************************/
+void RxPktPendingTimeout(unsigned long data)
+{
+	PRX_TS_RECORD	pRxTs = (PRX_TS_RECORD)data;
+	struct ieee80211_device *ieee = container_of(pRxTs, struct ieee80211_device, RxTsRecord[pRxTs->num]);
+
+	PRX_REORDER_ENTRY 	pReorderEntry = NULL;
+
+	//u32 flags = 0;
+	unsigned long flags = 0;
+	struct ieee80211_rxb *stats_IndicateArray[REORDER_WIN_SIZE];
+	u8 index = 0;
+	bool bPktInBuf = false;
+
+
+	spin_lock_irqsave(&(ieee->reorder_spinlock), flags);
+	//PlatformAcquireSpinLock(Adapter, RT_RX_SPINLOCK);
+	IEEE80211_DEBUG(IEEE80211_DL_REORDER,"==================>%s()\n",__FUNCTION__);
+	if(pRxTs->RxTimeoutIndicateSeq != 0xffff)
+	{
+		// Indicate the pending packets sequentially according to SeqNum until meet the gap.
+		while(!list_empty(&pRxTs->RxPendingPktList))
+		{
+			pReorderEntry = (PRX_REORDER_ENTRY)list_entry(pRxTs->RxPendingPktList.prev,RX_REORDER_ENTRY,List);
+			if(index == 0)
+				pRxTs->RxIndicateSeq = pReorderEntry->SeqNum;
+
+			if( SN_LESS(pReorderEntry->SeqNum, pRxTs->RxIndicateSeq) ||
+				SN_EQUAL(pReorderEntry->SeqNum, pRxTs->RxIndicateSeq)	)
+			{
+				list_del_init(&pReorderEntry->List);
+
+				if(SN_EQUAL(pReorderEntry->SeqNum, pRxTs->RxIndicateSeq))
+					pRxTs->RxIndicateSeq = (pRxTs->RxIndicateSeq + 1) % 4096;
+
+				IEEE80211_DEBUG(IEEE80211_DL_REORDER,"RxPktPendingTimeout(): IndicateSeq: %d\n", pReorderEntry->SeqNum);
+				stats_IndicateArray[index] = pReorderEntry->prxb;
+				index++;
+
+				list_add_tail(&pReorderEntry->List, &ieee->RxReorder_Unused_List);
+			}
+			else
+			{
+				bPktInBuf = true;
+				break;
+			}
+		}
+	}
+
+	if(index>0)
+	{
+		// Set RxTimeoutIndicateSeq to 0xffff to indicate no pending packets in buffer now.
+		pRxTs->RxTimeoutIndicateSeq = 0xffff;
+
+		// Indicate packets
+		if(index > REORDER_WIN_SIZE){
+			IEEE80211_DEBUG(IEEE80211_DL_ERR, "RxReorderIndicatePacket(): Rx Reorer buffer full!! \n");
+			spin_unlock_irqrestore(&(ieee->reorder_spinlock), flags);
+			return;
+		}
+		ieee80211_indicate_packets(ieee, stats_IndicateArray, index);
+	}
+
+	if(bPktInBuf && (pRxTs->RxTimeoutIndicateSeq==0xffff))
+	{
+		pRxTs->RxTimeoutIndicateSeq = pRxTs->RxIndicateSeq;
+		if(timer_pending(&pRxTs->RxPktPendingTimer))
+			del_timer_sync(&pRxTs->RxPktPendingTimer);
+		pRxTs->RxPktPendingTimer.expires = jiffies + ieee->pHTInfo->RxReorderPendingTime;
+		add_timer(&pRxTs->RxPktPendingTimer);
+	}
+	spin_unlock_irqrestore(&(ieee->reorder_spinlock), flags);
+	//PlatformReleaseSpinLock(Adapter, RT_RX_SPINLOCK);
+}
+
+/********************************************************************************************************************
+ *function:  Add BA timer function
+ *   input:  unsigned long	 data		//acturally we send TX_TS_RECORD or RX_TS_RECORD to these timer
+ *  return:  NULL
+ *  notice:
+********************************************************************************************************************/
+void TsAddBaProcess(unsigned long data)
+{
+	PTX_TS_RECORD	pTxTs = (PTX_TS_RECORD)data;
+	u8 num = pTxTs->num;
+	struct ieee80211_device *ieee = container_of(pTxTs, struct ieee80211_device, TxTsRecord[num]);
+
+	TsInitAddBA(ieee, pTxTs, BA_POLICY_IMMEDIATE, false);
+	IEEE80211_DEBUG(IEEE80211_DL_BA, "TsAddBaProcess(): ADDBA Req is started!! \n");
+}
+
+
+void ResetTsCommonInfo(PTS_COMMON_INFO	pTsCommonInfo)
+{
+	memset(pTsCommonInfo->Addr, 0, 6);
+	memset(&pTsCommonInfo->TSpec, 0, sizeof(TSPEC_BODY));
+	memset(&pTsCommonInfo->TClass, 0, sizeof(QOS_TCLAS)*TCLAS_NUM);
+	pTsCommonInfo->TClasProc = 0;
+	pTsCommonInfo->TClasNum = 0;
+}
+
+void ResetTxTsEntry(PTX_TS_RECORD pTS)
+{
+	ResetTsCommonInfo(&pTS->TsCommonInfo);
+	pTS->TxCurSeq = 0;
+	pTS->bAddBaReqInProgress = false;
+	pTS->bAddBaReqDelayed = false;
+	pTS->bUsingBa = false;
+	ResetBaEntry(&pTS->TxAdmittedBARecord); //For BA Originator
+	ResetBaEntry(&pTS->TxPendingBARecord);
+}
+
+void ResetRxTsEntry(PRX_TS_RECORD pTS)
+{
+	ResetTsCommonInfo(&pTS->TsCommonInfo);
+	pTS->RxIndicateSeq = 0xffff; // This indicate the RxIndicateSeq is not used now!!
+	pTS->RxTimeoutIndicateSeq = 0xffff; // This indicate the RxTimeoutIndicateSeq is not used now!!
+	ResetBaEntry(&pTS->RxAdmittedBARecord);	  // For BA Recepient
+}
+
+void TSInitialize(struct ieee80211_device *ieee)
+{
+	PTX_TS_RECORD		pTxTS  = ieee->TxTsRecord;
+	PRX_TS_RECORD		pRxTS  = ieee->RxTsRecord;
+	PRX_REORDER_ENTRY	pRxReorderEntry = ieee->RxReorderEntry;
+	u8				count = 0;
+	IEEE80211_DEBUG(IEEE80211_DL_TS, "==========>%s()\n", __FUNCTION__);
+	// Initialize Tx TS related info.
+	INIT_LIST_HEAD(&ieee->Tx_TS_Admit_List);
+	INIT_LIST_HEAD(&ieee->Tx_TS_Pending_List);
+	INIT_LIST_HEAD(&ieee->Tx_TS_Unused_List);
+
+	for(count = 0; count < TOTAL_TS_NUM; count++)
+	{
+		//
+		pTxTS->num = count;
+		// The timers for the operation of Traffic Stream and Block Ack.
+		// DLS related timer will be add here in the future!!
+		init_timer(&pTxTS->TsCommonInfo.SetupTimer);
+		pTxTS->TsCommonInfo.SetupTimer.data = (unsigned long)pTxTS;
+		pTxTS->TsCommonInfo.SetupTimer.function = TsSetupTimeOut;
+
+		init_timer(&pTxTS->TsCommonInfo.InactTimer);
+		pTxTS->TsCommonInfo.InactTimer.data = (unsigned long)pTxTS;
+		pTxTS->TsCommonInfo.InactTimer.function = TsInactTimeout;
+
+		init_timer(&pTxTS->TsAddBaTimer);
+		pTxTS->TsAddBaTimer.data = (unsigned long)pTxTS;
+		pTxTS->TsAddBaTimer.function = TsAddBaProcess;
+
+		init_timer(&pTxTS->TxPendingBARecord.Timer);
+		pTxTS->TxPendingBARecord.Timer.data = (unsigned long)pTxTS;
+		pTxTS->TxPendingBARecord.Timer.function = BaSetupTimeOut;
+
+		init_timer(&pTxTS->TxAdmittedBARecord.Timer);
+		pTxTS->TxAdmittedBARecord.Timer.data = (unsigned long)pTxTS;
+		pTxTS->TxAdmittedBARecord.Timer.function = TxBaInactTimeout;
+
+		ResetTxTsEntry(pTxTS);
+		list_add_tail(&pTxTS->TsCommonInfo.List, &ieee->Tx_TS_Unused_List);
+		pTxTS++;
+	}
+
+	// Initialize Rx TS related info.
+	INIT_LIST_HEAD(&ieee->Rx_TS_Admit_List);
+	INIT_LIST_HEAD(&ieee->Rx_TS_Pending_List);
+	INIT_LIST_HEAD(&ieee->Rx_TS_Unused_List);
+	for(count = 0; count < TOTAL_TS_NUM; count++)
+	{
+		pRxTS->num = count;
+		INIT_LIST_HEAD(&pRxTS->RxPendingPktList);
+
+		init_timer(&pRxTS->TsCommonInfo.SetupTimer);
+		pRxTS->TsCommonInfo.SetupTimer.data = (unsigned long)pRxTS;
+		pRxTS->TsCommonInfo.SetupTimer.function = TsSetupTimeOut;
+
+		init_timer(&pRxTS->TsCommonInfo.InactTimer);
+		pRxTS->TsCommonInfo.InactTimer.data = (unsigned long)pRxTS;
+		pRxTS->TsCommonInfo.InactTimer.function = TsInactTimeout;
+
+		init_timer(&pRxTS->RxAdmittedBARecord.Timer);
+		pRxTS->RxAdmittedBARecord.Timer.data = (unsigned long)pRxTS;
+		pRxTS->RxAdmittedBARecord.Timer.function = RxBaInactTimeout;
+
+		init_timer(&pRxTS->RxPktPendingTimer);
+		pRxTS->RxPktPendingTimer.data = (unsigned long)pRxTS;
+		pRxTS->RxPktPendingTimer.function = RxPktPendingTimeout;
+
+		ResetRxTsEntry(pRxTS);
+		list_add_tail(&pRxTS->TsCommonInfo.List, &ieee->Rx_TS_Unused_List);
+		pRxTS++;
+	}
+	// Initialize unused Rx Reorder List.
+	INIT_LIST_HEAD(&ieee->RxReorder_Unused_List);
+//#ifdef TO_DO_LIST
+	for(count = 0; count < REORDER_ENTRY_NUM; count++)
+	{
+		list_add_tail( &pRxReorderEntry->List,&ieee->RxReorder_Unused_List);
+		if(count == (REORDER_ENTRY_NUM-1))
+			break;
+		pRxReorderEntry = &ieee->RxReorderEntry[count+1];
+	}
+//#endif
+
+}
+
+void AdmitTS(struct ieee80211_device *ieee, PTS_COMMON_INFO pTsCommonInfo, u32 InactTime)
+{
+	del_timer_sync(&pTsCommonInfo->SetupTimer);
+	del_timer_sync(&pTsCommonInfo->InactTimer);
+
+	if(InactTime!=0)
+		mod_timer(&pTsCommonInfo->InactTimer, jiffies + MSECS(InactTime));
+}
+
+
+PTS_COMMON_INFO SearchAdmitTRStream(struct ieee80211_device *ieee, u8*	Addr, u8 TID, TR_SELECT	TxRxSelect)
+{
+	//DIRECTION_VALUE 	dir;
+	u8 	dir;
+	bool				search_dir[4] = {0, 0, 0, 0};
+	struct list_head*		psearch_list; //FIXME
+	PTS_COMMON_INFO	pRet = NULL;
+	if(ieee->iw_mode == IW_MODE_MASTER) //ap mode
+	{
+		if(TxRxSelect == TX_DIR)
+		{
+			search_dir[DIR_DOWN] = true;
+			search_dir[DIR_BI_DIR]= true;
+		}
+		else
+		{
+			search_dir[DIR_UP] 	= true;
+			search_dir[DIR_BI_DIR]= true;
+		}
+	}
+	else if(ieee->iw_mode == IW_MODE_ADHOC)
+	{
+		if(TxRxSelect == TX_DIR)
+			search_dir[DIR_UP] 	= true;
+		else
+			search_dir[DIR_DOWN] = true;
+	}
+	else
+	{
+		if(TxRxSelect == TX_DIR)
+		{
+			search_dir[DIR_UP] 	= true;
+			search_dir[DIR_BI_DIR]= true;
+			search_dir[DIR_DIRECT]= true;
+		}
+		else
+		{
+			search_dir[DIR_DOWN] = true;
+			search_dir[DIR_BI_DIR]= true;
+			search_dir[DIR_DIRECT]= true;
+		}
+	}
+
+	if(TxRxSelect == TX_DIR)
+		psearch_list = &ieee->Tx_TS_Admit_List;
+	else
+		psearch_list = &ieee->Rx_TS_Admit_List;
+
+	//for(dir = DIR_UP; dir <= DIR_BI_DIR; dir++)
+	for(dir = 0; dir <= DIR_BI_DIR; dir++)
+	{
+		if(search_dir[dir] ==false )
+			continue;
+		list_for_each_entry(pRet, psearch_list, List){
+	//		IEEE80211_DEBUG(IEEE80211_DL_TS, "ADD:"MAC_FMT", TID:%d, dir:%d\n", MAC_ARG(pRet->Addr), pRet->TSpec.f.TSInfo.field.ucTSID, pRet->TSpec.f.TSInfo.field.ucDirection);
+			if (memcmp(pRet->Addr, Addr, 6) == 0)
+				if (pRet->TSpec.f.TSInfo.field.ucTSID == TID)
+					if(pRet->TSpec.f.TSInfo.field.ucDirection == dir)
+					{
+	//					printk("Bingo! got it\n");
+						break;
+					}
+
+		}
+		if(&pRet->List  != psearch_list)
+			break;
+	}
+
+	if(&pRet->List  != psearch_list){
+		return pRet ;
+	}
+	else
+		return NULL;
+}
+
+void MakeTSEntry(
+		PTS_COMMON_INFO	pTsCommonInfo,
+		u8*		Addr,
+		PTSPEC_BODY	pTSPEC,
+		PQOS_TCLAS	pTCLAS,
+		u8		TCLAS_Num,
+		u8		TCLAS_Proc
+	)
+{
+	u8	count;
+
+	if(pTsCommonInfo == NULL)
+		return;
+
+	memcpy(pTsCommonInfo->Addr, Addr, 6);
+
+	if(pTSPEC != NULL)
+		memcpy((u8*)(&(pTsCommonInfo->TSpec)), (u8*)pTSPEC, sizeof(TSPEC_BODY));
+
+	for(count = 0; count < TCLAS_Num; count++)
+		memcpy((u8*)(&(pTsCommonInfo->TClass[count])), (u8*)pTCLAS, sizeof(QOS_TCLAS));
+
+	pTsCommonInfo->TClasProc = TCLAS_Proc;
+	pTsCommonInfo->TClasNum = TCLAS_Num;
+}
+
+
+bool GetTs(
+	struct ieee80211_device*	ieee,
+	PTS_COMMON_INFO			*ppTS,
+	u8*				Addr,
+	u8				TID,
+	TR_SELECT			TxRxSelect,  //Rx:1, Tx:0
+	bool				bAddNewTs
+	)
+{
+	u8	UP = 0;
+	//
+	// We do not build any TS for Broadcast or Multicast stream.
+	// So reject these kinds of search here.
+	//
+	if(is_broadcast_ether_addr(Addr) || is_multicast_ether_addr(Addr))
+	{
+		IEEE80211_DEBUG(IEEE80211_DL_ERR, "get TS for Broadcast or Multicast\n");
+		return false;
+	}
+	if (ieee->current_network.qos_data.supported == 0)
+		UP = 0;
+	else
+	{
+		// In WMM case: we use 4 TID only
+		if (!IsACValid(TID))
+		{
+			IEEE80211_DEBUG(IEEE80211_DL_ERR, " in %s(), TID(%d) is not valid\n", __FUNCTION__, TID);
+			return false;
+		}
+
+		switch(TID)
+		{
+		case 0:
+		case 3:
+			UP = 0;
+			break;
+
+		case 1:
+		case 2:
+			UP = 2;
+			break;
+
+		case 4:
+		case 5:
+			UP = 5;
+			break;
+
+		case 6:
+		case 7:
+			UP = 7;
+			break;
+		}
+	}
+
+	*ppTS = SearchAdmitTRStream(
+			ieee,
+			Addr,
+			UP,
+			TxRxSelect);
+	if(*ppTS != NULL)
+	{
+		return true;
+	}
+	else
+	{
+		if(bAddNewTs == false)
+		{
+			IEEE80211_DEBUG(IEEE80211_DL_TS, "add new TS failed(tid:%d)\n", UP);
+			return false;
+		}
+		else
+		{
+			//
+			// Create a new Traffic stream for current Tx/Rx
+			// This is for EDCA and WMM to add a new TS.
+			// For HCCA or WMMSA, TS cannot be addmit without negotiation.
+			//
+			TSPEC_BODY	TSpec;
+			PQOS_TSINFO		pTSInfo = &TSpec.f.TSInfo;
+			struct list_head*	pUnusedList =
+								(TxRxSelect == TX_DIR)?
+								(&ieee->Tx_TS_Unused_List):
+								(&ieee->Rx_TS_Unused_List);
+
+			struct list_head*	pAddmitList =
+								(TxRxSelect == TX_DIR)?
+								(&ieee->Tx_TS_Admit_List):
+								(&ieee->Rx_TS_Admit_List);
+
+			DIRECTION_VALUE		Dir =		(ieee->iw_mode == IW_MODE_MASTER)?
+								((TxRxSelect==TX_DIR)?DIR_DOWN:DIR_UP):
+								((TxRxSelect==TX_DIR)?DIR_UP:DIR_DOWN);
+			IEEE80211_DEBUG(IEEE80211_DL_TS, "to add Ts\n");
+			if(!list_empty(pUnusedList))
+			{
+				(*ppTS) = list_entry(pUnusedList->next, TS_COMMON_INFO, List);
+				list_del_init(&(*ppTS)->List);
+				if(TxRxSelect==TX_DIR)
+				{
+					PTX_TS_RECORD tmp = container_of(*ppTS, TX_TS_RECORD, TsCommonInfo);
+					ResetTxTsEntry(tmp);
+				}
+				else{
+					PRX_TS_RECORD tmp = container_of(*ppTS, RX_TS_RECORD, TsCommonInfo);
+					ResetRxTsEntry(tmp);
+				}
+
+				IEEE80211_DEBUG(IEEE80211_DL_TS, "to init current TS, UP:%d, Dir:%d, addr:"MAC_FMT"\n", UP, Dir, MAC_ARG(Addr));
+				// Prepare TS Info releated field
+				pTSInfo->field.ucTrafficType = 0;			// Traffic type: WMM is reserved in this field
+				pTSInfo->field.ucTSID = UP;			// TSID
+				pTSInfo->field.ucDirection = Dir;			// Direction: if there is DirectLink, this need additional consideration.
+				pTSInfo->field.ucAccessPolicy = 1;		// Access policy
+				pTSInfo->field.ucAggregation = 0; 		// Aggregation
+				pTSInfo->field.ucPSB = 0; 				// Aggregation
+				pTSInfo->field.ucUP = UP;				// User priority
+				pTSInfo->field.ucTSInfoAckPolicy = 0;		// Ack policy
+				pTSInfo->field.ucSchedule = 0;			// Schedule
+
+				MakeTSEntry(*ppTS, Addr, &TSpec, NULL, 0, 0);
+				AdmitTS(ieee, *ppTS, 0);
+				list_add_tail(&((*ppTS)->List), pAddmitList);
+				// if there is DirectLink, we need to do additional operation here!!
+
+				return true;
+			}
+			else
+			{
+				IEEE80211_DEBUG(IEEE80211_DL_ERR, "in function %s() There is not enough TS record to be used!!", __FUNCTION__);
+				return false;
+			}
+		}
+	}
+}
+
+void RemoveTsEntry(
+	struct ieee80211_device*	ieee,
+	PTS_COMMON_INFO			pTs,
+	TR_SELECT			TxRxSelect
+	)
+{
+	//u32 flags = 0;
+	unsigned long flags = 0;
+	del_timer_sync(&pTs->SetupTimer);
+	del_timer_sync(&pTs->InactTimer);
+	TsInitDelBA(ieee, pTs, TxRxSelect);
+
+	if(TxRxSelect == RX_DIR)
+	{
+//#ifdef TO_DO_LIST
+		PRX_REORDER_ENTRY	pRxReorderEntry;
+		PRX_TS_RECORD 		pRxTS = (PRX_TS_RECORD)pTs;
+		if(timer_pending(&pRxTS->RxPktPendingTimer))
+			del_timer_sync(&pRxTS->RxPktPendingTimer);
+
+		while(!list_empty(&pRxTS->RxPendingPktList))
+		{
+		//      PlatformAcquireSpinLock(Adapter, RT_RX_SPINLOCK);
+			spin_lock_irqsave(&(ieee->reorder_spinlock), flags);
+			//pRxReorderEntry = list_entry(&pRxTS->RxPendingPktList.prev,RX_REORDER_ENTRY,List);
+			pRxReorderEntry = (PRX_REORDER_ENTRY)list_entry(pRxTS->RxPendingPktList.prev,RX_REORDER_ENTRY,List);
+			list_del_init(&pRxReorderEntry->List);
+			{
+				int i = 0;
+				struct ieee80211_rxb * prxb = pRxReorderEntry->prxb;
+				if (unlikely(!prxb))
+				{
+					spin_unlock_irqrestore(&(ieee->reorder_spinlock), flags);
+					return;
+				}
+				for(i =0; i < prxb->nr_subframes; i++) {
+					dev_kfree_skb(prxb->subframes[i]);
+				}
+				kfree(prxb);
+				prxb = NULL;
+			}
+			list_add_tail(&pRxReorderEntry->List,&ieee->RxReorder_Unused_List);
+			//PlatformReleaseSpinLock(Adapter, RT_RX_SPINLOCK);
+			spin_unlock_irqrestore(&(ieee->reorder_spinlock), flags);
+		}
+
+//#endif
+	}
+	else
+	{
+		PTX_TS_RECORD pTxTS = (PTX_TS_RECORD)pTs;
+		del_timer_sync(&pTxTS->TsAddBaTimer);
+	}
+}
+
+void RemovePeerTS(struct ieee80211_device* ieee, u8* Addr)
+{
+	PTS_COMMON_INFO	pTS, pTmpTS;
+	printk("===========>RemovePeerTS,"MAC_FMT"\n", MAC_ARG(Addr));
+	list_for_each_entry_safe(pTS, pTmpTS, &ieee->Tx_TS_Pending_List, List)
+	{
+		if (memcmp(pTS->Addr, Addr, 6) == 0)
+		{
+			RemoveTsEntry(ieee, pTS, TX_DIR);
+			list_del_init(&pTS->List);
+			list_add_tail(&pTS->List, &ieee->Tx_TS_Unused_List);
+		}
+	}
+
+	list_for_each_entry_safe(pTS, pTmpTS, &ieee->Tx_TS_Admit_List, List)
+	{
+		if (memcmp(pTS->Addr, Addr, 6) == 0)
+		{
+			printk("====>remove Tx_TS_admin_list\n");
+			RemoveTsEntry(ieee, pTS, TX_DIR);
+			list_del_init(&pTS->List);
+			list_add_tail(&pTS->List, &ieee->Tx_TS_Unused_List);
+		}
+	}
+
+	list_for_each_entry_safe(pTS, pTmpTS, &ieee->Rx_TS_Pending_List, List)
+	{
+		if (memcmp(pTS->Addr, Addr, 6) == 0)
+		{
+			RemoveTsEntry(ieee, pTS, RX_DIR);
+			list_del_init(&pTS->List);
+			list_add_tail(&pTS->List, &ieee->Rx_TS_Unused_List);
+		}
+	}
+
+	list_for_each_entry_safe(pTS, pTmpTS, &ieee->Rx_TS_Admit_List, List)
+	{
+		if (memcmp(pTS->Addr, Addr, 6) == 0)
+		{
+			RemoveTsEntry(ieee, pTS, RX_DIR);
+			list_del_init(&pTS->List);
+			list_add_tail(&pTS->List, &ieee->Rx_TS_Unused_List);
+		}
+	}
+}
+
+void RemoveAllTS(struct ieee80211_device* ieee)
+{
+	PTS_COMMON_INFO pTS, pTmpTS;
+	list_for_each_entry_safe(pTS, pTmpTS, &ieee->Tx_TS_Pending_List, List)
+	{
+		RemoveTsEntry(ieee, pTS, TX_DIR);
+		list_del_init(&pTS->List);
+		list_add_tail(&pTS->List, &ieee->Tx_TS_Unused_List);
+	}
+
+	list_for_each_entry_safe(pTS, pTmpTS, &ieee->Tx_TS_Admit_List, List)
+	{
+		RemoveTsEntry(ieee, pTS, TX_DIR);
+		list_del_init(&pTS->List);
+		list_add_tail(&pTS->List, &ieee->Tx_TS_Unused_List);
+	}
+
+	list_for_each_entry_safe(pTS, pTmpTS, &ieee->Rx_TS_Pending_List, List)
+	{
+		RemoveTsEntry(ieee, pTS, RX_DIR);
+		list_del_init(&pTS->List);
+		list_add_tail(&pTS->List, &ieee->Rx_TS_Unused_List);
+	}
+
+	list_for_each_entry_safe(pTS, pTmpTS, &ieee->Rx_TS_Admit_List, List)
+	{
+		RemoveTsEntry(ieee, pTS, RX_DIR);
+		list_del_init(&pTS->List);
+		list_add_tail(&pTS->List, &ieee->Rx_TS_Unused_List);
+	}
+}
+
+void TsStartAddBaProcess(struct ieee80211_device* ieee, PTX_TS_RECORD	pTxTS)
+{
+	if(pTxTS->bAddBaReqInProgress == false)
+	{
+		pTxTS->bAddBaReqInProgress = true;
+		if(pTxTS->bAddBaReqDelayed)
+		{
+			IEEE80211_DEBUG(IEEE80211_DL_BA, "TsStartAddBaProcess(): Delayed Start ADDBA after 60 sec!!\n");
+			mod_timer(&pTxTS->TsAddBaTimer, jiffies + MSECS(TS_ADDBA_DELAY));
+		}
+		else
+		{
+			IEEE80211_DEBUG(IEEE80211_DL_BA,"TsStartAddBaProcess(): Immediately Start ADDBA now!!\n");
+			mod_timer(&pTxTS->TsAddBaTimer, jiffies+10); //set 10 ticks
+		}
+	}
+	else
+		IEEE80211_DEBUG(IEEE80211_DL_ERR, "%s()==>BA timer is already added\n", __FUNCTION__);
+}
+EXPORT_SYMBOL(RemovePeerTS);
diff --git a/drivers/staging/rtl8192u/ieee80211/rtl_crypto.h b/drivers/staging/rtl8192u/ieee80211/rtl_crypto.h
new file mode 100644
index 000000000000..ccf6ae763572
--- /dev/null
+++ b/drivers/staging/rtl8192u/ieee80211/rtl_crypto.h
@@ -0,0 +1,399 @@
+/*
+ * Scatterlist Cryptographic API.
+ *
+ * Copyright (c) 2002 James Morris <jmorris@intercode.com.au>
+ * Copyright (c) 2002 David S. Miller (davem@redhat.com)
+ *
+ * Portions derived from Cryptoapi, by Alexander Kjeldaas <astor@fast.no>
+ * and Nettle, by Niels Mé°ˆler.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2 of the License, or (at your option)
+ * any later version.
+ *
+ */
+#ifndef _LINUX_CRYPTO_H
+#define _LINUX_CRYPTO_H
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/types.h>
+#include <linux/list.h>
+#include <linux/string.h>
+#include <asm/page.h>
+#include <asm/errno.h>
+
+#define crypto_register_alg crypto_register_alg_rsl
+#define crypto_unregister_alg crypto_unregister_alg_rsl
+#define crypto_alloc_tfm crypto_alloc_tfm_rsl
+#define crypto_free_tfm crypto_free_tfm_rsl
+#define crypto_alg_available crypto_alg_available_rsl
+
+/*
+ * Algorithm masks and types.
+ */
+#define CRYPTO_ALG_TYPE_MASK		0x000000ff
+#define CRYPTO_ALG_TYPE_CIPHER		0x00000001
+#define CRYPTO_ALG_TYPE_DIGEST		0x00000002
+#define CRYPTO_ALG_TYPE_COMPRESS	0x00000004
+
+/*
+ * Transform masks and values (for crt_flags).
+ */
+#define CRYPTO_TFM_MODE_MASK		0x000000ff
+#define CRYPTO_TFM_REQ_MASK		0x000fff00
+#define CRYPTO_TFM_RES_MASK		0xfff00000
+
+#define CRYPTO_TFM_MODE_ECB		0x00000001
+#define CRYPTO_TFM_MODE_CBC		0x00000002
+#define CRYPTO_TFM_MODE_CFB		0x00000004
+#define CRYPTO_TFM_MODE_CTR		0x00000008
+
+#define CRYPTO_TFM_REQ_WEAK_KEY		0x00000100
+#define CRYPTO_TFM_RES_WEAK_KEY		0x00100000
+#define CRYPTO_TFM_RES_BAD_KEY_LEN   	0x00200000
+#define CRYPTO_TFM_RES_BAD_KEY_SCHED 	0x00400000
+#define CRYPTO_TFM_RES_BAD_BLOCK_LEN 	0x00800000
+#define CRYPTO_TFM_RES_BAD_FLAGS 	0x01000000
+
+/*
+ * Miscellaneous stuff.
+ */
+#define CRYPTO_UNSPEC			0
+#define CRYPTO_MAX_ALG_NAME		64
+
+struct scatterlist;
+
+/*
+ * Algorithms: modular crypto algorithm implementations, managed
+ * via crypto_register_alg() and crypto_unregister_alg().
+ */
+struct cipher_alg {
+	unsigned int cia_min_keysize;
+	unsigned int cia_max_keysize;
+	int (*cia_setkey)(void *ctx, const u8 *key,
+	                  unsigned int keylen, u32 *flags);
+	void (*cia_encrypt)(void *ctx, u8 *dst, const u8 *src);
+	void (*cia_decrypt)(void *ctx, u8 *dst, const u8 *src);
+};
+
+struct digest_alg {
+	unsigned int dia_digestsize;
+	void (*dia_init)(void *ctx);
+	void (*dia_update)(void *ctx, const u8 *data, unsigned int len);
+	void (*dia_final)(void *ctx, u8 *out);
+	int (*dia_setkey)(void *ctx, const u8 *key,
+	                  unsigned int keylen, u32 *flags);
+};
+
+struct compress_alg {
+	int (*coa_init)(void *ctx);
+	void (*coa_exit)(void *ctx);
+	int (*coa_compress)(void *ctx, const u8 *src, unsigned int slen,
+	                    u8 *dst, unsigned int *dlen);
+	int (*coa_decompress)(void *ctx, const u8 *src, unsigned int slen,
+	                      u8 *dst, unsigned int *dlen);
+};
+
+#define cra_cipher	cra_u.cipher
+#define cra_digest	cra_u.digest
+#define cra_compress	cra_u.compress
+
+struct crypto_alg {
+	struct list_head cra_list;
+	u32 cra_flags;
+	unsigned int cra_blocksize;
+	unsigned int cra_ctxsize;
+	const char cra_name[CRYPTO_MAX_ALG_NAME];
+
+	union {
+		struct cipher_alg cipher;
+		struct digest_alg digest;
+		struct compress_alg compress;
+	} cra_u;
+
+	struct module *cra_module;
+};
+
+/*
+ * Algorithm registration interface.
+ */
+int crypto_register_alg(struct crypto_alg *alg);
+int crypto_unregister_alg(struct crypto_alg *alg);
+
+/*
+ * Algorithm query interface.
+ */
+int crypto_alg_available(const char *name, u32 flags);
+
+/*
+ * Transforms: user-instantiated objects which encapsulate algorithms
+ * and core processing logic.  Managed via crypto_alloc_tfm() and
+ * crypto_free_tfm(), as well as the various helpers below.
+ */
+struct crypto_tfm;
+
+struct cipher_tfm {
+	void *cit_iv;
+	unsigned int cit_ivsize;
+	u32 cit_mode;
+	int (*cit_setkey)(struct crypto_tfm *tfm,
+	                  const u8 *key, unsigned int keylen);
+	int (*cit_encrypt)(struct crypto_tfm *tfm,
+			   struct scatterlist *dst,
+			   struct scatterlist *src,
+			   unsigned int nbytes);
+	int (*cit_encrypt_iv)(struct crypto_tfm *tfm,
+	                      struct scatterlist *dst,
+	                      struct scatterlist *src,
+	                      unsigned int nbytes, u8 *iv);
+	int (*cit_decrypt)(struct crypto_tfm *tfm,
+			   struct scatterlist *dst,
+			   struct scatterlist *src,
+			   unsigned int nbytes);
+	int (*cit_decrypt_iv)(struct crypto_tfm *tfm,
+			   struct scatterlist *dst,
+			   struct scatterlist *src,
+			   unsigned int nbytes, u8 *iv);
+	void (*cit_xor_block)(u8 *dst, const u8 *src);
+};
+
+struct digest_tfm {
+	void (*dit_init)(struct crypto_tfm *tfm);
+	void (*dit_update)(struct crypto_tfm *tfm,
+	                   struct scatterlist *sg, unsigned int nsg);
+	void (*dit_final)(struct crypto_tfm *tfm, u8 *out);
+	void (*dit_digest)(struct crypto_tfm *tfm, struct scatterlist *sg,
+	                   unsigned int nsg, u8 *out);
+	int (*dit_setkey)(struct crypto_tfm *tfm,
+	                  const u8 *key, unsigned int keylen);
+#ifdef CONFIG_CRYPTO_HMAC
+	void *dit_hmac_block;
+#endif
+};
+
+struct compress_tfm {
+	int (*cot_compress)(struct crypto_tfm *tfm,
+	                    const u8 *src, unsigned int slen,
+	                    u8 *dst, unsigned int *dlen);
+	int (*cot_decompress)(struct crypto_tfm *tfm,
+	                      const u8 *src, unsigned int slen,
+	                      u8 *dst, unsigned int *dlen);
+};
+
+#define crt_cipher	crt_u.cipher
+#define crt_digest	crt_u.digest
+#define crt_compress	crt_u.compress
+
+struct crypto_tfm {
+
+	u32 crt_flags;
+
+	union {
+		struct cipher_tfm cipher;
+		struct digest_tfm digest;
+		struct compress_tfm compress;
+	} crt_u;
+
+	struct crypto_alg *__crt_alg;
+};
+
+/*
+ * Transform user interface.
+ */
+
+/*
+ * crypto_alloc_tfm() will first attempt to locate an already loaded algorithm.
+ * If that fails and the kernel supports dynamically loadable modules, it
+ * will then attempt to load a module of the same name or alias.  A refcount
+ * is grabbed on the algorithm which is then associated with the new transform.
+ *
+ * crypto_free_tfm() frees up the transform and any associated resources,
+ * then drops the refcount on the associated algorithm.
+ */
+struct crypto_tfm *crypto_alloc_tfm(const char *alg_name, u32 tfm_flags);
+void crypto_free_tfm(struct crypto_tfm *tfm);
+
+/*
+ * Transform helpers which query the underlying algorithm.
+ */
+static inline const char *crypto_tfm_alg_name(struct crypto_tfm *tfm)
+{
+	return tfm->__crt_alg->cra_name;
+}
+
+static inline const char *crypto_tfm_alg_modname(struct crypto_tfm *tfm)
+{
+	struct crypto_alg *alg = tfm->__crt_alg;
+
+	if (alg->cra_module)
+		return alg->cra_module->name;
+	else
+		return NULL;
+}
+
+static inline u32 crypto_tfm_alg_type(struct crypto_tfm *tfm)
+{
+	return tfm->__crt_alg->cra_flags & CRYPTO_ALG_TYPE_MASK;
+}
+
+static inline unsigned int crypto_tfm_alg_min_keysize(struct crypto_tfm *tfm)
+{
+	BUG_ON(crypto_tfm_alg_type(tfm) != CRYPTO_ALG_TYPE_CIPHER);
+	return tfm->__crt_alg->cra_cipher.cia_min_keysize;
+}
+
+static inline unsigned int crypto_tfm_alg_max_keysize(struct crypto_tfm *tfm)
+{
+	BUG_ON(crypto_tfm_alg_type(tfm) != CRYPTO_ALG_TYPE_CIPHER);
+	return tfm->__crt_alg->cra_cipher.cia_max_keysize;
+}
+
+static inline unsigned int crypto_tfm_alg_ivsize(struct crypto_tfm *tfm)
+{
+	BUG_ON(crypto_tfm_alg_type(tfm) != CRYPTO_ALG_TYPE_CIPHER);
+	return tfm->crt_cipher.cit_ivsize;
+}
+
+static inline unsigned int crypto_tfm_alg_blocksize(struct crypto_tfm *tfm)
+{
+	return tfm->__crt_alg->cra_blocksize;
+}
+
+static inline unsigned int crypto_tfm_alg_digestsize(struct crypto_tfm *tfm)
+{
+	BUG_ON(crypto_tfm_alg_type(tfm) != CRYPTO_ALG_TYPE_DIGEST);
+	return tfm->__crt_alg->cra_digest.dia_digestsize;
+}
+
+/*
+ * API wrappers.
+ */
+static inline void crypto_digest_init(struct crypto_tfm *tfm)
+{
+	BUG_ON(crypto_tfm_alg_type(tfm) != CRYPTO_ALG_TYPE_DIGEST);
+	tfm->crt_digest.dit_init(tfm);
+}
+
+static inline void crypto_digest_update(struct crypto_tfm *tfm,
+                                        struct scatterlist *sg,
+                                        unsigned int nsg)
+{
+	BUG_ON(crypto_tfm_alg_type(tfm) != CRYPTO_ALG_TYPE_DIGEST);
+	tfm->crt_digest.dit_update(tfm, sg, nsg);
+}
+
+static inline void crypto_digest_final(struct crypto_tfm *tfm, u8 *out)
+{
+	BUG_ON(crypto_tfm_alg_type(tfm) != CRYPTO_ALG_TYPE_DIGEST);
+	tfm->crt_digest.dit_final(tfm, out);
+}
+
+static inline void crypto_digest_digest(struct crypto_tfm *tfm,
+                                        struct scatterlist *sg,
+                                        unsigned int nsg, u8 *out)
+{
+	BUG_ON(crypto_tfm_alg_type(tfm) != CRYPTO_ALG_TYPE_DIGEST);
+	tfm->crt_digest.dit_digest(tfm, sg, nsg, out);
+}
+
+static inline int crypto_digest_setkey(struct crypto_tfm *tfm,
+                                       const u8 *key, unsigned int keylen)
+{
+	BUG_ON(crypto_tfm_alg_type(tfm) != CRYPTO_ALG_TYPE_DIGEST);
+	if (tfm->crt_digest.dit_setkey == NULL)
+		return -ENOSYS;
+	return tfm->crt_digest.dit_setkey(tfm, key, keylen);
+}
+
+static inline int crypto_cipher_setkey(struct crypto_tfm *tfm,
+                                       const u8 *key, unsigned int keylen)
+{
+	BUG_ON(crypto_tfm_alg_type(tfm) != CRYPTO_ALG_TYPE_CIPHER);
+	return tfm->crt_cipher.cit_setkey(tfm, key, keylen);
+}
+
+static inline int crypto_cipher_encrypt(struct crypto_tfm *tfm,
+                                        struct scatterlist *dst,
+                                        struct scatterlist *src,
+                                        unsigned int nbytes)
+{
+	BUG_ON(crypto_tfm_alg_type(tfm) != CRYPTO_ALG_TYPE_CIPHER);
+	return tfm->crt_cipher.cit_encrypt(tfm, dst, src, nbytes);
+}
+
+static inline int crypto_cipher_encrypt_iv(struct crypto_tfm *tfm,
+                                           struct scatterlist *dst,
+                                           struct scatterlist *src,
+                                           unsigned int nbytes, u8 *iv)
+{
+	BUG_ON(crypto_tfm_alg_type(tfm) != CRYPTO_ALG_TYPE_CIPHER);
+	BUG_ON(tfm->crt_cipher.cit_mode == CRYPTO_TFM_MODE_ECB);
+	return tfm->crt_cipher.cit_encrypt_iv(tfm, dst, src, nbytes, iv);
+}
+
+static inline int crypto_cipher_decrypt(struct crypto_tfm *tfm,
+                                        struct scatterlist *dst,
+                                        struct scatterlist *src,
+                                        unsigned int nbytes)
+{
+	BUG_ON(crypto_tfm_alg_type(tfm) != CRYPTO_ALG_TYPE_CIPHER);
+	return tfm->crt_cipher.cit_decrypt(tfm, dst, src, nbytes);
+}
+
+static inline int crypto_cipher_decrypt_iv(struct crypto_tfm *tfm,
+                                           struct scatterlist *dst,
+                                           struct scatterlist *src,
+                                           unsigned int nbytes, u8 *iv)
+{
+	BUG_ON(crypto_tfm_alg_type(tfm) != CRYPTO_ALG_TYPE_CIPHER);
+	BUG_ON(tfm->crt_cipher.cit_mode == CRYPTO_TFM_MODE_ECB);
+	return tfm->crt_cipher.cit_decrypt_iv(tfm, dst, src, nbytes, iv);
+}
+
+static inline void crypto_cipher_set_iv(struct crypto_tfm *tfm,
+                                        const u8 *src, unsigned int len)
+{
+	BUG_ON(crypto_tfm_alg_type(tfm) != CRYPTO_ALG_TYPE_CIPHER);
+	memcpy(tfm->crt_cipher.cit_iv, src, len);
+}
+
+static inline void crypto_cipher_get_iv(struct crypto_tfm *tfm,
+                                        u8 *dst, unsigned int len)
+{
+	BUG_ON(crypto_tfm_alg_type(tfm) != CRYPTO_ALG_TYPE_CIPHER);
+	memcpy(dst, tfm->crt_cipher.cit_iv, len);
+}
+
+static inline int crypto_comp_compress(struct crypto_tfm *tfm,
+                                       const u8 *src, unsigned int slen,
+                                       u8 *dst, unsigned int *dlen)
+{
+	BUG_ON(crypto_tfm_alg_type(tfm) != CRYPTO_ALG_TYPE_COMPRESS);
+	return tfm->crt_compress.cot_compress(tfm, src, slen, dst, dlen);
+}
+
+static inline int crypto_comp_decompress(struct crypto_tfm *tfm,
+                                         const u8 *src, unsigned int slen,
+                                         u8 *dst, unsigned int *dlen)
+{
+	BUG_ON(crypto_tfm_alg_type(tfm) != CRYPTO_ALG_TYPE_COMPRESS);
+	return tfm->crt_compress.cot_decompress(tfm, src, slen, dst, dlen);
+}
+
+/*
+ * HMAC support.
+ */
+#ifdef CONFIG_CRYPTO_HMAC
+void crypto_hmac_init(struct crypto_tfm *tfm, u8 *key, unsigned int *keylen);
+void crypto_hmac_update(struct crypto_tfm *tfm,
+                        struct scatterlist *sg, unsigned int nsg);
+void crypto_hmac_final(struct crypto_tfm *tfm, u8 *key,
+                       unsigned int *keylen, u8 *out);
+void crypto_hmac(struct crypto_tfm *tfm, u8 *key, unsigned int *keylen,
+                 struct scatterlist *sg, unsigned int nsg, u8 *out);
+#endif	/* CONFIG_CRYPTO_HMAC */
+
+#endif	/* _LINUX_CRYPTO_H */
+
diff --git a/drivers/staging/rtl8192u/ieee80211/scatterwalk.c b/drivers/staging/rtl8192u/ieee80211/scatterwalk.c
new file mode 100644
index 000000000000..49f401fbce88
--- /dev/null
+++ b/drivers/staging/rtl8192u/ieee80211/scatterwalk.c
@@ -0,0 +1,126 @@
+/*
+ * Cryptographic API.
+ *
+ * Cipher operations.
+ *
+ * Copyright (c) 2002 James Morris <jmorris@intercode.com.au>
+ *               2002 Adam J. Richter <adam@yggdrasil.com>
+ *               2004 Jean-Luc Cooke <jlcooke@certainkey.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2 of the License, or (at your option)
+ * any later version.
+ *
+ */
+#include "kmap_types.h"
+
+#include <linux/kernel.h>
+#include <linux/mm.h>
+#include <linux/pagemap.h>
+#include <linux/highmem.h>
+#include <asm/scatterlist.h>
+#include "internal.h"
+#include "scatterwalk.h"
+
+enum km_type crypto_km_types[] = {
+	KM_USER0,
+	KM_USER1,
+	KM_SOFTIRQ0,
+	KM_SOFTIRQ1,
+};
+
+void *scatterwalk_whichbuf(struct scatter_walk *walk, unsigned int nbytes, void *scratch)
+{
+	if (nbytes <= walk->len_this_page &&
+	    (((unsigned long)walk->data) & (PAGE_CACHE_SIZE - 1)) + nbytes <=
+	    PAGE_CACHE_SIZE)
+		return walk->data;
+	else
+		return scratch;
+}
+
+static void memcpy_dir(void *buf, void *sgdata, size_t nbytes, int out)
+{
+	if (out)
+		memcpy(sgdata, buf, nbytes);
+	else
+		memcpy(buf, sgdata, nbytes);
+}
+
+void scatterwalk_start(struct scatter_walk *walk, struct scatterlist *sg)
+{
+	unsigned int rest_of_page;
+
+	walk->sg = sg;
+
+	walk->page = sg->page;
+	walk->len_this_segment = sg->length;
+
+	rest_of_page = PAGE_CACHE_SIZE - (sg->offset & (PAGE_CACHE_SIZE - 1));
+	walk->len_this_page = min(sg->length, rest_of_page);
+	walk->offset = sg->offset;
+}
+
+void scatterwalk_map(struct scatter_walk *walk, int out)
+{
+	walk->data = crypto_kmap(walk->page, out) + walk->offset;
+}
+
+static void scatterwalk_pagedone(struct scatter_walk *walk, int out,
+				 unsigned int more)
+{
+	/* walk->data may be pointing the first byte of the next page;
+	   however, we know we transfered at least one byte.  So,
+	   walk->data - 1 will be a virtual address in the mapped page. */
+
+	if (out)
+		flush_dcache_page(walk->page);
+
+	if (more) {
+		walk->len_this_segment -= walk->len_this_page;
+
+		if (walk->len_this_segment) {
+			walk->page++;
+			walk->len_this_page = min(walk->len_this_segment,
+						  (unsigned)PAGE_CACHE_SIZE);
+			walk->offset = 0;
+		}
+		else
+			scatterwalk_start(walk, sg_next(walk->sg));
+	}
+}
+
+void scatterwalk_done(struct scatter_walk *walk, int out, int more)
+{
+	crypto_kunmap(walk->data, out);
+	if (walk->len_this_page == 0 || !more)
+		scatterwalk_pagedone(walk, out, more);
+}
+
+/*
+ * Do not call this unless the total length of all of the fragments
+ * has been verified as multiple of the block size.
+ */
+int scatterwalk_copychunks(void *buf, struct scatter_walk *walk,
+			   size_t nbytes, int out)
+{
+	if (buf != walk->data) {
+		while (nbytes > walk->len_this_page) {
+			memcpy_dir(buf, walk->data, walk->len_this_page, out);
+			buf += walk->len_this_page;
+			nbytes -= walk->len_this_page;
+
+			crypto_kunmap(walk->data, out);
+			scatterwalk_pagedone(walk, out, 1);
+			scatterwalk_map(walk, out);
+		}
+
+		memcpy_dir(buf, walk->data, nbytes, out);
+	}
+
+	walk->offset += nbytes;
+	walk->len_this_page -= nbytes;
+	walk->len_this_segment -= nbytes;
+	return 0;
+}
diff --git a/drivers/staging/rtl8192u/ieee80211/scatterwalk.h b/drivers/staging/rtl8192u/ieee80211/scatterwalk.h
new file mode 100644
index 000000000000..b16446519017
--- /dev/null
+++ b/drivers/staging/rtl8192u/ieee80211/scatterwalk.h
@@ -0,0 +1,51 @@
+/*
+ * Cryptographic API.
+ *
+ * Copyright (c) 2002 James Morris <jmorris@intercode.com.au>
+ * Copyright (c) 2002 Adam J. Richter <adam@yggdrasil.com>
+ * Copyright (c) 2004 Jean-Luc Cooke <jlcooke@certainkey.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2 of the License, or (at your option)
+ * any later version.
+ *
+ */
+
+#ifndef _CRYPTO_SCATTERWALK_H
+#define _CRYPTO_SCATTERWALK_H
+#include <linux/mm.h>
+#include <asm/scatterlist.h>
+
+struct scatter_walk {
+	struct scatterlist	*sg;
+	struct page		*page;
+	void			*data;
+	unsigned int		len_this_page;
+	unsigned int		len_this_segment;
+	unsigned int		offset;
+};
+
+/* Define sg_next is an inline routine now in case we want to change
+   scatterlist to a linked list later. */
+static inline struct scatterlist *sg_next(struct scatterlist *sg)
+{
+	return sg + 1;
+}
+
+static inline int scatterwalk_samebuf(struct scatter_walk *walk_in,
+				      struct scatter_walk *walk_out,
+				      void *src_p, void *dst_p)
+{
+	return walk_in->page == walk_out->page &&
+	       walk_in->offset == walk_out->offset &&
+	       walk_in->data == src_p && walk_out->data == dst_p;
+}
+
+void *scatterwalk_whichbuf(struct scatter_walk *walk, unsigned int nbytes, void *scratch);
+void scatterwalk_start(struct scatter_walk *walk, struct scatterlist *sg);
+int scatterwalk_copychunks(void *buf, struct scatter_walk *walk, size_t nbytes, int out);
+void scatterwalk_map(struct scatter_walk *walk, int out);
+void scatterwalk_done(struct scatter_walk *walk, int out, int more);
+
+#endif  /* _CRYPTO_SCATTERWALK_H */
diff --git a/drivers/staging/rtl8192u/ieee80211_crypt.h b/drivers/staging/rtl8192u/ieee80211_crypt.h
new file mode 100644
index 000000000000..b58a3bcc0dc0
--- /dev/null
+++ b/drivers/staging/rtl8192u/ieee80211_crypt.h
@@ -0,0 +1,86 @@
+/*
+ * Original code based on Host AP (software wireless LAN access point) driver
+ * for Intersil Prism2/2.5/3.
+ *
+ * Copyright (c) 2001-2002, SSH Communications Security Corp and Jouni Malinen
+ * <jkmaline@cc.hut.fi>
+ * Copyright (c) 2002-2003, Jouni Malinen <jkmaline@cc.hut.fi>
+ *
+ * Adaption to a generic IEEE 802.11 stack by James Ketrenos
+ * <jketreno@linux.intel.com>
+ *
+ * Copyright (c) 2004, Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation. See README and COPYING for
+ * more details.
+ */
+
+/*
+ * This file defines the interface to the ieee80211 crypto module.
+ */
+#ifndef IEEE80211_CRYPT_H
+#define IEEE80211_CRYPT_H
+
+#include <linux/skbuff.h>
+
+struct ieee80211_crypto_ops {
+	const char *name;
+
+	/* init new crypto context (e.g., allocate private data space,
+	 * select IV, etc.); returns NULL on failure or pointer to allocated
+	 * private data on success */
+	void * (*init)(int keyidx);
+
+	/* deinitialize crypto context and free allocated private data */
+	void (*deinit)(void *priv);
+
+	/* encrypt/decrypt return < 0 on error or >= 0 on success. The return
+	 * value from decrypt_mpdu is passed as the keyidx value for
+	 * decrypt_msdu. skb must have enough head and tail room for the
+	 * encryption; if not, error will be returned; these functions are
+	 * called for all MPDUs (i.e., fragments).
+	 */
+	int (*encrypt_mpdu)(struct sk_buff *skb, int hdr_len, void *priv);
+	int (*decrypt_mpdu)(struct sk_buff *skb, int hdr_len, void *priv);
+
+	/* These functions are called for full MSDUs, i.e. full frames.
+	 * These can be NULL if full MSDU operations are not needed. */
+	int (*encrypt_msdu)(struct sk_buff *skb, int hdr_len, void *priv);
+	int (*decrypt_msdu)(struct sk_buff *skb, int keyidx, int hdr_len,
+			    void *priv);
+
+	int (*set_key)(void *key, int len, u8 *seq, void *priv);
+	int (*get_key)(void *key, int len, u8 *seq, void *priv);
+
+	/* procfs handler for printing out key information and possible
+	 * statistics */
+	char * (*print_stats)(char *p, void *priv);
+
+	/* maximum number of bytes added by encryption; encrypt buf is
+	 * allocated with extra_prefix_len bytes, copy of in_buf, and
+	 * extra_postfix_len; encrypt need not use all this space, but
+	 * the result must start at the beginning of the buffer and correct
+	 * length must be returned */
+	int extra_prefix_len, extra_postfix_len;
+
+	struct module *owner;
+};
+
+struct ieee80211_crypt_data {
+	struct list_head list; /* delayed deletion list */
+	struct ieee80211_crypto_ops *ops;
+	void *priv;
+	atomic_t refcnt;
+};
+
+int ieee80211_register_crypto_ops(struct ieee80211_crypto_ops *ops);
+int ieee80211_unregister_crypto_ops(struct ieee80211_crypto_ops *ops);
+struct ieee80211_crypto_ops * ieee80211_get_crypto_ops(const char *name);
+void ieee80211_crypt_deinit_entries(struct ieee80211_device *, int);
+void ieee80211_crypt_deinit_handler(unsigned long);
+void ieee80211_crypt_delayed_deinit(struct ieee80211_device *ieee,
+				    struct ieee80211_crypt_data **crypt);
+
+#endif
diff --git a/drivers/staging/rtl8192u/r8180_93cx6.c b/drivers/staging/rtl8192u/r8180_93cx6.c
new file mode 100644
index 000000000000..8878cfeb0fbb
--- /dev/null
+++ b/drivers/staging/rtl8192u/r8180_93cx6.c
@@ -0,0 +1,146 @@
+/*
+   This files contains card eeprom (93c46 or 93c56) programming routines,
+   memory is addressed by 16 bits words.
+
+   This is part of rtl8180 OpenSource driver.
+   Copyright (C) Andrea Merello 2004  <andreamrl@tiscali.it>
+   Released under the terms of GPL (General Public Licence)
+
+   Parts of this driver are based on the GPL part of the
+   official realtek driver.
+
+   Parts of this driver are based on the rtl8180 driver skeleton
+   from Patric Schenke & Andres Salomon.
+
+   Parts of this driver are based on the Intel Pro Wireless 2100 GPL driver.
+
+   We want to tanks the Authors of those projects and the Ndiswrapper
+   project Authors.
+*/
+
+#include "r8180_93cx6.h"
+
+void eprom_cs(struct net_device *dev, short bit)
+{
+	if(bit)
+		write_nic_byte_E(dev, EPROM_CMD,
+			       (1<<EPROM_CS_SHIFT) | \
+			       read_nic_byte_E(dev, EPROM_CMD)); //enable EPROM
+	else
+		write_nic_byte_E(dev, EPROM_CMD, read_nic_byte_E(dev, EPROM_CMD)\
+			       &~(1<<EPROM_CS_SHIFT)); //disable EPROM
+
+	force_pci_posting(dev);
+	udelay(EPROM_DELAY);
+}
+
+
+void eprom_ck_cycle(struct net_device *dev)
+{
+	write_nic_byte_E(dev, EPROM_CMD,
+		       (1<<EPROM_CK_SHIFT) | read_nic_byte_E(dev,EPROM_CMD));
+	force_pci_posting(dev);
+	udelay(EPROM_DELAY);
+	write_nic_byte_E(dev, EPROM_CMD,
+		       read_nic_byte_E(dev, EPROM_CMD) &~ (1<<EPROM_CK_SHIFT));
+	force_pci_posting(dev);
+	udelay(EPROM_DELAY);
+}
+
+
+void eprom_w(struct net_device *dev,short bit)
+{
+	if(bit)
+		write_nic_byte_E(dev, EPROM_CMD, (1<<EPROM_W_SHIFT) | \
+			       read_nic_byte_E(dev,EPROM_CMD));
+	else
+		write_nic_byte_E(dev, EPROM_CMD, read_nic_byte_E(dev,EPROM_CMD)\
+			       &~(1<<EPROM_W_SHIFT));
+
+	force_pci_posting(dev);
+	udelay(EPROM_DELAY);
+}
+
+
+short eprom_r(struct net_device *dev)
+{
+	short bit;
+
+	bit=(read_nic_byte_E(dev, EPROM_CMD) & (1<<EPROM_R_SHIFT) );
+	udelay(EPROM_DELAY);
+
+	if(bit) return 1;
+	return 0;
+}
+
+
+void eprom_send_bits_string(struct net_device *dev, short b[], int len)
+{
+	int i;
+
+	for(i=0; i<len; i++){
+		eprom_w(dev, b[i]);
+		eprom_ck_cycle(dev);
+	}
+}
+
+
+u32 eprom_read(struct net_device *dev, u32 addr)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	short read_cmd[]={1,1,0};
+	short addr_str[8];
+	int i;
+	int addr_len;
+	u32 ret;
+
+	ret=0;
+        //enable EPROM programming
+	write_nic_byte_E(dev, EPROM_CMD,
+		       (EPROM_CMD_PROGRAM<<EPROM_CMD_OPERATING_MODE_SHIFT));
+	force_pci_posting(dev);
+	udelay(EPROM_DELAY);
+
+	if (priv->epromtype==EPROM_93c56){
+		addr_str[7]=addr & 1;
+		addr_str[6]=addr & (1<<1);
+		addr_str[5]=addr & (1<<2);
+		addr_str[4]=addr & (1<<3);
+		addr_str[3]=addr & (1<<4);
+		addr_str[2]=addr & (1<<5);
+		addr_str[1]=addr & (1<<6);
+		addr_str[0]=addr & (1<<7);
+		addr_len=8;
+	}else{
+		addr_str[5]=addr & 1;
+		addr_str[4]=addr & (1<<1);
+		addr_str[3]=addr & (1<<2);
+		addr_str[2]=addr & (1<<3);
+		addr_str[1]=addr & (1<<4);
+		addr_str[0]=addr & (1<<5);
+		addr_len=6;
+	}
+	eprom_cs(dev, 1);
+	eprom_ck_cycle(dev);
+	eprom_send_bits_string(dev, read_cmd, 3);
+	eprom_send_bits_string(dev, addr_str, addr_len);
+
+	//keep chip pin D to low state while reading.
+	//I'm unsure if it is necessary, but anyway shouldn't hurt
+	eprom_w(dev, 0);
+
+	for(i=0;i<16;i++){
+		//eeprom needs a clk cycle between writing opcode&adr
+		//and reading data. (eeprom outs a dummy 0)
+		eprom_ck_cycle(dev);
+		ret |= (eprom_r(dev)<<(15-i));
+	}
+
+	eprom_cs(dev, 0);
+	eprom_ck_cycle(dev);
+
+	//disable EPROM programming
+	write_nic_byte_E(dev, EPROM_CMD,
+		       (EPROM_CMD_NORMAL<<EPROM_CMD_OPERATING_MODE_SHIFT));
+	return ret;
+}
diff --git a/drivers/staging/rtl8192u/r8180_93cx6.h b/drivers/staging/rtl8192u/r8180_93cx6.h
new file mode 100644
index 000000000000..fb3ac9766ea5
--- /dev/null
+++ b/drivers/staging/rtl8192u/r8180_93cx6.h
@@ -0,0 +1,40 @@
+/*
+	This is part of rtl8187 OpenSource driver
+	Copyright (C) Andrea Merello 2004-2005  <andreamrl@tiscali.it>
+	Released under the terms of GPL (General Public Licence)
+
+	Parts of this driver are based on the GPL part of the official realtek driver
+	Parts of this driver are based on the rtl8180 driver skeleton from Patric Schenke & Andres Salomon
+	Parts of this driver are based on the Intel Pro Wireless 2100 GPL driver
+
+	We want to tanks the Authors of such projects and the Ndiswrapper project Authors.
+*/
+
+/*This files contains card eeprom (93c46 or 93c56) programming routines*/
+/*memory is addressed by WORDS*/
+
+#include "r8192U.h"
+#include "r8192U_hw.h"
+
+#define EPROM_DELAY 10
+
+#define EPROM_ANAPARAM_ADDRLWORD 0xd
+#define EPROM_ANAPARAM_ADDRHWORD 0xe
+
+#define EPROM_RFCHIPID 0x6
+#define EPROM_TXPW_BASE 0x05
+#define EPROM_RFCHIPID_RTL8225U 5
+#define EPROM_RF_PARAM 0x4
+#define EPROM_CONFIG2 0xc
+
+#define EPROM_VERSION 0x1E
+#define MAC_ADR 0x7
+
+#define CIS 0x18
+
+#define EPROM_TXPW0 0x16
+#define EPROM_TXPW2 0x1b
+#define EPROM_TXPW1 0x3d
+
+
+u32 eprom_read(struct net_device *dev,u32 addr); //reads a 16 bits word
diff --git a/drivers/staging/rtl8192u/r8180_pm.c b/drivers/staging/rtl8192u/r8180_pm.c
new file mode 100644
index 000000000000..0c58d0ed502a
--- /dev/null
+++ b/drivers/staging/rtl8192u/r8180_pm.c
@@ -0,0 +1,48 @@
+/*
+   Power management interface routines.
+   Written by Mariusz Matuszek.
+   This code is currently just a placeholder for later work and
+   does not do anything useful.
+
+   This is part of rtl8180 OpenSource driver.
+   Copyright (C) Andrea Merello 2004  <andreamrl@tiscali.it>
+   Released under the terms of GPL (General Public Licence)
+*/
+
+#ifdef CONFIG_RTL8180_PM
+
+
+#include "r8180_hw.h"
+#include "r8180_pm.h"
+
+int rtl8180_save_state (struct pci_dev *dev, u32 state)
+{
+	printk(KERN_NOTICE "r8180 save state call (state %u).\n", state);
+	return(-EAGAIN);
+}
+
+
+int rtl8180_suspend (struct pci_dev *dev, u32 state)
+{
+	printk(KERN_NOTICE "r8180 suspend call (state %u).\n", state);
+	return(-EAGAIN);
+}
+
+
+int rtl8180_resume (struct pci_dev *dev)
+{
+	printk(KERN_NOTICE "r8180 resume call.\n");
+	return(-EAGAIN);
+}
+
+
+int rtl8180_enable_wake (struct pci_dev *dev, u32 state, int enable)
+{
+	printk(KERN_NOTICE "r8180 enable wake call (state %u, enable %d).\n",
+	       state, enable);
+	return(-EAGAIN);
+}
+
+
+
+#endif //CONFIG_RTL8180_PM
diff --git a/drivers/staging/rtl8192u/r8180_pm.h b/drivers/staging/rtl8192u/r8180_pm.h
new file mode 100644
index 000000000000..c7d18a8b79a1
--- /dev/null
+++ b/drivers/staging/rtl8192u/r8180_pm.h
@@ -0,0 +1,28 @@
+/*
+        Power management interface routines.
+	Written by Mariusz Matuszek.
+	This code is currently just a placeholder for later work and
+	does not do anything useful.
+
+	This is part of rtl8180 OpenSource driver.
+	Copyright (C) Andrea Merello 2004  <andreamrl@tiscali.it>
+	Released under the terms of GPL (General Public Licence)
+
+*/
+
+#ifdef CONFIG_RTL8180_PM
+
+#ifndef R8180_PM_H
+#define R8180_PM_H
+
+#include <linux/types.h>
+#include <linux/pci.h>
+
+int rtl8180_save_state (struct pci_dev *dev, u32 state);
+int rtl8180_suspend (struct pci_dev *dev, u32 state);
+int rtl8180_resume (struct pci_dev *dev);
+int rtl8180_enable_wake (struct pci_dev *dev, u32 state, int enable);
+
+#endif //R8180_PM_H
+
+#endif // CONFIG_RTL8180_PM
diff --git a/drivers/staging/rtl8192u/r8190_rtl8256.c b/drivers/staging/rtl8192u/r8190_rtl8256.c
new file mode 100644
index 000000000000..74ff337b0583
--- /dev/null
+++ b/drivers/staging/rtl8192u/r8190_rtl8256.c
@@ -0,0 +1,312 @@
+/*
+  This is part of the rtl8192 driver
+  released under the GPL (See file COPYING for details).
+
+  This files contains programming code for the rtl8256
+  radio frontend.
+
+  *Many* thanks to Realtek Corp. for their great support!
+
+*/
+
+#include "r8192U.h"
+#include "r8192U_hw.h"
+#include "r819xU_phyreg.h"
+#include "r819xU_phy.h"
+#include "r8190_rtl8256.h"
+
+/*--------------------------------------------------------------------------
+ * Overview:   	set RF band width (20M or 40M)
+ * Input:       struct net_device*	dev
+ * 		WIRELESS_BANDWIDTH_E	Bandwidth	//20M or 40M
+ * Output:      NONE
+ * Return:      NONE
+ * Note:	8226 support both 20M  and 40 MHz
+ *---------------------------------------------------------------------------*/
+void PHY_SetRF8256Bandwidth(struct net_device* dev , HT_CHANNEL_WIDTH Bandwidth)	//20M or 40M
+{
+	u8	eRFPath;
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+	//for(eRFPath = RF90_PATH_A; eRFPath <pHalData->NumTotalRFPath; eRFPath++)
+	for(eRFPath = 0; eRFPath <RF90_PATH_MAX; eRFPath++)
+	{
+		if (!rtl8192_phy_CheckIsLegalRFPath(dev, eRFPath))
+				continue;
+
+		switch(Bandwidth)
+		{
+			case HT_CHANNEL_WIDTH_20:
+				if(priv->card_8192_version == VERSION_819xU_A || priv->card_8192_version == VERSION_819xU_B)// 8256 D-cut, E-cut, xiong: consider it later!
+				{
+					rtl8192_phy_SetRFReg(dev, (RF90_RADIO_PATH_E)eRFPath, 0x0b, bMask12Bits, 0x100); //phy para:1ba
+					rtl8192_phy_SetRFReg(dev, (RF90_RADIO_PATH_E)eRFPath, 0x2c, bMask12Bits, 0x3d7);
+					rtl8192_phy_SetRFReg(dev, (RF90_RADIO_PATH_E)eRFPath, 0x0e, bMask12Bits, 0x021);
+
+					//cosa add for sd3's request 01/23/2008
+					rtl8192_phy_SetRFReg(dev, (RF90_RADIO_PATH_E)eRFPath, 0x14, bMask12Bits, 0x5ab);
+				}
+				else
+				{
+					RT_TRACE(COMP_ERR, "PHY_SetRF8256Bandwidth(): unknown hardware version\n");
+				}
+
+				break;
+			case HT_CHANNEL_WIDTH_20_40:
+				if(priv->card_8192_version == VERSION_819xU_A ||priv->card_8192_version == VERSION_819xU_B)// 8256 D-cut, E-cut, xiong: consider it later!
+				{
+					rtl8192_phy_SetRFReg(dev, (RF90_RADIO_PATH_E)eRFPath, 0x0b, bMask12Bits, 0x300); //phy para:3ba
+					rtl8192_phy_SetRFReg(dev, (RF90_RADIO_PATH_E)eRFPath, 0x2c, bMask12Bits, 0x3df);
+					rtl8192_phy_SetRFReg(dev, (RF90_RADIO_PATH_E)eRFPath, 0x0e, bMask12Bits, 0x0a1);
+
+					//cosa add for sd3's request 01/23/2008
+					if(priv->chan == 3 || priv->chan == 9) //I need to set priv->chan whenever current channel changes
+						rtl8192_phy_SetRFReg(dev, (RF90_RADIO_PATH_E)eRFPath, 0x14, bMask12Bits, 0x59b);
+					else
+						rtl8192_phy_SetRFReg(dev, (RF90_RADIO_PATH_E)eRFPath, 0x14, bMask12Bits, 0x5ab);
+				}
+				else
+				{
+					RT_TRACE(COMP_ERR, "PHY_SetRF8256Bandwidth(): unknown hardware version\n");
+				}
+
+
+				break;
+			default:
+				RT_TRACE(COMP_ERR, "PHY_SetRF8256Bandwidth(): unknown Bandwidth: %#X\n",Bandwidth );
+				break;
+
+		}
+	}
+	return;
+}
+/*--------------------------------------------------------------------------
+ * Overview:    Interface to config 8256
+ * Input:       struct net_device*	dev
+ * Output:      NONE
+ * Return:      NONE
+ *---------------------------------------------------------------------------*/
+void PHY_RF8256_Config(struct net_device* dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	// Initialize general global value
+	//
+	// TODO: Extend RF_PATH_C and RF_PATH_D in the future
+	priv->NumTotalRFPath = RTL819X_TOTAL_RF_PATH;
+	// Config BB and RF
+	phy_RF8256_Config_ParaFile(dev);
+
+	return;
+}
+/*--------------------------------------------------------------------------
+ * Overview:    Interface to config 8256
+ * Input:       struct net_device*	dev
+ * Output:      NONE
+ * Return:      NONE
+ *---------------------------------------------------------------------------*/
+void phy_RF8256_Config_ParaFile(struct net_device* dev)
+{
+	u32 	u4RegValue = 0;
+	//static s1Byte				szRadioAFile[] = RTL819X_PHY_RADIO_A;
+	//static s1Byte				szRadioBFile[] = RTL819X_PHY_RADIO_B;
+	//static s1Byte				szRadioCFile[] = RTL819X_PHY_RADIO_C;
+	//static s1Byte				szRadioDFile[] = RTL819X_PHY_RADIO_D;
+	u8 	eRFPath;
+	BB_REGISTER_DEFINITION_T	*pPhyReg;
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	u32	RegOffSetToBeCheck = 0x3;
+	u32 	RegValueToBeCheck = 0x7f1;
+	u32	RF3_Final_Value = 0;
+	u8	ConstRetryTimes = 5, RetryTimes = 5;
+	u8 ret = 0;
+	//3//-----------------------------------------------------------------
+	//3// <2> Initialize RF
+	//3//-----------------------------------------------------------------
+	for(eRFPath = (RF90_RADIO_PATH_E)RF90_PATH_A; eRFPath <priv->NumTotalRFPath; eRFPath++)
+	{
+		if (!rtl8192_phy_CheckIsLegalRFPath(dev, eRFPath))
+				continue;
+
+		pPhyReg = &priv->PHYRegDef[eRFPath];
+
+		// Joseph test for shorten RF config
+	//	pHalData->RfReg0Value[eRFPath] =  rtl8192_phy_QueryRFReg(dev, (RF90_RADIO_PATH_E)eRFPath, rGlobalCtrl, bMaskDWord);
+
+		/*----Store original RFENV control type----*/
+		switch(eRFPath)
+		{
+		case RF90_PATH_A:
+		case RF90_PATH_C:
+			u4RegValue = rtl8192_QueryBBReg(dev, pPhyReg->rfintfs, bRFSI_RFENV);
+			break;
+		case RF90_PATH_B :
+		case RF90_PATH_D:
+			u4RegValue = rtl8192_QueryBBReg(dev, pPhyReg->rfintfs, bRFSI_RFENV<<16);
+			break;
+		}
+
+		/*----Set RF_ENV enable----*/
+		rtl8192_setBBreg(dev, pPhyReg->rfintfe, bRFSI_RFENV<<16, 0x1);
+
+		/*----Set RF_ENV output high----*/
+		rtl8192_setBBreg(dev, pPhyReg->rfintfo, bRFSI_RFENV, 0x1);
+
+		/* Set bit number of Address and Data for RF register */
+		rtl8192_setBBreg(dev, pPhyReg->rfHSSIPara2, b3WireAddressLength, 0x0); 	// Set 0 to 4 bits for Z-serial and set 1 to 6 bits for 8258
+		rtl8192_setBBreg(dev, pPhyReg->rfHSSIPara2, b3WireDataLength, 0x0);	// Set 0 to 12 bits for Z-serial and 8258, and set 1 to 14 bits for ???
+
+		rtl8192_phy_SetRFReg(dev, (RF90_RADIO_PATH_E) eRFPath, 0x0, bMask12Bits, 0xbf);
+
+		/*----Check RF block (for FPGA platform only)----*/
+		// TODO: this function should be removed on ASIC , Emily 2007.2.2
+		if (rtl8192_phy_checkBBAndRF(dev, HW90_BLOCK_RF, (RF90_RADIO_PATH_E)eRFPath))
+		{
+			RT_TRACE(COMP_ERR, "PHY_RF8256_Config():Check Radio[%d] Fail!!\n", eRFPath);
+			goto phy_RF8256_Config_ParaFile_Fail;
+		}
+
+		RetryTimes = ConstRetryTimes;
+		RF3_Final_Value = 0;
+		/*----Initialize RF fom connfiguration file----*/
+		switch(eRFPath)
+		{
+		case RF90_PATH_A:
+			while(RF3_Final_Value!=RegValueToBeCheck && RetryTimes!=0)
+			{
+				ret = rtl8192_phy_ConfigRFWithHeaderFile(dev,(RF90_RADIO_PATH_E)eRFPath);
+				RF3_Final_Value = rtl8192_phy_QueryRFReg(dev, (RF90_RADIO_PATH_E)eRFPath, RegOffSetToBeCheck, bMask12Bits);
+				RT_TRACE(COMP_RF, "RF %d %d register final value: %x\n", eRFPath, RegOffSetToBeCheck, RF3_Final_Value);
+				RetryTimes--;
+			}
+			break;
+		case RF90_PATH_B:
+			while(RF3_Final_Value!=RegValueToBeCheck && RetryTimes!=0)
+			{
+				ret = rtl8192_phy_ConfigRFWithHeaderFile(dev,(RF90_RADIO_PATH_E)eRFPath);
+				RF3_Final_Value = rtl8192_phy_QueryRFReg(dev, (RF90_RADIO_PATH_E)eRFPath, RegOffSetToBeCheck, bMask12Bits);
+				RT_TRACE(COMP_RF, "RF %d %d register final value: %x\n", eRFPath, RegOffSetToBeCheck, RF3_Final_Value);
+				RetryTimes--;
+			}
+			break;
+		case RF90_PATH_C:
+			while(RF3_Final_Value!=RegValueToBeCheck && RetryTimes!=0)
+			{
+				ret = rtl8192_phy_ConfigRFWithHeaderFile(dev,(RF90_RADIO_PATH_E)eRFPath);
+				RF3_Final_Value = rtl8192_phy_QueryRFReg(dev, (RF90_RADIO_PATH_E)eRFPath, RegOffSetToBeCheck, bMask12Bits);
+				RT_TRACE(COMP_RF, "RF %d %d register final value: %x\n", eRFPath, RegOffSetToBeCheck, RF3_Final_Value);
+				RetryTimes--;
+			}
+			break;
+		case RF90_PATH_D:
+			while(RF3_Final_Value!=RegValueToBeCheck && RetryTimes!=0)
+			{
+				ret = rtl8192_phy_ConfigRFWithHeaderFile(dev,(RF90_RADIO_PATH_E)eRFPath);
+				RF3_Final_Value = rtl8192_phy_QueryRFReg(dev, (RF90_RADIO_PATH_E)eRFPath, RegOffSetToBeCheck, bMask12Bits);
+				RT_TRACE(COMP_RF, "RF %d %d register final value: %x\n", eRFPath, RegOffSetToBeCheck, RF3_Final_Value);
+				RetryTimes--;
+			}
+			break;
+		}
+
+		/*----Restore RFENV control type----*/;
+		switch(eRFPath)
+		{
+		case RF90_PATH_A:
+		case RF90_PATH_C:
+			rtl8192_setBBreg(dev, pPhyReg->rfintfs, bRFSI_RFENV, u4RegValue);
+			break;
+		case RF90_PATH_B :
+		case RF90_PATH_D:
+			rtl8192_setBBreg(dev, pPhyReg->rfintfs, bRFSI_RFENV<<16, u4RegValue);
+			break;
+		}
+
+		if(ret){
+			RT_TRACE(COMP_ERR, "phy_RF8256_Config_ParaFile():Radio[%d] Fail!!", eRFPath);
+			goto phy_RF8256_Config_ParaFile_Fail;
+		}
+
+	}
+
+	RT_TRACE(COMP_PHY, "PHY Initialization Success\n") ;
+	return ;
+
+phy_RF8256_Config_ParaFile_Fail:
+	RT_TRACE(COMP_ERR, "PHY Initialization failed\n") ;
+	return ;
+}
+
+
+void PHY_SetRF8256CCKTxPower(struct net_device*	dev, u8	powerlevel)
+{
+	u32	TxAGC=0;
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	//modified by vivi, 20080109
+	TxAGC = powerlevel;
+
+	if(priv->bDynamicTxLowPower == TRUE ) //cosa 05/22/2008 for scan
+	{
+		if(priv->CustomerID == RT_CID_819x_Netcore)
+			TxAGC = 0x22;
+		else
+		TxAGC += priv->CckPwEnl;
+	}
+
+	if(TxAGC > 0x24)
+		TxAGC = 0x24;
+	rtl8192_setBBreg(dev, rTxAGC_CCK_Mcs32, bTxAGCRateCCK, TxAGC);
+}
+
+
+void PHY_SetRF8256OFDMTxPower(struct net_device* dev, u8 powerlevel)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	//Joseph TxPower for 8192 testing
+	u32 writeVal, powerBase0, powerBase1, writeVal_tmp;
+	u8 index = 0;
+	u16 RegOffset[6] = {0xe00, 0xe04, 0xe10, 0xe14, 0xe18, 0xe1c};
+	u8 byte0, byte1, byte2, byte3;
+
+	powerBase0 = powerlevel + priv->TxPowerDiff;	//OFDM rates
+	powerBase0 = (powerBase0<<24) | (powerBase0<<16) |(powerBase0<<8) |powerBase0;
+	powerBase1 = powerlevel;							//MCS rates
+	powerBase1 = (powerBase1<<24) | (powerBase1<<16) |(powerBase1<<8) |powerBase1;
+
+	for(index=0; index<6; index++)
+	{
+		writeVal = priv->MCSTxPowerLevelOriginalOffset[index] + ((index<2)?powerBase0:powerBase1);
+		byte0 = (u8)(writeVal & 0x7f);
+		byte1 = (u8)((writeVal & 0x7f00)>>8);
+		byte2 = (u8)((writeVal & 0x7f0000)>>16);
+		byte3 = (u8)((writeVal & 0x7f000000)>>24);
+		if(byte0 > 0x24)	// Max power index = 0x24
+			byte0 = 0x24;
+		if(byte1 > 0x24)
+			byte1 = 0x24;
+		if(byte2 > 0x24)
+			byte2 = 0x24;
+		if(byte3 > 0x24)
+			byte3 = 0x24;
+
+		//for tx power track
+		if(index == 3)
+		{
+			writeVal_tmp = (byte3<<24) | (byte2<<16) |(byte1<<8) |byte0;
+			priv->Pwr_Track = writeVal_tmp;
+		}
+
+		if(priv->bDynamicTxHighPower == TRUE)     //Add by Jacken 2008/03/06
+		{
+			// Emily, 20080613. Set low tx power for both MCS and legacy OFDM
+			writeVal = 0x03030303;
+		}
+		else
+		{
+			writeVal = (byte3<<24) | (byte2<<16) |(byte1<<8) |byte0;
+		}
+		rtl8192_setBBreg(dev, RegOffset[index], 0x7f7f7f7f, writeVal);
+	}
+	return;
+
+}
+
diff --git a/drivers/staging/rtl8192u/r8190_rtl8256.h b/drivers/staging/rtl8192u/r8190_rtl8256.h
new file mode 100644
index 000000000000..5c1f650fe824
--- /dev/null
+++ b/drivers/staging/rtl8192u/r8190_rtl8256.h
@@ -0,0 +1,27 @@
+/*
+  This is part of the rtl8180-sa2400 driver
+  released under the GPL (See file COPYING for details).
+  Copyright (c) 2005 Andrea Merello <andreamrl@tiscali.it>
+
+  This files contains programming code for the rtl8256
+  radio frontend.
+
+  *Many* thanks to Realtek Corp. for their great support!
+
+*/
+
+#ifndef RTL8225H
+#define RTL8225H
+
+#ifdef RTL8190P
+#define RTL819X_TOTAL_RF_PATH 4 //for 90P
+#else
+#define RTL819X_TOTAL_RF_PATH 2 //for 8192U
+#endif
+extern void PHY_SetRF8256Bandwidth(struct net_device* dev , HT_CHANNEL_WIDTH Bandwidth);
+extern void PHY_RF8256_Config(struct net_device* dev);
+extern void phy_RF8256_Config_ParaFile(struct net_device* dev);
+extern void PHY_SetRF8256CCKTxPower(struct net_device*	dev, u8	powerlevel);
+extern void PHY_SetRF8256OFDMTxPower(struct net_device* dev, u8 powerlevel);
+
+#endif
diff --git a/drivers/staging/rtl8192u/r8192U.h b/drivers/staging/rtl8192u/r8192U.h
new file mode 100644
index 000000000000..69a2721e850c
--- /dev/null
+++ b/drivers/staging/rtl8192u/r8192U.h
@@ -0,0 +1,1263 @@
+/*
+   This is part of rtl8187 OpenSource driver.
+   Copyright (C) Andrea Merello 2004-2005  <andreamrl@tiscali.it>
+   Released under the terms of GPL (General Public Licence)
+
+   Parts of this driver are based on the GPL part of the
+   official realtek driver
+
+   Parts of this driver are based on the rtl8192 driver skeleton
+   from Patric Schenke & Andres Salomon
+
+   Parts of this driver are based on the Intel Pro Wireless 2100 GPL driver
+
+   We want to tanks the Authors of those projects and the Ndiswrapper
+   project Authors.
+*/
+
+#ifndef R819xU_H
+#define R819xU_H
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+//#include <linux/config.h>
+#include <linux/init.h>
+#include <linux/ioport.h>
+#include <linux/sched.h>
+#include <linux/types.h>
+#include <linux/slab.h>
+#include <linux/netdevice.h>
+//#include <linux/pci.h>
+#include <linux/usb.h>
+#include <linux/etherdevice.h>
+#include <linux/delay.h>
+#include <linux/rtnetlink.h>	//for rtnl_lock()
+#include <linux/wireless.h>
+#include <linux/timer.h>
+#include <linux/proc_fs.h>	// Necessary because we use the proc fs
+#include <linux/if_arp.h>
+#include <linux/random.h>
+#include <linux/version.h>
+#include <asm/io.h>
+#include "ieee80211.h"
+
+#define RTL8192U
+#define RTL819xU_MODULE_NAME "rtl819xU"
+//added for HW security, john.0629
+#define FALSE 0
+#define TRUE 1
+#define MAX_KEY_LEN     61
+#define KEY_BUF_SIZE    5
+
+#define BIT0            0x00000001
+#define BIT1            0x00000002
+#define BIT2            0x00000004
+#define BIT3            0x00000008
+#define BIT4            0x00000010
+#define BIT5            0x00000020
+#define BIT6            0x00000040
+#define BIT7            0x00000080
+#define BIT8            0x00000100
+#define BIT9            0x00000200
+#define BIT10           0x00000400
+#define BIT11           0x00000800
+#define BIT12           0x00001000
+#define BIT13           0x00002000
+#define BIT14           0x00004000
+#define BIT15           0x00008000
+#define BIT16           0x00010000
+#define BIT17           0x00020000
+#define BIT18           0x00040000
+#define BIT19           0x00080000
+#define BIT20           0x00100000
+#define BIT21           0x00200000
+#define BIT22           0x00400000
+#define BIT23           0x00800000
+#define BIT24           0x01000000
+#define BIT25           0x02000000
+#define BIT26           0x04000000
+#define BIT27           0x08000000
+#define BIT28           0x10000000
+#define BIT29           0x20000000
+#define BIT30           0x40000000
+#define BIT31           0x80000000
+
+// Rx smooth factor
+#define	Rx_Smooth_Factor		20
+#define DMESG(x,a...)
+#define DMESGW(x,a...)
+#define DMESGE(x,a...)
+extern u32 rt_global_debug_component;
+#define RT_TRACE(component, x, args...) \
+do { if(rt_global_debug_component & component) \
+	printk(KERN_DEBUG RTL819xU_MODULE_NAME ":" x "\n" , \
+	       ##args);\
+}while(0);
+
+#define COMP_TRACE				BIT0		// For function call tracing.
+#define COMP_DBG				BIT1		// Only for temporary debug message.
+#define COMP_INIT				BIT2		// during driver initialization / halt / reset.
+
+
+#define COMP_RECV				BIT3		// Reveive part data path.
+#define COMP_SEND				BIT4		// Send part path.
+#define COMP_IO					BIT5		// I/O Related. Added by Annie, 2006-03-02.
+#define COMP_POWER				BIT6		// 802.11 Power Save mode or System/Device Power state related.
+#define COMP_EPROM				BIT7		// 802.11 link related: join/start BSS, leave BSS.
+#define COMP_SWBW				BIT8	// For bandwidth switch.
+#define COMP_POWER_TRACKING			BIT9	//FOR 8190 TX POWER TRACKING
+#define COMP_TURBO				BIT10	// For Turbo Mode related. By Annie, 2005-10-21.
+#define COMP_QOS				BIT11	// For QoS.
+#define COMP_RATE				BIT12	// For Rate Adaptive mechanism, 2006.07.02, by rcnjko.
+#define COMP_RM					BIT13	// For Radio Measurement.
+#define COMP_DIG				BIT14	// For DIG, 2006.09.25, by rcnjko.
+#define COMP_PHY	 			BIT15
+#define COMP_CH					BIT16	//channel setting debug
+#define COMP_TXAGC				BIT17	// For Tx power, 060928, by rcnjko.
+#define COMP_HIPWR				BIT18	// For High Power Mechanism, 060928, by rcnjko.
+#define COMP_HALDM				BIT19	// For HW Dynamic Mechanism, 061010, by rcnjko.
+#define COMP_SEC			        BIT20	// Event handling
+#define COMP_LED				BIT21	// For LED.
+#define COMP_RF					BIT22	// For RF.
+//1!!!!!!!!!!!!!!!!!!!!!!!!!!!
+#define COMP_RXDESC				BIT23	// Show Rx desc information for SD3 debug. Added by Annie, 2006-07-15.
+//1//1Attention Please!!!<11n or 8190 specific code should be put below this line>
+//1!!!!!!!!!!!!!!!!!!!!!!!!!!!
+
+#define COMP_FIRMWARE				BIT24	//for firmware downloading
+#define COMP_HT					BIT25	// For 802.11n HT related information. by Emily 2006-8-11
+#define COMP_AMSDU				BIT26	// For A-MSDU Debugging
+
+#define COMP_SCAN				BIT27
+//#define COMP_RESET				BIT28
+#define COMP_DOWN				BIT29  //for rm driver module
+#define COMP_RESET				BIT30  //for silent reset
+#define COMP_ERR				BIT31 //for error out, always on
+
+#define RTL819x_DEBUG
+#ifdef RTL819x_DEBUG
+#define assert(expr) \
+        if (!(expr)) {                                  \
+                printk( "Assertion failed! %s,%s,%s,line=%d\n", \
+                #expr,__FILE__,__FUNCTION__,__LINE__);          \
+        }
+//wb added to debug out data buf
+//if you want print DATA buffer related BA, please set ieee80211_debug_level to DATA|BA
+#define RT_DEBUG_DATA(level, data, datalen)      \
+        do{ if ((rt_global_debug_component & (level)) == (level))   \
+                {       \
+                        int i;                                  \
+                        u8* pdata = (u8*) data;                 \
+                        printk(KERN_DEBUG RTL819xU_MODULE_NAME ": %s()\n", __FUNCTION__);   \
+                        for(i=0; i<(int)(datalen); i++)                 \
+                        {                                               \
+                                printk("%2x ", pdata[i]);               \
+                                if ((i+1)%16 == 0) printk("\n");        \
+                        }                               \
+                        printk("\n");                   \
+                }                                       \
+        } while (0)
+#else
+#define assert(expr) do {} while (0)
+#define RT_DEBUG_DATA(level, data, datalen) do {} while(0)
+#endif /* RTL8169_DEBUG */
+
+
+//
+// Queue Select Value in TxDesc
+//
+#define QSLT_BK                                 0x1
+#define QSLT_BE                                 0x0
+#define QSLT_VI                                 0x4
+#define QSLT_VO                                 0x6
+#define QSLT_BEACON                             0x10
+#define QSLT_HIGH                               0x11
+#define QSLT_MGNT                               0x12
+#define QSLT_CMD                                0x13
+
+#define DESC90_RATE1M                           0x00
+#define DESC90_RATE2M                           0x01
+#define DESC90_RATE5_5M                         0x02
+#define DESC90_RATE11M                          0x03
+#define DESC90_RATE6M                           0x04
+#define DESC90_RATE9M                           0x05
+#define DESC90_RATE12M                          0x06
+#define DESC90_RATE18M                          0x07
+#define DESC90_RATE24M                          0x08
+#define DESC90_RATE36M                          0x09
+#define DESC90_RATE48M                          0x0a
+#define DESC90_RATE54M                          0x0b
+#define DESC90_RATEMCS0                         0x00
+#define DESC90_RATEMCS1                         0x01
+#define DESC90_RATEMCS2                         0x02
+#define DESC90_RATEMCS3                         0x03
+#define DESC90_RATEMCS4                         0x04
+#define DESC90_RATEMCS5                         0x05
+#define DESC90_RATEMCS6                         0x06
+#define DESC90_RATEMCS7                         0x07
+#define DESC90_RATEMCS8                         0x08
+#define DESC90_RATEMCS9                         0x09
+#define DESC90_RATEMCS10                        0x0a
+#define DESC90_RATEMCS11                        0x0b
+#define DESC90_RATEMCS12                        0x0c
+#define DESC90_RATEMCS13                        0x0d
+#define DESC90_RATEMCS14                        0x0e
+#define DESC90_RATEMCS15                        0x0f
+#define DESC90_RATEMCS32                        0x20
+
+#define RTL819X_DEFAULT_RF_TYPE RF_1T2R
+
+#define IEEE80211_WATCH_DOG_TIME    2000
+#define		PHY_Beacon_RSSI_SLID_WIN_MAX		10
+//for txpowertracking by amy
+#define 	OFDM_Table_Length	19
+#define	CCK_Table_length	12
+
+/* for rtl819x */
+typedef struct _tx_desc_819x_usb {
+        //DWORD 0
+        u16	PktSize;
+        u8	Offset;
+        u8	Reserved0:3;
+        u8	CmdInit:1;
+        u8	LastSeg:1;
+        u8	FirstSeg:1;
+        u8	LINIP:1;
+        u8	OWN:1;
+
+        //DWORD 1
+        u8	TxFWInfoSize;
+        u8	RATid:3;
+        u8	DISFB:1;
+        u8	USERATE:1;
+        u8	MOREFRAG:1;
+        u8	NoEnc:1;
+        u8	PIFS:1;
+        u8	QueueSelect:5;
+        u8	NoACM:1;
+        u8	Reserved1:2;
+        u8	SecCAMID:5;
+        u8	SecDescAssign:1;
+        u8	SecType:2;
+
+        //DWORD 2
+        u16	TxBufferSize;
+        //u16 Reserved2;
+        u8	ResvForPaddingLen:7;
+        u8	Reserved3:1;
+        u8	Reserved4;
+
+        //DWORD 3, 4, 5
+        u32	Reserved5;
+        u32	Reserved6;
+        u32	Reserved7;
+}tx_desc_819x_usb, *ptx_desc_819x_usb;
+
+#ifdef USB_TX_DRIVER_AGGREGATION_ENABLE
+typedef struct _tx_desc_819x_usb_aggr_subframe {
+	//DWORD 0
+	u16	PktSize;
+	u8	Offset;
+	u8	TxFWInfoSize;
+
+	//DWORD 1
+	u8	RATid:3;
+	u8	DISFB:1;
+	u8	USERATE:1;
+	u8	MOREFRAG:1;
+	u8	NoEnc:1;
+	u8	PIFS:1;
+	u8	QueueSelect:5;
+	u8	NoACM:1;
+	u8	Reserved1:2;
+	u8	SecCAMID:5;
+	u8	SecDescAssign:1;
+	u8	SecType:2;
+	u8	PacketID:7;
+	u8	OWN:1;
+}tx_desc_819x_usb_aggr_subframe, *ptx_desc_819x_usb_aggr_subframe;
+#endif
+
+
+
+typedef struct _tx_desc_cmd_819x_usb {
+        //DWORD 0
+	u16	Reserved0;
+	u8	Reserved1;
+	u8	Reserved2:3;
+	u8	CmdInit:1;
+	u8	LastSeg:1;
+	u8	FirstSeg:1;
+	u8	LINIP:1;
+	u8	OWN:1;
+
+        //DOWRD 1
+	//u32	Reserved3;
+	u8	TxFWInfoSize;
+	u8	Reserved3;
+	u8	QueueSelect;
+	u8	Reserved4;
+
+        //DOWRD 2
+	u16 	TxBufferSize;
+	u16	Reserved5;
+
+       //DWORD 3,4,5
+	//u32	TxBufferAddr;
+	//u32	NextDescAddress;
+	u32	Reserved6;
+	u32	Reserved7;
+	u32	Reserved8;
+}tx_desc_cmd_819x_usb, *ptx_desc_cmd_819x_usb;
+
+
+typedef struct _tx_fwinfo_819x_usb {
+        //DOWRD 0
+        u8		TxRate:7;
+        u8		CtsEnable:1;
+        u8		RtsRate:7;
+        u8		RtsEnable:1;
+        u8		TxHT:1;
+        u8		Short:1;                //Short PLCP for CCK, or short GI for 11n MCS
+        u8		TxBandwidth:1;          // This is used for HT MCS rate only.
+        u8		TxSubCarrier:2;         // This is used for legacy OFDM rate only.
+        u8		STBC:2;
+        u8		AllowAggregation:1;
+        u8		RtsHT:1;                //Interpre RtsRate field as high throughput data rate
+        u8		RtsShort:1;             //Short PLCP for CCK, or short GI for 11n MCS
+        u8		RtsBandwidth:1;         // This is used for HT MCS rate only.
+        u8		RtsSubcarrier:2;        // This is used for legacy OFDM rate only.
+        u8		RtsSTBC:2;
+        u8		EnableCPUDur:1;         //Enable firmware to recalculate and assign packet duration
+
+        //DWORD 1
+        u32		RxMF:2;
+        u32		RxAMD:3;
+        u32		TxPerPktInfoFeedback:1;//1 indicate Tx info gathtered by firmware and returned by Rx Cmd
+        u32		Reserved1:2;
+        u32		TxAGCOffSet:4;
+        u32		TxAGCSign:1;
+        u32		Tx_INFO_RSVD:6;
+	u32		PacketID:13;
+        //u32                Reserved;
+}tx_fwinfo_819x_usb, *ptx_fwinfo_819x_usb;
+
+typedef struct rtl8192_rx_info {
+	struct urb *urb;
+	struct net_device *dev;
+	u8 out_pipe;
+}rtl8192_rx_info ;
+
+typedef struct rx_desc_819x_usb{
+	//DOWRD 0
+	u16                 Length:14;
+	u16                 CRC32:1;
+	u16                 ICV:1;
+	u8                  RxDrvInfoSize;
+	u8                  Shift:2;
+	u8                  PHYStatus:1;
+	u8                  SWDec:1;
+	//u8                LastSeg:1;
+	//u8                FirstSeg:1;
+	//u8                EOR:1;
+	//u8                OWN:1;
+	u8                  Reserved1:4;
+
+	//DWORD 1
+	u32                 Reserved2;
+
+	//DWORD 2
+	//u32               Reserved3;
+
+	//DWORD 3
+	//u32                BufferAddress;
+
+}rx_desc_819x_usb, *prx_desc_819x_usb;
+
+#ifdef USB_RX_AGGREGATION_SUPPORT
+typedef struct _rx_desc_819x_usb_aggr_subframe{
+	//DOWRD 0
+	u16			Length:14;
+	u16			CRC32:1;
+	u16			ICV:1;
+	u8			Offset;
+	u8			RxDrvInfoSize;
+	//DOWRD 1
+	u8			Shift:2;
+	u8			PHYStatus:1;
+	u8			SWDec:1;
+	u8			Reserved1:4;
+	u8			Reserved2;
+	u16			Reserved3;
+	//DWORD 2
+	//u4Byte		Reserved3;
+	//DWORD 3
+	//u4Byte           	BufferAddress;
+}rx_desc_819x_usb_aggr_subframe, *prx_desc_819x_usb_aggr_subframe;
+#endif
+
+typedef struct rx_drvinfo_819x_usb{
+	//DWORD 0
+	u16                 Reserved1:12;
+	u16                 PartAggr:1;
+	u16                 FirstAGGR:1;
+	u16                 Reserved2:2;
+
+	u8                  RxRate:7;
+	u8                  RxHT:1;
+
+	u8                  BW:1;
+	u8                  SPLCP:1;
+	u8                  Reserved3:2;
+	u8                  PAM:1;
+	u8                  Mcast:1;
+	u8                  Bcast:1;
+	u8                  Reserved4:1;
+
+	//DWORD 1
+	u32                  TSFL;
+
+}rx_drvinfo_819x_usb, *prx_drvinfo_819x_usb;
+
+
+#define MAX_DEV_ADDR_SIZE		8  /* support till 64 bit bus width OS */
+#define MAX_FIRMWARE_INFORMATION_SIZE   32 /*2006/04/30 by Emily forRTL8190*/
+#define MAX_802_11_HEADER_LENGTH        (40 + MAX_FIRMWARE_INFORMATION_SIZE)
+#define ENCRYPTION_MAX_OVERHEAD		128
+#define	USB_HWDESC_HEADER_LEN		sizeof(tx_desc_819x_usb)
+#define TX_PACKET_SHIFT_BYTES 	  	(USB_HWDESC_HEADER_LEN + sizeof(tx_fwinfo_819x_usb))
+#define MAX_FRAGMENT_COUNT		8
+#ifdef RTL8192U
+#ifdef USB_TX_DRIVER_AGGREGATION_ENABLE
+#define MAX_TRANSMIT_BUFFER_SIZE			32000
+#else
+#define MAX_TRANSMIT_BUFFER_SIZE			8000
+#endif
+#else
+#define MAX_TRANSMIT_BUFFER_SIZE  	(1600+(MAX_802_11_HEADER_LENGTH+ENCRYPTION_MAX_OVERHEAD)*MAX_FRAGMENT_COUNT)
+#endif
+#ifdef USB_TX_DRIVER_AGGREGATION_ENABLE
+#define TX_PACKET_DRVAGGR_SUBFRAME_SHIFT_BYTES (sizeof(tx_desc_819x_usb_aggr_subframe) + sizeof(tx_fwinfo_819x_usb))
+#endif
+#define scrclng					4		// octets for crc32 (FCS, ICV)
+
+typedef enum rf_optype
+{
+	RF_OP_By_SW_3wire = 0,
+	RF_OP_By_FW,
+	RF_OP_MAX
+}rf_op_type;
+/* 8190 Loopback Mode definition */
+typedef enum _rtl819xUsb_loopback{
+	RTL819xU_NO_LOOPBACK = 0,
+	RTL819xU_MAC_LOOPBACK = 1,
+	RTL819xU_DMA_LOOPBACK = 2,
+	RTL819xU_CCK_LOOPBACK = 3,
+}rtl819xUsb_loopback_e;
+
+/* due to rtl8192 firmware */
+typedef enum _desc_packet_type_e{
+	DESC_PACKET_TYPE_INIT = 0,
+	DESC_PACKET_TYPE_NORMAL = 1,
+}desc_packet_type_e;
+
+typedef enum _firmware_source{
+	FW_SOURCE_IMG_FILE = 0,
+	FW_SOURCE_HEADER_FILE = 1,		//from header file
+}firmware_source_e, *pfirmware_source_e;
+
+typedef enum _firmware_status{
+	FW_STATUS_0_INIT = 0,
+	FW_STATUS_1_MOVE_BOOT_CODE = 1,
+	FW_STATUS_2_MOVE_MAIN_CODE = 2,
+	FW_STATUS_3_TURNON_CPU = 3,
+	FW_STATUS_4_MOVE_DATA_CODE = 4,
+	FW_STATUS_5_READY = 5,
+}firmware_status_e;
+
+typedef struct _rt_firmare_seg_container {
+	u16	seg_size;
+	u8	*seg_ptr;
+}fw_seg_container, *pfw_seg_container;
+typedef struct _rt_firmware{
+	firmware_status_e firmware_status;
+	u16               cmdpacket_frag_thresold;
+#define RTL8190_MAX_FIRMWARE_CODE_SIZE  64000   //64k
+	u8                firmware_buf[RTL8190_MAX_FIRMWARE_CODE_SIZE];
+	u16               firmware_buf_size;
+}rt_firmware, *prt_firmware;
+
+//+by amy 080507
+#define MAX_RECEIVE_BUFFER_SIZE	9100	// Add this to 9100 bytes to receive A-MSDU from RT-AP
+
+typedef struct _rt_firmware_info_819xUsb{
+	u8		sz_info[16];
+}rt_firmware_info_819xUsb, *prt_firmware_info_819xUsb;
+
+/* Firmware Queue Layout */
+#define NUM_OF_FIRMWARE_QUEUE		10
+#define NUM_OF_PAGES_IN_FW		0x100
+
+#ifdef USE_ONE_PIPE
+#define NUM_OF_PAGE_IN_FW_QUEUE_BE	0x000
+#define NUM_OF_PAGE_IN_FW_QUEUE_BK	0x000
+#define NUM_OF_PAGE_IN_FW_QUEUE_VI	0x0ff
+#define NUM_OF_PAGE_IN_FW_QUEUE_VO	0x000
+#define NUM_OF_PAGE_IN_FW_QUEUE_HCCA	0
+#define NUM_OF_PAGE_IN_FW_QUEUE_CMD	0x0
+#define NUM_OF_PAGE_IN_FW_QUEUE_MGNT	0x00
+#define NUM_OF_PAGE_IN_FW_QUEUE_HIGH	0
+#define NUM_OF_PAGE_IN_FW_QUEUE_BCN	0x0
+#define NUM_OF_PAGE_IN_FW_QUEUE_PUB	0x00
+#else
+
+#define NUM_OF_PAGE_IN_FW_QUEUE_BE	0x020
+#define NUM_OF_PAGE_IN_FW_QUEUE_BK	0x020
+#define NUM_OF_PAGE_IN_FW_QUEUE_VI	0x040
+#define NUM_OF_PAGE_IN_FW_QUEUE_VO	0x040
+#define NUM_OF_PAGE_IN_FW_QUEUE_HCCA	0
+#define NUM_OF_PAGE_IN_FW_QUEUE_CMD	0x4
+#define NUM_OF_PAGE_IN_FW_QUEUE_MGNT	0x20
+#define NUM_OF_PAGE_IN_FW_QUEUE_HIGH	0
+#define NUM_OF_PAGE_IN_FW_QUEUE_BCN	0x4
+#define NUM_OF_PAGE_IN_FW_QUEUE_PUB	0x18
+
+#endif
+
+#define APPLIED_RESERVED_QUEUE_IN_FW	0x80000000
+#define RSVD_FW_QUEUE_PAGE_BK_SHIFT	0x00
+#define RSVD_FW_QUEUE_PAGE_BE_SHIFT	0x08
+#define RSVD_FW_QUEUE_PAGE_VI_SHIFT	0x10
+#define RSVD_FW_QUEUE_PAGE_VO_SHIFT	0x18
+#define RSVD_FW_QUEUE_PAGE_MGNT_SHIFT	0x10
+#define RSVD_FW_QUEUE_PAGE_CMD_SHIFT	0x08
+#define RSVD_FW_QUEUE_PAGE_BCN_SHIFT	0x00
+#define RSVD_FW_QUEUE_PAGE_PUB_SHIFT	0x08
+//=================================================================
+//=================================================================
+
+#define EPROM_93c46 0
+#define EPROM_93c56 1
+
+#define DEFAULT_FRAG_THRESHOLD 2342U
+#define MIN_FRAG_THRESHOLD     256U
+#define DEFAULT_BEACONINTERVAL 0x64U
+#define DEFAULT_BEACON_ESSID "Rtl819xU"
+
+#define DEFAULT_SSID ""
+#define DEFAULT_RETRY_RTS 7
+#define DEFAULT_RETRY_DATA 7
+#define PRISM_HDR_SIZE 64
+
+#define		PHY_RSSI_SLID_WIN_MAX				100
+
+
+typedef enum _WIRELESS_MODE {
+	WIRELESS_MODE_UNKNOWN = 0x00,
+	WIRELESS_MODE_A = 0x01,
+	WIRELESS_MODE_B = 0x02,
+	WIRELESS_MODE_G = 0x04,
+	WIRELESS_MODE_AUTO = 0x08,
+	WIRELESS_MODE_N_24G = 0x10,
+	WIRELESS_MODE_N_5G = 0x20
+} WIRELESS_MODE;
+
+
+#define RTL_IOCTL_WPA_SUPPLICANT		SIOCIWFIRSTPRIV+30
+
+typedef struct buffer
+{
+	struct buffer *next;
+	u32 *buf;
+
+} buffer;
+
+typedef struct rtl_reg_debug{
+        unsigned int  cmd;
+        struct {
+                unsigned char type;
+                unsigned char addr;
+                unsigned char page;
+                unsigned char length;
+        } head;
+        unsigned char buf[0xff];
+}rtl_reg_debug;
+
+
+
+
+
+
+typedef struct _rt_9x_tx_rate_history {
+	u32             cck[4];
+	u32             ofdm[8];
+	// HT_MCS[0][]: BW=0 SG=0
+	// HT_MCS[1][]: BW=1 SG=0
+	// HT_MCS[2][]: BW=0 SG=1
+	// HT_MCS[3][]: BW=1 SG=1
+	u32             ht_mcs[4][16];
+}rt_tx_rahis_t, *prt_tx_rahis_t;
+typedef struct _RT_SMOOTH_DATA_4RF {
+	char    elements[4][100];//array to store values
+	u32     index;                  //index to current array to store
+	u32     TotalNum;               //num of valid elements
+	u32     TotalVal[4];            //sum of valid elements
+}RT_SMOOTH_DATA_4RF, *PRT_SMOOTH_DATA_4RF;
+
+#define MAX_8192U_RX_SIZE			8192    // This maybe changed for D-cut larger aggregation size
+//stats seems messed up, clean it ASAP
+typedef struct Stats
+{
+	unsigned long txrdu;
+//	unsigned long rxrdu;
+	//unsigned long rxnolast;
+	//unsigned long rxnodata;
+//	unsigned long rxreset;
+//	unsigned long rxnopointer;
+	unsigned long rxok;
+	unsigned long rxframgment;
+	unsigned long rxcmdpkt[4];		//08/05/08 amy rx cmd element txfeedback/bcn report/cfg set/query
+	unsigned long rxurberr;
+	unsigned long rxstaterr;
+	unsigned long received_rate_histogram[4][32];	//0: Total, 1:OK, 2:CRC, 3:ICV, 2007 07 03 cosa
+	unsigned long received_preamble_GI[2][32];		//0: Long preamble/GI, 1:Short preamble/GI
+	unsigned long rx_AMPDUsize_histogram[5]; // level: (<4K), (4K~8K), (8K~16K), (16K~32K), (32K~64K)
+	unsigned long rx_AMPDUnum_histogram[5]; // level: (<5), (5~10), (10~20), (20~40), (>40)
+	unsigned long numpacket_matchbssid;	// debug use only.
+	unsigned long numpacket_toself;		// debug use only.
+	unsigned long num_process_phyinfo;		// debug use only.
+	unsigned long numqry_phystatus;
+	unsigned long numqry_phystatusCCK;
+	unsigned long numqry_phystatusHT;
+	unsigned long received_bwtype[5];              //0: 20M, 1: funn40M, 2: upper20M, 3: lower20M, 4: duplicate
+	unsigned long txnperr;
+	unsigned long txnpdrop;
+	unsigned long txresumed;
+//	unsigned long rxerr;
+//	unsigned long rxoverflow;
+//	unsigned long rxint;
+	unsigned long txnpokint;
+//	unsigned long txhpokint;
+//	unsigned long txhperr;
+//	unsigned long ints;
+//	unsigned long shints;
+	unsigned long txoverflow;
+//	unsigned long rxdmafail;
+//	unsigned long txbeacon;
+//	unsigned long txbeaconerr;
+	unsigned long txlpokint;
+	unsigned long txlpdrop;
+	unsigned long txlperr;
+	unsigned long txbeokint;
+	unsigned long txbedrop;
+	unsigned long txbeerr;
+	unsigned long txbkokint;
+	unsigned long txbkdrop;
+	unsigned long txbkerr;
+	unsigned long txviokint;
+	unsigned long txvidrop;
+	unsigned long txvierr;
+	unsigned long txvookint;
+	unsigned long txvodrop;
+	unsigned long txvoerr;
+	unsigned long txbeaconokint;
+	unsigned long txbeacondrop;
+	unsigned long txbeaconerr;
+	unsigned long txmanageokint;
+	unsigned long txmanagedrop;
+	unsigned long txmanageerr;
+	unsigned long txdatapkt;
+	unsigned long txfeedback;
+	unsigned long txfeedbackok;
+
+	unsigned long txoktotal;
+	unsigned long txokbytestotal;
+	unsigned long txokinperiod;
+	unsigned long txmulticast;
+	unsigned long txbytesmulticast;
+	unsigned long txbroadcast;
+	unsigned long txbytesbroadcast;
+	unsigned long txunicast;
+	unsigned long txbytesunicast;
+
+	unsigned long rxoktotal;
+	unsigned long rxbytesunicast;
+	unsigned long txfeedbackfail;
+	unsigned long txerrtotal;
+	unsigned long txerrbytestotal;
+	unsigned long txerrmulticast;
+	unsigned long txerrbroadcast;
+	unsigned long txerrunicast;
+	unsigned long txretrycount;
+	unsigned long txfeedbackretry;
+	u8	      last_packet_rate;
+	unsigned long slide_signal_strength[100];
+	unsigned long slide_evm[100];
+	unsigned long slide_rssi_total;	// For recording sliding window's RSSI value
+	unsigned long slide_evm_total;	// For recording sliding window's EVM value
+	long signal_strength; // Transformed, in dbm. Beautified signal strength for UI, not correct.
+	long signal_quality;
+	long last_signal_strength_inpercent;
+	long recv_signal_power;	// Correct smoothed ss in Dbm, only used in driver to report real power now.
+	u8 rx_rssi_percentage[4];
+	u8 rx_evm_percentage[2];
+	long rxSNRdB[4];
+	rt_tx_rahis_t txrate;
+	u32 Slide_Beacon_pwdb[100];     //cosa add for beacon rssi
+	u32 Slide_Beacon_Total;         //cosa add for beacon rssi
+	RT_SMOOTH_DATA_4RF              cck_adc_pwdb;
+
+	u32	CurrentShowTxate;
+} Stats;
+
+
+// Bandwidth Offset
+#define HAL_PRIME_CHNL_OFFSET_DONT_CARE		0
+#define HAL_PRIME_CHNL_OFFSET_LOWER			1
+#define HAL_PRIME_CHNL_OFFSET_UPPER			2
+
+//+by amy 080507
+
+typedef struct 	ChnlAccessSetting {
+	u16 SIFS_Timer;
+	u16 DIFS_Timer;
+	u16 SlotTimeTimer;
+	u16 EIFS_Timer;
+	u16 CWminIndex;
+	u16 CWmaxIndex;
+}*PCHANNEL_ACCESS_SETTING,CHANNEL_ACCESS_SETTING;
+
+typedef struct _BB_REGISTER_DEFINITION{
+	u32 rfintfs; 			// set software control: //		0x870~0x877[8 bytes]
+	u32 rfintfi; 			// readback data: //		0x8e0~0x8e7[8 bytes]
+	u32 rfintfo; 			// output data: //		0x860~0x86f [16 bytes]
+	u32 rfintfe; 			// output enable: //		0x860~0x86f [16 bytes]
+	u32 rf3wireOffset; 		// LSSI data: //		0x840~0x84f [16 bytes]
+	u32 rfLSSI_Select; 		// BB Band Select: //		0x878~0x87f [8 bytes]
+	u32 rfTxGainStage;		// Tx gain stage: //		0x80c~0x80f [4 bytes]
+	u32 rfHSSIPara1; 		// wire parameter control1 : //		0x820~0x823,0x828~0x82b, 0x830~0x833, 0x838~0x83b [16 bytes]
+	u32 rfHSSIPara2; 		// wire parameter control2 : //		0x824~0x827,0x82c~0x82f, 0x834~0x837, 0x83c~0x83f [16 bytes]
+	u32 rfSwitchControl; 	//Tx Rx antenna control : //		0x858~0x85f [16 bytes]
+	u32 rfAGCControl1; 	//AGC parameter control1 : //		0xc50~0xc53,0xc58~0xc5b, 0xc60~0xc63, 0xc68~0xc6b [16 bytes]
+	u32 rfAGCControl2; 	//AGC parameter control2 : //		0xc54~0xc57,0xc5c~0xc5f, 0xc64~0xc67, 0xc6c~0xc6f [16 bytes]
+	u32 rfRxIQImbalance; 	//OFDM Rx IQ imbalance matrix : //		0xc14~0xc17,0xc1c~0xc1f, 0xc24~0xc27, 0xc2c~0xc2f [16 bytes]
+	u32 rfRxAFE;  			//Rx IQ DC ofset and Rx digital filter, Rx DC notch filter : //		0xc10~0xc13,0xc18~0xc1b, 0xc20~0xc23, 0xc28~0xc2b [16 bytes]
+	u32 rfTxIQImbalance; 	//OFDM Tx IQ imbalance matrix //		0xc80~0xc83,0xc88~0xc8b, 0xc90~0xc93, 0xc98~0xc9b [16 bytes]
+	u32 rfTxAFE; 			//Tx IQ DC Offset and Tx DFIR type //		0xc84~0xc87,0xc8c~0xc8f, 0xc94~0xc97, 0xc9c~0xc9f [16 bytes]
+	u32 rfLSSIReadBack; 	//LSSI RF readback data //		0x8a0~0x8af [16 bytes]
+}BB_REGISTER_DEFINITION_T, *PBB_REGISTER_DEFINITION_T;
+
+typedef enum _RT_RF_TYPE_819xU{
+        RF_TYPE_MIN = 0,
+        RF_8225,
+        RF_8256,
+        RF_8258,
+        RF_PSEUDO_11N = 4,
+}RT_RF_TYPE_819xU, *PRT_RF_TYPE_819xU;
+
+typedef struct _rate_adaptive
+{
+	u8				rate_adaptive_disabled;
+	u8				ratr_state;
+	u16				reserve;
+
+	u32				high_rssi_thresh_for_ra;
+	u32				high2low_rssi_thresh_for_ra;
+	u8				low2high_rssi_thresh_for_ra40M;
+	u32				low_rssi_thresh_for_ra40M;
+	u8				low2high_rssi_thresh_for_ra20M;
+	u32				low_rssi_thresh_for_ra20M;
+	u32				upper_rssi_threshold_ratr;
+	u32				middle_rssi_threshold_ratr;
+	u32				low_rssi_threshold_ratr;
+	u32				low_rssi_threshold_ratr_40M;
+	u32				low_rssi_threshold_ratr_20M;
+	u8				ping_rssi_enable;	//cosa add for test
+	u32				ping_rssi_ratr;	//cosa add for test
+	u32				ping_rssi_thresh_for_ra;//cosa add for test
+	u32				last_ratr;
+
+} rate_adaptive, *prate_adaptive;
+
+#define TxBBGainTableLength 37
+#define	CCKTxBBGainTableLength 23
+
+typedef struct _txbbgain_struct
+{
+	long	txbb_iq_amplifygain;
+	u32	txbbgain_value;
+} txbbgain_struct, *ptxbbgain_struct;
+
+typedef struct _ccktxbbgain_struct
+{
+	//The Value is from a22 to a29 one Byte one time is much Safer
+	u8	ccktxbb_valuearray[8];
+} ccktxbbgain_struct,*pccktxbbgain_struct;
+
+
+typedef struct _init_gain
+{
+	u8				xaagccore1;
+	u8				xbagccore1;
+	u8				xcagccore1;
+	u8				xdagccore1;
+	u8				cca;
+
+} init_gain, *pinit_gain;
+//by amy 0606
+
+typedef struct _phy_ofdm_rx_status_report_819xusb
+{
+	u8	trsw_gain_X[4];
+	u8	pwdb_all;
+	u8	cfosho_X[4];
+	u8	cfotail_X[4];
+	u8	rxevm_X[2];
+	u8	rxsnr_X[4];
+	u8	pdsnr_X[2];
+	u8	csi_current_X[2];
+	u8	csi_target_X[2];
+	u8	sigevm;
+	u8	max_ex_pwr;
+	u8	sgi_en;
+	u8  rxsc_sgien_exflg;
+}phy_sts_ofdm_819xusb_t;
+
+typedef struct _phy_cck_rx_status_report_819xusb
+{
+	/* For CCK rate descriptor. This is a unsigned 8:1 variable. LSB bit presend
+	   0.5. And MSB 7 bts presend a signed value. Range from -64~+63.5. */
+	u8	adc_pwdb_X[4];
+	u8	sq_rpt;
+	u8	cck_agc_rpt;
+}phy_sts_cck_819xusb_t;
+
+
+typedef struct _phy_ofdm_rx_status_rxsc_sgien_exintfflag{
+	u8			reserved:4;
+	u8			rxsc:2;
+	u8			sgi_en:1;
+	u8			ex_intf_flag:1;
+}phy_ofdm_rx_status_rxsc_sgien_exintfflag;
+
+typedef enum _RT_CUSTOMER_ID
+{
+	RT_CID_DEFAULT = 0,
+	RT_CID_8187_ALPHA0 = 1,
+	RT_CID_8187_SERCOMM_PS = 2,
+	RT_CID_8187_HW_LED = 3,
+	RT_CID_8187_NETGEAR = 4,
+	RT_CID_WHQL = 5,
+	RT_CID_819x_CAMEO  = 6,
+	RT_CID_819x_RUNTOP = 7,
+	RT_CID_819x_Senao = 8,
+	RT_CID_TOSHIBA = 9,	// Merge by Jacken, 2008/01/31.
+	RT_CID_819x_Netcore = 10,
+	RT_CID_Nettronix = 11,
+	RT_CID_DLINK = 12,
+	RT_CID_PRONET = 13,
+}RT_CUSTOMER_ID, *PRT_CUSTOMER_ID;
+
+//================================================================================
+// LED customization.
+//================================================================================
+
+typedef	enum _LED_STRATEGY_8190{
+	SW_LED_MODE0, // SW control 1 LED via GPIO0. It is default option.
+	SW_LED_MODE1, // SW control for PCI Express
+	SW_LED_MODE2, // SW control for Cameo.
+	SW_LED_MODE3, // SW contorl for RunTop.
+	SW_LED_MODE4, // SW control for Netcore
+	HW_LED, // HW control 2 LEDs, LED0 and LED1 (there are 4 different control modes)
+}LED_STRATEGY_8190, *PLED_STRATEGY_8190;
+
+typedef enum _RESET_TYPE {
+	RESET_TYPE_NORESET = 0x00,
+	RESET_TYPE_NORMAL = 0x01,
+	RESET_TYPE_SILENT = 0x02
+} RESET_TYPE;
+
+/* The simple tx command OP code. */
+typedef enum _tag_TxCmd_Config_Index{
+	TXCMD_TXRA_HISTORY_CTRL				= 0xFF900000,
+	TXCMD_RESET_TX_PKT_BUFF				= 0xFF900001,
+	TXCMD_RESET_RX_PKT_BUFF				= 0xFF900002,
+	TXCMD_SET_TX_DURATION				= 0xFF900003,
+	TXCMD_SET_RX_RSSI						= 0xFF900004,
+	TXCMD_SET_TX_PWR_TRACKING			= 0xFF900005,
+	TXCMD_XXXX_CTRL,
+}DCMD_TXCMD_OP;
+
+typedef struct r8192_priv
+{
+	struct usb_device *udev;
+	//added for maintain info from eeprom
+	short epromtype;
+	u16 eeprom_vid;
+	u16 eeprom_pid;
+	u8  eeprom_CustomerID;
+	u8  eeprom_ChannelPlan;
+	RT_CUSTOMER_ID CustomerID;
+	LED_STRATEGY_8190	LedStrategy;
+	u8  txqueue_to_outpipemap[9];
+	int irq;
+	struct ieee80211_device *ieee80211;
+
+	short card_8192; /* O: rtl8192, 1:rtl8185 V B/C, 2:rtl8185 V D */
+	u8 card_8192_version; /* if TCR reports card V B/C this discriminates */
+//	short phy_ver; /* meaningful for rtl8225 1:A 2:B 3:C */
+	short enable_gpio0;
+	enum card_type {PCI,MINIPCI,CARDBUS,USB}card_type;
+	short hw_plcp_len;
+	short plcp_preamble_mode;
+
+	spinlock_t irq_lock;
+//	spinlock_t irq_th_lock;
+	spinlock_t tx_lock;
+        struct mutex mutex;
+	//spinlock_t rf_lock; //used to lock rf write operation added by wb
+
+	u16 irq_mask;
+//	short irq_enabled;
+//	struct net_device *dev; //comment this out.
+	short chan;
+	short sens;
+	short max_sens;
+
+
+	//	u8 chtxpwr[15]; //channels from 1 to 14, 0 not used
+//	u8 chtxpwr_ofdm[15]; //channels from 1 to 14, 0 not used
+//	u8 cck_txpwr_base;
+//	u8 ofdm_txpwr_base;
+//	u8 challow[15]; //channels from 1 to 14, 0 not used
+	short up;
+	short crcmon; //if 1 allow bad crc frame reception in monitor mode
+//	short prism_hdr;
+
+//	struct timer_list scan_timer;
+	/*short scanpending;
+	short stopscan;*/
+//	spinlock_t scan_lock;
+//	u8 active_probe;
+	//u8 active_scan_num;
+	struct semaphore wx_sem;
+	struct semaphore rf_sem; //used to lock rf write operation added by wb, modified by david
+//	short hw_wep;
+
+//	short digphy;
+//	short antb;
+//	short diversity;
+//	u8 cs_treshold;
+//	short rcr_csense;
+	u8 rf_type; //0 means 1T2R, 1 means 2T4R
+	RT_RF_TYPE_819xU rf_chip;
+
+//	u32 key0[4];
+	short (*rf_set_sens)(struct net_device *dev,short sens);
+	u8 (*rf_set_chan)(struct net_device *dev,u8 ch);
+	void (*rf_close)(struct net_device *dev);
+	void (*rf_init)(struct net_device *dev);
+	//short rate;
+	short promisc;
+	/*stats*/
+	struct Stats stats;
+	struct iw_statistics wstats;
+	struct proc_dir_entry *dir_dev;
+
+	/*RX stuff*/
+//	u32 *rxring;
+//	u32 *rxringtail;
+//	dma_addr_t rxringdma;
+	struct urb **rx_urb;
+	struct urb **rx_cmd_urb;
+#ifdef THOMAS_BEACON
+	u32 *oldaddr;
+#endif
+#ifdef THOMAS_TASKLET
+	atomic_t irt_counter;//count for irq_rx_tasklet
+#endif
+#ifdef JACKSON_NEW_RX
+        struct sk_buff **pp_rxskb;
+        int     rx_inx;
+#endif
+
+/* modified by davad for Rx process */
+       struct sk_buff_head rx_queue;
+       struct sk_buff_head skb_queue;
+       struct work_struct qos_activate;
+	short  tx_urb_index;
+	atomic_t tx_pending[0x10];//UART_PRIORITY+1
+
+
+	struct tasklet_struct irq_rx_tasklet;
+	struct urb *rxurb_task;
+
+	//2 Tx Related variables
+	u16	ShortRetryLimit;
+	u16	LongRetryLimit;
+	u32	TransmitConfig;
+	u8	RegCWinMin;		// For turbo mode CW adaptive. Added by Annie, 2005-10-27.
+
+	u32     LastRxDescTSFHigh;
+	u32     LastRxDescTSFLow;
+
+
+	//2 Rx Related variables
+	u16	EarlyRxThreshold;
+	u32	ReceiveConfig;
+	u8	AcmControl;
+
+	u8	RFProgType;
+
+	u8 retry_data;
+	u8 retry_rts;
+	u16 rts;
+
+	struct 	ChnlAccessSetting  ChannelAccessSetting;
+	struct work_struct reset_wq;
+
+/**********************************************************/
+	//for rtl819xUsb
+	u16     basic_rate;
+	u8      short_preamble;
+	u8      slot_time;
+	bool 	bDcut;
+	bool bCurrentRxAggrEnable;
+	u8 Rf_Mode; //add for Firmware RF -R/W switch
+	prt_firmware		pFirmware;
+	rtl819xUsb_loopback_e	LoopbackMode;
+	firmware_source_e	firmware_source;
+	u16 EEPROMTxPowerDiff;
+	u8 EEPROMThermalMeter;
+	u8 EEPROMPwDiff;
+	u8 EEPROMCrystalCap;
+	u8 EEPROM_Def_Ver;
+	u8 EEPROMTxPowerLevelCCK;// CCK channel 1~14
+	u8 EEPROMTxPowerLevelCCK_V1[3];
+	u8 EEPROMTxPowerLevelOFDM24G[3]; // OFDM 2.4G channel 1~14
+	u8 EEPROMTxPowerLevelOFDM5G[24];	// OFDM 5G
+
+/*PHY related*/
+	BB_REGISTER_DEFINITION_T	PHYRegDef[4];	//Radio A/B/C/D
+	// Read/write are allow for following hardware information variables
+	u32	MCSTxPowerLevelOriginalOffset[6];
+	u32	CCKTxPowerLevelOriginalOffset;
+	u8	TxPowerLevelCCK[14];			// CCK channel 1~14
+	u8	TxPowerLevelOFDM24G[14];		// OFDM 2.4G channel 1~14
+	u8	TxPowerLevelOFDM5G[14];			// OFDM 5G
+	u32	Pwr_Track;
+	u8	TxPowerDiff;
+	u8	AntennaTxPwDiff[2];				// Antenna gain offset, index 0 for B, 1 for C, and 2 for D
+	u8	CrystalCap;						// CrystalCap.
+	u8	ThermalMeter[2];				// ThermalMeter, index 0 for RFIC0, and 1 for RFIC1
+
+	u8	CckPwEnl;
+	// Use to calculate PWBD.
+	u8	bCckHighPower;
+	long	undecorated_smoothed_pwdb;
+
+	//for set channel
+	u8	SwChnlInProgress;
+	u8 	SwChnlStage;
+	u8	SwChnlStep;
+	u8	SetBWModeInProgress;
+	HT_CHANNEL_WIDTH		CurrentChannelBW;
+	u8      ChannelPlan;
+	// 8190 40MHz mode
+	//
+	u8	nCur40MhzPrimeSC;	// Control channel sub-carrier
+	// Joseph test for shorten RF configuration time.
+	// We save RF reg0 in this variable to reduce RF reading.
+	//
+	u32					RfReg0Value[4];
+	u8 					NumTotalRFPath;
+	bool 				brfpath_rxenable[4];
+	//RF set related
+	bool				SetRFPowerStateInProgress;
+//+by amy 080507
+	struct timer_list watch_dog_timer;
+
+//+by amy 080515 for dynamic mechenism
+	//Add by amy Tx Power Control for Near/Far Range 2008/05/15
+	bool	bdynamic_txpower;  //bDynamicTxPower
+	bool	bDynamicTxHighPower;  // Tx high power state
+	bool	bDynamicTxLowPower;  // Tx low power state
+	bool	bLastDTPFlag_High;
+	bool	bLastDTPFlag_Low;
+
+	bool	bstore_last_dtpflag;
+	bool	bstart_txctrl_bydtp;   //Define to discriminate on High power State or on sitesuvey to change Tx gain index
+	//Add by amy for Rate Adaptive
+	rate_adaptive rate_adaptive;
+	//Add by amy for TX power tracking
+	//2008/05/15  Mars OPEN/CLOSE TX POWER TRACKING
+       txbbgain_struct txbbgain_table[TxBBGainTableLength];
+	u8			   txpower_count;//For 6 sec do tracking again
+	bool			   btxpower_trackingInit;
+	u8			   OFDM_index;
+	u8			   CCK_index;
+	//2007/09/10 Mars Add CCK TX Power Tracking
+	ccktxbbgain_struct	cck_txbbgain_table[CCKTxBBGainTableLength];
+	ccktxbbgain_struct	cck_txbbgain_ch14_table[CCKTxBBGainTableLength];
+	u8 rfa_txpowertrackingindex;
+	u8 rfa_txpowertrackingindex_real;
+	u8 rfa_txpowertracking_default;
+	u8 rfc_txpowertrackingindex;
+	u8 rfc_txpowertrackingindex_real;
+
+	s8 cck_present_attentuation;
+	u8 cck_present_attentuation_20Mdefault;
+	u8 cck_present_attentuation_40Mdefault;
+	char cck_present_attentuation_difference;
+	bool btxpower_tracking;
+	bool bcck_in_ch14;
+	bool btxpowerdata_readfromEEPORM;
+	u16 	TSSI_13dBm;
+	//For Backup Initial Gain
+	init_gain initgain_backup;
+	u8 DefaultInitialGain[4];
+	// For EDCA Turbo mode, Added by amy 080515.
+	bool		bis_any_nonbepkts;
+	bool		bcurrent_turbo_EDCA;
+	bool		bis_cur_rdlstate;
+	struct timer_list fsync_timer;
+	bool bfsync_processing;	// 500ms Fsync timer is active or not
+	u32 	rate_record;
+	u32 	rateCountDiffRecord;
+	u32	ContiuneDiffCount;
+	bool bswitch_fsync;
+
+	u8	framesync;
+	u32 	framesyncC34;
+	u8   	framesyncMonitor;
+        	//Added by amy 080516  for RX related
+	u16 	nrxAMPDU_size;
+	u8 	nrxAMPDU_aggr_num;
+
+	//by amy for gpio
+	 bool bHwRadioOff;
+
+	//by amy for reset_count
+	u32 reset_count;
+	bool bpbc_pressed;
+	//by amy for debug
+	u32 txpower_checkcnt;
+	u32 txpower_tracking_callback_cnt;
+	u8 thermal_read_val[40];
+	u8 thermal_readback_index;
+	u32 ccktxpower_adjustcnt_not_ch14;
+	u32 ccktxpower_adjustcnt_ch14;
+	u8 tx_fwinfo_force_subcarriermode;
+	u8 tx_fwinfo_force_subcarrierval;
+	//by amy for silent reset
+	RESET_TYPE	ResetProgress;
+	bool		bForcedSilentReset;
+	bool		bDisableNormalResetCheck;
+	u16		TxCounter;
+	u16		RxCounter;
+	int		IrpPendingCount;
+	bool		bResetInProgress;
+	bool		force_reset;
+	u8		InitialGainOperateType;
+
+	u16		SifsTime;
+
+	//define work item by amy 080526
+
+	struct delayed_work update_beacon_wq;
+	struct delayed_work watch_dog_wq;
+	struct delayed_work txpower_tracking_wq;
+	struct delayed_work rfpath_check_wq;
+	struct delayed_work gpio_change_rf_wq;
+	struct delayed_work initialgain_operate_wq;
+	struct workqueue_struct *priv_wq;
+}r8192_priv;
+
+// for rtl8187
+// now mirging to rtl8187B
+/*
+typedef enum{
+	LOW_PRIORITY = 0x02,
+	NORM_PRIORITY
+	} priority_t;
+*/
+//for rtl8187B
+typedef enum{
+	BULK_PRIORITY = 0x01,
+	//RSVD0,
+	//RSVD1,
+	LOW_PRIORITY,
+	NORM_PRIORITY,
+	VO_PRIORITY,
+	VI_PRIORITY, //0x05
+	BE_PRIORITY,
+	BK_PRIORITY,
+	RSVD2,
+	RSVD3,
+	BEACON_PRIORITY, //0x0A
+	HIGH_PRIORITY,
+	MANAGE_PRIORITY,
+	RSVD4,
+	RSVD5,
+	UART_PRIORITY //0x0F
+} priority_t;
+
+typedef enum{
+	NIC_8192U = 1,
+	NIC_8190P = 2,
+	NIC_8192E = 3,
+	} nic_t;
+
+
+#ifdef JOHN_HWSEC
+struct ssid_thread {
+	struct net_device *dev;
+       	u8 name[IW_ESSID_MAX_SIZE + 1];
+};
+#endif
+
+bool init_firmware(struct net_device *dev);
+short rtl819xU_tx_cmd(struct net_device *dev, struct sk_buff *skb);
+short rtl8192_tx(struct net_device *dev, struct sk_buff* skb);
+
+u32 read_cam(struct net_device *dev, u8 addr);
+void write_cam(struct net_device *dev, u8 addr, u32 data);
+
+u8 read_nic_byte(struct net_device *dev, int x);
+u8 read_nic_byte_E(struct net_device *dev, int x);
+u32 read_nic_dword(struct net_device *dev, int x);
+u16 read_nic_word(struct net_device *dev, int x) ;
+void write_nic_byte(struct net_device *dev, int x,u8 y);
+void write_nic_byte_E(struct net_device *dev, int x,u8 y);
+void write_nic_word(struct net_device *dev, int x,u16 y);
+void write_nic_dword(struct net_device *dev, int x,u32 y);
+void force_pci_posting(struct net_device *dev);
+
+void rtl8192_rtx_disable(struct net_device *);
+void rtl8192_rx_enable(struct net_device *);
+void rtl8192_tx_enable(struct net_device *);
+
+void rtl8192_disassociate(struct net_device *dev);
+//void fix_rx_fifo(struct net_device *dev);
+void rtl8185_set_rf_pins_enable(struct net_device *dev,u32 a);
+
+void rtl8192_set_anaparam(struct net_device *dev,u32 a);
+void rtl8185_set_anaparam2(struct net_device *dev,u32 a);
+void rtl8192_update_msr(struct net_device *dev);
+int rtl8192_down(struct net_device *dev);
+int rtl8192_up(struct net_device *dev);
+void rtl8192_commit(struct net_device *dev);
+void rtl8192_set_chan(struct net_device *dev,short ch);
+void write_phy(struct net_device *dev, u8 adr, u8 data);
+void write_phy_cck(struct net_device *dev, u8 adr, u32 data);
+void write_phy_ofdm(struct net_device *dev, u8 adr, u32 data);
+void rtl8185_tx_antenna(struct net_device *dev, u8 ant);
+void rtl8192_set_rxconf(struct net_device *dev);
+//short check_nic_enough_desc(struct net_device *dev, priority_t priority);
+extern void rtl819xusb_beacon_tx(struct net_device *dev,u16  tx_rate);
+
+void EnableHWSecurityConfig8192(struct net_device *dev);
+void setKey(struct net_device *dev, u8 EntryNo, u8 KeyIndex, u16 KeyType, u8 *MacAddr, u8 DefaultKey, u32 *KeyContent );
+
+
+#endif
diff --git a/drivers/staging/rtl8192u/r8192U_core.c b/drivers/staging/rtl8192u/r8192U_core.c
new file mode 100644
index 000000000000..adade13e1e19
--- /dev/null
+++ b/drivers/staging/rtl8192u/r8192U_core.c
@@ -0,0 +1,6085 @@
+/******************************************************************************
+ * Copyright(c) 2008 - 2010 Realtek Corporation. All rights reserved.
+ * Linux device driver for RTL8192U
+ *
+ * Based on the r8187 driver, which is:
+ * Copyright 2004-2005 Andrea Merello <andreamrl@tiscali.it>, et al.
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
+ *
+ * The full GNU General Public License is included in this distribution in the
+ * file called LICENSE.
+ *
+ * Contact Information:
+ * Jerry chuang <wlanfae@realtek.com>
+ */
+
+#ifndef CONFIG_FORCE_HARD_FLOAT
+double __floatsidf (int i) { return i; }
+unsigned int __fixunsdfsi (double d) { return d; }
+double __adddf3(double a, double b) { return a+b; }
+double __addsf3(float a, float b) { return a+b; }
+double __subdf3(double a, double b) { return a-b; }
+double __extendsfdf2(float a) {return a;}
+#endif
+
+#undef LOOP_TEST
+#undef DUMP_RX
+#undef DUMP_TX
+#undef DEBUG_TX_DESC2
+#undef RX_DONT_PASS_UL
+#undef DEBUG_EPROM
+#undef DEBUG_RX_VERBOSE
+#undef DUMMY_RX
+#undef DEBUG_ZERO_RX
+#undef DEBUG_RX_SKB
+#undef DEBUG_TX_FRAG
+#undef DEBUG_RX_FRAG
+#undef DEBUG_TX_FILLDESC
+#undef DEBUG_TX
+#undef DEBUG_IRQ
+#undef DEBUG_RX
+#undef DEBUG_RXALLOC
+#undef DEBUG_REGISTERS
+#undef DEBUG_RING
+#undef DEBUG_IRQ_TASKLET
+#undef DEBUG_TX_ALLOC
+#undef DEBUG_TX_DESC
+
+#define CONFIG_RTL8192_IO_MAP
+
+#include <asm/uaccess.h>
+#include "r8192U_hw.h"
+#include "r8192U.h"
+#include "r8190_rtl8256.h" /* RTL8225 Radio frontend */
+#include "r8180_93cx6.h"   /* Card EEPROM */
+#include "r8192U_wx.h"
+#include "r819xU_phy.h" //added by WB 4.30.2008
+#include "r819xU_phyreg.h"
+#include "r819xU_cmdpkt.h"
+#include "r8192U_dm.h"
+//#include "r8192xU_phyreg.h"
+#include <linux/usb.h>
+// FIXME: check if 2.6.7 is ok
+
+#ifdef CONFIG_RTL8192_PM
+#include "r8192_pm.h"
+#endif
+
+#ifdef ENABLE_DOT11D
+#include "dot11d.h"
+#endif
+//set here to open your trace code. //WB
+u32 rt_global_debug_component = \
+			//	COMP_INIT    	|
+//				COMP_DBG	|
+			//	COMP_EPROM   	|
+//				COMP_PHY	|
+			//	COMP_RF		|
+//				COMP_FIRMWARE	|
+//				COMP_CH		|
+			//	COMP_POWER_TRACKING |
+//				COMP_RATE	|
+			//	COMP_TXAGC	|
+		//		COMP_TRACE	|
+				COMP_DOWN	|
+		//		COMP_RECV	|
+		//              COMP_SWBW	|
+				COMP_SEC	|
+	//			COMP_RESET	|
+		//		COMP_SEND	|
+			//	COMP_EVENTS	|
+				COMP_ERR ; //always open err flags on
+
+#define TOTAL_CAM_ENTRY 32
+#define CAM_CONTENT_COUNT 8
+
+static struct usb_device_id rtl8192_usb_id_tbl[] = {
+	/* Realtek */
+	{USB_DEVICE(0x0bda, 0x8192)},
+	{USB_DEVICE(0x0bda, 0x8709)},
+	/* Corega */
+	{USB_DEVICE(0x07aa, 0x0043)},
+	/* Belkin */
+	{USB_DEVICE(0x050d, 0x805E)},
+	/* Sitecom */
+	{USB_DEVICE(0x0df6, 0x0031)},
+	/* EnGenius */
+	{USB_DEVICE(0x1740, 0x9201)},
+	/* Dlink */
+	{USB_DEVICE(0x2001, 0x3301)},
+	/* Zinwell */
+	{USB_DEVICE(0x5a57, 0x0290)},
+	{}
+};
+
+MODULE_LICENSE("GPL");
+MODULE_VERSION("V 1.1");
+MODULE_DEVICE_TABLE(usb, rtl8192_usb_id_tbl);
+MODULE_DESCRIPTION("Linux driver for Realtek RTL8192 USB WiFi cards");
+
+static char* ifname = "wlan%d";
+static int hwwep = 1;  //default use hw. set 0 to use software security
+static int channels = 0x3fff;
+
+
+
+module_param(ifname, charp, S_IRUGO|S_IWUSR );
+//module_param(hwseqnum,int, S_IRUGO|S_IWUSR);
+module_param(hwwep,int, S_IRUGO|S_IWUSR);
+module_param(channels,int, S_IRUGO|S_IWUSR);
+
+MODULE_PARM_DESC(ifname," Net interface name, wlan%d=default");
+//MODULE_PARM_DESC(hwseqnum," Try to use hardware 802.11 header sequence numbers. Zero=default");
+MODULE_PARM_DESC(hwwep," Try to use hardware security support. ");
+MODULE_PARM_DESC(channels," Channel bitmask for specific locales. NYI");
+
+static int __devinit rtl8192_usb_probe(struct usb_interface *intf,
+			 const struct usb_device_id *id);
+static void __devexit rtl8192_usb_disconnect(struct usb_interface *intf);
+
+
+static struct usb_driver rtl8192_usb_driver = {
+	.name		= RTL819xU_MODULE_NAME,		  /* Driver name   */
+	.id_table	= rtl8192_usb_id_tbl,		  /* PCI_ID table  */
+	.probe		= rtl8192_usb_probe,		  /* probe fn      */
+	.disconnect	= rtl8192_usb_disconnect,	  /* remove fn     */
+#ifdef CONFIG_RTL8192_PM
+	.suspend	= rtl8192_suspend,		  /* PM suspend fn */
+	.resume		= rtl8192_resume,                 /* PM resume fn  */
+#else
+	.suspend	= NULL,				  /* PM suspend fn */
+	.resume      	= NULL,				  /* PM resume fn  */
+#endif
+};
+
+#ifdef ENABLE_DOT11D
+
+typedef struct _CHANNEL_LIST
+{
+	u8	Channel[32];
+	u8	Len;
+}CHANNEL_LIST, *PCHANNEL_LIST;
+
+static CHANNEL_LIST ChannelPlan[] = {
+	{{1,2,3,4,5,6,7,8,9,10,11,36,40,44,48,52,56,60,64,149,153,157,161,165},24},  		//FCC
+	{{1,2,3,4,5,6,7,8,9,10,11},11},                    				//IC
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13,36,40,44,48,52,56,60,64},21},  	//ETSI
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13},13},    //Spain. Change to ETSI.
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13},13},  	//France. Change to ETSI.
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13,14,36,40,44,48,52,56,60,64},22},	//MKK					//MKK
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13,14,36,40,44,48,52,56,60,64},22},//MKK1
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13},13},	//Israel.
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13,14,36,40,44,48,52,56,60,64},22},			// For 11a , TELEC
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13,14,36,40,44,48,52,56,60,64}, 22},    //MIC
+	{{1,2,3,4,5,6,7,8,9,10,11,12,13,14},14}					//For Global Domain. 1-11:active scan, 12-14 passive scan. //+YJ, 080626
+};
+
+static void rtl819x_set_channel_map(u8 channel_plan, struct r8192_priv* priv)
+{
+	int i, max_chan=-1, min_chan=-1;
+	struct ieee80211_device* ieee = priv->ieee80211;
+	switch (channel_plan)
+	{
+		case COUNTRY_CODE_FCC:
+		case COUNTRY_CODE_IC:
+		case COUNTRY_CODE_ETSI:
+		case COUNTRY_CODE_SPAIN:
+		case COUNTRY_CODE_FRANCE:
+		case COUNTRY_CODE_MKK:
+		case COUNTRY_CODE_MKK1:
+		case COUNTRY_CODE_ISRAEL:
+		case COUNTRY_CODE_TELEC:
+		case COUNTRY_CODE_MIC:
+		{
+			Dot11d_Init(ieee);
+			ieee->bGlobalDomain = false;
+			//acturally 8225 & 8256 rf chip only support B,G,24N mode
+			if ((priv->rf_chip == RF_8225) || (priv->rf_chip == RF_8256))
+			{
+				min_chan = 1;
+				max_chan = 14;
+			}
+			else
+			{
+				RT_TRACE(COMP_ERR, "unknown rf chip, can't set channel map in function:%s()\n", __FUNCTION__);
+			}
+			if (ChannelPlan[channel_plan].Len != 0){
+				// Clear old channel map
+				memset(GET_DOT11D_INFO(ieee)->channel_map, 0, sizeof(GET_DOT11D_INFO(ieee)->channel_map));
+				// Set new channel map
+				for (i=0;i<ChannelPlan[channel_plan].Len;i++)
+				{
+					if (ChannelPlan[channel_plan].Channel[i] < min_chan || ChannelPlan[channel_plan].Channel[i] > max_chan)
+					break;
+					GET_DOT11D_INFO(ieee)->channel_map[ChannelPlan[channel_plan].Channel[i]] = 1;
+				}
+			}
+			break;
+		}
+		case COUNTRY_CODE_GLOBAL_DOMAIN:
+		{
+			GET_DOT11D_INFO(ieee)->bEnabled = 0;//this flag enabled to follow 11d country IE setting, otherwise, it shall follow global domain settings.
+			Dot11d_Reset(ieee);
+			ieee->bGlobalDomain = true;
+			break;
+		}
+		default:
+			break;
+	}
+	return;
+}
+#endif
+
+#define eqMacAddr(a,b) ( ((a)[0]==(b)[0] && (a)[1]==(b)[1] && (a)[2]==(b)[2] && (a)[3]==(b)[3] && (a)[4]==(b)[4] && (a)[5]==(b)[5]) ? 1:0 )
+
+#define 	rx_hal_is_cck_rate(_pdrvinfo)\
+			(_pdrvinfo->RxRate == DESC90_RATE1M ||\
+			_pdrvinfo->RxRate == DESC90_RATE2M ||\
+			_pdrvinfo->RxRate == DESC90_RATE5_5M ||\
+			_pdrvinfo->RxRate == DESC90_RATE11M) &&\
+			!_pdrvinfo->RxHT\
+
+
+void CamResetAllEntry(struct net_device *dev)
+{
+	u32 ulcommand = 0;
+	//2004/02/11  In static WEP, OID_ADD_KEY or OID_ADD_WEP are set before STA associate to AP.
+	// However, ResetKey is called on OID_802_11_INFRASTRUCTURE_MODE and MlmeAssociateRequest
+	// In this condition, Cam can not be reset because upper layer will not set this static key again.
+	//if(Adapter->EncAlgorithm == WEP_Encryption)
+	//      return;
+//debug
+	//DbgPrint("========================================\n");
+	//DbgPrint("                            Call ResetAllEntry                                              \n");
+	//DbgPrint("========================================\n\n");
+	ulcommand |= BIT31|BIT30;
+	write_nic_dword(dev, RWCAM, ulcommand);
+
+}
+
+
+void write_cam(struct net_device *dev, u8 addr, u32 data)
+{
+	write_nic_dword(dev, WCAMI, data);
+	write_nic_dword(dev, RWCAM, BIT31|BIT16|(addr&0xff) );
+}
+
+u32 read_cam(struct net_device *dev, u8 addr)
+{
+	write_nic_dword(dev, RWCAM, 0x80000000|(addr&0xff) );
+	return read_nic_dword(dev, 0xa8);
+}
+
+void write_nic_byte_E(struct net_device *dev, int indx, u8 data)
+{
+	int status;
+	struct r8192_priv *priv = (struct r8192_priv *)ieee80211_priv(dev);
+	struct usb_device *udev = priv->udev;
+
+	status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
+			       RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE,
+			       indx|0xfe00, 0, &data, 1, HZ / 2);
+
+	if (status < 0)
+	{
+		printk("write_nic_byte_E TimeOut! status:%d\n", status);
+	}
+}
+
+u8 read_nic_byte_E(struct net_device *dev, int indx)
+{
+	int status;
+	u8 data;
+	struct r8192_priv *priv = (struct r8192_priv *)ieee80211_priv(dev);
+	struct usb_device *udev = priv->udev;
+
+	status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
+			       RTL8187_REQ_GET_REGS, RTL8187_REQT_READ,
+			       indx|0xfe00, 0, &data, 1, HZ / 2);
+
+	if (status < 0)
+	{
+		printk("read_nic_byte_E TimeOut! status:%d\n", status);
+	}
+
+	return data;
+}
+//as 92U has extend page from 4 to 16, so modify functions below.
+void write_nic_byte(struct net_device *dev, int indx, u8 data)
+{
+	int status;
+
+	struct r8192_priv *priv = (struct r8192_priv *)ieee80211_priv(dev);
+	struct usb_device *udev = priv->udev;
+
+	status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
+			       RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE,
+			       (indx&0xff)|0xff00, (indx>>8)&0x0f, &data, 1, HZ / 2);
+
+	if (status < 0)
+	{
+		printk("write_nic_byte TimeOut! status:%d\n", status);
+	}
+
+
+}
+
+
+void write_nic_word(struct net_device *dev, int indx, u16 data)
+{
+
+	int status;
+
+	struct r8192_priv *priv = (struct r8192_priv *)ieee80211_priv(dev);
+	struct usb_device *udev = priv->udev;
+
+	status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
+			       RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE,
+			       (indx&0xff)|0xff00, (indx>>8)&0x0f, &data, 2, HZ / 2);
+
+	if (status < 0)
+	{
+		printk("write_nic_word TimeOut! status:%d\n", status);
+	}
+
+}
+
+
+void write_nic_dword(struct net_device *dev, int indx, u32 data)
+{
+
+	int status;
+
+	struct r8192_priv *priv = (struct r8192_priv *)ieee80211_priv(dev);
+	struct usb_device *udev = priv->udev;
+
+	status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
+			       RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE,
+			       (indx&0xff)|0xff00, (indx>>8)&0x0f, &data, 4, HZ / 2);
+
+
+	if (status < 0)
+	{
+		printk("write_nic_dword TimeOut! status:%d\n", status);
+	}
+
+}
+
+
+
+u8 read_nic_byte(struct net_device *dev, int indx)
+{
+	u8 data;
+	int status;
+	struct r8192_priv *priv = (struct r8192_priv *)ieee80211_priv(dev);
+	struct usb_device *udev = priv->udev;
+
+	status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
+			       RTL8187_REQ_GET_REGS, RTL8187_REQT_READ,
+			       (indx&0xff)|0xff00, (indx>>8)&0x0f, &data, 1, HZ / 2);
+
+	if (status < 0)
+	{
+		printk("read_nic_byte TimeOut! status:%d\n", status);
+	}
+
+	return data;
+}
+
+
+
+u16 read_nic_word(struct net_device *dev, int indx)
+{
+	u16 data;
+	int status;
+	struct r8192_priv *priv = (struct r8192_priv *)ieee80211_priv(dev);
+	struct usb_device *udev = priv->udev;
+
+	status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
+			       RTL8187_REQ_GET_REGS, RTL8187_REQT_READ,
+			       (indx&0xff)|0xff00, (indx>>8)&0x0f, &data, 2, HZ / 2);
+
+	if (status < 0)
+	{
+		printk("read_nic_word TimeOut! status:%d\n", status);
+	}
+
+
+	return data;
+}
+
+u16 read_nic_word_E(struct net_device *dev, int indx)
+{
+	u16 data;
+	int status;
+	struct r8192_priv *priv = (struct r8192_priv *)ieee80211_priv(dev);
+	struct usb_device *udev = priv->udev;
+
+	status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
+			       RTL8187_REQ_GET_REGS, RTL8187_REQT_READ,
+			       indx|0xfe00, 0, &data, 2, HZ / 2);
+
+	if (status < 0)
+	{
+		printk("read_nic_word TimeOut! status:%d\n", status);
+	}
+
+
+	return data;
+}
+
+u32 read_nic_dword(struct net_device *dev, int indx)
+{
+	u32 data;
+	int status;
+//	int result;
+
+	struct r8192_priv *priv = (struct r8192_priv *)ieee80211_priv(dev);
+	struct usb_device *udev = priv->udev;
+
+	status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
+			       RTL8187_REQ_GET_REGS, RTL8187_REQT_READ,
+			       (indx&0xff)|0xff00, (indx>>8)&0x0f, &data, 4, HZ / 2);
+//	if(0 != result) {
+//	  printk(KERN_WARNING "read size of data = %d\, date = %d\n", result, data);
+//	}
+
+	if (status < 0)
+	{
+		printk("read_nic_dword TimeOut! status:%d\n", status);
+	}
+
+
+
+	return data;
+}
+
+
+//u8 read_phy_cck(struct net_device *dev, u8 adr);
+//u8 read_phy_ofdm(struct net_device *dev, u8 adr);
+/* this might still called in what was the PHY rtl8185/rtl8192 common code
+ * plans are to possibilty turn it again in one common code...
+ */
+inline void force_pci_posting(struct net_device *dev)
+{
+}
+
+
+static struct net_device_stats *rtl8192_stats(struct net_device *dev);
+void rtl8192_commit(struct net_device *dev);
+//void rtl8192_restart(struct net_device *dev);
+void rtl8192_restart(struct work_struct *work);
+//void rtl8192_rq_tx_ack(struct work_struct *work);
+
+void watch_dog_timer_callback(unsigned long data);
+
+/****************************************************************************
+   -----------------------------PROCFS STUFF-------------------------
+*****************************************************************************/
+
+static struct proc_dir_entry *rtl8192_proc = NULL;
+
+
+
+static int proc_get_stats_ap(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	struct r8192_priv *priv = (struct r8192_priv *)ieee80211_priv(dev);
+	struct ieee80211_device *ieee = priv->ieee80211;
+	struct ieee80211_network *target;
+
+	int len = 0;
+
+	list_for_each_entry(target, &ieee->network_list, list) {
+
+		len += snprintf(page + len, count - len,
+		"%s ", target->ssid);
+
+		if(target->wpa_ie_len>0 || target->rsn_ie_len>0){
+			len += snprintf(page + len, count - len,
+			"WPA\n");
+		}
+		else{
+			len += snprintf(page + len, count - len,
+			"non_WPA\n");
+		}
+
+	}
+
+	*eof = 1;
+	return len;
+}
+
+static int proc_get_registers(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+//	struct r8192_priv *priv = (struct r8192_priv *)ieee80211_priv(dev);
+
+	int len = 0;
+	int i,n;
+
+	int max=0xff;
+
+	/* This dump the current register page */
+len += snprintf(page + len, count - len,
+			"\n####################page 0##################\n ");
+
+	for(n=0;n<=max;)
+	{
+		//printk( "\nD: %2x> ", n);
+		len += snprintf(page + len, count - len,
+			"\nD:  %2x > ",n);
+
+		for(i=0;i<16 && n<=max;i++,n++)
+		len += snprintf(page + len, count - len,
+			"%2x ",read_nic_byte(dev,0x000|n));
+
+		//	printk("%2x ",read_nic_byte(dev,n));
+	}
+len += snprintf(page + len, count - len,
+			"\n####################page 1##################\n ");
+	for(n=0;n<=max;)
+	{
+		//printk( "\nD: %2x> ", n);
+		len += snprintf(page + len, count - len,
+			"\nD:  %2x > ",n);
+
+		for(i=0;i<16 && n<=max;i++,n++)
+		len += snprintf(page + len, count - len,
+			"%2x ",read_nic_byte(dev,0x100|n));
+
+		//      printk("%2x ",read_nic_byte(dev,n));
+	}
+len += snprintf(page + len, count - len,
+			"\n####################page 3##################\n ");
+	for(n=0;n<=max;)
+	{
+		//printk( "\nD: %2x> ", n);
+		len += snprintf(page + len, count - len,
+			"\nD:  %2x > ",n);
+
+		for(i=0;i<16 && n<=max;i++,n++)
+		len += snprintf(page + len, count - len,
+			"%2x ",read_nic_byte(dev,0x300|n));
+
+		//      printk("%2x ",read_nic_byte(dev,n));
+	}
+
+
+	len += snprintf(page + len, count - len,"\n");
+	*eof = 1;
+	return len;
+
+}
+
+
+
+
+
+static int proc_get_stats_tx(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	struct r8192_priv *priv = (struct r8192_priv *)ieee80211_priv(dev);
+
+	int len = 0;
+
+	len += snprintf(page + len, count - len,
+		"TX VI priority ok int: %lu\n"
+		"TX VI priority error int: %lu\n"
+		"TX VO priority ok int: %lu\n"
+		"TX VO priority error int: %lu\n"
+		"TX BE priority ok int: %lu\n"
+		"TX BE priority error int: %lu\n"
+		"TX BK priority ok int: %lu\n"
+		"TX BK priority error int: %lu\n"
+		"TX MANAGE priority ok int: %lu\n"
+		"TX MANAGE priority error int: %lu\n"
+		"TX BEACON priority ok int: %lu\n"
+		"TX BEACON priority error int: %lu\n"
+//		"TX high priority ok int: %lu\n"
+//		"TX high priority failed error int: %lu\n"
+		"TX queue resume: %lu\n"
+		"TX queue stopped?: %d\n"
+		"TX fifo overflow: %lu\n"
+//		"TX beacon: %lu\n"
+		"TX VI queue: %d\n"
+		"TX VO queue: %d\n"
+		"TX BE queue: %d\n"
+		"TX BK queue: %d\n"
+//		"TX HW queue: %d\n"
+		"TX VI dropped: %lu\n"
+		"TX VO dropped: %lu\n"
+		"TX BE dropped: %lu\n"
+		"TX BK dropped: %lu\n"
+		"TX total data packets %lu\n",
+//		"TX beacon aborted: %lu\n",
+		priv->stats.txviokint,
+		priv->stats.txvierr,
+		priv->stats.txvookint,
+		priv->stats.txvoerr,
+		priv->stats.txbeokint,
+		priv->stats.txbeerr,
+		priv->stats.txbkokint,
+		priv->stats.txbkerr,
+		priv->stats.txmanageokint,
+		priv->stats.txmanageerr,
+		priv->stats.txbeaconokint,
+		priv->stats.txbeaconerr,
+//		priv->stats.txhpokint,
+//		priv->stats.txhperr,
+		priv->stats.txresumed,
+		netif_queue_stopped(dev),
+		priv->stats.txoverflow,
+//		priv->stats.txbeacon,
+		atomic_read(&(priv->tx_pending[VI_PRIORITY])),
+		atomic_read(&(priv->tx_pending[VO_PRIORITY])),
+		atomic_read(&(priv->tx_pending[BE_PRIORITY])),
+		atomic_read(&(priv->tx_pending[BK_PRIORITY])),
+//		read_nic_byte(dev, TXFIFOCOUNT),
+		priv->stats.txvidrop,
+		priv->stats.txvodrop,
+		priv->stats.txbedrop,
+		priv->stats.txbkdrop,
+		priv->stats.txdatapkt
+//		priv->stats.txbeaconerr
+		);
+
+	*eof = 1;
+	return len;
+}
+
+
+
+static int proc_get_stats_rx(char *page, char **start,
+			  off_t offset, int count,
+			  int *eof, void *data)
+{
+	struct net_device *dev = data;
+	struct r8192_priv *priv = (struct r8192_priv *)ieee80211_priv(dev);
+
+	int len = 0;
+
+	len += snprintf(page + len, count - len,
+		"RX packets: %lu\n"
+		"RX urb status error: %lu\n"
+		"RX invalid urb error: %lu\n",
+		priv->stats.rxoktotal,
+		priv->stats.rxstaterr,
+		priv->stats.rxurberr);
+
+	*eof = 1;
+	return len;
+}
+void rtl8192_proc_module_init(void)
+{
+	RT_TRACE(COMP_INIT, "Initializing proc filesystem");
+	rtl8192_proc=create_proc_entry(RTL819xU_MODULE_NAME, S_IFDIR, init_net.proc_net);
+}
+
+
+void rtl8192_proc_module_remove(void)
+{
+	remove_proc_entry(RTL819xU_MODULE_NAME, init_net.proc_net);
+}
+
+
+void rtl8192_proc_remove_one(struct net_device *dev)
+{
+	struct r8192_priv *priv = (struct r8192_priv *)ieee80211_priv(dev);
+
+
+	if (priv->dir_dev) {
+	//	remove_proc_entry("stats-hw", priv->dir_dev);
+		remove_proc_entry("stats-tx", priv->dir_dev);
+		remove_proc_entry("stats-rx", priv->dir_dev);
+	//	remove_proc_entry("stats-ieee", priv->dir_dev);
+		remove_proc_entry("stats-ap", priv->dir_dev);
+		remove_proc_entry("registers", priv->dir_dev);
+	//	remove_proc_entry("cck-registers",priv->dir_dev);
+	//	remove_proc_entry("ofdm-registers",priv->dir_dev);
+		//remove_proc_entry(dev->name, rtl8192_proc);
+		remove_proc_entry("wlan0", rtl8192_proc);
+		priv->dir_dev = NULL;
+	}
+}
+
+
+void rtl8192_proc_init_one(struct net_device *dev)
+{
+	struct proc_dir_entry *e;
+	struct r8192_priv *priv = (struct r8192_priv *)ieee80211_priv(dev);
+	priv->dir_dev = create_proc_entry(dev->name,
+					  S_IFDIR | S_IRUGO | S_IXUGO,
+					  rtl8192_proc);
+	if (!priv->dir_dev) {
+		RT_TRACE(COMP_ERR, "Unable to initialize /proc/net/rtl8192/%s\n",
+		      dev->name);
+		return;
+	}
+	e = create_proc_read_entry("stats-rx", S_IFREG | S_IRUGO,
+				   priv->dir_dev, proc_get_stats_rx, dev);
+
+	if (!e) {
+		RT_TRACE(COMP_ERR,"Unable to initialize "
+		      "/proc/net/rtl8192/%s/stats-rx\n",
+		      dev->name);
+	}
+
+
+	e = create_proc_read_entry("stats-tx", S_IFREG | S_IRUGO,
+				   priv->dir_dev, proc_get_stats_tx, dev);
+
+	if (!e) {
+		RT_TRACE(COMP_ERR, "Unable to initialize "
+		      "/proc/net/rtl8192/%s/stats-tx\n",
+		      dev->name);
+	}
+
+	e = create_proc_read_entry("stats-ap", S_IFREG | S_IRUGO,
+				   priv->dir_dev, proc_get_stats_ap, dev);
+
+	if (!e) {
+		RT_TRACE(COMP_ERR, "Unable to initialize "
+		      "/proc/net/rtl8192/%s/stats-ap\n",
+		      dev->name);
+	}
+
+	e = create_proc_read_entry("registers", S_IFREG | S_IRUGO,
+				   priv->dir_dev, proc_get_registers, dev);
+	if (!e) {
+		RT_TRACE(COMP_ERR, "Unable to initialize "
+		      "/proc/net/rtl8192/%s/registers\n",
+		      dev->name);
+	}
+}
+/****************************************************************************
+   -----------------------------MISC STUFF-------------------------
+*****************************************************************************/
+
+/* this is only for debugging */
+void print_buffer(u32 *buffer, int len)
+{
+	int i;
+	u8 *buf =(u8*)buffer;
+
+	printk("ASCII BUFFER DUMP (len: %x):\n",len);
+
+	for(i=0;i<len;i++)
+		printk("%c",buf[i]);
+
+	printk("\nBINARY BUFFER DUMP (len: %x):\n",len);
+
+	for(i=0;i<len;i++)
+		printk("%x",buf[i]);
+
+	printk("\n");
+}
+
+//short check_nic_enough_desc(struct net_device *dev, priority_t priority)
+short check_nic_enough_desc(struct net_device *dev,int queue_index)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	int used = atomic_read(&priv->tx_pending[queue_index]);
+
+	return (used < MAX_TX_URB);
+}
+
+void tx_timeout(struct net_device *dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	//rtl8192_commit(dev);
+
+	schedule_work(&priv->reset_wq);
+	//DMESG("TXTIMEOUT");
+}
+
+
+/* this is only for debug */
+void dump_eprom(struct net_device *dev)
+{
+	int i;
+	for(i=0; i<63; i++)
+		RT_TRACE(COMP_EPROM, "EEPROM addr %x : %x", i, eprom_read(dev,i));
+}
+
+/* this is only for debug */
+void rtl8192_dump_reg(struct net_device *dev)
+{
+	int i;
+	int n;
+	int max=0x1ff;
+
+	RT_TRACE(COMP_PHY, "Dumping NIC register map");
+
+	for(n=0;n<=max;)
+	{
+		printk( "\nD: %2x> ", n);
+		for(i=0;i<16 && n<=max;i++,n++)
+			printk("%2x ",read_nic_byte(dev,n));
+	}
+	printk("\n");
+}
+
+/****************************************************************************
+      ------------------------------HW STUFF---------------------------
+*****************************************************************************/
+
+
+void rtl8192_set_mode(struct net_device *dev,int mode)
+{
+	u8 ecmd;
+	ecmd=read_nic_byte(dev, EPROM_CMD);
+	ecmd=ecmd &~ EPROM_CMD_OPERATING_MODE_MASK;
+	ecmd=ecmd | (mode<<EPROM_CMD_OPERATING_MODE_SHIFT);
+	ecmd=ecmd &~ (1<<EPROM_CS_SHIFT);
+	ecmd=ecmd &~ (1<<EPROM_CK_SHIFT);
+	write_nic_byte(dev, EPROM_CMD, ecmd);
+}
+
+
+void rtl8192_update_msr(struct net_device *dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	u8 msr;
+
+	msr  = read_nic_byte(dev, MSR);
+	msr &= ~ MSR_LINK_MASK;
+
+	/* do not change in link_state != WLAN_LINK_ASSOCIATED.
+	 * msr must be updated if the state is ASSOCIATING.
+	 * this is intentional and make sense for ad-hoc and
+	 * master (see the create BSS/IBSS func)
+	 */
+	if (priv->ieee80211->state == IEEE80211_LINKED){
+
+		if (priv->ieee80211->iw_mode == IW_MODE_INFRA)
+			msr |= (MSR_LINK_MANAGED<<MSR_LINK_SHIFT);
+		else if (priv->ieee80211->iw_mode == IW_MODE_ADHOC)
+			msr |= (MSR_LINK_ADHOC<<MSR_LINK_SHIFT);
+		else if (priv->ieee80211->iw_mode == IW_MODE_MASTER)
+			msr |= (MSR_LINK_MASTER<<MSR_LINK_SHIFT);
+
+	}else
+		msr |= (MSR_LINK_NONE<<MSR_LINK_SHIFT);
+
+	write_nic_byte(dev, MSR, msr);
+}
+
+void rtl8192_set_chan(struct net_device *dev,short ch)
+{
+	struct r8192_priv *priv = (struct r8192_priv *)ieee80211_priv(dev);
+//	u32 tx;
+	RT_TRACE(COMP_CH, "=====>%s()====ch:%d\n", __FUNCTION__, ch);
+	priv->chan=ch;
+
+	/* this hack should avoid frame TX during channel setting*/
+
+
+//	tx = read_nic_dword(dev,TX_CONF);
+//	tx &= ~TX_LOOPBACK_MASK;
+
+#ifndef LOOP_TEST
+//	write_nic_dword(dev,TX_CONF, tx |( TX_LOOPBACK_MAC<<TX_LOOPBACK_SHIFT));
+
+	//need to implement rf set channel here WB
+
+	if (priv->rf_set_chan)
+	priv->rf_set_chan(dev,priv->chan);
+	mdelay(10);
+//	write_nic_dword(dev,TX_CONF,tx | (TX_LOOPBACK_NONE<<TX_LOOPBACK_SHIFT));
+#endif
+}
+
+static void rtl8192_rx_isr(struct urb *urb);
+//static void rtl8192_rx_isr(struct urb *rx_urb);
+
+u32 get_rxpacket_shiftbytes_819xusb(struct ieee80211_rx_stats *pstats)
+{
+
+#ifdef USB_RX_AGGREGATION_SUPPORT
+	if (pstats->bisrxaggrsubframe)
+		return (sizeof(rx_desc_819x_usb) + pstats->RxDrvInfoSize
+			+ pstats->RxBufShift + 8);
+	else
+#endif
+		return (sizeof(rx_desc_819x_usb) + pstats->RxDrvInfoSize
+				+ pstats->RxBufShift);
+
+}
+static int rtl8192_rx_initiate(struct net_device*dev)
+{
+	struct r8192_priv *priv = (struct r8192_priv *)ieee80211_priv(dev);
+	struct urb *entry;
+	struct sk_buff *skb;
+	struct rtl8192_rx_info *info;
+
+	/* nomal packet rx procedure */
+	while (skb_queue_len(&priv->rx_queue) < MAX_RX_URB) {
+		skb = __dev_alloc_skb(RX_URB_SIZE, GFP_KERNEL);
+		if (!skb)
+			break;
+		entry = usb_alloc_urb(0, GFP_KERNEL);
+		if (!entry) {
+			kfree_skb(skb);
+			break;
+		}
+//		printk("nomal packet IN request!\n");
+		usb_fill_bulk_urb(entry, priv->udev,
+				  usb_rcvbulkpipe(priv->udev, 3), skb_tail_pointer(skb),
+				  RX_URB_SIZE, rtl8192_rx_isr, skb);
+		info = (struct rtl8192_rx_info *) skb->cb;
+		info->urb = entry;
+		info->dev = dev;
+		info->out_pipe = 3; //denote rx normal packet queue
+		skb_queue_tail(&priv->rx_queue, skb);
+		usb_submit_urb(entry, GFP_KERNEL);
+	}
+
+	/* command packet rx procedure */
+	while (skb_queue_len(&priv->rx_queue) < MAX_RX_URB + 3) {
+//		printk("command packet IN request!\n");
+		skb = __dev_alloc_skb(RX_URB_SIZE ,GFP_KERNEL);
+		if (!skb)
+			break;
+		entry = usb_alloc_urb(0, GFP_KERNEL);
+		if (!entry) {
+			kfree_skb(skb);
+			break;
+		}
+		usb_fill_bulk_urb(entry, priv->udev,
+				  usb_rcvbulkpipe(priv->udev, 9), skb_tail_pointer(skb),
+				  RX_URB_SIZE, rtl8192_rx_isr, skb);
+		info = (struct rtl8192_rx_info *) skb->cb;
+		info->urb = entry;
+		info->dev = dev;
+		   info->out_pipe = 9; //denote rx cmd packet queue
+		skb_queue_tail(&priv->rx_queue, skb);
+		usb_submit_urb(entry, GFP_KERNEL);
+	}
+
+	return 0;
+}
+
+void rtl8192_set_rxconf(struct net_device *dev)
+{
+	struct r8192_priv *priv = (struct r8192_priv *)ieee80211_priv(dev);
+	u32 rxconf;
+
+	rxconf=read_nic_dword(dev,RCR);
+	rxconf = rxconf &~ MAC_FILTER_MASK;
+	rxconf = rxconf | RCR_AMF;
+	rxconf = rxconf | RCR_ADF;
+	rxconf = rxconf | RCR_AB;
+	rxconf = rxconf | RCR_AM;
+	//rxconf = rxconf | RCR_ACF;
+
+	if (dev->flags & IFF_PROMISC) {DMESG ("NIC in promisc mode");}
+
+	if(priv->ieee80211->iw_mode == IW_MODE_MONITOR || \
+	   dev->flags & IFF_PROMISC){
+		rxconf = rxconf | RCR_AAP;
+	} /*else if(priv->ieee80211->iw_mode == IW_MODE_MASTER){
+		rxconf = rxconf | (1<<ACCEPT_ALLMAC_FRAME_SHIFT);
+		rxconf = rxconf | (1<<RX_CHECK_BSSID_SHIFT);
+	}*/else{
+		rxconf = rxconf | RCR_APM;
+		rxconf = rxconf | RCR_CBSSID;
+	}
+
+
+	if(priv->ieee80211->iw_mode == IW_MODE_MONITOR){
+		rxconf = rxconf | RCR_AICV;
+		rxconf = rxconf | RCR_APWRMGT;
+	}
+
+	if( priv->crcmon == 1 && priv->ieee80211->iw_mode == IW_MODE_MONITOR)
+		rxconf = rxconf | RCR_ACRC32;
+
+
+	rxconf = rxconf &~ RX_FIFO_THRESHOLD_MASK;
+	rxconf = rxconf | (RX_FIFO_THRESHOLD_NONE<<RX_FIFO_THRESHOLD_SHIFT);
+	rxconf = rxconf &~ MAX_RX_DMA_MASK;
+	rxconf = rxconf | ((u32)7<<RCR_MXDMA_OFFSET);
+
+//	rxconf = rxconf | (1<<RX_AUTORESETPHY_SHIFT);
+	rxconf = rxconf | RCR_ONLYERLPKT;
+
+//	rxconf = rxconf &~ RCR_CS_MASK;
+//	rxconf = rxconf | (1<<RCR_CS_SHIFT);
+
+	write_nic_dword(dev, RCR, rxconf);
+
+	#ifdef DEBUG_RX
+	DMESG("rxconf: %x %x",rxconf ,read_nic_dword(dev,RCR));
+	#endif
+}
+//wait to be removed
+void rtl8192_rx_enable(struct net_device *dev)
+{
+	//u8 cmd;
+
+	//struct r8192_priv *priv = (struct r8192_priv *)ieee80211_priv(dev);
+
+	rtl8192_rx_initiate(dev);
+
+//	rtl8192_set_rxconf(dev);
+}
+
+
+void rtl8192_tx_enable(struct net_device *dev)
+{
+}
+
+
+
+void rtl8192_rtx_disable(struct net_device *dev)
+{
+	u8 cmd;
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	struct sk_buff *skb;
+	struct rtl8192_rx_info *info;
+
+	cmd=read_nic_byte(dev,CMDR);
+	write_nic_byte(dev, CMDR, cmd &~ \
+		(CR_TE|CR_RE));
+	force_pci_posting(dev);
+	mdelay(10);
+
+	while ((skb = __skb_dequeue(&priv->rx_queue))) {
+		info = (struct rtl8192_rx_info *) skb->cb;
+		if (!info->urb)
+			continue;
+
+		usb_kill_urb(info->urb);
+		kfree_skb(skb);
+	}
+
+	if (skb_queue_len(&priv->skb_queue)) {
+		printk(KERN_WARNING "skb_queue not empty\n");
+	}
+
+	skb_queue_purge(&priv->skb_queue);
+	return;
+}
+
+
+int alloc_tx_beacon_desc_ring(struct net_device *dev, int count)
+{
+	return 0;
+}
+
+inline u16 ieeerate2rtlrate(int rate)
+{
+	switch(rate){
+	case 10:
+	return 0;
+	case 20:
+	return 1;
+	case 55:
+	return 2;
+	case 110:
+	return 3;
+	case 60:
+	return 4;
+	case 90:
+	return 5;
+	case 120:
+	return 6;
+	case 180:
+	return 7;
+	case 240:
+	return 8;
+	case 360:
+	return 9;
+	case 480:
+	return 10;
+	case 540:
+	return 11;
+	default:
+	return 3;
+
+	}
+}
+static u16 rtl_rate[] = {10,20,55,110,60,90,120,180,240,360,480,540};
+inline u16 rtl8192_rate2rate(short rate)
+{
+	if (rate >11) return 0;
+	return rtl_rate[rate];
+}
+
+
+/* The protype of rx_isr has changed since one verion of Linux Kernel */
+static void rtl8192_rx_isr(struct urb *urb)
+{
+	struct sk_buff *skb = (struct sk_buff *) urb->context;
+	struct rtl8192_rx_info *info = (struct rtl8192_rx_info *)skb->cb;
+	struct net_device *dev = info->dev;
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	int out_pipe = info->out_pipe;
+	int err;
+	if(!priv->up)
+		return;
+	if (unlikely(urb->status)) {
+		info->urb = NULL;
+		priv->stats.rxstaterr++;
+		priv->ieee80211->stats.rx_errors++;
+		usb_free_urb(urb);
+	//	printk("%s():rx status err\n",__FUNCTION__);
+		return;
+	}
+	skb_unlink(skb, &priv->rx_queue);
+	skb_put(skb, urb->actual_length);
+
+	skb_queue_tail(&priv->skb_queue, skb);
+	tasklet_schedule(&priv->irq_rx_tasklet);
+
+	skb = dev_alloc_skb(RX_URB_SIZE);
+	if (unlikely(!skb)) {
+		usb_free_urb(urb);
+		printk("%s():can,t alloc skb\n",__FUNCTION__);
+		/* TODO check rx queue length and refill *somewhere* */
+		return;
+	}
+
+	usb_fill_bulk_urb(urb, priv->udev,
+			usb_rcvbulkpipe(priv->udev, out_pipe), skb_tail_pointer(skb),
+			RX_URB_SIZE, rtl8192_rx_isr, skb);
+
+	info = (struct rtl8192_rx_info *) skb->cb;
+	info->urb = urb;
+	info->dev = dev;
+	info->out_pipe = out_pipe;
+
+	urb->transfer_buffer = skb_tail_pointer(skb);
+	urb->context = skb;
+	skb_queue_tail(&priv->rx_queue, skb);
+	err = usb_submit_urb(urb, GFP_ATOMIC);
+	if(err && err != EPERM)
+		printk("can not submit rxurb, err is %x,URB status is %x\n",err,urb->status);
+}
+
+u32
+rtl819xusb_rx_command_packet(
+	struct net_device *dev,
+	struct ieee80211_rx_stats *pstats
+	)
+{
+	u32	status;
+
+	//RT_TRACE(COMP_RECV, DBG_TRACE, ("---> RxCommandPacketHandle819xUsb()\n"));
+
+	status = cmpk_message_handle_rx(dev, pstats);
+	if (status)
+	{
+		DMESG("rxcommandpackethandle819xusb: It is a command packet\n");
+	}
+	else
+	{
+		//RT_TRACE(COMP_RECV, DBG_TRACE, ("RxCommandPacketHandle819xUsb: It is not a command packet\n"));
+	}
+
+	//RT_TRACE(COMP_RECV, DBG_TRACE, ("<--- RxCommandPacketHandle819xUsb()\n"));
+	return status;
+}
+
+
+void rtl8192_data_hard_stop(struct net_device *dev)
+{
+	//FIXME !!
+}
+
+
+void rtl8192_data_hard_resume(struct net_device *dev)
+{
+	// FIXME !!
+}
+
+/* this function TX data frames when the ieee80211 stack requires this.
+ * It checks also if we need to stop the ieee tx queue, eventually do it
+ */
+void rtl8192_hard_data_xmit(struct sk_buff *skb, struct net_device *dev, int rate)
+{
+	struct r8192_priv *priv = (struct r8192_priv *)ieee80211_priv(dev);
+	int ret;
+	unsigned long flags;
+	cb_desc *tcb_desc = (cb_desc *)(skb->cb + MAX_DEV_ADDR_SIZE);
+	u8 queue_index = tcb_desc->queue_index;
+
+	/* shall not be referred by command packet */
+	assert(queue_index != TXCMD_QUEUE);
+
+	spin_lock_irqsave(&priv->tx_lock,flags);
+
+	memcpy((unsigned char *)(skb->cb),&dev,sizeof(dev));
+//	tcb_desc->RATRIndex = 7;
+//	tcb_desc->bTxDisableRateFallBack = 1;
+//	tcb_desc->bTxUseDriverAssingedRate = 1;
+	tcb_desc->bTxEnableFwCalcDur = 1;
+	skb_push(skb, priv->ieee80211->tx_headroom);
+	ret = rtl8192_tx(dev, skb);
+
+	//priv->ieee80211->stats.tx_bytes+=(skb->len - priv->ieee80211->tx_headroom);
+	//priv->ieee80211->stats.tx_packets++;
+
+	spin_unlock_irqrestore(&priv->tx_lock,flags);
+
+//	return ret;
+	return;
+}
+
+/* This is a rough attempt to TX a frame
+ * This is called by the ieee 80211 stack to TX management frames.
+ * If the ring is full packet are dropped (for data frame the queue
+ * is stopped before this can happen).
+ */
+int rtl8192_hard_start_xmit(struct sk_buff *skb,struct net_device *dev)
+{
+	struct r8192_priv *priv = (struct r8192_priv *)ieee80211_priv(dev);
+	int ret;
+	unsigned long flags;
+	cb_desc *tcb_desc = (cb_desc *)(skb->cb + MAX_DEV_ADDR_SIZE);
+	u8 queue_index = tcb_desc->queue_index;
+
+
+	spin_lock_irqsave(&priv->tx_lock,flags);
+
+	memcpy((unsigned char *)(skb->cb),&dev,sizeof(dev));
+	if(queue_index == TXCMD_QUEUE) {
+		skb_push(skb, USB_HWDESC_HEADER_LEN);
+		rtl819xU_tx_cmd(dev, skb);
+		ret = 1;
+		spin_unlock_irqrestore(&priv->tx_lock,flags);
+		return ret;
+	} else {
+		skb_push(skb, priv->ieee80211->tx_headroom);
+		ret = rtl8192_tx(dev, skb);
+	}
+
+	spin_unlock_irqrestore(&priv->tx_lock,flags);
+
+	return ret;
+}
+
+
+void rtl8192_try_wake_queue(struct net_device *dev, int pri);
+
+#ifdef USB_TX_DRIVER_AGGREGATION_ENABLE
+u16 DrvAggr_PaddingAdd(struct net_device *dev, struct sk_buff *skb)
+{
+	u16     PaddingNum =  256 - ((skb->len + TX_PACKET_DRVAGGR_SUBFRAME_SHIFT_BYTES) % 256);
+	return  (PaddingNum&0xff);
+}
+
+u8 MRateToHwRate8190Pci(u8 rate);
+u8 QueryIsShort(u8 TxHT, u8 TxRate, cb_desc *tcb_desc);
+u8 MapHwQueueToFirmwareQueue(u8 QueueID);
+struct sk_buff *DrvAggr_Aggregation(struct net_device *dev, struct ieee80211_drv_agg_txb *pSendList)
+{
+	struct ieee80211_device *ieee = netdev_priv(dev);
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	cb_desc 	*tcb_desc = NULL;
+	u8 		i;
+	u32		TotalLength;
+	struct sk_buff	*skb;
+	struct sk_buff  *agg_skb;
+	tx_desc_819x_usb_aggr_subframe *tx_agg_desc = NULL;
+	tx_fwinfo_819x_usb	       *tx_fwinfo = NULL;
+
+	//
+	// Local variable initialization.
+	//
+	/* first skb initialization */
+	skb = pSendList->tx_agg_frames[0];
+	TotalLength = skb->len;
+
+	/* Get the total aggregation length including the padding space and
+	 * sub frame header.
+	 */
+	for(i = 1; i < pSendList->nr_drv_agg_frames; i++) {
+		TotalLength += DrvAggr_PaddingAdd(dev, skb);
+		skb = pSendList->tx_agg_frames[i];
+		TotalLength += (skb->len + TX_PACKET_DRVAGGR_SUBFRAME_SHIFT_BYTES);
+	}
+
+	/* allocate skb to contain the aggregated packets */
+	agg_skb = dev_alloc_skb(TotalLength + ieee->tx_headroom);
+	memset(agg_skb->data, 0, agg_skb->len);
+	skb_reserve(agg_skb, ieee->tx_headroom);
+
+//	RT_DEBUG_DATA(COMP_SEND, skb->cb, sizeof(skb->cb));
+	/* reserve info for first subframe Tx descriptor to be set in the tx function */
+	skb = pSendList->tx_agg_frames[0];
+	tcb_desc = (cb_desc *)(skb->cb + MAX_DEV_ADDR_SIZE);
+	tcb_desc->drv_agg_enable = 1;
+	tcb_desc->pkt_size = skb->len;
+	tcb_desc->DrvAggrNum = pSendList->nr_drv_agg_frames;
+	printk("DrvAggNum = %d\n", tcb_desc->DrvAggrNum);
+//	RT_DEBUG_DATA(COMP_SEND, skb->cb, sizeof(skb->cb));
+//	printk("========>skb->data ======> \n");
+//	RT_DEBUG_DATA(COMP_SEND, skb->data, skb->len);
+	memcpy(agg_skb->cb, skb->cb, sizeof(skb->cb));
+	memcpy(skb_put(agg_skb,skb->len),skb->data,skb->len);
+
+	for(i = 1; i < pSendList->nr_drv_agg_frames; i++) {
+		/* push the next sub frame to be 256 byte aline */
+		skb_put(agg_skb,DrvAggr_PaddingAdd(dev,skb));
+
+		/* Subframe drv Tx descriptor and firmware info setting */
+		skb = pSendList->tx_agg_frames[i];
+		tcb_desc = (cb_desc *)(skb->cb + MAX_DEV_ADDR_SIZE);
+		tx_agg_desc = (tx_desc_819x_usb_aggr_subframe *)agg_skb->tail;
+		tx_fwinfo = (tx_fwinfo_819x_usb *)(agg_skb->tail + sizeof(tx_desc_819x_usb_aggr_subframe));
+
+		memset(tx_fwinfo,0,sizeof(tx_fwinfo_819x_usb));
+		/* DWORD 0 */
+		tx_fwinfo->TxHT = (tcb_desc->data_rate&0x80)?1:0;
+		tx_fwinfo->TxRate = MRateToHwRate8190Pci(tcb_desc->data_rate);
+		tx_fwinfo->EnableCPUDur = tcb_desc->bTxEnableFwCalcDur;
+		tx_fwinfo->Short = QueryIsShort(tx_fwinfo->TxHT, tx_fwinfo->TxRate, tcb_desc);
+		if(tcb_desc->bAMPDUEnable) {//AMPDU enabled
+			tx_fwinfo->AllowAggregation = 1;
+			/* DWORD 1 */
+			tx_fwinfo->RxMF = tcb_desc->ampdu_factor;
+			tx_fwinfo->RxAMD = tcb_desc->ampdu_density&0x07;//ampdudensity
+		} else {
+			tx_fwinfo->AllowAggregation = 0;
+			/* DWORD 1 */
+			tx_fwinfo->RxMF = 0;
+			tx_fwinfo->RxAMD = 0;
+		}
+
+		/* Protection mode related */
+		tx_fwinfo->RtsEnable = (tcb_desc->bRTSEnable)?1:0;
+		tx_fwinfo->CtsEnable = (tcb_desc->bCTSEnable)?1:0;
+		tx_fwinfo->RtsSTBC = (tcb_desc->bRTSSTBC)?1:0;
+		tx_fwinfo->RtsHT = (tcb_desc->rts_rate&0x80)?1:0;
+		tx_fwinfo->RtsRate =  MRateToHwRate8190Pci((u8)tcb_desc->rts_rate);
+		tx_fwinfo->RtsSubcarrier = (tx_fwinfo->RtsHT==0)?(tcb_desc->RTSSC):0;
+		tx_fwinfo->RtsBandwidth = (tx_fwinfo->RtsHT==1)?((tcb_desc->bRTSBW)?1:0):0;
+		tx_fwinfo->RtsShort = (tx_fwinfo->RtsHT==0)?(tcb_desc->bRTSUseShortPreamble?1:0):\
+				      (tcb_desc->bRTSUseShortGI?1:0);
+
+		/* Set Bandwidth and sub-channel settings. */
+		if(priv->CurrentChannelBW == HT_CHANNEL_WIDTH_20_40)
+		{
+			if(tcb_desc->bPacketBW) {
+				tx_fwinfo->TxBandwidth = 1;
+				tx_fwinfo->TxSubCarrier = 0;    //By SD3's Jerry suggestion, use duplicated mode
+			} else {
+				tx_fwinfo->TxBandwidth = 0;
+				tx_fwinfo->TxSubCarrier = priv->nCur40MhzPrimeSC;
+			}
+		} else {
+			tx_fwinfo->TxBandwidth = 0;
+			tx_fwinfo->TxSubCarrier = 0;
+		}
+
+		/* Fill Tx descriptor */
+		memset(tx_agg_desc, 0, sizeof(tx_desc_819x_usb_aggr_subframe));
+		/* DWORD 0 */
+		//tx_agg_desc->LINIP = 0;
+		//tx_agg_desc->CmdInit = 1;
+		tx_agg_desc->Offset =  sizeof(tx_fwinfo_819x_usb) + 8;
+		/* already raw data, need not to substract header length */
+		tx_agg_desc->PktSize = skb->len & 0xffff;
+
+		/*DWORD 1*/
+		tx_agg_desc->SecCAMID= 0;
+		tx_agg_desc->RATid = tcb_desc->RATRIndex;
+		{
+			//MPDUOverhead = 0;
+			tx_agg_desc->NoEnc = 1;
+		}
+		tx_agg_desc->SecType = 0x0;
+
+		if (tcb_desc->bHwSec) {
+			switch (priv->ieee80211->pairwise_key_type)
+			{
+				case KEY_TYPE_WEP40:
+				case KEY_TYPE_WEP104:
+					tx_agg_desc->SecType = 0x1;
+					tx_agg_desc->NoEnc = 0;
+					break;
+				case KEY_TYPE_TKIP:
+					tx_agg_desc->SecType = 0x2;
+					tx_agg_desc->NoEnc = 0;
+					break;
+				case KEY_TYPE_CCMP:
+					tx_agg_desc->SecType = 0x3;
+					tx_agg_desc->NoEnc = 0;
+					break;
+				case KEY_TYPE_NA:
+					tx_agg_desc->SecType = 0x0;
+					tx_agg_desc->NoEnc = 1;
+					break;
+			}
+		}
+
+		tx_agg_desc->QueueSelect = MapHwQueueToFirmwareQueue(tcb_desc->queue_index);
+		tx_agg_desc->TxFWInfoSize =  sizeof(tx_fwinfo_819x_usb);
+
+		tx_agg_desc->DISFB = tcb_desc->bTxDisableRateFallBack;
+		tx_agg_desc->USERATE = tcb_desc->bTxUseDriverAssingedRate;
+
+		tx_agg_desc->OWN = 1;
+
+		//DWORD 2
+		/* According windows driver, it seems that there no need to fill this field */
+		//tx_agg_desc->TxBufferSize= (u32)(skb->len - USB_HWDESC_HEADER_LEN);
+
+		/* to fill next packet */
+		skb_put(agg_skb,TX_PACKET_DRVAGGR_SUBFRAME_SHIFT_BYTES);
+		memcpy(skb_put(agg_skb,skb->len),skb->data,skb->len);
+	}
+
+	for(i = 0; i < pSendList->nr_drv_agg_frames; i++) {
+		dev_kfree_skb_any(pSendList->tx_agg_frames[i]);
+	}
+
+	return agg_skb;
+}
+
+/* NOTE:
+	This function return a list of PTCB which is proper to be aggregate with the input TCB.
+	If no proper TCB is found to do aggregation, SendList will only contain the input TCB.
+*/
+u8 DrvAggr_GetAggregatibleList(struct net_device *dev, struct sk_buff *skb,
+		struct ieee80211_drv_agg_txb *pSendList)
+{
+	struct ieee80211_device *ieee = netdev_priv(dev);
+	PRT_HIGH_THROUGHPUT	pHTInfo = ieee->pHTInfo;
+	u16		nMaxAggrNum = pHTInfo->UsbTxAggrNum;
+	cb_desc 	*tcb_desc = (cb_desc *)(skb->cb + MAX_DEV_ADDR_SIZE);
+	u8		QueueID = tcb_desc->queue_index;
+
+	do {
+		pSendList->tx_agg_frames[pSendList->nr_drv_agg_frames++] = skb;
+		if(pSendList->nr_drv_agg_frames >= nMaxAggrNum) {
+			break;
+		}
+
+	} while((skb = skb_dequeue(&ieee->skb_drv_aggQ[QueueID])));
+
+	RT_TRACE(COMP_AMSDU, "DrvAggr_GetAggregatibleList, nAggrTcbNum = %d \n", pSendList->nr_drv_agg_frames);
+	return pSendList->nr_drv_agg_frames;
+}
+#endif
+
+static void rtl8192_tx_isr(struct urb *tx_urb)
+{
+	struct sk_buff *skb = (struct sk_buff*)tx_urb->context;
+	struct net_device *dev = NULL;
+	struct r8192_priv *priv = NULL;
+	cb_desc *tcb_desc = (cb_desc *)(skb->cb + MAX_DEV_ADDR_SIZE);
+	u8  queue_index = tcb_desc->queue_index;
+//	bool bToSend0Byte;
+//	u16 BufLen = skb->len;
+
+	memcpy(&dev,(struct net_device*)(skb->cb),sizeof(struct net_device*));
+	priv = ieee80211_priv(dev);
+
+	if(tcb_desc->queue_index != TXCMD_QUEUE) {
+		if(tx_urb->status == 0) {
+			dev->trans_start = jiffies;
+			// As act as station mode, destion shall be  unicast address.
+			//priv->ieee80211->stats.tx_bytes+=(skb->len - priv->ieee80211->tx_headroom);
+			//priv->ieee80211->stats.tx_packets++;
+			priv->stats.txoktotal++;
+			priv->ieee80211->LinkDetectInfo.NumTxOkInPeriod++;
+			priv->stats.txbytesunicast += (skb->len - priv->ieee80211->tx_headroom);
+		} else {
+			priv->ieee80211->stats.tx_errors++;
+			//priv->stats.txmanageerr++;
+			/* TODO */
+		}
+	}
+
+	/* free skb and tx_urb */
+	if(skb != NULL) {
+		dev_kfree_skb_any(skb);
+		usb_free_urb(tx_urb);
+		atomic_dec(&priv->tx_pending[queue_index]);
+	}
+
+	{
+		//
+		// Handle HW Beacon:
+		// We had transfer our beacon frame to host controler at this moment.
+		//
+		//
+		// Caution:
+		// Handling the wait queue of command packets.
+		// For Tx command packets, we must not do TCB fragment because it is not handled right now.
+		// We must cut the packets to match the size of TX_CMD_PKT before we send it.
+		//
+
+		/* Handle MPDU in wait queue. */
+		if(queue_index != BEACON_QUEUE) {
+			/* Don't send data frame during scanning.*/
+			if((skb_queue_len(&priv->ieee80211->skb_waitQ[queue_index]) != 0)&&\
+					(!(priv->ieee80211->queue_stop))) {
+				if(NULL != (skb = skb_dequeue(&(priv->ieee80211->skb_waitQ[queue_index]))))
+					priv->ieee80211->softmac_hard_start_xmit(skb, dev);
+
+				return; //modified by david to avoid further processing AMSDU
+			}
+#ifdef USB_TX_DRIVER_AGGREGATION_ENABLE
+			else if ((skb_queue_len(&priv->ieee80211->skb_drv_aggQ[queue_index])!= 0)&&\
+				(!(priv->ieee80211->queue_stop))) {
+				// Tx Driver Aggregation process
+				/* The driver will aggregation the packets according to the following stets
+				 * 1. check whether there's tx irq available, for it's a completion return
+				 *    function, it should contain enough tx irq;
+				 * 2. check pakcet type;
+				 * 3. intialize sendlist, check whether the to-be send packet no greater than 1
+				 * 4. aggregation the packets, and fill firmware info and tx desc to it, etc.
+				 * 5. check whehter the packet could be sent, otherwise just insert to wait head
+				 * */
+				skb = skb_dequeue(&priv->ieee80211->skb_drv_aggQ[queue_index]);
+				if(!check_nic_enough_desc(dev, queue_index)) {
+					skb_queue_head(&(priv->ieee80211->skb_drv_aggQ[queue_index]), skb);
+					return;
+				}
+
+				{
+					/*TODO*/
+					/*
+					u8* pHeader = skb->data;
+
+					if(IsMgntQosData(pHeader) ||
+					    IsMgntQData_Ack(pHeader) ||
+					    IsMgntQData_Poll(pHeader) ||
+					    IsMgntQData_Poll_Ack(pHeader)
+					  )
+					*/
+					{
+						struct ieee80211_drv_agg_txb SendList;
+
+						memset(&SendList, 0, sizeof(struct ieee80211_drv_agg_txb));
+						if(DrvAggr_GetAggregatibleList(dev, skb, &SendList) > 1) {
+							skb = DrvAggr_Aggregation(dev, &SendList);
+
+						}
+					}
+					priv->ieee80211->softmac_hard_start_xmit(skb, dev);
+				}
+			}
+#endif
+		}
+	}
+
+}
+
+void rtl8192_beacon_stop(struct net_device *dev)
+{
+	u8 msr, msrm, msr2;
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+	msr  = read_nic_byte(dev, MSR);
+	msrm = msr & MSR_LINK_MASK;
+	msr2 = msr & ~MSR_LINK_MASK;
+
+	if(NIC_8192U == priv->card_8192) {
+		usb_kill_urb(priv->rx_urb[MAX_RX_URB]);
+	}
+	if ((msrm == (MSR_LINK_ADHOC<<MSR_LINK_SHIFT) ||
+		(msrm == (MSR_LINK_MASTER<<MSR_LINK_SHIFT)))){
+		write_nic_byte(dev, MSR, msr2 | MSR_LINK_NONE);
+		write_nic_byte(dev, MSR, msr);
+	}
+}
+
+void rtl8192_config_rate(struct net_device* dev, u16* rate_config)
+{
+	 struct r8192_priv *priv = ieee80211_priv(dev);
+	 struct ieee80211_network *net;
+	 u8 i=0, basic_rate = 0;
+	 net = & priv->ieee80211->current_network;
+
+	 for (i=0; i<net->rates_len; i++)
+	 {
+		 basic_rate = net->rates[i]&0x7f;
+		 switch(basic_rate)
+		 {
+			 case MGN_1M:	*rate_config |= RRSR_1M;	break;
+			 case MGN_2M:	*rate_config |= RRSR_2M;	break;
+			 case MGN_5_5M:	*rate_config |= RRSR_5_5M;	break;
+			 case MGN_11M:	*rate_config |= RRSR_11M;	break;
+			 case MGN_6M:	*rate_config |= RRSR_6M;	break;
+			 case MGN_9M:	*rate_config |= RRSR_9M;	break;
+			 case MGN_12M:	*rate_config |= RRSR_12M;	break;
+			 case MGN_18M:	*rate_config |= RRSR_18M;	break;
+			 case MGN_24M:	*rate_config |= RRSR_24M;	break;
+			 case MGN_36M:	*rate_config |= RRSR_36M;	break;
+			 case MGN_48M:	*rate_config |= RRSR_48M;	break;
+			 case MGN_54M:	*rate_config |= RRSR_54M;	break;
+		 }
+	 }
+	 for (i=0; i<net->rates_ex_len; i++)
+	 {
+		 basic_rate = net->rates_ex[i]&0x7f;
+		 switch(basic_rate)
+		 {
+			 case MGN_1M:	*rate_config |= RRSR_1M;	break;
+			 case MGN_2M:	*rate_config |= RRSR_2M;	break;
+			 case MGN_5_5M:	*rate_config |= RRSR_5_5M;	break;
+			 case MGN_11M:	*rate_config |= RRSR_11M;	break;
+			 case MGN_6M:	*rate_config |= RRSR_6M;	break;
+			 case MGN_9M:	*rate_config |= RRSR_9M;	break;
+			 case MGN_12M:	*rate_config |= RRSR_12M;	break;
+			 case MGN_18M:	*rate_config |= RRSR_18M;	break;
+			 case MGN_24M:	*rate_config |= RRSR_24M;	break;
+			 case MGN_36M:	*rate_config |= RRSR_36M;	break;
+			 case MGN_48M:	*rate_config |= RRSR_48M;	break;
+			 case MGN_54M:	*rate_config |= RRSR_54M;	break;
+		 }
+	 }
+}
+
+
+#define SHORT_SLOT_TIME 9
+#define NON_SHORT_SLOT_TIME 20
+
+void rtl8192_update_cap(struct net_device* dev, u16 cap)
+{
+	u32 tmp = 0;
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	struct ieee80211_network *net = &priv->ieee80211->current_network;
+	priv->short_preamble = cap & WLAN_CAPABILITY_SHORT_PREAMBLE;
+	tmp = priv->basic_rate;
+	if (priv->short_preamble)
+		tmp |= BRSR_AckShortPmb;
+	write_nic_dword(dev, RRSR, tmp);
+
+	if (net->mode & (IEEE_G|IEEE_N_24G))
+	{
+		u8 slot_time = 0;
+		if ((cap & WLAN_CAPABILITY_SHORT_SLOT)&&(!priv->ieee80211->pHTInfo->bCurrentRT2RTLongSlotTime))
+		{//short slot time
+			slot_time = SHORT_SLOT_TIME;
+		}
+		else //long slot time
+			slot_time = NON_SHORT_SLOT_TIME;
+		priv->slot_time = slot_time;
+		write_nic_byte(dev, SLOT_TIME, slot_time);
+	}
+
+}
+void rtl8192_net_update(struct net_device *dev)
+{
+
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	struct ieee80211_network *net;
+	u16 BcnTimeCfg = 0, BcnCW = 6, BcnIFS = 0xf;
+	u16 rate_config = 0;
+	net = & priv->ieee80211->current_network;
+
+	rtl8192_config_rate(dev, &rate_config);
+	priv->basic_rate = rate_config &= 0x15f;
+
+	write_nic_dword(dev,BSSIDR,((u32*)net->bssid)[0]);
+	write_nic_word(dev,BSSIDR+4,((u16*)net->bssid)[2]);
+	//for(i=0;i<ETH_ALEN;i++)
+	//	write_nic_byte(dev,BSSID+i,net->bssid[i]);
+
+	rtl8192_update_msr(dev);
+//	rtl8192_update_cap(dev, net->capability);
+	if (priv->ieee80211->iw_mode == IW_MODE_ADHOC)
+	{
+	write_nic_word(dev, ATIMWND, 2);
+	write_nic_word(dev, BCN_DMATIME, 1023);
+	write_nic_word(dev, BCN_INTERVAL, net->beacon_interval);
+//	write_nic_word(dev, BcnIntTime, 100);
+	write_nic_word(dev, BCN_DRV_EARLY_INT, 1);
+	write_nic_byte(dev, BCN_ERR_THRESH, 100);
+		BcnTimeCfg |= (BcnCW<<BCN_TCFG_CW_SHIFT);
+	// TODO: BcnIFS may required to be changed on ASIC
+		BcnTimeCfg |= BcnIFS<<BCN_TCFG_IFS;
+
+	write_nic_word(dev, BCN_TCFG, BcnTimeCfg);
+	}
+
+
+
+}
+
+//temporary hw beacon is not used any more.
+//open it when necessary
+void rtl819xusb_beacon_tx(struct net_device *dev,u16  tx_rate)
+{
+
+}
+inline u8 rtl8192_IsWirelessBMode(u16 rate)
+{
+	if( ((rate <= 110) && (rate != 60) && (rate != 90)) || (rate == 220) )
+		return 1;
+	else return 0;
+}
+
+u16 N_DBPSOfRate(u16 DataRate);
+
+u16 ComputeTxTime(
+	u16		FrameLength,
+	u16		DataRate,
+	u8		bManagementFrame,
+	u8		bShortPreamble
+)
+{
+	u16	FrameTime;
+	u16	N_DBPS;
+	u16	Ceiling;
+
+	if( rtl8192_IsWirelessBMode(DataRate) )
+	{
+		if( bManagementFrame || !bShortPreamble || DataRate == 10 )
+		{	// long preamble
+			FrameTime = (u16)(144+48+(FrameLength*8/(DataRate/10)));
+		}
+		else
+		{	// Short preamble
+			FrameTime = (u16)(72+24+(FrameLength*8/(DataRate/10)));
+		}
+		if( ( FrameLength*8 % (DataRate/10) ) != 0 ) //Get the Ceilling
+				FrameTime ++;
+	} else {	//802.11g DSSS-OFDM PLCP length field calculation.
+		N_DBPS = N_DBPSOfRate(DataRate);
+		Ceiling = (16 + 8*FrameLength + 6) / N_DBPS
+				+ (((16 + 8*FrameLength + 6) % N_DBPS) ? 1 : 0);
+		FrameTime = (u16)(16 + 4 + 4*Ceiling + 6);
+	}
+	return FrameTime;
+}
+
+u16 N_DBPSOfRate(u16 DataRate)
+{
+	 u16 N_DBPS = 24;
+
+	 switch(DataRate)
+	 {
+	 case 60:
+	  N_DBPS = 24;
+	  break;
+
+	 case 90:
+	  N_DBPS = 36;
+	  break;
+
+	 case 120:
+	  N_DBPS = 48;
+	  break;
+
+	 case 180:
+	  N_DBPS = 72;
+	  break;
+
+	 case 240:
+	  N_DBPS = 96;
+	  break;
+
+	 case 360:
+	  N_DBPS = 144;
+	  break;
+
+	 case 480:
+	  N_DBPS = 192;
+	  break;
+
+	 case 540:
+	  N_DBPS = 216;
+	  break;
+
+	 default:
+	  break;
+	 }
+
+	 return N_DBPS;
+}
+
+void rtl819xU_cmd_isr(struct urb *tx_cmd_urb, struct pt_regs *regs)
+{
+	usb_free_urb(tx_cmd_urb);
+}
+
+unsigned int txqueue2outpipe(struct r8192_priv* priv,unsigned int tx_queue) {
+
+	if(tx_queue >= 9)
+	{
+		RT_TRACE(COMP_ERR,"%s():Unknown queue ID!!!\n",__FUNCTION__);
+		return 0x04;
+	}
+	return priv->txqueue_to_outpipemap[tx_queue];
+}
+
+short rtl819xU_tx_cmd(struct net_device *dev, struct sk_buff *skb)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	//u8			*tx;
+	int			status;
+	struct urb		*tx_urb;
+	//int			urb_buf_len;
+	unsigned int 		idx_pipe;
+	tx_desc_cmd_819x_usb *pdesc = (tx_desc_cmd_819x_usb *)skb->data;
+	cb_desc *tcb_desc = (cb_desc *)(skb->cb + MAX_DEV_ADDR_SIZE);
+	u8 queue_index = tcb_desc->queue_index;
+
+	//printk("\n %s::queue_index = %d\n",__FUNCTION__, queue_index);
+	atomic_inc(&priv->tx_pending[queue_index]);
+	tx_urb = usb_alloc_urb(0,GFP_ATOMIC);
+	if(!tx_urb){
+		dev_kfree_skb(skb);
+		return -ENOMEM;
+	}
+
+	memset(pdesc, 0, USB_HWDESC_HEADER_LEN);
+	/* Tx descriptor ought to be set according to the skb->cb */
+	pdesc->FirstSeg = 1;//bFirstSeg;
+	pdesc->LastSeg = 1;//bLastSeg;
+	pdesc->CmdInit = tcb_desc->bCmdOrInit;
+	pdesc->TxBufferSize = tcb_desc->txbuf_size;
+	pdesc->OWN = 1;
+	pdesc->LINIP = tcb_desc->bLastIniPkt;
+
+	//----------------------------------------------------------------------------
+	// Fill up USB_OUT_CONTEXT.
+	//----------------------------------------------------------------------------
+	// Get index to out pipe from specified QueueID.
+#ifndef USE_ONE_PIPE
+	idx_pipe = txqueue2outpipe(priv,queue_index);
+#else
+	idx_pipe = 0x04;
+#endif
+#ifdef JOHN_DUMP_TXDESC
+	int i;
+	printk("<Tx descriptor>--rate %x---",rate);
+	for (i = 0; i < 8; i++)
+		printk("%8x ", tx[i]);
+	printk("\n");
+#endif
+	usb_fill_bulk_urb(tx_urb,priv->udev, usb_sndbulkpipe(priv->udev,idx_pipe), \
+			skb->data, skb->len, rtl8192_tx_isr, skb);
+
+	status = usb_submit_urb(tx_urb, GFP_ATOMIC);
+
+	if (!status){
+		return 0;
+	}else{
+		DMESGE("Error TX CMD URB, error %d",
+				status);
+		return -1;
+	}
+}
+
+/*
+ * Mapping Software/Hardware descriptor queue id to "Queue Select Field"
+ * in TxFwInfo data structure
+ * 2006.10.30 by Emily
+ *
+ * \param QUEUEID       Software Queue
+*/
+u8 MapHwQueueToFirmwareQueue(u8 QueueID)
+{
+	u8 QueueSelect = 0x0;       //defualt set to
+
+	switch(QueueID) {
+		case BE_QUEUE:
+			QueueSelect = QSLT_BE;  //or QSelect = pTcb->priority;
+			break;
+
+		case BK_QUEUE:
+			QueueSelect = QSLT_BK;  //or QSelect = pTcb->priority;
+			break;
+
+		case VO_QUEUE:
+			QueueSelect = QSLT_VO;  //or QSelect = pTcb->priority;
+			break;
+
+		case VI_QUEUE:
+			QueueSelect = QSLT_VI;  //or QSelect = pTcb->priority;
+			break;
+		case MGNT_QUEUE:
+			QueueSelect = QSLT_MGNT;
+			break;
+
+		case BEACON_QUEUE:
+			QueueSelect = QSLT_BEACON;
+			break;
+
+			// TODO: 2006.10.30 mark other queue selection until we verify it is OK
+			// TODO: Remove Assertions
+//#if (RTL819X_FPGA_VER & RTL819X_FPGA_GUANGAN_070502)
+		case TXCMD_QUEUE:
+			QueueSelect = QSLT_CMD;
+			break;
+//#endif
+		case HIGH_QUEUE:
+			QueueSelect = QSLT_HIGH;
+			break;
+
+		default:
+			RT_TRACE(COMP_ERR, "TransmitTCB(): Impossible Queue Selection: %d \n", QueueID);
+			break;
+	}
+	return QueueSelect;
+}
+
+u8 MRateToHwRate8190Pci(u8 rate)
+{
+	u8  ret = DESC90_RATE1M;
+
+	switch(rate) {
+		case MGN_1M:    ret = DESC90_RATE1M;    break;
+		case MGN_2M:    ret = DESC90_RATE2M;    break;
+		case MGN_5_5M:  ret = DESC90_RATE5_5M;  break;
+		case MGN_11M:   ret = DESC90_RATE11M;   break;
+		case MGN_6M:    ret = DESC90_RATE6M;    break;
+		case MGN_9M:    ret = DESC90_RATE9M;    break;
+		case MGN_12M:   ret = DESC90_RATE12M;   break;
+		case MGN_18M:   ret = DESC90_RATE18M;   break;
+		case MGN_24M:   ret = DESC90_RATE24M;   break;
+		case MGN_36M:   ret = DESC90_RATE36M;   break;
+		case MGN_48M:   ret = DESC90_RATE48M;   break;
+		case MGN_54M:   ret = DESC90_RATE54M;   break;
+
+		// HT rate since here
+		case MGN_MCS0:  ret = DESC90_RATEMCS0;  break;
+		case MGN_MCS1:  ret = DESC90_RATEMCS1;  break;
+		case MGN_MCS2:  ret = DESC90_RATEMCS2;  break;
+		case MGN_MCS3:  ret = DESC90_RATEMCS3;  break;
+		case MGN_MCS4:  ret = DESC90_RATEMCS4;  break;
+		case MGN_MCS5:  ret = DESC90_RATEMCS5;  break;
+		case MGN_MCS6:  ret = DESC90_RATEMCS6;  break;
+		case MGN_MCS7:  ret = DESC90_RATEMCS7;  break;
+		case MGN_MCS8:  ret = DESC90_RATEMCS8;  break;
+		case MGN_MCS9:  ret = DESC90_RATEMCS9;  break;
+		case MGN_MCS10: ret = DESC90_RATEMCS10; break;
+		case MGN_MCS11: ret = DESC90_RATEMCS11; break;
+		case MGN_MCS12: ret = DESC90_RATEMCS12; break;
+		case MGN_MCS13: ret = DESC90_RATEMCS13; break;
+		case MGN_MCS14: ret = DESC90_RATEMCS14; break;
+		case MGN_MCS15: ret = DESC90_RATEMCS15; break;
+		case (0x80|0x20): ret = DESC90_RATEMCS32; break;
+
+		default:       break;
+	}
+	return ret;
+}
+
+
+u8 QueryIsShort(u8 TxHT, u8 TxRate, cb_desc *tcb_desc)
+{
+	u8   tmp_Short;
+
+	tmp_Short = (TxHT==1)?((tcb_desc->bUseShortGI)?1:0):((tcb_desc->bUseShortPreamble)?1:0);
+
+	if(TxHT==1 && TxRate != DESC90_RATEMCS15)
+		tmp_Short = 0;
+
+	return tmp_Short;
+}
+
+static void tx_zero_isr(struct urb *tx_urb)
+{
+	return;
+}
+
+/*
+ * The tx procedure is just as following,
+ * skb->cb will contain all the following information,
+ * priority, morefrag, rate, &dev.
+ * */
+short rtl8192_tx(struct net_device *dev, struct sk_buff* skb)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	cb_desc *tcb_desc = (cb_desc *)(skb->cb + MAX_DEV_ADDR_SIZE);
+	tx_desc_819x_usb *tx_desc = (tx_desc_819x_usb *)skb->data;
+	tx_fwinfo_819x_usb *tx_fwinfo = (tx_fwinfo_819x_usb *)(skb->data + USB_HWDESC_HEADER_LEN);
+	struct usb_device *udev = priv->udev;
+	int pend;
+	int status;
+	struct urb *tx_urb = NULL, *tx_urb_zero = NULL;
+	//int urb_len;
+	unsigned int idx_pipe;
+//	RT_DEBUG_DATA(COMP_SEND, tcb_desc, sizeof(cb_desc));
+//	printk("=============> %s\n", __FUNCTION__);
+	pend = atomic_read(&priv->tx_pending[tcb_desc->queue_index]);
+	/* we are locked here so the two atomic_read and inc are executed
+	 * without interleaves
+	 * !!! For debug purpose
+	 */
+	if( pend > MAX_TX_URB){
+		printk("To discard skb packet!\n");
+		dev_kfree_skb_any(skb);
+		return -1;
+	}
+
+	tx_urb = usb_alloc_urb(0,GFP_ATOMIC);
+	if(!tx_urb){
+		dev_kfree_skb_any(skb);
+		return -ENOMEM;
+	}
+
+	/* Fill Tx firmware info */
+	memset(tx_fwinfo,0,sizeof(tx_fwinfo_819x_usb));
+	/* DWORD 0 */
+	tx_fwinfo->TxHT = (tcb_desc->data_rate&0x80)?1:0;
+	tx_fwinfo->TxRate = MRateToHwRate8190Pci(tcb_desc->data_rate);
+	tx_fwinfo->EnableCPUDur = tcb_desc->bTxEnableFwCalcDur;
+	tx_fwinfo->Short = QueryIsShort(tx_fwinfo->TxHT, tx_fwinfo->TxRate, tcb_desc);
+	if(tcb_desc->bAMPDUEnable) {//AMPDU enabled
+		tx_fwinfo->AllowAggregation = 1;
+		/* DWORD 1 */
+		tx_fwinfo->RxMF = tcb_desc->ampdu_factor;
+		tx_fwinfo->RxAMD = tcb_desc->ampdu_density&0x07;//ampdudensity
+	} else {
+		tx_fwinfo->AllowAggregation = 0;
+		/* DWORD 1 */
+		tx_fwinfo->RxMF = 0;
+		tx_fwinfo->RxAMD = 0;
+	}
+
+	/* Protection mode related */
+	tx_fwinfo->RtsEnable = (tcb_desc->bRTSEnable)?1:0;
+	tx_fwinfo->CtsEnable = (tcb_desc->bCTSEnable)?1:0;
+	tx_fwinfo->RtsSTBC = (tcb_desc->bRTSSTBC)?1:0;
+	tx_fwinfo->RtsHT = (tcb_desc->rts_rate&0x80)?1:0;
+	tx_fwinfo->RtsRate =  MRateToHwRate8190Pci((u8)tcb_desc->rts_rate);
+	tx_fwinfo->RtsSubcarrier = (tx_fwinfo->RtsHT==0)?(tcb_desc->RTSSC):0;
+	tx_fwinfo->RtsBandwidth = (tx_fwinfo->RtsHT==1)?((tcb_desc->bRTSBW)?1:0):0;
+	tx_fwinfo->RtsShort = (tx_fwinfo->RtsHT==0)?(tcb_desc->bRTSUseShortPreamble?1:0):\
+				(tcb_desc->bRTSUseShortGI?1:0);
+
+	/* Set Bandwidth and sub-channel settings. */
+	if(priv->CurrentChannelBW == HT_CHANNEL_WIDTH_20_40)
+	{
+		if(tcb_desc->bPacketBW) {
+			tx_fwinfo->TxBandwidth = 1;
+			tx_fwinfo->TxSubCarrier = 0;    //By SD3's Jerry suggestion, use duplicated mode
+		} else {
+			tx_fwinfo->TxBandwidth = 0;
+			tx_fwinfo->TxSubCarrier = priv->nCur40MhzPrimeSC;
+		}
+	} else {
+		tx_fwinfo->TxBandwidth = 0;
+		tx_fwinfo->TxSubCarrier = 0;
+	}
+
+#ifdef USB_TX_DRIVER_AGGREGATION_ENABLE
+	if (tcb_desc->drv_agg_enable)
+	{
+		tx_fwinfo->Tx_INFO_RSVD = (tcb_desc->DrvAggrNum & 0x1f) << 1;
+	}
+#endif
+	/* Fill Tx descriptor */
+	memset(tx_desc, 0, sizeof(tx_desc_819x_usb));
+	/* DWORD 0 */
+	tx_desc->LINIP = 0;
+	tx_desc->CmdInit = 1;
+	tx_desc->Offset =  sizeof(tx_fwinfo_819x_usb) + 8;
+
+#ifdef USB_TX_DRIVER_AGGREGATION_ENABLE
+	if (tcb_desc->drv_agg_enable) {
+		tx_desc->PktSize = tcb_desc->pkt_size;
+	} else
+#endif
+	{
+		tx_desc->PktSize = (skb->len - TX_PACKET_SHIFT_BYTES) & 0xffff;
+	}
+
+	/*DWORD 1*/
+	tx_desc->SecCAMID= 0;
+	tx_desc->RATid = tcb_desc->RATRIndex;
+	{
+		//MPDUOverhead = 0;
+		tx_desc->NoEnc = 1;
+	}
+	tx_desc->SecType = 0x0;
+		if (tcb_desc->bHwSec)
+			{
+				switch (priv->ieee80211->pairwise_key_type)
+				{
+					case KEY_TYPE_WEP40:
+					case KEY_TYPE_WEP104:
+						 tx_desc->SecType = 0x1;
+						 tx_desc->NoEnc = 0;
+						 break;
+					case KEY_TYPE_TKIP:
+						 tx_desc->SecType = 0x2;
+						 tx_desc->NoEnc = 0;
+						 break;
+					case KEY_TYPE_CCMP:
+						 tx_desc->SecType = 0x3;
+						 tx_desc->NoEnc = 0;
+						 break;
+					case KEY_TYPE_NA:
+						 tx_desc->SecType = 0x0;
+						 tx_desc->NoEnc = 1;
+						 break;
+				}
+			}
+
+	tx_desc->QueueSelect = MapHwQueueToFirmwareQueue(tcb_desc->queue_index);
+	tx_desc->TxFWInfoSize =  sizeof(tx_fwinfo_819x_usb);
+
+	tx_desc->DISFB = tcb_desc->bTxDisableRateFallBack;
+	tx_desc->USERATE = tcb_desc->bTxUseDriverAssingedRate;
+
+	/* Fill fields that are required to be initialized in all of the descriptors */
+	//DWORD 0
+	tx_desc->FirstSeg = 1;
+	tx_desc->LastSeg = 1;
+	tx_desc->OWN = 1;
+
+#ifdef USB_TX_DRIVER_AGGREGATION_ENABLE
+	if (tcb_desc->drv_agg_enable) {
+		tx_desc->TxBufferSize = tcb_desc->pkt_size + sizeof(tx_fwinfo_819x_usb);
+	} else
+#endif
+	{
+		//DWORD 2
+		tx_desc->TxBufferSize = (u32)(skb->len - USB_HWDESC_HEADER_LEN);
+	}
+	/* Get index to out pipe from specified QueueID */
+#ifndef USE_ONE_PIPE
+	idx_pipe = txqueue2outpipe(priv,tcb_desc->queue_index);
+#else
+	idx_pipe = 0x5;
+#endif
+
+	//RT_DEBUG_DATA(COMP_SEND,tx_fwinfo,sizeof(tx_fwinfo_819x_usb));
+	//RT_DEBUG_DATA(COMP_SEND,tx_desc,sizeof(tx_desc_819x_usb));
+
+	/* To submit bulk urb */
+	usb_fill_bulk_urb(tx_urb,udev,
+			usb_sndbulkpipe(udev,idx_pipe), skb->data,
+			skb->len, rtl8192_tx_isr, skb);
+
+	status = usb_submit_urb(tx_urb, GFP_ATOMIC);
+	if (!status){
+//we need to send 0 byte packet whenever 512N bytes/64N(HIGN SPEED/NORMAL SPEED) bytes packet has been transmitted. Otherwise, it will be halt to wait for another packet. WB. 2008.08.27
+		bool bSend0Byte = false;
+		u8 zero = 0;
+		if(udev->speed == USB_SPEED_HIGH)
+		{
+			if (skb->len > 0 && skb->len % 512 == 0)
+				bSend0Byte = true;
+		}
+		else
+		{
+			if (skb->len > 0 && skb->len % 64 == 0)
+				bSend0Byte = true;
+		}
+		if (bSend0Byte)
+		{
+			tx_urb_zero = usb_alloc_urb(0,GFP_ATOMIC);
+			if(!tx_urb_zero){
+				RT_TRACE(COMP_ERR, "can't alloc urb for zero byte\n");
+				return -ENOMEM;
+			}
+			usb_fill_bulk_urb(tx_urb_zero,udev,
+					usb_sndbulkpipe(udev,idx_pipe), &zero,
+					0, tx_zero_isr, dev);
+			status = usb_submit_urb(tx_urb_zero, GFP_ATOMIC);
+			if (status){
+			RT_TRACE(COMP_ERR, "Error TX URB for zero byte %d, error %d", atomic_read(&priv->tx_pending[tcb_desc->queue_index]), status);
+			return -1;
+			}
+		}
+		dev->trans_start = jiffies;
+		atomic_inc(&priv->tx_pending[tcb_desc->queue_index]);
+		return 0;
+	}else{
+		RT_TRACE(COMP_ERR, "Error TX URB %d, error %d", atomic_read(&priv->tx_pending[tcb_desc->queue_index]),
+				status);
+		return -1;
+	}
+}
+
+short rtl8192_usb_initendpoints(struct net_device *dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+	priv->rx_urb = (struct urb**) kmalloc (sizeof(struct urb*) * (MAX_RX_URB+1), GFP_KERNEL);
+
+#ifndef JACKSON_NEW_RX
+	for(i=0;i<(MAX_RX_URB+1);i++){
+
+		priv->rx_urb[i] = usb_alloc_urb(0,GFP_KERNEL);
+
+		priv->rx_urb[i]->transfer_buffer = kmalloc(RX_URB_SIZE, GFP_KERNEL);
+
+		priv->rx_urb[i]->transfer_buffer_length = RX_URB_SIZE;
+	}
+#endif
+
+#ifdef THOMAS_BEACON
+{
+	long align = 0;
+	void *oldaddr, *newaddr;
+
+	priv->rx_urb[16] = usb_alloc_urb(0, GFP_KERNEL);
+	priv->oldaddr = kmalloc(16, GFP_KERNEL);
+	oldaddr = priv->oldaddr;
+	align = ((long)oldaddr) & 3;
+	if (align) {
+		newaddr = oldaddr + 4 - align;
+		priv->rx_urb[16]->transfer_buffer_length = 16 - 4 + align;
+	} else {
+		newaddr = oldaddr;
+		priv->rx_urb[16]->transfer_buffer_length = 16;
+	}
+	priv->rx_urb[16]->transfer_buffer = newaddr;
+}
+#endif
+
+	memset(priv->rx_urb, 0, sizeof(struct urb*) * MAX_RX_URB);
+	priv->pp_rxskb = (struct sk_buff **)kmalloc(sizeof(struct sk_buff *) * MAX_RX_URB, GFP_KERNEL);
+	if (priv->pp_rxskb == NULL)
+		goto destroy;
+
+	memset(priv->pp_rxskb, 0, sizeof(struct sk_buff*) * MAX_RX_URB);
+
+	goto _middle;
+
+
+destroy:
+	if (priv->pp_rxskb) {
+		kfree(priv->pp_rxskb);
+	}
+	if (priv->rx_urb) {
+		kfree(priv->rx_urb);
+	}
+
+	priv->pp_rxskb = NULL;
+	priv->rx_urb = NULL;
+
+	DMESGE("Endpoint Alloc Failure");
+	return -ENOMEM;
+
+
+_middle:
+
+	printk("End of initendpoints\n");
+	return 0;
+
+}
+#ifdef THOMAS_BEACON
+void rtl8192_usb_deleteendpoints(struct net_device *dev)
+{
+	int i;
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+	if(priv->rx_urb){
+		for(i=0;i<(MAX_RX_URB+1);i++){
+			usb_kill_urb(priv->rx_urb[i]);
+			usb_free_urb(priv->rx_urb[i]);
+		}
+		kfree(priv->rx_urb);
+		priv->rx_urb = NULL;
+	}
+	if(priv->oldaddr){
+		kfree(priv->oldaddr);
+		priv->oldaddr = NULL;
+	}
+	if (priv->pp_rxskb) {
+		kfree(priv->pp_rxskb);
+		priv->pp_rxskb = 0;
+	}
+}
+#else
+void rtl8192_usb_deleteendpoints(struct net_device *dev)
+{
+	int i;
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+#ifndef JACKSON_NEW_RX
+
+	if(priv->rx_urb){
+		for(i=0;i<(MAX_RX_URB+1);i++){
+			usb_kill_urb(priv->rx_urb[i]);
+			kfree(priv->rx_urb[i]->transfer_buffer);
+			usb_free_urb(priv->rx_urb[i]);
+		}
+		kfree(priv->rx_urb);
+		priv->rx_urb = NULL;
+
+	}
+#else
+	if(priv->rx_urb){
+		kfree(priv->rx_urb);
+		priv->rx_urb = NULL;
+	}
+	if(priv->oldaddr){
+		kfree(priv->oldaddr);
+		priv->oldaddr = NULL;
+	}
+	if (priv->pp_rxskb) {
+		kfree(priv->pp_rxskb);
+		priv->pp_rxskb = 0;
+
+	}
+
+#endif
+}
+#endif
+
+extern void rtl8192_update_ratr_table(struct net_device* dev);
+void rtl8192_link_change(struct net_device *dev)
+{
+//	int i;
+
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	struct ieee80211_device* ieee = priv->ieee80211;
+	//write_nic_word(dev, BCN_INTR_ITV, net->beacon_interval);
+	if (ieee->state == IEEE80211_LINKED)
+	{
+		rtl8192_net_update(dev);
+		rtl8192_update_ratr_table(dev);
+		//add this as in pure N mode, wep encryption will use software way, but there is no chance to set this as wep will not set group key in wext. WB.2008.07.08
+		if ((KEY_TYPE_WEP40 == ieee->pairwise_key_type) || (KEY_TYPE_WEP104 == ieee->pairwise_key_type))
+		EnableHWSecurityConfig8192(dev);
+	}
+	/*update timing params*/
+//	RT_TRACE(COMP_CH, "========>%s(), chan:%d\n", __FUNCTION__, priv->chan);
+//	rtl8192_set_chan(dev, priv->chan);
+	 if (ieee->iw_mode == IW_MODE_INFRA || ieee->iw_mode == IW_MODE_ADHOC)
+        {
+                u32 reg = 0;
+                reg = read_nic_dword(dev, RCR);
+                if (priv->ieee80211->state == IEEE80211_LINKED)
+                        priv->ReceiveConfig = reg |= RCR_CBSSID;
+                else
+                        priv->ReceiveConfig = reg &= ~RCR_CBSSID;
+                write_nic_dword(dev, RCR, reg);
+        }
+
+//	rtl8192_set_rxconf(dev);
+}
+
+static struct ieee80211_qos_parameters def_qos_parameters = {
+        {3,3,3,3},/* cw_min */
+        {7,7,7,7},/* cw_max */
+        {2,2,2,2},/* aifs */
+        {0,0,0,0},/* flags */
+        {0,0,0,0} /* tx_op_limit */
+};
+
+
+void rtl8192_update_beacon(struct work_struct * work)
+{
+        struct r8192_priv *priv = container_of(work, struct r8192_priv, update_beacon_wq.work);
+        struct net_device *dev = priv->ieee80211->dev;
+ 	struct ieee80211_device* ieee = priv->ieee80211;
+	struct ieee80211_network* net = &ieee->current_network;
+
+	if (ieee->pHTInfo->bCurrentHTSupport)
+		HTUpdateSelfAndPeerSetting(ieee, net);
+	ieee->pHTInfo->bCurrentRT2RTLongSlotTime = net->bssht.bdRT2RTLongSlotTime;
+	rtl8192_update_cap(dev, net->capability);
+}
+/*
+* background support to run QoS activate functionality
+*/
+int WDCAPARA_ADD[] = {EDCAPARA_BE,EDCAPARA_BK,EDCAPARA_VI,EDCAPARA_VO};
+void rtl8192_qos_activate(struct work_struct * work)
+{
+	struct r8192_priv *priv = container_of(work, struct r8192_priv, qos_activate);
+	struct net_device *dev = priv->ieee80211->dev;
+	struct ieee80211_qos_parameters *qos_parameters = &priv->ieee80211->current_network.qos_data.parameters;
+	u8 mode = priv->ieee80211->current_network.mode;
+	//u32 size = sizeof(struct ieee80211_qos_parameters);
+	u8  u1bAIFS;
+	u32 u4bAcParam;
+	int i;
+
+	if (priv == NULL)
+		return;
+
+       mutex_lock(&priv->mutex);
+	if(priv->ieee80211->state != IEEE80211_LINKED)
+		goto success;
+	RT_TRACE(COMP_QOS,"qos active process with associate response received\n");
+	/* It better set slot time at first */
+	/* For we just support b/g mode at present, let the slot time at 9/20 selection */
+	/* update the ac parameter to related registers */
+	for(i = 0; i <  QOS_QUEUE_NUM; i++) {
+		//Mode G/A: slotTimeTimer = 9; Mode B: 20
+		u1bAIFS = qos_parameters->aifs[i] * ((mode&(IEEE_G|IEEE_N_24G)) ?9:20) + aSifsTime;
+		u4bAcParam = ((((u32)(qos_parameters->tx_op_limit[i]))<< AC_PARAM_TXOP_LIMIT_OFFSET)|
+				(((u32)(qos_parameters->cw_max[i]))<< AC_PARAM_ECW_MAX_OFFSET)|
+				(((u32)(qos_parameters->cw_min[i]))<< AC_PARAM_ECW_MIN_OFFSET)|
+				((u32)u1bAIFS << AC_PARAM_AIFS_OFFSET));
+
+		write_nic_dword(dev, WDCAPARA_ADD[i], u4bAcParam);
+		//write_nic_dword(dev, WDCAPARA_ADD[i], 0x005e4332);
+	}
+
+success:
+       mutex_unlock(&priv->mutex);
+}
+
+static int rtl8192_qos_handle_probe_response(struct r8192_priv *priv,
+		int active_network,
+		struct ieee80211_network *network)
+{
+	int ret = 0;
+	u32 size = sizeof(struct ieee80211_qos_parameters);
+
+	if(priv->ieee80211->state !=IEEE80211_LINKED)
+		return ret;
+
+	if ((priv->ieee80211->iw_mode != IW_MODE_INFRA))
+		return ret;
+
+	if (network->flags & NETWORK_HAS_QOS_MASK) {
+		if (active_network &&
+				(network->flags & NETWORK_HAS_QOS_PARAMETERS))
+			network->qos_data.active = network->qos_data.supported;
+
+		if ((network->qos_data.active == 1) && (active_network == 1) &&
+				(network->flags & NETWORK_HAS_QOS_PARAMETERS) &&
+				(network->qos_data.old_param_count !=
+				 network->qos_data.param_count)) {
+			network->qos_data.old_param_count =
+				network->qos_data.param_count;
+			queue_work(priv->priv_wq, &priv->qos_activate);
+			RT_TRACE (COMP_QOS, "QoS parameters change call "
+					"qos_activate\n");
+		}
+	} else {
+		memcpy(&priv->ieee80211->current_network.qos_data.parameters,\
+		       &def_qos_parameters, size);
+
+		if ((network->qos_data.active == 1) && (active_network == 1)) {
+			queue_work(priv->priv_wq, &priv->qos_activate);
+			RT_TRACE(COMP_QOS, "QoS was disabled call qos_activate \n");
+		}
+		network->qos_data.active = 0;
+		network->qos_data.supported = 0;
+	}
+
+	return 0;
+}
+
+/* handle manage frame frame beacon and probe response */
+static int rtl8192_handle_beacon(struct net_device * dev,
+			      struct ieee80211_beacon * beacon,
+			      struct ieee80211_network * network)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+	rtl8192_qos_handle_probe_response(priv,1,network);
+	queue_delayed_work(priv->priv_wq, &priv->update_beacon_wq, 0);
+	return 0;
+
+}
+
+/*
+* handling the beaconing responses. if we get different QoS setting
+* off the network from the associated setting, adjust the QoS
+* setting
+*/
+static int rtl8192_qos_association_resp(struct r8192_priv *priv,
+				    struct ieee80211_network *network)
+{
+	int ret = 0;
+	unsigned long flags;
+	u32 size = sizeof(struct ieee80211_qos_parameters);
+	int set_qos_param = 0;
+
+	if ((priv == NULL) || (network == NULL))
+		return ret;
+
+	if(priv->ieee80211->state !=IEEE80211_LINKED)
+		return ret;
+
+	if ((priv->ieee80211->iw_mode != IW_MODE_INFRA))
+		return ret;
+
+	spin_lock_irqsave(&priv->ieee80211->lock, flags);
+	if(network->flags & NETWORK_HAS_QOS_PARAMETERS) {
+		memcpy(&priv->ieee80211->current_network.qos_data.parameters,\
+			 &network->qos_data.parameters,\
+			sizeof(struct ieee80211_qos_parameters));
+		priv->ieee80211->current_network.qos_data.active = 1;
+		 {
+			set_qos_param = 1;
+			/* update qos parameter for current network */
+			priv->ieee80211->current_network.qos_data.old_param_count = \
+				 priv->ieee80211->current_network.qos_data.param_count;
+			priv->ieee80211->current_network.qos_data.param_count = \
+				 network->qos_data.param_count;
+		}
+	} else {
+		memcpy(&priv->ieee80211->current_network.qos_data.parameters,\
+		       &def_qos_parameters, size);
+		priv->ieee80211->current_network.qos_data.active = 0;
+		priv->ieee80211->current_network.qos_data.supported = 0;
+		set_qos_param = 1;
+	}
+
+	spin_unlock_irqrestore(&priv->ieee80211->lock, flags);
+
+	RT_TRACE(COMP_QOS, "%s: network->flags = %d,%d\n",__FUNCTION__,network->flags ,priv->ieee80211->current_network.qos_data.active);
+	if (set_qos_param == 1)
+		queue_work(priv->priv_wq, &priv->qos_activate);
+
+
+	return ret;
+}
+
+
+static int rtl8192_handle_assoc_response(struct net_device *dev,
+				     struct ieee80211_assoc_response_frame *resp,
+				     struct ieee80211_network *network)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	rtl8192_qos_association_resp(priv, network);
+	return 0;
+}
+
+
+void rtl8192_update_ratr_table(struct net_device* dev)
+	//	POCTET_STRING	posLegacyRate,
+	//	u8*			pMcsRate)
+	//	PRT_WLAN_STA	pEntry)
+{
+	struct r8192_priv* priv = ieee80211_priv(dev);
+	struct ieee80211_device* ieee = priv->ieee80211;
+	u8* pMcsRate = ieee->dot11HTOperationalRateSet;
+	//struct ieee80211_network *net = &ieee->current_network;
+	u32 ratr_value = 0;
+	u8 rate_index = 0;
+	rtl8192_config_rate(dev, (u16*)(&ratr_value));
+	ratr_value |= (*(u16*)(pMcsRate)) << 12;
+//	switch (net->mode)
+	switch (ieee->mode)
+	{
+		case IEEE_A:
+			ratr_value &= 0x00000FF0;
+			break;
+		case IEEE_B:
+			ratr_value &= 0x0000000F;
+			break;
+		case IEEE_G:
+			ratr_value &= 0x00000FF7;
+			break;
+		case IEEE_N_24G:
+		case IEEE_N_5G:
+			if (ieee->pHTInfo->PeerMimoPs == 0) //MIMO_PS_STATIC
+				ratr_value &= 0x0007F007;
+			else{
+				if (priv->rf_type == RF_1T2R)
+					ratr_value &= 0x000FF007;
+				else
+					ratr_value &= 0x0F81F007;
+			}
+			break;
+		default:
+			break;
+	}
+	ratr_value &= 0x0FFFFFFF;
+	if(ieee->pHTInfo->bCurTxBW40MHz && ieee->pHTInfo->bCurShortGI40MHz){
+		ratr_value |= 0x80000000;
+	}else if(!ieee->pHTInfo->bCurTxBW40MHz && ieee->pHTInfo->bCurShortGI20MHz){
+		ratr_value |= 0x80000000;
+	}
+	write_nic_dword(dev, RATR0+rate_index*4, ratr_value);
+	write_nic_byte(dev, UFWP, 1);
+}
+
+static u8 ccmp_ie[4] = {0x00,0x50,0xf2,0x04};
+static u8 ccmp_rsn_ie[4] = {0x00, 0x0f, 0xac, 0x04};
+bool GetNmodeSupportBySecCfg8192(struct net_device*dev)
+{
+	struct r8192_priv* priv = ieee80211_priv(dev);
+	struct ieee80211_device* ieee = priv->ieee80211;
+	struct ieee80211_network * network = &ieee->current_network;
+	int wpa_ie_len= ieee->wpa_ie_len;
+	struct ieee80211_crypt_data* crypt;
+	int encrypt;
+
+	crypt = ieee->crypt[ieee->tx_keyidx];
+	//we use connecting AP's capability instead of only security config on our driver to distinguish whether it should use N mode or G mode
+	encrypt = (network->capability & WLAN_CAPABILITY_PRIVACY) || (ieee->host_encrypt && crypt && crypt->ops && (0 == strcmp(crypt->ops->name,"WEP")));
+
+	/* simply judge  */
+	if(encrypt && (wpa_ie_len == 0)) {
+		/* wep encryption, no N mode setting */
+		return false;
+//	} else if((wpa_ie_len != 0)&&(memcmp(&(ieee->wpa_ie[14]),ccmp_ie,4))) {
+	} else if((wpa_ie_len != 0)) {
+		/* parse pairwise key type */
+		//if((pairwisekey = WEP40)||(pairwisekey = WEP104)||(pairwisekey = TKIP))
+		if (((ieee->wpa_ie[0] == 0xdd) && (!memcmp(&(ieee->wpa_ie[14]),ccmp_ie,4))) || ((ieee->wpa_ie[0] == 0x30) && (!memcmp(&ieee->wpa_ie[10],ccmp_rsn_ie, 4))))
+			return true;
+		else
+			return false;
+	} else {
+		return true;
+	}
+
+	return true;
+}
+
+bool GetHalfNmodeSupportByAPs819xUsb(struct net_device* dev)
+{
+	bool			Reval;
+	struct r8192_priv* priv = ieee80211_priv(dev);
+	struct ieee80211_device* ieee = priv->ieee80211;
+
+	if(ieee->bHalfWirelessN24GMode == true)
+		Reval = true;
+	else
+		Reval =  false;
+
+	return Reval;
+}
+
+void rtl8192_refresh_supportrate(struct r8192_priv* priv)
+{
+	struct ieee80211_device* ieee = priv->ieee80211;
+	//we donot consider set support rate for ABG mode, only HT MCS rate is set here.
+	if (ieee->mode == WIRELESS_MODE_N_24G || ieee->mode == WIRELESS_MODE_N_5G)
+	{
+		memcpy(ieee->Regdot11HTOperationalRateSet, ieee->RegHTSuppRateSet, 16);
+		//RT_DEBUG_DATA(COMP_INIT, ieee->RegHTSuppRateSet, 16);
+		//RT_DEBUG_DATA(COMP_INIT, ieee->Regdot11HTOperationalRateSet, 16);
+	}
+	else
+		memset(ieee->Regdot11HTOperationalRateSet, 0, 16);
+	return;
+}
+
+u8 rtl8192_getSupportedWireleeMode(struct net_device*dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	u8 ret = 0;
+	switch(priv->rf_chip)
+	{
+		case RF_8225:
+		case RF_8256:
+		case RF_PSEUDO_11N:
+			ret = (WIRELESS_MODE_N_24G|WIRELESS_MODE_G|WIRELESS_MODE_B);
+			break;
+		case RF_8258:
+			ret = (WIRELESS_MODE_A|WIRELESS_MODE_N_5G);
+			break;
+		default:
+			ret = WIRELESS_MODE_B;
+			break;
+	}
+	return ret;
+}
+void rtl8192_SetWirelessMode(struct net_device* dev, u8 wireless_mode)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	u8 bSupportMode = rtl8192_getSupportedWireleeMode(dev);
+
+	if ((wireless_mode == WIRELESS_MODE_AUTO) || ((wireless_mode&bSupportMode)==0))
+	{
+		if(bSupportMode & WIRELESS_MODE_N_24G)
+		{
+			wireless_mode = WIRELESS_MODE_N_24G;
+		}
+		else if(bSupportMode & WIRELESS_MODE_N_5G)
+		{
+			wireless_mode = WIRELESS_MODE_N_5G;
+		}
+		else if((bSupportMode & WIRELESS_MODE_A))
+		{
+			wireless_mode = WIRELESS_MODE_A;
+		}
+		else if((bSupportMode & WIRELESS_MODE_G))
+		{
+			wireless_mode = WIRELESS_MODE_G;
+		}
+		else if((bSupportMode & WIRELESS_MODE_B))
+		{
+			wireless_mode = WIRELESS_MODE_B;
+		}
+		else{
+			RT_TRACE(COMP_ERR, "%s(), No valid wireless mode supported, SupportedWirelessMode(%x)!!!\n", __FUNCTION__,bSupportMode);
+			wireless_mode = WIRELESS_MODE_B;
+		}
+	}
+#ifdef TO_DO_LIST //// TODO: this function doesn't work well at this time, we shoud wait for FPGA
+	ActUpdateChannelAccessSetting( pAdapter, pHalData->CurrentWirelessMode, &pAdapter->MgntInfo.Info8185.ChannelAccessSetting );
+#endif
+	priv->ieee80211->mode = wireless_mode;
+
+	if ((wireless_mode == WIRELESS_MODE_N_24G) ||  (wireless_mode == WIRELESS_MODE_N_5G))
+		priv->ieee80211->pHTInfo->bEnableHT = 1;
+	else
+		priv->ieee80211->pHTInfo->bEnableHT = 0;
+	RT_TRACE(COMP_INIT, "Current Wireless Mode is %x\n", wireless_mode);
+	rtl8192_refresh_supportrate(priv);
+
+}
+//init priv variables here. only non_zero value should be initialized here.
+static void rtl8192_init_priv_variable(struct net_device* dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	u8 i;
+	priv->card_8192 = NIC_8192U;
+	priv->chan = 1; //set to channel 1
+	priv->ieee80211->mode = WIRELESS_MODE_AUTO; //SET AUTO
+	priv->ieee80211->iw_mode = IW_MODE_INFRA;
+	priv->ieee80211->ieee_up=0;
+	priv->retry_rts = DEFAULT_RETRY_RTS;
+	priv->retry_data = DEFAULT_RETRY_DATA;
+	priv->ieee80211->rts = DEFAULT_RTS_THRESHOLD;
+	priv->ieee80211->rate = 110; //11 mbps
+	priv->ieee80211->short_slot = 1;
+	priv->promisc = (dev->flags & IFF_PROMISC) ? 1:0;
+	priv->CckPwEnl = 6;
+	//for silent reset
+	priv->IrpPendingCount = 1;
+	priv->ResetProgress = RESET_TYPE_NORESET;
+	priv->bForcedSilentReset = 0;
+	priv->bDisableNormalResetCheck = false;
+	priv->force_reset = false;
+
+	priv->ieee80211->FwRWRF = 0; 	//we don't use FW read/write RF until stable firmware is available.
+	priv->ieee80211->current_network.beacon_interval = DEFAULT_BEACONINTERVAL;
+	priv->ieee80211->iw_mode = IW_MODE_INFRA;
+	priv->ieee80211->softmac_features  = IEEE_SOFTMAC_SCAN |
+		IEEE_SOFTMAC_ASSOCIATE | IEEE_SOFTMAC_PROBERQ |
+		IEEE_SOFTMAC_PROBERS | IEEE_SOFTMAC_TX_QUEUE |
+		IEEE_SOFTMAC_BEACONS;//added by amy 080604 //|  //IEEE_SOFTMAC_SINGLE_QUEUE;
+
+	priv->ieee80211->active_scan = 1;
+	priv->ieee80211->modulation = IEEE80211_CCK_MODULATION | IEEE80211_OFDM_MODULATION;
+	priv->ieee80211->host_encrypt = 1;
+	priv->ieee80211->host_decrypt = 1;
+	priv->ieee80211->start_send_beacons = NULL;//rtl819xusb_beacon_tx;//-by amy 080604
+	priv->ieee80211->stop_send_beacons = NULL;//rtl8192_beacon_stop;//-by amy 080604
+	priv->ieee80211->softmac_hard_start_xmit = rtl8192_hard_start_xmit;
+	priv->ieee80211->set_chan = rtl8192_set_chan;
+	priv->ieee80211->link_change = rtl8192_link_change;
+	priv->ieee80211->softmac_data_hard_start_xmit = rtl8192_hard_data_xmit;
+	priv->ieee80211->data_hard_stop = rtl8192_data_hard_stop;
+	priv->ieee80211->data_hard_resume = rtl8192_data_hard_resume;
+	priv->ieee80211->init_wmmparam_flag = 0;
+	priv->ieee80211->fts = DEFAULT_FRAG_THRESHOLD;
+	priv->ieee80211->check_nic_enough_desc = check_nic_enough_desc;
+	priv->ieee80211->tx_headroom = TX_PACKET_SHIFT_BYTES;
+	priv->ieee80211->qos_support = 1;
+
+	//added by WB
+//	priv->ieee80211->SwChnlByTimerHandler = rtl8192_phy_SwChnl;
+	priv->ieee80211->SetBWModeHandler = rtl8192_SetBWMode;
+	priv->ieee80211->handle_assoc_response = rtl8192_handle_assoc_response;
+	priv->ieee80211->handle_beacon = rtl8192_handle_beacon;
+	//added by david
+	priv->ieee80211->GetNmodeSupportBySecCfg = GetNmodeSupportBySecCfg8192;
+	priv->ieee80211->GetHalfNmodeSupportByAPsHandler = GetHalfNmodeSupportByAPs819xUsb;
+	priv->ieee80211->SetWirelessMode = rtl8192_SetWirelessMode;
+	//added by amy
+	priv->ieee80211->InitialGainHandler = InitialGain819xUsb;
+	priv->card_type = USB;
+#ifdef TO_DO_LIST
+	if(Adapter->bInHctTest)
+	{
+		pHalData->ShortRetryLimit = 7;
+		pHalData->LongRetryLimit = 7;
+	}
+#endif
+	{
+		priv->ShortRetryLimit = 0x30;
+		priv->LongRetryLimit = 0x30;
+	}
+	priv->EarlyRxThreshold = 7;
+	priv->enable_gpio0 = 0;
+	priv->TransmitConfig =
+	//	TCR_DurProcMode |	//for RTL8185B, duration setting by HW
+	//?	TCR_DISReqQsize |
+		(TCR_MXDMA_2048<<TCR_MXDMA_OFFSET)|  // Max DMA Burst Size per Tx DMA Burst, 7: reservied.
+		(priv->ShortRetryLimit<<TCR_SRL_OFFSET)|	// Short retry limit
+		(priv->LongRetryLimit<<TCR_LRL_OFFSET) |	// Long retry limit
+		(false ? TCR_SAT: 0);	// FALSE: HW provies PLCP length and LENGEXT, TURE: SW proiveds them
+#ifdef TO_DO_LIST
+	if(Adapter->bInHctTest)
+		pHalData->ReceiveConfig	=	pHalData->CSMethod |
+						RCR_AMF | RCR_ADF |	//RCR_AAP | 	//accept management/data
+						//guangan200710
+						RCR_ACF |	//accept control frame for SW AP needs PS-poll, 2005.07.07, by rcnjko.
+						RCR_AB | RCR_AM | RCR_APM |		//accept BC/MC/UC
+						RCR_AICV | RCR_ACRC32 | 		//accept ICV/CRC error packet
+						((u32)7<<RCR_MXDMA_OFFSET) | // Max DMA Burst Size per Rx DMA Burst, 7: unlimited.
+						(pHalData->EarlyRxThreshold<<RCR_FIFO_OFFSET) | // Rx FIFO Threshold, 7: No Rx threshold.
+						(pHalData->EarlyRxThreshold == 7 ? RCR_OnlyErlPkt:0);
+	else
+
+#endif
+	priv->ReceiveConfig	=
+		RCR_AMF | RCR_ADF |		//accept management/data
+		RCR_ACF |			//accept control frame for SW AP needs PS-poll, 2005.07.07, by rcnjko.
+		RCR_AB | RCR_AM | RCR_APM |	//accept BC/MC/UC
+		//RCR_AICV | RCR_ACRC32 | 	//accept ICV/CRC error packet
+		((u32)7<<RCR_MXDMA_OFFSET)| // Max DMA Burst Size per Rx DMA Burst, 7: unlimited.
+		(priv->EarlyRxThreshold<<RX_FIFO_THRESHOLD_SHIFT) | // Rx FIFO Threshold, 7: No Rx threshold.
+		(priv->EarlyRxThreshold == 7 ? RCR_ONLYERLPKT:0);
+
+	priv->AcmControl = 0;
+	priv->pFirmware = (rt_firmware*)kmalloc(sizeof(rt_firmware), GFP_KERNEL);
+	if (priv->pFirmware)
+	memset(priv->pFirmware, 0, sizeof(rt_firmware));
+
+	/* rx related queue */
+	skb_queue_head_init(&priv->rx_queue);
+	skb_queue_head_init(&priv->skb_queue);
+
+	/* Tx related queue */
+	for(i = 0; i < MAX_QUEUE_SIZE; i++) {
+		skb_queue_head_init(&priv->ieee80211->skb_waitQ [i]);
+	}
+	for(i = 0; i < MAX_QUEUE_SIZE; i++) {
+		skb_queue_head_init(&priv->ieee80211->skb_aggQ [i]);
+	}
+	for(i = 0; i < MAX_QUEUE_SIZE; i++) {
+		skb_queue_head_init(&priv->ieee80211->skb_drv_aggQ [i]);
+	}
+	priv->rf_set_chan = rtl8192_phy_SwChnl;
+}
+
+//init lock here
+static void rtl8192_init_priv_lock(struct r8192_priv* priv)
+{
+	spin_lock_init(&priv->tx_lock);
+	spin_lock_init(&priv->irq_lock);//added by thomas
+	//spin_lock_init(&priv->rf_lock);
+	sema_init(&priv->wx_sem,1);
+	sema_init(&priv->rf_sem,1);
+	mutex_init(&priv->mutex);
+}
+
+extern  void    rtl819x_watchdog_wqcallback(struct work_struct *work);
+
+void rtl8192_irq_rx_tasklet(struct r8192_priv *priv);
+//init tasklet and wait_queue here. only 2.6 above kernel is considered
+#define DRV_NAME "wlan0"
+static void rtl8192_init_priv_task(struct net_device* dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+#ifdef PF_SYNCTHREAD
+	priv->priv_wq = create_workqueue(DRV_NAME,0);
+#else
+	priv->priv_wq = create_workqueue(DRV_NAME);
+#endif
+
+	INIT_WORK(&priv->reset_wq, rtl8192_restart);
+
+	//INIT_DELAYED_WORK(&priv->watch_dog_wq, hal_dm_watchdog);
+	INIT_DELAYED_WORK(&priv->watch_dog_wq, rtl819x_watchdog_wqcallback);
+	INIT_DELAYED_WORK(&priv->txpower_tracking_wq,  dm_txpower_trackingcallback);
+//	INIT_DELAYED_WORK(&priv->gpio_change_rf_wq,  dm_gpio_change_rf_callback);
+	INIT_DELAYED_WORK(&priv->rfpath_check_wq,  dm_rf_pathcheck_workitemcallback);
+	INIT_DELAYED_WORK(&priv->update_beacon_wq, rtl8192_update_beacon);
+	INIT_DELAYED_WORK(&priv->initialgain_operate_wq, InitialGainOperateWorkItemCallBack);
+	//INIT_WORK(&priv->SwChnlWorkItem,  rtl8192_SwChnl_WorkItem);
+	//INIT_WORK(&priv->SetBWModeWorkItem,  rtl8192_SetBWModeWorkItem);
+	INIT_WORK(&priv->qos_activate, rtl8192_qos_activate);
+
+	tasklet_init(&priv->irq_rx_tasklet,
+	     (void(*)(unsigned long))rtl8192_irq_rx_tasklet,
+	     (unsigned long)priv);
+}
+
+static void rtl8192_get_eeprom_size(struct net_device* dev)
+{
+	u16 curCR = 0;
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	RT_TRACE(COMP_EPROM, "===========>%s()\n", __FUNCTION__);
+	curCR = read_nic_word_E(dev,EPROM_CMD);
+	RT_TRACE(COMP_EPROM, "read from Reg EPROM_CMD(%x):%x\n", EPROM_CMD, curCR);
+	//whether need I consider BIT5?
+	priv->epromtype = (curCR & Cmd9346CR_9356SEL) ? EPROM_93c56 : EPROM_93c46;
+	RT_TRACE(COMP_EPROM, "<===========%s(), epromtype:%d\n", __FUNCTION__, priv->epromtype);
+}
+
+//used to swap endian. as ntohl & htonl are not neccessary to swap endian, so use this instead.
+static inline u16 endian_swap(u16* data)
+{
+	u16 tmp = *data;
+	*data = (tmp >> 8) | (tmp << 8);
+	return *data;
+}
+static void rtl8192_read_eeprom_info(struct net_device* dev)
+{
+	u16 wEPROM_ID = 0;
+	u8 bMac_Tmp_Addr[6] = {0x00, 0xe0, 0x4c, 0x00, 0x00, 0x02};
+	u8 bLoad_From_EEPOM = false;
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	u16 tmpValue = 0;
+	RT_TRACE(COMP_EPROM, "===========>%s()\n", __FUNCTION__);
+	wEPROM_ID = eprom_read(dev, 0); //first read EEPROM ID out;
+	RT_TRACE(COMP_EPROM, "EEPROM ID is 0x%x\n", wEPROM_ID);
+
+	if (wEPROM_ID != RTL8190_EEPROM_ID)
+	{
+		RT_TRACE(COMP_ERR, "EEPROM ID is invalid(is 0x%x(should be 0x%x)\n", wEPROM_ID, RTL8190_EEPROM_ID);
+	}
+	else
+		bLoad_From_EEPOM = true;
+
+	if (bLoad_From_EEPOM)
+	{
+		tmpValue = eprom_read(dev, (EEPROM_VID>>1));
+		priv->eeprom_vid = endian_swap(&tmpValue);
+		priv->eeprom_pid = eprom_read(dev, (EEPROM_PID>>1));
+		tmpValue = eprom_read(dev, (EEPROM_ChannelPlan>>1));
+		priv->eeprom_ChannelPlan =((tmpValue&0xff00)>>8);
+		priv->btxpowerdata_readfromEEPORM = true;
+		priv->eeprom_CustomerID = eprom_read(dev, (EEPROM_Customer_ID>>1)) >>8;
+	}
+	else
+	{
+		priv->eeprom_vid = 0;
+		priv->eeprom_pid = 0;
+		priv->card_8192_version = VERSION_819xU_B;
+		priv->eeprom_ChannelPlan = 0;
+		priv->eeprom_CustomerID = 0;
+	}
+	RT_TRACE(COMP_EPROM, "vid:0x%4x, pid:0x%4x, CustomID:0x%2x, ChanPlan:0x%x\n", priv->eeprom_vid, priv->eeprom_pid, priv->eeprom_CustomerID, priv->eeprom_ChannelPlan);
+	//set channelplan from eeprom
+	priv->ChannelPlan = priv->eeprom_ChannelPlan;
+	if (bLoad_From_EEPOM)
+	{
+		int i;
+		for (i=0; i<6; i+=2)
+		{
+			u16 tmp = 0;
+			tmp = eprom_read(dev, (u16)((EEPROM_NODE_ADDRESS_BYTE_0 + i)>>1));
+			*(u16*)(&dev->dev_addr[i]) = tmp;
+		}
+	}
+	else
+	{
+		memcpy(dev->dev_addr, bMac_Tmp_Addr, 6);
+		//should I set IDR0 here?
+	}
+	RT_TRACE(COMP_EPROM, "MAC addr:"MAC_FMT"\n", MAC_ARG(dev->dev_addr));
+	priv->rf_type = RTL819X_DEFAULT_RF_TYPE; //default 1T2R
+	priv->rf_chip = RF_8256;
+
+	if (priv->card_8192_version == (u8)VERSION_819xU_A)
+	{
+		//read Tx power gain offset of legacy OFDM to HT rate
+		if (bLoad_From_EEPOM)
+			priv->EEPROMTxPowerDiff = (eprom_read(dev, (EEPROM_TxPowerDiff>>1))&0xff00) >> 8;
+		else
+			priv->EEPROMTxPowerDiff = EEPROM_Default_TxPower;
+		RT_TRACE(COMP_EPROM, "TxPowerDiff:%d\n", priv->EEPROMTxPowerDiff);
+		//read ThermalMeter from EEPROM
+		if (bLoad_From_EEPOM)
+			priv->EEPROMThermalMeter = (u8)(eprom_read(dev, (EEPROM_ThermalMeter>>1))&0x00ff);
+		else
+			priv->EEPROMThermalMeter = EEPROM_Default_ThermalMeter;
+		RT_TRACE(COMP_EPROM, "ThermalMeter:%d\n", priv->EEPROMThermalMeter);
+		//vivi, for tx power track
+		priv->TSSI_13dBm = priv->EEPROMThermalMeter *100;
+		//read antenna tx power offset of B/C/D to A from EEPROM
+		if (bLoad_From_EEPOM)
+			priv->EEPROMPwDiff = (eprom_read(dev, (EEPROM_PwDiff>>1))&0x0f00)>>8;
+		else
+			priv->EEPROMPwDiff = EEPROM_Default_PwDiff;
+		RT_TRACE(COMP_EPROM, "TxPwDiff:%d\n", priv->EEPROMPwDiff);
+		// Read CrystalCap from EEPROM
+		if (bLoad_From_EEPOM)
+			priv->EEPROMCrystalCap = (eprom_read(dev, (EEPROM_CrystalCap>>1))&0x0f);
+		else
+			priv->EEPROMCrystalCap = EEPROM_Default_CrystalCap;
+		RT_TRACE(COMP_EPROM, "CrystalCap = %d\n", priv->EEPROMCrystalCap);
+		//get per-channel Tx power level
+		if (bLoad_From_EEPOM)
+			priv->EEPROM_Def_Ver = (eprom_read(dev, (EEPROM_TxPwIndex_Ver>>1))&0xff00)>>8;
+		else
+			priv->EEPROM_Def_Ver = 1;
+		RT_TRACE(COMP_EPROM, "EEPROM_DEF_VER:%d\n", priv->EEPROM_Def_Ver);
+		if (priv->EEPROM_Def_Ver == 0) //old eeprom definition
+		{
+			int i;
+			if (bLoad_From_EEPOM)
+				priv->EEPROMTxPowerLevelCCK = (eprom_read(dev, (EEPROM_TxPwIndex_CCK>>1))&0xff) >> 8;
+			else
+				priv->EEPROMTxPowerLevelCCK = 0x10;
+			RT_TRACE(COMP_EPROM, "CCK Tx Power Levl: 0x%02x\n", priv->EEPROMTxPowerLevelCCK);
+			for (i=0; i<3; i++)
+			{
+				if (bLoad_From_EEPOM)
+				{
+					tmpValue = eprom_read(dev, (EEPROM_TxPwIndex_OFDM_24G+i)>>1);
+					if (((EEPROM_TxPwIndex_OFDM_24G+i) % 2) == 0)
+						tmpValue = tmpValue & 0x00ff;
+					else
+						tmpValue = (tmpValue & 0xff00) >> 8;
+				}
+				else
+					tmpValue = 0x10;
+				priv->EEPROMTxPowerLevelOFDM24G[i] = (u8) tmpValue;
+				RT_TRACE(COMP_EPROM, "OFDM 2.4G Tx Power Level, Index %d = 0x%02x\n", i, priv->EEPROMTxPowerLevelCCK);
+			}
+		}//end if EEPROM_DEF_VER == 0
+		else if (priv->EEPROM_Def_Ver == 1)
+		{
+			if (bLoad_From_EEPOM)
+			{
+				tmpValue = eprom_read(dev, (EEPROM_TxPwIndex_CCK_V1>>1));
+				tmpValue = (tmpValue & 0xff00) >> 8;
+			}
+			else
+				tmpValue = 0x10;
+			priv->EEPROMTxPowerLevelCCK_V1[0] = (u8)tmpValue;
+
+			if (bLoad_From_EEPOM)
+				tmpValue = eprom_read(dev, (EEPROM_TxPwIndex_CCK_V1 + 2)>>1);
+			else
+				tmpValue = 0x1010;
+			*((u16*)(&priv->EEPROMTxPowerLevelCCK_V1[1])) = tmpValue;
+			if (bLoad_From_EEPOM)
+				tmpValue = eprom_read(dev, (EEPROM_TxPwIndex_OFDM_24G_V1>>1));
+			else
+				tmpValue = 0x1010;
+			*((u16*)(&priv->EEPROMTxPowerLevelOFDM24G[0])) = tmpValue;
+			if (bLoad_From_EEPOM)
+				tmpValue = eprom_read(dev, (EEPROM_TxPwIndex_OFDM_24G_V1+2)>>1);
+			else
+				tmpValue = 0x10;
+			priv->EEPROMTxPowerLevelOFDM24G[2] = (u8)tmpValue;
+		}//endif EEPROM_Def_Ver == 1
+
+		//update HAL variables
+		//
+		{
+			int i;
+			for (i=0; i<14; i++)
+			{
+				if (i<=3)
+					priv->TxPowerLevelOFDM24G[i] = priv->EEPROMTxPowerLevelOFDM24G[0];
+				else if (i>=4 && i<=9)
+					priv->TxPowerLevelOFDM24G[i] = priv->EEPROMTxPowerLevelOFDM24G[1];
+				else
+					priv->TxPowerLevelOFDM24G[i] = priv->EEPROMTxPowerLevelOFDM24G[2];
+			}
+
+			for (i=0; i<14; i++)
+			{
+				if (priv->EEPROM_Def_Ver == 0)
+				{
+					if (i<=3)
+						priv->TxPowerLevelCCK[i] = priv->EEPROMTxPowerLevelOFDM24G[0] + (priv->EEPROMTxPowerLevelCCK - priv->EEPROMTxPowerLevelOFDM24G[1]);
+					else if (i>=4 && i<=9)
+						priv->TxPowerLevelCCK[i] = priv->EEPROMTxPowerLevelCCK;
+					else
+						priv->TxPowerLevelCCK[i] = priv->EEPROMTxPowerLevelOFDM24G[2] + (priv->EEPROMTxPowerLevelCCK - priv->EEPROMTxPowerLevelOFDM24G[1]);
+				}
+				else if (priv->EEPROM_Def_Ver == 1)
+				{
+					if (i<=3)
+						priv->TxPowerLevelCCK[i] = priv->EEPROMTxPowerLevelCCK_V1[0];
+					else if (i>=4 && i<=9)
+						priv->TxPowerLevelCCK[i] = priv->EEPROMTxPowerLevelCCK_V1[1];
+					else
+						priv->TxPowerLevelCCK[i] = priv->EEPROMTxPowerLevelCCK_V1[2];
+				}
+			}
+		}//end update HAL variables
+		priv->TxPowerDiff = priv->EEPROMPwDiff;
+// Antenna B gain offset to antenna A, bit0~3
+		priv->AntennaTxPwDiff[0] = (priv->EEPROMTxPowerDiff & 0xf);
+		// Antenna C gain offset to antenna A, bit4~7
+		priv->AntennaTxPwDiff[1] = ((priv->EEPROMTxPowerDiff & 0xf0)>>4);
+		// CrystalCap, bit12~15
+		priv->CrystalCap = priv->EEPROMCrystalCap;
+		// ThermalMeter, bit0~3 for RFIC1, bit4~7 for RFIC2
+		// 92U does not enable TX power tracking.
+		priv->ThermalMeter[0] = priv->EEPROMThermalMeter;
+	}//end if VersionID == VERSION_819xU_A
+
+//added by vivi, for dlink led, 20080416
+	switch(priv->eeprom_CustomerID)
+	{
+		case EEPROM_CID_RUNTOP:
+			priv->CustomerID = RT_CID_819x_RUNTOP;
+			break;
+
+		case EEPROM_CID_DLINK:
+			priv->CustomerID = RT_CID_DLINK;
+			break;
+
+		default:
+			priv->CustomerID = RT_CID_DEFAULT;
+			break;
+
+	}
+
+	switch(priv->CustomerID)
+	{
+		case RT_CID_819x_RUNTOP:
+			priv->LedStrategy = SW_LED_MODE2;
+			break;
+
+		case RT_CID_DLINK:
+			priv->LedStrategy = SW_LED_MODE4;
+			break;
+
+		default:
+			priv->LedStrategy = SW_LED_MODE0;
+			break;
+
+	}
+
+
+	if(priv->rf_type == RF_1T2R)
+	{
+		RT_TRACE(COMP_EPROM, "\n1T2R config\n");
+	}
+	else
+	{
+		RT_TRACE(COMP_EPROM, "\n2T4R config\n");
+	}
+
+	// 2008/01/16 MH We can only know RF type in the function. So we have to init
+	// DIG RATR table again.
+	init_rate_adaptive(dev);
+	//we need init DIG RATR table here again.
+
+	RT_TRACE(COMP_EPROM, "<===========%s()\n", __FUNCTION__);
+	return;
+}
+
+short rtl8192_get_channel_map(struct net_device * dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+#ifdef ENABLE_DOT11D
+	if(priv->ChannelPlan > COUNTRY_CODE_GLOBAL_DOMAIN){
+		printk("rtl8180_init:Error channel plan! Set to default.\n");
+		priv->ChannelPlan= 0;
+	}
+	RT_TRACE(COMP_INIT, "Channel plan is %d\n",priv->ChannelPlan);
+
+	rtl819x_set_channel_map(priv->ChannelPlan, priv);
+#else
+	int ch,i;
+	//Set Default Channel Plan
+	if(!channels){
+		DMESG("No channels, aborting");
+		return -1;
+	}
+	ch=channels;
+	priv->ChannelPlan= 0;//hikaru
+	 // set channels 1..14 allowed in given locale
+	for (i=1; i<=14; i++) {
+		(priv->ieee80211->channel_map)[i] = (u8)(ch & 0x01);
+		ch >>= 1;
+	}
+#endif
+	return 0;
+}
+
+short rtl8192_init(struct net_device *dev)
+{
+
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+	memset(&(priv->stats),0,sizeof(struct Stats));
+	memset(priv->txqueue_to_outpipemap,0,9);
+#ifdef PIPE12
+	{
+		int i=0;
+		u8 queuetopipe[]={3,2,1,0,4,8,7,6,5};
+		memcpy(priv->txqueue_to_outpipemap,queuetopipe,9);
+/*		for(i=0;i<9;i++)
+			printk("%d ",priv->txqueue_to_outpipemap[i]);
+		printk("\n");*/
+	}
+#else
+	{
+		u8 queuetopipe[]={3,2,1,0,4,4,0,4,4};
+		memcpy(priv->txqueue_to_outpipemap,queuetopipe,9);
+/*		for(i=0;i<9;i++)
+			printk("%d ",priv->txqueue_to_outpipemap[i]);
+		printk("\n");*/
+	}
+#endif
+	rtl8192_init_priv_variable(dev);
+	rtl8192_init_priv_lock(priv);
+	rtl8192_init_priv_task(dev);
+	rtl8192_get_eeprom_size(dev);
+	rtl8192_read_eeprom_info(dev);
+	rtl8192_get_channel_map(dev);
+	init_hal_dm(dev);
+	init_timer(&priv->watch_dog_timer);
+	priv->watch_dog_timer.data = (unsigned long)dev;
+	priv->watch_dog_timer.function = watch_dog_timer_callback;
+	if(rtl8192_usb_initendpoints(dev)!=0){
+		DMESG("Endopoints initialization failed");
+		return -ENOMEM;
+	}
+
+	//rtl8192_adapter_start(dev);
+#ifdef DEBUG_EPROM
+	dump_eprom(dev);
+#endif
+	return 0;
+}
+
+/******************************************************************************
+ *function:  This function actually only set RRSR, RATR and BW_OPMODE registers
+ *	     not to do all the hw config as its name says
+ *   input:  net_device dev
+ *  output:  none
+ *  return:  none
+ *  notice:  This part need to modified according to the rate set we filtered
+ * ****************************************************************************/
+void rtl8192_hwconfig(struct net_device* dev)
+{
+	u32 regRATR = 0, regRRSR = 0;
+	u8 regBwOpMode = 0, regTmp = 0;
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+// Set RRSR, RATR, and BW_OPMODE registers
+	//
+	switch(priv->ieee80211->mode)
+	{
+	case WIRELESS_MODE_B:
+		regBwOpMode = BW_OPMODE_20MHZ;
+		regRATR = RATE_ALL_CCK;
+		regRRSR = RATE_ALL_CCK;
+		break;
+	case WIRELESS_MODE_A:
+		regBwOpMode = BW_OPMODE_5G |BW_OPMODE_20MHZ;
+		regRATR = RATE_ALL_OFDM_AG;
+		regRRSR = RATE_ALL_OFDM_AG;
+		break;
+	case WIRELESS_MODE_G:
+		regBwOpMode = BW_OPMODE_20MHZ;
+		regRATR = RATE_ALL_CCK | RATE_ALL_OFDM_AG;
+		regRRSR = RATE_ALL_CCK | RATE_ALL_OFDM_AG;
+		break;
+	case WIRELESS_MODE_AUTO:
+#ifdef TO_DO_LIST
+		if (Adapter->bInHctTest)
+		{
+		    regBwOpMode = BW_OPMODE_20MHZ;
+		    regRATR = RATE_ALL_CCK | RATE_ALL_OFDM_AG;
+		    regRRSR = RATE_ALL_CCK | RATE_ALL_OFDM_AG;
+		}
+		else
+#endif
+		{
+		    regBwOpMode = BW_OPMODE_20MHZ;
+		    regRATR = RATE_ALL_CCK | RATE_ALL_OFDM_AG | RATE_ALL_OFDM_1SS | RATE_ALL_OFDM_2SS;
+		    regRRSR = RATE_ALL_CCK | RATE_ALL_OFDM_AG;
+		}
+		break;
+	case WIRELESS_MODE_N_24G:
+		// It support CCK rate by default.
+		// CCK rate will be filtered out only when associated AP does not support it.
+		regBwOpMode = BW_OPMODE_20MHZ;
+			regRATR = RATE_ALL_CCK | RATE_ALL_OFDM_AG | RATE_ALL_OFDM_1SS | RATE_ALL_OFDM_2SS;
+			regRRSR = RATE_ALL_CCK | RATE_ALL_OFDM_AG;
+		break;
+	case WIRELESS_MODE_N_5G:
+		regBwOpMode = BW_OPMODE_5G;
+		regRATR = RATE_ALL_OFDM_AG | RATE_ALL_OFDM_1SS | RATE_ALL_OFDM_2SS;
+		regRRSR = RATE_ALL_OFDM_AG;
+		break;
+	}
+
+	write_nic_byte(dev, BW_OPMODE, regBwOpMode);
+	{
+		u32 ratr_value = 0;
+		ratr_value = regRATR;
+		if (priv->rf_type == RF_1T2R)
+		{
+			ratr_value &= ~(RATE_ALL_OFDM_2SS);
+		}
+		write_nic_dword(dev, RATR0, ratr_value);
+		write_nic_byte(dev, UFWP, 1);
+	}
+	regTmp = read_nic_byte(dev, 0x313);
+	regRRSR = ((regTmp) << 24) | (regRRSR & 0x00ffffff);
+	write_nic_dword(dev, RRSR, regRRSR);
+
+	//
+	// Set Retry Limit here
+	//
+	write_nic_word(dev, RETRY_LIMIT,
+			priv->ShortRetryLimit << RETRY_LIMIT_SHORT_SHIFT | \
+			priv->LongRetryLimit << RETRY_LIMIT_LONG_SHIFT);
+	// Set Contention Window here
+
+	// Set Tx AGC
+
+	// Set Tx Antenna including Feedback control
+
+	// Set Auto Rate fallback control
+
+
+}
+
+
+//InitializeAdapter and PhyCfg
+bool rtl8192_adapter_start(struct net_device *dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	u32 dwRegRead = 0;
+	bool init_status = true;
+	RT_TRACE(COMP_INIT, "====>%s()\n", __FUNCTION__);
+	priv->Rf_Mode = RF_OP_By_SW_3wire;
+	//for ASIC power on sequence
+	write_nic_byte_E(dev, 0x5f, 0x80);
+	mdelay(50);
+	write_nic_byte_E(dev, 0x5f, 0xf0);
+	write_nic_byte_E(dev, 0x5d, 0x00);
+	write_nic_byte_E(dev, 0x5e, 0x80);
+	write_nic_byte(dev, 0x17, 0x37);
+	mdelay(10);
+//#ifdef TO_DO_LIST
+	priv->pFirmware->firmware_status = FW_STATUS_0_INIT;
+	//config CPUReset Register
+	//Firmware Reset or not?
+	dwRegRead = read_nic_dword(dev, CPU_GEN);
+	if (priv->pFirmware->firmware_status == FW_STATUS_0_INIT)
+		dwRegRead |= CPU_GEN_SYSTEM_RESET; //do nothing here?
+	else if (priv->pFirmware->firmware_status == FW_STATUS_5_READY)
+		dwRegRead |= CPU_GEN_FIRMWARE_RESET;
+	else
+		RT_TRACE(COMP_ERR, "ERROR in %s(): undefined firmware state(%d)\n", __FUNCTION__,   priv->pFirmware->firmware_status);
+
+	write_nic_dword(dev, CPU_GEN, dwRegRead);
+	//mdelay(30);
+	//config BB.
+	rtl8192_BBConfig(dev);
+
+	//Loopback mode or not
+	priv->LoopbackMode = RTL819xU_NO_LOOPBACK;
+//	priv->LoopbackMode = RTL819xU_MAC_LOOPBACK;
+
+	dwRegRead = read_nic_dword(dev, CPU_GEN);
+	if (priv->LoopbackMode == RTL819xU_NO_LOOPBACK)
+		dwRegRead = ((dwRegRead & CPU_GEN_NO_LOOPBACK_MSK) | CPU_GEN_NO_LOOPBACK_SET);
+	else if (priv->LoopbackMode == RTL819xU_MAC_LOOPBACK)
+		dwRegRead |= CPU_CCK_LOOPBACK;
+	else
+		RT_TRACE(COMP_ERR, "Serious error in %s(): wrong loopback mode setting(%d)\n", __FUNCTION__,  priv->LoopbackMode);
+
+	write_nic_dword(dev, CPU_GEN, dwRegRead);
+
+	//after reset cpu, we need wait for a seconds to write in register.
+	udelay(500);
+
+	//xiong add for new bitfile:usb suspend reset pin set to 1. //do we need?
+	write_nic_byte_E(dev, 0x5f, (read_nic_byte_E(dev, 0x5f)|0x20));
+
+	//Set Hardware
+	rtl8192_hwconfig(dev);
+
+	//turn on Tx/Rx
+	write_nic_byte(dev, CMDR, CR_RE|CR_TE);
+
+	//set IDR0 here
+	write_nic_dword(dev, MAC0, ((u32*)dev->dev_addr)[0]);
+	write_nic_word(dev, MAC4, ((u16*)(dev->dev_addr + 4))[0]);
+
+	//set RCR
+	write_nic_dword(dev, RCR, priv->ReceiveConfig);
+
+	//Initialize Number of Reserved Pages in Firmware Queue
+	write_nic_dword(dev, RQPN1,  NUM_OF_PAGE_IN_FW_QUEUE_BK << RSVD_FW_QUEUE_PAGE_BK_SHIFT |\
+						NUM_OF_PAGE_IN_FW_QUEUE_BE << RSVD_FW_QUEUE_PAGE_BE_SHIFT | \
+						NUM_OF_PAGE_IN_FW_QUEUE_VI << RSVD_FW_QUEUE_PAGE_VI_SHIFT | \
+						NUM_OF_PAGE_IN_FW_QUEUE_VO <<RSVD_FW_QUEUE_PAGE_VO_SHIFT);
+	write_nic_dword(dev, RQPN2, NUM_OF_PAGE_IN_FW_QUEUE_MGNT << RSVD_FW_QUEUE_PAGE_MGNT_SHIFT |\
+						NUM_OF_PAGE_IN_FW_QUEUE_CMD << RSVD_FW_QUEUE_PAGE_CMD_SHIFT);
+	write_nic_dword(dev, RQPN3, APPLIED_RESERVED_QUEUE_IN_FW| \
+						NUM_OF_PAGE_IN_FW_QUEUE_BCN<<RSVD_FW_QUEUE_PAGE_BCN_SHIFT
+//						| NUM_OF_PAGE_IN_FW_QUEUE_PUB<<RSVD_FW_QUEUE_PAGE_PUB_SHIFT
+						);
+	write_nic_dword(dev, RATR0+4*7, (RATE_ALL_OFDM_AG | RATE_ALL_CCK));
+
+	//Set AckTimeout
+	// TODO: (it value is only for FPGA version). need to be changed!!2006.12.18, by Emily
+	write_nic_byte(dev, ACK_TIMEOUT, 0x30);
+
+//	RT_TRACE(COMP_INIT, "%s():priv->ResetProgress is %d\n", __FUNCTION__,priv->ResetProgress);
+	if(priv->ResetProgress == RESET_TYPE_NORESET)
+	rtl8192_SetWirelessMode(dev, priv->ieee80211->mode);
+	if(priv->ResetProgress == RESET_TYPE_NORESET){
+	CamResetAllEntry(dev);
+	{
+		u8 SECR_value = 0x0;
+		SECR_value |= SCR_TxEncEnable;
+		SECR_value |= SCR_RxDecEnable;
+		SECR_value |= SCR_NoSKMC;
+		write_nic_byte(dev, SECR, SECR_value);
+	}
+	}
+
+	//Beacon related
+	write_nic_word(dev, ATIMWND, 2);
+	write_nic_word(dev, BCN_INTERVAL, 100);
+
+	{
+#define DEFAULT_EDCA 0x005e4332
+		int i;
+		for (i=0; i<QOS_QUEUE_NUM; i++)
+		write_nic_dword(dev, WDCAPARA_ADD[i], DEFAULT_EDCA);
+	}
+#ifdef USB_RX_AGGREGATION_SUPPORT
+	//3 For usb rx firmware aggregation control
+	if(priv->ResetProgress == RESET_TYPE_NORESET)
+	{
+		u32 ulValue;
+		PRT_HIGH_THROUGHPUT	pHTInfo = priv->ieee80211->pHTInfo;
+		ulValue = (pHTInfo->UsbRxFwAggrEn<<24) | (pHTInfo->UsbRxFwAggrPageNum<<16) |
+					(pHTInfo->UsbRxFwAggrPacketNum<<8) | (pHTInfo->UsbRxFwAggrTimeout);
+		/*
+		 * If usb rx firmware aggregation is enabled,
+		 * when anyone of three threshold conditions above is reached,
+		 * firmware will send aggregated packet to driver.
+		 */
+		write_nic_dword(dev, 0x1a8, ulValue);
+		priv->bCurrentRxAggrEnable = true;
+	}
+#endif
+
+	rtl8192_phy_configmac(dev);
+
+	if (priv->card_8192_version == (u8) VERSION_819xU_A)
+	{
+		rtl8192_phy_getTxPower(dev);
+		rtl8192_phy_setTxPower(dev, priv->chan);
+	}
+
+	//Firmware download
+	init_status = init_firmware(dev);
+	if(!init_status)
+	{
+		RT_TRACE(COMP_ERR,"ERR!!! %s(): Firmware download is failed\n", __FUNCTION__);
+		return init_status;
+	}
+	RT_TRACE(COMP_INIT, "%s():after firmware download\n", __FUNCTION__);
+	//
+#ifdef TO_DO_LIST
+if(Adapter->ResetProgress == RESET_TYPE_NORESET)
+	{
+		if(pMgntInfo->RegRfOff == TRUE)
+		{ // User disable RF via registry.
+			RT_TRACE((COMP_INIT|COMP_RF), DBG_LOUD, ("InitializeAdapter819xUsb(): Turn off RF for RegRfOff ----------\n"));
+			MgntActSet_RF_State(Adapter, eRfOff, RF_CHANGE_BY_SW);
+			// Those action will be discard in MgntActSet_RF_State because off the same state
+			for(eRFPath = 0; eRFPath <pHalData->NumTotalRFPath; eRFPath++)
+				PHY_SetRFReg(Adapter, (RF90_RADIO_PATH_E)eRFPath, 0x4, 0xC00, 0x0);
+		}
+		else if(pMgntInfo->RfOffReason > RF_CHANGE_BY_PS)
+		{ // H/W or S/W RF OFF before sleep.
+			RT_TRACE((COMP_INIT|COMP_RF), DBG_LOUD, ("InitializeAdapter819xUsb(): Turn off RF for RfOffReason(%d) ----------\n", pMgntInfo->RfOffReason));
+			MgntActSet_RF_State(Adapter, eRfOff, pMgntInfo->RfOffReason);
+		}
+		else
+		{
+			pHalData->eRFPowerState = eRfOn;
+			pMgntInfo->RfOffReason = 0;
+			RT_TRACE((COMP_INIT|COMP_RF), DBG_LOUD, ("InitializeAdapter819xUsb(): RF is on ----------\n"));
+		}
+	}
+	else
+	{
+		if(pHalData->eRFPowerState == eRfOff)
+		{
+			MgntActSet_RF_State(Adapter, eRfOff, pMgntInfo->RfOffReason);
+			// Those action will be discard in MgntActSet_RF_State because off the same state
+			for(eRFPath = 0; eRFPath <pHalData->NumTotalRFPath; eRFPath++)
+				PHY_SetRFReg(Adapter, (RF90_RADIO_PATH_E)eRFPath, 0x4, 0xC00, 0x0);
+		}
+	}
+#endif
+	//config RF.
+	if(priv->ResetProgress == RESET_TYPE_NORESET){
+	rtl8192_phy_RFConfig(dev);
+	RT_TRACE(COMP_INIT, "%s():after phy RF config\n", __FUNCTION__);
+	}
+
+
+	if(priv->ieee80211->FwRWRF)
+		// We can force firmware to do RF-R/W
+		priv->Rf_Mode = RF_OP_By_FW;
+	else
+		priv->Rf_Mode = RF_OP_By_SW_3wire;
+
+
+	rtl8192_phy_updateInitGain(dev);
+	/*--set CCK and OFDM Block "ON"--*/
+	rtl8192_setBBreg(dev, rFPGA0_RFMOD, bCCKEn, 0x1);
+	rtl8192_setBBreg(dev, rFPGA0_RFMOD, bOFDMEn, 0x1);
+
+	if(priv->ResetProgress == RESET_TYPE_NORESET)
+	{
+		//if D or C cut
+		u8 tmpvalue = read_nic_byte(dev, 0x301);
+		if(tmpvalue ==0x03)
+		{
+			priv->bDcut = TRUE;
+			RT_TRACE(COMP_POWER_TRACKING, "D-cut\n");
+		}
+		else
+		{
+			priv->bDcut = FALSE;
+			RT_TRACE(COMP_POWER_TRACKING, "C-cut\n");
+		}
+		dm_initialize_txpower_tracking(dev);
+
+		if(priv->bDcut == TRUE)
+		{
+			u32 i, TempCCk;
+			u32 tmpRegA= rtl8192_QueryBBReg(dev,rOFDM0_XATxIQImbalance,bMaskDWord);
+		//	u32 tmpRegC= rtl8192_QueryBBReg(dev,rOFDM0_XCTxIQImbalance,bMaskDWord);
+			for(i = 0; i<TxBBGainTableLength; i++)
+			{
+				if(tmpRegA == priv->txbbgain_table[i].txbbgain_value)
+				{
+					priv->rfa_txpowertrackingindex= (u8)i;
+					priv->rfa_txpowertrackingindex_real= (u8)i;
+					priv->rfa_txpowertracking_default= priv->rfa_txpowertrackingindex;
+					break;
+				}
+			}
+
+			TempCCk = rtl8192_QueryBBReg(dev, rCCK0_TxFilter1, bMaskByte2);
+
+			for(i=0 ; i<CCKTxBBGainTableLength ; i++)
+			{
+
+				if(TempCCk == priv->cck_txbbgain_table[i].ccktxbb_valuearray[0])
+				{
+					priv->cck_present_attentuation_20Mdefault=(u8) i;
+					break;
+				}
+			}
+			priv->cck_present_attentuation_40Mdefault= 0;
+			priv->cck_present_attentuation_difference= 0;
+			priv->cck_present_attentuation = priv->cck_present_attentuation_20Mdefault;
+
+	//		pMgntInfo->bTXPowerTracking = FALSE;//TEMPLY DISABLE
+		}
+	}
+	write_nic_byte(dev, 0x87, 0x0);
+
+
+	return init_status;
+}
+
+/* this configures registers for beacon tx and enables it via
+ * rtl8192_beacon_tx_enable(). rtl8192_beacon_tx_disable() might
+ * be used to stop beacon transmission
+ */
+/***************************************************************************
+    -------------------------------NET STUFF---------------------------
+***************************************************************************/
+
+static struct net_device_stats *rtl8192_stats(struct net_device *dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+	return &priv->ieee80211->stats;
+}
+
+bool
+HalTxCheckStuck819xUsb(
+	struct net_device *dev
+	)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	u16 		RegTxCounter = read_nic_word(dev, 0x128);
+	bool		bStuck = FALSE;
+	RT_TRACE(COMP_RESET,"%s():RegTxCounter is %d,TxCounter is %d\n",__FUNCTION__,RegTxCounter,priv->TxCounter);
+	if(priv->TxCounter==RegTxCounter)
+		bStuck = TRUE;
+
+	priv->TxCounter = RegTxCounter;
+
+	return bStuck;
+}
+
+/*
+*	<Assumption: RT_TX_SPINLOCK is acquired.>
+*	First added: 2006.11.19 by emily
+*/
+RESET_TYPE
+TxCheckStuck(struct net_device *dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	u8			QueueID;
+//	PRT_TCB			pTcb;
+//	u8			ResetThreshold;
+	bool			bCheckFwTxCnt = false;
+	//unsigned long flags;
+
+	//
+	// Decide Stuch threshold according to current power save mode
+	//
+
+//     RT_TRACE(COMP_RESET, " ==> TxCheckStuck()\n");
+//	     PlatformAcquireSpinLock(Adapter, RT_TX_SPINLOCK);
+//	     spin_lock_irqsave(&priv->ieee80211->lock,flags);
+	     for (QueueID = 0; QueueID<=BEACON_QUEUE;QueueID ++)
+	     {
+	     		if(QueueID == TXCMD_QUEUE)
+		         continue;
+#ifdef USB_TX_DRIVER_AGGREGATION_ENABLE
+			if((skb_queue_len(&priv->ieee80211->skb_waitQ[QueueID]) == 0) && (skb_queue_len(&priv->ieee80211->skb_aggQ[QueueID]) == 0) && (skb_queue_len(&priv->ieee80211->skb_drv_aggQ[QueueID]) == 0))
+#else
+		     	if((skb_queue_len(&priv->ieee80211->skb_waitQ[QueueID]) == 0)  && (skb_queue_len(&priv->ieee80211->skb_aggQ[QueueID]) == 0))
+#endif
+			 	continue;
+
+	             bCheckFwTxCnt = true;
+	     }
+//	     PlatformReleaseSpinLock(Adapter, RT_TX_SPINLOCK);
+//	spin_unlock_irqrestore(&priv->ieee80211->lock,flags);
+//	RT_TRACE(COMP_RESET,"bCheckFwTxCnt is %d\n",bCheckFwTxCnt);
+	if(bCheckFwTxCnt)
+	{
+		if(HalTxCheckStuck819xUsb(dev))
+		{
+			RT_TRACE(COMP_RESET, "TxCheckStuck(): Fw indicates no Tx condition! \n");
+			return RESET_TYPE_SILENT;
+		}
+	}
+	return RESET_TYPE_NORESET;
+}
+
+bool
+HalRxCheckStuck819xUsb(struct net_device *dev)
+{
+	u16 	RegRxCounter = read_nic_word(dev, 0x130);
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	bool bStuck = FALSE;
+	static u8	rx_chk_cnt = 0;
+	RT_TRACE(COMP_RESET,"%s(): RegRxCounter is %d,RxCounter is %d\n",__FUNCTION__,RegRxCounter,priv->RxCounter);
+	// If rssi is small, we should check rx for long time because of bad rx.
+	// or maybe it will continuous silent reset every 2 seconds.
+	rx_chk_cnt++;
+	if(priv->undecorated_smoothed_pwdb >= (RateAdaptiveTH_High+5))
+	{
+		rx_chk_cnt = 0;	//high rssi, check rx stuck right now.
+	}
+	else if(priv->undecorated_smoothed_pwdb < (RateAdaptiveTH_High+5) &&
+		((priv->CurrentChannelBW!=HT_CHANNEL_WIDTH_20&&priv->undecorated_smoothed_pwdb>=RateAdaptiveTH_Low_40M) ||
+		(priv->CurrentChannelBW==HT_CHANNEL_WIDTH_20&&priv->undecorated_smoothed_pwdb>=RateAdaptiveTH_Low_20M)) )
+	{
+		if(rx_chk_cnt < 2)
+		{
+			return bStuck;
+		}
+		else
+		{
+			rx_chk_cnt = 0;
+		}
+	}
+	else if(((priv->CurrentChannelBW!=HT_CHANNEL_WIDTH_20&&priv->undecorated_smoothed_pwdb<RateAdaptiveTH_Low_40M) ||
+		(priv->CurrentChannelBW==HT_CHANNEL_WIDTH_20&&priv->undecorated_smoothed_pwdb<RateAdaptiveTH_Low_20M)) &&
+		priv->undecorated_smoothed_pwdb >= VeryLowRSSI)
+	{
+		if(rx_chk_cnt < 4)
+		{
+			//DbgPrint("RSSI < %d && RSSI >= %d, no check this time \n", RateAdaptiveTH_Low, VeryLowRSSI);
+			return bStuck;
+		}
+		else
+		{
+			rx_chk_cnt = 0;
+			//DbgPrint("RSSI < %d && RSSI >= %d, check this time \n", RateAdaptiveTH_Low, VeryLowRSSI);
+		}
+	}
+	else
+	{
+		if(rx_chk_cnt < 8)
+		{
+			//DbgPrint("RSSI <= %d, no check this time \n", VeryLowRSSI);
+			return bStuck;
+		}
+		else
+		{
+			rx_chk_cnt = 0;
+			//DbgPrint("RSSI <= %d, check this time \n", VeryLowRSSI);
+		}
+	}
+
+	if(priv->RxCounter==RegRxCounter)
+		bStuck = TRUE;
+
+	priv->RxCounter = RegRxCounter;
+
+	return bStuck;
+}
+
+RESET_TYPE
+RxCheckStuck(struct net_device *dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	//int                     i;
+	bool        bRxCheck = FALSE;
+
+//       RT_TRACE(COMP_RESET," ==> RxCheckStuck()\n");
+	//PlatformAcquireSpinLock(Adapter, RT_RX_SPINLOCK);
+
+	 if(priv->IrpPendingCount > 1)
+		bRxCheck = TRUE;
+       //PlatformReleaseSpinLock(Adapter, RT_RX_SPINLOCK);
+
+//       RT_TRACE(COMP_RESET,"bRxCheck is %d \n",bRxCheck);
+	if(bRxCheck)
+	{
+		if(HalRxCheckStuck819xUsb(dev))
+		{
+			RT_TRACE(COMP_RESET, "RxStuck Condition\n");
+			return RESET_TYPE_SILENT;
+		}
+	}
+	return RESET_TYPE_NORESET;
+}
+
+
+/**
+*	This function is called by Checkforhang to check whether we should ask OS to reset driver
+*
+*	\param pAdapter	The adapter context for this miniport
+*
+*	Note:NIC with USB interface sholud not call this function because we cannot scan descriptor
+*	to judge whether there is tx stuck.
+*	Note: This function may be required to be rewrite for Vista OS.
+*	<<<Assumption: Tx spinlock has been acquired >>>
+*
+*	8185 and 8185b does not implement this function. This is added by Emily at 2006.11.24
+*/
+RESET_TYPE
+rtl819x_ifcheck_resetornot(struct net_device *dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	RESET_TYPE	TxResetType = RESET_TYPE_NORESET;
+	RESET_TYPE	RxResetType = RESET_TYPE_NORESET;
+	RT_RF_POWER_STATE 	rfState;
+
+	rfState = priv->ieee80211->eRFPowerState;
+
+	TxResetType = TxCheckStuck(dev);
+	if( rfState != eRfOff ||
+		/*ADAPTER_TEST_STATUS_FLAG(Adapter, ADAPTER_STATUS_FW_DOWNLOAD_FAILURE)) &&*/
+		(priv->ieee80211->iw_mode != IW_MODE_ADHOC))
+	{
+		// If driver is in the status of firmware download failure , driver skips RF initialization and RF is
+		// in turned off state. Driver should check whether Rx stuck and do silent reset. And
+		// if driver is in firmware download failure status, driver should initialize RF in the following
+		// silent reset procedure Emily, 2008.01.21
+
+		// Driver should not check RX stuck in IBSS mode because it is required to
+		// set Check BSSID in order to send beacon, however, if check BSSID is
+		// set, STA cannot hear any packet a all. Emily, 2008.04.12
+		RxResetType = RxCheckStuck(dev);
+	}
+	if(TxResetType==RESET_TYPE_NORMAL || RxResetType==RESET_TYPE_NORMAL)
+		return RESET_TYPE_NORMAL;
+	else if(TxResetType==RESET_TYPE_SILENT || RxResetType==RESET_TYPE_SILENT){
+		RT_TRACE(COMP_RESET,"%s():silent reset\n",__FUNCTION__);
+		return RESET_TYPE_SILENT;
+	}
+	else
+		return RESET_TYPE_NORESET;
+
+}
+
+void rtl8192_cancel_deferred_work(struct r8192_priv* priv);
+int _rtl8192_up(struct net_device *dev);
+int rtl8192_close(struct net_device *dev);
+
+
+
+void
+CamRestoreAllEntry(	struct net_device *dev)
+{
+	u8 EntryId = 0;
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	u8*	MacAddr = priv->ieee80211->current_network.bssid;
+
+	static u8	CAM_CONST_ADDR[4][6] = {
+		{0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
+		{0x00, 0x00, 0x00, 0x00, 0x00, 0x01},
+		{0x00, 0x00, 0x00, 0x00, 0x00, 0x02},
+		{0x00, 0x00, 0x00, 0x00, 0x00, 0x03}};
+	static u8	CAM_CONST_BROAD[] =
+		{0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+
+	RT_TRACE(COMP_SEC, "CamRestoreAllEntry: \n");
+
+
+	if ((priv->ieee80211->pairwise_key_type == KEY_TYPE_WEP40)||
+	    (priv->ieee80211->pairwise_key_type == KEY_TYPE_WEP104))
+	{
+
+		for(EntryId=0; EntryId<4; EntryId++)
+		{
+			{
+				MacAddr = CAM_CONST_ADDR[EntryId];
+				setKey(dev,
+						EntryId ,
+						EntryId,
+						priv->ieee80211->pairwise_key_type,
+						MacAddr,
+						0,
+						NULL);
+			}
+		}
+
+	}
+	else if(priv->ieee80211->pairwise_key_type == KEY_TYPE_TKIP)
+	{
+
+		{
+			if(priv->ieee80211->iw_mode == IW_MODE_ADHOC)
+				setKey(dev,
+						4,
+						0,
+						priv->ieee80211->pairwise_key_type,
+						(u8*)dev->dev_addr,
+						0,
+						NULL);
+			else
+				setKey(dev,
+						4,
+						0,
+						priv->ieee80211->pairwise_key_type,
+						MacAddr,
+						0,
+						NULL);
+		}
+	}
+	else if(priv->ieee80211->pairwise_key_type == KEY_TYPE_CCMP)
+	{
+
+		{
+			if(priv->ieee80211->iw_mode == IW_MODE_ADHOC)
+				setKey(dev,
+						4,
+						0,
+						priv->ieee80211->pairwise_key_type,
+						(u8*)dev->dev_addr,
+						0,
+						NULL);
+			else
+				setKey(dev,
+						4,
+						0,
+						priv->ieee80211->pairwise_key_type,
+						MacAddr,
+						0,
+						NULL);
+		}
+	}
+
+
+
+	if(priv->ieee80211->group_key_type == KEY_TYPE_TKIP)
+	{
+		MacAddr = CAM_CONST_BROAD;
+		for(EntryId=1 ; EntryId<4 ; EntryId++)
+		{
+			{
+				setKey(dev,
+						EntryId,
+						EntryId,
+						priv->ieee80211->group_key_type,
+						MacAddr,
+						0,
+						NULL);
+			}
+		}
+		if(priv->ieee80211->iw_mode == IW_MODE_ADHOC)
+				setKey(dev,
+						0,
+						0,
+						priv->ieee80211->group_key_type,
+						CAM_CONST_ADDR[0],
+						0,
+						NULL);
+	}
+	else if(priv->ieee80211->group_key_type == KEY_TYPE_CCMP)
+	{
+		MacAddr = CAM_CONST_BROAD;
+		for(EntryId=1; EntryId<4 ; EntryId++)
+		{
+			{
+				setKey(dev,
+						EntryId ,
+						EntryId,
+						priv->ieee80211->group_key_type,
+						MacAddr,
+						0,
+						NULL);
+			}
+		}
+
+		if(priv->ieee80211->iw_mode == IW_MODE_ADHOC)
+				setKey(dev,
+						0 ,
+						0,
+						priv->ieee80211->group_key_type,
+						CAM_CONST_ADDR[0],
+						0,
+						NULL);
+	}
+}
+//////////////////////////////////////////////////////////////
+// This function is used to fix Tx/Rx stop bug temporarily.
+// This function will do "system reset" to NIC when Tx or Rx is stuck.
+// The method checking Tx/Rx stuck of this function is supported by FW,
+// which reports Tx and Rx counter to register 0x128 and 0x130.
+//////////////////////////////////////////////////////////////
+void
+rtl819x_ifsilentreset(struct net_device *dev)
+{
+	//OCTET_STRING asocpdu;
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	u8	reset_times = 0;
+	int reset_status = 0;
+	struct ieee80211_device *ieee = priv->ieee80211;
+
+
+	// 2007.07.20. If we need to check CCK stop, please uncomment this line.
+	//bStuck = Adapter->HalFunc.CheckHWStopHandler(Adapter);
+
+	if(priv->ResetProgress==RESET_TYPE_NORESET)
+	{
+RESET_START:
+
+		RT_TRACE(COMP_RESET,"=========>Reset progress!! \n");
+
+		// Set the variable for reset.
+		priv->ResetProgress = RESET_TYPE_SILENT;
+//		rtl8192_close(dev);
+		down(&priv->wx_sem);
+		if(priv->up == 0)
+		{
+			RT_TRACE(COMP_ERR,"%s():the driver is not up! return\n",__FUNCTION__);
+			up(&priv->wx_sem);
+			return ;
+		}
+		priv->up = 0;
+		RT_TRACE(COMP_RESET,"%s():======>start to down the driver\n",__FUNCTION__);
+//		if(!netif_queue_stopped(dev))
+//			netif_stop_queue(dev);
+
+		rtl8192_rtx_disable(dev);
+		rtl8192_cancel_deferred_work(priv);
+		deinit_hal_dm(dev);
+		del_timer_sync(&priv->watch_dog_timer);
+
+		ieee->sync_scan_hurryup = 1;
+		if(ieee->state == IEEE80211_LINKED)
+		{
+			down(&ieee->wx_sem);
+			printk("ieee->state is IEEE80211_LINKED\n");
+			ieee80211_stop_send_beacons(priv->ieee80211);
+			del_timer_sync(&ieee->associate_timer);
+			cancel_delayed_work(&ieee->associate_retry_wq);
+			ieee80211_stop_scan(ieee);
+			netif_carrier_off(dev);
+			up(&ieee->wx_sem);
+		}
+		else{
+			printk("ieee->state is NOT LINKED\n");
+			ieee80211_softmac_stop_protocol(priv->ieee80211);			}
+		up(&priv->wx_sem);
+		RT_TRACE(COMP_RESET,"%s():<==========down process is finished\n",__FUNCTION__);
+	//rtl8192_irq_disable(dev);
+		RT_TRACE(COMP_RESET,"%s():===========>start to up the driver\n",__FUNCTION__);
+		reset_status = _rtl8192_up(dev);
+
+		RT_TRACE(COMP_RESET,"%s():<===========up process is finished\n",__FUNCTION__);
+		if(reset_status == -EAGAIN)
+		{
+			if(reset_times < 3)
+			{
+				reset_times++;
+				goto RESET_START;
+			}
+			else
+			{
+				RT_TRACE(COMP_ERR," ERR!!! %s():  Reset Failed!!\n", __FUNCTION__);
+			}
+		}
+		ieee->is_silent_reset = 1;
+		EnableHWSecurityConfig8192(dev);
+		if(ieee->state == IEEE80211_LINKED && ieee->iw_mode == IW_MODE_INFRA)
+		{
+			ieee->set_chan(ieee->dev, ieee->current_network.channel);
+
+			queue_work(ieee->wq, &ieee->associate_complete_wq);
+
+		}
+		else if(ieee->state == IEEE80211_LINKED && ieee->iw_mode == IW_MODE_ADHOC)
+		{
+			ieee->set_chan(ieee->dev, ieee->current_network.channel);
+			ieee->link_change(ieee->dev);
+
+		//	notify_wx_assoc_event(ieee);
+
+			ieee80211_start_send_beacons(ieee);
+
+			if (ieee->data_hard_resume)
+				ieee->data_hard_resume(ieee->dev);
+			netif_carrier_on(ieee->dev);
+		}
+
+		CamRestoreAllEntry(dev);
+
+		priv->ResetProgress = RESET_TYPE_NORESET;
+		priv->reset_count++;
+
+		priv->bForcedSilentReset =false;
+		priv->bResetInProgress = false;
+
+		// For test --> force write UFWP.
+		write_nic_byte(dev, UFWP, 1);
+		RT_TRACE(COMP_RESET, "Reset finished!! ====>[%d]\n", priv->reset_count);
+	}
+}
+
+void CAM_read_entry(
+	struct net_device *dev,
+	u32	 		iIndex
+)
+{
+ 	u32 target_command=0;
+	 u32 target_content=0;
+	 u8 entry_i=0;
+	 u32 ulStatus;
+	s32 i=100;
+//	printk("=======>start read CAM\n");
+ 	for(entry_i=0;entry_i<CAM_CONTENT_COUNT;entry_i++)
+ 	{
+   	// polling bit, and No Write enable, and address
+		target_command= entry_i+CAM_CONTENT_COUNT*iIndex;
+		target_command= target_command | BIT31;
+
+	//Check polling bit is clear
+//	mdelay(1);
+		while((i--)>=0)
+		{
+			ulStatus = read_nic_dword(dev, RWCAM);
+			if(ulStatus & BIT31){
+				continue;
+			}
+			else{
+				break;
+			}
+		}
+		write_nic_dword(dev, RWCAM, target_command);
+		RT_TRACE(COMP_SEC,"CAM_read_entry(): WRITE A0: %x \n",target_command);
+	 //	printk("CAM_read_entry(): WRITE A0: %lx \n",target_command);
+		target_content = read_nic_dword(dev, RCAMO);
+		RT_TRACE(COMP_SEC, "CAM_read_entry(): WRITE A8: %x \n",target_content);
+	 //	printk("CAM_read_entry(): WRITE A8: %lx \n",target_content);
+	}
+	printk("\n");
+}
+
+void rtl819x_update_rxcounts(
+	struct r8192_priv *priv,
+	u32* TotalRxBcnNum,
+	u32* TotalRxDataNum
+)
+{
+	u16 			SlotIndex;
+	u8			i;
+
+	*TotalRxBcnNum = 0;
+	*TotalRxDataNum = 0;
+
+	SlotIndex = (priv->ieee80211->LinkDetectInfo.SlotIndex++)%(priv->ieee80211->LinkDetectInfo.SlotNum);
+	priv->ieee80211->LinkDetectInfo.RxBcnNum[SlotIndex] = priv->ieee80211->LinkDetectInfo.NumRecvBcnInPeriod;
+	priv->ieee80211->LinkDetectInfo.RxDataNum[SlotIndex] = priv->ieee80211->LinkDetectInfo.NumRecvDataInPeriod;
+	for( i=0; i<priv->ieee80211->LinkDetectInfo.SlotNum; i++ ){
+		*TotalRxBcnNum += priv->ieee80211->LinkDetectInfo.RxBcnNum[i];
+		*TotalRxDataNum += priv->ieee80211->LinkDetectInfo.RxDataNum[i];
+	}
+}
+
+
+extern	void	rtl819x_watchdog_wqcallback(struct work_struct *work)
+{
+	struct delayed_work *dwork = container_of(work,struct delayed_work,work);
+       struct r8192_priv *priv = container_of(dwork,struct r8192_priv,watch_dog_wq);
+       struct net_device *dev = priv->ieee80211->dev;
+	struct ieee80211_device* ieee = priv->ieee80211;
+	RESET_TYPE	ResetType = RESET_TYPE_NORESET;
+	static u8	check_reset_cnt=0;
+	bool bBusyTraffic = false;
+
+	if(!priv->up)
+		return;
+	hal_dm_watchdog(dev);
+
+	{//to get busy traffic condition
+		if(ieee->state == IEEE80211_LINKED)
+		{
+			if(	ieee->LinkDetectInfo.NumRxOkInPeriod> 666 ||
+				ieee->LinkDetectInfo.NumTxOkInPeriod> 666 ) {
+				bBusyTraffic = true;
+			}
+			ieee->LinkDetectInfo.NumRxOkInPeriod = 0;
+			ieee->LinkDetectInfo.NumTxOkInPeriod = 0;
+			ieee->LinkDetectInfo.bBusyTraffic = bBusyTraffic;
+		}
+	}
+	//added by amy for AP roaming
+	{
+		if(priv->ieee80211->state == IEEE80211_LINKED && priv->ieee80211->iw_mode == IW_MODE_INFRA)
+		{
+			u32	TotalRxBcnNum = 0;
+			u32	TotalRxDataNum = 0;
+
+			rtl819x_update_rxcounts(priv, &TotalRxBcnNum, &TotalRxDataNum);
+			if((TotalRxBcnNum+TotalRxDataNum) == 0)
+			{
+				#ifdef TODO
+				if(rfState == eRfOff)
+					RT_TRACE(COMP_ERR,"========>%s()\n",__FUNCTION__);
+				#endif
+				printk("===>%s(): AP is power off,connect another one\n",__FUNCTION__);
+			//	Dot11d_Reset(dev);
+				priv->ieee80211->state = IEEE80211_ASSOCIATING;
+				notify_wx_assoc_event(priv->ieee80211);
+				RemovePeerTS(priv->ieee80211,priv->ieee80211->current_network.bssid);
+				priv->ieee80211->link_change(dev);
+                                queue_work(priv->ieee80211->wq, &priv->ieee80211->associate_procedure_wq);
+
+			}
+		}
+		priv->ieee80211->LinkDetectInfo.NumRecvBcnInPeriod=0;
+		priv->ieee80211->LinkDetectInfo.NumRecvDataInPeriod=0;
+	}
+//	CAM_read_entry(dev,4);
+	//check if reset the driver
+	if(check_reset_cnt++ >= 3)
+	{
+    		ResetType = rtl819x_ifcheck_resetornot(dev);
+		check_reset_cnt = 3;
+		//DbgPrint("Start to check silent reset\n");
+	}
+	//	RT_TRACE(COMP_RESET,"%s():priv->force_reset is %d,priv->ResetProgress is %d, priv->bForcedSilentReset is %d,priv->bDisableNormalResetCheck is %d,ResetType is %d\n",__FUNCTION__,priv->force_reset,priv->ResetProgress,priv->bForcedSilentReset,priv->bDisableNormalResetCheck,ResetType);
+	if( (priv->force_reset) || (priv->ResetProgress==RESET_TYPE_NORESET &&
+		(priv->bForcedSilentReset ||
+		(!priv->bDisableNormalResetCheck && ResetType==RESET_TYPE_SILENT)))) // This is control by OID set in Pomelo
+	{
+		RT_TRACE(COMP_RESET,"%s():priv->force_reset is %d,priv->ResetProgress is %d, priv->bForcedSilentReset is %d,priv->bDisableNormalResetCheck is %d,ResetType is %d\n",__FUNCTION__,priv->force_reset,priv->ResetProgress,priv->bForcedSilentReset,priv->bDisableNormalResetCheck,ResetType);
+		rtl819x_ifsilentreset(dev);
+	}
+	priv->force_reset = false;
+	priv->bForcedSilentReset = false;
+	priv->bResetInProgress = false;
+	RT_TRACE(COMP_TRACE, " <==RtUsbCheckForHangWorkItemCallback()\n");
+
+}
+
+void watch_dog_timer_callback(unsigned long data)
+{
+	struct r8192_priv *priv = ieee80211_priv((struct net_device *) data);
+	//printk("===============>watch_dog  timer\n");
+	queue_delayed_work(priv->priv_wq,&priv->watch_dog_wq, 0);
+	mod_timer(&priv->watch_dog_timer, jiffies + MSECS(IEEE80211_WATCH_DOG_TIME));
+}
+int _rtl8192_up(struct net_device *dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	//int i;
+	int init_status = 0;
+	priv->up=1;
+	priv->ieee80211->ieee_up=1;
+	RT_TRACE(COMP_INIT, "Bringing up iface");
+	init_status = rtl8192_adapter_start(dev);
+	if(!init_status)
+	{
+		RT_TRACE(COMP_ERR,"ERR!!! %s(): initialization is failed!\n", __FUNCTION__);
+		priv->up=priv->ieee80211->ieee_up = 0;
+		return -EAGAIN;
+	}
+	RT_TRACE(COMP_INIT, "start adapter finished\n");
+	rtl8192_rx_enable(dev);
+//	rtl8192_tx_enable(dev);
+	if(priv->ieee80211->state != IEEE80211_LINKED)
+	ieee80211_softmac_start_protocol(priv->ieee80211);
+	ieee80211_reset_queue(priv->ieee80211);
+	watch_dog_timer_callback((unsigned long) dev);
+	if(!netif_queue_stopped(dev))
+		netif_start_queue(dev);
+	else
+		netif_wake_queue(dev);
+
+	return 0;
+}
+
+
+int rtl8192_open(struct net_device *dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	int ret;
+	down(&priv->wx_sem);
+	ret = rtl8192_up(dev);
+	up(&priv->wx_sem);
+	return ret;
+
+}
+
+
+int rtl8192_up(struct net_device *dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+	if (priv->up == 1) return -1;
+
+	return _rtl8192_up(dev);
+}
+
+
+int rtl8192_close(struct net_device *dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	int ret;
+
+	down(&priv->wx_sem);
+
+	ret = rtl8192_down(dev);
+
+	up(&priv->wx_sem);
+
+	return ret;
+
+}
+
+int rtl8192_down(struct net_device *dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	int i;
+
+	if (priv->up == 0) return -1;
+
+	priv->up=0;
+	priv->ieee80211->ieee_up = 0;
+	RT_TRACE(COMP_DOWN, "==========>%s()\n", __FUNCTION__);
+/* FIXME */
+	if (!netif_queue_stopped(dev))
+		netif_stop_queue(dev);
+
+	rtl8192_rtx_disable(dev);
+	//rtl8192_irq_disable(dev);
+
+ /* Tx related queue release */
+	for(i = 0; i < MAX_QUEUE_SIZE; i++) {
+		skb_queue_purge(&priv->ieee80211->skb_waitQ [i]);
+	}
+	for(i = 0; i < MAX_QUEUE_SIZE; i++) {
+		skb_queue_purge(&priv->ieee80211->skb_aggQ [i]);
+	}
+
+	for(i = 0; i < MAX_QUEUE_SIZE; i++) {
+		skb_queue_purge(&priv->ieee80211->skb_drv_aggQ [i]);
+	}
+
+	//as cancel_delayed_work will del work->timer, so if work is not definedas struct delayed_work, it will corrupt
+//	flush_scheduled_work();
+	rtl8192_cancel_deferred_work(priv);
+	deinit_hal_dm(dev);
+	del_timer_sync(&priv->watch_dog_timer);
+
+
+	ieee80211_softmac_stop_protocol(priv->ieee80211);
+	memset(&priv->ieee80211->current_network, 0 , offsetof(struct ieee80211_network, list));
+	RT_TRACE(COMP_DOWN, "<==========%s()\n", __FUNCTION__);
+
+		return 0;
+}
+
+
+void rtl8192_commit(struct net_device *dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	int reset_status = 0;
+	//u8 reset_times = 0;
+	if (priv->up == 0) return ;
+	priv->up = 0;
+
+	rtl8192_cancel_deferred_work(priv);
+	del_timer_sync(&priv->watch_dog_timer);
+	//cancel_delayed_work(&priv->SwChnlWorkItem);
+
+	ieee80211_softmac_stop_protocol(priv->ieee80211);
+
+	//rtl8192_irq_disable(dev);
+	rtl8192_rtx_disable(dev);
+	reset_status = _rtl8192_up(dev);
+
+}
+
+/*
+void rtl8192_restart(struct net_device *dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+*/
+void rtl8192_restart(struct work_struct *work)
+{
+	struct r8192_priv *priv = container_of(work, struct r8192_priv, reset_wq);
+	struct net_device *dev = priv->ieee80211->dev;
+
+	down(&priv->wx_sem);
+
+	rtl8192_commit(dev);
+
+	up(&priv->wx_sem);
+}
+
+static void r8192_set_multicast(struct net_device *dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	short promisc;
+
+	//down(&priv->wx_sem);
+
+	/* FIXME FIXME */
+
+	promisc = (dev->flags & IFF_PROMISC) ? 1:0;
+
+	if (promisc != priv->promisc)
+	//	rtl8192_commit(dev);
+
+	priv->promisc = promisc;
+
+	//schedule_work(&priv->reset_wq);
+	//up(&priv->wx_sem);
+}
+
+
+int r8192_set_mac_adr(struct net_device *dev, void *mac)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	struct sockaddr *addr = mac;
+
+	down(&priv->wx_sem);
+
+	memcpy(dev->dev_addr, addr->sa_data, ETH_ALEN);
+
+	schedule_work(&priv->reset_wq);
+	up(&priv->wx_sem);
+
+	return 0;
+}
+
+/* based on ipw2200 driver */
+int rtl8192_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
+{
+	struct r8192_priv *priv = (struct r8192_priv *)ieee80211_priv(dev);
+	struct iwreq *wrq = (struct iwreq *)rq;
+	int ret=-1;
+	struct ieee80211_device *ieee = priv->ieee80211;
+	u32 key[4];
+	u8 broadcast_addr[6] = {0xff,0xff,0xff,0xff,0xff,0xff};
+	struct iw_point *p = &wrq->u.data;
+	struct ieee_param *ipw = NULL;//(struct ieee_param *)wrq->u.data.pointer;
+
+	down(&priv->wx_sem);
+
+
+     if (p->length < sizeof(struct ieee_param) || !p->pointer){
+	     ret = -EINVAL;
+	     goto out;
+	}
+
+     ipw = (struct ieee_param *)kmalloc(p->length, GFP_KERNEL);
+     if (ipw == NULL){
+	     ret = -ENOMEM;
+	     goto out;
+     }
+     if (copy_from_user(ipw, p->pointer, p->length)) {
+		kfree(ipw);
+	    ret = -EFAULT;
+	    goto out;
+	}
+
+	switch (cmd) {
+	    case RTL_IOCTL_WPA_SUPPLICANT:
+	//parse here for HW security
+			if (ipw->cmd == IEEE_CMD_SET_ENCRYPTION)
+			{
+				if (ipw->u.crypt.set_tx)
+				{
+					if (strcmp(ipw->u.crypt.alg, "CCMP") == 0)
+						ieee->pairwise_key_type = KEY_TYPE_CCMP;
+					else if (strcmp(ipw->u.crypt.alg, "TKIP") == 0)
+						ieee->pairwise_key_type = KEY_TYPE_TKIP;
+					else if (strcmp(ipw->u.crypt.alg, "WEP") == 0)
+					{
+						if (ipw->u.crypt.key_len == 13)
+							ieee->pairwise_key_type = KEY_TYPE_WEP104;
+						else if (ipw->u.crypt.key_len == 5)
+							ieee->pairwise_key_type = KEY_TYPE_WEP40;
+					}
+					else
+						ieee->pairwise_key_type = KEY_TYPE_NA;
+
+					if (ieee->pairwise_key_type)
+					{
+						memcpy((u8*)key, ipw->u.crypt.key, 16);
+						EnableHWSecurityConfig8192(dev);
+					//we fill both index entry and 4th entry for pairwise key as in IPW interface, adhoc will only get here, so we need index entry for its default key serching!
+					//added by WB.
+						setKey(dev, 4, ipw->u.crypt.idx, ieee->pairwise_key_type, (u8*)ieee->ap_mac_addr, 0, key);
+						if (ieee->auth_mode != 2)
+						setKey(dev, ipw->u.crypt.idx, ipw->u.crypt.idx, ieee->pairwise_key_type, (u8*)ieee->ap_mac_addr, 0, key);
+					}
+				}
+				else //if (ipw->u.crypt.idx) //group key use idx > 0
+				{
+					memcpy((u8*)key, ipw->u.crypt.key, 16);
+					if (strcmp(ipw->u.crypt.alg, "CCMP") == 0)
+						ieee->group_key_type= KEY_TYPE_CCMP;
+					else if (strcmp(ipw->u.crypt.alg, "TKIP") == 0)
+						ieee->group_key_type = KEY_TYPE_TKIP;
+					else if (strcmp(ipw->u.crypt.alg, "WEP") == 0)
+					{
+						if (ipw->u.crypt.key_len == 13)
+							ieee->group_key_type = KEY_TYPE_WEP104;
+						else if (ipw->u.crypt.key_len == 5)
+							ieee->group_key_type = KEY_TYPE_WEP40;
+					}
+					else
+						ieee->group_key_type = KEY_TYPE_NA;
+
+					if (ieee->group_key_type)
+					{
+							setKey(	dev,
+								ipw->u.crypt.idx,
+								ipw->u.crypt.idx,		//KeyIndex
+						     		ieee->group_key_type,	//KeyType
+						            	broadcast_addr,	//MacAddr
+								0,		//DefaultKey
+							      	key);		//KeyContent
+					}
+				}
+			}
+#ifdef JOHN_HWSEC_DEBUG
+		//john's test 0711
+		printk("@@ wrq->u pointer = ");
+		for(i=0;i<wrq->u.data.length;i++){
+			if(i%10==0) printk("\n");
+			printk( "%8x|", ((u32*)wrq->u.data.pointer)[i] );
+		}
+		printk("\n");
+#endif /*JOHN_HWSEC_DEBUG*/
+		ret = ieee80211_wpa_supplicant_ioctl(priv->ieee80211, &wrq->u.data);
+		break;
+
+	    default:
+		ret = -EOPNOTSUPP;
+		break;
+	}
+	kfree(ipw);
+	ipw = NULL;
+out:
+	up(&priv->wx_sem);
+	return ret;
+}
+
+u8 HwRateToMRate90(bool bIsHT, u8 rate)
+{
+	u8  ret_rate = 0xff;
+
+	if(!bIsHT) {
+		switch(rate) {
+			case DESC90_RATE1M:   ret_rate = MGN_1M;         break;
+			case DESC90_RATE2M:   ret_rate = MGN_2M;         break;
+			case DESC90_RATE5_5M: ret_rate = MGN_5_5M;       break;
+			case DESC90_RATE11M:  ret_rate = MGN_11M;        break;
+			case DESC90_RATE6M:   ret_rate = MGN_6M;         break;
+			case DESC90_RATE9M:   ret_rate = MGN_9M;         break;
+			case DESC90_RATE12M:  ret_rate = MGN_12M;        break;
+			case DESC90_RATE18M:  ret_rate = MGN_18M;        break;
+			case DESC90_RATE24M:  ret_rate = MGN_24M;        break;
+			case DESC90_RATE36M:  ret_rate = MGN_36M;        break;
+			case DESC90_RATE48M:  ret_rate = MGN_48M;        break;
+			case DESC90_RATE54M:  ret_rate = MGN_54M;        break;
+
+			default:
+				ret_rate = 0xff;
+				RT_TRACE(COMP_RECV, "HwRateToMRate90(): Non supported Rate [%x], bIsHT = %d!!!\n", rate, bIsHT);
+				break;
+		}
+
+	} else {
+		switch(rate) {
+			case DESC90_RATEMCS0:   ret_rate = MGN_MCS0;    break;
+			case DESC90_RATEMCS1:   ret_rate = MGN_MCS1;    break;
+			case DESC90_RATEMCS2:   ret_rate = MGN_MCS2;    break;
+			case DESC90_RATEMCS3:   ret_rate = MGN_MCS3;    break;
+			case DESC90_RATEMCS4:   ret_rate = MGN_MCS4;    break;
+			case DESC90_RATEMCS5:   ret_rate = MGN_MCS5;    break;
+			case DESC90_RATEMCS6:   ret_rate = MGN_MCS6;    break;
+			case DESC90_RATEMCS7:   ret_rate = MGN_MCS7;    break;
+			case DESC90_RATEMCS8:   ret_rate = MGN_MCS8;    break;
+			case DESC90_RATEMCS9:   ret_rate = MGN_MCS9;    break;
+			case DESC90_RATEMCS10:  ret_rate = MGN_MCS10;   break;
+			case DESC90_RATEMCS11:  ret_rate = MGN_MCS11;   break;
+			case DESC90_RATEMCS12:  ret_rate = MGN_MCS12;   break;
+			case DESC90_RATEMCS13:  ret_rate = MGN_MCS13;   break;
+			case DESC90_RATEMCS14:  ret_rate = MGN_MCS14;   break;
+			case DESC90_RATEMCS15:  ret_rate = MGN_MCS15;   break;
+			case DESC90_RATEMCS32:  ret_rate = (0x80|0x20); break;
+
+			default:
+				ret_rate = 0xff;
+				RT_TRACE(COMP_RECV, "HwRateToMRate90(): Non supported Rate [%x], bIsHT = %d!!!\n",rate, bIsHT);
+				break;
+		}
+	}
+
+	return ret_rate;
+}
+
+/**
+ * Function:     UpdateRxPktTimeStamp
+ * Overview:     Recored down the TSF time stamp when receiving a packet
+ *
+ * Input:
+ *       PADAPTER        Adapter
+ *       PRT_RFD         pRfd,
+ *
+ * Output:
+ *       PRT_RFD         pRfd
+ *                               (pRfd->Status.TimeStampHigh is updated)
+ *                               (pRfd->Status.TimeStampLow is updated)
+ * Return:
+ *               None
+ */
+void UpdateRxPktTimeStamp8190 (struct net_device *dev, struct ieee80211_rx_stats *stats)
+{
+	struct r8192_priv *priv = (struct r8192_priv *)ieee80211_priv(dev);
+
+	if(stats->bIsAMPDU && !stats->bFirstMPDU) {
+		stats->mac_time[0] = priv->LastRxDescTSFLow;
+		stats->mac_time[1] = priv->LastRxDescTSFHigh;
+	} else {
+		priv->LastRxDescTSFLow = stats->mac_time[0];
+		priv->LastRxDescTSFHigh = stats->mac_time[1];
+	}
+}
+
+//by amy 080606
+
+long rtl819x_translate_todbm(u8 signal_strength_index	)// 0-100 index.
+{
+	long	signal_power; // in dBm.
+
+	// Translate to dBm (x=0.5y-95).
+	signal_power = (long)((signal_strength_index + 1) >> 1);
+	signal_power -= 95;
+
+	return signal_power;
+}
+
+
+/* 2008/01/22 MH We can not delcare RSSI/EVM total value of sliding window to
+    be a local static. Otherwise, it may increase when we return from S3/S4. The
+    value will be kept in memory or disk. We must delcare the value in adapter
+    and it will be reinitialized when return from S3/S4. */
+void rtl8192_process_phyinfo(struct r8192_priv * priv,u8* buffer, struct ieee80211_rx_stats * pprevious_stats, struct ieee80211_rx_stats * pcurrent_stats)
+{
+	bool bcheck = false;
+	u8	rfpath;
+	u32	nspatial_stream, tmp_val;
+	//u8	i;
+	static u32 slide_rssi_index=0, slide_rssi_statistics=0;
+	static u32 slide_evm_index=0, slide_evm_statistics=0;
+	static u32 last_rssi=0, last_evm=0;
+
+	static u32 slide_beacon_adc_pwdb_index=0, slide_beacon_adc_pwdb_statistics=0;
+	static u32 last_beacon_adc_pwdb=0;
+
+	struct ieee80211_hdr_3addr *hdr;
+	u16 sc ;
+	unsigned int frag,seq;
+	hdr = (struct ieee80211_hdr_3addr *)buffer;
+	sc = le16_to_cpu(hdr->seq_ctl);
+	frag = WLAN_GET_SEQ_FRAG(sc);
+	seq = WLAN_GET_SEQ_SEQ(sc);
+	//cosa add 04292008 to record the sequence number
+	pcurrent_stats->Seq_Num = seq;
+	//
+	// Check whether we should take the previous packet into accounting
+	//
+	if(!pprevious_stats->bIsAMPDU)
+	{
+		// if previous packet is not aggregated packet
+		bcheck = true;
+	}else
+	{
+	}
+
+
+	if(slide_rssi_statistics++ >= PHY_RSSI_SLID_WIN_MAX)
+	{
+		slide_rssi_statistics = PHY_RSSI_SLID_WIN_MAX;
+		last_rssi = priv->stats.slide_signal_strength[slide_rssi_index];
+		priv->stats.slide_rssi_total -= last_rssi;
+	}
+	priv->stats.slide_rssi_total += pprevious_stats->SignalStrength;
+
+	priv->stats.slide_signal_strength[slide_rssi_index++] = pprevious_stats->SignalStrength;
+	if(slide_rssi_index >= PHY_RSSI_SLID_WIN_MAX)
+		slide_rssi_index = 0;
+
+	// <1> Showed on UI for user, in dbm
+	tmp_val = priv->stats.slide_rssi_total/slide_rssi_statistics;
+	priv->stats.signal_strength = rtl819x_translate_todbm((u8)tmp_val);
+	pcurrent_stats->rssi = priv->stats.signal_strength;
+	//
+	// If the previous packet does not match the criteria, neglect it
+	//
+	if(!pprevious_stats->bPacketMatchBSSID)
+	{
+		if(!pprevious_stats->bToSelfBA)
+			return;
+	}
+
+	if(!bcheck)
+		return;
+
+
+	//rtl8190_process_cck_rxpathsel(priv,pprevious_stats);//only rtl8190 supported
+
+	//
+	// Check RSSI
+	//
+	priv->stats.num_process_phyinfo++;
+
+	/* record the general signal strength to the sliding window. */
+
+
+	// <2> Showed on UI for engineering
+	// hardware does not provide rssi information for each rf path in CCK
+	if(!pprevious_stats->bIsCCK && (pprevious_stats->bPacketToSelf || pprevious_stats->bToSelfBA))
+	{
+		for (rfpath = RF90_PATH_A; rfpath < priv->NumTotalRFPath; rfpath++)
+		{
+		     if (!rtl8192_phy_CheckIsLegalRFPath(priv->ieee80211->dev, rfpath))
+				 continue;
+
+			//Fixed by Jacken 2008-03-20
+			if(priv->stats.rx_rssi_percentage[rfpath] == 0)
+			{
+				priv->stats.rx_rssi_percentage[rfpath] = pprevious_stats->RxMIMOSignalStrength[rfpath];
+				//DbgPrint("MIMO RSSI initialize \n");
+			}
+			if(pprevious_stats->RxMIMOSignalStrength[rfpath]  > priv->stats.rx_rssi_percentage[rfpath])
+			{
+				priv->stats.rx_rssi_percentage[rfpath] =
+					( (priv->stats.rx_rssi_percentage[rfpath]*(Rx_Smooth_Factor-1)) +
+					(pprevious_stats->RxMIMOSignalStrength[rfpath])) /(Rx_Smooth_Factor);
+				priv->stats.rx_rssi_percentage[rfpath] = priv->stats.rx_rssi_percentage[rfpath]  + 1;
+			}
+			else
+			{
+				priv->stats.rx_rssi_percentage[rfpath] =
+					( (priv->stats.rx_rssi_percentage[rfpath]*(Rx_Smooth_Factor-1)) +
+					(pprevious_stats->RxMIMOSignalStrength[rfpath])) /(Rx_Smooth_Factor);
+			}
+			RT_TRACE(COMP_DBG,"priv->stats.rx_rssi_percentage[rfPath]  = %d \n" ,priv->stats.rx_rssi_percentage[rfpath] );
+		}
+	}
+
+
+	//
+	// Check PWDB.
+	//
+	RT_TRACE(COMP_RXDESC, "Smooth %s PWDB = %d\n",
+				pprevious_stats->bIsCCK? "CCK": "OFDM",
+				pprevious_stats->RxPWDBAll);
+
+	if(pprevious_stats->bPacketBeacon)
+	{
+/* record the beacon pwdb to the sliding window. */
+		if(slide_beacon_adc_pwdb_statistics++ >= PHY_Beacon_RSSI_SLID_WIN_MAX)
+		{
+			slide_beacon_adc_pwdb_statistics = PHY_Beacon_RSSI_SLID_WIN_MAX;
+			last_beacon_adc_pwdb = priv->stats.Slide_Beacon_pwdb[slide_beacon_adc_pwdb_index];
+			priv->stats.Slide_Beacon_Total -= last_beacon_adc_pwdb;
+			//DbgPrint("slide_beacon_adc_pwdb_index = %d, last_beacon_adc_pwdb = %d, Adapter->RxStats.Slide_Beacon_Total = %d\n",
+			//	slide_beacon_adc_pwdb_index, last_beacon_adc_pwdb, Adapter->RxStats.Slide_Beacon_Total);
+		}
+		priv->stats.Slide_Beacon_Total += pprevious_stats->RxPWDBAll;
+		priv->stats.Slide_Beacon_pwdb[slide_beacon_adc_pwdb_index] = pprevious_stats->RxPWDBAll;
+		//DbgPrint("slide_beacon_adc_pwdb_index = %d, pPreviousRfd->Status.RxPWDBAll = %d\n", slide_beacon_adc_pwdb_index, pPreviousRfd->Status.RxPWDBAll);
+		slide_beacon_adc_pwdb_index++;
+		if(slide_beacon_adc_pwdb_index >= PHY_Beacon_RSSI_SLID_WIN_MAX)
+			slide_beacon_adc_pwdb_index = 0;
+		pprevious_stats->RxPWDBAll = priv->stats.Slide_Beacon_Total/slide_beacon_adc_pwdb_statistics;
+		if(pprevious_stats->RxPWDBAll >= 3)
+			pprevious_stats->RxPWDBAll -= 3;
+	}
+
+	RT_TRACE(COMP_RXDESC, "Smooth %s PWDB = %d\n",
+				pprevious_stats->bIsCCK? "CCK": "OFDM",
+				pprevious_stats->RxPWDBAll);
+
+
+	if(pprevious_stats->bPacketToSelf || pprevious_stats->bPacketBeacon || pprevious_stats->bToSelfBA)
+	{
+		if(priv->undecorated_smoothed_pwdb < 0)	// initialize
+		{
+			priv->undecorated_smoothed_pwdb = pprevious_stats->RxPWDBAll;
+			//DbgPrint("First pwdb initialize \n");
+		}
+		if(pprevious_stats->RxPWDBAll > (u32)priv->undecorated_smoothed_pwdb)
+		{
+			priv->undecorated_smoothed_pwdb =
+					( ((priv->undecorated_smoothed_pwdb)*(Rx_Smooth_Factor-1)) +
+					(pprevious_stats->RxPWDBAll)) /(Rx_Smooth_Factor);
+			priv->undecorated_smoothed_pwdb = priv->undecorated_smoothed_pwdb + 1;
+		}
+		else
+		{
+			priv->undecorated_smoothed_pwdb =
+					( ((priv->undecorated_smoothed_pwdb)*(Rx_Smooth_Factor-1)) +
+					(pprevious_stats->RxPWDBAll)) /(Rx_Smooth_Factor);
+		}
+
+	}
+
+	//
+	// Check EVM
+	//
+	/* record the general EVM to the sliding window. */
+	if(pprevious_stats->SignalQuality == 0)
+	{
+	}
+	else
+	{
+		if(pprevious_stats->bPacketToSelf || pprevious_stats->bPacketBeacon || pprevious_stats->bToSelfBA){
+			if(slide_evm_statistics++ >= PHY_RSSI_SLID_WIN_MAX){
+				slide_evm_statistics = PHY_RSSI_SLID_WIN_MAX;
+				last_evm = priv->stats.slide_evm[slide_evm_index];
+				priv->stats.slide_evm_total -= last_evm;
+			}
+
+			priv->stats.slide_evm_total += pprevious_stats->SignalQuality;
+
+			priv->stats.slide_evm[slide_evm_index++] = pprevious_stats->SignalQuality;
+			if(slide_evm_index >= PHY_RSSI_SLID_WIN_MAX)
+				slide_evm_index = 0;
+
+			// <1> Showed on UI for user, in percentage.
+			tmp_val = priv->stats.slide_evm_total/slide_evm_statistics;
+			priv->stats.signal_quality = tmp_val;
+			//cosa add 10/11/2007, Showed on UI for user in Windows Vista, for Link quality.
+			priv->stats.last_signal_strength_inpercent = tmp_val;
+		}
+
+		// <2> Showed on UI for engineering
+		if(pprevious_stats->bPacketToSelf || pprevious_stats->bPacketBeacon || pprevious_stats->bToSelfBA)
+		{
+			for(nspatial_stream = 0; nspatial_stream<2 ; nspatial_stream++) // 2 spatial stream
+			{
+				if(pprevious_stats->RxMIMOSignalQuality[nspatial_stream] != -1)
+				{
+					if(priv->stats.rx_evm_percentage[nspatial_stream] == 0)	// initialize
+					{
+						priv->stats.rx_evm_percentage[nspatial_stream] = pprevious_stats->RxMIMOSignalQuality[nspatial_stream];
+					}
+					priv->stats.rx_evm_percentage[nspatial_stream] =
+						( (priv->stats.rx_evm_percentage[nspatial_stream]* (Rx_Smooth_Factor-1)) +
+						(pprevious_stats->RxMIMOSignalQuality[nspatial_stream]* 1)) / (Rx_Smooth_Factor);
+				}
+			}
+		}
+	}
+
+
+}
+
+/*-----------------------------------------------------------------------------
+ * Function:	rtl819x_query_rxpwrpercentage()
+ *
+ * Overview:
+ *
+ * Input:		char		antpower
+ *
+ * Output:		NONE
+ *
+ * Return:		0-100 percentage
+ *
+ * Revised History:
+ *	When		Who		Remark
+ *	05/26/2008	amy		Create Version 0 porting from windows code.
+ *
+ *---------------------------------------------------------------------------*/
+static u8 rtl819x_query_rxpwrpercentage(
+	char		antpower
+	)
+{
+	if ((antpower <= -100) || (antpower >= 20))
+	{
+		return	0;
+	}
+	else if (antpower >= 0)
+	{
+		return	100;
+	}
+	else
+	{
+		return	(100+antpower);
+	}
+
+}	/* QueryRxPwrPercentage */
+
+static u8
+rtl819x_evm_dbtopercentage(
+    char value
+    )
+{
+    char ret_val;
+
+    ret_val = value;
+
+    if(ret_val >= 0)
+        ret_val = 0;
+    if(ret_val <= -33)
+        ret_val = -33;
+    ret_val = 0 - ret_val;
+    ret_val*=3;
+	if(ret_val == 99)
+		ret_val = 100;
+    return(ret_val);
+}
+//
+//	Description:
+// 	We want good-looking for signal strength/quality
+//	2007/7/19 01:09, by cosa.
+//
+long
+rtl819x_signal_scale_mapping(
+	long currsig
+	)
+{
+	long retsig;
+
+	// Step 1. Scale mapping.
+	if(currsig >= 61 && currsig <= 100)
+	{
+		retsig = 90 + ((currsig - 60) / 4);
+	}
+	else if(currsig >= 41 && currsig <= 60)
+	{
+		retsig = 78 + ((currsig - 40) / 2);
+	}
+	else if(currsig >= 31 && currsig <= 40)
+	{
+		retsig = 66 + (currsig - 30);
+	}
+	else if(currsig >= 21 && currsig <= 30)
+	{
+		retsig = 54 + (currsig - 20);
+	}
+	else if(currsig >= 5 && currsig <= 20)
+	{
+		retsig = 42 + (((currsig - 5) * 2) / 3);
+	}
+	else if(currsig == 4)
+	{
+		retsig = 36;
+	}
+	else if(currsig == 3)
+	{
+		retsig = 27;
+	}
+	else if(currsig == 2)
+	{
+		retsig = 18;
+	}
+	else if(currsig == 1)
+	{
+		retsig = 9;
+	}
+	else
+	{
+		retsig = currsig;
+	}
+
+	return retsig;
+}
+
+static void rtl8192_query_rxphystatus(
+	struct r8192_priv * priv,
+	struct ieee80211_rx_stats * pstats,
+	rx_drvinfo_819x_usb  * pdrvinfo,
+	struct ieee80211_rx_stats * precord_stats,
+	bool bpacket_match_bssid,
+	bool bpacket_toself,
+	bool bPacketBeacon,
+	bool bToSelfBA
+	)
+{
+	//PRT_RFD_STATUS		pRtRfdStatus = &(pRfd->Status);
+	phy_sts_ofdm_819xusb_t*	pofdm_buf;
+	phy_sts_cck_819xusb_t	*	pcck_buf;
+	phy_ofdm_rx_status_rxsc_sgien_exintfflag* prxsc;
+	u8				*prxpkt;
+	u8				i, max_spatial_stream, tmp_rxsnr, tmp_rxevm, rxsc_sgien_exflg;
+	char				rx_pwr[4], rx_pwr_all=0;
+	//long				rx_avg_pwr = 0;
+	char				rx_snrX, rx_evmX;
+	u8				evm, pwdb_all;
+	u32				RSSI, total_rssi=0;//, total_evm=0;
+//	long				signal_strength_index = 0;
+	u8				is_cck_rate=0;
+	u8				rf_rx_num = 0;
+
+
+	priv->stats.numqry_phystatus++;
+
+	is_cck_rate = rx_hal_is_cck_rate(pdrvinfo);
+
+	// Record it for next packet processing
+	memset(precord_stats, 0, sizeof(struct ieee80211_rx_stats));
+	pstats->bPacketMatchBSSID = precord_stats->bPacketMatchBSSID = bpacket_match_bssid;
+	pstats->bPacketToSelf = precord_stats->bPacketToSelf = bpacket_toself;
+	pstats->bIsCCK = precord_stats->bIsCCK = is_cck_rate;//RX_HAL_IS_CCK_RATE(pDrvInfo);
+	pstats->bPacketBeacon = precord_stats->bPacketBeacon = bPacketBeacon;
+	pstats->bToSelfBA = precord_stats->bToSelfBA = bToSelfBA;
+
+	prxpkt = (u8*)pdrvinfo;
+
+	/* Move pointer to the 16th bytes. Phy status start address. */
+	prxpkt += sizeof(rx_drvinfo_819x_usb);
+
+	/* Initial the cck and ofdm buffer pointer */
+	pcck_buf = (phy_sts_cck_819xusb_t *)prxpkt;
+	pofdm_buf = (phy_sts_ofdm_819xusb_t *)prxpkt;
+
+	pstats->RxMIMOSignalQuality[0] = -1;
+	pstats->RxMIMOSignalQuality[1] = -1;
+	precord_stats->RxMIMOSignalQuality[0] = -1;
+	precord_stats->RxMIMOSignalQuality[1] = -1;
+
+	if(is_cck_rate)
+	{
+		//
+		// (1)Hardware does not provide RSSI for CCK
+		//
+
+		//
+		// (2)PWDB, Average PWDB cacluated by hardware (for rate adaptive)
+		//
+		u8 report;//, cck_agc_rpt;
+
+		priv->stats.numqry_phystatusCCK++;
+
+		if(!priv->bCckHighPower)
+		{
+			report = pcck_buf->cck_agc_rpt & 0xc0;
+			report = report>>6;
+			switch(report)
+			{
+				//Fixed by Jacken from Bryant 2008-03-20
+				//Original value is -38 , -26 , -14 , -2
+				//Fixed value is -35 , -23 , -11 , 6
+				case 0x3:
+					rx_pwr_all = -35 - (pcck_buf->cck_agc_rpt & 0x3e);
+					break;
+				case 0x2:
+					rx_pwr_all = -23 - (pcck_buf->cck_agc_rpt & 0x3e);
+					break;
+				case 0x1:
+					rx_pwr_all = -11 - (pcck_buf->cck_agc_rpt & 0x3e);
+					break;
+				case 0x0:
+					rx_pwr_all = 6 - (pcck_buf->cck_agc_rpt & 0x3e);
+					break;
+			}
+		}
+		else
+		{
+			report = pcck_buf->cck_agc_rpt & 0x60;
+			report = report>>5;
+			switch(report)
+			{
+				case 0x3:
+					rx_pwr_all = -35 - ((pcck_buf->cck_agc_rpt & 0x1f)<<1) ;
+					break;
+				case 0x2:
+					rx_pwr_all = -23 - ((pcck_buf->cck_agc_rpt & 0x1f)<<1);
+					break;
+				case 0x1:
+					rx_pwr_all = -11 - ((pcck_buf->cck_agc_rpt & 0x1f)<<1) ;
+					break;
+				case 0x0:
+					rx_pwr_all = 6 - ((pcck_buf->cck_agc_rpt & 0x1f)<<1) ;
+					break;
+			}
+		}
+
+		pwdb_all = rtl819x_query_rxpwrpercentage(rx_pwr_all);
+		pstats->RxPWDBAll = precord_stats->RxPWDBAll = pwdb_all;
+		pstats->RecvSignalPower = pwdb_all;
+
+		//
+		// (3) Get Signal Quality (EVM)
+		//
+		//if(bpacket_match_bssid)
+		{
+			u8	sq;
+
+			if(pstats->RxPWDBAll > 40)
+			{
+				sq = 100;
+			}else
+			{
+				sq = pcck_buf->sq_rpt;
+
+				if(pcck_buf->sq_rpt > 64)
+					sq = 0;
+				else if (pcck_buf->sq_rpt < 20)
+					sq = 100;
+				else
+					sq = ((64-sq) * 100) / 44;
+			}
+			pstats->SignalQuality = precord_stats->SignalQuality = sq;
+			pstats->RxMIMOSignalQuality[0] = precord_stats->RxMIMOSignalQuality[0] = sq;
+			pstats->RxMIMOSignalQuality[1] = precord_stats->RxMIMOSignalQuality[1] = -1;
+		}
+	}
+	else
+	{
+		priv->stats.numqry_phystatusHT++;
+		//
+		// (1)Get RSSI for HT rate
+		//
+		for(i=RF90_PATH_A; i<priv->NumTotalRFPath; i++)
+		{
+			// 2008/01/30 MH we will judge RF RX path now.
+			if (priv->brfpath_rxenable[i])
+				rf_rx_num++;
+			else
+				continue;
+
+		if (!rtl8192_phy_CheckIsLegalRFPath(priv->ieee80211->dev, i))
+				continue;
+
+			//Fixed by Jacken from Bryant 2008-03-20
+			//Original value is 106
+			rx_pwr[i] = ((pofdm_buf->trsw_gain_X[i]&0x3F)*2) - 106;
+
+			//Get Rx snr value in DB
+			tmp_rxsnr =	pofdm_buf->rxsnr_X[i];
+			rx_snrX = (char)(tmp_rxsnr);
+			//rx_snrX >>= 1;;
+			rx_snrX /= 2;
+			priv->stats.rxSNRdB[i] = (long)rx_snrX;
+
+			/* Translate DBM to percentage. */
+			RSSI = rtl819x_query_rxpwrpercentage(rx_pwr[i]);
+			total_rssi += RSSI;
+
+			/* Record Signal Strength for next packet */
+			//if(bpacket_match_bssid)
+			{
+				pstats->RxMIMOSignalStrength[i] =(u8) RSSI;
+				precord_stats->RxMIMOSignalStrength[i] =(u8) RSSI;
+			}
+		}
+
+
+		//
+		// (2)PWDB, Average PWDB cacluated by hardware (for rate adaptive)
+		//
+		//Fixed by Jacken from Bryant 2008-03-20
+		//Original value is 106
+		rx_pwr_all = (((pofdm_buf->pwdb_all ) >> 1 )& 0x7f) -106;
+		pwdb_all = rtl819x_query_rxpwrpercentage(rx_pwr_all);
+
+		pstats->RxPWDBAll = precord_stats->RxPWDBAll = pwdb_all;
+		pstats->RxPower = precord_stats->RxPower =  rx_pwr_all;
+
+		//
+		// (3)EVM of HT rate
+		//
+		if(pdrvinfo->RxHT && pdrvinfo->RxRate>=DESC90_RATEMCS8 &&
+			pdrvinfo->RxRate<=DESC90_RATEMCS15)
+			max_spatial_stream = 2; //both spatial stream make sense
+		else
+			max_spatial_stream = 1; //only spatial stream 1 makes sense
+
+		for(i=0; i<max_spatial_stream; i++)
+		{
+			tmp_rxevm =	pofdm_buf->rxevm_X[i];
+			rx_evmX = (char)(tmp_rxevm);
+
+			// Do not use shift operation like "rx_evmX >>= 1" because the compilor of free build environment
+			// fill most significant bit to "zero" when doing shifting operation which may change a negative
+			// value to positive one, then the dbm value (which is supposed to be negative)  is not correct anymore.
+			rx_evmX /= 2;	//dbm
+
+			evm = rtl819x_evm_dbtopercentage(rx_evmX);
+			//if(bpacket_match_bssid)
+			{
+				if(i==0) // Fill value in RFD, Get the first spatial stream only
+					pstats->SignalQuality = precord_stats->SignalQuality = (u8)(evm & 0xff);
+				pstats->RxMIMOSignalQuality[i] = precord_stats->RxMIMOSignalQuality[i] = (u8)(evm & 0xff);
+			}
+		}
+
+
+		/* record rx statistics for debug */
+		rxsc_sgien_exflg = pofdm_buf->rxsc_sgien_exflg;
+		prxsc =	(phy_ofdm_rx_status_rxsc_sgien_exintfflag *)&rxsc_sgien_exflg;
+		if(pdrvinfo->BW)	//40M channel
+			priv->stats.received_bwtype[1+prxsc->rxsc]++;
+		else				//20M channel
+			priv->stats.received_bwtype[0]++;
+	}
+
+	//UI BSS List signal strength(in percentage), make it good looking, from 0~100.
+	//It is assigned to the BSS List in GetValueFromBeaconOrProbeRsp().
+	if(is_cck_rate)
+	{
+		pstats->SignalStrength = precord_stats->SignalStrength = (u8)(rtl819x_signal_scale_mapping((long)pwdb_all));//PWDB_ALL;
+
+	}
+	else
+	{
+		//pRfd->Status.SignalStrength = pRecordRfd->Status.SignalStrength = (u8)(SignalScaleMapping(total_rssi/=RF90_PATH_MAX));//(u8)(total_rssi/=RF90_PATH_MAX);
+		// We can judge RX path number now.
+		if (rf_rx_num != 0)
+			pstats->SignalStrength = precord_stats->SignalStrength = (u8)(rtl819x_signal_scale_mapping((long)(total_rssi/=rf_rx_num)));
+	}
+}	/* QueryRxPhyStatus8190Pci */
+
+void
+rtl8192_record_rxdesc_forlateruse(
+	struct ieee80211_rx_stats *	psrc_stats,
+	struct ieee80211_rx_stats *	ptarget_stats
+)
+{
+	ptarget_stats->bIsAMPDU = psrc_stats->bIsAMPDU;
+	ptarget_stats->bFirstMPDU = psrc_stats->bFirstMPDU;
+	ptarget_stats->Seq_Num = psrc_stats->Seq_Num;
+}
+
+
+void TranslateRxSignalStuff819xUsb(struct sk_buff *skb,
+				   struct ieee80211_rx_stats * pstats,
+				   rx_drvinfo_819x_usb  *pdrvinfo)
+{
+	// TODO: We must only check packet for current MAC address. Not finish
+	rtl8192_rx_info *info = (struct rtl8192_rx_info *)skb->cb;
+	struct net_device *dev=info->dev;
+	struct r8192_priv *priv = (struct r8192_priv *)ieee80211_priv(dev);
+	bool bpacket_match_bssid, bpacket_toself;
+	bool bPacketBeacon=FALSE, bToSelfBA=FALSE;
+	static struct ieee80211_rx_stats  previous_stats;
+	struct ieee80211_hdr_3addr *hdr;//by amy
+       u16 fc,type;
+
+	// Get Signal Quality for only RX data queue (but not command queue)
+
+	u8* tmp_buf;
+	//u16 tmp_buf_len = 0;
+	u8  *praddr;
+
+	/* Get MAC frame start address. */
+	tmp_buf = (u8*)skb->data;// + get_rxpacket_shiftbytes_819xusb(pstats);
+
+	hdr = (struct ieee80211_hdr_3addr *)tmp_buf;
+	fc = le16_to_cpu(hdr->frame_ctl);
+	type = WLAN_FC_GET_TYPE(fc);
+	praddr = hdr->addr1;
+
+	/* Check if the received packet is acceptabe. */
+	bpacket_match_bssid = ((IEEE80211_FTYPE_CTL != type) &&
+							(eqMacAddr(priv->ieee80211->current_network.bssid,  (fc & IEEE80211_FCTL_TODS)? hdr->addr1 : (fc & IEEE80211_FCTL_FROMDS )? hdr->addr2 : hdr->addr3))
+								 && (!pstats->bHwError) && (!pstats->bCRC)&& (!pstats->bICV));
+	bpacket_toself =  bpacket_match_bssid & (eqMacAddr(praddr, priv->ieee80211->dev->dev_addr));
+
+		if(WLAN_FC_GET_FRAMETYPE(fc)== IEEE80211_STYPE_BEACON)
+		{
+			bPacketBeacon = true;
+			//DbgPrint("Beacon 2, MatchBSSID = %d, ToSelf = %d \n", bPacketMatchBSSID, bPacketToSelf);
+		}
+		if(WLAN_FC_GET_FRAMETYPE(fc) == IEEE80211_STYPE_BLOCKACK)
+		{
+			if((eqMacAddr(praddr,dev->dev_addr)))
+				bToSelfBA = true;
+				//DbgPrint("BlockAck, MatchBSSID = %d, ToSelf = %d \n", bPacketMatchBSSID, bPacketToSelf);
+		}
+
+
+
+	if(bpacket_match_bssid)
+	{
+		priv->stats.numpacket_matchbssid++;
+	}
+	if(bpacket_toself){
+		priv->stats.numpacket_toself++;
+	}
+	//
+	// Process PHY information for previous packet (RSSI/PWDB/EVM)
+	//
+	// Because phy information is contained in the last packet of AMPDU only, so driver
+	// should process phy information of previous packet
+	rtl8192_process_phyinfo(priv, tmp_buf, &previous_stats, pstats);
+	rtl8192_query_rxphystatus(priv, pstats, pdrvinfo, &previous_stats, bpacket_match_bssid,bpacket_toself,bPacketBeacon,bToSelfBA);
+	rtl8192_record_rxdesc_forlateruse(pstats, &previous_stats);
+
+}
+
+/**
+* Function:	UpdateReceivedRateHistogramStatistics
+* Overview:	Recored down the received data rate
+*
+* Input:
+* 	struct net_device *dev
+*	struct ieee80211_rx_stats *stats
+*
+* Output:
+*
+*			(priv->stats.ReceivedRateHistogram[] is updated)
+* Return:
+*		None
+*/
+void
+UpdateReceivedRateHistogramStatistics8190(
+	struct net_device *dev,
+	struct ieee80211_rx_stats *stats
+	)
+{
+	struct r8192_priv *priv = (struct r8192_priv *)ieee80211_priv(dev);
+	u32 rcvType=1;   //0: Total, 1:OK, 2:CRC, 3:ICV
+	u32 rateIndex;
+	u32 preamble_guardinterval;  //1: short preamble/GI, 0: long preamble/GI
+
+
+	if(stats->bCRC)
+	rcvType = 2;
+	else if(stats->bICV)
+	rcvType = 3;
+
+	if(stats->bShortPreamble)
+	preamble_guardinterval = 1;// short
+	else
+	preamble_guardinterval = 0;// long
+
+	switch(stats->rate)
+	{
+		//
+		// CCK rate
+		//
+		case MGN_1M:    rateIndex = 0;  break;
+		case MGN_2M:    rateIndex = 1;  break;
+		case MGN_5_5M:  rateIndex = 2;  break;
+		case MGN_11M:   rateIndex = 3;  break;
+		//
+		// Legacy OFDM rate
+		//
+		case MGN_6M:    rateIndex = 4;  break;
+		case MGN_9M:    rateIndex = 5;  break;
+		case MGN_12M:   rateIndex = 6;  break;
+		case MGN_18M:   rateIndex = 7;  break;
+		case MGN_24M:   rateIndex = 8;  break;
+		case MGN_36M:   rateIndex = 9;  break;
+		case MGN_48M:   rateIndex = 10; break;
+		case MGN_54M:   rateIndex = 11; break;
+		//
+		// 11n High throughput rate
+		//
+		case MGN_MCS0:  rateIndex = 12; break;
+		case MGN_MCS1:  rateIndex = 13; break;
+		case MGN_MCS2:  rateIndex = 14; break;
+		case MGN_MCS3:  rateIndex = 15; break;
+		case MGN_MCS4:  rateIndex = 16; break;
+		case MGN_MCS5:  rateIndex = 17; break;
+		case MGN_MCS6:  rateIndex = 18; break;
+		case MGN_MCS7:  rateIndex = 19; break;
+		case MGN_MCS8:  rateIndex = 20; break;
+		case MGN_MCS9:  rateIndex = 21; break;
+		case MGN_MCS10: rateIndex = 22; break;
+		case MGN_MCS11: rateIndex = 23; break;
+		case MGN_MCS12: rateIndex = 24; break;
+		case MGN_MCS13: rateIndex = 25; break;
+		case MGN_MCS14: rateIndex = 26; break;
+		case MGN_MCS15: rateIndex = 27; break;
+		default:        rateIndex = 28; break;
+	}
+    priv->stats.received_preamble_GI[preamble_guardinterval][rateIndex]++;
+    priv->stats.received_rate_histogram[0][rateIndex]++; //total
+    priv->stats.received_rate_histogram[rcvType][rateIndex]++;
+}
+
+
+void query_rxdesc_status(struct sk_buff *skb, struct ieee80211_rx_stats *stats, bool bIsRxAggrSubframe)
+{
+	rtl8192_rx_info *info = (struct rtl8192_rx_info *)skb->cb;
+	struct net_device *dev=info->dev;
+	struct r8192_priv *priv = (struct r8192_priv *)ieee80211_priv(dev);
+	//rx_desc_819x_usb *desc = (rx_desc_819x_usb *)skb->data;
+	rx_drvinfo_819x_usb  *driver_info = NULL;
+
+	//
+	//Get Rx Descriptor Information
+	//
+#ifdef USB_RX_AGGREGATION_SUPPORT
+	if (bIsRxAggrSubframe)
+	{
+		rx_desc_819x_usb_aggr_subframe *desc = (rx_desc_819x_usb_aggr_subframe *)skb->data;
+		stats->Length = desc->Length ;
+		stats->RxDrvInfoSize = desc->RxDrvInfoSize;
+		stats->RxBufShift = 0; //RxBufShift = 2 in RxDesc, but usb didn't shift bytes in fact.
+		stats->bICV = desc->ICV;
+		stats->bCRC = desc->CRC32;
+		stats->bHwError = stats->bCRC|stats->bICV;
+		stats->Decrypted = !desc->SWDec;//RTL8190 set this bit to indicate that Hw does not decrypt packet
+	} else
+#endif
+	{
+		rx_desc_819x_usb *desc = (rx_desc_819x_usb *)skb->data;
+
+		stats->Length = desc->Length;
+		stats->RxDrvInfoSize = desc->RxDrvInfoSize;
+		stats->RxBufShift = 0;//desc->Shift&0x03;
+		stats->bICV = desc->ICV;
+		stats->bCRC = desc->CRC32;
+		stats->bHwError = stats->bCRC|stats->bICV;
+		//RTL8190 set this bit to indicate that Hw does not decrypt packet
+		stats->Decrypted = !desc->SWDec;
+	}
+
+	if((priv->ieee80211->pHTInfo->bCurrentHTSupport == true) && (priv->ieee80211->pairwise_key_type == KEY_TYPE_CCMP))
+	{
+		stats->bHwError = false;
+	}
+	else
+	{
+		stats->bHwError = stats->bCRC|stats->bICV;
+	}
+
+	if(stats->Length < 24 || stats->Length > MAX_8192U_RX_SIZE)
+		stats->bHwError |= 1;
+	//
+	//Get Driver Info
+	//
+	// TODO: Need to verify it on FGPA platform
+	//Driver info are written to the RxBuffer following rx desc
+	if (stats->RxDrvInfoSize != 0) {
+		driver_info = (rx_drvinfo_819x_usb *)(skb->data + sizeof(rx_desc_819x_usb) + \
+				stats->RxBufShift);
+		/* unit: 0.5M */
+		/* TODO */
+		if(!stats->bHwError){
+			u8	ret_rate;
+			ret_rate = HwRateToMRate90(driver_info->RxHT, driver_info->RxRate);
+			if(ret_rate == 0xff)
+			{
+				// Abnormal Case: Receive CRC OK packet with Rx descriptor indicating non supported rate.
+				// Special Error Handling here, 2008.05.16, by Emily
+
+				stats->bHwError = 1;
+				stats->rate = MGN_1M;	//Set 1M rate by default
+			}else
+			{
+				stats->rate = ret_rate;
+			}
+		}
+		else
+			stats->rate = 0x02;
+
+		stats->bShortPreamble = driver_info->SPLCP;
+
+
+		UpdateReceivedRateHistogramStatistics8190(dev, stats);
+
+		stats->bIsAMPDU = (driver_info->PartAggr==1);
+		stats->bFirstMPDU = (driver_info->PartAggr==1) && (driver_info->FirstAGGR==1);
+		stats->TimeStampLow = driver_info->TSFL;
+		// xiong mask it, 070514
+		//pRfd->Status.TimeStampHigh = PlatformEFIORead4Byte(Adapter, TSFR+4);
+		// stats->TimeStampHigh = read_nic_dword(dev,  TSFR+4);
+
+		UpdateRxPktTimeStamp8190(dev, stats);
+
+		//
+		// Rx A-MPDU
+		//
+		if(driver_info->FirstAGGR==1 || driver_info->PartAggr == 1)
+			RT_TRACE(COMP_RXDESC, "driver_info->FirstAGGR = %d, driver_info->PartAggr = %d\n",
+					driver_info->FirstAGGR, driver_info->PartAggr);
+
+	}
+
+	skb_pull(skb,sizeof(rx_desc_819x_usb));
+	//
+	// Get Total offset of MPDU Frame Body
+	//
+	if((stats->RxBufShift + stats->RxDrvInfoSize) > 0) {
+		stats->bShift = 1;
+		skb_pull(skb,stats->RxBufShift + stats->RxDrvInfoSize);
+	}
+
+#ifdef USB_RX_AGGREGATION_SUPPORT
+	/* for the rx aggregated sub frame, the redundant space truelly contained in the packet */
+	if(bIsRxAggrSubframe) {
+		skb_pull(skb, 8);
+	}
+#endif
+	/* for debug 2008.5.29 */
+
+	//added by vivi, for MP, 20080108
+	stats->RxIs40MHzPacket = driver_info->BW;
+	if(stats->RxDrvInfoSize != 0)
+		TranslateRxSignalStuff819xUsb(skb, stats, driver_info);
+
+}
+
+u32 GetRxPacketShiftBytes819xUsb(struct ieee80211_rx_stats  *Status, bool bIsRxAggrSubframe)
+{
+#ifdef USB_RX_AGGREGATION_SUPPORT
+	if (bIsRxAggrSubframe)
+		return (sizeof(rx_desc_819x_usb) + Status->RxDrvInfoSize
+			+ Status->RxBufShift + 8);
+	else
+#endif
+		return (sizeof(rx_desc_819x_usb) + Status->RxDrvInfoSize
+				+ Status->RxBufShift);
+}
+
+void rtl8192_rx_nomal(struct sk_buff* skb)
+{
+	rtl8192_rx_info *info = (struct rtl8192_rx_info *)skb->cb;
+	struct net_device *dev=info->dev;
+	struct r8192_priv *priv = (struct r8192_priv *)ieee80211_priv(dev);
+	struct ieee80211_rx_stats stats = {
+		.signal = 0,
+		.noise = -98,
+		.rate = 0,
+		//      .mac_time = jiffies,
+		.freq = IEEE80211_24GHZ_BAND,
+	};
+	u32 rx_pkt_len = 0;
+	struct ieee80211_hdr_1addr *ieee80211_hdr = NULL;
+	bool unicast_packet = false;
+#ifdef USB_RX_AGGREGATION_SUPPORT
+	struct sk_buff *agg_skb = NULL;
+	u32  TotalLength = 0;
+	u32  TempDWord = 0;
+	u32  PacketLength = 0;
+	u32  PacketOccupiedLendth = 0;
+	u8   TempByte = 0;
+	u32  PacketShiftBytes = 0;
+	rx_desc_819x_usb_aggr_subframe *RxDescr = NULL;
+	u8  PaddingBytes = 0;
+	//add just for testing
+	u8   testing;
+
+#endif
+
+	/* 20 is for ps-poll */
+	if((skb->len >=(20 + sizeof(rx_desc_819x_usb))) && (skb->len < RX_URB_SIZE)) {
+#ifdef USB_RX_AGGREGATION_SUPPORT
+		TempByte = *(skb->data + sizeof(rx_desc_819x_usb));
+#endif
+		/* first packet should not contain Rx aggregation header */
+		query_rxdesc_status(skb, &stats, false);
+		/* TODO */
+		/* hardware related info */
+#ifdef USB_RX_AGGREGATION_SUPPORT
+		if (TempByte & BIT0) {
+			agg_skb = skb;
+			//TotalLength = agg_skb->len - 4; /*sCrcLng*/
+			TotalLength = stats.Length - 4; /*sCrcLng*/
+			//RT_TRACE(COMP_RECV, "%s:first aggregated packet!Length=%d\n",__FUNCTION__,TotalLength);
+			/* though the head pointer has passed this position  */
+			TempDWord = *(u32 *)(agg_skb->data - 4);
+			PacketLength = (u16)(TempDWord & 0x3FFF); /*sCrcLng*/
+			skb = dev_alloc_skb(PacketLength);
+			memcpy(skb_put(skb,PacketLength),agg_skb->data,PacketLength);
+			PacketShiftBytes = GetRxPacketShiftBytes819xUsb(&stats, false);
+		}
+#endif
+		/* Process the MPDU recevied */
+		skb_trim(skb, skb->len - 4/*sCrcLng*/);
+
+		rx_pkt_len = skb->len;
+		ieee80211_hdr = (struct ieee80211_hdr_1addr *)skb->data;
+		unicast_packet = false;
+		if(is_broadcast_ether_addr(ieee80211_hdr->addr1)) {
+			//TODO
+		}else if(is_multicast_ether_addr(ieee80211_hdr->addr1)){
+			//TODO
+		}else {
+			/* unicast packet */
+			unicast_packet = true;
+		}
+
+		if(!ieee80211_rx(priv->ieee80211,skb, &stats)) {
+			dev_kfree_skb_any(skb);
+		} else {
+			priv->stats.rxoktotal++;
+			if(unicast_packet) {
+				priv->stats.rxbytesunicast += rx_pkt_len;
+			}
+		}
+#ifdef USB_RX_AGGREGATION_SUPPORT
+		testing = 1;
+		// (PipeIndex == 0) && (TempByte & BIT0) => TotalLength > 0.
+		if (TotalLength > 0) {
+			PacketOccupiedLendth = PacketLength + (PacketShiftBytes + 8);
+			if ((PacketOccupiedLendth & 0xFF) != 0)
+				PacketOccupiedLendth = (PacketOccupiedLendth & 0xFFFFFF00) + 256;
+			PacketOccupiedLendth -= 8;
+			TempDWord = PacketOccupiedLendth - PacketShiftBytes; /*- PacketLength */
+			if (agg_skb->len > TempDWord)
+				skb_pull(agg_skb, TempDWord);
+			else
+				agg_skb->len = 0;
+
+			while (agg_skb->len>=GetRxPacketShiftBytes819xUsb(&stats, true)) {
+				u8 tmpCRC = 0, tmpICV = 0;
+				//RT_TRACE(COMP_RECV,"%s:aggred pkt,total_len = %d\n",__FUNCTION__,agg_skb->len);
+				RxDescr = (rx_desc_819x_usb_aggr_subframe *)(agg_skb->data);
+				tmpCRC = RxDescr->CRC32;
+				tmpICV = RxDescr->ICV;
+				memcpy(agg_skb->data, &agg_skb->data[44], 2);
+				RxDescr->CRC32 = tmpCRC;
+				RxDescr->ICV = tmpICV;
+
+				memset(&stats, 0, sizeof(struct ieee80211_rx_stats));
+				stats.signal = 0;
+				stats.noise = -98;
+				stats.rate = 0;
+				stats.freq = IEEE80211_24GHZ_BAND;
+				query_rxdesc_status(agg_skb, &stats, true);
+				PacketLength = stats.Length;
+
+				if(PacketLength > agg_skb->len) {
+					break;
+				}
+				/* Process the MPDU recevied */
+				skb = dev_alloc_skb(PacketLength);
+				memcpy(skb_put(skb,PacketLength),agg_skb->data, PacketLength);
+				skb_trim(skb, skb->len - 4/*sCrcLng*/);
+
+				rx_pkt_len = skb->len;
+				ieee80211_hdr = (struct ieee80211_hdr_1addr *)skb->data;
+				unicast_packet = false;
+				if(is_broadcast_ether_addr(ieee80211_hdr->addr1)) {
+					//TODO
+				}else if(is_multicast_ether_addr(ieee80211_hdr->addr1)){
+					//TODO
+				}else {
+					/* unicast packet */
+					unicast_packet = true;
+				}
+				if(!ieee80211_rx(priv->ieee80211,skb, &stats)) {
+					dev_kfree_skb_any(skb);
+				} else {
+					priv->stats.rxoktotal++;
+					if(unicast_packet) {
+						priv->stats.rxbytesunicast += rx_pkt_len;
+					}
+				}
+				/* should trim the packet which has been copied to target skb */
+				skb_pull(agg_skb, PacketLength);
+				PacketShiftBytes = GetRxPacketShiftBytes819xUsb(&stats, true);
+				PacketOccupiedLendth = PacketLength + PacketShiftBytes;
+				if ((PacketOccupiedLendth & 0xFF) != 0) {
+					PaddingBytes = 256 - (PacketOccupiedLendth & 0xFF);
+					if (agg_skb->len > PaddingBytes)
+						skb_pull(agg_skb, PaddingBytes);
+					else
+						agg_skb->len = 0;
+				}
+			}
+			dev_kfree_skb(agg_skb);
+		}
+#endif
+	} else {
+		priv->stats.rxurberr++;
+		printk("actual_length:%d\n", skb->len);
+		dev_kfree_skb_any(skb);
+	}
+
+}
+
+void
+rtl819xusb_process_received_packet(
+	struct net_device *dev,
+	struct ieee80211_rx_stats *pstats
+	)
+{
+//	bool bfreerfd=false, bqueued=false;
+	u8* 	frame;
+	u16     frame_len=0;
+	struct r8192_priv *priv = ieee80211_priv(dev);
+//	u8			index = 0;
+//	u8			TID = 0;
+	//u16			seqnum = 0;
+	//PRX_TS_RECORD	pts = NULL;
+
+	// Get shifted bytes of Starting address of 802.11 header. 2006.09.28, by Emily
+	//porting by amy 080508
+	pstats->virtual_address += get_rxpacket_shiftbytes_819xusb(pstats);
+	frame = pstats->virtual_address;
+	frame_len = pstats->packetlength;
+#ifdef TODO	// by amy about HCT
+	if(!Adapter->bInHctTest)
+		CountRxErrStatistics(Adapter, pRfd);
+#endif
+	{
+	#ifdef ENABLE_PS  //by amy for adding ps function in future
+		RT_RF_POWER_STATE rtState;
+		// When RF is off, we should not count the packet for hw/sw synchronize
+		// reason, ie. there may be a duration while sw switch is changed and hw
+		// switch is being changed. 2006.12.04, by shien chang.
+		Adapter->HalFunc.GetHwRegHandler(Adapter, HW_VAR_RF_STATE, (u8* )(&rtState));
+		if (rtState == eRfOff)
+		{
+			return;
+		}
+	#endif
+	priv->stats.rxframgment++;
+
+	}
+#ifdef TODO
+	RmMonitorSignalStrength(Adapter, pRfd);
+#endif
+	/* 2007/01/16 MH Add RX command packet handle here. */
+	/* 2007/03/01 MH We have to release RFD and return if rx pkt is cmd pkt. */
+	if (rtl819xusb_rx_command_packet(dev, pstats))
+	{
+		return;
+	}
+
+#ifdef SW_CRC_CHECK
+	SwCrcCheck();
+#endif
+
+
+}
+
+void query_rx_cmdpkt_desc_status(struct sk_buff *skb, struct ieee80211_rx_stats *stats)
+{
+//	rtl8192_rx_info *info = (struct rtl8192_rx_info *)skb->cb;
+//	struct net_device *dev=info->dev;
+//	struct r8192_priv *priv = (struct r8192_priv *)ieee80211_priv(dev);
+	rx_desc_819x_usb *desc = (rx_desc_819x_usb *)skb->data;
+//	rx_drvinfo_819x_usb  *driver_info;
+
+	//
+	//Get Rx Descriptor Information
+	//
+	stats->virtual_address = (u8*)skb->data;
+	stats->Length = desc->Length;
+	stats->RxDrvInfoSize = 0;
+	stats->RxBufShift = 0;
+	stats->packetlength = stats->Length-scrclng;
+	stats->fraglength = stats->packetlength;
+	stats->fragoffset = 0;
+	stats->ntotalfrag = 1;
+}
+
+
+void rtl8192_rx_cmd(struct sk_buff *skb)
+{
+	struct rtl8192_rx_info *info = (struct rtl8192_rx_info *)skb->cb;
+	struct net_device *dev = info->dev;
+	//int ret;
+//	struct urb *rx_urb = info->urb;
+	/* TODO */
+	struct ieee80211_rx_stats stats = {
+		.signal = 0,
+		.noise = -98,
+		.rate = 0,
+		//      .mac_time = jiffies,
+		.freq = IEEE80211_24GHZ_BAND,
+	};
+
+	if((skb->len >=(20 + sizeof(rx_desc_819x_usb))) && (skb->len < RX_URB_SIZE))
+	{
+
+		query_rx_cmdpkt_desc_status(skb,&stats);
+		// this is to be done by amy 080508     prfd->queue_id = 1;
+
+
+		//
+		//  Process the command packet received.
+		//
+
+		rtl819xusb_process_received_packet(dev,&stats);
+
+		dev_kfree_skb_any(skb);
+	}
+	else
+		;
+
+
+}
+
+void rtl8192_irq_rx_tasklet(struct r8192_priv *priv)
+{
+	struct sk_buff *skb;
+	struct rtl8192_rx_info *info;
+
+	while (NULL != (skb = skb_dequeue(&priv->skb_queue))) {
+		info = (struct rtl8192_rx_info *)skb->cb;
+		switch (info->out_pipe) {
+		/* Nomal packet pipe */
+			case 3:
+				//RT_TRACE(COMP_RECV, "normal in-pipe index(%d)\n",info->out_pipe);
+				priv->IrpPendingCount--;
+				rtl8192_rx_nomal(skb);
+				break;
+
+				/* Command packet pipe */
+			case 9:
+				RT_TRACE(COMP_RECV, "command in-pipe index(%d)\n",\
+						info->out_pipe);
+
+				rtl8192_rx_cmd(skb);
+				break;
+
+			default: /* should never get here! */
+				RT_TRACE(COMP_ERR, "Unknown in-pipe index(%d)\n",\
+						info->out_pipe);
+				dev_kfree_skb(skb);
+				break;
+
+		}
+	}
+}
+
+static const struct net_device_ops rtl8192_netdev_ops = {
+	.ndo_open               = rtl8192_open,
+	.ndo_stop               = rtl8192_close,
+	.ndo_get_stats          = rtl8192_stats,
+	.ndo_tx_timeout         = tx_timeout,
+	.ndo_do_ioctl           = rtl8192_ioctl,
+	.ndo_set_multicast_list = r8192_set_multicast,
+	.ndo_set_mac_address    = r8192_set_mac_adr,
+	.ndo_validate_addr      = eth_validate_addr,
+	.ndo_change_mtu         = eth_change_mtu,
+	.ndo_start_xmit         = ieee80211_xmit,
+};
+
+
+/****************************************************************************
+     ---------------------------- USB_STUFF---------------------------
+*****************************************************************************/
+
+static int __devinit rtl8192_usb_probe(struct usb_interface *intf,
+			 const struct usb_device_id *id)
+{
+//	unsigned long ioaddr = 0;
+	struct net_device *dev = NULL;
+	struct r8192_priv *priv= NULL;
+	struct usb_device *udev = interface_to_usbdev(intf);
+	RT_TRACE(COMP_INIT, "Oops: i'm coming\n");
+
+	dev = alloc_ieee80211(sizeof(struct r8192_priv));
+
+
+	usb_set_intfdata(intf, dev);
+	SET_NETDEV_DEV(dev, &intf->dev);
+	priv = ieee80211_priv(dev);
+	priv->ieee80211 = netdev_priv(dev);
+	priv->udev=udev;
+
+	dev->netdev_ops = &rtl8192_netdev_ops;
+
+	 //DMESG("Oops: i'm coming\n");
+#if WIRELESS_EXT >= 12
+#if WIRELESS_EXT < 17
+	dev->get_wireless_stats = r8192_get_wireless_stats;
+#endif
+	dev->wireless_handlers = (struct iw_handler_def *) &r8192_wx_handlers_def;
+#endif
+	dev->type=ARPHRD_ETHER;
+
+	dev->watchdog_timeo = HZ*3;	//modified by john, 0805
+
+	if (dev_alloc_name(dev, ifname) < 0){
+		RT_TRACE(COMP_INIT, "Oops: devname already taken! Trying wlan%%d...\n");
+		ifname = "wlan%d";
+		dev_alloc_name(dev, ifname);
+	}
+
+	RT_TRACE(COMP_INIT, "Driver probe completed1\n");
+	if(rtl8192_init(dev)!=0){
+		RT_TRACE(COMP_ERR, "Initialization failed");
+		goto fail;
+	}
+	netif_carrier_off(dev);
+	netif_stop_queue(dev);
+
+	register_netdev(dev);
+	RT_TRACE(COMP_INIT, "dev name=======> %s\n",dev->name);
+	rtl8192_proc_init_one(dev);
+
+
+	RT_TRACE(COMP_INIT, "Driver probe completed\n");
+	return 0;
+
+
+fail:
+	free_ieee80211(dev);
+
+	RT_TRACE(COMP_ERR, "wlan driver load failed\n");
+	return -ENODEV;
+
+}
+
+//detach all the work and timer structure declared or inititialize in r8192U_init function.
+void rtl8192_cancel_deferred_work(struct r8192_priv* priv)
+{
+
+	cancel_work_sync(&priv->reset_wq);
+	cancel_delayed_work(&priv->watch_dog_wq);
+	cancel_delayed_work(&priv->update_beacon_wq);
+	cancel_work_sync(&priv->qos_activate);
+	//cancel_work_sync(&priv->SetBWModeWorkItem);
+	//cancel_work_sync(&priv->SwChnlWorkItem);
+
+}
+
+
+static void __devexit rtl8192_usb_disconnect(struct usb_interface *intf)
+{
+	struct net_device *dev = usb_get_intfdata(intf);
+
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	if(dev){
+
+		unregister_netdev(dev);
+
+		RT_TRACE(COMP_DOWN, "=============>wlan driver to be removed\n");
+		rtl8192_proc_remove_one(dev);
+
+			rtl8192_down(dev);
+		if (priv->pFirmware)
+		{
+			kfree(priv->pFirmware);
+			priv->pFirmware = NULL;
+		}
+	//	priv->rf_close(dev);
+//		rtl8192_SetRFPowerState(dev, eRfOff);
+		rtl8192_usb_deleteendpoints(dev);
+		destroy_workqueue(priv->priv_wq);
+		//rtl8192_irq_disable(dev);
+		//rtl8192_reset(dev);
+		mdelay(10);
+
+	}
+	free_ieee80211(dev);
+	RT_TRACE(COMP_DOWN, "wlan driver removed\n");
+}
+
+/* fun with the built-in ieee80211 stack... */
+extern int ieee80211_debug_init(void);
+extern void ieee80211_debug_exit(void);
+extern int ieee80211_crypto_init(void);
+extern void ieee80211_crypto_deinit(void);
+extern int ieee80211_crypto_tkip_init(void);
+extern void ieee80211_crypto_tkip_exit(void);
+extern int ieee80211_crypto_ccmp_init(void);
+extern void ieee80211_crypto_ccmp_exit(void);
+extern int ieee80211_crypto_wep_init(void);
+extern void ieee80211_crypto_wep_exit(void);
+
+static int __init rtl8192_usb_module_init(void)
+{
+	int ret;
+
+#ifdef CONFIG_IEEE80211_DEBUG
+	ret = ieee80211_debug_init();
+	if (ret) {
+		printk(KERN_ERR "ieee80211_debug_init() failed %d\n", ret);
+		return ret;
+	}
+#endif
+	ret = ieee80211_crypto_init();
+	if (ret) {
+		printk(KERN_ERR "ieee80211_crypto_init() failed %d\n", ret);
+		return ret;
+	}
+
+	ret = ieee80211_crypto_tkip_init();
+	if (ret) {
+		printk(KERN_ERR "ieee80211_crypto_tkip_init() failed %d\n",
+			ret);
+		return ret;
+	}
+
+	ret = ieee80211_crypto_ccmp_init();
+	if (ret) {
+		printk(KERN_ERR "ieee80211_crypto_ccmp_init() failed %d\n",
+			ret);
+		return ret;
+	}
+
+	ret = ieee80211_crypto_wep_init();
+	if (ret) {
+		printk(KERN_ERR "ieee80211_crypto_wep_init() failed %d\n", ret);
+		return ret;
+	}
+
+	printk(KERN_INFO "\nLinux kernel driver for RTL8192 based WLAN cards\n");
+	printk(KERN_INFO "Copyright (c) 2007-2008, Realsil Wlan\n");
+	RT_TRACE(COMP_INIT, "Initializing module");
+	RT_TRACE(COMP_INIT, "Wireless extensions version %d", WIRELESS_EXT);
+	rtl8192_proc_module_init();
+	return usb_register(&rtl8192_usb_driver);
+}
+
+
+static void __exit rtl8192_usb_module_exit(void)
+{
+	usb_deregister(&rtl8192_usb_driver);
+
+	RT_TRACE(COMP_DOWN, "Exiting");
+//	rtl8192_proc_module_remove();
+}
+
+
+void rtl8192_try_wake_queue(struct net_device *dev, int pri)
+{
+	unsigned long flags;
+	short enough_desc;
+	struct r8192_priv *priv = (struct r8192_priv *)ieee80211_priv(dev);
+
+	spin_lock_irqsave(&priv->tx_lock,flags);
+	enough_desc = check_nic_enough_desc(dev,pri);
+	spin_unlock_irqrestore(&priv->tx_lock,flags);
+
+	if(enough_desc)
+		ieee80211_wake_queue(priv->ieee80211);
+}
+
+void EnableHWSecurityConfig8192(struct net_device *dev)
+{
+	u8 SECR_value = 0x0;
+	struct r8192_priv *priv = (struct r8192_priv *)ieee80211_priv(dev);
+	 struct ieee80211_device* ieee = priv->ieee80211;
+	SECR_value = SCR_TxEncEnable | SCR_RxDecEnable;
+	if (((KEY_TYPE_WEP40 == ieee->pairwise_key_type) || (KEY_TYPE_WEP104 == ieee->pairwise_key_type)) && (priv->ieee80211->auth_mode != 2))
+	{
+		SECR_value |= SCR_RxUseDK;
+		SECR_value |= SCR_TxUseDK;
+	}
+	else if ((ieee->iw_mode == IW_MODE_ADHOC) && (ieee->pairwise_key_type & (KEY_TYPE_CCMP | KEY_TYPE_TKIP)))
+	{
+		SECR_value |= SCR_RxUseDK;
+		SECR_value |= SCR_TxUseDK;
+	}
+	//add HWSec active enable here.
+//default using hwsec. when peer AP is in N mode only and pairwise_key_type is none_aes(which HT_IOT_ACT_PURE_N_MODE indicates it), use software security. when peer AP is in b,g,n mode mixed and pairwise_key_type is none_aes, use g mode hw security. WB on 2008.7.4
+
+	ieee->hwsec_active = 1;
+
+	if ((ieee->pHTInfo->IOTAction&HT_IOT_ACT_PURE_N_MODE) || !hwwep)//!ieee->hwsec_support) //add hwsec_support flag to totol control hw_sec on/off
+	{
+		ieee->hwsec_active = 0;
+		SECR_value &= ~SCR_RxDecEnable;
+	}
+	RT_TRACE(COMP_SEC,"%s:, hwsec:%d, pairwise_key:%d, SECR_value:%x\n", __FUNCTION__, \
+			ieee->hwsec_active, ieee->pairwise_key_type, SECR_value);
+	{
+		write_nic_byte(dev, SECR,  SECR_value);//SECR_value |  SCR_UseDK );
+	}
+}
+
+
+void setKey(	struct net_device *dev,
+		u8 EntryNo,
+		u8 KeyIndex,
+		u16 KeyType,
+		u8 *MacAddr,
+		u8 DefaultKey,
+		u32 *KeyContent )
+{
+	u32 TargetCommand = 0;
+	u32 TargetContent = 0;
+	u16 usConfig = 0;
+	u8 i;
+	if (EntryNo >= TOTAL_CAM_ENTRY)
+		RT_TRACE(COMP_ERR, "cam entry exceeds in setKey()\n");
+
+	RT_TRACE(COMP_SEC, "====>to setKey(), dev:%p, EntryNo:%d, KeyIndex:%d, KeyType:%d, MacAddr"MAC_FMT"\n", dev,EntryNo, KeyIndex, KeyType, MAC_ARG(MacAddr));
+
+	if (DefaultKey)
+		usConfig |= BIT15 | (KeyType<<2);
+	else
+		usConfig |= BIT15 | (KeyType<<2) | KeyIndex;
+//	usConfig |= BIT15 | (KeyType<<2) | (DefaultKey<<5) | KeyIndex;
+
+
+	for(i=0 ; i<CAM_CONTENT_COUNT; i++){
+		TargetCommand  = i+CAM_CONTENT_COUNT*EntryNo;
+		TargetCommand |= BIT31|BIT16;
+
+		if(i==0){//MAC|Config
+			TargetContent = (u32)(*(MacAddr+0)) << 16|
+					(u32)(*(MacAddr+1)) << 24|
+					(u32)usConfig;
+
+			write_nic_dword(dev, WCAMI, TargetContent);
+			write_nic_dword(dev, RWCAM, TargetCommand);
+	//		printk("setkey cam =%8x\n", read_cam(dev, i+6*EntryNo));
+		}
+		else if(i==1){//MAC
+			TargetContent = (u32)(*(MacAddr+2)) 	 |
+					(u32)(*(MacAddr+3)) <<  8|
+					(u32)(*(MacAddr+4)) << 16|
+					(u32)(*(MacAddr+5)) << 24;
+			write_nic_dword(dev, WCAMI, TargetContent);
+			write_nic_dword(dev, RWCAM, TargetCommand);
+		}
+		else {
+			//Key Material
+			if(KeyContent !=NULL){
+			write_nic_dword(dev, WCAMI, (u32)(*(KeyContent+i-2)) );
+			write_nic_dword(dev, RWCAM, TargetCommand);
+		}
+	}
+	}
+
+}
+
+/***************************************************************************
+     ------------------- module init / exit stubs ----------------
+****************************************************************************/
+module_init(rtl8192_usb_module_init);
+module_exit(rtl8192_usb_module_exit);
diff --git a/drivers/staging/rtl8192u/r8192U_dm.c b/drivers/staging/rtl8192u/r8192U_dm.c
new file mode 100644
index 000000000000..2dde9fa5c21e
--- /dev/null
+++ b/drivers/staging/rtl8192u/r8192U_dm.c
@@ -0,0 +1,3890 @@
+/*++
+Copyright-c Realtek Semiconductor Corp. All rights reserved.
+
+Module Name:
+	r8192U_dm.c
+
+Abstract:
+	HW dynamic mechanism.
+
+Major Change History:
+	When      	Who				What
+	----------	--------------- -------------------------------
+	2008-05-14	amy                     create version 0 porting from windows code.
+
+--*/
+#include "r8192U.h"
+#include "r8192U_dm.h"
+#include "r8192U_hw.h"
+#include "r819xU_phy.h"
+#include "r819xU_phyreg.h"
+#include "r8190_rtl8256.h"
+#include "r819xU_cmdpkt.h"
+/*---------------------------Define Local Constant---------------------------*/
+//
+// Indicate different AP vendor for IOT issue.
+//
+static u32 edca_setting_DL[HT_IOT_PEER_MAX] =
+		{ 0x5e4322, 	0x5e4322, 	0x5e4322, 	0x604322, 	0xa44f, 	0x5ea44f};
+static u32 edca_setting_UL[HT_IOT_PEER_MAX] =
+		{ 0x5e4322, 	0xa44f, 	0x5e4322, 	0x604322, 	0x5ea44f, 	0x5ea44f};
+
+
+#define RTK_UL_EDCA 0xa44f
+#define RTK_DL_EDCA 0x5e4322
+/*---------------------------Define Local Constant---------------------------*/
+
+
+/*------------------------Define global variable-----------------------------*/
+// Debug variable ?
+dig_t	dm_digtable;
+// Store current shoftware write register content for MAC PHY.
+u8		dm_shadow[16][256] = {{0}};
+// For Dynamic Rx Path Selection by Signal Strength
+DRxPathSel	DM_RxPathSelTable;
+/*------------------------Define global variable-----------------------------*/
+
+
+/*------------------------Define local variable------------------------------*/
+/*------------------------Define local variable------------------------------*/
+
+
+/*--------------------Define export function prototype-----------------------*/
+extern	void	init_hal_dm(struct net_device *dev);
+extern	void deinit_hal_dm(struct net_device *dev);
+
+extern void hal_dm_watchdog(struct net_device *dev);
+
+
+extern	void	init_rate_adaptive(struct net_device *dev);
+extern	void	dm_txpower_trackingcallback(struct work_struct *work);
+
+extern	void	dm_cck_txpower_adjust(struct net_device *dev,bool  binch14);
+extern	void	dm_restore_dynamic_mechanism_state(struct net_device *dev);
+extern	void	dm_backup_dynamic_mechanism_state(struct net_device *dev);
+extern	void	dm_change_dynamic_initgain_thresh(struct net_device *dev,
+								u32		dm_type,
+								u32		dm_value);
+extern	void	DM_ChangeFsyncSetting(struct net_device *dev,
+												s32		DM_Type,
+												s32		DM_Value);
+extern	void dm_force_tx_fw_info(struct net_device *dev,
+										u32		force_type,
+										u32		force_value);
+extern	void	dm_init_edca_turbo(struct net_device *dev);
+extern	void	dm_rf_operation_test_callback(unsigned long data);
+extern	void	dm_rf_pathcheck_workitemcallback(struct work_struct *work);
+extern	void dm_fsync_timer_callback(unsigned long data);
+extern	void dm_check_fsync(struct net_device *dev);
+extern	void	dm_shadow_init(struct net_device *dev);
+
+
+/*--------------------Define export function prototype-----------------------*/
+
+
+/*---------------------Define local function prototype-----------------------*/
+// DM --> Rate Adaptive
+static	void	dm_check_rate_adaptive(struct net_device *dev);
+
+// DM --> Bandwidth switch
+static	void	dm_init_bandwidth_autoswitch(struct net_device *dev);
+static	void	dm_bandwidth_autoswitch(	struct net_device *dev);
+
+// DM --> TX power control
+//static	void	dm_initialize_txpower_tracking(struct net_device *dev);
+
+static	void	dm_check_txpower_tracking(struct net_device *dev);
+
+
+
+//static	void	dm_txpower_reset_recovery(struct net_device *dev);
+
+
+// DM --> BB init gain restore
+#ifndef RTL8192U
+static	void	dm_bb_initialgain_restore(struct net_device *dev);
+
+
+// DM --> BB init gain backup
+static	void	dm_bb_initialgain_backup(struct net_device *dev);
+#endif
+// DM --> Dynamic Init Gain by RSSI
+static	void	dm_dig_init(struct net_device *dev);
+static	void	dm_ctrl_initgain_byrssi(struct net_device *dev);
+static	void	dm_ctrl_initgain_byrssi_highpwr(struct net_device *dev);
+static	void	dm_ctrl_initgain_byrssi_by_driverrssi(	struct net_device *dev);
+static	void	dm_ctrl_initgain_byrssi_by_fwfalse_alarm(struct net_device *dev);
+static	void	dm_initial_gain(struct net_device *dev);
+static	void	dm_pd_th(struct net_device *dev);
+static	void	dm_cs_ratio(struct net_device *dev);
+
+static	void dm_init_ctstoself(struct net_device *dev);
+// DM --> EDCA turboe mode control
+static	void	dm_check_edca_turbo(struct net_device *dev);
+
+// DM --> HW RF control
+static	void	dm_check_rfctrl_gpio(struct net_device *dev);
+
+#ifndef RTL8190P
+//static	void	dm_gpio_change_rf(struct net_device *dev);
+#endif
+// DM --> Check PBC
+static	void dm_check_pbc_gpio(struct net_device *dev);
+
+
+// DM --> Check current RX RF path state
+static	void	dm_check_rx_path_selection(struct net_device *dev);
+static 	void dm_init_rxpath_selection(struct net_device *dev);
+static	void dm_rxpath_sel_byrssi(struct net_device *dev);
+
+
+// DM --> Fsync for broadcom ap
+static void dm_init_fsync(struct net_device *dev);
+static void dm_deInit_fsync(struct net_device *dev);
+
+//Added by vivi, 20080522
+static	void	dm_check_txrateandretrycount(struct net_device *dev);
+
+/*---------------------Define local function prototype-----------------------*/
+
+/*---------------------Define of Tx Power Control For Near/Far Range --------*/   //Add by Jacken 2008/02/18
+static	void	dm_init_dynamic_txpower(struct net_device *dev);
+static	void	dm_dynamic_txpower(struct net_device *dev);
+
+
+// DM --> For rate adaptive and DIG, we must send RSSI to firmware
+static	void dm_send_rssi_tofw(struct net_device *dev);
+static	void	dm_ctstoself(struct net_device *dev);
+/*---------------------------Define function prototype------------------------*/
+//================================================================================
+//	HW Dynamic mechanism interface.
+//================================================================================
+
+//
+//	Description:
+//		Prepare SW resource for HW dynamic mechanism.
+//
+//	Assumption:
+//		This function is only invoked at driver intialization once.
+//
+//
+extern	void
+init_hal_dm(struct net_device *dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+	// Undecorated Smoothed Signal Strength, it can utilized to dynamic mechanism.
+	priv->undecorated_smoothed_pwdb = -1;
+
+	//Initial TX Power Control for near/far range , add by amy 2008/05/15, porting from windows code.
+	dm_init_dynamic_txpower(dev);
+	init_rate_adaptive(dev);
+	//dm_initialize_txpower_tracking(dev);
+	dm_dig_init(dev);
+	dm_init_edca_turbo(dev);
+	dm_init_bandwidth_autoswitch(dev);
+	dm_init_fsync(dev);
+	dm_init_rxpath_selection(dev);
+	dm_init_ctstoself(dev);
+
+}	// InitHalDm
+
+extern void deinit_hal_dm(struct net_device *dev)
+{
+
+	dm_deInit_fsync(dev);
+
+}
+
+
+#ifdef USB_RX_AGGREGATION_SUPPORT
+void dm_CheckRxAggregation(struct net_device *dev) {
+	struct r8192_priv *priv = ieee80211_priv((struct net_device *)dev);
+	PRT_HIGH_THROUGHPUT	pHTInfo = priv->ieee80211->pHTInfo;
+	static unsigned long	lastTxOkCnt = 0;
+	static unsigned long	lastRxOkCnt = 0;
+	unsigned long		curTxOkCnt = 0;
+	unsigned long		curRxOkCnt = 0;
+
+/*
+	if (pHalData->bForcedUsbRxAggr) {
+		if (pHalData->ForcedUsbRxAggrInfo == 0) {
+			if (pHalData->bCurrentRxAggrEnable) {
+				Adapter->HalFunc.HalUsbRxAggrHandler(Adapter, FALSE);
+			}
+		} else {
+			if (!pHalData->bCurrentRxAggrEnable || (pHalData->ForcedUsbRxAggrInfo != pHalData->LastUsbRxAggrInfoSetting)) {
+				Adapter->HalFunc.HalUsbRxAggrHandler(Adapter, TRUE);
+			}
+		}
+		return;
+	}
+
+*/
+	curTxOkCnt = priv->stats.txbytesunicast - lastTxOkCnt;
+	curRxOkCnt = priv->stats.rxbytesunicast - lastRxOkCnt;
+
+	if((curTxOkCnt + curRxOkCnt) < 15000000) {
+		return;
+	}
+
+	if(curTxOkCnt > 4*curRxOkCnt) {
+		if (priv->bCurrentRxAggrEnable) {
+			write_nic_dword(dev, 0x1a8, 0);
+			priv->bCurrentRxAggrEnable = false;
+		}
+	}else{
+		if (!priv->bCurrentRxAggrEnable && !pHTInfo->bCurrentRT2RTAggregation) {
+			u32 ulValue;
+			ulValue = (pHTInfo->UsbRxFwAggrEn<<24) | (pHTInfo->UsbRxFwAggrPageNum<<16) |
+				(pHTInfo->UsbRxFwAggrPacketNum<<8) | (pHTInfo->UsbRxFwAggrTimeout);
+			/*
+			 * If usb rx firmware aggregation is enabled,
+			 * when anyone of three threshold conditions above is reached,
+			 * firmware will send aggregated packet to driver.
+			 */
+			write_nic_dword(dev, 0x1a8, ulValue);
+			priv->bCurrentRxAggrEnable = true;
+		}
+	}
+
+	lastTxOkCnt = priv->stats.txbytesunicast;
+	lastRxOkCnt = priv->stats.rxbytesunicast;
+}	// dm_CheckEdcaTurbo
+#endif
+
+
+
+extern  void    hal_dm_watchdog(struct net_device *dev)
+{
+	//struct r8192_priv *priv = ieee80211_priv(dev);
+
+	//static u8 	previous_bssid[6] ={0};
+
+	/*Add by amy 2008/05/15 ,porting from windows code.*/
+	dm_check_rate_adaptive(dev);
+	dm_dynamic_txpower(dev);
+	dm_check_txrateandretrycount(dev);
+	dm_check_txpower_tracking(dev);
+	dm_ctrl_initgain_byrssi(dev);
+	dm_check_edca_turbo(dev);
+	dm_bandwidth_autoswitch(dev);
+	dm_check_rfctrl_gpio(dev);
+	dm_check_rx_path_selection(dev);
+	dm_check_fsync(dev);
+
+	// Add by amy 2008-05-15 porting from windows code.
+	dm_check_pbc_gpio(dev);
+	dm_send_rssi_tofw(dev);
+	dm_ctstoself(dev);
+#ifdef USB_RX_AGGREGATION_SUPPORT
+	dm_CheckRxAggregation(dev);
+#endif
+}	//HalDmWatchDog
+
+
+/*
+  * Decide Rate Adaptive Set according to distance (signal strength)
+  *	01/11/2008	MHC		Modify input arguments and RATR table level.
+  *	01/16/2008	MHC		RF_Type is assigned in ReadAdapterInfo(). We must call
+  *						the function after making sure RF_Type.
+  */
+extern void init_rate_adaptive(struct net_device * dev)
+{
+
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	prate_adaptive	pra = (prate_adaptive)&priv->rate_adaptive;
+
+	pra->ratr_state = DM_RATR_STA_MAX;
+	pra->high2low_rssi_thresh_for_ra = RateAdaptiveTH_High;
+	pra->low2high_rssi_thresh_for_ra20M = RateAdaptiveTH_Low_20M+5;
+	pra->low2high_rssi_thresh_for_ra40M = RateAdaptiveTH_Low_40M+5;
+
+	pra->high_rssi_thresh_for_ra = RateAdaptiveTH_High+5;
+	pra->low_rssi_thresh_for_ra20M = RateAdaptiveTH_Low_20M;
+	pra->low_rssi_thresh_for_ra40M = RateAdaptiveTH_Low_40M;
+
+	if(priv->CustomerID == RT_CID_819x_Netcore)
+		pra->ping_rssi_enable = 1;
+	else
+		pra->ping_rssi_enable = 0;
+	pra->ping_rssi_thresh_for_ra = 15;
+
+
+	if (priv->rf_type == RF_2T4R)
+	{
+		// 07/10/08 MH Modify for RA smooth scheme.
+		/* 2008/01/11 MH Modify 2T RATR table for different RSSI. 080515 porting by amy from windows code.*/
+		pra->upper_rssi_threshold_ratr		= 	0x8f0f0000;
+		pra->middle_rssi_threshold_ratr		= 	0x8f0ff000;
+		pra->low_rssi_threshold_ratr		= 	0x8f0ff001;
+		pra->low_rssi_threshold_ratr_40M	= 	0x8f0ff005;
+		pra->low_rssi_threshold_ratr_20M	= 	0x8f0ff001;
+		pra->ping_rssi_ratr	= 	0x0000000d;//cosa add for test
+	}
+	else if (priv->rf_type == RF_1T2R)
+	{
+		pra->upper_rssi_threshold_ratr		= 	0x000f0000;
+		pra->middle_rssi_threshold_ratr		= 	0x000ff000;
+		pra->low_rssi_threshold_ratr		= 	0x000ff001;
+		pra->low_rssi_threshold_ratr_40M	= 	0x000ff005;
+		pra->low_rssi_threshold_ratr_20M	= 	0x000ff001;
+		pra->ping_rssi_ratr	= 	0x0000000d;//cosa add for test
+	}
+
+}	// InitRateAdaptive
+
+
+/*-----------------------------------------------------------------------------
+ * Function:	dm_check_rate_adaptive()
+ *
+ * Overview:
+ *
+ * Input:		NONE
+ *
+ * Output:		NONE
+ *
+ * Return:		NONE
+ *
+ * Revised History:
+ *	When		Who		Remark
+ *	05/26/08	amy 	Create version 0 proting from windows code.
+ *
+ *---------------------------------------------------------------------------*/
+static void dm_check_rate_adaptive(struct net_device * dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	PRT_HIGH_THROUGHPUT	pHTInfo = priv->ieee80211->pHTInfo;
+	prate_adaptive			pra = (prate_adaptive)&priv->rate_adaptive;
+	u32						currentRATR, targetRATR = 0;
+	u32						LowRSSIThreshForRA = 0, HighRSSIThreshForRA = 0;
+	bool						bshort_gi_enabled = false;
+	static u8					ping_rssi_state=0;
+
+
+	if(!priv->up)
+	{
+		RT_TRACE(COMP_RATE, "<---- dm_check_rate_adaptive(): driver is going to unload\n");
+		return;
+	}
+
+	if(pra->rate_adaptive_disabled)//this variable is set by ioctl.
+		return;
+
+	// TODO: Only 11n mode is implemented currently,
+	if( !(priv->ieee80211->mode == WIRELESS_MODE_N_24G ||
+		 priv->ieee80211->mode == WIRELESS_MODE_N_5G))
+		 return;
+
+	if( priv->ieee80211->state == IEEE80211_LINKED )
+	{
+	//	RT_TRACE(COMP_RATE, "dm_CheckRateAdaptive(): \t");
+
+		//
+		// Check whether Short GI is enabled
+		//
+		bshort_gi_enabled = (pHTInfo->bCurTxBW40MHz && pHTInfo->bCurShortGI40MHz) ||
+			(!pHTInfo->bCurTxBW40MHz && pHTInfo->bCurShortGI20MHz);
+
+
+		pra->upper_rssi_threshold_ratr =
+				(pra->upper_rssi_threshold_ratr & (~BIT31)) | ((bshort_gi_enabled)? BIT31:0) ;
+
+		pra->middle_rssi_threshold_ratr =
+				(pra->middle_rssi_threshold_ratr & (~BIT31)) | ((bshort_gi_enabled)? BIT31:0) ;
+
+		if (priv->CurrentChannelBW != HT_CHANNEL_WIDTH_20)
+		{
+			pra->low_rssi_threshold_ratr =
+				(pra->low_rssi_threshold_ratr_40M & (~BIT31)) | ((bshort_gi_enabled)? BIT31:0) ;
+		}
+		else
+		{
+			pra->low_rssi_threshold_ratr =
+			(pra->low_rssi_threshold_ratr_20M & (~BIT31)) | ((bshort_gi_enabled)? BIT31:0) ;
+		}
+		//cosa add for test
+		pra->ping_rssi_ratr =
+				(pra->ping_rssi_ratr & (~BIT31)) | ((bshort_gi_enabled)? BIT31:0) ;
+
+		/* 2007/10/08 MH We support RA smooth scheme now. When it is the first
+		   time to link with AP. We will not change upper/lower threshold. If
+		   STA stay in high or low level, we must change two different threshold
+		   to prevent jumping frequently. */
+		if (pra->ratr_state == DM_RATR_STA_HIGH)
+		{
+			HighRSSIThreshForRA 	= pra->high2low_rssi_thresh_for_ra;
+			LowRSSIThreshForRA	= (priv->CurrentChannelBW != HT_CHANNEL_WIDTH_20)?
+					(pra->low_rssi_thresh_for_ra40M):(pra->low_rssi_thresh_for_ra20M);
+		}
+		else if (pra->ratr_state == DM_RATR_STA_LOW)
+		{
+			HighRSSIThreshForRA	= pra->high_rssi_thresh_for_ra;
+			LowRSSIThreshForRA 	= (priv->CurrentChannelBW != HT_CHANNEL_WIDTH_20)?
+					(pra->low2high_rssi_thresh_for_ra40M):(pra->low2high_rssi_thresh_for_ra20M);
+		}
+		else
+		{
+			HighRSSIThreshForRA	= pra->high_rssi_thresh_for_ra;
+			LowRSSIThreshForRA	= (priv->CurrentChannelBW != HT_CHANNEL_WIDTH_20)?
+					(pra->low_rssi_thresh_for_ra40M):(pra->low_rssi_thresh_for_ra20M);
+		}
+
+		//DbgPrint("[DM] THresh H/L=%d/%d\n\r", RATR.HighRSSIThreshForRA, RATR.LowRSSIThreshForRA);
+		if(priv->undecorated_smoothed_pwdb >= (long)HighRSSIThreshForRA)
+		{
+			//DbgPrint("[DM] RSSI=%d STA=HIGH\n\r", pHalData->UndecoratedSmoothedPWDB);
+			pra->ratr_state = DM_RATR_STA_HIGH;
+			targetRATR = pra->upper_rssi_threshold_ratr;
+		}else if(priv->undecorated_smoothed_pwdb >= (long)LowRSSIThreshForRA)
+		{
+			//DbgPrint("[DM] RSSI=%d STA=Middle\n\r", pHalData->UndecoratedSmoothedPWDB);
+			pra->ratr_state = DM_RATR_STA_MIDDLE;
+			targetRATR = pra->middle_rssi_threshold_ratr;
+		}else
+		{
+			//DbgPrint("[DM] RSSI=%d STA=LOW\n\r", pHalData->UndecoratedSmoothedPWDB);
+			pra->ratr_state = DM_RATR_STA_LOW;
+			targetRATR = pra->low_rssi_threshold_ratr;
+		}
+
+			//cosa add for test
+		if(pra->ping_rssi_enable)
+		{
+			//pHalData->UndecoratedSmoothedPWDB = 19;
+			if(priv->undecorated_smoothed_pwdb < (long)(pra->ping_rssi_thresh_for_ra+5))
+			{
+				if( (priv->undecorated_smoothed_pwdb < (long)pra->ping_rssi_thresh_for_ra) ||
+					ping_rssi_state )
+				{
+					//DbgPrint("TestRSSI = %d, set RATR to 0x%x \n", pHalData->UndecoratedSmoothedPWDB, pRA->TestRSSIRATR);
+					pra->ratr_state = DM_RATR_STA_LOW;
+					targetRATR = pra->ping_rssi_ratr;
+					ping_rssi_state = 1;
+				}
+				//else
+				//	DbgPrint("TestRSSI is between the range. \n");
+			}
+			else
+			{
+				//DbgPrint("TestRSSI Recover to 0x%x \n", targetRATR);
+				ping_rssi_state = 0;
+			}
+		}
+
+		// 2008.04.01
+		// For RTL819X, if pairwisekey = wep/tkip, we support only MCS0~7.
+		if(priv->ieee80211->GetHalfNmodeSupportByAPsHandler(dev))
+			targetRATR &=  0xf00fffff;
+
+		//
+		// Check whether updating of RATR0 is required
+		//
+		currentRATR = read_nic_dword(dev, RATR0);
+		if( targetRATR !=  currentRATR )
+		{
+			u32 ratr_value;
+			ratr_value = targetRATR;
+			RT_TRACE(COMP_RATE,"currentRATR = %x, targetRATR = %x\n", currentRATR, targetRATR);
+			if(priv->rf_type == RF_1T2R)
+			{
+				ratr_value &= ~(RATE_ALL_OFDM_2SS);
+			}
+			write_nic_dword(dev, RATR0, ratr_value);
+			write_nic_byte(dev, UFWP, 1);
+
+			pra->last_ratr = targetRATR;
+		}
+
+	}
+	else
+	{
+		pra->ratr_state = DM_RATR_STA_MAX;
+	}
+
+}	// dm_CheckRateAdaptive
+
+
+static void dm_init_bandwidth_autoswitch(struct net_device * dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+	priv->ieee80211->bandwidth_auto_switch.threshold_20Mhzto40Mhz = BW_AUTO_SWITCH_LOW_HIGH;
+	priv->ieee80211->bandwidth_auto_switch.threshold_40Mhzto20Mhz = BW_AUTO_SWITCH_HIGH_LOW;
+	priv->ieee80211->bandwidth_auto_switch.bforced_tx20Mhz = false;
+	priv->ieee80211->bandwidth_auto_switch.bautoswitch_enable = false;
+
+}	// dm_init_bandwidth_autoswitch
+
+
+static void dm_bandwidth_autoswitch(struct net_device * dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+	if(priv->CurrentChannelBW == HT_CHANNEL_WIDTH_20 ||!priv->ieee80211->bandwidth_auto_switch.bautoswitch_enable){
+		return;
+	}else{
+		if(priv->ieee80211->bandwidth_auto_switch.bforced_tx20Mhz == false){//If send packets in 40 Mhz in 20/40
+			if(priv->undecorated_smoothed_pwdb <= priv->ieee80211->bandwidth_auto_switch.threshold_40Mhzto20Mhz)
+				priv->ieee80211->bandwidth_auto_switch.bforced_tx20Mhz = true;
+		}else{//in force send packets in 20 Mhz in 20/40
+			if(priv->undecorated_smoothed_pwdb >= priv->ieee80211->bandwidth_auto_switch.threshold_20Mhzto40Mhz)
+				priv->ieee80211->bandwidth_auto_switch.bforced_tx20Mhz = false;
+
+		}
+	}
+}	// dm_BandwidthAutoSwitch
+
+//OFDM default at 0db, index=6.
+static u32 OFDMSwingTable[OFDM_Table_Length] = {
+	0x7f8001fe,	// 0, +6db
+	0x71c001c7,	// 1, +5db
+	0x65400195,	// 2, +4db
+	0x5a400169,	// 3, +3db
+	0x50800142,	// 4, +2db
+	0x47c0011f,	// 5, +1db
+	0x40000100,	// 6, +0db ===> default, upper for higher temprature, lower for low temprature
+	0x390000e4,	// 7, -1db
+	0x32c000cb,	// 8, -2db
+	0x2d4000b5,	// 9, -3db
+	0x288000a2,	// 10, -4db
+	0x24000090,	// 11, -5db
+	0x20000080,	// 12, -6db
+	0x1c800072,	// 13, -7db
+	0x19800066,	// 14, -8db
+	0x26c0005b,	// 15, -9db
+	0x24400051,	// 16, -10db
+	0x12000048,	// 17, -11db
+	0x10000040	// 18, -12db
+};
+
+static u8	CCKSwingTable_Ch1_Ch13[CCK_Table_length][8] = {
+	{0x36, 0x35, 0x2e, 0x25, 0x1c, 0x12, 0x09, 0x04},	// 0, +0db ===> CCK40M default
+	{0x30, 0x2f, 0x29, 0x21, 0x19, 0x10, 0x08, 0x03},	// 1, -1db
+	{0x2b, 0x2a, 0x25, 0x1e, 0x16, 0x0e, 0x07, 0x03},	// 2, -2db
+	{0x26, 0x25, 0x21, 0x1b, 0x14, 0x0d, 0x06, 0x03},	// 3, -3db
+	{0x22, 0x21, 0x1d, 0x18, 0x11, 0x0b, 0x06, 0x02},	// 4, -4db
+	{0x1f, 0x1e, 0x1a, 0x15, 0x10, 0x0a, 0x05, 0x02},	// 5, -5db
+	{0x1b, 0x1a, 0x17, 0x13, 0x0e, 0x09, 0x04, 0x02},	// 6, -6db ===> CCK20M default
+	{0x18, 0x17, 0x15, 0x11, 0x0c, 0x08, 0x04, 0x02},	// 7, -7db
+	{0x16, 0x15, 0x12, 0x0f, 0x0b, 0x07, 0x04, 0x01},	// 8, -8db
+	{0x13, 0x13, 0x10, 0x0d, 0x0a, 0x06, 0x03, 0x01},	// 9, -9db
+	{0x11, 0x11, 0x0f, 0x0c, 0x09, 0x06, 0x03, 0x01},	// 10, -10db
+	{0x0f, 0x0f, 0x0d, 0x0b, 0x08, 0x05, 0x03, 0x01}	// 11, -11db
+};
+
+static u8	CCKSwingTable_Ch14[CCK_Table_length][8] = {
+	{0x36, 0x35, 0x2e, 0x1b, 0x00, 0x00, 0x00, 0x00},	// 0, +0db  ===> CCK40M default
+	{0x30, 0x2f, 0x29, 0x18, 0x00, 0x00, 0x00, 0x00},	// 1, -1db
+	{0x2b, 0x2a, 0x25, 0x15, 0x00, 0x00, 0x00, 0x00},	// 2, -2db
+	{0x26, 0x25, 0x21, 0x13, 0x00, 0x00, 0x00, 0x00},	// 3, -3db
+	{0x22, 0x21, 0x1d, 0x11, 0x00, 0x00, 0x00, 0x00},	// 4, -4db
+	{0x1f, 0x1e, 0x1a, 0x0f, 0x00, 0x00, 0x00, 0x00},	// 5, -5db
+	{0x1b, 0x1a, 0x17, 0x0e, 0x00, 0x00, 0x00, 0x00},	// 6, -6db  ===> CCK20M default
+	{0x18, 0x17, 0x15, 0x0c, 0x00, 0x00, 0x00, 0x00},	// 7, -7db
+	{0x16, 0x15, 0x12, 0x0b, 0x00, 0x00, 0x00, 0x00},	// 8, -8db
+	{0x13, 0x13, 0x10, 0x0a, 0x00, 0x00, 0x00, 0x00},	// 9, -9db
+	{0x11, 0x11, 0x0f, 0x09, 0x00, 0x00, 0x00, 0x00},	// 10, -10db
+	{0x0f, 0x0f, 0x0d, 0x08, 0x00, 0x00, 0x00, 0x00}	// 11, -11db
+};
+
+static void dm_TXPowerTrackingCallback_TSSI(struct net_device * dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	bool						bHighpowerstate, viviflag = FALSE;
+	DCMD_TXCMD_T			tx_cmd;
+	u8						powerlevelOFDM24G;
+	int						i =0, j = 0, k = 0;
+	u8						RF_Type, tmp_report[5]={0, 0, 0, 0, 0};
+	u32						Value;
+	u8						Pwr_Flag;
+	u16						Avg_TSSI_Meas, TSSI_13dBm, Avg_TSSI_Meas_from_driver=0;
+	//RT_STATUS 				rtStatus = RT_STATUS_SUCCESS;
+	bool rtStatus = true;
+	u32						delta=0;
+
+	write_nic_byte(dev, 0x1ba, 0);
+
+	priv->ieee80211->bdynamic_txpower_enable = false;
+	bHighpowerstate = priv->bDynamicTxHighPower;
+
+	powerlevelOFDM24G = (u8)(priv->Pwr_Track>>24);
+	RF_Type = priv->rf_type;
+	Value = (RF_Type<<8) | powerlevelOFDM24G;
+
+	RT_TRACE(COMP_POWER_TRACKING, "powerlevelOFDM24G = %x\n", powerlevelOFDM24G);
+
+	for(j = 0; j<=30; j++)
+{	//fill tx_cmd
+
+	tx_cmd.Op		= TXCMD_SET_TX_PWR_TRACKING;
+	tx_cmd.Length	= 4;
+	tx_cmd.Value		= Value;
+#ifdef RTL8192U
+	rtStatus = SendTxCommandPacket(dev, &tx_cmd, 12);
+	if (rtStatus == RT_STATUS_FAILURE)
+	{
+		RT_TRACE(COMP_POWER_TRACKING, "Set configuration with tx cmd queue fail!\n");
+	}
+#else
+	cmpk_message_handle_tx(dev, (u8*)&tx_cmd,
+								DESC_PACKET_TYPE_INIT, sizeof(DCMD_TXCMD_T));
+#endif
+	mdelay(1);
+	//DbgPrint("hi, vivi, strange\n");
+	for(i = 0;i <= 30; i++)
+	{
+		Pwr_Flag = read_nic_byte(dev, 0x1ba);
+
+		if (Pwr_Flag == 0)
+		{
+			mdelay(1);
+			continue;
+		}
+#ifdef RTL8190P
+		Avg_TSSI_Meas = read_nic_word(dev, 0x1bc);
+#else
+		Avg_TSSI_Meas = read_nic_word(dev, 0x13c);
+#endif
+		if(Avg_TSSI_Meas == 0)
+		{
+			write_nic_byte(dev, 0x1ba, 0);
+			break;
+		}
+
+		for(k = 0;k < 5; k++)
+		{
+#ifdef RTL8190P
+			tmp_report[k] = read_nic_byte(dev, 0x1d8+k);
+#else
+			if(k !=4)
+				tmp_report[k] = read_nic_byte(dev, 0x134+k);
+			else
+				tmp_report[k] = read_nic_byte(dev, 0x13e);
+#endif
+			RT_TRACE(COMP_POWER_TRACKING, "TSSI_report_value = %d\n", tmp_report[k]);
+		}
+
+		//check if the report value is right
+		for(k = 0;k < 5; k++)
+		{
+			if(tmp_report[k] <= 20)
+			{
+				viviflag =TRUE;
+				break;
+			}
+		}
+		if(viviflag ==TRUE)
+		{
+			write_nic_byte(dev, 0x1ba, 0);
+			viviflag = FALSE;
+			RT_TRACE(COMP_POWER_TRACKING, "we filted this data\n");
+			for(k = 0;k < 5; k++)
+				tmp_report[k] = 0;
+			break;
+		}
+
+		for(k = 0;k < 5; k++)
+		{
+			Avg_TSSI_Meas_from_driver += tmp_report[k];
+		}
+
+		Avg_TSSI_Meas_from_driver = Avg_TSSI_Meas_from_driver*100/5;
+		RT_TRACE(COMP_POWER_TRACKING, "Avg_TSSI_Meas_from_driver = %d\n", Avg_TSSI_Meas_from_driver);
+		TSSI_13dBm = priv->TSSI_13dBm;
+		RT_TRACE(COMP_POWER_TRACKING, "TSSI_13dBm = %d\n", TSSI_13dBm);
+
+		//if(abs(Avg_TSSI_Meas_from_driver - TSSI_13dBm) <= E_FOR_TX_POWER_TRACK)
+		// For MacOS-compatible
+		if(Avg_TSSI_Meas_from_driver > TSSI_13dBm)
+			delta = Avg_TSSI_Meas_from_driver - TSSI_13dBm;
+		else
+			delta = TSSI_13dBm - Avg_TSSI_Meas_from_driver;
+
+		if(delta <= E_FOR_TX_POWER_TRACK)
+		{
+			priv->ieee80211->bdynamic_txpower_enable = TRUE;
+			write_nic_byte(dev, 0x1ba, 0);
+			RT_TRACE(COMP_POWER_TRACKING, "tx power track is done\n");
+			RT_TRACE(COMP_POWER_TRACKING, "priv->rfa_txpowertrackingindex = %d\n", priv->rfa_txpowertrackingindex);
+			RT_TRACE(COMP_POWER_TRACKING, "priv->rfa_txpowertrackingindex_real = %d\n", priv->rfa_txpowertrackingindex_real);
+#ifdef RTL8190P
+			RT_TRACE(COMP_POWER_TRACKING, "priv->rfc_txpowertrackingindex = %d\n", priv->rfc_txpowertrackingindex);
+			RT_TRACE(COMP_POWER_TRACKING, "priv->rfc_txpowertrackingindex_real = %d\n", priv->rfc_txpowertrackingindex_real);
+#endif
+			RT_TRACE(COMP_POWER_TRACKING, "priv->cck_present_attentuation_difference = %d\n", priv->cck_present_attentuation_difference);
+			RT_TRACE(COMP_POWER_TRACKING, "priv->cck_present_attentuation = %d\n", priv->cck_present_attentuation);
+			return;
+		}
+		else
+		{
+			if(Avg_TSSI_Meas_from_driver < TSSI_13dBm - E_FOR_TX_POWER_TRACK)
+			{
+				if((priv->rfa_txpowertrackingindex > 0)
+#ifdef RTL8190P
+					&&(priv->rfc_txpowertrackingindex > 0)
+#endif
+				)
+				{
+					priv->rfa_txpowertrackingindex--;
+					if(priv->rfa_txpowertrackingindex_real > 4)
+					{
+						priv->rfa_txpowertrackingindex_real--;
+						rtl8192_setBBreg(dev, rOFDM0_XATxIQImbalance, bMaskDWord, priv->txbbgain_table[priv->rfa_txpowertrackingindex_real].txbbgain_value);
+					}
+#ifdef RTL8190P
+					priv->rfc_txpowertrackingindex--;
+					if(priv->rfc_txpowertrackingindex_real > 4)
+					{
+						priv->rfc_txpowertrackingindex_real--;
+						rtl8192_setBBreg(dev, rOFDM0_XCTxIQImbalance, bMaskDWord, priv->txbbgain_table[priv->rfc_txpowertrackingindex_real].txbbgain_value);
+					}
+#endif
+				}
+			}
+			else
+			{
+				if((priv->rfa_txpowertrackingindex < 36)
+#ifdef RTL8190P
+					&&(priv->rfc_txpowertrackingindex < 36)
+#endif
+					)
+				{
+					priv->rfa_txpowertrackingindex++;
+					priv->rfa_txpowertrackingindex_real++;
+					rtl8192_setBBreg(dev, rOFDM0_XATxIQImbalance, bMaskDWord, priv->txbbgain_table[priv->rfa_txpowertrackingindex_real].txbbgain_value);
+
+#ifdef RTL8190P
+					priv->rfc_txpowertrackingindex++;
+					priv->rfc_txpowertrackingindex_real++;
+					rtl8192_setBBreg(dev, rOFDM0_XCTxIQImbalance, bMaskDWord, priv->txbbgain_table[priv->rfc_txpowertrackingindex_real].txbbgain_value);
+#endif
+				}
+			}
+			priv->cck_present_attentuation_difference
+				= priv->rfa_txpowertrackingindex - priv->rfa_txpowertracking_default;
+
+			if(priv->CurrentChannelBW == HT_CHANNEL_WIDTH_20)
+				priv->cck_present_attentuation
+				= priv->cck_present_attentuation_20Mdefault + priv->cck_present_attentuation_difference;
+			else
+				priv->cck_present_attentuation
+				= priv->cck_present_attentuation_40Mdefault + priv->cck_present_attentuation_difference;
+
+			if(priv->cck_present_attentuation > -1&&priv->cck_present_attentuation <23)
+			{
+				if(priv->ieee80211->current_network.channel == 14 && !priv->bcck_in_ch14)
+				{
+					priv->bcck_in_ch14 = TRUE;
+					dm_cck_txpower_adjust(dev,priv->bcck_in_ch14);
+				}
+				else if(priv->ieee80211->current_network.channel != 14 && priv->bcck_in_ch14)
+				{
+					priv->bcck_in_ch14 = FALSE;
+					dm_cck_txpower_adjust(dev,priv->bcck_in_ch14);
+				}
+				else
+					dm_cck_txpower_adjust(dev,priv->bcck_in_ch14);
+			}
+		RT_TRACE(COMP_POWER_TRACKING, "priv->rfa_txpowertrackingindex = %d\n", priv->rfa_txpowertrackingindex);
+		RT_TRACE(COMP_POWER_TRACKING, "priv->rfa_txpowertrackingindex_real = %d\n", priv->rfa_txpowertrackingindex_real);
+#ifdef RTL8190P
+		RT_TRACE(COMP_POWER_TRACKING, "priv->rfc_txpowertrackingindex = %d\n", priv->rfc_txpowertrackingindex);
+		RT_TRACE(COMP_POWER_TRACKING, "priv->rfc_txpowertrackingindex_real = %d\n", priv->rfc_txpowertrackingindex_real);
+#endif
+		RT_TRACE(COMP_POWER_TRACKING, "priv->cck_present_attentuation_difference = %d\n", priv->cck_present_attentuation_difference);
+		RT_TRACE(COMP_POWER_TRACKING, "priv->cck_present_attentuation = %d\n", priv->cck_present_attentuation);
+
+		if (priv->cck_present_attentuation_difference <= -12||priv->cck_present_attentuation_difference >= 24)
+		{
+			priv->ieee80211->bdynamic_txpower_enable = TRUE;
+			write_nic_byte(dev, 0x1ba, 0);
+			RT_TRACE(COMP_POWER_TRACKING, "tx power track--->limited\n");
+			return;
+		}
+
+
+	}
+		write_nic_byte(dev, 0x1ba, 0);
+		Avg_TSSI_Meas_from_driver = 0;
+		for(k = 0;k < 5; k++)
+			tmp_report[k] = 0;
+		break;
+	}
+}
+		priv->ieee80211->bdynamic_txpower_enable = TRUE;
+		write_nic_byte(dev, 0x1ba, 0);
+}
+
+static void dm_TXPowerTrackingCallback_ThermalMeter(struct net_device * dev)
+{
+#define ThermalMeterVal	9
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	u32 tmpRegA, TempCCk;
+	u8 tmpOFDMindex, tmpCCKindex, tmpCCK20Mindex, tmpCCK40Mindex, tmpval;
+	int i =0, CCKSwingNeedUpdate=0;
+
+	if(!priv->btxpower_trackingInit)
+	{
+		//Query OFDM default setting
+		tmpRegA= rtl8192_QueryBBReg(dev, rOFDM0_XATxIQImbalance, bMaskDWord);
+		for(i=0; i<OFDM_Table_Length; i++)	//find the index
+		{
+			if(tmpRegA == OFDMSwingTable[i])
+			{
+				priv->OFDM_index= (u8)i;
+				RT_TRACE(COMP_POWER_TRACKING, "Initial reg0x%x = 0x%x, OFDM_index=0x%x\n",
+					rOFDM0_XATxIQImbalance, tmpRegA, priv->OFDM_index);
+			}
+		}
+
+		//Query CCK default setting From 0xa22
+		TempCCk = rtl8192_QueryBBReg(dev, rCCK0_TxFilter1, bMaskByte2);
+		for(i=0 ; i<CCK_Table_length ; i++)
+		{
+			if(TempCCk == (u32)CCKSwingTable_Ch1_Ch13[i][0])
+			{
+				priv->CCK_index =(u8) i;
+				RT_TRACE(COMP_POWER_TRACKING, "Initial reg0x%x = 0x%x, CCK_index=0x%x\n",
+					rCCK0_TxFilter1, TempCCk, priv->CCK_index);
+				break;
+			}
+		}
+		priv->btxpower_trackingInit = TRUE;
+		//pHalData->TXPowercount = 0;
+		return;
+	}
+
+	//==========================
+	// this is only for test, should be masked
+	//==========================
+
+	// read and filter out unreasonable value
+	tmpRegA = rtl8192_phy_QueryRFReg(dev, RF90_PATH_A, 0x12, 0x078);	// 0x12: RF Reg[10:7]
+	RT_TRACE(COMP_POWER_TRACKING, "Readback ThermalMeterA = %d \n", tmpRegA);
+	if(tmpRegA < 3 || tmpRegA > 13)
+		return;
+	if(tmpRegA >= 12)	// if over 12, TP will be bad when high temprature
+		tmpRegA = 12;
+	RT_TRACE(COMP_POWER_TRACKING, "Valid ThermalMeterA = %d \n", tmpRegA);
+	priv->ThermalMeter[0] = ThermalMeterVal;	//We use fixed value by Bryant's suggestion
+	priv->ThermalMeter[1] = ThermalMeterVal;	//We use fixed value by Bryant's suggestion
+
+	//Get current RF-A temprature index
+	if(priv->ThermalMeter[0] >= (u8)tmpRegA)	//lower temprature
+	{
+		tmpOFDMindex = tmpCCK20Mindex = 6+(priv->ThermalMeter[0]-(u8)tmpRegA);
+		tmpCCK40Mindex = tmpCCK20Mindex - 6;
+		if(tmpOFDMindex >= OFDM_Table_Length)
+			tmpOFDMindex = OFDM_Table_Length-1;
+		if(tmpCCK20Mindex >= CCK_Table_length)
+			tmpCCK20Mindex = CCK_Table_length-1;
+		if(tmpCCK40Mindex >= CCK_Table_length)
+			tmpCCK40Mindex = CCK_Table_length-1;
+	}
+	else
+	{
+		tmpval = ((u8)tmpRegA - priv->ThermalMeter[0]);
+		if(tmpval >= 6)								// higher temprature
+			tmpOFDMindex = tmpCCK20Mindex = 0;		// max to +6dB
+		else
+			tmpOFDMindex = tmpCCK20Mindex = 6 - tmpval;
+		tmpCCK40Mindex = 0;
+	}
+	//DbgPrint("%ddb, tmpOFDMindex = %d, tmpCCK20Mindex = %d, tmpCCK40Mindex = %d",
+		//((u1Byte)tmpRegA - pHalData->ThermalMeter[0]),
+		//tmpOFDMindex, tmpCCK20Mindex, tmpCCK40Mindex);
+	if(priv->CurrentChannelBW != HT_CHANNEL_WIDTH_20)	//40M
+		tmpCCKindex = tmpCCK40Mindex;
+	else
+		tmpCCKindex = tmpCCK20Mindex;
+
+	if(priv->ieee80211->current_network.channel == 14 && !priv->bcck_in_ch14)
+	{
+		priv->bcck_in_ch14 = TRUE;
+		CCKSwingNeedUpdate = 1;
+	}
+	else if(priv->ieee80211->current_network.channel != 14 && priv->bcck_in_ch14)
+	{
+		priv->bcck_in_ch14 = FALSE;
+		CCKSwingNeedUpdate = 1;
+	}
+
+	if(priv->CCK_index != tmpCCKindex)
+	{
+		priv->CCK_index = tmpCCKindex;
+		CCKSwingNeedUpdate = 1;
+	}
+
+	if(CCKSwingNeedUpdate)
+	{
+		//DbgPrint("Update CCK Swing, CCK_index = %d\n", pHalData->CCK_index);
+		dm_cck_txpower_adjust(dev, priv->bcck_in_ch14);
+	}
+	if(priv->OFDM_index != tmpOFDMindex)
+	{
+		priv->OFDM_index = tmpOFDMindex;
+		rtl8192_setBBreg(dev, rOFDM0_XATxIQImbalance, bMaskDWord, OFDMSwingTable[priv->OFDM_index]);
+		RT_TRACE(COMP_POWER_TRACKING, "Update OFDMSwing[%d] = 0x%x\n",
+			priv->OFDM_index, OFDMSwingTable[priv->OFDM_index]);
+	}
+	priv->txpower_count = 0;
+}
+
+extern	void	dm_txpower_trackingcallback(struct work_struct *work)
+{
+	struct delayed_work *dwork = container_of(work,struct delayed_work,work);
+       struct r8192_priv *priv = container_of(dwork,struct r8192_priv,txpower_tracking_wq);
+       struct net_device *dev = priv->ieee80211->dev;
+
+#ifdef RTL8190P
+	dm_TXPowerTrackingCallback_TSSI(dev);
+#else
+	if(priv->bDcut == TRUE)
+		dm_TXPowerTrackingCallback_TSSI(dev);
+	else
+		dm_TXPowerTrackingCallback_ThermalMeter(dev);
+#endif
+}
+
+
+static void dm_InitializeTXPowerTracking_TSSI(struct net_device *dev)
+{
+
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+	//Initial the Tx BB index and mapping value
+	priv->txbbgain_table[0].txbb_iq_amplifygain = 			12;
+	priv->txbbgain_table[0].txbbgain_value=0x7f8001fe;
+	priv->txbbgain_table[1].txbb_iq_amplifygain = 			11;
+	priv->txbbgain_table[1].txbbgain_value=0x788001e2;
+	priv->txbbgain_table[2].txbb_iq_amplifygain = 			10;
+	priv->txbbgain_table[2].txbbgain_value=0x71c001c7;
+	priv->txbbgain_table[3].txbb_iq_amplifygain = 			9;
+	priv->txbbgain_table[3].txbbgain_value=0x6b8001ae;
+	priv->txbbgain_table[4].txbb_iq_amplifygain = 		       8;
+	priv->txbbgain_table[4].txbbgain_value=0x65400195;
+	priv->txbbgain_table[5].txbb_iq_amplifygain = 		       7;
+	priv->txbbgain_table[5].txbbgain_value=0x5fc0017f;
+	priv->txbbgain_table[6].txbb_iq_amplifygain = 		       6;
+	priv->txbbgain_table[6].txbbgain_value=0x5a400169;
+	priv->txbbgain_table[7].txbb_iq_amplifygain = 		       5;
+	priv->txbbgain_table[7].txbbgain_value=0x55400155;
+	priv->txbbgain_table[8].txbb_iq_amplifygain = 		       4;
+	priv->txbbgain_table[8].txbbgain_value=0x50800142;
+	priv->txbbgain_table[9].txbb_iq_amplifygain = 		       3;
+	priv->txbbgain_table[9].txbbgain_value=0x4c000130;
+	priv->txbbgain_table[10].txbb_iq_amplifygain = 		       2;
+	priv->txbbgain_table[10].txbbgain_value=0x47c0011f;
+	priv->txbbgain_table[11].txbb_iq_amplifygain = 		       1;
+	priv->txbbgain_table[11].txbbgain_value=0x43c0010f;
+	priv->txbbgain_table[12].txbb_iq_amplifygain = 		       0;
+	priv->txbbgain_table[12].txbbgain_value=0x40000100;
+	priv->txbbgain_table[13].txbb_iq_amplifygain = 		       -1;
+	priv->txbbgain_table[13].txbbgain_value=0x3c8000f2;
+	priv->txbbgain_table[14].txbb_iq_amplifygain = 		     -2;
+	priv->txbbgain_table[14].txbbgain_value=0x390000e4;
+	priv->txbbgain_table[15].txbb_iq_amplifygain = 		     -3;
+	priv->txbbgain_table[15].txbbgain_value=0x35c000d7;
+	priv->txbbgain_table[16].txbb_iq_amplifygain = 		     -4;
+	priv->txbbgain_table[16].txbbgain_value=0x32c000cb;
+	priv->txbbgain_table[17].txbb_iq_amplifygain = 		     -5;
+	priv->txbbgain_table[17].txbbgain_value=0x300000c0;
+	priv->txbbgain_table[18].txbb_iq_amplifygain = 			    -6;
+	priv->txbbgain_table[18].txbbgain_value=0x2d4000b5;
+	priv->txbbgain_table[19].txbb_iq_amplifygain = 		     -7;
+	priv->txbbgain_table[19].txbbgain_value=0x2ac000ab;
+	priv->txbbgain_table[20].txbb_iq_amplifygain = 		     -8;
+	priv->txbbgain_table[20].txbbgain_value=0x288000a2;
+	priv->txbbgain_table[21].txbb_iq_amplifygain = 		     -9;
+	priv->txbbgain_table[21].txbbgain_value=0x26000098;
+	priv->txbbgain_table[22].txbb_iq_amplifygain = 		     -10;
+	priv->txbbgain_table[22].txbbgain_value=0x24000090;
+	priv->txbbgain_table[23].txbb_iq_amplifygain = 		     -11;
+	priv->txbbgain_table[23].txbbgain_value=0x22000088;
+	priv->txbbgain_table[24].txbb_iq_amplifygain = 		     -12;
+	priv->txbbgain_table[24].txbbgain_value=0x20000080;
+	priv->txbbgain_table[25].txbb_iq_amplifygain = 		     -13;
+	priv->txbbgain_table[25].txbbgain_value=0x1a00006c;
+	priv->txbbgain_table[26].txbb_iq_amplifygain = 		     -14;
+	priv->txbbgain_table[26].txbbgain_value=0x1c800072;
+	priv->txbbgain_table[27].txbb_iq_amplifygain = 		     -15;
+	priv->txbbgain_table[27].txbbgain_value=0x18000060;
+	priv->txbbgain_table[28].txbb_iq_amplifygain = 		     -16;
+	priv->txbbgain_table[28].txbbgain_value=0x19800066;
+	priv->txbbgain_table[29].txbb_iq_amplifygain = 		     -17;
+	priv->txbbgain_table[29].txbbgain_value=0x15800056;
+	priv->txbbgain_table[30].txbb_iq_amplifygain = 		     -18;
+	priv->txbbgain_table[30].txbbgain_value=0x26c0005b;
+	priv->txbbgain_table[31].txbb_iq_amplifygain = 		     -19;
+	priv->txbbgain_table[31].txbbgain_value=0x14400051;
+	priv->txbbgain_table[32].txbb_iq_amplifygain = 		     -20;
+	priv->txbbgain_table[32].txbbgain_value=0x24400051;
+	priv->txbbgain_table[33].txbb_iq_amplifygain = 		     -21;
+	priv->txbbgain_table[33].txbbgain_value=0x1300004c;
+	priv->txbbgain_table[34].txbb_iq_amplifygain = 		     -22;
+	priv->txbbgain_table[34].txbbgain_value=0x12000048;
+	priv->txbbgain_table[35].txbb_iq_amplifygain = 		     -23;
+	priv->txbbgain_table[35].txbbgain_value=0x11000044;
+	priv->txbbgain_table[36].txbb_iq_amplifygain = 		     -24;
+	priv->txbbgain_table[36].txbbgain_value=0x10000040;
+
+	//ccktxbb_valuearray[0] is 0xA22 [1] is 0xA24 ...[7] is 0xA29
+	//This Table is for CH1~CH13
+	priv->cck_txbbgain_table[0].ccktxbb_valuearray[0] = 0x36;
+	priv->cck_txbbgain_table[0].ccktxbb_valuearray[1] = 0x35;
+	priv->cck_txbbgain_table[0].ccktxbb_valuearray[2] = 0x2e;
+	priv->cck_txbbgain_table[0].ccktxbb_valuearray[3] = 0x25;
+	priv->cck_txbbgain_table[0].ccktxbb_valuearray[4] = 0x1c;
+	priv->cck_txbbgain_table[0].ccktxbb_valuearray[5] = 0x12;
+	priv->cck_txbbgain_table[0].ccktxbb_valuearray[6] = 0x09;
+	priv->cck_txbbgain_table[0].ccktxbb_valuearray[7] = 0x04;
+
+	priv->cck_txbbgain_table[1].ccktxbb_valuearray[0] = 0x33;
+	priv->cck_txbbgain_table[1].ccktxbb_valuearray[1] = 0x32;
+	priv->cck_txbbgain_table[1].ccktxbb_valuearray[2] = 0x2b;
+	priv->cck_txbbgain_table[1].ccktxbb_valuearray[3] = 0x23;
+	priv->cck_txbbgain_table[1].ccktxbb_valuearray[4] = 0x1a;
+	priv->cck_txbbgain_table[1].ccktxbb_valuearray[5] = 0x11;
+	priv->cck_txbbgain_table[1].ccktxbb_valuearray[6] = 0x08;
+	priv->cck_txbbgain_table[1].ccktxbb_valuearray[7] = 0x04;
+
+	priv->cck_txbbgain_table[2].ccktxbb_valuearray[0] = 0x30;
+	priv->cck_txbbgain_table[2].ccktxbb_valuearray[1] = 0x2f;
+	priv->cck_txbbgain_table[2].ccktxbb_valuearray[2] = 0x29;
+	priv->cck_txbbgain_table[2].ccktxbb_valuearray[3] = 0x21;
+	priv->cck_txbbgain_table[2].ccktxbb_valuearray[4] = 0x19;
+	priv->cck_txbbgain_table[2].ccktxbb_valuearray[5] = 0x10;
+	priv->cck_txbbgain_table[2].ccktxbb_valuearray[6] = 0x08;
+	priv->cck_txbbgain_table[2].ccktxbb_valuearray[7] = 0x03;
+
+	priv->cck_txbbgain_table[3].ccktxbb_valuearray[0] = 0x2d;
+	priv->cck_txbbgain_table[3].ccktxbb_valuearray[1] = 0x2d;
+	priv->cck_txbbgain_table[3].ccktxbb_valuearray[2] = 0x27;
+	priv->cck_txbbgain_table[3].ccktxbb_valuearray[3] = 0x1f;
+	priv->cck_txbbgain_table[3].ccktxbb_valuearray[4] = 0x18;
+	priv->cck_txbbgain_table[3].ccktxbb_valuearray[5] = 0x0f;
+	priv->cck_txbbgain_table[3].ccktxbb_valuearray[6] = 0x08;
+	priv->cck_txbbgain_table[3].ccktxbb_valuearray[7] = 0x03;
+
+	priv->cck_txbbgain_table[4].ccktxbb_valuearray[0] = 0x2b;
+	priv->cck_txbbgain_table[4].ccktxbb_valuearray[1] = 0x2a;
+	priv->cck_txbbgain_table[4].ccktxbb_valuearray[2] = 0x25;
+	priv->cck_txbbgain_table[4].ccktxbb_valuearray[3] = 0x1e;
+	priv->cck_txbbgain_table[4].ccktxbb_valuearray[4] = 0x16;
+	priv->cck_txbbgain_table[4].ccktxbb_valuearray[5] = 0x0e;
+	priv->cck_txbbgain_table[4].ccktxbb_valuearray[6] = 0x07;
+	priv->cck_txbbgain_table[4].ccktxbb_valuearray[7] = 0x03;
+
+	priv->cck_txbbgain_table[5].ccktxbb_valuearray[0] = 0x28;
+	priv->cck_txbbgain_table[5].ccktxbb_valuearray[1] = 0x28;
+	priv->cck_txbbgain_table[5].ccktxbb_valuearray[2] = 0x22;
+	priv->cck_txbbgain_table[5].ccktxbb_valuearray[3] = 0x1c;
+	priv->cck_txbbgain_table[5].ccktxbb_valuearray[4] = 0x15;
+	priv->cck_txbbgain_table[5].ccktxbb_valuearray[5] = 0x0d;
+	priv->cck_txbbgain_table[5].ccktxbb_valuearray[6] = 0x07;
+	priv->cck_txbbgain_table[5].ccktxbb_valuearray[7] = 0x03;
+
+	priv->cck_txbbgain_table[6].ccktxbb_valuearray[0] = 0x26;
+	priv->cck_txbbgain_table[6].ccktxbb_valuearray[1] = 0x25;
+	priv->cck_txbbgain_table[6].ccktxbb_valuearray[2] = 0x21;
+	priv->cck_txbbgain_table[6].ccktxbb_valuearray[3] = 0x1b;
+	priv->cck_txbbgain_table[6].ccktxbb_valuearray[4] = 0x14;
+	priv->cck_txbbgain_table[6].ccktxbb_valuearray[5] = 0x0d;
+	priv->cck_txbbgain_table[6].ccktxbb_valuearray[6] = 0x06;
+	priv->cck_txbbgain_table[6].ccktxbb_valuearray[7] = 0x03;
+
+	priv->cck_txbbgain_table[7].ccktxbb_valuearray[0] = 0x24;
+	priv->cck_txbbgain_table[7].ccktxbb_valuearray[1] = 0x23;
+	priv->cck_txbbgain_table[7].ccktxbb_valuearray[2] = 0x1f;
+	priv->cck_txbbgain_table[7].ccktxbb_valuearray[3] = 0x19;
+	priv->cck_txbbgain_table[7].ccktxbb_valuearray[4] = 0x13;
+	priv->cck_txbbgain_table[7].ccktxbb_valuearray[5] = 0x0c;
+	priv->cck_txbbgain_table[7].ccktxbb_valuearray[6] = 0x06;
+	priv->cck_txbbgain_table[7].ccktxbb_valuearray[7] = 0x03;
+
+	priv->cck_txbbgain_table[8].ccktxbb_valuearray[0] = 0x22;
+	priv->cck_txbbgain_table[8].ccktxbb_valuearray[1] = 0x21;
+	priv->cck_txbbgain_table[8].ccktxbb_valuearray[2] = 0x1d;
+	priv->cck_txbbgain_table[8].ccktxbb_valuearray[3] = 0x18;
+	priv->cck_txbbgain_table[8].ccktxbb_valuearray[4] = 0x11;
+	priv->cck_txbbgain_table[8].ccktxbb_valuearray[5] = 0x0b;
+	priv->cck_txbbgain_table[8].ccktxbb_valuearray[6] = 0x06;
+	priv->cck_txbbgain_table[8].ccktxbb_valuearray[7] = 0x02;
+
+	priv->cck_txbbgain_table[9].ccktxbb_valuearray[0] = 0x20;
+	priv->cck_txbbgain_table[9].ccktxbb_valuearray[1] = 0x20;
+	priv->cck_txbbgain_table[9].ccktxbb_valuearray[2] = 0x1b;
+	priv->cck_txbbgain_table[9].ccktxbb_valuearray[3] = 0x16;
+	priv->cck_txbbgain_table[9].ccktxbb_valuearray[4] = 0x11;
+	priv->cck_txbbgain_table[9].ccktxbb_valuearray[5] = 0x08;
+	priv->cck_txbbgain_table[9].ccktxbb_valuearray[6] = 0x05;
+	priv->cck_txbbgain_table[9].ccktxbb_valuearray[7] = 0x02;
+
+	priv->cck_txbbgain_table[10].ccktxbb_valuearray[0] = 0x1f;
+	priv->cck_txbbgain_table[10].ccktxbb_valuearray[1] = 0x1e;
+	priv->cck_txbbgain_table[10].ccktxbb_valuearray[2] = 0x1a;
+	priv->cck_txbbgain_table[10].ccktxbb_valuearray[3] = 0x15;
+	priv->cck_txbbgain_table[10].ccktxbb_valuearray[4] = 0x10;
+	priv->cck_txbbgain_table[10].ccktxbb_valuearray[5] = 0x0a;
+	priv->cck_txbbgain_table[10].ccktxbb_valuearray[6] = 0x05;
+	priv->cck_txbbgain_table[10].ccktxbb_valuearray[7] = 0x02;
+
+	priv->cck_txbbgain_table[11].ccktxbb_valuearray[0] = 0x1d;
+	priv->cck_txbbgain_table[11].ccktxbb_valuearray[1] = 0x1c;
+	priv->cck_txbbgain_table[11].ccktxbb_valuearray[2] = 0x18;
+	priv->cck_txbbgain_table[11].ccktxbb_valuearray[3] = 0x14;
+	priv->cck_txbbgain_table[11].ccktxbb_valuearray[4] = 0x0f;
+	priv->cck_txbbgain_table[11].ccktxbb_valuearray[5] = 0x0a;
+	priv->cck_txbbgain_table[11].ccktxbb_valuearray[6] = 0x05;
+	priv->cck_txbbgain_table[11].ccktxbb_valuearray[7] = 0x02;
+
+	priv->cck_txbbgain_table[12].ccktxbb_valuearray[0] = 0x1b;
+	priv->cck_txbbgain_table[12].ccktxbb_valuearray[1] = 0x1a;
+	priv->cck_txbbgain_table[12].ccktxbb_valuearray[2] = 0x17;
+	priv->cck_txbbgain_table[12].ccktxbb_valuearray[3] = 0x13;
+	priv->cck_txbbgain_table[12].ccktxbb_valuearray[4] = 0x0e;
+	priv->cck_txbbgain_table[12].ccktxbb_valuearray[5] = 0x09;
+	priv->cck_txbbgain_table[12].ccktxbb_valuearray[6] = 0x04;
+	priv->cck_txbbgain_table[12].ccktxbb_valuearray[7] = 0x02;
+
+	priv->cck_txbbgain_table[13].ccktxbb_valuearray[0] = 0x1a;
+	priv->cck_txbbgain_table[13].ccktxbb_valuearray[1] = 0x19;
+	priv->cck_txbbgain_table[13].ccktxbb_valuearray[2] = 0x16;
+	priv->cck_txbbgain_table[13].ccktxbb_valuearray[3] = 0x12;
+	priv->cck_txbbgain_table[13].ccktxbb_valuearray[4] = 0x0d;
+	priv->cck_txbbgain_table[13].ccktxbb_valuearray[5] = 0x09;
+	priv->cck_txbbgain_table[13].ccktxbb_valuearray[6] = 0x04;
+	priv->cck_txbbgain_table[13].ccktxbb_valuearray[7] = 0x02;
+
+	priv->cck_txbbgain_table[14].ccktxbb_valuearray[0] = 0x18;
+	priv->cck_txbbgain_table[14].ccktxbb_valuearray[1] = 0x17;
+	priv->cck_txbbgain_table[14].ccktxbb_valuearray[2] = 0x15;
+	priv->cck_txbbgain_table[14].ccktxbb_valuearray[3] = 0x11;
+	priv->cck_txbbgain_table[14].ccktxbb_valuearray[4] = 0x0c;
+	priv->cck_txbbgain_table[14].ccktxbb_valuearray[5] = 0x08;
+	priv->cck_txbbgain_table[14].ccktxbb_valuearray[6] = 0x04;
+	priv->cck_txbbgain_table[14].ccktxbb_valuearray[7] = 0x02;
+
+	priv->cck_txbbgain_table[15].ccktxbb_valuearray[0] = 0x17;
+	priv->cck_txbbgain_table[15].ccktxbb_valuearray[1] = 0x16;
+	priv->cck_txbbgain_table[15].ccktxbb_valuearray[2] = 0x13;
+	priv->cck_txbbgain_table[15].ccktxbb_valuearray[3] = 0x10;
+	priv->cck_txbbgain_table[15].ccktxbb_valuearray[4] = 0x0c;
+	priv->cck_txbbgain_table[15].ccktxbb_valuearray[5] = 0x08;
+	priv->cck_txbbgain_table[15].ccktxbb_valuearray[6] = 0x04;
+	priv->cck_txbbgain_table[15].ccktxbb_valuearray[7] = 0x02;
+
+	priv->cck_txbbgain_table[16].ccktxbb_valuearray[0] = 0x16;
+	priv->cck_txbbgain_table[16].ccktxbb_valuearray[1] = 0x15;
+	priv->cck_txbbgain_table[16].ccktxbb_valuearray[2] = 0x12;
+	priv->cck_txbbgain_table[16].ccktxbb_valuearray[3] = 0x0f;
+	priv->cck_txbbgain_table[16].ccktxbb_valuearray[4] = 0x0b;
+	priv->cck_txbbgain_table[16].ccktxbb_valuearray[5] = 0x07;
+	priv->cck_txbbgain_table[16].ccktxbb_valuearray[6] = 0x04;
+	priv->cck_txbbgain_table[16].ccktxbb_valuearray[7] = 0x01;
+
+	priv->cck_txbbgain_table[17].ccktxbb_valuearray[0] = 0x14;
+	priv->cck_txbbgain_table[17].ccktxbb_valuearray[1] = 0x14;
+	priv->cck_txbbgain_table[17].ccktxbb_valuearray[2] = 0x11;
+	priv->cck_txbbgain_table[17].ccktxbb_valuearray[3] = 0x0e;
+	priv->cck_txbbgain_table[17].ccktxbb_valuearray[4] = 0x0b;
+	priv->cck_txbbgain_table[17].ccktxbb_valuearray[5] = 0x07;
+	priv->cck_txbbgain_table[17].ccktxbb_valuearray[6] = 0x03;
+	priv->cck_txbbgain_table[17].ccktxbb_valuearray[7] = 0x02;
+
+	priv->cck_txbbgain_table[18].ccktxbb_valuearray[0] = 0x13;
+	priv->cck_txbbgain_table[18].ccktxbb_valuearray[1] = 0x13;
+	priv->cck_txbbgain_table[18].ccktxbb_valuearray[2] = 0x10;
+	priv->cck_txbbgain_table[18].ccktxbb_valuearray[3] = 0x0d;
+	priv->cck_txbbgain_table[18].ccktxbb_valuearray[4] = 0x0a;
+	priv->cck_txbbgain_table[18].ccktxbb_valuearray[5] = 0x06;
+	priv->cck_txbbgain_table[18].ccktxbb_valuearray[6] = 0x03;
+	priv->cck_txbbgain_table[18].ccktxbb_valuearray[7] = 0x01;
+
+	priv->cck_txbbgain_table[19].ccktxbb_valuearray[0] = 0x12;
+	priv->cck_txbbgain_table[19].ccktxbb_valuearray[1] = 0x12;
+	priv->cck_txbbgain_table[19].ccktxbb_valuearray[2] = 0x0f;
+	priv->cck_txbbgain_table[19].ccktxbb_valuearray[3] = 0x0c;
+	priv->cck_txbbgain_table[19].ccktxbb_valuearray[4] = 0x09;
+	priv->cck_txbbgain_table[19].ccktxbb_valuearray[5] = 0x06;
+	priv->cck_txbbgain_table[19].ccktxbb_valuearray[6] = 0x03;
+	priv->cck_txbbgain_table[19].ccktxbb_valuearray[7] = 0x01;
+
+	priv->cck_txbbgain_table[20].ccktxbb_valuearray[0] = 0x11;
+	priv->cck_txbbgain_table[20].ccktxbb_valuearray[1] = 0x11;
+	priv->cck_txbbgain_table[20].ccktxbb_valuearray[2] = 0x0f;
+	priv->cck_txbbgain_table[20].ccktxbb_valuearray[3] = 0x0c;
+	priv->cck_txbbgain_table[20].ccktxbb_valuearray[4] = 0x09;
+	priv->cck_txbbgain_table[20].ccktxbb_valuearray[5] = 0x06;
+	priv->cck_txbbgain_table[20].ccktxbb_valuearray[6] = 0x03;
+	priv->cck_txbbgain_table[20].ccktxbb_valuearray[7] = 0x01;
+
+	priv->cck_txbbgain_table[21].ccktxbb_valuearray[0] = 0x10;
+	priv->cck_txbbgain_table[21].ccktxbb_valuearray[1] = 0x10;
+	priv->cck_txbbgain_table[21].ccktxbb_valuearray[2] = 0x0e;
+	priv->cck_txbbgain_table[21].ccktxbb_valuearray[3] = 0x0b;
+	priv->cck_txbbgain_table[21].ccktxbb_valuearray[4] = 0x08;
+	priv->cck_txbbgain_table[21].ccktxbb_valuearray[5] = 0x05;
+	priv->cck_txbbgain_table[21].ccktxbb_valuearray[6] = 0x03;
+	priv->cck_txbbgain_table[21].ccktxbb_valuearray[7] = 0x01;
+
+	priv->cck_txbbgain_table[22].ccktxbb_valuearray[0] = 0x0f;
+	priv->cck_txbbgain_table[22].ccktxbb_valuearray[1] = 0x0f;
+	priv->cck_txbbgain_table[22].ccktxbb_valuearray[2] = 0x0d;
+	priv->cck_txbbgain_table[22].ccktxbb_valuearray[3] = 0x0b;
+	priv->cck_txbbgain_table[22].ccktxbb_valuearray[4] = 0x08;
+	priv->cck_txbbgain_table[22].ccktxbb_valuearray[5] = 0x05;
+	priv->cck_txbbgain_table[22].ccktxbb_valuearray[6] = 0x03;
+	priv->cck_txbbgain_table[22].ccktxbb_valuearray[7] = 0x01;
+
+	//ccktxbb_valuearray[0] is 0xA22 [1] is 0xA24 ...[7] is 0xA29
+	//This Table is for CH14
+	priv->cck_txbbgain_ch14_table[0].ccktxbb_valuearray[0] = 0x36;
+	priv->cck_txbbgain_ch14_table[0].ccktxbb_valuearray[1] = 0x35;
+	priv->cck_txbbgain_ch14_table[0].ccktxbb_valuearray[2] = 0x2e;
+	priv->cck_txbbgain_ch14_table[0].ccktxbb_valuearray[3] = 0x1b;
+	priv->cck_txbbgain_ch14_table[0].ccktxbb_valuearray[4] = 0x00;
+	priv->cck_txbbgain_ch14_table[0].ccktxbb_valuearray[5] = 0x00;
+	priv->cck_txbbgain_ch14_table[0].ccktxbb_valuearray[6] = 0x00;
+	priv->cck_txbbgain_ch14_table[0].ccktxbb_valuearray[7] = 0x00;
+
+	priv->cck_txbbgain_ch14_table[1].ccktxbb_valuearray[0] = 0x33;
+	priv->cck_txbbgain_ch14_table[1].ccktxbb_valuearray[1] = 0x32;
+	priv->cck_txbbgain_ch14_table[1].ccktxbb_valuearray[2] = 0x2b;
+	priv->cck_txbbgain_ch14_table[1].ccktxbb_valuearray[3] = 0x19;
+	priv->cck_txbbgain_ch14_table[1].ccktxbb_valuearray[4] = 0x00;
+	priv->cck_txbbgain_ch14_table[1].ccktxbb_valuearray[5] = 0x00;
+	priv->cck_txbbgain_ch14_table[1].ccktxbb_valuearray[6] = 0x00;
+	priv->cck_txbbgain_ch14_table[1].ccktxbb_valuearray[7] = 0x00;
+
+	priv->cck_txbbgain_ch14_table[2].ccktxbb_valuearray[0] = 0x30;
+	priv->cck_txbbgain_ch14_table[2].ccktxbb_valuearray[1] = 0x2f;
+	priv->cck_txbbgain_ch14_table[2].ccktxbb_valuearray[2] = 0x29;
+	priv->cck_txbbgain_ch14_table[2].ccktxbb_valuearray[3] = 0x18;
+	priv->cck_txbbgain_ch14_table[2].ccktxbb_valuearray[4] = 0x00;
+	priv->cck_txbbgain_ch14_table[2].ccktxbb_valuearray[5] = 0x00;
+	priv->cck_txbbgain_ch14_table[2].ccktxbb_valuearray[6] = 0x00;
+	priv->cck_txbbgain_ch14_table[2].ccktxbb_valuearray[7] = 0x00;
+
+	priv->cck_txbbgain_ch14_table[3].ccktxbb_valuearray[0] = 0x2d;
+	priv->cck_txbbgain_ch14_table[3].ccktxbb_valuearray[1] = 0x2d;
+	priv->cck_txbbgain_ch14_table[3].ccktxbb_valuearray[2] = 0x27;
+	priv->cck_txbbgain_ch14_table[3].ccktxbb_valuearray[3] = 0x17;
+	priv->cck_txbbgain_ch14_table[3].ccktxbb_valuearray[4] = 0x00;
+	priv->cck_txbbgain_ch14_table[3].ccktxbb_valuearray[5] = 0x00;
+	priv->cck_txbbgain_ch14_table[3].ccktxbb_valuearray[6] = 0x00;
+	priv->cck_txbbgain_ch14_table[3].ccktxbb_valuearray[7] = 0x00;
+
+	priv->cck_txbbgain_ch14_table[4].ccktxbb_valuearray[0] = 0x2b;
+	priv->cck_txbbgain_ch14_table[4].ccktxbb_valuearray[1] = 0x2a;
+	priv->cck_txbbgain_ch14_table[4].ccktxbb_valuearray[2] = 0x25;
+	priv->cck_txbbgain_ch14_table[4].ccktxbb_valuearray[3] = 0x15;
+	priv->cck_txbbgain_ch14_table[4].ccktxbb_valuearray[4] = 0x00;
+	priv->cck_txbbgain_ch14_table[4].ccktxbb_valuearray[5] = 0x00;
+	priv->cck_txbbgain_ch14_table[4].ccktxbb_valuearray[6] = 0x00;
+	priv->cck_txbbgain_ch14_table[4].ccktxbb_valuearray[7] = 0x00;
+
+	priv->cck_txbbgain_ch14_table[5].ccktxbb_valuearray[0] = 0x28;
+	priv->cck_txbbgain_ch14_table[5].ccktxbb_valuearray[1] = 0x28;
+	priv->cck_txbbgain_ch14_table[5].ccktxbb_valuearray[2] = 0x22;
+	priv->cck_txbbgain_ch14_table[5].ccktxbb_valuearray[3] = 0x14;
+	priv->cck_txbbgain_ch14_table[5].ccktxbb_valuearray[4] = 0x00;
+	priv->cck_txbbgain_ch14_table[5].ccktxbb_valuearray[5] = 0x00;
+	priv->cck_txbbgain_ch14_table[5].ccktxbb_valuearray[6] = 0x00;
+	priv->cck_txbbgain_ch14_table[5].ccktxbb_valuearray[7] = 0x00;
+
+	priv->cck_txbbgain_ch14_table[6].ccktxbb_valuearray[0] = 0x26;
+	priv->cck_txbbgain_ch14_table[6].ccktxbb_valuearray[1] = 0x25;
+	priv->cck_txbbgain_ch14_table[6].ccktxbb_valuearray[2] = 0x21;
+	priv->cck_txbbgain_ch14_table[6].ccktxbb_valuearray[3] = 0x13;
+	priv->cck_txbbgain_ch14_table[6].ccktxbb_valuearray[4] = 0x00;
+	priv->cck_txbbgain_ch14_table[6].ccktxbb_valuearray[5] = 0x00;
+	priv->cck_txbbgain_ch14_table[6].ccktxbb_valuearray[6] = 0x00;
+	priv->cck_txbbgain_ch14_table[6].ccktxbb_valuearray[7] = 0x00;
+
+	priv->cck_txbbgain_ch14_table[7].ccktxbb_valuearray[0] = 0x24;
+	priv->cck_txbbgain_ch14_table[7].ccktxbb_valuearray[1] = 0x23;
+	priv->cck_txbbgain_ch14_table[7].ccktxbb_valuearray[2] = 0x1f;
+	priv->cck_txbbgain_ch14_table[7].ccktxbb_valuearray[3] = 0x12;
+	priv->cck_txbbgain_ch14_table[7].ccktxbb_valuearray[4] = 0x00;
+	priv->cck_txbbgain_ch14_table[7].ccktxbb_valuearray[5] = 0x00;
+	priv->cck_txbbgain_ch14_table[7].ccktxbb_valuearray[6] = 0x00;
+	priv->cck_txbbgain_ch14_table[7].ccktxbb_valuearray[7] = 0x00;
+
+	priv->cck_txbbgain_ch14_table[8].ccktxbb_valuearray[0] = 0x22;
+	priv->cck_txbbgain_ch14_table[8].ccktxbb_valuearray[1] = 0x21;
+	priv->cck_txbbgain_ch14_table[8].ccktxbb_valuearray[2] = 0x1d;
+	priv->cck_txbbgain_ch14_table[8].ccktxbb_valuearray[3] = 0x11;
+	priv->cck_txbbgain_ch14_table[8].ccktxbb_valuearray[4] = 0x00;
+	priv->cck_txbbgain_ch14_table[8].ccktxbb_valuearray[5] = 0x00;
+	priv->cck_txbbgain_ch14_table[8].ccktxbb_valuearray[6] = 0x00;
+	priv->cck_txbbgain_ch14_table[8].ccktxbb_valuearray[7] = 0x00;
+
+	priv->cck_txbbgain_ch14_table[9].ccktxbb_valuearray[0] = 0x20;
+	priv->cck_txbbgain_ch14_table[9].ccktxbb_valuearray[1] = 0x20;
+	priv->cck_txbbgain_ch14_table[9].ccktxbb_valuearray[2] = 0x1b;
+	priv->cck_txbbgain_ch14_table[9].ccktxbb_valuearray[3] = 0x10;
+	priv->cck_txbbgain_ch14_table[9].ccktxbb_valuearray[4] = 0x00;
+	priv->cck_txbbgain_ch14_table[9].ccktxbb_valuearray[5] = 0x00;
+	priv->cck_txbbgain_ch14_table[9].ccktxbb_valuearray[6] = 0x00;
+	priv->cck_txbbgain_ch14_table[9].ccktxbb_valuearray[7] = 0x00;
+
+	priv->cck_txbbgain_ch14_table[10].ccktxbb_valuearray[0] = 0x1f;
+	priv->cck_txbbgain_ch14_table[10].ccktxbb_valuearray[1] = 0x1e;
+	priv->cck_txbbgain_ch14_table[10].ccktxbb_valuearray[2] = 0x1a;
+	priv->cck_txbbgain_ch14_table[10].ccktxbb_valuearray[3] = 0x0f;
+	priv->cck_txbbgain_ch14_table[10].ccktxbb_valuearray[4] = 0x00;
+	priv->cck_txbbgain_ch14_table[10].ccktxbb_valuearray[5] = 0x00;
+	priv->cck_txbbgain_ch14_table[10].ccktxbb_valuearray[6] = 0x00;
+	priv->cck_txbbgain_ch14_table[10].ccktxbb_valuearray[7] = 0x00;
+
+	priv->cck_txbbgain_ch14_table[11].ccktxbb_valuearray[0] = 0x1d;
+	priv->cck_txbbgain_ch14_table[11].ccktxbb_valuearray[1] = 0x1c;
+	priv->cck_txbbgain_ch14_table[11].ccktxbb_valuearray[2] = 0x18;
+	priv->cck_txbbgain_ch14_table[11].ccktxbb_valuearray[3] = 0x0e;
+	priv->cck_txbbgain_ch14_table[11].ccktxbb_valuearray[4] = 0x00;
+	priv->cck_txbbgain_ch14_table[11].ccktxbb_valuearray[5] = 0x00;
+	priv->cck_txbbgain_ch14_table[11].ccktxbb_valuearray[6] = 0x00;
+	priv->cck_txbbgain_ch14_table[11].ccktxbb_valuearray[7] = 0x00;
+
+	priv->cck_txbbgain_ch14_table[12].ccktxbb_valuearray[0] = 0x1b;
+	priv->cck_txbbgain_ch14_table[12].ccktxbb_valuearray[1] = 0x1a;
+	priv->cck_txbbgain_ch14_table[12].ccktxbb_valuearray[2] = 0x17;
+	priv->cck_txbbgain_ch14_table[12].ccktxbb_valuearray[3] = 0x0e;
+	priv->cck_txbbgain_ch14_table[12].ccktxbb_valuearray[4] = 0x00;
+	priv->cck_txbbgain_ch14_table[12].ccktxbb_valuearray[5] = 0x00;
+	priv->cck_txbbgain_ch14_table[12].ccktxbb_valuearray[6] = 0x00;
+	priv->cck_txbbgain_ch14_table[12].ccktxbb_valuearray[7] = 0x00;
+
+	priv->cck_txbbgain_ch14_table[13].ccktxbb_valuearray[0] = 0x1a;
+	priv->cck_txbbgain_ch14_table[13].ccktxbb_valuearray[1] = 0x19;
+	priv->cck_txbbgain_ch14_table[13].ccktxbb_valuearray[2] = 0x16;
+	priv->cck_txbbgain_ch14_table[13].ccktxbb_valuearray[3] = 0x0d;
+	priv->cck_txbbgain_ch14_table[13].ccktxbb_valuearray[4] = 0x00;
+	priv->cck_txbbgain_ch14_table[13].ccktxbb_valuearray[5] = 0x00;
+	priv->cck_txbbgain_ch14_table[13].ccktxbb_valuearray[6] = 0x00;
+	priv->cck_txbbgain_ch14_table[13].ccktxbb_valuearray[7] = 0x00;
+
+	priv->cck_txbbgain_ch14_table[14].ccktxbb_valuearray[0] = 0x18;
+	priv->cck_txbbgain_ch14_table[14].ccktxbb_valuearray[1] = 0x17;
+	priv->cck_txbbgain_ch14_table[14].ccktxbb_valuearray[2] = 0x15;
+	priv->cck_txbbgain_ch14_table[14].ccktxbb_valuearray[3] = 0x0c;
+	priv->cck_txbbgain_ch14_table[14].ccktxbb_valuearray[4] = 0x00;
+	priv->cck_txbbgain_ch14_table[14].ccktxbb_valuearray[5] = 0x00;
+	priv->cck_txbbgain_ch14_table[14].ccktxbb_valuearray[6] = 0x00;
+	priv->cck_txbbgain_ch14_table[14].ccktxbb_valuearray[7] = 0x00;
+
+	priv->cck_txbbgain_ch14_table[15].ccktxbb_valuearray[0] = 0x17;
+	priv->cck_txbbgain_ch14_table[15].ccktxbb_valuearray[1] = 0x16;
+	priv->cck_txbbgain_ch14_table[15].ccktxbb_valuearray[2] = 0x13;
+	priv->cck_txbbgain_ch14_table[15].ccktxbb_valuearray[3] = 0x0b;
+	priv->cck_txbbgain_ch14_table[15].ccktxbb_valuearray[4] = 0x00;
+	priv->cck_txbbgain_ch14_table[15].ccktxbb_valuearray[5] = 0x00;
+	priv->cck_txbbgain_ch14_table[15].ccktxbb_valuearray[6] = 0x00;
+	priv->cck_txbbgain_ch14_table[15].ccktxbb_valuearray[7] = 0x00;
+
+	priv->cck_txbbgain_ch14_table[16].ccktxbb_valuearray[0] = 0x16;
+	priv->cck_txbbgain_ch14_table[16].ccktxbb_valuearray[1] = 0x15;
+	priv->cck_txbbgain_ch14_table[16].ccktxbb_valuearray[2] = 0x12;
+	priv->cck_txbbgain_ch14_table[16].ccktxbb_valuearray[3] = 0x0b;
+	priv->cck_txbbgain_ch14_table[16].ccktxbb_valuearray[4] = 0x00;
+	priv->cck_txbbgain_ch14_table[16].ccktxbb_valuearray[5] = 0x00;
+	priv->cck_txbbgain_ch14_table[16].ccktxbb_valuearray[6] = 0x00;
+	priv->cck_txbbgain_ch14_table[16].ccktxbb_valuearray[7] = 0x00;
+
+	priv->cck_txbbgain_ch14_table[17].ccktxbb_valuearray[0] = 0x14;
+	priv->cck_txbbgain_ch14_table[17].ccktxbb_valuearray[1] = 0x14;
+	priv->cck_txbbgain_ch14_table[17].ccktxbb_valuearray[2] = 0x11;
+	priv->cck_txbbgain_ch14_table[17].ccktxbb_valuearray[3] = 0x0a;
+	priv->cck_txbbgain_ch14_table[17].ccktxbb_valuearray[4] = 0x00;
+	priv->cck_txbbgain_ch14_table[17].ccktxbb_valuearray[5] = 0x00;
+	priv->cck_txbbgain_ch14_table[17].ccktxbb_valuearray[6] = 0x00;
+	priv->cck_txbbgain_ch14_table[17].ccktxbb_valuearray[7] = 0x00;
+
+	priv->cck_txbbgain_ch14_table[18].ccktxbb_valuearray[0] = 0x13;
+	priv->cck_txbbgain_ch14_table[18].ccktxbb_valuearray[1] = 0x13;
+	priv->cck_txbbgain_ch14_table[18].ccktxbb_valuearray[2] = 0x10;
+	priv->cck_txbbgain_ch14_table[18].ccktxbb_valuearray[3] = 0x0a;
+	priv->cck_txbbgain_ch14_table[18].ccktxbb_valuearray[4] = 0x00;
+	priv->cck_txbbgain_ch14_table[18].ccktxbb_valuearray[5] = 0x00;
+	priv->cck_txbbgain_ch14_table[18].ccktxbb_valuearray[6] = 0x00;
+	priv->cck_txbbgain_ch14_table[18].ccktxbb_valuearray[7] = 0x00;
+
+	priv->cck_txbbgain_ch14_table[19].ccktxbb_valuearray[0] = 0x12;
+	priv->cck_txbbgain_ch14_table[19].ccktxbb_valuearray[1] = 0x12;
+	priv->cck_txbbgain_ch14_table[19].ccktxbb_valuearray[2] = 0x0f;
+	priv->cck_txbbgain_ch14_table[19].ccktxbb_valuearray[3] = 0x09;
+	priv->cck_txbbgain_ch14_table[19].ccktxbb_valuearray[4] = 0x00;
+	priv->cck_txbbgain_ch14_table[19].ccktxbb_valuearray[5] = 0x00;
+	priv->cck_txbbgain_ch14_table[19].ccktxbb_valuearray[6] = 0x00;
+	priv->cck_txbbgain_ch14_table[19].ccktxbb_valuearray[7] = 0x00;
+
+	priv->cck_txbbgain_ch14_table[20].ccktxbb_valuearray[0] = 0x11;
+	priv->cck_txbbgain_ch14_table[20].ccktxbb_valuearray[1] = 0x11;
+	priv->cck_txbbgain_ch14_table[20].ccktxbb_valuearray[2] = 0x0f;
+	priv->cck_txbbgain_ch14_table[20].ccktxbb_valuearray[3] = 0x09;
+	priv->cck_txbbgain_ch14_table[20].ccktxbb_valuearray[4] = 0x00;
+	priv->cck_txbbgain_ch14_table[20].ccktxbb_valuearray[5] = 0x00;
+	priv->cck_txbbgain_ch14_table[20].ccktxbb_valuearray[6] = 0x00;
+	priv->cck_txbbgain_ch14_table[20].ccktxbb_valuearray[7] = 0x00;
+
+	priv->cck_txbbgain_ch14_table[21].ccktxbb_valuearray[0] = 0x10;
+	priv->cck_txbbgain_ch14_table[21].ccktxbb_valuearray[1] = 0x10;
+	priv->cck_txbbgain_ch14_table[21].ccktxbb_valuearray[2] = 0x0e;
+	priv->cck_txbbgain_ch14_table[21].ccktxbb_valuearray[3] = 0x08;
+	priv->cck_txbbgain_ch14_table[21].ccktxbb_valuearray[4] = 0x00;
+	priv->cck_txbbgain_ch14_table[21].ccktxbb_valuearray[5] = 0x00;
+	priv->cck_txbbgain_ch14_table[21].ccktxbb_valuearray[6] = 0x00;
+	priv->cck_txbbgain_ch14_table[21].ccktxbb_valuearray[7] = 0x00;
+
+	priv->cck_txbbgain_ch14_table[22].ccktxbb_valuearray[0] = 0x0f;
+	priv->cck_txbbgain_ch14_table[22].ccktxbb_valuearray[1] = 0x0f;
+	priv->cck_txbbgain_ch14_table[22].ccktxbb_valuearray[2] = 0x0d;
+	priv->cck_txbbgain_ch14_table[22].ccktxbb_valuearray[3] = 0x08;
+	priv->cck_txbbgain_ch14_table[22].ccktxbb_valuearray[4] = 0x00;
+	priv->cck_txbbgain_ch14_table[22].ccktxbb_valuearray[5] = 0x00;
+	priv->cck_txbbgain_ch14_table[22].ccktxbb_valuearray[6] = 0x00;
+	priv->cck_txbbgain_ch14_table[22].ccktxbb_valuearray[7] = 0x00;
+
+	priv->btxpower_tracking = TRUE;
+	priv->txpower_count       = 0;
+	priv->btxpower_trackingInit = FALSE;
+
+}
+
+static void dm_InitializeTXPowerTracking_ThermalMeter(struct net_device *dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+	// Tx Power tracking by Theremal Meter require Firmware R/W 3-wire. This mechanism
+	// can be enabled only when Firmware R/W 3-wire is enabled. Otherwise, frequent r/w
+	// 3-wire by driver cause RF goes into wrong state.
+	if(priv->ieee80211->FwRWRF)
+		priv->btxpower_tracking = TRUE;
+	else
+		priv->btxpower_tracking = FALSE;
+	priv->txpower_count       = 0;
+	priv->btxpower_trackingInit = FALSE;
+}
+
+
+void dm_initialize_txpower_tracking(struct net_device *dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+#ifdef RTL8190P
+	dm_InitializeTXPowerTracking_TSSI(dev);
+#else
+	if(priv->bDcut == TRUE)
+		dm_InitializeTXPowerTracking_TSSI(dev);
+	else
+		dm_InitializeTXPowerTracking_ThermalMeter(dev);
+#endif
+}// dm_InitializeTXPowerTracking
+
+
+static void dm_CheckTXPowerTracking_TSSI(struct net_device *dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	static u32 tx_power_track_counter = 0;
+
+	if(!priv->btxpower_tracking)
+		return;
+	else
+	{
+		if((tx_power_track_counter % 30 == 0)&&(tx_power_track_counter != 0))
+		{
+				queue_delayed_work(priv->priv_wq,&priv->txpower_tracking_wq,0);
+		}
+		tx_power_track_counter++;
+	}
+
+}
+
+
+static void dm_CheckTXPowerTracking_ThermalMeter(struct net_device *dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	static u8 	TM_Trigger=0;
+	//DbgPrint("dm_CheckTXPowerTracking() \n");
+	if(!priv->btxpower_tracking)
+		return;
+	else
+	{
+		if(priv->txpower_count  <= 2)
+		{
+			priv->txpower_count++;
+			return;
+		}
+	}
+
+	if(!TM_Trigger)
+	{
+		//Attention!! You have to wirte all 12bits data to RF, or it may cause RF to crash
+		//actually write reg0x02 bit1=0, then bit1=1.
+		//DbgPrint("Trigger ThermalMeter, write RF reg0x2 = 0x4d to 0x4f\n");
+		rtl8192_phy_SetRFReg(dev, RF90_PATH_A, 0x02, bMask12Bits, 0x4d);
+		rtl8192_phy_SetRFReg(dev, RF90_PATH_A, 0x02, bMask12Bits, 0x4f);
+		rtl8192_phy_SetRFReg(dev, RF90_PATH_A, 0x02, bMask12Bits, 0x4d);
+		rtl8192_phy_SetRFReg(dev, RF90_PATH_A, 0x02, bMask12Bits, 0x4f);
+		TM_Trigger = 1;
+		return;
+	}
+	else
+	{
+		//DbgPrint("Schedule TxPowerTrackingWorkItem\n");
+			queue_delayed_work(priv->priv_wq,&priv->txpower_tracking_wq,0);
+		TM_Trigger = 0;
+	}
+}
+
+
+static void dm_check_txpower_tracking(struct net_device *dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	//static u32 tx_power_track_counter = 0;
+
+#ifdef  RTL8190P
+	dm_CheckTXPowerTracking_TSSI(dev);
+#else
+	if(priv->bDcut == TRUE)
+		dm_CheckTXPowerTracking_TSSI(dev);
+	else
+		dm_CheckTXPowerTracking_ThermalMeter(dev);
+#endif
+
+}	// dm_CheckTXPowerTracking
+
+
+static void dm_CCKTxPowerAdjust_TSSI(struct net_device *dev, bool  bInCH14)
+{
+	u32 TempVal;
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	//Write 0xa22 0xa23
+	TempVal = 0;
+	if(!bInCH14){
+		//Write 0xa22 0xa23
+		TempVal = 	priv->cck_txbbgain_table[priv->cck_present_attentuation].ccktxbb_valuearray[0] +
+					(priv->cck_txbbgain_table[priv->cck_present_attentuation].ccktxbb_valuearray[1]<<8) ;
+
+		rtl8192_setBBreg(dev, rCCK0_TxFilter1,bMaskHWord, TempVal);
+		//Write 0xa24 ~ 0xa27
+		TempVal = 0;
+		TempVal = 	priv->cck_txbbgain_table[priv->cck_present_attentuation].ccktxbb_valuearray[2] +
+					(priv->cck_txbbgain_table[priv->cck_present_attentuation].ccktxbb_valuearray[3]<<8) +
+					(priv->cck_txbbgain_table[priv->cck_present_attentuation].ccktxbb_valuearray[4]<<16 )+
+					(priv->cck_txbbgain_table[priv->cck_present_attentuation].ccktxbb_valuearray[5]<<24);
+		rtl8192_setBBreg(dev, rCCK0_TxFilter2,bMaskDWord, TempVal);
+		//Write 0xa28  0xa29
+		TempVal = 0;
+		TempVal = 	priv->cck_txbbgain_table[priv->cck_present_attentuation].ccktxbb_valuearray[6] +
+					(priv->cck_txbbgain_table[priv->cck_present_attentuation].ccktxbb_valuearray[7]<<8) ;
+
+		rtl8192_setBBreg(dev, rCCK0_DebugPort,bMaskLWord, TempVal);
+	}
+	else
+	{
+		TempVal = 	priv->cck_txbbgain_ch14_table[priv->cck_present_attentuation].ccktxbb_valuearray[0] +
+					(priv->cck_txbbgain_ch14_table[priv->cck_present_attentuation].ccktxbb_valuearray[1]<<8) ;
+
+		rtl8192_setBBreg(dev, rCCK0_TxFilter1,bMaskHWord, TempVal);
+		//Write 0xa24 ~ 0xa27
+		TempVal = 0;
+		TempVal = 	priv->cck_txbbgain_ch14_table[priv->cck_present_attentuation].ccktxbb_valuearray[2] +
+					(priv->cck_txbbgain_ch14_table[priv->cck_present_attentuation].ccktxbb_valuearray[3]<<8) +
+					(priv->cck_txbbgain_ch14_table[priv->cck_present_attentuation].ccktxbb_valuearray[4]<<16 )+
+					(priv->cck_txbbgain_ch14_table[priv->cck_present_attentuation].ccktxbb_valuearray[5]<<24);
+		rtl8192_setBBreg(dev, rCCK0_TxFilter2,bMaskDWord, TempVal);
+		//Write 0xa28  0xa29
+		TempVal = 0;
+		TempVal = 	priv->cck_txbbgain_ch14_table[priv->cck_present_attentuation].ccktxbb_valuearray[6] +
+					(priv->cck_txbbgain_ch14_table[priv->cck_present_attentuation].ccktxbb_valuearray[7]<<8) ;
+
+		rtl8192_setBBreg(dev, rCCK0_DebugPort,bMaskLWord, TempVal);
+	}
+
+
+}
+
+static void dm_CCKTxPowerAdjust_ThermalMeter(struct net_device *dev,	bool  bInCH14)
+{
+	u32 TempVal;
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+	TempVal = 0;
+	if(!bInCH14)
+	{
+		//Write 0xa22 0xa23
+		TempVal = 	CCKSwingTable_Ch1_Ch13[priv->CCK_index][0] +
+					(CCKSwingTable_Ch1_Ch13[priv->CCK_index][1]<<8) ;
+		rtl8192_setBBreg(dev, rCCK0_TxFilter1, bMaskHWord, TempVal);
+		RT_TRACE(COMP_POWER_TRACKING, "CCK not chnl 14, reg 0x%x = 0x%x\n",
+			rCCK0_TxFilter1, TempVal);
+		//Write 0xa24 ~ 0xa27
+		TempVal = 0;
+		TempVal = 	CCKSwingTable_Ch1_Ch13[priv->CCK_index][2] +
+					(CCKSwingTable_Ch1_Ch13[priv->CCK_index][3]<<8) +
+					(CCKSwingTable_Ch1_Ch13[priv->CCK_index][4]<<16 )+
+					(CCKSwingTable_Ch1_Ch13[priv->CCK_index][5]<<24);
+		rtl8192_setBBreg(dev, rCCK0_TxFilter2, bMaskDWord, TempVal);
+		RT_TRACE(COMP_POWER_TRACKING, "CCK not chnl 14, reg 0x%x = 0x%x\n",
+			rCCK0_TxFilter2, TempVal);
+		//Write 0xa28  0xa29
+		TempVal = 0;
+		TempVal = 	CCKSwingTable_Ch1_Ch13[priv->CCK_index][6] +
+					(CCKSwingTable_Ch1_Ch13[priv->CCK_index][7]<<8) ;
+
+		rtl8192_setBBreg(dev, rCCK0_DebugPort, bMaskLWord, TempVal);
+		RT_TRACE(COMP_POWER_TRACKING, "CCK not chnl 14, reg 0x%x = 0x%x\n",
+			rCCK0_DebugPort, TempVal);
+	}
+	else
+	{
+//		priv->CCKTxPowerAdjustCntNotCh14++;	//cosa add for debug.
+		//Write 0xa22 0xa23
+		TempVal = 	CCKSwingTable_Ch14[priv->CCK_index][0] +
+					(CCKSwingTable_Ch14[priv->CCK_index][1]<<8) ;
+
+		rtl8192_setBBreg(dev, rCCK0_TxFilter1, bMaskHWord, TempVal);
+		RT_TRACE(COMP_POWER_TRACKING, "CCK chnl 14, reg 0x%x = 0x%x\n",
+			rCCK0_TxFilter1, TempVal);
+		//Write 0xa24 ~ 0xa27
+		TempVal = 0;
+		TempVal = 	CCKSwingTable_Ch14[priv->CCK_index][2] +
+					(CCKSwingTable_Ch14[priv->CCK_index][3]<<8) +
+					(CCKSwingTable_Ch14[priv->CCK_index][4]<<16 )+
+					(CCKSwingTable_Ch14[priv->CCK_index][5]<<24);
+		rtl8192_setBBreg(dev, rCCK0_TxFilter2, bMaskDWord, TempVal);
+		RT_TRACE(COMP_POWER_TRACKING, "CCK chnl 14, reg 0x%x = 0x%x\n",
+			rCCK0_TxFilter2, TempVal);
+		//Write 0xa28  0xa29
+		TempVal = 0;
+		TempVal = 	CCKSwingTable_Ch14[priv->CCK_index][6] +
+					(CCKSwingTable_Ch14[priv->CCK_index][7]<<8) ;
+
+		rtl8192_setBBreg(dev, rCCK0_DebugPort, bMaskLWord, TempVal);
+		RT_TRACE(COMP_POWER_TRACKING,"CCK chnl 14, reg 0x%x = 0x%x\n",
+			rCCK0_DebugPort, TempVal);
+	}
+}
+
+
+
+extern void dm_cck_txpower_adjust(
+	struct net_device *dev,
+	bool  binch14
+)
+{	// dm_CCKTxPowerAdjust
+
+	struct r8192_priv *priv = ieee80211_priv(dev);
+#ifdef RTL8190P
+	dm_CCKTxPowerAdjust_TSSI(dev, binch14);
+#else
+	if(priv->bDcut == TRUE)
+		dm_CCKTxPowerAdjust_TSSI(dev, binch14);
+	else
+		dm_CCKTxPowerAdjust_ThermalMeter(dev, binch14);
+#endif
+}
+
+
+#ifndef  RTL8192U
+static void dm_txpower_reset_recovery(
+	struct net_device *dev
+)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+	RT_TRACE(COMP_POWER_TRACKING, "Start Reset Recovery ==>\n");
+	rtl8192_setBBreg(dev, rOFDM0_XATxIQImbalance, bMaskDWord, priv->txbbgain_table[priv->rfa_txpowertrackingindex].txbbgain_value);
+	RT_TRACE(COMP_POWER_TRACKING, "Reset Recovery: Fill in 0xc80 is %08x\n",priv->txbbgain_table[priv->rfa_txpowertrackingindex].txbbgain_value);
+	RT_TRACE(COMP_POWER_TRACKING, "Reset Recovery: Fill in RFA_txPowerTrackingIndex is %x\n",priv->rfa_txpowertrackingindex);
+	RT_TRACE(COMP_POWER_TRACKING, "Reset Recovery : RF A I/Q Amplify Gain is %ld\n",priv->txbbgain_table[priv->rfa_txpowertrackingindex].txbb_iq_amplifygain);
+	RT_TRACE(COMP_POWER_TRACKING, "Reset Recovery: CCK Attenuation is %d dB\n",priv->cck_present_attentuation);
+	dm_cck_txpower_adjust(dev,priv->bcck_in_ch14);
+
+	rtl8192_setBBreg(dev, rOFDM0_XCTxIQImbalance, bMaskDWord, priv->txbbgain_table[priv->rfc_txpowertrackingindex].txbbgain_value);
+	RT_TRACE(COMP_POWER_TRACKING, "Reset Recovery: Fill in 0xc90 is %08x\n",priv->txbbgain_table[priv->rfc_txpowertrackingindex].txbbgain_value);
+	RT_TRACE(COMP_POWER_TRACKING, "Reset Recovery: Fill in RFC_txPowerTrackingIndex is %x\n",priv->rfc_txpowertrackingindex);
+	RT_TRACE(COMP_POWER_TRACKING, "Reset Recovery : RF C I/Q Amplify Gain is %ld\n",priv->txbbgain_table[priv->rfc_txpowertrackingindex].txbb_iq_amplifygain);
+
+}	// dm_TXPowerResetRecovery
+
+extern void dm_restore_dynamic_mechanism_state(struct net_device *dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	u32 	reg_ratr = priv->rate_adaptive.last_ratr;
+
+	if(!priv->up)
+	{
+		RT_TRACE(COMP_RATE, "<---- dm_restore_dynamic_mechanism_state(): driver is going to unload\n");
+		return;
+	}
+
+	//
+	// Restore previous state for rate adaptive
+	//
+	if(priv->rate_adaptive.rate_adaptive_disabled)
+		return;
+	// TODO: Only 11n mode is implemented currently,
+	if( !(priv->ieee80211->mode==WIRELESS_MODE_N_24G ||
+		 priv->ieee80211->mode==WIRELESS_MODE_N_5G))
+		 return;
+	{
+			/* 2007/11/15 MH Copy from 8190PCI. */
+			u32 ratr_value;
+			ratr_value = reg_ratr;
+			if(priv->rf_type == RF_1T2R)	// 1T2R, Spatial Stream 2 should be disabled
+			{
+				ratr_value &=~ (RATE_ALL_OFDM_2SS);
+				//DbgPrint("HW_VAR_TATR_0 from 0x%x ==> 0x%x\n", ((pu4Byte)(val))[0], ratr_value);
+			}
+			//DbgPrint("set HW_VAR_TATR_0 = 0x%x\n", ratr_value);
+			//cosa PlatformEFIOWrite4Byte(Adapter, RATR0, ((pu4Byte)(val))[0]);
+			write_nic_dword(dev, RATR0, ratr_value);
+			write_nic_byte(dev, UFWP, 1);
+	}
+	//Resore TX Power Tracking Index
+	if(priv->btxpower_trackingInit && priv->btxpower_tracking){
+		dm_txpower_reset_recovery(dev);
+	}
+
+	//
+	//Restore BB Initial Gain
+	//
+	dm_bb_initialgain_restore(dev);
+
+}	// DM_RestoreDynamicMechanismState
+
+static void dm_bb_initialgain_restore(struct net_device *dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	u32 bit_mask = 0x7f; //Bit0~ Bit6
+
+	if(dm_digtable.dig_algorithm == DIG_ALGO_BY_RSSI)
+		return;
+
+	//Disable Initial Gain
+	//PHY_SetBBReg(Adapter, UFWP, bMaskLWord, 0x800);
+	rtl8192_setBBreg(dev, UFWP, bMaskByte1, 0x8);	// Only clear byte 1 and rewrite.
+	rtl8192_setBBreg(dev, rOFDM0_XAAGCCore1, bit_mask, (u32)priv->initgain_backup.xaagccore1);
+	rtl8192_setBBreg(dev, rOFDM0_XBAGCCore1, bit_mask, (u32)priv->initgain_backup.xbagccore1);
+	rtl8192_setBBreg(dev, rOFDM0_XCAGCCore1, bit_mask, (u32)priv->initgain_backup.xcagccore1);
+	rtl8192_setBBreg(dev, rOFDM0_XDAGCCore1, bit_mask, (u32)priv->initgain_backup.xdagccore1);
+	bit_mask  = bMaskByte2;
+	rtl8192_setBBreg(dev, rCCK0_CCA, bit_mask, (u32)priv->initgain_backup.cca);
+
+	RT_TRACE(COMP_DIG, "dm_BBInitialGainRestore 0xc50 is %x\n",priv->initgain_backup.xaagccore1);
+	RT_TRACE(COMP_DIG, "dm_BBInitialGainRestore 0xc58 is %x\n",priv->initgain_backup.xbagccore1);
+	RT_TRACE(COMP_DIG, "dm_BBInitialGainRestore 0xc60 is %x\n",priv->initgain_backup.xcagccore1);
+	RT_TRACE(COMP_DIG, "dm_BBInitialGainRestore 0xc68 is %x\n",priv->initgain_backup.xdagccore1);
+	RT_TRACE(COMP_DIG, "dm_BBInitialGainRestore 0xa0a is %x\n",priv->initgain_backup.cca);
+	//Enable Initial Gain
+	//PHY_SetBBReg(Adapter, UFWP, bMaskLWord, 0x100);
+	rtl8192_setBBreg(dev, UFWP, bMaskByte1, 0x1);	// Only clear byte 1 and rewrite.
+
+}	// dm_BBInitialGainRestore
+
+
+extern void dm_backup_dynamic_mechanism_state(struct net_device *dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+	// Fsync to avoid reset
+	priv->bswitch_fsync  = false;
+	priv->bfsync_processing = false;
+	//Backup BB InitialGain
+	dm_bb_initialgain_backup(dev);
+
+}	// DM_BackupDynamicMechanismState
+
+
+static void dm_bb_initialgain_backup(struct net_device *dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	u32 bit_mask = bMaskByte0; //Bit0~ Bit6
+
+	if(dm_digtable.dig_algorithm == DIG_ALGO_BY_RSSI)
+		return;
+
+	//PHY_SetBBReg(Adapter, UFWP, bMaskLWord, 0x800);
+	rtl8192_setBBreg(dev, UFWP, bMaskByte1, 0x8);	// Only clear byte 1 and rewrite.
+	priv->initgain_backup.xaagccore1 = (u8)rtl8192_QueryBBReg(dev, rOFDM0_XAAGCCore1, bit_mask);
+	priv->initgain_backup.xbagccore1 = (u8)rtl8192_QueryBBReg(dev, rOFDM0_XBAGCCore1, bit_mask);
+	priv->initgain_backup.xcagccore1 = (u8)rtl8192_QueryBBReg(dev, rOFDM0_XCAGCCore1, bit_mask);
+	priv->initgain_backup.xdagccore1 = (u8)rtl8192_QueryBBReg(dev, rOFDM0_XDAGCCore1, bit_mask);
+	bit_mask  = bMaskByte2;
+	priv->initgain_backup.cca = (u8)rtl8192_QueryBBReg(dev, rCCK0_CCA, bit_mask);
+
+	RT_TRACE(COMP_DIG, "BBInitialGainBackup 0xc50 is %x\n",priv->initgain_backup.xaagccore1);
+	RT_TRACE(COMP_DIG, "BBInitialGainBackup 0xc58 is %x\n",priv->initgain_backup.xbagccore1);
+	RT_TRACE(COMP_DIG, "BBInitialGainBackup 0xc60 is %x\n",priv->initgain_backup.xcagccore1);
+	RT_TRACE(COMP_DIG, "BBInitialGainBackup 0xc68 is %x\n",priv->initgain_backup.xdagccore1);
+	RT_TRACE(COMP_DIG, "BBInitialGainBackup 0xa0a is %x\n",priv->initgain_backup.cca);
+
+}   // dm_BBInitialGainBakcup
+
+#endif
+/*-----------------------------------------------------------------------------
+ * Function:	dm_change_dynamic_initgain_thresh()
+ *
+ * Overview:
+ *
+ * Input:		NONE
+ *
+ * Output:		NONE
+ *
+ * Return:		NONE
+ *
+ * Revised History:
+ *	When		Who		Remark
+ *	05/29/2008	amy		Create Version 0 porting from windows code.
+ *
+ *---------------------------------------------------------------------------*/
+extern void dm_change_dynamic_initgain_thresh(struct net_device *dev,
+								u32		dm_type,
+								u32		dm_value)
+{
+	if (dm_type == DIG_TYPE_THRESH_HIGH)
+	{
+		dm_digtable.rssi_high_thresh = dm_value;
+	}
+	else if (dm_type == DIG_TYPE_THRESH_LOW)
+	{
+		dm_digtable.rssi_low_thresh = dm_value;
+	}
+	else if (dm_type == DIG_TYPE_THRESH_HIGHPWR_HIGH)
+	{
+		dm_digtable.rssi_high_power_highthresh = dm_value;
+	}
+	else if (dm_type == DIG_TYPE_THRESH_HIGHPWR_HIGH)
+	{
+		dm_digtable.rssi_high_power_highthresh = dm_value;
+	}
+	else if (dm_type == DIG_TYPE_ENABLE)
+	{
+		dm_digtable.dig_state		= DM_STA_DIG_MAX;
+		dm_digtable.dig_enable_flag	= true;
+	}
+	else if (dm_type == DIG_TYPE_DISABLE)
+	{
+		dm_digtable.dig_state		= DM_STA_DIG_MAX;
+		dm_digtable.dig_enable_flag	= false;
+	}
+	else if (dm_type == DIG_TYPE_DBG_MODE)
+	{
+		if(dm_value >= DM_DBG_MAX)
+			dm_value = DM_DBG_OFF;
+		dm_digtable.dbg_mode		= (u8)dm_value;
+	}
+	else if (dm_type == DIG_TYPE_RSSI)
+	{
+		if(dm_value > 100)
+			dm_value = 30;
+		dm_digtable.rssi_val			= (long)dm_value;
+	}
+	else if (dm_type == DIG_TYPE_ALGORITHM)
+	{
+		if (dm_value >= DIG_ALGO_MAX)
+			dm_value = DIG_ALGO_BY_FALSE_ALARM;
+		if(dm_digtable.dig_algorithm != (u8)dm_value)
+			dm_digtable.dig_algorithm_switch = 1;
+		dm_digtable.dig_algorithm	= (u8)dm_value;
+	}
+	else if (dm_type == DIG_TYPE_BACKOFF)
+	{
+		if(dm_value > 30)
+			dm_value = 30;
+		dm_digtable.backoff_val		= (u8)dm_value;
+	}
+	else if(dm_type == DIG_TYPE_RX_GAIN_MIN)
+	{
+		if(dm_value == 0)
+			dm_value = 0x1;
+		dm_digtable.rx_gain_range_min = (u8)dm_value;
+	}
+	else if(dm_type == DIG_TYPE_RX_GAIN_MAX)
+	{
+		if(dm_value > 0x50)
+			dm_value = 0x50;
+		dm_digtable.rx_gain_range_max = (u8)dm_value;
+	}
+}	/* DM_ChangeDynamicInitGainThresh */
+extern	void
+dm_change_fsync_setting(
+	struct net_device *dev,
+	s32		DM_Type,
+	s32		DM_Value)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+	if (DM_Type == 0)	// monitor 0xc38 register
+	{
+		if(DM_Value > 1)
+			DM_Value = 1;
+		priv->framesyncMonitor = (u8)DM_Value;
+		//DbgPrint("pHalData->framesyncMonitor = %d", pHalData->framesyncMonitor);
+	}
+}
+
+extern void
+dm_change_rxpath_selection_setting(
+	struct net_device *dev,
+	s32		DM_Type,
+	s32		DM_Value)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	prate_adaptive 	pRA = (prate_adaptive)&(priv->rate_adaptive);
+
+
+	if(DM_Type == 0)
+	{
+		if(DM_Value > 1)
+			DM_Value = 1;
+		DM_RxPathSelTable.Enable = (u8)DM_Value;
+	}
+	else if(DM_Type == 1)
+	{
+		if(DM_Value > 1)
+			DM_Value = 1;
+		DM_RxPathSelTable.DbgMode = (u8)DM_Value;
+	}
+	else if(DM_Type == 2)
+	{
+		if(DM_Value > 40)
+			DM_Value = 40;
+		DM_RxPathSelTable.SS_TH_low = (u8)DM_Value;
+	}
+	else if(DM_Type == 3)
+	{
+		if(DM_Value > 25)
+			DM_Value = 25;
+		DM_RxPathSelTable.diff_TH = (u8)DM_Value;
+	}
+	else if(DM_Type == 4)
+	{
+		if(DM_Value >= CCK_Rx_Version_MAX)
+			DM_Value = CCK_Rx_Version_1;
+		DM_RxPathSelTable.cck_method= (u8)DM_Value;
+	}
+	else if(DM_Type == 10)
+	{
+		if(DM_Value > 100)
+			DM_Value = 50;
+		DM_RxPathSelTable.rf_rssi[0] = (u8)DM_Value;
+	}
+	else if(DM_Type == 11)
+	{
+		if(DM_Value > 100)
+			DM_Value = 50;
+		DM_RxPathSelTable.rf_rssi[1] = (u8)DM_Value;
+	}
+	else if(DM_Type == 12)
+	{
+		if(DM_Value > 100)
+			DM_Value = 50;
+		DM_RxPathSelTable.rf_rssi[2] = (u8)DM_Value;
+	}
+	else if(DM_Type == 13)
+	{
+		if(DM_Value > 100)
+			DM_Value = 50;
+		DM_RxPathSelTable.rf_rssi[3] = (u8)DM_Value;
+	}
+	else if(DM_Type == 20)
+	{
+		if(DM_Value > 1)
+			DM_Value = 1;
+		pRA->ping_rssi_enable = (u8)DM_Value;
+	}
+	else if(DM_Type == 21)
+	{
+		if(DM_Value > 30)
+			DM_Value = 30;
+		pRA->ping_rssi_thresh_for_ra = DM_Value;
+	}
+}
+
+
+/*-----------------------------------------------------------------------------
+ * Function:	dm_dig_init()
+ *
+ * Overview:	Set DIG scheme init value.
+ *
+ * Input:		NONE
+ *
+ * Output:		NONE
+ *
+ * Return:		NONE
+ *
+ * Revised History:
+ *	When		Who		Remark
+ *	05/15/2008	amy		Create Version 0 porting from windows code.
+ *
+ *---------------------------------------------------------------------------*/
+static void dm_dig_init(struct net_device *dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	/* 2007/10/05 MH Disable DIG scheme now. Not tested. */
+	dm_digtable.dig_enable_flag	= true;
+	dm_digtable.dig_algorithm = DIG_ALGO_BY_RSSI;
+	dm_digtable.dbg_mode = DM_DBG_OFF;	//off=by real rssi value, on=by DM_DigTable.Rssi_val for new dig
+	dm_digtable.dig_algorithm_switch = 0;
+
+	/* 2007/10/04 MH Define init gain threshol. */
+	dm_digtable.dig_state		= DM_STA_DIG_MAX;
+	dm_digtable.dig_highpwr_state	= DM_STA_DIG_MAX;
+	dm_digtable.initialgain_lowerbound_state = false;
+
+	dm_digtable.rssi_low_thresh 	= DM_DIG_THRESH_LOW;
+	dm_digtable.rssi_high_thresh 	= DM_DIG_THRESH_HIGH;
+
+	dm_digtable.rssi_high_power_lowthresh = DM_DIG_HIGH_PWR_THRESH_LOW;
+	dm_digtable.rssi_high_power_highthresh = DM_DIG_HIGH_PWR_THRESH_HIGH;
+
+	dm_digtable.rssi_val = 50;	//for new dig debug rssi value
+	dm_digtable.backoff_val = DM_DIG_BACKOFF;
+	dm_digtable.rx_gain_range_max = DM_DIG_MAX;
+	if(priv->CustomerID == RT_CID_819x_Netcore)
+		dm_digtable.rx_gain_range_min = DM_DIG_MIN_Netcore;
+	else
+		dm_digtable.rx_gain_range_min = DM_DIG_MIN;
+
+}	/* dm_dig_init */
+
+
+/*-----------------------------------------------------------------------------
+ * Function:	dm_ctrl_initgain_byrssi()
+ *
+ * Overview:	Driver must monitor RSSI and notify firmware to change initial
+ *				gain according to different threshold. BB team provide the
+ *				suggested solution.
+ *
+ * Input:			struct net_device *dev
+ *
+ * Output:		NONE
+ *
+ * Return:		NONE
+ *
+ * Revised History:
+ *	When		Who		Remark
+ *	05/27/2008	amy		Create Version 0 porting from windows code.
+ *---------------------------------------------------------------------------*/
+static void dm_ctrl_initgain_byrssi(struct net_device *dev)
+{
+
+	if (dm_digtable.dig_enable_flag == false)
+		return;
+
+	if(dm_digtable.dig_algorithm == DIG_ALGO_BY_FALSE_ALARM)
+		dm_ctrl_initgain_byrssi_by_fwfalse_alarm(dev);
+	else if(dm_digtable.dig_algorithm == DIG_ALGO_BY_RSSI)
+		dm_ctrl_initgain_byrssi_by_driverrssi(dev);
+//		;
+	else
+		return;
+}
+
+
+static void dm_ctrl_initgain_byrssi_by_driverrssi(
+	struct net_device *dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	u8 i;
+	static u8 	fw_dig=0;
+
+	if (dm_digtable.dig_enable_flag == false)
+		return;
+
+	//DbgPrint("Dig by Sw Rssi \n");
+	if(dm_digtable.dig_algorithm_switch)	// if swithed algorithm, we have to disable FW Dig.
+		fw_dig = 0;
+	if(fw_dig <= 3)	// execute several times to make sure the FW Dig is disabled
+	{// FW DIG Off
+		for(i=0; i<3; i++)
+			rtl8192_setBBreg(dev, UFWP, bMaskByte1, 0x8);	// Only clear byte 1 and rewrite.
+		fw_dig++;
+		dm_digtable.dig_state = DM_STA_DIG_OFF;	//fw dig off.
+	}
+
+	if(priv->ieee80211->state == IEEE80211_LINKED)
+		dm_digtable.cur_connect_state = DIG_CONNECT;
+	else
+		dm_digtable.cur_connect_state = DIG_DISCONNECT;
+
+	//DbgPrint("DM_DigTable.PreConnectState = %d, DM_DigTable.CurConnectState = %d \n",
+		//DM_DigTable.PreConnectState, DM_DigTable.CurConnectState);
+
+	if(dm_digtable.dbg_mode == DM_DBG_OFF)
+		dm_digtable.rssi_val = priv->undecorated_smoothed_pwdb;
+	//DbgPrint("DM_DigTable.Rssi_val = %d \n", DM_DigTable.Rssi_val);
+	dm_initial_gain(dev);
+	dm_pd_th(dev);
+	dm_cs_ratio(dev);
+	if(dm_digtable.dig_algorithm_switch)
+		dm_digtable.dig_algorithm_switch = 0;
+	dm_digtable.pre_connect_state = dm_digtable.cur_connect_state;
+
+}	/* dm_CtrlInitGainByRssi */
+
+static void dm_ctrl_initgain_byrssi_by_fwfalse_alarm(
+	struct net_device *dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	static u32 reset_cnt = 0;
+	u8 i;
+
+	if (dm_digtable.dig_enable_flag == false)
+		return;
+
+	if(dm_digtable.dig_algorithm_switch)
+	{
+		dm_digtable.dig_state = DM_STA_DIG_MAX;
+		// Fw DIG On.
+		for(i=0; i<3; i++)
+			rtl8192_setBBreg(dev, UFWP, bMaskByte1, 0x1);	// Only clear byte 1 and rewrite.
+		dm_digtable.dig_algorithm_switch = 0;
+	}
+
+	if (priv->ieee80211->state != IEEE80211_LINKED)
+		return;
+
+	// For smooth, we can not change DIG state.
+	if ((priv->undecorated_smoothed_pwdb > dm_digtable.rssi_low_thresh) &&
+		(priv->undecorated_smoothed_pwdb < dm_digtable.rssi_high_thresh))
+	{
+		return;
+	}
+	//DbgPrint("Dig by Fw False Alarm\n");
+	//if (DM_DigTable.Dig_State == DM_STA_DIG_OFF)
+	/*DbgPrint("DIG Check\n\r RSSI=%d LOW=%d HIGH=%d STATE=%d",
+	pHalData->UndecoratedSmoothedPWDB, DM_DigTable.RssiLowThresh,
+	DM_DigTable.RssiHighThresh, DM_DigTable.Dig_State);*/
+	/* 1. When RSSI decrease, We have to judge if it is smaller than a treshold
+		  and then execute below step. */
+	if ((priv->undecorated_smoothed_pwdb <= dm_digtable.rssi_low_thresh))
+	{
+		/* 2008/02/05 MH When we execute silent reset, the DIG PHY parameters
+		   will be reset to init value. We must prevent the condition. */
+		if (dm_digtable.dig_state == DM_STA_DIG_OFF &&
+			(priv->reset_count == reset_cnt))
+		{
+			return;
+		}
+		else
+		{
+			reset_cnt = priv->reset_count;
+		}
+
+		// If DIG is off, DIG high power state must reset.
+		dm_digtable.dig_highpwr_state = DM_STA_DIG_MAX;
+		dm_digtable.dig_state = DM_STA_DIG_OFF;
+
+		// 1.1 DIG Off.
+		rtl8192_setBBreg(dev, UFWP, bMaskByte1, 0x8);	// Only clear byte 1 and rewrite.
+
+		// 1.2 Set initial gain.
+		write_nic_byte(dev, rOFDM0_XAAGCCore1, 0x17);
+		write_nic_byte(dev, rOFDM0_XBAGCCore1, 0x17);
+		write_nic_byte(dev, rOFDM0_XCAGCCore1, 0x17);
+		write_nic_byte(dev, rOFDM0_XDAGCCore1, 0x17);
+
+		// 1.3 Lower PD_TH for OFDM.
+		if (priv->CurrentChannelBW != HT_CHANNEL_WIDTH_20)
+		{
+			/* 2008/01/11 MH 40MHZ 90/92 register are not the same. */
+			// 2008/02/05 MH SD3-Jerry 92U/92E PD_TH are the same.
+			#ifdef RTL8190P
+				write_nic_byte(dev, rOFDM0_RxDetector1, 0x40);
+			#else
+				write_nic_byte(dev, (rOFDM0_XATxAFE+3), 0x00);
+			#endif
+			/*else if (priv->card_8192 == HARDWARE_TYPE_RTL8190P)
+				write_nic_byte(pAdapter, rOFDM0_RxDetector1, 0x40);
+			*/
+			//else if (pAdapter->HardwareType == HARDWARE_TYPE_RTL8192E)
+
+
+			//else
+				//PlatformEFIOWrite1Byte(pAdapter, rOFDM0_RxDetector1, 0x40);
+		}
+		else
+			write_nic_byte(dev, rOFDM0_RxDetector1, 0x42);
+
+		// 1.4 Lower CS ratio for CCK.
+		write_nic_byte(dev, 0xa0a, 0x08);
+
+		// 1.5 Higher EDCCA.
+		//PlatformEFIOWrite4Byte(pAdapter, rOFDM0_ECCAThreshold, 0x325);
+		return;
+
+	}
+
+	/* 2. When RSSI increase, We have to judge if it is larger than a treshold
+		  and then execute below step.  */
+	if ((priv->undecorated_smoothed_pwdb >= dm_digtable.rssi_high_thresh) )
+	{
+		u8 reset_flag = 0;
+
+		if (dm_digtable.dig_state == DM_STA_DIG_ON &&
+			(priv->reset_count == reset_cnt))
+		{
+			dm_ctrl_initgain_byrssi_highpwr(dev);
+			return;
+		}
+		else
+		{
+			if (priv->reset_count != reset_cnt)
+				reset_flag = 1;
+
+			reset_cnt = priv->reset_count;
+		}
+
+		dm_digtable.dig_state = DM_STA_DIG_ON;
+		//DbgPrint("DIG ON\n\r");
+
+		// 2.1 Set initial gain.
+		// 2008/02/26 MH SD3-Jerry suggest to prevent dirty environment.
+		if (reset_flag == 1)
+		{
+			write_nic_byte(dev, rOFDM0_XAAGCCore1, 0x2c);
+			write_nic_byte(dev, rOFDM0_XBAGCCore1, 0x2c);
+			write_nic_byte(dev, rOFDM0_XCAGCCore1, 0x2c);
+			write_nic_byte(dev, rOFDM0_XDAGCCore1, 0x2c);
+		}
+		else
+		{
+			write_nic_byte(dev, rOFDM0_XAAGCCore1, 0x20);
+			write_nic_byte(dev, rOFDM0_XBAGCCore1, 0x20);
+			write_nic_byte(dev, rOFDM0_XCAGCCore1, 0x20);
+			write_nic_byte(dev, rOFDM0_XDAGCCore1, 0x20);
+		}
+
+		// 2.2 Higher PD_TH for OFDM.
+		if (priv->CurrentChannelBW != HT_CHANNEL_WIDTH_20)
+		{
+			/* 2008/01/11 MH 40MHZ 90/92 register are not the same. */
+			// 2008/02/05 MH SD3-Jerry 92U/92E PD_TH are the same.
+			#ifdef RTL8190P
+				write_nic_byte(dev, rOFDM0_RxDetector1, 0x42);
+			#else
+				write_nic_byte(dev, (rOFDM0_XATxAFE+3), 0x20);
+			#endif
+			/*
+			else if (priv->card_8192 == HARDWARE_TYPE_RTL8190P)
+				write_nic_byte(dev, rOFDM0_RxDetector1, 0x42);
+			*/
+			//else if (pAdapter->HardwareType == HARDWARE_TYPE_RTL8192E)
+
+			//else
+				//PlatformEFIOWrite1Byte(pAdapter, rOFDM0_RxDetector1, 0x42);
+		}
+		else
+			write_nic_byte(dev, rOFDM0_RxDetector1, 0x44);
+
+		// 2.3 Higher CS ratio for CCK.
+		write_nic_byte(dev, 0xa0a, 0xcd);
+
+		// 2.4 Lower EDCCA.
+		/* 2008/01/11 MH 90/92 series are the same. */
+		//PlatformEFIOWrite4Byte(pAdapter, rOFDM0_ECCAThreshold, 0x346);
+
+		// 2.5 DIG On.
+		rtl8192_setBBreg(dev, UFWP, bMaskByte1, 0x1);	// Only clear byte 1 and rewrite.
+
+	}
+
+	dm_ctrl_initgain_byrssi_highpwr(dev);
+
+}	/* dm_CtrlInitGainByRssi */
+
+
+/*-----------------------------------------------------------------------------
+ * Function:	dm_ctrl_initgain_byrssi_highpwr()
+ *
+ * Overview:
+ *
+ * Input:		NONE
+ *
+ * Output:		NONE
+ *
+ * Return:		NONE
+ *
+ * Revised History:
+ *	When		Who		Remark
+ *	05/28/2008	amy		Create Version 0 porting from windows code.
+ *
+ *---------------------------------------------------------------------------*/
+static void dm_ctrl_initgain_byrssi_highpwr(
+	struct net_device * dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	static u32 reset_cnt_highpwr = 0;
+
+	// For smooth, we can not change high power DIG state in the range.
+	if ((priv->undecorated_smoothed_pwdb > dm_digtable.rssi_high_power_lowthresh) &&
+		(priv->undecorated_smoothed_pwdb < dm_digtable.rssi_high_power_highthresh))
+	{
+		return;
+	}
+
+	/* 3. When RSSI >75% or <70%, it is a high power issue. We have to judge if
+		  it is larger than a treshold and then execute below step.  */
+	// 2008/02/05 MH SD3-Jerry Modify PD_TH for high power issue.
+	if (priv->undecorated_smoothed_pwdb >= dm_digtable.rssi_high_power_highthresh)
+	{
+		if (dm_digtable.dig_highpwr_state == DM_STA_DIG_ON &&
+			(priv->reset_count == reset_cnt_highpwr))
+			return;
+		else
+			dm_digtable.dig_highpwr_state = DM_STA_DIG_ON;
+
+		// 3.1 Higher PD_TH for OFDM for high power state.
+		if (priv->CurrentChannelBW != HT_CHANNEL_WIDTH_20)
+		{
+			#ifdef RTL8190P
+				write_nic_byte(dev, rOFDM0_RxDetector1, 0x41);
+			#else
+				write_nic_byte(dev, (rOFDM0_XATxAFE+3), 0x10);
+			#endif
+
+			/*else if (priv->card_8192 == HARDWARE_TYPE_RTL8190P)
+				write_nic_byte(dev, rOFDM0_RxDetector1, 0x41);
+			*/
+
+		}
+		else
+			write_nic_byte(dev, rOFDM0_RxDetector1, 0x43);
+	}
+	else
+	{
+		if (dm_digtable.dig_highpwr_state == DM_STA_DIG_OFF&&
+			(priv->reset_count == reset_cnt_highpwr))
+			return;
+		else
+			dm_digtable.dig_highpwr_state = DM_STA_DIG_OFF;
+
+		if (priv->undecorated_smoothed_pwdb < dm_digtable.rssi_high_power_lowthresh &&
+			 priv->undecorated_smoothed_pwdb >= dm_digtable.rssi_high_thresh)
+		{
+			// 3.2 Recover PD_TH for OFDM for normal power region.
+			if (priv->CurrentChannelBW != HT_CHANNEL_WIDTH_20)
+			{
+				#ifdef RTL8190P
+					write_nic_byte(dev, rOFDM0_RxDetector1, 0x42);
+				#else
+					write_nic_byte(dev, (rOFDM0_XATxAFE+3), 0x20);
+				#endif
+				/*else if (priv->card_8192 == HARDWARE_TYPE_RTL8190P)
+					write_nic_byte(dev, rOFDM0_RxDetector1, 0x42);
+				*/
+
+			}
+			else
+				write_nic_byte(dev, rOFDM0_RxDetector1, 0x44);
+		}
+	}
+
+	reset_cnt_highpwr = priv->reset_count;
+
+}	/* dm_CtrlInitGainByRssiHighPwr */
+
+
+static void dm_initial_gain(
+	struct net_device * dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	u8					initial_gain=0;
+	static u8				initialized=0, force_write=0;
+	static u32			reset_cnt=0;
+
+	if(dm_digtable.dig_algorithm_switch)
+	{
+		initialized = 0;
+		reset_cnt = 0;
+	}
+
+	if(dm_digtable.pre_connect_state == dm_digtable.cur_connect_state)
+	{
+		if(dm_digtable.cur_connect_state == DIG_CONNECT)
+		{
+			if((dm_digtable.rssi_val+10-dm_digtable.backoff_val) > dm_digtable.rx_gain_range_max)
+				dm_digtable.cur_ig_value = dm_digtable.rx_gain_range_max;
+			else if((dm_digtable.rssi_val+10-dm_digtable.backoff_val) < dm_digtable.rx_gain_range_min)
+				dm_digtable.cur_ig_value = dm_digtable.rx_gain_range_min;
+			else
+				dm_digtable.cur_ig_value = dm_digtable.rssi_val+10-dm_digtable.backoff_val;
+		}
+		else		//current state is disconnected
+		{
+			if(dm_digtable.cur_ig_value == 0)
+				dm_digtable.cur_ig_value = priv->DefaultInitialGain[0];
+			else
+				dm_digtable.cur_ig_value = dm_digtable.pre_ig_value;
+		}
+	}
+	else	// disconnected -> connected or connected -> disconnected
+	{
+		dm_digtable.cur_ig_value = priv->DefaultInitialGain[0];
+		dm_digtable.pre_ig_value = 0;
+	}
+	//DbgPrint("DM_DigTable.CurIGValue = 0x%x, DM_DigTable.PreIGValue = 0x%x\n", DM_DigTable.CurIGValue, DM_DigTable.PreIGValue);
+
+	// if silent reset happened, we should rewrite the values back
+	if(priv->reset_count != reset_cnt)
+	{
+		force_write = 1;
+		reset_cnt = priv->reset_count;
+	}
+
+	if(dm_digtable.pre_ig_value != read_nic_byte(dev, rOFDM0_XAAGCCore1))
+		force_write = 1;
+
+	{
+		if((dm_digtable.pre_ig_value != dm_digtable.cur_ig_value)
+			|| !initialized || force_write)
+		{
+			initial_gain = (u8)dm_digtable.cur_ig_value;
+			//DbgPrint("Write initial gain = 0x%x\n", initial_gain);
+			// Set initial gain.
+			write_nic_byte(dev, rOFDM0_XAAGCCore1, initial_gain);
+			write_nic_byte(dev, rOFDM0_XBAGCCore1, initial_gain);
+			write_nic_byte(dev, rOFDM0_XCAGCCore1, initial_gain);
+			write_nic_byte(dev, rOFDM0_XDAGCCore1, initial_gain);
+			dm_digtable.pre_ig_value = dm_digtable.cur_ig_value;
+			initialized = 1;
+			force_write = 0;
+		}
+	}
+}
+
+static void dm_pd_th(
+	struct net_device * dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	static u8				initialized=0, force_write=0;
+	static u32			reset_cnt = 0;
+
+	if(dm_digtable.dig_algorithm_switch)
+	{
+		initialized = 0;
+		reset_cnt = 0;
+	}
+
+	if(dm_digtable.pre_connect_state == dm_digtable.cur_connect_state)
+	{
+		if(dm_digtable.cur_connect_state == DIG_CONNECT)
+		{
+			if (dm_digtable.rssi_val >= dm_digtable.rssi_high_power_highthresh)
+				dm_digtable.curpd_thstate = DIG_PD_AT_HIGH_POWER;
+			else if ((dm_digtable.rssi_val <= dm_digtable.rssi_low_thresh))
+				dm_digtable.curpd_thstate = DIG_PD_AT_LOW_POWER;
+			else if ((dm_digtable.rssi_val >= dm_digtable.rssi_high_thresh) &&
+					(dm_digtable.rssi_val < dm_digtable.rssi_high_power_lowthresh))
+				dm_digtable.curpd_thstate = DIG_PD_AT_NORMAL_POWER;
+			else
+				dm_digtable.curpd_thstate = dm_digtable.prepd_thstate;
+		}
+		else
+		{
+			dm_digtable.curpd_thstate = DIG_PD_AT_LOW_POWER;
+		}
+	}
+	else	// disconnected -> connected or connected -> disconnected
+	{
+		dm_digtable.curpd_thstate = DIG_PD_AT_LOW_POWER;
+	}
+
+	// if silent reset happened, we should rewrite the values back
+	if(priv->reset_count != reset_cnt)
+	{
+		force_write = 1;
+		reset_cnt = priv->reset_count;
+	}
+
+	{
+		if((dm_digtable.prepd_thstate != dm_digtable.curpd_thstate) ||
+			(initialized<=3) || force_write)
+		{
+			//DbgPrint("Write PD_TH state = %d\n", DM_DigTable.CurPD_THState);
+			if(dm_digtable.curpd_thstate == DIG_PD_AT_LOW_POWER)
+			{
+				// Lower PD_TH for OFDM.
+				if (priv->CurrentChannelBW != HT_CHANNEL_WIDTH_20)
+				{
+					/* 2008/01/11 MH 40MHZ 90/92 register are not the same. */
+					// 2008/02/05 MH SD3-Jerry 92U/92E PD_TH are the same.
+					#ifdef RTL8190P
+						write_nic_byte(dev, rOFDM0_RxDetector1, 0x40);
+					#else
+						write_nic_byte(dev, (rOFDM0_XATxAFE+3), 0x00);
+					#endif
+					/*else if (priv->card_8192 == HARDWARE_TYPE_RTL8190P)
+						write_nic_byte(dev, rOFDM0_RxDetector1, 0x40);
+					*/
+				}
+				else
+					write_nic_byte(dev, rOFDM0_RxDetector1, 0x42);
+			}
+			else if(dm_digtable.curpd_thstate == DIG_PD_AT_NORMAL_POWER)
+			{
+				// Higher PD_TH for OFDM.
+				if (priv->CurrentChannelBW != HT_CHANNEL_WIDTH_20)
+				{
+					/* 2008/01/11 MH 40MHZ 90/92 register are not the same. */
+					// 2008/02/05 MH SD3-Jerry 92U/92E PD_TH are the same.
+					#ifdef RTL8190P
+						write_nic_byte(dev, rOFDM0_RxDetector1, 0x42);
+					#else
+						write_nic_byte(dev, (rOFDM0_XATxAFE+3), 0x20);
+					#endif
+					/*else if (priv->card_8192 == HARDWARE_TYPE_RTL8190P)
+						write_nic_byte(dev, rOFDM0_RxDetector1, 0x42);
+					*/
+				}
+				else
+					write_nic_byte(dev, rOFDM0_RxDetector1, 0x44);
+			}
+			else if(dm_digtable.curpd_thstate == DIG_PD_AT_HIGH_POWER)
+			{
+				// Higher PD_TH for OFDM for high power state.
+				if (priv->CurrentChannelBW != HT_CHANNEL_WIDTH_20)
+				{
+					#ifdef RTL8190P
+						write_nic_byte(dev, rOFDM0_RxDetector1, 0x41);
+					#else
+						write_nic_byte(dev, (rOFDM0_XATxAFE+3), 0x10);
+					#endif
+					/*else if (priv->card_8192 == HARDWARE_TYPE_RTL8190P)
+						write_nic_byte(dev, rOFDM0_RxDetector1, 0x41);
+					*/
+				}
+				else
+					write_nic_byte(dev, rOFDM0_RxDetector1, 0x43);
+			}
+			dm_digtable.prepd_thstate = dm_digtable.curpd_thstate;
+			if(initialized <= 3)
+				initialized++;
+			force_write = 0;
+		}
+	}
+}
+
+static	void dm_cs_ratio(
+	struct net_device * dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	static u8				initialized=0,force_write=0;
+	static u32			reset_cnt = 0;
+
+	if(dm_digtable.dig_algorithm_switch)
+	{
+		initialized = 0;
+		reset_cnt = 0;
+	}
+
+	if(dm_digtable.pre_connect_state == dm_digtable.cur_connect_state)
+	{
+		if(dm_digtable.cur_connect_state == DIG_CONNECT)
+		{
+			if ((dm_digtable.rssi_val <= dm_digtable.rssi_low_thresh))
+				dm_digtable.curcs_ratio_state = DIG_CS_RATIO_LOWER;
+			else if ((dm_digtable.rssi_val >= dm_digtable.rssi_high_thresh) )
+				dm_digtable.curcs_ratio_state = DIG_CS_RATIO_HIGHER;
+			else
+				dm_digtable.curcs_ratio_state = dm_digtable.precs_ratio_state;
+		}
+		else
+		{
+			dm_digtable.curcs_ratio_state = DIG_CS_RATIO_LOWER;
+		}
+	}
+	else	// disconnected -> connected or connected -> disconnected
+	{
+		dm_digtable.curcs_ratio_state = DIG_CS_RATIO_LOWER;
+	}
+
+	// if silent reset happened, we should rewrite the values back
+	if(priv->reset_count != reset_cnt)
+	{
+		force_write = 1;
+		reset_cnt = priv->reset_count;
+	}
+
+
+	{
+		if((dm_digtable.precs_ratio_state != dm_digtable.curcs_ratio_state) ||
+			!initialized || force_write)
+		{
+			//DbgPrint("Write CS_ratio state = %d\n", DM_DigTable.CurCS_ratioState);
+			if(dm_digtable.curcs_ratio_state == DIG_CS_RATIO_LOWER)
+			{
+				// Lower CS ratio for CCK.
+				write_nic_byte(dev, 0xa0a, 0x08);
+			}
+			else if(dm_digtable.curcs_ratio_state == DIG_CS_RATIO_HIGHER)
+			{
+				// Higher CS ratio for CCK.
+				write_nic_byte(dev, 0xa0a, 0xcd);
+			}
+			dm_digtable.precs_ratio_state = dm_digtable.curcs_ratio_state;
+			initialized = 1;
+			force_write = 0;
+		}
+	}
+}
+
+extern void dm_init_edca_turbo(struct net_device * dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+	priv->bcurrent_turbo_EDCA = false;
+	priv->ieee80211->bis_any_nonbepkts = false;
+	priv->bis_cur_rdlstate = false;
+}	// dm_init_edca_turbo
+
+static void dm_check_edca_turbo(
+	struct net_device * dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	PRT_HIGH_THROUGHPUT	pHTInfo = priv->ieee80211->pHTInfo;
+	//PSTA_QOS			pStaQos = pMgntInfo->pStaQos;
+
+	// Keep past Tx/Rx packet count for RT-to-RT EDCA turbo.
+	static unsigned long			lastTxOkCnt = 0;
+	static unsigned long			lastRxOkCnt = 0;
+	unsigned long				curTxOkCnt = 0;
+	unsigned long				curRxOkCnt = 0;
+
+	//
+	// Do not be Turbo if it's under WiFi config and Qos Enabled, because the EDCA parameters
+	// should follow the settings from QAP. By Bruce, 2007-12-07.
+	//
+	if(priv->ieee80211->state != IEEE80211_LINKED)
+		goto dm_CheckEdcaTurbo_EXIT;
+	// We do not turn on EDCA turbo mode for some AP that has IOT issue
+	if(priv->ieee80211->pHTInfo->IOTAction & HT_IOT_ACT_DISABLE_EDCA_TURBO)
+		goto dm_CheckEdcaTurbo_EXIT;
+
+//	printk("========>%s():bis_any_nonbepkts is %d\n",__FUNCTION__,priv->bis_any_nonbepkts);
+	// Check the status for current condition.
+	if(!priv->ieee80211->bis_any_nonbepkts)
+	{
+		curTxOkCnt = priv->stats.txbytesunicast - lastTxOkCnt;
+		curRxOkCnt = priv->stats.rxbytesunicast - lastRxOkCnt;
+		// For RT-AP, we needs to turn it on when Rx>Tx
+		if(curRxOkCnt > 4*curTxOkCnt)
+		{
+			//printk("%s():curRxOkCnt > 4*curTxOkCnt\n");
+			if(!priv->bis_cur_rdlstate || !priv->bcurrent_turbo_EDCA)
+			{
+				write_nic_dword(dev, EDCAPARA_BE, edca_setting_DL[pHTInfo->IOTPeer]);
+				priv->bis_cur_rdlstate = true;
+			}
+		}
+		else
+		{
+
+			//printk("%s():curRxOkCnt < 4*curTxOkCnt\n");
+			if(priv->bis_cur_rdlstate || !priv->bcurrent_turbo_EDCA)
+			{
+				write_nic_dword(dev, EDCAPARA_BE, edca_setting_UL[pHTInfo->IOTPeer]);
+				priv->bis_cur_rdlstate = false;
+			}
+
+		}
+
+		priv->bcurrent_turbo_EDCA = true;
+	}
+	else
+	{
+		//
+		// Turn Off EDCA turbo here.
+		// Restore original EDCA according to the declaration of AP.
+		//
+		 if(priv->bcurrent_turbo_EDCA)
+		{
+
+			{
+				u8		u1bAIFS;
+				u32		u4bAcParam;
+				struct ieee80211_qos_parameters *qos_parameters = &priv->ieee80211->current_network.qos_data.parameters;
+				u8 mode = priv->ieee80211->mode;
+
+			// For Each time updating EDCA parameter, reset EDCA turbo mode status.
+				dm_init_edca_turbo(dev);
+				u1bAIFS = qos_parameters->aifs[0] * ((mode&(IEEE_G|IEEE_N_24G)) ?9:20) + aSifsTime;
+				u4bAcParam = ((((u32)(qos_parameters->tx_op_limit[0]))<< AC_PARAM_TXOP_LIMIT_OFFSET)|
+					(((u32)(qos_parameters->cw_max[0]))<< AC_PARAM_ECW_MAX_OFFSET)|
+					(((u32)(qos_parameters->cw_min[0]))<< AC_PARAM_ECW_MIN_OFFSET)|
+					((u32)u1bAIFS << AC_PARAM_AIFS_OFFSET));
+			//write_nic_dword(dev, WDCAPARA_ADD[i], u4bAcParam);
+				write_nic_dword(dev, EDCAPARA_BE,  u4bAcParam);
+
+			// Check ACM bit.
+			// If it is set, immediately set ACM control bit to downgrading AC for passing WMM testplan. Annie, 2005-12-13.
+				{
+			// TODO:  Modified this part and try to set acm control in only 1 IO processing!!
+
+					PACI_AIFSN	pAciAifsn = (PACI_AIFSN)&(qos_parameters->aifs[0]);
+					u8		AcmCtrl = read_nic_byte( dev, AcmHwCtrl );
+					if( pAciAifsn->f.ACM )
+					{ // ACM bit is 1.
+						AcmCtrl |= AcmHw_BeqEn;
+					}
+					else
+					{ // ACM bit is 0.
+						AcmCtrl &= (~AcmHw_BeqEn);
+					}
+
+					RT_TRACE( COMP_QOS,"SetHwReg8190pci(): [HW_VAR_ACM_CTRL] Write 0x%X\n", AcmCtrl ) ;
+					write_nic_byte(dev, AcmHwCtrl, AcmCtrl );
+				}
+			}
+			priv->bcurrent_turbo_EDCA = false;
+		}
+	}
+
+
+dm_CheckEdcaTurbo_EXIT:
+	// Set variables for next time.
+	priv->ieee80211->bis_any_nonbepkts = false;
+	lastTxOkCnt = priv->stats.txbytesunicast;
+	lastRxOkCnt = priv->stats.rxbytesunicast;
+}	// dm_CheckEdcaTurbo
+
+extern void DM_CTSToSelfSetting(struct net_device * dev,u32 DM_Type, u32 DM_Value)
+{
+	struct r8192_priv *priv = ieee80211_priv((struct net_device *)dev);
+
+	if (DM_Type == 0)	// CTS to self disable/enable
+	{
+		if(DM_Value > 1)
+			DM_Value = 1;
+		priv->ieee80211->bCTSToSelfEnable = (bool)DM_Value;
+		//DbgPrint("pMgntInfo->bCTSToSelfEnable = %d\n", pMgntInfo->bCTSToSelfEnable);
+	}
+	else if(DM_Type == 1) //CTS to self Th
+	{
+		if(DM_Value >= 50)
+			DM_Value = 50;
+		priv->ieee80211->CTSToSelfTH = (u8)DM_Value;
+		//DbgPrint("pMgntInfo->CTSToSelfTH = %d\n", pMgntInfo->CTSToSelfTH);
+	}
+}
+
+static void dm_init_ctstoself(struct net_device * dev)
+{
+	struct r8192_priv *priv = ieee80211_priv((struct net_device *)dev);
+
+	priv->ieee80211->bCTSToSelfEnable = TRUE;
+	priv->ieee80211->CTSToSelfTH = CTSToSelfTHVal;
+}
+
+static void dm_ctstoself(struct net_device *dev)
+{
+	struct r8192_priv *priv = ieee80211_priv((struct net_device *)dev);
+	PRT_HIGH_THROUGHPUT	pHTInfo = priv->ieee80211->pHTInfo;
+	static unsigned long				lastTxOkCnt = 0;
+	static unsigned long				lastRxOkCnt = 0;
+	unsigned long						curTxOkCnt = 0;
+	unsigned long						curRxOkCnt = 0;
+
+	if(priv->ieee80211->bCTSToSelfEnable != TRUE)
+	{
+		pHTInfo->IOTAction &= ~HT_IOT_ACT_FORCED_CTS2SELF;
+		return;
+	}
+	/*
+	1. Uplink
+	2. Linksys350/Linksys300N
+	3. <50 disable, >55 enable
+	*/
+
+	if(pHTInfo->IOTPeer == HT_IOT_PEER_BROADCOM)
+	{
+		curTxOkCnt = priv->stats.txbytesunicast - lastTxOkCnt;
+		curRxOkCnt = priv->stats.rxbytesunicast - lastRxOkCnt;
+		if(curRxOkCnt > 4*curTxOkCnt)	//downlink, disable CTS to self
+		{
+			pHTInfo->IOTAction &= ~HT_IOT_ACT_FORCED_CTS2SELF;
+			//DbgPrint("dm_CTSToSelf() ==> CTS to self disabled -- downlink\n");
+		}
+		else	//uplink
+		{
+			pHTInfo->IOTAction |= HT_IOT_ACT_FORCED_CTS2SELF;
+		}
+
+		lastTxOkCnt = priv->stats.txbytesunicast;
+		lastRxOkCnt = priv->stats.rxbytesunicast;
+	}
+}
+
+
+/*-----------------------------------------------------------------------------
+ * Function:	dm_check_rfctrl_gpio()
+ *
+ * Overview:	Copy 8187B template for 9xseries.
+ *
+ * Input:		NONE
+ *
+ * Output:		NONE
+ *
+ * Return:		NONE
+ *
+ * Revised History:
+ *	When		Who		Remark
+ *	05/28/2008	amy		Create Version 0 porting from windows code.
+ *
+ *---------------------------------------------------------------------------*/
+static void dm_check_rfctrl_gpio(struct net_device * dev)
+{
+	//struct r8192_priv *priv = ieee80211_priv(dev);
+
+	// Walk around for DTM test, we will not enable HW - radio on/off because r/w
+	// page 1 register before Lextra bus is enabled cause system fails when resuming
+	// from S4. 20080218, Emily
+
+	// Stop to execute workitem to prevent S3/S4 bug.
+#ifdef RTL8190P
+	return;
+#endif
+#ifdef RTL8192U
+	return;
+#endif
+#ifdef RTL8192E
+		queue_delayed_work(priv->priv_wq,&priv->gpio_change_rf_wq,0);
+#endif
+
+}	/* dm_CheckRfCtrlGPIO */
+
+/*-----------------------------------------------------------------------------
+ * Function:	dm_check_pbc_gpio()
+ *
+ * Overview:	Check if PBC button is pressed.
+ *
+ * Input:		NONE
+ *
+ * Output:		NONE
+ *
+ * Return:		NONE
+ *
+ * Revised History:
+ *	When		Who		Remark
+ *	05/28/2008	amy 	Create Version 0 porting from windows code.
+ *
+ *---------------------------------------------------------------------------*/
+static	void	dm_check_pbc_gpio(struct net_device *dev)
+{
+#ifdef RTL8192U
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	u8 tmp1byte;
+
+
+	tmp1byte = read_nic_byte(dev,GPI);
+	if(tmp1byte == 0xff)
+		return;
+
+	if (tmp1byte&BIT6 || tmp1byte&BIT0)
+	{
+		// Here we only set bPbcPressed to TRUE
+		// After trigger PBC, the variable will be set to FALSE
+		RT_TRACE(COMP_IO, "CheckPbcGPIO - PBC is pressed\n");
+		priv->bpbc_pressed = true;
+	}
+#endif
+
+}
+
+#ifdef RTL8192E
+
+/*-----------------------------------------------------------------------------
+ * Function:	dm_GPIOChangeRF
+ * Overview:	PCI will not support workitem call back HW radio on-off control.
+ *
+ * Input:		NONE
+ *
+ * Output:		NONE
+ *
+ * Return:		NONE
+ *
+ * Revised History:
+ *	When		Who		Remark
+ *	02/21/2008	MHC		Create Version 0.
+ *
+ *---------------------------------------------------------------------------*/
+extern	void	dm_gpio_change_rf_callback(struct work_struct *work)
+{
+	struct delayed_work *dwork = container_of(work,struct delayed_work,work);
+       struct r8192_priv *priv = container_of(dwork,struct r8192_priv,gpio_change_rf_wq);
+       struct net_device *dev = priv->ieee80211->dev;
+	u8 tmp1byte;
+	RT_RF_POWER_STATE	eRfPowerStateToSet;
+	bool bActuallySet = false;
+
+	do{
+		bActuallySet=false;
+
+		if(!priv->up)
+		{
+			RT_TRACE((COMP_INIT | COMP_POWER | COMP_RF),"dm_gpio_change_rf_callback(): Callback function breaks out!!\n");
+		}
+		else
+		{
+			// 0x108 GPIO input register is read only
+			//set 0x108 B1= 1: RF-ON; 0: RF-OFF.
+			tmp1byte = read_nic_byte(dev,GPI);
+
+			eRfPowerStateToSet = (tmp1byte&BIT1) ?  eRfOn : eRfOff;
+
+			if( (priv->bHwRadioOff == true) && (eRfPowerStateToSet == eRfOn))
+			{
+				RT_TRACE(COMP_RF, "gpiochangeRF  - HW Radio ON\n");
+
+				priv->bHwRadioOff = false;
+				bActuallySet = true;
+			}
+			else if ( (priv->bHwRadioOff == false) && (eRfPowerStateToSet == eRfOff))
+			{
+				RT_TRACE(COMP_RF, "gpiochangeRF  - HW Radio OFF\n");
+				priv->bHwRadioOff = true;
+				bActuallySet = true;
+			}
+
+			if(bActuallySet)
+			{
+				#ifdef TO_DO
+				MgntActSet_RF_State(dev, eRfPowerStateToSet, RF_CHANGE_BY_HW);
+				//DrvIFIndicateCurrentPhyStatus(pAdapter);
+				#endif
+			}
+			else
+			{
+				msleep(2000);
+			}
+
+		}
+	}while(TRUE)
+
+}	/* dm_GPIOChangeRF */
+
+#endif
+/*-----------------------------------------------------------------------------
+ * Function:	DM_RFPathCheckWorkItemCallBack()
+ *
+ * Overview:	Check if Current RF RX path is enabled
+ *
+ * Input:		NONE
+ *
+ * Output:		NONE
+ *
+ * Return:		NONE
+ *
+ * Revised History:
+ *	When		Who		Remark
+ *	01/30/2008	MHC		Create Version 0.
+ *
+ *---------------------------------------------------------------------------*/
+extern	void	dm_rf_pathcheck_workitemcallback(struct work_struct *work)
+{
+	struct delayed_work *dwork = container_of(work,struct delayed_work,work);
+       struct r8192_priv *priv = container_of(dwork,struct r8192_priv,rfpath_check_wq);
+       struct net_device *dev =priv->ieee80211->dev;
+	//bool bactually_set = false;
+	u8 rfpath = 0, i;
+
+
+	/* 2008/01/30 MH After discussing with SD3 Jerry, 0xc04/0xd04 register will
+	   always be the same. We only read 0xc04 now. */
+	rfpath = read_nic_byte(dev, 0xc04);
+
+	// Check Bit 0-3, it means if RF A-D is enabled.
+	for (i = 0; i < RF90_PATH_MAX; i++)
+	{
+		if (rfpath & (0x01<<i))
+			priv->brfpath_rxenable[i] = 1;
+		else
+			priv->brfpath_rxenable[i] = 0;
+	}
+	if(!DM_RxPathSelTable.Enable)
+		return;
+
+	dm_rxpath_sel_byrssi(dev);
+}	/* DM_RFPathCheckWorkItemCallBack */
+
+static void dm_init_rxpath_selection(struct net_device * dev)
+{
+	u8 i;
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	DM_RxPathSelTable.Enable = 1;	//default enabled
+	DM_RxPathSelTable.SS_TH_low = RxPathSelection_SS_TH_low;
+	DM_RxPathSelTable.diff_TH = RxPathSelection_diff_TH;
+	if(priv->CustomerID == RT_CID_819x_Netcore)
+		DM_RxPathSelTable.cck_method = CCK_Rx_Version_2;
+	else
+		DM_RxPathSelTable.cck_method = CCK_Rx_Version_1;
+	DM_RxPathSelTable.DbgMode = DM_DBG_OFF;
+	DM_RxPathSelTable.disabledRF = 0;
+	for(i=0; i<4; i++)
+	{
+		DM_RxPathSelTable.rf_rssi[i] = 50;
+		DM_RxPathSelTable.cck_pwdb_sta[i] = -64;
+		DM_RxPathSelTable.rf_enable_rssi_th[i] = 100;
+	}
+}
+
+static void dm_rxpath_sel_byrssi(struct net_device * dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	u8				i, max_rssi_index=0, min_rssi_index=0, sec_rssi_index=0, rf_num=0;
+	u8				tmp_max_rssi=0, tmp_min_rssi=0, tmp_sec_rssi=0;
+	u8				cck_default_Rx=0x2;	//RF-C
+	u8				cck_optional_Rx=0x3;//RF-D
+	long				tmp_cck_max_pwdb=0, tmp_cck_min_pwdb=0, tmp_cck_sec_pwdb=0;
+	u8				cck_rx_ver2_max_index=0, cck_rx_ver2_min_index=0, cck_rx_ver2_sec_index=0;
+	u8				cur_rf_rssi;
+	long				cur_cck_pwdb;
+	static u8			disabled_rf_cnt=0, cck_Rx_Path_initialized=0;
+	u8				update_cck_rx_path;
+
+	if(priv->rf_type != RF_2T4R)
+		return;
+
+	if(!cck_Rx_Path_initialized)
+	{
+		DM_RxPathSelTable.cck_Rx_path = (read_nic_byte(dev, 0xa07)&0xf);
+		cck_Rx_Path_initialized = 1;
+	}
+
+	DM_RxPathSelTable.disabledRF = 0xf;
+	DM_RxPathSelTable.disabledRF &=~ (read_nic_byte(dev, 0xc04));
+
+	if(priv->ieee80211->mode == WIRELESS_MODE_B)
+	{
+		DM_RxPathSelTable.cck_method = CCK_Rx_Version_2;	//pure B mode, fixed cck version2
+		//DbgPrint("Pure B mode, use cck rx version2 \n");
+	}
+
+	//decide max/sec/min rssi index
+	for (i=0; i<RF90_PATH_MAX; i++)
+	{
+		if(!DM_RxPathSelTable.DbgMode)
+			DM_RxPathSelTable.rf_rssi[i] = priv->stats.rx_rssi_percentage[i];
+
+		if(priv->brfpath_rxenable[i])
+		{
+			rf_num++;
+			cur_rf_rssi = DM_RxPathSelTable.rf_rssi[i];
+
+			if(rf_num == 1)	// find first enabled rf path and the rssi values
+			{	//initialize, set all rssi index to the same one
+				max_rssi_index = min_rssi_index = sec_rssi_index = i;
+				tmp_max_rssi = tmp_min_rssi = tmp_sec_rssi = cur_rf_rssi;
+			}
+			else if(rf_num == 2)
+			{	// we pick up the max index first, and let sec and min to be the same one
+				if(cur_rf_rssi >= tmp_max_rssi)
+				{
+					tmp_max_rssi = cur_rf_rssi;
+					max_rssi_index = i;
+				}
+				else
+				{
+					tmp_sec_rssi = tmp_min_rssi = cur_rf_rssi;
+					sec_rssi_index = min_rssi_index = i;
+				}
+			}
+			else
+			{
+				if(cur_rf_rssi > tmp_max_rssi)
+				{
+					tmp_sec_rssi = tmp_max_rssi;
+					sec_rssi_index = max_rssi_index;
+					tmp_max_rssi = cur_rf_rssi;
+					max_rssi_index = i;
+				}
+				else if(cur_rf_rssi == tmp_max_rssi)
+				{	// let sec and min point to the different index
+					tmp_sec_rssi = cur_rf_rssi;
+					sec_rssi_index = i;
+				}
+				else if((cur_rf_rssi < tmp_max_rssi) &&(cur_rf_rssi > tmp_sec_rssi))
+				{
+					tmp_sec_rssi = cur_rf_rssi;
+					sec_rssi_index = i;
+				}
+				else if(cur_rf_rssi == tmp_sec_rssi)
+				{
+					if(tmp_sec_rssi == tmp_min_rssi)
+					{	// let sec and min point to the different index
+						tmp_sec_rssi = cur_rf_rssi;
+						sec_rssi_index = i;
+					}
+					else
+					{
+						// This case we don't need to set any index
+					}
+				}
+				else if((cur_rf_rssi < tmp_sec_rssi) && (cur_rf_rssi > tmp_min_rssi))
+				{
+					// This case we don't need to set any index
+				}
+				else if(cur_rf_rssi == tmp_min_rssi)
+				{
+					if(tmp_sec_rssi == tmp_min_rssi)
+					{	// let sec and min point to the different index
+						tmp_min_rssi = cur_rf_rssi;
+						min_rssi_index = i;
+					}
+					else
+					{
+						// This case we don't need to set any index
+					}
+				}
+				else if(cur_rf_rssi < tmp_min_rssi)
+				{
+					tmp_min_rssi = cur_rf_rssi;
+					min_rssi_index = i;
+				}
+			}
+		}
+	}
+
+	rf_num = 0;
+	// decide max/sec/min cck pwdb index
+	if(DM_RxPathSelTable.cck_method == CCK_Rx_Version_2)
+	{
+		for (i=0; i<RF90_PATH_MAX; i++)
+		{
+			if(priv->brfpath_rxenable[i])
+			{
+				rf_num++;
+				cur_cck_pwdb =  DM_RxPathSelTable.cck_pwdb_sta[i];
+
+				if(rf_num == 1)	// find first enabled rf path and the rssi values
+				{	//initialize, set all rssi index to the same one
+					cck_rx_ver2_max_index = cck_rx_ver2_min_index = cck_rx_ver2_sec_index = i;
+					tmp_cck_max_pwdb = tmp_cck_min_pwdb = tmp_cck_sec_pwdb = cur_cck_pwdb;
+				}
+				else if(rf_num == 2)
+				{	// we pick up the max index first, and let sec and min to be the same one
+					if(cur_cck_pwdb >= tmp_cck_max_pwdb)
+					{
+						tmp_cck_max_pwdb = cur_cck_pwdb;
+						cck_rx_ver2_max_index = i;
+					}
+					else
+					{
+						tmp_cck_sec_pwdb = tmp_cck_min_pwdb = cur_cck_pwdb;
+						cck_rx_ver2_sec_index = cck_rx_ver2_min_index = i;
+					}
+				}
+				else
+				{
+					if(cur_cck_pwdb > tmp_cck_max_pwdb)
+					{
+						tmp_cck_sec_pwdb = tmp_cck_max_pwdb;
+						cck_rx_ver2_sec_index = cck_rx_ver2_max_index;
+						tmp_cck_max_pwdb = cur_cck_pwdb;
+						cck_rx_ver2_max_index = i;
+					}
+					else if(cur_cck_pwdb == tmp_cck_max_pwdb)
+					{	// let sec and min point to the different index
+						tmp_cck_sec_pwdb = cur_cck_pwdb;
+						cck_rx_ver2_sec_index = i;
+					}
+					else if((cur_cck_pwdb < tmp_cck_max_pwdb) &&(cur_cck_pwdb > tmp_cck_sec_pwdb))
+					{
+						tmp_cck_sec_pwdb = cur_cck_pwdb;
+						cck_rx_ver2_sec_index = i;
+					}
+					else if(cur_cck_pwdb == tmp_cck_sec_pwdb)
+					{
+						if(tmp_cck_sec_pwdb == tmp_cck_min_pwdb)
+						{	// let sec and min point to the different index
+							tmp_cck_sec_pwdb = cur_cck_pwdb;
+							cck_rx_ver2_sec_index = i;
+						}
+						else
+						{
+							// This case we don't need to set any index
+						}
+					}
+					else if((cur_cck_pwdb < tmp_cck_sec_pwdb) && (cur_cck_pwdb > tmp_cck_min_pwdb))
+					{
+						// This case we don't need to set any index
+					}
+					else if(cur_cck_pwdb == tmp_cck_min_pwdb)
+					{
+						if(tmp_cck_sec_pwdb == tmp_cck_min_pwdb)
+						{	// let sec and min point to the different index
+							tmp_cck_min_pwdb = cur_cck_pwdb;
+							cck_rx_ver2_min_index = i;
+						}
+						else
+						{
+							// This case we don't need to set any index
+						}
+					}
+					else if(cur_cck_pwdb < tmp_cck_min_pwdb)
+					{
+						tmp_cck_min_pwdb = cur_cck_pwdb;
+						cck_rx_ver2_min_index = i;
+					}
+				}
+
+			}
+		}
+	}
+
+
+	// Set CCK Rx path
+	// reg0xA07[3:2]=cck default rx path, reg0xa07[1:0]=cck optional rx path.
+	update_cck_rx_path = 0;
+	if(DM_RxPathSelTable.cck_method == CCK_Rx_Version_2)
+	{
+		cck_default_Rx = cck_rx_ver2_max_index;
+		cck_optional_Rx = cck_rx_ver2_sec_index;
+		if(tmp_cck_max_pwdb != -64)
+			update_cck_rx_path = 1;
+	}
+
+	if(tmp_min_rssi < DM_RxPathSelTable.SS_TH_low && disabled_rf_cnt < 2)
+	{
+		if((tmp_max_rssi - tmp_min_rssi) >= DM_RxPathSelTable.diff_TH)
+		{
+			//record the enabled rssi threshold
+			DM_RxPathSelTable.rf_enable_rssi_th[min_rssi_index] = tmp_max_rssi+5;
+			//disable the BB Rx path, OFDM
+			rtl8192_setBBreg(dev, rOFDM0_TRxPathEnable, 0x1<<min_rssi_index, 0x0);	// 0xc04[3:0]
+			rtl8192_setBBreg(dev, rOFDM1_TRxPathEnable, 0x1<<min_rssi_index, 0x0);	// 0xd04[3:0]
+			disabled_rf_cnt++;
+		}
+		if(DM_RxPathSelTable.cck_method == CCK_Rx_Version_1)
+		{
+			cck_default_Rx = max_rssi_index;
+			cck_optional_Rx = sec_rssi_index;
+			if(tmp_max_rssi)
+				update_cck_rx_path = 1;
+		}
+	}
+
+	if(update_cck_rx_path)
+	{
+		DM_RxPathSelTable.cck_Rx_path = (cck_default_Rx<<2)|(cck_optional_Rx);
+		rtl8192_setBBreg(dev, rCCK0_AFESetting, 0x0f000000, DM_RxPathSelTable.cck_Rx_path);
+	}
+
+	if(DM_RxPathSelTable.disabledRF)
+	{
+		for(i=0; i<4; i++)
+		{
+			if((DM_RxPathSelTable.disabledRF>>i) & 0x1)	//disabled rf
+			{
+				if(tmp_max_rssi >= DM_RxPathSelTable.rf_enable_rssi_th[i])
+				{
+					//enable the BB Rx path
+					//DbgPrint("RF-%d is enabled. \n", 0x1<<i);
+					rtl8192_setBBreg(dev, rOFDM0_TRxPathEnable, 0x1<<i, 0x1);	// 0xc04[3:0]
+					rtl8192_setBBreg(dev, rOFDM1_TRxPathEnable, 0x1<<i, 0x1);	// 0xd04[3:0]
+					DM_RxPathSelTable.rf_enable_rssi_th[i] = 100;
+					disabled_rf_cnt--;
+				}
+			}
+		}
+	}
+}
+
+/*-----------------------------------------------------------------------------
+ * Function:	dm_check_rx_path_selection()
+ *
+ * Overview:	Call a workitem to check current RXRF path and Rx Path selection by RSSI.
+ *
+ * Input:		NONE
+ *
+ * Output:		NONE
+ *
+ * Return:		NONE
+ *
+ * Revised History:
+ *	When		Who		Remark
+ *	05/28/2008	amy		Create Version 0 porting from windows code.
+ *
+ *---------------------------------------------------------------------------*/
+static	void	dm_check_rx_path_selection(struct net_device *dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	queue_delayed_work(priv->priv_wq,&priv->rfpath_check_wq,0);
+}	/* dm_CheckRxRFPath */
+
+
+static void dm_init_fsync (struct net_device *dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+	priv->ieee80211->fsync_time_interval = 500;
+	priv->ieee80211->fsync_rate_bitmap = 0x0f000800;
+	priv->ieee80211->fsync_rssi_threshold = 30;
+#ifdef RTL8190P
+	priv->ieee80211->bfsync_enable = true;
+#else
+	priv->ieee80211->bfsync_enable = false;
+#endif
+	priv->ieee80211->fsync_multiple_timeinterval = 3;
+	priv->ieee80211->fsync_firstdiff_ratethreshold= 100;
+	priv->ieee80211->fsync_seconddiff_ratethreshold= 200;
+	priv->ieee80211->fsync_state = Default_Fsync;
+	priv->framesyncMonitor = 1;	// current default 0xc38 monitor on
+
+	init_timer(&priv->fsync_timer);
+	priv->fsync_timer.data = (unsigned long)dev;
+	priv->fsync_timer.function = dm_fsync_timer_callback;
+}
+
+
+static void dm_deInit_fsync(struct net_device *dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	del_timer_sync(&priv->fsync_timer);
+}
+
+extern void dm_fsync_timer_callback(unsigned long data)
+{
+	struct net_device *dev = (struct net_device *)data;
+	struct r8192_priv *priv = ieee80211_priv((struct net_device *)data);
+	u32 rate_index, rate_count = 0, rate_count_diff=0;
+	bool		bSwitchFromCountDiff = false;
+	bool		bDoubleTimeInterval = false;
+
+	if(	priv->ieee80211->state == IEEE80211_LINKED &&
+		priv->ieee80211->bfsync_enable &&
+		(priv->ieee80211->pHTInfo->IOTAction & HT_IOT_ACT_CDD_FSYNC))
+	{
+		 // Count rate 54, MCS [7], [12, 13, 14, 15]
+		u32 rate_bitmap;
+		for(rate_index = 0; rate_index <= 27; rate_index++)
+		{
+			rate_bitmap  = 1 << rate_index;
+			if(priv->ieee80211->fsync_rate_bitmap &  rate_bitmap)
+				rate_count+= priv->stats.received_rate_histogram[1][rate_index];
+		}
+
+		if(rate_count < priv->rate_record)
+			rate_count_diff = 0xffffffff - rate_count + priv->rate_record;
+		else
+			rate_count_diff = rate_count - priv->rate_record;
+		if(rate_count_diff < priv->rateCountDiffRecord)
+		{
+
+			u32 DiffNum = priv->rateCountDiffRecord - rate_count_diff;
+			// Contiune count
+			if(DiffNum >= priv->ieee80211->fsync_seconddiff_ratethreshold)
+				priv->ContiuneDiffCount++;
+			else
+				priv->ContiuneDiffCount = 0;
+
+			// Contiune count over
+			if(priv->ContiuneDiffCount >=2)
+			{
+				bSwitchFromCountDiff = true;
+				priv->ContiuneDiffCount = 0;
+			}
+		}
+		else
+		{
+			// Stop contiune count
+			priv->ContiuneDiffCount = 0;
+		}
+
+		//If Count diff <= FsyncRateCountThreshold
+		if(rate_count_diff <= priv->ieee80211->fsync_firstdiff_ratethreshold)
+		{
+			bSwitchFromCountDiff = true;
+			priv->ContiuneDiffCount = 0;
+		}
+		priv->rate_record = rate_count;
+		priv->rateCountDiffRecord = rate_count_diff;
+		RT_TRACE(COMP_HALDM, "rateRecord %d rateCount %d, rateCountdiff %d bSwitchFsync %d\n", priv->rate_record, rate_count, rate_count_diff , priv->bswitch_fsync);
+		// if we never receive those mcs rate and rssi > 30 % then switch fsyn
+		if(priv->undecorated_smoothed_pwdb > priv->ieee80211->fsync_rssi_threshold && bSwitchFromCountDiff)
+		{
+			bDoubleTimeInterval = true;
+			priv->bswitch_fsync = !priv->bswitch_fsync;
+			if(priv->bswitch_fsync)
+			{
+			#ifdef RTL8190P
+				write_nic_byte(dev, 0xC36, 0x00);
+			#else
+				write_nic_byte(dev,0xC36, 0x1c);
+			#endif
+				write_nic_byte(dev, 0xC3e, 0x90);
+			}
+			else
+			{
+			#ifdef RTL8190P
+				write_nic_byte(dev, 0xC36, 0x40);
+			#else
+				write_nic_byte(dev, 0xC36, 0x5c);
+			#endif
+				write_nic_byte(dev, 0xC3e, 0x96);
+			}
+		}
+		else if(priv->undecorated_smoothed_pwdb <= priv->ieee80211->fsync_rssi_threshold)
+		{
+			if(priv->bswitch_fsync)
+			{
+				priv->bswitch_fsync  = false;
+			#ifdef RTL8190P
+				write_nic_byte(dev, 0xC36, 0x40);
+			#else
+				write_nic_byte(dev, 0xC36, 0x5c);
+			#endif
+				write_nic_byte(dev, 0xC3e, 0x96);
+			}
+		}
+		if(bDoubleTimeInterval){
+			if(timer_pending(&priv->fsync_timer))
+				del_timer_sync(&priv->fsync_timer);
+			priv->fsync_timer.expires = jiffies + MSECS(priv->ieee80211->fsync_time_interval*priv->ieee80211->fsync_multiple_timeinterval);
+			add_timer(&priv->fsync_timer);
+		}
+		else{
+			if(timer_pending(&priv->fsync_timer))
+				del_timer_sync(&priv->fsync_timer);
+			priv->fsync_timer.expires = jiffies + MSECS(priv->ieee80211->fsync_time_interval);
+			add_timer(&priv->fsync_timer);
+		}
+	}
+	else
+	{
+		// Let Register return to default value;
+		if(priv->bswitch_fsync)
+		{
+			priv->bswitch_fsync  = false;
+		#ifdef RTL8190P
+			write_nic_byte(dev, 0xC36, 0x40);
+		#else
+			write_nic_byte(dev, 0xC36, 0x5c);
+		#endif
+			write_nic_byte(dev, 0xC3e, 0x96);
+		}
+		priv->ContiuneDiffCount = 0;
+	#ifdef RTL8190P
+		write_nic_dword(dev, rOFDM0_RxDetector2, 0x164052cd);
+	#else
+		write_nic_dword(dev, rOFDM0_RxDetector2, 0x465c52cd);
+	#endif
+	}
+	RT_TRACE(COMP_HALDM, "ContiuneDiffCount %d\n", priv->ContiuneDiffCount);
+	RT_TRACE(COMP_HALDM, "rateRecord %d rateCount %d, rateCountdiff %d bSwitchFsync %d\n", priv->rate_record, rate_count, rate_count_diff , priv->bswitch_fsync);
+}
+
+static void dm_StartHWFsync(struct net_device *dev)
+{
+	RT_TRACE(COMP_HALDM, "%s\n", __FUNCTION__);
+	write_nic_dword(dev, rOFDM0_RxDetector2, 0x465c12cf);
+	write_nic_byte(dev, 0xc3b, 0x41);
+}
+
+static void dm_EndSWFsync(struct net_device *dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+	RT_TRACE(COMP_HALDM, "%s\n", __FUNCTION__);
+	del_timer_sync(&(priv->fsync_timer));
+
+	// Let Register return to default value;
+	if(priv->bswitch_fsync)
+	{
+		priv->bswitch_fsync  = false;
+
+		#ifdef RTL8190P
+			write_nic_byte(dev, 0xC36, 0x40);
+		#else
+			write_nic_byte(dev, 0xC36, 0x5c);
+		#endif
+
+		write_nic_byte(dev, 0xC3e, 0x96);
+	}
+
+	priv->ContiuneDiffCount = 0;
+#ifndef RTL8190P
+	write_nic_dword(dev, rOFDM0_RxDetector2, 0x465c52cd);
+#endif
+
+}
+
+static void dm_StartSWFsync(struct net_device *dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	u32 			rateIndex;
+	u32 			rateBitmap;
+
+	RT_TRACE(COMP_HALDM,"%s\n", __FUNCTION__);
+	// Initial rate record to zero, start to record.
+	priv->rate_record = 0;
+	// Initial contiune diff count to zero, start to record.
+	priv->ContiuneDiffCount = 0;
+	priv->rateCountDiffRecord = 0;
+	priv->bswitch_fsync  = false;
+
+	if(priv->ieee80211->mode == WIRELESS_MODE_N_24G)
+	{
+		priv->ieee80211->fsync_firstdiff_ratethreshold= 600;
+		priv->ieee80211->fsync_seconddiff_ratethreshold = 0xffff;
+	}
+	else
+	{
+		priv->ieee80211->fsync_firstdiff_ratethreshold= 200;
+		priv->ieee80211->fsync_seconddiff_ratethreshold = 200;
+	}
+	for(rateIndex = 0; rateIndex <= 27; rateIndex++)
+	{
+		rateBitmap  = 1 << rateIndex;
+		if(priv->ieee80211->fsync_rate_bitmap &  rateBitmap)
+			priv->rate_record += priv->stats.received_rate_histogram[1][rateIndex];
+	}
+	if(timer_pending(&priv->fsync_timer))
+		del_timer_sync(&priv->fsync_timer);
+	priv->fsync_timer.expires = jiffies + MSECS(priv->ieee80211->fsync_time_interval);
+	add_timer(&priv->fsync_timer);
+
+#ifndef RTL8190P
+	write_nic_dword(dev, rOFDM0_RxDetector2, 0x465c12cd);
+#endif
+
+}
+
+static void dm_EndHWFsync(struct net_device *dev)
+{
+	RT_TRACE(COMP_HALDM,"%s\n", __FUNCTION__);
+	write_nic_dword(dev, rOFDM0_RxDetector2, 0x465c52cd);
+	write_nic_byte(dev, 0xc3b, 0x49);
+
+}
+
+void dm_check_fsync(struct net_device *dev)
+{
+#define	RegC38_Default				0
+#define	RegC38_NonFsync_Other_AP	1
+#define	RegC38_Fsync_AP_BCM		2
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	//u32 			framesyncC34;
+	static u8		reg_c38_State=RegC38_Default;
+	static u32	reset_cnt=0;
+
+	RT_TRACE(COMP_HALDM, "RSSI %d TimeInterval %d MultipleTimeInterval %d\n", priv->ieee80211->fsync_rssi_threshold, priv->ieee80211->fsync_time_interval, priv->ieee80211->fsync_multiple_timeinterval);
+	RT_TRACE(COMP_HALDM, "RateBitmap 0x%x FirstDiffRateThreshold %d SecondDiffRateThreshold %d\n", priv->ieee80211->fsync_rate_bitmap, priv->ieee80211->fsync_firstdiff_ratethreshold, priv->ieee80211->fsync_seconddiff_ratethreshold);
+
+	if(	priv->ieee80211->state == IEEE80211_LINKED &&
+		(priv->ieee80211->pHTInfo->IOTAction & HT_IOT_ACT_CDD_FSYNC))
+	{
+		if(priv->ieee80211->bfsync_enable == 0)
+		{
+			switch(priv->ieee80211->fsync_state)
+			{
+				case Default_Fsync:
+					dm_StartHWFsync(dev);
+					priv->ieee80211->fsync_state = HW_Fsync;
+					break;
+				case SW_Fsync:
+					dm_EndSWFsync(dev);
+					dm_StartHWFsync(dev);
+					priv->ieee80211->fsync_state = HW_Fsync;
+					break;
+				case HW_Fsync:
+				default:
+					break;
+			}
+		}
+		else
+		{
+			switch(priv->ieee80211->fsync_state)
+			{
+				case Default_Fsync:
+					dm_StartSWFsync(dev);
+					priv->ieee80211->fsync_state = SW_Fsync;
+					break;
+				case HW_Fsync:
+					dm_EndHWFsync(dev);
+					dm_StartSWFsync(dev);
+					priv->ieee80211->fsync_state = SW_Fsync;
+					break;
+				case SW_Fsync:
+				default:
+					break;
+
+			}
+		}
+		if(priv->framesyncMonitor)
+		{
+			if(reg_c38_State != RegC38_Fsync_AP_BCM)
+			{	//For broadcom AP we write different default value
+				#ifdef RTL8190P
+					write_nic_byte(dev, rOFDM0_RxDetector3, 0x15);
+				#else
+					write_nic_byte(dev, rOFDM0_RxDetector3, 0x95);
+				#endif
+
+				reg_c38_State = RegC38_Fsync_AP_BCM;
+			}
+		}
+	}
+	else
+	{
+		switch(priv->ieee80211->fsync_state)
+		{
+			case HW_Fsync:
+				dm_EndHWFsync(dev);
+				priv->ieee80211->fsync_state = Default_Fsync;
+				break;
+			case SW_Fsync:
+				dm_EndSWFsync(dev);
+				priv->ieee80211->fsync_state = Default_Fsync;
+				break;
+			case Default_Fsync:
+			default:
+				break;
+		}
+
+		if(priv->framesyncMonitor)
+		{
+			if(priv->ieee80211->state == IEEE80211_LINKED)
+			{
+				if(priv->undecorated_smoothed_pwdb <= RegC38_TH)
+				{
+					if(reg_c38_State != RegC38_NonFsync_Other_AP)
+					{
+						#ifdef RTL8190P
+							write_nic_byte(dev, rOFDM0_RxDetector3, 0x10);
+						#else
+							write_nic_byte(dev, rOFDM0_RxDetector3, 0x90);
+						#endif
+
+						reg_c38_State = RegC38_NonFsync_Other_AP;
+					}
+				}
+				else if(priv->undecorated_smoothed_pwdb >= (RegC38_TH+5))
+				{
+					if(reg_c38_State)
+					{
+						write_nic_byte(dev, rOFDM0_RxDetector3, priv->framesync);
+						reg_c38_State = RegC38_Default;
+						//DbgPrint("Fsync is idle, rssi>=40, write 0xc38 = 0x%x \n", pHalData->framesync);
+					}
+				}
+			}
+			else
+			{
+				if(reg_c38_State)
+				{
+					write_nic_byte(dev, rOFDM0_RxDetector3, priv->framesync);
+					reg_c38_State = RegC38_Default;
+					//DbgPrint("Fsync is idle, not connected, write 0xc38 = 0x%x \n", pHalData->framesync);
+				}
+			}
+		}
+	}
+	if(priv->framesyncMonitor)
+	{
+		if(priv->reset_count != reset_cnt)
+		{	//After silent reset, the reg_c38_State will be returned to default value
+			write_nic_byte(dev, rOFDM0_RxDetector3, priv->framesync);
+			reg_c38_State = RegC38_Default;
+			reset_cnt = priv->reset_count;
+			//DbgPrint("reg_c38_State = 0 for silent reset. \n");
+		}
+	}
+	else
+	{
+		if(reg_c38_State)
+		{
+			write_nic_byte(dev, rOFDM0_RxDetector3, priv->framesync);
+			reg_c38_State = RegC38_Default;
+			//DbgPrint("framesync no monitor, write 0xc38 = 0x%x \n", pHalData->framesync);
+		}
+	}
+}
+
+
+/*-----------------------------------------------------------------------------
+ * Function:	dm_shadow_init()
+ *
+ * Overview:	Store all NIC MAC/BB register content.
+ *
+ * Input:		NONE
+ *
+ * Output:		NONE
+ *
+ * Return:		NONE
+ *
+ * Revised History:
+ *	When		Who		Remark
+ *	05/29/2008	amy		Create Version 0 porting from windows code.
+ *
+ *---------------------------------------------------------------------------*/
+extern void dm_shadow_init(struct net_device *dev)
+{
+	u8	page;
+	u16	offset;
+
+	for (page = 0; page < 5; page++)
+		for (offset = 0; offset < 256; offset++)
+		{
+			dm_shadow[page][offset] = read_nic_byte(dev, offset+page*256);
+			//DbgPrint("P-%d/O-%02x=%02x\r\n", page, offset, DM_Shadow[page][offset]);
+		}
+
+	for (page = 8; page < 11; page++)
+		for (offset = 0; offset < 256; offset++)
+			dm_shadow[page][offset] = read_nic_byte(dev, offset+page*256);
+
+	for (page = 12; page < 15; page++)
+		for (offset = 0; offset < 256; offset++)
+			dm_shadow[page][offset] = read_nic_byte(dev, offset+page*256);
+
+}   /* dm_shadow_init */
+
+/*---------------------------Define function prototype------------------------*/
+/*-----------------------------------------------------------------------------
+ * Function:	DM_DynamicTxPower()
+ *
+ * Overview:	Detect Signal strength to control TX Registry
+			Tx Power Control For Near/Far Range
+ *
+ * Input:		NONE
+ *
+ * Output:		NONE
+ *
+ * Return:		NONE
+ *
+ * Revised History:
+ *	When		Who		Remark
+ *	03/06/2008	Jacken	Create Version 0.
+ *
+ *---------------------------------------------------------------------------*/
+static void dm_init_dynamic_txpower(struct net_device *dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+	//Initial TX Power Control for near/far range , add by amy 2008/05/15, porting from windows code.
+	priv->ieee80211->bdynamic_txpower_enable = true;    //Default to enable Tx Power Control
+	priv->bLastDTPFlag_High = false;
+	priv->bLastDTPFlag_Low = false;
+	priv->bDynamicTxHighPower = false;
+	priv->bDynamicTxLowPower = false;
+}
+
+static void dm_dynamic_txpower(struct net_device *dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	unsigned int txhipower_threshhold=0;
+	unsigned int txlowpower_threshold=0;
+	if(priv->ieee80211->bdynamic_txpower_enable != true)
+	{
+		priv->bDynamicTxHighPower = false;
+		priv->bDynamicTxLowPower = false;
+		return;
+	}
+	//printk("priv->ieee80211->current_network.unknown_cap_exist is %d ,priv->ieee80211->current_network.broadcom_cap_exist is %d\n",priv->ieee80211->current_network.unknown_cap_exist,priv->ieee80211->current_network.broadcom_cap_exist);
+	if((priv->ieee80211->current_network.atheros_cap_exist ) && (priv->ieee80211->mode == IEEE_G)){
+		txhipower_threshhold = TX_POWER_ATHEROAP_THRESH_HIGH;
+		txlowpower_threshold = TX_POWER_ATHEROAP_THRESH_LOW;
+	}
+	else
+	{
+		txhipower_threshhold = TX_POWER_NEAR_FIELD_THRESH_HIGH;
+		txlowpower_threshold = TX_POWER_NEAR_FIELD_THRESH_LOW;
+	}
+
+//	printk("=======>%s(): txhipower_threshhold is %d,txlowpower_threshold is %d\n",__FUNCTION__,txhipower_threshhold,txlowpower_threshold);
+	RT_TRACE(COMP_TXAGC,"priv->undecorated_smoothed_pwdb = %ld \n" , priv->undecorated_smoothed_pwdb);
+
+	if(priv->ieee80211->state == IEEE80211_LINKED)
+	{
+		if(priv->undecorated_smoothed_pwdb >= txhipower_threshhold)
+		{
+			priv->bDynamicTxHighPower = true;
+			priv->bDynamicTxLowPower = false;
+		}
+		else
+		{
+			// high power state check
+			if(priv->undecorated_smoothed_pwdb < txlowpower_threshold && priv->bDynamicTxHighPower == true)
+			{
+				priv->bDynamicTxHighPower = false;
+			}
+			// low power state check
+			if(priv->undecorated_smoothed_pwdb < 35)
+			{
+				priv->bDynamicTxLowPower = true;
+			}
+			else if(priv->undecorated_smoothed_pwdb >= 40)
+			{
+				priv->bDynamicTxLowPower = false;
+			}
+		}
+	}
+	else
+	{
+		//pHalData->bTXPowerCtrlforNearFarRange = !pHalData->bTXPowerCtrlforNearFarRange;
+		priv->bDynamicTxHighPower = false;
+		priv->bDynamicTxLowPower = false;
+	}
+
+	if( (priv->bDynamicTxHighPower != priv->bLastDTPFlag_High ) ||
+		(priv->bDynamicTxLowPower != priv->bLastDTPFlag_Low ) )
+	{
+		RT_TRACE(COMP_TXAGC,"SetTxPowerLevel8190()  channel = %d \n" , priv->ieee80211->current_network.channel);
+
+#if  defined(RTL8190P) || defined(RTL8192E)
+		SetTxPowerLevel8190(Adapter,pHalData->CurrentChannel);
+#endif
+
+#ifdef RTL8192U
+		rtl8192_phy_setTxPower(dev,priv->ieee80211->current_network.channel);
+		//pHalData->bStartTxCtrlByTPCNFR = FALSE;    //Clear th flag of Set TX Power from Sitesurvey
+#endif
+	}
+	priv->bLastDTPFlag_High = priv->bDynamicTxHighPower;
+	priv->bLastDTPFlag_Low = priv->bDynamicTxLowPower;
+
+}	/* dm_dynamic_txpower */
+
+//added by vivi, for read tx rate and retrycount
+static void dm_check_txrateandretrycount(struct net_device * dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	struct ieee80211_device* ieee = priv->ieee80211;
+	//for 11n tx rate
+//	priv->stats.CurrentShowTxate = read_nic_byte(dev, Current_Tx_Rate_Reg);
+	ieee->softmac_stats.CurrentShowTxate = read_nic_byte(dev, Current_Tx_Rate_Reg);
+	//printk("=============>tx_rate_reg:%x\n", ieee->softmac_stats.CurrentShowTxate);
+	//for initial tx rate
+//	priv->stats.last_packet_rate = read_nic_byte(dev, Initial_Tx_Rate_Reg);
+	ieee->softmac_stats.last_packet_rate = read_nic_byte(dev ,Initial_Tx_Rate_Reg);
+	//for tx tx retry count
+//	priv->stats.txretrycount = read_nic_dword(dev, Tx_Retry_Count_Reg);
+	ieee->softmac_stats.txretrycount = read_nic_dword(dev, Tx_Retry_Count_Reg);
+}
+
+static void dm_send_rssi_tofw(struct net_device *dev)
+{
+	DCMD_TXCMD_T			tx_cmd;
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+	// If we test chariot, we should stop the TX command ?
+	// Because 92E will always silent reset when we send tx command. We use register
+	// 0x1e0(byte) to botify driver.
+	write_nic_byte(dev, DRIVER_RSSI, (u8)priv->undecorated_smoothed_pwdb);
+	return;
+	tx_cmd.Op		= TXCMD_SET_RX_RSSI;
+	tx_cmd.Length	= 4;
+	tx_cmd.Value		= priv->undecorated_smoothed_pwdb;
+
+	cmpk_message_handle_tx(dev, (u8*)&tx_cmd,
+								DESC_PACKET_TYPE_INIT, sizeof(DCMD_TXCMD_T));
+}
+
+/*---------------------------Define function prototype------------------------*/
+
diff --git a/drivers/staging/rtl8192u/r8192U_dm.h b/drivers/staging/rtl8192u/r8192U_dm.h
new file mode 100644
index 000000000000..3ceb59b9eca7
--- /dev/null
+++ b/drivers/staging/rtl8192u/r8192U_dm.h
@@ -0,0 +1,254 @@
+/*****************************************************************************
+ *	Copyright(c) 2007,  RealTEK Technology Inc. All Right Reserved.
+ *
+ * Module:		Hal819xUsbDM.h	(RTL8192  Header H File)
+ *
+ *
+ * Note:		For dynamic control definition constant structure.
+ *
+ *
+ * Export:
+ *
+ * Abbrev:
+ *
+ * History:
+ *	Data		Who		Remark
+ *	10/04/2007  MHC    	Create initial version.
+ *
+ *****************************************************************************/
+ /* Check to see if the file has been included already.  */
+#ifndef	__R8192UDM_H__
+#define __R8192UDM_H__
+
+
+/*--------------------------Define Parameters-------------------------------*/
+#define		DM_DIG_THRESH_HIGH					40
+#define		DM_DIG_THRESH_LOW					35
+
+#define		DM_DIG_HIGH_PWR_THRESH_HIGH		75
+#define		DM_DIG_HIGH_PWR_THRESH_LOW		70
+
+#define		BW_AUTO_SWITCH_HIGH_LOW			25
+#define		BW_AUTO_SWITCH_LOW_HIGH			30
+
+#define		DM_check_fsync_time_interval				500
+
+
+#define		DM_DIG_BACKOFF				12
+#define		DM_DIG_MAX					0x36
+#define		DM_DIG_MIN					0x1c
+#define		DM_DIG_MIN_Netcore			0x12
+
+#define		RxPathSelection_SS_TH_low		30
+#define		RxPathSelection_diff_TH			18
+
+#define		RateAdaptiveTH_High			50
+#define		RateAdaptiveTH_Low_20M		30
+#define		RateAdaptiveTH_Low_40M		10
+#define		VeryLowRSSI					15
+#define		CTSToSelfTHVal					30
+
+//defined by vivi, for tx power track
+#define		E_FOR_TX_POWER_TRACK               300
+//Dynamic Tx Power Control Threshold
+#define		TX_POWER_NEAR_FIELD_THRESH_HIGH		68
+#define		TX_POWER_NEAR_FIELD_THRESH_LOW		62
+//added by amy for atheros AP
+#define         TX_POWER_ATHEROAP_THRESH_HIGH           78
+#define 	TX_POWER_ATHEROAP_THRESH_LOW		72
+
+//defined by vivi, for showing on UI
+#define 		Current_Tx_Rate_Reg         0x1b8
+#define 		Initial_Tx_Rate_Reg         	  0x1b9
+#define 		Tx_Retry_Count_Reg         0x1ac
+#define		RegC38_TH				 20
+/*--------------------------Define Parameters-------------------------------*/
+
+
+/*------------------------------Define structure----------------------------*/
+/* 2007/10/04 MH Define upper and lower threshold of DIG enable or disable. */
+typedef struct _dynamic_initial_gain_threshold_
+{
+	u8		dig_enable_flag;
+	u8		dig_algorithm;
+	u8		dbg_mode;
+	u8		dig_algorithm_switch;
+
+	long		rssi_low_thresh;
+	long		rssi_high_thresh;
+
+	long		rssi_high_power_lowthresh;
+	long		rssi_high_power_highthresh;
+
+	u8		dig_state;
+	u8		dig_highpwr_state;
+	u8		cur_connect_state;
+	u8		pre_connect_state;
+
+	u8		curpd_thstate;
+	u8		prepd_thstate;
+	u8		curcs_ratio_state;
+	u8		precs_ratio_state;
+
+	u32		pre_ig_value;
+	u32		cur_ig_value;
+
+	u8		backoff_val;
+	u8		rx_gain_range_max;
+	u8		rx_gain_range_min;
+	bool		initialgain_lowerbound_state;
+
+	long		rssi_val;
+}dig_t;
+
+typedef enum tag_dynamic_init_gain_state_definition
+{
+	DM_STA_DIG_OFF = 0,
+	DM_STA_DIG_ON,
+	DM_STA_DIG_MAX
+}dm_dig_sta_e;
+
+
+/* 2007/10/08 MH Define RATR state. */
+typedef enum tag_dynamic_ratr_state_definition
+{
+	DM_RATR_STA_HIGH = 0,
+	DM_RATR_STA_MIDDLE = 1,
+	DM_RATR_STA_LOW = 2,
+	DM_RATR_STA_MAX
+}dm_ratr_sta_e;
+
+/* 2007/10/11 MH Define DIG operation type. */
+typedef enum tag_dynamic_init_gain_operation_type_definition
+{
+	DIG_TYPE_THRESH_HIGH	= 0,
+	DIG_TYPE_THRESH_LOW	= 1,
+	DIG_TYPE_THRESH_HIGHPWR_HIGH	= 2,
+	DIG_TYPE_THRESH_HIGHPWR_LOW	= 3,
+	DIG_TYPE_DBG_MODE				= 4,
+	DIG_TYPE_RSSI						= 5,
+	DIG_TYPE_ALGORITHM				= 6,
+	DIG_TYPE_BACKOFF					= 7,
+	DIG_TYPE_PWDB_FACTOR			= 8,
+	DIG_TYPE_RX_GAIN_MIN				= 9,
+	DIG_TYPE_RX_GAIN_MAX				= 10,
+	DIG_TYPE_ENABLE 		= 20,
+	DIG_TYPE_DISABLE 		= 30,
+	DIG_OP_TYPE_MAX
+}dm_dig_op_e;
+
+typedef enum tag_dig_algorithm_definition
+{
+	DIG_ALGO_BY_FALSE_ALARM = 0,
+	DIG_ALGO_BY_RSSI	= 1,
+	DIG_ALGO_MAX
+}dm_dig_alg_e;
+
+typedef enum tag_dig_dbgmode_definition
+{
+	DIG_DBG_OFF = 0,
+	DIG_DBG_ON = 1,
+	DIG_DBG_MAX
+}dm_dig_dbg_e;
+
+typedef enum tag_dig_connect_definition
+{
+	DIG_DISCONNECT = 0,
+	DIG_CONNECT = 1,
+	DIG_CONNECT_MAX
+}dm_dig_connect_e;
+
+typedef enum tag_dig_packetdetection_threshold_definition
+{
+	DIG_PD_AT_LOW_POWER = 0,
+	DIG_PD_AT_NORMAL_POWER = 1,
+	DIG_PD_AT_HIGH_POWER = 2,
+	DIG_PD_MAX
+}dm_dig_pd_th_e;
+
+typedef enum tag_dig_cck_cs_ratio_state_definition
+{
+	DIG_CS_RATIO_LOWER = 0,
+	DIG_CS_RATIO_HIGHER = 1,
+	DIG_CS_MAX
+}dm_dig_cs_ratio_e;
+typedef struct _Dynamic_Rx_Path_Selection_
+{
+	u8		Enable;
+	u8		DbgMode;
+	u8		cck_method;
+	u8		cck_Rx_path;
+
+	u8		SS_TH_low;
+	u8		diff_TH;
+	u8		disabledRF;
+	u8		reserved;
+
+	u8		rf_rssi[4];
+	u8		rf_enable_rssi_th[4];
+	long		cck_pwdb_sta[4];
+}DRxPathSel;
+
+typedef enum tag_CCK_Rx_Path_Method_Definition
+{
+	CCK_Rx_Version_1 = 0,
+	CCK_Rx_Version_2= 1,
+	CCK_Rx_Version_MAX
+}DM_CCK_Rx_Path_Method;
+
+typedef enum tag_DM_DbgMode_Definition
+{
+	DM_DBG_OFF = 0,
+	DM_DBG_ON = 1,
+	DM_DBG_MAX
+}DM_DBG_E;
+
+typedef struct tag_Tx_Config_Cmd_Format
+{
+	u32	Op;										/* Command packet type. */
+	u32	Length;									/* Command packet length. */
+	u32	Value;
+}DCMD_TXCMD_T, *PDCMD_TXCMD_T;
+/*------------------------------Define structure----------------------------*/
+
+
+/*------------------------Export global variable----------------------------*/
+extern	dig_t	dm_digtable;
+extern	u8		dm_shadow[16][256];
+extern DRxPathSel      DM_RxPathSelTable;
+/*------------------------Export global variable----------------------------*/
+
+
+/*------------------------Export Marco Definition---------------------------*/
+
+/*------------------------Export Marco Definition---------------------------*/
+
+
+/*--------------------------Exported Function prototype---------------------*/
+extern  void    init_hal_dm(struct net_device *dev);
+extern  void deinit_hal_dm(struct net_device *dev);
+
+extern void hal_dm_watchdog(struct net_device *dev);
+
+extern  void    init_rate_adaptive(struct net_device *dev);
+extern  void    dm_txpower_trackingcallback(struct work_struct *work);
+extern  void    dm_restore_dynamic_mechanism_state(struct net_device *dev);
+extern  void    dm_backup_dynamic_mechanism_state(struct net_device *dev);
+extern  void    dm_change_dynamic_initgain_thresh(struct net_device *dev,
+								u32 dm_type, u32 dm_value);
+extern  void    dm_force_tx_fw_info(struct net_device *dev,u32 force_type, u32 force_value);
+extern  void    dm_init_edca_turbo(struct net_device *dev);
+extern  void    dm_rf_operation_test_callback(unsigned long data);
+extern  void    dm_rf_pathcheck_workitemcallback(struct work_struct *work);
+extern  void dm_fsync_timer_callback(unsigned long data);
+extern	void	dm_cck_txpower_adjust(struct net_device *dev,bool  binch14);
+extern  void    dm_shadow_init(struct net_device *dev);
+extern void dm_initialize_txpower_tracking(struct net_device *dev);
+/*--------------------------Exported Function prototype---------------------*/
+
+
+#endif	/*__R8192UDM_H__ */
+
+
+/* End of r8192U_dm.h */
+
diff --git a/drivers/staging/rtl8192u/r8192U_hw.h b/drivers/staging/rtl8192u/r8192U_hw.h
new file mode 100644
index 000000000000..e89aaf70143b
--- /dev/null
+++ b/drivers/staging/rtl8192u/r8192U_hw.h
@@ -0,0 +1,411 @@
+/*
+	This is part of rtl8187 OpenSource driver.
+	Copyright (C) Andrea Merello 2004-2005  <andreamrl@tiscali.it>
+	Released under the terms of GPL (General Public Licence)
+
+	Parts of this driver are based on the GPL part of the
+	official Realtek driver.
+	Parts of this driver are based on the rtl8180 driver skeleton
+	from Patric Schenke & Andres Salomon.
+	Parts of this driver are based on the Intel Pro Wireless
+	2100 GPL driver.
+
+	We want to tanks the Authors of those projects
+	and the Ndiswrapper project Authors.
+*/
+
+/* Mariusz Matuszek added full registers definition with Realtek's name */
+
+/* this file contains register definitions for the rtl8187 MAC controller */
+#ifndef R8192_HW
+#define R8192_HW
+
+typedef enum _VERSION_819xU{
+	VERSION_819xU_A, // A-cut
+	VERSION_819xU_B, // B-cut
+	VERSION_819xU_C,// C-cut
+}VERSION_819xU,*PVERSION_819xU;
+//added for different RF type
+typedef enum _RT_RF_TYPE_DEF
+{
+	RF_1T2R = 0,
+	RF_2T4R,
+
+	RF_819X_MAX_TYPE
+}RT_RF_TYPE_DEF;
+
+
+typedef enum _BaseBand_Config_Type{
+	BaseBand_Config_PHY_REG = 0,			//Radio Path A
+	BaseBand_Config_AGC_TAB = 1,			//Radio Path B
+}BaseBand_Config_Type, *PBaseBand_Config_Type;
+#define	RTL8187_REQT_READ	0xc0
+#define	RTL8187_REQT_WRITE	0x40
+#define	RTL8187_REQ_GET_REGS	0x05
+#define	RTL8187_REQ_SET_REGS	0x05
+
+#define MAX_TX_URB 5
+#define MAX_RX_URB 16
+
+#define R8180_MAX_RETRY 255
+//#define MAX_RX_NORMAL_URB 3
+//#define MAX_RX_COMMAND_URB 2
+#define RX_URB_SIZE 9100
+
+#define BB_ANTATTEN_CHAN14	0x0c
+#define BB_ANTENNA_B 0x40
+
+#define BB_HOST_BANG (1<<30)
+#define BB_HOST_BANG_EN (1<<2)
+#define BB_HOST_BANG_CLK (1<<1)
+#define BB_HOST_BANG_RW (1<<3)
+#define BB_HOST_BANG_DATA	 1
+
+//#if (RTL819X_FPGA_VER & RTL819X_FPGA_VIVI_070920)
+#define AFR			0x010
+#define AFR_CardBEn		(1<<0)
+#define AFR_CLKRUN_SEL		(1<<1)
+#define AFR_FuncRegEn		(1<<2)
+#define RTL8190_EEPROM_ID	0x8129
+#define EEPROM_VID		0x02
+#define EEPROM_PID		0x04
+#define EEPROM_NODE_ADDRESS_BYTE_0	0x0C
+
+#define EEPROM_TxPowerDiff	0x1F
+#define EEPROM_ThermalMeter	0x20
+#define EEPROM_PwDiff		0x21	//0x21
+#define EEPROM_CrystalCap	0x22	//0x22
+
+#define EEPROM_TxPwIndex_CCK	0x23	//0x23
+#define EEPROM_TxPwIndex_OFDM_24G	0x24	//0x24~0x26
+#define EEPROM_TxPwIndex_CCK_V1		0x29	//0x29~0x2B
+#define EEPROM_TxPwIndex_OFDM_24G_V1	0x2C	//0x2C~0x2E
+#define EEPROM_TxPwIndex_Ver		0x27	//0x27
+
+#define EEPROM_Default_TxPowerDiff		0x0
+#define EEPROM_Default_ThermalMeter		0x7
+#define EEPROM_Default_PwDiff			0x4
+#define EEPROM_Default_CrystalCap		0x5
+#define EEPROM_Default_TxPower			0x1010
+#define EEPROM_Customer_ID			0x7B	//0x7B:CustomerID
+#define EEPROM_ChannelPlan			0x16	//0x7C
+#define EEPROM_IC_VER				0x7d	//0x7D
+#define EEPROM_CRC				0x7e	//0x7E~0x7F
+
+#define EEPROM_CID_DEFAULT			0x0
+#define EEPROM_CID_CAMEO				0x1
+#define EEPROM_CID_RUNTOP				0x2
+#define EEPROM_CID_Senao				0x3
+#define EEPROM_CID_TOSHIBA				0x4	// Toshiba setting, Merge by Jacken, 2008/01/31
+#define EEPROM_CID_NetCore				0x5
+#define EEPROM_CID_Nettronix			0x6
+#define EEPROM_CID_Pronet				0x7
+#define EEPROM_CID_DLINK				0x8
+
+#define AC_PARAM_TXOP_LIMIT_OFFSET	16
+#define AC_PARAM_ECW_MAX_OFFSET		12
+#define AC_PARAM_ECW_MIN_OFFSET		8
+#define AC_PARAM_AIFS_OFFSET		0
+
+//#endif
+enum _RTL8192Usb_HW {
+
+	PCIF			= 0x009, // PCI Function Register 0x0009h~0x000bh
+#define	BB_GLOBAL_RESET_BIT	0x1
+	BB_GLOBAL_RESET		= 0x020, // BasebandGlobal Reset Register
+	BSSIDR			= 0x02E, // BSSID Register
+	CMDR			= 0x037, // Command register
+#define CR_RST			0x10
+#define CR_RE			0x08
+#define CR_TE			0x04
+#define CR_MulRW		0x01
+	SIFS			= 0x03E, // SIFS register
+	TCR			= 0x040, // Transmit Configuration Register
+
+#define TCR_MXDMA_2048 		7
+#define TCR_LRL_OFFSET		0
+#define TCR_SRL_OFFSET		8
+#define TCR_MXDMA_OFFSET	21
+#define TCR_SAT			BIT24		// Enable Rate depedent ack timeout timer
+	RCR			= 0x044, // Receive Configuration Register
+#define MAC_FILTER_MASK ((1<<0) | (1<<1) | (1<<2) | (1<<3) | (1<<5) | \
+		(1<<12) | (1<<18) | (1<<19) | (1<<20) | (1<<21) | (1<<22) | (1<<23))
+#define RX_FIFO_THRESHOLD_MASK ((1<<13) | (1<<14) | (1<<15))
+#define RX_FIFO_THRESHOLD_SHIFT 13
+#define RX_FIFO_THRESHOLD_128 3
+#define RX_FIFO_THRESHOLD_256 4
+#define RX_FIFO_THRESHOLD_512 5
+#define RX_FIFO_THRESHOLD_1024 6
+#define RX_FIFO_THRESHOLD_NONE 7
+#define MAX_RX_DMA_MASK ((1<<8) | (1<<9) | (1<<10))
+#define RCR_MXDMA_OFFSET	8
+#define RCR_FIFO_OFFSET		13
+#define RCR_ONLYERLPKT		BIT31			// Early Receiving based on Packet Size.
+#define RCR_ENCS2		BIT30			// Enable Carrier Sense Detection Method 2
+#define RCR_ENCS1		BIT29			// Enable Carrier Sense Detection Method 1
+#define RCR_ENMBID		BIT27			// Enable Multiple BssId.
+#define RCR_ACKTXBW		(BIT24|BIT25)		// TXBW Setting of ACK frames
+#define RCR_CBSSID		BIT23			// Accept BSSID match packet
+#define RCR_APWRMGT		BIT22			// Accept power management packet
+#define	RCR_ADD3		BIT21			// Accept address 3 match packet
+#define RCR_AMF			BIT20			// Accept management type frame
+#define RCR_ACF			BIT19			// Accept control type frame
+#define RCR_ADF			BIT18			// Accept data type frame
+#define RCR_RXFTH		BIT13			// Rx FIFO Threshold
+#define RCR_AICV		BIT12			// Accept ICV error packet
+#define	RCR_ACRC32		BIT5			// Accept CRC32 error packet
+#define	RCR_AB			BIT3			// Accept broadcast packet
+#define	RCR_AM			BIT2			// Accept multicast packet
+#define	RCR_APM			BIT1			// Accept physical match packet
+#define	RCR_AAP			BIT0			// Accept all unicast packet
+	SLOT_TIME		= 0x049, // Slot Time Register
+	ACK_TIMEOUT		= 0x04c, // Ack Timeout Register
+	PIFS_TIME		= 0x04d, // PIFS time
+	USTIME			= 0x04e, // Microsecond Tuning Register, Sets the microsecond time unit used by MAC clock.
+	EDCAPARA_BE		= 0x050, // EDCA Parameter of AC BE
+	EDCAPARA_BK		= 0x054, // EDCA Parameter of AC BK
+	EDCAPARA_VO		= 0x058, // EDCA Parameter of AC VO
+	EDCAPARA_VI		= 0x05C, // EDCA Parameter of AC VI
+	RFPC			= 0x05F, // Rx FIFO Packet Count
+	CWRR			= 0x060, // Contention Window Report Register
+	BCN_TCFG		= 0x062, // Beacon Time Configuration
+#define BCN_TCFG_CW_SHIFT		8
+#define BCN_TCFG_IFS			0
+	BCN_INTERVAL		= 0x070, // Beacon Interval (TU)
+	ATIMWND			= 0x072, // ATIM Window Size (TU)
+	BCN_DRV_EARLY_INT	= 0x074, // Driver Early Interrupt Time (TU). Time to send interrupt to notify to change beacon content before TBTT
+	BCN_DMATIME		= 0x076, // Beacon DMA and ATIM interrupt time (US). Indicates the time before TBTT to perform beacon queue DMA
+	BCN_ERR_THRESH		= 0x078, // Beacon Error Threshold
+	RWCAM			= 0x0A0, //IN 8190 Data Sheet is called CAMcmd
+	WCAMI			= 0x0A4, // Software write CAM input content
+	RCAMO			= 0x0A8, // Software read/write CAM config
+	SECR			= 0x0B0, //Security Configuration Register
+#define	SCR_TxUseDK		BIT0			//Force Tx Use Default Key
+#define SCR_RxUseDK		BIT1			//Force Rx Use Default Key
+#define SCR_TxEncEnable		BIT2			//Enable Tx Encryption
+#define SCR_RxDecEnable		BIT3			//Enable Rx Decryption
+#define SCR_SKByA2		BIT4			//Search kEY BY A2
+#define SCR_NoSKMC		BIT5			//No Key Search for Multicast
+#define SCR_UseDK		0x01
+#define SCR_TxSecEnable		0x02
+#define SCR_RxSecEnable		0x04
+	TPPoll			= 0x0fd, // Transmit priority polling register
+	PSR			= 0x0ff, // Page Select Register
+#define CPU_CCK_LOOPBACK	0x00030000
+#define CPU_GEN_SYSTEM_RESET	0x00000001
+#define CPU_GEN_FIRMWARE_RESET	0x00000008
+#define CPU_GEN_BOOT_RDY	0x00000010
+#define CPU_GEN_FIRM_RDY	0x00000020
+#define CPU_GEN_PUT_CODE_OK	0x00000080
+#define CPU_GEN_BB_RST		0x00000100
+#define CPU_GEN_PWR_STB_CPU	0x00000004
+#define CPU_GEN_NO_LOOPBACK_MSK	0xFFF8FFFF		// Set bit18,17,16 to 0. Set bit19
+#define CPU_GEN_NO_LOOPBACK_SET	0x00080000		// Set BIT19 to 1
+
+//----------------------------------------------------------------------------
+//       8190 CPU General Register		(offset 0x100, 4 byte)
+//----------------------------------------------------------------------------
+#define	CPU_CCK_LOOPBACK	0x00030000
+#define	CPU_GEN_SYSTEM_RESET	0x00000001
+#define	CPU_GEN_FIRMWARE_RESET	0x00000008
+#define	CPU_GEN_BOOT_RDY	0x00000010
+#define	CPU_GEN_FIRM_RDY	0x00000020
+#define	CPU_GEN_PUT_CODE_OK	0x00000080
+#define	CPU_GEN_BB_RST		0x00000100
+#define	CPU_GEN_PWR_STB_CPU	0x00000004
+#define CPU_GEN_NO_LOOPBACK_MSK	0xFFF8FFFF // Set bit18,17,16 to 0. Set bit19
+#define CPU_GEN_NO_LOOPBACK_SET	0x00080000 // Set BIT19 to 1
+	CPU_GEN			= 0x100, // CPU Reset Register
+	LED1Cfg			=		0x154,// LED1 Configuration Register
+	LED0Cfg			=		0x155,// LED0 Configuration Register
+
+	AcmAvg			= 0x170, // ACM Average Period Register
+	AcmHwCtrl		= 0x171, // ACM Hardware Control Register
+//----------------------------------------------------------------------------
+////
+////       8190 AcmHwCtrl bits                                    (offset 0x171, 1 byte)
+////----------------------------------------------------------------------------
+//
+#define AcmHw_HwEn              BIT0
+#define AcmHw_BeqEn             BIT1
+#define AcmHw_ViqEn             BIT2
+#define AcmHw_VoqEn             BIT3
+#define AcmHw_BeqStatus         BIT4
+#define AcmHw_ViqStatus         BIT5
+#define AcmHw_VoqStatus         BIT6
+
+	AcmFwCtrl		= 0x172, // ACM Firmware Control Register
+	AES_11N_FIX		= 0x173,
+	VOAdmTime		= 0x174, // VO Queue Admitted Time Register
+	VIAdmTime		= 0x178, // VI Queue Admitted Time Register
+	BEAdmTime		= 0x17C, // BE Queue Admitted Time Register
+	RQPN1			= 0x180, // Reserved Queue Page Number , Vo Vi, Be, Bk
+	RQPN2			= 0x184, // Reserved Queue Page Number, HCCA, Cmd, Mgnt, High
+	RQPN3			= 0x188, // Reserved Queue Page Number, Bcn, Public,
+//	QPRR			= 0x1E0, // Queue Page Report per TID
+	QPNR			= 0x1D0, //0x1F0, // Queue Packet Number report per TID
+	BQDA			= 0x200, // Beacon Queue Descriptor Address
+	HQDA			= 0x204, // High Priority Queue Descriptor Address
+	CQDA			= 0x208, // Command Queue Descriptor Address
+	MQDA			= 0x20C, // Management Queue Descriptor Address
+	HCCAQDA			= 0x210, // HCCA Queue Descriptor Address
+	VOQDA			= 0x214, // VO Queue Descriptor Address
+	VIQDA			= 0x218, // VI Queue Descriptor Address
+	BEQDA			= 0x21C, // BE Queue Descriptor Address
+	BKQDA			= 0x220, // BK Queue Descriptor Address
+	RCQDA			= 0x224, // Receive command Queue Descriptor Address
+	RDQDA			= 0x228, // Receive Queue Descriptor Start Address
+
+	MAR0			= 0x240, // Multicast filter.
+	MAR4			= 0x244,
+
+	CCX_PERIOD		= 0x250, // CCX Measurement Period Register, in unit of TU.
+	CLM_RESULT		= 0x251, // CCA Busy fraction register.
+	NHM_PERIOD		= 0x252, // NHM Measurement Period register, in unit of TU.
+
+	NHM_THRESHOLD0		= 0x253, // Noise Histogram Meashorement0.
+	NHM_THRESHOLD1		= 0x254, // Noise Histogram Meashorement1.
+	NHM_THRESHOLD2		= 0x255, // Noise Histogram Meashorement2.
+	NHM_THRESHOLD3		= 0x256, // Noise Histogram Meashorement3.
+	NHM_THRESHOLD4		= 0x257, // Noise Histogram Meashorement4.
+	NHM_THRESHOLD5		= 0x258, // Noise Histogram Meashorement5.
+	NHM_THRESHOLD6		= 0x259, // Noise Histogram Meashorement6
+
+	MCTRL			= 0x25A, // Measurement Control
+
+	NHM_RPI_COUNTER0	= 0x264, // Noise Histogram RPI counter0, the fraction of signal strength < NHM_THRESHOLD0.
+	NHM_RPI_COUNTER1	= 0x265, // Noise Histogram RPI counter1, the fraction of signal strength in (NHM_THRESHOLD0, NHM_THRESHOLD1].
+	NHM_RPI_COUNTER2	= 0x266, // Noise Histogram RPI counter2, the fraction of signal strength in (NHM_THRESHOLD1, NHM_THRESHOLD2].
+	NHM_RPI_COUNTER3	= 0x267, // Noise Histogram RPI counter3, the fraction of signal strength in (NHM_THRESHOLD2, NHM_THRESHOLD3].
+	NHM_RPI_COUNTER4	= 0x268, // Noise Histogram RPI counter4, the fraction of signal strength in (NHM_THRESHOLD3, NHM_THRESHOLD4].
+	NHM_RPI_COUNTER5	= 0x269, // Noise Histogram RPI counter5, the fraction of signal strength in (NHM_THRESHOLD4, NHM_THRESHOLD5].
+	NHM_RPI_COUNTER6	= 0x26A, // Noise Histogram RPI counter6, the fraction of signal strength in (NHM_THRESHOLD5, NHM_THRESHOLD6].
+	NHM_RPI_COUNTER7	= 0x26B, // Noise Histogram RPI counter7, the fraction of signal strength in (NHM_THRESHOLD6, NHM_THRESHOLD7].
+#define	BW_OPMODE_11J			BIT0
+#define	BW_OPMODE_5G			BIT1
+#define	BW_OPMODE_20MHZ			BIT2
+	BW_OPMODE		= 0x300, // Bandwidth operation mode
+	MSR			= 0x303, // Media Status register
+#define MSR_LINK_MASK      ((1<<0)|(1<<1))
+#define MSR_LINK_MANAGED   2
+#define MSR_LINK_NONE      0
+#define MSR_LINK_SHIFT     0
+#define MSR_LINK_ADHOC     1
+#define MSR_LINK_MASTER    3
+#define MSR_LINK_ENEDCA	   (1<<4)
+	RETRY_LIMIT		= 0x304, // Retry Limit [15:8]-short, [7:0]-long
+#define RETRY_LIMIT_SHORT_SHIFT 8
+#define RETRY_LIMIT_LONG_SHIFT 0
+	TSFR			= 0x308,
+	RRSR			= 0x310, // Response Rate Set
+#define RRSR_RSC_OFFSET			21
+#define RRSR_SHORT_OFFSET			23
+#define RRSR_RSC_DUPLICATE			0x600000
+#define RRSR_RSC_LOWSUBCHNL		0x400000
+#define RRSR_RSC_UPSUBCHANL		0x200000
+#define RRSR_SHORT					0x800000
+#define RRSR_1M						BIT0
+#define RRSR_2M						BIT1
+#define RRSR_5_5M					BIT2
+#define RRSR_11M					BIT3
+#define RRSR_6M						BIT4
+#define RRSR_9M						BIT5
+#define RRSR_12M					BIT6
+#define RRSR_18M					BIT7
+#define RRSR_24M					BIT8
+#define RRSR_36M					BIT9
+#define RRSR_48M					BIT10
+#define RRSR_54M					BIT11
+#define RRSR_MCS0					BIT12
+#define RRSR_MCS1					BIT13
+#define RRSR_MCS2					BIT14
+#define RRSR_MCS3					BIT15
+#define RRSR_MCS4					BIT16
+#define RRSR_MCS5					BIT17
+#define RRSR_MCS6					BIT18
+#define RRSR_MCS7					BIT19
+#define BRSR_AckShortPmb			BIT23		// CCK ACK: use Short Preamble or not.
+	RATR0			= 0x320, // Rate Adaptive Table register1
+	UFWP			= 0x318,
+	DRIVER_RSSI		= 0x32c,					// Driver tell Firmware current RSSI
+//----------------------------------------------------------------------------
+//       8190 Rate Adaptive Table Register	(offset 0x320, 4 byte)
+//----------------------------------------------------------------------------
+//CCK
+#define	RATR_1M			0x00000001
+#define	RATR_2M			0x00000002
+#define	RATR_55M		0x00000004
+#define	RATR_11M		0x00000008
+//OFDM
+#define	RATR_6M			0x00000010
+#define	RATR_9M			0x00000020
+#define	RATR_12M		0x00000040
+#define	RATR_18M		0x00000080
+#define	RATR_24M		0x00000100
+#define	RATR_36M		0x00000200
+#define	RATR_48M		0x00000400
+#define	RATR_54M		0x00000800
+//MCS 1 Spatial Stream
+#define	RATR_MCS0		0x00001000
+#define	RATR_MCS1		0x00002000
+#define	RATR_MCS2		0x00004000
+#define	RATR_MCS3		0x00008000
+#define	RATR_MCS4		0x00010000
+#define	RATR_MCS5		0x00020000
+#define	RATR_MCS6		0x00040000
+#define	RATR_MCS7		0x00080000
+//MCS 2 Spatial Stream
+#define	RATR_MCS8		0x00100000
+#define	RATR_MCS9		0x00200000
+#define	RATR_MCS10		0x00400000
+#define	RATR_MCS11		0x00800000
+#define	RATR_MCS12		0x01000000
+#define	RATR_MCS13		0x02000000
+#define	RATR_MCS14		0x04000000
+#define	RATR_MCS15		0x08000000
+// ALL CCK Rate
+#define RATE_ALL_CCK		RATR_1M|RATR_2M|RATR_55M|RATR_11M
+#define RATE_ALL_OFDM_AG	RATR_6M|RATR_9M|RATR_12M|RATR_18M|RATR_24M\
+							|RATR_36M|RATR_48M|RATR_54M
+#define RATE_ALL_OFDM_1SS	RATR_MCS0|RATR_MCS1|RATR_MCS2|RATR_MCS3 | \
+							RATR_MCS4|RATR_MCS5|RATR_MCS6|RATR_MCS7
+#define RATE_ALL_OFDM_2SS	RATR_MCS8|RATR_MCS9	|RATR_MCS10|RATR_MCS11| \
+							RATR_MCS12|RATR_MCS13|RATR_MCS14|RATR_MCS15
+
+	MCS_TXAGC		= 0x340, // MCS AGC
+	CCK_TXAGC		= 0x348, // CCK AGC
+//	ISR			= 0x350, // Interrupt Status Register
+//	IMR			= 0x354, // Interrupt Mask Register
+//	IMR_POLL		= 0x360,
+	MacBlkCtrl		= 0x403, // Mac block on/off control register
+
+	EPROM_CMD 		= 0xfe58,
+#define Cmd9346CR_9356SEL	(1<<4)
+#define EPROM_CMD_RESERVED_MASK (1<<5)
+#define EPROM_CMD_OPERATING_MODE_SHIFT 6
+#define EPROM_CMD_OPERATING_MODE_MASK ((1<<7)|(1<<6))
+#define EPROM_CMD_CONFIG 0x3
+#define EPROM_CMD_NORMAL 0
+#define EPROM_CMD_LOAD 1
+#define EPROM_CMD_PROGRAM 2
+#define EPROM_CS_SHIFT 3
+#define EPROM_CK_SHIFT 2
+#define EPROM_W_SHIFT 1
+#define EPROM_R_SHIFT 0
+	MAC0 			= 0x000,
+	MAC1 			= 0x001,
+	MAC2 			= 0x002,
+	MAC3 			= 0x003,
+	MAC4 			= 0x004,
+	MAC5 			= 0x005,
+
+};
+//----------------------------------------------------------------------------
+//       818xB AnaParm & AnaParm2 Register
+//----------------------------------------------------------------------------
+//#define ANAPARM_ASIC_ON    0x45090658
+//#define ANAPARM2_ASIC_ON   0x727f3f52
+#define GPI 0x108
+#define GPO 0x109
+#define GPE 0x10a
+#endif
diff --git a/drivers/staging/rtl8192u/r8192U_wx.c b/drivers/staging/rtl8192u/r8192U_wx.c
new file mode 100644
index 000000000000..25d5c870b0fb
--- /dev/null
+++ b/drivers/staging/rtl8192u/r8192U_wx.c
@@ -0,0 +1,1228 @@
+/*
+   This file contains wireless extension handlers.
+
+   This is part of rtl8180 OpenSource driver.
+   Copyright (C) Andrea Merello 2004-2005  <andreamrl@tiscali.it>
+   Released under the terms of GPL (General Public Licence)
+
+   Parts of this driver are based on the GPL part
+   of the official realtek driver.
+
+   Parts of this driver are based on the rtl8180 driver skeleton
+   from Patric Schenke & Andres Salomon.
+
+   Parts of this driver are based on the Intel Pro Wireless 2100 GPL driver.
+
+   We want to tanks the Authors of those projects and the Ndiswrapper
+   project Authors.
+*/
+
+#include <linux/string.h>
+#include "r8192U.h"
+#include "r8192U_hw.h"
+
+#ifdef ENABLE_DOT11D
+#include "dot11d.h"
+#endif
+
+#define RATE_COUNT 12
+u32 rtl8180_rates[] = {1000000,2000000,5500000,11000000,
+	6000000,9000000,12000000,18000000,24000000,36000000,48000000,54000000};
+
+
+#ifndef ENETDOWN
+#define ENETDOWN 1
+#endif
+
+static int r8192_wx_get_freq(struct net_device *dev,
+			     struct iw_request_info *a,
+			     union iwreq_data *wrqu, char *b)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+	return ieee80211_wx_get_freq(priv->ieee80211,a,wrqu,b);
+}
+
+
+static int r8192_wx_get_mode(struct net_device *dev, struct iw_request_info *a,
+			     union iwreq_data *wrqu, char *b)
+{
+	struct r8192_priv *priv=ieee80211_priv(dev);
+
+	return ieee80211_wx_get_mode(priv->ieee80211,a,wrqu,b);
+}
+
+
+
+static int r8192_wx_get_rate(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	return ieee80211_wx_get_rate(priv->ieee80211,info,wrqu,extra);
+}
+
+
+
+static int r8192_wx_set_rate(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	int ret;
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+	down(&priv->wx_sem);
+
+	ret = ieee80211_wx_set_rate(priv->ieee80211,info,wrqu,extra);
+
+	up(&priv->wx_sem);
+
+	return ret;
+}
+
+
+static int r8192_wx_set_rts(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	int ret;
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+	down(&priv->wx_sem);
+
+	ret = ieee80211_wx_set_rts(priv->ieee80211,info,wrqu,extra);
+
+	up(&priv->wx_sem);
+
+	return ret;
+}
+
+static int r8192_wx_get_rts(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	return ieee80211_wx_get_rts(priv->ieee80211,info,wrqu,extra);
+}
+
+static int r8192_wx_set_power(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	int ret;
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+	down(&priv->wx_sem);
+
+	ret = ieee80211_wx_set_power(priv->ieee80211,info,wrqu,extra);
+
+	up(&priv->wx_sem);
+
+	return ret;
+}
+
+static int r8192_wx_get_power(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	return ieee80211_wx_get_power(priv->ieee80211,info,wrqu,extra);
+}
+
+#ifdef JOHN_IOCTL
+u16 read_rtl8225(struct net_device *dev, u8 addr);
+void write_rtl8225(struct net_device *dev, u8 adr, u16 data);
+u32 john_read_rtl8225(struct net_device *dev, u8 adr);
+void _write_rtl8225(struct net_device *dev, u8 adr, u16 data);
+
+static int r8192_wx_read_regs(struct net_device *dev,
+			       struct iw_request_info *info,
+			       union iwreq_data *wrqu, char *extra)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	u8 addr;
+	u16 data1;
+
+	down(&priv->wx_sem);
+
+
+	get_user(addr,(u8*)wrqu->data.pointer);
+	data1 = read_rtl8225(dev, addr);
+	wrqu->data.length = data1;
+
+	up(&priv->wx_sem);
+	return 0;
+
+}
+
+static int r8192_wx_write_regs(struct net_device *dev,
+			       struct iw_request_info *info,
+			       union iwreq_data *wrqu, char *extra)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	u8 addr;
+
+	down(&priv->wx_sem);
+
+	get_user(addr, (u8*)wrqu->data.pointer);
+	write_rtl8225(dev, addr, wrqu->data.length);
+
+	up(&priv->wx_sem);
+	return 0;
+
+}
+
+void rtl8187_write_phy(struct net_device *dev, u8 adr, u32 data);
+u8 rtl8187_read_phy(struct net_device *dev,u8 adr, u32 data);
+
+static int r8192_wx_read_bb(struct net_device *dev,
+			       struct iw_request_info *info,
+			       union iwreq_data *wrqu, char *extra)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	u8 databb;
+
+	down(&priv->wx_sem);
+
+	databb = rtl8187_read_phy(dev, (u8)wrqu->data.length, 0x00000000);
+	wrqu->data.length = databb;
+
+	up(&priv->wx_sem);
+	return 0;
+}
+
+void rtl8187_write_phy(struct net_device *dev, u8 adr, u32 data);
+static int r8192_wx_write_bb(struct net_device *dev,
+			       struct iw_request_info *info,
+			       union iwreq_data *wrqu, char *extra)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	u8 databb;
+
+	down(&priv->wx_sem);
+
+	get_user(databb, (u8*)wrqu->data.pointer);
+	rtl8187_write_phy(dev, wrqu->data.length, databb);
+
+	up(&priv->wx_sem);
+	return 0;
+
+}
+
+
+static int r8192_wx_write_nicb(struct net_device *dev,
+			       struct iw_request_info *info,
+			       union iwreq_data *wrqu, char *extra)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	u32 addr;
+
+	down(&priv->wx_sem);
+
+	get_user(addr, (u32*)wrqu->data.pointer);
+	write_nic_byte(dev, addr, wrqu->data.length);
+
+	up(&priv->wx_sem);
+	return 0;
+
+}
+static int r8192_wx_read_nicb(struct net_device *dev,
+			       struct iw_request_info *info,
+			       union iwreq_data *wrqu, char *extra)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	u32 addr;
+	u16 data1;
+
+	down(&priv->wx_sem);
+
+	get_user(addr,(u32*)wrqu->data.pointer);
+	data1 = read_nic_byte(dev, addr);
+	wrqu->data.length = data1;
+
+	up(&priv->wx_sem);
+	return 0;
+}
+
+static int r8192_wx_get_ap_status(struct net_device *dev,
+			       struct iw_request_info *info,
+			       union iwreq_data *wrqu, char *extra)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	struct ieee80211_device *ieee = priv->ieee80211;
+	struct ieee80211_network *target;
+	int name_len;
+
+	down(&priv->wx_sem);
+
+	//count the length of input ssid
+	for(name_len=0 ; ((char*)wrqu->data.pointer)[name_len]!='\0' ; name_len++);
+
+	//search for the correspoding info which is received
+	list_for_each_entry(target, &ieee->network_list, list) {
+		if ( (target->ssid_len == name_len) &&
+		     (strncmp(target->ssid, (char*)wrqu->data.pointer, name_len)==0)){
+			if(target->wpa_ie_len>0 || target->rsn_ie_len>0 )
+				//set flags=1 to indicate this ap is WPA
+				wrqu->data.flags = 1;
+			else wrqu->data.flags = 0;
+
+
+		break;
+		}
+	}
+
+	up(&priv->wx_sem);
+	return 0;
+}
+
+
+
+#endif
+static int r8192_wx_force_reset(struct net_device *dev,
+		struct iw_request_info *info,
+		union iwreq_data *wrqu, char *extra)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+	down(&priv->wx_sem);
+
+	printk("%s(): force reset ! extra is %d\n",__FUNCTION__, *extra);
+	priv->force_reset = *extra;
+	up(&priv->wx_sem);
+	return 0;
+
+}
+
+
+static int r8192_wx_set_rawtx(struct net_device *dev,
+			       struct iw_request_info *info,
+			       union iwreq_data *wrqu, char *extra)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	int ret;
+
+	down(&priv->wx_sem);
+
+	ret = ieee80211_wx_set_rawtx(priv->ieee80211, info, wrqu, extra);
+
+	up(&priv->wx_sem);
+
+	return ret;
+
+}
+
+static int r8192_wx_set_crcmon(struct net_device *dev,
+			       struct iw_request_info *info,
+			       union iwreq_data *wrqu, char *extra)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	int *parms = (int *)extra;
+	int enable = (parms[0] > 0);
+	short prev = priv->crcmon;
+
+	down(&priv->wx_sem);
+
+	if(enable)
+		priv->crcmon=1;
+	else
+		priv->crcmon=0;
+
+	DMESG("bad CRC in monitor mode are %s",
+	      priv->crcmon ? "accepted" : "rejected");
+
+	if(prev != priv->crcmon && priv->up){
+		//rtl8180_down(dev);
+		//rtl8180_up(dev);
+	}
+
+	up(&priv->wx_sem);
+
+	return 0;
+}
+
+static int r8192_wx_set_mode(struct net_device *dev, struct iw_request_info *a,
+			     union iwreq_data *wrqu, char *b)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	int ret;
+	down(&priv->wx_sem);
+
+	ret = ieee80211_wx_set_mode(priv->ieee80211,a,wrqu,b);
+
+	rtl8192_set_rxconf(dev);
+
+	up(&priv->wx_sem);
+	return ret;
+}
+
+struct  iw_range_with_scan_capa
+{
+	/* Informative stuff (to choose between different interface) */
+	__u32           throughput;     /* To give an idea... */
+	/* In theory this value should be the maximum benchmarked
+	 * TCP/IP throughput, because with most of these devices the
+	 * bit rate is meaningless (overhead an co) to estimate how
+	 * fast the connection will go and pick the fastest one.
+	 * I suggest people to play with Netperf or any benchmark...
+	 */
+
+	/* NWID (or domain id) */
+	__u32           min_nwid;       /* Minimal NWID we are able to set */
+	__u32           max_nwid;       /* Maximal NWID we are able to set */
+
+	/* Old Frequency (backward compat - moved lower ) */
+	__u16           old_num_channels;
+	__u8            old_num_frequency;
+
+	/* Scan capabilities */
+	__u8            scan_capa;
+};
+static int rtl8180_wx_get_range(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *extra)
+{
+	struct iw_range *range = (struct iw_range *)extra;
+	struct iw_range_with_scan_capa* tmp = (struct iw_range_with_scan_capa*)range;
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	u16 val;
+	int i;
+
+	wrqu->data.length = sizeof(*range);
+	memset(range, 0, sizeof(*range));
+
+	/* Let's try to keep this struct in the same order as in
+	 * linux/include/wireless.h
+	 */
+
+	/* TODO: See what values we can set, and remove the ones we can't
+	 * set, or fill them with some default data.
+	 */
+
+	/* ~5 Mb/s real (802.11b) */
+	range->throughput = 5 * 1000 * 1000;
+
+	// TODO: Not used in 802.11b?
+//	range->min_nwid;	/* Minimal NWID we are able to set */
+	// TODO: Not used in 802.11b?
+//	range->max_nwid;	/* Maximal NWID we are able to set */
+
+	/* Old Frequency (backward compat - moved lower ) */
+//	range->old_num_channels;
+//	range->old_num_frequency;
+//	range->old_freq[6]; /* Filler to keep "version" at the same offset */
+	if(priv->rf_set_sens != NULL)
+		range->sensitivity = priv->max_sens;	/* signal level threshold range */
+
+	range->max_qual.qual = 100;
+	/* TODO: Find real max RSSI and stick here */
+	range->max_qual.level = 0;
+	range->max_qual.noise = -98;
+	range->max_qual.updated = 7; /* Updated all three */
+
+	range->avg_qual.qual = 92; /* > 8% missed beacons is 'bad' */
+	/* TODO: Find real 'good' to 'bad' threshol value for RSSI */
+	range->avg_qual.level = 20 + -98;
+	range->avg_qual.noise = 0;
+	range->avg_qual.updated = 7; /* Updated all three */
+
+	range->num_bitrates = RATE_COUNT;
+
+	for (i = 0; i < RATE_COUNT && i < IW_MAX_BITRATES; i++) {
+		range->bitrate[i] = rtl8180_rates[i];
+	}
+
+	range->min_frag = MIN_FRAG_THRESHOLD;
+	range->max_frag = MAX_FRAG_THRESHOLD;
+
+	range->min_pmp=0;
+	range->max_pmp = 5000000;
+	range->min_pmt = 0;
+	range->max_pmt = 65535*1000;
+	range->pmp_flags = IW_POWER_PERIOD;
+	range->pmt_flags = IW_POWER_TIMEOUT;
+	range->pm_capa = IW_POWER_PERIOD | IW_POWER_TIMEOUT | IW_POWER_ALL_R;
+
+	range->we_version_compiled = WIRELESS_EXT;
+	range->we_version_source = 16;
+
+//	range->retry_capa;	/* What retry options are supported */
+//	range->retry_flags;	/* How to decode max/min retry limit */
+//	range->r_time_flags;	/* How to decode max/min retry life */
+//	range->min_retry;	/* Minimal number of retries */
+//	range->max_retry;	/* Maximal number of retries */
+//	range->min_r_time;	/* Minimal retry lifetime */
+//	range->max_r_time;	/* Maximal retry lifetime */
+
+
+	for (i = 0, val = 0; i < 14; i++) {
+
+		// Include only legal frequencies for some countries
+#ifdef ENABLE_DOT11D
+		if ((GET_DOT11D_INFO(priv->ieee80211)->channel_map)[i+1]) {
+#else
+		if ((priv->ieee80211->channel_map)[i+1]) {
+#endif
+			range->freq[val].i = i + 1;
+			range->freq[val].m = ieee80211_wlan_frequencies[i] * 100000;
+			range->freq[val].e = 1;
+			val++;
+		} else {
+			// FIXME: do we need to set anything for channels
+			// we don't use ?
+		}
+
+		if (val == IW_MAX_FREQUENCIES)
+		break;
+	}
+	range->num_frequency = val;
+	range->num_channels = val;
+#if WIRELESS_EXT > 17
+	range->enc_capa = IW_ENC_CAPA_WPA|IW_ENC_CAPA_WPA2|
+			  IW_ENC_CAPA_CIPHER_TKIP|IW_ENC_CAPA_CIPHER_CCMP;
+#endif
+	tmp->scan_capa = 0x01;
+	return 0;
+}
+
+
+static int r8192_wx_set_scan(struct net_device *dev, struct iw_request_info *a,
+			     union iwreq_data *wrqu, char *b)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	struct ieee80211_device* ieee = priv->ieee80211;
+	int ret = 0;
+
+	if(!priv->up) return -ENETDOWN;
+
+	if (priv->ieee80211->LinkDetectInfo.bBusyTraffic == true)
+		return -EAGAIN;
+	if (wrqu->data.flags & IW_SCAN_THIS_ESSID)
+	{
+		struct iw_scan_req* req = (struct iw_scan_req*)b;
+		if (req->essid_len)
+		{
+			//printk("==**&*&*&**===>scan set ssid:%s\n", req->essid);
+			ieee->current_network.ssid_len = req->essid_len;
+			memcpy(ieee->current_network.ssid, req->essid, req->essid_len);
+			//printk("=====>network ssid:%s\n", ieee->current_network.ssid);
+		}
+	}
+
+	down(&priv->wx_sem);
+	if(priv->ieee80211->state != IEEE80211_LINKED){
+		priv->ieee80211->scanning = 0;
+		ieee80211_softmac_scan_syncro(priv->ieee80211);
+		ret = 0;
+	}
+	else
+	ret = ieee80211_wx_set_scan(priv->ieee80211,a,wrqu,b);
+	up(&priv->wx_sem);
+	return ret;
+}
+
+
+static int r8192_wx_get_scan(struct net_device *dev, struct iw_request_info *a,
+			     union iwreq_data *wrqu, char *b)
+{
+
+	int ret;
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+	if(!priv->up) return -ENETDOWN;
+
+	down(&priv->wx_sem);
+
+	ret = ieee80211_wx_get_scan(priv->ieee80211,a,wrqu,b);
+
+	up(&priv->wx_sem);
+
+	return ret;
+}
+
+static int r8192_wx_set_essid(struct net_device *dev,
+			      struct iw_request_info *a,
+			      union iwreq_data *wrqu, char *b)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	int ret;
+	down(&priv->wx_sem);
+
+	ret = ieee80211_wx_set_essid(priv->ieee80211,a,wrqu,b);
+
+	up(&priv->wx_sem);
+
+	return ret;
+}
+
+
+
+
+static int r8192_wx_get_essid(struct net_device *dev,
+			      struct iw_request_info *a,
+			      union iwreq_data *wrqu, char *b)
+{
+	int ret;
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+	down(&priv->wx_sem);
+
+	ret = ieee80211_wx_get_essid(priv->ieee80211, a, wrqu, b);
+
+	up(&priv->wx_sem);
+
+	return ret;
+}
+
+
+static int r8192_wx_set_freq(struct net_device *dev, struct iw_request_info *a,
+			     union iwreq_data *wrqu, char *b)
+{
+	int ret;
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+	down(&priv->wx_sem);
+
+	ret = ieee80211_wx_set_freq(priv->ieee80211, a, wrqu, b);
+
+	up(&priv->wx_sem);
+	return ret;
+}
+
+static int r8192_wx_get_name(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	return ieee80211_wx_get_name(priv->ieee80211, info, wrqu, extra);
+}
+
+
+static int r8192_wx_set_frag(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+	if (wrqu->frag.disabled)
+		priv->ieee80211->fts = DEFAULT_FRAG_THRESHOLD;
+	else {
+		if (wrqu->frag.value < MIN_FRAG_THRESHOLD ||
+		    wrqu->frag.value > MAX_FRAG_THRESHOLD)
+			return -EINVAL;
+
+		priv->ieee80211->fts = wrqu->frag.value & ~0x1;
+	}
+
+	return 0;
+}
+
+
+static int r8192_wx_get_frag(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+	wrqu->frag.value = priv->ieee80211->fts;
+	wrqu->frag.fixed = 0;	/* no auto select */
+	wrqu->frag.disabled = (wrqu->frag.value == DEFAULT_FRAG_THRESHOLD);
+
+	return 0;
+}
+
+
+static int r8192_wx_set_wap(struct net_device *dev,
+			 struct iw_request_info *info,
+			 union iwreq_data *awrq,
+			 char *extra)
+{
+
+	int ret;
+	struct r8192_priv *priv = ieee80211_priv(dev);
+//        struct sockaddr *temp = (struct sockaddr *)awrq;
+	down(&priv->wx_sem);
+
+	ret = ieee80211_wx_set_wap(priv->ieee80211,info,awrq,extra);
+
+	up(&priv->wx_sem);
+
+	return ret;
+
+}
+
+
+static int r8192_wx_get_wap(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu, char *extra)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+	return ieee80211_wx_get_wap(priv->ieee80211,info,wrqu,extra);
+}
+
+
+static int r8192_wx_get_enc(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu, char *key)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+	return ieee80211_wx_get_encode(priv->ieee80211, info, wrqu, key);
+}
+
+static int r8192_wx_set_enc(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu, char *key)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	struct ieee80211_device *ieee = priv->ieee80211;
+	int ret;
+
+	//u32 TargetContent;
+	u32 hwkey[4]={0,0,0,0};
+	u8 mask=0xff;
+	u32 key_idx=0;
+	//u8 broadcast_addr[6] ={	0xff,0xff,0xff,0xff,0xff,0xff};
+	u8 zero_addr[4][6] ={	{0x00,0x00,0x00,0x00,0x00,0x00},
+				{0x00,0x00,0x00,0x00,0x00,0x01},
+				{0x00,0x00,0x00,0x00,0x00,0x02},
+				{0x00,0x00,0x00,0x00,0x00,0x03} };
+	int i;
+
+       if(!priv->up) return -ENETDOWN;
+
+	down(&priv->wx_sem);
+
+	RT_TRACE(COMP_SEC, "Setting SW wep key");
+	ret = ieee80211_wx_set_encode(priv->ieee80211,info,wrqu,key);
+
+	up(&priv->wx_sem);
+
+
+
+	//sometimes, the length is zero while we do not type key value
+	if(wrqu->encoding.length!=0){
+
+		for(i=0 ; i<4 ; i++){
+			hwkey[i] |=  key[4*i+0]&mask;
+			if(i==1&&(4*i+1)==wrqu->encoding.length) mask=0x00;
+			if(i==3&&(4*i+1)==wrqu->encoding.length) mask=0x00;
+			hwkey[i] |= (key[4*i+1]&mask)<<8;
+			hwkey[i] |= (key[4*i+2]&mask)<<16;
+			hwkey[i] |= (key[4*i+3]&mask)<<24;
+		}
+
+		#define CONF_WEP40  0x4
+		#define CONF_WEP104 0x14
+
+		switch(wrqu->encoding.flags & IW_ENCODE_INDEX){
+			case 0: key_idx = ieee->tx_keyidx; break;
+			case 1:	key_idx = 0; break;
+			case 2:	key_idx = 1; break;
+			case 3:	key_idx = 2; break;
+			case 4:	key_idx	= 3; break;
+			default: break;
+		}
+
+		if(wrqu->encoding.length==0x5){
+				ieee->pairwise_key_type = KEY_TYPE_WEP40;
+			EnableHWSecurityConfig8192(dev);
+
+			setKey( dev,
+				key_idx,                //EntryNo
+				key_idx,                //KeyIndex
+				KEY_TYPE_WEP40,         //KeyType
+				zero_addr[key_idx],
+				0,                      //DefaultKey
+				hwkey);                 //KeyContent
+
+		}
+
+		else if(wrqu->encoding.length==0xd){
+				ieee->pairwise_key_type = KEY_TYPE_WEP104;
+				EnableHWSecurityConfig8192(dev);
+
+			setKey( dev,
+				key_idx,                //EntryNo
+				key_idx,                //KeyIndex
+				KEY_TYPE_WEP104,        //KeyType
+				zero_addr[key_idx],
+				0,                      //DefaultKey
+				hwkey);                 //KeyContent
+
+		}
+		else printk("wrong type in WEP, not WEP40 and WEP104\n");
+
+	}
+
+	return ret;
+}
+
+
+static int r8192_wx_set_scan_type(struct net_device *dev, struct iw_request_info *aa, union
+ iwreq_data *wrqu, char *p){
+
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	int *parms=(int*)p;
+	int mode=parms[0];
+
+	priv->ieee80211->active_scan = mode;
+
+	return 1;
+}
+
+
+
+static int r8192_wx_set_retry(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *extra)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	int err = 0;
+
+	down(&priv->wx_sem);
+
+	if (wrqu->retry.flags & IW_RETRY_LIFETIME ||
+	    wrqu->retry.disabled){
+		err = -EINVAL;
+		goto exit;
+	}
+	if (!(wrqu->retry.flags & IW_RETRY_LIMIT)){
+		err = -EINVAL;
+		goto exit;
+	}
+
+	if(wrqu->retry.value > R8180_MAX_RETRY){
+		err= -EINVAL;
+		goto exit;
+	}
+	if (wrqu->retry.flags & IW_RETRY_MAX) {
+		priv->retry_rts = wrqu->retry.value;
+		DMESG("Setting retry for RTS/CTS data to %d", wrqu->retry.value);
+
+	}else {
+		priv->retry_data = wrqu->retry.value;
+		DMESG("Setting retry for non RTS/CTS data to %d", wrqu->retry.value);
+	}
+
+	/* FIXME !
+	 * We might try to write directly the TX config register
+	 * or to restart just the (R)TX process.
+	 * I'm unsure if whole reset is really needed
+	 */
+
+	rtl8192_commit(dev);
+	/*
+	if(priv->up){
+		rtl8180_rtx_disable(dev);
+		rtl8180_rx_enable(dev);
+		rtl8180_tx_enable(dev);
+
+	}
+	*/
+exit:
+	up(&priv->wx_sem);
+
+	return err;
+}
+
+static int r8192_wx_get_retry(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *extra)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+
+	wrqu->retry.disabled = 0; /* can't be disabled */
+
+	if ((wrqu->retry.flags & IW_RETRY_TYPE) ==
+	    IW_RETRY_LIFETIME)
+		return -EINVAL;
+
+	if (wrqu->retry.flags & IW_RETRY_MAX) {
+		wrqu->retry.flags = IW_RETRY_LIMIT | IW_RETRY_MAX;
+		wrqu->retry.value = priv->retry_rts;
+	} else {
+		wrqu->retry.flags = IW_RETRY_LIMIT | IW_RETRY_MIN;
+		wrqu->retry.value = priv->retry_data;
+	}
+	//printk("returning %d",wrqu->retry.value);
+
+
+	return 0;
+}
+
+static int r8192_wx_get_sens(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *extra)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	if(priv->rf_set_sens == NULL)
+		return -1; /* we have not this support for this radio */
+	wrqu->sens.value = priv->sens;
+	return 0;
+}
+
+
+static int r8192_wx_set_sens(struct net_device *dev,
+				struct iw_request_info *info,
+				union iwreq_data *wrqu, char *extra)
+{
+
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+	short err = 0;
+	down(&priv->wx_sem);
+	//DMESG("attempt to set sensivity to %ddb",wrqu->sens.value);
+	if(priv->rf_set_sens == NULL) {
+		err= -1; /* we have not this support for this radio */
+		goto exit;
+	}
+	if(priv->rf_set_sens(dev, wrqu->sens.value) == 0)
+		priv->sens = wrqu->sens.value;
+	else
+		err= -EINVAL;
+
+exit:
+	up(&priv->wx_sem);
+
+	return err;
+}
+
+#if (WIRELESS_EXT >= 18)
+//hw security need to reorganized.
+static int r8192_wx_set_enc_ext(struct net_device *dev,
+					struct iw_request_info *info,
+					union iwreq_data *wrqu, char *extra)
+{
+	int ret=0;
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	struct ieee80211_device* ieee = priv->ieee80211;
+	//printk("===>%s()\n", __FUNCTION__);
+
+
+	down(&priv->wx_sem);
+	ret = ieee80211_wx_set_encode_ext(priv->ieee80211, info, wrqu, extra);
+
+	{
+		u8 broadcast_addr[6] = {0xff,0xff,0xff,0xff,0xff,0xff};
+		u8 zero[6] = {0};
+		u32 key[4] = {0};
+		struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
+		struct iw_point *encoding = &wrqu->encoding;
+		u8 idx = 0, alg = 0, group = 0;
+		if ((encoding->flags & IW_ENCODE_DISABLED) ||
+		ext->alg == IW_ENCODE_ALG_NONE) //none is not allowed to use hwsec WB 2008.07.01
+			goto end_hw_sec;
+
+		alg =  (ext->alg == IW_ENCODE_ALG_CCMP)?KEY_TYPE_CCMP:ext->alg; // as IW_ENCODE_ALG_CCMP is defined to be 3 and KEY_TYPE_CCMP is defined to 4;
+		idx = encoding->flags & IW_ENCODE_INDEX;
+		if (idx)
+			idx --;
+		group = ext->ext_flags & IW_ENCODE_EXT_GROUP_KEY;
+
+		if ((!group) || (IW_MODE_ADHOC == ieee->iw_mode) || (alg ==  KEY_TYPE_WEP40))
+		{
+			if ((ext->key_len == 13) && (alg == KEY_TYPE_WEP40) )
+				alg = KEY_TYPE_WEP104;
+			ieee->pairwise_key_type = alg;
+			EnableHWSecurityConfig8192(dev);
+		}
+		memcpy((u8*)key, ext->key, 16); //we only get 16 bytes key.why? WB 2008.7.1
+
+		if ((alg & KEY_TYPE_WEP40) && (ieee->auth_mode !=2) )
+		{
+
+			setKey( dev,
+					idx,//EntryNo
+					idx, //KeyIndex
+					alg,  //KeyType
+					zero, //MacAddr
+					0,              //DefaultKey
+					key);           //KeyContent
+		}
+		else if (group)
+		{
+			ieee->group_key_type = alg;
+			setKey( dev,
+					idx,//EntryNo
+					idx, //KeyIndex
+					alg,  //KeyType
+					broadcast_addr, //MacAddr
+					0,              //DefaultKey
+					key);           //KeyContent
+		}
+		else //pairwise key
+		{
+			setKey( dev,
+					4,//EntryNo
+					idx, //KeyIndex
+					alg,  //KeyType
+					(u8*)ieee->ap_mac_addr, //MacAddr
+					0,              //DefaultKey
+					key);           //KeyContent
+		}
+
+
+	}
+
+end_hw_sec:
+
+	up(&priv->wx_sem);
+	return ret;
+
+}
+static int r8192_wx_set_auth(struct net_device *dev,
+					struct iw_request_info *info,
+					union iwreq_data *data, char *extra)
+{
+	int ret=0;
+	//printk("====>%s()\n", __FUNCTION__);
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	down(&priv->wx_sem);
+	ret = ieee80211_wx_set_auth(priv->ieee80211, info, &(data->param), extra);
+	up(&priv->wx_sem);
+	return ret;
+}
+
+static int r8192_wx_set_mlme(struct net_device *dev,
+					struct iw_request_info *info,
+					union iwreq_data *wrqu, char *extra)
+{
+	//printk("====>%s()\n", __FUNCTION__);
+
+	int ret=0;
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	down(&priv->wx_sem);
+	ret = ieee80211_wx_set_mlme(priv->ieee80211, info, wrqu, extra);
+
+	up(&priv->wx_sem);
+	return ret;
+}
+#endif
+static int r8192_wx_set_gen_ie(struct net_device *dev,
+					struct iw_request_info *info,
+					union iwreq_data *data, char *extra)
+{
+	   //printk("====>%s(), len:%d\n", __FUNCTION__, data->length);
+	int ret=0;
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	down(&priv->wx_sem);
+	ret = ieee80211_wx_set_gen_ie(priv->ieee80211, extra, data->data.length);
+	up(&priv->wx_sem);
+	//printk("<======%s(), ret:%d\n", __FUNCTION__, ret);
+	return ret;
+
+
+}
+
+static int dummy(struct net_device *dev, struct iw_request_info *a,
+		 union iwreq_data *wrqu,char *b)
+{
+	return -1;
+}
+
+
+static iw_handler r8192_wx_handlers[] =
+{
+	NULL,                     /* SIOCSIWCOMMIT */
+	r8192_wx_get_name,   	  /* SIOCGIWNAME */
+	dummy,                    /* SIOCSIWNWID */
+	dummy,                    /* SIOCGIWNWID */
+	r8192_wx_set_freq,        /* SIOCSIWFREQ */
+	r8192_wx_get_freq,        /* SIOCGIWFREQ */
+	r8192_wx_set_mode,        /* SIOCSIWMODE */
+	r8192_wx_get_mode,        /* SIOCGIWMODE */
+	r8192_wx_set_sens,        /* SIOCSIWSENS */
+	r8192_wx_get_sens,        /* SIOCGIWSENS */
+	NULL,                     /* SIOCSIWRANGE */
+	rtl8180_wx_get_range,	  /* SIOCGIWRANGE */
+	NULL,                     /* SIOCSIWPRIV */
+	NULL,                     /* SIOCGIWPRIV */
+	NULL,                     /* SIOCSIWSTATS */
+	NULL,                     /* SIOCGIWSTATS */
+	dummy,                    /* SIOCSIWSPY */
+	dummy,                    /* SIOCGIWSPY */
+	NULL,                     /* SIOCGIWTHRSPY */
+	NULL,                     /* SIOCWIWTHRSPY */
+	r8192_wx_set_wap,      	  /* SIOCSIWAP */
+	r8192_wx_get_wap,         /* SIOCGIWAP */
+#if (WIRELESS_EXT >= 18)
+	r8192_wx_set_mlme,                     /* MLME-- */
+#else
+	 NULL,
+#endif
+	dummy,                     /* SIOCGIWAPLIST -- depricated */
+	r8192_wx_set_scan,        /* SIOCSIWSCAN */
+	r8192_wx_get_scan,        /* SIOCGIWSCAN */
+	r8192_wx_set_essid,       /* SIOCSIWESSID */
+	r8192_wx_get_essid,       /* SIOCGIWESSID */
+	dummy,                    /* SIOCSIWNICKN */
+	dummy,                    /* SIOCGIWNICKN */
+	NULL,                     /* -- hole -- */
+	NULL,                     /* -- hole -- */
+	r8192_wx_set_rate,        /* SIOCSIWRATE */
+	r8192_wx_get_rate,        /* SIOCGIWRATE */
+	r8192_wx_set_rts,                    /* SIOCSIWRTS */
+	r8192_wx_get_rts,                    /* SIOCGIWRTS */
+	r8192_wx_set_frag,        /* SIOCSIWFRAG */
+	r8192_wx_get_frag,        /* SIOCGIWFRAG */
+	dummy,                    /* SIOCSIWTXPOW */
+	dummy,                    /* SIOCGIWTXPOW */
+	r8192_wx_set_retry,       /* SIOCSIWRETRY */
+	r8192_wx_get_retry,       /* SIOCGIWRETRY */
+	r8192_wx_set_enc,         /* SIOCSIWENCODE */
+	r8192_wx_get_enc,         /* SIOCGIWENCODE */
+	r8192_wx_set_power,                    /* SIOCSIWPOWER */
+	r8192_wx_get_power,                    /* SIOCGIWPOWER */
+	NULL,			/*---hole---*/
+	NULL, 			/*---hole---*/
+	r8192_wx_set_gen_ie,//NULL, 			/* SIOCSIWGENIE */
+	NULL, 			/* SIOCSIWGENIE */
+
+#if (WIRELESS_EXT >= 18)
+	r8192_wx_set_auth,//NULL, 			/* SIOCSIWAUTH */
+	NULL,//r8192_wx_get_auth,//NULL, 			/* SIOCSIWAUTH */
+	r8192_wx_set_enc_ext, 			/* SIOCSIWENCODEEXT */
+	NULL,//r8192_wx_get_enc_ext,//NULL, 			/* SIOCSIWENCODEEXT */
+#else
+	NULL,
+	NULL,
+	NULL,
+	NULL,
+#endif
+	NULL, 			/* SIOCSIWPMKSA */
+	NULL, 			 /*---hole---*/
+
+};
+
+
+static const struct iw_priv_args r8192_private_args[] = {
+
+	{
+		SIOCIWFIRSTPRIV + 0x0,
+		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "badcrc"
+	},
+
+	{
+		SIOCIWFIRSTPRIV + 0x1,
+		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "activescan"
+
+	},
+	{
+		SIOCIWFIRSTPRIV + 0x2,
+		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "rawtx"
+	}
+#ifdef JOHN_IOCTL
+	,
+	{
+		SIOCIWFIRSTPRIV + 0x3,
+		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "readRF"
+	}
+	,
+	{
+		SIOCIWFIRSTPRIV + 0x4,
+		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "writeRF"
+	}
+	,
+	{
+		SIOCIWFIRSTPRIV + 0x5,
+		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "readBB"
+	}
+	,
+	{
+		SIOCIWFIRSTPRIV + 0x6,
+		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "writeBB"
+	}
+	,
+	{
+		SIOCIWFIRSTPRIV + 0x7,
+		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "readnicb"
+	}
+	,
+	{
+		SIOCIWFIRSTPRIV + 0x8,
+		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "writenicb"
+	}
+	,
+	{
+		SIOCIWFIRSTPRIV + 0x9,
+		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "apinfo"
+	}
+
+#endif
+	,
+	{
+		SIOCIWFIRSTPRIV + 0x3,
+		IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "forcereset"
+
+	}
+
+};
+
+
+static iw_handler r8192_private_handler[] = {
+//	r8192_wx_set_monitor,  /* SIOCIWFIRSTPRIV */
+	r8192_wx_set_crcmon,   /*SIOCIWSECONDPRIV*/
+//	r8192_wx_set_forceassociate,
+//	r8192_wx_set_beaconinterval,
+//	r8192_wx_set_monitor_type,
+	r8192_wx_set_scan_type,
+	r8192_wx_set_rawtx,
+#ifdef JOHN_IOCTL
+	r8192_wx_read_regs,
+	r8192_wx_write_regs,
+	r8192_wx_read_bb,
+	r8192_wx_write_bb,
+	r8192_wx_read_nicb,
+	r8192_wx_write_nicb,
+	r8192_wx_get_ap_status,
+#endif
+	//r8192_wx_null,
+	r8192_wx_force_reset,
+};
+
+//#if WIRELESS_EXT >= 17
+struct iw_statistics *r8192_get_wireless_stats(struct net_device *dev)
+{
+       struct r8192_priv *priv = ieee80211_priv(dev);
+	struct ieee80211_device* ieee = priv->ieee80211;
+	struct iw_statistics* wstats = &priv->wstats;
+	int tmp_level = 0;
+	int tmp_qual = 0;
+	int tmp_noise = 0;
+	if(ieee->state < IEEE80211_LINKED)
+	{
+		wstats->qual.qual = 0;
+		wstats->qual.level = 0;
+		wstats->qual.noise = 0;
+		wstats->qual.updated = IW_QUAL_ALL_UPDATED | IW_QUAL_DBM;
+		return wstats;
+	}
+
+       tmp_level = (&ieee->current_network)->stats.rssi;
+	tmp_qual = (&ieee->current_network)->stats.signal;
+	tmp_noise = (&ieee->current_network)->stats.noise;
+	//printk("level:%d, qual:%d, noise:%d\n", tmp_level, tmp_qual, tmp_noise);
+
+	wstats->qual.level = tmp_level;
+	wstats->qual.qual = tmp_qual;
+	wstats->qual.noise = tmp_noise;
+	wstats->qual.updated = IW_QUAL_ALL_UPDATED| IW_QUAL_DBM;
+	return wstats;
+}
+//#endif
+
+
+struct iw_handler_def  r8192_wx_handlers_def={
+	.standard = r8192_wx_handlers,
+	.num_standard = sizeof(r8192_wx_handlers) / sizeof(iw_handler),
+	.private = r8192_private_handler,
+	.num_private = sizeof(r8192_private_handler) / sizeof(iw_handler),
+	.num_private_args = sizeof(r8192_private_args) / sizeof(struct iw_priv_args),
+#if WIRELESS_EXT >= 17
+	.get_wireless_stats = r8192_get_wireless_stats,
+#endif
+	.private_args = (struct iw_priv_args *)r8192_private_args,
+};
diff --git a/drivers/staging/rtl8192u/r8192U_wx.h b/drivers/staging/rtl8192u/r8192U_wx.h
new file mode 100644
index 000000000000..b2f7a571b1c8
--- /dev/null
+++ b/drivers/staging/rtl8192u/r8192U_wx.h
@@ -0,0 +1,23 @@
+/*
+	This is part of rtl8180 OpenSource driver - v 0.3
+	Copyright (C) Andrea Merello 2004  <andreamrl@tiscali.it>
+	Released under the terms of GPL (General Public Licence)
+
+	Parts of this driver are based on the GPL part of the official realtek driver
+	Parts of this driver are based on the rtl8180 driver skeleton from Patric Schenke & Andres Salomon
+	Parts of this driver are based on the Intel Pro Wireless 2100 GPL driver
+
+	We want to tanks the Authors of such projects and the Ndiswrapper project Authors.
+*/
+
+/* this file (will) contains wireless extension handlers*/
+
+#ifndef R8180_WX_H
+#define R8180_WX_H
+//#include <linux/wireless.h>
+//#include "ieee80211.h"
+extern struct iw_handler_def r8192_wx_handlers_def;
+/* Enable  the rtl819x_core.c to share this function, david 2008.9.22 */
+extern struct iw_statistics *r8192_get_wireless_stats(struct net_device *dev);
+
+#endif
diff --git a/drivers/staging/rtl8192u/r819xU_HTGen.h b/drivers/staging/rtl8192u/r819xU_HTGen.h
new file mode 100644
index 000000000000..f37b6d69b404
--- /dev/null
+++ b/drivers/staging/rtl8192u/r819xU_HTGen.h
@@ -0,0 +1,13 @@
+//
+// IOT Action for different AP
+//
+typedef enum _HT_IOT_ACTION{
+	HT_IOT_ACT_TX_USE_AMSDU_4K = 0x00000001,
+	HT_IOT_ACT_TX_USE_AMSDU_8K = 0x00000002,
+	HT_IOT_ACT_DECLARE_MCS13 = 0x00000004,
+	HT_IOT_ACT_DISABLE_EDCA_TURBO = 0x00000008,
+	HT_IOT_ACT_MGNT_USE_CCK_6M = 0x00000010,
+	HT_IOT_ACT_CDD_FSYNC = 0x00000020,
+	HT_IOT_ACT_PURE_N_MODE = 0x00000040,
+}HT_IOT_ACTION_E, *PHT_IOT_ACTION_E;
+
diff --git a/drivers/staging/rtl8192u/r819xU_HTType.h b/drivers/staging/rtl8192u/r819xU_HTType.h
new file mode 100644
index 000000000000..01f58b902028
--- /dev/null
+++ b/drivers/staging/rtl8192u/r819xU_HTType.h
@@ -0,0 +1,391 @@
+#ifndef _R819XU_HTTYPE_H_
+#define _R819XU_HTTYPE_H_
+
+
+//------------------------------------------------------------
+// The HT Capability element is present in beacons, association request,
+//	reassociation request and probe response frames
+//------------------------------------------------------------
+
+//
+// Operation mode value
+//
+#define HT_OPMODE_NO_PROTECT		0
+#define HT_OPMODE_OPTIONAL		1
+#define HT_OPMODE_40MHZ_PROTECT	2
+#define HT_OPMODE_MIXED			3
+
+//
+// MIMO Power Save Setings
+//
+#define MIMO_PS_STATIC				0
+#define MIMO_PS_DYNAMIC			1
+#define MIMO_PS_NOLIMIT			3
+
+
+//
+//	There should be 128 bits to cover all of the MCS rates. However, since
+//	8190 does not support too much rates, one integer is quite enough.
+//
+
+#define sHTCLng	4
+
+
+#define HT_SUPPORTED_MCS_1SS_BITMAP					0x000000ff
+#define HT_SUPPORTED_MCS_2SS_BITMAP					0x0000ff00
+#define HT_SUPPORTED_MCS_1SS_2SS_BITMAP			HT_MCS_1SS_BITMAP|HT_MCS_1SS_2SS_BITMAP
+
+
+typedef enum _HT_MCS_RATE{
+	HT_MCS0   = 0x00000001,
+	HT_MCS1   = 0x00000002,
+	HT_MCS2   = 0x00000004,
+	HT_MCS3   = 0x00000008,
+	HT_MCS4   = 0x00000010,
+	HT_MCS5   = 0x00000020,
+	HT_MCS6   = 0x00000040,
+	HT_MCS7   = 0x00000080,
+	HT_MCS8   = 0x00000100,
+	HT_MCS9   = 0x00000200,
+	HT_MCS10 = 0x00000400,
+	HT_MCS11 = 0x00000800,
+	HT_MCS12 = 0x00001000,
+	HT_MCS13 = 0x00002000,
+	HT_MCS14 = 0x00004000,
+	HT_MCS15 = 0x00008000,
+	// Do not define MCS32 here although 8190 support MCS32
+}HT_MCS_RATE,*PHT_MCS_RATE;
+
+//
+// Represent Channel Width in HT Capabilities
+//
+typedef enum _HT_CHANNEL_WIDTH{
+	HT_CHANNEL_WIDTH_20 = 0,
+	HT_CHANNEL_WIDTH_20_40 = 1,
+}HT_CHANNEL_WIDTH, *PHT_CHANNEL_WIDTH;
+
+//
+// Represent Extention Channel Offset in HT Capabilities
+// This is available only in 40Mhz mode.
+//
+typedef enum _HT_EXTCHNL_OFFSET{
+	HT_EXTCHNL_OFFSET_NO_EXT = 0,
+	HT_EXTCHNL_OFFSET_UPPER = 1,
+	HT_EXTCHNL_OFFSET_NO_DEF = 2,
+	HT_EXTCHNL_OFFSET_LOWER = 3,
+}HT_EXTCHNL_OFFSET, *PHT_EXTCHNL_OFFSET;
+
+typedef enum _CHNLOP{
+	CHNLOP_NONE = 0, // No Action now
+	CHNLOP_SCAN = 1, // Scan in progress
+	CHNLOP_SWBW = 2, // Bandwidth switching in progress
+	CHNLOP_SWCHNL = 3, // Software Channel switching in progress
+} CHNLOP, *PCHNLOP;
+
+// Determine if the Channel Operation is in progress
+#define CHHLOP_IN_PROGRESS(_pHTInfo)	\
+		((_pHTInfo)->ChnlOp > CHNLOP_NONE) ? TRUE : FALSE
+
+
+typedef enum _HT_ACTION{
+	ACT_RECOMMAND_WIDTH		= 0,
+	ACT_MIMO_PWR_SAVE 		= 1,
+	ACT_PSMP					= 2,
+	ACT_SET_PCO_PHASE		= 3,
+	ACT_MIMO_CHL_MEASURE	= 4,
+	ACT_RECIPROCITY_CORRECT	= 5,
+	ACT_MIMO_CSI_MATRICS		= 6,
+	ACT_MIMO_NOCOMPR_STEER	= 7,
+	ACT_MIMO_COMPR_STEER		= 8,
+	ACT_ANTENNA_SELECT		= 9,
+} HT_ACTION, *PHT_ACTION;
+
+
+/* 2007/06/07 MH Define sub-carrier mode for 40MHZ. */
+typedef enum _HT_Bandwidth_40MHZ_Sub_Carrier{
+	SC_MODE_DUPLICATE = 0,
+	SC_MODE_LOWER = 1,
+	SC_MODE_UPPER = 2,
+	SC_MODE_FULL40MHZ = 3,
+}HT_BW40_SC_E;
+
+typedef	struct _HT_CAPABILITY_ELE{
+
+	//HT capability info
+	u8	AdvCoding:1;
+	u8	ChlWidth:1;
+	u8	MimoPwrSave:2;
+	u8	GreenField:1;
+	u8	ShortGI20Mhz:1;
+	u8	ShortGI40Mhz:1;
+	u8	TxSTBC:1;
+	u8	RxSTBC:2;
+	u8	DelayBA:1;
+	u8	MaxAMSDUSize:1;
+	u8	DssCCk:1;
+	u8	PSMP:1;
+	u8	Rsvd1:1;
+	u8	LSigTxopProtect:1;
+
+	//MAC HT parameters info
+	u8	MaxRxAMPDUFactor:2;
+	u8	MPDUDensity:3;
+	u8	Rsvd2:3;
+
+	//Supported MCS set
+	u8	MCS[16];
+
+
+	//Extended HT Capability Info
+	u16	ExtHTCapInfo;
+
+	//TXBF Capabilities
+	u8	TxBFCap[4];
+
+	//Antenna Selection Capabilities
+	u8	ASCap;
+
+}__attribute__((packed)) HT_CAPABILITY_ELE, *PHT_CAPABILITY_ELE;
+
+//------------------------------------------------------------
+// The HT Information element is present in beacons
+// Only AP is required to include this element
+//------------------------------------------------------------
+
+typedef struct _HT_INFORMATION_ELE{
+	u8	ControlChl;
+
+	u8	ExtChlOffset:2;
+	u8	RecommemdedTxWidth:1;
+	u8	RIFS:1;
+	u8	PSMPAccessOnly:1;
+	u8	SrvIntGranularity:3;
+
+	u8	OptMode:2;
+	u8	NonGFDevPresent:1;
+	u8	Revd1:5;
+	u8	Revd2:8;
+
+	u8	Rsvd3:6;
+	u8	DualBeacon:1;
+	u8	DualCTSProtect:1;
+
+	u8	SecondaryBeacon:1;
+	u8	LSigTxopProtectFull:1;
+	u8	PcoActive:1;
+	u8	PcoPhase:1;
+	u8	Rsvd4:4;
+
+	u8	BasicMSC[16];
+}__attribute__((packed)) HT_INFORMATION_ELE, *PHT_INFORMATION_ELE;
+
+//
+// MIMO Power Save control field.
+// This is appear in MIMO Power Save Action Frame
+//
+typedef struct _MIMOPS_CTRL{
+	u8	MimoPsEnable:1;
+	u8	MimoPsMode:1;
+	u8	Reserved:6;
+} MIMOPS_CTRL, *PMIMOPS_CTRL;
+
+typedef enum _HT_SPEC_VER{
+	HT_SPEC_VER_IEEE = 0,
+	HT_SPEC_VER_EWC = 1,
+}HT_SPEC_VER, *PHT_SPEC_VER;
+
+typedef enum _HT_AGGRE_MODE_E{
+	HT_AGG_AUTO = 0,
+	HT_AGG_FORCE_ENABLE = 1,
+	HT_AGG_FORCE_DISABLE = 2,
+}HT_AGGRE_MODE_E, *PHT_AGGRE_MODE_E;
+
+//------------------------------------------------------------
+//  The Data structure is used to keep HT related variables when card is
+//  configured as non-AP STA mode.  **Note**  Current_xxx should be set
+//	to default value in HTInitializeHTInfo()
+//------------------------------------------------------------
+
+typedef struct _RT_HIGH_THROUGHPUT{
+//	DECLARE_RT_OBJECT(_RT_HIGH_THROUGHPUT);
+	u8				bEnableHT;
+	u8				bCurrentHTSupport;
+
+	u8				bRegBW40MHz;				// Tx 40MHz channel capablity
+	u8				bCurBW40MHz;				// Tx 40MHz channel capability
+
+	u8				bRegShortGI40MHz;			// Tx Short GI for 40Mhz
+	u8				bCurShortGI40MHz;			// Tx Short GI for 40MHz
+
+	u8				bRegShortGI20MHz;			// Tx Short GI for 20MHz
+	u8				bCurShortGI20MHz;			// Tx Short GI for 20MHz
+
+	u8				bRegSuppCCK;				// Tx CCK rate capability
+	u8				bCurSuppCCK;				// Tx CCK rate capability
+
+	// 802.11n spec version for "peer"
+	HT_SPEC_VER			ePeerHTSpecVer;
+
+
+	// HT related information for "Self"
+	HT_CAPABILITY_ELE	SelfHTCap;					// This is HT cap element sent to peer STA, which also indicate HT Rx capabilities.
+	HT_INFORMATION_ELE	SelfHTInfo;					// This is HT info element sent to peer STA, which also indicate HT Rx capabilities.
+
+	// HT related information for "Peer"
+	u8				PeerHTCapBuf[32];
+	u8				PeerHTInfoBuf[32];
+
+
+	// A-MSDU related
+	u8				bAMSDU_Support;			// This indicates Tx A-MSDU capability
+	u16				nAMSDU_MaxSize;			// This indicates Tx A-MSDU capability
+	u8				bCurrent_AMSDU_Support;	// This indicates Tx A-MSDU capability
+	u16				nCurrent_AMSDU_MaxSize;	// This indicates Tx A-MSDU capability
+
+
+	// AMPDU  related <2006.08.10 Emily>
+	u8				bAMPDUEnable;				// This indicate Tx A-MPDU capability
+	u8				bCurrentAMPDUEnable;		// This indicate Tx A-MPDU capability
+	u8				AMPDU_Factor;				// This indicate Tx A-MPDU capability
+	u8				CurrentAMPDUFactor;		// This indicate Tx A-MPDU capability
+	u8				MPDU_Density;				// This indicate Tx A-MPDU capability
+	u8				CurrentMPDUDensity;			// This indicate Tx A-MPDU capability
+
+	// Forced A-MPDU enable
+	HT_AGGRE_MODE_E	ForcedAMPDUMode;
+	u8				ForcedAMPDUFactor;
+	u8				ForcedMPDUDensity;
+
+	// Forced A-MSDU enable
+	HT_AGGRE_MODE_E	ForcedAMSDUMode;
+	u16				ForcedAMSDUMaxSize;
+
+	u8				bForcedShortGI;
+
+	u8				CurrentOpMode;
+
+	// MIMO PS related
+	u8				SelfMimoPs;
+	u8				PeerMimoPs;
+
+	// 40MHz Channel Offset settings.
+	HT_EXTCHNL_OFFSET	CurSTAExtChnlOffset;
+	u8				bCurTxBW40MHz;	// If we use 40 MHz to Tx
+	u8				PeerBandwidth;
+
+	// For Bandwidth Switching
+	u8				bSwBwInProgress;
+	CHNLOP				ChnlOp; // software switching channel in progress. By Bruce, 2008-02-15.
+	u8				SwBwStep;
+	//RT_TIMER			SwBwTimer;
+	struct timer_list		SwBwTimer;
+
+	// For Realtek proprietary A-MPDU factor for aggregation
+	u8				bRegRT2RTAggregation;
+	u8				bCurrentRT2RTAggregation;
+	u8				bCurrentRT2RTLongSlotTime;
+	u8				szRT2RTAggBuffer[10];
+
+	// Rx Reorder control
+	u8				bRegRxReorderEnable;
+	u8				bCurRxReorderEnable;
+	u8				RxReorderWinSize;
+	u8				RxReorderPendingTime;
+	u16				RxReorderDropCounter;
+
+#ifdef USB_TX_DRIVER_AGGREGATION_ENABLE
+	u8				UsbTxAggrNum;
+#endif
+#ifdef USB_RX_AGGREGATION_SUPPORT
+	u8				UsbRxFwAggrEn;
+	u8				UsbRxFwAggrPageNum;
+	u8				UsbRxFwAggrPacketNum;
+	u8				UsbRxFwAggrTimeout;
+#endif
+
+	// Add for Broadcom(Linksys) IOT. Joseph
+	u8				bIsPeerBcm;
+
+	// For IOT issue.
+	u32					IOTAction;
+}RT_HIGH_THROUGHPUT, *PRT_HIGH_THROUGHPUT;
+
+
+//------------------------------------------------------------
+// The Data structure is used to keep HT related variable for "each Sta"
+// when card is configured as "AP mode"
+//------------------------------------------------------------
+
+typedef struct _RT_HTINFO_STA_ENTRY{
+	u8			bEnableHT;
+
+	u8			bSupportCck;
+
+	u16			AMSDU_MaxSize;
+
+	u8			AMPDU_Factor;
+	u8			MPDU_Density;
+
+	u8			HTHighestOperaRate;
+
+	u8			bBw40MHz;
+
+	u8			MimoPs;
+
+	u8			McsRateSet[16];
+
+
+}RT_HTINFO_STA_ENTRY, *PRT_HTINFO_STA_ENTRY;
+
+
+
+
+
+//------------------------------------------------------------
+// The Data structure is used to keep HT related variable for "each AP"
+// when card is configured as "STA mode"
+//------------------------------------------------------------
+
+typedef struct _BSS_HT{
+
+	u8				bdSupportHT;
+
+	// HT related elements
+	u8					bdHTCapBuf[32];
+	u16					bdHTCapLen;
+	u8					bdHTInfoBuf[32];
+	u16					bdHTInfoLen;
+
+	HT_SPEC_VER				bdHTSpecVer;
+	//HT_CAPABILITY_ELE			bdHTCapEle;
+	//HT_INFORMATION_ELE		bdHTInfoEle;
+
+	u8					bdRT2RTAggregation;
+	u8					bdRT2RTLongSlotTime;
+}BSS_HT, *PBSS_HT;
+
+typedef struct _MIMO_RSSI{
+	u32	EnableAntenna;
+	u32	AntennaA;
+	u32 	AntennaB;
+	u32 	AntennaC;
+	u32 	AntennaD;
+	u32	Average;
+}MIMO_RSSI, *PMIMO_RSSI;
+
+typedef struct _MIMO_EVM{
+	u32	EVM1;
+	u32    EVM2;
+}MIMO_EVM, *PMIMO_EVM;
+
+typedef struct _FALSE_ALARM_STATISTICS{
+	u32	Cnt_Parity_Fail;
+	u32    Cnt_Rate_Illegal;
+	u32	Cnt_Crc8_fail;
+	u32	Cnt_all;
+}FALSE_ALARM_STATISTICS, *PFALSE_ALARM_STATISTICS;
+
+
+
+#endif //__INC_HTTYPE_H
+
diff --git a/drivers/staging/rtl8192u/r819xU_cmdpkt.c b/drivers/staging/rtl8192u/r819xU_cmdpkt.c
new file mode 100644
index 000000000000..fd19a85297a9
--- /dev/null
+++ b/drivers/staging/rtl8192u/r819xU_cmdpkt.c
@@ -0,0 +1,791 @@
+/******************************************************************************
+
+     (c) Copyright 2008, RealTEK Technologies Inc. All Rights Reserved.
+
+ Module:	r819xusb_cmdpkt.c	(RTL8190 TX/RX command packet handler Source C File)
+
+ Note:      The module is responsible for handling TX and RX command packet.
+			1. TX : Send set and query configuration command packet.
+			2. RX : Receive tx feedback, beacon state, query configuration
+				command packet.
+
+ Function:
+
+ Export:
+
+ Abbrev:
+
+ History:
+	Data		Who		Remark
+
+	05/06/2008  amy    	Create initial version porting from windows driver.
+
+******************************************************************************/
+#include "r8192U.h"
+#include "r819xU_cmdpkt.h"
+/*---------------------------Define Local Constant---------------------------*/
+/* Debug constant*/
+#define		CMPK_DEBOUNCE_CNT			1
+/* 2007/10/24 MH Add for printing a range of data. */
+#define		CMPK_PRINT(Address)\
+{\
+	unsigned char	i;\
+	u32	temp[10];\
+	\
+	memcpy(temp, Address, 40);\
+	for (i = 0; i <40; i+=4)\
+		printk("\r\n %08x", temp[i]);\
+}\
+/*---------------------------Define functions---------------------------------*/
+
+rt_status
+SendTxCommandPacket(
+	struct net_device *dev,
+	void* 			pData,
+	u32				DataLen
+	)
+{
+	rt_status	rtStatus = RT_STATUS_SUCCESS;
+	struct r8192_priv   *priv = ieee80211_priv(dev);
+	struct sk_buff	    *skb;
+	cb_desc		    *tcb_desc;
+	unsigned char	    *ptr_buf;
+	//bool	bLastInitPacket = false;
+
+	//PlatformAcquireSpinLock(Adapter, RT_TX_SPINLOCK);
+
+	//Get TCB and local buffer from common pool. (It is shared by CmdQ, MgntQ, and USB coalesce DataQ)
+	skb  = dev_alloc_skb(USB_HWDESC_HEADER_LEN + DataLen + 4);
+	memcpy((unsigned char *)(skb->cb),&dev,sizeof(dev));
+	tcb_desc = (cb_desc*)(skb->cb + MAX_DEV_ADDR_SIZE);
+	tcb_desc->queue_index = TXCMD_QUEUE;
+	tcb_desc->bCmdOrInit = DESC_PACKET_TYPE_NORMAL;
+	tcb_desc->bLastIniPkt = 0;
+	skb_reserve(skb, USB_HWDESC_HEADER_LEN);
+	ptr_buf = skb_put(skb, DataLen);
+	memset(ptr_buf,0,DataLen);
+	memcpy(ptr_buf,pData,DataLen);
+	tcb_desc->txbuf_size= (u16)DataLen;
+
+	if(!priv->ieee80211->check_nic_enough_desc(dev,tcb_desc->queue_index)||
+			(!skb_queue_empty(&priv->ieee80211->skb_waitQ[tcb_desc->queue_index]))||\
+			(priv->ieee80211->queue_stop) ) {
+			RT_TRACE(COMP_FIRMWARE,"===================NULL packet==================================> tx full!\n");
+			skb_queue_tail(&priv->ieee80211->skb_waitQ[tcb_desc->queue_index], skb);
+		} else {
+			priv->ieee80211->softmac_hard_start_xmit(skb,dev);
+		}
+
+	//PlatformReleaseSpinLock(Adapter, RT_TX_SPINLOCK);
+	return rtStatus;
+}
+
+/*-----------------------------------------------------------------------------
+ * Function:	cmpk_message_handle_tx()
+ *
+ * Overview:	Driver internal module can call the API to send message to
+ *				firmware side. For example, you can send a debug command packet.
+ *				Or you can send a request for FW to modify RLX4181 LBUS HW bank.
+ *				Otherwise, you can change MAC/PHT/RF register by firmware at
+ *				run time. We do not support message more than one segment now.
+ *
+ * Input:		NONE
+ *
+ * Output:		NONE
+ *
+ * Return:		NONE
+ *
+ * Revised History:
+ *	When		Who		Remark
+ *	05/06/2008	amy		porting from windows code.
+ *
+ *---------------------------------------------------------------------------*/
+ extern	rt_status	cmpk_message_handle_tx(
+	struct net_device *dev,
+	u8*	codevirtualaddress,
+	u32	packettype,
+	u32	buffer_len)
+{
+
+	bool 	    rt_status = true;
+#ifdef RTL8192U
+	return rt_status;
+#else
+	struct r8192_priv   *priv = ieee80211_priv(dev);
+	u16		    frag_threshold;
+	u16		    frag_length, frag_offset = 0;
+	//u16		    total_size;
+	//int		    i;
+
+	rt_firmware	    *pfirmware = priv->pFirmware;
+	struct sk_buff	    *skb;
+	unsigned char	    *seg_ptr;
+	cb_desc		    *tcb_desc;
+	u8                  bLastIniPkt;
+
+	firmware_init_param(dev);
+	//Fragmentation might be required
+	frag_threshold = pfirmware->cmdpacket_frag_thresold;
+	do {
+		if((buffer_len - frag_offset) > frag_threshold) {
+			frag_length = frag_threshold ;
+			bLastIniPkt = 0;
+
+		} else {
+			frag_length = buffer_len - frag_offset;
+			bLastIniPkt = 1;
+
+		}
+
+		/* Allocate skb buffer to contain firmware info and tx descriptor info
+		 * add 4 to avoid packet appending overflow.
+		 * */
+		#ifdef RTL8192U
+		skb  = dev_alloc_skb(USB_HWDESC_HEADER_LEN + frag_length + 4);
+		#else
+		skb  = dev_alloc_skb(frag_length + 4);
+		#endif
+		memcpy((unsigned char *)(skb->cb),&dev,sizeof(dev));
+		tcb_desc = (cb_desc*)(skb->cb + MAX_DEV_ADDR_SIZE);
+		tcb_desc->queue_index = TXCMD_QUEUE;
+		tcb_desc->bCmdOrInit = packettype;
+		tcb_desc->bLastIniPkt = bLastIniPkt;
+
+		#ifdef RTL8192U
+		skb_reserve(skb, USB_HWDESC_HEADER_LEN);
+		#endif
+
+		seg_ptr = skb_put(skb, buffer_len);
+		/*
+		 * Transform from little endian to big endian
+		 * and pending  zero
+		 */
+		memcpy(seg_ptr,codevirtualaddress,buffer_len);
+		tcb_desc->txbuf_size= (u16)buffer_len;
+
+
+		if(!priv->ieee80211->check_nic_enough_desc(dev,tcb_desc->queue_index)||
+			(!skb_queue_empty(&priv->ieee80211->skb_waitQ[tcb_desc->queue_index]))||\
+			(priv->ieee80211->queue_stop) ) {
+			RT_TRACE(COMP_FIRMWARE,"=====================================================> tx full!\n");
+			skb_queue_tail(&priv->ieee80211->skb_waitQ[tcb_desc->queue_index], skb);
+		} else {
+			priv->ieee80211->softmac_hard_start_xmit(skb,dev);
+		}
+
+		codevirtualaddress += frag_length;
+		frag_offset += frag_length;
+
+	}while(frag_offset < buffer_len);
+
+	return rt_status;
+
+
+#endif
+}	/* CMPK_Message_Handle_Tx */
+
+/*-----------------------------------------------------------------------------
+ * Function:    cmpk_counttxstatistic()
+ *
+ * Overview:
+ *
+ * Input:       PADAPTER 	pAdapter		-	.
+ *				CMPK_TXFB_T *psTx_FB	-	.
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Revised History:
+ *  When		Who		Remark
+ *  05/12/2008	amy 	Create Version 0 porting from windows code.
+ *
+ *---------------------------------------------------------------------------*/
+static	void
+cmpk_count_txstatistic(
+	struct net_device *dev,
+	cmpk_txfb_t	*pstx_fb)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+#ifdef ENABLE_PS
+	RT_RF_POWER_STATE	rtState;
+
+	pAdapter->HalFunc.GetHwRegHandler(pAdapter, HW_VAR_RF_STATE, (pu1Byte)(&rtState));
+
+	// When RF is off, we should not count the packet for hw/sw synchronize
+	// reason, ie. there may be a duration while sw switch is changed and hw
+	// switch is being changed. 2006.12.04, by shien chang.
+	if (rtState == eRfOff)
+	{
+		return;
+	}
+#endif
+
+#ifdef TODO
+	if(pAdapter->bInHctTest)
+		return;
+#endif
+	/* We can not know the packet length and transmit type: broadcast or uni
+	   or multicast. So the relative statistics must be collected in tx
+	   feedback info. */
+	if (pstx_fb->tok)
+	{
+		priv->stats.txfeedbackok++;
+		priv->stats.txoktotal++;
+		priv->stats.txokbytestotal += pstx_fb->pkt_length;
+		priv->stats.txokinperiod++;
+
+		/* We can not make sure broadcast/multicast or unicast mode. */
+		if (pstx_fb->pkt_type == PACKET_MULTICAST)
+		{
+			priv->stats.txmulticast++;
+			priv->stats.txbytesmulticast += pstx_fb->pkt_length;
+		}
+		else if (pstx_fb->pkt_type == PACKET_BROADCAST)
+		{
+			priv->stats.txbroadcast++;
+			priv->stats.txbytesbroadcast += pstx_fb->pkt_length;
+		}
+		else
+		{
+			priv->stats.txunicast++;
+			priv->stats.txbytesunicast += pstx_fb->pkt_length;
+		}
+	}
+	else
+	{
+		priv->stats.txfeedbackfail++;
+		priv->stats.txerrtotal++;
+		priv->stats.txerrbytestotal += pstx_fb->pkt_length;
+
+		/* We can not make sure broadcast/multicast or unicast mode. */
+		if (pstx_fb->pkt_type == PACKET_MULTICAST)
+		{
+			priv->stats.txerrmulticast++;
+		}
+		else if (pstx_fb->pkt_type == PACKET_BROADCAST)
+		{
+			priv->stats.txerrbroadcast++;
+		}
+		else
+		{
+			priv->stats.txerrunicast++;
+		}
+	}
+
+	priv->stats.txretrycount += pstx_fb->retry_cnt;
+	priv->stats.txfeedbackretry += pstx_fb->retry_cnt;
+
+}	/* cmpk_CountTxStatistic */
+
+
+
+/*-----------------------------------------------------------------------------
+ * Function:    cmpk_handle_tx_feedback()
+ *
+ * Overview:	The function is responsible for extract the message inside TX
+ *				feedbck message from firmware. It will contain dedicated info in
+ *				ws-06-0063-rtl8190-command-packet-specification. Please
+ *				refer to chapter "TX Feedback Element". We have to read 20 bytes
+ *				in the command packet.
+ *
+ * Input:       struct net_device *    dev
+ *				u8 	*	pmsg		-	Msg Ptr of the command packet.
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Revised History:
+ *  When		Who		Remark
+ *  05/08/2008	amy		Create Version 0 porting from windows code.
+ *
+ *---------------------------------------------------------------------------*/
+static	void
+cmpk_handle_tx_feedback(
+	struct net_device *dev,
+	u8	*	pmsg)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	cmpk_txfb_t		rx_tx_fb;	/* */
+
+	priv->stats.txfeedback++;
+
+	/* 0. Display received message. */
+	//cmpk_Display_Message(CMPK_RX_TX_FB_SIZE, pMsg);
+
+	/* 1. Extract TX feedback info from RFD to temp structure buffer. */
+	/* It seems that FW use big endian(MIPS) and DRV use little endian in
+	   windows OS. So we have to read the content byte by byte or transfer
+	   endian type before copy the message copy. */
+	/* 2007/07/05 MH Use pointer to transfer structure memory. */
+	//memcpy((UINT8 *)&rx_tx_fb, pMsg, sizeof(CMPK_TXFB_T));
+	memcpy((u8*)&rx_tx_fb, pmsg, sizeof(cmpk_txfb_t));
+	/* 2. Use tx feedback info to count TX statistics. */
+	cmpk_count_txstatistic(dev, &rx_tx_fb);
+	/* 2007/01/17 MH Comment previous method for TX statistic function. */
+	/* Collect info TX feedback packet to fill TCB. */
+	/* We can not know the packet length and transmit type: broadcast or uni
+	   or multicast. */
+	//CountTxStatistics( pAdapter, &tcb );
+
+}	/* cmpk_Handle_Tx_Feedback */
+
+void
+cmdpkt_beacontimerinterrupt_819xusb(
+	struct net_device *dev
+)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	u16 tx_rate;
+	{
+		//
+		// 070117, rcnjko: 87B have to S/W beacon for DTM encryption_cmn.
+		//
+		if(priv->ieee80211->current_network.mode == IEEE_A  ||
+			priv->ieee80211->current_network.mode == IEEE_N_5G ||
+			(priv->ieee80211->current_network.mode == IEEE_N_24G  && (!priv->ieee80211->pHTInfo->bCurSuppCCK)))
+		{
+			tx_rate = 60;
+			DMESG("send beacon frame  tx rate is 6Mbpm\n");
+		}
+		else
+		{
+			tx_rate =10;
+			DMESG("send beacon frame  tx rate is 1Mbpm\n");
+		}
+
+		rtl819xusb_beacon_tx(dev,tx_rate); // HW Beacon
+
+	}
+
+}
+
+
+
+
+/*-----------------------------------------------------------------------------
+ * Function:    cmpk_handle_interrupt_status()
+ *
+ * Overview:    The function is responsible for extract the message from
+ *				firmware. It will contain dedicated info in
+ *				ws-07-0063-v06-rtl819x-command-packet-specification-070315.doc.
+ * 				Please refer to chapter "Interrupt Status Element".
+ *
+ * Input:       struct net_device *dev,
+ *			u8*	pmsg		-	Message Pointer of the command packet.
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Revised History:
+ *  When			Who			Remark
+ *  05/12/2008	amy		Add this for rtl8192 porting from windows code.
+ *
+ *---------------------------------------------------------------------------*/
+static	void
+cmpk_handle_interrupt_status(
+	struct net_device *dev,
+	u8*	pmsg)
+{
+	cmpk_intr_sta_t		rx_intr_status;	/* */
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+	DMESG("---> cmpk_Handle_Interrupt_Status()\n");
+
+	/* 0. Display received message. */
+	//cmpk_Display_Message(CMPK_RX_BEACON_STATE_SIZE, pMsg);
+
+	/* 1. Extract TX feedback info from RFD to temp structure buffer. */
+	/* It seems that FW use big endian(MIPS) and DRV use little endian in
+	   windows OS. So we have to read the content byte by byte or transfer
+	   endian type before copy the message copy. */
+	//rx_bcn_state.Element_ID 	= pMsg[0];
+	//rx_bcn_state.Length 		= pMsg[1];
+	rx_intr_status.length = pmsg[1];
+	if (rx_intr_status.length != (sizeof(cmpk_intr_sta_t) - 2))
+	{
+		DMESG("cmpk_Handle_Interrupt_Status: wrong length!\n");
+		return;
+	}
+
+
+	// Statistics of beacon for ad-hoc mode.
+	if(	priv->ieee80211->iw_mode == IW_MODE_ADHOC)
+	{
+		//2 maybe need endian transform?
+		rx_intr_status.interrupt_status = *((u32 *)(pmsg + 4));
+		//rx_intr_status.InterruptStatus = N2H4BYTE(*((UINT32 *)(pMsg + 4)));
+
+		DMESG("interrupt status = 0x%x\n", rx_intr_status.interrupt_status);
+
+		if (rx_intr_status.interrupt_status & ISR_TxBcnOk)
+		{
+			priv->ieee80211->bibsscoordinator = true;
+			priv->stats.txbeaconokint++;
+		}
+		else if (rx_intr_status.interrupt_status & ISR_TxBcnErr)
+		{
+			priv->ieee80211->bibsscoordinator = false;
+			priv->stats.txbeaconerr++;
+		}
+
+		if (rx_intr_status.interrupt_status & ISR_BcnTimerIntr)
+		{
+			cmdpkt_beacontimerinterrupt_819xusb(dev);
+		}
+
+	}
+
+	 // Other informations in interrupt status we need?
+
+
+	DMESG("<---- cmpk_handle_interrupt_status()\n");
+
+}	/* cmpk_handle_interrupt_status */
+
+
+/*-----------------------------------------------------------------------------
+ * Function:    cmpk_handle_query_config_rx()
+ *
+ * Overview:    The function is responsible for extract the message from
+ *				firmware. It will contain dedicated info in
+ *				ws-06-0063-rtl8190-command-packet-specification. Please
+ *				refer to chapter "Beacon State Element".
+ *
+ * Input:       u8 *  pmsg	-	Message Pointer of the command packet.
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Revised History:
+ *  When		Who		Remark
+ *  05/12/2008	amy		Create Version 0 porting from windows code.
+ *
+ *---------------------------------------------------------------------------*/
+static	void
+cmpk_handle_query_config_rx(
+	struct net_device *dev,
+	u8*	   pmsg)
+{
+	cmpk_query_cfg_t	rx_query_cfg;	/* */
+
+	/* 0. Display received message. */
+	//cmpk_Display_Message(CMPK_RX_BEACON_STATE_SIZE, pMsg);
+
+	/* 1. Extract TX feedback info from RFD to temp structure buffer. */
+	/* It seems that FW use big endian(MIPS) and DRV use little endian in
+	   windows OS. So we have to read the content byte by byte or transfer
+	   endian type before copy the message copy. */
+	//rx_query_cfg.Element_ID 	= pMsg[0];
+	//rx_query_cfg.Length 		= pMsg[1];
+	rx_query_cfg.cfg_action 	= (pmsg[4] & 0x80000000)>>31;
+	rx_query_cfg.cfg_type 		= (pmsg[4] & 0x60) >> 5;
+	rx_query_cfg.cfg_size 		= (pmsg[4] & 0x18) >> 3;
+	rx_query_cfg.cfg_page 		= (pmsg[6] & 0x0F) >> 0;
+	rx_query_cfg.cfg_offset 		= pmsg[7];
+	rx_query_cfg.value 			= (pmsg[8] << 24) | (pmsg[9] << 16) |
+								  (pmsg[10] << 8) | (pmsg[11] << 0);
+	rx_query_cfg.mask 			= (pmsg[12] << 24) | (pmsg[13] << 16) |
+								  (pmsg[14] << 8) | (pmsg[15] << 0);
+
+}	/* cmpk_Handle_Query_Config_Rx */
+
+
+/*-----------------------------------------------------------------------------
+ * Function:	cmpk_count_tx_status()
+ *
+ * Overview:	Count aggregated tx status from firmwar of one type rx command
+ *				packet element id = RX_TX_STATUS.
+ *
+ * Input:		NONE
+ *
+ * Output:		NONE
+ *
+ * Return:		NONE
+ *
+ * Revised History:
+ *	When		Who		Remark
+ *	05/12/2008	amy		Create Version 0 porting from windows code.
+ *
+ *---------------------------------------------------------------------------*/
+static	void	cmpk_count_tx_status(	struct net_device *dev,
+									cmpk_tx_status_t 	*pstx_status)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+#ifdef ENABLE_PS
+
+	RT_RF_POWER_STATE	rtstate;
+
+	pAdapter->HalFunc.GetHwRegHandler(pAdapter, HW_VAR_RF_STATE, (pu1Byte)(&rtState));
+
+	// When RF is off, we should not count the packet for hw/sw synchronize
+	// reason, ie. there may be a duration while sw switch is changed and hw
+	// switch is being changed. 2006.12.04, by shien chang.
+	if (rtState == eRfOff)
+	{
+		return;
+	}
+#endif
+
+	priv->stats.txfeedbackok	+= pstx_status->txok;
+	priv->stats.txoktotal		+= pstx_status->txok;
+
+	priv->stats.txfeedbackfail	+= pstx_status->txfail;
+	priv->stats.txerrtotal		+= pstx_status->txfail;
+
+	priv->stats.txretrycount		+= pstx_status->txretry;
+	priv->stats.txfeedbackretry	+= pstx_status->txretry;
+
+	//pAdapter->TxStats.NumTxOkBytesTotal += psTx_FB->pkt_length;
+	//pAdapter->TxStats.NumTxErrBytesTotal += psTx_FB->pkt_length;
+	//pAdapter->MgntInfo.LinkDetectInfo.NumTxOkInPeriod++;
+
+	priv->stats.txmulticast	+= pstx_status->txmcok;
+	priv->stats.txbroadcast	+= pstx_status->txbcok;
+	priv->stats.txunicast		+= pstx_status->txucok;
+
+	priv->stats.txerrmulticast	+= pstx_status->txmcfail;
+	priv->stats.txerrbroadcast	+= pstx_status->txbcfail;
+	priv->stats.txerrunicast	+= pstx_status->txucfail;
+
+	priv->stats.txbytesmulticast	+= pstx_status->txmclength;
+	priv->stats.txbytesbroadcast	+= pstx_status->txbclength;
+	priv->stats.txbytesunicast		+= pstx_status->txuclength;
+
+	priv->stats.last_packet_rate		= pstx_status->rate;
+}	/* cmpk_CountTxStatus */
+
+
+
+/*-----------------------------------------------------------------------------
+ * Function:	cmpk_handle_tx_status()
+ *
+ * Overview:	Firmware add a new tx feedback status to reduce rx command
+ *				packet buffer operation load.
+ *
+ * Input:		NONE
+ *
+ * Output:		NONE
+ *
+ * Return:		NONE
+ *
+ * Revised History:
+ *	When		Who		Remark
+ *	05/12/2008	amy		Create Version 0 porting from windows code.
+ *
+ *---------------------------------------------------------------------------*/
+static	void
+cmpk_handle_tx_status(
+	struct net_device *dev,
+	u8*	   pmsg)
+{
+	cmpk_tx_status_t	rx_tx_sts;	/* */
+
+	memcpy((void*)&rx_tx_sts, (void*)pmsg, sizeof(cmpk_tx_status_t));
+	/* 2. Use tx feedback info to count TX statistics. */
+	cmpk_count_tx_status(dev, &rx_tx_sts);
+
+}	/* cmpk_Handle_Tx_Status */
+
+
+/*-----------------------------------------------------------------------------
+ * Function:	cmpk_handle_tx_rate_history()
+ *
+ * Overview:	Firmware add a new tx rate history
+ *
+ * Input:		NONE
+ *
+ * Output:		NONE
+ *
+ * Return:		NONE
+ *
+ * Revised History:
+ *	When		Who		Remark
+ *	05/12/2008	amy		Create Version 0 porting from windows code.
+ *
+ *---------------------------------------------------------------------------*/
+static	void
+cmpk_handle_tx_rate_history(
+	struct net_device *dev,
+	u8*	   pmsg)
+{
+	cmpk_tx_rahis_t	*ptxrate;
+//	RT_RF_POWER_STATE	rtState;
+	u8				i, j;
+	u16				length = sizeof(cmpk_tx_rahis_t);
+	u32				*ptemp;
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+
+#ifdef ENABLE_PS
+	pAdapter->HalFunc.GetHwRegHandler(pAdapter, HW_VAR_RF_STATE, (pu1Byte)(&rtState));
+
+	// When RF is off, we should not count the packet for hw/sw synchronize
+	// reason, ie. there may be a duration while sw switch is changed and hw
+	// switch is being changed. 2006.12.04, by shien chang.
+	if (rtState == eRfOff)
+	{
+		return;
+	}
+#endif
+
+	ptemp = (u32 *)pmsg;
+
+	//
+	// Do endian transfer to word alignment(16 bits) for windows system.
+	// You must do different endian transfer for linux and MAC OS
+	//
+	for (i = 0; i < (length/4); i++)
+	{
+		u16	 temp1, temp2;
+
+		temp1 = ptemp[i]&0x0000FFFF;
+		temp2 = ptemp[i]>>16;
+		ptemp[i] = (temp1<<16)|temp2;
+	}
+
+	ptxrate = (cmpk_tx_rahis_t *)pmsg;
+
+	if (ptxrate == NULL )
+	{
+		return;
+	}
+
+	for (i = 0; i < 16; i++)
+	{
+		// Collect CCK rate packet num
+		if (i < 4)
+			priv->stats.txrate.cck[i] += ptxrate->cck[i];
+
+		// Collect OFDM rate packet num
+		if (i< 8)
+			priv->stats.txrate.ofdm[i] += ptxrate->ofdm[i];
+
+		for (j = 0; j < 4; j++)
+			priv->stats.txrate.ht_mcs[j][i] += ptxrate->ht_mcs[j][i];
+	}
+
+}	/* cmpk_Handle_Tx_Rate_History */
+
+
+/*-----------------------------------------------------------------------------
+ * Function:    cmpk_message_handle_rx()
+ *
+ * Overview:    In the function, we will capture different RX command packet
+ *				info. Every RX command packet element has different message
+ *				length and meaning in content. We only support three type of RX
+ *				command packet now. Please refer to document
+ *				ws-06-0063-rtl8190-command-packet-specification.
+ *
+ * Input:       NONE
+ *
+ * Output:      NONE
+ *
+ * Return:      NONE
+ *
+ * Revised History:
+ *  When		Who		Remark
+ *  05/06/2008	amy		Create Version 0 porting from windows code.
+ *
+ *---------------------------------------------------------------------------*/
+extern	u32
+cmpk_message_handle_rx(
+	struct net_device *dev,
+	struct ieee80211_rx_stats *pstats)
+{
+//	u32			debug_level = DBG_LOUD;
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	int			total_length;
+	u8			cmd_length, exe_cnt = 0;
+	u8			element_id;
+	u8			*pcmd_buff;
+
+	/* 0. Check inpt arguments. If is is a command queue message or pointer is
+	      null. */
+	if (/*(prfd->queue_id != CMPK_RX_QUEUE_ID) || */(pstats== NULL))
+	{
+		/* Print error message. */
+		/*RT_TRACE(COMP_SEND, DebugLevel,
+				("\n\r[CMPK]-->Err queue id or pointer"));*/
+		return 0;	/* This is not a command packet. */
+	}
+
+	/* 1. Read received command packet message length from RFD. */
+	total_length = pstats->Length;
+
+	/* 2. Read virtual address from RFD. */
+	pcmd_buff = pstats->virtual_address;
+
+	/* 3. Read command pakcet element id and length. */
+	element_id = pcmd_buff[0];
+	/*RT_TRACE(COMP_SEND, DebugLevel,
+			("\n\r[CMPK]-->element ID=%d Len=%d", element_id, total_length));*/
+
+	/* 4. Check every received command packet conent according to different
+	      element type. Because FW may aggregate RX command packet to minimize
+	      transmit time between DRV and FW.*/
+	// Add a counter to prevent to locked in the loop too long
+	while (total_length > 0 || exe_cnt++ >100)
+	{
+		/* 2007/01/17 MH We support aggregation of different cmd in the same packet. */
+		element_id = pcmd_buff[0];
+
+		switch(element_id)
+		{
+			case RX_TX_FEEDBACK:
+				cmpk_handle_tx_feedback (dev, pcmd_buff);
+				cmd_length = CMPK_RX_TX_FB_SIZE;
+				break;
+
+			case RX_INTERRUPT_STATUS:
+				cmpk_handle_interrupt_status(dev, pcmd_buff);
+				cmd_length = sizeof(cmpk_intr_sta_t);
+				break;
+
+			case BOTH_QUERY_CONFIG:
+				cmpk_handle_query_config_rx(dev, pcmd_buff);
+				cmd_length = CMPK_BOTH_QUERY_CONFIG_SIZE;
+				break;
+
+			case RX_TX_STATUS:
+				cmpk_handle_tx_status(dev, pcmd_buff);
+				cmd_length = CMPK_RX_TX_STS_SIZE;
+				break;
+
+			case RX_TX_PER_PKT_FEEDBACK:
+				// You must at lease add a switch case element here,
+				// Otherwise, we will jump to default case.
+				//DbgPrint("CCX Test\r\n");
+				cmd_length = CMPK_RX_TX_FB_SIZE;
+				break;
+
+			case RX_TX_RATE_HISTORY:
+				//DbgPrint(" rx tx rate history\r\n");
+				cmpk_handle_tx_rate_history(dev, pcmd_buff);
+				cmd_length = CMPK_TX_RAHIS_SIZE;
+				break;
+
+			default:
+
+				RT_TRACE(COMP_ERR, "---->cmpk_message_handle_rx():unknow CMD Element\n");
+				return 1;	/* This is a command packet. */
+		}
+		// 2007/01/22 MH Display received rx command packet info.
+		//cmpk_Display_Message(cmd_length, pcmd_buff);
+
+		// 2007/01/22 MH Add to display tx statistic.
+		//cmpk_DisplayTxStatistic(pAdapter);
+
+		/* 2007/03/09 MH Collect sidderent cmd element pkt num. */
+		priv->stats.rxcmdpkt[element_id]++;
+
+		total_length -= cmd_length;
+		pcmd_buff    += cmd_length;
+	}	/* while (total_length > 0) */
+	return	1;	/* This is a command packet. */
+
+}	/* CMPK_Message_Handle_Rx */
diff --git a/drivers/staging/rtl8192u/r819xU_cmdpkt.h b/drivers/staging/rtl8192u/r819xU_cmdpkt.h
new file mode 100644
index 000000000000..a8855e61b0e5
--- /dev/null
+++ b/drivers/staging/rtl8192u/r819xU_cmdpkt.h
@@ -0,0 +1,207 @@
+#ifndef R819XUSB_CMDPKT_H
+#define R819XUSB_CMDPKT_H
+/* Different command packet have dedicated message length and definition. */
+#define		CMPK_RX_TX_FB_SIZE					sizeof(cmpk_txfb_t)		//20
+#define		CMPK_TX_SET_CONFIG_SIZE				sizeof(cmpk_set_cfg_t)	//16
+#define		CMPK_BOTH_QUERY_CONFIG_SIZE			sizeof(cmpk_set_cfg_t)	//16
+#define		CMPK_RX_TX_STS_SIZE					sizeof(cmpk_tx_status_t)//
+#define		CMPK_RX_DBG_MSG_SIZE			sizeof(cmpk_rx_dbginfo_t)//
+#define		CMPK_TX_RAHIS_SIZE			sizeof(cmpk_tx_rahis_t)
+
+/* 2008/05/08 amy For USB constant. */
+#define ISR_TxBcnOk					BIT27			// Transmit Beacon OK
+#define ISR_TxBcnErr				BIT26			// Transmit Beacon Error
+#define ISR_BcnTimerIntr			BIT13			// Beacon Timer Interrupt
+
+
+/* Define element ID of command packet. */
+
+/*------------------------------Define structure----------------------------*/
+/* Define different command packet structure. */
+/* 1. RX side: TX feedback packet. */
+typedef struct tag_cmd_pkt_tx_feedback
+{
+	// DWORD 0
+	u8	element_id;			/* Command packet type. */
+	u8	length;				/* Command packet length. */
+	/* 2007/07/05 MH Change tx feedback info field. */
+	/*------TX Feedback Info Field */
+	u8	TID:4;				/* */
+	u8	fail_reason:3;		/* */
+	u8	tok:1;				/* Transmit ok. */
+	u8	reserve1:4;			/* */
+	u8	pkt_type:2;		/* */
+	u8	bandwidth:1;		/* */
+	u8	qos_pkt:1;			/* */
+
+	// DWORD 1
+	u8	reserve2;			/* */
+	/*------TX Feedback Info Field */
+	u8	retry_cnt;			/* */
+	u16	pkt_id;				/* */
+
+	// DWORD 3
+	u16	seq_num;			/* */
+	u8	s_rate;				/* Start rate. */
+	u8	f_rate;				/* Final rate. */
+
+	// DWORD 4
+	u8	s_rts_rate;			/* */
+	u8	f_rts_rate;			/* */
+	u16	pkt_length;			/* */
+
+	// DWORD 5
+	u16	reserve3;			/* */
+	u16	duration;			/* */
+}cmpk_txfb_t;
+
+/* 2. RX side: Interrupt status packet. It includes Beacon State,
+	  Beacon Timer Interrupt and other useful informations in MAC ISR Reg. */
+typedef struct tag_cmd_pkt_interrupt_status
+{
+	u8	element_id;			/* Command packet type. */
+	u8	length;				/* Command packet length. */
+	u16	reserve;
+	u32	interrupt_status;				/* Interrupt Status. */
+}cmpk_intr_sta_t;
+
+
+/* 3. TX side: Set configuration packet. */
+typedef struct tag_cmd_pkt_set_configuration
+{
+	u8	element_id;			/* Command packet type. */
+	u8	length;				/* Command packet length. */
+	u16	reserve1;			/* */
+	u8 	cfg_reserve1:3;
+	u8	cfg_size:2;			/* Configuration info. */
+	u8	cfg_type:2;			/* Configuration info. */
+	u8	cfg_action:1;		/* Configuration info. */
+	u8	cfg_reserve2;		/* Configuration info. */
+	u8	cfg_page:4;			/* Configuration info. */
+	u8	cfg_reserve3:4;		/* Configuration info. */
+	u8	cfg_offset;			/* Configuration info. */
+	u32	value;				/* */
+	u32	mask;				/* */
+}cmpk_set_cfg_t;
+
+/* 4. Both side : TX/RX query configuraton packet. The query structure is the
+      same as set configuration. */
+#define		cmpk_query_cfg_t	cmpk_set_cfg_t
+
+/* 5. Multi packet feedback status. */
+typedef struct tag_tx_stats_feedback // PJ quick rxcmd 09042007
+{
+	// For endian transfer --> Driver will not the same as firmware structure.
+	// DW 0
+	u16	reserve1;
+	u8 	length;				// Command packet length
+	u8 	element_id;			// Command packet type
+
+	// DW 1
+	u16	txfail;				// Tx Fail count
+	u16 	txok;				// Tx ok count
+
+	// DW 2
+	u16	txmcok;  			// tx multicast
+	u16 	txretry;			// Tx Retry count
+
+	// DW 3
+	u16  txucok;				// tx unicast
+	u16	txbcok;  			// tx broadcast
+
+	// DW 4
+	u16	txbcfail;			//
+	u16	txmcfail;			//
+
+	// DW 5
+	u16	reserve2;			//
+	u16	txucfail;			//
+
+	// DW 6-8
+	u32	txmclength;
+	u32	txbclength;
+	u32	txuclength;
+
+	// DW 9
+	u16	reserve3_23;
+	u8	reserve3_1;
+	u8	rate;
+}__attribute__((packed)) cmpk_tx_status_t;
+
+/* 6. Debug feedback message. */
+/* 2007/10/23 MH Define RX debug message  */
+typedef struct tag_rx_debug_message_feedback
+{
+	// For endian transfer --> for driver
+	// DW 0
+	u16	reserve1;
+	u8 	length;				// Command packet length
+	u8 	element_id;			// Command packet type
+
+	// DW 1-??
+	// Variable debug message.
+
+}cmpk_rx_dbginfo_t;
+
+/* 2008/03/20 MH Define transmit rate history. For big endian format. */
+typedef struct tag_tx_rate_history
+{
+	// For endian transfer --> for driver
+	// DW 0
+	u8 	element_id;			// Command packet type
+	u8 	length;				// Command packet length
+	u16	reserved1;
+
+	// DW 1-2	CCK rate counter
+	u16 	cck[4];
+
+	// DW 3-6
+	u16 	ofdm[8];
+
+	// DW 7-14
+	//UINT16	MCS_BW0_SG0[16];
+
+	// DW 15-22
+	//UINT16	MCS_BW1_SG0[16];
+
+	// DW 23-30
+	//UINT16	MCS_BW0_SG1[16];
+
+	// DW 31-38
+	//UINT16	MCS_BW1_SG1[16];
+
+	// DW 7-14	BW=0 SG=0
+	// DW 15-22	BW=1 SG=0
+	// DW 23-30	BW=0 SG=1
+	// DW 31-38	BW=1 SG=1
+	u16	ht_mcs[4][16];
+
+}__attribute__((packed)) cmpk_tx_rahis_t;
+
+typedef enum tag_command_packet_directories
+{
+    RX_TX_FEEDBACK = 0,
+    RX_INTERRUPT_STATUS		= 1,
+    TX_SET_CONFIG				= 2,
+    BOTH_QUERY_CONFIG			= 3,
+    RX_TX_STATUS				= 4,
+    RX_DBGINFO_FEEDBACK		= 5,
+    RX_TX_PER_PKT_FEEDBACK		= 6,
+    RX_TX_RATE_HISTORY		= 7,
+    RX_CMD_ELE_MAX
+}cmpk_element_e;
+
+typedef enum _rt_status{
+	RT_STATUS_SUCCESS,
+	RT_STATUS_FAILURE,
+	RT_STATUS_PENDING,
+	RT_STATUS_RESOURCE
+}rt_status,*prt_status;
+
+extern rt_status cmpk_message_handle_tx(struct net_device *dev, u8* codevirtualaddress, u32 packettype, u32 buffer_len);
+
+extern  u32 cmpk_message_handle_rx(struct net_device *dev, struct ieee80211_rx_stats * pstats);
+extern rt_status SendTxCommandPacket( struct net_device *dev, void* pData, u32 DataLen);
+
+
+#endif
diff --git a/drivers/staging/rtl8192u/r819xU_firmware.c b/drivers/staging/rtl8192u/r819xU_firmware.c
new file mode 100644
index 000000000000..3cc2d571f9bd
--- /dev/null
+++ b/drivers/staging/rtl8192u/r819xU_firmware.c
@@ -0,0 +1,434 @@
+/**************************************************************************************************
+ * Procedure:    Init boot code/firmware code/data session
+ *
+ * Description: This routine will intialize firmware. If any error occurs during the initialization
+ * 		process, the routine shall terminate immediately and return fail.
+ *		NIC driver should call NdisOpenFile only from MiniportInitialize.
+ *
+ * Arguments:   The pointer of the adapter
+
+ * Returns:
+ *        NDIS_STATUS_FAILURE - the following initialization process should be terminated
+ *        NDIS_STATUS_SUCCESS - if firmware initialization process success
+**************************************************************************************************/
+//#include "ieee80211.h"
+#include "r8192U.h"
+#include "r8192U_hw.h"
+#include "r819xU_firmware_img.h"
+#include "r819xU_firmware.h"
+#include <linux/firmware.h>
+void firmware_init_param(struct net_device *dev)
+{
+	struct r8192_priv 	*priv = ieee80211_priv(dev);
+	rt_firmware		*pfirmware = priv->pFirmware;
+
+	pfirmware->cmdpacket_frag_thresold = GET_COMMAND_PACKET_FRAG_THRESHOLD(MAX_TRANSMIT_BUFFER_SIZE);
+}
+
+/*
+ * segment the img and use the ptr and length to remember info on each segment
+ *
+ */
+bool fw_download_code(struct net_device *dev, u8 *code_virtual_address, u32 buffer_len)
+{
+	struct r8192_priv   *priv = ieee80211_priv(dev);
+	bool 		    rt_status = true;
+	u16		    frag_threshold;
+	u16		    frag_length, frag_offset = 0;
+	//u16		    total_size;
+	int		    i;
+
+	rt_firmware	    *pfirmware = priv->pFirmware;
+	struct sk_buff	    *skb;
+	unsigned char	    *seg_ptr;
+	cb_desc		    *tcb_desc;
+	u8                  bLastIniPkt;
+
+	firmware_init_param(dev);
+	//Fragmentation might be required
+	frag_threshold = pfirmware->cmdpacket_frag_thresold;
+	do {
+		if((buffer_len - frag_offset) > frag_threshold) {
+			frag_length = frag_threshold ;
+			bLastIniPkt = 0;
+
+		} else {
+			frag_length = buffer_len - frag_offset;
+			bLastIniPkt = 1;
+
+		}
+
+		/* Allocate skb buffer to contain firmware info and tx descriptor info
+		 * add 4 to avoid packet appending overflow.
+		 * */
+		#ifdef RTL8192U
+		skb  = dev_alloc_skb(USB_HWDESC_HEADER_LEN + frag_length + 4);
+		#else
+		skb  = dev_alloc_skb(frag_length + 4);
+		#endif
+		memcpy((unsigned char *)(skb->cb),&dev,sizeof(dev));
+		tcb_desc = (cb_desc*)(skb->cb + MAX_DEV_ADDR_SIZE);
+		tcb_desc->queue_index = TXCMD_QUEUE;
+		tcb_desc->bCmdOrInit = DESC_PACKET_TYPE_INIT;
+		tcb_desc->bLastIniPkt = bLastIniPkt;
+
+		#ifdef RTL8192U
+		skb_reserve(skb, USB_HWDESC_HEADER_LEN);
+		#endif
+		seg_ptr = skb->data;
+		/*
+		 * Transform from little endian to big endian
+		 * and pending  zero
+		 */
+		for(i=0 ; i < frag_length; i+=4) {
+			*seg_ptr++ = ((i+0)<frag_length)?code_virtual_address[i+3]:0;
+			*seg_ptr++ = ((i+1)<frag_length)?code_virtual_address[i+2]:0;
+			*seg_ptr++ = ((i+2)<frag_length)?code_virtual_address[i+1]:0;
+			*seg_ptr++ = ((i+3)<frag_length)?code_virtual_address[i+0]:0;
+		}
+		tcb_desc->txbuf_size= (u16)i;
+		skb_put(skb, i);
+
+		if(!priv->ieee80211->check_nic_enough_desc(dev,tcb_desc->queue_index)||
+			(!skb_queue_empty(&priv->ieee80211->skb_waitQ[tcb_desc->queue_index]))||\
+			(priv->ieee80211->queue_stop) ) {
+			RT_TRACE(COMP_FIRMWARE,"=====================================================> tx full!\n");
+			skb_queue_tail(&priv->ieee80211->skb_waitQ[tcb_desc->queue_index], skb);
+		} else {
+			priv->ieee80211->softmac_hard_start_xmit(skb,dev);
+		}
+
+		code_virtual_address += frag_length;
+		frag_offset += frag_length;
+
+	}while(frag_offset < buffer_len);
+
+	return rt_status;
+
+}
+
+bool
+fwSendNullPacket(
+	struct net_device *dev,
+	u32			Length
+)
+{
+	bool	rtStatus = true;
+	struct r8192_priv   *priv = ieee80211_priv(dev);
+	struct sk_buff	    *skb;
+	cb_desc		    *tcb_desc;
+	unsigned char	    *ptr_buf;
+	bool	bLastInitPacket = false;
+
+	//PlatformAcquireSpinLock(Adapter, RT_TX_SPINLOCK);
+
+	//Get TCB and local buffer from common pool. (It is shared by CmdQ, MgntQ, and USB coalesce DataQ)
+	skb  = dev_alloc_skb(Length+ 4);
+	memcpy((unsigned char *)(skb->cb),&dev,sizeof(dev));
+	tcb_desc = (cb_desc*)(skb->cb + MAX_DEV_ADDR_SIZE);
+	tcb_desc->queue_index = TXCMD_QUEUE;
+	tcb_desc->bCmdOrInit = DESC_PACKET_TYPE_INIT;
+	tcb_desc->bLastIniPkt = bLastInitPacket;
+	ptr_buf = skb_put(skb, Length);
+	memset(ptr_buf,0,Length);
+	tcb_desc->txbuf_size= (u16)Length;
+
+	if(!priv->ieee80211->check_nic_enough_desc(dev,tcb_desc->queue_index)||
+			(!skb_queue_empty(&priv->ieee80211->skb_waitQ[tcb_desc->queue_index]))||\
+			(priv->ieee80211->queue_stop) ) {
+			RT_TRACE(COMP_FIRMWARE,"===================NULL packet==================================> tx full!\n");
+			skb_queue_tail(&priv->ieee80211->skb_waitQ[tcb_desc->queue_index], skb);
+		} else {
+			priv->ieee80211->softmac_hard_start_xmit(skb,dev);
+		}
+
+	//PlatformReleaseSpinLock(Adapter, RT_TX_SPINLOCK);
+	return rtStatus;
+}
+
+
+//-----------------------------------------------------------------------------
+// Procedure:    Check whether main code is download OK. If OK, turn on CPU
+//
+// Description:   CPU register locates in different page against general register.
+//			    Switch to CPU register in the begin and switch back before return
+//
+//
+// Arguments:   The pointer of the adapter
+//
+// Returns:
+//        NDIS_STATUS_FAILURE - the following initialization process should be terminated
+//        NDIS_STATUS_SUCCESS - if firmware initialization process success
+//-----------------------------------------------------------------------------
+bool CPUcheck_maincodeok_turnonCPU(struct net_device *dev)
+{
+	bool		rt_status = true;
+	int		check_putcodeOK_time = 200000, check_bootOk_time = 200000;
+	u32		CPU_status = 0;
+
+	/* Check whether put code OK */
+	do {
+		CPU_status = read_nic_dword(dev, CPU_GEN);
+
+		if(CPU_status&CPU_GEN_PUT_CODE_OK)
+			break;
+
+	}while(check_putcodeOK_time--);
+
+	if(!(CPU_status&CPU_GEN_PUT_CODE_OK)) {
+		RT_TRACE(COMP_ERR, "Download Firmware: Put code fail!\n");
+		goto CPUCheckMainCodeOKAndTurnOnCPU_Fail;
+	} else {
+		RT_TRACE(COMP_FIRMWARE, "Download Firmware: Put code ok!\n");
+	}
+
+	/* Turn On CPU */
+	CPU_status = read_nic_dword(dev, CPU_GEN);
+	write_nic_byte(dev, CPU_GEN, (u8)((CPU_status|CPU_GEN_PWR_STB_CPU)&0xff));
+	mdelay(1000);
+
+	/* Check whether CPU boot OK */
+	do {
+		CPU_status = read_nic_dword(dev, CPU_GEN);
+
+		if(CPU_status&CPU_GEN_BOOT_RDY)
+			break;
+	}while(check_bootOk_time--);
+
+	if(!(CPU_status&CPU_GEN_BOOT_RDY)) {
+		goto CPUCheckMainCodeOKAndTurnOnCPU_Fail;
+	} else {
+		RT_TRACE(COMP_FIRMWARE, "Download Firmware: Boot ready!\n");
+	}
+
+	return rt_status;
+
+CPUCheckMainCodeOKAndTurnOnCPU_Fail:
+	RT_TRACE(COMP_ERR, "ERR in %s()\n", __FUNCTION__);
+	rt_status = FALSE;
+	return rt_status;
+}
+
+bool CPUcheck_firmware_ready(struct net_device *dev)
+{
+
+	bool		rt_status = true;
+	int		check_time = 200000;
+	u32		CPU_status = 0;
+
+	/* Check Firmware Ready */
+	do {
+		CPU_status = read_nic_dword(dev, CPU_GEN);
+
+		if(CPU_status&CPU_GEN_FIRM_RDY)
+			break;
+
+	}while(check_time--);
+
+	if(!(CPU_status&CPU_GEN_FIRM_RDY))
+		goto CPUCheckFirmwareReady_Fail;
+	else
+		RT_TRACE(COMP_FIRMWARE, "Download Firmware: Firmware ready!\n");
+
+	return rt_status;
+
+CPUCheckFirmwareReady_Fail:
+	RT_TRACE(COMP_ERR, "ERR in %s()\n", __FUNCTION__);
+	rt_status = false;
+	return rt_status;
+
+}
+
+bool init_firmware(struct net_device *dev)
+{
+	struct r8192_priv 	*priv = ieee80211_priv(dev);
+	bool			rt_status = TRUE;
+
+	u8			*firmware_img_buf[3] = { &rtl8190_fwboot_array[0],
+							 &rtl8190_fwmain_array[0],
+							 &rtl8190_fwdata_array[0]};
+
+	u32			firmware_img_len[3] = { sizeof(rtl8190_fwboot_array),
+							sizeof(rtl8190_fwmain_array),
+							sizeof(rtl8190_fwdata_array)};
+	u32			file_length = 0;
+	u8			*mapped_file = NULL;
+	u32			init_step = 0;
+	opt_rst_type_e	rst_opt = OPT_SYSTEM_RESET;
+	firmware_init_step_e 	starting_state = FW_INIT_STEP0_BOOT;
+
+	rt_firmware		*pfirmware = priv->pFirmware;
+	const struct firmware 	*fw_entry;
+	const char *fw_name[3] = { "RTL8192U/boot.img",
+			   "RTL8192U/main.img",
+			   "RTL8192U/data.img"};
+	int rc;
+
+	RT_TRACE(COMP_FIRMWARE, " PlatformInitFirmware()==>\n");
+
+	if (pfirmware->firmware_status == FW_STATUS_0_INIT ) {
+		/* it is called by reset */
+		rst_opt = OPT_SYSTEM_RESET;
+		starting_state = FW_INIT_STEP0_BOOT;
+		// TODO: system reset
+
+	}else if(pfirmware->firmware_status == FW_STATUS_5_READY) {
+		/* it is called by Initialize */
+		rst_opt = OPT_FIRMWARE_RESET;
+		starting_state = FW_INIT_STEP2_DATA;
+	}else {
+		 RT_TRACE(COMP_FIRMWARE, "PlatformInitFirmware: undefined firmware state\n");
+	}
+
+	/*
+	 * Download boot, main, and data image for System reset.
+	 * Download data image for firmware reseta
+	 */
+	priv->firmware_source = FW_SOURCE_IMG_FILE;
+	for(init_step = starting_state; init_step <= FW_INIT_STEP2_DATA; init_step++) {
+		/*
+		 * Open Image file, and map file to contineous memory if open file success.
+		 * or read image file from array. Default load from IMG file
+		 */
+		if(rst_opt == OPT_SYSTEM_RESET) {
+			switch(priv->firmware_source) {
+				case FW_SOURCE_IMG_FILE:
+					rc = request_firmware(&fw_entry, fw_name[init_step],&priv->udev->dev);
+					if(rc < 0 ) {
+						RT_TRACE(COMP_ERR, "request firmware fail!\n");
+						goto download_firmware_fail;
+					}
+
+					if(fw_entry->size > sizeof(pfirmware->firmware_buf)) {
+						RT_TRACE(COMP_ERR, "img file size exceed the container buffer fail!\n");
+						goto download_firmware_fail;
+					}
+
+					if(init_step != FW_INIT_STEP1_MAIN) {
+						memcpy(pfirmware->firmware_buf,fw_entry->data,fw_entry->size);
+						mapped_file = pfirmware->firmware_buf;
+						file_length = fw_entry->size;
+					} else {
+					#ifdef RTL8190P
+						memcpy(pfirmware->firmware_buf,fw_entry->data,fw_entry->size);
+						mapped_file = pfirmware->firmware_buf;
+						file_length = fw_entry->size;
+					#else
+						memset(pfirmware->firmware_buf,0,128);
+						memcpy(&pfirmware->firmware_buf[128],fw_entry->data,fw_entry->size);
+						mapped_file = pfirmware->firmware_buf;
+						file_length = fw_entry->size + 128;
+					#endif
+					}
+					pfirmware->firmware_buf_size = file_length;
+					break;
+
+				case FW_SOURCE_HEADER_FILE:
+					mapped_file =  firmware_img_buf[init_step];
+					file_length  = firmware_img_len[init_step];
+					if(init_step == FW_INIT_STEP2_DATA) {
+						memcpy(pfirmware->firmware_buf, mapped_file, file_length);
+						pfirmware->firmware_buf_size = file_length;
+					}
+					break;
+
+				default:
+					break;
+			}
+
+
+		}else if(rst_opt == OPT_FIRMWARE_RESET ) {
+			/* we only need to download data.img here */
+			mapped_file = pfirmware->firmware_buf;
+			file_length = pfirmware->firmware_buf_size;
+		}
+
+		/* Download image file */
+		/* The firmware download process is just as following,
+		 * 1. that is each packet will be segmented and inserted to the wait queue.
+		 * 2. each packet segment will be put in the skb_buff packet.
+		 * 3. each skb_buff packet data content will already include the firmware info
+		 *   and Tx descriptor info
+		 * */
+		rt_status = fw_download_code(dev,mapped_file,file_length);
+		if(rst_opt == OPT_SYSTEM_RESET) {
+			release_firmware(fw_entry);
+		}
+
+		if(rt_status != TRUE) {
+			goto download_firmware_fail;
+		}
+
+		switch(init_step) {
+			case FW_INIT_STEP0_BOOT:
+				/* Download boot
+				 * initialize command descriptor.
+				 * will set polling bit when firmware code is also configured
+				 */
+				pfirmware->firmware_status = FW_STATUS_1_MOVE_BOOT_CODE;
+#ifdef RTL8190P
+				// To initialize IMEM, CPU move code  from 0x80000080, hence, we send 0x80 byte packet
+				rt_status = fwSendNullPacket(dev, RTL8190_CPU_START_OFFSET);
+				if(rt_status != true)
+				{
+					RT_TRACE(COMP_INIT, "fwSendNullPacket() fail ! \n");
+					goto  download_firmware_fail;
+				}
+#endif
+				//mdelay(1000);
+				/*
+				 * To initialize IMEM, CPU move code  from 0x80000080,
+				 * hence, we send 0x80 byte packet
+				 */
+				break;
+
+			case FW_INIT_STEP1_MAIN:
+				/* Download firmware code. Wait until Boot Ready and Turn on CPU */
+				pfirmware->firmware_status = FW_STATUS_2_MOVE_MAIN_CODE;
+
+				/* Check Put Code OK and Turn On CPU */
+				rt_status = CPUcheck_maincodeok_turnonCPU(dev);
+				if(rt_status != TRUE) {
+					RT_TRACE(COMP_ERR, "CPUcheck_maincodeok_turnonCPU fail!\n");
+					goto download_firmware_fail;
+				}
+
+				pfirmware->firmware_status = FW_STATUS_3_TURNON_CPU;
+				break;
+
+			case FW_INIT_STEP2_DATA:
+				/* download initial data code */
+				pfirmware->firmware_status = FW_STATUS_4_MOVE_DATA_CODE;
+				mdelay(1);
+
+				rt_status = CPUcheck_firmware_ready(dev);
+				if(rt_status != TRUE) {
+					RT_TRACE(COMP_ERR, "CPUcheck_firmware_ready fail(%d)!\n",rt_status);
+					goto download_firmware_fail;
+				}
+
+				/* wait until data code is initialized ready.*/
+				pfirmware->firmware_status = FW_STATUS_5_READY;
+				break;
+		}
+	}
+
+	RT_TRACE(COMP_FIRMWARE, "Firmware Download Success\n");
+	//assert(pfirmware->firmware_status == FW_STATUS_5_READY, ("Firmware Download Fail\n"));
+
+	return rt_status;
+
+download_firmware_fail:
+	RT_TRACE(COMP_ERR, "ERR in %s()\n", __FUNCTION__);
+	rt_status = FALSE;
+	return rt_status;
+
+}
+
+
+
+
+
+
+
+
diff --git a/drivers/staging/rtl8192u/r819xU_firmware.h b/drivers/staging/rtl8192u/r819xU_firmware.h
new file mode 100644
index 000000000000..a4bceeef33d3
--- /dev/null
+++ b/drivers/staging/rtl8192u/r819xU_firmware.h
@@ -0,0 +1,27 @@
+#ifndef __INC_FIRMWARE_H
+#define __INC_FIRMWARE_H
+
+#define RTL8190_CPU_START_OFFSET	0x80
+/* TODO: this definition is TBD */
+//#define USB_HWDESC_HEADER_LEN	0
+
+/* It should be double word alignment */
+//#if DEV_BUS_TYPE==PCI_INTERFACE
+//#define GET_COMMAND_PACKET_FRAG_THRESHOLD(v)	4*(v/4) - 8
+//#else
+#define GET_COMMAND_PACKET_FRAG_THRESHOLD(v)	(4*(v/4) - 8 - USB_HWDESC_HEADER_LEN)
+//#endif
+
+typedef enum _firmware_init_step{
+	FW_INIT_STEP0_BOOT = 0,
+	FW_INIT_STEP1_MAIN = 1,
+	FW_INIT_STEP2_DATA = 2,
+}firmware_init_step_e;
+
+typedef enum _opt_rst_type{
+	OPT_SYSTEM_RESET = 0,
+	OPT_FIRMWARE_RESET = 1,
+}opt_rst_type_e;
+
+#endif
+
diff --git a/drivers/staging/rtl8192u/r819xU_firmware_img.c b/drivers/staging/rtl8192u/r819xU_firmware_img.c
new file mode 100644
index 000000000000..29b656d7d82b
--- /dev/null
+++ b/drivers/staging/rtl8192u/r819xU_firmware_img.c
@@ -0,0 +1,3447 @@
+/*Created on  2008/ 7/16,  5:31*/
+#include <linux/types.h>
+
+u8 rtl8190_fwboot_array[] = {
+0x10,0x00,0x00,0x01,0x00,0x00,0x00,0x00,0x3c,0x08,0xbf,0xc0,0x25,0x08,0x00,0x08,
+0x3c,0x09,0xb0,0x03,0xad,0x28,0x00,0x20,0x40,0x80,0x68,0x00,0x00,0x00,0x00,0x00,
+0x3c,0x0a,0xd0,0x00,0x40,0x8a,0x60,0x00,0x00,0x00,0x00,0x00,0x3c,0x08,0x80,0x01,
+0x25,0x08,0xb0,0x50,0x24,0x09,0x00,0x01,0x3c,0x01,0x7f,0xff,0x34,0x21,0xff,0xff,
+0x01,0x01,0x50,0x24,0x00,0x09,0x48,0x40,0x35,0x29,0x00,0x01,0x01,0x2a,0x10,0x2b,
+0x14,0x40,0xff,0xfc,0x00,0x00,0x00,0x00,0x3c,0x0a,0x00,0x00,0x25,0x4a,0x00,0x00,
+0x4c,0x8a,0x00,0x00,0x4c,0x89,0x08,0x00,0x00,0x00,0x00,0x00,0x3c,0x08,0x80,0x01,
+0x25,0x08,0xb0,0x50,0x3c,0x01,0x80,0x00,0x01,0x21,0x48,0x25,0x3c,0x0a,0xbf,0xc0,
+0x25,0x4a,0x00,0x7c,0x3c,0x0b,0xb0,0x03,0xad,0x6a,0x00,0x20,0xad,0x00,0x00,0x00,
+0x21,0x08,0x00,0x04,0x01,0x09,0x10,0x2b,0x14,0x40,0xff,0xf8,0x00,0x00,0x00,0x00,
+0x3c,0x08,0x80,0x01,0x25,0x08,0x7f,0xff,0x24,0x09,0x00,0x01,0x3c,0x01,0x7f,0xff,
+0x34,0x21,0xff,0xff,0x01,0x01,0x50,0x24,0x00,0x09,0x48,0x40,0x35,0x29,0x00,0x01,
+0x01,0x2a,0x10,0x2b,0x14,0x40,0xff,0xfc,0x00,0x00,0x00,0x00,0x3c,0x0a,0x80,0x01,
+0x25,0x4a,0x00,0x00,0x3c,0x01,0x7f,0xff,0x34,0x21,0xff,0xff,0x01,0x41,0x50,0x24,
+0x3c,0x09,0x00,0x01,0x35,0x29,0x7f,0xff,0x4c,0x8a,0x20,0x00,0x4c,0x89,0x28,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x24,0x08,0x04,0x10,
+0x00,0x00,0x00,0x00,0x40,0x88,0xa0,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x3c,0x08,0xbf,0xc0,0x00,0x00,0x00,0x00,0x8d,0x09,0x00,0x00,0x00,0x00,0x00,0x00,
+0x3c,0x0a,0xbf,0xc0,0x25,0x4a,0x01,0x20,0x3c,0x0b,0xb0,0x03,0xad,0x6a,0x00,0x20,
+0x3c,0x08,0xb0,0x03,0x8d,0x09,0x00,0x00,0x00,0x00,0x00,0x00,0x35,0x29,0x00,0x10,
+0xad,0x09,0x00,0x00,0x00,0x00,0x00,0x00,0x3c,0x08,0x80,0x00,0x25,0x08,0x4b,0x84,
+0x01,0x00,0x00,0x08,0x00,0x00,0x00,0x00,};
+
+u8 rtl8190_fwmain_array[] = {
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+0x40,0x04,0x68,0x00,0x40,0x05,0x70,0x00,0x40,0x06,0x40,0x00,0x0c,0x00,0x12,0x94,
+0x00,0x00,0x00,0x00,0x40,0x1a,0x68,0x00,0x33,0x5b,0x00,0x3c,0x17,0x60,0x00,0x09,
+0x00,0x00,0x00,0x00,0x40,0x1b,0x60,0x00,0x00,0x00,0x00,0x00,0x03,0x5b,0xd0,0x24,
+0x40,0x1a,0x70,0x00,0x03,0x40,0x00,0x08,0x42,0x00,0x00,0x10,0x00,0x00,0x00,0x00,
+0x00,0x00,0x00,0x00,0x3c,0x02,0xff,0xff,0x34,0x42,0xff,0xff,0x8c,0x43,0x00,0x00,
+0x3c,0x03,0xb0,0x03,0x3c,0x02,0x80,0x00,0x34,0x63,0x00,0x20,0x24,0x42,0x00,0xd0,
+0xac,0x62,0x00,0x00,0x00,0x00,0x20,0x21,0x27,0x85,0x8b,0x60,0x00,0x85,0x18,0x21,
+0x24,0x84,0x00,0x01,0x28,0x82,0x00,0x0a,0x14,0x40,0xff,0xfc,0xa0,0x60,0x00,0x00,
+0x27,0x82,0x8b,0x6a,0x24,0x04,0x00,0x06,0x24,0x84,0xff,0xff,0xa4,0x40,0x00,0x00,
+0x04,0x81,0xff,0xfd,0x24,0x42,0x00,0x02,0x24,0x02,0x00,0x03,0xa3,0x82,0x8b,0x60,
+0x24,0x02,0x09,0xc4,0x24,0x03,0x01,0x00,0xa7,0x82,0x8b,0x76,0x24,0x02,0x04,0x00,
+0xaf,0x83,0x8b,0x78,0xaf,0x82,0x8b,0x7c,0x24,0x03,0x00,0x0a,0x24,0x02,0x00,0x04,
+0x24,0x05,0x00,0x02,0x24,0x04,0x00,0x01,0xa3,0x83,0x8b,0x62,0xa3,0x82,0x8b,0x68,
+0x24,0x03,0x00,0x01,0x24,0x02,0x02,0x00,0xa3,0x84,0x8b,0x66,0xa3,0x85,0x8b,0x69,
+0xa7,0x82,0x8b,0x6a,0xa7,0x83,0x8b,0x6c,0xa3,0x84,0x8b,0x61,0xa3,0x80,0x8b,0x63,
+0xa3,0x80,0x8b,0x64,0xa3,0x80,0x8b,0x65,0xa3,0x85,0x8b,0x67,0x03,0xe0,0x00,0x08,
+0x00,0x00,0x00,0x00,0x3c,0x03,0xb0,0x03,0x3c,0x02,0x80,0x00,0x24,0x42,0x01,0x84,
+0x34,0x63,0x00,0x20,0xac,0x62,0x00,0x00,0x27,0x84,0x8b,0x88,0x00,0x00,0x10,0x21,
+0x24,0x42,0x00,0x01,0x00,0x02,0x16,0x00,0x00,0x02,0x16,0x03,0x28,0x43,0x00,0x03,
+0xac,0x80,0xff,0xfc,0xa0,0x80,0x00,0x00,0x14,0x60,0xff,0xf9,0x24,0x84,0x00,0x0c,
+0x03,0xe0,0x00,0x08,0x00,0x00,0x00,0x00,0x3c,0x03,0xb0,0x03,0x3c,0x02,0x80,0x00,
+0x34,0x63,0x00,0x20,0x24,0x42,0x01,0xc8,0x3c,0x08,0xb0,0x03,0xac,0x62,0x00,0x00,
+0x35,0x08,0x00,0x70,0x8d,0x02,0x00,0x00,0x00,0xa0,0x48,0x21,0x00,0x04,0x26,0x00,
+0x00,0x02,0x2a,0x43,0x00,0x06,0x36,0x00,0x00,0x07,0x3e,0x00,0x00,0x02,0x12,0x03,
+0x29,0x23,0x00,0x03,0x00,0x04,0x56,0x03,0x00,0x06,0x36,0x03,0x00,0x07,0x3e,0x03,
+0x30,0x48,0x00,0x01,0x10,0x60,0x00,0x11,0x30,0xa5,0x00,0x07,0x24,0x02,0x00,0x02,
+0x00,0x49,0x10,0x23,0x00,0x45,0x10,0x07,0x30,0x42,0x00,0x01,0x10,0x40,0x00,0x66,
+0x00,0x00,0x00,0x00,0x8f,0xa2,0x00,0x10,0x00,0x00,0x00,0x00,0x00,0x02,0x21,0x43,
+0x11,0x00,0x00,0x10,0x00,0x07,0x20,0x0b,0x15,0x20,0x00,0x06,0x24,0x02,0x00,0x01,
+0x3c,0x02,0xb0,0x05,0x34,0x42,0x01,0x20,0xa4,0x44,0x00,0x00,0x03,0xe0,0x00,0x08,
+0x00,0x00,0x00,0x00,0x11,0x22,0x00,0x04,0x00,0x00,0x00,0x00,0x3c,0x02,0xb0,0x05,
+0x08,0x00,0x00,0x96,0x34,0x42,0x01,0x24,0x3c,0x02,0xb0,0x05,0x08,0x00,0x00,0x96,
+0x34,0x42,0x01,0x22,0x15,0x20,0x00,0x54,0x24,0x02,0x00,0x01,0x3c,0x02,0xb0,0x03,
+0x34,0x42,0x00,0x74,0x90,0x43,0x00,0x00,0x00,0x00,0x00,0x00,0xaf,0x83,0x8b,0x84,
+0x3c,0x02,0xb0,0x03,0x34,0x42,0x00,0x70,0x90,0x43,0x00,0x00,0x00,0x00,0x00,0x00,
+0x30,0x6b,0x00,0x08,0x11,0x60,0x00,0x18,0x00,0x09,0x28,0x40,0x00,0x00,0x40,0x21,
+0x27,0x85,0x8b,0x80,0x8c,0xa3,0x00,0x00,0x8c,0xa2,0x00,0x04,0x00,0x00,0x00,0x00,
+0x00,0x62,0x38,0x23,0x00,0x43,0x10,0x2a,0x10,0x40,0x00,0x3d,0x00,0x00,0x00,0x00,
+0xac,0xa7,0x00,0x00,0x25,0x02,0x00,0x01,0x00,0x02,0x16,0x00,0x00,0x02,0x46,0x03,
+0x29,0x03,0x00,0x03,0x14,0x60,0xff,0xf3,0x24,0xa5,0x00,0x0c,0x3c,0x03,0xb0,0x03,
+0x34,0x63,0x00,0x70,0x90,0x62,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x4b,0x10,0x23,
+0xa0,0x62,0x00,0x00,0x00,0x09,0x28,0x40,0x00,0xa9,0x10,0x21,0x00,0x02,0x10,0x80,
+0x27,0x83,0x8b,0x88,0x00,0x0a,0x20,0x0b,0x00,0x43,0x18,0x21,0x10,0xc0,0x00,0x05,
+0x00,0x00,0x38,0x21,0x80,0x62,0x00,0x01,0x00,0x00,0x00,0x00,0x14,0x40,0x00,0x05,
+0x00,0x00,0x00,0x00,0x80,0x62,0x00,0x00,0x00,0x00,0x00,0x00,0x14,0x40,0x00,0x03,
+0x00,0xa9,0x10,0x21,0x24,0x07,0x00,0x01,0x00,0xa9,0x10,0x21,0x00,0x02,0x30,0x80,
+0x27,0x82,0x8b,0x88,0xa0,0x67,0x00,0x01,0x00,0xc2,0x38,0x21,0x80,0xe3,0x00,0x01,
+0x00,0x00,0x00,0x00,0x10,0x60,0x00,0x07,0x00,0x00,0x00,0x00,0x27,0x83,0x8b,0x80,
+0x00,0xc3,0x18,0x21,0x8c,0x62,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x44,0x10,0x21,
+0xac,0x62,0x00,0x00,0x27,0x85,0x8b,0x84,0x27,0x82,0x8b,0x80,0x00,0xc5,0x28,0x21,
+0x00,0xc2,0x10,0x21,0x8c,0x43,0x00,0x00,0x8c,0xa4,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x64,0x18,0x2a,0x14,0x60,0x00,0x03,0x24,0x02,0x00,0x01,0x03,0xe0,0x00,0x08,
+0xa0,0xe2,0x00,0x00,0xa0,0xe0,0x00,0x00,0x03,0xe0,0x00,0x08,0x00,0x00,0x00,0x00,
+0x08,0x00,0x00,0xb9,0xac,0xa0,0x00,0x00,0x11,0x22,0x00,0x08,0x00,0x00,0x00,0x00,
+0x3c,0x02,0xb0,0x03,0x34,0x42,0x00,0x7c,0x90,0x43,0x00,0x00,0x00,0x00,0x00,0x00,
+0xaf,0x83,0x8b,0x9c,0x08,0x00,0x00,0xa9,0x3c,0x02,0xb0,0x03,0x3c,0x02,0xb0,0x03,
+0x34,0x42,0x00,0x78,0x90,0x43,0x00,0x00,0x00,0x00,0x00,0x00,0xaf,0x83,0x8b,0x90,
+0x08,0x00,0x00,0xa9,0x3c,0x02,0xb0,0x03,0x3c,0x03,0xb0,0x03,0x3c,0x02,0x80,0x00,
+0x34,0x63,0x00,0x20,0x24,0x42,0x04,0x18,0x3c,0x05,0xb0,0x03,0xac,0x62,0x00,0x00,
+0x34,0xa5,0x00,0x70,0x8c,0xa2,0x00,0x00,0x90,0x84,0x00,0x08,0x3c,0x06,0xb0,0x03,
+0x00,0x02,0x16,0x00,0x2c,0x83,0x00,0x03,0x34,0xc6,0x00,0x72,0x24,0x07,0x00,0x01,
+0x10,0x60,0x00,0x11,0x00,0x02,0x2f,0xc2,0x90,0xc2,0x00,0x00,0x00,0x00,0x18,0x21,
+0x00,0x02,0x16,0x00,0x10,0xa7,0x00,0x09,0x00,0x02,0x16,0x03,0x14,0x80,0x00,0x0c,
+0x30,0x43,0x00,0x03,0x83,0x82,0x8b,0x88,0x00,0x00,0x00,0x00,0x00,0x02,0x10,0x80,
+0x00,0x43,0x10,0x21,0x00,0x02,0x16,0x00,0x00,0x02,0x1e,0x03,0x3c,0x02,0xb0,0x03,
+0x34,0x42,0x00,0x72,0xa0,0x43,0x00,0x00,0x03,0xe0,0x00,0x08,0x00,0x00,0x00,0x00,
+0x30,0x45,0x00,0x05,0x10,0x87,0x00,0x04,0x30,0x43,0x00,0x06,0x93,0x82,0x8b,0xa0,
+0x08,0x00,0x01,0x21,0x00,0x43,0x10,0x21,0x83,0x82,0x8b,0x94,0x00,0x00,0x00,0x00,
+0x00,0x02,0x10,0x40,0x08,0x00,0x01,0x21,0x00,0x45,0x10,0x21,0x10,0x80,0x00,0x05,
+0x00,0x00,0x18,0x21,0x24,0x63,0x00,0x01,0x00,0x64,0x10,0x2b,0x14,0x40,0xff,0xfd,
+0x00,0x00,0x00,0x00,0x03,0xe0,0x00,0x08,0x00,0x00,0x00,0x00,0x3c,0x03,0xb0,0x03,
+0x3c,0x02,0x80,0x00,0x24,0x42,0x04,0xec,0x3c,0x04,0xb0,0x02,0x34,0x63,0x00,0x20,
+0xac,0x62,0x00,0x00,0x34,0x84,0x00,0x08,0x24,0x02,0x00,0x01,0xaf,0x84,0x8b,0xb0,
+0xa3,0x82,0x8b,0xc0,0xa7,0x80,0x8b,0xb4,0xa7,0x80,0x8b,0xb6,0xaf,0x80,0x8b,0xb8,
+0xaf,0x80,0x8b,0xbc,0x03,0xe0,0x00,0x08,0x00,0x00,0x00,0x00,0x3c,0x03,0xb0,0x03,
+0x3c,0x02,0x80,0x00,0x34,0x63,0x00,0x20,0x24,0x42,0x05,0x2c,0x3c,0x04,0xb0,0x03,
+0xac,0x62,0x00,0x00,0x34,0x84,0x00,0xac,0x80,0xa2,0x00,0x15,0x8c,0x83,0x00,0x00,
+0x27,0xbd,0xff,0xf0,0x00,0x43,0x10,0x21,0xac,0x82,0x00,0x00,0x03,0xe0,0x00,0x08,
+0x27,0xbd,0x00,0x10,0x3c,0x02,0xb0,0x03,0x3c,0x03,0x80,0x00,0x34,0x42,0x00,0x20,
+0x24,0x63,0x05,0x64,0x27,0xbd,0xff,0xe0,0xac,0x43,0x00,0x00,0xaf,0xb1,0x00,0x14,
+0xaf,0xb0,0x00,0x10,0xaf,0xbf,0x00,0x18,0x8f,0x90,0x8b,0xb0,0x0c,0x00,0x02,0x9a,
+0x00,0x80,0x88,0x21,0x14,0x40,0x00,0x2a,0x3c,0x02,0x00,0x80,0x16,0x20,0x00,0x02,
+0x34,0x42,0x02,0x01,0x24,0x02,0x02,0x01,0xae,0x02,0x00,0x00,0x97,0x84,0x8b,0xb4,
+0x97,0x82,0x8b,0xb6,0x3c,0x03,0xb0,0x02,0x00,0x83,0x20,0x21,0x24,0x42,0x00,0x04,
+0xa7,0x82,0x8b,0xb6,0xa4,0x82,0x00,0x00,0x8f,0x84,0x8b,0xb8,0x8f,0x82,0x8b,0xb0,
+0x93,0x85,0x8b,0x62,0x24,0x84,0x00,0x01,0x24,0x42,0x00,0x04,0x24,0x03,0x8f,0xff,
+0x3c,0x07,0xb0,0x06,0x3c,0x06,0xb0,0x03,0x00,0x43,0x10,0x24,0x00,0x85,0x28,0x2a,
+0x34,0xe7,0x80,0x18,0xaf,0x82,0x8b,0xb0,0xaf,0x84,0x8b,0xb8,0x10,0xa0,0x00,0x08,
+0x34,0xc6,0x01,0x08,0x8f,0x83,0x8b,0xbc,0x8f,0x84,0x8b,0x7c,0x8c,0xc2,0x00,0x00,
+0x00,0x64,0x18,0x21,0x00,0x43,0x10,0x2b,0x14,0x40,0x00,0x09,0x00,0x00,0x00,0x00,
+0x8c,0xe2,0x00,0x00,0x3c,0x03,0x0f,0x00,0x3c,0x04,0x04,0x00,0x00,0x43,0x10,0x24,
+0x10,0x44,0x00,0x03,0x00,0x00,0x00,0x00,0x0c,0x00,0x04,0x98,0x00,0x00,0x00,0x00,
+0x8f,0xbf,0x00,0x18,0x7b,0xb0,0x00,0xbc,0x03,0xe0,0x00,0x08,0x27,0xbd,0x00,0x20,
+0x27,0xbd,0xff,0xd8,0x3c,0x02,0xb0,0x03,0x3c,0x03,0x80,0x00,0x24,0x63,0x06,0x50,
+0xaf,0xb0,0x00,0x10,0x34,0x42,0x00,0x20,0x8f,0x90,0x8b,0xb0,0xac,0x43,0x00,0x00,
+0xaf,0xb3,0x00,0x1c,0xaf,0xb2,0x00,0x18,0xaf,0xb1,0x00,0x14,0xaf,0xbf,0x00,0x20,
+0x00,0x80,0x88,0x21,0x00,0xa0,0x90,0x21,0x0c,0x00,0x02,0x9a,0x00,0xc0,0x98,0x21,
+0x24,0x07,0x8f,0xff,0x14,0x40,0x00,0x19,0x26,0x03,0x00,0x04,0x24,0x02,0x0e,0x03,
+0xae,0x02,0x00,0x00,0x00,0x67,0x80,0x24,0x26,0x02,0x00,0x04,0xae,0x11,0x00,0x00,
+0x00,0x47,0x80,0x24,0x97,0x86,0x8b,0xb4,0x26,0x03,0x00,0x04,0xae,0x12,0x00,0x00,
+0x00,0x67,0x80,0x24,0xae,0x13,0x00,0x00,0x8f,0x84,0x8b,0xb0,0x3c,0x02,0xb0,0x02,
+0x97,0x85,0x8b,0xb6,0x00,0xc2,0x30,0x21,0x8f,0x82,0x8b,0xb8,0x24,0x84,0x00,0x10,
+0x24,0xa5,0x00,0x10,0x00,0x87,0x20,0x24,0x24,0x42,0x00,0x01,0xa7,0x85,0x8b,0xb6,
+0xaf,0x84,0x8b,0xb0,0xaf,0x82,0x8b,0xb8,0xa4,0xc5,0x00,0x00,0x8f,0xbf,0x00,0x20,
+0x7b,0xb2,0x00,0xfc,0x7b,0xb0,0x00,0xbc,0x03,0xe0,0x00,0x08,0x27,0xbd,0x00,0x28,
+0x27,0xbd,0xff,0xe8,0xaf,0xbf,0x00,0x10,0x94,0x82,0x00,0x04,0x00,0x00,0x00,0x00,
+0x30,0x42,0xe0,0x00,0x14,0x40,0x00,0x14,0x00,0x00,0x00,0x00,0x90,0x82,0x00,0x02,
+0x00,0x00,0x00,0x00,0x30,0x42,0x00,0xfc,0x00,0x82,0x28,0x21,0x8c,0xa4,0x00,0x00,
+0x3c,0x02,0x00,0x70,0x8c,0xa6,0x00,0x08,0x00,0x82,0x10,0x21,0x2c,0x43,0x00,0x06,
+0x10,0x60,0x00,0x09,0x3c,0x03,0x80,0x01,0x00,0x02,0x10,0x80,0x24,0x63,0x01,0xe8,
+0x00,0x43,0x10,0x21,0x8c,0x44,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x80,0x00,0x08,
+0x00,0x00,0x00,0x00,0xaf,0x86,0x80,0x14,0x8f,0xbf,0x00,0x10,0x00,0x00,0x00,0x00,
+0x03,0xe0,0x00,0x08,0x27,0xbd,0x00,0x18,0x8c,0xa4,0x00,0x00,0x0c,0x00,0x17,0xb3,
+0x00,0x00,0x00,0x00,0x08,0x00,0x01,0xde,0x00,0x00,0x00,0x00,0x0c,0x00,0x24,0xaa,
+0x00,0xc0,0x20,0x21,0x08,0x00,0x01,0xde,0x00,0x00,0x00,0x00,0x3c,0x02,0xb0,0x03,
+0x34,0x42,0x01,0x08,0x8c,0x44,0x00,0x00,0x8f,0x82,0x80,0x18,0x3c,0x03,0x00,0x0f,
+0x34,0x63,0x42,0x40,0x00,0x43,0x10,0x21,0x00,0x82,0x20,0x2b,0x10,0x80,0x00,0x09,
+0x24,0x03,0x00,0x05,0x8f,0x82,0x83,0x30,0x00,0x00,0x00,0x00,0x24,0x42,0x00,0x01,
+0xaf,0x82,0x83,0x30,0x10,0x43,0x00,0x03,0x00,0x00,0x00,0x00,0x03,0xe0,0x00,0x08,
+0x00,0x00,0x00,0x00,0x3c,0x03,0xb0,0x03,0x8c,0x63,0x01,0x08,0x24,0x02,0x00,0x01,
+0xa3,0x82,0x80,0x11,0xaf,0x80,0x83,0x30,0xaf,0x83,0x80,0x18,0x08,0x00,0x01,0xfb,
+0x00,0x00,0x00,0x00,0x30,0x84,0x00,0xff,0x14,0x80,0x00,0x2f,0x00,0x00,0x00,0x00,
+0x8f,0x82,0x80,0x14,0xa3,0x85,0x83,0x63,0x10,0x40,0x00,0x2b,0x2c,0xa2,0x00,0x04,
+0x14,0x40,0x00,0x06,0x00,0x05,0x10,0x40,0x24,0xa2,0xff,0xfc,0x2c,0x42,0x00,0x08,
+0x10,0x40,0x00,0x09,0x24,0xa2,0xff,0xf0,0x00,0x05,0x10,0x40,0x27,0x84,0x83,0x6c,
+0x00,0x44,0x10,0x21,0x94,0x43,0x00,0x00,0x00,0x00,0x00,0x00,0x24,0x63,0x00,0x01,
+0x03,0xe0,0x00,0x08,0xa4,0x43,0x00,0x00,0x2c,0x42,0x00,0x10,0x14,0x40,0x00,0x0a,
+0x00,0x05,0x10,0x40,0x24,0xa2,0xff,0xe0,0x2c,0x42,0x00,0x10,0x14,0x40,0x00,0x06,
+0x00,0x05,0x10,0x40,0x24,0xa2,0xff,0xd0,0x2c,0x42,0x00,0x10,0x10,0x40,0x00,0x09,
+0x24,0xa2,0xff,0xc0,0x00,0x05,0x10,0x40,0x27,0x84,0x83,0x6c,0x00,0x44,0x10,0x21,
+0x94,0x43,0xff,0xf8,0x00,0x00,0x00,0x00,0x24,0x63,0x00,0x01,0x03,0xe0,0x00,0x08,
+0xa4,0x43,0xff,0xf8,0x2c,0x42,0x00,0x10,0x10,0x40,0x00,0x07,0x00,0x05,0x10,0x40,
+0x27,0x84,0x83,0x6c,0x00,0x44,0x10,0x21,0x94,0x43,0xff,0xf8,0x00,0x00,0x00,0x00,
+0x24,0x63,0x00,0x01,0xa4,0x43,0xff,0xf8,0x03,0xe0,0x00,0x08,0x00,0x00,0x00,0x00,
+0x8f,0x86,0x8b,0xb0,0x8f,0x82,0x80,0x14,0x27,0xbd,0xff,0xe8,0xaf,0xbf,0x00,0x10,
+0x10,0x40,0x00,0x2a,0x00,0xc0,0x38,0x21,0x24,0x02,0x00,0x07,0x24,0x03,0xff,0x9c,
+0xa3,0x82,0x83,0x6b,0xa3,0x83,0x83,0x6a,0x27,0x8a,0x83,0x68,0x00,0x00,0x20,0x21,
+0x24,0x09,0x8f,0xff,0x00,0x04,0x10,0x80,0x00,0x4a,0x28,0x21,0x8c,0xa2,0x00,0x00,
+0x24,0xe3,0x00,0x04,0x24,0x88,0x00,0x01,0xac,0xe2,0x00,0x00,0x10,0x80,0x00,0x02,
+0x00,0x69,0x38,0x24,0xac,0xa0,0x00,0x00,0x31,0x04,0x00,0xff,0x2c,0x82,0x00,0x27,
+0x14,0x40,0xff,0xf5,0x00,0x04,0x10,0x80,0x97,0x83,0x8b,0xb6,0x97,0x85,0x8b,0xb4,
+0x3c,0x02,0xb0,0x02,0x24,0x63,0x00,0x9c,0x00,0xa2,0x28,0x21,0x3c,0x04,0xb0,0x06,
+0xa7,0x83,0x8b,0xb6,0x34,0x84,0x80,0x18,0xa4,0xa3,0x00,0x00,0x8c,0x85,0x00,0x00,
+0x24,0x02,0x8f,0xff,0x24,0xc6,0x00,0x9c,0x3c,0x03,0x0f,0x00,0x00,0xc2,0x30,0x24,
+0x00,0xa3,0x28,0x24,0x3c,0x02,0x04,0x00,0xaf,0x86,0x8b,0xb0,0x10,0xa2,0x00,0x03,
+0x00,0x00,0x00,0x00,0x0c,0x00,0x04,0x98,0x00,0x00,0x00,0x00,0x8f,0xbf,0x00,0x10,
+0x00,0x00,0x00,0x00,0x03,0xe0,0x00,0x08,0x27,0xbd,0x00,0x18,0x8f,0x86,0x8b,0xb0,
+0x27,0xbd,0xff,0xc8,0x24,0x02,0x00,0x08,0x24,0x03,0x00,0x20,0xaf,0xbf,0x00,0x30,
+0xa3,0xa2,0x00,0x13,0xa3,0xa3,0x00,0x12,0xa7,0xa4,0x00,0x10,0x00,0xc0,0x28,0x21,
+0x27,0xa9,0x00,0x10,0x00,0x00,0x38,0x21,0x24,0x08,0x8f,0xff,0x00,0x07,0x10,0x80,
+0x00,0x49,0x10,0x21,0x8c,0x44,0x00,0x00,0x24,0xe3,0x00,0x01,0x30,0x67,0x00,0xff,
+0x24,0xa2,0x00,0x04,0x2c,0xe3,0x00,0x08,0xac,0xa4,0x00,0x00,0x14,0x60,0xff,0xf7,
+0x00,0x48,0x28,0x24,0x97,0x83,0x8b,0xb6,0x97,0x85,0x8b,0xb4,0x3c,0x02,0xb0,0x02,
+0x24,0x63,0x00,0x20,0x00,0xa2,0x28,0x21,0x3c,0x04,0xb0,0x06,0xa7,0x83,0x8b,0xb6,
+0x34,0x84,0x80,0x18,0xa4,0xa3,0x00,0x00,0x8c,0x85,0x00,0x00,0x24,0x02,0x8f,0xff,
+0x24,0xc6,0x00,0x20,0x3c,0x03,0x0f,0x00,0x00,0xc2,0x30,0x24,0x00,0xa3,0x28,0x24,
+0x3c,0x02,0x04,0x00,0xaf,0x86,0x8b,0xb0,0x10,0xa2,0x00,0x03,0x00,0x00,0x00,0x00,
+0x0c,0x00,0x04,0x98,0x00,0x00,0x00,0x00,0x8f,0xbf,0x00,0x30,0x00,0x00,0x00,0x00,
+0x03,0xe0,0x00,0x08,0x27,0xbd,0x00,0x38,0x93,0x82,0x8b,0xc0,0x00,0x00,0x00,0x00,
+0x10,0x40,0x00,0x11,0x24,0x06,0x00,0x01,0x8f,0x82,0x8b,0xb8,0x3c,0x05,0xb0,0x06,
+0x3c,0x04,0xb0,0x03,0x34,0xa5,0x80,0x18,0x34,0x84,0x01,0x08,0x14,0x40,0x00,0x09,
+0x00,0x00,0x30,0x21,0x97,0x82,0x8b,0xb4,0x8c,0x84,0x00,0x00,0x3c,0x03,0xb0,0x02,
+0x00,0x43,0x10,0x21,0xaf,0x84,0x8b,0xbc,0xa7,0x80,0x8b,0xb6,0xac,0x40,0x00,0x00,
+0xac,0x40,0x00,0x04,0x8c,0xa2,0x00,0x00,0x03,0xe0,0x00,0x08,0x00,0xc0,0x10,0x21,
+0x8f,0x86,0x8b,0xb0,0x8f,0x82,0x8b,0xb8,0x27,0xbd,0xff,0xe8,0xaf,0xbf,0x00,0x10,
+0x00,0xc0,0x40,0x21,0x14,0x40,0x00,0x0a,0x00,0x40,0x50,0x21,0x00,0x00,0x38,0x21,
+0x27,0x89,0x83,0x38,0x24,0xe2,0x00,0x01,0x00,0x07,0x18,0x80,0x30,0x47,0x00,0xff,
+0x00,0x69,0x18,0x21,0x2c,0xe2,0x00,0x0a,0x14,0x40,0xff,0xfa,0xac,0x60,0x00,0x00,
+0x3c,0x02,0x00,0x80,0x10,0x82,0x00,0x6f,0x00,0x00,0x00,0x00,0x97,0x82,0x83,0x3e,
+0x00,0x00,0x00,0x00,0x24,0x42,0x00,0x01,0xa7,0x82,0x83,0x3e,0x90,0xa3,0x00,0x15,
+0x97,0x82,0x83,0x40,0x00,0x03,0x1e,0x00,0x00,0x03,0x1e,0x03,0x00,0x43,0x10,0x21,
+0xa7,0x82,0x83,0x40,0x8c,0xa4,0x00,0x20,0x3c,0x02,0x00,0x60,0x3c,0x03,0x00,0x20,
+0x00,0x82,0x20,0x24,0x10,0x83,0x00,0x54,0x00,0x00,0x00,0x00,0x14,0x80,0x00,0x47,
+0x00,0x00,0x00,0x00,0x97,0x82,0x83,0x44,0x00,0x00,0x00,0x00,0x24,0x42,0x00,0x01,
+0xa7,0x82,0x83,0x44,0x84,0xa3,0x00,0x06,0x8f,0x82,0x83,0x54,0x00,0x00,0x00,0x00,
+0x00,0x43,0x10,0x21,0xaf,0x82,0x83,0x54,0x25,0x42,0x00,0x01,0x28,0x43,0x27,0x10,
+0xaf,0x82,0x8b,0xb8,0x10,0x60,0x00,0x09,0x24,0x02,0x00,0x04,0x93,0x83,0x80,0x11,
+0x24,0x02,0x00,0x01,0x10,0x62,0x00,0x05,0x24,0x02,0x00,0x04,0x8f,0xbf,0x00,0x10,
+0x00,0x00,0x00,0x00,0x03,0xe0,0x00,0x08,0x27,0xbd,0x00,0x18,0x24,0x03,0x00,0x28,
+0xa3,0x83,0x83,0x3a,0xa3,0x82,0x83,0x3b,0x90,0xa2,0x00,0x18,0x93,0x83,0x83,0x63,
+0x00,0x00,0x38,0x21,0x00,0x02,0x16,0x00,0x00,0x02,0x16,0x03,0xa7,0x82,0x83,0x4e,
+0xa3,0x83,0x83,0x5c,0x27,0x89,0x83,0x38,0x24,0x05,0x8f,0xff,0x00,0x07,0x10,0x80,
+0x00,0x49,0x10,0x21,0x8c,0x44,0x00,0x00,0x24,0xe3,0x00,0x01,0x30,0x67,0x00,0xff,
+0x25,0x02,0x00,0x04,0x2c,0xe3,0x00,0x0a,0xad,0x04,0x00,0x00,0x14,0x60,0xff,0xf7,
+0x00,0x45,0x40,0x24,0x97,0x83,0x8b,0xb6,0x97,0x85,0x8b,0xb4,0x3c,0x02,0xb0,0x02,
+0x24,0x63,0x00,0x28,0x00,0xa2,0x28,0x21,0x3c,0x04,0xb0,0x06,0xa7,0x83,0x8b,0xb6,
+0x34,0x84,0x80,0x18,0xa4,0xa3,0x00,0x00,0x8c,0x85,0x00,0x00,0x24,0x02,0x8f,0xff,
+0x24,0xc6,0x00,0x28,0x3c,0x03,0x0f,0x00,0x00,0xc2,0x30,0x24,0x00,0xa3,0x28,0x24,
+0x3c,0x02,0x04,0x00,0xaf,0x86,0x8b,0xb0,0x10,0xa2,0x00,0x03,0x00,0x00,0x00,0x00,
+0x0c,0x00,0x04,0x98,0x00,0x00,0x00,0x00,0x0c,0x00,0x02,0x38,0x00,0x00,0x00,0x00,
+0xa3,0x80,0x80,0x11,0x08,0x00,0x02,0xe7,0x00,0x00,0x00,0x00,0x97,0x82,0x83,0x46,
+0x00,0x00,0x00,0x00,0x24,0x42,0x00,0x01,0xa7,0x82,0x83,0x46,0x84,0xa3,0x00,0x06,
+0x8f,0x82,0x83,0x58,0x00,0x00,0x00,0x00,0x00,0x43,0x10,0x21,0xaf,0x82,0x83,0x58,
+0x08,0x00,0x02,0xdf,0x25,0x42,0x00,0x01,0x97,0x82,0x83,0x42,0x00,0x00,0x00,0x00,
+0x24,0x42,0x00,0x01,0xa7,0x82,0x83,0x42,0x84,0xa3,0x00,0x06,0x8f,0x82,0x83,0x50,
+0x00,0x00,0x00,0x00,0x00,0x43,0x10,0x21,0xaf,0x82,0x83,0x50,0x08,0x00,0x02,0xdf,
+0x25,0x42,0x00,0x01,0x97,0x82,0x83,0x3c,0x00,0x00,0x00,0x00,0x24,0x42,0x00,0x01,
+0xa7,0x82,0x83,0x3c,0x08,0x00,0x02,0xc7,0x00,0x00,0x00,0x00,0x27,0xbd,0xff,0xd0,
+0xaf,0xbf,0x00,0x28,0x8c,0xa3,0x00,0x20,0x8f,0x8a,0x8b,0xb0,0x3c,0x02,0x00,0x10,
+0x00,0x62,0x10,0x24,0x00,0xa0,0x38,0x21,0x01,0x40,0x48,0x21,0x10,0x40,0x00,0x3d,
+0x00,0x80,0x28,0x21,0x8c,0xe4,0x00,0x1c,0x34,0xa5,0x12,0x06,0xaf,0xa5,0x00,0x10,
+0x8c,0x82,0x00,0x08,0x00,0x03,0x1c,0x42,0x30,0x63,0x00,0x30,0x00,0x02,0x13,0x02,
+0x30,0x42,0x00,0x40,0x00,0x43,0x10,0x25,0x90,0xe6,0x00,0x10,0x90,0xe4,0x00,0x13,
+0x94,0xe8,0x00,0x0c,0x94,0xe3,0x00,0x1a,0x00,0x02,0x16,0x00,0x90,0xe7,0x00,0x12,
+0x00,0xa2,0x28,0x25,0x24,0x02,0x12,0x34,0xa7,0xa2,0x00,0x1c,0x24,0x02,0x56,0x78,
+0xaf,0xa5,0x00,0x10,0xa3,0xa6,0x00,0x18,0xa3,0xa7,0x00,0x1f,0xa7,0xa3,0x00,0x1a,
+0xa3,0xa4,0x00,0x19,0xa7,0xa8,0x00,0x20,0xa7,0xa2,0x00,0x22,0x00,0x00,0x28,0x21,
+0x27,0xa7,0x00,0x10,0x24,0x06,0x8f,0xff,0x00,0x05,0x10,0x80,0x00,0x47,0x10,0x21,
+0x8c,0x44,0x00,0x00,0x24,0xa3,0x00,0x01,0x30,0x65,0x00,0xff,0x25,0x22,0x00,0x04,
+0x2c,0xa3,0x00,0x05,0xad,0x24,0x00,0x00,0x14,0x60,0xff,0xf7,0x00,0x46,0x48,0x24,
+0x97,0x83,0x8b,0xb6,0x97,0x85,0x8b,0xb4,0x3c,0x02,0xb0,0x02,0x24,0x63,0x00,0x14,
+0x00,0xa2,0x28,0x21,0x3c,0x04,0xb0,0x06,0xa7,0x83,0x8b,0xb6,0x34,0x84,0x80,0x18,
+0xa4,0xa3,0x00,0x00,0x8c,0x85,0x00,0x00,0x24,0x02,0x8f,0xff,0x25,0x46,0x00,0x14,
+0x3c,0x03,0x0f,0x00,0x00,0xc2,0x50,0x24,0x00,0xa3,0x28,0x24,0x3c,0x02,0x04,0x00,
+0xaf,0x8a,0x8b,0xb0,0x10,0xa2,0x00,0x03,0x00,0x00,0x00,0x00,0x0c,0x00,0x04,0x98,
+0x00,0x00,0x00,0x00,0x8f,0xbf,0x00,0x28,0x00,0x00,0x00,0x00,0x03,0xe0,0x00,0x08,
+0x27,0xbd,0x00,0x30,0x3c,0x05,0xb0,0x03,0x3c,0x02,0x80,0x00,0x27,0xbd,0xff,0xc8,
+0x00,0x04,0x22,0x00,0x34,0xa5,0x00,0x20,0x24,0x42,0x0e,0x04,0x3c,0x03,0xb0,0x00,
+0xaf,0xb5,0x00,0x24,0xaf,0xb4,0x00,0x20,0xaf,0xb2,0x00,0x18,0xaf,0xb0,0x00,0x10,
+0xaf,0xbf,0x00,0x30,0x00,0x83,0x80,0x21,0xaf,0xb7,0x00,0x2c,0xaf,0xb6,0x00,0x28,
+0xaf,0xb3,0x00,0x1c,0xaf,0xb1,0x00,0x14,0xac,0xa2,0x00,0x00,0x8e,0x09,0x00,0x00,
+0x00,0x00,0x90,0x21,0x26,0x10,0x00,0x08,0x00,0x09,0xa6,0x02,0x12,0x80,0x00,0x13,
+0x00,0x00,0xa8,0x21,0x24,0x13,0x00,0x02,0x3c,0x16,0x00,0xff,0x3c,0x17,0xff,0x00,
+0x8e,0x09,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x09,0x12,0x02,0x24,0x42,0x00,0x02,
+0x31,0x25,0x00,0xff,0x10,0xb3,0x00,0x76,0x30,0x51,0x00,0xff,0x24,0x02,0x00,0x03,
+0x10,0xa2,0x00,0x18,0x00,0x00,0x00,0x00,0x02,0x51,0x10,0x21,0x30,0x52,0xff,0xff,
+0x02,0x54,0x18,0x2b,0x14,0x60,0xff,0xf2,0x02,0x11,0x80,0x21,0x12,0xa0,0x00,0x0a,
+0x3c,0x02,0xb0,0x06,0x34,0x42,0x80,0x18,0x8c,0x43,0x00,0x00,0x3c,0x04,0x0f,0x00,
+0x3c,0x02,0x04,0x00,0x00,0x64,0x18,0x24,0x10,0x62,0x00,0x03,0x00,0x00,0x00,0x00,
+0x0c,0x00,0x04,0x98,0x00,0x00,0x00,0x00,0x8f,0xbf,0x00,0x30,0x7b,0xb6,0x01,0x7c,
+0x7b,0xb4,0x01,0x3c,0x7b,0xb2,0x00,0xfc,0x7b,0xb0,0x00,0xbc,0x03,0xe0,0x00,0x08,
+0x27,0xbd,0x00,0x38,0x8e,0x09,0x00,0x04,0x24,0x15,0x00,0x01,0x8e,0x06,0x00,0x0c,
+0x00,0x09,0x11,0x42,0x00,0x09,0x18,0xc2,0x30,0x48,0x00,0x03,0x00,0x09,0x14,0x02,
+0x30,0x6c,0x00,0x03,0x00,0x09,0x26,0x02,0x11,0x15,0x00,0x45,0x30,0x43,0x00,0x0f,
+0x29,0x02,0x00,0x02,0x14,0x40,0x00,0x26,0x00,0x00,0x00,0x00,0x11,0x13,0x00,0x0f,
+0x00,0x00,0x38,0x21,0x00,0x07,0x22,0x02,0x30,0x84,0xff,0x00,0x3c,0x03,0x00,0xff,
+0x00,0x07,0x2e,0x02,0x00,0x07,0x12,0x00,0x00,0x43,0x10,0x24,0x00,0xa4,0x28,0x25,
+0x00,0xa2,0x28,0x25,0x00,0x07,0x1e,0x00,0x00,0xa3,0x28,0x25,0x0c,0x00,0x01,0x94,
+0x01,0x20,0x20,0x21,0x08,0x00,0x03,0xa7,0x02,0x51,0x10,0x21,0x11,0x95,0x00,0x0f,
+0x00,0x00,0x00,0x00,0x11,0x88,0x00,0x07,0x00,0x00,0x00,0x00,0x00,0x04,0x10,0x80,
+0x27,0x83,0x8b,0x60,0x00,0x43,0x10,0x21,0x8c,0x47,0x00,0x18,0x08,0x00,0x03,0xce,
+0x00,0x07,0x22,0x02,0x00,0x04,0x10,0x40,0x27,0x83,0x8b,0x68,0x00,0x43,0x10,0x21,
+0x94,0x47,0x00,0x02,0x08,0x00,0x03,0xce,0x00,0x07,0x22,0x02,0x27,0x82,0x8b,0x60,
+0x00,0x82,0x10,0x21,0x90,0x47,0x00,0x00,0x08,0x00,0x03,0xce,0x00,0x07,0x22,0x02,
+0x15,0x00,0xff,0xdc,0x00,0x00,0x38,0x21,0x10,0x75,0x00,0x05,0x00,0x80,0x38,0x21,
+0x00,0x65,0x18,0x26,0x24,0x82,0x01,0x00,0x00,0x00,0x38,0x21,0x00,0x43,0x38,0x0a,
+0x24,0x02,0x00,0x01,0x11,0x82,0x00,0x0e,0x3c,0x02,0xb0,0x03,0x24,0x02,0x00,0x02,
+0x11,0x82,0x00,0x06,0x00,0x00,0x00,0x00,0x3c,0x02,0xb0,0x03,0x00,0xe2,0x10,0x21,
+0x8c,0x47,0x00,0x00,0x08,0x00,0x03,0xce,0x00,0x07,0x22,0x02,0x3c,0x02,0xb0,0x03,
+0x00,0xe2,0x10,0x21,0x94,0x43,0x00,0x00,0x08,0x00,0x03,0xcd,0x30,0x67,0xff,0xff,
+0x00,0xe2,0x10,0x21,0x90,0x43,0x00,0x00,0x08,0x00,0x03,0xcd,0x30,0x67,0x00,0xff,
+0x30,0x62,0x00,0x03,0x00,0x02,0x12,0x00,0x11,0x95,0x00,0x07,0x00,0x44,0x38,0x21,
+0x11,0x93,0x00,0x03,0x00,0x00,0x00,0x00,0x08,0x00,0x03,0xff,0x3c,0x02,0xb0,0x0a,
+0x08,0x00,0x04,0x04,0x3c,0x02,0xb0,0x0a,0x08,0x00,0x04,0x08,0x3c,0x02,0xb0,0x0a,
+0x8e,0x09,0x00,0x04,0x8e,0x02,0x00,0x08,0x8e,0x03,0x00,0x0c,0x00,0x09,0x41,0x42,
+0x00,0x02,0x22,0x02,0x00,0x03,0x3a,0x02,0x30,0x84,0xff,0x00,0x30,0xe7,0xff,0x00,
+0x00,0x02,0x5e,0x02,0x00,0x02,0x32,0x00,0x00,0x03,0x56,0x02,0x00,0x03,0x2a,0x00,
+0x01,0x64,0x58,0x25,0x00,0xd6,0x30,0x24,0x01,0x47,0x50,0x25,0x00,0x02,0x16,0x00,
+0x00,0xb6,0x28,0x24,0x00,0x03,0x1e,0x00,0x01,0x66,0x58,0x25,0x01,0x45,0x50,0x25,
+0x00,0x57,0x10,0x24,0x00,0x77,0x18,0x24,0x01,0x62,0x38,0x25,0x01,0x43,0x30,0x25,
+0x00,0x09,0x10,0xc2,0x00,0x09,0x1c,0x02,0x31,0x08,0x00,0x03,0x30,0x4c,0x00,0x03,
+0x30,0x63,0x00,0x0f,0x00,0x09,0x26,0x02,0x00,0xe0,0x58,0x21,0x15,0x00,0x00,0x28,
+0x00,0xc0,0x50,0x21,0x24,0x02,0x00,0x01,0x10,0x62,0x00,0x06,0x00,0x80,0x28,0x21,
+0x24,0x02,0x00,0x03,0x14,0x62,0xff,0x69,0x02,0x51,0x10,0x21,0x24,0x85,0x01,0x00,
+0x24,0x02,0x00,0x01,0x11,0x82,0x00,0x15,0x24,0x02,0x00,0x02,0x11,0x82,0x00,0x0a,
+0x3c,0x03,0xb0,0x03,0x00,0xa3,0x18,0x21,0x8c,0x62,0x00,0x00,0x00,0x0a,0x20,0x27,
+0x01,0x6a,0x28,0x24,0x00,0x44,0x10,0x24,0x00,0x45,0x10,0x25,0xac,0x62,0x00,0x00,
+0x08,0x00,0x03,0xa7,0x02,0x51,0x10,0x21,0x00,0xa3,0x18,0x21,0x94,0x62,0x00,0x00,
+0x00,0x0a,0x20,0x27,0x01,0x6a,0x28,0x24,0x00,0x44,0x10,0x24,0x00,0x45,0x10,0x25,
+0xa4,0x62,0x00,0x00,0x08,0x00,0x03,0xa7,0x02,0x51,0x10,0x21,0x3c,0x03,0xb0,0x03,
+0x00,0xa3,0x18,0x21,0x90,0x62,0x00,0x00,0x00,0x0a,0x20,0x27,0x01,0x6a,0x28,0x24,
+0x00,0x44,0x10,0x24,0x00,0x45,0x10,0x25,0x08,0x00,0x03,0xa6,0xa0,0x62,0x00,0x00,
+0x24,0x02,0x00,0x01,0x11,0x02,0x00,0x21,0x00,0x00,0x00,0x00,0x15,0x13,0xff,0x42,
+0x00,0x00,0x00,0x00,0x11,0x82,0x00,0x17,0x00,0x00,0x00,0x00,0x11,0x88,0x00,0x0b,
+0x00,0x00,0x00,0x00,0x27,0x83,0x8b,0x60,0x00,0x04,0x20,0x80,0x00,0x83,0x20,0x21,
+0x8c,0x82,0x00,0x18,0x00,0x06,0x18,0x27,0x00,0xe6,0x28,0x24,0x00,0x43,0x10,0x24,
+0x00,0x45,0x10,0x25,0x08,0x00,0x03,0xa6,0xac,0x82,0x00,0x18,0x27,0x83,0x8b,0x68,
+0x00,0x04,0x20,0x40,0x00,0x83,0x20,0x21,0x94,0x82,0x00,0x02,0x00,0x06,0x18,0x27,
+0x00,0xe6,0x28,0x24,0x00,0x43,0x10,0x24,0x00,0x45,0x10,0x25,0x08,0x00,0x03,0xa6,
+0xa4,0x82,0x00,0x02,0x27,0x83,0x8b,0x60,0x00,0x83,0x18,0x21,0x90,0x62,0x00,0x00,
+0x00,0x06,0x20,0x27,0x08,0x00,0x04,0x5c,0x00,0xe6,0x28,0x24,0x30,0x62,0x00,0x07,
+0x00,0x02,0x12,0x00,0x11,0x88,0x00,0x0f,0x00,0x44,0x10,0x21,0x11,0x93,0x00,0x07,
+0x00,0x00,0x00,0x00,0x3c,0x03,0xb0,0x0a,0x00,0x43,0x18,0x21,0x8c,0x62,0x00,0x00,
+0x00,0x06,0x20,0x27,0x08,0x00,0x04,0x49,0x00,0xe6,0x28,0x24,0x3c,0x03,0xb0,0x0a,
+0x00,0x43,0x18,0x21,0x94,0x62,0x00,0x00,0x00,0x06,0x20,0x27,0x08,0x00,0x04,0x52,
+0x00,0xe6,0x28,0x24,0x3c,0x03,0xb0,0x0a,0x08,0x00,0x04,0x7f,0x00,0x43,0x18,0x21,
+0x97,0x85,0x8b,0xb4,0x3c,0x07,0xb0,0x02,0x3c,0x04,0xb0,0x03,0x3c,0x02,0x80,0x00,
+0x00,0xa7,0x28,0x21,0x34,0x84,0x00,0x20,0x24,0x42,0x12,0x60,0x24,0x03,0xff,0x80,
+0xac,0x82,0x00,0x00,0xa0,0xa3,0x00,0x07,0x97,0x82,0x8b,0xb6,0x97,0x85,0x8b,0xb4,
+0x3c,0x06,0xb0,0x06,0x30,0x42,0xff,0xf8,0x24,0x42,0x00,0x10,0x00,0xa2,0x10,0x21,
+0x30,0x42,0x0f,0xff,0x24,0x44,0x00,0x08,0x30,0x84,0x0f,0xff,0x00,0x05,0x28,0xc2,
+0x3c,0x03,0x00,0x40,0x00,0xa3,0x28,0x25,0x00,0x87,0x20,0x21,0x34,0xc6,0x80,0x18,
+0xac,0xc5,0x00,0x00,0xaf,0x84,0x8b,0xb0,0xa7,0x82,0x8b,0xb4,0xa7,0x80,0x8b,0xb6,
+0xaf,0x80,0x8b,0xb8,0x03,0xe0,0x00,0x08,0x00,0x00,0x00,0x00,0x30,0xa5,0x00,0xff,
+0x30,0x84,0x00,0xff,0x24,0x02,0x00,0x01,0x00,0xe0,0x48,0x21,0x30,0xc6,0x00,0xff,
+0x8f,0xa7,0x00,0x10,0x10,0x82,0x00,0x07,0x00,0xa0,0x40,0x21,0x24,0x02,0x00,0x03,
+0x10,0x82,0x00,0x03,0x00,0x00,0x00,0x00,0x03,0xe0,0x00,0x08,0x00,0x00,0x00,0x00,
+0x24,0xa8,0x01,0x00,0x3c,0x03,0xb0,0x03,0x24,0x02,0x00,0x01,0x00,0x07,0x20,0x27,
+0x01,0x27,0x28,0x24,0x10,0xc2,0x00,0x14,0x01,0x03,0x18,0x21,0x24,0x02,0x00,0x02,
+0x10,0xc2,0x00,0x09,0x00,0x07,0x50,0x27,0x3c,0x03,0xb0,0x03,0x01,0x03,0x18,0x21,
+0x8c,0x62,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x4a,0x10,0x24,0x00,0x45,0x10,0x25,
+0x08,0x00,0x04,0xe3,0xac,0x62,0x00,0x00,0x3c,0x03,0xb0,0x03,0x01,0x03,0x18,0x21,
+0x94,0x62,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x4a,0x10,0x24,0x00,0x45,0x10,0x25,
+0x03,0xe0,0x00,0x08,0xa4,0x62,0x00,0x00,0x90,0x62,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x44,0x10,0x24,0x00,0x45,0x10,0x25,0xa0,0x62,0x00,0x00,0x03,0xe0,0x00,0x08,
+0x00,0x00,0x00,0x00,0x30,0x84,0x00,0x07,0x00,0x04,0x22,0x00,0x30,0xa5,0x00,0xff,
+0x00,0x85,0x28,0x21,0x3c,0x02,0xb0,0x0a,0x00,0xa2,0x40,0x21,0x30,0xc6,0x00,0xff,
+0x24,0x02,0x00,0x01,0x8f,0xa4,0x00,0x10,0x10,0xc2,0x00,0x14,0x24,0x02,0x00,0x02,
+0x00,0x04,0x50,0x27,0x10,0xc2,0x00,0x09,0x00,0xe4,0x48,0x24,0x3c,0x03,0xb0,0x0a,
+0x00,0xa3,0x18,0x21,0x8c,0x62,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x4a,0x10,0x24,
+0x00,0x49,0x10,0x25,0x03,0xe0,0x00,0x08,0xac,0x62,0x00,0x00,0x3c,0x03,0xb0,0x0a,
+0x00,0xa3,0x18,0x21,0x94,0x62,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x4a,0x10,0x24,
+0x00,0x49,0x10,0x25,0x03,0xe0,0x00,0x08,0xa4,0x62,0x00,0x00,0x91,0x02,0x00,0x00,
+0x00,0x04,0x18,0x27,0x00,0xe4,0x20,0x24,0x00,0x43,0x10,0x24,0x00,0x44,0x10,0x25,
+0x03,0xe0,0x00,0x08,0xa1,0x02,0x00,0x00,0x30,0xa9,0x00,0xff,0x27,0x83,0x8b,0x60,
+0x30,0x85,0x00,0xff,0x24,0x02,0x00,0x01,0x00,0x07,0x50,0x27,0x00,0xc7,0x40,0x24,
+0x11,0x22,0x00,0x17,0x00,0xa3,0x18,0x21,0x00,0x05,0x20,0x40,0x27,0x82,0x8b,0x60,
+0x00,0x05,0x28,0x80,0x27,0x83,0x8b,0x68,0x00,0x83,0x50,0x21,0x00,0xa2,0x20,0x21,
+0x24,0x02,0x00,0x02,0x00,0x07,0x40,0x27,0x11,0x22,0x00,0x07,0x00,0xc7,0x28,0x24,
+0x8c,0x82,0x00,0x18,0x00,0x00,0x00,0x00,0x00,0x48,0x10,0x24,0x00,0x45,0x10,0x25,
+0x03,0xe0,0x00,0x08,0xac,0x82,0x00,0x18,0x95,0x42,0x00,0x02,0x00,0x00,0x00,0x00,
+0x00,0x48,0x10,0x24,0x00,0x45,0x10,0x25,0x03,0xe0,0x00,0x08,0xa5,0x42,0x00,0x02,
+0x90,0x62,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x4a,0x10,0x24,0x00,0x48,0x10,0x25,
+0x03,0xe0,0x00,0x08,0xa0,0x62,0x00,0x00,0x00,0x04,0x32,0x02,0x30,0xc6,0xff,0x00,
+0x00,0x04,0x16,0x02,0x00,0x04,0x1a,0x00,0x3c,0x05,0x00,0xff,0x00,0x65,0x18,0x24,
+0x00,0x46,0x10,0x25,0x00,0x43,0x10,0x25,0x00,0x04,0x26,0x00,0x03,0xe0,0x00,0x08,
+0x00,0x44,0x10,0x25,0x3c,0x03,0xb0,0x03,0x3c,0x02,0x80,0x00,0x27,0xbd,0xff,0xe8,
+0x34,0x63,0x00,0x20,0x24,0x42,0x14,0xe4,0x3c,0x04,0xb0,0x03,0xaf,0xbf,0x00,0x14,
+0xac,0x62,0x00,0x00,0xaf,0xb0,0x00,0x10,0x34,0x84,0x00,0x2c,0x8c,0x83,0x00,0x00,
+0xa7,0x80,0xbb,0xf0,0x00,0x03,0x12,0x02,0x00,0x03,0x2d,0x02,0x30,0x42,0x0f,0xff,
+0xa3,0x83,0xbb,0xf8,0xa7,0x85,0xbb,0xfc,0xa7,0x82,0xbb,0xfa,0xa7,0x80,0xbb,0xf2,
+0xa7,0x80,0xbb,0xf4,0xa7,0x80,0xbb,0xf6,0x0c,0x00,0x06,0xce,0x24,0x04,0x05,0x00,
+0x3c,0x05,0x08,0x00,0x00,0x45,0x28,0x25,0x24,0x04,0x05,0x00,0x0c,0x00,0x06,0xc1,
+0x00,0x40,0x80,0x21,0x3c,0x02,0xf7,0xff,0x34,0x42,0xff,0xff,0x02,0x02,0x80,0x24,
+0x02,0x00,0x28,0x21,0x0c,0x00,0x06,0xc1,0x24,0x04,0x05,0x00,0x3c,0x02,0xb0,0x03,
+0x3c,0x03,0xb0,0x03,0x34,0x42,0x01,0x08,0x34,0x63,0x01,0x18,0x8c,0x45,0x00,0x00,
+0x8c,0x64,0x00,0x00,0x3c,0x02,0x00,0x0f,0x3c,0x03,0x00,0x4c,0x30,0x84,0x02,0x00,
+0x34,0x63,0x4b,0x40,0xaf,0x85,0xbc,0x00,0x10,0x80,0x00,0x06,0x34,0x42,0x42,0x40,
+0xaf,0x83,0xbc,0x04,0x8f,0xbf,0x00,0x14,0x8f,0xb0,0x00,0x10,0x03,0xe0,0x00,0x08,
+0x27,0xbd,0x00,0x18,0xaf,0x82,0xbc,0x04,0x08,0x00,0x05,0x69,0x00,0x00,0x00,0x00,
+0x3c,0x03,0xb0,0x03,0x3c,0x02,0x80,0x00,0x27,0xbd,0xff,0xc8,0x34,0x63,0x00,0x20,
+0x24,0x42,0x15,0xc0,0x30,0x84,0x00,0xff,0xaf,0xbf,0x00,0x30,0xaf,0xb7,0x00,0x2c,
+0xaf,0xb6,0x00,0x28,0xaf,0xb5,0x00,0x24,0xaf,0xb4,0x00,0x20,0xaf,0xb3,0x00,0x1c,
+0xaf,0xb2,0x00,0x18,0xaf,0xb1,0x00,0x14,0xaf,0xb0,0x00,0x10,0xac,0x62,0x00,0x00,
+0x10,0x80,0x00,0x1c,0x24,0x02,0x00,0x02,0x10,0x82,0x00,0x08,0x00,0x00,0x00,0x00,
+0x8f,0xbf,0x00,0x30,0x7b,0xb6,0x01,0x7c,0x7b,0xb4,0x01,0x3c,0x7b,0xb2,0x00,0xfc,
+0x7b,0xb0,0x00,0xbc,0x03,0xe0,0x00,0x08,0x27,0xbd,0x00,0x38,0xa7,0x80,0xbb,0xf0,
+0xa7,0x80,0xbb,0xf2,0xa7,0x80,0xbb,0xf4,0xa7,0x80,0xbb,0xf6,0x0c,0x00,0x06,0xce,
+0x24,0x04,0x05,0x00,0x3c,0x05,0x08,0x00,0x00,0x45,0x28,0x25,0x24,0x04,0x05,0x00,
+0x0c,0x00,0x06,0xc1,0x00,0x40,0x80,0x21,0x3c,0x05,0xf7,0xff,0x34,0xa5,0xff,0xff,
+0x02,0x05,0x28,0x24,0x0c,0x00,0x06,0xc1,0x24,0x04,0x05,0x00,0x08,0x00,0x05,0x84,
+0x00,0x00,0x00,0x00,0x0c,0x00,0x06,0xce,0x24,0x04,0x05,0xa0,0x24,0x04,0x05,0xa4,
+0x0c,0x00,0x06,0xce,0x00,0x02,0xbc,0x02,0x24,0x04,0x05,0xa8,0x00,0x02,0xb4,0x02,
+0x0c,0x00,0x06,0xce,0x30,0x55,0xff,0xff,0x00,0x40,0x80,0x21,0x97,0x84,0xbb,0xf0,
+0x97,0x82,0xbb,0xf2,0x97,0x83,0xbb,0xf6,0x02,0xe4,0x20,0x23,0x02,0xa2,0x10,0x23,
+0x00,0x82,0x20,0x21,0x97,0x82,0xbb,0xf4,0x32,0x14,0xff,0xff,0x02,0x83,0x18,0x23,
+0x02,0xc2,0x10,0x23,0x00,0x82,0x20,0x21,0x93,0x82,0xbb,0xf8,0x00,0x83,0x20,0x21,
+0x30,0x84,0xff,0xff,0x00,0x82,0x10,0x2b,0x14,0x40,0x00,0xaa,0x00,0x00,0x00,0x00,
+0x97,0x82,0xbb,0xfc,0x00,0x00,0x00,0x00,0x00,0x44,0x10,0x2b,0x14,0x40,0x00,0x7f,
+0x00,0x00,0x00,0x00,0x97,0x82,0xbb,0xfa,0x00,0x00,0x00,0x00,0x00,0x44,0x10,0x2b,
+0x10,0x40,0x00,0x3a,0x00,0x00,0x00,0x00,0x0c,0x00,0x06,0xce,0x24,0x04,0x04,0x50,
+0x30,0x51,0x00,0x7f,0x00,0x40,0x80,0x21,0x2e,0x22,0x00,0x32,0x10,0x40,0x00,0x13,
+0x24,0x02,0x00,0x20,0x12,0x22,0x00,0x17,0x24,0x02,0xff,0x80,0x02,0x02,0x10,0x24,
+0x26,0x31,0x00,0x01,0x00,0x51,0x80,0x25,0x02,0x00,0x28,0x21,0x0c,0x00,0x06,0xc1,
+0x24,0x04,0x04,0x50,0x02,0x00,0x28,0x21,0x0c,0x00,0x06,0xc1,0x24,0x04,0x04,0x58,
+0x02,0x00,0x28,0x21,0x0c,0x00,0x06,0xc1,0x24,0x04,0x04,0x60,0x02,0x00,0x28,0x21,
+0x24,0x04,0x04,0x68,0x0c,0x00,0x06,0xc1,0x00,0x00,0x00,0x00,0xa7,0x97,0xbb,0xf0,
+0xa7,0x95,0xbb,0xf2,0xa7,0x96,0xbb,0xf4,0xa7,0x94,0xbb,0xf6,0x08,0x00,0x05,0x84,
+0x00,0x00,0x00,0x00,0x0c,0x00,0x06,0xce,0x24,0x04,0x02,0x08,0x3c,0x04,0x00,0xc0,
+0x00,0x40,0x28,0x21,0x00,0x44,0x10,0x24,0x00,0x02,0x15,0x82,0x24,0x03,0x00,0x03,
+0x10,0x43,0x00,0x07,0x00,0x00,0x00,0x00,0x3c,0x02,0xff,0x3f,0x34,0x42,0xff,0xff,
+0x00,0xa2,0x10,0x24,0x00,0x44,0x28,0x25,0x0c,0x00,0x06,0xc1,0x24,0x04,0x02,0x08,
+0x0c,0x00,0x06,0xce,0x24,0x04,0x02,0x2c,0x00,0x40,0x90,0x21,0x3c,0x02,0xff,0xff,
+0x34,0x42,0x3f,0xff,0x02,0x42,0x90,0x24,0x02,0x40,0x28,0x21,0x0c,0x00,0x06,0xc1,
+0x24,0x04,0x02,0x2c,0x08,0x00,0x05,0xcb,0x24,0x02,0xff,0x80,0x0c,0x00,0x06,0xce,
+0x24,0x04,0x04,0x50,0x30,0x51,0x00,0x7f,0x24,0x02,0x00,0x20,0x16,0x22,0xff,0xdb,
+0x00,0x00,0x00,0x00,0x0c,0x00,0x06,0xce,0x24,0x04,0x02,0x2c,0x34,0x52,0x40,0x00,
+0x02,0x40,0x28,0x21,0x0c,0x00,0x06,0xc1,0x24,0x04,0x02,0x2c,0x0c,0x00,0x06,0xce,
+0x24,0x04,0x02,0x58,0x24,0x04,0x02,0x5c,0x0c,0x00,0x06,0xce,0x00,0x02,0x9e,0x02,
+0x30,0x43,0x00,0xff,0x00,0x13,0x12,0x00,0x00,0x43,0x10,0x25,0x2c,0x43,0x00,0x04,
+0x14,0x60,0x00,0x1d,0x2c,0x42,0x00,0x11,0x10,0x40,0x00,0x0b,0x00,0x00,0x00,0x00,
+0x3c,0x02,0xff,0xff,0x34,0x42,0x3f,0xff,0x02,0x42,0x90,0x24,0x02,0x40,0x28,0x21,
+0x24,0x04,0x02,0x2c,0x0c,0x00,0x06,0xc1,0x36,0x52,0x80,0x00,0x02,0x40,0x28,0x21,
+0x08,0x00,0x05,0xd9,0x24,0x04,0x02,0x2c,0x0c,0x00,0x06,0xce,0x24,0x04,0x02,0x08,
+0x3c,0x04,0x00,0xc0,0x00,0x40,0x28,0x21,0x00,0x44,0x10,0x24,0x00,0x02,0x15,0x82,
+0x24,0x03,0x00,0x02,0x14,0x43,0xff,0xee,0x3c,0x02,0xff,0x3f,0x34,0x42,0xff,0xff,
+0x00,0xa2,0x10,0x24,0x00,0x44,0x28,0x25,0x0c,0x00,0x06,0xc1,0x24,0x04,0x02,0x08,
+0x08,0x00,0x06,0x15,0x3c,0x02,0xff,0xff,0x0c,0x00,0x06,0xce,0x24,0x04,0x02,0x08,
+0x00,0x40,0x28,0x21,0x00,0x02,0x15,0x82,0x30,0x42,0x00,0x03,0x24,0x03,0x00,0x03,
+0x14,0x43,0xff,0xdf,0x3c,0x02,0xff,0x3f,0x34,0x42,0xff,0xff,0x00,0xa2,0x10,0x24,
+0x3c,0x03,0x00,0x80,0x08,0x00,0x06,0x2a,0x00,0x43,0x28,0x25,0x0c,0x00,0x06,0xce,
+0x24,0x04,0x04,0x50,0x30,0x51,0x00,0x7f,0x00,0x40,0x80,0x21,0x2e,0x22,0x00,0x32,
+0x10,0x40,0xff,0x9a,0x24,0x02,0x00,0x20,0x12,0x22,0x00,0x04,0x24,0x02,0xff,0x80,
+0x02,0x02,0x10,0x24,0x08,0x00,0x05,0xcd,0x26,0x31,0x00,0x02,0x0c,0x00,0x06,0xce,
+0x24,0x04,0x02,0x08,0x3c,0x04,0x00,0xc0,0x00,0x40,0x28,0x21,0x00,0x44,0x10,0x24,
+0x00,0x02,0x15,0x82,0x24,0x03,0x00,0x03,0x10,0x43,0x00,0x07,0x00,0x00,0x00,0x00,
+0x3c,0x02,0xff,0x3f,0x34,0x42,0xff,0xff,0x00,0xa2,0x10,0x24,0x00,0x44,0x28,0x25,
+0x0c,0x00,0x06,0xc1,0x24,0x04,0x02,0x08,0x0c,0x00,0x06,0xce,0x24,0x04,0x02,0x2c,
+0x00,0x40,0x90,0x21,0x3c,0x02,0xff,0xff,0x34,0x42,0x3f,0xff,0x02,0x42,0x90,0x24,
+0x02,0x40,0x28,0x21,0x0c,0x00,0x06,0xc1,0x24,0x04,0x02,0x2c,0x08,0x00,0x06,0x44,
+0x24,0x02,0xff,0x80,0x0c,0x00,0x06,0xce,0x24,0x04,0x04,0x50,0x00,0x40,0x80,0x21,
+0x30,0x51,0x00,0x7f,0x24,0x02,0x00,0x20,0x12,0x22,0x00,0x1d,0x2e,0x22,0x00,0x21,
+0x14,0x40,0xff,0x72,0x24,0x02,0xff,0x80,0x02,0x02,0x10,0x24,0x26,0x31,0xff,0xff,
+0x00,0x51,0x80,0x25,0x24,0x04,0x04,0x50,0x0c,0x00,0x06,0xc1,0x02,0x00,0x28,0x21,
+0x24,0x04,0x04,0x58,0x0c,0x00,0x06,0xc1,0x02,0x00,0x28,0x21,0x24,0x04,0x04,0x60,
+0x0c,0x00,0x06,0xc1,0x02,0x00,0x28,0x21,0x02,0x00,0x28,0x21,0x0c,0x00,0x06,0xc1,
+0x24,0x04,0x04,0x68,0x24,0x02,0x00,0x20,0x16,0x22,0xff,0x60,0x00,0x00,0x00,0x00,
+0x0c,0x00,0x06,0xce,0x24,0x04,0x02,0x2c,0x00,0x40,0x90,0x21,0x3c,0x02,0xff,0xff,
+0x34,0x42,0x3f,0xff,0x02,0x42,0x10,0x24,0x08,0x00,0x06,0x1b,0x34,0x52,0x80,0x00,
+0x0c,0x00,0x06,0xce,0x24,0x04,0x02,0x2c,0x34,0x52,0x40,0x00,0x02,0x40,0x28,0x21,
+0x0c,0x00,0x06,0xc1,0x24,0x04,0x02,0x2c,0x0c,0x00,0x06,0xce,0x24,0x04,0x02,0x58,
+0x24,0x04,0x02,0x5c,0x0c,0x00,0x06,0xce,0x00,0x02,0x9e,0x02,0x30,0x43,0x00,0xff,
+0x00,0x13,0x12,0x00,0x00,0x43,0x10,0x25,0x2c,0x43,0x00,0x04,0x14,0x60,0x00,0x20,
+0x2c,0x42,0x00,0x11,0x10,0x40,0x00,0x0d,0x00,0x00,0x00,0x00,0x3c,0x02,0xff,0xff,
+0x34,0x42,0x3f,0xff,0x02,0x42,0x90,0x24,0x02,0x40,0x28,0x21,0x24,0x04,0x02,0x2c,
+0x0c,0x00,0x06,0xc1,0x36,0x52,0x80,0x00,0x02,0x40,0x28,0x21,0x0c,0x00,0x06,0xc1,
+0x24,0x04,0x02,0x2c,0x08,0x00,0x06,0x68,0x2e,0x22,0x00,0x21,0x0c,0x00,0x06,0xce,
+0x24,0x04,0x02,0x08,0x3c,0x04,0x00,0xc0,0x00,0x40,0x28,0x21,0x00,0x44,0x10,0x24,
+0x00,0x02,0x15,0x82,0x24,0x03,0x00,0x02,0x14,0x43,0xff,0xec,0x00,0x00,0x00,0x00,
+0x3c,0x02,0xff,0x3f,0x34,0x42,0xff,0xff,0x00,0xa2,0x10,0x24,0x00,0x44,0x28,0x25,
+0x0c,0x00,0x06,0xc1,0x24,0x04,0x02,0x08,0x08,0x00,0x06,0x98,0x3c,0x02,0xff,0xff,
+0x0c,0x00,0x06,0xce,0x24,0x04,0x02,0x08,0x00,0x40,0x28,0x21,0x00,0x02,0x15,0x82,
+0x30,0x42,0x00,0x03,0x24,0x03,0x00,0x03,0x14,0x43,0xff,0xdc,0x3c,0x03,0x00,0x80,
+0x3c,0x02,0xff,0x3f,0x34,0x42,0xff,0xff,0x00,0xa2,0x10,0x24,0x08,0x00,0x06,0xb0,
+0x00,0x43,0x28,0x25,0x30,0x83,0x00,0x03,0x00,0x04,0x20,0x40,0x00,0x83,0x20,0x23,
+0x3c,0x02,0xb0,0x0a,0x00,0x82,0x20,0x21,0xac,0x85,0x00,0x00,0x00,0x00,0x18,0x21,
+0x24,0x63,0x00,0x01,0x2c,0x62,0x00,0x0a,0x14,0x40,0xff,0xfe,0x24,0x63,0x00,0x01,
+0x03,0xe0,0x00,0x08,0x24,0x63,0xff,0xff,0x30,0x86,0x00,0x03,0x00,0x04,0x28,0x40,
+0x3c,0x03,0xb0,0x0a,0x00,0xa6,0x10,0x23,0x00,0x43,0x10,0x21,0x24,0x04,0xff,0xff,
+0xac,0x44,0x10,0x00,0x00,0x00,0x18,0x21,0x24,0x63,0x00,0x01,0x2c,0x62,0x00,0x0a,
+0x14,0x40,0xff,0xfe,0x24,0x63,0x00,0x01,0x24,0x63,0xff,0xff,0x00,0xa6,0x18,0x23,
+0x3c,0x02,0xb0,0x0a,0x00,0x62,0x18,0x21,0x8c,0x62,0x00,0x00,0x03,0xe0,0x00,0x08,
+0x00,0x00,0x00,0x00,0x3c,0x05,0xb0,0x03,0x3c,0x02,0x80,0x00,0x24,0x42,0x1b,0x84,
+0x24,0x03,0x00,0x01,0x34,0xa5,0x00,0x20,0x3c,0x06,0xb0,0x03,0xac,0xa2,0x00,0x00,
+0x34,0xc6,0x01,0x04,0xa0,0x83,0x00,0x48,0xa0,0x80,0x00,0x04,0xa0,0x80,0x00,0x05,
+0xa0,0x80,0x00,0x06,0xa0,0x80,0x00,0x07,0xa0,0x80,0x00,0x08,0xa0,0x80,0x00,0x09,
+0xa0,0x80,0x00,0x0a,0xa0,0x80,0x00,0x11,0xa0,0x80,0x00,0x13,0xa0,0x80,0x00,0x49,
+0x94,0xc2,0x00,0x00,0xac,0x80,0x00,0x00,0xa0,0x80,0x00,0x4e,0x00,0x02,0x14,0x00,
+0x00,0x02,0x14,0x03,0x30,0x43,0x00,0xff,0x30,0x42,0xff,0x00,0xa4,0x82,0x00,0x44,
+0xa4,0x83,0x00,0x46,0xac,0x80,0x00,0x24,0xac,0x80,0x00,0x28,0xac,0x80,0x00,0x2c,
+0xac,0x80,0x00,0x30,0xac,0x80,0x00,0x34,0xac,0x80,0x00,0x38,0xac,0x80,0x00,0x3c,
+0x03,0xe0,0x00,0x08,0xac,0x80,0x00,0x40,0x84,0x83,0x00,0x0c,0x3c,0x07,0xb0,0x03,
+0x34,0xe7,0x00,0x20,0x00,0x03,0x10,0xc0,0x00,0x43,0x10,0x21,0x00,0x02,0x10,0x80,
+0x27,0x83,0x8f,0xf4,0x00,0x43,0x10,0x21,0x8c,0x48,0x00,0x18,0x3c,0x02,0x80,0x00,
+0x24,0x42,0x1c,0x18,0xac,0xe2,0x00,0x00,0x8d,0x03,0x00,0x08,0x80,0x82,0x00,0x13,
+0x00,0x05,0x2c,0x00,0x00,0x03,0x1e,0x02,0x00,0x02,0x12,0x00,0x30,0x63,0x00,0x7e,
+0x00,0x62,0x18,0x21,0x00,0x65,0x18,0x21,0x3c,0x02,0xc0,0x00,0x3c,0x05,0xb0,0x05,
+0x34,0x42,0x04,0x00,0x24,0x63,0x00,0x01,0x3c,0x07,0xb0,0x05,0x3c,0x08,0xb0,0x05,
+0x34,0xa5,0x04,0x20,0xac,0xa3,0x00,0x00,0x00,0xc2,0x30,0x21,0x34,0xe7,0x04,0x24,
+0x35,0x08,0x02,0x28,0x24,0x02,0x00,0x01,0x24,0x03,0x00,0x20,0xac,0xe6,0x00,0x00,
+0xac,0x82,0x00,0x3c,0x03,0xe0,0x00,0x08,0xa1,0x03,0x00,0x00,0x27,0xbd,0xff,0xa8,
+0x00,0x07,0x60,0x80,0x27,0x82,0xb3,0xf0,0xaf,0xbe,0x00,0x50,0xaf,0xb7,0x00,0x4c,
+0xaf,0xb5,0x00,0x44,0xaf,0xb4,0x00,0x40,0xaf,0xbf,0x00,0x54,0xaf,0xb6,0x00,0x48,
+0xaf,0xb3,0x00,0x3c,0xaf,0xb2,0x00,0x38,0xaf,0xb1,0x00,0x34,0xaf,0xb0,0x00,0x30,
+0x01,0x82,0x10,0x21,0x8c,0x43,0x00,0x00,0x00,0xe0,0x70,0x21,0x3c,0x02,0x80,0x00,
+0x94,0x73,0x00,0x14,0x3c,0x07,0xb0,0x03,0x34,0xe7,0x00,0x20,0x24,0x42,0x1c,0xac,
+0x3c,0x03,0xb0,0x05,0xac,0xe2,0x00,0x00,0x34,0x63,0x01,0x28,0x90,0x67,0x00,0x00,
+0x00,0x13,0xa8,0xc0,0x02,0xb3,0x18,0x21,0x27,0x82,0x8f,0xf4,0x00,0x03,0x18,0x80,
+0x00,0x62,0x18,0x21,0x00,0x05,0x2c,0x00,0x00,0x07,0x3e,0x00,0x28,0xc2,0x00,0x03,
+0x00,0xc0,0xa0,0x21,0x00,0x80,0x78,0x21,0x00,0x05,0xbc,0x03,0x8c,0x68,0x00,0x18,
+0x02,0xa0,0x58,0x21,0x10,0x40,0x01,0x81,0x00,0x07,0xf6,0x03,0x00,0xde,0x10,0x07,
+0x30,0x5e,0x00,0x01,0x01,0x73,0x10,0x21,0x27,0x83,0x8f,0xf8,0x00,0x02,0x10,0x80,
+0x00,0x43,0x10,0x21,0x80,0x4d,0x00,0x06,0x8d,0x03,0x00,0x00,0x8d,0x02,0x00,0x04,
+0x8d,0x0a,0x00,0x08,0x8d,0x03,0x00,0x0c,0xaf,0xa2,0x00,0x20,0x11,0xa0,0x01,0x71,
+0xaf,0xa3,0x00,0x18,0x27,0x82,0xb3,0xf0,0x01,0x82,0x10,0x21,0x8c,0x44,0x00,0x00,
+0x00,0x00,0x00,0x00,0x90,0x83,0x00,0x16,0x00,0x00,0x00,0x00,0x30,0x63,0x00,0x04,
+0x14,0x60,0x00,0x12,0x00,0x00,0xb0,0x21,0x3c,0x02,0xb0,0x09,0x34,0x42,0x01,0x46,
+0x90,0x43,0x00,0x00,0x2a,0x84,0x00,0x04,0x10,0x80,0x01,0x56,0x30,0x65,0x00,0x01,
+0x91,0xe2,0x00,0x09,0x00,0x00,0x00,0x00,0x12,0x82,0x00,0x02,0x00,0x00,0x00,0x00,
+0x00,0x00,0x28,0x21,0x14,0xa0,0x00,0x03,0x00,0x00,0x38,0x21,0x13,0xc0,0x00,0x03,
+0x38,0xf6,0x00,0x01,0x24,0x07,0x00,0x01,0x38,0xf6,0x00,0x01,0x01,0x73,0x10,0x21,
+0x00,0x02,0x30,0x80,0x27,0x83,0x90,0x00,0x00,0xc3,0x48,0x21,0x91,0x25,0x00,0x00,
+0x8f,0xa4,0x00,0x20,0x2c,0xa3,0x00,0x04,0x00,0x04,0x11,0xc3,0x30,0x42,0x00,0x01,
+0x00,0x03,0xb0,0x0b,0x12,0xc0,0x00,0xd8,0xaf,0xa2,0x00,0x24,0x93,0x90,0xbb,0xda,
+0x00,0x0a,0x16,0x42,0x30,0x52,0x00,0x3f,0x2e,0x06,0x00,0x0c,0x10,0xc0,0x00,0xc0,
+0x00,0xa0,0x20,0x21,0x2c,0xa2,0x00,0x10,0x14,0x40,0x00,0x04,0x00,0x90,0x10,0x2b,
+0x30,0xa2,0x00,0x07,0x24,0x44,0x00,0x04,0x00,0x90,0x10,0x2b,0x10,0x40,0x00,0x0b,
+0x01,0x73,0x10,0x21,0x27,0x85,0xbb,0x0c,0x00,0x10,0x10,0x40,0x00,0x50,0x10,0x21,
+0x00,0x45,0x10,0x21,0x90,0x50,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x90,0x18,0x2b,
+0x14,0x60,0xff,0xfa,0x00,0x10,0x10,0x40,0x01,0x73,0x10,0x21,0x00,0x02,0x10,0x80,
+0x27,0x83,0x8f,0xf8,0x00,0x43,0x10,0x21,0x31,0xa4,0x00,0x01,0x10,0x80,0x00,0xa5,
+0xa0,0x50,0x00,0x07,0x3c,0x04,0xb0,0x05,0x34,0x84,0x00,0x08,0x24,0x02,0x00,0x01,
+0x3c,0x03,0x80,0x00,0xa1,0xe2,0x00,0x4e,0xac,0x83,0x00,0x00,0x8c,0x85,0x00,0x00,
+0x3c,0x02,0x00,0xf0,0x3c,0x03,0x40,0xf0,0x34,0x42,0xf0,0x00,0x34,0x63,0xf0,0x00,
+0x24,0x17,0x00,0x0e,0x24,0x13,0x01,0x06,0xac,0x82,0x00,0x00,0xac,0x83,0x00,0x00,
+0x27,0x82,0xb3,0xf0,0x01,0x82,0x10,0x21,0x8c,0x43,0x00,0x00,0x24,0x05,0x00,0x01,
+0xaf,0xa5,0x00,0x1c,0x90,0x62,0x00,0x16,0x00,0x13,0xa8,0xc0,0x32,0x51,0x00,0x02,
+0x34,0x42,0x00,0x04,0xa0,0x62,0x00,0x16,0x8f,0xa3,0x00,0x20,0x8f,0xa4,0x00,0x18,
+0x00,0x03,0x13,0x43,0x00,0x04,0x1a,0x02,0x30,0x47,0x00,0x01,0x12,0x20,0x00,0x04,
+0x30,0x64,0x07,0xff,0x2e,0x03,0x00,0x04,0x32,0x42,0x00,0x33,0x00,0x43,0x90,0x0b,
+0x8f,0xa5,0x00,0x24,0x8f,0xa6,0x00,0x1c,0x00,0x12,0x10,0x40,0x00,0x05,0x19,0xc0,
+0x00,0x47,0x10,0x21,0x00,0x06,0x2a,0x80,0x00,0x43,0x10,0x21,0x00,0x10,0x32,0x00,
+0x00,0x04,0x24,0x80,0x02,0x65,0x28,0x21,0x00,0xa4,0x28,0x21,0x00,0x46,0x10,0x21,
+0x00,0x17,0x1c,0x00,0x3c,0x04,0xc0,0x00,0x00,0x43,0x30,0x21,0x16,0x80,0x00,0x29,
+0x00,0xa4,0x28,0x21,0x3c,0x02,0xb0,0x05,0x34,0x42,0x04,0x00,0x3c,0x03,0xb0,0x05,
+0x3c,0x04,0xb0,0x05,0xac,0x46,0x00,0x00,0x34,0x63,0x04,0x04,0x34,0x84,0x02,0x28,
+0x24,0x02,0x00,0x01,0xac,0x65,0x00,0x00,0xa0,0x82,0x00,0x00,0x3c,0x02,0xb0,0x09,
+0x34,0x42,0x01,0x46,0x90,0x44,0x00,0x00,0x91,0xe3,0x00,0x09,0x30,0x86,0x00,0x01,
+0x02,0x83,0x18,0x26,0x00,0x03,0x30,0x0b,0x14,0xc0,0x00,0x03,0x00,0x00,0x28,0x21,
+0x13,0xc0,0x00,0x03,0x02,0xb3,0x10,0x21,0x24,0x05,0x00,0x01,0x02,0xb3,0x10,0x21,
+0x27,0x83,0x8f,0xf8,0x00,0x02,0x10,0x80,0x00,0x43,0x10,0x21,0x84,0x48,0x00,0x04,
+0x00,0xa0,0x30,0x21,0x00,0xe0,0x20,0x21,0x02,0x80,0x28,0x21,0x02,0xc0,0x38,0x21,
+0x0c,0x00,0x00,0x72,0xaf,0xa8,0x00,0x10,0x7b,0xbe,0x02,0xbc,0x7b,0xb6,0x02,0x7c,
+0x7b,0xb4,0x02,0x3c,0x7b,0xb2,0x01,0xfc,0x7b,0xb0,0x01,0xbc,0x03,0xe0,0x00,0x08,
+0x27,0xbd,0x00,0x58,0x24,0x02,0x00,0x01,0x12,0x82,0x00,0x3d,0x3c,0x02,0xb0,0x05,
+0x24,0x02,0x00,0x02,0x12,0x82,0x00,0x31,0x3c,0x02,0xb0,0x05,0x24,0x02,0x00,0x03,
+0x12,0x82,0x00,0x25,0x3c,0x02,0xb0,0x05,0x24,0x02,0x00,0x10,0x12,0x82,0x00,0x19,
+0x3c,0x02,0xb0,0x05,0x24,0x02,0x00,0x11,0x12,0x82,0x00,0x0d,0x3c,0x02,0xb0,0x05,
+0x24,0x02,0x00,0x12,0x16,0x82,0xff,0xd1,0x3c,0x02,0xb0,0x05,0x3c,0x03,0xb0,0x05,
+0x34,0x42,0x04,0x20,0x3c,0x04,0xb0,0x05,0x34,0x63,0x04,0x24,0xac,0x46,0x00,0x00,
+0x34,0x84,0x02,0x28,0xac,0x65,0x00,0x00,0x08,0x00,0x07,0xe2,0x24,0x02,0x00,0x20,
+0x34,0x42,0x04,0x40,0x3c,0x03,0xb0,0x05,0x3c,0x04,0xb0,0x05,0xac,0x46,0x00,0x00,
+0x34,0x63,0x04,0x44,0x34,0x84,0x02,0x28,0x24,0x02,0x00,0x40,0x08,0x00,0x07,0xe2,
+0xac,0x65,0x00,0x00,0x34,0x42,0x04,0x28,0x3c,0x03,0xb0,0x05,0x3c,0x04,0xb0,0x05,
+0xac,0x46,0x00,0x00,0x34,0x63,0x04,0x2c,0x34,0x84,0x02,0x28,0x24,0x02,0xff,0x80,
+0x08,0x00,0x07,0xe2,0xac,0x65,0x00,0x00,0x34,0x42,0x04,0x18,0x3c,0x03,0xb0,0x05,
+0x3c,0x04,0xb0,0x05,0xac,0x46,0x00,0x00,0x34,0x63,0x04,0x1c,0x34,0x84,0x02,0x28,
+0x24,0x02,0x00,0x08,0x08,0x00,0x07,0xe2,0xac,0x65,0x00,0x00,0x34,0x42,0x04,0x10,
+0x3c,0x03,0xb0,0x05,0x3c,0x04,0xb0,0x05,0xac,0x46,0x00,0x00,0x34,0x63,0x04,0x14,
+0x34,0x84,0x02,0x28,0x24,0x02,0x00,0x04,0x08,0x00,0x07,0xe2,0xac,0x65,0x00,0x00,
+0x34,0x42,0x04,0x08,0x3c,0x03,0xb0,0x05,0x3c,0x04,0xb0,0x05,0xac,0x46,0x00,0x00,
+0x34,0x63,0x04,0x0c,0x34,0x84,0x02,0x28,0x24,0x02,0x00,0x02,0x08,0x00,0x07,0xe2,
+0xac,0x65,0x00,0x00,0x24,0x17,0x00,0x14,0x08,0x00,0x07,0xb4,0x24,0x13,0x01,0x02,
+0x30,0xa2,0x00,0x07,0x24,0x44,0x00,0x0c,0x00,0x90,0x18,0x2b,0x10,0x60,0x00,0x0c,
+0x26,0x02,0x00,0x04,0x27,0x85,0xbb,0x0c,0x00,0x10,0x10,0x40,0x00,0x50,0x10,0x21,
+0x00,0x45,0x10,0x21,0x90,0x50,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x90,0x18,0x2b,
+0x14,0x60,0xff,0xfa,0x00,0x10,0x10,0x40,0x2e,0x06,0x00,0x0c,0x26,0x02,0x00,0x04,
+0x08,0x00,0x07,0x9e,0x00,0x46,0x80,0x0a,0x27,0x82,0xb3,0xf0,0x01,0x82,0x20,0x21,
+0x8c,0x87,0x00,0x00,0x00,0x00,0x00,0x00,0x90,0xe2,0x00,0x19,0x00,0x00,0x00,0x00,
+0x14,0x40,0x00,0x07,0x00,0x00,0x00,0x00,0x27,0x82,0x90,0x10,0x00,0xc2,0x10,0x21,
+0x90,0x43,0x00,0x00,0x00,0x00,0x00,0x00,0x10,0x60,0x00,0x14,0x00,0x00,0x00,0x00,
+0x90,0xe3,0x00,0x16,0x27,0x82,0x8f,0xf8,0x00,0xc2,0x10,0x21,0x34,0x63,0x00,0x20,
+0x90,0x50,0x00,0x07,0xa0,0xe3,0x00,0x16,0x8c,0x84,0x00,0x00,0x00,0x0a,0x1e,0x42,
+0x24,0x06,0x00,0x01,0x90,0x82,0x00,0x16,0x30,0x71,0x00,0x02,0x30,0x72,0x00,0x3f,
+0x30,0x42,0x00,0xfb,0x24,0x17,0x00,0x18,0x24,0x13,0x01,0x03,0x24,0x15,0x08,0x18,
+0xaf,0xa6,0x00,0x1c,0x08,0x00,0x07,0xbe,0xa0,0x82,0x00,0x16,0x8d,0x02,0x00,0x04,
+0x00,0x0a,0x1c,0x42,0x30,0x42,0x00,0x10,0x14,0x40,0x00,0x15,0x30,0x72,0x00,0x3f,
+0x81,0x22,0x00,0x05,0x00,0x00,0x00,0x00,0x14,0x40,0x00,0x11,0x30,0x72,0x00,0x3e,
+0x27,0x83,0x90,0x08,0x00,0xc3,0x18,0x21,0x80,0x64,0x00,0x00,0x27,0x83,0xb5,0x68,
+0x00,0x04,0x11,0x00,0x00,0x44,0x10,0x23,0x00,0x02,0x10,0x80,0x00,0x44,0x10,0x23,
+0x00,0x02,0x10,0x80,0x00,0x43,0x10,0x21,0x90,0x44,0x00,0x05,0x90,0x43,0x00,0x04,
+0x00,0x00,0x00,0x00,0x00,0x64,0x18,0x24,0x30,0x63,0x00,0x01,0x02,0x43,0x90,0x25,
+0x27,0x85,0xb3,0xf0,0x01,0x85,0x28,0x21,0x8c,0xa6,0x00,0x00,0x01,0x73,0x10,0x21,
+0x27,0x83,0x90,0x00,0x90,0xc4,0x00,0x16,0x00,0x02,0x10,0x80,0x00,0x43,0x10,0x21,
+0x30,0x84,0x00,0xdf,0x90,0x50,0x00,0x00,0xa0,0xc4,0x00,0x16,0x80,0xc6,0x00,0x12,
+0x8c,0xa3,0x00,0x00,0x2d,0xc4,0x00,0x02,0xaf,0xa6,0x00,0x1c,0x90,0x62,0x00,0x16,
+0x00,0x00,0x00,0x00,0x30,0x42,0x00,0xfb,0x14,0x80,0x00,0x06,0xa0,0x62,0x00,0x16,
+0x24,0x02,0x00,0x06,0x11,0xc2,0x00,0x03,0x24,0x02,0x00,0x04,0x15,0xc2,0xff,0x0e,
+0x32,0x51,0x00,0x02,0x32,0x51,0x00,0x02,0x2e,0x02,0x00,0x0c,0x14,0x40,0x00,0x0f,
+0x00,0x11,0x18,0x2b,0x32,0x02,0x00,0x0f,0x34,0x42,0x00,0x10,0x00,0x03,0x19,0x00,
+0x00,0x43,0x18,0x21,0x3c,0x02,0xb0,0x03,0x34,0x42,0x00,0xb8,0xa0,0x43,0x00,0x00,
+0x00,0x00,0x20,0x21,0x02,0x00,0x28,0x21,0x0c,0x00,0x02,0x05,0xaf,0xaf,0x00,0x28,
+0x8f,0xaf,0x00,0x28,0x08,0x00,0x07,0xbe,0x00,0x00,0x00,0x00,0x08,0x00,0x08,0xb9,
+0x32,0x03,0x00,0xff,0x3c,0x03,0xb0,0x05,0x34,0x63,0x02,0x42,0x90,0x62,0x00,0x00,
+0x00,0x00,0x00,0x00,0x30,0x42,0x00,0x0f,0x14,0x40,0xfe,0xaa,0x00,0x00,0x00,0x00,
+0x91,0xe2,0x00,0x09,0x00,0x00,0x00,0x00,0x02,0x82,0x10,0x26,0x08,0x00,0x07,0x75,
+0x00,0x02,0x28,0x0b,0x08,0x00,0x07,0x7b,0x00,0x00,0xb0,0x21,0x24,0x02,0x00,0x10,
+0x10,0xc2,0x00,0x08,0x24,0x02,0x00,0x11,0x10,0xc2,0xfe,0x7d,0x00,0x07,0x17,0x83,
+0x24,0x02,0x00,0x12,0x14,0xc2,0xfe,0x7b,0x00,0x07,0x17,0x43,0x08,0x00,0x07,0x55,
+0x30,0x5e,0x00,0x01,0x08,0x00,0x07,0x55,0x00,0x07,0xf7,0xc2,0x00,0x04,0x10,0x40,
+0x27,0x83,0x80,0x1c,0x00,0x43,0x10,0x21,0x00,0x80,0x40,0x21,0x94,0x44,0x00,0x00,
+0x2d,0x07,0x00,0x04,0x24,0xc2,0x00,0x03,0x00,0x47,0x30,0x0a,0x00,0x86,0x00,0x18,
+0x3c,0x03,0xb0,0x03,0x3c,0x02,0x80,0x00,0x34,0x63,0x00,0x20,0x24,0x42,0x23,0x7c,
+0xac,0x62,0x00,0x00,0x2d,0x06,0x00,0x10,0x00,0x00,0x20,0x12,0x00,0x04,0x22,0x42,
+0x24,0x84,0x00,0x01,0x24,0x83,0x00,0xc0,0x10,0xe0,0x00,0x0b,0x24,0x82,0x00,0x60,
+0x00,0x40,0x20,0x21,0x00,0x65,0x20,0x0a,0x3c,0x03,0xb0,0x03,0x34,0x63,0x01,0x00,
+0x90,0x62,0x00,0x00,0x00,0x00,0x00,0x00,0x30,0x42,0x00,0x01,0x00,0x44,0x20,0x04,
+0x03,0xe0,0x00,0x08,0x00,0x80,0x10,0x21,0x24,0x85,0x00,0x28,0x24,0x83,0x00,0x24,
+0x31,0x02,0x00,0x08,0x14,0xc0,0xff,0xf4,0x24,0x84,0x00,0x14,0x00,0x60,0x20,0x21,
+0x08,0x00,0x08,0xf6,0x00,0xa2,0x20,0x0b,0x27,0xbd,0xff,0xe0,0x3c,0x03,0xb0,0x03,
+0x3c,0x02,0x80,0x00,0xaf,0xb0,0x00,0x10,0x24,0x42,0x24,0x18,0x00,0x80,0x80,0x21,
+0x34,0x63,0x00,0x20,0x3c,0x04,0xb0,0x03,0xaf,0xb2,0x00,0x18,0xaf,0xb1,0x00,0x14,
+0xaf,0xbf,0x00,0x1c,0x83,0xb1,0x00,0x33,0x83,0xa8,0x00,0x37,0x34,0x84,0x01,0x10,
+0xac,0x62,0x00,0x00,0x2e,0x02,0x00,0x10,0x00,0xe0,0x90,0x21,0x8c,0x87,0x00,0x00,
+0x14,0x40,0x00,0x0c,0x2e,0x02,0x00,0x0c,0x3c,0x02,0x00,0x0f,0x34,0x42,0xf0,0x00,
+0x00,0xe2,0x10,0x24,0x14,0x40,0x00,0x37,0x32,0x02,0x00,0x08,0x32,0x02,0x00,0x07,
+0x27,0x83,0x80,0xcc,0x00,0x43,0x10,0x21,0x90,0x50,0x00,0x00,0x00,0x00,0x00,0x00,
+0x2e,0x02,0x00,0x0c,0x14,0x40,0x00,0x03,0x02,0x00,0x20,0x21,0x32,0x02,0x00,0x0f,
+0x24,0x44,0x00,0x0c,0x00,0x87,0x10,0x06,0x30,0x42,0x00,0x01,0x14,0x40,0x00,0x07,
+0x2c,0x82,0x00,0x0c,0x00,0x04,0x10,0x80,0x27,0x83,0xb4,0x40,0x00,0x43,0x10,0x21,
+0x8c,0x44,0x00,0x00,0x00,0x00,0x00,0x00,0x2c,0x82,0x00,0x0c,0x14,0x40,0x00,0x05,
+0x00,0x05,0x10,0x40,0x00,0x46,0x10,0x21,0x00,0x02,0x11,0x00,0x00,0x82,0x10,0x21,
+0x24,0x44,0x00,0x04,0x15,0x00,0x00,0x02,0x24,0x06,0x00,0x20,0x24,0x06,0x00,0x0e,
+0x0c,0x00,0x08,0xdf,0x00,0x00,0x00,0x00,0x00,0x40,0x30,0x21,0x3c,0x02,0xb0,0x03,
+0x34,0x42,0x01,0x00,0x90,0x43,0x00,0x00,0x2e,0x04,0x00,0x04,0x24,0x02,0x00,0x10,
+0x24,0x05,0x00,0x0a,0x00,0x44,0x28,0x0a,0x30,0x63,0x00,0x01,0x14,0x60,0x00,0x02,
+0x00,0x05,0x10,0x40,0x00,0xa0,0x10,0x21,0x30,0x45,0x00,0xff,0x00,0xc5,0x10,0x21,
+0x24,0x46,0x00,0x46,0x02,0x26,0x18,0x04,0xa6,0x43,0x00,0x00,0x8f,0xbf,0x00,0x1c,
+0x8f,0xb2,0x00,0x18,0x7b,0xb0,0x00,0xbc,0x00,0xc0,0x10,0x21,0x03,0xe0,0x00,0x08,
+0x27,0xbd,0x00,0x20,0x10,0x40,0xff,0xcf,0x2e,0x02,0x00,0x0c,0x32,0x02,0x00,0x07,
+0x27,0x83,0x80,0xc4,0x00,0x43,0x10,0x21,0x90,0x44,0x00,0x00,0x08,0x00,0x09,0x24,
+0x02,0x04,0x80,0x23,0x27,0xbd,0xff,0xb8,0x00,0x05,0x38,0x80,0x27,0x82,0xb3,0xf0,
+0xaf,0xbe,0x00,0x40,0xaf,0xb6,0x00,0x38,0xaf,0xb3,0x00,0x2c,0xaf,0xbf,0x00,0x44,
+0xaf,0xb7,0x00,0x3c,0xaf,0xb5,0x00,0x34,0xaf,0xb4,0x00,0x30,0xaf,0xb2,0x00,0x28,
+0xaf,0xb1,0x00,0x24,0xaf,0xb0,0x00,0x20,0x00,0xe2,0x38,0x21,0x8c,0xe6,0x00,0x00,
+0xaf,0xa5,0x00,0x4c,0x3c,0x02,0x80,0x00,0x3c,0x05,0xb0,0x03,0x34,0xa5,0x00,0x20,
+0x24,0x42,0x25,0x74,0x24,0x03,0x00,0x01,0xac,0xa2,0x00,0x00,0xa0,0xc3,0x00,0x12,
+0x8c,0xe5,0x00,0x00,0x94,0xc3,0x00,0x06,0x90,0xa2,0x00,0x16,0xa4,0xc3,0x00,0x14,
+0x27,0x83,0x8f,0xf0,0x34,0x42,0x00,0x08,0xa0,0xa2,0x00,0x16,0x8c,0xe8,0x00,0x00,
+0xaf,0xa4,0x00,0x48,0x27,0x82,0x8f,0xf4,0x95,0x11,0x00,0x14,0x00,0x00,0x00,0x00,
+0x00,0x11,0x98,0xc0,0x02,0x71,0x20,0x21,0x00,0x04,0x20,0x80,0x00,0x82,0x10,0x21,
+0x8c,0x52,0x00,0x18,0x00,0x83,0x18,0x21,0x84,0x75,0x00,0x06,0x8e,0x45,0x00,0x08,
+0x8e,0x46,0x00,0x04,0x8e,0x47,0x00,0x04,0x00,0x05,0x1c,0x82,0x00,0x06,0x31,0x42,
+0x27,0x82,0x90,0x00,0x30,0x63,0x00,0x01,0x30,0xc6,0x00,0x01,0x00,0x82,0x20,0x21,
+0xa5,0x15,0x00,0x1a,0x00,0x05,0x14,0x42,0xaf,0xa3,0x00,0x18,0xaf,0xa6,0x00,0x1c,
+0x30,0xe7,0x00,0x10,0x30,0x56,0x00,0x01,0x80,0x97,0x00,0x06,0x14,0xe0,0x00,0x47,
+0x00,0x05,0xf7,0xc2,0x80,0x82,0x00,0x05,0x00,0x00,0x00,0x00,0x14,0x40,0x00,0x44,
+0x02,0x71,0x10,0x21,0x93,0x90,0xbb,0xd9,0x00,0x00,0x00,0x00,0x2e,0x02,0x00,0x0c,
+0x14,0x40,0x00,0x06,0x02,0x00,0x20,0x21,0x00,0x16,0x10,0x40,0x00,0x43,0x10,0x21,
+0x00,0x02,0x11,0x00,0x02,0x02,0x10,0x21,0x24,0x44,0x00,0x04,0x02,0x71,0x10,0x21,
+0x00,0x02,0x10,0x80,0x27,0x83,0x90,0x00,0x00,0x43,0x10,0x21,0x00,0x80,0x80,0x21,
+0xa0,0x44,0x00,0x03,0xa0,0x44,0x00,0x00,0x02,0x00,0x20,0x21,0x02,0xc0,0x28,0x21,
+0x0c,0x00,0x08,0xdf,0x02,0xa0,0x30,0x21,0x02,0x71,0x18,0x21,0x00,0x03,0x88,0x80,
+0x00,0x40,0xa0,0x21,0x27,0x82,0x90,0x10,0x02,0x22,0x10,0x21,0x8c,0x44,0x00,0x00,
+0x26,0xe3,0x00,0x02,0x00,0x03,0x17,0xc2,0x00,0x62,0x18,0x21,0x00,0x04,0x25,0xc2,
+0x00,0x03,0x18,0x43,0x30,0x84,0x00,0x01,0x00,0x03,0x18,0x40,0x03,0xc4,0x20,0x24,
+0x14,0x80,0x00,0x15,0x02,0x43,0x38,0x21,0x3c,0x08,0xb0,0x03,0x35,0x08,0x00,0x28,
+0x8d,0x03,0x00,0x00,0x8f,0xa6,0x00,0x4c,0x8f,0xa4,0x00,0x48,0x27,0x82,0x8f,0xf8,
+0x02,0x22,0x10,0x21,0x24,0x63,0x00,0x01,0x02,0xa0,0x28,0x21,0xa4,0x54,0x00,0x04,
+0x00,0xc0,0x38,0x21,0x0c,0x00,0x07,0x2b,0xad,0x03,0x00,0x00,0x7b,0xbe,0x02,0x3c,
+0x7b,0xb6,0x01,0xfc,0x7b,0xb4,0x01,0xbc,0x7b,0xb2,0x01,0x7c,0x7b,0xb0,0x01,0x3c,
+0x03,0xe0,0x00,0x08,0x27,0xbd,0x00,0x48,0x8f,0xa2,0x00,0x1c,0x8f,0xa6,0x00,0x18,
+0x02,0x00,0x20,0x21,0x02,0xc0,0x28,0x21,0xaf,0xa2,0x00,0x10,0x0c,0x00,0x09,0x06,
+0xaf,0xa0,0x00,0x14,0x08,0x00,0x09,0xc2,0x02,0x82,0xa0,0x21,0x02,0x71,0x10,0x21,
+0x00,0x02,0x10,0x80,0x27,0x83,0x90,0x00,0x00,0x43,0x10,0x21,0x90,0x50,0x00,0x00,
+0x08,0x00,0x09,0xae,0xa0,0x50,0x00,0x03,0x27,0xbd,0xff,0xb8,0xaf,0xb1,0x00,0x24,
+0x8f,0xb1,0x00,0x5c,0x3c,0x03,0xb0,0x03,0x3c,0x02,0x80,0x00,0x34,0x63,0x00,0x20,
+0x24,0x42,0x27,0x98,0xaf,0xbe,0x00,0x40,0xaf,0xb7,0x00,0x3c,0xaf,0xb6,0x00,0x38,
+0xaf,0xb5,0x00,0x34,0xaf,0xb4,0x00,0x30,0xaf,0xa5,0x00,0x4c,0x8f,0xb5,0x00,0x58,
+0xaf,0xbf,0x00,0x44,0xaf,0xb3,0x00,0x2c,0xaf,0xb2,0x00,0x28,0xaf,0xb0,0x00,0x20,
+0x00,0xe0,0xb0,0x21,0xac,0x62,0x00,0x00,0x00,0x80,0xf0,0x21,0x00,0x00,0xb8,0x21,
+0x16,0x20,0x00,0x2b,0x00,0x00,0xa0,0x21,0x27,0x85,0xb3,0xf0,0x00,0x07,0x10,0x80,
+0x00,0x45,0x10,0x21,0x8c,0x53,0x00,0x00,0x00,0x15,0x18,0x80,0x00,0x65,0x18,0x21,
+0x92,0x62,0x00,0x16,0x8c,0x72,0x00,0x00,0x30,0x42,0x00,0x03,0x14,0x40,0x00,0x2d,
+0x00,0x00,0x00,0x00,0x92,0x42,0x00,0x16,0x00,0x00,0x00,0x00,0x30,0x42,0x00,0x03,
+0x14,0x40,0x00,0x28,0x00,0x00,0x00,0x00,0x8c,0x82,0x00,0x34,0x00,0x00,0x00,0x00,
+0x14,0x40,0x00,0x18,0x02,0x20,0x10,0x21,0x8c,0x82,0x00,0x38,0x00,0x00,0x00,0x00,
+0x14,0x40,0x00,0x14,0x02,0x20,0x10,0x21,0x8c,0x82,0x00,0x3c,0x00,0x00,0x00,0x00,
+0x14,0x40,0x00,0x0f,0x3c,0x03,0xb0,0x09,0x3c,0x05,0xb0,0x05,0x34,0x63,0x01,0x44,
+0x34,0xa5,0x02,0x52,0x94,0x66,0x00,0x00,0x90,0xa2,0x00,0x00,0x8f,0xa3,0x00,0x4c,
+0x00,0x00,0x00,0x00,0x00,0x62,0x10,0x06,0x30,0x42,0x00,0x01,0x10,0x40,0x00,0x04,
+0x30,0xc6,0xff,0xff,0x2c,0xc2,0x00,0x41,0x10,0x40,0x00,0x09,0x24,0x05,0x00,0x14,
+0x02,0x20,0x10,0x21,0x7b,0xbe,0x02,0x3c,0x7b,0xb6,0x01,0xfc,0x7b,0xb4,0x01,0xbc,
+0x7b,0xb2,0x01,0x7c,0x7b,0xb0,0x01,0x3c,0x03,0xe0,0x00,0x08,0x27,0xbd,0x00,0x48,
+0x0c,0x00,0x07,0x06,0x24,0x06,0x01,0x07,0x24,0x02,0x00,0x01,0x08,0x00,0x0a,0x28,
+0xa3,0xc2,0x00,0x11,0x10,0xc0,0x00,0x1c,0x24,0x02,0x00,0x01,0x10,0xc2,0x00,0x17,
+0x00,0xc0,0x88,0x21,0x96,0x54,0x00,0x1a,0x02,0xa0,0xb8,0x21,0x12,0x20,0xff,0xed,
+0x02,0x20,0x10,0x21,0x27,0x83,0xb3,0xf0,0x00,0x17,0x10,0x80,0x00,0x43,0x10,0x21,
+0x8c,0x44,0x00,0x00,0x3c,0x03,0xb0,0x03,0x34,0x63,0x00,0x28,0x80,0x86,0x00,0x12,
+0x8c,0x62,0x00,0x00,0x00,0x14,0x2c,0x00,0x00,0x05,0x2c,0x03,0x00,0x46,0x10,0x21,
+0x8f,0xa6,0x00,0x4c,0x02,0xe0,0x38,0x21,0x03,0xc0,0x20,0x21,0x0c,0x00,0x07,0x2b,
+0xac,0x62,0x00,0x00,0x08,0x00,0x0a,0x28,0xaf,0xd1,0x00,0x40,0x96,0x74,0x00,0x1a,
+0x08,0x00,0x0a,0x3b,0x02,0xc0,0xb8,0x21,0x3c,0x02,0xb0,0x03,0x34,0x42,0x01,0x08,
+0x8c,0x50,0x00,0x00,0x02,0x60,0x20,0x21,0x0c,0x00,0x1f,0x11,0x02,0x00,0x28,0x21,
+0x30,0x42,0x00,0xff,0x02,0x00,0x28,0x21,0x02,0x40,0x20,0x21,0x0c,0x00,0x1f,0x11,
+0xaf,0xa2,0x00,0x18,0x8f,0xa4,0x00,0x18,0x00,0x00,0x00,0x00,0x10,0x80,0x00,0xed,
+0x30,0x50,0x00,0xff,0x12,0x00,0x00,0x18,0x24,0x11,0x00,0x01,0x96,0x63,0x00,0x14,
+0x96,0x44,0x00,0x14,0x27,0x85,0x8f,0xf0,0x00,0x03,0x10,0xc0,0x00,0x43,0x10,0x21,
+0x00,0x02,0x10,0x80,0x00,0x45,0x10,0x21,0x00,0x04,0x18,0xc0,0x8c,0x46,0x00,0x08,
+0x00,0x64,0x18,0x21,0x00,0x03,0x18,0x80,0x00,0x65,0x18,0x21,0x00,0x06,0x17,0x02,
+0x24,0x04,0x00,0xff,0x8c,0x63,0x00,0x08,0x10,0x44,0x00,0xd6,0x00,0x03,0x17,0x02,
+0x10,0x44,0x00,0xd5,0x3c,0x02,0x80,0x00,0x00,0x66,0x18,0x2b,0x24,0x11,0x00,0x02,
+0x24,0x02,0x00,0x01,0x00,0x43,0x88,0x0a,0x24,0x02,0x00,0x01,0x12,0x22,0x00,0x5a,
+0x24,0x02,0x00,0x02,0x16,0x22,0xff,0xbd,0x00,0x00,0x00,0x00,0x96,0x49,0x00,0x14,
+0x27,0x82,0x8f,0xf4,0x02,0xa0,0xb8,0x21,0x00,0x09,0x50,0xc0,0x01,0x49,0x18,0x21,
+0x00,0x03,0x40,0x80,0x01,0x02,0x10,0x21,0x8c,0x43,0x00,0x18,0x00,0x00,0x00,0x00,
+0x8c,0x65,0x00,0x08,0x8c,0x62,0x00,0x0c,0x8c,0x62,0x00,0x04,0x00,0x05,0x24,0x42,
+0x00,0x05,0x1c,0x82,0x30,0x42,0x00,0x10,0x30,0x66,0x00,0x01,0x14,0x40,0x00,0x41,
+0x30,0x87,0x00,0x01,0x27,0x82,0x90,0x08,0x01,0x02,0x10,0x21,0x80,0x44,0x00,0x00,
+0x27,0x82,0xb5,0x68,0x00,0x04,0x19,0x00,0x00,0x64,0x18,0x23,0x00,0x03,0x18,0x80,
+0x00,0x64,0x18,0x23,0x00,0x03,0x18,0x80,0x00,0x62,0x10,0x21,0x90,0x45,0x00,0x05,
+0x27,0x84,0xb4,0x90,0x00,0x64,0x18,0x21,0x90,0x63,0x00,0x00,0x10,0xa0,0x00,0x2b,
+0x2c,0x64,0x00,0x0c,0x14,0x80,0x00,0x04,0x00,0x60,0x10,0x21,0x00,0x06,0x11,0x00,
+0x00,0x62,0x10,0x21,0x24,0x42,0x00,0x24,0x3c,0x01,0xb0,0x03,0xa0,0x22,0x00,0xb9,
+0x14,0x80,0x00,0x06,0x00,0x60,0x28,0x21,0x00,0x07,0x10,0x40,0x00,0x46,0x10,0x21,
+0x00,0x02,0x11,0x00,0x00,0x62,0x10,0x21,0x24,0x45,0x00,0x04,0x01,0x49,0x10,0x21,
+0x27,0x83,0x90,0x00,0x00,0x02,0x10,0x80,0x00,0x43,0x10,0x21,0x00,0xa0,0x18,0x21,
+0xa0,0x45,0x00,0x03,0xa0,0x45,0x00,0x00,0x24,0x02,0x00,0x08,0x12,0x02,0x00,0x0b,
+0x24,0x02,0x00,0x01,0x00,0x60,0x28,0x21,0x02,0x40,0x20,0x21,0x0c,0x00,0x1f,0x8d,
+0xaf,0xa2,0x00,0x10,0x30,0x54,0xff,0xff,0x92,0x42,0x00,0x16,0x00,0x00,0x00,0x00,
+0x02,0x02,0x10,0x25,0x08,0x00,0x0a,0x3b,0xa2,0x42,0x00,0x16,0x00,0x60,0x28,0x21,
+0x02,0x40,0x20,0x21,0x0c,0x00,0x1f,0x3e,0xaf,0xa0,0x00,0x10,0x08,0x00,0x0a,0xbe,
+0x30,0x54,0xff,0xff,0x08,0x00,0x0a,0xa6,0x00,0x60,0x10,0x21,0x14,0x80,0xff,0xfd,
+0x00,0x00,0x00,0x00,0x00,0x06,0x11,0x00,0x00,0x62,0x10,0x21,0x08,0x00,0x0a,0xa6,
+0x24,0x42,0x00,0x04,0x27,0x82,0x90,0x00,0x01,0x02,0x10,0x21,0x90,0x43,0x00,0x00,
+0x08,0x00,0x0a,0xb6,0xa0,0x43,0x00,0x03,0x96,0x69,0x00,0x14,0x02,0xc0,0xb8,0x21,
+0x24,0x0b,0x00,0x01,0x00,0x09,0x10,0xc0,0x00,0x49,0x18,0x21,0x00,0x03,0x40,0x80,
+0x00,0x40,0x50,0x21,0x27,0x82,0x8f,0xf4,0x01,0x02,0x10,0x21,0x8c,0x43,0x00,0x18,
+0x00,0x00,0x00,0x00,0x8c,0x65,0x00,0x08,0x8c,0x62,0x00,0x0c,0x8c,0x62,0x00,0x04,
+0x00,0x05,0x24,0x42,0x00,0x05,0x1c,0x82,0x30,0x42,0x00,0x10,0x30,0x66,0x00,0x01,
+0x10,0x40,0x00,0x0d,0x30,0x87,0x00,0x01,0x27,0x82,0x90,0x08,0x01,0x02,0x10,0x21,
+0x80,0x43,0x00,0x00,0x00,0x00,0x58,0x21,0x00,0x03,0x11,0x00,0x00,0x43,0x10,0x23,
+0x00,0x02,0x10,0x80,0x00,0x43,0x10,0x23,0x00,0x02,0x10,0x80,0x27,0x83,0xb5,0x60,
+0x00,0x43,0x10,0x21,0xa0,0x40,0x00,0x04,0x11,0x60,0x00,0x4f,0x00,0x00,0x00,0x00,
+0x01,0x49,0x10,0x21,0x00,0x02,0x20,0x80,0x27,0x85,0x90,0x00,0x00,0x85,0x10,0x21,
+0x80,0x43,0x00,0x05,0x00,0x00,0x00,0x00,0x14,0x60,0x00,0x42,0x01,0x49,0x10,0x21,
+0x27,0x82,0x90,0x08,0x00,0x82,0x10,0x21,0x80,0x44,0x00,0x00,0x27,0x82,0xb5,0x68,
+0x00,0x04,0x19,0x00,0x00,0x64,0x18,0x23,0x00,0x03,0x18,0x80,0x00,0x64,0x18,0x23,
+0x00,0x03,0x18,0x80,0x00,0x62,0x10,0x21,0x90,0x45,0x00,0x05,0x27,0x84,0xb4,0x90,
+0x00,0x64,0x18,0x21,0x90,0x63,0x00,0x00,0x10,0xa0,0x00,0x2c,0x2c,0x64,0x00,0x0c,
+0x14,0x80,0x00,0x04,0x00,0x60,0x10,0x21,0x00,0x06,0x11,0x00,0x00,0x62,0x10,0x21,
+0x24,0x42,0x00,0x24,0x3c,0x01,0xb0,0x03,0xa0,0x22,0x00,0xb9,0x14,0x80,0x00,0x06,
+0x00,0x60,0x28,0x21,0x00,0x07,0x10,0x40,0x00,0x46,0x10,0x21,0x00,0x02,0x11,0x00,
+0x00,0x62,0x10,0x21,0x24,0x45,0x00,0x04,0x01,0x49,0x10,0x21,0x27,0x83,0x90,0x00,
+0x00,0x02,0x10,0x80,0x00,0x43,0x10,0x21,0x00,0xa0,0x18,0x21,0xa0,0x45,0x00,0x03,
+0xa0,0x45,0x00,0x00,0x8f,0xa4,0x00,0x18,0x24,0x02,0x00,0x08,0x10,0x82,0x00,0x0c,
+0x00,0x60,0x28,0x21,0x24,0x02,0x00,0x01,0x02,0x60,0x20,0x21,0x0c,0x00,0x1f,0x8d,
+0xaf,0xa2,0x00,0x10,0x8f,0xa3,0x00,0x18,0x30,0x54,0xff,0xff,0x92,0x62,0x00,0x16,
+0x00,0x00,0x00,0x00,0x00,0x62,0x10,0x25,0x08,0x00,0x0a,0x3b,0xa2,0x62,0x00,0x16,
+0x02,0x60,0x20,0x21,0x0c,0x00,0x1f,0x3e,0xaf,0xa0,0x00,0x10,0x08,0x00,0x0b,0x2d,
+0x00,0x00,0x00,0x00,0x08,0x00,0x0b,0x15,0x00,0x60,0x10,0x21,0x14,0x80,0xff,0xfd,
+0x00,0x00,0x00,0x00,0x00,0x06,0x11,0x00,0x00,0x62,0x10,0x21,0x08,0x00,0x0b,0x15,
+0x24,0x42,0x00,0x04,0x00,0x02,0x10,0x80,0x00,0x45,0x10,0x21,0x90,0x43,0x00,0x00,
+0x08,0x00,0x0b,0x25,0xa0,0x43,0x00,0x03,0x27,0x85,0x90,0x00,0x08,0x00,0x0b,0x41,
+0x01,0x49,0x10,0x21,0x3c,0x02,0x80,0x00,0x00,0x62,0x18,0x26,0x08,0x00,0x0a,0x76,
+0x00,0xc2,0x30,0x26,0x12,0x00,0xff,0x2d,0x24,0x02,0x00,0x01,0x08,0x00,0x0a,0x7b,
+0x24,0x11,0x00,0x02,0x3c,0x03,0xb0,0x03,0x3c,0x02,0x80,0x00,0x27,0xbd,0xff,0xd0,
+0x24,0x42,0x2d,0x44,0x34,0x63,0x00,0x20,0x3c,0x05,0xb0,0x05,0xaf,0xb3,0x00,0x24,
+0xaf,0xb2,0x00,0x20,0xaf,0xb1,0x00,0x1c,0xaf,0xbf,0x00,0x28,0xaf,0xb0,0x00,0x18,
+0xac,0x62,0x00,0x00,0x34,0xa5,0x02,0x42,0x90,0xa2,0x00,0x00,0x00,0x80,0x90,0x21,
+0x24,0x11,0x00,0x10,0x30,0x53,0x00,0xff,0x24,0x02,0x00,0x10,0x12,0x22,0x00,0xcf,
+0x00,0x00,0x18,0x21,0x24,0x02,0x00,0x11,0x12,0x22,0x00,0xc1,0x24,0x02,0x00,0x12,
+0x12,0x22,0x00,0xb4,0x00,0x00,0x00,0x00,0x14,0x60,0x00,0xad,0xae,0x43,0x00,0x40,
+0x3c,0x02,0xb0,0x05,0x34,0x42,0x02,0x2c,0x8c,0x44,0x00,0x00,0x3c,0x03,0x00,0x02,
+0x34,0x63,0x00,0xff,0x00,0x83,0x80,0x24,0x00,0x10,0x14,0x43,0x10,0x40,0x00,0x05,
+0x00,0x00,0x00,0x00,0x8e,0x42,0x00,0x34,0x00,0x00,0x00,0x00,0x14,0x40,0x00,0x92,
+0x00,0x00,0x00,0x00,0x93,0x83,0x8b,0x61,0x00,0x00,0x00,0x00,0x30,0x62,0x00,0x02,
+0x10,0x40,0x00,0x04,0x32,0x10,0x00,0xff,0x00,0x10,0x11,0xc3,0x14,0x40,0x00,0x86,
+0x00,0x00,0x00,0x00,0x16,0x00,0x00,0x15,0x02,0x00,0x10,0x21,0x26,0x22,0x00,0x01,
+0x30,0x51,0x00,0xff,0x2e,0x23,0x00,0x13,0x14,0x60,0xff,0xdb,0x24,0x03,0x00,0x02,
+0x12,0x63,0x00,0x73,0x24,0x02,0x00,0x05,0x2a,0x62,0x00,0x03,0x10,0x40,0x00,0x58,
+0x24,0x02,0x00,0x04,0x24,0x02,0x00,0x01,0x12,0x62,0x00,0x4b,0x02,0x40,0x20,0x21,
+0x3c,0x02,0xb0,0x05,0x34,0x42,0x02,0x2c,0x8c,0x43,0x00,0x00,0x00,0x00,0x00,0x00,
+0x30,0x70,0x00,0xff,0x12,0x00,0x00,0x06,0x02,0x00,0x10,0x21,0x8f,0xbf,0x00,0x28,
+0x7b,0xb2,0x01,0x3c,0x7b,0xb0,0x00,0xfc,0x03,0xe0,0x00,0x08,0x27,0xbd,0x00,0x30,
+0x92,0x46,0x00,0x04,0x8e,0x43,0x00,0x24,0x24,0x02,0x00,0x07,0x02,0x40,0x20,0x21,
+0x00,0x00,0x28,0x21,0x24,0x07,0x00,0x06,0xaf,0xa2,0x00,0x10,0x0c,0x00,0x09,0xe6,
+0xaf,0xa3,0x00,0x14,0xae,0x42,0x00,0x24,0x3c,0x02,0xb0,0x05,0x8c,0x42,0x02,0x2c,
+0x00,0x00,0x00,0x00,0x30,0x50,0x00,0xff,0x16,0x00,0xff,0xec,0x02,0x00,0x10,0x21,
+0x92,0x46,0x00,0x05,0x8e,0x43,0x00,0x28,0x24,0x02,0x00,0x05,0x02,0x40,0x20,0x21,
+0x24,0x05,0x00,0x01,0x24,0x07,0x00,0x04,0xaf,0xa2,0x00,0x10,0x0c,0x00,0x09,0xe6,
+0xaf,0xa3,0x00,0x14,0xae,0x42,0x00,0x28,0x3c,0x02,0xb0,0x05,0x8c,0x42,0x02,0x2c,
+0x00,0x00,0x00,0x00,0x30,0x50,0x00,0xff,0x16,0x00,0xff,0xdc,0x02,0x00,0x10,0x21,
+0x92,0x46,0x00,0x06,0x8e,0x43,0x00,0x2c,0x24,0x02,0x00,0x03,0x02,0x40,0x20,0x21,
+0x24,0x05,0x00,0x02,0x00,0x00,0x38,0x21,0xaf,0xa2,0x00,0x10,0x0c,0x00,0x09,0xe6,
+0xaf,0xa3,0x00,0x14,0xae,0x42,0x00,0x2c,0x3c,0x02,0xb0,0x05,0x8c,0x42,0x02,0x2c,
+0x00,0x00,0x00,0x00,0x30,0x50,0x00,0xff,0x16,0x00,0xff,0xcc,0x02,0x00,0x10,0x21,
+0x92,0x46,0x00,0x07,0x8e,0x43,0x00,0x30,0x24,0x02,0x00,0x02,0x02,0x40,0x20,0x21,
+0x24,0x05,0x00,0x03,0x24,0x07,0x00,0x01,0xaf,0xa2,0x00,0x10,0x0c,0x00,0x09,0xe6,
+0xaf,0xa3,0x00,0x14,0xae,0x42,0x00,0x30,0x3c,0x02,0xb0,0x05,0x8c,0x42,0x02,0x2c,
+0x08,0x00,0x0b,0x97,0x30,0x42,0x00,0xff,0x92,0x46,0x00,0x04,0x8e,0x43,0x00,0x24,
+0x24,0x02,0x00,0x07,0x00,0x00,0x28,0x21,0x24,0x07,0x00,0x06,0xaf,0xa2,0x00,0x10,
+0x0c,0x00,0x09,0xe6,0xaf,0xa3,0x00,0x14,0x08,0x00,0x0b,0x90,0xae,0x42,0x00,0x24,
+0x12,0x62,0x00,0x0d,0x24,0x02,0x00,0x03,0x24,0x02,0x00,0x08,0x16,0x62,0xff,0xa8,
+0x02,0x40,0x20,0x21,0x92,0x46,0x00,0x07,0x8e,0x42,0x00,0x30,0x24,0x05,0x00,0x03,
+0x24,0x07,0x00,0x01,0xaf,0xa3,0x00,0x10,0x0c,0x00,0x09,0xe6,0xaf,0xa2,0x00,0x14,
+0x08,0x00,0x0b,0x90,0xae,0x42,0x00,0x30,0x92,0x46,0x00,0x06,0x8e,0x43,0x00,0x2c,
+0x02,0x40,0x20,0x21,0x24,0x05,0x00,0x02,0x00,0x00,0x38,0x21,0xaf,0xa2,0x00,0x10,
+0x0c,0x00,0x09,0xe6,0xaf,0xa3,0x00,0x14,0x08,0x00,0x0b,0x90,0xae,0x42,0x00,0x2c,
+0x92,0x46,0x00,0x05,0x8e,0x43,0x00,0x28,0x02,0x40,0x20,0x21,0x24,0x05,0x00,0x01,
+0x24,0x07,0x00,0x04,0xaf,0xa2,0x00,0x10,0x0c,0x00,0x09,0xe6,0xaf,0xa3,0x00,0x14,
+0x08,0x00,0x0b,0x90,0xae,0x42,0x00,0x28,0x0c,0x00,0x01,0x59,0x24,0x04,0x00,0x01,
+0x08,0x00,0x0b,0x81,0x00,0x00,0x00,0x00,0x8f,0x84,0xb4,0x30,0xae,0x40,0x00,0x34,
+0x94,0x85,0x00,0x14,0x0c,0x00,0x1b,0x84,0x00,0x00,0x00,0x00,0x93,0x83,0x8b,0x61,
+0x00,0x00,0x00,0x00,0x30,0x62,0x00,0x02,0x10,0x40,0xff,0x69,0x00,0x00,0x00,0x00,
+0x0c,0x00,0x01,0x59,0x00,0x00,0x20,0x21,0x08,0x00,0x0b,0x79,0x00,0x00,0x00,0x00,
+0x02,0x40,0x20,0x21,0x0c,0x00,0x09,0x5d,0x02,0x20,0x28,0x21,0x08,0x00,0x0b,0x6d,
+0x3c,0x02,0xb0,0x05,0x8e,0x42,0x00,0x3c,0x00,0x00,0x00,0x00,0x14,0x40,0xff,0x4a,
+0x00,0x00,0x00,0x00,0x8f,0x82,0xb4,0x38,0x00,0x00,0x00,0x00,0x90,0x42,0x00,0x0a,
+0x00,0x00,0x00,0x00,0x00,0x02,0x18,0x2b,0x08,0x00,0x0b,0x6a,0xae,0x43,0x00,0x3c,
+0x8e,0x42,0x00,0x38,0x00,0x00,0x00,0x00,0x14,0x40,0xff,0x3d,0x24,0x02,0x00,0x12,
+0x8f,0x82,0xb4,0x34,0x00,0x00,0x00,0x00,0x90,0x42,0x00,0x0a,0x00,0x00,0x00,0x00,
+0x00,0x02,0x18,0x2b,0x08,0x00,0x0b,0x6a,0xae,0x43,0x00,0x38,0x8e,0x42,0x00,0x34,
+0x00,0x00,0x00,0x00,0x14,0x40,0xff,0x30,0x24,0x02,0x00,0x11,0x8f,0x82,0xb4,0x30,
+0x00,0x00,0x00,0x00,0x90,0x42,0x00,0x0a,0x00,0x00,0x00,0x00,0x00,0x02,0x18,0x2b,
+0x08,0x00,0x0b,0x6a,0xae,0x43,0x00,0x34,0x3c,0x03,0xb0,0x03,0x3c,0x02,0x80,0x00,
+0x27,0xbd,0xff,0xe0,0x34,0x63,0x00,0x20,0x24,0x42,0x30,0xf8,0x3c,0x08,0xb0,0x03,
+0xaf,0xb1,0x00,0x14,0xac,0x62,0x00,0x00,0x35,0x08,0x01,0x00,0xaf,0xbf,0x00,0x18,
+0xaf,0xb0,0x00,0x10,0x91,0x03,0x00,0x00,0x00,0xa0,0x48,0x21,0x24,0x11,0x00,0x0a,
+0x2c,0xa5,0x00,0x04,0x24,0x02,0x00,0x10,0x00,0x45,0x88,0x0a,0x30,0x63,0x00,0x01,
+0x00,0xc0,0x28,0x21,0x14,0x60,0x00,0x02,0x00,0x11,0x40,0x40,0x02,0x20,0x40,0x21,
+0x84,0x83,0x00,0x0c,0x31,0x11,0x00,0xff,0x01,0x20,0x20,0x21,0x00,0x03,0x10,0xc0,
+0x00,0x43,0x10,0x21,0x00,0x02,0x10,0x80,0x27,0x83,0x8f,0xf8,0x00,0x43,0x10,0x21,
+0x84,0x43,0x00,0x04,0x24,0x06,0x00,0x0e,0x10,0xe0,0x00,0x06,0x02,0x23,0x80,0x21,
+0x02,0x00,0x10,0x21,0x8f,0xbf,0x00,0x18,0x7b,0xb0,0x00,0xbc,0x03,0xe0,0x00,0x08,
+0x27,0xbd,0x00,0x20,0x0c,0x00,0x08,0xdf,0x00,0x00,0x00,0x00,0x02,0x11,0x18,0x21,
+0x08,0x00,0x0c,0x60,0x00,0x62,0x80,0x21,0x27,0xbd,0xff,0xd0,0xaf,0xbf,0x00,0x28,
+0xaf,0xb4,0x00,0x20,0xaf,0xb3,0x00,0x1c,0xaf,0xb2,0x00,0x18,0xaf,0xb5,0x00,0x24,
+0xaf,0xb1,0x00,0x14,0xaf,0xb0,0x00,0x10,0x84,0x82,0x00,0x0c,0x3c,0x06,0xb0,0x03,
+0x34,0xc6,0x00,0x20,0x00,0x02,0x18,0xc0,0x00,0x62,0x18,0x21,0x00,0x03,0x18,0x80,
+0x27,0x82,0x8f,0xf4,0x00,0x62,0x10,0x21,0x8c,0x55,0x00,0x18,0x3c,0x02,0x80,0x00,
+0x24,0x42,0x31,0xa8,0xac,0xc2,0x00,0x00,0x8e,0xb0,0x00,0x08,0x27,0x82,0x8f,0xf8,
+0x00,0x62,0x18,0x21,0x90,0x71,0x00,0x07,0x00,0x10,0x86,0x43,0x32,0x10,0x00,0x01,
+0x00,0xa0,0x38,0x21,0x02,0x00,0x30,0x21,0x00,0xa0,0x98,0x21,0x02,0x20,0x28,0x21,
+0x0c,0x00,0x0c,0x3e,0x00,0x80,0x90,0x21,0x02,0x20,0x20,0x21,0x02,0x00,0x28,0x21,
+0x24,0x06,0x00,0x14,0x0c,0x00,0x08,0xdf,0x00,0x40,0xa0,0x21,0x86,0x43,0x00,0x0c,
+0x3c,0x09,0xb0,0x09,0x3c,0x08,0xb0,0x09,0x00,0x03,0x10,0xc0,0x00,0x43,0x10,0x21,
+0x00,0x02,0x10,0x80,0x27,0x83,0x90,0x00,0x00,0x43,0x10,0x21,0x80,0x43,0x00,0x06,
+0x3c,0x07,0xb0,0x09,0x3c,0x05,0xb0,0x09,0x28,0x62,0x00,0x00,0x24,0x64,0x00,0x03,
+0x00,0x82,0x18,0x0b,0x00,0x03,0x18,0x83,0x3c,0x02,0xb0,0x09,0x00,0x03,0x18,0x80,
+0x34,0x42,0x01,0x02,0x35,0x29,0x01,0x10,0x35,0x08,0x01,0x14,0x34,0xe7,0x01,0x20,
+0x34,0xa5,0x01,0x24,0xa4,0x54,0x00,0x00,0x12,0x60,0x00,0x11,0x02,0xa3,0xa8,0x21,
+0x8e,0xa2,0x00,0x0c,0x8e,0xa3,0x00,0x08,0x00,0x02,0x14,0x00,0x00,0x03,0x1c,0x02,
+0x00,0x43,0x10,0x21,0xad,0x22,0x00,0x00,0x8e,0xa3,0x00,0x0c,0x00,0x00,0x00,0x00,
+0x00,0x03,0x1c,0x02,0xa5,0x03,0x00,0x00,0x8f,0xbf,0x00,0x28,0x7b,0xb4,0x01,0x3c,
+0x7b,0xb2,0x00,0xfc,0x7b,0xb0,0x00,0xbc,0x03,0xe0,0x00,0x08,0x27,0xbd,0x00,0x30,
+0x8e,0xa2,0x00,0x04,0x00,0x00,0x00,0x00,0xad,0x22,0x00,0x00,0x8e,0xa4,0x00,0x08,
+0x00,0x00,0x00,0x00,0xa5,0x04,0x00,0x00,0x7a,0xa2,0x00,0x7c,0x00,0x00,0x00,0x00,
+0x00,0x03,0x1c,0x00,0x00,0x02,0x14,0x02,0x00,0x62,0x18,0x21,0xac,0xe3,0x00,0x00,
+0x8e,0xa2,0x00,0x0c,0x00,0x00,0x00,0x00,0x00,0x02,0x14,0x02,0x08,0x00,0x0c,0xb2,
+0xa4,0xa2,0x00,0x00,0x27,0xbd,0xff,0xe0,0xaf,0xb2,0x00,0x18,0xaf,0xb0,0x00,0x10,
+0xaf,0xbf,0x00,0x1c,0xaf,0xb1,0x00,0x14,0x84,0x82,0x00,0x0c,0x00,0x80,0x90,0x21,
+0x3c,0x05,0xb0,0x03,0x00,0x02,0x20,0xc0,0x00,0x82,0x20,0x21,0x00,0x04,0x20,0x80,
+0x27,0x82,0x8f,0xf4,0x00,0x82,0x10,0x21,0x8c,0x51,0x00,0x18,0x3c,0x02,0x80,0x00,
+0x34,0xa5,0x00,0x20,0x24,0x42,0x33,0x24,0x27,0x83,0x8f,0xf8,0xac,0xa2,0x00,0x00,
+0x00,0x83,0x20,0x21,0x3c,0x02,0xb0,0x03,0x90,0x86,0x00,0x07,0x34,0x42,0x01,0x00,
+0x8e,0x23,0x00,0x08,0x90,0x44,0x00,0x00,0x2c,0xc5,0x00,0x04,0x24,0x02,0x00,0x10,
+0x24,0x10,0x00,0x0a,0x00,0x45,0x80,0x0a,0x00,0x03,0x1e,0x43,0x30,0x84,0x00,0x01,
+0x30,0x65,0x00,0x01,0x14,0x80,0x00,0x02,0x00,0x10,0x10,0x40,0x02,0x00,0x10,0x21,
+0x00,0xc0,0x20,0x21,0x24,0x06,0x00,0x20,0x0c,0x00,0x08,0xdf,0x30,0x50,0x00,0xff,
+0x86,0x44,0x00,0x0c,0x27,0x85,0x90,0x00,0x3c,0x06,0xb0,0x09,0x00,0x04,0x18,0xc0,
+0x00,0x64,0x18,0x21,0x00,0x03,0x18,0x80,0x00,0x65,0x18,0x21,0x80,0x64,0x00,0x06,
+0x00,0x50,0x10,0x21,0x34,0xc6,0x01,0x02,0x24,0x85,0x00,0x03,0x28,0x83,0x00,0x00,
+0x00,0xa3,0x20,0x0b,0x00,0x04,0x20,0x83,0x00,0x04,0x20,0x80,0xa4,0xc2,0x00,0x00,
+0x02,0x24,0x20,0x21,0x8c,0x83,0x00,0x04,0x3c,0x02,0xb0,0x09,0x34,0x42,0x01,0x10,
+0xac,0x43,0x00,0x00,0x8c,0x86,0x00,0x08,0x3c,0x02,0xb0,0x09,0x34,0x42,0x01,0x14,
+0xa4,0x46,0x00,0x00,0x8c,0x85,0x00,0x0c,0x8c,0x82,0x00,0x08,0x3c,0x06,0xb0,0x09,
+0x00,0x05,0x2c,0x00,0x00,0x02,0x14,0x02,0x00,0xa2,0x28,0x21,0x34,0xc6,0x01,0x20,
+0xac,0xc5,0x00,0x00,0x8c,0x83,0x00,0x0c,0x3c,0x05,0xb0,0x09,0x34,0xa5,0x01,0x24,
+0x00,0x03,0x1c,0x02,0xa4,0xa3,0x00,0x00,0x92,0x42,0x00,0x0a,0x3c,0x03,0xb0,0x09,
+0x34,0x63,0x01,0x30,0x00,0x02,0x13,0x00,0x24,0x42,0x00,0x04,0x30,0x42,0xff,0xff,
+0xa4,0x62,0x00,0x00,0x86,0x44,0x00,0x0c,0x27,0x83,0x90,0x08,0x8f,0xbf,0x00,0x1c,
+0x00,0x04,0x10,0xc0,0x00,0x44,0x10,0x21,0x00,0x02,0x10,0x80,0x00,0x43,0x10,0x21,
+0x94,0x44,0x00,0x02,0x8f,0xb2,0x00,0x18,0x7b,0xb0,0x00,0xbc,0x3c,0x05,0xb0,0x09,
+0x34,0xa5,0x01,0x32,0xa4,0xa4,0x00,0x00,0x03,0xe0,0x00,0x08,0x27,0xbd,0x00,0x20,
+0x27,0xbd,0xff,0xe0,0x3c,0x02,0xb0,0x03,0x3c,0x03,0x80,0x00,0xaf,0xb0,0x00,0x10,
+0x34,0x42,0x00,0x20,0x00,0xa0,0x80,0x21,0x24,0x63,0x34,0xb0,0x00,0x05,0x2c,0x43,
+0xaf,0xb1,0x00,0x14,0xaf,0xbf,0x00,0x18,0xac,0x43,0x00,0x00,0x10,0xa0,0x00,0x05,
+0x00,0x80,0x88,0x21,0x8c,0x82,0x00,0x34,0x00,0x00,0x00,0x00,0x14,0x40,0x00,0xb6,
+0x00,0x00,0x00,0x00,0x32,0x10,0x00,0xff,0x12,0x00,0x00,0x4c,0x00,0x00,0x10,0x21,
+0x24,0x02,0x00,0x08,0x12,0x02,0x00,0xa3,0x2a,0x02,0x00,0x09,0x10,0x40,0x00,0x89,
+0x24,0x02,0x00,0x40,0x24,0x04,0x00,0x02,0x12,0x04,0x00,0x79,0x2a,0x02,0x00,0x03,
+0x10,0x40,0x00,0x69,0x24,0x02,0x00,0x04,0x24,0x02,0x00,0x01,0x12,0x02,0x00,0x5a,
+0x00,0x00,0x00,0x00,0x3c,0x02,0xb0,0x05,0x34,0x42,0x00,0x08,0x3c,0x03,0x80,0x00,
+0xa2,0x20,0x00,0x4e,0xac,0x43,0x00,0x00,0x82,0x24,0x00,0x11,0x92,0x27,0x00,0x11,
+0x10,0x80,0x00,0x4e,0x00,0x00,0x00,0x00,0x92,0x26,0x00,0x0a,0x24,0x02,0x00,0x12,
+0x10,0x46,0x00,0x09,0x30,0xc2,0x00,0xff,0x27,0x83,0xb3,0xf0,0x00,0x02,0x10,0x80,
+0x00,0x43,0x10,0x21,0x8c,0x44,0x00,0x00,0x00,0x00,0x00,0x00,0x94,0x83,0x00,0x14,
+0x00,0x00,0x00,0x00,0xa6,0x23,0x00,0x0c,0x3c,0x02,0xb0,0x09,0x34,0x42,0x00,0x40,
+0x90,0x43,0x00,0x00,0x00,0x00,0x00,0x00,0x30,0x63,0x00,0x03,0xa2,0x23,0x00,0x10,
+0x14,0x60,0x00,0x2b,0x30,0x65,0x00,0x01,0x30,0xc2,0x00,0xff,0x27,0x83,0xb3,0xf0,
+0x00,0x02,0x10,0x80,0x00,0x43,0x10,0x21,0x8c,0x44,0x00,0x00,0x82,0x23,0x00,0x12,
+0x90,0x82,0x00,0x16,0x00,0x00,0x00,0x00,0x00,0x02,0x11,0x42,0x30,0x42,0x00,0x01,
+0x00,0x62,0x18,0x21,0x00,0x03,0x26,0x00,0x14,0x80,0x00,0x18,0xa2,0x23,0x00,0x12,
+0x00,0x07,0x16,0x00,0x14,0x40,0x00,0x11,0x24,0x02,0x00,0x01,0x96,0x23,0x00,0x0c,
+0x27,0x84,0x90,0x00,0x00,0x03,0x10,0xc0,0x00,0x43,0x10,0x21,0x00,0x02,0x10,0x80,
+0x00,0x44,0x10,0x21,0x80,0x45,0x00,0x06,0x00,0x03,0x1a,0x00,0x3c,0x02,0xb0,0x00,
+0x00,0x65,0x18,0x21,0x00,0x62,0x18,0x21,0x90,0x64,0x00,0x00,0x90,0x62,0x00,0x04,
+0xa2,0x20,0x00,0x15,0xa3,0x80,0x8b,0xc4,0x24,0x02,0x00,0x01,0x8f,0xbf,0x00,0x18,
+0x7b,0xb0,0x00,0xbc,0x03,0xe0,0x00,0x08,0x27,0xbd,0x00,0x20,0x0c,0x00,0x0c,0xc9,
+0x02,0x20,0x20,0x21,0x92,0x27,0x00,0x11,0x08,0x00,0x0d,0x79,0x00,0x07,0x16,0x00,
+0x0c,0x00,0x0c,0x6a,0x02,0x20,0x20,0x21,0x86,0x23,0x00,0x0c,0x27,0x84,0x8f,0xf8,
+0x00,0x03,0x10,0xc0,0x00,0x43,0x10,0x21,0x00,0x02,0x10,0x80,0x00,0x44,0x20,0x21,
+0x90,0x85,0x00,0x07,0x27,0x83,0x90,0x00,0x00,0x43,0x10,0x21,0xa2,0x25,0x00,0x13,
+0x90,0x83,0x00,0x07,0x08,0x00,0x0d,0x91,0xa0,0x43,0x00,0x02,0x92,0x26,0x00,0x0a,
+0x08,0x00,0x0d,0x5a,0x30,0xc2,0x00,0xff,0x8e,0x22,0x00,0x24,0x00,0x00,0x00,0x00,
+0x10,0x50,0x00,0x07,0xa2,0x20,0x00,0x08,0x24,0x02,0x00,0x07,0xa2,0x22,0x00,0x0a,
+0x92,0x22,0x00,0x27,0xae,0x20,0x00,0x24,0x08,0x00,0x0d,0x4d,0xa2,0x22,0x00,0x04,
+0x08,0x00,0x0d,0xab,0x24,0x02,0x00,0x06,0x16,0x02,0xff,0x9b,0x3c,0x02,0xb0,0x05,
+0x8e,0x23,0x00,0x2c,0x24,0x02,0x00,0x01,0x10,0x62,0x00,0x07,0xa2,0x24,0x00,0x08,
+0x24,0x02,0x00,0x03,0xa2,0x22,0x00,0x0a,0x92,0x22,0x00,0x2f,0xae,0x20,0x00,0x2c,
+0x08,0x00,0x0d,0x4d,0xa2,0x22,0x00,0x06,0x08,0x00,0x0d,0xba,0xa2,0x20,0x00,0x0a,
+0x8e,0x22,0x00,0x28,0x24,0x03,0x00,0x01,0x24,0x04,0x00,0x01,0x10,0x44,0x00,0x07,
+0xa2,0x23,0x00,0x08,0x24,0x02,0x00,0x05,0xa2,0x22,0x00,0x0a,0x92,0x22,0x00,0x2b,
+0xae,0x20,0x00,0x28,0x08,0x00,0x0d,0x4d,0xa2,0x22,0x00,0x05,0x08,0x00,0x0d,0xc6,
+0x24,0x02,0x00,0x04,0x12,0x02,0x00,0x12,0x2a,0x02,0x00,0x41,0x10,0x40,0x00,0x09,
+0x24,0x02,0x00,0x80,0x24,0x02,0x00,0x20,0x16,0x02,0xff,0x7b,0x3c,0x02,0xb0,0x05,
+0x24,0x02,0x00,0x12,0xa2,0x22,0x00,0x0a,0xa2,0x22,0x00,0x08,0x08,0x00,0x0d,0x4d,
+0xae,0x20,0x00,0x3c,0x16,0x02,0xff,0x74,0x3c,0x02,0xb0,0x05,0x24,0x02,0x00,0x10,
+0xa2,0x22,0x00,0x0a,0xa2,0x22,0x00,0x08,0x08,0x00,0x0d,0x4d,0xae,0x20,0x00,0x34,
+0x24,0x02,0x00,0x11,0xa2,0x22,0x00,0x0a,0xa2,0x22,0x00,0x08,0x08,0x00,0x0d,0x4d,
+0xae,0x20,0x00,0x38,0x8e,0x24,0x00,0x30,0x24,0x02,0x00,0x03,0x24,0x03,0x00,0x01,
+0x10,0x83,0x00,0x07,0xa2,0x22,0x00,0x08,0x24,0x02,0x00,0x02,0xa2,0x22,0x00,0x0a,
+0x92,0x22,0x00,0x33,0xae,0x20,0x00,0x30,0x08,0x00,0x0d,0x4d,0xa2,0x22,0x00,0x07,
+0x08,0x00,0x0d,0xec,0xa2,0x24,0x00,0x0a,0x8f,0x84,0xb4,0x30,0xae,0x20,0x00,0x34,
+0x94,0x85,0x00,0x14,0x0c,0x00,0x1b,0x84,0x32,0x10,0x00,0xff,0x08,0x00,0x0d,0x3e,
+0x00,0x00,0x00,0x00,0x3c,0x03,0xb0,0x03,0x3c,0x02,0x80,0x00,0x24,0x42,0x37,0xe4,
+0x34,0x63,0x00,0x20,0xac,0x62,0x00,0x00,0x80,0xa2,0x00,0x15,0x3c,0x06,0xb0,0x05,
+0x10,0x40,0x00,0x0a,0x34,0xc6,0x02,0x54,0x83,0x83,0x8b,0xc4,0x00,0x00,0x00,0x00,
+0xac,0x83,0x00,0x24,0x8c,0xc2,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x02,0x17,0x42,
+0x30,0x42,0x00,0x01,0x03,0xe0,0x00,0x08,0xac,0x82,0x00,0x28,0x8c,0x82,0x00,0x2c,
+0x3c,0x06,0xb0,0x05,0x34,0xc6,0x04,0x50,0x00,0x02,0x18,0x43,0x30,0x63,0x00,0x01,
+0x10,0x40,0x00,0x04,0x30,0x45,0x00,0x01,0xac,0x83,0x00,0x28,0x03,0xe0,0x00,0x08,
+0xac,0x85,0x00,0x24,0x90,0xc2,0x00,0x00,0x00,0x00,0x00,0x00,0x30,0x42,0x00,0xff,
+0x30,0x43,0x00,0x02,0x30,0x42,0x00,0x01,0xac,0x83,0x00,0x28,0x03,0xe0,0x00,0x08,
+0xac,0x82,0x00,0x24,0x3c,0x03,0xb0,0x03,0x3c,0x02,0x80,0x00,0x27,0xbd,0xff,0xd8,
+0x34,0x63,0x00,0x20,0x24,0x42,0x38,0x74,0xac,0x62,0x00,0x00,0xaf,0xb1,0x00,0x1c,
+0xaf,0xbf,0x00,0x20,0xaf,0xb0,0x00,0x18,0x90,0xa6,0x00,0x0a,0x27,0x83,0xb3,0xf0,
+0x00,0xa0,0x88,0x21,0x00,0x06,0x10,0x80,0x00,0x43,0x10,0x21,0x8c,0x50,0x00,0x00,
+0x80,0xa5,0x00,0x11,0x92,0x03,0x00,0x12,0x10,0xa0,0x00,0x04,0xa2,0x20,0x00,0x15,
+0x24,0x02,0x00,0x12,0x10,0xc2,0x00,0xda,0x00,0x00,0x00,0x00,0x82,0x22,0x00,0x12,
+0x00,0x00,0x00,0x00,0x10,0x40,0x00,0x67,0x00,0x00,0x00,0x00,0xa2,0x20,0x00,0x12,
+0xa2,0x00,0x00,0x19,0x86,0x23,0x00,0x0c,0x00,0x00,0x00,0x00,0x00,0x03,0x10,0xc0,
+0x00,0x43,0x10,0x21,0x00,0x02,0x10,0x80,0x27,0x83,0x90,0x10,0x00,0x43,0x10,0x21,
+0xa0,0x40,0x00,0x00,0x92,0x03,0x00,0x16,0x00,0x00,0x00,0x00,0x30,0x63,0x00,0xdf,
+0xa2,0x03,0x00,0x16,0x82,0x02,0x00,0x12,0x00,0x00,0x00,0x00,0x14,0x40,0x00,0x20,
+0x00,0x00,0x00,0x00,0x92,0x23,0x00,0x08,0x00,0x00,0x00,0x00,0x14,0x60,0x00,0x45,
+0x24,0x02,0x00,0x01,0xa2,0x20,0x00,0x04,0x92,0x08,0x00,0x04,0x00,0x00,0x00,0x00,
+0x15,0x00,0x00,0x1e,0x24,0x02,0x00,0x01,0x92,0x07,0x00,0x0a,0xa2,0x02,0x00,0x17,
+0x92,0x02,0x00,0x16,0x30,0xe3,0x00,0xff,0x30,0x42,0x00,0xe4,0x10,0x60,0x00,0x03,
+0xa2,0x02,0x00,0x16,0x34,0x42,0x00,0x01,0xa2,0x02,0x00,0x16,0x11,0x00,0x00,0x05,
+0x00,0x00,0x00,0x00,0x92,0x02,0x00,0x16,0x00,0x00,0x00,0x00,0x34,0x42,0x00,0x02,
+0xa2,0x02,0x00,0x16,0x92,0x02,0x00,0x17,0x00,0x00,0x00,0x00,0x10,0x40,0x00,0x08,
+0x00,0x00,0x00,0x00,0x96,0x02,0x00,0x06,0x00,0x00,0x00,0x00,0xa6,0x02,0x00,0x14,
+0x8f,0xbf,0x00,0x20,0x7b,0xb0,0x00,0xfc,0x03,0xe0,0x00,0x08,0x27,0xbd,0x00,0x28,
+0x96,0x02,0x00,0x00,0x08,0x00,0x0e,0x68,0xa6,0x02,0x00,0x14,0x92,0x07,0x00,0x0a,
+0x00,0x00,0x00,0x00,0x14,0xe0,0x00,0x03,0x00,0x00,0x00,0x00,0x08,0x00,0x0e,0x54,
+0xa2,0x00,0x00,0x17,0x96,0x04,0x00,0x00,0x96,0x05,0x00,0x06,0x27,0x86,0x8f,0xf0,
+0x00,0x04,0x18,0xc0,0x00,0x64,0x18,0x21,0x00,0x05,0x10,0xc0,0x00,0x45,0x10,0x21,
+0x00,0x03,0x18,0x80,0x00,0x66,0x18,0x21,0x00,0x02,0x10,0x80,0x00,0x46,0x10,0x21,
+0x8c,0x66,0x00,0x08,0x8c,0x45,0x00,0x08,0x3c,0x03,0x80,0x00,0x00,0xc3,0x20,0x24,
+0x10,0x80,0x00,0x08,0x00,0xa3,0x10,0x24,0x10,0x40,0x00,0x04,0x00,0x00,0x18,0x21,
+0x10,0x80,0x00,0x02,0x24,0x03,0x00,0x01,0x00,0xa6,0x18,0x2b,0x08,0x00,0x0e,0x54,
+0xa2,0x03,0x00,0x17,0x10,0x40,0xff,0xfd,0x00,0xa6,0x18,0x2b,0x08,0x00,0x0e,0x88,
+0x00,0x00,0x00,0x00,0x10,0x62,0x00,0x09,0x24,0x02,0x00,0x02,0x10,0x62,0x00,0x05,
+0x24,0x02,0x00,0x03,0x14,0x62,0xff,0xb8,0x00,0x00,0x00,0x00,0x08,0x00,0x0e,0x4e,
+0xa2,0x20,0x00,0x07,0x08,0x00,0x0e,0x4e,0xa2,0x20,0x00,0x06,0x08,0x00,0x0e,0x4e,
+0xa2,0x20,0x00,0x05,0x82,0x22,0x00,0x10,0x00,0x00,0x00,0x00,0x14,0x40,0x00,0x69,
+0x2c,0x62,0x00,0x02,0x10,0x40,0x00,0x49,0x3c,0x02,0xb0,0x09,0x92,0x25,0x00,0x08,
+0x00,0x00,0x00,0x00,0x30,0xa6,0x00,0xff,0x2c,0xc2,0x00,0x04,0x10,0x40,0x00,0x3b,
+0x2c,0xc2,0x00,0x10,0x3c,0x04,0xb0,0x05,0x34,0x84,0x02,0x29,0x90,0x83,0x00,0x00,
+0x24,0x02,0x00,0x01,0x00,0xc2,0x10,0x04,0x00,0x02,0x10,0x27,0x00,0x62,0x18,0x24,
+0xa0,0x83,0x00,0x00,0x86,0x23,0x00,0x0c,0x96,0x26,0x00,0x0c,0x00,0x03,0x10,0xc0,
+0x00,0x43,0x10,0x21,0x00,0x02,0x28,0x80,0x27,0x83,0x8f,0xf4,0x00,0xa3,0x18,0x21,
+0x8c,0x64,0x00,0x18,0x00,0x00,0x00,0x00,0x8c,0x82,0x00,0x04,0x00,0x00,0x00,0x00,
+0x30,0x42,0x00,0x10,0x10,0x40,0x00,0x18,0x24,0x07,0x00,0x01,0x93,0x82,0x8b,0x61,
+0x00,0x00,0x00,0x00,0x30,0x42,0x00,0x01,0x14,0x40,0x00,0x0a,0x24,0x05,0x00,0x24,
+0x00,0x06,0x2c,0x00,0x00,0x05,0x2c,0x03,0x0c,0x00,0x1b,0x84,0x02,0x00,0x20,0x21,
+0x92,0x02,0x00,0x16,0xa2,0x00,0x00,0x12,0x30,0x42,0x00,0xe7,0x08,0x00,0x0e,0x45,
+0xa2,0x02,0x00,0x16,0xf0,0xc5,0x00,0x06,0x00,0x00,0x28,0x12,0x27,0x82,0x8f,0xf0,
+0x00,0xa2,0x28,0x21,0x0c,0x00,0x01,0x4b,0x3c,0x04,0x00,0x80,0x96,0x26,0x00,0x0c,
+0x08,0x00,0x0e,0xc5,0x00,0x06,0x2c,0x00,0x27,0x83,0x90,0x00,0x27,0x82,0x90,0x08,
+0x00,0xa2,0x10,0x21,0x00,0xa3,0x18,0x21,0x90,0x44,0x00,0x00,0x90,0x65,0x00,0x05,
+0x93,0x82,0x80,0x10,0x00,0x00,0x30,0x21,0x0c,0x00,0x21,0xf5,0xaf,0xa2,0x00,0x10,
+0x96,0x26,0x00,0x0c,0x08,0x00,0x0e,0xbf,0x00,0x00,0x00,0x00,0x14,0x40,0xff,0xcd,
+0x3c,0x04,0xb0,0x05,0x34,0x84,0x02,0x29,0x90,0x83,0x00,0x00,0x30,0xa5,0x00,0x0f,
+0x24,0x02,0x00,0x80,0x08,0x00,0x0e,0xae,0x00,0xa2,0x10,0x07,0x86,0x26,0x00,0x0c,
+0x3c,0x03,0xb0,0x09,0x34,0x42,0x01,0x72,0x34,0x63,0x01,0x78,0x94,0x47,0x00,0x00,
+0x8c,0x65,0x00,0x00,0x00,0x06,0x10,0xc0,0x00,0x46,0x10,0x21,0x3c,0x04,0xb0,0x09,
+0xae,0x25,0x00,0x1c,0x34,0x84,0x01,0x7c,0x27,0x83,0x8f,0xf4,0x00,0x02,0x10,0x80,
+0x8c,0x85,0x00,0x00,0x00,0x43,0x10,0x21,0x8c,0x43,0x00,0x18,0xae,0x25,0x00,0x20,
+0xa6,0x27,0x00,0x18,0x8c,0x66,0x00,0x08,0x02,0x20,0x20,0x21,0x0c,0x00,0x0f,0x15,
+0x00,0x00,0x28,0x21,0x86,0x25,0x00,0x18,0x8e,0x26,0x00,0x1c,0x8e,0x27,0x00,0x20,
+0x02,0x20,0x20,0x21,0x0c,0x00,0x1c,0x86,0xaf,0xa2,0x00,0x10,0x08,0x00,0x0e,0x45,
+0xa2,0x02,0x00,0x12,0x92,0x22,0x00,0x08,0x08,0x00,0x0e,0x45,0xa2,0x22,0x00,0x09,
+0xa2,0x20,0x00,0x11,0x80,0x82,0x00,0x50,0x00,0x00,0x00,0x00,0x10,0x40,0x00,0x03,
+0x3c,0x02,0xb0,0x03,0x34,0x42,0x00,0xd0,0xac,0x40,0x00,0x00,0x08,0x00,0x0e,0x45,
+0xa0,0x80,0x00,0x50,0x94,0x8a,0x00,0x0c,0x24,0x03,0x00,0x24,0x00,0x80,0x70,0x21,
+0x3c,0x02,0x80,0x00,0x3c,0x04,0xb0,0x03,0x24,0x42,0x3c,0x54,0xf1,0x43,0x00,0x06,
+0x34,0x84,0x00,0x20,0x00,0x00,0x18,0x12,0x00,0xa0,0x68,0x21,0xac,0x82,0x00,0x00,
+0x27,0x85,0x90,0x00,0x27,0x82,0x8f,0xff,0x27,0xbd,0xff,0xf8,0x00,0x62,0x60,0x21,
+0x00,0x65,0x58,0x21,0x00,0x00,0xc0,0x21,0x11,0xa0,0x00,0xcc,0x00,0x00,0x78,0x21,
+0x00,0x0a,0x1c,0x00,0x00,0x03,0x1c,0x03,0x00,0x03,0x10,0xc0,0x00,0x43,0x10,0x21,
+0x00,0x02,0x10,0x80,0x00,0x45,0x10,0x21,0x91,0x87,0x00,0x00,0x80,0x48,0x00,0x04,
+0x03,0xa0,0x60,0x21,0x00,0x0a,0x1c,0x00,0x00,0x03,0x1c,0x03,0x00,0x03,0x10,0xc0,
+0x00,0x43,0x10,0x21,0x00,0x02,0x48,0x80,0x27,0x83,0x8f,0xf4,0xa3,0xa7,0x00,0x00,
+0x01,0x23,0x18,0x21,0x8c,0x64,0x00,0x18,0x25,0x02,0xff,0xff,0x00,0x48,0x40,0x0b,
+0x8c,0x83,0x00,0x04,0x2d,0x05,0x00,0x07,0x24,0x02,0x00,0x06,0x30,0x63,0x00,0x08,
+0x14,0x60,0x00,0x35,0x00,0x45,0x40,0x0a,0x93,0xa7,0x00,0x00,0x27,0x82,0x90,0x08,
+0x01,0x22,0x10,0x21,0x30,0xe3,0x00,0xf0,0x38,0x63,0x00,0x50,0x30,0xe5,0x00,0xff,
+0x00,0x05,0x20,0x2b,0x00,0x03,0x18,0x2b,0x00,0x64,0x18,0x24,0x90,0x49,0x00,0x00,
+0x10,0x60,0x00,0x16,0x30,0xe4,0x00,0x0f,0x24,0x02,0x00,0x04,0x10,0xa2,0x00,0x9d,
+0x00,0x00,0x00,0x00,0x11,0xa0,0x00,0x3a,0x2c,0xa2,0x00,0x0c,0x10,0x40,0x00,0x02,
+0x24,0x84,0x00,0x0c,0x00,0xe0,0x20,0x21,0x30,0x84,0x00,0xff,0x00,0x04,0x10,0x40,
+0x27,0x83,0xbb,0x0c,0x00,0x44,0x10,0x21,0x00,0x43,0x10,0x21,0x90,0x47,0x00,0x00,
+0x00,0x00,0x00,0x00,0x2c,0xe3,0x00,0x0c,0xa3,0xa7,0x00,0x00,0x10,0x60,0x00,0x02,
+0x24,0xe2,0x00,0x04,0x00,0xe0,0x10,0x21,0xa3,0xa2,0x00,0x00,0x91,0x65,0x00,0x00,
+0x91,0x82,0x00,0x00,0x30,0xa3,0x00,0xff,0x00,0x62,0x10,0x2b,0x10,0x40,0x00,0x0e,
+0x2c,0x62,0x00,0x0c,0x14,0x40,0x00,0x03,0x00,0x60,0x20,0x21,0x30,0xa2,0x00,0x0f,
+0x24,0x44,0x00,0x0c,0x00,0x04,0x10,0x40,0x00,0x44,0x20,0x21,0x27,0x83,0xbb,0x0c,
+0x00,0x83,0x18,0x21,0x90,0x62,0x00,0x02,0x00,0x00,0x00,0x00,0x10,0x40,0x00,0x05,
+0x00,0x09,0x11,0x00,0xa1,0x85,0x00,0x00,0x93,0xa2,0x00,0x00,0x03,0xe0,0x00,0x08,
+0x27,0xbd,0x00,0x08,0x00,0x49,0x10,0x23,0x00,0x02,0x10,0x80,0x00,0x49,0x10,0x23,
+0x00,0x02,0x10,0x80,0x00,0x44,0x10,0x21,0x27,0x83,0xb4,0x98,0x00,0x43,0x10,0x21,
+0x90,0x44,0x00,0x00,0x00,0x00,0x00,0x00,0x2c,0x83,0x00,0x0c,0x14,0x60,0x00,0x06,
+0x00,0x80,0x10,0x21,0x00,0x18,0x10,0x40,0x00,0x4f,0x10,0x21,0x00,0x02,0x11,0x00,
+0x00,0x82,0x10,0x21,0x24,0x42,0x00,0x04,0x08,0x00,0x0f,0x76,0xa1,0x82,0x00,0x00,
+0x8f,0x8d,0x81,0x5c,0x00,0x00,0x00,0x00,0x01,0xa8,0x10,0x21,0x90,0x43,0x00,0x00,
+0x00,0x00,0x00,0x00,0x10,0x60,0xff,0xd1,0x00,0x00,0x28,0x21,0x00,0x06,0x74,0x82,
+0x30,0xe2,0x00,0xff,0x2c,0x42,0x00,0x0c,0x14,0x40,0x00,0x03,0x00,0xe0,0x10,0x21,
+0x30,0xe2,0x00,0x0f,0x24,0x42,0x00,0x0c,0x30,0x44,0x00,0xff,0xa3,0xa2,0x00,0x00,
+0x24,0x02,0x00,0x0c,0x10,0x82,0x00,0x0d,0x00,0x09,0x11,0x00,0x00,0x49,0x10,0x23,
+0x00,0x02,0x10,0x80,0x00,0x04,0x18,0x40,0x00,0x49,0x10,0x23,0x00,0x64,0x18,0x21,
+0x00,0x02,0x10,0x80,0x00,0x43,0x10,0x21,0x27,0x84,0xb4,0x98,0x00,0x44,0x10,0x21,
+0x90,0x47,0x00,0x00,0x00,0x00,0x00,0x00,0xa3,0xa7,0x00,0x00,0x00,0x0a,0x1c,0x00,
+0x00,0x03,0x1c,0x03,0x00,0x03,0x10,0xc0,0x00,0x43,0x10,0x21,0x00,0x02,0x10,0x80,
+0x27,0x83,0x8f,0xf4,0x00,0x43,0x10,0x21,0x8c,0x44,0x00,0x18,0x00,0x00,0x00,0x00,
+0x8c,0x83,0x00,0x04,0x00,0x00,0x00,0x00,0x30,0x63,0x00,0x10,0x14,0x60,0x00,0x33,
+0x00,0x06,0x14,0x42,0x00,0x09,0x11,0x00,0x00,0x49,0x10,0x23,0x00,0x02,0x10,0x80,
+0x00,0x49,0x10,0x23,0x27,0x83,0xb5,0x68,0x00,0x02,0x10,0x80,0x00,0x43,0x10,0x21,
+0x90,0x44,0x00,0x04,0x90,0x43,0x00,0x05,0x00,0x00,0x00,0x00,0x00,0x64,0xc0,0x24,
+0x93,0xa7,0x00,0x00,0x00,0x00,0x00,0x00,0x2c,0xe2,0x00,0x0f,0x10,0x40,0x00,0x0f,
+0x31,0xcf,0x00,0x01,0x00,0x0a,0x1c,0x00,0x00,0x03,0x1c,0x03,0x00,0x03,0x10,0xc0,
+0x00,0x43,0x10,0x21,0x00,0x02,0x10,0x80,0x27,0x84,0x8f,0xf0,0x00,0x44,0x10,0x21,
+0x84,0x43,0x00,0x06,0x00,0x00,0x00,0x00,0x28,0x63,0x06,0x41,0x14,0x60,0x00,0x04,
+0x30,0xe2,0x00,0xff,0x24,0x07,0x00,0x0f,0xa3,0xa7,0x00,0x00,0x30,0xe2,0x00,0xff,
+0x2c,0x42,0x00,0x0c,0x14,0x40,0x00,0x06,0x00,0xe0,0x10,0x21,0x00,0x18,0x10,0x40,
+0x00,0x4f,0x10,0x21,0x00,0x02,0x11,0x00,0x00,0x47,0x10,0x21,0x24,0x42,0x00,0x04,
+0xa3,0xa2,0x00,0x00,0x00,0x40,0x38,0x21,0x01,0xa8,0x10,0x21,0x90,0x43,0x00,0x00,
+0x24,0xa4,0x00,0x01,0x30,0x85,0xff,0xff,0x00,0xa3,0x18,0x2b,0x14,0x60,0xff,0xad,
+0x30,0xe2,0x00,0xff,0x08,0x00,0x0f,0x63,0x00,0x00,0x00,0x00,0x08,0x00,0x0f,0xc4,
+0x30,0x58,0x00,0x01,0x81,0xc2,0x00,0x48,0x00,0x00,0x00,0x00,0x10,0x40,0xff,0x73,
+0x00,0x00,0x00,0x00,0x08,0x00,0x0f,0x51,0x00,0x00,0x00,0x00,0x00,0x0a,0x1c,0x00,
+0x00,0x03,0x1c,0x03,0x00,0x03,0x10,0xc0,0x00,0x43,0x10,0x21,0x00,0x02,0x10,0x80,
+0x00,0x45,0x10,0x21,0x80,0x48,0x00,0x05,0x91,0x67,0x00,0x00,0x08,0x00,0x0f,0x31,
+0x03,0xa0,0x58,0x21,0x3c,0x03,0xb0,0x03,0x3c,0x02,0x80,0x00,0x34,0x63,0x00,0x20,
+0x24,0x42,0x3f,0xf4,0x03,0xe0,0x00,0x08,0xac,0x62,0x00,0x00,0x27,0xbd,0xff,0xc0,
+0xaf,0xb7,0x00,0x34,0xaf,0xb6,0x00,0x30,0xaf,0xb5,0x00,0x2c,0xaf,0xb4,0x00,0x28,
+0xaf,0xb3,0x00,0x24,0xaf,0xb2,0x00,0x20,0xaf,0xbf,0x00,0x3c,0xaf,0xbe,0x00,0x38,
+0xaf,0xb1,0x00,0x1c,0xaf,0xb0,0x00,0x18,0x84,0x82,0x00,0x0c,0x27,0x93,0x8f,0xf4,
+0x3c,0x05,0xb0,0x03,0x00,0x02,0x18,0xc0,0x00,0x62,0x18,0x21,0x00,0x03,0x18,0x80,
+0x00,0x73,0x10,0x21,0x8c,0x5e,0x00,0x18,0x3c,0x02,0x80,0x00,0x34,0xa5,0x00,0x20,
+0x24,0x42,0x40,0x0c,0xac,0xa2,0x00,0x00,0x8f,0xd0,0x00,0x08,0x27,0x95,0x90,0x00,
+0x00,0x75,0x18,0x21,0x00,0x00,0x28,0x21,0x02,0x00,0x30,0x21,0x90,0x71,0x00,0x00,
+0x0c,0x00,0x0f,0x15,0x00,0x80,0xb0,0x21,0x00,0x40,0x90,0x21,0x00,0x10,0x14,0x42,
+0x30,0x54,0x00,0x01,0x02,0x40,0x20,0x21,0x00,0x10,0x14,0x82,0x02,0x80,0x28,0x21,
+0x12,0x51,0x00,0x23,0x00,0x10,0xbf,0xc2,0x86,0xc3,0x00,0x0c,0x30,0x50,0x00,0x01,
+0x00,0x03,0x10,0xc0,0x00,0x43,0x10,0x21,0x00,0x02,0x10,0x80,0x00,0x55,0x10,0x21,
+0xa0,0x52,0x00,0x00,0x86,0xc3,0x00,0x0c,0x00,0x00,0x00,0x00,0x00,0x03,0x10,0xc0,
+0x00,0x43,0x10,0x21,0x00,0x02,0x10,0x80,0x00,0x53,0x30,0x21,0x8c,0xc7,0x00,0x18,
+0x27,0x83,0x8f,0xf0,0x00,0x43,0x10,0x21,0x8c,0xe3,0x00,0x04,0x84,0x46,0x00,0x06,
+0x00,0x03,0x19,0x42,0x0c,0x00,0x08,0xdf,0x30,0x73,0x00,0x01,0x00,0x40,0x88,0x21,
+0x02,0x40,0x20,0x21,0x02,0x80,0x28,0x21,0x16,0xe0,0x00,0x10,0x02,0x00,0x30,0x21,
+0x86,0xc2,0x00,0x0c,0x00,0x00,0x00,0x00,0x00,0x02,0x18,0xc0,0x00,0x62,0x18,0x21,
+0x00,0x03,0x18,0x80,0x27,0x82,0x8f,0xf8,0x00,0x62,0x18,0x21,0xa4,0x71,0x00,0x04,
+0x7b,0xbe,0x01,0xfc,0x7b,0xb6,0x01,0xbc,0x7b,0xb4,0x01,0x7c,0x7b,0xb2,0x01,0x3c,
+0x7b,0xb0,0x00,0xfc,0x03,0xe0,0x00,0x08,0x27,0xbd,0x00,0x40,0x86,0xc3,0x00,0x0c,
+0xaf,0xb3,0x00,0x10,0xaf,0xa0,0x00,0x14,0x00,0x03,0x10,0xc0,0x00,0x43,0x10,0x21,
+0x00,0x02,0x10,0x80,0x00,0x55,0x10,0x21,0x80,0x47,0x00,0x06,0x00,0x00,0x00,0x00,
+0x24,0xe7,0x00,0x02,0x00,0x07,0x17,0xc2,0x00,0xe2,0x38,0x21,0x00,0x07,0x38,0x43,
+0x00,0x07,0x38,0x40,0x0c,0x00,0x09,0x06,0x03,0xc7,0x38,0x21,0x08,0x00,0x10,0x44,
+0x02,0x22,0x88,0x21,0x3c,0x03,0xb0,0x03,0x3c,0x02,0x80,0x00,0x27,0xbd,0xff,0xd0,
+0x34,0x63,0x00,0x20,0x24,0x42,0x41,0x94,0xaf,0xb2,0x00,0x20,0xac,0x62,0x00,0x00,
+0xaf,0xbf,0x00,0x28,0xaf,0xb3,0x00,0x24,0xaf,0xb1,0x00,0x1c,0xaf,0xb0,0x00,0x18,
+0x3c,0x02,0xb0,0x03,0x90,0x83,0x00,0x0a,0x34,0x42,0x01,0x04,0x94,0x45,0x00,0x00,
+0x00,0x03,0x18,0x80,0x27,0x82,0xb3,0xf0,0x00,0x62,0x18,0x21,0x30,0xa6,0xff,0xff,
+0x8c,0x71,0x00,0x00,0x80,0x85,0x00,0x12,0x30,0xc9,0x00,0xff,0x00,0x06,0x32,0x02,
+0xa4,0x86,0x00,0x44,0xa4,0x89,0x00,0x46,0x82,0x22,0x00,0x12,0x00,0x80,0x90,0x21,
+0x10,0xa0,0x00,0x1b,0xa0,0x80,0x00,0x15,0x00,0xc5,0x10,0x2a,0x10,0x40,0x00,0x14,
+0x00,0x00,0x00,0x00,0xa2,0x20,0x00,0x19,0x84,0x83,0x00,0x0c,0x00,0x00,0x00,0x00,
+0x00,0x03,0x10,0xc0,0x00,0x43,0x10,0x21,0x00,0x02,0x10,0x80,0x27,0x83,0x90,0x10,
+0x00,0x43,0x10,0x21,0xa0,0x40,0x00,0x00,0xa0,0x80,0x00,0x12,0x92,0x22,0x00,0x16,
+0x00,0x00,0x00,0x00,0x30,0x42,0x00,0xdf,0xa2,0x22,0x00,0x16,0x8f,0xbf,0x00,0x28,
+0x7b,0xb2,0x01,0x3c,0x7b,0xb0,0x00,0xfc,0x03,0xe0,0x00,0x08,0x27,0xbd,0x00,0x30,
+0x0c,0x00,0x0f,0xfd,0x00,0x00,0x00,0x00,0x08,0x00,0x10,0x93,0x00,0x00,0x00,0x00,
+0x28,0x42,0x00,0x02,0x10,0x40,0x01,0x76,0x00,0x00,0x28,0x21,0x94,0x87,0x00,0x0c,
+0x00,0x00,0x00,0x00,0x00,0xe0,0x10,0x21,0x00,0x02,0x14,0x00,0x00,0x02,0x14,0x03,
+0x00,0x07,0x24,0x00,0x00,0x04,0x24,0x03,0x00,0x02,0x18,0xc0,0x00,0x62,0x18,0x21,
+0x00,0x04,0x28,0xc0,0x00,0xa4,0x28,0x21,0x27,0x82,0x90,0x10,0x00,0x03,0x18,0x80,
+0x00,0x62,0x18,0x21,0x00,0x05,0x28,0x80,0x27,0x82,0x8f,0xf8,0x00,0xa2,0x10,0x21,
+0x8c,0x68,0x00,0x00,0x80,0x44,0x00,0x06,0x27,0x82,0x90,0x00,0x00,0x08,0x1d,0x02,
+0x00,0xa2,0x28,0x21,0x38,0x84,0x00,0x00,0x30,0x63,0x00,0x01,0x01,0x24,0x30,0x0b,
+0x80,0xaa,0x00,0x04,0x80,0xa9,0x00,0x05,0x10,0x60,0x00,0x02,0x00,0x08,0x14,0x02,
+0x30,0x46,0x00,0x0f,0x15,0x20,0x00,0x28,0x01,0x49,0x10,0x21,0x15,0x40,0x00,0x11,
+0x30,0xe3,0xff,0xff,0x92,0x45,0x00,0x08,0x00,0x00,0x00,0x00,0x30,0xa8,0x00,0xff,
+0x2d,0x02,0x00,0x04,0x10,0x40,0x01,0x46,0x2d,0x02,0x00,0x10,0x3c,0x04,0xb0,0x05,
+0x34,0x84,0x02,0x29,0x90,0x83,0x00,0x00,0x24,0x02,0x00,0x01,0x01,0x02,0x10,0x04,
+0x00,0x62,0x18,0x25,0xa0,0x83,0x00,0x00,0x96,0x47,0x00,0x0c,0x00,0x00,0x00,0x00,
+0x30,0xe3,0xff,0xff,0x00,0x03,0x10,0xc0,0x00,0x43,0x10,0x21,0x27,0x84,0x90,0x00,
+0x00,0x02,0x10,0x80,0x00,0x44,0x10,0x21,0x80,0x45,0x00,0x06,0x00,0x03,0x1a,0x00,
+0x3c,0x04,0xb0,0x00,0x00,0x65,0x18,0x21,0x00,0x64,0x20,0x21,0x94,0x82,0x00,0x00,
+0x82,0x43,0x00,0x10,0x00,0x02,0x14,0x00,0x14,0x60,0x00,0x06,0x00,0x02,0x3c,0x03,
+0x30,0xe2,0x00,0x04,0x14,0x40,0x00,0x04,0x01,0x49,0x10,0x21,0x34,0xe2,0x08,0x00,
+0xa4,0x82,0x00,0x00,0x01,0x49,0x10,0x21,0x00,0x02,0x16,0x00,0x00,0x02,0x16,0x03,
+0x00,0x46,0x10,0x2a,0x10,0x40,0x00,0x7c,0x00,0x00,0x00,0x00,0x82,0x42,0x00,0x10,
+0x00,0x00,0x00,0x00,0x10,0x40,0x00,0x0e,0x00,0x00,0x00,0x00,0x86,0x43,0x00,0x0c,
+0x25,0x44,0x00,0x01,0x00,0x03,0x10,0xc0,0x00,0x43,0x10,0x21,0x00,0x02,0x10,0x80,
+0x27,0x83,0x90,0x00,0x00,0x43,0x10,0x21,0xa0,0x44,0x00,0x04,0x92,0x23,0x00,0x16,
+0x02,0x40,0x20,0x21,0x30,0x63,0x00,0xfb,0x08,0x00,0x10,0x98,0xa2,0x23,0x00,0x16,
+0x86,0x43,0x00,0x0c,0x25,0x24,0x00,0x01,0x00,0x03,0x10,0xc0,0x00,0x43,0x10,0x21,
+0x00,0x02,0x10,0x80,0x27,0x83,0x90,0x00,0x00,0x43,0x10,0x21,0xa0,0x44,0x00,0x05,
+0x86,0x45,0x00,0x0c,0x0c,0x00,0x1f,0x08,0x02,0x20,0x20,0x21,0x10,0x40,0x00,0x5a,
+0x00,0x00,0x00,0x00,0x92,0x45,0x00,0x08,0x00,0x00,0x00,0x00,0x30,0xa6,0x00,0xff,
+0x2c,0xc2,0x00,0x04,0x10,0x40,0x00,0x4c,0x2c,0xc2,0x00,0x10,0x3c,0x04,0xb0,0x05,
+0x34,0x84,0x02,0x29,0x90,0x83,0x00,0x00,0x24,0x02,0x00,0x01,0x00,0xc2,0x10,0x04,
+0x00,0x02,0x10,0x27,0x00,0x62,0x18,0x24,0xa0,0x83,0x00,0x00,0x92,0x45,0x00,0x08,
+0x00,0x00,0x00,0x00,0x30,0xa5,0x00,0xff,0x14,0xa0,0x00,0x33,0x24,0x02,0x00,0x01,
+0xa2,0x40,0x00,0x04,0x92,0x22,0x00,0x04,0x00,0x00,0x00,0x00,0x14,0x40,0x00,0x0c,
+0x24,0x02,0x00,0x01,0xa2,0x22,0x00,0x17,0x92,0x22,0x00,0x17,0x00,0x00,0x00,0x00,
+0x10,0x40,0x00,0x04,0x00,0x00,0x00,0x00,0x96,0x22,0x00,0x06,0x08,0x00,0x10,0x93,
+0xa6,0x22,0x00,0x14,0x96,0x22,0x00,0x00,0x08,0x00,0x10,0x93,0xa6,0x22,0x00,0x14,
+0x92,0x22,0x00,0x0a,0x00,0x00,0x00,0x00,0x14,0x40,0x00,0x03,0x00,0x00,0x00,0x00,
+0x08,0x00,0x11,0x22,0xa2,0x20,0x00,0x17,0x96,0x24,0x00,0x00,0x96,0x25,0x00,0x06,
+0x27,0x86,0x8f,0xf0,0x00,0x04,0x18,0xc0,0x00,0x64,0x18,0x21,0x00,0x05,0x10,0xc0,
+0x00,0x45,0x10,0x21,0x00,0x03,0x18,0x80,0x00,0x66,0x18,0x21,0x00,0x02,0x10,0x80,
+0x00,0x46,0x10,0x21,0x8c,0x65,0x00,0x08,0x8c,0x44,0x00,0x08,0x3c,0x03,0x80,0x00,
+0x00,0xa3,0x30,0x24,0x10,0xc0,0x00,0x08,0x00,0x83,0x10,0x24,0x10,0x40,0x00,0x04,
+0x00,0x00,0x18,0x21,0x10,0xc0,0x00,0x02,0x24,0x03,0x00,0x01,0x00,0x85,0x18,0x2b,
+0x08,0x00,0x11,0x22,0xa2,0x23,0x00,0x17,0x10,0x40,0xff,0xfd,0x00,0x85,0x18,0x2b,
+0x08,0x00,0x11,0x45,0x00,0x00,0x00,0x00,0x10,0xa2,0x00,0x09,0x24,0x02,0x00,0x02,
+0x10,0xa2,0x00,0x05,0x24,0x02,0x00,0x03,0x14,0xa2,0xff,0xca,0x00,0x00,0x00,0x00,
+0x08,0x00,0x11,0x1d,0xa2,0x40,0x00,0x07,0x08,0x00,0x11,0x1d,0xa2,0x40,0x00,0x06,
+0x08,0x00,0x11,0x1d,0xa2,0x40,0x00,0x05,0x14,0x40,0xff,0xbe,0x3c,0x04,0xb0,0x05,
+0x34,0x84,0x02,0x29,0x90,0x83,0x00,0x00,0x30,0xa5,0x00,0x0f,0x24,0x02,0x00,0x80,
+0x08,0x00,0x11,0x14,0x00,0xa2,0x10,0x07,0x0c,0x00,0x10,0x03,0x02,0x40,0x20,0x21,
+0x08,0x00,0x10,0x93,0x00,0x00,0x00,0x00,0x92,0x45,0x00,0x08,0x00,0x00,0x00,0x00,
+0x30,0xa6,0x00,0xff,0x2c,0xc2,0x00,0x04,0x10,0x40,0x00,0x99,0x2c,0xc2,0x00,0x10,
+0x3c,0x04,0xb0,0x05,0x34,0x84,0x02,0x29,0x90,0x83,0x00,0x00,0x24,0x02,0x00,0x01,
+0x00,0xc2,0x10,0x04,0x00,0x02,0x10,0x27,0x00,0x62,0x18,0x24,0xa0,0x83,0x00,0x00,
+0x92,0x45,0x00,0x08,0x00,0x00,0x00,0x00,0x30,0xa5,0x00,0xff,0x14,0xa0,0x00,0x80,
+0x24,0x02,0x00,0x01,0xa2,0x40,0x00,0x04,0x86,0x43,0x00,0x0c,0x27,0x93,0x8f,0xf4,
+0x96,0x47,0x00,0x0c,0x00,0x03,0x10,0xc0,0x00,0x43,0x10,0x21,0x00,0x02,0x28,0x80,
+0x00,0xb3,0x18,0x21,0x8c,0x64,0x00,0x18,0x00,0x00,0x00,0x00,0x8c,0x82,0x00,0x04,
+0x00,0x00,0x00,0x00,0x30,0x42,0x00,0x10,0x10,0x40,0x00,0x64,0x00,0x00,0x30,0x21,
+0x00,0x07,0x1c,0x00,0x00,0x03,0x1c,0x03,0x00,0x03,0x10,0xc0,0x00,0x43,0x10,0x21,
+0x00,0x02,0x10,0x80,0x00,0x53,0x10,0x21,0x8c,0x43,0x00,0x18,0x93,0x82,0x8b,0x61,
+0x8c,0x64,0x00,0x04,0x30,0x42,0x00,0x01,0x00,0x04,0x21,0x42,0x14,0x40,0x00,0x4d,
+0x30,0x90,0x00,0x01,0x00,0x07,0x2c,0x00,0x00,0x05,0x2c,0x03,0x0c,0x00,0x1b,0x84,
+0x02,0x20,0x20,0x21,0x96,0x26,0x00,0x06,0x12,0x00,0x00,0x14,0x30,0xc5,0xff,0xff,
+0x02,0x60,0x90,0x21,0x00,0x05,0x10,0xc0,0x00,0x45,0x10,0x21,0x00,0x02,0x10,0x80,
+0x00,0x52,0x18,0x21,0x92,0x22,0x00,0x0a,0x00,0x00,0x00,0x00,0x10,0x40,0x00,0x0b,
+0x02,0x20,0x20,0x21,0x8c,0x63,0x00,0x18,0x00,0x00,0x00,0x00,0x8c,0x62,0x00,0x04,
+0x00,0x00,0x00,0x00,0x00,0x02,0x11,0x42,0x0c,0x00,0x1b,0x84,0x30,0x50,0x00,0x01,
+0x96,0x26,0x00,0x06,0x16,0x00,0xff,0xef,0x30,0xc5,0xff,0xff,0x92,0x22,0x00,0x04,
+0x00,0x00,0x00,0x00,0x14,0x40,0x00,0x0d,0x24,0x02,0x00,0x01,0xa2,0x22,0x00,0x17,
+0x92,0x22,0x00,0x17,0x00,0x00,0x00,0x00,0x10,0x40,0x00,0x05,0x00,0x00,0x00,0x00,
+0xa6,0x26,0x00,0x14,0x92,0x22,0x00,0x16,0x08,0x00,0x10,0x92,0x30,0x42,0x00,0xc3,
+0x96,0x22,0x00,0x00,0x08,0x00,0x11,0xb9,0xa6,0x22,0x00,0x14,0x92,0x22,0x00,0x0a,
+0x00,0x00,0x00,0x00,0x14,0x40,0x00,0x03,0x00,0x00,0x00,0x00,0x08,0x00,0x11,0xb4,
+0xa2,0x20,0x00,0x17,0x96,0x24,0x00,0x00,0x30,0xc5,0xff,0xff,0x00,0x05,0x18,0xc0,
+0x00,0x04,0x10,0xc0,0x00,0x44,0x10,0x21,0x00,0x65,0x18,0x21,0x27,0x84,0x8f,0xf0,
+0x00,0x02,0x10,0x80,0x00,0x44,0x10,0x21,0x00,0x03,0x18,0x80,0x8c,0x45,0x00,0x08,
+0x00,0x64,0x18,0x21,0x8c,0x64,0x00,0x08,0x3c,0x02,0x80,0x00,0x00,0xa2,0x38,0x24,
+0x10,0xe0,0x00,0x08,0x00,0x82,0x10,0x24,0x10,0x40,0x00,0x04,0x00,0x00,0x18,0x21,
+0x10,0xe0,0x00,0x02,0x24,0x03,0x00,0x01,0x00,0x85,0x18,0x2b,0x08,0x00,0x11,0xb4,
+0xa2,0x23,0x00,0x17,0x10,0x40,0xff,0xfd,0x00,0x85,0x18,0x2b,0x08,0x00,0x11,0xd8,
+0x00,0x00,0x00,0x00,0x24,0x05,0x00,0x24,0xf0,0xe5,0x00,0x06,0x00,0x00,0x28,0x12,
+0x27,0x82,0x8f,0xf0,0x00,0xa2,0x28,0x21,0x0c,0x00,0x01,0x4b,0x00,0x00,0x20,0x21,
+0x96,0x47,0x00,0x0c,0x08,0x00,0x11,0x96,0x00,0x07,0x2c,0x00,0x27,0x83,0x90,0x00,
+0x27,0x82,0x90,0x08,0x00,0xa2,0x10,0x21,0x00,0xa3,0x18,0x21,0x90,0x44,0x00,0x00,
+0x90,0x65,0x00,0x05,0x93,0x82,0x80,0x10,0x24,0x07,0x00,0x01,0x0c,0x00,0x21,0xf5,
+0xaf,0xa2,0x00,0x10,0x96,0x47,0x00,0x0c,0x08,0x00,0x11,0x89,0x00,0x07,0x1c,0x00,
+0x10,0xa2,0x00,0x09,0x24,0x02,0x00,0x02,0x10,0xa2,0x00,0x05,0x24,0x02,0x00,0x03,
+0x14,0xa2,0xff,0x7d,0x00,0x00,0x00,0x00,0x08,0x00,0x11,0x7a,0xa2,0x40,0x00,0x07,
+0x08,0x00,0x11,0x7a,0xa2,0x40,0x00,0x06,0x08,0x00,0x11,0x7a,0xa2,0x40,0x00,0x05,
+0x14,0x40,0xff,0x71,0x3c,0x04,0xb0,0x05,0x34,0x84,0x02,0x29,0x90,0x83,0x00,0x00,
+0x30,0xa5,0x00,0x0f,0x24,0x02,0x00,0x80,0x08,0x00,0x11,0x71,0x00,0xa2,0x10,0x07,
+0x14,0x40,0xfe,0xc3,0x3c,0x04,0xb0,0x05,0x34,0x84,0x02,0x29,0x90,0x83,0x00,0x00,
+0x30,0xa5,0x00,0x0f,0x24,0x02,0x00,0x80,0x08,0x00,0x10,0xcc,0x00,0xa2,0x10,0x07,
+0x84,0x83,0x00,0x0c,0x00,0x00,0x00,0x00,0x00,0x03,0x10,0xc0,0x00,0x43,0x10,0x21,
+0x00,0x02,0x10,0x80,0x27,0x83,0x8f,0xf4,0x00,0x43,0x10,0x21,0x8c,0x47,0x00,0x18,
+0x00,0x00,0x00,0x00,0x8c,0xe6,0x00,0x08,0x0c,0x00,0x0f,0x15,0x00,0x00,0x00,0x00,
+0x02,0x40,0x20,0x21,0x00,0x00,0x28,0x21,0x00,0x00,0x30,0x21,0x00,0x00,0x38,0x21,
+0x0c,0x00,0x1c,0x86,0xaf,0xa2,0x00,0x10,0x00,0x02,0x1e,0x00,0x14,0x60,0xfe,0x6b,
+0xa2,0x22,0x00,0x12,0x92,0x43,0x00,0x08,0x00,0x00,0x00,0x00,0x14,0x60,0x00,0x40,
+0x24,0x02,0x00,0x01,0xa2,0x40,0x00,0x04,0x92,0x28,0x00,0x04,0x00,0x00,0x00,0x00,
+0x15,0x00,0x00,0x19,0x24,0x02,0x00,0x01,0x92,0x27,0x00,0x0a,0xa2,0x22,0x00,0x17,
+0x92,0x22,0x00,0x17,0x00,0x00,0x00,0x00,0x10,0x40,0x00,0x10,0x00,0x00,0x00,0x00,
+0x96,0x22,0x00,0x06,0x00,0x00,0x00,0x00,0xa6,0x22,0x00,0x14,0x92,0x22,0x00,0x16,
+0x30,0xe3,0x00,0xff,0x30,0x42,0x00,0xc0,0x10,0x60,0x00,0x03,0xa2,0x22,0x00,0x16,
+0x34,0x42,0x00,0x01,0xa2,0x22,0x00,0x16,0x11,0x00,0xfe,0x50,0x00,0x00,0x00,0x00,
+0x92,0x22,0x00,0x16,0x08,0x00,0x10,0x92,0x34,0x42,0x00,0x02,0x96,0x22,0x00,0x00,
+0x08,0x00,0x12,0x3b,0xa6,0x22,0x00,0x14,0x92,0x27,0x00,0x0a,0x00,0x00,0x00,0x00,
+0x14,0xe0,0x00,0x03,0x00,0x00,0x00,0x00,0x08,0x00,0x12,0x34,0xa2,0x20,0x00,0x17,
+0x96,0x24,0x00,0x00,0x96,0x25,0x00,0x06,0x27,0x86,0x8f,0xf0,0x00,0x04,0x18,0xc0,
+0x00,0x64,0x18,0x21,0x00,0x05,0x10,0xc0,0x00,0x45,0x10,0x21,0x00,0x03,0x18,0x80,
+0x00,0x66,0x18,0x21,0x00,0x02,0x10,0x80,0x00,0x46,0x10,0x21,0x8c,0x65,0x00,0x08,
+0x8c,0x44,0x00,0x08,0x3c,0x03,0x80,0x00,0x00,0xa3,0x30,0x24,0x10,0xc0,0x00,0x08,
+0x00,0x83,0x10,0x24,0x10,0x40,0x00,0x04,0x00,0x00,0x18,0x21,0x10,0xc0,0x00,0x02,
+0x24,0x03,0x00,0x01,0x00,0x85,0x18,0x2b,0x08,0x00,0x12,0x34,0xa2,0x23,0x00,0x17,
+0x10,0x40,0xff,0xfd,0x00,0x85,0x18,0x2b,0x08,0x00,0x12,0x63,0x00,0x00,0x00,0x00,
+0x10,0x62,0x00,0x09,0x24,0x02,0x00,0x02,0x10,0x62,0x00,0x05,0x24,0x02,0x00,0x03,
+0x14,0x62,0xff,0xbd,0x00,0x00,0x00,0x00,0x08,0x00,0x12,0x2e,0xa2,0x40,0x00,0x07,
+0x08,0x00,0x12,0x2e,0xa2,0x40,0x00,0x06,0x08,0x00,0x12,0x2e,0xa2,0x40,0x00,0x05,
+0x3c,0x02,0x80,0x00,0x00,0x82,0x30,0x24,0x10,0xc0,0x00,0x08,0x00,0xa2,0x18,0x24,
+0x10,0x60,0x00,0x04,0x00,0x00,0x10,0x21,0x10,0xc0,0x00,0x02,0x24,0x02,0x00,0x01,
+0x00,0xa4,0x10,0x2b,0x03,0xe0,0x00,0x08,0x00,0x00,0x00,0x00,0x10,0x60,0xff,0xfd,
+0x00,0xa4,0x10,0x2b,0x08,0x00,0x12,0x7e,0x00,0x00,0x00,0x00,0x30,0x82,0xff,0xff,
+0x00,0x02,0x18,0xc0,0x00,0x62,0x18,0x21,0x27,0x84,0x90,0x00,0x00,0x03,0x18,0x80,
+0x00,0x64,0x18,0x21,0x80,0x66,0x00,0x06,0x00,0x02,0x12,0x00,0x3c,0x03,0xb0,0x00,
+0x00,0x46,0x10,0x21,0x00,0x45,0x10,0x21,0x03,0xe0,0x00,0x08,0x00,0x43,0x10,0x21,
+0x27,0xbd,0xff,0xe0,0x30,0x82,0x00,0x7c,0x30,0x84,0xff,0x00,0xaf,0xbf,0x00,0x1c,
+0xaf,0xb2,0x00,0x18,0xaf,0xb1,0x00,0x14,0xaf,0xb0,0x00,0x10,0x14,0x40,0x00,0x41,
+0x00,0x04,0x22,0x03,0x24,0x02,0x00,0x04,0x3c,0x10,0xb0,0x03,0x8e,0x10,0x00,0x00,
+0x10,0x82,0x00,0x32,0x24,0x02,0x00,0x08,0x10,0x82,0x00,0x03,0x32,0x02,0x00,0x20,
+0x08,0x00,0x12,0xa4,0x00,0x00,0x00,0x00,0x10,0x40,0x00,0x17,0x3c,0x02,0xb0,0x06,
+0x34,0x42,0x80,0x24,0x8c,0x43,0x00,0x00,0x00,0x00,0x00,0x00,0x30,0x67,0x00,0xff,
+0x10,0xe0,0x00,0x23,0x00,0x00,0x88,0x21,0x8f,0x85,0x8f,0xd0,0x00,0x40,0x30,0x21,
+0x94,0xa2,0x00,0x08,0x8c,0xc3,0x00,0x00,0x26,0x31,0x00,0x01,0x24,0x42,0x00,0x02,
+0x30,0x42,0x01,0xff,0x34,0x63,0x01,0x00,0x02,0x27,0x20,0x2a,0xa4,0xa2,0x00,0x08,
+0x14,0x80,0xff,0xf7,0xac,0xc3,0x00,0x00,0x84,0xa3,0x00,0x08,0x3c,0x02,0xb0,0x03,
+0x34,0x42,0x00,0x30,0xac,0x43,0x00,0x00,0x27,0x92,0xb3,0xf0,0x24,0x11,0x00,0x12,
+0x8e,0x44,0x00,0x00,0x26,0x31,0xff,0xff,0x90,0x82,0x00,0x10,0x00,0x00,0x00,0x00,
+0x10,0x40,0x00,0x03,0x26,0x52,0x00,0x04,0x0c,0x00,0x20,0xd0,0x00,0x00,0x00,0x00,
+0x06,0x21,0xff,0xf7,0x24,0x02,0xff,0xdf,0x02,0x02,0x80,0x24,0x3c,0x01,0xb0,0x03,
+0x0c,0x00,0x13,0x18,0xac,0x30,0x00,0x00,0x08,0x00,0x12,0xa4,0x00,0x00,0x00,0x00,
+0x8f,0x85,0x8f,0xd0,0x08,0x00,0x12,0xba,0x00,0x00,0x00,0x00,0x24,0x02,0xff,0x95,
+0x3c,0x03,0xb0,0x03,0x02,0x02,0x80,0x24,0x34,0x63,0x00,0x30,0x3c,0x01,0xb0,0x03,
+0xac,0x30,0x00,0x00,0x0c,0x00,0x12,0xe1,0xac,0x60,0x00,0x00,0x08,0x00,0x12,0xa4,
+0x00,0x00,0x00,0x00,0x3c,0x02,0xb0,0x03,0x34,0x42,0x00,0x50,0x08,0x00,0x12,0xa4,
+0xac,0x46,0x00,0x00,0x3c,0x0a,0x80,0x00,0x25,0x4a,0x4b,0x84,0x3c,0x0b,0xb0,0x03,
+0xad,0x6a,0x00,0x20,0x3c,0x08,0x80,0x01,0x25,0x08,0x00,0x00,0x3c,0x09,0x80,0x01,
+0x25,0x29,0x03,0x1c,0x11,0x09,0x00,0x10,0x00,0x00,0x00,0x00,0x3c,0x0a,0x80,0x00,
+0x25,0x4a,0x4b,0xac,0x3c,0x0b,0xb0,0x03,0xad,0x6a,0x00,0x20,0x3c,0x08,0xb0,0x06,
+0x35,0x08,0x80,0x10,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x8d,0x09,0x00,0x00,
+0x00,0x00,0x00,0x00,0x31,0x29,0x00,0x01,0x00,0x00,0x00,0x00,0x24,0x01,0x00,0x01,
+0x15,0x21,0xff,0xf2,0x00,0x00,0x00,0x00,0x3c,0x0a,0x80,0x00,0x25,0x4a,0x4b,0xe8,
+0x3c,0x0b,0xb0,0x03,0xad,0x6a,0x00,0x20,0x3c,0x02,0xb0,0x03,0x8c,0x43,0x00,0x00,
+0x00,0x00,0x00,0x00,0x34,0x63,0x00,0x40,0x00,0x00,0x00,0x00,0xac,0x43,0x00,0x00,
+0x00,0x00,0x00,0x00,0x3c,0x0a,0x80,0x00,0x25,0x4a,0x4c,0x14,0x3c,0x0b,0xb0,0x03,
+0xad,0x6a,0x00,0x20,0x3c,0x02,0x80,0x01,0x24,0x42,0x00,0x00,0x3c,0x03,0x80,0x01,
+0x24,0x63,0x03,0x1c,0x3c,0x04,0xb0,0x00,0x8c,0x85,0x00,0x00,0x00,0x00,0x00,0x00,
+0xac,0x45,0x00,0x00,0x24,0x42,0x00,0x04,0x24,0x84,0x00,0x04,0x00,0x43,0x08,0x2a,
+0x14,0x20,0xff,0xf9,0x00,0x00,0x00,0x00,0x0c,0x00,0x13,0x18,0x00,0x00,0x00,0x00,
+0x3c,0x0a,0x80,0x00,0x25,0x4a,0x4c,0x60,0x3c,0x0b,0xb0,0x03,0xad,0x6a,0x00,0x20,
+0x3c,0x02,0x80,0x01,0x24,0x42,0x03,0x20,0x3c,0x03,0x80,0x01,0x24,0x63,0x3f,0x14,
+0xac,0x40,0x00,0x00,0xac,0x40,0x00,0x04,0xac,0x40,0x00,0x08,0xac,0x40,0x00,0x0c,
+0x24,0x42,0x00,0x10,0x00,0x43,0x08,0x2a,0x14,0x20,0xff,0xf9,0x00,0x00,0x00,0x00,
+0x3c,0x0a,0x80,0x00,0x25,0x4a,0x4c,0xa0,0x3c,0x0b,0xb0,0x03,0xad,0x6a,0x00,0x20,
+0x3c,0x1c,0x80,0x01,0x27,0x9c,0x7f,0xf0,0x27,0x9d,0x8b,0xd0,0x00,0x00,0x00,0x00,
+0x27,0x9d,0x8f,0xb8,0x3c,0x0a,0x80,0x00,0x25,0x4a,0x4c,0xc4,0x3c,0x0b,0xb0,0x03,
+0xad,0x6a,0x00,0x20,0x40,0x80,0x68,0x00,0x40,0x08,0x60,0x00,0x00,0x00,0x00,0x00,
+0x35,0x08,0xff,0x01,0x40,0x88,0x60,0x00,0x00,0x00,0x00,0x00,0x0c,0x00,0x15,0x65,
+0x00,0x00,0x00,0x00,0x24,0x84,0xf8,0x00,0x30,0x87,0x00,0x03,0x00,0x04,0x30,0x40,
+0x00,0xc7,0x20,0x23,0x3c,0x02,0xb0,0x0a,0x27,0xbd,0xff,0xe0,0x24,0x03,0xff,0xff,
+0x00,0x82,0x20,0x21,0xaf,0xb1,0x00,0x14,0xac,0x83,0x10,0x00,0xaf,0xbf,0x00,0x18,
+0xaf,0xb0,0x00,0x10,0x00,0xa0,0x88,0x21,0x24,0x03,0x00,0x01,0x8c,0x82,0x10,0x00,
+0x00,0x00,0x00,0x00,0x14,0x43,0xff,0xfd,0x00,0xc7,0x10,0x23,0x3c,0x03,0xb0,0x0a,
+0x00,0x43,0x10,0x21,0x8c,0x50,0x00,0x00,0x0c,0x00,0x13,0x95,0x02,0x20,0x20,0x21,
+0x02,0x11,0x80,0x24,0x00,0x50,0x80,0x06,0x02,0x00,0x10,0x21,0x8f,0xbf,0x00,0x18,
+0x7b,0xb0,0x00,0xbc,0x03,0xe0,0x00,0x08,0x27,0xbd,0x00,0x20,0x27,0xbd,0xff,0xd8,
+0xaf,0xb2,0x00,0x18,0x00,0xa0,0x90,0x21,0x24,0x05,0xff,0xff,0xaf,0xb3,0x00,0x1c,
+0xaf,0xbf,0x00,0x20,0xaf,0xb1,0x00,0x14,0xaf,0xb0,0x00,0x10,0x00,0xc0,0x98,0x21,
+0x12,0x45,0x00,0x23,0x24,0x84,0xf8,0x00,0x30,0x83,0x00,0x03,0x00,0x04,0x10,0x40,
+0x00,0x40,0x88,0x21,0x00,0x60,0x20,0x21,0x00,0x43,0x10,0x23,0x3c,0x03,0xb0,0x0a,
+0x00,0x43,0x10,0x21,0xac,0x45,0x10,0x00,0x00,0x40,0x18,0x21,0x24,0x05,0x00,0x01,
+0x8c,0x62,0x10,0x00,0x00,0x00,0x00,0x00,0x14,0x45,0xff,0xfd,0x3c,0x02,0xb0,0x0a,
+0x02,0x24,0x88,0x23,0x02,0x22,0x88,0x21,0x8e,0x30,0x00,0x00,0x0c,0x00,0x13,0x95,
+0x02,0x40,0x20,0x21,0x00,0x12,0x18,0x27,0x02,0x03,0x80,0x24,0x00,0x53,0x10,0x04,
+0x02,0x02,0x80,0x25,0xae,0x30,0x00,0x00,0x24,0x03,0x00,0x01,0x8e,0x22,0x10,0x00,
+0x00,0x00,0x00,0x00,0x14,0x43,0xff,0xfd,0x00,0x00,0x00,0x00,0x8f,0xbf,0x00,0x20,
+0x7b,0xb2,0x00,0xfc,0x7b,0xb0,0x00,0xbc,0x03,0xe0,0x00,0x08,0x27,0xbd,0x00,0x28,
+0x30,0x82,0x00,0x03,0x00,0x04,0x18,0x40,0x00,0x62,0x18,0x23,0x3c,0x04,0xb0,0x0a,
+0x00,0x64,0x18,0x21,0xac,0x66,0x00,0x00,0x24,0x04,0x00,0x01,0x8c,0x62,0x10,0x00,
+0x00,0x00,0x00,0x00,0x14,0x44,0xff,0xfd,0x00,0x00,0x00,0x00,0x08,0x00,0x13,0x83,
+0x00,0x00,0x00,0x00,0x00,0x00,0x18,0x21,0x00,0x64,0x10,0x06,0x30,0x42,0x00,0x01,
+0x14,0x40,0x00,0x05,0x00,0x00,0x00,0x00,0x24,0x63,0x00,0x01,0x2c,0x62,0x00,0x20,
+0x14,0x40,0xff,0xf9,0x00,0x00,0x00,0x00,0x03,0xe0,0x00,0x08,0x00,0x60,0x10,0x21,
+0x27,0xbd,0xff,0xe0,0x3c,0x03,0xb0,0x05,0xaf,0xb2,0x00,0x18,0xaf,0xb1,0x00,0x14,
+0xaf,0xb0,0x00,0x10,0xaf,0xbf,0x00,0x1c,0x00,0x80,0x90,0x21,0x00,0xa0,0x80,0x21,
+0x00,0xc0,0x88,0x21,0x34,0x63,0x02,0x2e,0x90,0x62,0x00,0x00,0x00,0x00,0x00,0x00,
+0x30,0x42,0x00,0x01,0x14,0x40,0xff,0xfc,0x24,0x04,0x08,0x24,0x3c,0x05,0x00,0xc0,
+0x0c,0x00,0x13,0x5b,0x24,0x06,0x00,0x03,0x24,0x04,0x08,0x34,0x3c,0x05,0x00,0xc0,
+0x0c,0x00,0x13,0x5b,0x24,0x06,0x00,0x03,0x3c,0x02,0xc0,0x00,0x00,0x10,0x1c,0x00,
+0x34,0x42,0x04,0x00,0x3c,0x04,0xb0,0x05,0x3c,0x05,0xb0,0x05,0x24,0x63,0x16,0x09,
+0x02,0x22,0x10,0x21,0x34,0x84,0x04,0x20,0x34,0xa5,0x04,0x24,0x3c,0x06,0xb0,0x05,
+0xac,0x83,0x00,0x00,0x24,0x07,0x00,0x01,0xac,0xa2,0x00,0x00,0x34,0xc6,0x02,0x28,
+0x24,0x02,0x00,0x20,0xae,0x47,0x00,0x3c,0x24,0x04,0x08,0x24,0xa0,0xc2,0x00,0x00,
+0x3c,0x05,0x00,0xc0,0xa2,0x47,0x00,0x11,0x0c,0x00,0x13,0x5b,0x24,0x06,0x00,0x01,
+0x24,0x04,0x08,0x34,0x3c,0x05,0x00,0xc0,0x0c,0x00,0x13,0x5b,0x24,0x06,0x00,0x01,
+0x8f,0xbf,0x00,0x1c,0x8f,0xb2,0x00,0x18,0x7b,0xb0,0x00,0xbc,0x03,0xe0,0x00,0x08,
+0x27,0xbd,0x00,0x20,0x24,0x02,0x00,0x06,0xac,0x82,0x00,0x0c,0xa0,0x80,0x00,0x50,
+0xac,0x80,0x00,0x00,0xac,0x80,0x00,0x04,0xac,0x80,0x00,0x08,0xac,0x80,0x00,0x14,
+0xac,0x80,0x00,0x18,0xac,0x80,0x00,0x1c,0xa4,0x80,0x00,0x20,0xac,0x80,0x00,0x24,
+0xac,0x80,0x00,0x28,0xac,0x80,0x00,0x2c,0xa0,0x80,0x00,0x30,0xa0,0x80,0x00,0x31,
+0xac,0x80,0x00,0x34,0xac,0x80,0x00,0x38,0xa0,0x80,0x00,0x3c,0xac,0x82,0x00,0x10,
+0xa0,0x80,0x00,0x44,0xac,0x80,0x00,0x48,0x03,0xe0,0x00,0x08,0xac,0x80,0x00,0x4c,
+0x3c,0x04,0xb0,0x06,0x34,0x84,0x80,0x00,0x8c,0x83,0x00,0x00,0x3c,0x02,0x12,0x00,
+0x3c,0x05,0xb0,0x03,0x00,0x62,0x18,0x25,0x34,0xa5,0x00,0x8b,0x24,0x02,0xff,0x80,
+0xac,0x83,0x00,0x00,0x03,0xe0,0x00,0x08,0xa0,0xa2,0x00,0x00,0x3c,0x04,0xb0,0x03,
+0x34,0x84,0x00,0x0b,0x24,0x02,0x00,0x22,0x3c,0x05,0xb0,0x01,0x3c,0x06,0x45,0x67,
+0x3c,0x0a,0xb0,0x09,0xa0,0x82,0x00,0x00,0x34,0xa5,0x00,0x04,0x34,0xc6,0x89,0xaa,
+0x35,0x4a,0x00,0x04,0x24,0x02,0x01,0x23,0x3c,0x0b,0xb0,0x09,0x3c,0x07,0x01,0x23,
+0x3c,0x0c,0xb0,0x09,0x3c,0x01,0xb0,0x01,0xac,0x20,0x00,0x00,0x27,0xbd,0xff,0xe0,
+0xac,0xa0,0x00,0x00,0x35,0x6b,0x00,0x08,0x3c,0x01,0xb0,0x09,0xac,0x26,0x00,0x00,
+0x34,0xe7,0x45,0x66,0xa5,0x42,0x00,0x00,0x35,0x8c,0x00,0x0c,0x24,0x02,0xcd,0xef,
+0x3c,0x0d,0xb0,0x09,0x3c,0x08,0xcd,0xef,0x3c,0x0e,0xb0,0x09,0xad,0x67,0x00,0x00,
+0xaf,0xb7,0x00,0x1c,0xa5,0x82,0x00,0x00,0xaf,0xb6,0x00,0x18,0xaf,0xb5,0x00,0x14,
+0xaf,0xb4,0x00,0x10,0xaf,0xb3,0x00,0x0c,0xaf,0xb2,0x00,0x08,0xaf,0xb1,0x00,0x04,
+0xaf,0xb0,0x00,0x00,0x35,0xad,0x00,0x10,0x35,0x08,0x01,0x22,0x35,0xce,0x00,0x14,
+0x24,0x02,0x89,0xab,0x3c,0x0f,0xb0,0x09,0x3c,0x09,0x89,0xab,0x3c,0x10,0xb0,0x09,
+0x3c,0x11,0xb0,0x09,0x3c,0x12,0xb0,0x09,0x3c,0x13,0xb0,0x09,0x3c,0x14,0xb0,0x09,
+0x3c,0x15,0xb0,0x09,0x3c,0x16,0xb0,0x09,0x3c,0x17,0xb0,0x09,0xad,0xa8,0x00,0x00,
+0x24,0x03,0xff,0xff,0xa5,0xc2,0x00,0x00,0x35,0xef,0x00,0x18,0x35,0x29,0xcd,0xee,
+0x36,0x10,0x00,0x1c,0x36,0x31,0x00,0x20,0x36,0x52,0x00,0x24,0x36,0x73,0x00,0x28,
+0x36,0x94,0x00,0x2c,0x36,0xb5,0x00,0x30,0x36,0xd6,0x00,0x34,0x36,0xf7,0x00,0x38,
+0x24,0x02,0x45,0x67,0xad,0xe9,0x00,0x00,0xa6,0x02,0x00,0x00,0xae,0x23,0x00,0x00,
+0x8f,0xb0,0x00,0x00,0xa6,0x43,0x00,0x00,0x8f,0xb1,0x00,0x04,0xae,0x63,0x00,0x00,
+0x8f,0xb2,0x00,0x08,0xa6,0x83,0x00,0x00,0x8f,0xb3,0x00,0x0c,0xae,0xa3,0x00,0x00,
+0x8f,0xb4,0x00,0x10,0xa6,0xc3,0x00,0x00,0x8f,0xb5,0x00,0x14,0xae,0xe3,0x00,0x00,
+0x7b,0xb6,0x00,0xfc,0x3c,0x18,0xb0,0x09,0x37,0x18,0x00,0x3c,0xa7,0x03,0x00,0x00,
+0x03,0xe0,0x00,0x08,0x27,0xbd,0x00,0x20,0x3c,0x03,0xb0,0x03,0x3c,0x02,0x80,0x00,
+0x34,0x63,0x00,0x20,0x24,0x42,0x51,0x38,0xac,0x62,0x00,0x00,0x8c,0x83,0x00,0x34,
+0x34,0x02,0xff,0xff,0x00,0x43,0x10,0x2a,0x14,0x40,0x01,0x0b,0x00,0x80,0x30,0x21,
+0x8c,0x84,0x00,0x08,0x24,0x02,0x00,0x03,0x10,0x82,0x00,0xfe,0x00,0x00,0x00,0x00,
+0x8c,0xc2,0x00,0x2c,0x00,0x00,0x00,0x00,0x14,0x40,0x00,0x47,0x24,0x02,0x00,0x06,
+0x3c,0x03,0xb0,0x05,0x34,0x63,0x04,0x50,0x90,0x62,0x00,0x00,0x00,0x00,0x00,0x00,
+0x30,0x42,0x00,0xff,0x14,0x40,0x00,0xe4,0xac,0xc2,0x00,0x2c,0x24,0x02,0x00,0x01,
+0x10,0x82,0x00,0xe3,0x00,0x00,0x00,0x00,0x24,0x02,0x00,0x02,0x10,0x82,0x00,0xd1,
+0x00,0x00,0x00,0x00,0x8c,0xc7,0x00,0x04,0x24,0x02,0x00,0x02,0x10,0xe2,0x00,0xc7,
+0x00,0x00,0x00,0x00,0x8c,0xc2,0x00,0x14,0x00,0x00,0x00,0x00,0x14,0x40,0x00,0x09,
+0x24,0x02,0x00,0x01,0x3c,0x03,0xb0,0x09,0x34,0x63,0x01,0x60,0x90,0x62,0x00,0x00,
+0x00,0x00,0x00,0x00,0x30,0x42,0x00,0xff,0x10,0x40,0x00,0x05,0xac,0xc2,0x00,0x14,
+0x24,0x02,0x00,0x01,0xac,0xc2,0x00,0x00,0x03,0xe0,0x00,0x08,0xac,0xc0,0x00,0x14,
+0x3c,0x02,0xb0,0x03,0x34,0x42,0x00,0xd0,0x8c,0x43,0x00,0x00,0x00,0x00,0x00,0x00,
+0x04,0x61,0x00,0x16,0x3c,0x03,0xb0,0x05,0x34,0x63,0x02,0x2e,0x90,0x62,0x00,0x00,
+0x00,0x00,0x00,0x00,0x30,0x42,0x00,0x01,0x14,0x40,0x00,0x10,0x3c,0x02,0xb0,0x05,
+0x34,0x42,0x02,0x42,0x90,0x43,0x00,0x00,0x00,0x00,0x00,0x00,0x14,0x60,0x00,0x0b,
+0x00,0x00,0x00,0x00,0x80,0xc2,0x00,0x50,0x00,0x00,0x00,0x00,0x14,0x40,0x00,0x07,
+0x00,0x00,0x00,0x00,0x14,0x80,0x00,0x05,0x24,0x02,0x00,0x0e,0x24,0x03,0x00,0x01,
+0xac,0xc2,0x00,0x00,0x03,0xe0,0x00,0x08,0xa0,0xc3,0x00,0x50,0x80,0xc2,0x00,0x31,
+0x00,0x00,0x00,0x00,0x10,0x40,0x00,0x0a,0x3c,0x02,0xb0,0x06,0x34,0x42,0x80,0x18,
+0x8c,0x43,0x00,0x00,0x3c,0x04,0xf0,0x00,0x3c,0x02,0x80,0x00,0x00,0x64,0x18,0x24,
+0x10,0x62,0x00,0x03,0x24,0x02,0x00,0x09,0x03,0xe0,0x00,0x08,0xac,0xc2,0x00,0x00,
+0x8c,0xc2,0x00,0x40,0x00,0x00,0x00,0x00,0x8c,0x43,0x00,0x00,0x00,0x00,0x00,0x00,
+0x10,0x60,0x00,0x09,0x3c,0x03,0xb0,0x03,0x3c,0x02,0xb0,0x05,0x34,0x42,0x02,0x2c,
+0x8c,0x43,0x00,0x00,0x3c,0x04,0x00,0x02,0x00,0x64,0x18,0x24,0x14,0x60,0xff,0xf2,
+0x24,0x02,0x00,0x10,0x3c,0x03,0xb0,0x03,0x34,0x63,0x02,0x01,0x90,0x62,0x00,0x00,
+0x00,0x00,0x00,0x00,0x30,0x42,0x00,0x80,0x10,0x40,0x00,0x0e,0x00,0x00,0x00,0x00,
+0x8c,0xc3,0x00,0x0c,0x00,0x00,0x00,0x00,0xac,0xc3,0x00,0x10,0x3c,0x02,0xb0,0x03,
+0x90,0x42,0x02,0x01,0x00,0x00,0x00,0x00,0x30,0x42,0x00,0x0f,0xac,0xc2,0x00,0x0c,
+0x90,0xc3,0x00,0x0f,0x24,0x02,0x00,0x0d,0x3c,0x01,0xb0,0x03,0x08,0x00,0x14,0xa6,
+0xa0,0x23,0x02,0x01,0x3c,0x02,0xb0,0x09,0x34,0x42,0x01,0x80,0x90,0x44,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x04,0x1e,0x00,0x00,0x03,0x1e,0x03,0x10,0x60,0x00,0x15,
+0xa0,0xc4,0x00,0x44,0x24,0x02,0x00,0x01,0x10,0x62,0x00,0x0b,0x24,0x02,0x00,0x02,
+0x10,0x62,0x00,0x03,0x24,0x03,0x00,0x0d,0x03,0xe0,0x00,0x08,0x00,0x00,0x00,0x00,
+0x8c,0xc2,0x00,0x0c,0xac,0xc3,0x00,0x00,0x24,0x03,0x00,0x04,0xac,0xc2,0x00,0x10,
+0x03,0xe0,0x00,0x08,0xac,0xc3,0x00,0x0c,0x24,0x02,0x00,0x0d,0xac,0xc2,0x00,0x00,
+0x24,0x03,0x00,0x04,0x24,0x02,0x00,0x06,0xac,0xc3,0x00,0x10,0x03,0xe0,0x00,0x08,
+0xac,0xc2,0x00,0x0c,0x8c,0xc3,0x00,0x38,0x00,0x00,0x00,0x00,0x2c,0x62,0x00,0x06,
+0x10,0x40,0x00,0x2e,0x00,0x03,0x10,0x80,0x3c,0x03,0x80,0x01,0x24,0x63,0x02,0x00,
+0x00,0x43,0x10,0x21,0x8c,0x44,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x80,0x00,0x08,
+0x00,0x00,0x00,0x00,0x24,0x02,0x00,0x01,0x10,0xe2,0x00,0x06,0x24,0x02,0x00,0x03,
+0x8c,0xa2,0x02,0xbc,0x00,0x00,0x00,0x00,0x10,0x40,0x00,0x06,0x3c,0x03,0xb0,0x06,
+0x24,0x02,0x00,0x02,0xac,0xc2,0x00,0x00,0x24,0x02,0x00,0x01,0x03,0xe0,0x00,0x08,
+0xac,0xc2,0x00,0x38,0x34,0x63,0x80,0x24,0x8c,0x62,0x00,0x00,0x00,0x00,0x00,0x00,
+0x30,0x42,0x00,0xff,0x10,0x40,0x00,0x05,0xac,0xc2,0x00,0x18,0x24,0x02,0x00,0x02,
+0xac,0xc2,0x00,0x00,0x08,0x00,0x14,0xfa,0xac,0xc0,0x00,0x18,0x08,0x00,0x14,0xfa,
+0xac,0xc0,0x00,0x00,0x24,0x02,0x00,0x02,0x24,0x03,0x00,0x0b,0xac,0xc2,0x00,0x38,
+0x03,0xe0,0x00,0x08,0xac,0xc3,0x00,0x00,0x24,0x02,0x00,0x01,0x10,0xe2,0x00,0x05,
+0x00,0x00,0x00,0x00,0x24,0x02,0x00,0x0c,0xac,0xc2,0x00,0x00,0x08,0x00,0x14,0xfb,
+0x24,0x02,0x00,0x04,0x08,0x00,0x15,0x12,0x24,0x02,0x00,0x03,0xac,0xc0,0x00,0x38,
+0x03,0xe0,0x00,0x08,0xac,0xc0,0x00,0x00,0x24,0x02,0x00,0x01,0x10,0xe2,0x00,0x05,
+0x24,0x02,0x00,0x03,0x80,0xc2,0x00,0x30,0x00,0x00,0x00,0x00,0x14,0x40,0x00,0x08,
+0x24,0x02,0x00,0x04,0xac,0xc2,0x00,0x00,0x93,0x82,0x86,0x3c,0x00,0x00,0x00,0x00,
+0x14,0x40,0xff,0xd6,0x24,0x02,0x00,0x05,0x03,0xe0,0x00,0x08,0xac,0xc0,0x00,0x38,
+0x08,0x00,0x15,0x22,0xac,0xc0,0x00,0x00,0x3c,0x02,0xb0,0x06,0x34,0x42,0x80,0x18,
+0x8c,0x43,0x00,0x00,0x3c,0x04,0xf0,0x00,0x3c,0x02,0x80,0x00,0x00,0x64,0x18,0x24,
+0x10,0x62,0x00,0x03,0x24,0x02,0x00,0x09,0x08,0x00,0x15,0x26,0xac,0xc2,0x00,0x00,
+0x24,0x02,0x00,0x05,0x08,0x00,0x15,0x18,0xac,0xc2,0x00,0x38,0x80,0xc2,0x00,0x30,
+0x00,0x00,0x00,0x00,0x14,0x40,0xff,0x37,0x24,0x02,0x00,0x04,0x08,0x00,0x14,0xa6,
+0x00,0x00,0x00,0x00,0x84,0xc2,0x00,0x20,0x00,0x00,0x00,0x00,0x10,0x40,0xff,0x66,
+0x24,0x02,0x00,0x06,0x3c,0x02,0xb0,0x05,0x34,0x42,0x02,0x2e,0x90,0x43,0x00,0x00,
+0x00,0x00,0x00,0x00,0x30,0x63,0x00,0x01,0x30,0x63,0x00,0xff,0x00,0x60,0x10,0x21,
+0x14,0x40,0xff,0x24,0xa4,0xc3,0x00,0x20,0x08,0x00,0x14,0xa6,0x24,0x02,0x00,0x06,
+0x8c,0xc2,0x00,0x1c,0x00,0x00,0x00,0x00,0x14,0x40,0xff,0x57,0x24,0x02,0x00,0x05,
+0x3c,0x03,0xb0,0x05,0x34,0x63,0x02,0x2c,0x8c,0x62,0x00,0x00,0x00,0x00,0x00,0x00,
+0x30,0x42,0x00,0xff,0x10,0x40,0xff,0x14,0xac,0xc2,0x00,0x1c,0x08,0x00,0x14,0xa6,
+0x24,0x02,0x00,0x05,0x3c,0x02,0xb0,0x05,0x8c,0x42,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x02,0x17,0x42,0x30,0x42,0x00,0x01,0x14,0x40,0xff,0x47,0x24,0x02,0x00,0x06,
+0x08,0x00,0x14,0x5c,0x00,0x00,0x00,0x00,0x24,0x02,0x00,0x0a,0x03,0xe0,0x00,0x08,
+0xac,0x82,0x00,0x00,0x27,0xbd,0xff,0xd8,0xaf,0xb0,0x00,0x10,0x27,0x90,0x86,0x48,
+0xaf,0xbf,0x00,0x20,0xaf,0xb3,0x00,0x1c,0xaf,0xb2,0x00,0x18,0x0c,0x00,0x2b,0xe8,
+0xaf,0xb1,0x00,0x14,0xaf,0x90,0x8f,0xd0,0x48,0x02,0x00,0x00,0x0c,0x00,0x13,0xec,
+0x00,0x00,0x00,0x00,0x0c,0x00,0x18,0x4e,0x02,0x00,0x20,0x21,0x0c,0x00,0x00,0x34,
+0x00,0x00,0x00,0x00,0x0c,0x00,0x13,0xf7,0x00,0x00,0x00,0x00,0x27,0x84,0x84,0x68,
+0x0c,0x00,0x27,0xc1,0x00,0x00,0x00,0x00,0x93,0x84,0x80,0x10,0x0c,0x00,0x21,0x9a,
+0x00,0x00,0x00,0x00,0x27,0x84,0x89,0x08,0x0c,0x00,0x06,0xe1,0x00,0x00,0x00,0x00,
+0x0c,0x00,0x01,0x3b,0x00,0x00,0x00,0x00,0x27,0x84,0x84,0x10,0x0c,0x00,0x13,0xd5,
+0x00,0x00,0x00,0x00,0x27,0x82,0x89,0x3c,0xaf,0x82,0x84,0x50,0x0c,0x00,0x00,0x61,
+0x00,0x00,0x00,0x00,0x3c,0x03,0xb0,0x03,0x34,0x63,0x01,0x08,0x3c,0x04,0xb0,0x09,
+0x3c,0x05,0xb0,0x09,0x8c,0x66,0x00,0x00,0x34,0x84,0x01,0x68,0x24,0x02,0xc8,0x80,
+0x34,0xa5,0x01,0x40,0x24,0x03,0x00,0x0a,0xa4,0x82,0x00,0x00,0xa4,0xa3,0x00,0x00,
+0x3c,0x04,0xb0,0x03,0x8c,0x82,0x00,0x00,0x8f,0x87,0x84,0x10,0xaf,0x86,0x84,0x08,
+0x34,0x42,0x00,0x20,0xac,0x82,0x00,0x00,0x3c,0x02,0xb0,0x03,0x34,0x42,0x00,0x58,
+0x8c,0x43,0x00,0x00,0x2c,0xe4,0x00,0x11,0x34,0x63,0x01,0x00,0xac,0x43,0x00,0x00,
+0x10,0x80,0xff,0xfa,0x3c,0x02,0xb0,0x03,0x3c,0x03,0x80,0x01,0x00,0x07,0x10,0x80,
+0x24,0x63,0x02,0x18,0x00,0x43,0x10,0x21,0x8c,0x44,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x80,0x00,0x08,0x00,0x00,0x00,0x00,0x27,0x84,0x84,0x68,0x0c,0x00,0x26,0xe5,
+0x00,0x00,0x00,0x00,0x27,0x84,0x84,0x10,0x27,0x85,0x86,0x48,0x0c,0x00,0x14,0x4e,
+0x00,0x00,0x00,0x00,0x3c,0x02,0xb0,0x09,0x34,0x42,0x00,0x07,0x3c,0x03,0xb0,0x06,
+0x90,0x44,0x00,0x00,0x34,0x63,0x80,0x18,0x8c,0x65,0x00,0x00,0x3c,0x02,0xb0,0x03,
+0x34,0x42,0x00,0xec,0x3c,0x03,0xb0,0x03,0x30,0x86,0x00,0xff,0xa0,0x46,0x00,0x00,
+0x00,0x05,0x2f,0x02,0x34,0x63,0x00,0xed,0x24,0x02,0x00,0x01,0x10,0xc2,0x00,0x2c,
+0xa0,0x65,0x00,0x00,0xa3,0x80,0x81,0x58,0x93,0x83,0x81,0xf1,0x24,0x02,0x00,0x01,
+0x10,0x62,0x00,0x08,0x00,0x00,0x00,0x00,0x8f,0x87,0x84,0x10,0x8f,0x82,0x84,0x44,
+0x00,0x00,0x00,0x00,0x24,0x42,0x00,0x01,0xaf,0x82,0x84,0x44,0x08,0x00,0x15,0x9b,
+0x3c,0x02,0xb0,0x03,0x8f,0x87,0x84,0x10,0x00,0x00,0x00,0x00,0x24,0xe2,0xff,0xfc,
+0x2c,0x42,0x00,0x03,0x14,0x40,0x00,0x0a,0x3c,0x03,0xb0,0x06,0x93,0x82,0x86,0x3c,
+0x00,0x00,0x00,0x00,0x14,0x40,0x00,0x07,0x34,0x63,0x80,0x18,0x27,0x84,0x84,0x68,
+0x0c,0x00,0x27,0x75,0x00,0x00,0x00,0x00,0x8f,0x87,0x84,0x10,0x3c,0x03,0xb0,0x06,
+0x34,0x63,0x80,0x18,0x8c,0x62,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x02,0x17,0x02,
+0x10,0x40,0xff,0xe6,0x00,0x00,0x00,0x00,0x8f,0x82,0xbc,0x10,0x8f,0x84,0xbc,0x18,
+0x3c,0x05,0xb0,0x01,0x00,0x45,0x10,0x21,0xac,0x44,0x00,0x00,0x8f,0x83,0xbc,0x10,
+0x8f,0x82,0xbc,0x14,0x00,0x65,0x18,0x21,0x08,0x00,0x15,0xc7,0xac,0x62,0x00,0x04,
+0x14,0xa0,0xff,0xd4,0x3c,0x02,0xb0,0x03,0x93,0x83,0x81,0x58,0x34,0x42,0x00,0xee,
+0x24,0x63,0x00,0x01,0x30,0x64,0x00,0xff,0x2c,0x84,0x00,0xf1,0xa0,0x43,0x00,0x00,
+0xa3,0x83,0x81,0x58,0x14,0x80,0xff,0xcc,0x00,0x00,0x00,0x00,0xaf,0x86,0x84,0x24,
+0xa3,0x86,0x86,0x23,0x08,0x00,0x15,0xc1,0x00,0x00,0x00,0x00,0x27,0x84,0x84,0x68,
+0x0c,0x00,0x29,0x6e,0x00,0x00,0x00,0x00,0xa3,0x82,0x84,0x41,0x8f,0x82,0x84,0x44,
+0xaf,0x80,0x84,0x10,0x24,0x42,0x00,0x01,0xaf,0x82,0x84,0x44,0x08,0x00,0x15,0x9a,
+0x00,0x00,0x38,0x21,0x27,0x84,0x86,0x48,0x0c,0x00,0x19,0x19,0x00,0x00,0x00,0x00,
+0x30,0x42,0x00,0xff,0x14,0x40,0x00,0x05,0x3c,0x03,0xb0,0x05,0xaf,0x80,0x84,0x10,
+0xaf,0x80,0x84,0x14,0x08,0x00,0x15,0xc6,0x00,0x00,0x00,0x00,0x34,0x63,0x04,0x50,
+0x90,0x62,0x00,0x00,0x00,0x00,0x00,0x00,0x30,0x42,0x00,0xff,0xaf,0x82,0x84,0x3c,
+0x14,0x40,0x00,0x20,0x24,0x02,0x00,0x01,0x8f,0x84,0x84,0x18,0x00,0x00,0x00,0x00,
+0x10,0x82,0x00,0x20,0x3c,0x03,0xb0,0x09,0x34,0x63,0x01,0x60,0x90,0x62,0x00,0x00,
+0x00,0x00,0x00,0x00,0x30,0x42,0x00,0xff,0xaf,0x82,0x84,0x24,0x14,0x40,0x00,0x15,
+0x24,0x02,0x00,0x01,0x24,0x02,0x00,0x02,0x10,0x82,0x00,0x07,0x00,0x00,0x00,0x00,
+0x24,0x07,0x00,0x03,0x24,0x02,0x00,0x01,0xaf,0x82,0x84,0x14,0xaf,0x87,0x84,0x10,
+0x08,0x00,0x15,0xc6,0x00,0x00,0x00,0x00,0x3c,0x02,0xb0,0x05,0x34,0x42,0x02,0x2e,
+0x90,0x43,0x00,0x00,0x00,0x00,0x00,0x00,0x30,0x63,0x00,0x01,0x30,0x63,0x00,0xff,
+0x00,0x60,0x10,0x21,0xa7,0x83,0x84,0x30,0x14,0x40,0xff,0xf1,0x00,0x00,0x00,0x00,
+0x24,0x02,0x00,0x01,0xaf,0x82,0x84,0x14,0xaf,0x80,0x84,0x10,0x08,0x00,0x15,0xc6,
+0x00,0x00,0x00,0x00,0x3c,0x03,0xb0,0x05,0x34,0x63,0x02,0x2c,0x8c,0x62,0x00,0x00,
+0x00,0x00,0x00,0x00,0x30,0x42,0x00,0xff,0xaf,0x82,0x84,0x2c,0x14,0x40,0xff,0xf5,
+0x24,0x02,0x00,0x01,0x08,0x00,0x16,0x1a,0x3c,0x03,0xb0,0x09,0x27,0x84,0x86,0x48,
+0x0c,0x00,0x1a,0xde,0x00,0x00,0x00,0x00,0x83,0x82,0x84,0x40,0x00,0x00,0x00,0x00,
+0x14,0x40,0xff,0xec,0x24,0x02,0x00,0x02,0x3c,0x03,0xb0,0x05,0x34,0x63,0x04,0x50,
+0x90,0x62,0x00,0x00,0x00,0x00,0x00,0x00,0x30,0x42,0x00,0xff,0xaf,0x82,0x84,0x3c,
+0x14,0x40,0xff,0xe4,0x24,0x02,0x00,0x02,0x8f,0x84,0x84,0x18,0x24,0x02,0x00,0x01,
+0x10,0x82,0x00,0x12,0x24,0x02,0x00,0x02,0x10,0x82,0x00,0x04,0x00,0x00,0x00,0x00,
+0x24,0x07,0x00,0x04,0x08,0x00,0x16,0x26,0x24,0x02,0x00,0x02,0x3c,0x02,0xb0,0x05,
+0x34,0x42,0x02,0x2e,0x90,0x43,0x00,0x00,0x00,0x00,0x00,0x00,0x30,0x63,0x00,0x01,
+0x30,0x63,0x00,0xff,0x00,0x60,0x10,0x21,0xa7,0x83,0x84,0x30,0x14,0x40,0xff,0xf4,
+0x00,0x00,0x00,0x00,0x08,0x00,0x16,0x35,0x24,0x02,0x00,0x02,0x3c,0x03,0xb0,0x05,
+0x34,0x63,0x02,0x2c,0x8c,0x62,0x00,0x00,0x00,0x00,0x00,0x00,0x30,0x42,0x00,0xff,
+0xaf,0x82,0x84,0x2c,0x14,0x40,0xff,0xf7,0x00,0x00,0x00,0x00,0x08,0x00,0x16,0x56,
+0x24,0x02,0x00,0x02,0x27,0x84,0x89,0x08,0x0c,0x00,0x0b,0x51,0x00,0x00,0x00,0x00,
+0x8f,0x83,0x84,0x14,0xaf,0x82,0x84,0x2c,0x38,0x64,0x00,0x02,0x00,0x04,0x18,0x0a,
+0xaf,0x83,0x84,0x14,0x14,0x40,0xff,0xad,0x24,0x07,0x00,0x05,0x8f,0x82,0x89,0x48,
+0xaf,0x80,0x84,0x10,0x10,0x40,0x00,0x02,0x24,0x04,0x00,0x01,0xaf,0x84,0x84,0x18,
+0x93,0x82,0x89,0x56,0x00,0x00,0x00,0x00,0x10,0x40,0xff,0x43,0x00,0x00,0x00,0x00,
+0x3c,0x02,0xb0,0x05,0x34,0x42,0x00,0x08,0x8c,0x43,0x00,0x00,0x3c,0x04,0x20,0x00,
+0x00,0x64,0x18,0x24,0x10,0x60,0xff,0x3c,0x00,0x00,0x00,0x00,0x3c,0x02,0xb0,0x03,
+0x34,0x42,0x00,0xa0,0x8c,0x43,0x00,0x00,0x3c,0x04,0x80,0x00,0xaf,0x80,0x89,0x30,
+0x24,0x63,0x00,0x01,0xac,0x43,0x00,0x00,0x3c,0x01,0xb0,0x05,0xac,0x24,0x00,0x08,
+0xaf,0x80,0x89,0x2c,0xaf,0x80,0x89,0x34,0xaf,0x80,0x89,0x38,0xaf,0x80,0x89,0x44,
+0xaf,0x80,0x89,0x3c,0x08,0x00,0x15,0xc6,0x00,0x00,0x00,0x00,0x83,0x82,0x84,0x60,
+0x00,0x00,0x00,0x00,0x10,0x40,0x00,0x02,0x24,0x02,0x00,0x20,0xaf,0x82,0x84,0x2c,
+0x8f,0x85,0x84,0x2c,0x27,0x84,0x89,0x08,0x0c,0x00,0x0d,0x2c,0x00,0x00,0x00,0x00,
+0x00,0x02,0x1e,0x00,0xa3,0x82,0x84,0x40,0xaf,0x80,0x84,0x2c,0x10,0x60,0xff,0x8e,
+0x00,0x00,0x00,0x00,0x3c,0x02,0xb0,0x05,0x34,0x42,0x02,0x2e,0x90,0x43,0x00,0x00,
+0x00,0x00,0x00,0x00,0x30,0x63,0x00,0x01,0x30,0x63,0x00,0xff,0x00,0x60,0x10,0x21,
+0xa7,0x83,0x84,0x30,0x10,0x40,0x00,0x04,0x24,0x04,0x00,0x02,0xaf,0x84,0x84,0x18,
+0x08,0x00,0x16,0x36,0x00,0x00,0x00,0x00,0x08,0x00,0x16,0x27,0x24,0x07,0x00,0x06,
+0x27,0x84,0x84,0x10,0x27,0x85,0x89,0x08,0x0c,0x00,0x0d,0xf9,0x00,0x00,0x00,0x00,
+0x8f,0x82,0x84,0x34,0xaf,0x80,0x84,0x3c,0x14,0x40,0x00,0x19,0x00,0x40,0x18,0x21,
+0x8f,0x82,0x84,0x38,0x00,0x00,0x00,0x00,0x14,0x40,0x00,0x15,0x24,0x02,0x00,0x02,
+0x8f,0x83,0x84,0x18,0x00,0x00,0x00,0x00,0x10,0x62,0x00,0x0b,0x3c,0x02,0x40,0x00,
+0x8f,0x83,0x84,0x14,0x24,0x02,0x00,0x01,0x10,0x62,0x00,0x02,0x24,0x07,0x00,0x03,
+0x24,0x07,0x00,0x06,0xaf,0x87,0x84,0x10,0x24,0x04,0x00,0x03,0xaf,0x84,0x84,0x18,
+0x08,0x00,0x15,0xc6,0x00,0x00,0x00,0x00,0x34,0x42,0x00,0x14,0x3c,0x01,0xb0,0x05,
+0xac,0x22,0x00,0x00,0xaf,0x80,0x84,0x10,0x08,0x00,0x16,0xcf,0x24,0x04,0x00,0x03,
+0x10,0x60,0x00,0x10,0x00,0x00,0x00,0x00,0x27,0x84,0x84,0x10,0x27,0x85,0x89,0x08,
+0x0c,0x00,0x0e,0x1d,0x00,0x00,0x00,0x00,0x8f,0x83,0x84,0x14,0x24,0x02,0x00,0x01,
+0xa3,0x80,0x84,0x40,0xaf,0x80,0x84,0x18,0x10,0x62,0x00,0x02,0x24,0x07,0x00,0x03,
+0x24,0x07,0x00,0x04,0xaf,0x87,0x84,0x10,0xaf,0x80,0x84,0x34,0x08,0x00,0x15,0xc6,
+0x00,0x00,0x00,0x00,0x83,0x82,0x84,0x60,0x00,0x00,0x00,0x00,0x14,0x40,0x00,0x04,
+0x00,0x00,0x00,0x00,0x27,0x84,0x89,0x08,0x0c,0x00,0x10,0x65,0x00,0x00,0x00,0x00,
+0x8f,0x82,0x84,0x14,0xa3,0x80,0x84,0x40,0xaf,0x80,0x84,0x10,0xaf,0x80,0x84,0x18,
+0x14,0x40,0x00,0x03,0x00,0x00,0x00,0x00,0x24,0x02,0x00,0x02,0xaf,0x82,0x84,0x14,
+0xaf,0x80,0x84,0x38,0x08,0x00,0x15,0xc6,0x00,0x00,0x00,0x00,0x27,0x84,0x84,0x10,
+0x27,0x85,0x89,0x08,0x0c,0x00,0x0e,0x1d,0x00,0x00,0x00,0x00,0x8f,0x82,0x84,0x14,
+0xa3,0x80,0x84,0x40,0xaf,0x80,0x84,0x10,0xaf,0x80,0x84,0x18,0x14,0x40,0xfe,0xc2,
+0x00,0x00,0x00,0x00,0x24,0x02,0x00,0x02,0xaf,0x82,0x84,0x14,0x08,0x00,0x15,0xc6,
+0x00,0x00,0x00,0x00,0x27,0x84,0x89,0x08,0x0c,0x00,0x10,0x65,0x00,0x00,0x00,0x00,
+0x08,0x00,0x16,0xff,0x00,0x00,0x00,0x00,0x27,0x84,0x84,0x68,0x0c,0x00,0x2a,0x96,
+0x00,0x00,0x00,0x00,0x08,0x00,0x15,0xfe,0x00,0x00,0x00,0x00,0x0c,0x00,0x24,0x66,
+0x00,0x00,0x00,0x00,0x0c,0x00,0x27,0x56,0x00,0x00,0x00,0x00,0x0c,0x00,0x18,0x40,
+0x00,0x00,0x00,0x00,0x27,0x84,0x84,0x68,0x0c,0x00,0x27,0x64,0x00,0x00,0x00,0x00,
+0x93,0x83,0xbc,0x08,0x00,0x00,0x00,0x00,0x14,0x60,0x00,0x2b,0x3c,0x02,0xb0,0x03,
+0x34,0x42,0x01,0x08,0x8c,0x44,0x00,0x00,0x8f,0x83,0xbc,0x00,0x8f,0x82,0xbc,0x04,
+0x00,0x83,0x18,0x23,0x00,0x43,0x10,0x2b,0x10,0x40,0x00,0x23,0x3c,0x02,0xb0,0x03,
+0x24,0x04,0x05,0xa0,0x34,0x42,0x01,0x18,0x8c,0x42,0x00,0x00,0x0c,0x00,0x06,0xce,
+0x00,0x00,0x00,0x00,0x24,0x04,0x05,0xa4,0x0c,0x00,0x06,0xce,0x00,0x02,0x84,0x02,
+0x30,0x51,0xff,0xff,0x24,0x04,0x05,0xa8,0x00,0x02,0x94,0x02,0x0c,0x00,0x06,0xce,
+0x3a,0x10,0xff,0xff,0x3a,0x31,0xff,0xff,0x30,0x42,0xff,0xff,0x2e,0x10,0x00,0x01,
+0x2e,0x31,0x00,0x01,0x3a,0x52,0xff,0xff,0x02,0x11,0x80,0x25,0x2e,0x52,0x00,0x01,
+0x38,0x42,0xff,0xff,0x02,0x12,0x80,0x25,0x2c,0x42,0x00,0x01,0x02,0x02,0x80,0x25,
+0x16,0x00,0x00,0x02,0x24,0x04,0x00,0x02,0x00,0x00,0x20,0x21,0x0c,0x00,0x05,0x70,
+0x00,0x00,0x00,0x00,0x3c,0x02,0xb0,0x03,0x34,0x42,0x01,0x08,0x8c,0x43,0x00,0x00,
+0x00,0x00,0x00,0x00,0xaf,0x83,0xbc,0x00,0x0c,0x00,0x01,0xeb,0x00,0x00,0x00,0x00,
+0xaf,0x80,0x84,0x10,0xaf,0x80,0x84,0x44,0x08,0x00,0x15,0x9a,0x00,0x00,0x38,0x21,
+0x27,0x90,0xb3,0xf0,0x24,0x11,0x00,0x12,0x8e,0x04,0x00,0x00,0x00,0x00,0x00,0x00,
+0x90,0x82,0x00,0x10,0x00,0x00,0x00,0x00,0x10,0x40,0x00,0x03,0x00,0x00,0x00,0x00,
+0x0c,0x00,0x20,0xd0,0x00,0x00,0x00,0x00,0x26,0x31,0xff,0xff,0x06,0x21,0xff,0xf6,
+0x26,0x10,0x00,0x04,0xaf,0x80,0x84,0x10,0x08,0x00,0x15,0xc7,0x00,0x00,0x38,0x21,
+0x3c,0x02,0xb0,0x03,0x34,0x42,0x01,0x08,0x8c,0x44,0x00,0x00,0x8f,0x82,0x84,0x08,
+0x00,0x04,0x19,0xc2,0x00,0x02,0x11,0xc2,0x10,0x62,0xff,0xf6,0x00,0x00,0x00,0x00,
+0x3c,0x02,0xb0,0x03,0x34,0x42,0x01,0x02,0x90,0x43,0x00,0x00,0x3c,0x12,0xb0,0x05,
+0xaf,0x84,0x84,0x08,0x30,0x63,0x00,0xff,0x00,0x03,0x11,0x40,0x00,0x43,0x10,0x23,
+0x00,0x02,0x10,0x80,0x00,0x43,0x10,0x21,0x00,0x02,0x99,0x00,0x00,0x00,0x88,0x21,
+0x36,0x52,0x02,0x2c,0x27,0x90,0xb3,0xf0,0x8e,0x04,0x00,0x00,0x00,0x00,0x00,0x00,
+0x90,0x83,0x00,0x16,0x00,0x00,0x00,0x00,0x30,0x62,0x00,0x03,0x10,0x40,0x00,0x06,
+0x30,0x62,0x00,0x1c,0x14,0x40,0x00,0x04,0x00,0x00,0x00,0x00,0x8f,0x85,0x84,0x08,
+0x0c,0x00,0x1e,0xb2,0x02,0x60,0x30,0x21,0x8e,0x42,0x00,0x00,0x00,0x00,0x00,0x00,
+0x30,0x42,0x00,0xff,0x14,0x40,0xff,0xd7,0x00,0x00,0x00,0x00,0x26,0x31,0x00,0x01,
+0x2a,0x22,0x00,0x13,0x14,0x40,0xff,0xec,0x26,0x10,0x00,0x04,0x08,0x00,0x17,0x5d,
+0x00,0x00,0x00,0x00,0x8f,0x84,0x84,0x1c,0x27,0x85,0x89,0x08,0x0c,0x00,0x17,0xd3,
+0x00,0x00,0x00,0x00,0x8f,0x83,0x84,0x1c,0x24,0x02,0x00,0x04,0x14,0x62,0xfe,0xa2,
+0x00,0x00,0x00,0x00,0x08,0x00,0x16,0x27,0x24,0x07,0x00,0x05,0x27,0x84,0x89,0x08,
+0x0c,0x00,0x24,0x8d,0x00,0x00,0x00,0x00,0x24,0x07,0x00,0x05,0xaf,0x87,0x84,0x10,
+0x08,0x00,0x15,0xc7,0x00,0x00,0x00,0x00,0x8f,0x82,0x89,0x3c,0x00,0x00,0x00,0x00,
+0x10,0x40,0x00,0x0d,0x00,0x00,0x00,0x00,0x8f,0x84,0xb4,0x30,0xaf,0x80,0x89,0x3c,
+0x94,0x85,0x00,0x14,0x0c,0x00,0x1b,0x84,0x00,0x00,0x00,0x00,0x93,0x82,0x8b,0x61,
+0x00,0x00,0x00,0x00,0x30,0x42,0x00,0x02,0x10,0x40,0x00,0x03,0x00,0x00,0x00,0x00,
+0x0c,0x00,0x01,0x59,0x00,0x00,0x20,0x21,0x8f,0x84,0xb4,0x30,0x0c,0x00,0x20,0xd0,
+0x00,0x00,0x00,0x00,0x08,0x00,0x17,0x5d,0x00,0x00,0x00,0x00,0x3c,0x02,0xff,0x90,
+0x27,0xbd,0xff,0xe8,0x00,0x80,0x18,0x21,0x34,0x42,0x00,0x01,0x27,0x84,0x89,0x08,
+0x10,0x62,0x00,0x05,0xaf,0xbf,0x00,0x10,0x8f,0xbf,0x00,0x10,0x00,0x00,0x00,0x00,
+0x03,0xe0,0x00,0x08,0x27,0xbd,0x00,0x18,0x0c,0x00,0x06,0xe1,0x00,0x00,0x00,0x00,
+0x27,0x84,0x86,0x48,0x0c,0x00,0x18,0x4e,0x00,0x00,0x00,0x00,0x27,0x84,0x84,0x10,
+0x0c,0x00,0x13,0xd5,0x00,0x00,0x00,0x00,0x08,0x00,0x17,0xba,0x00,0x00,0x00,0x00,
+0x8f,0x82,0x89,0x48,0x00,0x00,0x00,0x00,0x14,0x40,0x00,0x05,0x00,0x00,0x18,0x21,
+0x8f,0x82,0x84,0x18,0x00,0x00,0x00,0x00,0x10,0x40,0x00,0x02,0x00,0x00,0x00,0x00,
+0x24,0x03,0x00,0x01,0x03,0xe0,0x00,0x08,0x00,0x60,0x10,0x21,0x27,0xbd,0xff,0xe0,
+0x3c,0x06,0xb0,0x03,0xaf,0xb1,0x00,0x14,0xaf,0xb0,0x00,0x10,0x34,0xc6,0x00,0x5f,
+0xaf,0xbf,0x00,0x18,0x90,0xc3,0x00,0x00,0x3c,0x07,0xb0,0x03,0x34,0xe7,0x00,0x5d,
+0x34,0x63,0x00,0x01,0x3c,0x09,0xb0,0x03,0x24,0x02,0x00,0x01,0xa0,0xc3,0x00,0x00,
+0x00,0x80,0x80,0x21,0xa0,0xe2,0x00,0x00,0x00,0xa0,0x88,0x21,0x35,0x29,0x00,0x5e,
+0x00,0xe0,0x40,0x21,0x24,0x04,0x00,0x01,0x91,0x22,0x00,0x00,0x91,0x03,0x00,0x00,
+0x30,0x42,0x00,0x01,0x14,0x83,0x00,0x03,0x30,0x42,0x00,0x01,0x14,0x40,0xff,0xfa,
+0x00,0x00,0x00,0x00,0x24,0x02,0x00,0x04,0x12,0x02,0x00,0x2c,0x24,0x05,0x0f,0x00,
+0x24,0x02,0x00,0x06,0x12,0x02,0x00,0x08,0x24,0x05,0x00,0x0f,0x3c,0x02,0xb0,0x03,
+0x34,0x42,0x02,0x00,0xa0,0x50,0x00,0x00,0x8f,0xbf,0x00,0x18,0x7b,0xb0,0x00,0xbc,
+0x03,0xe0,0x00,0x08,0x27,0xbd,0x00,0x20,0x24,0x04,0x0c,0x04,0x0c,0x00,0x13,0x5b,
+0x24,0x06,0x00,0x0f,0x24,0x04,0x0d,0x04,0x24,0x05,0x00,0x0f,0x0c,0x00,0x13,0x5b,
+0x24,0x06,0x00,0x0f,0x24,0x04,0x08,0x80,0x24,0x05,0x1e,0x00,0x0c,0x00,0x13,0x5b,
+0x24,0x06,0x00,0x0f,0x24,0x04,0x08,0x8c,0x24,0x05,0x0f,0x00,0x0c,0x00,0x13,0x5b,
+0x24,0x06,0x00,0x0f,0x24,0x04,0x08,0x24,0x3c,0x05,0x00,0x30,0x0c,0x00,0x13,0x5b,
+0x24,0x06,0x00,0x02,0x24,0x04,0x08,0x2c,0x3c,0x05,0x00,0x30,0x0c,0x00,0x13,0x5b,
+0x24,0x06,0x00,0x02,0x24,0x04,0x08,0x34,0x3c,0x05,0x00,0x30,0x0c,0x00,0x13,0x5b,
+0x24,0x06,0x00,0x02,0x24,0x04,0x08,0x3c,0x3c,0x05,0x00,0x30,0x0c,0x00,0x13,0x5b,
+0x24,0x06,0x00,0x02,0x08,0x00,0x17,0xf4,0x3c,0x02,0xb0,0x03,0x24,0x04,0x08,0x8c,
+0x0c,0x00,0x13,0x5b,0x24,0x06,0x00,0x04,0x24,0x04,0x08,0x80,0x24,0x05,0x1e,0x00,
+0x0c,0x00,0x13,0x5b,0x24,0x06,0x00,0x04,0x24,0x04,0x0c,0x04,0x24,0x05,0x00,0x0f,
+0x0c,0x00,0x13,0x5b,0x24,0x06,0x00,0x04,0x24,0x04,0x0d,0x04,0x24,0x05,0x00,0x0f,
+0x0c,0x00,0x13,0x5b,0x24,0x06,0x00,0x04,0x24,0x04,0x08,0x24,0x3c,0x05,0x00,0x30,
+0x0c,0x00,0x13,0x5b,0x24,0x06,0x00,0x03,0x24,0x04,0x08,0x2c,0x3c,0x05,0x00,0x30,
+0x0c,0x00,0x13,0x5b,0x24,0x06,0x00,0x03,0x24,0x04,0x08,0x34,0x3c,0x05,0x00,0x30,
+0x0c,0x00,0x13,0x5b,0x24,0x06,0x00,0x02,0x3c,0x05,0x00,0x30,0x24,0x06,0x00,0x03,
+0x0c,0x00,0x13,0x5b,0x24,0x04,0x08,0x3c,0x02,0x20,0x20,0x21,0x24,0x05,0x00,0x14,
+0x0c,0x00,0x13,0xa0,0x24,0x06,0x01,0x07,0x08,0x00,0x17,0xf4,0x3c,0x02,0xb0,0x03,
+0x3c,0x03,0xb0,0x03,0x34,0x63,0x00,0x73,0x90,0x62,0x00,0x00,0x00,0x00,0x00,0x00,
+0x30,0x42,0x00,0x02,0x14,0x40,0x00,0x04,0x00,0x00,0x00,0x00,0xa3,0x80,0x81,0x59,
+0x03,0xe0,0x00,0x08,0x00,0x00,0x00,0x00,0x24,0x02,0x00,0x01,0xa3,0x82,0x81,0x59,
+0x03,0xe0,0x00,0x08,0x00,0x00,0x00,0x00,0x3c,0x03,0xb0,0x03,0x3c,0x02,0x80,0x00,
+0x00,0x80,0x70,0x21,0x34,0x63,0x00,0x20,0x24,0x42,0x61,0x38,0x3c,0x04,0xb0,0x03,
+0xac,0x62,0x00,0x00,0x34,0x84,0x00,0x30,0xad,0xc0,0x02,0xbc,0xad,0xc0,0x02,0xb8,
+0x8c,0x83,0x00,0x00,0x24,0x02,0x00,0xff,0xa5,0xc0,0x00,0x0a,0x00,0x00,0x30,0x21,
+0xa7,0x82,0x8f,0xe0,0x27,0x88,0x8f,0xf0,0xa5,0xc3,0x00,0x08,0x3c,0x07,0xb0,0x08,
+0x30,0xc2,0xff,0xff,0x00,0x02,0x20,0xc0,0x24,0xc3,0x00,0x01,0x00,0x82,0x10,0x21,
+0x00,0x60,0x30,0x21,0x00,0x02,0x10,0x80,0x30,0x63,0xff,0xff,0x00,0x48,0x10,0x21,
+0x00,0x87,0x20,0x21,0x28,0xc5,0x00,0xff,0xac,0x83,0x00,0x00,0x14,0xa0,0xff,0xf4,
+0xa4,0x43,0x00,0x00,0x3c,0x02,0xb0,0x08,0x34,0x03,0xff,0xff,0x25,0xc4,0x00,0x0c,
+0x24,0x0a,0x00,0x02,0x34,0x42,0x07,0xf8,0x3c,0x06,0xb0,0x03,0xa7,0x83,0xb3,0xcc,
+0xac,0x43,0x00,0x00,0xaf,0x84,0xb3,0xf0,0x34,0xc6,0x00,0x64,0xa0,0x8a,0x00,0x18,
+0x94,0xc5,0x00,0x00,0x8f,0x82,0xb3,0xf0,0x25,0xc4,0x00,0x30,0x24,0x08,0x00,0x03,
+0x3c,0x03,0xb0,0x03,0xa0,0x45,0x00,0x21,0x34,0x63,0x00,0x66,0xaf,0x84,0xb3,0xf4,
+0xa0,0x88,0x00,0x18,0x94,0x65,0x00,0x00,0x8f,0x82,0xb3,0xf4,0x25,0xc4,0x00,0x54,
+0x25,0xc7,0x00,0x78,0xa0,0x45,0x00,0x21,0xaf,0x84,0xb3,0xf8,0xa0,0x88,0x00,0x18,
+0x94,0x65,0x00,0x00,0x8f,0x82,0xb3,0xf8,0x25,0xc8,0x00,0x9c,0x24,0x09,0x00,0x01,
+0xa0,0x45,0x00,0x21,0xaf,0x87,0xb3,0xfc,0xa0,0xea,0x00,0x18,0x94,0xc4,0x00,0x00,
+0x8f,0x82,0xb3,0xfc,0x3c,0x03,0xb0,0x03,0x34,0x63,0x00,0x62,0xa0,0x44,0x00,0x21,
+0xaf,0x88,0xb4,0x00,0xa1,0x09,0x00,0x18,0x94,0x65,0x00,0x00,0x8f,0x82,0xb4,0x00,
+0x25,0xc4,0x00,0xc0,0x3c,0x06,0xb0,0x03,0xa0,0x45,0x00,0x21,0xaf,0x84,0xb4,0x04,
+0xa0,0x89,0x00,0x18,0x94,0x65,0x00,0x00,0x8f,0x82,0xb4,0x04,0x25,0xc4,0x00,0xe4,
+0x34,0xc6,0x00,0x60,0xa0,0x45,0x00,0x21,0xaf,0x84,0xb4,0x08,0xa0,0x80,0x00,0x18,
+0x94,0xc5,0x00,0x00,0x8f,0x82,0xb4,0x08,0x25,0xc3,0x01,0x08,0x25,0xc7,0x01,0x2c,
+0xa0,0x45,0x00,0x21,0xaf,0x83,0xb4,0x0c,0xa0,0x60,0x00,0x18,0x94,0xc8,0x00,0x00,
+0x8f,0x82,0xb4,0x0c,0x25,0xc4,0x01,0x50,0x25,0xc5,0x01,0x74,0xa0,0x48,0x00,0x21,
+0x25,0xc6,0x01,0x98,0x25,0xc9,0x01,0xbc,0x25,0xca,0x01,0xe0,0x25,0xcb,0x02,0x04,
+0x25,0xcc,0x02,0x28,0x25,0xcd,0x02,0x4c,0x24,0x02,0x00,0x10,0x3c,0x03,0xb0,0x03,
+0xaf,0x87,0xb4,0x10,0x34,0x63,0x00,0x38,0xa0,0xe0,0x00,0x18,0xaf,0x84,0xb4,0x14,
+0xa0,0x80,0x00,0x18,0xaf,0x85,0xb4,0x18,0xa0,0xa0,0x00,0x18,0xaf,0x86,0xb4,0x1c,
+0xa0,0xc0,0x00,0x18,0xaf,0x89,0xb4,0x20,0xa1,0x20,0x00,0x18,0xaf,0x8a,0xb4,0x24,
+0xa1,0x40,0x00,0x18,0xaf,0x8b,0xb4,0x28,0xa1,0x60,0x00,0x18,0xaf,0x8c,0xb4,0x2c,
+0xa1,0x80,0x00,0x18,0xaf,0x8d,0xb4,0x30,0xa1,0xa2,0x00,0x18,0x94,0x64,0x00,0x00,
+0x8f,0x82,0xb4,0x30,0x25,0xc5,0x02,0x70,0x3c,0x03,0xb0,0x03,0xa0,0x44,0x00,0x21,
+0x24,0x02,0x00,0x11,0xaf,0x85,0xb4,0x34,0x34,0x63,0x00,0x6e,0xa0,0xa2,0x00,0x18,
+0x94,0x64,0x00,0x00,0x8f,0x82,0xb4,0x34,0x25,0xc5,0x02,0x94,0x3c,0x03,0xb0,0x03,
+0xa0,0x44,0x00,0x21,0x24,0x02,0x00,0x12,0xaf,0x85,0xb4,0x38,0x34,0x63,0x00,0x6c,
+0xa0,0xa2,0x00,0x18,0x94,0x64,0x00,0x00,0x8f,0x82,0xb4,0x38,0x24,0x05,0xff,0xff,
+0x24,0x07,0x00,0x01,0xa0,0x44,0x00,0x21,0x24,0x06,0x00,0x12,0x27,0x84,0xb3,0xf0,
+0x8c,0x82,0x00,0x00,0x24,0xc6,0xff,0xff,0xa0,0x40,0x00,0x04,0x8c,0x83,0x00,0x00,
+0xa4,0x45,0x00,0x00,0xa4,0x45,0x00,0x02,0xa0,0x60,0x00,0x0a,0x8c,0x82,0x00,0x00,
+0xa4,0x65,0x00,0x06,0xa4,0x65,0x00,0x08,0xa0,0x40,0x00,0x10,0x8c,0x83,0x00,0x00,
+0xa4,0x45,0x00,0x0c,0xa4,0x45,0x00,0x0e,0xa0,0x60,0x00,0x12,0x8c,0x82,0x00,0x00,
+0x00,0x00,0x00,0x00,0xa0,0x40,0x00,0x16,0x8c,0x83,0x00,0x00,0xa4,0x45,0x00,0x14,
+0xa0,0x67,0x00,0x17,0x8c,0x82,0x00,0x00,0x24,0x84,0x00,0x04,0xa0,0x40,0x00,0x20,
+0x04,0xc1,0xff,0xe7,0xac,0x40,0x00,0x1c,0x03,0xe0,0x00,0x08,0x00,0x00,0x00,0x00,
+0x3c,0x03,0xb0,0x03,0x3c,0x02,0x80,0x00,0x34,0x63,0x00,0x20,0x24,0x42,0x64,0x00,
+0x00,0x05,0x28,0x40,0xac,0x62,0x00,0x00,0x00,0xa6,0x28,0x21,0x2c,0xe2,0x00,0x10,
+0x14,0x80,0x00,0x06,0x00,0x00,0x18,0x21,0x10,0x40,0x00,0x02,0x00,0x00,0x00,0x00,
+0x00,0xe0,0x18,0x21,0x03,0xe0,0x00,0x08,0x00,0x60,0x10,0x21,0x24,0x02,0x00,0x20,
+0x10,0xe2,0x00,0x06,0x2c,0xe4,0x00,0x10,0x24,0xa2,0x00,0x01,0x10,0x80,0xff,0xf9,
+0x00,0x02,0x11,0x00,0x08,0x00,0x19,0x0d,0x00,0x47,0x18,0x21,0x08,0x00,0x19,0x0d,
+0x24,0xa3,0x00,0x50,0x3c,0x03,0xb0,0x03,0x3c,0x02,0x80,0x00,0x27,0xbd,0xff,0xc8,
+0x34,0x63,0x00,0x20,0x24,0x42,0x64,0x64,0xaf,0xb2,0x00,0x18,0xaf,0xbf,0x00,0x34,
+0xaf,0xbe,0x00,0x30,0xaf,0xb7,0x00,0x2c,0xaf,0xb6,0x00,0x28,0xaf,0xb5,0x00,0x24,
+0xaf,0xb4,0x00,0x20,0xaf,0xb3,0x00,0x1c,0xaf,0xb1,0x00,0x14,0xaf,0xb0,0x00,0x10,
+0xac,0x62,0x00,0x00,0x8c,0x86,0x02,0xbc,0x00,0x80,0x90,0x21,0x14,0xc0,0x01,0x66,
+0x00,0xc0,0x38,0x21,0x84,0x82,0x00,0x08,0x3c,0x03,0xb0,0x06,0x94,0x84,0x00,0x08,
+0x00,0x02,0x10,0x80,0x00,0x43,0x10,0x21,0x8c,0x45,0x00,0x00,0x8c,0x43,0x00,0x00,
+0x24,0x84,0x00,0x02,0x30,0x84,0x01,0xff,0x30,0xb1,0xff,0xff,0x00,0x03,0x44,0x02,
+0xa6,0x44,0x00,0x08,0x14,0xe0,0x00,0x08,0x3c,0x03,0xb0,0x06,0x34,0x63,0x80,0x24,
+0x8c,0x62,0x00,0x00,0x00,0x00,0x00,0x00,0x34,0x42,0x01,0x00,0xac,0x62,0x00,0x00,
+0x8e,0x46,0x02,0xbc,0x00,0x00,0x00,0x00,0x14,0xc0,0x01,0x4c,0x00,0x11,0x98,0xc0,
+0x00,0x11,0x3a,0x00,0x3c,0x04,0xb0,0x00,0x00,0xe4,0x20,0x21,0x8c,0x83,0x00,0x0c,
+0x00,0x11,0x98,0xc0,0x02,0x71,0x10,0x21,0x00,0x03,0x1b,0x82,0x30,0x63,0x00,0x1f,
+0x00,0x02,0x10,0x80,0x27,0x9e,0x8f,0xf4,0x00,0x5e,0x10,0x21,0x00,0x60,0x30,0x21,
+0xac,0x44,0x00,0x18,0xae,0x43,0x02,0xbc,0x14,0xc0,0x00,0x10,0x3c,0x02,0xb0,0x00,
+0x00,0x08,0x10,0xc0,0x00,0x48,0x10,0x21,0x27,0x84,0x8f,0xf0,0x00,0x02,0x10,0x80,
+0x00,0x44,0x10,0x21,0x94,0x45,0x00,0x00,0x02,0x71,0x18,0x21,0x00,0x03,0x18,0x80,
+0x00,0x64,0x18,0x21,0x24,0x02,0xff,0xff,0xa4,0x62,0x00,0x02,0xa4,0x68,0x00,0x04,
+0xae,0x51,0x02,0xb8,0xa6,0x45,0x00,0x0a,0x3c,0x02,0xb0,0x00,0x00,0xe2,0x40,0x21,
+0x8d,0x16,0x00,0x00,0x8d,0x14,0x00,0x04,0x02,0x71,0x10,0x21,0x00,0x02,0x38,0x80,
+0x00,0x14,0x1a,0x02,0x27,0x84,0x90,0x00,0x30,0x63,0x00,0x1f,0x24,0x02,0x00,0x10,
+0x00,0xe4,0x20,0x21,0xa6,0x43,0x00,0x06,0x8d,0x10,0x00,0x08,0xa0,0x82,0x00,0x06,
+0x86,0x45,0x00,0x06,0x00,0xfe,0x10,0x21,0x24,0x03,0x00,0x13,0x10,0xa3,0x01,0x15,
+0xac,0x48,0x00,0x18,0x3c,0x03,0xb0,0x03,0x34,0x63,0x01,0x00,0xa6,0x40,0x00,0x02,
+0x3c,0x02,0xb0,0x03,0x90,0x64,0x00,0x00,0x34,0x42,0x01,0x08,0x8c,0x45,0x00,0x00,
+0x00,0x10,0x1b,0xc2,0x27,0x82,0x8f,0xf0,0x00,0x04,0x20,0x82,0x00,0xe2,0x10,0x21,
+0x30,0x63,0x00,0x01,0xac,0x45,0x00,0x08,0x10,0x60,0x00,0xec,0x30,0x97,0x00,0x01,
+0x00,0x10,0x16,0x82,0x30,0x46,0x00,0x01,0x00,0x10,0x12,0x02,0x00,0x10,0x19,0xc2,
+0x00,0x10,0x26,0x02,0x00,0x10,0x2e,0x42,0x30,0x47,0x00,0x7f,0x24,0x02,0x00,0x01,
+0x30,0x75,0x00,0x01,0x30,0x84,0x00,0x01,0x10,0xc2,0x00,0xd9,0x30,0xa3,0x00,0x01,
+0x0c,0x00,0x19,0x00,0x00,0x60,0x28,0x21,0x02,0x71,0x18,0x21,0x00,0x03,0x18,0x80,
+0x2c,0x46,0x00,0x54,0x27,0x85,0x90,0x00,0x27,0x84,0x8f,0xf8,0x00,0x06,0x10,0x0a,
+0x00,0x65,0x28,0x21,0x26,0xa6,0x00,0x02,0x00,0x64,0x18,0x21,0xa0,0xa2,0x00,0x02,
+0xa0,0x66,0x00,0x06,0xa0,0x62,0x00,0x07,0xa0,0xa2,0x00,0x01,0x02,0x71,0x20,0x21,
+0x00,0x04,0x20,0x80,0x00,0x9e,0x60,0x21,0x8d,0x85,0x00,0x18,0x00,0x10,0x15,0xc2,
+0x30,0x42,0x00,0x01,0x8c,0xa3,0x00,0x0c,0xa6,0x42,0x00,0x00,0x27,0x82,0x90,0x10,
+0x00,0x82,0x50,0x21,0xa6,0x56,0x00,0x04,0x8d,0x45,0x00,0x00,0x00,0x03,0x19,0x42,
+0x3c,0x02,0xff,0xef,0x34,0x42,0xff,0xff,0x30,0x63,0x00,0x01,0x00,0xa2,0x48,0x24,
+0x00,0x03,0x1d,0x00,0x01,0x23,0x48,0x25,0x00,0x09,0x15,0x02,0x26,0xc5,0x00,0x10,
+0x00,0x14,0x19,0x82,0x00,0x14,0x25,0x82,0x00,0x10,0x34,0x02,0x00,0x10,0x3c,0x42,
+0x00,0x10,0x44,0x82,0x30,0x42,0x00,0x01,0x30,0xb5,0xff,0xff,0x30,0xce,0x00,0x01,
+0x30,0xe5,0x00,0x01,0x30,0x6d,0x00,0x01,0x30,0x8b,0x00,0x03,0x32,0x94,0x00,0x07,
+0x31,0x06,0x00,0x01,0xad,0x49,0x00,0x00,0x10,0x40,0x00,0x0b,0x32,0x07,0x00,0x7f,
+0x8d,0x84,0x00,0x18,0x3c,0x03,0xff,0xf0,0x34,0x63,0xff,0xff,0x8c,0x82,0x00,0x0c,
+0x01,0x23,0x18,0x24,0x00,0x02,0x13,0x82,0x30,0x42,0x00,0x0f,0x00,0x02,0x14,0x00,
+0x00,0x62,0x18,0x25,0xad,0x43,0x00,0x00,0x24,0x02,0x00,0x01,0x10,0xc2,0x00,0x90,
+0x00,0x00,0x00,0x00,0x15,0xa0,0x00,0x03,0x00,0x00,0x00,0x00,0x15,0x60,0x00,0x81,
+0x24,0x02,0x00,0x01,0x96,0x42,0x00,0x04,0x00,0x00,0x00,0x00,0x24,0x42,0x00,0x04,
+0xa6,0x42,0x00,0x04,0x0c,0x00,0x19,0x00,0x01,0xc0,0x20,0x21,0x02,0x71,0x18,0x21,
+0x00,0x03,0x38,0x80,0x2c,0x45,0x00,0x54,0x27,0x84,0x90,0x00,0x00,0xe4,0x20,0x21,
+0x00,0x05,0x10,0x0a,0xa0,0x82,0x00,0x00,0xa0,0x80,0x00,0x04,0xa0,0x80,0x00,0x05,
+0x96,0x45,0x00,0x04,0x27,0x82,0x8f,0xf0,0x00,0xe2,0x10,0x21,0xa4,0x45,0x00,0x06,
+0x00,0xfe,0x18,0x21,0x92,0x45,0x00,0x01,0x8c,0x66,0x00,0x18,0x27,0x82,0x90,0x10,
+0x00,0xe2,0x10,0x21,0xa0,0x40,0x00,0x00,0xa0,0x85,0x00,0x07,0x94,0xc3,0x00,0x10,
+0x24,0x02,0x00,0x04,0x30,0x63,0x00,0x0f,0x10,0x62,0x00,0x5e,0x24,0xc6,0x00,0x10,
+0x94,0xc3,0x00,0x16,0x27,0x85,0x90,0x08,0x00,0xe5,0x10,0x21,0xa4,0x43,0x00,0x02,
+0x94,0xc2,0x00,0x04,0x00,0x00,0x00,0x00,0x30,0x42,0x00,0x01,0x14,0x40,0x00,0x4c,
+0x02,0x71,0x20,0x21,0x94,0xc2,0x00,0x00,0x24,0x03,0x00,0xa4,0x30,0x42,0x00,0xff,
+0x10,0x43,0x00,0x47,0x00,0x00,0x00,0x00,0x94,0xc2,0x00,0x00,0x24,0x03,0x00,0x88,
+0x30,0x42,0x00,0x88,0x10,0x43,0x00,0x3c,0x02,0x71,0x18,0x21,0x27,0x84,0x90,0x10,
+0x00,0x03,0x18,0x80,0x00,0x64,0x18,0x21,0x8c,0x62,0x00,0x00,0x3c,0x04,0x00,0x80,
+0x00,0x44,0x10,0x25,0xac,0x62,0x00,0x00,0x02,0x71,0x10,0x21,0x00,0x02,0x10,0x80,
+0x00,0x45,0x10,0x21,0xa0,0x54,0x00,0x00,0x92,0x43,0x02,0xbf,0x3c,0x02,0xb0,0x03,
+0x34,0x42,0x00,0xc3,0xa0,0x43,0x00,0x00,0x8e,0x4b,0x02,0xbc,0x00,0x00,0x00,0x00,
+0x11,0x60,0x00,0x1c,0x32,0xa2,0x00,0xff,0x00,0x15,0x1a,0x02,0x30,0x64,0xff,0xff,
+0x38,0x42,0x00,0x00,0x24,0x65,0x00,0x01,0x00,0x82,0x28,0x0a,0x02,0x20,0x30,0x21,
+0x10,0xa0,0x00,0x12,0x00,0x00,0x38,0x21,0x02,0x71,0x10,0x21,0x00,0x02,0x10,0x80,
+0x27,0x83,0x8f,0xf0,0x00,0x43,0x20,0x21,0x24,0xa9,0xff,0xff,0x3c,0x0a,0xb0,0x08,
+0x24,0x0c,0xff,0xff,0x00,0x06,0x10,0xc0,0x00,0x4a,0x10,0x21,0x8c,0x43,0x00,0x00,
+0x24,0xe8,0x00,0x01,0x10,0xe9,0x00,0x0f,0x30,0x63,0x00,0xff,0x31,0x07,0xff,0xff,
+0x00,0xe5,0x10,0x2b,0x14,0x40,0xff,0xf7,0x00,0x60,0x30,0x21,0x25,0x62,0xff,0xff,
+0xae,0x42,0x02,0xbc,0x7b,0xbe,0x01,0xbc,0x7b,0xb6,0x01,0x7c,0x7b,0xb4,0x01,0x3c,
+0x7b,0xb2,0x00,0xfc,0x7b,0xb0,0x00,0xbc,0x24,0x02,0x00,0x01,0x03,0xe0,0x00,0x08,
+0x27,0xbd,0x00,0x38,0xa4,0x86,0x00,0x04,0xa4,0x8c,0x00,0x02,0xae,0x51,0x02,0xb8,
+0x08,0x00,0x1a,0x2f,0xa6,0x43,0x00,0x0a,0x94,0xc2,0x00,0x18,0x00,0x00,0x00,0x00,
+0x30,0x42,0x00,0x60,0x10,0x40,0xff,0xc1,0x02,0x71,0x18,0x21,0x02,0x71,0x20,0x21,
+0x27,0x82,0x90,0x10,0x00,0x04,0x20,0x80,0x00,0x82,0x20,0x21,0x8c,0x83,0x00,0x00,
+0x3c,0x02,0xff,0x7f,0x34,0x42,0xff,0xff,0x00,0x62,0x18,0x24,0x08,0x00,0x1a,0x0e,
+0xac,0x83,0x00,0x00,0x27,0x85,0x90,0x08,0x00,0xe5,0x10,0x21,0x08,0x00,0x19,0xf8,
+0xa4,0x40,0x00,0x02,0x11,0x62,0x00,0x07,0x00,0x00,0x00,0x00,0x2d,0x62,0x00,0x02,
+0x14,0x40,0xff,0x80,0x00,0x00,0x00,0x00,0x96,0x42,0x00,0x04,0x08,0x00,0x19,0xd8,
+0x24,0x42,0x00,0x0c,0x96,0x42,0x00,0x04,0x08,0x00,0x19,0xd8,0x24,0x42,0x00,0x08,
+0x16,0xe6,0xff,0x70,0x3c,0x02,0xff,0xfb,0x8d,0x83,0x00,0x18,0x34,0x42,0xff,0xff,
+0x02,0x02,0x10,0x24,0xac,0x62,0x00,0x08,0x08,0x00,0x19,0xd1,0x00,0x00,0x30,0x21,
+0x16,0xe6,0xff,0x27,0x3c,0x02,0xfb,0xff,0x34,0x42,0xff,0xff,0x02,0x02,0x10,0x24,
+0xad,0x02,0x00,0x08,0x08,0x00,0x19,0x90,0x00,0x00,0x30,0x21,0x93,0x88,0xbb,0x04,
+0x00,0x10,0x1e,0x42,0x00,0x10,0x26,0x82,0x27,0x82,0x8f,0xf8,0x2d,0x05,0x00,0x0c,
+0x00,0xe2,0x48,0x21,0x30,0x63,0x00,0x01,0x30,0x86,0x00,0x01,0x14,0xa0,0x00,0x06,
+0x01,0x00,0x38,0x21,0x00,0x03,0x10,0x40,0x00,0x46,0x10,0x21,0x00,0x02,0x11,0x00,
+0x01,0x02,0x10,0x21,0x24,0x47,0x00,0x04,0x02,0x71,0x10,0x21,0x00,0x02,0x10,0x80,
+0x27,0x84,0x90,0x00,0x27,0x83,0x8f,0xf8,0x00,0x44,0x20,0x21,0x00,0x43,0x10,0x21,
+0xa1,0x27,0x00,0x07,0xa0,0x40,0x00,0x06,0xa0,0x80,0x00,0x02,0x08,0x00,0x19,0x9f,
+0xa0,0x80,0x00,0x01,0x24,0x02,0x00,0x01,0xa6,0x42,0x00,0x02,0x0c,0x00,0x01,0xc4,
+0x01,0x00,0x20,0x21,0x08,0x00,0x1a,0x35,0x00,0x00,0x00,0x00,0x27,0x9e,0x8f,0xf4,
+0x08,0x00,0x19,0x52,0x00,0x11,0x3a,0x00,0x94,0x91,0x00,0x0a,0x08,0x00,0x19,0x39,
+0x00,0x00,0x00,0x00,0x30,0xa9,0xff,0xff,0x00,0x09,0x18,0xc0,0x00,0x69,0x18,0x21,
+0x3c,0x06,0xb0,0x03,0x3c,0x02,0x80,0x00,0x24,0x42,0x6a,0x54,0x00,0x03,0x18,0x80,
+0x34,0xc6,0x00,0x20,0x27,0x85,0x90,0x00,0xac,0xc2,0x00,0x00,0x00,0x65,0x18,0x21,
+0x80,0x62,0x00,0x07,0x00,0x00,0x00,0x00,0x10,0x40,0x00,0x32,0x24,0x88,0x00,0x06,
+0x90,0x82,0x00,0x16,0x00,0x80,0x40,0x21,0x34,0x42,0x00,0x02,0x30,0x43,0x00,0x01,
+0x14,0x60,0x00,0x02,0xa0,0x82,0x00,0x16,0xa0,0x80,0x00,0x17,0x95,0x03,0x00,0x02,
+0x00,0x00,0x00,0x00,0x10,0x69,0x00,0x22,0x3c,0x02,0x34,0x34,0x91,0x02,0x00,0x04,
+0x00,0x00,0x00,0x00,0x14,0x40,0x00,0x06,0x00,0x03,0x20,0xc0,0x24,0x02,0x00,0x01,
+0xa1,0x02,0x00,0x04,0xa5,0x09,0x00,0x02,0x03,0xe0,0x00,0x08,0xa5,0x09,0x00,0x00,
+0x00,0x83,0x20,0x21,0x27,0x87,0x8f,0xf0,0x00,0x04,0x20,0x80,0x00,0x87,0x20,0x21,
+0x94,0x83,0x00,0x04,0x3c,0x02,0xb0,0x08,0x3c,0x06,0xb0,0x03,0x00,0x03,0x28,0xc0,
+0x00,0xa3,0x18,0x21,0x00,0x03,0x18,0x80,0x00,0xa2,0x28,0x21,0x3c,0x02,0x80,0x01,
+0x24,0x42,0x82,0xe4,0x00,0x67,0x18,0x21,0x34,0xc6,0x00,0x20,0xac,0xc2,0x00,0x00,
+0xa4,0x69,0x00,0x00,0xa4,0x89,0x00,0x02,0xac,0xa9,0x00,0x00,0x91,0x02,0x00,0x04,
+0xa5,0x09,0x00,0x02,0x24,0x42,0x00,0x01,0x03,0xe0,0x00,0x08,0xa1,0x02,0x00,0x04,
+0x3c,0x03,0xb0,0x03,0x34,0x63,0x00,0xb0,0x34,0x42,0x34,0x34,0x03,0xe0,0x00,0x08,
+0xac,0x62,0x00,0x00,0x90,0x82,0x00,0x16,0x00,0x00,0x00,0x00,0x34,0x42,0x00,0x01,
+0x30,0x43,0x00,0x02,0x14,0x60,0xff,0xd1,0xa0,0x82,0x00,0x16,0x24,0x02,0x00,0x01,
+0x08,0x00,0x1a,0xab,0xa0,0x82,0x00,0x17,0x27,0xbd,0xff,0xe8,0xaf,0xbf,0x00,0x10,
+0x00,0x80,0x38,0x21,0x84,0x84,0x00,0x02,0x3c,0x03,0xb0,0x03,0x3c,0x02,0x80,0x00,
+0x3c,0x0a,0xb0,0x06,0x34,0x63,0x00,0x20,0x24,0x42,0x6b,0x78,0x3c,0x0b,0xb0,0x08,
+0x27,0x89,0x8f,0xf0,0x34,0x0c,0xff,0xff,0x35,0x4a,0x80,0x20,0x10,0x80,0x00,0x30,
+0xac,0x62,0x00,0x00,0x97,0x82,0x8f,0xe0,0x94,0xe6,0x02,0xba,0x00,0x02,0x18,0xc0,
+0x00,0x6b,0x28,0x21,0xac,0xa6,0x00,0x00,0x8c,0xe4,0x02,0xb8,0x00,0x62,0x18,0x21,
+0x00,0x03,0x18,0x80,0x00,0x04,0x10,0xc0,0x00,0x44,0x10,0x21,0x00,0x02,0x10,0x80,
+0x00,0x49,0x10,0x21,0x94,0x48,0x00,0x04,0x00,0x69,0x18,0x21,0xa4,0x66,0x00,0x00,
+0x00,0x08,0x28,0xc0,0x00,0xab,0x10,0x21,0xac,0x4c,0x00,0x00,0x8c,0xe4,0x02,0xb8,
+0x27,0x82,0x8f,0xf4,0x00,0xa8,0x28,0x21,0x00,0x04,0x18,0xc0,0x00,0x64,0x18,0x21,
+0x00,0x03,0x18,0x80,0x00,0x62,0x10,0x21,0x8c,0x46,0x00,0x18,0x27,0x84,0x90,0x00,
+0x00,0x64,0x18,0x21,0x8c,0xc2,0x00,0x00,0x80,0x67,0x00,0x06,0x00,0x05,0x28,0x80,
+0x30,0x42,0xff,0xff,0x00,0x47,0x10,0x21,0x30,0x43,0x00,0xff,0x00,0x03,0x18,0x2b,
+0x00,0x02,0x12,0x02,0x00,0x43,0x10,0x21,0x3c,0x04,0x00,0x04,0x00,0xa9,0x28,0x21,
+0x00,0x44,0x10,0x25,0xa4,0xac,0x00,0x00,0xad,0x42,0x00,0x00,0xa7,0x88,0x8f,0xe0,
+0x8f,0xbf,0x00,0x10,0x00,0x00,0x00,0x00,0x03,0xe0,0x00,0x08,0x27,0xbd,0x00,0x18,
+0x84,0xe3,0x00,0x06,0x27,0x82,0xb3,0xf0,0x94,0xe5,0x02,0xba,0x00,0x03,0x18,0x80,
+0x00,0x62,0x18,0x21,0x8c,0x64,0x00,0x00,0x0c,0x00,0x1a,0x95,0x00,0x00,0x00,0x00,
+0x08,0x00,0x1b,0x18,0x00,0x00,0x00,0x00,0x94,0x88,0x00,0x00,0x00,0x80,0x58,0x21,
+0x27,0x8a,0x8f,0xf0,0x00,0x08,0x18,0xc0,0x00,0x68,0x18,0x21,0x3c,0x04,0xb0,0x03,
+0x00,0x03,0x18,0x80,0x3c,0x02,0x80,0x00,0x00,0x6a,0x18,0x21,0x34,0x84,0x00,0x20,
+0x24,0x42,0x6c,0x98,0x30,0xa5,0xff,0xff,0xac,0x82,0x00,0x00,0x94,0x67,0x00,0x02,
+0x11,0x05,0x00,0x35,0x24,0x04,0x00,0x01,0x91,0x66,0x00,0x04,0x00,0x00,0x00,0x00,
+0x00,0x86,0x10,0x2a,0x10,0x40,0x00,0x10,0x00,0xc0,0x48,0x21,0x3c,0x0d,0xb0,0x03,
+0x01,0x40,0x60,0x21,0x35,0xad,0x00,0x20,0x10,0xe5,0x00,0x0d,0x24,0x84,0x00,0x01,
+0x00,0x07,0x10,0xc0,0x00,0x47,0x10,0x21,0x00,0x02,0x10,0x80,0x01,0x20,0x30,0x21,
+0x00,0x4a,0x10,0x21,0x00,0x86,0x18,0x2a,0x00,0xe0,0x40,0x21,0x94,0x47,0x00,0x02,
+0x14,0x60,0xff,0xf5,0x00,0x00,0x00,0x00,0x03,0xe0,0x00,0x08,0x00,0x00,0x10,0x21,
+0x00,0x08,0x20,0xc0,0x00,0x88,0x20,0x21,0x24,0xc2,0xff,0xff,0x00,0x04,0x20,0x80,
+0xa1,0x62,0x00,0x04,0x00,0x8c,0x20,0x21,0x94,0x83,0x00,0x04,0x00,0x07,0x10,0xc0,
+0x00,0x47,0x10,0x21,0x00,0x02,0x10,0x80,0x00,0x4c,0x10,0x21,0x00,0x03,0x28,0xc0,
+0x94,0x46,0x00,0x02,0x00,0xa3,0x18,0x21,0x00,0x03,0x18,0x80,0x00,0x6c,0x18,0x21,
+0xa4,0x66,0x00,0x00,0xa4,0x86,0x00,0x02,0x95,0x64,0x00,0x02,0x3c,0x03,0xb0,0x08,
+0x3c,0x02,0x80,0x01,0x00,0xa3,0x28,0x21,0x24,0x42,0x82,0xe4,0xad,0xa2,0x00,0x00,
+0x10,0x87,0x00,0x03,0xac,0xa6,0x00,0x00,0x03,0xe0,0x00,0x08,0x24,0x02,0x00,0x01,
+0x08,0x00,0x1b,0x66,0xa5,0x68,0x00,0x02,0x91,0x62,0x00,0x04,0xa5,0x67,0x00,0x00,
+0x24,0x42,0xff,0xff,0x30,0x43,0x00,0xff,0x14,0x60,0x00,0x03,0xa1,0x62,0x00,0x04,
+0x24,0x02,0xff,0xff,0xa5,0x62,0x00,0x02,0x91,0x65,0x00,0x04,0x00,0x00,0x00,0x00,
+0x10,0xa0,0xff,0xf1,0x00,0x00,0x00,0x00,0x95,0x66,0x00,0x00,0x34,0x02,0xff,0xff,
+0x14,0xc2,0xff,0xed,0x3c,0x03,0xb0,0x03,0x95,0x64,0x00,0x02,0x3c,0x02,0xee,0xee,
+0x00,0xa2,0x10,0x25,0x34,0x63,0x00,0xbc,0xac,0x62,0x00,0x00,0x10,0x86,0xff,0xe6,
+0xa1,0x60,0x00,0x04,0x24,0x02,0xff,0xff,0x08,0x00,0x1b,0x66,0xa5,0x62,0x00,0x02,
+0x00,0x05,0x40,0xc0,0x01,0x05,0x30,0x21,0x27,0xbd,0xff,0xd8,0x00,0x06,0x30,0x80,
+0x27,0x82,0x8f,0xf4,0xaf,0xb2,0x00,0x18,0xaf,0xb1,0x00,0x14,0xaf,0xbf,0x00,0x20,
+0xaf,0xb3,0x00,0x1c,0xaf,0xb0,0x00,0x10,0x00,0xc2,0x10,0x21,0x8c,0x47,0x00,0x18,
+0x00,0xa0,0x90,0x21,0x3c,0x02,0x80,0x00,0x3c,0x05,0xb0,0x03,0x34,0xa5,0x00,0x20,
+0x24,0x42,0x6e,0x10,0xac,0xa2,0x00,0x00,0x27,0x83,0x90,0x00,0x00,0xc3,0x30,0x21,
+0x8c,0xe2,0x00,0x00,0x80,0xc5,0x00,0x06,0x00,0x80,0x88,0x21,0x30,0x42,0xff,0xff,
+0x00,0x45,0x10,0x21,0x30,0x43,0x00,0xff,0x10,0x60,0x00,0x02,0x00,0x02,0x12,0x02,
+0x24,0x42,0x00,0x01,0x30,0x53,0x00,0xff,0x01,0x12,0x10,0x21,0x00,0x02,0x10,0x80,
+0x27,0x83,0x90,0x00,0x00,0x43,0x10,0x21,0x80,0x44,0x00,0x07,0x00,0x00,0x00,0x00,
+0x10,0x80,0x00,0x4b,0x26,0x24,0x00,0x06,0x32,0x50,0xff,0xff,0x02,0x20,0x20,0x21,
+0x0c,0x00,0x1b,0x26,0x02,0x00,0x28,0x21,0x92,0x22,0x00,0x10,0x00,0x00,0x00,0x00,
+0x14,0x40,0x00,0x2e,0x3c,0x03,0xb0,0x08,0x3c,0x09,0x80,0x01,0x27,0x88,0x8f,0xf0,
+0xa6,0x32,0x00,0x0c,0x00,0x10,0x20,0xc0,0x00,0x90,0x20,0x21,0x00,0x04,0x20,0x80,
+0x00,0x88,0x20,0x21,0x94,0x82,0x00,0x04,0x3c,0x03,0xb0,0x08,0x3c,0x07,0xb0,0x03,
+0x00,0x02,0x28,0xc0,0x00,0xa2,0x10,0x21,0x00,0x02,0x10,0x80,0x00,0x48,0x10,0x21,
+0x00,0xa3,0x28,0x21,0x25,0x26,0x82,0xe4,0x34,0x03,0xff,0xff,0x34,0xe7,0x00,0x20,
+0xac,0xe6,0x00,0x00,0xa4,0x83,0x00,0x02,0xa4,0x43,0x00,0x00,0xac,0xa3,0x00,0x00,
+0x92,0x22,0x00,0x10,0x92,0x23,0x00,0x0a,0xa6,0x32,0x00,0x0e,0x02,0x62,0x10,0x21,
+0x14,0x60,0x00,0x05,0xa2,0x22,0x00,0x10,0x92,0x22,0x00,0x16,0x00,0x00,0x00,0x00,
+0x30,0x42,0x00,0xfe,0xa2,0x22,0x00,0x16,0x92,0x22,0x00,0x04,0x00,0x00,0x00,0x00,
+0x14,0x40,0x00,0x05,0x00,0x00,0x00,0x00,0x92,0x22,0x00,0x16,0x00,0x00,0x00,0x00,
+0x30,0x42,0x00,0xfd,0xa2,0x22,0x00,0x16,0x8f,0xbf,0x00,0x20,0x7b,0xb2,0x00,0xfc,
+0x7b,0xb0,0x00,0xbc,0x03,0xe0,0x00,0x08,0x27,0xbd,0x00,0x28,0x96,0x22,0x00,0x0e,
+0x27,0x88,0x8f,0xf0,0x00,0x02,0x20,0xc0,0x00,0x82,0x20,0x21,0x00,0x04,0x20,0x80,
+0x00,0x88,0x20,0x21,0x94,0x82,0x00,0x04,0x3c,0x06,0xb0,0x03,0x3c,0x09,0x80,0x01,
+0x00,0x02,0x28,0xc0,0x00,0xa2,0x10,0x21,0x00,0x02,0x10,0x80,0x00,0xa3,0x28,0x21,
+0x00,0x48,0x10,0x21,0x34,0xc6,0x00,0x20,0x25,0x23,0x82,0xe4,0xac,0xc3,0x00,0x00,
+0xa4,0x50,0x00,0x00,0xac,0xb0,0x00,0x00,0x08,0x00,0x1b,0xb5,0xa4,0x90,0x00,0x02,
+0x08,0x00,0x1b,0xac,0x32,0x50,0xff,0xff,0x3c,0x03,0xb0,0x03,0x3c,0x02,0x80,0x00,
+0x24,0x42,0x6f,0xd8,0x34,0x63,0x00,0x20,0xac,0x62,0x00,0x00,0x90,0x82,0x00,0x04,
+0x97,0xaa,0x00,0x12,0x00,0x80,0x60,0x21,0x30,0xa8,0xff,0xff,0x00,0x4a,0x20,0x23,
+0x34,0x09,0xff,0xff,0x30,0xcf,0xff,0xff,0x30,0xee,0xff,0xff,0x11,0x09,0x00,0x73,
+0xa1,0x84,0x00,0x04,0x00,0x0e,0xc0,0xc0,0x00,0x08,0x10,0xc0,0x00,0x48,0x10,0x21,
+0x03,0x0e,0x20,0x21,0x27,0x8d,0x8f,0xf0,0x00,0x04,0x20,0x80,0x00,0x02,0x10,0x80,
+0x00,0x4d,0x10,0x21,0x00,0x8d,0x20,0x21,0x94,0x86,0x00,0x02,0x94,0x43,0x00,0x04,
+0x3c,0x19,0x80,0x01,0xa4,0x46,0x00,0x02,0x00,0x03,0x28,0xc0,0x00,0xa3,0x18,0x21,
+0x94,0x87,0x00,0x02,0x3c,0x02,0xb0,0x08,0x00,0x03,0x18,0x80,0x00,0xa2,0x28,0x21,
+0x00,0x6d,0x18,0x21,0x27,0x22,0x82,0xe4,0x3c,0x01,0xb0,0x03,0xac,0x22,0x00,0x20,
+0xa4,0x66,0x00,0x00,0x10,0xe9,0x00,0x57,0xac,0xa6,0x00,0x00,0x01,0xe0,0x30,0x21,
+0x11,0x40,0x00,0x1d,0x00,0x00,0x48,0x21,0x01,0x40,0x38,0x21,0x27,0x8b,0x8f,0xf4,
+0x27,0x8a,0x90,0x00,0x00,0x06,0x40,0xc0,0x01,0x06,0x18,0x21,0x00,0x03,0x18,0x80,
+0x00,0x6b,0x10,0x21,0x8c,0x44,0x00,0x18,0x00,0x6a,0x18,0x21,0x80,0x65,0x00,0x06,
+0x8c,0x82,0x00,0x00,0x00,0x00,0x00,0x00,0x30,0x42,0xff,0xff,0x00,0x45,0x10,0x21,
+0x30,0x44,0x00,0xff,0x00,0x02,0x12,0x02,0x01,0x22,0x18,0x21,0x24,0x62,0x00,0x01,
+0x14,0x80,0x00,0x02,0x30,0x49,0x00,0xff,0x30,0x69,0x00,0xff,0x01,0x06,0x10,0x21,
+0x00,0x02,0x10,0x80,0x00,0x4d,0x10,0x21,0x24,0xe7,0xff,0xff,0x94,0x46,0x00,0x02,
+0x14,0xe0,0xff,0xe9,0x00,0x06,0x40,0xc0,0x91,0x82,0x00,0x10,0x00,0x00,0x00,0x00,
+0x14,0x40,0x00,0x20,0x3c,0x06,0xb0,0x03,0xa5,0x8f,0x00,0x0c,0x03,0x0e,0x20,0x21,
+0x00,0x04,0x20,0x80,0x00,0x8d,0x20,0x21,0x94,0x82,0x00,0x04,0x3c,0x03,0xb0,0x08,
+0x3c,0x07,0xb0,0x03,0x00,0x02,0x28,0xc0,0x00,0xa2,0x10,0x21,0x00,0x02,0x10,0x80,
+0x00,0x4d,0x10,0x21,0x00,0xa3,0x28,0x21,0x27,0x26,0x82,0xe4,0x34,0x03,0xff,0xff,
+0x34,0xe7,0x00,0x20,0xac,0xe6,0x00,0x00,0xa4,0x83,0x00,0x02,0xa4,0x43,0x00,0x00,
+0xac,0xa3,0x00,0x00,0x91,0x82,0x00,0x10,0x91,0x83,0x00,0x04,0xa5,0x8e,0x00,0x0e,
+0x01,0x22,0x10,0x21,0x14,0x60,0x00,0x05,0xa1,0x82,0x00,0x10,0x91,0x82,0x00,0x16,
+0x00,0x00,0x00,0x00,0x30,0x42,0x00,0xfd,0xa1,0x82,0x00,0x16,0x03,0xe0,0x00,0x08,
+0x00,0x00,0x00,0x00,0x95,0x82,0x00,0x0e,0x3c,0x03,0xb0,0x08,0x00,0x02,0x20,0xc0,
+0x00,0x82,0x20,0x21,0x00,0x04,0x20,0x80,0x00,0x8d,0x20,0x21,0x94,0x82,0x00,0x04,
+0x34,0xc6,0x00,0x20,0x27,0x27,0x82,0xe4,0x00,0x02,0x28,0xc0,0x00,0xa2,0x10,0x21,
+0x00,0x02,0x10,0x80,0x00,0xa3,0x28,0x21,0x00,0x4d,0x10,0x21,0xac,0xc7,0x00,0x00,
+0xa4,0x8f,0x00,0x02,0xa4,0x4f,0x00,0x00,0xac,0xaf,0x00,0x00,0x08,0x00,0x1c,0x44,
+0x03,0x0e,0x20,0x21,0x08,0x00,0x1c,0x1f,0xa5,0x88,0x00,0x02,0x00,0x0e,0xc0,0xc0,
+0x03,0x0e,0x10,0x21,0x00,0x02,0x10,0x80,0x27,0x8d,0x8f,0xf0,0x00,0x4d,0x10,0x21,
+0x94,0x43,0x00,0x02,0x30,0x84,0x00,0xff,0x14,0x80,0x00,0x05,0xa5,0x83,0x00,0x00,
+0x24,0x02,0xff,0xff,0x3c,0x19,0x80,0x01,0x08,0x00,0x1c,0x1f,0xa5,0x82,0x00,0x02,
+0x08,0x00,0x1c,0x1f,0x3c,0x19,0x80,0x01,0x3c,0x08,0xb0,0x03,0x3c,0x02,0x80,0x00,
+0x27,0xbd,0xff,0x78,0x35,0x08,0x00,0x20,0x24,0x42,0x72,0x18,0xaf,0xb2,0x00,0x68,
+0xaf,0xb1,0x00,0x64,0xaf,0xb0,0x00,0x60,0xad,0x02,0x00,0x00,0xaf,0xbf,0x00,0x84,
+0xaf,0xbe,0x00,0x80,0xaf,0xb7,0x00,0x7c,0xaf,0xb6,0x00,0x78,0xaf,0xb5,0x00,0x74,
+0xaf,0xb4,0x00,0x70,0xaf,0xb3,0x00,0x6c,0xaf,0xa4,0x00,0x88,0x90,0x83,0x00,0x0a,
+0x27,0x82,0xb3,0xf0,0xaf,0xa6,0x00,0x90,0x00,0x03,0x18,0x80,0x00,0x62,0x18,0x21,
+0x8c,0x63,0x00,0x00,0xaf,0xa7,0x00,0x94,0x27,0x86,0x8f,0xf4,0xaf,0xa3,0x00,0x1c,
+0x94,0x63,0x00,0x14,0x30,0xb1,0xff,0xff,0x24,0x08,0x00,0x01,0x00,0x03,0x20,0xc0,
+0xaf,0xa3,0x00,0x18,0x00,0x83,0x18,0x21,0xaf,0xa4,0x00,0x54,0x00,0x03,0x18,0x80,
+0x27,0x84,0x90,0x00,0x00,0x64,0x20,0x21,0x80,0x82,0x00,0x06,0x00,0x66,0x18,0x21,
+0x8c,0x66,0x00,0x18,0x24,0x42,0x00,0x02,0x00,0x02,0x1f,0xc2,0x8c,0xc4,0x00,0x08,
+0x00,0x43,0x10,0x21,0x00,0x02,0x10,0x43,0x00,0x02,0x10,0x40,0x00,0x04,0x2f,0xc2,
+0x00,0x04,0x1c,0x82,0x00,0xc2,0x38,0x21,0x00,0x04,0x24,0x42,0x8f,0xa2,0x00,0x1c,
+0x30,0x63,0x00,0x01,0x30,0x84,0x00,0x01,0xaf,0xa5,0x00,0x3c,0xaf,0xa3,0x00,0x34,
+0xaf,0xa4,0x00,0x38,0xaf,0xa0,0x00,0x40,0xaf,0xa0,0x00,0x44,0xaf,0xa0,0x00,0x50,
+0xaf,0xa8,0x00,0x20,0x80,0x42,0x00,0x12,0x8f,0xb2,0x00,0x18,0xaf,0xa2,0x00,0x28,
+0x8c,0xd0,0x00,0x0c,0x14,0xa0,0x01,0xe4,0x00,0x60,0x30,0x21,0x00,0x10,0x10,0x82,
+0x30,0x45,0x00,0x07,0x10,0xa0,0x00,0x11,0xaf,0xa0,0x00,0x30,0x8f,0xa4,0x00,0x98,
+0x27,0x82,0x80,0x1c,0x00,0x04,0x18,0x40,0x00,0x62,0x18,0x21,0x24,0xa2,0x00,0x06,
+0x8f,0xa5,0x00,0x20,0x94,0x64,0x00,0x00,0x00,0x45,0x10,0x04,0x00,0x44,0x00,0x1a,
+0x14,0x80,0x00,0x02,0x00,0x00,0x00,0x00,0x00,0x07,0x00,0x0d,0x00,0x00,0x10,0x12,
+0x24,0x42,0x00,0x20,0x30,0x42,0xff,0xfc,0xaf,0xa2,0x00,0x30,0x8f,0xa3,0x00,0x18,
+0x8f,0xa4,0x00,0x28,0x34,0x02,0xff,0xff,0xaf,0xa0,0x00,0x2c,0xaf,0xa2,0x00,0x48,
+0xaf,0xa3,0x00,0x4c,0x00,0x60,0xf0,0x21,0x00,0x00,0xb8,0x21,0x18,0x80,0x00,0x48,
+0xaf,0xa0,0x00,0x24,0x00,0x11,0x89,0x02,0xaf,0xb1,0x00,0x58,0x00,0x80,0xa8,0x21,
+0x00,0x12,0x10,0xc0,0x00,0x52,0x18,0x21,0x00,0x03,0x80,0x80,0x27,0x85,0x8f,0xf0,
+0x02,0x40,0x20,0x21,0x00,0x40,0xa0,0x21,0x02,0x05,0x10,0x21,0x94,0x56,0x00,0x02,
+0x0c,0x00,0x12,0x87,0x00,0x00,0x28,0x21,0x90,0x42,0x00,0x00,0x24,0x03,0x00,0x08,
+0x30,0x42,0x00,0x0c,0x10,0x43,0x01,0x9e,0x24,0x04,0x00,0x01,0x24,0x02,0x00,0x01,
+0x10,0x82,0x01,0x7c,0x3c,0x02,0xb0,0x03,0x8f,0xa6,0x00,0x88,0x34,0x42,0x01,0x04,
+0x84,0xc5,0x00,0x0c,0x02,0x92,0x18,0x21,0x94,0x46,0x00,0x00,0x00,0x05,0x20,0xc0,
+0x00,0x85,0x20,0x21,0x00,0x03,0x18,0x80,0x27,0x82,0x90,0x00,0x27,0x85,0x8f,0xf8,
+0x00,0x65,0x28,0x21,0x00,0x62,0x18,0x21,0x80,0x71,0x00,0x05,0x80,0x73,0x00,0x04,
+0x8f,0xa3,0x00,0x88,0x30,0xd0,0xff,0xff,0x00,0x10,0x3a,0x03,0x32,0x08,0x00,0xff,
+0x27,0x82,0x90,0x10,0x00,0x04,0x20,0x80,0x80,0xa6,0x00,0x06,0x00,0x82,0x20,0x21,
+0xa4,0x67,0x00,0x44,0xa4,0x68,0x00,0x46,0x8c,0x84,0x00,0x00,0x38,0xc6,0x00,0x00,
+0x01,0x00,0x80,0x21,0x00,0x04,0x15,0x02,0x30,0x42,0x00,0x01,0x10,0x40,0x00,0x03,
+0x00,0xe6,0x80,0x0a,0x00,0x04,0x14,0x02,0x30,0x50,0x00,0x0f,0x12,0x20,0x01,0x50,
+0x02,0x40,0x20,0x21,0x02,0x71,0x10,0x21,0x00,0x50,0x10,0x2a,0x14,0x40,0x00,0xed,
+0x02,0x92,0x10,0x21,0x93,0x82,0x8b,0x61,0x00,0x00,0x00,0x00,0x30,0x42,0x00,0x01,
+0x14,0x40,0x00,0xe0,0x02,0x92,0x28,0x21,0x26,0xe2,0x00,0x01,0x30,0x57,0xff,0xff,
+0x02,0x40,0xf0,0x21,0x26,0xb5,0xff,0xff,0x16,0xa0,0xff,0xbd,0x02,0xc0,0x90,0x21,
+0x16,0xe0,0x00,0xd0,0x00,0x00,0x00,0x00,0x8f,0xa3,0x00,0x98,0x00,0x00,0x00,0x00,
+0x2c,0x62,0x00,0x10,0x10,0x40,0x00,0x2e,0x00,0x00,0x00,0x00,0x8f,0xa4,0x00,0x24,
+0x00,0x00,0x00,0x00,0x18,0x80,0x00,0x2a,0x24,0x03,0x00,0x01,0x8f,0xa5,0x00,0x1c,
+0x27,0x84,0x8f,0xf4,0x94,0xb2,0x00,0x14,0xa0,0xa3,0x00,0x12,0x8f,0xa6,0x00,0x3c,
+0x00,0x12,0x10,0xc0,0x00,0x52,0x10,0x21,0x00,0x02,0x80,0x80,0x27,0x82,0x90,0x00,
+0x02,0x02,0x10,0x21,0x80,0x43,0x00,0x06,0x02,0x04,0x20,0x21,0x8c,0x85,0x00,0x18,
+0x24,0x63,0x00,0x02,0x00,0x03,0x17,0xc2,0x00,0x62,0x18,0x21,0x00,0x03,0x18,0x43,
+0x00,0x03,0x18,0x40,0x14,0xc0,0x00,0x0e,0x00,0xa3,0x38,0x21,0x27,0x82,0x8f,0xf0,
+0x02,0x02,0x10,0x21,0x94,0x43,0x00,0x06,0x8f,0xa8,0x00,0x1c,0x24,0x02,0x00,0x01,
+0xa5,0x03,0x00,0x1a,0x7b,0xbe,0x04,0x3c,0x7b,0xb6,0x03,0xfc,0x7b,0xb4,0x03,0xbc,
+0x7b,0xb2,0x03,0x7c,0x7b,0xb0,0x03,0x3c,0x03,0xe0,0x00,0x08,0x27,0xbd,0x00,0x88,
+0x8f,0xa4,0x00,0x98,0x8f,0xa5,0x00,0x38,0x8f,0xa6,0x00,0x34,0xaf,0xa0,0x00,0x10,
+0x0c,0x00,0x09,0x06,0xaf,0xa0,0x00,0x14,0x08,0x00,0x1d,0x4b,0x00,0x00,0x00,0x00,
+0x8f,0xa3,0x00,0x44,0x93,0x82,0x81,0x59,0x00,0x00,0x00,0x00,0x10,0x40,0x00,0x61,
+0x30,0x69,0x00,0x03,0x8f,0xa4,0x00,0x24,0x8f,0xa5,0x00,0x28,0x00,0x00,0x00,0x00,
+0x00,0x85,0x10,0x2a,0x10,0x40,0x00,0x8f,0x00,0x00,0x00,0x00,0x8f,0xa6,0x00,0x1c,
+0x00,0x00,0x00,0x00,0x90,0xc4,0x00,0x04,0x00,0x00,0x00,0x00,0x30,0x83,0x00,0xff,
+0x00,0xa3,0x10,0x2a,0x10,0x40,0x00,0x87,0x00,0x00,0x00,0x00,0x8f,0xa8,0x00,0x24,
+0x00,0x00,0x00,0x00,0x11,0x00,0x00,0x83,0x00,0x65,0x10,0x23,0x00,0xa8,0x18,0x23,
+0x00,0x62,0x10,0x2a,0x14,0x40,0x00,0x7d,0x30,0x63,0x00,0xff,0x00,0x85,0x10,0x23,
+0x30,0x42,0x00,0xff,0xaf,0xa2,0x00,0x50,0x8f,0xa2,0x00,0x50,0x00,0x00,0x00,0x00,
+0x10,0x40,0x00,0x73,0x00,0x00,0xa8,0x21,0x27,0x8c,0x8f,0xf0,0x3c,0x0b,0x80,0xff,
+0x24,0x10,0x00,0x04,0x27,0x91,0x8f,0xf4,0x35,0x6b,0xff,0xff,0x3c,0x0d,0x7f,0x00,
+0x27,0x8e,0x90,0x00,0x01,0x80,0x78,0x21,0x00,0x12,0x30,0xc0,0x00,0xd2,0x10,0x21,
+0x00,0x02,0x10,0x80,0x00,0x4c,0x10,0x21,0x94,0x42,0x00,0x06,0x8f,0xa3,0x00,0x2c,
+0x8f,0xa4,0x00,0x30,0xaf,0xa2,0x00,0x44,0x8f,0xa5,0x00,0x44,0x30,0x49,0x00,0x03,
+0x02,0x09,0x10,0x23,0x30,0x42,0x00,0x03,0x00,0xa2,0x10,0x21,0x8f,0xa8,0x00,0x30,
+0x24,0x42,0x00,0x04,0x30,0x42,0xff,0xff,0x00,0x64,0x38,0x21,0x01,0x02,0x28,0x23,
+0x00,0x62,0x18,0x21,0x00,0x48,0x10,0x2b,0x10,0x40,0x00,0x52,0x00,0x00,0x20,0x21,
+0x30,0xe7,0xff,0xff,0x30,0xa4,0xff,0xff,0xaf,0xa7,0x00,0x2c,0x00,0xd2,0x10,0x21,
+0x00,0x02,0x10,0x80,0x00,0x51,0x18,0x21,0x8c,0x65,0x00,0x18,0x00,0x04,0x25,0x40,
+0x00,0x8d,0x20,0x24,0x8c,0xa8,0x00,0x04,0x00,0x4e,0x18,0x21,0x00,0x4f,0x50,0x21,
+0x01,0x0b,0x40,0x24,0x01,0x04,0x40,0x25,0xac,0xa8,0x00,0x04,0x8f,0xa4,0x00,0x98,
+0x8f,0xa2,0x00,0x50,0x26,0xb5,0x00,0x01,0xa0,0x64,0x00,0x00,0x8c,0xa4,0x00,0x08,
+0x00,0x00,0x00,0x00,0x04,0x81,0x00,0x0c,0x02,0xa2,0x30,0x2a,0x80,0x62,0x00,0x06,
+0x00,0x00,0x00,0x00,0x24,0x42,0x00,0x02,0x00,0x02,0x1f,0xc2,0x00,0x43,0x10,0x21,
+0x00,0x02,0x10,0x43,0x00,0x02,0x10,0x40,0x00,0xa2,0x38,0x21,0x8f,0xa5,0x00,0x40,
+0x00,0x00,0x00,0x00,0xa4,0xe5,0x00,0x00,0x95,0x52,0x00,0x02,0x14,0xc0,0xff,0xc7,
+0x00,0x12,0x30,0xc0,0x8f,0xa4,0x00,0x24,0x8f,0xa5,0x00,0x50,0x8f,0xa6,0x00,0x1c,
+0x8f,0xa3,0x00,0x2c,0x00,0x85,0x80,0x21,0xa0,0xd0,0x00,0x12,0x00,0x09,0x10,0x23,
+0x30,0x42,0x00,0x03,0x8f,0xa8,0x00,0x88,0x00,0x62,0x10,0x23,0xa4,0xc2,0x00,0x1a,
+0x85,0x03,0x00,0x0c,0x00,0x00,0x00,0x00,0x00,0x03,0x10,0xc0,0x00,0x43,0x10,0x21,
+0x00,0x02,0x10,0x80,0x27,0x83,0x8f,0xf4,0x00,0x43,0x10,0x21,0x8c,0x44,0x00,0x18,
+0x00,0x00,0x00,0x00,0x8c,0x83,0x00,0x04,0x00,0x00,0x00,0x00,0x30,0x63,0x00,0x10,
+0x14,0x60,0xff,0x74,0x02,0x00,0x10,0x21,0x8f,0xa3,0x00,0x54,0x8f,0xa4,0x00,0x18,
+0x8f,0xa5,0x00,0x24,0x00,0x64,0x10,0x21,0x00,0x02,0x10,0x80,0x27,0x83,0x90,0x08,
+0x00,0x43,0x10,0x21,0x90,0x44,0x00,0x00,0x10,0xa0,0x00,0x03,0x00,0x00,0x30,0x21,
+0x08,0x00,0x1d,0x51,0x02,0x00,0x10,0x21,0x93,0x82,0x80,0x10,0x00,0x00,0x28,0x21,
+0x00,0x00,0x38,0x21,0x0c,0x00,0x21,0xf5,0xaf,0xa2,0x00,0x10,0x08,0x00,0x1d,0x51,
+0x02,0x00,0x10,0x21,0x30,0x63,0xff,0xff,0x08,0x00,0x1d,0xa3,0xaf,0xa3,0x00,0x2c,
+0x8f,0xa8,0x00,0x44,0x08,0x00,0x1d,0xc5,0x31,0x09,0x00,0x03,0x08,0x00,0x1d,0x7e,
+0xaf,0xa3,0x00,0x50,0x8f,0xa6,0x00,0x44,0xaf,0xa0,0x00,0x50,0x08,0x00,0x1d,0xc5,
+0x30,0xc9,0x00,0x03,0x8f,0xa5,0x00,0x48,0x8f,0xa6,0x00,0x4c,0x8f,0xa4,0x00,0x1c,
+0x03,0xc0,0x38,0x21,0x0c,0x00,0x1b,0xf6,0xaf,0xb7,0x00,0x10,0x08,0x00,0x1d,0x2e,
+0x00,0x00,0x00,0x00,0x00,0x05,0x28,0x80,0x27,0x82,0x8f,0xf0,0x00,0xa2,0x28,0x21,
+0x00,0x00,0x20,0x21,0x0c,0x00,0x01,0x4b,0x00,0x00,0x00,0x00,0x08,0x00,0x1d,0x27,
+0x26,0xe2,0x00,0x01,0x00,0x02,0x80,0x80,0x27,0x83,0x90,0x00,0x8f,0xa4,0x00,0x1c,
+0x02,0x03,0x18,0x21,0x26,0x31,0x00,0x01,0x02,0x40,0x28,0x21,0x0c,0x00,0x1f,0x08,
+0xa0,0x71,0x00,0x05,0x14,0x40,0xff,0x13,0x00,0x00,0x00,0x00,0x16,0xe0,0x00,0x4d,
+0x03,0xc0,0x38,0x21,0x8f,0xa4,0x00,0x24,0x8f,0xa5,0x00,0x20,0x24,0x02,0x00,0x01,
+0x24,0x84,0x00,0x01,0xaf,0xb2,0x00,0x48,0xaf,0xb6,0x00,0x4c,0x02,0xc0,0xf0,0x21,
+0x10,0xa2,0x00,0x41,0xaf,0xa4,0x00,0x24,0x27,0x82,0x8f,0xf0,0x02,0x02,0x10,0x21,
+0x94,0x42,0x00,0x06,0x8f,0xa4,0x00,0x30,0xaf,0xa0,0x00,0x20,0xaf,0xa2,0x00,0x44,
+0x30,0x49,0x00,0x03,0x8f,0xa8,0x00,0x44,0x00,0x09,0x10,0x23,0x30,0x42,0x00,0x03,
+0x01,0x02,0x10,0x21,0x24,0x42,0x00,0x04,0x30,0x42,0xff,0xff,0x00,0x44,0x18,0x2b,
+0x10,0x60,0x00,0x2b,0x00,0x00,0x00,0x00,0x8f,0xa5,0x00,0x2c,0x00,0x82,0x10,0x23,
+0x00,0xa4,0x18,0x21,0x30,0x63,0xff,0xff,0x30,0x44,0xff,0xff,0xaf,0xa3,0x00,0x2c,
+0x02,0x92,0x28,0x21,0x00,0x05,0x28,0x80,0x27,0x82,0x8f,0xf4,0x00,0xa2,0x10,0x21,
+0x8c,0x46,0x00,0x18,0x3c,0x03,0x80,0xff,0x3c,0x02,0x7f,0x00,0x8c,0xc8,0x00,0x04,
+0x00,0x04,0x25,0x40,0x34,0x63,0xff,0xff,0x00,0x82,0x20,0x24,0x01,0x03,0x40,0x24,
+0x01,0x04,0x40,0x25,0xac,0xc8,0x00,0x04,0x8f,0xa8,0x00,0x98,0x27,0x82,0x90,0x00,
+0x00,0xa2,0x10,0x21,0xa0,0x48,0x00,0x00,0x8c,0xc4,0x00,0x08,0x00,0x00,0x00,0x00,
+0x00,0x04,0x27,0xc2,0x10,0x80,0xfe,0xdb,0xaf,0xa4,0x00,0x3c,0x80,0x42,0x00,0x06,
+0x00,0x00,0x00,0x00,0x24,0x42,0x00,0x02,0x00,0x02,0x1f,0xc2,0x00,0x43,0x10,0x21,
+0x00,0x02,0x10,0x43,0x00,0x02,0x10,0x40,0x00,0xc2,0x38,0x21,0x8f,0xa2,0x00,0x40,
+0x00,0x00,0x00,0x00,0xa4,0xe2,0x00,0x00,0x08,0x00,0x1d,0x2a,0x26,0xb5,0xff,0xff,
+0x8f,0xa6,0x00,0x2c,0x00,0x00,0x20,0x21,0x00,0xc2,0x10,0x21,0x30,0x42,0xff,0xff,
+0x08,0x00,0x1e,0x38,0xaf,0xa2,0x00,0x2c,0x8f,0xa6,0x00,0x1c,0x08,0x00,0x1e,0x22,
+0xa4,0xd2,0x00,0x14,0x8f,0xa5,0x00,0x48,0x8f,0xa6,0x00,0x4c,0x8f,0xa4,0x00,0x1c,
+0x0c,0x00,0x1b,0xf6,0xaf,0xb7,0x00,0x10,0x08,0x00,0x1e,0x19,0x00,0x00,0xb8,0x21,
+0x0c,0x00,0x12,0x87,0x00,0x00,0x28,0x21,0x00,0x40,0x18,0x21,0x94,0x42,0x00,0x00,
+0x00,0x00,0x00,0x00,0x34,0x42,0x08,0x00,0xa4,0x62,0x00,0x00,0x08,0x00,0x1d,0x1e,
+0x02,0x71,0x10,0x21,0x02,0x92,0x18,0x21,0x00,0x03,0x80,0x80,0x27,0x82,0x8f,0xf4,
+0x02,0x02,0x10,0x21,0x8c,0x44,0x00,0x18,0x00,0x00,0x00,0x00,0x8c,0x83,0x00,0x04,
+0x00,0x00,0x00,0x00,0x30,0x63,0x00,0x10,0x10,0x60,0x00,0x09,0x24,0x06,0x00,0x01,
+0x93,0x82,0x8b,0x61,0x00,0x00,0x00,0x00,0x30,0x42,0x00,0x01,0x10,0x40,0xfe,0xa2,
+0x3c,0x04,0x00,0x80,0x27,0x85,0x8f,0xf0,0x08,0x00,0x1e,0x09,0x02,0x05,0x28,0x21,
+0x27,0x83,0x90,0x08,0x27,0x82,0x90,0x00,0x02,0x03,0x18,0x21,0x02,0x02,0x10,0x21,
+0x90,0x64,0x00,0x00,0x90,0x45,0x00,0x05,0x93,0x83,0x80,0x10,0x00,0x00,0x38,0x21,
+0x0c,0x00,0x21,0xf5,0xaf,0xa3,0x00,0x10,0x08,0x00,0x1e,0x80,0x00,0x00,0x00,0x00,
+0x27,0x82,0x90,0x08,0x02,0x02,0x10,0x21,0x94,0x43,0x00,0x02,0x8f,0xa6,0x00,0x58,
+0x00,0x03,0x19,0x02,0x00,0x66,0x18,0x23,0x30,0x63,0x0f,0xff,0x28,0x62,0x00,0x20,
+0x10,0x40,0x00,0x06,0x28,0x62,0x00,0x40,0x8f,0xa8,0x00,0x90,0x00,0x00,0x00,0x00,
+0x00,0x68,0x10,0x06,0x08,0x00,0x1c,0xf7,0x30,0x44,0x00,0x01,0x10,0x40,0x00,0x04,
+0x00,0x00,0x00,0x00,0x8f,0xa4,0x00,0x94,0x08,0x00,0x1e,0xa1,0x00,0x64,0x10,0x06,
+0x08,0x00,0x1c,0xf7,0x00,0x00,0x20,0x21,0x8f,0xa4,0x00,0x98,0x8f,0xa5,0x00,0x38,
+0xaf,0xa0,0x00,0x10,0x0c,0x00,0x09,0x06,0xaf,0xa8,0x00,0x14,0x30,0x42,0xff,0xff,
+0x08,0x00,0x1c,0xc7,0xaf,0xa2,0x00,0x40,0x3c,0x02,0xb0,0x03,0x3c,0x03,0x80,0x00,
+0x27,0xbd,0xff,0xe0,0x34,0x42,0x00,0x20,0x24,0x63,0x7a,0xc8,0xaf,0xb1,0x00,0x14,
+0xaf,0xb0,0x00,0x10,0xaf,0xbf,0x00,0x18,0xac,0x43,0x00,0x00,0x90,0x82,0x00,0x0a,
+0x00,0x80,0x80,0x21,0x14,0x40,0x00,0x45,0x00,0x00,0x88,0x21,0x92,0x02,0x00,0x04,
+0x00,0x00,0x00,0x00,0x14,0x40,0x00,0x3c,0x00,0x00,0x00,0x00,0x12,0x20,0x00,0x18,
+0x00,0x00,0x00,0x00,0x92,0x02,0x00,0x16,0x92,0x05,0x00,0x0a,0x30,0x42,0x00,0xfc,
+0x10,0xa0,0x00,0x03,0xa2,0x02,0x00,0x16,0x34,0x42,0x00,0x01,0xa2,0x02,0x00,0x16,
+0x92,0x04,0x00,0x04,0x00,0x00,0x00,0x00,0x30,0x83,0x00,0xff,0x10,0x60,0x00,0x05,
+0x00,0x00,0x00,0x00,0x92,0x02,0x00,0x16,0x00,0x00,0x00,0x00,0x34,0x42,0x00,0x02,
+0xa2,0x02,0x00,0x16,0x10,0x60,0x00,0x0a,0x00,0x00,0x00,0x00,0x14,0xa0,0x00,0x08,
+0x00,0x00,0x00,0x00,0x96,0x02,0x00,0x00,0xa2,0x00,0x00,0x17,0xa6,0x02,0x00,0x14,
+0x8f,0xbf,0x00,0x18,0x7b,0xb0,0x00,0xbc,0x03,0xe0,0x00,0x08,0x27,0xbd,0x00,0x20,
+0x14,0x80,0x00,0x05,0x24,0x02,0x00,0x01,0x96,0x03,0x00,0x06,0xa2,0x02,0x00,0x17,
+0x08,0x00,0x1e,0xdc,0xa6,0x03,0x00,0x14,0x96,0x04,0x00,0x00,0x96,0x05,0x00,0x06,
+0x27,0x86,0x8f,0xf0,0x00,0x04,0x10,0xc0,0x00,0x05,0x18,0xc0,0x00,0x44,0x10,0x21,
+0x00,0x65,0x18,0x21,0x00,0x02,0x10,0x80,0x00,0x03,0x18,0x80,0x00,0x66,0x18,0x21,
+0x00,0x46,0x10,0x21,0x8c,0x65,0x00,0x08,0x8c,0x44,0x00,0x08,0x0c,0x00,0x12,0x78,
+0x00,0x00,0x00,0x00,0x30,0x43,0x00,0xff,0x10,0x60,0x00,0x04,0xa2,0x02,0x00,0x17,
+0x96,0x02,0x00,0x06,0x08,0x00,0x1e,0xdc,0xa6,0x02,0x00,0x14,0x96,0x02,0x00,0x00,
+0x08,0x00,0x1e,0xdc,0xa6,0x02,0x00,0x14,0x96,0x05,0x00,0x00,0x0c,0x00,0x1f,0x08,
+0x02,0x00,0x20,0x21,0x08,0x00,0x1e,0xc3,0x02,0x22,0x88,0x21,0x94,0x85,0x00,0x06,
+0x0c,0x00,0x1f,0x08,0x00,0x00,0x00,0x00,0x08,0x00,0x1e,0xbf,0x00,0x40,0x88,0x21,
+0x3c,0x03,0xb0,0x03,0x3c,0x02,0x80,0x00,0x34,0x63,0x00,0x20,0x24,0x42,0x7c,0x20,
+0x27,0xbd,0xff,0xf0,0xac,0x62,0x00,0x00,0x00,0x00,0x10,0x21,0x03,0xe0,0x00,0x08,
+0x27,0xbd,0x00,0x10,0x3c,0x03,0xb0,0x03,0x3c,0x02,0x80,0x00,0x34,0x63,0x00,0x20,
+0x24,0x42,0x7c,0x44,0xac,0x62,0x00,0x00,0x90,0x89,0x00,0x0a,0x00,0x80,0x30,0x21,
+0x11,0x20,0x00,0x05,0x00,0xa0,0x50,0x21,0x90,0x82,0x00,0x17,0x00,0x00,0x00,0x00,
+0x14,0x40,0x00,0x1b,0x00,0x00,0x00,0x00,0x90,0xc7,0x00,0x04,0x00,0x00,0x00,0x00,
+0x10,0xe0,0x00,0x1b,0x00,0x00,0x00,0x00,0x94,0xc8,0x00,0x00,0x27,0x83,0x8f,0xf0,
+0x93,0x85,0x8b,0x60,0x00,0x08,0x10,0xc0,0x00,0x48,0x10,0x21,0x00,0x02,0x10,0x80,
+0x00,0x43,0x10,0x21,0x8c,0x44,0x00,0x08,0x00,0xe5,0x28,0x2b,0x10,0xa0,0x00,0x06,
+0x01,0x44,0x18,0x23,0x8f,0x82,0x8b,0x78,0x00,0x00,0x00,0x00,0x00,0x43,0x10,0x2b,
+0x10,0x40,0x00,0x05,0x00,0x00,0x00,0x00,0x24,0x03,0x00,0x10,0xa4,0xc8,0x00,0x14,
+0x03,0xe0,0x00,0x08,0x00,0x60,0x10,0x21,0x11,0x20,0x00,0x05,0x00,0x00,0x00,0x00,
+0x94,0xc2,0x00,0x06,0x24,0x03,0x00,0x08,0x08,0x00,0x1f,0x34,0xa4,0xc2,0x00,0x14,
+0x08,0x00,0x1f,0x34,0x00,0x00,0x18,0x21,0x27,0xbd,0xff,0xc8,0xaf,0xb5,0x00,0x2c,
+0xaf,0xb4,0x00,0x28,0xaf,0xb3,0x00,0x24,0xaf,0xb0,0x00,0x18,0xaf,0xbf,0x00,0x30,
+0xaf,0xb2,0x00,0x20,0xaf,0xb1,0x00,0x1c,0x94,0x91,0x00,0x06,0x00,0x80,0xa0,0x21,
+0x3c,0x02,0x80,0x00,0x3c,0x04,0xb0,0x03,0x00,0x11,0xa8,0xc0,0x34,0x84,0x00,0x20,
+0x24,0x42,0x7c,0xf8,0x02,0xb1,0x48,0x21,0xac,0x82,0x00,0x00,0x00,0x09,0x48,0x80,
+0x24,0x03,0x00,0x01,0x27,0x82,0x90,0x00,0xa2,0x83,0x00,0x12,0x01,0x22,0x10,0x21,
+0x27,0x84,0x8f,0xf4,0x01,0x24,0x20,0x21,0x80,0x48,0x00,0x06,0x8c,0x8a,0x00,0x18,
+0x27,0x83,0x90,0x10,0x01,0x23,0x48,0x21,0x8d,0x24,0x00,0x00,0x25,0x08,0x00,0x02,
+0x8d,0x42,0x00,0x00,0x8d,0x49,0x00,0x04,0x00,0x08,0x17,0xc2,0x8d,0x43,0x00,0x08,
+0x01,0x02,0x40,0x21,0x00,0x04,0x25,0xc2,0x00,0x08,0x40,0x43,0x30,0x84,0x00,0x01,
+0x00,0x03,0x1f,0xc2,0x00,0x08,0x40,0x40,0x00,0xe0,0x80,0x21,0x00,0x64,0x18,0x24,
+0x00,0x09,0x49,0x42,0x01,0x48,0x10,0x21,0x00,0xa0,0x98,0x21,0x00,0xa0,0x20,0x21,
+0x00,0x40,0x38,0x21,0x02,0x00,0x28,0x21,0x14,0x60,0x00,0x19,0x31,0x29,0x00,0x01,
+0x94,0x42,0x00,0x00,0x02,0xb1,0x88,0x21,0x02,0x00,0x28,0x21,0x00,0x11,0x88,0x80,
+0x27,0x90,0x8f,0xf0,0x02,0x30,0x80,0x21,0x96,0x03,0x00,0x06,0x30,0x52,0xff,0xff,
+0x02,0x60,0x20,0x21,0x00,0x60,0x30,0x21,0xa6,0x83,0x00,0x1a,0x27,0x82,0x8f,0xf8,
+0x0c,0x00,0x08,0xdf,0x02,0x22,0x88,0x21,0x00,0x52,0x10,0x21,0x96,0x03,0x00,0x06,
+0xa6,0x22,0x00,0x04,0x8f,0xbf,0x00,0x30,0x7b,0xb4,0x01,0x7c,0x7b,0xb2,0x01,0x3c,
+0x7b,0xb0,0x00,0xfc,0x00,0x60,0x10,0x21,0x03,0xe0,0x00,0x08,0x27,0xbd,0x00,0x38,
+0xaf,0xa9,0x00,0x10,0x0c,0x00,0x09,0x06,0xaf,0xa0,0x00,0x14,0x08,0x00,0x1f,0x72,
+0x02,0xb1,0x88,0x21,0x27,0xbd,0xff,0xc0,0xaf,0xbe,0x00,0x38,0xaf,0xb7,0x00,0x34,
+0xaf,0xb6,0x00,0x30,0xaf,0xb5,0x00,0x2c,0xaf,0xb3,0x00,0x24,0xaf,0xb1,0x00,0x1c,
+0xaf,0xbf,0x00,0x3c,0xaf,0xb4,0x00,0x28,0xaf,0xb2,0x00,0x20,0xaf,0xb0,0x00,0x18,
+0x94,0x90,0x00,0x00,0x3c,0x08,0xb0,0x03,0x35,0x08,0x00,0x20,0x00,0x10,0x10,0xc0,
+0x00,0x50,0x18,0x21,0x00,0x40,0x88,0x21,0x3c,0x02,0x80,0x00,0x00,0x03,0x48,0x80,
+0x24,0x42,0x7e,0x34,0x00,0x80,0x98,0x21,0x27,0x84,0x90,0x00,0x01,0x24,0x20,0x21,
+0x93,0xb7,0x00,0x53,0xad,0x02,0x00,0x00,0x80,0x83,0x00,0x06,0x27,0x82,0x8f,0xf4,
+0x01,0x22,0x10,0x21,0x8c,0x44,0x00,0x18,0x24,0x63,0x00,0x02,0x00,0x03,0x17,0xc2,
+0x8c,0x88,0x00,0x08,0x00,0x62,0x18,0x21,0x00,0x03,0x18,0x43,0x00,0x03,0x18,0x40,
+0xaf,0xa7,0x00,0x4c,0x2c,0xa2,0x00,0x10,0x00,0xa0,0xa8,0x21,0x00,0x83,0x50,0x21,
+0x00,0x08,0x47,0xc2,0x00,0xc0,0x58,0x21,0x00,0x00,0xb0,0x21,0x8c,0x92,0x00,0x0c,
+0x14,0x40,0x00,0x13,0x00,0x00,0xf0,0x21,0x92,0x67,0x00,0x04,0x24,0x14,0x00,0x01,
+0x12,0x87,0x00,0x10,0x02,0x30,0x10,0x21,0x27,0x83,0x90,0x08,0x01,0x23,0x18,0x21,
+0x80,0x64,0x00,0x00,0x27,0x83,0xb5,0x60,0x00,0x04,0x11,0x00,0x00,0x44,0x10,0x23,
+0x00,0x02,0x10,0x80,0x00,0x44,0x10,0x23,0x00,0x02,0x10,0x80,0x00,0x43,0x10,0x21,
+0x90,0x44,0x00,0x04,0x00,0x00,0x00,0x00,0x10,0x80,0x00,0x23,0x00,0x00,0x00,0x00,
+0x02,0x30,0x10,0x21,0x00,0x02,0x80,0x80,0x24,0x04,0x00,0x01,0x27,0x83,0x90,0x10,
+0xa2,0x64,0x00,0x12,0x02,0x03,0x18,0x21,0x8c,0x62,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x02,0x15,0xc2,0x30,0x42,0x00,0x01,0x01,0x02,0x10,0x24,0x14,0x40,0x00,0x0e,
+0x02,0xa0,0x20,0x21,0x27,0x82,0x8f,0xf0,0x02,0x02,0x10,0x21,0x94,0x43,0x00,0x06,
+0x00,0x00,0x00,0x00,0xa6,0x63,0x00,0x1a,0x94,0x42,0x00,0x06,0x7b,0xbe,0x01,0xfc,
+0x7b,0xb6,0x01,0xbc,0x7b,0xb4,0x01,0x7c,0x7b,0xb2,0x01,0x3c,0x7b,0xb0,0x00,0xfc,
+0x03,0xe0,0x00,0x08,0x27,0xbd,0x00,0x40,0x8f,0xa5,0x00,0x4c,0x01,0x60,0x30,0x21,
+0x01,0x40,0x38,0x21,0xaf,0xa0,0x00,0x10,0x0c,0x00,0x09,0x06,0xaf,0xa0,0x00,0x14,
+0x08,0x00,0x1f,0xd9,0x00,0x00,0x00,0x00,0x27,0x83,0x90,0x10,0x01,0x23,0x18,0x21,
+0x8c,0x62,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x02,0x15,0xc2,0x30,0x42,0x00,0x01,
+0x01,0x02,0x10,0x24,0x14,0x40,0x00,0xaf,0x00,0xa0,0x20,0x21,0x32,0x4f,0x00,0x03,
+0x00,0x12,0x10,0x82,0x25,0xe3,0x00,0x0d,0x30,0x45,0x00,0x07,0x00,0x74,0x78,0x04,
+0x10,0xa0,0x00,0x0e,0x00,0x00,0x90,0x21,0x27,0x82,0x80,0x1c,0x00,0x15,0x18,0x40,
+0x00,0x62,0x18,0x21,0x94,0x64,0x00,0x00,0x24,0xa2,0x00,0x06,0x00,0x54,0x10,0x04,
+0x00,0x44,0x00,0x1a,0x14,0x80,0x00,0x02,0x00,0x00,0x00,0x00,0x00,0x07,0x00,0x0d,
+0x00,0x00,0x10,0x12,0x24,0x42,0x00,0x20,0x30,0x52,0xff,0xfc,0x02,0x30,0x10,0x21,
+0x27,0x83,0x90,0x00,0x00,0x02,0x10,0x80,0x00,0x43,0x10,0x21,0x90,0x44,0x00,0x03,
+0x00,0x00,0x00,0x00,0x30,0x83,0x00,0xff,0x2c,0x62,0x00,0x0c,0x14,0x40,0x00,0x04,
+0x2c,0x62,0x00,0x19,0x30,0x82,0x00,0x0f,0x24,0x43,0x00,0x0c,0x2c,0x62,0x00,0x19,
+0x10,0x40,0x00,0x19,0x24,0x0e,0x00,0x20,0x24,0x62,0xff,0xe9,0x2c,0x42,0x00,0x02,
+0x14,0x40,0x00,0x15,0x24,0x0e,0x00,0x10,0x24,0x62,0xff,0xeb,0x2c,0x42,0x00,0x02,
+0x14,0x40,0x00,0x11,0x24,0x0e,0x00,0x08,0x24,0x02,0x00,0x14,0x10,0x62,0x00,0x0e,
+0x24,0x0e,0x00,0x02,0x24,0x62,0xff,0xef,0x2c,0x42,0x00,0x03,0x14,0x40,0x00,0x0a,
+0x24,0x0e,0x00,0x10,0x24,0x62,0xff,0xf1,0x2c,0x42,0x00,0x02,0x14,0x40,0x00,0x06,
+0x24,0x0e,0x00,0x08,0x24,0x62,0xff,0xf3,0x2c,0x42,0x00,0x02,0x24,0x0e,0x00,0x04,
+0x24,0x03,0x00,0x02,0x00,0x62,0x70,0x0a,0x30,0xe2,0x00,0xff,0x00,0x00,0x48,0x21,
+0x00,0x00,0x68,0x21,0x10,0x40,0x00,0x6d,0x00,0x00,0x58,0x21,0x3c,0x14,0x80,0xff,
+0x27,0x99,0x8f,0xf0,0x01,0xf2,0xc0,0x23,0x36,0x94,0xff,0xff,0x01,0xc9,0x10,0x2a,
+0x14,0x40,0x00,0x64,0x24,0x03,0x00,0x04,0x00,0x10,0x28,0xc0,0x00,0xb0,0x10,0x21,
+0x00,0x02,0x10,0x80,0x00,0x59,0x10,0x21,0x94,0x56,0x00,0x06,0x00,0x00,0x00,0x00,
+0x32,0xcc,0x00,0x03,0x00,0x6c,0x10,0x23,0x30,0x42,0x00,0x03,0x02,0xc2,0x10,0x21,
+0x24,0x42,0x00,0x04,0x30,0x51,0xff,0xff,0x02,0x32,0x18,0x2b,0x10,0x60,0x00,0x4d,
+0x01,0xf1,0x10,0x23,0x02,0x51,0x10,0x23,0x01,0x78,0x18,0x2b,0x10,0x60,0x00,0x34,
+0x30,0x44,0xff,0xff,0x29,0x22,0x00,0x40,0x10,0x40,0x00,0x31,0x01,0x72,0x18,0x21,
+0x25,0x22,0x00,0x01,0x00,0x02,0x16,0x00,0x00,0x02,0x4e,0x03,0x00,0xb0,0x10,0x21,
+0x00,0x02,0x30,0x80,0x27,0x82,0x8f,0xf4,0x30,0x6b,0xff,0xff,0x00,0xc2,0x18,0x21,
+0x8c,0x67,0x00,0x18,0x00,0x04,0x25,0x40,0x3c,0x03,0x7f,0x00,0x8c,0xe2,0x00,0x04,
+0x00,0x83,0x20,0x24,0x27,0x83,0x90,0x00,0x00,0x54,0x10,0x24,0x00,0xc3,0x28,0x21,
+0x00,0x44,0x10,0x25,0xac,0xe2,0x00,0x04,0x16,0xe0,0x00,0x02,0xa0,0xb5,0x00,0x00,
+0xa0,0xb5,0x00,0x03,0x27,0x84,0x90,0x10,0x00,0xc4,0x18,0x21,0x8c,0x62,0x00,0x00,
+0x8c,0xe8,0x00,0x08,0x00,0x02,0x15,0xc2,0x00,0x08,0x47,0xc2,0x30,0x42,0x00,0x01,
+0x01,0x02,0x10,0x24,0x10,0x40,0x00,0x0a,0x00,0x00,0x00,0x00,0x80,0xa2,0x00,0x06,
+0x00,0x00,0x00,0x00,0x24,0x42,0x00,0x02,0x00,0x02,0x1f,0xc2,0x00,0x43,0x10,0x21,
+0x00,0x02,0x10,0x43,0x00,0x02,0x10,0x40,0x00,0xe2,0x50,0x21,0xa5,0x5e,0x00,0x00,
+0x92,0x62,0x00,0x04,0x25,0xad,0x00,0x01,0x27,0x84,0x8f,0xf0,0x00,0xc4,0x18,0x21,
+0x01,0xa2,0x10,0x2a,0x94,0x70,0x00,0x02,0x14,0x40,0xff,0xb8,0x00,0x00,0x00,0x00,
+0x96,0x63,0x00,0x14,0x00,0x0c,0x10,0x23,0xa2,0x69,0x00,0x12,0x30,0x42,0x00,0x03,
+0x01,0x62,0x10,0x23,0x00,0x03,0x80,0xc0,0x8f,0xa5,0x00,0x4c,0x30,0x4b,0xff,0xff,
+0x02,0x03,0x80,0x21,0x27,0x82,0x8f,0xf8,0x00,0x10,0x80,0x80,0xa6,0x6b,0x00,0x1a,
+0x02,0xa0,0x20,0x21,0x01,0x60,0x30,0x21,0x01,0x60,0x88,0x21,0x0c,0x00,0x08,0xdf,
+0x02,0x02,0x80,0x21,0x00,0x5e,0x10,0x21,0xa6,0x02,0x00,0x04,0x08,0x00,0x1f,0xdf,
+0x02,0x20,0x10,0x21,0x01,0x62,0x10,0x2b,0x10,0x40,0xff,0xe9,0x00,0x00,0x20,0x21,
+0x29,0x22,0x00,0x40,0x10,0x40,0xff,0xe6,0x01,0x71,0x18,0x21,0x08,0x00,0x20,0x55,
+0x25,0x22,0x00,0x01,0x08,0x00,0x20,0x84,0x32,0xcc,0x00,0x03,0x08,0x00,0x20,0x84,
+0x00,0x00,0x60,0x21,0x8f,0xa5,0x00,0x4c,0x01,0x40,0x38,0x21,0xaf,0xa0,0x00,0x10,
+0x0c,0x00,0x09,0x06,0xaf,0xb4,0x00,0x14,0x92,0x67,0x00,0x04,0x08,0x00,0x1f,0xf7,
+0x30,0x5e,0xff,0xff,0x30,0x84,0xff,0xff,0x00,0x04,0x30,0xc0,0x00,0xc4,0x20,0x21,
+0x00,0x04,0x20,0x80,0x27,0x82,0x8f,0xf0,0x3c,0x03,0xb0,0x08,0x30,0xa5,0xff,0xff,
+0x00,0x82,0x20,0x21,0x00,0xc3,0x30,0x21,0xac,0xc5,0x00,0x00,0x03,0xe0,0x00,0x08,
+0xa4,0x85,0x00,0x00,0x30,0x84,0xff,0xff,0x00,0x04,0x30,0xc0,0x00,0xc4,0x30,0x21,
+0x27,0x88,0x8f,0xf0,0x00,0x06,0x30,0x80,0x00,0xc8,0x30,0x21,0x94,0xc3,0x00,0x04,
+0x3c,0x02,0xb0,0x08,0x3c,0x07,0xb0,0x03,0x00,0x03,0x20,0xc0,0x00,0x83,0x18,0x21,
+0x00,0x03,0x18,0x80,0x00,0x82,0x20,0x21,0x3c,0x02,0x80,0x01,0x30,0xa5,0xff,0xff,
+0x00,0x68,0x18,0x21,0x34,0xe7,0x00,0x20,0x24,0x42,0x82,0xe4,0xac,0xe2,0x00,0x00,
+0xa4,0xc5,0x00,0x02,0xa4,0x65,0x00,0x00,0x03,0xe0,0x00,0x08,0xac,0x85,0x00,0x00,
+0x3c,0x02,0xb0,0x03,0x3c,0x03,0x80,0x01,0x34,0x42,0x00,0x20,0x24,0x63,0x83,0x40,
+0xac,0x43,0x00,0x00,0x90,0x82,0x00,0x10,0x3c,0x08,0xb0,0x03,0x3c,0x09,0xb0,0x06,
+0x27,0x87,0x8f,0xf0,0x3c,0x0d,0xb0,0x08,0x34,0x0e,0xff,0xff,0x35,0x08,0x00,0x62,
+0x00,0x80,0x30,0x21,0x24,0x0c,0xff,0xff,0x10,0x40,0x00,0x2c,0x35,0x29,0x80,0x20,
+0x97,0x82,0x8f,0xe0,0x94,0x85,0x00,0x0c,0x3c,0x0b,0xb0,0x03,0x00,0x02,0x18,0xc0,
+0x00,0x62,0x10,0x21,0x00,0x02,0x10,0x80,0x00,0x47,0x10,0x21,0xa4,0x45,0x00,0x00,
+0x94,0x84,0x00,0x0e,0x00,0x6d,0x18,0x21,0xac,0x65,0x00,0x00,0x00,0x04,0x10,0xc0,
+0x00,0x44,0x10,0x21,0x00,0x02,0x10,0x80,0x00,0x47,0x10,0x21,0x94,0x45,0x00,0x04,
+0x3c,0x0a,0x77,0x77,0x35,0x6b,0x00,0xb4,0x00,0x05,0x10,0xc0,0x00,0x45,0x18,0x21,
+0x00,0x03,0x18,0x80,0x00,0x67,0x18,0x21,0x00,0x4d,0x10,0x21,0xac,0x4e,0x00,0x00,
+0xa4,0x6e,0x00,0x00,0x95,0x04,0x00,0x00,0x90,0xc3,0x00,0x10,0x24,0x02,0x00,0xff,
+0x00,0x44,0x10,0x23,0x00,0x43,0x10,0x2a,0xa7,0x85,0x8f,0xe0,0x10,0x40,0x00,0x04,
+0x35,0x4a,0x88,0x88,0xad,0x6a,0x00,0x00,0x90,0xc3,0x00,0x10,0x00,0x00,0x00,0x00,
+0x30,0x63,0x00,0xff,0x3c,0x02,0x00,0x40,0x00,0x62,0x18,0x25,0xad,0x23,0x00,0x00,
+0xa4,0xcc,0x00,0x0e,0xa4,0xcc,0x00,0x0c,0xa0,0xc0,0x00,0x10,0x03,0xe0,0x00,0x08,
+0x00,0x00,0x00,0x00,0x30,0x84,0xff,0xff,0x00,0x04,0x10,0xc0,0x00,0x44,0x10,0x21,
+0x27,0x89,0x8f,0xf0,0x00,0x02,0x10,0x80,0x00,0x49,0x10,0x21,0x97,0x83,0x8f,0xe0,
+0x94,0x4a,0x00,0x04,0x3c,0x02,0xb0,0x08,0x00,0x03,0x38,0xc0,0x00,0x0a,0x40,0xc0,
+0x00,0xe3,0x18,0x21,0x01,0x0a,0x28,0x21,0x00,0xe2,0x38,0x21,0x01,0x02,0x40,0x21,
+0x00,0x03,0x18,0x80,0x00,0x05,0x28,0x80,0x3c,0x06,0xb0,0x03,0x3c,0x02,0x80,0x01,
+0x00,0xa9,0x28,0x21,0x00,0x69,0x18,0x21,0x34,0xc6,0x00,0x20,0x34,0x09,0xff,0xff,
+0x24,0x42,0x84,0x34,0xac,0xc2,0x00,0x00,0xa4,0x64,0x00,0x00,0xac,0xe4,0x00,0x00,
+0xa4,0xa9,0x00,0x00,0xad,0x09,0x00,0x00,0xa7,0x8a,0x8f,0xe0,0x03,0xe0,0x00,0x08,
+0x00,0x00,0x00,0x00,0x3c,0x03,0xb0,0x03,0x3c,0x02,0x80,0x01,0x34,0x63,0x00,0x20,
+0x24,0x42,0x84,0xb4,0x3c,0x04,0xb0,0x03,0xac,0x62,0x00,0x00,0x34,0x84,0x01,0x10,
+0x8c,0x82,0x00,0x00,0x97,0x83,0x81,0x60,0x30,0x42,0xff,0xff,0x10,0x62,0x00,0x16,
+0x24,0x0a,0x00,0x01,0xa7,0x82,0x81,0x60,0xaf,0x80,0xb4,0x40,0x00,0x40,0x28,0x21,
+0x24,0x06,0x00,0x01,0x27,0x84,0xb4,0x44,0x25,0x43,0xff,0xff,0x00,0x66,0x10,0x04,
+0x00,0xa2,0x10,0x24,0x14,0x40,0x00,0x07,0x00,0x00,0x00,0x00,0x8c,0x83,0xff,0xfc,
+0x00,0x00,0x00,0x00,0x00,0x66,0x10,0x04,0x00,0xa2,0x10,0x24,0x38,0x42,0x00,0x00,
+0x01,0x42,0x18,0x0a,0x25,0x4a,0x00,0x01,0x2d,0x42,0x00,0x14,0xac,0x83,0x00,0x00,
+0x14,0x40,0xff,0xf1,0x24,0x84,0x00,0x04,0x3c,0x0b,0xb0,0x03,0x00,0x00,0x50,0x21,
+0x3c,0x0c,0x80,0x00,0x27,0x89,0xb4,0x90,0x35,0x6b,0x01,0x20,0x8d,0x68,0x00,0x00,
+0x8d,0x23,0x00,0x04,0x01,0x0c,0x10,0x24,0x00,0x02,0x17,0xc2,0x11,0x03,0x00,0x37,
+0xa1,0x22,0x00,0xdc,0xa1,0x20,0x00,0xd5,0xa1,0x20,0x00,0xd6,0x01,0x20,0x30,0x21,
+0x00,0x00,0x38,0x21,0x00,0x00,0x28,0x21,0x01,0x20,0x20,0x21,0x00,0xa8,0x10,0x06,
+0x30,0x42,0x00,0x01,0x10,0xe0,0x00,0x10,0xa0,0x82,0x00,0x0a,0x90,0x82,0x00,0x07,
+0x00,0x00,0x00,0x00,0x10,0x40,0x00,0x31,0x24,0xa2,0xff,0xff,0xa0,0x82,0x00,0x08,
+0x90,0x82,0x00,0x0a,0x00,0x00,0x00,0x00,0x10,0x40,0x00,0x09,0x00,0x00,0x00,0x00,
+0x90,0x83,0x00,0x08,0x00,0x00,0x00,0x00,0x00,0x03,0x10,0x40,0x00,0x43,0x10,0x21,
+0x00,0x46,0x10,0x21,0xa0,0x45,0x00,0x09,0x90,0x82,0x00,0x0a,0x00,0x00,0x00,0x00,
+0x10,0x40,0x00,0x07,0x00,0x00,0x00,0x00,0x14,0xe0,0x00,0x04,0x00,0x00,0x00,0x00,
+0xa0,0xc5,0x00,0xd5,0x24,0x07,0x00,0x01,0xa0,0x85,0x00,0x08,0xa0,0xc5,0x00,0xd6,
+0x24,0xa5,0x00,0x01,0x2c,0xa2,0x00,0x1c,0x14,0x40,0xff,0xe0,0x24,0x84,0x00,0x03,
+0x90,0xc4,0x00,0xd5,0x00,0x00,0x28,0x21,0x00,0xa4,0x10,0x2b,0x10,0x40,0x00,0x0b,
+0x00,0x00,0x00,0x00,0x00,0xc0,0x18,0x21,0xa0,0x64,0x00,0x08,0x90,0xc2,0x00,0xd5,
+0x24,0xa5,0x00,0x01,0xa0,0x62,0x00,0x09,0x90,0xc4,0x00,0xd5,0x00,0x00,0x00,0x00,
+0x00,0xa4,0x10,0x2b,0x14,0x40,0xff,0xf8,0x24,0x63,0x00,0x03,0x25,0x4a,0x00,0x01,
+0x2d,0x42,0x00,0x08,0xad,0x28,0x00,0x04,0x25,0x6b,0x00,0x04,0x14,0x40,0xff,0xbf,
+0x25,0x29,0x00,0xec,0x03,0xe0,0x00,0x08,0x00,0x00,0x00,0x00,0x90,0x82,0x00,0x05,
+0x08,0x00,0x21,0x68,0xa0,0x82,0x00,0x08,0x97,0x85,0x8b,0x6a,0x3c,0x03,0xb0,0x03,
+0x3c,0x02,0x80,0x01,0x27,0xbd,0xff,0xe8,0x34,0x63,0x00,0x20,0x24,0x42,0x86,0x68,
+0xaf,0xb0,0x00,0x10,0xaf,0xbf,0x00,0x14,0xac,0x62,0x00,0x00,0x30,0x90,0x00,0xff,
+0x00,0x05,0x28,0x42,0x00,0x00,0x48,0x21,0x27,0x8f,0xb4,0x94,0x00,0x00,0x50,0x21,
+0x00,0x00,0x58,0x21,0x27,0x98,0xb5,0x74,0x27,0x99,0xb5,0x70,0x27,0x8e,0xb5,0x6e,
+0x27,0x8c,0xb4,0x98,0x27,0x8d,0xb4,0xf0,0x27,0x88,0xb5,0x68,0x00,0x0a,0x18,0x80,
+0x01,0x6f,0x10,0x21,0xac,0x40,0x00,0x00,0xac,0x45,0x00,0x58,0x00,0x6e,0x20,0x21,
+0x00,0x78,0x10,0x21,0xa1,0x00,0xff,0xfc,0xad,0x00,0x00,0x00,0xa1,0x00,0x00,0x04,
+0xa1,0x00,0x00,0x05,0xad,0x00,0xff,0xf8,0x00,0x79,0x18,0x21,0x24,0x06,0x00,0x01,
+0x24,0xc6,0xff,0xff,0xa0,0x80,0x00,0x00,0xa4,0x60,0x00,0x00,0xac,0x40,0x00,0x00,
+0x24,0x63,0x00,0x02,0x24,0x42,0x00,0x04,0x04,0xc1,0xff,0xf9,0x24,0x84,0x00,0x01,
+0x00,0x0a,0x10,0x80,0x00,0x4d,0x20,0x21,0x00,0x00,0x30,0x21,0x00,0x4c,0x18,0x21,
+0x27,0x87,0x81,0x64,0x8c,0xe2,0x00,0x00,0x24,0xe7,0x00,0x04,0xac,0x82,0x00,0x00,
+0xa0,0x66,0x00,0x00,0xa0,0x66,0x00,0x01,0x24,0xc6,0x00,0x01,0x28,0xc2,0x00,0x1c,
+0xa0,0x60,0x00,0x02,0x24,0x84,0x00,0x04,0x14,0x40,0xff,0xf6,0x24,0x63,0x00,0x03,
+0x25,0x29,0x00,0x01,0x29,0x22,0x00,0x08,0x25,0x4a,0x00,0x3b,0x25,0x08,0x00,0xec,
+0x14,0x40,0xff,0xd6,0x25,0x6b,0x00,0xec,0xa7,0x80,0x81,0x60,0x00,0x00,0x48,0x21,
+0x27,0x83,0xb4,0x40,0xac,0x69,0x00,0x00,0x25,0x29,0x00,0x01,0x29,0x22,0x00,0x0c,
+0x14,0x40,0xff,0xfc,0x24,0x63,0x00,0x04,0x0c,0x00,0x21,0x2d,0x00,0x00,0x00,0x00,
+0x2e,0x04,0x00,0x14,0x27,0x83,0xb4,0x90,0x24,0x09,0x00,0x07,0x10,0x80,0x00,0x0a,
+0x00,0x00,0x00,0x00,0x90,0x62,0x00,0xd5,0x25,0x29,0xff,0xff,0xa0,0x62,0x00,0x00,
+0x05,0x21,0xff,0xfa,0x24,0x63,0x00,0xec,0x8f,0xbf,0x00,0x14,0x8f,0xb0,0x00,0x10,
+0x03,0xe0,0x00,0x08,0x27,0xbd,0x00,0x18,0x90,0x62,0x00,0xd6,0x08,0x00,0x21,0xeb,
+0x25,0x29,0xff,0xff,0x30,0x84,0x00,0xff,0x00,0x04,0x11,0x00,0x00,0x44,0x10,0x23,
+0x00,0x02,0x10,0x80,0x00,0x44,0x10,0x23,0x00,0x02,0x10,0x80,0x27,0x83,0xb4,0x90,
+0x00,0x43,0x60,0x21,0x3c,0x04,0xb0,0x03,0x3c,0x02,0x80,0x01,0x34,0x84,0x00,0x20,
+0x24,0x42,0x87,0xd4,0x30,0xc6,0x00,0xff,0x93,0xa9,0x00,0x13,0x30,0xa5,0x00,0xff,
+0x30,0xe7,0x00,0xff,0xac,0x82,0x00,0x00,0x10,0xc0,0x00,0xeb,0x25,0x8f,0x00,0xd0,
+0x91,0x82,0x00,0x00,0x00,0x00,0x00,0x00,0x24,0x42,0xff,0xfc,0x2c,0x43,0x00,0x18,
+0x10,0x60,0x00,0xcf,0x3c,0x03,0x80,0x01,0x00,0x02,0x10,0x80,0x24,0x63,0x02,0x5c,
+0x00,0x43,0x10,0x21,0x8c,0x44,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x80,0x00,0x08,
+0x00,0x00,0x00,0x00,0x2d,0x22,0x00,0x2d,0x10,0x40,0x00,0x14,0x00,0x00,0x00,0x00,
+0x10,0xa0,0x00,0x0f,0x00,0x00,0x00,0x00,0x24,0x02,0x00,0x01,0x10,0xa2,0x00,0x09,
+0x00,0x00,0x00,0x00,0x24,0x02,0x00,0x02,0x10,0xa2,0x00,0x06,0x00,0x00,0x00,0x00,
+0x8d,0x82,0x00,0xd0,0x00,0x00,0x00,0x00,0x24,0x42,0xff,0xd0,0x03,0xe0,0x00,0x08,
+0xad,0x82,0x00,0xd0,0x8d,0x82,0x00,0xd0,0x08,0x00,0x22,0x23,0x24,0x42,0xff,0xe0,
+0x8d,0x82,0x00,0xd0,0x08,0x00,0x22,0x23,0x24,0x42,0x00,0x01,0x10,0xa0,0x00,0x0f,
+0x00,0x00,0x00,0x00,0x24,0x02,0x00,0x01,0x10,0xa2,0xff,0xf9,0x00,0x00,0x00,0x00,
+0x24,0x02,0x00,0x02,0x10,0xa2,0x00,0x07,0x00,0x00,0x00,0x00,0x24,0x02,0x00,0x03,
+0x14,0xa2,0xff,0xf0,0x00,0x00,0x00,0x00,0x8d,0x82,0x00,0xd0,0x08,0x00,0x22,0x23,
+0x24,0x42,0xff,0xe8,0x03,0xe0,0x00,0x08,0x00,0x00,0x00,0x00,0x8d,0x82,0x00,0xd0,
+0x08,0x00,0x22,0x23,0x24,0x42,0x00,0x02,0x10,0xa0,0xff,0xfc,0x00,0x00,0x00,0x00,
+0x24,0x02,0x00,0x01,0x10,0xa2,0xff,0xe6,0x00,0x00,0x00,0x00,0x24,0x02,0x00,0x02,
+0x10,0xa2,0xff,0xf4,0x24,0x02,0x00,0x03,0x14,0xa2,0xff,0xef,0x00,0x00,0x00,0x00,
+0x8d,0x82,0x00,0xd0,0x08,0x00,0x22,0x23,0x24,0x42,0xff,0xf8,0x2d,0x22,0x00,0x19,
+0x14,0x40,0xff,0xde,0x00,0x00,0x00,0x00,0x10,0xa0,0xff,0xec,0x00,0x00,0x00,0x00,
+0x24,0x02,0x00,0x01,0x10,0xa2,0xff,0xd6,0x00,0x00,0x00,0x00,0x24,0x02,0x00,0x02,
+0x10,0xa2,0xff,0xe4,0x24,0x02,0x00,0x03,0x10,0xa2,0xff,0xf1,0x00,0x00,0x00,0x00,
+0x8d,0x82,0x00,0xd0,0x08,0x00,0x22,0x23,0x24,0x42,0xff,0xf0,0x2d,0x22,0x00,0x1b,
+0x10,0x40,0xff,0xf1,0x00,0x00,0x00,0x00,0x10,0xa0,0xff,0xdc,0x00,0x00,0x00,0x00,
+0x24,0x02,0x00,0x01,0x10,0xa2,0xff,0xc6,0x00,0x00,0x00,0x00,0x24,0x02,0x00,0x02,
+0x14,0xa2,0xff,0xce,0x00,0x00,0x00,0x00,0x8d,0x82,0x00,0xd0,0x08,0x00,0x22,0x23,
+0x24,0x42,0xff,0xf4,0x2d,0x22,0x00,0x1e,0x10,0x40,0xff,0xe3,0x00,0x00,0x00,0x00,
+0x10,0xa0,0xff,0xce,0x00,0x00,0x00,0x00,0x24,0x02,0x00,0x01,0x10,0xa2,0xff,0xc9,
+0x24,0x02,0x00,0x02,0x10,0xa2,0xff,0xd6,0x00,0x00,0x00,0x00,0x08,0x00,0x22,0x34,
+0x24,0x02,0x00,0x03,0x2d,0x22,0x00,0x23,0x10,0x40,0xff,0xd7,0x00,0x00,0x00,0x00,
+0x10,0xa0,0xff,0xaf,0x00,0x00,0x00,0x00,0x24,0x02,0x00,0x01,0x10,0xa2,0xff,0xbd,
+0x24,0x02,0x00,0x02,0x10,0xa2,0xff,0xda,0x00,0x00,0x00,0x00,0x24,0x02,0x00,0x03,
+0x14,0xa2,0xff,0x9f,0x00,0x00,0x00,0x00,0x08,0x00,0x22,0x25,0x00,0x00,0x00,0x00,
+0x2d,0x22,0x00,0x25,0x10,0x40,0xff,0xc8,0x00,0x00,0x00,0x00,0x10,0xa0,0xff,0xa0,
+0x00,0x00,0x00,0x00,0x24,0x02,0x00,0x01,0x10,0xa2,0x00,0x06,0x00,0x00,0x00,0x00,
+0x24,0x02,0x00,0x02,0x10,0xa2,0xff,0x97,0x00,0x00,0x00,0x00,0x08,0x00,0x22,0x80,
+0x24,0x02,0x00,0x03,0x8d,0x82,0x00,0xd0,0x08,0x00,0x22,0x23,0x24,0x42,0xff,0xfc,
+0x2d,0x22,0x00,0x16,0x14,0x40,0x00,0x0e,0x00,0x00,0x00,0x00,0x10,0xa0,0xff,0xa3,
+0x00,0x00,0x00,0x00,0x24,0x02,0x00,0x01,0x10,0xa2,0xff,0x8d,0x00,0x00,0x00,0x00,
+0x24,0x02,0x00,0x02,0x10,0xa2,0xff,0x9b,0x24,0x02,0x00,0x03,0x14,0xa2,0xff,0xa8,
+0x00,0x00,0x00,0x00,0x8d,0x82,0x00,0xd0,0x08,0x00,0x22,0x23,0x24,0x42,0xff,0xfa,
+0x10,0xa0,0xff,0x96,0x00,0x00,0x00,0x00,0x24,0x02,0x00,0x01,0x10,0xa2,0xff,0x80,
+0x00,0x00,0x00,0x00,0x24,0x02,0x00,0x02,0x10,0xa2,0xff,0x8e,0x00,0x00,0x00,0x00,
+0x08,0x00,0x22,0x48,0x00,0x00,0x00,0x00,0x2d,0x22,0x00,0x17,0x14,0x40,0xff,0x9e,
+0x00,0x00,0x00,0x00,0x08,0x00,0x22,0x97,0x00,0x00,0x00,0x00,0x2d,0x22,0x00,0x19,
+0x10,0x40,0xff,0xe2,0x00,0x00,0x00,0x00,0x10,0xa0,0xff,0x84,0x00,0x00,0x00,0x00,
+0x24,0x02,0x00,0x01,0x10,0xa2,0xff,0x6e,0x00,0x00,0x00,0x00,0x24,0x02,0x00,0x02,
+0x10,0xa2,0xff,0x7c,0x24,0x02,0x00,0x03,0x10,0xa2,0xff,0x89,0x00,0x00,0x00,0x00,
+0x08,0x00,0x22,0x25,0x00,0x00,0x00,0x00,0x08,0x00,0x22,0xb4,0x2d,0x22,0x00,0x1b,
+0x2d,0x22,0x00,0x1e,0x10,0x40,0xff,0xde,0x00,0x00,0x00,0x00,0x10,0xa0,0xff,0x73,
+0x00,0x00,0x00,0x00,0x24,0x02,0x00,0x01,0x10,0xa2,0xff,0x5d,0x00,0x00,0x00,0x00,
+0x24,0x02,0x00,0x02,0x10,0xa2,0xff,0x6b,0x24,0x02,0x00,0x03,0x10,0xa2,0xff,0x88,
+0x00,0x00,0x00,0x00,0x08,0x00,0x22,0x25,0x00,0x00,0x00,0x00,0x2d,0x22,0x00,0x23,
+0x14,0x40,0xff,0xf2,0x00,0x00,0x00,0x00,0x08,0x00,0x22,0x4e,0x00,0x00,0x00,0x00,
+0x08,0x00,0x22,0x4c,0x2d,0x22,0x00,0x25,0x08,0x00,0x22,0x85,0x2d,0x22,0x00,0x27,
+0x10,0xa0,0xff,0x5e,0x00,0x00,0x00,0x00,0x24,0x02,0x00,0x01,0x10,0xa2,0xff,0x48,
+0x00,0x00,0x00,0x00,0x24,0x02,0x00,0x02,0x10,0xa2,0xff,0x56,0x24,0x02,0x00,0x03,
+0x14,0xa2,0xff,0x63,0x00,0x00,0x00,0x00,0x08,0x00,0x22,0x91,0x00,0x00,0x00,0x00,
+0x2d,0x22,0x00,0x27,0x14,0x40,0xff,0x8e,0x00,0x00,0x00,0x00,0x08,0x00,0x22,0x3e,
+0x00,0x00,0x00,0x00,0x2d,0x22,0x00,0x29,0x14,0x40,0xff,0x89,0x00,0x00,0x00,0x00,
+0x08,0x00,0x22,0x2b,0x00,0x00,0x00,0x00,0x91,0x86,0x00,0x00,0x91,0x83,0x00,0xd4,
+0x25,0x8d,0x00,0x5c,0x30,0xc4,0x00,0xff,0x00,0x04,0x10,0x40,0x00,0x44,0x10,0x21,
+0x00,0x04,0x50,0x80,0x01,0x82,0x58,0x21,0x01,0x8a,0x40,0x21,0x25,0x78,0x00,0x08,
+0x10,0x60,0x00,0x37,0x25,0x0e,0x00,0x60,0x2c,0xa2,0x00,0x03,0x14,0x40,0x00,0x25,
+0x00,0x00,0x00,0x00,0x91,0x82,0x00,0xdd,0x00,0x00,0x00,0x00,0x14,0x40,0x00,0x1e,
+0x00,0x00,0x00,0x00,0x27,0x87,0x81,0x64,0x01,0x47,0x10,0x21,0x8c,0x43,0x00,0x00,
+0x00,0x00,0x00,0x00,0xad,0x03,0x00,0x60,0x91,0x62,0x00,0x08,0x00,0x00,0x00,0x00,
+0x00,0x40,0x30,0x21,0xa1,0x82,0x00,0x00,0x30,0xc2,0x00,0xff,0x00,0x02,0x10,0x80,
+0x00,0x47,0x10,0x21,0x8c,0x43,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x03,0x18,0x42,
+0xad,0xa3,0x00,0x00,0x91,0x84,0x00,0x00,0x8d,0xc5,0x00,0x00,0x00,0x04,0x20,0x80,
+0x00,0x87,0x10,0x21,0x8c,0x43,0x00,0x00,0x00,0x05,0x28,0x40,0x00,0x8c,0x20,0x21,
+0x00,0x03,0x18,0x80,0x00,0xa3,0x10,0x2b,0x00,0x62,0x28,0x0a,0xac,0x85,0x00,0x60,
+0x03,0xe0,0x00,0x08,0xa1,0x80,0x00,0xd4,0x27,0x87,0x81,0x64,0x08,0x00,0x23,0x0e,
+0xa1,0x80,0x00,0xdd,0x27,0x82,0x81,0xd4,0x8d,0x83,0x00,0xd8,0x00,0x82,0x10,0x21,
+0x90,0x44,0x00,0x00,0x24,0x63,0x00,0x01,0x00,0x64,0x20,0x2b,0x14,0x80,0xff,0x0d,
+0xad,0x83,0x00,0xd8,0x8d,0x02,0x00,0x60,0xa1,0x80,0x00,0xd4,0x00,0x02,0x1f,0xc2,
+0x00,0x43,0x10,0x21,0x00,0x02,0x10,0x43,0x03,0xe0,0x00,0x08,0xad,0x82,0x00,0x5c,
+0x10,0xe0,0x00,0x1a,0x24,0x83,0xff,0xfc,0x2c,0x62,0x00,0x18,0x10,0x40,0x01,0x18,
+0x00,0x03,0x10,0x80,0x3c,0x03,0x80,0x01,0x24,0x63,0x02,0xbc,0x00,0x43,0x10,0x21,
+0x8c,0x44,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x80,0x00,0x08,0x00,0x00,0x00,0x00,
+0x2d,0x22,0x00,0x2d,0x10,0x40,0x00,0x5f,0x00,0x00,0x00,0x00,0x10,0xa0,0x00,0x5a,
+0x00,0x00,0x00,0x00,0x24,0x02,0x00,0x01,0x10,0xa2,0x00,0x54,0x00,0x00,0x00,0x00,
+0x24,0x02,0x00,0x02,0x10,0xa2,0x00,0x51,0x00,0x00,0x00,0x00,0x8d,0x82,0x00,0xd0,
+0x00,0x00,0x00,0x00,0x24,0x42,0xff,0xd0,0xad,0x82,0x00,0xd0,0x8d,0xe3,0x00,0x00,
+0x8d,0xa2,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x43,0x10,0x21,0xad,0xa2,0x00,0x00,
+0xad,0xe0,0x00,0x00,0x8d,0xa3,0x00,0x00,0x8d,0xc4,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x83,0x10,0x2a,0x10,0x40,0x00,0x22,0x00,0x00,0x00,0x00,0x93,0x05,0x00,0x01,
+0x91,0x82,0x00,0x00,0x00,0x00,0x00,0x00,0x10,0x45,0x00,0x05,0x24,0x02,0x00,0x01,
+0xa1,0x85,0x00,0x00,0xa1,0x82,0x00,0xd4,0x03,0xe0,0x00,0x08,0xad,0x80,0x00,0xd8,
+0x91,0x82,0x00,0xdd,0x24,0x03,0x00,0x01,0x10,0x43,0x00,0x05,0x00,0x00,0x00,0x00,
+0xa1,0x83,0x00,0xd4,0xad,0x80,0x00,0xd8,0x03,0xe0,0x00,0x08,0xa1,0x83,0x00,0xdd,
+0x00,0x04,0x17,0xc2,0x00,0x82,0x10,0x21,0x00,0x02,0x10,0x43,0xad,0xa2,0x00,0x00,
+0x91,0x83,0x00,0x00,0x27,0x82,0x81,0x64,0x8d,0xc5,0x00,0x00,0x00,0x03,0x18,0x80,
+0x00,0x62,0x18,0x21,0x8c,0x64,0x00,0x00,0x00,0x05,0x28,0x40,0x00,0x04,0x18,0x80,
+0x00,0xa3,0x10,0x2b,0x00,0x62,0x28,0x0a,0x08,0x00,0x23,0x20,0xad,0xc5,0x00,0x00,
+0x97,0x82,0x8b,0x6c,0x00,0x00,0x00,0x00,0x00,0x62,0x10,0x2a,0x10,0x40,0xfe,0xb9,
+0x00,0x00,0x00,0x00,0x91,0x82,0x00,0xdd,0x00,0x00,0x00,0x00,0x14,0x40,0x00,0x15,
+0x00,0x00,0x00,0x00,0x91,0x83,0x00,0x00,0x27,0x82,0x81,0x64,0x00,0x03,0x18,0x80,
+0x00,0x62,0x10,0x21,0x8c,0x44,0x00,0x00,0x00,0x6c,0x18,0x21,0xac,0x64,0x00,0x60,
+0x93,0x05,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x05,0x10,0x80,0x01,0x82,0x10,0x21,
+0x24,0x4e,0x00,0x60,0xa1,0x85,0x00,0x00,0x8d,0xc2,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x02,0x1f,0xc2,0x00,0x43,0x10,0x21,0x00,0x02,0x10,0x43,0x03,0xe0,0x00,0x08,
+0xad,0xa2,0x00,0x00,0x08,0x00,0x23,0x92,0xa1,0x80,0x00,0xdd,0x8d,0x82,0x00,0xd0,
+0x08,0x00,0x23,0x4e,0x24,0x42,0xff,0xe0,0x8d,0x82,0x00,0xd0,0x08,0x00,0x23,0x4e,
+0x24,0x42,0x00,0x01,0x10,0xa0,0x00,0x0d,0x00,0x00,0x00,0x00,0x24,0x02,0x00,0x01,
+0x10,0xa2,0xff,0xf9,0x00,0x00,0x00,0x00,0x24,0x02,0x00,0x02,0x10,0xa2,0xff,0xa7,
+0x00,0x00,0x00,0x00,0x24,0x02,0x00,0x03,0x14,0xa2,0xff,0xf0,0x00,0x00,0x00,0x00,
+0x8d,0x82,0x00,0xd0,0x08,0x00,0x23,0x4e,0x24,0x42,0xff,0xe8,0x8d,0x82,0x00,0xd0,
+0x08,0x00,0x23,0x4e,0x24,0x42,0x00,0x02,0x10,0xa0,0xff,0xfc,0x00,0x00,0x00,0x00,
+0x24,0x02,0x00,0x01,0x10,0xa2,0xff,0xe8,0x00,0x00,0x00,0x00,0x24,0x02,0x00,0x02,
+0x10,0xa2,0xff,0x96,0x24,0x02,0x00,0x03,0x14,0xa2,0xff,0xf1,0x00,0x00,0x00,0x00,
+0x8d,0x82,0x00,0xd0,0x08,0x00,0x23,0x4e,0x24,0x42,0xff,0xf8,0x2d,0x22,0x00,0x19,
+0x14,0x40,0xff,0xe0,0x00,0x00,0x00,0x00,0x10,0xa0,0xff,0xec,0x00,0x00,0x00,0x00,
+0x24,0x02,0x00,0x01,0x10,0xa2,0xff,0xd8,0x00,0x00,0x00,0x00,0x24,0x02,0x00,0x02,
+0x10,0xa2,0xff,0x86,0x24,0x02,0x00,0x03,0x10,0xa2,0xff,0xf1,0x00,0x00,0x00,0x00,
+0x8d,0x82,0x00,0xd0,0x08,0x00,0x23,0x4e,0x24,0x42,0xff,0xf0,0x2d,0x22,0x00,0x1b,
+0x10,0x40,0xff,0xf1,0x00,0x00,0x00,0x00,0x10,0xa0,0xff,0xdc,0x00,0x00,0x00,0x00,
+0x24,0x02,0x00,0x01,0x10,0xa2,0xff,0xc8,0x00,0x00,0x00,0x00,0x24,0x02,0x00,0x02,
+0x14,0xa2,0xff,0xd0,0x00,0x00,0x00,0x00,0x8d,0x82,0x00,0xd0,0x08,0x00,0x23,0x4e,
+0x24,0x42,0xff,0xf4,0x2d,0x22,0x00,0x1e,0x10,0x40,0xff,0xe3,0x00,0x00,0x00,0x00,
+0x10,0xa0,0xff,0xce,0x00,0x00,0x00,0x00,0x24,0x02,0x00,0x01,0x10,0xa2,0xff,0x6b,
+0x24,0x02,0x00,0x02,0x10,0xa2,0xff,0xd6,0x00,0x00,0x00,0x00,0x08,0x00,0x23,0xaa,
+0x24,0x02,0x00,0x03,0x2d,0x22,0x00,0x23,0x10,0x40,0xff,0xd7,0x00,0x00,0x00,0x00,
+0x10,0xa0,0xff,0xb1,0x00,0x00,0x00,0x00,0x24,0x02,0x00,0x01,0x10,0xa2,0xff,0x5f,
+0x24,0x02,0x00,0x02,0x10,0xa2,0xff,0xda,0x00,0x00,0x00,0x00,0x24,0x02,0x00,0x03,
+0x14,0xa2,0xff,0x56,0x00,0x00,0x00,0x00,0x08,0x00,0x23,0x9b,0x00,0x00,0x00,0x00,
+0x2d,0x22,0x00,0x25,0x10,0x40,0xff,0xc8,0x00,0x00,0x00,0x00,0x10,0xa0,0xff,0xa2,
+0x00,0x00,0x00,0x00,0x24,0x02,0x00,0x01,0x10,0xa2,0x00,0x06,0x00,0x00,0x00,0x00,
+0x24,0x02,0x00,0x02,0x10,0xa2,0xff,0x99,0x00,0x00,0x00,0x00,0x08,0x00,0x23,0xf4,
+0x24,0x02,0x00,0x03,0x8d,0x82,0x00,0xd0,0x08,0x00,0x23,0x4e,0x24,0x42,0xff,0xfc,
+0x2d,0x22,0x00,0x16,0x14,0x40,0x00,0x0e,0x00,0x00,0x00,0x00,0x10,0xa0,0xff,0xa3,
+0x00,0x00,0x00,0x00,0x24,0x02,0x00,0x01,0x10,0xa2,0xff,0x8f,0x00,0x00,0x00,0x00,
+0x24,0x02,0x00,0x02,0x10,0xa2,0xff,0x3d,0x24,0x02,0x00,0x03,0x14,0xa2,0xff,0xa8,
+0x00,0x00,0x00,0x00,0x8d,0x82,0x00,0xd0,0x08,0x00,0x23,0x4e,0x24,0x42,0xff,0xfa,
+0x10,0xa0,0xff,0x96,0x00,0x00,0x00,0x00,0x24,0x02,0x00,0x01,0x10,0xa2,0xff,0x82,
+0x00,0x00,0x00,0x00,0x24,0x02,0x00,0x02,0x10,0xa2,0xff,0x30,0x00,0x00,0x00,0x00,
+0x08,0x00,0x23,0xbc,0x00,0x00,0x00,0x00,0x2d,0x22,0x00,0x17,0x14,0x40,0xff,0x9e,
+0x00,0x00,0x00,0x00,0x08,0x00,0x24,0x0b,0x00,0x00,0x00,0x00,0x2d,0x22,0x00,0x19,
+0x10,0x40,0xff,0xe2,0x00,0x00,0x00,0x00,0x10,0xa0,0xff,0x84,0x00,0x00,0x00,0x00,
+0x24,0x02,0x00,0x01,0x10,0xa2,0xff,0x70,0x00,0x00,0x00,0x00,0x24,0x02,0x00,0x02,
+0x10,0xa2,0xff,0x1e,0x24,0x02,0x00,0x03,0x10,0xa2,0xff,0x89,0x00,0x00,0x00,0x00,
+0x08,0x00,0x23,0x9b,0x00,0x00,0x00,0x00,0x08,0x00,0x24,0x28,0x2d,0x22,0x00,0x1b,
+0x2d,0x22,0x00,0x1e,0x10,0x40,0xff,0xde,0x00,0x00,0x00,0x00,0x10,0xa0,0xff,0x73,
+0x00,0x00,0x00,0x00,0x24,0x02,0x00,0x01,0x10,0xa2,0xff,0x5f,0x00,0x00,0x00,0x00,
+0x24,0x02,0x00,0x02,0x10,0xa2,0xff,0x0d,0x24,0x02,0x00,0x03,0x10,0xa2,0xff,0x88,
+0x00,0x00,0x00,0x00,0x08,0x00,0x23,0x9b,0x00,0x00,0x00,0x00,0x2d,0x22,0x00,0x23,
+0x14,0x40,0xff,0xf2,0x00,0x00,0x00,0x00,0x08,0x00,0x23,0xc2,0x00,0x00,0x00,0x00,
+0x08,0x00,0x23,0xc0,0x2d,0x22,0x00,0x25,0x08,0x00,0x23,0xf9,0x2d,0x22,0x00,0x27,
+0x10,0xa0,0xff,0x5e,0x00,0x00,0x00,0x00,0x24,0x02,0x00,0x01,0x10,0xa2,0xff,0x4a,
+0x00,0x00,0x00,0x00,0x24,0x02,0x00,0x02,0x10,0xa2,0xfe,0xf8,0x24,0x02,0x00,0x03,
+0x14,0xa2,0xff,0x63,0x00,0x00,0x00,0x00,0x08,0x00,0x24,0x05,0x00,0x00,0x00,0x00,
+0x2d,0x22,0x00,0x27,0x14,0x40,0xff,0x8e,0x00,0x00,0x00,0x00,0x08,0x00,0x23,0xb2,
+0x00,0x00,0x00,0x00,0x2d,0x22,0x00,0x29,0x14,0x40,0xff,0x89,0x00,0x00,0x00,0x00,
+0x08,0x00,0x23,0xa1,0x00,0x00,0x00,0x00,0x27,0xbd,0xff,0xe8,0x3c,0x02,0xb0,0x03,
+0xaf,0xbf,0x00,0x14,0xaf,0xb0,0x00,0x10,0x34,0x42,0x01,0x18,0x3c,0x03,0xb0,0x03,
+0x8c,0x50,0x00,0x00,0x34,0x63,0x01,0x2c,0x90,0x62,0x00,0x00,0x32,0x05,0x00,0x01,
+0xa3,0x82,0x80,0x10,0x14,0xa0,0x00,0x14,0x30,0x44,0x00,0xff,0x32,0x02,0x01,0x00,
+0x14,0x40,0x00,0x09,0x00,0x00,0x00,0x00,0x32,0x02,0x08,0x00,0x10,0x40,0x00,0x02,
+0x24,0x02,0x00,0x01,0xa3,0x82,0xbc,0x08,0x8f,0xbf,0x00,0x14,0x8f,0xb0,0x00,0x10,
+0x03,0xe0,0x00,0x08,0x27,0xbd,0x00,0x18,0x0c,0x00,0x05,0x39,0x00,0x00,0x00,0x00,
+0x26,0x02,0xff,0x00,0xa3,0x80,0xbc,0x08,0x3c,0x01,0xb0,0x03,0xac,0x22,0x01,0x18,
+0x08,0x00,0x24,0x77,0x32,0x02,0x08,0x00,0x0c,0x00,0x21,0x9a,0x00,0x00,0x00,0x00,
+0x26,0x02,0xff,0xff,0x3c,0x01,0xb0,0x03,0xac,0x22,0x01,0x18,0x08,0x00,0x24,0x74,
+0x32,0x02,0x01,0x00,0x27,0xbd,0xff,0xe0,0x3c,0x02,0xb0,0x03,0x34,0x42,0x00,0xd0,
+0xaf,0xbf,0x00,0x18,0x8c,0x43,0x00,0x00,0x3c,0x02,0x00,0x40,0x24,0x07,0x0f,0xff,
+0x00,0x03,0x33,0x02,0x00,0x03,0x2d,0x02,0x00,0x03,0x43,0x02,0x30,0x69,0x0f,0xff,
+0x00,0x62,0x18,0x24,0x30,0xa5,0x00,0x03,0x30,0xc6,0x00,0xff,0x10,0x60,0x00,0x08,
+0x31,0x08,0x00,0xff,0x01,0x00,0x30,0x21,0x0c,0x00,0x25,0x38,0xaf,0xa9,0x00,0x10,
+0x8f,0xbf,0x00,0x18,0x00,0x00,0x00,0x00,0x03,0xe0,0x00,0x08,0x27,0xbd,0x00,0x20,
+0x0c,0x00,0x25,0x8a,0x00,0x00,0x00,0x00,0x3c,0x03,0xb0,0x03,0x34,0x63,0x00,0xd4,
+0x08,0x00,0x24,0xa0,0xac,0x62,0x00,0x00,0x27,0xbd,0xff,0xc0,0xaf,0xb6,0x00,0x30,
+0xaf,0xb3,0x00,0x24,0xaf,0xb1,0x00,0x1c,0xaf,0xb0,0x00,0x18,0xaf,0xbf,0x00,0x3c,
+0xaf,0xbe,0x00,0x38,0xaf,0xb7,0x00,0x34,0xaf,0xb5,0x00,0x2c,0xaf,0xb4,0x00,0x28,
+0xaf,0xb2,0x00,0x20,0x0c,0x00,0x17,0xc8,0x00,0x80,0x80,0x21,0x00,0x00,0xb0,0x21,
+0x00,0x00,0x88,0x21,0x10,0x40,0x00,0x12,0x00,0x00,0x98,0x21,0x3c,0x02,0xb0,0x03,
+0x3c,0x03,0xb0,0x03,0x3c,0x04,0xb0,0x03,0x24,0x05,0x00,0x01,0x34,0x42,0x00,0xbc,
+0x34,0x63,0x00,0xbb,0x34,0x84,0x00,0xba,0xa4,0x40,0x00,0x00,0xa0,0x65,0x00,0x00,
+0xa0,0x85,0x00,0x00,0x7b,0xbe,0x01,0xfc,0x7b,0xb6,0x01,0xbc,0x7b,0xb4,0x01,0x7c,
+0x7b,0xb2,0x01,0x3c,0x7b,0xb0,0x00,0xfc,0x03,0xe0,0x00,0x08,0x27,0xbd,0x00,0x40,
+0x3c,0x02,0xb0,0x03,0x34,0x42,0x01,0x47,0x90,0x44,0x00,0x00,0x00,0x10,0x1a,0x02,
+0x3c,0x15,0xfd,0xff,0x30,0x84,0x00,0xff,0xa0,0x50,0x00,0x00,0x30,0x74,0x00,0x0f,
+0xaf,0xa4,0x00,0x10,0x00,0x00,0x90,0x21,0x3c,0x17,0x02,0x00,0x36,0xb5,0xff,0xff,
+0x3c,0x1e,0xb0,0x03,0x0c,0x00,0x06,0xce,0x24,0x04,0x04,0x00,0x00,0x57,0x10,0x25,
+0x00,0x40,0x28,0x21,0x0c,0x00,0x06,0xc1,0x24,0x04,0x04,0x00,0x00,0x00,0x80,0x21,
+0x0c,0x00,0x26,0x52,0x00,0x00,0x00,0x00,0x26,0x03,0x00,0x01,0x30,0x70,0x00,0xff,
+0x10,0x40,0x00,0x47,0x2e,0x03,0x00,0x02,0x14,0x60,0xff,0xf9,0x00,0x00,0x00,0x00,
+0x0c,0x00,0x06,0xce,0x24,0x04,0x04,0x00,0x00,0x55,0x10,0x24,0x00,0x40,0x28,0x21,
+0x0c,0x00,0x06,0xc1,0x24,0x04,0x04,0x00,0x24,0x02,0x00,0x01,0x12,0x82,0x00,0x38,
+0x00,0x00,0x00,0x00,0x12,0x80,0x00,0x36,0x00,0x00,0x00,0x00,0x32,0x22,0x00,0x60,
+0x32,0x23,0x0c,0x00,0x00,0x03,0x1a,0x02,0x3c,0x05,0x00,0x60,0x00,0x02,0x11,0x42,
+0x02,0x25,0x20,0x24,0x00,0x43,0x10,0x25,0x3c,0x03,0x04,0x00,0x02,0x23,0x28,0x24,
+0x00,0x04,0x24,0x42,0x00,0x44,0x10,0x25,0x00,0x05,0x2d,0x02,0x00,0x45,0x88,0x25,
+0x12,0x20,0x00,0x05,0x26,0x42,0x00,0x01,0x26,0xc2,0x00,0x01,0x30,0x56,0x00,0xff,
+0x02,0x71,0x98,0x21,0x26,0x42,0x00,0x01,0x02,0x5e,0x20,0x21,0x30,0x52,0x00,0xff,
+0x2e,0x43,0x00,0x05,0xa0,0x91,0x00,0xd8,0x14,0x60,0xff,0xce,0x3c,0x02,0xb0,0x03,
+0x8f,0xa5,0x00,0x10,0x34,0x42,0x01,0x47,0xa0,0x45,0x00,0x00,0x12,0x60,0x00,0x0e,
+0x3c,0x02,0xb0,0x03,0x12,0xc0,0x00,0x0d,0x34,0x42,0x00,0xbc,0x00,0x13,0x10,0x40,
+0x00,0x53,0x10,0x21,0x00,0x02,0x10,0xc0,0x00,0x53,0x10,0x21,0x00,0x02,0x98,0x80,
+0x02,0x76,0x00,0x1b,0x16,0xc0,0x00,0x02,0x00,0x00,0x00,0x00,0x00,0x07,0x00,0x0d,
+0x00,0x00,0x98,0x12,0x3c,0x02,0xb0,0x03,0x34,0x42,0x00,0xbc,0x3c,0x03,0xb0,0x03,
+0x3c,0x04,0xb0,0x03,0xa4,0x53,0x00,0x00,0x34,0x63,0x00,0xbb,0x34,0x84,0x00,0xba,
+0x24,0x02,0x00,0x01,0xa0,0x60,0x00,0x00,0x08,0x00,0x24,0xc5,0xa0,0x82,0x00,0x00,
+0x0c,0x00,0x06,0xce,0x24,0x04,0x04,0xfc,0x08,0x00,0x24,0xf3,0x00,0x40,0x88,0x21,
+0x3c,0x03,0xb0,0x03,0x34,0x63,0x00,0xbc,0x3c,0x04,0xb0,0x03,0x3c,0x05,0xb0,0x03,
+0xa4,0x60,0x00,0x00,0x34,0x84,0x00,0xbb,0x34,0xa5,0x00,0xba,0x24,0x02,0x00,0x02,
+0x24,0x03,0x00,0x01,0xa0,0x82,0x00,0x00,0x08,0x00,0x24,0xc5,0xa0,0xa3,0x00,0x00,
+0x27,0xbd,0xff,0xd8,0xaf,0xb0,0x00,0x10,0x30,0xd0,0x00,0xff,0x2e,0x02,0x00,0x2e,
+0xaf,0xb2,0x00,0x18,0xaf,0xb1,0x00,0x14,0xaf,0xbf,0x00,0x20,0xaf,0xb3,0x00,0x1c,
+0x30,0xb1,0x00,0xff,0x14,0x40,0x00,0x06,0x00,0x80,0x90,0x21,0x8f,0xbf,0x00,0x20,
+0x7b,0xb2,0x00,0xfc,0x7b,0xb0,0x00,0xbc,0x03,0xe0,0x00,0x08,0x27,0xbd,0x00,0x28,
+0x2e,0x13,0x00,0x10,0x24,0x05,0x00,0x14,0x0c,0x00,0x13,0xa0,0x24,0x06,0x01,0x07,
+0x12,0x60,0x00,0x38,0x02,0x00,0x30,0x21,0x8f,0xa2,0x00,0x38,0x30,0xc3,0x00,0x3f,
+0x3c,0x04,0xb0,0x09,0x00,0x02,0x14,0x00,0x00,0x43,0x30,0x25,0x34,0x84,0x01,0x60,
+0x90,0x82,0x00,0x00,0x00,0x00,0x00,0x00,0x14,0x40,0xff,0xfd,0x24,0x02,0x00,0x01,
+0x12,0x22,0x00,0x2a,0x2a,0x22,0x00,0x02,0x14,0x40,0x00,0x24,0x24,0x02,0x00,0x02,
+0x12,0x22,0x00,0x20,0x24,0x02,0x00,0x03,0x12,0x22,0x00,0x19,0x00,0x00,0x00,0x00,
+0x16,0x60,0xff,0xe2,0x24,0x02,0x00,0x01,0x12,0x22,0x00,0x13,0x2a,0x22,0x00,0x02,
+0x14,0x40,0x00,0x0d,0x24,0x02,0x00,0x02,0x12,0x22,0x00,0x09,0x24,0x02,0x00,0x03,
+0x16,0x22,0xff,0xda,0x00,0x00,0x00,0x00,0x24,0x04,0x08,0x4c,0x24,0x05,0xff,0xff,
+0x0c,0x00,0x13,0x5b,0x3c,0x06,0x0c,0xb8,0x08,0x00,0x25,0x43,0x00,0x00,0x00,0x00,
+0x08,0x00,0x25,0x6b,0x24,0x04,0x08,0x48,0x16,0x20,0xff,0xd0,0x00,0x00,0x00,0x00,
+0x08,0x00,0x25,0x6b,0x24,0x04,0x08,0x40,0x08,0x00,0x25,0x6b,0x24,0x04,0x08,0x44,
+0x24,0x04,0x08,0x4c,0x0c,0x00,0x13,0x5b,0x24,0x05,0xff,0xff,0x08,0x00,0x25,0x60,
+0x00,0x00,0x00,0x00,0x08,0x00,0x25,0x79,0x24,0x04,0x08,0x48,0x16,0x20,0xff,0xe0,
+0x00,0x00,0x00,0x00,0x08,0x00,0x25,0x79,0x24,0x04,0x08,0x40,0x08,0x00,0x25,0x79,
+0x24,0x04,0x08,0x44,0x02,0x40,0x20,0x21,0x0c,0x00,0x25,0xca,0x02,0x20,0x28,0x21,
+0x08,0x00,0x25,0x4e,0x00,0x40,0x30,0x21,0x27,0xbd,0xff,0xd8,0x2c,0xc2,0x00,0x2e,
+0xaf,0xb2,0x00,0x18,0xaf,0xb1,0x00,0x14,0xaf,0xb0,0x00,0x10,0xaf,0xbf,0x00,0x20,
+0xaf,0xb3,0x00,0x1c,0x00,0xc0,0x80,0x21,0x30,0xb1,0x00,0xff,0x00,0x80,0x90,0x21,
+0x14,0x40,0x00,0x07,0x00,0x00,0x18,0x21,0x8f,0xbf,0x00,0x20,0x7b,0xb2,0x00,0xfc,
+0x7b,0xb0,0x00,0xbc,0x00,0x60,0x10,0x21,0x03,0xe0,0x00,0x08,0x27,0xbd,0x00,0x28,
+0x2e,0x13,0x00,0x10,0x24,0x05,0x00,0x14,0x0c,0x00,0x13,0xa0,0x24,0x06,0x01,0x07,
+0x12,0x60,0x00,0x24,0x02,0x00,0x30,0x21,0x3c,0x03,0xb0,0x09,0x34,0x63,0x01,0x60,
+0x90,0x62,0x00,0x00,0x00,0x00,0x00,0x00,0x14,0x40,0xff,0xfd,0x30,0xc5,0x00,0x3f,
+0x0c,0x00,0x26,0x07,0x02,0x20,0x20,0x21,0x16,0x60,0x00,0x0a,0x00,0x40,0x80,0x21,
+0x24,0x02,0x00,0x01,0x12,0x22,0x00,0x15,0x2a,0x22,0x00,0x02,0x14,0x40,0x00,0x0f,
+0x24,0x02,0x00,0x02,0x12,0x22,0x00,0x0b,0x24,0x02,0x00,0x03,0x12,0x22,0x00,0x03,
+0x00,0x00,0x00,0x00,0x08,0x00,0x25,0x96,0x02,0x00,0x18,0x21,0x24,0x04,0x08,0x4c,
+0x24,0x05,0xff,0xff,0x0c,0x00,0x13,0x5b,0x3c,0x06,0x0c,0xb8,0x08,0x00,0x25,0x96,
+0x02,0x00,0x18,0x21,0x08,0x00,0x25,0xb8,0x24,0x04,0x08,0x48,0x16,0x20,0xff,0xf5,
+0x00,0x00,0x00,0x00,0x08,0x00,0x25,0xb8,0x24,0x04,0x08,0x40,0x08,0x00,0x25,0xb8,
+0x24,0x04,0x08,0x44,0x02,0x40,0x20,0x21,0x0c,0x00,0x25,0xca,0x02,0x20,0x28,0x21,
+0x08,0x00,0x25,0xa2,0x00,0x40,0x30,0x21,0x27,0xbd,0xff,0xe8,0x2c,0xc2,0x00,0x1f,
+0xaf,0xb0,0x00,0x10,0xaf,0xbf,0x00,0x14,0x00,0xc0,0x80,0x21,0x14,0x40,0x00,0x1d,
+0x30,0xa5,0x00,0xff,0x24,0x02,0x00,0x01,0x10,0xa2,0x00,0x18,0x28,0xa2,0x00,0x02,
+0x14,0x40,0x00,0x12,0x24,0x02,0x00,0x02,0x10,0xa2,0x00,0x0e,0x24,0x02,0x00,0x03,
+0x10,0xa2,0x00,0x07,0x24,0x04,0x08,0x4c,0x26,0x10,0xff,0xe2,0x02,0x00,0x10,0x21,
+0x8f,0xbf,0x00,0x14,0x8f,0xb0,0x00,0x10,0x03,0xe0,0x00,0x08,0x27,0xbd,0x00,0x18,
+0x24,0x05,0xff,0xff,0x0c,0x00,0x13,0x5b,0x3c,0x06,0x0d,0xf8,0x08,0x00,0x25,0xdb,
+0x26,0x10,0xff,0xe2,0x08,0x00,0x25,0xe0,0x24,0x04,0x08,0x48,0x14,0xa0,0xff,0xf2,
+0x24,0x04,0x08,0x40,0x08,0x00,0x25,0xe1,0x24,0x05,0xff,0xff,0x08,0x00,0x25,0xe0,
+0x24,0x04,0x08,0x44,0x2c,0xc2,0x00,0x10,0x14,0x40,0xff,0xec,0x24,0x02,0x00,0x01,
+0x10,0xa2,0x00,0x14,0x28,0xa2,0x00,0x02,0x14,0x40,0x00,0x0e,0x24,0x02,0x00,0x02,
+0x10,0xa2,0x00,0x0a,0x24,0x02,0x00,0x03,0x10,0xa2,0x00,0x03,0x24,0x04,0x08,0x4c,
+0x08,0x00,0x25,0xdb,0x26,0x10,0xff,0xf1,0x24,0x05,0xff,0xff,0x0c,0x00,0x13,0x5b,
+0x3c,0x06,0x0d,0xb8,0x08,0x00,0x25,0xdb,0x26,0x10,0xff,0xf1,0x08,0x00,0x25,0xfa,
+0x24,0x04,0x08,0x48,0x14,0xa0,0xff,0xf6,0x24,0x04,0x08,0x40,0x08,0x00,0x25,0xfb,
+0x24,0x05,0xff,0xff,0x08,0x00,0x25,0xfa,0x24,0x04,0x08,0x44,0x27,0xbd,0xff,0xe8,
+0x30,0x84,0x00,0xff,0x24,0x02,0x00,0x01,0x10,0x82,0x00,0x39,0xaf,0xbf,0x00,0x10,
+0x28,0x82,0x00,0x02,0x14,0x40,0x00,0x27,0x00,0x00,0x00,0x00,0x24,0x02,0x00,0x02,
+0x10,0x82,0x00,0x17,0x00,0xa0,0x30,0x21,0x24,0x02,0x00,0x03,0x10,0x82,0x00,0x05,
+0x24,0x04,0x08,0x3c,0x8f,0xbf,0x00,0x10,0x00,0x00,0x00,0x00,0x03,0xe0,0x00,0x08,
+0x27,0xbd,0x00,0x18,0x0c,0x00,0x13,0x5b,0x3c,0x05,0x3f,0x00,0x24,0x04,0x08,0x3c,
+0x3c,0x05,0x80,0x00,0x0c,0x00,0x13,0x5b,0x00,0x00,0x30,0x21,0x24,0x04,0x08,0x3c,
+0x3c,0x05,0x80,0x00,0x0c,0x00,0x13,0x5b,0x24,0x06,0x00,0x01,0x24,0x04,0x08,0xac,
+0x0c,0x00,0x13,0x3d,0x24,0x05,0x0f,0xff,0x08,0x00,0x26,0x15,0x00,0x00,0x00,0x00,
+0x24,0x04,0x08,0x34,0x0c,0x00,0x13,0x5b,0x3c,0x05,0x3f,0x00,0x24,0x04,0x08,0x34,
+0x3c,0x05,0x80,0x00,0x0c,0x00,0x13,0x5b,0x00,0x00,0x30,0x21,0x24,0x04,0x08,0x34,
+0x3c,0x05,0x80,0x00,0x0c,0x00,0x13,0x5b,0x24,0x06,0x00,0x01,0x08,0x00,0x26,0x24,
+0x24,0x04,0x08,0xa8,0x14,0x80,0xff,0xdf,0x00,0xa0,0x30,0x21,0x24,0x04,0x08,0x24,
+0x0c,0x00,0x13,0x5b,0x3c,0x05,0x3f,0x00,0x24,0x04,0x08,0x24,0x3c,0x05,0x80,0x00,
+0x0c,0x00,0x13,0x5b,0x00,0x00,0x30,0x21,0x24,0x04,0x08,0x24,0x3c,0x05,0x80,0x00,
+0x0c,0x00,0x13,0x5b,0x24,0x06,0x00,0x01,0x08,0x00,0x26,0x24,0x24,0x04,0x08,0xa0,
+0x00,0xa0,0x30,0x21,0x24,0x04,0x08,0x2c,0x0c,0x00,0x13,0x5b,0x3c,0x05,0x3f,0x00,
+0x24,0x04,0x08,0x2c,0x3c,0x05,0x80,0x00,0x0c,0x00,0x13,0x5b,0x00,0x00,0x30,0x21,
+0x24,0x04,0x08,0x2c,0x3c,0x05,0x80,0x00,0x0c,0x00,0x13,0x5b,0x24,0x06,0x00,0x01,
+0x08,0x00,0x26,0x24,0x24,0x04,0x08,0xa4,0x3c,0x05,0x00,0x14,0x3c,0x02,0xb0,0x05,
+0x34,0x42,0x04,0x20,0x3c,0x06,0xc0,0x00,0x3c,0x03,0xb0,0x05,0x3c,0x04,0xb0,0x05,
+0x34,0xa5,0x17,0x09,0xac,0x45,0x00,0x00,0x34,0xc6,0x05,0x07,0x34,0x63,0x04,0x24,
+0x34,0x84,0x02,0x28,0x3c,0x07,0xb0,0x05,0x24,0x02,0x00,0x20,0xac,0x66,0x00,0x00,
+0x34,0xe7,0x04,0x50,0xa0,0x82,0x00,0x00,0x90,0xe2,0x00,0x00,0x00,0x00,0x00,0x00,
+0x30,0x42,0x00,0x03,0x10,0x40,0xff,0xfc,0x24,0x02,0x00,0x01,0x03,0xe0,0x00,0x08,
+0x00,0x00,0x00,0x00,0x93,0x85,0x81,0xf1,0x24,0x02,0x00,0x01,0x14,0xa2,0x00,0x51,
+0x00,0x80,0x40,0x21,0x8c,0x89,0x00,0x04,0x3c,0x03,0xb0,0x01,0x01,0x23,0x30,0x21,
+0x8c,0xc2,0x00,0x04,0x00,0x00,0x00,0x00,0x30,0x42,0x00,0x08,0x10,0x45,0x00,0x59,
+0x00,0x00,0x00,0x00,0x94,0xc2,0x00,0x38,0x24,0x03,0x00,0xb4,0x30,0x44,0x00,0xff,
+0x10,0x83,0x00,0x61,0x24,0x02,0x00,0xc4,0x10,0x82,0x00,0x54,0x24,0x02,0x00,0x94,
+0x10,0x82,0x00,0x45,0x00,0x00,0x00,0x00,0x94,0xc2,0x00,0x38,0x00,0x00,0x00,0x00,
+0x30,0x47,0xff,0xff,0x30,0xe3,0x40,0xff,0x24,0x02,0x40,0x88,0x14,0x62,0x00,0x39,
+0x30,0xe3,0x03,0x00,0x24,0x02,0x03,0x00,0x10,0x62,0x00,0x38,0x00,0x00,0x00,0x00,
+0x94,0xc2,0x00,0x56,0x00,0x00,0x00,0x00,0x30,0x47,0xff,0xff,0x30,0xe2,0x00,0x80,
+0x14,0x40,0x00,0x30,0x3c,0x02,0xb0,0x01,0x01,0x22,0x30,0x21,0x94,0xc3,0x00,0x60,
+0x24,0x02,0x00,0x08,0x14,0x43,0x00,0x3b,0x00,0x00,0x00,0x00,0x90,0xc2,0x00,0x62,
+0x24,0x03,0x00,0x04,0x00,0x02,0x39,0x02,0x10,0xe3,0x00,0x15,0x24,0x02,0x00,0x06,
+0x14,0xe2,0x00,0x34,0x00,0x00,0x00,0x00,0x8d,0x05,0x01,0xac,0x94,0xc4,0x00,0x66,
+0x27,0x82,0x89,0x58,0x00,0x05,0x28,0x80,0x30,0x87,0xff,0xff,0x00,0xa2,0x28,0x21,
+0x00,0x07,0x1a,0x00,0x8c,0xa4,0x00,0x00,0x00,0x07,0x12,0x02,0x00,0x43,0x10,0x25,
+0x24,0x42,0x00,0x5e,0x24,0x03,0xc0,0x00,0x30,0x47,0xff,0xff,0x00,0x83,0x20,0x24,
+0x00,0x87,0x20,0x25,0xac,0xa4,0x00,0x00,0x08,0x00,0x26,0xcd,0xad,0x07,0x00,0x10,
+0x8d,0x05,0x01,0xac,0x94,0xc4,0x00,0x64,0x27,0x82,0x89,0x58,0x00,0x05,0x28,0x80,
+0x30,0x87,0xff,0xff,0x00,0xa2,0x28,0x21,0x00,0x07,0x1a,0x00,0x8c,0xa4,0x00,0x00,
+0x00,0x07,0x12,0x02,0x00,0x43,0x10,0x25,0x24,0x42,0x00,0x36,0x3c,0x03,0xff,0xff,
+0x30,0x47,0xff,0xff,0x00,0x83,0x20,0x24,0x00,0x87,0x20,0x25,0xac,0xa4,0x00,0x00,
+0xad,0x07,0x00,0x10,0x03,0xe0,0x00,0x08,0x00,0x00,0x00,0x00,0x94,0xc2,0x00,0x50,
+0x08,0x00,0x26,0x8b,0x30,0x47,0xff,0xff,0x8d,0x04,0x01,0xac,0x27,0x83,0x89,0x58,
+0x00,0x04,0x20,0x80,0x00,0x83,0x20,0x21,0x8c,0x82,0x00,0x00,0x3c,0x03,0xff,0xff,
+0x00,0x43,0x10,0x24,0x34,0x42,0x00,0x2e,0xac,0x82,0x00,0x00,0x24,0x03,0x00,0x2e,
+0xad,0x03,0x00,0x10,0x03,0xe0,0x00,0x08,0x00,0x00,0x00,0x00,0x8d,0x04,0x01,0xac,
+0x27,0x83,0x89,0x58,0x00,0x04,0x20,0x80,0x00,0x83,0x20,0x21,0x8c,0x82,0x00,0x00,
+0x3c,0x03,0xff,0xff,0x00,0x43,0x10,0x24,0x34,0x42,0x00,0x0e,0x24,0x03,0x00,0x0e,
+0x08,0x00,0x26,0xcc,0xac,0x82,0x00,0x00,0x8d,0x04,0x01,0xac,0x27,0x83,0x89,0x58,
+0x00,0x04,0x20,0x80,0x00,0x83,0x20,0x21,0x8c,0x82,0x00,0x00,0x3c,0x03,0xff,0xff,
+0x00,0x43,0x10,0x24,0x34,0x42,0x00,0x14,0x24,0x03,0x00,0x14,0x08,0x00,0x26,0xcc,
+0xac,0x82,0x00,0x00,0x03,0xe0,0x00,0x08,0x00,0x00,0x00,0x00,0x30,0xc6,0x00,0xff,
+0x00,0x06,0x48,0x40,0x01,0x26,0x10,0x21,0x00,0x02,0x10,0x80,0x27,0x8b,0xbc,0x20,
+0x27,0x83,0xbc,0x26,0x00,0x4b,0x40,0x21,0x00,0x43,0x10,0x21,0x94,0x47,0x00,0x00,
+0x30,0xa2,0x3f,0xff,0x10,0xe2,0x00,0x29,0x30,0x8a,0xff,0xff,0x95,0x02,0x00,0x02,
+0x24,0x03,0x00,0x01,0x00,0x02,0x11,0x82,0x30,0x42,0x00,0x01,0x10,0x43,0x00,0x18,
+0x00,0x00,0x00,0x00,0x01,0x26,0x10,0x21,0x00,0x02,0x10,0x80,0x00,0x4b,0x30,0x21,
+0x94,0xc4,0x00,0x02,0x27,0x83,0xbc,0x26,0x27,0x85,0xbc,0x24,0x00,0x45,0x28,0x21,
+0x30,0x84,0xff,0xdf,0x00,0x43,0x10,0x21,0xa4,0xc4,0x00,0x02,0xa4,0x40,0x00,0x00,
+0xa4,0xa0,0x00,0x00,0x94,0xc3,0x00,0x02,0x3c,0x04,0xb0,0x01,0x01,0x44,0x20,0x21,
+0x30,0x63,0xff,0xbf,0xa4,0xc3,0x00,0x02,0xa0,0xc0,0x00,0x00,0x8c,0x82,0x00,0x04,
+0x24,0x03,0xf0,0xff,0x00,0x43,0x10,0x24,0x03,0xe0,0x00,0x08,0xac,0x82,0x00,0x04,
+0x24,0x02,0xc0,0x00,0x91,0x04,0x00,0x01,0x00,0xa2,0x10,0x24,0x00,0x47,0x28,0x25,
+0x3c,0x03,0xb0,0x01,0x24,0x02,0x00,0x02,0x14,0x82,0xff,0xe2,0x01,0x43,0x18,0x21,
+0xac,0x65,0x00,0x00,0x08,0x00,0x26,0xfa,0x01,0x26,0x10,0x21,0x08,0x00,0x26,0xfa,
+0x01,0x26,0x10,0x21,0x93,0x83,0x81,0xf1,0x24,0x02,0x00,0x01,0x14,0x62,0x00,0x0d,
+0x3c,0x02,0xb0,0x01,0x8c,0x84,0x00,0x04,0x3c,0x06,0xb0,0x09,0x00,0x82,0x20,0x21,
+0x8c,0x85,0x00,0x08,0x8c,0x83,0x00,0x04,0x3c,0x02,0x01,0x00,0x34,0xc6,0x01,0x00,
+0x00,0x62,0x18,0x24,0x14,0x60,0x00,0x05,0x30,0xa5,0x20,0x00,0x24,0x02,0x00,0x06,
+0xa0,0xc2,0x00,0x00,0x03,0xe0,0x00,0x08,0x00,0x00,0x00,0x00,0x3c,0x03,0xb0,0x09,
+0x10,0xa0,0xff,0xfc,0x34,0x63,0x01,0x00,0x24,0x02,0x00,0x0e,0x08,0x00,0x27,0x2d,
+0xa0,0x62,0x00,0x00,0x3c,0x02,0xb0,0x01,0x30,0xa5,0xff,0xff,0x00,0xa2,0x28,0x21,
+0x8c,0xa3,0x00,0x00,0x3c,0x02,0x10,0x00,0x00,0x80,0x30,0x21,0x00,0x62,0x18,0x24,
+0x8c,0xa2,0x00,0x04,0x10,0x60,0x00,0x04,0x00,0x00,0x00,0x00,0x30,0x42,0x80,0x00,
+0x10,0x40,0x00,0x13,0x00,0x00,0x00,0x00,0x8c,0xc2,0x01,0xa8,0x00,0x00,0x00,0x00,
+0x24,0x44,0x00,0x01,0x28,0x83,0x00,0x00,0x24,0x42,0x00,0x40,0x00,0x83,0x10,0x0a,
+0x93,0x83,0x81,0xf0,0x00,0x02,0x11,0x83,0x00,0x02,0x11,0x80,0x00,0x82,0x20,0x23,
+0x24,0x63,0xff,0xff,0xac,0xc4,0x01,0xa8,0xa3,0x83,0x81,0xf0,0x8c,0xc4,0x01,0xac,
+0x8c,0xc2,0x01,0xa8,0x00,0x00,0x00,0x00,0x00,0x44,0x10,0x26,0x00,0x02,0x10,0x2b,
+0x03,0xe0,0x00,0x08,0x00,0x00,0x00,0x00,0x3c,0x03,0xb0,0x03,0x34,0x63,0x00,0x73,
+0x90,0x62,0x00,0x00,0x00,0x00,0x00,0x00,0x30,0x42,0x00,0x01,0x14,0x40,0x00,0x04,
+0x00,0x00,0x00,0x00,0xa3,0x80,0x81,0xf1,0x03,0xe0,0x00,0x08,0x00,0x00,0x00,0x00,
+0x24,0x02,0x00,0x01,0xa3,0x82,0x81,0xf1,0x03,0xe0,0x00,0x08,0x00,0x00,0x00,0x00,
+0x3c,0x02,0xb0,0x03,0x34,0x42,0x00,0xa8,0x8c,0x43,0x00,0x00,0x00,0x00,0x00,0x00,
+0x30,0x62,0x00,0xff,0x00,0x03,0x2e,0x02,0x00,0x02,0x39,0x80,0x2c,0xa2,0x00,0x02,
+0x00,0x03,0x34,0x02,0x10,0x40,0x00,0x05,0x00,0x03,0x1a,0x02,0xa4,0x87,0x01,0xd8,
+0xa0,0x85,0x01,0xd4,0xa0,0x86,0x01,0xd5,0xa0,0x83,0x01,0xd6,0x03,0xe0,0x00,0x08,
+0x00,0x00,0x00,0x00,0x8c,0x82,0x00,0x04,0x3c,0x05,0xb0,0x01,0x00,0x80,0x50,0x21,
+0x00,0x45,0x10,0x21,0x8c,0x43,0x00,0x04,0x24,0x02,0x00,0x05,0x00,0x03,0x1a,0x02,
+0x30,0x69,0x00,0x0f,0x11,0x22,0x00,0x0b,0x24,0x02,0x00,0x07,0x11,0x22,0x00,0x09,
+0x24,0x02,0x00,0x0a,0x11,0x22,0x00,0x07,0x24,0x02,0x00,0x0b,0x11,0x22,0x00,0x05,
+0x24,0x02,0x00,0x01,0x93,0x83,0x81,0xf0,0x3c,0x04,0xb0,0x06,0x10,0x62,0x00,0x03,
+0x34,0x84,0x80,0x18,0x03,0xe0,0x00,0x08,0x00,0x00,0x00,0x00,0x8c,0x82,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x02,0x17,0x02,0x14,0x40,0xff,0xfa,0x00,0x00,0x00,0x00,
+0x8d,0x43,0x01,0xa8,0x27,0x82,0x89,0x58,0x00,0x03,0x18,0x80,0x00,0x6a,0x20,0x21,
+0x8c,0x87,0x00,0xa8,0x00,0x62,0x18,0x21,0x8c,0x68,0x00,0x00,0x00,0xe5,0x28,0x21,
+0x8c,0xa9,0x00,0x00,0x3c,0x02,0xff,0xff,0x27,0x83,0x8a,0x58,0x01,0x22,0x10,0x24,
+0x00,0x48,0x10,0x25,0xac,0xa2,0x00,0x00,0x8d,0x44,0x01,0xa8,0x00,0x07,0x30,0xc2,
+0x3c,0x02,0x00,0x80,0x00,0x04,0x20,0x80,0x00,0x83,0x20,0x21,0x00,0x06,0x32,0x00,
+0x8c,0xa9,0x00,0x04,0x00,0xc2,0x30,0x25,0x8c,0x82,0x00,0x00,0x3c,0x03,0x80,0x00,
+0x01,0x22,0x10,0x25,0x00,0x43,0x10,0x25,0xac,0xa2,0x00,0x04,0xaf,0x87,0xbc,0x10,
+0x8c,0xa2,0x00,0x00,0x00,0x00,0x00,0x00,0xaf,0x82,0xbc,0x18,0x8c,0xa3,0x00,0x04,
+0x3c,0x01,0xb0,0x07,0xac,0x26,0x80,0x18,0x8d,0x42,0x01,0xa8,0xaf,0x83,0xbc,0x14,
+0x93,0x85,0x81,0xf0,0x24,0x44,0x00,0x01,0x28,0x83,0x00,0x00,0x24,0x42,0x00,0x40,
+0x00,0x83,0x10,0x0a,0x00,0x02,0x11,0x83,0x00,0x02,0x11,0x80,0x24,0xa5,0xff,0xff,
+0x00,0x82,0x20,0x23,0xad,0x44,0x01,0xa8,0xa3,0x85,0x81,0xf0,0x08,0x00,0x27,0x89,
+0x00,0x00,0x00,0x00,0x3c,0x05,0xb0,0x03,0x3c,0x02,0x80,0x01,0x24,0x42,0x9f,0x04,
+0x34,0xa5,0x00,0x20,0xac,0xa2,0x00,0x00,0x24,0x02,0x00,0x02,0x24,0x03,0x00,0x20,
+0xac,0x82,0x00,0x64,0x3c,0x02,0x80,0x01,0xac,0x83,0x00,0x60,0x00,0x80,0x38,0x21,
+0xac,0x80,0x00,0x00,0xac,0x80,0x00,0x04,0xac,0x80,0x00,0x08,0xac,0x80,0x00,0x4c,
+0xac,0x80,0x00,0x50,0xac,0x80,0x00,0x54,0xac,0x80,0x00,0x0c,0xac,0x80,0x00,0x58,
+0xa0,0x80,0x00,0x5c,0x24,0x83,0x00,0x68,0x24,0x42,0xa0,0x14,0x24,0x04,0x00,0x0f,
+0x24,0x84,0xff,0xff,0xac,0x62,0x00,0x00,0x04,0x81,0xff,0xfd,0x24,0x63,0x00,0x04,
+0x3c,0x02,0xb0,0x03,0x34,0x42,0x00,0xa8,0xac,0xe0,0x01,0xa8,0xac,0xe0,0x01,0xac,
+0xac,0xe0,0x01,0xb0,0xac,0xe0,0x01,0xb4,0xa0,0xe0,0x01,0xb8,0xa0,0xe0,0x01,0xb9,
+0xa0,0xe0,0x01,0xba,0xa0,0xe0,0x01,0xc0,0xa0,0xe0,0x01,0xc1,0xac,0xe0,0x01,0xc4,
+0xac,0xe0,0x01,0xc8,0xac,0xe0,0x01,0xcc,0xac,0xe0,0x01,0xd0,0x8c,0x44,0x00,0x00,
+0x3c,0x02,0x80,0x01,0x24,0x42,0xa0,0xfc,0x30,0x83,0x00,0xff,0x00,0x03,0x19,0x80,
+0xa4,0xe3,0x01,0xd8,0xac,0xe2,0x00,0x78,0x3c,0x03,0x80,0x01,0x3c,0x02,0x80,0x01,
+0x24,0x63,0xa2,0x88,0x24,0x42,0xa1,0xf4,0xac,0xe3,0x00,0x88,0xac,0xe2,0x00,0x98,
+0x3c,0x03,0x80,0x01,0x3c,0x02,0x80,0x01,0x00,0x04,0x2e,0x03,0x00,0x04,0x34,0x03,
+0x24,0x63,0xa3,0x30,0x00,0x04,0x22,0x03,0x24,0x42,0xa4,0x74,0xac,0xe3,0x00,0xa0,
+0xac,0xe2,0x00,0xa4,0xa0,0xe5,0x01,0xd4,0xa0,0xe6,0x01,0xd5,0x03,0xe0,0x00,0x08,
+0xa0,0xe4,0x01,0xd6,0x3c,0x03,0xb0,0x03,0x3c,0x02,0x80,0x01,0x34,0x63,0x00,0x20,
+0x24,0x42,0xa0,0x14,0x03,0xe0,0x00,0x08,0xac,0x62,0x00,0x00,0x3c,0x02,0xb0,0x03,
+0x3c,0x03,0x80,0x01,0x34,0x42,0x00,0x20,0x24,0x63,0xa0,0x2c,0xac,0x43,0x00,0x00,
+0x8c,0x82,0x00,0x10,0x00,0x00,0x00,0x00,0x10,0x40,0x00,0x11,0x00,0x80,0x28,0x21,
+0x8c,0x82,0x00,0x14,0x00,0x00,0x00,0x00,0x10,0x40,0x00,0x0d,0x00,0x00,0x00,0x00,
+0x8c,0x84,0x00,0x10,0x8c,0xa3,0x00,0x14,0x8c,0xa2,0x00,0x04,0x00,0x83,0x20,0x21,
+0x00,0x44,0x10,0x21,0x30,0x43,0x00,0xff,0x00,0x03,0x18,0x2b,0x00,0x02,0x12,0x02,
+0x00,0x43,0x10,0x21,0x00,0x02,0x12,0x00,0x30,0x42,0x3f,0xff,0xac,0xa2,0x00,0x04,
+0xac,0xa0,0x00,0x00,0xac,0xa0,0x00,0x4c,0xac,0xa0,0x00,0x50,0xac,0xa0,0x00,0x54,
+0x03,0xe0,0x00,0x08,0xac,0xa0,0x00,0x0c,0x3c,0x03,0xb0,0x03,0x3c,0x02,0x80,0x01,
+0x34,0x63,0x00,0x20,0x24,0x42,0xa0,0xa8,0xac,0x62,0x00,0x00,0x8c,0x86,0x00,0x04,
+0x3c,0x02,0xb0,0x01,0x24,0x03,0x00,0x01,0x00,0xc2,0x10,0x21,0x8c,0x45,0x00,0x00,
+0xac,0x83,0x00,0x4c,0x00,0x05,0x14,0x02,0x30,0xa3,0x3f,0xff,0x30,0x42,0x00,0xff,
+0xac,0x83,0x00,0x10,0xac,0x82,0x00,0x14,0x8c,0x83,0x00,0x14,0xac,0x85,0x00,0x40,
+0x00,0xc3,0x30,0x21,0x03,0xe0,0x00,0x08,0xac,0x86,0x00,0x08,0x3c,0x02,0xb0,0x03,
+0x3c,0x03,0x80,0x01,0x27,0xbd,0xff,0xe8,0x34,0x42,0x00,0x20,0x24,0x63,0xa0,0xfc,
+0xaf,0xb0,0x00,0x10,0xaf,0xbf,0x00,0x14,0xac,0x43,0x00,0x00,0x8c,0x82,0x00,0x4c,
+0x00,0x00,0x00,0x00,0x10,0x40,0x00,0x0a,0x00,0x80,0x80,0x21,0xae,0x00,0x00,0x00,
+0xae,0x00,0x00,0x4c,0xae,0x00,0x00,0x50,0xae,0x00,0x00,0x54,0xae,0x00,0x00,0x0c,
+0x8f,0xbf,0x00,0x14,0x8f,0xb0,0x00,0x10,0x03,0xe0,0x00,0x08,0x27,0xbd,0x00,0x18,
+0x0c,0x00,0x28,0x2a,0x00,0x00,0x00,0x00,0x08,0x00,0x28,0x4c,0xae,0x00,0x00,0x00,
+0x3c,0x02,0xb0,0x03,0x3c,0x03,0x80,0x01,0x27,0xbd,0xff,0xe8,0x34,0x42,0x00,0x20,
+0x24,0x63,0xa1,0x60,0xaf,0xb0,0x00,0x10,0xaf,0xbf,0x00,0x14,0xac,0x43,0x00,0x00,
+0x8c,0x82,0x00,0x4c,0x00,0x00,0x00,0x00,0x10,0x40,0x00,0x16,0x00,0x80,0x80,0x21,
+0x8e,0x03,0x00,0x08,0x3c,0x02,0xb0,0x01,0x8e,0x04,0x00,0x44,0x00,0x62,0x18,0x21,
+0x90,0x65,0x00,0x00,0x24,0x02,0x00,0x01,0xae,0x02,0x00,0x50,0x30,0xa3,0x00,0xff,
+0x00,0x03,0x10,0x82,0x00,0x04,0x23,0x02,0x30,0x84,0x00,0x0f,0x30,0x42,0x00,0x03,
+0x00,0x03,0x19,0x02,0xae,0x04,0x00,0x34,0xae,0x02,0x00,0x2c,0xae,0x03,0x00,0x30,
+0xa2,0x05,0x00,0x48,0x8f,0xbf,0x00,0x14,0x8f,0xb0,0x00,0x10,0x03,0xe0,0x00,0x08,
+0x27,0xbd,0x00,0x18,0x0c,0x00,0x28,0x2a,0x00,0x00,0x00,0x00,0x08,0x00,0x28,0x64,
+0x00,0x00,0x00,0x00,0x3c,0x02,0xb0,0x03,0x3c,0x03,0x80,0x01,0x27,0xbd,0xff,0xe8,
+0x34,0x42,0x00,0x20,0x24,0x63,0xa1,0xf4,0xaf,0xb0,0x00,0x10,0xaf,0xbf,0x00,0x14,
+0xac,0x43,0x00,0x00,0x8c,0x82,0x00,0x50,0x00,0x00,0x00,0x00,0x10,0x40,0x00,0x16,
+0x00,0x80,0x80,0x21,0x92,0x03,0x00,0x44,0x8e,0x02,0x00,0x40,0x83,0x85,0x8b,0xc4,
+0x92,0x04,0x00,0x41,0x30,0x63,0x00,0x01,0x00,0x02,0x16,0x02,0xae,0x04,0x00,0x14,
+0x00,0x00,0x30,0x21,0xae,0x02,0x00,0x18,0x10,0xa0,0x00,0x04,0xae,0x03,0x00,0x3c,
+0x10,0x60,0x00,0x03,0x24,0x02,0x00,0x01,0x24,0x06,0x00,0x01,0x24,0x02,0x00,0x01,
+0xa3,0x86,0x8b,0xc4,0x8f,0xbf,0x00,0x14,0xae,0x02,0x00,0x54,0x8f,0xb0,0x00,0x10,
+0x03,0xe0,0x00,0x08,0x27,0xbd,0x00,0x18,0x0c,0x00,0x28,0x58,0x00,0x00,0x00,0x00,
+0x08,0x00,0x28,0x89,0x00,0x00,0x00,0x00,0x3c,0x02,0xb0,0x03,0x3c,0x03,0x80,0x01,
+0x27,0xbd,0xff,0xe8,0x34,0x42,0x00,0x20,0x24,0x63,0xa2,0x88,0xaf,0xb0,0x00,0x10,
+0xaf,0xbf,0x00,0x14,0xac,0x43,0x00,0x00,0x8c,0x82,0x00,0x50,0x00,0x00,0x00,0x00,
+0x10,0x40,0x00,0x1b,0x00,0x80,0x80,0x21,0x3c,0x02,0xb0,0x03,0x8c,0x42,0x00,0x00,
+0x92,0x04,0x00,0x44,0x8e,0x03,0x00,0x40,0x83,0x86,0x8b,0xc4,0x92,0x05,0x00,0x41,
+0x30,0x42,0x08,0x00,0x30,0x84,0x00,0x01,0x00,0x02,0x12,0xc2,0x00,0x03,0x1e,0x02,
+0x00,0x82,0x20,0x25,0xae,0x05,0x00,0x14,0x00,0x00,0x38,0x21,0xae,0x03,0x00,0x18,
+0x10,0xc0,0x00,0x04,0xae,0x04,0x00,0x3c,0x10,0x80,0x00,0x03,0x24,0x02,0x00,0x01,
+0x24,0x07,0x00,0x01,0x24,0x02,0x00,0x01,0xa3,0x87,0x8b,0xc4,0x8f,0xbf,0x00,0x14,
+0xae,0x02,0x00,0x54,0x8f,0xb0,0x00,0x10,0x03,0xe0,0x00,0x08,0x27,0xbd,0x00,0x18,
+0x0c,0x00,0x28,0x58,0x00,0x00,0x00,0x00,0x08,0x00,0x28,0xae,0x00,0x00,0x00,0x00,
+0x3c,0x02,0xb0,0x03,0x3c,0x03,0x80,0x01,0x27,0xbd,0xff,0xe8,0x34,0x42,0x00,0x20,
+0x24,0x63,0xa3,0x30,0xaf,0xb0,0x00,0x10,0xaf,0xbf,0x00,0x14,0xac,0x43,0x00,0x00,
+0x8c,0x82,0x00,0x54,0x00,0x00,0x00,0x00,0x10,0x40,0x00,0x42,0x00,0x80,0x80,0x21,
+0x8e,0x04,0x00,0x04,0x8e,0x03,0x00,0x44,0x3c,0x02,0x80,0x00,0x3c,0x08,0xb0,0x01,
+0x34,0x42,0x00,0x10,0x00,0x88,0x20,0x21,0x00,0x62,0x18,0x25,0xac,0x83,0x00,0x04,
+0x8e,0x02,0x00,0x04,0x8e,0x03,0x01,0xac,0x27,0x89,0x89,0x58,0x00,0x48,0x10,0x21,
+0x8c,0x45,0x00,0x00,0x00,0x03,0x18,0x80,0x00,0x69,0x18,0x21,0xac,0x65,0x00,0x00,
+0x8e,0x02,0x00,0x04,0x8e,0x03,0x01,0xac,0x27,0x87,0x8a,0x58,0x00,0x48,0x10,0x21,
+0x8c,0x45,0x00,0x04,0x00,0x03,0x18,0x80,0x00,0x67,0x18,0x21,0xac,0x65,0x00,0x00,
+0x8e,0x02,0x01,0xac,0x8e,0x06,0x00,0x04,0x02,0x00,0x20,0x21,0x00,0x02,0x10,0x80,
+0x00,0x47,0x38,0x21,0x94,0xe3,0x00,0x02,0x00,0x49,0x10,0x21,0x90,0x45,0x00,0x00,
+0x00,0x03,0x1a,0x00,0x00,0xc8,0x30,0x21,0x00,0xa3,0x28,0x25,0x0c,0x00,0x26,0x69,
+0xa4,0xc5,0x00,0x2e,0x8e,0x03,0x01,0xac,0x8e,0x07,0x00,0x04,0x3c,0x06,0xb0,0x03,
+0x24,0x65,0x00,0x01,0x28,0xa4,0x00,0x00,0x24,0x62,0x00,0x40,0x00,0xa4,0x10,0x0a,
+0x00,0x02,0x11,0x83,0x00,0x02,0x11,0x80,0x00,0x03,0x18,0x80,0x00,0xa2,0x28,0x23,
+0x00,0x70,0x18,0x21,0xae,0x05,0x01,0xac,0xac,0x67,0x00,0xa8,0x34,0xc6,0x00,0x30,
+0x8c,0xc3,0x00,0x00,0x93,0x82,0x81,0xf0,0x02,0x00,0x20,0x21,0x24,0x63,0x00,0x01,
+0x24,0x42,0x00,0x01,0xac,0xc3,0x00,0x00,0xa3,0x82,0x81,0xf0,0x0c,0x00,0x28,0x0b,
+0x00,0x00,0x00,0x00,0x8f,0xbf,0x00,0x14,0x8f,0xb0,0x00,0x10,0x03,0xe0,0x00,0x08,
+0x27,0xbd,0x00,0x18,0x0c,0x00,0x28,0xa2,0x00,0x00,0x00,0x00,0x08,0x00,0x28,0xd8,
+0x00,0x00,0x00,0x00,0x3c,0x02,0xb0,0x03,0x3c,0x03,0x80,0x01,0x27,0xbd,0xff,0xe8,
+0x34,0x42,0x00,0x20,0x24,0x63,0xa4,0x74,0xaf,0xb0,0x00,0x10,0xaf,0xbf,0x00,0x14,
+0xac,0x43,0x00,0x00,0x8c,0x82,0x00,0x54,0x00,0x00,0x00,0x00,0x10,0x40,0x00,0x42,
+0x00,0x80,0x80,0x21,0x8e,0x04,0x00,0x04,0x8e,0x03,0x00,0x44,0x3c,0x02,0x80,0x00,
+0x3c,0x08,0xb0,0x01,0x34,0x42,0x00,0x10,0x00,0x88,0x20,0x21,0x00,0x62,0x18,0x25,
+0xac,0x83,0x00,0x04,0x8e,0x02,0x00,0x04,0x8e,0x03,0x01,0xac,0x27,0x89,0x89,0x58,
+0x00,0x48,0x10,0x21,0x8c,0x45,0x00,0x00,0x00,0x03,0x18,0x80,0x00,0x69,0x18,0x21,
+0xac,0x65,0x00,0x00,0x8e,0x02,0x00,0x04,0x8e,0x03,0x01,0xac,0x27,0x87,0x8a,0x58,
+0x00,0x48,0x10,0x21,0x8c,0x45,0x00,0x04,0x00,0x03,0x18,0x80,0x00,0x67,0x18,0x21,
+0xac,0x65,0x00,0x00,0x8e,0x02,0x01,0xac,0x8e,0x06,0x00,0x04,0x02,0x00,0x20,0x21,
+0x00,0x02,0x10,0x80,0x00,0x47,0x38,0x21,0x94,0xe3,0x00,0x02,0x00,0x49,0x10,0x21,
+0x90,0x45,0x00,0x00,0x00,0x03,0x1a,0x00,0x00,0xc8,0x30,0x21,0x00,0xa3,0x28,0x25,
+0x0c,0x00,0x26,0x69,0xa4,0xc5,0x00,0x2e,0x8e,0x03,0x01,0xac,0x8e,0x07,0x00,0x04,
+0x3c,0x06,0xb0,0x03,0x24,0x65,0x00,0x01,0x28,0xa4,0x00,0x00,0x24,0x62,0x00,0x40,
+0x00,0xa4,0x10,0x0a,0x00,0x02,0x11,0x83,0x00,0x02,0x11,0x80,0x00,0x03,0x18,0x80,
+0x00,0xa2,0x28,0x23,0x00,0x70,0x18,0x21,0xae,0x05,0x01,0xac,0xac,0x67,0x00,0xa8,
+0x34,0xc6,0x00,0x30,0x8c,0xc3,0x00,0x00,0x93,0x82,0x81,0xf0,0x02,0x00,0x20,0x21,
+0x24,0x63,0x00,0x01,0x24,0x42,0x00,0x01,0xac,0xc3,0x00,0x00,0xa3,0x82,0x81,0xf0,
+0x0c,0x00,0x28,0x0b,0x00,0x00,0x00,0x00,0x8f,0xbf,0x00,0x14,0x8f,0xb0,0x00,0x10,
+0x03,0xe0,0x00,0x08,0x27,0xbd,0x00,0x18,0x0c,0x00,0x28,0xa2,0x00,0x00,0x00,0x00,
+0x08,0x00,0x29,0x29,0x00,0x00,0x00,0x00,0x3c,0x02,0xb0,0x03,0x3c,0x03,0x80,0x01,
+0x27,0xbd,0xff,0xd8,0x34,0x42,0x00,0x20,0x24,0x63,0xa5,0xb8,0xaf,0xb2,0x00,0x18,
+0xac,0x43,0x00,0x00,0x3c,0x12,0xb0,0x03,0x3c,0x02,0x80,0x01,0xaf,0xb4,0x00,0x20,
+0xaf,0xb3,0x00,0x1c,0xaf,0xb1,0x00,0x14,0xaf,0xb0,0x00,0x10,0xaf,0xbf,0x00,0x24,
+0x00,0x80,0x80,0x21,0x24,0x54,0xa0,0x14,0x00,0x00,0x88,0x21,0x3c,0x13,0xb0,0x01,
+0x36,0x52,0x00,0xef,0x3c,0x02,0xb0,0x09,0x34,0x42,0x00,0x06,0x90,0x43,0x00,0x00,
+0x8e,0x04,0x00,0x04,0x92,0x02,0x01,0xbb,0x30,0x69,0x00,0xff,0x00,0x04,0x42,0x02,
+0x10,0x40,0x00,0x1e,0x00,0x00,0x38,0x21,0x8e,0x03,0x01,0xa8,0x3c,0x06,0x28,0x38,
+0x34,0xc6,0x00,0x20,0x24,0x64,0x00,0x3d,0x28,0x82,0x00,0x00,0x24,0x63,0x00,0x7c,
+0x00,0x82,0x18,0x0a,0x00,0x03,0x19,0x83,0x00,0x03,0x19,0x80,0x00,0x83,0x20,0x23,
+0x00,0x04,0x10,0x80,0x00,0x50,0x10,0x21,0x8c,0x45,0x00,0xa8,0xae,0x04,0x01,0xac,
+0xae,0x04,0x01,0xa8,0x00,0xb3,0x18,0x21,0xae,0x05,0x00,0x04,0xac,0x66,0x00,0x00,
+0x8e,0x02,0x00,0x04,0x3c,0x03,0x80,0x00,0x34,0x63,0x4e,0x00,0x00,0x53,0x10,0x21,
+0xac,0x43,0x00,0x04,0xa2,0x00,0x01,0xbb,0x93,0x83,0x81,0xf7,0x00,0x00,0x00,0x00,
+0x24,0x62,0x00,0x01,0xa3,0x82,0x81,0xf7,0xa2,0x43,0x00,0x00,0x01,0x28,0x10,0x23,
+0x24,0x44,0x00,0x40,0x28,0x83,0x00,0x00,0x24,0x42,0x00,0x7f,0x00,0x83,0x10,0x0a,
+0x00,0x02,0x11,0x83,0x00,0x02,0x11,0x80,0x24,0x84,0xff,0xff,0x10,0x44,0x00,0x6b,
+0x3c,0x02,0xb0,0x01,0x8e,0x03,0x00,0x04,0x3c,0x04,0x7c,0x00,0x00,0x62,0x18,0x21,
+0x8c,0x65,0x00,0x04,0x34,0x84,0x00,0xf0,0x00,0x00,0x30,0x21,0xae,0x05,0x00,0x44,
+0x00,0xa4,0x20,0x24,0x8c,0x63,0x00,0x00,0x10,0x80,0x00,0x6b,0x3c,0x02,0xff,0xff,
+0x3c,0x09,0xb0,0x03,0x3c,0x05,0x7c,0x00,0x35,0x29,0x00,0x99,0x3c,0x0a,0xb0,0x01,
+0x24,0x08,0x00,0x40,0x34,0xa5,0x00,0xf0,0x3c,0x0b,0xff,0xff,0x3c,0x0c,0x28,0x38,
+0x16,0x20,0x00,0x06,0x24,0xe7,0x00,0x01,0x93,0x82,0x81,0xf6,0x24,0x11,0x00,0x01,
+0x24,0x42,0x00,0x01,0xa1,0x22,0x00,0x00,0xa3,0x82,0x81,0xf6,0x8e,0x02,0x00,0x04,
+0x24,0x06,0x00,0x01,0x24,0x42,0x01,0x00,0x30,0x42,0x3f,0xff,0xae,0x02,0x00,0x04,
+0x00,0x4a,0x10,0x21,0x8c,0x43,0x00,0x04,0x00,0x00,0x00,0x00,0xae,0x03,0x00,0x44,
+0x00,0x65,0x20,0x24,0x8c,0x43,0x00,0x00,0x10,0xe8,0x00,0x2d,0x00,0x00,0x00,0x00,
+0x14,0x80,0xff,0xeb,0x00,0x6b,0x10,0x24,0x14,0x4c,0xff,0xe9,0x24,0x02,0x00,0x01,
+0x10,0xc2,0x00,0x30,0x3c,0x03,0xb0,0x09,0x8e,0x02,0x00,0x44,0x8e,0x04,0x00,0x60,
+0x00,0x02,0x1e,0x42,0x00,0x02,0x12,0x02,0x30,0x42,0x00,0x0f,0x30,0x63,0x00,0x01,
+0xae,0x02,0x00,0x00,0x10,0x44,0x00,0x1a,0xae,0x03,0x00,0x58,0x8e,0x02,0x00,0x64,
+0x8e,0x04,0x00,0x58,0x00,0x00,0x00,0x00,0x10,0x82,0x00,0x05,0x00,0x00,0x00,0x00,
+0xae,0x00,0x00,0x4c,0xae,0x00,0x00,0x50,0xae,0x00,0x00,0x54,0xae,0x00,0x00,0x0c,
+0x8e,0x03,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x03,0x10,0x80,0x00,0x50,0x10,0x21,
+0x8c,0x42,0x00,0x68,0x00,0x00,0x00,0x00,0x10,0x54,0x00,0x06,0x00,0x00,0x00,0x00,
+0x00,0x40,0xf8,0x09,0x02,0x00,0x20,0x21,0x8e,0x04,0x00,0x58,0x8e,0x03,0x00,0x00,
+0x00,0x00,0x00,0x00,0xae,0x03,0x00,0x60,0x08,0x00,0x29,0x81,0xae,0x04,0x00,0x64,
+0x8e,0x02,0x00,0x64,0x00,0x00,0x00,0x00,0x14,0x62,0xff,0xe5,0x00,0x00,0x00,0x00,
+0x7a,0x02,0x0d,0x7c,0x8f,0xbf,0x00,0x24,0x8f,0xb4,0x00,0x20,0x7b,0xb2,0x00,0xfc,
+0x7b,0xb0,0x00,0xbc,0x00,0x43,0x10,0x26,0x00,0x02,0x10,0x2b,0x03,0xe0,0x00,0x08,
+0x27,0xbd,0x00,0x28,0x8e,0x04,0x00,0x04,0x34,0x63,0x00,0x06,0x90,0x62,0x00,0x00,
+0x00,0x04,0x42,0x02,0x00,0x48,0x10,0x23,0x24,0x44,0x00,0x40,0x28,0x83,0x00,0x00,
+0x24,0x42,0x00,0x7f,0x00,0x83,0x10,0x0a,0x00,0x02,0x11,0x83,0x00,0x02,0x11,0x80,
+0x00,0x82,0x20,0x23,0x14,0x86,0xff,0xc4,0x00,0x00,0x00,0x00,0x8e,0x03,0x00,0x00,
+0x00,0x00,0x00,0x00,0x2c,0x62,0x00,0x03,0x14,0x40,0x00,0x05,0x24,0x02,0x00,0x0d,
+0x10,0x62,0x00,0x03,0x24,0x02,0x00,0x01,0x08,0x00,0x2a,0x04,0xa2,0x02,0x00,0x5c,
+0x08,0x00,0x2a,0x04,0xa2,0x00,0x00,0x5c,0x00,0x62,0x10,0x24,0x3c,0x03,0x28,0x38,
+0x14,0x43,0xff,0x93,0x24,0x02,0x00,0x01,0x08,0x00,0x29,0xdc,0x00,0x00,0x00,0x00,
+0x3c,0x02,0xb0,0x01,0x00,0xa2,0x40,0x21,0x00,0xa0,0x48,0x21,0x8d,0x05,0x00,0x00,
+0x24,0x02,0xc0,0x00,0x00,0x09,0x38,0xc2,0x00,0xa2,0x28,0x24,0x24,0xc2,0xff,0xff,
+0x00,0x07,0x3a,0x00,0x3c,0x0a,0xb0,0x06,0x3c,0x03,0x00,0x80,0x00,0xa6,0x28,0x25,
+0x2c,0x42,0x1f,0xff,0x00,0xe3,0x38,0x25,0x35,0x4a,0x80,0x18,0x10,0x40,0x00,0x0e,
+0xad,0x05,0x00,0x00,0xaf,0x89,0xbc,0x10,0x8d,0x02,0x00,0x00,0x00,0x00,0x00,0x00,
+0xaf,0x82,0xbc,0x18,0x8d,0x03,0x00,0x04,0xad,0x47,0x00,0x00,0xaf,0x83,0xbc,0x14,
+0xac,0x80,0x01,0xd0,0xac,0x80,0x01,0xc4,0xa0,0x80,0x01,0xc0,0xa0,0x80,0x01,0xc1,
+0xac,0x80,0x01,0xc8,0xac,0x80,0x01,0xcc,0x03,0xe0,0x00,0x08,0x00,0x00,0x00,0x00,
+0x27,0xbd,0xff,0xe8,0xaf,0xbf,0x00,0x10,0x8c,0x83,0x01,0xc4,0x00,0x80,0x38,0x21,
+0x90,0x84,0x01,0xc0,0x00,0x03,0x18,0x80,0x00,0x67,0x18,0x21,0x8c,0x65,0x00,0xa8,
+0x3c,0x02,0xb0,0x01,0x24,0x03,0x00,0x01,0x00,0xa2,0x10,0x21,0x8c,0x42,0x00,0x00,
+0x10,0x83,0x00,0x18,0x00,0x02,0x14,0x02,0x8c,0xe9,0x01,0xcc,0x8c,0xea,0x01,0xc8,
+0x30,0x46,0x00,0xff,0x01,0x2a,0x18,0x21,0x30,0x64,0x00,0xff,0x00,0x03,0x1a,0x02,
+0x24,0x62,0x00,0x01,0x14,0x80,0x00,0x02,0x30,0x48,0x00,0xff,0x30,0x68,0x00,0xff,
+0x90,0xe2,0x01,0xc1,0x00,0x00,0x00,0x00,0x00,0x48,0x10,0x23,0x00,0x02,0x12,0x00,
+0x00,0x49,0x10,0x21,0x00,0x4a,0x10,0x21,0x00,0x46,0x30,0x23,0x0c,0x00,0x2a,0x2c,
+0x00,0xe0,0x20,0x21,0x8f,0xbf,0x00,0x10,0x00,0x00,0x00,0x00,0x03,0xe0,0x00,0x08,
+0x27,0xbd,0x00,0x18,0x8c,0xe6,0x01,0xc8,0x08,0x00,0x2a,0x6b,0x00,0x00,0x00,0x00,
+0x27,0xbd,0xff,0xe8,0xaf,0xbf,0x00,0x14,0xaf,0xb0,0x00,0x10,0x8c,0x82,0x01,0xc4,
+0x90,0x87,0x01,0xc1,0x00,0x80,0x80,0x21,0x00,0x02,0x10,0x80,0x00,0x44,0x10,0x21,
+0x8c,0x48,0x00,0xa8,0x3c,0x02,0xb0,0x01,0x00,0x07,0x3a,0x00,0x01,0x02,0x10,0x21,
+0x8c,0x43,0x00,0x00,0x00,0xe5,0x38,0x21,0x00,0xe6,0x38,0x21,0x00,0x03,0x1c,0x02,
+0x30,0x63,0x00,0xff,0x00,0xe3,0x38,0x23,0x01,0x00,0x28,0x21,0x0c,0x00,0x2a,0x2c,
+0x00,0xe0,0x30,0x21,0x8e,0x02,0x01,0xa8,0x8f,0xbf,0x00,0x14,0x24,0x44,0x00,0x01,
+0x28,0x83,0x00,0x00,0x24,0x42,0x00,0x40,0x00,0x83,0x10,0x0a,0x00,0x02,0x11,0x83,
+0x00,0x02,0x11,0x80,0x00,0x82,0x20,0x23,0xae,0x04,0x01,0xa8,0x8f,0xb0,0x00,0x10,
+0x03,0xe0,0x00,0x08,0x27,0xbd,0x00,0x18,0x3c,0x02,0xb0,0x03,0x3c,0x03,0x80,0x01,
+0x27,0xbd,0xff,0xe8,0x34,0x42,0x00,0x20,0x24,0x63,0xaa,0x58,0xaf,0xb0,0x00,0x10,
+0xaf,0xbf,0x00,0x14,0xac,0x43,0x00,0x00,0x90,0x82,0x01,0xd4,0x00,0x00,0x00,0x00,
+0x14,0x40,0x00,0x6a,0x00,0x80,0x80,0x21,0x90,0x82,0x01,0xc0,0x00,0x00,0x00,0x00,
+0x14,0x40,0x00,0x61,0x00,0x00,0x00,0x00,0x8c,0x83,0x01,0xa8,0x8c,0x82,0x01,0xac,
+0x00,0x00,0x00,0x00,0x10,0x62,0x00,0x22,0x00,0x00,0x28,0x21,0x93,0x82,0x81,0xf1,
+0x00,0x03,0x30,0x80,0x00,0xc4,0x18,0x21,0x24,0x04,0x00,0x01,0x8c,0x67,0x00,0xa8,
+0x10,0x44,0x00,0x20,0x3c,0x04,0xb0,0x01,0xaf,0x87,0xbc,0x10,0x00,0xe4,0x20,0x21,
+0x8c,0x86,0x00,0x00,0x00,0x07,0x18,0xc2,0x3c,0x02,0x00,0x80,0xaf,0x86,0xbc,0x18,
+0x8c,0x86,0x00,0x04,0x00,0x03,0x1a,0x00,0x3c,0x05,0xb0,0x06,0x00,0x62,0x18,0x25,
+0x34,0xa5,0x80,0x18,0xac,0xa3,0x00,0x00,0x8e,0x02,0x01,0xa8,0x8e,0x09,0x01,0xac,
+0xaf,0x86,0xbc,0x14,0x24,0x44,0x00,0x01,0x28,0x83,0x00,0x00,0x24,0x42,0x00,0x40,
+0x00,0x83,0x10,0x0a,0x00,0x02,0x11,0x83,0x00,0x02,0x11,0x80,0x00,0x82,0x20,0x23,
+0x00,0x80,0x30,0x21,0xae,0x04,0x01,0xa8,0x00,0xc9,0x10,0x26,0x00,0x02,0x28,0x2b,
+0x8f,0xbf,0x00,0x14,0x8f,0xb0,0x00,0x10,0x00,0xa0,0x10,0x21,0x03,0xe0,0x00,0x08,
+0x27,0xbd,0x00,0x18,0x93,0x82,0x81,0xf0,0x00,0x00,0x00,0x00,0x2c,0x42,0x00,0x02,
+0x14,0x40,0xff,0xf7,0x00,0x00,0x28,0x21,0x3c,0x05,0xb0,0x01,0x00,0xe5,0x28,0x21,
+0x27,0x83,0x89,0x58,0x00,0xc3,0x18,0x21,0x8c,0xa6,0x00,0x00,0x8c,0x64,0x00,0x00,
+0x24,0x02,0xc0,0x00,0x00,0xc2,0x10,0x24,0x00,0x44,0x10,0x25,0xac,0xa2,0x00,0x00,
+0x8e,0x03,0x01,0xa8,0x27,0x84,0x8a,0x58,0x8c,0xa6,0x00,0x04,0x00,0x03,0x18,0x80,
+0x00,0x64,0x18,0x21,0x8c,0x62,0x00,0x00,0x3c,0x03,0x80,0x00,0x00,0x07,0x20,0xc2,
+0x00,0xc2,0x10,0x25,0x00,0x43,0x10,0x25,0xac,0xa2,0x00,0x04,0xaf,0x87,0xbc,0x10,
+0x8c,0xa6,0x00,0x00,0x3c,0x02,0x00,0x80,0x00,0x04,0x22,0x00,0x3c,0x03,0xb0,0x06,
+0xaf,0x86,0xbc,0x18,0x00,0x82,0x20,0x25,0x34,0x63,0x80,0x18,0x8c,0xa6,0x00,0x04,
+0xac,0x64,0x00,0x00,0x8e,0x02,0x01,0xa8,0xaf,0x86,0xbc,0x14,0x24,0x44,0x00,0x01,
+0x28,0x83,0x00,0x00,0x24,0x42,0x00,0x40,0x00,0x83,0x10,0x0a,0x93,0x83,0x81,0xf0,
+0x00,0x02,0x11,0x83,0x00,0x02,0x11,0x80,0x00,0x82,0x20,0x23,0x24,0x63,0xff,0xff,
+0xae,0x04,0x01,0xa8,0xa3,0x83,0x81,0xf0,0x8e,0x04,0x01,0xac,0x8e,0x02,0x01,0xa8,
+0x08,0x00,0x2a,0xcb,0x00,0x44,0x10,0x26,0x0c,0x00,0x2a,0x4c,0x00,0x00,0x00,0x00,
+0x7a,0x02,0x0d,0x7c,0x08,0x00,0x2a,0xcb,0x00,0x43,0x10,0x26,0x8c,0x86,0x01,0xa8,
+0x8c,0x89,0x01,0xac,0x00,0x00,0x00,0x00,0x10,0xc9,0x00,0xb4,0x00,0xc0,0x68,0x21,
+0x00,0x06,0x10,0x80,0x27,0x83,0x89,0x58,0x00,0x43,0x18,0x21,0x00,0x44,0x10,0x21,
+0x8c,0x47,0x00,0xa8,0x94,0x65,0x00,0x02,0x3c,0x02,0xb0,0x01,0x00,0xe2,0x10,0x21,
+0x30,0xa5,0x3f,0xff,0xa4,0x45,0x00,0x2c,0x90,0x8a,0x01,0xc0,0x00,0x00,0x00,0x00,
+0x11,0x40,0x00,0x0c,0x00,0x07,0x32,0x02,0x8c,0x83,0x01,0xc4,0x90,0x85,0x01,0xc1,
+0x00,0x03,0x18,0x80,0x00,0x64,0x18,0x21,0x8c,0x62,0x00,0xa8,0x00,0x00,0x00,0x00,
+0x00,0x02,0x12,0x02,0x00,0x45,0x10,0x21,0x30,0x42,0x00,0x3f,0x14,0xc2,0xff,0xde,
+0x00,0x00,0x00,0x00,0x3c,0x04,0xb0,0x01,0x00,0xe4,0x40,0x21,0x8d,0x06,0x00,0x00,
+0x00,0x0d,0x28,0x80,0x00,0x06,0x14,0x02,0x30,0x4b,0x00,0xff,0x00,0xeb,0x70,0x21,
+0x01,0xc4,0x20,0x21,0x90,0x83,0x00,0x00,0x27,0x82,0x89,0x58,0x00,0xa2,0x28,0x21,
+0x8c,0xa4,0x00,0x00,0x00,0x03,0x18,0x82,0x30,0x63,0x00,0x03,0x2c,0x62,0x00,0x02,
+0x14,0x40,0x00,0x66,0x30,0x8c,0x3f,0xff,0x24,0x02,0x00,0x02,0x10,0x62,0x00,0x61,
+0x2d,0x82,0x08,0x00,0x15,0x40,0x00,0x36,0x01,0x6c,0x10,0x21,0x01,0x6c,0x18,0x21,
+0x30,0x62,0x00,0xff,0x00,0x02,0x10,0x2b,0x00,0x03,0x1a,0x02,0x3c,0x04,0xb0,0x01,
+0x00,0x62,0x18,0x21,0x00,0xe4,0x20,0x21,0x24,0x02,0x00,0x01,0xa2,0x03,0x01,0xc1,
+0xa0,0x82,0x00,0x08,0x8e,0x06,0x01,0xa8,0x3c,0x03,0xb0,0x00,0x34,0x63,0xff,0xf4,
+0x24,0xc5,0x00,0x01,0x28,0xa4,0x00,0x00,0x24,0xc2,0x00,0x40,0x00,0xa4,0x10,0x0a,
+0x01,0xc3,0x18,0x21,0xa4,0x6c,0x00,0x00,0x00,0x02,0x11,0x83,0x00,0x02,0x11,0x80,
+0x92,0x04,0x01,0xc0,0x00,0xa2,0x38,0x23,0x3c,0x03,0xb0,0x03,0xae,0x0b,0x01,0xcc,
+0xae,0x0c,0x01,0xc8,0xae,0x06,0x01,0xc4,0xae,0x07,0x01,0xa8,0x34,0x63,0x01,0x08,
+0x92,0x05,0x01,0xd6,0x8c,0x66,0x00,0x00,0x24,0x84,0x00,0x01,0x30,0x82,0x00,0xff,
+0x00,0x45,0x10,0x2b,0xae,0x06,0x01,0xd0,0x10,0x40,0x00,0x07,0xa2,0x04,0x01,0xc0,
+0x92,0x02,0x01,0xd5,0x92,0x03,0x01,0xc1,0x24,0x42,0xff,0xfc,0x00,0x62,0x18,0x2a,
+0x14,0x60,0x00,0x08,0x00,0x00,0x00,0x00,0x02,0x00,0x20,0x21,0x0c,0x00,0x2a,0x4c,
+0x00,0x00,0x00,0x00,0x8e,0x09,0x01,0xac,0x8e,0x06,0x01,0xa8,0x08,0x00,0x2a,0xcb,
+0x00,0xc9,0x10,0x26,0x8e,0x09,0x01,0xac,0x08,0x00,0x2a,0xca,0x00,0xe0,0x30,0x21,
+0x30,0x43,0x00,0xff,0x92,0x07,0x01,0xc1,0x00,0x02,0x12,0x02,0x30,0x44,0x00,0xff,
+0x38,0x63,0x00,0x00,0x24,0x46,0x00,0x01,0x92,0x05,0x01,0xd5,0x00,0x83,0x30,0x0a,
+0x00,0xc7,0x18,0x21,0x00,0xa3,0x10,0x2a,0x14,0x40,0xff,0xeb,0x00,0x00,0x00,0x00,
+0x24,0xa2,0xff,0xfc,0x00,0x62,0x10,0x2a,0x10,0x40,0x00,0x07,0x01,0x80,0x28,0x21,
+0x92,0x03,0x01,0xd6,0x25,0x42,0x00,0x01,0x00,0x43,0x10,0x2a,0x14,0x40,0x00,0x07,
+0x25,0xa4,0x00,0x01,0x01,0x80,0x28,0x21,0x01,0x60,0x30,0x21,0x0c,0x00,0x2a,0x74,
+0x02,0x00,0x20,0x21,0x08,0x00,0x2b,0x6d,0x00,0x00,0x00,0x00,0x28,0x83,0x00,0x00,
+0x25,0xa2,0x00,0x40,0x00,0x83,0x10,0x0a,0x00,0x02,0x11,0x83,0x00,0x02,0x11,0x80,
+0x00,0x82,0x20,0x23,0x00,0xc7,0x18,0x21,0x25,0x42,0x00,0x01,0x00,0x80,0x30,0x21,
+0xa2,0x03,0x01,0xc1,0xae,0x0b,0x01,0xcc,0xae,0x0c,0x01,0xc8,0x08,0x00,0x2a,0xc9,
+0xa2,0x02,0x01,0xc0,0x14,0x40,0xff,0x9f,0x00,0x00,0x00,0x00,0x15,0x40,0x00,0x14,
+0x24,0x02,0xc0,0x00,0x00,0xc2,0x10,0x24,0x00,0x4c,0x10,0x25,0xad,0x02,0x00,0x00,
+0xaf,0x87,0xbc,0x10,0x8d,0x05,0x00,0x00,0x00,0x07,0x18,0xc2,0x3c,0x02,0x00,0x80,
+0x00,0x03,0x1a,0x00,0x3c,0x04,0xb0,0x06,0xaf,0x85,0xbc,0x18,0x00,0x62,0x18,0x25,
+0x34,0x84,0x80,0x18,0x8d,0x05,0x00,0x04,0xac,0x83,0x00,0x00,0x8e,0x02,0x01,0xa8,
+0x8e,0x09,0x01,0xac,0xaf,0x85,0xbc,0x14,0x08,0x00,0x2a,0xc2,0x24,0x44,0x00,0x01,
+0x01,0x6c,0x10,0x21,0x30,0x45,0x00,0xff,0x92,0x04,0x01,0xc1,0x00,0x02,0x12,0x02,
+0x30,0x46,0x00,0xff,0x38,0xa5,0x00,0x00,0x24,0x42,0x00,0x01,0x92,0x03,0x01,0xd5,
+0x00,0xc5,0x10,0x0a,0x00,0x82,0x20,0x21,0x00,0x64,0x18,0x2a,0x10,0x60,0xff,0xca,
+0x01,0x80,0x28,0x21,0x08,0x00,0x2b,0x6b,0x02,0x00,0x20,0x21,0x90,0x87,0x01,0xc0,
+0x00,0x00,0x00,0x00,0x10,0xe0,0xff,0x06,0x00,0x00,0x28,0x21,0x3c,0x02,0xb0,0x03,
+0x34,0x42,0x01,0x08,0x94,0x83,0x01,0xd8,0x8c,0x88,0x01,0xd0,0x8c,0x45,0x00,0x00,
+0x01,0x03,0x18,0x21,0x00,0xa3,0x10,0x2b,0x10,0x40,0x00,0x0b,0x2c,0xe2,0x00,0x02,
+0x00,0xa8,0x10,0x2b,0x10,0x40,0xfe,0xf9,0x00,0xc9,0x10,0x26,0x3c,0x02,0x80,0x00,
+0x00,0x62,0x18,0x21,0x00,0xa2,0x10,0x21,0x00,0x43,0x10,0x2b,0x14,0x40,0xfe,0xf3,
+0x00,0xc9,0x10,0x26,0x2c,0xe2,0x00,0x02,0x10,0x40,0xff,0x90,0x00,0x00,0x00,0x00,
+0x24,0x02,0x00,0x01,0x14,0xe2,0xfe,0xed,0x00,0xc9,0x10,0x26,0x3c,0x03,0xb0,0x06,
+0x34,0x63,0x80,0x18,0x8c,0x62,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x02,0x17,0x02,
+0x14,0x40,0xfe,0xe5,0x00,0x00,0x00,0x00,0x08,0x00,0x2b,0x6b,0x00,0x00,0x00,0x00,
+0x3c,0x04,0xb0,0x03,0x3c,0x06,0xb0,0x07,0x3c,0x02,0x80,0x01,0x34,0xc6,0x00,0x18,
+0x34,0x84,0x00,0x20,0x24,0x42,0xaf,0xa0,0x24,0x03,0xff,0x83,0xac,0x82,0x00,0x00,
+0xa0,0xc3,0x00,0x00,0x90,0xc4,0x00,0x00,0x27,0xbd,0xff,0xf8,0x3c,0x03,0xb0,0x07,
+0x24,0x02,0xff,0x82,0xa3,0xa4,0x00,0x00,0xa0,0x62,0x00,0x00,0x90,0x64,0x00,0x00,
+0x3c,0x02,0xb0,0x07,0x34,0x42,0x00,0x08,0xa3,0xa4,0x00,0x01,0xa0,0x40,0x00,0x00,
+0x90,0x43,0x00,0x00,0x24,0x02,0x00,0x03,0x3c,0x05,0xb0,0x07,0xa3,0xa3,0x00,0x00,
+0xa0,0xc2,0x00,0x00,0x90,0xc4,0x00,0x00,0x34,0xa5,0x00,0x10,0x24,0x02,0x00,0x06,
+0x3c,0x03,0xb0,0x07,0xa3,0xa4,0x00,0x00,0x34,0x63,0x00,0x38,0xa0,0xa2,0x00,0x00,
+0x90,0x64,0x00,0x00,0x3c,0x02,0xb0,0x07,0x34,0x42,0x00,0x20,0xa3,0xa4,0x00,0x00,
+0xa0,0xa0,0x00,0x00,0x90,0xa3,0x00,0x00,0xaf,0x82,0xbf,0x20,0xa3,0xa3,0x00,0x00,
+0xa0,0x40,0x00,0x00,0x90,0x43,0x00,0x00,0x03,0xe0,0x00,0x08,0x27,0xbd,0x00,0x08,
+};
+
+u8 rtl8190_fwdata_array[] ={
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x00,0x10,0x00,0x08,0x00,
+0x02,0xe9,0x01,0x74,0x02,0xab,0x01,0xc7,0x01,0x55,0x00,0xe4,0x00,0xab,0x00,0x72,
+0x00,0x55,0x00,0x4c,0x00,0x4c,0x00,0x4c,0x00,0x4c,0x00,0x4c,0x02,0x76,0x01,0x3b,
+0x00,0xd2,0x00,0x9e,0x00,0x69,0x00,0x4f,0x00,0x46,0x00,0x3f,0x01,0x3b,0x00,0x9e,
+0x00,0x69,0x00,0x4f,0x00,0x35,0x00,0x27,0x00,0x23,0x00,0x20,0x01,0x2f,0x00,0x98,
+0x00,0x65,0x00,0x4c,0x00,0x33,0x00,0x26,0x00,0x22,0x00,0x1e,0x00,0x98,0x00,0x4c,
+0x00,0x33,0x00,0x26,0x00,0x19,0x00,0x13,0x00,0x11,0x00,0x0f,0x02,0x39,0x01,0x1c,
+0x00,0xbd,0x00,0x8e,0x00,0x5f,0x00,0x47,0x00,0x3f,0x00,0x39,0x01,0x1c,0x00,0x8e,
+0x00,0x5f,0x00,0x47,0x00,0x2f,0x00,0x23,0x00,0x20,0x00,0x1c,0x01,0x11,0x00,0x89,
+0x00,0x5b,0x00,0x44,0x00,0x2e,0x00,0x22,0x00,0x1e,0x00,0x1b,0x00,0x89,0x00,0x44,
+0x00,0x2e,0x00,0x22,0x00,0x17,0x00,0x11,0x00,0x0f,0x00,0x0e,0x02,0xab,0x02,0xab,
+0x02,0x66,0x02,0x66,0x07,0x06,0x06,0x06,0x05,0x06,0x07,0x08,0x04,0x06,0x07,0x08,
+0x09,0x0a,0x0b,0x0b,0x49,0x6e,0x74,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x54,0x4c,
+0x42,0x4d,0x4f,0x44,0x00,0x00,0x00,0x00,0x54,0x4c,0x42,0x4c,0x5f,0x64,0x61,0x74,
+0x61,0x00,0x54,0x4c,0x42,0x53,0x00,0x00,0x00,0x00,0x00,0x00,0x41,0x64,0x45,0x4c,
+0x5f,0x64,0x61,0x74,0x61,0x00,0x41,0x64,0x45,0x53,0x00,0x00,0x00,0x00,0x00,0x00,
+0x45,0x78,0x63,0x43,0x6f,0x64,0x65,0x36,0x00,0x00,0x45,0x78,0x63,0x43,0x6f,0x64,
+0x65,0x37,0x00,0x00,0x53,0x79,0x73,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x42,0x70,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x52,0x49,0x00,0x00,0x00,0x00,0x00,0x00,
+0x00,0x00,0x43,0x70,0x55,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x4f,0x76,0x00,0x00,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x80,0x01,0x0b,0x53,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x08,0x00,0x00,0x00,0x10,0x00,0x00,0x00,0x2c,
+0x00,0x00,0x00,0x58,0x00,0x00,0x00,0x30,0x00,0x00,0x00,0x48,0x00,0x00,0x00,0x60,
+0x00,0x00,0x00,0x90,0x00,0x00,0x00,0xc0,0x00,0x00,0x01,0x20,0x00,0x00,0x01,0x80,
+0x00,0x00,0x01,0xb0,0x00,0x00,0x00,0x34,0x00,0x00,0x00,0x68,0x00,0x00,0x00,0x9c,
+0x00,0x00,0x00,0xd0,0x00,0x00,0x01,0x38,0x00,0x00,0x01,0xa0,0x00,0x00,0x01,0xd4,
+0x00,0x00,0x02,0x08,0x00,0x00,0x00,0x68,0x00,0x00,0x00,0xd0,0x00,0x00,0x01,0x38,
+0x00,0x00,0x01,0xa0,0x00,0x00,0x02,0x6f,0x00,0x00,0x03,0x40,0x00,0x00,0x03,0xa8,
+0x00,0x00,0x04,0x10,0x01,0x01,0x01,0x02,0x01,0x01,0x02,0x02,0x03,0x03,0x04,0x04,
+0x01,0x01,0x02,0x02,0x03,0x03,0x04,0x04,0x02,0x03,0x03,0x04,0x05,0x06,0x07,0x08,
+0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x80,0x00,0x07,0x74,0x80,0x00,0x07,0x88,
+0x80,0x00,0x07,0x88,0x80,0x00,0x07,0x78,0x80,0x00,0x07,0x78,0x80,0x00,0x07,0x9c,
+0x80,0x00,0x53,0xc4,0x80,0x00,0x54,0x24,0x80,0x00,0x54,0x38,0x80,0x00,0x54,0x5c,
+0x80,0x00,0x54,0x68,0x80,0x00,0x54,0xa8,0x80,0x00,0x56,0xa8,0x80,0x00,0x57,0xec,
+0x80,0x00,0x58,0x14,0x80,0x00,0x59,0x0c,0x80,0x00,0x59,0xc4,0x80,0x00,0x5a,0x6c,
+0x80,0x00,0x5a,0xe0,0x80,0x00,0x5b,0xec,0x80,0x00,0x5c,0x24,0x80,0x00,0x5c,0x38,
+0x80,0x00,0x5c,0x4c,0x80,0x00,0x5d,0x40,0x80,0x00,0x5d,0x80,0x80,0x00,0x5e,0x34,
+0x80,0x00,0x5e,0x5c,0x80,0x00,0x56,0x68,0x80,0x00,0x5e,0x78,0x80,0x00,0x88,0xf8,
+0x80,0x00,0x88,0xf8,0x80,0x00,0x88,0xf8,0x80,0x00,0x89,0x2c,0x80,0x00,0x89,0x6c,
+0x80,0x00,0x89,0xa4,0x80,0x00,0x89,0xd4,0x80,0x00,0x8a,0x10,0x80,0x00,0x8a,0x50,
+0x80,0x00,0x8a,0xb8,0x80,0x00,0x8a,0xcc,0x80,0x00,0x8b,0x08,0x80,0x00,0x8b,0x10,
+0x80,0x00,0x8b,0x4c,0x80,0x00,0x8b,0x60,0x80,0x00,0x8b,0x68,0x80,0x00,0x8b,0x70,
+0x80,0x00,0x8b,0x70,0x80,0x00,0x8b,0x70,0x80,0x00,0x8b,0x70,0x80,0x00,0x8a,0x90,
+0x80,0x00,0x8b,0xa0,0x80,0x00,0x8b,0xb4,0x80,0x00,0x88,0x54,0x80,0x00,0x8e,0xc8,
+0x80,0x00,0x8e,0xc8,0x80,0x00,0x8e,0xc8,0x80,0x00,0x8e,0xfc,0x80,0x00,0x8f,0x3c,
+0x80,0x00,0x8f,0x74,0x80,0x00,0x8f,0xa4,0x80,0x00,0x8f,0xe0,0x80,0x00,0x90,0x20,
+0x80,0x00,0x90,0x88,0x80,0x00,0x90,0x9c,0x80,0x00,0x90,0xd8,0x80,0x00,0x90,0xe0,
+0x80,0x00,0x91,0x1c,0x80,0x00,0x91,0x30,0x80,0x00,0x91,0x38,0x80,0x00,0x91,0x40,
+0x80,0x00,0x91,0x40,0x80,0x00,0x91,0x40,0x80,0x00,0x91,0x40,0x80,0x00,0x90,0x60,
+0x80,0x00,0x91,0x70,0x80,0x00,0x91,0x84,0x80,0x00,0x8d,0x00,};
+
+u32 Rtl8192UsbPHY_REGArray[] = {
+0x0, };
+
+u32 Rtl8192UsbPHY_REG_1T2RArray[] = {
+0x800,0x00000000,
+0x804,0x00000001,
+0x808,0x0000fc00,
+0x80c,0x0000001c,
+0x810,0x801010aa,
+0x814,0x008514d0,
+0x818,0x00000040,
+0x81c,0x00000000,
+0x820,0x00000004,
+0x824,0x00690000,
+0x828,0x00000004,
+0x82c,0x00e90000,
+0x830,0x00000004,
+0x834,0x00690000,
+0x838,0x00000004,
+0x83c,0x00e90000,
+0x840,0x00000000,
+0x844,0x00000000,
+0x848,0x00000000,
+0x84c,0x00000000,
+0x850,0x00000000,
+0x854,0x00000000,
+0x858,0x65a965a9,
+0x85c,0x65a965a9,
+0x860,0x001f0010,
+0x864,0x007f0010,
+0x868,0x001f0010,
+0x86c,0x007f0010,
+0x870,0x0f100f70,
+0x874,0x0f100f70,
+0x878,0x00000000,
+0x87c,0x00000000,
+0x880,0x6870e36c,
+0x884,0xe3573600,
+0x888,0x4260c340,
+0x88c,0x0000ff00,
+0x890,0x00000000,
+0x894,0xfffffffe,
+0x898,0x4c42382f,
+0x89c,0x00656056,
+0x8b0,0x00000000,
+0x8e0,0x00000000,
+0x8e4,0x00000000,
+0x900,0x00000000,
+0x904,0x00000023,
+0x908,0x00000000,
+0x90c,0x31121311,
+0xa00,0x00d0c7d8,
+0xa04,0x811f0008,
+0xa08,0x80cd8300,
+0xa0c,0x2e62740f,
+0xa10,0x95009b78,
+0xa14,0x11145008,
+0xa18,0x00881117,
+0xa1c,0x89140fa0,
+0xa20,0x1a1b0000,
+0xa24,0x090e1317,
+0xa28,0x00000204,
+0xa2c,0x00000000,
+0xc00,0x00000040,
+0xc04,0x00005433,
+0xc08,0x000000e4,
+0xc0c,0x6c6c6c6c,
+0xc10,0x08800000,
+0xc14,0x40000100,
+0xc18,0x08000000,
+0xc1c,0x40000100,
+0xc20,0x08000000,
+0xc24,0x40000100,
+0xc28,0x08000000,
+0xc2c,0x40000100,
+0xc30,0x6de9ac44,
+0xc34,0x465c52cd,
+0xc38,0x497f5994,
+0xc3c,0x0a969764,
+0xc40,0x1f7c403f,
+0xc44,0x000100b7,
+0xc48,0xec020000,
+0xc4c,0x00000300,
+0xc50,0x69543420,
+0xc54,0x433c0094,
+0xc58,0x69543420,
+0xc5c,0x433c0094,
+0xc60,0x69543420,
+0xc64,0x433c0094,
+0xc68,0x69543420,
+0xc6c,0x433c0094,
+0xc70,0x2c7f000d,
+0xc74,0x0186175b,
+0xc78,0x0000001f,
+0xc7c,0x00b91612,
+0xc80,0x40000100,
+0xc84,0x20000000,
+0xc88,0x40000100,
+0xc8c,0x20200000,
+0xc90,0x40000100,
+0xc94,0x00000000,
+0xc98,0x40000100,
+0xc9c,0x00000000,
+0xca0,0x00492492,
+0xca4,0x00000000,
+0xca8,0x00000000,
+0xcac,0x00000000,
+0xcb0,0x00000000,
+0xcb4,0x00000000,
+0xcb8,0x00000000,
+0xcbc,0x00492492,
+0xcc0,0x00000000,
+0xcc4,0x00000000,
+0xcc8,0x00000000,
+0xccc,0x00000000,
+0xcd0,0x00000000,
+0xcd4,0x00000000,
+0xcd8,0x64b22427,
+0xcdc,0x00766932,
+0xce0,0x00222222,
+0xd00,0x00000750,
+0xd04,0x00000403,
+0xd08,0x0000907f,
+0xd0c,0x00000001,
+0xd10,0xa0633333,
+0xd14,0x33333c63,
+0xd18,0x6a8f5b6b,
+0xd1c,0x00000000,
+0xd20,0x00000000,
+0xd24,0x00000000,
+0xd28,0x00000000,
+0xd2c,0xcc979975,
+0xd30,0x00000000,
+0xd34,0x00000000,
+0xd38,0x00000000,
+0xd3c,0x00027293,
+0xd40,0x00000000,
+0xd44,0x00000000,
+0xd48,0x00000000,
+0xd4c,0x00000000,
+0xd50,0x6437140a,
+0xd54,0x024dbd02,
+0xd58,0x00000000,
+0xd5c,0x04032064,
+0xe00,0x161a1a1a,
+0xe04,0x12121416,
+0xe08,0x00001800,
+0xe0c,0x00000000,
+0xe10,0x161a1a1a,
+0xe14,0x12121416,
+0xe18,0x161a1a1a,
+0xe1c,0x12121416,
+};
+
+u32 Rtl8192UsbRadioA_Array[] = {
+0x019,0x00000003,
+0x000,0x000000bf,
+0x001,0x00000ee0,
+0x002,0x0000004c,
+0x003,0x000007f1,
+0x004,0x00000975,
+0x005,0x00000c58,
+0x006,0x00000ae6,
+0x007,0x000000ca,
+0x008,0x00000e1c,
+0x009,0x000007f0,
+0x00a,0x000009d0,
+0x00b,0x000001ba,
+0x00c,0x00000240,
+0x00e,0x00000020,
+0x00f,0x00000990,
+0x012,0x00000806,
+0x014,0x000005ab,
+0x015,0x00000f80,
+0x016,0x00000020,
+0x017,0x00000597,
+0x018,0x0000050a,
+0x01a,0x00000f80,
+0x01b,0x00000f5e,
+0x01c,0x00000008,
+0x01d,0x00000607,
+0x01e,0x000006cc,
+0x01f,0x00000000,
+0x020,0x000001a5,
+0x01f,0x00000001,
+0x020,0x00000165,
+0x01f,0x00000002,
+0x020,0x000000c6,
+0x01f,0x00000003,
+0x020,0x00000086,
+0x01f,0x00000004,
+0x020,0x00000046,
+0x01f,0x00000005,
+0x020,0x000001e6,
+0x01f,0x00000006,
+0x020,0x000001a6,
+0x01f,0x00000007,
+0x020,0x00000166,
+0x01f,0x00000008,
+0x020,0x000000c7,
+0x01f,0x00000009,
+0x020,0x00000087,
+0x01f,0x0000000a,
+0x020,0x000000f7,
+0x01f,0x0000000b,
+0x020,0x000000d7,
+0x01f,0x0000000c,
+0x020,0x000000b7,
+0x01f,0x0000000d,
+0x020,0x00000097,
+0x01f,0x0000000e,
+0x020,0x00000077,
+0x01f,0x0000000f,
+0x020,0x00000057,
+0x01f,0x00000010,
+0x020,0x00000037,
+0x01f,0x00000011,
+0x020,0x000000fb,
+0x01f,0x00000012,
+0x020,0x000000db,
+0x01f,0x00000013,
+0x020,0x000000bb,
+0x01f,0x00000014,
+0x020,0x000000ff,
+0x01f,0x00000015,
+0x020,0x000000e3,
+0x01f,0x00000016,
+0x020,0x000000c3,
+0x01f,0x00000017,
+0x020,0x000000a3,
+0x01f,0x00000018,
+0x020,0x00000083,
+0x01f,0x00000019,
+0x020,0x00000063,
+0x01f,0x0000001a,
+0x020,0x00000043,
+0x01f,0x0000001b,
+0x020,0x00000023,
+0x01f,0x0000001c,
+0x020,0x00000003,
+0x01f,0x0000001d,
+0x020,0x000001e3,
+0x01f,0x0000001e,
+0x020,0x000001c3,
+0x01f,0x0000001f,
+0x020,0x000001a3,
+0x01f,0x00000020,
+0x020,0x00000183,
+0x01f,0x00000021,
+0x020,0x00000163,
+0x01f,0x00000022,
+0x020,0x00000143,
+0x01f,0x00000023,
+0x020,0x00000123,
+0x01f,0x00000024,
+0x020,0x00000103,
+0x023,0x00000203,
+0x024,0x00000200,
+0x00b,0x000001ba,
+0x02c,0x000003d7,
+0x02d,0x00000ff0,
+0x000,0x00000037,
+0x004,0x00000160,
+0x007,0x00000080,
+0x002,0x0000088d,
+0x0fe,0x00000000,
+0x0fe,0x00000000,
+0x016,0x00000200,
+0x016,0x00000380,
+0x016,0x00000020,
+0x016,0x000001a0,
+0x000,0x000000bf,
+0x00d,0x0000001f,
+0x00d,0x00000c9f,
+0x002,0x0000004d,
+0x000,0x00000cbf,
+0x004,0x00000975,
+0x007,0x00000700,
+};
+
+u32 Rtl8192UsbRadioB_Array[] = {
+0x019,0x00000003,
+0x000,0x000000bf,
+0x001,0x000006e0,
+0x002,0x0000004c,
+0x003,0x000007f1,
+0x004,0x00000975,
+0x005,0x00000c58,
+0x006,0x00000ae6,
+0x007,0x000000ca,
+0x008,0x00000e1c,
+0x000,0x000000b7,
+0x00a,0x00000850,
+0x000,0x000000bf,
+0x00b,0x000001ba,
+0x00c,0x00000240,
+0x00e,0x00000020,
+0x015,0x00000f80,
+0x016,0x00000020,
+0x017,0x00000597,
+0x018,0x0000050a,
+0x01a,0x00000e00,
+0x01b,0x00000f5e,
+0x01d,0x00000607,
+0x01e,0x000006cc,
+0x00b,0x000001ba,
+0x023,0x00000203,
+0x024,0x00000200,
+0x000,0x00000037,
+0x004,0x00000160,
+0x016,0x00000200,
+0x016,0x00000380,
+0x016,0x00000020,
+0x016,0x000001a0,
+0x00d,0x00000ccc,
+0x000,0x000000bf,
+0x002,0x0000004d,
+0x000,0x00000cbf,
+0x004,0x00000975,
+0x007,0x00000700,
+};
+
+u32 Rtl8192UsbRadioC_Array[] = {
+0x0, };
+
+u32 Rtl8192UsbRadioD_Array[] = {
+0x0, };
+
+u32 Rtl8192UsbMACPHY_Array[] = {
+0x03c,0xffff0000,0x00000f0f,
+0x340,0xffffffff,0x161a1a1a,
+0x344,0xffffffff,0x12121416,
+0x348,0x0000ffff,0x00001818,
+0x12c,0xffffffff,0x04000802,
+0x318,0x00000fff,0x00000100,
+};
+
+u32 Rtl8192UsbMACPHY_Array_PG[] = {
+0x03c,0xffff0000,0x00000f0f,
+0xe00,0xffffffff,0x06090909,
+0xe04,0xffffffff,0x00030306,
+0xe08,0x0000ff00,0x00000000,
+0xe10,0xffffffff,0x0a0c0d0f,
+0xe14,0xffffffff,0x06070809,
+0xe18,0xffffffff,0x0a0c0d0f,
+0xe1c,0xffffffff,0x06070809,
+0x12c,0xffffffff,0x04000802,
+0x318,0x00000fff,0x00000800,
+};
+
+u32 Rtl8192UsbAGCTAB_Array[] = {
+0xc78,0x7d000001,
+0xc78,0x7d010001,
+0xc78,0x7d020001,
+0xc78,0x7d030001,
+0xc78,0x7d040001,
+0xc78,0x7d050001,
+0xc78,0x7c060001,
+0xc78,0x7b070001,
+0xc78,0x7a080001,
+0xc78,0x79090001,
+0xc78,0x780a0001,
+0xc78,0x770b0001,
+0xc78,0x760c0001,
+0xc78,0x750d0001,
+0xc78,0x740e0001,
+0xc78,0x730f0001,
+0xc78,0x72100001,
+0xc78,0x71110001,
+0xc78,0x70120001,
+0xc78,0x6f130001,
+0xc78,0x6e140001,
+0xc78,0x6d150001,
+0xc78,0x6c160001,
+0xc78,0x6b170001,
+0xc78,0x6a180001,
+0xc78,0x69190001,
+0xc78,0x681a0001,
+0xc78,0x671b0001,
+0xc78,0x661c0001,
+0xc78,0x651d0001,
+0xc78,0x641e0001,
+0xc78,0x491f0001,
+0xc78,0x48200001,
+0xc78,0x47210001,
+0xc78,0x46220001,
+0xc78,0x45230001,
+0xc78,0x44240001,
+0xc78,0x43250001,
+0xc78,0x28260001,
+0xc78,0x27270001,
+0xc78,0x26280001,
+0xc78,0x25290001,
+0xc78,0x242a0001,
+0xc78,0x232b0001,
+0xc78,0x222c0001,
+0xc78,0x212d0001,
+0xc78,0x202e0001,
+0xc78,0x0a2f0001,
+0xc78,0x08300001,
+0xc78,0x06310001,
+0xc78,0x05320001,
+0xc78,0x04330001,
+0xc78,0x03340001,
+0xc78,0x02350001,
+0xc78,0x01360001,
+0xc78,0x00370001,
+0xc78,0x00380001,
+0xc78,0x00390001,
+0xc78,0x003a0001,
+0xc78,0x003b0001,
+0xc78,0x003c0001,
+0xc78,0x003d0001,
+0xc78,0x003e0001,
+0xc78,0x003f0001,
+0xc78,0x7d400001,
+0xc78,0x7d410001,
+0xc78,0x7d420001,
+0xc78,0x7d430001,
+0xc78,0x7d440001,
+0xc78,0x7d450001,
+0xc78,0x7c460001,
+0xc78,0x7b470001,
+0xc78,0x7a480001,
+0xc78,0x79490001,
+0xc78,0x784a0001,
+0xc78,0x774b0001,
+0xc78,0x764c0001,
+0xc78,0x754d0001,
+0xc78,0x744e0001,
+0xc78,0x734f0001,
+0xc78,0x72500001,
+0xc78,0x71510001,
+0xc78,0x70520001,
+0xc78,0x6f530001,
+0xc78,0x6e540001,
+0xc78,0x6d550001,
+0xc78,0x6c560001,
+0xc78,0x6b570001,
+0xc78,0x6a580001,
+0xc78,0x69590001,
+0xc78,0x685a0001,
+0xc78,0x675b0001,
+0xc78,0x665c0001,
+0xc78,0x655d0001,
+0xc78,0x645e0001,
+0xc78,0x495f0001,
+0xc78,0x48600001,
+0xc78,0x47610001,
+0xc78,0x46620001,
+0xc78,0x45630001,
+0xc78,0x44640001,
+0xc78,0x43650001,
+0xc78,0x28660001,
+0xc78,0x27670001,
+0xc78,0x26680001,
+0xc78,0x25690001,
+0xc78,0x246a0001,
+0xc78,0x236b0001,
+0xc78,0x226c0001,
+0xc78,0x216d0001,
+0xc78,0x206e0001,
+0xc78,0x0a6f0001,
+0xc78,0x08700001,
+0xc78,0x06710001,
+0xc78,0x05720001,
+0xc78,0x04730001,
+0xc78,0x03740001,
+0xc78,0x02750001,
+0xc78,0x01760001,
+0xc78,0x00770001,
+0xc78,0x00780001,
+0xc78,0x00790001,
+0xc78,0x007a0001,
+0xc78,0x007b0001,
+0xc78,0x007c0001,
+0xc78,0x007d0001,
+0xc78,0x007e0001,
+0xc78,0x007f0001,
+0xc78,0x2e00001e,
+0xc78,0x2e01001e,
+0xc78,0x2e02001e,
+0xc78,0x2e03001e,
+0xc78,0x2e04001e,
+0xc78,0x2e05001e,
+0xc78,0x3006001e,
+0xc78,0x3407001e,
+0xc78,0x3908001e,
+0xc78,0x3c09001e,
+0xc78,0x3f0a001e,
+0xc78,0x420b001e,
+0xc78,0x440c001e,
+0xc78,0x450d001e,
+0xc78,0x460e001e,
+0xc78,0x460f001e,
+0xc78,0x4710001e,
+0xc78,0x4811001e,
+0xc78,0x4912001e,
+0xc78,0x4a13001e,
+0xc78,0x4b14001e,
+0xc78,0x4b15001e,
+0xc78,0x4c16001e,
+0xc78,0x4d17001e,
+0xc78,0x4e18001e,
+0xc78,0x4f19001e,
+0xc78,0x4f1a001e,
+0xc78,0x501b001e,
+0xc78,0x511c001e,
+0xc78,0x521d001e,
+0xc78,0x521e001e,
+0xc78,0x531f001e,
+0xc78,0x5320001e,
+0xc78,0x5421001e,
+0xc78,0x5522001e,
+0xc78,0x5523001e,
+0xc78,0x5624001e,
+0xc78,0x5725001e,
+0xc78,0x5726001e,
+0xc78,0x5827001e,
+0xc78,0x5828001e,
+0xc78,0x5929001e,
+0xc78,0x592a001e,
+0xc78,0x5a2b001e,
+0xc78,0x5b2c001e,
+0xc78,0x5c2d001e,
+0xc78,0x5c2e001e,
+0xc78,0x5d2f001e,
+0xc78,0x5e30001e,
+0xc78,0x5f31001e,
+0xc78,0x6032001e,
+0xc78,0x6033001e,
+0xc78,0x6134001e,
+0xc78,0x6235001e,
+0xc78,0x6336001e,
+0xc78,0x6437001e,
+0xc78,0x6438001e,
+0xc78,0x6539001e,
+0xc78,0x663a001e,
+0xc78,0x673b001e,
+0xc78,0x673c001e,
+0xc78,0x683d001e,
+0xc78,0x693e001e,
+0xc78,0x6a3f001e,
+};
diff --git a/drivers/staging/rtl8192u/r819xU_firmware_img.h b/drivers/staging/rtl8192u/r819xU_firmware_img.h
new file mode 100644
index 000000000000..d9d9515a1e61
--- /dev/null
+++ b/drivers/staging/rtl8192u/r819xU_firmware_img.h
@@ -0,0 +1,35 @@
+#ifndef IMG_H
+#define IMG_H
+
+#define BOOT_ARR_LEN 344
+#define MAIN_ARR_LEN 45136
+#define DATA_ARR_LEN 796
+#define MACPHY_Array_PGLength 30
+#define PHY_REG_1T2RArrayLength 296
+#define AGCTAB_ArrayLength 384
+#define MACPHY_ArrayLength 18
+
+#define RadioA_ArrayLength 246
+#define RadioB_ArrayLength 78
+#define RadioC_ArrayLength 1
+#define RadioD_ArrayLength 1
+#define PHY_REGArrayLength 1
+
+
+extern u8 rtl8190_fwboot_array[BOOT_ARR_LEN];
+extern u8 rtl8190_fwmain_array[MAIN_ARR_LEN];
+extern u8 rtl8190_fwdata_array[DATA_ARR_LEN];
+
+extern u32 Rtl8192UsbPHY_REGArray[];
+extern u32 Rtl8192UsbPHY_REG_1T2RArray[];
+extern u32 Rtl8192UsbRadioA_Array[];
+extern u32 Rtl8192UsbRadioB_Array[];
+extern u32 Rtl8192UsbRadioC_Array[];
+extern u32 Rtl8192UsbRadioD_Array[];
+extern u32 Rtl8192UsbMACPHY_Array[];
+extern u32 Rtl8192UsbMACPHY_Array_PG[];
+extern u32 Rtl8192UsbAGCTAB_Array[];
+
+
+
+#endif
diff --git a/drivers/staging/rtl8192u/r819xU_phy.c b/drivers/staging/rtl8192u/r819xU_phy.c
new file mode 100644
index 000000000000..a3adaedece9a
--- /dev/null
+++ b/drivers/staging/rtl8192u/r819xU_phy.c
@@ -0,0 +1,1777 @@
+#include "r8192U.h"
+#include "r8192U_hw.h"
+#include "r819xU_phy.h"
+#include "r819xU_phyreg.h"
+#include "r8190_rtl8256.h"
+#include "r8192U_dm.h"
+#include "r819xU_firmware_img.h"
+
+#ifdef ENABLE_DOT11D
+#include "dot11d.h"
+#endif
+static u32 RF_CHANNEL_TABLE_ZEBRA[] = {
+	0,
+	0x085c, //2412 1
+	0x08dc, //2417 2
+	0x095c, //2422 3
+	0x09dc, //2427 4
+	0x0a5c, //2432 5
+	0x0adc, //2437 6
+	0x0b5c, //2442 7
+	0x0bdc, //2447 8
+	0x0c5c, //2452 9
+	0x0cdc, //2457 10
+	0x0d5c, //2462 11
+	0x0ddc, //2467 12
+	0x0e5c, //2472 13
+	0x0f72, //2484
+};
+
+
+#define rtl819XPHY_REG_1T2RArray Rtl8192UsbPHY_REG_1T2RArray
+#define rtl819XMACPHY_Array_PG Rtl8192UsbMACPHY_Array_PG
+#define rtl819XMACPHY_Array Rtl8192UsbMACPHY_Array
+#define rtl819XRadioA_Array  Rtl8192UsbRadioA_Array
+#define rtl819XRadioB_Array Rtl8192UsbRadioB_Array
+#define rtl819XRadioC_Array Rtl8192UsbRadioC_Array
+#define rtl819XRadioD_Array Rtl8192UsbRadioD_Array
+#define rtl819XAGCTAB_Array Rtl8192UsbAGCTAB_Array
+
+/******************************************************************************
+ *function:  This function read BB parameters from Header file we gen,
+ *	     and do register read/write
+ *   input:  u32	dwBitMask  //taget bit pos in the addr to be modified
+ *  output:  none
+ *  return:  u32	return the shift bit bit position of the mask
+ * ****************************************************************************/
+u32 rtl8192_CalculateBitShift(u32 dwBitMask)
+{
+	u32 i;
+	for (i=0; i<=31; i++)
+	{
+		if (((dwBitMask>>i)&0x1) == 1)
+			break;
+	}
+	return i;
+}
+/******************************************************************************
+ *function:  This function check different RF type to execute legal judgement. If RF Path is illegal, we will return false.
+ *   input:  none
+ *  output:  none
+ *  return:  0(illegal, false), 1(legal,true)
+ * ***************************************************************************/
+u8 rtl8192_phy_CheckIsLegalRFPath(struct net_device* dev, u32 eRFPath)
+{
+	u8 ret = 1;
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	if (priv->rf_type == RF_2T4R)
+		ret = 0;
+	else if (priv->rf_type == RF_1T2R)
+	{
+		if (eRFPath == RF90_PATH_A || eRFPath == RF90_PATH_B)
+			ret = 1;
+		else if (eRFPath == RF90_PATH_C || eRFPath == RF90_PATH_D)
+			ret = 0;
+	}
+	return ret;
+}
+/******************************************************************************
+ *function:  This function set specific bits to BB register
+ *   input:  net_device dev
+ *           u32	dwRegAddr  //target addr to be modified
+ *           u32	dwBitMask  //taget bit pos in the addr to be modified
+ *           u32	dwData     //value to be write
+ *  output:  none
+ *  return:  none
+ *  notice:
+ * ****************************************************************************/
+void rtl8192_setBBreg(struct net_device* dev, u32 dwRegAddr, u32 dwBitMask, u32 dwData)
+{
+
+	u32 OriginalValue, BitShift, NewValue;
+
+	if(dwBitMask!= bMaskDWord)
+	{//if not "double word" write
+		OriginalValue = read_nic_dword(dev, dwRegAddr);
+		BitShift = rtl8192_CalculateBitShift(dwBitMask);
+		NewValue = (((OriginalValue) & (~dwBitMask)) | (dwData << BitShift));
+		write_nic_dword(dev, dwRegAddr, NewValue);
+	}else
+		write_nic_dword(dev, dwRegAddr, dwData);
+	return;
+}
+/******************************************************************************
+ *function:  This function reads specific bits from BB register
+ *   input:  net_device dev
+ *           u32	dwRegAddr  //target addr to be readback
+ *           u32	dwBitMask  //taget bit pos in the addr to be readback
+ *  output:  none
+ *  return:  u32	Data	//the readback register value
+ *  notice:
+ * ****************************************************************************/
+u32 rtl8192_QueryBBReg(struct net_device* dev, u32 dwRegAddr, u32 dwBitMask)
+{
+	u32 Ret = 0, OriginalValue, BitShift;
+
+	OriginalValue = read_nic_dword(dev, dwRegAddr);
+	BitShift = rtl8192_CalculateBitShift(dwBitMask);
+	Ret =(OriginalValue & dwBitMask) >> BitShift;
+
+	return (Ret);
+}
+static  u32 phy_FwRFSerialRead( struct net_device* dev, RF90_RADIO_PATH_E       eRFPath, u32 Offset  );
+
+static void phy_FwRFSerialWrite( struct net_device* dev, RF90_RADIO_PATH_E       eRFPath, u32  Offset, u32  Data);
+
+/******************************************************************************
+ *function:  This function read register from RF chip
+ *   input:  net_device dev
+ *   	     RF90_RADIO_PATH_E eRFPath //radio path of A/B/C/D
+ *           u32	Offset     //target address to be read
+ *  output:  none
+ *  return:  u32 	readback value
+ *  notice:  There are three types of serial operations:(1) Software serial write.(2)Hardware LSSI-Low Speed Serial Interface.(3)Hardware HSSI-High speed serial write. Driver here need to implement (1) and (2)---need more spec for this information.
+ * ****************************************************************************/
+u32 rtl8192_phy_RFSerialRead(struct net_device* dev, RF90_RADIO_PATH_E eRFPath, u32 Offset)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	u32 ret = 0;
+	u32 NewOffset = 0;
+	BB_REGISTER_DEFINITION_T* pPhyReg = &priv->PHYRegDef[eRFPath];
+	rtl8192_setBBreg(dev, pPhyReg->rfLSSIReadBack, bLSSIReadBackData, 0);
+	//make sure RF register offset is correct
+	Offset &= 0x3f;
+
+	//switch page for 8256 RF IC
+	if (priv->rf_chip == RF_8256)
+	{
+		if (Offset >= 31)
+		{
+			priv->RfReg0Value[eRFPath] |= 0x140;
+			//Switch to Reg_Mode2 for Reg 31-45
+			rtl8192_setBBreg(dev, pPhyReg->rf3wireOffset, bMaskDWord, (priv->RfReg0Value[eRFPath]<<16) );
+			//modify offset
+			NewOffset = Offset -30;
+		}
+		else if (Offset >= 16)
+		{
+			priv->RfReg0Value[eRFPath] |= 0x100;
+			priv->RfReg0Value[eRFPath] &= (~0x40);
+			//Switch to Reg_Mode 1 for Reg16-30
+			rtl8192_setBBreg(dev, pPhyReg->rf3wireOffset, bMaskDWord, (priv->RfReg0Value[eRFPath]<<16) );
+
+			NewOffset = Offset - 15;
+		}
+		else
+			NewOffset = Offset;
+	}
+	else
+	{
+		RT_TRACE((COMP_PHY|COMP_ERR), "check RF type here, need to be 8256\n");
+		NewOffset = Offset;
+	}
+	//put desired read addr to LSSI control Register
+	rtl8192_setBBreg(dev, pPhyReg->rfHSSIPara2, bLSSIReadAddress, NewOffset);
+	//Issue a posedge trigger
+	//
+	rtl8192_setBBreg(dev, pPhyReg->rfHSSIPara2,  bLSSIReadEdge, 0x0);
+	rtl8192_setBBreg(dev, pPhyReg->rfHSSIPara2,  bLSSIReadEdge, 0x1);
+
+
+	// TODO: we should not delay such a  long time. Ask help from SD3
+	msleep(1);
+
+	ret = rtl8192_QueryBBReg(dev, pPhyReg->rfLSSIReadBack, bLSSIReadBackData);
+
+
+	// Switch back to Reg_Mode0;
+	if(priv->rf_chip == RF_8256)
+	{
+		priv->RfReg0Value[eRFPath] &= 0xebf;
+
+		rtl8192_setBBreg(
+			dev,
+			pPhyReg->rf3wireOffset,
+			bMaskDWord,
+			(priv->RfReg0Value[eRFPath] << 16));
+	}
+
+	return ret;
+
+}
+
+/******************************************************************************
+ *function:  This function write data to RF register
+ *   input:  net_device dev
+ *   	     RF90_RADIO_PATH_E eRFPath //radio path of A/B/C/D
+ *           u32	Offset     //target address to be written
+ *           u32	Data	//The new register data to be written
+ *  output:  none
+ *  return:  none
+ *  notice:  For RF8256 only.
+  ===========================================================
+ *Reg Mode	RegCTL[1]	RegCTL[0]		Note
+ *		(Reg00[12])	(Reg00[10])
+ *===========================================================
+ *Reg_Mode0	0		x			Reg 0 ~15(0x0 ~ 0xf)
+ *------------------------------------------------------------------
+ *Reg_Mode1	1		0			Reg 16 ~30(0x1 ~ 0xf)
+ *------------------------------------------------------------------
+ * Reg_Mode2	1		1			Reg 31 ~ 45(0x1 ~ 0xf)
+ *------------------------------------------------------------------
+ * ****************************************************************************/
+void rtl8192_phy_RFSerialWrite(struct net_device* dev, RF90_RADIO_PATH_E eRFPath, u32 Offset, u32 Data)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	u32 DataAndAddr = 0, NewOffset = 0;
+	BB_REGISTER_DEFINITION_T	*pPhyReg = &priv->PHYRegDef[eRFPath];
+
+	Offset &= 0x3f;
+	//spin_lock_irqsave(&priv->rf_lock, flags);
+//	down(&priv->rf_sem);
+	if (priv->rf_chip == RF_8256)
+	{
+
+		if (Offset >= 31)
+		{
+			priv->RfReg0Value[eRFPath] |= 0x140;
+			rtl8192_setBBreg(dev, pPhyReg->rf3wireOffset, bMaskDWord, (priv->RfReg0Value[eRFPath] << 16));
+			NewOffset = Offset - 30;
+		}
+		else if (Offset >= 16)
+		{
+			priv->RfReg0Value[eRFPath] |= 0x100;
+			priv->RfReg0Value[eRFPath] &= (~0x40);
+			rtl8192_setBBreg(dev, pPhyReg->rf3wireOffset, bMaskDWord, (priv->RfReg0Value[eRFPath]<<16));
+			NewOffset = Offset - 15;
+		}
+		else
+			NewOffset = Offset;
+	}
+	else
+	{
+		RT_TRACE((COMP_PHY|COMP_ERR), "check RF type here, need to be 8256\n");
+		NewOffset = Offset;
+	}
+
+	// Put write addr in [5:0]  and write data in [31:16]
+	DataAndAddr = (Data<<16) | (NewOffset&0x3f);
+
+	// Write Operation
+	rtl8192_setBBreg(dev, pPhyReg->rf3wireOffset, bMaskDWord, DataAndAddr);
+
+
+	if(Offset==0x0)
+		priv->RfReg0Value[eRFPath] = Data;
+
+	// Switch back to Reg_Mode0;
+	if(priv->rf_chip == RF_8256)
+	{
+		if(Offset != 0)
+		{
+			priv->RfReg0Value[eRFPath] &= 0xebf;
+			rtl8192_setBBreg(
+				dev,
+				pPhyReg->rf3wireOffset,
+				bMaskDWord,
+				(priv->RfReg0Value[eRFPath] << 16));
+		}
+	}
+	//spin_unlock_irqrestore(&priv->rf_lock, flags);
+//	up(&priv->rf_sem);
+	return;
+}
+
+/******************************************************************************
+ *function:  This function set specific bits to RF register
+ *   input:  net_device dev
+ *   	     RF90_RADIO_PATH_E eRFPath //radio path of A/B/C/D
+ *           u32	RegAddr  //target addr to be modified
+ *           u32	BitMask  //taget bit pos in the addr to be modified
+ *           u32	Data     //value to be write
+ *  output:  none
+ *  return:  none
+ *  notice:
+ * ****************************************************************************/
+void rtl8192_phy_SetRFReg(struct net_device* dev, RF90_RADIO_PATH_E eRFPath, u32 RegAddr, u32 BitMask, u32 Data)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	u32 Original_Value, BitShift, New_Value;
+//	u8	time = 0;
+
+	if (!rtl8192_phy_CheckIsLegalRFPath(dev, eRFPath))
+		return;
+
+	if (priv->Rf_Mode == RF_OP_By_FW)
+	{
+		if (BitMask != bMask12Bits) // RF data is 12 bits only
+		{
+			Original_Value = phy_FwRFSerialRead(dev, eRFPath, RegAddr);
+			BitShift =  rtl8192_CalculateBitShift(BitMask);
+			New_Value = ((Original_Value) & (~BitMask)) | (Data<< BitShift);
+
+			phy_FwRFSerialWrite(dev, eRFPath, RegAddr, New_Value);
+		}else
+			phy_FwRFSerialWrite(dev, eRFPath, RegAddr, Data);
+
+		udelay(200);
+
+	}
+	else
+	{
+		if (BitMask != bMask12Bits) // RF data is 12 bits only
+		{
+			Original_Value = rtl8192_phy_RFSerialRead(dev, eRFPath, RegAddr);
+			BitShift =  rtl8192_CalculateBitShift(BitMask);
+			New_Value = (((Original_Value) & (~BitMask)) | (Data<< BitShift));
+
+			rtl8192_phy_RFSerialWrite(dev, eRFPath, RegAddr, New_Value);
+		}else
+			rtl8192_phy_RFSerialWrite(dev, eRFPath, RegAddr, Data);
+	}
+	return;
+}
+
+/******************************************************************************
+ *function:  This function reads specific bits from RF register
+ *   input:  net_device dev
+ *           u32	RegAddr  //target addr to be readback
+ *           u32	BitMask  //taget bit pos in the addr to be readback
+ *  output:  none
+ *  return:  u32	Data	//the readback register value
+ *  notice:
+ * ****************************************************************************/
+u32 rtl8192_phy_QueryRFReg(struct net_device* dev, RF90_RADIO_PATH_E eRFPath, u32 RegAddr, u32 BitMask)
+{
+	u32 Original_Value, Readback_Value, BitShift;
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+
+	if (!rtl8192_phy_CheckIsLegalRFPath(dev, eRFPath))
+		return 0;
+	if (priv->Rf_Mode == RF_OP_By_FW)
+	{
+		Original_Value = phy_FwRFSerialRead(dev, eRFPath, RegAddr);
+		BitShift =  rtl8192_CalculateBitShift(BitMask);
+		Readback_Value = (Original_Value & BitMask) >> BitShift;
+		udelay(200);
+		return (Readback_Value);
+	}
+	else
+	{
+		Original_Value = rtl8192_phy_RFSerialRead(dev, eRFPath, RegAddr);
+		BitShift =  rtl8192_CalculateBitShift(BitMask);
+		Readback_Value = (Original_Value & BitMask) >> BitShift;
+		return (Readback_Value);
+	}
+}
+/******************************************************************************
+ *function:  We support firmware to execute RF-R/W.
+ *   input:  dev
+ *  output:  none
+ *  return:  none
+ *  notice:
+ * ***************************************************************************/
+static	u32
+phy_FwRFSerialRead(
+	struct net_device* dev,
+	RF90_RADIO_PATH_E	eRFPath,
+	u32				Offset	)
+{
+	u32		retValue = 0;
+	u32		Data = 0;
+	u8		time = 0;
+	//DbgPrint("FW RF CTRL\n\r");
+	/* 2007/11/02 MH Firmware RF Write control. By Francis' suggestion, we can
+	   not execute the scheme in the initial step. Otherwise, RF-R/W will waste
+	   much time. This is only for site survey. */
+	// 1. Read operation need not insert data. bit 0-11
+	//Data &= bMask12Bits;
+	// 2. Write RF register address. Bit 12-19
+	Data |= ((Offset&0xFF)<<12);
+	// 3. Write RF path.  bit 20-21
+	Data |= ((eRFPath&0x3)<<20);
+	// 4. Set RF read indicator. bit 22=0
+	//Data |= 0x00000;
+	// 5. Trigger Fw to operate the command. bit 31
+	Data |= 0x80000000;
+	// 6. We can not execute read operation if bit 31 is 1.
+	while (read_nic_dword(dev, QPNR)&0x80000000)
+	{
+		// If FW can not finish RF-R/W for more than ?? times. We must reset FW.
+		if (time++ < 100)
+		{
+			//DbgPrint("FW not finish RF-R Time=%d\n\r", time);
+			udelay(10);
+		}
+		else
+			break;
+	}
+	// 7. Execute read operation.
+	write_nic_dword(dev, QPNR, Data);
+	// 8. Check if firmawre send back RF content.
+	while (read_nic_dword(dev, QPNR)&0x80000000)
+	{
+		// If FW can not finish RF-R/W for more than ?? times. We must reset FW.
+		if (time++ < 100)
+		{
+			//DbgPrint("FW not finish RF-W Time=%d\n\r", time);
+			udelay(10);
+		}
+		else
+			return	(0);
+	}
+	retValue = read_nic_dword(dev, RF_DATA);
+
+	return	(retValue);
+
+}	/* phy_FwRFSerialRead */
+
+/******************************************************************************
+ *function:  We support firmware to execute RF-R/W.
+ *   input:  dev
+ *  output:  none
+ *  return:  none
+ *  notice:
+ * ***************************************************************************/
+static void
+phy_FwRFSerialWrite(
+		struct net_device* dev,
+		RF90_RADIO_PATH_E	eRFPath,
+		u32				Offset,
+		u32				Data	)
+{
+	u8	time = 0;
+
+	//DbgPrint("N FW RF CTRL RF-%d OF%02x DATA=%03x\n\r", eRFPath, Offset, Data);
+	/* 2007/11/02 MH Firmware RF Write control. By Francis' suggestion, we can
+	   not execute the scheme in the initial step. Otherwise, RF-R/W will waste
+	   much time. This is only for site survey. */
+
+	// 1. Set driver write bit and 12 bit data. bit 0-11
+	//Data &= bMask12Bits;	// Done by uper layer.
+	// 2. Write RF register address. bit 12-19
+	Data |= ((Offset&0xFF)<<12);
+	// 3. Write RF path.  bit 20-21
+	Data |= ((eRFPath&0x3)<<20);
+	// 4. Set RF write indicator. bit 22=1
+	Data |= 0x400000;
+	// 5. Trigger Fw to operate the command. bit 31=1
+	Data |= 0x80000000;
+
+	// 6. Write operation. We can not write if bit 31 is 1.
+	while (read_nic_dword(dev, QPNR)&0x80000000)
+	{
+		// If FW can not finish RF-R/W for more than ?? times. We must reset FW.
+		if (time++ < 100)
+		{
+			//DbgPrint("FW not finish RF-W Time=%d\n\r", time);
+			udelay(10);
+		}
+		else
+			break;
+	}
+	// 7. No matter check bit. We always force the write. Because FW will
+	//    not accept the command.
+	write_nic_dword(dev, QPNR, Data);
+	/* 2007/11/02 MH Acoording to test, we must delay 20us to wait firmware
+	   to finish RF write operation. */
+	/* 2008/01/17 MH We support delay in firmware side now. */
+	//delay_us(20);
+
+}	/* phy_FwRFSerialWrite */
+
+
+/******************************************************************************
+ *function:  This function read BB parameters from Header file we gen,
+ *	     and do register read/write
+ *   input:  dev
+ *  output:  none
+ *  return:  none
+ *  notice:  BB parameters may change all the time, so please make
+ *           sure it has been synced with the newest.
+ * ***************************************************************************/
+void rtl8192_phy_configmac(struct net_device* dev)
+{
+	u32 dwArrayLen = 0, i;
+	u32* pdwArray = NULL;
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+	if(priv->btxpowerdata_readfromEEPORM)
+	{
+		RT_TRACE(COMP_PHY, "Rtl819XMACPHY_Array_PG\n");
+		dwArrayLen = MACPHY_Array_PGLength;
+		pdwArray = rtl819XMACPHY_Array_PG;
+
+	}
+	else
+	{
+		RT_TRACE(COMP_PHY, "Rtl819XMACPHY_Array\n");
+		dwArrayLen = MACPHY_ArrayLength;
+		pdwArray = rtl819XMACPHY_Array;
+	}
+	for(i = 0; i<dwArrayLen; i=i+3){
+		if(pdwArray[i] == 0x318)
+		{
+			pdwArray[i+2] = 0x00000800;
+			//DbgPrint("ptrArray[i], ptrArray[i+1], ptrArray[i+2] = %x, %x, %x\n",
+			//	ptrArray[i], ptrArray[i+1], ptrArray[i+2]);
+		}
+
+		RT_TRACE(COMP_DBG, "The Rtl8190MACPHY_Array[0] is %x Rtl8190MACPHY_Array[1] is %x Rtl8190MACPHY_Array[2] is %x\n",
+				pdwArray[i], pdwArray[i+1], pdwArray[i+2]);
+		rtl8192_setBBreg(dev, pdwArray[i], pdwArray[i+1], pdwArray[i+2]);
+	}
+	return;
+
+}
+
+/******************************************************************************
+ *function:  This function do dirty work
+ *   input:  dev
+ *  output:  none
+ *  return:  none
+ *  notice:  BB parameters may change all the time, so please make
+ *           sure it has been synced with the newest.
+ * ***************************************************************************/
+
+void rtl8192_phyConfigBB(struct net_device* dev, u8 ConfigType)
+{
+	u32 i;
+
+#ifdef TO_DO_LIST
+	u32 *rtl8192PhyRegArrayTable = NULL, *rtl8192AgcTabArrayTable = NULL;
+	if(Adapter->bInHctTest)
+	{
+		PHY_REGArrayLen = PHY_REGArrayLengthDTM;
+		AGCTAB_ArrayLen = AGCTAB_ArrayLengthDTM;
+		Rtl8190PHY_REGArray_Table = Rtl819XPHY_REGArrayDTM;
+		Rtl8190AGCTAB_Array_Table = Rtl819XAGCTAB_ArrayDTM;
+	}
+#endif
+	if (ConfigType == BaseBand_Config_PHY_REG)
+	{
+		for (i=0; i<PHY_REG_1T2RArrayLength; i+=2)
+		{
+			rtl8192_setBBreg(dev, rtl819XPHY_REG_1T2RArray[i], bMaskDWord, rtl819XPHY_REG_1T2RArray[i+1]);
+			RT_TRACE(COMP_DBG, "i: %x, The Rtl819xUsbPHY_REGArray[0] is %x Rtl819xUsbPHY_REGArray[1] is %x \n",i, rtl819XPHY_REG_1T2RArray[i], rtl819XPHY_REG_1T2RArray[i+1]);
+		}
+	}
+	else if (ConfigType == BaseBand_Config_AGC_TAB)
+	{
+		for (i=0; i<AGCTAB_ArrayLength; i+=2)
+		{
+			rtl8192_setBBreg(dev, rtl819XAGCTAB_Array[i], bMaskDWord, rtl819XAGCTAB_Array[i+1]);
+			RT_TRACE(COMP_DBG, "i:%x, The rtl819XAGCTAB_Array[0] is %x rtl819XAGCTAB_Array[1] is %x \n",i, rtl819XAGCTAB_Array[i], rtl819XAGCTAB_Array[i+1]);
+		}
+	}
+	return;
+
+
+}
+/******************************************************************************
+ *function:  This function initialize Register definition offset for Radio Path
+ *	     A/B/C/D
+ *   input:  net_device dev
+ *  output:  none
+ *  return:  none
+ *  notice:  Initialization value here is constant and it should never be changed
+ * ***************************************************************************/
+void rtl8192_InitBBRFRegDef(struct net_device* dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+// RF Interface Sowrtware Control
+	priv->PHYRegDef[RF90_PATH_A].rfintfs = rFPGA0_XAB_RFInterfaceSW; // 16 LSBs if read 32-bit from 0x870
+	priv->PHYRegDef[RF90_PATH_B].rfintfs = rFPGA0_XAB_RFInterfaceSW; // 16 MSBs if read 32-bit from 0x870 (16-bit for 0x872)
+	priv->PHYRegDef[RF90_PATH_C].rfintfs = rFPGA0_XCD_RFInterfaceSW;// 16 LSBs if read 32-bit from 0x874
+	priv->PHYRegDef[RF90_PATH_D].rfintfs = rFPGA0_XCD_RFInterfaceSW;// 16 MSBs if read 32-bit from 0x874 (16-bit for 0x876)
+
+	// RF Interface Readback Value
+	priv->PHYRegDef[RF90_PATH_A].rfintfi = rFPGA0_XAB_RFInterfaceRB; // 16 LSBs if read 32-bit from 0x8E0
+	priv->PHYRegDef[RF90_PATH_B].rfintfi = rFPGA0_XAB_RFInterfaceRB;// 16 MSBs if read 32-bit from 0x8E0 (16-bit for 0x8E2)
+	priv->PHYRegDef[RF90_PATH_C].rfintfi = rFPGA0_XCD_RFInterfaceRB;// 16 LSBs if read 32-bit from 0x8E4
+	priv->PHYRegDef[RF90_PATH_D].rfintfi = rFPGA0_XCD_RFInterfaceRB;// 16 MSBs if read 32-bit from 0x8E4 (16-bit for 0x8E6)
+
+	// RF Interface Output (and Enable)
+	priv->PHYRegDef[RF90_PATH_A].rfintfo = rFPGA0_XA_RFInterfaceOE; // 16 LSBs if read 32-bit from 0x860
+	priv->PHYRegDef[RF90_PATH_B].rfintfo = rFPGA0_XB_RFInterfaceOE; // 16 LSBs if read 32-bit from 0x864
+	priv->PHYRegDef[RF90_PATH_C].rfintfo = rFPGA0_XC_RFInterfaceOE;// 16 LSBs if read 32-bit from 0x868
+	priv->PHYRegDef[RF90_PATH_D].rfintfo = rFPGA0_XD_RFInterfaceOE;// 16 LSBs if read 32-bit from 0x86C
+
+	// RF Interface (Output and)  Enable
+	priv->PHYRegDef[RF90_PATH_A].rfintfe = rFPGA0_XA_RFInterfaceOE; // 16 MSBs if read 32-bit from 0x860 (16-bit for 0x862)
+	priv->PHYRegDef[RF90_PATH_B].rfintfe = rFPGA0_XB_RFInterfaceOE; // 16 MSBs if read 32-bit from 0x864 (16-bit for 0x866)
+	priv->PHYRegDef[RF90_PATH_C].rfintfe = rFPGA0_XC_RFInterfaceOE;// 16 MSBs if read 32-bit from 0x86A (16-bit for 0x86A)
+	priv->PHYRegDef[RF90_PATH_D].rfintfe = rFPGA0_XD_RFInterfaceOE;// 16 MSBs if read 32-bit from 0x86C (16-bit for 0x86E)
+
+	//Addr of LSSI. Wirte RF register by driver
+	priv->PHYRegDef[RF90_PATH_A].rf3wireOffset = rFPGA0_XA_LSSIParameter; //LSSI Parameter
+	priv->PHYRegDef[RF90_PATH_B].rf3wireOffset = rFPGA0_XB_LSSIParameter;
+	priv->PHYRegDef[RF90_PATH_C].rf3wireOffset = rFPGA0_XC_LSSIParameter;
+	priv->PHYRegDef[RF90_PATH_D].rf3wireOffset = rFPGA0_XD_LSSIParameter;
+
+	// RF parameter
+	priv->PHYRegDef[RF90_PATH_A].rfLSSI_Select = rFPGA0_XAB_RFParameter;  //BB Band Select
+	priv->PHYRegDef[RF90_PATH_B].rfLSSI_Select = rFPGA0_XAB_RFParameter;
+	priv->PHYRegDef[RF90_PATH_C].rfLSSI_Select = rFPGA0_XCD_RFParameter;
+	priv->PHYRegDef[RF90_PATH_D].rfLSSI_Select = rFPGA0_XCD_RFParameter;
+
+	// Tx AGC Gain Stage (same for all path. Should we remove this?)
+	priv->PHYRegDef[RF90_PATH_A].rfTxGainStage = rFPGA0_TxGainStage; //Tx gain stage
+	priv->PHYRegDef[RF90_PATH_B].rfTxGainStage = rFPGA0_TxGainStage; //Tx gain stage
+	priv->PHYRegDef[RF90_PATH_C].rfTxGainStage = rFPGA0_TxGainStage; //Tx gain stage
+	priv->PHYRegDef[RF90_PATH_D].rfTxGainStage = rFPGA0_TxGainStage; //Tx gain stage
+
+	// Tranceiver A~D HSSI Parameter-1
+	priv->PHYRegDef[RF90_PATH_A].rfHSSIPara1 = rFPGA0_XA_HSSIParameter1;  //wire control parameter1
+	priv->PHYRegDef[RF90_PATH_B].rfHSSIPara1 = rFPGA0_XB_HSSIParameter1;  //wire control parameter1
+	priv->PHYRegDef[RF90_PATH_C].rfHSSIPara1 = rFPGA0_XC_HSSIParameter1;  //wire control parameter1
+	priv->PHYRegDef[RF90_PATH_D].rfHSSIPara1 = rFPGA0_XD_HSSIParameter1;  //wire control parameter1
+
+	// Tranceiver A~D HSSI Parameter-2
+	priv->PHYRegDef[RF90_PATH_A].rfHSSIPara2 = rFPGA0_XA_HSSIParameter2;  //wire control parameter2
+	priv->PHYRegDef[RF90_PATH_B].rfHSSIPara2 = rFPGA0_XB_HSSIParameter2;  //wire control parameter2
+	priv->PHYRegDef[RF90_PATH_C].rfHSSIPara2 = rFPGA0_XC_HSSIParameter2;  //wire control parameter2
+	priv->PHYRegDef[RF90_PATH_D].rfHSSIPara2 = rFPGA0_XD_HSSIParameter2;  //wire control parameter1
+
+	// RF switch Control
+	priv->PHYRegDef[RF90_PATH_A].rfSwitchControl = rFPGA0_XAB_SwitchControl; //TR/Ant switch control
+	priv->PHYRegDef[RF90_PATH_B].rfSwitchControl = rFPGA0_XAB_SwitchControl;
+	priv->PHYRegDef[RF90_PATH_C].rfSwitchControl = rFPGA0_XCD_SwitchControl;
+	priv->PHYRegDef[RF90_PATH_D].rfSwitchControl = rFPGA0_XCD_SwitchControl;
+
+	// AGC control 1
+	priv->PHYRegDef[RF90_PATH_A].rfAGCControl1 = rOFDM0_XAAGCCore1;
+	priv->PHYRegDef[RF90_PATH_B].rfAGCControl1 = rOFDM0_XBAGCCore1;
+	priv->PHYRegDef[RF90_PATH_C].rfAGCControl1 = rOFDM0_XCAGCCore1;
+	priv->PHYRegDef[RF90_PATH_D].rfAGCControl1 = rOFDM0_XDAGCCore1;
+
+	// AGC control 2
+	priv->PHYRegDef[RF90_PATH_A].rfAGCControl2 = rOFDM0_XAAGCCore2;
+	priv->PHYRegDef[RF90_PATH_B].rfAGCControl2 = rOFDM0_XBAGCCore2;
+	priv->PHYRegDef[RF90_PATH_C].rfAGCControl2 = rOFDM0_XCAGCCore2;
+	priv->PHYRegDef[RF90_PATH_D].rfAGCControl2 = rOFDM0_XDAGCCore2;
+
+	// RX AFE control 1
+	priv->PHYRegDef[RF90_PATH_A].rfRxIQImbalance = rOFDM0_XARxIQImbalance;
+	priv->PHYRegDef[RF90_PATH_B].rfRxIQImbalance = rOFDM0_XBRxIQImbalance;
+	priv->PHYRegDef[RF90_PATH_C].rfRxIQImbalance = rOFDM0_XCRxIQImbalance;
+	priv->PHYRegDef[RF90_PATH_D].rfRxIQImbalance = rOFDM0_XDRxIQImbalance;
+
+	// RX AFE control 1
+	priv->PHYRegDef[RF90_PATH_A].rfRxAFE = rOFDM0_XARxAFE;
+	priv->PHYRegDef[RF90_PATH_B].rfRxAFE = rOFDM0_XBRxAFE;
+	priv->PHYRegDef[RF90_PATH_C].rfRxAFE = rOFDM0_XCRxAFE;
+	priv->PHYRegDef[RF90_PATH_D].rfRxAFE = rOFDM0_XDRxAFE;
+
+	// Tx AFE control 1
+	priv->PHYRegDef[RF90_PATH_A].rfTxIQImbalance = rOFDM0_XATxIQImbalance;
+	priv->PHYRegDef[RF90_PATH_B].rfTxIQImbalance = rOFDM0_XBTxIQImbalance;
+	priv->PHYRegDef[RF90_PATH_C].rfTxIQImbalance = rOFDM0_XCTxIQImbalance;
+	priv->PHYRegDef[RF90_PATH_D].rfTxIQImbalance = rOFDM0_XDTxIQImbalance;
+
+	// Tx AFE control 2
+	priv->PHYRegDef[RF90_PATH_A].rfTxAFE = rOFDM0_XATxAFE;
+	priv->PHYRegDef[RF90_PATH_B].rfTxAFE = rOFDM0_XBTxAFE;
+	priv->PHYRegDef[RF90_PATH_C].rfTxAFE = rOFDM0_XCTxAFE;
+	priv->PHYRegDef[RF90_PATH_D].rfTxAFE = rOFDM0_XDTxAFE;
+
+	// Tranceiver LSSI Readback
+	priv->PHYRegDef[RF90_PATH_A].rfLSSIReadBack = rFPGA0_XA_LSSIReadBack;
+	priv->PHYRegDef[RF90_PATH_B].rfLSSIReadBack = rFPGA0_XB_LSSIReadBack;
+	priv->PHYRegDef[RF90_PATH_C].rfLSSIReadBack = rFPGA0_XC_LSSIReadBack;
+	priv->PHYRegDef[RF90_PATH_D].rfLSSIReadBack = rFPGA0_XD_LSSIReadBack;
+
+}
+/******************************************************************************
+ *function:  This function is to write register and then readback to make sure whether BB and RF is OK
+ *   input:  net_device dev
+ *   	     HW90_BLOCK_E CheckBlock
+ *   	     RF90_RADIO_PATH_E eRFPath  //only used when checkblock is HW90_BLOCK_RF
+ *  output:  none
+ *  return:  return whether BB and RF is ok(0:OK; 1:Fail)
+ *  notice:  This function may be removed in the ASIC
+ * ***************************************************************************/
+u8 rtl8192_phy_checkBBAndRF(struct net_device* dev, HW90_BLOCK_E CheckBlock, RF90_RADIO_PATH_E eRFPath)
+{
+//	struct r8192_priv *priv = ieee80211_priv(dev);
+//	BB_REGISTER_DEFINITION_T *pPhyReg = &priv->PHYRegDef[eRFPath];
+	u8 ret = 0;
+	u32 i, CheckTimes = 4, dwRegRead = 0;
+	u32 WriteAddr[4];
+	u32 WriteData[] = {0xfffff027, 0xaa55a02f, 0x00000027, 0x55aa502f};
+	// Initialize register address offset to be checked
+	WriteAddr[HW90_BLOCK_MAC] = 0x100;
+	WriteAddr[HW90_BLOCK_PHY0] = 0x900;
+	WriteAddr[HW90_BLOCK_PHY1] = 0x800;
+	WriteAddr[HW90_BLOCK_RF] = 0x3;
+	RT_TRACE(COMP_PHY, "=======>%s(), CheckBlock:%d\n", __FUNCTION__, CheckBlock);
+	for(i=0 ; i < CheckTimes ; i++)
+	{
+
+		//
+		// Write Data to register and readback
+		//
+		switch(CheckBlock)
+		{
+		case HW90_BLOCK_MAC:
+			RT_TRACE(COMP_ERR, "PHY_CheckBBRFOK(): Never Write 0x100 here!");
+			break;
+
+		case HW90_BLOCK_PHY0:
+		case HW90_BLOCK_PHY1:
+			write_nic_dword(dev, WriteAddr[CheckBlock], WriteData[i]);
+			dwRegRead = read_nic_dword(dev, WriteAddr[CheckBlock]);
+			break;
+
+		case HW90_BLOCK_RF:
+			WriteData[i] &= 0xfff;
+			rtl8192_phy_SetRFReg(dev, eRFPath, WriteAddr[HW90_BLOCK_RF], bMask12Bits, WriteData[i]);
+			// TODO: we should not delay for such a long time. Ask SD3
+			msleep(1);
+			dwRegRead = rtl8192_phy_QueryRFReg(dev, eRFPath, WriteAddr[HW90_BLOCK_RF], bMask12Bits);
+			msleep(1);
+			break;
+
+		default:
+			ret = 1;
+			break;
+		}
+
+
+		//
+		// Check whether readback data is correct
+		//
+		if(dwRegRead != WriteData[i])
+		{
+			RT_TRACE((COMP_PHY|COMP_ERR), "====>error=====dwRegRead: %x, WriteData: %x \n", dwRegRead, WriteData[i]);
+			ret = 1;
+			break;
+		}
+	}
+
+	return ret;
+}
+
+
+/******************************************************************************
+ *function:  This function initialize BB&RF
+ *   input:  net_device dev
+ *  output:  none
+ *  return:  none
+ *  notice:  Initialization value may change all the time, so please make
+ *           sure it has been synced with the newest.
+ * ***************************************************************************/
+void rtl8192_BB_Config_ParaFile(struct net_device* dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	u8 bRegValue = 0, eCheckItem = 0, rtStatus = 0;
+	u32 dwRegValue = 0;
+	/**************************************
+	//<1>Initialize BaseBand
+	**************************************/
+
+	/*--set BB Global Reset--*/
+	bRegValue = read_nic_byte(dev, BB_GLOBAL_RESET);
+	write_nic_byte(dev, BB_GLOBAL_RESET,(bRegValue|BB_GLOBAL_RESET_BIT));
+	mdelay(50);
+	/*---set BB reset Active---*/
+	dwRegValue = read_nic_dword(dev, CPU_GEN);
+	write_nic_dword(dev, CPU_GEN, (dwRegValue&(~CPU_GEN_BB_RST)));
+
+	/*----Ckeck FPGAPHY0 and PHY1 board is OK----*/
+	// TODO: this function should be removed on ASIC , Emily 2007.2.2
+	for(eCheckItem=(HW90_BLOCK_E)HW90_BLOCK_PHY0; eCheckItem<=HW90_BLOCK_PHY1; eCheckItem++)
+	{
+		rtStatus  = rtl8192_phy_checkBBAndRF(dev, (HW90_BLOCK_E)eCheckItem, (RF90_RADIO_PATH_E)0); //don't care RF path
+		if(rtStatus != 0)
+		{
+			RT_TRACE((COMP_ERR | COMP_PHY), "PHY_RF8256_Config():Check PHY%d Fail!!\n", eCheckItem-1);
+			return ;
+		}
+	}
+	/*---- Set CCK and OFDM Block "OFF"----*/
+	rtl8192_setBBreg(dev, rFPGA0_RFMOD, bCCKEn|bOFDMEn, 0x0);
+	/*----BB Register Initilazation----*/
+	//==m==>Set PHY REG From Header<==m==
+	rtl8192_phyConfigBB(dev, BaseBand_Config_PHY_REG);
+
+	/*----Set BB reset de-Active----*/
+	dwRegValue = read_nic_dword(dev, CPU_GEN);
+	write_nic_dword(dev, CPU_GEN, (dwRegValue|CPU_GEN_BB_RST));
+
+	/*----BB AGC table Initialization----*/
+	//==m==>Set PHY REG From Header<==m==
+	rtl8192_phyConfigBB(dev, BaseBand_Config_AGC_TAB);
+
+	/*----Enable XSTAL ----*/
+	write_nic_byte_E(dev, 0x5e, 0x00);
+	if (priv->card_8192_version == (u8)VERSION_819xU_A)
+	{
+		//Antenna gain offset from B/C/D to A
+		dwRegValue = (priv->AntennaTxPwDiff[1]<<4 | priv->AntennaTxPwDiff[0]);
+		rtl8192_setBBreg(dev, rFPGA0_TxGainStage, (bXBTxAGC|bXCTxAGC), dwRegValue);
+
+		//XSTALLCap
+		dwRegValue = priv->CrystalCap & 0xf;
+		rtl8192_setBBreg(dev, rFPGA0_AnalogParameter1, bXtalCap, dwRegValue);
+	}
+
+	// Check if the CCK HighPower is turned ON.
+	// This is used to calculate PWDB.
+	priv->bCckHighPower = (u8)(rtl8192_QueryBBReg(dev, rFPGA0_XA_HSSIParameter2, 0x200));
+	return;
+}
+/******************************************************************************
+ *function:  This function initialize BB&RF
+ *   input:  net_device dev
+ *  output:  none
+ *  return:  none
+ *  notice:  Initialization value may change all the time, so please make
+ *           sure it has been synced with the newest.
+ * ***************************************************************************/
+void rtl8192_BBConfig(struct net_device* dev)
+{
+	rtl8192_InitBBRFRegDef(dev);
+	//config BB&RF. As hardCode based initialization has not been well
+	//implemented, so use file first.FIXME:should implement it for hardcode?
+	rtl8192_BB_Config_ParaFile(dev);
+	return;
+}
+
+/******************************************************************************
+ *function:  This function obtains the initialization value of Tx power Level offset
+ *   input:  net_device dev
+ *  output:  none
+ *  return:  none
+ * ***************************************************************************/
+void rtl8192_phy_getTxPower(struct net_device* dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	priv->MCSTxPowerLevelOriginalOffset[0] =
+		read_nic_dword(dev, rTxAGC_Rate18_06);
+	priv->MCSTxPowerLevelOriginalOffset[1] =
+		read_nic_dword(dev, rTxAGC_Rate54_24);
+	priv->MCSTxPowerLevelOriginalOffset[2] =
+		read_nic_dword(dev, rTxAGC_Mcs03_Mcs00);
+	priv->MCSTxPowerLevelOriginalOffset[3] =
+		read_nic_dword(dev, rTxAGC_Mcs07_Mcs04);
+	priv->MCSTxPowerLevelOriginalOffset[4] =
+		read_nic_dword(dev, rTxAGC_Mcs11_Mcs08);
+	priv->MCSTxPowerLevelOriginalOffset[5] =
+		read_nic_dword(dev, rTxAGC_Mcs15_Mcs12);
+
+	// read rx initial gain
+	priv->DefaultInitialGain[0] = read_nic_byte(dev, rOFDM0_XAAGCCore1);
+	priv->DefaultInitialGain[1] = read_nic_byte(dev, rOFDM0_XBAGCCore1);
+	priv->DefaultInitialGain[2] = read_nic_byte(dev, rOFDM0_XCAGCCore1);
+	priv->DefaultInitialGain[3] = read_nic_byte(dev, rOFDM0_XDAGCCore1);
+	RT_TRACE(COMP_INIT, "Default initial gain (c50=0x%x, c58=0x%x, c60=0x%x, c68=0x%x) \n",
+		priv->DefaultInitialGain[0], priv->DefaultInitialGain[1],
+		priv->DefaultInitialGain[2], priv->DefaultInitialGain[3]);
+
+	// read framesync
+	priv->framesync = read_nic_byte(dev, rOFDM0_RxDetector3);
+	priv->framesyncC34 = read_nic_byte(dev, rOFDM0_RxDetector2);
+	RT_TRACE(COMP_INIT, "Default framesync (0x%x) = 0x%x \n",
+		rOFDM0_RxDetector3, priv->framesync);
+
+	// read SIFS (save the value read fome MACPHY_REG.txt)
+	priv->SifsTime = read_nic_word(dev, SIFS);
+
+	return;
+}
+
+/******************************************************************************
+ *function:  This function obtains the initialization value of Tx power Level offset
+ *   input:  net_device dev
+ *  output:  none
+ *  return:  none
+ * ***************************************************************************/
+void rtl8192_phy_setTxPower(struct net_device* dev, u8 channel)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	u8	powerlevel = priv->TxPowerLevelCCK[channel-1];
+	u8	powerlevelOFDM24G = priv->TxPowerLevelOFDM24G[channel-1];
+
+	switch(priv->rf_chip)
+	{
+	case RF_8256:
+		PHY_SetRF8256CCKTxPower(dev, powerlevel); //need further implement
+		PHY_SetRF8256OFDMTxPower(dev, powerlevelOFDM24G);
+		break;
+	default:
+//	case RF_8225:
+//	case RF_8258:
+		RT_TRACE((COMP_PHY|COMP_ERR), "error RF chipID(8225 or 8258) in function %s()\n", __FUNCTION__);
+		break;
+	}
+	return;
+}
+
+/******************************************************************************
+ *function:  This function check Rf chip to do RF config
+ *   input:  net_device dev
+ *  output:  none
+ *  return:  only 8256 is supported
+ * ***************************************************************************/
+void rtl8192_phy_RFConfig(struct net_device* dev)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+	switch(priv->rf_chip)
+	{
+		case RF_8256:
+			PHY_RF8256_Config(dev);
+			break;
+	//	case RF_8225:
+	//	case RF_8258:
+		default:
+			RT_TRACE(COMP_ERR, "error chip id\n");
+			break;
+	}
+	return;
+}
+
+/******************************************************************************
+ *function:  This function update Initial gain
+ *   input:  net_device dev
+ *  output:  none
+ *  return:  As Windows has not implemented this, wait for complement
+ * ***************************************************************************/
+void rtl8192_phy_updateInitGain(struct net_device* dev)
+{
+	return;
+}
+
+/******************************************************************************
+ *function:  This function read RF parameters from general head file, and do RF 3-wire
+ *   input:  net_device dev
+ *  output:  none
+ *  return:  return code show if RF configuration is successful(0:pass, 1:fail)
+ *    Note:  Delay may be required for RF configuration
+ * ***************************************************************************/
+u8 rtl8192_phy_ConfigRFWithHeaderFile(struct net_device* dev, RF90_RADIO_PATH_E	eRFPath)
+{
+
+	int i;
+	//u32* pRFArray;
+	u8 ret = 0;
+
+	switch(eRFPath){
+		case RF90_PATH_A:
+			for(i = 0;i<RadioA_ArrayLength; i=i+2){
+
+				if(rtl819XRadioA_Array[i] == 0xfe){
+						mdelay(100);
+						continue;
+				}
+				rtl8192_phy_SetRFReg(dev, eRFPath, rtl819XRadioA_Array[i], bMask12Bits, rtl819XRadioA_Array[i+1]);
+				mdelay(1);
+
+			}
+			break;
+		case RF90_PATH_B:
+			for(i = 0;i<RadioB_ArrayLength; i=i+2){
+
+				if(rtl819XRadioB_Array[i] == 0xfe){
+						mdelay(100);
+						continue;
+				}
+				rtl8192_phy_SetRFReg(dev, eRFPath, rtl819XRadioB_Array[i], bMask12Bits, rtl819XRadioB_Array[i+1]);
+				mdelay(1);
+
+			}
+			break;
+		case RF90_PATH_C:
+			for(i = 0;i<RadioC_ArrayLength; i=i+2){
+
+				if(rtl819XRadioC_Array[i] == 0xfe){
+						mdelay(100);
+						continue;
+				}
+				rtl8192_phy_SetRFReg(dev, eRFPath, rtl819XRadioC_Array[i], bMask12Bits, rtl819XRadioC_Array[i+1]);
+				mdelay(1);
+
+			}
+			break;
+		case RF90_PATH_D:
+			for(i = 0;i<RadioD_ArrayLength; i=i+2){
+
+				if(rtl819XRadioD_Array[i] == 0xfe){
+						mdelay(100);
+						continue;
+				}
+				rtl8192_phy_SetRFReg(dev, eRFPath, rtl819XRadioD_Array[i], bMask12Bits, rtl819XRadioD_Array[i+1]);
+				mdelay(1);
+
+			}
+			break;
+		default:
+			break;
+	}
+
+	return ret;;
+
+}
+/******************************************************************************
+ *function:  This function set Tx Power of the channel
+ *   input:  struct net_device *dev
+ *   	     u8 		channel
+ *  output:  none
+ *  return:  none
+ *    Note:
+ * ***************************************************************************/
+void rtl8192_SetTxPowerLevel(struct net_device *dev, u8 channel)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	u8	powerlevel = priv->TxPowerLevelCCK[channel-1];
+	u8	powerlevelOFDM24G = priv->TxPowerLevelOFDM24G[channel-1];
+
+	switch(priv->rf_chip)
+	{
+	case RF_8225:
+#ifdef TO_DO_LIST
+		PHY_SetRF8225CckTxPower(Adapter, powerlevel);
+		PHY_SetRF8225OfdmTxPower(Adapter, powerlevelOFDM24G);
+#endif
+		break;
+
+	case RF_8256:
+		PHY_SetRF8256CCKTxPower(dev, powerlevel);
+		PHY_SetRF8256OFDMTxPower(dev, powerlevelOFDM24G);
+		break;
+
+	case RF_8258:
+		break;
+	default:
+		RT_TRACE(COMP_ERR, "unknown rf chip ID in rtl8192_SetTxPowerLevel()\n");
+		break;
+	}
+	return;
+}
+
+/******************************************************************************
+ *function:  This function set RF state on or off
+ *   input:  struct net_device *dev
+ *   	     RT_RF_POWER_STATE eRFPowerState  //Power State to set
+ *  output:  none
+ *  return:  none
+ *    Note:
+ * ***************************************************************************/
+bool rtl8192_SetRFPowerState(struct net_device *dev, RT_RF_POWER_STATE eRFPowerState)
+{
+	bool				bResult = true;
+//	u8					eRFPath;
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+	if(eRFPowerState == priv->ieee80211->eRFPowerState)
+		return false;
+
+	if(priv->SetRFPowerStateInProgress == true)
+		return false;
+
+	priv->SetRFPowerStateInProgress = true;
+
+	switch(priv->rf_chip)
+	{
+		case RF_8256:
+		switch( eRFPowerState )
+		{
+			case eRfOn:
+	//RF-A, RF-B
+					//enable RF-Chip A/B
+					rtl8192_setBBreg(dev, rFPGA0_XA_RFInterfaceOE, BIT4, 0x1);	// 0x860[4]
+					//analog to digital on
+					rtl8192_setBBreg(dev, rFPGA0_AnalogParameter4, 0x300, 0x3);// 0x88c[9:8]
+					//digital to analog on
+					rtl8192_setBBreg(dev, rFPGA0_AnalogParameter1, 0x18, 0x3); // 0x880[4:3]
+					//rx antenna on
+					rtl8192_setBBreg(dev, rOFDM0_TRxPathEnable, 0x3, 0x3);// 0xc04[1:0]
+					//rx antenna on
+					rtl8192_setBBreg(dev, rOFDM1_TRxPathEnable, 0x3, 0x3);// 0xd04[1:0]
+					//analog to digital part2 on
+					rtl8192_setBBreg(dev, rFPGA0_AnalogParameter1, 0x60, 0x3); // 0x880[6:5]
+
+				break;
+
+			case eRfSleep:
+
+				break;
+
+			case eRfOff:
+					//RF-A, RF-B
+					//disable RF-Chip A/B
+					rtl8192_setBBreg(dev, rFPGA0_XA_RFInterfaceOE, BIT4, 0x0);	// 0x860[4]
+					//analog to digital off, for power save
+					rtl8192_setBBreg(dev, rFPGA0_AnalogParameter4, 0xf00, 0x0);// 0x88c[11:8]
+					//digital to analog off, for power save
+					rtl8192_setBBreg(dev, rFPGA0_AnalogParameter1, 0x18, 0x0); // 0x880[4:3]
+					//rx antenna off
+					rtl8192_setBBreg(dev, rOFDM0_TRxPathEnable, 0xf, 0x0);// 0xc04[3:0]
+					//rx antenna off
+					rtl8192_setBBreg(dev, rOFDM1_TRxPathEnable, 0xf, 0x0);// 0xd04[3:0]
+					//analog to digital part2 off, for power save
+					rtl8192_setBBreg(dev, rFPGA0_AnalogParameter1, 0x60, 0x0); // 0x880[6:5]
+
+				break;
+
+			default:
+				bResult = false;
+				RT_TRACE(COMP_ERR, "SetRFPowerState819xUsb(): unknow state to set: 0x%X!!!\n", eRFPowerState);
+				break;
+		}
+			break;
+		default:
+			RT_TRACE(COMP_ERR, "Not support rf_chip(%x)\n", priv->rf_chip);
+			break;
+	}
+#ifdef TO_DO_LIST
+	if(bResult)
+	{
+		// Update current RF state variable.
+		pHalData->eRFPowerState = eRFPowerState;
+		switch(pHalData->RFChipID )
+		{
+			case RF_8256:
+		switch(pHalData->eRFPowerState)
+				{
+				case eRfOff:
+					//
+					//If Rf off reason is from IPS, Led should blink with no link, by Maddest 071015
+					//
+					if(pMgntInfo->RfOffReason==RF_CHANGE_BY_IPS )
+					{
+						Adapter->HalFunc.LedControlHandler(Adapter,LED_CTL_NO_LINK);
+					}
+					else
+					{
+						// Turn off LED if RF is not ON.
+						Adapter->HalFunc.LedControlHandler(Adapter, LED_CTL_POWER_OFF);
+					}
+					break;
+
+				case eRfOn:
+					// Turn on RF we are still linked, which might happen when
+					// we quickly turn off and on HW RF. 2006.05.12, by rcnjko.
+					if( pMgntInfo->bMediaConnect == TRUE )
+					{
+						Adapter->HalFunc.LedControlHandler(Adapter, LED_CTL_LINK);
+					}
+					else
+					{
+						// Turn off LED if RF is not ON.
+						Adapter->HalFunc.LedControlHandler(Adapter, LED_CTL_NO_LINK);
+					}
+					break;
+
+				default:
+					// do nothing.
+					break;
+				}// Switch RF state
+				break;
+
+				default:
+					RT_TRACE(COMP_RF, DBG_LOUD, ("SetRFPowerState8190(): Unknown RF type\n"));
+					break;
+			}
+
+	}
+#endif
+	priv->SetRFPowerStateInProgress = false;
+
+	return bResult;
+}
+
+/****************************************************************************************
+ *function:  This function set command table variable(struct SwChnlCmd).
+ *   input:  SwChnlCmd*		CmdTable 	//table to be set.
+ *   	     u32		CmdTableIdx 	//variable index in table to be set
+ *   	     u32		CmdTableSz	//table size.
+ *   	     SwChnlCmdID	CmdID		//command ID to set.
+ *	     u32		Para1
+ *	     u32		Para2
+ *	     u32		msDelay
+ *  output:
+ *  return:  true if finished, false otherwise
+ *    Note:
+ * ************************************************************************************/
+u8 rtl8192_phy_SetSwChnlCmdArray(
+	SwChnlCmd*		CmdTable,
+	u32			CmdTableIdx,
+	u32			CmdTableSz,
+	SwChnlCmdID		CmdID,
+	u32			Para1,
+	u32			Para2,
+	u32			msDelay
+	)
+{
+	SwChnlCmd* pCmd;
+
+	if(CmdTable == NULL)
+	{
+		RT_TRACE(COMP_ERR, "phy_SetSwChnlCmdArray(): CmdTable cannot be NULL.\n");
+		return false;
+	}
+	if(CmdTableIdx >= CmdTableSz)
+	{
+		RT_TRACE(COMP_ERR, "phy_SetSwChnlCmdArray(): Access invalid index, please check size of the table, CmdTableIdx:%d, CmdTableSz:%d\n",
+				CmdTableIdx, CmdTableSz);
+		return false;
+	}
+
+	pCmd = CmdTable + CmdTableIdx;
+	pCmd->CmdID = CmdID;
+	pCmd->Para1 = Para1;
+	pCmd->Para2 = Para2;
+	pCmd->msDelay = msDelay;
+
+	return true;
+}
+/******************************************************************************
+ *function:  This function set channel step by step
+ *   input:  struct net_device *dev
+ *   	     u8 		channel
+ *   	     u8* 		stage //3 stages
+ *   	     u8* 		step  //
+ *   	     u32* 		delay //whether need to delay
+ *  output:  store new stage, step and delay for next step(combine with function above)
+ *  return:  true if finished, false otherwise
+ *    Note:  Wait for simpler function to replace it //wb
+ * ***************************************************************************/
+u8 rtl8192_phy_SwChnlStepByStep(struct net_device *dev, u8 channel, u8* stage, u8* step, u32* delay)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+//	PCHANNEL_ACCESS_SETTING	pChnlAccessSetting;
+	SwChnlCmd				PreCommonCmd[MAX_PRECMD_CNT];
+	u32					PreCommonCmdCnt;
+	SwChnlCmd				PostCommonCmd[MAX_POSTCMD_CNT];
+	u32					PostCommonCmdCnt;
+	SwChnlCmd				RfDependCmd[MAX_RFDEPENDCMD_CNT];
+	u32					RfDependCmdCnt;
+	SwChnlCmd				*CurrentCmd = NULL;
+	//RF90_RADIO_PATH_E		eRFPath;
+	u8		eRFPath;
+//	u32		RfRetVal;
+//	u8		RetryCnt;
+
+	RT_TRACE(COMP_CH, "====>%s()====stage:%d, step:%d, channel:%d\n", __FUNCTION__, *stage, *step, channel);
+//	RT_ASSERT(IsLegalChannel(Adapter, channel), ("illegal channel: %d\n", channel));
+#ifdef ENABLE_DOT11D
+	if (!IsLegalChannel(priv->ieee80211, channel))
+	{
+		RT_TRACE(COMP_ERR, "=============>set to illegal channel:%d\n", channel);
+		return true; //return true to tell upper caller function this channel setting is finished! Or it will in while loop.
+	}
+#endif
+//FIXME:need to check whether channel is legal or not here.WB
+
+
+	//for(eRFPath = RF90_PATH_A; eRFPath <pHalData->NumTotalRFPath; eRFPath++)
+//	for(eRFPath = 0; eRFPath <RF90_PATH_MAX; eRFPath++)
+//	{
+//		if (!rtl8192_phy_CheckIsLegalRFPath(dev, eRFPath))
+//			continue;
+		// <1> Fill up pre common command.
+		PreCommonCmdCnt = 0;
+		rtl8192_phy_SetSwChnlCmdArray(PreCommonCmd, PreCommonCmdCnt++, MAX_PRECMD_CNT,
+					CmdID_SetTxPowerLevel, 0, 0, 0);
+		rtl8192_phy_SetSwChnlCmdArray(PreCommonCmd, PreCommonCmdCnt++, MAX_PRECMD_CNT,
+					CmdID_End, 0, 0, 0);
+
+		// <2> Fill up post common command.
+		PostCommonCmdCnt = 0;
+
+		rtl8192_phy_SetSwChnlCmdArray(PostCommonCmd, PostCommonCmdCnt++, MAX_POSTCMD_CNT,
+					CmdID_End, 0, 0, 0);
+
+		// <3> Fill up RF dependent command.
+		RfDependCmdCnt = 0;
+		switch( priv->rf_chip )
+		{
+		case RF_8225:
+			if (!(channel >= 1 && channel <= 14))
+			{
+				RT_TRACE(COMP_ERR, "illegal channel for Zebra 8225: %d\n", channel);
+				return true;
+			}
+			rtl8192_phy_SetSwChnlCmdArray(RfDependCmd, RfDependCmdCnt++, MAX_RFDEPENDCMD_CNT,
+				CmdID_RF_WriteReg, rZebra1_Channel, RF_CHANNEL_TABLE_ZEBRA[channel], 10);
+			rtl8192_phy_SetSwChnlCmdArray(RfDependCmd, RfDependCmdCnt++, MAX_RFDEPENDCMD_CNT,
+				CmdID_End, 0, 0, 0);
+			break;
+
+		case RF_8256:
+			// TEST!! This is not the table for 8256!!
+			if (!(channel >= 1 && channel <= 14))
+			{
+				RT_TRACE(COMP_ERR, "illegal channel for Zebra 8256: %d\n", channel);
+				return true;
+			}
+			rtl8192_phy_SetSwChnlCmdArray(RfDependCmd, RfDependCmdCnt++, MAX_RFDEPENDCMD_CNT,
+				CmdID_RF_WriteReg, rZebra1_Channel, channel, 10);
+			rtl8192_phy_SetSwChnlCmdArray(RfDependCmd, RfDependCmdCnt++, MAX_RFDEPENDCMD_CNT,
+			CmdID_End, 0, 0, 0);
+			break;
+
+		case RF_8258:
+			break;
+
+		default:
+			RT_TRACE(COMP_ERR, "Unknown RFChipID: %d\n", priv->rf_chip);
+			return true;
+			break;
+		}
+
+
+		do{
+			switch(*stage)
+			{
+			case 0:
+				CurrentCmd=&PreCommonCmd[*step];
+				break;
+			case 1:
+				CurrentCmd=&RfDependCmd[*step];
+				break;
+			case 2:
+				CurrentCmd=&PostCommonCmd[*step];
+				break;
+			}
+
+			if(CurrentCmd->CmdID==CmdID_End)
+			{
+				if((*stage)==2)
+				{
+					(*delay)=CurrentCmd->msDelay;
+					return true;
+				}
+				else
+				{
+					(*stage)++;
+					(*step)=0;
+					continue;
+				}
+			}
+
+			switch(CurrentCmd->CmdID)
+			{
+			case CmdID_SetTxPowerLevel:
+				if(priv->card_8192_version == (u8)VERSION_819xU_A) //xiong: consider it later!
+					rtl8192_SetTxPowerLevel(dev,channel);
+				break;
+			case CmdID_WritePortUlong:
+				write_nic_dword(dev, CurrentCmd->Para1, CurrentCmd->Para2);
+				break;
+			case CmdID_WritePortUshort:
+				write_nic_word(dev, CurrentCmd->Para1, (u16)CurrentCmd->Para2);
+				break;
+			case CmdID_WritePortUchar:
+				write_nic_byte(dev, CurrentCmd->Para1, (u8)CurrentCmd->Para2);
+				break;
+			case CmdID_RF_WriteReg:
+				for(eRFPath = 0; eRFPath < RF90_PATH_MAX; eRFPath++)
+				{
+				rtl8192_phy_SetRFReg(dev, (RF90_RADIO_PATH_E)eRFPath, CurrentCmd->Para1, bZebra1_ChannelNum, CurrentCmd->Para2);
+				}
+				break;
+			default:
+				break;
+			}
+
+			break;
+		}while(true);
+//	}/*for(Number of RF paths)*/
+
+	(*delay)=CurrentCmd->msDelay;
+	(*step)++;
+	return false;
+}
+
+/******************************************************************************
+ *function:  This function does acturally set channel work
+ *   input:  struct net_device *dev
+ *   	     u8 		channel
+ *  output:  none
+ *  return:  noin
+ *    Note:  We should not call this function directly
+ * ***************************************************************************/
+void rtl8192_phy_FinishSwChnlNow(struct net_device *dev, u8 channel)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	u32	delay = 0;
+
+	while(!rtl8192_phy_SwChnlStepByStep(dev,channel,&priv->SwChnlStage,&priv->SwChnlStep,&delay))
+	{
+	//	if(delay>0)
+	//		msleep(delay);//or mdelay? need further consideration
+		if(!priv->up)
+			break;
+	}
+}
+/******************************************************************************
+ *function:  Callback routine of the work item for switch channel.
+ *   input:
+ *
+ *  output:  none
+ *  return:  noin
+ * ***************************************************************************/
+void rtl8192_SwChnl_WorkItem(struct net_device *dev)
+{
+
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+	RT_TRACE(COMP_CH, "==> SwChnlCallback819xUsbWorkItem(), chan:%d\n", priv->chan);
+
+
+	rtl8192_phy_FinishSwChnlNow(dev , priv->chan);
+
+	RT_TRACE(COMP_CH, "<== SwChnlCallback819xUsbWorkItem()\n");
+}
+
+/******************************************************************************
+ *function:  This function scheduled actural workitem to set channel
+ *   input:  net_device dev
+ *   	     u8		channel //channel to set
+ *  output:  none
+ *  return:  return code show if workitem is scheduled(1:pass, 0:fail)
+ *    Note:  Delay may be required for RF configuration
+ * ***************************************************************************/
+u8 rtl8192_phy_SwChnl(struct net_device* dev, u8 channel)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	RT_TRACE(COMP_CH, "=====>%s(), SwChnlInProgress:%d\n", __FUNCTION__, priv->SwChnlInProgress);
+	if(!priv->up)
+		return false;
+	if(priv->SwChnlInProgress)
+		return false;
+
+//	if(pHalData->SetBWModeInProgress)
+//		return;
+if (0) //to test current channel from RF reg 0x7.
+{
+	u8		eRFPath;
+	for(eRFPath = 0; eRFPath < 2; eRFPath++){
+	printk("====>set channel:%x\n",rtl8192_phy_QueryRFReg(dev, (RF90_RADIO_PATH_E)eRFPath, 0x7, bZebra1_ChannelNum));
+	udelay(10);
+	}
+}
+	//--------------------------------------------
+	switch(priv->ieee80211->mode)
+	{
+	case WIRELESS_MODE_A:
+	case WIRELESS_MODE_N_5G:
+		if (channel<=14){
+			RT_TRACE(COMP_ERR, "WIRELESS_MODE_A but channel<=14");
+			return false;
+		}
+		break;
+	case WIRELESS_MODE_B:
+		if (channel>14){
+			RT_TRACE(COMP_ERR, "WIRELESS_MODE_B but channel>14");
+			return false;
+		}
+		break;
+	case WIRELESS_MODE_G:
+	case WIRELESS_MODE_N_24G:
+		if (channel>14){
+			RT_TRACE(COMP_ERR, "WIRELESS_MODE_G but channel>14");
+			return false;
+		}
+		break;
+	}
+	//--------------------------------------------
+
+	priv->SwChnlInProgress = true;
+	if(channel == 0)
+		channel = 1;
+
+	priv->chan=channel;
+
+	priv->SwChnlStage=0;
+	priv->SwChnlStep=0;
+//	schedule_work(&(priv->SwChnlWorkItem));
+//	rtl8192_SwChnl_WorkItem(dev);
+	if(priv->up) {
+//		queue_work(priv->priv_wq,&(priv->SwChnlWorkItem));
+	rtl8192_SwChnl_WorkItem(dev);
+	}
+
+	priv->SwChnlInProgress = false;
+	return true;
+}
+
+
+//
+/******************************************************************************
+ *function:  Callback routine of the work item for set bandwidth mode.
+ *   input:  struct net_device *dev
+ *   	     HT_CHANNEL_WIDTH	Bandwidth  //20M or 40M
+ *   	     HT_EXTCHNL_OFFSET Offset 	   //Upper, Lower, or Don't care
+ *  output:  none
+ *  return:  none
+ *    Note:  I doubt whether SetBWModeInProgress flag is necessary as we can
+ *    	     test whether current work in the queue or not.//do I?
+ * ***************************************************************************/
+void rtl8192_SetBWModeWorkItem(struct net_device *dev)
+{
+
+	struct r8192_priv *priv = ieee80211_priv(dev);
+	u8 regBwOpMode;
+
+	RT_TRACE(COMP_SWBW, "==>rtl8192_SetBWModeWorkItem()  Switch to %s bandwidth\n", \
+					priv->CurrentChannelBW == HT_CHANNEL_WIDTH_20?"20MHz":"40MHz")
+
+
+	if(priv->rf_chip == RF_PSEUDO_11N)
+	{
+		priv->SetBWModeInProgress= false;
+		return;
+	}
+
+	//<1>Set MAC register
+	regBwOpMode = read_nic_byte(dev, BW_OPMODE);
+
+	switch(priv->CurrentChannelBW)
+	{
+		case HT_CHANNEL_WIDTH_20:
+			regBwOpMode |= BW_OPMODE_20MHZ;
+		       // 2007/02/07 Mark by Emily becasue we have not verify whether this register works
+			write_nic_byte(dev, BW_OPMODE, regBwOpMode);
+			break;
+
+		case HT_CHANNEL_WIDTH_20_40:
+			regBwOpMode &= ~BW_OPMODE_20MHZ;
+			// 2007/02/07 Mark by Emily becasue we have not verify whether this register works
+			write_nic_byte(dev, BW_OPMODE, regBwOpMode);
+			break;
+
+		default:
+			RT_TRACE(COMP_ERR, "SetChannelBandwidth819xUsb(): unknown Bandwidth: %#X\n",priv->CurrentChannelBW);
+			break;
+	}
+
+	//<2>Set PHY related register
+	switch(priv->CurrentChannelBW)
+	{
+		case HT_CHANNEL_WIDTH_20:
+			// Add by Vivi 20071119
+			rtl8192_setBBreg(dev, rFPGA0_RFMOD, bRFMOD, 0x0);
+			rtl8192_setBBreg(dev, rFPGA1_RFMOD, bRFMOD, 0x0);
+			rtl8192_setBBreg(dev, rFPGA0_AnalogParameter1, 0x00100000, 1);
+
+			// Correct the tx power for CCK rate in 20M. Suggest by YN, 20071207
+			priv->cck_present_attentuation =
+				priv->cck_present_attentuation_20Mdefault + priv->cck_present_attentuation_difference;
+
+			if(priv->cck_present_attentuation > 22)
+				priv->cck_present_attentuation= 22;
+			if(priv->cck_present_attentuation< 0)
+				priv->cck_present_attentuation = 0;
+			RT_TRACE(COMP_INIT, "20M, pHalData->CCKPresentAttentuation = %d\n", priv->cck_present_attentuation);
+
+			if(priv->chan == 14 && !priv->bcck_in_ch14)
+			{
+				priv->bcck_in_ch14 = TRUE;
+				dm_cck_txpower_adjust(dev,priv->bcck_in_ch14);
+			}
+			else if(priv->chan != 14 && priv->bcck_in_ch14)
+			{
+				priv->bcck_in_ch14 = FALSE;
+				dm_cck_txpower_adjust(dev,priv->bcck_in_ch14);
+			}
+			else
+				dm_cck_txpower_adjust(dev,priv->bcck_in_ch14);
+
+			break;
+		case HT_CHANNEL_WIDTH_20_40:
+			// Add by Vivi 20071119
+			rtl8192_setBBreg(dev, rFPGA0_RFMOD, bRFMOD, 0x1);
+			rtl8192_setBBreg(dev, rFPGA1_RFMOD, bRFMOD, 0x1);
+			rtl8192_setBBreg(dev, rCCK0_System, bCCKSideBand, (priv->nCur40MhzPrimeSC>>1));
+			rtl8192_setBBreg(dev, rFPGA0_AnalogParameter1, 0x00100000, 0);
+			rtl8192_setBBreg(dev, rOFDM1_LSTF, 0xC00, priv->nCur40MhzPrimeSC);
+			priv->cck_present_attentuation =
+				priv->cck_present_attentuation_40Mdefault + priv->cck_present_attentuation_difference;
+
+			if(priv->cck_present_attentuation > 22)
+				priv->cck_present_attentuation = 22;
+			if(priv->cck_present_attentuation < 0)
+				priv->cck_present_attentuation = 0;
+
+			RT_TRACE(COMP_INIT, "40M, pHalData->CCKPresentAttentuation = %d\n", priv->cck_present_attentuation);
+			if(priv->chan == 14 && !priv->bcck_in_ch14)
+			{
+				priv->bcck_in_ch14 = true;
+				dm_cck_txpower_adjust(dev,priv->bcck_in_ch14);
+			}
+			else if(priv->chan!= 14 && priv->bcck_in_ch14)
+			{
+				priv->bcck_in_ch14 = false;
+				dm_cck_txpower_adjust(dev,priv->bcck_in_ch14);
+			}
+			else
+				dm_cck_txpower_adjust(dev,priv->bcck_in_ch14);
+
+			break;
+		default:
+			RT_TRACE(COMP_ERR, "SetChannelBandwidth819xUsb(): unknown Bandwidth: %#X\n" ,priv->CurrentChannelBW);
+			break;
+
+	}
+	//Skip over setting of J-mode in BB register here. Default value is "None J mode". Emily 20070315
+
+	//<3>Set RF related register
+	switch( priv->rf_chip )
+	{
+		case RF_8225:
+#ifdef TO_DO_LIST
+			PHY_SetRF8225Bandwidth(Adapter, pHalData->CurrentChannelBW);
+#endif
+			break;
+
+		case RF_8256:
+			PHY_SetRF8256Bandwidth(dev, priv->CurrentChannelBW);
+			break;
+
+		case RF_8258:
+			// PHY_SetRF8258Bandwidth();
+			break;
+
+		case RF_PSEUDO_11N:
+			// Do Nothing
+			break;
+
+		default:
+			RT_TRACE(COMP_ERR, "Unknown RFChipID: %d\n", priv->rf_chip);
+			break;
+	}
+	priv->SetBWModeInProgress= false;
+
+	RT_TRACE(COMP_SWBW, "<==SetBWMode819xUsb(), %d", atomic_read(&(priv->ieee80211->atm_swbw)) );
+}
+
+/******************************************************************************
+ *function:  This function schedules bandwith switch work.
+ *   input:  struct net_device *dev
+ *   	     HT_CHANNEL_WIDTH	Bandwidth  //20M or 40M
+ *   	     HT_EXTCHNL_OFFSET Offset 	   //Upper, Lower, or Don't care
+ *  output:  none
+ *  return:  none
+ *    Note:  I doubt whether SetBWModeInProgress flag is necessary as we can
+ *    	     test whether current work in the queue or not.//do I?
+ * ***************************************************************************/
+void rtl8192_SetBWMode(struct net_device *dev, HT_CHANNEL_WIDTH	Bandwidth, HT_EXTCHNL_OFFSET Offset)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+	if(priv->SetBWModeInProgress)
+		return;
+	priv->SetBWModeInProgress= true;
+
+	priv->CurrentChannelBW = Bandwidth;
+
+	if(Offset==HT_EXTCHNL_OFFSET_LOWER)
+		priv->nCur40MhzPrimeSC = HAL_PRIME_CHNL_OFFSET_UPPER;
+	else if(Offset==HT_EXTCHNL_OFFSET_UPPER)
+		priv->nCur40MhzPrimeSC = HAL_PRIME_CHNL_OFFSET_LOWER;
+	else
+		priv->nCur40MhzPrimeSC = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+
+	//queue_work(priv->priv_wq, &(priv->SetBWModeWorkItem));
+	//	schedule_work(&(priv->SetBWModeWorkItem));
+	rtl8192_SetBWModeWorkItem(dev);
+
+}
+
+void InitialGain819xUsb(struct net_device *dev,	u8 Operation)
+{
+	struct r8192_priv *priv = ieee80211_priv(dev);
+
+	priv->InitialGainOperateType = Operation;
+
+	if(priv->up)
+	{
+		queue_delayed_work(priv->priv_wq,&priv->initialgain_operate_wq,0);
+	}
+}
+
+extern void InitialGainOperateWorkItemCallBack(struct work_struct *work)
+{
+	struct delayed_work *dwork = container_of(work,struct delayed_work,work);
+       struct r8192_priv *priv = container_of(dwork,struct r8192_priv,initialgain_operate_wq);
+       struct net_device *dev = priv->ieee80211->dev;
+#define SCAN_RX_INITIAL_GAIN	0x17
+#define POWER_DETECTION_TH	0x08
+	u32	BitMask;
+	u8	initial_gain;
+	u8	Operation;
+
+	Operation = priv->InitialGainOperateType;
+
+	switch(Operation)
+	{
+		case IG_Backup:
+			RT_TRACE(COMP_SCAN, "IG_Backup, backup the initial gain.\n");
+			initial_gain = SCAN_RX_INITIAL_GAIN;//priv->DefaultInitialGain[0];//
+			BitMask = bMaskByte0;
+			if(dm_digtable.dig_algorithm == DIG_ALGO_BY_FALSE_ALARM)
+				rtl8192_setBBreg(dev, UFWP, bMaskByte1, 0x8);	// FW DIG OFF
+			priv->initgain_backup.xaagccore1 = (u8)rtl8192_QueryBBReg(dev, rOFDM0_XAAGCCore1, BitMask);
+			priv->initgain_backup.xbagccore1 = (u8)rtl8192_QueryBBReg(dev, rOFDM0_XBAGCCore1, BitMask);
+			priv->initgain_backup.xcagccore1 = (u8)rtl8192_QueryBBReg(dev, rOFDM0_XCAGCCore1, BitMask);
+			priv->initgain_backup.xdagccore1 = (u8)rtl8192_QueryBBReg(dev, rOFDM0_XDAGCCore1, BitMask);
+			BitMask  = bMaskByte2;
+			priv->initgain_backup.cca		= (u8)rtl8192_QueryBBReg(dev, rCCK0_CCA, BitMask);
+
+			RT_TRACE(COMP_SCAN, "Scan InitialGainBackup 0xc50 is %x\n",priv->initgain_backup.xaagccore1);
+			RT_TRACE(COMP_SCAN, "Scan InitialGainBackup 0xc58 is %x\n",priv->initgain_backup.xbagccore1);
+			RT_TRACE(COMP_SCAN, "Scan InitialGainBackup 0xc60 is %x\n",priv->initgain_backup.xcagccore1);
+			RT_TRACE(COMP_SCAN, "Scan InitialGainBackup 0xc68 is %x\n",priv->initgain_backup.xdagccore1);
+			RT_TRACE(COMP_SCAN, "Scan InitialGainBackup 0xa0a is %x\n",priv->initgain_backup.cca);
+
+			RT_TRACE(COMP_SCAN, "Write scan initial gain = 0x%x \n", initial_gain);
+			write_nic_byte(dev, rOFDM0_XAAGCCore1, initial_gain);
+			write_nic_byte(dev, rOFDM0_XBAGCCore1, initial_gain);
+			write_nic_byte(dev, rOFDM0_XCAGCCore1, initial_gain);
+			write_nic_byte(dev, rOFDM0_XDAGCCore1, initial_gain);
+			RT_TRACE(COMP_SCAN, "Write scan 0xa0a = 0x%x \n", POWER_DETECTION_TH);
+			write_nic_byte(dev, 0xa0a, POWER_DETECTION_TH);
+			break;
+		case IG_Restore:
+			RT_TRACE(COMP_SCAN, "IG_Restore, restore the initial gain.\n");
+			BitMask = 0x7f; //Bit0~ Bit6
+			if(dm_digtable.dig_algorithm == DIG_ALGO_BY_FALSE_ALARM)
+				rtl8192_setBBreg(dev, UFWP, bMaskByte1, 0x8);	// FW DIG OFF
+
+			rtl8192_setBBreg(dev, rOFDM0_XAAGCCore1, BitMask, (u32)priv->initgain_backup.xaagccore1);
+			rtl8192_setBBreg(dev, rOFDM0_XBAGCCore1, BitMask, (u32)priv->initgain_backup.xbagccore1);
+			rtl8192_setBBreg(dev, rOFDM0_XCAGCCore1, BitMask, (u32)priv->initgain_backup.xcagccore1);
+			rtl8192_setBBreg(dev, rOFDM0_XDAGCCore1, BitMask, (u32)priv->initgain_backup.xdagccore1);
+			BitMask  = bMaskByte2;
+			rtl8192_setBBreg(dev, rCCK0_CCA, BitMask, (u32)priv->initgain_backup.cca);
+
+			RT_TRACE(COMP_SCAN, "Scan BBInitialGainRestore 0xc50 is %x\n",priv->initgain_backup.xaagccore1);
+			RT_TRACE(COMP_SCAN, "Scan BBInitialGainRestore 0xc58 is %x\n",priv->initgain_backup.xbagccore1);
+			RT_TRACE(COMP_SCAN, "Scan BBInitialGainRestore 0xc60 is %x\n",priv->initgain_backup.xcagccore1);
+			RT_TRACE(COMP_SCAN, "Scan BBInitialGainRestore 0xc68 is %x\n",priv->initgain_backup.xdagccore1);
+			RT_TRACE(COMP_SCAN, "Scan BBInitialGainRestore 0xa0a is %x\n",priv->initgain_backup.cca);
+
+#ifdef RTL8190P
+			SetTxPowerLevel8190(Adapter,priv->CurrentChannel);
+#endif
+#ifdef RTL8192E
+			SetTxPowerLevel8190(Adapter,priv->CurrentChannel);
+#endif
+//#ifdef RTL8192U
+			rtl8192_phy_setTxPower(dev,priv->ieee80211->current_network.channel);
+//#endif
+
+			if(dm_digtable.dig_algorithm == DIG_ALGO_BY_FALSE_ALARM)
+				rtl8192_setBBreg(dev, UFWP, bMaskByte1, 0x1);	// FW DIG ON
+			break;
+		default:
+			RT_TRACE(COMP_SCAN, "Unknown IG Operation. \n");
+			break;
+	}
+}
+
diff --git a/drivers/staging/rtl8192u/r819xU_phy.h b/drivers/staging/rtl8192u/r819xU_phy.h
new file mode 100644
index 000000000000..3e3bc577e6c3
--- /dev/null
+++ b/drivers/staging/rtl8192u/r819xU_phy.h
@@ -0,0 +1,90 @@
+#ifndef _R819XU_PHY_H
+#define _R819XU_PHY_H
+
+/* Channel switch:The size of command tables for switch channel*/
+#define MAX_PRECMD_CNT 16
+#define MAX_RFDEPENDCMD_CNT 16
+#define MAX_POSTCMD_CNT 16
+
+typedef enum _SwChnlCmdID{
+	CmdID_End,
+	CmdID_SetTxPowerLevel,
+	CmdID_BBRegWrite10,
+	CmdID_WritePortUlong,
+	CmdID_WritePortUshort,
+	CmdID_WritePortUchar,
+	CmdID_RF_WriteReg,
+}SwChnlCmdID;
+
+/*--------------------------------Define structure--------------------------------*/
+/* 1. Switch channel related */
+typedef struct _SwChnlCmd{
+	SwChnlCmdID	CmdID;
+	u32			Para1;
+	u32			Para2;
+	u32			msDelay;
+}__attribute__ ((packed)) SwChnlCmd;
+
+extern u32 rtl819XMACPHY_Array_PG[];
+extern u32 rtl819XPHY_REG_1T2RArray[];
+extern u32 rtl819XAGCTAB_Array[];
+extern u32 rtl819XRadioA_Array[];
+extern u32 rtl819XRadioB_Array[];
+extern u32 rtl819XRadioC_Array[];
+extern u32 rtl819XRadioD_Array[];
+
+typedef enum _HW90_BLOCK{
+	HW90_BLOCK_MAC = 0,
+	HW90_BLOCK_PHY0 = 1,
+	HW90_BLOCK_PHY1 = 2,
+	HW90_BLOCK_RF = 3,
+	HW90_BLOCK_MAXIMUM = 4, // Never use this
+}HW90_BLOCK_E, *PHW90_BLOCK_E;
+
+typedef enum _RF90_RADIO_PATH{
+	RF90_PATH_A = 0,			//Radio Path A
+	RF90_PATH_B = 1,			//Radio Path B
+	RF90_PATH_C = 2,			//Radio Path C
+	RF90_PATH_D = 3,			//Radio Path D
+	RF90_PATH_MAX				//Max RF number 92 support
+}RF90_RADIO_PATH_E, *PRF90_RADIO_PATH_E;
+
+#define bMaskByte0                0xff
+#define bMaskByte1                0xff00
+#define bMaskByte2                0xff0000
+#define bMaskByte3                0xff000000
+#define bMaskHWord                0xffff0000
+#define bMaskLWord                0x0000ffff
+#define bMaskDWord                0xffffffff
+
+//extern u32 rtl8192_CalculateBitShift(u32 dwBitMask);
+extern u8 rtl8192_phy_CheckIsLegalRFPath(struct net_device* dev, u32 eRFPath);
+extern void rtl8192_setBBreg(struct net_device* dev, u32 dwRegAddr, u32 dwBitMask, u32 dwData);
+extern u32 rtl8192_QueryBBReg(struct net_device* dev, u32 dwRegAddr, u32 dwBitMask);
+//extern u32 rtl8192_phy_RFSerialRead(struct net_device* dev, RF90_RADIO_PATH_E eRFPath, u32 Offset);
+//extern void rtl8192_phy_RFSerialWrite(struct net_device* dev, RF90_RADIO_PATH_E eRFPath, u32 Offset, u32 Data);
+extern void rtl8192_phy_SetRFReg(struct net_device* dev, RF90_RADIO_PATH_E eRFPath, u32 RegAddr, u32 BitMask, u32 Data);
+extern u32 rtl8192_phy_QueryRFReg(struct net_device* dev, RF90_RADIO_PATH_E eRFPath, u32 RegAddr, u32 BitMask);
+extern void rtl8192_phy_configmac(struct net_device* dev);
+extern void rtl8192_phyConfigBB(struct net_device* dev, u8 ConfigType);
+//extern void rtl8192_InitBBRFRegDef(struct net_device* dev);
+extern u8 rtl8192_phy_checkBBAndRF(struct net_device* dev, HW90_BLOCK_E CheckBlock, RF90_RADIO_PATH_E eRFPath);
+//extern void rtl8192_BB_Config_ParaFile(struct net_device* dev);
+extern void rtl8192_BBConfig(struct net_device* dev);
+extern void rtl8192_phy_getTxPower(struct net_device* dev);
+extern void rtl8192_phy_setTxPower(struct net_device* dev, u8 channel);
+extern void rtl8192_phy_RFConfig(struct net_device* dev);
+extern void rtl8192_phy_updateInitGain(struct net_device* dev);
+extern u8 rtl8192_phy_ConfigRFWithHeaderFile(struct net_device* dev, RF90_RADIO_PATH_E	eRFPath);
+
+extern u8 rtl8192_phy_SwChnl(struct net_device* dev, u8 channel);
+extern void rtl8192_SetBWMode(struct net_device *dev, HT_CHANNEL_WIDTH	Bandwidth, HT_EXTCHNL_OFFSET Offset);
+extern void rtl8192_SwChnl_WorkItem(struct net_device *dev);
+void rtl8192_SetBWModeWorkItem(struct net_device *dev);
+extern bool rtl8192_SetRFPowerState(struct net_device *dev, RT_RF_POWER_STATE eRFPowerState);
+//added by amy
+extern void InitialGain819xUsb(struct net_device *dev,	u8 Operation);
+
+extern void InitialGainOperateWorkItemCallBack(struct work_struct *work);
+
+#endif
diff --git a/drivers/staging/rtl8192u/r819xU_phyreg.h b/drivers/staging/rtl8192u/r819xU_phyreg.h
new file mode 100644
index 000000000000..06b0b539e1bc
--- /dev/null
+++ b/drivers/staging/rtl8192u/r819xU_phyreg.h
@@ -0,0 +1,871 @@
+#ifndef _R819XU_PHYREG_H
+#define _R819XU_PHYREG_H
+
+
+#define   RF_DATA				0x1d4					// FW will write RF data in the register.
+
+//Register   //duplicate register due to connection: RF_Mode, TRxRN, NumOf L-STF
+//page 1
+#define rPMAC_Reset               		0x100
+#define rPMAC_TxStart             		0x104
+#define rPMAC_TxLegacySIG         		0x108
+#define rPMAC_TxHTSIG1            		0x10c
+#define rPMAC_TxHTSIG2            		0x110
+#define rPMAC_PHYDebug            		0x114
+#define rPMAC_TxPacketNum         		0x118
+#define rPMAC_TxIdle              		0x11c
+#define rPMAC_TxMACHeader0       	0x120
+#define rPMAC_TxMACHeader1       	0x124
+#define rPMAC_TxMACHeader2       	0x128
+#define rPMAC_TxMACHeader3       	0x12c
+#define rPMAC_TxMACHeader4       	0x130
+#define rPMAC_TxMACHeader5       	0x134
+#define rPMAC_TxDataType          		0x138
+#define rPMAC_TxRandomSeed      		0x13c
+#define rPMAC_CCKPLCPPreamble  		0x140
+#define rPMAC_CCKPLCPHeader     		0x144
+#define rPMAC_CCKCRC16            		0x148
+#define rPMAC_OFDMRxCRC32OK  		0x170
+#define rPMAC_OFDMRxCRC32Er   		0x174
+#define rPMAC_OFDMRxParityEr    		0x178
+#define rPMAC_OFDMRxCRC8Er     		0x17c
+#define rPMAC_CCKCRxRC16Er       		0x180
+#define rPMAC_CCKCRxRC32Er       		0x184
+#define rPMAC_CCKCRxRC32OK      		0x188
+#define rPMAC_TxStatus            		0x18c
+
+//page8
+#define rFPGA0_RFMOD              		0x800  //RF mode & CCK TxSC
+#define rFPGA0_TxInfo             		0x804
+#define rFPGA0_PSDFunction        		0x808
+#define rFPGA0_TxGainStage        		0x80c
+#define rFPGA0_RFTiming1          		0x810
+#define rFPGA0_RFTiming2          		0x814
+//#define rFPGA0_XC_RFTiming        		0x818
+//#define rFPGA0_XD_RFTiming        		0x81c
+#define rFPGA0_XA_HSSIParameter1  	0x820
+#define rFPGA0_XA_HSSIParameter2  	0x824
+#define rFPGA0_XB_HSSIParameter1  	0x828
+#define rFPGA0_XB_HSSIParameter2  	0x82c
+#define rFPGA0_XC_HSSIParameter1  	0x830
+#define rFPGA0_XC_HSSIParameter2  	0x834
+#define rFPGA0_XD_HSSIParameter1  	0x838
+#define rFPGA0_XD_HSSIParameter2  	0x83c
+#define rFPGA0_XA_LSSIParameter   	0x840
+#define rFPGA0_XB_LSSIParameter   	0x844
+#define rFPGA0_XC_LSSIParameter   	0x848
+#define rFPGA0_XD_LSSIParameter   	0x84c
+#define rFPGA0_RFWakeUpParameter  	0x850
+#define rFPGA0_RFSleepUpParameter 	0x854
+#define rFPGA0_XAB_SwitchControl  	0x858
+#define rFPGA0_XCD_SwitchControl  	0x85c
+#define rFPGA0_XA_RFInterfaceOE   	0x860
+#define rFPGA0_XB_RFInterfaceOE   	0x864
+#define rFPGA0_XC_RFInterfaceOE   	0x868
+#define rFPGA0_XD_RFInterfaceOE   	0x86c
+#define rFPGA0_XAB_RFInterfaceSW  	0x870
+#define rFPGA0_XCD_RFInterfaceSW  	0x874
+#define rFPGA0_XAB_RFParameter    	0x878
+#define rFPGA0_XCD_RFParameter    	0x87c
+#define rFPGA0_AnalogParameter1   	0x880
+#define rFPGA0_AnalogParameter2   	0x884
+#define rFPGA0_AnalogParameter3   	0x888
+#define rFPGA0_AnalogParameter4   	0x88c
+#define rFPGA0_XA_LSSIReadBack    	0x8a0
+#define rFPGA0_XB_LSSIReadBack    	0x8a4
+#define rFPGA0_XC_LSSIReadBack    	0x8a8
+#define rFPGA0_XD_LSSIReadBack    	0x8ac
+#define rFPGA0_PSDReport          		0x8b4
+#define rFPGA0_XAB_RFInterfaceRB  	0x8e0
+#define rFPGA0_XCD_RFInterfaceRB  	0x8e4
+
+//page 9
+#define rFPGA1_RFMOD              		0x900  //RF mode & OFDM TxSC
+#define rFPGA1_TxBlock            		0x904
+#define rFPGA1_DebugSelect        		0x908
+#define rFPGA1_TxInfo             		0x90c
+
+//page a
+#define rCCK0_System              		0xa00
+#define rCCK0_AFESetting          		0xa04
+#define rCCK0_CCA                 			0xa08
+#define rCCK0_RxAGC1              		0xa0c  //AGC default value, saturation level
+#define rCCK0_RxAGC2              		0xa10  //AGC & DAGC
+#define rCCK0_RxHP                		0xa14
+#define rCCK0_DSPParameter1       	0xa18  //Timing recovery & Channel estimation threshold
+#define rCCK0_DSPParameter2       	0xa1c  //SQ threshold
+#define rCCK0_TxFilter1           		0xa20
+#define rCCK0_TxFilter2           		0xa24
+#define rCCK0_DebugPort           		0xa28  //debug port and Tx filter3
+#define rCCK0_FalseAlarmReport    	0xa2c  //0xa2d
+#define rCCK0_TRSSIReport         		0xa50
+#define rCCK0_RxReport            		0xa54  //0xa57
+#define rCCK0_FACounterLower      	0xa5c  //0xa5b
+#define rCCK0_FACounterUpper      	0xa58  //0xa5c
+
+//page c
+#define rOFDM0_LSTF               		0xc00
+#define rOFDM0_TRxPathEnable      	0xc04
+#define rOFDM0_TRMuxPar           		0xc08
+#define rOFDM0_TRSWIsolation      		0xc0c
+#define rOFDM0_XARxAFE            		0xc10  //RxIQ DC offset, Rx digital filter, DC notch filter
+#define rOFDM0_XARxIQImbalance    	0xc14  //RxIQ imblance matrix
+#define rOFDM0_XBRxAFE            		0xc18
+#define rOFDM0_XBRxIQImbalance    	0xc1c
+#define rOFDM0_XCRxAFE            		0xc20
+#define rOFDM0_XCRxIQImbalance    	0xc24
+#define rOFDM0_XDRxAFE            		0xc28
+#define rOFDM0_XDRxIQImbalance    	0xc2c
+#define rOFDM0_RxDetector1        		0xc30  //PD,BW & SBD
+#define rOFDM0_RxDetector2        		0xc34  //SBD & Fame Sync.
+#define rOFDM0_RxDetector3        		0xc38  //Frame Sync.
+#define rOFDM0_RxDetector4        		0xc3c  //PD, SBD, Frame Sync & Short-GI
+#define rOFDM0_RxDSP              		0xc40  //Rx Sync Path
+#define rOFDM0_CFOandDAGC         	0xc44  //CFO & DAGC
+#define rOFDM0_CCADropThreshold   	0xc48 //CCA Drop threshold
+#define rOFDM0_ECCAThreshold      	0xc4c // energy CCA
+#define rOFDM0_XAAGCCore1         	0xc50
+#define rOFDM0_XAAGCCore2         	0xc54
+#define rOFDM0_XBAGCCore1         	0xc58
+#define rOFDM0_XBAGCCore2         	0xc5c
+#define rOFDM0_XCAGCCore1         	0xc60
+#define rOFDM0_XCAGCCore2         	0xc64
+#define rOFDM0_XDAGCCore1         	0xc68
+#define rOFDM0_XDAGCCore2         	0xc6c
+#define rOFDM0_AGCParameter1      	0xc70
+#define rOFDM0_AGCParameter2      	0xc74
+#define rOFDM0_AGCRSSITable       	0xc78
+#define rOFDM0_HTSTFAGC           		0xc7c
+#define rOFDM0_XATxIQImbalance   	0xc80
+#define rOFDM0_XATxAFE            		0xc84
+#define rOFDM0_XBTxIQImbalance    	0xc88
+#define rOFDM0_XBTxAFE            		0xc8c
+#define rOFDM0_XCTxIQImbalance    	0xc90
+#define rOFDM0_XCTxAFE            		0xc94
+#define rOFDM0_XDTxIQImbalance    	0xc98
+#define rOFDM0_XDTxAFE            		0xc9c
+#define rOFDM0_RxHPParameter      	0xce0
+#define rOFDM0_TxPseudoNoiseWgt   	0xce4
+#define rOFDM0_FrameSync          		0xcf0
+#define rOFDM0_DFSReport          		0xcf4
+#define rOFDM0_TxCoeff1           		0xca4
+#define rOFDM0_TxCoeff2           		0xca8
+#define rOFDM0_TxCoeff3           		0xcac
+#define rOFDM0_TxCoeff4           		0xcb0
+#define rOFDM0_TxCoeff5           		0xcb4
+#define rOFDM0_TxCoeff6           		0xcb8
+
+
+//page d
+#define rOFDM1_LSTF               		0xd00
+#define rOFDM1_TRxPathEnable      	0xd04
+#define rOFDM1_CFO                		0xd08
+#define rOFDM1_CSI1               		0xd10
+#define rOFDM1_SBD                		0xd14
+#define rOFDM1_CSI2               		0xd18
+#define rOFDM1_CFOTracking        		0xd2c
+#define rOFDM1_TRxMesaure1        	0xd34
+#define rOFDM1_IntfDet            		0xd3c
+#define rOFDM1_PseudoNoiseStateAB 0xd50
+#define rOFDM1_PseudoNoiseStateCD 0xd54
+#define rOFDM1_RxPseudoNoiseWgt   0xd58
+#define rOFDM_PHYCounter1         		0xda0  //cca, parity fail
+#define rOFDM_PHYCounter2         		0xda4  //rate illegal, crc8 fail
+#define rOFDM_PHYCounter3         		0xda8  //MCS not support
+#define rOFDM_ShortCFOAB          		0xdac
+#define rOFDM_ShortCFOCD          		0xdb0
+#define rOFDM_LongCFOAB           		0xdb4
+#define rOFDM_LongCFOCD           		0xdb8
+#define rOFDM_TailCFOAB           		0xdbc
+#define rOFDM_TailCFOCD           		0xdc0
+#define rOFDM_PWMeasure1          	0xdc4
+#define rOFDM_PWMeasure2          	0xdc8
+#define rOFDM_BWReport            		0xdcc
+#define rOFDM_AGCReport           		0xdd0
+#define rOFDM_RxSNR               		0xdd4
+#define rOFDM_RxEVMCSI            		0xdd8
+#define rOFDM_SIGReport           		0xddc
+
+//page e
+#define rTxAGC_Rate18_06			0xe00
+#define rTxAGC_Rate54_24			0xe04
+#define rTxAGC_CCK_Mcs32			0xe08
+#define rTxAGC_Mcs03_Mcs00			0xe10
+#define rTxAGC_Mcs07_Mcs04			0xe14
+#define rTxAGC_Mcs11_Mcs08			0xe18
+#define rTxAGC_Mcs15_Mcs12			0xe1c
+
+
+//RF
+//Zebra1
+#define rZebra1_HSSIEnable            	0x0
+#define rZebra1_TRxEnable1            	0x1
+#define rZebra1_TRxEnable2           	0x2
+#define rZebra1_AGC                   		0x4
+#define rZebra1_ChargePump            	0x5
+#define rZebra1_Channel               		0x7
+#define rZebra1_TxGain               		0x8
+#define rZebra1_TxLPF                 		0x9
+#define rZebra1_RxLPF                 		0xb
+#define rZebra1_RxHPFCorner           	0xc
+
+//Zebra4
+#define rGlobalCtrl                   		0
+#define rRTL8256_TxLPF                		19
+#define rRTL8256_RxLPF                		11
+
+//RTL8258
+#define rRTL8258_TxLPF                		0x11
+#define rRTL8258_RxLPF                		0x13
+#define rRTL8258_RSSILPF              	0xa
+
+//Bit Mask
+//page-1
+#define bBBResetB                 			0x100
+#define bGlobalResetB             		0x200
+#define bOFDMTxStart              		0x4
+#define bCCKTxStart               			0x8
+#define bCRC32Debug               		0x100
+#define bPMACLoopback             		0x10
+#define bTxLSIG                   			0xffffff
+#define bOFDMTxRate               		0xf
+#define bOFDMTxReserved           		0x10
+#define bOFDMTxLength             		0x1ffe0
+#define bOFDMTxParity             		0x20000
+#define bTxHTSIG1                 			0xffffff
+#define bTxHTMCSRate              		0x7f
+#define bTxHTBW                   			0x80
+#define bTxHTLength               		0xffff00
+#define bTxHTSIG2                 			0xffffff
+#define bTxHTSmoothing            		0x1
+#define bTxHTSounding             		0x2
+#define bTxHTReserved             		0x4
+#define bTxHTAggreation           		0x8
+#define bTxHTSTBC                 			0x30
+#define bTxHTAdvanceCoding        		0x40
+#define bTxHTShortGI              		0x80
+#define bTxHTNumberHT_LTF         		0x300
+#define bTxHTCRC8                 			0x3fc00
+#define bCounterReset             		0x10000
+#define bNumOfOFDMTx              		0xffff
+#define bNumOfCCKTx               		0xffff0000
+#define bTxIdleInterval           			0xffff
+#define bOFDMService              		0xffff0000
+#define bTxMACHeader              		0xffffffff
+#define bTxDataInit               			0xff
+#define bTxHTMode                 		0x100
+#define bTxDataType               		0x30000
+#define bTxRandomSeed             		0xffffffff
+#define bCCKTxPreamble           		0x1
+#define bCCKTxSFD                 			0xffff0000
+#define bCCKTxSIG                 			0xff
+#define bCCKTxService             		0xff00
+#define bCCKLengthExt             		0x8000
+#define bCCKTxLength              		0xffff0000
+#define bCCKTxCRC16               		0xffff
+#define bCCKTxStatus              		0x1
+#define bOFDMTxStatus             		0x2
+
+//page-8
+#define bRFMOD                    			0x1
+#define bJapanMode                		0x2
+#define bCCKTxSC                  			0x30
+#define bCCKEn                    			0x1000000
+#define bOFDMEn                   			0x2000000
+#define bOFDMRxADCPhase           		0x10000
+#define bOFDMTxDACPhase           		0x40000
+#define bXATxAGC                  			0x3f
+#define bXBTxAGC                  			0xf00
+#define bXCTxAGC                  			0xf000
+#define bXDTxAGC                  			0xf0000
+#define bPAStart                  			0xf0000000
+#define bTRStart                  			0x00f00000
+#define bRFStart                  			0x0000f000
+#define bBBStart                  			0x000000f0
+#define bBBCCKStart               		0x0000000f
+#define bPAEnd                    			0xf          //Reg0x814
+#define bTREnd                    			0x0f000000
+#define bRFEnd                    			0x000f0000
+#define bCCAMask                  			0x000000f0   //T2R
+#define bR2RCCAMask               		0x00000f00
+#define bHSSI_R2TDelay            		0xf8000000
+#define bHSSI_T2RDelay            		0xf80000
+#define bContTxHSSI               		0x400     //chane gain at continue Tx
+#define bIGFromCCK                		0x200
+#define bAGCAddress               		0x3f
+#define bRxHPTx                   			0x7000
+#define bRxHPT2R                  			0x38000
+#define bRxHPCCKIni               		0xc0000
+#define bAGCTxCode                		0xc00000
+#define bAGCRxCode                		0x300000
+#define b3WireDataLength          		0x800
+#define b3WireAddressLength       		0x400
+#define b3WireRFPowerDown         		0x1
+//#define bHWSISelect               		0x8
+#define b5GPAPEPolarity           		0x40000000
+#define b2GPAPEPolarity           		0x80000000
+#define bRFSW_TxDefaultAnt        		0x3
+#define bRFSW_TxOptionAnt         		0x30
+#define bRFSW_RxDefaultAnt        		0x300
+#define bRFSW_RxOptionAnt         		0x3000
+#define bRFSI_3WireData           		0x1
+#define bRFSI_3WireClock          		0x2
+#define bRFSI_3WireLoad           		0x4
+#define bRFSI_3WireRW             		0x8
+#define bRFSI_3Wire               			0xf  //3-wire total control
+#define bRFSI_RFENV               		0x10
+#define bRFSI_TRSW                		0x20
+#define bRFSI_TRSWB               		0x40
+#define bRFSI_ANTSW               		0x100
+#define bRFSI_ANTSWB              		0x200
+#define bRFSI_PAPE                			0x400
+#define bRFSI_PAPE5G              		0x800
+#define bBandSelect               			0x1
+#define bHTSIG2_GI                			0x80
+#define bHTSIG2_Smoothing         		0x01
+#define bHTSIG2_Sounding          		0x02
+#define bHTSIG2_Aggreaton         		0x08
+#define bHTSIG2_STBC              		0x30
+#define bHTSIG2_AdvCoding         		0x40
+#define bHTSIG2_NumOfHTLTF        	0x300
+#define bHTSIG2_CRC8              		0x3fc
+#define bHTSIG1_MCS               		0x7f
+#define bHTSIG1_BandWidth         		0x80
+#define bHTSIG1_HTLength          		0xffff
+#define bLSIG_Rate                			0xf
+#define bLSIG_Reserved            		0x10
+#define bLSIG_Length              		0x1fffe
+#define bLSIG_Parity              			0x20
+#define bCCKRxPhase               		0x4
+#define bLSSIReadAddress          		0x3f000000   //LSSI "Read" Address
+#define bLSSIReadEdge             		0x80000000   //LSSI "Read" edge signal
+#define bLSSIReadBackData         		0xfff
+#define bLSSIReadOKFlag           		0x1000
+#define bCCKSampleRate            		0x8       //0: 44MHz, 1:88MHz
+
+#define bRegulator0Standby        		0x1
+#define bRegulatorPLLStandby      		0x2
+#define bRegulator1Standby        		0x4
+#define bPLLPowerUp               		0x8
+#define bDPLLPowerUp              		0x10
+#define bDA10PowerUp              		0x20
+#define bAD7PowerUp               		0x200
+#define bDA6PowerUp               		0x2000
+#define bXtalPowerUp              		0x4000
+#define b40MDClkPowerUP           		0x8000
+#define bDA6DebugMode             		0x20000
+#define bDA6Swing                 			0x380000
+#define bADClkPhase               		0x4000000
+#define b80MClkDelay              		0x18000000
+#define bAFEWatchDogEnable        		0x20000000
+#define bXtalCap                			0x0f000000
+#define bIntDifClkEnable          		0x400
+#define bExtSigClkEnable         		0x800
+#define bBandgapMbiasPowerUp      	0x10000
+#define bAD11SHGain               		0xc0000
+#define bAD11InputRange           		0x700000
+#define bAD11OPCurrent            		0x3800000
+#define bIPathLoopback            		0x4000000
+#define bQPathLoopback            		0x8000000
+#define bAFELoopback              		0x10000000
+#define bDA10Swing                		0x7e0
+#define bDA10Reverse              		0x800
+#define bDAClkSource              		0x1000
+#define bAD7InputRange            		0x6000
+#define bAD7Gain                  			0x38000
+#define bAD7OutputCMMode          		0x40000
+#define bAD7InputCMMode           		0x380000
+#define bAD7Current               			0xc00000
+#define bRegulatorAdjust          		0x7000000
+#define bAD11PowerUpAtTx          		0x1
+#define bDA10PSAtTx               		0x10
+#define bAD11PowerUpAtRx          		0x100
+#define bDA10PSAtRx               		0x1000
+
+#define bCCKRxAGCFormat           		0x200
+
+#define bPSDFFTSamplepPoint       		0xc000
+#define bPSDAverageNum            		0x3000
+#define bIQPathControl            		0xc00
+#define bPSDFreq                  			0x3ff
+#define bPSDAntennaPath           		0x30
+#define bPSDIQSwitch              		0x40
+#define bPSDRxTrigger             		0x400000
+#define bPSDTxTrigger             		0x80000000
+#define bPSDSineToneScale        		0x7f000000
+#define bPSDReport                			0xffff
+
+//page-9
+#define bOFDMTxSC                 		0x30000000
+#define bCCKTxOn                  			0x1
+#define bOFDMTxOn                 		0x2
+#define bDebugPage                		0xfff  //reset debug page and also HWord, LWord
+#define bDebugItem                		0xff   //reset debug page and LWord
+#define bAntL              			0x10
+#define bAntNonHT           				0x100
+#define bAntHT1               			0x1000
+#define bAntHT2                   			0x10000
+#define bAntHT1S1                 			0x100000
+#define bAntNonHTS1               		0x1000000
+
+//page-a
+#define bCCKBBMode                		0x3
+#define bCCKTxPowerSaving         		0x80
+#define bCCKRxPowerSaving         		0x40
+#define bCCKSideBand              		0x10
+#define bCCKScramble              		0x8
+#define bCCKAntDiversity    			0x8000
+#define bCCKCarrierRecovery   		0x4000
+#define bCCKTxRate           			0x3000
+#define bCCKDCCancel             		0x0800
+#define bCCKISICancel             		0x0400
+#define bCCKMatchFilter           		0x0200
+#define bCCKEqualizer             		0x0100
+#define bCCKPreambleDetect       		0x800000
+#define bCCKFastFalseCCA          		0x400000
+#define bCCKChEstStart            		0x300000
+#define bCCKCCACount              		0x080000
+#define bCCKcs_lim                			0x070000
+#define bCCKBistMode              		0x80000000
+#define bCCKCCAMask             		0x40000000
+#define bCCKTxDACPhase         		0x4
+#define bCCKRxADCPhase         		0x20000000   //r_rx_clk
+#define bCCKr_cp_mode0         		0x0100
+#define bCCKTxDCOffset           		0xf0
+#define bCCKRxDCOffset           		0xf
+#define bCCKCCAMode              		0xc000
+#define bCCKFalseCS_lim           		0x3f00
+#define bCCKCS_ratio              		0xc00000
+#define bCCKCorgBit_sel           		0x300000
+#define bCCKPD_lim                			0x0f0000
+#define bCCKNewCCA                		0x80000000
+#define bCCKRxHPofIG              		0x8000
+#define bCCKRxIG                  			0x7f00
+#define bCCKLNAPolarity           		0x800000
+#define bCCKRx1stGain             		0x7f0000
+#define bCCKRFExtend              		0x20000000 //CCK Rx Iinital gain polarity
+#define bCCKRxAGCSatLevel        		0x1f000000
+#define bCCKRxAGCSatCount       		0xe0
+#define bCCKRxRFSettle            		0x1f       //AGCsamp_dly
+#define bCCKFixedRxAGC           		0x8000
+//#define bCCKRxAGCFormat         		0x4000   //remove to HSSI register 0x824
+#define bCCKAntennaPolarity      		0x2000
+#define bCCKTxFilterType          		0x0c00
+#define bCCKRxAGCReportType   		0x0300
+#define bCCKRxDAGCEn              		0x80000000
+#define bCCKRxDAGCPeriod        		0x20000000
+#define bCCKRxDAGCSatLevel     		0x1f000000
+#define bCCKTimingRecovery       		0x800000
+#define bCCKTxC0                  			0x3f0000
+#define bCCKTxC1                  			0x3f000000
+#define bCCKTxC2                  			0x3f
+#define bCCKTxC3                  			0x3f00
+#define bCCKTxC4                  			0x3f0000
+#define bCCKTxC5                  			0x3f000000
+#define bCCKTxC6                  			0x3f
+#define bCCKTxC7                  			0x3f00
+#define bCCKDebugPort             		0xff0000
+#define bCCKDACDebug              		0x0f000000
+#define bCCKFalseAlarmEnable      		0x8000
+#define bCCKFalseAlarmRead        		0x4000
+#define bCCKTRSSI                 			0x7f
+#define bCCKRxAGCReport           		0xfe
+#define bCCKRxReport_AntSel       		0x80000000
+#define bCCKRxReport_MFOff        		0x40000000
+#define bCCKRxRxReport_SQLoss     	0x20000000
+#define bCCKRxReport_Pktloss      		0x10000000
+#define bCCKRxReport_Lockedbit    	0x08000000
+#define bCCKRxReport_RateError    	0x04000000
+#define bCCKRxReport_RxRate       		0x03000000
+#define bCCKRxFACounterLower      	0xff
+#define bCCKRxFACounterUpper      	0xff000000
+#define bCCKRxHPAGCStart          		0xe000
+#define bCCKRxHPAGCFinal          		0x1c00
+
+#define bCCKRxFalseAlarmEnable    	0x8000
+#define bCCKFACounterFreeze       		0x4000
+
+#define bCCKTxPathSel             		0x10000000
+#define bCCKDefaultRxPath         		0xc000000
+#define bCCKOptionRxPath          		0x3000000
+
+//page c
+#define bNumOfSTF                			0x3
+#define bShift_L                 			0xc0
+#define bGI_TH                   			0xc
+#define bRxPathA                 			0x1
+#define bRxPathB                 			0x2
+#define bRxPathC                 			0x4
+#define bRxPathD                 			0x8
+#define bTxPathA                 			0x1
+#define bTxPathB                 			0x2
+#define bTxPathC                 			0x4
+#define bTxPathD                 			0x8
+#define bTRSSIFreq               			0x200
+#define bADCBackoff              			0x3000
+#define bDFIRBackoff             			0xc000
+#define bTRSSILatchPhase         		0x10000
+#define bRxIDCOffset             			0xff
+#define bRxQDCOffset             			0xff00
+#define bRxDFIRMode              		0x1800000
+#define bRxDCNFType              		0xe000000
+#define bRXIQImb_A               			0x3ff
+#define bRXIQImb_B               			0xfc00
+#define bRXIQImb_C               			0x3f0000
+#define bRXIQImb_D               			0xffc00000
+#define bDC_dc_Notch             		0x60000
+#define bRxNBINotch              			0x1f000000
+#define bPD_TH                   			0xf
+#define bPD_TH_Opt2              		0xc000
+#define bPWED_TH                 			0x700
+#define bIfMF_Win_L              			0x800
+#define bPD_Option               			0x1000
+#define bMF_Win_L                			0xe000
+#define bBW_Search_L             		0x30000
+#define bwin_enh_L               			0xc0000
+#define bBW_TH                   			0x700000
+#define bED_TH2                  			0x3800000
+#define bBW_option               			0x4000000
+#define bRatio_TH                			0x18000000
+#define bWindow_L                			0xe0000000
+#define bSBD_Option              			0x1
+#define bFrame_TH                			0x1c
+#define bFS_Option               			0x60
+#define bDC_Slope_check          		0x80
+#define bFGuard_Counter_DC_L     		0xe00
+#define bFrame_Weight_Short      		0x7000
+#define bSub_Tune                			0xe00000
+#define bFrame_DC_Length         		0xe000000
+#define bSBD_start_offset        		0x30000000
+#define bFrame_TH_2              		0x7
+#define bFrame_GI2_TH            		0x38
+#define bGI2_Sync_en             		0x40
+#define bSarch_Short_Early       		0x300
+#define bSarch_Short_Late        		0xc00
+#define bSarch_GI2_Late          		0x70000
+#define bCFOAntSum               		0x1
+#define bCFOAcc                  			0x2
+#define bCFOStartOffset          		0xc
+#define bCFOLookBack             		0x70
+#define bCFOSumWeight            		0x80
+#define bDAGCEnable              			0x10000
+#define bTXIQImb_A               			0x3ff
+#define bTXIQImb_B               			0xfc00
+#define bTXIQImb_C               			0x3f0000
+#define bTXIQImb_D               			0xffc00000
+#define bTxIDCOffset             			0xff
+#define bTxQDCOffset             			0xff00
+#define bTxDFIRMode              		0x10000
+#define bTxPesudoNoiseOn         		0x4000000
+#define bTxPesudoNoise_A         		0xff
+#define bTxPesudoNoise_B         		0xff00
+#define bTxPesudoNoise_C         		0xff0000
+#define bTxPesudoNoise_D         		0xff000000
+#define bCCADropOption           		0x20000
+#define bCCADropThres            		0xfff00000
+#define bEDCCA_H                 			0xf
+#define bEDCCA_L                 			0xf0
+#define bLambda_ED               0x300
+#define bRxInitialGain           0x7f
+#define bRxAntDivEn              0x80
+#define bRxAGCAddressForLNA      0x7f00
+#define bRxHighPowerFlow         0x8000
+#define bRxAGCFreezeThres        0xc0000
+#define bRxFreezeStep_AGC1       0x300000
+#define bRxFreezeStep_AGC2       0xc00000
+#define bRxFreezeStep_AGC3       0x3000000
+#define bRxFreezeStep_AGC0       0xc000000
+#define bRxRssi_Cmp_En           0x10000000
+#define bRxQuickAGCEn            0x20000000
+#define bRxAGCFreezeThresMode    0x40000000
+#define bRxOverFlowCheckType     0x80000000
+#define bRxAGCShift              0x7f
+#define bTRSW_Tri_Only           0x80
+#define bPowerThres              0x300
+#define bRxAGCEn                 0x1
+#define bRxAGCTogetherEn         0x2
+#define bRxAGCMin                0x4
+#define bRxHP_Ini                0x7
+#define bRxHP_TRLNA              0x70
+#define bRxHP_RSSI               0x700
+#define bRxHP_BBP1               0x7000
+#define bRxHP_BBP2               0x70000
+#define bRxHP_BBP3               0x700000
+#define bRSSI_H                  0x7f0000     //the threshold for high power
+#define bRSSI_Gen                0x7f000000   //the threshold for ant diversity
+#define bRxSettle_TRSW           0x7
+#define bRxSettle_LNA            0x38
+#define bRxSettle_RSSI           0x1c0
+#define bRxSettle_BBP            0xe00
+#define bRxSettle_RxHP           0x7000
+#define bRxSettle_AntSW_RSSI     0x38000
+#define bRxSettle_AntSW          0xc0000
+#define bRxProcessTime_DAGC      0x300000
+#define bRxSettle_HSSI           0x400000
+#define bRxProcessTime_BBPPW     0x800000
+#define bRxAntennaPowerShift     0x3000000
+#define bRSSITableSelect         0xc000000
+#define bRxHP_Final              0x7000000
+#define bRxHTSettle_BBP          0x7
+#define bRxHTSettle_HSSI         0x8
+#define bRxHTSettle_RxHP         0x70
+#define bRxHTSettle_BBPPW        0x80
+#define bRxHTSettle_Idle         0x300
+#define bRxHTSettle_Reserved     0x1c00
+#define bRxHTRxHPEn              0x8000
+#define bRxHTAGCFreezeThres      0x30000
+#define bRxHTAGCTogetherEn       0x40000
+#define bRxHTAGCMin              0x80000
+#define bRxHTAGCEn               0x100000
+#define bRxHTDAGCEn              0x200000
+#define bRxHTRxHP_BBP            0x1c00000
+#define bRxHTRxHP_Final          0xe0000000
+#define bRxPWRatioTH             0x3
+#define bRxPWRatioEn             0x4
+#define bRxMFHold                0x3800
+#define bRxPD_Delay_TH1          0x38
+#define bRxPD_Delay_TH2          0x1c0
+#define bRxPD_DC_COUNT_MAX       0x600
+//#define bRxMF_Hold               0x3800
+#define bRxPD_Delay_TH           0x8000
+#define bRxProcess_Delay         0xf0000
+#define bRxSearchrange_GI2_Early 0x700000
+#define bRxFrame_Guard_Counter_L 0x3800000
+#define bRxSGI_Guard_L           0xc000000
+#define bRxSGI_Search_L          0x30000000
+#define bRxSGI_TH                0xc0000000
+#define bDFSCnt0                 0xff
+#define bDFSCnt1                 0xff00
+#define bDFSFlag                 0xf0000
+
+#define bMFWeightSum             0x300000
+#define bMinIdxTH                0x7f000000
+
+#define bDAFormat                0x40000
+
+#define bTxChEmuEnable           0x01000000
+
+#define bTRSWIsolation_A         0x7f
+#define bTRSWIsolation_B         0x7f00
+#define bTRSWIsolation_C         0x7f0000
+#define bTRSWIsolation_D         0x7f000000
+
+#define bExtLNAGain              0x7c00
+
+//page d
+#define bSTBCEn                  0x4
+#define bAntennaMapping          0x10
+#define bNss                     0x20
+#define bCFOAntSumD              0x200
+#define bPHYCounterReset         0x8000000
+#define bCFOReportGet            0x4000000
+#define bOFDMContinueTx          0x10000000
+#define bOFDMSingleCarrier       0x20000000
+#define bOFDMSingleTone          0x40000000
+//#define bRxPath1                 0x01
+//#define bRxPath2                 0x02
+//#define bRxPath3                 0x04
+//#define bRxPath4                 0x08
+//#define bTxPath1                 0x10
+//#define bTxPath2                 0x20
+#define bHTDetect                0x100
+#define bCFOEn                   0x10000
+#define bCFOValue                0xfff00000
+#define bSigTone_Re              0x3f
+#define bSigTone_Im              0x7f00
+#define bCounter_CCA             0xffff
+#define bCounter_ParityFail      0xffff0000
+#define bCounter_RateIllegal     0xffff
+#define bCounter_CRC8Fail        0xffff0000
+#define bCounter_MCSNoSupport    0xffff
+#define bCounter_FastSync        0xffff
+#define bShortCFO                0xfff
+#define bShortCFOTLength         12   //total
+#define bShortCFOFLength         11   //fraction
+#define bLongCFO                 0x7ff
+#define bLongCFOTLength          11
+#define bLongCFOFLength          11
+#define bTailCFO                 0x1fff
+#define bTailCFOTLength          13
+#define bTailCFOFLength          12
+
+#define bmax_en_pwdB             0xffff
+#define bCC_power_dB             0xffff0000
+#define bnoise_pwdB              0xffff
+#define bPowerMeasTLength        10
+#define bPowerMeasFLength        3
+#define bRx_HT_BW                0x1
+#define bRxSC                    0x6
+#define bRx_HT                   0x8
+
+#define bNB_intf_det_on          0x1
+#define bIntf_win_len_cfg        0x30
+#define bNB_Intf_TH_cfg          0x1c0
+
+#define bRFGain                  0x3f
+#define bTableSel                0x40
+#define bTRSW                    0x80
+
+#define bRxSNR_A                 0xff
+#define bRxSNR_B                 0xff00
+#define bRxSNR_C                 0xff0000
+#define bRxSNR_D                 0xff000000
+#define bSNREVMTLength           8
+#define bSNREVMFLength           1
+
+#define bCSI1st                  0xff
+#define bCSI2nd                  0xff00
+#define bRxEVM1st                0xff0000
+#define bRxEVM2nd                0xff000000
+
+#define bSIGEVM                  0xff
+#define bPWDB                    0xff00
+#define bSGIEN                   0x10000
+
+#define bSFactorQAM1             0xf
+#define bSFactorQAM2             0xf0
+#define bSFactorQAM3             0xf00
+#define bSFactorQAM4             0xf000
+#define bSFactorQAM5             0xf0000
+#define bSFactorQAM6             0xf0000
+#define bSFactorQAM7             0xf00000
+#define bSFactorQAM8             0xf000000
+#define bSFactorQAM9             0xf0000000
+#define bCSIScheme               0x100000
+
+#define bNoiseLvlTopSet          0x3
+#define bChSmooth                0x4
+#define bChSmoothCfg1            0x38
+#define bChSmoothCfg2            0x1c0
+#define bChSmoothCfg3            0xe00
+#define bChSmoothCfg4            0x7000
+#define bMRCMode                 0x800000
+#define bTHEVMCfg                0x7000000
+
+#define bLoopFitType             0x1
+#define bUpdCFO                  0x40
+#define bUpdCFOOffData           0x80
+#define bAdvUpdCFO               0x100
+#define bAdvTimeCtrl             0x800
+#define bUpdClko                 0x1000
+#define bFC                      0x6000
+#define bTrackingMode            0x8000
+#define bPhCmpEnable             0x10000
+#define bUpdClkoLTF              0x20000
+#define bComChCFO                0x40000
+#define bCSIEstiMode             0x80000
+#define bAdvUpdEqz               0x100000
+#define bUChCfg                  0x7000000
+#define bUpdEqz                  0x8000000
+
+//page e
+#define bTxAGCRate18_06			0x7f7f7f7f
+#define bTxAGCRate54_24			0x7f7f7f7f
+#define bTxAGCRateMCS32		0x7f
+#define bTxAGCRateCCK			0x7f00
+#define bTxAGCRateMCS3_MCS0	0x7f7f7f7f
+#define bTxAGCRateMCS7_MCS4	0x7f7f7f7f
+#define bTxAGCRateMCS11_MCS8	0x7f7f7f7f
+#define bTxAGCRateMCS15_MCS12	0x7f7f7f7f
+
+
+//Rx Pseduo noise
+#define bRxPesudoNoiseOn         0x20000000
+#define bRxPesudoNoise_A         0xff
+#define bRxPesudoNoise_B         0xff00
+#define bRxPesudoNoise_C         0xff0000
+#define bRxPesudoNoise_D         0xff000000
+#define bPesudoNoiseState_A      0xffff
+#define bPesudoNoiseState_B      0xffff0000
+#define bPesudoNoiseState_C      0xffff
+#define bPesudoNoiseState_D      0xffff0000
+
+//RF
+//Zebra1
+#define bZebra1_HSSIEnable        0x8
+#define bZebra1_TRxControl        0xc00
+#define bZebra1_TRxGainSetting    0x07f
+#define bZebra1_RxCorner          0xc00
+#define bZebra1_TxChargePump      0x38
+#define bZebra1_RxChargePump      0x7
+#define bZebra1_ChannelNum        0xf80
+#define bZebra1_TxLPFBW           0x400
+#define bZebra1_RxLPFBW           0x600
+
+//Zebra4
+#define bRTL8256RegModeCtrl1      0x100
+#define bRTL8256RegModeCtrl0      0x40
+#define bRTL8256_TxLPFBW          0x18
+#define bRTL8256_RxLPFBW          0x600
+
+//RTL8258
+#define bRTL8258_TxLPFBW          0xc
+#define bRTL8258_RxLPFBW          0xc00
+#define bRTL8258_RSSILPFBW        0xc0
+
+//byte endable for sb_write
+#define bByte0                    0x1
+#define bByte1                    0x2
+#define bByte2                    0x4
+#define bByte3                    0x8
+#define bWord0                    0x3
+#define bWord1                    0xc
+#define bDWord                    0xf
+
+//for PutRegsetting & GetRegSetting BitMask
+#define bMaskByte0                0xff
+#define bMaskByte1                0xff00
+#define bMaskByte2                0xff0000
+#define bMaskByte3                0xff000000
+#define bMaskHWord                0xffff0000
+#define bMaskLWord                0x0000ffff
+#define bMaskDWord                0xffffffff
+
+//for PutRFRegsetting & GetRFRegSetting BitMask
+#define bMask12Bits               0xfff
+
+#define bEnable                   0x1
+#define bDisable                  0x0
+
+#define LeftAntenna               0x0
+#define RightAntenna              0x1
+
+#define tCheckTxStatus            500   //500ms
+#define tUpdateRxCounter          100   //100ms
+
+#define rateCCK     0
+#define rateOFDM    1
+#define rateHT      2
+
+//define Register-End
+#define bPMAC_End                 0x1ff
+#define bFPGAPHY0_End             0x8ff
+#define bFPGAPHY1_End             0x9ff
+#define bCCKPHY0_End              0xaff
+#define bOFDMPHY0_End             0xcff
+#define bOFDMPHY1_End             0xdff
+
+//define max debug item in each debug page
+//#define bMaxItem_FPGA_PHY0        0x9
+//#define bMaxItem_FPGA_PHY1        0x3
+//#define bMaxItem_PHY_11B          0x16
+//#define bMaxItem_OFDM_PHY0        0x29
+//#define bMaxItem_OFDM_PHY1        0x0
+
+#define bPMACControl              0x0
+#define bWMACControl              0x1
+#define bWNICControl              0x2
+
+#define PathA                     0x0
+#define PathB                     0x1
+#define PathC                     0x2
+#define PathD                     0x3
+
+#define	rRTL8256RxMixerPole		0xb
+#define 	bZebraRxMixerPole		0x6
+#define 	rRTL8256TxBBOPBias        0x9
+#define 	bRTL8256TxBBOPBias       0x400
+#define 	rRTL8256TxBBBW             19
+#define 	bRTL8256TxBBBW            	0x18
+
+#endif	//__INC_HAL8190PCIPHYREG_H
diff --git a/drivers/staging/samsung-laptop/Kconfig b/drivers/staging/samsung-laptop/Kconfig
new file mode 100644
index 000000000000..f27c60864c26
--- /dev/null
+++ b/drivers/staging/samsung-laptop/Kconfig
@@ -0,0 +1,10 @@
+config SAMSUNG_LAPTOP
+	tristate "Samsung Laptop driver"
+	default n
+	depends on RFKILL && BACKLIGHT_CLASS_DEVICE && X86
+	help
+	  This module implements a driver for the N128 Samsung Laptop
+	  providing control over the Wireless LED and the LCD backlight
+
+	  To compile this driver as a module, choose
+	  M here: the module will be called samsung-laptop.
diff --git a/drivers/staging/samsung-laptop/Makefile b/drivers/staging/samsung-laptop/Makefile
new file mode 100644
index 000000000000..3c6f42045211
--- /dev/null
+++ b/drivers/staging/samsung-laptop/Makefile
@@ -0,0 +1 @@
+obj-$(CONFIG_SAMSUNG_LAPTOP)	+= samsung-laptop.o
diff --git a/drivers/staging/samsung-laptop/TODO b/drivers/staging/samsung-laptop/TODO
new file mode 100644
index 000000000000..f7a6d589916e
--- /dev/null
+++ b/drivers/staging/samsung-laptop/TODO
@@ -0,0 +1,5 @@
+TODO:
+	- review from other developers
+	- figure out ACPI video issues
+
+Please send patches to Greg Kroah-Hartman <gregkh@suse.de>
diff --git a/drivers/staging/samsung-laptop/samsung-laptop.c b/drivers/staging/samsung-laptop/samsung-laptop.c
new file mode 100644
index 000000000000..4877138a9f96
--- /dev/null
+++ b/drivers/staging/samsung-laptop/samsung-laptop.c
@@ -0,0 +1,542 @@
+/*
+ * Samsung N130 Laptop driver
+ *
+ * Copyright (C) 2009 Greg Kroah-Hartman (gregkh@suse.de)
+ * Copyright (C) 2009 Novell Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation.
+ *
+ */
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/delay.h>
+#include <linux/pci.h>
+#include <linux/backlight.h>
+#include <linux/fb.h>
+#include <linux/dmi.h>
+#include <linux/platform_device.h>
+#include <linux/rfkill.h>
+
+/*
+ * This driver is needed because a number of Samsung laptops do not hook
+ * their control settings through ACPI.  So we have to poke around in the
+ * BIOS to do things like brightness values, and "special" key controls.
+ */
+
+/*
+ * We have 0 - 8 as valid brightness levels.  The specs say that level 0 should
+ * be reserved by the BIOS (which really doesn't make much sense), we tell
+ * userspace that the value is 0 - 7 and then just tell the hardware 1 - 8
+ */
+#define MAX_BRIGHT	0x07
+
+/* Brightness is 0 - 8, as described above.  Value 0 is for the BIOS to use */
+#define GET_BRIGHTNESS			0x00
+#define SET_BRIGHTNESS			0x01
+
+/* first byte:
+ * 0x00 - wireless is off
+ * 0x01 - wireless is on
+ * second byte:
+ * 0x02 - 3G is off
+ * 0x03 - 3G is on
+ * TODO, verify 3G is correct, that doesn't seem right...
+ */
+#define GET_WIRELESS_BUTTON		0x02
+#define SET_WIRELESS_BUTTON		0x03
+
+/* 0 is off, 1 is on */
+#define GET_BACKLIGHT			0x04
+#define SET_BACKLIGHT			0x05
+
+/*
+ * 0x80 or 0x00 - no action
+ * 0x81 - recovery key pressed
+ */
+#define GET_RECOVERY_METHOD		0x06
+#define SET_RECOVERY_METHOD		0x07
+
+/* 0 is low, 1 is high */
+#define GET_PERFORMANCE_LEVEL		0x08
+#define SET_PERFORMANCE_LEVEL		0x09
+
+/*
+ * Tell the BIOS that Linux is running on this machine.
+ * 81 is on, 80 is off
+ */
+#define SET_LINUX			0x0a
+
+
+#define MAIN_FUNCTION			0x4c49
+
+#define SABI_HEADER_PORT		0x00
+#define SABI_HEADER_RE_MEM		0x02
+#define SABI_HEADER_IFACEFUNC		0x03
+#define SABI_HEADER_EN_MEM		0x04
+#define SABI_HEADER_DATA_OFFSET		0x05
+#define SABI_HEADER_DATA_SEGMENT	0x07
+
+#define SABI_IFACE_MAIN			0x00
+#define SABI_IFACE_SUB			0x02
+#define SABI_IFACE_COMPLETE		0x04
+#define SABI_IFACE_DATA			0x05
+
+/* Structure to get data back to the calling function */
+struct sabi_retval {
+	u8 retval[20];
+};
+
+static void __iomem *sabi;
+static void __iomem *sabi_iface;
+static void __iomem *f0000_segment;
+static struct backlight_device *backlight_device;
+static struct mutex sabi_mutex;
+static struct platform_device *sdev;
+static struct rfkill *rfk;
+
+static int force;
+module_param(force, bool, 0);
+MODULE_PARM_DESC(force, "Disable the DMI check and forces the driver to be loaded");
+
+static int debug;
+module_param(debug, bool, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(debug, "Debug enabled or not");
+
+static int sabi_get_command(u8 command, struct sabi_retval *sretval)
+{
+	int retval = 0;
+	u16 port = readw(sabi + SABI_HEADER_PORT);
+
+	mutex_lock(&sabi_mutex);
+
+	/* enable memory to be able to write to it */
+	outb(readb(sabi + SABI_HEADER_EN_MEM), port);
+
+	/* write out the command */
+	writew(MAIN_FUNCTION, sabi_iface + SABI_IFACE_MAIN);
+	writew(command, sabi_iface + SABI_IFACE_SUB);
+	writeb(0, sabi_iface + SABI_IFACE_COMPLETE);
+	outb(readb(sabi + SABI_HEADER_IFACEFUNC), port);
+
+	/* write protect memory to make it safe */
+	outb(readb(sabi + SABI_HEADER_RE_MEM), port);
+
+	/* see if the command actually succeeded */
+	if (readb(sabi_iface + SABI_IFACE_COMPLETE) == 0xaa &&
+	    readb(sabi_iface + SABI_IFACE_DATA) != 0xff) {
+		/*
+		 * It did!
+		 * Save off the data into a structure so the caller use it.
+		 * Right now we only care about the first 4 bytes,
+		 * I suppose there are commands that need more, but I don't
+		 * know about them.
+		 */
+		sretval->retval[0] = readb(sabi_iface + SABI_IFACE_DATA);
+		sretval->retval[1] = readb(sabi_iface + SABI_IFACE_DATA + 1);
+		sretval->retval[2] = readb(sabi_iface + SABI_IFACE_DATA + 2);
+		sretval->retval[3] = readb(sabi_iface + SABI_IFACE_DATA + 3);
+		goto exit;
+	}
+
+	/* Something bad happened, so report it and error out */
+	printk(KERN_WARNING "SABI command 0x%02x failed with completion flag 0x%02x and output 0x%02x\n",
+		command, readb(sabi_iface + SABI_IFACE_COMPLETE),
+		readb(sabi_iface + SABI_IFACE_DATA));
+	retval = -EINVAL;
+exit:
+	mutex_unlock(&sabi_mutex);
+	return retval;
+
+}
+
+static int sabi_set_command(u8 command, u8 data)
+{
+	int retval = 0;
+	u16 port = readw(sabi + SABI_HEADER_PORT);
+
+	mutex_lock(&sabi_mutex);
+
+	/* enable memory to be able to write to it */
+	outb(readb(sabi + SABI_HEADER_EN_MEM), port);
+
+	/* write out the command */
+	writew(MAIN_FUNCTION, sabi_iface + SABI_IFACE_MAIN);
+	writew(command, sabi_iface + SABI_IFACE_SUB);
+	writeb(0, sabi_iface + SABI_IFACE_COMPLETE);
+	writeb(data, sabi_iface + SABI_IFACE_DATA);
+	outb(readb(sabi + SABI_HEADER_IFACEFUNC), port);
+
+	/* write protect memory to make it safe */
+	outb(readb(sabi + SABI_HEADER_RE_MEM), port);
+
+	/* see if the command actually succeeded */
+	if (readb(sabi_iface + SABI_IFACE_COMPLETE) == 0xaa &&
+	    readb(sabi_iface + SABI_IFACE_DATA) != 0xff) {
+		/* it did! */
+		goto exit;
+	}
+
+	/* Something bad happened, so report it and error out */
+	printk(KERN_WARNING "SABI command 0x%02x failed with completion flag 0x%02x and output 0x%02x\n",
+		command, readb(sabi_iface + SABI_IFACE_COMPLETE),
+		readb(sabi_iface + SABI_IFACE_DATA));
+	retval = -EINVAL;
+exit:
+	mutex_unlock(&sabi_mutex);
+	return retval;
+}
+
+static void test_backlight(void)
+{
+	struct sabi_retval sretval;
+
+	sabi_get_command(GET_BACKLIGHT, &sretval);
+	printk(KERN_DEBUG "backlight = 0x%02x\n", sretval.retval[0]);
+
+	sabi_set_command(SET_BACKLIGHT, 0);
+	printk(KERN_DEBUG "backlight should be off\n");
+
+	sabi_get_command(GET_BACKLIGHT, &sretval);
+	printk(KERN_DEBUG "backlight = 0x%02x\n", sretval.retval[0]);
+
+	msleep(1000);
+
+	sabi_set_command(SET_BACKLIGHT, 1);
+	printk(KERN_DEBUG "backlight should be on\n");
+
+	sabi_get_command(GET_BACKLIGHT, &sretval);
+	printk(KERN_DEBUG "backlight = 0x%02x\n", sretval.retval[0]);
+}
+
+static void test_wireless(void)
+{
+	struct sabi_retval sretval;
+
+	sabi_get_command(GET_WIRELESS_BUTTON, &sretval);
+	printk(KERN_DEBUG "wireless led = 0x%02x\n", sretval.retval[0]);
+
+	sabi_set_command(SET_WIRELESS_BUTTON, 0);
+	printk(KERN_DEBUG "wireless led should be off\n");
+
+	sabi_get_command(GET_WIRELESS_BUTTON, &sretval);
+	printk(KERN_DEBUG "wireless led = 0x%02x\n", sretval.retval[0]);
+
+	msleep(1000);
+
+	sabi_set_command(SET_WIRELESS_BUTTON, 1);
+	printk(KERN_DEBUG "wireless led should be on\n");
+
+	sabi_get_command(GET_WIRELESS_BUTTON, &sretval);
+	printk(KERN_DEBUG "wireless led = 0x%02x\n", sretval.retval[0]);
+}
+
+static u8 read_brightness(void)
+{
+	struct sabi_retval sretval;
+	int user_brightness = 0;
+	int retval;
+
+	retval = sabi_get_command(GET_BRIGHTNESS, &sretval);
+	if (!retval)
+		user_brightness = sretval.retval[0];
+		if (user_brightness != 0)
+			--user_brightness;
+	return user_brightness;
+}
+
+static void set_brightness(u8 user_brightness)
+{
+	sabi_set_command(SET_BRIGHTNESS, user_brightness + 1);
+}
+
+static int get_brightness(struct backlight_device *bd)
+{
+	return (int)read_brightness();
+}
+
+static int update_status(struct backlight_device *bd)
+{
+	set_brightness(bd->props.brightness);
+
+	if (bd->props.power == FB_BLANK_UNBLANK)
+		sabi_set_command(SET_BACKLIGHT, 1);
+	else
+		sabi_set_command(SET_BACKLIGHT, 0);
+	return 0;
+}
+
+static struct backlight_ops backlight_ops = {
+	.get_brightness	= get_brightness,
+	.update_status	= update_status,
+};
+
+static int rfkill_set(void *data, bool blocked)
+{
+	/* Do something with blocked...*/
+	/*
+	 * blocked == false is on
+	 * blocked == true is off
+	 */
+	if (blocked)
+		sabi_set_command(SET_WIRELESS_BUTTON, 0);
+	else
+		sabi_set_command(SET_WIRELESS_BUTTON, 1);
+
+	return 0;
+}
+
+static struct rfkill_ops rfkill_ops = {
+	.set_block = rfkill_set,
+};
+
+static int init_wireless(struct platform_device *sdev)
+{
+	int retval;
+
+	rfk = rfkill_alloc("samsung-wifi", &sdev->dev, RFKILL_TYPE_WLAN,
+			   &rfkill_ops, NULL);
+	if (!rfk)
+		return -ENOMEM;
+
+	retval = rfkill_register(rfk);
+	if (retval) {
+		rfkill_destroy(rfk);
+		return -ENODEV;
+	}
+
+	return 0;
+}
+
+static void destroy_wireless(void)
+{
+	rfkill_unregister(rfk);
+	rfkill_destroy(rfk);
+}
+
+static ssize_t get_silent_state(struct device *dev,
+				struct device_attribute *attr, char *buf)
+{
+	struct sabi_retval sretval;
+	int retval;
+
+	/* Read the state */
+	retval = sabi_get_command(GET_PERFORMANCE_LEVEL, &sretval);
+	if (retval)
+		return retval;
+
+	/* The logic is backwards, yeah, lots of fun... */
+	if (sretval.retval[0] == 0)
+		retval = 1;
+	else
+		retval = 0;
+	return sprintf(buf, "%d\n", retval);
+}
+
+static ssize_t set_silent_state(struct device *dev,
+				struct device_attribute *attr, const char *buf,
+				size_t count)
+{
+	char value;
+
+	if (count >= 1) {
+		value = buf[0];
+		if ((value == '0') || (value == 'n') || (value == 'N')) {
+			/* Turn speed up */
+			sabi_set_command(SET_PERFORMANCE_LEVEL, 0x01);
+		} else if ((value == '1') || (value == 'y') || (value == 'Y')) {
+			/* Turn speed down */
+			sabi_set_command(SET_PERFORMANCE_LEVEL, 0x00);
+		} else {
+			return -EINVAL;
+		}
+	}
+	return count;
+}
+static DEVICE_ATTR(silent, S_IWUGO | S_IRUGO,
+		   get_silent_state, set_silent_state);
+
+
+static int __init dmi_check_cb(const struct dmi_system_id *id)
+{
+	printk(KERN_INFO KBUILD_MODNAME ": found laptop model '%s'\n",
+		id->ident);
+	return 0;
+}
+
+static struct dmi_system_id __initdata samsung_dmi_table[] = {
+	{
+		.ident = "N128",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "N128"),
+			DMI_MATCH(DMI_BOARD_NAME, "N128"),
+		},
+		.callback = dmi_check_cb,
+	},
+	{
+		.ident = "N130",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "N130"),
+			DMI_MATCH(DMI_BOARD_NAME, "N130"),
+		},
+		.callback = dmi_check_cb,
+	},
+	{ },
+};
+MODULE_DEVICE_TABLE(dmi, samsung_dmi_table);
+
+static int __init samsung_init(void)
+{
+	struct sabi_retval sretval;
+	const char *testStr = "SECLINUX";
+	void __iomem *memcheck;
+	unsigned int ifaceP;
+	int pStr;
+	int loca;
+	int retval;
+
+	mutex_init(&sabi_mutex);
+
+	if (!force && !dmi_check_system(samsung_dmi_table))
+		return -ENODEV;
+
+	f0000_segment = ioremap(0xf0000, 0xffff);
+	if (!f0000_segment) {
+		printk(KERN_ERR "Can't map the segment at 0xf0000\n");
+		return -EINVAL;
+	}
+
+	/* Try to find the signature "SECLINUX" in memory to find the header */
+	pStr = 0;
+	memcheck = f0000_segment;
+	for (loca = 0; loca < 0xffff; loca++) {
+		char temp = readb(memcheck + loca);
+
+		if (temp == testStr[pStr]) {
+			if (pStr == strlen(testStr)-1)
+				break;
+			++pStr;
+		} else {
+			pStr = 0;
+		}
+	}
+	if (loca == 0xffff) {
+		printk(KERN_ERR "This computer does not support SABI\n");
+		goto error_no_signature;
+		}
+
+	/* point to the SMI port Number */
+	loca += 1;
+	sabi = (memcheck + loca);
+
+	if (debug) {
+		printk(KERN_DEBUG "This computer supports SABI==%x\n",
+			loca + 0xf0000 - 6);
+		printk(KERN_DEBUG "SABI header:\n");
+		printk(KERN_DEBUG " SMI Port Number = 0x%04x\n",
+			readw(sabi + SABI_HEADER_PORT));
+		printk(KERN_DEBUG " SMI Interface Function = 0x%02x\n",
+			readb(sabi + SABI_HEADER_IFACEFUNC));
+		printk(KERN_DEBUG " SMI enable memory buffer = 0x%02x\n",
+			readb(sabi + SABI_HEADER_EN_MEM));
+		printk(KERN_DEBUG " SMI restore memory buffer = 0x%02x\n",
+			readb(sabi + SABI_HEADER_RE_MEM));
+		printk(KERN_DEBUG " SABI data offset = 0x%04x\n",
+			readw(sabi + SABI_HEADER_DATA_OFFSET));
+		printk(KERN_DEBUG " SABI data segment = 0x%04x\n",
+			readw(sabi + SABI_HEADER_DATA_SEGMENT));
+	}
+
+	/* Get a pointer to the SABI Interface */
+	ifaceP = (readw(sabi + SABI_HEADER_DATA_SEGMENT) & 0x0ffff) << 4;
+	ifaceP += readw(sabi + SABI_HEADER_DATA_OFFSET) & 0x0ffff;
+	sabi_iface = ioremap(ifaceP, 16);
+	if (!sabi_iface) {
+		printk(KERN_ERR "Can't remap %x\n", ifaceP);
+		goto exit;
+	}
+	if (debug) {
+		printk(KERN_DEBUG "ifaceP = 0x%08x\n", ifaceP);
+		printk(KERN_DEBUG "sabi_iface = %p\n", sabi_iface);
+
+		test_backlight();
+		test_wireless();
+
+		retval = sabi_get_command(GET_BRIGHTNESS, &sretval);
+		printk(KERN_DEBUG "brightness = 0x%02x\n", sretval.retval[0]);
+	}
+
+	/* Turn on "Linux" mode in the BIOS */
+	retval = sabi_set_command(SET_LINUX, 0x81);
+	if (retval) {
+		printk(KERN_ERR KBUILD_MODNAME ": Linux mode was not set!\n");
+		goto error_no_platform;
+	}
+
+	/* knock up a platform device to hang stuff off of */
+	sdev = platform_device_register_simple("samsung", -1, NULL, 0);
+	if (IS_ERR(sdev))
+		goto error_no_platform;
+
+	/* create a backlight device to talk to this one */
+	backlight_device = backlight_device_register("samsung", &sdev->dev,
+						     NULL, &backlight_ops);
+	if (IS_ERR(backlight_device))
+		goto error_no_backlight;
+
+	backlight_device->props.max_brightness = MAX_BRIGHT;
+	backlight_device->props.brightness = read_brightness();
+	backlight_device->props.power = FB_BLANK_UNBLANK;
+	backlight_update_status(backlight_device);
+
+	retval = init_wireless(sdev);
+	if (retval)
+		goto error_no_rfk;
+
+	retval = device_create_file(&sdev->dev, &dev_attr_silent);
+	if (retval)
+		goto error_file_create;
+
+exit:
+	return 0;
+
+error_file_create:
+	destroy_wireless();
+
+error_no_rfk:
+	backlight_device_unregister(backlight_device);
+
+error_no_backlight:
+	platform_device_unregister(sdev);
+
+error_no_platform:
+	iounmap(sabi_iface);
+
+error_no_signature:
+	iounmap(f0000_segment);
+	return -EINVAL;
+}
+
+static void __exit samsung_exit(void)
+{
+	/* Turn off "Linux" mode in the BIOS */
+	sabi_set_command(SET_LINUX, 0x80);
+
+	device_remove_file(&sdev->dev, &dev_attr_silent);
+	backlight_device_unregister(backlight_device);
+	destroy_wireless();
+	iounmap(sabi_iface);
+	iounmap(f0000_segment);
+	platform_device_unregister(sdev);
+}
+
+module_init(samsung_init);
+module_exit(samsung_exit);
+
+MODULE_AUTHOR("Greg Kroah-Hartman <gregkh@suse.de>");
+MODULE_DESCRIPTION("Samsung Backlight driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/staging/sep/sep_driver.c b/drivers/staging/sep/sep_driver.c
index f890a16096c0..e7bc9ec63a8c 100644
--- a/drivers/staging/sep/sep_driver.c
+++ b/drivers/staging/sep/sep_driver.c
@@ -273,7 +273,8 @@ static dma_addr_t sep_shared_virt_to_bus(struct sep_device *sep,
 						void *virt_address)
 {
 	dma_addr_t pa = sep->shared_bus + (virt_address - sep->shared_addr);
-	edbg("sep: virt to bus b %08llx v %p\n", pa, virt_address);
+	edbg("sep: virt to bus b %08llx v %p\n",
+		(unsigned long long)pa, virt_address);
 	return pa;
 }
 
@@ -1788,6 +1789,7 @@ static int sep_create_flow_dma_tables_handler(struct sep_device *sep,
 	first_table_data.physical_address = 0xffffffff;
 
 	/* find the free structure for flow data */
+	error = -EINVAL;
 	flow_context_ptr = sep_find_flow_context(sep, SEP_FREE_FLOW_ID);
 	if (flow_context_ptr == NULL)
 		goto end_function;
@@ -2447,7 +2449,7 @@ static void sep_configure_dma_burst(struct sep_device *sep)
 #endif
 
 /*
-  Function that is activaed on the succesful probe of the SEP device
+  Function that is activated on the successful probe of the SEP device
 */
 static int __devinit sep_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 {
diff --git a/drivers/staging/serqt_usb2/serqt_usb2.c b/drivers/staging/serqt_usb2/serqt_usb2.c
index 52af44cfbe83..060e9de3b065 100644
--- a/drivers/staging/serqt_usb2/serqt_usb2.c
+++ b/drivers/staging/serqt_usb2/serqt_usb2.c
@@ -929,7 +929,7 @@ static int qt_open(struct tty_struct *tty,
 	dbg(__FILE__ "qt_setuart completed.\n");
 
 	/*
-	 * Put this here to make it responsive to stty and defauls set by
+	 * Put this here to make it responsive to stty and defaults set by
 	 * the tty layer
 	 */
 	/* FIXME: is this needed? */
diff --git a/drivers/staging/slicoss/slicoss.c b/drivers/staging/slicoss/slicoss.c
index e67a130f9e46..5b191afc1442 100644
--- a/drivers/staging/slicoss/slicoss.c
+++ b/drivers/staging/slicoss/slicoss.c
@@ -354,7 +354,6 @@ static const struct net_device_ops slic_netdev_ops = {
 	.ndo_get_stats		= slic_get_stats,
 	.ndo_set_multicast_list	= slic_mcast_set_list,
 	.ndo_validate_addr	= eth_validate_addr,
-	.ndo_set_mac_address	= eth_mac_addr,
 	.ndo_change_mtu		= eth_change_mtu,
 };
 
diff --git a/drivers/staging/sm7xx/Kconfig b/drivers/staging/sm7xx/Kconfig
new file mode 100644
index 000000000000..204dbfc3c38b
--- /dev/null
+++ b/drivers/staging/sm7xx/Kconfig
@@ -0,0 +1,15 @@
+config FB_SM7XX
+	tristate "Silicon Motion SM7XX Frame Buffer Support"
+	depends on FB
+	select FB_CFB_FILLRECT
+	select FB_CFB_COPYAREA
+	select FB_CFB_IMAGEBLIT
+	help
+	  Frame Buffer driver for the Silicon Motion SM7XX serial graphic card.
+
+config FB_SM7XX_ACCEL
+	bool "Siliconmotion Acceleration functions (EXPERIMENTAL)"
+	depends on FB_SM7XX && EXPERIMENTAL
+	help
+	  This will compile the Trident frame buffer device with
+	  acceleration functions.
diff --git a/drivers/staging/sm7xx/Makefile b/drivers/staging/sm7xx/Makefile
new file mode 100644
index 000000000000..f43cb9106305
--- /dev/null
+++ b/drivers/staging/sm7xx/Makefile
@@ -0,0 +1,3 @@
+obj-$(CONFIG_FB_SM7XX) += sm7xx.o
+
+sm7xx-y := smtcfb.o
diff --git a/drivers/staging/sm7xx/TODO b/drivers/staging/sm7xx/TODO
new file mode 100644
index 000000000000..1f61f5e11cf5
--- /dev/null
+++ b/drivers/staging/sm7xx/TODO
@@ -0,0 +1,10 @@
+TODO:
+- Dual head support
+- use kernel coding style
+- checkpatch.pl clean
+- refine the code and remove unused code
+- use kernel framebuffer mode setting instead of hard code
+- move it to drivers/video/sm7xx/ or make it be drivers/video/sm7xxfb.c
+
+Please send any patches to Greg Kroah-Hartman <greg@kroah.com> and
+Teddy Wang <teddy.wang@siliconmotion.com.cn>.
diff --git a/drivers/staging/sm7xx/smtc2d.c b/drivers/staging/sm7xx/smtc2d.c
new file mode 100644
index 000000000000..133b86c6a678
--- /dev/null
+++ b/drivers/staging/sm7xx/smtc2d.c
@@ -0,0 +1,979 @@
+/*
+ * Silicon Motion SM7XX 2D drawing engine functions.
+ *
+ * Copyright (C) 2006 Silicon Motion Technology Corp.
+ * Author: Boyod boyod.yang@siliconmotion.com.cn
+ *
+ * Copyright (C) 2009 Lemote, Inc.
+ * Author: Wu Zhangjin, wuzj@lemote.com
+ *
+ *  This file is subject to the terms and conditions of the GNU General Public
+ *  License. See the file COPYING in the main directory of this archive for
+ *  more details.
+ *
+ * Version 0.10.26192.21.01
+ * 	- Add PowerPC support
+ * 	- Add 2D support for Lynx -
+ * Verified on 2.6.19.2
+ * 	Boyod.yang  <boyod.yang@siliconmotion.com.cn>
+ */
+
+unsigned char smtc_de_busy;
+
+void SMTC_write2Dreg(unsigned long nOffset, unsigned long nData)
+{
+	writel(nData, smtc_2DBaseAddress + nOffset);
+}
+
+unsigned long SMTC_read2Dreg(unsigned long nOffset)
+{
+	return readl(smtc_2DBaseAddress + nOffset);
+}
+
+void SMTC_write2Ddataport(unsigned long nOffset, unsigned long nData)
+{
+	writel(nData, smtc_2Ddataport + nOffset);
+}
+
+/**********************************************************************
+ *
+ * deInit
+ *
+ * Purpose
+ *    Drawing engine initialization.
+ *
+ **********************************************************************/
+
+void deInit(unsigned int nModeWidth, unsigned int nModeHeight,
+		unsigned int bpp)
+{
+	/* Get current power configuration. */
+	unsigned char clock;
+	clock = smtc_seqr(0x21);
+
+	/* initialize global 'mutex lock' variable */
+	smtc_de_busy = 0;
+
+	/* Enable 2D Drawing Engine */
+	smtc_seqw(0x21, clock & 0xF8);
+
+	SMTC_write2Dreg(DE_CLIP_TL,
+			FIELD_VALUE(0, DE_CLIP_TL, TOP, 0) |
+			FIELD_SET(0, DE_CLIP_TL, STATUS, DISABLE) |
+			FIELD_SET(0, DE_CLIP_TL, INHIBIT, OUTSIDE) |
+			FIELD_VALUE(0, DE_CLIP_TL, LEFT, 0));
+
+	if (bpp >= 24) {
+		SMTC_write2Dreg(DE_PITCH,
+				FIELD_VALUE(0, DE_PITCH, DESTINATION,
+					    nModeWidth * 3) | FIELD_VALUE(0,
+								  DE_PITCH,
+								  SOURCE,
+								  nModeWidth
+								  * 3));
+	} else {
+		SMTC_write2Dreg(DE_PITCH,
+				FIELD_VALUE(0, DE_PITCH, DESTINATION,
+					    nModeWidth) | FIELD_VALUE(0,
+							      DE_PITCH,
+							      SOURCE,
+							      nModeWidth));
+	}
+
+	SMTC_write2Dreg(DE_WINDOW_WIDTH,
+			FIELD_VALUE(0, DE_WINDOW_WIDTH, DESTINATION,
+				    nModeWidth) | FIELD_VALUE(0,
+							      DE_WINDOW_WIDTH,
+							      SOURCE,
+							      nModeWidth));
+
+	switch (bpp) {
+	case 8:
+		SMTC_write2Dreg(DE_STRETCH_FORMAT,
+				FIELD_SET(0, DE_STRETCH_FORMAT, PATTERN_XY,
+					  NORMAL) | FIELD_VALUE(0,
+							DE_STRETCH_FORMAT,
+							PATTERN_Y,
+							0) |
+				FIELD_VALUE(0, DE_STRETCH_FORMAT, PATTERN_X,
+				    0) | FIELD_SET(0, DE_STRETCH_FORMAT,
+						   PIXEL_FORMAT,
+						   8) | FIELD_SET(0,
+							  DE_STRETCH_FORMAT,
+							  ADDRESSING,
+							  XY) |
+				FIELD_VALUE(0, DE_STRETCH_FORMAT,
+					SOURCE_HEIGHT, 3));
+		break;
+	case 24:
+		SMTC_write2Dreg(DE_STRETCH_FORMAT,
+				FIELD_SET(0, DE_STRETCH_FORMAT, PATTERN_XY,
+					  NORMAL) | FIELD_VALUE(0,
+							DE_STRETCH_FORMAT,
+							PATTERN_Y,
+							0) |
+				FIELD_VALUE(0, DE_STRETCH_FORMAT, PATTERN_X,
+				    0) | FIELD_SET(0, DE_STRETCH_FORMAT,
+							   PIXEL_FORMAT,
+							   24) | FIELD_SET(0,
+							   DE_STRETCH_FORMAT,
+							   ADDRESSING,
+							   XY) |
+				FIELD_VALUE(0, DE_STRETCH_FORMAT,
+					SOURCE_HEIGHT, 3));
+		break;
+	case 16:
+	default:
+		SMTC_write2Dreg(DE_STRETCH_FORMAT,
+				FIELD_SET(0, DE_STRETCH_FORMAT, PATTERN_XY,
+					  NORMAL) | FIELD_VALUE(0,
+							DE_STRETCH_FORMAT,
+							PATTERN_Y,
+							0) |
+				FIELD_VALUE(0, DE_STRETCH_FORMAT, PATTERN_X,
+				    0) | FIELD_SET(0, DE_STRETCH_FORMAT,
+							   PIXEL_FORMAT,
+							   16) | FIELD_SET(0,
+							   DE_STRETCH_FORMAT,
+							   ADDRESSING,
+							   XY) |
+				FIELD_VALUE(0, DE_STRETCH_FORMAT,
+					SOURCE_HEIGHT, 3));
+		break;
+	}
+
+	SMTC_write2Dreg(DE_MASKS,
+			FIELD_VALUE(0, DE_MASKS, BYTE_MASK, 0xFFFF) |
+			FIELD_VALUE(0, DE_MASKS, BIT_MASK, 0xFFFF));
+	SMTC_write2Dreg(DE_COLOR_COMPARE_MASK,
+			FIELD_VALUE(0, DE_COLOR_COMPARE_MASK, MASKS, \
+				0xFFFFFF));
+	SMTC_write2Dreg(DE_COLOR_COMPARE,
+			FIELD_VALUE(0, DE_COLOR_COMPARE, COLOR, 0xFFFFFF));
+}
+
+void deVerticalLine(unsigned long dst_base,
+		    unsigned long dst_pitch,
+		    unsigned long nX,
+		    unsigned long nY,
+		    unsigned long dst_height, unsigned long nColor)
+{
+	deWaitForNotBusy();
+
+	SMTC_write2Dreg(DE_WINDOW_DESTINATION_BASE,
+			FIELD_VALUE(0, DE_WINDOW_DESTINATION_BASE, ADDRESS,
+				    dst_base));
+
+	SMTC_write2Dreg(DE_PITCH,
+			FIELD_VALUE(0, DE_PITCH, DESTINATION, dst_pitch) |
+			FIELD_VALUE(0, DE_PITCH, SOURCE, dst_pitch));
+
+	SMTC_write2Dreg(DE_WINDOW_WIDTH,
+			FIELD_VALUE(0, DE_WINDOW_WIDTH, DESTINATION,
+			    dst_pitch) | FIELD_VALUE(0, DE_WINDOW_WIDTH,
+						     SOURCE,
+						     dst_pitch));
+
+	SMTC_write2Dreg(DE_FOREGROUND,
+			FIELD_VALUE(0, DE_FOREGROUND, COLOR, nColor));
+
+	SMTC_write2Dreg(DE_DESTINATION,
+			FIELD_SET(0, DE_DESTINATION, WRAP, DISABLE) |
+			FIELD_VALUE(0, DE_DESTINATION, X, nX) |
+			FIELD_VALUE(0, DE_DESTINATION, Y, nY));
+
+	SMTC_write2Dreg(DE_DIMENSION,
+			FIELD_VALUE(0, DE_DIMENSION, X, 1) |
+			FIELD_VALUE(0, DE_DIMENSION, Y_ET, dst_height));
+
+	SMTC_write2Dreg(DE_CONTROL,
+			FIELD_SET(0, DE_CONTROL, STATUS, START) |
+			FIELD_SET(0, DE_CONTROL, DIRECTION, LEFT_TO_RIGHT) |
+			FIELD_SET(0, DE_CONTROL, MAJOR, Y) |
+			FIELD_SET(0, DE_CONTROL, STEP_X, NEGATIVE) |
+			FIELD_SET(0, DE_CONTROL, STEP_Y, POSITIVE) |
+			FIELD_SET(0, DE_CONTROL, LAST_PIXEL, OFF) |
+			FIELD_SET(0, DE_CONTROL, COMMAND, SHORT_STROKE) |
+			FIELD_SET(0, DE_CONTROL, ROP_SELECT, ROP2) |
+			FIELD_VALUE(0, DE_CONTROL, ROP, 0x0C));
+
+	smtc_de_busy = 1;
+}
+
+void deHorizontalLine(unsigned long dst_base,
+		      unsigned long dst_pitch,
+		      unsigned long nX,
+		      unsigned long nY,
+		      unsigned long dst_width, unsigned long nColor)
+{
+	deWaitForNotBusy();
+
+	SMTC_write2Dreg(DE_WINDOW_DESTINATION_BASE,
+			FIELD_VALUE(0, DE_WINDOW_DESTINATION_BASE, ADDRESS,
+				    dst_base));
+
+	SMTC_write2Dreg(DE_PITCH,
+			FIELD_VALUE(0, DE_PITCH, DESTINATION, dst_pitch) |
+			FIELD_VALUE(0, DE_PITCH, SOURCE, dst_pitch));
+
+	SMTC_write2Dreg(DE_WINDOW_WIDTH,
+			FIELD_VALUE(0, DE_WINDOW_WIDTH, DESTINATION,
+			    dst_pitch) | FIELD_VALUE(0, DE_WINDOW_WIDTH,
+						     SOURCE,
+						     dst_pitch));
+	SMTC_write2Dreg(DE_FOREGROUND,
+			FIELD_VALUE(0, DE_FOREGROUND, COLOR, nColor));
+	SMTC_write2Dreg(DE_DESTINATION,
+			FIELD_SET(0, DE_DESTINATION, WRAP,
+			  DISABLE) | FIELD_VALUE(0, DE_DESTINATION, X,
+						 nX) | FIELD_VALUE(0,
+							   DE_DESTINATION,
+							   Y,
+							   nY));
+	SMTC_write2Dreg(DE_DIMENSION,
+			FIELD_VALUE(0, DE_DIMENSION, X,
+			    dst_width) | FIELD_VALUE(0, DE_DIMENSION,
+						     Y_ET, 1));
+	SMTC_write2Dreg(DE_CONTROL,
+		FIELD_SET(0, DE_CONTROL, STATUS, START) | FIELD_SET(0,
+							    DE_CONTROL,
+							    DIRECTION,
+							    RIGHT_TO_LEFT)
+		| FIELD_SET(0, DE_CONTROL, MAJOR, X) | FIELD_SET(0,
+							 DE_CONTROL,
+							 STEP_X,
+							 POSITIVE)
+		| FIELD_SET(0, DE_CONTROL, STEP_Y,
+			    NEGATIVE) | FIELD_SET(0, DE_CONTROL,
+						  LAST_PIXEL,
+						  OFF) | FIELD_SET(0,
+							   DE_CONTROL,
+							   COMMAND,
+							   SHORT_STROKE)
+		| FIELD_SET(0, DE_CONTROL, ROP_SELECT,
+			    ROP2) | FIELD_VALUE(0, DE_CONTROL, ROP,
+						0x0C));
+
+	smtc_de_busy = 1;
+}
+
+void deLine(unsigned long dst_base,
+	    unsigned long dst_pitch,
+	    unsigned long nX1,
+	    unsigned long nY1,
+	    unsigned long nX2, unsigned long nY2, unsigned long nColor)
+{
+	unsigned long nCommand =
+	    FIELD_SET(0, DE_CONTROL, STATUS, START) |
+	    FIELD_SET(0, DE_CONTROL, DIRECTION, LEFT_TO_RIGHT) |
+	    FIELD_SET(0, DE_CONTROL, MAJOR, X) |
+	    FIELD_SET(0, DE_CONTROL, STEP_X, POSITIVE) |
+	    FIELD_SET(0, DE_CONTROL, STEP_Y, POSITIVE) |
+	    FIELD_SET(0, DE_CONTROL, LAST_PIXEL, OFF) |
+	    FIELD_SET(0, DE_CONTROL, ROP_SELECT, ROP2) |
+	    FIELD_VALUE(0, DE_CONTROL, ROP, 0x0C);
+	unsigned long DeltaX;
+	unsigned long DeltaY;
+
+	/* Calculate delta X */
+	if (nX1 <= nX2)
+		DeltaX = nX2 - nX1;
+	else {
+		DeltaX = nX1 - nX2;
+		nCommand = FIELD_SET(nCommand, DE_CONTROL, STEP_X, NEGATIVE);
+	}
+
+	/* Calculate delta Y */
+	if (nY1 <= nY2)
+		DeltaY = nY2 - nY1;
+	else {
+		DeltaY = nY1 - nY2;
+		nCommand = FIELD_SET(nCommand, DE_CONTROL, STEP_Y, NEGATIVE);
+	}
+
+	/* Determine the major axis */
+	if (DeltaX < DeltaY)
+		nCommand = FIELD_SET(nCommand, DE_CONTROL, MAJOR, Y);
+
+	/* Vertical line? */
+	if (nX1 == nX2)
+		deVerticalLine(dst_base, dst_pitch, nX1, nY1, DeltaY, nColor);
+
+	/* Horizontal line? */
+	else if (nY1 == nY2)
+		deHorizontalLine(dst_base, dst_pitch, nX1, nY1, \
+				DeltaX, nColor);
+
+	/* Diagonal line? */
+	else if (DeltaX == DeltaY) {
+		deWaitForNotBusy();
+
+		SMTC_write2Dreg(DE_WINDOW_DESTINATION_BASE,
+				FIELD_VALUE(0, DE_WINDOW_DESTINATION_BASE,
+					    ADDRESS, dst_base));
+
+		SMTC_write2Dreg(DE_PITCH,
+				FIELD_VALUE(0, DE_PITCH, DESTINATION,
+					    dst_pitch) | FIELD_VALUE(0,
+							     DE_PITCH,
+							     SOURCE,
+							     dst_pitch));
+
+		SMTC_write2Dreg(DE_WINDOW_WIDTH,
+				FIELD_VALUE(0, DE_WINDOW_WIDTH, DESTINATION,
+					    dst_pitch) | FIELD_VALUE(0,
+							     DE_WINDOW_WIDTH,
+							     SOURCE,
+							     dst_pitch));
+
+		SMTC_write2Dreg(DE_FOREGROUND,
+				FIELD_VALUE(0, DE_FOREGROUND, COLOR, nColor));
+
+		SMTC_write2Dreg(DE_DESTINATION,
+				FIELD_SET(0, DE_DESTINATION, WRAP, DISABLE) |
+				FIELD_VALUE(0, DE_DESTINATION, X, 1) |
+				FIELD_VALUE(0, DE_DESTINATION, Y, nY1));
+
+		SMTC_write2Dreg(DE_DIMENSION,
+				FIELD_VALUE(0, DE_DIMENSION, X, 1) |
+				FIELD_VALUE(0, DE_DIMENSION, Y_ET, DeltaX));
+
+		SMTC_write2Dreg(DE_CONTROL,
+				FIELD_SET(nCommand, DE_CONTROL, COMMAND,
+					  SHORT_STROKE));
+	}
+
+	/* Generic line */
+	else {
+		unsigned int k1, k2, et, w;
+		if (DeltaX < DeltaY) {
+			k1 = 2 * DeltaX;
+			et = k1 - DeltaY;
+			k2 = et - DeltaY;
+			w = DeltaY + 1;
+		} else {
+			k1 = 2 * DeltaY;
+			et = k1 - DeltaX;
+			k2 = et - DeltaX;
+			w = DeltaX + 1;
+		}
+
+		deWaitForNotBusy();
+
+		SMTC_write2Dreg(DE_WINDOW_DESTINATION_BASE,
+				FIELD_VALUE(0, DE_WINDOW_DESTINATION_BASE,
+					    ADDRESS, dst_base));
+
+		SMTC_write2Dreg(DE_PITCH,
+				FIELD_VALUE(0, DE_PITCH, DESTINATION,
+					    dst_pitch) | FIELD_VALUE(0,
+							     DE_PITCH,
+							     SOURCE,
+							     dst_pitch));
+
+		SMTC_write2Dreg(DE_WINDOW_WIDTH,
+				FIELD_VALUE(0, DE_WINDOW_WIDTH, DESTINATION,
+					    dst_pitch) | FIELD_VALUE(0,
+							     DE_WINDOW_WIDTH,
+							     SOURCE,
+							     dst_pitch));
+
+		SMTC_write2Dreg(DE_FOREGROUND,
+				FIELD_VALUE(0, DE_FOREGROUND, COLOR, nColor));
+
+		SMTC_write2Dreg(DE_SOURCE,
+				FIELD_SET(0, DE_SOURCE, WRAP, DISABLE) |
+				FIELD_VALUE(0, DE_SOURCE, X_K1, k1) |
+				FIELD_VALUE(0, DE_SOURCE, Y_K2, k2));
+
+		SMTC_write2Dreg(DE_DESTINATION,
+				FIELD_SET(0, DE_DESTINATION, WRAP, DISABLE) |
+				FIELD_VALUE(0, DE_DESTINATION, X, nX1) |
+				FIELD_VALUE(0, DE_DESTINATION, Y, nY1));
+
+		SMTC_write2Dreg(DE_DIMENSION,
+				FIELD_VALUE(0, DE_DIMENSION, X, w) |
+				FIELD_VALUE(0, DE_DIMENSION, Y_ET, et));
+
+		SMTC_write2Dreg(DE_CONTROL,
+				FIELD_SET(nCommand, DE_CONTROL, COMMAND,
+					  LINE_DRAW));
+	}
+
+	smtc_de_busy = 1;
+}
+
+void deFillRect(unsigned long dst_base,
+		unsigned long dst_pitch,
+		unsigned long dst_X,
+		unsigned long dst_Y,
+		unsigned long dst_width,
+		unsigned long dst_height, unsigned long nColor)
+{
+	deWaitForNotBusy();
+
+	SMTC_write2Dreg(DE_WINDOW_DESTINATION_BASE,
+			FIELD_VALUE(0, DE_WINDOW_DESTINATION_BASE, ADDRESS,
+				    dst_base));
+
+	if (dst_pitch) {
+		SMTC_write2Dreg(DE_PITCH,
+				FIELD_VALUE(0, DE_PITCH, DESTINATION,
+					    dst_pitch) | FIELD_VALUE(0,
+							     DE_PITCH,
+							     SOURCE,
+							     dst_pitch));
+
+		SMTC_write2Dreg(DE_WINDOW_WIDTH,
+				FIELD_VALUE(0, DE_WINDOW_WIDTH, DESTINATION,
+					    dst_pitch) | FIELD_VALUE(0,
+							     DE_WINDOW_WIDTH,
+							     SOURCE,
+							     dst_pitch));
+	}
+
+	SMTC_write2Dreg(DE_FOREGROUND,
+			FIELD_VALUE(0, DE_FOREGROUND, COLOR, nColor));
+
+	SMTC_write2Dreg(DE_DESTINATION,
+			FIELD_SET(0, DE_DESTINATION, WRAP, DISABLE) |
+			FIELD_VALUE(0, DE_DESTINATION, X, dst_X) |
+			FIELD_VALUE(0, DE_DESTINATION, Y, dst_Y));
+
+	SMTC_write2Dreg(DE_DIMENSION,
+			FIELD_VALUE(0, DE_DIMENSION, X, dst_width) |
+			FIELD_VALUE(0, DE_DIMENSION, Y_ET, dst_height));
+
+	SMTC_write2Dreg(DE_CONTROL,
+			FIELD_SET(0, DE_CONTROL, STATUS, START) |
+			FIELD_SET(0, DE_CONTROL, DIRECTION, LEFT_TO_RIGHT) |
+			FIELD_SET(0, DE_CONTROL, LAST_PIXEL, OFF) |
+			FIELD_SET(0, DE_CONTROL, COMMAND, RECTANGLE_FILL) |
+			FIELD_SET(0, DE_CONTROL, ROP_SELECT, ROP2) |
+			FIELD_VALUE(0, DE_CONTROL, ROP, 0x0C));
+
+	smtc_de_busy = 1;
+}
+
+/**********************************************************************
+ *
+ * deRotatePattern
+ *
+ * Purpose
+ *    Rotate the given pattern if necessary
+ *
+ * Parameters
+ *    [in]
+ *	   pPattern  - Pointer to DE_SURFACE structure containing
+ *		       pattern attributes
+ *	   patternX  - X position (0-7) of pattern origin
+ *	   patternY  - Y position (0-7) of pattern origin
+ *
+ *    [out]
+ *	   pattern_dstaddr - Pointer to pre-allocated buffer containing
+ *	   rotated pattern
+ *
+ **********************************************************************/
+void deRotatePattern(unsigned char *pattern_dstaddr,
+		     unsigned long pattern_src_addr,
+		     unsigned long pattern_BPP,
+		     unsigned long pattern_stride, int patternX, int patternY)
+{
+	unsigned int i;
+	unsigned long pattern[PATTERN_WIDTH * PATTERN_HEIGHT];
+	unsigned int x, y;
+	unsigned char *pjPatByte;
+
+	if (pattern_dstaddr != NULL) {
+		deWaitForNotBusy();
+
+		if (patternX || patternY) {
+			/* Rotate pattern */
+			pjPatByte = (unsigned char *)pattern;
+
+			switch (pattern_BPP) {
+			case 8:
+				{
+					for (y = 0; y < 8; y++) {
+						unsigned char *pjBuffer =
+						    pattern_dstaddr +
+						    ((patternY + y) & 7) * 8;
+						for (x = 0; x < 8; x++) {
+							pjBuffer[(patternX +
+								  x) & 7] =
+							    pjPatByte[x];
+						}
+						pjPatByte += pattern_stride;
+					}
+					break;
+				}
+
+			case 16:
+				{
+					for (y = 0; y < 8; y++) {
+						unsigned short *pjBuffer =
+						    (unsigned short *)
+						    pattern_dstaddr +
+						    ((patternY + y) & 7) * 8;
+						for (x = 0; x < 8; x++) {
+							pjBuffer[(patternX +
+								  x) & 7] =
+							    ((unsigned short *)
+							     pjPatByte)[x];
+						}
+						pjPatByte += pattern_stride;
+					}
+					break;
+				}
+
+			case 32:
+				{
+					for (y = 0; y < 8; y++) {
+						unsigned long *pjBuffer =
+						    (unsigned long *)
+						    pattern_dstaddr +
+						    ((patternY + y) & 7) * 8;
+						for (x = 0; x < 8; x++) {
+							pjBuffer[(patternX +
+								  x) & 7] =
+							    ((unsigned long *)
+							     pjPatByte)[x];
+						}
+						pjPatByte += pattern_stride;
+					}
+					break;
+				}
+			}
+		} else {
+			/*Don't rotate,just copy pattern into pattern_dstaddr*/
+			for (i = 0; i < (pattern_BPP * 2); i++) {
+				((unsigned long *)pattern_dstaddr)[i] =
+				    pattern[i];
+			}
+		}
+
+	}
+}
+
+/**********************************************************************
+ *
+ * deCopy
+ *
+ * Purpose
+ *    Copy a rectangular area of the source surface to a destination surface
+ *
+ * Remarks
+ *    Source bitmap must have the same color depth (BPP) as the destination
+ *    bitmap.
+ *
+**********************************************************************/
+void deCopy(unsigned long dst_base,
+	    unsigned long dst_pitch,
+	    unsigned long dst_BPP,
+	    unsigned long dst_X,
+	    unsigned long dst_Y,
+	    unsigned long dst_width,
+	    unsigned long dst_height,
+	    unsigned long src_base,
+	    unsigned long src_pitch,
+	    unsigned long src_X,
+	    unsigned long src_Y, pTransparent pTransp, unsigned char nROP2)
+{
+	unsigned long nDirection = 0;
+	unsigned long nTransparent = 0;
+	/* Direction of ROP2 operation:
+	 * 1 = Left to Right,
+	 * (-1) = Right to Left
+	 */
+	unsigned long opSign = 1;
+	/* xWidth is in pixels */
+	unsigned long xWidth = 192 / (dst_BPP / 8);
+	unsigned long de_ctrl = 0;
+
+	deWaitForNotBusy();
+
+	SMTC_write2Dreg(DE_WINDOW_DESTINATION_BASE,
+			FIELD_VALUE(0, DE_WINDOW_DESTINATION_BASE, ADDRESS,
+				    dst_base));
+
+	SMTC_write2Dreg(DE_WINDOW_SOURCE_BASE,
+			FIELD_VALUE(0, DE_WINDOW_SOURCE_BASE, ADDRESS,
+				    src_base));
+
+	if (dst_pitch && src_pitch) {
+		SMTC_write2Dreg(DE_PITCH,
+			FIELD_VALUE(0, DE_PITCH, DESTINATION,
+				    dst_pitch) | FIELD_VALUE(0,
+						     DE_PITCH,
+						     SOURCE,
+						     src_pitch));
+
+		SMTC_write2Dreg(DE_WINDOW_WIDTH,
+			FIELD_VALUE(0, DE_WINDOW_WIDTH, DESTINATION,
+				    dst_pitch) | FIELD_VALUE(0,
+						     DE_WINDOW_WIDTH,
+						     SOURCE,
+						     src_pitch));
+	}
+
+	/* Set transparent bits if necessary */
+	if (pTransp != NULL) {
+		nTransparent =
+		    pTransp->match | pTransp->select | pTransp->control;
+
+		/* Set color compare register */
+		SMTC_write2Dreg(DE_COLOR_COMPARE,
+				FIELD_VALUE(0, DE_COLOR_COMPARE, COLOR,
+					    pTransp->color));
+	}
+
+	/* Determine direction of operation */
+	if (src_Y < dst_Y) {
+		/* +----------+
+		   |S         |
+		   |          +----------+
+		   |          |      |   |
+		   |          |      |   |
+		   +---|------+      |
+		   |               D |
+		   +----------+ */
+
+		nDirection = BOTTOM_TO_TOP;
+	} else if (src_Y > dst_Y) {
+		/* +----------+
+		   |D         |
+		   |          +----------+
+		   |          |      |   |
+		   |          |      |   |
+		   +---|------+      |
+		   |               S |
+		   +----------+ */
+
+		nDirection = TOP_TO_BOTTOM;
+	} else {
+		/* src_Y == dst_Y */
+
+		if (src_X <= dst_X) {
+			/* +------+---+------+
+			   |S     |   |     D|
+			   |      |   |      |
+			   |      |   |      |
+			   |      |   |      |
+			   +------+---+------+ */
+
+			nDirection = RIGHT_TO_LEFT;
+		} else {
+			/* src_X > dst_X */
+
+			/* +------+---+------+
+			   |D     |   |     S|
+			   |      |   |      |
+			   |      |   |      |
+			   |      |   |      |
+			   +------+---+------+ */
+
+			nDirection = LEFT_TO_RIGHT;
+		}
+	}
+
+	if ((nDirection == BOTTOM_TO_TOP) || (nDirection == RIGHT_TO_LEFT)) {
+		src_X += dst_width - 1;
+		src_Y += dst_height - 1;
+		dst_X += dst_width - 1;
+		dst_Y += dst_height - 1;
+		opSign = (-1);
+	}
+
+	if (dst_BPP >= 24) {
+		src_X *= 3;
+		src_Y *= 3;
+		dst_X *= 3;
+		dst_Y *= 3;
+		dst_width *= 3;
+		if ((nDirection == BOTTOM_TO_TOP)
+		    || (nDirection == RIGHT_TO_LEFT)) {
+			src_X += 2;
+			dst_X += 2;
+		}
+	}
+
+	/* Workaround for 192 byte hw bug */
+	if ((nROP2 != 0x0C) && ((dst_width * (dst_BPP / 8)) >= 192)) {
+		/*
+		 * Perform the ROP2 operation in chunks of (xWidth *
+		 * dst_height)
+		 */
+		while (1) {
+			deWaitForNotBusy();
+
+			SMTC_write2Dreg(DE_SOURCE,
+				FIELD_SET(0, DE_SOURCE, WRAP, DISABLE) |
+				FIELD_VALUE(0, DE_SOURCE, X_K1, src_X) |
+				FIELD_VALUE(0, DE_SOURCE, Y_K2, src_Y));
+
+			SMTC_write2Dreg(DE_DESTINATION,
+				FIELD_SET(0, DE_DESTINATION, WRAP,
+				  DISABLE) | FIELD_VALUE(0,
+							 DE_DESTINATION,
+							 X,
+							 dst_X)
+			| FIELD_VALUE(0, DE_DESTINATION, Y,
+						      dst_Y));
+
+			SMTC_write2Dreg(DE_DIMENSION,
+				FIELD_VALUE(0, DE_DIMENSION, X,
+				    xWidth) | FIELD_VALUE(0,
+							  DE_DIMENSION,
+							  Y_ET,
+							  dst_height));
+
+			de_ctrl =
+			    FIELD_VALUE(0, DE_CONTROL, ROP,
+				nROP2) | nTransparent | FIELD_SET(0,
+							  DE_CONTROL,
+							  ROP_SELECT,
+							  ROP2)
+			    | FIELD_SET(0, DE_CONTROL, COMMAND,
+				BITBLT) | ((nDirection ==
+					    1) ? FIELD_SET(0,
+						   DE_CONTROL,
+						   DIRECTION,
+						   RIGHT_TO_LEFT)
+					   : FIELD_SET(0, DE_CONTROL,
+					       DIRECTION,
+					       LEFT_TO_RIGHT)) |
+			    FIELD_SET(0, DE_CONTROL, STATUS, START);
+
+			SMTC_write2Dreg(DE_CONTROL, de_ctrl);
+
+			src_X += (opSign * xWidth);
+			dst_X += (opSign * xWidth);
+			dst_width -= xWidth;
+
+			if (dst_width <= 0) {
+				/* ROP2 operation is complete */
+				break;
+			}
+
+			if (xWidth > dst_width)
+				xWidth = dst_width;
+		}
+	} else {
+		deWaitForNotBusy();
+		SMTC_write2Dreg(DE_SOURCE,
+			FIELD_SET(0, DE_SOURCE, WRAP, DISABLE) |
+			FIELD_VALUE(0, DE_SOURCE, X_K1, src_X) |
+			FIELD_VALUE(0, DE_SOURCE, Y_K2, src_Y));
+
+		SMTC_write2Dreg(DE_DESTINATION,
+			FIELD_SET(0, DE_DESTINATION, WRAP, DISABLE) |
+			FIELD_VALUE(0, DE_DESTINATION, X, dst_X) |
+			FIELD_VALUE(0, DE_DESTINATION, Y, dst_Y));
+
+		SMTC_write2Dreg(DE_DIMENSION,
+			FIELD_VALUE(0, DE_DIMENSION, X, dst_width) |
+			FIELD_VALUE(0, DE_DIMENSION, Y_ET, dst_height));
+
+		de_ctrl = FIELD_VALUE(0, DE_CONTROL, ROP, nROP2) |
+		    nTransparent |
+		    FIELD_SET(0, DE_CONTROL, ROP_SELECT, ROP2) |
+		    FIELD_SET(0, DE_CONTROL, COMMAND, BITBLT) |
+		    ((nDirection == 1) ? FIELD_SET(0, DE_CONTROL, DIRECTION,
+						   RIGHT_TO_LEFT)
+		     : FIELD_SET(0, DE_CONTROL, DIRECTION,
+				 LEFT_TO_RIGHT)) | FIELD_SET(0, DE_CONTROL,
+							     STATUS, START);
+		SMTC_write2Dreg(DE_CONTROL, de_ctrl);
+	}
+
+	smtc_de_busy = 1;
+}
+
+/*
+ * This function sets the pixel format that will apply to the 2D Engine.
+ */
+void deSetPixelFormat(unsigned long bpp)
+{
+	unsigned long de_format;
+
+	de_format = SMTC_read2Dreg(DE_STRETCH_FORMAT);
+
+	switch (bpp) {
+	case 8:
+		de_format =
+		    FIELD_SET(de_format, DE_STRETCH_FORMAT, PIXEL_FORMAT, 8);
+		break;
+	default:
+	case 16:
+		de_format =
+		    FIELD_SET(de_format, DE_STRETCH_FORMAT, PIXEL_FORMAT, 16);
+		break;
+	case 32:
+		de_format =
+		    FIELD_SET(de_format, DE_STRETCH_FORMAT, PIXEL_FORMAT, 32);
+		break;
+	}
+
+	SMTC_write2Dreg(DE_STRETCH_FORMAT, de_format);
+}
+
+/*
+ * System memory to Video memory monochrome expansion.
+ *
+ * Source is monochrome image in system memory.  This function expands the
+ * monochrome data to color image in video memory.
+ */
+
+long deSystemMem2VideoMemMonoBlt(const char *pSrcbuf,
+				 long srcDelta,
+				 unsigned long startBit,
+				 unsigned long dBase,
+				 unsigned long dPitch,
+				 unsigned long bpp,
+				 unsigned long dx, unsigned long dy,
+				 unsigned long width, unsigned long height,
+				 unsigned long fColor,
+				 unsigned long bColor,
+				 unsigned long rop2) {
+	unsigned long bytePerPixel;
+	unsigned long ulBytesPerScan;
+	unsigned long ul4BytesPerScan;
+	unsigned long ulBytesRemain;
+	unsigned long de_ctrl = 0;
+	unsigned char ajRemain[4];
+	long i, j;
+
+	bytePerPixel = bpp / 8;
+
+	/* Just make sure the start bit is within legal range */
+	startBit &= 7;
+
+	ulBytesPerScan = (width + startBit + 7) / 8;
+	ul4BytesPerScan = ulBytesPerScan & ~3;
+	ulBytesRemain = ulBytesPerScan & 3;
+
+	if (smtc_de_busy)
+		deWaitForNotBusy();
+
+	/*
+	 * 2D Source Base.  Use 0 for HOST Blt.
+	 */
+
+	SMTC_write2Dreg(DE_WINDOW_SOURCE_BASE, 0);
+
+	/*
+	 * 2D Destination Base.
+	 *
+	 * It is an address offset (128 bit aligned) from the beginning of
+	 * frame buffer.
+	 */
+
+	SMTC_write2Dreg(DE_WINDOW_DESTINATION_BASE, dBase);
+
+	if (dPitch) {
+
+		/*
+		 * Program pitch (distance between the 1st points of two
+		 * adjacent lines).
+		 *
+		 * Note that input pitch is BYTE value, but the 2D Pitch
+		 * register uses pixel values. Need Byte to pixel convertion.
+		 */
+
+		SMTC_write2Dreg(DE_PITCH,
+			FIELD_VALUE(0, DE_PITCH, DESTINATION,
+			    dPitch /
+			    bytePerPixel) | FIELD_VALUE(0,
+							DE_PITCH,
+							SOURCE,
+							dPitch /
+							bytePerPixel));
+
+		/* Screen Window width in Pixels.
+		 *
+		 * 2D engine uses this value to calculate the linear address in
+		 * frame buffer for a given point.
+		 */
+
+		SMTC_write2Dreg(DE_WINDOW_WIDTH,
+			FIELD_VALUE(0, DE_WINDOW_WIDTH, DESTINATION,
+			    (dPitch /
+			     bytePerPixel)) | FIELD_VALUE(0,
+							  DE_WINDOW_WIDTH,
+							  SOURCE,
+							  (dPitch
+							   /
+							   bytePerPixel)));
+	}
+	/* Note: For 2D Source in Host Write, only X_K1 field is needed, and
+	 * Y_K2 field is not used. For mono bitmap, use startBit for X_K1.
+	 */
+
+	SMTC_write2Dreg(DE_SOURCE,
+			FIELD_SET(0, DE_SOURCE, WRAP, DISABLE) |
+			FIELD_VALUE(0, DE_SOURCE, X_K1, startBit) |
+			FIELD_VALUE(0, DE_SOURCE, Y_K2, 0));
+
+	SMTC_write2Dreg(DE_DESTINATION,
+			FIELD_SET(0, DE_DESTINATION, WRAP, DISABLE) |
+			FIELD_VALUE(0, DE_DESTINATION, X, dx) |
+			FIELD_VALUE(0, DE_DESTINATION, Y, dy));
+
+	SMTC_write2Dreg(DE_DIMENSION,
+			FIELD_VALUE(0, DE_DIMENSION, X, width) |
+			FIELD_VALUE(0, DE_DIMENSION, Y_ET, height));
+
+	SMTC_write2Dreg(DE_FOREGROUND, fColor);
+	SMTC_write2Dreg(DE_BACKGROUND, bColor);
+
+	if (bpp)
+		deSetPixelFormat(bpp);
+	/* Set the pixel format of the destination */
+
+	de_ctrl = FIELD_VALUE(0, DE_CONTROL, ROP, rop2) |
+	    FIELD_SET(0, DE_CONTROL, ROP_SELECT, ROP2) |
+	    FIELD_SET(0, DE_CONTROL, COMMAND, HOST_WRITE) |
+	    FIELD_SET(0, DE_CONTROL, HOST, MONO) |
+	    FIELD_SET(0, DE_CONTROL, STATUS, START);
+
+	SMTC_write2Dreg(DE_CONTROL, de_ctrl | deGetTransparency());
+
+	/* Write MONO data (line by line) to 2D Engine data port */
+	for (i = 0; i < height; i++) {
+		/* For each line, send the data in chunks of 4 bytes */
+		for (j = 0; j < (ul4BytesPerScan / 4); j++)
+			SMTC_write2Ddataport(0,
+					     *(unsigned long *)(pSrcbuf +
+								(j * 4)));
+
+		if (ulBytesRemain) {
+			memcpy(ajRemain, pSrcbuf + ul4BytesPerScan,
+			       ulBytesRemain);
+			SMTC_write2Ddataport(0, *(unsigned long *)ajRemain);
+		}
+
+		pSrcbuf += srcDelta;
+	}
+	smtc_de_busy = 1;
+
+	return 0;
+}
+
+/*
+ * This function gets the transparency status from DE_CONTROL register.
+ * It returns a double word with the transparent fields properly set,
+ * while other fields are 0.
+ */
+unsigned long deGetTransparency(void)
+{
+	unsigned long de_ctrl;
+
+	de_ctrl = SMTC_read2Dreg(DE_CONTROL);
+
+	de_ctrl &=
+	    FIELD_MASK(DE_CONTROL_TRANSPARENCY_MATCH) |
+	    FIELD_MASK(DE_CONTROL_TRANSPARENCY_SELECT) |
+	    FIELD_MASK(DE_CONTROL_TRANSPARENCY);
+
+	return de_ctrl;
+}
diff --git a/drivers/staging/sm7xx/smtc2d.h b/drivers/staging/sm7xx/smtc2d.h
new file mode 100644
index 000000000000..38d0c335322b
--- /dev/null
+++ b/drivers/staging/sm7xx/smtc2d.h
@@ -0,0 +1,530 @@
+/*
+ * Silicon Motion SM712 2D drawing engine functions.
+ *
+ * Copyright (C) 2006 Silicon Motion Technology Corp.
+ * Author: Ge Wang, gewang@siliconmotion.com
+ *
+ * Copyright (C) 2009 Lemote, Inc.
+ * Author: Wu Zhangjin, wuzj@lemote.com
+ *
+ *  This file is subject to the terms and conditions of the GNU General Public
+ *  License. See the file COPYING in the main directory of this archive for
+ *  more details.
+ */
+
+#ifndef NULL
+#define NULL	 0
+#endif
+
+/* Internal macros */
+
+#define _F_START(f)		(0 ? f)
+#define _F_END(f)		(1 ? f)
+#define _F_SIZE(f)		(1 + _F_END(f) - _F_START(f))
+#define _F_MASK(f)		(((1ULL << _F_SIZE(f)) - 1) << _F_START(f))
+#define _F_NORMALIZE(v, f)	(((v) & _F_MASK(f)) >> _F_START(f))
+#define _F_DENORMALIZE(v, f)	(((v) << _F_START(f)) & _F_MASK(f))
+
+/* Global macros */
+
+#define FIELD_GET(x, reg, field) \
+( \
+    _F_NORMALIZE((x), reg ## _ ## field) \
+)
+
+#define FIELD_SET(x, reg, field, value) \
+( \
+    (x & ~_F_MASK(reg ## _ ## field)) \
+    | _F_DENORMALIZE(reg ## _ ## field ## _ ## value, reg ## _ ## field) \
+)
+
+#define FIELD_VALUE(x, reg, field, value) \
+( \
+    (x & ~_F_MASK(reg ## _ ## field)) \
+    | _F_DENORMALIZE(value, reg ## _ ## field) \
+)
+
+#define FIELD_CLEAR(reg, field) \
+( \
+    ~_F_MASK(reg ## _ ## field) \
+)
+
+/* Field Macros                        */
+
+#define FIELD_START(field)	(0 ? field)
+#define FIELD_END(field)	(1 ? field)
+#define FIELD_SIZE(field) \
+	(1 + FIELD_END(field) - FIELD_START(field))
+
+#define FIELD_MASK(field) \
+	(((1 << (FIELD_SIZE(field)-1)) \
+	| ((1 << (FIELD_SIZE(field)-1)) - 1)) \
+	<< FIELD_START(field))
+
+#define FIELD_NORMALIZE(reg, field) \
+	(((reg) & FIELD_MASK(field)) >> FIELD_START(field))
+
+#define FIELD_DENORMALIZE(field, value) \
+	(((value) << FIELD_START(field)) & FIELD_MASK(field))
+
+#define FIELD_INIT(reg, field, value) \
+	FIELD_DENORMALIZE(reg ## _ ## field, \
+		reg ## _ ## field ## _ ## value)
+
+#define FIELD_INIT_VAL(reg, field, value) \
+	(FIELD_DENORMALIZE(reg ## _ ## field, value))
+
+#define FIELD_VAL_SET(x, r, f, v) ({ \
+	x = (x & ~FIELD_MASK(r ## _ ## f)) \
+	| FIELD_DENORMALIZE(r ## _ ## f, r ## _ ## f ## _ ## v) \
+})
+
+#define RGB(r, g, b)	((unsigned long)(((r) << 16) | ((g) << 8) | (b)))
+
+/* Transparent info definition */
+typedef struct {
+	unsigned long match;	/* Matching pixel is OPAQUE/TRANSPARENT */
+	unsigned long select;	/* Transparency controlled by SRC/DST */
+	unsigned long control;	/* ENABLE/DISABLE transparency */
+	unsigned long color;	/* Transparent color */
+} Transparent, *pTransparent;
+
+#define PIXEL_DEPTH_1_BP	0	/* 1 bit per pixel */
+#define PIXEL_DEPTH_8_BPP	1	/* 8 bits per pixel */
+#define PIXEL_DEPTH_16_BPP	2	/* 16 bits per pixel */
+#define PIXEL_DEPTH_32_BPP	3	/* 32 bits per pixel */
+#define PIXEL_DEPTH_YUV422	8	/* 16 bits per pixel YUV422 */
+#define PIXEL_DEPTH_YUV420	9	/* 16 bits per pixel YUV420 */
+
+#define PATTERN_WIDTH		8
+#define PATTERN_HEIGHT		8
+
+#define	TOP_TO_BOTTOM		0
+#define	BOTTOM_TO_TOP		1
+#define RIGHT_TO_LEFT		BOTTOM_TO_TOP
+#define LEFT_TO_RIGHT		TOP_TO_BOTTOM
+
+/* Constants used in Transparent structure */
+#define MATCH_OPAQUE		0x00000000
+#define MATCH_TRANSPARENT	0x00000400
+#define SOURCE			0x00000000
+#define DESTINATION		0x00000200
+
+/* 2D registers. */
+
+#define	DE_SOURCE			0x000000
+#define	DE_SOURCE_WRAP			31 : 31
+#define	DE_SOURCE_WRAP_DISABLE		0
+#define	DE_SOURCE_WRAP_ENABLE		1
+#define	DE_SOURCE_X_K1			29 : 16
+#define	DE_SOURCE_Y_K2			15 : 0
+
+#define	DE_DESTINATION			0x000004
+#define	DE_DESTINATION_WRAP		31 : 31
+#define	DE_DESTINATION_WRAP_DISABLE	0
+#define	DE_DESTINATION_WRAP_ENABLE	1
+#define	DE_DESTINATION_X		28 : 16
+#define	DE_DESTINATION_Y		15 : 0
+
+#define	DE_DIMENSION			0x000008
+#define	DE_DIMENSION_X			28 : 16
+#define	DE_DIMENSION_Y_ET		15 : 0
+
+#define	DE_CONTROL			0x00000C
+#define	DE_CONTROL_STATUS		31 : 31
+#define	DE_CONTROL_STATUS_STOP		0
+#define	DE_CONTROL_STATUS_START		1
+#define	DE_CONTROL_PATTERN		30 : 30
+#define	DE_CONTROL_PATTERN_MONO		0
+#define	DE_CONTROL_PATTERN_COLOR	1
+#define	DE_CONTROL_UPDATE_DESTINATION_X		29 : 29
+#define	DE_CONTROL_UPDATE_DESTINATION_X_DISABLE	0
+#define	DE_CONTROL_UPDATE_DESTINATION_X_ENABLE	1
+#define	DE_CONTROL_QUICK_START			28 : 28
+#define	DE_CONTROL_QUICK_START_DISABLE		0
+#define	DE_CONTROL_QUICK_START_ENABLE		1
+#define	DE_CONTROL_DIRECTION			27 : 27
+#define	DE_CONTROL_DIRECTION_LEFT_TO_RIGHT	0
+#define	DE_CONTROL_DIRECTION_RIGHT_TO_LEFT	1
+#define	DE_CONTROL_MAJOR			26 : 26
+#define	DE_CONTROL_MAJOR_X			0
+#define	DE_CONTROL_MAJOR_Y			1
+#define	DE_CONTROL_STEP_X			25 : 25
+#define	DE_CONTROL_STEP_X_POSITIVE		1
+#define	DE_CONTROL_STEP_X_NEGATIVE		0
+#define	DE_CONTROL_STEP_Y			24 : 24
+#define	DE_CONTROL_STEP_Y_POSITIVE		1
+#define	DE_CONTROL_STEP_Y_NEGATIVE		0
+#define	DE_CONTROL_STRETCH			23 : 23
+#define	DE_CONTROL_STRETCH_DISABLE		0
+#define	DE_CONTROL_STRETCH_ENABLE		1
+#define	DE_CONTROL_HOST				22 : 22
+#define	DE_CONTROL_HOST_COLOR			0
+#define	DE_CONTROL_HOST_MONO			1
+#define	DE_CONTROL_LAST_PIXEL			21 : 21
+#define	DE_CONTROL_LAST_PIXEL_OFF		0
+#define	DE_CONTROL_LAST_PIXEL_ON		1
+#define	DE_CONTROL_COMMAND			20 : 16
+#define	DE_CONTROL_COMMAND_BITBLT		0
+#define	DE_CONTROL_COMMAND_RECTANGLE_FILL	1
+#define	DE_CONTROL_COMMAND_DE_TILE		2
+#define	DE_CONTROL_COMMAND_TRAPEZOID_FILL	3
+#define	DE_CONTROL_COMMAND_ALPHA_BLEND		4
+#define	DE_CONTROL_COMMAND_RLE_STRIP		5
+#define	DE_CONTROL_COMMAND_SHORT_STROKE		6
+#define	DE_CONTROL_COMMAND_LINE_DRAW		7
+#define	DE_CONTROL_COMMAND_HOST_WRITE		8
+#define	DE_CONTROL_COMMAND_HOST_READ		9
+#define	DE_CONTROL_COMMAND_HOST_WRITE_BOTTOM_UP	10
+#define	DE_CONTROL_COMMAND_ROTATE		11
+#define	DE_CONTROL_COMMAND_FONT			12
+#define	DE_CONTROL_COMMAND_TEXTURE_LOAD		15
+#define	DE_CONTROL_ROP_SELECT			15 : 15
+#define	DE_CONTROL_ROP_SELECT_ROP3		0
+#define	DE_CONTROL_ROP_SELECT_ROP2		1
+#define	DE_CONTROL_ROP2_SOURCE			14 : 14
+#define	DE_CONTROL_ROP2_SOURCE_BITMAP		0
+#define	DE_CONTROL_ROP2_SOURCE_PATTERN		1
+#define	DE_CONTROL_MONO_DATA			13 : 12
+#define	DE_CONTROL_MONO_DATA_NOT_PACKED		0
+#define	DE_CONTROL_MONO_DATA_8_PACKED		1
+#define	DE_CONTROL_MONO_DATA_16_PACKED		2
+#define	DE_CONTROL_MONO_DATA_32_PACKED		3
+#define	DE_CONTROL_REPEAT_ROTATE		11 : 11
+#define	DE_CONTROL_REPEAT_ROTATE_DISABLE	0
+#define	DE_CONTROL_REPEAT_ROTATE_ENABLE		1
+#define	DE_CONTROL_TRANSPARENCY_MATCH		10 : 10
+#define	DE_CONTROL_TRANSPARENCY_MATCH_OPAQUE		0
+#define	DE_CONTROL_TRANSPARENCY_MATCH_TRANSPARENT	1
+#define	DE_CONTROL_TRANSPARENCY_SELECT			9 : 9
+#define	DE_CONTROL_TRANSPARENCY_SELECT_SOURCE		0
+#define	DE_CONTROL_TRANSPARENCY_SELECT_DESTINATION	1
+#define	DE_CONTROL_TRANSPARENCY				8 : 8
+#define	DE_CONTROL_TRANSPARENCY_DISABLE			0
+#define	DE_CONTROL_TRANSPARENCY_ENABLE			1
+#define	DE_CONTROL_ROP					7 : 0
+
+/* Pseudo fields. */
+
+#define	DE_CONTROL_SHORT_STROKE_DIR			27 : 24
+#define	DE_CONTROL_SHORT_STROKE_DIR_225			0
+#define	DE_CONTROL_SHORT_STROKE_DIR_135			1
+#define	DE_CONTROL_SHORT_STROKE_DIR_315			2
+#define	DE_CONTROL_SHORT_STROKE_DIR_45			3
+#define	DE_CONTROL_SHORT_STROKE_DIR_270			4
+#define	DE_CONTROL_SHORT_STROKE_DIR_90			5
+#define	DE_CONTROL_SHORT_STROKE_DIR_180			8
+#define	DE_CONTROL_SHORT_STROKE_DIR_0			10
+#define	DE_CONTROL_ROTATION				25 : 24
+#define	DE_CONTROL_ROTATION_0				0
+#define	DE_CONTROL_ROTATION_270				1
+#define	DE_CONTROL_ROTATION_90				2
+#define	DE_CONTROL_ROTATION_180				3
+
+#define	DE_PITCH					0x000010
+#define	DE_PITCH_DESTINATION				28 : 16
+#define	DE_PITCH_SOURCE					12 : 0
+
+#define	DE_FOREGROUND					0x000014
+#define	DE_FOREGROUND_COLOR				31 : 0
+
+#define	DE_BACKGROUND					0x000018
+#define	DE_BACKGROUND_COLOR				31 : 0
+
+#define	DE_STRETCH_FORMAT				0x00001C
+#define	DE_STRETCH_FORMAT_PATTERN_XY			30 : 30
+#define	DE_STRETCH_FORMAT_PATTERN_XY_NORMAL		0
+#define	DE_STRETCH_FORMAT_PATTERN_XY_OVERWRITE		1
+#define	DE_STRETCH_FORMAT_PATTERN_Y			29 : 27
+#define	DE_STRETCH_FORMAT_PATTERN_X			25 : 23
+#define	DE_STRETCH_FORMAT_PIXEL_FORMAT			21 : 20
+#define	DE_STRETCH_FORMAT_PIXEL_FORMAT_8		0
+#define	DE_STRETCH_FORMAT_PIXEL_FORMAT_16		1
+#define	DE_STRETCH_FORMAT_PIXEL_FORMAT_24		3
+#define	DE_STRETCH_FORMAT_PIXEL_FORMAT_32		2
+#define	DE_STRETCH_FORMAT_ADDRESSING			19 : 16
+#define	DE_STRETCH_FORMAT_ADDRESSING_XY			0
+#define	DE_STRETCH_FORMAT_ADDRESSING_LINEAR		15
+#define	DE_STRETCH_FORMAT_SOURCE_HEIGHT			11 : 0
+
+#define	DE_COLOR_COMPARE				0x000020
+#define	DE_COLOR_COMPARE_COLOR				23 : 0
+
+#define	DE_COLOR_COMPARE_MASK				0x000024
+#define	DE_COLOR_COMPARE_MASK_MASKS			23 : 0
+
+#define	DE_MASKS					0x000028
+#define	DE_MASKS_BYTE_MASK				31 : 16
+#define	DE_MASKS_BIT_MASK				15 : 0
+
+#define	DE_CLIP_TL					0x00002C
+#define	DE_CLIP_TL_TOP					31 : 16
+#define	DE_CLIP_TL_STATUS				13 : 13
+#define	DE_CLIP_TL_STATUS_DISABLE			0
+#define	DE_CLIP_TL_STATUS_ENABLE			1
+#define	DE_CLIP_TL_INHIBIT				12 : 12
+#define	DE_CLIP_TL_INHIBIT_OUTSIDE			0
+#define	DE_CLIP_TL_INHIBIT_INSIDE			1
+#define	DE_CLIP_TL_LEFT					11 : 0
+
+#define	DE_CLIP_BR					0x000030
+#define	DE_CLIP_BR_BOTTOM				31 : 16
+#define	DE_CLIP_BR_RIGHT				12 : 0
+
+#define	DE_MONO_PATTERN_LOW				0x000034
+#define	DE_MONO_PATTERN_LOW_PATTERN			31 : 0
+
+#define	DE_MONO_PATTERN_HIGH				0x000038
+#define	DE_MONO_PATTERN_HIGH_PATTERN			31 : 0
+
+#define	DE_WINDOW_WIDTH					0x00003C
+#define	DE_WINDOW_WIDTH_DESTINATION			28 : 16
+#define	DE_WINDOW_WIDTH_SOURCE				12 : 0
+
+#define	DE_WINDOW_SOURCE_BASE				0x000040
+#define	DE_WINDOW_SOURCE_BASE_EXT			27 : 27
+#define	DE_WINDOW_SOURCE_BASE_EXT_LOCAL			0
+#define	DE_WINDOW_SOURCE_BASE_EXT_EXTERNAL		1
+#define	DE_WINDOW_SOURCE_BASE_CS			26 : 26
+#define	DE_WINDOW_SOURCE_BASE_CS_0			0
+#define	DE_WINDOW_SOURCE_BASE_CS_1			1
+#define	DE_WINDOW_SOURCE_BASE_ADDRESS			25 : 0
+
+#define	DE_WINDOW_DESTINATION_BASE			0x000044
+#define	DE_WINDOW_DESTINATION_BASE_EXT			27 : 27
+#define	DE_WINDOW_DESTINATION_BASE_EXT_LOCAL		0
+#define	DE_WINDOW_DESTINATION_BASE_EXT_EXTERNAL		1
+#define	DE_WINDOW_DESTINATION_BASE_CS			26 : 26
+#define	DE_WINDOW_DESTINATION_BASE_CS_0			0
+#define	DE_WINDOW_DESTINATION_BASE_CS_1			1
+#define	DE_WINDOW_DESTINATION_BASE_ADDRESS		25 : 0
+
+#define	DE_ALPHA					0x000048
+#define	DE_ALPHA_VALUE					7 : 0
+
+#define	DE_WRAP						0x00004C
+#define	DE_WRAP_X					31 : 16
+#define	DE_WRAP_Y					15 : 0
+
+#define	DE_STATUS					0x000050
+#define	DE_STATUS_CSC					1 : 1
+#define	DE_STATUS_CSC_CLEAR				0
+#define	DE_STATUS_CSC_NOT_ACTIVE			0
+#define	DE_STATUS_CSC_ACTIVE				1
+#define	DE_STATUS_2D					0 : 0
+#define	DE_STATUS_2D_CLEAR				0
+#define	DE_STATUS_2D_NOT_ACTIVE				0
+#define	DE_STATUS_2D_ACTIVE				1
+
+/* Color Space Conversion registers. */
+
+#define	CSC_Y_SOURCE_BASE				0x0000C8
+#define	CSC_Y_SOURCE_BASE_EXT				27 : 27
+#define	CSC_Y_SOURCE_BASE_EXT_LOCAL			0
+#define	CSC_Y_SOURCE_BASE_EXT_EXTERNAL			1
+#define	CSC_Y_SOURCE_BASE_CS				26 : 26
+#define	CSC_Y_SOURCE_BASE_CS_0				0
+#define	CSC_Y_SOURCE_BASE_CS_1				1
+#define	CSC_Y_SOURCE_BASE_ADDRESS			25 : 0
+
+#define	CSC_CONSTANTS					0x0000CC
+#define	CSC_CONSTANTS_Y					31 : 24
+#define	CSC_CONSTANTS_R					23 : 16
+#define	CSC_CONSTANTS_G					15 : 8
+#define	CSC_CONSTANTS_B					7 : 0
+
+#define	CSC_Y_SOURCE_X					0x0000D0
+#define	CSC_Y_SOURCE_X_INTEGER				26 : 16
+#define	CSC_Y_SOURCE_X_FRACTION				15 : 3
+
+#define	CSC_Y_SOURCE_Y					0x0000D4
+#define	CSC_Y_SOURCE_Y_INTEGER				27 : 16
+#define	CSC_Y_SOURCE_Y_FRACTION				15 : 3
+
+#define	CSC_U_SOURCE_BASE				0x0000D8
+#define	CSC_U_SOURCE_BASE_EXT				27 : 27
+#define	CSC_U_SOURCE_BASE_EXT_LOCAL			0
+#define	CSC_U_SOURCE_BASE_EXT_EXTERNAL			1
+#define	CSC_U_SOURCE_BASE_CS				26 : 26
+#define	CSC_U_SOURCE_BASE_CS_0				0
+#define	CSC_U_SOURCE_BASE_CS_1				1
+#define	CSC_U_SOURCE_BASE_ADDRESS			25 : 0
+
+#define	CSC_V_SOURCE_BASE				0x0000DC
+#define	CSC_V_SOURCE_BASE_EXT				27 : 27
+#define	CSC_V_SOURCE_BASE_EXT_LOCAL			0
+#define	CSC_V_SOURCE_BASE_EXT_EXTERNAL			1
+#define	CSC_V_SOURCE_BASE_CS				26 : 26
+#define	CSC_V_SOURCE_BASE_CS_0				0
+#define	CSC_V_SOURCE_BASE_CS_1				1
+#define	CSC_V_SOURCE_BASE_ADDRESS			25 : 0
+
+#define	CSC_SOURCE_DIMENSION				0x0000E0
+#define	CSC_SOURCE_DIMENSION_X				31 : 16
+#define	CSC_SOURCE_DIMENSION_Y				15 : 0
+
+#define	CSC_SOURCE_PITCH				0x0000E4
+#define	CSC_SOURCE_PITCH_Y				31 : 16
+#define	CSC_SOURCE_PITCH_UV				15 : 0
+
+#define	CSC_DESTINATION					0x0000E8
+#define	CSC_DESTINATION_WRAP				31 : 31
+#define	CSC_DESTINATION_WRAP_DISABLE			0
+#define	CSC_DESTINATION_WRAP_ENABLE			1
+#define	CSC_DESTINATION_X				27 : 16
+#define	CSC_DESTINATION_Y				11 : 0
+
+#define	CSC_DESTINATION_DIMENSION			0x0000EC
+#define	CSC_DESTINATION_DIMENSION_X			31 : 16
+#define	CSC_DESTINATION_DIMENSION_Y			15 : 0
+
+#define	CSC_DESTINATION_PITCH				0x0000F0
+#define	CSC_DESTINATION_PITCH_X				31 : 16
+#define	CSC_DESTINATION_PITCH_Y				15 : 0
+
+#define	CSC_SCALE_FACTOR				0x0000F4
+#define	CSC_SCALE_FACTOR_HORIZONTAL			31 : 16
+#define	CSC_SCALE_FACTOR_VERTICAL			15 : 0
+
+#define	CSC_DESTINATION_BASE				0x0000F8
+#define	CSC_DESTINATION_BASE_EXT			27 : 27
+#define	CSC_DESTINATION_BASE_EXT_LOCAL			0
+#define	CSC_DESTINATION_BASE_EXT_EXTERNAL		1
+#define	CSC_DESTINATION_BASE_CS				26 : 26
+#define	CSC_DESTINATION_BASE_CS_0			0
+#define	CSC_DESTINATION_BASE_CS_1			1
+#define	CSC_DESTINATION_BASE_ADDRESS			25 : 0
+
+#define	CSC_CONTROL					0x0000FC
+#define	CSC_CONTROL_STATUS				31 : 31
+#define	CSC_CONTROL_STATUS_STOP				0
+#define	CSC_CONTROL_STATUS_START			1
+#define	CSC_CONTROL_SOURCE_FORMAT			30 : 28
+#define	CSC_CONTROL_SOURCE_FORMAT_YUV422		0
+#define	CSC_CONTROL_SOURCE_FORMAT_YUV420I		1
+#define	CSC_CONTROL_SOURCE_FORMAT_YUV420		2
+#define	CSC_CONTROL_SOURCE_FORMAT_YVU9			3
+#define	CSC_CONTROL_SOURCE_FORMAT_IYU1			4
+#define	CSC_CONTROL_SOURCE_FORMAT_IYU2			5
+#define	CSC_CONTROL_SOURCE_FORMAT_RGB565		6
+#define	CSC_CONTROL_SOURCE_FORMAT_RGB8888		7
+#define	CSC_CONTROL_DESTINATION_FORMAT			27 : 26
+#define	CSC_CONTROL_DESTINATION_FORMAT_RGB565		0
+#define	CSC_CONTROL_DESTINATION_FORMAT_RGB8888		1
+#define	CSC_CONTROL_HORIZONTAL_FILTER			25 : 25
+#define	CSC_CONTROL_HORIZONTAL_FILTER_DISABLE		0
+#define	CSC_CONTROL_HORIZONTAL_FILTER_ENABLE		1
+#define	CSC_CONTROL_VERTICAL_FILTER			24 : 24
+#define	CSC_CONTROL_VERTICAL_FILTER_DISABLE		0
+#define	CSC_CONTROL_VERTICAL_FILTER_ENABLE		1
+#define	CSC_CONTROL_BYTE_ORDER				23 : 23
+#define	CSC_CONTROL_BYTE_ORDER_YUYV			0
+#define	CSC_CONTROL_BYTE_ORDER_UYVY			1
+
+#define	DE_DATA_PORT_501				0x110000
+#define	DE_DATA_PORT_712				0x400000
+#define	DE_DATA_PORT_722				0x6000
+
+/* point to virtual Memory Map IO starting address */
+extern char *smtc_RegBaseAddress;
+/* point to virtual video memory starting address */
+extern char *smtc_VRAMBaseAddress;
+extern unsigned char smtc_de_busy;
+
+extern unsigned long memRead32(unsigned long nOffset);
+extern void memWrite32(unsigned long nOffset, unsigned long nData);
+extern unsigned long SMTC_read2Dreg(unsigned long nOffset);
+
+/* 2D functions */
+extern void deInit(unsigned int nModeWidth, unsigned int nModeHeight,
+		   unsigned int bpp);
+
+extern void deWaitForNotBusy(void);
+
+extern void deVerticalLine(unsigned long dst_base,
+	unsigned long dst_pitch,
+	unsigned long nX,
+	unsigned long nY,
+	unsigned long dst_height,
+	unsigned long nColor);
+
+extern void deHorizontalLine(unsigned long dst_base,
+	unsigned long dst_pitch,
+	unsigned long nX,
+	unsigned long nY,
+	unsigned long dst_width,
+	unsigned long nColor);
+
+extern void deLine(unsigned long dst_base,
+	unsigned long dst_pitch,
+	unsigned long nX1,
+	unsigned long nY1,
+	unsigned long nX2,
+	unsigned long nY2,
+	unsigned long nColor);
+
+extern void deFillRect(unsigned long dst_base,
+	unsigned long dst_pitch,
+	unsigned long dst_X,
+	unsigned long dst_Y,
+	unsigned long dst_width,
+	unsigned long dst_height,
+	unsigned long nColor);
+
+extern void deRotatePattern(unsigned char *pattern_dstaddr,
+	unsigned long pattern_src_addr,
+	unsigned long pattern_BPP,
+	unsigned long pattern_stride,
+	int	patternX,
+	int	patternY);
+
+extern void deCopy(unsigned long dst_base,
+	unsigned long dst_pitch,
+	unsigned long dst_BPP,
+	unsigned long dst_X,
+	unsigned long dst_Y,
+	unsigned long dst_width,
+	unsigned long dst_height,
+	unsigned long src_base,
+	unsigned long src_pitch,
+	unsigned long src_X,
+	unsigned long src_Y,
+	pTransparent	pTransp,
+	unsigned char nROP2);
+
+/*
+ * System memory to Video memory monochrome expansion.
+ *
+ * Source is monochrome image in system memory.  This function expands the
+ * monochrome data to color image in video memory.
+ *
+ * @pSrcbuf: pointer to start of source buffer in system memory
+ * @srcDelta: Pitch value (in bytes) of the source buffer, +ive means top
+ * 		down and -ive mean button up
+ * @startBit: Mono data can start at any bit in a byte, this value should
+ * 		be 0 to 7
+ * @dBase: Address of destination :  offset in frame buffer
+ * @dPitch: Pitch value of destination surface in BYTE
+ * @bpp: Color depth of destination surface
+ * @dx, dy: Starting coordinate of destination surface
+ * @width, height: width and height of rectange in pixel value
+ * @fColor,bColor: Foreground, Background color (corresponding to a 1, 0 in
+ * 	the monochrome data)
+ * @rop2: ROP value
+ */
+
+extern long deSystemMem2VideoMemMonoBlt(
+	const char *pSrcbuf,
+	long srcDelta,
+	unsigned long startBit,
+	unsigned long dBase,
+	unsigned long dPitch,
+	unsigned long bpp,
+	unsigned long dx, unsigned long dy,
+	unsigned long width, unsigned long height,
+	unsigned long fColor,
+	unsigned long bColor,
+	unsigned long rop2);
+
+extern unsigned long deGetTransparency(void);
+extern void deSetPixelFormat(unsigned long bpp);
diff --git a/drivers/staging/sm7xx/smtcfb.c b/drivers/staging/sm7xx/smtcfb.c
new file mode 100644
index 000000000000..161dbc9c1397
--- /dev/null
+++ b/drivers/staging/sm7xx/smtcfb.c
@@ -0,0 +1,1253 @@
+/*
+ * Silicon Motion SM7XX frame buffer device
+ *
+ * Copyright (C) 2006 Silicon Motion Technology Corp.
+ * Authors: Ge Wang, gewang@siliconmotion.com
+ * 	    Boyod boyod.yang@siliconmotion.com.cn
+ *
+ * Copyright (C) 2009 Lemote, Inc.
+ * Author: Wu Zhangjin, wuzj@lemote.com
+ *
+ *  This file is subject to the terms and conditions of the GNU General Public
+ *  License. See the file COPYING in the main directory of this archive for
+ *  more details.
+ *
+ * Version 0.10.26192.21.01
+ * 	- Add PowerPC/Big endian support
+ * 	- Add 2D support for Lynx
+ * 	- Verified on2.6.19.2  Boyod.yang <boyod.yang@siliconmotion.com.cn>
+ *
+ * Version 0.09.2621.00.01
+ * 	- Only support Linux Kernel's version 2.6.21.
+ *	Boyod.yang  <boyod.yang@siliconmotion.com.cn>
+ *
+ * Version 0.09
+ * 	- Only support Linux Kernel's version 2.6.12.
+ * 	Boyod.yang <boyod.yang@siliconmotion.com.cn>
+ */
+
+#ifndef __KERNEL__
+#define __KERNEL__
+#endif
+
+#include <linux/io.h>
+#include <linux/fb.h>
+#include <linux/pci.h>
+#include <linux/init.h>
+#include <linux/uaccess.h>
+#include <linux/console.h>
+#include <linux/screen_info.h>
+
+#ifdef CONFIG_PM
+#include <linux/pm.h>
+#endif
+
+struct screen_info smtc_screen_info;
+
+#include "smtcfb.h"
+#include "smtc2d.h"
+
+#ifdef DEBUG
+#define smdbg(format, arg...)	printk(KERN_DEBUG format , ## arg)
+#else
+#define smdbg(format, arg...)
+#endif
+
+/*
+* Private structure
+*/
+struct smtcfb_info {
+	/*
+	 * The following is a pointer to be passed into the
+	 * functions below.  The modules outside the main
+	 * voyager.c driver have no knowledge as to what
+	 * is within this structure.
+	 */
+	struct fb_info fb;
+	struct display_switch *dispsw;
+	struct pci_dev *dev;
+	signed int currcon;
+
+	struct {
+		u8 red, green, blue;
+	} palette[NR_RGB];
+
+	u_int palette_size;
+};
+
+struct par_info {
+	/*
+	 * Hardware
+	 */
+	u16 chipID;
+	unsigned char __iomem *m_pMMIO;
+	char __iomem *m_pLFB;
+	char *m_pDPR;
+	char *m_pVPR;
+	char *m_pCPR;
+
+	u_int width;
+	u_int height;
+	u_int hz;
+	u_long BaseAddressInVRAM;
+	u8 chipRevID;
+};
+
+struct vesa_mode_table	{
+	char mode_index[6];
+	u16 lfb_width;
+	u16 lfb_height;
+	u16 lfb_depth;
+};
+
+static struct vesa_mode_table vesa_mode[] = {
+	{"0x301", 640,  480,  8},
+	{"0x303", 800,  600,  8},
+	{"0x305", 1024, 768,	8},
+	{"0x307", 1280, 1024, 8},
+
+	{"0x311", 640,  480,  16},
+	{"0x314", 800,  600,  16},
+	{"0x317", 1024, 768,	16},
+	{"0x31A", 1280, 1024, 16},
+
+	{"0x312", 640,  480,  24},
+	{"0x315", 800,  600,  24},
+	{"0x318", 1024, 768,	24},
+	{"0x31B", 1280, 1024, 24},
+};
+
+char __iomem *smtc_RegBaseAddress;	/* Memory Map IO starting address */
+char __iomem *smtc_VRAMBaseAddress;	/* video memory starting address */
+
+char *smtc_2DBaseAddress;	/* 2D engine starting address */
+char *smtc_2Ddataport;		/* 2D data port offset */
+short smtc_2Dacceleration;
+
+static u32 colreg[17];
+static struct par_info hw;	/* hardware information */
+
+u16 smtc_ChipIDs[] = {
+	0x710,
+	0x712,
+	0x720
+};
+
+#define numSMTCchipIDs (sizeof(smtc_ChipIDs) / sizeof(u16))
+
+void deWaitForNotBusy(void)
+{
+	unsigned long i = 0x1000000;
+	while (i--) {
+		if ((smtc_seqr(0x16) & 0x18) == 0x10)
+			break;
+	}
+	smtc_de_busy = 0;
+}
+
+static void sm712_set_timing(struct smtcfb_info *sfb,
+			     struct par_info *ppar_info)
+{
+	int i = 0, j = 0;
+	u32 m_nScreenStride;
+
+	smdbg("\nppar_info->width = %d ppar_info->height = %d"
+			"sfb->fb.var.bits_per_pixel = %d ppar_info->hz = %d\n",
+			ppar_info->width, ppar_info->height,
+			sfb->fb.var.bits_per_pixel, ppar_info->hz);
+
+	for (j = 0; j < numVGAModes; j++) {
+		if (VGAMode[j].mmSizeX == ppar_info->width &&
+		    VGAMode[j].mmSizeY == ppar_info->height &&
+		    VGAMode[j].bpp == sfb->fb.var.bits_per_pixel &&
+		    VGAMode[j].hz == ppar_info->hz) {
+
+			smdbg("\nVGAMode[j].mmSizeX  = %d VGAMode[j].mmSizeY ="
+					"%d VGAMode[j].bpp = %d"
+					"VGAMode[j].hz=%d\n",
+					VGAMode[j].mmSizeX, VGAMode[j].mmSizeY,
+					VGAMode[j].bpp, VGAMode[j].hz);
+
+			smdbg("VGAMode index=%d\n", j);
+
+			smtc_mmiowb(0x0, 0x3c6);
+
+			smtc_seqw(0, 0x1);
+
+			smtc_mmiowb(VGAMode[j].Init_MISC, 0x3c2);
+
+			/* init SEQ register SR00 - SR04 */
+			for (i = 0; i < SIZE_SR00_SR04; i++)
+				smtc_seqw(i, VGAMode[j].Init_SR00_SR04[i]);
+
+			/* init SEQ register SR10 - SR24 */
+			for (i = 0; i < SIZE_SR10_SR24; i++)
+				smtc_seqw(i + 0x10,
+					  VGAMode[j].Init_SR10_SR24[i]);
+
+			/* init SEQ register SR30 - SR75 */
+			for (i = 0; i < SIZE_SR30_SR75; i++)
+				if (((i + 0x30) != 0x62) \
+					&& ((i + 0x30) != 0x6a) \
+					&& ((i + 0x30) != 0x6b))
+					smtc_seqw(i + 0x30,
+						VGAMode[j].Init_SR30_SR75[i]);
+
+			/* init SEQ register SR80 - SR93 */
+			for (i = 0; i < SIZE_SR80_SR93; i++)
+				smtc_seqw(i + 0x80,
+					  VGAMode[j].Init_SR80_SR93[i]);
+
+			/* init SEQ register SRA0 - SRAF */
+			for (i = 0; i < SIZE_SRA0_SRAF; i++)
+				smtc_seqw(i + 0xa0,
+					  VGAMode[j].Init_SRA0_SRAF[i]);
+
+			/* init Graphic register GR00 - GR08 */
+			for (i = 0; i < SIZE_GR00_GR08; i++)
+				smtc_grphw(i, VGAMode[j].Init_GR00_GR08[i]);
+
+			/* init Attribute register AR00 - AR14 */
+			for (i = 0; i < SIZE_AR00_AR14; i++)
+				smtc_attrw(i, VGAMode[j].Init_AR00_AR14[i]);
+
+			/* init CRTC register CR00 - CR18 */
+			for (i = 0; i < SIZE_CR00_CR18; i++)
+				smtc_crtcw(i, VGAMode[j].Init_CR00_CR18[i]);
+
+			/* init CRTC register CR30 - CR4D */
+			for (i = 0; i < SIZE_CR30_CR4D; i++)
+				smtc_crtcw(i + 0x30,
+					   VGAMode[j].Init_CR30_CR4D[i]);
+
+			/* init CRTC register CR90 - CRA7 */
+			for (i = 0; i < SIZE_CR90_CRA7; i++)
+				smtc_crtcw(i + 0x90,
+					   VGAMode[j].Init_CR90_CRA7[i]);
+		}
+	}
+	smtc_mmiowb(0x67, 0x3c2);
+
+	/* set VPR registers */
+	writel(0x0, ppar_info->m_pVPR + 0x0C);
+	writel(0x0, ppar_info->m_pVPR + 0x40);
+
+	/* set data width */
+	m_nScreenStride =
+		(ppar_info->width * sfb->fb.var.bits_per_pixel) / 64;
+	switch (sfb->fb.var.bits_per_pixel) {
+	case 8:
+		writel(0x0, ppar_info->m_pVPR + 0x0);
+		break;
+	case 16:
+		writel(0x00020000, ppar_info->m_pVPR + 0x0);
+		break;
+	case 24:
+		writel(0x00040000, ppar_info->m_pVPR + 0x0);
+		break;
+	case 32:
+		writel(0x00030000, ppar_info->m_pVPR + 0x0);
+		break;
+	}
+	writel((u32) (((m_nScreenStride + 2) << 16) | m_nScreenStride),
+	       ppar_info->m_pVPR + 0x10);
+
+}
+
+static void sm712_setpalette(int regno, unsigned red, unsigned green,
+			     unsigned blue, struct fb_info *info)
+{
+	struct par_info *cur_par = (struct par_info *)info->par;
+
+	if (cur_par->BaseAddressInVRAM)
+		/*
+		 * second display palette for dual head. Enable CRT RAM, 6-bit
+		 * RAM
+		 */
+		smtc_seqw(0x66, (smtc_seqr(0x66) & 0xC3) | 0x20);
+	else
+		/* primary display palette. Enable LCD RAM only, 6-bit RAM */
+		smtc_seqw(0x66, (smtc_seqr(0x66) & 0xC3) | 0x10);
+	smtc_mmiowb(regno, dac_reg);
+	smtc_mmiowb(red >> 10, dac_val);
+	smtc_mmiowb(green >> 10, dac_val);
+	smtc_mmiowb(blue >> 10, dac_val);
+}
+
+static void smtc_set_timing(struct smtcfb_info *sfb, struct par_info
+		*ppar_info)
+{
+	switch (ppar_info->chipID) {
+	case 0x710:
+	case 0x712:
+	case 0x720:
+		sm712_set_timing(sfb, ppar_info);
+		break;
+	}
+}
+
+static struct fb_var_screeninfo smtcfb_var = {
+	.xres = 1024,
+	.yres = 600,
+	.xres_virtual = 1024,
+	.yres_virtual = 600,
+	.bits_per_pixel = 16,
+	.red = {16, 8, 0},
+	.green = {8, 8, 0},
+	.blue = {0, 8, 0},
+	.activate = FB_ACTIVATE_NOW,
+	.height = -1,
+	.width = -1,
+	.vmode = FB_VMODE_NONINTERLACED,
+};
+
+static struct fb_fix_screeninfo smtcfb_fix = {
+	.id = "sm712fb",
+	.type = FB_TYPE_PACKED_PIXELS,
+	.visual = FB_VISUAL_TRUECOLOR,
+	.line_length = 800 * 3,
+	.accel = FB_ACCEL_SMI_LYNX,
+};
+
+/* chan_to_field
+ *
+ * convert a colour value into a field position
+ *
+ * from pxafb.c
+ */
+
+static inline unsigned int chan_to_field(unsigned int chan,
+					 struct fb_bitfield *bf)
+{
+	chan &= 0xffff;
+	chan >>= 16 - bf->length;
+	return chan << bf->offset;
+}
+
+static int smtcfb_blank(int blank_mode, struct fb_info *info)
+{
+	/* clear DPMS setting */
+	switch (blank_mode) {
+	case FB_BLANK_UNBLANK:
+		/* Screen On: HSync: On, VSync : On */
+		smtc_seqw(0x01, (smtc_seqr(0x01) & (~0x20)));
+		smtc_seqw(0x6a, 0x16);
+		smtc_seqw(0x6b, 0x02);
+		smtc_seqw(0x21, (smtc_seqr(0x21) & 0x77));
+		smtc_seqw(0x22, (smtc_seqr(0x22) & (~0x30)));
+		smtc_seqw(0x23, (smtc_seqr(0x23) & (~0xc0)));
+		smtc_seqw(0x24, (smtc_seqr(0x24) | 0x01));
+		smtc_seqw(0x31, (smtc_seqr(0x31) | 0x03));
+		break;
+	case FB_BLANK_NORMAL:
+		/* Screen Off: HSync: On, VSync : On   Soft blank */
+		smtc_seqw(0x01, (smtc_seqr(0x01) & (~0x20)));
+		smtc_seqw(0x6a, 0x16);
+		smtc_seqw(0x6b, 0x02);
+		smtc_seqw(0x22, (smtc_seqr(0x22) & (~0x30)));
+		smtc_seqw(0x23, (smtc_seqr(0x23) & (~0xc0)));
+		smtc_seqw(0x24, (smtc_seqr(0x24) | 0x01));
+		smtc_seqw(0x31, ((smtc_seqr(0x31) & (~0x07)) | 0x00));
+		break;
+	case FB_BLANK_VSYNC_SUSPEND:
+		/* Screen On: HSync: On, VSync : Off */
+		smtc_seqw(0x01, (smtc_seqr(0x01) | 0x20));
+		smtc_seqw(0x20, (smtc_seqr(0x20) & (~0xB0)));
+		smtc_seqw(0x6a, 0x0c);
+		smtc_seqw(0x6b, 0x02);
+		smtc_seqw(0x21, (smtc_seqr(0x21) | 0x88));
+		smtc_seqw(0x22, ((smtc_seqr(0x22) & (~0x30)) | 0x20));
+		smtc_seqw(0x23, ((smtc_seqr(0x23) & (~0xc0)) | 0x20));
+		smtc_seqw(0x24, (smtc_seqr(0x24) & (~0x01)));
+		smtc_seqw(0x31, ((smtc_seqr(0x31) & (~0x07)) | 0x00));
+		smtc_seqw(0x34, (smtc_seqr(0x34) | 0x80));
+		break;
+	case FB_BLANK_HSYNC_SUSPEND:
+		/* Screen On: HSync: Off, VSync : On */
+		smtc_seqw(0x01, (smtc_seqr(0x01) | 0x20));
+		smtc_seqw(0x20, (smtc_seqr(0x20) & (~0xB0)));
+		smtc_seqw(0x6a, 0x0c);
+		smtc_seqw(0x6b, 0x02);
+		smtc_seqw(0x21, (smtc_seqr(0x21) | 0x88));
+		smtc_seqw(0x22, ((smtc_seqr(0x22) & (~0x30)) | 0x10));
+		smtc_seqw(0x23, ((smtc_seqr(0x23) & (~0xc0)) | 0xD8));
+		smtc_seqw(0x24, (smtc_seqr(0x24) & (~0x01)));
+		smtc_seqw(0x31, ((smtc_seqr(0x31) & (~0x07)) | 0x00));
+		smtc_seqw(0x34, (smtc_seqr(0x34) | 0x80));
+		break;
+	case FB_BLANK_POWERDOWN:
+		/* Screen On: HSync: Off, VSync : Off */
+		smtc_seqw(0x01, (smtc_seqr(0x01) | 0x20));
+		smtc_seqw(0x20, (smtc_seqr(0x20) & (~0xB0)));
+		smtc_seqw(0x6a, 0x0c);
+		smtc_seqw(0x6b, 0x02);
+		smtc_seqw(0x21, (smtc_seqr(0x21) | 0x88));
+		smtc_seqw(0x22, ((smtc_seqr(0x22) & (~0x30)) | 0x30));
+		smtc_seqw(0x23, ((smtc_seqr(0x23) & (~0xc0)) | 0xD8));
+		smtc_seqw(0x24, (smtc_seqr(0x24) & (~0x01)));
+		smtc_seqw(0x31, ((smtc_seqr(0x31) & (~0x07)) | 0x00));
+		smtc_seqw(0x34, (smtc_seqr(0x34) | 0x80));
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int smtc_setcolreg(unsigned regno, unsigned red, unsigned green,
+			  unsigned blue, unsigned trans, struct fb_info *info)
+{
+	struct smtcfb_info *sfb = (struct smtcfb_info *)info;
+	u32 val;
+
+	if (regno > 255)
+		return 1;
+
+	switch (sfb->fb.fix.visual) {
+	case FB_VISUAL_DIRECTCOLOR:
+	case FB_VISUAL_TRUECOLOR:
+		/*
+		 * 16/32 bit true-colour, use pseuo-palette for 16 base color
+		 */
+		if (regno < 16) {
+			if (sfb->fb.var.bits_per_pixel == 16) {
+				u32 *pal = sfb->fb.pseudo_palette;
+				val = chan_to_field(red, &sfb->fb.var.red);
+				val |= chan_to_field(green, \
+						&sfb->fb.var.green);
+				val |= chan_to_field(blue, &sfb->fb.var.blue);
+#ifdef __BIG_ENDIAN
+				pal[regno] =
+				    ((red & 0xf800) >> 8) |
+				    ((green & 0xe000) >> 13) |
+				    ((green & 0x1c00) << 3) |
+				    ((blue & 0xf800) >> 3);
+#else
+				pal[regno] = val;
+#endif
+			} else {
+				u32 *pal = sfb->fb.pseudo_palette;
+				val = chan_to_field(red, &sfb->fb.var.red);
+				val |= chan_to_field(green, \
+						&sfb->fb.var.green);
+				val |= chan_to_field(blue, &sfb->fb.var.blue);
+#ifdef __BIG_ENDIAN
+				val =
+				    (val & 0xff00ff00 >> 8) |
+				    (val & 0x00ff00ff << 8);
+#endif
+				pal[regno] = val;
+			}
+		}
+		break;
+
+	case FB_VISUAL_PSEUDOCOLOR:
+		/* color depth 8 bit */
+		sm712_setpalette(regno, red, green, blue, info);
+		break;
+
+	default:
+		return 1;	/* unknown type */
+	}
+
+	return 0;
+
+}
+
+#ifdef __BIG_ENDIAN
+static ssize_t smtcfb_read(struct fb_info *info, char __user * buf, size_t
+				count, loff_t *ppos)
+{
+	unsigned long p = *ppos;
+
+	u32 *buffer, *dst;
+	u32 __iomem *src;
+	int c, i, cnt = 0, err = 0;
+	unsigned long total_size;
+
+	if (!info || !info->screen_base)
+		return -ENODEV;
+
+	if (info->state != FBINFO_STATE_RUNNING)
+		return -EPERM;
+
+	total_size = info->screen_size;
+
+	if (total_size == 0)
+		total_size = info->fix.smem_len;
+
+	if (p >= total_size)
+		return 0;
+
+	if (count >= total_size)
+		count = total_size;
+
+	if (count + p > total_size)
+		count = total_size - p;
+
+	buffer = kmalloc((count > PAGE_SIZE) ? PAGE_SIZE : count, GFP_KERNEL);
+	if (!buffer)
+		return -ENOMEM;
+
+	src = (u32 __iomem *) (info->screen_base + p);
+
+	if (info->fbops->fb_sync)
+		info->fbops->fb_sync(info);
+
+	while (count) {
+		c = (count > PAGE_SIZE) ? PAGE_SIZE : count;
+		dst = buffer;
+		for (i = c >> 2; i--;) {
+			*dst = fb_readl(src++);
+			*dst =
+			    (*dst & 0xff00ff00 >> 8) |
+			    (*dst & 0x00ff00ff << 8);
+			dst++;
+		}
+		if (c & 3) {
+			u8 *dst8 = (u8 *) dst;
+			u8 __iomem *src8 = (u8 __iomem *) src;
+
+			for (i = c & 3; i--;) {
+				if (i & 1) {
+					*dst8++ = fb_readb(++src8);
+				} else {
+					*dst8++ = fb_readb(--src8);
+					src8 += 2;
+				}
+			}
+			src = (u32 __iomem *) src8;
+		}
+
+		if (copy_to_user(buf, buffer, c)) {
+			err = -EFAULT;
+			break;
+		}
+		*ppos += c;
+		buf += c;
+		cnt += c;
+		count -= c;
+	}
+
+	kfree(buffer);
+
+	return (err) ? err : cnt;
+}
+
+static ssize_t
+smtcfb_write(struct fb_info *info, const char __user *buf, size_t count,
+	     loff_t *ppos)
+{
+	unsigned long p = *ppos;
+
+	u32 *buffer, *src;
+	u32 __iomem *dst;
+	int c, i, cnt = 0, err = 0;
+	unsigned long total_size;
+
+	if (!info || !info->screen_base)
+		return -ENODEV;
+
+	if (info->state != FBINFO_STATE_RUNNING)
+		return -EPERM;
+
+	total_size = info->screen_size;
+
+	if (total_size == 0)
+		total_size = info->fix.smem_len;
+
+	if (p > total_size)
+		return -EFBIG;
+
+	if (count > total_size) {
+		err = -EFBIG;
+		count = total_size;
+	}
+
+	if (count + p > total_size) {
+		if (!err)
+			err = -ENOSPC;
+
+		count = total_size - p;
+	}
+
+	buffer = kmalloc((count > PAGE_SIZE) ? PAGE_SIZE : count, GFP_KERNEL);
+	if (!buffer)
+		return -ENOMEM;
+
+	dst = (u32 __iomem *) (info->screen_base + p);
+
+	if (info->fbops->fb_sync)
+		info->fbops->fb_sync(info);
+
+	while (count) {
+		c = (count > PAGE_SIZE) ? PAGE_SIZE : count;
+		src = buffer;
+
+		if (copy_from_user(src, buf, c)) {
+			err = -EFAULT;
+			break;
+		}
+
+		for (i = c >> 2; i--;) {
+			fb_writel((*src & 0xff00ff00 >> 8) |
+				  (*src & 0x00ff00ff << 8), dst++);
+			src++;
+		}
+		if (c & 3) {
+			u8 *src8 = (u8 *) src;
+			u8 __iomem *dst8 = (u8 __iomem *) dst;
+
+			for (i = c & 3; i--;) {
+				if (i & 1) {
+					fb_writeb(*src8++, ++dst8);
+				} else {
+					fb_writeb(*src8++, --dst8);
+					dst8 += 2;
+				}
+			}
+			dst = (u32 __iomem *) dst8;
+		}
+
+		*ppos += c;
+		buf += c;
+		cnt += c;
+		count -= c;
+	}
+
+	kfree(buffer);
+
+	return (cnt) ? cnt : err;
+}
+#endif	/* ! __BIG_ENDIAN */
+
+#include "smtc2d.c"
+
+void smtcfb_copyarea(struct fb_info *info, const struct fb_copyarea *area)
+{
+	struct par_info *p = (struct par_info *)info->par;
+
+	if (smtc_2Dacceleration) {
+		if (!area->width || !area->height)
+			return;
+
+		deCopy(p->BaseAddressInVRAM, 0, info->var.bits_per_pixel,
+		       area->dx, area->dy, area->width, area->height,
+		       p->BaseAddressInVRAM, 0, area->sx, area->sy, 0, 0xC);
+
+	} else
+		cfb_copyarea(info, area);
+}
+
+void smtcfb_fillrect(struct fb_info *info, const struct fb_fillrect *rect)
+{
+	struct par_info *p = (struct par_info *)info->par;
+
+	if (smtc_2Dacceleration) {
+		if (!rect->width || !rect->height)
+			return;
+		if (info->var.bits_per_pixel >= 24)
+			deFillRect(p->BaseAddressInVRAM, 0, rect->dx * 3,
+				   rect->dy * 3, rect->width * 3, rect->height,
+				   rect->color);
+		else
+			deFillRect(p->BaseAddressInVRAM, 0, rect->dx, rect->dy,
+				   rect->width, rect->height, rect->color);
+	} else
+		cfb_fillrect(info, rect);
+}
+
+void smtcfb_imageblit(struct fb_info *info, const struct fb_image *image)
+{
+	struct par_info *p = (struct par_info *)info->par;
+	u32 bg_col = 0, fg_col = 0;
+
+	if ((smtc_2Dacceleration) && (image->depth == 1)) {
+		if (smtc_de_busy)
+			deWaitForNotBusy();
+
+		switch (info->var.bits_per_pixel) {
+		case 8:
+			bg_col = image->bg_color;
+			fg_col = image->fg_color;
+			break;
+		case 16:
+			bg_col =
+			    ((u32 *) (info->pseudo_palette))[image->bg_color];
+			fg_col =
+			    ((u32 *) (info->pseudo_palette))[image->fg_color];
+			break;
+		case 32:
+			bg_col =
+			    ((u32 *) (info->pseudo_palette))[image->bg_color];
+			fg_col =
+			    ((u32 *) (info->pseudo_palette))[image->fg_color];
+			break;
+		}
+
+		deSystemMem2VideoMemMonoBlt(
+			image->data,
+			image->width / 8,
+			0,
+			p->BaseAddressInVRAM,
+			0,
+			0,
+			image->dx, image->dy,
+			image->width, image->height,
+			fg_col, bg_col,
+			0x0C);
+
+	} else
+		cfb_imageblit(info, image);
+}
+
+static struct fb_ops smtcfb_ops = {
+	.owner = THIS_MODULE,
+	.fb_setcolreg = smtc_setcolreg,
+	.fb_blank = smtcfb_blank,
+	.fb_fillrect = smtcfb_fillrect,
+	.fb_imageblit = smtcfb_imageblit,
+	.fb_copyarea = smtcfb_copyarea,
+#ifdef __BIG_ENDIAN
+	.fb_read = smtcfb_read,
+	.fb_write = smtcfb_write,
+#endif
+
+};
+
+void smtcfb_setmode(struct smtcfb_info *sfb)
+{
+	switch (sfb->fb.var.bits_per_pixel) {
+	case 32:
+		sfb->fb.fix.visual = FB_VISUAL_TRUECOLOR;
+		sfb->fb.fix.line_length = sfb->fb.var.xres * 4;
+		sfb->fb.var.red.length = 8;
+		sfb->fb.var.green.length = 8;
+		sfb->fb.var.blue.length = 8;
+		sfb->fb.var.red.offset = 16;
+		sfb->fb.var.green.offset = 8;
+		sfb->fb.var.blue.offset = 0;
+
+		break;
+	case 8:
+		sfb->fb.fix.visual = FB_VISUAL_PSEUDOCOLOR;
+		sfb->fb.fix.line_length = sfb->fb.var.xres;
+		sfb->fb.var.red.offset = 5;
+		sfb->fb.var.red.length = 3;
+		sfb->fb.var.green.offset = 2;
+		sfb->fb.var.green.length = 3;
+		sfb->fb.var.blue.offset = 0;
+		sfb->fb.var.blue.length = 2;
+		break;
+	case 24:
+		sfb->fb.fix.visual = FB_VISUAL_TRUECOLOR;
+		sfb->fb.fix.line_length = sfb->fb.var.xres * 3;
+		sfb->fb.var.red.length = 8;
+		sfb->fb.var.green.length = 8;
+		sfb->fb.var.blue.length = 8;
+
+		sfb->fb.var.red.offset = 16;
+		sfb->fb.var.green.offset = 8;
+		sfb->fb.var.blue.offset = 0;
+
+		break;
+	case 16:
+	default:
+		sfb->fb.fix.visual = FB_VISUAL_TRUECOLOR;
+		sfb->fb.fix.line_length = sfb->fb.var.xres * 2;
+
+		sfb->fb.var.red.length = 5;
+		sfb->fb.var.green.length = 6;
+		sfb->fb.var.blue.length = 5;
+
+		sfb->fb.var.red.offset = 11;
+		sfb->fb.var.green.offset = 5;
+		sfb->fb.var.blue.offset = 0;
+
+		break;
+	}
+
+	hw.width = sfb->fb.var.xres;
+	hw.height = sfb->fb.var.yres;
+	hw.hz = 60;
+	smtc_set_timing(sfb, &hw);
+	if (smtc_2Dacceleration) {
+		printk("2D acceleration enabled!\n");
+		/* Init smtc drawing engine */
+		deInit(sfb->fb.var.xres, sfb->fb.var.yres,
+				sfb->fb.var.bits_per_pixel);
+	}
+}
+
+/*
+ * Alloc struct smtcfb_info and assign the default value
+ */
+static struct smtcfb_info *smtc_alloc_fb_info(struct pci_dev *dev,
+							char *name)
+{
+	struct smtcfb_info *sfb;
+
+	sfb = kmalloc(sizeof(struct smtcfb_info), GFP_KERNEL);
+
+	if (!sfb)
+		return NULL;
+
+	memset(sfb, 0, sizeof(struct smtcfb_info));
+
+	sfb->currcon = -1;
+	sfb->dev = dev;
+
+	/*** Init sfb->fb with default value ***/
+	sfb->fb.flags = FBINFO_FLAG_DEFAULT;
+	sfb->fb.fbops = &smtcfb_ops;
+	sfb->fb.var = smtcfb_var;
+	sfb->fb.fix = smtcfb_fix;
+
+	strcpy(sfb->fb.fix.id, name);
+
+	sfb->fb.fix.type = FB_TYPE_PACKED_PIXELS;
+	sfb->fb.fix.type_aux = 0;
+	sfb->fb.fix.xpanstep = 0;
+	sfb->fb.fix.ypanstep = 0;
+	sfb->fb.fix.ywrapstep = 0;
+	sfb->fb.fix.accel = FB_ACCEL_SMI_LYNX;
+
+	sfb->fb.var.nonstd = 0;
+	sfb->fb.var.activate = FB_ACTIVATE_NOW;
+	sfb->fb.var.height = -1;
+	sfb->fb.var.width = -1;
+	/* text mode acceleration */
+	sfb->fb.var.accel_flags = FB_ACCELF_TEXT;
+	sfb->fb.var.vmode = FB_VMODE_NONINTERLACED;
+	sfb->fb.par = &hw;
+	sfb->fb.pseudo_palette = colreg;
+
+	return sfb;
+}
+
+/*
+ * Unmap in the memory mapped IO registers
+ */
+
+static void smtc_unmap_mmio(struct smtcfb_info *sfb)
+{
+	if (sfb && smtc_RegBaseAddress)
+		smtc_RegBaseAddress = NULL;
+}
+
+/*
+ * Map in the screen memory
+ */
+
+static int smtc_map_smem(struct smtcfb_info *sfb,
+		struct pci_dev *dev, u_long smem_len)
+{
+	if (sfb->fb.var.bits_per_pixel == 32) {
+#ifdef __BIG_ENDIAN
+		sfb->fb.fix.smem_start = pci_resource_start(dev, 0)
+			+ 0x800000;
+#else
+		sfb->fb.fix.smem_start = pci_resource_start(dev, 0);
+#endif
+	} else {
+		sfb->fb.fix.smem_start = pci_resource_start(dev, 0);
+	}
+
+	sfb->fb.fix.smem_len = smem_len;
+
+	sfb->fb.screen_base = smtc_VRAMBaseAddress;
+
+	if (!sfb->fb.screen_base) {
+		printk(KERN_INFO "%s: unable to map screen memory\n",
+				sfb->fb.fix.id);
+		return -ENOMEM;
+	}
+
+	return 0;
+}
+
+/*
+ * Unmap in the screen memory
+ *
+ */
+static void smtc_unmap_smem(struct smtcfb_info *sfb)
+{
+	if (sfb && sfb->fb.screen_base) {
+		iounmap(sfb->fb.screen_base);
+		sfb->fb.screen_base = NULL;
+	}
+}
+
+/*
+ * We need to wake up the LynxEM+, and make sure its in linear memory mode.
+ */
+static inline void sm7xx_init_hw(void)
+{
+	outb_p(0x18, 0x3c4);
+	outb_p(0x11, 0x3c5);
+}
+
+static void smtc_free_fb_info(struct smtcfb_info *sfb)
+{
+	if (sfb) {
+		fb_alloc_cmap(&sfb->fb.cmap, 0, 0);
+		kfree(sfb);
+	}
+}
+
+/*
+ *	sm712vga_setup - process command line options, get vga parameter
+ *	@options: string of options
+ *	Returns zero.
+ *
+ */
+static int __init __maybe_unused sm712vga_setup(char *options)
+{
+	int index;
+
+	if (!options || !*options) {
+		smdbg("\n No vga parameter\n");
+		return -EINVAL;
+	}
+
+	smtc_screen_info.lfb_width = 0;
+	smtc_screen_info.lfb_height = 0;
+	smtc_screen_info.lfb_depth = 0;
+
+	smdbg("\nsm712vga_setup = %s\n", options);
+
+	for (index = 0;
+	     index < (sizeof(vesa_mode) / sizeof(struct vesa_mode_table));
+	     index++) {
+		if (strstr(options, vesa_mode[index].mode_index)) {
+			smtc_screen_info.lfb_width = vesa_mode[index].lfb_width;
+			smtc_screen_info.lfb_height =
+					vesa_mode[index].lfb_height;
+			smtc_screen_info.lfb_depth = vesa_mode[index].lfb_depth;
+			return 0;
+		}
+	}
+
+	return -1;
+}
+__setup("vga=", sm712vga_setup);
+
+/* Jason (08/13/2009)
+ * Original init function changed to probe method to be used by pci_drv
+ * process used to detect chips replaced with kernel process in pci_drv
+ */
+static int __init smtcfb_pci_probe(struct pci_dev *pdev,
+				   const struct pci_device_id *ent)
+{
+	struct smtcfb_info *sfb;
+	u_long smem_size = 0x00800000;	/* default 8MB */
+	char name[16];
+	int err;
+	unsigned long pFramebufferPhysical;
+
+	printk(KERN_INFO
+		"Silicon Motion display driver " SMTC_LINUX_FB_VERSION "\n");
+
+	err = pci_enable_device(pdev);	/* enable SMTC chip */
+
+	if (err)
+		return err;
+	err = -ENOMEM;
+
+	hw.chipID = ent->device;
+	sprintf(name, "sm%Xfb", hw.chipID);
+
+	sfb = smtc_alloc_fb_info(pdev, name);
+
+	if (!sfb)
+		goto failed;
+	/* Jason (08/13/2009)
+	 * Store fb_info to be further used when suspending and resuming
+	 */
+	pci_set_drvdata(pdev, sfb);
+
+	sm7xx_init_hw();
+
+	/*get mode parameter from smtc_screen_info */
+	if (smtc_screen_info.lfb_width != 0) {
+		sfb->fb.var.xres = smtc_screen_info.lfb_width;
+		sfb->fb.var.yres = smtc_screen_info.lfb_height;
+		sfb->fb.var.bits_per_pixel = smtc_screen_info.lfb_depth;
+	} else {
+		/* default resolution 1024x600 16bit mode */
+		sfb->fb.var.xres = SCREEN_X_RES;
+		sfb->fb.var.yres = SCREEN_Y_RES;
+		sfb->fb.var.bits_per_pixel = SCREEN_BPP;
+	}
+
+#ifdef __BIG_ENDIAN
+	if (sfb->fb.var.bits_per_pixel == 24)
+		sfb->fb.var.bits_per_pixel = (smtc_screen_info.lfb_depth = 32);
+#endif
+	/* Map address and memory detection */
+	pFramebufferPhysical = pci_resource_start(pdev, 0);
+	pci_read_config_byte(pdev, PCI_REVISION_ID, &hw.chipRevID);
+
+	switch (hw.chipID) {
+	case 0x710:
+	case 0x712:
+		sfb->fb.fix.mmio_start = pFramebufferPhysical + 0x00400000;
+		sfb->fb.fix.mmio_len = 0x00400000;
+		smem_size = SM712_VIDEOMEMORYSIZE;
+#ifdef __BIG_ENDIAN
+		hw.m_pLFB = (smtc_VRAMBaseAddress =
+		    ioremap(pFramebufferPhysical, 0x00c00000));
+#else
+		hw.m_pLFB = (smtc_VRAMBaseAddress =
+		    ioremap(pFramebufferPhysical, 0x00800000));
+#endif
+		hw.m_pMMIO = (smtc_RegBaseAddress =
+		    smtc_VRAMBaseAddress + 0x00700000);
+		smtc_2DBaseAddress = (hw.m_pDPR =
+		    smtc_VRAMBaseAddress + 0x00408000);
+		smtc_2Ddataport = smtc_VRAMBaseAddress + DE_DATA_PORT_712;
+		hw.m_pVPR = hw.m_pLFB + 0x0040c000;
+#ifdef __BIG_ENDIAN
+		if (sfb->fb.var.bits_per_pixel == 32) {
+			smtc_VRAMBaseAddress += 0x800000;
+			hw.m_pLFB += 0x800000;
+			printk(KERN_INFO
+				"\nsmtc_VRAMBaseAddress=%p hw.m_pLFB=%p\n",
+					smtc_VRAMBaseAddress, hw.m_pLFB);
+		}
+#endif
+		if (!smtc_RegBaseAddress) {
+			printk(KERN_INFO
+				"%s: unable to map memory mapped IO\n",
+				sfb->fb.fix.id);
+			return -ENOMEM;
+		}
+
+		/* set MCLK = 14.31818 * (0x16 / 0x2) */
+		smtc_seqw(0x6a, 0x16);
+		smtc_seqw(0x6b, 0x02);
+		smtc_seqw(0x62, 0x3e);
+		/* enable PCI burst */
+		smtc_seqw(0x17, 0x20);
+		/* enable word swap */
+#ifdef __BIG_ENDIAN
+		if (sfb->fb.var.bits_per_pixel == 32)
+			smtc_seqw(0x17, 0x30);
+#endif
+#ifdef CONFIG_FB_SM7XX_ACCEL
+		smtc_2Dacceleration = 1;
+#endif
+		break;
+	case 0x720:
+		sfb->fb.fix.mmio_start = pFramebufferPhysical;
+		sfb->fb.fix.mmio_len = 0x00200000;
+		smem_size = SM722_VIDEOMEMORYSIZE;
+		smtc_2DBaseAddress = (hw.m_pDPR =
+		    ioremap(pFramebufferPhysical, 0x00a00000));
+		hw.m_pLFB = (smtc_VRAMBaseAddress =
+		    smtc_2DBaseAddress + 0x00200000);
+		hw.m_pMMIO = (smtc_RegBaseAddress =
+		    smtc_2DBaseAddress + 0x000c0000);
+		smtc_2Ddataport = smtc_2DBaseAddress + DE_DATA_PORT_722;
+		hw.m_pVPR = smtc_2DBaseAddress + 0x800;
+
+		smtc_seqw(0x62, 0xff);
+		smtc_seqw(0x6a, 0x0d);
+		smtc_seqw(0x6b, 0x02);
+		smtc_2Dacceleration = 0;
+		break;
+	default:
+		printk(KERN_INFO
+		"No valid Silicon Motion display chip was detected!\n");
+
+		smtc_free_fb_info(sfb);
+		return err;
+	}
+
+	/* can support 32 bpp */
+	if (15 == sfb->fb.var.bits_per_pixel)
+		sfb->fb.var.bits_per_pixel = 16;
+
+	sfb->fb.var.xres_virtual = sfb->fb.var.xres;
+	sfb->fb.var.yres_virtual = sfb->fb.var.yres;
+	err = smtc_map_smem(sfb, pdev, smem_size);
+	if (err)
+		goto failed;
+
+	smtcfb_setmode(sfb);
+	/* Primary display starting from 0 postion */
+	hw.BaseAddressInVRAM = 0;
+	sfb->fb.par = &hw;
+
+	err = register_framebuffer(&sfb->fb);
+	if (err < 0)
+		goto failed;
+
+	printk(KERN_INFO "Silicon Motion SM%X Rev%X primary display mode"
+			"%dx%d-%d Init Complete.\n", hw.chipID, hw.chipRevID,
+			sfb->fb.var.xres, sfb->fb.var.yres,
+			sfb->fb.var.bits_per_pixel);
+
+	return 0;
+
+ failed:
+	printk(KERN_INFO "Silicon Motion, Inc.  primary display init fail\n");
+
+	smtc_unmap_smem(sfb);
+	smtc_unmap_mmio(sfb);
+	smtc_free_fb_info(sfb);
+
+	return err;
+}
+
+
+/* Jason (08/11/2009) PCI_DRV wrapper essential structs */
+static struct pci_device_id smtcfb_pci_table[] = {
+	{0x126f, 0x710, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
+	{0x126f, 0x712, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
+	{0x126f, 0x720, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
+	{0,}
+};
+
+
+/* Jason (08/14/2009)
+ * do some clean up when the driver module is removed
+ */
+static void __devexit smtcfb_pci_remove(struct pci_dev *pdev)
+{
+	struct smtcfb_info *sfb;
+
+	sfb = pci_get_drvdata(pdev);
+	pci_set_drvdata(pdev, NULL);
+	smtc_unmap_smem(sfb);
+	smtc_unmap_mmio(sfb);
+	unregister_framebuffer(&sfb->fb);
+	smtc_free_fb_info(sfb);
+}
+
+/* Jason (08/14/2009)
+ * suspend function, called when the suspend event is triggered
+ */
+static int __maybe_unused smtcfb_suspend(struct pci_dev *pdev, pm_message_t msg)
+{
+	struct smtcfb_info *sfb;
+	int retv;
+
+	sfb = pci_get_drvdata(pdev);
+
+	/* set the hw in sleep mode use externel clock and self memory refresh
+	 * so that we can turn off internal PLLs later on
+	 */
+	smtc_seqw(0x20, (smtc_seqr(0x20) | 0xc0));
+	smtc_seqw(0x69, (smtc_seqr(0x69) & 0xf7));
+
+	switch (msg.event) {
+	case PM_EVENT_FREEZE:
+	case PM_EVENT_PRETHAW:
+		pdev->dev.power.power_state = msg;
+		return 0;
+	}
+
+	/* when doing suspend, call fb apis and pci apis */
+	if (msg.event == PM_EVENT_SUSPEND) {
+		acquire_console_sem();
+		fb_set_suspend(&sfb->fb, 1);
+		release_console_sem();
+		retv = pci_save_state(pdev);
+		pci_disable_device(pdev);
+		retv = pci_choose_state(pdev, msg);
+		retv = pci_set_power_state(pdev, retv);
+	}
+
+	pdev->dev.power.power_state = msg;
+
+	/* additionaly turn off all function blocks including internal PLLs */
+	smtc_seqw(0x21, 0xff);
+
+	return 0;
+}
+
+static int __maybe_unused smtcfb_resume(struct pci_dev *pdev)
+{
+	struct smtcfb_info *sfb;
+	int retv;
+
+	sfb = pci_get_drvdata(pdev);
+
+	/* when resuming, restore pci data and fb cursor */
+	if (pdev->dev.power.power_state.event != PM_EVENT_FREEZE) {
+		retv = pci_set_power_state(pdev, PCI_D0);
+		retv = pci_restore_state(pdev);
+		if (pci_enable_device(pdev))
+			return -1;
+		pci_set_master(pdev);
+	}
+
+	/* reinit hardware */
+	sm7xx_init_hw();
+	switch (hw.chipID) {
+	case 0x710:
+	case 0x712:
+		/* set MCLK = 14.31818 *  (0x16 / 0x2) */
+		smtc_seqw(0x6a, 0x16);
+		smtc_seqw(0x6b, 0x02);
+		smtc_seqw(0x62, 0x3e);
+		/* enable PCI burst */
+		smtc_seqw(0x17, 0x20);
+#ifdef __BIG_ENDIAN
+		if (sfb->fb.var.bits_per_pixel == 32)
+			smtc_seqw(0x17, 0x30);
+#endif
+		break;
+	case 0x720:
+		smtc_seqw(0x62, 0xff);
+		smtc_seqw(0x6a, 0x0d);
+		smtc_seqw(0x6b, 0x02);
+		break;
+	}
+
+	smtc_seqw(0x34, (smtc_seqr(0x34) | 0xc0));
+	smtc_seqw(0x33, ((smtc_seqr(0x33) | 0x08) & 0xfb));
+
+	smtcfb_setmode(sfb);
+
+	acquire_console_sem();
+	fb_set_suspend(&sfb->fb, 0);
+	release_console_sem();
+
+	return 0;
+}
+
+/* Jason (08/13/2009)
+ * pci_driver struct used to wrap the original driver
+ * so that it can be registered into the kernel and
+ * the proper method would be called when suspending and resuming
+ */
+static struct pci_driver smtcfb_driver = {
+	.name = "smtcfb",
+	.id_table = smtcfb_pci_table,
+	.probe = smtcfb_pci_probe,
+	.remove = __devexit_p(smtcfb_pci_remove),
+#ifdef CONFIG_PM
+	.suspend = smtcfb_suspend,
+	.resume = smtcfb_resume,
+#endif
+};
+
+static int __init smtcfb_init(void)
+{
+	return pci_register_driver(&smtcfb_driver);
+}
+
+static void __exit smtcfb_exit(void)
+{
+	pci_unregister_driver(&smtcfb_driver);
+}
+
+module_init(smtcfb_init);
+module_exit(smtcfb_exit);
+
+MODULE_AUTHOR("Siliconmotion ");
+MODULE_DESCRIPTION("Framebuffer driver for SMI Graphic Cards");
+MODULE_LICENSE("GPL");
diff --git a/drivers/staging/sm7xx/smtcfb.h b/drivers/staging/sm7xx/smtcfb.h
new file mode 100644
index 000000000000..7f2c34138215
--- /dev/null
+++ b/drivers/staging/sm7xx/smtcfb.h
@@ -0,0 +1,793 @@
+/*
+ * Silicon Motion SM712 frame buffer device
+ *
+ * Copyright (C) 2006 Silicon Motion Technology Corp.
+ * Authors:	Ge Wang, gewang@siliconmotion.com
+ *	 	Boyod boyod.yang@siliconmotion.com.cn
+ *
+ * Copyright (C) 2009 Lemote, Inc.
+ * Author: Wu Zhangjin, wuzj@lemote.com
+ *
+ *  This file is subject to the terms and conditions of the GNU General Public
+ *  License. See the file COPYING in the main directory of this archive for
+ *  more details.
+ */
+
+#define SMTC_LINUX_FB_VERSION	"version 0.11.2619.21.01 July 27, 2008"
+
+#define NR_PALETTE        256
+#define NR_RGB            2
+
+#define FB_ACCEL_SMI_LYNX 88
+
+#ifdef __BIG_ENDIAN
+#define PC_VGA            0
+#else
+#define PC_VGA            1
+#endif
+
+#define SCREEN_X_RES      1024
+#define SCREEN_Y_RES      600
+#define SCREEN_BPP        16
+
+#ifndef FIELD_OFFSET
+#define FIELD_OFSFET(type, field) \
+	((unsigned long) (PUCHAR) & (((type *)0)->field))
+#endif
+
+/*Assume SM712 graphics chip has 4MB VRAM */
+#define SM712_VIDEOMEMORYSIZE	  0x00400000
+/*Assume SM722 graphics chip has 8MB VRAM */
+#define SM722_VIDEOMEMORYSIZE	  0x00800000
+
+#define dac_reg	(0x3c8)
+#define dac_val	(0x3c9)
+
+extern char *smtc_RegBaseAddress;
+#define smtc_mmiowb(dat, reg)	writeb(dat, smtc_RegBaseAddress + reg)
+#define smtc_mmioww(dat, reg)	writew(dat, smtc_RegBaseAddress + reg)
+#define smtc_mmiowl(dat, reg)	writel(dat, smtc_RegBaseAddress + reg)
+
+#define smtc_mmiorb(reg)	readb(smtc_RegBaseAddress + reg)
+#define smtc_mmiorw(reg)	readw(smtc_RegBaseAddress + reg)
+#define smtc_mmiorl(reg)	readl(smtc_RegBaseAddress + reg)
+
+#define SIZE_SR00_SR04      (0x04 - 0x00 + 1)
+#define SIZE_SR10_SR24      (0x24 - 0x10 + 1)
+#define SIZE_SR30_SR75      (0x75 - 0x30 + 1)
+#define SIZE_SR80_SR93      (0x93 - 0x80 + 1)
+#define SIZE_SRA0_SRAF      (0xAF - 0xA0 + 1)
+#define SIZE_GR00_GR08      (0x08 - 0x00 + 1)
+#define SIZE_AR00_AR14      (0x14 - 0x00 + 1)
+#define SIZE_CR00_CR18      (0x18 - 0x00 + 1)
+#define SIZE_CR30_CR4D      (0x4D - 0x30 + 1)
+#define SIZE_CR90_CRA7      (0xA7 - 0x90 + 1)
+#define SIZE_VPR		(0x6C + 1)
+#define SIZE_DPR		(0x44 + 1)
+
+static inline void smtc_crtcw(int reg, int val)
+{
+	smtc_mmiowb(reg, 0x3d4);
+	smtc_mmiowb(val, 0x3d5);
+}
+
+static inline unsigned int smtc_crtcr(int reg)
+{
+	smtc_mmiowb(reg, 0x3d4);
+	return smtc_mmiorb(0x3d5);
+}
+
+static inline void smtc_grphw(int reg, int val)
+{
+	smtc_mmiowb(reg, 0x3ce);
+	smtc_mmiowb(val, 0x3cf);
+}
+
+static inline unsigned int smtc_grphr(int reg)
+{
+	smtc_mmiowb(reg, 0x3ce);
+	return smtc_mmiorb(0x3cf);
+}
+
+static inline void smtc_attrw(int reg, int val)
+{
+	smtc_mmiorb(0x3da);
+	smtc_mmiowb(reg, 0x3c0);
+	smtc_mmiorb(0x3c1);
+	smtc_mmiowb(val, 0x3c0);
+}
+
+static inline void smtc_seqw(int reg, int val)
+{
+	smtc_mmiowb(reg, 0x3c4);
+	smtc_mmiowb(val, 0x3c5);
+}
+
+static inline unsigned int smtc_seqr(int reg)
+{
+	smtc_mmiowb(reg, 0x3c4);
+	return smtc_mmiorb(0x3c5);
+}
+
+/* The next structure holds all information relevant for a specific video mode.
+ */
+
+struct ModeInit {
+	int mmSizeX;
+	int mmSizeY;
+	int bpp;
+	int hz;
+	unsigned char Init_MISC;
+	unsigned char Init_SR00_SR04[SIZE_SR00_SR04];
+	unsigned char Init_SR10_SR24[SIZE_SR10_SR24];
+	unsigned char Init_SR30_SR75[SIZE_SR30_SR75];
+	unsigned char Init_SR80_SR93[SIZE_SR80_SR93];
+	unsigned char Init_SRA0_SRAF[SIZE_SRA0_SRAF];
+	unsigned char Init_GR00_GR08[SIZE_GR00_GR08];
+	unsigned char Init_AR00_AR14[SIZE_AR00_AR14];
+	unsigned char Init_CR00_CR18[SIZE_CR00_CR18];
+	unsigned char Init_CR30_CR4D[SIZE_CR30_CR4D];
+	unsigned char Init_CR90_CRA7[SIZE_CR90_CRA7];
+};
+
+/**********************************************************************
+			 SM712 Mode table.
+ **********************************************************************/
+struct ModeInit VGAMode[] = {
+	{
+	 /*  mode#0: 640 x 480  16Bpp  60Hz */
+	 640, 480, 16, 60,
+	 /*  Init_MISC */
+	 0xE3,
+	 {			/*  Init_SR0_SR4 */
+	  0x03, 0x01, 0x0F, 0x00, 0x0E,
+	  },
+	 {			/*  Init_SR10_SR24 */
+	  0xFF, 0xBE, 0xEF, 0xFF, 0x00, 0x0E, 0x17, 0x2C,
+	  0x99, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	  0xC4, 0x30, 0x02, 0x01, 0x01,
+	  },
+	 {			/*  Init_SR30_SR75 */
+	  0x32, 0x03, 0xA0, 0x09, 0xC0, 0x32, 0x32, 0x32,
+	  0x32, 0x32, 0x32, 0x32, 0x00, 0x00, 0x03, 0xFF,
+	  0x00, 0xFC, 0x00, 0x00, 0x20, 0x18, 0x00, 0xFC,
+	  0x20, 0x0C, 0x44, 0x20, 0x00, 0x32, 0x32, 0x32,
+	  0x04, 0x24, 0x63, 0x4F, 0x52, 0x0B, 0xDF, 0xEA,
+	  0x04, 0x50, 0x19, 0x32, 0x32, 0x00, 0x00, 0x32,
+	  0x01, 0x80, 0x7E, 0x1A, 0x1A, 0x00, 0x00, 0x00,
+	  0x50, 0x03, 0x74, 0x14, 0x07, 0x82, 0x07, 0x04,
+	  0x00, 0x45, 0x30, 0x30, 0x40, 0x30,
+	  },
+	 {			/*  Init_SR80_SR93 */
+	  0xFF, 0x07, 0x00, 0x6F, 0x7F, 0x7F, 0xFF, 0x32,
+	  0xF7, 0x00, 0x00, 0x00, 0xEF, 0xFF, 0x32, 0x32,
+	  0x00, 0x00, 0x00, 0x00,
+	  },
+	 {			/*  Init_SRA0_SRAF */
+	  0x00, 0xFF, 0xBF, 0xFF, 0xFF, 0xED, 0xED, 0xED,
+	  0x7B, 0xFF, 0xFF, 0xFF, 0xBF, 0xEF, 0xFF, 0xDF,
+	  },
+	 {			/*  Init_GR00_GR08 */
+	  0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x05, 0x0F,
+	  0xFF,
+	  },
+	 {			/*  Init_AR00_AR14 */
+	  0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+	  0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F,
+	  0x41, 0x00, 0x0F, 0x00, 0x00,
+	  },
+	 {			/*  Init_CR00_CR18 */
+	  0x5F, 0x4F, 0x4F, 0x00, 0x53, 0x1F, 0x0B, 0x3E,
+	  0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	  0xEA, 0x0C, 0xDF, 0x50, 0x40, 0xDF, 0x00, 0xE3,
+	  0xFF,
+	  },
+	 {			/*  Init_CR30_CR4D */
+	  0x00, 0x00, 0x00, 0x00, 0x00, 0x55, 0x03, 0x20,
+	  0x00, 0x00, 0x00, 0x40, 0x00, 0xE7, 0xFF, 0xFD,
+	  0x5F, 0x4F, 0x00, 0x54, 0x00, 0x0B, 0xDF, 0x00,
+	  0xEA, 0x0C, 0x2E, 0x00, 0x4F, 0xDF,
+	  },
+	 {			/*  Init_CR90_CRA7 */
+	  0x56, 0xDD, 0x5E, 0xEA, 0x87, 0x44, 0x8F, 0x55,
+	  0x0A, 0x8F, 0x55, 0x0A, 0x00, 0x00, 0x18, 0x00,
+	  0x11, 0x10, 0x0B, 0x0A, 0x0A, 0x0A, 0x0A, 0x00,
+	  },
+	 },
+	{
+	 /*  mode#1: 640 x 480  24Bpp  60Hz */
+	 640, 480, 24, 60,
+	 /*  Init_MISC */
+	 0xE3,
+	 {			/*  Init_SR0_SR4 */
+	  0x03, 0x01, 0x0F, 0x00, 0x0E,
+	  },
+	 {			/*  Init_SR10_SR24 */
+	  0xFF, 0xBE, 0xEF, 0xFF, 0x00, 0x0E, 0x17, 0x2C,
+	  0x99, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	  0xC4, 0x30, 0x02, 0x01, 0x01,
+	  },
+	 {			/*  Init_SR30_SR75 */
+	  0x32, 0x03, 0xA0, 0x09, 0xC0, 0x32, 0x32, 0x32,
+	  0x32, 0x32, 0x32, 0x32, 0x00, 0x00, 0x03, 0xFF,
+	  0x00, 0xFC, 0x00, 0x00, 0x20, 0x18, 0x00, 0xFC,
+	  0x20, 0x0C, 0x44, 0x20, 0x00, 0x32, 0x32, 0x32,
+	  0x04, 0x24, 0x63, 0x4F, 0x52, 0x0B, 0xDF, 0xEA,
+	  0x04, 0x50, 0x19, 0x32, 0x32, 0x00, 0x00, 0x32,
+	  0x01, 0x80, 0x7E, 0x1A, 0x1A, 0x00, 0x00, 0x00,
+	  0x50, 0x03, 0x74, 0x14, 0x07, 0x82, 0x07, 0x04,
+	  0x00, 0x45, 0x30, 0x30, 0x40, 0x30,
+	  },
+	 {			/*  Init_SR80_SR93 */
+	  0xFF, 0x07, 0x00, 0x6F, 0x7F, 0x7F, 0xFF, 0x32,
+	  0xF7, 0x00, 0x00, 0x00, 0xEF, 0xFF, 0x32, 0x32,
+	  0x00, 0x00, 0x00, 0x00,
+	  },
+	 {			/*  Init_SRA0_SRAF */
+	  0x00, 0xFF, 0xBF, 0xFF, 0xFF, 0xED, 0xED, 0xED,
+	  0x7B, 0xFF, 0xFF, 0xFF, 0xBF, 0xEF, 0xFF, 0xDF,
+	  },
+	 {			/*  Init_GR00_GR08 */
+	  0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x05, 0x0F,
+	  0xFF,
+	  },
+	 {			/*  Init_AR00_AR14 */
+	  0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+	  0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F,
+	  0x41, 0x00, 0x0F, 0x00, 0x00,
+	  },
+	 {			/*  Init_CR00_CR18 */
+	  0x5F, 0x4F, 0x4F, 0x00, 0x53, 0x1F, 0x0B, 0x3E,
+	  0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	  0xEA, 0x0C, 0xDF, 0x50, 0x40, 0xDF, 0x00, 0xE3,
+	  0xFF,
+	  },
+	 {			/*  Init_CR30_CR4D */
+	  0x00, 0x00, 0x00, 0x00, 0x00, 0x55, 0x03, 0x20,
+	  0x00, 0x00, 0x00, 0x40, 0x00, 0xE7, 0xFF, 0xFD,
+	  0x5F, 0x4F, 0x00, 0x54, 0x00, 0x0B, 0xDF, 0x00,
+	  0xEA, 0x0C, 0x2E, 0x00, 0x4F, 0xDF,
+	  },
+	 {			/*  Init_CR90_CRA7 */
+	  0x56, 0xDD, 0x5E, 0xEA, 0x87, 0x44, 0x8F, 0x55,
+	  0x0A, 0x8F, 0x55, 0x0A, 0x00, 0x00, 0x18, 0x00,
+	  0x11, 0x10, 0x0B, 0x0A, 0x0A, 0x0A, 0x0A, 0x00,
+	  },
+	 },
+	{
+	 /*  mode#0: 640 x 480  32Bpp  60Hz */
+	 640, 480, 32, 60,
+	 /*  Init_MISC */
+	 0xE3,
+	 {			/*  Init_SR0_SR4 */
+	  0x03, 0x01, 0x0F, 0x00, 0x0E,
+	  },
+	 {			/*  Init_SR10_SR24 */
+	  0xFF, 0xBE, 0xEF, 0xFF, 0x00, 0x0E, 0x17, 0x2C,
+	  0x99, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	  0xC4, 0x30, 0x02, 0x01, 0x01,
+	  },
+	 {			/*  Init_SR30_SR75 */
+	  0x32, 0x03, 0xA0, 0x09, 0xC0, 0x32, 0x32, 0x32,
+	  0x32, 0x32, 0x32, 0x32, 0x00, 0x00, 0x03, 0xFF,
+	  0x00, 0xFC, 0x00, 0x00, 0x20, 0x18, 0x00, 0xFC,
+	  0x20, 0x0C, 0x44, 0x20, 0x00, 0x32, 0x32, 0x32,
+	  0x04, 0x24, 0x63, 0x4F, 0x52, 0x0B, 0xDF, 0xEA,
+	  0x04, 0x50, 0x19, 0x32, 0x32, 0x00, 0x00, 0x32,
+	  0x01, 0x80, 0x7E, 0x1A, 0x1A, 0x00, 0x00, 0x00,
+	  0x50, 0x03, 0x74, 0x14, 0x07, 0x82, 0x07, 0x04,
+	  0x00, 0x45, 0x30, 0x30, 0x40, 0x30,
+	  },
+	 {			/*  Init_SR80_SR93 */
+	  0xFF, 0x07, 0x00, 0x6F, 0x7F, 0x7F, 0xFF, 0x32,
+	  0xF7, 0x00, 0x00, 0x00, 0xEF, 0xFF, 0x32, 0x32,
+	  0x00, 0x00, 0x00, 0x00,
+	  },
+	 {			/*  Init_SRA0_SRAF */
+	  0x00, 0xFF, 0xBF, 0xFF, 0xFF, 0xED, 0xED, 0xED,
+	  0x7B, 0xFF, 0xFF, 0xFF, 0xBF, 0xEF, 0xFF, 0xDF,
+	  },
+	 {			/*  Init_GR00_GR08 */
+	  0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x05, 0x0F,
+	  0xFF,
+	  },
+	 {			/*  Init_AR00_AR14 */
+	  0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+	  0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F,
+	  0x41, 0x00, 0x0F, 0x00, 0x00,
+	  },
+	 {			/*  Init_CR00_CR18 */
+	  0x5F, 0x4F, 0x4F, 0x00, 0x53, 0x1F, 0x0B, 0x3E,
+	  0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	  0xEA, 0x0C, 0xDF, 0x50, 0x40, 0xDF, 0x00, 0xE3,
+	  0xFF,
+	  },
+	 {			/*  Init_CR30_CR4D */
+	  0x00, 0x00, 0x00, 0x00, 0x00, 0x55, 0x03, 0x20,
+	  0x00, 0x00, 0x00, 0x40, 0x00, 0xE7, 0xFF, 0xFD,
+	  0x5F, 0x4F, 0x00, 0x54, 0x00, 0x0B, 0xDF, 0x00,
+	  0xEA, 0x0C, 0x2E, 0x00, 0x4F, 0xDF,
+	  },
+	 {			/*  Init_CR90_CRA7 */
+	  0x56, 0xDD, 0x5E, 0xEA, 0x87, 0x44, 0x8F, 0x55,
+	  0x0A, 0x8F, 0x55, 0x0A, 0x00, 0x00, 0x18, 0x00,
+	  0x11, 0x10, 0x0B, 0x0A, 0x0A, 0x0A, 0x0A, 0x00,
+	  },
+	 },
+
+	{			/*  mode#2: 800 x 600  16Bpp  60Hz */
+	 800, 600, 16, 60,
+	 /*  Init_MISC */
+	 0x2B,
+	 {			/*  Init_SR0_SR4 */
+	  0x03, 0x01, 0x0F, 0x03, 0x0E,
+	  },
+	 {			/*  Init_SR10_SR24 */
+	  0xFF, 0xBE, 0xEE, 0xFF, 0x00, 0x0E, 0x17, 0x2C,
+	  0x99, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
+	  0xC4, 0x30, 0x02, 0x01, 0x01,
+	  },
+	 {			/*  Init_SR30_SR75 */
+	  0x34, 0x03, 0x20, 0x09, 0xC0, 0x24, 0x24, 0x24,
+	  0x24, 0x24, 0x24, 0x24, 0x00, 0x00, 0x03, 0xFF,
+	  0x00, 0xFC, 0x00, 0x00, 0x20, 0x38, 0x00, 0xFC,
+	  0x20, 0x0C, 0x44, 0x20, 0x00, 0x24, 0x24, 0x24,
+	  0x04, 0x48, 0x83, 0x63, 0x68, 0x72, 0x57, 0x58,
+	  0x04, 0x55, 0x59, 0x24, 0x24, 0x00, 0x00, 0x24,
+	  0x01, 0x80, 0x7A, 0x1A, 0x1A, 0x00, 0x00, 0x00,
+	  0x50, 0x03, 0x74, 0x14, 0x1C, 0x85, 0x35, 0x13,
+	  0x02, 0x45, 0x30, 0x35, 0x40, 0x20,
+	  },
+	 {			/*  Init_SR80_SR93 */
+	  0x00, 0x00, 0x00, 0x6F, 0x7F, 0x7F, 0xFF, 0x24,
+	  0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x24, 0x24,
+	  0x00, 0x00, 0x00, 0x00,
+	  },
+	 {			/*  Init_SRA0_SRAF */
+	  0x00, 0xFF, 0xBF, 0xFF, 0xFF, 0xED, 0xED, 0xED,
+	  0x7B, 0xFF, 0xFF, 0xFF, 0xBF, 0xEF, 0xBF, 0xDF,
+	  },
+	 {			/*  Init_GR00_GR08 */
+	  0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x05, 0x0F,
+	  0xFF,
+	  },
+	 {			/*  Init_AR00_AR14 */
+	  0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+	  0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F,
+	  0x41, 0x00, 0x0F, 0x00, 0x00,
+	  },
+	 {			/*  Init_CR00_CR18 */
+	  0x7F, 0x63, 0x63, 0x00, 0x68, 0x18, 0x72, 0xF0,
+	  0x00, 0x60, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	  0x58, 0x0C, 0x57, 0x64, 0x40, 0x57, 0x00, 0xE3,
+	  0xFF,
+	  },
+	 {			/*  Init_CR30_CR4D */
+	  0x00, 0x00, 0x00, 0x00, 0x00, 0x33, 0x03, 0x20,
+	  0x00, 0x00, 0x00, 0x40, 0x00, 0xE7, 0xBF, 0xFD,
+	  0x7F, 0x63, 0x00, 0x69, 0x18, 0x72, 0x57, 0x00,
+	  0x58, 0x0C, 0xE0, 0x20, 0x63, 0x57,
+	  },
+	 {			/*  Init_CR90_CRA7 */
+	  0x56, 0x4B, 0x5E, 0x55, 0x86, 0x9D, 0x8E, 0xAA,
+	  0xDB, 0x2A, 0xDF, 0x33, 0x00, 0x00, 0x18, 0x00,
+	  0x20, 0x1F, 0x1A, 0x19, 0x0F, 0x0F, 0x0F, 0x00,
+	  },
+	 },
+	{			/*  mode#3: 800 x 600  24Bpp  60Hz */
+	 800, 600, 24, 60,
+	 0x2B,
+	 {			/*  Init_SR0_SR4 */
+	  0x03, 0x01, 0x0F, 0x03, 0x0E,
+	  },
+	 {			/*  Init_SR10_SR24 */
+	  0xFF, 0xBE, 0xEE, 0xFF, 0x00, 0x0E, 0x17, 0x2C,
+	  0x99, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	  0xC4, 0x30, 0x02, 0x01, 0x01,
+	  },
+	 {			/*  Init_SR30_SR75 */
+	  0x36, 0x03, 0x20, 0x09, 0xC0, 0x36, 0x36, 0x36,
+	  0x36, 0x36, 0x36, 0x36, 0x00, 0x00, 0x03, 0xFF,
+	  0x00, 0xFC, 0x00, 0x00, 0x20, 0x18, 0x00, 0xFC,
+	  0x20, 0x0C, 0x44, 0x20, 0x00, 0x36, 0x36, 0x36,
+	  0x04, 0x48, 0x83, 0x63, 0x68, 0x72, 0x57, 0x58,
+	  0x04, 0x55, 0x59, 0x36, 0x36, 0x00, 0x00, 0x36,
+	  0x01, 0x80, 0x7E, 0x1A, 0x1A, 0x00, 0x00, 0x00,
+	  0x50, 0x03, 0x74, 0x14, 0x1C, 0x85, 0x35, 0x13,
+	  0x02, 0x45, 0x30, 0x30, 0x40, 0x20,
+	  },
+	 {			/*  Init_SR80_SR93 */
+	  0xFF, 0x07, 0x00, 0x6F, 0x7F, 0x7F, 0xFF, 0x36,
+	  0xF7, 0x00, 0x00, 0x00, 0xEF, 0xFF, 0x36, 0x36,
+	  0x00, 0x00, 0x00, 0x00,
+	  },
+	 {			/*  Init_SRA0_SRAF */
+	  0x00, 0xFF, 0xBF, 0xFF, 0xFF, 0xED, 0xED, 0xED,
+	  0x7B, 0xFF, 0xFF, 0xFF, 0xBF, 0xEF, 0xBF, 0xDF,
+	  },
+	 {			/*  Init_GR00_GR08 */
+	  0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x05, 0x0F,
+	  0xFF,
+	  },
+	 {			/*  Init_AR00_AR14 */
+	  0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+	  0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F,
+	  0x41, 0x00, 0x0F, 0x00, 0x00,
+	  },
+	 {			/*  Init_CR00_CR18 */
+	  0x7F, 0x63, 0x63, 0x00, 0x68, 0x18, 0x72, 0xF0,
+	  0x00, 0x60, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	  0x58, 0x0C, 0x57, 0x64, 0x40, 0x57, 0x00, 0xE3,
+	  0xFF,
+	  },
+	 {			/*  Init_CR30_CR4D */
+	  0x00, 0x00, 0x00, 0x00, 0x00, 0x33, 0x03, 0x20,
+	  0x00, 0x00, 0x00, 0x40, 0x00, 0xE7, 0xBF, 0xFD,
+	  0x7F, 0x63, 0x00, 0x69, 0x18, 0x72, 0x57, 0x00,
+	  0x58, 0x0C, 0xE0, 0x20, 0x63, 0x57,
+	  },
+	 {			/*  Init_CR90_CRA7 */
+	  0x56, 0x4B, 0x5E, 0x55, 0x86, 0x9D, 0x8E, 0xAA,
+	  0xDB, 0x2A, 0xDF, 0x33, 0x00, 0x00, 0x18, 0x00,
+	  0x20, 0x1F, 0x1A, 0x19, 0x0F, 0x0F, 0x0F, 0x00,
+	  },
+	 },
+	{			/*  mode#7: 800 x 600  32Bpp  60Hz */
+	 800, 600, 32, 60,
+	 /*  Init_MISC */
+	 0x2B,
+	 {			/*  Init_SR0_SR4 */
+	  0x03, 0x01, 0x0F, 0x03, 0x0E,
+	  },
+	 {			/*  Init_SR10_SR24 */
+	  0xFF, 0xBE, 0xEE, 0xFF, 0x00, 0x0E, 0x17, 0x2C,
+	  0x99, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
+	  0xC4, 0x30, 0x02, 0x01, 0x01,
+	  },
+	 {			/*  Init_SR30_SR75 */
+	  0x34, 0x03, 0x20, 0x09, 0xC0, 0x24, 0x24, 0x24,
+	  0x24, 0x24, 0x24, 0x24, 0x00, 0x00, 0x03, 0xFF,
+	  0x00, 0xFC, 0x00, 0x00, 0x20, 0x38, 0x00, 0xFC,
+	  0x20, 0x0C, 0x44, 0x20, 0x00, 0x24, 0x24, 0x24,
+	  0x04, 0x48, 0x83, 0x63, 0x68, 0x72, 0x57, 0x58,
+	  0x04, 0x55, 0x59, 0x24, 0x24, 0x00, 0x00, 0x24,
+	  0x01, 0x80, 0x7A, 0x1A, 0x1A, 0x00, 0x00, 0x00,
+	  0x50, 0x03, 0x74, 0x14, 0x1C, 0x85, 0x35, 0x13,
+	  0x02, 0x45, 0x30, 0x35, 0x40, 0x20,
+	  },
+	 {			/*  Init_SR80_SR93 */
+	  0x00, 0x00, 0x00, 0x6F, 0x7F, 0x7F, 0xFF, 0x24,
+	  0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x24, 0x24,
+	  0x00, 0x00, 0x00, 0x00,
+	  },
+	 {			/*  Init_SRA0_SRAF */
+	  0x00, 0xFF, 0xBF, 0xFF, 0xFF, 0xED, 0xED, 0xED,
+	  0x7B, 0xFF, 0xFF, 0xFF, 0xBF, 0xEF, 0xBF, 0xDF,
+	  },
+	 {			/*  Init_GR00_GR08 */
+	  0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x05, 0x0F,
+	  0xFF,
+	  },
+	 {			/*  Init_AR00_AR14 */
+	  0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+	  0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F,
+	  0x41, 0x00, 0x0F, 0x00, 0x00,
+	  },
+	 {			/*  Init_CR00_CR18 */
+	  0x7F, 0x63, 0x63, 0x00, 0x68, 0x18, 0x72, 0xF0,
+	  0x00, 0x60, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	  0x58, 0x0C, 0x57, 0x64, 0x40, 0x57, 0x00, 0xE3,
+	  0xFF,
+	  },
+	 {			/*  Init_CR30_CR4D */
+	  0x00, 0x00, 0x00, 0x00, 0x00, 0x33, 0x03, 0x20,
+	  0x00, 0x00, 0x00, 0x40, 0x00, 0xE7, 0xBF, 0xFD,
+	  0x7F, 0x63, 0x00, 0x69, 0x18, 0x72, 0x57, 0x00,
+	  0x58, 0x0C, 0xE0, 0x20, 0x63, 0x57,
+	  },
+	 {			/*  Init_CR90_CRA7 */
+	  0x56, 0x4B, 0x5E, 0x55, 0x86, 0x9D, 0x8E, 0xAA,
+	  0xDB, 0x2A, 0xDF, 0x33, 0x00, 0x00, 0x18, 0x00,
+	  0x20, 0x1F, 0x1A, 0x19, 0x0F, 0x0F, 0x0F, 0x00,
+	  },
+	 },
+	/* We use 1024x768 table to light 1024x600 panel for lemote */
+	{			/*  mode#4: 1024 x 600  16Bpp  60Hz  */
+	 1024, 600, 16, 60,
+	 /*  Init_MISC */
+	 0xEB,
+	 {			/*  Init_SR0_SR4 */
+	  0x03, 0x01, 0x0F, 0x00, 0x0E,
+	  },
+	 {			/*  Init_SR10_SR24 */
+	  0xC8, 0x40, 0x14, 0x60, 0x00, 0x0A, 0x17, 0x20,
+	  0x51, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
+	  0xC4, 0x30, 0x02, 0x00, 0x01,
+	  },
+	 {			/*  Init_SR30_SR75 */
+	  0x22, 0x03, 0x24, 0x09, 0xC0, 0x22, 0x22, 0x22,
+	  0x22, 0x22, 0x22, 0x22, 0x00, 0x00, 0x03, 0xFF,
+	  0x00, 0xFC, 0x00, 0x00, 0x20, 0x18, 0x00, 0xFC,
+	  0x20, 0x0C, 0x44, 0x20, 0x00, 0x22, 0x22, 0x22,
+	  0x06, 0x68, 0xA7, 0x7F, 0x83, 0x24, 0xFF, 0x03,
+	  0x00, 0x60, 0x59, 0x22, 0x22, 0x00, 0x00, 0x22,
+	  0x01, 0x80, 0x7A, 0x1A, 0x1A, 0x00, 0x00, 0x00,
+	  0x50, 0x03, 0x16, 0x02, 0x0D, 0x82, 0x09, 0x02,
+	  0x04, 0x45, 0x3F, 0x30, 0x40, 0x20,
+	  },
+	 {			/*  Init_SR80_SR93 */
+	  0xFF, 0x07, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0x3A,
+	  0xF7, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x3A, 0x3A,
+	  0x00, 0x00, 0x00, 0x00,
+	  },
+	 {			/*  Init_SRA0_SRAF */
+	  0x00, 0xFB, 0x9F, 0x01, 0x00, 0xED, 0xED, 0xED,
+	  0x7B, 0xFB, 0xFF, 0xFF, 0x97, 0xEF, 0xBF, 0xDF,
+	  },
+	 {			/*  Init_GR00_GR08 */
+	  0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x05, 0x0F,
+	  0xFF,
+	  },
+	 {			/*  Init_AR00_AR14 */
+	  0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+	  0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F,
+	  0x41, 0x00, 0x0F, 0x00, 0x00,
+	  },
+	 {			/*  Init_CR00_CR18 */
+	  0xA3, 0x7F, 0x7F, 0x00, 0x85, 0x16, 0x24, 0xF5,
+	  0x00, 0x60, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	  0x03, 0x09, 0xFF, 0x80, 0x40, 0xFF, 0x00, 0xE3,
+	  0xFF,
+	  },
+	 {			/*  Init_CR30_CR4D */
+	  0x00, 0x00, 0x00, 0x00, 0x00, 0x80, 0x02, 0x20,
+	  0x00, 0x00, 0x00, 0x40, 0x00, 0xFF, 0xBF, 0xFF,
+	  0xA3, 0x7F, 0x00, 0x82, 0x0b, 0x6f, 0x57, 0x00,
+	  0x5c, 0x0f, 0xE0, 0xe0, 0x7F, 0x57,
+	  },
+	 {			/*  Init_CR90_CRA7 */
+	  0x55, 0xD9, 0x5D, 0xE1, 0x86, 0x1B, 0x8E, 0x26,
+	  0xDA, 0x8D, 0xDE, 0x94, 0x00, 0x00, 0x18, 0x00,
+	  0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x15, 0x03,
+	  },
+	 },
+	{			/*  mode#5: 1024 x 768  24Bpp  60Hz */
+	 1024, 768, 24, 60,
+	 /*  Init_MISC */
+	 0xEB,
+	 {			/*  Init_SR0_SR4 */
+	  0x03, 0x01, 0x0F, 0x03, 0x0E,
+	  },
+	 {			/*  Init_SR10_SR24 */
+	  0xF3, 0xB6, 0xC0, 0xDD, 0x00, 0x0E, 0x17, 0x2C,
+	  0x99, 0x02, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
+	  0xC4, 0x30, 0x02, 0x01, 0x01,
+	  },
+	 {			/*  Init_SR30_SR75 */
+	  0x38, 0x03, 0x20, 0x09, 0xC0, 0x3A, 0x3A, 0x3A,
+	  0x3A, 0x3A, 0x3A, 0x3A, 0x00, 0x00, 0x03, 0xFF,
+	  0x00, 0xFC, 0x00, 0x00, 0x20, 0x18, 0x00, 0xFC,
+	  0x20, 0x0C, 0x44, 0x20, 0x00, 0x00, 0x00, 0x3A,
+	  0x06, 0x68, 0xA7, 0x7F, 0x83, 0x24, 0xFF, 0x03,
+	  0x00, 0x60, 0x59, 0x3A, 0x3A, 0x00, 0x00, 0x3A,
+	  0x01, 0x80, 0x7E, 0x1A, 0x1A, 0x00, 0x00, 0x00,
+	  0x50, 0x03, 0x74, 0x14, 0x3B, 0x0D, 0x09, 0x02,
+	  0x04, 0x45, 0x30, 0x30, 0x40, 0x20,
+	  },
+	 {			/*  Init_SR80_SR93 */
+	  0xFF, 0x07, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0x3A,
+	  0xF7, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x3A, 0x3A,
+	  0x00, 0x00, 0x00, 0x00,
+	  },
+	 {			/*  Init_SRA0_SRAF */
+	  0x00, 0xFB, 0x9F, 0x01, 0x00, 0xED, 0xED, 0xED,
+	  0x7B, 0xFB, 0xFF, 0xFF, 0x97, 0xEF, 0xBF, 0xDF,
+	  },
+	 {			/*  Init_GR00_GR08 */
+	  0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x05, 0x0F,
+	  0xFF,
+	  },
+	 {			/*  Init_AR00_AR14 */
+	  0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+	  0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F,
+	  0x41, 0x00, 0x0F, 0x00, 0x00,
+	  },
+	 {			/*  Init_CR00_CR18 */
+	  0xA3, 0x7F, 0x7F, 0x00, 0x85, 0x16, 0x24, 0xF5,
+	  0x00, 0x60, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	  0x03, 0x09, 0xFF, 0x80, 0x40, 0xFF, 0x00, 0xE3,
+	  0xFF,
+	  },
+	 {			/*  Init_CR30_CR4D */
+	  0x00, 0x00, 0x00, 0x00, 0x00, 0x80, 0x02, 0x20,
+	  0x00, 0x00, 0x00, 0x40, 0x00, 0xFF, 0xBF, 0xFF,
+	  0xA3, 0x7F, 0x00, 0x86, 0x15, 0x24, 0xFF, 0x00,
+	  0x01, 0x07, 0xE5, 0x20, 0x7F, 0xFF,
+	  },
+	 {			/*  Init_CR90_CRA7 */
+	  0x55, 0xD9, 0x5D, 0xE1, 0x86, 0x1B, 0x8E, 0x26,
+	  0xDA, 0x8D, 0xDE, 0x94, 0x00, 0x00, 0x18, 0x00,
+	  0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x15, 0x03,
+	  },
+	 },
+	{			/*  mode#4: 1024 x 768  32Bpp  60Hz */
+	 1024, 768, 32, 60,
+	 /*  Init_MISC */
+	 0xEB,
+	 {			/*  Init_SR0_SR4 */
+	  0x03, 0x01, 0x0F, 0x03, 0x0E,
+	  },
+	 {			/*  Init_SR10_SR24 */
+	  0xF3, 0xB6, 0xC0, 0xDD, 0x00, 0x0E, 0x17, 0x2C,
+	  0x99, 0x02, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
+	  0xC4, 0x32, 0x02, 0x01, 0x01,
+	  },
+	 {			/*  Init_SR30_SR75 */
+	  0x38, 0x03, 0x20, 0x09, 0xC0, 0x3A, 0x3A, 0x3A,
+	  0x3A, 0x3A, 0x3A, 0x3A, 0x00, 0x00, 0x03, 0xFF,
+	  0x00, 0xFC, 0x00, 0x00, 0x20, 0x18, 0x00, 0xFC,
+	  0x20, 0x0C, 0x44, 0x20, 0x00, 0x00, 0x00, 0x3A,
+	  0x06, 0x68, 0xA7, 0x7F, 0x83, 0x24, 0xFF, 0x03,
+	  0x00, 0x60, 0x59, 0x3A, 0x3A, 0x00, 0x00, 0x3A,
+	  0x01, 0x80, 0x7E, 0x1A, 0x1A, 0x00, 0x00, 0x00,
+	  0x50, 0x03, 0x74, 0x14, 0x3B, 0x0D, 0x09, 0x02,
+	  0x04, 0x45, 0x30, 0x30, 0x40, 0x20,
+	  },
+	 {			/*  Init_SR80_SR93 */
+	  0xFF, 0x07, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0x3A,
+	  0xF7, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x3A, 0x3A,
+	  0x00, 0x00, 0x00, 0x00,
+	  },
+	 {			/*  Init_SRA0_SRAF */
+	  0x00, 0xFB, 0x9F, 0x01, 0x00, 0xED, 0xED, 0xED,
+	  0x7B, 0xFB, 0xFF, 0xFF, 0x97, 0xEF, 0xBF, 0xDF,
+	  },
+	 {			/*  Init_GR00_GR08 */
+	  0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x05, 0x0F,
+	  0xFF,
+	  },
+	 {			/*  Init_AR00_AR14 */
+	  0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+	  0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F,
+	  0x41, 0x00, 0x0F, 0x00, 0x00,
+	  },
+	 {			/*  Init_CR00_CR18 */
+	  0xA3, 0x7F, 0x7F, 0x00, 0x85, 0x16, 0x24, 0xF5,
+	  0x00, 0x60, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	  0x03, 0x09, 0xFF, 0x80, 0x40, 0xFF, 0x00, 0xE3,
+	  0xFF,
+	  },
+	 {			/*  Init_CR30_CR4D */
+	  0x00, 0x00, 0x00, 0x00, 0x00, 0x80, 0x02, 0x20,
+	  0x00, 0x00, 0x00, 0x40, 0x00, 0xFF, 0xBF, 0xFF,
+	  0xA3, 0x7F, 0x00, 0x86, 0x15, 0x24, 0xFF, 0x00,
+	  0x01, 0x07, 0xE5, 0x20, 0x7F, 0xFF,
+	  },
+	 {			/*  Init_CR90_CRA7 */
+	  0x55, 0xD9, 0x5D, 0xE1, 0x86, 0x1B, 0x8E, 0x26,
+	  0xDA, 0x8D, 0xDE, 0x94, 0x00, 0x00, 0x18, 0x00,
+	  0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x15, 0x03,
+	  },
+	 },
+	{			/*  mode#6: 320 x 240  16Bpp  60Hz */
+	 320, 240, 16, 60,
+	 /*  Init_MISC */
+	 0xEB,
+	 {			/*  Init_SR0_SR4 */
+	  0x03, 0x01, 0x0F, 0x03, 0x0E,
+	  },
+	 {			/*  Init_SR10_SR24 */
+	  0xF3, 0xB6, 0xC0, 0xDD, 0x00, 0x0E, 0x17, 0x2C,
+	  0x99, 0x02, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
+	  0xC4, 0x32, 0x02, 0x01, 0x01,
+	  },
+	 {			/*  Init_SR30_SR75 */
+	  0x38, 0x03, 0x20, 0x09, 0xC0, 0x3A, 0x3A, 0x3A,
+	  0x3A, 0x3A, 0x3A, 0x3A, 0x00, 0x00, 0x03, 0xFF,
+	  0x00, 0xFC, 0x00, 0x00, 0x20, 0x18, 0x00, 0xFC,
+	  0x20, 0x0C, 0x44, 0x20, 0x00, 0x00, 0x00, 0x3A,
+	  0x06, 0x68, 0xA7, 0x7F, 0x83, 0x24, 0xFF, 0x03,
+	  0x00, 0x60, 0x59, 0x3A, 0x3A, 0x00, 0x00, 0x3A,
+	  0x01, 0x80, 0x7E, 0x1A, 0x1A, 0x00, 0x00, 0x00,
+	  0x50, 0x03, 0x74, 0x14, 0x08, 0x43, 0x08, 0x43,
+	  0x04, 0x45, 0x30, 0x30, 0x40, 0x20,
+	  },
+	 {			/*  Init_SR80_SR93 */
+	  0xFF, 0x07, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0x3A,
+	  0xF7, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x3A, 0x3A,
+	  0x00, 0x00, 0x00, 0x00,
+	  },
+	 {			/*  Init_SRA0_SRAF */
+	  0x00, 0xFB, 0x9F, 0x01, 0x00, 0xED, 0xED, 0xED,
+	  0x7B, 0xFB, 0xFF, 0xFF, 0x97, 0xEF, 0xBF, 0xDF,
+	  },
+	 {			/*  Init_GR00_GR08 */
+	  0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x05, 0x0F,
+	  0xFF,
+	  },
+	 {			/*  Init_AR00_AR14 */
+	  0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+	  0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F,
+	  0x41, 0x00, 0x0F, 0x00, 0x00,
+	  },
+	 {			/*  Init_CR00_CR18 */
+	  0xA3, 0x7F, 0x7F, 0x00, 0x85, 0x16, 0x24, 0xF5,
+	  0x00, 0x60, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	  0x03, 0x09, 0xFF, 0x80, 0x40, 0xFF, 0x00, 0xE3,
+	  0xFF,
+	  },
+	 {			/*  Init_CR30_CR4D */
+	  0x00, 0x00, 0x00, 0x00, 0x00, 0x80, 0x02, 0x20,
+	  0x00, 0x00, 0x30, 0x40, 0x00, 0xFF, 0xBF, 0xFF,
+	  0x2E, 0x27, 0x00, 0x2b, 0x0c, 0x0F, 0xEF, 0x00,
+	  0xFe, 0x0f, 0x01, 0xC0, 0x27, 0xEF,
+	  },
+	 {			/*  Init_CR90_CRA7 */
+	  0x55, 0xD9, 0x5D, 0xE1, 0x86, 0x1B, 0x8E, 0x26,
+	  0xDA, 0x8D, 0xDE, 0x94, 0x00, 0x00, 0x18, 0x00,
+	  0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x15, 0x03,
+	  },
+	 },
+
+	{			/*  mode#8: 320 x 240  32Bpp  60Hz */
+	 320, 240, 32, 60,
+	 /*  Init_MISC */
+	 0xEB,
+	 {			/*  Init_SR0_SR4 */
+	  0x03, 0x01, 0x0F, 0x03, 0x0E,
+	  },
+	 {			/*  Init_SR10_SR24 */
+	  0xF3, 0xB6, 0xC0, 0xDD, 0x00, 0x0E, 0x17, 0x2C,
+	  0x99, 0x02, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
+	  0xC4, 0x32, 0x02, 0x01, 0x01,
+	  },
+	 {			/*  Init_SR30_SR75 */
+	  0x38, 0x03, 0x20, 0x09, 0xC0, 0x3A, 0x3A, 0x3A,
+	  0x3A, 0x3A, 0x3A, 0x3A, 0x00, 0x00, 0x03, 0xFF,
+	  0x00, 0xFC, 0x00, 0x00, 0x20, 0x18, 0x00, 0xFC,
+	  0x20, 0x0C, 0x44, 0x20, 0x00, 0x00, 0x00, 0x3A,
+	  0x06, 0x68, 0xA7, 0x7F, 0x83, 0x24, 0xFF, 0x03,
+	  0x00, 0x60, 0x59, 0x3A, 0x3A, 0x00, 0x00, 0x3A,
+	  0x01, 0x80, 0x7E, 0x1A, 0x1A, 0x00, 0x00, 0x00,
+	  0x50, 0x03, 0x74, 0x14, 0x08, 0x43, 0x08, 0x43,
+	  0x04, 0x45, 0x30, 0x30, 0x40, 0x20,
+	  },
+	 {			/*  Init_SR80_SR93 */
+	  0xFF, 0x07, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0x3A,
+	  0xF7, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x3A, 0x3A,
+	  0x00, 0x00, 0x00, 0x00,
+	  },
+	 {			/*  Init_SRA0_SRAF */
+	  0x00, 0xFB, 0x9F, 0x01, 0x00, 0xED, 0xED, 0xED,
+	  0x7B, 0xFB, 0xFF, 0xFF, 0x97, 0xEF, 0xBF, 0xDF,
+	  },
+	 {			/*  Init_GR00_GR08 */
+	  0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x05, 0x0F,
+	  0xFF,
+	  },
+	 {			/*  Init_AR00_AR14 */
+	  0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+	  0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F,
+	  0x41, 0x00, 0x0F, 0x00, 0x00,
+	  },
+	 {			/*  Init_CR00_CR18 */
+	  0xA3, 0x7F, 0x7F, 0x00, 0x85, 0x16, 0x24, 0xF5,
+	  0x00, 0x60, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	  0x03, 0x09, 0xFF, 0x80, 0x40, 0xFF, 0x00, 0xE3,
+	  0xFF,
+	  },
+	 {			/*  Init_CR30_CR4D */
+	  0x00, 0x00, 0x00, 0x00, 0x00, 0x80, 0x02, 0x20,
+	  0x00, 0x00, 0x30, 0x40, 0x00, 0xFF, 0xBF, 0xFF,
+	  0x2E, 0x27, 0x00, 0x2b, 0x0c, 0x0F, 0xEF, 0x00,
+	  0xFe, 0x0f, 0x01, 0xC0, 0x27, 0xEF,
+	  },
+	 {			/*  Init_CR90_CRA7 */
+	  0x55, 0xD9, 0x5D, 0xE1, 0x86, 0x1B, 0x8E, 0x26,
+	  0xDA, 0x8D, 0xDE, 0x94, 0x00, 0x00, 0x18, 0x00,
+	  0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x15, 0x03,
+	  },
+	 },
+};
+
+#define numVGAModes		(sizeof(VGAMode) / sizeof(struct ModeInit))
diff --git a/drivers/staging/usbip/vhci_hcd.c b/drivers/staging/usbip/vhci_hcd.c
index 6e91fc2bd850..ef4371358dbe 100644
--- a/drivers/staging/usbip/vhci_hcd.c
+++ b/drivers/staging/usbip/vhci_hcd.c
@@ -56,7 +56,7 @@ static void vhci_stop(struct usb_hcd *hcd);
 static int vhci_get_frame_number(struct usb_hcd *hcd);
 
 static const char driver_name[] = "vhci_hcd";
-static const char driver_desc[] = "USB/IP Virtual Host Contoroller";
+static const char driver_desc[] = "USB/IP Virtual Host Controller";
 
 struct vhci_hcd *the_controller;
 
diff --git a/drivers/staging/vme/TODO b/drivers/staging/vme/TODO
index adc5fca42afd..2201ff6f74d1 100644
--- a/drivers/staging/vme/TODO
+++ b/drivers/staging/vme/TODO
@@ -11,7 +11,7 @@ The current DMA resource Allocation provides no means of selecting the
 suitability of a DMA controller based on it's supported modes of operation, as
 opposed to the resource allocation mechanisms for master and slave windows:
 
-	struct vme_resource *vme_request_dma(struct device *dev);
+	struct vme_resource *vme_dma_request(struct device *dev);
 
 As opposed to:
 
diff --git a/drivers/staging/vme/bridges/vme_ca91cx42.c b/drivers/staging/vme/bridges/vme_ca91cx42.c
index e139eaeaa174..1cf3e91db59d 100644
--- a/drivers/staging/vme/bridges/vme_ca91cx42.c
+++ b/drivers/staging/vme/bridges/vme_ca91cx42.c
@@ -15,7 +15,6 @@
  * option) any later version.
  */
 
-#include <linux/version.h>
 #include <linux/module.h>
 #include <linux/mm.h>
 #include <linux/types.h>
@@ -54,9 +53,6 @@ struct mutex vme_int;   /*
 			 * Only one VME interrupt can be
 			 * generated at a time, provide locking
 			 */
-struct mutex vme_irq;   /* Locking for VME irq callback configuration */
-
-
 
 static char driver_name[] = "vme_ca91cx42";
 
@@ -158,23 +154,13 @@ static u32 ca91cx42_LERR_irqhandler(void)
 static u32 ca91cx42_VIRQ_irqhandler(int stat)
 {
 	int vec, i, serviced = 0;
-	void (*call)(int, int, void *);
-	void *priv_data;
 
 	for (i = 7; i > 0; i--) {
 		if (stat & (1 << i)) {
 			vec = ioread32(ca91cx42_bridge->base +
 				CA91CX42_V_STATID[i]) & 0xff;
 
-			call = ca91cx42_bridge->irq[i - 1].callback[vec].func;
-			priv_data =
-			ca91cx42_bridge->irq[i - 1].callback[vec].priv_data;
-
-			if (call != NULL)
-				call(i, vec, priv_data);
-			else
-				printk("Spurilous VME interrupt, level:%x, "
-					"vector:%x\n", i, vec);
+			vme_irq_handler(ca91cx42_bridge, i, vec);
 
 			serviced |= (1 << i);
 		}
@@ -235,6 +221,8 @@ static int ca91cx42_irq_init(struct vme_bridge *bridge)
 	/* Initialise list for VME bus errors */
 	INIT_LIST_HEAD(&(bridge->vme_errors));
 
+	mutex_init(&(bridge->irq_mtx));
+
 	/* Disable interrupts from PCI to VME */
 	iowrite32(0, bridge->base + VINT_EN);
 
@@ -282,66 +270,31 @@ static void ca91cx42_irq_exit(struct pci_dev *pdev)
 /*
  * Set up an VME interrupt
  */
-int ca91cx42_request_irq(int level, int statid,
-	void (*callback)(int level, int vector, void *priv_data),
-	void *priv_data)
+void ca91cx42_irq_set(int level, int state, int sync)
+
 {
+	struct pci_dev *pdev;
 	u32 tmp;
 
-	mutex_lock(&(vme_irq));
-
-	if (ca91cx42_bridge->irq[level - 1].callback[statid].func) {
-		mutex_unlock(&(vme_irq));
-		printk("VME Interrupt already taken\n");
-		return -EBUSY;
-	}
-
-
-	ca91cx42_bridge->irq[level - 1].count++;
-	ca91cx42_bridge->irq[level - 1].callback[statid].priv_data = priv_data;
-	ca91cx42_bridge->irq[level - 1].callback[statid].func = callback;
-
 	/* Enable IRQ level */
 	tmp = ioread32(ca91cx42_bridge->base + LINT_EN);
-	tmp |= CA91CX42_LINT_VIRQ[level];
-	iowrite32(tmp, ca91cx42_bridge->base + LINT_EN);
-
-	mutex_unlock(&(vme_irq));
-
-	return 0;
-}
 
-/*
- * Free VME interrupt
- */
-void ca91cx42_free_irq(int level, int statid)
-{
-	u32 tmp;
-	struct pci_dev *pdev;
-
-	mutex_lock(&(vme_irq));
-
-	ca91cx42_bridge->irq[level - 1].count--;
-
-	/* Disable IRQ level if no more interrupts attached at this level*/
-	if (ca91cx42_bridge->irq[level - 1].count == 0) {
-		tmp = ioread32(ca91cx42_bridge->base + LINT_EN);
+	if (state == 0)
 		tmp &= ~CA91CX42_LINT_VIRQ[level];
-		iowrite32(tmp, ca91cx42_bridge->base + LINT_EN);
+	else
+		tmp |= CA91CX42_LINT_VIRQ[level];
+
+	iowrite32(tmp, ca91cx42_bridge->base + LINT_EN);
 
+	if ((state == 0) && (sync != 0)) {
 		pdev = container_of(ca91cx42_bridge->parent, struct pci_dev,
 			dev);
 
 		synchronize_irq(pdev->irq);
 	}
-
-	ca91cx42_bridge->irq[level - 1].callback[statid].func = NULL;
-	ca91cx42_bridge->irq[level - 1].callback[statid].priv_data = NULL;
-
-	mutex_unlock(&(vme_irq));
 }
 
-int ca91cx42_generate_irq(int level, int statid)
+int ca91cx42_irq_generate(int level, int statid)
 {
 	u32 tmp;
 
@@ -1065,7 +1018,6 @@ static int ca91cx42_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 	init_waitqueue_head(&dma_queue);
 	init_waitqueue_head(&iack_queue);
 	mutex_init(&(vme_int));
-	mutex_init(&(vme_irq));
 	mutex_init(&(vme_rmw));
 
 	ca91cx42_bridge->parent = &(pdev->dev);
@@ -1182,9 +1134,8 @@ static int ca91cx42_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 	ca91cx42_bridge->dma_list_exec = ca91cx42_dma_list_exec;
 	ca91cx42_bridge->dma_list_empty = ca91cx42_dma_list_empty;
 #endif
-	ca91cx42_bridge->request_irq = ca91cx42_request_irq;
-	ca91cx42_bridge->free_irq = ca91cx42_free_irq;
-	ca91cx42_bridge->generate_irq = ca91cx42_generate_irq;
+	ca91cx42_bridge->irq_set = ca91cx42_irq_set;
+	ca91cx42_bridge->irq_generate = ca91cx42_irq_generate;
 #if 0
 	ca91cx42_bridge->lm_set = ca91cx42_lm_set;
 	ca91cx42_bridge->lm_get = ca91cx42_lm_get;
@@ -1220,7 +1171,9 @@ static int ca91cx42_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 	vme_unregister_bridge(ca91cx42_bridge);
 err_reg:
 	ca91cx42_crcsr_exit(pdev);
+#if 0
 err_crcsr:
+#endif
 err_lm:
 	/* resources are stored in link list */
 	list_for_each(pos, &(ca91cx42_bridge->lm_resources)) {
@@ -1275,7 +1228,6 @@ void ca91cx42_remove(struct pci_dev *pdev)
 	struct vme_slave_resource *slave_image;
 	struct vme_dma_resource *dma_ctrlr;
 	struct vme_lm_resource *lm;
-	int i;
 
 	/* Turn off Ints */
 	iowrite32(0, ca91cx42_bridge->base + LINT_EN);
diff --git a/drivers/staging/vme/bridges/vme_tsi148.c b/drivers/staging/vme/bridges/vme_tsi148.c
index 00fe0803c21c..89a7dccb934f 100644
--- a/drivers/staging/vme/bridges/vme_tsi148.c
+++ b/drivers/staging/vme/bridges/vme_tsi148.c
@@ -13,7 +13,6 @@
  * option) any later version.
  */
 
-#include <linux/version.h>
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/mm.h>
@@ -78,8 +77,6 @@ struct mutex vme_int;	/*
 				 * Only one VME interrupt can be
 				 * generated at a time, provide locking
 				 */
-struct mutex vme_irq;	/* Locking for VME irq callback configuration */
-
 
 static char driver_name[] = "vme_tsi148";
 
@@ -240,7 +237,6 @@ static u32 tsi148_VERR_irqhandler(void)
  */
 static u32 tsi148_IACK_irqhandler(void)
 {
-	printk("tsi148_IACK_irqhandler\n");
 	wake_up(&iack_queue);
 
 	return TSI148_LCSR_INTC_IACKC;
@@ -252,8 +248,6 @@ static u32 tsi148_IACK_irqhandler(void)
 static u32 tsi148_VIRQ_irqhandler(u32 stat)
 {
 	int vec, i, serviced = 0;
-	void (*call)(int, int, void *);
-	void *priv_data;
 
 	for (i = 7; i > 0; i--) {
 		if (stat & (1 << i)) {
@@ -266,15 +260,7 @@ static u32 tsi148_VIRQ_irqhandler(u32 stat)
 			vec = ioread8(tsi148_bridge->base +
 				TSI148_LCSR_VIACK[i] + 3);
 
-			call = tsi148_bridge->irq[i - 1].callback[vec].func;
-			priv_data =
-				tsi148_bridge->irq[i-1].callback[vec].priv_data;
-
-			if (call != NULL)
-				call(i, vec, priv_data);
-			else
-				printk("Spurilous VME interrupt, level:%x, "
-					"vector:%x\n", i, vec);
+			vme_irq_handler(tsi148_bridge, i, vec);
 
 			serviced |= (1 << i);
 		}
@@ -354,6 +340,8 @@ static int tsi148_irq_init(struct vme_bridge *bridge)
 	/* Initialise list for VME bus errors */
 	INIT_LIST_HEAD(&(bridge->vme_errors));
 
+	mutex_init(&(bridge->irq_mtx));
+
 	result = request_irq(pdev->irq,
 			     tsi148_irqhandler,
 			     IRQF_SHARED,
@@ -433,55 +421,15 @@ int tsi148_iack_received(void)
 }
 
 /*
- * Set up an VME interrupt
+ * Configure VME interrupt
  */
-int tsi148_request_irq(int level, int statid,
-	void (*callback)(int level, int vector, void *priv_data),
-        void *priv_data)
+void tsi148_irq_set(int level, int state, int sync)
 {
-	u32 tmp;
-
-	mutex_lock(&(vme_irq));
-
-	if(tsi148_bridge->irq[level - 1].callback[statid].func) {
-		mutex_unlock(&(vme_irq));
-		printk("VME Interrupt already taken\n");
-		return -EBUSY;
-	}
-
-
-	tsi148_bridge->irq[level - 1].count++;
-	tsi148_bridge->irq[level - 1].callback[statid].priv_data = priv_data;
-	tsi148_bridge->irq[level - 1].callback[statid].func = callback;
-
-	/* Enable IRQ level */
-	tmp = ioread32be(tsi148_bridge->base + TSI148_LCSR_INTEO);
-	tmp |= TSI148_LCSR_INTEO_IRQEO[level - 1];
-	iowrite32be(tmp, tsi148_bridge->base + TSI148_LCSR_INTEO);
-
-	tmp = ioread32be(tsi148_bridge->base + TSI148_LCSR_INTEN);
-	tmp |= TSI148_LCSR_INTEN_IRQEN[level - 1];
-	iowrite32be(tmp, tsi148_bridge->base + TSI148_LCSR_INTEN);
-
-	mutex_unlock(&(vme_irq));
-
-	return 0;
-}
-
-/*
- * Free VME interrupt
- */
-void tsi148_free_irq(int level, int statid)
-{
-	u32 tmp;
 	struct pci_dev *pdev;
+	u32 tmp;
 
-	mutex_lock(&(vme_irq));
-
-	tsi148_bridge->irq[level - 1].count--;
-
-	/* Disable IRQ level if no more interrupts attached at this level*/
-	if (tsi148_bridge->irq[level - 1].count == 0) {
+	/* We need to do the ordering differently for enabling and disabling */
+	if (state == 0) {
 		tmp = ioread32be(tsi148_bridge->base + TSI148_LCSR_INTEN);
 		tmp &= ~TSI148_LCSR_INTEN_IRQEN[level - 1];
 		iowrite32be(tmp, tsi148_bridge->base + TSI148_LCSR_INTEN);
@@ -490,22 +438,28 @@ void tsi148_free_irq(int level, int statid)
 		tmp &= ~TSI148_LCSR_INTEO_IRQEO[level - 1];
 		iowrite32be(tmp, tsi148_bridge->base + TSI148_LCSR_INTEO);
 
-		pdev = container_of(tsi148_bridge->parent, struct pci_dev, dev);
-
-		synchronize_irq(pdev->irq);
-	}
+		if (sync != 0) {
+			pdev = container_of(tsi148_bridge->parent,
+				struct pci_dev, dev);
 
-	tsi148_bridge->irq[level - 1].callback[statid].func = NULL;
-	tsi148_bridge->irq[level - 1].callback[statid].priv_data = NULL;
+			synchronize_irq(pdev->irq);
+		}
+	} else {
+		tmp = ioread32be(tsi148_bridge->base + TSI148_LCSR_INTEO);
+		tmp |= TSI148_LCSR_INTEO_IRQEO[level - 1];
+		iowrite32be(tmp, tsi148_bridge->base + TSI148_LCSR_INTEO);
 
-	mutex_unlock(&(vme_irq));
+		tmp = ioread32be(tsi148_bridge->base + TSI148_LCSR_INTEN);
+		tmp |= TSI148_LCSR_INTEN_IRQEN[level - 1];
+		iowrite32be(tmp, tsi148_bridge->base + TSI148_LCSR_INTEN);
+	}
 }
 
 /*
  * Generate a VME bus interrupt at the requested level & vector. Wait for
  * interrupt to be acked.
  */
-int tsi148_generate_irq(int level, int statid)
+int tsi148_irq_generate(int level, int statid)
 {
 	u32 tmp;
 
@@ -891,7 +845,7 @@ static int tsi148_alloc_resource(struct vme_master_resource *image,
 		image->pci_resource.start);
 
 	/* If the existing size is OK, return */
-	if (existing_size == (size - 1))
+	if ((size != 0) && (existing_size == (size - 1)))
 		return 0;
 
 	if (existing_size != 0) {
@@ -903,6 +857,11 @@ static int tsi148_alloc_resource(struct vme_master_resource *image,
 		memset(&(image->pci_resource), 0, sizeof(struct resource));
 	}
 
+	/* Exit here if size is zero */
+	if (size == 0) {
+		return 0;
+	}
+
 	if (image->pci_resource.name == NULL) {
 		image->pci_resource.name = kmalloc(VMENAMSIZ+3, GFP_KERNEL);
 		if (image->pci_resource.name == NULL) {
@@ -981,12 +940,13 @@ int tsi148_master_set( struct vme_master_resource *image, int enabled,
 
 	/* Verify input data */
 	if (vme_base & 0xFFFF) {
-		printk("Invalid VME Window alignment\n");
+		printk(KERN_ERR "Invalid VME Window alignment\n");
 		retval = -EINVAL;
 		goto err_window;
 	}
-	if (size < 0x10000) {
-		printk("Invalid VME Window size\n");
+
+	if ((size == 0) && (enabled != 0)) {
+		printk(KERN_ERR "Size must be non-zero for enabled windows\n");
 		retval = -EINVAL;
 		goto err_window;
 	}
@@ -994,26 +954,31 @@ int tsi148_master_set( struct vme_master_resource *image, int enabled,
 	spin_lock(&(image->lock));
 
 	/* Let's allocate the resource here rather than further up the stack as
-	 * it avoids pushing loads of bus dependant stuff up the stack
+	 * it avoids pushing loads of bus dependant stuff up the stack. If size
+	 * is zero, any existing resource will be freed.
 	 */
 	retval = tsi148_alloc_resource(image, size);
 	if (retval) {
 		spin_unlock(&(image->lock));
-		printk(KERN_ERR "Unable to allocate memory for resource "
-			"name\n");
-		retval = -ENOMEM;
+		printk(KERN_ERR "Unable to allocate memory for "
+			"resource\n");
 		goto err_res;
 	}
 
-	pci_base = (unsigned long long)image->pci_resource.start;
-
+	if (size == 0) {
+		pci_base = 0;
+		pci_bound = 0;
+		vme_offset = 0;
+	} else {
+		pci_base = (unsigned long long)image->pci_resource.start;
 
-	/*
-	 * Bound address is a valid address for the window, adjust
-	 * according to window granularity.
-	 */
-	pci_bound = pci_base + (size - 0x10000);
-	vme_offset = vme_base - pci_base;
+		/*
+		 * Bound address is a valid address for the window, adjust
+		 * according to window granularity.
+		 */
+		pci_bound = pci_base + (size - 0x10000);
+		vme_offset = vme_base - pci_base;
+	}
 
 	/* Convert 64-bit variables to 2x 32-bit variables */
 	reg_split(pci_base, &pci_base_high, &pci_base_low);
@@ -1022,19 +987,19 @@ int tsi148_master_set( struct vme_master_resource *image, int enabled,
 
 	if (pci_base_low & 0xFFFF) {
 		spin_unlock(&(image->lock));
-		printk("Invalid PCI base alignment\n");
+		printk(KERN_ERR "Invalid PCI base alignment\n");
 		retval = -EINVAL;
 		goto err_gran;
 	}
 	if (pci_bound_low & 0xFFFF) {
 		spin_unlock(&(image->lock));
-		printk("Invalid PCI bound alignment\n");
+		printk(KERN_ERR "Invalid PCI bound alignment\n");
 		retval = -EINVAL;
 		goto err_gran;
 	}
 	if (vme_offset_low & 0xFFFF) {
 		spin_unlock(&(image->lock));
-		printk("Invalid VME Offset alignment\n");
+		printk(KERN_ERR "Invalid VME Offset alignment\n");
 		retval = -EINVAL;
 		goto err_gran;
 	}
@@ -1094,7 +1059,8 @@ int tsi148_master_set( struct vme_master_resource *image, int enabled,
 		temp_ctl |= TSI148_LCSR_OTAT_TM_2eSST;
 	}
 	if (cycle & VME_2eSSTB) {
-		printk("Currently not setting Broadcast Select Registers\n");
+		printk(KERN_WARNING "Currently not setting Broadcast Select "
+			"Registers\n");
 		temp_ctl &= ~TSI148_LCSR_OTAT_TM_M;
 		temp_ctl |= TSI148_LCSR_OTAT_TM_2eSSTB;
 	}
@@ -1110,7 +1076,7 @@ int tsi148_master_set( struct vme_master_resource *image, int enabled,
 		break;
 	default:
 		spin_unlock(&(image->lock));
-		printk("Invalid data width\n");
+		printk(KERN_ERR "Invalid data width\n");
 		retval = -EINVAL;
 		goto err_dwidth;
 	}
@@ -1147,7 +1113,7 @@ int tsi148_master_set( struct vme_master_resource *image, int enabled,
 		break;
 	default:
 		spin_unlock(&(image->lock));
-		printk("Invalid address space\n");
+		printk(KERN_ERR "Invalid address space\n");
 		retval = -EINVAL;
 		goto err_aspace;
 		break;
@@ -2154,7 +2120,7 @@ int tsi148_lm_detach(struct vme_lm_resource *lm, int monitor)
 	iowrite32be(tmp, tsi148_bridge->base + TSI148_LCSR_INTEO);
 
 	iowrite32be(TSI148_LCSR_INTC_LMC[monitor],
-		 tsi148_bridge->base + TSI148_LCSR_INTEO);
+		 tsi148_bridge->base + TSI148_LCSR_INTC);
 
 	/* Detach callback */
 	lm_callback[monitor] = NULL;
@@ -2334,7 +2300,6 @@ static int tsi148_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 	init_waitqueue_head(&dma_queue[1]);
 	init_waitqueue_head(&iack_queue);
 	mutex_init(&(vme_int));
-	mutex_init(&(vme_irq));
 	mutex_init(&(vme_rmw));
 
 	tsi148_bridge->parent = &(pdev->dev);
@@ -2482,9 +2447,8 @@ static int tsi148_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 	tsi148_bridge->dma_list_add = tsi148_dma_list_add;
 	tsi148_bridge->dma_list_exec = tsi148_dma_list_exec;
 	tsi148_bridge->dma_list_empty = tsi148_dma_list_empty;
-	tsi148_bridge->request_irq = tsi148_request_irq;
-	tsi148_bridge->free_irq = tsi148_free_irq;
-	tsi148_bridge->generate_irq = tsi148_generate_irq;
+	tsi148_bridge->irq_set = tsi148_irq_set;
+	tsi148_bridge->irq_generate = tsi148_irq_generate;
 	tsi148_bridge->lm_set = tsi148_lm_set;
 	tsi148_bridge->lm_get = tsi148_lm_get;
 	tsi148_bridge->lm_attach = tsi148_lm_attach;
@@ -2617,13 +2581,6 @@ static void tsi148_remove(struct pci_dev *pdev)
 	}
 
 	/*
-	 *  Disable and clear all interrupts.
-	 */
-	iowrite32be(0x0, tsi148_bridge->base + TSI148_LCSR_INTEO);
-	iowrite32be(0xFFFFFFFF, tsi148_bridge->base + TSI148_LCSR_INTC);
-	iowrite32be(0xFFFFFFFF, tsi148_bridge->base + TSI148_LCSR_INTEN);
-
-	/*
 	 *  Map all Interrupts to PCI INTA
 	 */
 	iowrite32be(0x0, tsi148_bridge->base + TSI148_LCSR_INTM1);
diff --git a/drivers/staging/vme/devices/vme_user.c b/drivers/staging/vme/devices/vme_user.c
index 78912883d153..e228942ee081 100644
--- a/drivers/staging/vme/devices/vme_user.c
+++ b/drivers/staging/vme/devices/vme_user.c
@@ -31,7 +31,6 @@
 #include <linux/spinlock.h>
 #include <linux/syscalls.h>
 #include <linux/types.h>
-#include <linux/version.h>
 
 #include <asm/io.h>
 #include <asm/uaccess.h>
@@ -625,7 +624,7 @@ err_nocard:
 static int __init vme_user_probe(struct device *dev, int cur_bus, int cur_slot)
 {
 	int i, err;
-	char name[8];
+	char name[12];
 
 	/* Save pointer to the bridge device */
 	if (vme_user_bridge != NULL) {
diff --git a/drivers/staging/vme/vme.c b/drivers/staging/vme/vme.c
index 477a1adfd0e9..994fdb9b2127 100644
--- a/drivers/staging/vme/vme.c
+++ b/drivers/staging/vme/vme.c
@@ -13,7 +13,6 @@
  * option) any later version.
  */
 
-#include <linux/version.h>
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/mm.h>
@@ -644,7 +643,7 @@ EXPORT_SYMBOL(vme_master_free);
  * Request a DMA controller with specific attributes, return some unique
  * identifier.
  */
-struct vme_resource *vme_request_dma(struct device *dev)
+struct vme_resource *vme_dma_request(struct device *dev)
 {
 	struct vme_bridge *bridge;
 	struct list_head *dma_pos = NULL;
@@ -705,7 +704,7 @@ err_ctrlr:
 err_bus:
 	return NULL;
 }
-EXPORT_SYMBOL(vme_request_dma);
+EXPORT_SYMBOL(vme_dma_request);
 
 /*
  * Start new list
@@ -880,7 +879,7 @@ int vme_dma_list_add(struct vme_dma_list *list, struct vme_dma_attr *src,
 		return -EINVAL;
 	}
 
-	if (mutex_trylock(&(list->mtx))) {
+	if (!mutex_trylock(&(list->mtx))) {
 		printk("Link List already submitted\n");
 		return -EINVAL;
 	}
@@ -923,7 +922,7 @@ int vme_dma_list_free(struct vme_dma_list *list)
 		return -EINVAL;
 	}
 
-	if (mutex_trylock(&(list->mtx))) {
+	if (!mutex_trylock(&(list->mtx))) {
 		printk("Link List in use\n");
 		return -EINVAL;
 	}
@@ -956,7 +955,7 @@ int vme_dma_free(struct vme_resource *resource)
 
 	ctrlr = list_entry(resource->entry, struct vme_dma_resource, list);
 
-	if (mutex_trylock(&(ctrlr->mtx))) {
+	if (!mutex_trylock(&(ctrlr->mtx))) {
 		printk("Resource busy, can't free\n");
 		return -EBUSY;
 	}
@@ -975,7 +974,23 @@ int vme_dma_free(struct vme_resource *resource)
 }
 EXPORT_SYMBOL(vme_dma_free);
 
-int vme_request_irq(struct device *dev, int level, int statid,
+void vme_irq_handler(struct vme_bridge *bridge, int level, int statid)
+{
+	void (*call)(int, int, void *);
+	void *priv_data;
+
+	call = bridge->irq[level - 1].callback[statid].func;
+	priv_data = bridge->irq[level - 1].callback[statid].priv_data;
+
+	if (call != NULL)
+		call(level, statid, priv_data);
+	else
+		printk(KERN_WARNING "Spurilous VME interrupt, level:%x, "
+			"vector:%x\n", level, statid);
+}
+EXPORT_SYMBOL(vme_irq_handler);
+
+int vme_irq_request(struct device *dev, int level, int statid,
 	void (*callback)(int level, int vector, void *priv_data),
 	void *priv_data)
 {
@@ -988,20 +1003,37 @@ int vme_request_irq(struct device *dev, int level, int statid,
 	}
 
 	if((level < 1) || (level > 7)) {
-		printk(KERN_WARNING "Invalid interrupt level\n");
+		printk(KERN_ERR "Invalid interrupt level\n");
 		return -EINVAL;
 	}
 
-	if (bridge->request_irq == NULL) {
-		printk("Registering interrupts not supported\n");
+	if (bridge->irq_set == NULL) {
+		printk(KERN_ERR "Configuring interrupts not supported\n");
 		return -EINVAL;
 	}
 
-	return bridge->request_irq(level, statid, callback, priv_data);
+	mutex_lock(&(bridge->irq_mtx));
+
+	if (bridge->irq[level - 1].callback[statid].func) {
+		mutex_unlock(&(bridge->irq_mtx));
+		printk(KERN_WARNING "VME Interrupt already taken\n");
+		return -EBUSY;
+	}
+
+	bridge->irq[level - 1].count++;
+	bridge->irq[level - 1].callback[statid].priv_data = priv_data;
+	bridge->irq[level - 1].callback[statid].func = callback;
+
+	/* Enable IRQ level */
+	bridge->irq_set(level, 1, 1);
+
+	mutex_unlock(&(bridge->irq_mtx));
+
+	return 0;
 }
-EXPORT_SYMBOL(vme_request_irq);
+EXPORT_SYMBOL(vme_irq_request);
 
-void vme_free_irq(struct device *dev, int level, int statid)
+void vme_irq_free(struct device *dev, int level, int statid)
 {
 	struct vme_bridge *bridge;
 
@@ -1012,20 +1044,31 @@ void vme_free_irq(struct device *dev, int level, int statid)
 	}
 
 	if((level < 1) || (level > 7)) {
-		printk(KERN_WARNING "Invalid interrupt level\n");
+		printk(KERN_ERR "Invalid interrupt level\n");
 		return;
 	}
 
-	if (bridge->free_irq == NULL) {
-		printk("Freeing interrupts not supported\n");
+	if (bridge->irq_set == NULL) {
+		printk(KERN_ERR "Configuring interrupts not supported\n");
 		return;
 	}
 
-	bridge->free_irq(level, statid);
+	mutex_lock(&(bridge->irq_mtx));
+
+	bridge->irq[level - 1].count--;
+
+	/* Disable IRQ level if no more interrupts attached at this level*/
+	if (bridge->irq[level - 1].count == 0)
+		bridge->irq_set(level, 0, 1);
+
+	bridge->irq[level - 1].callback[statid].func = NULL;
+	bridge->irq[level - 1].callback[statid].priv_data = NULL;
+
+	mutex_unlock(&(bridge->irq_mtx));
 }
-EXPORT_SYMBOL(vme_free_irq);
+EXPORT_SYMBOL(vme_irq_free);
 
-int vme_generate_irq(struct device *dev, int level, int statid)
+int vme_irq_generate(struct device *dev, int level, int statid)
 {
 	struct vme_bridge *bridge;
 
@@ -1040,14 +1083,14 @@ int vme_generate_irq(struct device *dev, int level, int statid)
 		return -EINVAL;
 	}
 
-	if (bridge->generate_irq == NULL) {
+	if (bridge->irq_generate == NULL) {
 		printk("Interrupt generation not supported\n");
 		return -EINVAL;
 	}
 
-	return bridge->generate_irq(level, statid);
+	return bridge->irq_generate(level, statid);
 }
-EXPORT_SYMBOL(vme_generate_irq);
+EXPORT_SYMBOL(vme_irq_generate);
 
 /*
  * Request the location monitor, return resource or NULL
@@ -1148,7 +1191,7 @@ int vme_lm_set(struct vme_resource *resource, unsigned long long lm_base,
 
 	/* XXX Check parameters */
 
-	return lm->parent->lm_set(lm, lm_base, aspace, cycle);
+	return bridge->lm_set(lm, lm_base, aspace, cycle);
 }
 EXPORT_SYMBOL(vme_lm_set);
 
@@ -1228,16 +1271,18 @@ void vme_lm_free(struct vme_resource *resource)
 
 	lm = list_entry(resource->entry, struct vme_lm_resource, list);
 
-	if (mutex_trylock(&(lm->mtx))) {
-		printk(KERN_ERR "Resource busy, can't free\n");
-		return;
-	}
+	mutex_lock(&(lm->mtx));
 
-	/* XXX Check to see that there aren't any callbacks still attached */
+	/* XXX
+	 * Check to see that there aren't any callbacks still attached, if
+	 * there are we should probably be detaching them!
+	 */
 
 	lm->locked = 0;
 
 	mutex_unlock(&(lm->mtx));
+
+	kfree(resource);
 }
 EXPORT_SYMBOL(vme_lm_free);
 
diff --git a/drivers/staging/vme/vme.h b/drivers/staging/vme/vme.h
index 6206e91d1992..97dc22e34caf 100644
--- a/drivers/staging/vme/vme.h
+++ b/drivers/staging/vme/vme.h
@@ -123,7 +123,7 @@ unsigned int vme_master_rmw (struct vme_resource *, unsigned int, unsigned int,
 	unsigned int, loff_t);
 void vme_master_free(struct vme_resource *);
 
-struct vme_resource *vme_request_dma(struct device *);
+struct vme_resource *vme_dma_request(struct device *);
 struct vme_dma_list *vme_new_dma_list(struct vme_resource *);
 struct vme_dma_attr *vme_dma_pattern_attribute(u32, vme_pattern_t);
 struct vme_dma_attr *vme_dma_pci_attribute(dma_addr_t);
@@ -136,10 +136,10 @@ int vme_dma_list_exec(struct vme_dma_list *);
 int vme_dma_list_free(struct vme_dma_list *);
 int vme_dma_free(struct vme_resource *);
 
-int vme_request_irq(struct device *, int, int,
+int vme_irq_request(struct device *, int, int,
 	void (*callback)(int, int, void *), void *);
-void vme_free_irq(struct device *, int, int);
-int vme_generate_irq(struct device *, int, int);
+void vme_irq_free(struct device *, int, int);
+int vme_irq_generate(struct device *, int, int);
 
 struct vme_resource * vme_lm_request(struct device *);
 int vme_lm_count(struct vme_resource *);
diff --git a/drivers/staging/vme/vme_api.txt b/drivers/staging/vme/vme_api.txt
index 591eba5c9036..a5c1b1cd5fcc 100644
--- a/drivers/staging/vme/vme_api.txt
+++ b/drivers/staging/vme/vme_api.txt
@@ -77,7 +77,7 @@ driver in question:
 	struct vme_resource * vme_slave_request(struct device *dev,
 		vme_address_t aspace, vme_cycle_t cycle);
 
-	struct vme_resource *vme_request_dma(struct device *dev);
+	struct vme_resource *vme_dma_request(struct device *dev);
 
 For slave windows these attributes are split into those of type 'vme_address_t'
 and 'vme_cycle_t'. Master windows add a further set of attributes 'vme_cycle_t'.
@@ -290,10 +290,10 @@ status ID combination. Any given combination can only be assigned a single
 callback function. A void pointer parameter is provided, the value of which is
 passed to the callback function, the use of this pointer is user undefined:
 
-	int vme_request_irq(struct device *dev, int level, int statid,
+	int vme_irq_request(struct device *dev, int level, int statid,
 		void (*callback)(int, int, void *), void *priv);
 
-	void vme_free_irq(struct device *dev, int level, int statid);
+	void vme_irq_free(struct device *dev, int level, int statid);
 
 The callback parameters are as follows. Care must be taken in writing a callback
 function, callback functions run in interrupt context:
@@ -307,7 +307,7 @@ Interrupt Generation
 The following function can be used to generate a VME interrupt at a given VME
 level and VME status ID:
 
-	int vme_generate_irq(struct device *dev, int level, int statid);
+	int vme_irq_generate(struct device *dev, int level, int statid);
 
 
 Location monitors
diff --git a/drivers/staging/vme/vme_bridge.h b/drivers/staging/vme/vme_bridge.h
index e43cc19103b3..851fa92559f6 100644
--- a/drivers/staging/vme/vme_bridge.h
+++ b/drivers/staging/vme/vme_bridge.h
@@ -120,6 +120,8 @@ struct vme_bridge {
 
 	/* Interrupt callbacks */
 	struct vme_irq irq[7];
+	/* Locking for VME irq callback configuration */
+	struct mutex irq_mtx;
 
 	/* Slave Functions */
 	int (*slave_get) (struct vme_slave_resource *, int *,
@@ -149,9 +151,8 @@ struct vme_bridge {
 	int (*dma_list_empty) (struct vme_dma_list *);
 
 	/* Interrupt Functions */
-	int (*request_irq) (int, int, void (*cback)(int, int, void*), void *);
-	void (*free_irq) (int, int);
-	int (*generate_irq) (int, int);
+	void (*irq_set) (int, int, int);
+	int (*irq_generate) (int, int);
 
 	/* Location monitor functions */
 	int (*lm_set) (struct vme_lm_resource *, unsigned long long,
@@ -175,6 +176,8 @@ struct vme_bridge {
 #endif
 };
 
+void vme_irq_handler(struct vme_bridge *, int, int);
+
 int vme_register_bridge (struct vme_bridge *);
 void vme_unregister_bridge (struct vme_bridge *);
 
diff --git a/drivers/staging/vt6655/Kconfig b/drivers/staging/vt6655/Kconfig
index 825bbc4fc3fa..061e730df2d0 100644
--- a/drivers/staging/vt6655/Kconfig
+++ b/drivers/staging/vt6655/Kconfig
@@ -1,6 +1,6 @@
 config VT6655
    tristate "VIA Technologies VT6655 support"
-   depends on PCI
+   depends on PCI && WLAN
    select WIRELESS_EXT
    select WEXT_PRIV
    ---help---
diff --git a/drivers/staging/vt6655/device.h b/drivers/staging/vt6655/device.h
index fa7f0fcad33b..cde44d21b75c 100644
--- a/drivers/staging/vt6655/device.h
+++ b/drivers/staging/vt6655/device.h
@@ -44,7 +44,6 @@
 #include <linux/timer.h>
 #include <linux/slab.h>
 #include <linux/interrupt.h>
-#include <linux/version.h>
 #include <linux/string.h>
 #include <linux/wait.h>
 #include <linux/if_arp.h>
@@ -79,7 +78,6 @@
 // device specific
 //
 
-#include "kcompat.h"
 #include "device_cfg.h"
 #include "ttype.h"
 #include "80211hdr.h"
diff --git a/drivers/staging/vt6655/device_main.c b/drivers/staging/vt6655/device_main.c
index 53450b48eaa6..0db8d7b6e79c 100644
--- a/drivers/staging/vt6655/device_main.c
+++ b/drivers/staging/vt6655/device_main.c
@@ -661,7 +661,7 @@ else
    if(zonetype!=pDevice->abyEEPROM[EEP_OFS_ZONETYPE])
       printk("zonetype in file[%02x] mismatch with in EEPROM[%02x]\n",zonetype,pDevice->abyEEPROM[EEP_OFS_ZONETYPE]);
    else
-      printk("Read Zonetype file sucess,use default zonetype setting[%02x]\n",zonetype);
+      printk("Read Zonetype file success,use default zonetype setting[%02x]\n",zonetype);
  }
  	}
   else
diff --git a/drivers/staging/vt6655/ioctl.c b/drivers/staging/vt6655/ioctl.c
index fc9cbe0acd64..d9a5fd21ab31 100644
--- a/drivers/staging/vt6655/ioctl.c
+++ b/drivers/staging/vt6655/ioctl.c
@@ -159,7 +159,7 @@ int private_ioctl(PSDevice pDevice, struct ifreq *rq) {
 	 else if(zonetype == 0x02) { //Europe
              sZoneTypeCmd.ZoneType = ZoneType_Europe;
 	 }
-	 else { //Unknow ZoneType
+	 else { //Unknown ZoneType
 	        printk("Error:ZoneType[%x] Unknown ???\n",zonetype);
 	         result = -EFAULT;
 		break;
@@ -692,7 +692,7 @@ if(wpa_Result.authenticated==TRUE) {
      wireless_send_event(pDevice->dev, IWEVCUSTOM, &wrqu, pItemSSID->abySSID);
    }
    #endif
-         pDevice->fWPA_Authened = TRUE;           //is sucessful peer to wpa_Result.authenticated?
+         pDevice->fWPA_Authened = TRUE;           //is successful peer to wpa_Result.authenticated?
 }
 
         //printk("get private wpa_supplicant announce WPA SM\n");
diff --git a/drivers/staging/vt6655/kcompat.h b/drivers/staging/vt6655/kcompat.h
deleted file mode 100644
index 2cf634ca67d6..000000000000
--- a/drivers/staging/vt6655/kcompat.h
+++ /dev/null
@@ -1,39 +0,0 @@
-/*
- * Copyright (c) 1996, 2003 VIA Networking, Inc. All rights reserved.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- *
- *
- * File: kcompat.h
- *
- * Purpose: define kernel compatibility header
- *
- * Author: Lyndon Chen
- *
- * Date: Apr 8, 2002
- *
- */
-
-#ifndef _KCOMPAT_H
-#define _KCOMPAT_H
-
-#include <linux/version.h>
-
-#ifndef HAVE_NETDEV_PRIV
-#define netdev_priv(dev) (dev->priv)
-#endif
-
-#endif
-
diff --git a/drivers/staging/vt6655/mib.h b/drivers/staging/vt6655/mib.h
index 69e04f70b6c1..2aa2b91de72b 100644
--- a/drivers/staging/vt6655/mib.h
+++ b/drivers/staging/vt6655/mib.h
@@ -325,10 +325,10 @@ typedef struct tagSStatCounter {
    #ifdef Calcu_LinkQual
        //Tx count:
     ULONG TxNoRetryOkCount;         //success tx no retry !
-    ULONG TxRetryOkCount;              //sucess tx but retry !
+    ULONG TxRetryOkCount;              //success tx but retry !
     ULONG TxFailCount;                      //fail tx ?
       //Rx count:
-    ULONG RxOkCnt;                          //sucess rx !
+    ULONG RxOkCnt;                          //success rx !
     ULONG RxFcsErrCnt;                    //fail rx ?
       //statistic
     ULONG SignalStren;
diff --git a/drivers/staging/vt6655/rxtx.h b/drivers/staging/vt6655/rxtx.h
index 17bd1b1f40e6..5da815efe70b 100644
--- a/drivers/staging/vt6655/rxtx.h
+++ b/drivers/staging/vt6655/rxtx.h
@@ -35,17 +35,10 @@
 
 /*---------------------  Export Definitions -------------------------*/
 
-/*---------------------  Export Classes  ----------------------------*/
-
 /*---------------------  Export Variables  --------------------------*/
 
 /*---------------------  Export Functions  --------------------------*/
 
-
-#ifdef __cplusplus
-extern "C" {                            /* Assume C declarations for C++ */
-#endif /* __cplusplus */
-
 /*
 VOID vGenerateMACHeader(
     IN PSDevice pDevice,
@@ -111,14 +104,4 @@ VOID vDMA0_tx_80211(PSDevice  pDevice, struct sk_buff *skb, PBYTE pbMPDU, UINT c
 CMD_STATUS csMgmt_xmit(PSDevice pDevice, PSTxMgmtPacket pPacket);
 CMD_STATUS csBeacon_xmit(PSDevice pDevice, PSTxMgmtPacket pPacket);
 
-#ifdef __cplusplus
-}                                       /* End of extern "C" { */
-#endif /* __cplusplus */
-
-
-
-
 #endif // __RXTX_H__
-
-
-
diff --git a/drivers/staging/vt6655/wcmd.c b/drivers/staging/vt6655/wcmd.c
index d81f5b79a157..c9eabf9995df 100644
--- a/drivers/staging/vt6655/wcmd.c
+++ b/drivers/staging/vt6655/wcmd.c
@@ -48,7 +48,6 @@
 #include "wmgr.h"
 #include "power.h"
 #include "wctl.h"
-#include "card.h"
 #include "baseband.h"
 #include "rxtx.h"
 #include "rf.h"
diff --git a/drivers/staging/vt6655/wpa.c b/drivers/staging/vt6655/wpa.c
index f92d33ffe775..5da671418b52 100644
--- a/drivers/staging/vt6655/wpa.c
+++ b/drivers/staging/vt6655/wpa.c
@@ -147,7 +147,7 @@ WPA_ParseRSN (
         if (pRSN->len >= 12) //oui1(4)+ver(2)+GKS(4)+PKSCnt(2)
         {
             j = 0;
-            DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"wPKCount: %d, sizeof(pBSSList->abyPKType): %ld\n", pRSN->wPKCount, sizeof(pBSSList->abyPKType));
+            DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"wPKCount: %d, sizeof(pBSSList->abyPKType): %zu\n", pRSN->wPKCount, sizeof(pBSSList->abyPKType));
             for(i = 0; (i < pRSN->wPKCount) && (j < sizeof(pBSSList->abyPKType)/sizeof(BYTE)); i++) {
                 if(pRSN->len >= 12+i*4+4) { //oui1(4)+ver(2)+GKS(4)+PKSCnt(2)+PKS(4*i)
                     if ( !memcmp(pRSN->PKSList[i].abyOUI, abyOUI00, 4))
@@ -178,7 +178,7 @@ WPA_ParseRSN (
             // overlay IE_RSN_Auth structure into correct place
             pIE_RSN_Auth = (PWLAN_IE_RSN_AUTH) pRSN->PKSList[m].abyOUI;
             j = 0;
-            DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"wAuthCount: %d, sizeof(pBSSList->abyAuthType): %ld\n",
+            DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"wAuthCount: %d, sizeof(pBSSList->abyAuthType): %zu\n",
                           pIE_RSN_Auth->wAuthCount, sizeof(pBSSList->abyAuthType));
             for(i = 0; (i < pIE_RSN_Auth->wAuthCount) && (j < sizeof(pBSSList->abyAuthType)/sizeof(BYTE)); i++) {
                 if(pRSN->len >= 14+4+(m+i)*4) { //oui1(4)+ver(2)+GKS(4)+PKSCnt(2)+PKS(4*m)+AKC(2)+AKS(4*i)
diff --git a/drivers/staging/vt6655/wroute.c b/drivers/staging/vt6655/wroute.c
index ab991618a298..1d02040e80e0 100644
--- a/drivers/staging/vt6655/wroute.c
+++ b/drivers/staging/vt6655/wroute.c
@@ -113,7 +113,7 @@ BOOL ROUTEbRelay (PSDevice pDevice, PBYTE pbySkbData, UINT uDataLen, UINT uNodeI
     }
 
     if (pDevice->bEnableHostWEP) {
-        if (uNodeIndex >= 0) {
+	if (uNodeIndex < MAX_NODE_NUM + 1) {
             pTransmitKey = &STempKey;
             pTransmitKey->byCipherSuite = pMgmt->sNodeDBTable[uNodeIndex].byCipherSuite;
             pTransmitKey->dwKeyIndex = pMgmt->sNodeDBTable[uNodeIndex].dwKeyIndex;
diff --git a/drivers/staging/vt6656/Kconfig b/drivers/staging/vt6656/Kconfig
index 87bcd269310c..1055b526c532 100644
--- a/drivers/staging/vt6656/Kconfig
+++ b/drivers/staging/vt6656/Kconfig
@@ -1,6 +1,6 @@
 config VT6656
 	tristate "VIA Technologies VT6656 support"
-	depends on USB
+	depends on USB && WLAN
 	select WIRELESS_EXT
 	select WEXT_PRIV
 	---help---
diff --git a/drivers/staging/vt6656/baseband.c b/drivers/staging/vt6656/baseband.c
index 820a7b8e6fb8..7dc01dbfc6ff 100644
--- a/drivers/staging/vt6656/baseband.c
+++ b/drivers/staging/vt6656/baseband.c
@@ -46,7 +46,6 @@
 #include "control.h"
 #include "datarate.h"
 #include "rndis.h"
-#include "control.h"
 
 /*---------------------  Static Definitions -------------------------*/
 static int          msglevel                =MSG_LEVEL_INFO;
@@ -1041,7 +1040,7 @@ else {
    if(pDevice->config_file.ZoneType !=pDevice->abyEEPROM[EEP_OFS_ZONETYPE])
       printk("zonetype in file[%02x] mismatch with in EEPROM[%02x]\n",pDevice->config_file.ZoneType,pDevice->abyEEPROM[EEP_OFS_ZONETYPE]);
    else
-      printk("Read Zonetype file sucess,use default zonetype setting[%02x]\n",pDevice->config_file.ZoneType);
+      printk("Read Zonetype file success,use default zonetype setting[%02x]\n",pDevice->config_file.ZoneType);
  }
 }
 
diff --git a/drivers/staging/vt6656/channel.c b/drivers/staging/vt6656/channel.c
index e49796f7b814..f7136b0073bb 100644
--- a/drivers/staging/vt6656/channel.c
+++ b/drivers/staging/vt6656/channel.c
@@ -19,7 +19,7 @@
  *
  * File: channel.c
  *
- * Purpose: Channel number maping
+ * Purpose: Channel number mapping
  *
  * Author: Lucas Lin
  *
diff --git a/drivers/staging/vt6656/device.h b/drivers/staging/vt6656/device.h
index b02ca2d66fee..8b541d1d0e23 100644
--- a/drivers/staging/vt6656/device.h
+++ b/drivers/staging/vt6656/device.h
@@ -44,7 +44,6 @@
 #include <linux/timer.h>
 #include <linux/slab.h>
 #include <linux/interrupt.h>
-#include <linux/version.h>
 #include <linux/string.h>
 #include <linux/wait.h>
 #include <linux/if_arp.h>
@@ -88,7 +87,6 @@
 // device specific
 //
 
-#include "kcompat.h"
 #include "device_cfg.h"
 #include "ttype.h"
 #include "80211hdr.h"
@@ -103,7 +101,7 @@
 #include "card.h"
 
 /*---------------------  Export Definitions -------------------------*/
-#define VNT_USB_VENDOR_ID                     0x160A
+#define VNT_USB_VENDOR_ID                     0x160a
 #define VNT_USB_PRODUCT_ID                    0x3184
 
 #define MAC_MAX_CONTEXT_REG     (256+128)
diff --git a/drivers/staging/vt6656/firmware.c b/drivers/staging/vt6656/firmware.c
index 52daa3bda739..585b6b12c5ba 100644
--- a/drivers/staging/vt6656/firmware.c
+++ b/drivers/staging/vt6656/firmware.c
@@ -801,7 +801,7 @@ FIRMWAREbDownload(
                                             &(pBuffer[ii])
                                             );
 
-            DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Download firmware...%d %ld\n", ii, sizeof(abyFirmware));
+            DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Download firmware...%d %zu\n", ii, sizeof(abyFirmware));
             if (NdisStatus != STATUS_SUCCESS) {
                 if (pBuffer)
                     kfree(pBuffer);
diff --git a/drivers/staging/vt6656/hostap.c b/drivers/staging/vt6656/hostap.c
index 0c8267a10078..1078d616c497 100644
--- a/drivers/staging/vt6656/hostap.c
+++ b/drivers/staging/vt6656/hostap.c
@@ -37,7 +37,6 @@
 #include "baseband.h"
 #include "wpactl.h"
 #include "key.h"
-#include "mac.h"
 #include "datarate.h"
 
 #define VIAWGET_HOSTAPD_MAX_BUF_SIZE 1024
diff --git a/drivers/staging/vt6656/ioctl.c b/drivers/staging/vt6656/ioctl.c
index d94131fe5243..6f33005a615f 100644
--- a/drivers/staging/vt6656/ioctl.c
+++ b/drivers/staging/vt6656/ioctl.c
@@ -152,7 +152,7 @@ int private_ioctl(PSDevice pDevice, struct ifreq *rq) {
 	 else if(zonetype == 0x02) { //Europe
              sZoneTypeCmd.ZoneType = ZoneType_Europe;
 	 }
-	 else { //Unknow ZoneType
+	 else { //Unknown ZoneType
 	        printk("Error:ZoneType[%x] Unknown ???\n",zonetype);
 	         result = -EFAULT;
 		break;
@@ -679,7 +679,7 @@ if(wpa_Result.authenticated==TRUE) {
      wireless_send_event(pDevice->dev, IWEVCUSTOM, &wrqu, pItemSSID->abySSID);
    }
    #endif
-         pDevice->fWPA_Authened = TRUE;           //is sucessful peer to wpa_Result.authenticated?
+         pDevice->fWPA_Authened = TRUE;           //is successful peer to wpa_Result.authenticated?
 }
 
         //printk("get private wpa_supplicant announce WPA SM\n");
diff --git a/drivers/staging/vt6656/iwctl.c b/drivers/staging/vt6656/iwctl.c
index aa8d1a2394a4..b7c6a22fe321 100644
--- a/drivers/staging/vt6656/iwctl.c
+++ b/drivers/staging/vt6656/iwctl.c
@@ -1724,7 +1724,7 @@ int iwctl_siwauth(struct net_device *dev,
 	case IW_AUTH_WPA_ENABLED:
 		//pDevice->bWPADEVUp = !! wrq->value;
 		//if(pDevice->bWPADEVUp==TRUE)
-		  // printk("iwctl_siwauth:set WPADEV to enable sucessful*******\n");
+		  // printk("iwctl_siwauth:set WPADEV to enable successful*******\n");
 		//else
 		 //  printk("iwctl_siwauth:set WPADEV to enable fail?????\n");
 		break;
diff --git a/drivers/staging/vt6656/kcompat.h b/drivers/staging/vt6656/kcompat.h
deleted file mode 100644
index 2cf634ca67d6..000000000000
--- a/drivers/staging/vt6656/kcompat.h
+++ /dev/null
@@ -1,39 +0,0 @@
-/*
- * Copyright (c) 1996, 2003 VIA Networking, Inc. All rights reserved.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- *
- *
- * File: kcompat.h
- *
- * Purpose: define kernel compatibility header
- *
- * Author: Lyndon Chen
- *
- * Date: Apr 8, 2002
- *
- */
-
-#ifndef _KCOMPAT_H
-#define _KCOMPAT_H
-
-#include <linux/version.h>
-
-#ifndef HAVE_NETDEV_PRIV
-#define netdev_priv(dev) (dev->priv)
-#endif
-
-#endif
-
diff --git a/drivers/staging/vt6656/main_usb.c b/drivers/staging/vt6656/main_usb.c
index 05186110c029..ef17c4958c67 100644
--- a/drivers/staging/vt6656/main_usb.c
+++ b/drivers/staging/vt6656/main_usb.c
@@ -64,11 +64,9 @@
 #include "ioctl.h"
 #include "iwctl.h"
 #include "dpc.h"
-#include "iocmd.h"
 #include "datarate.h"
 #include "rf.h"
 #include "firmware.h"
-#include "mac.h"
 #include "rndis.h"
 #include "control.h"
 #include "channel.h"
@@ -809,12 +807,6 @@ vntwusb_found1(struct usb_interface *intf, const struct usb_device_id *id)
         kfree(pDevice);
         return -ENODEV;
     }
-	//2008-0623-02<Remark>by MikeLiu
-        //2007-0821-01<Add>by MikeLiu
-       //#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,21)
-  	//usb_set_intfdata(intf, pDevice);
-	//SET_NETDEV_DEV(netdev, &intf->dev);
-       //#endif
 
 //2008-07-21-01<Add>by MikeLiu
 //register wpadev
@@ -1545,7 +1537,7 @@ if(result!=0) {
   return buffer;
 }
 
-//return --->-1:fail;  >=0:sucessful
+//return --->-1:fail;  >=0:successful
 static int Read_config_file(PSDevice pDevice) {
   int result=0;
   UCHAR      tmpbuffer[100];
diff --git a/drivers/staging/vt6656/mib.h b/drivers/staging/vt6656/mib.h
index b806b4d29717..ac996d2cd911 100644
--- a/drivers/staging/vt6656/mib.h
+++ b/drivers/staging/vt6656/mib.h
@@ -357,10 +357,10 @@ typedef struct tagSStatCounter {
    #ifdef Calcu_LinkQual
        //Tx count:
     ULONG TxNoRetryOkCount;         //success tx no retry !
-    ULONG TxRetryOkCount;              //sucess tx but retry !
+    ULONG TxRetryOkCount;              //success tx but retry !
     ULONG TxFailCount;                      //fail tx ?
       //Rx count:
-    ULONG RxOkCnt;                          //sucess rx !
+    ULONG RxOkCnt;                          //success rx !
     ULONG RxFcsErrCnt;                    //fail rx ?
       //statistic
     ULONG SignalStren;
diff --git a/drivers/staging/vt6656/rxtx.c b/drivers/staging/vt6656/rxtx.c
index 94ddf8bab62b..d9fa36c95230 100644
--- a/drivers/staging/vt6656/rxtx.c
+++ b/drivers/staging/vt6656/rxtx.c
@@ -3153,7 +3153,7 @@ bRelayPacketSend (
     }
 
     if (pDevice->bEnableHostWEP) {
-        if (uNodeIndex >= 0) {
+        if (uNodeIndex < MAX_NODE_NUM + 1) {
             pTransmitKey = &STempKey;
             pTransmitKey->byCipherSuite = pMgmt->sNodeDBTable[uNodeIndex].byCipherSuite;
             pTransmitKey->dwKeyIndex = pMgmt->sNodeDBTable[uNodeIndex].dwKeyIndex;
diff --git a/drivers/staging/vt6656/wcmd.c b/drivers/staging/vt6656/wcmd.c
index 6912344fdfae..51b2dcfbab91 100644
--- a/drivers/staging/vt6656/wcmd.c
+++ b/drivers/staging/vt6656/wcmd.c
@@ -48,7 +48,6 @@
 #include "wmgr.h"
 #include "power.h"
 #include "wctl.h"
-#include "card.h"
 #include "baseband.h"
 #include "control.h"
 #include "rxtx.h"
@@ -1332,7 +1331,7 @@ BSSvSecondTxData(
     }
 
   spin_lock_irq(&pDevice->lock);
-  //is wap_supplicant running sucessful OR only open && sharekey mode!
+  //is wap_supplicant running successful OR only open && sharekey mode!
   #if 1
   if(((pDevice->bLinkPass ==TRUE)&&(pMgmt->eAuthenMode < WMAC_AUTH_WPA)) ||  //open && sharekey linking
       (pDevice->fWPA_Authened == TRUE)) {   //wpa linking
diff --git a/drivers/staging/vt6656/wpa.c b/drivers/staging/vt6656/wpa.c
index f92d33ffe775..5da671418b52 100644
--- a/drivers/staging/vt6656/wpa.c
+++ b/drivers/staging/vt6656/wpa.c
@@ -147,7 +147,7 @@ WPA_ParseRSN (
         if (pRSN->len >= 12) //oui1(4)+ver(2)+GKS(4)+PKSCnt(2)
         {
             j = 0;
-            DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"wPKCount: %d, sizeof(pBSSList->abyPKType): %ld\n", pRSN->wPKCount, sizeof(pBSSList->abyPKType));
+            DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"wPKCount: %d, sizeof(pBSSList->abyPKType): %zu\n", pRSN->wPKCount, sizeof(pBSSList->abyPKType));
             for(i = 0; (i < pRSN->wPKCount) && (j < sizeof(pBSSList->abyPKType)/sizeof(BYTE)); i++) {
                 if(pRSN->len >= 12+i*4+4) { //oui1(4)+ver(2)+GKS(4)+PKSCnt(2)+PKS(4*i)
                     if ( !memcmp(pRSN->PKSList[i].abyOUI, abyOUI00, 4))
@@ -178,7 +178,7 @@ WPA_ParseRSN (
             // overlay IE_RSN_Auth structure into correct place
             pIE_RSN_Auth = (PWLAN_IE_RSN_AUTH) pRSN->PKSList[m].abyOUI;
             j = 0;
-            DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"wAuthCount: %d, sizeof(pBSSList->abyAuthType): %ld\n",
+            DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"wAuthCount: %d, sizeof(pBSSList->abyAuthType): %zu\n",
                           pIE_RSN_Auth->wAuthCount, sizeof(pBSSList->abyAuthType));
             for(i = 0; (i < pIE_RSN_Auth->wAuthCount) && (j < sizeof(pBSSList->abyAuthType)/sizeof(BYTE)); i++) {
                 if(pRSN->len >= 14+4+(m+i)*4) { //oui1(4)+ver(2)+GKS(4)+PKSCnt(2)+PKS(4*m)+AKC(2)+AKS(4*i)
diff --git a/drivers/staging/wavelan/wavelan_cs.c b/drivers/staging/wavelan/wavelan_cs.c
index 33918fd5b231..10c702b5be4a 100644
--- a/drivers/staging/wavelan/wavelan_cs.c
+++ b/drivers/staging/wavelan/wavelan_cs.c
@@ -3987,7 +3987,7 @@ wavelan_interrupt(int		irq,
 #endif
 
   /* Prevent reentrancy. We need to do that because we may have
-   * multiple interrupt handler running concurently.
+   * multiple interrupt handler running concurrently.
    * It is safe because interrupts are disabled before aquiring
    * the spinlock. */
   spin_lock(&lp->spinlock);
diff --git a/drivers/staging/wlags49_h2/Kconfig b/drivers/staging/wlags49_h2/Kconfig
new file mode 100644
index 000000000000..92053fe70130
--- /dev/null
+++ b/drivers/staging/wlags49_h2/Kconfig
@@ -0,0 +1,9 @@
+config WLAGS49_H2
+	tristate "Agere Systems HERMES II Wireless PC Card Model 0110"
+	depends on WLAN_80211 && WIRELESS_EXT && PCMCIA
+	select WEXT_SPY
+	---help---
+	  Driver for wireless cards using Agere's HERMES II chipset
+	  which are identified with Manufacture ID: 0156,0003
+	  The software is a modified version of wl_lkm_722_abg.tar.gz
+	  from the Agere Systems website, addapted for Ubuntu 9.04.
diff --git a/drivers/staging/wlags49_h2/Makefile b/drivers/staging/wlags49_h2/Makefile
new file mode 100644
index 000000000000..25d0a8a9ce30
--- /dev/null
+++ b/drivers/staging/wlags49_h2/Makefile
@@ -0,0 +1,81 @@
+#
+# Makefile for wlags49_h2_cs.ko and wlags49_h25_cs.ko
+#
+# Default build for Hermes-II base cards (possibly identified with
+# "manfid: 0x0156, 0x0003" in "pccardctl ident" output), comment
+# -DHERMES25 below
+#
+# If you want to build for Hermes-II.5 base cards (possibly identified with
+# "manfid: 0x0156, 0x0004" in "pccardctl ident" output), uncomment
+# -DHERMES25 below
+#
+#  If you want to build AP support (untested), comment out -DSTA_ONLY
+
+INSTALLDIR := /lib/modules/$(shell uname -r)/kernel/drivers/net/wireless
+EXTRA_CFLAGS += -I$(KERNELDIR)/include
+EXTRA_CFLAGS += -I$(src) \
+		-DBUS_PCMCIA \
+		-DUSE_WPA \
+		-DUSE_WEXT \
+		-DSTA_ONLY \
+		-DWVLAN_49 \
+#		-DHERMES25 \
+#		-DDBG \
+#		-DDBG_LVL=5 \
+#		-DUSE_UIL \
+#		-DUSE_PROFILE \
+
+ifeq ($(findstring HERMES25,$(EXTRA_CFLAGS)),)
+WLNAME := wlags49_h2_cs
+$(WLNAME)-y := sta_h2.o
+ifeq ($(findstring STA_ONLY,$(EXTRA_CFLAGS)),)
+$(WLNAME)-y += ap_h2.o
+endif
+else
+WLNAME=wlags49_h25_cs
+$(WLNAME)-y := sta_h25.o
+ifeq ($(findstring STA_ONLY,$(EXTRA_CFLAGS)),)
+$(WLNAME)-y += ap_h25.o
+endif
+endif
+
+# If KERNELRELEASE is defined, we've been invoked from the
+# kernel build system and can use its language.
+ifneq ($(KERNELRELEASE),)
+
+obj-m		+= $(WLNAME).o
+
+$(WLNAME)-y +=	wl_profile.o \
+		wl_wext.o \
+		wl_priv.o \
+		wl_main.o \
+		wl_enc.o \
+		wl_util.o \
+		wl_netdev.o \
+		wl_cs.o \
+		mmd.o \
+		hcf.o \
+		dhf.o
+
+$(WLNAME)-$(CONFIG_SYSFS)	+= wl_sysfs.o
+
+# Otherwise we were called directly from the command
+# line; invoke the kernel build system.
+else
+	KERNELDIR ?= /lib/modules/$(shell uname -r)/build
+	PWD := $(shell pwd)
+
+default:
+	$(MAKE) -C $(KERNELDIR) M=$(PWD) modules
+endif
+
+clean:
+	rm -fr *.o *.ko *.mod.c *.mod.o .*.*.cmd Module.symvers \
+		Module.markers modules.order .tmp_versions
+
+install: default
+	-rmmod $(WLNAME)
+	install -d $(INSTALLDIR)
+	install -m 0644 -o root -g root $(WLNAME).ko $(INSTALLDIR)
+	/sbin/depmod -aq
+
diff --git a/drivers/staging/wlags49_h2/README.ubuntu b/drivers/staging/wlags49_h2/README.ubuntu
new file mode 100644
index 000000000000..47beaec86e4a
--- /dev/null
+++ b/drivers/staging/wlags49_h2/README.ubuntu
@@ -0,0 +1,180 @@
+=======================================================================
+WLAN driver for cards using the HERMES II and HERMES II.5 chipset
+
+HERMES II Card
+
+PCMCIA Info: "Agere Systems" "Wireless PC Card Model 0110"
+             Manufacture ID: 0156,0003
+
+HERMES II.5 Card
+
+PCMCIA Info: "Linksys" "WCF54G_Wireless-G_CompactFlash_Card"
+             Manufacture ID: 0156,0004
+
+Based on Agere Systems Linux LKM Wireless Driver Source Code,
+Version 7.22; complies with Open Source BSD License.
+=======================================================================
+
+DESCRIPTION
+
+The software is a modified version of wl_lkm_722_abg.tar.gz from the
+Agere Systems website, addapted for Ubuntu 9.04.
+
+Modified for kernel 2.6 by Henk de Groot <pe1dnn@amsat.org>
+Based on 7.18 version by Andrey Borzenkov <arvidjaar@mail.ru> $Revision: 39 $
+
+INSTALLATION
+
+Unpack in a new directory.
+
+Open a terminal screen.
+
+Change directory to the source directory
+
+Type command
+
+make
+
+and wait until it is finshed. Now you have build the module
+wlags49_h2_cs; this module is meant for a HERMES II card.
+
+The driver is tested with a Thomson SpeedTouch 110 Wireless PC Card.
+For the test Station mode was used with WEP. The driver is supposed
+to support WAP and as accesspoint that is NOT tested.
+
+If you have a card using the HERMES II.5 chip you have to make
+changes to the Makefile and uncomment -DHERMES25. This will build
+driver wlags49_h25_cs.
+
+Note: You can detemine the type with command "pccardctrl info"
+        MANIFID: 0156,0002 = HERMES - not supported by this driver
+        MANIFID: 0156,0003 = HERMES II   (Wireless B)
+        MANIFID: 0156,0004 = HERMES II.5 (Wireless B/G)
+
+After succesfull compile type command
+
+sudo make install
+
+to install the module.
+
+Now the card should be recognized. It should be able to configure
+and use the card with NetworkManager. Wpa_supplicant also works, as does
+manual configuration using the iwconfig/iwlist programs.
+
+Note: I only tested Station mode with WEP but if I didn't break anything
+WPA and AP mode should also work; note however that WPA was experimental
+in the original Agere driver!
+
+Note: to compile as AP change the makefile and remove the line
+-DSTA_ONLY \
+
+(or comment it, but in that case make sure to move it after all the
+ flags you want to use)
+
+CHANGES
+
+The HCF functions to control the card are virtually unchanged, the only
+changes are meant to fix compiler warnings. The only real change is in
+HCF_WAIT_WHILE which now has a udelay(2) added to give a small delay.
+
+The linux driver files (wl_xxxx.c) are changed in the following ways:
+- Addaptations of Andrey Borzenkov applied to 7.22 source
+- Alterations to avoid most HCF_ASSERTs
+-- Switching interrupts off and on in the HCF
+-- Bugfixes, things that were aparently wrong like reporting link status
+   change which checked a variable that was not changed in HCF anymore.
+-- Used on WEP but setting keys via SIOCSIWENCODEEXT was not supported
+-- Recovery actions added
+
+The major problem was the order in which calls can be made. The original
+looks like a traditonal UNIX driver. To call an "ioctl" function you
+have to "open" the device first to get a handle and after "close" no
+"ioctl" function can be called anymore. With the 2.6 driver this all
+changed; the former ioctl functions are now called before "open" and
+after "close", which was not expected. One of the problems was enable/
+disable of interrupts in the HCF. Interrupt handling starts at "open"
+so if a former "ioctl" routinge is called before "open" or after "close"
+then nothing should be done with interrupt switching in the HCF. Once
+this was solved most HCF_ASSERTS went away.
+
+The last point, recovery actions added, needs some clarification.
+Starting the card works most of the time, but unfortunately not always.
+At a few times recovery code was added; when the card starts to
+misbehave or the communication between the HCF and the card is
+out of sync and the HCF enters DEFUNCT mode everything is reset and
+reinitialized. Note, hcf.c contains a lot of documentation. It takes
+some time but slowly some things become clear. Also some unresolved
+issues are mentioned in hcf.c, so there are still unknown bugs.
+
+The card problems are almost in all cases when starting up and before
+the first association with an AP, once the card is in operation it
+seems to stay that way; when debugging no HCF_ASSERTS appear anymore.
+Note: some HCF_ASSERTS still appear, in a number of cases it is a real
+error, for example at card removal the missing card is detected.
+
+LICENSE
+
+The Agere Systems license applies. This is why I include the original
+README.wlags49. The instructions in that file are bogus now. I also
+include the man page. Eventhough setting parameters on the module
+does not work anymore but it provides some information about all the
+settings.
+
+I have not have personal contact with Agere, but others have. Agere
+agreed to make their software available under the BSD licence.
+This driver is based on the 7.22 version.
+
+The following was mailed by Agere to Andrey Borzenkov about this:
+
+    --- Begin Message ---
+
+        * From: TJ <tj@xxxxxxxxxxx>
+        * Date: Mon, 05 Feb 2007 19:28:59 +0000
+
+    Hi Andrey,
+
+    I've got some good news for you/us/the world of Hermes :)
+
+    I got a reply from the legal representative at Agere confirming that
+    their source-code is BSD licensed, and I've included the contents of the
+    email here.
+
+    I hope this re-assures you so that your excellent work on the drivers
+    can be made widely available for other hackers to work with.
+
+    Regards,
+
+    TJ.
+
+    ---------
+    On Mon, 2007-02-05 at 13:54 -0500, Pathare, Viren M (Viren) wrote:
+
+
+    "I would like to confirm that the two drivers; Linux LKM Wireless Driver
+    Source Code, Version 7.18 and Linux LKM Wireless Driver Source Code,
+    Version 7.22 comply with Open Source BSD License. Therefore the source
+    code can be distributed in unmodified or modified form consistent with
+    the terms of the license.
+
+    The Linux driver architecture was based on two modules, the MSF (Module
+    specific functions) and the HCF (Hardware Control Functions). Included
+    in the HCF is run-time firmware (binary format) which is downloaded into
+    the RAM of the Hermes 1/2/2.5 WMAC.
+
+    This hex coded firmware is not based on any open source software and
+    hence it is not subject to any Open Source License. The firmware was
+    developed by Agere and runs on the DISC processor embedded within the
+    Hermes 1/2/2.5 Wireless MAC devices.
+
+    Hope this helps.
+
+    Sincerely,
+
+    Viren Pathare
+    Intellectual Property Licensing Manager
+    Agere"
+
+
+
+    --- End Message ---
+
diff --git a/drivers/staging/wlags49_h2/README.wlags49 b/drivers/staging/wlags49_h2/README.wlags49
new file mode 100644
index 000000000000..7586fd09adc9
--- /dev/null
+++ b/drivers/staging/wlags49_h2/README.wlags49
@@ -0,0 +1,641 @@
+==============================================================================
+Agere Systems Inc.                                                   July 2004
+Readme for Linux Driver Source for Wavelan                   Version: 7.22-abg
+==============================================================================
+
+This text file includes update information, installation instructions,
+limitations to the current version of the product, and suggestions to solve
+known issues or problems.
+
+
+TABLE OF CONTENTS.
+
+1.  DESCRIPTION
+2.  SYSTEM REQUIREMENTS
+3.  NEW IN THIS RELEASE
+4.  INSTALLATION NOTES
+5.  TECHNICAL CONSTRAINTS
+6.  KNOWN ISSUES
+7.  TECHNICAL SUPPORT
+
+------------------------------------------------------------------------------
+1.  DESCRIPTION
+
+    With this package, you can build and install a Wireless driver for a
+    specific Linux kernel.
+
+    The driver in this package supports the network interface cards based on:
+     - WL60010, a.k.a. Hermes-II
+     - WL60040, a.k.a. Hermes-II.5
+
+    Although derived from the Hermes-I/II Linux driver, this release ONLY
+    Supports Hermes-II/II.5 chipsets.  Hermes-I is no longer supported.
+
+    The software is distributed in a compressed source file archive:
+     - wl_lkm_7_22_abg.tar.gz
+
+    Because this release supports more than one Hermes CPU and bus
+    architecture, a naming convention is used for the resulting binaries that
+    can be built from this source code. Driver binaries are named as follows:
+
+    wlags49_<hermes_type>_<bus_arch>.o
+
+    where 'wlags49' denotes an Agere WaveLan Linux build,
+
+    <hermes_type> is: 'h2' for Hermes-II, 'h25' for Hermes-II.5
+
+    <bus_arch> is: 'cs' for Card Services (PCMCIA, Compact Flash), PCI for
+    PCI or MiniPCI.
+
+    For example, a driver built for Hermes-II Card Services (PCMCIA/Compact
+    Flash) is named wlags49_h2_cs.o, whereas a driver built for Hermes-II
+    MiniPCI is named wlags49_h2_pci.o.
+    The following software is included with this distribution:
+
+    General information:
+    * README.wlags49              This file
+    * LICENSE.wlags49             License
+    * wlags49.mk                  Top level Makefile
+    * Build                       Script to build driver
+    * Install                     Script to install driver
+
+    Driver source:
+    * wireless/                   MSF source
+    * hcf/                        HCF and F/W source
+    * wireless/wlags49_cs.mk      Driver Makefile, PC Card
+    * wireless/wlags49_pci.mk     Driver Makefile, PCI
+    * include/hcf/debug.h         Driver debug support
+    * include/hcf/hcfcfg.h        Header to configure HCF
+    * include/wireless/*.h        Driver source headers
+
+    Driver online manual page:
+    * man/wlags49.4               Driver manual page
+
+    PCMCIA configuration update:
+    * etc/wlags49.conf            Add-on config file
+    * etc/wlags49.mk              config update Makefile
+    * etc/wlags49.patch           config update patch file
+
+    The driver is build up of 2 modules:
+     - a higher module called Module Specific Functions (MSF), which contains
+       the functions of the driver that are network driver interface and
+       Operating System specific.
+     - a lower module called Hardware Control Functions (HCF), which contains
+       the functions to interface to the Network Interface Card (NIC).  The HCF
+       provides for all WaveLAN NIC types one standard interface to the MSF.
+       This I/F is called the Wireless Connection Interface (WCI) and is the
+       subject of a seperate document (025726).
+
+    The HCF directory contains firmware images to allow the card to operate in
+    either station (STA) or Access Point (AP) mode. In the build process, the
+    files fw_h2.c and fw_h25.c are used for Hermes-II and Hermes-II.5
+    respectively. The firmware images in this release are identified as:
+	 - HII Station F/W:      fw_h2.c.sta
+	 - HII.5 Station F/W:    fw_h25.c.sta
+	 - HII AccesPoint F/W:   fw_h2.c.ap
+	 - HII.5 AccesPoint F/W: fw_h25.c.ap
+	To build a STA or AP mode driver, the suffix .sta or .ap must be removed.
+	The files as distributed by this release build STA drivers by default.
+
+------------------------------------------------------------------------------
+2.  SYSTEM REQUIREMENTS
+
+2.1 Operating System
+
+    This software can be compiled and installed with Linux kernel versions
+    2.4.x. Although this driver should compile for other CPUs as well, as of
+    the date of this release, no CPU architectures other than x86 have been
+    verified.
+
+    wl_lkm_7_22_abg is tested with the following Linux Distributions:
+    * Red Hat version 9.0
+    * Suse    version 9.0
+
+    If you're building for PC Card or Compact Flash, you need the Card Services
+    from David Hinds.
+
+    wl_lkm_7_22_abg is tested with:
+    * pcmcia-cs-3.2.7.tar.gz
+
+2.2 Free Disk Space
+
+    To compile the software you need to have the full set of Linux kernel
+    source files installed, as well as a sane build environment which includes
+    all tools necessary for compiling and linking code. Depending on the exact
+    version of the kernel, you need approximately 150 MB of free disk space.
+    Once compiled, the driver uses about 150-200 KB.  Please note, this size is
+    approximate and can vary depending on which version of the driver is built.
+    In addition, adding debug tracing support increases this size.
+
+------------------------------------------------------------------------------
+3.  NEW IN THIS RELEASE
+
+Version 7.22 abg - July 28, 2004
+
+------------------------------------------------------------------------------
+4.  INSTALLATION NOTES
+
+    The driver files for the Linux driver are not "ready" for direct
+    installation onto any Linux computer.  To build and install the driver you
+    need some expertise on the Linux operating system in general and the type
+    and version installed of the kernel installed on your computer.  With this
+    knowledge you can use the driver source files provided to build your own
+    Linux driver for your specific computer and kernel.
+
+4.1 Before you start
+
+    1) Determine the type and version of the Linux kernel of your computer and
+    check whether it meets the system requirements listed in section 2 of this
+    README.
+
+    2) If you're building for PC Card or Compact Flash, read the Linux
+    PCMCIA-HOWTO by David Hinds. This document is probably provided on the
+    CD-ROM of your Linux distribution. You can download the latest version
+    from:
+
+        http://pcmcia-cs.sourceforge.net
+
+   Please read the section titled "Prerequisites and kernel setup" of the
+   PCMCIA-HOWTO.
+
+4.2 Build the driver for PC Card / Compact Flash
+
+    1) Obtain a copy of the Linux PCMCIA package from a CD-ROM of your Linux
+    distribution or download the latest version.
+    For your convenience, the Agere Systems Wireless CD-ROM contains a copy of
+    the PCMCIA package in sub-directory: Xtras/Linux/PCMCIA
+
+    2) To unpack the Linux PCMCIA package, copy it to the current working
+    directory and type:
+       % tar xzvf pcmcia-cs-x.y.z.tar.gz
+       % mv pcmcia-cs-x.y.z pcmcia-cs
+
+    Note: If you use the archive supplied on the CDROM, use archive name
+    "pc3_2_1.tgz" instead of "pcmcia-cs-3.2.7.tar.gz".
+
+    Note: even though PCMCIA code exists in the kernel source tree, the PCMCIA
+    Card Services package needs to be unpacked locally to build drivers based
+    on it.
+
+    3) Extract the wlags49 distribution archive on top of the Linux PCMCIA
+    package.
+       % cd pcmcia-cs
+       % tar xzvf ../wl_lkm_7_22_abg.tar.gz
+
+    4) To build and install the driver, follow the procedure below:
+       % ./Configure
+
+    Answer the presented questions. Usually the default answers are OK and
+    pressing "Enter" is enough.
+    On newer RedHat systems, however, you should specify "/usr/src/linux-2.4"
+    as the Linux source directory instead of the default "/usr/src/linux".
+
+    For more detailed information on configuration, building and installing,
+    see the PCMCIA-HOWTO.
+
+    To build the default drivers, which support Hermes-II in station mode, run
+    the Build script:
+       % ./Build
+
+    This script determines whether your system uses in-kernel PCMCIA and either
+    builds the full PCMCIA package or just the driver.
+
+    Before installing the driver with the Install script, you must become
+    'root':
+       % su
+       ..
+       % ./Install
+
+    This script determines whether your system uses in-kernel PCMCIA and either
+    installs the full PCMCIA package or just the driver.
+
+    5) If it becomes necessary to clean the build, issue the following
+    commands:
+       % make clean
+       % make -C lib clean
+
+4.3 Build the driver for PCI
+
+    1) Extract the wlags49 to the current working directory.
+       % tar xzvf wl_lkm_7_22.tar.gz
+
+    Note: there is no need to unpack the driver source into a PCMCIA build
+    directory.
+
+    2) To build the PCI driver:
+       % make -f wlags49.mk wlags49_h2_pci
+       or
+       % make -f wlags49.mk wlags49_h25_pci
+
+    3) Install the driver.
+       % insmod ./wireless/wlags49_h25.o
+
+    4) If it becomes necessary to clean the build.
+       % make -f wlags49.mk pci_clean
+
+4.4 Configure your Wireless PC Card
+
+    There are 3 ways to configure the driver
+    - module parameters (/etc/pcmcia/config.opts)
+    - wireless extension (/etc/pcmcia/wireless.opts)
+    - Agere configuration file (/etc/agere/iwconfig-eth#)
+
+
+4.4.1 Configure through /etc/pcmcia/config.opts
+
+    To use this method, make sure that /etc/pcmcia/wireless.opts file is either
+    absent or contains blank parameter values as shown below.
+
+    *,*,*,00:60:1D:*|*,*,*,00:02:2D:*)
+        INFO=""
+        ESSID=""
+        MODE=""
+        KEY=""
+    ;;
+
+    1) To configure the Wireless PC Card, please refer to:
+       * The online manual page (wlags49.4)
+         % man wlags49
+       * The network adapter sections of the PCMCIA documentation.
+         % more PCMCIA-HOWTO
+
+    2) Use an editor to configure the module parameters:
+       # vi /etc/pcmcia/config.opts
+
+       a) To connect your computer to a wireless infrastructure that includes
+       access points such as the AP-1000 or AP-500, you need to identify the
+       network name of the wireless infrastructure.
+
+       For example if your infrastructure uses the network name "My Network",
+       edit the config.opts file to include the following:
+
+       module "<driver_name>" opts "network_name=My\ Network"
+
+       Notice that the space character needs to be escaped with a backslash.
+
+       b) To connect your computer to a Residential Gateway RG-1000, you need
+       to know the RG ID (=network_name) and the encryption key.  You can find
+       the RG ID on a small label on the rear of the unit.
+
+       For example if your RG-1000 has ID 225ccf and you did not change the
+       encryption key yet, edit the config.opts file to include the following:
+
+       module "<driver_name>" opts "network_name=\"225ccf\" key_1=\"25ccf\"
+       enable_encryption=Y"
+
+       If you changed your encryption key, you should specify this key as key_1
+       on the parameter line.
+
+       c) To connect your computer to a peer-to-peer network, in an environment
+       without access points, the IBSS mode is recommended.
+
+       For example to connect to a peer-to-peer network called "My Network",
+       enter the following in the config.opts file:
+
+       module "<driver_name>" opts "create_ibss=Y network_name=My\ Network"
+
+       d) Optionally you can also include a "Station Name" value that can be
+       used to indentify your computer on the wireless network.
+
+       For example if you wish to name your computer "Wave1" when connecting it
+       to a wireless infrastructure,  edit the config.opts file to include the
+       following:
+
+       module "<driver_name>" opts "network_name=Ocean station_name=Wave1"
+
+       e) To connect your computer to an Ad-Hoc workgroup of wireless
+       computers, enter the following in the config.opts file:
+
+       module "<driver_name>" opts "port_type=3"
+
+       Note that the "Ad-Hoc Demo Mode" is not the recommended mode for a
+       peer-to-peer network.  The configuration of this  non-interoperable mode
+       is only explained here for special applications (e.g. research, or
+       compatibility with other / previous WaveLAN/IEEE products).
+
+       The IBSS mode described in c) is the preferred and interoperable mode
+       for creating a peer-to-peer network.
+
+    3) Use an editor to modify the network options for your adapter.
+       # vi /etc/pcmcia/network.opts
+
+       The parameters need to be correct for the connected network. Check with
+       your system administrator for the correct network information.  Refer to
+       the PCMCIA-HOWTO for more configuration information.
+
+       For example:
+            *,*,*,*)
+                IF_PORT=""
+                BOOTP="n"
+                IPADDR="10.0.0.5"
+                NETMASK="255.255.255.0"
+                NETWORK="10.0.0.0"
+                BROADCAST="10.0.0.255"
+                GATEWAY="10.0.0.1"
+                DOMAIN="domain.org"
+                DNS_1="dns1.domain.org"
+                ;;
+
+       RedHat and Suse do not use the network.opts to configure the driver.
+       Instead RedHat uses a GUI-based tool called 'neat' ('net.cfg' in older
+       versions) and SuSE Linux uses 'YaST'. These tools creates scripts, like
+       ifcfg-eth0, in the directory /etc/sysconfig/network-scripts. Using the
+       default GNOME menu, you can start netcfg from: Programs->System->Network
+       Configuration.
+
+    4) Restart the PCMCIA services.
+       # /etc/rc.d/rc.pcmcia restart
+         or
+       # /etc/rc.d/init.d/pcmcia restart
+
+
+    For a more detailed description about the various configuration options and
+    definitions, please consult the Wireless documentation.
+
+4.4.2 Configure through /etc/pcmcia/wireless.opts
+
+    This driver has support for the "Wireless Extensions".  This interface
+    allows the "Wireless Tools" to get statistics from the driver and allows to
+    change the configuration of the driver on the fly.
+
+    The latest versions of the PCMCIA package contain scripts that use the
+    wireless extension to configure the driver as an alternative to the
+    configuration through module parameters as described in section 4.4.1.
+    Read the /etc/pcmcia/wireless.opts file for the theory of operation.  When
+    the driver is configured, go to section 4.4.1 step 3 to configure the
+    network parameters.
+
+    For more information, refer to the following WEB pages:
+    http://www.hpl.hp.com/personal/Jean_Tourrilhes/Linux/Linux.Wireless.Extensions.html
+    http://www.hpl.hp.com/personal/Jean_Tourrilhes/Linux/Tools.html
+
+4.4.3 Configure through /etc/agere/iwconfig-eth#
+
+    In addition to using either the module options or the wireless extensions
+    methods to configure a wireless device, this version of the software also
+    supports an Agere specific implementation. This was done because:
+    * Module options configures multiple devices the same.
+    * Wireless extensions parameters do not cover all of the available options
+      in the driver.
+
+    For each wireless ethernet device (identified by eth<n>, where n is a
+    positive integer), a file /etc/agere/iwconfig-eth<n> can be created which
+    contains configuration information for a wireless device. For example, the
+    file /etc/agere/iwconfig-eth1 is the config file for eth1. This file should
+    contain Key/Value pairs in the format:
+
+    <Key>=<Value>
+
+    where <Key> is the parameter to configure and <Value> is the value to
+    assign it. For example, if the config file /etc/agere/iwconfig-eth1
+    described above contains the following:
+
+    DesiredSSID=some_network
+    EnableEncryption=Y
+    Key1=net01
+    TxKey=1
+
+    this configures eth1 to associate to the ESSID 'some_network' with
+    encryption on, where the the first encryption key is 'net01' and the key to
+    use for encryption is Key 1.
+
+    Note that this only works on Agere hardware which uses this driver. For
+    other wireless drivers, or non-wireless devices, this file can be present,
+    but has no effect.
+
+    Please refer to the man page for more information on this configuration
+    file and the parameters that can be set.
+
+
+4.5 Configuring your Wireless PCI card
+
+    Note that the above method of configuring the card using
+    /etc/pcmcia/config.opts is only valid for PCMCIA/CF cards. For [mini]PCI
+    and CardBus cards, refer to your system's documentation on modules.conf to
+    load the driver with the proper options for a given wireless ethernet
+    interface. In addition, network configuration tools like 'netcfg', 'neat',
+    or 'YaST' (see Section 4.4.1, Step 3) can be used to configure the miniPCI
+    card. Lastly, the Agere configuration file described in Section 4.4.3 may
+    also be used for [mini]PCI and CardBus devices.
+
+4.6 Troubleshooting
+
+    When the Wireless PC Card is inserted, the card manager emit beeps in
+    different tones to indicate success or failure of particular configuration
+    steps.
+      a) Two high beeps
+         - The card was identified and configured successfully.
+      b) One high beep followed by a low beep
+         - The card was identified, but could not be configured.
+         - Examine the system log (dmesg) for PCMCIA error or warning messages.
+      c) One low beep
+         - The card could not be identified.
+         - Execute "cardctl ident" to display the adapter PnP information.
+           Verify the PnP information matches an entry in the PCMCIA
+           configuration file (/etc/pcmcia/config).
+         - Examine the system log (dmesg) for PCMCIA error or warning messages.
+
+    The Wireless PC Card has two LEDs that indicate the state of the adapter
+    and network.
+      * Power LED (toward the middle of the adapter)
+    	- This LED indicates power has been applied, and the card is
+    	  functional. In normal operation mode with Card Power Management
+    	  disabled, it is steady-on. With Card Power Management enabled, it
+    	  blinks rapidly (several times per second).
+      * Transmit/Receive LED (closer to the edge of the adapter)
+        - This LED flashes when it detects transmit or receive packets.
+
+      * Both LEDs blink at the same time every 10 seconds.
+    	- The adapter was unable to make contact with the named wireless
+    	  network. Verify the network_name, in the config.opts file matches the
+    	  network name of the access point.
+      * LEDs indicate normal operation with the Power LED
+    	steady-on or blinking rapidly and Transmit/Receive LED flashing, but no
+    	traffic.
+    	- If the network is operating in normal mode (ie.  port_type = 0 or not
+    	  specified), and a network_name has been specified, verify the
+    	  workstation network parameters (ifconfig, route, etc.) are correct
+    	  for the wireless network.
+    	- If the network is operating in Ad-Hoc (peer-to-peer) mode (ie.
+    	  port_type = 3), the adapter needs another workstation/adapter to
+    	  communicate with.  Verify the network parameters on both of the
+    	  workstations (ifconfig, route, etc.) are correct.
+
+    Refer to the online manual page for additional configuration, feature and
+    support information.
+       % man wlags49
+         or
+       % man 4 wlags49
+         or
+       % nroff -man wlags49.4 | more
+
+4.7 Identifying the software
+
+    This section explains how to identify the version of this software once it
+    is unpacked or installed.
+
+    The Linux Driver Source/Library distribution consist of two main
+    components, the driver source and the HCF module.
+
+    * To quickly identify the version of the source, type:
+      % grep DRV.*VERSION include/wireless/wl_version.h
+      #define DRV_MAJOR_VERSION   7
+      #define DRV_MINOR_VERSION   22
+
+    * To identify the revision of the HCF library contained in the driver,
+      type:
+      % grep HCF.Revision hcf/hcf.c
+      #define HCF_VERSION  TEXT( "HCF$Revision: 1.8 $" )
+
+    To identify a compiled wlags49 driver, go to the directory where the driver
+    is located. Card Services drivers (wlags49_h2_cs.o and wlags49_h25_cs.o)
+    are located in:
+    /lib/modules/<kernel-version>/pcmcia
+
+    PCI drivers (wlags49_h2.o) are located in:
+    /lib/modules/<kernel-version>/kernel/drivers/net
+
+    * To retrieve the version of the source used to compile the driver, type:
+      % strings <driver_name>.o | grep Agere
+      <driver_name> v7.22-abg-Beta for PCMCIA
+      <driver_name> v7.22-abg-Beta for PCI
+
+    * Likewise, to retrieve the revision of the HCF used to compile the driver,
+      type:
+      % strings <driver_name>.o | grep Revision
+      HCF$Revision: 5.15
+
+    At startup the wlags49 driver reports its version in the system log file
+    (/var/log/messages).
+
+------------------------------------------------------------------------------
+5.  TECHNICAL CONSTRAINTS
+
+    At the time of release of this software, the following constraints are
+    identified:
+
+5.1 Using the ISA adapter
+
+    Description: To allow operation in desktop computers Agere also provides an
+    optional ISA bus to PC Card adapter (also referred to as "swapbox").
+
+    This ISA Adapter can be configured for two different I/O Address values:
+      * 3E2 (factory-set default)
+      * 3E0
+
+    Impact: By default the i82365 module of the Linux pcmcia package only
+    probes at 3E0.
+
+    Actions:
+    1) Read the manual page on the probing of the i82365 module, by typing the
+    command:
+        man i82365
+
+    2) Apply one of the two following options:
+       a) Change the I/O address strapping of the ISA adapter by replacing the
+          jumper on the ISA adapter.  The correct jumper setting is pictured in
+          the electronic "Wireless ISA Adapter, Getting Started Guide" provided
+          on the Wireless Software CD-ROM. This guide is provided in Adobe's
+          Acrobat PDF format.
+
+       b) Alternatively, you can load the i82365 module with the
+          "extra_sockets" parameter set to 1.
+
+          On a RedHat 5.x thru 7.x, system, put this in the file
+          "/etc/sysconfig/pcmcia":
+             PCMCIA=yes
+             PCIC=i82365
+             PCIC_OPTS="extra_sockets=1"
+             CORE_OPTS=
+             CARDMGR_OPTS=
+
+          For other Linux distributions, you are advised to consult the
+          "PCMCIA-HOWTO" notes for information about changing the I/O Address
+          probing.
+
+5.2 Using the PCI Adapter
+
+    Description: To allow operation in desktop computers Agere also provides an
+    optional PCI bus to PC Card adapter (also referred to as "swapbox").
+
+    For correct interrupt assignment, the system should support PCIBIOS 2.2.
+    It is recommended to use PCMCIA package version 3.2.7 or higher.
+
+    The default configuration of the interrupt routing method of the PCI
+    Adapter's TI CardBus Controller is incorrect.
+
+    Actions:
+    1) Read the manual page on the "Options specific for TI CardBus
+    Controllers" of the i82365 module, by typing the command:
+        man i82365
+
+    2) Load the i82365 module with the "irq_mode" parameter set to 0.
+       On a RedHat 5.x thru 7.x system, put this in the file
+       "/etc/sysconfig/pcmcia":
+           PCMCIA=yes
+           PCIC=i82365
+           PCIC_OPTS="irq_mode=0"
+           CORE_OPTS=
+           CARDMGR_OPTS=
+
+   For the location of the PCMCIA scripts on other Linux distributions, you
+   are advised to consult the "PCMCIA-HOWTO", "Notes about specific Linux
+   distributions".
+
+------------------------------------------------------------------------------
+6.  KNOWN ISSUES
+
+    This is the current list of known issues for this release, and will be
+    addressed in the near future:
+
+    1. This driver release contains a version of Hermes-II.5 firmware which
+    REQUIRES calibrated cards. If there is no calibration data present in the
+    PDA of the hardware, the firmware does not operate.
+
+    2. WDS is not yet supported.
+
+    3. DMA is not yet supported.
+
+    4. WPA is not yet supported.
+
+    5. 32-bits I/O is not yet supported.
+
+    6. The current Build script also builds the PCI drivers.
+
+    7. The current Install script also copies the PCI drivers to the lib
+    directory.
+
+	8. If F/W files are required from outside this release, the entry points
+	inside these F/W files have to be renamed from "ap" and "station" to
+	"fw_image" and they have to be renamed to fw_h2.c and fw_h25.c for
+	Hermes-II and Hermes-II.5.
+
+------------------------------------------------------------------------------
+7.  TECHNICAL SUPPORT
+
+7.1 Finding Information
+
+    On the Agere Systems Web Site you can find the most recent device drivers,
+    software updates and user documentation.
+
+    World Wide Web:    http://www.agere.com
+
+7.2 Contact Technical Support
+
+    If you encounter problems when installing or using this product, or would
+    like information about our other "Wireless" products, please contact your
+    local Authorized "Wireless" Reseller or Agere Systems sales office.
+
+    Addresses and telephone numbers of the Agere Systems sales offices are
+    listed on our Agere Systems web site.
+
+    When contacting Technical Support, please use the Problem Report Form and
+    send it to us by Fax or E-Mail.  The Problem Report Form 'REPORT.TXT'
+    (Plain text format) is included on the disk. Alternatively, you can
+    download the Problem Report Form from the Agere Systems web site.
+
+    Include Product Name, Serial Number and software version number with each
+    request to help the Support Group helping you.
+
+==============================================================================
+                          END OF FILE
diff --git a/drivers/staging/wlags49_h2/TODO b/drivers/staging/wlags49_h2/TODO
new file mode 100644
index 000000000000..14aa415b1a82
--- /dev/null
+++ b/drivers/staging/wlags49_h2/TODO
@@ -0,0 +1,33 @@
+First of all, the best thing would be that this driver becomes obsolte by
+adding support for Hermes II and Hermes II.5 cards to the existing orinoco
+driver. The orinoco driver currently only supports Hermes I based cards.
+Since this will not happen by magic and has not happend until now this
+driver provides a stop-gap solution for these type of cards.
+
+Having said that, the following wishlist comes to mind to make the driver
+suitable as fully supported kernel driver. Feel free to expand/enhance the
+list.
+
+TODO:
+	- verify against a Hermes II.5 card
+	- verify with WPA encription (both with H2 and H2.5 cards)
+	- sometimes the card does not initialize correctly, retry mechanisms
+	  are build in to catch most cases but not all
+	- once the driver runs it is very stable, but I have the impression
+	  some the crittical sections take to long
+	- the driver is split into a Hermes II and a Hermes II.5 part, it
+	  would be nice to handle both with one module instead of two
+	- review by the wireless developer community
+	- verify the code against the coding standards for a propper linux
+	  driver
+	- resolve license issues (?)
+
+DONE:
+	- verified against a Hermes II card (Thomson Speedtouch 110 PCMCIA
+	  card)
+	- verified with WEP encription
+
+Please send any patches or complaints about this driver to Greg
+Kroah-Hartman <greg@kroah.com> and Cc: Henk de Groot <pe1dnn@amsat.org>
+Don't bother the upstream wireless kernel developers about it, they
+want nothing to do with it.
diff --git a/drivers/staging/wlags49_h2/WARNING.txt b/drivers/staging/wlags49_h2/WARNING.txt
new file mode 100644
index 000000000000..5d12973ba19c
--- /dev/null
+++ b/drivers/staging/wlags49_h2/WARNING.txt
@@ -0,0 +1,3 @@
+These sources are shared with the wlags49_h25 driver. Some files are even
+exclusively used by that driver. Do not delete them here without looking
+at that other driver.
diff --git a/drivers/staging/wlags49_h2/ap_h2.c b/drivers/staging/wlags49_h2/ap_h2.c
new file mode 100644
index 000000000000..f5123d2cb4c1
--- /dev/null
+++ b/drivers/staging/wlags49_h2/ap_h2.c
@@ -0,0 +1,3337 @@
+/*
+ * File:	ap_h24.236
+ *
+ * Abstract:	This file contains memory image 'fw_image'.
+ *
+ * Contents:	Total size of the memory image: 51010 bytes.
+ *		Total number of blocks: 4 blocks.
+ *		Block  1 : load address 00000060, 326 bytes.
+ *		Block  2 : load address 00000C16, 6424 bytes.
+ *		Block  3 : load address 001E252E, 444 bytes.
+ *		Block  4 : load address 001F4000, 43816 bytes.
+ *
+ * Identity:	component id: 32 (variant 2) version 2.36
+ *
+ * Compatibility:
+ *		supplying interface 8 (variant 2) : 2 - 4
+ *		acting on interface 1 (variant 4) : 6 - 7
+ *		acting on interface 1 (variant 5) : 6 - 7
+ *		acting on interface 1 (variant 6) : 6 - 7
+ *		acting on interface 2 (variant 2) : 1 - 2
+ *
+ * Generated:	by g:\fw\fupu3.exe version 4.26
+ *
+ * Commandline:	g:\fw\fupu3.exe /f=4 /n=fw_image /i=t2023600.hex
+ */
+
+
+#include "hcfcfg.h"				// to get hcf_16 etc defined as well as
+                                // possible settings which inluence mdd.h or dhf.h
+#include "mdd.h"   				//to get COMP_ID_STA etc defined
+#include "dhf.h"   				//used to be "fhfmem.h", to get memblock,plugrecord,
+
+static const hcf_8 fw_image_1_data[] = {
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1C, 0x0D, 0x00, 0x00,
+	 0x3A, 0x0C, 0x00, 0x00, 0x3A, 0x0C, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x1B, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0A, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x02, 0x00, 0x02, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC8, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0A, 0x00,
+	 0x0A, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0xEA, 0x00, 0x00, 0xFF, 0x07, 0x02, 0x00, 0x64, 0x00, 0x64, 0x00, 0x10, 0x27, 0x10, 0x27,
+	 0x14, 0x00, 0xD0, 0x07, 0xD0, 0x07, 0x10, 0x27, 0x2F, 0x00, 0x32, 0x00, 0x32, 0x00, 0x05, 0x00,
+	 0x02, 0x00, 0x02, 0x00, 0x10, 0x27, 0x05, 0x00, 0x00, 0x02, 0x00, 0x02, 0x13, 0x00, 0x0A, 0x00,
+	 0x07, 0x00, 0x03, 0x00, 0x32, 0x00, 0x00, 0x00, 0x00, 0x00, 0x2A, 0x09, 0x2B, 0x09, 0x2B, 0x09,
+	 0x03, 0x00, 0x00, 0x00, 0x00, 0x6E, 0x00, 0x14, 0x01, 0x00, 0x40, 0x00, 0x32, 0x00, 0x32, 0x00,
+	 0x0A, 0x00, 0x02, 0x00, 0x06, 0x00, 0x01, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x01, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+
+};  /* fw_image_1_data */
+
+static const hcf_8 fw_image_2_data[] = {
+	 0x9B, 0xA7, 0x00, 0x0A, 0x10, 0x01, 0x68, 0xA4, 0xB0, 0x01, 0x84, 0x01, 0x30, 0x33, 0x31, 0x33,
+	 0x44, 0x44, 0x30, 0x33, 0x31, 0x33, 0x30, 0x33, 0x31, 0x33, 0x32, 0x33, 0x32, 0x33, 0x90, 0x00,
+	 0x78, 0x04, 0xAE, 0xE4, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B,
+	 0x0C, 0x0D, 0x0E, 0x0F, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xA5, 0xC6, 0x84, 0xF8, 0x99, 0xEE,
+	 0x8D, 0xF6, 0x0D, 0xFF, 0xBD, 0xD6, 0xB1, 0xDE, 0x54, 0x91, 0x50, 0x60, 0x03, 0x02, 0xA9, 0xCE,
+	 0x7D, 0x56, 0x19, 0xE7, 0x62, 0xB5, 0xE6, 0x4D, 0x9A, 0xEC, 0x45, 0x8F, 0x9D, 0x1F, 0x40, 0x89,
+	 0x87, 0xFA, 0x15, 0xEF, 0xEB, 0xB2, 0xC9, 0x8E, 0x0B, 0xFB, 0xEC, 0x41, 0x67, 0xB3, 0xFD, 0x5F,
+	 0xEA, 0x45, 0xBF, 0x23, 0xF7, 0x53, 0x96, 0xE4, 0x5B, 0x9B, 0xC2, 0x75, 0x1C, 0xE1, 0xAE, 0x3D,
+	 0x6A, 0x4C, 0x5A, 0x6C, 0x41, 0x7E, 0x02, 0xF5, 0x4F, 0x83, 0x5C, 0x68, 0xF4, 0x51, 0x34, 0xD1,
+	 0x08, 0xF9, 0x93, 0xE2, 0x73, 0xAB, 0x53, 0x62, 0x3F, 0x2A, 0x0C, 0x08, 0x52, 0x95, 0x65, 0x46,
+	 0x5E, 0x9D, 0x28, 0x30, 0xA1, 0x37, 0x0F, 0x0A, 0xB5, 0x2F, 0x09, 0x0E, 0x36, 0x24, 0x9B, 0x1B,
+	 0x3D, 0xDF, 0x26, 0xCD, 0x69, 0x4E, 0xCD, 0x7F, 0x9F, 0xEA, 0x1B, 0x12, 0x9E, 0x1D, 0x74, 0x58,
+	 0x2E, 0x34, 0x2D, 0x36, 0xB2, 0xDC, 0xEE, 0xB4, 0xFB, 0x5B, 0xF6, 0xA4, 0x4D, 0x76, 0x61, 0xB7,
+	 0xCE, 0x7D, 0x7B, 0x52, 0x3E, 0xDD, 0x71, 0x5E, 0x97, 0x13, 0xF5, 0xA6, 0x68, 0xB9, 0x00, 0x00,
+	 0x2C, 0xC1, 0x60, 0x40, 0x1F, 0xE3, 0xC8, 0x79, 0xED, 0xB6, 0xBE, 0xD4, 0x46, 0x8D, 0xD9, 0x67,
+	 0x4B, 0x72, 0xDE, 0x94, 0xD4, 0x98, 0xE8, 0xB0, 0x4A, 0x85, 0x6B, 0xBB, 0x2A, 0xC5, 0xE5, 0x4F,
+	 0x16, 0xED, 0xC5, 0x86, 0xD7, 0x9A, 0x55, 0x66, 0x94, 0x11, 0xCF, 0x8A, 0x10, 0xE9, 0x06, 0x04,
+	 0x81, 0xFE, 0xF0, 0xA0, 0x44, 0x78, 0xBA, 0x25, 0xE3, 0x4B, 0xF3, 0xA2, 0xFE, 0x5D, 0xC0, 0x80,
+	 0x8A, 0x05, 0xAD, 0x3F, 0xBC, 0x21, 0x48, 0x70, 0x04, 0xF1, 0xDF, 0x63, 0xC1, 0x77, 0x75, 0xAF,
+	 0x63, 0x42, 0x30, 0x20, 0x1A, 0xE5, 0x0E, 0xFD, 0x6D, 0xBF, 0x4C, 0x81, 0x14, 0x18, 0x35, 0x26,
+	 0x2F, 0xC3, 0xE1, 0xBE, 0xA2, 0x35, 0xCC, 0x88, 0x39, 0x2E, 0x57, 0x93, 0xF2, 0x55, 0x82, 0xFC,
+	 0x47, 0x7A, 0xAC, 0xC8, 0xE7, 0xBA, 0x2B, 0x32, 0x95, 0xE6, 0xA0, 0xC0, 0x98, 0x19, 0xD1, 0x9E,
+	 0x7F, 0xA3, 0x66, 0x44, 0x7E, 0x54, 0xAB, 0x3B, 0x83, 0x0B, 0xCA, 0x8C, 0x29, 0xC7, 0xD3, 0x6B,
+	 0x3C, 0x28, 0x79, 0xA7, 0xE2, 0xBC, 0x1D, 0x16, 0x76, 0xAD, 0x3B, 0xDB, 0x56, 0x64, 0x4E, 0x74,
+	 0x1E, 0x14, 0xDB, 0x92, 0x0A, 0x0C, 0x6C, 0x48, 0xE4, 0xB8, 0x5D, 0x9F, 0x6E, 0xBD, 0xEF, 0x43,
+	 0xA6, 0xC4, 0xA8, 0x39, 0xA4, 0x31, 0x37, 0xD3, 0x8B, 0xF2, 0x32, 0xD5, 0x43, 0x8B, 0x59, 0x6E,
+	 0xB7, 0xDA, 0x8C, 0x01, 0x64, 0xB1, 0xD2, 0x9C, 0xE0, 0x49, 0xB4, 0xD8, 0xFA, 0xAC, 0x07, 0xF3,
+	 0x25, 0xCF, 0xAF, 0xCA, 0x8E, 0xF4, 0xE9, 0x47, 0x18, 0x10, 0xD5, 0x6F, 0x88, 0xF0, 0x6F, 0x4A,
+	 0x72, 0x5C, 0x24, 0x38, 0xF1, 0x57, 0xC7, 0x73, 0x51, 0x97, 0x23, 0xCB, 0x7C, 0xA1, 0x9C, 0xE8,
+	 0x21, 0x3E, 0xDD, 0x96, 0xDC, 0x61, 0x86, 0x0D, 0x85, 0x0F, 0x90, 0xE0, 0x42, 0x7C, 0xC4, 0x71,
+	 0xAA, 0xCC, 0xD8, 0x90, 0x05, 0x06, 0x01, 0xF7, 0x12, 0x1C, 0xA3, 0xC2, 0x5F, 0x6A, 0xF9, 0xAE,
+	 0xD0, 0x69, 0x91, 0x17, 0x58, 0x99, 0x27, 0x3A, 0xB9, 0x27, 0x38, 0xD9, 0x13, 0xEB, 0xB3, 0x2B,
+	 0x33, 0x22, 0xBB, 0xD2, 0x70, 0xA9, 0x89, 0x07, 0xA7, 0x33, 0xB6, 0x2D, 0x22, 0x3C, 0x92, 0x15,
+	 0x20, 0xC9, 0x49, 0x87, 0xFF, 0xAA, 0x78, 0x50, 0x7A, 0xA5, 0x8F, 0x03, 0xF8, 0x59, 0x80, 0x09,
+	 0x17, 0x1A, 0xDA, 0x65, 0x31, 0xD7, 0xC6, 0x84, 0xB8, 0xD0, 0xC3, 0x82, 0xB0, 0x29, 0x77, 0x5A,
+	 0x11, 0x1E, 0xCB, 0x7B, 0xFC, 0xA8, 0xD6, 0x6D, 0x3A, 0x2C, 0x00, 0x30, 0x00, 0x31, 0x00, 0x33,
+	 0x00, 0x34, 0x00, 0x35, 0x00, 0x36, 0x00, 0x37, 0x00, 0x38, 0x00, 0x38, 0x00, 0x3A, 0x00, 0x3B,
+	 0x00, 0x3C, 0x00, 0x3D, 0x00, 0x3E, 0x00, 0x3F, 0x00, 0x3F, 0x09, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x0A, 0x02, 0x14,
+	 0x05, 0x32, 0x0B, 0x37, 0x08, 0x50, 0x0B, 0x6E, 0x00, 0x00, 0x01, 0x00, 0x02, 0x00, 0x3F, 0x00,
+	 0x0C, 0x00, 0x30, 0x00, 0x03, 0x00, 0x0F, 0x00, 0x3E, 0x00, 0x3C, 0x00, 0x02, 0x00, 0x04, 0x00,
+	 0x0A, 0x00, 0x0B, 0x00, 0x10, 0x00, 0x16, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x63, 0x00, 0x63, 0x00, 0x20, 0x00, 0x63, 0x00, 0x63, 0x00, 0x20, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x0A, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0B, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0C, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x0D, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0E, 0x00, 0x00, 0x00, 0x00, 0x00, 0x50, 0x10,
+	 0x9E, 0x10, 0x56, 0x10, 0x98, 0x10, 0x5C, 0x10, 0x92, 0x10, 0x62, 0x10, 0x8C, 0x10, 0x68, 0x10,
+	 0x86, 0x10, 0x6E, 0x10, 0x80, 0x10, 0x74, 0x10, 0x7A, 0x10, 0x07, 0x01, 0x00, 0x00, 0x0A, 0x22,
+	 0x00, 0x04, 0x08, 0x01, 0x00, 0x00, 0x0A, 0x26, 0x00, 0x04, 0x09, 0x01, 0x00, 0x00, 0x0A, 0x2A,
+	 0x00, 0x04, 0x0A, 0x01, 0x00, 0x00, 0x0A, 0x2E, 0x00, 0x04, 0x0B, 0x01, 0x00, 0x00, 0x10, 0x24,
+	 0x04, 0x04, 0x0C, 0x01, 0x00, 0x00, 0x10, 0x28, 0x04, 0x04, 0x0D, 0x01, 0x00, 0x00, 0x10, 0x2C,
+	 0x04, 0x04, 0x0E, 0x01, 0x00, 0x00, 0x10, 0x30, 0x04, 0x04, 0x0F, 0x01, 0x00, 0x00, 0x16, 0x34,
+	 0x08, 0x04, 0x10, 0x01, 0x00, 0x00, 0x16, 0x38, 0x08, 0x04, 0x11, 0x01, 0x00, 0x00, 0x16, 0x3C,
+	 0x08, 0x04, 0x12, 0x01, 0x00, 0x00, 0x16, 0x40, 0x08, 0x04, 0x13, 0x01, 0x00, 0x00, 0x17, 0x64,
+	 0x0C, 0x0B, 0x14, 0x01, 0x00, 0x00, 0x17, 0x68, 0x0C, 0x0B, 0x15, 0x01, 0x00, 0x00, 0x17, 0x6C,
+	 0x0C, 0x0B, 0x16, 0x01, 0x00, 0x00, 0x17, 0x70, 0x0C, 0x0B, 0x17, 0x01, 0x00, 0x00, 0x17, 0x74,
+	 0x0C, 0x0B, 0x18, 0x01, 0x00, 0x00, 0x17, 0x78, 0x0C, 0x0B, 0x19, 0x01, 0x00, 0x00, 0x17, 0x7C,
+	 0x0C, 0x0B, 0x1A, 0x01, 0x00, 0x00, 0x17, 0x80, 0x0C, 0x0B, 0x1B, 0x01, 0x00, 0x00, 0x17, 0x84,
+	 0x0C, 0x0B, 0x1C, 0x01, 0x00, 0x00, 0x17, 0x88, 0x0C, 0x0B, 0x1D, 0x01, 0x00, 0x00, 0x17, 0x8C,
+	 0x0C, 0x0B, 0x1E, 0x01, 0x00, 0x00, 0x1D, 0x95, 0x17, 0x04, 0x1F, 0x01, 0x00, 0x00, 0x1D, 0x99,
+	 0x17, 0x04, 0x20, 0x01, 0x00, 0x00, 0x1D, 0x9D, 0x17, 0x04, 0x21, 0x01, 0x00, 0x00, 0x1D, 0xA1,
+	 0x17, 0x04, 0x22, 0x01, 0x00, 0x00, 0x0E, 0xA5, 0x00, 0x00, 0xC0, 0x10, 0xE0, 0x10, 0x00, 0x11,
+	 0x20, 0x11, 0x78, 0x11, 0xC8, 0x10, 0xE8, 0x10, 0x08, 0x11, 0x28, 0x11, 0x80, 0x11, 0xD0, 0x10,
+	 0xF0, 0x10, 0x10, 0x11, 0x30, 0x11, 0x88, 0x11, 0xD8, 0x10, 0xF8, 0x10, 0x18, 0x11, 0x38, 0x11,
+	 0x90, 0x11, 0x40, 0x11, 0x48, 0x11, 0x50, 0x11, 0x58, 0x11, 0x60, 0x11, 0x68, 0x11, 0x70, 0x11,
+	 0x98, 0x11, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xD2, 0x14, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xA1, 0xEB, 0xBA, 0xEB,
+	 0xDF, 0xEB, 0x57, 0xEB, 0x57, 0xEB, 0x57, 0xEB, 0x57, 0xEB, 0x57, 0xEB, 0x57, 0xEB, 0x57, 0xEB,
+	 0x57, 0xEB, 0x90, 0xF1, 0x57, 0xEB, 0x57, 0xEB, 0x57, 0xEB, 0x57, 0xEB, 0x57, 0xEB, 0xD6, 0xED,
+	 0x57, 0xEB, 0x57, 0xEB, 0x57, 0xEB, 0x57, 0xEB, 0x57, 0xEB, 0x57, 0xEB, 0x57, 0xEB, 0x57, 0xEB,
+	 0x57, 0xEB, 0x57, 0xEB, 0x57, 0xEB, 0x57, 0xEB, 0x57, 0xEB, 0x57, 0xEB, 0x57, 0xEB, 0x2F, 0xEE,
+	 0x57, 0xEB, 0x57, 0xEB, 0x57, 0xEB, 0x57, 0xEB, 0x57, 0xEB, 0x57, 0xEB, 0x57, 0xEB, 0x57, 0xEB,
+	 0x57, 0xEB, 0x57, 0xEB, 0x57, 0xEB, 0x57, 0xEB, 0x57, 0xEB, 0x57, 0xEB, 0xA4, 0xED, 0xBE, 0xED,
+	 0x57, 0xEB, 0x57, 0xEB, 0x57, 0xEB, 0x57, 0xEB, 0x57, 0xEB, 0x57, 0xEB, 0x7F, 0xF4, 0x19, 0xEC,
+	 0x2C, 0xEC, 0xDC, 0xEC, 0xE0, 0xEC, 0x57, 0xEB, 0x57, 0xEB, 0x8F, 0xED, 0x84, 0xE3, 0x59, 0xE3,
+	 0xD7, 0xE3, 0x28, 0xE4, 0x00, 0x00, 0x00, 0x00, 0xD0, 0xEB, 0xF6, 0xEB, 0x72, 0xF0, 0x72, 0xF0,
+	 0x00, 0x00, 0x00, 0x00, 0xE0, 0xFC, 0x89, 0xEE, 0x45, 0xF0, 0x5A, 0x00, 0x02, 0x00, 0xF9, 0xFF,
+	 0x89, 0xEE, 0x9F, 0xEE, 0xCC, 0x00, 0x02, 0x00, 0xF7, 0xFF, 0x89, 0xEE, 0x9F, 0xEE, 0xB6, 0x1F,
+	 0x06, 0x00, 0xF0, 0xFF, 0x89, 0xEE, 0x73, 0xEE, 0x00, 0x00, 0x00, 0x02, 0xF6, 0xFF, 0x89, 0xEE,
+	 0x9F, 0xEE, 0x6C, 0x00, 0x02, 0x00, 0xF4, 0xFF, 0x89, 0xEE, 0x9F, 0xEE, 0x6A, 0x01, 0x02, 0x00,
+	 0xF5, 0xFF, 0x89, 0xEE, 0x4E, 0xF0, 0xA8, 0x1F, 0x02, 0x00, 0xE0, 0xFF, 0x89, 0xEE, 0x9F, 0xEE,
+	 0xEE, 0x21, 0x02, 0x00, 0xE1, 0xFF, 0x89, 0xEE, 0x9F, 0xEE, 0xF0, 0x21, 0x02, 0x00, 0xE2, 0xFF,
+	 0x89, 0xEE, 0x9F, 0xEE, 0xF2, 0x21, 0x02, 0x00, 0xE3, 0xFF, 0x89, 0xEE, 0x9F, 0xEE, 0xEA, 0x21,
+	 0x02, 0x00, 0x03, 0xFC, 0x89, 0xEE, 0xE5, 0xEF, 0x7C, 0x21, 0x02, 0x00, 0x04, 0xFC, 0x89, 0xEE,
+	 0x99, 0xEE, 0xBE, 0x1F, 0x22, 0x00, 0x06, 0xFC, 0x89, 0xEE, 0x9F, 0xEE, 0xA6, 0x1F, 0x02, 0x00,
+	 0x07, 0xFC, 0x89, 0xEE, 0x9F, 0xEE, 0x02, 0x20, 0x02, 0x00, 0x0E, 0xFC, 0x89, 0xEE, 0xF7, 0xEF,
+	 0x0C, 0x20, 0x22, 0x00, 0xB1, 0xFC, 0x89, 0xEE, 0x58, 0xF2, 0x2C, 0x21, 0x02, 0x00, 0x20, 0xFC,
+	 0x89, 0xEE, 0x9F, 0xEE, 0x32, 0x20, 0x02, 0x00, 0x25, 0xFC, 0x89, 0xEE, 0x9F, 0xEE, 0x3C, 0x20,
+	 0x02, 0x00, 0x26, 0xFC, 0x89, 0xEE, 0x9F, 0xEE, 0x3E, 0x20, 0x02, 0x00, 0x27, 0xFC, 0x89, 0xEE,
+	 0x9F, 0xEE, 0x40, 0x20, 0x02, 0x00, 0xB2, 0xFC, 0x89, 0xEE, 0x99, 0xEE, 0x50, 0x21, 0x22, 0x00,
+	 0xC1, 0xFC, 0x89, 0xEE, 0x9F, 0xEE, 0x98, 0x21, 0x20, 0x00, 0xB0, 0xFC, 0x69, 0xEE, 0x5D, 0xF2,
+	 0x00, 0x00, 0x00, 0x00, 0xC4, 0xFC, 0x69, 0xEE, 0x68, 0xF0, 0x00, 0x00, 0x08, 0x00, 0xC8, 0xFC,
+	 0x69, 0xEE, 0x63, 0xF0, 0x00, 0x00, 0x08, 0x00, 0xB4, 0xFC, 0x69, 0xEE, 0x9B, 0xF2, 0x00, 0x00,
+	 0x00, 0x00, 0xB6, 0xFC, 0x69, 0xEE, 0x4E, 0xF3, 0x00, 0x00, 0x00, 0x00, 0xB7, 0xFC, 0x69, 0xEE,
+	 0x90, 0xF3, 0x00, 0x00, 0x00, 0x00, 0xB8, 0xFC, 0x69, 0xEE, 0xED, 0xF3, 0x00, 0x00, 0x00, 0x00,
+	 0xB5, 0xFC, 0x89, 0xEE, 0x9F, 0xEE, 0xE6, 0x21, 0x02, 0x00, 0xB9, 0xFC, 0x89, 0xEE, 0x9F, 0xEE,
+	 0xE8, 0x21, 0x02, 0x00, 0x90, 0xFD, 0x89, 0xEE, 0x73, 0xEE, 0xEC, 0x21, 0x02, 0x00, 0x23, 0xFC,
+	 0x89, 0xEE, 0x9F, 0xEE, 0x38, 0x20, 0x02, 0x00, 0x29, 0xFC, 0x48, 0xEF, 0xF5, 0xEE, 0x00, 0x00,
+	 0x00, 0x00, 0xC2, 0xFC, 0x89, 0xEE, 0x9F, 0xEE, 0x74, 0x21, 0x02, 0x00, 0x32, 0xFC, 0x89, 0xEE,
+	 0x9F, 0xEE, 0x60, 0x01, 0x02, 0x00, 0x33, 0xFC, 0x89, 0xEE, 0x9F, 0xEE, 0x62, 0x01, 0x02, 0x00,
+	 0x10, 0xFC, 0x89, 0xEE, 0x9F, 0xEE, 0xAE, 0x1F, 0x02, 0x00, 0x11, 0xFC, 0x89, 0xEE, 0x9F, 0xEE,
+	 0x46, 0x20, 0x06, 0x00, 0x12, 0xFC, 0x89, 0xEE, 0x9F, 0xEE, 0x4C, 0x20, 0x06, 0x00, 0x13, 0xFC,
+	 0x89, 0xEE, 0x9F, 0xEE, 0x52, 0x20, 0x06, 0x00, 0x14, 0xFC, 0x89, 0xEE, 0x9F, 0xEE, 0x58, 0x20,
+	 0x06, 0x00, 0x15, 0xFC, 0x89, 0xEE, 0x9F, 0xEE, 0x5E, 0x20, 0x06, 0x00, 0x16, 0xFC, 0x89, 0xEE,
+	 0x9F, 0xEE, 0x64, 0x20, 0x06, 0x00, 0x17, 0xFC, 0x89, 0xEE, 0x9F, 0xEE, 0x2E, 0x20, 0x02, 0x00,
+	 0x83, 0xFC, 0x89, 0xEE, 0x9F, 0xEE, 0x6E, 0x01, 0x02, 0x00, 0x97, 0xFC, 0x89, 0xEE, 0x9F, 0xEE,
+	 0x6C, 0x01, 0x02, 0x00, 0x98, 0xFC, 0x31, 0xF0, 0x1F, 0xF0, 0xE4, 0x00, 0x02, 0x00, 0x99, 0xFC,
+	 0x31, 0xF0, 0x1F, 0xF0, 0xE4, 0x02, 0x02, 0x00, 0x9A, 0xFC, 0x31, 0xF0, 0x1F, 0xF0, 0xE4, 0x04,
+	 0x02, 0x00, 0x9B, 0xFC, 0x31, 0xF0, 0x1F, 0xF0, 0xE4, 0x06, 0x02, 0x00, 0x9C, 0xFC, 0x31, 0xF0,
+	 0x1F, 0xF0, 0xE4, 0x08, 0x02, 0x00, 0x9D, 0xFC, 0x31, 0xF0, 0x1F, 0xF0, 0xE4, 0x0A, 0x02, 0x00,
+	 0x18, 0xFC, 0x89, 0xEE, 0x9F, 0xEE, 0x30, 0x20, 0x02, 0x00, 0x22, 0xFC, 0x89, 0xEE, 0x9F, 0xEE,
+	 0x36, 0x20, 0x02, 0x00, 0x24, 0xFC, 0x89, 0xEE, 0x9F, 0xEE, 0x3A, 0x20, 0x02, 0x00, 0xC0, 0xFC,
+	 0x69, 0xEE, 0x61, 0xF0, 0x00, 0x00, 0x06, 0x00, 0x9E, 0xFC, 0x89, 0xEE, 0x17, 0xF0, 0x70, 0x01,
+	 0x02, 0x00, 0x9F, 0xFC, 0x31, 0xF0, 0x1F, 0xF0, 0xE6, 0x00, 0x02, 0x00, 0xA0, 0xFC, 0x31, 0xF0,
+	 0x1F, 0xF0, 0xE6, 0x02, 0x02, 0x00, 0xA1, 0xFC, 0x31, 0xF0, 0x1F, 0xF0, 0xE6, 0x04, 0x02, 0x00,
+	 0xA2, 0xFC, 0x31, 0xF0, 0x1F, 0xF0, 0xE6, 0x06, 0x02, 0x00, 0xA3, 0xFC, 0x31, 0xF0, 0x1F, 0xF0,
+	 0xE6, 0x08, 0x02, 0x00, 0xA4, 0xFC, 0x31, 0xF0, 0x1F, 0xF0, 0xE6, 0x0A, 0x02, 0x00, 0x20, 0xFD,
+	 0xBA, 0xEE, 0x73, 0xEE, 0x53, 0xF5, 0x08, 0x00, 0x21, 0xFD, 0xBA, 0xEE, 0x73, 0xEE, 0x57, 0xF5,
+	 0x0A, 0x00, 0x22, 0xFD, 0xBA, 0xEE, 0x73, 0xEE, 0x5C, 0xF5, 0x16, 0x00, 0x23, 0xFD, 0xBA, 0xEE,
+	 0x73, 0xEE, 0x67, 0xF5, 0x0A, 0x00, 0x10, 0xFD, 0x89, 0xEE, 0x73, 0xEE, 0x34, 0x01, 0x02, 0x00,
+	 0x45, 0xFD, 0x89, 0xEE, 0x73, 0xEE, 0xCC, 0x00, 0x02, 0x00, 0x47, 0xFD, 0x89, 0xEE, 0x73, 0xEE,
+	 0x38, 0x01, 0x02, 0x00, 0x48, 0xFD, 0x9E, 0xEF, 0x73, 0xEE, 0x60, 0x01, 0x02, 0x00, 0x49, 0xFD,
+	 0x9E, 0xEF, 0x73, 0xEE, 0x62, 0x01, 0x02, 0x00, 0x4A, 0xFD, 0x89, 0xEE, 0x73, 0xEE, 0x58, 0x01,
+	 0x02, 0x00, 0x4B, 0xFD, 0x89, 0xEE, 0x73, 0xEE, 0x5A, 0x01, 0x02, 0x00, 0x4D, 0xFD, 0xBA, 0xEE,
+	 0x73, 0xEE, 0x6C, 0xF5, 0x04, 0x00, 0x4F, 0xFD, 0xB2, 0xEF, 0x73, 0xEE, 0x80, 0x21, 0x02, 0x00,
+	 0xC0, 0xFD, 0xBA, 0xEE, 0x73, 0xEE, 0x6E, 0xF5, 0x02, 0x00, 0xC2, 0xFD, 0xA8, 0xEF, 0x73, 0xEE,
+	 0x00, 0x00, 0x02, 0x00, 0xC3, 0xFD, 0xBA, 0xEE, 0x73, 0xEE, 0x6F, 0xF5, 0x02, 0x00, 0x40, 0xFD,
+	 0xB2, 0xEE, 0x73, 0xEE, 0x78, 0x01, 0x02, 0x00, 0x24, 0xFD, 0xD8, 0xEF, 0x73, 0xEE, 0x00, 0x00,
+	 0x02, 0x00, 0x91, 0xFD, 0x89, 0xEE, 0x73, 0xEE, 0x86, 0x1B, 0x02, 0x00, 0x93, 0xFD, 0x89, 0xEE,
+	 0x73, 0xEE, 0x8C, 0x1B, 0x02, 0x00, 0xC1, 0xFD, 0x89, 0xEE, 0x73, 0xEE, 0xCA, 0x00, 0x02, 0x00,
+	 0xC6, 0xFD, 0xE7, 0xEE, 0x73, 0xEE, 0x8E, 0x21, 0x0A, 0x00, 0x89, 0xFD, 0x5F, 0xEF, 0x73, 0xEE,
+	 0x00, 0x00, 0x00, 0x00, 0x8A, 0xFD, 0xD7, 0xEE, 0x73, 0xEE, 0xC0, 0x21, 0x24, 0x00, 0x46, 0xFD,
+	 0x89, 0xEE, 0x73, 0xEE, 0x7A, 0x01, 0x06, 0x00, 0x86, 0xFD, 0x89, 0xEE, 0x73, 0xEE, 0xB6, 0x1F,
+	 0x06, 0x00, 0x87, 0xFD, 0x89, 0xEE, 0x73, 0xEE, 0xB8, 0x21, 0x06, 0x00, 0x8B, 0xFD, 0x7A, 0xF3,
+	 0x73, 0xEE, 0x00, 0x00, 0x12, 0x00, 0x8E, 0xFD, 0x89, 0xEE, 0x73, 0xEE, 0xB8, 0x12, 0x02, 0x00,
+	 0x80, 0xFD, 0xBC, 0xEF, 0x73, 0xEE, 0x1C, 0x00, 0x02, 0x00, 0x81, 0xFD, 0xBC, 0xEF, 0x73, 0xEE,
+	 0x1C, 0x02, 0x02, 0x00, 0x82, 0xFD, 0xBC, 0xEF, 0x73, 0xEE, 0x1C, 0x04, 0x02, 0x00, 0x83, 0xFD,
+	 0xBC, 0xEF, 0x73, 0xEE, 0x1C, 0x06, 0x02, 0x00, 0x84, 0xFD, 0xBC, 0xEF, 0x73, 0xEE, 0x1C, 0x08,
+	 0x02, 0x00, 0x85, 0xFD, 0xBC, 0xEF, 0x73, 0xEE, 0x1C, 0x0A, 0x02, 0x00, 0x00, 0xF1, 0x46, 0x00,
+	 0x2D, 0xEE, 0xF8, 0x00, 0x00, 0x03, 0x8A, 0xEA, 0x1F, 0x00, 0x36, 0x01, 0xCA, 0x00, 0x96, 0x01,
+	 0xCE, 0x00, 0xFC, 0x00, 0x78, 0x01, 0xDA, 0x1E, 0x1A, 0x01, 0x86, 0x1B, 0xC8, 0x00, 0x00, 0x00,
+	 0xCE, 0x12, 0x00, 0x00, 0xD2, 0x14, 0x14, 0x01, 0x03, 0x00, 0xAE, 0x00, 0xE4, 0x00, 0x3C, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x77, 0xB4, 0xEA, 0xB3, 0x26, 0xB5, 0x2F, 0xB5, 0xFB, 0xB3, 0xA4, 0xB4, 0x69, 0xB4, 0xE7, 0xC5,
+	 0x4A, 0xC5, 0xE7, 0xC5, 0xBE, 0xC5, 0x54, 0xC5, 0x48, 0xC5, 0x06, 0xC6, 0x17, 0xC6, 0x17, 0xC6,
+	 0x17, 0xC6, 0x20, 0xC6, 0x3B, 0xC6, 0x98, 0xC6, 0xB4, 0xC6, 0xBF, 0xC5, 0xD2, 0xC5, 0xA6, 0xC5,
+	 0x10, 0x00, 0x12, 0x00, 0x13, 0x00, 0x20, 0x00, 0x21, 0x00, 0x22, 0x00, 0x30, 0x00, 0x31, 0x00,
+	 0x32, 0x00, 0x33, 0x00, 0x34, 0x00, 0x35, 0x00, 0x36, 0x00, 0x37, 0x00, 0x38, 0x00, 0x39, 0x00,
+	 0x3A, 0x00, 0x00, 0x00, 0x14, 0x01, 0x14, 0x01, 0x14, 0x01, 0x14, 0x01, 0x14, 0x01, 0x14, 0x01,
+	 0x14, 0x01, 0x14, 0x01, 0xF3, 0x02, 0xAD, 0x03, 0x60, 0x04, 0x04, 0x05, 0x07, 0x06, 0x08, 0x07,
+	 0x0A, 0x08, 0x16, 0x09, 0x44, 0x0A, 0x04, 0x0B, 0x40, 0x0C, 0x80, 0x0D, 0x00, 0x0E, 0x84, 0x0F,
+	 0x01, 0x10, 0x10, 0x11, 0x02, 0x14, 0x40, 0x20, 0x32, 0x21, 0x32, 0x22, 0x04, 0x23, 0x01, 0x24,
+	 0x0F, 0x25, 0x00, 0x26, 0x00, 0x27, 0x00, 0x28, 0x00, 0x29, 0x00, 0x2A, 0x01, 0x2B, 0x06, 0x2C,
+	 0x00, 0x38, 0x00, 0x39, 0xD6, 0x3A, 0x00, 0x3B, 0x00, 0x3C, 0x14, 0x3D, 0x7F, 0x3E, 0x00, 0x3F,
+	 0x68, 0x40, 0x75, 0x41, 0x07, 0x42, 0x07, 0x43, 0x00, 0x45, 0x3B, 0x4A, 0x00, 0x4B, 0x00, 0x4C,
+	 0x0F, 0x4D, 0x02, 0x75, 0x00, 0x76, 0x80, 0x00, 0x08, 0x01, 0x09, 0x01, 0x09, 0x01, 0x0A, 0x01,
+	 0x0A, 0x01, 0x0B, 0x01, 0x0B, 0x01, 0x0C, 0x01, 0x0C, 0x01, 0x0D, 0x01, 0x0D, 0x01, 0x0E, 0x01,
+	 0x0E, 0x01, 0x0F, 0x01, 0x0F, 0x01, 0x10, 0x01, 0x10, 0x01, 0x11, 0x01, 0x11, 0x01, 0x12, 0x01,
+	 0x12, 0x01, 0x13, 0x01, 0x13, 0x01, 0x14, 0x01, 0x14, 0x01, 0x15, 0x01, 0x15, 0x01, 0x16, 0x01,
+	 0x16, 0x01, 0x17, 0x01, 0x17, 0x01, 0x18, 0x01, 0x18, 0x01, 0x19, 0x01, 0x19, 0x01, 0x4D, 0x01,
+	 0x4D, 0x01, 0x4E, 0x01, 0x4E, 0x01, 0x4F, 0x01, 0x4F, 0x01, 0x50, 0x01, 0x50, 0x01, 0x51, 0x01,
+	 0x51, 0x01, 0x52, 0x01, 0x52, 0x01, 0x53, 0x01, 0x53, 0x01, 0x54, 0x01, 0x54, 0x01, 0x65, 0x01,
+	 0x65, 0x01, 0x66, 0x01, 0x66, 0x01, 0x67, 0x01, 0x67, 0x01, 0x68, 0x01, 0x68, 0x01, 0x69, 0x01,
+	 0x69, 0x01, 0x6A, 0x01, 0x6A, 0x01, 0x6B, 0x01, 0x6B, 0x01, 0x6C, 0x01, 0x6C, 0x01, 0x6D, 0x01,
+	 0x6D, 0x01, 0x6E, 0x01, 0x6E, 0x01, 0x6F, 0x01, 0x6F, 0x01, 0x70, 0x01, 0x70, 0x01, 0x71, 0x01,
+	 0x71, 0x01, 0x72, 0x01, 0x72, 0x01, 0x73, 0x01, 0x73, 0x01, 0x74, 0x01, 0x74, 0x01, 0x75, 0x01,
+	 0x75, 0x01, 0x76, 0x01, 0x76, 0x01, 0x77, 0x01, 0x77, 0x01, 0x78, 0x01, 0x78, 0x01, 0x79, 0x01,
+	 0x79, 0x01, 0x7A, 0x01, 0x7A, 0x01, 0x7B, 0x01, 0x7B, 0x01, 0x7C, 0x01, 0x7C, 0x01, 0x7D, 0x01,
+	 0x7D, 0x01, 0x7E, 0x01, 0x7E, 0x01, 0x7F, 0x01, 0x7F, 0x01, 0x7F, 0x01, 0x7F, 0x01, 0x7F, 0x01,
+	 0x7F, 0x01, 0x7F, 0x01, 0x7F, 0x01, 0x7F, 0x01, 0x7F, 0x01, 0x7F, 0x01, 0x7F, 0x01, 0x7F, 0x01,
+	 0x7F, 0x01, 0x7F, 0x01, 0x7F, 0x01, 0x7F, 0x01, 0x7F, 0x01, 0x7F, 0x01, 0x7F, 0x01, 0x7F, 0x01,
+	 0x7F, 0x01, 0x7F, 0x01, 0x7F, 0x01, 0x7F, 0x01, 0x80, 0x12, 0x80, 0x12, 0x80, 0x12, 0x80, 0x12,
+	 0x80, 0x12, 0x80, 0x12, 0x80, 0x12, 0x80, 0x12, 0x80, 0x12, 0x80, 0x12, 0x80, 0x12, 0x80, 0x12,
+	 0x80, 0x12, 0x80, 0x12, 0x80, 0x13, 0x80, 0x13, 0x80, 0x13, 0x80, 0x13, 0x80, 0x13, 0x80, 0x13,
+	 0x80, 0x13, 0x80, 0x13, 0x80, 0x13, 0x80, 0x13, 0x80, 0x13, 0x80, 0x13, 0x80, 0x13, 0x80, 0x13,
+	 0x51, 0x44, 0x51, 0x44, 0x51, 0x44, 0x51, 0x44, 0x51, 0x44, 0x51, 0x44, 0x51, 0x44, 0x51, 0x44,
+	 0x51, 0x44, 0x51, 0x44, 0x51, 0x44, 0x51, 0x44, 0x51, 0x44, 0x51, 0x44, 0x22, 0x46, 0x22, 0x46,
+	 0x22, 0x46, 0x22, 0x46, 0x22, 0x46, 0x22, 0x46, 0x22, 0x46, 0x22, 0x46, 0x22, 0x46, 0x22, 0x46,
+	 0x22, 0x46, 0x23, 0x46, 0x23, 0x46, 0x23, 0x46, 0x1C, 0x47, 0x1C, 0x47, 0x1C, 0x47, 0x1C, 0x47,
+	 0x1C, 0x47, 0x1C, 0x47, 0x1C, 0x47, 0x1C, 0x47, 0x1C, 0x47, 0x1C, 0x47, 0x1C, 0x47, 0x1C, 0x47,
+	 0x1C, 0x47, 0x1D, 0x47, 0x9A, 0x48, 0xDA, 0x48, 0x1A, 0x48, 0x5A, 0x48, 0x9A, 0x48, 0xDA, 0x48,
+	 0x1A, 0x48, 0x5A, 0x48, 0x9A, 0x48, 0xDA, 0x48, 0x1A, 0x48, 0x5A, 0x48, 0x9A, 0x48, 0x33, 0x48,
+	 0x78, 0x49, 0x78, 0x49, 0x79, 0x49, 0x79, 0x49, 0x79, 0x49, 0x79, 0x49, 0x7A, 0x49, 0x7A, 0x49,
+	 0x7A, 0x49, 0x7A, 0x49, 0x7B, 0x49, 0x7B, 0x49, 0x7B, 0x49, 0x7C, 0x49, 0x32, 0x00, 0x46, 0x00,
+	 0x5A, 0x00, 0x6E, 0x00, 0x82, 0x00, 0x96, 0x00, 0xAA, 0x00, 0xBE, 0x00, 0xD2, 0x00, 0xE6, 0x00,
+	 0xFA, 0x00, 0x0E, 0x01, 0x22, 0x01, 0x52, 0x01, 0x05, 0x00, 0x04, 0x00, 0x04, 0x00, 0x04, 0x00,
+	 0x04, 0x00, 0x03, 0x00, 0x03, 0x00, 0x03, 0x00, 0x03, 0x00, 0x03, 0x00, 0x02, 0x00, 0x02, 0x00,
+	 0x02, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x15, 0x00, 0x6E, 0x6F, 0x6E, 0x2D, 0x73, 0x70,
+	 0x65, 0x63, 0x69, 0x66, 0x69, 0x65, 0x64, 0x20, 0x53, 0x53, 0x49, 0x44, 0x20, 0x21, 0x21, 0x20,
+	 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x01, 0x00, 0x00, 0x20, 0x20, 0x20,
+	 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+	 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x00, 0x09, 0x00, 0x00,
+	 0x01, 0x00, 0x64, 0x00, 0x64, 0x00, 0x00, 0x00, 0x48, 0x45, 0x52, 0x4D, 0x45, 0x53, 0x20, 0x32,
+	 0x00, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+	 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00,
+	 0x01, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00,
+	 0x01, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x15, 0x00, 0x6E, 0x6F, 0x6E, 0x2D, 0x73, 0x70,
+	 0x65, 0x63, 0x69, 0x66, 0x69, 0x65, 0x64, 0x20, 0x53, 0x53, 0x49, 0x44, 0x20, 0x21, 0x21, 0x20,
+	 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x01, 0x00, 0x20, 0x20, 0x20, 0x20,
+	 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+	 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x00, 0x09, 0x00, 0x00,
+	 0x01, 0x00, 0x64, 0x00, 0x64, 0x00, 0x00, 0x00, 0x48, 0x45, 0x52, 0x4D, 0x45, 0x53, 0x20, 0x32,
+	 0x00, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+	 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00,
+	 0x01, 0x00, 0x02, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46, 0x69, 0x72, 0x73, 0x74, 0x20,
+	 0x57, 0x61, 0x76, 0x65, 0x4C, 0x41, 0x4E, 0x20, 0x49, 0x49, 0x20, 0x53, 0x53, 0x49, 0x44, 0x20,
+	 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x00, 0x00, 0x20, 0x20, 0x20, 0x20,
+	 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+	 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x28, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x2B, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x19, 0x00, 0x02, 0x01, 0x82, 0x84, 0x8B, 0x96, 0x00, 0x00,
+	 0x00, 0x00, 0x20, 0x00, 0x20, 0x00, 0x10, 0x00, 0x08, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x01,
+	 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0xDD, 0x00, 0x50, 0xF2, 0x01,
+	 0x01, 0x00, 0x00, 0x50, 0xF2, 0x05, 0x02, 0x00, 0x00, 0x50, 0xF2, 0x02, 0x00, 0x50, 0xF2, 0x04,
+	 0x02, 0x00, 0x00, 0x50, 0xF2, 0x00, 0x00, 0x50, 0xF2, 0x01, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x14, 0x00, 0x04, 0x00,
+	 0x15, 0x00, 0x02, 0x00, 0x10, 0x00, 0x10, 0x00, 0x10, 0x00, 0x04, 0x00, 0x10, 0x00, 0x02, 0x00,
+	 0x01, 0x00, 0x04, 0x00, 0x15, 0x00, 0x20, 0x00, 0x11, 0x00, 0x20, 0x00, 0x1E, 0x1F, 0x8E, 0x21,
+	 0x00, 0x23, 0xDA, 0x22, 0x04, 0x23, 0xC0, 0x21, 0xFF, 0xFF, 0xFF, 0xFF, 0x34, 0x23, 0x00, 0x00,
+	 0x50, 0x21, 0x8E, 0x21, 0xFF, 0xFF, 0x00, 0x00, 0x1E, 0x1F, 0x8E, 0x21, 0x00, 0x23, 0xFF, 0xFF,
+	 0x04, 0x23, 0xC0, 0x21, 0xFF, 0xFF, 0xFF, 0xFF, 0x34, 0x23, 0x00, 0x00, 0x8E, 0x21, 0x3C, 0x23,
+	 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x03, 0x03, 0x00, 0x06, 0x07,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x80,
+	 0x00, 0x60, 0x1D, 0x00, 0x00, 0x00, 0x0D, 0x81, 0x00, 0x60, 0x1D, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00,
+
+};  /* fw_image_2_data */
+
+static const hcf_8 fw_image_3_data[] = {
+	 0x3F, 0x41, 0xA5, 0x4C, 0x50, 0x37, 0x04, 0x00, 0x01, 0xB9, 0x41, 0x5F, 0xB5, 0x60, 0x55, 0xE0,
+	 0x0C, 0x60, 0x10, 0x62, 0xA2, 0xD3, 0x01, 0x60, 0x01, 0x65, 0xD4, 0x80, 0x5A, 0xD1, 0x0F, 0x02,
+	 0x5A, 0xD3, 0x3E, 0x60, 0x00, 0x66, 0xE0, 0x87, 0x40, 0x4A, 0xEA, 0x60, 0x88, 0x61, 0x64, 0x44,
+	 0xC8, 0x84, 0x0C, 0x63, 0xAA, 0x46, 0x58, 0xD0, 0xAA, 0x46, 0x59, 0xD8, 0xFB, 0x1F, 0x08, 0x60,
+	 0x00, 0x63, 0xFA, 0x60, 0x00, 0x65, 0xBD, 0xD3, 0xA3, 0xD3, 0x02, 0xA8, 0xD4, 0x80, 0x61, 0x02,
+	 0x60, 0x02, 0x26, 0x60, 0x6A, 0x61, 0x3C, 0x60, 0x00, 0x66, 0x41, 0x4B, 0x2B, 0x41, 0x26, 0x60,
+	 0xB2, 0x7C, 0xD1, 0x80, 0xA1, 0xD2, 0x25, 0x05, 0x59, 0xD0, 0x60, 0x45, 0x59, 0xD2, 0x44, 0x47,
+	 0xE0, 0x87, 0x40, 0x4A, 0x59, 0xD2, 0x59, 0x8B, 0x40, 0x4C, 0x08, 0x60, 0x00, 0x63, 0xBE, 0xD3,
+	 0xBD, 0xD1, 0xEC, 0x18, 0xD4, 0x80, 0xEA, 0x18, 0x03, 0x03, 0xC3, 0x83, 0xC3, 0x83, 0xF7, 0x01,
+	 0x67, 0x44, 0xC0, 0x84, 0xE0, 0x85, 0x2C, 0x44, 0xD4, 0x80, 0x63, 0x41, 0x01, 0x06, 0x65, 0x44,
+	 0xC8, 0x83, 0xAA, 0x46, 0x59, 0xD1, 0x27, 0xD8, 0x5A, 0x87, 0xFC, 0x1F, 0xAA, 0x46, 0x2B, 0x41,
+	 0xD5, 0x01, 0x26, 0x60, 0xB2, 0x61, 0x41, 0x4B, 0x2B, 0x41, 0x26, 0x60, 0xEA, 0x7C, 0xD1, 0x80,
+	 0xA1, 0xD2, 0x27, 0x05, 0x59, 0xD0, 0x60, 0x45, 0x59, 0xD2, 0x44, 0x47, 0xE0, 0x87, 0x40, 0x4A,
+	 0x59, 0xD2, 0x59, 0x8B, 0x40, 0x4C, 0x08, 0x60, 0x00, 0x63, 0xBE, 0xD3, 0xBD, 0xD1, 0xEC, 0x18,
+	 0xD4, 0x80, 0xEA, 0x18, 0x03, 0x03, 0xC3, 0x83, 0xC3, 0x83, 0xF7, 0x01, 0x04, 0xA3, 0xA3, 0xD1,
+	 0x5A, 0x88, 0x2C, 0x43, 0xD3, 0x80, 0xFF, 0xFF, 0x01, 0x06, 0x64, 0x43, 0xCF, 0x83, 0xAA, 0x46,
+	 0x60, 0xFE, 0x28, 0xD1, 0x5E, 0x88, 0x27, 0xD8, 0x5A, 0x87, 0xFB, 0x1F, 0x20, 0xFE, 0xAA, 0x46,
+	 0xD3, 0x01, 0xB8, 0xFE, 0xB9, 0xFE, 0xBA, 0xFE, 0xBB, 0xFE, 0xBD, 0xFE, 0xBF, 0xFE, 0x21, 0x60,
+	 0x80, 0x62, 0xA2, 0xD3, 0x12, 0x63, 0x60, 0x40, 0x01, 0x27, 0x05, 0x00, 0x0B, 0x60, 0xEA, 0x62,
+	 0x00, 0x64, 0x5A, 0xDB, 0xFE, 0x1F, 0xA2, 0x60, 0x49, 0x78, 0xFF, 0xFF, 0xF1, 0xFF, 0x94, 0x48,
+	 0x1F, 0x00, 0x04, 0x00, 0xF2, 0xFF, 0x98, 0x48, 0x1F, 0x00, 0x04, 0x00, 0xFB, 0xFF, 0xA0, 0x48,
+	 0x1F, 0x00, 0x04, 0x00, 0xF1, 0xFF, 0xF2, 0x4D, 0x1F, 0x00, 0x04, 0x00, 0xF2, 0xFF, 0xF6, 0x4D,
+	 0x1F, 0x00, 0x04, 0x00, 0xFB, 0xFF, 0xFE, 0x4D, 0x1F, 0x00, 0x04, 0x00, 0x86, 0xFD, 0xB6, 0x1F,
+	 0x00, 0x00, 0x06, 0x00, 0x10, 0xFD, 0x34, 0x01, 0x00, 0x00, 0x02, 0x00, 0x14, 0xFD, 0x7E, 0x21,
+	 0x00, 0x00, 0x0A, 0x00, 0x20, 0xFA, 0xFA, 0x1D, 0x00, 0x00, 0x0E, 0x00, 0x21, 0xFA, 0xDE, 0x1D,
+	 0x00, 0x00, 0x0E, 0x00, 0x22, 0xFA, 0x16, 0x1E, 0x00, 0x00, 0x0E, 0x00, 0x23, 0xFA, 0xCA, 0x1C,
+	 0x00, 0x00, 0x01, 0x00, 0x24, 0xFA, 0xBE, 0x1E, 0x00, 0x00, 0x0E, 0x00, 0x25, 0xFA, 0xDE, 0x1C,
+	 0x00, 0x00, 0x80, 0x00, 0x26, 0xFA, 0xC4, 0x1C, 0x00, 0x00, 0x01, 0x00,
+
+};  /* fw_image_3_data */
+
+static const hcf_8 fw_image_4_data[] = {
+	 0xA6, 0x60, 0x25, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xA6, 0x60, 0x0B, 0x78, 0x41, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xA6, 0x60, 0x11, 0x78, 0xC4, 0xE2, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xA5, 0x60, 0x61, 0x78, 0x43, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x44, 0xFF, 0x20, 0x54, 0xCD, 0xE2, 0xA6, 0x60, 0x23, 0x78, 0x08, 0xE1, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xA6, 0x60, 0x25, 0x78, 0x44, 0xE2, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xA6, 0x60, 0x25, 0x78, 0x46, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xA6, 0x60, 0x25, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xAC, 0x60, 0x81, 0x78, 0x4C, 0x4E, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xAC, 0x60, 0x18, 0x78, 0x4C, 0xE2, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xC4, 0xE2, 0x84, 0xFF, 0x22, 0x58, 0x82, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xA7, 0x60, 0xC4, 0x78, 0x43, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xE4, 0xE2, 0xAC, 0x60, 0x31, 0x78, 0x95, 0xF3, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xBF, 0x60, 0x76, 0x78, 0x64, 0xE2, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xAC, 0x60, 0x8C, 0x78, 0xA4, 0xE2, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xAC, 0x60, 0x72, 0x78, 0x47, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xB2, 0x60, 0xD1, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xB2, 0x60, 0xFE, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xB1, 0x60, 0x90, 0x78, 0x42, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xB1, 0x60, 0xC0, 0x78, 0x43, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xB1, 0x60, 0xC0, 0x78, 0x44, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xB4, 0x60, 0x73, 0x78, 0x45, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xB1, 0x60, 0xC3, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x00, 0x60, 0x83, 0x64, 0x80, 0x29, 0x09, 0xFB, 0xB2, 0x60, 0x99, 0x78, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xC0, 0x60, 0x29, 0x78, 0x40, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xBF, 0x60, 0xB4, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xBE, 0x60, 0x78, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xBD, 0x60, 0xE8, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xB5, 0x60, 0x96, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xA1, 0xFF, 0xFF, 0xFF, 0x83, 0x3E, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xC0, 0x60, 0x9F, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x01,
+	 0x41, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x01,
+	 0x42, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x01,
+	 0xB0, 0xFF, 0xB1, 0xFF, 0x40, 0xFF, 0x43, 0xFF, 0xC0, 0x60, 0x9A, 0x78, 0x44, 0xFF, 0xFF, 0x01,
+	 0xC0, 0x60, 0x9F, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x01,
+	 0xC6, 0x60, 0x66, 0x78, 0x45, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x01,
+	 0xC0, 0x60, 0x9A, 0x78, 0x84, 0xE2, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x01,
+	 0xC0, 0x60, 0x99, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x01,
+	 0xC7, 0x60, 0x26, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xE5, 0x60, 0x0E, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xC7, 0x60, 0x2E, 0x78, 0x42, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xC7, 0x60, 0x2E, 0x78, 0x24, 0xE2, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xE3, 0x60, 0x45, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xC7, 0x60, 0x2E, 0x78, 0x44, 0xE2, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xC7, 0x60, 0x2E, 0x78, 0x84, 0xE2, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xC7, 0x60, 0x2E, 0x78, 0x47, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xEB, 0x60, 0x5B, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xEB, 0x60, 0x87, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xEB, 0x60, 0xA0, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xEB, 0x60, 0x84, 0x78, 0x28, 0xE2, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xEB, 0x60, 0x84, 0x78, 0x44, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xEB, 0x60, 0x84, 0x78, 0x45, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xEB, 0x60, 0x84, 0x78, 0x46, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x00, 0x60, 0x87, 0x64, 0x80, 0x29, 0x09, 0xFB, 0x47, 0xFF, 0xEB, 0x60, 0x84, 0x78, 0xFF, 0xFF,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x87, 0xF3, 0x88, 0xF3, 0xDC, 0x81, 0x00, 0x7C, 0x01, 0x00, 0x00, 0xFA, 0x60, 0x46, 0xFE, 0x63,
+	 0xA3, 0xD8, 0xFE, 0x1F, 0xCD, 0x81, 0xD8, 0x84, 0xF8, 0x02, 0x87, 0xF3, 0x88, 0xF5, 0xDC, 0x81,
+	 0x80, 0x67, 0x40, 0x4A, 0x14, 0x60, 0x02, 0x65, 0x01, 0x7C, 0x07, 0x18, 0x2A, 0x43, 0x02, 0xFC,
+	 0x5F, 0x8A, 0x8E, 0xF8, 0x70, 0xF8, 0x00, 0xF4, 0xF8, 0x01, 0x2E, 0x58, 0xFF, 0xFF, 0x89, 0xF5,
+	 0x06, 0x64, 0x66, 0x43, 0x00, 0x7C, 0x63, 0x46, 0xFE, 0x63, 0xA3, 0xD8, 0xFE, 0x1F, 0xCC, 0x84,
+	 0x66, 0x43, 0xDB, 0x83, 0xF8, 0x02, 0x14, 0x60, 0x02, 0x65, 0x09, 0x60, 0x2B, 0x7C, 0x89, 0xF3,
+	 0x06, 0x61, 0x60, 0x46, 0x01, 0x63, 0x72, 0xF8, 0x00, 0xFC, 0x63, 0x47, 0x06, 0xFA, 0x72, 0xF8,
+	 0x8E, 0xF8, 0xDF, 0x83, 0x66, 0x44, 0xCD, 0x81, 0x02, 0xA6, 0xF5, 0x02, 0x89, 0xF3, 0x06, 0x61,
+	 0x60, 0x46, 0x03, 0x7C, 0x73, 0xF8, 0x66, 0x44, 0xCD, 0x81, 0x02, 0xA6, 0xFB, 0x02, 0x2E, 0x58,
+	 0xFF, 0xFF, 0x3F, 0x40, 0x40, 0x26, 0x0A, 0x00, 0x42, 0x60, 0x09, 0xE0, 0x3F, 0x40, 0x01, 0x2A,
+	 0x03, 0x00, 0x60, 0x60, 0x1C, 0xE0, 0x02, 0x00, 0x80, 0x60, 0x1C, 0xE0, 0x40, 0xEC, 0x00, 0xED,
+	 0x02, 0xEE, 0x80, 0x60, 0x58, 0xEC, 0x80, 0x60, 0x00, 0xED, 0x80, 0x60, 0x82, 0xEE, 0xC0, 0x60,
+	 0x59, 0xEC, 0xC0, 0x60, 0x07, 0xED, 0xAD, 0x4F, 0xFE, 0xB4, 0xA0, 0x5D, 0x00, 0xF3, 0x28, 0xFB,
+	 0x40, 0x44, 0xA4, 0x60, 0x5D, 0x7C, 0x20, 0xF9, 0xA5, 0x60, 0x48, 0x7C, 0x21, 0xF9, 0xA7, 0x60,
+	 0x30, 0x7C, 0x22, 0xF9, 0xB0, 0x60, 0xCD, 0x7C, 0x23, 0xF9, 0xB5, 0x60, 0x6C, 0x7C, 0x24, 0xF9,
+	 0xC0, 0x60, 0x88, 0x7C, 0x25, 0xF9, 0xC6, 0x60, 0xE0, 0x7C, 0x26, 0xF9, 0x91, 0x60, 0x00, 0xE8,
+	 0x28, 0xE8, 0x44, 0x60, 0x02, 0xE6, 0x00, 0x64, 0x40, 0x52, 0x10, 0x60, 0x04, 0xE6, 0x08, 0x60,
+	 0x00, 0x63, 0xFA, 0x60, 0x00, 0x65, 0xBD, 0xD3, 0xBD, 0xD3, 0x02, 0xA8, 0xD4, 0x80, 0x47, 0x02,
+	 0x46, 0x02, 0xDB, 0x83, 0xFA, 0x60, 0x27, 0x65, 0x5B, 0xD3, 0xBF, 0xD1, 0x1A, 0x18, 0xC3, 0x83,
+	 0xD4, 0x80, 0xC3, 0x83, 0xF9, 0x02, 0xDB, 0x83, 0xD3, 0x83, 0xD3, 0x86, 0x64, 0x41, 0xCD, 0x81,
+	 0xA6, 0xD1, 0xDA, 0x86, 0x1C, 0x60, 0x68, 0x65, 0x00, 0x60, 0x72, 0x63, 0xA5, 0xD3, 0xDA, 0x85,
+	 0x90, 0x84, 0xFF, 0x27, 0x02, 0x00, 0xA2, 0xD9, 0x01, 0x00, 0xF8, 0x1F, 0xCD, 0x81, 0xFF, 0xFF,
+	 0xEF, 0x02, 0x08, 0x60, 0x06, 0x63, 0xFA, 0x60, 0x28, 0x65, 0x5B, 0xD3, 0xBF, 0xD1, 0x0B, 0x18,
+	 0xC3, 0x83, 0xD4, 0x80, 0xC3, 0x83, 0xF9, 0x02, 0xBF, 0xD3, 0x21, 0x60, 0x72, 0x62, 0x0E, 0xB4,
+	 0xE0, 0x84, 0xE0, 0x84, 0xA2, 0xDB, 0x08, 0x60, 0x06, 0x63, 0xFD, 0x60, 0x0C, 0x65, 0x5B, 0xD3,
+	 0xBF, 0xD1, 0x0D, 0x18, 0xC3, 0x83, 0xD4, 0x80, 0xC3, 0x83, 0xF9, 0x02, 0xFA, 0xA3, 0xA3, 0xD3,
+	 0x02, 0x60, 0x00, 0x65, 0xF7, 0xA0, 0xFC, 0xA0, 0x0A, 0x05, 0x01, 0x05, 0x00, 0x00, 0x21, 0x60,
+	 0x00, 0x65, 0x3F, 0x43, 0x3F, 0x43, 0x21, 0x60, 0x00, 0x65, 0xC0, 0x60, 0x8F, 0xEE, 0xB7, 0x84,
+	 0x40, 0x5F, 0x00, 0x60, 0x30, 0xE2, 0x00, 0x60, 0x50, 0xE2, 0x00, 0x60, 0x79, 0xE2, 0x00, 0x60,
+	 0x90, 0xE2, 0x01, 0x60, 0xD0, 0xE2, 0x01, 0x60, 0xF0, 0xE2, 0x01, 0x60, 0xB0, 0xE2, 0x26, 0x64,
+	 0x35, 0xFB, 0x01, 0x60, 0x30, 0x64, 0x0A, 0xA4, 0x38, 0xFB, 0x60, 0x45, 0x00, 0x60, 0xF8, 0x64,
+	 0x0A, 0xA4, 0x39, 0xFB, 0x35, 0xF1, 0x0A, 0x64, 0xC4, 0x84, 0x36, 0xFB, 0xC0, 0x84, 0x0A, 0xA4,
+	 0x37, 0xFB, 0x09, 0x60, 0x2A, 0x64, 0x99, 0xFB, 0x82, 0xFF, 0x92, 0xFF, 0x5C, 0x41, 0x5C, 0x46,
+	 0x5C, 0x47, 0x00, 0xE1, 0xA7, 0x60, 0x9B, 0x63, 0x0C, 0x60, 0x16, 0x64, 0xA0, 0xDD, 0x87, 0xFF,
+	 0x97, 0xFF, 0x0C, 0x60, 0x02, 0x64, 0x40, 0x5A, 0x06, 0xA4, 0x40, 0x5B, 0x5C, 0x5E, 0x5C, 0x51,
+	 0x1F, 0x60, 0xAA, 0x62, 0xA2, 0xD3, 0x65, 0xFB, 0x21, 0x60, 0xEC, 0x61, 0x27, 0x7C, 0xA1, 0xD9,
+	 0x25, 0x60, 0x2E, 0x63, 0x7F, 0xA3, 0xE3, 0x87, 0x00, 0x7F, 0x8A, 0xFB, 0x02, 0x60, 0x80, 0x66,
+	 0x22, 0x60, 0x22, 0x64, 0x77, 0x60, 0x77, 0x63, 0x00, 0xFA, 0x01, 0xFC, 0x00, 0xF0, 0x01, 0xF0,
+	 0xD0, 0x80, 0xD3, 0x80, 0x1E, 0x02, 0x1D, 0x02, 0x06, 0x60, 0x80, 0x65, 0x45, 0x4A, 0xAA, 0x46,
+	 0x00, 0xFC, 0x01, 0xFA, 0xAA, 0x46, 0x00, 0xF0, 0x2A, 0x41, 0x50, 0x65, 0xD3, 0x80, 0xCD, 0x84,
+	 0x13, 0x03, 0x0A, 0x60, 0x80, 0x65, 0x45, 0x4A, 0xAA, 0x46, 0x00, 0xFC, 0x01, 0xFA, 0xAA, 0x46,
+	 0x00, 0xF0, 0x65, 0x41, 0xC8, 0x65, 0xD3, 0x80, 0xCD, 0x84, 0x06, 0x03, 0x12, 0x60, 0x7F, 0x64,
+	 0x03, 0x00, 0x10, 0x65, 0x02, 0x60, 0x7F, 0x64, 0x65, 0x43, 0x87, 0xFD, 0x1B, 0x60, 0x72, 0x62,
+	 0xA2, 0xDD, 0x07, 0x61, 0xC5, 0x81, 0xE1, 0x85, 0xD4, 0x84, 0x8B, 0xFB, 0xDC, 0x84, 0x89, 0xFB,
+	 0x0C, 0xA4, 0x88, 0xFB, 0x1B, 0x60, 0x74, 0x62, 0xA2, 0xDB, 0xA2, 0x60, 0x58, 0x4E, 0x1F, 0x78,
+	 0xFF, 0xFF, 0xA2, 0x60, 0x58, 0x4E, 0x00, 0x78, 0xFF, 0xFF, 0x8B, 0xF1, 0x8A, 0xF3, 0x7C, 0x63,
+	 0x8D, 0xFB, 0x60, 0x46, 0x01, 0xFC, 0xDC, 0x84, 0xD0, 0x80, 0x00, 0xFA, 0xFA, 0x04, 0x8E, 0xFB,
+	 0x60, 0x46, 0x00, 0x64, 0x00, 0xFA, 0x63, 0x44, 0x80, 0x7F, 0x01, 0xFA, 0x8B, 0xF3, 0x8A, 0xF1,
+	 0xDC, 0x84, 0xD0, 0x84, 0x8C, 0xFB, 0x03, 0x60, 0x26, 0x61, 0xB3, 0x60, 0x58, 0x4D, 0x64, 0x78,
+	 0xFF, 0xFF, 0x66, 0x44, 0x2E, 0xFB, 0x82, 0xFF, 0x40, 0x42, 0x87, 0xFF, 0x8C, 0xF3, 0x94, 0xFB,
+	 0x00, 0x64, 0x12, 0x60, 0xC8, 0x63, 0xA3, 0xDB, 0x00, 0x64, 0x40, 0x50, 0x63, 0xFF, 0x66, 0xFF,
+	 0x65, 0xFF, 0x64, 0xFF, 0x61, 0xFF, 0x62, 0xFF, 0x49, 0x60, 0x02, 0xE1, 0x52, 0x60, 0x02, 0xE1,
+	 0x5B, 0x60, 0x02, 0xE1, 0x65, 0x60, 0x02, 0xE1, 0x6C, 0x60, 0x02, 0xE1, 0x76, 0x60, 0x02, 0xE1,
+	 0x41, 0x60, 0x02, 0xE1, 0x04, 0x65, 0x21, 0x60, 0x7E, 0x64, 0x44, 0xD3, 0xEA, 0x60, 0x58, 0x4E,
+	 0x78, 0x78, 0xFF, 0xFF, 0x1C, 0x60, 0x04, 0x65, 0x0C, 0x64, 0xA5, 0xDB, 0xA3, 0x60, 0xED, 0x64,
+	 0x80, 0xFB, 0x2D, 0xFF, 0x0A, 0x61, 0x41, 0x4B, 0x09, 0x60, 0x08, 0x61, 0xB3, 0x60, 0x58, 0x4D,
+	 0x64, 0x78, 0xFF, 0xFF, 0xF0, 0x67, 0x0E, 0xFA, 0x1B, 0x60, 0xE0, 0x62, 0x1B, 0x60, 0xC4, 0x64,
+	 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0x2B, 0x41,
+	 0x4D, 0x8B, 0xFF, 0xFF, 0xE9, 0x02, 0x0A, 0x61, 0x41, 0x4B, 0x09, 0x60, 0x08, 0x61, 0xB3, 0x60,
+	 0x58, 0x4D, 0x64, 0x78, 0xFF, 0xFF, 0x1B, 0x60, 0xE0, 0x62, 0x1B, 0x60, 0xB8, 0x64, 0xA2, 0xDB,
+	 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0x2B, 0x41, 0x4D, 0x8B,
+	 0xFF, 0xFF, 0xEB, 0x02, 0xEB, 0x60, 0x4E, 0x78, 0xFF, 0xFF, 0x00, 0xEA, 0x00, 0xEB, 0x50, 0x60,
+	 0x03, 0xEA, 0x51, 0x60, 0x13, 0xEA, 0x52, 0x60, 0x30, 0xEA, 0x53, 0x60, 0x40, 0xEA, 0x54, 0x60,
+	 0x52, 0xEA, 0x55, 0x60, 0x6D, 0xEA, 0x56, 0x60, 0x71, 0xEA, 0x57, 0x60, 0x8B, 0xEA, 0x58, 0x60,
+	 0x47, 0xEA, 0x59, 0x60, 0xA0, 0xEA, 0x5A, 0x60, 0xB2, 0xEA, 0x5B, 0x60, 0xC1, 0xEA, 0x5C, 0x60,
+	 0xD7, 0xEA, 0x5D, 0x60, 0xEB, 0xEA, 0x5E, 0x60, 0xA0, 0xEA, 0x50, 0x60, 0x36, 0xEB, 0x51, 0x60,
+	 0x37, 0xEB, 0x52, 0x60, 0x20, 0xEB, 0x53, 0x60, 0xE4, 0xEB, 0x54, 0x60, 0x34, 0xEB, 0x55, 0x60,
+	 0x58, 0xEB, 0x56, 0x60, 0x48, 0xEB, 0x57, 0x60, 0xD0, 0xEB, 0x58, 0x60, 0xC3, 0xEB, 0x59, 0x60,
+	 0xFC, 0xEB, 0x5A, 0x60, 0x34, 0xEB, 0x5B, 0x60, 0x58, 0xEB, 0x5C, 0x60, 0xC0, 0xEB, 0x5D, 0x60,
+	 0xD0, 0xEB, 0x5E, 0x60, 0x91, 0xEB, 0x00, 0xEA, 0x00, 0xEB, 0xE0, 0x60, 0x02, 0xEA, 0xE0, 0x60,
+	 0x03, 0xEB, 0xA0, 0x60, 0x00, 0xEB, 0xB0, 0x60, 0x00, 0xEB, 0xAB, 0x48, 0x40, 0x3B, 0x01, 0x00,
+	 0xFC, 0x01, 0x00, 0xEB, 0x03, 0x60, 0x02, 0x62, 0x62, 0x44, 0xA2, 0xDB, 0x0F, 0x64, 0x60, 0x7F,
+	 0xA0, 0x5A, 0x80, 0x60, 0x00, 0xEA, 0xA0, 0x60, 0x00, 0xEA, 0xD1, 0x60, 0x00, 0xEA, 0x3F, 0x40,
+	 0x40, 0x26, 0x08, 0x00, 0x00, 0x60, 0x18, 0x64, 0x00, 0x60, 0x00, 0x65, 0x94, 0x84, 0xA0, 0x50,
+	 0x1D, 0x60, 0x19, 0xE2, 0x24, 0x44, 0xFF, 0xB4, 0x04, 0xFB, 0x50, 0x60, 0x00, 0x64, 0x05, 0xFB,
+	 0x10, 0x60, 0x10, 0x75, 0xEB, 0x60, 0x84, 0x78, 0xFF, 0xFF, 0x80, 0xFF, 0x90, 0xFF, 0x98, 0xFF,
+	 0x23, 0x60, 0x5C, 0x63, 0x20, 0x44, 0xBD, 0xDB, 0x21, 0x44, 0xBD, 0xDB, 0x22, 0x44, 0xBD, 0xDB,
+	 0x23, 0x44, 0xBD, 0xDB, 0x24, 0x44, 0xBD, 0xDB, 0x25, 0x44, 0xBD, 0xDB, 0x26, 0x44, 0xBD, 0xDB,
+	 0x27, 0x44, 0xBD, 0xDB, 0x28, 0x44, 0xBD, 0xDB, 0x29, 0x44, 0xBD, 0xDB, 0x2A, 0x44, 0xBD, 0xDB,
+	 0x2B, 0x44, 0xBD, 0xDB, 0x2C, 0x44, 0xBD, 0xDB, 0x2D, 0x44, 0xBD, 0xDB, 0x2E, 0x44, 0xBD, 0xDB,
+	 0x2F, 0x44, 0xBD, 0xDB, 0x23, 0x60, 0x50, 0x64, 0xA0, 0xDD, 0x24, 0x60, 0x7C, 0x63, 0x23, 0x60,
+	 0x52, 0x64, 0xA0, 0xDD, 0x23, 0x60, 0x54, 0x63, 0x30, 0x44, 0xA3, 0xDB, 0x23, 0x60, 0x56, 0x63,
+	 0x31, 0x44, 0xA3, 0xDB, 0x23, 0x60, 0x58, 0x63, 0x32, 0x44, 0xA3, 0xDB, 0x23, 0x60, 0x5A, 0x63,
+	 0x33, 0x44, 0xA3, 0xDB, 0x81, 0xFF, 0x91, 0xFF, 0x58, 0x51, 0x48, 0x00, 0x82, 0xFF, 0x92, 0xFF,
+	 0x58, 0x51, 0x44, 0x00, 0x83, 0xFF, 0x93, 0xFF, 0x58, 0x51, 0x40, 0x00, 0x84, 0xFF, 0x94, 0xFF,
+	 0x58, 0x51, 0x3C, 0x00, 0x85, 0xFF, 0x95, 0xFF, 0x58, 0x51, 0x38, 0x00, 0x86, 0xFF, 0x96, 0xFF,
+	 0x58, 0x51, 0x34, 0x00, 0x87, 0xFF, 0x97, 0xFF, 0x58, 0x51, 0x30, 0x00, 0x80, 0xFF, 0x90, 0xFF,
+	 0x99, 0xFF, 0x23, 0x60, 0x50, 0x64, 0xA0, 0xD1, 0x30, 0x44, 0x64, 0x43, 0xBD, 0xDB, 0x31, 0x44,
+	 0xBD, 0xDB, 0x32, 0x44, 0xBD, 0xDB, 0x33, 0x44, 0xBD, 0xDB, 0x34, 0x44, 0xBD, 0xDB, 0x35, 0x44,
+	 0xBD, 0xDB, 0x36, 0x44, 0xBD, 0xDB, 0x37, 0x44, 0xBD, 0xDB, 0x38, 0x44, 0xBD, 0xDB, 0x39, 0x44,
+	 0xBD, 0xDB, 0x3A, 0x44, 0xBD, 0xDB, 0x3B, 0x44, 0xBD, 0xDB, 0x3C, 0x44, 0xBD, 0xDB, 0x3D, 0x44,
+	 0xBD, 0xDB, 0x3E, 0x44, 0xBD, 0xDB, 0x3F, 0x44, 0xBD, 0xDB, 0xE3, 0x60, 0x50, 0x64, 0x0A, 0xFB,
+	 0x40, 0x21, 0xFE, 0x01, 0xA1, 0xFF, 0xFF, 0xFF, 0x78, 0x01, 0xFF, 0xFF, 0x42, 0x50, 0x40, 0x53,
+	 0x23, 0x60, 0x52, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0x40, 0x52, 0x33, 0x44, 0x32, 0x42, 0xA2, 0xDB,
+	 0xDA, 0x82, 0xA2, 0xDD, 0xDA, 0x83, 0x65, 0x44, 0xBD, 0xDB, 0x61, 0x44, 0xBD, 0xDB, 0x66, 0x44,
+	 0xBD, 0xDB, 0xBD, 0xD9, 0x30, 0x44, 0xBD, 0xDB, 0x99, 0xFF, 0xA4, 0x4C, 0xBD, 0xDB, 0xA5, 0x4C,
+	 0xBD, 0xDB, 0xA0, 0x4C, 0xBD, 0xDB, 0xA1, 0x4C, 0xBD, 0xDB, 0x98, 0xFF, 0x23, 0x60, 0x52, 0x64,
+	 0xA0, 0xDD, 0x23, 0x60, 0x54, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0x40, 0x50, 0x23, 0x60, 0x58, 0x62,
+	 0xA2, 0xD3, 0xFF, 0xFF, 0x40, 0x52, 0x23, 0x60, 0x5A, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0x40, 0x53,
+	 0x31, 0x41, 0x23, 0x60, 0x56, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0x40, 0x51, 0x23, 0x60, 0x50, 0x62,
+	 0xA2, 0xD3, 0xFF, 0xFF, 0x60, 0x43, 0x20, 0x44, 0xBD, 0xDB, 0x21, 0x44, 0xBD, 0xDB, 0x22, 0x44,
+	 0xBD, 0xDB, 0x23, 0x44, 0xBD, 0xDB, 0x24, 0x44, 0xBD, 0xDB, 0x25, 0x44, 0xBD, 0xDB, 0x26, 0x44,
+	 0xBD, 0xDB, 0x27, 0x44, 0xBD, 0xDB, 0x28, 0x44, 0xBD, 0xDB, 0x29, 0x44, 0xBD, 0xDB, 0x2A, 0x44,
+	 0xBD, 0xDB, 0x2B, 0x44, 0xBD, 0xDB, 0x2C, 0x44, 0xBD, 0xDB, 0x2D, 0x44, 0xBD, 0xDB, 0x2E, 0x44,
+	 0xBD, 0xDB, 0x2F, 0x44, 0xBD, 0xDB, 0x23, 0x60, 0x50, 0x64, 0xA0, 0xDD, 0x61, 0x58, 0xFF, 0xFF,
+	 0x30, 0x44, 0x02, 0xA8, 0x00, 0xE1, 0x07, 0x02, 0x62, 0xFF, 0x63, 0xFF, 0x64, 0xFF, 0x65, 0xFF,
+	 0x66, 0xFF, 0xBF, 0xFE, 0xA1, 0xFF, 0x82, 0xFF, 0x88, 0xFF, 0x6C, 0x40, 0x41, 0xFF, 0xC4, 0xE2,
+	 0x43, 0xFF, 0x5C, 0x49, 0x08, 0xE1, 0xA5, 0x60, 0x5E, 0x78, 0xFF, 0xFF, 0xA1, 0xFF, 0x98, 0xFF,
+	 0x80, 0x3E, 0x9F, 0xFE, 0x03, 0x04, 0xA6, 0x60, 0x28, 0x78, 0xFF, 0xFF, 0xE2, 0xFE, 0x40, 0x05,
+	 0xE0, 0xFE, 0x5B, 0x05, 0xE1, 0xFE, 0xF2, 0x04, 0x29, 0x40, 0x08, 0x26, 0xEF, 0x01, 0x72, 0x44,
+	 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0x95, 0xF3, 0xE8, 0x85, 0xFF, 0xB7,
+	 0xE0, 0x84, 0xE0, 0x84, 0xB4, 0x85, 0x73, 0x44, 0xD4, 0x84, 0x10, 0x65, 0xD4, 0x80, 0xFF, 0xFF,
+	 0x26, 0x04, 0x3F, 0x40, 0x40, 0x26, 0x13, 0x00, 0x0B, 0x60, 0xF8, 0x62, 0xA2, 0xD1, 0x00, 0x60,
+	 0x10, 0x64, 0x90, 0x84, 0xA0, 0x50, 0xF8, 0xA2, 0xA2, 0xD1, 0x0A, 0x60, 0x19, 0x64, 0x90, 0x84,
+	 0xA0, 0x52, 0x06, 0xA2, 0xA2, 0xD1, 0x46, 0x60, 0x09, 0x64, 0x90, 0x84, 0xA0, 0x50, 0xD2, 0xF4,
+	 0x25, 0x60, 0x16, 0x7C, 0x63, 0x40, 0x01, 0x26, 0x08, 0x00, 0xA4, 0xD3, 0xFF, 0xFF, 0x01, 0xB4,
+	 0xFF, 0xFF, 0x03, 0x02, 0xAD, 0x4F, 0xFE, 0xB4, 0xA0, 0x5D, 0x02, 0xEE, 0xBD, 0xFE, 0xBE, 0x01,
+	 0x21, 0x46, 0x5E, 0x62, 0x9A, 0xFF, 0x07, 0xE1, 0xA1, 0xFF, 0xFF, 0xFF, 0x06, 0x25, 0x10, 0x00,
+	 0xA2, 0xDC, 0x7A, 0xDC, 0x7A, 0xDC, 0x62, 0x62, 0x01, 0x5D, 0x7A, 0xDC, 0x7A, 0xDC, 0x7A, 0xDC,
+	 0x7A, 0xDC, 0x44, 0xFF, 0x06, 0x25, 0x04, 0x00, 0x0E, 0xE1, 0x02, 0x60, 0x01, 0xE1, 0x9E, 0x01,
+	 0x62, 0xFF, 0xC4, 0xE2, 0x41, 0xFF, 0x0A, 0xE1, 0x99, 0x01, 0xC8, 0x74, 0xCD, 0xE2, 0x29, 0x44,
+	 0x08, 0xBC, 0x40, 0x49, 0x05, 0xE1, 0x25, 0x60, 0x18, 0x63, 0xA3, 0xD3, 0xD2, 0xF3, 0x06, 0x18,
+	 0x28, 0x40, 0x08, 0x2A, 0x05, 0x00, 0x28, 0x40, 0x48, 0x36, 0x02, 0x00, 0x02, 0xBC, 0xD2, 0xFB,
+	 0x3F, 0x40, 0x01, 0x2B, 0xFF, 0xFF, 0xA1, 0xFF, 0x67, 0x4C, 0x06, 0x61, 0xCD, 0x81, 0x04, 0x25,
+	 0x30, 0x00, 0x87, 0x4C, 0xFB, 0x02, 0x28, 0x40, 0x40, 0x2B, 0x02, 0x00, 0x15, 0x60, 0x6F, 0x6B,
+	 0xF3, 0x60, 0xA0, 0x64, 0x04, 0x25, 0x25, 0x00, 0x80, 0x4C, 0x30, 0x64, 0x3A, 0xDB, 0x44, 0xFF,
+	 0x04, 0x25, 0x1F, 0x00, 0x04, 0x60, 0x00, 0x65, 0x25, 0x44, 0x37, 0x36, 0xB4, 0x84, 0x6E, 0x36,
+	 0xB4, 0x84, 0x80, 0x4E, 0x24, 0x41, 0x04, 0x25, 0x14, 0x00, 0x61, 0x4C, 0x64, 0xA1, 0x61, 0x54,
+	 0xA1, 0xFF, 0xFF, 0xFF, 0x04, 0x25, 0x0D, 0x00, 0x67, 0x4E, 0x07, 0x64, 0x1C, 0xFB, 0x00, 0xE1,
+	 0x02, 0x60, 0x01, 0xE1, 0x53, 0x01, 0x33, 0xF3, 0xFD, 0x11, 0xFC, 0x18, 0x40, 0x64, 0x3A, 0xDB,
+	 0x0A, 0x00, 0xC4, 0xE2, 0x27, 0x44, 0x20, 0x2A, 0x04, 0x00, 0x42, 0x64, 0x3A, 0xDB, 0x67, 0x4C,
+	 0x02, 0x00, 0x41, 0x64, 0x3A, 0xDB, 0x62, 0xFF, 0x08, 0xE1, 0xE2, 0xFE, 0x72, 0x52, 0x5C, 0x49,
+	 0x32, 0x7B, 0x4D, 0xE2, 0x3B, 0x01, 0x08, 0xE1, 0x39, 0x01, 0xA1, 0xFF, 0x98, 0xFF, 0x80, 0x3E,
+	 0x00, 0x60, 0x46, 0x74, 0xCD, 0xE2, 0x04, 0xE1, 0x02, 0x60, 0x00, 0xE1, 0x3F, 0x44, 0x40, 0x26,
+	 0x0B, 0x00, 0x01, 0x2A, 0x05, 0x00, 0x42, 0x60, 0x09, 0xE0, 0x60, 0x60, 0x1C, 0xE0, 0x04, 0x00,
+	 0x42, 0x60, 0x09, 0xE0, 0x80, 0x60, 0x1C, 0xE0, 0x04, 0x29, 0xFE, 0x01, 0xC4, 0xE2, 0x43, 0x64,
+	 0x3A, 0xDB, 0x83, 0xF3, 0xFF, 0xFF, 0x60, 0x41, 0x3F, 0x44, 0x02, 0x27, 0x84, 0x00, 0x20, 0x2B,
+	 0xFF, 0x01, 0x80, 0xE1, 0x95, 0x60, 0x80, 0xE7, 0x61, 0x40, 0x40, 0x2B, 0x0D, 0x00, 0x05, 0x63,
+	 0xA7, 0x60, 0x58, 0x4F, 0x1D, 0x78, 0xFF, 0xFF, 0x28, 0x63, 0xFF, 0xFF, 0xFE, 0x1F, 0x01, 0x63,
+	 0xA7, 0x60, 0x58, 0x4F, 0x1D, 0x78, 0xFF, 0xFF, 0xFF, 0xB1, 0xCD, 0x81, 0xE1, 0x85, 0x1E, 0x60,
+	 0xA2, 0x64, 0x44, 0xD1, 0xFF, 0xFF, 0x64, 0x43, 0xA7, 0x60, 0x58, 0x4F, 0x1D, 0x78, 0xFF, 0xFF,
+	 0x00, 0x60, 0x00, 0x63, 0xA7, 0x60, 0x58, 0x4F, 0x1D, 0x78, 0xFF, 0xFF, 0x1E, 0x60, 0xBE, 0x61,
+	 0x21, 0x60, 0x72, 0x62, 0xA2, 0xD3, 0x45, 0xD1, 0x47, 0xBC, 0xE0, 0x84, 0x62, 0x45, 0x64, 0x5F,
+	 0xE8, 0x83, 0xA7, 0x60, 0x58, 0x4F, 0x1D, 0x78, 0xFF, 0xFF, 0x82, 0xF3, 0xCD, 0xE2, 0x60, 0x54,
+	 0x04, 0xE1, 0x04, 0x29, 0xFE, 0x01, 0xC4, 0xE2, 0x15, 0x60, 0xA2, 0xE7, 0x38, 0x69, 0xFF, 0xFF,
+	 0x68, 0x44, 0x01, 0x16, 0xFD, 0x01, 0x01, 0x2A, 0x36, 0x00, 0x03, 0x60, 0x80, 0x7C, 0xA3, 0x83,
+	 0x21, 0x60, 0x72, 0x62, 0xA2, 0xD1, 0x43, 0xBB, 0xB3, 0x83, 0x95, 0x60, 0x80, 0xE7, 0xA7, 0x60,
+	 0x58, 0x4F, 0x1D, 0x78, 0xFF, 0xFF, 0xE3, 0x83, 0x15, 0x60, 0xA2, 0xE7, 0x38, 0x69, 0xFF, 0xFF,
+	 0x68, 0x41, 0x01, 0x16, 0xFD, 0x01, 0x63, 0x47, 0x61, 0x40, 0x01, 0x2A, 0x03, 0x00, 0x00, 0x3A,
+	 0xCC, 0x84, 0x02, 0x00, 0x07, 0x3A, 0xDC, 0x84, 0xFF, 0xB4, 0xA5, 0xDB, 0x60, 0x47, 0xE8, 0x84,
+	 0x47, 0x65, 0x21, 0x60, 0x72, 0x62, 0xA2, 0xD3, 0xB4, 0x85, 0xB4, 0x83, 0x80, 0xE1, 0x95, 0x60,
+	 0x80, 0xE7, 0xA7, 0x60, 0x58, 0x4F, 0x1D, 0x78, 0xFF, 0xFF, 0x82, 0xF3, 0xCD, 0xE2, 0x60, 0x54,
+	 0x04, 0x29, 0xFE, 0x01, 0xC4, 0xE2, 0x83, 0xF3, 0xFF, 0xFF, 0xFF, 0xFF, 0x80, 0x2B, 0x04, 0x00,
+	 0xA6, 0x60, 0xF6, 0x78, 0xFF, 0xFF, 0xFF, 0x01, 0x83, 0xF3, 0x80, 0xE1, 0xCC, 0x84, 0xE0, 0x85,
+	 0x15, 0x60, 0xA2, 0xE7, 0x1D, 0x60, 0xDE, 0x64, 0x58, 0x4F, 0x4F, 0x00, 0x1D, 0x60, 0xFA, 0x64,
+	 0x58, 0x4F, 0x4B, 0x00, 0x1E, 0x60, 0x16, 0x64, 0x58, 0x4F, 0x47, 0x00, 0x1E, 0x60, 0x32, 0x64,
+	 0x58, 0x4F, 0x43, 0x00, 0x1E, 0x60, 0x4E, 0x64, 0x58, 0x4F, 0x3F, 0x00, 0x1E, 0x60, 0x6A, 0x64,
+	 0x58, 0x4F, 0x3B, 0x00, 0x1E, 0x60, 0x86, 0x64, 0x58, 0x4F, 0x37, 0x00, 0x01, 0x68, 0xFF, 0x6A,
+	 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x3F, 0x44, 0x20, 0x27, 0x00, 0x00, 0x3F, 0x40, 0x40, 0x26,
+	 0x08, 0x00, 0x00, 0x60, 0x18, 0x64, 0x00, 0x60, 0x00, 0x65, 0x94, 0x84, 0xA0, 0x50, 0x1D, 0x60,
+	 0x19, 0xE2, 0xC4, 0xE2, 0x00, 0x63, 0x82, 0xFD, 0x32, 0x7B, 0x4D, 0xE2, 0xBF, 0xFE, 0xC4, 0xE2,
+	 0x41, 0xFF, 0xE0, 0xFE, 0xE1, 0xFE, 0xE2, 0xFE, 0x43, 0xFF, 0x44, 0xFF, 0x46, 0xFF, 0x84, 0xF3,
+	 0x62, 0xFF, 0x60, 0x40, 0x05, 0x36, 0x2D, 0xFF, 0x07, 0x36, 0xD5, 0xFE, 0x08, 0xE1, 0x88, 0x60,
+	 0x85, 0x71, 0x8D, 0xE2, 0xA5, 0x60, 0x5E, 0x78, 0xFF, 0xFF, 0x50, 0xEC, 0x63, 0x4A, 0xFF, 0xFF,
+	 0x01, 0x16, 0xFE, 0x01, 0x40, 0xEC, 0x2F, 0x58, 0xFF, 0xFF, 0x44, 0xD3, 0x80, 0x7C, 0x60, 0x48,
+	 0x60, 0x47, 0x00, 0x7F, 0xB0, 0x8A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x30, 0x44, 0x02, 0xA8, 0x00, 0xE1, 0x02, 0x02, 0xA1, 0xFF, 0xFF, 0xFF, 0x82, 0xFF, 0x88, 0xFF,
+	 0x48, 0xE2, 0x01, 0x70, 0xAE, 0xF1, 0x00, 0x6B, 0x89, 0xFF, 0x64, 0x54, 0x88, 0xFF, 0x9F, 0xFE,
+	 0x02, 0x05, 0x64, 0x44, 0x60, 0x54, 0xCD, 0xE2, 0xC2, 0x64, 0x3A, 0xDB, 0xBC, 0xFF, 0xB5, 0xFF,
+	 0x1D, 0xFF, 0x26, 0x44, 0x02, 0xB4, 0x40, 0x46, 0x3C, 0x44, 0x00, 0xBC, 0xFF, 0xFF, 0x06, 0x03,
+	 0x27, 0x40, 0x26, 0x22, 0x03, 0x00, 0x02, 0x64, 0x31, 0xFB, 0xC0, 0xFE, 0x27, 0x44, 0x20, 0x2A,
+	 0x04, 0x00, 0xA0, 0x60, 0x00, 0xEA, 0xB0, 0x60, 0x00, 0xEA, 0x5C, 0x4D, 0x27, 0x44, 0x18, 0xB4,
+	 0x40, 0x47, 0x00, 0xE1, 0x6C, 0x40, 0x44, 0xE2, 0xC4, 0xE2, 0x47, 0xFF, 0xB7, 0xFF, 0xB4, 0xFF,
+	 0x32, 0xF1, 0x08, 0x29, 0x09, 0x00, 0x64, 0x40, 0x07, 0x22, 0x06, 0x00, 0x43, 0xFF, 0x27, 0x44,
+	 0x10, 0xBC, 0x40, 0x47, 0x00, 0x64, 0x32, 0xFB, 0x31, 0x41, 0x3C, 0x44, 0x01, 0xB1, 0x00, 0xBC,
+	 0x0A, 0x02, 0x09, 0x03, 0x32, 0xF3, 0x00, 0x7C, 0x01, 0xB4, 0xFF, 0xFF, 0x04, 0x03, 0x32, 0xF9,
+	 0x02, 0x64, 0x31, 0xFB, 0xC0, 0xFE, 0x48, 0x60, 0x2D, 0x7D, 0x08, 0x60, 0x00, 0x6B, 0x00, 0x64,
+	 0x33, 0xFB, 0x0C, 0x60, 0x16, 0x64, 0xA0, 0xD7, 0xFF, 0xFF, 0xFF, 0xFF, 0x32, 0xF3, 0x08, 0x29,
+	 0x0A, 0x00, 0x60, 0x40, 0x07, 0x22, 0x07, 0x00, 0xFE, 0xB4, 0x32, 0xFB, 0x27, 0x44, 0x10, 0xBC,
+	 0xF7, 0xB4, 0x40, 0x47, 0x43, 0xFF, 0x00, 0x64, 0x3A, 0xDB, 0x01, 0x60, 0x08, 0xE1, 0x31, 0x40,
+	 0x01, 0x2A, 0x04, 0x00, 0x00, 0x64, 0x33, 0xFB, 0x01, 0x60, 0x0A, 0xE1, 0xE5, 0xFE, 0x13, 0x05,
+	 0x27, 0x44, 0x10, 0x26, 0x13, 0x00, 0x9F, 0xFE, 0x02, 0x04, 0x02, 0xE1, 0x06, 0x00, 0x3E, 0xE1,
+	 0x31, 0x44, 0x01, 0x2A, 0x02, 0x00, 0x04, 0x0A, 0xBF, 0xE1, 0xA1, 0xFF, 0xFF, 0xFF, 0x81, 0x3E,
+	 0xAF, 0x60, 0x19, 0x78, 0xFF, 0xFF, 0xA8, 0x60, 0x09, 0x78, 0xFF, 0xFF, 0x27, 0x44, 0x08, 0x26,
+	 0xFF, 0xFF, 0xBF, 0x60, 0x2A, 0x78, 0xFF, 0xFF, 0x48, 0xF3, 0x32, 0xF1, 0x00, 0x63, 0x64, 0x40,
+	 0x03, 0x22, 0x3D, 0x00, 0x31, 0x40, 0x08, 0x26, 0xF4, 0x01, 0xCD, 0xE2, 0x84, 0xE1, 0x70, 0x41,
+	 0xAD, 0x80, 0x71, 0x40, 0x80, 0x27, 0xED, 0x12, 0x03, 0x03, 0xBF, 0x60, 0x7C, 0x78, 0xFF, 0xFF,
+	 0xA1, 0xFF, 0xFF, 0xFF, 0xC4, 0xE2, 0x32, 0xFD, 0x60, 0x40, 0x01, 0x2A, 0xDF, 0x01, 0x00, 0x63,
+	 0x32, 0xFD, 0x6C, 0x40, 0x3C, 0x46, 0x3E, 0xF2, 0x2A, 0xF0, 0x27, 0x41, 0x44, 0x48, 0x20, 0xB9,
+	 0x01, 0xB4, 0xF7, 0xB1, 0x0A, 0x03, 0x64, 0x40, 0x08, 0x27, 0x07, 0x00, 0x0F, 0x60, 0x92, 0x63,
+	 0x00, 0x64, 0x45, 0xFB, 0x46, 0xFB, 0xBD, 0xDB, 0xA3, 0xDB, 0xCB, 0x0A, 0x41, 0x47, 0x3F, 0x40,
+	 0x01, 0x2B, 0x04, 0x00, 0xF6, 0xFE, 0x67, 0x4C, 0x05, 0x60, 0x69, 0x6B, 0x02, 0xE1, 0x01, 0x60,
+	 0x08, 0xE1, 0xF0, 0xFE, 0x84, 0xFF, 0xBF, 0x60, 0xAD, 0x64, 0x40, 0x42, 0x82, 0xFF, 0xE5, 0xFE,
+	 0x03, 0x04, 0xAC, 0x60, 0x41, 0x78, 0xFF, 0xFF, 0xE4, 0xFE, 0x0A, 0x04, 0x1D, 0xFF, 0x00, 0xEB,
+	 0x60, 0x7F, 0xA0, 0x5A, 0x80, 0x60, 0x00, 0xEA, 0xA0, 0x60, 0x00, 0xEA, 0xD1, 0x60, 0x00, 0xEA,
+	 0x43, 0xFF, 0xE6, 0xFE, 0x03, 0x05, 0xA7, 0x60, 0x9B, 0x78, 0xFF, 0xFF, 0x3C, 0x44, 0x60, 0x46,
+	 0x0F, 0xF0, 0x40, 0x42, 0x64, 0x40, 0x01, 0x2A, 0x03, 0x00, 0xAB, 0x60, 0x03, 0x78, 0xFF, 0xFF,
+	 0x0B, 0x64, 0x3A, 0xDB, 0x1C, 0x42, 0x22, 0x46, 0x13, 0xF2, 0xFF, 0x65, 0x60, 0x47, 0x2A, 0xF2,
+	 0x40, 0x45, 0x40, 0x48, 0x04, 0x2B, 0x17, 0x00, 0x16, 0xF2, 0x1D, 0xF2, 0x40, 0x43, 0x0F, 0xF2,
+	 0x40, 0x44, 0x25, 0x5E, 0x3F, 0x40, 0x01, 0x27, 0x40, 0x45, 0x0F, 0x64, 0x14, 0xF0, 0x35, 0xF2,
+	 0xA0, 0x82, 0x0F, 0xB4, 0xCA, 0x85, 0xD4, 0x80, 0x10, 0xF2, 0x01, 0x02, 0x2B, 0xFA, 0x27, 0x44,
+	 0x40, 0xBC, 0x40, 0x47, 0x13, 0x00, 0x17, 0xF2, 0x2C, 0xF0, 0x40, 0x43, 0x1B, 0xF2, 0x1D, 0xFA,
+	 0x40, 0x44, 0x64, 0x40, 0x01, 0x2A, 0x02, 0x00, 0xAB, 0xFC, 0x05, 0x00, 0x28, 0x40, 0xA4, 0x36,
+	 0x02, 0x00, 0x11, 0xF2, 0x2B, 0xFA, 0x27, 0x44, 0xBF, 0xB4, 0x40, 0x47, 0x28, 0x40, 0x40, 0x2B,
+	 0xFF, 0xFF, 0xAF, 0x60, 0x2E, 0x78, 0xFF, 0xFF, 0x22, 0x46, 0x2C, 0xF0, 0x27, 0x44, 0xDF, 0xB4,
+	 0x40, 0x47, 0xB5, 0xFF, 0xBC, 0xFF, 0x47, 0xFF, 0xB7, 0xFF, 0xB4, 0xFF, 0x48, 0x60, 0x2D, 0x7D,
+	 0x08, 0x60, 0x00, 0x6B, 0x64, 0x40, 0x01, 0x2A, 0x01, 0x00, 0x13, 0x00, 0x2A, 0xF0, 0x01, 0x65,
+	 0x64, 0x40, 0xA4, 0x3A, 0x04, 0x65, 0x27, 0x44, 0x34, 0x87, 0x36, 0xF3, 0xB4, 0xFF, 0x60, 0x5B,
+	 0x4D, 0xE2, 0x04, 0x64, 0x3A, 0xDB, 0x01, 0x60, 0x0A, 0xE1, 0x2B, 0xE1, 0xA1, 0xFF, 0xFF, 0xFF,
+	 0x81, 0x3E, 0x06, 0x64, 0x3A, 0xDB, 0x22, 0x46, 0x01, 0x64, 0x31, 0xFB, 0xC0, 0xFE, 0xBF, 0x60,
+	 0x85, 0x78, 0xFF, 0xFF, 0xB5, 0xFF, 0xA1, 0xFF, 0x6C, 0x40, 0x3F, 0x40, 0x01, 0x2B, 0x03, 0x00,
+	 0x67, 0x4C, 0x05, 0x60, 0x69, 0x6B, 0x02, 0xE1, 0x01, 0x60, 0x08, 0xE1, 0xC4, 0xE2, 0x08, 0x64,
+	 0x3A, 0xDB, 0xF0, 0xFE, 0x25, 0x46, 0x01, 0xF2, 0x61, 0x45, 0xD4, 0x9E, 0x21, 0x46, 0x16, 0xFA,
+	 0x2A, 0x44, 0x72, 0x45, 0x24, 0xFA, 0x95, 0xF3, 0x06, 0x04, 0xE4, 0xE2, 0xDC, 0x9C, 0x29, 0x40,
+	 0x01, 0x26, 0x64, 0x44, 0x95, 0xF9, 0x25, 0xFA, 0x96, 0xF3, 0x02, 0x04, 0xDC, 0x84, 0x96, 0xFB,
+	 0x28, 0xFA, 0x97, 0xF3, 0x02, 0x04, 0xDC, 0x84, 0x97, 0xFB, 0x29, 0xFA, 0x2D, 0x44, 0x04, 0x2A,
+	 0x06, 0x00, 0x28, 0x40, 0xA4, 0x36, 0x03, 0x00, 0xA9, 0x60, 0xC9, 0x78, 0xFF, 0xFF, 0x94, 0xFC,
+	 0x1F, 0x60, 0x9A, 0x65, 0xA5, 0xD1, 0x28, 0x44, 0x08, 0x2A, 0x51, 0x00, 0x03, 0x2B, 0x01, 0x00,
+	 0x4E, 0x00, 0x64, 0x40, 0x00, 0x36, 0x4B, 0x00, 0x32, 0xF2, 0x2F, 0xF0, 0x50, 0xFE, 0x01, 0x2A,
+	 0x03, 0x00, 0x01, 0x61, 0x8F, 0xF3, 0x31, 0x00, 0xD0, 0x80, 0x33, 0xF2, 0x30, 0xF0, 0x34, 0xF2,
+	 0xD0, 0x80, 0x31, 0xF0, 0xFF, 0xFF, 0xD0, 0x80, 0x60, 0x47, 0x34, 0x0C, 0xFF, 0xB4, 0x12, 0x60,
+	 0xCE, 0x65, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD3, 0xFF, 0xFF, 0x31, 0x18, 0x60, 0x43, 0x50, 0xFE,
+	 0x66, 0x41, 0x32, 0xF0, 0x63, 0x46, 0x03, 0xF2, 0x61, 0x46, 0xD0, 0x80, 0x33, 0xF0, 0x63, 0x46,
+	 0x04, 0xF2, 0x61, 0x46, 0xD0, 0x80, 0x34, 0xF0, 0x63, 0x46, 0x05, 0xF2, 0xFF, 0xFF, 0xD0, 0x80,
+	 0xFF, 0xFF, 0x04, 0x0C, 0x00, 0xF2, 0x61, 0x46, 0x1A, 0x18, 0xE8, 0x01, 0x06, 0xF0, 0x8F, 0xF3,
+	 0x61, 0x46, 0x02, 0x61, 0x64, 0x40, 0x02, 0x2A, 0x12, 0x00, 0xFC, 0xA0, 0xFF, 0xFF, 0x04, 0x0E,
+	 0x61, 0x44, 0x14, 0xFA, 0x11, 0xFC, 0x0B, 0x00, 0x2C, 0xF2, 0x2F, 0xFA, 0x2D, 0xF2, 0x30, 0xFA,
+	 0x2E, 0xF2, 0x31, 0xFA, 0x1D, 0xFF, 0x26, 0x44, 0x02, 0xBC, 0x40, 0x46, 0x20, 0x00, 0x26, 0x43,
+	 0x84, 0xBB, 0xFC, 0xB3, 0x21, 0x46, 0x01, 0x5D, 0x0F, 0xFC, 0x5C, 0x46, 0x25, 0x44, 0x06, 0xFA,
+	 0x05, 0xFF, 0x27, 0x44, 0x01, 0x2A, 0x13, 0x00, 0x50, 0xFE, 0x28, 0x40, 0x08, 0x3A, 0x12, 0x00,
+	 0x2F, 0xF2, 0x30, 0xF0, 0x60, 0x43, 0x31, 0xF2, 0x22, 0x46, 0x64, 0x41, 0x2C, 0xF0, 0x2D, 0xF0,
+	 0xD3, 0x80, 0x2E, 0xF0, 0xD1, 0x80, 0xD0, 0x80, 0x27, 0x44, 0x09, 0x0C, 0x03, 0x00, 0x27, 0x44,
+	 0x06, 0x22, 0x05, 0x00, 0xB8, 0xB4, 0x40, 0x47, 0x02, 0x64, 0x31, 0xFB, 0xC0, 0xFE, 0xD4, 0x64,
+	 0x40, 0x48, 0x0D, 0x64, 0x3A, 0xDB, 0x21, 0x46, 0x1C, 0xF2, 0x62, 0xF1, 0xFF, 0xB4, 0xD0, 0x80,
+	 0xFF, 0xFF, 0x01, 0x06, 0x64, 0x44, 0x40, 0x45, 0x0A, 0x36, 0x70, 0x64, 0x14, 0x36, 0x38, 0x64,
+	 0x37, 0x3A, 0x03, 0x00, 0x04, 0x7F, 0x40, 0x45, 0x15, 0x64, 0x6E, 0x3A, 0x03, 0x00, 0x84, 0x7F,
+	 0x40, 0x45, 0x0B, 0x64, 0x40, 0x44, 0x00, 0x63, 0x28, 0x44, 0xA4, 0x36, 0x07, 0x00, 0x04, 0x2B,
+	 0x05, 0x00, 0x30, 0xF3, 0x24, 0x45, 0xD4, 0x84, 0xCA, 0x65, 0xD4, 0x83, 0xD4, 0x64, 0x1A, 0x00,
+	 0x0F, 0x64, 0x3A, 0xDB, 0x21, 0x46, 0x70, 0x63, 0x1C, 0xF2, 0xCA, 0x65, 0x40, 0x45, 0x0A, 0x36,
+	 0x70, 0x64, 0x14, 0x36, 0x38, 0x64, 0x37, 0x3A, 0x03, 0x00, 0x04, 0x7F, 0x40, 0x45, 0x15, 0x64,
+	 0x6E, 0x3A, 0x03, 0x00, 0x84, 0x7F, 0x40, 0x45, 0x0B, 0x64, 0x40, 0x44, 0x2B, 0xF2, 0xC4, 0x85,
+	 0xD4, 0x83, 0xC4, 0x64, 0x40, 0x48, 0x2F, 0xF0, 0xB0, 0xF0, 0xB1, 0xF2, 0x00, 0xE1, 0xA1, 0xFF,
+	 0xFF, 0xFF, 0x80, 0x4E, 0x83, 0x4C, 0x9A, 0xFF, 0x84, 0x4C, 0x85, 0x4C, 0x81, 0x4C, 0xA1, 0xFF,
+	 0x98, 0xFF, 0x87, 0x4F, 0x87, 0x4C, 0x87, 0x4F, 0x87, 0x4D, 0x87, 0x4C, 0x01, 0x08, 0x01, 0x00,
+	 0xFF, 0xFF, 0x87, 0x4C, 0x87, 0x4C, 0x87, 0x4C, 0x87, 0x4C, 0xFF, 0xFF, 0xFF, 0xFF, 0x6A, 0x44,
+	 0xBC, 0xFF, 0xC4, 0xE2, 0x0C, 0x74, 0x04, 0xE1, 0xA1, 0xFF, 0x35, 0xF3, 0xC4, 0xE2, 0x60, 0x54,
+	 0x89, 0xFF, 0x13, 0x74, 0x88, 0xFF, 0xB5, 0xFF, 0x47, 0xFF, 0x29, 0x44, 0xF7, 0xB4, 0x40, 0x49,
+	 0xB7, 0xFF, 0xB4, 0xFF, 0x48, 0x60, 0x2D, 0x7D, 0x08, 0x60, 0x00, 0x6B, 0x27, 0x44, 0x01, 0x2A,
+	 0x05, 0x00, 0xFE, 0xB4, 0x40, 0x47, 0xA8, 0x60, 0x89, 0x78, 0xFF, 0xFF, 0xA7, 0x60, 0x8E, 0x78,
+	 0xFF, 0xFF, 0x28, 0x40, 0xB4, 0x3A, 0x09, 0x00, 0x27, 0x44, 0x07, 0x22, 0x05, 0x00, 0xF8, 0xB4,
+	 0x40, 0x47, 0x02, 0x64, 0x31, 0xFB, 0xC0, 0xFE, 0x9B, 0x01, 0x28, 0x44, 0xD4, 0x36, 0x03, 0x00,
+	 0xAA, 0x60, 0xEA, 0x78, 0xFF, 0xFF, 0x48, 0xE2, 0x27, 0x44, 0xFB, 0xB4, 0x40, 0x47, 0x21, 0x60,
+	 0x98, 0x63, 0xA3, 0xD3, 0xB5, 0x60, 0x58, 0x4D, 0xE3, 0x78, 0xFF, 0xFF, 0x34, 0xFB, 0x1C, 0x42,
+	 0x22, 0x46, 0x2A, 0xF0, 0xF7, 0x60, 0xFF, 0x64, 0xA0, 0x84, 0xA2, 0xDA, 0x60, 0x40, 0x40, 0x2B,
+	 0xCC, 0x00, 0x22, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x22, 0x26, 0x42, 0x00, 0x01, 0x26, 0x03, 0x00,
+	 0x04, 0x26, 0x07, 0x00, 0xC2, 0x00, 0x04, 0x2B, 0xC0, 0x00, 0x88, 0xF3, 0xFF, 0xFF, 0x60, 0x46,
+	 0x01, 0x00, 0x07, 0xF4, 0x47, 0xF2, 0xFF, 0xFF, 0xDC, 0x84, 0x47, 0xFA, 0x0D, 0x60, 0x3E, 0x62,
+	 0x80, 0xFF, 0xC4, 0x60, 0x78, 0x44, 0x02, 0xA4, 0xA2, 0xDB, 0x7D, 0x78, 0xFF, 0xFF, 0x82, 0xFF,
+	 0x88, 0xF3, 0x66, 0x5C, 0xD0, 0x80, 0x00, 0x7C, 0x07, 0x03, 0x66, 0x43, 0x22, 0x46, 0x22, 0xF2,
+	 0x63, 0x46, 0x60, 0x40, 0x01, 0x2A, 0x01, 0x00, 0x3C, 0xF1, 0x47, 0xF0, 0x64, 0x41, 0x64, 0x47,
+	 0xFF, 0xB4, 0x60, 0x5F, 0x20, 0xBC, 0x80, 0x26, 0x80, 0xAC, 0x60, 0x47, 0x22, 0x46, 0x3A, 0xFA,
+	 0x64, 0x44, 0x20, 0x7F, 0x34, 0x94, 0x3B, 0xFA, 0x08, 0x60, 0x00, 0xEA, 0x0F, 0x64, 0x60, 0x7F,
+	 0xA0, 0x5A, 0x80, 0x60, 0x00, 0xEA, 0xA0, 0x60, 0x00, 0xEA, 0xD1, 0x60, 0x00, 0xEA, 0x85, 0x00,
+	 0x2A, 0xF2, 0x00, 0x60, 0x7C, 0x62, 0x60, 0x40, 0x40, 0x2B, 0x27, 0x00, 0xA2, 0xD3, 0x00, 0x61,
+	 0x60, 0xFE, 0xA0, 0xD3, 0xDE, 0x82, 0xA2, 0xD1, 0xFF, 0xFF, 0x20, 0xFE, 0x64, 0x5F, 0xDC, 0x84,
+	 0xF1, 0x81, 0xC0, 0x2B, 0x04, 0x00, 0x80, 0x2A, 0x02, 0x00, 0x7F, 0xA4, 0xDC, 0x84, 0xFF, 0x3B,
+	 0x03, 0x00, 0x60, 0x47, 0xDC, 0x87, 0x01, 0x61, 0xC0, 0x80, 0x00, 0x36, 0xDC, 0x84, 0x4E, 0xDB,
+	 0x60, 0xFE, 0xDA, 0x82, 0xA2, 0xD1, 0xFF, 0xFF, 0xC1, 0x84, 0xF0, 0x22, 0x10, 0xA4, 0xF0, 0x2A,
+	 0x01, 0x00, 0x00, 0x64, 0xA2, 0xDB, 0xFF, 0xFF, 0x20, 0xFE, 0x00, 0x60, 0x7C, 0x62, 0xA2, 0xD3,
+	 0xFF, 0xFF, 0xA0, 0xD3, 0x5A, 0xD1, 0x3A, 0xFA, 0x3B, 0xF8, 0x74, 0x62, 0xA2, 0xD0, 0xFF, 0xFF,
+	 0x64, 0x44, 0xE0, 0x7F, 0xA0, 0x5A, 0x64, 0x47, 0xE1, 0x7F, 0x5A, 0xD0, 0xA0, 0x5A, 0x64, 0x44,
+	 0xE2, 0x7F, 0xA0, 0x5A, 0x00, 0x60, 0x80, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0xA0, 0xD1, 0x5A, 0xD1,
+	 0x64, 0x45, 0x64, 0x44, 0xE3, 0x7F, 0xA0, 0x5A, 0x64, 0x47, 0xE4, 0x7F, 0x5A, 0xD1, 0xA0, 0x5A,
+	 0x64, 0x44, 0xE5, 0x7F, 0xA0, 0x5A, 0x64, 0x47, 0xE6, 0x7F, 0x5A, 0xD1, 0xA0, 0x5A, 0x64, 0x44,
+	 0xE7, 0x7F, 0xA0, 0x5A, 0x65, 0x40, 0x0D, 0x3A, 0x1C, 0x00, 0x64, 0x47, 0xE8, 0x7F, 0x5A, 0xD1,
+	 0xA0, 0x5A, 0x64, 0x44, 0xE9, 0x7F, 0xA0, 0x5A, 0x64, 0x47, 0xEA, 0x7F, 0x5A, 0xD1, 0xA0, 0x5A,
+	 0x64, 0x44, 0xEB, 0x7F, 0xA0, 0x5A, 0x64, 0x47, 0xEC, 0x7F, 0x5A, 0xD1, 0xA0, 0x5A, 0x64, 0x44,
+	 0xED, 0x7F, 0xA0, 0x5A, 0x64, 0x47, 0xEE, 0x7F, 0x5A, 0xD1, 0xA0, 0x5A, 0x64, 0x44, 0xEF, 0x7F,
+	 0xA0, 0x5A, 0x08, 0x60, 0x00, 0xEA, 0x65, 0x44, 0x02, 0xA4, 0x60, 0x7F, 0xA0, 0x5A, 0x80, 0x60,
+	 0x00, 0xEA, 0xA0, 0x60, 0x00, 0xEA, 0xD1, 0x60, 0x00, 0xEA, 0x0B, 0xF2, 0xFF, 0xFF, 0x7F, 0xB4,
+	 0x0C, 0xF0, 0x04, 0x02, 0x64, 0x46, 0x00, 0xF0, 0x04, 0x64, 0x22, 0x46, 0x03, 0xFA, 0x60, 0x41,
+	 0x64, 0x46, 0x01, 0xF2, 0xFC, 0xA1, 0x61, 0x45, 0xD4, 0x84, 0xFF, 0xFF, 0x08, 0x02, 0x00, 0xF0,
+	 0x04, 0x63, 0x64, 0x46, 0x01, 0xF2, 0x22, 0x46, 0x1A, 0xFA, 0x03, 0xFC, 0x02, 0x00, 0x22, 0x46,
+	 0x1A, 0xFA, 0x35, 0xF2, 0x04, 0xF8, 0xDC, 0x84, 0x35, 0xFA, 0x14, 0xF2, 0x0F, 0xB5, 0x0F, 0xB4,
+	 0xCC, 0x84, 0x94, 0x80, 0x04, 0x60, 0x00, 0x65, 0x2A, 0xF2, 0x01, 0x02, 0x94, 0x84, 0x2A, 0xFA,
+	 0x95, 0xFC, 0x06, 0x00, 0xC4, 0x3A, 0x07, 0x00, 0x27, 0x44, 0xFD, 0xB4, 0x40, 0x47, 0x48, 0xE2,
+	 0xA8, 0x60, 0x28, 0x78, 0xFF, 0xFF, 0x28, 0x44, 0x04, 0x26, 0x05, 0x00, 0x68, 0x3A, 0x03, 0x00,
+	 0x32, 0x44, 0x00, 0x27, 0x03, 0x00, 0xA7, 0x60, 0x9B, 0x78, 0xFF, 0xFF, 0x0A, 0x64, 0x3A, 0xDB,
+	 0xA7, 0x60, 0x9B, 0x78, 0xFF, 0xFF, 0x0E, 0x64, 0x3A, 0xDB, 0x10, 0x60, 0x00, 0x65, 0x3C, 0x46,
+	 0x2A, 0xF2, 0x13, 0xF0, 0xA4, 0x84, 0xB4, 0xBC, 0x40, 0x48, 0x62, 0xF1, 0x64, 0x47, 0xFF, 0xB4,
+	 0x60, 0x45, 0xD0, 0x80, 0x70, 0x61, 0x01, 0x06, 0x64, 0x44, 0x0A, 0x36, 0x70, 0x64, 0x14, 0x36,
+	 0x38, 0x64, 0x37, 0x36, 0x15, 0x64, 0x6E, 0x36, 0x0B, 0x64, 0x40, 0x4E, 0xA0, 0x63, 0x0A, 0x64,
+	 0x65, 0x40, 0x0A, 0x36, 0x03, 0x00, 0x38, 0x61, 0x14, 0x64, 0xEB, 0x83, 0x40, 0x45, 0x43, 0x44,
+	 0x02, 0x60, 0x5E, 0x65, 0x2A, 0xF2, 0x2B, 0xF2, 0x60, 0x40, 0x04, 0x2B, 0x04, 0x00, 0x2E, 0x45,
+	 0xD4, 0x85, 0xC5, 0x84, 0x05, 0x00, 0x1B, 0xF0, 0xC5, 0x84, 0xC0, 0x84, 0x2E, 0x45, 0xC4, 0x84,
+	 0x60, 0x43, 0x28, 0x44, 0x00, 0xE1, 0xA1, 0xFF, 0x80, 0x4E, 0x83, 0x4C, 0x9A, 0xFF, 0x56, 0x62,
+	 0x7A, 0xD4, 0x7A, 0xD4, 0x7A, 0xD4, 0x5C, 0x62, 0x7A, 0xD4, 0x7A, 0xD4, 0x7A, 0xD4, 0xA1, 0xFF,
+	 0x98, 0xFF, 0x87, 0x4F, 0x87, 0x4C, 0x87, 0x4F, 0x87, 0x4D, 0x87, 0x4C, 0x01, 0x08, 0x01, 0x00,
+	 0xFF, 0xFF, 0x87, 0x4C, 0x87, 0x4C, 0x87, 0x4C, 0x87, 0x4C, 0xFF, 0xFF, 0xFF, 0xFF, 0x6A, 0x44,
+	 0xBC, 0xFF, 0xB5, 0xFF, 0x47, 0xFF, 0x27, 0x44, 0x02, 0xBC, 0x40, 0x47, 0x36, 0xF3, 0xB7, 0xFF,
+	 0xB4, 0xFF, 0x48, 0x60, 0x2D, 0x7D, 0x08, 0x60, 0x00, 0x6B, 0x60, 0x5B, 0x4D, 0xE2, 0xA8, 0x60,
+	 0x81, 0x78, 0xFF, 0xFF, 0x21, 0x46, 0xB5, 0xFF, 0xBC, 0xFF, 0x47, 0xFF, 0xB7, 0xFF, 0xB4, 0xFF,
+	 0x48, 0x60, 0x2D, 0x7D, 0x08, 0x60, 0x00, 0x6B, 0x26, 0x43, 0x25, 0x44, 0x06, 0xFA, 0x2A, 0x44,
+	 0x72, 0x45, 0x24, 0xFA, 0x95, 0xF3, 0x06, 0x04, 0xE4, 0xE2, 0xDC, 0x9C, 0x29, 0x40, 0x01, 0x26,
+	 0x64, 0x44, 0x95, 0xF9, 0x25, 0xFA, 0x96, 0xF3, 0x02, 0x04, 0xDC, 0x84, 0x96, 0xFB, 0x28, 0xFA,
+	 0x97, 0xF3, 0x02, 0x04, 0xDC, 0x84, 0x97, 0xFB, 0x29, 0xFA, 0x2D, 0x40, 0x01, 0x2A, 0x0E, 0x00,
+	 0x1D, 0xFF, 0x26, 0x44, 0x02, 0xBC, 0x40, 0x46, 0x27, 0x44, 0x07, 0x22, 0x05, 0x00, 0xF8, 0xB4,
+	 0x40, 0x47, 0x06, 0x64, 0x31, 0xFB, 0xC0, 0xFE, 0x30, 0xF1, 0x50, 0x00, 0xFC, 0xB3, 0x32, 0x40,
+	 0x01, 0x2A, 0x06, 0x00, 0x0A, 0xBB, 0x0F, 0xFC, 0xCB, 0xFE, 0xA7, 0x60, 0x9B, 0x78, 0xFF, 0xFF,
+	 0x2D, 0x44, 0x04, 0x26, 0x02, 0x00, 0x0F, 0xFC, 0x05, 0xFF, 0x30, 0xF1, 0x27, 0x44, 0x05, 0x22,
+	 0x2D, 0x00, 0xFA, 0xB4, 0x40, 0x47, 0x2D, 0x44, 0x10, 0x2A, 0x24, 0x00, 0x28, 0x40, 0xD4, 0x3A,
+	 0x21, 0x00, 0x31, 0x40, 0x08, 0x26, 0x00, 0x7C, 0x2B, 0x44, 0xD0, 0x80, 0x70, 0x45, 0x02, 0x28,
+	 0x64, 0x44, 0xC4, 0x84, 0xFF, 0xFF, 0x04, 0x24, 0x00, 0xB4, 0x60, 0x50, 0x08, 0x28, 0x01, 0x00,
+	 0x20, 0x29, 0x6D, 0xE2, 0x12, 0x60, 0xC0, 0x63, 0x1D, 0xF0, 0xC0, 0x64, 0xC0, 0x84, 0xA3, 0xD1,
+	 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xC0, 0x84, 0xA3, 0xDB, 0xA8, 0x60,
+	 0x89, 0x78, 0xFF, 0xFF, 0x02, 0x64, 0x31, 0xFB, 0xC0, 0xFE, 0x07, 0x00, 0x02, 0x2A, 0x05, 0x00,
+	 0xFD, 0xB4, 0x40, 0x47, 0x06, 0x64, 0x31, 0xFB, 0xC0, 0xFE, 0x05, 0x64, 0x3A, 0xDB, 0x28, 0x44,
+	 0xA4, 0x3A, 0x04, 0x00, 0x39, 0xF1, 0x25, 0x44, 0x0A, 0x36, 0x38, 0xF1, 0x31, 0x40, 0x08, 0x26,
+	 0x00, 0x7C, 0x2B, 0x44, 0xD0, 0x80, 0x70, 0x45, 0x02, 0x28, 0x64, 0x44, 0xC4, 0x84, 0xFF, 0xFF,
+	 0x04, 0x24, 0x00, 0xB4, 0x28, 0x40, 0xE4, 0x36, 0x00, 0xB4, 0x60, 0x50, 0x08, 0x28, 0x01, 0x00,
+	 0x20, 0x29, 0x6D, 0xE2, 0xA7, 0x60, 0x8E, 0x78, 0xFF, 0xFF, 0x21, 0x46, 0xB5, 0xFF, 0xBC, 0xFF,
+	 0x47, 0xFF, 0xB7, 0xFF, 0xB4, 0xFF, 0x48, 0x60, 0x2D, 0x7D, 0x08, 0x60, 0x00, 0x6B, 0x27, 0x44,
+	 0x07, 0x22, 0x05, 0x00, 0xF8, 0xB4, 0x40, 0x47, 0x06, 0x64, 0x31, 0xFB, 0xC0, 0xFE, 0xEA, 0x01,
+	 0x27, 0x44, 0x05, 0x22, 0x09, 0x00, 0xBA, 0xB4, 0x40, 0x47, 0x3C, 0x46, 0x02, 0x64, 0x31, 0xFB,
+	 0xC0, 0xFE, 0xA7, 0x60, 0x9B, 0x78, 0xFF, 0xFF, 0x27, 0x44, 0x02, 0x2A, 0x06, 0x00, 0xFD, 0xB4,
+	 0x40, 0x47, 0x06, 0x64, 0x31, 0xFB, 0xC0, 0xFE, 0xF4, 0x01, 0xF3, 0x0A, 0x7C, 0x50, 0x6D, 0xE2,
+	 0xF0, 0x01, 0x72, 0x45, 0xDC, 0x84, 0x95, 0xFB, 0x11, 0x64, 0x3A, 0xDB, 0x96, 0xF3, 0x06, 0x04,
+	 0xDC, 0x84, 0x96, 0xFB, 0x97, 0xF3, 0x02, 0x04, 0xDC, 0x84, 0x97, 0xFB, 0xA7, 0x60, 0xA6, 0x78,
+	 0xFF, 0xFF, 0x00, 0x61, 0x12, 0x64, 0x3A, 0xDB, 0x16, 0x60, 0xBA, 0x63, 0xBD, 0xD3, 0x72, 0x45,
+	 0x44, 0x8A, 0x02, 0x28, 0x02, 0x00, 0xE4, 0xE2, 0xDD, 0x81, 0x02, 0x28, 0x02, 0x00, 0xE4, 0xE2,
+	 0xDD, 0x81, 0xBD, 0xD3, 0x95, 0xF1, 0x61, 0x45, 0xC0, 0x84, 0x00, 0x61, 0x02, 0x24, 0x01, 0xB9,
+	 0xC4, 0x84, 0x60, 0x55, 0x2A, 0x52, 0x95, 0xFB, 0x02, 0x24, 0x01, 0xB9, 0xBD, 0xD3, 0x96, 0xF1,
+	 0x61, 0x45, 0xC0, 0x84, 0x00, 0x61, 0x02, 0x24, 0x01, 0xB9, 0xC4, 0x84, 0x96, 0xFB, 0x02, 0x24,
+	 0x01, 0xB9, 0xBD, 0xD3, 0x97, 0xF1, 0x61, 0x45, 0xC0, 0x84, 0xC4, 0x84, 0x97, 0xFB, 0xA8, 0x60,
+	 0x0C, 0x78, 0xFF, 0xFF, 0xAE, 0x01, 0xA1, 0xFF, 0xFF, 0xFF, 0x01, 0x25, 0x09, 0x00, 0x04, 0x25,
+	 0x03, 0x00, 0x47, 0xFF, 0x32, 0x74, 0xA5, 0x01, 0xC4, 0xE2, 0xAF, 0x60, 0x19, 0x78, 0xFF, 0xFF,
+	 0x4C, 0x4E, 0x47, 0xFF, 0x32, 0x74, 0xCD, 0xE2, 0xAC, 0x60, 0x8F, 0x78, 0x00, 0x61, 0x10, 0x64,
+	 0x3A, 0xDB, 0xA7, 0x60, 0x9B, 0x78, 0xFF, 0xFF, 0xA7, 0x60, 0x9B, 0x78, 0xFF, 0xFF, 0x5C, 0x4D,
+	 0x26, 0x44, 0x02, 0x26, 0x0C, 0x00, 0x3E, 0x46, 0x09, 0xF2, 0x1E, 0x41, 0x03, 0x1B, 0xAE, 0x60,
+	 0xCB, 0x78, 0xFF, 0xFF, 0x40, 0x5E, 0xFD, 0xFB, 0x21, 0x44, 0x02, 0x64, 0x40, 0x46, 0x41, 0x5D,
+	 0x21, 0x46, 0x00, 0xF2, 0x46, 0x45, 0x87, 0xFC, 0x4C, 0xE2, 0x01, 0x64, 0x33, 0xFB, 0x01, 0x60,
+	 0x0E, 0xE1, 0x03, 0xE1, 0x3F, 0x40, 0x01, 0x27, 0x00, 0x00, 0x21, 0x69, 0xB6, 0xFF, 0xA1, 0xFF,
+	 0x6C, 0x5E, 0xB6, 0xFF, 0xB7, 0xFF, 0x60, 0x5C, 0x20, 0x64, 0x3A, 0xDB, 0x68, 0x43, 0x26, 0xFC,
+	 0x22, 0x69, 0x64, 0x44, 0xA1, 0xFF, 0xFF, 0xFF, 0x6C, 0x5F, 0x60, 0x43, 0x26, 0xF2, 0xFF, 0xFF,
+	 0x68, 0x5F, 0x26, 0xFA, 0x3A, 0x69, 0x1D, 0xFC, 0x2E, 0x44, 0x36, 0xF1, 0x1C, 0xFA, 0xC3, 0x94,
+	 0xCD, 0xE2, 0x2E, 0x44, 0x14, 0x36, 0x12, 0x00, 0x0A, 0x36, 0x0F, 0x00, 0x63, 0x45, 0xE3, 0x83,
+	 0xE3, 0x83, 0xC7, 0x83, 0xE3, 0x83, 0xC7, 0x83, 0xFF, 0xFF, 0x37, 0x36, 0x05, 0x00, 0x6E, 0x36,
+	 0x04, 0x00, 0xAE, 0x60, 0xE3, 0x78, 0xFF, 0xFF, 0xEB, 0x83, 0xEB, 0x83, 0xEB, 0x83, 0xEB, 0x83,
+	 0xFF, 0xFF, 0x80, 0x27, 0xCF, 0x83, 0x1B, 0xFC, 0x01, 0x64, 0x4F, 0xFB, 0xA1, 0xFF, 0x1C, 0xF2,
+	 0x29, 0x41, 0xF9, 0x81, 0x52, 0x4A, 0x71, 0x89, 0x68, 0x5F, 0x27, 0xFA, 0x6C, 0x40, 0x03, 0x15,
+	 0xAE, 0x60, 0xF4, 0x78, 0xFF, 0xFF, 0x88, 0x60, 0x85, 0x71, 0x8D, 0xE2, 0x99, 0xF1, 0xFC, 0xA3,
+	 0xD3, 0x80, 0x43, 0x43, 0x03, 0x04, 0xAE, 0x60, 0xEB, 0x78, 0xFF, 0xFF, 0x32, 0x40, 0x01, 0x2A,
+	 0x4C, 0x00, 0x9A, 0xFF, 0x23, 0x43, 0x18, 0x61, 0xA1, 0xFF, 0x8C, 0x44, 0xCB, 0x83, 0x2A, 0xFA,
+	 0x40, 0x48, 0x40, 0x27, 0x04, 0xA1, 0x60, 0x40, 0x03, 0x2B, 0x01, 0x00, 0x06, 0xA1, 0x88, 0xB0,
+	 0x88, 0x36, 0xD9, 0x81, 0x62, 0x45, 0x23, 0x44, 0x54, 0x94, 0x28, 0x40, 0x04, 0x26, 0x00, 0x64,
+	 0x3F, 0xFA, 0xC9, 0x81, 0x65, 0x42, 0x7A, 0xDC, 0x00, 0xB9, 0xFD, 0x1C, 0x00, 0xF4, 0x6E, 0x61,
+	 0x10, 0x62, 0x14, 0x02, 0x05, 0x1D, 0x12, 0x1E, 0x0C, 0x00, 0x00, 0xF4, 0x7C, 0x61, 0x02, 0x62,
+	 0x7A, 0xDC, 0x63, 0x40, 0xFD, 0x1C, 0xF9, 0x1D, 0xFF, 0xB1, 0x08, 0x1E, 0x02, 0x02, 0x00, 0xF4,
+	 0x02, 0x62, 0xB6, 0xFF, 0xB7, 0xFF, 0xA1, 0xFF, 0x6C, 0x44, 0x5A, 0xDA, 0x98, 0xFF, 0x01, 0x60,
+	 0x08, 0xE1, 0x81, 0xE1, 0xA1, 0xFF, 0x6C, 0x40, 0xA1, 0xFF, 0x47, 0xFF, 0x26, 0x44, 0xFD, 0xB4,
+	 0x84, 0xBC, 0x01, 0x15, 0x7F, 0xB4, 0x40, 0x46, 0xA1, 0xFF, 0x6C, 0x40, 0x14, 0x63, 0x01, 0x11,
+	 0x01, 0x00, 0xFD, 0x1F, 0xAE, 0x60, 0x61, 0x78, 0xFF, 0xFF, 0x9A, 0xFF, 0x54, 0x63, 0x12, 0x64,
+	 0x40, 0x46, 0x00, 0x64, 0x0F, 0xFA, 0xA1, 0xFF, 0xCB, 0xF1, 0x12, 0x61, 0x50, 0xFE, 0x8C, 0x44,
+	 0xCC, 0xF0, 0xBD, 0xDA, 0x40, 0x48, 0x04, 0x26, 0x40, 0x00, 0xA1, 0xFF, 0x8C, 0x44, 0xBD, 0xDA,
+	 0x30, 0xFB, 0x6C, 0x44, 0xBD, 0xDA, 0xFF, 0xFF, 0x01, 0x26, 0x24, 0x00, 0xD0, 0x80, 0xA1, 0xFF,
+	 0x8C, 0x44, 0x6C, 0x5C, 0xF2, 0xFE, 0xBD, 0xDA, 0xCD, 0xF3, 0xD4, 0x80, 0xD0, 0x80, 0xBD, 0xD8,
+	 0x2D, 0x44, 0x15, 0x0C, 0x32, 0x40, 0x02, 0x2A, 0x07, 0x00, 0x28, 0x42, 0x0C, 0xB2, 0x08, 0x3A,
+	 0x03, 0x00, 0x10, 0xBC, 0x40, 0x4D, 0x4D, 0x00, 0x03, 0x0A, 0xAE, 0x60, 0xF9, 0x78, 0xFF, 0xFF,
+	 0x11, 0xBC, 0x40, 0x4D, 0x28, 0x45, 0xBF, 0x60, 0xFF, 0x64, 0x24, 0x88, 0x42, 0x00, 0x30, 0xBC,
+	 0x40, 0x4D, 0x3F, 0x00, 0x20, 0xB9, 0x5C, 0x8E, 0xA1, 0xFF, 0x8C, 0x44, 0xBD, 0xDA, 0xDC, 0x9C,
+	 0x6C, 0x44, 0xF2, 0xFE, 0xBD, 0xDA, 0x08, 0x28, 0x44, 0x4E, 0xDC, 0x84, 0x2E, 0x5C, 0xB0, 0x84,
+	 0xEF, 0xB1, 0x08, 0x24, 0x40, 0xB9, 0x41, 0x46, 0x2C, 0x00, 0x8C, 0x44, 0x04, 0x61, 0xBD, 0xDA,
+	 0x50, 0xFE, 0x80, 0x27, 0x00, 0x64, 0x30, 0xFB, 0x8C, 0x44, 0xBD, 0xDA, 0xD0, 0x80, 0x8C, 0x44,
+	 0xBD, 0xDA, 0xD4, 0x80, 0x00, 0x65, 0x8C, 0x44, 0xCD, 0xF1, 0xBD, 0xDA, 0xD0, 0x80, 0x28, 0x44,
+	 0x03, 0x0C, 0xA0, 0x2A, 0x0A, 0x00, 0x11, 0x00, 0x10, 0x65, 0x60, 0x40, 0xC4, 0x36, 0x04, 0x00,
+	 0xD4, 0x3A, 0x08, 0x00, 0x27, 0x40, 0x40, 0x26, 0x30, 0x65, 0x00, 0x64, 0x3F, 0xFA, 0x46, 0x4E,
+	 0x35, 0x8D, 0x5F, 0x00, 0x40, 0x26, 0xF9, 0x01, 0x30, 0x65, 0x9D, 0xDC, 0x9D, 0xDC, 0x9D, 0xDC,
+	 0xF4, 0x01, 0x00, 0xE1, 0x23, 0x43, 0xE8, 0xA3, 0x6A, 0x62, 0x9A, 0xFF, 0xA1, 0xFF, 0x28, 0x44,
+	 0x03, 0x2B, 0x04, 0x00, 0x7A, 0xDC, 0x7A, 0xDC, 0x7A, 0xDC, 0x28, 0x44, 0x88, 0xB0, 0x88, 0x2A,
+	 0x03, 0x00, 0x70, 0x62, 0x7A, 0xDC, 0x28, 0x44, 0x40, 0x2B, 0x13, 0x00, 0x72, 0x62, 0x7A, 0xDC,
+	 0x04, 0xE6, 0x7A, 0xDC, 0x3B, 0xF2, 0xFF, 0xFF, 0xFF, 0xFF, 0x20, 0x2B, 0x02, 0x00, 0x7A, 0xDC,
+	 0x7A, 0xDC, 0x08, 0x60, 0x00, 0xEB, 0xFC, 0xA3, 0x25, 0xFF, 0x3F, 0xFC, 0x04, 0xA3, 0xB0, 0xFF,
+	 0x01, 0x00, 0x3F, 0xFC, 0xCF, 0x83, 0xDF, 0x83, 0x04, 0x02, 0x00, 0xF4, 0x10, 0x62, 0x6C, 0x61,
+	 0x1F, 0x00, 0x27, 0x03, 0xCB, 0x83, 0xFF, 0x60, 0xFE, 0x65, 0x0E, 0xA3, 0xA7, 0x84, 0xF2, 0xA3,
+	 0x00, 0xF4, 0x10, 0x62, 0x6C, 0x61, 0x7A, 0xDC, 0xFE, 0x1C, 0x03, 0x1D, 0x7C, 0xA8, 0xD9, 0x81,
+	 0x0A, 0x02, 0x00, 0xF4, 0x02, 0x62, 0xA7, 0x84, 0x7A, 0x61, 0x7A, 0xDC, 0xFE, 0x1C, 0xF9, 0x1D,
+	 0x7C, 0xA8, 0xD9, 0x81, 0xF6, 0x03, 0xFF, 0xB1, 0x0C, 0x1E, 0x02, 0x02, 0x00, 0xF4, 0x02, 0x62,
+	 0xA1, 0xFF, 0x01, 0x60, 0x0C, 0xE1, 0xB6, 0xFF, 0xB7, 0xFF, 0xA1, 0xFF, 0xCD, 0x81, 0x6C, 0x44,
+	 0x5A, 0xDA, 0x98, 0xFF, 0x00, 0xE6, 0x7C, 0x44, 0x33, 0xFB, 0x01, 0x60, 0x0C, 0xE1, 0x83, 0xE1,
+	 0xA1, 0xFF, 0x8C, 0x44, 0x46, 0x45, 0xA1, 0xFF, 0x14, 0x63, 0x01, 0x10, 0xFE, 0x1F, 0x01, 0x60,
+	 0x08, 0xE1, 0x0A, 0x64, 0x60, 0x54, 0x47, 0xFF, 0x50, 0x4B, 0x67, 0x50, 0x69, 0xE2, 0x6A, 0x40,
+	 0x40, 0x2B, 0x01, 0x15, 0x29, 0x00, 0x6C, 0x40, 0x28, 0x40, 0x03, 0x26, 0x15, 0x00, 0x31, 0x40,
+	 0x20, 0x2A, 0x03, 0x00, 0x28, 0x40, 0x50, 0x3A, 0x0F, 0x00, 0x2D, 0x44, 0x20, 0x2A, 0x0C, 0x00,
+	 0x2B, 0x44, 0xAC, 0x80, 0x28, 0x40, 0xB4, 0x3A, 0x03, 0x00, 0x02, 0x03, 0x30, 0xFB, 0x04, 0x00,
+	 0x2B, 0x50, 0xA8, 0x60, 0x92, 0x78, 0x04, 0xE1, 0x04, 0xE1, 0xA1, 0xFF, 0x35, 0xF1, 0x26, 0x44,
+	 0x64, 0x54, 0xCD, 0xE2, 0x84, 0xBC, 0x2D, 0x40, 0x0C, 0x22, 0xFD, 0xB4, 0x40, 0x46, 0x23, 0x64,
+	 0x3A, 0xDB, 0xAB, 0x60, 0x6A, 0x78, 0xFF, 0xFF, 0x27, 0x40, 0x26, 0x22, 0x04, 0x00, 0x02, 0x64,
+	 0x31, 0xFB, 0xC0, 0xFE, 0xFF, 0xFF, 0x6C, 0x40, 0xB7, 0xFF, 0xB4, 0xFF, 0x48, 0x60, 0x2D, 0x7D,
+	 0x08, 0x60, 0x00, 0x6B, 0x37, 0xF3, 0x2B, 0x45, 0xD4, 0x80, 0xFF, 0xFF, 0x02, 0x28, 0x65, 0x44,
+	 0x60, 0x50, 0xA0, 0x4C, 0x20, 0xBC, 0xFF, 0xB4, 0xA0, 0x51, 0x35, 0xF1, 0x74, 0x44, 0xC0, 0x94,
+	 0x32, 0x40, 0x02, 0x2A, 0x18, 0x00, 0x28, 0x44, 0xA4, 0x36, 0x04, 0x00, 0x0C, 0xB4, 0xFF, 0xFF,
+	 0x04, 0x36, 0x11, 0x00, 0x26, 0x43, 0xFD, 0xB3, 0x04, 0xBB, 0x43, 0x46, 0x01, 0x2A, 0x03, 0x00,
+	 0x28, 0x47, 0x40, 0xBF, 0x40, 0x48, 0x0A, 0xBB, 0x0F, 0xFC, 0x50, 0x4B, 0x67, 0x50, 0x00, 0x64,
+	 0x30, 0xFB, 0x05, 0xFF, 0xC6, 0x01, 0x24, 0x64, 0x3A, 0xDB, 0x28, 0x44, 0x04, 0x2A, 0x03, 0x00,
+	 0xA7, 0x60, 0x8E, 0x78, 0xFF, 0xFF, 0x1D, 0xFF, 0x48, 0xE2, 0x27, 0x44, 0x06, 0x22, 0x05, 0x00,
+	 0xF9, 0xB4, 0x40, 0x47, 0x02, 0x64, 0x31, 0xFB, 0xC0, 0xFE, 0x26, 0x40, 0x10, 0x2A, 0x18, 0x00,
+	 0x26, 0xF2, 0xFF, 0xFF, 0x60, 0x47, 0xFF, 0xB4, 0xC0, 0xA0, 0xFF, 0xFF, 0x11, 0x0E, 0x98, 0xF1,
+	 0x1E, 0x60, 0xF8, 0x64, 0xA0, 0xD3, 0xFF, 0xFF, 0xDC, 0x84, 0xDC, 0x80, 0xD0, 0x80, 0x04, 0x03,
+	 0xA2, 0xDB, 0x08, 0x24, 0xC6, 0xFE, 0x04, 0x00, 0x8A, 0xFF, 0x20, 0x60, 0x00, 0x75, 0x88, 0xFF,
+	 0xAC, 0x60, 0x05, 0x78, 0xFF, 0xFF, 0x98, 0xF1, 0x1E, 0x60, 0xFA, 0x64, 0xA0, 0xD3, 0xFF, 0xFF,
+	 0xDC, 0x84, 0xDC, 0x80, 0xD0, 0x80, 0x04, 0x03, 0xA2, 0xDB, 0x08, 0x24, 0xC6, 0xFE, 0x04, 0x00,
+	 0x8A, 0xFF, 0x20, 0x60, 0x00, 0x75, 0x88, 0xFF, 0x2A, 0x64, 0x3A, 0xDB, 0x5C, 0x41, 0x87, 0xE1,
+	 0xA1, 0xFF, 0x6C, 0x40, 0x02, 0x00, 0x29, 0x64, 0x3A, 0xDB, 0x01, 0x60, 0x08, 0xE1, 0x87, 0xE1,
+	 0xA1, 0xFF, 0x6C, 0x40, 0x11, 0x00, 0x1F, 0x60, 0x0C, 0x64, 0xA0, 0xD3, 0xFF, 0xFF, 0xDC, 0x84,
+	 0xFF, 0xFF, 0x08, 0x28, 0xA2, 0xDB, 0xF1, 0x01, 0x01, 0x60, 0x08, 0xE1, 0x21, 0x64, 0x3A, 0xDB,
+	 0x03, 0x00, 0x01, 0x60, 0x08, 0xE1, 0x6C, 0x40, 0x00, 0x64, 0x33, 0xFB, 0x32, 0x74, 0x40, 0x63,
+	 0x01, 0x16, 0xFE, 0x01, 0x01, 0x68, 0x01, 0x11, 0x09, 0x00, 0xA7, 0x6A, 0x22, 0x64, 0x3A, 0xDB,
+	 0x03, 0x60, 0xC9, 0x63, 0x01, 0x11, 0x02, 0x00, 0x6C, 0x40, 0xFC, 0x1F, 0x6C, 0x40, 0xB5, 0xFF,
+	 0x6C, 0x40, 0xBC, 0xFF, 0x6C, 0x40, 0xB7, 0xFF, 0xB4, 0xFF, 0x48, 0x60, 0x2D, 0x7D, 0x08, 0x60,
+	 0x00, 0x6B, 0x03, 0x0A, 0xA7, 0x60, 0x9B, 0x78, 0xFF, 0xFF, 0x01, 0x64, 0x4F, 0xFB, 0x27, 0x44,
+	 0x06, 0x22, 0x06, 0x00, 0xF9, 0xB4, 0x40, 0x47, 0x02, 0x64, 0x31, 0xFB, 0xC0, 0xFE, 0x48, 0xE2,
+	 0x27, 0x64, 0x3A, 0xDB, 0xB3, 0xE1, 0xA1, 0xFF, 0xFF, 0xFF, 0x81, 0x3E, 0x54, 0x62, 0x22, 0x46,
+	 0xA2, 0xD0, 0x16, 0x63, 0x7C, 0x41, 0x44, 0x48, 0x80, 0x36, 0x04, 0x61, 0x28, 0x40, 0x50, 0x36,
+	 0x04, 0x61, 0x41, 0x4E, 0x28, 0x44, 0xA4, 0x36, 0x0E, 0x63, 0x12, 0x60, 0xC2, 0x62, 0xA2, 0xD1,
+	 0x24, 0x44, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xC0, 0x84, 0xA2, 0xDB,
+	 0x9A, 0xFF, 0xA1, 0xFF, 0x54, 0x62, 0xA2, 0xD2, 0xFF, 0xFF, 0x6A, 0x40, 0x80, 0x4E, 0x7A, 0xD4,
+	 0x7A, 0xD4, 0x7A, 0xD4, 0x7A, 0xD4, 0x7A, 0xD4, 0x7A, 0xD4, 0x7A, 0xD4, 0xFF, 0xFF, 0x01, 0x1D,
+	 0x78, 0x00, 0x7A, 0xD4, 0x7A, 0xD4, 0x7A, 0xD4, 0x7A, 0xD4, 0x28, 0x40, 0x03, 0x2B, 0x04, 0x00,
+	 0x7A, 0xD4, 0x7A, 0xD4, 0x7A, 0xD4, 0x6A, 0x40, 0x70, 0x62, 0x28, 0x44, 0x88, 0xB0, 0x88, 0x36,
+	 0x7A, 0xD4, 0x28, 0x40, 0x40, 0x2B, 0x0B, 0x00, 0x72, 0x62, 0x7A, 0xD4, 0x7A, 0xD4, 0xA2, 0xD2,
+	 0xFF, 0xFF, 0x60, 0x40, 0x20, 0x2B, 0x02, 0x00, 0x7A, 0xD4, 0x7A, 0xD4, 0x46, 0x00, 0x23, 0x43,
+	 0xCF, 0x83, 0xDF, 0x83, 0x02, 0x03, 0x55, 0x03, 0x04, 0x00, 0x03, 0xF0, 0x04, 0xF4, 0x64, 0x42,
+	 0x37, 0x00, 0x2E, 0x40, 0x04, 0x2A, 0x21, 0x00, 0xA1, 0xFF, 0x02, 0xFE, 0x10, 0x25, 0x42, 0xFE,
+	 0x72, 0x45, 0x65, 0x4C, 0x95, 0xF3, 0x03, 0x04, 0xE4, 0xE2, 0xDC, 0x84, 0x95, 0xFB, 0xA1, 0xFF,
+	 0x80, 0x4C, 0x96, 0xF3, 0x02, 0x04, 0xDC, 0x84, 0x96, 0xFB, 0x80, 0x4C, 0x97, 0xF3, 0x02, 0x04,
+	 0xDC, 0x84, 0x97, 0xFB, 0x80, 0x4C, 0x5C, 0x4E, 0xF8, 0xA3, 0x03, 0xF2, 0x9A, 0xF2, 0x04, 0xF4,
+	 0xFF, 0xB1, 0xF8, 0xA1, 0x06, 0xA4, 0x60, 0x42, 0x09, 0x00, 0x03, 0xF2, 0x9A, 0xF2, 0x04, 0xF4,
+	 0xC8, 0x82, 0xFF, 0xB1, 0x03, 0x00, 0x00, 0xF4, 0x81, 0xF2, 0xFF, 0xB1, 0x7A, 0xD4, 0xFF, 0xFF,
+	 0xFD, 0x1C, 0xF9, 0x1D, 0xFF, 0xB1, 0x17, 0x1E, 0x02, 0x02, 0x00, 0xF4, 0xDA, 0x82, 0xDA, 0x82,
+	 0xA2, 0xD2, 0xA1, 0xFF, 0x09, 0x74, 0x80, 0x4D, 0x0E, 0x00, 0x03, 0xF2, 0x9A, 0xF2, 0x04, 0xF4,
+	 0x23, 0x43, 0xA1, 0xFF, 0xA0, 0xD2, 0xFE, 0xA1, 0xCB, 0x83, 0x80, 0x4E, 0xAF, 0x83, 0x02, 0x1D,
+	 0x02, 0x03, 0xED, 0x01, 0xE3, 0x01, 0xA1, 0xFF, 0x28, 0x40, 0x40, 0x2B, 0x02, 0x00, 0x9C, 0x4E,
+	 0x9C, 0x4C, 0xA1, 0xFF, 0xDA, 0x83, 0x66, 0x44, 0x22, 0x46, 0x0C, 0xFA, 0x0B, 0xFC, 0x87, 0x4F,
+	 0x87, 0x4C, 0x87, 0x4F, 0x87, 0x4D, 0x87, 0x4C, 0x01, 0x08, 0x01, 0x00, 0xFF, 0xFF, 0x87, 0x4C,
+	 0x87, 0x4C, 0x87, 0x4C, 0x87, 0x4C, 0xFF, 0xFF, 0xFF, 0xFF, 0x6A, 0x44, 0xBC, 0xFF, 0x01, 0x60,
+	 0x08, 0xE1, 0x0C, 0x74, 0x04, 0xE1, 0xA1, 0xFF, 0x35, 0xF3, 0xC4, 0xE2, 0x60, 0x54, 0x89, 0xFF,
+	 0x13, 0x74, 0x88, 0xFF, 0x29, 0x44, 0xF7, 0xB4, 0x40, 0x49, 0x34, 0x64, 0x3A, 0xDB, 0x06, 0xE1,
+	 0x47, 0xFF, 0xA8, 0x60, 0x64, 0x78, 0xFF, 0xFF, 0xFF, 0x01, 0x08, 0xE1, 0xA1, 0xFF, 0xFF, 0xFF,
+	 0x43, 0xFF, 0x01, 0x60, 0x00, 0xE1, 0x28, 0xF3, 0x47, 0xFF, 0x60, 0x40, 0x07, 0x37, 0x4B, 0x00,
+	 0x05, 0x3B, 0x04, 0x00, 0xFF, 0x0A, 0x80, 0xE1, 0xA1, 0xFF, 0xFF, 0xFF, 0x29, 0xF5, 0x2A, 0xF3,
+	 0x47, 0xFF, 0x3F, 0xF0, 0x01, 0x1B, 0x01, 0x64, 0x60, 0x56, 0xAD, 0xE2, 0xB5, 0xFF, 0x6C, 0x40,
+	 0x40, 0xE1, 0xA1, 0xFF, 0x00, 0xF4, 0x6E, 0x61, 0x12, 0x62, 0x64, 0x43, 0x01, 0xE1, 0x03, 0x64,
+	 0xE2, 0xD0, 0xC9, 0x81, 0x64, 0x4C, 0xCC, 0x84, 0xDA, 0x82, 0xFA, 0x02, 0x01, 0x60, 0x00, 0x6B,
+	 0x9A, 0xFF, 0xCA, 0x82, 0x03, 0x00, 0x00, 0xF4, 0x81, 0xF2, 0xFF, 0xFF, 0x7A, 0xD0, 0xA1, 0xFF,
+	 0x64, 0x4C, 0xFC, 0x1C, 0xF8, 0x1D, 0x00, 0xB9, 0x06, 0x1E, 0x02, 0x02, 0x00, 0xF4, 0xDA, 0x82,
+	 0x5A, 0xD2, 0xA1, 0xFF, 0x60, 0x4D, 0x3F, 0x40, 0x02, 0x2B, 0x08, 0x00, 0x28, 0xF3, 0xA5, 0x60,
+	 0xC4, 0x65, 0x60, 0x40, 0x0E, 0x3B, 0x02, 0x00, 0x80, 0x4C, 0xFE, 0x01, 0xA1, 0xFF, 0x87, 0x4E,
+	 0x87, 0x4C, 0x87, 0x4C, 0x87, 0x4C, 0x87, 0x4C, 0x67, 0x4C, 0xFF, 0xFF, 0xBC, 0xFF, 0x00, 0xE1,
+	 0xD5, 0xFE, 0xA1, 0xFF, 0xFF, 0xFF, 0x00, 0x64, 0x40, 0x46, 0x60, 0x41, 0xB5, 0xFF, 0xB7, 0xFF,
+	 0xB4, 0xFF, 0x29, 0xF5, 0x3F, 0xF0, 0x24, 0xF2, 0x44, 0x43, 0x40, 0x44, 0x00, 0xF4, 0xF3, 0x60,
+	 0xA0, 0x65, 0x10, 0x62, 0x5A, 0xD2, 0xD9, 0x81, 0xD4, 0x80, 0xFF, 0xFF, 0xFB, 0x02, 0x61, 0x45,
+	 0x24, 0x44, 0xD4, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xFD, 0xA5, 0x48, 0x60, 0x00, 0x64,
+	 0xC4, 0x9D, 0x0D, 0x60, 0x00, 0x6B, 0x24, 0x44, 0xC0, 0x83, 0xBB, 0xFF, 0x29, 0xF5, 0x01, 0xE1,
+	 0x00, 0xF4, 0x6C, 0x61, 0x10, 0x62, 0x05, 0x00, 0x00, 0xF4, 0x01, 0xF2, 0xFF, 0xFF, 0x60, 0x41,
+	 0x04, 0x62, 0xA1, 0xFF, 0xFF, 0xFF, 0x01, 0x10, 0x1A, 0x00, 0x26, 0x44, 0x01, 0x26, 0x0C, 0x00,
+	 0x24, 0x44, 0xC8, 0x84, 0x40, 0x44, 0x02, 0x03, 0x6C, 0x45, 0xF3, 0x01, 0x03, 0x15, 0x01, 0x64,
+	 0x05, 0xFA, 0x15, 0x00, 0x6C, 0x45, 0xED, 0x01, 0x23, 0x44, 0xC8, 0x84, 0x40, 0x43, 0x02, 0x03,
+	 0x6C, 0x45, 0xE7, 0x01, 0x00, 0x64, 0x01, 0x15, 0x01, 0x64, 0x6C, 0x45, 0x05, 0xFB, 0xE2, 0xD2,
+	 0xDA, 0x82, 0xC9, 0x81, 0x60, 0x4C, 0xDD, 0x1C, 0xD7, 0x03, 0xBC, 0xFF, 0xDA, 0x01, 0x00, 0xE1,
+	 0xD5, 0xFE, 0xA1, 0xFF, 0xFF, 0xFF, 0x08, 0xE1, 0xA1, 0xFF, 0x67, 0x4C, 0x43, 0xFF, 0xAD, 0x4F,
+	 0x02, 0xBC, 0x00, 0x7F, 0xA0, 0x5D, 0x01, 0xE1, 0x01, 0x60, 0x69, 0x6B, 0xA5, 0x60, 0xC4, 0x64,
+	 0x60, 0x4C, 0xBB, 0xFF, 0xA1, 0xFF, 0xFF, 0xFF, 0x60, 0x4C, 0xA1, 0xFF, 0xFF, 0xFF, 0x60, 0x4C,
+	 0xFC, 0x01, 0x29, 0xF3, 0x2A, 0xF1, 0x07, 0xB5, 0x04, 0xE1, 0x65, 0x41, 0x64, 0x54, 0xCD, 0xE2,
+	 0x95, 0x81, 0xA1, 0x5D, 0xA1, 0xFF, 0xFF, 0xFF, 0xF9, 0x01, 0x00, 0xE1, 0x30, 0x40, 0x02, 0x36,
+	 0xA1, 0xFF, 0x83, 0xFF, 0x8D, 0xFF, 0x5C, 0x44, 0x5C, 0x43, 0x5C, 0x42, 0x5C, 0x41, 0x5C, 0x40,
+	 0xAC, 0xFF, 0xAD, 0xFF, 0xE7, 0xE1, 0xB1, 0x60, 0xC0, 0x78, 0xFF, 0xFF, 0x10, 0x61, 0x7F, 0x60,
+	 0xC0, 0x64, 0xA0, 0x80, 0x7F, 0x67, 0x02, 0x63, 0x26, 0x02, 0x98, 0xFE, 0x1A, 0x05, 0x1B, 0x60,
+	 0xB8, 0x62, 0xA2, 0xD5, 0x0E, 0xF2, 0x15, 0x18, 0x02, 0x18, 0x09, 0xF4, 0xFB, 0x01, 0x23, 0x44,
+	 0x00, 0xA8, 0x08, 0x7E, 0x0A, 0x02, 0x66, 0x44, 0x11, 0xFB, 0x46, 0x43, 0x23, 0x47, 0x80, 0xBF,
+	 0x3B, 0x42, 0x04, 0xA2, 0xA2, 0xDB, 0x08, 0xB9, 0x10, 0x7E, 0x00, 0x7F, 0x0E, 0xFA, 0x00, 0x67,
+	 0x0A, 0x00, 0x20, 0x44, 0xDC, 0x85, 0x0F, 0xB4, 0xF6, 0xA0, 0x7F, 0x67, 0x07, 0x63, 0x03, 0x05,
+	 0x45, 0x40, 0x00, 0x67, 0xD8, 0xFE, 0xFF, 0x27, 0x05, 0xFD, 0x0A, 0x7E, 0x04, 0xFB, 0x61, 0x55,
+	 0x4A, 0x00, 0x28, 0xFB, 0x01, 0xF3, 0x29, 0xFB, 0x44, 0x46, 0x40, 0x45, 0x10, 0x61, 0x7E, 0x60,
+	 0xC0, 0x64, 0xA0, 0x80, 0x7F, 0x67, 0x02, 0x63, 0x31, 0x02, 0xB3, 0x60, 0x58, 0x4F, 0x22, 0x78,
+	 0xFF, 0xFF, 0x7F, 0x67, 0x03, 0x63, 0x2A, 0x02, 0x26, 0x40, 0x01, 0x2B, 0x24, 0x00, 0x98, 0xFE,
+	 0x19, 0x05, 0x1B, 0x60, 0xB8, 0x62, 0xA2, 0xD5, 0x0E, 0xF2, 0x14, 0x18, 0x02, 0x18, 0x09, 0xF4,
+	 0xFB, 0x01, 0x23, 0x44, 0x00, 0xA8, 0x08, 0x7E, 0x0A, 0x02, 0x66, 0x44, 0x11, 0xFB, 0x46, 0x43,
+	 0x23, 0x47, 0x80, 0xBF, 0x3B, 0x42, 0x04, 0xA2, 0xA2, 0xDB, 0x08, 0xB9, 0x10, 0x7E, 0x00, 0x7F,
+	 0x0E, 0xFA, 0x09, 0x00, 0x20, 0x44, 0xDC, 0x85, 0x0F, 0xB4, 0xF6, 0xA0, 0x7F, 0x67, 0x07, 0x63,
+	 0x05, 0x05, 0x45, 0x40, 0xD8, 0xFE, 0x00, 0x67, 0xD0, 0xFE, 0xD9, 0xFE, 0xFF, 0x27, 0x05, 0xFD,
+	 0x0B, 0x7E, 0x04, 0xFB, 0x12, 0x60, 0xC8, 0x63, 0xA3, 0xD3, 0xFF, 0xFF, 0x20, 0xB0, 0x80, 0xBC,
+	 0x08, 0x28, 0xA3, 0xDB, 0x61, 0x55, 0x63, 0x00, 0x04, 0xB5, 0x82, 0xB5, 0x25, 0x02, 0x04, 0x03,
+	 0x20, 0x44, 0x7F, 0xB4, 0x40, 0x40, 0xA3, 0xD3, 0x99, 0xFE, 0x04, 0x04, 0x02, 0xBC, 0xFE, 0xB4,
+	 0xA3, 0xDB, 0x56, 0x00, 0xBC, 0xF3, 0x20, 0x40, 0x80, 0x26, 0x52, 0x00, 0xA3, 0xD3, 0xFF, 0xA0,
+	 0xF8, 0xB4, 0x02, 0x02, 0xA3, 0xDB, 0x1C, 0x00, 0x04, 0xBC, 0xBF, 0xB4, 0xA3, 0xDB, 0x08, 0xB0,
+	 0x01, 0x64, 0x08, 0x24, 0x02, 0x64, 0x28, 0xFB, 0x20, 0x44, 0x80, 0xBC, 0x40, 0x40, 0xD0, 0xFE,
+	 0x3F, 0x00, 0xBF, 0xB4, 0xA3, 0xDB, 0x3C, 0x00, 0x40, 0xB0, 0xFF, 0xFF, 0xFA, 0x02, 0xF8, 0xB4,
+	 0xA3, 0xDB, 0x08, 0xB5, 0x07, 0x7C, 0x01, 0x02, 0xBC, 0xF9, 0x20, 0x44, 0x7F, 0xB4, 0x40, 0x40,
+	 0x12, 0x60, 0xC8, 0x63, 0xA3, 0xD3, 0xFF, 0xFF, 0x20, 0xB5, 0x07, 0xB5, 0x08, 0x28, 0xC4, 0x02,
+	 0x99, 0xFE, 0x26, 0x05, 0x20, 0x44, 0x80, 0x26, 0x23, 0x00, 0x20, 0x2A, 0x00, 0x00, 0x40, 0x2A,
+	 0x1F, 0x00, 0xBF, 0xB4, 0x40, 0x40, 0x09, 0x00, 0xA8, 0xFF, 0x20, 0x44, 0x99, 0xFE, 0x02, 0x05,
+	 0x80, 0x2A, 0x03, 0x00, 0x40, 0xBC, 0x40, 0x40, 0x13, 0x00, 0x00, 0xF1, 0x80, 0xBC, 0x40, 0x40,
+	 0x64, 0x44, 0xE0, 0x84, 0xE8, 0x84, 0x0A, 0x36, 0x29, 0x01, 0x0B, 0x36, 0x5A, 0x01, 0x28, 0xFB,
+	 0x01, 0xF1, 0x29, 0xF9, 0x02, 0xF1, 0x2A, 0xF9, 0x03, 0xF1, 0x2B, 0xF9, 0xD0, 0xFE, 0xAE, 0xFF,
+	 0xA1, 0xFF, 0xFF, 0xFF, 0x82, 0x3E, 0x75, 0x44, 0x02, 0xB0, 0x01, 0xB0, 0x28, 0x02, 0xDC, 0x02,
+	 0x04, 0xB0, 0x08, 0xB0, 0x0B, 0x02, 0x20, 0x02, 0x40, 0x26, 0xA7, 0xFF, 0x8C, 0xFF, 0x75, 0x40,
+	 0x80, 0x2B, 0x01, 0x00, 0xAB, 0xFF, 0x75, 0x44, 0x8D, 0xFF, 0xEA, 0x01, 0x0A, 0xF3, 0xAA, 0xFF,
+	 0x60, 0x40, 0x20, 0x2B, 0x02, 0x00, 0x60, 0xFF, 0x0D, 0x00, 0x01, 0x26, 0x0C, 0x00, 0xC0, 0x60,
+	 0x00, 0x7C, 0xA0, 0x84, 0x80, 0x3B, 0x02, 0x00, 0xC0, 0x67, 0x03, 0x00, 0x40, 0x3B, 0x02, 0x00,
+	 0x00, 0x67, 0x0A, 0xFB, 0xD5, 0x01, 0xD4, 0x01, 0xAB, 0xFF, 0x00, 0x00, 0xD1, 0x01, 0x79, 0x63,
+	 0xFF, 0xFF, 0xFF, 0x1F, 0xA9, 0xFF, 0x77, 0x44, 0x60, 0x57, 0x10, 0x60, 0x00, 0x75, 0x40, 0x4A,
+	 0x01, 0x2A, 0x1C, 0x00, 0x24, 0x44, 0xAC, 0x86, 0x08, 0xF2, 0x18, 0x03, 0x1B, 0x60, 0xBE, 0x65,
+	 0xD4, 0x80, 0x0E, 0xF2, 0x02, 0x03, 0xA5, 0xD5, 0x04, 0x00, 0x01, 0xBC, 0x0E, 0xFA, 0x09, 0xF4,
+	 0xD1, 0xFE, 0x46, 0x44, 0x0B, 0x18, 0x66, 0x44, 0x10, 0xFB, 0x66, 0x47, 0x20, 0xBF, 0x3B, 0x42,
+	 0x04, 0xA2, 0xA2, 0xDB, 0x0E, 0xF2, 0x01, 0x75, 0x10, 0xBC, 0x0E, 0xFA, 0x2A, 0x44, 0x08, 0x2A,
+	 0x18, 0x00, 0x23, 0x44, 0x00, 0xA8, 0x5C, 0x43, 0x14, 0x03, 0x1B, 0x60, 0xB8, 0x62, 0xA2, 0xD5,
+	 0x01, 0x00, 0x09, 0xF4, 0x0E, 0xF2, 0x0D, 0x18, 0x08, 0xB0, 0x18, 0xAC, 0xFA, 0x03, 0x0E, 0xFA,
+	 0x66, 0x43, 0x11, 0xFD, 0x46, 0x43, 0x23, 0x47, 0x80, 0xBF, 0x3B, 0x42, 0x04, 0xA2, 0xA2, 0xDB,
+	 0x08, 0x75, 0x2A, 0x44, 0x06, 0x22, 0x2D, 0x00, 0x22, 0x44, 0x00, 0xA8, 0x60, 0x46, 0x0E, 0xF2,
+	 0x28, 0x03, 0x10, 0xB0, 0x01, 0xBC, 0x03, 0x02, 0x00, 0x64, 0x40, 0x42, 0x22, 0x00, 0x0E, 0xFA,
+	 0xD1, 0xFE, 0x1B, 0x60, 0xB2, 0x64, 0x40, 0x47, 0x58, 0x4F, 0x80, 0x00, 0x46, 0x42, 0x19, 0x02,
+	 0x22, 0x47, 0x40, 0xBF, 0x3B, 0x42, 0x04, 0xA2, 0xA2, 0xDB, 0x23, 0xF2, 0x66, 0x43, 0x00, 0xA8,
+	 0x0E, 0xF2, 0x08, 0x02, 0x60, 0x40, 0x02, 0x2A, 0xE4, 0x01, 0x12, 0xFD, 0x10, 0x64, 0x0E, 0xFA,
+	 0x02, 0x75, 0x07, 0x00, 0x60, 0x40, 0x04, 0x2A, 0xDC, 0x01, 0x12, 0xFD, 0x10, 0x64, 0x0E, 0xFA,
+	 0x04, 0x75, 0x2A, 0x44, 0x80, 0x2A, 0x19, 0x00, 0x21, 0x44, 0xAC, 0x86, 0x0E, 0xF2, 0x15, 0x03,
+	 0x01, 0xBC, 0x0E, 0xFA, 0xD1, 0xFE, 0x1B, 0x60, 0xCA, 0x64, 0x40, 0x47, 0x58, 0x4F, 0x56, 0x00,
+	 0x46, 0x41, 0x0B, 0x02, 0x21, 0x47, 0x10, 0xBF, 0x3B, 0x42, 0x04, 0xA2, 0xA2, 0xDB, 0x0E, 0xF2,
+	 0x66, 0x43, 0x08, 0xFD, 0x10, 0xBC, 0x0E, 0xFA, 0x80, 0x75, 0x2A, 0x44, 0x10, 0xB0, 0x20, 0x44,
+	 0x15, 0x03, 0x7F, 0xB4, 0x40, 0x40, 0x12, 0x60, 0xC8, 0x63, 0xA3, 0xD3, 0xFF, 0xFF, 0x20, 0xB0,
+	 0x80, 0xB0, 0x09, 0x03, 0x08, 0x03, 0x40, 0xBC, 0x7F, 0xB4, 0x04, 0xB0, 0xA3, 0xDB, 0x03, 0x03,
+	 0x20, 0x44, 0x80, 0xBC, 0x40, 0x40, 0xB1, 0x60, 0x90, 0x78, 0xFF, 0xFF, 0xB1, 0x60, 0xC0, 0x78,
+	 0xFF, 0xFF, 0xE8, 0xFE, 0x14, 0x05, 0xEA, 0xFE, 0x24, 0x05, 0xE9, 0xFE, 0x1C, 0x05, 0xE7, 0xFE,
+	 0x09, 0x05, 0x47, 0xFF, 0x20, 0x44, 0x0F, 0x22, 0x03, 0x00, 0xCC, 0x84, 0x40, 0x40, 0x0F, 0x22,
+	 0xB8, 0xFE, 0xEC, 0x01, 0x23, 0x41, 0x00, 0xB9, 0x5C, 0x4A, 0xE8, 0x02, 0x6E, 0x01, 0x24, 0x41,
+	 0x00, 0xB9, 0x1B, 0x60, 0xBE, 0x65, 0x45, 0x47, 0xE1, 0x02, 0x58, 0x4F, 0x0F, 0x00, 0xDE, 0x02,
+	 0x5C, 0x4A, 0x46, 0x44, 0x50, 0x01, 0x22, 0x41, 0x00, 0xB9, 0x5C, 0x4A, 0x08, 0x24, 0x81, 0x01,
+	 0xD5, 0x01, 0x21, 0x41, 0x00, 0xB9, 0x5C, 0x4A, 0xA6, 0x03, 0xD0, 0x01, 0x27, 0xD3, 0x03, 0x00,
+	 0x10, 0xB0, 0x09, 0xF2, 0x04, 0x03, 0xAC, 0x86, 0x0E, 0xF2, 0xFA, 0x02, 0x08, 0xFE, 0x2F, 0x58,
+	 0xFF, 0xFF, 0x0E, 0xF3, 0x0F, 0x60, 0xFE, 0x65, 0x0C, 0xF3, 0x24, 0x86, 0x24, 0x46, 0x60, 0x40,
+	 0xFB, 0x3B, 0x07, 0x00, 0x80, 0x26, 0x02, 0x00, 0x23, 0x46, 0x03, 0x4C, 0x46, 0x61, 0x3A, 0x65,
+	 0x0C, 0x00, 0x2E, 0xF3, 0x40, 0x45, 0xF8, 0x2B, 0x02, 0x00, 0x40, 0x45, 0x03, 0x00, 0x58, 0x4F,
+	 0x39, 0x00, 0x07, 0x02, 0x58, 0x4F, 0x45, 0x00, 0x04, 0x05, 0x66, 0x50, 0x65, 0x52, 0x61, 0x51,
+	 0x09, 0x00, 0x26, 0x47, 0x00, 0xBF, 0x0E, 0xFB, 0x2E, 0xF5, 0x05, 0xF0, 0x80, 0x60, 0x64, 0x50,
+	 0x00, 0x72, 0x7E, 0x71, 0xAC, 0xFF, 0xB1, 0x60, 0xC0, 0x78, 0xFF, 0xFF, 0x8E, 0xFF, 0x0F, 0xF3,
+	 0x0F, 0x60, 0xFE, 0x65, 0x24, 0x86, 0x0D, 0xF3, 0x2E, 0xF3, 0x40, 0x45, 0xF8, 0x2B, 0x02, 0x00,
+	 0x40, 0x45, 0x03, 0x00, 0x58, 0x4F, 0x16, 0x00, 0x07, 0x02, 0x58, 0x4F, 0x22, 0x00, 0x04, 0x05,
+	 0x66, 0x50, 0x65, 0x52, 0x61, 0x51, 0x09, 0x00, 0x26, 0x47, 0x00, 0xBF, 0x0F, 0xFB, 0x2E, 0xF5,
+	 0x05, 0xF0, 0x80, 0x60, 0x64, 0x50, 0x00, 0x72, 0x7E, 0x71, 0x8D, 0xFF, 0xAD, 0xFF, 0xB1, 0x60,
+	 0xC0, 0x78, 0xFF, 0xFF, 0x25, 0x44, 0x8A, 0xF1, 0x8B, 0xF1, 0xD0, 0x80, 0xD0, 0x80, 0x07, 0x04,
+	 0x01, 0x06, 0x05, 0x00, 0x25, 0x46, 0x01, 0xF0, 0x03, 0x67, 0xA0, 0x85, 0x94, 0x80, 0x2F, 0x58,
+	 0xFF, 0xFF, 0x25, 0x46, 0x26, 0x41, 0x46, 0x63, 0x01, 0xF2, 0xFF, 0xFF, 0xFF, 0xB5, 0xD5, 0x81,
+	 0x00, 0xF2, 0x05, 0x04, 0x04, 0x63, 0x60, 0x46, 0xF7, 0x1B, 0x42, 0xFE, 0x0D, 0x00, 0x61, 0x44,
+	 0xC5, 0x81, 0x63, 0x45, 0xC5, 0x81, 0x9C, 0x84, 0xDC, 0x84, 0x01, 0xF2, 0xF0, 0x85, 0xF0, 0x80,
+	 0x65, 0x44, 0xF8, 0x85, 0xFF, 0xFF, 0x02, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0xA2, 0xFF, 0x1B, 0x60,
+	 0xD0, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0xAC, 0x86, 0x0E, 0xF2, 0x07, 0x03, 0x00, 0xA8, 0x09, 0xF2,
+	 0xFA, 0x02, 0x01, 0x67, 0x0E, 0xFA, 0x08, 0xFE, 0x17, 0x00, 0x8C, 0xF3, 0xFF, 0xFF, 0xD8, 0xA0,
+	 0x00, 0xB4, 0x12, 0x06, 0x09, 0x60, 0x08, 0x61, 0x41, 0x4A, 0x7C, 0xA1, 0x0E, 0xA1, 0xA2, 0xFF,
+	 0xB3, 0x60, 0x58, 0x4E, 0x97, 0x78, 0xFF, 0xFF, 0xA3, 0xFF, 0x06, 0x03, 0x2A, 0x43, 0xB3, 0x60,
+	 0x58, 0x4E, 0xB8, 0x78, 0xFF, 0xFF, 0x08, 0xFE, 0xA3, 0xFF, 0x2D, 0x58, 0xFF, 0xFF, 0x41, 0x4A,
+	 0x7C, 0xA1, 0x0E, 0xA1, 0xA2, 0xFF, 0xB3, 0x60, 0x58, 0x4E, 0x97, 0x78, 0xFF, 0xFF, 0x07, 0x03,
+	 0x2A, 0x43, 0xB3, 0x60, 0x58, 0x4E, 0xB8, 0x78, 0xFF, 0xFF, 0x08, 0xFE, 0x0D, 0x00, 0x1B, 0x60,
+	 0xD0, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0xAC, 0x86, 0x0E, 0xF2, 0x06, 0x03, 0x00, 0xA8, 0x09, 0xF2,
+	 0xFA, 0x02, 0x01, 0x67, 0x0E, 0xFA, 0x08, 0xFE, 0xA3, 0xFF, 0x2D, 0x58, 0xFF, 0xFF, 0x8D, 0xF3,
+	 0x7C, 0x63, 0x00, 0xBE, 0x40, 0x45, 0x1A, 0x03, 0x00, 0x65, 0x65, 0x44, 0xDC, 0x85, 0x84, 0xA1,
+	 0x00, 0xF2, 0x06, 0x06, 0x01, 0xFC, 0x00, 0xA8, 0x60, 0x46, 0xF7, 0x02, 0x40, 0x45, 0x0E, 0x00,
+	 0x8C, 0xF3, 0x00, 0x63, 0xD4, 0x84, 0x8C, 0xFB, 0x80, 0x60, 0x7C, 0x64, 0x01, 0xFA, 0x00, 0xF0,
+	 0x00, 0xFC, 0xD3, 0x80, 0x8D, 0xF9, 0x02, 0x02, 0x8E, 0xF9, 0x08, 0xFE, 0x2E, 0x58, 0xFF, 0xFF,
+	 0x66, 0x44, 0x25, 0x46, 0x05, 0xFA, 0x06, 0xFA, 0x01, 0xF0, 0x03, 0x67, 0x02, 0xFC, 0xB0, 0x84,
+	 0x3A, 0x7E, 0x01, 0xFA, 0x12, 0x64, 0x03, 0xFA, 0x00, 0xF0, 0x04, 0xF8, 0x00, 0x64, 0x0C, 0x61,
+	 0x10, 0x63, 0x59, 0xDA, 0xFE, 0x1F, 0x2E, 0x58, 0xFF, 0xFF, 0x27, 0x43, 0xE3, 0x81, 0xE9, 0x81,
+	 0x03, 0x05, 0x16, 0x03, 0x00, 0x61, 0x01, 0x00, 0xE4, 0x63, 0x61, 0x46, 0xBF, 0xD2, 0x27, 0x45,
+	 0xDC, 0x84, 0xA2, 0xDA, 0xBE, 0xD2, 0x25, 0x46, 0x88, 0xF8, 0x04, 0x1B, 0x25, 0x44, 0x61, 0x46,
+	 0xA3, 0xDA, 0x04, 0x00, 0x0A, 0xFA, 0x60, 0x46, 0x25, 0x44, 0x09, 0xFA, 0x61, 0x46, 0xBE, 0xDA,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x25, 0x44, 0x00, 0xA8, 0x07, 0x4B, 0x0C, 0x03, 0x58, 0x4F, 0x33, 0x00,
+	 0x0B, 0x47, 0x1B, 0x60, 0xC4, 0x65, 0x27, 0x44, 0xD4, 0x80, 0x00, 0x64, 0x01, 0x02, 0x0F, 0xFA,
+	 0x58, 0x4F, 0xD3, 0x01, 0x70, 0x00, 0x25, 0x43, 0xE3, 0x84, 0x7C, 0x41, 0x02, 0x04, 0xE8, 0x81,
+	 0xE4, 0x63, 0x61, 0x46, 0xA3, 0xD2, 0x00, 0x7C, 0x40, 0x45, 0xBF, 0xD8, 0xA3, 0xD8, 0xBE, 0xD8,
+	 0x27, 0x42, 0x5A, 0xD3, 0x25, 0x5C, 0x60, 0x41, 0x02, 0x1B, 0x27, 0xD9, 0x05, 0x00, 0x25, 0x46,
+	 0x0A, 0xFA, 0x61, 0x46, 0x25, 0x44, 0x09, 0xFA, 0x25, 0x44, 0x27, 0x43, 0x00, 0x61, 0x60, 0x46,
+	 0x09, 0xF2, 0x08, 0xFC, 0x00, 0xA8, 0xDD, 0x81, 0xFA, 0x02, 0xBF, 0xD1, 0x66, 0x44, 0xBE, 0xDB,
+	 0xC1, 0x84, 0xBF, 0xDB, 0x48, 0x00, 0x25, 0x46, 0xE4, 0x63, 0x08, 0xF2, 0x89, 0xF2, 0x1E, 0x18,
+	 0x40, 0x47, 0xE0, 0x84, 0xE8, 0x85, 0x02, 0x05, 0xE8, 0x83, 0x00, 0x65, 0x65, 0x46, 0xBF, 0xD2,
+	 0x61, 0x5C, 0xCC, 0x84, 0xA2, 0xDA, 0x25, 0x46, 0x0A, 0xF2, 0x00, 0xB9, 0x65, 0x46, 0x08, 0x24,
+	 0xBE, 0xDA, 0x02, 0x1B, 0xA3, 0xD8, 0x02, 0x00, 0x60, 0x46, 0x89, 0xFA, 0x00, 0xB9, 0x61, 0x46,
+	 0x08, 0x28, 0x0A, 0xFA, 0x25, 0x46, 0x89, 0xFC, 0x8A, 0xFC, 0x88, 0xFC, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x00, 0x61, 0x28, 0x65, 0x25, 0x43, 0x8E, 0xF3, 0xAF, 0x83, 0x00, 0xBE, 0x18, 0x03, 0x02, 0x03,
+	 0x00, 0xFC, 0x01, 0x00, 0x8D, 0xFD, 0x63, 0x46, 0x65, 0x44, 0xCC, 0x85, 0x00, 0xF2, 0x07, 0x02,
+	 0x8E, 0xF5, 0x00, 0x64, 0x00, 0xFA, 0xDE, 0x60, 0xAF, 0x64, 0x09, 0xFB, 0x08, 0x00, 0x66, 0x43,
+	 0x00, 0xBE, 0xDD, 0x81, 0xF1, 0x02, 0x8C, 0xF1, 0x8E, 0xFD, 0xC1, 0x84, 0x8C, 0xFB, 0x2E, 0x58,
+	 0xFF, 0xFF, 0x00, 0x66, 0x46, 0x45, 0x29, 0x43, 0xFC, 0xA3, 0x66, 0x44, 0xBD, 0xDB, 0x25, 0x44,
+	 0xBD, 0xDB, 0x00, 0x64, 0xBD, 0xDB, 0x03, 0x61, 0x0E, 0x65, 0x1B, 0x60, 0xD8, 0x63, 0x43, 0x49,
+	 0xA3, 0xD3, 0x06, 0xA3, 0x00, 0xA8, 0xCD, 0x81, 0x04, 0x02, 0xF9, 0x02, 0xB1, 0x60, 0xC0, 0x78,
+	 0xFF, 0xFF, 0x01, 0x26, 0xE6, 0x01, 0xD4, 0x80, 0x60, 0x45, 0xE3, 0x05, 0xF6, 0xA3, 0xBD, 0xD1,
+	 0xBD, 0xD1, 0x44, 0x47, 0x44, 0x48, 0x44, 0x45, 0x1C, 0x60, 0x16, 0x64, 0x44, 0xD7, 0xFF, 0xFF,
+	 0xFF, 0xFF, 0x48, 0xFE, 0x8D, 0xF5, 0x8C, 0xF3, 0x0D, 0x18, 0xCC, 0x84, 0x8C, 0xFB, 0x80, 0x60,
+	 0x7C, 0x64, 0x01, 0xFA, 0x00, 0x64, 0x00, 0xF0, 0x00, 0xFA, 0xD0, 0x80, 0x8D, 0xF9, 0x02, 0x02,
+	 0x8E, 0xF9, 0x08, 0xFE, 0x2E, 0x58, 0xFF, 0xFF, 0x1B, 0x60, 0x88, 0x63, 0x0D, 0x65, 0x00, 0x61,
+	 0x41, 0x48, 0xA3, 0xD3, 0x06, 0xA3, 0xAC, 0x86, 0x00, 0x61, 0x09, 0x03, 0x00, 0xF2, 0x09, 0xF0,
+	 0xAC, 0x86, 0x00, 0xF2, 0xDD, 0x81, 0xFC, 0x02, 0x64, 0x44, 0xAC, 0x86, 0xF6, 0x01, 0x61, 0x44,
+	 0x25, 0x46, 0x27, 0xDA, 0x65, 0x44, 0x28, 0x45, 0x45, 0x88, 0xCC, 0x85, 0x5A, 0x87, 0xE9, 0x02,
+	 0x00, 0x64, 0x27, 0xDA, 0x5A, 0xDA, 0x5A, 0x87, 0x88, 0xF3, 0x87, 0xF1, 0x02, 0xA4, 0x60, 0x46,
+	 0x60, 0x45, 0x00, 0x61, 0x1E, 0xF2, 0xFF, 0xFF, 0xAC, 0x86, 0x00, 0xF2, 0x04, 0x03, 0xAC, 0x86,
+	 0x00, 0xF2, 0xDD, 0x81, 0xFC, 0x02, 0x65, 0x44, 0x02, 0xA5, 0x65, 0x46, 0x64, 0x44, 0xCC, 0x9C,
+	 0xFF, 0xFF, 0xF0, 0x02, 0x61, 0x44, 0x25, 0x46, 0x27, 0xDA, 0x5A, 0x87, 0x28, 0x45, 0x45, 0x88,
+	 0x88, 0xF3, 0x87, 0xF1, 0x02, 0xA4, 0x60, 0x46, 0x60, 0x45, 0x00, 0x61, 0x72, 0xF2, 0xFF, 0xFF,
+	 0xAC, 0x86, 0x00, 0xF2, 0x09, 0x03, 0x00, 0xF2, 0x09, 0xF0, 0xAC, 0x86, 0x00, 0xF2, 0xDD, 0x81,
+	 0xFC, 0x02, 0x64, 0x44, 0xAC, 0x86, 0xF6, 0x01, 0x65, 0x44, 0x02, 0xA5, 0x65, 0x46, 0x64, 0x44,
+	 0xCC, 0x9C, 0x61, 0x44, 0xEB, 0x02, 0x25, 0x46, 0x27, 0xDA, 0x5A, 0x87, 0x28, 0x45, 0x45, 0x88,
+	 0x06, 0x60, 0x40, 0x65, 0x8D, 0xF3, 0x01, 0x61, 0xAC, 0x86, 0x00, 0xF2, 0x03, 0x03, 0xD5, 0x80,
+	 0xDD, 0x81, 0xFA, 0x04, 0xCD, 0x84, 0x25, 0x46, 0x27, 0xDA, 0x28, 0x45, 0xC4, 0x84, 0x5A, 0xDA,
+	 0xDA, 0x81, 0x8C, 0xF1, 0x59, 0xD8, 0x1B, 0x60, 0x86, 0x64, 0x18, 0x63, 0xA0, 0xD1, 0x06, 0xA4,
+	 0x59, 0xD8, 0xFC, 0x1F, 0x00, 0x64, 0x59, 0xDA, 0x59, 0xDA, 0x01, 0x60, 0x1C, 0x64, 0x0A, 0x63,
+	 0x58, 0xD1, 0x59, 0xD8, 0xFD, 0x1F, 0x7E, 0xF1, 0x59, 0xD8, 0x45, 0x01, 0x07, 0x4B, 0xB4, 0x60,
+	 0x58, 0x4F, 0x23, 0x78, 0xFF, 0xFF, 0x0B, 0x47, 0x58, 0x4F, 0x21, 0x00, 0x3C, 0x01, 0x07, 0x4B,
+	 0xB4, 0x60, 0x58, 0x4F, 0x23, 0x78, 0xFF, 0xFF, 0x0B, 0x47, 0x27, 0x44, 0x00, 0xBE, 0x08, 0xF0,
+	 0x15, 0x03, 0x64, 0x42, 0x4A, 0xD3, 0x09, 0xF2, 0xDC, 0x83, 0xA2, 0xDD, 0x25, 0x43, 0x09, 0xFC,
+	 0x63, 0x46, 0x27, 0x43, 0x0A, 0xFC, 0x09, 0xFA, 0x08, 0xF8, 0x00, 0xA8, 0x66, 0x43, 0x03, 0x02,
+	 0x64, 0x44, 0x58, 0xDD, 0x03, 0x00, 0x60, 0x46, 0x25, 0x44, 0x0A, 0xFA, 0x1C, 0x01, 0x27, 0x43,
+	 0xE3, 0x81, 0xE9, 0x81, 0x03, 0x05, 0x16, 0x03, 0x00, 0x61, 0x01, 0x00, 0xE4, 0x63, 0x61, 0x46,
+	 0xBF, 0xD2, 0x27, 0x45, 0xDC, 0x84, 0xA2, 0xDA, 0xA3, 0xD2, 0x25, 0x46, 0x88, 0xF8, 0x04, 0x1B,
+	 0x25, 0x44, 0x61, 0x46, 0xBE, 0xDA, 0x04, 0x00, 0x09, 0xFA, 0x60, 0x46, 0x25, 0x44, 0x0A, 0xFA,
+	 0x61, 0x46, 0xA3, 0xDA, 0x2F, 0x58, 0xFF, 0xFF, 0x30, 0x44, 0x02, 0xA8, 0x00, 0xE1, 0x03, 0x02,
+	 0x28, 0xE2, 0x40, 0xFF, 0xA1, 0xFF, 0x84, 0xFF, 0xBF, 0x60, 0xAD, 0x64, 0x40, 0x42, 0xB5, 0x60,
+	 0xA2, 0x64, 0x40, 0x40, 0x9D, 0xF3, 0x66, 0xFB, 0x0F, 0x60, 0x9A, 0x63, 0xAA, 0xF3, 0xBD, 0xDB,
+	 0x00, 0x60, 0x9A, 0x64, 0xBD, 0xDB, 0x02, 0x64, 0xBD, 0xDB, 0x04, 0x64, 0xA3, 0xDB, 0x5C, 0x49,
+	 0x0A, 0x64, 0x40, 0x4B, 0x5C, 0x5C, 0x01, 0x60, 0x39, 0xE2, 0x04, 0x60, 0x00, 0x7A, 0x89, 0xFF,
+	 0x03, 0x60, 0xFF, 0x73, 0x88, 0xFF, 0xB5, 0x60, 0xA2, 0x78, 0xFF, 0xFF, 0xA0, 0xFE, 0x07, 0x05,
+	 0xA3, 0xFE, 0x07, 0x05, 0xA1, 0xFE, 0x50, 0x05, 0x60, 0x64, 0x3B, 0xDB, 0x10, 0x00, 0x20, 0x58,
+	 0xFF, 0xFF, 0xFA, 0x01, 0x12, 0x60, 0xCC, 0x63, 0xA3, 0xD3, 0xFF, 0xFF, 0xFB, 0xB4, 0xA3, 0xDB,
+	 0xA0, 0x4C, 0x59, 0xBC, 0xFF, 0xB4, 0xA0, 0x51, 0xA0, 0x4C, 0x7D, 0xB4, 0xA0, 0x51, 0xA1, 0xFF,
+	 0xFF, 0xFF, 0x83, 0x3E, 0x40, 0x60, 0x0B, 0x65, 0x2B, 0x44, 0x00, 0x63, 0xE8, 0x80, 0xF8, 0x84,
+	 0x02, 0x24, 0x94, 0x84, 0xF3, 0x83, 0xCD, 0x81, 0xFF, 0xFF, 0xF8, 0x02, 0xDF, 0x83, 0x2F, 0x58,
+	 0x40, 0x4B, 0x00, 0x62, 0x01, 0x64, 0xD4, 0x80, 0xE0, 0x84, 0x1A, 0x03, 0xD4, 0x80, 0xE0, 0x84,
+	 0x15, 0x03, 0x61, 0x44, 0x11, 0x61, 0xE0, 0x84, 0xCD, 0x81, 0xFD, 0x04, 0x01, 0x00, 0xE0, 0x84,
+	 0xF2, 0x82, 0xFF, 0xFF, 0x02, 0x24, 0xC6, 0x82, 0x02, 0x28, 0xD6, 0x82, 0xE2, 0x80, 0xCD, 0x81,
+	 0x02, 0x28, 0x01, 0xBC, 0xF4, 0x02, 0x01, 0x2A, 0xC6, 0x82, 0x03, 0x00, 0xE9, 0x81, 0xF2, 0x82,
+	 0x61, 0x44, 0x2D, 0x58, 0xFF, 0xFF, 0x00, 0xA8, 0x10, 0x61, 0x04, 0x03, 0xF0, 0x84, 0xCD, 0x81,
+	 0xFD, 0x04, 0x61, 0x44, 0x2D, 0x58, 0xFF, 0xFF, 0x00, 0x64, 0x3B, 0xDB, 0x16, 0x60, 0xA8, 0x63,
+	 0xBD, 0xD3, 0xA3, 0xD1, 0x60, 0x40, 0x04, 0x3A, 0x2D, 0x00, 0x00, 0x64, 0x4A, 0xDB, 0x1B, 0x60,
+	 0x88, 0x63, 0xA3, 0xD3, 0x46, 0x43, 0xAC, 0x86, 0x3C, 0x45, 0x23, 0x03, 0xD4, 0x80, 0x07, 0xF2,
+	 0x02, 0x02, 0x09, 0xF2, 0xF8, 0x01, 0xD0, 0x80, 0x09, 0xF2, 0xF5, 0x02, 0x60, 0x43, 0x80, 0x67,
+	 0xB0, 0x81, 0x1B, 0x60, 0xDA, 0x62, 0x61, 0x44, 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64,
+	 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0x09, 0x60, 0x08, 0x65, 0x0E, 0xF2, 0x02, 0xF2, 0x60, 0x40,
+	 0xF0, 0x37, 0x05, 0x00, 0x90, 0xF3, 0xD4, 0x80, 0xCC, 0x84, 0x01, 0x02, 0x90, 0xFB, 0x63, 0x44,
+	 0xDA, 0x01, 0x23, 0x46, 0x3C, 0x44, 0xAC, 0x80, 0xFF, 0xFF, 0x89, 0x02, 0x6A, 0xF3, 0x6B, 0xF3,
+	 0x02, 0xA8, 0x02, 0xA8, 0x08, 0x02, 0x00, 0x64, 0x6C, 0xFB, 0x6A, 0xFB, 0x6B, 0xFB, 0x00, 0x64,
+	 0x6D, 0xFB, 0xCA, 0xFE, 0x97, 0x00, 0x03, 0x02, 0x00, 0x64, 0x6B, 0xFB, 0xCA, 0xFE, 0x01, 0x64,
+	 0x3B, 0xDB, 0x1B, 0x60, 0x8E, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0x00, 0xA8, 0x60, 0x46, 0x35, 0x03,
+	 0x2C, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x26, 0x8A, 0x00, 0x2E, 0xF2, 0x12, 0x60, 0xCE, 0x65,
+	 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD3, 0x66, 0x41, 0x60, 0x46, 0x60, 0x43, 0x05, 0xF2,
+	 0x16, 0x18, 0x61, 0x46, 0x2E, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x04, 0xF2, 0x0C, 0x02, 0x61, 0x46,
+	 0x2D, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x03, 0xF2, 0x06, 0x02, 0x61, 0x46, 0x2C, 0xF0, 0x63, 0x46,
+	 0xD0, 0x80, 0xFF, 0xFF, 0x07, 0x03, 0x80, 0xF4, 0xFF, 0xFF, 0x63, 0x46, 0xE8, 0x1B, 0x88, 0xF3,
+	 0x08, 0xFE, 0x60, 0x43, 0x61, 0x46, 0x63, 0x02, 0x66, 0x45, 0x63, 0x46, 0x06, 0xF2, 0x65, 0x46,
+	 0x80, 0xB0, 0x09, 0xF2, 0x5C, 0x03, 0xAC, 0x86, 0xCA, 0x01, 0x6B, 0xF3, 0xFF, 0xFF, 0x01, 0xA8,
+	 0xFF, 0xFF, 0x50, 0x02, 0x1B, 0x60, 0xA0, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0x00, 0xA8, 0x60, 0x46,
+	 0x0F, 0x03, 0x77, 0xF1, 0x07, 0xF2, 0xFF, 0xFF, 0xD0, 0x80, 0x09, 0xF2, 0x03, 0x02, 0xAC, 0x86,
+	 0x07, 0xF2, 0xFA, 0x02, 0x03, 0x02, 0x00, 0x64, 0x77, 0xFB, 0xEC, 0x01, 0x46, 0x5C, 0x3F, 0x00,
+	 0x1B, 0x60, 0xA6, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0x00, 0xA8, 0x60, 0x46, 0x01, 0x03, 0x37, 0x02,
+	 0x6C, 0xF3, 0xFF, 0xFF, 0x01, 0xA8, 0xFF, 0xFF, 0x14, 0x02, 0x1B, 0x60, 0x94, 0x62, 0xA2, 0xD3,
+	 0xFF, 0xFF, 0x00, 0xA8, 0x60, 0x46, 0x0B, 0x03, 0x2A, 0xF0, 0x20, 0x67, 0x09, 0xF2, 0xB0, 0x83,
+	 0x00, 0xA8, 0x00, 0x64, 0x02, 0x03, 0x2A, 0xFC, 0x01, 0x00, 0x6C, 0xFB, 0x20, 0x00, 0x00, 0x64,
+	 0x6C, 0xFB, 0x1B, 0x60, 0x88, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0x00, 0xA8, 0x60, 0x46, 0x12, 0x03,
+	 0x2A, 0xF0, 0x08, 0x67, 0xA0, 0x80, 0xFF, 0xFF, 0x12, 0x03, 0x77, 0xF1, 0x07, 0xF2, 0xFF, 0xFF,
+	 0xD0, 0x80, 0x09, 0xF2, 0x03, 0x02, 0xAC, 0x86, 0x07, 0xF2, 0xFA, 0x02, 0x08, 0x02, 0x00, 0x64,
+	 0x77, 0xFB, 0xE7, 0x01, 0x00, 0x64, 0x77, 0xFB, 0xB5, 0x60, 0xA2, 0x78, 0xFF, 0xFF, 0x66, 0x44,
+	 0xFC, 0xFB, 0x46, 0x5C, 0x21, 0x60, 0x98, 0x63, 0xA3, 0xD3, 0xB5, 0x60, 0x58, 0x4D, 0xE3, 0x78,
+	 0xFF, 0xFF, 0x0D, 0xF2, 0x60, 0x5C, 0x64, 0x5F, 0x0D, 0xFA, 0x07, 0xF0, 0x2A, 0xF2, 0xFF, 0xFF,
+	 0x77, 0xF9, 0x60, 0x40, 0x08, 0x2B, 0x05, 0x00, 0x00, 0x64, 0x48, 0xFB, 0xB8, 0x60, 0x2D, 0x78,
+	 0xFF, 0xFF, 0x00, 0x64, 0xD0, 0x80, 0x88, 0xF3, 0x07, 0x02, 0x23, 0xF0, 0x04, 0x64, 0xB0, 0x84,
+	 0xA2, 0xDA, 0xBD, 0x60, 0x28, 0x78, 0xFF, 0xFF, 0xD0, 0x80, 0xB8, 0xF3, 0x03, 0x03, 0x60, 0x40,
+	 0x03, 0x3A, 0x00, 0x00, 0x2A, 0xF2, 0x00, 0x63, 0x40, 0x47, 0x50, 0x36, 0x01, 0x00, 0x01, 0x63,
+	 0x48, 0xFD, 0x4A, 0xF3, 0x35, 0xFA, 0x10, 0xA4, 0x4A, 0xFB, 0x00, 0x64, 0x15, 0xFA, 0x16, 0xFA,
+	 0x0F, 0xFA, 0xFF, 0xFF, 0x07, 0xF0, 0x66, 0x43, 0x64, 0x46, 0x0E, 0xF0, 0x63, 0x46, 0x00, 0x7F,
+	 0x64, 0x5E, 0x4B, 0xFB, 0x64, 0x44, 0x00, 0x7E, 0xBB, 0xFB, 0x07, 0xF0, 0x88, 0xF3, 0xFF, 0xFF,
+	 0xD0, 0x80, 0xFF, 0xFF, 0x03, 0x03, 0xBB, 0xF3, 0xBA, 0xFB, 0x60, 0x41, 0x03, 0xF2, 0x00, 0xF4,
+	 0x01, 0xF2, 0xFC, 0xA5, 0x00, 0x7F, 0xD4, 0x84, 0x27, 0x45, 0x3C, 0x46, 0x1A, 0xFA, 0x22, 0x63,
+	 0x7B, 0x60, 0xFF, 0x64, 0xA4, 0x84, 0x03, 0x2B, 0x1C, 0x63, 0x2A, 0xFA, 0x60, 0x40, 0xA4, 0x36,
+	 0x14, 0x63, 0x43, 0x4C, 0x00, 0x7C, 0x22, 0xF8, 0x64, 0x41, 0x07, 0xF0, 0x66, 0x43, 0x64, 0x46,
+	 0x36, 0xF2, 0x63, 0x46, 0xFF, 0xB4, 0x22, 0xFA, 0x60, 0x40, 0x00, 0x36, 0x8E, 0x00, 0x2A, 0xF2,
+	 0xFF, 0xFF, 0x60, 0x40, 0x08, 0x3A, 0x89, 0x00, 0x03, 0xF2, 0x00, 0xF4, 0xA0, 0xD2, 0xAA, 0x60,
+	 0xAA, 0x65, 0x5A, 0xD0, 0xD4, 0x80, 0x03, 0x64, 0x0A, 0x02, 0xD0, 0x80, 0x00, 0x64, 0x5A, 0xD0,
+	 0x06, 0x02, 0xD0, 0x80, 0xF8, 0x7F, 0xD0, 0x80, 0x01, 0x03, 0x01, 0x02, 0x01, 0x61, 0x62, 0x43,
+	 0x46, 0x43, 0x3C, 0x46, 0x07, 0xF4, 0x36, 0xF2, 0xFF, 0xFF, 0xA3, 0x46, 0x60, 0x40, 0x22, 0x26,
+	 0x45, 0x00, 0x60, 0x45, 0x63, 0x42, 0x5A, 0xD0, 0xCD, 0x81, 0x3C, 0x46, 0x14, 0x02, 0x64, 0x44,
+	 0x88, 0x3A, 0x11, 0x00, 0x8E, 0x3B, 0x0F, 0x00, 0x65, 0x44, 0x01, 0x26, 0x5E, 0x00, 0x04, 0x26,
+	 0x03, 0x00, 0x10, 0x26, 0x01, 0x00, 0x2D, 0x00, 0xA3, 0x46, 0x37, 0xF2, 0xFF, 0xFF, 0x60, 0x40,
+	 0x80, 0x2B, 0x53, 0x00, 0x3A, 0x00, 0xA3, 0x46, 0x65, 0x44, 0x01, 0x26, 0x0B, 0x00, 0x04, 0x26,
+	 0x03, 0x00, 0x10, 0x26, 0x01, 0x00, 0x1D, 0x00, 0x37, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x80, 0x27,
+	 0x2C, 0x00, 0x17, 0x00, 0x88, 0xF3, 0xFF, 0xFF, 0x60, 0x46, 0x36, 0xF2, 0x66, 0x43, 0xFF, 0xB4,
+	 0x3C, 0x46, 0x22, 0xF0, 0x60, 0x47, 0xB0, 0x84, 0x22, 0xFA, 0x63, 0x46, 0x37, 0xF0, 0x60, 0x40,
+	 0x04, 0x27, 0x03, 0x00, 0x10, 0x27, 0x01, 0x00, 0x04, 0x00, 0x64, 0x40, 0x80, 0x27, 0x15, 0x00,
+	 0x00, 0x00, 0x3C, 0x46, 0x02, 0x65, 0xBC, 0x60, 0x58, 0x78, 0xFF, 0xFF, 0xCD, 0x81, 0x63, 0x42,
+	 0x5A, 0xD0, 0x3C, 0x46, 0x0A, 0x02, 0x64, 0x44, 0x88, 0x3A, 0x07, 0x00, 0x77, 0x37, 0x1D, 0x00,
+	 0x78, 0x37, 0x1B, 0x00, 0x8E, 0x37, 0x19, 0x00, 0xF1, 0x01, 0x3C, 0x46, 0x22, 0xF0, 0x80, 0x67,
+	 0xB0, 0x84, 0xA2, 0xDA, 0xFF, 0xFF, 0x3F, 0xF2, 0x3E, 0xF0, 0x08, 0xA4, 0x60, 0x41, 0x22, 0xF2,
+	 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x26, 0x03, 0x00, 0x04, 0x26, 0x03, 0x00, 0x06, 0x00, 0x04, 0x2B,
+	 0x04, 0x00, 0x61, 0x44, 0x64, 0x40, 0x10, 0x26, 0x3F, 0xFA, 0x3C, 0x46, 0x2C, 0xF2, 0x27, 0x40,
+	 0x01, 0x27, 0x32, 0xF2, 0xB5, 0xF1, 0x60, 0x40, 0x01, 0x26, 0x53, 0x00, 0x09, 0x60, 0x00, 0x64,
+	 0xD0, 0x80, 0x3F, 0xF2, 0x09, 0x06, 0x2C, 0x45, 0xC4, 0x84, 0xD0, 0x80, 0x40, 0x4A, 0x40, 0x06,
+	 0x60, 0x43, 0x64, 0x44, 0x54, 0x88, 0x18, 0x00, 0x60, 0x45, 0x1F, 0x60, 0x9C, 0x64, 0xA0, 0xD3,
+	 0xBB, 0xF3, 0x00, 0xBC, 0x60, 0x47, 0xEC, 0xA0, 0x33, 0x03, 0x32, 0x07, 0x2C, 0x44, 0xC4, 0x81,
+	 0x02, 0x60, 0x1C, 0x65, 0x45, 0x4A, 0xD5, 0x80, 0x2C, 0x45, 0x2A, 0x06, 0x27, 0x40, 0x04, 0x27,
+	 0x30, 0x00, 0x2A, 0x43, 0xD7, 0x85, 0x45, 0x48, 0xB6, 0xF1, 0x0F, 0xF2, 0xD3, 0x80, 0x01, 0x65,
+	 0x01, 0x07, 0x00, 0x65, 0xB4, 0x84, 0x0F, 0xFA, 0x00, 0x63, 0x3F, 0xF2, 0x28, 0x45, 0x60, 0x41,
+	 0xD4, 0x84, 0xDF, 0x83, 0xFC, 0x07, 0x14, 0xFC, 0x61, 0x44, 0x01, 0x36, 0x02, 0x00, 0x09, 0x3A,
+	 0x06, 0x00, 0x28, 0x44, 0x48, 0x88, 0x2A, 0x44, 0xC8, 0x83, 0x43, 0x4A, 0xE5, 0x01, 0x17, 0xFA,
+	 0x04, 0x60, 0x00, 0x64, 0x27, 0x45, 0xB4, 0x84, 0x2A, 0xFA, 0x28, 0x43, 0x16, 0xFC, 0x0D, 0x00,
+	 0x3F, 0xF2, 0x2C, 0x45, 0xB6, 0xF1, 0xC4, 0x81, 0xD1, 0x80, 0x0F, 0xF2, 0x01, 0x06, 0x01, 0xBC,
+	 0x0F, 0xFA, 0x3F, 0xF2, 0x17, 0xFA, 0x01, 0x64, 0x14, 0xFA, 0x07, 0xF0, 0x66, 0x43, 0x64, 0x46,
+	 0x0E, 0xF0, 0x63, 0x46, 0x00, 0x7F, 0x64, 0x5E, 0x4B, 0xFB, 0x64, 0x44, 0x00, 0x7E, 0xBB, 0xFB,
+	 0x62, 0xF1, 0x60, 0x43, 0x60, 0x47, 0xD0, 0x80, 0xC0, 0x65, 0x01, 0x06, 0x64, 0x44, 0x0A, 0x36,
+	 0x70, 0x64, 0x14, 0x36, 0x38, 0x64, 0x37, 0x36, 0x15, 0x64, 0x6E, 0x36, 0x0B, 0x64, 0x44, 0x86,
+	 0x2A, 0xF2, 0x07, 0xF0, 0x60, 0x40, 0xB0, 0x3A, 0x03, 0x00, 0x40, 0x3B, 0x01, 0x00, 0x12, 0x00,
+	 0x0C, 0xB4, 0x08, 0x3A, 0x55, 0x00, 0x22, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x80, 0x2B, 0x50, 0x00,
+	 0x17, 0xF2, 0x22, 0xF0, 0xFF, 0xFF, 0x64, 0x40, 0x22, 0x22, 0x04, 0x00, 0x00, 0xA8, 0x01, 0xA8,
+	 0x47, 0x03, 0x46, 0x03, 0x3C, 0x46, 0x2A, 0xF0, 0x40, 0x67, 0xB0, 0x84, 0xA2, 0xDA, 0x60, 0x45,
+	 0x22, 0xF2, 0xFF, 0xFF, 0x60, 0x43, 0x60, 0x40, 0x01, 0x26, 0x03, 0x00, 0x04, 0x26, 0x0A, 0x00,
+	 0x02, 0x00, 0x04, 0x27, 0x07, 0x00, 0x65, 0x44, 0x2A, 0x65, 0x60, 0x40, 0x03, 0x2B, 0x24, 0x65,
+	 0x45, 0x4C, 0x2E, 0x00, 0x65, 0x44, 0x2E, 0x65, 0x60, 0x40, 0x03, 0x2B, 0x28, 0x65, 0x45, 0x4C,
+	 0x07, 0xF0, 0x88, 0xF3, 0xFF, 0xFF, 0xD0, 0x80, 0x00, 0x7C, 0x03, 0x03, 0x63, 0x40, 0x01, 0x2A,
+	 0x01, 0x00, 0x3D, 0xF1, 0x2A, 0xF2, 0xFF, 0xFF, 0x08, 0xB0, 0x3E, 0xF2, 0x19, 0x03, 0x60, 0x47,
+	 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0x03, 0xB4, 0xD0, 0x80, 0xFF, 0xFF, 0x11, 0x03, 0x1B, 0x60,
+	 0xD4, 0x62, 0x1B, 0x60, 0xAC, 0x64, 0xA2, 0xDB, 0x3C, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB,
+	 0xFF, 0xFF, 0x2B, 0xFF, 0x5C, 0x5C, 0xFC, 0xFC, 0xCE, 0xFE, 0xB5, 0x60, 0xEC, 0x78, 0xFF, 0xFF,
+	 0xBB, 0xF1, 0x2C, 0x45, 0x64, 0x43, 0x17, 0xF2, 0x4B, 0xF1, 0xC4, 0x84, 0xE0, 0x84, 0xE0, 0x84,
+	 0xE0, 0x81, 0x63, 0x40, 0x37, 0x37, 0xE1, 0x81, 0x64, 0x45, 0xB5, 0x60, 0x58, 0x4D, 0xC1, 0x78,
+	 0xFF, 0xFF, 0xAE, 0x82, 0xFC, 0xA2, 0x0A, 0x03, 0x63, 0x40, 0x6E, 0x3B, 0x06, 0x00, 0x60, 0x41,
+	 0x04, 0x0D, 0x63, 0x44, 0x80, 0x7E, 0xBB, 0xFB, 0x61, 0x44, 0xDC, 0x84, 0x2B, 0xF0, 0x1B, 0xFA,
+	 0x64, 0x44, 0x80, 0x27, 0x34, 0x00, 0x16, 0xF2, 0x0F, 0xF0, 0xAC, 0x84, 0x2C, 0x45, 0x29, 0x03,
+	 0x4B, 0xF1, 0xC4, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x81, 0x63, 0x40, 0x37, 0x37, 0xE1, 0x81,
+	 0x64, 0x45, 0x0F, 0xF0, 0xB5, 0x60, 0x58, 0x4D, 0xC1, 0x78, 0xFF, 0xFF, 0xAE, 0x82, 0xFC, 0xA2,
+	 0x0A, 0x03, 0x63, 0x40, 0x6E, 0x3B, 0x06, 0x00, 0x60, 0x41, 0x04, 0x0D, 0x80, 0x67, 0xB0, 0x84,
+	 0x0F, 0xFA, 0x61, 0x44, 0xDC, 0x84, 0x1D, 0xFA, 0xDE, 0x65, 0xC4, 0x85, 0x26, 0x41, 0xE1, 0x81,
+	 0xC5, 0x84, 0x2B, 0xFA, 0x1B, 0xF0, 0xDE, 0x64, 0xC0, 0x85, 0x26, 0x44, 0xE0, 0x84, 0xC4, 0x84,
+	 0x10, 0xFA, 0x26, 0x44, 0x2C, 0xF0, 0x0A, 0xA4, 0x64, 0x40, 0x01, 0x26, 0x00, 0x64, 0x11, 0xFA,
+	 0xBB, 0xF3, 0x13, 0xFA, 0xFF, 0xFF, 0x0D, 0xF2, 0x3E, 0xF0, 0x60, 0x47, 0xFF, 0xB4, 0x64, 0x41,
+	 0x01, 0xB1, 0x01, 0x63, 0x1D, 0x02, 0x60, 0x41, 0xFF, 0x22, 0x04, 0x00, 0xB5, 0x60, 0x58, 0x4F,
+	 0xB2, 0x78, 0xFF, 0xFF, 0x0F, 0x60, 0x92, 0x64, 0xA0, 0xDD, 0x21, 0x60, 0x98, 0x62, 0xA2, 0xD3,
+	 0xB5, 0x60, 0x58, 0x4D, 0xE3, 0x78, 0xFF, 0xFF, 0x60, 0x41, 0x01, 0x63, 0x61, 0x40, 0xFF, 0x22,
+	 0x04, 0x00, 0xB5, 0x60, 0x58, 0x4F, 0xB2, 0x78, 0xFF, 0xFF, 0x0F, 0x60, 0x94, 0x64, 0xA0, 0xDD,
+	 0x2A, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x40, 0x27, 0x03, 0x00, 0xBA, 0x60, 0x4A, 0x78, 0xFF, 0xFF,
+	 0x22, 0xF2, 0x46, 0x43, 0x60, 0x40, 0x22, 0x26, 0x8B, 0x00, 0x01, 0x26, 0x05, 0x00, 0x04, 0x26,
+	 0x0C, 0x00, 0xBA, 0x60, 0x4A, 0x78, 0xFF, 0xFF, 0x04, 0x27, 0x03, 0x00, 0xBA, 0x60, 0x4A, 0x78,
+	 0xFF, 0xFF, 0x88, 0xF3, 0xFF, 0xFF, 0x60, 0x46, 0x02, 0x00, 0x07, 0xF4, 0xFF, 0xFF, 0xA3, 0x46,
+	 0x2A, 0xF2, 0xA3, 0x46, 0x60, 0x40, 0x08, 0x27, 0x3B, 0x00, 0x88, 0xF3, 0x66, 0x5C, 0xD0, 0x80,
+	 0x37, 0xF0, 0x08, 0x03, 0x64, 0x40, 0x10, 0x2A, 0x12, 0x00, 0xFF, 0x60, 0xEF, 0x64, 0xA0, 0x84,
+	 0x37, 0xFA, 0x24, 0x00, 0x3D, 0xF3, 0x01, 0x61, 0x60, 0x43, 0xCF, 0x83, 0xE1, 0x81, 0xFD, 0x0D,
+	 0xE9, 0x81, 0xA1, 0x80, 0xFF, 0xFF, 0x03, 0x03, 0x91, 0x84, 0x37, 0xFA, 0x17, 0x00, 0x47, 0xF2,
+	 0xFF, 0xFF, 0x10, 0xA0, 0xFF, 0xFF, 0x02, 0x04, 0xFF, 0x60, 0xFF, 0x64, 0xDC, 0x84, 0x47, 0xFA,
+	 0x46, 0xF2, 0x16, 0x04, 0xDC, 0x84, 0x46, 0xFA, 0x45, 0xF2, 0x08, 0x04, 0xDC, 0x84, 0x45, 0xFA,
+	 0x05, 0x04, 0x37, 0xF2, 0xFF, 0xFF, 0xE0, 0x84, 0xE8, 0x84, 0x37, 0xFA, 0x0D, 0x60, 0x3E, 0x62,
+	 0x80, 0xFF, 0x78, 0x44, 0x03, 0xA4, 0xA2, 0xDB, 0xC4, 0x60, 0x05, 0x78, 0xFF, 0xFF, 0x84, 0xFF,
+	 0x0D, 0x60, 0x3E, 0x62, 0x80, 0xFF, 0x78, 0x44, 0x03, 0xA4, 0xA2, 0xDB, 0xC4, 0x60, 0x7D, 0x78,
+	 0xFF, 0xFF, 0x84, 0xFF, 0x88, 0xF3, 0x66, 0x5C, 0xD0, 0x80, 0x00, 0x7C, 0x07, 0x03, 0x66, 0x43,
+	 0x3C, 0x46, 0x22, 0xF2, 0x63, 0x46, 0x60, 0x40, 0x01, 0x2A, 0x01, 0x00, 0x3C, 0xF1, 0x47, 0xF0,
+	 0x64, 0x41, 0x64, 0x47, 0xFF, 0xB4, 0x60, 0x5F, 0x20, 0xBC, 0x80, 0x26, 0x80, 0xAC, 0x60, 0x47,
+	 0xA3, 0x46, 0x3A, 0xFA, 0x64, 0x44, 0x20, 0x7F, 0x34, 0x94, 0x3B, 0xFA, 0xA3, 0x46, 0x46, 0xF2,
+	 0x45, 0xF0, 0xA3, 0x46, 0x3C, 0xFA, 0x3D, 0xF8, 0x08, 0x60, 0x00, 0xEA, 0x0F, 0x64, 0x60, 0x7F,
+	 0xA0, 0x5A, 0x80, 0x60, 0x00, 0xEA, 0xA0, 0x60, 0x00, 0xEA, 0xD1, 0x60, 0x00, 0xEA, 0x8A, 0x00,
+	 0x2A, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x08, 0x27, 0x35, 0x00, 0x2A, 0xF2, 0x00, 0x60, 0x7C, 0x62,
+	 0x60, 0x40, 0x40, 0x2B, 0x27, 0x00, 0xA2, 0xD3, 0x00, 0x61, 0x60, 0xFE, 0xA0, 0xD3, 0xDE, 0x82,
+	 0xA2, 0xD1, 0xFF, 0xFF, 0x20, 0xFE, 0x64, 0x5F, 0xDC, 0x84, 0xF1, 0x81, 0xC0, 0x2B, 0x04, 0x00,
+	 0x80, 0x2A, 0x02, 0x00, 0x7F, 0xA4, 0xDC, 0x84, 0xFF, 0x3B, 0x03, 0x00, 0x60, 0x47, 0xDC, 0x87,
+	 0x01, 0x61, 0xC0, 0x80, 0x00, 0x36, 0xDC, 0x84, 0x4E, 0xDB, 0x60, 0xFE, 0xDA, 0x82, 0xA2, 0xD1,
+	 0xFF, 0xFF, 0xC1, 0x84, 0xF0, 0x22, 0x10, 0xA4, 0xF0, 0x2A, 0x01, 0x00, 0x00, 0x64, 0xA2, 0xDB,
+	 0xFF, 0xFF, 0x20, 0xFE, 0x00, 0x60, 0x7C, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0xA0, 0xD3, 0x5A, 0xD1,
+	 0x3A, 0xFA, 0x3B, 0xF8, 0x74, 0x62, 0xA2, 0xD0, 0xFF, 0xFF, 0x64, 0x44, 0xE0, 0x7F, 0xA0, 0x5A,
+	 0x64, 0x47, 0xE1, 0x7F, 0x5A, 0xD0, 0xA0, 0x5A, 0x64, 0x44, 0xE2, 0x7F, 0xA0, 0x5A, 0x00, 0x60,
+	 0x80, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0xA0, 0xD1, 0x5A, 0xD1, 0x64, 0x45, 0x64, 0x44, 0xE3, 0x7F,
+	 0xA0, 0x5A, 0x64, 0x47, 0xE4, 0x7F, 0x5A, 0xD1, 0xA0, 0x5A, 0x64, 0x44, 0xE5, 0x7F, 0xA0, 0x5A,
+	 0x64, 0x47, 0xE6, 0x7F, 0x5A, 0xD1, 0xA0, 0x5A, 0x64, 0x44, 0xE7, 0x7F, 0xA0, 0x5A, 0x65, 0x40,
+	 0x0D, 0x3A, 0x1C, 0x00, 0x64, 0x47, 0xE8, 0x7F, 0x5A, 0xD1, 0xA0, 0x5A, 0x64, 0x44, 0xE9, 0x7F,
+	 0xA0, 0x5A, 0x64, 0x47, 0xEA, 0x7F, 0x5A, 0xD1, 0xA0, 0x5A, 0x64, 0x44, 0xEB, 0x7F, 0xA0, 0x5A,
+	 0x64, 0x47, 0xEC, 0x7F, 0x5A, 0xD1, 0xA0, 0x5A, 0x64, 0x44, 0xED, 0x7F, 0xA0, 0x5A, 0x64, 0x47,
+	 0xEE, 0x7F, 0x5A, 0xD1, 0xA0, 0x5A, 0x64, 0x44, 0xEF, 0x7F, 0xA0, 0x5A, 0x08, 0x60, 0x00, 0xEA,
+	 0x65, 0x44, 0x02, 0xA4, 0x60, 0x7F, 0xA0, 0x5A, 0x80, 0x60, 0x00, 0xEA, 0xA0, 0x60, 0x00, 0xEA,
+	 0xD1, 0x60, 0x00, 0xEA, 0x02, 0x64, 0x3B, 0xDB, 0xBD, 0x60, 0xEB, 0x78, 0xFF, 0xFF, 0x66, 0x44,
+	 0xFC, 0xFB, 0x07, 0xF0, 0x00, 0x64, 0xD0, 0x80, 0x88, 0xF3, 0x17, 0x03, 0xD0, 0x80, 0x66, 0x41,
+	 0x64, 0x46, 0x6F, 0xF2, 0x61, 0x46, 0x6D, 0x03, 0x60, 0x40, 0x00, 0x36, 0x6A, 0x00, 0x47, 0xF1,
+	 0x07, 0xF0, 0x64, 0x40, 0x02, 0x26, 0x01, 0x00, 0x0B, 0x00, 0x03, 0x12, 0xBB, 0x60, 0x4E, 0x78,
+	 0xFF, 0xFF, 0xFC, 0x0A, 0xBC, 0x60, 0x48, 0x78, 0xFF, 0xFF, 0xBC, 0x60, 0x48, 0x78, 0xFF, 0xFF,
+	 0x3E, 0xF2, 0x60, 0x45, 0x60, 0x47, 0x07, 0xB0, 0x00, 0x3A, 0x01, 0x00, 0xA6, 0x00, 0x65, 0x44,
+	 0x60, 0x40, 0x01, 0x36, 0x4E, 0x00, 0x02, 0x36, 0x4F, 0x00, 0x03, 0x36, 0x2D, 0x00, 0x04, 0x36,
+	 0x3E, 0x00, 0x52, 0x00, 0x00, 0x64, 0x4C, 0xFB, 0x66, 0x41, 0x64, 0x46, 0x6F, 0xF2, 0xFF, 0xFF,
+	 0x05, 0x7E, 0x6F, 0xFA, 0x61, 0x46, 0x00, 0x65, 0x65, 0x43, 0x66, 0x41, 0x64, 0x46, 0x70, 0xF2,
+	 0x8C, 0xFA, 0x00, 0xA8, 0x6F, 0xF2, 0x15, 0x03, 0x60, 0x47, 0xFF, 0xB5, 0x70, 0xF2, 0x00, 0xBB,
+	 0xFF, 0xA0, 0x07, 0x03, 0x0E, 0x06, 0xE8, 0x84, 0xA4, 0x80, 0xFF, 0xFF, 0x02, 0x02, 0xFB, 0x04,
+	 0x08, 0x00, 0xB9, 0x81, 0xE8, 0x84, 0xD9, 0x81, 0xFD, 0x04, 0x0F, 0x60, 0xA2, 0x65, 0x45, 0xD3,
+	 0x0E, 0xFA, 0x0C, 0xF4, 0xFF, 0xFF, 0x1D, 0x00, 0x4C, 0xF3, 0xFF, 0xFF, 0xDC, 0x84, 0x4C, 0xFB,
+	 0xAB, 0xF3, 0x60, 0x45, 0xD4, 0x80, 0xFF, 0xFF, 0x14, 0x02, 0x1C, 0x60, 0x0C, 0x62, 0x0F, 0x60,
+	 0x96, 0x64, 0xA2, 0xDB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0xC3, 0x01, 0x4C, 0xF3,
+	 0x66, 0x41, 0xDC, 0x84, 0x4C, 0xFB, 0x64, 0x46, 0x6F, 0xF2, 0xFF, 0xFF, 0x03, 0x7E, 0x6F, 0xFA,
+	 0x61, 0x46, 0xBC, 0x60, 0x48, 0x78, 0xFF, 0xFF, 0x66, 0x41, 0x64, 0x46, 0x6F, 0xF2, 0xFF, 0xFF,
+	 0x01, 0x7E, 0x6F, 0xFA, 0x61, 0x46, 0xF5, 0x01, 0x66, 0x41, 0x64, 0x46, 0x6F, 0xF2, 0x8C, 0xFA,
+	 0x60, 0x47, 0x70, 0xF2, 0xFF, 0xB5, 0x08, 0x18, 0xE4, 0x84, 0xA4, 0x80, 0xFF, 0xFF, 0x03, 0x02,
+	 0xFB, 0x04, 0x01, 0x64, 0x01, 0x00, 0x00, 0x64, 0x0C, 0xF4, 0x00, 0xA8, 0xFF, 0xFF, 0xE4, 0x02,
+	 0x66, 0x41, 0x64, 0x46, 0x6F, 0xF2, 0xFF, 0xFF, 0x60, 0x47, 0x70, 0xF2, 0xFF, 0xB5, 0x61, 0x46,
+	 0x00, 0xA8, 0xFF, 0xFF, 0x29, 0x03, 0xE0, 0x84, 0xA4, 0x80, 0xFF, 0xFF, 0xFC, 0x03, 0x66, 0x41,
+	 0x64, 0x46, 0x70, 0xFA, 0x61, 0x46, 0x01, 0x65, 0x65, 0x43, 0x66, 0x41, 0x64, 0x46, 0x70, 0xF2,
+	 0x8C, 0xFA, 0x00, 0xA8, 0x6F, 0xF2, 0x15, 0x03, 0x60, 0x47, 0xFF, 0xB5, 0x70, 0xF2, 0x00, 0xBB,
+	 0xFF, 0xA0, 0x07, 0x03, 0x0E, 0x06, 0xE8, 0x84, 0xA4, 0x80, 0xFF, 0xFF, 0x02, 0x02, 0xFB, 0x04,
+	 0x08, 0x00, 0xB9, 0x81, 0xE8, 0x84, 0xD9, 0x81, 0xFD, 0x04, 0x0F, 0x60, 0xA2, 0x65, 0x45, 0xD3,
+	 0x0E, 0xFA, 0x0C, 0xF4, 0xFF, 0xFF, 0xA3, 0x01, 0xA2, 0x01, 0x65, 0x44, 0x60, 0x40, 0x01, 0x36,
+	 0xA8, 0x01, 0x02, 0x36, 0x01, 0x00, 0xA5, 0x01, 0x66, 0x41, 0x64, 0x46, 0x6F, 0xF2, 0xFF, 0xFF,
+	 0x01, 0x7E, 0x6F, 0xFA, 0x61, 0x46, 0x00, 0x65, 0x65, 0x43, 0x66, 0x41, 0x64, 0x46, 0x70, 0xF2,
+	 0x8C, 0xFA, 0x00, 0xA8, 0x6F, 0xF2, 0x15, 0x03, 0x60, 0x47, 0xFF, 0xB5, 0x70, 0xF2, 0x00, 0xBB,
+	 0xFF, 0xA0, 0x07, 0x03, 0x0E, 0x06, 0xE8, 0x84, 0xA4, 0x80, 0xFF, 0xFF, 0x02, 0x02, 0xFB, 0x04,
+	 0x08, 0x00, 0xB9, 0x81, 0xE8, 0x84, 0xD9, 0x81, 0xFD, 0x04, 0x0F, 0x60, 0xA2, 0x65, 0x45, 0xD3,
+	 0x0E, 0xFA, 0x0C, 0xF4, 0xFF, 0xFF, 0xBC, 0x60, 0x48, 0x78, 0xFF, 0xFF, 0x3E, 0xF2, 0x60, 0x45,
+	 0x60, 0x47, 0x07, 0xB0, 0x00, 0x3A, 0x01, 0x00, 0xA3, 0x00, 0x65, 0x44, 0x60, 0x40, 0x01, 0x36,
+	 0x0B, 0x00, 0x02, 0x36, 0x14, 0x00, 0x03, 0x36, 0x47, 0x00, 0x04, 0x36, 0x5E, 0x00, 0x05, 0x36,
+	 0x0E, 0x00, 0xBC, 0x60, 0x48, 0x78, 0xFF, 0xFF, 0x07, 0xF0, 0x66, 0x41, 0x64, 0x46, 0x6F, 0xF2,
+	 0xFF, 0xFF, 0x02, 0x7E, 0x6F, 0xFA, 0x61, 0x46, 0xBC, 0x60, 0x48, 0x78, 0xFF, 0xFF, 0x07, 0xF0,
+	 0x01, 0x65, 0x65, 0x43, 0x66, 0x41, 0x64, 0x46, 0x70, 0xF2, 0x8C, 0xFA, 0x00, 0xA8, 0x6F, 0xF2,
+	 0x15, 0x03, 0x60, 0x47, 0xFF, 0xB5, 0x70, 0xF2, 0x00, 0xBB, 0xFF, 0xA0, 0x07, 0x03, 0x0E, 0x06,
+	 0xE8, 0x84, 0xA4, 0x80, 0xFF, 0xFF, 0x02, 0x02, 0xFB, 0x04, 0x08, 0x00, 0xB9, 0x81, 0xE8, 0x84,
+	 0xD9, 0x81, 0xFD, 0x04, 0x0F, 0x60, 0xA2, 0x65, 0x45, 0xD3, 0x0E, 0xFA, 0x0C, 0xF4, 0xFF, 0xFF,
+	 0x66, 0x41, 0x64, 0x46, 0x6F, 0xF2, 0x00, 0x63, 0x03, 0x7E, 0x6F, 0xFA, 0x61, 0x46, 0x4C, 0xFD,
+	 0x1C, 0x60, 0x0C, 0x62, 0x0F, 0x60, 0x96, 0x64, 0xA2, 0xDB, 0x02, 0x64, 0x4A, 0xDB, 0xFF, 0xFF,
+	 0x04, 0xFF, 0xBC, 0x60, 0x48, 0x78, 0xFF, 0xFF, 0x66, 0x41, 0x64, 0x46, 0x70, 0xF2, 0x4C, 0xF3,
+	 0x02, 0xB0, 0x61, 0x46, 0xCC, 0x84, 0x05, 0x03, 0x04, 0x28, 0x4C, 0xFB, 0xBC, 0x60, 0x48, 0x78,
+	 0xFF, 0xFF, 0x04, 0x28, 0x4C, 0xFB, 0x66, 0x41, 0x64, 0x46, 0x6F, 0xF2, 0xFF, 0xFF, 0x04, 0x7E,
+	 0x6F, 0xFA, 0x61, 0x46, 0xBC, 0x60, 0x48, 0x78, 0xFF, 0xFF, 0x66, 0x41, 0x64, 0x46, 0x6F, 0xF2,
+	 0xFF, 0xFF, 0x60, 0x47, 0xFF, 0xB5, 0x70, 0xF2, 0x61, 0x46, 0xFF, 0xA0, 0xFF, 0xFF, 0x2F, 0x06,
+	 0xE8, 0x84, 0xA4, 0x80, 0xFF, 0xFF, 0x02, 0x02, 0xFB, 0x04, 0x29, 0x00, 0x64, 0x46, 0x70, 0xFA,
+	 0x01, 0x65, 0x65, 0x43, 0x66, 0x41, 0x64, 0x46, 0x70, 0xF2, 0x8C, 0xFA, 0x00, 0xA8, 0x6F, 0xF2,
+	 0x15, 0x03, 0x60, 0x47, 0xFF, 0xB5, 0x70, 0xF2, 0x00, 0xBB, 0xFF, 0xA0, 0x07, 0x03, 0x0E, 0x06,
+	 0xE8, 0x84, 0xA4, 0x80, 0xFF, 0xFF, 0x02, 0x02, 0xFB, 0x04, 0x08, 0x00, 0xB9, 0x81, 0xE8, 0x84,
+	 0xD9, 0x81, 0xFD, 0x04, 0x0F, 0x60, 0xA2, 0x65, 0x45, 0xD3, 0x0E, 0xFA, 0x0C, 0xF4, 0xFF, 0xFF,
+	 0x6F, 0xF2, 0x00, 0x63, 0x03, 0x7E, 0x6F, 0xFA, 0x3C, 0x46, 0x4C, 0xFD, 0x51, 0x00, 0x50, 0x00,
+	 0x65, 0x44, 0x60, 0x40, 0x01, 0x36, 0x03, 0x00, 0x02, 0x36, 0x12, 0x00, 0x49, 0x00, 0x66, 0x41,
+	 0x64, 0x46, 0x70, 0xF2, 0x61, 0x46, 0x01, 0xB0, 0xFF, 0xFF, 0x42, 0x02, 0x07, 0xF0, 0x66, 0x41,
+	 0x64, 0x46, 0x6F, 0xF2, 0xFF, 0xFF, 0x02, 0x7E, 0x6F, 0xFA, 0x61, 0x46, 0x39, 0x00, 0x38, 0x00,
+	 0x07, 0xF0, 0x66, 0x41, 0x64, 0x46, 0x6F, 0xF2, 0xFF, 0xFF, 0x01, 0x7E, 0x6F, 0xFA, 0x60, 0x47,
+	 0xFF, 0xB5, 0x70, 0xF2, 0x61, 0x46, 0xFF, 0xA0, 0xFF, 0xFF, 0xF1, 0x06, 0xE8, 0x84, 0xA4, 0x80,
+	 0xFF, 0xFF, 0x02, 0x02, 0xFB, 0x04, 0xEB, 0x01, 0x66, 0x41, 0x64, 0x46, 0x70, 0xFA, 0x61, 0x46,
+	 0x00, 0x65, 0x65, 0x43, 0x66, 0x41, 0x64, 0x46, 0x70, 0xF2, 0x8C, 0xFA, 0x00, 0xA8, 0x6F, 0xF2,
+	 0x15, 0x03, 0x60, 0x47, 0xFF, 0xB5, 0x70, 0xF2, 0x00, 0xBB, 0xFF, 0xA0, 0x07, 0x03, 0x0E, 0x06,
+	 0xE8, 0x84, 0xA4, 0x80, 0xFF, 0xFF, 0x02, 0x02, 0xFB, 0x04, 0x08, 0x00, 0xB9, 0x81, 0xE8, 0x84,
+	 0xD9, 0x81, 0xFD, 0x04, 0x0F, 0x60, 0xA2, 0x65, 0x45, 0xD3, 0x0E, 0xFA, 0x0C, 0xF4, 0xFF, 0xFF,
+	 0x03, 0x64, 0x3B, 0xDB, 0xCA, 0xFE, 0x47, 0xF1, 0x01, 0x65, 0x32, 0x40, 0x04, 0x27, 0x08, 0x00,
+	 0x2C, 0xF2, 0x64, 0x45, 0x02, 0x22, 0x04, 0x00, 0x60, 0x40, 0x01, 0x26, 0x01, 0x00, 0xEC, 0x00,
+	 0x14, 0xF2, 0x65, 0x40, 0x01, 0x26, 0x1D, 0x00, 0x60, 0x45, 0x05, 0x64, 0x3B, 0xDB, 0x65, 0x44,
+	 0xCC, 0x85, 0x98, 0xF1, 0x1E, 0x60, 0xDE, 0x64, 0xA0, 0xD3, 0xFF, 0xFF, 0xD8, 0x80, 0xC4, 0x84,
+	 0x0B, 0x03, 0x07, 0x05, 0xDC, 0x80, 0xD0, 0x80, 0x04, 0x03, 0xA2, 0xDB, 0x09, 0x04, 0xC6, 0xFE,
+	 0x07, 0x00, 0x00, 0x64, 0xB8, 0x84, 0xA2, 0xDB, 0x8A, 0xFF, 0x20, 0x60, 0x00, 0x75, 0x88, 0xFF,
+	 0xAF, 0x00, 0x60, 0x41, 0x2A, 0xF0, 0x00, 0x60, 0x0C, 0x64, 0xA0, 0x84, 0x04, 0x36, 0x02, 0x00,
+	 0x0C, 0x3A, 0x01, 0x00, 0xA5, 0x00, 0x61, 0x45, 0x60, 0x41, 0x98, 0xF1, 0x1E, 0x60, 0xDE, 0x64,
+	 0xA0, 0xD3, 0xFF, 0xFF, 0xD8, 0x80, 0xC4, 0x84, 0x0B, 0x03, 0x07, 0x05, 0xDC, 0x80, 0xD0, 0x80,
+	 0x04, 0x03, 0xA2, 0xDB, 0x09, 0x04, 0xC6, 0xFE, 0x07, 0x00, 0x00, 0x64, 0xB8, 0x84, 0xA2, 0xDB,
+	 0x8A, 0xFF, 0x20, 0x60, 0x00, 0x75, 0x88, 0xFF, 0x61, 0x40, 0x08, 0x36, 0x01, 0x00, 0x88, 0x00,
+	 0x14, 0xF2, 0x1C, 0x65, 0x60, 0x41, 0x00, 0x63, 0xCD, 0x81, 0xC7, 0x83, 0xFD, 0x02, 0x3F, 0xF0,
+	 0x2C, 0xF2, 0xC3, 0x83, 0x60, 0x40, 0x01, 0x2A, 0x29, 0x00, 0x98, 0xF1, 0x1E, 0x60, 0xDC, 0x64,
+	 0xA0, 0xD3, 0xFF, 0xFF, 0xDC, 0x84, 0xDC, 0x80, 0xD0, 0x80, 0x04, 0x03, 0xA2, 0xDB, 0x08, 0x24,
+	 0xC6, 0xFE, 0x04, 0x00, 0x8A, 0xFF, 0x20, 0x60, 0x00, 0x75, 0x88, 0xFF, 0x98, 0xF1, 0x1E, 0x60,
+	 0xE2, 0x64, 0xA0, 0xD3, 0x63, 0x45, 0xD8, 0x80, 0xC4, 0x84, 0x0B, 0x03, 0x07, 0x05, 0xDC, 0x80,
+	 0xD0, 0x80, 0x04, 0x03, 0xA2, 0xDB, 0x09, 0x04, 0xC6, 0xFE, 0x07, 0x00, 0x00, 0x64, 0xB8, 0x84,
+	 0xA2, 0xDB, 0x8A, 0xFF, 0x20, 0x60, 0x00, 0x75, 0x88, 0xFF, 0x52, 0x00, 0x98, 0xF1, 0x1E, 0x60,
+	 0xDA, 0x64, 0xA0, 0xD3, 0xFF, 0xFF, 0xDC, 0x84, 0xDC, 0x80, 0xD0, 0x80, 0x04, 0x03, 0xA2, 0xDB,
+	 0x08, 0x24, 0xC6, 0xFE, 0x04, 0x00, 0x8A, 0xFF, 0x20, 0x60, 0x00, 0x75, 0x88, 0xFF, 0x98, 0xF1,
+	 0x1E, 0x60, 0xE0, 0x64, 0xA0, 0xD3, 0x63, 0x45, 0xD8, 0x80, 0xC4, 0x84, 0x0B, 0x03, 0x07, 0x05,
+	 0xDC, 0x80, 0xD0, 0x80, 0x04, 0x03, 0xA2, 0xDB, 0x09, 0x04, 0xC6, 0xFE, 0x07, 0x00, 0x00, 0x64,
+	 0xB8, 0x84, 0xA2, 0xDB, 0x8A, 0xFF, 0x20, 0x60, 0x00, 0x75, 0x88, 0xFF, 0x15, 0xF2, 0xFF, 0xFF,
+	 0x0F, 0xB4, 0x00, 0xA8, 0x01, 0xA8, 0x24, 0x03, 0x12, 0x03, 0x98, 0xF1, 0x1E, 0x60, 0xE8, 0x64,
+	 0xA0, 0xD3, 0xFF, 0xFF, 0xDC, 0x84, 0xDC, 0x80, 0xD0, 0x80, 0x04, 0x03, 0xA2, 0xDB, 0x08, 0x24,
+	 0xC6, 0xFE, 0x04, 0x00, 0x8A, 0xFF, 0x20, 0x60, 0x00, 0x75, 0x88, 0xFF, 0x11, 0x00, 0x98, 0xF1,
+	 0x1E, 0x60, 0xE6, 0x64, 0xA0, 0xD3, 0xFF, 0xFF, 0xDC, 0x84, 0xDC, 0x80, 0xD0, 0x80, 0x04, 0x03,
+	 0xA2, 0xDB, 0x08, 0x24, 0xC6, 0xFE, 0x04, 0x00, 0x8A, 0xFF, 0x20, 0x60, 0x00, 0x75, 0x88, 0xFF,
+	 0x04, 0x64, 0x3B, 0xDB, 0x07, 0xF0, 0x66, 0x41, 0x64, 0x46, 0x06, 0xF0, 0xFF, 0x60, 0x5F, 0x64,
+	 0xA0, 0x84, 0x06, 0xFA, 0x61, 0x46, 0x1B, 0x60, 0xD4, 0x62, 0x1B, 0x60, 0xAC, 0x64, 0xA2, 0xDB,
+	 0x3C, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0x5C, 0x5C, 0xFC, 0xFC,
+	 0xCE, 0xFE, 0xB5, 0x60, 0xEC, 0x78, 0xFF, 0xFF, 0x1F, 0x60, 0x64, 0x62, 0xA2, 0xD3, 0x07, 0xF4,
+	 0x06, 0xF2, 0x02, 0xA8, 0x3C, 0x46, 0x10, 0x03, 0x10, 0xB0, 0x2A, 0xF2, 0x0D, 0x03, 0x0E, 0xF2,
+	 0x0C, 0xB0, 0x60, 0x40, 0xF0, 0x37, 0x20, 0xBC, 0x02, 0x03, 0xFE, 0x7F, 0x0E, 0xFA, 0x23, 0xF0,
+	 0x10, 0x64, 0xB0, 0x84, 0xA2, 0xDA, 0xCC, 0x01, 0x0F, 0xF0, 0x15, 0xF2, 0x64, 0x41, 0x01, 0x2A,
+	 0x02, 0x00, 0xB1, 0xF1, 0x09, 0x00, 0x03, 0x65, 0x07, 0xF0, 0x66, 0x43, 0x64, 0x46, 0x06, 0xF0,
+	 0x63, 0x46, 0xB0, 0xF1, 0x64, 0x40, 0x10, 0x2A, 0x64, 0x45, 0xDC, 0x84, 0xD4, 0x80, 0x15, 0xFA,
+	 0x3B, 0x07, 0x61, 0x40, 0x01, 0x2A, 0x09, 0x00, 0x1F, 0x60, 0x0E, 0x64, 0xA0, 0xD3, 0xFF, 0xFF,
+	 0xDC, 0x84, 0xFF, 0xFF, 0x08, 0x28, 0xA2, 0xDB, 0x08, 0x00, 0x1F, 0x60, 0x10, 0x64, 0xA0, 0xD3,
+	 0xFF, 0xFF, 0xDC, 0x84, 0xFF, 0xFF, 0x08, 0x28, 0xA2, 0xDB, 0x2A, 0xF0, 0x08, 0x67, 0xB0, 0x84,
+	 0xA2, 0xDA, 0x08, 0xF0, 0x1B, 0x60, 0x8E, 0x64, 0xD0, 0x80, 0x07, 0xF2, 0x46, 0x43, 0x88, 0xF1,
+	 0x06, 0x03, 0x60, 0x46, 0x86, 0xF4, 0xD0, 0x80, 0x80, 0xBB, 0x01, 0x03, 0x06, 0xFC, 0x23, 0x46,
+	 0x3E, 0xF2, 0x00, 0x63, 0x01, 0xB0, 0x43, 0x5C, 0xFC, 0xFC, 0x0B, 0x03, 0x1B, 0x60, 0xDA, 0x62,
+	 0x1B, 0x60, 0xA6, 0x64, 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF,
+	 0x2B, 0xFF, 0xB5, 0x60, 0xEC, 0x78, 0xFF, 0xFF, 0x00, 0x64, 0x49, 0xFB, 0x98, 0xF1, 0x1E, 0x60,
+	 0xE8, 0x64, 0xA0, 0xD3, 0xFF, 0xFF, 0xDC, 0x84, 0xDC, 0x80, 0xD0, 0x80, 0x04, 0x03, 0xA2, 0xDB,
+	 0x08, 0x24, 0xC6, 0xFE, 0x04, 0x00, 0x8A, 0xFF, 0x20, 0x60, 0x00, 0x75, 0x88, 0xFF, 0x98, 0xF1,
+	 0x1E, 0x60, 0xEA, 0x64, 0xA0, 0xD3, 0xFF, 0xFF, 0xDC, 0x84, 0xDC, 0x80, 0xD0, 0x80, 0x04, 0x03,
+	 0xA2, 0xDB, 0x08, 0x24, 0xC6, 0xFE, 0x04, 0x00, 0x8A, 0xFF, 0x20, 0x60, 0x00, 0x75, 0x88, 0xFF,
+	 0x21, 0x60, 0x98, 0x63, 0xA3, 0xD3, 0xB5, 0x60, 0x58, 0x4D, 0xE3, 0x78, 0xFF, 0xFF, 0x0D, 0xF2,
+	 0x60, 0x5C, 0x64, 0x5F, 0x0D, 0xFA, 0x23, 0xF0, 0x01, 0x64, 0xB0, 0x84, 0xA2, 0xDA, 0x07, 0xF0,
+	 0x66, 0x41, 0x64, 0x46, 0x06, 0xF2, 0x7F, 0x65, 0xA4, 0x9E, 0x06, 0xFA, 0x61, 0x46, 0x40, 0x01,
+	 0xBE, 0x60, 0x70, 0x78, 0xFF, 0xFF, 0x21, 0x64, 0x3B, 0xDB, 0x31, 0xF3, 0x01, 0x63, 0xC4, 0xB4,
+	 0x31, 0xFB, 0x32, 0xFD, 0xBE, 0x60, 0x1C, 0x62, 0x42, 0x40, 0xA0, 0x4C, 0x40, 0xBC, 0x7D, 0xB4,
+	 0xA0, 0x51, 0xA0, 0xFE, 0x1A, 0xFF, 0x1B, 0x60, 0xA0, 0x64, 0x08, 0xF0, 0x07, 0xF0, 0xD0, 0x80,
+	 0x1B, 0x60, 0xA6, 0x62, 0x14, 0x02, 0xA2, 0xD3, 0x01, 0x63, 0xAC, 0x86, 0x07, 0xF2, 0x0F, 0x03,
+	 0xD0, 0x80, 0x09, 0xF2, 0xFA, 0x02, 0x23, 0xFC, 0x1B, 0x60, 0xD4, 0x62, 0x1B, 0x60, 0xAC, 0x64,
+	 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0x3C, 0x46,
+	 0x06, 0x64, 0xA1, 0xFF, 0x49, 0xFB, 0x83, 0x3E, 0x31, 0xF3, 0x87, 0x60, 0x80, 0x61, 0x1D, 0xF0,
+	 0x60, 0x40, 0x01, 0x2A, 0x15, 0x00, 0xFE, 0xB4, 0x31, 0xFB, 0x00, 0x64, 0x49, 0xFB, 0x01, 0x64,
+	 0x47, 0xFB, 0x21, 0x60, 0x98, 0x63, 0xA3, 0xD3, 0xB5, 0x60, 0x58, 0x4D, 0xE3, 0x78, 0xFF, 0xFF,
+	 0x00, 0x71, 0x64, 0x5F, 0x0D, 0xFA, 0x40, 0x64, 0x3B, 0xDB, 0xBE, 0x60, 0x70, 0x78, 0xFF, 0xFF,
+	 0x02, 0x2A, 0x1B, 0x00, 0xD1, 0x91, 0x8D, 0xE2, 0x41, 0x64, 0x3B, 0xDB, 0x31, 0xF3, 0x21, 0x60,
+	 0xA0, 0x63, 0xFD, 0xB4, 0x31, 0xFB, 0xA3, 0xD3, 0xB5, 0x60, 0x58, 0x4D, 0xE3, 0x78, 0xFF, 0xFF,
+	 0x02, 0x63, 0x60, 0x5C, 0x0D, 0xF2, 0x47, 0xFD, 0xFF, 0xB5, 0x60, 0x47, 0xD0, 0x80, 0xDC, 0x84,
+	 0x1F, 0x03, 0x60, 0x47, 0xB4, 0x84, 0x0D, 0xFA, 0x1B, 0x00, 0x08, 0x2A, 0x07, 0x00, 0x42, 0x64,
+	 0x3B, 0xDB, 0x31, 0xF3, 0xFF, 0xFF, 0xF7, 0xB4, 0x31, 0xFB, 0x12, 0x00, 0x10, 0x2A, 0x09, 0x00,
+	 0x43, 0x64, 0x3B, 0xDB, 0x31, 0xF3, 0xFF, 0xFF, 0xEF, 0xB4, 0x31, 0xFB, 0xBD, 0x60, 0xEB, 0x78,
+	 0xFF, 0xFF, 0x44, 0x64, 0x3B, 0xDB, 0x31, 0xF3, 0xFF, 0xFF, 0xDF, 0xB4, 0x31, 0xFB, 0x00, 0x00,
+	 0x2A, 0x64, 0x3B, 0xDB, 0xB5, 0x60, 0xA2, 0x64, 0x40, 0x40, 0xBA, 0x60, 0x4F, 0x78, 0xFF, 0xFF,
+	 0x12, 0x60, 0xCC, 0x63, 0xA3, 0xD3, 0xFF, 0xFF, 0x02, 0xB5, 0x04, 0xB5, 0x04, 0x03, 0x03, 0x03,
+	 0xBE, 0x60, 0xF7, 0x78, 0xFF, 0xFF, 0xEB, 0x60, 0x58, 0x4E, 0x24, 0x78, 0xFF, 0xFF, 0x31, 0x40,
+	 0x01, 0x2A, 0x29, 0x00, 0x9D, 0xFE, 0x27, 0x04, 0x26, 0x0A, 0x9F, 0xFE, 0x24, 0x05, 0x85, 0xFF,
+	 0x20, 0x44, 0x84, 0xFF, 0x40, 0x26, 0x1F, 0x00, 0x3F, 0x40, 0x20, 0x2B, 0x1C, 0x00, 0x38, 0x69,
+	 0xFF, 0xFF, 0x68, 0x44, 0x01, 0x16, 0xFD, 0x01, 0x01, 0x2A, 0x15, 0x00, 0x1F, 0x60, 0x1A, 0x64,
+	 0xA0, 0xD3, 0xFF, 0xFF, 0xDC, 0x84, 0xFF, 0xFF, 0x08, 0x28, 0xA2, 0xDB, 0x65, 0xF1, 0x02, 0x60,
+	 0xEE, 0x64, 0x82, 0xFB, 0xFF, 0xFF, 0x80, 0x60, 0x00, 0x64, 0xB0, 0x84, 0x83, 0xFB, 0x04, 0x64,
+	 0x84, 0xFB, 0xDF, 0xFE, 0x19, 0xFF, 0x10, 0x64, 0x3B, 0xDB, 0x66, 0xF3, 0x73, 0x45, 0xE0, 0x84,
+	 0xE0, 0x84, 0xE0, 0x84, 0xC4, 0x93, 0x75, 0xF1, 0xC9, 0xFE, 0x64, 0x40, 0x01, 0x26, 0x3D, 0x00,
+	 0x49, 0xF3, 0x3C, 0x46, 0x33, 0x18, 0xCC, 0x84, 0x49, 0xFB, 0x30, 0x02, 0xBF, 0x60, 0xAD, 0x64,
+	 0x40, 0x42, 0xFC, 0xFC, 0x00, 0x64, 0x5C, 0x5C, 0x32, 0xFB, 0x82, 0xFF, 0x5C, 0x47, 0x84, 0xFF,
+	 0x62, 0xFF, 0x1F, 0x60, 0x0A, 0x64, 0xA0, 0xD3, 0xFF, 0xFF, 0xDC, 0x84, 0xFF, 0xFF, 0x08, 0x28,
+	 0xA2, 0xDB, 0x2A, 0xF2, 0x07, 0xF0, 0x0C, 0xB4, 0x08, 0x3A, 0x07, 0x00, 0x66, 0x41, 0x64, 0x46,
+	 0x06, 0xF0, 0xFF, 0x60, 0xDF, 0x64, 0xA0, 0x84, 0x06, 0xFA, 0x23, 0xF0, 0x01, 0x64, 0xB0, 0x84,
+	 0xA2, 0xDA, 0x1B, 0x60, 0xD4, 0x62, 0x1B, 0x60, 0xAC, 0x64, 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB,
+	 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xC1, 0xFE, 0xCE, 0xFE, 0x06, 0x00, 0x66, 0xF3,
+	 0x73, 0x45, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xC4, 0x93, 0x12, 0x60, 0xC8, 0x63, 0xA3, 0xD3,
+	 0xAD, 0x49, 0x20, 0xB5, 0x08, 0xB1, 0x23, 0x03, 0xE1, 0x81, 0x10, 0xB5, 0x95, 0x81, 0x60, 0x41,
+	 0x18, 0x02, 0x12, 0x60, 0xCA, 0x7C, 0xA4, 0xD3, 0xFF, 0xFF, 0xCC, 0x84, 0xA4, 0xDB, 0x17, 0x02,
+	 0x0A, 0x64, 0xA4, 0xDB, 0x61, 0x44, 0x07, 0xB4, 0xFF, 0xFF, 0x11, 0x02, 0x08, 0xB1, 0xE1, 0x81,
+	 0x95, 0x81, 0xA3, 0xD3, 0x0C, 0x03, 0x08, 0xAC, 0x01, 0xBC, 0xA3, 0xDB, 0xFF, 0xFF, 0x13, 0xFF,
+	 0x06, 0x00, 0x10, 0xAC, 0xA3, 0xDB, 0x12, 0x60, 0xCA, 0x63, 0x0A, 0x7C, 0xA3, 0xD9, 0xB5, 0x60,
+	 0xAF, 0x78, 0xFF, 0xFF, 0x46, 0xF3, 0x45, 0xF1, 0x05, 0x1B, 0x64, 0x44, 0x03, 0x1B, 0x0F, 0x60,
+	 0x92, 0x62, 0xA2, 0xD3, 0x45, 0xFB, 0x00, 0x63, 0x46, 0xFD, 0x60, 0x41, 0x25, 0x64, 0x3B, 0xDB,
+	 0x27, 0x44, 0xEF, 0xB4, 0x40, 0x47, 0x00, 0xB9, 0x71, 0x40, 0x80, 0x27, 0x01, 0x12, 0x19, 0x03,
+	 0xBF, 0x60, 0x4D, 0x62, 0x84, 0xFF, 0x42, 0x42, 0x82, 0xFF, 0xA0, 0x4C, 0x14, 0xBC, 0xFF, 0xB4,
+	 0xA0, 0x51, 0x1F, 0x0A, 0xA1, 0xFF, 0xFF, 0xFF, 0x81, 0x3E, 0x70, 0x44, 0xAC, 0x80, 0x19, 0x0A,
+	 0x71, 0x40, 0x80, 0x27, 0xF7, 0x12, 0x45, 0xF3, 0x27, 0x02, 0x03, 0x18, 0xCC, 0x84, 0x45, 0xFB,
+	 0xF1, 0x02, 0x06, 0x0A, 0xA0, 0x4C, 0xFB, 0xB4, 0xA0, 0x51, 0xA7, 0x60, 0xDF, 0x78, 0xFF, 0xFF,
+	 0x84, 0xFF, 0xBF, 0x60, 0x2A, 0x64, 0x40, 0x42, 0x82, 0xFF, 0xA0, 0x4C, 0x14, 0xBC, 0xFF, 0xB4,
+	 0xA0, 0x51, 0xAF, 0x60, 0x19, 0x78, 0xFF, 0xFF, 0x3C, 0x44, 0xAC, 0x80, 0x32, 0xF1, 0x12, 0x03,
+	 0x64, 0x40, 0x07, 0x22, 0x0F, 0x00, 0xA7, 0x60, 0xC1, 0x78, 0xFF, 0xFF, 0xA0, 0x4C, 0x1C, 0xBC,
+	 0xDF, 0xB4, 0xA0, 0x51, 0xF1, 0x01, 0x06, 0x00, 0x28, 0x64, 0x3A, 0xDB, 0xA0, 0x4C, 0x30, 0xBC,
+	 0xF3, 0xB4, 0xA0, 0x51, 0xA1, 0xFF, 0xFF, 0xFF, 0x81, 0x3E, 0x28, 0x64, 0x3B, 0xDB, 0x0F, 0x60,
+	 0x94, 0x62, 0xA2, 0xD3, 0x32, 0x40, 0x02, 0x27, 0x16, 0x00, 0x46, 0xFB, 0x14, 0x18, 0xBF, 0x60,
+	 0x9B, 0x64, 0x84, 0xFF, 0x40, 0x42, 0x82, 0xFF, 0xA0, 0x4C, 0x14, 0xBC, 0xF7, 0xB4, 0xA0, 0x51,
+	 0xA1, 0xFF, 0xFF, 0xFF, 0x81, 0x3E, 0x70, 0x44, 0xAC, 0x80, 0x46, 0xF3, 0xCA, 0x0A, 0xDC, 0x02,
+	 0xCC, 0x84, 0x46, 0xFB, 0xF5, 0x02, 0x84, 0xFF, 0xBF, 0x60, 0xAD, 0x64, 0x40, 0x42, 0x82, 0xFF,
+	 0x27, 0x44, 0x08, 0xBC, 0x40, 0x47, 0xBB, 0xE1, 0x04, 0x00, 0x3A, 0xE1, 0x31, 0x40, 0x01, 0x26,
+	 0xBB, 0xE1, 0xA7, 0x60, 0xB5, 0x78, 0xFF, 0xFF, 0x24, 0xE2, 0x2D, 0xF3, 0x2C, 0xF3, 0x00, 0xBD,
+	 0xCC, 0x84, 0x08, 0x03, 0x2C, 0xFB, 0x06, 0x02, 0x65, 0x44, 0x2C, 0xFB, 0x8A, 0xFF, 0x80, 0x60,
+	 0x00, 0x75, 0x88, 0xFF, 0xD2, 0xF3, 0x31, 0x40, 0x01, 0x2A, 0x44, 0x00, 0x60, 0x43, 0x04, 0xB0,
+	 0x02, 0xB0, 0x08, 0x24, 0x16, 0x02, 0x29, 0x44, 0xFF, 0xFF, 0x00, 0xA8, 0xCC, 0x81, 0x0E, 0x03,
+	 0x41, 0x49, 0x37, 0x02, 0x63, 0x40, 0x08, 0x2A, 0x09, 0x00, 0xF7, 0xB3, 0x25, 0x60, 0x1C, 0x7C,
+	 0xA4, 0xD1, 0xAD, 0x4F, 0xFD, 0xB4, 0xA0, 0x5D, 0x44, 0x49, 0x2B, 0x00, 0x63, 0x40, 0x02, 0x2A,
+	 0x14, 0x00, 0x25, 0x60, 0x1E, 0x64, 0xA0, 0xD3, 0x25, 0x60, 0x1A, 0x7C, 0xA4, 0xDB, 0x40, 0x49,
+	 0x25, 0x60, 0x20, 0x64, 0xA0, 0xD3, 0x25, 0x60, 0x1C, 0x7C, 0xA4, 0xDB, 0x0C, 0xBB, 0xFD, 0xB3,
+	 0xAD, 0x4F, 0x02, 0xBC, 0x00, 0x7F, 0xA0, 0x5D, 0x14, 0x00, 0x25, 0x60, 0x22, 0x64, 0xA0, 0xD3,
+	 0x25, 0x60, 0x1A, 0x7C, 0x0E, 0x18, 0xA4, 0xDB, 0x40, 0x49, 0x25, 0x60, 0x24, 0x64, 0xA0, 0xD3,
+	 0x25, 0x60, 0x1C, 0x7C, 0xA4, 0xDB, 0x08, 0xBB, 0xFB, 0xB3, 0xAD, 0x4F, 0x02, 0xBC, 0x00, 0x7F,
+	 0xA0, 0x5D, 0xD2, 0xFD, 0x01, 0x60, 0x0C, 0x61, 0xA1, 0xD3, 0x61, 0x43, 0x17, 0x18, 0x58, 0xD3,
+	 0x62, 0x41, 0x03, 0x18, 0xCC, 0x84, 0xA1, 0xDB, 0x11, 0x00, 0x49, 0xD3, 0xA3, 0xDB, 0x06, 0xA1,
+	 0xA1, 0xD3, 0x59, 0xD1, 0x60, 0x45, 0xA5, 0xD3, 0x59, 0xD1, 0xB0, 0x84, 0xA5, 0xDB, 0x64, 0x44,
+	 0x06, 0x36, 0xCD, 0xFE, 0x07, 0x36, 0xD6, 0xFE, 0xE5, 0x01, 0x23, 0x46, 0xB5, 0x60, 0xAF, 0x78,
+	 0xFF, 0xFF, 0x46, 0x43, 0x1C, 0x60, 0x0A, 0x61, 0xA1, 0xD3, 0x59, 0xD1, 0x06, 0x1B, 0x59, 0xD3,
+	 0x59, 0xD1, 0x03, 0x1B, 0x59, 0xD3, 0x59, 0xD1, 0xF0, 0x18, 0x00, 0x63, 0x49, 0xDD, 0x60, 0x40,
+	 0x02, 0x36, 0x11, 0x00, 0x03, 0x36, 0x32, 0x00, 0x01, 0x36, 0x08, 0x00, 0x05, 0x3A, 0xEA, 0x01,
+	 0xA4, 0xD3, 0x5A, 0xD3, 0x9C, 0x85, 0xA4, 0x84, 0xA2, 0xDB, 0xE4, 0x01, 0x01, 0x60, 0x0C, 0x61,
+	 0x00, 0x64, 0xA1, 0xDB, 0xDF, 0x01, 0xC0, 0x60, 0x4F, 0x64, 0x40, 0x45, 0x22, 0x00, 0x01, 0x60,
+	 0x0C, 0x66, 0xA6, 0xD3, 0x04, 0xA1, 0x60, 0x43, 0xA1, 0xD3, 0xC9, 0x81, 0x60, 0x45, 0x00, 0xBB,
+	 0xA1, 0xDB, 0xBE, 0xD3, 0x09, 0x03, 0xD4, 0x84, 0x9C, 0x84, 0xDC, 0x84, 0xFF, 0xFF, 0x04, 0x0E,
+	 0xA3, 0xD1, 0x63, 0x46, 0x64, 0x43, 0xF2, 0x01, 0x9C, 0x84, 0xDC, 0x85, 0x49, 0xDD, 0x61, 0x44,
+	 0x00, 0xBB, 0xA6, 0xDB, 0x02, 0x03, 0x65, 0x44, 0xBE, 0xDB, 0xBC, 0x01, 0xC0, 0x60, 0x2A, 0x64,
+	 0x40, 0x45, 0x01, 0x60, 0x0C, 0x66, 0xA6, 0xD3, 0xFF, 0xFF, 0xD0, 0x80, 0x0F, 0x18, 0x02, 0x03,
+	 0x60, 0x46, 0xF9, 0x01, 0x58, 0xD3, 0xA4, 0xD3, 0x60, 0x45, 0x00, 0x63, 0xA4, 0xDD, 0x05, 0x18,
+	 0x58, 0xD3, 0xFF, 0xFF, 0xC4, 0x83, 0xA2, 0xDD, 0xCA, 0x84, 0xA6, 0xDB, 0x25, 0x58, 0x64, 0x41,
+	 0x30, 0x44, 0x02, 0xA8, 0x00, 0xE1, 0x06, 0x02, 0x40, 0xFF, 0x42, 0xFF, 0x43, 0xFF, 0x44, 0xFF,
+	 0x45, 0xFF, 0xA1, 0xFF, 0x88, 0xFF, 0x85, 0xFF, 0x21, 0xE1, 0x5C, 0x40, 0xC0, 0x60, 0x9A, 0x78,
+	 0xFF, 0xFF, 0x43, 0xFF, 0x39, 0xE1, 0xA1, 0xFF, 0xFF, 0xFF, 0x84, 0x3E, 0xFB, 0x01, 0xA0, 0x4C,
+	 0x3D, 0x46, 0x2A, 0xF2, 0x46, 0x4D, 0x10, 0x25, 0x0E, 0x00, 0x09, 0xE1, 0xA1, 0xFF, 0x66, 0x40,
+	 0x0F, 0xF2, 0x01, 0x29, 0x02, 0x00, 0x40, 0xFF, 0x0A, 0xBC, 0xA2, 0xDA, 0x08, 0x25, 0xE9, 0x01,
+	 0xCB, 0xFE, 0x5C, 0x5D, 0xE7, 0x01, 0x44, 0xFF, 0x03, 0x2B, 0x21, 0x00, 0x89, 0xF3, 0x06, 0x61,
+	 0x60, 0x43, 0x66, 0x45, 0x31, 0xF0, 0x63, 0x46, 0x05, 0xF2, 0x65, 0x46, 0xD0, 0x80, 0x30, 0xF0,
+	 0x0F, 0x02, 0x63, 0x46, 0x04, 0xF2, 0x65, 0x46, 0xD0, 0x80, 0x2F, 0xF0, 0x09, 0x02, 0x63, 0x46,
+	 0x03, 0xF2, 0x65, 0x46, 0xD0, 0x80, 0xFF, 0xFF, 0x03, 0x02, 0xFF, 0xFF, 0x48, 0xFE, 0x06, 0x00,
+	 0xCD, 0x81, 0x02, 0xA3, 0xE7, 0x02, 0x88, 0xF1, 0x08, 0xFE, 0x64, 0x43, 0x26, 0x03, 0x31, 0xF2,
+	 0x12, 0x60, 0xCE, 0x65, 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD3, 0x66, 0x41, 0x60, 0x46,
+	 0x60, 0x43, 0x05, 0xF2, 0x16, 0x18, 0x61, 0x46, 0x31, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x04, 0xF2,
+	 0x0C, 0x02, 0x61, 0x46, 0x30, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x03, 0xF2, 0x06, 0x02, 0x61, 0x46,
+	 0x2F, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0xFF, 0xFF, 0x07, 0x03, 0x80, 0xF4, 0xFF, 0xFF, 0x63, 0x46,
+	 0xE8, 0x1B, 0x88, 0xF3, 0x08, 0xFE, 0x60, 0x43, 0x61, 0x46, 0x07, 0xFC, 0x3F, 0xF2, 0x09, 0x60,
+	 0xB0, 0x65, 0xD4, 0x80, 0x2A, 0xF2, 0xA1, 0x05, 0x08, 0x25, 0x93, 0x01, 0x00, 0x64, 0x0D, 0x60,
+	 0x2C, 0x61, 0x40, 0x4B, 0xA1, 0xDB, 0x2D, 0x46, 0x3B, 0xF2, 0x88, 0xF1, 0x87, 0xF4, 0x60, 0x40,
+	 0x20, 0x2B, 0x12, 0x00, 0xD3, 0x80, 0x2C, 0xF0, 0x90, 0x03, 0x07, 0xF4, 0x64, 0x40, 0x01, 0x26,
+	 0x88, 0xF5, 0xB6, 0xF4, 0x2D, 0x46, 0x04, 0x64, 0x04, 0xB3, 0x22, 0xFA, 0x04, 0x03, 0xC2, 0x60,
+	 0x11, 0x78, 0xFF, 0xFF, 0x01, 0x00, 0xE0, 0x00, 0x74, 0x62, 0xA2, 0xD0, 0xFF, 0xFF, 0x64, 0x44,
+	 0xE0, 0x7F, 0xA0, 0x5B, 0x64, 0x47, 0xE1, 0x7F, 0x5A, 0xD0, 0xA0, 0x5B, 0x64, 0x44, 0xE2, 0x7F,
+	 0xA0, 0x5B, 0x64, 0x47, 0x7C, 0x5F, 0xE8, 0x84, 0xE8, 0x85, 0x0C, 0x60, 0x3A, 0x64, 0x44, 0xD3,
+	 0x5A, 0xD1, 0x03, 0x1B, 0xC2, 0x60, 0x04, 0x78, 0xFF, 0xFF, 0x60, 0x45, 0x64, 0x44, 0xE3, 0x7F,
+	 0xA0, 0x5B, 0x64, 0x47, 0xE4, 0x7F, 0x5A, 0xD1, 0xA0, 0x5B, 0x64, 0x44, 0xE5, 0x7F, 0xA0, 0x5B,
+	 0x64, 0x47, 0xE6, 0x7F, 0x5A, 0xD1, 0xA0, 0x5B, 0x64, 0x44, 0xE7, 0x7F, 0xA0, 0x5B, 0x65, 0x40,
+	 0x0D, 0x3A, 0x1C, 0x00, 0x64, 0x47, 0xE8, 0x7F, 0x5A, 0xD1, 0xA0, 0x5B, 0x64, 0x44, 0xE9, 0x7F,
+	 0xA0, 0x5B, 0x64, 0x47, 0xEA, 0x7F, 0x5A, 0xD1, 0xA0, 0x5B, 0x64, 0x44, 0xEB, 0x7F, 0xA0, 0x5B,
+	 0x64, 0x47, 0xEC, 0x7F, 0x5A, 0xD1, 0xA0, 0x5B, 0x64, 0x44, 0xED, 0x7F, 0xA0, 0x5B, 0x64, 0x47,
+	 0xEE, 0x7F, 0x5A, 0xD1, 0xA0, 0x5B, 0x64, 0x44, 0xEF, 0x7F, 0xA0, 0x5B, 0x65, 0x44, 0xD8, 0x84,
+	 0x08, 0x25, 0x78, 0x00, 0x60, 0x7F, 0xA0, 0x5B, 0x80, 0x60, 0x00, 0xEB, 0xA0, 0x60, 0x00, 0xEB,
+	 0xD1, 0x60, 0x00, 0xEB, 0x3F, 0xF2, 0x04, 0x65, 0xC4, 0x83, 0x0A, 0xE1, 0xB3, 0xFF, 0x9A, 0xFF,
+	 0xCB, 0x83, 0x00, 0xF4, 0x10, 0x62, 0x6C, 0x61, 0x0E, 0xA3, 0xAB, 0x84, 0xF2, 0xA3, 0xA1, 0xFF,
+	 0x08, 0x00, 0x00, 0xF4, 0x81, 0xF2, 0x02, 0x62, 0xC9, 0x81, 0xAB, 0x84, 0xA1, 0xFF, 0x01, 0x00,
+	 0xA2, 0xDC, 0x7A, 0xD4, 0xFD, 0x1C, 0xA2, 0xDC, 0x08, 0x25, 0x54, 0x00, 0xF2, 0x1D, 0x7C, 0xA8,
+	 0xD9, 0x81, 0xEF, 0x03, 0xFF, 0xB1, 0x09, 0x1E, 0x02, 0x02, 0x00, 0xF4, 0x02, 0x62, 0x5A, 0xD2,
+	 0x89, 0xFF, 0x80, 0x4F, 0x6F, 0x44, 0xA2, 0xDA, 0x88, 0xFF, 0x98, 0xFF, 0x09, 0xE1, 0xA1, 0xFF,
+	 0x3D, 0x46, 0x08, 0x25, 0x3F, 0x00, 0x40, 0xFF, 0x0F, 0xF0, 0x0A, 0x64, 0xB0, 0x84, 0x18, 0x14,
+	 0xF7, 0xB4, 0xA2, 0xDA, 0x0D, 0x60, 0x2C, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x2A,
+	 0x0C, 0x00, 0xD1, 0xF5, 0xD0, 0xF4, 0x0D, 0x60, 0x2C, 0x61, 0x59, 0xD1, 0x37, 0xF8, 0x05, 0x64,
+	 0x59, 0xD1, 0xCC, 0x84, 0xBD, 0xD8, 0xFC, 0x02, 0x2D, 0x46, 0xC0, 0x60, 0xB0, 0x78, 0xFF, 0xFF,
+	 0xA2, 0xDA, 0x2D, 0x46, 0x3B, 0xF0, 0xFF, 0xFF, 0x64, 0x40, 0x20, 0x2B, 0x18, 0x00, 0xD1, 0xF5,
+	 0xB7, 0xF0, 0x2A, 0x44, 0xA4, 0x84, 0xFF, 0xFF, 0x2F, 0x26, 0x10, 0x00, 0x2D, 0x46, 0x64, 0x44,
+	 0x3A, 0xF0, 0xBC, 0xF0, 0x64, 0x5F, 0x3D, 0xF0, 0x07, 0xF4, 0xD0, 0xF4, 0xFF, 0xFF, 0x08, 0xA3,
+	 0x5B, 0xD8, 0x65, 0x5C, 0x5B, 0xD8, 0x5B, 0xDA, 0x2D, 0x46, 0x01, 0x00, 0x2D, 0x46, 0xC0, 0x60,
+	 0xB0, 0x78, 0xFF, 0xFF, 0x98, 0xFF, 0x43, 0xFF, 0x40, 0xFF, 0xB0, 0xFF, 0xB1, 0xFF, 0x2D, 0x46,
+	 0x0D, 0x60, 0x2C, 0x61, 0xA1, 0xD3, 0x2D, 0x46, 0x60, 0x40, 0x01, 0x2A, 0x0A, 0x00, 0xD1, 0xF5,
+	 0xD0, 0xF4, 0x59, 0xD1, 0x37, 0xF8, 0x05, 0x64, 0x59, 0xD1, 0xCC, 0x84, 0xBD, 0xD8, 0xFC, 0x02,
+	 0x2D, 0x46, 0xC0, 0x60, 0x9A, 0x78, 0xFF, 0xFF, 0x98, 0xFF, 0x09, 0xE1, 0xA1, 0xFF, 0x3D, 0x46,
+	 0x08, 0x25, 0xE0, 0x01, 0x0F, 0xF2, 0x40, 0xFF, 0x02, 0xBC, 0xA2, 0xDA, 0xC0, 0x60, 0xB0, 0x78,
+	 0xFF, 0xFF, 0x00, 0x64, 0x0D, 0x60, 0x2C, 0x62, 0xA2, 0xDB, 0x04, 0x64, 0x22, 0xFA, 0x87, 0xF4,
+	 0x88, 0xF1, 0xFF, 0xFF, 0xD3, 0x80, 0x3B, 0xF2, 0xE7, 0x03, 0x60, 0x47, 0xC0, 0xB7, 0x02, 0xFE,
+	 0xF0, 0x84, 0xF0, 0x84, 0xF0, 0x84, 0x00, 0xA8, 0x40, 0x4A, 0x16, 0x03, 0xE0, 0x81, 0x61, 0x43,
+	 0x42, 0xFE, 0x00, 0x64, 0xF0, 0x84, 0xFE, 0x1F, 0x40, 0x4A, 0xE1, 0x84, 0xE0, 0x84, 0x2D, 0x46,
+	 0x07, 0xF4, 0xE0, 0x81, 0x37, 0xF0, 0x2A, 0x47, 0x0C, 0x60, 0x7A, 0x63, 0xA0, 0x84, 0x47, 0x9C,
+	 0x10, 0x03, 0x7C, 0x44, 0xA0, 0x63, 0x11, 0x00, 0x20, 0x64, 0x40, 0x4A, 0x63, 0x46, 0x37, 0xF0,
+	 0x66, 0x44, 0x64, 0x40, 0x80, 0x2B, 0x05, 0x00, 0x00, 0x60, 0x70, 0x7C, 0x00, 0x60, 0x90, 0x63,
+	 0x04, 0x00, 0x2D, 0x46, 0xC2, 0x60, 0x04, 0x78, 0xFF, 0xFF, 0x2D, 0x46, 0xCE, 0xFB, 0xCF, 0xF9,
+	 0xD0, 0xFD, 0x07, 0xF2, 0xD1, 0xFB, 0x60, 0x46, 0x37, 0xF0, 0x2A, 0x44, 0x0D, 0x60, 0x2C, 0x62,
+	 0x5A, 0xD9, 0x00, 0x65, 0x45, 0x4B, 0xA0, 0x84, 0xFF, 0xFF, 0x3F, 0x22, 0x05, 0x00, 0x90, 0x84,
+	 0x37, 0xFA, 0x01, 0x64, 0x40, 0x4B, 0x21, 0x00, 0xAD, 0x46, 0x0A, 0xA3, 0x3D, 0xF2, 0xAD, 0x46,
+	 0xA3, 0xD0, 0xAD, 0x46, 0xD0, 0x80, 0x3C, 0xF2, 0xAD, 0x46, 0x02, 0x03, 0x16, 0x07, 0x14, 0x04,
+	 0x5B, 0xD0, 0xAD, 0x46, 0xD0, 0x80, 0x3B, 0xF2, 0x03, 0x03, 0xAD, 0x46, 0x0E, 0x07, 0x0C, 0x04,
+	 0x3A, 0xF0, 0xAD, 0x46, 0x5B, 0xD0, 0x64, 0x5F, 0xD0, 0x80, 0x2B, 0x44, 0x18, 0x07, 0x04, 0x03,
+	 0xD0, 0x84, 0x10, 0xA4, 0xFF, 0xFF, 0x13, 0x07, 0x7F, 0x01, 0x01, 0x64, 0x0D, 0x60, 0x2C, 0x62,
+	 0xA2, 0xDB, 0x2D, 0x46, 0x0D, 0x60, 0x3C, 0x62, 0x80, 0xFF, 0x78, 0x44, 0x03, 0xA4, 0xA2, 0xDB,
+	 0xC2, 0x60, 0xAA, 0x78, 0xFF, 0xFF, 0x85, 0xFF, 0x2D, 0x46, 0x08, 0x25, 0x53, 0x01, 0x2D, 0x46,
+	 0x0D, 0x60, 0x3C, 0x62, 0x80, 0xFF, 0x78, 0x44, 0x03, 0xA4, 0xA2, 0xDB, 0xC3, 0x60, 0x33, 0x78,
+	 0xFF, 0xFF, 0x85, 0xFF, 0x2D, 0x46, 0x08, 0x25, 0x45, 0x01, 0x00, 0x60, 0x0F, 0x64, 0xC1, 0x60,
+	 0x70, 0x78, 0xFF, 0xFF, 0x07, 0xF4, 0x66, 0x41, 0x03, 0xF2, 0x04, 0xF2, 0x40, 0x42, 0x05, 0xF2,
+	 0x40, 0x43, 0x40, 0x44, 0x61, 0x46, 0x3C, 0xF2, 0x3D, 0xF2, 0x40, 0x40, 0x40, 0x41, 0x0D, 0x60,
+	 0x70, 0x65, 0x00, 0x61, 0xCF, 0xF1, 0xCE, 0xF5, 0x44, 0x4C, 0x2C, 0x5C, 0xE9, 0x80, 0x00, 0x64,
+	 0xF0, 0x84, 0xF0, 0x84, 0xC0, 0x83, 0xBD, 0xD2, 0x24, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F,
+	 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C,
+	 0x20, 0x44, 0x40, 0x80, 0xDB, 0x83, 0xBD, 0xD2, 0x20, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F,
+	 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C,
+	 0x21, 0x44, 0x40, 0x81, 0xDB, 0x83, 0xBD, 0xD2, 0x21, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F,
+	 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C,
+	 0x22, 0x44, 0x40, 0x82, 0xDB, 0x83, 0xBD, 0xD2, 0x22, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F,
+	 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C,
+	 0x23, 0x44, 0x40, 0x83, 0xF2, 0xA3, 0xBD, 0xD2, 0x23, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F,
+	 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C,
+	 0x24, 0x44, 0xC0, 0x9C, 0x41, 0x84, 0xDD, 0x81, 0x08, 0x2A, 0xA7, 0x01, 0x0D, 0x60, 0x2E, 0x61,
+	 0x05, 0x64, 0xD0, 0xF4, 0xD1, 0xF5, 0xFE, 0xA3, 0x5B, 0xD0, 0xCC, 0x84, 0x59, 0xD9, 0xFC, 0x02,
+	 0xD0, 0xF3, 0xD1, 0xF5, 0x60, 0x42, 0x20, 0x44, 0xA2, 0xDA, 0x21, 0x44, 0x5A, 0xDA, 0x22, 0x44,
+	 0x5A, 0xDA, 0x23, 0x44, 0x5A, 0xDA, 0x24, 0x44, 0x5A, 0xDA, 0x61, 0x46, 0x0D, 0x60, 0x3C, 0x62,
+	 0xA2, 0xD7, 0xFF, 0xFF, 0xFF, 0xFF, 0x66, 0x41, 0xD0, 0xF3, 0xD1, 0xF5, 0xA0, 0xD2, 0x5A, 0xD0,
+	 0x40, 0x40, 0x44, 0x41, 0x5A, 0xD2, 0x5A, 0xD0, 0x40, 0x42, 0x5A, 0xD0, 0x44, 0x43, 0x61, 0x46,
+	 0xBA, 0xF0, 0x3B, 0xF2, 0x44, 0x44, 0x65, 0x5F, 0x40, 0x85, 0xCF, 0xF4, 0xCE, 0xF5, 0x43, 0x4C,
+	 0x0D, 0x60, 0x70, 0x65, 0xBD, 0xD2, 0x25, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84,
+	 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C, 0x20, 0x44,
+	 0x40, 0x80, 0xBD, 0xD2, 0x20, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1,
+	 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C, 0x21, 0x44, 0x40, 0x81,
+	 0xBD, 0xD2, 0x21, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44,
+	 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C, 0x22, 0x44, 0x40, 0x82, 0xBD, 0xD2,
+	 0x22, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F,
+	 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C, 0x23, 0x44, 0x40, 0x83, 0xBD, 0xD2, 0x23, 0x5C,
+	 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84,
+	 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C, 0x24, 0x44, 0x40, 0x84, 0xBD, 0xD2, 0x24, 0x5C, 0x90, 0x9C,
+	 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1,
+	 0x64, 0x47, 0x90, 0x9C, 0x25, 0x44, 0x40, 0x85, 0x61, 0x46, 0x3A, 0xF0, 0xFF, 0xFF, 0x64, 0x44,
+	 0xE0, 0x7F, 0xA0, 0x5B, 0x64, 0x47, 0xE1, 0x7F, 0x5A, 0xD0, 0xA0, 0x5B, 0x64, 0x44, 0xE2, 0x7F,
+	 0xA0, 0x5B, 0x64, 0x47, 0xCE, 0xF5, 0xBD, 0xD2, 0x25, 0x5C, 0x90, 0x84, 0xE8, 0x80, 0xF8, 0x84,
+	 0x20, 0x5C, 0x40, 0x80, 0x20, 0x44, 0xE4, 0x7F, 0xA0, 0x5B, 0x20, 0x47, 0xE5, 0x7F, 0xA0, 0x5B,
+	 0xBD, 0xD2, 0x20, 0x5C, 0x90, 0x84, 0xE8, 0x80, 0xF8, 0x84, 0x21, 0x5C, 0x40, 0x81, 0x21, 0x44,
+	 0xE6, 0x7F, 0xA0, 0x5B, 0x21, 0x47, 0xE7, 0x7F, 0xA0, 0x5B, 0x21, 0x44, 0xE8, 0x80, 0xF8, 0x84,
+	 0x22, 0x5C, 0x40, 0x82, 0x22, 0x44, 0xE8, 0x7F, 0xA0, 0x5B, 0x22, 0x47, 0xE9, 0x7F, 0xA0, 0x5B,
+	 0x22, 0x44, 0xE8, 0x80, 0xF8, 0x84, 0x23, 0x5C, 0x40, 0x83, 0x23, 0x44, 0xEA, 0x7F, 0xA0, 0x5B,
+	 0x23, 0x47, 0xEB, 0x7F, 0xA0, 0x5B, 0x23, 0x44, 0xE8, 0x80, 0xF8, 0x84, 0x24, 0x5C, 0x40, 0x84,
+	 0x24, 0x44, 0xEC, 0x7F, 0xA0, 0x5B, 0x24, 0x47, 0xED, 0x7F, 0xA0, 0x5B, 0x24, 0x44, 0xE8, 0x80,
+	 0xF8, 0x84, 0x25, 0x5C, 0x40, 0x85, 0x25, 0x44, 0xEE, 0x7F, 0xA0, 0x5B, 0x25, 0x47, 0xEF, 0x7F,
+	 0xA0, 0x5B, 0x2C, 0x43, 0xA3, 0xD2, 0x25, 0x5C, 0x90, 0x81, 0xE9, 0x84, 0xE3, 0x7F, 0xA0, 0x5B,
+	 0x0D, 0x60, 0x3C, 0x62, 0xA2, 0xD7, 0xFF, 0xFF, 0xFF, 0xFF, 0xCB, 0xF3, 0x5A, 0xD3, 0x40, 0x48,
+	 0x5A, 0xD3, 0x40, 0x49, 0x40, 0x4A, 0x00, 0x60, 0x70, 0x7C, 0x44, 0x4D, 0x45, 0xF2, 0x46, 0xF2,
+	 0x40, 0x47, 0x40, 0x46, 0x0D, 0x60, 0x70, 0x65, 0x00, 0x61, 0x2D, 0x5C, 0xE9, 0x80, 0x00, 0x64,
+	 0xF0, 0x84, 0xF0, 0x84, 0xC0, 0x83, 0xBD, 0xD2, 0x2A, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F,
+	 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C,
+	 0x26, 0x44, 0x40, 0x86, 0xDB, 0x83, 0xBD, 0xD2, 0x26, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F,
+	 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C,
+	 0x27, 0x44, 0x40, 0x87, 0xDB, 0x83, 0xBD, 0xD2, 0x27, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F,
+	 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C,
+	 0x28, 0x44, 0x40, 0x88, 0xDB, 0x83, 0xBD, 0xD2, 0x28, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F,
+	 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C,
+	 0x29, 0x44, 0x40, 0x89, 0xF2, 0xA3, 0xBD, 0xD2, 0x29, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F,
+	 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C,
+	 0x2A, 0x44, 0xC0, 0x9C, 0x41, 0x8A, 0xDD, 0x81, 0x08, 0x2A, 0xA7, 0x01, 0x26, 0x44, 0x40, 0xFA,
+	 0x27, 0x44, 0x41, 0xFA, 0x28, 0x44, 0x42, 0xFA, 0x29, 0x44, 0x43, 0xFA, 0x2A, 0x44, 0x44, 0xFA,
+	 0x0D, 0x60, 0x3E, 0x62, 0xA2, 0xD7, 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x60, 0x80, 0x7C, 0x44, 0x4D,
+	 0x2D, 0x42, 0xA2, 0xD2, 0x5A, 0xD0, 0x40, 0x46, 0x44, 0x47, 0x5A, 0xD2, 0x5A, 0xD0, 0x40, 0x48,
+	 0x5A, 0xD0, 0x44, 0x49, 0x47, 0xF2, 0x44, 0x4A, 0x40, 0x8B, 0x60, 0x5C, 0x64, 0x47, 0xE0, 0x7F,
+	 0xA0, 0x5A, 0xFF, 0xB4, 0x20, 0xBC, 0x7F, 0xB4, 0xE1, 0x7F, 0xA0, 0x5A, 0x64, 0x44, 0xE2, 0x7F,
+	 0xA0, 0x5A, 0x00, 0x60, 0x70, 0x63, 0x0D, 0x60, 0x70, 0x65, 0xBD, 0xD2, 0x2B, 0x5C, 0x90, 0x9C,
+	 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1,
+	 0x64, 0x47, 0x90, 0x9C, 0x26, 0x44, 0x40, 0x86, 0xBD, 0xD2, 0x26, 0x5C, 0x90, 0x9C, 0x64, 0x47,
+	 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47,
+	 0x90, 0x9C, 0x27, 0x44, 0x40, 0x87, 0xBD, 0xD2, 0x27, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F,
+	 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C,
+	 0x28, 0x44, 0x40, 0x88, 0xBD, 0xD2, 0x28, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84,
+	 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C, 0x29, 0x44,
+	 0x40, 0x89, 0xBD, 0xD2, 0x29, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1,
+	 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C, 0x2A, 0x44, 0x40, 0x8A,
+	 0xBD, 0xD2, 0x2A, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44,
+	 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C, 0x2B, 0x44, 0x40, 0x8B, 0xBD, 0xD2,
+	 0x2B, 0x5C, 0x90, 0x84, 0xE8, 0x80, 0xF8, 0x84, 0x26, 0x5C, 0x40, 0x86, 0x26, 0x44, 0xE4, 0x7F,
+	 0xA0, 0x5A, 0x26, 0x47, 0xE5, 0x7F, 0xA0, 0x5A, 0xBD, 0xD2, 0x26, 0x5C, 0x90, 0x84, 0xE8, 0x80,
+	 0xF8, 0x84, 0x27, 0x5C, 0x40, 0x87, 0x27, 0x44, 0xE6, 0x7F, 0xA0, 0x5A, 0x27, 0x47, 0xE7, 0x7F,
+	 0xA0, 0x5A, 0x27, 0x44, 0xE8, 0x80, 0xF8, 0x84, 0x28, 0x5C, 0x40, 0x88, 0x28, 0x44, 0xE8, 0x7F,
+	 0xA0, 0x5A, 0x28, 0x47, 0xE9, 0x7F, 0xA0, 0x5A, 0x28, 0x44, 0xE8, 0x80, 0xF8, 0x84, 0x29, 0x5C,
+	 0x40, 0x89, 0x29, 0x44, 0xEA, 0x7F, 0xA0, 0x5A, 0x29, 0x47, 0xEB, 0x7F, 0xA0, 0x5A, 0x29, 0x44,
+	 0xE8, 0x80, 0xF8, 0x84, 0x2A, 0x5C, 0x40, 0x8A, 0x2A, 0x44, 0xEC, 0x7F, 0xA0, 0x5A, 0x2A, 0x47,
+	 0xED, 0x7F, 0xA0, 0x5A, 0x2A, 0x44, 0xE8, 0x80, 0xF8, 0x84, 0x2B, 0x5C, 0x40, 0x8B, 0x2B, 0x44,
+	 0xEE, 0x7F, 0xA0, 0x5A, 0x2B, 0x47, 0xEF, 0x7F, 0xA0, 0x5A, 0x38, 0xF0, 0x2B, 0x44, 0x90, 0x84,
+	 0xE8, 0x84, 0xE3, 0x7F, 0xA0, 0x5A, 0x0D, 0x60, 0x3E, 0x62, 0xA2, 0xD7, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x42, 0xFF, 0x40, 0xFF, 0xDD, 0xFE, 0xAD, 0x4F, 0x00, 0x7F, 0x01, 0xBC, 0xA0, 0x5D, 0x00, 0xEE,
+	 0x19, 0x61, 0xCD, 0x81, 0xFF, 0xFF, 0xFD, 0x02, 0x43, 0x45, 0x20, 0x44, 0x60, 0xBC, 0x40, 0x40,
+	 0x02, 0x60, 0xEE, 0x63, 0x65, 0xF3, 0x82, 0xFD, 0x40, 0x7F, 0x83, 0xFB, 0x05, 0x64, 0x84, 0xFB,
+	 0xDF, 0xFE, 0x19, 0xFF, 0xC5, 0x60, 0x6D, 0x64, 0x3F, 0x40, 0x01, 0x2B, 0x02, 0x00, 0xC5, 0x60,
+	 0x6D, 0x64, 0x85, 0xFB, 0xC0, 0x60, 0x9A, 0x78, 0xFF, 0xFF, 0x04, 0xEE, 0xAD, 0x4F, 0x00, 0x7F,
+	 0x01, 0xBC, 0xA0, 0x5D, 0x19, 0x61, 0xCD, 0x81, 0xFF, 0xFF, 0xFD, 0x02, 0xAD, 0x4F, 0x00, 0x7F,
+	 0x01, 0xBC, 0xA0, 0x5D, 0x00, 0xEE, 0x15, 0x60, 0xA2, 0xE7, 0x1C, 0x60, 0x68, 0x63, 0x1C, 0x60,
+	 0xDC, 0x65, 0xDF, 0xFE, 0x80, 0xE1, 0xBD, 0xD3, 0xFF, 0xFF, 0x60, 0x48, 0x60, 0x47, 0x80, 0xBC,
+	 0x00, 0x7F, 0x60, 0x4A, 0xD7, 0x80, 0xA1, 0xFF, 0xFF, 0xFF, 0xF5, 0x02, 0x1C, 0x60, 0xDC, 0x63,
+	 0x1D, 0x60, 0xDE, 0x65, 0xBD, 0xD3, 0xFF, 0xFF, 0x60, 0x48, 0x60, 0x47, 0x80, 0xBC, 0x00, 0x7F,
+	 0x60, 0x4A, 0xD7, 0x80, 0xA1, 0xFF, 0xFF, 0xFF, 0xF5, 0x02, 0x3F, 0x40, 0x20, 0x2B, 0x00, 0x00,
+	 0x01, 0x68, 0xFF, 0x6A, 0xBF, 0xFE, 0xC6, 0x60, 0x55, 0x78, 0xFF, 0xFF, 0x3F, 0x40, 0x20, 0x2B,
+	 0xAD, 0x00, 0x01, 0x16, 0xFE, 0x01, 0x38, 0x69, 0xA1, 0xFF, 0xFF, 0xFF, 0x68, 0x44, 0x01, 0x2A,
+	 0xA5, 0x00, 0x1F, 0x60, 0x1A, 0x64, 0xA0, 0xD3, 0xFF, 0xFF, 0xDC, 0x84, 0xFF, 0xFF, 0x08, 0x28,
+	 0xA2, 0xDB, 0x65, 0xF1, 0x80, 0x60, 0x00, 0x64, 0xB0, 0x9C, 0x01, 0x00, 0x65, 0xF1, 0xDD, 0xFE,
+	 0xAD, 0x4F, 0x00, 0x7F, 0x01, 0xBC, 0xA0, 0x5D, 0x00, 0xEE, 0x43, 0x45, 0x20, 0x44, 0x20, 0xBC,
+	 0x40, 0x40, 0x02, 0x60, 0xEE, 0x64, 0x82, 0xFB, 0x83, 0xF9, 0x05, 0x64, 0x84, 0xFB, 0xDF, 0xFE,
+	 0x19, 0xFF, 0x83, 0x00, 0x20, 0x44, 0x20, 0xBC, 0x40, 0x40, 0x43, 0x45, 0xA4, 0xD1, 0xDA, 0x83,
+	 0xC3, 0x85, 0x80, 0xE1, 0xDF, 0xFE, 0xBD, 0xD3, 0xFF, 0xFF, 0x60, 0x48, 0x60, 0x47, 0x80, 0xBC,
+	 0x00, 0x7F, 0x60, 0x4A, 0xD7, 0x80, 0xA1, 0xFF, 0xF6, 0x02, 0xBF, 0xFE, 0x6E, 0x00, 0x3F, 0x40,
+	 0x40, 0x26, 0x13, 0x00, 0x0B, 0x60, 0xF8, 0x62, 0xA2, 0xD1, 0x00, 0x60, 0x10, 0x64, 0x90, 0x84,
+	 0xA0, 0x50, 0xF8, 0xA2, 0xA2, 0xD1, 0x0A, 0x60, 0x19, 0x64, 0x90, 0x84, 0xA0, 0x52, 0x06, 0xA2,
+	 0xA2, 0xD1, 0x46, 0x60, 0x09, 0x64, 0x90, 0x84, 0xA0, 0x50, 0xAD, 0x4F, 0xFE, 0xB4, 0xA0, 0x5D,
+	 0xAD, 0x4F, 0xFD, 0xB4, 0xA0, 0x5D, 0x02, 0xEE, 0xBD, 0xFE, 0x50, 0x00, 0x80, 0xE1, 0x01, 0x16,
+	 0xFE, 0x01, 0x64, 0x48, 0x92, 0x6A, 0xA1, 0xFF, 0xFF, 0xFF, 0x68, 0x40, 0x1F, 0x60, 0x08, 0x64,
+	 0xA0, 0xD3, 0xFF, 0xFF, 0xDC, 0x84, 0xFF, 0xFF, 0x08, 0x28, 0xA2, 0xDB, 0x3F, 0x00, 0x80, 0xE1,
+	 0x01, 0x16, 0xFE, 0x01, 0x01, 0x68, 0xA7, 0x6A, 0xA1, 0xFF, 0xFF, 0xFF, 0x68, 0x40, 0x36, 0x00,
+	 0x20, 0x44, 0x20, 0xBC, 0x40, 0x40, 0x80, 0xE1, 0x64, 0x46, 0x01, 0x16, 0xFE, 0x01, 0x21, 0x69,
+	 0xA1, 0xFF, 0xFF, 0xFF, 0x68, 0x5E, 0x01, 0x16, 0xFE, 0x01, 0x22, 0x69, 0xA1, 0xFF, 0xFF, 0xFF,
+	 0x68, 0x5F, 0x26, 0xFA, 0x1C, 0xF2, 0x01, 0x16, 0xFE, 0x01, 0x3A, 0x69, 0xA1, 0xFF, 0xFF, 0xFF,
+	 0x68, 0x5F, 0x27, 0xFA, 0x1B, 0x00, 0x20, 0x44, 0x20, 0xBC, 0x40, 0x40, 0x43, 0x45, 0xBE, 0xD5,
+	 0xA4, 0xD2, 0x5A, 0x86, 0xEF, 0xA0, 0x11, 0x61, 0x01, 0x06, 0x60, 0x41, 0x1C, 0x60, 0x46, 0x63,
+	 0x80, 0xE1, 0xBD, 0xD3, 0x26, 0x42, 0x01, 0x16, 0xFE, 0x01, 0x60, 0x49, 0xA1, 0xFF, 0xFF, 0xFF,
+	 0x68, 0x44, 0xCD, 0x81, 0xA2, 0xDA, 0x5A, 0x86, 0xF4, 0x02, 0x25, 0x43, 0x21, 0xE1, 0x00, 0x64,
+	 0xBF, 0xDB, 0x20, 0x44, 0x20, 0x2A, 0x07, 0x00, 0x07, 0xB4, 0x04, 0x36, 0xC3, 0xFE, 0x06, 0x36,
+	 0xCC, 0xFE, 0x07, 0x36, 0xD5, 0xFE, 0x20, 0x44, 0xD8, 0xB4, 0x40, 0x40, 0x20, 0x44, 0x40, 0x2A,
+	 0x07, 0x00, 0x9F, 0xFE, 0x1E, 0x05, 0xBF, 0xB4, 0x40, 0x40, 0x85, 0xF7, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x1B, 0x60, 0xE6, 0x63, 0xBD, 0xD3, 0x02, 0x61, 0x17, 0x1B, 0x04, 0xA3, 0xBD, 0xD3, 0x02, 0x61,
+	 0x13, 0x1B, 0x04, 0xA3, 0xBD, 0xD3, 0x02, 0x61, 0x0F, 0x1B, 0x04, 0xA3, 0xBD, 0xD3, 0x04, 0x61,
+	 0x0B, 0x1B, 0x04, 0xA3, 0xBD, 0xD3, 0x06, 0x61, 0x07, 0x1B, 0x04, 0xA3, 0xBD, 0xD3, 0x07, 0x61,
+	 0x03, 0x1B, 0xC0, 0x60, 0x9A, 0x78, 0xFF, 0xFF, 0xA3, 0xD1, 0x40, 0x44, 0x20, 0x44, 0x07, 0xB5,
+	 0xD4, 0x85, 0x35, 0x80, 0x24, 0x45, 0x1C, 0x60, 0x22, 0x64, 0x44, 0xD7, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x80, 0xE1, 0x43, 0x45, 0x20, 0x44, 0x20, 0xBC, 0x40, 0x40, 0x64, 0x43, 0xBD, 0xD3, 0xBD, 0xD1,
+	 0x40, 0x44, 0x10, 0x27, 0x10, 0x00, 0xFF, 0x60, 0x7F, 0x65, 0x15, 0x60, 0xA2, 0x64, 0x24, 0x40,
+	 0x08, 0x2B, 0xA4, 0x84, 0xA0, 0x57, 0xFF, 0xFF, 0x64, 0x49, 0xFF, 0xFF, 0x68, 0x44, 0x01, 0x16,
+	 0xFD, 0x01, 0x00, 0x7F, 0xA3, 0xDB, 0xA1, 0x01, 0x80, 0xE1, 0x43, 0x45, 0x20, 0x44, 0x20, 0xBC,
+	 0x40, 0x40, 0x64, 0x43, 0xBD, 0xD3, 0xBD, 0xD1, 0x40, 0x44, 0x10, 0x2B, 0x11, 0x00, 0xA3, 0xD3,
+	 0xFF, 0xFF, 0x15, 0x60, 0x80, 0xE7, 0x24, 0x40, 0x07, 0x27, 0x02, 0x00, 0x50, 0xEC, 0x00, 0x00,
+	 0x60, 0x4A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x24, 0x40, 0x20, 0x2B, 0x40, 0xEC, 0x0F, 0x00,
+	 0x15, 0x60, 0x22, 0x64, 0x24, 0x40, 0x08, 0x27, 0x80, 0xBC, 0xA3, 0xD3, 0xA0, 0x57, 0x60, 0x48,
+	 0x64, 0x44, 0x80, 0xBC, 0xFF, 0xB4, 0x60, 0x4A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x75, 0x01,
+	 0xA2, 0xFF, 0x30, 0x44, 0x02, 0xA8, 0x00, 0xE1, 0x01, 0x02, 0xA1, 0xFF, 0x86, 0xFF, 0x88, 0xFF,
+	 0x5C, 0x46, 0x5C, 0x49, 0x5C, 0x40, 0xDE, 0x60, 0x58, 0x4F, 0xE2, 0x78, 0xFF, 0xFF, 0xCE, 0x60,
+	 0x58, 0x4F, 0x00, 0x78, 0xFF, 0xFF, 0xE7, 0x60, 0x58, 0x4F, 0xBE, 0x78, 0xFF, 0xFF, 0xDB, 0x60,
+	 0x58, 0x4F, 0x3B, 0x78, 0xFF, 0xFF, 0x13, 0xE1, 0xA3, 0xFF, 0xC7, 0x60, 0x2E, 0x78, 0xFF, 0xFF,
+	 0xDC, 0x60, 0x87, 0x78, 0xFF, 0xFF, 0x0F, 0x60, 0xCE, 0x62, 0xA2, 0xD1, 0x80, 0x60, 0x00, 0x64,
+	 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x22, 0x00, 0x75, 0xF3, 0x31, 0x40, 0x01, 0x2A, 0x1E, 0x00,
+	 0xDC, 0x84, 0x01, 0xB4, 0x75, 0xFB, 0x09, 0x02, 0x0F, 0x60, 0xD0, 0x62, 0xA2, 0xD1, 0x00, 0x60,
+	 0x04, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x11, 0x00, 0x0F, 0x60, 0xDC, 0x62, 0xA2, 0xD1,
+	 0x00, 0x60, 0x02, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x08, 0x00, 0xA9, 0xFE, 0xE4, 0x05,
+	 0xAB, 0xFE, 0x07, 0x05, 0xA8, 0xFE, 0xD4, 0x05, 0xAA, 0xFE, 0xD5, 0x05, 0xA1, 0xFF, 0xFF, 0xFF,
+	 0x85, 0x3E, 0x1B, 0x60, 0xC4, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0x00, 0xA8, 0x60, 0x46, 0x03, 0x02,
+	 0xC7, 0x60, 0x2E, 0x78, 0xFF, 0xFF, 0x26, 0x45, 0xD4, 0x80, 0x0F, 0xF0, 0xF9, 0x03, 0x64, 0x44,
+	 0x70, 0xB0, 0x70, 0x2A, 0x14, 0x00, 0x1F, 0x60, 0x18, 0x64, 0xA0, 0xD3, 0xFF, 0xFF, 0xDC, 0x84,
+	 0xFF, 0xFF, 0x08, 0x28, 0xA2, 0xDB, 0xA2, 0xFF, 0x8F, 0xF3, 0xFF, 0xFF, 0xCC, 0x84, 0xFE, 0xA0,
+	 0x8F, 0xFB, 0x01, 0x07, 0xD4, 0xFE, 0xA3, 0xFF, 0xCB, 0x60, 0xBC, 0x78, 0xFF, 0xFF, 0x64, 0x40,
+	 0x02, 0x26, 0x09, 0x00, 0x66, 0x45, 0x09, 0xF4, 0x0F, 0xF2, 0x02, 0x18, 0x65, 0x46, 0xE3, 0x1B,
+	 0x00, 0x64, 0x40, 0x46, 0xCB, 0x01, 0xA2, 0xFF, 0x8F, 0xF3, 0x46, 0x46, 0xCC, 0x84, 0xFE, 0xA0,
+	 0x8F, 0xFB, 0x01, 0x07, 0xD4, 0xFE, 0xA3, 0xFF, 0x0F, 0xF0, 0xA3, 0xFC, 0x64, 0x44, 0x80, 0x26,
+	 0x22, 0x00, 0x98, 0xF1, 0x1E, 0x60, 0xF8, 0x64, 0xA0, 0xD3, 0xFF, 0xFF, 0xDC, 0x84, 0xDC, 0x80,
+	 0xD0, 0x80, 0x04, 0x03, 0xA2, 0xDB, 0x08, 0x24, 0xC6, 0xFE, 0x04, 0x00, 0x8A, 0xFF, 0x20, 0x60,
+	 0x00, 0x75, 0x88, 0xFF, 0x32, 0x44, 0x01, 0x2A, 0x03, 0x00, 0x07, 0x60, 0x01, 0x64, 0x04, 0x00,
+	 0x02, 0x2A, 0x06, 0x00, 0x00, 0x60, 0x01, 0x64, 0x23, 0xFA, 0xCB, 0x60, 0xC8, 0x78, 0xFF, 0xFF,
+	 0xCB, 0x60, 0xBC, 0x78, 0xFF, 0xFF, 0x08, 0x26, 0x3F, 0x00, 0x2A, 0xF2, 0x60, 0x63, 0x60, 0x40,
+	 0x02, 0x2B, 0x66, 0x63, 0xBE, 0xD2, 0x69, 0xF1, 0xA3, 0xD2, 0xD0, 0x80, 0x68, 0xF1, 0x18, 0x02,
+	 0xBF, 0xD2, 0xD0, 0x80, 0x67, 0xF1, 0x14, 0x02, 0xD0, 0x80, 0xFF, 0xFF, 0x11, 0x02, 0x98, 0xF1,
+	 0x1F, 0x60, 0x04, 0x64, 0xA0, 0xD3, 0xFF, 0xFF, 0xDC, 0x84, 0xDC, 0x80, 0xD0, 0x80, 0x04, 0x03,
+	 0xA2, 0xDB, 0x08, 0x24, 0xC6, 0xFE, 0x04, 0x00, 0x8A, 0xFF, 0x20, 0x60, 0x00, 0x75, 0x88, 0xFF,
+	 0x32, 0x44, 0x01, 0x2A, 0x03, 0x00, 0x07, 0x60, 0x02, 0x64, 0x04, 0x00, 0x02, 0x2A, 0x06, 0x00,
+	 0x00, 0x60, 0x02, 0x64, 0x23, 0xFA, 0xCB, 0x60, 0xC8, 0x78, 0xFF, 0xFF, 0x2A, 0xF2, 0xFF, 0xFF,
+	 0x60, 0x40, 0xB0, 0x3A, 0x06, 0x00, 0x00, 0x60, 0x02, 0x64, 0x23, 0xFA, 0xC8, 0x60, 0x6D, 0x78,
+	 0xFF, 0xFF, 0xCB, 0x60, 0xBC, 0x78, 0xFF, 0xFF, 0x32, 0x44, 0x01, 0x2A, 0x4A, 0x00, 0x20, 0x60,
+	 0x6C, 0x63, 0xBF, 0xD3, 0x00, 0x65, 0xB4, 0x81, 0xDB, 0x83, 0x3D, 0x03, 0xBF, 0xD3, 0xA3, 0xD3,
+	 0x40, 0x48, 0xBE, 0xD3, 0x40, 0x4A, 0x2E, 0xF0, 0x40, 0x4C, 0xD0, 0x80, 0x2D, 0xF0, 0x08, 0x02,
+	 0x2A, 0x44, 0xD0, 0x80, 0x2C, 0xF0, 0x04, 0x02, 0x28, 0x44, 0xD0, 0x80, 0xFF, 0xFF, 0x2B, 0x03,
+	 0x31, 0xF0, 0x2C, 0x44, 0xD0, 0x80, 0x30, 0xF0, 0x08, 0x02, 0x2A, 0x44, 0xD0, 0x80, 0x2F, 0xF0,
+	 0x04, 0x02, 0x28, 0x44, 0xD0, 0x80, 0xFF, 0xFF, 0x1E, 0x03, 0x34, 0xF0, 0x2C, 0x44, 0xD0, 0x80,
+	 0x33, 0xF0, 0x08, 0x02, 0x2A, 0x44, 0xD0, 0x80, 0x32, 0xF0, 0x04, 0x02, 0x28, 0x44, 0xD0, 0x80,
+	 0xFF, 0xFF, 0x11, 0x03, 0x38, 0xF0, 0x2C, 0x44, 0xD0, 0x80, 0x37, 0xF0, 0x08, 0x02, 0x2A, 0x44,
+	 0xD0, 0x80, 0x36, 0xF0, 0x04, 0x02, 0x28, 0x44, 0xD0, 0x80, 0xFF, 0xFF, 0x04, 0x03, 0xFA, 0xA1,
+	 0x06, 0xA3, 0xB7, 0x03, 0xC3, 0x01, 0x07, 0x60, 0x00, 0x64, 0x23, 0xFA, 0xCB, 0x60, 0xC8, 0x78,
+	 0xFF, 0xFF, 0x2A, 0xF2, 0x0F, 0xF0, 0x60, 0x45, 0xA4, 0x36, 0x08, 0x00, 0x0C, 0xB4, 0x04, 0x36,
+	 0x02, 0x00, 0x0C, 0x3A, 0x06, 0x00, 0xCB, 0x60, 0xBC, 0x78, 0xFF, 0xFF, 0xC9, 0x60, 0x42, 0x78,
+	 0xFF, 0xFF, 0x26, 0xF2, 0x50, 0xF1, 0x60, 0x47, 0x00, 0x7E, 0xD0, 0x84, 0x1F, 0xA4, 0x06, 0x0E,
+	 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0x07, 0x00, 0xC2, 0xA4, 0xE8, 0x84,
+	 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x87, 0xF8, 0xBF, 0xC0, 0x84, 0xA2, 0xDB, 0x0F, 0xF0,
+	 0x65, 0x40, 0x40, 0x2B, 0x22, 0x00, 0x32, 0x40, 0x08, 0x26, 0x1F, 0x00, 0x07, 0xF4, 0x36, 0xF2,
+	 0xFF, 0xFF, 0x37, 0xB4, 0x26, 0x46, 0x19, 0x02, 0x2C, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x26,
+	 0x11, 0x00, 0x98, 0xF1, 0x1E, 0x60, 0xFE, 0x64, 0xA0, 0xD3, 0xFF, 0xFF, 0xDC, 0x84, 0xDC, 0x80,
+	 0xD0, 0x80, 0x04, 0x03, 0xA2, 0xDB, 0x08, 0x24, 0xC6, 0xFE, 0x04, 0x00, 0x8A, 0xFF, 0x20, 0x60,
+	 0x00, 0x75, 0x88, 0xFF, 0xCB, 0x60, 0xBC, 0x78, 0xFF, 0xFF, 0x2A, 0xF2, 0x64, 0x40, 0x60, 0x26,
+	 0x03, 0x00, 0xC9, 0x60, 0x1A, 0x78, 0xFF, 0xFF, 0x60, 0x40, 0x40, 0x3A, 0xF3, 0x01, 0x98, 0xF1,
+	 0x1E, 0x60, 0xF2, 0x64, 0xA0, 0xD3, 0xFF, 0xFF, 0xDC, 0x84, 0xDC, 0x80, 0xD0, 0x80, 0x04, 0x03,
+	 0xA2, 0xDB, 0x08, 0x24, 0xC6, 0xFE, 0x04, 0x00, 0x8A, 0xFF, 0x20, 0x60, 0x00, 0x75, 0x88, 0xFF,
+	 0x27, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x3B, 0x12, 0x00, 0x98, 0xF1, 0x1F, 0x60, 0x00, 0x64,
+	 0xA0, 0xD3, 0xFF, 0xFF, 0xDC, 0x84, 0xDC, 0x80, 0xD0, 0x80, 0x04, 0x03, 0xA2, 0xDB, 0x08, 0x24,
+	 0xC6, 0xFE, 0x04, 0x00, 0x8A, 0xFF, 0x20, 0x60, 0x00, 0x75, 0x88, 0xFF, 0x13, 0x00, 0x02, 0x3B,
+	 0x11, 0x00, 0x98, 0xF1, 0x1F, 0x60, 0x02, 0x64, 0xA0, 0xD3, 0xFF, 0xFF, 0xDC, 0x84, 0xDC, 0x80,
+	 0xD0, 0x80, 0x04, 0x03, 0xA2, 0xDB, 0x08, 0x24, 0xC6, 0xFE, 0x04, 0x00, 0x8A, 0xFF, 0x20, 0x60,
+	 0x00, 0x75, 0x88, 0xFF, 0x2A, 0xF2, 0x28, 0x41, 0x40, 0xA8, 0x01, 0xB1, 0x02, 0x02, 0x5F, 0x02,
+	 0x89, 0x00, 0x60, 0x40, 0x08, 0x2A, 0x2B, 0x00, 0x98, 0xF1, 0x1E, 0x60, 0xF0, 0x64, 0xA0, 0xD3,
+	 0xFF, 0xFF, 0xDC, 0x84, 0xDC, 0x80, 0xD0, 0x80, 0x04, 0x03, 0xA2, 0xDB, 0x08, 0x24, 0xC6, 0xFE,
+	 0x04, 0x00, 0x8A, 0xFF, 0x20, 0x60, 0x00, 0x75, 0x88, 0xFF, 0x1B, 0xF2, 0xFF, 0xFF, 0x60, 0x45,
+	 0x98, 0xF1, 0x1E, 0x60, 0xF6, 0x64, 0xA0, 0xD3, 0xFF, 0xFF, 0xD8, 0x80, 0xC4, 0x84, 0x0B, 0x03,
+	 0x07, 0x05, 0xDC, 0x80, 0xD0, 0x80, 0x04, 0x03, 0xA2, 0xDB, 0x09, 0x04, 0xC6, 0xFE, 0x07, 0x00,
+	 0x00, 0x64, 0xB8, 0x84, 0xA2, 0xDB, 0x8A, 0xFF, 0x20, 0x60, 0x00, 0x75, 0x88, 0xFF, 0x0F, 0xF2,
+	 0xFF, 0xFF, 0x60, 0x40, 0x40, 0x26, 0x28, 0x00, 0x32, 0x44, 0x02, 0x26, 0x25, 0x00, 0x10, 0x2B,
+	 0x26, 0x00, 0x20, 0x60, 0x6C, 0x63, 0xBF, 0xD3, 0x2C, 0xF0, 0x00, 0xA8, 0x60, 0x41, 0x0D, 0x03,
+	 0x50, 0xFE, 0xBD, 0xD3, 0x2D, 0xF0, 0xD0, 0x80, 0xBD, 0xD3, 0x2E, 0xF0, 0xD0, 0x80, 0xBD, 0xD3,
+	 0x2C, 0xF0, 0xD0, 0x80, 0xFA, 0xA1, 0x10, 0x0C, 0xF3, 0x02, 0x50, 0xFE, 0x60, 0x60, 0x01, 0x64,
+	 0xD0, 0x80, 0x2D, 0xF0, 0x1D, 0x64, 0xD0, 0x80, 0x2E, 0xF0, 0x01, 0x64, 0xD0, 0x80, 0xFF, 0xFF,
+	 0x03, 0x0C, 0xCB, 0x60, 0xBC, 0x78, 0xFF, 0xFF, 0x32, 0x40, 0x40, 0x2A, 0x00, 0x00, 0xCB, 0x60,
+	 0xB6, 0x78, 0xFF, 0xFF, 0x32, 0x40, 0x40, 0x26, 0xFA, 0x01, 0x2A, 0xF0, 0xFF, 0xFF, 0x64, 0x40,
+	 0x08, 0x2A, 0x20, 0x00, 0x32, 0x40, 0x02, 0x2A, 0x1D, 0x00, 0x03, 0x67, 0xA0, 0x84, 0x00, 0x37,
+	 0x64, 0x63, 0x60, 0x40, 0x02, 0x37, 0x5E, 0x63, 0x60, 0x40, 0x01, 0x37, 0x58, 0x63, 0x60, 0x40,
+	 0x03, 0x37, 0x0D, 0x00, 0xBD, 0xD2, 0x67, 0xF1, 0xBD, 0xD2, 0xD0, 0x80, 0x68, 0xF1, 0x07, 0x02,
+	 0xD0, 0x80, 0xBD, 0xD2, 0x69, 0xF1, 0x03, 0x02, 0xD0, 0x80, 0xFF, 0xFF, 0x03, 0x03, 0xCB, 0x60,
+	 0xBC, 0x78, 0xFF, 0xFF, 0x2A, 0xF2, 0x87, 0xF4, 0x60, 0x40, 0x03, 0x2B, 0x31, 0x00, 0x89, 0xF3,
+	 0x06, 0x61, 0x60, 0x43, 0x66, 0x45, 0x31, 0xF0, 0x63, 0x46, 0x05, 0xF2, 0x65, 0x46, 0xD0, 0x80,
+	 0x30, 0xF0, 0x0F, 0x02, 0x63, 0x46, 0x04, 0xF2, 0x65, 0x46, 0xD0, 0x80, 0x2F, 0xF0, 0x09, 0x02,
+	 0x63, 0x46, 0x03, 0xF2, 0x65, 0x46, 0xD0, 0x80, 0xFF, 0xFF, 0x03, 0x02, 0xFF, 0xFF, 0x48, 0xFE,
+	 0x06, 0x00, 0xCD, 0x81, 0x02, 0xA3, 0xE7, 0x02, 0x88, 0xF1, 0x08, 0xFE, 0x64, 0x43, 0x03, 0x03,
+	 0xCB, 0x60, 0xBC, 0x78, 0xFF, 0xFF, 0x43, 0x43, 0x23, 0x46, 0x06, 0xF0, 0x26, 0x46, 0x07, 0x67,
+	 0xA0, 0x84, 0x23, 0xFA, 0x64, 0x40, 0x02, 0x26, 0x2B, 0x00, 0xCB, 0x60, 0xBC, 0x78, 0xFF, 0xFF,
+	 0x26, 0x1B, 0x31, 0xF2, 0x12, 0x60, 0xCE, 0x65, 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD3,
+	 0x66, 0x41, 0x60, 0x46, 0x60, 0x43, 0x05, 0xF2, 0x16, 0x18, 0x61, 0x46, 0x31, 0xF0, 0x63, 0x46,
+	 0xD0, 0x80, 0x04, 0xF2, 0x0C, 0x02, 0x61, 0x46, 0x30, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x03, 0xF2,
+	 0x06, 0x02, 0x61, 0x46, 0x2F, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0xFF, 0xFF, 0x07, 0x03, 0x80, 0xF4,
+	 0xFF, 0xFF, 0x63, 0x46, 0xE8, 0x1B, 0x88, 0xF3, 0x08, 0xFE, 0x60, 0x43, 0x61, 0x46, 0x43, 0x43,
+	 0x07, 0xFC, 0x43, 0x43, 0x02, 0xFE, 0x1D, 0xF0, 0x12, 0x60, 0xC0, 0x62, 0xC0, 0x64, 0xC0, 0x84,
+	 0xA2, 0xD1, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xC0, 0x84, 0xA2, 0xDB,
+	 0x63, 0x45, 0x2A, 0xF2, 0x35, 0xF0, 0x60, 0x40, 0xA4, 0x36, 0x0B, 0x00, 0x08, 0x2B, 0x0C, 0x00,
+	 0x23, 0x46, 0x22, 0xF2, 0x26, 0x46, 0xD0, 0x80, 0xFF, 0xFF, 0x06, 0x02, 0xCB, 0x60, 0xBC, 0x78,
+	 0xFF, 0xFF, 0xCB, 0x60, 0xB6, 0x78, 0xFF, 0xFF, 0x23, 0x46, 0x1E, 0xF2, 0x26, 0x46, 0x44, 0x4C,
+	 0x0F, 0x26, 0x19, 0x00, 0x00, 0xBC, 0x40, 0x45, 0x0B, 0x03, 0x00, 0x64, 0x23, 0x46, 0x1E, 0xFA,
+	 0x26, 0x46, 0xA2, 0xFF, 0xB4, 0x60, 0x58, 0x4E, 0x48, 0x78, 0xFF, 0xFF, 0xA3, 0xFF, 0x26, 0x46,
+	 0x2A, 0xF0, 0x2C, 0x44, 0x64, 0x40, 0x04, 0x27, 0x06, 0x00, 0x23, 0x46, 0x22, 0xFA, 0x26, 0x46,
+	 0xCA, 0x60, 0xB6, 0x78, 0xFF, 0xFF, 0x3F, 0xF2, 0x02, 0xFA, 0xA2, 0xFF, 0x16, 0xF0, 0xFF, 0xFF,
+	 0x64, 0x44, 0x01, 0x26, 0xDC, 0x9C, 0x93, 0xF3, 0x2A, 0xF2, 0xDC, 0x83, 0x93, 0xFD, 0x06, 0xF4,
+	 0x01, 0xF8, 0x26, 0x46, 0x60, 0x40, 0x40, 0x2B, 0x18, 0x00, 0x64, 0x44, 0x00, 0x65, 0xFF, 0xB4,
+	 0xFC, 0xA4, 0x06, 0xF0, 0x03, 0x03, 0x64, 0x46, 0x0C, 0x0D, 0x02, 0x65, 0x26, 0x46, 0x00, 0xF2,
+	 0xFF, 0xFF, 0xD0, 0x80, 0xFF, 0xFF, 0x02, 0x03, 0x60, 0x46, 0xF9, 0x01, 0x01, 0xF2, 0xFF, 0xFF,
+	 0xD4, 0x84, 0x01, 0xFA, 0x66, 0x44, 0x26, 0x46, 0x06, 0xFA, 0x06, 0xF4, 0x00, 0xF2, 0x80, 0xFC,
+	 0x40, 0x45, 0xB4, 0x60, 0x58, 0x4E, 0x48, 0x78, 0xFF, 0xFF, 0xA3, 0xFF, 0x26, 0x46, 0x2C, 0x44,
+	 0x0F, 0x26, 0x10, 0x00, 0x23, 0x46, 0x22, 0xFA, 0x26, 0x44, 0x1E, 0xFA, 0x26, 0x46, 0x1B, 0x60,
+	 0xDA, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x26, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF,
+	 0x2B, 0xFF, 0x6F, 0x00, 0xA3, 0x46, 0x22, 0xF2, 0x60, 0x45, 0xDC, 0x84, 0xD4, 0x80, 0x22, 0xFA,
+	 0xA3, 0x46, 0x6C, 0x02, 0x2A, 0xF0, 0xA3, 0x46, 0x1E, 0xF2, 0xA3, 0x46, 0x00, 0xBC, 0x00, 0xF2,
+	 0x01, 0x02, 0x64, 0x00, 0x44, 0x4C, 0x3F, 0xF0, 0x60, 0x43, 0x23, 0x46, 0x1E, 0xF4, 0x09, 0x60,
+	 0x00, 0x65, 0x3F, 0xF2, 0x26, 0x46, 0xC0, 0x84, 0xD4, 0x80, 0x60, 0x45, 0x57, 0x07, 0x80, 0xFC,
+	 0x1B, 0xF2, 0x06, 0xF2, 0x60, 0x41, 0x23, 0x46, 0x1E, 0xF4, 0x1B, 0xF0, 0x06, 0xF0, 0xC1, 0x81,
+	 0x06, 0xFA, 0x05, 0xFA, 0x9B, 0xFA, 0x65, 0x44, 0x3F, 0xFA, 0x64, 0x46, 0x00, 0xFC, 0x63, 0x46,
+	 0x01, 0xF2, 0x10, 0x61, 0xF2, 0xA4, 0x01, 0xFA, 0xC8, 0x83, 0x02, 0x64, 0x59, 0xD0, 0x58, 0xD8,
+	 0xFD, 0x1F, 0x06, 0x45, 0x1B, 0x60, 0xDA, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x25, 0x44, 0x5A, 0xDB,
+	 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xA2, 0xFF, 0x00, 0xF4, 0x01, 0xF0, 0x0A, 0x18,
+	 0x70, 0x67, 0xA0, 0x80, 0xF0, 0x67, 0x06, 0x03, 0xC0, 0x84, 0x01, 0xFA, 0x25, 0x46, 0x25, 0x44,
+	 0x80, 0xFC, 0x05, 0xFA, 0xB4, 0x60, 0x58, 0x4E, 0x48, 0x78, 0xFF, 0xFF, 0xD4, 0xFE, 0xA3, 0xFF,
+	 0x2C, 0x44, 0x04, 0x27, 0x16, 0x00, 0x23, 0x46, 0x1E, 0xF2, 0x9E, 0xFC, 0x60, 0x46, 0x46, 0x46,
+	 0x3F, 0xF2, 0x00, 0xF4, 0x60, 0x47, 0x08, 0xFA, 0x26, 0x46, 0x2C, 0x43, 0x2A, 0xFC, 0x06, 0xF4,
+	 0x00, 0x64, 0x00, 0xFA, 0x01, 0xF0, 0x80, 0x60, 0x00, 0x64, 0xB0, 0x84, 0x01, 0xFA, 0x26, 0x46,
+	 0x1D, 0x00, 0x00, 0x66, 0x46, 0x46, 0xC7, 0x60, 0x31, 0x78, 0xFF, 0xFF, 0xA3, 0x46, 0x1E, 0xF0,
+	 0x9E, 0xFC, 0x00, 0x63, 0x33, 0x85, 0xA3, 0x46, 0x0D, 0x03, 0xA3, 0x46, 0x22, 0xF2, 0x0F, 0x65,
+	 0xA4, 0x85, 0xD4, 0x84, 0x22, 0xFA, 0xA3, 0x46, 0xA2, 0xFF, 0xB4, 0x60, 0x58, 0x4E, 0x48, 0x78,
+	 0xFF, 0xFF, 0xA3, 0xFF, 0x26, 0x46, 0xCB, 0x60, 0xBC, 0x78, 0xFF, 0xFF, 0x07, 0xF0, 0x88, 0xF3,
+	 0xFF, 0xFF, 0xD0, 0x80, 0x64, 0x46, 0x6F, 0xF2, 0x26, 0x46, 0x50, 0x03, 0x60, 0x40, 0x00, 0x36,
+	 0x4D, 0x00, 0x64, 0x46, 0x0E, 0xF2, 0x26, 0x46, 0x60, 0x47, 0xFF, 0xB5, 0x27, 0xF2, 0xFF, 0xFF,
+	 0xFF, 0xB4, 0xD4, 0x80, 0xFF, 0xFF, 0x42, 0x06, 0x64, 0x46, 0x6F, 0xF2, 0x26, 0x46, 0x60, 0x47,
+	 0xFF, 0xB5, 0x65, 0x41, 0x0F, 0x60, 0xA2, 0x65, 0x00, 0x64, 0xE9, 0x81, 0xD8, 0x84, 0xFD, 0x02,
+	 0xC8, 0x84, 0x60, 0x43, 0x44, 0xD1, 0xFF, 0xFF, 0x64, 0x47, 0xFF, 0xB5, 0x27, 0xF2, 0xFF, 0xFF,
+	 0xFF, 0xB4, 0xD4, 0x80, 0x64, 0x44, 0x06, 0x06, 0x07, 0xF0, 0xFF, 0xFF, 0x64, 0x46, 0x0E, 0xFA,
+	 0x26, 0x46, 0x19, 0x00, 0x00, 0x61, 0x27, 0xF0, 0x0F, 0x60, 0xA2, 0x65, 0x61, 0x43, 0x45, 0xD3,
+	 0x64, 0x41, 0xFF, 0xB1, 0x61, 0x45, 0x60, 0x47, 0xFF, 0xB4, 0xDB, 0x83, 0xD4, 0x80, 0x63, 0x41,
+	 0xF3, 0x02, 0xCB, 0x83, 0x63, 0x41, 0x0F, 0x60, 0xA2, 0x65, 0x45, 0xD3, 0x07, 0xF0, 0xFF, 0xFF,
+	 0x64, 0x46, 0x0E, 0xFA, 0x26, 0x46, 0xAF, 0x84, 0xE8, 0x81, 0x05, 0x03, 0x00, 0x60, 0x01, 0x64,
+	 0xCD, 0x81, 0xE0, 0x84, 0xFD, 0x02, 0x64, 0x46, 0x70, 0xFA, 0x26, 0x46, 0x2A, 0xF2, 0x32, 0xF0,
+	 0x60, 0x40, 0x08, 0x2A, 0x5C, 0x00, 0x01, 0x2B, 0x2F, 0x00, 0x64, 0x40, 0x01, 0x2A, 0x2C, 0x00,
+	 0x98, 0xF1, 0x1E, 0x60, 0xF0, 0x64, 0xA0, 0xD3, 0xFF, 0xFF, 0xDC, 0x84, 0xDC, 0x80, 0xD0, 0x80,
+	 0x04, 0x03, 0xA2, 0xDB, 0x08, 0x24, 0xC6, 0xFE, 0x04, 0x00, 0x8A, 0xFF, 0x20, 0x60, 0x00, 0x75,
+	 0x88, 0xFF, 0x1B, 0xF2, 0xFF, 0xFF, 0x60, 0x45, 0x98, 0xF1, 0x1E, 0x60, 0xF6, 0x64, 0xA0, 0xD3,
+	 0xFF, 0xFF, 0xD8, 0x80, 0xC4, 0x84, 0x0B, 0x03, 0x07, 0x05, 0xDC, 0x80, 0xD0, 0x80, 0x04, 0x03,
+	 0xA2, 0xDB, 0x09, 0x04, 0xC6, 0xFE, 0x07, 0x00, 0x00, 0x64, 0xB8, 0x84, 0xA2, 0xDB, 0x8A, 0xFF,
+	 0x20, 0x60, 0x00, 0x75, 0x88, 0xFF, 0x2B, 0x00, 0x98, 0xF1, 0x1E, 0x60, 0xEE, 0x64, 0xA0, 0xD3,
+	 0xFF, 0xFF, 0xDC, 0x84, 0xDC, 0x80, 0xD0, 0x80, 0x04, 0x03, 0xA2, 0xDB, 0x08, 0x24, 0xC6, 0xFE,
+	 0x04, 0x00, 0x8A, 0xFF, 0x20, 0x60, 0x00, 0x75, 0x88, 0xFF, 0x1B, 0xF2, 0xFF, 0xFF, 0x60, 0x45,
+	 0x98, 0xF1, 0x1E, 0x60, 0xF4, 0x64, 0xA0, 0xD3, 0xFF, 0xFF, 0xD8, 0x80, 0xC4, 0x84, 0x0B, 0x03,
+	 0x07, 0x05, 0xDC, 0x80, 0xD0, 0x80, 0x04, 0x03, 0xA2, 0xDB, 0x09, 0x04, 0xC6, 0xFE, 0x07, 0x00,
+	 0x00, 0x64, 0xB8, 0x84, 0xA2, 0xDB, 0x8A, 0xFF, 0x20, 0x60, 0x00, 0x75, 0x88, 0xFF, 0x07, 0xF4,
+	 0xFF, 0xFF, 0x22, 0xF2, 0x26, 0x46, 0x0F, 0xB4, 0xDC, 0x85, 0x98, 0xF1, 0x1E, 0x60, 0xF2, 0x64,
+	 0xA0, 0xD3, 0xFF, 0xFF, 0xD8, 0x80, 0xC4, 0x84, 0x0B, 0x03, 0x07, 0x05, 0xDC, 0x80, 0xD0, 0x80,
+	 0x04, 0x03, 0xA2, 0xDB, 0x09, 0x04, 0xC6, 0xFE, 0x07, 0x00, 0x00, 0x64, 0xB8, 0x84, 0xA2, 0xDB,
+	 0x8A, 0xFF, 0x20, 0x60, 0x00, 0x75, 0x88, 0xFF, 0x27, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x3B,
+	 0x12, 0x00, 0x98, 0xF1, 0x1F, 0x60, 0x00, 0x64, 0xA0, 0xD3, 0xFF, 0xFF, 0xDC, 0x84, 0xDC, 0x80,
+	 0xD0, 0x80, 0x04, 0x03, 0xA2, 0xDB, 0x08, 0x24, 0xC6, 0xFE, 0x04, 0x00, 0x8A, 0xFF, 0x20, 0x60,
+	 0x00, 0x75, 0x88, 0xFF, 0x13, 0x00, 0x02, 0x3B, 0x11, 0x00, 0x98, 0xF1, 0x1F, 0x60, 0x02, 0x64,
+	 0xA0, 0xD3, 0xFF, 0xFF, 0xDC, 0x84, 0xDC, 0x80, 0xD0, 0x80, 0x04, 0x03, 0xA2, 0xDB, 0x08, 0x24,
+	 0xC6, 0xFE, 0x04, 0x00, 0x8A, 0xFF, 0x20, 0x60, 0x00, 0x75, 0x88, 0xFF, 0xCC, 0x60, 0x06, 0x78,
+	 0xFF, 0xFF, 0xC7, 0x60, 0x31, 0x78, 0xFF, 0xFF, 0x1B, 0x60, 0xDA, 0x64, 0x40, 0x4B, 0xF0, 0x60,
+	 0x58, 0x4D, 0x75, 0x78, 0xFF, 0xFF, 0x00, 0x66, 0x46, 0x46, 0xC7, 0x60, 0x31, 0x78, 0xFF, 0xFF,
+	 0x1B, 0x60, 0xDA, 0x62, 0x1B, 0x60, 0xBE, 0x64, 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64,
+	 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xF8, 0xFE, 0x00, 0x66, 0x46, 0x46, 0xC7, 0x60, 0x31, 0x78,
+	 0xFF, 0xFF, 0x2A, 0xF2, 0x58, 0x63, 0x60, 0x47, 0x01, 0x27, 0x64, 0x63, 0x25, 0x60, 0x26, 0x62,
+	 0x61, 0x5C, 0xA2, 0xD9, 0xBD, 0xD0, 0xBD, 0xD0, 0x64, 0x45, 0x64, 0x41, 0xBD, 0xD0, 0x00, 0xF4,
+	 0x04, 0xF8, 0x83, 0xFA, 0x82, 0xF8, 0xA6, 0x46, 0x02, 0xB0, 0x5E, 0x63, 0x04, 0x03, 0x64, 0x63,
+	 0x03, 0xB0, 0x02, 0x3A, 0x6C, 0x63, 0x3F, 0xF2, 0xBD, 0xD0, 0xBD, 0xD0, 0x64, 0x45, 0x64, 0x41,
+	 0xBD, 0xD0, 0xA6, 0x46, 0x07, 0xF8, 0x86, 0xFA, 0x85, 0xF8, 0x60, 0x47, 0x08, 0xFA, 0x25, 0x60,
+	 0x26, 0x62, 0xA2, 0xD1, 0x26, 0x46, 0x64, 0x41, 0x2F, 0x58, 0xFF, 0xFF, 0x2A, 0xF2, 0x2C, 0xF0,
+	 0x31, 0x40, 0x20, 0x26, 0x09, 0x00, 0x60, 0x40, 0xA4, 0x36, 0x21, 0x00, 0x08, 0x26, 0x07, 0x00,
+	 0x7E, 0xF1, 0xCC, 0x60, 0xCF, 0x78, 0xFF, 0xFF, 0xCC, 0x60, 0xFF, 0x78, 0xFF, 0xFF, 0x64, 0x40,
+	 0x01, 0x26, 0x12, 0x00, 0x3F, 0xF0, 0x32, 0x40, 0x10, 0x2A, 0x0A, 0x00, 0x64, 0x41, 0x60, 0x40,
+	 0x40, 0x27, 0x06, 0x00, 0xCD, 0x81, 0xDD, 0x81, 0x03, 0x03, 0x02, 0x03, 0x01, 0x61, 0x01, 0x00,
+	 0x00, 0x61, 0x60, 0x40, 0x18, 0x3A, 0x03, 0x00, 0xCD, 0x60, 0x3B, 0x78, 0xFF, 0xFF, 0x07, 0xF2,
+	 0x88, 0xF1, 0x66, 0x45, 0xD0, 0x80, 0x60, 0x46, 0x06, 0xF2, 0x65, 0x46, 0x03, 0x03, 0xFF, 0xFF,
+	 0x02, 0x26, 0x07, 0x00, 0xDA, 0x60, 0x58, 0x4F, 0xDB, 0x78, 0xFF, 0xFF, 0xCD, 0x60, 0x37, 0x78,
+	 0xFF, 0xFF, 0x2A, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0xA4, 0x3A, 0x07, 0x00, 0xDD, 0x60, 0x58, 0x4F,
+	 0x45, 0x78, 0xFF, 0xFF, 0xCD, 0x60, 0x37, 0x78, 0xFF, 0xFF, 0x26, 0x46, 0xCB, 0x60, 0x58, 0x4F,
+	 0xD9, 0x78, 0xFF, 0xFF, 0x3F, 0xF2, 0x06, 0x65, 0xD4, 0x80, 0x60, 0x43, 0x52, 0x04, 0x00, 0xF4,
+	 0xAA, 0x60, 0xAA, 0x65, 0x09, 0xF2, 0x0A, 0xF0, 0xD4, 0x80, 0x03, 0x64, 0x4A, 0x02, 0xD0, 0x80,
+	 0x00, 0x64, 0x0B, 0xF0, 0x46, 0x02, 0x64, 0x45, 0xD4, 0x80, 0xF8, 0x7F, 0x08, 0x02, 0x0C, 0xF0,
+	 0x26, 0x46, 0x64, 0x45, 0x23, 0xF0, 0x20, 0x67, 0xB0, 0x84, 0xA2, 0xDA, 0x0B, 0x00, 0xD4, 0x80,
+	 0x1D, 0x60, 0x60, 0x64, 0x11, 0x02, 0x0C, 0xF0, 0x26, 0x46, 0x64, 0x45, 0x23, 0xF0, 0x40, 0x67,
+	 0xB0, 0x84, 0xA2, 0xDA, 0x65, 0x44, 0x88, 0x3A, 0x2C, 0x00, 0x77, 0x37, 0x03, 0x00, 0x78, 0x37,
+	 0x01, 0x00, 0x8E, 0x37, 0x00, 0x61, 0x25, 0x00, 0xD4, 0x80, 0x08, 0x65, 0x22, 0x02, 0xD7, 0x80,
+	 0x01, 0x60, 0x00, 0x64, 0x0C, 0xF0, 0x1D, 0x04, 0xD0, 0x80, 0x0D, 0xF0, 0x1A, 0x02, 0x26, 0x46,
+	 0x14, 0xF2, 0x01, 0x63, 0x02, 0xA8, 0x64, 0x47, 0x14, 0x03, 0x7F, 0xB4, 0xFD, 0xA0, 0x06, 0x03,
+	 0x10, 0x07, 0x23, 0xF0, 0x60, 0x67, 0xB0, 0x84, 0xA2, 0xDA, 0x6A, 0x00, 0xD2, 0xF3, 0xFF, 0xFF,
+	 0x02, 0xBC, 0xD2, 0xFB, 0xE5, 0x60, 0x58, 0x4F, 0x94, 0x78, 0xFF, 0xFF, 0xCD, 0x60, 0x37, 0x78,
+	 0xFF, 0xFF, 0x26, 0x46, 0x61, 0x40, 0x01, 0x2A, 0x12, 0x00, 0x98, 0xF1, 0x1F, 0x60, 0x06, 0x64,
+	 0xA0, 0xD3, 0xFF, 0xFF, 0xDC, 0x84, 0xDC, 0x80, 0xD0, 0x80, 0x04, 0x03, 0xA2, 0xDB, 0x08, 0x24,
+	 0xC6, 0xFE, 0x04, 0x00, 0x8A, 0xFF, 0x20, 0x60, 0x00, 0x75, 0x88, 0xFF, 0x7C, 0x00, 0xDD, 0x60,
+	 0x58, 0x4F, 0x45, 0x78, 0xFF, 0xFF, 0x2A, 0xF2, 0xFF, 0xFF, 0xFF, 0xFF, 0x48, 0x36, 0x73, 0x00,
+	 0xCD, 0x60, 0x58, 0x4F, 0x48, 0x78, 0xFF, 0xFF, 0xCD, 0x60, 0x37, 0x78, 0xFF, 0xFF, 0x60, 0x40,
+	 0x0C, 0x26, 0x69, 0x00, 0x64, 0x40, 0x01, 0x2A, 0x66, 0x00, 0xB0, 0x3A, 0x05, 0x00, 0xD1, 0x60,
+	 0x58, 0x4F, 0x80, 0x78, 0xFF, 0xFF, 0x5B, 0x00, 0x00, 0x3A, 0x05, 0x00, 0xD4, 0x60, 0x58, 0x4F,
+	 0xF3, 0x78, 0xFF, 0xFF, 0x54, 0x00, 0x20, 0x3A, 0x05, 0x00, 0xD4, 0x60, 0x58, 0x4F, 0xF3, 0x78,
+	 0xFF, 0xFF, 0x4D, 0x00, 0xC0, 0x3A, 0x05, 0x00, 0xDA, 0x60, 0x58, 0x4F, 0x48, 0x78, 0xFF, 0xFF,
+	 0x46, 0x00, 0xA0, 0x3A, 0x05, 0x00, 0xDA, 0x60, 0x58, 0x4F, 0xA6, 0x78, 0xFF, 0xFF, 0x3F, 0x00,
+	 0x40, 0x3A, 0x0D, 0x00, 0xE1, 0x60, 0x58, 0x4F, 0x10, 0x78, 0xFF, 0xFF, 0x38, 0x00, 0x60, 0x40,
+	 0x50, 0x3A, 0x05, 0x00, 0xEA, 0x60, 0x58, 0x4F, 0xF5, 0x78, 0xFF, 0xFF, 0x30, 0x00, 0x33, 0x00,
+	 0xD2, 0xF3, 0xFF, 0xFF, 0x02, 0xBC, 0xD2, 0xFB, 0x2A, 0xF2, 0x3B, 0xF0, 0x60, 0x40, 0x40, 0x2B,
+	 0x19, 0x00, 0x22, 0xF2, 0xFF, 0xFF, 0x04, 0xB4, 0xFF, 0xFF, 0x14, 0x03, 0xC0, 0x60, 0x00, 0x64,
+	 0x64, 0x40, 0x20, 0x2B, 0x0F, 0x00, 0xA0, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0x23, 0xF2,
+	 0x10, 0xBD, 0xB4, 0x9C, 0x3F, 0xF2, 0x23, 0xF8, 0xF8, 0xA4, 0x3F, 0xFA, 0x00, 0xF4, 0x60, 0x47,
+	 0x08, 0xFA, 0x26, 0x46, 0x1B, 0x60, 0xDA, 0x62, 0x1B, 0x60, 0xBE, 0x64, 0xA2, 0xDB, 0x26, 0x44,
+	 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xF8, 0xFE, 0x0C, 0x00, 0x66, 0x44,
+	 0x00, 0xA8, 0xFF, 0xFF, 0x0A, 0x03, 0x26, 0x46, 0x1B, 0x60, 0xDA, 0x64, 0x40, 0x4B, 0xF0, 0x60,
+	 0x58, 0x4D, 0x75, 0x78, 0xFF, 0xFF, 0x00, 0x66, 0x46, 0x46, 0xCB, 0x60, 0xB9, 0x78, 0xFF, 0xFF,
+	 0x14, 0xF2, 0x00, 0x7C, 0x3E, 0xF8, 0xCC, 0x84, 0xCC, 0x84, 0x19, 0x03, 0x60, 0x02, 0x11, 0xF2,
+	 0x07, 0xFA, 0xAC, 0xF3, 0x19, 0xFA, 0xCD, 0x60, 0x58, 0x4E, 0xE4, 0x78, 0xFF, 0xFF, 0x1B, 0x60,
+	 0xDA, 0x62, 0x1B, 0x60, 0x9A, 0x64, 0xA2, 0xDB, 0x26, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB,
+	 0xFF, 0xFF, 0x2B, 0xFF, 0xC8, 0xFE, 0xF2, 0x64, 0x3B, 0x42, 0x4A, 0xDB, 0x79, 0x00, 0xA2, 0xFF,
+	 0x46, 0x45, 0xB4, 0x60, 0x58, 0x4E, 0x91, 0x78, 0xFF, 0xFF, 0xA3, 0xFF, 0x11, 0x03, 0x7E, 0x63,
+	 0x46, 0x4B, 0x25, 0x46, 0xA3, 0xD0, 0x2B, 0x46, 0xA3, 0xD8, 0xFB, 0x1F, 0x89, 0xFC, 0x8A, 0xFC,
+	 0x88, 0xFC, 0x05, 0x18, 0x64, 0x46, 0x01, 0xF0, 0x10, 0x67, 0xC0, 0x84, 0x01, 0xFA, 0x08, 0xFE,
+	 0x2B, 0x46, 0x46, 0x46, 0x25, 0x46, 0xCD, 0x60, 0x58, 0x4E, 0xE4, 0x78, 0xFF, 0xFF, 0x1F, 0x60,
+	 0x8E, 0x62, 0xA2, 0xD3, 0x88, 0xF3, 0x00, 0xA8, 0x07, 0xFA, 0x0F, 0x03, 0x1B, 0x60, 0xDA, 0x62,
+	 0x1B, 0x60, 0x94, 0x64, 0xA2, 0xDB, 0x25, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF,
+	 0x2B, 0xFF, 0xF3, 0x64, 0x3B, 0x42, 0x4A, 0xDB, 0x0E, 0x00, 0x1B, 0x60, 0xDA, 0x62, 0x1B, 0x60,
+	 0x88, 0x64, 0xA2, 0xDB, 0x25, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF,
+	 0xF4, 0x64, 0x3B, 0x42, 0x4A, 0xDB, 0x26, 0x44, 0x00, 0xA8, 0xC1, 0xFE, 0x31, 0x03, 0xD2, 0xF3,
+	 0xFF, 0xFF, 0x02, 0xBC, 0xD2, 0xFB, 0x26, 0x46, 0x2A, 0xF2, 0x3B, 0xF0, 0x60, 0x40, 0x40, 0x2B,
+	 0x18, 0x00, 0x64, 0x40, 0x20, 0x2B, 0x15, 0x00, 0x22, 0xF2, 0xFF, 0xFF, 0x04, 0xB4, 0xFF, 0xFF,
+	 0x10, 0x03, 0xC0, 0x67, 0xA0, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0x23, 0xF2, 0x10, 0xBD,
+	 0xB4, 0x9C, 0x3F, 0xF2, 0x23, 0xF8, 0xF8, 0xA4, 0x3F, 0xFA, 0x00, 0xF4, 0x60, 0x47, 0x08, 0xFA,
+	 0x26, 0x46, 0x1B, 0x60, 0xDA, 0x62, 0x1B, 0x60, 0xBE, 0x64, 0xA2, 0xDB, 0x26, 0x44, 0x5A, 0xDB,
+	 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xF8, 0xFE, 0xF1, 0x64, 0x3B, 0x42, 0x4A, 0xDB,
+	 0x00, 0x66, 0x46, 0x46, 0x2F, 0x58, 0xFF, 0xFF, 0x2A, 0xF2, 0x82, 0x60, 0xFF, 0x65, 0xA4, 0x87,
+	 0x02, 0xBF, 0x2A, 0xFA, 0x1C, 0xF2, 0x13, 0xFA, 0x32, 0xF2, 0x2C, 0xFA, 0x33, 0xF2, 0x2D, 0xFA,
+	 0x34, 0xF2, 0x2E, 0xFA, 0x2F, 0xF2, 0x32, 0xFA, 0x30, 0xF2, 0x33, 0xFA, 0x31, 0xF2, 0x34, 0xFA,
+	 0x67, 0xF3, 0x2F, 0xFA, 0x68, 0xF3, 0x30, 0xFA, 0x69, 0xF3, 0x31, 0xFA, 0x2E, 0x58, 0xFF, 0xFF,
+	 0x0F, 0x60, 0xF8, 0x62, 0xD0, 0x60, 0x7B, 0x64, 0xA2, 0xDB, 0x2F, 0x58, 0xFF, 0xFF, 0x1F, 0x60,
+	 0x62, 0x63, 0x20, 0x60, 0x02, 0x62, 0xA2, 0xD3, 0xA3, 0xDB, 0x1E, 0x63, 0x1F, 0x60, 0x6C, 0x61,
+	 0x20, 0x60, 0x0C, 0x64, 0x58, 0xD1, 0x59, 0xD9, 0xFD, 0x1F, 0x1F, 0x60, 0x8E, 0x63, 0x20, 0x60,
+	 0x2E, 0x62, 0xA2, 0xD3, 0xA3, 0xDB, 0x1F, 0x60, 0x90, 0x63, 0x20, 0x60, 0x30, 0x62, 0xA2, 0xD3,
+	 0xA3, 0xDB, 0x1F, 0x60, 0x9A, 0x63, 0x20, 0x60, 0x3A, 0x62, 0xA2, 0xD3, 0xA3, 0xDB, 0x1F, 0x60,
+	 0x9C, 0x63, 0x20, 0x60, 0x3C, 0x62, 0xA2, 0xD3, 0xA3, 0xDB, 0x1F, 0x60, 0x9E, 0x63, 0x20, 0x60,
+	 0x3E, 0x62, 0xA2, 0xD3, 0xA3, 0xDB, 0x1F, 0x60, 0xA0, 0x63, 0x20, 0x60, 0x40, 0x62, 0xA2, 0xD3,
+	 0xA3, 0xDB, 0x1F, 0x60, 0x92, 0x63, 0x20, 0x60, 0x32, 0x62, 0xA2, 0xD3, 0xA3, 0xDB, 0x1F, 0x60,
+	 0x94, 0x63, 0x20, 0x60, 0x34, 0x62, 0xA2, 0xD3, 0xA3, 0xDB, 0x1F, 0x60, 0x96, 0x63, 0x20, 0x60,
+	 0x36, 0x62, 0xA2, 0xD3, 0xA3, 0xDB, 0x1F, 0x60, 0xB6, 0x63, 0xBD, 0xD1, 0xCB, 0xF9, 0x67, 0xF9,
+	 0xBD, 0xD1, 0xCC, 0xF9, 0x68, 0xF9, 0xA3, 0xD1, 0xCD, 0xF9, 0x69, 0xF9, 0x01, 0x64, 0x6B, 0xFB,
+	 0x1F, 0x60, 0xA8, 0x62, 0xA2, 0xD3, 0xC4, 0xFB, 0x00, 0x63, 0x4A, 0xFD, 0x5A, 0xFD, 0x6C, 0xFD,
+	 0x6D, 0xFD, 0x21, 0x60, 0x82, 0x64, 0xA0, 0xD3, 0xEA, 0x60, 0x58, 0x4E, 0x78, 0x78, 0xFF, 0xFF,
+	 0x21, 0x60, 0x80, 0x64, 0xA0, 0xD1, 0x1F, 0x60, 0x92, 0x62, 0xA2, 0xD3, 0xFF, 0x60, 0xE7, 0x65,
+	 0x32, 0x41, 0xA5, 0x81, 0xFF, 0xA0, 0xFF, 0xFF, 0x01, 0x03, 0x0B, 0x00, 0x08, 0x65, 0xB5, 0x81,
+	 0x1F, 0x60, 0x96, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x2A, 0x02, 0x00, 0x10, 0x65,
+	 0xB5, 0x81, 0x41, 0x52, 0x88, 0xF5, 0x32, 0x44, 0x10, 0xB0, 0xFF, 0xFF, 0x0B, 0x03, 0x21, 0x60,
+	 0x2C, 0x62, 0xA2, 0xD3, 0x06, 0xF0, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0x80, 0xBF,
+	 0xB0, 0x84, 0x06, 0xFA, 0x1F, 0x60, 0x92, 0x62, 0xA2, 0xD3, 0x22, 0x7C, 0xFF, 0xA0, 0xFD, 0xA0,
+	 0x05, 0x06, 0x03, 0x03, 0xFE, 0xA0, 0x04, 0x7C, 0x01, 0x02, 0x36, 0xF8, 0x0E, 0xF0, 0x0F, 0x60,
+	 0xA2, 0x65, 0x20, 0x60, 0x38, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0xFE, 0xA0, 0x03, 0xA8, 0x11, 0x06,
+	 0x5F, 0xF1, 0x06, 0x02, 0x64, 0x44, 0x08, 0x2A, 0x09, 0x00, 0x06, 0x64, 0x44, 0xD3, 0x0D, 0x00,
+	 0x64, 0x44, 0x20, 0x2A, 0x03, 0x00, 0x0A, 0x64, 0x44, 0xD3, 0x07, 0x00, 0x01, 0x64, 0x44, 0xD3,
+	 0x04, 0x00, 0xE8, 0x84, 0xE0, 0x84, 0x44, 0xD3, 0x00, 0x00, 0x0E, 0xFA, 0x1F, 0x60, 0x9E, 0x62,
+	 0xA2, 0xD1, 0x20, 0x44, 0x20, 0xB5, 0x64, 0x41, 0x00, 0xB9, 0xD4, 0x84, 0x08, 0x28, 0x20, 0xBC,
+	 0x40, 0x40, 0x11, 0x60, 0xF0, 0x61, 0xA1, 0xD3, 0xFF, 0xFF, 0x00, 0xB8, 0x10, 0x60, 0x0C, 0x65,
+	 0x0D, 0x03, 0x11, 0x60, 0xF8, 0x63, 0xC5, 0xF3, 0xA3, 0xD1, 0xE0, 0x84, 0xC4, 0x84, 0xA0, 0xD3,
+	 0xFF, 0xFF, 0x01, 0xB0, 0xFF, 0xFF, 0x02, 0x02, 0xC5, 0xF9, 0x65, 0xF9, 0xC5, 0xF3, 0x01, 0x61,
+	 0xCC, 0x84, 0xFF, 0xFF, 0x02, 0x03, 0xE1, 0x81, 0xFB, 0x01, 0x9A, 0xF3, 0x61, 0x45, 0xA4, 0x80,
+	 0xFF, 0xFF, 0x0B, 0x02, 0x00, 0xB8, 0x01, 0x63, 0x08, 0x03, 0xE8, 0x84, 0xFF, 0xFF, 0x02, 0x24,
+	 0x02, 0x00, 0xDF, 0x83, 0xFA, 0x01, 0xC5, 0xFD, 0x65, 0xFD, 0x0A, 0x64, 0x25, 0x60, 0x1E, 0x63,
+	 0xA3, 0xDB, 0x01, 0x64, 0x25, 0x60, 0x20, 0x63, 0xA3, 0xDB, 0xB6, 0xF1, 0x09, 0x60, 0x2A, 0x64,
+	 0xD0, 0x80, 0x03, 0x64, 0x01, 0x06, 0x06, 0x64, 0xB0, 0xFB, 0x0F, 0x60, 0xD6, 0x62, 0x00, 0x64,
+	 0xA2, 0xDB, 0xDE, 0xFE, 0x0B, 0x04, 0x0F, 0x60, 0xD8, 0x62, 0x40, 0x60, 0x00, 0x64, 0xA2, 0xDB,
+	 0xCF, 0x60, 0x05, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60, 0xD6, 0x62,
+	 0x00, 0x64, 0xA2, 0xDB, 0x65, 0xF1, 0x1C, 0x60, 0x00, 0x62, 0xA2, 0xD9, 0x08, 0x64, 0x4A, 0xDB,
+	 0xFF, 0xFF, 0x2D, 0xFF, 0x0F, 0x60, 0xD8, 0x62, 0x20, 0x60, 0x00, 0x64, 0xA2, 0xDB, 0xCF, 0x60,
+	 0x2D, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60, 0xD6, 0x62, 0x00, 0x64,
+	 0xA2, 0xDB, 0xBE, 0xFE, 0x0F, 0x60, 0xCE, 0x62, 0xA2, 0xD1, 0x40, 0x60, 0x00, 0x64, 0xB0, 0x84,
+	 0xA2, 0xDB, 0xCF, 0xFE, 0x20, 0x44, 0x01, 0x65, 0x34, 0x80, 0x1F, 0x60, 0xA6, 0x64, 0xA0, 0xD3,
+	 0xC3, 0xFB, 0x60, 0x40, 0x05, 0x3A, 0x03, 0x00, 0xEB, 0x60, 0x1A, 0x61, 0x11, 0x00, 0x04, 0x3A,
+	 0x03, 0x00, 0xEB, 0x60, 0x0E, 0x61, 0x0C, 0x00, 0x03, 0x3A, 0x03, 0x00, 0xEB, 0x60, 0x02, 0x61,
+	 0x07, 0x00, 0x02, 0x3A, 0x03, 0x00, 0xEA, 0x60, 0xF6, 0x61, 0x02, 0x00, 0xEA, 0x60, 0xEA, 0x61,
+	 0x3E, 0x60, 0x00, 0x66, 0x01, 0x60, 0x78, 0x64, 0x0A, 0x63, 0x59, 0xD0, 0x58, 0xD9, 0xFD, 0x1F,
+	 0x00, 0x66, 0xC4, 0xF3, 0x60, 0x41, 0x00, 0xA8, 0xFA, 0xA1, 0x01, 0x03, 0xA1, 0xDB, 0x01, 0x60,
+	 0x7A, 0x63, 0x16, 0x60, 0xC4, 0x61, 0xBD, 0xD3, 0xFF, 0xFF, 0x20, 0x7F, 0xA1, 0xDB, 0xBD, 0xD3,
+	 0xFF, 0xFF, 0x21, 0x7F, 0x59, 0xDB, 0xA3, 0xD3, 0xFF, 0xFF, 0x22, 0x7F, 0x59, 0xDB, 0x0F, 0x60,
+	 0xD6, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0xDE, 0xFE, 0x0B, 0x04, 0x0F, 0x60, 0xD8, 0x62, 0x40, 0x60,
+	 0x00, 0x64, 0xA2, 0xDB, 0xCF, 0x60, 0x77, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x1C, 0x60, 0x00, 0x62, 0x16, 0x60, 0xC2, 0x64, 0xA2, 0xDB, 0x20, 0x64, 0x4A, 0xDB, 0xFF, 0xFF,
+	 0x2D, 0xFF, 0x0F, 0x60, 0xD8, 0x62, 0x20, 0x60, 0x00, 0x64, 0xA2, 0xDB, 0xCF, 0x60, 0x9C, 0x64,
+	 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60, 0xD6, 0x62, 0x00, 0x64, 0xA2, 0xDB,
+	 0x65, 0xF1, 0x1C, 0x60, 0x00, 0x62, 0xA2, 0xD9, 0x08, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x2D, 0xFF,
+	 0x0F, 0x60, 0xD8, 0x62, 0x20, 0x60, 0x00, 0x64, 0xA2, 0xDB, 0xCF, 0x60, 0xB3, 0x64, 0x5A, 0xDB,
+	 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60, 0xD6, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0xBE, 0xFE,
+	 0x0F, 0x60, 0xCE, 0x62, 0xA2, 0xD1, 0x40, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE,
+	 0x20, 0x40, 0x20, 0x2A, 0x04, 0x00, 0xEB, 0x60, 0x58, 0x4E, 0x16, 0x78, 0xFF, 0xFF, 0x0F, 0x60,
+	 0xD6, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x4E, 0xF3, 0xFF, 0xFF, 0x13, 0x1B, 0x1F, 0x60, 0xAE, 0x64,
+	 0xA0, 0xD3, 0xC7, 0xFB, 0x1F, 0x60, 0x1E, 0x65, 0x1F, 0x60, 0xBC, 0x61, 0x1F, 0x60, 0x1C, 0x64,
+	 0x20, 0x63, 0x59, 0xD1, 0x58, 0xD9, 0xA5, 0xD9, 0xDA, 0x85, 0xFB, 0x1F, 0xD0, 0x60, 0x62, 0x78,
+	 0xFF, 0xFF, 0x20, 0x60, 0x40, 0x63, 0xE0, 0x84, 0xE0, 0x85, 0xC4, 0x85, 0xC7, 0x83, 0xFE, 0xA5,
+	 0x89, 0xF3, 0xFF, 0xFF, 0xC4, 0x84, 0x66, 0x45, 0x60, 0x46, 0x60, 0x41, 0xBD, 0xD1, 0x03, 0xF8,
+	 0xBD, 0xD1, 0x04, 0xF8, 0xA3, 0xD1, 0x05, 0xF8, 0x06, 0xF2, 0xFF, 0xFF, 0x02, 0x7E, 0x06, 0xFA,
+	 0x5F, 0xF3, 0x60, 0xFB, 0x73, 0xF0, 0x63, 0xF9, 0x66, 0x43, 0x21, 0x60, 0x2C, 0x62, 0x32, 0x40,
+	 0x08, 0x2A, 0x09, 0x00, 0xA2, 0xD3, 0x06, 0xF0, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84,
+	 0x80, 0xBF, 0xB0, 0x84, 0x06, 0xFA, 0x63, 0x44, 0x63, 0xF3, 0x60, 0x45, 0x66, 0x41, 0x65, 0x46,
+	 0x8C, 0xFA, 0x60, 0x40, 0x01, 0x36, 0x06, 0x00, 0x02, 0x36, 0x04, 0x00, 0x04, 0x36, 0x02, 0x00,
+	 0x05, 0x3A, 0x02, 0x00, 0x00, 0x64, 0x01, 0x00, 0x01, 0x64, 0x6F, 0xFA, 0x5F, 0xF3, 0x60, 0xF1,
+	 0xFF, 0xFF, 0xA0, 0x84, 0x65, 0x43, 0x02, 0x02, 0x5F, 0xF3, 0xFF, 0xFF, 0x60, 0x41, 0x0F, 0x60,
+	 0xAE, 0x65, 0x63, 0xF3, 0xFF, 0xFF, 0xE0, 0x84, 0x44, 0xD3, 0x61, 0x45, 0xA4, 0x80, 0xFF, 0xFF,
+	 0x04, 0x02, 0xE8, 0x84, 0xA4, 0x80, 0xFF, 0xFF, 0xFC, 0x03, 0xA4, 0x84, 0x61, 0xFB, 0x6F, 0xF0,
+	 0x60, 0x47, 0x90, 0x84, 0x6F, 0xFA, 0x60, 0x47, 0x60, 0x45, 0x80, 0x64, 0xE8, 0x84, 0xA4, 0x80,
+	 0xFF, 0xFF, 0xFC, 0x03, 0xA4, 0x84, 0x70, 0xF0, 0x70, 0xFA, 0x00, 0x61, 0xE8, 0x84, 0xFF, 0xFF,
+	 0x02, 0x05, 0xDD, 0x81, 0xFB, 0x01, 0xE1, 0x81, 0x0F, 0x60, 0xA2, 0x65, 0x45, 0xD3, 0x0E, 0xFA,
+	 0x66, 0x43, 0x0C, 0xF4, 0xC5, 0xFE, 0x0F, 0x60, 0xD6, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x0F, 0x60,
+	 0xD8, 0x62, 0x00, 0x60, 0x30, 0x64, 0xA2, 0xDB, 0xCF, 0x60, 0xC7, 0x64, 0x5A, 0xDB, 0xCF, 0xFE,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x4E, 0xDF, 0x60, 0x58, 0x4F, 0x13, 0x78, 0xFF, 0xFF, 0x0E, 0x4F,
+	 0x0F, 0x4E, 0xDC, 0x60, 0x58, 0x4F, 0x6B, 0x78, 0xFF, 0xFF, 0x0E, 0x4F, 0x0F, 0x4E, 0xDB, 0x60,
+	 0x58, 0x4F, 0xE8, 0x78, 0xFF, 0xFF, 0x0E, 0x4F, 0x0F, 0x4E, 0xDB, 0x60, 0x58, 0x4F, 0x42, 0x78,
+	 0xFF, 0xFF, 0x0E, 0x4F, 0xD7, 0x01, 0x4E, 0xF3, 0x7E, 0xF5, 0x60, 0x40, 0xFF, 0x22, 0x0A, 0x00,
+	 0x89, 0xF1, 0xCC, 0x84, 0xE0, 0x84, 0xC0, 0x86, 0x06, 0xF2, 0xFF, 0xFF, 0x00, 0x7E, 0x06, 0xFA,
+	 0x7E, 0xF5, 0x08, 0x00, 0x0F, 0x60, 0xF4, 0x62, 0xA2, 0xD1, 0x00, 0x60, 0x11, 0x64, 0xB0, 0x84,
+	 0xA2, 0xDB, 0xCF, 0xFE, 0x4E, 0xF3, 0x66, 0x40, 0xFF, 0x22, 0x05, 0x00, 0xFF, 0x22, 0x37, 0x00,
+	 0xD1, 0x60, 0x30, 0x78, 0xFF, 0xFF, 0x02, 0x64, 0x6A, 0xFB, 0xFF, 0xFF, 0xC1, 0xFE, 0x6A, 0xF3,
+	 0x00, 0x65, 0xD4, 0x80, 0x4E, 0xF3, 0x0F, 0x03, 0x0F, 0x60, 0xD6, 0x62, 0x00, 0x64, 0xA2, 0xDB,
+	 0x0F, 0x60, 0xD8, 0x62, 0x80, 0x60, 0x00, 0x64, 0xA2, 0xDB, 0xD0, 0x60, 0x9F, 0x64, 0x5A, 0xDB,
+	 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60, 0xD6, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0xDE, 0xFE,
+	 0x0B, 0x04, 0x0F, 0x60, 0xD8, 0x62, 0x20, 0x60, 0x00, 0x64, 0xA2, 0xDB, 0xD0, 0x60, 0xB3, 0x64,
+	 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x1C, 0x60, 0x00, 0x62, 0x06, 0x64, 0x4A, 0xDB,
+	 0xFF, 0xFF, 0x2D, 0xFF, 0x20, 0x44, 0x01, 0xB5, 0x54, 0x80, 0xDA, 0xFE, 0xBE, 0xFE, 0x88, 0xF1,
+	 0x02, 0x64, 0x87, 0xF3, 0xC0, 0x83, 0x40, 0x48, 0x76, 0xFD, 0xE4, 0x60, 0x58, 0x4E, 0x9D, 0x78,
+	 0xFF, 0xFF, 0x28, 0x44, 0x4C, 0x88, 0x76, 0xF3, 0x02, 0x65, 0xC4, 0x83, 0xF5, 0x02, 0xA2, 0x60,
+	 0x58, 0x4E, 0x00, 0x78, 0xFF, 0xFF, 0x14, 0x60, 0xD0, 0x62, 0x14, 0x60, 0xD2, 0x64, 0xA2, 0xDB,
+	 0x00, 0x64, 0x4A, 0xDB, 0x01, 0x60, 0xFE, 0x63, 0x12, 0x60, 0xCC, 0x61, 0x00, 0x64, 0x59, 0xDB,
+	 0xFE, 0x1F, 0x7E, 0xF1, 0x1B, 0x60, 0x9A, 0x61, 0x64, 0x40, 0xFF, 0x26, 0x39, 0x00, 0xD1, 0x60,
+	 0x58, 0x4E, 0x33, 0x78, 0xFF, 0xFF, 0x1B, 0x60, 0x88, 0x61, 0xD1, 0x60, 0x58, 0x4E, 0x33, 0x78,
+	 0xFF, 0xFF, 0x1B, 0x60, 0x8E, 0x61, 0xD1, 0x60, 0x58, 0x4E, 0x33, 0x78, 0xFF, 0xFF, 0x1B, 0x60,
+	 0xA0, 0x61, 0xD1, 0x60, 0x58, 0x4E, 0x33, 0x78, 0xFF, 0xFF, 0x1B, 0x60, 0xA6, 0x61, 0xD1, 0x60,
+	 0x58, 0x4E, 0x33, 0x78, 0xFF, 0xFF, 0x1B, 0x60, 0xB2, 0x61, 0xD1, 0x60, 0x58, 0x4E, 0x33, 0x78,
+	 0xFF, 0xFF, 0x1B, 0x60, 0xBE, 0x61, 0xD1, 0x60, 0x58, 0x4E, 0x33, 0x78, 0xFF, 0xFF, 0x1B, 0x60,
+	 0xAC, 0x61, 0xD1, 0x60, 0x58, 0x4E, 0x33, 0x78, 0xFF, 0xFF, 0x1B, 0x60, 0x94, 0x61, 0xD1, 0x60,
+	 0x58, 0x4E, 0x5F, 0x78, 0xFF, 0xFF, 0x0F, 0x60, 0xD6, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x5A, 0xDB,
+	 0xC5, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0xA1, 0xD3, 0x0E, 0x57, 0x24, 0x00, 0x0E, 0xF2, 0x44, 0x4C,
+	 0x80, 0xB0, 0x10, 0xB0, 0x0B, 0x03, 0x1B, 0x60, 0xDA, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x66, 0x44,
+	 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0x13, 0x00, 0x12, 0x02, 0xF0, 0x37,
+	 0x09, 0x00, 0x02, 0xF0, 0x09, 0x60, 0x08, 0x64, 0xD0, 0x80, 0xA2, 0xFF, 0x90, 0xF3, 0x02, 0x02,
+	 0xCC, 0x84, 0x90, 0xFB, 0x1B, 0x60, 0xDA, 0x64, 0x40, 0x4B, 0xF0, 0x60, 0x58, 0x4D, 0x75, 0x78,
+	 0xFF, 0xFF, 0x2C, 0x44, 0xAC, 0x86, 0x09, 0xF0, 0xD9, 0x02, 0x37, 0x58, 0xFF, 0xFF, 0xA1, 0xD3,
+	 0x0E, 0x57, 0x19, 0x00, 0x0E, 0xF2, 0x44, 0x4C, 0x80, 0xB0, 0x10, 0xB0, 0x0B, 0x03, 0x1B, 0x60,
+	 0xDA, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF,
+	 0x2B, 0xFF, 0x08, 0x00, 0x07, 0x02, 0x1B, 0x60, 0xDA, 0x64, 0x40, 0x4B, 0xF0, 0x60, 0x58, 0x4D,
+	 0x75, 0x78, 0xFF, 0xFF, 0x2C, 0x44, 0xAC, 0x86, 0x09, 0xF0, 0xE4, 0x02, 0x37, 0x58, 0xFF, 0xFF,
+	 0x00, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0xB0, 0x64, 0x2A, 0xFA, 0x2F, 0xF2, 0x2C, 0xFA, 0x30, 0xF2,
+	 0x2D, 0xFA, 0x31, 0xF2, 0x2E, 0xFA, 0xCB, 0xF3, 0x2F, 0xFA, 0xCC, 0xF3, 0x30, 0xFA, 0xCD, 0xF3,
+	 0x31, 0xFA, 0x67, 0xF3, 0x32, 0xFA, 0x68, 0xF3, 0x33, 0xFA, 0x69, 0xF3, 0x34, 0xFA, 0xAC, 0xF1,
+	 0x19, 0xF8, 0x06, 0x63, 0x3F, 0xFC, 0x1C, 0xF2, 0x13, 0xFA, 0x00, 0x64, 0x3E, 0xFA, 0x07, 0xF2,
+	 0x88, 0xF1, 0xFF, 0xFF, 0xD0, 0x80, 0xFF, 0xFF, 0x0C, 0x03, 0x60, 0x46, 0x06, 0xF2, 0x26, 0x46,
+	 0x01, 0xB0, 0xFF, 0xFF, 0x03, 0x02, 0xD3, 0x60, 0x64, 0x78, 0xFF, 0xFF, 0xD4, 0x60, 0xBA, 0x78,
+	 0xFF, 0xFF, 0x00, 0xF4, 0x0A, 0xF2, 0x09, 0xF2, 0xFF, 0xA0, 0x00, 0xA0, 0x13, 0x02, 0xFF, 0xA0,
+	 0x04, 0x03, 0x08, 0x03, 0xD1, 0x60, 0xD5, 0x78, 0xFF, 0xFF, 0x02, 0x64, 0x55, 0xFB, 0xD1, 0x60,
+	 0xE0, 0x78, 0xFF, 0xFF, 0x01, 0x63, 0x32, 0x40, 0x08, 0x2A, 0x0F, 0x00, 0x55, 0xFD, 0xD1, 0x60,
+	 0xE0, 0x78, 0xFF, 0xFF, 0x26, 0x46, 0x00, 0xF4, 0x0A, 0xF2, 0x0E, 0x63, 0x01, 0xA4, 0x0A, 0xFA,
+	 0x0B, 0xFC, 0x43, 0x59, 0xD4, 0x60, 0x93, 0x78, 0xFF, 0xFF, 0x26, 0x46, 0x00, 0xF4, 0x0A, 0xF2,
+	 0x0D, 0x63, 0x01, 0xA4, 0x0A, 0xFA, 0x0B, 0xFC, 0x43, 0x59, 0xD4, 0x60, 0x93, 0x78, 0xFF, 0xFF,
+	 0x88, 0xF5, 0x00, 0xF2, 0x26, 0x46, 0x00, 0xA0, 0x2E, 0xF0, 0x37, 0x03, 0x66, 0x41, 0x12, 0x60,
+	 0xCE, 0x65, 0x64, 0x47, 0x00, 0x7F, 0x88, 0xF1, 0xE0, 0x84, 0x44, 0xD3, 0x64, 0x43, 0x11, 0x18,
+	 0x60, 0x46, 0x00, 0xF2, 0xFF, 0xFF, 0xFC, 0x1B, 0x66, 0x44, 0x64, 0x46, 0x80, 0xF0, 0x60, 0x46,
+	 0x80, 0xF8, 0x65, 0x46, 0x65, 0x43, 0x80, 0xF0, 0x01, 0xFA, 0x80, 0xFC, 0x64, 0x46, 0x80, 0xF8,
+	 0x0B, 0x00, 0x64, 0x46, 0x62, 0x43, 0x00, 0xF2, 0xA3, 0xDB, 0x60, 0x46, 0x80, 0xF0, 0x81, 0xFC,
+	 0x80, 0xFC, 0x64, 0x46, 0x80, 0xF8, 0x60, 0x43, 0x61, 0x46, 0x87, 0xF1, 0x14, 0x60, 0xCE, 0x61,
+	 0xA1, 0xD3, 0xDA, 0x81, 0xD0, 0x80, 0xDC, 0x9C, 0x05, 0x05, 0xA1, 0xD3, 0x4A, 0xD9, 0xA0, 0xDD,
+	 0xDA, 0x9C, 0xA1, 0xD9, 0xD3, 0x60, 0x2D, 0x78, 0xFF, 0xFF, 0x14, 0x60, 0xCE, 0x64, 0xA0, 0xD3,
+	 0xFF, 0xFF, 0x62, 0x18, 0x14, 0x60, 0xCE, 0x64, 0x04, 0xA5, 0xA0, 0xD1, 0x72, 0x44, 0xFF, 0xB4,
+	 0x64, 0x40, 0xE0, 0x22, 0x1F, 0xB4, 0x64, 0x40, 0xF8, 0x22, 0x07, 0xB4, 0x02, 0x00, 0x03, 0x04,
+	 0xD0, 0x84, 0xD0, 0x80, 0xFC, 0x01, 0xE0, 0x84, 0x44, 0xD3, 0xFF, 0xFF, 0x60, 0x43, 0x66, 0x41,
+	 0x63, 0x46, 0x05, 0xF2, 0x00, 0xF0, 0x81, 0xF0, 0x02, 0x18, 0x64, 0x46, 0x81, 0xF8, 0x07, 0x1B,
+	 0x12, 0x60, 0xCE, 0x65, 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD9, 0x02, 0x00, 0x65, 0x46,
+	 0x00, 0xF8, 0x88, 0xF3, 0x63, 0x45, 0x60, 0x46, 0x00, 0xF2, 0xFF, 0xFF, 0xD4, 0x80, 0x01, 0x18,
+	 0xFA, 0x04, 0x80, 0xF8, 0x65, 0x46, 0x00, 0xFA, 0x06, 0xF2, 0xFF, 0xFF, 0x00, 0x7E, 0x06, 0xFA,
+	 0x61, 0x46, 0x2E, 0xF0, 0x66, 0x41, 0x12, 0x60, 0xCE, 0x65, 0x64, 0x47, 0x00, 0x7F, 0x88, 0xF1,
+	 0xE0, 0x84, 0x44, 0xD3, 0x64, 0x43, 0x11, 0x18, 0x60, 0x46, 0x00, 0xF2, 0xFF, 0xFF, 0xFC, 0x1B,
+	 0x66, 0x44, 0x64, 0x46, 0x80, 0xF0, 0x60, 0x46, 0x80, 0xF8, 0x65, 0x46, 0x65, 0x43, 0x80, 0xF0,
+	 0x01, 0xFA, 0x80, 0xFC, 0x64, 0x46, 0x80, 0xF8, 0x0B, 0x00, 0x64, 0x46, 0x62, 0x43, 0x00, 0xF2,
+	 0xA3, 0xDB, 0x60, 0x46, 0x80, 0xF0, 0x81, 0xFC, 0x80, 0xFC, 0x64, 0x46, 0x80, 0xF8, 0x60, 0x43,
+	 0x61, 0x46, 0xD3, 0x60, 0x2D, 0x78, 0xFF, 0xFF, 0x00, 0x60, 0x02, 0x61, 0xB3, 0x60, 0x58, 0x4D,
+	 0x77, 0x78, 0xFF, 0xFF, 0x87, 0xF1, 0x72, 0x44, 0xFF, 0xB4, 0xD0, 0x80, 0xFF, 0xFF, 0x02, 0x04,
+	 0xD0, 0x84, 0xFB, 0x01, 0xE0, 0x83, 0x88, 0xF3, 0x02, 0xA3, 0x43, 0x93, 0x66, 0x44, 0x00, 0xA8,
+	 0x56, 0xFD, 0x37, 0x03, 0x00, 0x64, 0x2B, 0xFA, 0x00, 0x60, 0xC0, 0x64, 0x2A, 0xFA, 0x66, 0x45,
+	 0x63, 0x46, 0x03, 0xF2, 0x04, 0xF0, 0x85, 0xF2, 0x65, 0x46, 0x2C, 0xFA, 0x2D, 0xF8, 0xAE, 0xFA,
+	 0xCB, 0xF3, 0x2F, 0xFA, 0x32, 0xFA, 0xCC, 0xF3, 0x30, 0xFA, 0x33, 0xFA, 0xCD, 0xF3, 0x31, 0xFA,
+	 0x34, 0xFA, 0xAC, 0xF1, 0x19, 0xF8, 0xFF, 0x67, 0x0E, 0xFA, 0x66, 0x45, 0x63, 0x46, 0x0E, 0xF2,
+	 0x65, 0x46, 0x02, 0x63, 0x00, 0x7E, 0x13, 0xFA, 0x3F, 0xFC, 0x00, 0x64, 0x3E, 0xFA, 0x88, 0xF3,
+	 0x07, 0xFA, 0x66, 0x41, 0x00, 0xF4, 0x05, 0x64, 0x09, 0xFA, 0x1B, 0x60, 0xDA, 0x62, 0x1B, 0x60,
+	 0x8E, 0x64, 0xA2, 0xDB, 0x61, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF,
+	 0xC1, 0xFE, 0x56, 0xF3, 0xA3, 0xFF, 0x60, 0x43, 0xE4, 0x60, 0x58, 0x4E, 0x9D, 0x78, 0xFF, 0xFF,
+	 0x56, 0xF3, 0xFF, 0xFF, 0x40, 0x58, 0x03, 0x65, 0xE2, 0x60, 0x58, 0x4E, 0x86, 0x78, 0xFF, 0xFF,
+	 0x56, 0xF3, 0x26, 0x46, 0x60, 0x43, 0x66, 0x41, 0x63, 0x46, 0x05, 0xF2, 0x00, 0xF0, 0x81, 0xF0,
+	 0x02, 0x18, 0x64, 0x46, 0x81, 0xF8, 0x07, 0x1B, 0x12, 0x60, 0xCE, 0x65, 0x60, 0x47, 0x00, 0x7F,
+	 0xE0, 0x84, 0x44, 0xD9, 0x02, 0x00, 0x65, 0x46, 0x00, 0xF8, 0x88, 0xF3, 0x63, 0x45, 0x60, 0x46,
+	 0x00, 0xF2, 0xFF, 0xFF, 0xD4, 0x80, 0x01, 0x18, 0xFA, 0x04, 0x80, 0xF8, 0x65, 0x46, 0x00, 0xFA,
+	 0x06, 0xF2, 0xFF, 0xFF, 0x00, 0x7E, 0x06, 0xFA, 0x61, 0x46, 0x2E, 0xF0, 0x66, 0x41, 0x12, 0x60,
+	 0xCE, 0x65, 0x64, 0x47, 0x00, 0x7F, 0x88, 0xF1, 0xE0, 0x84, 0x44, 0xD3, 0x64, 0x43, 0x11, 0x18,
+	 0x60, 0x46, 0x00, 0xF2, 0xFF, 0xFF, 0xFC, 0x1B, 0x66, 0x44, 0x64, 0x46, 0x80, 0xF0, 0x60, 0x46,
+	 0x80, 0xF8, 0x65, 0x46, 0x65, 0x43, 0x80, 0xF0, 0x01, 0xFA, 0x80, 0xFC, 0x64, 0x46, 0x80, 0xF8,
+	 0x0B, 0x00, 0x64, 0x46, 0x62, 0x43, 0x00, 0xF2, 0xA3, 0xDB, 0x60, 0x46, 0x80, 0xF0, 0x81, 0xFC,
+	 0x80, 0xFC, 0x64, 0x46, 0x80, 0xF8, 0x60, 0x43, 0x61, 0x46, 0x2C, 0xF2, 0x2D, 0xF0, 0xAE, 0xF2,
+	 0x66, 0x45, 0x63, 0x46, 0x03, 0xFA, 0x04, 0xF8, 0x55, 0xF3, 0x85, 0xFA, 0xFF, 0xA0, 0x65, 0x46,
+	 0x03, 0x03, 0xD4, 0x60, 0xD6, 0x78, 0xFF, 0xFF, 0x95, 0xF3, 0x66, 0x45, 0x63, 0x46, 0x1B, 0xFA,
+	 0x65, 0x46, 0xBA, 0x65, 0x60, 0x44, 0xC4, 0x85, 0x01, 0x60, 0xFE, 0x61, 0x00, 0x64, 0x80, 0x63,
+	 0xC7, 0x85, 0x94, 0x84, 0x59, 0xDB, 0xFC, 0x1F, 0x00, 0x60, 0x88, 0x64, 0x3F, 0xFA, 0x00, 0xF4,
+	 0x02, 0x64, 0x0A, 0xFA, 0x00, 0x64, 0x0B, 0xFA, 0x80, 0x7F, 0x10, 0x7E, 0x0C, 0xFA, 0x1A, 0x65,
+	 0x80, 0x61, 0x02, 0x60, 0x00, 0x63, 0x0F, 0x4E, 0xF2, 0x60, 0x58, 0x4F, 0x4A, 0x78, 0xFF, 0xFF,
+	 0x0E, 0x4F, 0xD4, 0x60, 0xA7, 0x78, 0xFF, 0xFF, 0x26, 0x46, 0x23, 0xF0, 0x00, 0x60, 0x02, 0x64,
+	 0xA0, 0x80, 0x00, 0xF4, 0x03, 0x03, 0xD4, 0x60, 0x50, 0x78, 0xFF, 0xFF, 0x09, 0xF2, 0xFF, 0xFF,
+	 0xFF, 0xA0, 0x00, 0xA0, 0x0C, 0x03, 0x03, 0x03, 0xD3, 0x60, 0xCC, 0x78, 0xFF, 0xFF, 0x0A, 0xF2,
+	 0x26, 0x46, 0xFF, 0xA0, 0x87, 0xF4, 0x10, 0x02, 0xD4, 0x60, 0xD6, 0x78, 0xFF, 0xFF, 0x0A, 0xF2,
+	 0xFF, 0xFF, 0xFF, 0xA0, 0xFD, 0xA0, 0x02, 0x03, 0x04, 0x03, 0x06, 0x00, 0xD4, 0x60, 0x0C, 0x78,
+	 0xFF, 0xFF, 0xD4, 0x60, 0x17, 0x78, 0xFF, 0xFF, 0x26, 0x46, 0x87, 0xF4, 0x66, 0x41, 0x63, 0x46,
+	 0x05, 0xF2, 0x00, 0xF0, 0x81, 0xF0, 0x02, 0x18, 0x64, 0x46, 0x81, 0xF8, 0x07, 0x1B, 0x12, 0x60,
+	 0xCE, 0x65, 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD9, 0x02, 0x00, 0x65, 0x46, 0x00, 0xF8,
+	 0x88, 0xF3, 0x63, 0x45, 0x60, 0x46, 0x00, 0xF2, 0xFF, 0xFF, 0xD4, 0x80, 0x01, 0x18, 0xFA, 0x04,
+	 0x80, 0xF8, 0x65, 0x46, 0x00, 0xFA, 0x06, 0xF2, 0xFF, 0xFF, 0x00, 0x7E, 0x06, 0xFA, 0x61, 0x46,
+	 0x14, 0x60, 0xD0, 0x62, 0xA2, 0xD3, 0xDA, 0x81, 0x60, 0x45, 0xD5, 0x80, 0xA1, 0xD1, 0x11, 0x03,
+	 0xD3, 0x80, 0xD9, 0x81, 0xFA, 0x02, 0xC9, 0x81, 0xC8, 0x85, 0xD5, 0x80, 0xA5, 0xD3, 0x08, 0x28,
+	 0xA1, 0xDB, 0x14, 0x60, 0xD0, 0x62, 0x65, 0x44, 0xA2, 0xDB, 0x4A, 0xD3, 0xFF, 0xFF, 0xCC, 0x84,
+	 0xA2, 0xDB, 0xD1, 0x60, 0xCA, 0x78, 0xFF, 0xFF, 0x26, 0x46, 0x87, 0xF4, 0x66, 0x41, 0x63, 0x46,
+	 0x05, 0xF2, 0x00, 0xF0, 0x81, 0xF0, 0x02, 0x18, 0x64, 0x46, 0x81, 0xF8, 0x07, 0x1B, 0x12, 0x60,
+	 0xCE, 0x65, 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD9, 0x02, 0x00, 0x65, 0x46, 0x00, 0xF8,
+	 0x88, 0xF3, 0x63, 0x45, 0x60, 0x46, 0x00, 0xF2, 0xFF, 0xFF, 0xD4, 0x80, 0x01, 0x18, 0xFA, 0x04,
+	 0x80, 0xF8, 0x65, 0x46, 0x00, 0xFA, 0x06, 0xF2, 0xFF, 0xFF, 0x00, 0x7E, 0x06, 0xFA, 0x61, 0x46,
+	 0x14, 0x60, 0xD0, 0x62, 0xA2, 0xD3, 0xDA, 0x81, 0x60, 0x45, 0xD5, 0x80, 0xA1, 0xD1, 0x11, 0x03,
+	 0xD3, 0x80, 0xD9, 0x81, 0xFA, 0x02, 0xC9, 0x81, 0xC8, 0x85, 0xD5, 0x80, 0xA5, 0xD3, 0x08, 0x28,
+	 0xA1, 0xDB, 0x14, 0x60, 0xD0, 0x62, 0x65, 0x44, 0xA2, 0xDB, 0x4A, 0xD3, 0xFF, 0xFF, 0xCC, 0x84,
+	 0xA2, 0xDB, 0xD1, 0x60, 0xD5, 0x78, 0xFF, 0xFF, 0x26, 0x46, 0x32, 0x44, 0x08, 0xB0, 0x87, 0xF4,
+	 0x03, 0x02, 0xD1, 0x60, 0xD5, 0x78, 0xFF, 0xFF, 0xD3, 0x60, 0x3C, 0x78, 0xFF, 0xFF, 0x32, 0x44,
+	 0x26, 0x46, 0x08, 0xB0, 0x07, 0xF2, 0x03, 0x02, 0xD1, 0x60, 0xD5, 0x78, 0xFF, 0xFF, 0x60, 0x46,
+	 0x1B, 0xF2, 0x26, 0x46, 0xBA, 0x65, 0x60, 0x44, 0xC4, 0x85, 0x01, 0x60, 0xFE, 0x61, 0x00, 0x64,
+	 0x80, 0x63, 0xC7, 0x85, 0x94, 0x84, 0x59, 0xDB, 0xFC, 0x1F, 0x00, 0xF4, 0x01, 0x60, 0xFE, 0x61,
+	 0x7E, 0x65, 0x18, 0x63, 0x5B, 0xD2, 0x59, 0xD1, 0xFF, 0xFF, 0xD0, 0x80, 0xD7, 0x80, 0x18, 0x02,
+	 0xF9, 0x02, 0x00, 0xF4, 0x02, 0x63, 0x0E, 0x65, 0x5B, 0xD2, 0x59, 0xD1, 0xFF, 0xFF, 0xD0, 0x80,
+	 0xD7, 0x80, 0x0E, 0x02, 0xF9, 0x02, 0x26, 0x46, 0x07, 0xF4, 0x06, 0xF2, 0xFF, 0xFF, 0x01, 0x7E,
+	 0x06, 0xFA, 0x26, 0x46, 0x00, 0xF4, 0x04, 0x64, 0x0A, 0xFA, 0x00, 0x64, 0x0B, 0xFA, 0x57, 0x00,
+	 0x26, 0x46, 0x87, 0xF4, 0x66, 0x41, 0x63, 0x46, 0x05, 0xF2, 0x00, 0xF0, 0x81, 0xF0, 0x02, 0x18,
+	 0x64, 0x46, 0x81, 0xF8, 0x07, 0x1B, 0x12, 0x60, 0xCE, 0x65, 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84,
+	 0x44, 0xD9, 0x02, 0x00, 0x65, 0x46, 0x00, 0xF8, 0x88, 0xF3, 0x63, 0x45, 0x60, 0x46, 0x00, 0xF2,
+	 0xFF, 0xFF, 0xD4, 0x80, 0x01, 0x18, 0xFA, 0x04, 0x80, 0xF8, 0x65, 0x46, 0x00, 0xFA, 0x06, 0xF2,
+	 0xFF, 0xFF, 0x00, 0x7E, 0x06, 0xFA, 0x61, 0x46, 0x14, 0x60, 0xD0, 0x62, 0xA2, 0xD3, 0xDA, 0x81,
+	 0x60, 0x45, 0xD5, 0x80, 0xA1, 0xD1, 0x11, 0x03, 0xD3, 0x80, 0xD9, 0x81, 0xFA, 0x02, 0xC9, 0x81,
+	 0xC8, 0x85, 0xD5, 0x80, 0xA5, 0xD3, 0x08, 0x28, 0xA1, 0xDB, 0x14, 0x60, 0xD0, 0x62, 0x65, 0x44,
+	 0xA2, 0xDB, 0x4A, 0xD3, 0xFF, 0xFF, 0xCC, 0x84, 0xA2, 0xDB, 0x00, 0xF4, 0x04, 0x64, 0x0A, 0xFA,
+	 0x0F, 0x64, 0x0B, 0xFA, 0x40, 0x59, 0x02, 0x60, 0x00, 0x61, 0x41, 0x58, 0x26, 0x46, 0x2C, 0xF2,
+	 0xA1, 0xDB, 0x2D, 0xF2, 0x59, 0xDB, 0x2E, 0xF2, 0x59, 0xDB, 0x03, 0x65, 0xE2, 0x60, 0x58, 0x4E,
+	 0x5B, 0x78, 0xFF, 0xFF, 0x03, 0x65, 0xE2, 0x60, 0x58, 0x4E, 0x86, 0x78, 0xFF, 0xFF, 0x26, 0x46,
+	 0x88, 0xF3, 0x07, 0xFA, 0x1B, 0x60, 0xDA, 0x62, 0x1B, 0x60, 0x8E, 0x64, 0xA2, 0xDB, 0x26, 0x44,
+	 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xC1, 0xFE, 0x00, 0x66, 0x46, 0x46,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x00, 0xF4, 0x0A, 0xF2, 0x09, 0xF2, 0xFF, 0xA0, 0x00, 0xA0, 0x06, 0x02,
+	 0xFF, 0xA0, 0x07, 0x03, 0x09, 0x03, 0xD3, 0x60, 0xCC, 0x78, 0xFF, 0xFF, 0xD3, 0x60, 0x8C, 0x78,
+	 0xFF, 0xFF, 0xD4, 0x60, 0xDB, 0x78, 0xFF, 0xFF, 0x26, 0x46, 0x07, 0xF4, 0x06, 0xF2, 0x66, 0x43,
+	 0x00, 0x7E, 0x06, 0xFA, 0x26, 0x46, 0xD3, 0x60, 0x3C, 0x78, 0xFF, 0xFF, 0x63, 0x46, 0x06, 0xF2,
+	 0xFF, 0xFF, 0x01, 0x7E, 0x06, 0xFA, 0x26, 0x46, 0x88, 0xF3, 0x07, 0xFA, 0x00, 0xF4, 0x02, 0x64,
+	 0x0A, 0xFA, 0x00, 0x64, 0x0B, 0xFA, 0x1B, 0x60, 0xDA, 0x62, 0x1B, 0x60, 0x8E, 0x64, 0xA2, 0xDB,
+	 0x26, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xC1, 0xFE, 0x00, 0x66,
+	 0x46, 0x46, 0x2F, 0x58, 0xFF, 0xFF, 0x16, 0x60, 0xAC, 0x7C, 0x2A, 0xF2, 0xA4, 0xDB, 0x22, 0x60,
+	 0x2A, 0x63, 0xFF, 0xB4, 0x01, 0x61, 0x00, 0x60, 0x10, 0x7C, 0xA3, 0xDB, 0x60, 0x40, 0x00, 0x36,
+	 0x03, 0x00, 0x02, 0x61, 0x00, 0x60, 0x30, 0x7C, 0x41, 0x47, 0x2A, 0xF8, 0x2F, 0xF2, 0x2C, 0xFA,
+	 0x30, 0xF2, 0x2D, 0xFA, 0x31, 0xF2, 0x2E, 0xFA, 0xCB, 0xF3, 0x2F, 0xFA, 0xCC, 0xF3, 0x30, 0xFA,
+	 0xCD, 0xF3, 0x31, 0xFA, 0x67, 0xF3, 0x32, 0xFA, 0x68, 0xF3, 0x33, 0xFA, 0x69, 0xF3, 0x34, 0xFA,
+	 0xAC, 0xF1, 0x19, 0xF8, 0x00, 0x7C, 0x3E, 0xF8, 0x1C, 0xF0, 0x13, 0xF8, 0x07, 0xF2, 0x88, 0xF1,
+	 0xFF, 0xFF, 0xD0, 0x80, 0xFF, 0xFF, 0x03, 0x02, 0xD9, 0x60, 0xA3, 0x78, 0xFF, 0xFF, 0x40, 0x4B,
+	 0xAB, 0x46, 0x06, 0xF2, 0xAB, 0x46, 0x00, 0xF4, 0x01, 0xB0, 0xFF, 0xFF, 0x03, 0x02, 0xD9, 0x60,
+	 0xA3, 0x78, 0xFF, 0xFF, 0x22, 0x60, 0x2C, 0x63, 0x09, 0xF2, 0xBD, 0xDB, 0x43, 0x44, 0x10, 0xB0,
+	 0x80, 0x60, 0x00, 0x63, 0x0D, 0x03, 0x1F, 0x60, 0x92, 0x62, 0xA2, 0xD1, 0xFF, 0xFF, 0x64, 0x44,
+	 0xFE, 0x26, 0x08, 0x00, 0x32, 0x40, 0x08, 0x26, 0x06, 0x00, 0xDA, 0x60, 0x02, 0x78, 0xFF, 0xFF,
+	 0x32, 0x40, 0x10, 0x2A, 0x00, 0x63, 0xAB, 0x46, 0x06, 0xF0, 0x7F, 0x60, 0xFF, 0x64, 0xA0, 0x84,
+	 0x63, 0x45, 0xB4, 0x84, 0x06, 0xFA, 0xAB, 0x46, 0x0A, 0xF0, 0x56, 0xF9, 0x24, 0x43, 0xBD, 0xD9,
+	 0x43, 0x44, 0x01, 0x63, 0x32, 0x40, 0x10, 0x26, 0x10, 0xBB, 0x1F, 0x60, 0x92, 0x62, 0xA2, 0xD3,
+	 0xFF, 0xFF, 0x60, 0x40, 0xFE, 0x26, 0x10, 0xBB, 0x09, 0xFC, 0x27, 0x44, 0xFE, 0xA0, 0xFF, 0xFF,
+	 0x03, 0x03, 0xD5, 0x60, 0xFE, 0x78, 0xFF, 0xFF, 0x16, 0x60, 0xA2, 0x64, 0x24, 0x43, 0x0B, 0xF0,
+	 0xA0, 0xD9, 0xBD, 0xD9, 0x0C, 0xF0, 0x58, 0xD9, 0xBD, 0xD9, 0x0D, 0xF0, 0x58, 0xD9, 0xBD, 0xD9,
+	 0x43, 0x44, 0x1C, 0x65, 0x2D, 0x61, 0x02, 0x60, 0x00, 0x63, 0xA5, 0xD0, 0xDA, 0x85, 0x64, 0x44,
+	 0x00, 0x7F, 0xCD, 0x81, 0xBD, 0xDB, 0x05, 0x03, 0x64, 0x47, 0x00, 0x7F, 0xCD, 0x81, 0xBD, 0xDB,
+	 0xF4, 0x02, 0x02, 0x60, 0x02, 0x61, 0xA1, 0xD3, 0xFF, 0xFF, 0xE0, 0x84, 0x04, 0xA5, 0xC5, 0x81,
+	 0xA1, 0xD3, 0x00, 0x65, 0x60, 0x43, 0x59, 0xD3, 0xFF, 0xFF, 0x7F, 0xB4, 0x02, 0x3A, 0x02, 0x00,
+	 0x01, 0x64, 0x15, 0x00, 0x04, 0x3A, 0x02, 0x00, 0x02, 0x64, 0x11, 0x00, 0x0A, 0x3A, 0x02, 0x00,
+	 0x04, 0x64, 0x0D, 0x00, 0x0B, 0x3A, 0x02, 0x00, 0x08, 0x64, 0x09, 0x00, 0x10, 0x3A, 0x02, 0x00,
+	 0x10, 0x64, 0x05, 0x00, 0x16, 0x3A, 0x02, 0x00, 0x20, 0x64, 0x01, 0x00, 0x00, 0x64, 0xCF, 0x83,
+	 0xB4, 0x85, 0xE1, 0x02, 0x65, 0x44, 0x60, 0xFB, 0xB8, 0xF3, 0x2B, 0x45, 0x66, 0x41, 0x65, 0x46,
+	 0x8C, 0xFA, 0x60, 0x40, 0x01, 0x36, 0x06, 0x00, 0x02, 0x36, 0x04, 0x00, 0x04, 0x36, 0x02, 0x00,
+	 0x05, 0x3A, 0x02, 0x00, 0x00, 0x64, 0x01, 0x00, 0x01, 0x64, 0x6F, 0xFA, 0x5F, 0xF3, 0x60, 0xF1,
+	 0xFF, 0xFF, 0xA0, 0x84, 0x65, 0x43, 0x02, 0x02, 0x5F, 0xF3, 0xFF, 0xFF, 0x60, 0x41, 0x0F, 0x60,
+	 0xAE, 0x65, 0xB8, 0xF3, 0xFF, 0xFF, 0xE0, 0x84, 0x44, 0xD3, 0x61, 0x45, 0xA4, 0x80, 0xFF, 0xFF,
+	 0x04, 0x02, 0xE8, 0x84, 0xA4, 0x80, 0xFF, 0xFF, 0xFC, 0x03, 0xA4, 0x84, 0x61, 0xFB, 0x6F, 0xF0,
+	 0x60, 0x47, 0x90, 0x84, 0x6F, 0xFA, 0x60, 0x47, 0x60, 0x45, 0x80, 0x64, 0xE8, 0x84, 0xA4, 0x80,
+	 0xFF, 0xFF, 0xFC, 0x03, 0xA4, 0x84, 0x70, 0xF0, 0x70, 0xFA, 0x00, 0x61, 0xE8, 0x84, 0xFF, 0xFF,
+	 0x02, 0x05, 0xDD, 0x81, 0xFB, 0x01, 0xE1, 0x81, 0x0F, 0x60, 0xA2, 0x65, 0x45, 0xD3, 0x0E, 0xFA,
+	 0x66, 0x43, 0x0C, 0xF4, 0xFF, 0xFF, 0xD6, 0x60, 0x80, 0x78, 0xFF, 0xFF, 0x16, 0x65, 0x2D, 0x61,
+	 0x02, 0x60, 0x00, 0x63, 0xA5, 0xD0, 0xDA, 0x85, 0x64, 0x44, 0x00, 0x7F, 0xCD, 0x81, 0xBD, 0xDB,
+	 0x05, 0x03, 0x64, 0x47, 0x00, 0x7F, 0xCD, 0x81, 0xBD, 0xDB, 0xF4, 0x02, 0x02, 0x60, 0x02, 0x61,
+	 0xA1, 0xD3, 0xFF, 0xFF, 0xE0, 0x84, 0x04, 0xA5, 0xC5, 0x81, 0xA1, 0xD3, 0x00, 0x65, 0x60, 0x43,
+	 0x59, 0xD3, 0xFF, 0xFF, 0x7F, 0xB4, 0x02, 0x3A, 0x02, 0x00, 0x01, 0x64, 0x15, 0x00, 0x04, 0x3A,
+	 0x02, 0x00, 0x02, 0x64, 0x11, 0x00, 0x0A, 0x3A, 0x02, 0x00, 0x04, 0x64, 0x0D, 0x00, 0x0B, 0x3A,
+	 0x02, 0x00, 0x08, 0x64, 0x09, 0x00, 0x10, 0x3A, 0x02, 0x00, 0x10, 0x64, 0x05, 0x00, 0x16, 0x3A,
+	 0x02, 0x00, 0x20, 0x64, 0x01, 0x00, 0x00, 0x64, 0xCF, 0x83, 0xB4, 0x85, 0xE1, 0x02, 0x65, 0x44,
+	 0x60, 0xFB, 0xB8, 0xF3, 0x2B, 0x45, 0x66, 0x41, 0x65, 0x46, 0x8C, 0xFA, 0x60, 0x40, 0x01, 0x36,
+	 0x06, 0x00, 0x02, 0x36, 0x04, 0x00, 0x04, 0x36, 0x02, 0x00, 0x05, 0x3A, 0x02, 0x00, 0x00, 0x64,
+	 0x01, 0x00, 0x01, 0x64, 0x6F, 0xFA, 0x5F, 0xF3, 0x60, 0xF1, 0xFF, 0xFF, 0xA0, 0x84, 0x65, 0x43,
+	 0x02, 0x02, 0x5F, 0xF3, 0xFF, 0xFF, 0x60, 0x41, 0x0F, 0x60, 0xAE, 0x65, 0xB8, 0xF3, 0xFF, 0xFF,
+	 0xE0, 0x84, 0x44, 0xD3, 0x61, 0x45, 0xA4, 0x80, 0xFF, 0xFF, 0x04, 0x02, 0xE8, 0x84, 0xA4, 0x80,
+	 0xFF, 0xFF, 0xFC, 0x03, 0xA4, 0x84, 0x61, 0xFB, 0x6F, 0xF0, 0x60, 0x47, 0x90, 0x84, 0x6F, 0xFA,
+	 0x60, 0x47, 0x60, 0x45, 0x80, 0x64, 0xE8, 0x84, 0xA4, 0x80, 0xFF, 0xFF, 0xFC, 0x03, 0xA4, 0x84,
+	 0x70, 0xF0, 0x70, 0xFA, 0x00, 0x61, 0xE8, 0x84, 0xFF, 0xFF, 0x02, 0x05, 0xDD, 0x81, 0xFB, 0x01,
+	 0xE1, 0x81, 0x0F, 0x60, 0xA2, 0x65, 0x45, 0xD3, 0x0E, 0xFA, 0x66, 0x43, 0x0C, 0xF4, 0xFF, 0xFF,
+	 0x26, 0x46, 0x3F, 0xF2, 0x00, 0xF4, 0x16, 0x65, 0x27, 0x40, 0x02, 0x3A, 0x03, 0x00, 0x1C, 0x65,
+	 0xF6, 0xA4, 0x01, 0x00, 0xFC, 0xA4, 0x24, 0x43, 0x22, 0x60, 0x82, 0x61, 0x5D, 0x91, 0x51, 0x90,
+	 0xFF, 0xFF, 0x04, 0x28, 0x60, 0x41, 0xCD, 0x84, 0x4C, 0x91, 0x60, 0x43, 0x60, 0xFE, 0xA5, 0xD2,
+	 0xDE, 0x85, 0x7F, 0x26, 0x02, 0x00, 0x00, 0xF4, 0x04, 0x65, 0x5D, 0x93, 0xA3, 0xDB, 0x5D, 0x93,
+	 0xA5, 0xD2, 0xF6, 0x1F, 0x5D, 0x93, 0x20, 0xFE, 0xDF, 0x83, 0x22, 0x60, 0x28, 0x7C, 0x03, 0x1E,
+	 0x60, 0xFE, 0xBD, 0xDF, 0x20, 0xFE, 0x22, 0x60, 0x2C, 0x64, 0x53, 0x93, 0xA4, 0xDD, 0x26, 0x46,
+	 0x00, 0xF4, 0x1F, 0x60, 0x90, 0x64, 0xA0, 0xD3, 0x00, 0x63, 0x00, 0xB8, 0x0A, 0xFC, 0x03, 0x02,
+	 0xD7, 0x60, 0x14, 0x78, 0xFF, 0xFF, 0x0B, 0xF2, 0x27, 0x40, 0x02, 0x3A, 0x02, 0x00, 0x0E, 0xF2,
+	 0xFF, 0xFF, 0x60, 0x47, 0x00, 0x3A, 0x26, 0x00, 0x60, 0x41, 0x00, 0x36, 0x23, 0x00, 0xE0, 0xA0,
+	 0xDA, 0x85, 0x20, 0x07, 0x1F, 0x60, 0x1E, 0x63, 0xA3, 0xD1, 0x65, 0x42, 0xD1, 0x80, 0x1F, 0x60,
+	 0x20, 0x63, 0x18, 0x02, 0x50, 0xFE, 0x61, 0x40, 0xFE, 0x22, 0x08, 0x00, 0x62, 0x45, 0xBD, 0xD3,
+	 0xA5, 0xD0, 0xDA, 0x82, 0xD0, 0x80, 0xC9, 0x81, 0xF6, 0x0C, 0x0C, 0x00, 0x61, 0x40, 0x00, 0x36,
+	 0x33, 0x00, 0x62, 0x45, 0xA3, 0xD3, 0xA5, 0xD0, 0xFF, 0xFF, 0x90, 0x80, 0xFF, 0x26, 0x02, 0x00,
+	 0xDE, 0x82, 0x2A, 0x00, 0x0C, 0x63, 0x0A, 0xFC, 0x00, 0x64, 0x09, 0xFA, 0x0B, 0xFA, 0x01, 0x7E,
+	 0x0C, 0xFA, 0x26, 0x46, 0x08, 0x64, 0x3F, 0xFA, 0x07, 0xF2, 0x88, 0xF1, 0x40, 0x58, 0x07, 0xF8,
+	 0x1B, 0x60, 0xDA, 0x62, 0x1B, 0x60, 0x8E, 0x64, 0xA2, 0xDB, 0x26, 0x44, 0x5A, 0xDB, 0x02, 0x64,
+	 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xC1, 0xFE, 0xDA, 0x60, 0x1E, 0x78, 0xFF, 0xFF, 0x20, 0xFE,
+	 0x21, 0x60, 0xE2, 0x61, 0xA1, 0xD3, 0xFF, 0xFF, 0x22, 0xB0, 0xFF, 0xFF, 0x03, 0x03, 0xD8, 0x60,
+	 0x9F, 0x78, 0xFF, 0xFF, 0x01, 0x63, 0xD7, 0x01, 0x1F, 0x60, 0x92, 0x62, 0xA2, 0xD3, 0xFF, 0xFF,
+	 0xFF, 0xA4, 0xFF, 0xFF, 0x0C, 0x20, 0x0D, 0x00, 0xD8, 0x60, 0x9F, 0x78, 0xFF, 0xFF, 0x20, 0xFE,
+	 0x28, 0x46, 0x2A, 0x41, 0xFF, 0xB1, 0x60, 0xFE, 0x82, 0x64, 0xA1, 0xDA, 0xFF, 0xFF, 0x20, 0xFE,
+	 0x15, 0x00, 0x21, 0x60, 0xEE, 0x61, 0xA1, 0xDF, 0xD9, 0x81, 0xA1, 0xDF, 0xD9, 0x81, 0xA1, 0xDF,
+	 0x04, 0xA1, 0xA1, 0xDF, 0xD9, 0x81, 0xA1, 0xDF, 0xD9, 0x81, 0xA1, 0xDF, 0xD9, 0x81, 0xA1, 0xDF,
+	 0x2B, 0x46, 0x37, 0xF2, 0x7F, 0x60, 0xCF, 0x65, 0xA4, 0x84, 0xA2, 0xDA, 0x26, 0x46, 0x3F, 0xF2,
+	 0x00, 0xF4, 0x27, 0x40, 0x02, 0x3A, 0x40, 0x00, 0x60, 0x43, 0xF6, 0xA3, 0x00, 0x60, 0x1B, 0x61,
+	 0x00, 0x60, 0xDD, 0x65, 0x60, 0xFE, 0x81, 0xA1, 0x7F, 0xA1, 0x02, 0x06, 0x00, 0xF4, 0x03, 0x61,
+	 0xDD, 0x81, 0xA1, 0xD2, 0xCF, 0x83, 0xD4, 0x80, 0x2D, 0x03, 0x17, 0x03, 0xCF, 0x83, 0x61, 0x44,
+	 0x80, 0xA0, 0x28, 0x03, 0x02, 0x02, 0x00, 0xF4, 0x03, 0x61, 0xDD, 0x81, 0xA1, 0xD2, 0xCF, 0x83,
+	 0x81, 0xA1, 0x20, 0x03, 0x05, 0x07, 0x7F, 0xA1, 0xCC, 0x84, 0xDD, 0x81, 0xE4, 0x03, 0xF7, 0x01,
+	 0x00, 0xF4, 0x00, 0xB8, 0x04, 0x61, 0xE4, 0x03, 0xF2, 0x01, 0x01, 0x60, 0xFF, 0x63, 0x46, 0x48,
+	 0x41, 0x4A, 0xDD, 0x81, 0xA1, 0xD0, 0xDF, 0x83, 0xA3, 0xD9, 0x64, 0x44, 0xDD, 0x81, 0xA1, 0xD0,
+	 0xDF, 0x83, 0xA3, 0xD9, 0xCC, 0x84, 0x81, 0xA1, 0x05, 0x03, 0x7F, 0xA1, 0xF7, 0x04, 0x00, 0xF4,
+	 0x03, 0x61, 0xF4, 0x01, 0x20, 0xFE, 0x3F, 0x00, 0x60, 0x43, 0xFC, 0xA3, 0x00, 0x60, 0x15, 0x61,
+	 0x00, 0x60, 0xDD, 0x65, 0x60, 0xFE, 0x81, 0xA1, 0x7F, 0xA1, 0x02, 0x06, 0x00, 0xF4, 0x03, 0x61,
+	 0xDD, 0x81, 0xA1, 0xD2, 0xCF, 0x83, 0xD4, 0x80, 0x2D, 0x03, 0x17, 0x03, 0xCF, 0x83, 0x61, 0x44,
+	 0x80, 0xA0, 0x28, 0x03, 0x02, 0x02, 0x00, 0xF4, 0x03, 0x61, 0xDD, 0x81, 0xA1, 0xD2, 0xCF, 0x83,
+	 0x81, 0xA1, 0x20, 0x03, 0x05, 0x07, 0x7F, 0xA1, 0xCC, 0x84, 0xDD, 0x81, 0xE4, 0x03, 0xF7, 0x01,
+	 0x00, 0xF4, 0x00, 0xB8, 0x04, 0x61, 0xE4, 0x03, 0xF2, 0x01, 0x01, 0x60, 0xFF, 0x63, 0x46, 0x48,
+	 0x41, 0x4A, 0xDD, 0x81, 0xA1, 0xD0, 0xDF, 0x83, 0xA3, 0xD9, 0x64, 0x44, 0xDD, 0x81, 0xA1, 0xD0,
+	 0xDF, 0x83, 0xA3, 0xD9, 0xCC, 0x84, 0x81, 0xA1, 0x05, 0x03, 0x7F, 0xA1, 0xF7, 0x04, 0x00, 0xF4,
+	 0x03, 0x61, 0xF4, 0x01, 0x20, 0xFE, 0x00, 0xBB, 0x02, 0x60, 0x00, 0x61, 0x08, 0x24, 0xD7, 0x00,
+	 0x60, 0xFE, 0xA1, 0xD3, 0xFF, 0xFF, 0xFA, 0xA4, 0xFF, 0xFF, 0x01, 0x05, 0x50, 0x01, 0xDD, 0x81,
+	 0xA1, 0xD1, 0xFF, 0xFF, 0x64, 0x40, 0x00, 0x3A, 0x4A, 0x01, 0xDD, 0x81, 0xA1, 0xD1, 0xFF, 0xFF,
+	 0x64, 0x40, 0x50, 0x3A, 0x44, 0x01, 0xDD, 0x81, 0xA1, 0xD1, 0xFF, 0xFF, 0x64, 0x40, 0xF2, 0x3A,
+	 0x3E, 0x01, 0xDD, 0x81, 0xA1, 0xD1, 0xFF, 0xFF, 0x64, 0x40, 0x01, 0x3A, 0x20, 0x01, 0xDD, 0x81,
+	 0xA1, 0xD1, 0xFF, 0xFF, 0x64, 0x40, 0x01, 0x3A, 0x1A, 0x01, 0xDD, 0x81, 0xA1, 0xD1, 0xFF, 0xFF,
+	 0x64, 0x40, 0x00, 0x3A, 0x14, 0x01, 0x60, 0x5C, 0x00, 0x36, 0x30, 0x00, 0x00, 0x64, 0xD8, 0x60,
+	 0x58, 0x4E, 0xC4, 0x78, 0xFF, 0xFF, 0x21, 0x60, 0xF6, 0x62, 0xA2, 0xDB, 0x64, 0x40, 0x00, 0x36,
+	 0x2B, 0x00, 0xDD, 0x81, 0xA1, 0xD3, 0xDD, 0x81, 0xD8, 0x60, 0x58, 0x4E, 0xC4, 0x78, 0xFF, 0xFF,
+	 0x21, 0x60, 0xF8, 0x62, 0xA2, 0xDB, 0x64, 0x40, 0x00, 0x36, 0x24, 0x00, 0xDD, 0x81, 0xA1, 0xD3,
+	 0xDD, 0x81, 0xD8, 0x60, 0x58, 0x4E, 0xC4, 0x78, 0xFF, 0xFF, 0x21, 0x60, 0xFA, 0x62, 0xA2, 0xDB,
+	 0x64, 0x40, 0x00, 0x36, 0x1D, 0x00, 0xDD, 0x81, 0xA1, 0xD1, 0x21, 0x60, 0xFC, 0x62, 0xA2, 0xD9,
+	 0xDD, 0x81, 0xA1, 0xD1, 0x21, 0x60, 0xFD, 0x62, 0xA2, 0xD9, 0x19, 0x00, 0x20, 0xFE, 0x21, 0x60,
+	 0xF6, 0x62, 0x00, 0x60, 0x04, 0x64, 0xA2, 0xDB, 0x20, 0xFE, 0x21, 0x60, 0xF8, 0x62, 0x00, 0x60,
+	 0x04, 0x64, 0xA2, 0xDB, 0x20, 0xFE, 0x21, 0x60, 0xFA, 0x62, 0x00, 0x60, 0x02, 0x64, 0xA2, 0xDB,
+	 0x20, 0xFE, 0x21, 0x60, 0xFC, 0x62, 0x00, 0x60, 0x00, 0x64, 0xA2, 0xDB, 0x00, 0x00, 0x20, 0xFE,
+	 0x21, 0x60, 0xE2, 0x62, 0xA2, 0xD1, 0x21, 0x60, 0xF6, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0xA0, 0x84,
+	 0xFF, 0xFF, 0x10, 0x26, 0x09, 0x00, 0x04, 0x26, 0x09, 0x00, 0x20, 0x26, 0x09, 0x00, 0x02, 0x26,
+	 0x09, 0x00, 0xD7, 0x60, 0x07, 0x78, 0xFF, 0xFF, 0x10, 0x7C, 0x05, 0x00, 0x04, 0x7C, 0x03, 0x00,
+	 0x20, 0x7C, 0x01, 0x00, 0x02, 0x7C, 0x21, 0x60, 0xEE, 0x61, 0xA1, 0xD9, 0x21, 0x60, 0xE4, 0x61,
+	 0xA1, 0xD1, 0x21, 0x60, 0xF8, 0x61, 0xA1, 0xD3, 0x21, 0x60, 0xEE, 0x61, 0xA0, 0x84, 0xA1, 0xD1,
+	 0xFF, 0xFF, 0x10, 0x26, 0x07, 0x00, 0x04, 0x26, 0x07, 0x00, 0x01, 0x26, 0x0D, 0x00, 0xD7, 0x60,
+	 0x07, 0x78, 0xFF, 0xFF, 0x10, 0x7C, 0x09, 0x00, 0x64, 0x40, 0x10, 0x22, 0x03, 0x00, 0xD7, 0x60,
+	 0x07, 0x78, 0xFF, 0xFF, 0x04, 0x7C, 0x01, 0x00, 0x01, 0x7C, 0x21, 0x60, 0xF0, 0x61, 0xA1, 0xD9,
+	 0x21, 0x60, 0xE6, 0x61, 0xA1, 0xD1, 0x21, 0x60, 0xFA, 0x61, 0xA1, 0xD3, 0xFF, 0xFF, 0xA0, 0x84,
+	 0x02, 0x26, 0x07, 0x00, 0x04, 0x26, 0x07, 0x00, 0x01, 0x26, 0x07, 0x00, 0xD7, 0x60, 0x07, 0x78,
+	 0xFF, 0xFF, 0x02, 0x7C, 0x03, 0x00, 0x04, 0x7C, 0x01, 0x00, 0x20, 0x7C, 0x21, 0x60, 0xF2, 0x61,
+	 0xA1, 0xD9, 0x21, 0x60, 0xFC, 0x61, 0xA1, 0xD1, 0x21, 0x60, 0xF4, 0x61, 0xA1, 0xD9, 0x21, 0x60,
+	 0xF2, 0x61, 0xA1, 0xD3, 0xFF, 0xFF, 0x60, 0x47, 0x21, 0x60, 0xF0, 0x61, 0xA1, 0xD1, 0xFF, 0xFF,
+	 0xB0, 0x84, 0x1F, 0x60, 0x92, 0x62, 0xA2, 0xD1, 0xFF, 0xFF, 0x64, 0x40, 0x01, 0x36, 0x22, 0xBC,
+	 0xAB, 0x46, 0x36, 0xFA, 0xAB, 0x46, 0x21, 0x60, 0xEE, 0x61, 0xA1, 0xD3, 0x1F, 0x60, 0x92, 0x62,
+	 0xA2, 0xD1, 0xFF, 0xFF, 0x64, 0x40, 0x01, 0x36, 0x22, 0xBC, 0x88, 0xF1, 0x66, 0x41, 0x64, 0x46,
+	 0x36, 0xFA, 0xFF, 0xFF, 0x61, 0x46, 0x50, 0x00, 0x21, 0x60, 0xFE, 0x62, 0xA2, 0xDB, 0xE0, 0x84,
+	 0xE0, 0x84, 0x03, 0x02, 0x01, 0x64, 0xA2, 0xDB, 0x02, 0x64, 0x02, 0xA5, 0x64, 0x44, 0xD4, 0x9C,
+	 0x22, 0x60, 0x00, 0x62, 0xA2, 0xD9, 0x22, 0x60, 0x02, 0x62, 0xA2, 0xDF, 0xDD, 0x81, 0xA1, 0xD1,
+	 0x00, 0x65, 0x64, 0x40, 0x00, 0x3A, 0x01, 0x65, 0xDD, 0x81, 0xA1, 0xD1, 0xFF, 0xFF, 0x64, 0x40,
+	 0x50, 0x3A, 0x01, 0x65, 0xDD, 0x81, 0xA1, 0xD1, 0xFF, 0xFF, 0x64, 0x40, 0xF2, 0x3A, 0x01, 0x65,
+	 0xDD, 0x81, 0xA1, 0xD1, 0x65, 0x40, 0x00, 0x3A, 0x18, 0x00, 0x00, 0x60, 0x00, 0x65, 0x64, 0x40,
+	 0x00, 0x36, 0x01, 0x65, 0x64, 0x40, 0x01, 0x36, 0x02, 0x65, 0x64, 0x40, 0x02, 0x36, 0x04, 0x65,
+	 0x64, 0x40, 0x04, 0x36, 0x10, 0x65, 0x64, 0x40, 0x05, 0x36, 0x20, 0x65, 0x65, 0x5C, 0x22, 0x60,
+	 0x02, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0xB0, 0x84, 0xA2, 0xDB, 0x21, 0x60, 0xFE, 0x62, 0xA2, 0xD3,
+	 0xFF, 0xFF, 0xFF, 0xA4, 0xA2, 0xDB, 0xCA, 0x02, 0x22, 0x60, 0x02, 0x62, 0xA2, 0xD3, 0x22, 0x60,
+	 0x00, 0x62, 0xA2, 0xD1, 0x2E, 0x58, 0xFF, 0xFF, 0xAB, 0x46, 0x82, 0xF0, 0xC0, 0x67, 0xB4, 0x84,
+	 0xAB, 0x46, 0x0B, 0xFA, 0x1F, 0x60, 0xA0, 0x64, 0xA0, 0xD1, 0x22, 0x60, 0xD4, 0x7C, 0x04, 0x1B,
+	 0xFF, 0x60, 0xFF, 0x63, 0xA4, 0xDD, 0x29, 0x00, 0x23, 0x60, 0x3C, 0x63, 0xA4, 0xDD, 0xDB, 0x83,
+	 0x60, 0xFE, 0x00, 0x64, 0xBD, 0xDB, 0x60, 0x64, 0xBD, 0xDB, 0x1D, 0x64, 0xBD, 0xDB, 0xC3, 0xF3,
+	 0xBD, 0xDB, 0xFF, 0xFF, 0x20, 0xFE, 0x01, 0x60, 0x78, 0x64, 0x06, 0x61, 0x58, 0xD1, 0xFF, 0xFF,
+	 0x60, 0xFE, 0xBD, 0xD9, 0x20, 0xFE, 0xCD, 0x81, 0x61, 0x40, 0x08, 0x28, 0xF7, 0x01, 0xB7, 0xF1,
+	 0xFF, 0xFF, 0x64, 0x47, 0x60, 0xFE, 0xBD, 0xD9, 0xBD, 0xDB, 0x20, 0xFE, 0x1F, 0x60, 0x9C, 0x64,
+	 0xA0, 0xD1, 0x60, 0xFE, 0xBD, 0xD9, 0xFF, 0xFF, 0x20, 0xFE, 0x22, 0x60, 0xD2, 0x64, 0x40, 0x48,
+	 0x18, 0x61, 0x26, 0x46, 0x00, 0xF4, 0xFF, 0x60, 0xF2, 0x64, 0xE1, 0x60, 0x58, 0x4D, 0xE5, 0x78,
+	 0xFF, 0xFF, 0x26, 0x46, 0x3F, 0xFC, 0x2B, 0x46, 0x56, 0xF1, 0x16, 0x60, 0xAC, 0x61, 0x1B, 0xF8,
+	 0xA1, 0xD1, 0x10, 0x60, 0x00, 0x64, 0xA0, 0x80, 0x06, 0xF2, 0x0C, 0x03, 0x10, 0xBC, 0x06, 0xFA,
+	 0x87, 0xF3, 0x00, 0x60, 0xE2, 0x62, 0xA2, 0xD3, 0x60, 0x45, 0xD4, 0x80, 0xDC, 0x84, 0x07, 0x07,
+	 0xA2, 0xDB, 0x05, 0x00, 0x10, 0xB5, 0xFF, 0xFF, 0x02, 0x03, 0xD4, 0x84, 0x06, 0xFA, 0x07, 0xF2,
+	 0x66, 0x45, 0x60, 0x46, 0x06, 0xF2, 0x65, 0x46, 0x02, 0xB0, 0xFF, 0xFF, 0x12, 0x03, 0x26, 0x46,
+	 0x88, 0xF3, 0x07, 0xFA, 0x1B, 0x60, 0xDA, 0x62, 0x1B, 0x60, 0x8E, 0x64, 0xA2, 0xDB, 0x26, 0x44,
+	 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xC1, 0xFE, 0x00, 0x66, 0x46, 0x46,
+	 0x4C, 0x00, 0x26, 0x46, 0x88, 0xF3, 0x07, 0xFA, 0x1B, 0x60, 0xDA, 0x62, 0x1B, 0x60, 0x8E, 0x64,
+	 0xA2, 0xDB, 0x26, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xC1, 0xFE,
+	 0x00, 0x66, 0x46, 0x46, 0x1A, 0x00, 0x00, 0x60, 0xC0, 0x64, 0x2A, 0xFA, 0x02, 0x64, 0x3F, 0xFA,
+	 0x88, 0xF3, 0x07, 0xFA, 0x00, 0xF4, 0x09, 0x64, 0x09, 0xFA, 0x1B, 0x60, 0xDA, 0x62, 0x1B, 0x60,
+	 0x8E, 0x64, 0xA2, 0xDB, 0x26, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF,
+	 0xC1, 0xFE, 0x00, 0x66, 0x46, 0x46, 0x2F, 0x58, 0xFF, 0xFF, 0x2B, 0x43, 0x14, 0x60, 0xD0, 0x62,
+	 0xA2, 0xD3, 0xDA, 0x81, 0x60, 0x45, 0xD5, 0x80, 0xA1, 0xD1, 0x11, 0x03, 0xD3, 0x80, 0xD9, 0x81,
+	 0xFA, 0x02, 0xC9, 0x81, 0xC8, 0x85, 0xD5, 0x80, 0xA5, 0xD3, 0x08, 0x28, 0xA1, 0xDB, 0x14, 0x60,
+	 0xD0, 0x62, 0x65, 0x44, 0xA2, 0xDB, 0x4A, 0xD3, 0xFF, 0xFF, 0xCC, 0x84, 0xA2, 0xDB, 0xAB, 0x46,
+	 0x06, 0xF2, 0xFF, 0xFF, 0x02, 0xBC, 0x06, 0xFA, 0xAB, 0x46, 0xAB, 0x46, 0x0F, 0x60, 0xFF, 0x64,
+	 0x02, 0xF0, 0x72, 0xF1, 0xA0, 0x84, 0xD0, 0x80, 0x02, 0xFA, 0xAB, 0x46, 0x01, 0x06, 0x72, 0xFB,
+	 0x27, 0x41, 0x01, 0xB1, 0xFF, 0xFF, 0x08, 0x03, 0x2B, 0x46, 0x0B, 0x58, 0x01, 0x65, 0xE2, 0x60,
+	 0x58, 0x4E, 0x86, 0x78, 0xFF, 0xFF, 0x0A, 0x00, 0x2B, 0x46, 0x0B, 0x58, 0x16, 0x60, 0xA2, 0x64,
+	 0x40, 0x59, 0x02, 0x65, 0xE2, 0x60, 0x58, 0x4E, 0x86, 0x78, 0xFF, 0xFF, 0x00, 0x66, 0x46, 0x46,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x26, 0x46, 0x00, 0xF4, 0x00, 0x64, 0x09, 0xFA, 0x0B, 0xFA, 0x01, 0x7E,
+	 0x0C, 0xFA, 0x0A, 0x64, 0x0A, 0xFA, 0x26, 0x46, 0x08, 0x64, 0x3F, 0xFA, 0x07, 0xF2, 0x88, 0xF1,
+	 0x40, 0x58, 0x07, 0xF8, 0x1B, 0x60, 0xDA, 0x62, 0x1B, 0x60, 0x8E, 0x64, 0xA2, 0xDB, 0x26, 0x44,
+	 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xC1, 0xFE, 0xFF, 0x60, 0xFD, 0x65,
+	 0x38, 0x46, 0x06, 0xF2, 0xFF, 0xFF, 0xA4, 0x83, 0x06, 0xFC, 0x02, 0xB0, 0x26, 0x46, 0x1C, 0x03,
+	 0x38, 0x43, 0x87, 0xF1, 0x14, 0x60, 0xCE, 0x61, 0xA1, 0xD3, 0xDA, 0x81, 0xD0, 0x80, 0xDC, 0x9C,
+	 0x05, 0x05, 0xA1, 0xD3, 0x4A, 0xD9, 0xA0, 0xDD, 0xDA, 0x9C, 0xA1, 0xD9, 0x02, 0x60, 0x00, 0x61,
+	 0x2C, 0xF2, 0xA1, 0xDB, 0x2D, 0xF2, 0x41, 0x58, 0x59, 0xDB, 0x2E, 0xF2, 0x59, 0xDB, 0x03, 0x65,
+	 0xE2, 0x60, 0x58, 0x4E, 0x86, 0x78, 0xFF, 0xFF, 0x00, 0x66, 0x46, 0x46, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x07, 0xF2, 0x88, 0xF1, 0xFF, 0xFF, 0xD0, 0x80, 0xFF, 0xFF, 0x02, 0x02, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x40, 0x47, 0x07, 0xF2, 0x66, 0x45, 0x60, 0x46, 0x06, 0xF2, 0x65, 0x46, 0x02, 0xB0, 0xFF, 0xFF,
+	 0x1B, 0x02, 0x27, 0x43, 0x14, 0x60, 0xD0, 0x62, 0xA2, 0xD3, 0xDA, 0x81, 0x60, 0x45, 0xD5, 0x80,
+	 0xA1, 0xD1, 0x11, 0x03, 0xD3, 0x80, 0xD9, 0x81, 0xFA, 0x02, 0xC9, 0x81, 0xC8, 0x85, 0xD5, 0x80,
+	 0xA5, 0xD3, 0x08, 0x28, 0xA1, 0xDB, 0x14, 0x60, 0xD0, 0x62, 0x65, 0x44, 0xA2, 0xDB, 0x4A, 0xD3,
+	 0xFF, 0xFF, 0xCC, 0x84, 0xA2, 0xDB, 0x0C, 0x00, 0x27, 0x44, 0x40, 0x58, 0x03, 0x65, 0xE2, 0x60,
+	 0x58, 0x4E, 0x86, 0x78, 0xFF, 0xFF, 0x27, 0x43, 0xE4, 0x60, 0x58, 0x4E, 0x9D, 0x78, 0xFF, 0xFF,
+	 0x26, 0x46, 0x87, 0xF4, 0x66, 0x41, 0x63, 0x46, 0x05, 0xF2, 0x00, 0xF0, 0x81, 0xF0, 0x02, 0x18,
+	 0x64, 0x46, 0x81, 0xF8, 0x07, 0x1B, 0x12, 0x60, 0xCE, 0x65, 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84,
+	 0x44, 0xD9, 0x02, 0x00, 0x65, 0x46, 0x00, 0xF8, 0x88, 0xF3, 0x63, 0x45, 0x60, 0x46, 0x00, 0xF2,
+	 0xFF, 0xFF, 0xD4, 0x80, 0x01, 0x18, 0xFA, 0x04, 0x80, 0xF8, 0x65, 0x46, 0x00, 0xFA, 0x06, 0xF2,
+	 0xFF, 0xFF, 0x00, 0x7E, 0x06, 0xFA, 0x61, 0x46, 0x2F, 0x58, 0xFF, 0xFF, 0x07, 0xF2, 0x88, 0xF1,
+	 0xFF, 0xFF, 0xD0, 0x80, 0xFF, 0xFF, 0x02, 0x02, 0x2F, 0x58, 0xFF, 0xFF, 0x40, 0x47, 0x07, 0xF2,
+	 0x66, 0x45, 0x60, 0x46, 0x06, 0xF2, 0x65, 0x46, 0x02, 0xB0, 0xFF, 0xFF, 0x02, 0x02, 0x2F, 0x58,
+	 0xFF, 0xFF, 0x27, 0x46, 0x06, 0xF0, 0xFF, 0x60, 0xED, 0x64, 0xA0, 0x84, 0x06, 0xFA, 0x27, 0x43,
+	 0x87, 0xF1, 0x14, 0x60, 0xCE, 0x61, 0xA1, 0xD3, 0xDA, 0x81, 0xD0, 0x80, 0xDC, 0x9C, 0x05, 0x05,
+	 0xA1, 0xD3, 0x4A, 0xD9, 0xA0, 0xDD, 0xDA, 0x9C, 0xA1, 0xD9, 0x07, 0x58, 0x03, 0x65, 0xE2, 0x60,
+	 0x58, 0x4E, 0x86, 0x78, 0xFF, 0xFF, 0x27, 0x43, 0xE4, 0x60, 0x58, 0x4E, 0x9D, 0x78, 0xFF, 0xFF,
+	 0x26, 0x46, 0x2F, 0x58, 0xFF, 0xFF, 0x26, 0x46, 0x2F, 0xF2, 0x2C, 0xFA, 0x30, 0xF2, 0x2D, 0xFA,
+	 0x31, 0xF2, 0x2E, 0xFA, 0xCB, 0xF3, 0x2F, 0xFA, 0xCC, 0xF3, 0x30, 0xFA, 0xCD, 0xF3, 0x31, 0xFA,
+	 0x67, 0xF3, 0x32, 0xFA, 0x68, 0xF3, 0x33, 0xFA, 0x69, 0xF3, 0x34, 0xFA, 0xAC, 0xF1, 0x19, 0xF8,
+	 0x1C, 0xF2, 0x13, 0xFA, 0x02, 0x63, 0x3F, 0xFC, 0x00, 0x64, 0x3E, 0xFA, 0x02, 0x60, 0x00, 0x61,
+	 0x2C, 0xF2, 0xA1, 0xDB, 0x2D, 0xF2, 0x41, 0x58, 0x59, 0xDB, 0x2E, 0xF2, 0x59, 0xDB, 0x06, 0x63,
+	 0x07, 0xF2, 0x88, 0xF1, 0xFF, 0xFF, 0xD0, 0x80, 0xFF, 0xFF, 0x0D, 0x02, 0x43, 0x59, 0x02, 0x65,
+	 0xE2, 0x60, 0x58, 0x4E, 0x5B, 0x78, 0xFF, 0xFF, 0x26, 0x46, 0xC0, 0x64, 0x2A, 0xFA, 0x00, 0xF4,
+	 0x06, 0x64, 0x09, 0xFA, 0x15, 0x00, 0x07, 0xF2, 0x66, 0x45, 0x60, 0x46, 0x06, 0xF2, 0x65, 0x46,
+	 0x02, 0xB0, 0xFF, 0xFF, 0x1E, 0x02, 0x07, 0x63, 0x43, 0x59, 0x01, 0x65, 0xE2, 0x60, 0x58, 0x4E,
+	 0x5B, 0x78, 0xFF, 0xFF, 0x26, 0x46, 0xA0, 0x64, 0x2A, 0xFA, 0x00, 0xF4, 0x07, 0x64, 0x09, 0xFA,
+	 0x26, 0x46, 0x88, 0xF3, 0x07, 0xFA, 0x1B, 0x60, 0xDA, 0x62, 0x1B, 0x60, 0x8E, 0x64, 0xA2, 0xDB,
+	 0x26, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xC1, 0xFE, 0x00, 0x66,
+	 0x46, 0x46, 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60, 0xFE, 0x62, 0xDB, 0x60, 0xB0, 0x64, 0xA2, 0xDB,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60, 0xEA, 0x62, 0x00, 0x60, 0x03, 0x64, 0xA2, 0xDB, 0xDB, 0x60,
+	 0x4D, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60, 0xE8, 0x62, 0xA2, 0xD1,
+	 0x00, 0x60, 0x02, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x5A, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x72, 0xF3,
+	 0x88, 0xF5, 0xDC, 0x81, 0x66, 0x43, 0x02, 0xA3, 0x63, 0x46, 0xCD, 0x81, 0x06, 0xF2, 0xED, 0x03,
+	 0x60, 0x40, 0x08, 0x2A, 0xF7, 0x01, 0x0C, 0xAC, 0x06, 0xFA, 0x46, 0x49, 0x00, 0x60, 0x02, 0x61,
+	 0xB3, 0x60, 0x58, 0x4D, 0x77, 0x78, 0xFF, 0xFF, 0xE0, 0x03, 0x25, 0x60, 0x2C, 0x61, 0xA1, 0xD3,
+	 0xFF, 0xFF, 0x03, 0x1B, 0x00, 0x60, 0xA0, 0x64, 0x02, 0x00, 0x00, 0x60, 0xC0, 0x64, 0x2A, 0xFA,
+	 0xAB, 0xFC, 0x66, 0x45, 0x29, 0x44, 0x07, 0xFA, 0x29, 0x46, 0x03, 0xF2, 0x04, 0xF0, 0x85, 0xF2,
+	 0x65, 0x46, 0x2C, 0xFA, 0x2D, 0xF8, 0xAE, 0xFA, 0xCB, 0xF3, 0x2F, 0xFA, 0x32, 0xFA, 0xCC, 0xF3,
+	 0x30, 0xFA, 0x33, 0xFA, 0xCD, 0xF3, 0x31, 0xFA, 0x34, 0xFA, 0xAC, 0xF1, 0x19, 0xF8, 0x18, 0x67,
+	 0x0E, 0xFA, 0x66, 0x45, 0x63, 0x46, 0x0E, 0xF2, 0x65, 0x46, 0x00, 0x7E, 0x13, 0xFA, 0x02, 0x63,
+	 0x3F, 0xFC, 0x00, 0x64, 0x3E, 0xFA, 0x66, 0x41, 0x00, 0xF4, 0x25, 0x60, 0x28, 0x62, 0xA2, 0xD3,
+	 0xFF, 0xFF, 0x09, 0xFA, 0x1B, 0x60, 0xDA, 0x62, 0x1B, 0x60, 0x9A, 0x64, 0xA2, 0xDB, 0x61, 0x44,
+	 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xC8, 0xFE, 0x9E, 0x01, 0x92, 0x01,
+	 0x0F, 0x60, 0xE8, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x5A, 0xDB, 0x2F, 0x58, 0xFF, 0xFF, 0x07, 0xF0,
+	 0xFF, 0xFF, 0x64, 0x43, 0x14, 0x60, 0xD0, 0x62, 0xA2, 0xD3, 0xDA, 0x81, 0x60, 0x45, 0xD5, 0x80,
+	 0xA1, 0xD1, 0x04, 0x03, 0xD3, 0x80, 0xD9, 0x81, 0xFA, 0x02, 0x09, 0x00, 0xA1, 0xDD, 0x14, 0x60,
+	 0xD0, 0x62, 0xD9, 0x84, 0xA2, 0xDB, 0x4A, 0xD3, 0xFF, 0xFF, 0xDC, 0x84, 0xA2, 0xDB, 0x66, 0x45,
+	 0x63, 0x46, 0x06, 0xF2, 0xFF, 0x60, 0x01, 0x7C, 0xA0, 0x9C, 0x06, 0xF8, 0x65, 0x46, 0x71, 0xF3,
+	 0x60, 0x40, 0x10, 0x2A, 0x03, 0x00, 0xCC, 0x84, 0x80, 0x2B, 0x71, 0xFB, 0x0F, 0x60, 0xE8, 0x62,
+	 0xA2, 0xD1, 0x00, 0x60, 0x02, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x0F, 0x60, 0xDC, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x0F, 0x60, 0xDE, 0x62, 0x00, 0x60, 0x02, 0x64,
+	 0xA2, 0xDB, 0xDB, 0x60, 0xF7, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x71, 0xF3,
+	 0x72, 0xF3, 0x00, 0xA8, 0x60, 0x88, 0x50, 0x03, 0xE0, 0x83, 0x6C, 0x03, 0xCB, 0x83, 0x88, 0xF3,
+	 0x73, 0xF1, 0x02, 0xA4, 0x40, 0x47, 0x64, 0x45, 0x27, 0x46, 0x72, 0xF4, 0x12, 0xF2, 0x40, 0x18,
+	 0xD4, 0x80, 0x02, 0x64, 0x3D, 0x07, 0x23, 0xFA, 0x2A, 0xF2, 0x0E, 0xF2, 0x0C, 0xB0, 0x02, 0xF0,
+	 0x0D, 0x02, 0x1B, 0x60, 0xDA, 0x62, 0x1B, 0x60, 0x8E, 0x64, 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB,
+	 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xC1, 0xFE, 0xE6, 0x01, 0x60, 0x40, 0xF0, 0x37,
+	 0x08, 0x00, 0x09, 0x60, 0x08, 0x64, 0xD0, 0x80, 0xA2, 0xFF, 0x90, 0xF3, 0x02, 0x02, 0xDC, 0x84,
+	 0x90, 0xFB, 0x1B, 0x60, 0xDA, 0x62, 0x1B, 0x60, 0xAC, 0x64, 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB,
+	 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xA3, 0xFF, 0xCE, 0xFE, 0x98, 0xF1, 0x1E, 0x60,
+	 0xEC, 0x64, 0xA0, 0xD3, 0xFF, 0xFF, 0xDC, 0x84, 0xDC, 0x80, 0xD0, 0x80, 0x04, 0x03, 0xA2, 0xDB,
+	 0x08, 0x24, 0xC6, 0xFE, 0x04, 0x00, 0x8A, 0xFF, 0x20, 0x60, 0x00, 0x75, 0x88, 0xFF, 0xBC, 0x01,
+	 0x27, 0x44, 0x02, 0xA4, 0x40, 0x47, 0xB8, 0x1F, 0x28, 0x43, 0xCB, 0x83, 0x88, 0xF3, 0x1A, 0x0E,
+	 0x02, 0xA4, 0x40, 0x4C, 0x43, 0x48, 0x2C, 0x46, 0x1E, 0xF2, 0x73, 0xF1, 0xAC, 0x86, 0x12, 0xF2,
+	 0x0C, 0x03, 0xD0, 0x80, 0xFF, 0xFF, 0x09, 0x07, 0x1B, 0x60, 0xDA, 0x64, 0x40, 0x4B, 0xF0, 0x60,
+	 0x58, 0x4D, 0x75, 0x78, 0xFF, 0xFF, 0x2C, 0x46, 0x9E, 0xFC, 0x2C, 0x44, 0x02, 0xA4, 0x28, 0x43,
+	 0x40, 0x4C, 0xE8, 0x1F, 0x7D, 0x01, 0x01, 0x63, 0x66, 0xF3, 0xAC, 0xF3, 0x00, 0xBD, 0xAC, 0x81,
+	 0x06, 0x03, 0x05, 0x03, 0xB5, 0x60, 0x58, 0x4D, 0xC1, 0x78, 0xFF, 0xFF, 0x60, 0x43, 0x5B, 0xFD,
+	 0x3E, 0x63, 0x16, 0x60, 0x60, 0x61, 0x00, 0x64, 0x59, 0xDB, 0xFE, 0x1F, 0x71, 0xFB, 0x72, 0xFB,
+	 0x16, 0x60, 0xA8, 0x65, 0x00, 0x64, 0xA5, 0xDB, 0x5A, 0xDB, 0x2F, 0x58, 0xFF, 0xFF, 0x1B, 0x60,
+	 0x9A, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0x00, 0xA8, 0x60, 0x46, 0x03, 0x02, 0xC7, 0x60, 0x2E, 0x78,
+	 0xFF, 0xFF, 0x07, 0xF0, 0x66, 0x45, 0x64, 0x46, 0x1B, 0xF2, 0x65, 0x46, 0x64, 0x45, 0x5B, 0xF1,
+	 0xE0, 0x84, 0x73, 0xF1, 0xC0, 0x84, 0xC0, 0x84, 0x12, 0xFA, 0x2C, 0xF2, 0x71, 0xF3, 0x60, 0x40,
+	 0x01, 0x2A, 0x36, 0x00, 0x00, 0xA8, 0x1F, 0x60, 0x8E, 0x62, 0xA2, 0xD3, 0x37, 0x03, 0x00, 0xA8,
+	 0xFF, 0xFF, 0x34, 0x03, 0xDE, 0x60, 0x58, 0x4D, 0x6B, 0x78, 0xFF, 0xFF, 0x25, 0x46, 0x09, 0x60,
+	 0x08, 0x61, 0xA2, 0xFF, 0x0E, 0xF2, 0x02, 0xF0, 0x60, 0x40, 0xF0, 0x37, 0x0D, 0x00, 0x92, 0xF3,
+	 0x90, 0xF3, 0xDC, 0x83, 0xD1, 0x80, 0x92, 0xFD, 0x0C, 0x03, 0x8C, 0xF3, 0xCC, 0x83, 0xD8, 0xA0,
+	 0x90, 0xFD, 0x07, 0x04, 0xD4, 0xFE, 0x05, 0x00, 0xD1, 0x80, 0x93, 0xF3, 0x02, 0x03, 0xDC, 0x84,
+	 0x93, 0xFB, 0x1B, 0x60, 0xDA, 0x62, 0x1B, 0x60, 0x94, 0x64, 0xA2, 0xDB, 0x25, 0x44, 0x5A, 0xDB,
+	 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xA3, 0xFF, 0xDC, 0x60, 0x87, 0x78, 0xFF, 0xFF,
+	 0x66, 0x41, 0x65, 0x46, 0x06, 0xF2, 0x61, 0x46, 0x60, 0x40, 0x10, 0x2A, 0x4C, 0x00, 0x80, 0x67,
+	 0xB4, 0x81, 0x1B, 0x60, 0xDA, 0x62, 0x61, 0x44, 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64,
+	 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xDE, 0x60, 0x58, 0x4D, 0x6B, 0x78, 0xFF, 0xFF, 0x25, 0x46,
+	 0x2A, 0xF2, 0x09, 0x60, 0x08, 0x61, 0x0C, 0xB0, 0xA2, 0xFF, 0x17, 0x03, 0x0E, 0xF2, 0x02, 0xF0,
+	 0x60, 0x40, 0xF0, 0x37, 0x0D, 0x00, 0x90, 0xF3, 0x92, 0xF3, 0xCC, 0x83, 0xD1, 0x80, 0x90, 0xFD,
+	 0x0C, 0x03, 0x8C, 0xF3, 0xDC, 0x83, 0xD8, 0xA0, 0x92, 0xFD, 0x07, 0x04, 0xD4, 0xFE, 0x05, 0x00,
+	 0xD1, 0x80, 0x93, 0xF3, 0x02, 0x03, 0xDC, 0x84, 0x93, 0xFB, 0x07, 0xF0, 0x0A, 0xF2, 0xA3, 0xFF,
+	 0x64, 0x45, 0x30, 0x1B, 0x66, 0x41, 0x65, 0x46, 0x02, 0xF0, 0x61, 0x46, 0x0F, 0x60, 0xFF, 0x61,
+	 0xA1, 0x84, 0x60, 0x41, 0xE9, 0x81, 0xE9, 0x81, 0xE9, 0x81, 0xE1, 0x82, 0x07, 0xB4, 0x01, 0x61,
+	 0x03, 0x03, 0xCC, 0x84, 0xE1, 0x81, 0xFD, 0x02, 0x16, 0x60, 0x62, 0x65, 0x46, 0xD1, 0x61, 0x44,
+	 0xB0, 0x84, 0xA2, 0xDB, 0x17, 0x00, 0x1B, 0x60, 0x8E, 0x61, 0x2A, 0xF2, 0x3E, 0xF2, 0x0C, 0xB0,
+	 0x01, 0xB0, 0x05, 0x03, 0x1B, 0x60, 0xA0, 0x61, 0x02, 0x02, 0x1B, 0x60, 0x88, 0x61, 0x1B, 0x60,
+	 0xDA, 0x62, 0x61, 0x44, 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF,
+	 0x2B, 0xFF, 0xC1, 0xFE, 0xDC, 0x60, 0x87, 0x78, 0xFF, 0xFF, 0x07, 0xF0, 0x2B, 0xF2, 0x2A, 0xF2,
+	 0x60, 0x41, 0x44, 0x49, 0x60, 0x45, 0xA4, 0x3A, 0x0D, 0x00, 0x61, 0x40, 0xC0, 0x3B, 0x7B, 0x00,
+	 0xA9, 0x46, 0x06, 0xF2, 0xA9, 0x46, 0x60, 0x40, 0x20, 0x26, 0x75, 0x00, 0x20, 0xBC, 0xA9, 0x46,
+	 0x06, 0xFA, 0xA9, 0x46, 0xA9, 0x46, 0x06, 0xF0, 0xA9, 0x46, 0x65, 0x40, 0x10, 0x2B, 0x6E, 0x00,
+	 0x64, 0x40, 0x10, 0x2A, 0x36, 0x00, 0x65, 0x40, 0xA4, 0x3A, 0x65, 0x00, 0x29, 0x45, 0x65, 0x46,
+	 0x72, 0xF2, 0xFF, 0xFF, 0x00, 0xA8, 0x60, 0x46, 0x04, 0x02, 0x78, 0x00, 0xDE, 0x60, 0x51, 0x78,
+	 0xFF, 0xFF, 0x09, 0xF2, 0x2A, 0xF0, 0x00, 0xA8, 0x20, 0x67, 0x02, 0x03, 0xB0, 0x84, 0x2A, 0xFA,
+	 0x0E, 0xF2, 0x02, 0xF0, 0x60, 0x40, 0xF0, 0x37, 0x08, 0x00, 0x09, 0x60, 0x08, 0x64, 0xD0, 0x80,
+	 0xA2, 0xFF, 0x90, 0xF3, 0x02, 0x02, 0xDC, 0x84, 0x90, 0xFB, 0x3E, 0xF2, 0xA3, 0xFF, 0x01, 0xB0,
+	 0x1B, 0x60, 0xA0, 0x61, 0x02, 0x02, 0x1B, 0x60, 0x8E, 0x61, 0x1B, 0x60, 0xDA, 0x62, 0x61, 0x44,
+	 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xC1, 0xFE,
+	 0x17, 0x00, 0x10, 0x64, 0xB0, 0x84, 0xDF, 0x65, 0xA4, 0x9E, 0xA9, 0x46, 0x06, 0xFA, 0xA9, 0x46,
+	 0xA2, 0xFF, 0x16, 0x60, 0xA8, 0x62, 0x04, 0x64, 0xA2, 0xDB, 0x29, 0x44, 0x5A, 0xDB, 0x71, 0xF3,
+	 0xC1, 0xFE, 0xD4, 0xFE, 0x87, 0xF1, 0xA3, 0xFF, 0xD0, 0x80, 0xDC, 0x84, 0x01, 0x07, 0x71, 0xFB,
+	 0xA9, 0x46, 0x72, 0xF2, 0xA9, 0x46, 0x65, 0x18, 0xA9, 0x46, 0x02, 0xF0, 0xA9, 0x46, 0x0F, 0x60,
+	 0xFF, 0x61, 0xA1, 0x84, 0x60, 0x41, 0xE9, 0x81, 0xE9, 0x81, 0xE9, 0x81, 0xE1, 0x82, 0x07, 0xB4,
+	 0x01, 0x61, 0x03, 0x03, 0xCC, 0x84, 0xE1, 0x81, 0xFD, 0x02, 0x16, 0x60, 0x62, 0x65, 0x46, 0xD1,
+	 0xFF, 0xFF, 0xB1, 0x84, 0xA2, 0xDB, 0xDE, 0x60, 0x68, 0x78, 0xFF, 0xFF, 0x64, 0x40, 0x10, 0x2A,
+	 0xFA, 0x01, 0xFF, 0x60, 0xEF, 0x64, 0xA0, 0x84, 0xA9, 0x46, 0x06, 0xFA, 0xA9, 0x46, 0x65, 0x41,
+	 0x71, 0xF3, 0x29, 0x45, 0xCC, 0x84, 0x80, 0x2B, 0x71, 0xFB, 0x65, 0x46, 0x72, 0xF2, 0xFF, 0xFF,
+	 0x00, 0xA8, 0x60, 0x46, 0x37, 0x02, 0x61, 0x40, 0xA4, 0x3A, 0xE5, 0x01, 0x00, 0x60, 0x3A, 0x61,
+	 0xB3, 0x60, 0x58, 0x4D, 0x77, 0x78, 0xFF, 0xFF, 0x81, 0x03, 0x02, 0x60, 0x48, 0x64, 0x2A, 0xFA,
+	 0xCB, 0xF1, 0x2F, 0xF8, 0xCC, 0xF1, 0x30, 0xF8, 0xCD, 0xF1, 0x31, 0xF8, 0x67, 0xF1, 0x32, 0xF8,
+	 0x68, 0xF1, 0x33, 0xF8, 0x69, 0xF1, 0x34, 0xF8, 0xA9, 0x46, 0x03, 0xF2, 0x04, 0xF0, 0x85, 0xF0,
+	 0xA9, 0x46, 0x2C, 0xFA, 0x2D, 0xF8, 0xAE, 0xF8, 0xAC, 0xF1, 0x19, 0xF8, 0xFF, 0x67, 0x0E, 0xFA,
+	 0x00, 0x64, 0x3E, 0xFA, 0x3F, 0xFA, 0x29, 0x44, 0x07, 0xFA, 0x1B, 0x60, 0xDA, 0x62, 0x1B, 0x60,
+	 0x8E, 0x64, 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF,
+	 0xC1, 0xFE, 0x37, 0x00, 0x80, 0x67, 0xB4, 0x83, 0x2A, 0xF2, 0x09, 0x60, 0x08, 0x65, 0x0C, 0xB0,
+	 0x09, 0xF0, 0x0D, 0x02, 0x1B, 0x60, 0xDA, 0x62, 0x1B, 0x60, 0x8E, 0x64, 0xA2, 0xDB, 0x66, 0x44,
+	 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0x9D, 0x18, 0x64, 0x46, 0x3E, 0xF2,
+	 0xA2, 0xFF, 0x01, 0xB0, 0x1B, 0x60, 0xA0, 0x61, 0x02, 0x02, 0x1B, 0x60, 0x88, 0x61, 0x02, 0xF2,
+	 0x0E, 0xF0, 0xD4, 0x80, 0x09, 0xF4, 0x06, 0x02, 0x90, 0xF3, 0x64, 0x40, 0xF0, 0x37, 0x02, 0x00,
+	 0xDC, 0x84, 0x90, 0xFB, 0x66, 0x44, 0x00, 0xA8, 0xFF, 0xFF, 0xF1, 0x02, 0x1B, 0x60, 0xDA, 0x62,
+	 0x61, 0x44, 0xA2, 0xDB, 0x5A, 0xDD, 0x08, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xC1, 0xFE,
+	 0xA3, 0xFF, 0xA9, 0x46, 0x02, 0xF0, 0xA9, 0x46, 0x0F, 0x60, 0xFF, 0x61, 0xA1, 0x84, 0x60, 0x41,
+	 0xE9, 0x81, 0xE9, 0x81, 0xE9, 0x81, 0xE1, 0x82, 0x07, 0xB4, 0x01, 0x61, 0x03, 0x03, 0xCC, 0x84,
+	 0xE1, 0x81, 0xFD, 0x02, 0x16, 0x60, 0x62, 0x65, 0x46, 0xD3, 0x9D, 0x85, 0xA4, 0x84, 0xA2, 0xDB,
+	 0x26, 0x46, 0x2F, 0x58, 0xFF, 0xFF, 0x46, 0x45, 0x3F, 0xF2, 0x05, 0x48, 0x00, 0xA8, 0x60, 0x41,
+	 0x66, 0x44, 0x0B, 0x03, 0x0E, 0xA1, 0x00, 0xF2, 0x42, 0xFE, 0xAC, 0x86, 0x01, 0xF2, 0x1F, 0x03,
+	 0x7F, 0xB5, 0xD5, 0x81, 0x66, 0x44, 0xF7, 0x07, 0x25, 0x46, 0x05, 0xF0, 0x06, 0xFA, 0x05, 0xFA,
+	 0xD0, 0x80, 0x64, 0x43, 0x13, 0x03, 0x60, 0x46, 0x01, 0xF0, 0x80, 0x67, 0xB0, 0x84, 0x01, 0xFA,
+	 0x00, 0xF0, 0x00, 0x64, 0x00, 0xFA, 0x44, 0x45, 0xA2, 0xFF, 0xB4, 0x60, 0x58, 0x4E, 0x48, 0x78,
+	 0xFF, 0xFF, 0xA3, 0xFF, 0x08, 0x45, 0x25, 0x46, 0x01, 0x64, 0x02, 0xFA, 0x02, 0xFE, 0x2D, 0x58,
+	 0xFF, 0xFF, 0x23, 0xF2, 0x07, 0xF0, 0x10, 0xB0, 0x10, 0xAC, 0x3B, 0x03, 0x23, 0xFA, 0x80, 0x67,
+	 0xB0, 0x81, 0x1B, 0x60, 0xDA, 0x62, 0x61, 0x44, 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x04, 0x64,
+	 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0x46, 0x45, 0x64, 0x46, 0x02, 0xF0, 0x0F, 0x60, 0xFF, 0x61,
+	 0xA1, 0x84, 0x60, 0x41, 0xE9, 0x81, 0xE9, 0x81, 0xE9, 0x81, 0xE1, 0x82, 0x07, 0xB4, 0x01, 0x61,
+	 0x03, 0x03, 0xCC, 0x84, 0xE1, 0x81, 0xFD, 0x02, 0x16, 0x60, 0x62, 0x65, 0x46, 0xD1, 0xFF, 0xFF,
+	 0xB1, 0x84, 0xA2, 0xDB, 0x9B, 0xF2, 0x25, 0x46, 0xE1, 0x81, 0x5B, 0xF1, 0x73, 0xF1, 0xC1, 0x81,
+	 0xC1, 0x81, 0x92, 0xFA, 0xA2, 0xFF, 0x02, 0xF0, 0x09, 0x60, 0x08, 0x61, 0xD1, 0x80, 0x0E, 0xF2,
+	 0x05, 0x02, 0x90, 0xF3, 0x20, 0xB0, 0xCC, 0x84, 0x01, 0x02, 0x90, 0xFB, 0xA3, 0xFF, 0x48, 0xFE,
+	 0x07, 0x00, 0x0E, 0xF2, 0x08, 0xFE, 0xF0, 0x7F, 0x60, 0x40, 0x20, 0x2A, 0x00, 0x7F, 0x0E, 0xFA,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x00, 0x60, 0xA0, 0x61, 0xB3, 0x60, 0x58, 0x4D, 0x77, 0x78, 0xFF, 0xFF,
+	 0x66, 0x44, 0x57, 0xFB, 0x04, 0x64, 0x03, 0xFA, 0x80, 0x64, 0x2A, 0xFA, 0xAC, 0xF1, 0x19, 0xF8,
+	 0x00, 0x64, 0x3E, 0xFA, 0x00, 0x60, 0x80, 0x64, 0x0E, 0xFA, 0x88, 0xF1, 0x07, 0xF8, 0x67, 0x44,
+	 0x2C, 0xFA, 0x2D, 0xFA, 0x2E, 0xFA, 0x0F, 0x60, 0xF6, 0x62, 0xE1, 0x60, 0x9E, 0x64, 0xA2, 0xDB,
+	 0x10, 0x60, 0x02, 0x62, 0xE0, 0x60, 0x0D, 0x64, 0xA2, 0xDB, 0x16, 0x60, 0xB2, 0x63, 0x65, 0x44,
+	 0xBD, 0xDB, 0x10, 0x60, 0x04, 0x64, 0xBD, 0xDB, 0x02, 0x64, 0xBD, 0xDB, 0x06, 0x64, 0xA3, 0xDB,
+	 0xE6, 0x60, 0x5A, 0x78, 0xFF, 0xFF, 0xE6, 0x60, 0x58, 0x4D, 0x66, 0x78, 0xFF, 0xFF, 0x57, 0xF5,
+	 0xCB, 0xF1, 0x2F, 0xF8, 0xCC, 0xF1, 0x30, 0xF8, 0xCD, 0xF1, 0x31, 0xF8, 0x67, 0xF1, 0x32, 0xF8,
+	 0x68, 0xF1, 0x33, 0xF8, 0x69, 0xF1, 0x34, 0xF8, 0x1F, 0x60, 0x92, 0x62, 0xA2, 0xD1, 0x01, 0x64,
+	 0x64, 0x40, 0xFE, 0x26, 0x10, 0xBC, 0x32, 0x40, 0x10, 0x26, 0x10, 0xBC, 0x23, 0x60, 0x4C, 0x62,
+	 0xA2, 0xDB, 0x1F, 0x60, 0x90, 0x62, 0xA2, 0xD1, 0x1F, 0x60, 0x1E, 0x64, 0x02, 0x18, 0x1F, 0x60,
+	 0x40, 0x64, 0x22, 0x60, 0xA2, 0x62, 0xA2, 0xDB, 0x22, 0x60, 0xBE, 0x62, 0xA2, 0xDB, 0x21, 0x60,
+	 0xC6, 0x61, 0x20, 0x60, 0x32, 0x62, 0xA2, 0xD3, 0x22, 0x60, 0x82, 0x65, 0xFE, 0xA4, 0xE0, 0x84,
+	 0x02, 0x05, 0x67, 0x44, 0x99, 0x00, 0xE0, 0x84, 0xC4, 0x85, 0x21, 0x60, 0xEC, 0x62, 0xA2, 0xD3,
+	 0xA5, 0xD1, 0xDA, 0x85, 0x21, 0x60, 0xE4, 0x62, 0xA0, 0x83, 0xA2, 0xDD, 0xA5, 0xD1, 0x21, 0x60,
+	 0xE2, 0x62, 0xA0, 0x83, 0xA2, 0xDD, 0x21, 0x60, 0xC0, 0x61, 0xDD, 0x60, 0x06, 0x64, 0xA1, 0xDB,
+	 0x06, 0xA1, 0x21, 0x60, 0xEA, 0x62, 0xA2, 0xD3, 0x21, 0x60, 0xE2, 0x62, 0x60, 0x40, 0xFD, 0xA0,
+	 0xA2, 0xD3, 0x74, 0x03, 0x50, 0x60, 0x00, 0x7C, 0x60, 0x40, 0x02, 0x2A, 0x03, 0x00, 0x01, 0x60,
+	 0xF2, 0x63, 0x0E, 0x00, 0x04, 0x2A, 0x03, 0x00, 0x02, 0x60, 0xF2, 0x63, 0x09, 0x00, 0x10, 0x2A,
+	 0x03, 0x00, 0x04, 0x60, 0xF2, 0x63, 0x04, 0x00, 0x20, 0x2A, 0x04, 0x00, 0x05, 0x60, 0xF2, 0x63,
+	 0x59, 0xD9, 0x59, 0xDD, 0x21, 0x60, 0xEA, 0x62, 0xA2, 0xD3, 0x21, 0x60, 0xE4, 0x62, 0xFE, 0xA0,
+	 0xA2, 0xD3, 0x54, 0x03, 0x00, 0x60, 0x00, 0x63, 0x59, 0xDD, 0x61, 0x45, 0x60, 0x40, 0x01, 0x2A,
+	 0x04, 0x00, 0x00, 0x60, 0xF2, 0x63, 0x59, 0xD9, 0x59, 0xDD, 0x60, 0x40, 0x02, 0x2A, 0x04, 0x00,
+	 0x01, 0x60, 0xF2, 0x63, 0x59, 0xD9, 0x59, 0xDD, 0x60, 0x40, 0x04, 0x2A, 0x04, 0x00, 0x02, 0x60,
+	 0xF2, 0x63, 0x59, 0xD9, 0x59, 0xDD, 0x60, 0x40, 0x10, 0x2A, 0x04, 0x00, 0x04, 0x60, 0xF2, 0x63,
+	 0x59, 0xD9, 0x59, 0xDD, 0x60, 0x40, 0x20, 0x2A, 0x04, 0x00, 0x05, 0x60, 0xF2, 0x63, 0x59, 0xD9,
+	 0x59, 0xDD, 0xD5, 0x83, 0xEB, 0x83, 0xEB, 0x83, 0xA5, 0xDD, 0x21, 0x60, 0xEA, 0x62, 0xA2, 0xD3,
+	 0x21, 0x60, 0xE6, 0x62, 0xFF, 0xA0, 0xA2, 0xD3, 0x21, 0x03, 0x00, 0x60, 0x00, 0x63, 0x59, 0xDD,
+	 0x61, 0x45, 0x60, 0x40, 0x01, 0x2A, 0x04, 0x00, 0x00, 0x60, 0xF2, 0x63, 0x59, 0xD9, 0x59, 0xDD,
+	 0x60, 0x40, 0x02, 0x2A, 0x04, 0x00, 0x01, 0x60, 0xF2, 0x63, 0x59, 0xD9, 0x59, 0xDD, 0x60, 0x40,
+	 0x04, 0x2A, 0x04, 0x00, 0x02, 0x60, 0xF2, 0x63, 0x59, 0xD9, 0x59, 0xDD, 0xD5, 0x83, 0xEB, 0x83,
+	 0xEB, 0x83, 0xA5, 0xDD, 0x21, 0x60, 0xE8, 0x62, 0xA2, 0xD1, 0x59, 0xD9, 0x21, 0x60, 0xC0, 0x65,
+	 0xD5, 0x84, 0xDD, 0x7F, 0xA5, 0xDB, 0x65, 0x44, 0x22, 0x60, 0xAC, 0x62, 0xA2, 0xDB, 0x22, 0x60,
+	 0xC8, 0x62, 0xA2, 0xDB, 0x57, 0xF5, 0xCB, 0xF3, 0xCC, 0xF1, 0x00, 0x63, 0xC0, 0x87, 0xCD, 0xF1,
+	 0x5A, 0xFD, 0xC0, 0x85, 0x65, 0x47, 0xC4, 0x84, 0x07, 0xB5, 0x1C, 0x60, 0x10, 0x62, 0x16, 0x60,
+	 0xAE, 0x64, 0xA2, 0xDB, 0x02, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x0F, 0x60, 0xD0, 0x62,
+	 0x00, 0x64, 0xA2, 0xDB, 0x0F, 0x60, 0xD2, 0x62, 0x00, 0x60, 0x02, 0x64, 0xA2, 0xDB, 0xE0, 0x60,
+	 0x17, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60, 0xD0, 0x62, 0xA2, 0xD1,
+	 0x00, 0x60, 0x02, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60,
+	 0xD0, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x57, 0xF5, 0x00, 0x64, 0x95, 0xFB, 0x96, 0xFB, 0x97, 0xFB,
+	 0x75, 0xFB, 0x66, 0xF3, 0x00, 0x75, 0x00, 0x72, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x93, 0xC7, 0xF3,
+	 0xED, 0xE2, 0xCC, 0x84, 0x5A, 0xFB, 0x0F, 0x60, 0xD2, 0x62, 0x00, 0x60, 0x04, 0x64, 0xA2, 0xDB,
+	 0xE0, 0x60, 0x36, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60, 0xD0, 0x62,
+	 0x00, 0x64, 0xA2, 0xDB, 0x65, 0xF1, 0x23, 0x60, 0x02, 0x62, 0xA2, 0xD9, 0x22, 0x60, 0xAA, 0x65,
+	 0xE2, 0x60, 0x58, 0x4D, 0x2F, 0x78, 0xFF, 0xFF, 0xE1, 0x60, 0x58, 0x4D, 0xA8, 0x78, 0xFF, 0xFF,
+	 0xE2, 0x60, 0x58, 0x4D, 0x49, 0x78, 0xFF, 0xFF, 0x57, 0xF5, 0x00, 0xF4, 0x66, 0xF1, 0x06, 0xF8,
+	 0x23, 0x60, 0x4C, 0x62, 0xA2, 0xD3, 0x07, 0xFA, 0x22, 0x60, 0xA2, 0x64, 0x40, 0x48, 0x10, 0x61,
+	 0x00, 0x60, 0x00, 0x64, 0xE1, 0x60, 0x58, 0x4D, 0xE5, 0x78, 0xFF, 0xFF, 0x57, 0xF5, 0x3F, 0xFC,
+	 0x5A, 0xF3, 0xC7, 0xF1, 0xAC, 0x83, 0x01, 0x64, 0x02, 0x02, 0x6C, 0xFB, 0x64, 0x43, 0x1B, 0x60,
+	 0xDA, 0x62, 0x1B, 0x60, 0x8E, 0x64, 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x04, 0x64, 0x5A, 0xDB,
+	 0xFF, 0xFF, 0x2B, 0xFF, 0xC1, 0xFE, 0xCF, 0x83, 0x73, 0xF3, 0x5A, 0xFD, 0xDC, 0x84, 0x73, 0xFB,
+	 0x5C, 0xF3, 0xFF, 0xFF, 0xCC, 0x84, 0x5C, 0xFB, 0x03, 0x03, 0xE1, 0x60, 0x0A, 0x78, 0xFF, 0xFF,
+	 0x0A, 0x64, 0x5C, 0xFB, 0xA2, 0x4C, 0x20, 0x27, 0xF8, 0x01, 0x46, 0x60, 0x50, 0x65, 0x72, 0x44,
+	 0xD4, 0x80, 0xFF, 0xFF, 0xF2, 0x04, 0x5D, 0xFB, 0x40, 0x48, 0x95, 0xF3, 0x5E, 0xFB, 0x40, 0x4A,
+	 0x96, 0xF3, 0x97, 0xF3, 0x40, 0x4C, 0x60, 0x41, 0x66, 0xF1, 0x40, 0x63, 0xAD, 0x80, 0xF0, 0xA3,
+	 0x09, 0x02, 0x3C, 0x03, 0x2C, 0x41, 0x2A, 0x44, 0x40, 0x4C, 0x28, 0x44, 0x40, 0x4A, 0x00, 0x64,
+	 0x40, 0x48, 0xF4, 0x01, 0xD1, 0x80, 0x01, 0x02, 0x31, 0x04, 0x10, 0xA3, 0x80, 0x60, 0x00, 0x65,
+	 0xA5, 0x80, 0xCF, 0x83, 0x08, 0x02, 0x28, 0x44, 0x60, 0x88, 0x2A, 0x44, 0x70, 0x8A, 0x2C, 0x44,
+	 0x70, 0x8C, 0xF1, 0x81, 0xF5, 0x01, 0xE7, 0xA3, 0x64, 0x44, 0x00, 0xA0, 0x00, 0x62, 0x02, 0x02,
+	 0x00, 0x61, 0x1C, 0x00, 0xE0, 0x84, 0xDE, 0x82, 0xFD, 0x04, 0x42, 0xFE, 0xF8, 0x84, 0x62, 0x45,
+	 0xC7, 0x83, 0x60, 0x45, 0x02, 0xFE, 0xD5, 0x84, 0x02, 0x05, 0x01, 0x05, 0x61, 0x44, 0xCF, 0x83,
+	 0x60, 0x41, 0x08, 0x03, 0x28, 0x44, 0x60, 0x88, 0x2A, 0x44, 0x70, 0x8A, 0x2C, 0x44, 0x70, 0x8C,
+	 0xF1, 0x81, 0xF1, 0x01, 0xCE, 0x82, 0xE9, 0x81, 0xFD, 0x02, 0xF1, 0x81, 0x61, 0x44, 0x00, 0xA8,
+	 0xFF, 0xFF, 0x30, 0x03, 0x73, 0x40, 0x5D, 0xF3, 0xFF, 0xFF, 0x60, 0x47, 0xE8, 0x84, 0xE8, 0x84,
+	 0x5E, 0xF3, 0x3F, 0xB5, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84,
+	 0xB4, 0x84, 0x61, 0x45, 0xD4, 0x84, 0xC0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x81,
+	 0x64, 0x44, 0x73, 0x45, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xC4, 0x85, 0x61, 0x44, 0xD4, 0x80,
+	 0xFF, 0xFF, 0x10, 0x03, 0x60, 0x53, 0xD4, 0x84, 0xFF, 0xFF, 0x75, 0xF3, 0xFF, 0xFF, 0xDC, 0x84,
+	 0x01, 0xB4, 0x75, 0xFB, 0x1F, 0x60, 0x14, 0x64, 0xA0, 0xD3, 0xFF, 0xFF, 0xDC, 0x84, 0xFF, 0xFF,
+	 0x08, 0x28, 0xA2, 0xDB, 0xE6, 0x60, 0xA3, 0x78, 0xFF, 0xFF, 0xC1, 0xFE, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x04, 0x64, 0x03, 0xFA, 0x00, 0xF4, 0x09, 0xF2, 0xFF, 0xFF, 0x60, 0x47, 0x00, 0x3A, 0x1C, 0x00,
+	 0x60, 0x43, 0x00, 0x36, 0x1C, 0x00, 0xE0, 0xA0, 0xDA, 0x85, 0x16, 0x07, 0x1F, 0x60, 0x1E, 0x61,
+	 0xA1, 0xD1, 0xFF, 0xFF, 0xD3, 0x80, 0xCB, 0x83, 0x0F, 0x02, 0x07, 0x0E, 0x59, 0xD3, 0xA5, 0xD0,
+	 0xDA, 0x85, 0xD0, 0x80, 0xFF, 0xFF, 0x08, 0x02, 0xF9, 0x1F, 0x13, 0x1E, 0xA5, 0xD0, 0x59, 0xD3,
+	 0xFF, 0xFF, 0x90, 0x80, 0xFF, 0x22, 0x0D, 0x00, 0xE1, 0x60, 0x9C, 0x78, 0xFF, 0xFF, 0x1F, 0x60,
+	 0x90, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x2A, 0x03, 0x00, 0x1F, 0x60, 0x40, 0x64,
+	 0x02, 0x00, 0x1F, 0x60, 0x1E, 0x64, 0x22, 0x60, 0xBE, 0x62, 0xA2, 0xDB, 0x26, 0x46, 0x2F, 0xF2,
+	 0x2C, 0xFA, 0x30, 0xF2, 0x2D, 0xFA, 0x31, 0xF2, 0x2E, 0xFA, 0xCB, 0xF1, 0x2F, 0xF8, 0xCC, 0xF1,
+	 0x30, 0xF8, 0xCD, 0xF1, 0x31, 0xF8, 0x67, 0xF1, 0x32, 0xF8, 0x68, 0xF1, 0x33, 0xF8, 0x69, 0xF1,
+	 0x34, 0xF8, 0x50, 0x63, 0x2A, 0xFC, 0xAC, 0xF3, 0x19, 0xFA, 0x00, 0x64, 0x3E, 0xFA, 0x88, 0xF3,
+	 0x07, 0xFA, 0x00, 0xF4, 0x66, 0xF1, 0x06, 0xF8, 0x23, 0x60, 0x4C, 0x62, 0xA2, 0xD3, 0x07, 0xFA,
+	 0x22, 0x60, 0xC6, 0x65, 0xE2, 0x60, 0x58, 0x4D, 0x2F, 0x78, 0xFF, 0xFF, 0x22, 0x60, 0xBE, 0x64,
+	 0x40, 0x48, 0x10, 0x61, 0x00, 0x60, 0x00, 0x64, 0xE1, 0x60, 0x58, 0x4D, 0xE5, 0x78, 0xFF, 0xFF,
+	 0x26, 0x46, 0x3F, 0xFC, 0x1B, 0x60, 0xDA, 0x62, 0x1B, 0x60, 0x8E, 0x64, 0xA2, 0xDB, 0x26, 0x44,
+	 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xC1, 0xFE, 0x20, 0x44, 0x80, 0x26,
+	 0x11, 0x00, 0x80, 0xBC, 0x40, 0x40, 0x00, 0x64, 0x95, 0xFB, 0x96, 0xFB, 0x97, 0xFB, 0x75, 0xFB,
+	 0x66, 0xF3, 0x00, 0x75, 0x00, 0x72, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x93, 0xC7, 0xF3, 0xED, 0xE2,
+	 0xCC, 0x84, 0x5A, 0xFB, 0x00, 0x66, 0x46, 0x46, 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60, 0xD0, 0x62,
+	 0x00, 0x64, 0xA2, 0xDB, 0x5A, 0xDB, 0x00, 0x64, 0x73, 0xFB, 0x75, 0xFB, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x3E, 0x63, 0x16, 0x60, 0x60, 0x61, 0x59, 0xD1, 0x61, 0x46, 0x08, 0x1B, 0xFC, 0x1F, 0x22, 0x60,
+	 0xDE, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x01, 0x65, 0x00, 0x61, 0x17, 0x00, 0x16, 0x60, 0xA2, 0x61,
+	 0x49, 0xD1, 0xCB, 0x83, 0xFD, 0x18, 0x63, 0x41, 0x04, 0xA1, 0x61, 0x45, 0x66, 0x43, 0x22, 0x60,
+	 0xDE, 0x64, 0xDC, 0x84, 0x60, 0xFE, 0xA3, 0xD1, 0xDF, 0x83, 0xA0, 0xD9, 0xCD, 0x81, 0x20, 0xFE,
+	 0xF8, 0x02, 0x66, 0x44, 0x16, 0x60, 0x62, 0x7C, 0xD0, 0x81, 0x5A, 0xF3, 0xC7, 0xF1, 0x22, 0x60,
+	 0xDC, 0x63, 0x00, 0xA0, 0x64, 0x5F, 0xBD, 0xDB, 0x1B, 0x60, 0x94, 0x66, 0xA6, 0xD1, 0x02, 0x02,
+	 0x01, 0x18, 0x01, 0xB9, 0x61, 0x44, 0x60, 0xFE, 0xA3, 0xDB, 0xFC, 0xA3, 0x65, 0x44, 0x03, 0xA4,
+	 0xA3, 0xDB, 0xFF, 0xFF, 0x20, 0xFE, 0x2D, 0x58, 0xFF, 0xFF, 0x23, 0x60, 0x4E, 0x62, 0xA2, 0xDB,
+	 0xCD, 0x81, 0x28, 0xD3, 0x5A, 0x88, 0xDC, 0x83, 0x39, 0x18, 0xFB, 0x03, 0x61, 0x40, 0x7F, 0x3A,
+	 0x07, 0x00, 0x23, 0x60, 0x4E, 0x62, 0xA2, 0xD3, 0x03, 0x61, 0x7C, 0xA4, 0xA2, 0xDB, 0x00, 0xF4,
+	 0x60, 0xFE, 0xA3, 0xD1, 0xDD, 0x81, 0xA1, 0xD8, 0x61, 0x40, 0x7F, 0x3A, 0x09, 0x00, 0x20, 0xFE,
+	 0x23, 0x60, 0x4E, 0x62, 0xA2, 0xD3, 0x03, 0x61, 0x7C, 0xA4, 0xA2, 0xDB, 0x00, 0xF4, 0x60, 0xFE,
+	 0xCF, 0x83, 0xA3, 0xD3, 0xDD, 0x81, 0xA1, 0xDA, 0xFF, 0xB4, 0x00, 0x7F, 0x15, 0x03, 0xDB, 0x83,
+	 0x61, 0x40, 0x7F, 0x3A, 0x0B, 0x00, 0x20, 0xFE, 0x60, 0x45, 0x23, 0x60, 0x4E, 0x62, 0xA2, 0xD3,
+	 0x03, 0x61, 0x7C, 0xA4, 0xA2, 0xDB, 0x65, 0x44, 0x00, 0xF4, 0x60, 0xFE, 0xA3, 0xD1, 0xDF, 0x83,
+	 0xDD, 0x81, 0xCC, 0x84, 0xA1, 0xD8, 0xEC, 0x02, 0x20, 0xFE, 0xC3, 0x01, 0x23, 0x60, 0x4E, 0x62,
+	 0xA2, 0xD1, 0xFD, 0xA1, 0xFF, 0xB1, 0xC1, 0x83, 0xA2, 0xDD, 0x2D, 0x58, 0xFF, 0xFF, 0x67, 0x5C,
+	 0x11, 0x60, 0xF0, 0x61, 0xA1, 0xD3, 0xA5, 0xD9, 0x12, 0x18, 0x60, 0x43, 0x23, 0x60, 0x04, 0x64,
+	 0xA5, 0xDB, 0x60, 0xFE, 0xA0, 0xDD, 0xFF, 0xFF, 0x20, 0xFE, 0xDC, 0x84, 0xCF, 0x83, 0xE3, 0x83,
+	 0x59, 0xD1, 0xDC, 0x84, 0x60, 0xFE, 0xA0, 0xD9, 0xFF, 0xFF, 0x20, 0xFE, 0xF9, 0x1F, 0x2D, 0x58,
+	 0xFF, 0xFF, 0x20, 0x40, 0x20, 0x2A, 0x0D, 0x00, 0x12, 0x60, 0xB8, 0x62, 0xA2, 0xD1, 0x50, 0xF3,
+	 0x23, 0x60, 0x39, 0x63, 0x60, 0xFE, 0xA3, 0xD9, 0xDF, 0x83, 0x60, 0x47, 0xA3, 0xDB, 0xFF, 0xFF,
+	 0x20, 0xFE, 0x2D, 0x58, 0xFF, 0xFF, 0x0E, 0x57, 0x32, 0x40, 0x40, 0x26, 0x25, 0x00, 0x45, 0x48,
+	 0x00, 0x60, 0x10, 0x61, 0xB3, 0x60, 0x58, 0x4D, 0x77, 0x78, 0xFF, 0xFF, 0x1D, 0x03, 0xF2, 0x60,
+	 0x02, 0x64, 0x24, 0xFA, 0x00, 0x60, 0x48, 0x61, 0x28, 0x44, 0x59, 0xDA, 0x03, 0x64, 0x38, 0x43,
+	 0xBD, 0xD1, 0xCC, 0x84, 0x59, 0xD8, 0xFC, 0x02, 0x39, 0x44, 0x59, 0xDA, 0x06, 0x64, 0x23, 0xFA,
+	 0x1B, 0x60, 0xDA, 0x62, 0x1B, 0x60, 0xCA, 0x64, 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64,
+	 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xFA, 0xFE, 0x37, 0x58, 0xFF, 0xFF, 0x0E, 0x57, 0x32, 0x40,
+	 0x40, 0x26, 0x51, 0x00, 0x45, 0x48, 0x00, 0x60, 0x68, 0x61, 0xB3, 0x60, 0x58, 0x4D, 0x77, 0x78,
+	 0xFF, 0xFF, 0x49, 0x03, 0xF2, 0x60, 0x01, 0x64, 0x24, 0xFA, 0x02, 0x60, 0x00, 0x61, 0x46, 0x4A,
+	 0x38, 0x44, 0x54, 0x94, 0x03, 0x64, 0x01, 0x02, 0x09, 0x00, 0x06, 0x63, 0x4A, 0x61, 0x38, 0x46,
+	 0xBD, 0xD0, 0xCC, 0x84, 0x2A, 0x46, 0x59, 0xD8, 0xFA, 0x02, 0x06, 0x00, 0xDA, 0x81, 0x38, 0x43,
+	 0xBD, 0xD1, 0xCC, 0x84, 0x59, 0xD8, 0xFC, 0x02, 0x05, 0x63, 0x28, 0x44, 0x02, 0xA8, 0x25, 0xFA,
+	 0x07, 0x02, 0x03, 0x64, 0x39, 0x43, 0xBD, 0xD1, 0xCC, 0x84, 0x59, 0xD8, 0xFC, 0x02, 0x08, 0x63,
+	 0x22, 0x60, 0x28, 0x7C, 0x28, 0x44, 0x03, 0xA8, 0xA4, 0xD3, 0x0F, 0x03, 0xE8, 0x85, 0xC7, 0x85,
+	 0x60, 0x43, 0xFE, 0xA3, 0x22, 0x60, 0x2A, 0x64, 0x58, 0xD1, 0xD9, 0x81, 0xA1, 0xD8, 0x7E, 0x2A,
+	 0x02, 0x00, 0x00, 0xF4, 0x02, 0x61, 0xF8, 0x1F, 0x65, 0x43, 0x2A, 0x46, 0x23, 0xFC, 0x1B, 0x60,
+	 0xDA, 0x62, 0x1B, 0x60, 0xCA, 0x64, 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB,
+	 0xFF, 0xFF, 0x2B, 0xFF, 0xFA, 0xFE, 0x37, 0x58, 0xFF, 0xFF, 0x0E, 0x57, 0x32, 0x40, 0x40, 0x26,
+	 0x1C, 0x00, 0x45, 0x48, 0x00, 0x60, 0x06, 0x61, 0xB3, 0x60, 0x58, 0x4D, 0x77, 0x78, 0xFF, 0xFF,
+	 0x14, 0x03, 0x02, 0x64, 0x23, 0xFA, 0xF2, 0x60, 0x00, 0x64, 0x5A, 0xDA, 0x28, 0x44, 0x5A, 0xDA,
+	 0xFF, 0xFF, 0x1B, 0x60, 0xDA, 0x62, 0x1B, 0x60, 0xCA, 0x64, 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB,
+	 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xFA, 0xFE, 0x37, 0x58, 0xFF, 0xFF, 0xA2, 0xFF,
+	 0x32, 0x40, 0x40, 0x26, 0x3E, 0x00, 0x7C, 0xF3, 0x67, 0x43, 0xDC, 0x84, 0xCC, 0x84, 0x39, 0x03,
+	 0x60, 0x46, 0x0A, 0x02, 0x7C, 0xFD, 0x00, 0x60, 0x46, 0x61, 0xB3, 0x60, 0x58, 0x4D, 0x77, 0x78,
+	 0xFF, 0xFF, 0x66, 0x44, 0x7C, 0xFB, 0x2E, 0x03, 0x46, 0x4B, 0x1E, 0x60, 0xD8, 0x61, 0x18, 0x64,
+	 0x23, 0xFA, 0xF1, 0x60, 0x00, 0x64, 0x24, 0xFA, 0x4A, 0x65, 0xA2, 0xFF, 0x2C, 0x63, 0x00, 0x64,
+	 0x59, 0xD1, 0xA2, 0xDB, 0xA5, 0xD8, 0xDA, 0x85, 0x80, 0x3A, 0x02, 0x00, 0x00, 0xF4, 0x04, 0x65,
+	 0xF7, 0x1F, 0x12, 0x63, 0x59, 0xD1, 0xA5, 0xD8, 0xDA, 0x85, 0x80, 0x3A, 0x02, 0x00, 0x00, 0xF4,
+	 0x04, 0x65, 0xF8, 0x1F, 0x1B, 0x60, 0xDA, 0x62, 0x1B, 0x60, 0xCA, 0x64, 0xA2, 0xDB, 0x2B, 0x44,
+	 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xFA, 0xFE, 0xA6, 0xFE, 0x00, 0x64,
+	 0x7C, 0xFB, 0xA3, 0xFF, 0xC7, 0x60, 0x2E, 0x78, 0xFF, 0xFF, 0xA6, 0xFE, 0xB8, 0x05, 0xA7, 0xFE,
+	 0x0A, 0x05, 0xA5, 0xFE, 0x03, 0x04, 0xE3, 0x60, 0xD3, 0x78, 0xFF, 0xFF, 0xA4, 0xFE, 0xF2, 0x04,
+	 0xE4, 0x60, 0x69, 0x78, 0xFF, 0xFF, 0x36, 0x45, 0x17, 0x60, 0x52, 0x64, 0x44, 0xD7, 0xFF, 0xFF,
+	 0xFF, 0xFF, 0x28, 0xF3, 0x7E, 0xF1, 0x60, 0x47, 0x07, 0xB4, 0x4E, 0xFB, 0x01, 0x61, 0x03, 0x03,
+	 0xCC, 0x84, 0xE1, 0x81, 0xFD, 0x02, 0x9D, 0x84, 0xA1, 0x80, 0xA0, 0x83, 0x1A, 0x03, 0x7E, 0xFD,
+	 0x0F, 0x60, 0xF4, 0x62, 0xA2, 0xD1, 0x00, 0x60, 0x02, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE,
+	 0x7E, 0xF1, 0x31, 0x44, 0x64, 0x40, 0xFF, 0x26, 0x09, 0x00, 0xFE, 0xB4, 0x40, 0x51, 0x01, 0x7C,
+	 0xBC, 0xF9, 0x49, 0xF3, 0x01, 0x63, 0x60, 0x40, 0xFF, 0x26, 0x49, 0xFD, 0xC7, 0x60, 0x2E, 0x78,
+	 0xFF, 0xFF, 0xE3, 0x60, 0xD3, 0x78, 0xFF, 0xFF, 0x1F, 0x60, 0xB6, 0x63, 0xBD, 0xD3, 0xBD, 0xD1,
+	 0xBD, 0xD1, 0xB0, 0x84, 0xB0, 0x84, 0xFF, 0xFF, 0x07, 0x02, 0x6B, 0xFB, 0x31, 0x44, 0xFE, 0xB4,
+	 0x40, 0x51, 0x0D, 0x64, 0x05, 0xFB, 0x3F, 0x00, 0x28, 0xF3, 0x7E, 0xF1, 0x60, 0x47, 0x64, 0x41,
+	 0x07, 0xB1, 0x07, 0xB4, 0x08, 0x24, 0x67, 0x4C, 0x4E, 0xFB, 0x01, 0x61, 0x03, 0x03, 0xCC, 0x84,
+	 0xE1, 0x81, 0xFD, 0x02, 0xA1, 0x80, 0xB1, 0x83, 0x2E, 0x02, 0x7E, 0xFD, 0x1F, 0x60, 0xAA, 0x62,
+	 0xA2, 0xD3, 0xC5, 0xFB, 0x65, 0xFB, 0x7E, 0xF3, 0xFF, 0xFF, 0xCC, 0x85, 0xA4, 0x80, 0x7E, 0xFB,
+	 0x17, 0x02, 0x1B, 0x60, 0xC4, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0x00, 0xA8, 0x60, 0x46, 0x46, 0x5E,
+	 0x31, 0x44, 0x01, 0xBC, 0x40, 0x51, 0xED, 0xE2, 0x0F, 0x4E, 0xCE, 0x60, 0x58, 0x4F, 0x07, 0x78,
+	 0xFF, 0xFF, 0x0E, 0x4F, 0x01, 0x65, 0xE2, 0x60, 0x58, 0x4E, 0xDD, 0x78, 0xFF, 0xFF, 0x08, 0x00,
+	 0x0F, 0x60, 0xD6, 0x62, 0xA2, 0xD1, 0x00, 0x60, 0x10, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE,
+	 0xE5, 0x60, 0x16, 0x78, 0xFF, 0xFF, 0xD7, 0xFE, 0xC7, 0x60, 0x2E, 0x78, 0xFF, 0xFF, 0x2E, 0xF5,
+	 0x27, 0xF2, 0x12, 0x60, 0xCE, 0x65, 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD3, 0x66, 0x41,
+	 0x60, 0x46, 0x60, 0x43, 0x05, 0xF2, 0x16, 0x18, 0x61, 0x46, 0x27, 0xF0, 0x63, 0x46, 0xD0, 0x80,
+	 0x04, 0xF2, 0x0C, 0x02, 0x61, 0x46, 0x26, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x03, 0xF2, 0x06, 0x02,
+	 0x61, 0x46, 0x25, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0xFF, 0xFF, 0x07, 0x03, 0x80, 0xF4, 0xFF, 0xFF,
+	 0x63, 0x46, 0xE8, 0x1B, 0x88, 0xF3, 0x08, 0xFE, 0x60, 0x43, 0x61, 0x46, 0x28, 0x02, 0x14, 0x60,
+	 0xD0, 0x62, 0xA2, 0xD3, 0xDA, 0x81, 0x60, 0x45, 0xD5, 0x80, 0xA1, 0xD1, 0x04, 0x03, 0xD3, 0x80,
+	 0xD9, 0x81, 0xFA, 0x02, 0x09, 0x00, 0xA1, 0xDD, 0x14, 0x60, 0xD0, 0x62, 0xD9, 0x84, 0xA2, 0xDB,
+	 0x4A, 0xD3, 0xFF, 0xFF, 0xDC, 0x84, 0xA2, 0xDB, 0x66, 0x45, 0x63, 0x46, 0x06, 0xF2, 0xFF, 0x60,
+	 0x01, 0x7C, 0xA0, 0x9C, 0x06, 0xF8, 0x65, 0x46, 0x71, 0xF3, 0x60, 0x40, 0x10, 0x2A, 0x03, 0x00,
+	 0xCC, 0x84, 0x80, 0x2B, 0x71, 0xFB, 0xE4, 0x60, 0x58, 0x4E, 0x9D, 0x78, 0xFF, 0xFF, 0xAB, 0x01,
+	 0x2E, 0xF5, 0x25, 0x60, 0x28, 0x61, 0x28, 0xF0, 0xFF, 0xFF, 0xA1, 0xD9, 0x27, 0xF2, 0x12, 0x60,
+	 0xCE, 0x65, 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD3, 0x66, 0x41, 0x60, 0x46, 0x60, 0x43,
+	 0x05, 0xF2, 0x16, 0x18, 0x61, 0x46, 0x27, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x04, 0xF2, 0x0C, 0x02,
+	 0x61, 0x46, 0x26, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x03, 0xF2, 0x06, 0x02, 0x61, 0x46, 0x25, 0xF0,
+	 0x63, 0x46, 0xD0, 0x80, 0xFF, 0xFF, 0x07, 0x03, 0x80, 0xF4, 0xFF, 0xFF, 0x63, 0x46, 0xE8, 0x1B,
+	 0x88, 0xF3, 0x08, 0xFE, 0x60, 0x43, 0x61, 0x46, 0x13, 0x02, 0x63, 0x46, 0x06, 0xF2, 0xFF, 0xFF,
+	 0x02, 0xB0, 0x08, 0xBC, 0x0D, 0x03, 0x06, 0xFA, 0xE4, 0x60, 0x58, 0x4E, 0x9D, 0x78, 0xFF, 0xFF,
+	 0x0F, 0x60, 0xE8, 0x62, 0xA2, 0xD1, 0x00, 0x60, 0x02, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE,
+	 0x6A, 0x01, 0x7E, 0xF1, 0xFF, 0xFF, 0x64, 0x41, 0x07, 0xB1, 0xFF, 0xFF, 0x08, 0x24, 0x67, 0x4C,
+	 0x1B, 0x60, 0xC4, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0x00, 0xA8, 0x60, 0x46, 0x46, 0x5E, 0x1F, 0x60,
+	 0xAA, 0x62, 0xA2, 0xD3, 0xC5, 0xFB, 0x65, 0xFB, 0x1F, 0x60, 0xB6, 0x63, 0xBD, 0xD1, 0xCB, 0xF9,
+	 0x67, 0xF9, 0xBD, 0xD1, 0xCC, 0xF9, 0x68, 0xF9, 0xA3, 0xD1, 0xCD, 0xF9, 0x69, 0xF9, 0x01, 0x64,
+	 0x6B, 0xFB, 0x31, 0x44, 0x21, 0xBC, 0x40, 0x51, 0x20, 0x44, 0x01, 0x65, 0x34, 0x80, 0x01, 0x64,
+	 0x51, 0xFB, 0x21, 0x60, 0x50, 0x64, 0x52, 0xFB, 0x0F, 0x4E, 0xE8, 0x60, 0x58, 0x4F, 0x02, 0x78,
+	 0xFF, 0xFF, 0x0E, 0x4F, 0xC7, 0x60, 0x2E, 0x78, 0xFF, 0xFF, 0x0E, 0x57, 0x63, 0x46, 0x43, 0x47,
+	 0x1E, 0xF2, 0x72, 0xF2, 0x02, 0x1B, 0x01, 0x1B, 0x0C, 0x00, 0x60, 0x46, 0x1B, 0x60, 0xDA, 0x64,
+	 0x40, 0x4B, 0xF0, 0x60, 0x58, 0x4D, 0x75, 0x78, 0xFF, 0xFF, 0x27, 0x46, 0x72, 0xF2, 0xFF, 0xFF,
+	 0xF4, 0x1B, 0x37, 0x58, 0xFF, 0xFF, 0x1B, 0x60, 0xAC, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0x00, 0xA8,
+	 0x60, 0x46, 0x0E, 0xF2, 0x5B, 0x03, 0x60, 0x40, 0xF0, 0x37, 0x48, 0x00, 0xFF, 0x37, 0x3D, 0x00,
+	 0xFD, 0x37, 0x35, 0x00, 0x18, 0x37, 0x29, 0x00, 0xFE, 0x37, 0x2C, 0x00, 0xF8, 0x37, 0x0A, 0x00,
+	 0x60, 0x47, 0xFF, 0xB5, 0x0F, 0x60, 0xD0, 0x62, 0x46, 0xD1, 0x00, 0x60, 0x01, 0x64, 0xB0, 0x84,
+	 0xA2, 0xDB, 0xCF, 0xFE, 0x1B, 0x60, 0xDA, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB,
+	 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xD6, 0x01, 0x06, 0xB4, 0xFD, 0x7F, 0x0E, 0xFA,
+	 0x1B, 0x60, 0xDA, 0x62, 0x1B, 0x60, 0xB2, 0x64, 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64,
+	 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xF9, 0xFE, 0xC6, 0x01, 0xDB, 0x60, 0x58, 0x4F, 0xB7, 0x78,
+	 0xFF, 0xFF, 0x14, 0x00, 0xDE, 0x60, 0x58, 0x4F, 0x99, 0x78, 0xFF, 0xFF, 0xBC, 0x03, 0x23, 0xF0,
+	 0x60, 0x40, 0x04, 0x26, 0xE2, 0x1B, 0x02, 0x26, 0xE0, 0x18, 0xA2, 0xFF, 0x02, 0xF0, 0x09, 0x60,
+	 0x08, 0x64, 0xD0, 0x80, 0x90, 0xF3, 0x02, 0x02, 0xCC, 0x84, 0x90, 0xFB, 0x1B, 0x60, 0xDA, 0x64,
+	 0x40, 0x4B, 0xF0, 0x60, 0x58, 0x4D, 0x75, 0x78, 0xFF, 0xFF, 0xA5, 0x01, 0xAC, 0xFE, 0x09, 0x05,
+	 0xAD, 0xFE, 0x10, 0x05, 0xAE, 0xFE, 0x9F, 0x05, 0xAF, 0xFE, 0x3A, 0x05, 0xC7, 0x60, 0x2E, 0x78,
+	 0xFF, 0xFF, 0x0F, 0x60, 0xCE, 0x62, 0xA2, 0xD1, 0x20, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB,
+	 0xCF, 0xFE, 0xF4, 0x01, 0x10, 0x60, 0x02, 0x65, 0x03, 0x61, 0x07, 0x00, 0xA2, 0xDD, 0x58, 0x4F,
+	 0x64, 0x58, 0xFF, 0xFF, 0x00, 0xB9, 0xFF, 0xFF, 0x08, 0x03, 0x00, 0x63, 0xA5, 0xD1, 0x5A, 0xD3,
+	 0xDA, 0x85, 0x00, 0xA8, 0xCD, 0x81, 0xF2, 0x02, 0xF8, 0x02, 0xE0, 0x01, 0x0F, 0x60, 0xCC, 0x62,
+	 0x0F, 0x60, 0xF2, 0x65, 0xE5, 0x60, 0x4E, 0x63, 0x00, 0x64, 0x5A, 0xDB, 0xD6, 0x80, 0xFF, 0xFF,
+	 0x04, 0x03, 0x5A, 0xDB, 0x5A, 0xDB, 0x5A, 0xDD, 0xF9, 0x01, 0x10, 0x60, 0x00, 0x65, 0x00, 0x64,
+	 0x5A, 0xDB, 0xD6, 0x80, 0xFF, 0xFF, 0x02, 0x03, 0x5A, 0xDD, 0xFB, 0x01, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x0F, 0x60, 0xD0, 0x64, 0x40, 0x41, 0x0F, 0x60, 0xCE, 0x63, 0xA3, 0xD1, 0x00, 0x64, 0xD0, 0x80,
+	 0x06, 0x61, 0x08, 0x03, 0xBD, 0xDB, 0xA3, 0xD3, 0xFF, 0xFF, 0xB0, 0x84, 0xCD, 0x81, 0xA3, 0xDB,
+	 0x06, 0xA3, 0xF9, 0x02, 0x0F, 0x60, 0xF4, 0x63, 0xA3, 0xD1, 0x00, 0x64, 0xD0, 0x80, 0x07, 0x61,
+	 0x19, 0x03, 0xBD, 0xDB, 0x64, 0x44, 0xFE, 0xA3, 0x02, 0xA3, 0xCD, 0x81, 0xE8, 0x84, 0xE3, 0x03,
+	 0x02, 0x05, 0xE1, 0x03, 0xF9, 0x01, 0x78, 0xFB, 0x7A, 0xFD, 0x61, 0x5C, 0xA3, 0xD3, 0x79, 0xF9,
+	 0x03, 0x18, 0x58, 0x4F, 0x60, 0x58, 0xFF, 0xFF, 0x7A, 0xF3, 0x79, 0xF1, 0x60, 0x43, 0x78, 0xF3,
+	 0x64, 0x41, 0xEA, 0x01, 0x21, 0x43, 0x0F, 0x60, 0xF4, 0x65, 0xD7, 0x80, 0xBD, 0xD1, 0xBD, 0xD3,
+	 0x03, 0x02, 0xC7, 0x60, 0x2E, 0x78, 0xFF, 0xFF, 0xA0, 0x84, 0xBD, 0xD1, 0x43, 0x41, 0xF5, 0x03,
+	 0xE5, 0x60, 0x53, 0x64, 0x64, 0x58, 0x40, 0x4F, 0x2A, 0xF0, 0x83, 0x60, 0xFF, 0x65, 0x64, 0x47,
+	 0x03, 0x2B, 0x01, 0x00, 0x17, 0x00, 0x03, 0x26, 0x03, 0xAC, 0x60, 0x47, 0xA4, 0x84, 0x2A, 0xFA,
+	 0x2F, 0xF2, 0x2C, 0xFA, 0x30, 0xF2, 0x2D, 0xFA, 0x31, 0xF2, 0x2E, 0xFA, 0x64, 0x41, 0xCB, 0xF3,
+	 0x2F, 0xFA, 0x60, 0x43, 0xCC, 0xF3, 0x30, 0xFA, 0xCD, 0xF1, 0x31, 0xF8, 0x32, 0xFC, 0x33, 0xFA,
+	 0x34, 0xF8, 0x19, 0x00, 0x60, 0x47, 0xA4, 0x84, 0x2A, 0xFA, 0x2F, 0xF2, 0x2C, 0xFA, 0x30, 0xF2,
+	 0x2D, 0xFA, 0x31, 0xF2, 0x2E, 0xFA, 0x36, 0xF2, 0x32, 0xFA, 0x37, 0xF2, 0x33, 0xFA, 0x38, 0xF2,
+	 0x34, 0xFA, 0xCB, 0xF3, 0x2F, 0xFA, 0x36, 0xFA, 0xCC, 0xF3, 0x30, 0xFA, 0x37, 0xFA, 0xCD, 0xF3,
+	 0x31, 0xFA, 0x38, 0xFA, 0x64, 0x41, 0x1C, 0xF2, 0x13, 0xFA, 0x00, 0xF4, 0x0D, 0xF2, 0xFF, 0xFF,
+	 0x60, 0x40, 0x80, 0x2B, 0x29, 0x00, 0x26, 0x46, 0x04, 0x63, 0x03, 0xFC, 0x00, 0xF4, 0x0D, 0xF2,
+	 0x06, 0xFA, 0xE6, 0x60, 0x58, 0x4E, 0xF4, 0x78, 0xFF, 0xFF, 0xFF, 0xA0, 0x59, 0xF5, 0x1A, 0x02,
+	 0x39, 0xF2, 0x26, 0x46, 0x3F, 0xFA, 0x00, 0xF4, 0x00, 0x60, 0x81, 0x67, 0x0D, 0xFA, 0x7C, 0x64,
+	 0x01, 0xFA, 0x26, 0x46, 0x00, 0x64, 0x3E, 0xFA, 0x1B, 0x60, 0xDA, 0x62, 0x1B, 0x60, 0x9A, 0x64,
+	 0xA2, 0xDB, 0x26, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xC8, 0xFE,
+	 0x00, 0x66, 0x46, 0x46, 0x2F, 0x58, 0xFF, 0xFF, 0x26, 0x46, 0x3F, 0xF0, 0x42, 0x64, 0xD0, 0x80,
+	 0xFF, 0xFF, 0x01, 0x04, 0x3F, 0xFA, 0x1C, 0xF2, 0x13, 0xFA, 0x26, 0xF2, 0x27, 0xF0, 0x60, 0x47,
+	 0x00, 0xF4, 0x1F, 0xFA, 0x64, 0x47, 0x20, 0xFA, 0x61, 0x44, 0x21, 0xFA, 0x01, 0x67, 0x0D, 0xFA,
+	 0x10, 0x61, 0x1F, 0x60, 0x6C, 0x64, 0x1E, 0x63, 0x58, 0xD1, 0xCD, 0x81, 0xBD, 0xD8, 0xFC, 0x02,
+	 0x9B, 0xF1, 0xB8, 0xF1, 0x64, 0x5E, 0x64, 0x5F, 0x44, 0x63, 0xBD, 0xDA, 0x1F, 0x60, 0x66, 0x62,
+	 0xA2, 0xD3, 0xFF, 0xFF, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0x09, 0xBC, 0x4A, 0xD3, 0x60, 0x45,
+	 0x60, 0x40, 0x01, 0x36, 0x03, 0x64, 0x02, 0x36, 0x01, 0x64, 0xB4, 0x84, 0x06, 0xA2, 0xA2, 0xD1,
+	 0xBD, 0xDA, 0x64, 0x47, 0xBD, 0xDA, 0xB5, 0xF3, 0xB6, 0xF1, 0x60, 0x47, 0xBD, 0xDA, 0x64, 0x47,
+	 0xC3, 0xF1, 0xBD, 0xDA, 0x64, 0x44, 0xBD, 0xDA, 0x26, 0x46, 0x00, 0x64, 0x23, 0xF0, 0x3B, 0xF0,
+	 0x64, 0x40, 0x10, 0x2A, 0x06, 0x00, 0xC0, 0x67, 0xA0, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84,
+	 0x10, 0xBC, 0x3E, 0xFA, 0x1B, 0x60, 0xDA, 0x62, 0x1B, 0x60, 0x9A, 0x64, 0xA2, 0xDB, 0x26, 0x44,
+	 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xC8, 0xFE, 0x00, 0x66, 0x46, 0x46,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x04, 0x60, 0x5C, 0x61, 0xB3, 0x60, 0x58, 0x4D, 0x77, 0x78, 0xFF, 0xFF,
+	 0x66, 0x44, 0x59, 0xFB, 0x04, 0x64, 0x03, 0xFA, 0x2F, 0x58, 0xFF, 0xFF, 0x59, 0xF5, 0xAC, 0xF1,
+	 0x19, 0xF8, 0x00, 0x64, 0x3E, 0xFA, 0x08, 0x64, 0x2A, 0xFA, 0x80, 0x7E, 0xF8, 0x7F, 0x0E, 0xFA,
+	 0x88, 0xF1, 0x07, 0xF8, 0x01, 0x60, 0x60, 0x67, 0x2C, 0xFA, 0x1D, 0x60, 0x00, 0x67, 0x2D, 0xFA,
+	 0x01, 0x60, 0x00, 0x67, 0x2E, 0xFA, 0xCB, 0xF1, 0x2F, 0xF8, 0x32, 0xF8, 0xCC, 0xF1, 0x30, 0xF8,
+	 0x33, 0xF8, 0xCD, 0xF1, 0x31, 0xF8, 0x34, 0xF8, 0x00, 0x63, 0x3B, 0xFC, 0x3D, 0xFC, 0x01, 0x64,
+	 0x3A, 0xFA, 0x66, 0x64, 0x39, 0xFA, 0x3C, 0xFC, 0xAA, 0x60, 0xAA, 0x64, 0x00, 0xF4, 0x02, 0xFA,
+	 0x00, 0x60, 0x03, 0x64, 0x5A, 0xDA, 0x1D, 0x60, 0x60, 0x64, 0x5A, 0xDA, 0x01, 0x60, 0x00, 0x64,
+	 0x5A, 0xDA, 0x82, 0x7F, 0x24, 0x7E, 0x08, 0xFA, 0x01, 0x60, 0x01, 0x64, 0x0A, 0xFA, 0x00, 0x64,
+	 0x0E, 0xFA, 0x2D, 0x58, 0xFF, 0xFF, 0x59, 0xF5, 0x3D, 0xF2, 0x3C, 0xF2, 0xCC, 0x83, 0x00, 0xA8,
+	 0x03, 0x03, 0x08, 0x28, 0x3D, 0xFC, 0x45, 0x00, 0x3D, 0xFA, 0x3A, 0xF2, 0x3B, 0xF0, 0x00, 0x63,
+	 0x00, 0xF4, 0x07, 0xFC, 0x01, 0xB0, 0x0B, 0xFA, 0x1A, 0x03, 0x1F, 0xF8, 0xFF, 0xFF, 0x1B, 0x60,
+	 0xDA, 0x62, 0x18, 0x64, 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x0A, 0x64, 0x5A, 0xDB, 0xFF, 0xFF,
+	 0x2B, 0xFF, 0x1F, 0xF2, 0x1E, 0xF0, 0x59, 0xF5, 0x00, 0xA8, 0x3B, 0xF8, 0xD0, 0x80, 0x06, 0x03,
+	 0x05, 0x03, 0x04, 0x60, 0x5C, 0x63, 0x0F, 0x64, 0x3A, 0xFA, 0x39, 0xFC, 0x00, 0xF4, 0x00, 0x64,
+	 0x06, 0xFA, 0xE6, 0x60, 0x58, 0x4E, 0xF4, 0x78, 0xFF, 0xFF, 0x59, 0xF5, 0x00, 0xF4, 0x81, 0x60,
+	 0x00, 0x64, 0x06, 0xFA, 0x32, 0x47, 0x04, 0xBC, 0x07, 0xFA, 0xB8, 0xF1, 0x00, 0x7F, 0x64, 0x5E,
+	 0x09, 0xFA, 0x59, 0xF5, 0x00, 0x64, 0x15, 0xFA, 0x39, 0xF2, 0x3F, 0xFA, 0x1B, 0x60, 0xDA, 0x62,
+	 0x1B, 0x60, 0x88, 0x64, 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF,
+	 0x2B, 0xFF, 0xE1, 0x60, 0x0D, 0x78, 0xFF, 0xFF, 0x66, 0x45, 0x0E, 0xF2, 0x0F, 0xF0, 0x10, 0xF0,
+	 0x64, 0x41, 0x01, 0xA8, 0x59, 0xF5, 0x09, 0x02, 0xAD, 0x83, 0x64, 0x44, 0xAC, 0x84, 0x08, 0x24,
+	 0x0A, 0x63, 0x3C, 0xFC, 0x3D, 0xFC, 0x1A, 0x02, 0x2D, 0x00, 0x03, 0x3A, 0x03, 0x00, 0x00, 0x64,
+	 0x3C, 0xFA, 0x29, 0x00, 0x04, 0x3A, 0x09, 0x00, 0x0A, 0x64, 0x3C, 0xFA, 0x01, 0x64, 0x3A, 0xFA,
+	 0x00, 0xF4, 0x00, 0x64, 0x1F, 0xFA, 0x1E, 0xFA, 0x1E, 0x00, 0x02, 0x3A, 0x1E, 0x00, 0x64, 0x44,
+	 0xAD, 0x83, 0xAC, 0x84, 0x02, 0x03, 0x3C, 0xFC, 0x3D, 0xFC, 0x15, 0x03, 0x3A, 0xFA, 0xF8, 0x65,
+	 0x52, 0x63, 0x64, 0x44, 0x01, 0x36, 0x0D, 0x00, 0x12, 0xA3, 0x64, 0x40, 0x02, 0x2A, 0x02, 0x00,
+	 0xC7, 0x83, 0xC7, 0x83, 0x64, 0x40, 0x08, 0x2A, 0x01, 0x00, 0xC7, 0x83, 0x64, 0x40, 0x04, 0x26,
+	 0xC7, 0x83, 0x39, 0xFC, 0x00, 0x64, 0x2E, 0x58, 0xFF, 0xFF, 0x3B, 0xF0, 0x3A, 0xF2, 0x65, 0x46,
+	 0x06, 0xF2, 0x40, 0x47, 0x1D, 0x18, 0x32, 0x47, 0x07, 0xFA, 0x24, 0x7E, 0x82, 0x7F, 0x08, 0xFA,
+	 0x01, 0x60, 0x01, 0x63, 0xB8, 0xF3, 0x0A, 0xFC, 0x00, 0x7F, 0x09, 0xFA, 0x27, 0x40, 0x01, 0x2A,
+	 0x0F, 0x00, 0x1F, 0xF8, 0x1B, 0x60, 0xDA, 0x62, 0x18, 0x64, 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB,
+	 0x0A, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0x1E, 0xF0, 0x59, 0xF5, 0x3B, 0xF8, 0x65, 0x46,
+	 0x27, 0x40, 0x02, 0x26, 0x02, 0x00, 0x00, 0xF4, 0x13, 0x00, 0x6E, 0x61, 0xFF, 0x60, 0xFE, 0x64,
+	 0x00, 0x60, 0x0E, 0x63, 0x58, 0xD1, 0x59, 0xD8, 0xFD, 0x1F, 0x01, 0x60, 0xEE, 0x63, 0x00, 0xF4,
+	 0x02, 0x61, 0x58, 0xD1, 0x59, 0xD8, 0x7E, 0x3A, 0x02, 0x00, 0x00, 0xF4, 0x02, 0x61, 0xF9, 0x1F,
+	 0x27, 0x40, 0x04, 0x26, 0x1B, 0x00, 0x46, 0x4B, 0x1B, 0x60, 0x88, 0x62, 0xA2, 0xD3, 0xFF, 0xFF,
+	 0x00, 0xA8, 0x60, 0x46, 0x0E, 0x03, 0x89, 0xF0, 0xE7, 0x60, 0x58, 0x4D, 0xAE, 0x78, 0xFF, 0xFF,
+	 0x65, 0x44, 0xAC, 0x86, 0xFF, 0xFF, 0x08, 0x03, 0xE7, 0x60, 0x58, 0x4D, 0xAE, 0x78, 0xFF, 0xFF,
+	 0x04, 0x00, 0x2B, 0x46, 0x82, 0xFC, 0x00, 0xF4, 0x82, 0xFC, 0x00, 0xF4, 0x27, 0x40, 0x08, 0x26,
+	 0x1A, 0x00, 0x46, 0x4B, 0x1B, 0x60, 0xC4, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0x00, 0xA8, 0x60, 0x46,
+	 0x0E, 0x03, 0x89, 0xF0, 0xE7, 0x60, 0x58, 0x4D, 0xAE, 0x78, 0xFF, 0xFF, 0x65, 0x44, 0xAC, 0x86,
+	 0xFF, 0xFF, 0x08, 0x03, 0xE7, 0x60, 0x58, 0x4D, 0xAE, 0x78, 0xFF, 0xFF, 0x04, 0x00, 0x65, 0x46,
+	 0x02, 0xFA, 0x00, 0xF4, 0x82, 0xFC, 0x01, 0x64, 0x2E, 0x58, 0xFF, 0xFF, 0x01, 0x61, 0x02, 0x64,
+	 0x7A, 0x63, 0x58, 0xD0, 0xAB, 0x46, 0xA0, 0xD8, 0xAB, 0x46, 0xFB, 0x1F, 0xAB, 0x46, 0x00, 0xF4,
+	 0xCD, 0x81, 0xAB, 0x46, 0x00, 0xF4, 0xF3, 0x02, 0x2D, 0x58, 0xFF, 0xFF, 0x00, 0x60, 0x2A, 0x61,
+	 0xB3, 0x60, 0x58, 0x4D, 0x77, 0x78, 0xFF, 0xFF, 0x66, 0x44, 0x58, 0xFB, 0x04, 0x64, 0x03, 0xFA,
+	 0x67, 0x44, 0x2C, 0xFA, 0x2D, 0xFA, 0x2E, 0xFA, 0x32, 0xFA, 0x33, 0xFA, 0x34, 0xFA, 0x12, 0x60,
+	 0x80, 0x64, 0x88, 0xF1, 0x0E, 0xFA, 0x07, 0xF8, 0x00, 0x64, 0x3E, 0xFA, 0x11, 0x60, 0xD8, 0x63,
+	 0xA3, 0xDB, 0x06, 0xA3, 0x10, 0x60, 0x08, 0x64, 0xBD, 0xDB, 0x04, 0x64, 0xBD, 0xDB, 0x06, 0x64,
+	 0xA3, 0xDB, 0x10, 0x60, 0x06, 0x62, 0xEA, 0x60, 0x08, 0x64, 0xA2, 0xDB, 0x11, 0x60, 0xE4, 0x63,
+	 0x00, 0x64, 0xA3, 0xDB, 0x06, 0xA3, 0x10, 0x60, 0x0C, 0x64, 0xBD, 0xDB, 0x08, 0x64, 0xBD, 0xDB,
+	 0x06, 0x64, 0xA3, 0xDB, 0x10, 0x60, 0x0A, 0x62, 0xEA, 0x60, 0x12, 0x64, 0xA2, 0xDB, 0x0F, 0x60,
+	 0xFC, 0x62, 0xE9, 0x60, 0xF2, 0x64, 0xA2, 0xDB, 0x00, 0x64, 0x25, 0x60, 0x2A, 0x62, 0xA2, 0xDB,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x58, 0xF5, 0xCB, 0xF1, 0x2F, 0xF8, 0xCC, 0xF1, 0x30, 0xF8, 0xCD, 0xF1,
+	 0x31, 0xF8, 0xAC, 0xF1, 0x19, 0xF8, 0xEA, 0x60, 0x58, 0x4E, 0x1C, 0x78, 0xFF, 0xFF, 0x30, 0x64,
+	 0x3B, 0x42, 0x5A, 0xDB, 0x0F, 0x60, 0xE2, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x16, 0x60, 0xCC, 0x61,
+	 0xA1, 0xD3, 0xFF, 0xFF, 0x59, 0x18, 0x58, 0xF5, 0x40, 0x64, 0x2A, 0xFA, 0x52, 0xF3, 0x00, 0xF4,
+	 0x60, 0x43, 0xBD, 0xD1, 0x04, 0x65, 0x64, 0x47, 0xA5, 0xDA, 0x64, 0x41, 0xDD, 0x81, 0xE9, 0x81,
+	 0x62, 0x44, 0x04, 0x03, 0xBD, 0xD1, 0xCD, 0x81, 0x58, 0xD8, 0xFC, 0x02, 0x58, 0x8B, 0x21, 0x60,
+	 0x8E, 0x63, 0xA3, 0xD1, 0x2B, 0x44, 0xC8, 0x84, 0x64, 0x41, 0xFF, 0xB1, 0x61, 0x45, 0x03, 0xA1,
+	 0xE9, 0x81, 0x41, 0x4C, 0xBD, 0xD1, 0xCD, 0x81, 0x58, 0xD8, 0xFC, 0x02, 0x2B, 0xD2, 0x2B, 0x43,
+	 0x60, 0x47, 0x01, 0x7E, 0x52, 0xF1, 0xA3, 0xDA, 0xA4, 0xD3, 0xCB, 0x83, 0x44, 0x8B, 0xF8, 0x84,
+	 0x2C, 0x41, 0x0C, 0x04, 0xBE, 0xD2, 0xFF, 0xFF, 0x60, 0x47, 0xBE, 0xDA, 0x00, 0x7E, 0xA3, 0xD2,
+	 0x60, 0x45, 0x00, 0x7F, 0xB4, 0x84, 0xCD, 0x81, 0xBD, 0xDA, 0xF4, 0x02, 0x58, 0xF5, 0x2B, 0x44,
+	 0x04, 0xA4, 0x3F, 0xFA, 0x65, 0xF3, 0x64, 0xFB, 0x16, 0x60, 0xCE, 0x61, 0x01, 0x64, 0x52, 0xF1,
+	 0xA1, 0xDB, 0x65, 0xFB, 0xA4, 0xD3, 0x04, 0x65, 0x51, 0xF3, 0x01, 0x18, 0x0C, 0x65, 0xF3, 0xB4,
+	 0xB4, 0x84, 0x51, 0xFB, 0x02, 0xB0, 0xFF, 0xFF, 0x16, 0x03, 0x65, 0xF3, 0xFF, 0xFF, 0x60, 0x47,
+	 0x0F, 0xB4, 0x65, 0xFB, 0x01, 0x03, 0x0F, 0x00, 0xE9, 0x60, 0x74, 0x78, 0xFF, 0xFF, 0x51, 0xF1,
+	 0x65, 0xF3, 0x64, 0x40, 0x02, 0x26, 0xF8, 0x01, 0xF3, 0xA0, 0x04, 0xA4, 0x01, 0x04, 0xF1, 0xA4,
+	 0x10, 0x36, 0xF2, 0x01, 0x65, 0xFB, 0x65, 0xF3, 0x16, 0x60, 0xCC, 0x61, 0xA1, 0xD1, 0xCC, 0x84,
+	 0x01, 0x61, 0x08, 0x24, 0x03, 0x00, 0xE1, 0x81, 0xCC, 0x84, 0xFB, 0x01, 0xA1, 0x84, 0x51, 0xF1,
+	 0xE7, 0x03, 0x16, 0x60, 0xCE, 0x61, 0xA1, 0xDB, 0x00, 0x00, 0x65, 0xF3, 0x01, 0x61, 0xCC, 0x84,
+	 0xFF, 0xFF, 0x02, 0x03, 0xE1, 0x81, 0xFB, 0x01, 0x9A, 0xF3, 0x61, 0x45, 0xA4, 0x80, 0xFF, 0xFF,
+	 0xD7, 0x03, 0x31, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0x0F, 0x60, 0xE2, 0x62, 0x00, 0x64, 0xA2, 0xDB,
+	 0xDE, 0xFE, 0x0B, 0x04, 0x0F, 0x60, 0xE4, 0x62, 0x40, 0x60, 0x00, 0x64, 0xA2, 0xDB, 0xE8, 0x60,
+	 0x95, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x65, 0xF1, 0x1C, 0x60, 0x00, 0x62,
+	 0xA2, 0xD9, 0x1E, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x2D, 0xFF, 0x0F, 0x60, 0xE4, 0x62, 0x20, 0x60,
+	 0x00, 0x64, 0xA2, 0xDB, 0xE8, 0x60, 0xC8, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF,
+	 0xBE, 0xFE, 0x0F, 0x60, 0xCE, 0x62, 0xA2, 0xD1, 0x40, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB,
+	 0xCF, 0xFE, 0x0F, 0x60, 0xE2, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x58, 0xF5, 0x1B, 0x60, 0xDA, 0x62,
+	 0x1B, 0x60, 0x8E, 0x64, 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF,
+	 0x2B, 0xFF, 0x00, 0x64, 0x4F, 0xFB, 0x0F, 0x60, 0xE4, 0x62, 0x00, 0x60, 0x01, 0x64, 0xA2, 0xDB,
+	 0xE8, 0x60, 0xF2, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0xC1, 0xFE, 0x33, 0x64, 0x3B, 0x42, 0x5A, 0xDB,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x34, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0x0F, 0x60, 0xE2, 0x62, 0x00, 0x64,
+	 0xA2, 0xDB, 0xA6, 0xF1, 0x11, 0x60, 0xDC, 0x62, 0xA2, 0xD9, 0x1C, 0x60, 0x10, 0x62, 0x11, 0x60,
+	 0xD8, 0x64, 0xA2, 0xDB, 0x02, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0xA7, 0xF1, 0x11, 0x60,
+	 0xE8, 0x62, 0xA2, 0xD9, 0x1C, 0x60, 0x0E, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0xFD, 0x1B, 0x1C, 0x60,
+	 0x10, 0x62, 0x11, 0x60, 0xE4, 0x64, 0xA2, 0xDB, 0x02, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF,
+	 0x0F, 0x60, 0xE4, 0x62, 0x00, 0x60, 0x08, 0x64, 0xA2, 0xDB, 0xE9, 0x60, 0x23, 0x64, 0x5A, 0xDB,
+	 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x4F, 0xF1, 0x0F, 0x60, 0xE2, 0x62, 0x00, 0x64, 0xA2, 0xDB,
+	 0x64, 0x40, 0xFF, 0x26, 0x03, 0x00, 0xE8, 0x60, 0x77, 0x78, 0xFF, 0xFF, 0x02, 0x0A, 0x00, 0x64,
+	 0x4F, 0xFB, 0xA8, 0xF1, 0x11, 0x60, 0xE8, 0x62, 0xA2, 0xD9, 0x0F, 0x60, 0xE4, 0x62, 0x00, 0x60,
+	 0x0C, 0x64, 0xA2, 0xDB, 0xE9, 0x60, 0x49, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x1C, 0x60, 0x10, 0x62,
+	 0x11, 0x60, 0xE4, 0x64, 0xA2, 0xDB, 0x02, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x2F, 0x58,
+	 0xFF, 0xFF, 0x0F, 0x60, 0xE2, 0x62, 0xA2, 0xD1, 0x00, 0x60, 0x04, 0x64, 0xA0, 0x80, 0x9C, 0x84,
+	 0x0C, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x1C, 0x60, 0x10, 0x62, 0x11, 0x60, 0xE4, 0x64, 0xA2, 0xDB,
+	 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x14, 0x00, 0xFF, 0x60, 0xF7, 0x64, 0xA0, 0x84,
+	 0xA2, 0xDB, 0x4F, 0xF3, 0xDB, 0x0A, 0x00, 0xA0, 0x00, 0x64, 0x02, 0x03, 0x4F, 0xFB, 0xD6, 0x01,
+	 0x1C, 0x60, 0x10, 0x62, 0x11, 0x60, 0xD8, 0x64, 0xA2, 0xDB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF,
+	 0x04, 0xFF, 0xE8, 0x60, 0x77, 0x78, 0xFF, 0xFF, 0x35, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0x1C, 0x60,
+	 0x10, 0x62, 0x11, 0x60, 0xD8, 0x64, 0xA2, 0xDB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF,
+	 0x51, 0xF3, 0xFF, 0xFF, 0xE3, 0xB4, 0x51, 0xFB, 0x16, 0x60, 0xCA, 0x64, 0xA0, 0xD3, 0xFF, 0xFF,
+	 0xFE, 0xB4, 0xA2, 0xDB, 0x00, 0x64, 0x25, 0x60, 0x2A, 0x62, 0xA2, 0xDB, 0x0F, 0x60, 0xE2, 0x62,
+	 0x00, 0x64, 0xA2, 0xDB, 0xDE, 0xFE, 0x0E, 0x04, 0x32, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0x0F, 0x60,
+	 0xE4, 0x62, 0x40, 0x60, 0x00, 0x64, 0xA2, 0xDB, 0xE9, 0x60, 0x8E, 0x64, 0x5A, 0xDB, 0xCF, 0xFE,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x64, 0xF1, 0x65, 0xF9, 0x1C, 0x60, 0x00, 0x62, 0xA2, 0xD9, 0x1E, 0x64,
+	 0x4A, 0xDB, 0xFF, 0xFF, 0x2D, 0xFF, 0x0F, 0x60, 0xE4, 0x62, 0x20, 0x60, 0x00, 0x64, 0xA2, 0xDB,
+	 0xE9, 0x60, 0xB6, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0xBE, 0xFE, 0x0F, 0x60,
+	 0xCE, 0x62, 0xA2, 0xD1, 0x40, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x0F, 0x60,
+	 0xCE, 0x62, 0xA2, 0xD1, 0x10, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x00, 0x60,
+	 0x04, 0x61, 0xB3, 0x60, 0x58, 0x4D, 0x77, 0x78, 0xFF, 0xFF, 0x01, 0x64, 0x23, 0xFA, 0xF1, 0x60,
+	 0x02, 0x64, 0x24, 0xFA, 0x1B, 0x60, 0xDA, 0x62, 0x1B, 0x60, 0xCA, 0x64, 0xA2, 0xDB, 0x66, 0x44,
+	 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xFA, 0xFE, 0xEA, 0x60, 0x58, 0x4E,
+	 0x2E, 0x78, 0xFF, 0xFF, 0x20, 0x44, 0x01, 0xB5, 0x54, 0x80, 0x31, 0x44, 0xDE, 0xB4, 0x40, 0x51,
+	 0x0F, 0x60, 0xE2, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x5A, 0xDB, 0x3E, 0x64, 0x3B, 0x42, 0x5A, 0xDB,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x3F, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0x1C, 0x60, 0x10, 0x62, 0x11, 0x60,
+	 0xD8, 0x64, 0xA2, 0xDB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x00, 0x64, 0x51, 0xFB,
+	 0x0F, 0x60, 0xE2, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x5A, 0xDB, 0xBE, 0xFE, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x0F, 0x60, 0xE2, 0x62, 0xA2, 0xD1, 0x00, 0x60, 0x04, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60, 0xE2, 0x62, 0xA2, 0xD1, 0x00, 0x60, 0x08, 0x64, 0xB0, 0x84,
+	 0xA2, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x00, 0x66, 0x01, 0x60, 0x7A, 0x61, 0x16, 0x60,
+	 0xC4, 0x63, 0xA1, 0xD3, 0xFF, 0xFF, 0x20, 0x7F, 0xBD, 0xDB, 0x21, 0x60, 0x32, 0x64, 0xBD, 0xDB,
+	 0x04, 0xA1, 0xA1, 0xD3, 0xFF, 0xFF, 0x22, 0x7F, 0xA3, 0xDB, 0x10, 0x00, 0x01, 0x60, 0x7A, 0x61,
+	 0x16, 0x60, 0xC4, 0x63, 0xA1, 0xD3, 0x00, 0x66, 0x20, 0x7F, 0xBD, 0xDB, 0x59, 0xD3, 0xFF, 0xFF,
+	 0x21, 0x7F, 0xBD, 0xDB, 0x59, 0xD3, 0xFF, 0xFF, 0x22, 0x7F, 0xA3, 0xDB, 0x0F, 0x60, 0xE2, 0x62,
+	 0xA2, 0xD1, 0x9F, 0x60, 0xFF, 0x64, 0xA0, 0x84, 0xA2, 0xDB, 0xDE, 0xFE, 0x0B, 0x04, 0x0F, 0x60,
+	 0xE4, 0x62, 0x40, 0x60, 0x00, 0x64, 0xA2, 0xDB, 0xEA, 0x60, 0x3E, 0x64, 0x5A, 0xDB, 0xCF, 0xFE,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x1C, 0x60, 0x00, 0x62, 0x16, 0x60, 0xC2, 0x64, 0xA2, 0xDB, 0x20, 0x64,
+	 0x4A, 0xDB, 0xFF, 0xFF, 0x2D, 0xFF, 0x0F, 0x60, 0xE4, 0x62, 0x20, 0x60, 0x00, 0x64, 0xA2, 0xDB,
+	 0xEA, 0x60, 0x66, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60, 0xE2, 0x62,
+	 0xA2, 0xD1, 0x9F, 0x60, 0xFF, 0x64, 0xA0, 0x84, 0xA2, 0xDB, 0xBE, 0xFE, 0x0F, 0x60, 0xCE, 0x62,
+	 0xA2, 0xD1, 0x40, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x2E, 0x58, 0xFF, 0xFF,
+	 0x5F, 0xFB, 0xAC, 0x85, 0x60, 0x41, 0x20, 0x03, 0x01, 0x60, 0x00, 0x63, 0x08, 0x64, 0xE9, 0x81,
+	 0xCC, 0x84, 0x02, 0x24, 0xDF, 0x83, 0xFB, 0x02, 0x21, 0x60, 0x8E, 0x64, 0xA0, 0xDD, 0x65, 0x41,
+	 0x21, 0x60, 0x90, 0x63, 0x0F, 0x60, 0xC0, 0x64, 0xE9, 0x81, 0x58, 0xD1, 0xFD, 0x04, 0xA3, 0xD9,
+	 0x0B, 0x03, 0x58, 0xD1, 0xE9, 0x81, 0x60, 0x45, 0xFC, 0x04, 0xA3, 0xD1, 0x64, 0x47, 0xB0, 0x84,
+	 0xBD, 0xDB, 0x00, 0xB9, 0x65, 0x44, 0xF0, 0x02, 0x20, 0x60, 0x38, 0x62, 0xA2, 0xD3, 0xFF, 0xFF,
+	 0x01, 0xA8, 0x01, 0x60, 0x70, 0x62, 0x06, 0x02, 0xA2, 0xD3, 0xFF, 0xFF, 0x01, 0xA8, 0xFF, 0xFF,
+	 0x01, 0x03, 0x02, 0x64, 0x60, 0x41, 0x21, 0x60, 0x8E, 0x63, 0xBD, 0xD3, 0xA3, 0xD3, 0xFF, 0xB5,
+	 0x80, 0xBF, 0xCD, 0x81, 0x65, 0x5C, 0x0F, 0x03, 0x80, 0xBF, 0xBD, 0xDB, 0x65, 0x44, 0xC8, 0x84,
+	 0xFF, 0xFF, 0x0C, 0x03, 0x60, 0x45, 0xCD, 0x81, 0xA3, 0xD3, 0x08, 0x03, 0x80, 0xBF, 0xCD, 0x81,
+	 0xFF, 0xFF, 0x01, 0x03, 0x80, 0xBC, 0x60, 0x47, 0xBD, 0xDB, 0x00, 0x65, 0x64, 0x41, 0x21, 0x60,
+	 0x90, 0x63, 0xBD, 0xD3, 0xFF, 0xFF, 0x80, 0xB0, 0xFF, 0xFF, 0x01, 0x03, 0x60, 0x45, 0x60, 0x47,
+	 0x80, 0xB0, 0xFF, 0xFF, 0x01, 0x03, 0x60, 0x45, 0xCD, 0x81, 0xFF, 0xFF, 0xF2, 0x02, 0x65, 0x44,
+	 0x7F, 0xB4, 0x02, 0x3A, 0x02, 0x00, 0x0A, 0x64, 0x15, 0x00, 0x04, 0x3A, 0x02, 0x00, 0x14, 0x64,
+	 0x11, 0x00, 0x0A, 0x3A, 0x02, 0x00, 0x32, 0x64, 0x0D, 0x00, 0x0B, 0x3A, 0x02, 0x00, 0x37, 0x64,
+	 0x09, 0x00, 0x10, 0x3A, 0x02, 0x00, 0x50, 0x64, 0x05, 0x00, 0x16, 0x3A, 0x02, 0x00, 0x6E, 0x64,
+	 0x01, 0x00, 0x14, 0x64, 0x62, 0xFB, 0x2E, 0x58, 0xFF, 0xFF, 0x3C, 0x64, 0x3B, 0x42, 0x5A, 0xDB,
+	 0x31, 0x40, 0x20, 0x2A, 0x18, 0x00, 0x3F, 0xF2, 0x47, 0x65, 0xC4, 0x84, 0xE8, 0x84, 0x23, 0xFA,
+	 0xF1, 0x60, 0x02, 0x64, 0x24, 0xFA, 0x1B, 0x60, 0xDA, 0x62, 0x1B, 0x60, 0xCA, 0x64, 0xA2, 0xDB,
+	 0x26, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xFA, 0xFE, 0x00, 0x66,
+	 0x46, 0x46, 0x2F, 0x58, 0xFF, 0xFF, 0x26, 0x46, 0x2F, 0x58, 0xFF, 0xFF, 0x0C, 0x63, 0x12, 0x60,
+	 0xB6, 0x62, 0x00, 0x64, 0x5A, 0xDB, 0xFE, 0x1F, 0x53, 0xFB, 0x54, 0xFB, 0x12, 0x60, 0xBA, 0x63,
+	 0x02, 0x64, 0xA3, 0xDB, 0x2E, 0x58, 0xFF, 0xFF, 0x12, 0x60, 0xBE, 0x62, 0xA2, 0xD3, 0x00, 0x63,
+	 0xF0, 0xA0, 0x01, 0xA4, 0x03, 0x03, 0xA2, 0xDB, 0x2E, 0x58, 0xFF, 0xFF, 0xA2, 0xDD, 0x12, 0x60,
+	 0xC0, 0x62, 0xA2, 0xD1, 0xA2, 0xDD, 0x5A, 0xD3, 0xA2, 0xDD, 0xC0, 0x81, 0x61, 0x44, 0x02, 0x24,
+	 0xFF, 0xFF, 0xE9, 0x81, 0xE9, 0x81, 0xE9, 0x81, 0xE9, 0x81, 0x5A, 0xD3, 0xE9, 0x81, 0xE8, 0x83,
+	 0xEB, 0x83, 0xEB, 0x83, 0xEB, 0x83, 0xEB, 0x85, 0xD4, 0x85, 0xC5, 0x83, 0xA2, 0xDD, 0x12, 0x60,
+	 0xB8, 0x62, 0x63, 0x47, 0x00, 0x7F, 0xA2, 0xDB, 0x2E, 0x58, 0xFF, 0xFF, 0x03, 0xE1, 0xA3, 0xFF,
+	 0x1B, 0x60, 0x5A, 0x63, 0x17, 0xFD, 0xAE, 0xFF, 0xEB, 0x60, 0x84, 0x78, 0xFF, 0xFF, 0x7F, 0x67,
+	 0x01, 0x61, 0x23, 0x58, 0xFF, 0xFF, 0xB1, 0xFE, 0x05, 0x05, 0xB0, 0xFE, 0x06, 0x05, 0xB2, 0xFE,
+	 0xB3, 0xFE, 0x22, 0x00, 0xF0, 0x60, 0xFA, 0x78, 0xFF, 0xFF, 0x28, 0xF3, 0x29, 0xF1, 0x40, 0x44,
+	 0x44, 0x45, 0x2A, 0xF1, 0x2B, 0xF1, 0x44, 0x46, 0x44, 0x47, 0x3F, 0xB4, 0xE0, 0x85, 0x16, 0x60,
+	 0xD2, 0x64, 0x44, 0xD7, 0x58, 0x43, 0xFF, 0xFF, 0x60, 0x45, 0x12, 0x60, 0xC8, 0x7C, 0xA4, 0xD3,
+	 0x61, 0x43, 0x04, 0xB4, 0x24, 0x44, 0x02, 0x03, 0x13, 0xFF, 0x06, 0x00, 0x3F, 0xB4, 0xB4, 0x84,
+	 0xFF, 0x27, 0x05, 0xFD, 0x04, 0xFB, 0x10, 0x75, 0xA1, 0xFF, 0xFF, 0xFF, 0x86, 0x3E, 0xB4, 0xFE,
+	 0x09, 0x05, 0xB5, 0xFE, 0x02, 0x24, 0x80, 0xF7, 0xFF, 0xFF, 0xFF, 0xFF, 0xB7, 0xFE, 0x05, 0x05,
+	 0xB6, 0xFE, 0xF2, 0x01, 0xF1, 0x60, 0x35, 0x78, 0xFF, 0xFF, 0x36, 0x44, 0x00, 0x7F, 0xF4, 0xA0,
+	 0x60, 0x45, 0x05, 0x05, 0x17, 0x60, 0x5E, 0x64, 0x44, 0xD7, 0xFF, 0xFF, 0xFF, 0xFF, 0xE4, 0x01,
+	 0xE3, 0x01, 0x7F, 0x60, 0xC0, 0x64, 0x24, 0x45, 0xA4, 0x80, 0x7F, 0x67, 0x02, 0x61, 0x10, 0x02,
+	 0x10, 0x64, 0x40, 0x40, 0x02, 0x64, 0x40, 0x50, 0x61, 0xFF, 0x3F, 0x40, 0x40, 0x26, 0x04, 0x00,
+	 0x10, 0xE0, 0x46, 0x60, 0x09, 0xE0, 0x00, 0x00, 0x27, 0xF1, 0x00, 0x66, 0x20, 0x78, 0x42, 0xFE,
+	 0x23, 0x58, 0xFF, 0xFF, 0x78, 0x60, 0xC0, 0x64, 0x24, 0x45, 0xA4, 0x80, 0x7F, 0x67, 0x02, 0x61,
+	 0x1C, 0x02, 0x12, 0x60, 0xC8, 0x63, 0xA3, 0xD3, 0x07, 0x7C, 0x20, 0xB5, 0x0C, 0xB5, 0x04, 0x03,
+	 0x03, 0x02, 0xBC, 0xF9, 0x00, 0x67, 0x11, 0x00, 0x00, 0x61, 0x41, 0x56, 0xC7, 0xFE, 0xB4, 0x01,
+	 0x36, 0x47, 0xFF, 0x23, 0x04, 0x00, 0x00, 0x7F, 0x60, 0x41, 0x7F, 0x67, 0x06, 0x00, 0x04, 0x7C,
+	 0xBC, 0xF9, 0x20, 0x44, 0x80, 0xBC, 0x40, 0x40, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x78, 0x60,
+	 0xC0, 0x64, 0x24, 0x45, 0xA4, 0x80, 0x7F, 0x67, 0x02, 0x61, 0x31, 0x02, 0x12, 0x60, 0xC8, 0x63,
+	 0xA3, 0xD3, 0x01, 0x7C, 0x20, 0xB5, 0x0C, 0xB5, 0x03, 0x03, 0x02, 0x02, 0xBC, 0xF9, 0xFF, 0xFF,
+	 0x02, 0x61, 0x41, 0x56, 0xC7, 0xFE, 0xEB, 0x60, 0x84, 0x78, 0xFF, 0xFF, 0x7E, 0xF1, 0x20, 0x44,
+	 0x64, 0x40, 0xFF, 0x26, 0x1B, 0x00, 0x7F, 0xB4, 0x40, 0x40, 0x5C, 0x5E, 0x82, 0xFF, 0x26, 0x44,
+	 0xFD, 0xB4, 0x40, 0x46, 0x5C, 0x41, 0x87, 0xFF, 0x62, 0xFF, 0x00, 0x63, 0x1B, 0x60, 0xC4, 0x62,
+	 0xA2, 0xD3, 0xFF, 0xFF, 0x00, 0xA8, 0x60, 0x46, 0x04, 0x03, 0x09, 0xF2, 0x0F, 0xFC, 0xAC, 0x86,
+	 0xFB, 0x01, 0x1C, 0x60, 0x04, 0x62, 0x06, 0x64, 0xA2, 0xDB, 0x2D, 0xFF, 0x00, 0x67, 0x23, 0x58,
+	 0xFF, 0xFF, 0x25, 0x46, 0x01, 0xF2, 0x08, 0xF0, 0x60, 0x47, 0x03, 0xB4, 0x03, 0xAC, 0x7F, 0x67,
+	 0x03, 0x61, 0x08, 0x02, 0x1B, 0x60, 0xE0, 0x64, 0x40, 0x4B, 0xF0, 0x60, 0x58, 0x4D, 0x75, 0x78,
+	 0xFF, 0xFF, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x24, 0x40, 0x01, 0x2B, 0x49, 0x00, 0x25, 0x44,
+	 0x1F, 0xB4, 0xE0, 0x85, 0xEC, 0x60, 0x36, 0x64, 0xC4, 0x98, 0xFF, 0xFF, 0xC0, 0xFE, 0x3D, 0x00,
+	 0xC1, 0xFE, 0x3B, 0x00, 0xC2, 0xFE, 0x39, 0x00, 0xC3, 0xFE, 0x37, 0x00, 0xC4, 0xFE, 0x35, 0x00,
+	 0xC5, 0xFE, 0x33, 0x00, 0xC6, 0xFE, 0x31, 0x00, 0xC7, 0xFE, 0x2F, 0x00, 0xC8, 0xFE, 0x2D, 0x00,
+	 0xC9, 0xFE, 0x2B, 0x00, 0xCA, 0xFE, 0x29, 0x00, 0xCB, 0xFE, 0x27, 0x00, 0xCC, 0xFE, 0x25, 0x00,
+	 0xCD, 0xFE, 0x23, 0x00, 0xCE, 0xFE, 0x21, 0x00, 0xCF, 0xFE, 0x1F, 0x00, 0xD0, 0xFE, 0x1D, 0x00,
+	 0xD1, 0xFE, 0x1B, 0x00, 0xD2, 0xFE, 0x19, 0x00, 0xD3, 0xFE, 0x17, 0x00, 0xD4, 0xFE, 0x15, 0x00,
+	 0xD5, 0xFE, 0x13, 0x00, 0xD6, 0xFE, 0x11, 0x00, 0xD7, 0xFE, 0x0F, 0x00, 0xD8, 0xFE, 0x0D, 0x00,
+	 0xD9, 0xFE, 0x0B, 0x00, 0xDA, 0xFE, 0x09, 0x00, 0xDB, 0xFE, 0x07, 0x00, 0xDC, 0xFE, 0x05, 0x00,
+	 0xDD, 0xFE, 0x03, 0x00, 0xDE, 0xFE, 0x01, 0x00, 0xDF, 0xFE, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF,
+	 0x00, 0x64, 0x9F, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x9E, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x9D, 0xFE,
+	 0xF0, 0x84, 0xFF, 0xFF, 0x9C, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x9B, 0xFE, 0xF0, 0x84, 0xFF, 0xFF,
+	 0x9A, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x99, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x98, 0xFE, 0xF0, 0x84,
+	 0xFF, 0xFF, 0x97, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x96, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x95, 0xFE,
+	 0xF0, 0x84, 0xFF, 0xFF, 0x94, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x93, 0xFE, 0xF0, 0x84, 0xFF, 0xFF,
+	 0x92, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x91, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x90, 0xFE, 0xF0, 0x84,
+	 0x06, 0xFB, 0x8F, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x8E, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x8D, 0xFE,
+	 0xF0, 0x84, 0xFF, 0xFF, 0x8C, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x8B, 0xFE, 0xF0, 0x84, 0xFF, 0xFF,
+	 0x8A, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x89, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x88, 0xFE, 0xF0, 0x84,
+	 0xFF, 0xFF, 0x87, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x86, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x85, 0xFE,
+	 0xF0, 0x84, 0xFF, 0xFF, 0x84, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x83, 0xFE, 0xF0, 0x84, 0xFF, 0xFF,
+	 0x82, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x81, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x80, 0xFE, 0xF0, 0x84,
+	 0x05, 0xFB, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x5C, 0x5C, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF,
+	 0x24, 0x40, 0x01, 0x27, 0x55, 0x00, 0x05, 0x60, 0x00, 0x63, 0x05, 0xFD, 0x30, 0x44, 0xBD, 0xDB,
+	 0x31, 0x44, 0xBD, 0xDB, 0x32, 0x44, 0xBD, 0xDB, 0x33, 0x44, 0xBD, 0xDB, 0x34, 0x44, 0xBD, 0xDB,
+	 0x35, 0x44, 0xBD, 0xDB, 0x36, 0x44, 0xBD, 0xDB, 0x37, 0x44, 0xBD, 0xDB, 0x38, 0x44, 0xBD, 0xDB,
+	 0x39, 0x44, 0xBD, 0xDB, 0x3A, 0x44, 0xBD, 0xDB, 0x3B, 0x44, 0xBD, 0xDB, 0x3C, 0x44, 0xBD, 0xDB,
+	 0x3D, 0x44, 0xBD, 0xDB, 0x3E, 0x44, 0xBD, 0xDB, 0x3F, 0x44, 0xBD, 0xDB, 0x02, 0x61, 0x61, 0x44,
+	 0x02, 0x36, 0x82, 0xFF, 0x03, 0x36, 0x83, 0xFF, 0x04, 0x36, 0x84, 0xFF, 0x05, 0x36, 0x85, 0xFF,
+	 0x06, 0x36, 0x86, 0xFF, 0x07, 0x36, 0x87, 0xFF, 0x20, 0x44, 0xBD, 0xDB, 0x21, 0x44, 0xBD, 0xDB,
+	 0x22, 0x44, 0xBD, 0xDB, 0x23, 0x44, 0xBD, 0xDB, 0x24, 0x44, 0xBD, 0xDB, 0x25, 0x44, 0xBD, 0xDB,
+	 0x26, 0x44, 0xBD, 0xDB, 0x27, 0x44, 0xBD, 0xDB, 0x28, 0x44, 0xBD, 0xDB, 0x29, 0x44, 0xBD, 0xDB,
+	 0x2A, 0x44, 0xBD, 0xDB, 0x2B, 0x44, 0xBD, 0xDB, 0x2C, 0x44, 0xBD, 0xDB, 0x2D, 0x44, 0xBD, 0xDB,
+	 0x2E, 0x44, 0xBD, 0xDB, 0x2F, 0x44, 0xBD, 0xDB, 0xDD, 0x81, 0x08, 0x3A, 0xD0, 0x01, 0x54, 0x00,
+	 0x27, 0x40, 0x10, 0x26, 0x30, 0x00, 0x26, 0x44, 0x01, 0x36, 0x2D, 0x00, 0x02, 0x36, 0x82, 0xFF,
+	 0x03, 0x36, 0x83, 0xFF, 0x04, 0x36, 0x84, 0xFF, 0x05, 0x36, 0x85, 0xFF, 0x06, 0x36, 0x86, 0xFF,
+	 0x25, 0x44, 0x00, 0x36, 0x44, 0x40, 0x01, 0x36, 0x44, 0x41, 0x02, 0x36, 0x44, 0x42, 0x03, 0x36,
+	 0x44, 0x43, 0x04, 0x36, 0x44, 0x44, 0x05, 0x36, 0x44, 0x45, 0x06, 0x36, 0x44, 0x46, 0x07, 0x36,
+	 0x44, 0x47, 0x08, 0x36, 0x44, 0x48, 0x09, 0x36, 0x44, 0x49, 0x0A, 0x36, 0x44, 0x4A, 0x0B, 0x36,
+	 0x44, 0x4B, 0x0C, 0x36, 0x44, 0x4C, 0x0D, 0x36, 0x44, 0x4D, 0x0E, 0x36, 0x44, 0x4E, 0x0F, 0x36,
+	 0x44, 0x4F, 0x87, 0xFF, 0x21, 0x00, 0x25, 0x44, 0x10, 0x36, 0x44, 0x50, 0x11, 0x36, 0x44, 0x51,
+	 0x12, 0x36, 0x44, 0x52, 0x13, 0x36, 0x44, 0x53, 0x14, 0x36, 0x44, 0x54, 0x15, 0x36, 0x44, 0x55,
+	 0x16, 0x36, 0x44, 0x56, 0x17, 0x36, 0x44, 0x57, 0x18, 0x36, 0x44, 0x58, 0x19, 0x36, 0x44, 0x59,
+	 0x1A, 0x36, 0x44, 0x5A, 0x1B, 0x36, 0x44, 0x5B, 0x1C, 0x36, 0x44, 0x5C, 0x1D, 0x36, 0x44, 0x5D,
+	 0x1E, 0x36, 0x44, 0x5E, 0x1F, 0x36, 0x44, 0x5F, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x25, 0x46,
+	 0xB3, 0x60, 0x58, 0x4F, 0x22, 0x78, 0xFF, 0xFF, 0x03, 0x61, 0x7F, 0x67, 0x0B, 0x02, 0x00, 0xF0,
+	 0x1B, 0x60, 0xE0, 0x62, 0x04, 0x64, 0xA2, 0xDB, 0x5A, 0xD9, 0x0A, 0x64, 0x5A, 0xDB, 0xFF, 0xFF,
+	 0x2B, 0xFF, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x40, 0x60, 0xC0, 0x64, 0x24, 0x45, 0xA4, 0x80,
+	 0x7F, 0x67, 0x02, 0x61, 0x11, 0x02, 0x1C, 0x60, 0x04, 0x62, 0x1A, 0x64, 0xA2, 0xDB, 0x00, 0x60,
+	 0x50, 0x63, 0x5A, 0xDD, 0xED, 0x60, 0xB9, 0x64, 0x80, 0xFB, 0x2D, 0xFF, 0xEB, 0x60, 0x84, 0x78,
+	 0xFF, 0xFF, 0x2A, 0xF3, 0x05, 0xFB, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x40, 0x60, 0xC0, 0x64,
+	 0x24, 0x45, 0xA4, 0x80, 0x7F, 0x67, 0x02, 0x61, 0x0F, 0x02, 0x1C, 0x60, 0x04, 0x62, 0x1C, 0x64,
+	 0xA2, 0xDB, 0x00, 0x60, 0x50, 0x63, 0x5A, 0xDD, 0xED, 0x60, 0xD3, 0x64, 0x80, 0xFB, 0x2D, 0xFF,
+	 0xEB, 0x60, 0x84, 0x78, 0xFF, 0xFF, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x7F, 0x60, 0xC0, 0x64,
+	 0x24, 0x45, 0xA4, 0x80, 0x02, 0x61, 0x34, 0x02, 0x25, 0x45, 0x20, 0x44, 0x80, 0x2A, 0x35, 0x00,
+	 0xF1, 0x60, 0x00, 0x64, 0xD4, 0x80, 0xFF, 0xFF, 0x01, 0x03, 0x29, 0x00, 0x21, 0x60, 0x74, 0x62,
+	 0xA2, 0xD1, 0x9A, 0xF3, 0x16, 0x60, 0xCC, 0x61, 0xA0, 0x84, 0xA1, 0xDB, 0x25, 0x45, 0x1B, 0x60,
+	 0x52, 0x63, 0x01, 0x61, 0xBD, 0xD3, 0xBD, 0xD1, 0xD4, 0x80, 0xBD, 0xD3, 0xBD, 0xD5, 0xCD, 0x81,
+	 0x02, 0x03, 0x15, 0x03, 0xF7, 0x01, 0xA2, 0xFF, 0xA6, 0xD3, 0x40, 0x4C, 0x00, 0xA8, 0x67, 0x43,
+	 0x0C, 0x02, 0xA2, 0xDD, 0x42, 0x48, 0x64, 0x41, 0xB3, 0x60, 0x58, 0x4D, 0x77, 0x78, 0xFF, 0xFF,
+	 0x66, 0x44, 0x28, 0xDB, 0x02, 0x03, 0x2C, 0x58, 0xA3, 0xFF, 0x0C, 0x61, 0x03, 0x00, 0x04, 0x61,
+	 0x7F, 0x67, 0x01, 0x00, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0xF1, 0x60, 0x02, 0x64, 0xD4, 0x80,
+	 0x7F, 0x67, 0x06, 0x63, 0xF8, 0x02, 0x31, 0x40, 0x20, 0x26, 0xF5, 0x01, 0x21, 0x60, 0x74, 0x62,
+	 0xA2, 0xD1, 0x9A, 0xF3, 0x16, 0x60, 0xCC, 0x61, 0xA0, 0x84, 0xA1, 0xDB, 0x16, 0x60, 0xD0, 0x61,
+	 0x01, 0x64, 0xA1, 0xDB, 0xFF, 0xFF, 0xC4, 0xFE, 0xE5, 0x01, 0xC6, 0xFE, 0xE3, 0x01, 0x7E, 0x60,
+	 0xC0, 0x64, 0x24, 0x45, 0xA4, 0x80, 0x02, 0x61, 0x3F, 0x02, 0x25, 0x45, 0xF8, 0x2B, 0x3B, 0x00,
+	 0x2E, 0xF5, 0x67, 0x44, 0xD4, 0x80, 0x17, 0x60, 0x6A, 0x63, 0x39, 0x03, 0x64, 0x61, 0x24, 0x44,
+	 0x01, 0x27, 0x29, 0x00, 0xA3, 0xFC, 0xA4, 0xF8, 0xBD, 0xD3, 0xA3, 0xD1, 0xD4, 0x80, 0xCD, 0x81,
+	 0x08, 0x24, 0x64, 0x58, 0x08, 0xA3, 0xF8, 0x02, 0x08, 0x60, 0x00, 0x63, 0xBD, 0xD3, 0xA3, 0xD1,
+	 0xFE, 0xA0, 0xFA, 0x60, 0x00, 0x64, 0xD0, 0x80, 0x14, 0x02, 0x13, 0x02, 0x04, 0xA3, 0xBE, 0xD3,
+	 0xBD, 0xD1, 0x0F, 0x18, 0xD4, 0x80, 0x0D, 0x18, 0x03, 0x03, 0xC3, 0x83, 0xC3, 0x83, 0xF7, 0x01,
+	 0x64, 0x41, 0xDD, 0x81, 0xE1, 0x81, 0xCB, 0x83, 0x46, 0x65, 0xF2, 0x60, 0x58, 0x4F, 0x4A, 0x78,
+	 0xFF, 0xFF, 0x00, 0x67, 0x0A, 0x00, 0xBD, 0xD3, 0xBE, 0xD1, 0xD4, 0x80, 0xCD, 0x81, 0x08, 0x24,
+	 0x64, 0x58, 0x08, 0xA3, 0xF8, 0x02, 0x04, 0x61, 0x7F, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x0F, 0x64,
+	 0x23, 0xFA, 0x67, 0x44, 0x24, 0xFA, 0x62, 0x41, 0x3E, 0x60, 0x00, 0x65, 0x1A, 0x63, 0xEA, 0x60,
+	 0x88, 0x64, 0x65, 0x46, 0x58, 0xD0, 0x2E, 0xF5, 0x59, 0xD8, 0xFB, 0x1F, 0x00, 0x67, 0x23, 0x58,
+	 0xFF, 0xFF, 0x4B, 0xD3, 0xFF, 0xFF, 0x60, 0x41, 0xE8, 0x84, 0xDC, 0x84, 0x23, 0xFA, 0xBF, 0xD1,
+	 0x4A, 0x65, 0x64, 0x43, 0xF2, 0x60, 0x58, 0x4F, 0x4A, 0x78, 0xFF, 0xFF, 0x00, 0x67, 0x23, 0x58,
+	 0xFF, 0xFF, 0x25, 0xF2, 0xFF, 0xFF, 0xE0, 0xA0, 0x20, 0x64, 0x01, 0x06, 0x25, 0xFA, 0x23, 0xF2,
+	 0xDF, 0xD1, 0xCC, 0x84, 0xE0, 0x85, 0x0B, 0x06, 0xBF, 0xD1, 0x64, 0x41, 0xD5, 0x80, 0x64, 0x43,
+	 0x01, 0x06, 0x65, 0x41, 0x4A, 0x65, 0xEF, 0x60, 0x58, 0x4F, 0x87, 0x78, 0xFF, 0xFF, 0x00, 0x67,
+	 0x23, 0x58, 0xFF, 0xFF, 0xBC, 0xF3, 0x02, 0x63, 0x23, 0xFC, 0x07, 0xB4, 0x25, 0xFA, 0x00, 0x67,
+	 0x23, 0x58, 0xFF, 0xFF, 0x4B, 0xD3, 0xBF, 0xD3, 0x60, 0x41, 0xC9, 0x83, 0xE9, 0x81, 0xDD, 0x81,
+	 0xA3, 0xFA, 0xE0, 0x81, 0x3C, 0x60, 0x00, 0x67, 0x02, 0x24, 0x02, 0xA4, 0x60, 0x47, 0x40, 0x4B,
+	 0xC9, 0x81, 0x4A, 0x65, 0xAB, 0x46, 0x59, 0xD0, 0xAB, 0x46, 0xA5, 0xD8, 0xDA, 0x85, 0x80, 0x3A,
+	 0x02, 0x00, 0x00, 0xF4, 0x04, 0x65, 0xF6, 0x1F, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0xFC, 0xA3,
+	 0xA3, 0xD1, 0x4C, 0x65, 0xA4, 0xD3, 0xDA, 0x83, 0x60, 0x47, 0x25, 0xFA, 0x00, 0x7E, 0x60, 0x47,
+	 0x01, 0x26, 0xDC, 0x84, 0x60, 0x41, 0xE8, 0x84, 0xD8, 0x84, 0x23, 0xFA, 0xAB, 0x01, 0xFC, 0xA3,
+	 0xA3, 0xD1, 0x4C, 0x65, 0xA4, 0xD3, 0xDA, 0x83, 0x00, 0x7F, 0x25, 0xFA, 0x60, 0x41, 0x01, 0x26,
+	 0xDD, 0x81, 0xE9, 0x84, 0xD8, 0x84, 0x23, 0xFA, 0x9D, 0x01, 0x23, 0xF2, 0x12, 0x60, 0xB8, 0x65,
+	 0x60, 0x41, 0x12, 0x60, 0x54, 0x63, 0xA3, 0xDB, 0xFF, 0xA1, 0x48, 0x64, 0x58, 0xD0, 0x7E, 0xA8,
+	 0x5B, 0xD9, 0x02, 0x02, 0x00, 0xF4, 0x02, 0x64, 0xFF, 0xA1, 0xD7, 0x80, 0x02, 0x03, 0x01, 0x03,
+	 0xF5, 0x01, 0x2E, 0xF5, 0x00, 0x60, 0x2F, 0x65, 0x25, 0xF2, 0x00, 0x63, 0xCC, 0x84, 0x03, 0xA3,
+	 0xFD, 0x05, 0x4A, 0x64, 0xD7, 0x80, 0x11, 0x60, 0xF0, 0x61, 0x2F, 0x05, 0xA1, 0xDD, 0xE3, 0x83,
+	 0xFE, 0xA3, 0x58, 0xD0, 0x7E, 0xA8, 0x59, 0xD9, 0x02, 0x02, 0x00, 0xF4, 0x02, 0x64, 0xF9, 0x1F,
+	 0x00, 0x63, 0x59, 0xDD, 0x2E, 0xF5, 0x11, 0x60, 0xF0, 0x64, 0x25, 0xF0, 0xA0, 0xD3, 0xD3, 0x80,
+	 0x01, 0xB0, 0x04, 0x03, 0x01, 0xA4, 0x03, 0x03, 0xA2, 0xDB, 0x01, 0x00, 0xA2, 0xDD, 0x11, 0x60,
+	 0xF8, 0x63, 0x10, 0x60, 0x0A, 0x65, 0xBD, 0xD3, 0xBD, 0xD1, 0xE0, 0x84, 0xC4, 0x82, 0x10, 0x60,
+	 0x2A, 0x65, 0x07, 0x64, 0x64, 0x41, 0x5A, 0xDB, 0xD6, 0x80, 0xCD, 0x81, 0x06, 0x03, 0xFB, 0x02,
+	 0x25, 0xF2, 0x02, 0xA3, 0xCC, 0x84, 0xA2, 0xDA, 0xEC, 0x02, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF,
+	 0x12, 0x60, 0x54, 0x61, 0xA1, 0xD3, 0x23, 0xFA, 0xE0, 0x83, 0x4A, 0x65, 0x04, 0x02, 0x02, 0x63,
+	 0x23, 0xFC, 0xA5, 0xFC, 0x09, 0x00, 0xDB, 0x83, 0x59, 0xD1, 0xA5, 0xD8, 0xDA, 0x85, 0x80, 0x3A,
+	 0x02, 0x00, 0x00, 0xF4, 0x04, 0x65, 0xF8, 0x1F, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x11, 0x60,
+	 0xF0, 0x62, 0xA2, 0xD3, 0x00, 0x61, 0x02, 0xA4, 0xFE, 0xA0, 0x23, 0xFA, 0x1B, 0x03, 0xFA, 0xA4,
+	 0xFD, 0xA4, 0x01, 0xA1, 0xFD, 0x07, 0x61, 0x43, 0x23, 0xF2, 0x25, 0xFC, 0xE0, 0x83, 0x02, 0xA3,
+	 0x11, 0x60, 0xF0, 0x61, 0x00, 0x60, 0x4A, 0x64, 0x59, 0xD1, 0x58, 0xD8, 0x7E, 0x3A, 0x02, 0x00,
+	 0x00, 0xF4, 0x02, 0x64, 0xF9, 0x1F, 0x25, 0xF2, 0x23, 0xF2, 0x01, 0xB0, 0xCC, 0x84, 0x04, 0x02,
+	 0x23, 0xFA, 0x02, 0x00, 0x00, 0x64, 0x25, 0xFA, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x41, 0x4B,
+	 0x65, 0x42, 0x80, 0x64, 0xD4, 0x85, 0x2B, 0x41, 0x00, 0xA1, 0x55, 0x8B, 0x0D, 0x03, 0x02, 0x04,
+	 0x65, 0x41, 0x02, 0x00, 0x00, 0x64, 0x40, 0x4B, 0xCA, 0x84, 0x58, 0xD0, 0xC9, 0x81, 0xBD, 0xD9,
+	 0xFC, 0x02, 0x00, 0xF4, 0x04, 0x65, 0xEC, 0x01, 0x2F, 0x58, 0xFF, 0xFF, 0xFC, 0xA3, 0xA3, 0xD3,
+	 0x02, 0x7C, 0xA0, 0xD3, 0x23, 0xF8, 0xDC, 0x84, 0x25, 0xFA, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF,
+	 0x02, 0x64, 0x23, 0xFA, 0x01, 0x64, 0x9D, 0xFE, 0x02, 0x28, 0x02, 0x64, 0x25, 0xFA, 0x00, 0x67,
+	 0x23, 0x58, 0xFF, 0xFF, 0x21, 0x60, 0x80, 0x62, 0xA2, 0xD3, 0x02, 0x7C, 0x23, 0xF8, 0x01, 0xB4,
+	 0x25, 0xFA, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0xFC, 0xA3, 0xA3, 0xD1, 0x02, 0x64, 0x23, 0xFA,
+	 0x64, 0x44, 0x7C, 0x5F, 0x60, 0x45, 0x64, 0x47, 0x7C, 0x5F, 0x89, 0xF1, 0x66, 0x41, 0xC0, 0x86,
+	 0xA5, 0xD2, 0x61, 0x46, 0x00, 0x63, 0x60, 0x40, 0x0A, 0x37, 0x01, 0x63, 0x14, 0x37, 0x02, 0x63,
+	 0x37, 0x37, 0x06, 0x63, 0x6E, 0x37, 0x0B, 0x63, 0x25, 0xFC, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF,
+	 0x02, 0x64, 0x23, 0xFA, 0x88, 0xFF, 0x75, 0x44, 0x8D, 0xFF, 0xE8, 0x87, 0xE8, 0x84, 0xE8, 0x84,
+	 0x03, 0xB4, 0x25, 0xFA, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x25, 0xF0, 0x21, 0x60, 0x7C, 0x65,
+	 0x23, 0xF2, 0xA5, 0xD9, 0x02, 0xA8, 0x64, 0x44, 0x07, 0x02, 0x00, 0xBC, 0xF2, 0xA4, 0x04, 0x03,
+	 0x03, 0x07, 0x1F, 0x60, 0xAA, 0x62, 0xA2, 0xD9, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x20, 0x63,
+	 0x20, 0x60, 0x0A, 0x61, 0x48, 0x64, 0x58, 0xD0, 0x59, 0xD9, 0xFD, 0x1F, 0x25, 0xF0, 0x20, 0x64,
+	 0xD0, 0x81, 0xFF, 0xFF, 0x02, 0x07, 0x25, 0xFA, 0x0F, 0x00, 0x20, 0x60, 0x0E, 0x63, 0xC3, 0x83,
+	 0x01, 0x2A, 0x06, 0x00, 0xCF, 0x83, 0xA3, 0xD3, 0xCD, 0x81, 0x00, 0x7F, 0xBD, 0xDB, 0x04, 0x03,
+	 0x00, 0x64, 0xC9, 0x81, 0xBD, 0xDB, 0xFD, 0x02, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x23, 0xF2,
+	 0x25, 0xF0, 0x01, 0x60, 0x70, 0x63, 0xA3, 0xD9, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0xFC, 0xA3,
+	 0xA5, 0xF0, 0xA3, 0xD1, 0xFF, 0xFF, 0x64, 0x5E, 0x00, 0x7F, 0x60, 0x41, 0x64, 0x47, 0x7C, 0x5F,
+	 0x89, 0xF1, 0x66, 0x43, 0xC0, 0x86, 0x65, 0x44, 0xA1, 0xDA, 0x63, 0x46, 0x00, 0x67, 0x23, 0x58,
+	 0xFF, 0xFF, 0xFC, 0xA3, 0xA3, 0xD1, 0xFF, 0xFF, 0x64, 0x5E, 0x00, 0x7F, 0x60, 0x45, 0x64, 0x47,
+	 0x7C, 0x5F, 0x89, 0xF1, 0x66, 0x41, 0xC0, 0x86, 0x65, 0x44, 0xA0, 0xD2, 0x61, 0x46, 0x25, 0xFA,
+	 0x02, 0x64, 0x23, 0xFA, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x23, 0xF2, 0x25, 0xF0, 0x02, 0xA8,
+	 0x00, 0x67, 0x02, 0x02, 0x2D, 0xF9, 0x2C, 0xF9, 0x23, 0x58, 0xFF, 0xFF, 0x1F, 0x60, 0xA8, 0x61,
+	 0x23, 0xF2, 0x25, 0xF2, 0x02, 0xA8, 0x00, 0xA8, 0x09, 0x02, 0x07, 0x03, 0xD0, 0xA0, 0x30, 0x65,
+	 0x03, 0x04, 0xA7, 0xA0, 0x59, 0x65, 0x01, 0x06, 0x65, 0x44, 0xA1, 0xDB, 0x00, 0x67, 0x23, 0x58,
+	 0xFF, 0xFF, 0x04, 0x61, 0x0A, 0x00, 0x25, 0x60, 0x2C, 0x61, 0x01, 0x64, 0xA1, 0xDB, 0x04, 0x00,
+	 0x25, 0x60, 0x2C, 0x61, 0x00, 0x64, 0xA1, 0xDB, 0x06, 0x61, 0x41, 0x56, 0xC7, 0xFE, 0xEB, 0x60,
+	 0x84, 0x78, 0xFF, 0xFF, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0xA2, 0xFF, 0x46, 0x45, 0x02, 0xF0,
+	 0x09, 0x60, 0x08, 0x64, 0xD0, 0x80, 0x00, 0xF4, 0x01, 0xF2, 0x66, 0x5C, 0x25, 0x46, 0x56, 0x02,
+	 0x70, 0x27, 0x54, 0x00, 0x12, 0x64, 0x03, 0xFA, 0x04, 0xF8, 0x0E, 0xF2, 0x87, 0xFC, 0x8D, 0xFC,
+	 0x8E, 0xFC, 0xDA, 0x82, 0x16, 0x61, 0x00, 0x63, 0xC9, 0x81, 0x5A, 0xDC, 0xFD, 0x02, 0x60, 0x40,
+	 0xF0, 0x3B, 0x16, 0x00, 0x32, 0x44, 0x8F, 0xF3, 0x01, 0xB0, 0xF6, 0xA0, 0x08, 0x24, 0x2C, 0x05,
+	 0xDC, 0x83, 0xF0, 0x67, 0x0E, 0xFA, 0x1B, 0x60, 0xC4, 0x64, 0x2B, 0xDB, 0x66, 0x44, 0x5A, 0xDB,
+	 0x02, 0x64, 0x5A, 0xDB, 0x8F, 0xFD, 0x2B, 0xFF, 0xFE, 0x64, 0x3B, 0x42, 0x4A, 0xDB, 0x4F, 0x00,
+	 0x90, 0xF3, 0x0A, 0x65, 0xD4, 0x80, 0xDC, 0x83, 0x17, 0x05, 0x90, 0xFD, 0x98, 0xFE, 0x04, 0x04,
+	 0x00, 0x7F, 0x08, 0x7E, 0x0E, 0xFA, 0x3B, 0xFF, 0x1B, 0x60, 0xB8, 0x64, 0x2B, 0xDB, 0x66, 0x44,
+	 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0x0E, 0xF2, 0x2B, 0xFF, 0x60, 0x40, 0x08, 0x26, 0xF7, 0xFE,
+	 0xFD, 0x64, 0x3B, 0x42, 0x4A, 0xDB, 0x32, 0x00, 0x8C, 0xF3, 0xFF, 0xFF, 0xD8, 0xA0, 0xFF, 0xFF,
+	 0x0D, 0x04, 0x1B, 0x60, 0xD0, 0x64, 0x2B, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB,
+	 0xFF, 0xFF, 0x2B, 0xFF, 0xFC, 0x64, 0x3B, 0x42, 0x4A, 0xDB, 0x21, 0x00, 0x46, 0x45, 0x00, 0x64,
+	 0x2B, 0xDB, 0x25, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xA2, 0xFF,
+	 0x00, 0xF4, 0x01, 0xF0, 0x0A, 0x18, 0x70, 0x67, 0xA0, 0x80, 0xF0, 0x67, 0x06, 0x03, 0xC0, 0x84,
+	 0x01, 0xFA, 0x25, 0x46, 0x25, 0x44, 0x80, 0xFC, 0x05, 0xFA, 0xB4, 0x60, 0x58, 0x4E, 0x48, 0x78,
+	 0xFF, 0xFF, 0xD4, 0xFE, 0xA3, 0xFF, 0xFF, 0x64, 0x3B, 0x42, 0x4A, 0xDB, 0xD4, 0xFE, 0xA3, 0xFF,
+	 0x2D, 0x58, 0xFF, 0xFF, 0x1B, 0x60, 0xBE, 0x64, 0x40, 0x47, 0x58, 0x4F, 0x0D, 0x00, 0x1B, 0x60,
+	 0xB2, 0x64, 0x40, 0x47, 0x58, 0x4F, 0x18, 0x00, 0x1B, 0x60, 0xCA, 0x64, 0x40, 0x47, 0x58, 0x4F,
+	 0x03, 0x00, 0xEB, 0x60, 0x84, 0x78, 0xFF, 0xFF, 0x27, 0xD5, 0x0E, 0xF2, 0x0B, 0x18, 0x60, 0x40,
+	 0x01, 0x2A, 0x08, 0x00, 0x1B, 0x60, 0xE0, 0x64, 0x40, 0x4B, 0xF0, 0x60, 0x58, 0x4D, 0x75, 0x78,
+	 0xFF, 0xFF, 0xF2, 0x01, 0x2F, 0x58, 0xFF, 0xFF, 0x27, 0xD5, 0x0E, 0xF2, 0x14, 0x18, 0x60, 0x40,
+	 0x01, 0x2A, 0x11, 0x00, 0x02, 0xF0, 0x09, 0x60, 0x08, 0x64, 0xD0, 0x80, 0xA2, 0xFF, 0x90, 0xF3,
+	 0x02, 0x02, 0xCC, 0x84, 0x90, 0xFB, 0x1B, 0x60, 0xE0, 0x64, 0x40, 0x4B, 0xF0, 0x60, 0x58, 0x4D,
+	 0x75, 0x78, 0xFF, 0xFF, 0xE9, 0x01, 0x2F, 0x58, 0xFF, 0xFF, 0xFB, 0x64, 0x3A, 0x42, 0x4A, 0xDB,
+	 0xA2, 0xFF, 0x93, 0xF3, 0x8F, 0xF3, 0xCC, 0x80, 0xFA, 0xA0, 0x01, 0x14, 0x1E, 0x05, 0xB3, 0x60,
+	 0x58, 0x4D, 0x4E, 0x78, 0xFF, 0xFF, 0xA2, 0xFF, 0x18, 0x03, 0xF0, 0x67, 0x0E, 0xFA, 0x1B, 0x60,
+	 0xE0, 0x62, 0x1B, 0x60, 0xC4, 0x64, 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB,
+	 0xFF, 0xFF, 0x2B, 0xFF, 0xF6, 0x64, 0x3A, 0x42, 0x4A, 0xDB, 0x93, 0xF3, 0x8F, 0xF3, 0xCC, 0x83,
+	 0xDC, 0x84, 0x01, 0x15, 0x93, 0xFD, 0x8F, 0xFB, 0xD4, 0xFE, 0x92, 0xF3, 0x90, 0xF3, 0x00, 0xA8,
+	 0x91, 0xF1, 0x03, 0x02, 0xD0, 0x80, 0xFF, 0xFF, 0x27, 0x05, 0xB3, 0x60, 0x58, 0x4D, 0x4E, 0x78,
+	 0xFF, 0xFF, 0xA2, 0xFF, 0x21, 0x03, 0x00, 0x63, 0x92, 0xF3, 0x0E, 0xFC, 0xCC, 0x84, 0xFF, 0x3A,
+	 0x92, 0xFB, 0x98, 0xFE, 0x03, 0x04, 0x08, 0xBB, 0x0E, 0xFC, 0x3B, 0xFF, 0x1B, 0x60, 0xE0, 0x62,
+	 0x1B, 0x60, 0xB8, 0x64, 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF,
+	 0x2B, 0xFF, 0xF7, 0x64, 0x3A, 0x42, 0x4A, 0xDB, 0x90, 0xF3, 0x0E, 0xF2, 0xDC, 0x83, 0x08, 0xB0,
+	 0x90, 0xFD, 0x08, 0x28, 0xF7, 0xFE, 0xD4, 0xFE, 0xA3, 0xFF, 0xEB, 0x60, 0x84, 0x78, 0xFF, 0xFF,
+	 0xB9, 0xFE, 0x13, 0xFF, 0x24, 0x40, 0x80, 0x2B, 0x0B, 0x00, 0xA2, 0xFF, 0x25, 0x46, 0x09, 0xF4,
+	 0x0E, 0xF2, 0x05, 0x18, 0x08, 0xBC, 0x0E, 0xFA, 0xFF, 0xFF, 0xF7, 0xFE, 0x01, 0x00, 0xD8, 0xFE,
+	 0xA3, 0xFF, 0x25, 0x46, 0x3E, 0xF2, 0x00, 0xF4, 0x08, 0xF0, 0x25, 0x46, 0x06, 0xB4, 0xFF, 0x7F,
+	 0x10, 0xBC, 0x06, 0x26, 0xFD, 0x7F, 0x0E, 0xFA, 0x3E, 0xF2, 0x3F, 0xF2, 0x60, 0x41, 0x08, 0x2A,
+	 0x64, 0x47, 0x3F, 0xFA, 0x60, 0x45, 0x1F, 0x60, 0x62, 0x62, 0xA2, 0xD3, 0xA3, 0xFC, 0xAB, 0xFC,
+	 0x91, 0xFC, 0xD4, 0x80, 0xE0, 0x60, 0xC1, 0x65, 0xA5, 0x80, 0x01, 0x04, 0x07, 0x03, 0x23, 0xF0,
+	 0x08, 0x64, 0xB0, 0x84, 0xA2, 0xDA, 0xF2, 0x60, 0x25, 0x78, 0xFF, 0xFF, 0xF4, 0x60, 0x58, 0x4F,
+	 0x2D, 0x78, 0xFF, 0xFF, 0x14, 0x04, 0x23, 0xF0, 0x04, 0x64, 0xB0, 0x84, 0xA2, 0xDA, 0x98, 0xF1,
+	 0x1E, 0x60, 0xFC, 0x64, 0xA0, 0xD3, 0xFF, 0xFF, 0xDC, 0x84, 0xDC, 0x80, 0xD0, 0x80, 0x04, 0x03,
+	 0xA2, 0xDB, 0x08, 0x24, 0xC6, 0xFE, 0x02, 0x00, 0x20, 0x60, 0x00, 0x75, 0x46, 0x00, 0x3E, 0xF0,
+	 0x89, 0xF1, 0x64, 0x47, 0x07, 0xB4, 0x07, 0x36, 0x3B, 0x00, 0x04, 0x03, 0xCC, 0x84, 0xE0, 0x84,
+	 0xC0, 0x83, 0x2D, 0x00, 0x2C, 0xF2, 0x88, 0xF1, 0x01, 0xB0, 0x64, 0x43, 0x35, 0x02, 0x2E, 0xF2,
+	 0x12, 0x60, 0xCE, 0x65, 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD3, 0x66, 0x41, 0x60, 0x46,
+	 0x60, 0x43, 0x05, 0xF2, 0x16, 0x18, 0x61, 0x46, 0x2E, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x04, 0xF2,
+	 0x0C, 0x02, 0x61, 0x46, 0x2D, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x03, 0xF2, 0x06, 0x02, 0x61, 0x46,
+	 0x2C, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0xFF, 0xFF, 0x07, 0x03, 0x80, 0xF4, 0xFF, 0xFF, 0x63, 0x46,
+	 0xE8, 0x1B, 0x88, 0xF3, 0x08, 0xFE, 0x60, 0x43, 0x61, 0x46, 0x01, 0x03, 0x09, 0x00, 0x66, 0x45,
+	 0x63, 0x46, 0x06, 0xF0, 0x65, 0x46, 0x64, 0x44, 0x0C, 0x26, 0x02, 0x00, 0x02, 0x26, 0x04, 0x00,
+	 0x23, 0xF0, 0x04, 0x64, 0xB0, 0x84, 0xA2, 0xDA, 0x07, 0xFC, 0x23, 0xF2, 0xFF, 0xFF, 0x10, 0x1B,
+	 0x1B, 0x60, 0xE0, 0x62, 0x1B, 0x60, 0x9A, 0x64, 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64,
+	 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0x0E, 0xF2, 0xC8, 0xFE, 0x10, 0xAC, 0x0E, 0xFA, 0x0F, 0x00,
+	 0x1B, 0x60, 0xE0, 0x62, 0x1B, 0x60, 0xAC, 0x64, 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64,
+	 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0x0E, 0xF2, 0xCE, 0xFE, 0x10, 0xAC, 0x0E, 0xFA, 0xEB, 0x60,
+	 0x84, 0x78, 0xFF, 0xFF, 0xCB, 0x84, 0xC9, 0x83, 0xFF, 0xFF, 0x08, 0x04, 0x58, 0xD1, 0xA5, 0xD8,
+	 0xDA, 0x85, 0x80, 0x3A, 0x02, 0x00, 0x00, 0xF4, 0x04, 0x65, 0xF8, 0x1F, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x25, 0xF0, 0x21, 0x60, 0x2C, 0x62, 0xA2, 0xD9, 0x19, 0x00, 0x21, 0x60, 0x80, 0x64, 0xA0, 0xD1,
+	 0x7F, 0xF9, 0x0C, 0x60, 0x38, 0x62, 0x40, 0x63, 0x00, 0x64, 0x5A, 0xDB, 0xFE, 0x1F, 0x64, 0x40,
+	 0x01, 0x2A, 0x0C, 0x00, 0x04, 0x65, 0x0C, 0x60, 0x38, 0x61, 0x48, 0x64, 0x3E, 0x63, 0x7C, 0xA8,
+	 0x58, 0xD0, 0x59, 0xD9, 0x02, 0x02, 0x00, 0xF4, 0x02, 0x64, 0xF9, 0x1F, 0x21, 0x60, 0x2C, 0x62,
+	 0xA2, 0xD1, 0x0D, 0x60, 0x1C, 0x65, 0x02, 0xFE, 0x64, 0x44, 0xF8, 0x84, 0xF8, 0x84, 0xF8, 0x87,
+	 0x60, 0x41, 0x64, 0x44, 0xE0, 0x84, 0xE0, 0x84, 0xC4, 0x84, 0x3E, 0xFB, 0x60, 0x42, 0x61, 0x44,
+	 0x03, 0xA2, 0x60, 0xFE, 0xA2, 0xDB, 0xFF, 0xFF, 0x20, 0xFE, 0x64, 0x44, 0x0C, 0x60, 0x3A, 0x65,
+	 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xC4, 0x84, 0x40, 0xFB, 0xFF, 0xFF, 0x00, 0x67,
+	 0x00, 0x61, 0x23, 0x58, 0xFF, 0xFF, 0x21, 0x60, 0x80, 0x64, 0xA0, 0xD1, 0x7F, 0xF9, 0x00, 0x64,
+	 0x40, 0x41, 0x64, 0x40, 0x01, 0x2A, 0xA6, 0x00, 0x4A, 0x64, 0xA0, 0xD2, 0xFF, 0xFF, 0x40, 0x42,
+	 0x80, 0x2B, 0x04, 0x00, 0xFF, 0xB4, 0x40, 0x42, 0x01, 0x64, 0x40, 0x41, 0x88, 0xF3, 0x46, 0x4B,
+	 0x87, 0xF3, 0x60, 0x46, 0xE0, 0x83, 0xAB, 0x46, 0x26, 0xF0, 0xAB, 0x46, 0x55, 0xF8, 0xAB, 0x46,
+	 0x27, 0xF0, 0xAB, 0x46, 0x56, 0xF8, 0xAB, 0x46, 0x28, 0xF0, 0xAB, 0x46, 0x57, 0xF8, 0x66, 0x44,
+	 0x02, 0xA6, 0xF1, 0x1F, 0x88, 0xF3, 0xFF, 0xFF, 0x60, 0x46, 0xAB, 0x46, 0x0C, 0x60, 0x7A, 0x65,
+	 0x22, 0x44, 0xFF, 0xB4, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xC4, 0x81, 0xC9, 0x81,
+	 0x52, 0x64, 0x0E, 0x63, 0x58, 0xD0, 0x59, 0xD9, 0xFD, 0x1F, 0x21, 0x44, 0x01, 0x2A, 0x08, 0x00,
+	 0xAB, 0x46, 0xF0, 0xA1, 0x6E, 0x64, 0x0E, 0x63, 0x59, 0xD1, 0x58, 0xD8, 0xFD, 0x1F, 0xAB, 0x46,
+	 0x22, 0x44, 0xFF, 0xB4, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0x0C, 0x60, 0xDC, 0x65, 0xC4, 0x81,
+	 0x60, 0x45, 0xC9, 0x81, 0x62, 0x64, 0x06, 0x63, 0x58, 0xD0, 0x59, 0xD9, 0xFD, 0x1F, 0x21, 0x44,
+	 0x01, 0x2A, 0x08, 0x00, 0xAB, 0x46, 0xF8, 0xA1, 0xAE, 0x64, 0x06, 0x63, 0x59, 0xD1, 0x58, 0xD8,
+	 0xFD, 0x1F, 0xAB, 0x46, 0x65, 0x44, 0x0C, 0x60, 0xFC, 0x65, 0xC4, 0x81, 0xC9, 0x81, 0x6A, 0x64,
+	 0x06, 0x63, 0x58, 0xD0, 0x59, 0xD9, 0xFD, 0x1F, 0x22, 0x44, 0xFF, 0xB4, 0xE0, 0x84, 0xE0, 0x85,
+	 0xC4, 0x84, 0x0C, 0x60, 0xC2, 0x65, 0xC4, 0x81, 0x72, 0x64, 0x04, 0x63, 0x58, 0xD0, 0x59, 0xD9,
+	 0xFD, 0x1F, 0xAB, 0x46, 0x21, 0x44, 0x01, 0x2A, 0x06, 0x00, 0xFA, 0xA1, 0x88, 0x64, 0x04, 0x63,
+	 0x59, 0xD1, 0x58, 0xD8, 0xFD, 0x1F, 0x37, 0xF0, 0x21, 0x44, 0x01, 0x2A, 0x13, 0x00, 0x22, 0x44,
+	 0x3D, 0xFB, 0x60, 0x41, 0x02, 0xFE, 0xF8, 0x84, 0xF8, 0x84, 0xF8, 0x84, 0x3C, 0xFB, 0x0C, 0x60,
+	 0xBE, 0x63, 0x88, 0xFF, 0xCD, 0x81, 0x06, 0xA3, 0xFD, 0x0D, 0x8D, 0xFF, 0x3B, 0xFD, 0x64, 0x47,
+	 0x80, 0xBF, 0x60, 0x5C, 0x22, 0x43, 0x80, 0x61, 0x88, 0xFF, 0xCF, 0x83, 0xE1, 0x81, 0xFD, 0x0D,
+	 0x8D, 0xFF, 0x61, 0x47, 0x31, 0x91, 0xB1, 0x84, 0x37, 0xFA, 0x87, 0xF3, 0xFF, 0xFF, 0xCC, 0x83,
+	 0xE3, 0x83, 0x66, 0x44, 0x02, 0xA6, 0x37, 0xF0, 0x66, 0x44, 0xB1, 0x9C, 0x37, 0xF8, 0x02, 0xA6,
+	 0xFA, 0x1F, 0xAB, 0x46, 0x00, 0x67, 0x00, 0x61, 0x23, 0x58, 0xFF, 0xFF, 0x23, 0xF2, 0x25, 0xF0,
+	 0x02, 0xA8, 0x00, 0x67, 0x24, 0x02, 0x3D, 0xF1, 0x64, 0x44, 0x03, 0xB4, 0x40, 0x42, 0xD0, 0x80,
+	 0x88, 0xF3, 0xFF, 0xFF, 0x60, 0x46, 0xB7, 0xF4, 0x80, 0x61, 0x02, 0x02, 0xE3, 0x83, 0xEB, 0x83,
+	 0x22, 0x44, 0x88, 0xFF, 0xCC, 0x84, 0xE1, 0x81, 0xFD, 0x0D, 0x8D, 0xFF, 0x61, 0x47, 0x31, 0x91,
+	 0x9D, 0x85, 0xA7, 0x83, 0x37, 0xFC, 0x87, 0xF3, 0xFF, 0xFF, 0xCC, 0x83, 0xE3, 0x83, 0x66, 0x44,
+	 0x02, 0xA6, 0xB7, 0xF2, 0x66, 0x44, 0xA5, 0x81, 0xB7, 0xFA, 0x02, 0xA6, 0xFA, 0x1F, 0x00, 0x67,
+	 0x23, 0x58, 0xFF, 0xFF, 0x11, 0x64, 0x23, 0xFA, 0x25, 0x44, 0x24, 0xFA, 0x04, 0x64, 0x40, 0x4B,
+	 0x62, 0x41, 0x0C, 0x60, 0xC2, 0x64, 0x04, 0x63, 0x58, 0xD1, 0x59, 0xD8, 0xFD, 0x1F, 0x2B, 0x43,
+	 0x00, 0x7C, 0x59, 0xD8, 0x4F, 0x8B, 0x06, 0xA4, 0xF6, 0x02, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF,
+	 0x21, 0x60, 0x80, 0x64, 0xA0, 0xD1, 0x7F, 0xF9, 0x64, 0x40, 0x01, 0x2A, 0x4E, 0x00, 0x27, 0xF2,
+	 0x12, 0x60, 0xCE, 0x65, 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD3, 0x66, 0x41, 0x60, 0x46,
+	 0x60, 0x43, 0x05, 0xF2, 0x16, 0x18, 0x61, 0x46, 0x27, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x04, 0xF2,
+	 0x0C, 0x02, 0x61, 0x46, 0x26, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x03, 0xF2, 0x06, 0x02, 0x61, 0x46,
+	 0x25, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0xFF, 0xFF, 0x07, 0x03, 0x80, 0xF4, 0xFF, 0xFF, 0x63, 0x46,
+	 0xE8, 0x1B, 0x88, 0xF3, 0x08, 0xFE, 0x60, 0x43, 0x61, 0x46, 0x01, 0x03, 0x2A, 0x00, 0x43, 0x4B,
+	 0xAB, 0x46, 0x37, 0xF2, 0x80, 0x60, 0x30, 0x7C, 0xB0, 0x84, 0xA2, 0xDA, 0x4E, 0x61, 0x6E, 0x64,
+	 0x0E, 0x63, 0xAB, 0x46, 0x59, 0xD0, 0xAB, 0x46, 0x58, 0xD8, 0xFB, 0x1F, 0x88, 0x64, 0x04, 0x63,
+	 0xAB, 0x46, 0x59, 0xD0, 0xAB, 0x46, 0x58, 0xD8, 0xFB, 0x1F, 0xD9, 0x81, 0x98, 0x64, 0x04, 0x63,
+	 0xAB, 0x46, 0x59, 0xD0, 0xAB, 0x46, 0x58, 0xD8, 0xFB, 0x1F, 0xD9, 0x81, 0xAE, 0x64, 0x0E, 0x63,
+	 0xAB, 0x46, 0x59, 0xD0, 0xAB, 0x46, 0x58, 0xD8, 0xFB, 0x1F, 0x00, 0x67, 0x00, 0x61, 0x23, 0x58,
+	 0xFF, 0xFF, 0x01, 0x67, 0x20, 0x61, 0x23, 0x58, 0xFF, 0xFF, 0x21, 0x60, 0x80, 0x64, 0xA0, 0xD1,
+	 0x7F, 0xF9, 0x64, 0x40, 0x01, 0x2A, 0x31, 0x00, 0x27, 0xF2, 0x12, 0x60, 0xCE, 0x65, 0x60, 0x47,
+	 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD3, 0x66, 0x41, 0x60, 0x46, 0x60, 0x43, 0x05, 0xF2, 0x16, 0x18,
+	 0x61, 0x46, 0x27, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x04, 0xF2, 0x0C, 0x02, 0x61, 0x46, 0x26, 0xF0,
+	 0x63, 0x46, 0xD0, 0x80, 0x03, 0xF2, 0x06, 0x02, 0x61, 0x46, 0x25, 0xF0, 0x63, 0x46, 0xD0, 0x80,
+	 0xFF, 0xFF, 0x07, 0x03, 0x80, 0xF4, 0xFF, 0xFF, 0x63, 0x46, 0xE8, 0x1B, 0x88, 0xF3, 0x08, 0xFE,
+	 0x60, 0x43, 0x61, 0x46, 0x01, 0x03, 0x0D, 0x00, 0x43, 0x4B, 0xAB, 0x46, 0x37, 0xF2, 0x80, 0x60,
+	 0x30, 0x61, 0x9D, 0x85, 0xA4, 0x84, 0xA2, 0xDA, 0xAB, 0x46, 0x00, 0x67, 0x00, 0x61, 0x23, 0x58,
+	 0xFF, 0xFF, 0x01, 0x67, 0x20, 0x61, 0x23, 0x58, 0xFF, 0xFF, 0x3E, 0xF2, 0xAC, 0xF1, 0x08, 0xB0,
+	 0x19, 0xF8, 0x4A, 0x02, 0x07, 0x23, 0x2B, 0x00, 0x60, 0x47, 0x07, 0xB4, 0x89, 0xF1, 0xCC, 0x84,
+	 0xE0, 0x84, 0x40, 0x8A, 0xAA, 0x46, 0x03, 0xF2, 0x04, 0xF0, 0x05, 0xF2, 0x60, 0x43, 0xAA, 0x46,
+	 0x2C, 0xFC, 0x2D, 0xF8, 0x2E, 0xFA, 0xCB, 0xF1, 0x2F, 0xF8, 0xCC, 0xF1, 0x30, 0xF8, 0xCD, 0xF1,
+	 0x31, 0xF8, 0x46, 0x4A, 0x00, 0xF4, 0x02, 0xF2, 0x03, 0xF0, 0x04, 0xF2, 0x60, 0x43, 0xAA, 0x46,
+	 0x32, 0xFC, 0x33, 0xF8, 0x34, 0xFA, 0xAA, 0x46, 0x05, 0xF2, 0x06, 0xF0, 0x07, 0xF2, 0x60, 0x43,
+	 0xAA, 0x46, 0x36, 0xFC, 0x37, 0xF8, 0x38, 0xFA, 0x03, 0x60, 0x08, 0x64, 0x1C, 0x00, 0x67, 0xF1,
+	 0x2F, 0xF8, 0x68, 0xF1, 0x30, 0xF8, 0x69, 0xF1, 0x31, 0xF8, 0x46, 0x4A, 0x00, 0xF4, 0x02, 0xF2,
+	 0x03, 0xF0, 0x04, 0xF2, 0x60, 0x43, 0xAA, 0x46, 0x2C, 0xFC, 0x2D, 0xF8, 0x2E, 0xFA, 0xAA, 0x46,
+	 0x05, 0xF2, 0x06, 0xF0, 0x07, 0xF2, 0x60, 0x43, 0xAA, 0x46, 0x32, 0xFC, 0x33, 0xF8, 0x34, 0xFA,
+	 0x02, 0x60, 0x08, 0x64, 0x00, 0x00, 0x2A, 0xFA, 0x02, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x28, 0xF3,
+	 0xFF, 0xFF, 0x60, 0x47, 0x0F, 0xB4, 0x59, 0x00, 0xFF, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x1C, 0x60,
+	 0x04, 0x65, 0x04, 0x64, 0xA5, 0xDB, 0x12, 0x00, 0x1C, 0x60, 0x04, 0x65, 0x0C, 0x64, 0xA5, 0xDB,
+	 0x0D, 0x00, 0x1C, 0x60, 0x04, 0x65, 0x06, 0x64, 0xA5, 0xDB, 0xFF, 0xFF, 0x2D, 0xFF, 0x00, 0x67,
+	 0x23, 0x58, 0xFF, 0xFF, 0x1C, 0x60, 0x04, 0x65, 0x08, 0x64, 0xA5, 0xDB, 0xF4, 0x60, 0xD9, 0x64,
+	 0x80, 0xFB, 0xFF, 0xFF, 0x2D, 0xFF, 0xEB, 0x60, 0x84, 0x78, 0xFF, 0xFF, 0x29, 0xF3, 0x65, 0xFB,
+	 0x83, 0xFB, 0x02, 0x60, 0xEE, 0x64, 0x82, 0xFB, 0x07, 0x64, 0x84, 0xFB, 0xF4, 0x60, 0xD9, 0x64,
+	 0x80, 0xFB, 0xFF, 0xFF, 0xDF, 0xFE, 0x00, 0x64, 0x19, 0xFF, 0xEB, 0x60, 0x84, 0x78, 0xFF, 0xFF,
+	 0xAF, 0x60, 0xFD, 0x63, 0x0C, 0x60, 0x16, 0x64, 0xA0, 0xDD, 0x62, 0xFF, 0xF4, 0x60, 0xC6, 0x63,
+	 0x80, 0xFD, 0xFF, 0xFF, 0x1A, 0xFF, 0xEB, 0x60, 0x84, 0x78, 0xFF, 0xFF, 0xA7, 0x60, 0x9B, 0x63,
+	 0x0C, 0x60, 0x16, 0x64, 0xA0, 0xDD, 0x62, 0xFF, 0x29, 0xF5, 0x1B, 0x60, 0xE0, 0x63, 0x1B, 0x60,
+	 0xB2, 0x64, 0xBD, 0xDB, 0x66, 0x44, 0xBD, 0xDB, 0x02, 0x64, 0xA3, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF,
+	 0xF9, 0xFE, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0xA7, 0x01, 0x00, 0x36, 0xA8, 0x01, 0x01, 0x36,
+	 0xAB, 0x01, 0x02, 0x36, 0xAE, 0x01, 0x03, 0x36, 0xB5, 0x01, 0x04, 0x36, 0xD1, 0x01, 0x05, 0x36,
+	 0xCF, 0x01, 0x06, 0x36, 0xF1, 0x01, 0x07, 0x36, 0xCB, 0x01, 0x08, 0x36, 0xB7, 0x01, 0x09, 0x36,
+	 0x0C, 0x00, 0x0A, 0x36, 0x0D, 0x00, 0x0B, 0x36, 0x0E, 0x00, 0x0C, 0x36, 0x17, 0x00, 0x0D, 0x36,
+	 0x0D, 0x00, 0x0E, 0x36, 0x1E, 0x00, 0x0F, 0x36, 0x32, 0x00, 0x02, 0x60, 0x00, 0x64, 0x08, 0x00,
+	 0x04, 0x60, 0x00, 0x64, 0x05, 0x00, 0x00, 0x60, 0x01, 0x64, 0x02, 0x00, 0x20, 0x60, 0x00, 0x64,
+	 0x32, 0x45, 0xB4, 0x85, 0x45, 0x52, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0xB0, 0x60, 0xC1, 0x63,
+	 0x0C, 0x60, 0x16, 0x64, 0xA0, 0xDD, 0x62, 0xFF, 0xFF, 0xFF, 0x1A, 0xFF, 0x00, 0x67, 0x23, 0x58,
+	 0xFF, 0xFF, 0x3F, 0x40, 0x02, 0x2B, 0x05, 0x00, 0x90, 0x60, 0x00, 0xE8, 0xAF, 0x60, 0xFD, 0x63,
+	 0x04, 0x00, 0x91, 0x60, 0x00, 0xE8, 0xB0, 0x60, 0xAB, 0x63, 0x28, 0xE8, 0x0C, 0x60, 0x16, 0x64,
+	 0xA0, 0xDD, 0x62, 0xFF, 0xFF, 0xFF, 0x1A, 0xFF, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x91, 0x60,
+	 0x00, 0xE8, 0x28, 0xE8, 0xD9, 0x60, 0xFE, 0x64, 0x32, 0x45, 0xA4, 0x85, 0x45, 0x52, 0x99, 0xFF,
+	 0xA5, 0x4F, 0xFF, 0xB4, 0x07, 0xFB, 0x98, 0xFF, 0xA7, 0x60, 0x9B, 0x63, 0x0C, 0x60, 0x16, 0x64,
+	 0xA0, 0xDD, 0x62, 0xFF, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x42, 0x6F, 0x6F, 0x74, 0x63, 0x6F,
+	 0x64, 0x65, 0x20, 0x21, 0x21, 0x20, 0x20, 0x00, 0x53, 0x54, 0x41, 0x2F, 0x41, 0x50, 0x20, 0x46,
+	 0x75, 0x6E, 0x63, 0x27, 0x73, 0x00, 0x20, 0x00, 0x02, 0x00, 0x02, 0x00, 0x24, 0x00, 0x00, 0x00,
+	 0x08, 0x00, 0x02, 0x00, 0x02, 0x00, 0x04, 0x00, 0x01, 0x00, 0x01, 0x00, 0x04, 0x00, 0x06, 0x00,
+	 0x07, 0x00, 0x05, 0x00, 0x06, 0x00, 0x07, 0x00, 0x06, 0x00, 0x06, 0x00, 0x07, 0x00, 0x01, 0x00,
+	 0x02, 0x00, 0x02, 0x00, 0x01, 0x00, 0x02, 0x00, 0x01, 0x00, 0x01, 0x00, 0x02, 0x00, 0x02, 0x00,
+	 0x40, 0x00, 0x32, 0x00, 0x32, 0x00, 0x0A, 0x00, 0x02, 0x00, 0x06, 0x00, 0x40, 0x00, 0x32, 0x00,
+	 0x36, 0x00, 0x0A, 0x00, 0x02, 0x00, 0x06, 0x00, 0x40, 0x00, 0x3B, 0x00, 0x40, 0x00, 0x17, 0x00,
+	 0x07, 0x00, 0x07, 0x00, 0x4A, 0x00, 0x40, 0x00, 0x4A, 0x00, 0x1E, 0x00, 0x0C, 0x00, 0x08, 0x00,
+	 0x57, 0x00, 0x4D, 0x00, 0x57, 0x00, 0x2B, 0x00, 0x19, 0x00, 0x08, 0x00, 0x5D, 0x00, 0x53, 0x00,
+	 0x5D, 0x00, 0x31, 0x00, 0x1F, 0x00, 0x08, 0x00,
+
+};  /* fw_image_4_data */
+
+static const CFG_IDENTITY_STRCT fw_image_infoidentity[] = {
+	{
+		sizeof( CFG_IDENTITY_STRCT ) / sizeof(hcf_16) - 1,
+		CFG_FW_IDENTITY,
+		COMP_ID_FW_AP,
+		2,							//Variant
+		2,							//Major
+		36							//Minor
+	},
+	{ 0000, 0000, 0000, 0000, 0000, 0000 }		//endsentinel
+};
+
+static const CFG_PROG_STRCT fw_image_code[] = {
+	{
+		8,
+		CFG_PROG,
+		CFG_PROG_VOLATILE,			// mode
+		0x0146,		// sizeof(fw_image_1_data),
+		0x00000060,					// Target address in NIC Memory
+		0x0000,						// CRC: yes/no	TYPE: primary/station/tertiary
+		(hcf_8 FAR   *) fw_image_1_data
+	},
+	{
+		8,
+		CFG_PROG,
+		CFG_PROG_VOLATILE,			// mode
+		0x1918,		// sizeof(fw_image_2_data),
+		0x00000C16,					// Target address in NIC Memory
+		0x0000,						// CRC: yes/no	TYPE: primary/station/tertiary
+		(hcf_8 FAR   *) fw_image_2_data
+	},
+	{
+		8,
+		CFG_PROG,
+		CFG_PROG_VOLATILE,			// mode
+		0x01bc,		// sizeof(fw_image_3_data),
+		0x001E252E,					// Target address in NIC Memory
+		0x0000,						// CRC: yes/no	TYPE: primary/station/tertiary
+		(hcf_8 FAR   *) fw_image_3_data
+	},
+	{
+		8,
+		CFG_PROG,
+		CFG_PROG_VOLATILE,			// mode
+		0xab28,		// sizeof(fw_image_4_data),
+		0x001F4000,					// Target address in NIC Memory
+		0x0000,						// CRC: yes/no	TYPE: primary/station/tertiary
+		(hcf_8 FAR   *) fw_image_4_data
+	},
+	{
+		5,
+		CFG_PROG,
+		CFG_PROG_STOP,				// mode
+		0000,
+ 	0x000F1297,					// Start execution address
+	},
+	{ 0000, 0000, 0000, 0000, 00000000, 0000, 00000000}
+};
+
+static const CFG_RANGE20_STRCT fw_image_infocompat[] = {
+	{	3 + ((20 * sizeof(CFG_RANGE_SPEC_STRCT)) / sizeof(hcf_16)),
+		CFG_FW_SUP_RANGE,
+		COMP_ROLE_SUPL,
+		COMP_ID_APF,
+		{
+			{ 2, 2, 4 }  				//variant, bottom, top
+		}
+	},
+	{	3 + ((20 * sizeof(CFG_RANGE_SPEC_STRCT)) / sizeof(hcf_16)),
+		CFG_MFI_ACT_RANGES_STA,
+		COMP_ROLE_ACT,
+		COMP_ID_MFI,
+		{
+			{ 4, 6, 7 }, 				//variant, bottom, top
+			{ 5, 6, 7 }, 				//variant, bottom, top
+			{ 6, 6, 7 }  				//variant, bottom, top
+		}
+	},
+	{	3 + ((20 * sizeof(CFG_RANGE_SPEC_STRCT)) / sizeof(hcf_16)),
+		CFG_CFI_ACT_RANGES_STA,
+		COMP_ROLE_ACT,
+		COMP_ID_CFI,
+		{
+			{ 2, 1, 2 }  				//variant, bottom, top
+		}
+	},
+	{ 0000, 0000, 0000, 0000, { { 0000, 0000, 0000 } } }			//endsentinel
+};
+
+memimage fw_image = {
+	"FUPU7D37dhfwci\001C",			//signature, <format number>, C/Bin type
+	(CFG_PROG_STRCT *) fw_image_code,
+	0x000F1297,
+	00000000,					//(dummy) pdaplug
+	00000000,					//(dummy) priplug
+	(CFG_RANGE20_STRCT *) fw_image_infocompat,
+	(CFG_IDENTITY_STRCT *) fw_image_infoidentity,
+};
+
diff --git a/drivers/staging/wlags49_h2/ap_h25.c b/drivers/staging/wlags49_h2/ap_h25.c
new file mode 100644
index 000000000000..f4491cbd08d3
--- /dev/null
+++ b/drivers/staging/wlags49_h2/ap_h25.c
@@ -0,0 +1,4094 @@
+/*
+ * File:	ap_h54.124
+ *
+ * Abstract:	This file contains memory image 'fw_image'.
+ *
+ * Contents:	Total size of the memory image: 63146 bytes.
+ *		Total number of blocks: 4 blocks.
+ *		Block  1 : load address 00000060, 328 bytes.
+ *		Block  2 : load address 00000C16, 9266 bytes.
+ *		Block  3 : load address 001E3048, 6476 bytes.
+ *		Block  4 : load address 001F4000, 47076 bytes.
+ *
+ * Identity:	component id: 32 (variant 3) version 1.24
+ *
+ * Compatibility:
+ *		supplying interface 8 (variant 4) : 1 - 1
+ *		acting on interface 1 (variant 7) : 3 - 3
+ *		acting on interface 1 (variant 8) : 1 - 1
+ *		acting on interface 2 (variant 4) : 1 - 2
+ *
+ * Generated:	by g:\fw\fupu3.exe version 4.26
+ *
+ * Commandline:	g:\fw\fupu3.exe /f=4 /n=fw_image /i=t3012400.hex
+ */
+
+
+#include "hcfcfg.h"				// to get hcf_16 etc defined as well as
+                                // possible settings which inluence mdd.h or dhf.h
+#include "mdd.h"   				//to get COMP_ID_STA etc defined
+#include "dhf.h"   				//used to be "fhfmem.h", to get memblock,plugrecord,
+
+static const hcf_8 fw_image_1_data[] = {
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xDC, 0x0C, 0x00, 0x00,
+	 0x02, 0x0D, 0x00, 0x00, 0x02, 0x0D, 0xD6, 0xA2, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x1B, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0A, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00,
+	 0x02, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC8, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0A, 0x00, 0x09, 0x00,
+	 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xEA,
+	 0x00, 0x00, 0xFF, 0x07, 0x02, 0x00, 0x64, 0x00, 0x64, 0x00, 0x10, 0x27, 0x10, 0x27, 0x14, 0x00,
+	 0xD0, 0x07, 0xD0, 0x07, 0x10, 0x27, 0x2F, 0x00, 0x32, 0x00, 0x32, 0x00, 0x05, 0x00, 0x02, 0x00,
+	 0x02, 0x00, 0x10, 0x27, 0x05, 0x00, 0x00, 0x02, 0x00, 0x02, 0x13, 0x00, 0x07, 0x00, 0x03, 0x00,
+	 0x32, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x2A, 0x09, 0x2B, 0x09, 0x2B, 0x09, 0xFF, 0x0F,
+	 0xF0, 0x0F, 0x00, 0x00, 0x00, 0x00, 0x00, 0x14, 0x01, 0x00, 0x40, 0x00, 0x32, 0x00, 0x32, 0x00,
+	 0x0A, 0x00, 0x02, 0x00, 0x06, 0x00, 0x02, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x01, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+
+};  /* fw_image_1_data */
+
+static const hcf_8 fw_image_2_data[] = {
+	 0x7C, 0xA4, 0x00, 0x16, 0x08, 0x40, 0x0F, 0xD2, 0xE1, 0x28, 0xA5, 0x7C, 0x50, 0x30, 0xF1, 0x84,
+	 0x44, 0x08, 0xAB, 0xAE, 0xA5, 0xB8, 0xFC, 0xBA, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x02, 0x03,
+	 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xA5, 0xC6, 0x84, 0xF8,
+	 0x99, 0xEE, 0x8D, 0xF6, 0x0D, 0xFF, 0xBD, 0xD6, 0xB1, 0xDE, 0x54, 0x91, 0x50, 0x60, 0x03, 0x02,
+	 0xA9, 0xCE, 0x7D, 0x56, 0x19, 0xE7, 0x62, 0xB5, 0xE6, 0x4D, 0x9A, 0xEC, 0x45, 0x8F, 0x9D, 0x1F,
+	 0x40, 0x89, 0x87, 0xFA, 0x15, 0xEF, 0xEB, 0xB2, 0xC9, 0x8E, 0x0B, 0xFB, 0xEC, 0x41, 0x67, 0xB3,
+	 0xFD, 0x5F, 0xEA, 0x45, 0xBF, 0x23, 0xF7, 0x53, 0x96, 0xE4, 0x5B, 0x9B, 0xC2, 0x75, 0x1C, 0xE1,
+	 0xAE, 0x3D, 0x6A, 0x4C, 0x5A, 0x6C, 0x41, 0x7E, 0x02, 0xF5, 0x4F, 0x83, 0x5C, 0x68, 0xF4, 0x51,
+	 0x34, 0xD1, 0x08, 0xF9, 0x93, 0xE2, 0x73, 0xAB, 0x53, 0x62, 0x3F, 0x2A, 0x0C, 0x08, 0x52, 0x95,
+	 0x65, 0x46, 0x5E, 0x9D, 0x28, 0x30, 0xA1, 0x37, 0x0F, 0x0A, 0xB5, 0x2F, 0x09, 0x0E, 0x36, 0x24,
+	 0x9B, 0x1B, 0x3D, 0xDF, 0x26, 0xCD, 0x69, 0x4E, 0xCD, 0x7F, 0x9F, 0xEA, 0x1B, 0x12, 0x9E, 0x1D,
+	 0x74, 0x58, 0x2E, 0x34, 0x2D, 0x36, 0xB2, 0xDC, 0xEE, 0xB4, 0xFB, 0x5B, 0xF6, 0xA4, 0x4D, 0x76,
+	 0x61, 0xB7, 0xCE, 0x7D, 0x7B, 0x52, 0x3E, 0xDD, 0x71, 0x5E, 0x97, 0x13, 0xF5, 0xA6, 0x68, 0xB9,
+	 0x00, 0x00, 0x2C, 0xC1, 0x60, 0x40, 0x1F, 0xE3, 0xC8, 0x79, 0xED, 0xB6, 0xBE, 0xD4, 0x46, 0x8D,
+	 0xD9, 0x67, 0x4B, 0x72, 0xDE, 0x94, 0xD4, 0x98, 0xE8, 0xB0, 0x4A, 0x85, 0x6B, 0xBB, 0x2A, 0xC5,
+	 0xE5, 0x4F, 0x16, 0xED, 0xC5, 0x86, 0xD7, 0x9A, 0x55, 0x66, 0x94, 0x11, 0xCF, 0x8A, 0x10, 0xE9,
+	 0x06, 0x04, 0x81, 0xFE, 0xF0, 0xA0, 0x44, 0x78, 0xBA, 0x25, 0xE3, 0x4B, 0xF3, 0xA2, 0xFE, 0x5D,
+	 0xC0, 0x80, 0x8A, 0x05, 0xAD, 0x3F, 0xBC, 0x21, 0x48, 0x70, 0x04, 0xF1, 0xDF, 0x63, 0xC1, 0x77,
+	 0x75, 0xAF, 0x63, 0x42, 0x30, 0x20, 0x1A, 0xE5, 0x0E, 0xFD, 0x6D, 0xBF, 0x4C, 0x81, 0x14, 0x18,
+	 0x35, 0x26, 0x2F, 0xC3, 0xE1, 0xBE, 0xA2, 0x35, 0xCC, 0x88, 0x39, 0x2E, 0x57, 0x93, 0xF2, 0x55,
+	 0x82, 0xFC, 0x47, 0x7A, 0xAC, 0xC8, 0xE7, 0xBA, 0x2B, 0x32, 0x95, 0xE6, 0xA0, 0xC0, 0x98, 0x19,
+	 0xD1, 0x9E, 0x7F, 0xA3, 0x66, 0x44, 0x7E, 0x54, 0xAB, 0x3B, 0x83, 0x0B, 0xCA, 0x8C, 0x29, 0xC7,
+	 0xD3, 0x6B, 0x3C, 0x28, 0x79, 0xA7, 0xE2, 0xBC, 0x1D, 0x16, 0x76, 0xAD, 0x3B, 0xDB, 0x56, 0x64,
+	 0x4E, 0x74, 0x1E, 0x14, 0xDB, 0x92, 0x0A, 0x0C, 0x6C, 0x48, 0xE4, 0xB8, 0x5D, 0x9F, 0x6E, 0xBD,
+	 0xEF, 0x43, 0xA6, 0xC4, 0xA8, 0x39, 0xA4, 0x31, 0x37, 0xD3, 0x8B, 0xF2, 0x32, 0xD5, 0x43, 0x8B,
+	 0x59, 0x6E, 0xB7, 0xDA, 0x8C, 0x01, 0x64, 0xB1, 0xD2, 0x9C, 0xE0, 0x49, 0xB4, 0xD8, 0xFA, 0xAC,
+	 0x07, 0xF3, 0x25, 0xCF, 0xAF, 0xCA, 0x8E, 0xF4, 0xE9, 0x47, 0x18, 0x10, 0xD5, 0x6F, 0x88, 0xF0,
+	 0x6F, 0x4A, 0x72, 0x5C, 0x24, 0x38, 0xF1, 0x57, 0xC7, 0x73, 0x51, 0x97, 0x23, 0xCB, 0x7C, 0xA1,
+	 0x9C, 0xE8, 0x21, 0x3E, 0xDD, 0x96, 0xDC, 0x61, 0x86, 0x0D, 0x85, 0x0F, 0x90, 0xE0, 0x42, 0x7C,
+	 0xC4, 0x71, 0xAA, 0xCC, 0xD8, 0x90, 0x05, 0x06, 0x01, 0xF7, 0x12, 0x1C, 0xA3, 0xC2, 0x5F, 0x6A,
+	 0xF9, 0xAE, 0xD0, 0x69, 0x91, 0x17, 0x58, 0x99, 0x27, 0x3A, 0xB9, 0x27, 0x38, 0xD9, 0x13, 0xEB,
+	 0xB3, 0x2B, 0x33, 0x22, 0xBB, 0xD2, 0x70, 0xA9, 0x89, 0x07, 0xA7, 0x33, 0xB6, 0x2D, 0x22, 0x3C,
+	 0x92, 0x15, 0x20, 0xC9, 0x49, 0x87, 0xFF, 0xAA, 0x78, 0x50, 0x7A, 0xA5, 0x8F, 0x03, 0xF8, 0x59,
+	 0x80, 0x09, 0x17, 0x1A, 0xDA, 0x65, 0x31, 0xD7, 0xC6, 0x84, 0xB8, 0xD0, 0xC3, 0x82, 0xB0, 0x29,
+	 0x77, 0x5A, 0x11, 0x1E, 0xCB, 0x7B, 0xFC, 0xA8, 0xD6, 0x6D, 0x3A, 0x2C, 0x00, 0x30, 0x00, 0x31,
+	 0x00, 0x33, 0x00, 0x34, 0x00, 0x35, 0x00, 0x36, 0x00, 0x37, 0x00, 0x38, 0x00, 0x38, 0x00, 0x3A,
+	 0x00, 0x3B, 0x00, 0x3C, 0x00, 0x3D, 0x00, 0x3E, 0x00, 0x3F, 0x00, 0x3F, 0x59, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x59, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xEC, 0x21, 0x10, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x0A, 0x00, 0x20, 0x03, 0xE0, 0x01, 0x40, 0x01, 0x20, 0x03, 0xE0, 0x01,
+	 0x40, 0x01, 0x18, 0x08, 0xF0, 0x3F, 0xFC, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x0A, 0x02, 0x14, 0x05, 0x32, 0x0B, 0x37,
+	 0x08, 0x50, 0x0B, 0x6E, 0x02, 0x00, 0x04, 0x00, 0x0B, 0x00, 0x16, 0x00, 0x0C, 0x00, 0x12, 0x00,
+	 0x18, 0x00, 0x24, 0x00, 0x30, 0x00, 0x48, 0x00, 0x60, 0x00, 0x6C, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x39, 0x00, 0x39, 0x00, 0x20, 0x00, 0x39, 0x00,
+	 0x39, 0x00, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x0A, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0B, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x0C, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0D, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0E, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0xA4, 0x10, 0xF2, 0x10, 0xAA, 0x10, 0xEC, 0x10, 0xB0, 0x10, 0xE6, 0x10, 0xB6, 0x10,
+	 0xE0, 0x10, 0xBC, 0x10, 0xDA, 0x10, 0xC2, 0x10, 0xD4, 0x10, 0xC8, 0x10, 0xCE, 0x10, 0x07, 0x01,
+	 0x00, 0x00, 0x16, 0x22, 0x00, 0x04, 0x08, 0x01, 0x00, 0x00, 0x16, 0x26, 0x00, 0x04, 0x09, 0x01,
+	 0x00, 0x00, 0x16, 0x2A, 0x00, 0x04, 0x0A, 0x01, 0x00, 0x00, 0x16, 0x2E, 0x00, 0x04, 0x0B, 0x01,
+	 0x00, 0x00, 0x10, 0x24, 0x04, 0x04, 0x0C, 0x01, 0x00, 0x00, 0x10, 0x28, 0x04, 0x04, 0x0D, 0x01,
+	 0x00, 0x00, 0x10, 0x2C, 0x04, 0x04, 0x0E, 0x01, 0x00, 0x00, 0x10, 0x30, 0x04, 0x04, 0x0F, 0x01,
+	 0x00, 0x00, 0x14, 0x34, 0x08, 0x84, 0x10, 0x01, 0x00, 0x00, 0x14, 0x38, 0x08, 0x84, 0x11, 0x01,
+	 0x00, 0x00, 0x14, 0x3C, 0x08, 0x84, 0x12, 0x01, 0x00, 0x00, 0x14, 0x40, 0x08, 0x84, 0x13, 0x01,
+	 0x00, 0x00, 0x17, 0x64, 0x0C, 0x8B, 0x14, 0x01, 0x00, 0x00, 0x17, 0x68, 0x0C, 0x8B, 0x15, 0x01,
+	 0x00, 0x00, 0x17, 0x6C, 0x0C, 0x8B, 0x16, 0x01, 0x00, 0x00, 0x17, 0x70, 0x0C, 0x8B, 0x17, 0x01,
+	 0x00, 0x00, 0x17, 0x74, 0x0C, 0x8B, 0x18, 0x01, 0x00, 0x00, 0x17, 0x78, 0x0C, 0x8B, 0x19, 0x01,
+	 0x00, 0x00, 0x17, 0x7C, 0x0C, 0x8B, 0x1A, 0x01, 0x00, 0x00, 0x17, 0x80, 0x0C, 0x8B, 0x1B, 0x01,
+	 0x00, 0x00, 0x17, 0x84, 0x0C, 0x8B, 0x1C, 0x01, 0x00, 0x00, 0x17, 0x88, 0x0C, 0x8B, 0x1D, 0x01,
+	 0x00, 0x00, 0x17, 0x8C, 0x0C, 0x8B, 0x1E, 0x01, 0x00, 0x00, 0x0E, 0x95, 0x17, 0x04, 0x1F, 0x01,
+	 0x00, 0x00, 0x0E, 0x99, 0x17, 0x04, 0x20, 0x01, 0x00, 0x00, 0x0E, 0x9D, 0x17, 0x04, 0x21, 0x01,
+	 0x00, 0x00, 0x0E, 0xA1, 0x17, 0x04, 0x22, 0x01, 0x00, 0x00, 0x0E, 0xA5, 0x00, 0x00, 0x14, 0x11,
+	 0x34, 0x11, 0x54, 0x11, 0x74, 0x11, 0xCC, 0x11, 0x1C, 0x11, 0x3C, 0x11, 0x5C, 0x11, 0x7C, 0x11,
+	 0xD4, 0x11, 0x24, 0x11, 0x44, 0x11, 0x64, 0x11, 0x84, 0x11, 0xDC, 0x11, 0x2C, 0x11, 0x4C, 0x11,
+	 0x6C, 0x11, 0x8C, 0x11, 0xE4, 0x11, 0x94, 0x11, 0x9C, 0x11, 0xA4, 0x11, 0xAC, 0x11, 0xB4, 0x11,
+	 0xBC, 0x11, 0xC4, 0x11, 0xEC, 0x11, 0x1E, 0x1E, 0x1E, 0x1E, 0x1E, 0x1E, 0x1E, 0x1E, 0x1E, 0x1E,
+	 0x1E, 0x1E, 0x1E, 0x1E, 0x1E, 0x1E, 0x1E, 0x1E, 0x1E, 0x1E, 0x1E, 0x1E, 0x1E, 0x1E, 0x1E, 0x1E,
+	 0x1E, 0x1E, 0x1E, 0x1E, 0x1E, 0x1E, 0x1E, 0x1E, 0x1E, 0x1E, 0x1E, 0x1E, 0x1E, 0x1E, 0x1E, 0x1E,
+	 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x0A, 0x0A, 0x7F, 0x7F, 0x7F,
+	 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F,
+	 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x1E, 0x1E, 0x1E, 0x1E, 0x1E, 0x1E,
+	 0x1E, 0x1E, 0x1E, 0x1E, 0x1E, 0x0A, 0x0A, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x10, 0x10, 0x10, 0x10,
+	 0x17, 0x17, 0x17, 0x17, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x14,
+	 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14,
+	 0x14, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x11, 0x11, 0x11, 0x11, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F,
+	 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x14, 0x14,
+	 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x16, 0x16, 0x16, 0x16,
+	 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F,
+	 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x0A, 0x0A, 0x0A, 0x0A, 0x0A, 0x0A, 0x0A, 0x0A,
+	 0x0A, 0x0A, 0x0A, 0x0A, 0x0A, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F,
+	 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x0A, 0x0A, 0x0A,
+	 0x0A, 0x7F, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x7F,
+	 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F,
+	 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x10, 0x10, 0x10, 0x10, 0x7F, 0x14, 0x14, 0x14, 0x14,
+	 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x0A, 0x0A, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F,
+	 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F,
+	 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14,
+	 0x14, 0x14, 0x14, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F,
+	 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F,
+	 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x7F, 0x7F,
+	 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F,
+	 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x9D, 0x9D, 0xA1, 0xAA, 0x10, 0x10,
+	 0x9D, 0x9D, 0x08, 0x02, 0x06, 0x00, 0xA5, 0xA5, 0xAA, 0xAA, 0x17, 0x17, 0xA2, 0xA2, 0x15, 0x05,
+	 0x07, 0x00, 0xAA, 0xAA, 0xB4, 0xB4, 0x1C, 0x1C, 0xA7, 0xA7, 0x1C, 0x0A, 0x08, 0x00, 0xB7, 0xB7,
+	 0xC1, 0xC1, 0x09, 0x09, 0xB4, 0xB4, 0x29, 0x17, 0x08, 0x00, 0xBD, 0xBD, 0xC7, 0xC7, 0x0F, 0x0F,
+	 0xBA, 0xBA, 0x2F, 0x1D, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x17,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0xE4, 0xF0, 0xFD, 0xF0, 0x1F, 0xF1, 0x60, 0xF6, 0x9B, 0xF0, 0x79, 0xF6, 0x9B, 0xF0, 0x9B, 0xF0,
+	 0x9B, 0xF0, 0x9B, 0xF0, 0x9B, 0xF0, 0xCC, 0xF7, 0x9B, 0xF0, 0x9B, 0xF0, 0x9B, 0xF0, 0x9B, 0xF0,
+	 0x9B, 0xF0, 0x15, 0xF3, 0x9B, 0xF0, 0x9B, 0xF0, 0x9B, 0xF0, 0x9B, 0xF0, 0x9B, 0xF0, 0x9B, 0xF0,
+	 0x9B, 0xF0, 0x9B, 0xF0, 0x9B, 0xF0, 0x9B, 0xF0, 0x9B, 0xF0, 0x9B, 0xF0, 0x9B, 0xF0, 0x9B, 0xF0,
+	 0x9B, 0xF0, 0x66, 0xF3, 0x9B, 0xF0, 0x9B, 0xF0, 0x9B, 0xF0, 0x9B, 0xF0, 0x9B, 0xF0, 0x9B, 0xF0,
+	 0x9B, 0xF0, 0x9B, 0xF0, 0x9B, 0xF0, 0x9B, 0xF0, 0x9B, 0xF0, 0x9B, 0xF0, 0x9B, 0xF0, 0x9B, 0xF0,
+	 0xE3, 0xF2, 0xFE, 0xF2, 0x9B, 0xF0, 0x9B, 0xF0, 0x9B, 0xF0, 0x9B, 0xF0, 0x9B, 0xF0, 0x9B, 0xF0,
+	 0xB4, 0x1C, 0x59, 0xF1, 0x6C, 0xF1, 0x1C, 0xF2, 0x20, 0xF2, 0x9B, 0xF0, 0x9B, 0xF0, 0xCF, 0xF2,
+	 0x64, 0xE6, 0x3E, 0xE6, 0x92, 0xE6, 0xE1, 0xE6, 0xA9, 0xE7, 0xCF, 0xE7, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x12, 0xF1, 0x35, 0xF1, 0x5D, 0xF6, 0x5D, 0xF6, 0x6D, 0xF6, 0x86, 0xF6, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0xE0, 0xFC, 0xC0, 0xF3, 0xF2, 0xF5, 0x5A, 0x00, 0x02, 0x00, 0xF9, 0xFF,
+	 0xC0, 0xF3, 0xD6, 0xF3, 0xCA, 0x00, 0x02, 0x00, 0xF7, 0xFF, 0xC0, 0xF3, 0xD6, 0xF3, 0xB0, 0x26,
+	 0x06, 0x00, 0xF0, 0xFF, 0xC0, 0xF3, 0xAA, 0xF3, 0x00, 0x00, 0x00, 0x02, 0xF6, 0xFF, 0xC0, 0xF3,
+	 0xD6, 0xF3, 0x6C, 0x00, 0x02, 0x00, 0xF4, 0xFF, 0xC0, 0xF3, 0xD6, 0xF3, 0x68, 0x01, 0x02, 0x00,
+	 0xF5, 0xFF, 0xC0, 0xF3, 0xFB, 0xF5, 0xA2, 0x26, 0x02, 0x00, 0xED, 0xFF, 0xC0, 0xF3, 0x0D, 0xF6,
+	 0x9E, 0x2B, 0x02, 0x00, 0xEC, 0xFF, 0xC0, 0xF3, 0x3B, 0xF6, 0xA0, 0x2B, 0x02, 0x00, 0xEB, 0xFF,
+	 0xC0, 0xF3, 0x41, 0xF6, 0xA2, 0x2B, 0x02, 0x00, 0xEE, 0xFF, 0xC0, 0xF3, 0x47, 0xF6, 0xD6, 0x2B,
+	 0x02, 0x00, 0xDA, 0xFF, 0xC0, 0xF3, 0xD6, 0xF3, 0xD0, 0x13, 0x0C, 0x00, 0xEA, 0xFF, 0xC0, 0xF3,
+	 0xAA, 0xF3, 0xEC, 0x2B, 0x06, 0x00, 0xE9, 0xFF, 0xC0, 0xF3, 0xD6, 0xF3, 0xF2, 0x2B, 0x02, 0x00,
+	 0xE8, 0xFF, 0xC0, 0xF3, 0xD6, 0xF3, 0xF4, 0x2B, 0x02, 0x00, 0xE7, 0xFF, 0xC0, 0xF3, 0xD6, 0xF3,
+	 0xF6, 0x2B, 0x02, 0x00, 0xE6, 0xFF, 0xC0, 0xF3, 0xD6, 0xF3, 0xF8, 0x2B, 0x02, 0x00, 0xE5, 0xFF,
+	 0xC0, 0xF3, 0xD6, 0xF3, 0xFA, 0x2B, 0x10, 0x00, 0xE4, 0xFF, 0xC0, 0xF3, 0xD6, 0xF3, 0x0A, 0x2C,
+	 0x18, 0x00, 0xDB, 0xFF, 0xC0, 0xF3, 0xD6, 0xF3, 0x22, 0x2C, 0x02, 0x00, 0xDC, 0xFF, 0xC0, 0xF3,
+	 0xD6, 0xF3, 0x24, 0x2C, 0x02, 0x00, 0xE1, 0xFF, 0xC0, 0xF3, 0xD6, 0xF3, 0xC6, 0x2C, 0x02, 0x00,
+	 0xE0, 0xFF, 0xC0, 0xF3, 0xD6, 0xF3, 0xC4, 0x2C, 0x02, 0x00, 0xE3, 0xFF, 0xC0, 0xF3, 0xD6, 0xF3,
+	 0xA8, 0x2C, 0x02, 0x00, 0xE2, 0xFF, 0x0E, 0xF4, 0xAA, 0xF3, 0x7E, 0x2C, 0x24, 0x00, 0x03, 0xFC,
+	 0xC0, 0xF3, 0x3A, 0xF5, 0x92, 0x2B, 0x02, 0x00, 0x04, 0xFC, 0xC0, 0xF3, 0xD0, 0xF3, 0xBA, 0x26,
+	 0x22, 0x00, 0x06, 0xFC, 0xC0, 0xF3, 0xD6, 0xF3, 0xA0, 0x26, 0x02, 0x00, 0x07, 0xFC, 0xC0, 0xF3,
+	 0xD6, 0xF3, 0xFE, 0x26, 0x02, 0x00, 0x0E, 0xFC, 0xC0, 0xF3, 0x63, 0xF5, 0x08, 0x27, 0x22, 0x00,
+	 0xB1, 0xFC, 0xC0, 0xF3, 0x88, 0xF8, 0x2A, 0x28, 0x02, 0x00, 0x20, 0xFC, 0xC0, 0xF3, 0xD6, 0xF3,
+	 0x2E, 0x27, 0x02, 0x00, 0x25, 0xFC, 0xC0, 0xF3, 0xD6, 0xF3, 0x3A, 0x27, 0x02, 0x00, 0x26, 0xFC,
+	 0xC0, 0xF3, 0xD6, 0xF3, 0x3C, 0x27, 0x02, 0x00, 0x27, 0xFC, 0xC0, 0xF3, 0xD6, 0xF3, 0x3E, 0x27,
+	 0x02, 0x00, 0xB2, 0xFC, 0xC0, 0xF3, 0xD0, 0xF3, 0x4E, 0x28, 0x22, 0x00, 0xC1, 0xFC, 0xC0, 0xF3,
+	 0xD6, 0xF3, 0x56, 0x2C, 0x20, 0x00, 0xB0, 0xFC, 0xA0, 0xF3, 0x8C, 0xF8, 0x00, 0x00, 0x00, 0x00,
+	 0xC4, 0xFC, 0xA0, 0xF3, 0x54, 0xF6, 0x00, 0x00, 0x08, 0x00, 0xC8, 0xFC, 0xA0, 0xF3, 0x52, 0xF6,
+	 0x00, 0x00, 0x08, 0x00, 0xB4, 0xFC, 0xA0, 0xF3, 0xC0, 0xF8, 0x00, 0x00, 0x00, 0x00, 0xB6, 0xFC,
+	 0xA0, 0xF3, 0x6A, 0xF9, 0x00, 0x00, 0x00, 0x00, 0xB7, 0xFC, 0xA0, 0xF3, 0xAC, 0xF9, 0x00, 0x00,
+	 0x00, 0x00, 0xB8, 0xFC, 0xA0, 0xF3, 0x02, 0xFA, 0x00, 0x00, 0x00, 0x00, 0xBC, 0xFC, 0xA0, 0xF3,
+	 0x3B, 0xFA, 0x00, 0x00, 0x00, 0x00, 0xBD, 0xFC, 0xA0, 0xF3, 0xC3, 0xFA, 0x00, 0x00, 0x00, 0x00,
+	 0xBE, 0xFC, 0xA0, 0xF3, 0xEF, 0xFA, 0x00, 0x00, 0x00, 0x00, 0xBF, 0xFC, 0xA0, 0xF3, 0x3C, 0xFB,
+	 0x00, 0x00, 0x00, 0x00, 0xB3, 0xFC, 0xC0, 0xF3, 0xD6, 0xF3, 0xA2, 0x0F, 0x10, 0x00, 0xB5, 0xFC,
+	 0xC0, 0xF3, 0xD6, 0xF3, 0xA4, 0x2C, 0x02, 0x00, 0xB9, 0xFC, 0xC0, 0xF3, 0xD6, 0xF3, 0xA6, 0x2C,
+	 0x02, 0x00, 0x90, 0xFD, 0xC0, 0xF3, 0xAA, 0xF3, 0xAA, 0x2C, 0x02, 0x00, 0x88, 0xFC, 0xC0, 0xF3,
+	 0xD6, 0xF3, 0x78, 0x2B, 0x04, 0x00, 0x89, 0xFC, 0xC0, 0xF3, 0xD6, 0xF3, 0x7C, 0x2B, 0x04, 0x00,
+	 0xC5, 0xFC, 0xC0, 0xF3, 0xD6, 0xF3, 0x80, 0x2B, 0x04, 0x00, 0x23, 0xFC, 0xC0, 0xF3, 0xD6, 0xF3,
+	 0x34, 0x27, 0x04, 0x00, 0x2A, 0xFC, 0xC0, 0xF3, 0x2C, 0xF4, 0xB6, 0x26, 0x02, 0x00, 0xC7, 0xFD,
+	 0xC0, 0xF3, 0xAA, 0xF3, 0xA6, 0x2B, 0x0A, 0x00, 0x29, 0xFC, 0x7F, 0xF4, 0x43, 0xF4, 0x00, 0x00,
+	 0x00, 0x00, 0xC2, 0xFC, 0xC0, 0xF3, 0xD6, 0xF3, 0x86, 0x2B, 0x08, 0x00, 0x32, 0xFC, 0xC0, 0xF3,
+	 0xD6, 0xF3, 0x5C, 0x01, 0x02, 0x00, 0x33, 0xFC, 0xC0, 0xF3, 0xD6, 0xF3, 0x5E, 0x01, 0x02, 0x00,
+	 0x35, 0xFC, 0xC0, 0xF3, 0xD6, 0xF3, 0x8E, 0x2B, 0x02, 0x00, 0xC7, 0xFC, 0xC0, 0xF3, 0xEB, 0xF5,
+	 0x90, 0x2B, 0x02, 0x00, 0x10, 0xFC, 0xC0, 0xF3, 0xD6, 0xF3, 0xA8, 0x26, 0x02, 0x00, 0x11, 0xFC,
+	 0xC0, 0xF3, 0xD6, 0xF3, 0x44, 0x27, 0x06, 0x00, 0x12, 0xFC, 0xC0, 0xF3, 0xD6, 0xF3, 0x4A, 0x27,
+	 0x06, 0x00, 0x13, 0xFC, 0xC0, 0xF3, 0xD6, 0xF3, 0x50, 0x27, 0x06, 0x00, 0x14, 0xFC, 0xC0, 0xF3,
+	 0xD6, 0xF3, 0x56, 0x27, 0x06, 0x00, 0x15, 0xFC, 0xC0, 0xF3, 0xD6, 0xF3, 0x5C, 0x27, 0x06, 0x00,
+	 0x16, 0xFC, 0xC0, 0xF3, 0xD6, 0xF3, 0x62, 0x27, 0x06, 0x00, 0x17, 0xFC, 0xC0, 0xF3, 0xD6, 0xF3,
+	 0x2A, 0x27, 0x02, 0x00, 0x83, 0xFC, 0xC0, 0xF3, 0xD6, 0xF3, 0x6C, 0x01, 0x02, 0x00, 0x97, 0xFC,
+	 0xC0, 0xF3, 0xD6, 0xF3, 0x6A, 0x01, 0x02, 0x00, 0x98, 0xFC, 0xD7, 0xF5, 0xC5, 0xF5, 0xEC, 0x00,
+	 0x02, 0x00, 0x99, 0xFC, 0xD7, 0xF5, 0xC5, 0xF5, 0xEC, 0x02, 0x02, 0x00, 0x9A, 0xFC, 0xD7, 0xF5,
+	 0xC5, 0xF5, 0xEC, 0x04, 0x02, 0x00, 0x9B, 0xFC, 0xD7, 0xF5, 0xC5, 0xF5, 0xEC, 0x06, 0x02, 0x00,
+	 0x9C, 0xFC, 0xD7, 0xF5, 0xC5, 0xF5, 0xEC, 0x08, 0x02, 0x00, 0x9D, 0xFC, 0xD7, 0xF5, 0xC5, 0xF5,
+	 0xEC, 0x0A, 0x02, 0x00, 0x18, 0xFC, 0xC0, 0xF3, 0xD6, 0xF3, 0x2C, 0x27, 0x02, 0x00, 0x22, 0xFC,
+	 0xC0, 0xF3, 0xD6, 0xF3, 0x32, 0x27, 0x02, 0x00, 0x24, 0xFC, 0xC0, 0xF3, 0xD6, 0xF3, 0x38, 0x27,
+	 0x02, 0x00, 0xC0, 0xFC, 0xA0, 0xF3, 0x50, 0xF6, 0x00, 0x00, 0x06, 0x00, 0x9E, 0xFC, 0xC0, 0xF3,
+	 0x83, 0xF5, 0x6E, 0x01, 0x04, 0x00, 0x9F, 0xFC, 0xC0, 0xF3, 0xD6, 0xF3, 0x3E, 0x2C, 0x04, 0x00,
+	 0xA0, 0xFC, 0xC0, 0xF3, 0xD6, 0xF3, 0x42, 0x2C, 0x04, 0x00, 0xA1, 0xFC, 0xC0, 0xF3, 0xD6, 0xF3,
+	 0x46, 0x2C, 0x04, 0x00, 0xA2, 0xFC, 0xC0, 0xF3, 0xD6, 0xF3, 0x4A, 0x2C, 0x04, 0x00, 0xA3, 0xFC,
+	 0xC0, 0xF3, 0xD6, 0xF3, 0x4E, 0x2C, 0x04, 0x00, 0xA4, 0xFC, 0xC0, 0xF3, 0xD6, 0xF3, 0x52, 0x2C,
+	 0x04, 0x00, 0x20, 0xFD, 0xF1, 0xF3, 0xAA, 0xF3, 0xD5, 0xFB, 0x08, 0x00, 0x21, 0xFD, 0xF1, 0xF3,
+	 0xAA, 0xF3, 0xD9, 0xFB, 0x0A, 0x00, 0x22, 0xFD, 0xF1, 0xF3, 0xAA, 0xF3, 0xDE, 0xFB, 0x16, 0x00,
+	 0x23, 0xFD, 0xF1, 0xF3, 0xAA, 0xF3, 0xE9, 0xFB, 0x0A, 0x00, 0x45, 0xFD, 0xC0, 0xF3, 0xAA, 0xF3,
+	 0xCA, 0x00, 0x02, 0x00, 0x47, 0xFD, 0xC0, 0xF3, 0xAA, 0xF3, 0x36, 0x01, 0x02, 0x00, 0x48, 0xFD,
+	 0xD4, 0xF4, 0xAA, 0xF3, 0x5C, 0x01, 0x02, 0x00, 0x49, 0xFD, 0xD4, 0xF4, 0xAA, 0xF3, 0x5E, 0x01,
+	 0x02, 0x00, 0x4A, 0xFD, 0xC0, 0xF3, 0xAA, 0xF3, 0x56, 0x01, 0x02, 0x00, 0x4B, 0xFD, 0xC0, 0xF3,
+	 0xAA, 0xF3, 0x58, 0x01, 0x02, 0x00, 0x4D, 0xFD, 0xF1, 0xF3, 0xAA, 0xF3, 0xEE, 0xFB, 0x08, 0x00,
+	 0x4F, 0xFD, 0xE8, 0xF4, 0xAA, 0xF3, 0x96, 0x2B, 0x02, 0x00, 0xC2, 0xFD, 0xDE, 0xF4, 0xAA, 0xF3,
+	 0x00, 0x00, 0x02, 0x00, 0x40, 0xFD, 0xE9, 0xF3, 0xAA, 0xF3, 0x78, 0x01, 0x02, 0x00, 0x24, 0xFD,
+	 0x01, 0xF5, 0xAA, 0xF3, 0x00, 0x00, 0x02, 0x00, 0x91, 0xFD, 0xC0, 0xF3, 0xAA, 0xF3, 0xCC, 0x1E,
+	 0x02, 0x00, 0x93, 0xFD, 0xC0, 0xF3, 0xAA, 0xF3, 0xD2, 0x1E, 0x02, 0x00, 0x8F, 0xFD, 0x0E, 0xF5,
+	 0xAA, 0xF3, 0x00, 0x00, 0x08, 0x00, 0xC1, 0xFD, 0x92, 0xF6, 0xAA, 0xF3, 0xC8, 0x00, 0x02, 0x00,
+	 0xC6, 0xFD, 0xC0, 0xF3, 0xAA, 0xF3, 0x20, 0x30, 0x04, 0x00, 0x25, 0xFD, 0xC0, 0xF3, 0xAA, 0xF3,
+	 0x62, 0x01, 0x02, 0x00, 0x89, 0xFD, 0x96, 0xF4, 0xAA, 0xF3, 0x00, 0x00, 0x00, 0x00, 0x8A, 0xFD,
+	 0x0E, 0xF4, 0xAA, 0xF3, 0x7E, 0x2C, 0x24, 0x00, 0x46, 0xFD, 0xC0, 0xF3, 0xAA, 0xF3, 0x7A, 0x01,
+	 0x06, 0x00, 0x86, 0xFD, 0xC0, 0xF3, 0xAA, 0xF3, 0xB0, 0x26, 0x06, 0x00, 0x87, 0xFD, 0xC0, 0xF3,
+	 0xAA, 0xF3, 0x76, 0x2C, 0x06, 0x00, 0x8B, 0xFD, 0x96, 0xF9, 0xAA, 0xF3, 0x00, 0x00, 0x12, 0x00,
+	 0x8B, 0xFD, 0x96, 0xF9, 0xAA, 0xF3, 0x00, 0x00, 0x12, 0x00, 0x8E, 0xFD, 0xC0, 0xF3, 0xAA, 0xF3,
+	 0xEE, 0x14, 0x02, 0x00, 0x80, 0xFD, 0xEF, 0xF4, 0xAA, 0xF3, 0x22, 0x00, 0x02, 0x00, 0x81, 0xFD,
+	 0xEF, 0xF4, 0xAA, 0xF3, 0x22, 0x02, 0x02, 0x00, 0x82, 0xFD, 0xEF, 0xF4, 0xAA, 0xF3, 0x22, 0x04,
+	 0x02, 0x00, 0x83, 0xFD, 0xEF, 0xF4, 0xAA, 0xF3, 0x22, 0x06, 0x02, 0x00, 0x84, 0xFD, 0xEF, 0xF4,
+	 0xAA, 0xF3, 0x22, 0x08, 0x02, 0x00, 0x85, 0xFD, 0xEF, 0xF4, 0xAA, 0xF3, 0x22, 0x0A, 0x02, 0x00,
+	 0x00, 0xF1, 0x46, 0x00, 0x64, 0xF3, 0xF6, 0x00, 0x00, 0x03, 0x8E, 0xF7, 0x1F, 0x00, 0x34, 0x01,
+	 0xC8, 0x00, 0x96, 0x01, 0xCC, 0x00, 0xFA, 0x00, 0x78, 0x01, 0xD2, 0x25, 0x18, 0x01, 0xCC, 0x1E,
+	 0xC8, 0x00, 0x00, 0x00, 0x02, 0x15, 0x00, 0x00, 0x06, 0x17, 0x12, 0x01, 0x03, 0x00, 0xAE, 0x00,
+	 0xEC, 0x00, 0x44, 0x00, 0xDC, 0x0F, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1C, 0x09, 0x08, 0x24, 0x28, 0x06,
+	 0x0C, 0x18, 0x08, 0x30, 0x14, 0x0C, 0x08, 0x36, 0x10, 0x12, 0xA1, 0xB6, 0x14, 0xB6, 0x50, 0xB7,
+	 0x59, 0xB7, 0x25, 0xB6, 0xCE, 0xB6, 0x93, 0xB6, 0x15, 0x1C, 0xD0, 0x1A, 0x15, 0x1C, 0x8B, 0x1B,
+	 0xEE, 0x1A, 0xCB, 0x1A, 0xD2, 0x1B, 0xF1, 0x1B, 0x06, 0x1C, 0x48, 0x1C, 0x74, 0x1C, 0x74, 0x1B,
+	 0x22, 0x46, 0x22, 0x46, 0x22, 0x46, 0x22, 0x46, 0x22, 0x46, 0x22, 0x46, 0x22, 0x46, 0x22, 0x46,
+	 0x22, 0x46, 0x22, 0x46, 0x22, 0x46, 0x23, 0x46, 0x23, 0x46, 0x23, 0x46, 0x1C, 0x47, 0x1C, 0x47,
+	 0x1C, 0x47, 0x1C, 0x47, 0x1C, 0x47, 0x1C, 0x47, 0x1C, 0x47, 0x1C, 0x47, 0x1C, 0x47, 0x1C, 0x47,
+	 0x1C, 0x47, 0x1C, 0x47, 0x1C, 0x47, 0x1D, 0x47, 0x9A, 0x48, 0xDA, 0x48, 0x1A, 0x48, 0x5A, 0x48,
+	 0x9A, 0x48, 0xDA, 0x48, 0x1A, 0x48, 0x5A, 0x48, 0x9A, 0x48, 0xDA, 0x48, 0x1A, 0x48, 0x5A, 0x48,
+	 0x9A, 0x48, 0x33, 0x48, 0x78, 0x49, 0x78, 0x49, 0x79, 0x49, 0x79, 0x49, 0x79, 0x49, 0x79, 0x49,
+	 0x7A, 0x49, 0x7A, 0x49, 0x7A, 0x49, 0x7A, 0x49, 0x7B, 0x49, 0x7B, 0x49, 0x7B, 0x49, 0x7C, 0x49,
+	 0xD8, 0x03, 0xDC, 0x03, 0xE0, 0x03, 0xE4, 0x03, 0xF0, 0x03, 0xF4, 0x03, 0xF8, 0x03, 0x0A, 0x04,
+	 0x0E, 0x04, 0x12, 0x04, 0x16, 0x04, 0x0C, 0x04, 0x10, 0x04, 0x14, 0x04, 0x18, 0x04, 0x1C, 0x04,
+	 0x20, 0x04, 0x24, 0x04, 0x28, 0x04, 0x4C, 0x04, 0x50, 0x04, 0x54, 0x04, 0x58, 0x04, 0x5C, 0x04,
+	 0x60, 0x04, 0x64, 0x04, 0x68, 0x04, 0x6C, 0x04, 0x70, 0x04, 0x74, 0x04, 0x7D, 0x04, 0x81, 0x04,
+	 0x85, 0x04, 0x89, 0x04, 0x8D, 0x04, 0x10, 0x00, 0x8E, 0x19, 0xAC, 0x00, 0x04, 0x00, 0x00, 0x00,
+	 0x00, 0x80, 0x3C, 0x0C, 0x00, 0x00, 0xFF, 0x3F, 0x44, 0x04, 0x00, 0x00, 0xD3, 0x22, 0x44, 0x04,
+	 0x9C, 0x02, 0xCB, 0x54, 0x44, 0x04, 0x00, 0x00, 0x01, 0x00, 0x44, 0x04, 0x00, 0x00, 0x00, 0x03,
+	 0x00, 0x0C, 0x71, 0x00, 0x30, 0x50, 0x20, 0x00, 0x80, 0xBF, 0x1F, 0xA6, 0x28, 0x00, 0x0B, 0x02,
+	 0x60, 0x84, 0x4C, 0x00, 0x02, 0x00, 0x4B, 0x1C, 0x98, 0x00, 0x00, 0x00, 0x20, 0x0B, 0x34, 0x04,
+	 0xFD, 0x34, 0x34, 0x00, 0x38, 0x04, 0xFD, 0x34, 0x34, 0x00, 0x3C, 0x04, 0x01, 0x00, 0x10, 0x00,
+	 0x00, 0x08, 0x00, 0x52, 0x14, 0x00, 0x04, 0x08, 0x0E, 0x32, 0x00, 0xA6, 0x10, 0x08, 0xC4, 0x03,
+	 0x50, 0x60, 0x18, 0x08, 0xF0, 0x3F, 0xFC, 0x01, 0x10, 0x0C, 0x00, 0x00, 0x80, 0x04, 0x14, 0x0C,
+	 0x00, 0x00, 0x00, 0x41, 0x20, 0x0C, 0xB0, 0x00, 0xB0, 0xB8, 0x24, 0x0C, 0x00, 0x00, 0xAB, 0x05,
+	 0x2C, 0x0C, 0x80, 0x05, 0x00, 0xFF, 0x30, 0x0C, 0x00, 0x00, 0xB0, 0x04, 0x34, 0x0C, 0x03, 0x00,
+	 0x00, 0xE8, 0x44, 0x0C, 0x04, 0x00, 0xFF, 0x0F, 0x00, 0x10, 0x2E, 0x00, 0x0C, 0xE3, 0x44, 0x04,
+	 0x00, 0x00, 0x01, 0x04, 0x44, 0x04, 0x00, 0x00, 0x01, 0x01, 0x44, 0x04, 0x00, 0x00, 0x01, 0x00,
+	 0x44, 0x04, 0x00, 0x00, 0x01, 0x04, 0x44, 0x04, 0x00, 0x00, 0x80, 0x03, 0x48, 0x0C, 0x00, 0x00,
+	 0x7F, 0x00, 0x04, 0x04, 0x08, 0x48, 0x00, 0x00, 0x04, 0x04, 0x08, 0x40, 0x00, 0x00, 0x00, 0x0C,
+	 0x71, 0x00, 0x30, 0x30, 0x00, 0x00, 0x5E, 0x40, 0x01, 0x00, 0x18, 0x00, 0x36, 0xC0, 0xE8, 0x0E,
+	 0x1C, 0x00, 0x78, 0xC8, 0xA5, 0x40, 0x24, 0x00, 0x9E, 0xB0, 0xB9, 0x95, 0x08, 0x08, 0x00, 0xEA,
+	 0x40, 0x01, 0x0C, 0x08, 0x00, 0xEA, 0x00, 0x00, 0x1C, 0x08, 0x00, 0x00, 0x42, 0x07, 0x20, 0x08,
+	 0x7B, 0x00, 0xD4, 0x09, 0x2C, 0x04, 0x14, 0x00, 0x50, 0x14, 0x30, 0x04, 0x28, 0x0F, 0x28, 0x7F,
+	 0x18, 0x08, 0x20, 0x00, 0xFC, 0x01, 0x04, 0x10, 0x69, 0x00, 0xFD, 0xC3, 0x08, 0x10, 0x69, 0x00,
+	 0xFD, 0xC3, 0x08, 0x0C, 0x00, 0x00, 0x00, 0x00, 0x48, 0x0C, 0x00, 0x00, 0x00, 0x00, 0x48, 0x0C,
+	 0x00, 0x00, 0x7F, 0x00, 0x04, 0x04, 0x08, 0x48, 0x02, 0x00, 0x00, 0x00, 0x5E, 0x48, 0x00, 0x00,
+	 0x04, 0x04, 0x08, 0x40, 0x02, 0x00, 0x00, 0x0C, 0x71, 0x00, 0x30, 0x50, 0x00, 0x00, 0x5E, 0x48,
+	 0x01, 0x00, 0x18, 0x00, 0x3A, 0xC0, 0xE8, 0x04, 0x1C, 0x00, 0x78, 0xD0, 0xA5, 0x40, 0x24, 0x00,
+	 0x9E, 0xB0, 0xB9, 0x85, 0x2C, 0x04, 0x14, 0x00, 0x50, 0x14, 0x30, 0x04, 0x28, 0x0F, 0x28, 0x7F,
+	 0x08, 0x08, 0x00, 0xEA, 0x40, 0x01, 0x0C, 0x08, 0x00, 0xEA, 0x00, 0x00, 0x1C, 0x08, 0x00, 0x00,
+	 0x42, 0x07, 0x20, 0x08, 0x7B, 0x00, 0xD4, 0x09, 0x18, 0x08, 0xF0, 0x3F, 0xFC, 0x01, 0x04, 0x10,
+	 0x69, 0x00, 0xDD, 0xCD, 0x08, 0x10, 0x69, 0x00, 0xDD, 0xCD, 0x08, 0x0C, 0x00, 0x00, 0x00, 0x00,
+	 0x48, 0x0C, 0x00, 0x00, 0x00, 0x00, 0x08, 0x04, 0x40, 0x01, 0x41, 0x01, 0x0C, 0x04, 0x40, 0x04,
+	 0x41, 0x04, 0x10, 0x04, 0xD6, 0x08, 0x56, 0x0A, 0x14, 0x04, 0x42, 0x02, 0x56, 0x0A, 0x18, 0x04,
+	 0x56, 0x0A, 0x40, 0x02, 0x1C, 0x04, 0x42, 0x0A, 0x42, 0x2A, 0x20, 0x04, 0xC2, 0x00, 0xD6, 0x08,
+	 0x24, 0x04, 0xD6, 0x08, 0xC0, 0x00, 0x28, 0x04, 0xC2, 0x08, 0xC2, 0x28, 0x08, 0x04, 0x40, 0x01,
+	 0x41, 0x01, 0x0C, 0x04, 0x00, 0x01, 0x01, 0x01, 0x10, 0x04, 0x56, 0x0A, 0x56, 0x0A, 0x14, 0x04,
+	 0x42, 0x02, 0x56, 0x0A, 0x18, 0x04, 0x56, 0x0A, 0x40, 0x02, 0x1C, 0x04, 0x42, 0x0A, 0x42, 0x2A,
+	 0x20, 0x04, 0x42, 0x02, 0x56, 0x0A, 0x24, 0x04, 0x56, 0x0A, 0x40, 0x02, 0x28, 0x04, 0x42, 0x0A,
+	 0x42, 0x2A, 0x08, 0x04, 0x40, 0x01, 0x41, 0x01, 0x0C, 0x04, 0x40, 0x04, 0x41, 0x04, 0x10, 0x04,
+	 0xCE, 0x08, 0x4E, 0x0A, 0x14, 0x04, 0x42, 0x02, 0x4E, 0x0A, 0x18, 0x04, 0x4E, 0x0A, 0x40, 0x02,
+	 0x1C, 0x04, 0x42, 0x0A, 0x42, 0x2A, 0x20, 0x04, 0xC2, 0x00, 0xCE, 0x08, 0x24, 0x04, 0xCE, 0x08,
+	 0xC0, 0x00, 0x28, 0x04, 0xC2, 0x08, 0xC2, 0x28, 0x08, 0x04, 0x40, 0x01, 0x41, 0x01, 0x0C, 0x04,
+	 0x00, 0x01, 0x01, 0x01, 0x10, 0x04, 0x4E, 0x0A, 0x4E, 0x0A, 0x14, 0x04, 0x42, 0x02, 0x4E, 0x0A,
+	 0x18, 0x04, 0x4E, 0x0A, 0x40, 0x02, 0x1C, 0x04, 0x42, 0x0A, 0x42, 0x2A, 0x20, 0x04, 0x42, 0x02,
+	 0x4E, 0x0A, 0x24, 0x04, 0x4E, 0x0A, 0x40, 0x02, 0x28, 0x04, 0x42, 0x0A, 0x42, 0x2A, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x01, 0x00, 0x01, 0x00, 0x01, 0x00, 0x02, 0x00, 0x03, 0x00,
+	 0x05, 0x00, 0xA0, 0x16, 0xA0, 0x16, 0xA0, 0x16, 0xA0, 0x16, 0xA0, 0x16, 0xA0, 0x16, 0xA0, 0x16,
+	 0xA0, 0x16, 0xA0, 0x16, 0xA0, 0x16, 0xA0, 0x16, 0xA0, 0x16, 0xA0, 0x16, 0xA0, 0x16, 0xA0, 0x16,
+	 0xA0, 0x16, 0xA0, 0x16, 0xA0, 0x16, 0xA0, 0x16, 0xA0, 0x16, 0xA0, 0x16, 0xA0, 0x16, 0xA0, 0x16,
+	 0xA0, 0x16, 0xA0, 0x16, 0xA0, 0x16, 0xA0, 0x16, 0xA0, 0x16, 0xA0, 0x17, 0xA0, 0x17, 0xA0, 0x17,
+	 0xA0, 0x18, 0xFF, 0x06, 0xFF, 0x06, 0xFF, 0x06, 0xFF, 0x06, 0xFF, 0x06, 0xFF, 0x06, 0xFF, 0x06,
+	 0xFF, 0x06, 0xFF, 0x06, 0xFF, 0x06, 0xFF, 0x06, 0xFF, 0x06, 0xFF, 0x06, 0xFF, 0x06, 0xFF, 0x06,
+	 0xFF, 0x06, 0xFF, 0x06, 0xFF, 0x06, 0xFF, 0x06, 0xFF, 0x06, 0xFF, 0x06, 0xFF, 0x06, 0xFF, 0x06,
+	 0xFF, 0x06, 0xFF, 0x06, 0xFF, 0x06, 0xFF, 0x06, 0xFF, 0x06, 0xFF, 0x06, 0xFF, 0x06, 0xFF, 0x06,
+	 0xFF, 0x06, 0x00, 0x00, 0x65, 0x00, 0x65, 0x00, 0x65, 0x00, 0x65, 0x00, 0x5D, 0x00, 0x52, 0x00,
+	 0x48, 0x00, 0x40, 0x00, 0x38, 0x00, 0x31, 0x00, 0x2C, 0x00, 0x27, 0x00, 0x23, 0x00, 0x1F, 0x00,
+	 0x00, 0x00, 0x65, 0x00, 0x65, 0x00, 0x65, 0x00, 0x65, 0x00, 0x5D, 0x00, 0x52, 0x00, 0x48, 0x00,
+	 0x40, 0x00, 0x38, 0x00, 0x31, 0x00, 0x2C, 0x00, 0x27, 0x00, 0x23, 0x00, 0x1F, 0x00, 0x00, 0x00,
+	 0x19, 0x00, 0x19, 0x00, 0x19, 0x00, 0x19, 0x00, 0x19, 0x00, 0x19, 0x00, 0x19, 0x00, 0x19, 0x00,
+	 0x19, 0x00, 0x19, 0x00, 0x19, 0x00, 0x19, 0x00, 0x19, 0x00, 0x19, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x0C, 0x00, 0x0C, 0x00, 0x0C, 0x00, 0x0C, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x00,
+	 0x15, 0x00, 0x6E, 0x6F, 0x6E, 0x2D, 0x73, 0x70, 0x65, 0x63, 0x69, 0x66, 0x69, 0x65, 0x64, 0x20,
+	 0x53, 0x53, 0x49, 0x44, 0x20, 0x21, 0x21, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+	 0x20, 0x20, 0x01, 0x00, 0x00, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+	 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+	 0x20, 0x20, 0x20, 0x20, 0x00, 0x09, 0x00, 0x00, 0x01, 0x00, 0x64, 0x00, 0x64, 0x00, 0x00, 0x00,
+	 0x48, 0x45, 0x52, 0x4D, 0x45, 0x53, 0x20, 0x32, 0x00, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+	 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+	 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x04, 0x00, 0x10, 0x00, 0x01, 0x00,
+	 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x01, 0x00, 0x02, 0x00, 0x02, 0x00, 0x00, 0x00, 0x04, 0x00,
+	 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x14, 0x00, 0x03, 0x00, 0x15, 0x00, 0x6E, 0x6F, 0x6E, 0x2D, 0x73, 0x70, 0x65, 0x63, 0x69, 0x66,
+	 0x69, 0x65, 0x64, 0x20, 0x53, 0x53, 0x49, 0x44, 0x20, 0x21, 0x21, 0x20, 0x20, 0x20, 0x20, 0x20,
+	 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x01, 0x00, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+	 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+	 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x00, 0x09, 0x00, 0x00, 0x01, 0x00, 0x64, 0x00,
+	 0x64, 0x00, 0x00, 0x00, 0x48, 0x45, 0x52, 0x4D, 0x45, 0x53, 0x20, 0x32, 0x00, 0x20, 0x20, 0x20,
+	 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+	 0x20, 0x20, 0x20, 0x20, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x04, 0x00,
+	 0x10, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x01, 0x00, 0x02, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46, 0x69, 0x72, 0x73, 0x74, 0x20, 0x57, 0x61,
+	 0x76, 0x65, 0x4C, 0x41, 0x4E, 0x20, 0x49, 0x49, 0x20, 0x53, 0x53, 0x49, 0x44, 0x20, 0x20, 0x20,
+	 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x00, 0x00, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+	 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+	 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0xFF, 0x0F, 0xF0, 0x0F, 0x0F, 0x00, 0x50, 0x01, 0x02, 0x00, 0x10, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x2B, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x19, 0x00, 0x14, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x07, 0x00, 0x30, 0x00, 0xFF, 0x00, 0x09, 0x00, 0x09, 0x00, 0x09, 0x00, 0x09, 0x00,
+	 0x0A, 0x00, 0x0A, 0x00, 0x0B, 0x00, 0x0B, 0x00, 0x14, 0x00, 0x14, 0x00, 0x14, 0x00, 0x0A, 0x00,
+	 0x00, 0x00, 0x02, 0x01, 0x02, 0x04, 0x0B, 0x16, 0x00, 0x00, 0x00, 0x00, 0x02, 0x01, 0x82, 0x84,
+	 0x8B, 0x96, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x14, 0x00, 0x01, 0x00,
+	 0x00, 0x00, 0x03, 0x00, 0x20, 0x00, 0x1B, 0x00, 0x17, 0x00, 0x11, 0x00, 0x10, 0x00, 0x0B, 0x00,
+	 0x0B, 0x00, 0x09, 0x00, 0x17, 0x00, 0x14, 0x00, 0x10, 0x00, 0x0D, 0x00, 0x0B, 0x00, 0x09, 0x00,
+	 0x08, 0x00, 0x07, 0x00, 0x0D, 0x00, 0x0A, 0x00, 0x09, 0x00, 0x08, 0x00, 0x05, 0x00, 0x05, 0x00,
+	 0xD8, 0x0C, 0xC0, 0x08, 0x90, 0x0D, 0x60, 0x09, 0x48, 0x0E, 0x30, 0x0A, 0x24, 0x0F, 0x18, 0x0B,
+	 0x0B, 0x6E, 0x0B, 0x37, 0x02, 0x14, 0x01, 0x0A, 0xFF, 0x0F, 0xF0, 0x0F, 0xFF, 0x0F, 0xF0, 0x0F,
+	 0xFF, 0x0F, 0xF0, 0x0F, 0xFF, 0x0F, 0xF0, 0x0F, 0xFF, 0x0F, 0xF0, 0x0F, 0xFF, 0x0F, 0xF0, 0x0F,
+	 0x04, 0x00, 0x04, 0x00, 0x04, 0x00, 0x03, 0x00, 0x07, 0x00, 0x07, 0x00, 0x07, 0x00, 0x07, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0xDD, 0x00, 0x50, 0xF2, 0x01, 0x01, 0x00,
+	 0x00, 0x50, 0xF2, 0x05, 0x02, 0x00, 0x00, 0x50, 0xF2, 0x02, 0x00, 0x50, 0xF2, 0x04, 0x02, 0x00,
+	 0x00, 0x50, 0xF2, 0x00, 0x00, 0x50, 0xF2, 0x01, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x14, 0x00, 0x04, 0x00, 0x15, 0x00, 0x02, 0x00,
+	 0x10, 0x00, 0x10, 0x00, 0x10, 0x00, 0x04, 0x00, 0x10, 0x00, 0x02, 0x00, 0x04, 0x00, 0x04, 0x00,
+	 0x15, 0x00, 0x20, 0x00, 0x11, 0x00, 0x20, 0x00, 0x16, 0x26, 0xE2, 0x2B, 0xEA, 0x2D, 0xC4, 0x2D,
+	 0xEE, 0x2D, 0x7E, 0x2C, 0x1E, 0x2E, 0x22, 0x2E, 0xFF, 0xFF, 0x2C, 0x2E, 0x00, 0x00, 0x4E, 0x28,
+	 0xD8, 0x2B, 0x22, 0x2E, 0xFF, 0xFF, 0x00, 0x00, 0x16, 0x26, 0xE2, 0x2B, 0xEA, 0x2D, 0xFF, 0xFF,
+	 0xEE, 0x2D, 0x7E, 0x2C, 0x1E, 0x2E, 0x22, 0x2E, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xFF, 0xFF, 0x2C, 0x2E, 0x00, 0x00, 0xE2, 0x2B, 0x34, 0x2E, 0x22, 0x2E, 0x00, 0x00, 0x00, 0x05,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x01, 0x03, 0x03, 0x00, 0x06, 0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x2A, 0x00, 0x00, 0x08, 0x32, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x80, 0x00, 0x60, 0x1D, 0x00, 0x00, 0x00, 0x0D, 0x81,
+	 0x00, 0x60, 0x1D, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00,
+	 0x00, 0x00, 0xDD, 0x00, 0xFF, 0xFF, 0x97, 0xDA, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x10, 0x00, 0x19, 0x0A, 0x09, 0x46, 0x1C, 0x60, 0x18, 0x00, 0x19, 0x1D, 0x09, 0x42,
+	 0x1C, 0x60,
+
+};  /* fw_image_2_data */
+
+static const hcf_8 fw_image_3_data[] = {
+	 0x00, 0x60, 0x46, 0x74, 0xCD, 0xE2, 0x04, 0xE1, 0x02, 0x60, 0x00, 0xE1, 0x82, 0xF3, 0x21, 0x60,
+	 0xCE, 0x61, 0x60, 0x40, 0x01, 0x2B, 0x02, 0x00, 0x21, 0x60, 0x56, 0x61, 0x0F, 0x60, 0xE8, 0x64,
+	 0x59, 0xD1, 0x58, 0xD9, 0x59, 0xD1, 0x58, 0xD9, 0x3F, 0x44, 0x40, 0x26, 0x05, 0x00, 0x18, 0x60,
+	 0x22, 0xF3, 0x5A, 0xD1, 0xA0, 0x50, 0xA4, 0x50, 0x3F, 0x40, 0x02, 0x2B, 0x03, 0x00, 0x18, 0x60,
+	 0x74, 0x78, 0xFF, 0xFF, 0x04, 0x29, 0xFE, 0x01, 0xC4, 0xE2, 0x43, 0x64, 0x3A, 0xDB, 0x82, 0xF3,
+	 0xFF, 0xFF, 0x60, 0x41, 0x3F, 0x44, 0xFF, 0x01, 0x3F, 0x40, 0x40, 0x26, 0x05, 0x00, 0x18, 0x60,
+	 0x20, 0xF3, 0x5A, 0xD1, 0xA0, 0x50, 0xA4, 0x52, 0xC4, 0xE2, 0x00, 0x63, 0x81, 0xFD, 0x32, 0x7B,
+	 0x4D, 0xE2, 0xBF, 0xFE, 0xC4, 0xE2, 0x41, 0xFF, 0xE0, 0xFE, 0xE1, 0xFE, 0xE2, 0xFE, 0x43, 0xFF,
+	 0x44, 0xFF, 0x46, 0xFF, 0x83, 0xF3, 0x62, 0xFF, 0x60, 0x40, 0x05, 0x36, 0x2D, 0xFF, 0x07, 0x36,
+	 0xD5, 0xFE, 0x08, 0xE1, 0x88, 0x60, 0x85, 0x71, 0x8D, 0xE2, 0xA3, 0x60, 0x30, 0x78, 0xFF, 0xFF,
+	 0x00, 0x60, 0x10, 0x62, 0x1A, 0x60, 0x58, 0x4D, 0xB4, 0x78, 0xFF, 0xFF, 0x64, 0x41, 0xA9, 0x9C,
+	 0x60, 0x45, 0x1A, 0x60, 0x58, 0x4D, 0x88, 0x78, 0xFF, 0xFF, 0x82, 0xF1, 0x09, 0x60, 0xB4, 0x61,
+	 0x64, 0x44, 0x01, 0x27, 0x24, 0x00, 0x60, 0x40, 0x0E, 0x3A, 0x0D, 0x00, 0x01, 0x7C, 0x10, 0x60,
+	 0xF2, 0xF9, 0x44, 0x60, 0x08, 0x7C, 0x10, 0x60, 0xC4, 0xF9, 0x12, 0x60, 0xE5, 0xF1, 0x02, 0x60,
+	 0xB0, 0x61, 0xB1, 0x9C, 0x26, 0x00, 0x00, 0x7C, 0x10, 0x60, 0xF2, 0xF9, 0x40, 0x60, 0x08, 0x7C,
+	 0x10, 0x60, 0xC4, 0xF9, 0x12, 0x60, 0xE5, 0xF1, 0x02, 0x60, 0x90, 0x61, 0xB1, 0x9C, 0x09, 0x60,
+	 0x67, 0x65, 0xFF, 0xB4, 0xC4, 0x85, 0xE0, 0x84, 0xE0, 0x84, 0xC4, 0x81, 0x12, 0x00, 0xFF, 0xB4,
+	 0xED, 0xA0, 0x25, 0x60, 0xCC, 0x61, 0x04, 0x04, 0xE2, 0xA0, 0xD9, 0x81, 0x01, 0x04, 0xD9, 0x81,
+	 0xA1, 0xD1, 0x02, 0x60, 0x50, 0x61, 0x1F, 0x60, 0xF6, 0x65, 0xE0, 0x84, 0x44, 0xD3, 0xB1, 0x9C,
+	 0xC8, 0x81, 0x61, 0x47, 0x00, 0x7E, 0xE9, 0x81, 0x07, 0x60, 0xF0, 0x65, 0xA5, 0x81, 0x0B, 0xB9,
+	 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x85, 0xB5, 0x85, 0x04, 0x60, 0x44, 0x62, 0x1A, 0x60, 0x58, 0x4D,
+	 0x88, 0x78, 0xFF, 0xFF, 0x82, 0xF3, 0xC8, 0x61, 0x61, 0x54, 0xCD, 0xE2, 0x60, 0x40, 0x01, 0x27,
+	 0x2E, 0x00, 0xCC, 0x84, 0xE0, 0x85, 0x15, 0x60, 0xA2, 0xE7, 0x1F, 0x60, 0x86, 0x64, 0x1A, 0x60,
+	 0x58, 0x4F, 0x7D, 0x78, 0xFF, 0xFF, 0x1F, 0x60, 0xA2, 0x64, 0x1A, 0x60, 0x58, 0x4F, 0x7D, 0x78,
+	 0xFF, 0xFF, 0x1F, 0x60, 0xBE, 0x64, 0x1A, 0x60, 0x58, 0x4F, 0x7D, 0x78, 0xFF, 0xFF, 0x1F, 0x60,
+	 0xDA, 0x64, 0x1A, 0x60, 0x58, 0x4F, 0x7D, 0x78, 0xFF, 0xFF, 0x75, 0x64, 0x06, 0x61, 0x61, 0x48,
+	 0x60, 0x44, 0x80, 0xBC, 0xFF, 0xB4, 0x60, 0x4A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x21, 0x60,
+	 0xEC, 0x7C, 0x07, 0x60, 0xE9, 0xF9, 0x21, 0x60, 0x74, 0x63, 0x14, 0x61, 0x21, 0x00, 0x11, 0x60,
+	 0x62, 0xF1, 0xFF, 0xB4, 0xED, 0xA0, 0x64, 0x41, 0x04, 0x04, 0xE2, 0xA0, 0xD9, 0x81, 0x01, 0x04,
+	 0xD9, 0x81, 0xA1, 0xD1, 0x10, 0x60, 0x91, 0xF3, 0x64, 0x41, 0xFF, 0xB1, 0xFF, 0x60, 0x00, 0x65,
+	 0xA4, 0x84, 0x34, 0x94, 0xA2, 0xDB, 0x5A, 0xD3, 0x64, 0x41, 0xA5, 0x81, 0xFF, 0xB4, 0x34, 0x94,
+	 0xA2, 0xDB, 0x22, 0x60, 0x58, 0x7C, 0x07, 0x60, 0xE9, 0xF9, 0x21, 0x60, 0x02, 0x63, 0x13, 0x61,
+	 0x1A, 0x60, 0x58, 0x4D, 0x9C, 0x78, 0xFF, 0xFF, 0x07, 0x60, 0xE9, 0xF3, 0x31, 0x40, 0x80, 0x26,
+	 0x36, 0xA4, 0x07, 0x60, 0xE9, 0xFB, 0x60, 0x43, 0x09, 0x61, 0x1A, 0x60, 0x58, 0x4D, 0x9C, 0x78,
+	 0xFF, 0xFF, 0x82, 0xF3, 0x22, 0x60, 0xC4, 0x61, 0x00, 0x7C, 0x7E, 0x63, 0x59, 0xD9, 0xFE, 0x1F,
+	 0x60, 0x40, 0x01, 0x27, 0x03, 0x00, 0x23, 0x60, 0x46, 0x65, 0x15, 0x00, 0xFF, 0xB4, 0xF9, 0xA0,
+	 0x23, 0x60, 0x68, 0x65, 0x01, 0x7C, 0x0D, 0x04, 0xED, 0xA0, 0x23, 0x60, 0x8A, 0x65, 0x11, 0x7C,
+	 0x08, 0x04, 0xE2, 0xA0, 0x23, 0x60, 0xAC, 0x65, 0x21, 0x7C, 0x03, 0x04, 0x23, 0x60, 0xCE, 0x65,
+	 0x31, 0x7C, 0x64, 0x5F, 0x64, 0xFB, 0xA5, 0xD3, 0xDA, 0x85, 0xF0, 0xA0, 0x22, 0x60, 0xC4, 0x61,
+	 0x08, 0x06, 0x40, 0x54, 0x58, 0x53, 0x08, 0xFF, 0xA2, 0x60, 0xE7, 0x64, 0x43, 0xFB, 0x08, 0xFF,
+	 0xFF, 0x01, 0x60, 0x43, 0x60, 0x46, 0xA5, 0xD1, 0xDA, 0x85, 0xA5, 0xD3, 0xDA, 0x85, 0x59, 0xD9,
+	 0x59, 0xDB, 0x59, 0xD9, 0x59, 0xDB, 0xFB, 0x1F, 0x0C, 0x63, 0xA5, 0xD1, 0xDA, 0x85, 0xA5, 0xD3,
+	 0xDA, 0x85, 0x59, 0xD9, 0x59, 0xDB, 0x59, 0xD9, 0x59, 0xDB, 0xF7, 0x1F, 0x66, 0x44, 0x0E, 0x63,
+	 0x53, 0x93, 0x60, 0x40, 0x10, 0x36, 0x07, 0x00, 0x65, 0x44, 0x48, 0xD3, 0x59, 0xD9, 0x59, 0xDB,
+	 0x59, 0xD9, 0x59, 0xDB, 0xFB, 0x1F, 0x12, 0x60, 0xBC, 0xF1, 0x64, 0xF3, 0x64, 0x43, 0xDB, 0x81,
+	 0x25, 0x60, 0x5A, 0x65, 0x60, 0x40, 0x01, 0x37, 0x12, 0x00, 0x11, 0x37, 0x17, 0x00, 0x21, 0x37,
+	 0x1D, 0x00, 0x31, 0x37, 0x22, 0x00, 0xA3, 0xD1, 0x12, 0x60, 0xB7, 0xF5, 0x64, 0x44, 0xFF, 0xB4,
+	 0x12, 0x60, 0xB6, 0xFB, 0x64, 0x47, 0xFF, 0xB4, 0x12, 0x60, 0xAD, 0xF1, 0x1D, 0x00, 0xA1, 0xD3,
+	 0x12, 0x60, 0xB8, 0xF5, 0xFF, 0xB4, 0x12, 0x60, 0xAE, 0xF1, 0x16, 0x00, 0xA1, 0xD3, 0x12, 0x60,
+	 0xB9, 0xF5, 0x60, 0x47, 0xFF, 0xB4, 0x12, 0x60, 0xAF, 0xF1, 0x0E, 0x00, 0x59, 0xD3, 0x12, 0x60,
+	 0xBA, 0xF5, 0xFF, 0xB4, 0x12, 0x60, 0xB0, 0xF1, 0x07, 0x00, 0x59, 0xD3, 0x12, 0x60, 0xBB, 0xF5,
+	 0x60, 0x47, 0xFF, 0xB4, 0x12, 0x60, 0xB1, 0xF1, 0x12, 0x60, 0xB5, 0xFB, 0x12, 0x60, 0xB2, 0xF9,
+	 0x66, 0x42, 0xFC, 0xA2, 0xA2, 0xD3, 0x24, 0x60, 0x48, 0x63, 0xCC, 0x84, 0xE8, 0x84, 0xCC, 0x81,
+	 0x63, 0x45, 0xA6, 0xD3, 0xDA, 0x82, 0xFF, 0xB4, 0xFF, 0xFF, 0x03, 0x03, 0x60, 0x40, 0x80, 0x2B,
+	 0x03, 0x00, 0xDA, 0x86, 0xCD, 0x81, 0xF5, 0x01, 0x00, 0xB9, 0xA6, 0xD3, 0x0B, 0x03, 0x5A, 0xD1,
+	 0xDA, 0x86, 0xFF, 0xB4, 0xE0, 0x84, 0xC4, 0x84, 0x5C, 0x90, 0xBD, 0xD9, 0xFD, 0x02, 0xCD, 0x81,
+	 0x66, 0x42, 0xF2, 0x02, 0x5A, 0xD3, 0x24, 0x60, 0x86, 0x65, 0xD7, 0x80, 0xBD, 0xDB, 0xFD, 0x02,
+	 0x64, 0xF3, 0x15, 0x60, 0xDD, 0xF1, 0x60, 0x40, 0x01, 0x27, 0x09, 0x00, 0x64, 0x40, 0x10, 0x26,
+	 0x06, 0x00, 0x13, 0x64, 0xAD, 0xFB, 0x01, 0x60, 0x67, 0x64, 0x37, 0xFB, 0x09, 0x00, 0x08, 0x64,
+	 0xAD, 0xFB, 0x82, 0xF3, 0x01, 0x60, 0x67, 0x7C, 0x60, 0x40, 0x01, 0x27, 0x5B, 0x7C, 0x37, 0xF9,
+	 0x13, 0x60, 0x5B, 0xF1, 0x64, 0xF3, 0x15, 0x60, 0xD2, 0xF9, 0x15, 0x60, 0xD6, 0xF9, 0x60, 0x40,
+	 0x01, 0x27, 0x0A, 0x00, 0xFF, 0xB5, 0x10, 0x60, 0xA8, 0x63, 0x65, 0x41, 0xCD, 0x81, 0x06, 0xA3,
+	 0xFD, 0x02, 0xFA, 0xA3, 0xA3, 0xD3, 0x0F, 0x00, 0x01, 0x60, 0xFF, 0x65, 0xA4, 0x84, 0x11, 0x60,
+	 0x14, 0x61, 0xA1, 0xD1, 0xFF, 0xFF, 0xD0, 0x80, 0x08, 0xA1, 0xFB, 0x02, 0xFC, 0xA1, 0xA1, 0xD3,
+	 0x15, 0x60, 0xD2, 0xF1, 0xFF, 0xB4, 0xD0, 0x80, 0xFF, 0xFF, 0x04, 0x07, 0x15, 0x60, 0xD2, 0xFB,
+	 0x15, 0x60, 0xD6, 0xFB, 0x25, 0x60, 0x7A, 0x63, 0x24, 0x60, 0x08, 0x65, 0x12, 0x60, 0xB6, 0xF1,
+	 0x23, 0x60, 0xF0, 0x61, 0x25, 0x60, 0x68, 0x64, 0x40, 0x4F, 0x04, 0x64, 0xC3, 0x60, 0x58, 0x4D,
+	 0x25, 0x78, 0xFF, 0xFF, 0x25, 0x60, 0x82, 0x63, 0x12, 0x60, 0xB5, 0xF1, 0x24, 0x60, 0x48, 0x65,
+	 0x25, 0x60, 0x66, 0x64, 0x40, 0x4F, 0x08, 0x64, 0xC3, 0x60, 0x58, 0x4D, 0x25, 0x78, 0xFF, 0xFF,
+	 0x64, 0xF3, 0x08, 0x7C, 0x38, 0xF9, 0x24, 0x60, 0xE0, 0x61, 0x60, 0x40, 0x01, 0x2B, 0x0E, 0x00,
+	 0x01, 0x37, 0x06, 0x00, 0x11, 0x37, 0x03, 0x00, 0x21, 0x3B, 0x1E, 0xA1, 0x1E, 0xA1, 0x1E, 0xA1,
+	 0x1C, 0x63, 0x24, 0x60, 0xC2, 0x64, 0x59, 0xD1, 0x58, 0xD9, 0xFD, 0x1F, 0x12, 0x60, 0xB2, 0xF3,
+	 0x00, 0x7C, 0x60, 0x45, 0x70, 0x62, 0x1A, 0x60, 0x58, 0x4D, 0x88, 0x78, 0xFF, 0xFF, 0x04, 0x29,
+	 0xFE, 0x01, 0x00, 0x60, 0x10, 0x62, 0x1A, 0x60, 0x58, 0x4D, 0xB4, 0x78, 0xFF, 0xFF, 0x01, 0x61,
+	 0xB1, 0x9C, 0x60, 0x45, 0x1A, 0x60, 0x58, 0x4D, 0x88, 0x78, 0xFF, 0xFF, 0x18, 0x60, 0x50, 0x78,
+	 0xFF, 0xFF, 0x44, 0xD3, 0x80, 0x7C, 0x60, 0x48, 0x60, 0x47, 0x00, 0x7F, 0xB0, 0x8A, 0xFF, 0xFF,
+	 0x01, 0x16, 0xFE, 0x01, 0x2F, 0x58, 0xFF, 0xFF, 0xD5, 0x60, 0x84, 0xE7, 0x62, 0x47, 0x80, 0xBF,
+	 0x60, 0x4A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x64, 0x4A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01,
+	 0x65, 0x4A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x95, 0x60, 0x84, 0xE7, 0x2D, 0x58, 0xFF, 0xFF,
+	 0x00, 0x7C, 0xBD, 0xD3, 0xD5, 0x60, 0x84, 0xE7, 0x60, 0x47, 0x80, 0xBF, 0x60, 0x4A, 0xBD, 0xD3,
+	 0x01, 0x16, 0xFE, 0x01, 0x90, 0x8A, 0xBD, 0xD3, 0x01, 0x16, 0xFE, 0x01, 0x90, 0x8A, 0xFF, 0xFF,
+	 0x01, 0x16, 0xFE, 0x01, 0xCD, 0x81, 0x95, 0x60, 0x84, 0xE7, 0xEB, 0x02, 0x2D, 0x58, 0xFF, 0xFF,
+	 0xD5, 0x60, 0x84, 0xE7, 0x62, 0x4A, 0x02, 0x64, 0x01, 0x16, 0xFE, 0x01, 0xCC, 0x84, 0xFF, 0xFF,
+	 0xFD, 0x02, 0x7C, 0x49, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x68, 0x5C, 0x7C, 0x49, 0xFF, 0xFF,
+	 0x01, 0x16, 0xFE, 0x01, 0x68, 0x44, 0x95, 0x60, 0x84, 0xE7, 0x2D, 0x58, 0xFF, 0xFF, 0x42, 0xFF,
+	 0x40, 0xFF, 0x3F, 0x40, 0x02, 0x27, 0x33, 0x00, 0x43, 0x45, 0x20, 0x44, 0x20, 0xBC, 0x40, 0x40,
+	 0x3F, 0x40, 0x02, 0x27, 0x1B, 0x00, 0x60, 0xBC, 0x40, 0x40, 0xDD, 0xFE, 0x18, 0x60, 0x07, 0xF1,
+	 0xAD, 0x4F, 0x00, 0x7F, 0xFA, 0xB4, 0x64, 0x41, 0x64, 0xF1, 0x02, 0xB1, 0x04, 0x65, 0x02, 0x02,
+	 0x64, 0x40, 0x01, 0x2B, 0x01, 0x65, 0xB4, 0x84, 0xA0, 0x5D, 0x00, 0xEE, 0x19, 0x61, 0xCD, 0x81,
+	 0xFF, 0xFF, 0xFD, 0x02, 0x43, 0x45, 0x3F, 0x40, 0x02, 0x27, 0x11, 0x00, 0xAE, 0x4F, 0xFD, 0xB4,
+	 0x04, 0xBC, 0xA0, 0x5E, 0x00, 0x60, 0x02, 0x71, 0x8D, 0xE2, 0x40, 0xE1, 0xA1, 0xFF, 0x04, 0xAC,
+	 0xA0, 0x5E, 0x0F, 0x60, 0xA0, 0x71, 0x8D, 0xE2, 0xA1, 0xFF, 0xDD, 0xFE, 0x1E, 0x00, 0x43, 0x45,
+	 0x20, 0x44, 0x60, 0xBC, 0x40, 0x40, 0xAE, 0x4F, 0xFD, 0xB4, 0x04, 0xBC, 0xA0, 0x5E, 0xDD, 0xFE,
+	 0x00, 0x60, 0x02, 0x71, 0x8D, 0xE2, 0x40, 0xE1, 0xA1, 0xFF, 0x04, 0xAC, 0xA0, 0x5E, 0x00, 0x60,
+	 0xC8, 0x71, 0x8D, 0xE2, 0xA1, 0xFF, 0x0C, 0x60, 0x00, 0x62, 0x00, 0x60, 0x71, 0x7C, 0x10, 0x60,
+	 0x00, 0x65, 0x1A, 0x60, 0x58, 0x4D, 0x88, 0x78, 0xFF, 0xFF, 0x20, 0x60, 0x3C, 0x63, 0x1E, 0x61,
+	 0x1A, 0x60, 0x58, 0x4D, 0x9C, 0x78, 0xFF, 0xFF, 0x00, 0x60, 0x14, 0x71, 0x8D, 0xE2, 0xA1, 0xFF,
+	 0x31, 0x44, 0x40, 0x26, 0x02, 0x00, 0x80, 0x26, 0x17, 0x00, 0x21, 0x60, 0xEC, 0x63, 0x07, 0x60,
+	 0xE9, 0xFD, 0x09, 0x61, 0x1A, 0x60, 0x58, 0x4D, 0x9C, 0x78, 0xFF, 0xFF, 0x31, 0x44, 0x40, 0x2A,
+	 0x14, 0x00, 0x31, 0x44, 0x7F, 0xB4, 0x40, 0x51, 0xAE, 0x4C, 0x10, 0x26, 0x0E, 0x00, 0x07, 0x60,
+	 0xEA, 0xFB, 0x31, 0x44, 0x80, 0xBC, 0x40, 0x51, 0x22, 0x60, 0x22, 0x63, 0x07, 0x60, 0xE9, 0xFD,
+	 0x09, 0x61, 0x1A, 0x60, 0x58, 0x4D, 0x9C, 0x78, 0xFF, 0xFF, 0x20, 0x60, 0xF0, 0x63, 0x03, 0x61,
+	 0x1A, 0x60, 0x58, 0x4D, 0x9C, 0x78, 0xFF, 0xFF, 0x00, 0x60, 0x10, 0x62, 0x19, 0x60, 0x8F, 0x7C,
+	 0x00, 0x60, 0xAC, 0x65, 0x1A, 0x60, 0x58, 0x4D, 0x88, 0x78, 0xFF, 0xFF, 0x80, 0xE1, 0xBF, 0xFE,
+	 0xA1, 0x4F, 0x70, 0xB4, 0x50, 0x36, 0xAF, 0x00, 0x20, 0x36, 0x03, 0x00, 0x18, 0x60, 0x24, 0x78,
+	 0xFF, 0xFF, 0x01, 0x60, 0x1A, 0xE1, 0xDF, 0xFE, 0x19, 0xFF, 0x00, 0xE1, 0xA1, 0xFF, 0xFF, 0xFF,
+	 0x3F, 0x40, 0x20, 0x2B, 0xA1, 0x00, 0x01, 0x16, 0xFE, 0x01, 0x38, 0x69, 0xA1, 0xFF, 0xFF, 0xFF,
+	 0x68, 0x44, 0x01, 0x2A, 0x99, 0x00, 0x13, 0x60, 0x09, 0xF3, 0xFF, 0xFF, 0xDC, 0x84, 0x00, 0x36,
+	 0x00, 0x3B, 0xA2, 0xDB, 0x64, 0xF1, 0x80, 0x60, 0x00, 0x64, 0xB0, 0x9C, 0x47, 0x00, 0x43, 0x45,
+	 0x20, 0x44, 0x20, 0xBC, 0x40, 0x40, 0x18, 0x60, 0x22, 0xF3, 0x3F, 0x40, 0x40, 0x26, 0x01, 0x00,
+	 0xA0, 0x50, 0x3F, 0x40, 0x02, 0x2B, 0x29, 0x00, 0xAE, 0x4F, 0xFD, 0xB4, 0xA0, 0x5E, 0xDD, 0xFE,
+	 0xAC, 0x4F, 0x10, 0xBC, 0xA0, 0x5C, 0xFF, 0xFF, 0x10, 0xAC, 0xA0, 0x5C, 0x00, 0x60, 0xC8, 0x71,
+	 0x8D, 0xE2, 0x40, 0xE1, 0x40, 0x29, 0xFE, 0x01, 0x0C, 0x60, 0x00, 0x62, 0x00, 0x60, 0x71, 0x7C,
+	 0x10, 0x60, 0x00, 0x65, 0x1A, 0x60, 0x58, 0x4D, 0x88, 0x78, 0xFF, 0xFF, 0x00, 0x60, 0xC8, 0x71,
+	 0x8D, 0xE2, 0x40, 0xE1, 0x40, 0x29, 0xFE, 0x01, 0x01, 0x60, 0x08, 0xE1, 0x64, 0xF1, 0x82, 0xF9,
+	 0x05, 0x7C, 0x83, 0xF9, 0xDF, 0xFE, 0x19, 0xFF, 0xFF, 0xFF, 0x18, 0x60, 0x07, 0xF1, 0xAD, 0x4F,
+	 0x00, 0x7F, 0xFA, 0xB4, 0x64, 0x41, 0x64, 0xF1, 0x02, 0xB1, 0x04, 0x65, 0x02, 0x02, 0x64, 0x40,
+	 0x01, 0x2B, 0x01, 0x65, 0xB4, 0x84, 0xA0, 0x5D, 0xBF, 0xFE, 0x45, 0x00, 0x18, 0x60, 0x07, 0xF1,
+	 0xAD, 0x4F, 0x00, 0x7F, 0xFA, 0xB4, 0x64, 0x41, 0x64, 0xF1, 0x02, 0xB1, 0x04, 0x65, 0x02, 0x02,
+	 0x64, 0x40, 0x01, 0x2B, 0x01, 0x65, 0xB4, 0x84, 0xA0, 0x5D, 0x43, 0x45, 0x20, 0x44, 0x20, 0xBC,
+	 0x40, 0x40, 0x02, 0x60, 0xEE, 0x64, 0x3F, 0x40, 0x02, 0x27, 0xC8, 0x64, 0x81, 0xFB, 0x82, 0xF9,
+	 0x05, 0x64, 0x83, 0xFB, 0xDF, 0xFE, 0x19, 0xFF, 0x26, 0x00, 0x20, 0x44, 0x20, 0xBC, 0x40, 0x40,
+	 0x43, 0x45, 0xA4, 0xD1, 0xDA, 0x83, 0xC3, 0x85, 0x80, 0xE1, 0xDF, 0xFE, 0xBD, 0xD3, 0xFF, 0xFF,
+	 0x60, 0x48, 0x60, 0x47, 0x80, 0xBC, 0x00, 0x7F, 0x60, 0x4A, 0xD7, 0x80, 0xA1, 0xFF, 0xF6, 0x02,
+	 0xBF, 0xFE, 0x11, 0x00, 0x43, 0x45, 0xA4, 0xD1, 0xDA, 0x83, 0x0D, 0x18, 0x64, 0x44, 0x00, 0x61,
+	 0xFA, 0xA4, 0xDD, 0x81, 0xFD, 0x02, 0x1A, 0x60, 0x58, 0x4D, 0x9C, 0x78, 0xFF, 0xFF, 0xBF, 0xFE,
+	 0x02, 0x00, 0xF1, 0xFE, 0x01, 0x00, 0x25, 0x43, 0x21, 0xE1, 0x00, 0x64, 0xBF, 0xDB, 0x20, 0x44,
+	 0x20, 0x2A, 0x07, 0x00, 0x07, 0xB4, 0x04, 0x36, 0xC3, 0xFE, 0x06, 0x36, 0xCC, 0xFE, 0x07, 0x36,
+	 0xD5, 0xFE, 0x20, 0x44, 0xD8, 0xB4, 0x40, 0x40, 0x1F, 0x60, 0x2C, 0x63, 0xBD, 0xD3, 0x03, 0x61,
+	 0x0F, 0x1B, 0x04, 0xA3, 0xBD, 0xD3, 0x04, 0x61, 0x0B, 0x1B, 0x04, 0xA3, 0xBD, 0xD3, 0x06, 0x61,
+	 0x07, 0x1B, 0x04, 0xA3, 0xBD, 0xD3, 0x07, 0x61, 0x03, 0x1B, 0xC3, 0x60, 0x53, 0x78, 0xFF, 0xFF,
+	 0xA3, 0xD1, 0x40, 0x44, 0x20, 0x44, 0x07, 0xB5, 0xD4, 0x85, 0x35, 0x80, 0x24, 0x45, 0x1F, 0x60,
+	 0x6C, 0x64, 0x44, 0xD7, 0xFF, 0xFF, 0xFF, 0xFF, 0x43, 0x45, 0x20, 0x44, 0x20, 0xBC, 0x40, 0x40,
+	 0x64, 0x43, 0xBD, 0xD3, 0xBD, 0xD1, 0x40, 0x44, 0x10, 0x27, 0x19, 0x00, 0x3F, 0x40, 0x02, 0x2B,
+	 0x06, 0x00, 0x24, 0x47, 0x08, 0x2B, 0x13, 0x00, 0x07, 0xB4, 0x01, 0x36, 0x11, 0x00, 0xFF, 0x60,
+	 0x7F, 0x65, 0x15, 0x60, 0xA2, 0x64, 0x24, 0x40, 0x08, 0x2B, 0xA4, 0x84, 0xA0, 0x57, 0xFF, 0xFF,
+	 0x64, 0x49, 0xFF, 0xFF, 0x68, 0x44, 0x01, 0x16, 0xFD, 0x01, 0x00, 0x7F, 0xA3, 0xDB, 0xAB, 0x01,
+	 0x64, 0x42, 0x1A, 0x60, 0x58, 0x4D, 0xB4, 0x78, 0xFF, 0xFF, 0xBD, 0xD9, 0xA3, 0xDB, 0xA3, 0x01,
+	 0x43, 0x45, 0x20, 0x44, 0x20, 0xBC, 0x40, 0x40, 0x64, 0x43, 0xBD, 0xD3, 0xA3, 0xD1, 0x40, 0x44,
+	 0x10, 0x2B, 0x16, 0x00, 0xBE, 0xD1, 0xFF, 0xFF, 0x15, 0x60, 0x80, 0xE7, 0x24, 0x40, 0x07, 0x27,
+	 0x04, 0x00, 0xAC, 0x4F, 0x10, 0xBC, 0x00, 0x7F, 0xA0, 0x5C, 0x64, 0x4A, 0xFF, 0xFF, 0x01, 0x16,
+	 0xFE, 0x01, 0x24, 0x40, 0x20, 0x27, 0x1D, 0x00, 0xAC, 0x4F, 0xEF, 0xB4, 0xA0, 0x5C, 0x19, 0x00,
+	 0x3F, 0x40, 0x02, 0x2B, 0x06, 0x00, 0x24, 0x47, 0x08, 0x2B, 0x13, 0x00, 0x07, 0xB4, 0x01, 0x36,
+	 0x11, 0x00, 0x15, 0x60, 0x22, 0x64, 0x24, 0x40, 0x08, 0x27, 0x80, 0xBC, 0x7C, 0x48, 0xBE, 0xD3,
+	 0xA0, 0x57, 0x60, 0x48, 0x64, 0x44, 0x80, 0xBC, 0xFF, 0xB4, 0x60, 0x4A, 0xFF, 0xFF, 0x01, 0x16,
+	 0xFE, 0x01, 0x69, 0x01, 0x01, 0x61, 0x1A, 0x60, 0x58, 0x4D, 0x9C, 0x78, 0xFF, 0xFF, 0x63, 0x01,
+	 0x28, 0xF3, 0xFF, 0xFF, 0x60, 0x47, 0x0F, 0xB4, 0x9A, 0x00, 0xFF, 0x67, 0x23, 0x58, 0xFF, 0xFF,
+	 0x04, 0x64, 0x0F, 0x60, 0x9F, 0xFB, 0x27, 0x00, 0x0C, 0x64, 0x3F, 0x40, 0x02, 0x2B, 0x23, 0x00,
+	 0x29, 0xF1, 0x0F, 0x60, 0x9F, 0xFB, 0x5A, 0xD9, 0x1C, 0x60, 0xD0, 0x64, 0x7F, 0xFB, 0xFF, 0xFF,
+	 0x2D, 0xFF, 0xF0, 0x60, 0xC7, 0x78, 0xFF, 0xFF, 0x22, 0x60, 0x22, 0x63, 0x09, 0x61, 0x1A, 0x60,
+	 0x58, 0x4D, 0x9C, 0x78, 0xFF, 0xFF, 0x77, 0x00, 0xD3, 0xF3, 0xFF, 0xFF, 0xFE, 0xB4, 0xD3, 0xFB,
+	 0x06, 0x64, 0x0F, 0x60, 0x9F, 0xFB, 0xFF, 0xFF, 0x2D, 0xFF, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF,
+	 0x08, 0x64, 0x0F, 0x60, 0x9F, 0xFB, 0x1D, 0x60, 0x4F, 0x64, 0x7F, 0xFB, 0xFF, 0xFF, 0x2D, 0xFF,
+	 0xF0, 0x60, 0xC7, 0x78, 0xFF, 0xFF, 0x29, 0xF3, 0x11, 0x60, 0xF9, 0x65, 0x60, 0x5C, 0x3F, 0x40,
+	 0x02, 0x2B, 0x13, 0x00, 0x00, 0x37, 0x11, 0x00, 0x01, 0x3B, 0x55, 0x00, 0x11, 0x60, 0x19, 0x63,
+	 0xFF, 0xB7, 0x60, 0x5C, 0xA3, 0xD3, 0x08, 0xA3, 0x00, 0x7E, 0xD0, 0x80, 0xD7, 0x80, 0x02, 0x03,
+	 0xF9, 0x02, 0x49, 0x00, 0xF4, 0xA3, 0xA3, 0xD3, 0x05, 0x00, 0x00, 0xBC, 0xF2, 0xA4, 0x43, 0x03,
+	 0x42, 0x07, 0x64, 0x44, 0x64, 0xFB, 0x82, 0xFB, 0xC8, 0x64, 0x81, 0xFB, 0x07, 0x64, 0x83, 0xFB,
+	 0x1D, 0x60, 0x4F, 0x64, 0x7F, 0xFB, 0xFF, 0xFF, 0xDF, 0xFE, 0x00, 0x64, 0x19, 0xFF, 0xF0, 0x60,
+	 0xC7, 0x78, 0xFF, 0xFF, 0x88, 0xFF, 0xBA, 0x60, 0x98, 0x71, 0x8D, 0xE2, 0x01, 0x11, 0x09, 0x00,
+	 0x71, 0x40, 0x80, 0x27, 0xFB, 0x01, 0x88, 0xE2, 0xBA, 0x60, 0xD0, 0x64, 0x03, 0xFB, 0x8D, 0xFF,
+	 0x15, 0x00, 0x8D, 0xFF, 0xB1, 0x60, 0xED, 0x63, 0x06, 0x60, 0x0B, 0xFD, 0xFF, 0xFF, 0x62, 0xFF,
+	 0x1D, 0x60, 0x3C, 0x63, 0x7F, 0xFD, 0xFF, 0xFF, 0x1A, 0xFF, 0xF0, 0x60, 0xC7, 0x78, 0xFF, 0xFF,
+	 0xA4, 0x60, 0x7C, 0x63, 0x06, 0x60, 0x0B, 0xFD, 0xFF, 0xFF, 0x62, 0xFF, 0x29, 0xF5, 0x1F, 0x60,
+	 0x26, 0x63, 0x1E, 0x60, 0xF8, 0x64, 0xBD, 0xDB, 0x66, 0x44, 0xBD, 0xDB, 0x02, 0x64, 0xA3, 0xDB,
+	 0xFF, 0xFF, 0x2B, 0xFF, 0xF9, 0xFE, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x66, 0x01, 0x00, 0x36,
+	 0x67, 0x01, 0x01, 0x36, 0x69, 0x01, 0x02, 0x36, 0x7F, 0x01, 0x03, 0x36, 0x89, 0x01, 0x04, 0x36,
+	 0xC1, 0x01, 0x05, 0x36, 0xBF, 0x01, 0x06, 0x36, 0xF1, 0x01, 0x07, 0x36, 0xBB, 0x01, 0x08, 0x36,
+	 0x8A, 0x01, 0x09, 0x36, 0x0C, 0x00, 0x0A, 0x36, 0x0D, 0x00, 0x0B, 0x36, 0x0E, 0x00, 0x0C, 0x36,
+	 0x17, 0x00, 0x0D, 0x36, 0x0D, 0x00, 0x0E, 0x36, 0x1D, 0x00, 0x0F, 0x36, 0x41, 0x00, 0x02, 0x60,
+	 0x00, 0x64, 0x08, 0x00, 0x04, 0x60, 0x00, 0x64, 0x05, 0x00, 0x00, 0x60, 0x01, 0x64, 0x02, 0x00,
+	 0x20, 0x60, 0x00, 0x64, 0x32, 0x45, 0xB4, 0x85, 0x45, 0x52, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF,
+	 0xB2, 0x60, 0xD0, 0x63, 0x06, 0x60, 0x0B, 0xFD, 0x62, 0xFF, 0xFF, 0xFF, 0x1A, 0xFF, 0x00, 0x67,
+	 0x23, 0x58, 0xFF, 0xFF, 0x3F, 0x40, 0x02, 0x2B, 0x15, 0x00, 0x88, 0xFF, 0xBA, 0x60, 0x98, 0x71,
+	 0x8D, 0xE2, 0x01, 0x11, 0x09, 0x00, 0x71, 0x40, 0x80, 0x27, 0xFB, 0x01, 0x88, 0xE2, 0xBA, 0x60,
+	 0xD0, 0x64, 0x03, 0xFB, 0x8D, 0xFF, 0x11, 0x00, 0x8D, 0xFF, 0x90, 0x60, 0x00, 0xE8, 0xB1, 0x60,
+	 0xED, 0x63, 0x04, 0x00, 0x91, 0x60, 0x00, 0xE8, 0xB2, 0x60, 0xB6, 0x63, 0x2A, 0xE8, 0x06, 0x60,
+	 0x0B, 0xFD, 0xFF, 0xFF, 0x62, 0xFF, 0xFF, 0xFF, 0x1A, 0xFF, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF,
+	 0xD2, 0xF3, 0xFF, 0xFF, 0xEF, 0xB4, 0xD2, 0xFB, 0xAD, 0x4F, 0xFD, 0xB4, 0xA0, 0x5D, 0xD0, 0x60,
+	 0x00, 0xE8, 0x2A, 0xE8, 0xD9, 0x60, 0xFE, 0x64, 0x32, 0x45, 0xA4, 0x85, 0x45, 0x52, 0x99, 0xFF,
+	 0xA5, 0x4F, 0xFF, 0xB4, 0x07, 0xFB, 0x98, 0xFF, 0xA4, 0x60, 0x7C, 0x63, 0x06, 0x60, 0x0B, 0xFD,
+	 0x62, 0xFF, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x30, 0x44, 0x02, 0xA8, 0x00, 0xE1, 0x07, 0x02,
+	 0x62, 0xFF, 0x63, 0xFF, 0x64, 0xFF, 0x65, 0xFF, 0x66, 0xFF, 0xBF, 0xFE, 0xA1, 0xFF, 0x82, 0xFF,
+	 0x88, 0xFF, 0x6C, 0x40, 0x41, 0xFF, 0xC4, 0xE2, 0x43, 0xFF, 0x5C, 0x49, 0x08, 0xE1, 0xA3, 0x60,
+	 0x30, 0x78, 0xFF, 0xFF, 0x30, 0x44, 0x02, 0xA8, 0x00, 0xE1, 0x02, 0x02, 0xA1, 0xFF, 0xFF, 0xFF,
+	 0x82, 0xFF, 0x88, 0xFF, 0xA8, 0xE2, 0x01, 0x70, 0xAD, 0xF1, 0x00, 0x6B, 0x89, 0xFF, 0x64, 0x54,
+	 0x88, 0xFF, 0x9F, 0xFE, 0x02, 0x05, 0x64, 0x44, 0x60, 0x54, 0xCD, 0xE2, 0xC2, 0x64, 0x3A, 0xDB,
+	 0xBC, 0xFF, 0xB5, 0xFF, 0x1D, 0xFF, 0x26, 0x44, 0x02, 0xB4, 0x40, 0x46, 0x3C, 0x44, 0x00, 0xBC,
+	 0xFF, 0xFF, 0x06, 0x03, 0x27, 0x40, 0x26, 0x22, 0x03, 0x00, 0x02, 0x64, 0x31, 0xFB, 0xC0, 0xFE,
+	 0x27, 0x44, 0x20, 0x2A, 0x04, 0x00, 0xA0, 0x60, 0x00, 0xEA, 0xB0, 0x60, 0x00, 0xEA, 0x5C, 0x44,
+	 0x27, 0x44, 0x18, 0xB4, 0x40, 0x47, 0x00, 0xE1, 0xA4, 0xE2, 0xC4, 0xE2, 0x47, 0xFF, 0xB6, 0xFF,
+	 0xB7, 0xFF, 0xB4, 0xFF, 0x32, 0xF1, 0x08, 0x29, 0x09, 0x00, 0x64, 0x40, 0x07, 0x22, 0x06, 0x00,
+	 0x43, 0xFF, 0x27, 0x44, 0x10, 0xBC, 0x40, 0x47, 0x00, 0x64, 0x32, 0xFB, 0x31, 0x41, 0x3C, 0x44,
+	 0x01, 0xB1, 0x00, 0xBC, 0x0A, 0x02, 0x09, 0x03, 0x32, 0xF3, 0x00, 0x7C, 0x01, 0xB4, 0xFF, 0xFF,
+	 0x04, 0x03, 0x32, 0xF9, 0x02, 0x64, 0x31, 0xFB, 0xC0, 0xFE, 0xC8, 0x60, 0x09, 0x7D, 0x00, 0x60,
+	 0x00, 0x6B, 0x00, 0x64, 0x33, 0xFB, 0x0C, 0x60, 0x16, 0x64, 0xA0, 0xD7, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x00, 0xE1, 0x30, 0x40, 0x02, 0x36, 0xA1, 0xFF, 0x83, 0xFF, 0x8D, 0xFF, 0x5C, 0x44, 0x5C, 0x43,
+	 0x5C, 0x42, 0x5C, 0x41, 0x5C, 0x40, 0xAC, 0xFF, 0xAD, 0xFF, 0xE7, 0xE1, 0xB3, 0x60, 0xBE, 0x78,
+	 0xFF, 0xFF, 0x30, 0x44, 0x02, 0xA8, 0x00, 0xE1, 0x03, 0x02, 0x28, 0xE2, 0x40, 0xFF, 0xA1, 0xFF,
+	 0x84, 0xFF, 0xC1, 0x60, 0x6B, 0x64, 0x40, 0x42, 0xB7, 0x60, 0xA2, 0x64, 0x40, 0x40, 0x9C, 0xF3,
+	 0x65, 0xFB, 0x0F, 0x60, 0xF6, 0x63, 0xA9, 0xF3, 0xBD, 0xDB, 0x00, 0x60, 0x9A, 0x64, 0xBD, 0xDB,
+	 0x02, 0x64, 0xBD, 0xDB, 0x04, 0x64, 0xA3, 0xDB, 0x5C, 0x49, 0x0A, 0x64, 0x40, 0x4B, 0x5C, 0x5C,
+	 0x01, 0x60, 0x39, 0xE2, 0x04, 0x60, 0x00, 0x7A, 0x89, 0xFF, 0x03, 0x60, 0xFF, 0x73, 0x88, 0xFF,
+	 0xB7, 0x60, 0xA2, 0x78, 0xFF, 0xFF, 0x30, 0x44, 0x02, 0xA8, 0x00, 0xE1, 0x06, 0x02, 0x40, 0xFF,
+	 0x42, 0xFF, 0x43, 0xFF, 0x44, 0xFF, 0x45, 0xFF, 0xA1, 0xFF, 0x88, 0xFF, 0x85, 0xFF, 0x21, 0xE1,
+	 0x5C, 0x40, 0xC3, 0x60, 0x53, 0x78, 0xFF, 0xFF, 0xA2, 0xFF, 0x30, 0x44, 0x02, 0xA8, 0x00, 0xE1,
+	 0x01, 0x02, 0xA1, 0xFF, 0x86, 0xFF, 0x88, 0xFF, 0x5C, 0x46, 0x5C, 0x49, 0x5C, 0x40, 0xE1, 0x60,
+	 0x58, 0x4F, 0x7A, 0x78, 0xFF, 0xFF, 0xD0, 0x60, 0x58, 0x4F, 0xA2, 0x78, 0xFF, 0xFF, 0xEB, 0x60,
+	 0x58, 0x4F, 0x10, 0x78, 0xFF, 0xFF, 0xDD, 0x60, 0x58, 0x4F, 0xF5, 0x78, 0xFF, 0xFF, 0x1F, 0xE1,
+	 0xA3, 0xFF, 0xCA, 0x60, 0x7E, 0x78, 0xFF, 0xFF, 0x03, 0xE1, 0xA3, 0xFF, 0x1E, 0x60, 0x9E, 0x63,
+	 0x17, 0xFD, 0xAE, 0xFF, 0xF0, 0x60, 0xC7, 0x78, 0xFF, 0xFF, 0x86, 0xF3, 0x87, 0xF3, 0xDC, 0x81,
+	 0x00, 0x7C, 0x01, 0x00, 0x00, 0xFA, 0x60, 0x46, 0xFE, 0x63, 0xA3, 0xD8, 0xFE, 0x1F, 0xCD, 0x81,
+	 0xD8, 0x84, 0xF8, 0x02, 0x86, 0xF3, 0x87, 0xF5, 0xDC, 0x81, 0x80, 0x67, 0x40, 0x4A, 0x05, 0x18,
+	 0x2A, 0x43, 0x02, 0xFC, 0x5F, 0x8A, 0x00, 0xF4, 0xFA, 0x01, 0x2E, 0x58, 0xFF, 0xFF, 0x88, 0xF3,
+	 0x06, 0x61, 0x00, 0x7C, 0x60, 0x46, 0xFE, 0x63, 0xA3, 0xD8, 0xFE, 0x1F, 0xCD, 0x81, 0x66, 0x44,
+	 0xD8, 0x84, 0xF8, 0x02, 0x09, 0x60, 0x2B, 0x7C, 0x88, 0xF3, 0x06, 0x61, 0x60, 0x46, 0x01, 0x63,
+	 0x76, 0xF8, 0x00, 0xFC, 0x63, 0x47, 0x06, 0xFA, 0x76, 0xF8, 0x03, 0x64, 0x77, 0xFA, 0xDF, 0x83,
+	 0x66, 0x44, 0xCD, 0x81, 0x02, 0xA6, 0xF4, 0x02, 0x2E, 0x58, 0xFF, 0xFF, 0x8A, 0xF1, 0x89, 0xF3,
+	 0x7C, 0x63, 0x8C, 0xFB, 0x60, 0x46, 0x01, 0xFC, 0xDC, 0x84, 0xD0, 0x80, 0x00, 0xFA, 0xFA, 0x04,
+	 0x8D, 0xFB, 0x60, 0x46, 0x00, 0x64, 0x00, 0xFA, 0x63, 0x44, 0x80, 0x7F, 0x01, 0xFA, 0x8A, 0xF3,
+	 0x89, 0xF1, 0xDC, 0x84, 0xD0, 0x84, 0x8B, 0xFB, 0x03, 0x60, 0x26, 0x61, 0xB5, 0x60, 0x58, 0x4D,
+	 0x8C, 0x78, 0xFF, 0xFF, 0x66, 0x44, 0x2E, 0xFB, 0x82, 0xFF, 0x40, 0x42, 0x87, 0xFF, 0x8B, 0xF3,
+	 0x93, 0xFB, 0x00, 0x64, 0x40, 0x50, 0x63, 0xFF, 0x60, 0xFF, 0x66, 0xFF, 0x65, 0xFF, 0x64, 0xFF,
+	 0x61, 0xFF, 0x62, 0xFF, 0x49, 0x60, 0x02, 0xE1, 0x52, 0x60, 0x02, 0xE1, 0x5C, 0x60, 0x02, 0xE1,
+	 0x65, 0x60, 0x02, 0xE1, 0x6B, 0x60, 0x02, 0xE1, 0x76, 0x60, 0x02, 0xE1, 0x41, 0x60, 0x02, 0xE1,
+	 0x04, 0x64, 0x0F, 0x60, 0x9F, 0xFB, 0x1F, 0x60, 0x64, 0x64, 0x7F, 0xFB, 0x2D, 0xFF, 0x0A, 0x61,
+	 0x41, 0x4B, 0x09, 0x60, 0x08, 0x61, 0xB5, 0x60, 0x58, 0x4D, 0x8C, 0x78, 0xFF, 0xFF, 0xF0, 0x67,
+	 0x0E, 0xFA, 0x1F, 0x60, 0x0A, 0x64, 0x0F, 0x60, 0x93, 0xFB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64,
+	 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0x2B, 0x41, 0x4D, 0x8B, 0xFF, 0xFF, 0xEA, 0x02, 0x09, 0x61,
+	 0x41, 0x4B, 0x09, 0x60, 0x08, 0x61, 0xB5, 0x60, 0x58, 0x4D, 0x8C, 0x78, 0xFF, 0xFF, 0x1E, 0x60,
+	 0xFE, 0x64, 0x0F, 0x60, 0x93, 0xFB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF,
+	 0x2B, 0xFF, 0x2B, 0x41, 0x4D, 0x8B, 0xFF, 0xFF, 0xEC, 0x02, 0x1E, 0x60, 0xB0, 0x78, 0xFF, 0xFF,
+	 0x00, 0xEA, 0x00, 0xEB, 0x50, 0x60, 0x03, 0xEA, 0x51, 0x60, 0x13, 0xEA, 0x52, 0x60, 0x30, 0xEA,
+	 0x53, 0x60, 0x40, 0xEA, 0x54, 0x60, 0x52, 0xEA, 0x55, 0x60, 0x6D, 0xEA, 0x56, 0x60, 0x71, 0xEA,
+	 0x57, 0x60, 0x8B, 0xEA, 0x58, 0x60, 0x47, 0xEA, 0x59, 0x60, 0xA0, 0xEA, 0x5A, 0x60, 0xB2, 0xEA,
+	 0x5B, 0x60, 0xC1, 0xEA, 0x5C, 0x60, 0xD7, 0xEA, 0x5D, 0x60, 0xEB, 0xEA, 0x5E, 0x60, 0xA0, 0xEA,
+	 0x50, 0x60, 0x36, 0xEB, 0x51, 0x60, 0x37, 0xEB, 0x52, 0x60, 0x20, 0xEB, 0x53, 0x60, 0xE4, 0xEB,
+	 0x54, 0x60, 0x34, 0xEB, 0x55, 0x60, 0x58, 0xEB, 0x56, 0x60, 0x48, 0xEB, 0x57, 0x60, 0xD0, 0xEB,
+	 0x58, 0x60, 0xC3, 0xEB, 0x59, 0x60, 0xFC, 0xEB, 0x5A, 0x60, 0x34, 0xEB, 0x5B, 0x60, 0x58, 0xEB,
+	 0x5C, 0x60, 0xC0, 0xEB, 0x5D, 0x60, 0xD0, 0xEB, 0x5E, 0x60, 0x91, 0xEB, 0x00, 0xEA, 0x00, 0xEB,
+	 0xE0, 0x60, 0x02, 0xEA, 0xE0, 0x60, 0x03, 0xEB, 0xA0, 0x60, 0x00, 0xEB, 0xB0, 0x60, 0x00, 0xEB,
+	 0xAB, 0x48, 0x40, 0x3B, 0x01, 0x00, 0xFC, 0x01, 0x00, 0xEB, 0x03, 0x60, 0x02, 0x64, 0xA0, 0xDB,
+	 0x0F, 0x64, 0x60, 0x7F, 0xA0, 0x5A, 0x80, 0x60, 0x00, 0xEA, 0xA0, 0x60, 0x00, 0xEA, 0xD1, 0x60,
+	 0x00, 0xEA, 0x24, 0x44, 0xFF, 0xB4, 0x04, 0xFB, 0x50, 0x60, 0x00, 0x64, 0x05, 0xFB, 0x10, 0x60,
+	 0x10, 0x75, 0xF0, 0x60, 0xC7, 0x78, 0xFF, 0xFF, 0x3F, 0x40, 0x40, 0x26, 0x40, 0x00, 0x05, 0x60,
+	 0xF9, 0xF1, 0x42, 0x60, 0x08, 0x64, 0x09, 0x60, 0x19, 0x63, 0x64, 0x40, 0x01, 0x2B, 0x04, 0x00,
+	 0x42, 0x60, 0x09, 0x64, 0x0A, 0x60, 0x19, 0x63, 0x18, 0x60, 0x22, 0xFB, 0x04, 0x60, 0x00, 0xBC,
+	 0x18, 0x60, 0x1E, 0xFB, 0x18, 0x60, 0x1D, 0xFD, 0x1D, 0x60, 0x19, 0x63, 0x18, 0x60, 0x21, 0xFD,
+	 0x80, 0x60, 0x1C, 0x64, 0x3F, 0x40, 0x01, 0x2A, 0x02, 0x00, 0x60, 0x60, 0x1C, 0x64, 0x18, 0x60,
+	 0x23, 0xFB, 0x18, 0x60, 0x1F, 0xFB, 0x18, 0x60, 0x22, 0xF3, 0xA0, 0x50, 0xA0, 0x50, 0x0B, 0x60,
+	 0xF8, 0x63, 0xA3, 0xD1, 0x30, 0x60, 0x38, 0x61, 0xA1, 0xD3, 0xF8, 0xA3, 0x90, 0x84, 0xA2, 0xDB,
+	 0xA3, 0xD1, 0x59, 0xD3, 0x06, 0xA3, 0x90, 0x84, 0xA2, 0xDB, 0xA3, 0xD1, 0x59, 0xD3, 0xFE, 0xA3,
+	 0x90, 0x84, 0xA2, 0xDB, 0xA3, 0xD1, 0x59, 0xD3, 0xFF, 0xFF, 0x90, 0x84, 0xA2, 0xDB, 0x80, 0x60,
+	 0x58, 0xEC, 0x80, 0x60, 0x00, 0xED, 0x80, 0x60, 0x80, 0xEE, 0x40, 0xEC, 0x00, 0xED, 0x00, 0xEE,
+	 0xC0, 0x60, 0x59, 0xEC, 0xC0, 0x60, 0x07, 0xED, 0xC0, 0x60, 0x8F, 0xEE, 0xAD, 0x4F, 0xFA, 0xB4,
+	 0xA0, 0x5D, 0x00, 0xF3, 0x28, 0xFB, 0x40, 0x44, 0xA2, 0x60, 0xE8, 0x7C, 0x20, 0xF9, 0x1D, 0x60,
+	 0xD0, 0x7C, 0x21, 0xF9, 0x1D, 0x60, 0xE6, 0x7C, 0x22, 0xF9, 0x1E, 0x60, 0x44, 0x7C, 0x23, 0xF9,
+	 0x1E, 0x60, 0x55, 0x7C, 0x24, 0xF9, 0x1E, 0x60, 0x7F, 0x7C, 0x25, 0xF9, 0x1E, 0x60, 0x90, 0x7C,
+	 0x26, 0xF9, 0xD0, 0x60, 0x00, 0xE8, 0x28, 0xE8, 0x44, 0x60, 0x01, 0xE6, 0x00, 0x64, 0x40, 0x52,
+	 0x10, 0x60, 0x04, 0xE6, 0x08, 0x60, 0x06, 0x63, 0xFD, 0x60, 0x0C, 0x65, 0x5B, 0xD3, 0xBF, 0xD1,
+	 0x0C, 0x18, 0xC3, 0x83, 0xD4, 0x80, 0xC3, 0x83, 0xF9, 0x02, 0xFA, 0xA3, 0xA3, 0xD3, 0x02, 0x60,
+	 0x00, 0x65, 0xF9, 0xA0, 0xFC, 0xA0, 0x09, 0x05, 0x00, 0x05, 0x21, 0x60, 0x00, 0x65, 0x3F, 0x43,
+	 0x21, 0x60, 0x00, 0x65, 0xC0, 0x60, 0x8F, 0xEE, 0x08, 0x00, 0x02, 0x60, 0x00, 0x65, 0x00, 0x60,
+	 0x00, 0x64, 0x18, 0xFB, 0x3F, 0x43, 0x11, 0x60, 0x10, 0xE6, 0xB7, 0x84, 0x40, 0x5F, 0x30, 0x60,
+	 0x20, 0x63, 0x3F, 0x40, 0x20, 0x27, 0x06, 0x00, 0x0F, 0x60, 0xFF, 0x64, 0xBD, 0xDB, 0x0F, 0x60,
+	 0xF0, 0x64, 0x03, 0x00, 0x0F, 0x64, 0xBD, 0xDB, 0x00, 0x64, 0xA3, 0xDB, 0x00, 0x60, 0x30, 0xE2,
+	 0x00, 0x60, 0x50, 0xE2, 0x00, 0x60, 0x79, 0xE2, 0x00, 0x60, 0x90, 0xE2, 0x01, 0x60, 0xD0, 0xE2,
+	 0x01, 0x60, 0xF0, 0xE2, 0x01, 0x60, 0xB0, 0xE2, 0x13, 0x64, 0xAD, 0xFB, 0x01, 0x60, 0x67, 0x64,
+	 0x37, 0xFB, 0x00, 0x60, 0x50, 0x64, 0x36, 0xFB, 0x09, 0x60, 0x2A, 0x64, 0x98, 0xFB, 0x82, 0xFF,
+	 0x92, 0xFF, 0x5C, 0x41, 0x5C, 0x46, 0x5C, 0x47, 0x00, 0xE1, 0xA4, 0x60, 0x7C, 0x63, 0x0C, 0x60,
+	 0x16, 0x64, 0xA0, 0xDD, 0x87, 0xFF, 0x97, 0xFF, 0x0C, 0x60, 0x02, 0x64, 0x40, 0x5A, 0x06, 0xA4,
+	 0x40, 0x5B, 0x5C, 0x5E, 0x13, 0x60, 0x52, 0xF3, 0x64, 0xFB, 0x3F, 0x40, 0x01, 0x22, 0x03, 0x00,
+	 0x80, 0x60, 0x37, 0x7C, 0x02, 0x00, 0x80, 0x60, 0x27, 0x7C, 0x16, 0x60, 0x55, 0xF9, 0x00, 0x60,
+	 0x80, 0x64, 0x89, 0xFB, 0x02, 0x60, 0x80, 0x66, 0x22, 0x60, 0x22, 0x64, 0x77, 0x60, 0x77, 0x63,
+	 0x00, 0xFA, 0x01, 0xFC, 0x00, 0xF0, 0x01, 0xF0, 0xD0, 0x80, 0xD3, 0x80, 0x1E, 0x02, 0x1D, 0x02,
+	 0x06, 0x60, 0x80, 0x65, 0x45, 0x4A, 0xAA, 0x46, 0x00, 0xFC, 0x01, 0xFA, 0xAA, 0x46, 0x00, 0xF0,
+	 0x2A, 0x41, 0x50, 0x65, 0xD3, 0x80, 0xCD, 0x84, 0x13, 0x03, 0x0A, 0x60, 0x80, 0x65, 0x45, 0x4A,
+	 0xAA, 0x46, 0x00, 0xFC, 0x01, 0xFA, 0xAA, 0x46, 0x00, 0xF0, 0x65, 0x41, 0xC8, 0x65, 0xD3, 0x80,
+	 0xCD, 0x84, 0x06, 0x03, 0x12, 0x60, 0x7F, 0x64, 0x03, 0x00, 0x10, 0x65, 0x02, 0x60, 0x7F, 0x64,
+	 0x65, 0x43, 0x86, 0xFD, 0x0F, 0x60, 0x5B, 0xFD, 0x07, 0x61, 0xC5, 0x81, 0xE1, 0x85, 0xD4, 0x84,
+	 0x8A, 0xFB, 0xDC, 0x84, 0x88, 0xFB, 0x0C, 0xA4, 0x87, 0xFB, 0x0F, 0x60, 0x5C, 0xFB, 0x1E, 0x60,
+	 0x58, 0x4E, 0xD3, 0x78, 0xFF, 0xFF, 0x1E, 0x60, 0x58, 0x4E, 0xB9, 0x78, 0xFF, 0xFF, 0x3F, 0x40,
+	 0x40, 0x26, 0x05, 0x00, 0x18, 0x60, 0x20, 0xF3, 0x5A, 0xD1, 0xA0, 0x50, 0xA4, 0x52, 0x00, 0x64,
+	 0x0A, 0x60, 0x7E, 0xFB, 0x1E, 0x60, 0xF2, 0x78, 0xFF, 0xFF, 0x5C, 0x51, 0x3F, 0x41, 0xA5, 0x4C,
+	 0x50, 0x37, 0x0B, 0x00, 0x01, 0xB9, 0x41, 0x5F, 0xB5, 0x60, 0x55, 0xE0, 0x05, 0x60, 0xF9, 0xF1,
+	 0xC0, 0x67, 0x90, 0x84, 0x3F, 0x40, 0x01, 0x26, 0xA0, 0x50, 0x06, 0x60, 0x08, 0xF3, 0x01, 0x60,
+	 0x01, 0x65, 0x01, 0x60, 0x02, 0x7C, 0xD4, 0x80, 0xD0, 0x80, 0x01, 0x03, 0x10, 0x02, 0x5A, 0xD1,
+	 0x5A, 0xD3, 0x3E, 0x60, 0x00, 0x66, 0xE0, 0x87, 0x40, 0x4A, 0xF7, 0x60, 0x8C, 0x61, 0x64, 0x44,
+	 0xC8, 0x84, 0x0C, 0x63, 0xAA, 0x46, 0x58, 0xD0, 0xAA, 0x46, 0x59, 0xD8, 0xFB, 0x1F, 0x08, 0x60,
+	 0x00, 0x63, 0xFA, 0x60, 0x00, 0x65, 0xBD, 0xD3, 0xA3, 0xD3, 0x02, 0xA8, 0xD4, 0x80, 0x07, 0x02,
+	 0x06, 0x02, 0x49, 0x60, 0x4C, 0x61, 0x3C, 0x60, 0x00, 0x66, 0x41, 0x4B, 0x03, 0x00, 0x24, 0x60,
+	 0x84, 0x78, 0xFF, 0xFF, 0x2B, 0x41, 0x49, 0x60, 0x94, 0x7C, 0xD1, 0x80, 0xA1, 0xD2, 0x25, 0x05,
+	 0x59, 0xD0, 0x60, 0x45, 0x59, 0xD2, 0x44, 0x47, 0xE0, 0x87, 0x40, 0x4A, 0x59, 0xD2, 0x59, 0x8B,
+	 0x40, 0x4C, 0x08, 0x60, 0x00, 0x63, 0xBE, 0xD3, 0xBD, 0xD1, 0xEC, 0x18, 0xD4, 0x80, 0xEA, 0x18,
+	 0x03, 0x03, 0xC3, 0x83, 0xC3, 0x83, 0xF7, 0x01, 0x67, 0x44, 0xC0, 0x84, 0xE0, 0x85, 0x2C, 0x44,
+	 0xD4, 0x80, 0x63, 0x41, 0x01, 0x06, 0x65, 0x44, 0xC8, 0x83, 0xAA, 0x46, 0x59, 0xD1, 0x27, 0xD8,
+	 0x5A, 0x87, 0xFC, 0x1F, 0xAA, 0x46, 0x2B, 0x41, 0xD5, 0x01, 0x49, 0x60, 0x94, 0x61, 0x41, 0x4B,
+	 0x2B, 0x41, 0x49, 0x60, 0x94, 0x7C, 0xD1, 0x80, 0xA1, 0xD2, 0x27, 0x05, 0x59, 0xD0, 0x60, 0x45,
+	 0x59, 0xD2, 0x44, 0x47, 0xE0, 0x87, 0x40, 0x4A, 0x59, 0xD2, 0x59, 0x8B, 0x40, 0x4C, 0x08, 0x60,
+	 0x00, 0x63, 0xBE, 0xD3, 0xBD, 0xD1, 0xEC, 0x18, 0xD4, 0x80, 0xEA, 0x18, 0x03, 0x03, 0xC3, 0x83,
+	 0xC3, 0x83, 0xF7, 0x01, 0x04, 0xA3, 0xA3, 0xD1, 0x5A, 0x88, 0x2C, 0x43, 0xD3, 0x80, 0xFF, 0xFF,
+	 0x01, 0x06, 0x64, 0x43, 0xCF, 0x83, 0xAA, 0x46, 0x60, 0xFE, 0x28, 0xD1, 0x5E, 0x88, 0x27, 0xD8,
+	 0x5A, 0x87, 0xFB, 0x1F, 0x20, 0xFE, 0xAA, 0x46, 0xD3, 0x01, 0xFA, 0x60, 0x39, 0x65, 0x24, 0x60,
+	 0x58, 0x4D, 0x97, 0x78, 0xFF, 0xFF, 0x03, 0x03, 0xBE, 0xD1, 0x07, 0x60, 0xED, 0xF9, 0x07, 0x60,
+	 0xED, 0xF3, 0x20, 0x60, 0x00, 0x7C, 0x60, 0x40, 0x10, 0x2A, 0x05, 0x00, 0x07, 0x60, 0xEC, 0xF9,
+	 0x07, 0x60, 0xEB, 0xF9, 0x12, 0x00, 0x04, 0xB0, 0x10, 0x60, 0x55, 0xF3, 0x0E, 0x03, 0x02, 0xBC,
+	 0xA2, 0xDB, 0x07, 0x60, 0xF5, 0xFB, 0x10, 0x60, 0xE8, 0xF3, 0x10, 0x60, 0xAC, 0xF3, 0x02, 0xBD,
+	 0x02, 0xBC, 0xA2, 0xDB, 0x65, 0x44, 0x10, 0x60, 0xE8, 0xFB, 0x07, 0x60, 0xED, 0xF3, 0x31, 0x41,
+	 0x60, 0x40, 0x20, 0x2A, 0x40, 0xB9, 0x40, 0x26, 0x03, 0x00, 0x60, 0x40, 0x01, 0x26, 0x80, 0xB9,
+	 0x41, 0x51, 0xFA, 0x60, 0x3A, 0x65, 0x24, 0x60, 0x58, 0x4D, 0x97, 0x78, 0xFF, 0xFF, 0x03, 0x02,
+	 0x23, 0x60, 0x1D, 0x78, 0xFF, 0xFF, 0x5B, 0xD3, 0xF8, 0x60, 0x3F, 0x65, 0x00, 0x7F, 0xE0, 0x84,
+	 0xE0, 0x84, 0x10, 0x60, 0xF7, 0xF3, 0xE0, 0x9C, 0xA4, 0x84, 0xB0, 0x84, 0xA2, 0xDB, 0x5A, 0xD3,
+	 0xFF, 0xFF, 0xA4, 0x84, 0xB0, 0x84, 0xA2, 0xDB, 0xBD, 0xD3, 0xFF, 0xFF, 0x60, 0x47, 0x00, 0x7F,
+	 0xE0, 0x84, 0xE0, 0x84, 0x10, 0x60, 0xFA, 0xF3, 0xE0, 0x9C, 0xA4, 0x84, 0xB0, 0x84, 0xA2, 0xDB,
+	 0x5A, 0xD3, 0xFF, 0xFF, 0xA4, 0x84, 0xB0, 0x84, 0xA2, 0xDB, 0x21, 0x60, 0xFA, 0x61, 0xA3, 0xD3,
+	 0xFF, 0xFF, 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0xE0, 0x84, 0xA1, 0xD3, 0xE0, 0x9C, 0xA4, 0x84,
+	 0xB0, 0x84, 0xA1, 0xDB, 0xA3, 0xD3, 0xFF, 0xFF, 0x00, 0x7F, 0xE0, 0x84, 0xE0, 0x84, 0x59, 0xD3,
+	 0xE0, 0x9C, 0xA4, 0x84, 0xB0, 0x84, 0xA1, 0xDB, 0x11, 0x60, 0x00, 0xF3, 0xFF, 0xFF, 0xA4, 0x84,
+	 0xB0, 0x84, 0xA2, 0xDB, 0x5A, 0xD3, 0xFF, 0xFF, 0xA4, 0x84, 0xB0, 0x84, 0xA2, 0xDB, 0x11, 0x60,
+	 0x03, 0xF3, 0xFF, 0xFF, 0xA4, 0x84, 0xB0, 0x84, 0xA2, 0xDB, 0x5A, 0xD3, 0xFF, 0xFF, 0xA4, 0x84,
+	 0xB0, 0x84, 0xA2, 0xDB, 0x11, 0x60, 0x06, 0xF3, 0xFF, 0xFF, 0xA4, 0x84, 0xB0, 0x84, 0xA2, 0xDB,
+	 0x5A, 0xD3, 0xFF, 0xFF, 0xA4, 0x84, 0xB0, 0x84, 0xA2, 0xDB, 0xA3, 0xD3, 0xFF, 0xFF, 0x60, 0x47,
+	 0x00, 0x7F, 0xE0, 0x84, 0xE0, 0x84, 0x11, 0x60, 0x09, 0xF3, 0xE0, 0x9C, 0xA4, 0x84, 0xB0, 0x84,
+	 0xA2, 0xDB, 0x5A, 0xD3, 0xFF, 0xFF, 0xA4, 0x84, 0xB0, 0x84, 0xA2, 0xDB, 0x11, 0x60, 0x0C, 0xF3,
+	 0xFF, 0xFF, 0xA4, 0x84, 0xB0, 0x84, 0xA2, 0xDB, 0x5A, 0xD3, 0xFF, 0xFF, 0xA4, 0x84, 0xB0, 0x84,
+	 0xA2, 0xDB, 0x11, 0x60, 0x0F, 0xF3, 0xFF, 0xFF, 0xA4, 0x84, 0xB0, 0x84, 0xA2, 0xDB, 0x5A, 0xD3,
+	 0xFF, 0xFF, 0xA4, 0x84, 0xB0, 0x84, 0xA2, 0xDB, 0x02, 0xA3, 0xA3, 0xD3, 0xF8, 0x60, 0x3F, 0x65,
+	 0x00, 0x7F, 0xE0, 0x84, 0xE0, 0x84, 0x11, 0x60, 0x12, 0xF3, 0xE0, 0x9C, 0xA4, 0x84, 0xB0, 0x84,
+	 0xA2, 0xDB, 0x5A, 0xD3, 0xFF, 0xFF, 0xA4, 0x84, 0xB0, 0x84, 0xA2, 0xDB, 0xBD, 0xD3, 0xFF, 0xFF,
+	 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0xE0, 0x84, 0x11, 0x60, 0x15, 0xF3, 0xE0, 0x9C, 0xA4, 0x84,
+	 0xB0, 0x84, 0xA2, 0xDB, 0x5A, 0xD3, 0xFF, 0xFF, 0xA4, 0x84, 0xB0, 0x84, 0xA2, 0xDB, 0x22, 0x60,
+	 0x30, 0x61, 0xA3, 0xD3, 0xFF, 0xFF, 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0xE0, 0x84, 0xA1, 0xD3,
+	 0xE0, 0x9C, 0xA4, 0x84, 0xB0, 0x84, 0xA1, 0xDB, 0xA3, 0xD3, 0xFF, 0xFF, 0x00, 0x7F, 0xE0, 0x84,
+	 0xE0, 0x84, 0x59, 0xD3, 0xE0, 0x9C, 0xA4, 0x84, 0xB0, 0x84, 0xA1, 0xDB, 0x11, 0x60, 0x1B, 0xF3,
+	 0xFF, 0xFF, 0xA4, 0x84, 0xB0, 0x84, 0xA2, 0xDB, 0x5A, 0xD3, 0xFF, 0xFF, 0xA4, 0x84, 0xB0, 0x84,
+	 0xA2, 0xDB, 0x11, 0x60, 0x1E, 0xF3, 0xFF, 0xFF, 0xA4, 0x84, 0xB0, 0x84, 0xA2, 0xDB, 0x5A, 0xD3,
+	 0xFF, 0xFF, 0xA4, 0x84, 0xB0, 0x84, 0xA2, 0xDB, 0x11, 0x60, 0x21, 0xF3, 0xFF, 0xFF, 0xA4, 0x84,
+	 0xB0, 0x84, 0xA2, 0xDB, 0x5A, 0xD3, 0xFF, 0xFF, 0xA4, 0x84, 0xB0, 0x84, 0xA2, 0xDB, 0xA3, 0xD3,
+	 0xFF, 0xFF, 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0xE0, 0x84, 0x11, 0x60, 0x24, 0xF3, 0xE0, 0x9C,
+	 0xA4, 0x84, 0xB0, 0x84, 0xA2, 0xDB, 0x5A, 0xD3, 0xFF, 0xFF, 0xA4, 0x84, 0xB0, 0x84, 0xA2, 0xDB,
+	 0x11, 0x60, 0x27, 0xF3, 0xFF, 0xFF, 0xA4, 0x84, 0xB0, 0x84, 0xA2, 0xDB, 0x5A, 0xD3, 0xFF, 0xFF,
+	 0xA4, 0x84, 0xB0, 0x84, 0xA2, 0xDB, 0x11, 0x60, 0x2A, 0xF3, 0xFF, 0xFF, 0xA4, 0x84, 0xB0, 0x84,
+	 0xA2, 0xDB, 0x5A, 0xD3, 0xFF, 0xFF, 0xA4, 0x84, 0xB0, 0x84, 0xA2, 0xDB, 0x00, 0x60, 0x6A, 0x63,
+	 0x22, 0x60, 0x56, 0x61, 0x21, 0x60, 0xEA, 0x64, 0x58, 0xD1, 0x59, 0xD9, 0xFD, 0x1F, 0x11, 0x60,
+	 0x33, 0xF3, 0xFF, 0xFF, 0x18, 0xAC, 0xA2, 0xDB, 0x5A, 0xD3, 0xFF, 0xFF, 0x18, 0xAC, 0xA2, 0xDB,
+	 0x11, 0x60, 0x37, 0xF3, 0xFF, 0xFF, 0x18, 0xAC, 0xA2, 0xDB, 0x11, 0x60, 0x39, 0xF3, 0xFF, 0xFF,
+	 0x18, 0xAC, 0xA2, 0xDB, 0x11, 0x60, 0x40, 0xF3, 0xFF, 0xFF, 0x18, 0xAC, 0xA2, 0xDB, 0x11, 0x60,
+	 0x42, 0xF3, 0xFF, 0xFF, 0x18, 0xAC, 0xA2, 0xDB, 0x11, 0x60, 0x4E, 0xF3, 0xFF, 0xFF, 0x18, 0xAC,
+	 0xA2, 0xDB, 0x5A, 0xD3, 0xFF, 0xFF, 0x18, 0xAC, 0xA2, 0xDB, 0x11, 0x60, 0x52, 0xF3, 0xFF, 0xFF,
+	 0x18, 0xAC, 0xA2, 0xDB, 0x11, 0x60, 0x54, 0xF3, 0xFF, 0xFF, 0x18, 0xAC, 0xA2, 0xDB, 0x11, 0x60,
+	 0x5B, 0xF3, 0xFF, 0xFF, 0x18, 0xAC, 0xA2, 0xDB, 0x11, 0x60, 0x5D, 0xF3, 0xFF, 0xFF, 0x18, 0xAC,
+	 0xA2, 0xDB, 0xFA, 0x60, 0x2C, 0x65, 0x24, 0x60, 0x58, 0x4D, 0x97, 0x78, 0xFF, 0xFF, 0x0E, 0x03,
+	 0x63, 0x45, 0x23, 0x60, 0xF0, 0x63, 0x06, 0x61, 0xA5, 0xD1, 0xDA, 0x85, 0x64, 0x44, 0x0F, 0xB4,
+	 0xBD, 0xDB, 0x64, 0x47, 0x0F, 0xB4, 0xCD, 0x81, 0xBD, 0xDB, 0xF6, 0x02, 0xFA, 0x60, 0x30, 0x65,
+	 0x24, 0x60, 0x58, 0x4D, 0x97, 0x78, 0xFF, 0xFF, 0x14, 0x03, 0xBD, 0xD3, 0x63, 0x46, 0x24, 0x60,
+	 0x88, 0x63, 0x12, 0x60, 0x53, 0xFB, 0xDA, 0x85, 0xBD, 0xDB, 0x0E, 0x61, 0xA6, 0xD1, 0xDA, 0x86,
+	 0x64, 0x44, 0xFF, 0xB4, 0xA5, 0xDB, 0xDA, 0x85, 0x64, 0x47, 0xFF, 0xB4, 0xCD, 0x81, 0xBD, 0xDB,
+	 0xF5, 0x02, 0xFA, 0x60, 0x31, 0x65, 0x24, 0x60, 0x58, 0x4D, 0x97, 0x78, 0xFF, 0xFF, 0x22, 0x03,
+	 0xBD, 0xD3, 0x12, 0x60, 0x71, 0xFB, 0x5A, 0x81, 0x12, 0x60, 0x80, 0xFB, 0x5A, 0x82, 0x12, 0x60,
+	 0x8F, 0xFB, 0x5A, 0x83, 0x12, 0x60, 0x9E, 0xFB, 0x5A, 0x84, 0x0E, 0x61, 0xBD, 0xD1, 0xBD, 0xD5,
+	 0x64, 0x44, 0xFF, 0xB4, 0x21, 0xDB, 0x5A, 0x81, 0x64, 0x47, 0xFF, 0xB4, 0x22, 0xDB, 0x5A, 0x82,
+	 0x66, 0x44, 0xFF, 0xB4, 0x23, 0xDB, 0x5A, 0x83, 0x66, 0x47, 0xFF, 0xB4, 0x24, 0xDB, 0xCD, 0x81,
+	 0x5A, 0x84, 0xEC, 0x02, 0xFA, 0x60, 0x47, 0x65, 0x24, 0x60, 0x58, 0x4D, 0x97, 0x78, 0xFF, 0xFF,
+	 0x11, 0x03, 0x63, 0x45, 0x25, 0x60, 0x5A, 0x63, 0xA5, 0xD1, 0xDA, 0x85, 0xBD, 0xD9, 0x02, 0x61,
+	 0xA5, 0xD1, 0xDA, 0x85, 0x64, 0x47, 0x00, 0x7E, 0xBD, 0xDB, 0x64, 0x44, 0x00, 0x7E, 0xCD, 0x81,
+	 0xBD, 0xDB, 0xF6, 0x02, 0xFA, 0x60, 0x2E, 0x65, 0x24, 0x60, 0x58, 0x4D, 0x97, 0x78, 0xFF, 0xFF,
+	 0x1F, 0x03, 0x63, 0x46, 0xFC, 0xA3, 0xA3, 0xD3, 0x24, 0x60, 0x08, 0x63, 0xCC, 0x84, 0xE8, 0x84,
+	 0xCC, 0x81, 0x00, 0x36, 0x0D, 0x00, 0x63, 0x45, 0xA6, 0xD3, 0x5A, 0xD1, 0xDA, 0x86, 0xFF, 0xB4,
+	 0xE0, 0x84, 0xC4, 0x84, 0x5C, 0x90, 0xBD, 0xD9, 0xFD, 0x02, 0xCD, 0x81, 0x66, 0x42, 0xF4, 0x02,
+	 0x66, 0x42, 0x5A, 0xD3, 0x24, 0x60, 0x48, 0x65, 0xBD, 0xDB, 0xD7, 0x80, 0xFF, 0xFF, 0xFC, 0x02,
+	 0x25, 0x60, 0x6E, 0x61, 0xFA, 0x60, 0x46, 0x65, 0x24, 0x60, 0x58, 0x4D, 0x97, 0x78, 0xFF, 0xFF,
+	 0x01, 0x03, 0xA1, 0xDD, 0xD9, 0x81, 0xFA, 0x60, 0x2F, 0x65, 0x24, 0x60, 0x58, 0x4D, 0x97, 0x78,
+	 0xFF, 0xFF, 0x01, 0x03, 0xA1, 0xDD, 0xD9, 0x81, 0xFA, 0x60, 0x3E, 0x65, 0x24, 0x60, 0x58, 0x4D,
+	 0x97, 0x78, 0xFF, 0xFF, 0x01, 0x03, 0xA1, 0xDD, 0xD9, 0x81, 0xFA, 0x60, 0x3F, 0x65, 0x24, 0x60,
+	 0x58, 0x4D, 0x97, 0x78, 0xFF, 0xFF, 0x01, 0x03, 0xA1, 0xDD, 0xD9, 0x81, 0xFA, 0x60, 0x40, 0x65,
+	 0x24, 0x60, 0x58, 0x4D, 0x97, 0x78, 0xFF, 0xFF, 0x01, 0x03, 0xA1, 0xDD, 0xD9, 0x81, 0xFA, 0x60,
+	 0x3B, 0x65, 0x24, 0x60, 0x58, 0x4D, 0x97, 0x78, 0xFF, 0xFF, 0x01, 0x03, 0xA1, 0xDD, 0xFA, 0x60,
+	 0x48, 0x65, 0x24, 0x60, 0x58, 0x4D, 0x97, 0x78, 0xFF, 0xFF, 0x10, 0x03, 0xBD, 0xD3, 0x25, 0x60,
+	 0xCA, 0x61, 0x0E, 0xB4, 0xBD, 0xD1, 0xA1, 0xDB, 0x64, 0x47, 0x0E, 0xB4, 0xA3, 0xD1, 0x59, 0xDB,
+	 0x64, 0x44, 0x0E, 0xB4, 0x59, 0xDB, 0x64, 0x47, 0x0E, 0xB4, 0x59, 0xDB, 0xFA, 0x60, 0x29, 0x65,
+	 0x24, 0x60, 0x58, 0x4D, 0x97, 0x78, 0xFF, 0xFF, 0x07, 0x03, 0x04, 0xA3, 0xA3, 0xD3, 0x20, 0x60,
+	 0x00, 0x65, 0xB4, 0x84, 0x10, 0x60, 0x29, 0xFB, 0xFA, 0x60, 0x2A, 0x65, 0x24, 0x60, 0x58, 0x4D,
+	 0x97, 0x78, 0xFF, 0xFF, 0x39, 0x03, 0x04, 0xA3, 0xBD, 0xD1, 0x10, 0x60, 0xCD, 0xF3, 0x64, 0x41,
+	 0x64, 0x5E, 0xA2, 0xDB, 0x64, 0x47, 0x5A, 0xD3, 0x60, 0x5C, 0x64, 0x5F, 0xA2, 0xDB, 0x10, 0x60,
+	 0xE3, 0xF3, 0xFF, 0x60, 0xC0, 0xB5, 0x61, 0x40, 0x80, 0x27, 0x05, 0x00, 0xE9, 0x87, 0x3F, 0xB4,
+	 0xB4, 0x84, 0xA2, 0xDB, 0x1E, 0x00, 0x65, 0x44, 0xA2, 0xDB, 0x10, 0x60, 0xDC, 0xF1, 0xE1, 0x80,
+	 0xF9, 0x81, 0xE1, 0x80, 0xF9, 0x84, 0xFF, 0x60, 0x80, 0xB4, 0xC0, 0x9C, 0xA2, 0xD9, 0x10, 0x60,
+	 0xDF, 0xF1, 0xFF, 0xFF, 0xC0, 0x9C, 0xA2, 0xD9, 0x10, 0x60, 0xE6, 0xF1, 0x01, 0x7E, 0x60, 0x47,
+	 0x60, 0x41, 0x64, 0x44, 0xFE, 0x60, 0x00, 0xB5, 0xC1, 0x84, 0x01, 0x60, 0xFF, 0xB4, 0xB4, 0x84,
+	 0xA2, 0xDB, 0xDB, 0x83, 0x11, 0x60, 0x62, 0xFD, 0xFA, 0x60, 0x2B, 0x65, 0x24, 0x60, 0x58, 0x4D,
+	 0x97, 0x78, 0xFF, 0xFF, 0x07, 0x03, 0x04, 0xA3, 0xBD, 0xD3, 0x10, 0x60, 0xD0, 0xFB, 0xA3, 0xD3,
+	 0x10, 0x60, 0x94, 0xFB, 0xFA, 0x60, 0x3C, 0x65, 0x24, 0x60, 0x58, 0x4D, 0x97, 0x78, 0xFF, 0xFF,
+	 0x1F, 0x03, 0xA3, 0xD3, 0xFC, 0x60, 0xFC, 0x65, 0xA4, 0x84, 0x60, 0x5C, 0x00, 0x7E, 0xC0, 0x60,
+	 0x00, 0xA0, 0x60, 0x43, 0x07, 0x04, 0x10, 0x60, 0xD4, 0xF3, 0xFF, 0xFF, 0x03, 0x60, 0xFF, 0xB4,
+	 0x3C, 0x94, 0xA2, 0xDB, 0x21, 0x60, 0x30, 0x61, 0x64, 0x44, 0x00, 0x7F, 0xC0, 0xA0, 0x60, 0x47,
+	 0x07, 0x04, 0x60, 0x43, 0xA1, 0xD3, 0xFF, 0xFF, 0x03, 0x60, 0xFF, 0xB4, 0x3C, 0x94, 0xA1, 0xDB,
+	 0xB8, 0xFE, 0xB9, 0xFE, 0xBA, 0xFE, 0xBB, 0xFE, 0xBD, 0xFE, 0xBF, 0xFE, 0x15, 0x60, 0xCB, 0xF3,
+	 0x12, 0x63, 0x60, 0x40, 0x01, 0x27, 0x04, 0x00, 0x0B, 0x60, 0xEA, 0x62, 0x5A, 0xDF, 0xFE, 0x1F,
+	 0x1F, 0x60, 0xC8, 0x78, 0xFF, 0xFF, 0x08, 0x60, 0x06, 0x63, 0xBE, 0xD3, 0xBD, 0xD1, 0x07, 0x18,
+	 0xD4, 0x80, 0x05, 0x18, 0x03, 0x03, 0xC3, 0x83, 0xC3, 0x83, 0xF7, 0x01, 0xDB, 0x83, 0x00, 0xBC,
+	 0x2D, 0x58, 0xFF, 0xFF, 0x86, 0xFD, 0xB0, 0x26, 0x00, 0x00, 0x06, 0x00, 0x10, 0xFD, 0x32, 0x01,
+	 0x00, 0x00, 0x02, 0x00, 0x14, 0xFD, 0x94, 0x2B, 0x00, 0x00, 0x0A, 0x00, 0x41, 0xFA, 0x46, 0x23,
+	 0x00, 0x00, 0x22, 0x00, 0x42, 0xFA, 0x68, 0x23, 0x00, 0x00, 0x22, 0x00, 0x43, 0xFA, 0x8A, 0x23,
+	 0x00, 0x00, 0x22, 0x00, 0x44, 0xFA, 0xAC, 0x23, 0x00, 0x00, 0x22, 0x00, 0x45, 0xFA, 0xCE, 0x23,
+	 0x00, 0x00, 0x22, 0x00, 0x25, 0xFD, 0x62, 0x01, 0x00, 0x00, 0x02, 0x00,
+
+};  /* fw_image_3_data */
+
+static const hcf_8 fw_image_4_data[] = {
+	 0x6C, 0x40, 0xA1, 0xFF, 0x98, 0xFF, 0x80, 0x3E, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x41, 0xFF, 0x33, 0xF3, 0x32, 0x11, 0x31, 0x18, 0x40, 0x64, 0x3A, 0xDB, 0x1C, 0x00, 0xFF, 0xFF,
+	 0xC4, 0xE2, 0x27, 0x44, 0x20, 0x2A, 0x01, 0x00, 0xFF, 0xFF, 0x42, 0x64, 0x3A, 0xDB, 0x23, 0x00,
+	 0x41, 0xFF, 0xA3, 0x60, 0x34, 0x78, 0xE2, 0xFE, 0x40, 0x49, 0x02, 0x60, 0x01, 0xE1, 0x1D, 0x00,
+	 0x44, 0xFF, 0x1B, 0x09, 0x29, 0x44, 0x10, 0x2A, 0x04, 0x74, 0xCD, 0xE2, 0x10, 0x65, 0x0B, 0x00,
+	 0xA4, 0x60, 0x49, 0x78, 0xA4, 0xE2, 0x29, 0x44, 0x20, 0x2A, 0x0D, 0x00, 0x20, 0xAC, 0xEC, 0x01,
+	 0xA4, 0x60, 0x49, 0x78, 0x46, 0xFF, 0xB4, 0x84, 0x40, 0x49, 0xA1, 0xFF, 0xFF, 0xFF, 0x80, 0x3E,
+	 0xA4, 0x60, 0x49, 0x78, 0xFF, 0xFF, 0x62, 0xFF, 0x08, 0xE1, 0xA1, 0xFF, 0x98, 0xFF, 0x80, 0x3E,
+	 0xAA, 0x60, 0xF4, 0x78, 0x4C, 0x4E, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xAA, 0x60, 0xFB, 0x78, 0x44, 0xE2, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xC4, 0xE2, 0x84, 0xFF, 0x22, 0x58, 0x82, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xA4, 0x60, 0xB9, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xA1, 0xFF, 0xFF, 0xFF, 0xE1, 0x01, 0xFF, 0xFF,
+	 0x10, 0x29, 0xFA, 0x01, 0xE4, 0xE2, 0xAA, 0x60, 0xB0, 0x78, 0x94, 0xF3, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xC1, 0x60, 0x35, 0x78, 0x64, 0xE2, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xAA, 0x60, 0x97, 0x78, 0xAC, 0xE2, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x80, 0x29, 0xE2, 0x01, 0xAA, 0x60, 0xF3, 0x78, 0x47, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xB4, 0x60, 0xEF, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xB5, 0x60, 0x1C, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xB3, 0x60, 0x8B, 0x78, 0x42, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xB3, 0x60, 0xBE, 0x78, 0x43, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xB3, 0x60, 0xBE, 0x78, 0x44, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xB6, 0x60, 0x9D, 0x78, 0x45, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xB3, 0x60, 0xC1, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x00, 0x60, 0x83, 0x64, 0x80, 0x29, 0x09, 0xFB, 0xB4, 0x60, 0xB7, 0x78, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x98, 0xFF, 0xC2, 0x60, 0x69, 0x78, 0x40, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xC1, 0x60, 0xE0, 0x78, 0x98, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xC0, 0x60, 0x3D, 0x78, 0x98, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xBF, 0x60, 0xB8, 0x78, 0x98, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xB7, 0x60, 0x96, 0x78, 0x98, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xA1, 0xFF, 0x98, 0xFF, 0x83, 0x3E, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xC3, 0x60, 0x58, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x01,
+	 0x41, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x01,
+	 0x42, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x01,
+	 0xB0, 0xFF, 0xB1, 0xFF, 0x40, 0xFF, 0x43, 0xFF, 0xC3, 0x60, 0x53, 0x78, 0x44, 0xFF, 0xFF, 0x01,
+	 0xC3, 0x60, 0x58, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x01,
+	 0x1C, 0x60, 0x28, 0x78, 0x45, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x01,
+	 0xC3, 0x60, 0x53, 0x78, 0x84, 0xE2, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x01,
+	 0xC3, 0x60, 0x52, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x01,
+	 0xCA, 0x60, 0x76, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xE8, 0x60, 0x6C, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x42, 0xFF, 0xA1, 0xFF, 0xFF, 0xFF, 0x85, 0x3E, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xCA, 0x60, 0x7E, 0x78, 0x24, 0xE2, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xE6, 0x60, 0x2A, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xCA, 0x60, 0x7E, 0x78, 0x44, 0xE2, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xCA, 0x60, 0x7E, 0x78, 0x84, 0xE2, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xCA, 0x60, 0x7E, 0x78, 0x47, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xF0, 0x60, 0x9F, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xF0, 0x60, 0xCA, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xF0, 0x60, 0xE3, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xF0, 0x60, 0xC7, 0x78, 0x28, 0xE2, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xF0, 0x60, 0xC7, 0x78, 0x44, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xF0, 0x60, 0xC7, 0x78, 0x45, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xF0, 0x60, 0xC7, 0x78, 0x46, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x00, 0x60, 0x87, 0x64, 0x80, 0x29, 0x09, 0xFB, 0x47, 0xFF, 0xF0, 0x60, 0xC7, 0x78, 0xFF, 0xFF,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x43, 0xF7, 0xA7, 0xFF, 0x41, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0xA2, 0x60, 0x00, 0x78, 0x47, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x2E, 0x60, 0x54, 0x63, 0x20, 0x44, 0xBD, 0xDB, 0x21, 0x44, 0xBD, 0xDB, 0x22, 0x44, 0xBD, 0xDB,
+	 0x23, 0x44, 0xBD, 0xDB, 0x24, 0x44, 0xBD, 0xDB, 0x25, 0x44, 0xBD, 0xDB, 0x26, 0x44, 0xBD, 0xDB,
+	 0x27, 0x44, 0xBD, 0xDB, 0x28, 0x44, 0xBD, 0xDB, 0x29, 0x44, 0xBD, 0xDB, 0x2A, 0x44, 0xBD, 0xDB,
+	 0x2B, 0x44, 0xBD, 0xDB, 0x2C, 0x44, 0xBD, 0xDB, 0x2D, 0x44, 0xBD, 0xDB, 0x2E, 0x44, 0xBD, 0xDB,
+	 0x2F, 0x44, 0xBD, 0xDB, 0x17, 0x60, 0x24, 0xFD, 0x2F, 0x60, 0x74, 0x63, 0x17, 0x60, 0x25, 0xFD,
+	 0x30, 0x44, 0x17, 0x60, 0x26, 0xFB, 0x31, 0x44, 0x17, 0x60, 0x27, 0xFB, 0x32, 0x44, 0x17, 0x60,
+	 0x28, 0xFB, 0x33, 0x44, 0x17, 0x60, 0x29, 0xFB, 0x81, 0xFF, 0x91, 0xFF, 0x58, 0x51, 0x44, 0x00,
+	 0x82, 0xFF, 0x92, 0xFF, 0x58, 0x51, 0x40, 0x00, 0x83, 0xFF, 0x93, 0xFF, 0x58, 0x51, 0x3C, 0x00,
+	 0x84, 0xFF, 0x94, 0xFF, 0x58, 0x51, 0x38, 0x00, 0x85, 0xFF, 0x95, 0xFF, 0x58, 0x51, 0x34, 0x00,
+	 0x86, 0xFF, 0x96, 0xFF, 0x58, 0x51, 0x30, 0x00, 0x87, 0xFF, 0x97, 0xFF, 0x58, 0x51, 0x2C, 0x00,
+	 0x80, 0xFF, 0x90, 0xFF, 0x99, 0xFF, 0x17, 0x60, 0x24, 0xF1, 0x30, 0x44, 0x64, 0x43, 0xBD, 0xDB,
+	 0x31, 0x44, 0xBD, 0xDB, 0x32, 0x44, 0xBD, 0xDB, 0x33, 0x44, 0xBD, 0xDB, 0x34, 0x44, 0xBD, 0xDB,
+	 0x35, 0x44, 0xBD, 0xDB, 0x36, 0x44, 0xBD, 0xDB, 0x37, 0x44, 0xBD, 0xDB, 0x38, 0x44, 0xBD, 0xDB,
+	 0x39, 0x44, 0xBD, 0xDB, 0x3A, 0x44, 0xBD, 0xDB, 0x3B, 0x44, 0xBD, 0xDB, 0x3C, 0x44, 0xBD, 0xDB,
+	 0x3D, 0x44, 0xBD, 0xDB, 0x3E, 0x44, 0xBD, 0xDB, 0x3F, 0x44, 0xBD, 0xDB, 0xEE, 0x60, 0x48, 0x64,
+	 0x0A, 0xFB, 0x40, 0x21, 0xFE, 0x01, 0x70, 0x00, 0x42, 0x50, 0x40, 0x53, 0x17, 0x60, 0x25, 0xF3,
+	 0xFF, 0xFF, 0x40, 0x52, 0x33, 0x44, 0x32, 0x42, 0xA2, 0xDB, 0xDA, 0x82, 0xA2, 0xDD, 0xDA, 0x83,
+	 0x65, 0x44, 0xBD, 0xDB, 0x61, 0x44, 0xBD, 0xDB, 0x66, 0x44, 0xBD, 0xDB, 0xBD, 0xD9, 0x30, 0x44,
+	 0xBD, 0xDB, 0x99, 0xFF, 0xA4, 0x4C, 0xBD, 0xDB, 0xA5, 0x4C, 0xBD, 0xDB, 0xA0, 0x4C, 0xBD, 0xDB,
+	 0xA1, 0x4C, 0xBD, 0xDB, 0x98, 0xFF, 0x17, 0x60, 0x25, 0xFD, 0x17, 0x60, 0x26, 0xF3, 0xFF, 0xFF,
+	 0x40, 0x50, 0x17, 0x60, 0x28, 0xF3, 0xFF, 0xFF, 0x40, 0x52, 0x17, 0x60, 0x29, 0xF3, 0xFF, 0xFF,
+	 0x40, 0x53, 0x31, 0x41, 0x17, 0x60, 0x27, 0xF3, 0xFF, 0xFF, 0x40, 0x51, 0x17, 0x60, 0x24, 0xF3,
+	 0xFF, 0xFF, 0x60, 0x43, 0x20, 0x44, 0xBD, 0xDB, 0x21, 0x44, 0xBD, 0xDB, 0x22, 0x44, 0xBD, 0xDB,
+	 0x23, 0x44, 0xBD, 0xDB, 0x24, 0x44, 0xBD, 0xDB, 0x25, 0x44, 0xBD, 0xDB, 0x26, 0x44, 0xBD, 0xDB,
+	 0x27, 0x44, 0xBD, 0xDB, 0x28, 0x44, 0xBD, 0xDB, 0x29, 0x44, 0xBD, 0xDB, 0x2A, 0x44, 0xBD, 0xDB,
+	 0x2B, 0x44, 0xBD, 0xDB, 0x2C, 0x44, 0xBD, 0xDB, 0x2D, 0x44, 0xBD, 0xDB, 0x2E, 0x44, 0xBD, 0xDB,
+	 0x2F, 0x44, 0xBD, 0xDB, 0x17, 0x60, 0x24, 0xFD, 0x61, 0x58, 0xFF, 0xFF, 0x28, 0x60, 0x76, 0x63,
+	 0xA3, 0xD3, 0x33, 0x5C, 0x02, 0xA4, 0xBD, 0xDB, 0xFE, 0xB4, 0xE0, 0x85, 0xC4, 0x85, 0x47, 0xD9,
+	 0x34, 0x44, 0x5B, 0xDB, 0x44, 0xF3, 0x5B, 0xDB, 0xA1, 0xFF, 0xFF, 0xFF, 0x87, 0x3E, 0xFF, 0x01,
+	 0x82, 0xE1, 0x80, 0xFF, 0x90, 0xFF, 0x88, 0xFF, 0xA1, 0xFF, 0xFF, 0xFF, 0x87, 0x3E, 0x41, 0xFF,
+	 0x00, 0x60, 0x03, 0xE1, 0x21, 0x46, 0x66, 0x45, 0x00, 0xF4, 0x2E, 0x44, 0x09, 0xFA, 0x6A, 0x61,
+	 0x7F, 0x60, 0xFE, 0x63, 0xA1, 0xFF, 0x9A, 0xFF, 0x05, 0x11, 0x0A, 0x00, 0x00, 0xF4, 0x01, 0xF2,
+	 0x17, 0x18, 0x7A, 0x61, 0x02, 0x25, 0x04, 0x00, 0x6C, 0x44, 0x7A, 0xDA, 0xFB, 0x1C, 0xF6, 0x11,
+	 0xD9, 0x81, 0x41, 0xFF, 0x02, 0x1C, 0x00, 0xF4, 0xDA, 0x82, 0x41, 0xFF, 0xC9, 0x81, 0xCB, 0x83,
+	 0x6C, 0x44, 0x5A, 0xDA, 0x02, 0x1C, 0x00, 0xF4, 0x81, 0xF2, 0x6C, 0x44, 0x5A, 0xDA, 0xCB, 0x83,
+	 0x02, 0x74, 0x02, 0x60, 0x04, 0xE1, 0x80, 0x60, 0x00, 0x61, 0x5D, 0x93, 0xB5, 0xFF, 0x98, 0xFF,
+	 0x26, 0x44, 0xFD, 0xB4, 0x84, 0xBC, 0x40, 0x46, 0x65, 0x46, 0x00, 0x64, 0x23, 0xFA, 0x3F, 0xFC,
+	 0x63, 0x47, 0x0A, 0x63, 0x0F, 0xFC, 0x00, 0xF4, 0x08, 0xFA, 0xCB, 0xFE, 0x18, 0xE1, 0x44, 0xFF,
+	 0xA1, 0xFF, 0x98, 0xFF, 0x80, 0x3E, 0xE2, 0xFE, 0x03, 0x04, 0xA3, 0x60, 0x99, 0x78, 0xFF, 0xFF,
+	 0xE0, 0xFE, 0x03, 0x04, 0xA3, 0x60, 0xAF, 0x78, 0xFF, 0xFF, 0xE1, 0xFE, 0x07, 0x05, 0x9F, 0xFE,
+	 0x03, 0x04, 0x18, 0x60, 0x24, 0x78, 0xFF, 0xFF, 0x43, 0xFF, 0xA9, 0x01, 0xD3, 0xF3, 0xFF, 0xFF,
+	 0x01, 0xB4, 0xFF, 0xFF, 0x08, 0x24, 0x15, 0x00, 0x29, 0x44, 0x08, 0x26, 0xE1, 0x01, 0x72, 0x44,
+	 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0x94, 0xF3, 0xE8, 0x85, 0xFF, 0xB7,
+	 0xE0, 0x84, 0xE0, 0x84, 0xB4, 0x85, 0x73, 0x44, 0xD4, 0x84, 0x10, 0x65, 0xD4, 0x80, 0xFF, 0xFF,
+	 0x37, 0x04, 0x3F, 0x40, 0x40, 0x26, 0x09, 0x00, 0x18, 0x60, 0x1C, 0xF3, 0x5A, 0xD1, 0xA0, 0x50,
+	 0xA4, 0x52, 0x5A, 0xD3, 0x5A, 0xD1, 0xA0, 0x50, 0xA4, 0x50, 0xBC, 0xF3, 0xD2, 0xF1, 0x01, 0xA8,
+	 0x07, 0xA8, 0x0A, 0x03, 0x09, 0x03, 0x64, 0x40, 0x01, 0x26, 0x09, 0x00, 0x18, 0x60, 0x07, 0xF3,
+	 0xFF, 0xFF, 0x01, 0xB4, 0xFF, 0xFF, 0x03, 0x02, 0xAD, 0x4F, 0xFA, 0xB4, 0xA0, 0x5D, 0xAE, 0x4F,
+	 0x02, 0xBC, 0x00, 0x7F, 0xA0, 0x5E, 0x3F, 0x40, 0x02, 0x2B, 0x11, 0x00, 0x0C, 0x60, 0x00, 0x62,
+	 0x00, 0x60, 0x71, 0x7C, 0x00, 0x60, 0xB1, 0x65, 0x1A, 0x60, 0x58, 0x4D, 0x88, 0x78, 0xFF, 0xFF,
+	 0x08, 0xE1, 0x62, 0xFF, 0xA3, 0xFF, 0xFF, 0xFF, 0xA2, 0xFF, 0x02, 0x60, 0x08, 0xE1, 0xBD, 0xFE,
+	 0x97, 0x01, 0x21, 0x46, 0x01, 0x5D, 0x5C, 0x62, 0x03, 0xE1, 0x44, 0xFF, 0xA1, 0xFF, 0x9A, 0xFF,
+	 0x7A, 0xDC, 0x7A, 0xDC, 0x7A, 0xDC, 0x62, 0x62, 0x7A, 0xDC, 0x7A, 0xDC, 0x7A, 0xDC, 0xA1, 0xFF,
+	 0x5A, 0xDC, 0x12, 0xE1, 0x02, 0x60, 0x01, 0xE1, 0xA1, 0xFF, 0x98, 0xFF, 0x80, 0x3E, 0x28, 0x40,
+	 0x40, 0x2B, 0x03, 0x00, 0x29, 0x40, 0x20, 0x27, 0x97, 0x00, 0xC8, 0x74, 0xCD, 0xE2, 0x29, 0x44,
+	 0x08, 0xBC, 0x40, 0x49, 0x44, 0xFF, 0x05, 0xE1, 0x28, 0x40, 0x08, 0x2A, 0x07, 0x00, 0x28, 0x40,
+	 0x48, 0x36, 0x04, 0x00, 0xD2, 0xF3, 0xFF, 0xFF, 0x02, 0xBC, 0xD2, 0xFB, 0x29, 0x44, 0xFF, 0x60,
+	 0xEF, 0x65, 0x24, 0x89, 0x40, 0x27, 0x3F, 0x00, 0x00, 0x00, 0x29, 0x40, 0x80, 0x27, 0x0B, 0x00,
+	 0x07, 0x61, 0xA1, 0xFF, 0xCD, 0x81, 0x04, 0x25, 0x61, 0x00, 0x87, 0x4C, 0xFB, 0x02, 0xF3, 0x60,
+	 0xA0, 0x64, 0x80, 0x4C, 0x07, 0x00, 0xA1, 0xFF, 0x9C, 0x4C, 0x9C, 0x4C, 0x9C, 0x4D, 0x05, 0x60,
+	 0xCF, 0x64, 0x80, 0x4C, 0x28, 0x40, 0x40, 0x2B, 0x05, 0x00, 0x29, 0x40, 0x20, 0x27, 0x02, 0x00,
+	 0x15, 0x60, 0x6F, 0x6B, 0x04, 0x25, 0x4A, 0x00, 0x30, 0x64, 0x3A, 0xDB, 0x44, 0xFF, 0x04, 0x25,
+	 0x45, 0x00, 0x04, 0x60, 0x00, 0x65, 0x25, 0x44, 0xB4, 0x84, 0x80, 0x4E, 0x2D, 0x41, 0x04, 0x25,
+	 0x3D, 0x00, 0x61, 0x4C, 0x00, 0x60, 0x8A, 0x65, 0xC5, 0x81, 0x61, 0x54, 0xA1, 0xFF, 0xFF, 0xFF,
+	 0x04, 0x25, 0x34, 0x00, 0x67, 0x4E, 0x07, 0x64, 0x1C, 0xFB, 0x00, 0xE1, 0x02, 0x60, 0x05, 0xE1,
+	 0xA1, 0xFF, 0x98, 0xFF, 0x80, 0x3E, 0x28, 0x40, 0x40, 0x27, 0x0A, 0x00, 0x1C, 0x65, 0x28, 0x40,
+	 0xA4, 0x36, 0x14, 0x65, 0x23, 0x44, 0xC4, 0x84, 0x28, 0x40, 0x08, 0x2A, 0x0C, 0x00, 0x07, 0x00,
+	 0x23, 0x44, 0x1C, 0xA4, 0x29, 0x40, 0x20, 0x27, 0x02, 0x00, 0x11, 0x60, 0x0F, 0x6B, 0x3C, 0x46,
+	 0x98, 0xF0, 0x23, 0x44, 0xC4, 0x84, 0x06, 0x74, 0x25, 0x5C, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84,
+	 0xE0, 0x84, 0xB0, 0x84, 0x80, 0x4C, 0x9C, 0x4C, 0x44, 0xFF, 0x18, 0xE1, 0x0A, 0x64, 0x1E, 0x74,
+	 0x02, 0x60, 0x05, 0xE1, 0x40, 0x40, 0xA1, 0xFF, 0x98, 0xFF, 0x80, 0x3E, 0xC4, 0xE2, 0x27, 0x44,
+	 0x20, 0x2A, 0x06, 0x00, 0x42, 0x64, 0x3A, 0xDB, 0x67, 0x4C, 0xB0, 0x60, 0x80, 0x78, 0xFF, 0xFF,
+	 0x41, 0x64, 0x3A, 0xDB, 0x62, 0xFF, 0x08, 0xE1, 0xE2, 0xFE, 0x72, 0x52, 0xA1, 0xFF, 0x98, 0xFF,
+	 0x80, 0x3E, 0xA1, 0xFF, 0x98, 0xFF, 0x80, 0x3E, 0x28, 0x40, 0x08, 0x27, 0x66, 0x01, 0x3C, 0x46,
+	 0x8B, 0xFF, 0x84, 0x60, 0x00, 0xE4, 0x0F, 0x60, 0x92, 0x64, 0xC9, 0x60, 0x58, 0x4F, 0x10, 0x78,
+	 0xFF, 0xFF, 0x3F, 0xF2, 0x00, 0x60, 0x18, 0x70, 0x18, 0x71, 0x20, 0x72, 0x00, 0xF2, 0x60, 0x53,
+	 0x20, 0xE1, 0xA1, 0xFF, 0x88, 0x75, 0x00, 0xE1, 0xFF, 0xFF, 0x60, 0x50, 0x75, 0x44, 0x12, 0x71,
+	 0x6E, 0x72, 0x81, 0x75, 0xFF, 0xFF, 0x88, 0xFF, 0xA3, 0x60, 0xB5, 0x78, 0xFF, 0xFF, 0x32, 0xF3,
+	 0x08, 0x29, 0x0A, 0x00, 0x60, 0x40, 0x07, 0x22, 0x07, 0x00, 0xFE, 0xB4, 0x32, 0xFB, 0x27, 0x44,
+	 0x10, 0xBC, 0xF7, 0xB4, 0x40, 0x47, 0x43, 0xFF, 0x00, 0x64, 0x3A, 0xDB, 0x01, 0x60, 0x08, 0xE1,
+	 0x31, 0x40, 0x01, 0x2A, 0x04, 0x00, 0x00, 0x64, 0x33, 0xFB, 0x01, 0x60, 0x0A, 0xE1, 0xE5, 0xFE,
+	 0x27, 0x05, 0x9F, 0xFE, 0x12, 0x05, 0x31, 0x41, 0x40, 0x2A, 0x0F, 0x00, 0x07, 0x60, 0xEA, 0xF1,
+	 0xAE, 0x4C, 0x90, 0x80, 0x10, 0x2A, 0x09, 0x00, 0x7F, 0xB1, 0x07, 0x60, 0xEA, 0xFB, 0x60, 0x40,
+	 0x10, 0x2A, 0x80, 0xB9, 0x41, 0x51, 0xDF, 0xFE, 0x19, 0xFF, 0x27, 0x44, 0x10, 0x26, 0x13, 0x00,
+	 0x9F, 0xFE, 0x02, 0x04, 0x40, 0xE1, 0x06, 0x00, 0x7C, 0xE1, 0x31, 0x44, 0x01, 0x2A, 0x02, 0x00,
+	 0x04, 0x0A, 0xFD, 0xE1, 0xA1, 0xFF, 0xFF, 0xFF, 0x81, 0x3E, 0xAF, 0x60, 0x7B, 0x78, 0xFF, 0xFF,
+	 0xAA, 0x60, 0xC0, 0x78, 0xFF, 0xFF, 0x27, 0x44, 0x08, 0x26, 0xFF, 0xFF, 0xC0, 0x60, 0xEA, 0x78,
+	 0xFF, 0xFF, 0x48, 0xF3, 0x32, 0xF1, 0x00, 0x63, 0x64, 0x40, 0x07, 0x26, 0x03, 0x00, 0xA5, 0x60,
+	 0x6C, 0x78, 0xFF, 0xFF, 0x31, 0x40, 0x08, 0x26, 0xF1, 0x01, 0xCD, 0xE2, 0x84, 0xE1, 0x70, 0x41,
+	 0xAD, 0x80, 0x71, 0x40, 0x80, 0x27, 0xEA, 0x12, 0x03, 0x03, 0xC1, 0x60, 0x3B, 0x78, 0xFF, 0xFF,
+	 0xA1, 0xFF, 0xFF, 0xFF, 0xC4, 0xE2, 0x32, 0xFD, 0x60, 0x40, 0x01, 0x2A, 0xDC, 0x01, 0x3C, 0x46,
+	 0x3E, 0xF2, 0x2A, 0xF0, 0x27, 0x41, 0x44, 0x48, 0x20, 0xB9, 0x01, 0xB4, 0xF7, 0xB1, 0x0A, 0x03,
+	 0x64, 0x40, 0x08, 0x27, 0x07, 0x00, 0x0F, 0x60, 0xEE, 0x63, 0x00, 0x64, 0x45, 0xFB, 0x46, 0xFB,
+	 0xBD, 0xDB, 0xA3, 0xDB, 0xCB, 0x0A, 0xCA, 0x11, 0x41, 0x47, 0x22, 0xF2, 0xFF, 0xFF, 0x60, 0x40,
+	 0x10, 0x26, 0x04, 0x00, 0x01, 0x2A, 0x05, 0x00, 0x10, 0x2B, 0x03, 0x00, 0x29, 0x47, 0x20, 0xBF,
+	 0x40, 0x49, 0x05, 0xE1, 0x01, 0x60, 0x08, 0xE1, 0x2A, 0xE8, 0x3C, 0x46, 0x00, 0x63, 0x32, 0xFD,
+	 0x43, 0xFF, 0x0F, 0xF0, 0xFF, 0xFF, 0x64, 0x40, 0x01, 0x2A, 0x03, 0x00, 0xA8, 0x60, 0x76, 0x78,
+	 0xFF, 0xFF, 0x64, 0xF3, 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x27, 0x0E, 0x00, 0x1F, 0xF2, 0xFF, 0xFF,
+	 0x60, 0x40, 0x40, 0x2B, 0x09, 0x00, 0x15, 0x60, 0xDD, 0xF3, 0xFF, 0xFF, 0x60, 0x40, 0x02, 0x2A,
+	 0x03, 0x00, 0xA9, 0x60, 0x81, 0x78, 0xFF, 0xFF, 0x1F, 0xF2, 0xC0, 0x60, 0x00, 0x65, 0xA4, 0x9C,
+	 0x3F, 0x60, 0xCF, 0x65, 0x29, 0x44, 0xA4, 0x84, 0x30, 0x89, 0x15, 0x60, 0xD9, 0xF3, 0xFF, 0xFF,
+	 0x15, 0x60, 0xD8, 0xFB, 0x1F, 0xF2, 0x39, 0xF1, 0xE0, 0x60, 0xFF, 0xB5, 0x0A, 0x18, 0x60, 0x47,
+	 0x1F, 0xB4, 0xD0, 0x84, 0xE0, 0xA0, 0x02, 0x0D, 0x00, 0x64, 0x02, 0x00, 0x01, 0x04, 0x1F, 0x64,
+	 0x60, 0x47, 0xB4, 0x81, 0x07, 0x60, 0xEB, 0xF1, 0xFF, 0xFF, 0xB1, 0x8C, 0x29, 0x40, 0x40, 0x2B,
+	 0x10, 0x00, 0x22, 0x60, 0xC6, 0x65, 0x60, 0x47, 0x1F, 0xB4, 0xE0, 0x84, 0xE0, 0x84, 0x44, 0xD3,
+	 0x5A, 0xD1, 0x01, 0x60, 0x00, 0xE1, 0x01, 0x60, 0x09, 0x6B, 0x60, 0x4C, 0xB5, 0xFF, 0x64, 0x4C,
+	 0x14, 0x00, 0x22, 0x60, 0xC6, 0x65, 0x60, 0x47, 0x1F, 0xB4, 0xE0, 0x84, 0xE0, 0x84, 0x44, 0xD3,
+	 0x5A, 0xD1, 0x01, 0x60, 0x00, 0xE1, 0x05, 0x60, 0x69, 0x6B, 0x60, 0x4C, 0xB5, 0xFF, 0x64, 0x4C,
+	 0x7C, 0x44, 0x29, 0x40, 0x80, 0x2B, 0x67, 0x44, 0x60, 0x4C, 0x00, 0xE1, 0x84, 0xFF, 0xC1, 0x60,
+	 0x6B, 0x64, 0x40, 0x42, 0x82, 0xFF, 0x0D, 0x00, 0xE5, 0xFE, 0x03, 0x04, 0xAA, 0x60, 0xC0, 0x78,
+	 0xFF, 0xFF, 0x32, 0xF1, 0xFF, 0xFF, 0x64, 0x40, 0x07, 0x22, 0x43, 0xFF, 0xA4, 0x60, 0x7C, 0x78,
+	 0xFF, 0xFF, 0x3C, 0x44, 0x0B, 0x64, 0x3A, 0xDB, 0x01, 0x60, 0x0A, 0xE1, 0x1C, 0x42, 0x22, 0x46,
+	 0x13, 0xF2, 0xFF, 0x65, 0x60, 0x47, 0x2A, 0xF2, 0x40, 0x45, 0x40, 0x48, 0x04, 0x2B, 0x13, 0x00,
+	 0x16, 0xF2, 0x1D, 0xF2, 0x40, 0x43, 0x0F, 0xF2, 0x40, 0x4D, 0x0F, 0x64, 0x14, 0xF0, 0x35, 0xF2,
+	 0xA0, 0x82, 0x0F, 0xB4, 0xCA, 0x85, 0xD4, 0x80, 0x10, 0xF2, 0x01, 0x02, 0x2B, 0xFA, 0x27, 0x44,
+	 0x40, 0xBC, 0x40, 0x47, 0x13, 0x00, 0x17, 0xF2, 0x2C, 0xF0, 0x40, 0x43, 0x1B, 0xF2, 0x1D, 0xFA,
+	 0x40, 0x4D, 0x64, 0x40, 0x01, 0x2A, 0x02, 0x00, 0xAB, 0xFC, 0x05, 0x00, 0x28, 0x40, 0xA4, 0x36,
+	 0x02, 0x00, 0x11, 0xF2, 0x2B, 0xFA, 0x27, 0x44, 0xBF, 0xB4, 0x40, 0x47, 0xF0, 0xFE, 0xAF, 0x60,
+	 0x85, 0x78, 0xFF, 0xFF, 0x22, 0x46, 0x2C, 0xF0, 0x27, 0x44, 0xDF, 0xB4, 0x40, 0x47, 0x64, 0x40,
+	 0x01, 0x26, 0x01, 0x00, 0x01, 0x00, 0x11, 0x00, 0x2A, 0xF0, 0x01, 0x65, 0x64, 0x40, 0xA4, 0x3A,
+	 0x04, 0x65, 0x27, 0x44, 0x34, 0x87, 0x36, 0xF3, 0xFF, 0xFF, 0x60, 0x56, 0xAD, 0xE2, 0x04, 0x64,
+	 0x3A, 0xDB, 0x69, 0xE1, 0xA1, 0xFF, 0xFF, 0xFF, 0x81, 0x3E, 0x06, 0x64, 0x3A, 0xDB, 0x22, 0x46,
+	 0x01, 0x64, 0x31, 0xFB, 0xC0, 0xFE, 0xC1, 0x60, 0x44, 0x78, 0xFF, 0xFF, 0x28, 0x40, 0xC4, 0x3A,
+	 0x0C, 0x00, 0x27, 0x44, 0xFD, 0xB4, 0x40, 0x47, 0xA8, 0xE2, 0x05, 0xE1, 0x01, 0x60, 0x08, 0xE1,
+	 0x2A, 0xE8, 0x3C, 0x46, 0xA5, 0x60, 0x1C, 0x78, 0xFF, 0xFF, 0x3F, 0x40, 0x01, 0x2B, 0x05, 0x00,
+	 0x67, 0x4C, 0x01, 0x60, 0x00, 0xE1, 0x05, 0x60, 0x69, 0x6B, 0x07, 0x60, 0xEC, 0xF1, 0x1F, 0xF2,
+	 0x2A, 0xE8, 0xB0, 0x81, 0x29, 0x40, 0x40, 0x2B, 0x14, 0x00, 0x61, 0x4C, 0x22, 0x60, 0xC6, 0x65,
+	 0x61, 0x47, 0x1F, 0xB4, 0xE0, 0x84, 0xE0, 0x84, 0x44, 0xD3, 0x5A, 0xD1, 0x01, 0x60, 0x00, 0xE1,
+	 0x01, 0x60, 0x09, 0x6B, 0x60, 0x4C, 0xB5, 0xFF, 0xFF, 0x60, 0xF2, 0x64, 0x64, 0x4C, 0x40, 0x43,
+	 0x18, 0x00, 0x29, 0x47, 0x80, 0xB7, 0x34, 0x94, 0x60, 0x4C, 0x22, 0x60, 0xC6, 0x65, 0x61, 0x47,
+	 0x1F, 0xB4, 0xE0, 0x84, 0xE0, 0x84, 0x44, 0xD3, 0x5A, 0xD1, 0x01, 0x60, 0x00, 0xE1, 0x05, 0x60,
+	 0x69, 0x6B, 0x60, 0x4C, 0xB5, 0xFF, 0x64, 0x4C, 0x7C, 0x44, 0x29, 0x40, 0x80, 0x2B, 0x67, 0x44,
+	 0x60, 0x4C, 0x40, 0xE1, 0x01, 0x60, 0x08, 0xE1, 0x28, 0x45, 0xBF, 0x60, 0xFF, 0x64, 0x24, 0x88,
+	 0xC4, 0xE2, 0x08, 0x64, 0x3A, 0xDB, 0x21, 0x46, 0x2A, 0x44, 0x72, 0x45, 0x24, 0xFA, 0x94, 0xF3,
+	 0x06, 0x04, 0xE4, 0xE2, 0xDC, 0x9C, 0x29, 0x40, 0x01, 0x26, 0x64, 0x44, 0x94, 0xF9, 0x25, 0xFA,
+	 0x95, 0xF3, 0x02, 0x04, 0xDC, 0x84, 0x95, 0xFB, 0x28, 0xFA, 0x96, 0xF3, 0x02, 0x04, 0xDC, 0x84,
+	 0x96, 0xFB, 0x29, 0xFA, 0x24, 0x44, 0x04, 0x2A, 0x06, 0x00, 0x28, 0x40, 0xA4, 0x36, 0x03, 0x00,
+	 0xA7, 0x60, 0x46, 0x78, 0xFF, 0xFF, 0x94, 0xFC, 0x13, 0x60, 0x4A, 0xF1, 0x28, 0x44, 0x08, 0x2A,
+	 0x51, 0x00, 0x03, 0x2B, 0x01, 0x00, 0x4E, 0x00, 0x64, 0x40, 0x00, 0x36, 0x4B, 0x00, 0x32, 0xF2,
+	 0x2F, 0xF0, 0x50, 0xFE, 0x01, 0x2A, 0x03, 0x00, 0x01, 0x61, 0x8E, 0xF3, 0x31, 0x00, 0xD0, 0x80,
+	 0x33, 0xF2, 0x30, 0xF0, 0x34, 0xF2, 0xD0, 0x80, 0x31, 0xF0, 0xFF, 0xFF, 0xD0, 0x80, 0x60, 0x47,
+	 0x34, 0x0C, 0xFF, 0xB4, 0x15, 0x60, 0x02, 0x65, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD3, 0xFF, 0xFF,
+	 0x31, 0x18, 0x60, 0x43, 0x50, 0xFE, 0x66, 0x41, 0x32, 0xF0, 0x63, 0x46, 0x03, 0xF2, 0x61, 0x46,
+	 0xD0, 0x80, 0x33, 0xF0, 0x63, 0x46, 0x04, 0xF2, 0x61, 0x46, 0xD0, 0x80, 0x34, 0xF0, 0x63, 0x46,
+	 0x05, 0xF2, 0xFF, 0xFF, 0xD0, 0x80, 0xFF, 0xFF, 0x04, 0x0C, 0x00, 0xF2, 0x61, 0x46, 0x1A, 0x18,
+	 0xE8, 0x01, 0x06, 0xF0, 0x8E, 0xF3, 0x61, 0x46, 0x02, 0x61, 0x64, 0x40, 0x02, 0x2A, 0x12, 0x00,
+	 0xFC, 0xA0, 0xFF, 0xFF, 0x04, 0x0E, 0x61, 0x44, 0x14, 0xFA, 0x11, 0xFC, 0x0B, 0x00, 0x2C, 0xF2,
+	 0x2F, 0xFA, 0x2D, 0xF2, 0x30, 0xFA, 0x2E, 0xF2, 0x31, 0xFA, 0x1D, 0xFF, 0x26, 0x44, 0x02, 0xBC,
+	 0x40, 0x46, 0x1E, 0x00, 0x26, 0x43, 0x84, 0xBB, 0xFC, 0xB3, 0x21, 0x46, 0x01, 0x5D, 0x0F, 0xFC,
+	 0x5C, 0x46, 0x05, 0xFF, 0x27, 0x44, 0x01, 0x2A, 0x13, 0x00, 0x50, 0xFE, 0x28, 0x40, 0x08, 0x3A,
+	 0x12, 0x00, 0x2F, 0xF2, 0x30, 0xF0, 0x60, 0x43, 0x31, 0xF2, 0x22, 0x46, 0x64, 0x41, 0x2C, 0xF0,
+	 0x2D, 0xF0, 0xD3, 0x80, 0x2E, 0xF0, 0xD1, 0x80, 0xD0, 0x80, 0x27, 0x44, 0x09, 0x0C, 0x03, 0x00,
+	 0x27, 0x44, 0x06, 0x22, 0x05, 0x00, 0xB8, 0xB4, 0x40, 0x47, 0x02, 0x64, 0x31, 0xFB, 0xC0, 0xFE,
+	 0xD4, 0x64, 0x40, 0x48, 0x0D, 0x64, 0x3A, 0xDB, 0x21, 0x46, 0x1C, 0xF2, 0x00, 0xE1, 0xF0, 0xFE,
+	 0x00, 0x63, 0x28, 0x44, 0xA4, 0x36, 0x07, 0x00, 0x04, 0x2B, 0x05, 0x00, 0x30, 0xF3, 0x2D, 0x45,
+	 0xD4, 0x84, 0xCA, 0x65, 0xD4, 0x83, 0xD4, 0x64, 0x35, 0x00, 0x0F, 0x64, 0x3A, 0xDB, 0x21, 0x46,
+	 0x29, 0x40, 0x40, 0x27, 0x15, 0x00, 0x80, 0x27, 0x02, 0x00, 0xCA, 0x65, 0x01, 0x00, 0x6A, 0x65,
+	 0x1C, 0xF2, 0xFF, 0xFF, 0x04, 0x7F, 0x40, 0x45, 0x0A, 0x36, 0x70, 0x64, 0x14, 0x36, 0x38, 0x64,
+	 0x37, 0x36, 0x15, 0x64, 0x6E, 0x3A, 0x17, 0x00, 0x84, 0x7F, 0x40, 0x45, 0x0B, 0x64, 0x13, 0x00,
+	 0x1C, 0xF2, 0x1E, 0x65, 0x40, 0x45, 0x0B, 0x36, 0x1E, 0x64, 0x0F, 0x36, 0x16, 0x64, 0x0A, 0x36,
+	 0x12, 0x64, 0x0E, 0x36, 0x0E, 0x64, 0x09, 0x36, 0x0E, 0x64, 0x0D, 0x36, 0x0A, 0x64, 0x08, 0x36,
+	 0x0A, 0x64, 0x0C, 0x36, 0x0A, 0x64, 0x40, 0x4D, 0x00, 0xE1, 0xF0, 0xFE, 0x2B, 0xF2, 0xC4, 0x85,
+	 0xD4, 0x83, 0xC4, 0x64, 0x40, 0x48, 0x2F, 0xF0, 0xB0, 0xF0, 0xB1, 0xF2, 0xA1, 0xFF, 0x12, 0x74,
+	 0xCD, 0xE2, 0x80, 0x4E, 0x12, 0x74, 0x83, 0x4C, 0x12, 0x74, 0x9A, 0xFF, 0x84, 0x4C, 0x12, 0x74,
+	 0x85, 0x4C, 0x12, 0x74, 0x81, 0x4C, 0x12, 0x74, 0xA1, 0xFF, 0x98, 0xFF, 0xB1, 0x60, 0x58, 0x4F,
+	 0x00, 0x78, 0xFF, 0xFF, 0x01, 0x60, 0x18, 0xE1, 0x78, 0x44, 0x03, 0xA4, 0x35, 0xFB, 0xB1, 0x60,
+	 0x43, 0x78, 0xFF, 0xFF, 0x29, 0x44, 0xF7, 0xB4, 0x40, 0x49, 0x27, 0x44, 0x01, 0x2A, 0x05, 0x00,
+	 0xFE, 0xB4, 0x40, 0x47, 0xA5, 0x60, 0xCD, 0x78, 0xFF, 0xFF, 0x13, 0x60, 0x2E, 0xF3, 0xFF, 0xFF,
+	 0x60, 0x40, 0x02, 0x36, 0xC1, 0xFE, 0xA4, 0x60, 0x6F, 0x78, 0xFF, 0xFF, 0x28, 0x40, 0xB4, 0x3A,
+	 0x0B, 0x00, 0x27, 0x44, 0x07, 0x22, 0x05, 0x00, 0xF8, 0xB4, 0x40, 0x47, 0x02, 0x64, 0x31, 0xFB,
+	 0xC0, 0xFE, 0xA6, 0x60, 0xDD, 0x78, 0xFF, 0xFF, 0x28, 0x44, 0xD4, 0x36, 0x03, 0x00, 0xA8, 0x60,
+	 0x5D, 0x78, 0xFF, 0xFF, 0xA8, 0xE2, 0x27, 0x44, 0xFB, 0xB4, 0x40, 0x47, 0x1C, 0x42, 0x22, 0x46,
+	 0x16, 0x60, 0x2B, 0xF3, 0xFF, 0xFF, 0x34, 0xFB, 0x2A, 0xF0, 0xF7, 0x60, 0xFF, 0x64, 0xA0, 0x84,
+	 0xA2, 0xDA, 0x60, 0x40, 0x40, 0x2B, 0xC4, 0x00, 0x22, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x22, 0x26,
+	 0x3F, 0x00, 0x01, 0x26, 0x03, 0x00, 0x04, 0x26, 0x05, 0x00, 0xBA, 0x00, 0x04, 0x2B, 0xB8, 0x00,
+	 0x87, 0xF5, 0x01, 0x00, 0x07, 0xF4, 0x4B, 0xF2, 0xFF, 0xFF, 0xDC, 0x84, 0x4B, 0xFA, 0x0C, 0x60,
+	 0xFE, 0x62, 0x80, 0xFF, 0xC8, 0x60, 0x78, 0x44, 0x02, 0xA4, 0xA2, 0xDB, 0x46, 0x78, 0xFF, 0xFF,
+	 0x82, 0xFF, 0x87, 0xF3, 0x66, 0x5C, 0xD0, 0x80, 0x00, 0x7C, 0x07, 0x03, 0x66, 0x43, 0x22, 0x46,
+	 0x22, 0xF2, 0x63, 0x46, 0x60, 0x40, 0x01, 0x2A, 0x01, 0x00, 0x3C, 0xF1, 0x4B, 0xF0, 0x64, 0x41,
+	 0x64, 0x47, 0x60, 0x5F, 0x20, 0xBC, 0x80, 0x26, 0x80, 0xAC, 0x60, 0x47, 0x22, 0x46, 0x3A, 0xFA,
+	 0x64, 0x44, 0x20, 0x7F, 0x34, 0x94, 0x3B, 0xFA, 0x08, 0x60, 0x00, 0xEA, 0x0F, 0x64, 0x60, 0x7F,
+	 0xA0, 0x5A, 0x80, 0x60, 0x00, 0xEA, 0xA0, 0x60, 0x00, 0xEA, 0xD1, 0x60, 0x00, 0xEA, 0x80, 0x00,
+	 0x2A, 0xF2, 0x00, 0x60, 0x7C, 0x62, 0x60, 0x40, 0x40, 0x2B, 0x24, 0x00, 0xA2, 0xD3, 0x00, 0x61,
+	 0x60, 0xFE, 0xA0, 0xD3, 0x5E, 0xD1, 0xFF, 0xFF, 0x20, 0xFE, 0x64, 0x5F, 0xDC, 0x84, 0xF1, 0x81,
+	 0xC0, 0x2B, 0x04, 0x00, 0x80, 0x2A, 0x02, 0x00, 0x7F, 0xA4, 0xDC, 0x84, 0xFF, 0x3B, 0x03, 0x00,
+	 0x60, 0x47, 0xDC, 0x87, 0x01, 0x61, 0xC0, 0x80, 0x00, 0x36, 0xDC, 0x84, 0x4E, 0xDB, 0x60, 0xFE,
+	 0x5A, 0xD1, 0xFF, 0xFF, 0xC1, 0x84, 0xF0, 0x22, 0x10, 0xA4, 0xF0, 0x2A, 0x01, 0x00, 0x00, 0x64,
+	 0xA2, 0xDB, 0x20, 0xFE, 0x00, 0x60, 0x3E, 0xF3, 0xFF, 0xFF, 0xA0, 0xD3, 0x5A, 0xD1, 0x3A, 0xFA,
+	 0x3B, 0xF8, 0x74, 0x62, 0xA2, 0xD0, 0xFF, 0xFF, 0x64, 0x44, 0xE0, 0x7F, 0xA0, 0x5A, 0x64, 0x47,
+	 0xE1, 0x7F, 0x5A, 0xD0, 0xA0, 0x5A, 0x64, 0x44, 0xE2, 0x7F, 0xA0, 0x5A, 0x00, 0x60, 0x40, 0xF3,
+	 0xFF, 0xFF, 0xA0, 0xD1, 0x5A, 0xD1, 0x64, 0x45, 0x64, 0x44, 0xE3, 0x7F, 0xA0, 0x5A, 0x64, 0x47,
+	 0xE4, 0x7F, 0x5A, 0xD1, 0xA0, 0x5A, 0x64, 0x44, 0xE5, 0x7F, 0xA0, 0x5A, 0x64, 0x47, 0xE6, 0x7F,
+	 0x5A, 0xD1, 0xA0, 0x5A, 0x64, 0x44, 0xE7, 0x7F, 0xA0, 0x5A, 0x65, 0x40, 0x0D, 0x3A, 0x1C, 0x00,
+	 0x64, 0x47, 0xE8, 0x7F, 0x5A, 0xD1, 0xA0, 0x5A, 0x64, 0x44, 0xE9, 0x7F, 0xA0, 0x5A, 0x64, 0x47,
+	 0xEA, 0x7F, 0x5A, 0xD1, 0xA0, 0x5A, 0x64, 0x44, 0xEB, 0x7F, 0xA0, 0x5A, 0x64, 0x47, 0xEC, 0x7F,
+	 0x5A, 0xD1, 0xA0, 0x5A, 0x64, 0x44, 0xED, 0x7F, 0xA0, 0x5A, 0x64, 0x47, 0xEE, 0x7F, 0x5A, 0xD1,
+	 0xA0, 0x5A, 0x64, 0x44, 0xEF, 0x7F, 0xA0, 0x5A, 0x08, 0x60, 0x00, 0xEA, 0x65, 0x44, 0x02, 0xA4,
+	 0x60, 0x7F, 0xA0, 0x5A, 0x80, 0x60, 0x00, 0xEA, 0xA0, 0x60, 0x00, 0xEA, 0xD1, 0x60, 0x00, 0xEA,
+	 0x0B, 0xF2, 0xFF, 0xFF, 0x7F, 0xB4, 0x0C, 0xF0, 0x04, 0x02, 0x64, 0x46, 0x00, 0xF0, 0x04, 0x64,
+	 0x22, 0x46, 0x03, 0xFA, 0x60, 0x41, 0x64, 0x46, 0x01, 0xF2, 0xFC, 0xA1, 0x61, 0x45, 0xD4, 0x84,
+	 0xFF, 0xFF, 0x08, 0x02, 0x00, 0xF0, 0x04, 0x63, 0x64, 0x46, 0x01, 0xF2, 0x22, 0x46, 0x1A, 0xFA,
+	 0x03, 0xFC, 0x02, 0x00, 0x22, 0x46, 0x1A, 0xFA, 0x35, 0xF2, 0x04, 0xF8, 0xDC, 0x84, 0x35, 0xFA,
+	 0x14, 0xF2, 0x0F, 0xB5, 0x0F, 0xB4, 0xCC, 0x84, 0x94, 0x80, 0x04, 0x60, 0x00, 0x65, 0x2A, 0xF2,
+	 0x01, 0x02, 0x94, 0x84, 0x2A, 0xFA, 0x95, 0xFC, 0x06, 0x00, 0xC4, 0x3A, 0x07, 0x00, 0x27, 0x44,
+	 0xFD, 0xB4, 0x40, 0x47, 0xA8, 0xE2, 0xA5, 0x60, 0x7A, 0x78, 0xFF, 0xFF, 0x28, 0x44, 0x04, 0x26,
+	 0x05, 0x00, 0x68, 0x3A, 0x03, 0x00, 0x32, 0x44, 0x00, 0x27, 0x03, 0x00, 0xA4, 0x60, 0x7C, 0x78,
+	 0xFF, 0xFF, 0x0A, 0x64, 0x3A, 0xDB, 0xA4, 0x60, 0x7C, 0x78, 0xFF, 0xFF, 0x0E, 0x64, 0x3A, 0xDB,
+	 0x3C, 0x44, 0x60, 0x46, 0x1E, 0xF0, 0x40, 0x42, 0x64, 0x40, 0x40, 0x27, 0x48, 0x00, 0x1F, 0xF2,
+	 0xFF, 0xFF, 0x60, 0x40, 0x40, 0x27, 0x3C, 0x00, 0x80, 0x2B, 0x0B, 0x00, 0xBF, 0x60, 0xFF, 0x65,
+	 0x29, 0x44, 0x24, 0x89, 0x80, 0x60, 0x00, 0x65, 0x29, 0x44, 0x34, 0x89, 0x80, 0x60, 0x00, 0x63,
+	 0x05, 0x00, 0x3F, 0x60, 0xFF, 0x65, 0x29, 0x44, 0x24, 0x89, 0x00, 0x63, 0x1E, 0xF2, 0x39, 0xF1,
+	 0xC0, 0x60, 0xFF, 0xB5, 0x0A, 0x18, 0x60, 0x47, 0x1F, 0xB4, 0xD0, 0x84, 0xE0, 0xA0, 0x02, 0x0D,
+	 0x00, 0x64, 0x02, 0x00, 0x01, 0x04, 0x1F, 0x64, 0x60, 0x47, 0xB4, 0x84, 0x07, 0x60, 0xEB, 0xF1,
+	 0x3C, 0x94, 0xB0, 0x84, 0x60, 0x4C, 0x22, 0x60, 0xC6, 0x65, 0x60, 0x47, 0x1F, 0xB4, 0xE0, 0x84,
+	 0xE0, 0x84, 0x44, 0xD3, 0x5A, 0xD1, 0x01, 0x60, 0x00, 0xE1, 0x05, 0x60, 0x69, 0x6B, 0x60, 0x4C,
+	 0xB5, 0xFF, 0x64, 0x4C, 0x7C, 0x44, 0x29, 0x40, 0x80, 0x2B, 0x67, 0x44, 0x60, 0x4C, 0x32, 0x00,
+	 0x15, 0x60, 0xDD, 0xF3, 0xFF, 0xFF, 0x60, 0x40, 0x04, 0x26, 0xCB, 0x01, 0xBF, 0x01, 0x40, 0x60,
+	 0x00, 0x65, 0x29, 0x44, 0x34, 0x89, 0x40, 0x60, 0x00, 0x63, 0x9F, 0xF2, 0x1E, 0xF2, 0x39, 0xF1,
+	 0xC0, 0x60, 0xFF, 0xB5, 0x0A, 0x18, 0x60, 0x47, 0x1F, 0xB4, 0xD0, 0x84, 0xE0, 0xA0, 0x02, 0x0D,
+	 0x00, 0x64, 0x02, 0x00, 0x01, 0x04, 0x1F, 0x64, 0x60, 0x47, 0xB4, 0x84, 0x07, 0x60, 0xEB, 0xF1,
+	 0x3C, 0x94, 0xB0, 0x81, 0x61, 0x4C, 0x22, 0x60, 0xC6, 0x65, 0x61, 0x47, 0x1F, 0xB4, 0xE0, 0x84,
+	 0xE0, 0x84, 0x44, 0xD3, 0x5A, 0xD1, 0x01, 0x60, 0x00, 0xE1, 0x01, 0x60, 0x09, 0x6B, 0x60, 0x4C,
+	 0xB5, 0xFF, 0x64, 0x4C, 0x40, 0xE1, 0x01, 0x60, 0x08, 0xE1, 0x84, 0xFF, 0xC1, 0x60, 0x6B, 0x64,
+	 0x40, 0x42, 0x82, 0xFF, 0x2A, 0xF2, 0x10, 0x60, 0x00, 0x65, 0xA4, 0x84, 0xB4, 0xBC, 0x1E, 0xF0,
+	 0x40, 0x48, 0x64, 0x40, 0x40, 0x27, 0x17, 0x00, 0x1C, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x0A, 0x36,
+	 0x06, 0x00, 0x14, 0x36, 0x07, 0x00, 0x37, 0x36, 0x08, 0x00, 0x6E, 0x36, 0x09, 0x00, 0x70, 0x7C,
+	 0xA0, 0x63, 0x0F, 0x00, 0x38, 0x7C, 0x50, 0x63, 0x0C, 0x00, 0x15, 0x7C, 0x1E, 0x63, 0x09, 0x00,
+	 0x0B, 0x7C, 0x0F, 0x63, 0x06, 0x00, 0x9C, 0xF4, 0xFF, 0x65, 0x63, 0x47, 0xA4, 0x9C, 0xA7, 0x84,
+	 0x23, 0x00, 0x40, 0x45, 0x43, 0x4D, 0x00, 0xE1, 0xF0, 0xFE, 0x29, 0x40, 0x80, 0x2B, 0x03, 0x00,
+	 0x00, 0x60, 0x6A, 0x65, 0x02, 0x00, 0x00, 0x60, 0xCA, 0x65, 0x1F, 0xF2, 0xFF, 0xFF, 0x60, 0x40,
+	 0x40, 0x27, 0x0E, 0x00, 0x2A, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x04, 0x27, 0x03, 0x00, 0x65, 0x44,
+	 0xE0, 0x85, 0x12, 0x00, 0x2B, 0xF2, 0x11, 0xF0, 0xC0, 0x84, 0xD0, 0x84, 0xC4, 0x83, 0x11, 0x00,
+	 0x1E, 0x64, 0xC4, 0x84, 0x60, 0x45, 0x08, 0x00, 0x40, 0x45, 0xFF, 0x60, 0xF8, 0x64, 0x40, 0x43,
+	 0x00, 0xE1, 0xF0, 0xFE, 0x00, 0x60, 0x3C, 0x65, 0x91, 0xF4, 0x1B, 0xF0, 0xC3, 0x84, 0xC4, 0x84,
+	 0xC0, 0x83, 0x28, 0x44, 0xA1, 0xFF, 0x12, 0x74, 0x80, 0x4E, 0x12, 0x74, 0x83, 0x4C, 0x9A, 0xFF,
+	 0x12, 0x74, 0x56, 0x62, 0x7A, 0xD4, 0x12, 0x74, 0x7A, 0xD4, 0x12, 0x74, 0x7A, 0xD4, 0x12, 0x74,
+	 0x5C, 0x62, 0x7A, 0xD4, 0x12, 0x74, 0x7A, 0xD4, 0x12, 0x74, 0x7A, 0xD4, 0x12, 0x74, 0xA1, 0xFF,
+	 0x98, 0xFF, 0xB1, 0x60, 0x58, 0x4F, 0x00, 0x78, 0xFF, 0xFF, 0xBC, 0xFF, 0xB5, 0xFF, 0x01, 0x60,
+	 0x18, 0xE1, 0x47, 0xFF, 0x27, 0x44, 0x02, 0xBC, 0x40, 0x47, 0x36, 0xF3, 0xB6, 0xFF, 0xB7, 0xFF,
+	 0xB4, 0xFF, 0xC8, 0x60, 0x09, 0x7D, 0x7C, 0x4B, 0x60, 0x56, 0xAD, 0xE2, 0xA5, 0x60, 0xC7, 0x78,
+	 0xFF, 0xFF, 0x15, 0x60, 0xDD, 0xF3, 0x15, 0x60, 0xBE, 0xF3, 0x60, 0x40, 0x04, 0x26, 0x0B, 0x00,
+	 0x07, 0xB4, 0x60, 0x40, 0x01, 0x36, 0x07, 0x00, 0x29, 0x44, 0xBF, 0x60, 0xFF, 0xB7, 0x80, 0xBF,
+	 0x40, 0x49, 0x80, 0x67, 0x05, 0x00, 0x3F, 0x60, 0xFF, 0x65, 0x29, 0x44, 0x24, 0x89, 0x00, 0x64,
+	 0x12, 0x60, 0xD3, 0xF1, 0xFF, 0xFF, 0x15, 0x60, 0xD8, 0xF9, 0x39, 0xF1, 0x12, 0x60, 0xBF, 0xF1,
+	 0x64, 0x41, 0x64, 0x5E, 0x60, 0x45, 0x64, 0x47, 0x1F, 0xB4, 0x54, 0x94, 0xE0, 0xA0, 0x02, 0x0D,
+	 0x00, 0x64, 0x02, 0x00, 0x01, 0x04, 0x1F, 0x64, 0x60, 0x47, 0x07, 0x60, 0xEB, 0xF1, 0xB4, 0x84,
+	 0xB0, 0x8C, 0x22, 0x60, 0xC6, 0x7C, 0x60, 0x47, 0x1F, 0xB4, 0xE0, 0x84, 0xE0, 0x84, 0x40, 0xD3,
+	 0x5A, 0xD1, 0x01, 0x60, 0x00, 0xE1, 0x05, 0x60, 0x69, 0x6B, 0x60, 0x4C, 0xB5, 0xFF, 0x64, 0x4C,
+	 0x7C, 0x44, 0x29, 0x40, 0x80, 0x2B, 0x67, 0x44, 0x60, 0x4C, 0x40, 0xE1, 0x01, 0x60, 0x08, 0xE1,
+	 0x84, 0xFF, 0xC1, 0x60, 0x6B, 0x64, 0x40, 0x42, 0x82, 0xFF, 0x3C, 0x44, 0x60, 0x46, 0x40, 0x42,
+	 0x13, 0x64, 0x3A, 0xDB, 0x10, 0x60, 0x00, 0x65, 0x3C, 0x46, 0x2A, 0xF2, 0x15, 0x60, 0xBE, 0xF1,
+	 0xA4, 0x84, 0xC4, 0xBC, 0x40, 0x48, 0x64, 0x44, 0x04, 0x26, 0x09, 0x00, 0x02, 0x26, 0x0A, 0x00,
+	 0x01, 0x26, 0x0B, 0x00, 0x08, 0x2A, 0x03, 0x00, 0x0B, 0x63, 0x6E, 0x64, 0x08, 0x00, 0x15, 0x63,
+	 0x37, 0x64, 0x05, 0x00, 0x38, 0x63, 0x14, 0x64, 0x02, 0x00, 0x70, 0x63, 0x0A, 0x64, 0x43, 0x4D,
+	 0x40, 0x45, 0x00, 0xE1, 0xF0, 0xFE, 0x00, 0x60, 0x1E, 0x64, 0x1B, 0xF0, 0x11, 0xF0, 0xC0, 0x84,
+	 0xC0, 0x84, 0x60, 0x43, 0x28, 0x44, 0xA1, 0xFF, 0x12, 0x74, 0x80, 0x4E, 0x12, 0x74, 0x83, 0x4C,
+	 0x9A, 0xFF, 0x12, 0x74, 0x5C, 0x62, 0x7A, 0xD4, 0x12, 0x74, 0x7A, 0xD4, 0x12, 0x74, 0x7A, 0xD4,
+	 0x12, 0x74, 0xA1, 0xFF, 0x98, 0xFF, 0xB1, 0x60, 0x58, 0x4F, 0x00, 0x78, 0xFF, 0xFF, 0x01, 0x60,
+	 0x18, 0xE1, 0x78, 0x44, 0x03, 0xA4, 0x35, 0xFB, 0xB1, 0x60, 0x43, 0x78, 0xFF, 0xFF, 0xC4, 0xE2,
+	 0x08, 0x64, 0x3A, 0xDB, 0xA5, 0x60, 0x1C, 0x78, 0xFF, 0xFF, 0x24, 0x40, 0x01, 0x2A, 0x0E, 0x00,
+	 0x1D, 0xFF, 0x26, 0x44, 0x02, 0xBC, 0x40, 0x46, 0x27, 0x44, 0x07, 0x22, 0x05, 0x00, 0xF8, 0xB4,
+	 0x40, 0x47, 0x06, 0x64, 0x31, 0xFB, 0xC0, 0xFE, 0x30, 0xF1, 0x52, 0x00, 0xFC, 0xB3, 0x32, 0x40,
+	 0x01, 0x2A, 0x06, 0x00, 0x0A, 0xBB, 0x0F, 0xFC, 0xCB, 0xFE, 0xA4, 0x60, 0x7C, 0x78, 0xFF, 0xFF,
+	 0x24, 0x44, 0x04, 0x26, 0x02, 0x00, 0x0F, 0xFC, 0x05, 0xFF, 0x30, 0xF1, 0x27, 0x44, 0x05, 0x22,
+	 0x2C, 0x00, 0xFA, 0xB4, 0x40, 0x47, 0x24, 0x44, 0x10, 0x2A, 0x23, 0x00, 0x28, 0x40, 0xD4, 0x3A,
+	 0x20, 0x00, 0x31, 0x40, 0x08, 0x26, 0x00, 0x7C, 0x2B, 0x44, 0xD0, 0x80, 0x70, 0x45, 0x02, 0x28,
+	 0x64, 0x44, 0xC4, 0x84, 0xFF, 0xFF, 0x04, 0x24, 0x00, 0xB4, 0x60, 0x50, 0x08, 0x28, 0x01, 0x00,
+	 0x20, 0x29, 0x6D, 0xE2, 0x1D, 0xF0, 0xC0, 0x64, 0xC0, 0x84, 0x0A, 0x60, 0x7B, 0xF1, 0xE8, 0x84,
+	 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xC0, 0x84, 0xA2, 0xDB, 0xA5, 0x60, 0xCD, 0x78,
+	 0xFF, 0xFF, 0x02, 0x64, 0x31, 0xFB, 0xC0, 0xFE, 0x07, 0x00, 0x02, 0x2A, 0x05, 0x00, 0xFD, 0xB4,
+	 0x40, 0x47, 0x06, 0x64, 0x31, 0xFB, 0xC0, 0xFE, 0x05, 0x64, 0x3A, 0xDB, 0x28, 0x44, 0xA4, 0x3A,
+	 0x07, 0x00, 0x01, 0x60, 0x02, 0x7C, 0x25, 0x44, 0x0A, 0x3A, 0x02, 0x00, 0x01, 0x60, 0x3A, 0x7C,
+	 0x31, 0x40, 0x08, 0x26, 0x00, 0x7C, 0x2B, 0x44, 0xD0, 0x80, 0x70, 0x45, 0x02, 0x28, 0x64, 0x44,
+	 0xC4, 0x84, 0xFF, 0xFF, 0x04, 0x24, 0x00, 0xB4, 0x28, 0x40, 0xE4, 0x36, 0x00, 0xB4, 0x60, 0x50,
+	 0x08, 0x28, 0x01, 0x00, 0x20, 0x29, 0x6D, 0xE2, 0xA4, 0x60, 0x6F, 0x78, 0xFF, 0xFF, 0x27, 0x44,
+	 0x05, 0x22, 0x09, 0x00, 0xBA, 0xB4, 0x40, 0x47, 0x3C, 0x46, 0x02, 0x64, 0x31, 0xFB, 0xC0, 0xFE,
+	 0xA4, 0x60, 0x7C, 0x78, 0xFF, 0xFF, 0x27, 0x44, 0x02, 0x2A, 0x06, 0x00, 0xFD, 0xB4, 0x40, 0x47,
+	 0x06, 0x64, 0x31, 0xFB, 0xC0, 0xFE, 0xF4, 0x01, 0xF3, 0x0A, 0x7C, 0x50, 0x6D, 0xE2, 0xF0, 0x01,
+	 0x72, 0x45, 0xDC, 0x84, 0x94, 0xFB, 0x11, 0x64, 0x3A, 0xDB, 0x95, 0xF3, 0x06, 0x04, 0xDC, 0x84,
+	 0x95, 0xFB, 0x96, 0xF3, 0x02, 0x04, 0xDC, 0x84, 0x96, 0xFB, 0xA4, 0x60, 0x87, 0x78, 0xFF, 0xFF,
+	 0x00, 0x61, 0x12, 0x64, 0x3A, 0xDB, 0x18, 0x60, 0xEE, 0x63, 0xBD, 0xD3, 0x72, 0x45, 0x44, 0x8A,
+	 0x02, 0x28, 0x03, 0x00, 0xE4, 0xE2, 0xDD, 0x81, 0x04, 0x00, 0x02, 0x28, 0x02, 0x00, 0xE4, 0xE2,
+	 0xDD, 0x81, 0xBD, 0xD3, 0x94, 0xF1, 0x61, 0x45, 0xC0, 0x84, 0x00, 0x61, 0x02, 0x24, 0x01, 0xB9,
+	 0xC4, 0x84, 0x60, 0x55, 0x2A, 0x52, 0xE4, 0xE2, 0x94, 0xFB, 0x02, 0x24, 0x01, 0xB9, 0xBD, 0xD3,
+	 0x95, 0xF1, 0x61, 0x45, 0xC0, 0x84, 0x00, 0x61, 0x02, 0x24, 0x01, 0xB9, 0xC4, 0x84, 0x95, 0xFB,
+	 0x02, 0x24, 0x01, 0xB9, 0xBD, 0xD3, 0x96, 0xF1, 0x61, 0x45, 0xC0, 0x84, 0xC4, 0x84, 0x96, 0xFB,
+	 0xA5, 0x60, 0x71, 0x78, 0xFF, 0xFF, 0xAC, 0x01, 0x47, 0xFF, 0x44, 0xFF, 0xC8, 0x74, 0xCD, 0xE2,
+	 0xAA, 0x60, 0xFE, 0x78, 0x00, 0x61, 0xA4, 0x60, 0x7C, 0x78, 0xFF, 0xFF, 0x5C, 0x44, 0x26, 0x44,
+	 0x02, 0x26, 0x0C, 0x00, 0x3E, 0x46, 0x09, 0xF2, 0x1E, 0x41, 0x03, 0x1B, 0xAC, 0x60, 0x14, 0x78,
+	 0xFF, 0xFF, 0x40, 0x5E, 0xFD, 0xFB, 0x21, 0x44, 0x02, 0x64, 0x40, 0x46, 0x41, 0x5D, 0x21, 0x46,
+	 0x00, 0x64, 0x31, 0xFA, 0x00, 0xF2, 0x46, 0x45, 0x87, 0xFC, 0xAC, 0xE2, 0x01, 0x64, 0x33, 0xFB,
+	 0x32, 0x40, 0x01, 0x2A, 0x21, 0x00, 0x19, 0xF3, 0x01, 0x60, 0x1E, 0xE1, 0x1D, 0x18, 0x80, 0x64,
+	 0x40, 0x49, 0x00, 0xE1, 0x19, 0xFF, 0x08, 0x64, 0x2A, 0xFA, 0x5A, 0xDA, 0x2C, 0xFA, 0x5A, 0xDA,
+	 0x5A, 0xDA, 0xD2, 0xF3, 0xFF, 0xFF, 0x02, 0xBC, 0xD2, 0xFB, 0x72, 0x44, 0x24, 0xFA, 0x94, 0xF3,
+	 0x25, 0xFA, 0xA1, 0xFF, 0xFF, 0xFF, 0xB6, 0xFF, 0xB7, 0xFF, 0xB4, 0xFF, 0xC8, 0x60, 0x09, 0x7D,
+	 0x7C, 0x4B, 0xA4, 0x60, 0x7C, 0x78, 0xFF, 0xFF, 0x01, 0xE1, 0x01, 0x60, 0x1A, 0xE1, 0x3F, 0x60,
+	 0xCF, 0x65, 0x29, 0x44, 0x24, 0x89, 0x2E, 0x44, 0x00, 0x36, 0x41, 0x00, 0x01, 0x3A, 0xC9, 0x00,
+	 0x88, 0xFF, 0x40, 0x67, 0x29, 0x45, 0x34, 0x89, 0x04, 0x64, 0x89, 0xFF, 0x60, 0x54, 0x88, 0xFF,
+	 0xA1, 0xFF, 0x6C, 0x45, 0x65, 0x44, 0x0F, 0xB4, 0x40, 0x45, 0x1C, 0xFA, 0x65, 0x44, 0x29, 0x41,
+	 0xF9, 0x81, 0x52, 0x4A, 0x71, 0x89, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x83, 0x1D, 0xFC,
+	 0x1B, 0xFC, 0x98, 0xF1, 0xFC, 0xA3, 0xD3, 0x80, 0x43, 0x43, 0x03, 0x04, 0xAC, 0x60, 0x0A, 0x78,
+	 0xFF, 0xFF, 0x09, 0x7C, 0xD3, 0x80, 0x9A, 0xFF, 0x03, 0x07, 0xAC, 0x60, 0x0A, 0x78, 0xFF, 0xFF,
+	 0x25, 0x44, 0x01, 0x26, 0x0F, 0xAC, 0x1F, 0x60, 0x50, 0x65, 0x44, 0xD3, 0x12, 0x65, 0x45, 0x46,
+	 0x60, 0x47, 0x40, 0x7F, 0x27, 0xFA, 0x8F, 0xFC, 0x18, 0x61, 0xCB, 0xF1, 0xA1, 0xFF, 0x6C, 0x44,
+	 0xDC, 0x80, 0xFF, 0xFF, 0x21, 0x03, 0x50, 0xFE, 0xAC, 0x60, 0x20, 0x78, 0xFF, 0xFF, 0xC8, 0x60,
+	 0x0B, 0x7D, 0x08, 0x60, 0x00, 0x6B, 0xB5, 0xFF, 0xB7, 0xFF, 0xB4, 0xFF, 0xAA, 0x74, 0xCD, 0xE2,
+	 0x02, 0x64, 0x89, 0xFF, 0x60, 0x54, 0x88, 0xFF, 0x01, 0x60, 0x08, 0xE1, 0x05, 0xE1, 0xA1, 0xFF,
+	 0xFF, 0xFF, 0x04, 0x25, 0x76, 0x00, 0x6C, 0x44, 0x0A, 0x36, 0x07, 0x00, 0x14, 0x36, 0x05, 0x00,
+	 0x37, 0x36, 0x03, 0x00, 0x6E, 0x36, 0x01, 0x00, 0x6C, 0x00, 0x40, 0x45, 0x32, 0x74, 0xA1, 0xFF,
+	 0x1C, 0xFA, 0x40, 0x4E, 0x8C, 0x44, 0x60, 0x43, 0x1D, 0xFA, 0x01, 0xE1, 0x20, 0x64, 0x3A, 0xDB,
+	 0x2E, 0x44, 0x14, 0x36, 0x12, 0x00, 0x0A, 0x36, 0x0F, 0x00, 0x63, 0x45, 0xE3, 0x83, 0xE3, 0x83,
+	 0xC7, 0x83, 0xE3, 0x83, 0xC7, 0x83, 0xFF, 0xFF, 0x37, 0x36, 0x05, 0x00, 0x6E, 0x36, 0x04, 0x00,
+	 0xAC, 0x60, 0x1E, 0x78, 0xFF, 0xFF, 0xEB, 0x83, 0xEB, 0x83, 0xEB, 0x83, 0xEB, 0x83, 0xFF, 0xFF,
+	 0x80, 0x27, 0xCF, 0x83, 0x1B, 0xFC, 0x01, 0x64, 0x4F, 0xFB, 0xA1, 0xFF, 0x29, 0x41, 0xF9, 0x81,
+	 0x52, 0x4A, 0x71, 0x89, 0x2E, 0x44, 0x27, 0xFA, 0x98, 0xF1, 0xFC, 0xA3, 0xD3, 0x80, 0x43, 0x43,
+	 0x03, 0x04, 0xAC, 0x60, 0x0A, 0x78, 0xFF, 0xFF, 0x9A, 0xFF, 0x54, 0x63, 0x12, 0x64, 0x40, 0x46,
+	 0x8F, 0xFC, 0x18, 0x61, 0xCB, 0xF1, 0x50, 0xFE, 0x6C, 0x40, 0x9E, 0x15, 0x01, 0x60, 0x08, 0xE1,
+	 0x80, 0xE1, 0x00, 0x64, 0x33, 0xFB, 0x01, 0x60, 0x18, 0xE1, 0x01, 0x11, 0x0F, 0x00, 0x29, 0x44,
+	 0x20, 0xBC, 0x40, 0x49, 0x01, 0x64, 0x33, 0xFB, 0xB6, 0xFF, 0x00, 0xE1, 0x01, 0x60, 0x1A, 0xE1,
+	 0xA1, 0xFF, 0xFF, 0xFF, 0x6C, 0x40, 0xFC, 0x11, 0x01, 0x60, 0x18, 0xE1, 0xB5, 0xFF, 0xB6, 0xFF,
+	 0xB7, 0xFF, 0xB4, 0xFF, 0xC8, 0x60, 0x09, 0x7D, 0x7C, 0x4B, 0x35, 0xE1, 0xAC, 0xE2, 0xAA, 0x60,
+	 0x97, 0x78, 0xFF, 0xFF, 0x13, 0x60, 0x02, 0xF3, 0xFF, 0xFF, 0xDC, 0x84, 0x00, 0x36, 0x00, 0x3B,
+	 0xA2, 0xDB, 0x21, 0x64, 0x3A, 0xDB, 0xD2, 0x01, 0x25, 0x60, 0xF2, 0x64, 0xE5, 0x60, 0x78, 0x41,
+	 0xC7, 0x78, 0x97, 0xF1, 0x2A, 0x64, 0x3A, 0xDB, 0x5C, 0x41, 0xC8, 0x01, 0x29, 0x64, 0x3A, 0xDB,
+	 0x88, 0x60, 0x85, 0x71, 0x8D, 0xE2, 0xA2, 0xFC, 0x32, 0x40, 0x01, 0x2A, 0xA8, 0x00, 0x01, 0x60,
+	 0x1A, 0xE1, 0x23, 0x43, 0xA1, 0xFF, 0xEC, 0x44, 0x2A, 0xFA, 0x40, 0x48, 0xA1, 0xFF, 0x7A, 0xDC,
+	 0x7E, 0x36, 0x04, 0xA2, 0xFC, 0x1C, 0x03, 0x1D, 0x00, 0x64, 0x3F, 0xFA, 0x2E, 0x00, 0x03, 0x2B,
+	 0x04, 0x00, 0xA1, 0xFF, 0x7A, 0xDC, 0x7A, 0xDC, 0x7A, 0xDC, 0x8F, 0xB0, 0x88, 0x3A, 0x03, 0x00,
+	 0x70, 0x62, 0xA1, 0xFF, 0x7A, 0xDC, 0x28, 0x40, 0x40, 0x2B, 0x06, 0x00, 0x72, 0x62, 0xA1, 0xFF,
+	 0x7A, 0xDC, 0x7A, 0xDC, 0x7A, 0xDC, 0x7A, 0xDC, 0x3F, 0xFC, 0x00, 0xF4, 0x10, 0x62, 0x6E, 0x61,
+	 0xA1, 0xFF, 0x05, 0x1D, 0x12, 0x1E, 0x0C, 0x00, 0x00, 0xF4, 0x7C, 0x61, 0x02, 0x62, 0x7A, 0xDC,
+	 0x63, 0x40, 0xFD, 0x1C, 0xF9, 0x1D, 0xFF, 0xB1, 0x08, 0x1E, 0x02, 0x02, 0x00, 0xF4, 0x02, 0x62,
+	 0xB6, 0xFF, 0xB7, 0xFF, 0xA1, 0xFF, 0x6C, 0x44, 0x5A, 0xDA, 0x98, 0xFF, 0xA1, 0xFF, 0x6C, 0x40,
+	 0xA1, 0xFF, 0x47, 0xFF, 0x7C, 0x44, 0x33, 0xFB, 0x26, 0x44, 0xFD, 0xB4, 0x84, 0xBC, 0x01, 0x15,
+	 0x7F, 0xB4, 0x40, 0x46, 0x6C, 0x40, 0xB6, 0xFF, 0xB7, 0xFF, 0xA1, 0xFF, 0x6C, 0x45, 0xA1, 0xFF,
+	 0x7F, 0x60, 0x7F, 0x7C, 0x6C, 0x44, 0xA0, 0x84, 0x15, 0xA7, 0x15, 0xA4, 0x21, 0x46, 0x26, 0xFA,
+	 0x29, 0x40, 0x40, 0x2B, 0x07, 0x00, 0xB6, 0xFF, 0x40, 0x60, 0x00, 0x65, 0xA1, 0xFF, 0x6C, 0x44,
+	 0x1A, 0xFA, 0x09, 0x00, 0x65, 0x44, 0x0F, 0xB4, 0x06, 0xA8, 0x80, 0x60, 0x00, 0x65, 0x08, 0x28,
+	 0x7C, 0x45, 0x29, 0x44, 0x34, 0x89, 0x27, 0xF0, 0x65, 0x44, 0x64, 0x5E, 0x27, 0xFA, 0x81, 0xE1,
+	 0x01, 0x60, 0x18, 0xE1, 0x01, 0x11, 0x0F, 0x00, 0x29, 0x44, 0x20, 0xBC, 0x40, 0x49, 0x01, 0x64,
+	 0x33, 0xFB, 0xB6, 0xFF, 0x00, 0xE1, 0x01, 0x60, 0x1A, 0xE1, 0xA1, 0xFF, 0xFF, 0xFF, 0x6C, 0x40,
+	 0xFC, 0x11, 0x01, 0x60, 0x18, 0xE1, 0x21, 0x46, 0xB5, 0xFF, 0xBC, 0xFF, 0x47, 0xFF, 0xB6, 0xFF,
+	 0xB7, 0xFF, 0xB4, 0xFF, 0xC8, 0x60, 0x09, 0x7D, 0x7C, 0x4B, 0x26, 0x43, 0x2A, 0x44, 0x72, 0x45,
+	 0x24, 0xFA, 0x94, 0xF3, 0x06, 0x04, 0xE4, 0xE2, 0xDC, 0x9C, 0x29, 0x40, 0x01, 0x26, 0x64, 0x44,
+	 0x94, 0xF9, 0x25, 0xFA, 0x95, 0xF3, 0x02, 0x04, 0xDC, 0x84, 0x95, 0xFB, 0x28, 0xFA, 0x96, 0xF3,
+	 0x02, 0x04, 0xDC, 0x84, 0x96, 0xFB, 0x29, 0xFA, 0xAA, 0x60, 0x1D, 0x78, 0xFF, 0xFF, 0xA1, 0xFF,
+	 0x12, 0x61, 0x8C, 0x44, 0xCC, 0xF0, 0x2A, 0xFA, 0x40, 0x48, 0x04, 0x26, 0x43, 0x00, 0xA1, 0xFF,
+	 0x8C, 0x44, 0x5A, 0xDA, 0x30, 0xFB, 0x6C, 0x44, 0x2C, 0xFA, 0xFF, 0xFF, 0x01, 0x26, 0x26, 0x00,
+	 0xD0, 0x80, 0xA1, 0xFF, 0x8C, 0x44, 0x6C, 0x5C, 0x00, 0xE1, 0xF2, 0xFE, 0x2D, 0xFA, 0xCD, 0xF3,
+	 0xD4, 0x80, 0xD0, 0x80, 0x2E, 0xF8, 0x24, 0x44, 0x16, 0x0C, 0x32, 0x40, 0x02, 0x2A, 0x07, 0x00,
+	 0x28, 0x42, 0x0C, 0xB2, 0x08, 0x3A, 0x03, 0x00, 0x10, 0xBC, 0x40, 0x44, 0x5C, 0x00, 0x04, 0x0A,
+	 0xA1, 0xFF, 0xAC, 0x60, 0x13, 0x78, 0xFF, 0xFF, 0x11, 0xBC, 0x40, 0x44, 0x28, 0x45, 0xBF, 0x60,
+	 0xFF, 0x64, 0x24, 0x88, 0x50, 0x00, 0x30, 0xBC, 0x40, 0x44, 0x4D, 0x00, 0x20, 0xB9, 0x5C, 0x8E,
+	 0xA1, 0xFF, 0x8C, 0x44, 0x2D, 0xFA, 0xDC, 0x9C, 0x6C, 0x44, 0x00, 0xE1, 0xF2, 0xFE, 0x2E, 0xFA,
+	 0x08, 0x28, 0x44, 0x4E, 0xDC, 0x84, 0x2E, 0x5C, 0xB0, 0x84, 0xEF, 0xB1, 0x08, 0x24, 0x40, 0xB9,
+	 0x41, 0x46, 0x39, 0x00, 0x23, 0x41, 0x13, 0x64, 0x51, 0x90, 0x56, 0x63, 0x03, 0x04, 0xAC, 0x60,
+	 0x0A, 0x78, 0xFF, 0xFF, 0x8C, 0x44, 0x04, 0x61, 0x2B, 0xFA, 0x50, 0xFE, 0x80, 0x27, 0x00, 0x64,
+	 0x30, 0xFB, 0x8C, 0x44, 0x2C, 0xFA, 0xD0, 0x80, 0x8C, 0x44, 0x2D, 0xFA, 0xD4, 0x80, 0x00, 0x65,
+	 0x8C, 0x44, 0xCD, 0xF1, 0x2E, 0xFA, 0xD0, 0x80, 0x28, 0x44, 0x03, 0x0C, 0xA0, 0x2A, 0x0A, 0x00,
+	 0x11, 0x00, 0x10, 0x65, 0x60, 0x40, 0xC4, 0x36, 0x04, 0x00, 0xD4, 0x3A, 0x08, 0x00, 0x27, 0x40,
+	 0x40, 0x26, 0x30, 0x65, 0x00, 0x64, 0x3F, 0xFA, 0x46, 0x4E, 0x35, 0x84, 0x66, 0x00, 0x40, 0x26,
+	 0xF9, 0x01, 0x30, 0x65, 0x7A, 0xDC, 0x7A, 0xDC, 0x7A, 0xDC, 0x04, 0x61, 0xF3, 0x01, 0xA1, 0xFF,
+	 0xAB, 0x60, 0xE6, 0x78, 0xFF, 0xFF, 0xFF, 0x60, 0xFE, 0x65, 0x23, 0x43, 0xE8, 0xA3, 0x80, 0x27,
+	 0xF6, 0x01, 0x20, 0xE6, 0x08, 0x60, 0x00, 0xEB, 0x28, 0x44, 0x03, 0x2B, 0x05, 0x00, 0x6A, 0x62,
+	 0x7A, 0xDC, 0x7A, 0xDC, 0x7A, 0xDC, 0x28, 0x44, 0x8F, 0xB0, 0x88, 0x3A, 0x03, 0x00, 0x70, 0x62,
+	 0x7A, 0xDC, 0x28, 0x44, 0x40, 0x2B, 0x0D, 0x00, 0x72, 0x62, 0x7A, 0xDC, 0xA1, 0xFF, 0x6C, 0x5C,
+	 0x5A, 0xD8, 0xE4, 0x40, 0x20, 0x2B, 0x03, 0x00, 0x7A, 0xDC, 0x7A, 0xDC, 0xF8, 0xA3, 0x25, 0xFF,
+	 0xB0, 0xFF, 0x3F, 0xFC, 0x00, 0xF4, 0x10, 0x62, 0x10, 0x61, 0x57, 0x90, 0x6C, 0x61, 0xA1, 0xFF,
+	 0x09, 0x07, 0x02, 0x1D, 0x2A, 0x1E, 0x21, 0x00, 0xCB, 0x83, 0x7A, 0xDC, 0xFE, 0x1C, 0xD9, 0x81,
+	 0x24, 0x1E, 0x1B, 0x00, 0xCB, 0x83, 0x0E, 0xA3, 0xA7, 0x84, 0xF2, 0xA3, 0x7A, 0xDC, 0xFE, 0x1C,
+	 0x05, 0x1D, 0x01, 0x60, 0x18, 0xE1, 0x7C, 0xA8, 0xD9, 0x81, 0x0A, 0x02, 0x00, 0xF4, 0x02, 0x62,
+	 0xA7, 0x84, 0x7A, 0x61, 0x7A, 0xDC, 0xFE, 0x1C, 0xF9, 0x1D, 0x7C, 0xA8, 0xD9, 0x81, 0xF6, 0x03,
+	 0xFF, 0xB1, 0x0B, 0x1E, 0x02, 0x02, 0x00, 0xF4, 0x02, 0x62, 0xA1, 0xFF, 0xFF, 0xFF, 0xB6, 0xFF,
+	 0xB7, 0xFF, 0x6C, 0x44, 0x5A, 0xDA, 0xCD, 0x81, 0x64, 0x40, 0x46, 0x45, 0x28, 0x44, 0x40, 0x2B,
+	 0x0E, 0x00, 0x64, 0x40, 0x20, 0x2B, 0x0B, 0x00, 0x01, 0xA2, 0x62, 0x44, 0x46, 0x45, 0x21, 0x46,
+	 0x00, 0xF4, 0x02, 0x62, 0x9A, 0xFF, 0x7A, 0xDC, 0x7A, 0xDC, 0x7A, 0xDC, 0x7A, 0xDC, 0x98, 0xFF,
+	 0x00, 0xE6, 0x01, 0xF2, 0x61, 0x45, 0xD4, 0x9E, 0x21, 0x46, 0x16, 0xFA, 0x25, 0x44, 0x06, 0xFA,
+	 0xA1, 0xFF, 0x8C, 0x44, 0xA1, 0xFF, 0x47, 0xFF, 0x50, 0x4B, 0x67, 0x50, 0x69, 0xE2, 0x25, 0x46,
+	 0x01, 0xF2, 0x61, 0x45, 0xD4, 0x9E, 0x21, 0x46, 0x16, 0xFA, 0x25, 0x45, 0x86, 0xF8, 0xFF, 0xFF,
+	 0x6A, 0x44, 0x40, 0x2B, 0x03, 0x15, 0xAF, 0x60, 0x10, 0x78, 0xFF, 0xFF, 0x29, 0x40, 0x10, 0x26,
+	 0x04, 0x00, 0x04, 0x74, 0xCD, 0xE2, 0xA1, 0xFF, 0xFF, 0xFF, 0x6C, 0x44, 0xB6, 0xFF, 0xB7, 0xFF,
+	 0xC4, 0xE2, 0x01, 0x60, 0x18, 0xE1, 0x05, 0x76, 0xAD, 0xE2, 0x41, 0xE1, 0xA1, 0xFF, 0x6C, 0x45,
+	 0xA1, 0xFF, 0x65, 0x41, 0x7F, 0x60, 0x7F, 0x7C, 0x6C, 0x44, 0xA0, 0x84, 0x15, 0xA7, 0x15, 0xA4,
+	 0x21, 0x46, 0x26, 0xFA, 0x22, 0x46, 0x10, 0xFA, 0x21, 0x46, 0x29, 0x40, 0x40, 0x2B, 0x07, 0x00,
+	 0xB6, 0xFF, 0xA1, 0xFF, 0x40, 0x60, 0x00, 0x65, 0x6C, 0x44, 0x1A, 0xFA, 0x09, 0x00, 0x65, 0x44,
+	 0x0F, 0xB4, 0x06, 0xA8, 0x80, 0x60, 0x00, 0x65, 0x08, 0x28, 0x7C, 0x45, 0x29, 0x44, 0x34, 0x89,
+	 0x27, 0xF0, 0x65, 0x47, 0x1F, 0xB1, 0x34, 0x97, 0x64, 0x5E, 0x07, 0x60, 0xF5, 0xF1, 0x29, 0x40,
+	 0x40, 0x2B, 0x04, 0x00, 0x64, 0x40, 0x02, 0x26, 0x10, 0x60, 0x00, 0xBC, 0x27, 0xFA, 0x01, 0x60,
+	 0x18, 0xE1, 0x00, 0x64, 0x33, 0xFB, 0xA8, 0xE2, 0x05, 0xE1, 0x28, 0x40, 0x03, 0x26, 0xCE, 0x00,
+	 0x31, 0x40, 0x20, 0x2A, 0x03, 0x00, 0x28, 0x40, 0x50, 0x3A, 0xC8, 0x00, 0x24, 0x44, 0x20, 0x2A,
+	 0xC5, 0x00, 0x2B, 0x44, 0xAC, 0x80, 0x28, 0x40, 0xB4, 0x3A, 0x03, 0x00, 0x02, 0x03, 0x30, 0xFB,
+	 0xBD, 0x00, 0x28, 0x44, 0xBF, 0x60, 0xFF, 0x65, 0xA4, 0x84, 0x40, 0x48, 0x2B, 0x50, 0xA1, 0xFF,
+	 0xFF, 0xFF, 0x01, 0x60, 0x08, 0xE1, 0x1C, 0xF2, 0xC4, 0xE2, 0x40, 0x45, 0x28, 0x40, 0xC4, 0x36,
+	 0x9D, 0x00, 0x29, 0x40, 0x40, 0x2B, 0x49, 0x00, 0x2B, 0x60, 0xBE, 0x63, 0x60, 0x40, 0x0B, 0x36,
+	 0x20, 0x00, 0x0F, 0x36, 0x1B, 0x00, 0x0A, 0x36, 0x16, 0x00, 0x0E, 0x36, 0x11, 0x00, 0x09, 0x36,
+	 0x0C, 0x00, 0x0D, 0x36, 0x07, 0x00, 0x08, 0x36, 0x02, 0x00, 0xA3, 0xD3, 0x15, 0x00, 0x02, 0xA3,
+	 0xA3, 0xD3, 0x12, 0x00, 0x04, 0xA3, 0xA3, 0xD3, 0x0F, 0x00, 0x06, 0xA3, 0xA3, 0xD3, 0x0C, 0x00,
+	 0x08, 0xA3, 0xA3, 0xD3, 0x09, 0x00, 0x0A, 0xA3, 0xA3, 0xD3, 0x06, 0x00, 0x0C, 0xA3, 0xA3, 0xD3,
+	 0x03, 0x00, 0x0E, 0xA3, 0xA3, 0xD3, 0xFF, 0xFF, 0x25, 0x60, 0x82, 0x63, 0x60, 0x40, 0x0C, 0x36,
+	 0x19, 0x00, 0x08, 0x36, 0x15, 0x00, 0x0D, 0x36, 0x11, 0x00, 0x09, 0x36, 0x0D, 0x00, 0x0E, 0x36,
+	 0x09, 0x00, 0x0A, 0x36, 0x05, 0x00, 0x0F, 0x36, 0x01, 0x00, 0x3A, 0x00, 0x02, 0xA3, 0x38, 0x00,
+	 0x04, 0xA3, 0x36, 0x00, 0x06, 0xA3, 0x34, 0x00, 0x08, 0xA3, 0x32, 0x00, 0x0A, 0xA3, 0x30, 0x00,
+	 0x0C, 0xA3, 0x2E, 0x00, 0x0E, 0xA3, 0x2C, 0x00, 0x2B, 0x00, 0x2B, 0x60, 0xCE, 0x63, 0x25, 0x44,
+	 0x0A, 0x36, 0x0C, 0x00, 0x14, 0x36, 0x07, 0x00, 0x37, 0x36, 0x02, 0x00, 0xA3, 0xD3, 0x09, 0x00,
+	 0x02, 0xA3, 0xA3, 0xD3, 0x06, 0x00, 0x04, 0xA3, 0xA3, 0xD3, 0x03, 0x00, 0x06, 0xA3, 0xA3, 0xD3,
+	 0xFF, 0xFF, 0x40, 0x45, 0x0A, 0x36, 0x0D, 0x00, 0x14, 0x36, 0x38, 0x64, 0x37, 0x3A, 0x03, 0x00,
+	 0x04, 0x7F, 0x40, 0x45, 0x15, 0x64, 0x6E, 0x3A, 0x09, 0x00, 0x84, 0x7F, 0x40, 0x45, 0x0B, 0x64,
+	 0x05, 0x00, 0x29, 0x44, 0x7F, 0x60, 0xFF, 0xB4, 0x40, 0x49, 0x70, 0x64, 0x40, 0x4D, 0x02, 0x00,
+	 0x40, 0x45, 0x0A, 0x00, 0x25, 0x60, 0x7A, 0x63, 0x0A, 0x36, 0x06, 0x00, 0x14, 0x36, 0x02, 0xA3,
+	 0x37, 0x36, 0x04, 0xA3, 0x6E, 0x36, 0x06, 0xA3, 0x28, 0xA3, 0xA3, 0xD1, 0xD8, 0xA3, 0x15, 0x60,
+	 0xD8, 0xF9, 0x39, 0xF1, 0xA3, 0xD1, 0x64, 0x41, 0x64, 0x5E, 0x60, 0x45, 0x64, 0x47, 0x1F, 0xB4,
+	 0x54, 0x94, 0xE0, 0xA0, 0x02, 0x0D, 0x00, 0x64, 0x02, 0x00, 0x01, 0x04, 0x1F, 0x64, 0x60, 0x47,
+	 0xB4, 0x85, 0x29, 0x44, 0xC0, 0x60, 0x00, 0xB4, 0xB4, 0x84, 0x1F, 0xFA, 0xB5, 0xFF, 0xA1, 0xFF,
+	 0xAD, 0xF3, 0xC4, 0xE2, 0x89, 0xFF, 0x60, 0x54, 0x88, 0xFF, 0xDC, 0x84, 0xE0, 0x94, 0xFF, 0x60,
+	 0xCF, 0x65, 0x29, 0x44, 0x24, 0x89, 0xA5, 0x60, 0xD6, 0x78, 0x04, 0xE1, 0xA1, 0xFF, 0xFF, 0xFF,
+	 0xC4, 0xE2, 0xA1, 0xFF, 0xFF, 0x60, 0xCF, 0x65, 0x29, 0x44, 0x24, 0x89, 0xAD, 0xF3, 0xC4, 0xE2,
+	 0x89, 0xFF, 0x60, 0x54, 0x88, 0xFF, 0xDC, 0x84, 0xE0, 0x94, 0x26, 0x44, 0x84, 0xBC, 0x24, 0x40,
+	 0x0C, 0x22, 0xFD, 0xB4, 0x40, 0x46, 0x23, 0x64, 0x3A, 0xDB, 0xAC, 0x60, 0xAB, 0x78, 0xFF, 0xFF,
+	 0x27, 0x40, 0x26, 0x22, 0x05, 0x00, 0xF8, 0xB4, 0x40, 0x47, 0x06, 0x64, 0x31, 0xFB, 0xC0, 0xFE,
+	 0x29, 0x40, 0x10, 0x26, 0x02, 0x00, 0x04, 0x74, 0xCD, 0xE2, 0x01, 0x60, 0x18, 0xE1, 0x01, 0x60,
+	 0x18, 0xE1, 0x01, 0x11, 0x0F, 0x00, 0x29, 0x44, 0x20, 0xBC, 0x40, 0x49, 0x01, 0x64, 0x33, 0xFB,
+	 0xB6, 0xFF, 0x00, 0xE1, 0x01, 0x60, 0x1A, 0xE1, 0xA1, 0xFF, 0xFF, 0xFF, 0x6C, 0x40, 0xFC, 0x11,
+	 0x01, 0x60, 0x18, 0xE1, 0xB5, 0xFF, 0x47, 0xFF, 0xB6, 0xFF, 0xB7, 0xFF, 0xB4, 0xFF, 0xC8, 0x60,
+	 0x09, 0x7D, 0x7C, 0x4B, 0x37, 0xF3, 0x2B, 0x45, 0xD4, 0x80, 0xFF, 0xFF, 0x02, 0x28, 0x65, 0x44,
+	 0x60, 0x50, 0xA0, 0x4C, 0x20, 0xBC, 0xFF, 0xB4, 0xA0, 0x51, 0x00, 0x60, 0x2E, 0x7C, 0x74, 0x44,
+	 0xC0, 0x94, 0x32, 0x40, 0x02, 0x2A, 0x19, 0x00, 0x28, 0x44, 0xA4, 0x36, 0x03, 0x00, 0x0C, 0xB4,
+	 0x04, 0x36, 0x13, 0x00, 0x26, 0x43, 0xFD, 0xB3, 0x04, 0xBB, 0x43, 0x46, 0x01, 0x2A, 0x03, 0x00,
+	 0x28, 0x47, 0x40, 0xBF, 0x40, 0x48, 0x0A, 0xBB, 0x0F, 0xFC, 0x50, 0x4B, 0x67, 0x50, 0x00, 0x64,
+	 0x30, 0xFB, 0x05, 0xFF, 0xAC, 0x60, 0xAB, 0x78, 0xFF, 0xFF, 0x24, 0x64, 0x3A, 0xDB, 0x28, 0x44,
+	 0x04, 0x2A, 0x03, 0x00, 0xA4, 0x60, 0x6F, 0x78, 0xFF, 0xFF, 0x1D, 0xFF, 0xA8, 0xE2, 0x26, 0x40,
+	 0x10, 0x2A, 0x06, 0x00, 0x25, 0x60, 0xF0, 0x64, 0xE5, 0x60, 0x78, 0x41, 0xC7, 0x78, 0x97, 0xF1,
+	 0xA4, 0x60, 0x6F, 0x78, 0xFF, 0xFF, 0x03, 0x0A, 0xA4, 0x60, 0x7C, 0x78, 0xFF, 0xFF, 0x01, 0x64,
+	 0x4F, 0xFB, 0xE1, 0xE1, 0xA1, 0xFF, 0xFF, 0xFF, 0x81, 0x3E, 0x54, 0x62, 0x22, 0x46, 0xA2, 0xD0,
+	 0x16, 0x63, 0x7C, 0x41, 0x44, 0x48, 0x80, 0x36, 0x04, 0x61, 0x28, 0x40, 0x50, 0x36, 0x04, 0x61,
+	 0x41, 0x4E, 0x28, 0x44, 0xA4, 0x36, 0x0E, 0x63, 0x0A, 0x60, 0x7C, 0xF1, 0x2D, 0x44, 0xE8, 0x84,
+	 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xC0, 0x84, 0xA2, 0xDB, 0x9A, 0xFF, 0xA1, 0xFF,
+	 0x12, 0x74, 0xCD, 0xE2, 0x54, 0x62, 0xA2, 0xD2, 0xFF, 0xFF, 0x6A, 0x40, 0x80, 0x4E, 0x12, 0x74,
+	 0x7A, 0xD4, 0x12, 0x74, 0x7A, 0xD4, 0x12, 0x74, 0x7A, 0xD4, 0x12, 0x74, 0x7A, 0xD4, 0x12, 0x74,
+	 0x7A, 0xD4, 0x12, 0x74, 0x7A, 0xD4, 0x12, 0x74, 0x7A, 0xD4, 0x12, 0x74, 0xFF, 0xFF, 0x01, 0x1D,
+	 0xB2, 0x00, 0x7A, 0xD4, 0x12, 0x74, 0x7A, 0xD4, 0x12, 0x74, 0x7A, 0xD4, 0x12, 0x74, 0x7A, 0xD4,
+	 0x12, 0x74, 0x28, 0x40, 0x03, 0x2B, 0x06, 0x00, 0x7A, 0xD4, 0x12, 0x74, 0x7A, 0xD4, 0x12, 0x74,
+	 0x7A, 0xD4, 0x12, 0x74, 0x70, 0x62, 0x28, 0x44, 0x8F, 0xB0, 0x88, 0x3A, 0x02, 0x00, 0x7A, 0xD4,
+	 0x12, 0x74, 0x28, 0x40, 0x40, 0x2B, 0x16, 0x00, 0x72, 0x62, 0x7A, 0xD4, 0x12, 0x74, 0x7A, 0xD2,
+	 0x12, 0x74, 0x80, 0x4C, 0x20, 0x2B, 0x05, 0x00, 0x12, 0x74, 0x7A, 0xD4, 0x12, 0x74, 0x7A, 0xD4,
+	 0x12, 0x74, 0x22, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x10, 0x26, 0x04, 0x00, 0x26, 0x26, 0x4D, 0x00,
+	 0x26, 0x27, 0x4B, 0x00, 0x23, 0x43, 0xFF, 0xFF, 0x06, 0x1D, 0x2E, 0x1E, 0x00, 0x00, 0x03, 0xF0,
+	 0x04, 0xF4, 0x64, 0x42, 0x3D, 0x00, 0x2E, 0x40, 0x04, 0x2A, 0x27, 0x00, 0xA1, 0xFF, 0x02, 0xFE,
+	 0x10, 0x25, 0x42, 0xFE, 0x12, 0x74, 0x72, 0x45, 0x65, 0x4C, 0x94, 0xF3, 0x03, 0x04, 0xE4, 0xE2,
+	 0xDC, 0x84, 0x94, 0xFB, 0xA1, 0xFF, 0x12, 0x74, 0x80, 0x4C, 0x12, 0x74, 0x95, 0xF3, 0x02, 0x04,
+	 0xDC, 0x84, 0x95, 0xFB, 0x80, 0x4C, 0x12, 0x74, 0x96, 0xF3, 0x02, 0x04, 0xDC, 0x84, 0x96, 0xFB,
+	 0x80, 0x4C, 0x12, 0x74, 0x5C, 0x4E, 0xF8, 0xA3, 0x03, 0xF2, 0x9A, 0xF2, 0x04, 0xF4, 0xFF, 0xB1,
+	 0xF8, 0xA1, 0x06, 0xA4, 0x60, 0x42, 0x0A, 0x00, 0x4E, 0x00, 0x03, 0xF2, 0x9A, 0xF2, 0x04, 0xF4,
+	 0xC8, 0x82, 0xFF, 0xB1, 0x03, 0x00, 0x00, 0xF4, 0x81, 0xF2, 0xFF, 0xB1, 0x7A, 0xD4, 0x12, 0x74,
+	 0xFD, 0x1C, 0xF9, 0x1D, 0xFF, 0xB1, 0x1B, 0x1E, 0x02, 0x02, 0x00, 0xF4, 0xDA, 0x82, 0xDA, 0x82,
+	 0xA2, 0xD2, 0xA1, 0xFF, 0x09, 0x74, 0x60, 0x4D, 0x12, 0x00, 0x03, 0xF2, 0x9A, 0xF2, 0x04, 0xF4,
+	 0x23, 0x43, 0xA1, 0xFF, 0x12, 0x74, 0xA0, 0xD2, 0xFE, 0xA1, 0xCB, 0x83, 0x60, 0x4E, 0xAF, 0x83,
+	 0x03, 0x1D, 0x05, 0x03, 0x12, 0x74, 0xEB, 0x01, 0xA1, 0xFF, 0x12, 0x74, 0xDF, 0x01, 0x12, 0x74,
+	 0xDA, 0x83, 0x66, 0x44, 0x22, 0x46, 0x0C, 0xFA, 0x22, 0xF2, 0x0B, 0xFC, 0x28, 0x40, 0x40, 0x2B,
+	 0x1A, 0x00, 0x10, 0x26, 0x04, 0x00, 0x26, 0x26, 0x0F, 0x00, 0x26, 0x27, 0x0D, 0x00, 0x00, 0xF4,
+	 0x02, 0x62, 0xA1, 0xFF, 0x12, 0x74, 0x7A, 0xD4, 0x12, 0x74, 0x7A, 0xD4, 0x12, 0x74, 0x7A, 0xD4,
+	 0x12, 0x74, 0x7A, 0xD4, 0x12, 0x74, 0x07, 0x00, 0xA1, 0xFF, 0x12, 0x74, 0x9C, 0x4E, 0x12, 0x74,
+	 0x9C, 0x4C, 0x12, 0x74, 0x00, 0x00, 0x88, 0xFF, 0xA1, 0xFF, 0xB1, 0x60, 0x58, 0x4F, 0x00, 0x78,
+	 0xFF, 0xFF, 0x01, 0x60, 0x18, 0xE1, 0x78, 0x44, 0x02, 0xA4, 0x35, 0xFB, 0xCC, 0x00, 0x29, 0x44,
+	 0xF7, 0xB4, 0x40, 0x49, 0x34, 0x64, 0x3A, 0xDB, 0x44, 0xE1, 0xA5, 0x60, 0xB2, 0x78, 0xFF, 0xFF,
+	 0x00, 0x6B, 0xBC, 0xFF, 0x15, 0xF3, 0xFF, 0xFF, 0xDC, 0x84, 0x15, 0xFB, 0x78, 0x5C, 0x07, 0x00,
+	 0x78, 0x5C, 0x2F, 0x00, 0x62, 0xFF, 0xFF, 0xFF, 0xA1, 0xFF, 0x98, 0xFF, 0x80, 0x3E, 0x80, 0x60,
+	 0x01, 0xE0, 0xD5, 0x60, 0x84, 0xE7, 0x82, 0xF3, 0x40, 0x60, 0x60, 0x40, 0x01, 0x23, 0x48, 0x60,
+	 0x5E, 0x65, 0x80, 0x60, 0x00, 0x6A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x65, 0x4A, 0xFF, 0xFF,
+	 0x01, 0x16, 0xFE, 0x01, 0x00, 0x60, 0x00, 0x6A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x80, 0x60,
+	 0x00, 0x6A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x65, 0x4A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01,
+	 0x00, 0x60, 0x01, 0x6A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x95, 0x60, 0x84, 0xE7, 0x64, 0x58,
+	 0xFF, 0xFF, 0x80, 0x60, 0x01, 0xE0, 0xD5, 0x60, 0x84, 0xE7, 0x82, 0xF3, 0x7C, 0x45, 0x60, 0x40,
+	 0x01, 0x23, 0x02, 0x65, 0x8C, 0x60, 0x48, 0x6A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x00, 0x60,
+	 0x00, 0x6A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x00, 0x60, 0x7F, 0x6A, 0xFF, 0xFF, 0x01, 0x16,
+	 0xFE, 0x01, 0x84, 0x60, 0x04, 0x6A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x48, 0x60, 0x08, 0x6A,
+	 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x65, 0x4A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x84, 0x60,
+	 0x04, 0x6A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x40, 0x60, 0x08, 0x6A, 0xFF, 0xFF, 0x01, 0x16,
+	 0xFE, 0x01, 0x65, 0x4A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x8C, 0x60, 0x48, 0x6A, 0xFF, 0xFF,
+	 0x01, 0x16, 0xFE, 0x01, 0x00, 0x60, 0x00, 0x6A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x00, 0x60,
+	 0x00, 0x6A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x95, 0x60, 0x84, 0xE7, 0x64, 0x58, 0xFF, 0xFF,
+	 0x12, 0x74, 0x6A, 0x40, 0x87, 0x4F, 0x12, 0x74, 0x87, 0x4C, 0x12, 0x74, 0x29, 0x40, 0x40, 0x2B,
+	 0x08, 0x00, 0x0A, 0x64, 0x89, 0xFF, 0x60, 0x54, 0x88, 0xFF, 0x87, 0x4D, 0x12, 0x74, 0x87, 0x4D,
+	 0x09, 0x00, 0x03, 0x64, 0x89, 0xFF, 0x60, 0x54, 0x88, 0xFF, 0x87, 0x4F, 0x12, 0x74, 0x87, 0x4D,
+	 0x12, 0x74, 0x87, 0x4D, 0x7C, 0x44, 0x01, 0x08, 0x01, 0x00, 0x67, 0x44, 0x12, 0x74, 0x87, 0x4C,
+	 0x12, 0x74, 0x87, 0x4C, 0x12, 0x74, 0x87, 0x4C, 0x12, 0x74, 0x87, 0x4D, 0x12, 0x74, 0x87, 0x4D,
+	 0x12, 0x74, 0x87, 0x4D, 0x12, 0x74, 0x04, 0x21, 0x04, 0x00, 0xFF, 0x2A, 0x01, 0x00, 0x04, 0x00,
+	 0x03, 0x00, 0xFF, 0x2A, 0x0D, 0x00, 0x0C, 0x00, 0xBC, 0xFF, 0x61, 0xFF, 0x78, 0x5C, 0x57, 0x01,
+	 0x78, 0x5C, 0x7F, 0x01, 0xB6, 0xFF, 0xB7, 0xFF, 0xB4, 0xFF, 0xC8, 0x60, 0x09, 0x7D, 0x7C, 0x4B,
+	 0x6A, 0x44, 0x2F, 0x58, 0xFF, 0xFF, 0x04, 0x74, 0xC4, 0xE2, 0x04, 0xE1, 0x29, 0x40, 0x40, 0x2B,
+	 0x05, 0x00, 0xA1, 0xFF, 0xFF, 0xFF, 0xBC, 0xFF, 0x14, 0x74, 0x01, 0x00, 0x04, 0x74, 0xC4, 0xE2,
+	 0x04, 0xE1, 0xBC, 0xFF, 0xB5, 0xFF, 0x47, 0xFF, 0xB6, 0xFF, 0xB7, 0xFF, 0xB4, 0xFF, 0xC8, 0x60,
+	 0x09, 0x7D, 0x7C, 0x4B, 0x29, 0x40, 0x40, 0x27, 0x04, 0x00, 0xC2, 0x60, 0x58, 0x4F, 0xC8, 0x78,
+	 0xFF, 0xFF, 0xA1, 0xFF, 0x29, 0x40, 0x10, 0x26, 0x6D, 0x00, 0x80, 0x60, 0x01, 0xE0, 0xD5, 0x60,
+	 0x84, 0xE7, 0x82, 0xF3, 0x40, 0x60, 0x60, 0x40, 0x01, 0x23, 0x48, 0x60, 0x5E, 0x65, 0x80, 0x60,
+	 0x00, 0x6A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x65, 0x4A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01,
+	 0x00, 0x60, 0x00, 0x6A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x80, 0x60, 0x00, 0x6A, 0xFF, 0xFF,
+	 0x01, 0x16, 0xFE, 0x01, 0x65, 0x4A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x00, 0x60, 0x01, 0x6A,
+	 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x95, 0x60, 0x84, 0xE7, 0x80, 0x60, 0x01, 0xE0, 0xD5, 0x60,
+	 0x84, 0xE7, 0x82, 0xF3, 0x7C, 0x45, 0x60, 0x40, 0x01, 0x23, 0x02, 0x65, 0x8C, 0x60, 0x48, 0x6A,
+	 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x00, 0x60, 0x00, 0x6A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01,
+	 0x00, 0x60, 0x7F, 0x6A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x84, 0x60, 0x04, 0x6A, 0xFF, 0xFF,
+	 0x01, 0x16, 0xFE, 0x01, 0x48, 0x60, 0x08, 0x6A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x65, 0x4A,
+	 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x84, 0x60, 0x04, 0x6A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01,
+	 0x40, 0x60, 0x08, 0x6A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x65, 0x4A, 0xFF, 0xFF, 0x01, 0x16,
+	 0xFE, 0x01, 0x8C, 0x60, 0x48, 0x6A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x00, 0x60, 0x00, 0x6A,
+	 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x00, 0x60, 0x00, 0x6A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01,
+	 0x95, 0x60, 0x84, 0xE7, 0x01, 0x60, 0x08, 0xE1, 0xFF, 0xFF, 0xC4, 0xE2, 0x29, 0x40, 0x40, 0x2B,
+	 0x04, 0x00, 0xC2, 0x60, 0x58, 0x4F, 0xC8, 0x78, 0xFF, 0xFF, 0xC2, 0x60, 0x58, 0x4F, 0xD0, 0x78,
+	 0xFF, 0xFF, 0xA1, 0xFF, 0xAD, 0xF3, 0xC4, 0xE2, 0x89, 0xFF, 0x60, 0x54, 0x88, 0xFF, 0xDC, 0x84,
+	 0xE0, 0x94, 0x35, 0xF7, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x01, 0x08, 0xE1, 0xA1, 0xFF, 0xFF, 0xFF,
+	 0x43, 0xFF, 0x01, 0x60, 0x00, 0xE1, 0x28, 0xF3, 0x47, 0xFF, 0x60, 0x40, 0x07, 0x37, 0x66, 0x00,
+	 0x05, 0x3B, 0x04, 0x00, 0xFF, 0x0A, 0x80, 0xE1, 0xA1, 0xFF, 0xFF, 0xFF, 0x18, 0x60, 0x07, 0xF1,
+	 0xAD, 0x4F, 0x00, 0x7F, 0xFA, 0xB4, 0x64, 0x41, 0x64, 0xF1, 0x02, 0xB1, 0x04, 0x65, 0x02, 0x02,
+	 0x64, 0x40, 0x01, 0x2B, 0x01, 0x65, 0xB4, 0x84, 0xA0, 0x5D, 0x29, 0xF5, 0x2A, 0xF3, 0x47, 0xFF,
+	 0x3F, 0xF0, 0x01, 0x1B, 0x01, 0x64, 0x60, 0x56, 0xAD, 0xE2, 0xB5, 0xFF, 0x6C, 0x40, 0x40, 0xE1,
+	 0xA1, 0xFF, 0x00, 0xF4, 0x6E, 0x61, 0x12, 0x62, 0x64, 0x43, 0x01, 0xE1, 0x03, 0x64, 0xE2, 0xD0,
+	 0xC9, 0x81, 0x64, 0x4C, 0xCC, 0x84, 0xDA, 0x82, 0xFA, 0x02, 0x01, 0x60, 0x00, 0x6B, 0x9A, 0xFF,
+	 0xCA, 0x82, 0x03, 0x00, 0x00, 0xF4, 0x81, 0xF2, 0xFF, 0xFF, 0x7A, 0xD0, 0xA1, 0xFF, 0x64, 0x4C,
+	 0xFC, 0x1C, 0xF8, 0x1D, 0x00, 0xB9, 0x06, 0x1E, 0x02, 0x02, 0x00, 0xF4, 0xDA, 0x82, 0x5A, 0xD2,
+	 0xA1, 0xFF, 0x60, 0x4D, 0x3F, 0x40, 0x02, 0x2B, 0x10, 0x00, 0x28, 0xF3, 0xA5, 0x60, 0xC4, 0x65,
+	 0x60, 0x40, 0x0E, 0x3B, 0x0A, 0x00, 0xD2, 0xF3, 0xFF, 0xFF, 0x10, 0xBC, 0xD2, 0xFB, 0xAD, 0x4F,
+	 0x02, 0xBC, 0x00, 0x7F, 0xA0, 0x5D, 0x85, 0x4C, 0xFE, 0x01, 0xD2, 0xF3, 0xFF, 0xFF, 0x02, 0xBC,
+	 0xD2, 0xFB, 0xA1, 0xFF, 0x87, 0x4E, 0x87, 0x4C, 0x87, 0x4C, 0x87, 0x4C, 0x87, 0x4C, 0x67, 0x4C,
+	 0xFF, 0xFF, 0xBC, 0xFF, 0x00, 0xE1, 0xD5, 0xFE, 0xA1, 0xFF, 0xFF, 0xFF, 0x00, 0x64, 0x40, 0x46,
+	 0x60, 0x41, 0xB5, 0xFF, 0xB7, 0xFF, 0xB4, 0xFF, 0x29, 0xF5, 0x3F, 0xF0, 0x24, 0xF2, 0x44, 0x43,
+	 0x40, 0x4D, 0x00, 0xF4, 0xF3, 0x60, 0xA0, 0x65, 0x10, 0x62, 0x5A, 0xD2, 0xD9, 0x81, 0xD4, 0x80,
+	 0xFF, 0xFF, 0xFB, 0x02, 0x61, 0x45, 0x2D, 0x44, 0xD4, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84,
+	 0xFD, 0xA5, 0x48, 0x60, 0x00, 0x64, 0xC4, 0x9D, 0x0D, 0x60, 0x00, 0x6B, 0x2D, 0x44, 0xC0, 0x83,
+	 0xBB, 0xFF, 0x29, 0xF5, 0x01, 0xE1, 0x00, 0xF4, 0x6C, 0x61, 0x10, 0x62, 0x05, 0x00, 0x00, 0xF4,
+	 0x01, 0xF2, 0xFF, 0xFF, 0x60, 0x41, 0x04, 0x62, 0xA1, 0xFF, 0xFF, 0xFF, 0x01, 0x10, 0x1A, 0x00,
+	 0x26, 0x44, 0x01, 0x26, 0x0C, 0x00, 0x2D, 0x44, 0xC8, 0x84, 0x40, 0x4D, 0x02, 0x03, 0x6C, 0x45,
+	 0xF3, 0x01, 0x03, 0x15, 0x01, 0x64, 0x05, 0xFA, 0x15, 0x00, 0x6C, 0x45, 0xED, 0x01, 0x23, 0x44,
+	 0xC8, 0x84, 0x40, 0x43, 0x02, 0x03, 0x6C, 0x45, 0xE7, 0x01, 0x00, 0x64, 0x01, 0x15, 0x01, 0x64,
+	 0x6C, 0x45, 0x05, 0xFB, 0xE2, 0xD2, 0xDA, 0x82, 0xC9, 0x81, 0x60, 0x4C, 0xDD, 0x1C, 0xD7, 0x03,
+	 0xBC, 0xFF, 0xDA, 0x01, 0x00, 0xE1, 0xD5, 0xFE, 0xA1, 0xFF, 0xFF, 0xFF, 0x08, 0xE1, 0xA1, 0xFF,
+	 0x67, 0x4C, 0x43, 0xFF, 0xD2, 0xF3, 0xFF, 0xFF, 0x10, 0xBC, 0xD2, 0xFB, 0xAD, 0x4F, 0x02, 0xBC,
+	 0x00, 0x7F, 0xA0, 0x5D, 0x01, 0xE1, 0x01, 0x60, 0x69, 0x6B, 0xA5, 0x60, 0xC4, 0x64, 0x60, 0x4C,
+	 0xBB, 0xFF, 0xA1, 0xFF, 0xFF, 0xFF, 0x60, 0x4C, 0xA1, 0xFF, 0xFF, 0xFF, 0x60, 0x4C, 0xFC, 0x01,
+	 0x29, 0xF3, 0x2A, 0xF1, 0x07, 0xB5, 0x04, 0xE1, 0x65, 0x41, 0x64, 0x54, 0xCD, 0xE2, 0x95, 0x81,
+	 0xA1, 0x5D, 0xA1, 0xFF, 0xFF, 0xFF, 0xF9, 0x01, 0x10, 0x61, 0x7F, 0x60, 0xC0, 0x64, 0xA0, 0x80,
+	 0x7F, 0x67, 0x02, 0x63, 0x25, 0x02, 0x98, 0xFE, 0x19, 0x05, 0x0F, 0x60, 0x7F, 0xF5, 0x0E, 0xF2,
+	 0x15, 0x18, 0x02, 0x18, 0x09, 0xF4, 0xFB, 0x01, 0x23, 0x44, 0x00, 0xA8, 0x08, 0x7E, 0x0A, 0x02,
+	 0x66, 0x44, 0x11, 0xFB, 0x46, 0x43, 0x23, 0x47, 0x80, 0xBF, 0x3B, 0x42, 0x04, 0xA2, 0xA2, 0xDB,
+	 0x28, 0xB9, 0x10, 0x7E, 0x00, 0x7F, 0x0E, 0xFA, 0x00, 0x67, 0x0A, 0x00, 0x20, 0x44, 0xDC, 0x85,
+	 0x0F, 0xB4, 0xF7, 0xA0, 0x7F, 0x67, 0x07, 0x63, 0x03, 0x05, 0x45, 0x40, 0x00, 0x67, 0xD8, 0xFE,
+	 0xFF, 0x27, 0x05, 0xFD, 0x0A, 0x7E, 0x04, 0xFB, 0x61, 0x55, 0x48, 0x00, 0x28, 0xFB, 0x01, 0xF3,
+	 0x29, 0xFB, 0x44, 0x46, 0x40, 0x45, 0x10, 0x61, 0x7E, 0x60, 0xC0, 0x64, 0xA0, 0x80, 0x7F, 0x67,
+	 0x02, 0x63, 0x30, 0x02, 0xB5, 0x60, 0x58, 0x4F, 0x4B, 0x78, 0xFF, 0xFF, 0x7F, 0x67, 0x03, 0x63,
+	 0x29, 0x02, 0x26, 0x40, 0x01, 0x2B, 0x23, 0x00, 0x98, 0xFE, 0x18, 0x05, 0x0F, 0x60, 0x7F, 0xF5,
+	 0x0E, 0xF2, 0x14, 0x18, 0x02, 0x18, 0x09, 0xF4, 0xFB, 0x01, 0x23, 0x44, 0x00, 0xA8, 0x08, 0x7E,
+	 0x0A, 0x02, 0x66, 0x44, 0x11, 0xFB, 0x46, 0x43, 0x23, 0x47, 0x80, 0xBF, 0x3B, 0x42, 0x04, 0xA2,
+	 0xA2, 0xDB, 0x08, 0xB9, 0x10, 0x7E, 0x00, 0x7F, 0x0E, 0xFA, 0x09, 0x00, 0x20, 0x44, 0xDC, 0x85,
+	 0x0F, 0xB4, 0xF7, 0xA0, 0x7F, 0x67, 0x07, 0x63, 0x05, 0x05, 0x45, 0x40, 0xD8, 0xFE, 0x00, 0x67,
+	 0xD0, 0xFE, 0xD9, 0xFE, 0xFF, 0x27, 0x05, 0xFD, 0x0B, 0x7E, 0x04, 0xFB, 0x0A, 0x60, 0x7E, 0xF3,
+	 0xFF, 0xFF, 0x20, 0xB0, 0x80, 0xBC, 0x08, 0x28, 0xA2, 0xDB, 0x61, 0x55, 0x66, 0x00, 0x04, 0xB5,
+	 0x82, 0xB5, 0x25, 0x02, 0x04, 0x03, 0x20, 0x44, 0x7F, 0xB4, 0x40, 0x40, 0xA3, 0xD3, 0x99, 0xFE,
+	 0x04, 0x04, 0x02, 0xBC, 0xFE, 0xB4, 0xA3, 0xDB, 0x59, 0x00, 0xBC, 0xF3, 0x20, 0x40, 0x80, 0x26,
+	 0x55, 0x00, 0xA3, 0xD3, 0xFF, 0xA0, 0xF8, 0xB4, 0x02, 0x02, 0xA3, 0xDB, 0x1C, 0x00, 0x04, 0xBC,
+	 0xBF, 0xB4, 0xA3, 0xDB, 0x08, 0xB0, 0x01, 0x64, 0x08, 0x24, 0x02, 0x64, 0x28, 0xFB, 0x20, 0x44,
+	 0x80, 0xBC, 0x40, 0x40, 0xD0, 0xFE, 0x42, 0x00, 0xBF, 0xB4, 0xA3, 0xDB, 0x3F, 0x00, 0x40, 0xB0,
+	 0xFF, 0xFF, 0xFA, 0x02, 0xF8, 0xB4, 0xA3, 0xDB, 0x08, 0xB5, 0x07, 0x7C, 0x01, 0x02, 0xBC, 0xF9,
+	 0x20, 0x44, 0x7F, 0xB4, 0x40, 0x40, 0x14, 0x60, 0xFC, 0x63, 0xA3, 0xD3, 0xFF, 0xFF, 0x20, 0xB5,
+	 0x07, 0xB5, 0x08, 0x28, 0xC4, 0x02, 0x99, 0xFE, 0x29, 0x05, 0x20, 0x44, 0x80, 0x26, 0x26, 0x00,
+	 0x20, 0x2A, 0x03, 0x00, 0xDF, 0xB4, 0x40, 0x40, 0x6A, 0x00, 0x40, 0x2A, 0x1F, 0x00, 0xBF, 0xB4,
+	 0x40, 0x40, 0x09, 0x00, 0xA8, 0xFF, 0x20, 0x44, 0x99, 0xFE, 0x02, 0x05, 0x80, 0x2A, 0x03, 0x00,
+	 0x40, 0xBC, 0x40, 0x40, 0x13, 0x00, 0x00, 0xF1, 0x80, 0xBC, 0x40, 0x40, 0x64, 0x44, 0xE0, 0x84,
+	 0xE8, 0x84, 0x0A, 0x36, 0x29, 0x01, 0x0B, 0x36, 0x59, 0x01, 0x28, 0xFB, 0x01, 0xF1, 0x29, 0xF9,
+	 0x02, 0xF1, 0x2A, 0xF9, 0x03, 0xF1, 0x2B, 0xF9, 0xD0, 0xFE, 0xAE, 0xFF, 0xA1, 0xFF, 0xFF, 0xFF,
+	 0x82, 0x3E, 0x75, 0x44, 0x02, 0xB0, 0x01, 0xB0, 0x4A, 0x02, 0xDC, 0x02, 0x04, 0xB0, 0x08, 0xB0,
+	 0x0B, 0x02, 0x20, 0x02, 0x40, 0x26, 0xA7, 0xFF, 0x8C, 0xFF, 0x75, 0x40, 0x80, 0x2B, 0x01, 0x00,
+	 0xAB, 0xFF, 0x75, 0x44, 0x8D, 0xFF, 0xEA, 0x01, 0x0A, 0xF3, 0xAA, 0xFF, 0x60, 0x40, 0x20, 0x2B,
+	 0x02, 0x00, 0x38, 0xFF, 0x0D, 0x00, 0x01, 0x26, 0x0C, 0x00, 0xC0, 0x60, 0x00, 0x7C, 0xA0, 0x84,
+	 0x80, 0x3B, 0x02, 0x00, 0xC0, 0x67, 0x03, 0x00, 0x40, 0x3B, 0x02, 0x00, 0x00, 0x67, 0x0A, 0xFB,
+	 0xD5, 0x01, 0xD4, 0x01, 0x0B, 0xF1, 0xAB, 0xFF, 0x64, 0x44, 0xFF, 0x27, 0x1F, 0x00, 0x20, 0x26,
+	 0x03, 0x00, 0x02, 0x60, 0x00, 0x75, 0x1A, 0x00, 0x19, 0xF3, 0xFF, 0xFF, 0x03, 0x1B, 0x04, 0x60,
+	 0x00, 0x75, 0x0A, 0x64, 0xCC, 0x84, 0x19, 0xFB, 0x01, 0x60, 0x00, 0x75, 0x64, 0x40, 0x03, 0x22,
+	 0x0D, 0x00, 0x20, 0x44, 0x80, 0x2A, 0x03, 0x00, 0x20, 0xBC, 0x40, 0x40, 0x07, 0x00, 0xD9, 0xFE,
+	 0x81, 0x60, 0x0B, 0x64, 0x28, 0xFB, 0x2C, 0x44, 0x29, 0xFB, 0xD0, 0xFE, 0xAF, 0x01, 0xA9, 0xFF,
+	 0x77, 0x44, 0x60, 0x57, 0x40, 0x4A, 0x01, 0x2A, 0x20, 0x00, 0x24, 0x44, 0xAC, 0x86, 0x08, 0xF2,
+	 0x1C, 0x03, 0x1F, 0x60, 0x04, 0x65, 0xD4, 0x80, 0x0E, 0xF2, 0x02, 0x03, 0xA5, 0xD5, 0x04, 0x00,
+	 0x01, 0xBC, 0x0E, 0xFA, 0x09, 0xF4, 0xD1, 0xFE, 0x46, 0x44, 0x0F, 0x18, 0x3F, 0xF2, 0x48, 0x65,
+	 0xC4, 0x84, 0x13, 0xFB, 0x66, 0x44, 0x10, 0xFB, 0x66, 0x47, 0x20, 0xBF, 0x3B, 0x42, 0x04, 0xA2,
+	 0xA2, 0xDB, 0x0E, 0xF2, 0x41, 0x75, 0x10, 0xBC, 0x0E, 0xFA, 0x2A, 0x44, 0x08, 0x2A, 0x17, 0x00,
+	 0x23, 0x44, 0x00, 0xA8, 0x5C, 0x43, 0x13, 0x03, 0x0F, 0x60, 0x7F, 0xF5, 0x01, 0x00, 0x09, 0xF4,
+	 0x0E, 0xF2, 0x0D, 0x18, 0x08, 0xB0, 0x18, 0xAC, 0xFA, 0x03, 0x0E, 0xFA, 0x66, 0x43, 0x11, 0xFD,
+	 0x46, 0x43, 0x23, 0x47, 0x80, 0xBF, 0x3B, 0x42, 0x04, 0xA2, 0xA2, 0xDB, 0x28, 0x75, 0x2A, 0x44,
+	 0x06, 0x22, 0x2D, 0x00, 0x22, 0x44, 0x00, 0xA8, 0x60, 0x46, 0x0E, 0xF2, 0x28, 0x03, 0x10, 0xB0,
+	 0x01, 0xBC, 0x03, 0x02, 0x00, 0x64, 0x40, 0x42, 0x22, 0x00, 0x0E, 0xFA, 0xD1, 0xFE, 0x1E, 0x60,
+	 0xF8, 0x64, 0x40, 0x47, 0x58, 0x4F, 0x80, 0x00, 0x46, 0x42, 0x19, 0x02, 0x22, 0x47, 0x40, 0xBF,
+	 0x3B, 0x42, 0x04, 0xA2, 0xA2, 0xDB, 0x23, 0xF2, 0x66, 0x43, 0x00, 0xA8, 0x0E, 0xF2, 0x08, 0x02,
+	 0x60, 0x40, 0x02, 0x2A, 0xE4, 0x01, 0x12, 0xFD, 0x10, 0x64, 0x0E, 0xFA, 0x02, 0x75, 0x07, 0x00,
+	 0x60, 0x40, 0x04, 0x2A, 0xDC, 0x01, 0x12, 0xFD, 0x10, 0x64, 0x0E, 0xFA, 0x04, 0x75, 0x2A, 0x44,
+	 0x80, 0x2A, 0x19, 0x00, 0x21, 0x44, 0xAC, 0x86, 0x0E, 0xF2, 0x15, 0x03, 0x01, 0xBC, 0x0E, 0xFA,
+	 0xD1, 0xFE, 0x1F, 0x60, 0x10, 0x64, 0x40, 0x47, 0x58, 0x4F, 0x56, 0x00, 0x46, 0x41, 0x0B, 0x02,
+	 0x21, 0x47, 0x10, 0xBF, 0x3B, 0x42, 0x04, 0xA2, 0xA2, 0xDB, 0x0E, 0xF2, 0x66, 0x43, 0x08, 0xFD,
+	 0x10, 0xBC, 0x0E, 0xFA, 0x80, 0x75, 0x2A, 0x44, 0x10, 0xB0, 0x20, 0x44, 0x15, 0x03, 0x7F, 0xB4,
+	 0x40, 0x40, 0x14, 0x60, 0xFC, 0x63, 0xA3, 0xD3, 0xFF, 0xFF, 0x20, 0xB0, 0x80, 0xB0, 0x09, 0x03,
+	 0x08, 0x03, 0x40, 0xBC, 0x7F, 0xB4, 0x04, 0xB0, 0xA3, 0xDB, 0x03, 0x03, 0x20, 0x44, 0x80, 0xBC,
+	 0x40, 0x40, 0xB3, 0x60, 0x8B, 0x78, 0xFF, 0xFF, 0xB3, 0x60, 0xBE, 0x78, 0xFF, 0xFF, 0xE8, 0xFE,
+	 0x14, 0x05, 0xEA, 0xFE, 0x24, 0x05, 0xE9, 0xFE, 0x1C, 0x05, 0xE7, 0xFE, 0x09, 0x05, 0x47, 0xFF,
+	 0x20, 0x44, 0x0F, 0x22, 0x03, 0x00, 0xCC, 0x84, 0x40, 0x40, 0x0F, 0x22, 0xB8, 0xFE, 0xEC, 0x01,
+	 0x23, 0x41, 0x00, 0xB9, 0x5C, 0x4A, 0xE8, 0x02, 0x6F, 0x01, 0x24, 0x41, 0x00, 0xB9, 0x1F, 0x60,
+	 0x04, 0x65, 0x45, 0x47, 0xE1, 0x02, 0x58, 0x4F, 0x0F, 0x00, 0xDE, 0x02, 0x5C, 0x4A, 0x46, 0x44,
+	 0x4D, 0x01, 0x22, 0x41, 0x00, 0xB9, 0x5C, 0x4A, 0x08, 0x24, 0x81, 0x01, 0xD5, 0x01, 0x21, 0x41,
+	 0x00, 0xB9, 0x5C, 0x4A, 0xA6, 0x03, 0xD0, 0x01, 0x27, 0xD3, 0x03, 0x00, 0x10, 0xB0, 0x09, 0xF2,
+	 0x04, 0x03, 0xAC, 0x86, 0x0E, 0xF2, 0xFA, 0x02, 0x08, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x0E, 0xF3,
+	 0x0F, 0x60, 0xFE, 0x65, 0x0C, 0xF3, 0x24, 0x86, 0x24, 0x46, 0x60, 0x40, 0xFB, 0x3B, 0x07, 0x00,
+	 0x80, 0x26, 0x02, 0x00, 0x23, 0x46, 0x03, 0x4C, 0x46, 0x61, 0x3A, 0x65, 0x0C, 0x00, 0x2E, 0xF3,
+	 0x40, 0x45, 0xF8, 0x2B, 0x02, 0x00, 0x40, 0x45, 0x03, 0x00, 0x58, 0x4F, 0x44, 0x00, 0x07, 0x02,
+	 0x58, 0x4F, 0x50, 0x00, 0x04, 0x05, 0x66, 0x50, 0x65, 0x52, 0x61, 0x51, 0x09, 0x00, 0x26, 0x47,
+	 0x00, 0xBF, 0x0E, 0xFB, 0x2E, 0xF5, 0x05, 0xF0, 0x80, 0x60, 0x64, 0x50, 0x00, 0x72, 0x7E, 0x71,
+	 0xAC, 0xFF, 0xB3, 0x60, 0xBE, 0x78, 0xFF, 0xFF, 0x8E, 0xFF, 0x0F, 0xF3, 0x0F, 0x60, 0xFE, 0x65,
+	 0x24, 0x86, 0x0D, 0xF3, 0x24, 0x46, 0x60, 0x40, 0xFB, 0x3B, 0x07, 0x00, 0x80, 0x26, 0x02, 0x00,
+	 0x23, 0x46, 0x03, 0x4C, 0x46, 0x61, 0x3A, 0x65, 0x0C, 0x00, 0x2E, 0xF3, 0x40, 0x45, 0xF8, 0x2B,
+	 0x02, 0x00, 0x40, 0x45, 0x03, 0x00, 0x58, 0x4F, 0x16, 0x00, 0x07, 0x02, 0x58, 0x4F, 0x22, 0x00,
+	 0x04, 0x05, 0x66, 0x50, 0x65, 0x52, 0x61, 0x51, 0x09, 0x00, 0x26, 0x47, 0x00, 0xBF, 0x0F, 0xFB,
+	 0x2E, 0xF5, 0x05, 0xF0, 0x80, 0x60, 0x64, 0x50, 0x00, 0x72, 0x7E, 0x71, 0x8D, 0xFF, 0xAD, 0xFF,
+	 0xB3, 0x60, 0xBE, 0x78, 0xFF, 0xFF, 0x25, 0x44, 0x89, 0xF1, 0x8A, 0xF1, 0xD0, 0x80, 0xD0, 0x80,
+	 0x07, 0x04, 0x01, 0x06, 0x05, 0x00, 0x25, 0x46, 0x01, 0xF0, 0x03, 0x67, 0xA0, 0x85, 0x94, 0x80,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x25, 0x46, 0x26, 0x41, 0x46, 0x63, 0x01, 0xF2, 0xFF, 0xFF, 0xFF, 0xB5,
+	 0xD5, 0x81, 0x00, 0xF2, 0x05, 0x04, 0x04, 0x63, 0x60, 0x46, 0xF7, 0x1B, 0x42, 0xFE, 0x0D, 0x00,
+	 0x61, 0x44, 0xC5, 0x81, 0x63, 0x45, 0xC5, 0x81, 0x9C, 0x84, 0xDC, 0x84, 0x01, 0xF2, 0xF0, 0x85,
+	 0xF0, 0x80, 0x65, 0x44, 0xF8, 0x85, 0xFF, 0xFF, 0x02, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0xA2, 0xFF,
+	 0x0F, 0x60, 0x8B, 0xF3, 0xFF, 0xFF, 0xAC, 0x86, 0x0E, 0xF2, 0x07, 0x03, 0x00, 0xA8, 0x09, 0xF2,
+	 0xFA, 0x02, 0x01, 0x67, 0x0E, 0xFA, 0x08, 0xFE, 0x17, 0x00, 0x8B, 0xF3, 0xFF, 0xFF, 0xD8, 0xA0,
+	 0x00, 0xB4, 0x12, 0x06, 0x09, 0x60, 0x08, 0x61, 0x41, 0x4A, 0x7C, 0xA1, 0x0E, 0xA1, 0xA2, 0xFF,
+	 0xB5, 0x60, 0x58, 0x4E, 0xC1, 0x78, 0xFF, 0xFF, 0xA3, 0xFF, 0x06, 0x03, 0x2A, 0x43, 0xB5, 0x60,
+	 0x58, 0x4E, 0xE2, 0x78, 0xFF, 0xFF, 0x08, 0xFE, 0xA3, 0xFF, 0x2D, 0x58, 0xFF, 0xFF, 0x41, 0x4A,
+	 0x42, 0xA1, 0x03, 0x00, 0x41, 0x4A, 0x7C, 0xA1, 0x0E, 0xA1, 0xA2, 0xFF, 0xB5, 0x60, 0x58, 0x4E,
+	 0xC1, 0x78, 0xFF, 0xFF, 0x07, 0x03, 0x2A, 0x43, 0xB5, 0x60, 0x58, 0x4E, 0xE2, 0x78, 0xFF, 0xFF,
+	 0x08, 0xFE, 0x0C, 0x00, 0x0F, 0x60, 0x8B, 0xF3, 0xFF, 0xFF, 0xAC, 0x86, 0x0E, 0xF2, 0x06, 0x03,
+	 0x00, 0xA8, 0x09, 0xF2, 0xFA, 0x02, 0x01, 0x67, 0x0E, 0xFA, 0x08, 0xFE, 0xA3, 0xFF, 0x2D, 0x58,
+	 0xFF, 0xFF, 0x8C, 0xF3, 0x7C, 0x63, 0x00, 0xBE, 0x40, 0x45, 0x1A, 0x03, 0x00, 0x65, 0x65, 0x44,
+	 0xDC, 0x85, 0x84, 0xA1, 0x00, 0xF2, 0x06, 0x06, 0x01, 0xFC, 0x00, 0xA8, 0x60, 0x46, 0xF7, 0x02,
+	 0x40, 0x45, 0x0E, 0x00, 0x8B, 0xF3, 0x00, 0x63, 0xD4, 0x84, 0x8B, 0xFB, 0x80, 0x60, 0x7C, 0x64,
+	 0x01, 0xFA, 0x00, 0xF0, 0x00, 0xFC, 0xD3, 0x80, 0x8C, 0xF9, 0x02, 0x02, 0x8D, 0xF9, 0x08, 0xFE,
+	 0x2E, 0x58, 0xFF, 0xFF, 0x66, 0x44, 0x25, 0x46, 0x05, 0xFA, 0x06, 0xFA, 0x01, 0xF0, 0x03, 0x67,
+	 0x02, 0xFC, 0xB0, 0x84, 0x3A, 0x7E, 0x01, 0xFA, 0x12, 0x64, 0x03, 0xFA, 0x00, 0xF0, 0x04, 0xF8,
+	 0x00, 0x64, 0x0C, 0x61, 0x10, 0x63, 0x59, 0xDA, 0xFE, 0x1F, 0x2E, 0x58, 0xFF, 0xFF, 0x27, 0x43,
+	 0xE3, 0x81, 0xE9, 0x81, 0x03, 0x05, 0x16, 0x03, 0x00, 0x61, 0x01, 0x00, 0xEC, 0x63, 0x61, 0x46,
+	 0xBF, 0xD2, 0x27, 0x45, 0xDC, 0x84, 0xA2, 0xDA, 0xBE, 0xD2, 0x25, 0x46, 0x88, 0xF8, 0x04, 0x1B,
+	 0x25, 0x44, 0x61, 0x46, 0xA3, 0xDA, 0x04, 0x00, 0x0A, 0xFA, 0x60, 0x46, 0x25, 0x44, 0x09, 0xFA,
+	 0x61, 0x46, 0xBE, 0xDA, 0x2F, 0x58, 0xFF, 0xFF, 0x25, 0x44, 0x00, 0xA8, 0x07, 0x4B, 0x0C, 0x03,
+	 0x58, 0x4F, 0x33, 0x00, 0x0B, 0x47, 0x1F, 0x60, 0x0A, 0x65, 0x27, 0x44, 0xD4, 0x80, 0x00, 0x64,
+	 0x01, 0x02, 0x0F, 0xFA, 0x58, 0x4F, 0xD3, 0x01, 0x70, 0x00, 0x25, 0x43, 0xE3, 0x84, 0x7C, 0x41,
+	 0x02, 0x04, 0xE8, 0x81, 0xEC, 0x63, 0x61, 0x46, 0xA3, 0xD2, 0x00, 0x7C, 0x40, 0x45, 0xBF, 0xD8,
+	 0xA3, 0xD8, 0xBE, 0xD8, 0x27, 0x42, 0x5A, 0xD3, 0x25, 0x5C, 0x60, 0x41, 0x02, 0x1B, 0x27, 0xD9,
+	 0x05, 0x00, 0x25, 0x46, 0x0A, 0xFA, 0x61, 0x46, 0x25, 0x44, 0x09, 0xFA, 0x25, 0x44, 0x27, 0x43,
+	 0x00, 0x61, 0x60, 0x46, 0x09, 0xF2, 0x08, 0xFC, 0x00, 0xA8, 0xDD, 0x81, 0xFA, 0x02, 0xBF, 0xD1,
+	 0x66, 0x44, 0xBE, 0xDB, 0xC1, 0x84, 0xBF, 0xDB, 0x48, 0x00, 0x25, 0x46, 0xEC, 0x63, 0x08, 0xF2,
+	 0x89, 0xF2, 0x1E, 0x18, 0x40, 0x47, 0xE0, 0x84, 0xE8, 0x85, 0x02, 0x05, 0xE8, 0x83, 0x00, 0x65,
+	 0x65, 0x46, 0xBF, 0xD2, 0x61, 0x5C, 0xCC, 0x84, 0xA2, 0xDA, 0x25, 0x46, 0x0A, 0xF2, 0x00, 0xB9,
+	 0x65, 0x46, 0x08, 0x24, 0xBE, 0xDA, 0x02, 0x1B, 0xA3, 0xD8, 0x02, 0x00, 0x60, 0x46, 0x89, 0xFA,
+	 0x00, 0xB9, 0x61, 0x46, 0x08, 0x28, 0x0A, 0xFA, 0x25, 0x46, 0x89, 0xFC, 0x8A, 0xFC, 0x88, 0xFC,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x00, 0x61, 0x28, 0x65, 0x25, 0x43, 0x8D, 0xF3, 0xAF, 0x83, 0x00, 0xBE,
+	 0x18, 0x03, 0x02, 0x03, 0x00, 0xFC, 0x01, 0x00, 0x8C, 0xFD, 0x63, 0x46, 0x65, 0x44, 0xCC, 0x85,
+	 0x00, 0xF2, 0x07, 0x02, 0x8D, 0xF5, 0x00, 0x64, 0x00, 0xFA, 0xDE, 0x60, 0xAF, 0x64, 0x09, 0xFB,
+	 0x08, 0x00, 0x66, 0x43, 0x00, 0xBE, 0xDD, 0x81, 0xF1, 0x02, 0x8B, 0xF1, 0x8D, 0xFD, 0xC1, 0x84,
+	 0x8B, 0xFB, 0x2E, 0x58, 0xFF, 0xFF, 0x00, 0x66, 0x46, 0x45, 0x29, 0x43, 0xFC, 0xA3, 0x66, 0x44,
+	 0xBD, 0xDB, 0x25, 0x44, 0xBD, 0xDB, 0x00, 0x64, 0xBD, 0xDB, 0x03, 0x61, 0x0E, 0x65, 0x1F, 0x60,
+	 0x1E, 0x63, 0x43, 0x49, 0xA3, 0xD3, 0x06, 0xA3, 0x00, 0xA8, 0xCD, 0x81, 0x04, 0x02, 0xF9, 0x02,
+	 0xB3, 0x60, 0xBE, 0x78, 0xFF, 0xFF, 0x01, 0x26, 0xE6, 0x01, 0xD4, 0x80, 0x60, 0x45, 0xE3, 0x05,
+	 0xF6, 0xA3, 0xBD, 0xD1, 0xBD, 0xD1, 0x44, 0x47, 0x44, 0x48, 0x44, 0x45, 0x1F, 0x60, 0x60, 0x64,
+	 0x44, 0xD7, 0xFF, 0xFF, 0xFF, 0xFF, 0x48, 0xFE, 0x8C, 0xF5, 0x8B, 0xF3, 0x0D, 0x18, 0xCC, 0x84,
+	 0x8B, 0xFB, 0x80, 0x60, 0x7C, 0x64, 0x01, 0xFA, 0x00, 0x64, 0x00, 0xF0, 0x00, 0xFA, 0xD0, 0x80,
+	 0x8C, 0xF9, 0x02, 0x02, 0x8D, 0xF9, 0x08, 0xFE, 0x2E, 0x58, 0xFF, 0xFF, 0x1E, 0x60, 0xCE, 0x63,
+	 0x0D, 0x65, 0x00, 0x61, 0x41, 0x48, 0xA3, 0xD3, 0x06, 0xA3, 0xAC, 0x86, 0x00, 0x61, 0x09, 0x03,
+	 0x00, 0xF2, 0x09, 0xF0, 0xAC, 0x86, 0x00, 0xF2, 0xDD, 0x81, 0xFC, 0x02, 0x64, 0x44, 0xAC, 0x86,
+	 0xF6, 0x01, 0x61, 0x44, 0x25, 0x46, 0x27, 0xDA, 0x65, 0x44, 0x28, 0x45, 0x45, 0x88, 0xCC, 0x85,
+	 0x5A, 0x87, 0xE9, 0x02, 0x00, 0x64, 0x27, 0xDA, 0x5A, 0xDA, 0x5A, 0x87, 0x87, 0xF3, 0x86, 0xF1,
+	 0x02, 0xA4, 0x60, 0x46, 0x60, 0x45, 0x00, 0x61, 0x22, 0xF2, 0xFF, 0xFF, 0xAC, 0x86, 0x00, 0xF2,
+	 0x04, 0x03, 0xAC, 0x86, 0x00, 0xF2, 0xDD, 0x81, 0xFC, 0x02, 0x65, 0x44, 0x02, 0xA5, 0x65, 0x46,
+	 0x64, 0x44, 0xCC, 0x9C, 0xFF, 0xFF, 0xF0, 0x02, 0x61, 0x44, 0x25, 0x46, 0x27, 0xDA, 0x5A, 0x87,
+	 0x28, 0x45, 0x45, 0x88, 0x87, 0xF3, 0x86, 0xF1, 0x02, 0xA4, 0x60, 0x46, 0x60, 0x45, 0x00, 0x61,
+	 0x76, 0xF2, 0xFF, 0xFF, 0xAC, 0x86, 0x00, 0xF2, 0x09, 0x03, 0x00, 0xF2, 0x09, 0xF0, 0xAC, 0x86,
+	 0x00, 0xF2, 0xDD, 0x81, 0xFC, 0x02, 0x64, 0x44, 0xAC, 0x86, 0xF6, 0x01, 0x65, 0x44, 0x02, 0xA5,
+	 0x65, 0x46, 0x64, 0x44, 0xCC, 0x9C, 0x61, 0x44, 0xEB, 0x02, 0x25, 0x46, 0x27, 0xDA, 0x5A, 0x87,
+	 0x28, 0x45, 0x45, 0x88, 0x06, 0x60, 0x40, 0x65, 0x8C, 0xF3, 0x01, 0x61, 0xAC, 0x86, 0x00, 0xF2,
+	 0x03, 0x03, 0xD5, 0x80, 0xDD, 0x81, 0xFA, 0x04, 0xCD, 0x84, 0x25, 0x46, 0x27, 0xDA, 0x28, 0x45,
+	 0xC4, 0x84, 0x5A, 0xDA, 0xDA, 0x81, 0x8B, 0xF1, 0x59, 0xD8, 0x1E, 0x60, 0xCC, 0x64, 0x18, 0x63,
+	 0xA0, 0xD1, 0x06, 0xA4, 0x59, 0xD8, 0xFC, 0x1F, 0x00, 0x64, 0x59, 0xDA, 0x59, 0xDA, 0x01, 0x60,
+	 0x1A, 0x64, 0x0A, 0x63, 0x58, 0xD1, 0x59, 0xD8, 0xFD, 0x1F, 0x7D, 0xF1, 0x59, 0xD8, 0x45, 0x01,
+	 0x07, 0x4B, 0xB6, 0x60, 0x58, 0x4F, 0x4D, 0x78, 0xFF, 0xFF, 0x0B, 0x47, 0x58, 0x4F, 0x21, 0x00,
+	 0x3C, 0x01, 0x07, 0x4B, 0xB6, 0x60, 0x58, 0x4F, 0x4D, 0x78, 0xFF, 0xFF, 0x0B, 0x47, 0x27, 0x44,
+	 0x00, 0xBE, 0x08, 0xF0, 0x15, 0x03, 0x64, 0x42, 0x4A, 0xD3, 0x09, 0xF2, 0xDC, 0x83, 0xA2, 0xDD,
+	 0x25, 0x43, 0x09, 0xFC, 0x63, 0x46, 0x27, 0x43, 0x0A, 0xFC, 0x09, 0xFA, 0x08, 0xF8, 0x00, 0xA8,
+	 0x66, 0x43, 0x03, 0x02, 0x64, 0x44, 0x58, 0xDD, 0x03, 0x00, 0x60, 0x46, 0x25, 0x44, 0x0A, 0xFA,
+	 0x1C, 0x01, 0x27, 0x43, 0xE3, 0x81, 0xE9, 0x81, 0x03, 0x05, 0x16, 0x03, 0x00, 0x61, 0x01, 0x00,
+	 0xEC, 0x63, 0x61, 0x46, 0xBF, 0xD2, 0x27, 0x45, 0xDC, 0x84, 0xA2, 0xDA, 0xA3, 0xD2, 0x25, 0x46,
+	 0x88, 0xF8, 0x04, 0x1B, 0x25, 0x44, 0x61, 0x46, 0xBE, 0xDA, 0x04, 0x00, 0x09, 0xFA, 0x60, 0x46,
+	 0x25, 0x44, 0x0A, 0xFA, 0x61, 0x46, 0xA3, 0xDA, 0x2F, 0x58, 0xFF, 0xFF, 0xA0, 0xFE, 0x07, 0x05,
+	 0xA3, 0xFE, 0x07, 0x05, 0xA1, 0xFE, 0x46, 0x05, 0x60, 0x64, 0x3B, 0xDB, 0x0F, 0x00, 0x20, 0x58,
+	 0xFF, 0xFF, 0xFA, 0x01, 0x0A, 0x60, 0x80, 0xF3, 0xFF, 0xFF, 0xFB, 0xB4, 0xA2, 0xDB, 0xA0, 0x4C,
+	 0x59, 0xBC, 0xFF, 0xB4, 0xA0, 0x51, 0xA0, 0x4C, 0x7D, 0xB4, 0xA0, 0x51, 0xA1, 0xFF, 0xFF, 0xFF,
+	 0x83, 0x3E, 0x40, 0x60, 0x0B, 0x65, 0x2B, 0x44, 0x00, 0x63, 0xE8, 0x80, 0xF8, 0x84, 0x02, 0x24,
+	 0x94, 0x84, 0xF3, 0x83, 0xCD, 0x81, 0xFF, 0xFF, 0xF8, 0x02, 0xDF, 0x83, 0x2F, 0x58, 0x40, 0x4B,
+	 0x00, 0x62, 0x01, 0x64, 0xD4, 0x80, 0xE0, 0x84, 0x1A, 0x03, 0xD4, 0x80, 0xE0, 0x84, 0x15, 0x03,
+	 0x61, 0x44, 0x11, 0x61, 0xE0, 0x84, 0xCD, 0x81, 0xFD, 0x04, 0x01, 0x00, 0xE0, 0x84, 0xF2, 0x82,
+	 0xFF, 0xFF, 0x02, 0x24, 0xC6, 0x82, 0x02, 0x28, 0xD6, 0x82, 0xE2, 0x80, 0xCD, 0x81, 0x02, 0x28,
+	 0x01, 0xBC, 0xF4, 0x02, 0x01, 0x2A, 0xC6, 0x82, 0x03, 0x00, 0xE9, 0x81, 0xF2, 0x82, 0x61, 0x44,
+	 0x2D, 0x58, 0xFF, 0xFF, 0x00, 0x64, 0x3B, 0xDB, 0x0C, 0x60, 0x6E, 0xF3, 0x5A, 0xD1, 0x60, 0x40,
+	 0x04, 0x3A, 0x2C, 0x00, 0x00, 0x64, 0x4A, 0xDB, 0x1E, 0x60, 0xCE, 0x63, 0xA3, 0xD3, 0x46, 0x43,
+	 0xAC, 0x86, 0x3C, 0x45, 0x22, 0x03, 0xD4, 0x80, 0x07, 0xF2, 0x02, 0x02, 0x09, 0xF2, 0xF8, 0x01,
+	 0xD0, 0x80, 0x09, 0xF2, 0xF5, 0x02, 0x60, 0x43, 0x80, 0x67, 0xB0, 0x81, 0x61, 0x44, 0x0F, 0x60,
+	 0x90, 0xFB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0x09, 0x60,
+	 0x08, 0x65, 0x0E, 0xF2, 0x02, 0xF2, 0x60, 0x40, 0xF0, 0x37, 0x05, 0x00, 0x8F, 0xF3, 0xD4, 0x80,
+	 0xCC, 0x84, 0x01, 0x02, 0x8F, 0xFB, 0x63, 0x44, 0xDB, 0x01, 0x23, 0x46, 0x3C, 0x44, 0xAC, 0x80,
+	 0xFF, 0xFF, 0x94, 0x02, 0x69, 0xF3, 0x6A, 0xF3, 0x02, 0xA8, 0x02, 0xA8, 0x08, 0x02, 0x00, 0x64,
+	 0x6B, 0xFB, 0x69, 0xFB, 0x6A, 0xFB, 0x00, 0x64, 0x6C, 0xFB, 0xCA, 0xFE, 0x92, 0x00, 0x03, 0x02,
+	 0x00, 0x64, 0x6A, 0xFB, 0xCA, 0xFE, 0x01, 0x64, 0x3B, 0xDB, 0x0F, 0x60, 0x6A, 0xF3, 0xFF, 0xFF,
+	 0x00, 0xA8, 0x60, 0x46, 0x35, 0x03, 0x2C, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x26, 0x86, 0x00,
+	 0x2E, 0xF2, 0x15, 0x60, 0x02, 0x65, 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD3, 0x66, 0x41,
+	 0x60, 0x46, 0x60, 0x43, 0x05, 0xF2, 0x16, 0x18, 0x61, 0x46, 0x2E, 0xF0, 0x63, 0x46, 0xD0, 0x80,
+	 0x04, 0xF2, 0x0C, 0x02, 0x61, 0x46, 0x2D, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x03, 0xF2, 0x06, 0x02,
+	 0x61, 0x46, 0x2C, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0xFF, 0xFF, 0x07, 0x03, 0x80, 0xF4, 0xFF, 0xFF,
+	 0x63, 0x46, 0xE8, 0x1B, 0x87, 0xF3, 0x08, 0xFE, 0x60, 0x43, 0x61, 0x46, 0x5F, 0x02, 0x66, 0x45,
+	 0x63, 0x46, 0x06, 0xF2, 0x65, 0x46, 0x80, 0xB0, 0x09, 0xF2, 0x58, 0x03, 0xAC, 0x86, 0xCA, 0x01,
+	 0x6A, 0xF3, 0xFF, 0xFF, 0x01, 0xA8, 0xFF, 0xFF, 0x4C, 0x02, 0x0F, 0x60, 0x73, 0xF3, 0xFF, 0xFF,
+	 0x00, 0xA8, 0x60, 0x46, 0x0F, 0x03, 0x76, 0xF1, 0x07, 0xF2, 0xFF, 0xFF, 0xD0, 0x80, 0x09, 0xF2,
+	 0x03, 0x02, 0xAC, 0x86, 0x07, 0xF2, 0xFA, 0x02, 0x03, 0x02, 0x00, 0x64, 0x76, 0xFB, 0xED, 0x01,
+	 0x46, 0x5C, 0x3C, 0x00, 0x0F, 0x60, 0x76, 0xF3, 0xFF, 0xFF, 0x00, 0xA8, 0x60, 0x46, 0x01, 0x03,
+	 0x35, 0x02, 0x6B, 0xF3, 0xFF, 0xFF, 0x01, 0xA8, 0xFF, 0xFF, 0x13, 0x02, 0x0F, 0x60, 0x6D, 0xF3,
+	 0xFF, 0xFF, 0x00, 0xA8, 0x60, 0x46, 0x0B, 0x03, 0x2A, 0xF0, 0x20, 0x67, 0x09, 0xF2, 0xB0, 0x83,
+	 0x00, 0xA8, 0x00, 0x64, 0x02, 0x03, 0x2A, 0xFC, 0x01, 0x00, 0x6B, 0xFB, 0x1F, 0x00, 0x00, 0x64,
+	 0x6B, 0xFB, 0x0F, 0x60, 0x67, 0xF3, 0xFF, 0xFF, 0x00, 0xA8, 0x60, 0x46, 0x12, 0x03, 0x2A, 0xF0,
+	 0x08, 0x67, 0xA0, 0x80, 0xFF, 0xFF, 0x12, 0x03, 0x76, 0xF1, 0x07, 0xF2, 0xFF, 0xFF, 0xD0, 0x80,
+	 0x09, 0xF2, 0x03, 0x02, 0xAC, 0x86, 0x07, 0xF2, 0xFA, 0x02, 0x08, 0x02, 0x00, 0x64, 0x76, 0xFB,
+	 0xE8, 0x01, 0x00, 0x64, 0x76, 0xFB, 0xB7, 0x60, 0xA2, 0x78, 0xFF, 0xFF, 0x66, 0x44, 0xFC, 0xFB,
+	 0x46, 0x5C, 0x16, 0x60, 0x2B, 0xF3, 0x0D, 0xF2, 0x60, 0x5C, 0x64, 0x5F, 0x0D, 0xFA, 0x07, 0xF0,
+	 0x2A, 0xF2, 0xFF, 0xFF, 0x76, 0xF9, 0x60, 0x40, 0x08, 0x2B, 0x05, 0x00, 0x00, 0x64, 0x48, 0xFB,
+	 0xBA, 0x60, 0x03, 0x78, 0xFF, 0xFF, 0x00, 0x64, 0xD0, 0x80, 0xFF, 0xFF, 0x07, 0x02, 0x23, 0xF0,
+	 0x04, 0x64, 0xB0, 0x84, 0xA2, 0xDA, 0xBF, 0x60, 0x16, 0x78, 0xFF, 0xFF, 0x2A, 0xF2, 0x00, 0x63,
+	 0x40, 0x47, 0x50, 0x36, 0x01, 0x00, 0x01, 0x63, 0x48, 0xFD, 0x4A, 0xF3, 0x35, 0xFA, 0x10, 0xA4,
+	 0x4A, 0xFB, 0x00, 0x64, 0x15, 0xFA, 0x16, 0xFA, 0x0F, 0xFA, 0x07, 0xF0, 0x87, 0xF3, 0xFF, 0xFF,
+	 0xD0, 0x80, 0xFF, 0xFF, 0x05, 0x03, 0x66, 0x43, 0x64, 0x46, 0x11, 0xF2, 0xBA, 0xFB, 0x63, 0x46,
+	 0x03, 0xF2, 0x00, 0xF4, 0x01, 0xF2, 0xFC, 0xA5, 0x00, 0x7F, 0xD4, 0x84, 0x27, 0x45, 0x3C, 0x46,
+	 0x1A, 0xFA, 0x22, 0x63, 0x7B, 0x60, 0xFF, 0x64, 0xA4, 0x84, 0x03, 0x2B, 0x1C, 0x63, 0x2A, 0xFA,
+	 0x8F, 0xB0, 0x88, 0x36, 0x02, 0xA3, 0x60, 0x40, 0xA4, 0x36, 0x14, 0x63, 0x43, 0x4C, 0x18, 0xFC,
+	 0x00, 0x7C, 0x22, 0xF8, 0x64, 0x41, 0x07, 0xF0, 0x66, 0x43, 0x64, 0x46, 0x3A, 0xF2, 0x63, 0x46,
+	 0xFF, 0xB4, 0x22, 0xFA, 0x60, 0x40, 0x00, 0x36, 0x92, 0x00, 0x2A, 0xF2, 0xFF, 0xFF, 0x0C, 0xB0,
+	 0x08, 0x3A, 0x8D, 0x00, 0x60, 0x40, 0x40, 0x26, 0x8A, 0x00, 0x03, 0xF2, 0x00, 0xF4, 0xA0, 0xD2,
+	 0xAA, 0x60, 0xAA, 0x65, 0x5A, 0xD0, 0xD4, 0x80, 0x03, 0x64, 0x0A, 0x02, 0xD0, 0x80, 0x00, 0x64,
+	 0x5A, 0xD0, 0x06, 0x02, 0xD0, 0x80, 0xF8, 0x7F, 0xD0, 0x80, 0x01, 0x03, 0x01, 0x02, 0x01, 0x61,
+	 0x62, 0x43, 0x46, 0x43, 0x3C, 0x46, 0x07, 0xF4, 0x3A, 0xF2, 0xFF, 0xFF, 0xA3, 0x46, 0x60, 0x40,
+	 0x22, 0x26, 0x49, 0x00, 0x60, 0x45, 0x63, 0x42, 0x5A, 0xD0, 0xCD, 0x81, 0x3C, 0x46, 0x18, 0x02,
+	 0x64, 0x44, 0x88, 0x3A, 0x15, 0x00, 0x8E, 0x37, 0x00, 0x00, 0x65, 0x44, 0x01, 0x26, 0x5F, 0x00,
+	 0x04, 0x26, 0x03, 0x00, 0x10, 0x26, 0x01, 0x00, 0x31, 0x00, 0xA3, 0x46, 0x3B, 0xF2, 0xFF, 0xFF,
+	 0x60, 0x40, 0x80, 0x27, 0x3E, 0x00, 0xA3, 0x46, 0x00, 0x7C, 0x22, 0xF8, 0xA3, 0x46, 0x4F, 0x00,
+	 0xA3, 0x46, 0x65, 0x44, 0x01, 0x26, 0x0B, 0x00, 0x04, 0x26, 0x03, 0x00, 0x10, 0x26, 0x01, 0x00,
+	 0x1D, 0x00, 0x3B, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x80, 0x27, 0x2B, 0x00, 0x17, 0x00, 0x87, 0xF3,
+	 0xFF, 0xFF, 0x60, 0x46, 0x3A, 0xF2, 0x66, 0x43, 0xFF, 0xB4, 0x3C, 0x46, 0x22, 0xF0, 0x60, 0x47,
+	 0xB0, 0x84, 0x22, 0xFA, 0x63, 0x46, 0x3B, 0xF0, 0x60, 0x40, 0x04, 0x27, 0x03, 0x00, 0x10, 0x27,
+	 0x01, 0x00, 0x04, 0x00, 0x64, 0x40, 0x80, 0x27, 0x14, 0x00, 0x00, 0x00, 0x3C, 0x46, 0x02, 0x65,
+	 0xBE, 0x60, 0xB6, 0x78, 0xFF, 0xFF, 0xCD, 0x81, 0x63, 0x42, 0x5A, 0xD0, 0x3C, 0x46, 0x09, 0x02,
+	 0x64, 0x44, 0x88, 0x3A, 0x06, 0x00, 0x77, 0x37, 0x1A, 0x00, 0x78, 0x37, 0x18, 0x00, 0x8E, 0x37,
+	 0x16, 0x00, 0x3C, 0x46, 0x22, 0xF0, 0x80, 0x67, 0xB0, 0x84, 0xA2, 0xDA, 0xFF, 0xFF, 0x3F, 0xF2,
+	 0x3E, 0xF0, 0x08, 0xA4, 0x60, 0x41, 0x22, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x26, 0x03, 0x00,
+	 0x04, 0x26, 0x03, 0x00, 0x04, 0x00, 0x04, 0x2B, 0x02, 0x00, 0x61, 0x44, 0x3F, 0xFA, 0x3C, 0x46,
+	 0x2C, 0xF2, 0x27, 0x40, 0x01, 0x27, 0x32, 0xF2, 0xB4, 0xF1, 0x60, 0x40, 0x01, 0x26, 0x47, 0x00,
+	 0x09, 0x60, 0x00, 0x64, 0xD0, 0x80, 0x3F, 0xF2, 0x09, 0x06, 0x2C, 0x45, 0xC4, 0x84, 0xD0, 0x80,
+	 0x40, 0x4A, 0x34, 0x06, 0x60, 0x43, 0x64, 0x44, 0x54, 0x88, 0x17, 0x00, 0x60, 0x45, 0x13, 0x60,
+	 0x4B, 0xF3, 0xBB, 0xF3, 0x00, 0xBC, 0x60, 0x47, 0xEC, 0xA0, 0x28, 0x03, 0x27, 0x07, 0x2C, 0x44,
+	 0xC4, 0x81, 0x02, 0x60, 0x1C, 0x65, 0x45, 0x4A, 0xD5, 0x80, 0x2C, 0x45, 0x1F, 0x06, 0x27, 0x40,
+	 0x04, 0x27, 0x25, 0x00, 0x2A, 0x43, 0xD7, 0x85, 0x45, 0x48, 0xB5, 0xF1, 0x0F, 0xF2, 0xD3, 0x80,
+	 0x01, 0x65, 0x01, 0x07, 0x00, 0x65, 0xB4, 0x84, 0x0F, 0xFA, 0x00, 0x63, 0x3F, 0xF2, 0x28, 0x45,
+	 0x60, 0x41, 0xD4, 0x84, 0xDF, 0x83, 0xFC, 0x07, 0x14, 0xFC, 0x17, 0xFA, 0x04, 0x60, 0x00, 0x64,
+	 0x27, 0x45, 0xB4, 0x84, 0x2A, 0xFA, 0x28, 0x43, 0x16, 0xFC, 0x0D, 0x00, 0x3F, 0xF2, 0x2C, 0x45,
+	 0xB5, 0xF1, 0xC4, 0x81, 0xD1, 0x80, 0x0F, 0xF2, 0x01, 0x06, 0x01, 0xBC, 0x0F, 0xFA, 0x3F, 0xF2,
+	 0x17, 0xFA, 0x01, 0x64, 0x14, 0xFA, 0x0F, 0xF0, 0xFF, 0xFF, 0x64, 0x40, 0x01, 0x2A, 0x6F, 0x00,
+	 0x64, 0xF1, 0x15, 0x60, 0xDD, 0xF3, 0x64, 0x40, 0x01, 0x27, 0x03, 0x00, 0x60, 0x40, 0x02, 0x26,
+	 0x14, 0x00, 0x07, 0xF0, 0x66, 0x43, 0x64, 0x46, 0x12, 0xF0, 0x15, 0x60, 0xDE, 0xF3, 0x63, 0x46,
+	 0x64, 0x40, 0x10, 0x2A, 0x20, 0x00, 0x60, 0x40, 0x02, 0x26, 0x07, 0x00, 0x01, 0x26, 0x08, 0x00,
+	 0x04, 0x26, 0x09, 0x00, 0x06, 0x61, 0x6E, 0x63, 0x08, 0x00, 0x02, 0x61, 0x14, 0x63, 0x05, 0x00,
+	 0x00, 0x61, 0x0A, 0x63, 0x02, 0x00, 0x04, 0x61, 0x37, 0x63, 0x00, 0x64, 0x25, 0x60, 0xA2, 0x65,
+	 0x45, 0xD1, 0xD5, 0x81, 0x15, 0x60, 0xDA, 0xF9, 0x25, 0x60, 0x7A, 0x65, 0x45, 0xD1, 0x1C, 0xFC,
+	 0xB0, 0x84, 0x1E, 0xFA, 0x3C, 0x00, 0x60, 0x40, 0x10, 0x2A, 0x04, 0x00, 0x08, 0x61, 0x1E, 0x60,
+	 0x0B, 0x63, 0x27, 0x00, 0x20, 0x2A, 0x04, 0x00, 0x0A, 0x61, 0x16, 0x60, 0x0F, 0x63, 0x21, 0x00,
+	 0x40, 0x2A, 0x04, 0x00, 0x0C, 0x61, 0x12, 0x60, 0x0A, 0x63, 0x1B, 0x00, 0x80, 0x2A, 0x04, 0x00,
+	 0x0E, 0x61, 0x0E, 0x60, 0x0E, 0x63, 0x15, 0x00, 0x01, 0x2B, 0x04, 0x00, 0x10, 0x61, 0x0E, 0x60,
+	 0x09, 0x63, 0x0F, 0x00, 0x02, 0x2B, 0x04, 0x00, 0x12, 0x61, 0x0A, 0x60, 0x0D, 0x63, 0x09, 0x00,
+	 0x04, 0x2B, 0x04, 0x00, 0x14, 0x61, 0x0A, 0x60, 0x08, 0x63, 0x03, 0x00, 0x16, 0x61, 0x0A, 0x60,
+	 0x0C, 0x63, 0x1E, 0xF0, 0x40, 0x67, 0x25, 0x60, 0xA2, 0x65, 0x45, 0xD1, 0xD5, 0x81, 0x15, 0x60,
+	 0xDA, 0xF9, 0x25, 0x60, 0x7A, 0x65, 0x45, 0xD1, 0x1C, 0xFC, 0xB0, 0x84, 0x1E, 0xFA, 0xAA, 0xF2,
+	 0x15, 0x60, 0xC2, 0xF3, 0x07, 0xF0, 0x66, 0x43, 0x64, 0x46, 0x44, 0x44, 0x61, 0x40, 0x08, 0x26,
+	 0x02, 0x00, 0x61, 0x40, 0x80, 0x36, 0x12, 0xF2, 0x63, 0x46, 0x2C, 0x60, 0x26, 0x61, 0x00, 0x7F,
+	 0x60, 0x45, 0x45, 0xD3, 0xFF, 0xFF, 0x60, 0x45, 0x00, 0x7F, 0x4B, 0xFB, 0x65, 0x44, 0x00, 0x7E,
+	 0xBB, 0xFB, 0x62, 0xF1, 0x60, 0x43, 0x60, 0x47, 0xD0, 0x80, 0xC0, 0x65, 0x01, 0x06, 0x64, 0x44,
+	 0x0A, 0x36, 0x70, 0x64, 0x14, 0x36, 0x38, 0x64, 0x37, 0x36, 0x15, 0x64, 0x6E, 0x36, 0x0B, 0x64,
+	 0x44, 0x86, 0x2A, 0xF2, 0x07, 0xF0, 0x60, 0x40, 0xB0, 0x3A, 0x03, 0x00, 0x40, 0x3B, 0x01, 0x00,
+	 0x12, 0x00, 0x0C, 0xB4, 0x08, 0x3A, 0x44, 0x00, 0x22, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x80, 0x2B,
+	 0x3F, 0x00, 0x17, 0xF2, 0x22, 0xF0, 0xFF, 0xFF, 0x64, 0x40, 0x22, 0x22, 0x04, 0x00, 0x00, 0xA8,
+	 0x01, 0xA8, 0x36, 0x03, 0x35, 0x03, 0x3C, 0x46, 0x2A, 0xF0, 0x40, 0x67, 0xB0, 0x84, 0xA2, 0xDA,
+	 0x60, 0x45, 0x22, 0xF2, 0xFF, 0xFF, 0x60, 0x43, 0x60, 0x40, 0x01, 0x26, 0x05, 0x00, 0x04, 0x26,
+	 0x1D, 0x00, 0x10, 0x26, 0x10, 0x00, 0x04, 0x00, 0x04, 0x27, 0x18, 0x00, 0x10, 0x27, 0x0B, 0x00,
+	 0x65, 0x44, 0x2A, 0x61, 0x60, 0x40, 0x03, 0x2B, 0x24, 0x61, 0x8F, 0xB0, 0x88, 0x36, 0x02, 0xA1,
+	 0x41, 0x4C, 0x98, 0xFA, 0x15, 0x00, 0x65, 0x44, 0x32, 0x61, 0x60, 0x40, 0x03, 0x2B, 0x2C, 0x61,
+	 0x8F, 0xB0, 0x88, 0x36, 0x02, 0xA1, 0x41, 0x4C, 0x98, 0xFA, 0x0A, 0x00, 0x65, 0x44, 0x2E, 0x61,
+	 0x60, 0x40, 0x03, 0x2B, 0x28, 0x61, 0x8F, 0xB0, 0x88, 0x36, 0x02, 0xA1, 0x41, 0x4C, 0x98, 0xFA,
+	 0xBB, 0x60, 0xFB, 0x78, 0xFF, 0xFF, 0x66, 0x45, 0xAA, 0xF2, 0x15, 0x60, 0xC2, 0xF3, 0x24, 0x46,
+	 0x61, 0x40, 0x08, 0x26, 0x02, 0x00, 0x61, 0x40, 0x80, 0x36, 0x12, 0xF2, 0x65, 0x46, 0x60, 0x40,
+	 0x10, 0x26, 0x34, 0x00, 0x2C, 0x45, 0x17, 0xF2, 0x4B, 0xF1, 0xC4, 0x84, 0xE0, 0x84, 0xE0, 0x84,
+	 0xE0, 0x81, 0x64, 0x45, 0x16, 0xA1, 0xB7, 0x60, 0x58, 0x4D, 0xC0, 0x78, 0xFF, 0xFF, 0x64, 0xF1,
+	 0x01, 0xA4, 0xE0, 0x84, 0xE0, 0x84, 0x64, 0x40, 0x01, 0x2B, 0x06, 0xA4, 0x1B, 0xFA, 0xBB, 0xF3,
+	 0x25, 0x60, 0x82, 0x65, 0x60, 0x40, 0x0B, 0x37, 0x00, 0x63, 0x0F, 0x37, 0x02, 0x63, 0x0A, 0x37,
+	 0x04, 0x63, 0x0E, 0x37, 0x06, 0x63, 0x09, 0x37, 0x08, 0x63, 0x0D, 0x37, 0x0A, 0x63, 0x08, 0x37,
+	 0x0C, 0x63, 0x0C, 0x37, 0x0E, 0x63, 0x28, 0xA3, 0x47, 0xD1, 0xD8, 0xA3, 0xD7, 0x83, 0x15, 0x60,
+	 0xD9, 0xF9, 0x47, 0xD1, 0x40, 0x67, 0xB0, 0x84, 0x1F, 0xFA, 0x56, 0x00, 0x2A, 0xF2, 0xFF, 0xFF,
+	 0x60, 0x40, 0x80, 0x36, 0x17, 0x00, 0x50, 0x36, 0x15, 0x00, 0x10, 0x36, 0x13, 0x00, 0x30, 0x36,
+	 0x11, 0x00, 0xA0, 0x36, 0x0F, 0x00, 0xB0, 0x36, 0x0D, 0x00, 0xC0, 0x36, 0x0B, 0x00, 0xBB, 0xF3,
+	 0xFF, 0xFF, 0x60, 0x40, 0x0A, 0x37, 0x06, 0x00, 0x15, 0x60, 0xDD, 0xF3, 0x80, 0x60, 0x00, 0x61,
+	 0x60, 0x40, 0x04, 0x26, 0x00, 0x61, 0xBB, 0xF3, 0x25, 0x60, 0x7A, 0x65, 0x60, 0x40, 0x0A, 0x37,
+	 0x00, 0x63, 0x14, 0x37, 0x02, 0x63, 0x37, 0x37, 0x04, 0x63, 0x6E, 0x37, 0x06, 0x63, 0x28, 0xA3,
+	 0x47, 0xD1, 0xD8, 0xA3, 0xD7, 0x83, 0x15, 0x60, 0xD9, 0xF9, 0x47, 0xD1, 0xFF, 0xFF, 0xB1, 0x84,
+	 0x1F, 0xFA, 0xBB, 0xF1, 0x2C, 0x45, 0x64, 0x43, 0x17, 0xF2, 0x4B, 0xF1, 0xC4, 0x84, 0xE0, 0x84,
+	 0xE0, 0x84, 0xE0, 0x81, 0x63, 0x40, 0x37, 0x37, 0xE1, 0x81, 0x64, 0x45, 0xB7, 0x60, 0x58, 0x4D,
+	 0xC0, 0x78, 0xFF, 0xFF, 0xAE, 0x82, 0xFC, 0xA2, 0x0A, 0x03, 0x63, 0x40, 0x6E, 0x3B, 0x06, 0x00,
+	 0x60, 0x41, 0x04, 0x0D, 0x63, 0x44, 0x80, 0x7E, 0xBB, 0xFB, 0x61, 0x44, 0xDC, 0x84, 0x2B, 0xF0,
+	 0x1B, 0xFA, 0x64, 0x44, 0x80, 0x27, 0x47, 0x00, 0x07, 0xF0, 0x66, 0x45, 0x64, 0x46, 0x12, 0xF2,
+	 0x65, 0x46, 0x60, 0x40, 0x10, 0x2A, 0x2E, 0x00, 0x16, 0xF2, 0x0F, 0xF0, 0xAC, 0x84, 0x2C, 0x45,
+	 0x29, 0x03, 0x4B, 0xF1, 0xC4, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x81, 0x63, 0x40, 0x37, 0x37,
+	 0xE1, 0x81, 0x64, 0x45, 0x0F, 0xF0, 0xB7, 0x60, 0x58, 0x4D, 0xC0, 0x78, 0xFF, 0xFF, 0xAE, 0x82,
+	 0xFC, 0xA2, 0x0A, 0x03, 0x63, 0x40, 0x6E, 0x3B, 0x06, 0x00, 0x60, 0x41, 0x04, 0x0D, 0x80, 0x67,
+	 0xB0, 0x84, 0x0F, 0xFA, 0x61, 0x44, 0xDC, 0x84, 0x1D, 0xFA, 0xDE, 0x65, 0xC4, 0x85, 0x26, 0x41,
+	 0xE1, 0x81, 0xC5, 0x84, 0x2B, 0xFA, 0x1B, 0xF0, 0xDE, 0x64, 0xC0, 0x85, 0x26, 0x44, 0xE0, 0x84,
+	 0xC4, 0x84, 0x10, 0xFA, 0x26, 0x44, 0x2C, 0xF0, 0x0A, 0xA4, 0x66, 0x45, 0x24, 0x46, 0x92, 0xF2,
+	 0x65, 0x46, 0x9F, 0xF0, 0x61, 0x40, 0x10, 0x2A, 0x03, 0x00, 0x65, 0x40, 0x80, 0x27, 0xA0, 0xA4,
+	 0x64, 0x40, 0x01, 0x26, 0x00, 0x64, 0x11, 0xFA, 0xBB, 0xF3, 0x13, 0xFA, 0x7C, 0x44, 0x1D, 0xFA,
+	 0xFF, 0xFF, 0x0D, 0xF2, 0x3E, 0xF0, 0x60, 0x47, 0xFF, 0xB4, 0x64, 0x41, 0x01, 0xB1, 0x01, 0x63,
+	 0x17, 0x02, 0x60, 0x41, 0xFF, 0x22, 0x04, 0x00, 0xB7, 0x60, 0x58, 0x4F, 0xB1, 0x78, 0xFF, 0xFF,
+	 0x07, 0x60, 0xF7, 0xFD, 0x16, 0x60, 0x2B, 0xF3, 0xFF, 0xFF, 0x60, 0x41, 0x01, 0x63, 0x61, 0x40,
+	 0xFF, 0x22, 0x04, 0x00, 0xB7, 0x60, 0x58, 0x4F, 0xB1, 0x78, 0xFF, 0xFF, 0x07, 0x60, 0xF8, 0xFD,
+	 0xBD, 0x60, 0x7A, 0x78, 0xFF, 0xFF, 0x2A, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x40, 0x27, 0x03, 0x00,
+	 0xBD, 0x60, 0x75, 0x78, 0xFF, 0xFF, 0x22, 0xF2, 0x46, 0x43, 0x60, 0x40, 0x22, 0x26, 0x09, 0x00,
+	 0x01, 0x26, 0x0A, 0x00, 0x04, 0x26, 0x4B, 0x00, 0x10, 0x26, 0x10, 0x00, 0xBD, 0x60, 0x75, 0x78,
+	 0xFF, 0xFF, 0xBC, 0x60, 0xF0, 0x78, 0xFF, 0xFF, 0x04, 0x27, 0x3D, 0x00, 0x10, 0x27, 0x03, 0x00,
+	 0xBD, 0x60, 0x75, 0x78, 0xFF, 0xFF, 0x87, 0xF3, 0x3C, 0xF1, 0x02, 0x00, 0x07, 0xF2, 0x00, 0x7C,
+	 0x40, 0x43, 0x2A, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x08, 0x27, 0x21, 0x00, 0xA3, 0x46, 0x4B, 0xF2,
+	 0xFF, 0xFF, 0xDC, 0x84, 0x4B, 0xFA, 0x4A, 0xF2, 0x08, 0x04, 0xDC, 0x84, 0x4A, 0xFA, 0x49, 0xF2,
+	 0x04, 0x04, 0xDC, 0x84, 0x49, 0xFA, 0x01, 0x04, 0xFF, 0xFF, 0x87, 0xF3, 0x66, 0x5C, 0xD0, 0x80,
+	 0x00, 0x7C, 0x01, 0x02, 0x3C, 0xF1, 0x4B, 0xF0, 0x64, 0x47, 0x20, 0xBF, 0xA3, 0x46, 0x3A, 0xF8,
+	 0x3B, 0xFA, 0xA3, 0x46, 0x4A, 0xF2, 0x49, 0xF0, 0xA3, 0x46, 0x3C, 0xFA, 0x3D, 0xF8, 0x0F, 0x60,
+	 0xA0, 0x64, 0xA3, 0x46, 0x76, 0x61, 0x0E, 0x63, 0x59, 0xD0, 0x58, 0xD9, 0xFD, 0x1F, 0xA3, 0x46,
+	 0xBD, 0x60, 0x75, 0x78, 0xFF, 0xFF, 0x87, 0xF3, 0xFF, 0xFF, 0x60, 0x46, 0x02, 0x00, 0x07, 0xF4,
+	 0xFF, 0xFF, 0xA3, 0x46, 0x2A, 0xF2, 0xA3, 0x46, 0x60, 0x40, 0x08, 0x27, 0x48, 0x00, 0x87, 0xF3,
+	 0x66, 0x5C, 0xD0, 0x80, 0x3B, 0xF0, 0x08, 0x03, 0x64, 0x40, 0x10, 0x2A, 0x12, 0x00, 0xFF, 0x60,
+	 0xEF, 0x64, 0xA0, 0x84, 0x3B, 0xFA, 0x24, 0x00, 0x3D, 0xF3, 0x01, 0x61, 0x60, 0x43, 0xCF, 0x83,
+	 0xE1, 0x81, 0xFD, 0x0D, 0xE9, 0x81, 0xA1, 0x80, 0xFF, 0xFF, 0x03, 0x03, 0x91, 0x84, 0x3B, 0xFA,
+	 0x17, 0x00, 0x4B, 0xF2, 0xFF, 0xFF, 0x10, 0xA0, 0xFF, 0xFF, 0x02, 0x04, 0xFF, 0x60, 0xFF, 0x64,
+	 0xDC, 0x84, 0x4B, 0xFA, 0x4A, 0xF2, 0x16, 0x04, 0xDC, 0x84, 0x4A, 0xFA, 0x49, 0xF2, 0x08, 0x04,
+	 0xDC, 0x84, 0x49, 0xFA, 0x05, 0x04, 0x3B, 0xF2, 0xFF, 0xFF, 0xE0, 0x84, 0xE8, 0x84, 0x3B, 0xFA,
+	 0x0C, 0x60, 0xFE, 0x62, 0x80, 0xFF, 0x78, 0x44, 0x03, 0xA4, 0xA2, 0xDB, 0xC7, 0x60, 0xCF, 0x78,
+	 0xFF, 0xFF, 0x84, 0xFF, 0x06, 0x60, 0x17, 0xE1, 0x77, 0x40, 0x8B, 0xFF, 0x02, 0x60, 0x00, 0x75,
+	 0xC9, 0x60, 0x58, 0x4F, 0x67, 0x78, 0xFF, 0xFF, 0x01, 0x64, 0x06, 0x60, 0x80, 0xFB, 0x0C, 0x60,
+	 0xFE, 0x62, 0x80, 0xFF, 0x78, 0x44, 0x03, 0xA4, 0xA2, 0xDB, 0xC8, 0x60, 0x46, 0x78, 0xFF, 0xFF,
+	 0x84, 0xFF, 0x00, 0x7C, 0x06, 0x60, 0x80, 0xF3, 0xA2, 0xD9, 0x60, 0x40, 0x01, 0x2A, 0x04, 0x00,
+	 0xC9, 0x60, 0x58, 0x4F, 0xAF, 0x78, 0xFF, 0xFF, 0x3C, 0x46, 0x07, 0xF4, 0x87, 0xF3, 0x66, 0x5C,
+	 0xD0, 0x80, 0x00, 0x7C, 0x07, 0x03, 0x66, 0x43, 0x3C, 0x46, 0x22, 0xF2, 0x63, 0x46, 0x60, 0x40,
+	 0x01, 0x2A, 0x01, 0x00, 0x3C, 0xF1, 0x4B, 0xF0, 0x64, 0x41, 0x64, 0x47, 0xFF, 0xB4, 0x60, 0x5F,
+	 0x20, 0xBC, 0x80, 0x26, 0x80, 0xAC, 0x60, 0x47, 0xA3, 0x46, 0x3A, 0xFA, 0x64, 0x44, 0x20, 0x7F,
+	 0x34, 0x94, 0x3B, 0xFA, 0xA3, 0x46, 0x4A, 0xF2, 0x49, 0xF0, 0xA3, 0x46, 0x3C, 0xFA, 0x3D, 0xF8,
+	 0x80, 0x60, 0x10, 0xE0, 0x08, 0x60, 0x00, 0xEA, 0x0F, 0x64, 0x60, 0x7F, 0xA0, 0x5A, 0x80, 0x60,
+	 0x00, 0xEA, 0xA0, 0x60, 0x00, 0xEA, 0xD1, 0x60, 0x00, 0xEA, 0xBD, 0x60, 0x75, 0x78, 0xFF, 0xFF,
+	 0x2A, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x08, 0x27, 0x31, 0x00, 0x2A, 0xF2, 0x00, 0x60, 0x7C, 0x62,
+	 0x60, 0x40, 0x40, 0x2B, 0x24, 0x00, 0xA2, 0xD3, 0x00, 0x61, 0x60, 0xFE, 0xA0, 0xD3, 0x5E, 0xD1,
+	 0xFF, 0xFF, 0x20, 0xFE, 0x64, 0x5F, 0xDC, 0x84, 0xF1, 0x81, 0xC0, 0x2B, 0x04, 0x00, 0x80, 0x2A,
+	 0x02, 0x00, 0x7F, 0xA4, 0xDC, 0x84, 0xFF, 0x3B, 0x03, 0x00, 0x60, 0x47, 0xDC, 0x87, 0x01, 0x61,
+	 0xC0, 0x80, 0x00, 0x36, 0xDC, 0x84, 0x4E, 0xDB, 0x60, 0xFE, 0x5A, 0xD1, 0xFF, 0xFF, 0xC1, 0x84,
+	 0xF0, 0x22, 0x10, 0xA4, 0xF0, 0x2A, 0x01, 0x00, 0x00, 0x64, 0xA2, 0xDB, 0x20, 0xFE, 0x00, 0x60,
+	 0x3E, 0xF3, 0xFF, 0xFF, 0xA0, 0xD3, 0x5A, 0xD1, 0x3A, 0xFA, 0x3B, 0xF8, 0x74, 0x62, 0xA2, 0xD0,
+	 0xFF, 0xFF, 0x64, 0x44, 0xE0, 0x7F, 0xA0, 0x5A, 0x64, 0x47, 0xE1, 0x7F, 0x5A, 0xD0, 0xA0, 0x5A,
+	 0x64, 0x44, 0xE2, 0x7F, 0xA0, 0x5A, 0x00, 0x60, 0x40, 0xF3, 0xFF, 0xFF, 0xA0, 0xD1, 0x5A, 0xD1,
+	 0x64, 0x45, 0x64, 0x44, 0xE3, 0x7F, 0xA0, 0x5A, 0x64, 0x47, 0xE4, 0x7F, 0x5A, 0xD1, 0xA0, 0x5A,
+	 0x64, 0x44, 0xE5, 0x7F, 0xA0, 0x5A, 0x64, 0x47, 0xE6, 0x7F, 0x5A, 0xD1, 0xA0, 0x5A, 0x64, 0x44,
+	 0xE7, 0x7F, 0xA0, 0x5A, 0x65, 0x40, 0x0D, 0x3A, 0x1C, 0x00, 0x64, 0x47, 0xE8, 0x7F, 0x5A, 0xD1,
+	 0xA0, 0x5A, 0x64, 0x44, 0xE9, 0x7F, 0xA0, 0x5A, 0x64, 0x47, 0xEA, 0x7F, 0x5A, 0xD1, 0xA0, 0x5A,
+	 0x64, 0x44, 0xEB, 0x7F, 0xA0, 0x5A, 0x64, 0x47, 0xEC, 0x7F, 0x5A, 0xD1, 0xA0, 0x5A, 0x64, 0x44,
+	 0xED, 0x7F, 0xA0, 0x5A, 0x64, 0x47, 0xEE, 0x7F, 0x5A, 0xD1, 0xA0, 0x5A, 0x64, 0x44, 0xEF, 0x7F,
+	 0xA0, 0x5A, 0x08, 0x60, 0x00, 0xEA, 0x65, 0x44, 0x02, 0xA4, 0x60, 0x7F, 0xA0, 0x5A, 0x80, 0x60,
+	 0x00, 0xEA, 0xA0, 0x60, 0x00, 0xEA, 0xD1, 0x60, 0x00, 0xEA, 0x02, 0x64, 0x3B, 0xDB, 0xBA, 0x60,
+	 0xF3, 0x78, 0xFF, 0xFF, 0xBF, 0x60, 0xBB, 0x78, 0xFF, 0xFF, 0x66, 0x44, 0xFC, 0xFB, 0x07, 0xF0,
+	 0x00, 0x64, 0xD0, 0x80, 0x87, 0xF3, 0x0E, 0x03, 0xD0, 0x80, 0xFF, 0xFF, 0x0B, 0x03, 0x47, 0xF1,
+	 0x07, 0xF0, 0x64, 0x40, 0x02, 0x26, 0x01, 0x00, 0x08, 0x00, 0x03, 0x12, 0xBE, 0x60, 0x46, 0x78,
+	 0xFF, 0xFF, 0xFC, 0x0A, 0xBE, 0x60, 0xA6, 0x78, 0xFF, 0xFF, 0x87, 0xF0, 0x87, 0xF3, 0x10, 0xF0,
+	 0xD4, 0x80, 0xFF, 0xFF, 0x3D, 0x03, 0x66, 0x43, 0x65, 0x46, 0xFF, 0x67, 0x20, 0x85, 0x64, 0x5F,
+	 0x40, 0x44, 0x15, 0xF0, 0x25, 0x44, 0xD0, 0x84, 0x03, 0xA4, 0x03, 0x0E, 0xE8, 0x84, 0xE8, 0x84,
+	 0x04, 0x00, 0xFA, 0xA4, 0xE8, 0x84, 0xE8, 0x87, 0xC0, 0xBF, 0xC0, 0x84, 0x15, 0xFA, 0x40, 0x45,
+	 0x14, 0xF0, 0x24, 0x44, 0xD0, 0x84, 0x1F, 0xA4, 0x06, 0x0E, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84,
+	 0xE8, 0x84, 0xE8, 0x84, 0x07, 0x00, 0xC2, 0xA4, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84,
+	 0xE8, 0x87, 0xF8, 0xBF, 0xC0, 0x84, 0x14, 0xFA, 0x60, 0x5C, 0x2F, 0x67, 0xD0, 0x80, 0x60, 0x45,
+	 0x02, 0x28, 0x64, 0x45, 0x25, 0x5C, 0x8B, 0x67, 0xD0, 0x80, 0x60, 0x41, 0x02, 0x24, 0x64, 0x41,
+	 0xD5, 0x84, 0x80, 0x65, 0xC4, 0x87, 0x01, 0x05, 0x00, 0x64, 0xFF, 0xB4, 0x0E, 0xFA, 0x63, 0x46,
+	 0x07, 0xF0, 0x66, 0x43, 0x64, 0x46, 0x17, 0xF2, 0x63, 0x46, 0x60, 0x40, 0x00, 0x36, 0x2E, 0x00,
+	 0x01, 0x36, 0x1E, 0x00, 0x03, 0x3A, 0x25, 0x00, 0x64, 0x46, 0x10, 0xF2, 0x11, 0xFA, 0x12, 0xF2,
+	 0x00, 0x61, 0x60, 0x47, 0x00, 0x7F, 0x12, 0xFA, 0x97, 0xFA, 0x46, 0x44, 0x63, 0x46, 0xC1, 0x60,
+	 0x58, 0x4E, 0x72, 0x78, 0xFF, 0xFF, 0x65, 0x40, 0x00, 0x3A, 0x04, 0x00, 0xC1, 0x60, 0x58, 0x4E,
+	 0xBC, 0x78, 0xFF, 0xFF, 0x07, 0xF0, 0x66, 0x43, 0x64, 0x46, 0x96, 0xFC, 0x63, 0x46, 0x43, 0x00,
+	 0x64, 0x46, 0x16, 0xF2, 0x00, 0x61, 0x20, 0x28, 0xFF, 0xA4, 0x97, 0xFA, 0x16, 0xFA, 0x63, 0x46,
+	 0x3A, 0x00, 0x64, 0x46, 0x00, 0x61, 0x97, 0xFA, 0x63, 0x46, 0x35, 0x00, 0x07, 0xF0, 0x66, 0x41,
+	 0x64, 0x46, 0x16, 0xF2, 0xFF, 0xFF, 0x20, 0x28, 0xFF, 0xA4, 0x16, 0xFA, 0x93, 0xF4, 0x12, 0xF2,
+	 0x20, 0x28, 0xFF, 0xA3, 0x13, 0xFC, 0x61, 0x46, 0x63, 0x40, 0x00, 0x3A, 0x24, 0x00, 0xC1, 0x60,
+	 0x58, 0x4E, 0x93, 0x78, 0xFF, 0xFF, 0x61, 0x40, 0xFF, 0x36, 0x1D, 0x00, 0x66, 0x41, 0x64, 0x46,
+	 0x12, 0xF2, 0x93, 0xF4, 0x61, 0x46, 0x20, 0x28, 0x16, 0x00, 0x44, 0x44, 0xC1, 0x60, 0x58, 0x4E,
+	 0x72, 0x78, 0xFF, 0xFF, 0x24, 0x5C, 0x65, 0x40, 0x00, 0x36, 0x06, 0x00, 0x66, 0x41, 0x64, 0x46,
+	 0x01, 0x64, 0x17, 0xFA, 0x61, 0x46, 0x07, 0x00, 0x66, 0x43, 0x64, 0x46, 0xC1, 0x60, 0x58, 0x4E,
+	 0xBC, 0x78, 0xFF, 0xFF, 0x63, 0x46, 0xBE, 0x60, 0xA6, 0x78, 0xFF, 0xFF, 0x07, 0xF0, 0x66, 0x43,
+	 0x64, 0x46, 0x17, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0xFF, 0x27, 0xFF, 0xFF, 0x00, 0x36, 0x07, 0x00,
+	 0x01, 0x36, 0x1C, 0x00, 0x02, 0x36, 0x24, 0x00, 0x03, 0x36, 0x43, 0x00, 0xFF, 0xFF, 0x15, 0x60,
+	 0xF9, 0xF1, 0x16, 0xF2, 0x43, 0x44, 0xD0, 0x80, 0x2C, 0x60, 0x24, 0x61, 0x09, 0x03, 0xA1, 0xD1,
+	 0x2C, 0x60, 0x22, 0x63, 0xC0, 0x84, 0x16, 0xFA, 0xA3, 0xD3, 0xFF, 0xFF, 0x13, 0xFA, 0x39, 0x00,
+	 0x96, 0xFC, 0xC1, 0x60, 0x58, 0x4E, 0xBC, 0x78, 0xFF, 0xFF, 0x33, 0x00, 0x43, 0x44, 0xC1, 0x60,
+	 0x58, 0x4E, 0xBC, 0x78, 0xFF, 0xFF, 0x16, 0x60, 0x11, 0xF3, 0x96, 0xFC, 0x13, 0xFA, 0x29, 0x00,
+	 0x63, 0x46, 0x2B, 0x60, 0xF4, 0x63, 0xA3, 0xD3, 0x15, 0xF2, 0x60, 0x45, 0xD4, 0x80, 0x07, 0xF0,
+	 0x0C, 0x03, 0x66, 0x41, 0x44, 0x44, 0x64, 0x46, 0x12, 0xF2, 0x61, 0x46, 0xC1, 0x60, 0x58, 0x4E,
+	 0x72, 0x78, 0xFF, 0xFF, 0x65, 0x40, 0x00, 0x3A, 0x19, 0x00, 0x66, 0x43, 0x24, 0x46, 0xC1, 0x60,
+	 0x58, 0x4E, 0xBC, 0x78, 0xFF, 0xFF, 0x12, 0xF2, 0x91, 0xF2, 0x90, 0xFA, 0x60, 0x5F, 0x12, 0xFA,
+	 0x04, 0x00, 0xC1, 0x60, 0x58, 0x4E, 0xBC, 0x78, 0xFF, 0xFF, 0x03, 0x64, 0x17, 0xFA, 0x63, 0x46,
+	 0x05, 0x00, 0x24, 0x43, 0x02, 0x64, 0x17, 0xFA, 0x63, 0x46, 0x00, 0x00, 0x03, 0x64, 0x3B, 0xDB,
+	 0xCA, 0xFE, 0x47, 0xF1, 0x01, 0x65, 0x32, 0x40, 0x04, 0x27, 0x08, 0x00, 0x2C, 0xF2, 0x64, 0x45,
+	 0x02, 0x22, 0x04, 0x00, 0x60, 0x40, 0x01, 0x26, 0x01, 0x00, 0x7B, 0x00, 0x14, 0xF2, 0x65, 0x40,
+	 0x01, 0x26, 0x0C, 0x00, 0x60, 0x45, 0x05, 0x64, 0x3B, 0xDB, 0x65, 0x44, 0xCC, 0x85, 0x25, 0x60,
+	 0xD6, 0x64, 0xE5, 0x60, 0x78, 0x41, 0xD3, 0x78, 0x97, 0xF1, 0x50, 0x00, 0x60, 0x41, 0x2A, 0xF0,
+	 0x00, 0x60, 0x0C, 0x64, 0xA0, 0x84, 0x04, 0x36, 0x02, 0x00, 0x0C, 0x3A, 0x01, 0x00, 0x46, 0x00,
+	 0x61, 0x45, 0x60, 0x43, 0x25, 0x60, 0xD6, 0x64, 0xE5, 0x60, 0x78, 0x41, 0xD3, 0x78, 0x97, 0xF1,
+	 0x63, 0x40, 0x08, 0x36, 0x01, 0x00, 0x3A, 0x00, 0x14, 0xF2, 0x1C, 0x65, 0x60, 0x41, 0x00, 0x63,
+	 0xCD, 0x81, 0xC7, 0x83, 0xFD, 0x02, 0x3F, 0xF0, 0x2C, 0xF2, 0xC3, 0x83, 0x60, 0x40, 0x01, 0x2A,
+	 0x0D, 0x00, 0x25, 0x60, 0xD4, 0x64, 0xE5, 0x60, 0x78, 0x41, 0xC7, 0x78, 0x97, 0xF1, 0x25, 0x60,
+	 0xDA, 0x64, 0xE5, 0x60, 0x78, 0x41, 0xD2, 0x78, 0x63, 0x45, 0x20, 0x00, 0x25, 0x60, 0xD2, 0x64,
+	 0xE5, 0x60, 0x78, 0x41, 0xC7, 0x78, 0x97, 0xF1, 0x25, 0x60, 0xD8, 0x64, 0xE5, 0x60, 0x78, 0x41,
+	 0xD2, 0x78, 0x63, 0x45, 0x15, 0xF2, 0xFF, 0xFF, 0x0F, 0xB4, 0x00, 0xA8, 0x01, 0xA8, 0x0E, 0x03,
+	 0x07, 0x03, 0x25, 0x60, 0xE0, 0x64, 0xE5, 0x60, 0x78, 0x41, 0xC7, 0x78, 0x97, 0xF1, 0x06, 0x00,
+	 0x25, 0x60, 0xDE, 0x64, 0xE5, 0x60, 0x78, 0x41, 0xC7, 0x78, 0x97, 0xF1, 0x04, 0x64, 0x3B, 0xDB,
+	 0x07, 0xF0, 0x66, 0x41, 0x64, 0x46, 0x06, 0xF0, 0xFF, 0x60, 0x5F, 0x64, 0xA0, 0x84, 0x06, 0xFA,
+	 0x61, 0x46, 0x1E, 0x60, 0xF2, 0x64, 0x0F, 0x60, 0x8D, 0xFB, 0x3C, 0x44, 0x5A, 0xDB, 0x02, 0x64,
+	 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0x5C, 0x5C, 0xFC, 0xFC, 0xCE, 0xFE, 0xB7, 0x60, 0xE2, 0x78,
+	 0xFF, 0xFF, 0x13, 0x60, 0x2E, 0xF3, 0x07, 0xF4, 0x06, 0xF2, 0x02, 0xA8, 0x3C, 0x46, 0x10, 0x03,
+	 0x10, 0xB0, 0x2A, 0xF2, 0x0D, 0x03, 0x0E, 0xF2, 0x0C, 0xB0, 0x60, 0x40, 0xF0, 0x37, 0x20, 0xBC,
+	 0x02, 0x03, 0xFE, 0x7F, 0x0E, 0xFA, 0x23, 0xF0, 0x10, 0x64, 0xB0, 0x84, 0xA2, 0xDA, 0xCE, 0x01,
+	 0x2A, 0xF2, 0xFF, 0xFF, 0x50, 0xA8, 0x02, 0x7C, 0x10, 0x03, 0x0F, 0xF0, 0x15, 0xF2, 0x64, 0x41,
+	 0x01, 0x2A, 0x02, 0x00, 0xAF, 0xF1, 0x09, 0x00, 0x03, 0x65, 0x07, 0xF0, 0x66, 0x43, 0x64, 0x46,
+	 0x06, 0xF0, 0x63, 0x46, 0xAE, 0xF1, 0x64, 0x40, 0x10, 0x2A, 0x64, 0x45, 0xDC, 0x84, 0xD4, 0x80,
+	 0x15, 0xFA, 0x38, 0x07, 0x61, 0x40, 0x01, 0x2A, 0x08, 0x00, 0x13, 0x60, 0x03, 0xF3, 0xFF, 0xFF,
+	 0xDC, 0x84, 0x00, 0x36, 0x00, 0x3B, 0xA2, 0xDB, 0x07, 0x00, 0x13, 0x60, 0x04, 0xF3, 0xFF, 0xFF,
+	 0xDC, 0x84, 0x00, 0x36, 0x00, 0x3B, 0xA2, 0xDB, 0x2A, 0xF0, 0x08, 0x67, 0xB0, 0x84, 0xA2, 0xDA,
+	 0x08, 0xF0, 0x1E, 0x60, 0xD4, 0x64, 0xD0, 0x80, 0x07, 0xF2, 0x46, 0x43, 0x87, 0xF1, 0x06, 0x03,
+	 0x60, 0x46, 0x86, 0xF4, 0xD0, 0x80, 0x80, 0xBB, 0x01, 0x03, 0x06, 0xFC, 0x23, 0x46, 0x3E, 0xF2,
+	 0x00, 0x63, 0x01, 0xB0, 0x43, 0x5C, 0xFC, 0xFC, 0x0A, 0x03, 0x1E, 0x60, 0xEC, 0x64, 0x0F, 0x60,
+	 0x90, 0xFB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xB7, 0x60,
+	 0xE2, 0x78, 0xFF, 0xFF, 0x00, 0x64, 0x49, 0xFB, 0x25, 0x60, 0xE0, 0x64, 0xE5, 0x60, 0x78, 0x41,
+	 0xC7, 0x78, 0x97, 0xF1, 0x25, 0x60, 0xE2, 0x64, 0xE5, 0x60, 0x78, 0x41, 0xC7, 0x78, 0x97, 0xF1,
+	 0x27, 0x44, 0xF7, 0xB4, 0x40, 0x47, 0x23, 0xF0, 0x01, 0x64, 0xB0, 0x84, 0xA2, 0xDA, 0x07, 0xF0,
+	 0x66, 0x41, 0x64, 0x46, 0x06, 0xF2, 0x7F, 0x65, 0xA4, 0x9E, 0x06, 0xFA, 0x61, 0x46, 0x5E, 0x01,
+	 0xC0, 0x60, 0x35, 0x78, 0xFF, 0xFF, 0x21, 0x64, 0x3B, 0xDB, 0x31, 0xF3, 0x01, 0x63, 0xC4, 0xB4,
+	 0x31, 0xFB, 0x32, 0xFD, 0xBF, 0x60, 0xEB, 0x62, 0x42, 0x40, 0xA0, 0x4C, 0x40, 0xBC, 0x7D, 0xB4,
+	 0xA0, 0x51, 0xA0, 0xFE, 0x1A, 0xFF, 0x1E, 0x60, 0xE6, 0x64, 0x08, 0xF0, 0x07, 0xF0, 0xD0, 0x80,
+	 0x1E, 0x60, 0xEC, 0x62, 0x13, 0x02, 0xA2, 0xD3, 0x01, 0x63, 0xAC, 0x86, 0x07, 0xF2, 0x0E, 0x03,
+	 0xD0, 0x80, 0x09, 0xF2, 0xFA, 0x02, 0x23, 0xFC, 0x1E, 0x60, 0xF2, 0x64, 0x0F, 0x60, 0x8D, 0xFB,
+	 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0x3C, 0x46, 0x06, 0x64,
+	 0xA1, 0xFF, 0x49, 0xFB, 0x83, 0x3E, 0x31, 0xF3, 0x87, 0x60, 0x80, 0x61, 0x1D, 0xF0, 0x60, 0x40,
+	 0x01, 0x2A, 0x0F, 0x00, 0xFE, 0xB4, 0x31, 0xFB, 0x00, 0x64, 0x49, 0xFB, 0x01, 0x64, 0x47, 0xFB,
+	 0x00, 0x71, 0x05, 0x64, 0x64, 0x5F, 0x0D, 0xFA, 0x40, 0x64, 0x3B, 0xDB, 0xC0, 0x60, 0x35, 0x78,
+	 0xFF, 0xFF, 0x02, 0x2A, 0x17, 0x00, 0xD1, 0x91, 0x8D, 0xE2, 0x41, 0x64, 0x3B, 0xDB, 0x31, 0xF3,
+	 0x2C, 0x60, 0x5E, 0x63, 0xFD, 0xB4, 0x31, 0xFB, 0xA3, 0xD3, 0x02, 0x63, 0x60, 0x5C, 0x0D, 0xF2,
+	 0x47, 0xFD, 0xFF, 0xB5, 0x60, 0x47, 0xD0, 0x80, 0xDC, 0x84, 0x1F, 0x03, 0x60, 0x47, 0xB4, 0x84,
+	 0x0D, 0xFA, 0x1B, 0x00, 0x08, 0x2A, 0x07, 0x00, 0x42, 0x64, 0x3B, 0xDB, 0x31, 0xF3, 0xFF, 0xFF,
+	 0xF7, 0xB4, 0x31, 0xFB, 0x12, 0x00, 0x10, 0x2A, 0x09, 0x00, 0x43, 0x64, 0x3B, 0xDB, 0x31, 0xF3,
+	 0xFF, 0xFF, 0xEF, 0xB4, 0x31, 0xFB, 0xBF, 0x60, 0xBB, 0x78, 0xFF, 0xFF, 0x44, 0x64, 0x3B, 0xDB,
+	 0x31, 0xF3, 0xFF, 0xFF, 0xDF, 0xB4, 0x31, 0xFB, 0x00, 0x00, 0x2A, 0x64, 0x3B, 0xDB, 0xB7, 0x60,
+	 0xA2, 0x64, 0x40, 0x40, 0xBD, 0x60, 0x7D, 0x78, 0xFF, 0xFF, 0x0A, 0x60, 0x80, 0xF3, 0xFF, 0xFF,
+	 0x02, 0xB5, 0x04, 0xB5, 0x04, 0x03, 0x03, 0x03, 0xC0, 0x60, 0xB8, 0x78, 0xFF, 0xFF, 0xF0, 0x60,
+	 0x58, 0x4E, 0x74, 0x78, 0xFF, 0xFF, 0x31, 0x40, 0x01, 0x2A, 0x28, 0x00, 0x9D, 0xFE, 0x26, 0x04,
+	 0x25, 0x0A, 0x9F, 0xFE, 0x23, 0x05, 0x85, 0xFF, 0x20, 0x44, 0x84, 0xFF, 0x40, 0x26, 0x1E, 0x00,
+	 0x3F, 0x40, 0x20, 0x2B, 0x1B, 0x00, 0x38, 0x69, 0xFF, 0xFF, 0x68, 0x44, 0x01, 0x16, 0xFD, 0x01,
+	 0x01, 0x2A, 0x14, 0x00, 0x13, 0x60, 0x09, 0xF3, 0xFF, 0xFF, 0xDC, 0x84, 0x00, 0x36, 0x00, 0x3B,
+	 0xA2, 0xDB, 0x64, 0xF1, 0x02, 0x60, 0xEE, 0x64, 0x81, 0xFB, 0xFF, 0xFF, 0x80, 0x60, 0x00, 0x64,
+	 0xB0, 0x84, 0x82, 0xFB, 0x04, 0x64, 0x83, 0xFB, 0xDF, 0xFE, 0x19, 0xFF, 0x10, 0x64, 0x3B, 0xDB,
+	 0x65, 0xF3, 0x73, 0x45, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xC4, 0x93, 0x74, 0xF1, 0xC9, 0xFE,
+	 0x64, 0x40, 0x01, 0x26, 0x3B, 0x00, 0x49, 0xF3, 0x3C, 0x46, 0x31, 0x18, 0xCC, 0x84, 0x49, 0xFB,
+	 0x2E, 0x02, 0xC1, 0x60, 0x6B, 0x64, 0x40, 0x42, 0xFC, 0xFC, 0x00, 0x64, 0x5C, 0x5C, 0x32, 0xFB,
+	 0x82, 0xFF, 0x5C, 0x47, 0x84, 0xFF, 0x62, 0xFF, 0x13, 0x60, 0x01, 0xF3, 0xFF, 0xFF, 0xDC, 0x84,
+	 0x00, 0x36, 0x00, 0x3B, 0xA2, 0xDB, 0x2A, 0xF2, 0x07, 0xF0, 0x0C, 0xB4, 0x08, 0x3A, 0x07, 0x00,
+	 0x66, 0x41, 0x64, 0x46, 0x06, 0xF0, 0xFF, 0x60, 0xDF, 0x64, 0xA0, 0x84, 0x06, 0xFA, 0x23, 0xF0,
+	 0x01, 0x64, 0xB0, 0x84, 0xA2, 0xDA, 0x1E, 0x60, 0xF2, 0x64, 0x0F, 0x60, 0x8D, 0xFB, 0x66, 0x44,
+	 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xC1, 0xFE, 0xCE, 0xFE, 0x06, 0x00,
+	 0x65, 0xF3, 0x73, 0x45, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xC4, 0x93, 0x14, 0x60, 0xFC, 0x63,
+	 0xA3, 0xD3, 0xAD, 0x49, 0x20, 0xB5, 0x08, 0xB1, 0x22, 0x03, 0xE1, 0x81, 0x10, 0xB5, 0x95, 0x81,
+	 0x60, 0x41, 0x18, 0x02, 0x14, 0x60, 0xFE, 0x7C, 0xA4, 0xD3, 0xFF, 0xFF, 0xCC, 0x84, 0xA4, 0xDB,
+	 0x16, 0x02, 0x0A, 0x64, 0xA4, 0xDB, 0x61, 0x44, 0x07, 0xB4, 0xFF, 0xFF, 0x10, 0x02, 0x08, 0xB1,
+	 0xE1, 0x81, 0x95, 0x81, 0xA3, 0xD3, 0x0B, 0x03, 0x08, 0xAC, 0x01, 0xBC, 0xA3, 0xDB, 0xFF, 0xFF,
+	 0x13, 0xFF, 0x05, 0x00, 0x10, 0xAC, 0xA3, 0xDB, 0x0A, 0x7C, 0x0A, 0x60, 0x7F, 0xF9, 0xB7, 0x60,
+	 0xAE, 0x78, 0xFF, 0xFF, 0x46, 0xF3, 0x45, 0xF1, 0x04, 0x1B, 0x64, 0x44, 0x02, 0x1B, 0x07, 0x60,
+	 0xF7, 0xF3, 0x45, 0xFB, 0x00, 0x63, 0x46, 0xFD, 0x60, 0x41, 0x25, 0x64, 0x3B, 0xDB, 0x27, 0x44,
+	 0xEF, 0xB4, 0x40, 0x47, 0x00, 0xB9, 0x71, 0x40, 0x80, 0x27, 0x01, 0x12, 0x19, 0x03, 0xC1, 0x60,
+	 0x0C, 0x62, 0x84, 0xFF, 0x42, 0x42, 0x82, 0xFF, 0xA0, 0x4C, 0x14, 0xBC, 0xFF, 0xB4, 0xA0, 0x51,
+	 0x1F, 0x0A, 0xA1, 0xFF, 0xFF, 0xFF, 0x81, 0x3E, 0x70, 0x44, 0xAC, 0x80, 0x19, 0x0A, 0x71, 0x40,
+	 0x80, 0x27, 0xF7, 0x12, 0x45, 0xF3, 0x27, 0x02, 0x03, 0x18, 0xCC, 0x84, 0x45, 0xFB, 0xF1, 0x02,
+	 0x06, 0x0A, 0xA0, 0x4C, 0xFB, 0xB4, 0xA0, 0x51, 0xA4, 0x60, 0xD7, 0x78, 0xFF, 0xFF, 0x84, 0xFF,
+	 0xC0, 0x60, 0xEA, 0x64, 0x40, 0x42, 0x82, 0xFF, 0xA0, 0x4C, 0x14, 0xBC, 0xFF, 0xB4, 0xA0, 0x51,
+	 0xAF, 0x60, 0x7B, 0x78, 0xFF, 0xFF, 0x3C, 0x44, 0xAC, 0x80, 0x32, 0xF1, 0x12, 0x03, 0x64, 0x40,
+	 0x07, 0x22, 0x0F, 0x00, 0xA4, 0x60, 0xB6, 0x78, 0xFF, 0xFF, 0xA0, 0x4C, 0x1C, 0xBC, 0xDF, 0xB4,
+	 0xA0, 0x51, 0xF1, 0x01, 0x06, 0x00, 0x28, 0x64, 0x3A, 0xDB, 0xA0, 0x4C, 0x30, 0xBC, 0xF3, 0xB4,
+	 0xA0, 0x51, 0xA1, 0xFF, 0xFF, 0xFF, 0x81, 0x3E, 0x28, 0x64, 0x3B, 0xDB, 0x07, 0x60, 0xF8, 0xF3,
+	 0x32, 0x40, 0x02, 0x27, 0x16, 0x00, 0x46, 0xFB, 0x14, 0x18, 0xC1, 0x60, 0x59, 0x64, 0x84, 0xFF,
+	 0x40, 0x42, 0x82, 0xFF, 0xA0, 0x4C, 0x15, 0xBC, 0xF7, 0xB4, 0xA0, 0x51, 0xA1, 0xFF, 0xFF, 0xFF,
+	 0x81, 0x3E, 0x70, 0x44, 0xAC, 0x80, 0x46, 0xF3, 0xCB, 0x0A, 0xDD, 0x02, 0xCC, 0x84, 0x46, 0xFB,
+	 0xF5, 0x02, 0x84, 0xFF, 0xC1, 0x60, 0x6B, 0x64, 0x40, 0x42, 0x82, 0xFF, 0x27, 0x44, 0x08, 0xBC,
+	 0x40, 0x47, 0xF9, 0xE1, 0x04, 0x00, 0x78, 0xE1, 0x31, 0x40, 0x01, 0x26, 0xF9, 0xE1, 0xA4, 0x60,
+	 0xAA, 0x78, 0xFF, 0xFF, 0x15, 0x60, 0xFB, 0xF1, 0x60, 0x45, 0x2C, 0x60, 0x0A, 0x61, 0xC5, 0x83,
+	 0xA3, 0xD3, 0xFF, 0xFF, 0x60, 0x41, 0x66, 0x45, 0x24, 0x46, 0x0E, 0xF2, 0x65, 0x46, 0x64, 0x45,
+	 0xD5, 0x81, 0x61, 0x45, 0x00, 0x7F, 0xD4, 0x80, 0x64, 0x43, 0x08, 0x04, 0xE3, 0x83, 0x63, 0x45,
+	 0xC5, 0x81, 0x61, 0x45, 0xD4, 0x80, 0x02, 0x65, 0x03, 0x07, 0x03, 0x00, 0x00, 0x65, 0x01, 0x00,
+	 0x01, 0x65, 0x2E, 0x58, 0xFF, 0xFF, 0x66, 0x43, 0x64, 0x46, 0x8F, 0xF0, 0x12, 0xF2, 0x91, 0xF2,
+	 0x60, 0x40, 0x10, 0x36, 0x05, 0x00, 0x12, 0x36, 0x08, 0x00, 0x0C, 0x36, 0x0B, 0x00, 0x0F, 0x00,
+	 0x40, 0x61, 0xA5, 0x80, 0x0A, 0x64, 0x13, 0x02, 0xF3, 0x01, 0x10, 0x61, 0xA5, 0x80, 0x0E, 0x64,
+	 0x0E, 0x02, 0xEE, 0x01, 0x08, 0x61, 0xA5, 0x80, 0x10, 0x64, 0x09, 0x02, 0xE9, 0x01, 0xE1, 0x81,
+	 0xA5, 0x80, 0x03, 0x05, 0xC8, 0x84, 0x03, 0x02, 0xE3, 0x01, 0xFF, 0x61, 0x02, 0x00, 0x12, 0xFA,
+	 0x91, 0xFA, 0x63, 0x46, 0x2E, 0x58, 0xFF, 0xFF, 0x8F, 0xF0, 0x12, 0xF2, 0x91, 0xF2, 0x60, 0x40,
+	 0x0A, 0x36, 0x05, 0x00, 0x0E, 0x36, 0x08, 0x00, 0x10, 0x36, 0x0B, 0x00, 0x0F, 0x00, 0x08, 0x61,
+	 0xA5, 0x80, 0x10, 0x7E, 0x11, 0x02, 0xF3, 0x01, 0x04, 0x61, 0xA5, 0x80, 0x12, 0x7E, 0x0C, 0x02,
+	 0xEE, 0x01, 0x20, 0x61, 0xA5, 0x80, 0x0C, 0x7E, 0x07, 0x02, 0xE9, 0x01, 0xE9, 0x81, 0xA5, 0x80,
+	 0x05, 0x05, 0xD8, 0x84, 0x01, 0x02, 0xE3, 0x01, 0x12, 0xFA, 0x91, 0xFA, 0x2E, 0x58, 0xFF, 0xFF,
+	 0x24, 0xE2, 0x2D, 0xF3, 0x2C, 0xF3, 0x00, 0xBD, 0xCC, 0x84, 0x08, 0x03, 0x2C, 0xFB, 0x06, 0x02,
+	 0x65, 0x44, 0x2C, 0xFB, 0x8A, 0xFF, 0x80, 0x60, 0x00, 0x75, 0x88, 0xFF, 0x44, 0xF3, 0xFF, 0xFF,
+	 0xDC, 0x84, 0x44, 0xFB, 0x28, 0x60, 0x72, 0x65, 0x28, 0x60, 0x70, 0x61, 0xA5, 0xD3, 0xA1, 0xD3,
+	 0x11, 0x18, 0xCC, 0x84, 0xA1, 0xDB, 0x0E, 0x02, 0xA5, 0xD3, 0xA1, 0xDB, 0x14, 0x60, 0x3B, 0xF3,
+	 0x14, 0x60, 0x3A, 0xF1, 0xA2, 0xDB, 0xD0, 0x80, 0xFF, 0xFF, 0x04, 0x03, 0x8A, 0xFF, 0x20, 0x60,
+	 0x00, 0x75, 0x88, 0xFF, 0xD2, 0xF3, 0x31, 0x40, 0x01, 0x2A, 0x3D, 0x00, 0x60, 0x43, 0x04, 0xB0,
+	 0x02, 0xB0, 0x08, 0x24, 0x16, 0x02, 0x10, 0xB0, 0x29, 0x44, 0x34, 0x02, 0x00, 0xA8, 0xCC, 0x81,
+	 0x0D, 0x03, 0x41, 0x49, 0x2F, 0x02, 0x63, 0x40, 0x08, 0x2A, 0x08, 0x00, 0xF7, 0xB3, 0x18, 0x60,
+	 0x0A, 0xF1, 0xAD, 0x4F, 0xFD, 0xB4, 0xA0, 0x5D, 0x44, 0x49, 0x24, 0x00, 0x63, 0x40, 0x02, 0x2A,
+	 0x10, 0x00, 0x18, 0x60, 0x0B, 0xF3, 0x18, 0x60, 0x09, 0xFB, 0x40, 0x49, 0x18, 0x60, 0x0C, 0xF3,
+	 0x18, 0x60, 0x0A, 0xFB, 0x0C, 0xBB, 0xFD, 0xB3, 0xAD, 0x4F, 0x02, 0xBC, 0x00, 0x7F, 0xA0, 0x5D,
+	 0x11, 0x00, 0x18, 0x60, 0x0D, 0xF3, 0x30, 0x60, 0x12, 0x7C, 0x0C, 0x18, 0xA4, 0xDB, 0x40, 0x49,
+	 0x18, 0x60, 0x0E, 0xF3, 0x18, 0x60, 0x0A, 0xFB, 0x08, 0xBB, 0xFB, 0xB3, 0xAD, 0x4F, 0x02, 0xBC,
+	 0x00, 0x7F, 0xA0, 0x5D, 0xD2, 0xFD, 0x00, 0x60, 0x85, 0xF3, 0x62, 0x43, 0x17, 0x18, 0x58, 0xD3,
+	 0x62, 0x41, 0x03, 0x18, 0xCC, 0x84, 0xA1, 0xDB, 0x11, 0x00, 0x49, 0xD3, 0xA3, 0xDB, 0x06, 0xA1,
+	 0xA1, 0xD3, 0x59, 0xD1, 0x60, 0x45, 0xA5, 0xD3, 0x59, 0xD1, 0xB0, 0x84, 0xA5, 0xDB, 0x64, 0x44,
+	 0x06, 0x36, 0xCD, 0xFE, 0x07, 0x36, 0xD6, 0xFE, 0xE6, 0x01, 0x23, 0x46, 0xB7, 0x60, 0xAE, 0x78,
+	 0xFF, 0xFF, 0x46, 0x43, 0x1F, 0x60, 0x44, 0x61, 0xA1, 0xD3, 0x59, 0xD1, 0x06, 0x1B, 0x59, 0xD3,
+	 0x59, 0xD1, 0x03, 0x1B, 0x59, 0xD3, 0x59, 0xD1, 0xF0, 0x18, 0x00, 0x63, 0x49, 0xDD, 0x60, 0x40,
+	 0x02, 0x36, 0x11, 0x00, 0x03, 0x36, 0x32, 0x00, 0x01, 0x36, 0x08, 0x00, 0x05, 0x3A, 0xEA, 0x01,
+	 0xA4, 0xD3, 0x5A, 0xD3, 0x9C, 0x85, 0xA4, 0x84, 0xA2, 0xDB, 0xE4, 0x01, 0x01, 0x60, 0x0A, 0x61,
+	 0x00, 0x64, 0xA1, 0xDB, 0xDF, 0x01, 0xC2, 0x60, 0x8F, 0x64, 0x40, 0x45, 0x22, 0x00, 0x01, 0x60,
+	 0x0A, 0x66, 0xA6, 0xD3, 0x04, 0xA1, 0x60, 0x43, 0xA1, 0xD3, 0xC9, 0x81, 0x60, 0x45, 0x00, 0xBB,
+	 0xA1, 0xDB, 0xBE, 0xD3, 0x09, 0x03, 0xD4, 0x84, 0x9C, 0x84, 0xDC, 0x84, 0xFF, 0xFF, 0x04, 0x0E,
+	 0xA3, 0xD1, 0x63, 0x46, 0x64, 0x43, 0xF2, 0x01, 0x9C, 0x84, 0xDC, 0x85, 0x49, 0xDD, 0x61, 0x44,
+	 0x00, 0xBB, 0xA6, 0xDB, 0x02, 0x03, 0x65, 0x44, 0xBE, 0xDB, 0xBC, 0x01, 0xC2, 0x60, 0x6A, 0x64,
+	 0x40, 0x45, 0x01, 0x60, 0x0A, 0x66, 0xA6, 0xD3, 0xFF, 0xFF, 0xD0, 0x80, 0x0F, 0x18, 0x02, 0x03,
+	 0x60, 0x46, 0xF9, 0x01, 0x58, 0xD3, 0xA4, 0xD3, 0x60, 0x45, 0x00, 0x63, 0xA4, 0xDD, 0x05, 0x18,
+	 0x58, 0xD3, 0xFF, 0xFF, 0xC4, 0x83, 0xA2, 0xDD, 0xCA, 0x84, 0xA6, 0xDB, 0x25, 0x58, 0x64, 0x41,
+	 0x04, 0x60, 0x40, 0x62, 0x1A, 0x60, 0x58, 0x4D, 0xB4, 0x78, 0xFF, 0xFF, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x64, 0x40, 0x01, 0x2B, 0x50, 0x00, 0x28, 0x40, 0x08, 0x3A, 0x4D, 0x00, 0xE8, 0x84, 0xE8, 0x84,
+	 0xE8, 0x84, 0xE8, 0x84, 0x15, 0x60, 0xD5, 0xFB, 0x64, 0xF1, 0x24, 0x60, 0x88, 0x63, 0x64, 0x40,
+	 0x01, 0x27, 0x3C, 0xA3, 0x29, 0x40, 0x40, 0x2B, 0x1E, 0xA3, 0xBD, 0xD1, 0x63, 0x45, 0x44, 0x4E,
+	 0x0E, 0x61, 0xBD, 0xD1, 0xCD, 0x81, 0xD0, 0x80, 0x01, 0x03, 0xFB, 0x04, 0xCB, 0x83, 0x15, 0x60,
+	 0xD8, 0xF3, 0x39, 0xF1, 0xD7, 0x83, 0xEB, 0x83, 0x2E, 0x41, 0x5D, 0x93, 0xDF, 0x83, 0x15, 0x60,
+	 0xD4, 0xFD, 0x15, 0x60, 0xD3, 0xFB, 0x53, 0x93, 0xDF, 0x80, 0x10, 0x03, 0x38, 0xF3, 0xCF, 0x83,
+	 0x08, 0x03, 0xDF, 0x83, 0x0B, 0x02, 0xDF, 0x83, 0xDC, 0x84, 0xF0, 0xA0, 0x38, 0xFB, 0x06, 0x03,
+	 0x03, 0x00, 0xCC, 0x84, 0x38, 0xFB, 0x02, 0x03, 0x00, 0x63, 0x02, 0x00, 0x08, 0x64, 0x38, 0xFB,
+	 0xE3, 0x80, 0xFB, 0x83, 0xC3, 0x83, 0x63, 0x44, 0xFC, 0xA0, 0x02, 0x0E, 0x08, 0x07, 0x08, 0x00,
+	 0x04, 0xA4, 0xFF, 0xFF, 0x05, 0x0D, 0xFC, 0x64, 0xFF, 0x7F, 0x60, 0x43, 0x01, 0x00, 0x04, 0x63,
+	 0x39, 0xFD, 0x15, 0x60, 0xD7, 0xFD, 0x2F, 0x58, 0xFF, 0xFF, 0x15, 0x60, 0xD2, 0xF3, 0x40, 0x4E,
+	 0x60, 0x46, 0x2F, 0xDB, 0x44, 0x44, 0xA1, 0xD3, 0xD9, 0x81, 0x48, 0x94, 0x24, 0x5C, 0xD0, 0x9C,
+	 0x66, 0x42, 0x04, 0x06, 0xD2, 0x9C, 0x2F, 0xD9, 0x64, 0x46, 0x24, 0x44, 0xE0, 0x84, 0x44, 0xD3,
+	 0xA3, 0xDB, 0xFF, 0xB4, 0x60, 0x5C, 0x66, 0x44, 0x22, 0xA4, 0xD0, 0x84, 0xE0, 0xA0, 0x02, 0x0D,
+	 0x00, 0x64, 0x02, 0x00, 0x01, 0x04, 0x1F, 0x64, 0xA2, 0xD3, 0x60, 0x5C, 0x64, 0x5E, 0x60, 0x47,
+	 0x2F, 0xD1, 0x28, 0xA3, 0xA3, 0xD9, 0xD8, 0xA3, 0x2E, 0x42, 0x4E, 0x8E, 0xBD, 0xDB, 0xDB, 0x02,
+	 0x2D, 0x58, 0xFF, 0xFF, 0x43, 0xFF, 0x39, 0xE1, 0xA1, 0xFF, 0xFF, 0xFF, 0x84, 0x3E, 0xFB, 0x01,
+	 0x3D, 0x44, 0x00, 0xA8, 0xFF, 0xFF, 0x03, 0x02, 0x40, 0xFF, 0x44, 0xFF, 0xF4, 0x01, 0xA0, 0x4C,
+	 0x3D, 0x46, 0x2A, 0xF2, 0x46, 0x4D, 0x10, 0x25, 0x12, 0x00, 0x09, 0xE1, 0xA1, 0xFF, 0x2D, 0x46,
+	 0x0F, 0xF2, 0x01, 0x29, 0x06, 0x00, 0x2A, 0xF0, 0x40, 0xFF, 0x64, 0x40, 0x40, 0x2B, 0x08, 0xBC,
+	 0x02, 0xBC, 0x0F, 0xFA, 0x08, 0x25, 0xDE, 0x01, 0xCB, 0xFE, 0x5C, 0x5D, 0xDC, 0x01, 0x44, 0xFF,
+	 0x03, 0x2B, 0x21, 0x00, 0x88, 0xF3, 0x06, 0x61, 0x60, 0x43, 0x66, 0x45, 0x31, 0xF0, 0x63, 0x46,
+	 0x05, 0xF2, 0x65, 0x46, 0xD0, 0x80, 0x30, 0xF0, 0x0F, 0x02, 0x63, 0x46, 0x04, 0xF2, 0x65, 0x46,
+	 0xD0, 0x80, 0x2F, 0xF0, 0x09, 0x02, 0x63, 0x46, 0x03, 0xF2, 0x65, 0x46, 0xD0, 0x80, 0xFF, 0xFF,
+	 0x03, 0x02, 0xFF, 0xFF, 0x48, 0xFE, 0x06, 0x00, 0xCD, 0x81, 0x02, 0xA3, 0xE7, 0x02, 0x87, 0xF1,
+	 0x08, 0xFE, 0x64, 0x43, 0x26, 0x03, 0x31, 0xF2, 0x15, 0x60, 0x02, 0x65, 0x60, 0x47, 0x00, 0x7F,
+	 0xE0, 0x84, 0x44, 0xD3, 0x66, 0x41, 0x60, 0x46, 0x60, 0x43, 0x05, 0xF2, 0x16, 0x18, 0x61, 0x46,
+	 0x31, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x04, 0xF2, 0x0C, 0x02, 0x61, 0x46, 0x30, 0xF0, 0x63, 0x46,
+	 0xD0, 0x80, 0x03, 0xF2, 0x06, 0x02, 0x61, 0x46, 0x2F, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0xFF, 0xFF,
+	 0x07, 0x03, 0x80, 0xF4, 0xFF, 0xFF, 0x63, 0x46, 0xE8, 0x1B, 0x87, 0xF3, 0x08, 0xFE, 0x60, 0x43,
+	 0x61, 0x46, 0x07, 0xFC, 0x3F, 0xF2, 0x09, 0x60, 0xB0, 0x65, 0xD4, 0x80, 0x2A, 0xF2, 0x9D, 0x05,
+	 0x08, 0x25, 0x88, 0x01, 0x5C, 0x4B, 0x0C, 0x60, 0xEC, 0x61, 0xA1, 0xDF, 0x2D, 0x46, 0x3B, 0xF2,
+	 0x87, 0xF1, 0x87, 0xF4, 0x60, 0x40, 0x20, 0x2B, 0xB7, 0x00, 0xD3, 0x80, 0x2C, 0xF0, 0x8D, 0x03,
+	 0x07, 0xF4, 0x64, 0x40, 0x01, 0x26, 0x87, 0xF5, 0xBA, 0xF4, 0x2D, 0x46, 0x04, 0x64, 0x04, 0xB3,
+	 0x22, 0xF0, 0x04, 0x03, 0xC5, 0x60, 0xBD, 0x78, 0xFF, 0xFF, 0xA6, 0x00, 0x10, 0x64, 0xB0, 0x9C,
+	 0x3B, 0xF2, 0x22, 0xF8, 0x60, 0x47, 0xC0, 0xB7, 0x02, 0xFE, 0xF0, 0x84, 0xF0, 0x84, 0xF0, 0x84,
+	 0x00, 0xA8, 0x40, 0x4A, 0x17, 0x03, 0xE0, 0x81, 0x61, 0x43, 0x42, 0xFE, 0x00, 0x64, 0xF0, 0x84,
+	 0xFE, 0x1F, 0x40, 0x4A, 0xE1, 0x84, 0xE0, 0x84, 0x2D, 0x46, 0x07, 0xF4, 0xE0, 0x81, 0x3B, 0xF0,
+	 0x2A, 0x47, 0x0C, 0x60, 0x3A, 0x63, 0xA0, 0x84, 0x47, 0x9C, 0x10, 0x03, 0x7C, 0x44, 0x00, 0x60,
+	 0xB2, 0x63, 0x14, 0x00, 0x07, 0xF4, 0x3B, 0xF0, 0x66, 0x44, 0x64, 0x40, 0x80, 0x2B, 0x06, 0x00,
+	 0x00, 0x60, 0x78, 0x7C, 0x00, 0x60, 0xA2, 0x63, 0x43, 0x4C, 0x08, 0x00, 0x2D, 0x46, 0xC5, 0x60,
+	 0xB0, 0x78, 0xFF, 0xFF, 0x2D, 0x46, 0xC5, 0x60, 0xB0, 0x78, 0xFF, 0xFF, 0xCE, 0xFB, 0xCF, 0xF9,
+	 0xD0, 0xFD, 0xAD, 0x46, 0x3D, 0xF2, 0xAD, 0x46, 0xA3, 0xD0, 0xAD, 0x46, 0xD0, 0x80, 0x3C, 0xF2,
+	 0xAD, 0x46, 0x02, 0x03, 0x15, 0x07, 0xEE, 0x04, 0x5B, 0xD0, 0xAD, 0x46, 0xD0, 0x80, 0x3A, 0xF2,
+	 0x03, 0x03, 0xAD, 0x46, 0x0D, 0x07, 0xE6, 0x04, 0x3A, 0xF0, 0xAD, 0x46, 0x5B, 0xD0, 0x64, 0x44,
+	 0xD0, 0x80, 0x2B, 0x44, 0x05, 0x07, 0xDE, 0x03, 0xD0, 0x84, 0x10, 0xA4, 0xFF, 0xFF, 0x00, 0x07,
+	 0xCF, 0xF3, 0xCE, 0xF5, 0xFE, 0xA4, 0x0F, 0x60, 0xC0, 0x61, 0x0E, 0x63, 0x58, 0xD0, 0x59, 0xD9,
+	 0xFD, 0x1F, 0x2D, 0x46, 0x8B, 0xFF, 0x2D, 0x46, 0x0F, 0x60, 0xB2, 0x64, 0xC9, 0x60, 0x58, 0x4F,
+	 0x10, 0x78, 0xFF, 0xFF, 0x3F, 0xF2, 0x00, 0x60, 0x18, 0x70, 0x18, 0x71, 0x20, 0x72, 0x60, 0x53,
+	 0x88, 0x75, 0x00, 0xF2, 0x09, 0xE1, 0x60, 0x50, 0x12, 0x71, 0x6E, 0x72, 0x83, 0x75, 0xA1, 0xFF,
+	 0xFF, 0xFF, 0x08, 0x25, 0x1F, 0x00, 0x40, 0xFF, 0x02, 0xE1, 0xA1, 0xFF, 0xFF, 0xFF, 0x75, 0x40,
+	 0x03, 0x2A, 0x03, 0x00, 0x80, 0x75, 0x0A, 0x64, 0x0B, 0x00, 0x80, 0x75, 0x1B, 0xF3, 0x8B, 0xFF,
+	 0x02, 0x60, 0x00, 0x75, 0xFF, 0xFF, 0x02, 0x60, 0x00, 0x75, 0xDC, 0x84, 0xA2, 0xDB, 0x02, 0x64,
+	 0x98, 0xFF, 0x2D, 0x46, 0x0F, 0xF0, 0xFF, 0xFF, 0xB0, 0x84, 0xA2, 0xDA, 0x88, 0xFF, 0xC3, 0x60,
+	 0x74, 0x78, 0xFF, 0xFF, 0x8B, 0xFF, 0x02, 0x60, 0x00, 0x75, 0xFF, 0xFF, 0x02, 0x60, 0x00, 0x75,
+	 0x88, 0xFF, 0xC5, 0x60, 0x96, 0x78, 0xFF, 0xFF, 0x22, 0xF0, 0x22, 0x64, 0xB0, 0x84, 0x22, 0xFA,
+	 0x3A, 0xF0, 0xFF, 0xFF, 0x64, 0x44, 0xE0, 0x7F, 0xA0, 0x5B, 0x64, 0x47, 0xE1, 0x7F, 0x5A, 0xD0,
+	 0xA0, 0x5B, 0x64, 0x44, 0xE2, 0x7F, 0xA0, 0x5B, 0x64, 0x47, 0x7C, 0x5F, 0xE8, 0x84, 0xE8, 0x85,
+	 0x0D, 0x60, 0x02, 0x64, 0x44, 0xD3, 0x5A, 0xD1, 0x03, 0x1B, 0xC5, 0x60, 0xB0, 0x78, 0xFF, 0xFF,
+	 0x60, 0x45, 0x64, 0x44, 0xE3, 0x7F, 0xA0, 0x5B, 0x64, 0x47, 0xE4, 0x7F, 0x5A, 0xD1, 0xA0, 0x5B,
+	 0x64, 0x44, 0xE5, 0x7F, 0xA0, 0x5B, 0x64, 0x47, 0xE6, 0x7F, 0x5A, 0xD1, 0xA0, 0x5B, 0x64, 0x44,
+	 0xE7, 0x7F, 0xA0, 0x5B, 0x65, 0x40, 0x0D, 0x3A, 0x1C, 0x00, 0x64, 0x47, 0xE8, 0x7F, 0x5A, 0xD1,
+	 0xA0, 0x5B, 0x64, 0x44, 0xE9, 0x7F, 0xA0, 0x5B, 0x64, 0x47, 0xEA, 0x7F, 0x5A, 0xD1, 0xA0, 0x5B,
+	 0x64, 0x44, 0xEB, 0x7F, 0xA0, 0x5B, 0x64, 0x47, 0xEC, 0x7F, 0x5A, 0xD1, 0xA0, 0x5B, 0x64, 0x44,
+	 0xED, 0x7F, 0xA0, 0x5B, 0x64, 0x47, 0xEE, 0x7F, 0x5A, 0xD1, 0xA0, 0x5B, 0x64, 0x44, 0xEF, 0x7F,
+	 0xA0, 0x5B, 0x65, 0x44, 0xD8, 0x84, 0x08, 0x25, 0xB9, 0x00, 0x60, 0x7F, 0xA0, 0x5B, 0x80, 0x60,
+	 0x00, 0xEB, 0xA0, 0x60, 0x00, 0xEB, 0xD1, 0x60, 0x00, 0xEB, 0x3F, 0xF2, 0x3B, 0xF0, 0x60, 0x43,
+	 0xFC, 0xA4, 0x64, 0x40, 0x20, 0x2B, 0x03, 0x00, 0x08, 0xA4, 0x3F, 0xFA, 0x08, 0xA3, 0xF8, 0xA3,
+	 0x3F, 0xFA, 0x0A, 0xE1, 0xB3, 0xFF, 0x9A, 0xFF, 0xCB, 0x83, 0x00, 0xF4, 0x10, 0x62, 0x6C, 0x61,
+	 0x0E, 0xA3, 0xAB, 0x84, 0xF2, 0xA3, 0xA1, 0xFF, 0x08, 0x00, 0x00, 0xF4, 0x81, 0xF2, 0x6C, 0x18,
+	 0x02, 0x62, 0xC9, 0x81, 0xAB, 0x84, 0x01, 0x00, 0xA2, 0xDC, 0x7A, 0xD4, 0xFD, 0x1C, 0xA2, 0xDC,
+	 0x08, 0x25, 0x8C, 0x00, 0xF2, 0x1D, 0x41, 0x44, 0x7C, 0xA8, 0xD9, 0x81, 0xEE, 0x03, 0xFF, 0xB1,
+	 0x98, 0xFF, 0x09, 0xE1, 0xA1, 0xFF, 0xFF, 0xFF, 0x08, 0x25, 0x80, 0x00, 0x40, 0xFF, 0x42, 0x42,
+	 0x46, 0x43, 0x06, 0x1E, 0x04, 0x02, 0x00, 0xF4, 0x02, 0x62, 0x42, 0x42, 0x46, 0x43, 0x01, 0xA2,
+	 0x63, 0x45, 0x01, 0xA2, 0x62, 0x43, 0x46, 0x4C, 0xC6, 0x60, 0x58, 0x4F, 0x4B, 0x78, 0xFF, 0xFF,
+	 0x0A, 0xE1, 0x9A, 0xFF, 0x24, 0x41, 0x02, 0xA1, 0x65, 0x43, 0x08, 0xA3, 0x23, 0x46, 0x22, 0x42,
+	 0x7E, 0x3A, 0x0A, 0x00, 0x00, 0xF4, 0x81, 0xF2, 0x37, 0x18, 0x02, 0x62, 0xC9, 0x81, 0xAB, 0x84,
+	 0x03, 0x00, 0xA2, 0xDC, 0x7E, 0x36, 0xF6, 0x01, 0x7A, 0xD4, 0xFF, 0xFF, 0xFA, 0x1C, 0xA2, 0xDC,
+	 0xF1, 0x1D, 0xD9, 0x81, 0xFF, 0xB1, 0x0B, 0x1E, 0x62, 0x40, 0x7E, 0x3A, 0x02, 0x00, 0x00, 0xF4,
+	 0x02, 0x62, 0x5A, 0xD2, 0x89, 0xFF, 0x80, 0x4F, 0x6F, 0x44, 0xA2, 0xDA, 0x88, 0xFF, 0x98, 0xFF,
+	 0x3D, 0x46, 0x0F, 0xF0, 0x0A, 0x64, 0xB0, 0x84, 0x18, 0x14, 0xF7, 0xB4, 0xA2, 0xDA, 0x06, 0x60,
+	 0x76, 0xF3, 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x2A, 0x0C, 0x00, 0xD1, 0xF5, 0xD0, 0xF4, 0x0C, 0x60,
+	 0xEC, 0x61, 0x59, 0xD1, 0x3B, 0xF8, 0x05, 0x64, 0x59, 0xD1, 0xCC, 0x84, 0xBD, 0xD8, 0xFC, 0x02,
+	 0x2D, 0x46, 0xC3, 0x60, 0x74, 0x78, 0xFF, 0xFF, 0x28, 0x00, 0xA2, 0xDA, 0x2D, 0x46, 0x3B, 0xF0,
+	 0xFF, 0xFF, 0x64, 0x40, 0x20, 0x2B, 0x1E, 0x00, 0x07, 0xF4, 0xBB, 0xF0, 0x2A, 0x44, 0xA4, 0x84,
+	 0xFF, 0xFF, 0x2F, 0x26, 0x16, 0x00, 0x2D, 0x46, 0x64, 0x44, 0x3A, 0xF0, 0xBC, 0xF0, 0x64, 0x5F,
+	 0x3D, 0xF0, 0x07, 0xF4, 0xD0, 0xF4, 0xFF, 0xFF, 0x08, 0xA3, 0x5B, 0xD8, 0x65, 0x5C, 0x5B, 0xD8,
+	 0x5B, 0xDA, 0x2D, 0x46, 0xCE, 0xF3, 0x3C, 0xFA, 0xCF, 0xF3, 0x3D, 0xFA, 0x2A, 0x44, 0x23, 0xFA,
+	 0x01, 0x00, 0x2D, 0x46, 0xC3, 0x60, 0x74, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0x98, 0xFF, 0x43, 0xFF,
+	 0x40, 0xFF, 0xB0, 0xFF, 0xB1, 0xFF, 0x2D, 0x46, 0x0C, 0x60, 0xEC, 0x61, 0xA1, 0xD3, 0x2D, 0x46,
+	 0x60, 0x40, 0x01, 0x2A, 0x0A, 0x00, 0xD1, 0xF5, 0xD0, 0xF4, 0x59, 0xD1, 0x3B, 0xF8, 0x05, 0x64,
+	 0x59, 0xD1, 0xCC, 0x84, 0xBD, 0xD8, 0xFC, 0x02, 0x2D, 0x46, 0xC3, 0x60, 0x53, 0x78, 0xFF, 0xFF,
+	 0x98, 0xFF, 0x09, 0xE1, 0xA1, 0xFF, 0x3D, 0x46, 0x08, 0x25, 0xE0, 0x01, 0x0F, 0xF2, 0x40, 0xFF,
+	 0x02, 0xBC, 0xA2, 0xDA, 0xC3, 0x60, 0x74, 0x78, 0xFF, 0xFF, 0xB0, 0x84, 0x22, 0xFA, 0x00, 0x63,
+	 0x3B, 0xF2, 0x06, 0x60, 0x76, 0xFD, 0x60, 0x47, 0xC0, 0xB7, 0x02, 0xFE, 0xF0, 0x84, 0xF0, 0x84,
+	 0xF0, 0x84, 0x00, 0xA8, 0x40, 0x4A, 0x16, 0x03, 0xE0, 0x81, 0x61, 0x43, 0x42, 0xFE, 0x00, 0x64,
+	 0xF0, 0x84, 0xFE, 0x1F, 0x40, 0x4A, 0xE1, 0x84, 0xE0, 0x84, 0x2D, 0x46, 0x07, 0xF4, 0xE0, 0x81,
+	 0x3B, 0xF0, 0x2A, 0x47, 0x0C, 0x60, 0x3A, 0x63, 0xA0, 0x84, 0x47, 0x9C, 0x10, 0x03, 0x7C, 0x44,
+	 0xA8, 0x63, 0x0F, 0x00, 0x07, 0xF4, 0x20, 0x64, 0x40, 0x4A, 0x3B, 0xF0, 0x66, 0x44, 0x64, 0x40,
+	 0x80, 0x2B, 0x05, 0x00, 0x00, 0x60, 0x78, 0x7C, 0x00, 0x60, 0x98, 0x63, 0x02, 0x00, 0x2D, 0x46,
+	 0xBF, 0x01, 0x2D, 0x46, 0xCE, 0xFB, 0xCF, 0xF9, 0xD0, 0xFD, 0x07, 0xF2, 0xD1, 0xFB, 0x60, 0x46,
+	 0x3B, 0xF0, 0x2A, 0x44, 0x06, 0x60, 0x77, 0xF9, 0x5C, 0x4B, 0xA0, 0x84, 0xFF, 0xFF, 0x3F, 0x22,
+	 0x05, 0x00, 0x90, 0x84, 0x3B, 0xFA, 0x01, 0x64, 0x40, 0x4B, 0x21, 0x00, 0xAD, 0x46, 0x0A, 0xA3,
+	 0x3D, 0xF2, 0xAD, 0x46, 0xA3, 0xD0, 0xAD, 0x46, 0xD0, 0x80, 0x3C, 0xF2, 0xAD, 0x46, 0x02, 0x03,
+	 0x16, 0x07, 0x14, 0x04, 0x5B, 0xD0, 0xAD, 0x46, 0xD0, 0x80, 0x3B, 0xF2, 0x03, 0x03, 0xAD, 0x46,
+	 0x0E, 0x07, 0x0C, 0x04, 0x3A, 0xF0, 0xAD, 0x46, 0x5B, 0xD0, 0x64, 0x5F, 0xD0, 0x80, 0x2B, 0x44,
+	 0x17, 0x07, 0x04, 0x03, 0xD0, 0x84, 0x10, 0xA4, 0xFF, 0xFF, 0x12, 0x07, 0x89, 0x01, 0x01, 0x64,
+	 0x06, 0x60, 0x76, 0xFB, 0x2D, 0x46, 0x0C, 0x60, 0xFC, 0x62, 0x80, 0xFF, 0x78, 0x44, 0x03, 0xA4,
+	 0xA2, 0xDB, 0xC6, 0x60, 0x76, 0x78, 0xFF, 0xFF, 0x85, 0xFF, 0x2D, 0x46, 0x08, 0x25, 0x5E, 0x01,
+	 0x2D, 0x46, 0x0C, 0x60, 0xFC, 0x62, 0x80, 0xFF, 0x78, 0x44, 0x03, 0xA4, 0xA2, 0xDB, 0xC6, 0x60,
+	 0xFE, 0x78, 0xFF, 0xFF, 0x85, 0xFF, 0x2D, 0x46, 0x08, 0x25, 0x50, 0x01, 0x00, 0x60, 0x0F, 0x64,
+	 0xC4, 0x60, 0xDB, 0x78, 0xFF, 0xFF, 0x2D, 0x46, 0x3B, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x20, 0x2B,
+	 0x23, 0x00, 0x00, 0xF4, 0x08, 0x61, 0x2D, 0x46, 0x00, 0xF4, 0x0A, 0x62, 0x56, 0x92, 0x5A, 0xD0,
+	 0x2C, 0x46, 0x64, 0x47, 0x63, 0x40, 0x7F, 0x2A, 0x03, 0x00, 0x00, 0xF4, 0x03, 0x63, 0x46, 0x4C,
+	 0x60, 0xFE, 0xDE, 0xD8, 0x7F, 0x3A, 0x03, 0x00, 0x00, 0xF4, 0x03, 0x63, 0x46, 0x4C, 0xDE, 0xDA,
+	 0xFE, 0xA1, 0x20, 0xFE, 0xE8, 0x02, 0x63, 0x41, 0xFD, 0xA1, 0x46, 0x4C, 0x01, 0xF2, 0x2D, 0x46,
+	 0x61, 0x5E, 0x16, 0xFA, 0x2C, 0x44, 0x06, 0xFA, 0x2F, 0x58, 0xFF, 0xFF, 0x07, 0xF4, 0x66, 0x41,
+	 0x03, 0xF2, 0x04, 0xF2, 0x40, 0x42, 0x05, 0xF2, 0x40, 0x43, 0x40, 0x44, 0x61, 0x46, 0x3C, 0xF2,
+	 0x3D, 0xF2, 0x40, 0x40, 0x40, 0x41, 0x0D, 0x60, 0x72, 0x65, 0x00, 0x61, 0xCF, 0xF1, 0xCE, 0xF5,
+	 0x44, 0x4C, 0x2C, 0x5C, 0xE9, 0x80, 0x00, 0x64, 0xF0, 0x84, 0xF0, 0x84, 0xC0, 0x83, 0xBD, 0xD2,
+	 0x24, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F,
+	 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C, 0x20, 0x44, 0x40, 0x80, 0xDB, 0x83, 0xBD, 0xD2,
+	 0x20, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F,
+	 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C, 0x21, 0x44, 0x40, 0x81, 0xDB, 0x83, 0xBD, 0xD2,
+	 0x21, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F,
+	 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C, 0x22, 0x44, 0x40, 0x82, 0xDB, 0x83, 0xBD, 0xD2,
+	 0x22, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F,
+	 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C, 0x23, 0x44, 0x40, 0x83, 0xF2, 0xA3, 0xBD, 0xD2,
+	 0x23, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F,
+	 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C, 0x24, 0x44, 0xC0, 0x9C, 0x41, 0x84, 0xDD, 0x81,
+	 0x08, 0x2A, 0xA7, 0x01, 0x0C, 0x60, 0xEE, 0x61, 0x05, 0x64, 0xD0, 0xF4, 0xD1, 0xF5, 0xFE, 0xA3,
+	 0x5B, 0xD0, 0xCC, 0x84, 0x59, 0xD9, 0xFC, 0x02, 0xD0, 0xF3, 0xD1, 0xF5, 0x60, 0x42, 0x20, 0x44,
+	 0xA2, 0xDA, 0x21, 0x44, 0x5A, 0xDA, 0x22, 0x44, 0x5A, 0xDA, 0x23, 0x44, 0x5A, 0xDA, 0x24, 0x44,
+	 0x5A, 0xDA, 0x61, 0x46, 0x06, 0x60, 0x7E, 0xF7, 0xFF, 0xFF, 0xFF, 0xFF, 0x66, 0x41, 0xD0, 0xF3,
+	 0xD1, 0xF5, 0xA0, 0xD2, 0x5A, 0xD0, 0x40, 0x40, 0x44, 0x41, 0x5A, 0xD2, 0x5A, 0xD0, 0x40, 0x42,
+	 0x5A, 0xD0, 0x44, 0x43, 0x61, 0x46, 0xBA, 0xF0, 0x3B, 0xF2, 0x44, 0x44, 0x65, 0x5F, 0x40, 0x85,
+	 0xCF, 0xF4, 0xCE, 0xF5, 0x43, 0x4C, 0x0D, 0x60, 0x72, 0x65, 0xBD, 0xD2, 0x25, 0x5C, 0x90, 0x9C,
+	 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1,
+	 0x64, 0x47, 0x90, 0x9C, 0x20, 0x44, 0x40, 0x80, 0xBD, 0xD2, 0x20, 0x5C, 0x90, 0x9C, 0x64, 0x47,
+	 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47,
+	 0x90, 0x9C, 0x21, 0x44, 0x40, 0x81, 0xBD, 0xD2, 0x21, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F,
+	 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C,
+	 0x22, 0x44, 0x40, 0x82, 0xBD, 0xD2, 0x22, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84,
+	 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C, 0x23, 0x44,
+	 0x40, 0x83, 0xBD, 0xD2, 0x23, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1,
+	 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C, 0x24, 0x44, 0x40, 0x84,
+	 0xBD, 0xD2, 0x24, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44,
+	 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C, 0x25, 0x44, 0x40, 0x85, 0x61, 0x46,
+	 0x3A, 0xF0, 0xFF, 0xFF, 0x64, 0x44, 0xE0, 0x7F, 0xA0, 0x5B, 0x64, 0x47, 0xE1, 0x7F, 0x5A, 0xD0,
+	 0xA0, 0x5B, 0x64, 0x44, 0xE2, 0x7F, 0xA0, 0x5B, 0x64, 0x47, 0xCE, 0xF5, 0xBD, 0xD2, 0x25, 0x5C,
+	 0x90, 0x84, 0xE8, 0x80, 0xF8, 0x84, 0x20, 0x5C, 0x40, 0x80, 0x20, 0x44, 0xE4, 0x7F, 0xA0, 0x5B,
+	 0x20, 0x47, 0xE5, 0x7F, 0xA0, 0x5B, 0xBD, 0xD2, 0x20, 0x5C, 0x90, 0x84, 0xE8, 0x80, 0xF8, 0x84,
+	 0x21, 0x5C, 0x40, 0x81, 0x21, 0x44, 0xE6, 0x7F, 0xA0, 0x5B, 0x21, 0x47, 0xE7, 0x7F, 0xA0, 0x5B,
+	 0x21, 0x44, 0xE8, 0x80, 0xF8, 0x84, 0x22, 0x5C, 0x40, 0x82, 0x22, 0x44, 0xE8, 0x7F, 0xA0, 0x5B,
+	 0x22, 0x47, 0xE9, 0x7F, 0xA0, 0x5B, 0x22, 0x44, 0xE8, 0x80, 0xF8, 0x84, 0x23, 0x5C, 0x40, 0x83,
+	 0x23, 0x44, 0xEA, 0x7F, 0xA0, 0x5B, 0x23, 0x47, 0xEB, 0x7F, 0xA0, 0x5B, 0x23, 0x44, 0xE8, 0x80,
+	 0xF8, 0x84, 0x24, 0x5C, 0x40, 0x84, 0x24, 0x44, 0xEC, 0x7F, 0xA0, 0x5B, 0x24, 0x47, 0xED, 0x7F,
+	 0xA0, 0x5B, 0x24, 0x44, 0xE8, 0x80, 0xF8, 0x84, 0x25, 0x5C, 0x40, 0x85, 0x25, 0x44, 0xEE, 0x7F,
+	 0xA0, 0x5B, 0x25, 0x47, 0xEF, 0x7F, 0xA0, 0x5B, 0x2C, 0x43, 0xA3, 0xD2, 0x25, 0x5C, 0x90, 0x81,
+	 0xE9, 0x84, 0xE3, 0x7F, 0xA0, 0x5B, 0x06, 0x60, 0x7E, 0xF7, 0xFF, 0xFF, 0xFF, 0xFF, 0xCB, 0xF3,
+	 0x5A, 0xD3, 0x40, 0x48, 0x5A, 0xD3, 0x40, 0x49, 0x40, 0x4A, 0x00, 0x60, 0x78, 0x7C, 0x44, 0x4D,
+	 0x49, 0xF2, 0x4A, 0xF2, 0x40, 0x47, 0x40, 0x46, 0x0D, 0x60, 0x72, 0x65, 0x00, 0x61, 0x2D, 0x5C,
+	 0xE9, 0x80, 0x00, 0x64, 0xF0, 0x84, 0xF0, 0x84, 0xC0, 0x83, 0xBD, 0xD2, 0x2A, 0x5C, 0x90, 0x9C,
+	 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1,
+	 0x64, 0x47, 0x90, 0x9C, 0x26, 0x44, 0x40, 0x86, 0xDB, 0x83, 0xBD, 0xD2, 0x26, 0x5C, 0x90, 0x9C,
+	 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1,
+	 0x64, 0x47, 0x90, 0x9C, 0x27, 0x44, 0x40, 0x87, 0xDB, 0x83, 0xBD, 0xD2, 0x27, 0x5C, 0x90, 0x9C,
+	 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1,
+	 0x64, 0x47, 0x90, 0x9C, 0x28, 0x44, 0x40, 0x88, 0xDB, 0x83, 0xBD, 0xD2, 0x28, 0x5C, 0x90, 0x9C,
+	 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1,
+	 0x64, 0x47, 0x90, 0x9C, 0x29, 0x44, 0x40, 0x89, 0xF2, 0xA3, 0xBD, 0xD2, 0x29, 0x5C, 0x90, 0x9C,
+	 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1,
+	 0x64, 0x47, 0x90, 0x9C, 0x2A, 0x44, 0xC0, 0x9C, 0x41, 0x8A, 0xDD, 0x81, 0x08, 0x2A, 0xA7, 0x01,
+	 0x26, 0x44, 0x44, 0xFA, 0x27, 0x44, 0x45, 0xFA, 0x28, 0x44, 0x46, 0xFA, 0x29, 0x44, 0x47, 0xFA,
+	 0x2A, 0x44, 0x48, 0xFA, 0x06, 0x60, 0x7F, 0xF7, 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x60, 0x88, 0x7C,
+	 0x44, 0x4D, 0x2D, 0x42, 0xA2, 0xD2, 0x5A, 0xD0, 0x40, 0x46, 0x44, 0x47, 0x5A, 0xD2, 0x5A, 0xD0,
+	 0x40, 0x48, 0x5A, 0xD0, 0x44, 0x49, 0x4B, 0xF2, 0x44, 0x4A, 0x40, 0x8B, 0x60, 0x5C, 0x64, 0x47,
+	 0xE0, 0x7F, 0xA0, 0x5A, 0xFF, 0xB4, 0x20, 0xBC, 0x7F, 0xB4, 0xE1, 0x7F, 0xA0, 0x5A, 0x64, 0x44,
+	 0xE2, 0x7F, 0xA0, 0x5A, 0x00, 0x60, 0x78, 0x63, 0x0D, 0x60, 0x72, 0x65, 0xBD, 0xD2, 0x2B, 0x5C,
+	 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84,
+	 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C, 0x26, 0x44, 0x40, 0x86, 0xBD, 0xD2, 0x26, 0x5C, 0x90, 0x9C,
+	 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1,
+	 0x64, 0x47, 0x90, 0x9C, 0x27, 0x44, 0x40, 0x87, 0xBD, 0xD2, 0x27, 0x5C, 0x90, 0x9C, 0x64, 0x47,
+	 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47,
+	 0x90, 0x9C, 0x28, 0x44, 0x40, 0x88, 0xBD, 0xD2, 0x28, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F,
+	 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C,
+	 0x29, 0x44, 0x40, 0x89, 0xBD, 0xD2, 0x29, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84,
+	 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C, 0x2A, 0x44,
+	 0x40, 0x8A, 0xBD, 0xD2, 0x2A, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1,
+	 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C, 0x2B, 0x44, 0x40, 0x8B,
+	 0xBD, 0xD2, 0x2B, 0x5C, 0x90, 0x84, 0xE8, 0x80, 0xF8, 0x84, 0x26, 0x5C, 0x40, 0x86, 0x26, 0x44,
+	 0xE4, 0x7F, 0xA0, 0x5A, 0x26, 0x47, 0xE5, 0x7F, 0xA0, 0x5A, 0xBD, 0xD2, 0x26, 0x5C, 0x90, 0x84,
+	 0xE8, 0x80, 0xF8, 0x84, 0x27, 0x5C, 0x40, 0x87, 0x27, 0x44, 0xE6, 0x7F, 0xA0, 0x5A, 0x27, 0x47,
+	 0xE7, 0x7F, 0xA0, 0x5A, 0x27, 0x44, 0xE8, 0x80, 0xF8, 0x84, 0x28, 0x5C, 0x40, 0x88, 0x28, 0x44,
+	 0xE8, 0x7F, 0xA0, 0x5A, 0x28, 0x47, 0xE9, 0x7F, 0xA0, 0x5A, 0x28, 0x44, 0xE8, 0x80, 0xF8, 0x84,
+	 0x29, 0x5C, 0x40, 0x89, 0x29, 0x44, 0xEA, 0x7F, 0xA0, 0x5A, 0x29, 0x47, 0xEB, 0x7F, 0xA0, 0x5A,
+	 0x29, 0x44, 0xE8, 0x80, 0xF8, 0x84, 0x2A, 0x5C, 0x40, 0x8A, 0x2A, 0x44, 0xEC, 0x7F, 0xA0, 0x5A,
+	 0x2A, 0x47, 0xED, 0x7F, 0xA0, 0x5A, 0x2A, 0x44, 0xE8, 0x80, 0xF8, 0x84, 0x2B, 0x5C, 0x40, 0x8B,
+	 0x2B, 0x44, 0xEE, 0x7F, 0xA0, 0x5A, 0x2B, 0x47, 0xEF, 0x7F, 0xA0, 0x5A, 0x3C, 0xF0, 0x2B, 0x44,
+	 0x90, 0x84, 0xE8, 0x84, 0xE3, 0x7F, 0xA0, 0x5A, 0x06, 0x60, 0x7F, 0xF7, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x60, 0x45, 0x00, 0xF0, 0x84, 0x60, 0x00, 0xE3, 0x04, 0x71, 0x64, 0x50, 0x01, 0x2A, 0x04, 0x71,
+	 0x5C, 0x61, 0x04, 0x63, 0x59, 0xD0, 0x58, 0xD9, 0xFD, 0x1F, 0x3D, 0xF2, 0x60, 0x43, 0x60, 0x47,
+	 0x5B, 0xDB, 0x3C, 0xF2, 0xFF, 0xFF, 0x60, 0x47, 0x5B, 0xDB, 0x3A, 0xF2, 0xFF, 0xFF, 0x60, 0x47,
+	 0x5B, 0xDB, 0x3F, 0xF2, 0xFF, 0xFF, 0x60, 0x47, 0x5B, 0xDB, 0x81, 0x60, 0x18, 0xE3, 0x65, 0x43,
+	 0xE3, 0x84, 0x60, 0x47, 0x00, 0x7F, 0x60, 0x50, 0x7F, 0x64, 0x23, 0x94, 0x60, 0x51, 0x7C, 0x72,
+	 0x04, 0x75, 0x0C, 0x60, 0x16, 0x61, 0x16, 0x60, 0x00, 0x63, 0x59, 0xDD, 0x2A, 0xF2, 0x87, 0x60,
+	 0x8F, 0x65, 0xA4, 0x87, 0x40, 0xBF, 0x59, 0xDB, 0x56, 0x64, 0x0A, 0x63, 0x58, 0xD0, 0x59, 0xD9,
+	 0xFD, 0x1F, 0x62, 0x64, 0x04, 0x63, 0x58, 0xD0, 0x59, 0xD9, 0xFD, 0x1F, 0x35, 0xF2, 0x0F, 0x65,
+	 0xA4, 0x9C, 0x59, 0xD9, 0x06, 0x63, 0x59, 0xDF, 0xFE, 0x1F, 0x2A, 0xF2, 0xFF, 0xFF, 0x60, 0x45,
+	 0x03, 0x2B, 0x05, 0x00, 0x6A, 0x64, 0x04, 0x63, 0x58, 0xD0, 0x59, 0xD9, 0xFD, 0x1F, 0x65, 0x40,
+	 0x8F, 0xB0, 0x88, 0x3A, 0x02, 0x00, 0x39, 0xF0, 0x59, 0xD9, 0x2F, 0x58, 0xFF, 0xFF, 0x0C, 0x60,
+	 0x16, 0x61, 0xA3, 0x46, 0x00, 0xF4, 0x02, 0x64, 0x0A, 0x63, 0x58, 0xD0, 0x59, 0xD9, 0xFD, 0x1F,
+	 0x59, 0xDF, 0x59, 0xDF, 0xA0, 0x4C, 0x04, 0xBC, 0xFF, 0xB4, 0xA0, 0x51, 0x23, 0x44, 0x01, 0xA7,
+	 0x80, 0xBF, 0x60, 0x50, 0x80, 0x60, 0x38, 0x71, 0x80, 0x60, 0x7C, 0x72, 0x01, 0x76, 0xFF, 0xFF,
+	 0x76, 0x44, 0x01, 0x3A, 0xFD, 0x01, 0x40, 0x76, 0x42, 0xFF, 0xFF, 0xFF, 0x40, 0x76, 0x80, 0x60,
+	 0x18, 0x70, 0x80, 0x60, 0x18, 0x71, 0x80, 0x60, 0x7C, 0x72, 0x80, 0x60, 0x10, 0x73, 0x02, 0x76,
+	 0x76, 0x44, 0xFF, 0xFF, 0x76, 0x44, 0x02, 0x3A, 0xFD, 0x01, 0x40, 0x76, 0x42, 0xFF, 0x3C, 0x46,
+	 0x00, 0xF2, 0x80, 0x60, 0x00, 0xBC, 0x60, 0x50, 0x80, 0x60, 0x12, 0x71, 0x80, 0x60, 0x6E, 0x72,
+	 0x3F, 0xF2, 0xFF, 0xFF, 0xF8, 0xA7, 0x80, 0xBF, 0x60, 0x53, 0x04, 0x76, 0xFF, 0xFF, 0x88, 0xFF,
+	 0x3C, 0x46, 0x07, 0xF2, 0xFF, 0xFF, 0x40, 0x43, 0xA3, 0x46, 0x2F, 0x58, 0xFF, 0xFF, 0x77, 0x40,
+	 0x8B, 0xFF, 0xA0, 0x4C, 0x04, 0xE1, 0xFF, 0xFF, 0x76, 0x44, 0x04, 0x3A, 0xFD, 0x01, 0x40, 0x76,
+	 0x42, 0xFF, 0xFF, 0xFF, 0x10, 0x76, 0xFF, 0xFF, 0x76, 0x44, 0x20, 0x3A, 0xFD, 0x01, 0x40, 0x76,
+	 0x42, 0xFF, 0xA0, 0x48, 0x00, 0x7F, 0xA0, 0x51, 0x02, 0x60, 0x00, 0x75, 0x88, 0xFF, 0xA0, 0x4C,
+	 0xFB, 0xB4, 0xA0, 0x51, 0x06, 0x60, 0x1F, 0xE1, 0x16, 0xFF, 0x2F, 0x58, 0xFF, 0xFF, 0x26, 0x46,
+	 0x3F, 0xF2, 0xFF, 0xFF, 0xF8, 0xA4, 0x3F, 0xFA, 0x00, 0xF4, 0x60, 0x47, 0x08, 0xFA, 0xA0, 0x48,
+	 0x08, 0x26, 0x07, 0x00, 0xA0, 0x4C, 0x04, 0xE1, 0xFF, 0xFF, 0xA1, 0xFF, 0xFF, 0xFF, 0x00, 0x7F,
+	 0xA0, 0x51, 0x42, 0xFF, 0x26, 0x46, 0x8B, 0xFF, 0x02, 0x60, 0x00, 0x75, 0x3C, 0xF2, 0x40, 0x76,
+	 0x14, 0x1B, 0x26, 0x46, 0x3B, 0xF2, 0x0C, 0x60, 0xBC, 0x63, 0x60, 0x47, 0xC0, 0xB4, 0xE8, 0x84,
+	 0xE8, 0x84, 0xE8, 0x84, 0x43, 0x93, 0xE3, 0x9C, 0x64, 0x47, 0x80, 0x7C, 0x64, 0x5F, 0x60, 0x50,
+	 0x7F, 0x64, 0x23, 0x97, 0x80, 0xBF, 0x60, 0x51, 0x07, 0x00, 0x01, 0xA7, 0x80, 0xBF, 0x60, 0x50,
+	 0x80, 0x60, 0x40, 0x71, 0x80, 0x60, 0x7C, 0x72, 0x01, 0x76, 0xFF, 0xFF, 0xA1, 0xFF, 0xFF, 0xFF,
+	 0x0C, 0x21, 0xFC, 0x01, 0x04, 0x25, 0xD5, 0x01, 0x40, 0x76, 0x43, 0xFF, 0x0C, 0x60, 0x22, 0x61,
+	 0x26, 0x46, 0x00, 0xF4, 0x02, 0x64, 0x0A, 0x63, 0x58, 0xD0, 0x59, 0xD9, 0xFD, 0x1F, 0x59, 0xDF,
+	 0x59, 0xDF, 0x80, 0x60, 0x18, 0x70, 0x80, 0x60, 0x24, 0x71, 0x80, 0x60, 0x7C, 0x72, 0x80, 0x60,
+	 0x10, 0x73, 0x02, 0x76, 0xFF, 0xFF, 0xA1, 0xFF, 0xFF, 0xFF, 0x0C, 0x21, 0xFC, 0x01, 0x04, 0x25,
+	 0xB8, 0x01, 0x40, 0x76, 0x43, 0xFF, 0x26, 0x46, 0x00, 0xF2, 0xFF, 0xFF, 0x60, 0x47, 0x80, 0xBF,
+	 0x60, 0x50, 0x80, 0x60, 0x12, 0x71, 0x3F, 0xF2, 0x80, 0x60, 0x6E, 0x72, 0x60, 0x47, 0x80, 0xBF,
+	 0x60, 0x53, 0x04, 0x76, 0xFF, 0xFF, 0xA1, 0xFF, 0xFF, 0xFF, 0x0C, 0x21, 0xFC, 0x01, 0x04, 0x25,
+	 0xA0, 0x01, 0x40, 0x76, 0x43, 0xFF, 0x08, 0x76, 0xFF, 0xFF, 0xA1, 0xFF, 0xFF, 0xFF, 0x0C, 0x21,
+	 0xFC, 0x01, 0x04, 0x25, 0x96, 0x01, 0x76, 0x5C, 0xFF, 0xFF, 0x40, 0x76, 0x43, 0xFF, 0x88, 0xFF,
+	 0x26, 0x46, 0x2F, 0x58, 0xFF, 0xFF, 0xDF, 0x60, 0x2A, 0x78, 0xFF, 0xFF, 0x08, 0x60, 0x11, 0xF1,
+	 0x80, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x20, 0x00, 0x74, 0xF3, 0x31, 0x40,
+	 0x01, 0x2A, 0x1C, 0x00, 0xDC, 0x84, 0x01, 0xB4, 0x74, 0xFB, 0x08, 0x02, 0x08, 0x60, 0x12, 0xF1,
+	 0x00, 0x60, 0x04, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x10, 0x00, 0x08, 0x60, 0x18, 0xF1,
+	 0x00, 0x60, 0x02, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x08, 0x00, 0xA9, 0xFE, 0xE6, 0x05,
+	 0xAB, 0xFE, 0x07, 0x05, 0xA8, 0xFE, 0xD7, 0x05, 0xAA, 0xFE, 0xD8, 0x05, 0xA1, 0xFF, 0xFF, 0xFF,
+	 0x85, 0x3E, 0x0F, 0x60, 0x85, 0xF3, 0xFF, 0xFF, 0x00, 0xA8, 0x60, 0x46, 0x03, 0x02, 0xCA, 0x60,
+	 0x7E, 0x78, 0xFF, 0xFF, 0x26, 0x45, 0xD4, 0x80, 0x0F, 0xF0, 0xF9, 0x03, 0x64, 0x44, 0x70, 0xB0,
+	 0x70, 0x2A, 0x13, 0x00, 0x13, 0x60, 0x08, 0xF3, 0xFF, 0xFF, 0xDC, 0x84, 0x00, 0x36, 0x00, 0x3B,
+	 0xA2, 0xDB, 0xA2, 0xFF, 0x8E, 0xF3, 0xFF, 0xFF, 0xCC, 0x84, 0xFE, 0xA0, 0x8E, 0xFB, 0x01, 0x07,
+	 0xD4, 0xFE, 0xA3, 0xFF, 0xCE, 0x60, 0x38, 0x78, 0xFF, 0xFF, 0x64, 0x40, 0x02, 0x26, 0x09, 0x00,
+	 0x66, 0x45, 0x09, 0xF4, 0x0F, 0xF2, 0x02, 0x18, 0x65, 0x46, 0xE4, 0x1B, 0x00, 0x64, 0x40, 0x46,
+	 0xCD, 0x01, 0xA2, 0xFF, 0x8E, 0xF3, 0x46, 0x46, 0xCC, 0x84, 0xFE, 0xA0, 0x8E, 0xFB, 0x01, 0x07,
+	 0xD4, 0xFE, 0xA3, 0xFF, 0x0F, 0xF0, 0xA3, 0xFC, 0x64, 0x44, 0x80, 0x26, 0x17, 0x00, 0x25, 0x60,
+	 0xF0, 0x64, 0xE5, 0x60, 0x78, 0x41, 0xC7, 0x78, 0x97, 0xF1, 0x32, 0x44, 0x01, 0x2A, 0x03, 0x00,
+	 0x07, 0x60, 0x01, 0x64, 0x04, 0x00, 0x02, 0x2A, 0x06, 0x00, 0x00, 0x60, 0x01, 0x64, 0x23, 0xFA,
+	 0xCE, 0x60, 0x44, 0x78, 0xFF, 0xFF, 0xCE, 0x60, 0x38, 0x78, 0xFF, 0xFF, 0x0F, 0xF0, 0xFF, 0xFF,
+	 0x64, 0x44, 0x08, 0x26, 0x34, 0x00, 0x2A, 0xF2, 0x60, 0x63, 0x60, 0x40, 0x02, 0x2B, 0x66, 0x63,
+	 0xBE, 0xD2, 0x68, 0xF1, 0xA3, 0xD2, 0xD0, 0x80, 0x67, 0xF1, 0x0D, 0x02, 0xBF, 0xD2, 0xD0, 0x80,
+	 0x66, 0xF1, 0x09, 0x02, 0xD0, 0x80, 0xFF, 0xFF, 0x06, 0x02, 0x25, 0x60, 0xFC, 0x64, 0xE5, 0x60,
+	 0x78, 0x41, 0xC7, 0x78, 0x97, 0xF1, 0x32, 0x44, 0x01, 0x2A, 0x03, 0x00, 0x07, 0x60, 0x02, 0x64,
+	 0x04, 0x00, 0x02, 0x2A, 0x06, 0x00, 0x00, 0x60, 0x02, 0x64, 0x23, 0xFA, 0xCE, 0x60, 0x44, 0x78,
+	 0xFF, 0xFF, 0x2A, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0xB0, 0x3A, 0x06, 0x00, 0x00, 0x60, 0x02, 0x64,
+	 0x23, 0xFA, 0xCB, 0x60, 0x9D, 0x78, 0xFF, 0xFF, 0xCE, 0x60, 0x38, 0x78, 0xFF, 0xFF, 0x32, 0x44,
+	 0x01, 0x2A, 0x4A, 0x00, 0x27, 0x60, 0x6A, 0x63, 0xBF, 0xD3, 0x00, 0x65, 0xB4, 0x81, 0xDB, 0x83,
+	 0x3D, 0x03, 0xBF, 0xD3, 0xA3, 0xD3, 0x40, 0x48, 0xBE, 0xD3, 0x40, 0x4A, 0x2E, 0xF0, 0x40, 0x4C,
+	 0xD0, 0x80, 0x2D, 0xF0, 0x08, 0x02, 0x2A, 0x44, 0xD0, 0x80, 0x2C, 0xF0, 0x04, 0x02, 0x28, 0x44,
+	 0xD0, 0x80, 0xFF, 0xFF, 0x2B, 0x03, 0x31, 0xF0, 0x2C, 0x44, 0xD0, 0x80, 0x30, 0xF0, 0x08, 0x02,
+	 0x2A, 0x44, 0xD0, 0x80, 0x2F, 0xF0, 0x04, 0x02, 0x28, 0x44, 0xD0, 0x80, 0xFF, 0xFF, 0x1E, 0x03,
+	 0x34, 0xF0, 0x2C, 0x44, 0xD0, 0x80, 0x33, 0xF0, 0x08, 0x02, 0x2A, 0x44, 0xD0, 0x80, 0x32, 0xF0,
+	 0x04, 0x02, 0x28, 0x44, 0xD0, 0x80, 0xFF, 0xFF, 0x11, 0x03, 0x38, 0xF0, 0x2C, 0x44, 0xD0, 0x80,
+	 0x37, 0xF0, 0x08, 0x02, 0x2A, 0x44, 0xD0, 0x80, 0x36, 0xF0, 0x04, 0x02, 0x28, 0x44, 0xD0, 0x80,
+	 0xFF, 0xFF, 0x04, 0x03, 0xFA, 0xA1, 0x06, 0xA3, 0xB7, 0x03, 0xC3, 0x01, 0x07, 0x60, 0x00, 0x64,
+	 0x23, 0xFA, 0xCE, 0x60, 0x44, 0x78, 0xFF, 0xFF, 0x2A, 0xF2, 0x0F, 0xF0, 0x60, 0x45, 0xA4, 0x36,
+	 0x08, 0x00, 0x0C, 0xB4, 0x04, 0x36, 0x02, 0x00, 0x0C, 0x3A, 0x06, 0x00, 0xCE, 0x60, 0x38, 0x78,
+	 0xFF, 0xFF, 0xCC, 0x60, 0x35, 0x78, 0xFF, 0xFF, 0x26, 0xF2, 0x50, 0xF1, 0x60, 0x47, 0x00, 0x7E,
+	 0xD0, 0x84, 0x1F, 0xA4, 0x06, 0x0E, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84,
+	 0x07, 0x00, 0xC2, 0xA4, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x87, 0xF8, 0xBF,
+	 0xC0, 0x84, 0xA2, 0xDB, 0x0F, 0xF0, 0x65, 0x40, 0x40, 0x2B, 0x17, 0x00, 0x32, 0x40, 0x08, 0x26,
+	 0x14, 0x00, 0x07, 0xF4, 0x3A, 0xF2, 0xFF, 0xFF, 0x37, 0xB4, 0x26, 0x46, 0x0E, 0x02, 0x2C, 0xF2,
+	 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x26, 0x06, 0x00, 0x25, 0x60, 0xF6, 0x64, 0xE5, 0x60, 0x78, 0x41,
+	 0xC7, 0x78, 0x97, 0xF1, 0xCE, 0x60, 0x38, 0x78, 0xFF, 0xFF, 0x2A, 0xF2, 0x64, 0x40, 0x60, 0x26,
+	 0x03, 0x00, 0xCC, 0x60, 0x0D, 0x78, 0xFF, 0xFF, 0x60, 0x40, 0x40, 0x3A, 0xF3, 0x01, 0x25, 0x60,
+	 0xEA, 0x64, 0xE5, 0x60, 0x78, 0x41, 0xC7, 0x78, 0x97, 0xF1, 0x27, 0xF2, 0xFF, 0xFF, 0x60, 0x40,
+	 0x01, 0x3B, 0x07, 0x00, 0x25, 0x60, 0xF8, 0x64, 0xE5, 0x60, 0x78, 0x41, 0xC7, 0x78, 0x97, 0xF1,
+	 0x08, 0x00, 0x02, 0x3B, 0x06, 0x00, 0x25, 0x60, 0xFA, 0x64, 0xE5, 0x60, 0x78, 0x41, 0xC7, 0x78,
+	 0x97, 0xF1, 0x2A, 0xF2, 0x28, 0x41, 0x40, 0xA8, 0x01, 0xB1, 0x02, 0x02, 0x43, 0x02, 0x6D, 0x00,
+	 0x60, 0x40, 0x08, 0x2A, 0x0F, 0x00, 0x25, 0x60, 0xE8, 0x64, 0xE5, 0x60, 0x78, 0x41, 0xC7, 0x78,
+	 0x97, 0xF1, 0x1B, 0xF2, 0xFF, 0xFF, 0x60, 0x45, 0x25, 0x60, 0xEE, 0x64, 0xE5, 0x60, 0x78, 0x41,
+	 0xD3, 0x78, 0x97, 0xF1, 0x0F, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x40, 0x26, 0x28, 0x00, 0x32, 0x44,
+	 0x02, 0x26, 0x25, 0x00, 0x10, 0x2B, 0x26, 0x00, 0x27, 0x60, 0x6A, 0x63, 0xBF, 0xD3, 0x2C, 0xF0,
+	 0x00, 0xA8, 0x60, 0x41, 0x0D, 0x03, 0x50, 0xFE, 0xBD, 0xD3, 0x2D, 0xF0, 0xD0, 0x80, 0xBD, 0xD3,
+	 0x2E, 0xF0, 0xD0, 0x80, 0xBD, 0xD3, 0x2C, 0xF0, 0xD0, 0x80, 0xFA, 0xA1, 0x10, 0x0C, 0xF3, 0x02,
+	 0x50, 0xFE, 0x60, 0x60, 0x01, 0x64, 0xD0, 0x80, 0x2D, 0xF0, 0x1D, 0x64, 0xD0, 0x80, 0x2E, 0xF0,
+	 0x01, 0x64, 0xD0, 0x80, 0xFF, 0xFF, 0x03, 0x0C, 0xCE, 0x60, 0x38, 0x78, 0xFF, 0xFF, 0x32, 0x40,
+	 0x40, 0x2A, 0x00, 0x00, 0xCD, 0x60, 0xEE, 0x78, 0xFF, 0xFF, 0x32, 0x40, 0x40, 0x26, 0xFA, 0x01,
+	 0x2A, 0xF0, 0xFF, 0xFF, 0x64, 0x40, 0x08, 0x2A, 0x20, 0x00, 0x32, 0x40, 0x02, 0x2A, 0x1D, 0x00,
+	 0x03, 0x67, 0xA0, 0x84, 0x00, 0x37, 0x64, 0x63, 0x60, 0x40, 0x02, 0x37, 0x5E, 0x63, 0x60, 0x40,
+	 0x01, 0x37, 0x58, 0x63, 0x60, 0x40, 0x03, 0x37, 0x0D, 0x00, 0xBD, 0xD2, 0x66, 0xF1, 0xBD, 0xD2,
+	 0xD0, 0x80, 0x67, 0xF1, 0x07, 0x02, 0xD0, 0x80, 0xBD, 0xD2, 0x68, 0xF1, 0x03, 0x02, 0xD0, 0x80,
+	 0xFF, 0xFF, 0x03, 0x03, 0xCE, 0x60, 0x38, 0x78, 0xFF, 0xFF, 0x2A, 0xF2, 0x87, 0xF4, 0x60, 0x40,
+	 0x03, 0x2B, 0x31, 0x00, 0x88, 0xF3, 0x06, 0x61, 0x60, 0x43, 0x66, 0x45, 0x31, 0xF0, 0x63, 0x46,
+	 0x05, 0xF2, 0x65, 0x46, 0xD0, 0x80, 0x30, 0xF0, 0x0F, 0x02, 0x63, 0x46, 0x04, 0xF2, 0x65, 0x46,
+	 0xD0, 0x80, 0x2F, 0xF0, 0x09, 0x02, 0x63, 0x46, 0x03, 0xF2, 0x65, 0x46, 0xD0, 0x80, 0xFF, 0xFF,
+	 0x03, 0x02, 0xFF, 0xFF, 0x48, 0xFE, 0x06, 0x00, 0xCD, 0x81, 0x02, 0xA3, 0xE7, 0x02, 0x87, 0xF1,
+	 0x08, 0xFE, 0x64, 0x43, 0x03, 0x03, 0xCE, 0x60, 0x38, 0x78, 0xFF, 0xFF, 0x43, 0x43, 0x23, 0x46,
+	 0x06, 0xF0, 0x26, 0x46, 0x07, 0x67, 0xA0, 0x84, 0x23, 0xFA, 0x64, 0x40, 0x02, 0x26, 0x2B, 0x00,
+	 0xCE, 0x60, 0x38, 0x78, 0xFF, 0xFF, 0x26, 0x1B, 0x31, 0xF2, 0x15, 0x60, 0x02, 0x65, 0x60, 0x47,
+	 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD3, 0x66, 0x41, 0x60, 0x46, 0x60, 0x43, 0x05, 0xF2, 0x16, 0x18,
+	 0x61, 0x46, 0x31, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x04, 0xF2, 0x0C, 0x02, 0x61, 0x46, 0x30, 0xF0,
+	 0x63, 0x46, 0xD0, 0x80, 0x03, 0xF2, 0x06, 0x02, 0x61, 0x46, 0x2F, 0xF0, 0x63, 0x46, 0xD0, 0x80,
+	 0xFF, 0xFF, 0x07, 0x03, 0x80, 0xF4, 0xFF, 0xFF, 0x63, 0x46, 0xE8, 0x1B, 0x87, 0xF3, 0x08, 0xFE,
+	 0x60, 0x43, 0x61, 0x46, 0x43, 0x43, 0x07, 0xFC, 0x43, 0x43, 0x1D, 0xF0, 0xC0, 0x64, 0xC0, 0x84,
+	 0x0A, 0x60, 0x7B, 0xF1, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xC0, 0x84,
+	 0xA2, 0xDB, 0x63, 0x45, 0x2A, 0xF2, 0x35, 0xF0, 0x60, 0x40, 0xA4, 0x36, 0x0B, 0x00, 0x08, 0x2B,
+	 0x0C, 0x00, 0x23, 0x46, 0x26, 0xF2, 0x26, 0x46, 0xD0, 0x80, 0xFF, 0xFF, 0x06, 0x02, 0xCE, 0x60,
+	 0x38, 0x78, 0xFF, 0xFF, 0xCD, 0x60, 0xEE, 0x78, 0xFF, 0xFF, 0x23, 0x46, 0x22, 0xF2, 0x26, 0x46,
+	 0x44, 0x4C, 0x0F, 0x26, 0x19, 0x00, 0x00, 0xBC, 0x40, 0x45, 0x0B, 0x03, 0x00, 0x64, 0x23, 0x46,
+	 0x22, 0xFA, 0x26, 0x46, 0xA2, 0xFF, 0xB6, 0x60, 0x58, 0x4E, 0x72, 0x78, 0xFF, 0xFF, 0xA3, 0xFF,
+	 0x26, 0x46, 0x2A, 0xF0, 0x2C, 0x44, 0x64, 0x40, 0x04, 0x27, 0x06, 0x00, 0x23, 0x46, 0x26, 0xFA,
+	 0x26, 0x46, 0xCD, 0x60, 0xA5, 0x78, 0xFF, 0xFF, 0x3F, 0xF2, 0x02, 0xFA, 0xA2, 0xFF, 0x16, 0xF0,
+	 0xFF, 0xFF, 0x64, 0x44, 0x01, 0x26, 0xDC, 0x9C, 0x92, 0xF3, 0x2A, 0xF2, 0xDC, 0x83, 0x92, 0xFD,
+	 0x06, 0xF4, 0x01, 0xF8, 0x26, 0x46, 0x60, 0x40, 0x40, 0x2B, 0x18, 0x00, 0x64, 0x44, 0x00, 0x65,
+	 0xFF, 0xB4, 0xFC, 0xA4, 0x06, 0xF0, 0x03, 0x03, 0x64, 0x46, 0x0C, 0x0D, 0x02, 0x65, 0x26, 0x46,
+	 0x00, 0xF2, 0xFF, 0xFF, 0xD0, 0x80, 0xFF, 0xFF, 0x02, 0x03, 0x60, 0x46, 0xF9, 0x01, 0x01, 0xF2,
+	 0xFF, 0xFF, 0xD4, 0x84, 0x01, 0xFA, 0x66, 0x44, 0x26, 0x46, 0x06, 0xFA, 0x06, 0xF4, 0x00, 0xF2,
+	 0x80, 0xFC, 0x40, 0x45, 0xB6, 0x60, 0x58, 0x4E, 0x72, 0x78, 0xFF, 0xFF, 0xA3, 0xFF, 0x26, 0x46,
+	 0x2C, 0x44, 0x0F, 0x26, 0x0F, 0x00, 0x23, 0x46, 0x26, 0xFA, 0x26, 0x44, 0x22, 0xFA, 0x26, 0x46,
+	 0x00, 0x64, 0x0F, 0x60, 0x90, 0xFB, 0x26, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF,
+	 0x2B, 0xFF, 0x6E, 0x00, 0xA3, 0x46, 0x26, 0xF2, 0x60, 0x45, 0xDC, 0x84, 0xD4, 0x80, 0x26, 0xFA,
+	 0xA3, 0x46, 0x6B, 0x02, 0x2A, 0xF0, 0xA3, 0x46, 0x22, 0xF2, 0xA3, 0x46, 0x00, 0xBC, 0x00, 0xF2,
+	 0x01, 0x02, 0x63, 0x00, 0x44, 0x4C, 0x3F, 0xF0, 0x60, 0x43, 0x23, 0x46, 0x22, 0xF4, 0x09, 0x60,
+	 0x00, 0x65, 0x3F, 0xF2, 0x26, 0x46, 0xC0, 0x84, 0xD4, 0x80, 0x60, 0x45, 0x56, 0x07, 0x80, 0xFC,
+	 0x1B, 0xF2, 0x06, 0xF2, 0x60, 0x41, 0x23, 0x46, 0x22, 0xF4, 0x1B, 0xF0, 0x06, 0xF0, 0xC1, 0x81,
+	 0x06, 0xFA, 0x05, 0xFA, 0x9B, 0xFA, 0x65, 0x44, 0x3F, 0xFA, 0x64, 0x46, 0x00, 0xFC, 0x63, 0x46,
+	 0x01, 0xF2, 0x10, 0x61, 0xF2, 0xA4, 0x01, 0xFA, 0xC8, 0x83, 0x02, 0x64, 0x59, 0xD0, 0x58, 0xD8,
+	 0xFD, 0x1F, 0x06, 0x45, 0x00, 0x64, 0x0F, 0x60, 0x90, 0xFB, 0x25, 0x44, 0x5A, 0xDB, 0x02, 0x64,
+	 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xA2, 0xFF, 0x00, 0xF4, 0x01, 0xF0, 0x0A, 0x18, 0x70, 0x67,
+	 0xA0, 0x80, 0xF0, 0x67, 0x06, 0x03, 0xC0, 0x84, 0x01, 0xFA, 0x25, 0x46, 0x25, 0x44, 0x80, 0xFC,
+	 0x05, 0xFA, 0xB6, 0x60, 0x58, 0x4E, 0x72, 0x78, 0xFF, 0xFF, 0xD4, 0xFE, 0xA3, 0xFF, 0x2C, 0x44,
+	 0x04, 0x27, 0x16, 0x00, 0x23, 0x46, 0x22, 0xF2, 0xA2, 0xFC, 0x60, 0x46, 0x46, 0x46, 0x3F, 0xF2,
+	 0x00, 0xF4, 0x60, 0x47, 0x08, 0xFA, 0x26, 0x46, 0x2C, 0x43, 0x2A, 0xFC, 0x06, 0xF4, 0x00, 0x64,
+	 0x00, 0xFA, 0x01, 0xF0, 0x80, 0x60, 0x00, 0x64, 0xB0, 0x84, 0x01, 0xFA, 0x26, 0x46, 0x1D, 0x00,
+	 0x00, 0x66, 0x46, 0x46, 0xCA, 0x60, 0x81, 0x78, 0xFF, 0xFF, 0xA3, 0x46, 0x22, 0xF0, 0xA2, 0xFC,
+	 0x00, 0x63, 0x33, 0x85, 0xA3, 0x46, 0x0D, 0x03, 0xA3, 0x46, 0x26, 0xF2, 0x0F, 0x65, 0xA4, 0x85,
+	 0xD4, 0x84, 0x26, 0xFA, 0xA3, 0x46, 0xA2, 0xFF, 0xB6, 0x60, 0x58, 0x4E, 0x72, 0x78, 0xFF, 0xFF,
+	 0xA3, 0xFF, 0x26, 0x46, 0xCE, 0x60, 0x38, 0x78, 0xFF, 0xFF, 0x2A, 0xF2, 0x32, 0xF0, 0x60, 0x40,
+	 0x08, 0x2A, 0x24, 0x00, 0x01, 0x2B, 0x13, 0x00, 0x64, 0x40, 0x01, 0x2A, 0x10, 0x00, 0x25, 0x60,
+	 0xE8, 0x64, 0xE5, 0x60, 0x78, 0x41, 0xC7, 0x78, 0x97, 0xF1, 0x1B, 0xF2, 0xFF, 0xFF, 0x60, 0x45,
+	 0x25, 0x60, 0xEE, 0x64, 0xE5, 0x60, 0x78, 0x41, 0xD3, 0x78, 0x97, 0xF1, 0x0F, 0x00, 0x25, 0x60,
+	 0xE6, 0x64, 0xE5, 0x60, 0x78, 0x41, 0xC7, 0x78, 0x97, 0xF1, 0x1B, 0xF2, 0xFF, 0xFF, 0x60, 0x45,
+	 0x25, 0x60, 0xEC, 0x64, 0xE5, 0x60, 0x78, 0x41, 0xD3, 0x78, 0x97, 0xF1, 0x07, 0xF4, 0xFF, 0xFF,
+	 0x26, 0xF2, 0x26, 0x46, 0x0F, 0xB4, 0xDC, 0x85, 0x25, 0x60, 0xEA, 0x64, 0xE5, 0x60, 0x78, 0x41,
+	 0xD3, 0x78, 0x97, 0xF1, 0x27, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x3B, 0x07, 0x00, 0x25, 0x60,
+	 0xF8, 0x64, 0xE5, 0x60, 0x78, 0x41, 0xC7, 0x78, 0x97, 0xF1, 0x08, 0x00, 0x02, 0x3B, 0x06, 0x00,
+	 0x25, 0x60, 0xFA, 0x64, 0xE5, 0x60, 0x78, 0x41, 0xC7, 0x78, 0x97, 0xF1, 0x07, 0xF2, 0x26, 0xF0,
+	 0x41, 0x18, 0x60, 0x46, 0xFF, 0x67, 0x20, 0x88, 0x64, 0x5F, 0x40, 0x4A, 0x15, 0xF0, 0x28, 0x44,
+	 0xD0, 0x84, 0x03, 0xA4, 0x03, 0x0E, 0xE8, 0x84, 0xE8, 0x84, 0x04, 0x00, 0xFA, 0xA4, 0xE8, 0x84,
+	 0xE8, 0x87, 0xC0, 0xBF, 0xC0, 0x84, 0x15, 0xFA, 0x40, 0x48, 0x14, 0xF0, 0x2A, 0x44, 0xD0, 0x84,
+	 0x1F, 0xA4, 0x06, 0x0E, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0x07, 0x00,
+	 0xC2, 0xA4, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x87, 0xF8, 0xBF, 0xC0, 0x84,
+	 0x14, 0xFA, 0x2B, 0x60, 0xEC, 0x63, 0xBD, 0xDB, 0x60, 0x5C, 0x2F, 0x67, 0xD0, 0x80, 0x60, 0x45,
+	 0x02, 0x28, 0x64, 0x45, 0x28, 0x5C, 0xBD, 0xD9, 0x8B, 0x67, 0xD0, 0x80, 0x60, 0x41, 0x02, 0x24,
+	 0x64, 0x41, 0xD5, 0x84, 0x80, 0x65, 0xC4, 0x87, 0x01, 0x05, 0x00, 0x64, 0xFF, 0xB4, 0x0E, 0xFA,
+	 0xA3, 0xDB, 0x26, 0x46, 0xCE, 0x60, 0x7F, 0x78, 0xFF, 0xFF, 0xCA, 0x60, 0x81, 0x78, 0xFF, 0xFF,
+	 0x1F, 0x60, 0x20, 0x64, 0x40, 0x4B, 0xF6, 0x60, 0x58, 0x4D, 0xB3, 0x78, 0xFF, 0xFF, 0x00, 0x66,
+	 0x46, 0x46, 0xCA, 0x60, 0x81, 0x78, 0xFF, 0xFF, 0x1F, 0x60, 0x04, 0x64, 0x0F, 0x60, 0x90, 0xFB,
+	 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xF8, 0xFE, 0x00, 0x66,
+	 0x46, 0x46, 0xCA, 0x60, 0x81, 0x78, 0xFF, 0xFF, 0x2A, 0xF2, 0x58, 0x63, 0x60, 0x47, 0x01, 0x27,
+	 0x64, 0x63, 0x61, 0x5C, 0x18, 0x60, 0x0F, 0xF9, 0xBD, 0xD0, 0xBD, 0xD0, 0x64, 0x45, 0x64, 0x41,
+	 0xBD, 0xD0, 0x00, 0xF4, 0x04, 0xF8, 0x83, 0xFA, 0x82, 0xF8, 0xA6, 0x46, 0x02, 0xB0, 0x5E, 0x63,
+	 0x04, 0x03, 0x64, 0x63, 0x03, 0xB0, 0x02, 0x3A, 0x6C, 0x63, 0x3F, 0xF2, 0xBD, 0xD0, 0xBD, 0xD0,
+	 0x64, 0x45, 0x64, 0x41, 0xBD, 0xD0, 0xA6, 0x46, 0x07, 0xF8, 0x86, 0xFA, 0x85, 0xF8, 0x60, 0x47,
+	 0x08, 0xFA, 0x18, 0x60, 0x0F, 0xF1, 0x26, 0x46, 0x64, 0x41, 0x2F, 0x58, 0xFF, 0xFF, 0x2A, 0xF2,
+	 0x2C, 0xF0, 0x31, 0x40, 0x20, 0x26, 0x09, 0x00, 0x60, 0x40, 0xA4, 0x36, 0x21, 0x00, 0x08, 0x26,
+	 0x07, 0x00, 0x7D, 0xF1, 0xCF, 0x60, 0x47, 0x78, 0xFF, 0xFF, 0xCF, 0x60, 0x77, 0x78, 0xFF, 0xFF,
+	 0x64, 0x40, 0x01, 0x26, 0x12, 0x00, 0x3F, 0xF0, 0x32, 0x40, 0x10, 0x2A, 0x0A, 0x00, 0x64, 0x41,
+	 0x60, 0x40, 0x40, 0x27, 0x06, 0x00, 0xCD, 0x81, 0xDD, 0x81, 0x03, 0x03, 0x02, 0x03, 0x01, 0x61,
+	 0x01, 0x00, 0x00, 0x61, 0x60, 0x40, 0x18, 0x3A, 0x03, 0x00, 0xCF, 0x60, 0xC9, 0x78, 0xFF, 0xFF,
+	 0x07, 0xF2, 0x87, 0xF1, 0x66, 0x45, 0xD0, 0x80, 0x60, 0x46, 0x06, 0xF2, 0x65, 0x46, 0x03, 0x03,
+	 0xFF, 0xFF, 0x02, 0x26, 0x07, 0x00, 0xDD, 0x60, 0x58, 0x4F, 0x90, 0x78, 0xFF, 0xFF, 0xCF, 0x60,
+	 0xC5, 0x78, 0xFF, 0xFF, 0x2A, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0xA4, 0x3A, 0x07, 0x00, 0xDF, 0x60,
+	 0x58, 0x4F, 0xE3, 0x78, 0xFF, 0xFF, 0xCF, 0x60, 0xC5, 0x78, 0xFF, 0xFF, 0x26, 0x46, 0xCE, 0x60,
+	 0x58, 0x4F, 0x54, 0x78, 0xFF, 0xFF, 0x3F, 0xF2, 0x06, 0x65, 0xD4, 0x80, 0x60, 0x43, 0x5B, 0x04,
+	 0x00, 0xF4, 0xAA, 0x60, 0xAA, 0x65, 0x09, 0xF2, 0x0A, 0xF0, 0xD4, 0x80, 0x03, 0x64, 0x53, 0x02,
+	 0xD0, 0x80, 0x00, 0x64, 0x0B, 0xF0, 0x4F, 0x02, 0x64, 0x45, 0xD4, 0x80, 0xF8, 0x7F, 0x08, 0x02,
+	 0x0C, 0xF0, 0x26, 0x46, 0x64, 0x45, 0x23, 0xF0, 0x20, 0x67, 0xB0, 0x84, 0xA2, 0xDA, 0x0B, 0x00,
+	 0xD4, 0x80, 0x1D, 0x60, 0x60, 0x64, 0x11, 0x02, 0x0C, 0xF0, 0x26, 0x46, 0x64, 0x45, 0x23, 0xF0,
+	 0x40, 0x67, 0xB0, 0x84, 0xA2, 0xDA, 0x65, 0x44, 0x88, 0x3A, 0x35, 0x00, 0x77, 0x37, 0x03, 0x00,
+	 0x78, 0x37, 0x01, 0x00, 0x8E, 0x37, 0x00, 0x61, 0x2E, 0x00, 0xD4, 0x80, 0x08, 0x65, 0x2B, 0x02,
+	 0xD7, 0x80, 0x01, 0x60, 0x00, 0x64, 0x0C, 0xF0, 0x26, 0x04, 0xD0, 0x80, 0x0D, 0xF0, 0x23, 0x02,
+	 0x26, 0x46, 0x14, 0xF2, 0x01, 0x63, 0x02, 0xA8, 0x64, 0x47, 0x1D, 0x03, 0x7F, 0xB4, 0xFD, 0xA0,
+	 0x06, 0x03, 0x19, 0x07, 0x23, 0xF0, 0x60, 0x67, 0xB0, 0x84, 0xA2, 0xDA, 0x6B, 0x00, 0x26, 0x46,
+	 0x2A, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x08, 0x2A, 0x07, 0x00, 0x60, 0x40, 0x48, 0x36, 0x04, 0x00,
+	 0xD2, 0xF3, 0xFF, 0xFF, 0x02, 0xBC, 0xD2, 0xFB, 0xE8, 0x60, 0x58, 0x4F, 0xEF, 0x78, 0xFF, 0xFF,
+	 0xCF, 0x60, 0xC5, 0x78, 0xFF, 0xFF, 0x26, 0x46, 0x61, 0x40, 0x01, 0x2A, 0x09, 0x00, 0x25, 0x60,
+	 0xFE, 0x64, 0xE5, 0x60, 0x78, 0x41, 0xC7, 0x78, 0x97, 0xF1, 0xCF, 0x60, 0xC9, 0x78, 0xFF, 0xFF,
+	 0xDF, 0x60, 0x58, 0x4F, 0xE3, 0x78, 0xFF, 0xFF, 0x2A, 0xF2, 0xFF, 0xFF, 0xFF, 0xFF, 0x48, 0x36,
+	 0x88, 0x00, 0xCF, 0x60, 0xD6, 0x78, 0xFF, 0xFF, 0xCF, 0x60, 0xC5, 0x78, 0xFF, 0xFF, 0x60, 0x40,
+	 0x0C, 0x26, 0x7F, 0x00, 0x64, 0x40, 0x01, 0x2A, 0x7C, 0x00, 0xB0, 0x3A, 0x05, 0x00, 0xD4, 0x60,
+	 0x58, 0x4F, 0x5A, 0x78, 0xFF, 0xFF, 0x71, 0x00, 0x00, 0x3A, 0x05, 0x00, 0xD7, 0x60, 0x58, 0x4F,
+	 0xCA, 0x78, 0xFF, 0xFF, 0x6A, 0x00, 0x20, 0x3A, 0x05, 0x00, 0xD7, 0x60, 0x58, 0x4F, 0xCA, 0x78,
+	 0xFF, 0xFF, 0x63, 0x00, 0xC0, 0x3A, 0x05, 0x00, 0xDC, 0x60, 0x58, 0x4F, 0xFE, 0x78, 0xFF, 0xFF,
+	 0x5C, 0x00, 0xA0, 0x3A, 0x05, 0x00, 0xDD, 0x60, 0x58, 0x4F, 0x5B, 0x78, 0xFF, 0xFF, 0x55, 0x00,
+	 0x40, 0x3A, 0x0D, 0x00, 0xE3, 0x60, 0x58, 0x4F, 0xC3, 0x78, 0xFF, 0xFF, 0x4E, 0x00, 0x60, 0x40,
+	 0x50, 0x3A, 0x05, 0x00, 0xED, 0x60, 0x58, 0x4F, 0xEB, 0x78, 0xFF, 0xFF, 0x46, 0x00, 0xCF, 0x60,
+	 0xC9, 0x78, 0xFF, 0xFF, 0x26, 0x46, 0x2A, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x08, 0x2A, 0x07, 0x00,
+	 0x60, 0x40, 0x48, 0x36, 0x04, 0x00, 0xD2, 0xF3, 0xFF, 0xFF, 0x02, 0xBC, 0xD2, 0xFB, 0x2A, 0xF2,
+	 0x3B, 0xF0, 0x60, 0x40, 0x40, 0x2B, 0x04, 0x00, 0x64, 0x40, 0x20, 0x2B, 0x01, 0x00, 0x03, 0x00,
+	 0xCF, 0x60, 0xB9, 0x78, 0xFF, 0xFF, 0x22, 0xF2, 0xFF, 0xFF, 0x04, 0xB4, 0xFF, 0xFF, 0xF8, 0x03,
+	 0x23, 0xF2, 0x07, 0xF4, 0xBB, 0xF0, 0x26, 0x46, 0xA4, 0x84, 0xFF, 0xFF, 0x60, 0x40, 0x2F, 0x26,
+	 0x20, 0x00, 0xC9, 0x60, 0x58, 0x4F, 0xCF, 0x78, 0xFF, 0xFF, 0x64, 0x40, 0x18, 0x36, 0x09, 0x00,
+	 0x04, 0x65, 0xE5, 0x60, 0x58, 0x4E, 0x27, 0x78, 0xFF, 0xFF, 0x26, 0x46, 0xCF, 0x60, 0xC9, 0x78,
+	 0xFF, 0xFF, 0x1F, 0x60, 0x04, 0x64, 0x0F, 0x60, 0x90, 0xFB, 0x26, 0x44, 0x5A, 0xDB, 0x02, 0x64,
+	 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xF8, 0xFE, 0x0C, 0x00, 0x66, 0x44, 0x00, 0xA8, 0xFF, 0xFF,
+	 0x0A, 0x03, 0x26, 0x46, 0x1F, 0x60, 0x20, 0x64, 0x40, 0x4B, 0xF6, 0x60, 0x58, 0x4D, 0xB3, 0x78,
+	 0xFF, 0xFF, 0x00, 0x66, 0x46, 0x46, 0xCE, 0x60, 0x35, 0x78, 0xFF, 0xFF, 0x14, 0xF2, 0x00, 0x7C,
+	 0x3E, 0xF8, 0xCC, 0x84, 0xCC, 0x84, 0x18, 0x03, 0x5C, 0x02, 0x11, 0xF2, 0x07, 0xFA, 0xAB, 0xF3,
+	 0x19, 0xFA, 0xD0, 0x60, 0x58, 0x4E, 0x86, 0x78, 0xFF, 0xFF, 0x1E, 0x60, 0xE0, 0x64, 0x0F, 0x60,
+	 0x90, 0xFB, 0x26, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xC8, 0xFE,
+	 0xF2, 0x64, 0x3B, 0x42, 0x4A, 0xDB, 0x8D, 0x00, 0xA2, 0xFF, 0x46, 0x45, 0xB6, 0x60, 0x58, 0x4E,
+	 0xBB, 0x78, 0xFF, 0xFF, 0xA3, 0xFF, 0x11, 0x03, 0x7E, 0x63, 0x46, 0x4B, 0x25, 0x46, 0xA3, 0xD0,
+	 0x2B, 0x46, 0xA3, 0xD8, 0xFB, 0x1F, 0x89, 0xFC, 0x8A, 0xFC, 0x88, 0xFC, 0x05, 0x18, 0x64, 0x46,
+	 0x01, 0xF0, 0x10, 0x67, 0xC0, 0x84, 0x01, 0xFA, 0x08, 0xFE, 0x2B, 0x46, 0x46, 0x46, 0x25, 0x46,
+	 0xD0, 0x60, 0x58, 0x4E, 0x86, 0x78, 0xFF, 0xFF, 0x13, 0x60, 0x43, 0xF3, 0x87, 0xF3, 0x00, 0xA8,
+	 0x07, 0xFA, 0x0E, 0x03, 0x1E, 0x60, 0xDA, 0x64, 0x0F, 0x60, 0x90, 0xFB, 0x25, 0x44, 0x5A, 0xDB,
+	 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xF3, 0x64, 0x3B, 0x42, 0x4A, 0xDB, 0x0D, 0x00,
+	 0x1E, 0x60, 0xCE, 0x64, 0x0F, 0x60, 0x90, 0xFB, 0x25, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB,
+	 0xFF, 0xFF, 0x2B, 0xFF, 0xF4, 0x64, 0x3B, 0x42, 0x4A, 0xDB, 0x26, 0x44, 0x00, 0xA8, 0xC1, 0xFE,
+	 0x48, 0x03, 0x26, 0x46, 0x2A, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x08, 0x2A, 0x07, 0x00, 0x60, 0x40,
+	 0x48, 0x36, 0x04, 0x00, 0xD2, 0xF3, 0xFF, 0xFF, 0x02, 0xBC, 0xD2, 0xFB, 0x26, 0x46, 0x2A, 0xF2,
+	 0x3B, 0xF0, 0x60, 0x40, 0x40, 0x2B, 0x06, 0x00, 0xC0, 0x60, 0x00, 0x64, 0x64, 0x40, 0x20, 0x2B,
+	 0x01, 0x00, 0x03, 0x00, 0xD0, 0x60, 0x73, 0x78, 0xFF, 0xFF, 0x22, 0xF2, 0xFF, 0xFF, 0x04, 0xB4,
+	 0xFF, 0xFF, 0xF8, 0x03, 0x23, 0xF2, 0x07, 0xF4, 0xBB, 0xF0, 0x26, 0x46, 0xA4, 0x84, 0xFF, 0xFF,
+	 0x60, 0x40, 0x2F, 0x26, 0x07, 0x00, 0xC9, 0x60, 0x58, 0x4F, 0xCF, 0x78, 0xFF, 0xFF, 0x64, 0x40,
+	 0x18, 0x36, 0x09, 0x00, 0x04, 0x65, 0xE5, 0x60, 0x58, 0x4E, 0x27, 0x78, 0xFF, 0xFF, 0x26, 0x46,
+	 0xCF, 0x60, 0xC9, 0x78, 0xFF, 0xFF, 0x1F, 0x60, 0x04, 0x64, 0x0F, 0x60, 0x90, 0xFB, 0x26, 0x44,
+	 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xF8, 0xFE, 0xF1, 0x64, 0x3B, 0x42,
+	 0x4A, 0xDB, 0x00, 0x66, 0x46, 0x46, 0xCF, 0x60, 0xC5, 0x78, 0xFF, 0xFF, 0x2A, 0xF2, 0x82, 0x60,
+	 0xFF, 0x65, 0xA4, 0x87, 0x02, 0xBF, 0x2A, 0xFA, 0x1C, 0xF2, 0x13, 0xFA, 0x32, 0xF2, 0x2C, 0xFA,
+	 0x33, 0xF2, 0x2D, 0xFA, 0x34, 0xF2, 0x2E, 0xFA, 0x2F, 0xF2, 0x32, 0xFA, 0x30, 0xF2, 0x33, 0xFA,
+	 0x31, 0xF2, 0x34, 0xFA, 0x66, 0xF3, 0x2F, 0xFA, 0x67, 0xF3, 0x30, 0xFA, 0x68, 0xF3, 0x31, 0xFA,
+	 0x2E, 0x58, 0xFF, 0xFF, 0xD3, 0x60, 0x59, 0x64, 0x08, 0x60, 0x26, 0xFB, 0x2F, 0x58, 0xFF, 0xFF,
+	 0xB1, 0xF3, 0x12, 0x60, 0x2C, 0x63, 0xF7, 0xA0, 0xFF, 0xFF, 0x02, 0x06, 0x00, 0x64, 0xB1, 0xFB,
+	 0xB1, 0xF3, 0xB1, 0xFB, 0x01, 0xA4, 0xCC, 0x84, 0xFF, 0xFF, 0x02, 0x03, 0x2A, 0xA3, 0xFB, 0x01,
+	 0x63, 0x46, 0x10, 0x60, 0xA6, 0x63, 0x0E, 0x61, 0x60, 0xFE, 0xA6, 0xD1, 0xDE, 0x86, 0x01, 0x64,
+	 0x64, 0x40, 0x7F, 0x36, 0x00, 0x64, 0xA3, 0xDB, 0xDB, 0x83, 0xA3, 0xD9, 0xCD, 0x81, 0x04, 0xA3,
+	 0xF4, 0x02, 0x11, 0x60, 0x16, 0x63, 0x1C, 0x61, 0xA6, 0xD1, 0xDE, 0x86, 0x01, 0x64, 0x64, 0x40,
+	 0x7F, 0x36, 0x00, 0x64, 0xA3, 0xDB, 0xDB, 0x83, 0xA3, 0xD9, 0xCD, 0x81, 0x06, 0xA3, 0xF4, 0x02,
+	 0x20, 0xFE, 0x13, 0x60, 0x7F, 0xF3, 0x13, 0x60, 0x2D, 0xFB, 0x1E, 0x63, 0x26, 0x60, 0x64, 0x61,
+	 0x27, 0x60, 0x08, 0x64, 0x58, 0xD1, 0x59, 0xD9, 0xFD, 0x1F, 0x13, 0x60, 0x95, 0xF3, 0x13, 0x60,
+	 0x43, 0xFB, 0x13, 0x60, 0x96, 0xF3, 0x13, 0x60, 0x44, 0xFB, 0x13, 0x60, 0x9C, 0xF3, 0x13, 0x60,
+	 0x4A, 0xFB, 0x13, 0x60, 0x9D, 0xF3, 0x13, 0x60, 0x4B, 0xFB, 0x13, 0x60, 0x9E, 0xF3, 0x13, 0x60,
+	 0x4C, 0xFB, 0x13, 0x60, 0x9F, 0xF3, 0x13, 0x60, 0x4D, 0xFB, 0x13, 0x60, 0x97, 0xF3, 0x13, 0x60,
+	 0x45, 0xFB, 0x13, 0x60, 0x98, 0xF3, 0x13, 0x60, 0x46, 0xFB, 0x13, 0x60, 0x99, 0xF3, 0x13, 0x60,
+	 0x47, 0xFB, 0x26, 0x60, 0xB0, 0x63, 0xBD, 0xD1, 0xCB, 0xF9, 0x66, 0xF9, 0xBD, 0xD1, 0xCC, 0xF9,
+	 0x67, 0xF9, 0xA3, 0xD1, 0xCD, 0xF9, 0x68, 0xF9, 0x01, 0x64, 0x6A, 0xFB, 0x13, 0x60, 0x51, 0xF3,
+	 0xC4, 0xFB, 0x00, 0x63, 0x4A, 0xFD, 0x5A, 0xFD, 0x6B, 0xFD, 0x6C, 0xFD, 0x13, 0x60, 0x45, 0xF3,
+	 0x15, 0x60, 0xCB, 0xF1, 0xFF, 0x60, 0xE7, 0x65, 0x32, 0x41, 0xA5, 0x81, 0xFF, 0xA0, 0xFF, 0xFF,
+	 0x01, 0x03, 0x06, 0x00, 0x13, 0x60, 0x47, 0xF3, 0x08, 0xB9, 0x60, 0x40, 0x01, 0x26, 0x10, 0xB9,
+	 0x41, 0x52, 0x87, 0xF5, 0x32, 0x44, 0x10, 0xB0, 0xFF, 0xFF, 0x0A, 0x03, 0x14, 0x60, 0x15, 0xF3,
+	 0x06, 0xF0, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0x80, 0xBF, 0xB0, 0x84, 0x06, 0xFA,
+	 0x13, 0x60, 0x45, 0xF3, 0x22, 0x7C, 0xFF, 0xA0, 0xFD, 0xA0, 0x05, 0x06, 0x03, 0x03, 0xFE, 0xA0,
+	 0x04, 0x7C, 0x01, 0x02, 0x3A, 0xF8, 0x13, 0x60, 0x4C, 0xF1, 0x20, 0x44, 0x20, 0xB5, 0x64, 0x41,
+	 0x00, 0xB9, 0xD4, 0x84, 0x08, 0x28, 0x20, 0xBC, 0x40, 0x40, 0x15, 0x60, 0xCB, 0xF3, 0x30, 0x60,
+	 0x0E, 0x63, 0xF0, 0x84, 0xF0, 0x84, 0xF0, 0x84, 0x02, 0xB5, 0xF0, 0x84, 0xF0, 0x84, 0x03, 0xB4,
+	 0x65, 0x5C, 0xA3, 0xD9, 0x02, 0xA8, 0x18, 0x60, 0x08, 0xFB, 0x15, 0x02, 0x00, 0x60, 0xC8, 0x64,
+	 0x18, 0x60, 0x09, 0xFB, 0x18, 0x60, 0x0D, 0xFB, 0x07, 0x60, 0xD0, 0x64, 0x18, 0x60, 0x0A, 0xFB,
+	 0x18, 0x60, 0x0E, 0xFB, 0x01, 0x60, 0x90, 0x64, 0x18, 0x60, 0x0B, 0xFB, 0x00, 0x60, 0x64, 0x64,
+	 0x18, 0x60, 0x0C, 0xFB, 0x06, 0x00, 0x64, 0x64, 0x18, 0x60, 0x0B, 0xFB, 0x64, 0x64, 0x18, 0x60,
+	 0x0C, 0xFB, 0xB1, 0xF1, 0x10, 0x60, 0xA0, 0x63, 0x2F, 0x18, 0x60, 0x40, 0x01, 0x27, 0x12, 0x00,
+	 0xCC, 0x84, 0x06, 0xA3, 0xFD, 0x02, 0xA3, 0xD3, 0x10, 0x60, 0xA6, 0x63, 0x25, 0x1B, 0x10, 0x60,
+	 0xF8, 0x65, 0xA3, 0xD3, 0x06, 0xA3, 0xD7, 0x80, 0x02, 0x1B, 0xFB, 0x04, 0x1D, 0x00, 0xF8, 0xA3,
+	 0xA3, 0xD3, 0x18, 0x00, 0x11, 0x60, 0x14, 0x63, 0x11, 0x60, 0xF4, 0x65, 0xA3, 0xD1, 0x08, 0xA3,
+	 0xD0, 0x80, 0xD7, 0x80, 0x02, 0x03, 0xFA, 0x04, 0x0F, 0x00, 0xFA, 0xA3, 0xA3, 0xD3, 0x11, 0x60,
+	 0x16, 0x63, 0x0A, 0x1B, 0xA3, 0xD3, 0x08, 0xA3, 0xD7, 0x80, 0x02, 0x1B, 0xFB, 0x04, 0x04, 0x00,
+	 0xF6, 0xA3, 0xA3, 0xD3, 0xC5, 0xFB, 0x64, 0xFB, 0x27, 0x60, 0x34, 0x64, 0x26, 0x60, 0x90, 0x63,
+	 0xA0, 0xD1, 0xA3, 0xD9, 0x64, 0x41, 0x58, 0xD1, 0x5B, 0xD9, 0x64, 0xF3, 0xFF, 0xFF, 0x60, 0x40,
+	 0x01, 0x2B, 0x03, 0x00, 0xD1, 0x60, 0xE9, 0x78, 0xFF, 0xFF, 0x91, 0xFA, 0x61, 0x44, 0xEF, 0x60,
+	 0x58, 0x4E, 0xAB, 0x78, 0xFF, 0xFF, 0x12, 0xFA, 0x15, 0x60, 0xBC, 0xF3, 0x3F, 0x40, 0x01, 0x27,
+	 0x08, 0x00, 0x0F, 0x60, 0xFF, 0x65, 0xA4, 0x84, 0xEE, 0x60, 0x58, 0x4E, 0x26, 0x78, 0xFF, 0xFF,
+	 0x06, 0x00, 0x0F, 0x65, 0xA4, 0x84, 0xEE, 0x60, 0x58, 0x4E, 0x26, 0x78, 0xFF, 0xFF, 0x00, 0x65,
+	 0xEE, 0x60, 0x58, 0x4E, 0xC6, 0x78, 0xFF, 0xFF, 0xEF, 0x60, 0x58, 0x4E, 0x10, 0x78, 0xFF, 0xFF,
+	 0x15, 0x00, 0x11, 0xF8, 0x64, 0x44, 0xEF, 0x60, 0x58, 0x4E, 0xAB, 0x78, 0xFF, 0xFF, 0x12, 0xFA,
+	 0x15, 0x60, 0xBD, 0xF3, 0x0F, 0x60, 0xFF, 0x65, 0xA4, 0x84, 0xEE, 0x60, 0x58, 0x4E, 0x26, 0x78,
+	 0xFF, 0xFF, 0xFF, 0x65, 0xEE, 0x60, 0x58, 0x4E, 0xC6, 0x78, 0xFF, 0xFF, 0xB5, 0xF1, 0x09, 0x60,
+	 0x2A, 0x64, 0xD0, 0x80, 0x03, 0x64, 0x01, 0x06, 0x06, 0x64, 0xAE, 0xFB, 0x46, 0x48, 0xC3, 0xF3,
+	 0xFF, 0xFF, 0x60, 0x40, 0x05, 0x3A, 0x03, 0x00, 0x14, 0x60, 0x00, 0x66, 0x11, 0x00, 0x04, 0x3A,
+	 0x03, 0x00, 0x13, 0x60, 0xF4, 0x66, 0x0C, 0x00, 0x03, 0x3A, 0x03, 0x00, 0x13, 0x60, 0xE8, 0x66,
+	 0x07, 0x00, 0x02, 0x3A, 0x03, 0x00, 0x13, 0x60, 0xDC, 0x66, 0x02, 0x00, 0x13, 0x60, 0xD0, 0x66,
+	 0x60, 0xFE, 0xA6, 0xD3, 0xDE, 0x86, 0x10, 0x60, 0x5F, 0xFB, 0xA6, 0xD3, 0xDE, 0x86, 0x21, 0x60,
+	 0x2F, 0x63, 0xA3, 0xDB, 0x21, 0x60, 0xA7, 0x63, 0xA3, 0xDB, 0xA6, 0xD3, 0xDE, 0x86, 0x10, 0x60,
+	 0x5E, 0xFB, 0xA6, 0xD3, 0xDE, 0x86, 0x20, 0x60, 0xBF, 0x63, 0xA3, 0xDB, 0x20, 0xFE, 0xA6, 0xD3,
+	 0xDA, 0x86, 0x60, 0x43, 0x1F, 0xB3, 0x63, 0x5C, 0x1F, 0x60, 0x00, 0xB4, 0xE8, 0x84, 0xE8, 0x84,
+	 0xE8, 0x84, 0xB0, 0x85, 0x10, 0x60, 0x95, 0xF3, 0xFF, 0xFF, 0xFC, 0x60, 0x00, 0xB4, 0xB4, 0x84,
+	 0xA2, 0xDB, 0x10, 0x60, 0xD1, 0xFB, 0x21, 0x60, 0xCA, 0x63, 0xA3, 0xD3, 0xA6, 0xD1, 0xDE, 0x86,
+	 0x80, 0x60, 0x7F, 0xB5, 0x64, 0x44, 0xE8, 0x84, 0x7F, 0x60, 0x80, 0xB4, 0xB4, 0x84, 0xA3, 0xDB,
+	 0x60, 0xFE, 0xA6, 0xD3, 0xDE, 0x86, 0x10, 0x60, 0x62, 0xFB, 0x20, 0xFE, 0x10, 0x60, 0x2A, 0x62,
+	 0x00, 0x64, 0xA2, 0xDB, 0xDE, 0xFE, 0x0A, 0x04, 0x40, 0x60, 0x00, 0x64, 0x08, 0x60, 0x16, 0xFB,
+	 0xD2, 0x60, 0x5E, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x64, 0xF1, 0x0F, 0x60,
+	 0x9D, 0xF9, 0x0C, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x2D, 0xFF, 0x20, 0x44, 0x01, 0x65, 0x34, 0x80,
+	 0x20, 0x60, 0x00, 0x64, 0x08, 0x60, 0x16, 0xFB, 0xD2, 0x60, 0x82, 0x64, 0x5A, 0xDB, 0xCF, 0xFE,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x10, 0x60, 0x2A, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x64, 0xF1, 0x0F, 0x60,
+	 0x9D, 0xF9, 0x0E, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x2D, 0xFF, 0x20, 0x60, 0x00, 0x64, 0x08, 0x60,
+	 0x16, 0xFB, 0xD2, 0x60, 0x97, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x10, 0x60,
+	 0x2A, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0xBE, 0xFE, 0x08, 0x60, 0x11, 0xF1, 0x40, 0x60, 0x00, 0x64,
+	 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0xBE, 0xFE, 0x08, 0x60, 0x11, 0xF1, 0x40, 0x60, 0x00, 0x64,
+	 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x20, 0x40, 0x20, 0x2A, 0x04, 0x00, 0xF0, 0x60, 0x58, 0x4E,
+	 0x66, 0x78, 0xFF, 0xFF, 0x36, 0x40, 0x08, 0x3A, 0x6A, 0x00, 0x36, 0x40, 0x08, 0x3A, 0x05, 0x00,
+	 0x10, 0x60, 0x42, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x04, 0x00, 0x10, 0x60, 0x2A, 0x62, 0x00, 0x64,
+	 0xA2, 0xDB, 0x4E, 0xF3, 0xFF, 0xFF, 0x1D, 0x1B, 0x13, 0x60, 0x54, 0xF3, 0xC7, 0xFB, 0x26, 0x60,
+	 0x16, 0x65, 0x26, 0x60, 0xB8, 0x61, 0x26, 0x60, 0x14, 0x64, 0x20, 0x63, 0x59, 0xD1, 0x58, 0xD9,
+	 0xA5, 0xD9, 0xDA, 0x85, 0xFB, 0x1F, 0x00, 0x60, 0x01, 0x64, 0x08, 0x60, 0x22, 0xFB, 0xD3, 0x60,
+	 0x3C, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x36, 0x40, 0x08, 0x3A, 0x41, 0x00, 0xE7, 0x60, 0xC5, 0x78,
+	 0xFF, 0xFF, 0x27, 0x60, 0x3E, 0x63, 0x60, 0x41, 0x00, 0x62, 0xCD, 0x81, 0x04, 0xA2, 0xFD, 0x02,
+	 0x2C, 0x60, 0x3E, 0x61, 0xFC, 0xA2, 0x62, 0x45, 0xC5, 0x81, 0xE0, 0x84, 0xE0, 0x85, 0xC4, 0x85,
+	 0xC7, 0x83, 0xFE, 0xA5, 0x88, 0xF3, 0xFF, 0xFF, 0xC4, 0x84, 0x66, 0x45, 0x60, 0x46, 0xBD, 0xD1,
+	 0x03, 0xF8, 0xBD, 0xD1, 0x04, 0xF8, 0xA3, 0xD1, 0x05, 0xF8, 0x06, 0xF2, 0xFF, 0xFF, 0x02, 0x7E,
+	 0x06, 0xFA, 0x64, 0xF3, 0x61, 0x43, 0x60, 0x40, 0x01, 0x27, 0x02, 0xA3, 0xA3, 0xD1, 0x0F, 0xF8,
+	 0x16, 0x64, 0x12, 0xFA, 0x01, 0x64, 0x11, 0xFA, 0x66, 0x5C, 0xC1, 0x60, 0x58, 0x4E, 0x93, 0x78,
+	 0xFF, 0xFF, 0x66, 0x43, 0x32, 0x40, 0x08, 0x2A, 0x0A, 0x00, 0x14, 0x60, 0x15, 0xF3, 0x06, 0xF0,
+	 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0x80, 0xBF, 0xB0, 0x84, 0x06, 0xFA, 0xC5, 0xFE,
+	 0x10, 0x60, 0x2A, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x00, 0x60, 0x30, 0x64, 0x08, 0x60, 0x16, 0xFB,
+	 0xD2, 0x60, 0xB5, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x10, 0x60, 0x2A, 0x62,
+	 0x00, 0x64, 0xA2, 0xDB, 0x00, 0x60, 0x03, 0x64, 0x08, 0x60, 0x22, 0xFB, 0xD2, 0x60, 0xB5, 0x64,
+	 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x10, 0x60, 0x42, 0x62, 0x00, 0x64, 0xA2, 0xDB,
+	 0x0F, 0x4E, 0xE1, 0x60, 0x58, 0x4F, 0xA9, 0x78, 0xFF, 0xFF, 0x0E, 0x4F, 0x0F, 0x4E, 0xDF, 0x60,
+	 0x58, 0x4F, 0x0F, 0x78, 0xFF, 0xFF, 0x0E, 0x4F, 0x0F, 0x4E, 0xDE, 0x60, 0x58, 0x4F, 0x9A, 0x78,
+	 0xFF, 0xFF, 0x0E, 0x4F, 0x0F, 0x4E, 0xDD, 0x60, 0x58, 0x4F, 0xFB, 0x78, 0xFF, 0xFF, 0x0E, 0x4F,
+	 0xD5, 0x01, 0x4E, 0xF3, 0x7D, 0xF5, 0x60, 0x40, 0xFF, 0x22, 0x0A, 0x00, 0x88, 0xF1, 0xCC, 0x84,
+	 0xE0, 0x84, 0xC0, 0x86, 0x06, 0xF2, 0xFF, 0xFF, 0x00, 0x7E, 0x06, 0xFA, 0x7D, 0xF5, 0x07, 0x00,
+	 0x08, 0x60, 0x24, 0xF1, 0x00, 0x60, 0x11, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x4E, 0xF3,
+	 0x66, 0x40, 0xFF, 0x22, 0x05, 0x00, 0xFF, 0x22, 0x39, 0x00, 0xD4, 0x60, 0x0C, 0x78, 0xFF, 0xFF,
+	 0x02, 0x64, 0x69, 0xFB, 0xFF, 0xFF, 0xC1, 0xFE, 0x69, 0xF3, 0x00, 0x65, 0xD4, 0x80, 0x4E, 0xF3,
+	 0x0E, 0x03, 0x10, 0x60, 0x2A, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x80, 0x60, 0x00, 0x64, 0x08, 0x60,
+	 0x16, 0xFB, 0xD3, 0x60, 0x7C, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x10, 0x60,
+	 0x2A, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0xDE, 0xFE, 0x0A, 0x04, 0x20, 0x60, 0x00, 0x64, 0x08, 0x60,
+	 0x16, 0xFB, 0xD3, 0x60, 0x8F, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0xD3, 0xF3,
+	 0xFF, 0xFF, 0xFE, 0xB4, 0xD3, 0xFB, 0x1F, 0x60, 0x3A, 0x62, 0x06, 0x64, 0x4A, 0xDB, 0xFF, 0xFF,
+	 0x2D, 0xFF, 0x20, 0x44, 0x01, 0xB5, 0x54, 0x80, 0xDA, 0xFE, 0xBE, 0xFE, 0x87, 0xF1, 0x02, 0x64,
+	 0x86, 0xF3, 0xC0, 0x83, 0x40, 0x48, 0x75, 0xFD, 0xE7, 0x60, 0x58, 0x4E, 0x81, 0x78, 0xFF, 0xFF,
+	 0x28, 0x44, 0x4C, 0x88, 0x75, 0xF3, 0x02, 0x65, 0xC4, 0x83, 0xF5, 0x02, 0x1E, 0x60, 0x58, 0x4E,
+	 0xB9, 0x78, 0xFF, 0xFF, 0x17, 0x60, 0x06, 0x64, 0x0B, 0x60, 0x82, 0xFB, 0x4A, 0xDF, 0x01, 0x60,
+	 0xFE, 0x63, 0x15, 0x60, 0x00, 0x61, 0x00, 0x64, 0x59, 0xDB, 0xFE, 0x1F, 0x7D, 0xF1, 0x1E, 0x60,
+	 0xE0, 0x61, 0x64, 0x40, 0xFF, 0x26, 0x38, 0x00, 0xD4, 0x60, 0x58, 0x4E, 0x0F, 0x78, 0xFF, 0xFF,
+	 0x1E, 0x60, 0xCE, 0x61, 0xD4, 0x60, 0x58, 0x4E, 0x0F, 0x78, 0xFF, 0xFF, 0x1E, 0x60, 0xD4, 0x61,
+	 0xD4, 0x60, 0x58, 0x4E, 0x0F, 0x78, 0xFF, 0xFF, 0x1E, 0x60, 0xE6, 0x61, 0xD4, 0x60, 0x58, 0x4E,
+	 0x0F, 0x78, 0xFF, 0xFF, 0x1E, 0x60, 0xEC, 0x61, 0xD4, 0x60, 0x58, 0x4E, 0x0F, 0x78, 0xFF, 0xFF,
+	 0x1E, 0x60, 0xF8, 0x61, 0xD4, 0x60, 0x58, 0x4E, 0x0F, 0x78, 0xFF, 0xFF, 0x1F, 0x60, 0x04, 0x61,
+	 0xD4, 0x60, 0x58, 0x4E, 0x0F, 0x78, 0xFF, 0xFF, 0x1E, 0x60, 0xF2, 0x61, 0xD4, 0x60, 0x58, 0x4E,
+	 0x0F, 0x78, 0xFF, 0xFF, 0x1E, 0x60, 0xDA, 0x61, 0xD4, 0x60, 0x58, 0x4E, 0x3A, 0x78, 0xFF, 0xFF,
+	 0x00, 0x64, 0x08, 0x60, 0x15, 0xFB, 0x5A, 0xDB, 0xC5, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0xA1, 0xD3,
+	 0x0E, 0x57, 0x23, 0x00, 0x0E, 0xF2, 0x44, 0x4C, 0x80, 0xB0, 0x10, 0xB0, 0x0A, 0x03, 0x00, 0x64,
+	 0x0F, 0x60, 0x90, 0xFB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF,
+	 0x13, 0x00, 0x12, 0x02, 0xF0, 0x37, 0x09, 0x00, 0x02, 0xF0, 0x09, 0x60, 0x08, 0x64, 0xD0, 0x80,
+	 0xA2, 0xFF, 0x8F, 0xF3, 0x02, 0x02, 0xCC, 0x84, 0x8F, 0xFB, 0x1F, 0x60, 0x20, 0x64, 0x40, 0x4B,
+	 0xF6, 0x60, 0x58, 0x4D, 0xB3, 0x78, 0xFF, 0xFF, 0x2C, 0x44, 0xAC, 0x86, 0x09, 0xF0, 0xDA, 0x02,
+	 0x37, 0x58, 0xFF, 0xFF, 0xA1, 0xD3, 0x0E, 0x57, 0x18, 0x00, 0x0E, 0xF2, 0x44, 0x4C, 0x80, 0xB0,
+	 0x10, 0xB0, 0x0A, 0x03, 0x00, 0x64, 0x0F, 0x60, 0x90, 0xFB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64,
+	 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0x08, 0x00, 0x07, 0x02, 0x1F, 0x60, 0x20, 0x64, 0x40, 0x4B,
+	 0xF6, 0x60, 0x58, 0x4D, 0xB3, 0x78, 0xFF, 0xFF, 0x2C, 0x44, 0xAC, 0x86, 0x09, 0xF0, 0xE5, 0x02,
+	 0x37, 0x58, 0xFF, 0xFF, 0x00, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0xB0, 0x64, 0x2A, 0xFA, 0x2F, 0xF2,
+	 0x2C, 0xFA, 0x30, 0xF2, 0x2D, 0xFA, 0x31, 0xF2, 0x2E, 0xFA, 0xCB, 0xF3, 0x2F, 0xFA, 0xCC, 0xF3,
+	 0x30, 0xFA, 0xCD, 0xF3, 0x31, 0xFA, 0x66, 0xF3, 0x32, 0xFA, 0x67, 0xF3, 0x33, 0xFA, 0x68, 0xF3,
+	 0x34, 0xFA, 0xAB, 0xF1, 0x19, 0xF8, 0x06, 0x63, 0x3F, 0xFC, 0x1C, 0xF2, 0x13, 0xFA, 0x00, 0x64,
+	 0x3E, 0xFA, 0x07, 0xF2, 0x87, 0xF1, 0xFF, 0xFF, 0xD0, 0x80, 0xFF, 0xFF, 0x0C, 0x03, 0x60, 0x46,
+	 0x06, 0xF2, 0x26, 0x46, 0x01, 0xB0, 0xFF, 0xFF, 0x03, 0x02, 0xD6, 0x60, 0x40, 0x78, 0xFF, 0xFF,
+	 0xD7, 0x60, 0x92, 0x78, 0xFF, 0xFF, 0x00, 0xF4, 0x0A, 0xF2, 0x09, 0xF2, 0xFF, 0xA0, 0x00, 0xA0,
+	 0x13, 0x02, 0xFF, 0xA0, 0x04, 0x03, 0x08, 0x03, 0xD4, 0x60, 0xAF, 0x78, 0xFF, 0xFF, 0x02, 0x64,
+	 0x55, 0xFB, 0xD4, 0x60, 0xBA, 0x78, 0xFF, 0xFF, 0x01, 0x63, 0x32, 0x40, 0x08, 0x2A, 0x0F, 0x00,
+	 0x55, 0xFD, 0xD4, 0x60, 0xBA, 0x78, 0xFF, 0xFF, 0x26, 0x46, 0x00, 0xF4, 0x0A, 0xF2, 0x0E, 0x63,
+	 0x01, 0xA4, 0x0A, 0xFA, 0x0B, 0xFC, 0x43, 0x59, 0xD7, 0x60, 0x6C, 0x78, 0xFF, 0xFF, 0x26, 0x46,
+	 0x00, 0xF4, 0x0A, 0xF2, 0x0D, 0x63, 0x01, 0xA4, 0x0A, 0xFA, 0x0B, 0xFC, 0x43, 0x59, 0xD7, 0x60,
+	 0x6C, 0x78, 0xFF, 0xFF, 0x87, 0xF5, 0x00, 0xF2, 0x26, 0x46, 0x00, 0xA0, 0x2E, 0xF0, 0x37, 0x03,
+	 0x66, 0x41, 0x15, 0x60, 0x02, 0x65, 0x64, 0x47, 0x00, 0x7F, 0x87, 0xF1, 0xE0, 0x84, 0x44, 0xD3,
+	 0x64, 0x43, 0x11, 0x18, 0x60, 0x46, 0x00, 0xF2, 0xFF, 0xFF, 0xFC, 0x1B, 0x66, 0x44, 0x64, 0x46,
+	 0x80, 0xF0, 0x60, 0x46, 0x80, 0xF8, 0x65, 0x46, 0x65, 0x43, 0x80, 0xF0, 0x01, 0xFA, 0x80, 0xFC,
+	 0x64, 0x46, 0x80, 0xF8, 0x0B, 0x00, 0x64, 0x46, 0x62, 0x43, 0x00, 0xF2, 0xA3, 0xDB, 0x60, 0x46,
+	 0x80, 0xF0, 0x81, 0xFC, 0x80, 0xFC, 0x64, 0x46, 0x80, 0xF8, 0x60, 0x43, 0x61, 0x46, 0x86, 0xF1,
+	 0x17, 0x60, 0x02, 0x61, 0xA1, 0xD3, 0xDA, 0x81, 0xD0, 0x80, 0xDC, 0x9C, 0x05, 0x05, 0xA1, 0xD3,
+	 0x4A, 0xD9, 0xA0, 0xDD, 0xDA, 0x9C, 0xA1, 0xD9, 0xD6, 0x60, 0x09, 0x78, 0xFF, 0xFF, 0x0B, 0x60,
+	 0x81, 0xF3, 0xFF, 0xFF, 0x62, 0x18, 0x17, 0x60, 0x02, 0x64, 0x04, 0xA5, 0xA0, 0xD1, 0x72, 0x44,
+	 0xFF, 0xB4, 0x64, 0x40, 0xE0, 0x22, 0x1F, 0xB4, 0x64, 0x40, 0xF8, 0x22, 0x07, 0xB4, 0x02, 0x00,
+	 0x03, 0x04, 0xD0, 0x84, 0xD0, 0x80, 0xFC, 0x01, 0xE0, 0x84, 0x44, 0xD3, 0xFF, 0xFF, 0x60, 0x43,
+	 0x66, 0x41, 0x63, 0x46, 0x05, 0xF2, 0x00, 0xF0, 0x81, 0xF0, 0x02, 0x18, 0x64, 0x46, 0x81, 0xF8,
+	 0x07, 0x1B, 0x15, 0x60, 0x02, 0x65, 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD9, 0x02, 0x00,
+	 0x65, 0x46, 0x00, 0xF8, 0x87, 0xF3, 0x63, 0x45, 0x60, 0x46, 0x00, 0xF2, 0xFF, 0xFF, 0xD4, 0x80,
+	 0x01, 0x18, 0xFA, 0x04, 0x80, 0xF8, 0x65, 0x46, 0x00, 0xFA, 0x06, 0xF2, 0xFF, 0xFF, 0x00, 0x7E,
+	 0x06, 0xFA, 0x61, 0x46, 0x2E, 0xF0, 0x66, 0x41, 0x15, 0x60, 0x02, 0x65, 0x64, 0x47, 0x00, 0x7F,
+	 0x87, 0xF1, 0xE0, 0x84, 0x44, 0xD3, 0x64, 0x43, 0x11, 0x18, 0x60, 0x46, 0x00, 0xF2, 0xFF, 0xFF,
+	 0xFC, 0x1B, 0x66, 0x44, 0x64, 0x46, 0x80, 0xF0, 0x60, 0x46, 0x80, 0xF8, 0x65, 0x46, 0x65, 0x43,
+	 0x80, 0xF0, 0x01, 0xFA, 0x80, 0xFC, 0x64, 0x46, 0x80, 0xF8, 0x0B, 0x00, 0x64, 0x46, 0x62, 0x43,
+	 0x00, 0xF2, 0xA3, 0xDB, 0x60, 0x46, 0x80, 0xF0, 0x81, 0xFC, 0x80, 0xFC, 0x64, 0x46, 0x80, 0xF8,
+	 0x60, 0x43, 0x61, 0x46, 0xD6, 0x60, 0x09, 0x78, 0xFF, 0xFF, 0x00, 0x60, 0x02, 0x61, 0xB5, 0x60,
+	 0x58, 0x4D, 0xA2, 0x78, 0xFF, 0xFF, 0x86, 0xF1, 0x72, 0x44, 0xFF, 0xB4, 0xD0, 0x80, 0xFF, 0xFF,
+	 0x02, 0x04, 0xD0, 0x84, 0xFB, 0x01, 0xE0, 0x83, 0x87, 0xF3, 0x02, 0xA3, 0x43, 0x93, 0x66, 0x44,
+	 0x00, 0xA8, 0x56, 0xFD, 0x3A, 0x03, 0x00, 0x64, 0x2B, 0xFA, 0x00, 0x60, 0xC0, 0x64, 0x2A, 0xFA,
+	 0x66, 0x45, 0x63, 0x46, 0x03, 0xF2, 0x04, 0xF0, 0x85, 0xF2, 0x65, 0x46, 0x2C, 0xFA, 0x2D, 0xF8,
+	 0xAE, 0xFA, 0xCB, 0xF3, 0x2F, 0xFA, 0x32, 0xFA, 0xCC, 0xF3, 0x30, 0xFA, 0x33, 0xFA, 0xCD, 0xF3,
+	 0x31, 0xFA, 0x34, 0xFA, 0xAB, 0xF1, 0x19, 0xF8, 0xFF, 0x67, 0x0E, 0xFA, 0x66, 0x41, 0x43, 0x49,
+	 0x29, 0x46, 0x92, 0xF0, 0x2C, 0x60, 0x26, 0x63, 0x47, 0xD3, 0x61, 0x46, 0x02, 0x63, 0x00, 0x7E,
+	 0x13, 0xFA, 0x3F, 0xFC, 0x00, 0x64, 0x3E, 0xFA, 0x87, 0xF3, 0x07, 0xFA, 0x66, 0x41, 0x00, 0xF4,
+	 0x05, 0x64, 0x09, 0xFA, 0x1E, 0x60, 0xD4, 0x64, 0x0F, 0x60, 0x90, 0xFB, 0x61, 0x44, 0x5A, 0xDB,
+	 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xC1, 0xFE, 0x56, 0xF3, 0xA3, 0xFF, 0x60, 0x43,
+	 0xE7, 0x60, 0x58, 0x4E, 0x81, 0x78, 0xFF, 0xFF, 0x56, 0xF3, 0xFF, 0xFF, 0x40, 0x58, 0x03, 0x65,
+	 0xE5, 0x60, 0x58, 0x4E, 0x51, 0x78, 0xFF, 0xFF, 0x56, 0xF3, 0x26, 0x46, 0x60, 0x43, 0x66, 0x41,
+	 0x63, 0x46, 0x05, 0xF2, 0x00, 0xF0, 0x81, 0xF0, 0x02, 0x18, 0x64, 0x46, 0x81, 0xF8, 0x07, 0x1B,
+	 0x15, 0x60, 0x02, 0x65, 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD9, 0x02, 0x00, 0x65, 0x46,
+	 0x00, 0xF8, 0x87, 0xF3, 0x63, 0x45, 0x60, 0x46, 0x00, 0xF2, 0xFF, 0xFF, 0xD4, 0x80, 0x01, 0x18,
+	 0xFA, 0x04, 0x80, 0xF8, 0x65, 0x46, 0x00, 0xFA, 0x06, 0xF2, 0xFF, 0xFF, 0x00, 0x7E, 0x06, 0xFA,
+	 0x61, 0x46, 0x2E, 0xF0, 0x66, 0x41, 0x15, 0x60, 0x02, 0x65, 0x64, 0x47, 0x00, 0x7F, 0x87, 0xF1,
+	 0xE0, 0x84, 0x44, 0xD3, 0x64, 0x43, 0x11, 0x18, 0x60, 0x46, 0x00, 0xF2, 0xFF, 0xFF, 0xFC, 0x1B,
+	 0x66, 0x44, 0x64, 0x46, 0x80, 0xF0, 0x60, 0x46, 0x80, 0xF8, 0x65, 0x46, 0x65, 0x43, 0x80, 0xF0,
+	 0x01, 0xFA, 0x80, 0xFC, 0x64, 0x46, 0x80, 0xF8, 0x0B, 0x00, 0x64, 0x46, 0x62, 0x43, 0x00, 0xF2,
+	 0xA3, 0xDB, 0x60, 0x46, 0x80, 0xF0, 0x81, 0xFC, 0x80, 0xFC, 0x64, 0x46, 0x80, 0xF8, 0x60, 0x43,
+	 0x61, 0x46, 0x2C, 0xF2, 0x2D, 0xF0, 0xAE, 0xF2, 0x66, 0x45, 0x63, 0x46, 0x03, 0xFA, 0x04, 0xF8,
+	 0x55, 0xF3, 0x85, 0xFA, 0xFF, 0xA0, 0x65, 0x46, 0x03, 0x03, 0xD7, 0x60, 0xAE, 0x78, 0xFF, 0xFF,
+	 0x94, 0xF3, 0x66, 0x45, 0x63, 0x46, 0x1F, 0xFA, 0x65, 0x46, 0xBA, 0x65, 0x60, 0x44, 0xC4, 0x85,
+	 0x01, 0x60, 0xFE, 0x61, 0x00, 0x64, 0x80, 0x63, 0xC7, 0x85, 0x94, 0x84, 0x59, 0xDB, 0xFC, 0x1F,
+	 0x00, 0x60, 0x88, 0x64, 0x3F, 0xFA, 0x00, 0xF4, 0x02, 0x64, 0x0A, 0xFA, 0x00, 0x64, 0x0B, 0xFA,
+	 0x80, 0x7F, 0x10, 0x7E, 0x0C, 0xFA, 0x1A, 0x65, 0x80, 0x61, 0x02, 0x60, 0x00, 0x63, 0x0F, 0x4E,
+	 0xF8, 0x60, 0x58, 0x4F, 0x7A, 0x78, 0xFF, 0xFF, 0x0E, 0x4F, 0xD7, 0x60, 0x80, 0x78, 0xFF, 0xFF,
+	 0x26, 0x46, 0x23, 0xF0, 0x00, 0x60, 0x02, 0x64, 0xA0, 0x80, 0x00, 0xF4, 0x03, 0x03, 0xD7, 0x60,
+	 0x2A, 0x78, 0xFF, 0xFF, 0x09, 0xF2, 0xFF, 0xFF, 0xFF, 0xA0, 0x00, 0xA0, 0x0C, 0x03, 0x03, 0x03,
+	 0xD6, 0x60, 0xA7, 0x78, 0xFF, 0xFF, 0x0A, 0xF2, 0x26, 0x46, 0xFF, 0xA0, 0x87, 0xF4, 0x10, 0x02,
+	 0xD7, 0x60, 0xAE, 0x78, 0xFF, 0xFF, 0x0A, 0xF2, 0xFF, 0xFF, 0xFF, 0xA0, 0xFD, 0xA0, 0x02, 0x03,
+	 0x04, 0x03, 0x06, 0x00, 0xD6, 0x60, 0xE6, 0x78, 0xFF, 0xFF, 0xD6, 0x60, 0xF1, 0x78, 0xFF, 0xFF,
+	 0x26, 0x46, 0x87, 0xF4, 0x66, 0x41, 0x63, 0x46, 0x05, 0xF2, 0x00, 0xF0, 0x81, 0xF0, 0x02, 0x18,
+	 0x64, 0x46, 0x81, 0xF8, 0x07, 0x1B, 0x15, 0x60, 0x02, 0x65, 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84,
+	 0x44, 0xD9, 0x02, 0x00, 0x65, 0x46, 0x00, 0xF8, 0x87, 0xF3, 0x63, 0x45, 0x60, 0x46, 0x00, 0xF2,
+	 0xFF, 0xFF, 0xD4, 0x80, 0x01, 0x18, 0xFA, 0x04, 0x80, 0xF8, 0x65, 0x46, 0x00, 0xFA, 0x06, 0xF2,
+	 0xFF, 0xFF, 0x00, 0x7E, 0x06, 0xFA, 0x61, 0x46, 0x0B, 0x60, 0x82, 0xF3, 0xDA, 0x81, 0x60, 0x45,
+	 0xD5, 0x80, 0xA1, 0xD1, 0x11, 0x03, 0xD3, 0x80, 0xD9, 0x81, 0xFA, 0x02, 0xC9, 0x81, 0xC8, 0x85,
+	 0xD5, 0x80, 0xA5, 0xD3, 0x08, 0x28, 0xA1, 0xDB, 0x17, 0x60, 0x04, 0x62, 0x65, 0x44, 0xA2, 0xDB,
+	 0x4A, 0xD3, 0xFF, 0xFF, 0xCC, 0x84, 0xA2, 0xDB, 0xD4, 0x60, 0xA4, 0x78, 0xFF, 0xFF, 0x26, 0x46,
+	 0x87, 0xF4, 0x66, 0x41, 0x63, 0x46, 0x05, 0xF2, 0x00, 0xF0, 0x81, 0xF0, 0x02, 0x18, 0x64, 0x46,
+	 0x81, 0xF8, 0x07, 0x1B, 0x15, 0x60, 0x02, 0x65, 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD9,
+	 0x02, 0x00, 0x65, 0x46, 0x00, 0xF8, 0x87, 0xF3, 0x63, 0x45, 0x60, 0x46, 0x00, 0xF2, 0xFF, 0xFF,
+	 0xD4, 0x80, 0x01, 0x18, 0xFA, 0x04, 0x80, 0xF8, 0x65, 0x46, 0x00, 0xFA, 0x06, 0xF2, 0xFF, 0xFF,
+	 0x00, 0x7E, 0x06, 0xFA, 0x61, 0x46, 0x0B, 0x60, 0x82, 0xF3, 0xDA, 0x81, 0x60, 0x45, 0xD5, 0x80,
+	 0xA1, 0xD1, 0x11, 0x03, 0xD3, 0x80, 0xD9, 0x81, 0xFA, 0x02, 0xC9, 0x81, 0xC8, 0x85, 0xD5, 0x80,
+	 0xA5, 0xD3, 0x08, 0x28, 0xA1, 0xDB, 0x17, 0x60, 0x04, 0x62, 0x65, 0x44, 0xA2, 0xDB, 0x4A, 0xD3,
+	 0xFF, 0xFF, 0xCC, 0x84, 0xA2, 0xDB, 0xD4, 0x60, 0xAF, 0x78, 0xFF, 0xFF, 0x26, 0x46, 0x32, 0x44,
+	 0x08, 0xB0, 0x87, 0xF4, 0x03, 0x02, 0xD4, 0x60, 0xAF, 0x78, 0xFF, 0xFF, 0xD6, 0x60, 0x18, 0x78,
+	 0xFF, 0xFF, 0x32, 0x44, 0x26, 0x46, 0x08, 0xB0, 0x07, 0xF2, 0x03, 0x02, 0xD4, 0x60, 0xAF, 0x78,
+	 0xFF, 0xFF, 0x60, 0x46, 0x1F, 0xF2, 0x26, 0x46, 0xBA, 0x65, 0x60, 0x44, 0xC4, 0x85, 0x01, 0x60,
+	 0xFE, 0x61, 0x00, 0x64, 0x80, 0x63, 0xC7, 0x85, 0x94, 0x84, 0x59, 0xDB, 0xFC, 0x1F, 0x00, 0xF4,
+	 0x01, 0x60, 0xFE, 0x61, 0x7E, 0x65, 0x18, 0x63, 0x5B, 0xD2, 0x59, 0xD1, 0xFF, 0xFF, 0xD0, 0x80,
+	 0xD7, 0x80, 0x18, 0x02, 0xF9, 0x02, 0x00, 0xF4, 0x02, 0x63, 0x0E, 0x65, 0x5B, 0xD2, 0x59, 0xD1,
+	 0xFF, 0xFF, 0xD0, 0x80, 0xD7, 0x80, 0x0E, 0x02, 0xF9, 0x02, 0x26, 0x46, 0x07, 0xF4, 0x06, 0xF2,
+	 0xFF, 0xFF, 0x01, 0x7E, 0x06, 0xFA, 0x26, 0x46, 0x00, 0xF4, 0x04, 0x64, 0x0A, 0xFA, 0x00, 0x64,
+	 0x0B, 0xFA, 0x56, 0x00, 0x26, 0x46, 0x87, 0xF4, 0x66, 0x41, 0x63, 0x46, 0x05, 0xF2, 0x00, 0xF0,
+	 0x81, 0xF0, 0x02, 0x18, 0x64, 0x46, 0x81, 0xF8, 0x07, 0x1B, 0x15, 0x60, 0x02, 0x65, 0x60, 0x47,
+	 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD9, 0x02, 0x00, 0x65, 0x46, 0x00, 0xF8, 0x87, 0xF3, 0x63, 0x45,
+	 0x60, 0x46, 0x00, 0xF2, 0xFF, 0xFF, 0xD4, 0x80, 0x01, 0x18, 0xFA, 0x04, 0x80, 0xF8, 0x65, 0x46,
+	 0x00, 0xFA, 0x06, 0xF2, 0xFF, 0xFF, 0x00, 0x7E, 0x06, 0xFA, 0x61, 0x46, 0x0B, 0x60, 0x82, 0xF3,
+	 0xDA, 0x81, 0x60, 0x45, 0xD5, 0x80, 0xA1, 0xD1, 0x11, 0x03, 0xD3, 0x80, 0xD9, 0x81, 0xFA, 0x02,
+	 0xC9, 0x81, 0xC8, 0x85, 0xD5, 0x80, 0xA5, 0xD3, 0x08, 0x28, 0xA1, 0xDB, 0x17, 0x60, 0x04, 0x62,
+	 0x65, 0x44, 0xA2, 0xDB, 0x4A, 0xD3, 0xFF, 0xFF, 0xCC, 0x84, 0xA2, 0xDB, 0x00, 0xF4, 0x04, 0x64,
+	 0x0A, 0xFA, 0x0F, 0x64, 0x0B, 0xFA, 0x40, 0x59, 0x02, 0x60, 0x00, 0x61, 0x41, 0x58, 0x26, 0x46,
+	 0x2C, 0xF2, 0xA1, 0xDB, 0x2D, 0xF2, 0x59, 0xDB, 0x2E, 0xF2, 0x59, 0xDB, 0x03, 0x65, 0xE5, 0x60,
+	 0x58, 0x4E, 0x27, 0x78, 0xFF, 0xFF, 0x03, 0x65, 0xE5, 0x60, 0x58, 0x4E, 0x51, 0x78, 0xFF, 0xFF,
+	 0x26, 0x46, 0x87, 0xF3, 0x07, 0xFA, 0x1E, 0x60, 0xD4, 0x64, 0x0F, 0x60, 0x90, 0xFB, 0x26, 0x44,
+	 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xC1, 0xFE, 0x00, 0x66, 0x46, 0x46,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x00, 0xF4, 0x0A, 0xF2, 0x09, 0xF2, 0xFF, 0xA0, 0x00, 0xA0, 0x06, 0x02,
+	 0xFF, 0xA0, 0x07, 0x03, 0x09, 0x03, 0xD6, 0x60, 0xA7, 0x78, 0xFF, 0xFF, 0xD6, 0x60, 0x68, 0x78,
+	 0xFF, 0xFF, 0xD7, 0x60, 0xB3, 0x78, 0xFF, 0xFF, 0x26, 0x46, 0x07, 0xF4, 0x06, 0xF2, 0x66, 0x43,
+	 0x00, 0x7E, 0x06, 0xFA, 0x26, 0x46, 0xD6, 0x60, 0x18, 0x78, 0xFF, 0xFF, 0x63, 0x46, 0x06, 0xF2,
+	 0xFF, 0xFF, 0x01, 0x7E, 0x06, 0xFA, 0x26, 0x46, 0x87, 0xF3, 0x07, 0xFA, 0x00, 0xF4, 0x02, 0x64,
+	 0x0A, 0xFA, 0x00, 0x64, 0x0B, 0xFA, 0x1E, 0x60, 0xD4, 0x64, 0x0F, 0x60, 0x90, 0xFB, 0x26, 0x44,
+	 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xC1, 0xFE, 0x00, 0x66, 0x46, 0x46,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x01, 0x61, 0x00, 0x60, 0x10, 0x7C, 0x2A, 0xF2, 0x0C, 0x60, 0x70, 0xFB,
+	 0xFF, 0xB4, 0x16, 0x60, 0x83, 0xFB, 0x60, 0x40, 0x00, 0x36, 0x03, 0x00, 0x02, 0x61, 0x00, 0x60,
+	 0x30, 0x7C, 0x41, 0x47, 0x2A, 0xF8, 0x2F, 0xF2, 0x2C, 0xFA, 0x30, 0xF2, 0x2D, 0xFA, 0x31, 0xF2,
+	 0x2E, 0xFA, 0xCB, 0xF3, 0x2F, 0xFA, 0xCC, 0xF3, 0x30, 0xFA, 0xCD, 0xF3, 0x31, 0xFA, 0x66, 0xF3,
+	 0x32, 0xFA, 0x67, 0xF3, 0x33, 0xFA, 0x68, 0xF3, 0x34, 0xFA, 0xAB, 0xF1, 0x19, 0xF8, 0x00, 0x7C,
+	 0x3E, 0xF8, 0x1C, 0xF0, 0x13, 0xF8, 0x07, 0xF2, 0x87, 0xF1, 0xFF, 0xFF, 0xD0, 0x80, 0xFF, 0xFF,
+	 0x03, 0x02, 0xDC, 0x60, 0x55, 0x78, 0xFF, 0xFF, 0x40, 0x4B, 0x01, 0x65, 0xEF, 0x60, 0x58, 0x4E,
+	 0xDC, 0x78, 0xFF, 0xFF, 0xAB, 0x46, 0x06, 0xF2, 0xAB, 0x46, 0x00, 0xF4, 0x01, 0xB0, 0xFF, 0xFF,
+	 0x03, 0x02, 0xDC, 0x60, 0x55, 0x78, 0xFF, 0xFF, 0x09, 0xF2, 0x16, 0x60, 0x84, 0xFB, 0x5A, 0x84,
+	 0x00, 0x63, 0x60, 0x40, 0x20, 0x26, 0x02, 0xBB, 0x60, 0x40, 0x04, 0x27, 0x04, 0xBB, 0xAB, 0x46,
+	 0x78, 0xFC, 0xAB, 0x46, 0xFF, 0xFF, 0x10, 0xB0, 0x80, 0x60, 0x00, 0x63, 0x0C, 0x03, 0x13, 0x60,
+	 0x45, 0xF1, 0xFF, 0xFF, 0x64, 0x44, 0xFE, 0x26, 0x08, 0x00, 0x32, 0x40, 0x08, 0x26, 0x06, 0x00,
+	 0xDC, 0x60, 0xB9, 0x78, 0xFF, 0xFF, 0x32, 0x40, 0x10, 0x2A, 0x00, 0x63, 0xAB, 0x46, 0x06, 0xF0,
+	 0x7F, 0x60, 0xFF, 0x64, 0xA0, 0x84, 0x63, 0x45, 0xB4, 0x84, 0x06, 0xFA, 0xAB, 0x46, 0x0A, 0xF0,
+	 0x56, 0xF9, 0x24, 0xD9, 0x5A, 0x84, 0x01, 0x63, 0x32, 0x40, 0x10, 0x26, 0x10, 0xBB, 0x13, 0x60,
+	 0x45, 0xF3, 0xFF, 0xFF, 0x60, 0x40, 0xFE, 0x26, 0x10, 0xBB, 0x15, 0x60, 0xDD, 0xF1, 0x63, 0x44,
+	 0x20, 0xBC, 0xFB, 0x60, 0xFF, 0xB7, 0x64, 0x40, 0x10, 0x26, 0x04, 0xBC, 0x60, 0x47, 0x60, 0x43,
+	 0x09, 0xFC, 0x27, 0x44, 0xFE, 0xA0, 0xFF, 0xFF, 0x03, 0x03, 0xD8, 0x60, 0xC8, 0x78, 0xFF, 0xFF,
+	 0x18, 0x60, 0xD6, 0x64, 0x24, 0x43, 0x0B, 0xF0, 0xA0, 0xD9, 0xBD, 0xD9, 0x0C, 0xF0, 0x58, 0xD9,
+	 0xBD, 0xD9, 0x0D, 0xF0, 0x58, 0xD9, 0xBD, 0xD9, 0x43, 0x44, 0x26, 0x46, 0x87, 0xF2, 0x3F, 0xF2,
+	 0x41, 0x4B, 0x00, 0xF4, 0x60, 0x43, 0xF6, 0xA3, 0x00, 0x60, 0x1B, 0x61, 0x00, 0x60, 0x01, 0x65,
+	 0x01, 0x60, 0xFF, 0x64, 0x40, 0x4C, 0xEF, 0x60, 0x58, 0x4E, 0x79, 0x78, 0xFF, 0xFF, 0x00, 0xBB,
+	 0xFF, 0xFF, 0x00, 0x02, 0x00, 0x64, 0x40, 0x4A, 0x60, 0xFE, 0x02, 0x60, 0x00, 0x63, 0xBD, 0xD3,
+	 0xBD, 0xD3, 0x60, 0x41, 0xF0, 0x60, 0x58, 0x4E, 0x27, 0x78, 0xFF, 0xFF, 0x20, 0xFE, 0x26, 0x46,
+	 0x3F, 0xF2, 0x00, 0xF4, 0x60, 0x43, 0xF6, 0xA3, 0x00, 0x60, 0x1B, 0x61, 0x00, 0x60, 0x32, 0x65,
+	 0x01, 0x60, 0xFF, 0x64, 0x40, 0x4C, 0xEF, 0x60, 0x58, 0x4E, 0x79, 0x78, 0xFF, 0xFF, 0x00, 0xBB,
+	 0xFF, 0xFF, 0x0B, 0x03, 0x60, 0xFE, 0x02, 0x60, 0x00, 0x63, 0xBD, 0xD3, 0xBD, 0xD3, 0x60, 0x41,
+	 0xF0, 0x60, 0x58, 0x4E, 0x27, 0x78, 0xFF, 0xFF, 0x00, 0x00, 0x20, 0xFE, 0x30, 0x60, 0x20, 0x61,
+	 0xA1, 0xD1, 0x82, 0xF3, 0x01, 0x60, 0x6E, 0x63, 0x60, 0x45, 0x2A, 0x44, 0x60, 0xFB, 0xA3, 0xD5,
+	 0x65, 0x40, 0x01, 0x27, 0x5B, 0xD5, 0x65, 0x40, 0x01, 0x27, 0x59, 0xD1, 0x66, 0x41, 0xA0, 0x84,
+	 0x24, 0x94, 0x2B, 0x46, 0x0F, 0xFA, 0x61, 0xFB, 0x16, 0x64, 0x12, 0xFA, 0x01, 0x64, 0x11, 0xFA,
+	 0x66, 0x5C, 0xC1, 0x60, 0x58, 0x4E, 0x93, 0x78, 0xFF, 0xFF, 0xD9, 0x60, 0x28, 0x78, 0xFF, 0xFF,
+	 0x26, 0x46, 0x87, 0xF2, 0x3F, 0xF2, 0x41, 0x4B, 0x00, 0xF4, 0x60, 0x43, 0xFC, 0xA3, 0x00, 0x60,
+	 0x15, 0x61, 0x00, 0x60, 0x01, 0x65, 0x01, 0x60, 0xFF, 0x64, 0x40, 0x4C, 0xEF, 0x60, 0x58, 0x4E,
+	 0x79, 0x78, 0xFF, 0xFF, 0x00, 0xBB, 0xFF, 0xFF, 0x00, 0x02, 0x00, 0x64, 0x40, 0x4A, 0x60, 0xFE,
+	 0x02, 0x60, 0x00, 0x63, 0xBD, 0xD3, 0xBD, 0xD3, 0x60, 0x41, 0xF0, 0x60, 0x58, 0x4E, 0x27, 0x78,
+	 0xFF, 0xFF, 0x20, 0xFE, 0x26, 0x46, 0x3F, 0xF2, 0x00, 0xF4, 0x60, 0x43, 0xFC, 0xA3, 0x00, 0x60,
+	 0x15, 0x61, 0x00, 0x60, 0x32, 0x65, 0x01, 0x60, 0xFF, 0x64, 0x40, 0x4C, 0xEF, 0x60, 0x58, 0x4E,
+	 0x79, 0x78, 0xFF, 0xFF, 0x00, 0xBB, 0xFF, 0xFF, 0x0B, 0x03, 0x60, 0xFE, 0x02, 0x60, 0x00, 0x63,
+	 0xBD, 0xD3, 0xBD, 0xD3, 0x60, 0x41, 0xF0, 0x60, 0x58, 0x4E, 0x27, 0x78, 0xFF, 0xFF, 0x00, 0x00,
+	 0x20, 0xFE, 0x30, 0x60, 0x20, 0x61, 0xA1, 0xD1, 0x82, 0xF3, 0x01, 0x60, 0x6E, 0x63, 0x60, 0x45,
+	 0x2A, 0x44, 0x60, 0xFB, 0xA3, 0xD5, 0x65, 0x40, 0x01, 0x27, 0x5B, 0xD5, 0x65, 0x40, 0x01, 0x27,
+	 0x59, 0xD1, 0x66, 0x41, 0xA0, 0x84, 0x24, 0x94, 0x2B, 0x46, 0x0F, 0xFA, 0x61, 0xFB, 0x16, 0x64,
+	 0x12, 0xFA, 0x01, 0x64, 0x11, 0xFA, 0x66, 0x5C, 0xC1, 0x60, 0x58, 0x4E, 0x93, 0x78, 0xFF, 0xFF,
+	 0x2B, 0x46, 0x0F, 0xF2, 0x12, 0x63, 0x7C, 0x18, 0x26, 0x46, 0x87, 0xF2, 0x01, 0x65, 0x41, 0x4B,
+	 0xAB, 0x46, 0x0F, 0xF2, 0xFF, 0xFF, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xFF, 0x22,
+	 0x00, 0x65, 0x78, 0xF2, 0xFF, 0xFF, 0xB4, 0x84, 0x78, 0xFA, 0xAB, 0x46, 0xFF, 0xFF, 0x26, 0x46,
+	 0x3F, 0xF2, 0x00, 0xF4, 0x16, 0x65, 0x27, 0x40, 0x02, 0x3A, 0x03, 0x00, 0x1C, 0x65, 0xF6, 0xA4,
+	 0x01, 0x00, 0xFC, 0xA4, 0x24, 0x43, 0x2D, 0x60, 0x5E, 0x61, 0x5D, 0x91, 0x51, 0x90, 0xFF, 0xFF,
+	 0x04, 0x28, 0x60, 0x41, 0xCD, 0x84, 0x4C, 0x91, 0x60, 0x43, 0x60, 0xFE, 0xA5, 0xD2, 0xDE, 0x85,
+	 0x7F, 0x26, 0x02, 0x00, 0x00, 0xF4, 0x04, 0x65, 0x5D, 0x93, 0xA3, 0xDB, 0x5D, 0x93, 0xA5, 0xD2,
+	 0xF6, 0x1F, 0x5D, 0x93, 0x20, 0xFE, 0xDF, 0x83, 0x2D, 0x60, 0x04, 0x7C, 0x03, 0x1E, 0x60, 0xFE,
+	 0xBD, 0xDF, 0x20, 0xFE, 0x2D, 0x60, 0x08, 0x64, 0x53, 0x93, 0xA4, 0xDD, 0x26, 0x46, 0x00, 0xF4,
+	 0x13, 0x60, 0x44, 0xF3, 0x00, 0x63, 0x00, 0xB8, 0x0A, 0xFC, 0x03, 0x02, 0xD9, 0x60, 0xCF, 0x78,
+	 0xFF, 0xFF, 0x0B, 0xF2, 0x27, 0x40, 0x02, 0x3A, 0x02, 0x00, 0x0E, 0xF2, 0xFF, 0xFF, 0x60, 0x47,
+	 0x00, 0x3A, 0x25, 0x00, 0x60, 0x41, 0x00, 0x36, 0x22, 0x00, 0xE0, 0xA0, 0xDA, 0x85, 0x1F, 0x07,
+	 0x13, 0x60, 0x0B, 0xF1, 0x65, 0x42, 0xD1, 0x80, 0x26, 0x60, 0x18, 0x63, 0x18, 0x02, 0x50, 0xFE,
+	 0x61, 0x40, 0xFE, 0x22, 0x08, 0x00, 0x62, 0x45, 0xBD, 0xD3, 0xA5, 0xD0, 0xDA, 0x82, 0xD0, 0x80,
+	 0xC9, 0x81, 0xF6, 0x0C, 0x0C, 0x00, 0x61, 0x40, 0x00, 0x36, 0x31, 0x00, 0x62, 0x45, 0xA3, 0xD3,
+	 0xA5, 0xD0, 0xFF, 0xFF, 0x90, 0x80, 0xFF, 0x26, 0x02, 0x00, 0xDE, 0x82, 0x28, 0x00, 0x0C, 0x63,
+	 0x0A, 0xFC, 0x00, 0x64, 0x09, 0xFA, 0x0B, 0xFA, 0x01, 0x7E, 0x0C, 0xFA, 0x26, 0x46, 0x08, 0x64,
+	 0x3F, 0xFA, 0x07, 0xF2, 0x87, 0xF1, 0x40, 0x58, 0x07, 0xF8, 0x1E, 0x60, 0xD4, 0x64, 0x0F, 0x60,
+	 0x90, 0xFB, 0x26, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xC1, 0xFE,
+	 0xDC, 0x60, 0xD4, 0x78, 0xFF, 0xFF, 0x20, 0xFE, 0x16, 0x60, 0x50, 0xF3, 0xFF, 0xFF, 0x22, 0xB0,
+	 0xFF, 0xFF, 0x03, 0x03, 0xDB, 0x60, 0xB1, 0x78, 0xFF, 0xFF, 0x01, 0x63, 0xD9, 0x01, 0x13, 0x60,
+	 0x45, 0xF3, 0xFF, 0xFF, 0xFF, 0xA4, 0xFF, 0xFF, 0x0C, 0x20, 0x03, 0x00, 0xDB, 0x60, 0xB1, 0x78,
+	 0xFF, 0xFF, 0x00, 0x64, 0x16, 0x60, 0x56, 0xFB, 0x16, 0x60, 0x57, 0xFB, 0x16, 0x60, 0x58, 0xFB,
+	 0x16, 0x60, 0x5A, 0xFB, 0x16, 0x60, 0x5B, 0xFB, 0x16, 0x60, 0x5C, 0xFB, 0x16, 0x60, 0x5D, 0xFB,
+	 0x18, 0x60, 0x17, 0xFB, 0x2B, 0x46, 0x3B, 0xF2, 0x7F, 0x60, 0xCF, 0x65, 0xA4, 0x84, 0xA2, 0xDA,
+	 0x26, 0x46, 0x00, 0xF4, 0x0B, 0xF2, 0x27, 0x40, 0x02, 0x3A, 0x02, 0x00, 0x0E, 0xF2, 0xFF, 0xFF,
+	 0xCE, 0x81, 0x20, 0xFE, 0x30, 0x60, 0x28, 0x64, 0x40, 0x4A, 0xDA, 0x60, 0x58, 0x4D, 0x62, 0x78,
+	 0xFF, 0xFF, 0x20, 0xFE, 0x18, 0x60, 0x17, 0xF3, 0xFF, 0xFF, 0x08, 0x18, 0x18, 0x60, 0x19, 0xF3,
+	 0x18, 0x60, 0x1A, 0xF5, 0x60, 0x41, 0x30, 0x60, 0x2E, 0x62, 0xA2, 0xDF, 0x2A, 0xD1, 0xDA, 0x85,
+	 0x64, 0x44, 0x01, 0xA0, 0xFF, 0xFF, 0x01, 0x02, 0x75, 0x00, 0x45, 0x4A, 0x7C, 0x44, 0x60, 0xFE,
+	 0xA1, 0xD2, 0xFF, 0xFF, 0xD0, 0x80, 0x20, 0xFE, 0x01, 0x03, 0xE3, 0x01, 0x30, 0x60, 0x2E, 0x62,
+	 0xA2, 0xDF, 0x60, 0xFE, 0x5D, 0xD2, 0xFF, 0xFF, 0x60, 0x5C, 0x41, 0x94, 0x81, 0xA0, 0x20, 0xFE,
+	 0x2D, 0x04, 0x01, 0x64, 0x18, 0x60, 0x17, 0xFB, 0xC1, 0x84, 0x84, 0xA4, 0x18, 0x60, 0x19, 0xFB,
+	 0x00, 0xF2, 0x18, 0x60, 0x1A, 0xFB, 0x18, 0x60, 0x18, 0xFD, 0x02, 0x60, 0x00, 0x63, 0xCD, 0x85,
+	 0x64, 0x44, 0xD8, 0x81, 0xCD, 0x84, 0x4C, 0x91, 0x60, 0x43, 0x60, 0xFE, 0xA5, 0xD2, 0xDE, 0x85,
+	 0x7F, 0x26, 0x02, 0x00, 0x00, 0xF4, 0x04, 0x65, 0x5D, 0x93, 0xA3, 0xDB, 0x5D, 0x93, 0xA5, 0xD2,
+	 0xF6, 0x1F, 0x5D, 0x93, 0x20, 0xFE, 0xDF, 0x83, 0x00, 0x60, 0x01, 0x61, 0x02, 0x60, 0x00, 0x64,
+	 0xE0, 0x87, 0x60, 0x46, 0x18, 0x60, 0x18, 0xF3, 0xFF, 0xFF, 0x60, 0x43, 0x60, 0xFE, 0xCD, 0x81,
+	 0x20, 0xFE, 0x2A, 0x44, 0x00, 0x60, 0x02, 0x65, 0x44, 0xD7, 0xFF, 0xFF, 0xFF, 0xFF, 0xDB, 0x60,
+	 0x5C, 0x78, 0xFF, 0xFF, 0x18, 0x60, 0x17, 0xF3, 0xFF, 0xFF, 0x08, 0x18, 0x18, 0x60, 0x19, 0xF3,
+	 0x18, 0x60, 0x1A, 0xF5, 0x60, 0x41, 0x30, 0x60, 0x2E, 0x62, 0xA2, 0xDF, 0x66, 0x5C, 0x26, 0x46,
+	 0x00, 0xF2, 0x64, 0x46, 0x58, 0x90, 0xFF, 0xFF, 0x03, 0x02, 0x61, 0x44, 0x0B, 0xA5, 0x04, 0x00,
+	 0x61, 0x44, 0xFC, 0xA4, 0x8B, 0x7C, 0xC0, 0x85, 0xDD, 0x81, 0x66, 0x44, 0x18, 0x60, 0x1A, 0xFB,
+	 0x26, 0x46, 0x1B, 0xF0, 0x18, 0x60, 0x1A, 0xF5, 0x64, 0x44, 0xD4, 0x80, 0xFF, 0xFF, 0xD7, 0x06,
+	 0x2D, 0x58, 0xFF, 0xFF, 0x60, 0xFE, 0x5D, 0xD2, 0xFF, 0xFF, 0x20, 0xFE, 0xFF, 0xB4, 0x41, 0x94,
+	 0x81, 0xA0, 0xFF, 0xFF, 0x02, 0x04, 0x00, 0xF4, 0x84, 0xA4, 0x60, 0x41, 0x62, 0x01, 0x60, 0xFE,
+	 0x5D, 0xD2, 0xFF, 0xFF, 0xFA, 0xA4, 0xFF, 0xFF, 0x04, 0x20, 0x02, 0x00, 0xFF, 0xA1, 0x61, 0x01,
+	 0x5D, 0xD0, 0xFF, 0xFF, 0x64, 0x40, 0x00, 0x36, 0x02, 0x00, 0xC9, 0x81, 0x5A, 0x01, 0x5D, 0xD0,
+	 0xFF, 0xFF, 0x64, 0x40, 0x50, 0x36, 0x02, 0x00, 0xFD, 0xA1, 0x53, 0x01, 0x5D, 0xD0, 0xFF, 0xFF,
+	 0x64, 0x40, 0xF2, 0x36, 0x04, 0x00, 0xFC, 0xA1, 0xDA, 0x60, 0x01, 0x78, 0xFF, 0xFF, 0x5D, 0xD0,
+	 0xFF, 0xFF, 0x64, 0x40, 0x01, 0x36, 0x04, 0x00, 0xFB, 0xA1, 0xDA, 0x60, 0x01, 0x78, 0xFF, 0xFF,
+	 0x5D, 0xD0, 0xFF, 0xFF, 0x64, 0x40, 0x01, 0x36, 0x04, 0x00, 0xFA, 0xA1, 0xDA, 0x60, 0x01, 0x78,
+	 0xFF, 0xFF, 0x5D, 0xD0, 0xFF, 0xFF, 0x64, 0x40, 0x00, 0x36, 0x04, 0x00, 0xF9, 0xA1, 0xDA, 0x60,
+	 0x01, 0x78, 0xFF, 0xFF, 0x60, 0x5C, 0x00, 0x36, 0x2A, 0x00, 0x00, 0x64, 0xDB, 0x60, 0x58, 0x4E,
+	 0x16, 0x78, 0xFF, 0xFF, 0x16, 0x60, 0x5A, 0xFB, 0x64, 0x40, 0x00, 0x36, 0x25, 0x00, 0x5D, 0xD2,
+	 0xDD, 0x81, 0xDB, 0x60, 0x58, 0x4E, 0x16, 0x78, 0xFF, 0xFF, 0x16, 0x60, 0x5B, 0xFB, 0x64, 0x40,
+	 0x00, 0x36, 0x1F, 0x00, 0x5D, 0xD2, 0xDD, 0x81, 0xDB, 0x60, 0x58, 0x4E, 0x16, 0x78, 0xFF, 0xFF,
+	 0x16, 0x60, 0x5C, 0xFB, 0x64, 0x40, 0x00, 0x36, 0x19, 0x00, 0x5D, 0xD0, 0x16, 0x60, 0x5D, 0xF9,
+	 0x5D, 0xD0, 0x2C, 0x60, 0xBB, 0x62, 0xA2, 0xD9, 0xD9, 0x60, 0xF9, 0x78, 0xFF, 0xFF, 0x20, 0xFE,
+	 0x00, 0x60, 0x04, 0x64, 0x16, 0x60, 0x5A, 0xFB, 0x20, 0xFE, 0x00, 0x60, 0x04, 0x64, 0x16, 0x60,
+	 0x5B, 0xFB, 0x20, 0xFE, 0x00, 0x60, 0x02, 0x64, 0x16, 0x60, 0x5C, 0xFB, 0x20, 0xFE, 0x00, 0x60,
+	 0x00, 0x64, 0x16, 0x60, 0x5D, 0xFB, 0xD9, 0x60, 0xF9, 0x78, 0xFF, 0xFF, 0x16, 0x60, 0x5E, 0xFB,
+	 0xE0, 0x84, 0xE0, 0x84, 0x03, 0x02, 0x01, 0x64, 0xA2, 0xDB, 0x02, 0x64, 0x02, 0xA5, 0x64, 0x44,
+	 0xD4, 0x9C, 0x16, 0x60, 0x5F, 0xF9, 0x2C, 0x60, 0xC0, 0x62, 0xA2, 0xDF, 0x5D, 0xD0, 0x00, 0x65,
+	 0x64, 0x40, 0x00, 0x3A, 0x01, 0x65, 0x5D, 0xD0, 0xFF, 0xFF, 0x64, 0x40, 0x50, 0x3A, 0x01, 0x65,
+	 0x5D, 0xD0, 0xFF, 0xFF, 0x64, 0x40, 0xF2, 0x3A, 0x01, 0x65, 0x5D, 0xD0, 0x65, 0x40, 0x00, 0x3A,
+	 0x17, 0x00, 0x00, 0x60, 0x00, 0x65, 0x64, 0x40, 0x00, 0x36, 0x01, 0x65, 0x64, 0x40, 0x01, 0x36,
+	 0x02, 0x65, 0x64, 0x40, 0x02, 0x36, 0x04, 0x65, 0x64, 0x40, 0x04, 0x36, 0x10, 0x65, 0x64, 0x40,
+	 0x05, 0x36, 0x20, 0x65, 0x65, 0x5C, 0x16, 0x60, 0x60, 0xF3, 0xFF, 0xFF, 0xB0, 0x84, 0xA2, 0xDB,
+	 0x16, 0x60, 0x5E, 0xF3, 0xFF, 0xFF, 0xFF, 0xA4, 0xA2, 0xDB, 0xD0, 0x02, 0x16, 0x60, 0x60, 0xF3,
+	 0x16, 0x60, 0x5F, 0xF1, 0x2E, 0x58, 0xFF, 0xFF, 0x20, 0xFE, 0x16, 0x60, 0x50, 0xF1, 0x16, 0x60,
+	 0x5A, 0xF3, 0xFF, 0xFF, 0xA0, 0x84, 0xFF, 0xFF, 0x10, 0x26, 0x09, 0x00, 0x04, 0x26, 0x09, 0x00,
+	 0x20, 0x26, 0x09, 0x00, 0x02, 0x26, 0x09, 0x00, 0xD9, 0x60, 0xC3, 0x78, 0xFF, 0xFF, 0x10, 0x7C,
+	 0x05, 0x00, 0x04, 0x7C, 0x03, 0x00, 0x20, 0x7C, 0x01, 0x00, 0x02, 0x7C, 0x16, 0x60, 0x56, 0xF9,
+	 0x16, 0x60, 0x51, 0xF1, 0x16, 0x60, 0x5B, 0xF3, 0x2C, 0x60, 0xAC, 0x62, 0xA0, 0x84, 0xA2, 0xD1,
+	 0xFF, 0xFF, 0x10, 0x26, 0x07, 0x00, 0x04, 0x26, 0x07, 0x00, 0x01, 0x26, 0x0D, 0x00, 0xD9, 0x60,
+	 0xC3, 0x78, 0xFF, 0xFF, 0x10, 0x7C, 0x09, 0x00, 0x64, 0x40, 0x10, 0x22, 0x03, 0x00, 0xD9, 0x60,
+	 0xC3, 0x78, 0xFF, 0xFF, 0x04, 0x7C, 0x01, 0x00, 0x01, 0x7C, 0x16, 0x60, 0x57, 0xF9, 0x16, 0x60,
+	 0x52, 0xF1, 0x16, 0x60, 0x5C, 0xF3, 0xFF, 0xFF, 0xA0, 0x84, 0x02, 0x26, 0x07, 0x00, 0x04, 0x26,
+	 0x07, 0x00, 0x01, 0x26, 0x07, 0x00, 0xD9, 0x60, 0xC3, 0x78, 0xFF, 0xFF, 0x02, 0x7C, 0x03, 0x00,
+	 0x04, 0x7C, 0x01, 0x00, 0x20, 0x7C, 0x16, 0x60, 0x58, 0xF9, 0x16, 0x60, 0x5D, 0xF1, 0x16, 0x60,
+	 0x59, 0xF9, 0x16, 0x60, 0x58, 0xF3, 0x16, 0x60, 0x57, 0xF1, 0x60, 0x47, 0xB0, 0x84, 0x13, 0x60,
+	 0x45, 0xF1, 0xFF, 0xFF, 0x64, 0x40, 0x01, 0x36, 0x22, 0xBC, 0xAB, 0x46, 0x3A, 0xFA, 0xAB, 0x46,
+	 0x16, 0x60, 0x56, 0xF3, 0x13, 0x60, 0x45, 0xF1, 0xFF, 0xFF, 0x64, 0x40, 0x01, 0x36, 0x22, 0xBC,
+	 0x87, 0xF1, 0x66, 0x41, 0x64, 0x46, 0x3A, 0xFA, 0xFF, 0xFF, 0x61, 0x46, 0xAB, 0x46, 0x82, 0xF0,
+	 0xC0, 0x67, 0xB4, 0x84, 0xAB, 0x46, 0x0B, 0xFA, 0x13, 0x60, 0x4D, 0xF1, 0x2D, 0x60, 0xBE, 0x7C,
+	 0x04, 0x1B, 0xFF, 0x60, 0xFF, 0x63, 0xA4, 0xDD, 0x26, 0x00, 0x2E, 0x60, 0x34, 0x63, 0xA4, 0xDD,
+	 0xDB, 0x83, 0x60, 0xFE, 0x00, 0x64, 0xBD, 0xDB, 0x60, 0x64, 0xBD, 0xDB, 0x1D, 0x64, 0xBD, 0xDB,
+	 0xC3, 0xF3, 0xBD, 0xDB, 0x20, 0xFE, 0x01, 0x60, 0x78, 0x64, 0x06, 0x61, 0x58, 0xD1, 0xFF, 0xFF,
+	 0x60, 0xFE, 0xBD, 0xD9, 0x20, 0xFE, 0xCD, 0x81, 0x61, 0x40, 0x08, 0x28, 0xF7, 0x01, 0xB6, 0xF1,
+	 0xFF, 0xFF, 0x64, 0x47, 0x60, 0xFE, 0xBD, 0xD9, 0xBD, 0xDB, 0x20, 0xFE, 0x13, 0x60, 0x4B, 0xF1,
+	 0x60, 0xFE, 0xBD, 0xD9, 0x20, 0xFE, 0x2D, 0x60, 0xBC, 0x64, 0x40, 0x48, 0x18, 0x61, 0x26, 0x46,
+	 0x00, 0xF4, 0xFF, 0x60, 0xF2, 0x64, 0xE4, 0x60, 0x58, 0x4D, 0xA7, 0x78, 0xFF, 0xFF, 0x26, 0x46,
+	 0x3F, 0xFC, 0x2B, 0x46, 0x56, 0xF1, 0x1F, 0xF8, 0x0C, 0x60, 0x70, 0xF1, 0x10, 0x60, 0x00, 0x64,
+	 0xA0, 0x80, 0x06, 0xF2, 0x0B, 0x03, 0x10, 0xBC, 0x06, 0xFA, 0x86, 0xF3, 0x00, 0x60, 0x70, 0xF3,
+	 0x60, 0x45, 0xD4, 0x80, 0xDC, 0x84, 0x07, 0x07, 0xA2, 0xDB, 0x05, 0x00, 0x10, 0xB5, 0xFF, 0xFF,
+	 0x02, 0x03, 0xD4, 0x84, 0x06, 0xFA, 0x07, 0xF2, 0x66, 0x45, 0x60, 0x46, 0x06, 0xF2, 0x65, 0x46,
+	 0x02, 0xB0, 0xFF, 0xFF, 0x11, 0x03, 0x26, 0x46, 0x87, 0xF3, 0x07, 0xFA, 0x1E, 0x60, 0xD4, 0x64,
+	 0x0F, 0x60, 0x90, 0xFB, 0x26, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF,
+	 0xC1, 0xFE, 0x00, 0x66, 0x46, 0x46, 0x50, 0x00, 0x26, 0x46, 0x87, 0xF3, 0x07, 0xFA, 0x1E, 0x60,
+	 0xD4, 0x64, 0x0F, 0x60, 0x90, 0xFB, 0x26, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF,
+	 0x2B, 0xFF, 0xC1, 0xFE, 0x00, 0x66, 0x46, 0x46, 0x19, 0x00, 0x00, 0x60, 0xC0, 0x64, 0x2A, 0xFA,
+	 0x02, 0x64, 0x3F, 0xFA, 0x87, 0xF3, 0x07, 0xFA, 0x00, 0xF4, 0x09, 0x64, 0x09, 0xFA, 0x1E, 0x60,
+	 0xD4, 0x64, 0x0F, 0x60, 0x90, 0xFB, 0x26, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF,
+	 0x2B, 0xFF, 0xC1, 0xFE, 0x00, 0x66, 0x46, 0x46, 0x2F, 0x58, 0xFF, 0xFF, 0x2B, 0x43, 0x0B, 0x60,
+	 0x82, 0xF3, 0xDA, 0x81, 0x60, 0x45, 0xD5, 0x80, 0xA1, 0xD1, 0x11, 0x03, 0xD3, 0x80, 0xD9, 0x81,
+	 0xFA, 0x02, 0xC9, 0x81, 0xC8, 0x85, 0xD5, 0x80, 0xA5, 0xD3, 0x08, 0x28, 0xA1, 0xDB, 0x17, 0x60,
+	 0x04, 0x62, 0x65, 0x44, 0xA2, 0xDB, 0x4A, 0xD3, 0xFF, 0xFF, 0xCC, 0x84, 0xA2, 0xDB, 0xAB, 0x46,
+	 0x06, 0xF2, 0xFF, 0xFF, 0x02, 0xBC, 0x06, 0xFA, 0x78, 0xF2, 0x15, 0x60, 0xDC, 0xF3, 0x60, 0x45,
+	 0xA4, 0x84, 0x15, 0x60, 0xDC, 0xFB, 0xAB, 0x46, 0xAB, 0x46, 0x0F, 0x60, 0xFF, 0x64, 0x02, 0xF0,
+	 0x71, 0xF1, 0xA0, 0x84, 0xD0, 0x80, 0x02, 0xFA, 0xAB, 0x46, 0x01, 0x06, 0x71, 0xFB, 0x27, 0x41,
+	 0x01, 0xB1, 0xFF, 0xFF, 0x08, 0x03, 0x2B, 0x46, 0x0B, 0x58, 0x01, 0x65, 0xE5, 0x60, 0x58, 0x4E,
+	 0x51, 0x78, 0xFF, 0xFF, 0x0A, 0x00, 0x2B, 0x46, 0x0B, 0x58, 0x18, 0x60, 0xD6, 0x64, 0x40, 0x59,
+	 0x02, 0x65, 0xE5, 0x60, 0x58, 0x4E, 0x51, 0x78, 0xFF, 0xFF, 0x00, 0x66, 0x46, 0x46, 0x2F, 0x58,
+	 0xFF, 0xFF, 0x26, 0x46, 0x00, 0xF4, 0x00, 0x64, 0x09, 0xFA, 0x0B, 0xFA, 0x01, 0x7E, 0x0C, 0xFA,
+	 0x0A, 0x64, 0x0A, 0xFA, 0x26, 0x46, 0x08, 0x64, 0x3F, 0xFA, 0x07, 0xF2, 0x87, 0xF1, 0x40, 0x58,
+	 0x07, 0xF8, 0x1E, 0x60, 0xD4, 0x64, 0x0F, 0x60, 0x90, 0xFB, 0x26, 0x44, 0x5A, 0xDB, 0x02, 0x64,
+	 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xC1, 0xFE, 0xFF, 0x60, 0xFD, 0x65, 0x38, 0x46, 0x06, 0xF2,
+	 0xFF, 0xFF, 0xA4, 0x83, 0x06, 0xFC, 0x02, 0xB0, 0x26, 0x46, 0x1C, 0x03, 0x38, 0x43, 0x86, 0xF1,
+	 0x17, 0x60, 0x02, 0x61, 0xA1, 0xD3, 0xDA, 0x81, 0xD0, 0x80, 0xDC, 0x9C, 0x05, 0x05, 0xA1, 0xD3,
+	 0x4A, 0xD9, 0xA0, 0xDD, 0xDA, 0x9C, 0xA1, 0xD9, 0x02, 0x60, 0x00, 0x61, 0x2C, 0xF2, 0xA1, 0xDB,
+	 0x2D, 0xF2, 0x41, 0x58, 0x59, 0xDB, 0x2E, 0xF2, 0x59, 0xDB, 0x03, 0x65, 0xE5, 0x60, 0x58, 0x4E,
+	 0x51, 0x78, 0xFF, 0xFF, 0x00, 0x66, 0x46, 0x46, 0x2F, 0x58, 0xFF, 0xFF, 0x07, 0xF2, 0x87, 0xF1,
+	 0xFF, 0xFF, 0xD0, 0x80, 0xFF, 0xFF, 0x02, 0x02, 0x2F, 0x58, 0xFF, 0xFF, 0x40, 0x47, 0x07, 0xF2,
+	 0x66, 0x45, 0x60, 0x46, 0x06, 0xF2, 0x65, 0x46, 0x02, 0xB0, 0xFF, 0xFF, 0x1A, 0x02, 0x27, 0x43,
+	 0x0B, 0x60, 0x82, 0xF3, 0xDA, 0x81, 0x60, 0x45, 0xD5, 0x80, 0xA1, 0xD1, 0x11, 0x03, 0xD3, 0x80,
+	 0xD9, 0x81, 0xFA, 0x02, 0xC9, 0x81, 0xC8, 0x85, 0xD5, 0x80, 0xA5, 0xD3, 0x08, 0x28, 0xA1, 0xDB,
+	 0x17, 0x60, 0x04, 0x62, 0x65, 0x44, 0xA2, 0xDB, 0x4A, 0xD3, 0xFF, 0xFF, 0xCC, 0x84, 0xA2, 0xDB,
+	 0x0C, 0x00, 0x27, 0x44, 0x40, 0x58, 0x03, 0x65, 0xE5, 0x60, 0x58, 0x4E, 0x51, 0x78, 0xFF, 0xFF,
+	 0x27, 0x43, 0xE7, 0x60, 0x58, 0x4E, 0x81, 0x78, 0xFF, 0xFF, 0x26, 0x46, 0x87, 0xF4, 0x66, 0x41,
+	 0x63, 0x46, 0x05, 0xF2, 0x00, 0xF0, 0x81, 0xF0, 0x02, 0x18, 0x64, 0x46, 0x81, 0xF8, 0x07, 0x1B,
+	 0x15, 0x60, 0x02, 0x65, 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD9, 0x02, 0x00, 0x65, 0x46,
+	 0x00, 0xF8, 0x87, 0xF3, 0x63, 0x45, 0x60, 0x46, 0x00, 0xF2, 0xFF, 0xFF, 0xD4, 0x80, 0x01, 0x18,
+	 0xFA, 0x04, 0x80, 0xF8, 0x65, 0x46, 0x00, 0xFA, 0x06, 0xF2, 0xFF, 0xFF, 0x00, 0x7E, 0x06, 0xFA,
+	 0x61, 0x46, 0x2F, 0x58, 0xFF, 0xFF, 0x07, 0xF2, 0x87, 0xF1, 0xFF, 0xFF, 0xD0, 0x80, 0xFF, 0xFF,
+	 0x02, 0x02, 0x2F, 0x58, 0xFF, 0xFF, 0x40, 0x47, 0x07, 0xF2, 0x66, 0x45, 0x60, 0x46, 0x06, 0xF2,
+	 0x65, 0x46, 0x02, 0xB0, 0xFF, 0xFF, 0x02, 0x02, 0x2F, 0x58, 0xFF, 0xFF, 0x27, 0x46, 0x06, 0xF0,
+	 0xFF, 0x60, 0xED, 0x64, 0xA0, 0x84, 0x06, 0xFA, 0x27, 0x43, 0x86, 0xF1, 0x17, 0x60, 0x02, 0x61,
+	 0xA1, 0xD3, 0xDA, 0x81, 0xD0, 0x80, 0xDC, 0x9C, 0x05, 0x05, 0xA1, 0xD3, 0x4A, 0xD9, 0xA0, 0xDD,
+	 0xDA, 0x9C, 0xA1, 0xD9, 0x07, 0x58, 0x03, 0x65, 0xE5, 0x60, 0x58, 0x4E, 0x51, 0x78, 0xFF, 0xFF,
+	 0x27, 0x43, 0xE7, 0x60, 0x58, 0x4E, 0x81, 0x78, 0xFF, 0xFF, 0x26, 0x46, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x26, 0x46, 0x2F, 0xF2, 0x2C, 0xFA, 0x30, 0xF2, 0x2D, 0xFA, 0x31, 0xF2, 0x2E, 0xFA, 0xCB, 0xF3,
+	 0x2F, 0xFA, 0xCC, 0xF3, 0x30, 0xFA, 0xCD, 0xF3, 0x31, 0xFA, 0x66, 0xF3, 0x32, 0xFA, 0x67, 0xF3,
+	 0x33, 0xFA, 0x68, 0xF3, 0x34, 0xFA, 0xAB, 0xF1, 0x19, 0xF8, 0x00, 0x65, 0xEF, 0x60, 0x58, 0x4E,
+	 0xDC, 0x78, 0xFF, 0xFF, 0x61, 0x44, 0x15, 0x60, 0xC2, 0xFB, 0x02, 0x63, 0x3F, 0xFC, 0x00, 0x64,
+	 0x3E, 0xFA, 0x02, 0x60, 0x00, 0x61, 0x2C, 0xF2, 0xA1, 0xDB, 0x2D, 0xF2, 0x41, 0x58, 0x59, 0xDB,
+	 0x2E, 0xF2, 0x59, 0xDB, 0x06, 0x63, 0x07, 0xF2, 0x87, 0xF1, 0xFF, 0xFF, 0xD0, 0x80, 0xFF, 0xFF,
+	 0x0D, 0x02, 0x43, 0x59, 0x02, 0x65, 0xE5, 0x60, 0x58, 0x4E, 0x27, 0x78, 0xFF, 0xFF, 0x26, 0x46,
+	 0xC0, 0x64, 0x2A, 0xFA, 0x00, 0xF4, 0x06, 0x64, 0x09, 0xFA, 0x15, 0x00, 0x07, 0xF2, 0x66, 0x45,
+	 0x60, 0x46, 0x06, 0xF2, 0x65, 0x46, 0x02, 0xB0, 0xFF, 0xFF, 0x1D, 0x02, 0x07, 0x63, 0x43, 0x59,
+	 0x01, 0x65, 0xE5, 0x60, 0x58, 0x4E, 0x27, 0x78, 0xFF, 0xFF, 0x26, 0x46, 0xA0, 0x64, 0x2A, 0xFA,
+	 0x00, 0xF4, 0x07, 0x64, 0x09, 0xFA, 0x26, 0x46, 0x87, 0xF3, 0x07, 0xFA, 0x1E, 0x60, 0xD4, 0x64,
+	 0x0F, 0x60, 0x90, 0xFB, 0x26, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF,
+	 0xC1, 0xFE, 0x00, 0x66, 0x46, 0x46, 0x2F, 0x58, 0xFF, 0xFF, 0xDE, 0x60, 0x66, 0x64, 0x08, 0x60,
+	 0x29, 0xFB, 0x2F, 0x58, 0xFF, 0xFF, 0x00, 0x60, 0x03, 0x64, 0x08, 0x60, 0x1F, 0xFB, 0xDE, 0x60,
+	 0x05, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x08, 0x60, 0x1E, 0xF1, 0x00, 0x60,
+	 0x02, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x59, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x71, 0xF3, 0x87, 0xF5,
+	 0xDC, 0x81, 0x66, 0x43, 0x02, 0xA3, 0x63, 0x46, 0xCD, 0x81, 0x06, 0xF2, 0xEE, 0x03, 0x60, 0x40,
+	 0x08, 0x2A, 0xF7, 0x01, 0x0C, 0xAC, 0x06, 0xFA, 0x46, 0x49, 0x00, 0x60, 0x02, 0x61, 0xB5, 0x60,
+	 0x58, 0x4D, 0xA2, 0x78, 0xFF, 0xFF, 0xE1, 0x03, 0x18, 0x60, 0x13, 0xF3, 0xFF, 0xFF, 0x03, 0x1B,
+	 0x00, 0x60, 0xA0, 0x64, 0x02, 0x00, 0x00, 0x60, 0xC0, 0x64, 0x2A, 0xFA, 0xAB, 0xFC, 0x66, 0x45,
+	 0x29, 0x44, 0x07, 0xFA, 0x29, 0x46, 0x03, 0xF2, 0x04, 0xF0, 0x85, 0xF2, 0x65, 0x46, 0x2C, 0xFA,
+	 0x2D, 0xF8, 0xAE, 0xFA, 0xCB, 0xF3, 0x2F, 0xFA, 0x32, 0xFA, 0xCC, 0xF3, 0x30, 0xFA, 0x33, 0xFA,
+	 0xCD, 0xF3, 0x31, 0xFA, 0x34, 0xFA, 0xAB, 0xF1, 0x19, 0xF8, 0x18, 0x67, 0x0E, 0xFA, 0x66, 0x41,
+	 0x29, 0x46, 0x92, 0xF0, 0x2C, 0x60, 0x26, 0x63, 0x47, 0xD3, 0x61, 0x46, 0x00, 0x7E, 0x13, 0xFA,
+	 0x02, 0x63, 0x3F, 0xFC, 0x00, 0x64, 0x3E, 0xFA, 0x66, 0x41, 0x00, 0xF4, 0x18, 0x60, 0x12, 0xF3,
+	 0x09, 0xFA, 0x1E, 0x60, 0xE0, 0x64, 0x0F, 0x60, 0x90, 0xFB, 0x61, 0x44, 0x5A, 0xDB, 0x02, 0x64,
+	 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xC8, 0xFE, 0xA0, 0x01, 0x95, 0x01, 0x00, 0x64, 0x08, 0x60,
+	 0x1E, 0xFB, 0x5A, 0xDB, 0x2F, 0x58, 0xFF, 0xFF, 0x07, 0xF0, 0xFF, 0xFF, 0x64, 0x43, 0x0B, 0x60,
+	 0x82, 0xF3, 0xDA, 0x81, 0x60, 0x45, 0xD5, 0x80, 0xA1, 0xD1, 0x04, 0x03, 0xD3, 0x80, 0xD9, 0x81,
+	 0xFA, 0x02, 0x08, 0x00, 0xA1, 0xDD, 0xD9, 0x84, 0x0B, 0x60, 0x82, 0xFB, 0x4A, 0xD3, 0xFF, 0xFF,
+	 0xDC, 0x84, 0xA2, 0xDB, 0x66, 0x45, 0x63, 0x46, 0x06, 0xF2, 0xFF, 0x60, 0x01, 0x7C, 0xA0, 0x9C,
+	 0x06, 0xF8, 0x65, 0x46, 0x70, 0xF3, 0x60, 0x40, 0x10, 0x2A, 0x03, 0x00, 0xCC, 0x84, 0x80, 0x2B,
+	 0x70, 0xFB, 0x08, 0x60, 0x1E, 0xF1, 0x00, 0x60, 0x02, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x10, 0x60, 0x30, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x00, 0x60, 0x02, 0x64,
+	 0x08, 0x60, 0x19, 0xFB, 0xDE, 0x60, 0xA8, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x70, 0xF3, 0x71, 0xF3, 0x00, 0xA8, 0x60, 0x88, 0x43, 0x03, 0xE0, 0x83, 0x5F, 0x03, 0xCB, 0x83,
+	 0x87, 0xF3, 0x72, 0xF1, 0x02, 0xA4, 0x40, 0x47, 0x64, 0x45, 0x27, 0x46, 0x76, 0xF4, 0x12, 0xF2,
+	 0x33, 0x18, 0xD4, 0x80, 0x02, 0x64, 0x30, 0x07, 0x23, 0xFA, 0x2A, 0xF2, 0x0E, 0xF2, 0x0C, 0xB0,
+	 0x02, 0xF0, 0x0C, 0x02, 0x1E, 0x60, 0xD4, 0x64, 0x0F, 0x60, 0x90, 0xFB, 0x66, 0x44, 0x5A, 0xDB,
+	 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xC1, 0xFE, 0xE7, 0x01, 0x60, 0x40, 0xF0, 0x37,
+	 0x08, 0x00, 0x09, 0x60, 0x08, 0x64, 0xD0, 0x80, 0xA2, 0xFF, 0x8F, 0xF3, 0x02, 0x02, 0xDC, 0x84,
+	 0x8F, 0xFB, 0x1E, 0x60, 0xF2, 0x64, 0x0F, 0x60, 0x90, 0xFB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64,
+	 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xA3, 0xFF, 0xCE, 0xFE, 0x25, 0x60, 0xE4, 0x64, 0xE5, 0x60,
+	 0x78, 0x41, 0xC7, 0x78, 0x97, 0xF1, 0xC9, 0x01, 0x27, 0x44, 0x02, 0xA4, 0x40, 0x47, 0xC5, 0x1F,
+	 0x28, 0x43, 0xCB, 0x83, 0x87, 0xF3, 0x1A, 0x0E, 0x02, 0xA4, 0x40, 0x4C, 0x43, 0x48, 0x2C, 0x46,
+	 0x22, 0xF2, 0x72, 0xF1, 0xAC, 0x86, 0x12, 0xF2, 0x0C, 0x03, 0xD0, 0x80, 0xFF, 0xFF, 0x09, 0x07,
+	 0x1F, 0x60, 0x20, 0x64, 0x40, 0x4B, 0xF6, 0x60, 0x58, 0x4D, 0xB3, 0x78, 0xFF, 0xFF, 0x2C, 0x46,
+	 0xA2, 0xFC, 0x2C, 0x44, 0x02, 0xA4, 0x28, 0x43, 0x40, 0x4C, 0xE8, 0x1F, 0x8B, 0x01, 0x01, 0x63,
+	 0x65, 0xF3, 0xAB, 0xF3, 0x00, 0xBD, 0xAC, 0x81, 0x06, 0x03, 0x05, 0x03, 0xB7, 0x60, 0x58, 0x4D,
+	 0xC0, 0x78, 0xFF, 0xFF, 0x60, 0x43, 0x5B, 0xFD, 0x3E, 0x63, 0x18, 0x60, 0x94, 0x61, 0x00, 0x64,
+	 0x59, 0xDB, 0xFE, 0x1F, 0x70, 0xFB, 0x71, 0xFB, 0x18, 0x60, 0xDC, 0x65, 0xA5, 0xDF, 0x5A, 0xDF,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60, 0x70, 0xF3, 0xFF, 0xFF, 0x00, 0xA8, 0x60, 0x46, 0x03, 0x02,
+	 0xCA, 0x60, 0x7E, 0x78, 0xFF, 0xFF, 0x07, 0xF0, 0x66, 0x45, 0x64, 0x46, 0x1F, 0xF2, 0x65, 0x46,
+	 0x64, 0x45, 0x5B, 0xF1, 0xE0, 0x84, 0x72, 0xF1, 0xC0, 0x84, 0xC0, 0x84, 0x12, 0xFA, 0x2C, 0xF2,
+	 0x70, 0xF3, 0x60, 0x40, 0x01, 0x2A, 0x34, 0x00, 0x00, 0xA8, 0x13, 0x60, 0x43, 0xF3, 0x36, 0x03,
+	 0x00, 0xA8, 0xFF, 0xFF, 0x33, 0x03, 0xE1, 0x60, 0x58, 0x4D, 0x04, 0x78, 0xFF, 0xFF, 0x25, 0x46,
+	 0x09, 0x60, 0x08, 0x61, 0xA2, 0xFF, 0x0E, 0xF2, 0x02, 0xF0, 0x60, 0x40, 0xF0, 0x37, 0x0D, 0x00,
+	 0x91, 0xF3, 0x8F, 0xF3, 0xDC, 0x83, 0xD1, 0x80, 0x91, 0xFD, 0x0C, 0x03, 0x8B, 0xF3, 0xCC, 0x83,
+	 0xD8, 0xA0, 0x8F, 0xFD, 0x07, 0x04, 0xD4, 0xFE, 0x05, 0x00, 0xD1, 0x80, 0x92, 0xF3, 0x02, 0x03,
+	 0xDC, 0x84, 0x92, 0xFB, 0x1E, 0x60, 0xDA, 0x64, 0x0F, 0x60, 0x90, 0xFB, 0x25, 0x44, 0x5A, 0xDB,
+	 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xA3, 0xFF, 0xDF, 0x60, 0x2A, 0x78, 0xFF, 0xFF,
+	 0x66, 0x41, 0x65, 0x46, 0x06, 0xF2, 0x61, 0x46, 0x60, 0x40, 0x10, 0x2A, 0x4B, 0x00, 0x80, 0x67,
+	 0xB4, 0x81, 0x61, 0x44, 0x0F, 0x60, 0x90, 0xFB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB,
+	 0xFF, 0xFF, 0x2B, 0xFF, 0xE1, 0x60, 0x58, 0x4D, 0x04, 0x78, 0xFF, 0xFF, 0x25, 0x46, 0x2A, 0xF2,
+	 0x09, 0x60, 0x08, 0x61, 0x0C, 0xB0, 0xA2, 0xFF, 0x17, 0x03, 0x0E, 0xF2, 0x02, 0xF0, 0x60, 0x40,
+	 0xF0, 0x37, 0x0D, 0x00, 0x8F, 0xF3, 0x91, 0xF3, 0xCC, 0x83, 0xD1, 0x80, 0x8F, 0xFD, 0x0C, 0x03,
+	 0x8B, 0xF3, 0xDC, 0x83, 0xD8, 0xA0, 0x91, 0xFD, 0x07, 0x04, 0xD4, 0xFE, 0x05, 0x00, 0xD1, 0x80,
+	 0x92, 0xF3, 0x02, 0x03, 0xDC, 0x84, 0x92, 0xFB, 0x07, 0xF0, 0x0A, 0xF2, 0xA3, 0xFF, 0x64, 0x45,
+	 0x2F, 0x1B, 0x66, 0x41, 0x65, 0x46, 0x02, 0xF0, 0x61, 0x46, 0x0F, 0x60, 0xFF, 0x61, 0xA1, 0x84,
+	 0x60, 0x41, 0xE9, 0x81, 0xE9, 0x81, 0xE9, 0x81, 0xE1, 0x82, 0x07, 0xB4, 0x01, 0x61, 0x03, 0x03,
+	 0xCC, 0x84, 0xE1, 0x81, 0xFD, 0x02, 0x18, 0x60, 0x96, 0x65, 0x46, 0xD1, 0x61, 0x44, 0xB0, 0x84,
+	 0xA2, 0xDB, 0x16, 0x00, 0x1E, 0x60, 0xD4, 0x61, 0x2A, 0xF2, 0x3E, 0xF2, 0x0C, 0xB0, 0x01, 0xB0,
+	 0x05, 0x03, 0x1E, 0x60, 0xE6, 0x61, 0x02, 0x02, 0x1E, 0x60, 0xCE, 0x61, 0x61, 0x44, 0x0F, 0x60,
+	 0x90, 0xFB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xC1, 0xFE,
+	 0xDF, 0x60, 0x2A, 0x78, 0xFF, 0xFF, 0x07, 0xF0, 0x2B, 0xF2, 0x2A, 0xF2, 0x60, 0x41, 0x44, 0x49,
+	 0x60, 0x45, 0xA4, 0x3A, 0x0D, 0x00, 0x61, 0x40, 0xC0, 0x3B, 0x79, 0x00, 0xA9, 0x46, 0x06, 0xF2,
+	 0xA9, 0x46, 0x60, 0x40, 0x20, 0x26, 0x73, 0x00, 0x20, 0xBC, 0xA9, 0x46, 0x06, 0xFA, 0xA9, 0x46,
+	 0xA9, 0x46, 0x06, 0xF0, 0xA9, 0x46, 0x65, 0x40, 0x10, 0x2B, 0x6C, 0x00, 0x64, 0x40, 0x10, 0x2A,
+	 0x35, 0x00, 0x65, 0x40, 0xA4, 0x3A, 0x63, 0x00, 0x29, 0x45, 0x65, 0x46, 0x76, 0xF2, 0xFF, 0xFF,
+	 0x00, 0xA8, 0x60, 0x46, 0x04, 0x02, 0x76, 0x00, 0xE0, 0x60, 0xEA, 0x78, 0xFF, 0xFF, 0x09, 0xF2,
+	 0x2A, 0xF0, 0x00, 0xA8, 0x20, 0x67, 0x02, 0x03, 0xB0, 0x84, 0x2A, 0xFA, 0x0E, 0xF2, 0x02, 0xF0,
+	 0x60, 0x40, 0xF0, 0x37, 0x08, 0x00, 0x09, 0x60, 0x08, 0x64, 0xD0, 0x80, 0xA2, 0xFF, 0x8F, 0xF3,
+	 0x02, 0x02, 0xDC, 0x84, 0x8F, 0xFB, 0x3E, 0xF2, 0xA3, 0xFF, 0x01, 0xB0, 0x1E, 0x60, 0xE6, 0x61,
+	 0x02, 0x02, 0x1E, 0x60, 0xD4, 0x61, 0x61, 0x44, 0x0F, 0x60, 0x90, 0xFB, 0x66, 0x44, 0x5A, 0xDB,
+	 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xC1, 0xFE, 0x16, 0x00, 0x10, 0x64, 0xB0, 0x84,
+	 0xDF, 0x65, 0xA4, 0x9E, 0xA9, 0x46, 0x06, 0xFA, 0xA9, 0x46, 0xA2, 0xFF, 0x04, 0x64, 0x0C, 0x60,
+	 0x6E, 0xFB, 0x29, 0x44, 0x5A, 0xDB, 0x70, 0xF3, 0xC1, 0xFE, 0xD4, 0xFE, 0x86, 0xF1, 0xA3, 0xFF,
+	 0xD0, 0x80, 0xDC, 0x84, 0x01, 0x07, 0x70, 0xFB, 0xA9, 0x46, 0x76, 0xF2, 0xA9, 0x46, 0x64, 0x18,
+	 0xA9, 0x46, 0x02, 0xF0, 0xA9, 0x46, 0x0F, 0x60, 0xFF, 0x61, 0xA1, 0x84, 0x60, 0x41, 0xE9, 0x81,
+	 0xE9, 0x81, 0xE9, 0x81, 0xE1, 0x82, 0x07, 0xB4, 0x01, 0x61, 0x03, 0x03, 0xCC, 0x84, 0xE1, 0x81,
+	 0xFD, 0x02, 0x18, 0x60, 0x96, 0x65, 0x46, 0xD1, 0xFF, 0xFF, 0xB1, 0x84, 0xA2, 0xDB, 0xE1, 0x60,
+	 0x01, 0x78, 0xFF, 0xFF, 0x64, 0x40, 0x10, 0x2A, 0xFA, 0x01, 0xFF, 0x60, 0xEF, 0x64, 0xA0, 0x84,
+	 0xA9, 0x46, 0x06, 0xFA, 0xA9, 0x46, 0x65, 0x41, 0x70, 0xF3, 0x29, 0x45, 0xCC, 0x84, 0x80, 0x2B,
+	 0x70, 0xFB, 0x65, 0x46, 0x76, 0xF2, 0xFF, 0xFF, 0x00, 0xA8, 0x60, 0x46, 0x36, 0x02, 0x61, 0x40,
+	 0xA4, 0x3A, 0xE5, 0x01, 0x00, 0x60, 0x3A, 0x61, 0xB5, 0x60, 0x58, 0x4D, 0x9F, 0x78, 0xFF, 0xFF,
+	 0x83, 0x03, 0x02, 0x60, 0x48, 0x64, 0x2A, 0xFA, 0xCB, 0xF1, 0x2F, 0xF8, 0xCC, 0xF1, 0x30, 0xF8,
+	 0xCD, 0xF1, 0x31, 0xF8, 0x66, 0xF1, 0x32, 0xF8, 0x67, 0xF1, 0x33, 0xF8, 0x68, 0xF1, 0x34, 0xF8,
+	 0xA9, 0x46, 0x03, 0xF2, 0x04, 0xF0, 0x85, 0xF0, 0xA9, 0x46, 0x2C, 0xFA, 0x2D, 0xF8, 0xAE, 0xF8,
+	 0xAB, 0xF1, 0x19, 0xF8, 0xFF, 0x67, 0x0E, 0xFA, 0x00, 0x64, 0x3E, 0xFA, 0x3F, 0xFA, 0x29, 0x44,
+	 0x07, 0xFA, 0x1E, 0x60, 0xD4, 0x64, 0x0F, 0x60, 0x90, 0xFB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64,
+	 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xC1, 0xFE, 0x35, 0x00, 0x80, 0x67, 0xB4, 0x83, 0x2A, 0xF2,
+	 0x09, 0x60, 0x08, 0x65, 0x0C, 0xB0, 0x09, 0xF0, 0x0C, 0x02, 0x1E, 0x60, 0xD4, 0x64, 0x0F, 0x60,
+	 0x90, 0xFB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0x9F, 0x18,
+	 0x64, 0x46, 0x3E, 0xF2, 0xA2, 0xFF, 0x01, 0xB0, 0x1E, 0x60, 0xE6, 0x61, 0x02, 0x02, 0x1E, 0x60,
+	 0xCE, 0x61, 0x02, 0xF2, 0x0E, 0xF0, 0xD4, 0x80, 0x09, 0xF4, 0x06, 0x02, 0x8F, 0xF3, 0x64, 0x40,
+	 0xF0, 0x37, 0x02, 0x00, 0xDC, 0x84, 0x8F, 0xFB, 0x66, 0x44, 0x00, 0xA8, 0xFF, 0xFF, 0xF1, 0x02,
+	 0x61, 0x44, 0x0F, 0x60, 0x90, 0xFB, 0x5A, 0xDD, 0x08, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF,
+	 0xC1, 0xFE, 0xA3, 0xFF, 0xA9, 0x46, 0x02, 0xF0, 0xA9, 0x46, 0x0F, 0x60, 0xFF, 0x61, 0xA1, 0x84,
+	 0x60, 0x41, 0xE9, 0x81, 0xE9, 0x81, 0xE9, 0x81, 0xE1, 0x82, 0x07, 0xB4, 0x01, 0x61, 0x03, 0x03,
+	 0xCC, 0x84, 0xE1, 0x81, 0xFD, 0x02, 0x18, 0x60, 0x96, 0x65, 0x46, 0xD3, 0x9D, 0x85, 0xA4, 0x84,
+	 0xA2, 0xDB, 0x26, 0x46, 0x2F, 0x58, 0xFF, 0xFF, 0x46, 0x45, 0x3F, 0xF2, 0x05, 0x48, 0x00, 0xA8,
+	 0x60, 0x41, 0x66, 0x44, 0x0B, 0x03, 0x0E, 0xA1, 0x00, 0xF2, 0x42, 0xFE, 0xAC, 0x86, 0x01, 0xF2,
+	 0x1F, 0x03, 0x7F, 0xB5, 0xD5, 0x81, 0x66, 0x44, 0xF7, 0x07, 0x25, 0x46, 0x05, 0xF0, 0x06, 0xFA,
+	 0x05, 0xFA, 0xD0, 0x80, 0x64, 0x43, 0x13, 0x03, 0x60, 0x46, 0x01, 0xF0, 0x80, 0x67, 0xB0, 0x84,
+	 0x01, 0xFA, 0x00, 0xF0, 0x00, 0x64, 0x00, 0xFA, 0x44, 0x45, 0xA2, 0xFF, 0xB6, 0x60, 0x58, 0x4E,
+	 0x72, 0x78, 0xFF, 0xFF, 0xA3, 0xFF, 0x08, 0x45, 0x25, 0x46, 0x01, 0x64, 0x02, 0xFA, 0x02, 0xFE,
+	 0x2D, 0x58, 0xFF, 0xFF, 0x23, 0xF2, 0x07, 0xF0, 0x10, 0xB0, 0x10, 0xAC, 0x3A, 0x03, 0x23, 0xFA,
+	 0x80, 0x67, 0xB0, 0x81, 0x61, 0x44, 0x0F, 0x60, 0x90, 0xFB, 0x66, 0x44, 0x5A, 0xDB, 0x04, 0x64,
+	 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0x46, 0x45, 0x64, 0x46, 0x02, 0xF0, 0x0F, 0x60, 0xFF, 0x61,
+	 0xA1, 0x84, 0x60, 0x41, 0xE9, 0x81, 0xE9, 0x81, 0xE9, 0x81, 0xE1, 0x82, 0x07, 0xB4, 0x01, 0x61,
+	 0x03, 0x03, 0xCC, 0x84, 0xE1, 0x81, 0xFD, 0x02, 0x18, 0x60, 0x96, 0x65, 0x46, 0xD1, 0xFF, 0xFF,
+	 0xB1, 0x84, 0xA2, 0xDB, 0x9F, 0xF2, 0x25, 0x46, 0xE1, 0x81, 0x5B, 0xF1, 0x72, 0xF1, 0xC1, 0x81,
+	 0xC1, 0x81, 0x92, 0xFA, 0xA2, 0xFF, 0x02, 0xF0, 0x09, 0x60, 0x08, 0x61, 0xD1, 0x80, 0x0E, 0xF2,
+	 0x05, 0x02, 0x8F, 0xF3, 0x20, 0xB0, 0xCC, 0x84, 0x01, 0x02, 0x8F, 0xFB, 0xA3, 0xFF, 0x48, 0xFE,
+	 0x07, 0x00, 0x0E, 0xF2, 0x08, 0xFE, 0xF0, 0x7F, 0x60, 0x40, 0x20, 0x2A, 0x00, 0x7F, 0x0E, 0xFA,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x00, 0x60, 0xC5, 0x61, 0xB5, 0x60, 0x58, 0x4D, 0xA2, 0x78, 0xFF, 0xFF,
+	 0x66, 0x44, 0x57, 0xFB, 0x04, 0x64, 0x03, 0xFA, 0x80, 0x64, 0x2A, 0xFA, 0xAB, 0xF1, 0x19, 0xF8,
+	 0x00, 0x64, 0x3E, 0xFA, 0x00, 0x60, 0x80, 0x64, 0x0E, 0xFA, 0x87, 0xF1, 0x07, 0xF8, 0x67, 0x44,
+	 0x2C, 0xFA, 0x2D, 0xFA, 0x2E, 0xFA, 0xE4, 0x60, 0x65, 0x64, 0x08, 0x60, 0x25, 0xFB, 0xE2, 0x60,
+	 0xA0, 0x64, 0x08, 0x60, 0x2B, 0xFB, 0x18, 0x60, 0xE6, 0x63, 0x65, 0x44, 0xBD, 0xDB, 0x10, 0x60,
+	 0x58, 0x64, 0xBD, 0xDB, 0x02, 0x64, 0xBD, 0xDB, 0x06, 0x64, 0xA3, 0xDB, 0xE9, 0x60, 0xB2, 0x78,
+	 0xFF, 0xFF, 0xE9, 0x60, 0x58, 0x4D, 0xBE, 0x78, 0xFF, 0xFF, 0x57, 0xF5, 0xCB, 0xF1, 0x2F, 0xF8,
+	 0xCC, 0xF1, 0x30, 0xF8, 0xCD, 0xF1, 0x31, 0xF8, 0x66, 0xF1, 0x32, 0xF8, 0x67, 0xF1, 0x33, 0xF8,
+	 0x68, 0xF1, 0x34, 0xF8, 0x13, 0x60, 0x45, 0xF1, 0x01, 0x64, 0x64, 0x40, 0xFE, 0x26, 0x10, 0xBC,
+	 0x32, 0x40, 0x10, 0x26, 0x10, 0xBC, 0x20, 0xBC, 0x04, 0x60, 0x00, 0x65, 0x60, 0x44, 0xB4, 0x84,
+	 0x17, 0x60, 0x22, 0xFB, 0x13, 0x60, 0x44, 0xF1, 0x26, 0x60, 0x16, 0x64, 0x02, 0x18, 0x26, 0x60,
+	 0x38, 0x64, 0x16, 0x60, 0xBF, 0xFB, 0x16, 0x60, 0xCF, 0xFB, 0x2C, 0x60, 0x84, 0x61, 0x13, 0x60,
+	 0x97, 0xF3, 0x2D, 0x60, 0x5E, 0x65, 0xFE, 0xA4, 0xE0, 0x84, 0x02, 0x05, 0x67, 0x44, 0x21, 0x00,
+	 0xE0, 0x84, 0xC4, 0x85, 0x16, 0x60, 0x55, 0xF3, 0xA5, 0xD1, 0xDA, 0x85, 0xA0, 0x83, 0x16, 0x60,
+	 0x51, 0xFD, 0xA5, 0xD1, 0x2C, 0x60, 0xA0, 0x62, 0xA0, 0x83, 0xA2, 0xDD, 0x2C, 0x60, 0x84, 0x61,
+	 0x50, 0x60, 0x00, 0x7C, 0x00, 0x60, 0xF2, 0x65, 0xE2, 0x60, 0x58, 0x4D, 0x06, 0x78, 0xFF, 0xFF,
+	 0x16, 0x60, 0x53, 0xF1, 0x59, 0xD9, 0x2C, 0x60, 0x7E, 0x65, 0xD5, 0x84, 0xDD, 0x7F, 0xA5, 0xDB,
+	 0x65, 0x44, 0x16, 0x60, 0xC4, 0xFB, 0x16, 0x60, 0xD4, 0xFB, 0x79, 0x00, 0x16, 0x60, 0x54, 0xF3,
+	 0x2C, 0x60, 0xA0, 0x62, 0xFD, 0xA0, 0xA2, 0xD3, 0xEE, 0x03, 0x60, 0x40, 0x02, 0x2A, 0x02, 0x00,
+	 0x01, 0x63, 0x0B, 0x00, 0x04, 0x2A, 0x02, 0x00, 0x02, 0x63, 0x07, 0x00, 0x10, 0x2A, 0x02, 0x00,
+	 0x04, 0x63, 0x03, 0x00, 0x20, 0x2A, 0x01, 0x00, 0x05, 0x63, 0x63, 0x47, 0xB4, 0x83, 0x59, 0xD9,
+	 0x59, 0xDD, 0x16, 0x60, 0x54, 0xF3, 0x16, 0x60, 0x51, 0xF3, 0xFE, 0xA0, 0x40, 0x4C, 0xD3, 0x03,
+	 0x00, 0x60, 0x00, 0x63, 0x59, 0xDD, 0x41, 0x4A, 0x2C, 0x40, 0x01, 0x2A, 0x05, 0x00, 0x00, 0x63,
+	 0x63, 0x47, 0xB4, 0x83, 0x59, 0xD9, 0x59, 0xDD, 0x2C, 0x40, 0x02, 0x2A, 0x03, 0x00, 0x01, 0x63,
+	 0x59, 0xD9, 0x59, 0xDD, 0x2C, 0x40, 0x04, 0x2A, 0x05, 0x00, 0x02, 0x63, 0x63, 0x47, 0xB4, 0x83,
+	 0x59, 0xD9, 0x59, 0xDD, 0x2C, 0x40, 0x10, 0x2A, 0x05, 0x00, 0x04, 0x63, 0x63, 0x47, 0xB4, 0x83,
+	 0x59, 0xD9, 0x59, 0xDD, 0x2C, 0x40, 0x20, 0x2A, 0x05, 0x00, 0x05, 0x63, 0x63, 0x47, 0xB4, 0x83,
+	 0x59, 0xD9, 0x59, 0xDD, 0x2A, 0x44, 0x51, 0x93, 0xEB, 0x83, 0xEB, 0x83, 0xA0, 0xDD, 0x16, 0x60,
+	 0x54, 0xF3, 0x16, 0x60, 0x52, 0xF3, 0xFF, 0xA0, 0x40, 0x4C, 0x9D, 0x03, 0x59, 0xDF, 0x41, 0x4A,
+	 0x2C, 0x40, 0x01, 0x2A, 0x05, 0x00, 0x00, 0x63, 0x63, 0x47, 0xB4, 0x83, 0x59, 0xD9, 0x59, 0xDD,
+	 0x2C, 0x40, 0x02, 0x2A, 0x05, 0x00, 0x01, 0x63, 0x63, 0x47, 0xB4, 0x83, 0x59, 0xD9, 0x59, 0xDD,
+	 0x2C, 0x40, 0x04, 0x2A, 0x05, 0x00, 0x02, 0x63, 0x63, 0x47, 0xB4, 0x83, 0x59, 0xD9, 0x59, 0xDD,
+	 0x2A, 0x44, 0x51, 0x93, 0xEB, 0x83, 0xEB, 0x83, 0xA0, 0xDD, 0x2D, 0x58, 0xFF, 0xFF, 0x57, 0xF5,
+	 0xCB, 0xF3, 0xCC, 0xF1, 0x00, 0x63, 0xC0, 0x87, 0xCD, 0xF1, 0x5A, 0xFD, 0xC0, 0x85, 0x65, 0x47,
+	 0xC4, 0x84, 0x07, 0xB5, 0x18, 0x60, 0xE2, 0x64, 0x0F, 0x60, 0xA5, 0xFB, 0x02, 0x64, 0x4A, 0xDB,
+	 0xFF, 0xFF, 0x04, 0xFF, 0x10, 0x60, 0x24, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x00, 0x60, 0x02, 0x64,
+	 0x08, 0x60, 0x13, 0xFB, 0xE2, 0x60, 0xA9, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x08, 0x60, 0x12, 0xF1, 0x00, 0x60, 0x02, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x2F, 0x58,
+	 0xFF, 0xFF, 0x10, 0x60, 0x24, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x57, 0xF5, 0x00, 0x64, 0x94, 0xFB,
+	 0x95, 0xFB, 0x96, 0xFB, 0x74, 0xFB, 0x65, 0xF3, 0x00, 0x75, 0x00, 0x72, 0xE0, 0x84, 0xE0, 0x84,
+	 0xE0, 0x93, 0xC7, 0xF3, 0xED, 0xE2, 0xCC, 0x84, 0x5A, 0xFB, 0x00, 0x60, 0x04, 0x64, 0x08, 0x60,
+	 0x13, 0xFB, 0xE2, 0x60, 0xC7, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x10, 0x60,
+	 0x24, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x64, 0xF1, 0xFF, 0xFF, 0x64, 0x40, 0x01, 0x2B, 0x05, 0x00,
+	 0x67, 0x44, 0x16, 0x60, 0xC1, 0xFB, 0x16, 0x60, 0xD1, 0xFB, 0x16, 0x60, 0xF6, 0xF9, 0x2D, 0x60,
+	 0x86, 0x65, 0xE4, 0x60, 0x58, 0x4D, 0xE7, 0x78, 0xFF, 0xFF, 0x64, 0xF3, 0xFF, 0xFF, 0x60, 0x40,
+	 0x01, 0x2B, 0x05, 0x00, 0xFF, 0x60, 0xFF, 0x63, 0x16, 0x60, 0xC5, 0xFD, 0x08, 0x00, 0x2E, 0x60,
+	 0x1E, 0x63, 0x16, 0x60, 0xC5, 0xFD, 0xE4, 0x60, 0x58, 0x4D, 0xFF, 0x78, 0xFF, 0xFF, 0xE4, 0x60,
+	 0x58, 0x4D, 0x6E, 0x78, 0xFF, 0xFF, 0xE5, 0x60, 0x58, 0x4D, 0x18, 0x78, 0xFF, 0xFF, 0x57, 0xF5,
+	 0x00, 0xF4, 0x65, 0xF1, 0x06, 0xF8, 0x17, 0x60, 0x22, 0xF3, 0x15, 0x60, 0xDD, 0xF1, 0xFB, 0x60,
+	 0xFF, 0x65, 0x60, 0x44, 0xA4, 0x84, 0x60, 0x47, 0x64, 0x40, 0x10, 0x26, 0x04, 0xBC, 0x60, 0x47,
+	 0x07, 0xFA, 0x2D, 0x60, 0x7E, 0x64, 0x40, 0x48, 0x10, 0x61, 0x00, 0x60, 0x00, 0x64, 0xE4, 0x60,
+	 0x58, 0x4D, 0xA7, 0x78, 0xFF, 0xFF, 0x57, 0xF5, 0x3F, 0xFC, 0x5A, 0xF3, 0xC7, 0xF1, 0xAC, 0x83,
+	 0x01, 0x64, 0x02, 0x02, 0x6B, 0xFB, 0x64, 0x43, 0x1E, 0x60, 0xD4, 0x64, 0x0F, 0x60, 0x90, 0xFB,
+	 0x66, 0x44, 0x5A, 0xDB, 0x04, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xC1, 0xFE, 0xCF, 0x83,
+	 0x72, 0xF3, 0x5A, 0xFD, 0xDC, 0x84, 0x72, 0xFB, 0x5C, 0xF3, 0xFF, 0xFF, 0xCC, 0x84, 0x5C, 0xFB,
+	 0x03, 0x03, 0xE3, 0x60, 0xBD, 0x78, 0xFF, 0xFF, 0x0A, 0x64, 0x5C, 0xFB, 0xA2, 0x4C, 0x20, 0x27,
+	 0xF8, 0x01, 0x46, 0x60, 0x50, 0x65, 0x72, 0x44, 0xD4, 0x80, 0xFF, 0xFF, 0xF2, 0x04, 0x5D, 0xFB,
+	 0x40, 0x48, 0x94, 0xF3, 0x5E, 0xFB, 0x40, 0x4A, 0x95, 0xF3, 0x96, 0xF3, 0x40, 0x4C, 0x60, 0x41,
+	 0x65, 0xF1, 0x40, 0x63, 0xAD, 0x80, 0xF0, 0xA3, 0x09, 0x02, 0x3C, 0x03, 0x2C, 0x41, 0x2A, 0x44,
+	 0x40, 0x4C, 0x28, 0x44, 0x40, 0x4A, 0x00, 0x64, 0x40, 0x48, 0xF4, 0x01, 0xD1, 0x80, 0x01, 0x02,
+	 0x31, 0x04, 0x10, 0xA3, 0x80, 0x60, 0x00, 0x65, 0xA5, 0x80, 0xCF, 0x83, 0x08, 0x02, 0x28, 0x44,
+	 0x60, 0x88, 0x2A, 0x44, 0x70, 0x8A, 0x2C, 0x44, 0x70, 0x8C, 0xF1, 0x81, 0xF5, 0x01, 0xE7, 0xA3,
+	 0x64, 0x44, 0x00, 0xA0, 0x00, 0x62, 0x02, 0x02, 0x00, 0x61, 0x1C, 0x00, 0xE0, 0x84, 0xDE, 0x82,
+	 0xFD, 0x04, 0x42, 0xFE, 0xF8, 0x84, 0x62, 0x45, 0xC7, 0x83, 0x60, 0x45, 0x02, 0xFE, 0xD5, 0x84,
+	 0x02, 0x05, 0x01, 0x05, 0x61, 0x44, 0xCF, 0x83, 0x60, 0x41, 0x08, 0x03, 0x28, 0x44, 0x60, 0x88,
+	 0x2A, 0x44, 0x70, 0x8A, 0x2C, 0x44, 0x70, 0x8C, 0xF1, 0x81, 0xF1, 0x01, 0xCE, 0x82, 0xE9, 0x81,
+	 0xFD, 0x02, 0xF1, 0x81, 0x61, 0x44, 0x00, 0xA8, 0xFF, 0xFF, 0x2F, 0x03, 0x73, 0x40, 0x5D, 0xF3,
+	 0xFF, 0xFF, 0x60, 0x47, 0xE8, 0x84, 0xE8, 0x84, 0x5E, 0xF3, 0x3F, 0xB5, 0xE0, 0x84, 0xE0, 0x84,
+	 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xB4, 0x84, 0x61, 0x45, 0xD4, 0x84, 0xC0, 0x84,
+	 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x81, 0x64, 0x44, 0x73, 0x45, 0xE0, 0x84, 0xE0, 0x84,
+	 0xE0, 0x84, 0xC4, 0x85, 0x61, 0x44, 0xD4, 0x80, 0xFF, 0xFF, 0x0F, 0x03, 0x60, 0x53, 0xD4, 0x84,
+	 0xFF, 0xFF, 0x74, 0xF3, 0xFF, 0xFF, 0xDC, 0x84, 0x01, 0xB4, 0x74, 0xFB, 0x13, 0x60, 0x06, 0xF3,
+	 0xFF, 0xFF, 0xDC, 0x84, 0x00, 0x36, 0x00, 0x3B, 0xA2, 0xDB, 0xE9, 0x60, 0xFB, 0x78, 0xFF, 0xFF,
+	 0xC1, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x04, 0x64, 0x03, 0xFA, 0x00, 0xF4, 0x09, 0xF2, 0xFF, 0xFF,
+	 0x60, 0x47, 0x00, 0x3A, 0x1C, 0x00, 0x60, 0x43, 0x00, 0x36, 0x1C, 0x00, 0xE0, 0xA0, 0xDA, 0x85,
+	 0x16, 0x07, 0x26, 0x60, 0x16, 0x61, 0xA1, 0xD1, 0xFF, 0xFF, 0xD3, 0x80, 0xCB, 0x83, 0x0F, 0x02,
+	 0x07, 0x0E, 0x59, 0xD3, 0xA5, 0xD0, 0xDA, 0x85, 0xD0, 0x80, 0xFF, 0xFF, 0x08, 0x02, 0xF9, 0x1F,
+	 0x12, 0x1E, 0xA5, 0xD0, 0x59, 0xD3, 0xFF, 0xFF, 0x90, 0x80, 0xFF, 0x22, 0x0C, 0x00, 0xE4, 0x60,
+	 0x63, 0x78, 0xFF, 0xFF, 0x13, 0x60, 0x44, 0xF3, 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x2A, 0x03, 0x00,
+	 0x26, 0x60, 0x38, 0x64, 0x02, 0x00, 0x26, 0x60, 0x16, 0x64, 0x16, 0x60, 0xCF, 0xFB, 0x26, 0x46,
+	 0x2F, 0xF2, 0x2C, 0xFA, 0x30, 0xF2, 0x2D, 0xFA, 0x31, 0xF2, 0x2E, 0xFA, 0xCB, 0xF1, 0x2F, 0xF8,
+	 0xCC, 0xF1, 0x30, 0xF8, 0xCD, 0xF1, 0x31, 0xF8, 0x66, 0xF1, 0x32, 0xF8, 0x67, 0xF1, 0x33, 0xF8,
+	 0x68, 0xF1, 0x34, 0xF8, 0x00, 0x65, 0xEF, 0x60, 0x58, 0x4E, 0xDC, 0x78, 0xFF, 0xFF, 0x61, 0x44,
+	 0x15, 0x60, 0xC2, 0xFB, 0x50, 0x63, 0x2A, 0xFC, 0xAB, 0xF3, 0x19, 0xFA, 0x00, 0x64, 0x3E, 0xFA,
+	 0x87, 0xF3, 0x07, 0xFA, 0x00, 0xF4, 0x65, 0xF1, 0x06, 0xF8, 0x17, 0x60, 0x22, 0xF3, 0x15, 0x60,
+	 0xDD, 0xF1, 0xFB, 0x60, 0xFF, 0xB7, 0x64, 0x40, 0x10, 0x26, 0x04, 0xBC, 0x60, 0x47, 0x07, 0xFA,
+	 0x2D, 0x60, 0xA6, 0x65, 0xE4, 0x60, 0x58, 0x4D, 0xE7, 0x78, 0xFF, 0xFF, 0x64, 0xF3, 0x2E, 0x60,
+	 0x1E, 0x63, 0x60, 0x40, 0x01, 0x27, 0x67, 0x43, 0x16, 0x60, 0xD5, 0xFD, 0x2D, 0x60, 0x9E, 0x64,
+	 0x40, 0x48, 0x10, 0x61, 0x00, 0x60, 0x00, 0x64, 0xE4, 0x60, 0x58, 0x4D, 0xA7, 0x78, 0xFF, 0xFF,
+	 0x26, 0x46, 0x3F, 0xFC, 0x1E, 0x60, 0xD4, 0x64, 0x0F, 0x60, 0x90, 0xFB, 0x26, 0x44, 0x5A, 0xDB,
+	 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xC1, 0xFE, 0x20, 0x44, 0x80, 0x26, 0x11, 0x00,
+	 0x80, 0xBC, 0x40, 0x40, 0x00, 0x64, 0x94, 0xFB, 0x95, 0xFB, 0x96, 0xFB, 0x74, 0xFB, 0x65, 0xF3,
+	 0x00, 0x75, 0x00, 0x72, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x93, 0xC7, 0xF3, 0xED, 0xE2, 0xCC, 0x84,
+	 0x5A, 0xFB, 0x00, 0x66, 0x46, 0x46, 0x2F, 0x58, 0xFF, 0xFF, 0x00, 0x64, 0x08, 0x60, 0x12, 0xFB,
+	 0x5A, 0xDB, 0x00, 0x64, 0x72, 0xFB, 0x74, 0xFB, 0x2F, 0x58, 0xFF, 0xFF, 0x3E, 0x63, 0x18, 0x60,
+	 0x94, 0x61, 0x59, 0xD1, 0x61, 0x46, 0x07, 0x1B, 0xFC, 0x1F, 0x2D, 0x60, 0xC8, 0x62, 0xA2, 0xDF,
+	 0x01, 0x65, 0x00, 0x61, 0x16, 0x00, 0x18, 0x60, 0xD6, 0x61, 0x49, 0xD1, 0xCB, 0x83, 0xFD, 0x18,
+	 0x63, 0x41, 0x04, 0xA1, 0x61, 0x45, 0x66, 0x43, 0x2D, 0x60, 0xC8, 0x64, 0xDC, 0x84, 0x60, 0xFE,
+	 0xBD, 0xD1, 0xA0, 0xD9, 0xCD, 0x81, 0x20, 0xFE, 0xF9, 0x02, 0x66, 0x44, 0x18, 0x60, 0x96, 0x7C,
+	 0xD0, 0x81, 0x5A, 0xF3, 0xC7, 0xF1, 0x2D, 0x60, 0xC6, 0x63, 0x00, 0xA0, 0x64, 0x5F, 0xBD, 0xDB,
+	 0x0F, 0x60, 0x6D, 0xF1, 0x02, 0x02, 0x01, 0x18, 0x01, 0xB9, 0x61, 0x44, 0x60, 0xFE, 0xA3, 0xDB,
+	 0xFC, 0xA3, 0x65, 0x44, 0x03, 0xA4, 0xA3, 0xDB, 0x20, 0xFE, 0x2D, 0x58, 0xFF, 0xFF, 0x17, 0x60,
+	 0x23, 0xFB, 0xCD, 0x81, 0x28, 0xD3, 0x5A, 0x88, 0xDC, 0x83, 0x31, 0x18, 0xFB, 0x03, 0x61, 0x40,
+	 0x7F, 0x3A, 0x06, 0x00, 0x17, 0x60, 0x23, 0xF3, 0x03, 0x61, 0x7C, 0xA4, 0xA2, 0xDB, 0x00, 0xF4,
+	 0x60, 0xFE, 0xA3, 0xD1, 0x5D, 0xD8, 0x61, 0x40, 0x7F, 0x3A, 0x08, 0x00, 0x20, 0xFE, 0x17, 0x60,
+	 0x23, 0xF3, 0x03, 0x61, 0x7C, 0xA4, 0xA2, 0xDB, 0x00, 0xF4, 0x60, 0xFE, 0xBF, 0xD3, 0x5D, 0xDA,
+	 0xFF, 0xB4, 0x00, 0x7F, 0x12, 0x03, 0xDF, 0x83, 0x61, 0x40, 0x7F, 0x3A, 0x0A, 0x00, 0x20, 0xFE,
+	 0x60, 0x45, 0x17, 0x60, 0x23, 0xF3, 0x03, 0x61, 0x7C, 0xA4, 0xA2, 0xDB, 0x65, 0x44, 0x00, 0xF4,
+	 0x60, 0xFE, 0xBD, 0xD1, 0xCC, 0x84, 0x5D, 0xD8, 0xEF, 0x02, 0x20, 0xFE, 0xCB, 0x01, 0x17, 0x60,
+	 0x23, 0xF1, 0xFD, 0xA1, 0xFF, 0xB1, 0xC1, 0x83, 0xA2, 0xDD, 0x2D, 0x58, 0xFF, 0xFF, 0x67, 0x5C,
+	 0x14, 0x60, 0x26, 0x61, 0xA1, 0xD3, 0xA5, 0xD9, 0x10, 0x18, 0x60, 0x43, 0x2D, 0x60, 0xEE, 0x64,
+	 0xA5, 0xDB, 0x60, 0xFE, 0xA0, 0xDD, 0x20, 0xFE, 0xDC, 0x84, 0xCF, 0x83, 0xE3, 0x83, 0x59, 0xD1,
+	 0xDC, 0x84, 0x60, 0xFE, 0xA0, 0xD9, 0x20, 0xFE, 0xFA, 0x1F, 0x2D, 0x58, 0xFF, 0xFF, 0x15, 0x60,
+	 0xDC, 0xF1, 0x15, 0x60, 0xDD, 0xF3, 0x64, 0x40, 0x01, 0x2A, 0x02, 0xBC, 0x64, 0x40, 0x02, 0x2A,
+	 0x04, 0xBC, 0x64, 0x40, 0x04, 0x2A, 0xEF, 0xB4, 0x15, 0x60, 0xDD, 0xFB, 0x07, 0xB4, 0x60, 0xFE,
+	 0x17, 0x60, 0x10, 0xFB, 0x20, 0xFE, 0x07, 0x7C, 0x15, 0x60, 0xDC, 0xF9, 0x2D, 0x58, 0xFF, 0xFF,
+	 0x20, 0x40, 0x20, 0x2A, 0x0A, 0x00, 0x0A, 0x60, 0x77, 0xF1, 0x50, 0xF3, 0x2E, 0x60, 0x31, 0x63,
+	 0x60, 0xFE, 0xBD, 0xD9, 0x60, 0x47, 0xA3, 0xDB, 0x20, 0xFE, 0x2D, 0x58, 0xFF, 0xFF, 0x0E, 0x57,
+	 0x32, 0x40, 0x40, 0x26, 0x24, 0x00, 0x45, 0x48, 0x00, 0x60, 0x10, 0x61, 0xB5, 0x60, 0x58, 0x4D,
+	 0x9F, 0x78, 0xFF, 0xFF, 0x1C, 0x03, 0xF2, 0x60, 0x02, 0x64, 0x24, 0xFA, 0x00, 0x60, 0x48, 0x61,
+	 0x28, 0x44, 0x59, 0xDA, 0x03, 0x64, 0x38, 0x43, 0xBD, 0xD1, 0xCC, 0x84, 0x59, 0xD8, 0xFC, 0x02,
+	 0x39, 0x44, 0x59, 0xDA, 0x06, 0x64, 0x23, 0xFA, 0x1F, 0x60, 0x10, 0x64, 0x0F, 0x60, 0x90, 0xFB,
+	 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xFA, 0xFE, 0x37, 0x58,
+	 0xFF, 0xFF, 0x0E, 0x57, 0x32, 0x40, 0x40, 0x26, 0x4F, 0x00, 0x45, 0x48, 0x00, 0x60, 0x68, 0x61,
+	 0xB5, 0x60, 0x58, 0x4D, 0x9F, 0x78, 0xFF, 0xFF, 0x47, 0x03, 0xF2, 0x60, 0x01, 0x64, 0x24, 0xFA,
+	 0x02, 0x60, 0x00, 0x61, 0x46, 0x4A, 0x38, 0x44, 0x54, 0x94, 0x03, 0x64, 0x01, 0x02, 0x09, 0x00,
+	 0x06, 0x63, 0x4A, 0x61, 0x38, 0x46, 0xBD, 0xD0, 0xCC, 0x84, 0x2A, 0x46, 0x59, 0xD8, 0xFA, 0x02,
+	 0x06, 0x00, 0xDA, 0x81, 0x38, 0x43, 0xBD, 0xD1, 0xCC, 0x84, 0x59, 0xD8, 0xFC, 0x02, 0x05, 0x63,
+	 0x28, 0x44, 0x02, 0xA8, 0x25, 0xFA, 0x07, 0x02, 0x03, 0x64, 0x39, 0x43, 0xBD, 0xD1, 0xCC, 0x84,
+	 0x59, 0xD8, 0xFC, 0x02, 0x08, 0x63, 0x28, 0x44, 0x03, 0xA8, 0x16, 0x60, 0x82, 0xF3, 0x0F, 0x03,
+	 0xE8, 0x85, 0xC7, 0x85, 0x60, 0x43, 0xFE, 0xA3, 0x2D, 0x60, 0x06, 0x64, 0x58, 0xD1, 0xD9, 0x81,
+	 0xA1, 0xD8, 0x7E, 0x2A, 0x02, 0x00, 0x00, 0xF4, 0x02, 0x61, 0xF8, 0x1F, 0x65, 0x43, 0x2A, 0x46,
+	 0x23, 0xFC, 0x1F, 0x60, 0x10, 0x64, 0x0F, 0x60, 0x90, 0xFB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64,
+	 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xFA, 0xFE, 0x37, 0x58, 0xFF, 0xFF, 0x0E, 0x57, 0x32, 0x40,
+	 0x40, 0x26, 0x1B, 0x00, 0x45, 0x48, 0x00, 0x60, 0x06, 0x61, 0xB5, 0x60, 0x58, 0x4D, 0x9F, 0x78,
+	 0xFF, 0xFF, 0x13, 0x03, 0x02, 0x64, 0x23, 0xFA, 0xF2, 0x60, 0x00, 0x64, 0x5A, 0xDA, 0x28, 0x44,
+	 0x5A, 0xDA, 0xFF, 0xFF, 0x1F, 0x60, 0x10, 0x64, 0x0F, 0x60, 0x90, 0xFB, 0x66, 0x44, 0x5A, 0xDB,
+	 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xFA, 0xFE, 0x37, 0x58, 0xFF, 0xFF, 0xA0, 0xD3,
+	 0xFF, 0xFF, 0xDC, 0x84, 0xDC, 0x80, 0xD0, 0x80, 0x03, 0x03, 0xA2, 0xDB, 0x08, 0x24, 0xC6, 0xFE,
+	 0xDD, 0x98, 0xFF, 0xFF, 0x97, 0xF1, 0xA0, 0xD3, 0xFF, 0xFF, 0xD8, 0x80, 0xC4, 0x84, 0x0C, 0x03,
+	 0x08, 0x05, 0xDC, 0x80, 0xD0, 0x80, 0x05, 0x03, 0xA2, 0xDB, 0x02, 0x24, 0xC6, 0xFE, 0xDD, 0x98,
+	 0xFF, 0xFF, 0xFF, 0x60, 0xFE, 0x64, 0xA2, 0xDB, 0xDD, 0x98, 0xFF, 0xFF, 0xA2, 0xFF, 0x32, 0x40,
+	 0x40, 0x26, 0x3C, 0x00, 0x7B, 0xF3, 0x67, 0x43, 0xDC, 0x84, 0xCC, 0x84, 0x37, 0x03, 0x60, 0x46,
+	 0x0A, 0x02, 0x7B, 0xFD, 0x00, 0x60, 0x46, 0x61, 0xB5, 0x60, 0x58, 0x4D, 0x9F, 0x78, 0xFF, 0xFF,
+	 0x66, 0x44, 0x7B, 0xFB, 0x2C, 0x03, 0x46, 0x4B, 0x25, 0x60, 0xD0, 0x61, 0x18, 0x64, 0x23, 0xFA,
+	 0xF1, 0x60, 0x00, 0x64, 0x24, 0xFA, 0x4A, 0x65, 0xA2, 0xFF, 0x2C, 0x63, 0x59, 0xD1, 0xA2, 0xDF,
+	 0xA5, 0xD8, 0xDA, 0x85, 0x80, 0x3A, 0x02, 0x00, 0x00, 0xF4, 0x04, 0x65, 0xF7, 0x1F, 0x12, 0x63,
+	 0x59, 0xD1, 0xA5, 0xD8, 0xDA, 0x85, 0x80, 0x3A, 0x02, 0x00, 0x00, 0xF4, 0x04, 0x65, 0xF8, 0x1F,
+	 0x1F, 0x60, 0x10, 0x64, 0x0F, 0x60, 0x90, 0xFB, 0x2B, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB,
+	 0xFF, 0xFF, 0x2B, 0xFF, 0xFA, 0xFE, 0xA6, 0xFE, 0x00, 0x64, 0x7B, 0xFB, 0xA3, 0xFF, 0xCA, 0x60,
+	 0x7E, 0x78, 0xFF, 0xFF, 0xA6, 0xFE, 0xBA, 0x05, 0xA7, 0xFE, 0x0A, 0x05, 0xA5, 0xFE, 0x03, 0x04,
+	 0xE6, 0x60, 0x8E, 0x78, 0xFF, 0xFF, 0xA4, 0xFE, 0xF2, 0x04, 0xE7, 0x60, 0x1F, 0x78, 0xFF, 0xFF,
+	 0x36, 0x45, 0x19, 0x60, 0x86, 0x64, 0x44, 0xD7, 0xFF, 0xFF, 0xFF, 0xFF, 0x28, 0xF3, 0x7D, 0xF1,
+	 0x60, 0x47, 0x07, 0xB4, 0x4E, 0xFB, 0x01, 0x61, 0x03, 0x03, 0xCC, 0x84, 0xE1, 0x81, 0xFD, 0x02,
+	 0x9D, 0x84, 0xA1, 0x80, 0xA0, 0x83, 0x15, 0x03, 0x7D, 0xFD, 0x08, 0x60, 0x24, 0xF1, 0x00, 0x60,
+	 0x02, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x31, 0x44, 0xDE, 0xB4, 0x40, 0x51, 0x01, 0x7C,
+	 0xBC, 0xF9, 0x49, 0xF3, 0x01, 0x63, 0x60, 0x40, 0xFF, 0x26, 0x49, 0xFD, 0xCA, 0x60, 0x7E, 0x78,
+	 0xFF, 0xFF, 0xE6, 0x60, 0x8E, 0x78, 0xFF, 0xFF, 0x26, 0x60, 0xB0, 0x63, 0xBD, 0xD3, 0xBD, 0xD1,
+	 0xBD, 0xD1, 0xB0, 0x84, 0xB0, 0x84, 0xFF, 0xFF, 0x07, 0x02, 0x6A, 0xFB, 0x31, 0x44, 0xFE, 0xB4,
+	 0x40, 0x51, 0x0D, 0x64, 0x05, 0xFB, 0x1A, 0x00, 0x28, 0xF3, 0xFF, 0xFF, 0x13, 0x60, 0x52, 0xF3,
+	 0xC5, 0xFB, 0x64, 0xFB, 0x0F, 0x60, 0x85, 0xF3, 0xFF, 0xFF, 0x00, 0xA8, 0x60, 0x46, 0x46, 0x5E,
+	 0x31, 0x44, 0x21, 0xBC, 0x40, 0x51, 0xED, 0xE2, 0x0F, 0x4E, 0xD0, 0x60, 0x58, 0x4F, 0xA8, 0x78,
+	 0xFF, 0xFF, 0x0E, 0x4F, 0x00, 0x00, 0xE8, 0x60, 0x74, 0x78, 0xFF, 0xFF, 0xD7, 0xFE, 0xCA, 0x60,
+	 0x7E, 0x78, 0xFF, 0xFF, 0x2E, 0xF5, 0x27, 0xF2, 0x15, 0x60, 0x02, 0x65, 0x60, 0x47, 0x00, 0x7F,
+	 0xE0, 0x84, 0x44, 0xD3, 0x66, 0x41, 0x60, 0x46, 0x60, 0x43, 0x05, 0xF2, 0x16, 0x18, 0x61, 0x46,
+	 0x27, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x04, 0xF2, 0x0C, 0x02, 0x61, 0x46, 0x26, 0xF0, 0x63, 0x46,
+	 0xD0, 0x80, 0x03, 0xF2, 0x06, 0x02, 0x61, 0x46, 0x25, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0xFF, 0xFF,
+	 0x07, 0x03, 0x80, 0xF4, 0xFF, 0xFF, 0x63, 0x46, 0xE8, 0x1B, 0x87, 0xF3, 0x08, 0xFE, 0x60, 0x43,
+	 0x61, 0x46, 0x26, 0x02, 0x0B, 0x60, 0x82, 0xF3, 0xDA, 0x81, 0x60, 0x45, 0xD5, 0x80, 0xA1, 0xD1,
+	 0x04, 0x03, 0xD3, 0x80, 0xD9, 0x81, 0xFA, 0x02, 0x08, 0x00, 0xA1, 0xDD, 0xD9, 0x84, 0x0B, 0x60,
+	 0x82, 0xFB, 0x4A, 0xD3, 0xFF, 0xFF, 0xDC, 0x84, 0xA2, 0xDB, 0x66, 0x45, 0x63, 0x46, 0x06, 0xF2,
+	 0xFF, 0x60, 0x01, 0x7C, 0xA0, 0x9C, 0x06, 0xF8, 0x65, 0x46, 0x70, 0xF3, 0x60, 0x40, 0x10, 0x2A,
+	 0x03, 0x00, 0xCC, 0x84, 0x80, 0x2B, 0x70, 0xFB, 0xE7, 0x60, 0x58, 0x4E, 0x81, 0x78, 0xFF, 0xFF,
+	 0xAD, 0x01, 0x2E, 0xF5, 0x28, 0xF0, 0x18, 0x60, 0x12, 0xF9, 0x27, 0xF2, 0x15, 0x60, 0x02, 0x65,
+	 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD3, 0x66, 0x41, 0x60, 0x46, 0x60, 0x43, 0x05, 0xF2,
+	 0x16, 0x18, 0x61, 0x46, 0x27, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x04, 0xF2, 0x0C, 0x02, 0x61, 0x46,
+	 0x26, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x03, 0xF2, 0x06, 0x02, 0x61, 0x46, 0x25, 0xF0, 0x63, 0x46,
+	 0xD0, 0x80, 0xFF, 0xFF, 0x07, 0x03, 0x80, 0xF4, 0xFF, 0xFF, 0x63, 0x46, 0xE8, 0x1B, 0x87, 0xF3,
+	 0x08, 0xFE, 0x60, 0x43, 0x61, 0x46, 0x12, 0x02, 0x63, 0x46, 0x06, 0xF2, 0xFF, 0xFF, 0x02, 0xB0,
+	 0x08, 0xBC, 0x0C, 0x03, 0x06, 0xFA, 0xE7, 0x60, 0x58, 0x4E, 0x81, 0x78, 0xFF, 0xFF, 0x08, 0x60,
+	 0x1E, 0xF1, 0x00, 0x60, 0x02, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x6F, 0x01, 0x01, 0x64,
+	 0x51, 0xFB, 0x28, 0x60, 0x4E, 0x64, 0x52, 0xFB, 0x15, 0x60, 0xC3, 0xF3, 0xFF, 0xFF, 0x15, 0x18,
+	 0x10, 0x60, 0x2A, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x08, 0x60, 0x1B, 0xF1, 0x00, 0x60, 0x10, 0x64,
+	 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x10, 0x60, 0x00, 0x64, 0x08, 0x60, 0x16, 0xFB, 0xE7, 0x60,
+	 0x3D, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x2B, 0x60, 0x88, 0x61, 0xFF, 0x60,
+	 0x80, 0x65, 0xA1, 0xD3, 0xFF, 0xFF, 0xA4, 0x80, 0x59, 0xD3, 0x05, 0x02, 0x04, 0x1B, 0x59, 0xD3,
+	 0xFF, 0xFF, 0x01, 0x1B, 0x15, 0x00, 0x10, 0x60, 0x2A, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x08, 0x60,
+	 0x1B, 0xF1, 0x00, 0x60, 0x20, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x10, 0x60, 0x00, 0x64,
+	 0x08, 0x60, 0x16, 0xFB, 0xE7, 0x60, 0x60, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x00, 0x60, 0x04, 0x61, 0xB5, 0x60, 0x58, 0x4D, 0x9F, 0x78, 0xFF, 0xFF, 0x01, 0x64, 0x23, 0xFA,
+	 0xF1, 0x60, 0x02, 0x64, 0x24, 0xFA, 0x1F, 0x60, 0x10, 0x64, 0x0F, 0x60, 0x90, 0xFB, 0x66, 0x44,
+	 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xFA, 0xFE, 0x00, 0x60, 0x30, 0x64,
+	 0x08, 0x60, 0x16, 0xFB, 0xD2, 0x60, 0xB5, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0xCA, 0x60, 0x7E, 0x78,
+	 0xFF, 0xFF, 0x0E, 0x57, 0x63, 0x46, 0x43, 0x47, 0x22, 0xF2, 0x76, 0xF2, 0x02, 0x1B, 0x01, 0x1B,
+	 0x0C, 0x00, 0x60, 0x46, 0x1F, 0x60, 0x20, 0x64, 0x40, 0x4B, 0xF6, 0x60, 0x58, 0x4D, 0xB3, 0x78,
+	 0xFF, 0xFF, 0x27, 0x46, 0x76, 0xF2, 0xFF, 0xFF, 0xF4, 0x1B, 0x37, 0x58, 0xFF, 0xFF, 0xE7, 0x60,
+	 0x9F, 0x64, 0x08, 0x60, 0x2A, 0xFB, 0x2F, 0x58, 0xFF, 0xFF, 0x2F, 0x58, 0xFF, 0xFF, 0x00, 0x64,
+	 0x08, 0x60, 0x21, 0xFB, 0x5A, 0xDB, 0x10, 0x60, 0x42, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x2F, 0x58,
+	 0xFF, 0xFF, 0x28, 0xF3, 0x7D, 0xF1, 0x60, 0x47, 0x07, 0xB4, 0x4E, 0xFB, 0x01, 0x61, 0x03, 0x03,
+	 0xCC, 0x84, 0xE1, 0x81, 0xFD, 0x02, 0xA1, 0x80, 0xB1, 0x83, 0x16, 0x02, 0xCF, 0x85, 0xA7, 0x80,
+	 0x7D, 0xFD, 0x0B, 0x02, 0x01, 0x65, 0xE5, 0x60, 0x58, 0x4E, 0xA6, 0x78, 0xFF, 0xFF, 0x31, 0x44,
+	 0xDF, 0xB4, 0x40, 0x51, 0xD0, 0x60, 0xD9, 0x78, 0xFF, 0xFF, 0x08, 0x60, 0x21, 0xF1, 0x00, 0x60,
+	 0x01, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0xE6, 0x60, 0x8E, 0x78, 0xFF, 0xFF, 0x28, 0xF3,
+	 0x7D, 0xF1, 0x60, 0x47, 0x07, 0xB4, 0x4E, 0xFB, 0x01, 0x61, 0x03, 0x03, 0xCC, 0x84, 0xE1, 0x81,
+	 0xFD, 0x02, 0x9D, 0x84, 0xA1, 0x80, 0xA0, 0x83, 0x13, 0x03, 0x7D, 0xFD, 0x08, 0x60, 0x24, 0xF1,
+	 0x00, 0x60, 0x02, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x7D, 0xF1, 0x31, 0x44, 0x64, 0x40,
+	 0xFF, 0x26, 0x03, 0x00, 0x21, 0xBC, 0x40, 0x51, 0x03, 0x00, 0xCA, 0x60, 0x7E, 0x78, 0xFF, 0xFF,
+	 0xE6, 0x60, 0x8E, 0x78, 0xFF, 0xFF, 0x0E, 0x57, 0x32, 0x40, 0x40, 0x26, 0x1B, 0x00, 0x45, 0x48,
+	 0x00, 0x60, 0x06, 0x61, 0xB5, 0x60, 0x58, 0x4D, 0x9F, 0x78, 0xFF, 0xFF, 0x13, 0x03, 0x02, 0x64,
+	 0x23, 0xFA, 0xF2, 0x60, 0x04, 0x64, 0x5A, 0xDA, 0x28, 0x44, 0x5A, 0xDA, 0xFF, 0xFF, 0x1F, 0x60,
+	 0x10, 0x64, 0x0F, 0x60, 0x90, 0xFB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF,
+	 0x2B, 0xFF, 0xFA, 0xFE, 0x37, 0x58, 0xFF, 0xFF, 0x0F, 0x60, 0x79, 0xF3, 0xFF, 0xFF, 0x00, 0xA8,
+	 0x60, 0x46, 0x0E, 0xF2, 0x59, 0x03, 0x60, 0x40, 0xF0, 0x37, 0x46, 0x00, 0xFF, 0x37, 0x3B, 0x00,
+	 0xFD, 0x37, 0x33, 0x00, 0x18, 0x37, 0x27, 0x00, 0xFE, 0x37, 0x2A, 0x00, 0xF8, 0x37, 0x0A, 0x00,
+	 0x60, 0x47, 0xFF, 0xB5, 0x10, 0x60, 0x24, 0x62, 0x46, 0xD1, 0x00, 0x60, 0x01, 0x64, 0xB0, 0x84,
+	 0xA2, 0xDB, 0xCF, 0xFE, 0x00, 0x64, 0x0F, 0x60, 0x90, 0xFB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64,
+	 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xD8, 0x01, 0x06, 0xB4, 0xFD, 0x7F, 0x0E, 0xFA, 0x1E, 0x60,
+	 0xF8, 0x64, 0x0F, 0x60, 0x90, 0xFB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF,
+	 0x2B, 0xFF, 0xF9, 0xFE, 0xC9, 0x01, 0xDE, 0x60, 0x58, 0x4F, 0x6C, 0x78, 0xFF, 0xFF, 0x14, 0x00,
+	 0xE1, 0x60, 0x58, 0x4F, 0x32, 0x78, 0xFF, 0xFF, 0xBF, 0x03, 0x23, 0xF0, 0x60, 0x40, 0x04, 0x26,
+	 0xE3, 0x1B, 0x02, 0x26, 0xE1, 0x18, 0xA2, 0xFF, 0x02, 0xF0, 0x09, 0x60, 0x08, 0x64, 0xD0, 0x80,
+	 0x8F, 0xF3, 0x02, 0x02, 0xCC, 0x84, 0x8F, 0xFB, 0x1F, 0x60, 0x20, 0x64, 0x40, 0x4B, 0xF6, 0x60,
+	 0x58, 0x4D, 0xB3, 0x78, 0xFF, 0xFF, 0xA8, 0x01, 0xAC, 0xFE, 0x09, 0x05, 0xAD, 0xFE, 0x0F, 0x05,
+	 0xAE, 0xFE, 0xA2, 0x05, 0xAF, 0xFE, 0x37, 0x05, 0xCA, 0x60, 0x7E, 0x78, 0xFF, 0xFF, 0x08, 0x60,
+	 0x11, 0xF1, 0x20, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0xF5, 0x01, 0x10, 0x60,
+	 0x56, 0x65, 0x03, 0x61, 0x07, 0x00, 0xA2, 0xDD, 0x58, 0x4F, 0x64, 0x58, 0xFF, 0xFF, 0x00, 0xB9,
+	 0xFF, 0xFF, 0x08, 0x03, 0x00, 0x63, 0xA5, 0xD1, 0x5A, 0xD3, 0xDA, 0x85, 0x00, 0xA8, 0xCD, 0x81,
+	 0xF2, 0x02, 0xF8, 0x02, 0xE1, 0x01, 0x10, 0x60, 0x20, 0x62, 0x10, 0x60, 0x46, 0x65, 0xE8, 0x60,
+	 0xA9, 0x63, 0x5A, 0xDF, 0xD6, 0x80, 0xFF, 0xFF, 0x04, 0x03, 0x5A, 0xDF, 0x5A, 0xDF, 0x5A, 0xDD,
+	 0xF9, 0x01, 0x10, 0x60, 0x54, 0x65, 0x5A, 0xDF, 0xD6, 0x80, 0xFF, 0xFF, 0x02, 0x03, 0x5A, 0xDD,
+	 0xFB, 0x01, 0x2F, 0x58, 0xFF, 0xFF, 0x10, 0x60, 0x24, 0x64, 0x40, 0x41, 0x10, 0x60, 0x22, 0x63,
+	 0xA3, 0xD1, 0x00, 0x64, 0xD0, 0x80, 0x06, 0x61, 0x08, 0x03, 0xBD, 0xDB, 0xA3, 0xD3, 0xFF, 0xFF,
+	 0xB0, 0x84, 0xCD, 0x81, 0xA3, 0xDB, 0x06, 0xA3, 0xF9, 0x02, 0x10, 0x60, 0x48, 0x63, 0xA3, 0xD1,
+	 0x00, 0x64, 0xD0, 0x80, 0x07, 0x61, 0x19, 0x03, 0xBD, 0xDB, 0x64, 0x44, 0xFE, 0xA3, 0x02, 0xA3,
+	 0xCD, 0x81, 0xE8, 0x84, 0xE3, 0x03, 0x02, 0x05, 0xE1, 0x03, 0xF9, 0x01, 0x77, 0xFB, 0x79, 0xFD,
+	 0x61, 0x5C, 0xA3, 0xD3, 0x78, 0xF9, 0x03, 0x18, 0x58, 0x4F, 0x60, 0x58, 0xFF, 0xFF, 0x79, 0xF3,
+	 0x78, 0xF1, 0x60, 0x43, 0x77, 0xF3, 0x64, 0x41, 0xEA, 0x01, 0x21, 0x43, 0x10, 0x60, 0x48, 0x65,
+	 0xD7, 0x80, 0xBD, 0xD1, 0xBD, 0xD3, 0x03, 0x02, 0xCA, 0x60, 0x7E, 0x78, 0xFF, 0xFF, 0xA0, 0x84,
+	 0xBD, 0xD1, 0x43, 0x41, 0xF5, 0x03, 0xE8, 0x60, 0xAE, 0x64, 0x64, 0x58, 0x40, 0x4F, 0x2A, 0xF0,
+	 0x83, 0x60, 0xFF, 0x65, 0x64, 0x47, 0x03, 0x2B, 0x01, 0x00, 0x17, 0x00, 0x03, 0x26, 0x03, 0xAC,
+	 0x60, 0x47, 0xA4, 0x84, 0x2A, 0xFA, 0x2F, 0xF2, 0x2C, 0xFA, 0x30, 0xF2, 0x2D, 0xFA, 0x31, 0xF2,
+	 0x2E, 0xFA, 0x64, 0x41, 0xCB, 0xF3, 0x2F, 0xFA, 0x60, 0x43, 0xCC, 0xF3, 0x30, 0xFA, 0xCD, 0xF1,
+	 0x31, 0xF8, 0x32, 0xFC, 0x33, 0xFA, 0x34, 0xF8, 0x19, 0x00, 0x60, 0x47, 0xA4, 0x84, 0x2A, 0xFA,
+	 0x2F, 0xF2, 0x2C, 0xFA, 0x30, 0xF2, 0x2D, 0xFA, 0x31, 0xF2, 0x2E, 0xFA, 0x36, 0xF2, 0x32, 0xFA,
+	 0x37, 0xF2, 0x33, 0xFA, 0x38, 0xF2, 0x34, 0xFA, 0xCB, 0xF3, 0x2F, 0xFA, 0x36, 0xFA, 0xCC, 0xF3,
+	 0x30, 0xFA, 0x37, 0xFA, 0xCD, 0xF3, 0x31, 0xFA, 0x38, 0xFA, 0x64, 0x41, 0x1C, 0xF2, 0x13, 0xFA,
+	 0x00, 0xF4, 0x0D, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x80, 0x2B, 0x28, 0x00, 0x26, 0x46, 0x04, 0x63,
+	 0x03, 0xFC, 0x00, 0xF4, 0x0D, 0xF2, 0x06, 0xFA, 0xEA, 0x60, 0x58, 0x4E, 0x49, 0x78, 0xFF, 0xFF,
+	 0xFF, 0xA0, 0x59, 0xF5, 0x19, 0x02, 0x39, 0xF2, 0x26, 0x46, 0x3F, 0xFA, 0x00, 0xF4, 0x00, 0x60,
+	 0x81, 0x67, 0x0D, 0xFA, 0x7C, 0x64, 0x01, 0xFA, 0x26, 0x46, 0x00, 0x64, 0x3E, 0xFA, 0x1E, 0x60,
+	 0xE0, 0x64, 0x0F, 0x60, 0x90, 0xFB, 0x26, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF,
+	 0x2B, 0xFF, 0xC8, 0xFE, 0x00, 0x66, 0x46, 0x46, 0x2F, 0x58, 0xFF, 0xFF, 0x26, 0x46, 0x3F, 0xF0,
+	 0x42, 0x64, 0xD0, 0x80, 0xFF, 0xFF, 0x01, 0x04, 0x3F, 0xFA, 0x1C, 0xF2, 0x13, 0xFA, 0x26, 0xF2,
+	 0x27, 0xF0, 0x60, 0x47, 0x00, 0xF4, 0x1F, 0xFA, 0x64, 0x47, 0x20, 0xFA, 0x61, 0x44, 0x21, 0xFA,
+	 0x01, 0x67, 0x0D, 0xFA, 0x10, 0x61, 0x26, 0x60, 0x64, 0x64, 0x1E, 0x63, 0x58, 0xD1, 0xCD, 0x81,
+	 0xBD, 0xD8, 0xFC, 0x02, 0x9A, 0xF1, 0xB7, 0xF1, 0x64, 0x5E, 0x64, 0x5F, 0x44, 0x63, 0xBD, 0xDA,
+	 0x13, 0x60, 0x2F, 0xF3, 0xFF, 0xFF, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0x09, 0xBC, 0x4A, 0xD3,
+	 0x60, 0x45, 0x60, 0x40, 0x01, 0x36, 0x03, 0x64, 0x02, 0x36, 0x01, 0x64, 0xB4, 0x84, 0x06, 0xA2,
+	 0xA2, 0xD1, 0xBD, 0xDA, 0x64, 0x47, 0xBD, 0xDA, 0xB4, 0xF3, 0xB5, 0xF1, 0x60, 0x47, 0xBD, 0xDA,
+	 0x64, 0x47, 0xC3, 0xF1, 0xBD, 0xDA, 0x64, 0x44, 0xBD, 0xDA, 0x26, 0x46, 0x00, 0x64, 0x23, 0xF0,
+	 0x3B, 0xF0, 0x64, 0x40, 0x10, 0x2A, 0x06, 0x00, 0xC0, 0x67, 0xA0, 0x84, 0xE8, 0x84, 0xE8, 0x84,
+	 0xE8, 0x84, 0x10, 0xBC, 0x3E, 0xFA, 0x1E, 0x60, 0xE0, 0x64, 0x0F, 0x60, 0x90, 0xFB, 0x26, 0x44,
+	 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xC8, 0xFE, 0x00, 0x66, 0x46, 0x46,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x04, 0x60, 0x5C, 0x61, 0xB5, 0x60, 0x58, 0x4D, 0xA2, 0x78, 0xFF, 0xFF,
+	 0x66, 0x44, 0x59, 0xFB, 0x04, 0x64, 0x03, 0xFA, 0x2F, 0x58, 0xFF, 0xFF, 0x59, 0xF5, 0xAB, 0xF1,
+	 0x19, 0xF8, 0x00, 0x64, 0x3E, 0xFA, 0x08, 0x64, 0x2A, 0xFA, 0x80, 0x7E, 0xF8, 0x7F, 0x0E, 0xFA,
+	 0x87, 0xF1, 0x07, 0xF8, 0x01, 0x60, 0x60, 0x67, 0x2C, 0xFA, 0x1D, 0x60, 0x00, 0x67, 0x2D, 0xFA,
+	 0x01, 0x60, 0x00, 0x67, 0x2E, 0xFA, 0xCB, 0xF1, 0x2F, 0xF8, 0x32, 0xF8, 0xCC, 0xF1, 0x30, 0xF8,
+	 0x33, 0xF8, 0xCD, 0xF1, 0x31, 0xF8, 0x34, 0xF8, 0x00, 0x63, 0x3B, 0xFC, 0x3D, 0xFC, 0x01, 0x64,
+	 0x3A, 0xFA, 0x66, 0x64, 0x39, 0xFA, 0x3C, 0xFC, 0xAA, 0x60, 0xAA, 0x64, 0x00, 0xF4, 0x02, 0xFA,
+	 0x00, 0x60, 0x03, 0x64, 0x5A, 0xDA, 0x1D, 0x60, 0x60, 0x64, 0x5A, 0xDA, 0x01, 0x60, 0x00, 0x64,
+	 0x5A, 0xDA, 0x81, 0x7F, 0x18, 0x7E, 0x08, 0xFA, 0x01, 0x60, 0x01, 0x64, 0x0A, 0xFA, 0x00, 0x64,
+	 0x0E, 0xFA, 0x2D, 0x58, 0xFF, 0xFF, 0x59, 0xF5, 0x3D, 0xF2, 0x3C, 0xF2, 0xCC, 0x83, 0x00, 0xA8,
+	 0x03, 0x03, 0x08, 0x28, 0x3D, 0xFC, 0x42, 0x00, 0x3D, 0xFA, 0x3A, 0xF2, 0x3B, 0xF0, 0x00, 0x63,
+	 0x00, 0xF4, 0x07, 0xFC, 0x01, 0xB0, 0x0B, 0xFA, 0x19, 0x03, 0x1F, 0xF8, 0xFF, 0xFF, 0x18, 0x64,
+	 0x0F, 0x60, 0x90, 0xFB, 0x66, 0x44, 0x5A, 0xDB, 0x0A, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF,
+	 0x1F, 0xF2, 0x1E, 0xF0, 0x59, 0xF5, 0x00, 0xA8, 0x3B, 0xF8, 0xD0, 0x80, 0x06, 0x03, 0x05, 0x03,
+	 0x04, 0x60, 0x5C, 0x63, 0x0F, 0x64, 0x3A, 0xFA, 0x39, 0xFC, 0x00, 0xF4, 0x00, 0x64, 0x06, 0xFA,
+	 0xEA, 0x60, 0x58, 0x4E, 0x49, 0x78, 0xFF, 0xFF, 0x59, 0xF5, 0x00, 0xF4, 0x81, 0x60, 0x00, 0x64,
+	 0x06, 0xFA, 0x32, 0x47, 0x07, 0xFA, 0xB7, 0xF1, 0x00, 0x7F, 0x64, 0x5E, 0x09, 0xFA, 0x59, 0xF5,
+	 0x00, 0x64, 0x15, 0xFA, 0x39, 0xF2, 0x3F, 0xFA, 0x1E, 0x60, 0xCE, 0x64, 0x0F, 0x60, 0x90, 0xFB,
+	 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xE3, 0x60, 0xC0, 0x78,
+	 0xFF, 0xFF, 0x66, 0x45, 0x0E, 0xF2, 0x0F, 0xF0, 0x10, 0xF0, 0x64, 0x41, 0x01, 0xA8, 0x59, 0xF5,
+	 0x09, 0x02, 0xAD, 0x83, 0x64, 0x44, 0xAC, 0x84, 0x08, 0x24, 0x0A, 0x63, 0x3C, 0xFC, 0x3D, 0xFC,
+	 0x1A, 0x02, 0x2D, 0x00, 0x03, 0x3A, 0x03, 0x00, 0x00, 0x64, 0x3C, 0xFA, 0x29, 0x00, 0x04, 0x3A,
+	 0x09, 0x00, 0x0A, 0x64, 0x3C, 0xFA, 0x01, 0x64, 0x3A, 0xFA, 0x00, 0xF4, 0x00, 0x64, 0x1F, 0xFA,
+	 0x1E, 0xFA, 0x1E, 0x00, 0x02, 0x3A, 0x1E, 0x00, 0x64, 0x44, 0xAD, 0x83, 0xAC, 0x84, 0x02, 0x03,
+	 0x3C, 0xFC, 0x3D, 0xFC, 0x15, 0x03, 0x3A, 0xFA, 0xF8, 0x65, 0x52, 0x63, 0x64, 0x44, 0x01, 0x36,
+	 0x0D, 0x00, 0x12, 0xA3, 0x64, 0x40, 0x02, 0x2A, 0x02, 0x00, 0xC7, 0x83, 0xC7, 0x83, 0x64, 0x40,
+	 0x08, 0x2A, 0x01, 0x00, 0xC7, 0x83, 0x64, 0x40, 0x04, 0x26, 0xC7, 0x83, 0x39, 0xFC, 0x00, 0x64,
+	 0x2E, 0x58, 0xFF, 0xFF, 0x3B, 0xF0, 0x3A, 0xF2, 0x65, 0x46, 0x06, 0xF2, 0x40, 0x47, 0x1C, 0x18,
+	 0x32, 0x47, 0x07, 0xFA, 0x18, 0x7E, 0x81, 0x7F, 0x08, 0xFA, 0x01, 0x60, 0x01, 0x63, 0xB7, 0xF3,
+	 0x0A, 0xFC, 0x00, 0x7F, 0x09, 0xFA, 0x27, 0x40, 0x01, 0x2A, 0x0E, 0x00, 0x1F, 0xF8, 0x18, 0x64,
+	 0x0F, 0x60, 0x90, 0xFB, 0x66, 0x44, 0x5A, 0xDB, 0x0A, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF,
+	 0x1E, 0xF0, 0x59, 0xF5, 0x3B, 0xF8, 0x65, 0x46, 0x27, 0x40, 0x02, 0x26, 0x02, 0x00, 0x00, 0xF4,
+	 0x13, 0x00, 0x6E, 0x61, 0xFF, 0x60, 0xFE, 0x64, 0x00, 0x60, 0x0E, 0x63, 0x58, 0xD1, 0x59, 0xD8,
+	 0xFD, 0x1F, 0x01, 0x60, 0xEE, 0x63, 0x00, 0xF4, 0x02, 0x61, 0x58, 0xD1, 0x59, 0xD8, 0x7E, 0x3A,
+	 0x02, 0x00, 0x00, 0xF4, 0x02, 0x61, 0xF9, 0x1F, 0x27, 0x40, 0x04, 0x26, 0x1A, 0x00, 0x46, 0x4B,
+	 0x0F, 0x60, 0x67, 0xF3, 0xFF, 0xFF, 0x00, 0xA8, 0x60, 0x46, 0x0E, 0x03, 0x89, 0xF0, 0xEB, 0x60,
+	 0x58, 0x4D, 0x00, 0x78, 0xFF, 0xFF, 0x65, 0x44, 0xAC, 0x86, 0xFF, 0xFF, 0x08, 0x03, 0xEB, 0x60,
+	 0x58, 0x4D, 0x00, 0x78, 0xFF, 0xFF, 0x04, 0x00, 0x2B, 0x46, 0x82, 0xFC, 0x00, 0xF4, 0x82, 0xFC,
+	 0x00, 0xF4, 0x27, 0x40, 0x08, 0x26, 0x19, 0x00, 0x46, 0x4B, 0x0F, 0x60, 0x85, 0xF3, 0xFF, 0xFF,
+	 0x00, 0xA8, 0x60, 0x46, 0x0E, 0x03, 0x89, 0xF0, 0xEB, 0x60, 0x58, 0x4D, 0x00, 0x78, 0xFF, 0xFF,
+	 0x65, 0x44, 0xAC, 0x86, 0xFF, 0xFF, 0x08, 0x03, 0xEB, 0x60, 0x58, 0x4D, 0x00, 0x78, 0xFF, 0xFF,
+	 0x04, 0x00, 0x65, 0x46, 0x02, 0xFA, 0x00, 0xF4, 0x82, 0xFC, 0x01, 0x64, 0x2E, 0x58, 0xFF, 0xFF,
+	 0x01, 0x61, 0x02, 0x64, 0x7A, 0x63, 0x58, 0xD0, 0xAB, 0x46, 0xA0, 0xD8, 0xAB, 0x46, 0xFB, 0x1F,
+	 0xAB, 0x46, 0x00, 0xF4, 0xCD, 0x81, 0xAB, 0x46, 0x00, 0xF4, 0xF3, 0x02, 0x2D, 0x58, 0xFF, 0xFF,
+	 0x00, 0x60, 0x2A, 0x61, 0xB5, 0x60, 0x58, 0x4D, 0xA2, 0x78, 0xFF, 0xFF, 0x66, 0x44, 0x58, 0xFB,
+	 0x04, 0x64, 0x03, 0xFA, 0x67, 0x44, 0x2C, 0xFA, 0x2D, 0xFA, 0x2E, 0xFA, 0x32, 0xFA, 0x33, 0xFA,
+	 0x34, 0xFA, 0x12, 0x60, 0x80, 0x64, 0x87, 0xF1, 0x0E, 0xFA, 0x07, 0xF8, 0x00, 0x64, 0x3E, 0xFA,
+	 0x0A, 0x60, 0x07, 0xFB, 0x06, 0xA2, 0x10, 0x60, 0x5C, 0x64, 0xA2, 0xDB, 0x04, 0x64, 0x5A, 0xDB,
+	 0x06, 0x64, 0x5A, 0xDB, 0xED, 0x60, 0xD9, 0x64, 0x08, 0x60, 0x2D, 0xFB, 0x00, 0x64, 0x0A, 0x60,
+	 0x0D, 0xFB, 0x06, 0xA2, 0x10, 0x60, 0x60, 0x64, 0xA2, 0xDB, 0x08, 0x64, 0x5A, 0xDB, 0x06, 0x64,
+	 0x5A, 0xDB, 0xED, 0x60, 0xE2, 0x64, 0x08, 0x60, 0x2F, 0xFB, 0xED, 0x60, 0xBE, 0x64, 0x08, 0x60,
+	 0x28, 0xFB, 0x00, 0x60, 0x30, 0x64, 0x08, 0x60, 0x1C, 0xFB, 0xEB, 0x60, 0x58, 0x64, 0x5A, 0xDB,
+	 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x2F, 0x58, 0xFF, 0xFF, 0xED, 0x60, 0x70, 0x78, 0xFF, 0xFF,
+	 0x58, 0xF5, 0xCB, 0xF1, 0x2F, 0xF8, 0xCC, 0xF1, 0x30, 0xF8, 0xCD, 0xF1, 0x31, 0xF8, 0xAB, 0xF1,
+	 0x19, 0xF8, 0x58, 0xF5, 0x40, 0x64, 0x2A, 0xFA, 0x64, 0xF3, 0x63, 0xFB, 0x08, 0x60, 0x1B, 0xF1,
+	 0x00, 0x60, 0x10, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x03, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x03, 0x00,
+	 0xEC, 0x60, 0xCB, 0x78, 0xFF, 0xFF, 0x15, 0x60, 0xC0, 0xF3, 0xEF, 0x60, 0x58, 0x4E, 0xAB, 0x78,
+	 0xFF, 0xFF, 0x15, 0x60, 0xC2, 0xFB, 0x15, 0x60, 0xBC, 0xF3, 0x3F, 0x40, 0x01, 0x27, 0x08, 0x00,
+	 0x0F, 0x60, 0xFF, 0x65, 0xA4, 0x84, 0xEE, 0x60, 0x58, 0x4E, 0x26, 0x78, 0xFF, 0xFF, 0x05, 0x00,
+	 0x0F, 0xB4, 0xEE, 0x60, 0x58, 0x4E, 0x26, 0x78, 0xFF, 0xFF, 0x58, 0xF5, 0x2D, 0x60, 0x94, 0x64,
+	 0x00, 0xF4, 0x40, 0x48, 0x28, 0x60, 0x4E, 0x64, 0x20, 0x40, 0x10, 0x27, 0x02, 0x00, 0x28, 0x60,
+	 0x2C, 0x64, 0x28, 0xDB, 0x04, 0x61, 0x00, 0x60, 0x00, 0x64, 0xE4, 0x60, 0x58, 0x4D, 0xA7, 0x78,
+	 0xFF, 0xFF, 0x58, 0xF5, 0x3F, 0xFC, 0x01, 0x64, 0x52, 0xF1, 0x0C, 0x60, 0x81, 0xFB, 0x64, 0xFB,
+	 0xA4, 0xD3, 0x04, 0x65, 0x51, 0xF3, 0x01, 0x18, 0x0C, 0x65, 0xF3, 0xB4, 0xB4, 0x84, 0x51, 0xFB,
+	 0x0D, 0x00, 0xED, 0x60, 0x70, 0x78, 0xFF, 0xFF, 0x51, 0xF1, 0x64, 0xF3, 0xFF, 0xFF, 0xF3, 0xA0,
+	 0x04, 0xA4, 0x01, 0x04, 0xF1, 0xA4, 0x10, 0x36, 0xF4, 0x01, 0x64, 0xFB, 0x64, 0xF3, 0x15, 0x60,
+	 0xC3, 0xF1, 0xCC, 0x84, 0x01, 0x61, 0x08, 0x24, 0x03, 0x00, 0xE1, 0x81, 0xCC, 0x84, 0xFB, 0x01,
+	 0xA1, 0x84, 0x51, 0xF1, 0xEA, 0x03, 0x0C, 0x60, 0x81, 0xFB, 0x9D, 0xFE, 0x3D, 0x05, 0xBA, 0xFE,
+	 0x10, 0x60, 0x36, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0xDE, 0xFE, 0x0A, 0x04, 0x40, 0x60, 0x00, 0x64,
+	 0x08, 0x60, 0x1C, 0xFB, 0xEB, 0x60, 0xD0, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x10, 0x60, 0x36, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x64, 0xF1, 0x0F, 0x60, 0x9D, 0xF9, 0x08, 0x64,
+	 0x4A, 0xDB, 0xFF, 0xFF, 0x2D, 0xFF, 0x20, 0x60, 0x00, 0x64, 0x08, 0x60, 0x1C, 0xFB, 0xEB, 0x60,
+	 0xF5, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0xBE, 0xFE, 0x08, 0x60, 0x11, 0xF1,
+	 0x40, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x18, 0x60, 0x07, 0xF1, 0xAD, 0x4F,
+	 0x00, 0x7F, 0xFA, 0xB4, 0x64, 0x41, 0x64, 0xF1, 0x02, 0xB1, 0x04, 0x65, 0x02, 0x02, 0x64, 0x40,
+	 0x01, 0x2B, 0x01, 0x65, 0xB4, 0x84, 0xA0, 0x5D, 0x10, 0x60, 0x36, 0x62, 0x00, 0x64, 0xA2, 0xDB,
+	 0xDE, 0xFE, 0x0A, 0x04, 0x40, 0x60, 0x00, 0x64, 0x08, 0x60, 0x1C, 0xFB, 0xEB, 0x60, 0xCD, 0x64,
+	 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x64, 0xF1, 0x0F, 0x60, 0x9D, 0xF9, 0x0E, 0x64,
+	 0x4A, 0xDB, 0xFF, 0xFF, 0x2D, 0xFF, 0x20, 0x60, 0x00, 0x64, 0x08, 0x60, 0x1C, 0xFB, 0xEC, 0x60,
+	 0x2D, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0xBE, 0xFE, 0x08, 0x60, 0x11, 0xF1,
+	 0x40, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x10, 0x60, 0x36, 0x62, 0x00, 0x64,
+	 0xA2, 0xDB, 0x58, 0xF5, 0x1E, 0x60, 0xD4, 0x64, 0x0F, 0x60, 0x90, 0xFB, 0x66, 0x44, 0x5A, 0xDB,
+	 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0x00, 0x64, 0x4F, 0xFB, 0x00, 0x60, 0x01, 0x64,
+	 0x08, 0x60, 0x1C, 0xFB, 0xEC, 0x60, 0x51, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0xC1, 0xFE, 0x2F, 0x58,
+	 0xFF, 0xFF, 0x10, 0x60, 0x36, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0xA5, 0xF1, 0x0A, 0x60, 0x09, 0xF9,
+	 0x14, 0x60, 0x0E, 0x64, 0x0F, 0x60, 0xA5, 0xFB, 0x02, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF,
+	 0xA6, 0xF1, 0x0A, 0x60, 0x0F, 0xF9, 0x1F, 0x60, 0x48, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0xFD, 0x1B,
+	 0x14, 0x60, 0x1A, 0x64, 0x0F, 0x60, 0xA5, 0xFB, 0x02, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF,
+	 0x00, 0x60, 0x08, 0x64, 0x08, 0x60, 0x1C, 0xFB, 0xEC, 0x60, 0x7A, 0x64, 0x5A, 0xDB, 0xCF, 0xFE,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x4F, 0xF1, 0x10, 0x60, 0x36, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x64, 0x40,
+	 0xFF, 0x26, 0x0B, 0x00, 0x51, 0xF3, 0xFF, 0xFF, 0x80, 0xB0, 0xFF, 0xFF, 0x03, 0x03, 0xED, 0x60,
+	 0x6A, 0x78, 0xFF, 0xFF, 0xEB, 0x60, 0xB4, 0x78, 0xFF, 0xFF, 0x02, 0x0A, 0x00, 0x64, 0x4F, 0xFB,
+	 0xA7, 0xF1, 0x0A, 0x60, 0x0F, 0xF9, 0x00, 0x60, 0x0C, 0x64, 0x08, 0x60, 0x1C, 0xFB, 0xEC, 0x60,
+	 0xA5, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x14, 0x60, 0x1A, 0x64, 0x0F, 0x60, 0xA5, 0xFB, 0x02, 0x64,
+	 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x2F, 0x58, 0xFF, 0xFF, 0x08, 0x60, 0x1B, 0xF1, 0x00, 0x60,
+	 0x04, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x0B, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x14, 0x60, 0x1A, 0x64,
+	 0x0F, 0x60, 0xA5, 0xFB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x13, 0x00, 0xFF, 0x60,
+	 0xF7, 0x64, 0xA0, 0x84, 0xA2, 0xDB, 0x4F, 0xF3, 0xDE, 0x0A, 0x00, 0xA0, 0x00, 0x64, 0x02, 0x03,
+	 0x4F, 0xFB, 0xD9, 0x01, 0x14, 0x60, 0x0E, 0x64, 0x0F, 0x60, 0xA5, 0xFB, 0x03, 0x64, 0x4A, 0xDB,
+	 0xFF, 0xFF, 0x04, 0xFF, 0xB7, 0x01, 0x15, 0x60, 0xC1, 0xF3, 0xEF, 0x60, 0x58, 0x4E, 0xAB, 0x78,
+	 0xFF, 0xFF, 0x15, 0x60, 0xC2, 0xFB, 0x15, 0x60, 0xBD, 0xF3, 0x0F, 0x60, 0xFF, 0x65, 0xA4, 0x84,
+	 0xEE, 0x60, 0x58, 0x4E, 0x26, 0x78, 0xFF, 0xFF, 0x58, 0xF5, 0x2D, 0x60, 0x94, 0x64, 0x00, 0xF4,
+	 0x40, 0x48, 0x28, 0x60, 0x4E, 0x64, 0x20, 0x40, 0x10, 0x27, 0x02, 0x00, 0x28, 0x60, 0x2C, 0x64,
+	 0x28, 0xDB, 0x04, 0x61, 0x00, 0x60, 0x00, 0x64, 0xE4, 0x60, 0x58, 0x4D, 0xA7, 0x78, 0xFF, 0xFF,
+	 0x58, 0xF5, 0x3F, 0xFC, 0x51, 0xF3, 0x20, 0x40, 0x10, 0x23, 0x02, 0x00, 0x20, 0xBC, 0x04, 0x00,
+	 0x60, 0x40, 0x01, 0x22, 0x40, 0xBC, 0x04, 0xBC, 0x80, 0xBC, 0x51, 0xFB, 0x11, 0x60, 0x16, 0x64,
+	 0x08, 0x60, 0x46, 0xFB, 0x06, 0x64, 0x08, 0x60, 0x4D, 0xFB, 0x15, 0x60, 0xC6, 0xF3, 0xFF, 0xFF,
+	 0x07, 0xB4, 0xA2, 0xDB, 0x51, 0xF3, 0x08, 0x60, 0x46, 0xF1, 0x60, 0x40, 0x20, 0x26, 0x03, 0x00,
+	 0x01, 0x26, 0x32, 0x00, 0x45, 0x00, 0x08, 0x60, 0x4D, 0xF3, 0xFF, 0xFF, 0xDD, 0xA0, 0x01, 0xA4,
+	 0x57, 0x03, 0xA2, 0xDB, 0x2B, 0x60, 0x88, 0x61, 0xE0, 0xA0, 0xF0, 0xA0, 0x05, 0x05, 0x01, 0x05,
+	 0x05, 0x00, 0x02, 0xA1, 0xF0, 0xA4, 0x02, 0x00, 0x04, 0xA1, 0xE0, 0xA4, 0xA1, 0xD1, 0x01, 0x61,
+	 0xDC, 0x84, 0xCC, 0x84, 0xFF, 0xFF, 0x02, 0x03, 0xE1, 0x81, 0xFB, 0x01, 0xA1, 0x80, 0x10, 0x60,
+	 0x9A, 0x64, 0x01, 0x02, 0xE0, 0x01, 0xA0, 0xD3, 0x11, 0x60, 0x0E, 0x63, 0xFA, 0xA4, 0xCC, 0x84,
+	 0x08, 0xA3, 0xFD, 0x02, 0xB1, 0xF1, 0xA3, 0xD3, 0x01, 0x18, 0xD5, 0x18, 0xFE, 0xA3, 0xA3, 0xD3,
+	 0x64, 0xFB, 0xEB, 0x60, 0xCD, 0x78, 0xFF, 0xFF, 0x11, 0x60, 0xF4, 0x65, 0x64, 0x41, 0xA1, 0xD3,
+	 0xD5, 0x80, 0x00, 0xB8, 0x25, 0x07, 0x02, 0x02, 0x08, 0xA1, 0xF9, 0x01, 0x61, 0x44, 0x08, 0x60,
+	 0x46, 0xFB, 0x01, 0x64, 0xA1, 0xDB, 0x49, 0xD3, 0x64, 0xFB, 0xEB, 0x60, 0xCD, 0x78, 0xFF, 0xFF,
+	 0x11, 0x60, 0xF4, 0x65, 0x64, 0x41, 0xA1, 0xD3, 0xD5, 0x80, 0x04, 0xB0, 0x11, 0x07, 0x02, 0x02,
+	 0x08, 0xA1, 0xF9, 0x01, 0x61, 0x44, 0x08, 0x60, 0x46, 0xFB, 0x49, 0xD3, 0x64, 0xFB, 0xEB, 0x60,
+	 0xCD, 0x78, 0xFF, 0xFF, 0x08, 0x60, 0x46, 0xF3, 0xFF, 0xFF, 0x08, 0xA4, 0xA2, 0xDB, 0x9A, 0x01,
+	 0x14, 0x60, 0x0E, 0x64, 0x0F, 0x60, 0xA5, 0xFB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF,
+	 0x51, 0xF3, 0xFF, 0xFF, 0xE3, 0xB4, 0x51, 0xFB, 0x0C, 0x60, 0x7F, 0xF3, 0xFF, 0xFF, 0xFE, 0xB4,
+	 0xA2, 0xDB, 0x10, 0x60, 0x36, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0xDE, 0xFE, 0x0A, 0x04, 0x40, 0x60,
+	 0x00, 0x64, 0x08, 0x60, 0x1C, 0xFB, 0xED, 0x60, 0x81, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58,
+	 0xFF, 0xFF, 0x63, 0xF1, 0x64, 0xF9, 0x0F, 0x60, 0x9D, 0xF9, 0x0E, 0x64, 0x4A, 0xDB, 0xFF, 0xFF,
+	 0x2D, 0xFF, 0x20, 0x60, 0x00, 0x64, 0x08, 0x60, 0x1C, 0xFB, 0xED, 0x60, 0xA3, 0x64, 0x5A, 0xDB,
+	 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0xBE, 0xFE, 0x08, 0x60, 0x11, 0xF1, 0x40, 0x60, 0x00, 0x64,
+	 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x08, 0x60, 0x11, 0xF1, 0x10, 0x60, 0x00, 0x64, 0xB0, 0x84,
+	 0xA2, 0xDB, 0xCF, 0xFE, 0x00, 0x60, 0x30, 0x64, 0x08, 0x60, 0x1C, 0xFB, 0xEB, 0x60, 0x58, 0x64,
+	 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x2F, 0x58, 0xFF, 0xFF, 0x14, 0x60, 0x0E, 0x64,
+	 0x0F, 0x60, 0xA5, 0xFB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x00, 0x64, 0x51, 0xFB,
+	 0x00, 0x64, 0x08, 0x60, 0x1B, 0xFB, 0x5A, 0xDB, 0xBE, 0xFE, 0x00, 0x60, 0x30, 0x64, 0x08, 0x60,
+	 0x1C, 0xFB, 0xEB, 0x60, 0x58, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x2F, 0x58,
+	 0xFF, 0xFF, 0x08, 0x60, 0x1B, 0xF1, 0x00, 0x60, 0x04, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x08, 0x60, 0x1B, 0xF1, 0x00, 0x60, 0x08, 0x64, 0xB0, 0x84, 0xA2, 0xDB,
+	 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x31, 0x40, 0x20, 0x2A, 0x35, 0x00, 0x3F, 0xF2, 0x47, 0x65,
+	 0xC4, 0x84, 0xE8, 0x84, 0x23, 0xFA, 0xF1, 0x60, 0x02, 0x64, 0x24, 0xFA, 0x64, 0xF3, 0x01, 0x60,
+	 0xFF, 0x65, 0xA4, 0x84, 0x01, 0x23, 0x14, 0x00, 0x11, 0x60, 0x14, 0x61, 0x11, 0x60, 0xF4, 0x65,
+	 0xA1, 0xD1, 0xD5, 0x80, 0xD0, 0x80, 0x0B, 0x03, 0x02, 0x03, 0x08, 0xA1, 0xF9, 0x01, 0x04, 0xA1,
+	 0xA1, 0xD3, 0x01, 0x60, 0x00, 0x65, 0x60, 0x47, 0xFF, 0xB4, 0xB4, 0x84, 0x01, 0x00, 0x01, 0x64,
+	 0x00, 0xF4, 0x08, 0xFA, 0xFF, 0xFF, 0x26, 0x46, 0x1F, 0x60, 0x10, 0x64, 0x0F, 0x60, 0x90, 0xFB,
+	 0x26, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xFA, 0xFE, 0x00, 0x66,
+	 0x46, 0x46, 0x2F, 0x58, 0xFF, 0xFF, 0x26, 0x46, 0x2F, 0x58, 0xFF, 0xFF, 0x5F, 0xFB, 0xAC, 0x85,
+	 0x60, 0x41, 0x2E, 0x60, 0x22, 0x63, 0x16, 0x60, 0xC6, 0xFD, 0x16, 0x60, 0xCC, 0xFD, 0x16, 0x60,
+	 0xD6, 0xFD, 0x16, 0x60, 0xE0, 0xFD, 0x5C, 0x03, 0x61, 0x5C, 0x00, 0x63, 0xE9, 0x81, 0xFF, 0xFF,
+	 0x02, 0x24, 0xDF, 0x83, 0xFB, 0x02, 0x08, 0x64, 0x53, 0x90, 0x64, 0x41, 0x03, 0x04, 0x01, 0x60,
+	 0x08, 0x63, 0x0C, 0x00, 0x01, 0x60, 0x00, 0x63, 0x10, 0x64, 0xE9, 0x81, 0xFF, 0xFF, 0x02, 0x24,
+	 0xDF, 0x83, 0x08, 0x36, 0x03, 0x00, 0xCC, 0x84, 0xFF, 0xFF, 0xF7, 0x02, 0x15, 0x60, 0xEC, 0xFD,
+	 0x43, 0x48, 0x65, 0x41, 0x2B, 0x60, 0xDA, 0x63, 0x28, 0x44, 0xFF, 0xB5, 0x10, 0x60, 0x08, 0x64,
+	 0xE9, 0x81, 0x58, 0xD1, 0xFD, 0x04, 0xA3, 0xD9, 0x0C, 0x03, 0x58, 0xD1, 0xE9, 0x81, 0x40, 0x4A,
+	 0xFC, 0x04, 0xA3, 0xD1, 0x64, 0x47, 0xB0, 0x84, 0xBD, 0xDB, 0x65, 0x44, 0xC8, 0x85, 0x2A, 0x44,
+	 0xEF, 0x02, 0x28, 0x43, 0x08, 0x3A, 0x24, 0x00, 0x60, 0x45, 0x04, 0x64, 0x32, 0x60, 0x00, 0x63,
+	 0x41, 0x48, 0xE9, 0x81, 0xCC, 0x84, 0x02, 0x24, 0xDF, 0x83, 0xFB, 0x02, 0x63, 0x40, 0x00, 0x36,
+	 0x17, 0x00, 0x17, 0x60, 0x11, 0xFD, 0x2E, 0x60, 0x24, 0x63, 0x65, 0x44, 0x28, 0x41, 0xE9, 0x81,
+	 0x58, 0xD1, 0xFD, 0x04, 0xA3, 0xD9, 0x15, 0x03, 0x58, 0xD1, 0xE9, 0x81, 0x60, 0x45, 0xFC, 0x04,
+	 0xA3, 0xD1, 0x64, 0x47, 0xB0, 0x84, 0xBD, 0xDB, 0x00, 0xB9, 0x65, 0x44, 0xF0, 0x02, 0x09, 0x00,
+	 0x67, 0x43, 0x16, 0x60, 0xC6, 0xFD, 0x16, 0x60, 0xCC, 0xFD, 0x16, 0x60, 0xD6, 0xFD, 0x16, 0x60,
+	 0xE0, 0xFD, 0x20, 0x40, 0x10, 0x27, 0x0D, 0x00, 0x2B, 0x60, 0xE2, 0x61, 0x15, 0x60, 0xEC, 0xF3,
+	 0xA1, 0xDB, 0xFF, 0xB4, 0xCC, 0x84, 0xA8, 0x83, 0x2B, 0x60, 0xD8, 0x64, 0x58, 0xD1, 0x59, 0xD9,
+	 0xFD, 0x1F, 0x2B, 0x60, 0xE4, 0x63, 0x15, 0x60, 0xBE, 0xF3, 0x08, 0x61, 0x60, 0xFE, 0xA3, 0xD1,
+	 0xFF, 0xFF, 0x20, 0xFE, 0x00, 0xA8, 0xE8, 0x84, 0x0F, 0x03, 0x60, 0xFE, 0x02, 0x28, 0xF6, 0x01,
+	 0x80, 0x62, 0xB2, 0x9C, 0xBD, 0xD9, 0x62, 0xF9, 0xCD, 0x81, 0x00, 0x36, 0x01, 0x00, 0xEE, 0x01,
+	 0x2E, 0x60, 0x24, 0x63, 0x08, 0x61, 0xEA, 0x01, 0x2E, 0x58, 0xFF, 0xFF, 0x2B, 0x60, 0x7C, 0x63,
+	 0x65, 0x40, 0xFF, 0x36, 0x02, 0xA3, 0xA3, 0xD3, 0xFF, 0xFF, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84,
+	 0xE8, 0x84, 0x40, 0x26, 0x7F, 0xB4, 0x20, 0x26, 0x3F, 0xB4, 0x60, 0x45, 0x80, 0x63, 0xEF, 0x60,
+	 0x58, 0x4D, 0x33, 0x78, 0xFF, 0xFF, 0x15, 0x60, 0xDF, 0xFB, 0x40, 0x63, 0xEF, 0x60, 0x58, 0x4D,
+	 0x33, 0x78, 0xFF, 0xFF, 0x15, 0x60, 0xE0, 0xFB, 0x20, 0x63, 0xEF, 0x60, 0x58, 0x4D, 0x33, 0x78,
+	 0xFF, 0xFF, 0x15, 0x60, 0xE1, 0xFB, 0x10, 0x63, 0xEF, 0x60, 0x58, 0x4D, 0x33, 0x78, 0xFF, 0xFF,
+	 0x15, 0x60, 0xE2, 0xFB, 0x08, 0x63, 0xEF, 0x60, 0x58, 0x4D, 0x33, 0x78, 0xFF, 0xFF, 0x15, 0x60,
+	 0xE3, 0xFB, 0x04, 0x63, 0xEF, 0x60, 0x58, 0x4D, 0x33, 0x78, 0xFF, 0xFF, 0x15, 0x60, 0xE4, 0xFB,
+	 0x02, 0x63, 0xEF, 0x60, 0x58, 0x4D, 0x33, 0x78, 0xFF, 0xFF, 0x15, 0x60, 0xE5, 0xFB, 0x01, 0x63,
+	 0xEF, 0x60, 0x58, 0x4D, 0x33, 0x78, 0xFF, 0xFF, 0x15, 0x60, 0xE6, 0xFB, 0x2E, 0x58, 0xFF, 0xFF,
+	 0x15, 0x60, 0xBE, 0xF3, 0xFF, 0xFF, 0x0F, 0xB4, 0x60, 0x45, 0x08, 0x63, 0xEF, 0x60, 0x58, 0x4D,
+	 0x5E, 0x78, 0xFF, 0xFF, 0x15, 0x60, 0xE7, 0xFB, 0x04, 0x63, 0xEF, 0x60, 0x58, 0x4D, 0x5E, 0x78,
+	 0xFF, 0xFF, 0x15, 0x60, 0xE8, 0xFB, 0x02, 0x63, 0xEF, 0x60, 0x58, 0x4D, 0x5E, 0x78, 0xFF, 0xFF,
+	 0x15, 0x60, 0xE9, 0xFB, 0x01, 0x63, 0xEF, 0x60, 0x58, 0x4D, 0x5E, 0x78, 0xFF, 0xFF, 0x15, 0x60,
+	 0xEA, 0xFB, 0x2E, 0x58, 0xFF, 0xFF, 0x63, 0x5C, 0xA7, 0x84, 0xEB, 0x83, 0x14, 0x02, 0x01, 0x03,
+	 0xFB, 0x01, 0x64, 0x44, 0x01, 0x36, 0x0B, 0x64, 0x02, 0x36, 0x0B, 0x64, 0x04, 0x36, 0x0A, 0x64,
+	 0x08, 0x36, 0x0A, 0x64, 0x10, 0x36, 0x09, 0x64, 0x20, 0x36, 0x09, 0x64, 0x40, 0x36, 0x09, 0x64,
+	 0x80, 0x36, 0x09, 0x64, 0x11, 0x00, 0x60, 0x40, 0x01, 0x36, 0x0B, 0x64, 0x02, 0x36, 0x0F, 0x64,
+	 0x04, 0x36, 0x0A, 0x64, 0x08, 0x36, 0x0E, 0x64, 0x10, 0x36, 0x09, 0x64, 0x20, 0x36, 0x0D, 0x64,
+	 0x40, 0x36, 0x08, 0x64, 0x80, 0x36, 0x0C, 0x64, 0x2D, 0x58, 0xFF, 0xFF, 0x63, 0x5C, 0xA7, 0x84,
+	 0xEB, 0x83, 0x0C, 0x02, 0x01, 0x03, 0xFB, 0x01, 0x64, 0x44, 0x01, 0x36, 0x0A, 0x64, 0x02, 0x36,
+	 0x14, 0x64, 0x04, 0x36, 0x37, 0x64, 0x08, 0x36, 0x6E, 0x64, 0x09, 0x00, 0x60, 0x40, 0x01, 0x36,
+	 0x0A, 0x64, 0x02, 0x36, 0x14, 0x64, 0x04, 0x36, 0x37, 0x64, 0x08, 0x36, 0x6E, 0x64, 0x2D, 0x58,
+	 0xFF, 0xFF, 0x60, 0xFE, 0x81, 0xA1, 0x7F, 0xA1, 0x02, 0x06, 0x00, 0xF4, 0x03, 0x61, 0x5D, 0xD2,
+	 0xCF, 0x83, 0xD4, 0x80, 0x25, 0x03, 0x16, 0x03, 0xCF, 0x83, 0x61, 0x44, 0x80, 0xA0, 0x20, 0x03,
+	 0x02, 0x02, 0x00, 0xF4, 0x03, 0x61, 0x5D, 0xD2, 0xCF, 0x83, 0x81, 0xA1, 0x19, 0x03, 0x05, 0x07,
+	 0x7F, 0xA1, 0xCC, 0x84, 0xDD, 0x81, 0xE6, 0x03, 0xF7, 0x01, 0x00, 0xF4, 0x00, 0xB8, 0x04, 0x61,
+	 0xE6, 0x03, 0xF2, 0x01, 0x2C, 0x43, 0x5D, 0xD0, 0xDE, 0xD9, 0x64, 0x44, 0x5D, 0xD0, 0xDE, 0xD9,
+	 0xCC, 0x84, 0x81, 0xA1, 0x05, 0x03, 0x7F, 0xA1, 0xF9, 0x04, 0x00, 0xF4, 0x03, 0x61, 0xF6, 0x01,
+	 0x20, 0xFE, 0x2E, 0x58, 0xFF, 0xFF, 0x01, 0x3A, 0x02, 0x00, 0x16, 0x64, 0x2B, 0x00, 0x02, 0x3A,
+	 0x02, 0x00, 0x14, 0x64, 0x27, 0x00, 0x04, 0x3A, 0x02, 0x00, 0x12, 0x64, 0x23, 0x00, 0x08, 0x3A,
+	 0x02, 0x00, 0x10, 0x64, 0x1F, 0x00, 0x10, 0x3A, 0x02, 0x00, 0x0E, 0x64, 0x1B, 0x00, 0x20, 0x3A,
+	 0x02, 0x00, 0x0C, 0x64, 0x17, 0x00, 0x40, 0x3A, 0x02, 0x00, 0x0A, 0x64, 0x13, 0x00, 0x80, 0x3A,
+	 0x02, 0x00, 0x08, 0x64, 0x0F, 0x00, 0x01, 0x3B, 0x02, 0x00, 0x06, 0x64, 0x0B, 0x00, 0x02, 0x3B,
+	 0x02, 0x00, 0x04, 0x64, 0x07, 0x00, 0x04, 0x3B, 0x02, 0x00, 0x02, 0x64, 0x03, 0x00, 0x08, 0x3B,
+	 0xFF, 0x01, 0x00, 0x64, 0x2E, 0x58, 0xFF, 0xFF, 0x27, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x36, 0x3A,
+	 0x02, 0x00, 0x00, 0x61, 0x2C, 0x00, 0x30, 0x3A, 0x02, 0x00, 0x02, 0x61, 0x28, 0x00, 0x24, 0x3A,
+	 0x02, 0x00, 0x04, 0x61, 0x24, 0x00, 0x18, 0x3A, 0x02, 0x00, 0x06, 0x61, 0x20, 0x00, 0x12, 0x3A,
+	 0x02, 0x00, 0x08, 0x61, 0x1C, 0x00, 0x0C, 0x3A, 0x02, 0x00, 0x0A, 0x61, 0x18, 0x00, 0x09, 0x3A,
+	 0x02, 0x00, 0x0C, 0x61, 0x14, 0x00, 0x06, 0x3A, 0x02, 0x00, 0x0E, 0x61, 0x10, 0x00, 0x6E, 0x3A,
+	 0x02, 0x00, 0x10, 0x61, 0x0C, 0x00, 0x37, 0x3A, 0x02, 0x00, 0x12, 0x61, 0x08, 0x00, 0x14, 0x3A,
+	 0x02, 0x00, 0x14, 0x61, 0x04, 0x00, 0x0A, 0x3A, 0xFF, 0xFF, 0x16, 0x61, 0x00, 0x00, 0x65, 0x40,
+	 0x01, 0x3A, 0x13, 0x00, 0x66, 0x45, 0x2B, 0x46, 0x92, 0xFA, 0x65, 0x46, 0x26, 0xF2, 0xFF, 0xFF,
+	 0x60, 0x41, 0x00, 0x7F, 0x60, 0x45, 0x61, 0x47, 0x00, 0x7F, 0xD4, 0x84, 0x66, 0x41, 0x2B, 0x46,
+	 0x0E, 0xF2, 0x60, 0x45, 0x65, 0x5E, 0x0E, 0xFA, 0x61, 0x46, 0x2E, 0x58, 0xFF, 0xFF, 0xCD, 0x81,
+	 0x7F, 0xB4, 0x02, 0x3A, 0x02, 0x00, 0x01, 0x64, 0x2E, 0x00, 0x04, 0x3A, 0x02, 0x00, 0x02, 0x64,
+	 0x2A, 0x00, 0x0B, 0x3A, 0x02, 0x00, 0x04, 0x64, 0x26, 0x00, 0x16, 0x3A, 0x02, 0x00, 0x08, 0x64,
+	 0x22, 0x00, 0x0C, 0x3A, 0x02, 0x00, 0x10, 0x64, 0x1E, 0x00, 0x12, 0x3A, 0x02, 0x00, 0x20, 0x64,
+	 0x1A, 0x00, 0x18, 0x3A, 0x02, 0x00, 0x40, 0x64, 0x16, 0x00, 0x24, 0x3A, 0x02, 0x00, 0x80, 0x64,
+	 0x12, 0x00, 0x30, 0x3A, 0x02, 0x00, 0x01, 0x7F, 0x0E, 0x00, 0x48, 0x3A, 0x02, 0x00, 0x02, 0x7F,
+	 0x0A, 0x00, 0x60, 0x3A, 0x02, 0x00, 0x04, 0x7F, 0x06, 0x00, 0x6C, 0x3A, 0x02, 0x00, 0x08, 0x7F,
+	 0x02, 0x00, 0x00, 0x64, 0x00, 0x00, 0x20, 0xFE, 0x2A, 0x45, 0x34, 0x8A, 0x60, 0xFE, 0x61, 0x40,
+	 0x00, 0x36, 0x02, 0x00, 0xBD, 0xD3, 0xC3, 0x01, 0x2E, 0x58, 0xFF, 0xFF, 0x53, 0xFB, 0x54, 0xFB,
+	 0x00, 0x60, 0x0C, 0x63, 0x14, 0x60, 0xEC, 0x62, 0x00, 0x64, 0x5A, 0xDB, 0xFE, 0x1F, 0x02, 0x64,
+	 0x0A, 0x60, 0x78, 0xFB, 0x2E, 0x58, 0xFF, 0xFF, 0x0A, 0x60, 0x7A, 0xF3, 0x00, 0x63, 0xF0, 0xA0,
+	 0x01, 0xA4, 0x03, 0x03, 0xA2, 0xDB, 0x2E, 0x58, 0xFF, 0xFF, 0xA2, 0xDD, 0x0A, 0x60, 0x7B, 0xF1,
+	 0xA2, 0xDD, 0x5A, 0xD3, 0xA2, 0xDD, 0xC0, 0x81, 0x61, 0x44, 0x02, 0x24, 0xFF, 0xFF, 0xE9, 0x81,
+	 0xE9, 0x81, 0xE9, 0x81, 0xE9, 0x81, 0x5A, 0xD3, 0xE9, 0x81, 0xE8, 0x83, 0xEB, 0x83, 0xEB, 0x83,
+	 0xEB, 0x83, 0xEB, 0x85, 0xD4, 0x85, 0xC5, 0x83, 0xA2, 0xDD, 0x63, 0x47, 0x00, 0x7F, 0x0A, 0x60,
+	 0x77, 0xFB, 0x2E, 0x58, 0xFF, 0xFF, 0x7F, 0x67, 0x01, 0x61, 0x23, 0x58, 0xFF, 0xFF, 0xB1, 0xFE,
+	 0x05, 0x05, 0xB0, 0xFE, 0x06, 0x05, 0xB2, 0xFE, 0xB3, 0xFE, 0x21, 0x00, 0xF7, 0x60, 0x38, 0x78,
+	 0xFF, 0xFF, 0x28, 0xF3, 0x29, 0xF1, 0x40, 0x44, 0x44, 0x45, 0x2A, 0xF1, 0x2B, 0xF1, 0x44, 0x46,
+	 0x44, 0x47, 0x3F, 0xB4, 0xE0, 0x85, 0x19, 0x60, 0x06, 0x64, 0x44, 0xD7, 0x58, 0x43, 0xFF, 0xFF,
+	 0x60, 0x45, 0x0A, 0x60, 0x7E, 0xF3, 0x61, 0x43, 0x04, 0xB4, 0x24, 0x44, 0x02, 0x03, 0x13, 0xFF,
+	 0x06, 0x00, 0x3F, 0xB4, 0xB4, 0x84, 0xFF, 0x27, 0x05, 0xFD, 0x04, 0xFB, 0x10, 0x75, 0xA1, 0xFF,
+	 0xFF, 0xFF, 0x86, 0x3E, 0xB4, 0xFE, 0x09, 0x05, 0xB5, 0xFE, 0x02, 0x24, 0x7F, 0xF7, 0xFF, 0xFF,
+	 0xFF, 0xFF, 0xB7, 0xFE, 0x05, 0x05, 0xB6, 0xFE, 0xF2, 0x01, 0xF7, 0x60, 0x73, 0x78, 0xFF, 0xFF,
+	 0x36, 0x44, 0x00, 0x7F, 0xEE, 0xA0, 0x60, 0x45, 0x05, 0x05, 0x19, 0x60, 0x98, 0x64, 0x44, 0xD7,
+	 0xFF, 0xFF, 0xFF, 0xFF, 0xE4, 0x01, 0xE3, 0x01, 0x7F, 0x60, 0xC0, 0x64, 0x24, 0x45, 0xA4, 0x80,
+	 0x7F, 0x67, 0x02, 0x61, 0x10, 0x02, 0x10, 0x64, 0x40, 0x40, 0x02, 0x64, 0x40, 0x50, 0x61, 0xFF,
+	 0x3F, 0x40, 0x40, 0x26, 0x04, 0x00, 0x10, 0xE0, 0x46, 0x60, 0x09, 0xE0, 0x00, 0x00, 0x27, 0xF1,
+	 0x00, 0x66, 0x20, 0x78, 0x42, 0xFE, 0x23, 0x58, 0xFF, 0xFF, 0x7F, 0x60, 0xC0, 0x64, 0x24, 0x45,
+	 0xA4, 0x80, 0x7F, 0x67, 0x02, 0x61, 0x19, 0x02, 0x0A, 0x60, 0x7E, 0xF3, 0x07, 0x7C, 0x20, 0xB5,
+	 0x0C, 0xB5, 0x04, 0x03, 0x03, 0x02, 0xBC, 0xF9, 0x00, 0x67, 0x0F, 0x00, 0x00, 0x61, 0x41, 0x56,
+	 0xC7, 0xFE, 0xB5, 0x01, 0x36, 0x47, 0xFF, 0x23, 0x04, 0x00, 0x00, 0x7F, 0x60, 0x41, 0x7F, 0x67,
+	 0x04, 0x00, 0x20, 0x44, 0x80, 0xBC, 0x40, 0x40, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x7F, 0x60,
+	 0xC0, 0x64, 0x24, 0x45, 0xA4, 0x80, 0x7F, 0x67, 0x02, 0x61, 0x31, 0x02, 0x0A, 0x60, 0x7E, 0xF3,
+	 0x01, 0x7C, 0x20, 0xB5, 0x0C, 0xB5, 0x03, 0x03, 0x02, 0x02, 0xBC, 0xF9, 0xFF, 0xFF, 0x02, 0x61,
+	 0x41, 0x56, 0xC7, 0xFE, 0xF0, 0x60, 0xC7, 0x78, 0xFF, 0xFF, 0x7D, 0xF1, 0x20, 0x44, 0x64, 0x40,
+	 0xFF, 0x26, 0x1C, 0x00, 0x7F, 0xB4, 0x40, 0x40, 0x5C, 0x5E, 0x82, 0xFF, 0x26, 0x44, 0xFD, 0xB4,
+	 0x40, 0x46, 0x5C, 0x41, 0x87, 0xFF, 0x62, 0xFF, 0x0F, 0x60, 0x85, 0xF3, 0xFF, 0xFF, 0x00, 0xA8,
+	 0x60, 0x46, 0x04, 0x03, 0x09, 0xF2, 0x8F, 0xFC, 0xAC, 0x86, 0xFB, 0x01, 0xD3, 0xF3, 0xFF, 0xFF,
+	 0xFE, 0xB4, 0xD3, 0xFB, 0x06, 0x64, 0x0F, 0x60, 0x9F, 0xFB, 0x2D, 0xFF, 0x00, 0x67, 0x23, 0x58,
+	 0xFF, 0xFF, 0x25, 0x46, 0x01, 0xF2, 0x08, 0xF0, 0x60, 0x47, 0x03, 0xB4, 0x03, 0xAC, 0x7F, 0x67,
+	 0x03, 0x61, 0x08, 0x02, 0x1F, 0x60, 0x26, 0x64, 0x40, 0x4B, 0xF6, 0x60, 0x58, 0x4D, 0xB3, 0x78,
+	 0xFF, 0xFF, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x24, 0x40, 0x01, 0x2B, 0x49, 0x00, 0x25, 0x44,
+	 0x1F, 0xB4, 0xE0, 0x85, 0xF1, 0x60, 0x76, 0x64, 0xC4, 0x98, 0xFF, 0xFF, 0xC0, 0xFE, 0x3D, 0x00,
+	 0xC1, 0xFE, 0x3B, 0x00, 0xC2, 0xFE, 0x39, 0x00, 0xC3, 0xFE, 0x37, 0x00, 0xC4, 0xFE, 0x35, 0x00,
+	 0xC5, 0xFE, 0x33, 0x00, 0xC6, 0xFE, 0x31, 0x00, 0xC7, 0xFE, 0x2F, 0x00, 0xC8, 0xFE, 0x2D, 0x00,
+	 0xC9, 0xFE, 0x2B, 0x00, 0xCA, 0xFE, 0x29, 0x00, 0xCB, 0xFE, 0x27, 0x00, 0xCC, 0xFE, 0x25, 0x00,
+	 0xCD, 0xFE, 0x23, 0x00, 0xCE, 0xFE, 0x21, 0x00, 0xCF, 0xFE, 0x1F, 0x00, 0xD0, 0xFE, 0x1D, 0x00,
+	 0xD1, 0xFE, 0x1B, 0x00, 0xD2, 0xFE, 0x19, 0x00, 0xD3, 0xFE, 0x17, 0x00, 0xD4, 0xFE, 0x15, 0x00,
+	 0xD5, 0xFE, 0x13, 0x00, 0xD6, 0xFE, 0x11, 0x00, 0xD7, 0xFE, 0x0F, 0x00, 0xD8, 0xFE, 0x0D, 0x00,
+	 0xD9, 0xFE, 0x0B, 0x00, 0xDA, 0xFE, 0x09, 0x00, 0xDB, 0xFE, 0x07, 0x00, 0xDC, 0xFE, 0x05, 0x00,
+	 0xDD, 0xFE, 0x03, 0x00, 0xDE, 0xFE, 0x01, 0x00, 0xDF, 0xFE, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF,
+	 0x00, 0x64, 0x9F, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x9E, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x9D, 0xFE,
+	 0xF0, 0x84, 0xFF, 0xFF, 0x9C, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x9B, 0xFE, 0xF0, 0x84, 0xFF, 0xFF,
+	 0x9A, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x99, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x98, 0xFE, 0xF0, 0x84,
+	 0xFF, 0xFF, 0x97, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x96, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x95, 0xFE,
+	 0xF0, 0x84, 0xFF, 0xFF, 0x94, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x93, 0xFE, 0xF0, 0x84, 0xFF, 0xFF,
+	 0x92, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x91, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x90, 0xFE, 0xF0, 0x84,
+	 0x06, 0xFB, 0x8F, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x8E, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x8D, 0xFE,
+	 0xF0, 0x84, 0xFF, 0xFF, 0x8C, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x8B, 0xFE, 0xF0, 0x84, 0xFF, 0xFF,
+	 0x8A, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x89, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x88, 0xFE, 0xF0, 0x84,
+	 0xFF, 0xFF, 0x87, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x86, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x85, 0xFE,
+	 0xF0, 0x84, 0xFF, 0xFF, 0x84, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x83, 0xFE, 0xF0, 0x84, 0xFF, 0xFF,
+	 0x82, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x81, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x80, 0xFE, 0xF0, 0x84,
+	 0x05, 0xFB, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x5C, 0x5C, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF,
+	 0x24, 0x40, 0x01, 0x27, 0x55, 0x00, 0x05, 0x60, 0x00, 0x63, 0x05, 0xFD, 0x30, 0x44, 0xBD, 0xDB,
+	 0x31, 0x44, 0xBD, 0xDB, 0x32, 0x44, 0xBD, 0xDB, 0x33, 0x44, 0xBD, 0xDB, 0x34, 0x44, 0xBD, 0xDB,
+	 0x35, 0x44, 0xBD, 0xDB, 0x36, 0x44, 0xBD, 0xDB, 0x37, 0x44, 0xBD, 0xDB, 0x38, 0x44, 0xBD, 0xDB,
+	 0x39, 0x44, 0xBD, 0xDB, 0x3A, 0x44, 0xBD, 0xDB, 0x3B, 0x44, 0xBD, 0xDB, 0x3C, 0x44, 0xBD, 0xDB,
+	 0x3D, 0x44, 0xBD, 0xDB, 0x3E, 0x44, 0xBD, 0xDB, 0x3F, 0x44, 0xBD, 0xDB, 0x02, 0x61, 0x61, 0x44,
+	 0x02, 0x36, 0x82, 0xFF, 0x03, 0x36, 0x83, 0xFF, 0x04, 0x36, 0x84, 0xFF, 0x05, 0x36, 0x85, 0xFF,
+	 0x06, 0x36, 0x86, 0xFF, 0x07, 0x36, 0x87, 0xFF, 0x20, 0x44, 0xBD, 0xDB, 0x21, 0x44, 0xBD, 0xDB,
+	 0x22, 0x44, 0xBD, 0xDB, 0x23, 0x44, 0xBD, 0xDB, 0x24, 0x44, 0xBD, 0xDB, 0x25, 0x44, 0xBD, 0xDB,
+	 0x26, 0x44, 0xBD, 0xDB, 0x27, 0x44, 0xBD, 0xDB, 0x28, 0x44, 0xBD, 0xDB, 0x29, 0x44, 0xBD, 0xDB,
+	 0x2A, 0x44, 0xBD, 0xDB, 0x2B, 0x44, 0xBD, 0xDB, 0x2C, 0x44, 0xBD, 0xDB, 0x2D, 0x44, 0xBD, 0xDB,
+	 0x2E, 0x44, 0xBD, 0xDB, 0x2F, 0x44, 0xBD, 0xDB, 0xDD, 0x81, 0x08, 0x3A, 0xD0, 0x01, 0x54, 0x00,
+	 0x27, 0x40, 0x10, 0x26, 0x30, 0x00, 0x26, 0x44, 0x01, 0x36, 0x2D, 0x00, 0x02, 0x36, 0x82, 0xFF,
+	 0x03, 0x36, 0x83, 0xFF, 0x04, 0x36, 0x84, 0xFF, 0x05, 0x36, 0x85, 0xFF, 0x06, 0x36, 0x86, 0xFF,
+	 0x25, 0x44, 0x00, 0x36, 0x44, 0x40, 0x01, 0x36, 0x44, 0x41, 0x02, 0x36, 0x44, 0x42, 0x03, 0x36,
+	 0x44, 0x43, 0x04, 0x36, 0x44, 0x44, 0x05, 0x36, 0x44, 0x45, 0x06, 0x36, 0x44, 0x46, 0x07, 0x36,
+	 0x44, 0x47, 0x08, 0x36, 0x44, 0x48, 0x09, 0x36, 0x44, 0x49, 0x0A, 0x36, 0x44, 0x4A, 0x0B, 0x36,
+	 0x44, 0x4B, 0x0C, 0x36, 0x44, 0x4C, 0x0D, 0x36, 0x44, 0x4D, 0x0E, 0x36, 0x44, 0x4E, 0x0F, 0x36,
+	 0x44, 0x4F, 0x87, 0xFF, 0x21, 0x00, 0x25, 0x44, 0x10, 0x36, 0x44, 0x50, 0x11, 0x36, 0x44, 0x51,
+	 0x12, 0x36, 0x44, 0x52, 0x13, 0x36, 0x44, 0x53, 0x14, 0x36, 0x44, 0x54, 0x15, 0x36, 0x44, 0x55,
+	 0x16, 0x36, 0x44, 0x56, 0x17, 0x36, 0x44, 0x57, 0x18, 0x36, 0x44, 0x58, 0x19, 0x36, 0x44, 0x59,
+	 0x1A, 0x36, 0x44, 0x5A, 0x1B, 0x36, 0x44, 0x5B, 0x1C, 0x36, 0x44, 0x5C, 0x1D, 0x36, 0x44, 0x5D,
+	 0x1E, 0x36, 0x44, 0x5E, 0x1F, 0x36, 0x44, 0x5F, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x25, 0x46,
+	 0xB5, 0x60, 0x58, 0x4F, 0x4B, 0x78, 0xFF, 0xFF, 0x03, 0x61, 0x7F, 0x67, 0x0A, 0x02, 0x00, 0xF0,
+	 0x04, 0x64, 0x0F, 0x60, 0x93, 0xFB, 0x5A, 0xD9, 0x0A, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF,
+	 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x40, 0x60, 0xC0, 0x64, 0x24, 0x45, 0xA4, 0x80, 0x7F, 0x67,
+	 0x02, 0x61, 0x12, 0x02, 0x14, 0x64, 0x0F, 0x60, 0x9F, 0xFB, 0x00, 0x60, 0x50, 0x63, 0x5A, 0xDD,
+	 0xF2, 0x60, 0xF7, 0x64, 0x7F, 0xFB, 0x2D, 0xFF, 0xF0, 0x60, 0xC7, 0x78, 0xFF, 0xFF, 0x2A, 0xF3,
+	 0x05, 0xFB, 0x2B, 0xF3, 0x06, 0xFB, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x40, 0x60, 0xC0, 0x64,
+	 0x24, 0x45, 0xA4, 0x80, 0x7F, 0x67, 0x02, 0x61, 0x0E, 0x02, 0x16, 0x64, 0x0F, 0x60, 0x9F, 0xFB,
+	 0x00, 0x60, 0x50, 0x63, 0x5A, 0xDD, 0xF3, 0x60, 0x12, 0x64, 0x7F, 0xFB, 0x2D, 0xFF, 0xF0, 0x60,
+	 0xC7, 0x78, 0xFF, 0xFF, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x7F, 0x60, 0xC0, 0x64, 0x24, 0x45,
+	 0xA4, 0x80, 0x02, 0x61, 0x35, 0x02, 0x25, 0x45, 0xF1, 0x60, 0x02, 0x64, 0xD4, 0x80, 0xFF, 0xFF,
+	 0x34, 0x03, 0xF1, 0x60, 0x00, 0x64, 0xD4, 0x80, 0xFF, 0xFF, 0x01, 0x03, 0x28, 0x00, 0x15, 0x60,
+	 0xC3, 0xF1, 0x99, 0xF3, 0x19, 0x60, 0x00, 0x61, 0xA0, 0x84, 0xA1, 0xDB, 0x25, 0x45, 0x1E, 0x60,
+	 0x96, 0x63, 0x01, 0x61, 0xBD, 0xD3, 0xBD, 0xD1, 0xD4, 0x80, 0xBD, 0xD3, 0xBD, 0xD5, 0xCD, 0x81,
+	 0x02, 0x03, 0x15, 0x03, 0xF7, 0x01, 0xA2, 0xFF, 0xA6, 0xD3, 0x40, 0x4C, 0x00, 0xA8, 0x67, 0x43,
+	 0x0C, 0x02, 0xA2, 0xDD, 0x42, 0x48, 0x64, 0x41, 0xB5, 0x60, 0x58, 0x4D, 0xA2, 0x78, 0xFF, 0xFF,
+	 0x66, 0x44, 0x28, 0xDB, 0x02, 0x03, 0x2C, 0x58, 0xA3, 0xFF, 0x0C, 0x61, 0x03, 0x00, 0x04, 0x61,
+	 0x7F, 0x67, 0x01, 0x00, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0xF1, 0x60, 0x02, 0x64, 0xD4, 0x80,
+	 0x7F, 0x67, 0x06, 0x63, 0xF8, 0x02, 0x31, 0x40, 0x21, 0x2A, 0xF5, 0x01, 0x01, 0x64, 0x0C, 0x60,
+	 0x82, 0xFB, 0xFF, 0xFF, 0xC4, 0xFE, 0xEE, 0x01, 0xC6, 0xFE, 0xEC, 0x01, 0x7E, 0x60, 0xC0, 0x64,
+	 0x24, 0x45, 0xA4, 0x80, 0x02, 0x61, 0x3F, 0x02, 0x25, 0x45, 0xF8, 0x2B, 0x3B, 0x00, 0x2E, 0xF5,
+	 0x67, 0x44, 0xD4, 0x80, 0x19, 0x60, 0xAA, 0x63, 0x39, 0x03, 0x7E, 0x61, 0x24, 0x44, 0x01, 0x27,
+	 0x29, 0x00, 0xA3, 0xFC, 0xA4, 0xF8, 0xBD, 0xD3, 0xA3, 0xD1, 0xD4, 0x80, 0xCD, 0x81, 0x08, 0x24,
+	 0x64, 0x58, 0x08, 0xA3, 0xF8, 0x02, 0x08, 0x60, 0x00, 0x63, 0xBD, 0xD3, 0xA3, 0xD1, 0xFE, 0xA0,
+	 0xFA, 0x60, 0x00, 0x64, 0xD0, 0x80, 0x14, 0x02, 0x13, 0x02, 0x04, 0xA3, 0xBE, 0xD3, 0xBD, 0xD1,
+	 0x0F, 0x18, 0xD4, 0x80, 0x0D, 0x18, 0x03, 0x03, 0xC3, 0x83, 0xC3, 0x83, 0xF7, 0x01, 0x64, 0x41,
+	 0xDD, 0x81, 0xE1, 0x81, 0xCB, 0x83, 0x46, 0x65, 0xF8, 0x60, 0x58, 0x4F, 0x7A, 0x78, 0xFF, 0xFF,
+	 0x00, 0x67, 0x0A, 0x00, 0xBD, 0xD3, 0xBE, 0xD1, 0xD4, 0x80, 0xCD, 0x81, 0x08, 0x24, 0x64, 0x58,
+	 0x08, 0xA3, 0xF8, 0x02, 0x04, 0x61, 0x7F, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x0F, 0x64, 0x23, 0xFA,
+	 0x67, 0x44, 0x24, 0xFA, 0x62, 0x41, 0x3E, 0x60, 0x00, 0x65, 0x1A, 0x63, 0xF7, 0x60, 0x8C, 0x64,
+	 0x65, 0x46, 0x58, 0xD0, 0x2E, 0xF5, 0x59, 0xD8, 0xFB, 0x1F, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF,
+	 0x4B, 0xD3, 0xFF, 0xFF, 0x60, 0x41, 0xE8, 0x84, 0xDC, 0x84, 0x23, 0xFA, 0xBF, 0xD1, 0x4A, 0x65,
+	 0x64, 0x43, 0xF8, 0x60, 0x58, 0x4F, 0x7A, 0x78, 0xFF, 0xFF, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF,
+	 0x25, 0xF2, 0xFF, 0xFF, 0xE0, 0xA0, 0x20, 0x64, 0x01, 0x06, 0x25, 0xFA, 0x23, 0xF2, 0xDF, 0xD1,
+	 0xCC, 0x84, 0xE0, 0x85, 0x0B, 0x06, 0xBF, 0xD1, 0x64, 0x41, 0xD5, 0x80, 0x64, 0x43, 0x01, 0x06,
+	 0x65, 0x41, 0x4A, 0x65, 0xF4, 0x60, 0x58, 0x4F, 0xBD, 0x78, 0xFF, 0xFF, 0x00, 0x67, 0x23, 0x58,
+	 0xFF, 0xFF, 0xBC, 0xF3, 0x02, 0x63, 0x23, 0xFC, 0x07, 0xB4, 0x25, 0xFA, 0x00, 0x67, 0x23, 0x58,
+	 0xFF, 0xFF, 0x4B, 0xD3, 0xBF, 0xD3, 0x60, 0x41, 0xC9, 0x83, 0xE9, 0x81, 0xDD, 0x81, 0xA3, 0xFA,
+	 0xE0, 0x81, 0x3C, 0x60, 0x00, 0x67, 0x02, 0x24, 0x02, 0xA4, 0x60, 0x47, 0x40, 0x4B, 0xC9, 0x81,
+	 0x4A, 0x65, 0xAB, 0x46, 0x59, 0xD0, 0xAB, 0x46, 0xA5, 0xD8, 0xDA, 0x85, 0x80, 0x3A, 0x02, 0x00,
+	 0x00, 0xF4, 0x04, 0x65, 0xF6, 0x1F, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0xFC, 0xA3, 0xA3, 0xD1,
+	 0x4C, 0x65, 0xA4, 0xD3, 0xDA, 0x83, 0x60, 0x47, 0x25, 0xFA, 0x00, 0x7E, 0x60, 0x47, 0x01, 0x26,
+	 0xDC, 0x84, 0x60, 0x41, 0xE8, 0x84, 0xD8, 0x84, 0x23, 0xFA, 0xAB, 0x01, 0xFC, 0xA3, 0xA3, 0xD1,
+	 0x4C, 0x65, 0xA4, 0xD3, 0xDA, 0x83, 0x00, 0x7F, 0x25, 0xFA, 0x60, 0x41, 0x01, 0x26, 0xDD, 0x81,
+	 0xE9, 0x84, 0xD8, 0x84, 0x23, 0xFA, 0x9D, 0x01, 0x23, 0xF2, 0x25, 0xF2, 0x02, 0xA8, 0xF8, 0xA0,
+	 0x0F, 0x02, 0xEC, 0xA0, 0x0D, 0x04, 0x0C, 0x07, 0x15, 0x60, 0xD2, 0xF1, 0xFF, 0xFF, 0xD0, 0x80,
+	 0xFF, 0xFF, 0x04, 0x07, 0x15, 0x60, 0xD2, 0xFB, 0x15, 0x60, 0xD6, 0xFB, 0x13, 0x60, 0x5B, 0xFB,
+	 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x23, 0xF2, 0x14, 0x60, 0xEE, 0x65, 0x60, 0x41, 0x14, 0x60,
+	 0x8A, 0x63, 0xA3, 0xDB, 0xFF, 0xA1, 0x48, 0x64, 0x58, 0xD0, 0x7E, 0xA8, 0x5B, 0xD9, 0x02, 0x02,
+	 0x00, 0xF4, 0x02, 0x64, 0xFF, 0xA1, 0xD7, 0x80, 0x02, 0x03, 0x01, 0x03, 0xF5, 0x01, 0x2E, 0xF5,
+	 0x00, 0x60, 0x2F, 0x65, 0x25, 0xF2, 0x00, 0x63, 0xCC, 0x84, 0x03, 0xA3, 0xFD, 0x05, 0x4A, 0x64,
+	 0xD7, 0x80, 0x14, 0x60, 0x26, 0x61, 0x18, 0x05, 0xA1, 0xDD, 0xE3, 0x83, 0xFE, 0xA3, 0x58, 0xD0,
+	 0x7E, 0xA8, 0x59, 0xD9, 0x02, 0x02, 0x00, 0xF4, 0x02, 0x64, 0xF9, 0x1F, 0x00, 0x63, 0x59, 0xDD,
+	 0x2E, 0xF5, 0x25, 0xF0, 0x0A, 0x60, 0x13, 0xF3, 0xD3, 0x80, 0x01, 0xB0, 0x04, 0x03, 0x01, 0xA4,
+	 0x03, 0x03, 0xA2, 0xDB, 0x01, 0x00, 0xA2, 0xDD, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x14, 0x60,
+	 0x8A, 0x61, 0xA1, 0xD3, 0x23, 0xFA, 0xE0, 0x83, 0x4A, 0x65, 0x04, 0x02, 0x02, 0x63, 0x23, 0xFC,
+	 0xA5, 0xFC, 0x09, 0x00, 0xDB, 0x83, 0x59, 0xD1, 0xA5, 0xD8, 0xDA, 0x85, 0x80, 0x3A, 0x02, 0x00,
+	 0x00, 0xF4, 0x04, 0x65, 0xF8, 0x1F, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x0A, 0x60, 0x13, 0xF3,
+	 0x00, 0x61, 0x02, 0xA4, 0xFE, 0xA0, 0x23, 0xFA, 0x1B, 0x03, 0xFA, 0xA4, 0xFD, 0xA4, 0x01, 0xA1,
+	 0xFD, 0x07, 0x61, 0x43, 0x23, 0xF2, 0x25, 0xFC, 0xE0, 0x83, 0x02, 0xA3, 0x14, 0x60, 0x26, 0x61,
+	 0x00, 0x60, 0x4A, 0x64, 0x59, 0xD1, 0x58, 0xD8, 0x7E, 0x3A, 0x02, 0x00, 0x00, 0xF4, 0x02, 0x64,
+	 0xF9, 0x1F, 0x25, 0xF2, 0x23, 0xF2, 0x01, 0xB0, 0xCC, 0x84, 0x04, 0x02, 0x23, 0xFA, 0x02, 0x00,
+	 0x00, 0x64, 0x25, 0xFA, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x41, 0x4B, 0x65, 0x42, 0x80, 0x64,
+	 0xD4, 0x85, 0x2B, 0x41, 0x00, 0xA1, 0x55, 0x8B, 0x0D, 0x03, 0x02, 0x04, 0x65, 0x41, 0x02, 0x00,
+	 0x00, 0x64, 0x40, 0x4B, 0xCA, 0x84, 0x58, 0xD0, 0xC9, 0x81, 0xBD, 0xD9, 0xFC, 0x02, 0x00, 0xF4,
+	 0x04, 0x65, 0xEC, 0x01, 0x2F, 0x58, 0xFF, 0xFF, 0xFC, 0xA3, 0xA3, 0xD3, 0x02, 0x7C, 0xA0, 0xD3,
+	 0x23, 0xF8, 0xDC, 0x84, 0x25, 0xFA, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x02, 0x64, 0x23, 0xFA,
+	 0x01, 0x64, 0x9D, 0xFE, 0x02, 0x28, 0x02, 0x64, 0x25, 0xFA, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF,
+	 0x02, 0x7C, 0x23, 0xF8, 0x01, 0x64, 0x25, 0xFA, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0xFC, 0xA3,
+	 0xA3, 0xD1, 0x02, 0x64, 0x23, 0xFA, 0x64, 0x44, 0x7C, 0x5F, 0x60, 0x45, 0x64, 0x47, 0x7C, 0x5F,
+	 0x88, 0xF1, 0x66, 0x41, 0xC0, 0x86, 0xA5, 0xD2, 0x61, 0x46, 0x25, 0xFA, 0x00, 0x67, 0x23, 0x58,
+	 0xFF, 0xFF, 0x02, 0x64, 0x23, 0xFA, 0x88, 0xFF, 0x75, 0x44, 0x8D, 0xFF, 0xE8, 0x87, 0xE8, 0x84,
+	 0xE8, 0x84, 0x03, 0xB4, 0x25, 0xFA, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x05, 0x64, 0x23, 0xFA,
+	 0x52, 0x63, 0x96, 0xF3, 0x4B, 0xDA, 0x95, 0xF3, 0x4B, 0xDA, 0x94, 0xF3, 0x4B, 0xDA, 0x60, 0x41,
+	 0x88, 0xFF, 0x72, 0x5C, 0x89, 0xFF, 0x4A, 0xD8, 0xA2, 0x48, 0x20, 0x23, 0x0E, 0x00, 0x64, 0x40,
+	 0x80, 0x27, 0x15, 0x00, 0xDC, 0x84, 0xBD, 0xDA, 0xBD, 0xD2, 0x11, 0x04, 0xDC, 0x84, 0xA2, 0xDA,
+	 0xA3, 0xD2, 0x0D, 0x04, 0xDC, 0x84, 0xA3, 0xDA, 0x0A, 0x00, 0x52, 0x63, 0x96, 0xF3, 0x4B, 0xDA,
+	 0x95, 0xF3, 0x4B, 0xDA, 0x94, 0xF3, 0x4B, 0xDA, 0x54, 0x90, 0x4C, 0x63, 0xE0, 0x02, 0x00, 0x67,
+	 0x23, 0x58, 0xFF, 0xFF, 0x25, 0xF0, 0x23, 0xF2, 0x15, 0x60, 0xC9, 0xF9, 0x02, 0xA8, 0x64, 0x44,
+	 0x1F, 0x02, 0x3F, 0x40, 0x02, 0x2B, 0x16, 0x00, 0x00, 0x37, 0x14, 0x00, 0x01, 0x3B, 0x18, 0x00,
+	 0x11, 0x60, 0xF9, 0x65, 0x11, 0x60, 0x19, 0x63, 0xFF, 0xB7, 0x60, 0x5C, 0xA3, 0xD3, 0x08, 0xA3,
+	 0x00, 0x7E, 0xD0, 0x80, 0xD7, 0x80, 0x03, 0x03, 0xF9, 0x02, 0x7F, 0x67, 0x0A, 0x00, 0xF4, 0xA3,
+	 0xA3, 0xD1, 0x04, 0x00, 0x00, 0xBC, 0xF2, 0xA4, 0x03, 0x03, 0x02, 0x07, 0x13, 0x60, 0x52, 0xF9,
+	 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x20, 0x63, 0x27, 0x60, 0x06, 0x61, 0x48, 0x64, 0x58, 0xD0,
+	 0x59, 0xD9, 0xFD, 0x1F, 0x25, 0xF0, 0x20, 0x64, 0xD0, 0x81, 0xFF, 0xFF, 0x02, 0x07, 0x25, 0xFA,
+	 0x0F, 0x00, 0x27, 0x60, 0x0A, 0x63, 0xC3, 0x83, 0x01, 0x2A, 0x06, 0x00, 0xCF, 0x83, 0xA3, 0xD3,
+	 0xCD, 0x81, 0x00, 0x7F, 0xBD, 0xDB, 0x04, 0x03, 0x00, 0x64, 0xC9, 0x81, 0xBD, 0xDB, 0xFD, 0x02,
+	 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x23, 0xF2, 0x25, 0xF0, 0x01, 0x60, 0x6E, 0x63, 0x7F, 0x67,
+	 0x3A, 0x18, 0xA3, 0xD9, 0x26, 0xF0, 0x7F, 0x67, 0x36, 0x18, 0x5B, 0xD9, 0x13, 0x60, 0x0A, 0xF3,
+	 0x25, 0xF0, 0x60, 0x40, 0x03, 0x3A, 0x2E, 0x00, 0x86, 0xF3, 0x87, 0xF3, 0x60, 0x43, 0xE3, 0x83,
+	 0x60, 0x46, 0x0F, 0xF8, 0x30, 0x61, 0x94, 0xFA, 0x01, 0x61, 0x91, 0xFA, 0x16, 0x64, 0x12, 0xFA,
+	 0x60, 0x40, 0x10, 0x36, 0x05, 0x00, 0x12, 0x36, 0x08, 0x00, 0x0C, 0x36, 0x0B, 0x00, 0x0F, 0x00,
+	 0x40, 0x61, 0xA1, 0x80, 0x0A, 0x64, 0x11, 0x02, 0xF3, 0x01, 0x10, 0x61, 0xA1, 0x80, 0x0E, 0x64,
+	 0x0C, 0x02, 0xEE, 0x01, 0x08, 0x61, 0xA1, 0x80, 0x10, 0x64, 0x07, 0x02, 0xE9, 0x01, 0xE1, 0x81,
+	 0xA1, 0x80, 0x05, 0x05, 0xC8, 0x84, 0x01, 0x02, 0xE3, 0x01, 0x12, 0xFA, 0x91, 0xFA, 0x66, 0x44,
+	 0x02, 0xA6, 0xD7, 0x1F, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0xFC, 0xA3, 0xA5, 0xF0, 0xA3, 0xD1,
+	 0xFF, 0xFF, 0x64, 0x5E, 0x00, 0x7F, 0x60, 0x41, 0x64, 0x47, 0x7C, 0x5F, 0x88, 0xF1, 0x66, 0x43,
+	 0xC0, 0x86, 0x65, 0x44, 0xA1, 0xDA, 0x63, 0x46, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0xFC, 0xA3,
+	 0xA3, 0xD1, 0xFF, 0xFF, 0x64, 0x5E, 0x00, 0x7F, 0x60, 0x45, 0x64, 0x47, 0x7C, 0x5F, 0x88, 0xF1,
+	 0x66, 0x41, 0xC0, 0x86, 0x65, 0x44, 0xA0, 0xD2, 0x61, 0x46, 0x25, 0xFA, 0x02, 0x64, 0x23, 0xFA,
+	 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x25, 0xF2, 0x15, 0x60, 0xC8, 0xFB, 0xFF, 0xFF, 0x00, 0x67,
+	 0x23, 0x58, 0xFF, 0xFF, 0x23, 0xF2, 0x25, 0xF0, 0x02, 0xA8, 0x00, 0x67, 0x02, 0x02, 0x2D, 0xF9,
+	 0x2C, 0xF9, 0x23, 0x58, 0xFF, 0xFF, 0x23, 0xF2, 0x25, 0xF2, 0x02, 0xA8, 0x00, 0xA8, 0x0A, 0x02,
+	 0x07, 0x03, 0xD0, 0xA0, 0x30, 0x65, 0x03, 0x04, 0xA7, 0xA0, 0x59, 0x65, 0x01, 0x06, 0x65, 0x44,
+	 0x13, 0x60, 0x51, 0xFB, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x25, 0xF2, 0x15, 0x60, 0xCF, 0xFB,
+	 0xFF, 0xFF, 0x08, 0x2A, 0x25, 0x00, 0x15, 0x60, 0xDD, 0xF3, 0xFF, 0xFF, 0xE9, 0xB4, 0x60, 0x44,
+	 0x15, 0x60, 0xCF, 0xF1, 0xFF, 0xFF, 0x64, 0x40, 0x01, 0x26, 0x02, 0xBC, 0x64, 0x40, 0x02, 0x2A,
+	 0x04, 0xBC, 0x64, 0x40, 0x04, 0x26, 0x08, 0x00, 0x15, 0x60, 0xDD, 0xFB, 0x13, 0x64, 0xAD, 0xFB,
+	 0x01, 0x60, 0x67, 0x64, 0x37, 0xFB, 0x0C, 0x00, 0x10, 0xBC, 0x15, 0x60, 0xDD, 0xFB, 0x08, 0x64,
+	 0xAD, 0xFB, 0x82, 0xF3, 0x01, 0x60, 0x67, 0x7C, 0x60, 0x40, 0x01, 0x27, 0x5B, 0x7C, 0x37, 0xF9,
+	 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x25, 0xF2, 0x15, 0x60, 0xD0, 0xFB, 0x00, 0x67, 0x23, 0x58,
+	 0xFF, 0xFF, 0x25, 0xF2, 0x15, 0x60, 0xD1, 0xFB, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x25, 0xF2,
+	 0x15, 0x60, 0xEB, 0xFB, 0xFF, 0xFF, 0x0F, 0x22, 0x41, 0x75, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF,
+	 0x04, 0x61, 0x06, 0x00, 0x01, 0x64, 0x01, 0x00, 0x00, 0x64, 0x18, 0x60, 0x13, 0xFB, 0x06, 0x61,
+	 0x41, 0x56, 0xC7, 0xFE, 0xF0, 0x60, 0xC7, 0x78, 0xFF, 0xFF, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF,
+	 0x78, 0x60, 0xC0, 0x64, 0x24, 0x45, 0xA4, 0x80, 0x7F, 0x67, 0x02, 0x61, 0x10, 0x02, 0x08, 0x61,
+	 0x41, 0x56, 0xC7, 0xFE, 0xF0, 0x60, 0xC7, 0x78, 0xFF, 0xFF, 0x36, 0x47, 0xFF, 0x23, 0x04, 0x00,
+	 0x00, 0x7F, 0x60, 0x41, 0x7F, 0x67, 0x03, 0x00, 0x04, 0x7C, 0xBC, 0xF9, 0x00, 0x67, 0x23, 0x58,
+	 0xFF, 0xFF, 0x78, 0x60, 0xC0, 0x64, 0x24, 0x45, 0xA4, 0x80, 0x7F, 0x67, 0x02, 0x61, 0x10, 0x02,
+	 0x0A, 0x61, 0x41, 0x56, 0xC7, 0xFE, 0xF0, 0x60, 0xC7, 0x78, 0xFF, 0xFF, 0x36, 0x47, 0xFF, 0x23,
+	 0x04, 0x00, 0x00, 0x7F, 0x60, 0x41, 0x7F, 0x67, 0x03, 0x00, 0x01, 0x7C, 0xBC, 0xF9, 0x00, 0x67,
+	 0x23, 0x58, 0xFF, 0xFF, 0x02, 0x63, 0x64, 0xF3, 0x23, 0xFC, 0x60, 0x40, 0x01, 0x23, 0x17, 0x00,
+	 0x01, 0x60, 0xFF, 0x65, 0xA4, 0x84, 0x11, 0x60, 0x14, 0x61, 0x11, 0x60, 0xF4, 0x65, 0xA1, 0xD1,
+	 0xD5, 0x80, 0xD0, 0x80, 0x0B, 0x03, 0x02, 0x03, 0x08, 0xA1, 0xF9, 0x01, 0x04, 0xA1, 0xA1, 0xD3,
+	 0x01, 0x60, 0x00, 0x65, 0x60, 0x47, 0xFF, 0xB4, 0xB4, 0x84, 0x01, 0x00, 0xFF, 0x64, 0x25, 0xFA,
+	 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0xA2, 0xFF, 0x46, 0x45, 0x02, 0xF0, 0x09, 0x60, 0x08, 0x64,
+	 0xD0, 0x80, 0x00, 0xF4, 0x01, 0xF2, 0x66, 0x5C, 0x25, 0x46, 0x56, 0x02, 0x70, 0x27, 0x54, 0x00,
+	 0x12, 0x64, 0x03, 0xFA, 0x04, 0xF8, 0x0E, 0xF2, 0x87, 0xFC, 0x8D, 0xFC, 0x8E, 0xFC, 0xDA, 0x82,
+	 0x16, 0x61, 0x00, 0x63, 0xC9, 0x81, 0x5A, 0xDC, 0xFD, 0x02, 0x60, 0x40, 0xF0, 0x3B, 0x16, 0x00,
+	 0x32, 0x44, 0x8E, 0xF3, 0x01, 0xB0, 0xF6, 0xA0, 0x08, 0x24, 0x2C, 0x05, 0xDC, 0x83, 0xF0, 0x67,
+	 0x0E, 0xFA, 0x1F, 0x60, 0x0A, 0x64, 0x2B, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB,
+	 0x8E, 0xFD, 0x2B, 0xFF, 0xFE, 0x64, 0x3B, 0x42, 0x4A, 0xDB, 0x4F, 0x00, 0x8F, 0xF3, 0x09, 0x65,
+	 0xD4, 0x80, 0xDC, 0x83, 0x17, 0x05, 0x8F, 0xFD, 0x98, 0xFE, 0x04, 0x04, 0x00, 0x7F, 0x08, 0x7E,
+	 0x0E, 0xFA, 0x3B, 0xFF, 0x1E, 0x60, 0xFE, 0x64, 0x2B, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64,
+	 0x5A, 0xDB, 0x0E, 0xF2, 0x2B, 0xFF, 0x60, 0x40, 0x08, 0x26, 0xF7, 0xFE, 0xFD, 0x64, 0x3B, 0x42,
+	 0x4A, 0xDB, 0x32, 0x00, 0x8B, 0xF3, 0xFF, 0xFF, 0xD8, 0xA0, 0xFF, 0xFF, 0x0D, 0x04, 0x1F, 0x60,
+	 0x16, 0x64, 0x2B, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF,
+	 0xFC, 0x64, 0x3B, 0x42, 0x4A, 0xDB, 0x21, 0x00, 0x46, 0x45, 0x00, 0x64, 0x2B, 0xDB, 0x25, 0x44,
+	 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xA2, 0xFF, 0x00, 0xF4, 0x01, 0xF0,
+	 0x0A, 0x18, 0x70, 0x67, 0xA0, 0x80, 0xF0, 0x67, 0x06, 0x03, 0xC0, 0x84, 0x01, 0xFA, 0x25, 0x46,
+	 0x25, 0x44, 0x80, 0xFC, 0x05, 0xFA, 0xB6, 0x60, 0x58, 0x4E, 0x72, 0x78, 0xFF, 0xFF, 0xD4, 0xFE,
+	 0xA3, 0xFF, 0xFF, 0x64, 0x3B, 0x42, 0x4A, 0xDB, 0xD4, 0xFE, 0xA3, 0xFF, 0x2D, 0x58, 0xFF, 0xFF,
+	 0x1F, 0x60, 0x04, 0x64, 0x40, 0x47, 0x58, 0x4F, 0x0D, 0x00, 0x1E, 0x60, 0xF8, 0x64, 0x40, 0x47,
+	 0x58, 0x4F, 0x18, 0x00, 0x1F, 0x60, 0x10, 0x64, 0x40, 0x47, 0x58, 0x4F, 0x03, 0x00, 0xF0, 0x60,
+	 0xC7, 0x78, 0xFF, 0xFF, 0x27, 0xD5, 0x0E, 0xF2, 0x0B, 0x18, 0x60, 0x40, 0x01, 0x2A, 0x08, 0x00,
+	 0x1F, 0x60, 0x26, 0x64, 0x40, 0x4B, 0xF6, 0x60, 0x58, 0x4D, 0xB3, 0x78, 0xFF, 0xFF, 0xF2, 0x01,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x27, 0xD5, 0x0E, 0xF2, 0x14, 0x18, 0x60, 0x40, 0x01, 0x2A, 0x11, 0x00,
+	 0x02, 0xF0, 0x09, 0x60, 0x08, 0x64, 0xD0, 0x80, 0xA2, 0xFF, 0x8F, 0xF3, 0x02, 0x02, 0xCC, 0x84,
+	 0x8F, 0xFB, 0x1F, 0x60, 0x26, 0x64, 0x40, 0x4B, 0xF6, 0x60, 0x58, 0x4D, 0xB3, 0x78, 0xFF, 0xFF,
+	 0xE9, 0x01, 0x2F, 0x58, 0xFF, 0xFF, 0xFB, 0x64, 0x3A, 0x42, 0x4A, 0xDB, 0xA2, 0xFF, 0x92, 0xF3,
+	 0x8E, 0xF3, 0xCC, 0x80, 0xFA, 0xA0, 0x01, 0x14, 0x1D, 0x05, 0xB5, 0x60, 0x58, 0x4D, 0x77, 0x78,
+	 0xFF, 0xFF, 0xA2, 0xFF, 0x17, 0x03, 0xF0, 0x67, 0x0E, 0xFA, 0x1F, 0x60, 0x0A, 0x64, 0x0F, 0x60,
+	 0x93, 0xFB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xF6, 0x64,
+	 0x3A, 0x42, 0x4A, 0xDB, 0x92, 0xF3, 0x8E, 0xF3, 0xCC, 0x83, 0xDC, 0x84, 0x01, 0x15, 0x92, 0xFD,
+	 0x8E, 0xFB, 0xD4, 0xFE, 0x91, 0xF3, 0x8F, 0xF3, 0x00, 0xA8, 0x90, 0xF1, 0x03, 0x02, 0xD0, 0x80,
+	 0xFF, 0xFF, 0x26, 0x05, 0xB5, 0x60, 0x58, 0x4D, 0x77, 0x78, 0xFF, 0xFF, 0xA2, 0xFF, 0x20, 0x03,
+	 0x00, 0x63, 0x91, 0xF3, 0x0E, 0xFC, 0xCC, 0x84, 0xFF, 0x3A, 0x91, 0xFB, 0x98, 0xFE, 0x03, 0x04,
+	 0x08, 0xBB, 0x0E, 0xFC, 0x3B, 0xFF, 0x1E, 0x60, 0xFE, 0x64, 0x0F, 0x60, 0x93, 0xFB, 0x66, 0x44,
+	 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xF7, 0x64, 0x3A, 0x42, 0x4A, 0xDB,
+	 0x8F, 0xF3, 0x0E, 0xF2, 0xDC, 0x83, 0x08, 0xB0, 0x8F, 0xFD, 0x08, 0x28, 0xF7, 0xFE, 0xD4, 0xFE,
+	 0xA3, 0xFF, 0xF0, 0x60, 0xC7, 0x78, 0xFF, 0xFF, 0xB9, 0xFE, 0x13, 0xFF, 0x24, 0x40, 0x80, 0x2B,
+	 0x0B, 0x00, 0xA2, 0xFF, 0x25, 0x46, 0x09, 0xF4, 0x0E, 0xF2, 0x05, 0x18, 0x08, 0xBC, 0x0E, 0xFA,
+	 0xFF, 0xFF, 0xF7, 0xFE, 0x01, 0x00, 0xD8, 0xFE, 0xA3, 0xFF, 0x25, 0x46, 0x3E, 0xF2, 0x00, 0xF4,
+	 0x08, 0xF0, 0x25, 0x46, 0x06, 0xB4, 0xFF, 0x7F, 0x10, 0xBC, 0x06, 0x26, 0xFD, 0x7F, 0x0E, 0xFA,
+	 0x3E, 0xF2, 0x3F, 0xF2, 0x60, 0x41, 0x08, 0x2A, 0x64, 0x47, 0x3F, 0xFA, 0x60, 0x45, 0x13, 0x60,
+	 0x2D, 0xF3, 0xA3, 0xFC, 0xAB, 0xFC, 0x91, 0xFC, 0xD4, 0x80, 0x38, 0x60, 0xC1, 0x65, 0xA5, 0x80,
+	 0x01, 0x04, 0x07, 0x03, 0x23, 0xF0, 0x08, 0x64, 0xB0, 0x84, 0xA2, 0xDA, 0xF8, 0x60, 0x57, 0x78,
+	 0xFF, 0xFF, 0xFB, 0x60, 0x58, 0x4F, 0x75, 0x78, 0xFF, 0xFF, 0x0B, 0x04, 0x23, 0xF0, 0x04, 0x64,
+	 0xB0, 0x84, 0xA2, 0xDA, 0x25, 0x60, 0xF4, 0x64, 0xE5, 0x60, 0x78, 0x41, 0xC7, 0x78, 0x97, 0xF1,
+	 0x46, 0x00, 0x3E, 0xF0, 0x88, 0xF1, 0x64, 0x47, 0x07, 0xB4, 0x07, 0x36, 0x3B, 0x00, 0x04, 0x03,
+	 0xCC, 0x84, 0xE0, 0x84, 0xC0, 0x83, 0x2D, 0x00, 0x2C, 0xF2, 0x87, 0xF1, 0x01, 0xB0, 0x64, 0x43,
+	 0x35, 0x02, 0x2E, 0xF2, 0x15, 0x60, 0x02, 0x65, 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD3,
+	 0x66, 0x41, 0x60, 0x46, 0x60, 0x43, 0x05, 0xF2, 0x16, 0x18, 0x61, 0x46, 0x2E, 0xF0, 0x63, 0x46,
+	 0xD0, 0x80, 0x04, 0xF2, 0x0C, 0x02, 0x61, 0x46, 0x2D, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x03, 0xF2,
+	 0x06, 0x02, 0x61, 0x46, 0x2C, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0xFF, 0xFF, 0x07, 0x03, 0x80, 0xF4,
+	 0xFF, 0xFF, 0x63, 0x46, 0xE8, 0x1B, 0x87, 0xF3, 0x08, 0xFE, 0x60, 0x43, 0x61, 0x46, 0x01, 0x03,
+	 0x09, 0x00, 0x66, 0x45, 0x63, 0x46, 0x06, 0xF0, 0x65, 0x46, 0x64, 0x44, 0x0C, 0x26, 0x02, 0x00,
+	 0x02, 0x26, 0x04, 0x00, 0x23, 0xF0, 0x04, 0x64, 0xB0, 0x84, 0xA2, 0xDA, 0x07, 0xFC, 0x23, 0xF2,
+	 0xFF, 0xFF, 0x0F, 0x1B, 0x1E, 0x60, 0xE0, 0x64, 0x0F, 0x60, 0x93, 0xFB, 0x66, 0x44, 0x5A, 0xDB,
+	 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0x0E, 0xF2, 0xC8, 0xFE, 0x10, 0xAC, 0x0E, 0xFA,
+	 0x0E, 0x00, 0x1E, 0x60, 0xF2, 0x64, 0x0F, 0x60, 0x93, 0xFB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64,
+	 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0x0E, 0xF2, 0xCE, 0xFE, 0x10, 0xAC, 0x0E, 0xFA, 0xF0, 0x60,
+	 0xC7, 0x78, 0xFF, 0xFF, 0xCB, 0x84, 0xC9, 0x83, 0xFF, 0xFF, 0x08, 0x04, 0x58, 0xD1, 0xA5, 0xD8,
+	 0xDA, 0x85, 0x80, 0x3A, 0x02, 0x00, 0x00, 0xF4, 0x04, 0x65, 0xF8, 0x1F, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x25, 0xF0, 0x14, 0x60, 0x15, 0xF9, 0x11, 0x00, 0x0D, 0x60, 0x00, 0x62, 0x40, 0x63, 0x5A, 0xDF,
+	 0xFE, 0x1F, 0x04, 0x65, 0x0D, 0x60, 0x00, 0x61, 0x48, 0x64, 0x3E, 0x63, 0x7C, 0xA8, 0x58, 0xD0,
+	 0x59, 0xD9, 0x02, 0x02, 0x00, 0xF4, 0x02, 0x64, 0xF9, 0x1F, 0x14, 0x60, 0x15, 0xF1, 0x0C, 0x60,
+	 0xDC, 0x65, 0x02, 0xFE, 0x64, 0x44, 0xF8, 0x84, 0xF8, 0x84, 0xF8, 0x87, 0x60, 0x41, 0x64, 0x44,
+	 0xE0, 0x84, 0xE0, 0x84, 0xC4, 0x84, 0x3E, 0xFB, 0x60, 0x42, 0x61, 0x44, 0x03, 0xA2, 0x60, 0xFE,
+	 0xA2, 0xDB, 0x20, 0xFE, 0x64, 0x44, 0x0D, 0x60, 0x02, 0x65, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84,
+	 0xE0, 0x84, 0xC4, 0x84, 0x40, 0xFB, 0xFF, 0xFF, 0x00, 0x67, 0x00, 0x61, 0x23, 0x58, 0xFF, 0xFF,
+	 0x5C, 0x41, 0x25, 0xF2, 0xFF, 0xFF, 0x40, 0x42, 0x80, 0x2B, 0x04, 0x00, 0xFF, 0xB4, 0x40, 0x42,
+	 0x01, 0x64, 0x40, 0x41, 0x87, 0xF3, 0x46, 0x4B, 0x86, 0xF3, 0x60, 0x46, 0xE0, 0x83, 0xAB, 0x46,
+	 0x26, 0xF0, 0xAB, 0x46, 0x59, 0xF8, 0xAB, 0x46, 0x27, 0xF0, 0xAB, 0x46, 0x5A, 0xF8, 0xAB, 0x46,
+	 0x28, 0xF0, 0xAB, 0x46, 0x5B, 0xF8, 0x66, 0x44, 0x02, 0xA6, 0xF1, 0x1F, 0x87, 0xF3, 0xFF, 0xFF,
+	 0x60, 0x46, 0xAB, 0x46, 0x0C, 0x60, 0x3A, 0x65, 0x22, 0x44, 0xFF, 0xB4, 0xE0, 0x84, 0xE0, 0x84,
+	 0xE0, 0x84, 0xE0, 0x84, 0xC4, 0x81, 0xC9, 0x81, 0x52, 0x64, 0x0E, 0x63, 0x58, 0xD0, 0x59, 0xD9,
+	 0xFD, 0x1F, 0x21, 0x44, 0x01, 0x2A, 0x08, 0x00, 0xAB, 0x46, 0xF0, 0xA1, 0x76, 0x64, 0x0E, 0x63,
+	 0x59, 0xD1, 0x58, 0xD8, 0xFD, 0x1F, 0xAB, 0x46, 0x22, 0x44, 0xFF, 0xB4, 0xE0, 0x84, 0xE0, 0x84,
+	 0xE0, 0x84, 0x0C, 0x60, 0x9C, 0x65, 0xC4, 0x81, 0x60, 0x45, 0xC9, 0x81, 0x62, 0x64, 0x06, 0x63,
+	 0x58, 0xD0, 0x59, 0xD9, 0xFD, 0x1F, 0x21, 0x44, 0x01, 0x2A, 0x08, 0x00, 0xAB, 0x46, 0xF8, 0xA1,
+	 0xB6, 0x64, 0x06, 0x63, 0x59, 0xD1, 0x58, 0xD8, 0xFD, 0x1F, 0xAB, 0x46, 0x65, 0x44, 0x0C, 0x60,
+	 0xBC, 0x65, 0xC4, 0x81, 0xC9, 0x81, 0x6A, 0x64, 0x06, 0x63, 0x58, 0xD0, 0x59, 0xD9, 0xFD, 0x1F,
+	 0x22, 0x44, 0xFF, 0xB4, 0xE0, 0x84, 0xE0, 0x85, 0xC4, 0x84, 0x0C, 0x60, 0x82, 0x65, 0xC4, 0x81,
+	 0x72, 0x64, 0x04, 0x63, 0x58, 0xD0, 0x59, 0xD9, 0xFD, 0x1F, 0xAB, 0x46, 0x21, 0x44, 0x01, 0x2A,
+	 0x06, 0x00, 0xFA, 0xA1, 0x90, 0x64, 0x04, 0x63, 0x59, 0xD1, 0x58, 0xD8, 0xFD, 0x1F, 0x3B, 0xF0,
+	 0x21, 0x44, 0x01, 0x2A, 0x13, 0x00, 0x22, 0x44, 0x3D, 0xFB, 0x60, 0x41, 0x02, 0xFE, 0xF8, 0x84,
+	 0xF8, 0x84, 0xF8, 0x84, 0x3C, 0xFB, 0x0C, 0x60, 0x7E, 0x63, 0x88, 0xFF, 0xCD, 0x81, 0x06, 0xA3,
+	 0xFD, 0x0D, 0x8D, 0xFF, 0x3B, 0xFD, 0x64, 0x47, 0x80, 0xBF, 0x60, 0x5C, 0x22, 0x43, 0x80, 0x61,
+	 0x88, 0xFF, 0xCF, 0x83, 0xE1, 0x81, 0xFD, 0x0D, 0x8D, 0xFF, 0x61, 0x47, 0x31, 0x91, 0xB1, 0x84,
+	 0x3B, 0xFA, 0x86, 0xF3, 0xFF, 0xFF, 0xCC, 0x83, 0xE3, 0x83, 0x66, 0x44, 0x02, 0xA6, 0x3B, 0xF0,
+	 0x66, 0x44, 0xB1, 0x9C, 0x3B, 0xF8, 0x02, 0xA6, 0xFA, 0x1F, 0xAB, 0x46, 0x00, 0x67, 0x00, 0x61,
+	 0x23, 0x58, 0xFF, 0xFF, 0x23, 0xF2, 0x25, 0xF0, 0x02, 0xA8, 0x00, 0x67, 0x24, 0x02, 0x3D, 0xF1,
+	 0x64, 0x44, 0x03, 0xB4, 0x40, 0x42, 0xD0, 0x80, 0x87, 0xF3, 0xFF, 0xFF, 0x60, 0x46, 0xBB, 0xF4,
+	 0x80, 0x61, 0x02, 0x02, 0xE3, 0x83, 0xEB, 0x83, 0x22, 0x44, 0x88, 0xFF, 0xCC, 0x84, 0xE1, 0x81,
+	 0xFD, 0x0D, 0x8D, 0xFF, 0x61, 0x47, 0x31, 0x91, 0x9D, 0x85, 0xA7, 0x83, 0x3B, 0xFC, 0x86, 0xF3,
+	 0xFF, 0xFF, 0xCC, 0x83, 0xE3, 0x83, 0x66, 0x44, 0x02, 0xA6, 0xBB, 0xF2, 0x66, 0x44, 0xA5, 0x81,
+	 0xBB, 0xFA, 0x02, 0xA6, 0xFA, 0x1F, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x11, 0x64, 0x23, 0xFA,
+	 0x25, 0x44, 0x24, 0xFA, 0x04, 0x64, 0x40, 0x4B, 0x62, 0x41, 0x0C, 0x60, 0x82, 0x64, 0x04, 0x63,
+	 0x58, 0xD1, 0x59, 0xD8, 0xFD, 0x1F, 0x2B, 0x43, 0x00, 0x7C, 0x59, 0xD8, 0x4F, 0x8B, 0x06, 0xA4,
+	 0xF6, 0x02, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x27, 0xF2, 0x15, 0x60, 0x02, 0x65, 0x60, 0x47,
+	 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD3, 0x66, 0x41, 0x60, 0x46, 0x60, 0x43, 0x05, 0xF2, 0x16, 0x18,
+	 0x61, 0x46, 0x27, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x04, 0xF2, 0x0C, 0x02, 0x61, 0x46, 0x26, 0xF0,
+	 0x63, 0x46, 0xD0, 0x80, 0x03, 0xF2, 0x06, 0x02, 0x61, 0x46, 0x25, 0xF0, 0x63, 0x46, 0xD0, 0x80,
+	 0xFF, 0xFF, 0x07, 0x03, 0x80, 0xF4, 0xFF, 0xFF, 0x63, 0x46, 0xE8, 0x1B, 0x87, 0xF3, 0x08, 0xFE,
+	 0x60, 0x43, 0x61, 0x46, 0x01, 0x03, 0x2A, 0x00, 0x43, 0x4B, 0xAB, 0x46, 0x3B, 0xF2, 0x80, 0x60,
+	 0x30, 0x7C, 0xB0, 0x84, 0xA2, 0xDA, 0x4E, 0x61, 0x76, 0x64, 0x0E, 0x63, 0xAB, 0x46, 0x59, 0xD0,
+	 0xAB, 0x46, 0x58, 0xD8, 0xFB, 0x1F, 0x90, 0x64, 0x04, 0x63, 0xAB, 0x46, 0x59, 0xD0, 0xAB, 0x46,
+	 0x58, 0xD8, 0xFB, 0x1F, 0xD9, 0x81, 0xA0, 0x64, 0x04, 0x63, 0xAB, 0x46, 0x59, 0xD0, 0xAB, 0x46,
+	 0x58, 0xD8, 0xFB, 0x1F, 0xD9, 0x81, 0xB6, 0x64, 0x0E, 0x63, 0xAB, 0x46, 0x59, 0xD0, 0xAB, 0x46,
+	 0x58, 0xD8, 0xFB, 0x1F, 0x00, 0x67, 0x00, 0x61, 0x23, 0x58, 0xFF, 0xFF, 0x01, 0x67, 0x20, 0x61,
+	 0x23, 0x58, 0xFF, 0xFF, 0x27, 0xF2, 0x15, 0x60, 0x02, 0x65, 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84,
+	 0x44, 0xD3, 0x66, 0x41, 0x60, 0x46, 0x60, 0x43, 0x05, 0xF2, 0x16, 0x18, 0x61, 0x46, 0x27, 0xF0,
+	 0x63, 0x46, 0xD0, 0x80, 0x04, 0xF2, 0x0C, 0x02, 0x61, 0x46, 0x26, 0xF0, 0x63, 0x46, 0xD0, 0x80,
+	 0x03, 0xF2, 0x06, 0x02, 0x61, 0x46, 0x25, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0xFF, 0xFF, 0x07, 0x03,
+	 0x80, 0xF4, 0xFF, 0xFF, 0x63, 0x46, 0xE8, 0x1B, 0x87, 0xF3, 0x08, 0xFE, 0x60, 0x43, 0x61, 0x46,
+	 0x01, 0x03, 0x0D, 0x00, 0x43, 0x4B, 0xAB, 0x46, 0x3B, 0xF2, 0x80, 0x60, 0x30, 0x61, 0x9D, 0x85,
+	 0xA4, 0x84, 0xA2, 0xDA, 0xAB, 0x46, 0x00, 0x67, 0x00, 0x61, 0x23, 0x58, 0xFF, 0xFF, 0x01, 0x67,
+	 0x20, 0x61, 0x23, 0x58, 0xFF, 0xFF, 0x00, 0x64, 0x40, 0x41, 0x4A, 0x64, 0xA0, 0xD2, 0xFF, 0xFF,
+	 0x40, 0x42, 0x80, 0x2B, 0x04, 0x00, 0xFF, 0xB4, 0x40, 0x42, 0x01, 0x64, 0x40, 0x41, 0x87, 0xF3,
+	 0x46, 0x4B, 0x86, 0xF3, 0x60, 0x46, 0xE0, 0x83, 0xAB, 0x46, 0x32, 0xF0, 0xAB, 0x46, 0x59, 0xF8,
+	 0xAB, 0x46, 0x33, 0xF0, 0xAB, 0x46, 0x5A, 0xF8, 0xAB, 0x46, 0x34, 0xF0, 0xAB, 0x46, 0x5B, 0xF8,
+	 0x66, 0x44, 0x02, 0xA6, 0xF1, 0x1F, 0x87, 0xF3, 0xFF, 0xFF, 0x60, 0x46, 0xAB, 0x46, 0x0C, 0x60,
+	 0x3A, 0x65, 0x22, 0x44, 0xFF, 0xB4, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xC4, 0x81,
+	 0xC9, 0x81, 0x4A, 0x64, 0x0E, 0x63, 0x58, 0xD0, 0x59, 0xD9, 0xFD, 0x1F, 0x21, 0x44, 0x01, 0x2A,
+	 0x08, 0x00, 0xAB, 0x46, 0xF0, 0xA1, 0x76, 0x64, 0x0E, 0x63, 0x59, 0xD1, 0x58, 0xD8, 0xFD, 0x1F,
+	 0xAB, 0x46, 0x22, 0x44, 0xFF, 0xB4, 0xE0, 0x84, 0xE0, 0x85, 0xC4, 0x84, 0x0C, 0x60, 0x82, 0x65,
+	 0xC4, 0x81, 0x5A, 0x64, 0x04, 0x63, 0x58, 0xD0, 0x59, 0xD9, 0xFD, 0x1F, 0xAB, 0x46, 0x21, 0x44,
+	 0x01, 0x2A, 0x06, 0x00, 0xFA, 0xA1, 0x90, 0x64, 0x04, 0x63, 0x59, 0xD1, 0x58, 0xD8, 0xFD, 0x1F,
+	 0x3B, 0xF0, 0x21, 0x44, 0x01, 0x2A, 0x13, 0x00, 0x22, 0x44, 0x3D, 0xFB, 0x60, 0x41, 0x02, 0xFE,
+	 0xF8, 0x84, 0xF8, 0x84, 0xF8, 0x84, 0x3C, 0xFB, 0x0C, 0x60, 0x7E, 0x63, 0x88, 0xFF, 0xCD, 0x81,
+	 0x06, 0xA3, 0xFD, 0x0D, 0x8D, 0xFF, 0x3B, 0xFD, 0x64, 0x47, 0x80, 0xBF, 0x60, 0x5C, 0x22, 0x43,
+	 0x80, 0x61, 0x88, 0xFF, 0xCF, 0x83, 0xE1, 0x81, 0xFD, 0x0D, 0x8D, 0xFF, 0x61, 0x47, 0x31, 0x91,
+	 0xB1, 0x84, 0x3B, 0xFA, 0x86, 0xF3, 0xFF, 0xFF, 0xCC, 0x83, 0xE3, 0x83, 0x66, 0x44, 0x02, 0xA6,
+	 0x3B, 0xF0, 0x66, 0x44, 0xB1, 0x9C, 0x3B, 0xF8, 0x02, 0xA6, 0xFA, 0x1F, 0xAB, 0x46, 0x00, 0x67,
+	 0x00, 0x61, 0x23, 0x58, 0xFF, 0xFF, 0x23, 0xF2, 0x25, 0xF0, 0x02, 0xA8, 0x00, 0x67, 0x24, 0x02,
+	 0x3D, 0xF1, 0x64, 0x44, 0x03, 0xB4, 0x40, 0x42, 0xD0, 0x80, 0x87, 0xF3, 0xFF, 0xFF, 0x60, 0x46,
+	 0xBB, 0xF4, 0x80, 0x61, 0x02, 0x02, 0xE3, 0x83, 0xEB, 0x83, 0x22, 0x44, 0x88, 0xFF, 0xCC, 0x84,
+	 0xE1, 0x81, 0xFD, 0x0D, 0x8D, 0xFF, 0x61, 0x47, 0x31, 0x91, 0x9D, 0x85, 0xA7, 0x83, 0x3B, 0xFC,
+	 0x86, 0xF3, 0xFF, 0xFF, 0xCC, 0x83, 0xE3, 0x83, 0x66, 0x44, 0x02, 0xA6, 0xBB, 0xF2, 0x66, 0x44,
+	 0xA5, 0x81, 0xBB, 0xFA, 0x02, 0xA6, 0xFA, 0x1F, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x27, 0xF2,
+	 0x15, 0x60, 0x02, 0x65, 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD3, 0x66, 0x41, 0x60, 0x46,
+	 0x60, 0x43, 0x05, 0xF2, 0x16, 0x18, 0x61, 0x46, 0x27, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x04, 0xF2,
+	 0x0C, 0x02, 0x61, 0x46, 0x26, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x03, 0xF2, 0x06, 0x02, 0x61, 0x46,
+	 0x25, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0xFF, 0xFF, 0x07, 0x03, 0x80, 0xF4, 0xFF, 0xFF, 0x63, 0x46,
+	 0xE8, 0x1B, 0x87, 0xF3, 0x08, 0xFE, 0x60, 0x43, 0x61, 0x46, 0x01, 0x03, 0x21, 0x00, 0x43, 0x4B,
+	 0xAB, 0x46, 0x3B, 0xF2, 0x80, 0x60, 0x30, 0x7C, 0xB0, 0x84, 0xA2, 0xDA, 0x4E, 0x61, 0x76, 0x64,
+	 0x0E, 0x63, 0xAB, 0x46, 0x59, 0xD0, 0xAB, 0x46, 0x58, 0xD8, 0xFB, 0x1F, 0x90, 0x64, 0x04, 0x63,
+	 0xAB, 0x46, 0x59, 0xD0, 0xAB, 0x46, 0x58, 0xD8, 0xFB, 0x1F, 0xA0, 0x64, 0x04, 0x63, 0xAB, 0x46,
+	 0x59, 0xD0, 0xAB, 0x46, 0x58, 0xD8, 0xFB, 0x1F, 0x00, 0x67, 0x00, 0x61, 0x23, 0x58, 0xFF, 0xFF,
+	 0x01, 0x67, 0x20, 0x61, 0x23, 0x58, 0xFF, 0xFF, 0x27, 0xF2, 0x15, 0x60, 0x02, 0x65, 0x60, 0x47,
+	 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD3, 0x66, 0x41, 0x60, 0x46, 0x60, 0x43, 0x05, 0xF2, 0x16, 0x18,
+	 0x61, 0x46, 0x27, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x04, 0xF2, 0x0C, 0x02, 0x61, 0x46, 0x26, 0xF0,
+	 0x63, 0x46, 0xD0, 0x80, 0x03, 0xF2, 0x06, 0x02, 0x61, 0x46, 0x25, 0xF0, 0x63, 0x46, 0xD0, 0x80,
+	 0xFF, 0xFF, 0x07, 0x03, 0x80, 0xF4, 0xFF, 0xFF, 0x63, 0x46, 0xE8, 0x1B, 0x87, 0xF3, 0x08, 0xFE,
+	 0x60, 0x43, 0x61, 0x46, 0x01, 0x03, 0x0D, 0x00, 0x43, 0x4B, 0xAB, 0x46, 0x3B, 0xF2, 0x80, 0x60,
+	 0x30, 0x61, 0x9D, 0x85, 0xA4, 0x84, 0xA2, 0xDA, 0xAB, 0x46, 0x00, 0x67, 0x00, 0x61, 0x23, 0x58,
+	 0xFF, 0xFF, 0x01, 0x67, 0x20, 0x61, 0x23, 0x58, 0xFF, 0xFF, 0x3E, 0xF2, 0xAB, 0xF1, 0x08, 0xB0,
+	 0x19, 0xF8, 0x4A, 0x02, 0x07, 0x23, 0x2B, 0x00, 0x60, 0x47, 0x07, 0xB4, 0x88, 0xF1, 0xCC, 0x84,
+	 0xE0, 0x84, 0x40, 0x8A, 0xAA, 0x46, 0x03, 0xF2, 0x04, 0xF0, 0x05, 0xF2, 0x60, 0x43, 0xAA, 0x46,
+	 0x2C, 0xFC, 0x2D, 0xF8, 0x2E, 0xFA, 0xCB, 0xF1, 0x2F, 0xF8, 0xCC, 0xF1, 0x30, 0xF8, 0xCD, 0xF1,
+	 0x31, 0xF8, 0x46, 0x4A, 0x00, 0xF4, 0x02, 0xF2, 0x03, 0xF0, 0x04, 0xF2, 0x60, 0x43, 0xAA, 0x46,
+	 0x32, 0xFC, 0x33, 0xF8, 0x34, 0xFA, 0xAA, 0x46, 0x05, 0xF2, 0x06, 0xF0, 0x07, 0xF2, 0x60, 0x43,
+	 0xAA, 0x46, 0x36, 0xFC, 0x37, 0xF8, 0x38, 0xFA, 0x03, 0x60, 0x08, 0x64, 0x1C, 0x00, 0x66, 0xF1,
+	 0x2F, 0xF8, 0x67, 0xF1, 0x30, 0xF8, 0x68, 0xF1, 0x31, 0xF8, 0x46, 0x4A, 0x00, 0xF4, 0x02, 0xF2,
+	 0x03, 0xF0, 0x04, 0xF2, 0x60, 0x43, 0xAA, 0x46, 0x2C, 0xFC, 0x2D, 0xF8, 0x2E, 0xFA, 0xAA, 0x46,
+	 0x05, 0xF2, 0x06, 0xF0, 0x07, 0xF2, 0x60, 0x43, 0xAA, 0x46, 0x32, 0xFC, 0x33, 0xF8, 0x34, 0xFA,
+	 0x02, 0x60, 0x08, 0x64, 0x00, 0x00, 0x2A, 0xFA, 0x02, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x42, 0x6F,
+	 0x6F, 0x74, 0x63, 0x6F, 0x64, 0x65, 0x20, 0x21, 0x21, 0x20, 0x20, 0x00, 0x53, 0x54, 0x41, 0x2F,
+	 0x41, 0x50, 0x20, 0x46, 0x75, 0x6E, 0x63, 0x27, 0x73, 0x00, 0x20, 0x00, 0x03, 0x00, 0x01, 0x00,
+	 0x18, 0x00, 0x00, 0x00, 0x08, 0x00, 0x04, 0x00, 0x01, 0x00, 0x01, 0x00, 0x01, 0x00, 0x01, 0x00,
+	 0x04, 0x00, 0x06, 0x00, 0x07, 0x00, 0x05, 0x00, 0x06, 0x00, 0x07, 0x00, 0x06, 0x00, 0x06, 0x00,
+	 0x07, 0x00, 0x01, 0x00, 0x02, 0x00, 0x02, 0x00, 0x01, 0x00, 0x02, 0x00, 0x01, 0x00, 0x01, 0x00,
+	 0x02, 0x00, 0x00, 0x00,
+
+};  /* fw_image_4_data */
+
+static const CFG_IDENTITY_STRCT fw_image_infoidentity[] = {
+	{
+		sizeof( CFG_IDENTITY_STRCT ) / sizeof(hcf_16) - 1,
+		CFG_FW_IDENTITY,
+		COMP_ID_FW_AP,
+		3,							//Variant
+		1,							//Major
+		24							//Minor
+	},
+	{ 0000, 0000, 0000, 0000, 0000, 0000 }		//endsentinel
+};
+
+static const CFG_PROG_STRCT fw_image_code[] = {
+	{
+		8,
+		CFG_PROG,
+		CFG_PROG_VOLATILE,			// mode
+		0x0148,		// sizeof(fw_image_1_data),
+		0x00000060,					// Target address in NIC Memory
+		0x0000,						// CRC: yes/no	TYPE: primary/station/tertiary
+		(hcf_8 FAR   *) fw_image_1_data
+	},
+	{
+		8,
+		CFG_PROG,
+		CFG_PROG_VOLATILE,			// mode
+		0x2432,		// sizeof(fw_image_2_data),
+		0x00000C16,					// Target address in NIC Memory
+		0x0000,						// CRC: yes/no	TYPE: primary/station/tertiary
+		(hcf_8 FAR   *) fw_image_2_data
+	},
+	{
+		8,
+		CFG_PROG,
+		CFG_PROG_VOLATILE,			// mode
+		0x194c,		// sizeof(fw_image_3_data),
+		0x001E3048,					// Target address in NIC Memory
+		0x0000,						// CRC: yes/no	TYPE: primary/station/tertiary
+		(hcf_8 FAR   *) fw_image_3_data
+	},
+	{
+		8,
+		CFG_PROG,
+		CFG_PROG_VOLATILE,			// mode
+		0xb7e4,		// sizeof(fw_image_4_data),
+		0x001F4000,					// Target address in NIC Memory
+		0x0000,						// CRC: yes/no	TYPE: primary/station/tertiary
+		(hcf_8 FAR   *) fw_image_4_data
+	},
+	{
+		5,
+		CFG_PROG,
+		CFG_PROG_STOP,				// mode
+		0000,
+ 	0x000F2101,					// Start execution address
+	},
+	{ 0000, 0000, 0000, 0000, 00000000, 0000, 00000000}
+};
+
+static const CFG_RANGE20_STRCT fw_image_infocompat[] = {
+	{	3 + ((20 * sizeof(CFG_RANGE_SPEC_STRCT)) / sizeof(hcf_16)),
+		CFG_FW_SUP_RANGE,
+		COMP_ROLE_SUPL,
+		COMP_ID_APF,
+		{
+			{ 4, 1, 1 }  				//variant, bottom, top
+		}
+	},
+	{	3 + ((20 * sizeof(CFG_RANGE_SPEC_STRCT)) / sizeof(hcf_16)),
+		CFG_MFI_ACT_RANGES_STA,
+		COMP_ROLE_ACT,
+		COMP_ID_MFI,
+		{
+			{ 7, 3, 3 }, 				//variant, bottom, top
+			{ 8, 1, 1 }  				//variant, bottom, top
+		}
+	},
+	{	3 + ((20 * sizeof(CFG_RANGE_SPEC_STRCT)) / sizeof(hcf_16)),
+		CFG_CFI_ACT_RANGES_STA,
+		COMP_ROLE_ACT,
+		COMP_ID_CFI,
+		{
+			{ 4, 1, 2 }  				//variant, bottom, top
+		}
+	},
+	{ 0000, 0000, 0000, 0000, { { 0000, 0000, 0000 } } }			//endsentinel
+};
+
+memimage fw_image = {
+	"FUPU7D37dhfwci\001C",			//signature, <format number>, C/Bin type
+	(CFG_PROG_STRCT *) fw_image_code,
+	0x000F2101,
+	00000000,					//(dummy) pdaplug
+	00000000,					//(dummy) priplug
+	(CFG_RANGE20_STRCT *) fw_image_infocompat,
+	(CFG_IDENTITY_STRCT *) fw_image_infoidentity,
+};
+
diff --git a/drivers/staging/wlags49_h2/debug.h b/drivers/staging/wlags49_h2/debug.h
new file mode 100644
index 000000000000..0b52e17b3011
--- /dev/null
+++ b/drivers/staging/wlags49_h2/debug.h
@@ -0,0 +1,212 @@
+/*******************************************************************************
+ * Agere Systems Inc.
+ * Wireless device driver for Linux (wlags49).
+ *
+ * Copyright (c) 1998-2003 Agere Systems Inc.
+ * All rights reserved.
+ *   http://www.agere.com
+ *
+ * Initially developed by TriplePoint, Inc.
+ *   http://www.triplepoint.com
+ *
+ *------------------------------------------------------------------------------
+ *
+ *   This file contains definitions and macros for debugging.
+ *
+ *------------------------------------------------------------------------------
+ *
+ * SOFTWARE LICENSE
+ *
+ * This software is provided subject to the following terms and conditions,
+ * which you should read carefully before using the software.  Using this
+ * software indicates your acceptance of these terms and conditions.  If you do
+ * not agree with these terms and conditions, do not use the software.
+ *
+ * Copyright © 2003 Agere Systems Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source or binary forms, with or without
+ * modifications, are permitted provided that the following conditions are met:
+ *
+ * . Redistributions of source code must retain the above copyright notice, this
+ *    list of conditions and the following Disclaimer as comments in the code as
+ *    well as in the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * . Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following Disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ *
+ * . Neither the name of Agere Systems Inc. nor the names of the contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * Disclaimer
+ *
+ * THIS SOFTWARE IS PROVIDED “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, INFRINGEMENT AND THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  ANY
+ * USE, MODIFICATION OR DISTRIBUTION OF THIS SOFTWARE IS SOLELY AT THE USERS OWN
+ * RISK. IN NO EVENT SHALL AGERE SYSTEMS INC. OR CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, INCLUDING, BUT NOT LIMITED TO, CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ *
+ ******************************************************************************/
+
+#ifndef _DEBUG_H
+#define _DEBUG_H
+
+
+
+
+/* Turn on debugging here if not done with a preprocessor define */
+#ifndef DBG
+#define DBG 0
+#else
+#undef	DBG
+#define DBG 1
+#endif //DBG
+
+
+
+
+#if DBG
+/****************************************************************************/
+
+/* Set the level of debugging if not done with a preprocessor define. See
+   wl_main.c, init_module() for how the debug level translates into the
+   the types of messages displayed */
+#ifndef DBG_LVL
+#define DBG_LVL 5			/* yields nothing via init_module,
+							   original value of 5 yields DBG_TRACE_ON and DBG_VERBOSE_ON */
+#endif  // DBG_LVL
+
+
+#define DBG_ERROR_ON        0x00000001L
+#define DBG_WARNING_ON      0x00000002L
+#define DBG_NOTICE_ON       0x00000004L
+#define DBG_TRACE_ON        0x00000008L
+#define DBG_VERBOSE_ON      0x00000010L
+#define DBG_PARAM_ON        0x00000020L
+#define DBG_BREAK_ON        0x00000040L
+#define DBG_RX_ON           0x00000100L
+#define DBG_TX_ON           0x00000200L
+#define DBG_DS_ON           0x00000400L
+
+#define DBG_DEFAULTS        (DBG_ERROR_ON | DBG_WARNING_ON | DBG_BREAK_ON)
+
+#define DBG_FLAGS(A)        (A)->DebugFlag
+#define DBG_NAME(A)         (A)->dbgName
+#define DBG_LEVEL(A)        (A)->dbgLevel
+
+
+#ifndef PRINTK
+#   define PRINTK(S...)     printk(S)
+#endif // PRINTK
+
+
+#ifndef DBG_PRINT
+#   define DBG_PRINT(S...)  PRINTK(KERN_DEBUG S)
+#endif // DBG_PRINT
+
+
+#ifndef DBG_PRINTC
+#   define DBG_PRINTC(S...) PRINTK(S)
+#endif // DBG_PRINTC
+
+
+#ifndef DBG_TRAP
+#   define DBG_TRAP         {}
+#endif // DBG_TRAP
+
+
+#define _ENTER_STR          ">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>"
+#define _LEAVE_STR          "<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<"
+
+
+#define _DBG_ENTER(A)       DBG_PRINT("%s:%.*s:%s\n",DBG_NAME(A),++DBG_LEVEL(A),_ENTER_STR,__FUNC__)
+#define _DBG_LEAVE(A)       DBG_PRINT("%s:%.*s:%s\n",DBG_NAME(A),DBG_LEVEL(A)--,_LEAVE_STR,__FUNC__)
+
+
+#define DBG_FUNC(F)         static const char *__FUNC__ = F;
+
+#define DBG_ENTER(A)        {if (DBG_FLAGS(A) & DBG_TRACE_ON) _DBG_ENTER(A);}
+
+#define DBG_LEAVE(A)        {if (DBG_FLAGS(A) & DBG_TRACE_ON) _DBG_LEAVE(A);}
+
+#define DBG_PARAM(A,N,F,S...)   {if (DBG_FLAGS(A) & DBG_PARAM_ON) \
+                                    DBG_PRINT("  %s -- "F"\n",N,S);}
+
+
+#define DBG_ERROR(A,S...)   {if (DBG_FLAGS(A) & DBG_ERROR_ON) \
+                                {DBG_PRINT("%s:ERROR:%s ",DBG_NAME(A),__FUNC__);DBG_PRINTC(S);DBG_TRAP;}}
+
+
+#define DBG_WARNING(A,S...) {if (DBG_FLAGS(A) & DBG_WARNING_ON) \
+                                {DBG_PRINT("%s:WARNING:%s ",DBG_NAME(A),__FUNC__);DBG_PRINTC(S);}}
+
+
+#define DBG_NOTICE(A,S...)  {if (DBG_FLAGS(A) & DBG_NOTICE_ON) \
+                                {DBG_PRINT("%s:NOTICE:%s ",DBG_NAME(A),__FUNC__);DBG_PRINTC(S);}}
+
+
+#define DBG_TRACE(A,S...)   do {if (DBG_FLAGS(A) & DBG_TRACE_ON) \
+                                {DBG_PRINT("%s:%s ",DBG_NAME(A),__FUNC__);DBG_PRINTC(S);}} while (0)
+
+
+#define DBG_RX(A,S...)      {if (DBG_FLAGS(A) & DBG_RX_ON) \
+                                {DBG_PRINT(S);}}
+
+
+#define DBG_TX(A,S...)      {if (DBG_FLAGS(A) & DBG_TX_ON) \
+                                {DBG_PRINT(S);}}
+
+#define DBG_DS(A,S...)      {if (DBG_FLAGS(A) & DBG_DS_ON) \
+                                {DBG_PRINT(S);}}
+
+
+#define DBG_ASSERT(C)       {if (!(C)) \
+                                {DBG_PRINT("ASSERT(%s) -- %s#%d (%s)\n", \
+                                    #C,__FILE__,__LINE__,__FUNC__); \
+                                DBG_TRAP;}}
+
+typedef struct {
+    char           *dbgName;
+    int             dbgLevel;
+    unsigned long   DebugFlag;
+} dbg_info_t;
+
+
+/****************************************************************************/
+#else // DBG
+/****************************************************************************/
+
+#define DBG_DEFN
+#define DBG_TRAP
+#define DBG_FUNC(F)
+#define DBG_PRINT(S...)
+#define DBG_ENTER(A)
+#define DBG_LEAVE(A)
+#define DBG_PARAM(A,N,F,S...)
+#define DBG_ERROR(A,S...)
+#define DBG_WARNING(A,S...)
+#define DBG_NOTICE(A,S...)
+#define DBG_TRACE(A,S...)
+#define DBG_RX(A,S...)
+#define DBG_TX(A,S...)
+#define DBG_DS(A,S...)
+#define DBG_ASSERT(C)
+
+#endif // DBG
+/****************************************************************************/
+
+
+
+
+#endif // _DEBUG_H
+
diff --git a/drivers/staging/wlags49_h2/dhf.c b/drivers/staging/wlags49_h2/dhf.c
new file mode 100644
index 000000000000..b6f5834b1aff
--- /dev/null
+++ b/drivers/staging/wlags49_h2/dhf.c
@@ -0,0 +1,390 @@
+
+//   vim:tw=110:ts=4:
+/**************************************************************************************************************
+*
+* FILE   :	DHF.C
+*
+* DATE	:	$Date: 2004/07/19 08:16:14 $   $Revision: 1.2 $
+* Original	:	2004/05/28 14:05:34    Revision: 1.36      Tag: hcf7_t20040602_01
+* Original	:	2004/05/11 06:22:57    Revision: 1.32      Tag: hcf7_t7_20040513_01
+* Original	:	2004/04/15 09:24:42    Revision: 1.28      Tag: hcf7_t7_20040415_01
+* Original	:	2004/04/08 15:18:16    Revision: 1.27      Tag: t7_20040413_01
+* Original	:	2004/04/01 15:32:55    Revision: 1.25      Tag: t7_20040401_01
+* Original	:	2004/03/10 15:39:28    Revision: 1.21      Tag: t20040310_01
+* Original	:	2004/03/04 11:03:37    Revision: 1.19      Tag: t20040304_01
+* Original	:	2004/03/02 09:27:11    Revision: 1.17      Tag: t20040302_03
+* Original	:	2004/02/24 13:00:28    Revision: 1.15      Tag: t20040224_01
+* Original	:	2004/02/19 10:57:28    Revision: 1.14      Tag: t20040219_01
+* Original	:	2003/11/27 09:00:09    Revision: 1.3      Tag: t20021216_01
+*
+* AUTHOR :	John Meertens
+*			Nico Valster
+*
+* SPECIFICATION: ........
+*
+* DESC   :	generic functions to handle the download of NIC firmware
+*			Local Support Routines for above procedures
+*
+*			Customizable via HCFCFG.H, which is included by HCF.H
+*
+*
+*	DHF is (intended to be) platform-independent.
+*	DHF is a module that provides a number of routines to download firmware
+*	images (the names primary, station, access point, secondary and tertiary
+*	are used or have been used) to volatile or nonvolatile memory
+*	in WaveLAN/IEEE NICs. To achieve this DHF makes use of the WaveLAN/IEEE
+*	WCI as implemented by the HCF-module.
+*
+*	Download to non-volatile memory is used to update a WaveLAN/IEEE NIC to new
+*	firmware. Normally this will be an upgrade to newer firmware, although
+*	downgrading to older firmware is possible too.
+*
+* Note: relative to Asserts, the following can be observed:
+*	Since the IFB is not known inside the routine, the macro HCFASSERT is replaced with MMDASSERT.
+*	Also the line number reported in the assert is raised by FILE_NAME_OFFSET (10000) to discriminate the
+*	DHF Asserts from HCF and MMD asserts.
+*
+***************************************************************************************************************
+*
+*
+* SOFTWARE LICENSE
+*
+* This software is provided subject to the following terms and conditions,
+* which you should read carefully before using the software.  Using this
+* software indicates your acceptance of these terms and conditions.  If you do
+* not agree with these terms and conditions, do not use the software.
+*
+* COPYRIGHT © 1999 - 2000 by Lucent Technologies.	All Rights Reserved
+* COPYRIGHT © 2001 - 2004	by Agere Systems Inc.	All Rights Reserved
+* All rights reserved.
+*
+* Redistribution and use in source or binary forms, with or without
+* modifications, are permitted provided that the following conditions are met:
+*
+* . Redistributions of source code must retain the above copyright notice, this
+*    list of conditions and the following Disclaimer as comments in the code as
+*    well as in the documentation and/or other materials provided with the
+*    distribution.
+*
+* . Redistributions in binary form must reproduce the above copyright notice,
+*    this list of conditions and the following Disclaimer in the documentation
+*    and/or other materials provided with the distribution.
+*
+* . Neither the name of Agere Systems Inc. nor the names of the contributors
+*    may be used to endorse or promote products derived from this software
+*    without specific prior written permission.
+*
+* Disclaimer
+*
+* THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
+* INCLUDING, BUT NOT LIMITED TO, INFRINGEMENT AND THE IMPLIED WARRANTIES OF
+* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  ANY
+* USE, MODIFICATION OR DISTRIBUTION OF THIS SOFTWARE IS SOLELY AT THE USERS OWN
+* RISK. IN NO EVENT SHALL AGERE SYSTEMS INC. OR CONTRIBUTORS BE LIABLE FOR ANY
+* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+* ON ANY THEORY OF LIABILITY, INCLUDING, BUT NOT LIMITED TO, CONTRACT, STRICT
+* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+* OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+* DAMAGE.
+*
+*
+**************************************************************************************************************/
+
+#include "hcf.h"
+#include "hcfdef.h"
+#include "dhf.h"
+#include "mmd.h"
+
+//to distinguish MMD from HCF asserts by means of line number
+#undef	FILE_NAME_OFFSET
+#define FILE_NAME_OFFSET MMD_FILE_NAME_OFFSET
+/*-----------------------------------------------------------------------------
+ *
+ * Defines, data structures, and global variables
+ *
+ *---------------------------------------------------------------------------*/
+
+//                    12345678901234
+char signature[14] = "FUPU7D37dhfwci";
+
+//The binary download function "relocates" the image using constructions like:
+//	fw->identity = (CFG_IDENTITY_STRCT FAR *)((char FAR *)fw->identity + (hcf_32)fw );
+//under some of the memory models under MSVC 1.52 these constructions degrade to 16-bits pointer arithmetic.
+//fw->identity is limited, such that adding it to fw, does not need to carry over from offset to segment.
+//However the segment is not set at all.
+//As a workaround the PSEUDO_CHARP macro is introduced which is a char pointer except for MSVC 1.52, in
+//which case we know that a 32-bit quantity is adequate as a pointer.
+//Note that other platforms may experience comparable problems when using the binary download feature.
+#if defined(_MSC_VER) && _MSC_VER ==  800				// Visual C++ 1.5
+#define PSEUDO_CHARP hcf_32
+#else
+#define PSEUDO_CHARP hcf_8*
+#endif
+
+/*-----------------------------------------------------------------------------
+ *
+ * LTV-records retrieved from the NIC to:
+ *	- determine compatibility between NIC and image
+ *	- ((setup the buffer size dynamically for non-volatile download (see note below) ))
+ *	- supply plugging information contained in the PDA (H-I only)
+ *
+ *---------------------------------------------------------------------------*/
+
+// for USB/H1 we needed a smaller value than the CFG_DL_BUF_STRCT reported 8192
+// for the time being it seems simpler to always use 2000 for USB/H1 as well as all other cases rather than
+// using the "fixed anyway" CFG_DL_BUF_STRCT.
+#define DL_SIZE 2000
+
+//CFG_IDENTITY_STRCT   	pri_identity	= { LOF(CFG_IDENTITY_STRCT), CFG_PRI_IDENTITY };
+CFG_SUP_RANGE_STRCT 	mfi_sup        	= { LOF(CFG_SUP_RANGE_STRCT), CFG_NIC_MFI_SUP_RANGE };
+CFG_SUP_RANGE_STRCT 	cfi_sup        	= { LOF(CFG_SUP_RANGE_STRCT), CFG_NIC_CFI_SUP_RANGE };
+/* Note: could be used rather than the above explained and defined DL_SIZE if need arises
+ * CFG_DL_BUF_STRCT    	dl_buf         	= { LOF(CFG_DL_BUF_STRCT), CFG_DL_BUF };
+*/
+
+/*-----------------------------------------------------------------------------
+ * Array ltv_info stores NIC information (in the form of LTV-records)
+ * needed for download. A NULL record indicates the end of the array.
+ *---------------------------------------------------------------------------*/
+
+/* The LTV_INFO_STRUCT is needed to save the sizes of the structs, because after a GET_INFO()
+ * the len field is changed to the real len of the RID by the called routine.
+ * This is only relevant if the DHF used without reloading the driver/utility.
+ */
+
+LTV_INFO_STRUCT ltv_info[] = {
+	{ (LTVP)&mfi_sup,			LOF(CFG_SUP_RANGE_STRCT) } ,
+	{ (LTVP)&cfi_sup,			LOF(CFG_SUP_RANGE_STRCT) } ,
+	{ (LTVP) NULL, 				0 }
+};
+
+
+/***********************************************************************************************************/
+/***************************************  PROTOTYPES  ******************************************************/
+/***********************************************************************************************************/
+static int				check_comp_fw( memimage *fw );
+
+
+/************************************************************************************************************
+*.SUBMODULE		int check_comp_fw( memimage *fw )
+*.PURPOSE		Checks compatibility of CFI and MFI, NIC as supplier, station/AP firmware image as supplier.
+*
+*.ARGUMENTS
+*   fw         	F/W image to be downloaded
+*
+*.RETURNS
+*   HFC_SUCCESS      	- firmware OK
+*   DHF_ERR_INCOMP_FW
+*
+*.DESCRIPTION
+*   This function uses compatibility and identity information that has been
+*   retrieved from the card which is currently inserted to check whether the
+*   station firmware image to be downloaded is compatible.
+*.ENDDOC				END DOCUMENTATION
+*************************************************************************************************************/
+int
+check_comp_fw( memimage *fw )
+{
+CFG_RANGE20_STRCT  		*p;
+int   					rc = HCF_SUCCESS;
+CFG_RANGE_SPEC_STRCT*	i;
+
+	switch( fw->identity->typ ) {
+	  case CFG_FW_IDENTITY:				//Station F/W
+	  case COMP_ID_FW_AP_FAKE:			//;?is this useful (used to be:  CFG_AP_IDENTITY)
+		break;
+	  default:
+		MMDASSERT( DO_ASSERT, fw->identity->typ ) 	//unknown/unsupported firmware_type:
+		rc = DHF_ERR_INCOMP_FW;
+		return rc; /* ;? how useful is this anyway,
+					*  till that is sorted out might as well violate my own single exit principle
+					*/
+	}
+	p = fw->compat;
+	i = NULL;
+	while( p->len && i == NULL ) {					// check the MFI ranges
+		if ( p->typ  == CFG_MFI_ACT_RANGES_STA ) {
+			i = mmd_check_comp( (void*)p, &mfi_sup );
+		}
+		p++;
+	}
+	MMDASSERT( i, 0 )	//MFI: NIC Supplier not compatible with F/W image Actor
+	if ( i ) {
+		p = fw->compat;
+		i = NULL;
+		while ( p->len && i == NULL ) {			// check the CFI ranges
+			if ( p->typ  == CFG_CFI_ACT_RANGES_STA ) {
+				 i = mmd_check_comp( (void*)p, &cfi_sup );
+			}
+			p++;
+		}
+		MMDASSERT( i, 0 )	//CFI: NIC Supplier not compatible with F/W image Actor
+	}
+	if ( i == NULL ) {
+		rc = DHF_ERR_INCOMP_FW;
+	}
+	return rc;
+} // check_comp_fw
+
+
+
+
+
+/*-----------------------------------------------------------------------------
+ *
+ * Exported functions
+ *
+ *---------------------------------------------------------------------------*/
+
+
+
+/*************************************************************************************************************
+*
+*.MODULE 		int dhf_download_binary( void *ifbp, memimage *fw )
+*.PURPOSE		Downloads a complete (primary, station, or access point) firmware image to the NIC.
+*
+*.ARGUMENTS
+*	ifbp		address of the Interface Block
+*   fw         	F/W image to be downloaded
+*
+*.RETURNS
+*   HCF_SUCCESS         	- download completed successfully.
+*   DHF_ERR_INCOMP_FW		- firmware not compatible
+*
+*.DESCRIPTION
+*   Initialize global variables
+*   Connect to the DHF
+*   Check the compatibility of the image (For primary firmware images it is checked first
+* 	whether download is necessary).
+*   If everything's download the firmware.
+*   Disconnect from the DHF.
+*
+*
+*.DIAGRAM
+*
+*.NOTICE:
+	MMDASSERT is unacceptable because some drivers call dhf_download_binary before hcf_connect
+
+* The old comment was:
+*.ENDDOC				END DOCUMENTATION
+*************************************************************************************************************/
+int
+dhf_download_binary( memimage *fw )
+{
+int 			rc = HCF_SUCCESS;
+CFG_PROG_STRCT 	*p;
+int				i;
+
+	//validate the image
+	for ( i = 0; i < sizeof(signature) && fw->signature[i] == signature[i]; i++ ) /*NOP*/;
+	if ( i != sizeof(signature) 		||
+		 fw->signature[i] != 0x01   	||
+		 //test for Little/Big Endian Binary flag
+		 fw->signature[i+1] != ( /*HCF_BIG_ENDIAN ? 'B' : */ 'L' ) ) rc = DHF_ERR_INCOMP_FW;
+	else {					//Little Endian Binary format
+		fw->codep    = (CFG_PROG_STRCT FAR *)((PSEUDO_CHARP)fw->codep + (hcf_32)fw );
+		fw->identity = (CFG_IDENTITY_STRCT FAR *)((PSEUDO_CHARP)fw->identity + (hcf_32)fw );
+		fw->compat   = (CFG_RANGE20_STRCT FAR *)((PSEUDO_CHARP)fw->compat + (hcf_32)fw );
+		for ( i = 0; fw->p[i]; i++ ) fw->p[i] = ((PSEUDO_CHARP)fw->p[i] + (hcf_32)fw );
+		p = fw->codep;
+		while ( p->len ) {
+			p->host_addr = (PSEUDO_CHARP)p->host_addr + (hcf_32)fw;
+			p++;
+		}
+	}
+	return rc;
+}   // dhf_download_binary
+
+
+/*************************************************************************************************************
+*
+*.MODULE 		int dhf_download_fw( void *ifbp, memimage *fw )
+*.PURPOSE		Downloads a complete (primary or tertiary) firmware image to the NIC.
+*
+*.ARGUMENTS
+*	ifbp		address of the Interface Block
+*   fw     		F/W image to be downloaded
+*
+*.RETURNS
+*	HCF_SUCCESS        	- download completed successfully.
+*	HCF_ERR_NO_NIC     	- no NIC present
+*	DHF_ERR_INCOMP_FW 	- firmware not compatible
+*
+*.DESCRIPTION
+* - check the signature of the image
+* - get the compatibility information from the components on the NIC
+*	  - Primary Firmware Identity
+*	  -	Modem - Firmware I/F
+*	  -	Controller - Firmware I/F
+*!! - if necessary ( i.e. H-I) get the PDA contents from the NIC
+* - check the compatibility of the MFI and CFI of the NIC with the F/W image
+*	Note: the Primary F/W compatibility is only relevant for the "running" HCF and is already verified in
+*	hcf_connect
+*!! -	if necessary ( i.e. H-I)
+*!!	  -	verify the sumcheck of the PDA
+*!!	  -	plug the image (based on the PDA and the default plug records)
+* - loop over all the download LTVs in the image which consists of a sequence of
+*	  - CFG_PROG_VOLATILE/CFG_PROG_NON_VOLATILE
+*	  - 1 or more sequences of CFG_PROG_ADDR, CFG_PROG_DATA,....,CFG_PROG_DATA
+*	  -	CFG_PROG_STOP
+*
+*.DIAGRAM
+*
+*.NOTICE
+* The old comment was:
+*	// Download primary firmware if necessary and allowed. This is done silently (without telling
+*	// the user) and only if the firmware in the download image is newer than the firmware in the
+*	// card.  In Major version 4 of the primary firmware functions of Hermes and Shark were
+*	// combined. Prior to that two separate versions existed. We only have to download primary
+*	// firmware if major version of primary firmware in the NIC < 4.
+*	//		download = pri_identity.version_major < 4;
+*	//		if ( download ) {
+*	//			rc = check_comp_primary( fw );
+*	//		}
+* It is my understanding that Pri Variant 1 must be updated by Pri Variant 2. The test on
+* major version < 4 should amount to the same result but be "principally" less correct
+* In deliberation with the Architecture team, it was decided that this upgrade for old H-I
+* NICs, is an aspect which belongs on the WSU level not on the DHF level
+*
+*.ENDDOC				END DOCUMENTATION
+*************************************************************************************************************/
+int
+dhf_download_fw( void *ifbp, memimage *fw )
+{
+int 				rc = HCF_SUCCESS;
+LTV_INFO_STRUCT_PTR pp = ltv_info;
+CFG_PROG_STRCT 		*p = fw->codep;
+LTVP 				ltvp;
+int					i;
+
+	MMDASSERT( fw != NULL, 0 )
+	//validate the image
+	for ( i = 0; i < sizeof(signature) && fw->signature[i] == signature[i]; i++ ) /*NOP*/;
+	if ( i != sizeof(signature) 		||
+		 fw->signature[i] != 0x01		||
+		 //check for binary image
+		 ( fw->signature[i+1] != 'C' && fw->signature[i+1] != ( /*HCF_BIG_ENDIAN ? 'B' : */ 'L' ) ) )
+		 rc = DHF_ERR_INCOMP_FW;
+
+//	Retrieve all information needed for download from the NIC
+	while ( ( rc == HCF_SUCCESS ) && ( ( ltvp = pp->ltvp) != NULL ) ) {
+		ltvp->len = pp++->len;	// Set len to original len. This len is changed to real len by GET_INFO()
+		rc = GET_INFO( ltvp );
+		MMDASSERT( rc == HCF_SUCCESS, rc )
+		MMDASSERT( rc == HCF_SUCCESS, ltvp->typ )
+		MMDASSERT( rc == HCF_SUCCESS, ltvp->len )
+	}
+	if ( rc == HCF_SUCCESS ) rc = check_comp_fw( fw );
+	if ( rc == HCF_SUCCESS ) {
+		while ( rc == HCF_SUCCESS && p->len ) {
+			rc = PUT_INFO( p );
+			p++;
+		}
+	}
+	MMDASSERT( rc == HCF_SUCCESS, rc )
+	return rc;
+}   // dhf_download_fw
+
+
diff --git a/drivers/staging/wlags49_h2/dhf.h b/drivers/staging/wlags49_h2/dhf.h
new file mode 100644
index 000000000000..c071f342a655
--- /dev/null
+++ b/drivers/staging/wlags49_h2/dhf.h
@@ -0,0 +1,226 @@
+
+//   vim:tw=110:ts=4:
+#ifndef DHF_H
+#define DHF_H
+
+/**************************************************************************************************************
+*
+* FILE   :	DHF.H
+*
+* DATE	:	$Date: 2004/07/19 08:16:14 $   $Revision: 1.2 $
+* Original	:	2004/05/17 07:33:13    Revision: 1.25      Tag: hcf7_t20040602_01
+* Original	:	2004/05/11 06:03:14    Revision: 1.24      Tag: hcf7_t7_20040513_01
+* Original	:	2004/04/15 09:24:42    Revision: 1.22      Tag: hcf7_t7_20040415_01
+* Original	:	2004/04/09 14:35:52    Revision: 1.21      Tag: t7_20040413_01
+* Original	:	2004/04/01 15:32:55    Revision: 1.18      Tag: t7_20040401_01
+* Original	:	2004/03/10 15:39:28    Revision: 1.15      Tag: t20040310_01
+* Original	:	2004/03/04 11:03:38    Revision: 1.13      Tag: t20040304_01
+* Original	:	2004/02/25 14:14:37    Revision: 1.11      Tag: t20040302_03
+* Original	:	2004/02/24 13:00:28    Revision: 1.10      Tag: t20040224_01
+* Original	:	2004/02/19 10:57:28    Revision: 1.8      Tag: t20040219_01
+*
+* AUTHOR :	John Meertens
+*			Nico Valster
+*
+* SPECIFICATION: .........
+*
+* DESC   :	structure definitions and function prototypes for unit DHF.
+*
+*			Customizable via HCFCFG.H, which is included indirectly via HCF.H
+*
+***************************************************************************************************************
+*
+*
+* SOFTWARE LICENSE
+*
+* This software is provided subject to the following terms and conditions,
+* which you should read carefully before using the software.  Using this
+* software indicates your acceptance of these terms and conditions.  If you do
+* not agree with these terms and conditions, do not use the software.
+*
+* COPYRIGHT © 1994 - 1995	by AT&T.				All Rights Reserved
+* COPYRIGHT © 1999 - 2000 by Lucent Technologies.	All Rights Reserved
+* COPYRIGHT © 2001 - 2004	by Agere Systems Inc.	All Rights Reserved
+* All rights reserved.
+*
+* Redistribution and use in source or binary forms, with or without
+* modifications, are permitted provided that the following conditions are met:
+*
+* . Redistributions of source code must retain the above copyright notice, this
+*    list of conditions and the following Disclaimer as comments in the code as
+*    well as in the documentation and/or other materials provided with the
+*    distribution.
+*
+* . Redistributions in binary form must reproduce the above copyright notice,
+*    this list of conditions and the following Disclaimer in the documentation
+*    and/or other materials provided with the distribution.
+*
+* . Neither the name of Agere Systems Inc. nor the names of the contributors
+*    may be used to endorse or promote products derived from this software
+*    without specific prior written permission.
+*
+* Disclaimer
+*
+* THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
+* INCLUDING, BUT NOT LIMITED TO, INFRINGEMENT AND THE IMPLIED WARRANTIES OF
+* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  ANY
+* USE, MODIFICATION OR DISTRIBUTION OF THIS SOFTWARE IS SOLELY AT THE USERS OWN
+* RISK. IN NO EVENT SHALL AGERE SYSTEMS INC. OR CONTRIBUTORS BE LIABLE FOR ANY
+* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+* ON ANY THEORY OF LIABILITY, INCLUDING, BUT NOT LIMITED TO, CONTRACT, STRICT
+* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+* OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+* DAMAGE.
+*
+*
+**************************************************************************************************************/
+
+
+#ifdef _WIN32_WCE
+#include <windef.h>
+#endif
+
+#include "hcf.h"   		 	// includes HCFCFG.H too
+
+#ifdef DHF_UIL
+#define GET_INFO( pp )  uil_get_info( (LTVP)pp )
+#define PUT_INFO( pp )  uil_put_info( (LTVP)pp )
+#else
+#define GET_INFO( pp )  hcf_get_info( ifbp, (LTVP)pp )
+#define PUT_INFO( pp )  hcf_put_info( ifbp, (LTVP)pp )
+#endif
+
+
+/*---- Defines --------------------------------------------------------------*/
+#define CODEMASK				0x0000FFFFL    	// Codemask for plug records
+
+/*---- Error numbers --------------------------------------------------------*/
+
+#define DHF_ERR_INCOMP_FW		0x40	//Image not compatible with NIC
+
+/*---- Type definitions -----------------------------------------------------*/
+//* needed by dhf_wrap.c
+//
+typedef struct {
+	LTVP 	ltvp;
+	hcf_16	len;
+} LTV_INFO_STRUCT , *LTV_INFO_STRUCT_PTR;
+
+
+/*
+ * Type: 	plugrecord
+ *
+ * Abstract: This structure represents a Plug Data Record.
+ *
+ * Description:
+ * This structure is used to overlay the plug records in the firmware memory image.
+ */
+
+typedef struct {
+	hcf_32	code;      	// Code to plug
+	hcf_32	addr;      	// Address within the memory image to plug it in
+	hcf_32	len;       	// The # of bytes which are available to store it
+} plugrecord;
+
+/*
+ * Type: 	stringrecord
+ *
+ * Abstract: This structure represents a Firmware debug/assert string
+ *
+ * Description:
+ * This structure is used to get assert and debug outputs in the driver and/or utility to be
+ * able to get more visability of the FW.
+ */
+
+#define MAX_DEBUGSTRINGS 		1024
+#define MAX_DEBUGSTRING_LEN 	  82
+
+typedef struct {
+	hcf_32	id;
+	char 	str[MAX_DEBUGSTRING_LEN];
+} stringrecord;
+
+/*
+ * Type: 	exportrecord
+ *
+ * Abstract: This structure represents a Firmware export of a variable
+ *
+ * Description:
+ * This structure is used to get the address and name of a FW variable.
+ */
+
+#define MAX_DEBUGEXPORTS 		2048
+#define MAX_DEBUGEXPORT_LEN 	  12
+
+typedef struct {
+	hcf_32	id;
+	char 	str[MAX_DEBUGEXPORT_LEN];
+} exportrecord;
+
+// Offsets in memimage array p[]
+#define FWSTRINGS_FUNCTION		0
+#define FWEXPORTS_FUNCTION		1
+
+/*
+ * Type: memimage
+ *
+ * Abstract: The "root" description of a complete memory image
+ *
+ * Description:
+ * This type represents an entire memory image. The image is built up of several
+ * segments. These segments need not be contiguous areas in memory, in other words
+ * the image may contain 'holes'.
+ *
+ * The 'codep' field points to an array of segment_descriptor structures.
+ * The end of the array is indicated by a segment_descriptor of which all fields are zero.
+ * The 'execution' field is a 32-bit address representing the execution address
+ *	of the firmware within the memory image. This address is zero in case of non-volatile
+ *	memory download.
+ * The 'compat' field points to an array of TODO
+ * 	The end of the array is indicated by a plug record of which all fields are zero.
+ * The 'identity' field points to an array of TODO
+ * 	The end of the array is indicated by a plug record of which all fields are zero.
+ * The Hermes-I specific 'pdaplug' field points to an array of Production Data Plug record structures.
+ * 	The end of the array is indicated by a plug record of which all fields are zero.
+ * The Hermes-I specific 'priplug' field points to an array of Primary Information Plug record structures.
+ * 	The end of the array is indicated by a plug record of which all fields are zero.
+ */
+typedef struct {
+	char					signature[14+1+1];	// signature (see DHF.C) + C/LE-Bin/BE-Bin-flag + format version
+	CFG_PROG_STRCT FAR		*codep;				//
+	hcf_32           	 	execution;    		// Execution address of the firmware
+	void FAR 		      	*place_holder_1;
+	void FAR  		     	*place_holder_2;
+	CFG_RANGE20_STRCT FAR  	*compat;      		// Pointer to the compatibility info records
+	CFG_IDENTITY_STRCT FAR 	*identity;    		// Pointer to the identity info records
+	void FAR				*p[2];				/* (Up to 9) pointers for (future) expansion
+												 * currently in use:
+												 *  - F/W printf information
+												 */
+} memimage;
+
+
+
+/*-----------------------------------------------------------------------------
+ *
+ * DHF function prototypes
+ *
+ *---------------------------------------------------------------------------*/
+
+EXTERN_C int dhf_download_fw( void *ifbp, memimage *fw );	//	ifbp, ignored when using the UIL
+EXTERN_C int dhf_download_binary( memimage *fw );
+
+
+/*-----------------------------------------------------------------------------
+ *
+ * Functions to be provided by the user of the DHF module.
+ *
+ *---------------------------------------------------------------------------*/
+
+// defined in DHF.C; see there for comments
+EXTERN_C hcf_16 *find_record_in_pda( hcf_16 *pdap, hcf_16 code );
+
+#endif  // DHF_H
+
diff --git a/drivers/staging/wlags49_h2/dhfcfg.h b/drivers/staging/wlags49_h2/dhfcfg.h
new file mode 100644
index 000000000000..a0c26c678c59
--- /dev/null
+++ b/drivers/staging/wlags49_h2/dhfcfg.h
@@ -0,0 +1,158 @@
+/*******************************************************************************
+ * Agere Systems Inc.
+ * Wireless device driver for Linux (wlags49).
+ *
+ * Copyright (c) 1998-2003 Agere Systems Inc.
+ * All rights reserved.
+ *   http://www.agere.com
+ *
+ * Initially developed by TriplePoint, Inc.
+ *   http://www.triplepoint.com
+ *
+ *------------------------------------------------------------------------------
+ *
+ *   This file contains DHF configuration info.
+ *
+ *------------------------------------------------------------------------------
+ *
+ * SOFTWARE LICENSE
+ *
+ * This software is provided subject to the following terms and conditions,
+ * which you should read carefully before using the software.  Using this
+ * software indicates your acceptance of these terms and conditions.  If you do
+ * not agree with these terms and conditions, do not use the software.
+ *
+ * Copyright © 2003 Agere Systems Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source or binary forms, with or without
+ * modifications, are permitted provided that the following conditions are met:
+ *
+ * . Redistributions of source code must retain the above copyright notice, this
+ *    list of conditions and the following Disclaimer as comments in the code as
+ *    well as in the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * . Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following Disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ *
+ * . Neither the name of Agere Systems Inc. nor the names of the contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * Disclaimer
+ *
+ * THIS SOFTWARE IS PROVIDED “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, INFRINGEMENT AND THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  ANY
+ * USE, MODIFICATION OR DISTRIBUTION OF THIS SOFTWARE IS SOLELY AT THE USERS OWN
+ * RISK. IN NO EVENT SHALL AGERE SYSTEMS INC. OR CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, INCLUDING, BUT NOT LIMITED TO, CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ *
+ ******************************************************************************/
+
+#ifndef DHFCFG_H
+#define DHFCFG_H
+/*-----------------------------------------------------------------------------
+ * File DHFCFG.H
+ *
+ * Contents: #defines for the DHF module
+ *
+ * Comments:
+ *   Some combinations of the #defines in this file are illegal (as noted below).
+ *   If an illegal combinations of #defines is specified a compile error is
+ *   generated. See document DHFUG.DOC for more information.
+ *
+ * Author: John Meertens
+ * Date:   11-01-2000
+ *
+ * Change history:
+ *---------------------------------------------------------------------------*/
+
+
+// Define DHF_WCI if you want to use the WCI to access the ORiNOCO card.
+// Define DHF_UIL if you want to use the UIL to access the ORiNOCO card.
+// You must define either DHF_WCI or DHF_UIL. If neither of the two is defined
+// or both a compile error is generated.
+#define DHF_WCI
+//!!!#define DHF_UIL
+
+// Define DHF_BIG_ENDIAN if you are working on a big endian platform.
+// Define DHF_LITTLE_ENDIAN if you are working on a little endian platform.
+// You must define either DHF_BIG_ENDIAN or DHF_LITTLE_ENDIAN. If neither of
+// the two is defined or both a compile error is generated.
+#ifdef USE_BIG_ENDIAN
+#define DHF_BIG_ENDIAN
+#else
+#define DHF_LITTLE_ENDIAN
+#endif  /* USE_BIG_ENDIAN */
+
+// Define DHF_WIN if you are working on Windows platform.
+// Define DHF_DOS if you are working on DOS.
+// You must define either DHF_WIN or DHF_DOS. If neither of
+// the two is defined or both a compile error is generated.
+//!!!#define DHF_WIN
+//!!!#define DHF_DOS
+
+// Define if you want the DHF to users. Not defining DHF_GET_RES_MSG
+// leads to a decrease in code size as message strings are not included.
+//!!!#define DHF_GET_RES_MSG
+
+// Linux driver specific
+// Prevent inclusion of stdlib.h and string.h
+#define _INC_STDLIB
+#define _INC_STRING
+
+//-----------------------------------------------------------------------------
+// Define one or more of the following DSF #defines if you want to implement
+// the related DSF-function. Function dsf_callback must allways be implemented.
+// See file DHF.H for prototypes of the functions.
+
+// Define DSF_ALLOC if you want to manage memory allocation and de-allocation
+// for the DHF. If DSF_ALLOC is defined you must implement dsf_alloc and dsf_free.
+//!!!#define DSF_ALLOC
+
+// Define DSF_CONFIRM if you want the DHF to ask the user for confirmation in a
+// number of situations. If DSF_CONFIRM is defined you must implement dsf_confirm.
+// Not defining DSF_CONFIRM leads to a decrease in code size as confirmation
+// strings are not included.
+//!!!#define DSF_CONFIRM
+
+// Define DSF_DEBUG_MESSAGE if you want debug messages added to your output.
+// If you define DSF_DEBUG_MESSAGE then you must implement function
+// dsf_debug_message.
+//#define DSF_DEBUG_MESSAGE
+
+// Define DSF_ASSERT if you want asserts to be activated.
+// If you define DSF_ASSERT then you must implement function dsf_assert.
+//#define DBG 1
+//#define DSF_ASSERT
+
+// Define DSF_DBWIN if you want asserts and debug messages to be send to a debug
+// window like SOFTICE or DebugView from SysInternals.
+//!!!#define DSF_DBWIN
+//!!! Not implemented yet!
+
+// Define DSF_VOLATILE_ONLY if you only wants to use valatile functions
+// This is a typical setting for a AP and a driver.
+#define DSF_VOLATILE_ONLY
+
+// Define DSF_HERMESII if you want to use the DHF for the Hermes-II
+#ifdef HERMES2
+#define DSF_HERMESII
+#else
+#undef DSF_HERMESII
+#endif // HERMES2
+
+// Define DSF_BINARY_FILE if you want to use the DHF in combination with
+// reading the Firmware from a separate binary file.
+//!!!#define DSF_BINARY_FILE
+
+#endif // DHFCFG_H
diff --git a/drivers/staging/wlags49_h2/hcf.c b/drivers/staging/wlags49_h2/hcf.c
new file mode 100644
index 000000000000..6e39f5081e27
--- /dev/null
+++ b/drivers/staging/wlags49_h2/hcf.c
@@ -0,0 +1,4881 @@
+//   vim:tw=110:ts=4:
+/************************************************************************************************************
+*
+* FILE   :	HCF.C
+*
+* DATE    :	$Date: 2004/08/05 11:47:10 $   $Revision: 1.10 $
+* Original:	2004/06/02 10:22:22    Revision: 1.85      Tag: hcf7_t20040602_01
+* Original:	2004/04/15 09:24:41    Revision: 1.63      Tag: hcf7_t7_20040415_01
+* Original:	2004/04/13 14:22:44    Revision: 1.62      Tag: t7_20040413_01
+* Original:	2004/04/01 15:32:55    Revision: 1.59      Tag: t7_20040401_01
+* Original:	2004/03/10 15:39:27    Revision: 1.55      Tag: t20040310_01
+* Original:	2004/03/04 11:03:37    Revision: 1.53      Tag: t20040304_01
+* Original:	2004/03/02 14:51:21    Revision: 1.50      Tag: t20040302_03
+* Original:	2004/02/24 13:00:27    Revision: 1.43      Tag: t20040224_01
+* Original:	2004/02/19 10:57:25    Revision: 1.39      Tag: t20040219_01
+*
+* AUTHOR :	Nico Valster
+*
+* SPECIFICATION: ........
+*
+* DESCRIPTION :	HCF Routines for Hermes-II (callable via the Wireless Connection I/F or WCI)
+*				Local Support Routines for above procedures
+*
+*			Customizable via HCFCFG.H, which is included by HCF.H
+*
+*************************************************************************************************************
+*
+*
+* SOFTWARE LICENSE
+*
+* This software is provided subject to the following terms and conditions,
+* which you should read carefully before using the software.  Using this
+* software indicates your acceptance of these terms and conditions.  If you do
+* not agree with these terms and conditions, do not use the software.
+*
+* COPYRIGHT © 1994 - 1995	by AT&T.				All Rights Reserved
+* COPYRIGHT © 1996 - 2000 by Lucent Technologies.	All Rights Reserved
+* COPYRIGHT © 2001 - 2004	by Agere Systems Inc.	All Rights Reserved
+* All rights reserved.
+*
+* Redistribution and use in source or binary forms, with or without
+* modifications, are permitted provided that the following conditions are met:
+*
+* . Redistributions of source code must retain the above copyright notice, this
+*    list of conditions and the following Disclaimer as comments in the code as
+*    well as in the documentation and/or other materials provided with the
+*    distribution.
+*
+* . Redistributions in binary form must reproduce the above copyright notice,
+*    this list of conditions and the following Disclaimer in the documentation
+*    and/or other materials provided with the distribution.
+*
+* . Neither the name of Agere Systems Inc. nor the names of the contributors
+*    may be used to endorse or promote products derived from this software
+*    without specific prior written permission.
+*
+* Disclaimer
+*
+* THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
+* INCLUDING, BUT NOT LIMITED TO, INFRINGEMENT AND THE IMPLIED WARRANTIES OF
+* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  ANY
+* USE, MODIFICATION OR DISTRIBUTION OF THIS SOFTWARE IS SOLELY AT THE USERS OWN
+* RISK. IN NO EVENT SHALL AGERE SYSTEMS INC. OR CONTRIBUTORS BE LIABLE FOR ANY
+* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+* ON ANY THEORY OF LIABILITY, INCLUDING, BUT NOT LIMITED TO, CONTRACT, STRICT
+* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+* OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+* DAMAGE.
+*
+*
+************************************************************************************************************/
+
+
+/************************************************************************************************************
+**
+** Implementation Notes
+**
+* -	a leading marker of //! is used. The purpose of such a sequence is to help to understand the flow
+*	An example is:	//!rc = HCF_SUCCESS;
+*	if this is superfluous because rc is already guaranteed to be 0 but it shows to the (maintenance)
+*	programmer it is an intentional omission at the place where someone could consider it most appropriate at
+*	first glance
+* -	using near pointers in a model where ss!=ds is an invitation for disaster, so be aware of how you specify
+*	your model and how you define variables which are used at interrupt time
+* -	remember that sign extension on 32 bit platforms may cause problems unless code is carefully constructed,
+*	e.g. use "(hcf_16)~foo" rather than "~foo"
+*
+************************************************************************************************************/
+
+#include "hcf.h"				// HCF and MSF common include file
+#include "hcfdef.h"				// HCF specific include file
+#include "mmd.h"				// MoreModularDriver common include file
+
+#if ! defined offsetof
+#define offsetof(s,m)   ((unsigned int)&(((s *)0)->m))
+#endif // offsetof
+
+
+/***********************************************************************************************************/
+/***************************************  PROTOTYPES  ******************************************************/
+/***********************************************************************************************************/
+HCF_STATIC int			cmd_exe( IFBP ifbp, hcf_16 cmd_code, hcf_16 par_0 );
+HCF_STATIC int			init( IFBP ifbp );
+HCF_STATIC int			put_info( IFBP ifbp, LTVP ltvp );
+#if (HCF_EXT) & HCF_EXT_MB
+HCF_STATIC int			put_info_mb( IFBP ifbp, CFG_MB_INFO_STRCT FAR * ltvp );
+#endif // HCF_EXT_MB
+#if (HCF_TYPE) & HCF_TYPE_WPA
+HCF_STATIC void			calc_mic( hcf_32* p, hcf_32 M );
+void 					calc_mic_rx_frag( IFBP ifbp, wci_bufp p, int len );
+void 					calc_mic_tx_frag( IFBP ifbp, wci_bufp p, int len );
+HCF_STATIC int			check_mic( IFBP ifbp );
+#endif // HCF_TYPE_WPA
+
+HCF_STATIC void			calibrate( IFBP ifbp );
+HCF_STATIC int			cmd_cmpl( IFBP ifbp );
+HCF_STATIC hcf_16		get_fid( IFBP ifbp );
+HCF_STATIC void			isr_info( IFBP ifbp );
+#if HCF_DMA
+HCF_STATIC DESC_STRCT*	get_frame_lst(IFBP ifbp, int tx_rx_flag);
+#endif // HCF_DMA
+HCF_STATIC void			get_frag( IFBP ifbp, wci_bufp bufp, int len BE_PAR( int word_len ) );	//char*, byte count (usually even)
+#if HCF_DMA
+HCF_STATIC void			put_frame_lst( IFBP ifbp, DESC_STRCT *descp, int tx_rx_flag );
+#endif // HCF_DMA
+HCF_STATIC void			put_frag( IFBP ifbp, wci_bufp bufp, int len BE_PAR( int word_len ) );
+HCF_STATIC void			put_frag_finalize( IFBP ifbp );
+HCF_STATIC int			setup_bap( IFBP ifbp, hcf_16 fid, int offset, int type );
+#if (HCF_ASSERT) & HCF_ASSERT_PRINTF
+static int fw_printf(IFBP ifbp, CFG_FW_PRINTF_STRCT FAR *ltvp);
+#endif // HCF_ASSERT_PRINTF
+
+HCF_STATIC int			download( IFBP ifbp, CFG_PROG_STRCT FAR *ltvp );
+#if (HCF_ENCAP) & HCF_ENC
+HCF_STATIC hcf_8		hcf_encap( wci_bufp type );
+#endif // HCF_ENCAP
+HCF_STATIC hcf_8		null_addr[4] = { 0, 0, 0, 0 };
+#if ! defined IN_PORT_WORD			//replace I/O Macros with logging facility
+extern FILE *log_file;
+
+#define IN_PORT_WORD(port)			in_port_word( (hcf_io)(port) )
+
+static hcf_16 in_port_word( hcf_io port ) {
+hcf_16 i = (hcf_16)_inpw( port );
+	if ( log_file ) {
+		fprintf( log_file, "\nR %2.2x %4.4x", (port)&0xFF, i);
+	}
+	return i;
+} // in_port_word
+
+#define OUT_PORT_WORD(port, value)	out_port_word( (hcf_io)(port), (hcf_16)(value) )
+
+static void out_port_word( hcf_io port, hcf_16 value ) {
+	_outpw( port, value );
+	if ( log_file ) {
+		fprintf( log_file, "\nW %2.02x %4.04x", (port)&0xFF, value );
+	}
+}
+
+void IN_PORT_STRING_32( hcf_io prt, hcf_32 FAR * dst, int n)	{
+	int i = 0;
+	hcf_16 FAR * p;
+	if ( log_file ) {
+		fprintf( log_file, "\nread string_32 length %04x (%04d) at port %02.2x to addr %lp",
+				 (hcf_16)n, (hcf_16)n, (hcf_16)(prt)&0xFF, dst);
+	}
+	while ( n-- ) {
+		p = (hcf_16 FAR *)dst;
+		*p++ = (hcf_16)_inpw( prt );
+		*p   = (hcf_16)_inpw( prt );
+		if ( log_file ) {
+			fprintf( log_file, "%s%08lx ", i++ % 0x08 ? " " : "\n", *dst);
+		}
+		dst++;
+	}
+} // IN_PORT_STRING_32
+
+void IN_PORT_STRING_8_16( hcf_io prt, hcf_8 FAR * dst, int n) {	//also handles byte alignment problems
+	hcf_16 FAR * p = (hcf_16 FAR *)dst;							//this needs more elaborate code in non-x86 platforms
+	int i = 0;
+	if ( log_file ) {
+		fprintf( log_file, "\nread string_16 length %04x (%04d) at port %02.2x to addr %lp",
+				 (hcf_16)n, (hcf_16)n, (hcf_16)(prt)&0xFF, dst );
+	}
+	while ( n-- ) {
+		*p =(hcf_16)_inpw( prt);
+		if ( log_file ) {
+			if ( i++ % 0x10 ) {
+				fprintf( log_file, "%04x ", *p);
+			} else {
+				fprintf( log_file, "\n%04x ", *p);
+			}
+		}
+		p++;
+	}
+} // IN_PORT_STRING_8_16
+
+void OUT_PORT_STRING_32( hcf_io prt, hcf_32 FAR * src, int n)	{
+	int i = 0;
+	hcf_16 FAR * p;
+	if ( log_file ) {
+		fprintf( log_file, "\nwrite string_32 length %04x (%04d) at port %02.2x",
+				 (hcf_16)n, (hcf_16)n, (hcf_16)(prt)&0xFF);
+	}
+	while ( n-- ) {
+		p = (hcf_16 FAR *)src;
+		_outpw( prt, *p++ );
+		_outpw( prt, *p   );
+		if ( log_file ) {
+			fprintf( log_file, "%s%08lx ", i++ % 0x08 ? " " : "\n", *src);
+		}
+		src++;
+	}
+} // OUT_PORT_STRING_32
+
+void OUT_PORT_STRING_8_16( hcf_io prt, hcf_8 FAR * src, int n)	{	//also handles byte alignment problems
+	hcf_16 FAR * p = (hcf_16 FAR *)src;								//this needs more elaborate code in non-x86 platforms
+	int i = 0;
+	if ( log_file ) {
+		fprintf( log_file, "\nwrite string_16 length %04x (%04d) at port %04x", n, n, (hcf_16)prt);
+	}
+	while ( n-- ) {
+		(void)_outpw( prt, *p);
+		if ( log_file ) {
+			if ( i++ % 0x10 ) {
+				fprintf( log_file, "%04x ", *p);
+			} else {
+				fprintf( log_file, "\n%04x ", *p);
+			}
+		}
+		p++;
+	}
+} // OUT_PORT_STRING_8_16
+
+#endif // IN_PORT_WORD
+
+/************************************************************************************************************
+******************************* D A T A    D E F I N I T I O N S ********************************************
+************************************************************************************************************/
+
+#if HCF_ASSERT
+IFBP BASED assert_ifbp = NULL;			//to make asserts easily work under MMD and DHF
+#endif // HCF_ASSERT
+
+#if HCF_ENCAP
+/* SNAP header to be inserted in Ethernet-II frames */
+HCF_STATIC  hcf_8 BASED snap_header[] = { 0xAA, 0xAA, 0x03, 0x00, 0x00,	//5 bytes signature +
+										  0 };							//1 byte protocol identifier
+#endif // HCF_ENCAP
+
+#if (HCF_TYPE) & HCF_TYPE_WPA
+HCF_STATIC hcf_8 BASED mic_pad[8] = { 0x5A, 0, 0, 0, 0, 0, 0, 0 };		//MIC padding of message
+#endif // HCF_TYPE_WPA
+
+#if defined MSF_COMPONENT_ID
+CFG_IDENTITY_STRCT BASED cfg_drv_identity = {
+	sizeof(cfg_drv_identity)/sizeof(hcf_16) - 1,	//length of RID
+	CFG_DRV_IDENTITY,			// (0x0826)
+	MSF_COMPONENT_ID,
+	MSF_COMPONENT_VAR,
+	MSF_COMPONENT_MAJOR_VER,
+	MSF_COMPONENT_MINOR_VER
+} ;
+
+CFG_RANGES_STRCT BASED cfg_drv_sup_range = {
+	sizeof(cfg_drv_sup_range)/sizeof(hcf_16) - 1,	//length of RID
+	CFG_DRV_SUP_RANGE,			// (0x0827)
+
+	COMP_ROLE_SUPL,
+	COMP_ID_DUI,
+	{{	DUI_COMPAT_VAR,
+		DUI_COMPAT_BOT,
+		DUI_COMPAT_TOP
+	}}
+} ;
+
+struct CFG_RANGE3_STRCT BASED cfg_drv_act_ranges_pri = {
+	sizeof(cfg_drv_act_ranges_pri)/sizeof(hcf_16) - 1,	//length of RID
+	CFG_DRV_ACT_RANGES_PRI,		// (0x0828)
+
+	COMP_ROLE_ACT,
+	COMP_ID_PRI,
+	{
+	 { 0, 0, 0 }, 							// HCF_PRI_VAR_1 not supported by HCF 7
+	 { 0, 0, 0 }, 							// HCF_PRI_VAR_2 not supported by HCF 7
+	 {	3,									//var_rec[2] - Variant number
+		CFG_DRV_ACT_RANGES_PRI_3_BOTTOM,		//		 - Bottom Compatibility
+		CFG_DRV_ACT_RANGES_PRI_3_TOP			//		 - Top Compatibility
+	 }
+	}
+} ;
+
+
+struct CFG_RANGE4_STRCT BASED cfg_drv_act_ranges_sta = {
+	sizeof(cfg_drv_act_ranges_sta)/sizeof(hcf_16) - 1,	//length of RID
+	CFG_DRV_ACT_RANGES_STA,		// (0x0829)
+
+	COMP_ROLE_ACT,
+	COMP_ID_STA,
+	{
+#if defined HCF_STA_VAR_1
+	 {	1,									//var_rec[1] - Variant number
+		CFG_DRV_ACT_RANGES_STA_1_BOTTOM,		//		 - Bottom Compatibility
+		CFG_DRV_ACT_RANGES_STA_1_TOP			//		 - Top Compatibility
+	 },
+#else
+	 { 0, 0, 0 },
+#endif // HCF_STA_VAR_1
+#if defined HCF_STA_VAR_2
+	 {	2,									//var_rec[1] - Variant number
+		CFG_DRV_ACT_RANGES_STA_2_BOTTOM,		//		 - Bottom Compatibility
+		CFG_DRV_ACT_RANGES_STA_2_TOP			//		 - Top Compatibility
+	 },
+#else
+	 { 0, 0, 0 },
+#endif // HCF_STA_VAR_2
+// For Native_USB (Not used!)
+#if defined HCF_STA_VAR_3
+	 {	3,									//var_rec[1] - Variant number
+		CFG_DRV_ACT_RANGES_STA_3_BOTTOM,		//		 - Bottom Compatibility
+		CFG_DRV_ACT_RANGES_STA_3_TOP			//		 - Top Compatibility
+	 },
+#else
+	 { 0, 0, 0 },
+#endif // HCF_STA_VAR_3
+// Warp
+#if defined HCF_STA_VAR_4
+	 {	4,									//var_rec[1] - Variant number
+		CFG_DRV_ACT_RANGES_STA_4_BOTTOM,		//           - Bottom Compatibility
+		CFG_DRV_ACT_RANGES_STA_4_TOP			//           - Top Compatibility
+	 }
+#else
+	 { 0, 0, 0 }
+#endif // HCF_STA_VAR_4
+	}
+} ;
+
+
+struct CFG_RANGE6_STRCT BASED cfg_drv_act_ranges_hsi = {
+	sizeof(cfg_drv_act_ranges_hsi)/sizeof(hcf_16) - 1,	//length of RID
+	CFG_DRV_ACT_RANGES_HSI,		// (0x082A)
+	COMP_ROLE_ACT,
+	COMP_ID_HSI,
+	{
+#if defined HCF_HSI_VAR_0					// Controlled deployment
+	 {	0,									// var_rec[1] - Variant number
+		CFG_DRV_ACT_RANGES_HSI_0_BOTTOM,		//           - Bottom Compatibility
+		CFG_DRV_ACT_RANGES_HSI_0_TOP			//           - Top Compatibility
+	 },
+#else
+	 { 0, 0, 0 },
+#endif // HCF_HSI_VAR_0
+	 { 0, 0, 0 }, 							// HCF_HSI_VAR_1 not supported by HCF 7
+	 { 0, 0, 0 }, 							// HCF_HSI_VAR_2 not supported by HCF 7
+	 { 0, 0, 0 }, 							// HCF_HSI_VAR_3 not supported by HCF 7
+#if defined HCF_HSI_VAR_4					// Hermes-II all types
+	 {	4,									// var_rec[1] - Variant number
+		CFG_DRV_ACT_RANGES_HSI_4_BOTTOM,		//           - Bottom Compatibility
+		CFG_DRV_ACT_RANGES_HSI_4_TOP			//           - Top Compatibility
+	 },
+#else
+	 { 0, 0, 0 },
+#endif // HCF_HSI_VAR_4
+#if defined HCF_HSI_VAR_5					// WARP Hermes-2.5
+	 {	5,									// var_rec[1] - Variant number
+		CFG_DRV_ACT_RANGES_HSI_5_BOTTOM,		//           - Bottom Compatibility
+		CFG_DRV_ACT_RANGES_HSI_5_TOP			//           - Top Compatibility
+	 }
+#else
+	 { 0, 0, 0 }
+#endif // HCF_HSI_VAR_5
+	}
+} ;
+
+
+CFG_RANGE4_STRCT BASED cfg_drv_act_ranges_apf = {
+	sizeof(cfg_drv_act_ranges_apf)/sizeof(hcf_16) - 1,	//length of RID
+	CFG_DRV_ACT_RANGES_APF,		// (0x082B)
+
+	COMP_ROLE_ACT,
+	COMP_ID_APF,
+	{
+#if defined HCF_APF_VAR_1				//(Fake) Hermes-I
+	 {	1,									//var_rec[1] - Variant number
+		CFG_DRV_ACT_RANGES_APF_1_BOTTOM,		//           - Bottom Compatibility
+		CFG_DRV_ACT_RANGES_APF_1_TOP			//           - Top Compatibility
+	 },
+#else
+	 { 0, 0, 0 },
+#endif // HCF_APF_VAR_1
+#if defined HCF_APF_VAR_2				//Hermes-II
+	 {	2,									// var_rec[1] - Variant number
+		CFG_DRV_ACT_RANGES_APF_2_BOTTOM,		//           - Bottom Compatibility
+		CFG_DRV_ACT_RANGES_APF_2_TOP			//           - Top Compatibility
+	 },
+#else
+	 { 0, 0, 0 },
+#endif // HCF_APF_VAR_2
+#if defined HCF_APF_VAR_3						// Native_USB
+	 {	3,										// var_rec[1] - Variant number
+		CFG_DRV_ACT_RANGES_APF_3_BOTTOM,		//           - Bottom Compatibility	!!!!!see note below!!!!!!!
+		CFG_DRV_ACT_RANGES_APF_3_TOP			//           - Top Compatibility
+	 },
+#else
+	 { 0, 0, 0 },
+#endif // HCF_APF_VAR_3
+#if defined HCF_APF_VAR_4						// WARP Hermes 2.5
+	 {	4,										// var_rec[1] - Variant number
+		CFG_DRV_ACT_RANGES_APF_4_BOTTOM,		//           - Bottom Compatibility	!!!!!see note below!!!!!!!
+		CFG_DRV_ACT_RANGES_APF_4_TOP			//           - Top Compatibility
+	 }
+#else
+	 { 0, 0, 0 }
+#endif // HCF_APF_VAR_4
+	}
+} ;
+#define HCF_VERSION  TEXT( "HCF$Revision: 1.10 $" )
+
+static struct /*CFG_HCF_OPT_STRCT*/ {
+	hcf_16	len;					//length of cfg_hcf_opt struct
+	hcf_16	typ;					//type 0x082C
+	hcf_16	 v0;						//offset HCF_VERSION
+	hcf_16	 v1;						// MSF_COMPONENT_ID
+	hcf_16	 v2;						// HCF_ALIGN
+	hcf_16	 v3;						// HCF_ASSERT
+	hcf_16	 v4;						// HCF_BIG_ENDIAN
+	hcf_16	 v5;						// /* HCF_DLV | HCF_DLNV */
+	hcf_16	 v6;						// HCF_DMA
+	hcf_16	 v7;						// HCF_ENCAP
+	hcf_16	 v8;						// HCF_EXT
+	hcf_16	 v9;						// HCF_INT_ON
+	hcf_16	v10;						// HCF_IO
+	hcf_16	v11;						// HCF_LEGACY
+	hcf_16	v12;						// HCF_MAX_LTV
+	hcf_16	v13;						// HCF_PROT_TIME
+	hcf_16	v14;						// HCF_SLEEP
+	hcf_16	v15;						// HCF_TALLIES
+	hcf_16	v16;						// HCF_TYPE
+	hcf_16	v17;						// HCF_NIC_TAL_CNT
+	hcf_16	v18;						// HCF_HCF_TAL_CNT
+	hcf_16	v19;						// offset tallies
+	TCHAR	val[sizeof(HCF_VERSION)];
+} BASED cfg_hcf_opt = {
+	sizeof(cfg_hcf_opt)/sizeof(hcf_16) -1,
+	CFG_HCF_OPT,				// (0x082C)
+	( sizeof(cfg_hcf_opt) - sizeof(HCF_VERSION) - 4 )/sizeof(hcf_16),
+#if defined MSF_COMPONENT_ID
+	MSF_COMPONENT_ID,
+#else
+	0,
+#endif // MSF_COMPONENT_ID
+	HCF_ALIGN,
+	HCF_ASSERT,
+	HCF_BIG_ENDIAN,
+	0,									// /* HCF_DLV | HCF_DLNV*/,
+	HCF_DMA,
+	HCF_ENCAP,
+	HCF_EXT,
+	HCF_INT_ON,
+	HCF_IO,
+	HCF_LEGACY,
+	HCF_MAX_LTV,
+	HCF_PROT_TIME,
+	HCF_SLEEP,
+	HCF_TALLIES,
+	HCF_TYPE,
+#if (HCF_TALLIES) & ( HCF_TALLIES_NIC | HCF_TALLIES_HCF )
+	HCF_NIC_TAL_CNT,
+	HCF_HCF_TAL_CNT,
+	offsetof(IFB_STRCT, IFB_TallyLen ),
+#else
+	0, 0, 0,
+#endif // HCF_TALLIES_NIC / HCF_TALLIES_HCF
+	HCF_VERSION
+}; // cfg_hcf_opt
+#endif // MSF_COMPONENT_ID
+
+#if defined HCF_TALLIES_EXTRA
+	replaced by HCF_EXT_TALLIES_FW ;
+#endif // HCF_TALLIES_EXTRA
+
+#if defined MSF_COMPONENT_ID || (HCF_EXT) & HCF_EXT_MB
+#if (HCF_EXT) & HCF_EXT_MB
+HCF_STATIC LTV_STRCT BASED cfg_null = { 1, CFG_NULL, {0} };
+#endif // HCF_EXT_MB
+HCF_STATIC hcf_16* BASED xxxx[ ] = {
+#if (HCF_EXT) & HCF_EXT_MB
+	&cfg_null.len,							//CFG_NULL						0x0820
+#endif // HCF_EXT_MB
+#if defined MSF_COMPONENT_ID
+	&cfg_drv_identity.len,					//CFG_DRV_IDENTITY              0x0826
+	&cfg_drv_sup_range.len,					//CFG_DRV_SUP_RANGE             0x0827
+	&cfg_drv_act_ranges_pri.len,			//CFG_DRV_ACT_RANGES_PRI        0x0828
+	&cfg_drv_act_ranges_sta.len,			//CFG_DRV_ACT_RANGES_STA		0x0829
+	&cfg_drv_act_ranges_hsi.len,			//CFG_DRV_ACT_RANGES_HSI		0x082A
+	&cfg_drv_act_ranges_apf.len,			//CFG_DRV_ACT_RANGES_APF		0x082B
+	&cfg_hcf_opt.len,						//CFG_HCF_OPT					0x082C
+	NULL,									//IFB_PRIIdentity placeholder	0xFD02
+	NULL,									//IFB_PRISup placeholder		0xFD03
+#endif // MSF_COMPONENT_ID
+	NULL									//endsentinel
+  };
+#define xxxx_PRI_IDENTITY_OFFSET	(sizeof(xxxx)/sizeof(xxxx[0]) - 3)
+
+#endif // MSF_COMPONENT_ID / HCF_EXT_MB
+
+
+/************************************************************************************************************
+************************** T O P   L E V E L   H C F   R O U T I N E S **************************************
+************************************************************************************************************/
+
+#if (HCF_DL_ONLY) == 0
+/************************************************************************************************************
+*
+*.MODULE		int hcf_action( IFBP ifbp, hcf_16 action )
+*.PURPOSE		Changes the run-time Card behavior.
+*				Performs Miscellanuous actions.
+*
+*.ARGUMENTS
+*	ifbp					address of the Interface Block
+*	action					number identifying the type of change
+*	 - HCF_ACT_CCX_OFF		disable CKIP
+*	 - HCF_ACT_CCX_ON		enable CKIP
+*	 - HCF_ACT_INT_FORCE_ON	enable interrupt generation by WaveLAN NIC
+*	 - HCF_ACT_INT_OFF		disable interrupt generation by WaveLAN NIC
+*	 - HCF_ACT_INT_ON		compensate 1 HCF_ACT_INT_OFF, enable interrupt generation if balance reached
+*	 - HCF_ACT_PRS_SCAN		Hermes Probe Respons Scan (F102) command
+*	 - HCF_ACT_RX_ACK		acknowledge non-DMA receiver to Hermes
+*	 - HCF_ACT_SCAN			Hermes Inquire Scan (F101) command (non-WARP only)
+*	 - HCF_ACT_SLEEP		DDS Sleep request
+*	 - HCF_ACT_TALLIES		Hermes Inquire Tallies (F100) command
+*
+*.RETURNS
+*	HCF_SUCCESS				all (including invalid)
+*	HCF_INT_PENDING			HCF_ACT_INT_OFF, interrupt pending
+*	HCF_ERR_NO_NIC			HCF_ACT_INT_OFF, NIC presence check fails
+*
+*.CONDITIONS
+* Except for hcf_action with HCF_ACT_INT_FORCE_ON or HCF_ACT_INT_OFF as parameter or hcf_connect with an I/O
+* address (i.e. not HCF_DISCONNECT), all hcf-function calls MUST be preceeded by a call of hcf_action with
+* HCF_ACT_INT_OFF as parameter.
+* Note that hcf_connect defaults to NIC interrupt disabled mode, i.e. as if hcf_action( HCF_ACT_INT_OFF )
+* was called.
+*
+*.DESCRIPTION
+* hcf_action supports the following mode changing action-code pairs that are antonyms
+*	 - HCF_ACT_CCX_OFF / HCF_ACT_CCX_ON
+*	 - HCF_ACT_INT_[FORCE_]ON / HCF_ACT_INT_OFF
+*
+* Additionally hcf_action can start the following actions in the NIC:
+*	 - HCF_ACT_PRS_SCAN
+*	 - HCF_ACT_RX_ACK
+*	 - HCF_ACT_SCAN
+*	 - HCF_ACT_SLEEP
+*	 - HCF_ACT_TALLIES
+*
+* o HCF_ACT_INT_OFF: Sets NIC Interrupts mode Disabled.
+* This command, and the associated [Force] Enable NIC interrupts command, are only available if the HCF_INT_ON
+* compile time option is not set at 0x0000.
+*
+* o HCF_ACT_INT_ON: Sets NIC Interrupts mode Enabled.
+* Enable NIC Interrupts, depending on the number of preceding Disable NIC Interrupt calls.
+*
+* o HCF_ACT_INT_FORCE_ON: Force NIC Interrupts mode Enabled.
+* Sets NIC Interrupts mode Enabled, regardless off the number of preceding Disable NIC Interrupt calls.
+*
+* The disabling and enabling of interrupts are antonyms.
+* These actions must be balanced.
+* For each "disable interrupts" there must be a matching "enable interrupts".
+* The disable interrupts may be executed multiple times in a row without intervening enable interrupts, in
+* other words, the disable interrupts may be nested.
+* The interrupt generation mechanism is disabled at the first call with HCF_ACT_INT_OFF.
+* The interrupt generation mechanism is re-enabled when the number of calls with HCF_ACT_INT_ON matches the
+* number of calls with INT_OFF.
+*
+* It is not allowed to have more Enable NIC Interrupts calls than Disable NIC Interrupts calls.
+* The interrupt generation mechanism is initially (i.e. after hcf_connect) disabled.
+* An MSF based on a interrupt strategy must call hcf_action with INT_ON in its initialization logic.
+*
+*!	The INT_OFF/INT_ON housekeeping is initialized at 0x0000 by hcf_connect, causing the interrupt generation
+*	mechanism to be disabled at first. This suits MSF implementation based on a polling strategy.
+*
+* o HCF_ACT_CCX_OFF / HCF_ACT_CCX_ON
+*!! This can use some more explanation;?
+* Disables and Enables support in the HCF runtime code for the CCX feature. Each time one of these action
+* codes is used, the effects of the preceding use cease.
+*
+* o HCF_ACT_SLEEP: Initiates the Disconnected DeepSleep process
+* This command is only available if the HCF_DDS compile time option is set. It triggers the F/W to start the
+* sleep handshaking. Regardless whether the Host initiates a Disconnected DeepSleep (DDS) or the F/W initiates
+* a Connected DeepSleep (CDS), the Host-F/W sleep handshaking is completed when the NIC Interrupts mode is
+* enabled (by means of the balancing HCF_ACT_INT_ON), i.e. at that moment the F/W really goes into sleep mode.
+* The F/W is wokenup by the HCF when the NIC Interrupts mode are disabled, i.e. at the first HCF_ACT_INT_OFF
+* after going into sleep.
+*
+* The following Miscellanuous actions are defined:
+*
+* o HCF_ACT_RX_ACK: Receiver Acknowledgement (non-DMA, non-USB mode only)
+* Acking the receiver, frees the NIC memory used to hold the Rx frame and allows the F/W to
+* report the existence of the next Rx frame.
+* If the MSF does not need access (any longer) to the current frame, e.g. because it is rejected based on the
+* look ahead or copied to another buffer, the receiver may be acked. Acking earlier is assumed to have the
+* potential of improving the performance.
+* If the MSF does not explitly ack te receiver, the acking is done implicitly if:
+* - the received frame fits in the look ahead buffer, by the hcf_service_nic call that reported the Rx frame
+* - if not in the above step, by hcf_rcv_msg (assuming hcf_rcv_msg is called)
+* - if neither of the above implicit acks nor an explicit ack by the MSF, by the first hcf_service_nic after
+*	the hcf_service_nic that reported the Rx frame.
+* Note: If an Rx frame is already acked, an explicit ACK by the MSF acts as a NoOperation.
+*
+* o HCF_ACT_TALLIES: Inquire Tallies command
+* This command is only operational if the F/W is enabled.
+* The Inquire Tallies command requests the F/W to provide its current set of tallies.
+* See also hcf_get_info with CFG_TALLIES as parameter.
+*
+* o HCF_ACT_PRS_SCAN: Inquire Probe Respons Scan command
+* This command is only operational if the F/W is enabled.
+* The Probe Respons Scan command starts a scan sequence.
+* The HCF puts the result of this action in an MSF defined buffer (see CFG_RID_LOG_STRCT).
+*
+* o HCF_ACT_SCAN: Inquire Scan command
+* This command is only supported for HII F/W (i.e. pre-WARP) and it is operational if the F/W is enabled.
+* The Inquire Scan command starts a scan sequence.
+* The HCF puts the result of this action in an MSF defined buffer (see CFG_RID_LOG_STRCT).
+*
+* Assert fails if
+* - ifbp has a recognizable out-of-range value.
+* - NIC interrupts are not disabled while required by parameter action.
+* - an invalid code is specified in parameter action.
+* - HCF_ACT_INT_ON commands outnumber the HCF_ACT_INT_OFF commands.
+* - reentrancy, may be  caused by calling hcf_functions without adequate protection against NIC interrupts or
+*	multi-threading
+*
+* - Since the HCF does not maintain status information relative to the F/W enabled state, it is not asserted
+*	whether HCF_ACT_SCAN, HCF_ACT_PRS_SCAN or HCF_ACT_TALLIES are only used while F/W is enabled.
+*
+*.DIAGRAM
+* 0: The assert embedded in HCFLOGENTRY checks against re-entrancy. Re-entrancy could be caused by a MSF logic
+*	at task-level calling hcf_functions without shielding with HCF_ACT_ON/_OFF. However the HCF_ACT_INT_OFF
+*	action itself can per definition not be protected this way. Based on code inspection, it can be concluded,
+*	that there is no re-entrancy PROBLEM in this particular flow. It does not seem worth the trouble to
+*	explicitly check for this condition (although there was a report of an MSF which ran into this assert.
+* 2:IFB_IntOffCnt is used to balance the INT_OFF and INT_ON calls.  Disabling of the interrupts is achieved by
+*	writing a zero to the Hermes IntEn register.  In a shared interrupt environment (e.g. the mini-PCI NDIS
+*	driver) it is considered more correct to return the status HCF_INT_PENDING if and only if, the current
+*	invocation of hcf_service_nic is (apparently) called in the ISR when the ISR was activated as result of a
+*	change in HREG_EV_STAT matching a bit in HREG_INT_EN, i.e. not if invoked as result of another device
+*	generating an interrupt on the shared interrupt line.
+*	Note 1: it has been observed that under certain adverse conditions on certain platforms the writing of
+*	HREG_INT_EN can apparently fail, therefor it is paramount that HREG_INT_EN is written again with 0 for
+*	each and every call to HCF_ACT_INT_OFF.
+*	Note 2: it has been observed that under certain H/W & S/W architectures this logic is called when there is
+*	no NIC at all. To cater for this, the value of HREG_INT_EN is validated. If the unused bit 0x0100 is set,
+*	it is assumed there is no NIC.
+*	Note 3: During the download process, some versions of the F/W reset HREG_SW_0, hence checking this
+*	register for HCF_MAGIC (the classical NIC presence test) when HCF_ACT_INT_OFF is called due to another
+*	card interrupting via a shared IRQ during a download, fails.
+*4:	The construction "if ( ifbp->IFB_IntOffCnt-- == 0 )" is optimal (in the sense of shortest/quickest
+*	path in error free flows) but NOT fail safe in case of too many INT_ON invocations compared to INT_OFF).
+*	Enabling of the interrupts is achieved by writing the Hermes IntEn register.
+*	 - If the HCF is in Defunct mode, the interrupts stay disabled.
+*	 - Under "normal" conditions, the HCF is only interested in Info Events, Rx Events and Notify Events.
+*	 - When the HCF is out of Tx/Notify resources, the HCF is also interested in Alloc Events.
+*	 - via HCF_EXT, the MSF programmer can also request HREG_EV_TICK and/or HREG_EV_TX_EXC interrupts.
+*	For DMA operation, the DMA hardware handles the alloc events. The DMA engine will generate a 'TxDmaDone'
+*	event as soon as it has pumped a frame from host ram into NIC-RAM (note that the frame does not have to be
+*	transmitted then), and a 'RxDmaDone' event as soon as a received frame has been pumped from NIC-RAM into
+*	host ram.  Note that the 'alloc' event has been removed from the event-mask, because the DMA engine will
+*	react to and acknowledge this event.
+*6:	ack the "old" Rx-event. See "Rx Buffer free strategy" in hcf_service_nic above for more explanation.
+*	IFB_RxFID and IFB_RxLen must be cleared to bring both the internal HCF house keeping and the information
+*	supplied to the MSF in the state "no frame received".
+*8:	The HCF_ACT_SCAN, HCF_ACT_PRS_SCAN and HCF_ACT_TALLIES activity are merged by "clever" algebraic
+*	manipulations of the RID-values and action codes, so foregoing robustness against migration problems for
+*	ease of implementation. The assumptions about numerical relationships between CFG_TALLIES etc and
+*	HCF_ACT_TALLIES etc are checked by the "#if" statements just prior to the body of this routine, resulting
+*	in: err "maintenance" during compilation if the assumptions are no longer met. The writing of HREG_PARAM_1
+*	with 0x3FFF in case of an PRS scan, is a kludge to get around lack of specification, hence different
+*	implementation in F/W and Host.
+*	When there is no NIC RAM available, some versions of the Hermes F/W do report 0x7F00 as error in the
+*	Result field of the Status register and some F/W versions don't. To mask this difference to the MSF all
+*	return codes of the Hermes are ignored ("best" and "most simple" solution to these types of analomies with
+*	an acceptable loss due to ignoring all error situations as well).
+*	The "No inquire space" is reported via the Hermes tallies.
+*30: do not HCFASSERT( rc, rc ) since rc == HCF_INT_PENDING is no error
+*
+*.ENDDOC				END DOCUMENTATION
+*
+************************************************************************************************************/
+#if ( (HCF_TYPE) & HCF_TYPE_HII5 ) == 0
+#if CFG_SCAN != CFG_TALLIES - HCF_ACT_TALLIES + HCF_ACT_SCAN
+err: "maintenance" apparently inviolated the underlying assumption about the numerical values of these macros
+#endif
+#endif // HCF_TYPE_HII5
+#if CFG_PRS_SCAN != CFG_TALLIES - HCF_ACT_TALLIES + HCF_ACT_PRS_SCAN
+err: "maintenance" apparently inviolated the underlying assumption about the numerical values of these macros
+#endif
+int
+hcf_action( IFBP ifbp, hcf_16 action )
+{
+int	rc = HCF_SUCCESS;
+
+	HCFASSERT( ifbp->IFB_Magic == HCF_MAGIC, ifbp->IFB_Magic )
+#if HCF_INT_ON
+	HCFLOGENTRY( action == HCF_ACT_INT_FORCE_ON ? HCF_TRACE_ACTION_KLUDGE : HCF_TRACE_ACTION, action )														/* 0 */
+#if (HCF_SLEEP)
+	HCFASSERT( ifbp->IFB_IntOffCnt != 0xFFFE || action == HCF_ACT_INT_OFF,
+			   MERGE_2( action, ifbp->IFB_IntOffCnt ) )
+#else
+	HCFASSERT( ifbp->IFB_IntOffCnt != 0xFFFE, action )
+#endif // HCF_SLEEP
+	HCFASSERT( ifbp->IFB_IntOffCnt != 0xFFFF ||
+			   action == HCF_ACT_INT_OFF || action == HCF_ACT_INT_FORCE_ON,  action )
+	HCFASSERT( ifbp->IFB_IntOffCnt <= 16 || ifbp->IFB_IntOffCnt >= 0xFFFE,
+			   MERGE_2( action, ifbp->IFB_IntOffCnt ) )	//nesting more than 16 deep seems unreasonable
+#endif // HCF_INT_ON
+
+	switch (action) {
+#if HCF_INT_ON
+hcf_16	i;
+	  case HCF_ACT_INT_OFF:						// Disable Interrupt generation
+#if HCF_SLEEP
+		if ( ifbp->IFB_IntOffCnt == 0xFFFE ) {	// WakeUp test	;?tie this to the "new" super-LinkStat
+			ifbp->IFB_IntOffCnt++;						// restore conventional I/F
+			OPW(HREG_IO, HREG_IO_WAKEUP_ASYNC );		// set wakeup bit
+			OPW(HREG_IO, HREG_IO_WAKEUP_ASYNC );		// set wakeup bit to counteract the clearing by F/W
+			// 800 us latency before FW switches to high power
+			MSF_WAIT(800);								// MSF-defined function to wait n microseconds.
+//OOR		if ( ifbp->IFB_DSLinkStat & CFG_LINK_STAT_DS_OOR ) { // OutOfRange
+//				printk( "<5>ACT_INT_OFF: Deepsleep phase terminated, enable and go to AwaitConnection\n" );		//;?remove me 1 day
+//				hcf_cntl( ifbp, HCF_CNTL_ENABLE );
+//			}
+//			ifbp->IFB_DSLinkStat &= ~( CFG_LINK_STAT_DS_IR | CFG_LINK_STAT_DS_OOR);	//clear IR/OOR state
+		}
+#endif // HCF_SLEEP
+/*2*/	ifbp->IFB_IntOffCnt++;
+//!     rc = 0;
+		i = IPW( HREG_INT_EN );
+		OPW( HREG_INT_EN, 0 );
+		if ( i & 0x1000 ) {
+			rc = HCF_ERR_NO_NIC;
+		} else {
+			if ( i & IPW( HREG_EV_STAT ) ) {
+				rc = HCF_INT_PENDING;
+			}
+		}
+		break;
+
+	  case HCF_ACT_INT_FORCE_ON:				// Enforce Enable Interrupt generation
+		ifbp->IFB_IntOffCnt = 0;
+		//Fall through in HCF_ACT_INT_ON
+
+	  case HCF_ACT_INT_ON:						// Enable Interrupt generation
+/*4*/	if ( ifbp->IFB_IntOffCnt-- == 0 && ifbp->IFB_CardStat == 0 ) {
+												//determine Interrupt Event mask
+#if HCF_DMA
+			if ( ifbp->IFB_CntlOpt & USE_DMA ) {
+				i = HREG_EV_INFO | HREG_EV_RDMAD | HREG_EV_TDMAD | HREG_EV_TX_EXT;	//mask when DMA active
+			} else
+#endif // HCF_DMA
+			{
+				i = HREG_EV_INFO | HREG_EV_RX | HREG_EV_TX_EXT;						//mask when DMA not active
+				if ( ifbp->IFB_RscInd == 0 ) {
+					i |= HREG_EV_ALLOC;												//mask when no TxFID available
+				}
+			}
+#if HCF_SLEEP
+			if ( ( IPW(HREG_EV_STAT) & ( i | HREG_EV_SLEEP_REQ ) ) == HREG_EV_SLEEP_REQ ) {
+				// firmware indicates it would like to go into sleep modus
+				// only acknowledge this request if no other events that can cause an interrupt are pending
+				ifbp->IFB_IntOffCnt--;			//becomes 0xFFFE
+            	OPW( HREG_INT_EN, i | HREG_EV_TICK );
+				OPW( HREG_EV_ACK, HREG_EV_SLEEP_REQ | HREG_EV_TICK | HREG_EV_ACK_REG_READY );
+			} else
+#endif // HCF_SLEEP
+			{
+            	OPW( HREG_INT_EN, i | HREG_EV_SLEEP_REQ );
+			}
+		}
+		break;
+#endif // HCF_INT_ON
+
+#if (HCF_SLEEP) & HCF_DDS
+	  case HCF_ACT_SLEEP:						// DDS Sleep request
+		hcf_cntl( ifbp, HCF_CNTL_DISABLE );
+		cmd_exe( ifbp, HCMD_SLEEP, 0 );
+		break;
+// 	  case HCF_ACT_WAKEUP:						// DDS Wakeup request
+// 		HCFASSERT( ifbp->IFB_IntOffCnt == 0xFFFE, ifbp->IFB_IntOffCnt )
+// 		ifbp->IFB_IntOffCnt++;					// restore conventional I/F
+// 		OPW( HREG_IO, HREG_IO_WAKEUP_ASYNC );
+// 		MSF_WAIT(800);							// MSF-defined function to wait n microseconds.
+// 		rc = hcf_action( ifbp, HCF_ACT_INT_OFF );	/*bogus, IFB_IntOffCnt == 0xFFFF, so if you carefully look
+// 													 *at the #if HCF_DDS statements, HCF_ACT_INT_OFF is empty
+// 													 *for DDS. "Much" better would be to merge the flows for
+// 													 *DDS and DEEP_SLEEP
+// 													 */
+// 		break;
+#endif // HCF_DDS
+
+#if (HCF_TYPE) & HCF_TYPE_CCX
+	  case HCF_ACT_CCX_ON:						// enable CKIP
+	  case HCF_ACT_CCX_OFF:						// disable CKIP
+		ifbp->IFB_CKIPStat = action;
+		break;
+#endif // HCF_TYPE_CCX
+
+	  case HCF_ACT_RX_ACK:						//Receiver ACK
+/*6*/	if ( ifbp->IFB_RxFID ) {
+			DAWA_ACK( HREG_EV_RX );
+		}
+		ifbp->IFB_RxFID = ifbp->IFB_RxLen = 0;
+		break;
+
+/*8*/ case	HCF_ACT_PRS_SCAN:					// Hermes PRS Scan (F102)
+		OPW( HREG_PARAM_1, 0x3FFF );
+			//Fall through in HCF_ACT_TALLIES
+	  case HCF_ACT_TALLIES:						// Hermes Inquire Tallies (F100)
+#if ( (HCF_TYPE) & HCF_TYPE_HII5 ) == 0
+	  case HCF_ACT_SCAN:						// Hermes Inquire Scan (F101)
+#endif // HCF_TYPE_HII5
+		/*!! the assumptions about numerical relationships between CFG_TALLIES etc and HCF_ACT_TALLIES etc
+		 *   are checked by #if statements just prior to this routine resulting in: err "maintenance"	*/
+		cmd_exe( ifbp, HCMD_INQUIRE, action - HCF_ACT_TALLIES + CFG_TALLIES );
+		break;
+
+	  default:
+		HCFASSERT( DO_ASSERT, action )
+		break;
+	}
+	//! do not HCFASSERT( rc == HCF_SUCCESS, rc )														/* 30*/
+	HCFLOGEXIT( HCF_TRACE_ACTION )
+	return rc;
+} // hcf_action
+#endif // HCF_DL_ONLY
+
+
+/************************************************************************************************************
+*
+*.MODULE		int hcf_cntl( IFBP ifbp, hcf_16 cmd )
+*.PURPOSE		Connect or disconnect a specific port to a specific network.
+*!!  ;???????????????? continue needs more explanation
+*				recovers by means of "continue" when the connect proces in CCX mode fails
+*				Enables or disables data transmission and reception for the NIC.
+*				Activates static NIC configuration for a specific port at connect.
+*				Activates static configuration for all ports at enable.
+*
+*.ARGUMENTS
+*	ifbp		address of the Interface Block
+*	cmd			0x001F:	Hermes command (disable, enable, connect, disconnect, continue)
+*					HCF_CNTL_ENABLE		Enable
+*					HCF_CNTL_DISABLE    Disable
+*					HCF_CNTL_CONTINUE	Continue
+*					HCF_CNTL_CONNECT    Connect
+*					HCF_CNTL_DISCONNECT Disconnect
+*				0x0100: command qualifier (continue)
+*					HCMD_RETRY			retry flag
+*				0x0700:  port number (connect/disconnect)
+*					HCF_PORT_0          MAC Port 0
+*					HCF_PORT_1          MAC Port 1
+*					HCF_PORT_2          MAC Port 2
+*					HCF_PORT_3          MAC Port 3
+*					HCF_PORT_4          MAC Port 4
+*					HCF_PORT_5          MAC Port 5
+*					HCF_PORT_6          MAC Port 6
+*
+*.RETURNS
+*	HCF_SUCCESS
+*!!	via cmd_exe
+*	HCF_ERR_NO_NIC
+*	HCF_ERR_DEFUNCT_...
+*	HCF_ERR_TIME_OUT
+*
+*.DESCRIPTION
+* The parameter cmd contains a number of subfields.
+* The actual value for cmd is created by logical or-ing the appropriate mnemonics for the subfields.
+* The field 0x001F contains the command code
+*  - HCF_CNTL_ENABLE
+*  - HCF_CNTL_DISABLE
+*  - HCF_CNTL_CONNECT
+*  - HCF_CNTL_DISCONNECT
+*  - HCF_CNTL_CONTINUE
+*
+* For HCF_CNTL_CONTINUE, the field 0x0100 contains the retry flag HCMD_RETRY.
+* For HCF_CNTL_CONNECT and HCF_CNTL_DISCONNECT, the field 0x0700 contains the port number as HCF_PORT_#.
+* For Station as well as AccessPoint F/W, MAC Port 0 is the "normal" communication channel.
+* For AccessPoint F/W, MAC Port 1 through 6 control the WDS links.
+*
+* Note that despite the names HCF_CNTL_DISABLE and HCF_CNTL_ENABLE, hcf_cntl does not influence the NIC
+* Interrupts mode.
+*
+* The Connect is used by the MSF to bring a particular port in an inactive state as far as data transmission
+* and reception are concerned.
+* When a particular port is disconnected:
+* - the F/W disables the receiver for that port.
+* - the F/W ignores send commands for that port.
+* - all frames (Receive as well as pending Transmit) for that port on the NIC are discarded.
+*
+* When the NIC is disabled, above list applies to all ports, i.e. the result is like all ports are
+* disconnected.
+*
+* When a particular port is connected:
+* - the F/W effectuates the static configuration for that port.
+* - enables the receiver for that port.
+* - accepts send commands for that port.
+*
+* Enabling has the following effects:
+* - the F/W effectuates the static configuration for all ports.
+*	The F/W only updates its static configuration at a transition from disabled to enabled or from
+*	disconnected to connected.
+*	In order to enforce the static configuration, the MSF must assure that such a transition takes place.
+*	Due to such a disable/enable or disconnect/connect sequence, Rx/Tx frames may be lost, in other words,
+*	configuration may impact communication.
+* - The DMA Engine (if applicable) is enabled.
+* Note that the Enable Function by itself only enables data transmission and reception, it
+* does not enable the Interrupt Generation mechanism. This is done by hcf_action.
+*
+* Disabling has the following effects:
+*!!  ;?????is the following statement really true
+* - it acts as a disconnect on all ports.
+* - The DMA Engine (if applicable) is disabled.
+*
+* For impact of the disable command on the behavior of hcf_dma_tx/rx_get see the appropriate sections.
+*
+* Although the Enable/Disable and Connect/Disconnect are antonyms, there is no restriction on their sequencing,
+* in other words, they may be called multiple times in arbitrary sequence without being paired or balanced.
+* Each time one of these functions is called, the effects of the preceding calls cease.
+*
+* Assert fails if
+* - ifbp has a recognizable out-of-range value.
+* - NIC interrupts are not disabled.
+* - A command other than Continue, Enable, Disable, Connect or Disconnect is given.
+* - An invalid combination of the subfields is given or a bit outside the subfields is given.
+* - any return code besides HCF_SUCCESS.
+* - reentrancy, may be  caused by calling a hcf_function without adequate protection against NIC interrupts or
+*	multi-threading
+*
+*.DIAGRAM
+*	hcf_cntl takes successively the following actions:
+*2:	If the HCF is in Defunct mode or incompatible with the Primary or Station Supplier in the Hermes,
+*	hcf_cntl() returns immediately with HCF_ERR_NO_NIC;? as status.
+*8:	when the port is disabled, the DMA engine needs to be de-activated, so the host can safely reclaim tx
+*	packets from the tx descriptor chain.
+*
+*.ENDDOC				END DOCUMENTATION
+*
+************************************************************************************************************/
+int
+hcf_cntl( IFBP ifbp, hcf_16 cmd )
+{
+int	rc = HCF_ERR_INCOMP_FW;
+#if HCF_ASSERT
+{	int x = cmd & HCMD_CMD_CODE;
+	if ( x == HCF_CNTL_CONTINUE ) x &= ~HCMD_RETRY;
+	else if ( (x == HCMD_DISABLE || x == HCMD_ENABLE) && ifbp->IFB_FWIdentity.comp_id == COMP_ID_FW_AP ) {
+		x &= ~HFS_TX_CNTL_PORT;
+	}
+	HCFASSERT( x==HCF_CNTL_ENABLE  || x==HCF_CNTL_DISABLE    || HCF_CNTL_CONTINUE ||
+			   x==HCF_CNTL_CONNECT || x==HCF_CNTL_DISCONNECT, cmd )
+}
+#endif // HCF_ASSERT
+// #if (HCF_SLEEP) & HCF_DDS
+// 	HCFASSERT( ifbp->IFB_IntOffCnt != 0xFFFE, cmd )
+// #endif // HCF_DDS
+	HCFLOGENTRY( HCF_TRACE_CNTL, cmd )
+	if ( ifbp->IFB_CardStat == 0 ) {																 /*2*/
+/*6*/	rc = cmd_exe( ifbp, cmd, 0 );
+#if (HCF_SLEEP) & HCF_DDS
+		ifbp->IFB_TickCnt = 0;				//start 2 second period (with 1 tick uncertanty)
+#endif // HCF_DDS
+	}
+#if HCF_DMA
+	//!rlav : note that this piece of code is always executed, regardless of the DEFUNCT bit in IFB_CardStat.
+	// The reason behind this is that the MSF should be able to get all its DMA resources back from the HCF,
+	// even if the hardware is disfunctional. Practical example under Windows : surprise removal.
+	if ( ifbp->IFB_CntlOpt & USE_DMA ) {
+		hcf_io io_port = ifbp->IFB_IOBase;
+		DESC_STRCT *p;
+		if ( cmd == HCF_CNTL_DISABLE || cmd == HCF_CNTL_ENABLE ) {
+			OUT_PORT_DWORD( (io_port + HREG_DMA_CTRL), DMA_CTRLSTAT_RESET);						/*8*/
+			ifbp->IFB_CntlOpt &= ~DMA_ENABLED;
+		}
+		if ( cmd == HCF_CNTL_ENABLE ) {
+			OUT_PORT_DWORD( (io_port + HREG_DMA_CTRL), DMA_CTRLSTAT_GO);
+			/* ;? by rewriting hcf_dma_rx_put you can probably just call hcf_dma_rx_put( ifbp->IFB_FirstDesc[DMA_RX] )
+			 * as additional beneficiary side effect, the SOP and EOP bits will also be cleared
+			 */
+			ifbp->IFB_CntlOpt |= DMA_ENABLED;
+			HCFASSERT( NT_ASSERT, NEVER_TESTED )
+			// make the entire rx descriptor chain DMA-owned, so the DMA engine can (re-)use it.
+			if ( ( p = ifbp->IFB_FirstDesc[DMA_RX] ) != NULL ) {   //;? Think this over again in the light of the new chaining strategy
+				if ( 1 ) 	{ //begin alternative
+					HCFASSERT( NT_ASSERT, NEVER_TESTED )
+					put_frame_lst( ifbp, ifbp->IFB_FirstDesc[DMA_RX], DMA_RX );
+					if ( ifbp->IFB_FirstDesc[DMA_RX] ) {
+						put_frame_lst( ifbp, ifbp->IFB_FirstDesc[DMA_RX]->next_desc_addr, DMA_RX );
+					}
+				} else {
+					while ( p ) {
+						//p->buf_cntl.cntl_stat |= DESC_DMA_OWNED;
+						p->BUF_CNT |= DESC_DMA_OWNED;
+						p = p->next_desc_addr;
+					}
+					// a rx chain is available so hand it over to the DMA engine
+					p = ifbp->IFB_FirstDesc[DMA_RX];
+					OUT_PORT_DWORD( (io_port + HREG_RXDMA_PTR32), p->desc_phys_addr);
+				}  //end alternative
+			}
+		}
+	}
+#endif // HCF_DMA
+	HCFASSERT( rc == HCF_SUCCESS, rc )
+	HCFLOGEXIT( HCF_TRACE_CNTL )
+	return rc;
+} // hcf_cntl
+
+
+/************************************************************************************************************
+*
+*.MODULE		int hcf_connect( IFBP ifbp, hcf_io io_base )
+*.PURPOSE		Grants access right for the HCF to the IFB.
+*				Initializes Card and HCF housekeeping.
+*
+*.ARGUMENTS
+*	ifbp		(near) address of the Interface Block
+*	io_base		non-USB: I/O Base address of the NIC (connect)
+*				non-USB: HCF_DISCONNECT
+*				USB:	 HCF_CONNECT, HCF_DISCONNECT
+*
+*.RETURNS
+*	HCF_SUCCESS
+*	HCF_ERR_INCOMP_PRI
+*	HCF_ERR_INCOMP_FW
+*	HCF_ERR_DEFUNCT_CMD_SEQ
+*!!	HCF_ERR_NO_NIC really returned ;?
+*	HCF_ERR_NO_NIC
+*	HCF_ERR_TIME_OUT
+*
+*	MSF-accessible fields of Result Block:
+*	IFB_IOBase				entry parameter io_base
+*	IFB_IORange				HREG_IO_RANGE (0x40/0x80)
+*	IFB_Version				version of the IFB layout
+*	IFB_FWIdentity			CFG_FW_IDENTITY_STRCT, specifies the identity of the
+*							"running" F/W, i.e. tertiary F/W under normal conditions
+*	IFB_FWSup				CFG_SUP_RANGE_STRCT, specifies the supplier range of
+*							the "running" F/W, i.e. tertiary F/W under normal conditions
+*	IFB_HSISup				CFG_SUP_RANGE_STRCT, specifies the HW/SW I/F range of the NIC
+*	IFB_PRIIdentity			CFG_PRI_IDENTITY_STRCT, specifies the Identity of the Primary F/W
+*	IFB_PRISup				CFG_SUP_RANGE_STRCT, specifies the supplier range of the Primary F/W
+*	all other				all MSF accessible fields, which are not specified above, are zero-filled
+*
+*.CONDITIONS
+* It is the responsibility of the MSF to assure the correctness of the I/O Base address.
+*
+* Note: hcf_connect defaults to NIC interrupt disabled mode, i.e. as if hcf_action( HCF_ACT_INT_OFF )
+* was called.
+*
+*.DESCRIPTION
+* hcf_connect passes the MSF-defined location of the IFB to the HCF and grants or revokes access right for the
+* HCF to the IFB. Revoking is done by specifying HCF_DISCONNECT rather than an I/O address for the parameter
+* io_base.  Every call of hcf_connect in "connect" mode, must eventually be followed by a call of hcf_connect
+* in "disconnect" mode. Clalling hcf_connect in "connect"/"disconnect" mode can not be nested.
+* The IFB address must be used as a handle with all subsequent HCF-function calls and the HCF uses the IFB
+* address as a handle when it performs a call(back) of an MSF-function (i.e. msf_assert).
+*
+* Note that not only the MSF accessible fields are cleared, but also all internal housekeeping
+* information is re-initialized.
+* This implies that all settings which are done via hcf_action and hcf_put_info (e.g. CFG_MB_ASSERT, CFG_REG_MB,
+* CFG_REG_INFO_LOG) must be done again. The only field which is not cleared, is IFB_MSFSup.
+*
+* If HCF_INT_ON is selected as compile option, NIC interrupts are disabled.
+*
+* Assert fails if
+* - ifbp is not properly aligned ( ref chapter HCF_ALIGN in 4.1.1)
+* - I/O Base Address is not a multiple of 0x40 (note: 0x0000 is explicitly allowed).
+*
+*.DIAGRAM
+*
+*0:	Throughout hcf_connect you need to distinguish the connect from the disconnect case, which requires
+*	some attention about what to use as "I/O" address when for which purpose.
+*2:
+*2a: Reset H-II by toggling reset bit in IO-register on and off.
+*	The HCF_TYPE_PRELOADED caters for the DOS environment where H-II is loaded by a separate program to
+*	overcome the 64k size limit posed on DOS drivers.
+*	The macro OPW is not yet useable because the IFB_IOBase field is not set.
+*	Note 1: hopefully the clearing and initializing of the IFB (see below) acts as a delay which meets the
+*	specification for S/W reset
+*	Note 2: it turns out that on some H/W constellations, the clock to access the EEProm is not lowered
+*	to an appropriate frequency by HREG_IO_SRESET. By giving an HCMD_INI first, this problem is worked around.
+*2b: Experimentally it is determined over a wide range of F/W versions that waiting for the for Cmd bit in
+*	Ev register gives a workable strategy. The available documentation does not give much clues.
+*4:	clear and initialize the IFB
+*	The HCF house keeping info is designed such that zero is the appropriate initial value for as much as
+*	feasible IFB-items.
+*	The readable fields mentioned in the description section and some HCF specific fields are given their
+*	actual value.
+*	IFB_TickIni is initialized at best guess before calibration
+*	Hcf_connect defaults to "no interrupt generation" (implicitly achieved by the zero-filling).
+*6:	Register compile-time linked MSF Routine and set default filter level
+*	cast needed to get around the "near" problem in DOS COM model
+*	er C2446: no conversion from void (__near __cdecl *)(unsigned char __far *,unsigned int,unsigned short,int)
+*							to   void (__far  __cdecl *)(unsigned char __far *,unsigned int,unsigned short,int)
+*8:	If a command is apparently still active (as indicated by the Busy bit in Cmd register) this may indicate a
+*	blocked cmd pipe line.  To unblock the following actions are done:
+*	 - Ack everything
+*	 - Wait for Busy bit drop  in Cmd register
+*	 - Wait for Cmd  bit raise in Ev  register
+*	The two waits are combined in a single HCF_WAIT_WHILE to optimize memory size. If either of these waits
+*	fail (prot_cnt becomes 0), then something is serious wrong. Rather than PANICK, the assumption is that the
+*	next cmd_exe will fail, causing the HCF to go into DEFUNCT mode
+*10:	Ack everything to unblock a (possibly blocked) cmd pipe line
+*	Note 1: it is very likely that an Alloc event is pending and very well possible that a (Send) Cmd event is
+*	pending on non-initial calls
+*	Note 2: it is assumed that this strategy takes away the need to ack every conceivable event after an
+*	Hermes Initialize
+*12:	Only H-II NEEDS the Hermes Initialize command. Due to the different semantics for H-I and H-II
+*	Initialize command, init() does not (and can not, since it is called e.g. after a download) execute the
+*	Hermes Initialize command. Executing the Hermes Initialize command for H-I would not harm but not do
+*	anything useful either, so it is skipped.
+*	The return status of cmd_exe is ignored. It is assumed that if cmd_exe fails, init fails too
+*14:	use io_base as a flag to merge hcf_connect and hcf_disconnect into 1 routine
+*	the call to init and its subsequent call of cmd_exe will return HCF_ERR_NO_NIC if appropriate. This status
+*	is (badly) needed by some legacy combination of NT4 and card services which do not yield an I/O address in
+*	time.
+*
+*.NOTICE
+*	On platforms where the NULL-pointer is not a bit-pattern of all zeros, the zero-filling of the IFB results
+*	in an incorrect initialization of pointers.
+*	The implementation of the MailBox manipulation in put_mb_info protects against the absence of a MailBox
+*	based on IFB_MBSize, IFB_MBWp and ifbp->IFB_MBRp. This has ramifications on the initialization of the
+*	MailBox via hcf_put_info with the CFG_REG_MB type, but it prevents dependency on the "NULL-"ness of
+*	IFB_MBp.
+*
+*.NOTICE
+*	There are a number of problems when asserting and logging hcf_connect, e.g.
+*	 - Asserting on re-entrancy of hcf_connect by means of
+*	 "HCFASSERT( (ifbp->IFB_AssertTrace & HCF_ASSERT_CONNECT) == 0, 0 )" is not useful because IFB contents
+*	 are undefined
+*	 - Asserting before the IFB is cleared will cause mdd_assert() to interpret the garbage in IFB_AssertRtn
+*	 as a routine address
+*	Therefore HCFTRACE nor HCFLOGENTRY is called by hcf_connect.
+*.ENDDOC				END DOCUMENTATION
+*
+************************************************************************************************************/
+int
+hcf_connect( IFBP ifbp, hcf_io io_base )
+{
+int			rc = HCF_SUCCESS;
+hcf_io		io_addr;
+hcf_32		prot_cnt;
+hcf_8		*q;
+LTV_STRCT	x;
+#if HCF_ASSERT
+	hcf_16 xa = ifbp->IFB_FWIdentity.typ;
+	/* is assumed to cause an assert later on if hcf_connect is called without intervening hcf_disconnect.
+	 * xa == CFG_FW_IDENTITY in subsequent calls without preceding hcf_disconnect,
+	 * xa == 0 in subsequent calls with preceding hcf_disconnect,
+	 * xa == "garbage" (any value except CFG_FW_IDENTITY is acceptable) in the initial call
+	 */
+#endif // HCF_ASSERT
+
+	if ( io_base == HCF_DISCONNECT ) {					//disconnect
+		io_addr = ifbp->IFB_IOBase;
+		OPW( HREG_INT_EN, 0 );		//;?workaround against dying F/W on subsequent hcf_connect calls
+	} else {											//connect								/* 0 */
+		io_addr = io_base;
+	}
+
+#if 0 //;? if a subsequent hcf_connect is preceeded by an hcf_disconnect the wakeup is not needed !!
+#if HCF_SLEEP
+    OUT_PORT_WORD( .....+HREG_IO, HREG_IO_WAKEUP_ASYNC ); 	    //OPW not yet useable
+	MSF_WAIT(800);								// MSF-defined function to wait n microseconds.
+	note that MSF_WAIT uses not yet defined!!!! IFB_IOBase and IFB_TickIni (via PROT_CNT_INI)
+	so be carefull if this code is restored
+#endif // HCF_SLEEP
+#endif // 0
+
+#if ( (HCF_TYPE) & HCF_TYPE_PRELOADED ) == 0	//switch clock back for SEEPROM access  !!!
+	OUT_PORT_WORD( io_addr + HREG_CMD, HCMD_INI );  	    //OPW not yet useable
+	prot_cnt = INI_TICK_INI;
+	HCF_WAIT_WHILE( (IN_PORT_WORD( io_addr +  HREG_EV_STAT) & HREG_EV_CMD) == 0 );
+	OUT_PORT_WORD( (io_addr + HREG_IO), HREG_IO_SRESET );	//OPW not yet useable					/* 2a*/
+#endif // HCF_TYPE_PRELOADED
+	for ( q = (hcf_8*)(&ifbp->IFB_Magic); q > (hcf_8*)ifbp; *--q = 0 ) /*NOP*/;						/* 4 */
+	ifbp->IFB_Magic		= HCF_MAGIC;
+	ifbp->IFB_Version	= IFB_VERSION;
+#if defined MSF_COMPONENT_ID //a new IFB demonstrates how dirty the solution is
+	xxxx[xxxx_PRI_IDENTITY_OFFSET] = NULL;		//IFB_PRIIdentity placeholder	0xFD02
+	xxxx[xxxx_PRI_IDENTITY_OFFSET+1] = NULL;	//IFB_PRISup placeholder		0xFD03
+#endif // MSF_COMPONENT_ID
+#if (HCF_TALLIES) & ( HCF_TALLIES_NIC | HCF_TALLIES_HCF )
+	ifbp->IFB_TallyLen = 1 + 2 * (HCF_NIC_TAL_CNT + HCF_HCF_TAL_CNT);	//convert # of Tallies to L value for LTV
+	ifbp->IFB_TallyTyp = CFG_TALLIES;			//IFB_TallyTyp: set T value
+#endif // HCF_TALLIES_NIC / HCF_TALLIES_HCF
+	ifbp->IFB_IOBase	= io_addr;				//set IO_Base asap, so asserts via HREG_SW_2 don't harm
+	ifbp->IFB_IORange	= HREG_IO_RANGE;
+	ifbp->IFB_CntlOpt	= USE_16BIT;
+#if HCF_ASSERT
+	assert_ifbp = ifbp;
+	ifbp->IFB_AssertLvl = 1;
+#if (HCF_ASSERT) & HCF_ASSERT_LNK_MSF_RTN
+	if ( io_base != HCF_DISCONNECT ) {
+		ifbp->IFB_AssertRtn = (MSF_ASSERT_RTNP)msf_assert;											/* 6 */
+	}
+#endif // HCF_ASSERT_LNK_MSF_RTN
+#if (HCF_ASSERT) & HCF_ASSERT_MB				//build the structure to pass the assert info to hcf_put_info
+	ifbp->IFB_AssertStrct.len = sizeof(ifbp->IFB_AssertStrct)/sizeof(hcf_16) - 1;
+	ifbp->IFB_AssertStrct.typ = CFG_MB_INFO;
+	ifbp->IFB_AssertStrct.base_typ = CFG_MB_ASSERT;
+	ifbp->IFB_AssertStrct.frag_cnt = 1;
+	ifbp->IFB_AssertStrct.frag_buf[0].frag_len =
+		( offsetof(IFB_STRCT, IFB_AssertLvl) - offsetof(IFB_STRCT, IFB_AssertLine) ) / sizeof(hcf_16);
+	ifbp->IFB_AssertStrct.frag_buf[0].frag_addr = &ifbp->IFB_AssertLine;
+#endif // HCF_ASSERT_MB
+#endif // HCF_ASSERT
+	IF_PROT_TIME( prot_cnt = ifbp->IFB_TickIni = INI_TICK_INI; )
+#if ( (HCF_TYPE) & HCF_TYPE_PRELOADED ) == 0
+	//!! No asserts before Reset-bit in HREG_IO is cleared
+	OPW( HREG_IO, 0x0000 );						//OPW useable										/* 2b*/
+	HCF_WAIT_WHILE( (IPW( HREG_EV_STAT) & HREG_EV_CMD) == 0 );
+	IF_PROT_TIME( HCFASSERT( prot_cnt, IPW( HREG_EV_STAT) ) )
+	IF_PROT_TIME( if ( prot_cnt ) prot_cnt = ifbp->IFB_TickIni; )
+#endif // HCF_TYPE_PRELOADED
+	//!! No asserts before Reset-bit in HREG_IO is cleared
+	HCFASSERT( DO_ASSERT, MERGE_2( HCF_ASSERT, 0xCAF0 )	) //just to proof that the complete assert machinery is working
+	HCFASSERT( xa != CFG_FW_IDENTITY, 0 )		// assert if hcf_connect is called without intervening hcf_disconnect.
+	HCFASSERT( ((hcf_32)(void*)ifbp & (HCF_ALIGN-1) ) == 0, (hcf_32)(void*)ifbp )
+	HCFASSERT( (io_addr & 0x003F) == 0, io_addr )
+												//if Busy bit in Cmd register
+	if (IPW( HREG_CMD ) & HCMD_BUSY ) {																/* 8 */
+												//.  Ack all to unblock a (possibly) blocked cmd pipe line
+		OPW( HREG_EV_ACK, ~HREG_EV_SLEEP_REQ );
+												//.  Wait for Busy bit drop  in Cmd register
+												//.  Wait for Cmd  bit raise in Ev  register
+		HCF_WAIT_WHILE( ( IPW( HREG_CMD ) & HCMD_BUSY ) && (IPW( HREG_EV_STAT) & HREG_EV_CMD) == 0 );
+		IF_PROT_TIME( HCFASSERT( prot_cnt, IPW( HREG_EV_STAT) ) ) /* if prot_cnt == 0, cmd_exe will fail, causing DEFUNCT */
+	}
+	OPW( HREG_EV_ACK, ~HREG_EV_SLEEP_REQ );
+#if ( (HCF_TYPE) & HCF_TYPE_PRELOADED ) == 0														/*12*/
+	(void)cmd_exe( ifbp, HCMD_INI, 0 );
+#endif // HCF_TYPE_PRELOADED
+if ( io_base != HCF_DISCONNECT ) {
+		rc = init( ifbp );																			/*14*/
+		if ( rc == HCF_SUCCESS ) {
+			x.len = 2;
+			x.typ = CFG_NIC_BUS_TYPE;
+			(void)hcf_get_info( ifbp, &x );
+			ifbp->IFB_BusType = x.val[0];
+			//CFG_NIC_BUS_TYPE not supported -> default 32 bits/DMA, MSF has to overrule via CFG_CNTL_OPT
+			if ( x.len == 0 || x.val[0] == 0x0002 || x.val[0] == 0x0003 ) {
+#if (HCF_IO) & HCF_IO_32BITS
+				ifbp->IFB_CntlOpt &= ~USE_16BIT;			//reset USE_16BIT
+#endif // HCF_IO_32BITS
+#if HCF_DMA
+				ifbp->IFB_CntlOpt |= USE_DMA;				//SET DMA
+#else
+				ifbp->IFB_IORange = 0x40 /*i.s.o. HREG_IO_RANGE*/;
+#endif // HCF_DMA
+			}
+		}
+	} else HCFASSERT(  ( ifbp->IFB_Magic ^= HCF_MAGIC ) == 0, ifbp->IFB_Magic ) /*NOP*/;
+	/* of above HCFASSERT only the side effect is needed, NOP in case HCFASSERT is dummy */
+	ifbp->IFB_IOBase = io_base;																		/* 0*/
+	return rc;
+} // hcf_connect
+
+#if HCF_DMA
+/************************************************************************************************************
+* Function get_frame_lst
+*  - resolve the "last host-owned descriptor" problems when a descriptor list is reclaimed by the MSF.
+*
+* The FrameList to be reclaimed as well as the DescriptorList always start in IFB_FirstDesc[tx_rx_flag]
+* and this is always the "current" DELWA Descriptor.
+*
+* If a FrameList is available, the last descriptor of the FrameList to turned into a new DELWA Descriptor:
+*  - a copy is made from the information in the last descriptor of the FrameList into the current
+*	 DELWA Descriptor
+*  - the remainder of the DescriptorList is detached from the copy by setting the next_desc_addr at NULL
+*  - the DMA control bits of the copy are cleared to do not confuse the MSF
+*  - the copy of the last descriptor (i.e. the "old" DELWA Descriptor) is chained to the prev Descriptor
+*	 of the FrameList, thus replacing the original last Descriptor of the FrameList.
+*  - IFB_FirstDesc is changed to the address of that replaced (original) last descriptor of the FrameList,
+*	 i.e. the "new" DELWA Descriptor.
+*
+* This function makes a copy of that last host-owned descriptor, so the MSF will get a copy of the descriptor.
+* On top of that, it adjusts DMA related fields in the IFB structure.
+	// perform a copying-scheme to circumvent the 'last host owned descriptor cannot be reclaimed' limitation imposed by H2.5's DMA hardware design
+	// a 'reclaim descriptor' should be available in the HCF:
+*
+* Returns: address of the first descriptor of the FrameList
+*
+ 8: Be careful once you start re-ordering the steps in the copy process, that it still works for cases
+* 	of FrameLists of 1, 2 and more than 2 descriptors
+*
+* Input parameters:
+* tx_rx_flag      : specifies 'transmit' or 'receive' descriptor.
+*
+************************************************************************************************************/
+HCF_STATIC DESC_STRCT*
+get_frame_lst( IFBP ifbp, int tx_rx_flag )
+{
+
+DESC_STRCT *head = ifbp->IFB_FirstDesc[tx_rx_flag];
+DESC_STRCT *copy, *p, *prev;
+
+	HCFASSERT( tx_rx_flag == DMA_RX || tx_rx_flag == DMA_TX, tx_rx_flag )
+								//if FrameList
+	if ( head ) {
+								//.  search for last descriptor of first FrameList
+		p = prev = head;
+		while ( ( p->BUF_SIZE & DESC_EOP ) == 0 && p->next_desc_addr ) {
+			if ( ( ifbp->IFB_CntlOpt & DMA_ENABLED ) == 0 ) {	//clear control bits when disabled
+				p->BUF_CNT &= DESC_CNT_MASK;
+			}
+			prev = p;
+			p = p->next_desc_addr;
+		}
+								//.  if DMA enabled
+		if ( ifbp->IFB_CntlOpt & DMA_ENABLED ) {
+								//.  .  if last descriptor of FrameList is DMA owned
+								//.  .  or if FrameList is single (DELWA) Descriptor
+			if ( p->BUF_CNT & DESC_DMA_OWNED || head->next_desc_addr == NULL ) {
+								//.  .  .  refuse to return FrameList to caller
+				head = NULL;
+			}
+		}
+	}
+								//if returnable FrameList found
+	if ( head ) {
+								//.  if FrameList is single (DELWA) Descriptor (implies DMA disabled)
+ 		if ( head->next_desc_addr == NULL ) {
+								//.  .  clear DescriptorList
+			/*;?ifbp->IFB_LastDesc[tx_rx_flag] =*/ ifbp->IFB_FirstDesc[tx_rx_flag] = NULL;
+								//.  else
+		} else {
+								//.  .  strip hardware-related bits from last descriptor
+								//.  .  remove DELWA Descriptor from head of DescriptorList
+			copy = head;
+	 		head = head->next_desc_addr;
+								//.   .  exchange first (Confined) and last (possibly imprisoned) Descriptor
+			copy->buf_phys_addr = p->buf_phys_addr;
+			copy->buf_addr = p->buf_addr;
+			copy->BUF_SIZE = p->BUF_SIZE &= DESC_CNT_MASK;	//get rid of DESC_EOP and possibly DESC_SOP
+			copy->BUF_CNT = p->BUF_CNT &= DESC_CNT_MASK;	//get rid of DESC_DMA_OWNED
+#if (HCF_EXT) & HCF_DESC_STRCT_EXT
+			copy->DESC_MSFSup = p->DESC_MSFSup;
+#endif // HCF_DESC_STRCT_EXT
+								//.  .  turn into a DELWA Descriptor
+			p->buf_addr = NULL;
+								//.  .  chain copy to prev											/* 8*/
+			prev->next_desc_addr = copy;
+								//.  .  detach remainder of the DescriptorList from FrameList
+			copy->next_desc_addr = NULL;
+			copy->next_desc_phys_addr = 0xDEAD0000; //! just to be nice, not really needed
+								//.  .  save the new start (i.e. DELWA Descriptor) in IFB_FirstDesc
+			ifbp->IFB_FirstDesc[tx_rx_flag] = p;
+		}
+								//.  strip DESC_SOP from first descriptor
+		head->BUF_SIZE &= DESC_CNT_MASK;
+		//head->BUF_CNT &= DESC_CNT_MASK;  get rid of DESC_DMA_OWNED
+		head->next_desc_phys_addr = 0xDEAD0000; //! just to be nice, not really needed
+	}
+								//return the just detached FrameList (if any)
+	return head;
+} // get_frame_lst
+
+
+/************************************************************************************************************
+* Function put_frame_lst
+*
+* This function
+*
+* Returns: address of the first descriptor of the FrameList
+*
+* Input parameters:
+* tx_rx_flag      : specifies 'transmit' or 'receive' descriptor.
+*
+* The following list should be kept in sync with hcf_dma_tx/rx_put, in order to get them in the WCI-spec !!!!
+* Assert fails if
+* -	DMA is not enabled
+* -	descriptor list is NULL
+* -	a descriptor in the descriptor list is not double word aligned
+* -	a count of size field of a descriptor contains control bits, i.e. bits in the high order nibble.
+* -	the DELWA descriptor is not a "singleton" DescriptorList.
+* -	the DELWA descriptor is not the first Descriptor supplied
+* -	a non_DMA descriptor is supplied before the DELWA Descriptor is supplied
+* -	Possibly more checks could be added !!!!!!!!!!!!!
+
+*.NOTICE
+* The asserts marked with *sc* are really sanity checks for the HCF, they can (supposedly) not be influenced
+* by incorrect MSF behavior
+
+		// The MSF is required to supply the HCF with a single descriptor for MSF tx reclaim purposes.
+		// This 'reclaim descriptor' can be recognized by the fact that its buf_addr field is zero.
+	*********************************************************************************************
+	* Although not required from a hardware perspective:
+	* - make each descriptor in this rx-chain DMA-owned.
+	* - Also set the count to zero. EOP and SOP bits are also cleared.
+	*********************************************************************************************/
+HCF_STATIC void
+put_frame_lst( IFBP ifbp, DESC_STRCT *descp, int tx_rx_flag )
+{
+	DESC_STRCT	*p = descp;
+	hcf_16 port;
+
+	HCFASSERT( ifbp->IFB_CntlOpt & USE_DMA, ifbp->IFB_CntlOpt) //only hcf_dma_tx_put must also be DMA_ENABLED
+	HCFASSERT( tx_rx_flag == DMA_RX || tx_rx_flag == DMA_TX, tx_rx_flag )
+	HCFASSERT( p , 0 )
+
+	while ( p ) {
+		HCFASSERT( ((hcf_32)p & 3 ) == 0, (hcf_32)p )
+		HCFASSERT( (p->BUF_CNT & ~DESC_CNT_MASK) == 0, p->BUF_CNT )
+		HCFASSERT( (p->BUF_SIZE & ~DESC_CNT_MASK) == 0, p->BUF_SIZE )
+		p->BUF_SIZE &= DESC_CNT_MASK;					//!!this SHOULD be superfluous in case of correct MSF
+		p->BUF_CNT &= tx_rx_flag == DMA_RX ? 0 : DESC_CNT_MASK;	//!!this SHOULD be superfluous in case of correct MSF
+		p->BUF_CNT |= DESC_DMA_OWNED;
+		if ( p->next_desc_addr ) {
+//			HCFASSERT( p->buf_addr && p->buf_phys_addr  && p->BUF_SIZE && +/- p->BUF_SIZE, ... )
+			HCFASSERT( p->next_desc_addr->desc_phys_addr, (hcf_32)p->next_desc_addr )
+			p->next_desc_phys_addr = p->next_desc_addr->desc_phys_addr;
+		} else {									//
+			p->next_desc_phys_addr = 0;
+			if ( p->buf_addr == NULL ) {			// DELWA Descriptor
+				HCFASSERT( descp == p, (hcf_32)descp )	//singleton DescriptorList
+				HCFASSERT( ifbp->IFB_FirstDesc[tx_rx_flag] == NULL, (hcf_32)ifbp->IFB_FirstDesc[tx_rx_flag])
+				HCFASSERT( ifbp->IFB_LastDesc[tx_rx_flag] == NULL, (hcf_32)ifbp->IFB_LastDesc[tx_rx_flag])
+				descp->BUF_CNT = 0; //&= ~DESC_DMA_OWNED;
+				ifbp->IFB_FirstDesc[tx_rx_flag] = descp;
+// part of alternative ifbp->IFB_LastDesc[tx_rx_flag] = ifbp->IFB_FirstDesc[tx_rx_flag] = descp;
+													// if "recycling" a FrameList
+													// (e.g. called from hcf_cntl( HCF_CNTL_ENABLE )
+													// .  prepare for activation DMA controller
+// part of alternative descp = descp->next_desc_addr;
+			} else {								//a "real" FrameList, hand it over to the DMA engine
+				HCFASSERT( ifbp->IFB_FirstDesc[tx_rx_flag], (hcf_32)descp )
+				HCFASSERT( ifbp->IFB_LastDesc[tx_rx_flag], (hcf_32)descp )
+				HCFASSERT( ifbp->IFB_LastDesc[tx_rx_flag]->next_desc_addr == NULL,
+						   (hcf_32)ifbp->IFB_LastDesc[tx_rx_flag]->next_desc_addr)
+//				p->buf_cntl.cntl_stat |= DESC_DMA_OWNED;
+				ifbp->IFB_LastDesc[tx_rx_flag]->next_desc_addr = descp;
+				ifbp->IFB_LastDesc[tx_rx_flag]->next_desc_phys_addr = descp->desc_phys_addr;
+				port = HREG_RXDMA_PTR32;
+				if ( tx_rx_flag ) {
+					p->BUF_SIZE |= DESC_EOP;	// p points at the last descriptor in the caller-supplied descriptor chain
+					descp->BUF_SIZE |= DESC_SOP;
+					port = HREG_TXDMA_PTR32;
+				}
+				OUT_PORT_DWORD( (ifbp->IFB_IOBase + port), descp->desc_phys_addr );
+			}
+			ifbp->IFB_LastDesc[tx_rx_flag] = p;
+		}
+		p = p->next_desc_addr;
+	}
+} // put_frame_lst
+
+
+/************************************************************************************************************
+*
+*.MODULE		DESC_STRCT* hcf_dma_rx_get( IFBP ifbp )
+*.PURPOSE		decapsulate a message and provides that message to the MSF.
+*				reclaim all descriptors in the rx descriptor chain.
+*
+*.ARGUMENTS
+*	ifbp		address of the Interface Block
+*
+*.RETURNS
+*	pointer to a FrameList
+*
+*.DESCRIPTION
+* hcf_dma_rx_get is intended to  return a received frame when such a frame is deposited in Host memory by the
+* DMA engine. In addition hcf_dma_rx_get can be used to reclaim all descriptors in the rx descriptor chain
+* when the DMA Engine is disabled, e.g. as part of a driver unloading strategy.
+* hcf_dma_rx_get must be called repeatedly by the MSF when hcf_service_nic signals availability of a rx frame
+* through the HREG_EV_RDMAD flag of IFB_DmaPackets. The calling must stop when a NULL pointer is returned, at
+* which time the HREG_EV_RDMAD flag is also cleared by the HCF to arm the mechanism for the next frame
+* reception.
+* Regardless whether the DMA Engine is currently enabled (as controlled via hcf_cntl), if the DMA controller
+* deposited an Rx-frame in the Rx-DescriptorList, this frame is detached from the Rx-DescriptorList,
+* transformed into a FrameList (i.e.  updating the housekeeping fields in the descriptors) and returned to the
+* caller.
+* If no such Rx-frame is available in the Rx-DescriptorList, the behavior of hcf_dma_rx_get depends on the
+* status of the DMA Engine.
+* If the DMA Engine is enabled, a NULL pointer is returned.
+* If the DMA Engine is disabled, the following strategy is used:
+* - the complete Rx-DescriptorList is returned. The DELWA Descriptor is not part of the Rx-DescriptorList.
+* - If there is no Rx-DescriptorList, the DELWA Descriptor is returned.
+* - If there is no DELWA Descriptor, a NULL pointer is returned.
+*
+* If the MSF performs an disable/enable sequence without exhausting the Rx-DescriptorList as described above,
+* the enable command will reset all house keeping information, i.e. already received but not yet by the MSF
+* retrieved frames are lost and the next frame will be received starting with the oldest descriptor.
+*
+* The HCF can be used in 2 fashions: with and without decapsulation for data transfer.
+* This is controlled at compile time by the HCF_ENC bit of the HCF_ENCAP system constant.
+* If appropriate, decapsulation is done by moving some data inside the buffers and updating the descriptors
+* accordingly.
+*!! ;?????where did I describe why a simple manipulation with the count values does not suffice?
+*
+*.DIAGRAM
+*
+*.ENDDOC				END DOCUMENTATION
+*
+************************************************************************************************************/
+
+DESC_STRCT*
+hcf_dma_rx_get (IFBP ifbp)
+{
+DESC_STRCT *descp;	// pointer to start of FrameList
+
+	descp = get_frame_lst( ifbp, DMA_RX );
+	if ( descp && descp->buf_addr )  //!be aware of the missing curly bracket
+
+											//skip decapsulation at confined descriptor
+#if (HCF_ENCAP) == HCF_ENC
+#if (HCF_TYPE) & HCF_TYPE_CCX
+	if ( ifbp->IFB_CKIPStat == HCF_ACT_CCX_OFF )
+#endif // HCF_TYPE_CCX
+    {
+int i;
+DESC_STRCT *p = descp->next_desc_addr;	//pointer to 2nd descriptor of frame
+		HCFASSERT(p, 0)
+		// The 2nd descriptor contains (maybe) a SNAP header plus part or whole of the payload.
+		//determine decapsulation sub-flag in RxFS
+		i = *(wci_recordp)&descp->buf_addr[HFS_STAT] & ( HFS_STAT_MSG_TYPE | HFS_STAT_ERR );
+		if ( i == HFS_STAT_TUNNEL ||
+			 ( i == HFS_STAT_1042 && hcf_encap( (wci_bufp)&p->buf_addr[HCF_DASA_SIZE] ) != ENC_TUNNEL )) {
+			// The 2nd descriptor contains a SNAP header plus part or whole of the payload.
+			HCFASSERT( p->BUF_CNT == (p->buf_addr[5] + (p->buf_addr[4]<<8) + 2*6 + 2 - 8), p->BUF_CNT )
+			// perform decapsulation
+			HCFASSERT(p->BUF_SIZE >=8, p->BUF_SIZE)
+			// move SA[2:5] in the second buffer to replace part of the SNAP header
+			for ( i=3; i >= 0; i--) p->buf_addr[i+8] = p->buf_addr[i];
+			// copy DA[0:5], SA[0:1] from first buffer to second buffer
+			for ( i=0; i<8; i++) p->buf_addr[i] = descp->buf_addr[HFS_ADDR_DEST + i];
+			// make first buffer shorter in count
+			descp->BUF_CNT = HFS_ADDR_DEST;
+		}
+	}
+#endif // HCF_ENC
+	if ( descp == NULL ) ifbp->IFB_DmaPackets &= (hcf_16)~HREG_EV_RDMAD;  //;?could be integrated into get_frame_lst
+	HCFLOGEXIT( HCF_TRACE_DMA_RX_GET )
+	return descp;
+} // hcf_dma_rx_get
+
+
+/************************************************************************************************************
+*
+*.MODULE		void hcf_dma_rx_put( IFBP ifbp, DESC_STRCT *descp )
+*.PURPOSE		supply buffers for receive purposes.
+*				supply the Rx-DELWA descriptor.
+*
+*.ARGUMENTS
+*	ifbp		address of the Interface Block
+*	descp		address of a DescriptorList
+*
+*.RETURNS		N.A.
+*
+*.DESCRIPTION
+* This function is called by the MSF to supply the HCF with new/more buffers for receive purposes.
+* The HCF can be used in 2 fashions: with and without encapsulation for data transfer.
+* This is controlled at compile time by the HCF_ENC bit of the HCF_ENCAP system constant.
+* As a consequence, some additional constaints apply to the number of descriptor and the buffers associated
+* with the first 2 descriptors. Independent of the encapsulation feature, the COUNT fields are ignored.
+* A special case is the supplying of the DELWA descriptor, which must be supplied as the first descriptor.
+*
+* Assert fails if
+* - ifbp has a recognizable out-of-range value.
+* - NIC interrupts are not disabled while required by parameter action.
+* - in case decapsulation by the HCF is selected:
+*	  -	The first databuffer does not have the exact size corresponding with the RxFS up to the 802.3 DestAddr
+*		field (== 29 words).
+*	  -	The FrameList does not consists of at least 2 Descriptors.
+*	  -	The second databuffer does not have the minimum size of 8 bytes.
+*!! The 2nd part of the list of asserts should be kept in sync with put_frame_lst, in order to get
+*!! them in the WCI-spec !!!!
+* - DMA is not enabled
+* - descriptor list is NULL
+* - a descriptor in the descriptor list is not double word aligned
+* - a count of size field of a descriptor contains control bits, i.e. bits in the high order nibble.
+* - the DELWA descriptor is not a "singleton" DescriptorList.
+* - the DELWA descriptor is not the first Descriptor supplied
+* - a non_DMA descriptor is supplied before the DELWA Descriptor is supplied
+*!! - Possibly more checks could be added !!!!!!!!!!!!!
+*
+*.DIAGRAM
+*
+*
+*.ENDDOC				END DOCUMENTATION
+*
+************************************************************************************************************/
+void
+hcf_dma_rx_put( IFBP ifbp, DESC_STRCT *descp )
+{
+
+	HCFLOGENTRY( HCF_TRACE_DMA_RX_PUT, 0xDA01 )
+	HCFASSERT( ifbp->IFB_Magic == HCF_MAGIC, ifbp->IFB_Magic )
+	HCFASSERT_INT
+
+	put_frame_lst( ifbp, descp, DMA_RX );
+#if HCF_ASSERT && (HCF_ENCAP) == HCF_ENC
+	if ( descp->buf_addr ) {
+		HCFASSERT( descp->BUF_SIZE == HCF_DMA_RX_BUF1_SIZE, descp->BUF_SIZE )
+		HCFASSERT( descp->next_desc_addr, 0 ) // first descriptor should be followed by another descriptor
+		// The second DB is for SNAP and payload purposes. It should be a minimum of 12 bytes in size.
+		HCFASSERT( descp->next_desc_addr->BUF_SIZE >= 12, descp->next_desc_addr->BUF_SIZE )
+	}
+#endif // HCFASSERT / HCF_ENC
+	HCFLOGEXIT( HCF_TRACE_DMA_RX_PUT )
+} // hcf_dma_rx_put
+
+
+/************************************************************************************************************
+*
+*.MODULE		DESC_STRCT* hcf_dma_tx_get( IFBP ifbp )
+*.PURPOSE		DMA mode: reclaims and decapsulates packets in the tx descriptor chain if:
+*				 - A Tx packet has been copied from host-RAM into NIC-RAM by the DMA engine
+*				 - The Hermes/DMAengine have been disabled
+*
+*.ARGUMENTS
+*	ifbp		address of the Interface Block
+*
+*.RETURNS
+*	pointer to a reclaimed Tx packet.
+*
+*.DESCRIPTION
+* impact of the disable command:
+* When a non-empty pool of Tx descriptors exists (created by means of hcf_dma_put_tx), the MSF
+* is supposed to empty that pool by means of hcf_dma_tx_get calls after the disable in an
+* disable/enable sequence.
+*
+*.DIAGRAM
+*
+*.NOTICE
+*
+*.ENDDOC				END DOCUMENTATION
+*
+************************************************************************************************************/
+DESC_STRCT*
+hcf_dma_tx_get( IFBP ifbp )
+{
+DESC_STRCT *descp;	// pointer to start of FrameList
+
+	descp = get_frame_lst( ifbp, DMA_TX );
+	if ( descp && descp->buf_addr )  //!be aware of the missing curly bracket
+											//skip decapsulation at confined descriptor
+#if (HCF_ENCAP) == HCF_ENC
+		if ( ( descp->BUF_CNT == HFS_TYPE )
+#if (HCF_TYPE) & HCF_TYPE_CCX
+			 || ( descp->BUF_CNT == HFS_DAT )
+#endif // HCF_TYPE_CCX
+		) { // perform decapsulation if needed
+			descp->next_desc_addr->buf_phys_addr -= HCF_DASA_SIZE;
+			descp->next_desc_addr->BUF_CNT 		 += HCF_DASA_SIZE;
+		}
+#endif // HCF_ENC
+	if ( descp == NULL ) {  //;?could be integrated into get_frame_lst
+		ifbp->IFB_DmaPackets &= (hcf_16)~HREG_EV_TDMAD;
+	}
+	HCFLOGEXIT( HCF_TRACE_DMA_TX_GET )
+	return descp;
+} // hcf_dma_tx_get
+
+
+/************************************************************************************************************
+*
+*.MODULE		void hcf_dma_tx_put( IFBP ifbp, DESC_STRCT *descp, hcf_16 tx_cntl )
+*.PURPOSE		puts a packet in the Tx DMA queue in host ram and kicks off the TxDma engine.
+*				supply the Tx-DELWA descriptor.
+*
+*.ARGUMENTS
+*	ifbp		address of the Interface Block
+*	descp		address of Tx Descriptor Chain (i.e. a single Tx frame)
+*	tx_cntl		indicates MAC-port and (Hermes) options
+*
+*.RETURNS		N.A.
+*
+*.DESCRIPTION
+* The HCF can be used in 2 fashions: with and without encapsulation for data transfer.
+* This is controlled at compile time by the HCF_ENC bit of the HCF_ENCAP system constant.
+*
+* Regardless of the HCF_ENCAP system constant, the descriptor list created to describe the frame to be
+* transmitted, must supply space to contain the 802.11 header, preceding the actual frame to be transmitted.
+* Basically, this only supplies working storage to the HCF which passes this on to the DMA engine.
+* As a consequence the contents of this space do not matter.
+* Nevertheless BUF_CNT must take in account this storage.
+* This working space to contain the 802.11 header may not be fragmented, the first buffer must be
+* sufficiently large to contain at least the 802.11 header, i.e. HFS_ADDR_DEST (29 words or 0x3A bytes).
+* This way, the HCF can simply, regardless whether or not the HCF encapsulates the frame, write the parameter
+* tx_cntl at offset 0x36 (HFS_TX_CNTL) in the first buffer.
+* Note that it is allowed to have part or all of the actual frame represented by the first descriptor as long
+* as the requirement for storage for the 802.11 header is met, i.e. the 802.3 frame starts at offset
+* HFS_ADDR_DEST.
+* Except for the Assert on the 1st buffer in case of Encapsualtion, the SIZE fields are ignored.
+*
+* In case the encapsulation feature is compiled in, there are the following additional requirements.
+* o The BUF_CNT of the first buffer changes from a minimum of 0x3A bytes to exactly 0x3A, i.e. the workspace
+*	to store the 802.11 header
+* o The BUF_SIZE of the first buffer is at least the space needed to store the
+*	- 802.11 header (29 words)
+*	- 802.3 header, i.e. 12 bytes addressing information and 2 bytes length field
+*	- 6 bytes SNAP-header
+*   This results in 39 words or 0x4E bytes or HFS_TYPE.
+*   Note that if the BUF_SIZE is larger than 0x4E, this surplus is not used.
+* o The actual frame begins in the 2nd descriptor (which is already implied by the BUF_CNT == 0x3A requirement) and the associated buffer contains at least the 802.3 header, i.e. the 14 bytes representing addressing information and length/type field
+*
+*   When the HCF does not encapsulates (i.e. length/type field <= 1500),  no changes are made to descriptors
+*   or buffers.
+*
+*   When the HCF actually encapsulates (i.e. length/type field > 1500), it successively writes, starting at
+*   offset HFS_ADDR_DEST (0x3A) in the first buffer:
+*     - the 802.3 addressing information, copied from the begin of the second buffer
+*     - the frame length, derived from the total length of the individual fragments, corrected for the SNAP
+*   	header length and Type field and ignoring the Destination Address, Source Address and Length field
+* 	  - the appropriate snap header (Tunnel or 1042, depending on the value of the type field).
+*
+* 	 The information in the first two descriptors is adjusted accordingly:
+* 	  - the first descriptor count is changed from 0x3A to 0x4E (HFS_TYPE), which matches 0x3A + 12 + 2 + 6
+* 	  - the second descriptor count is decreased by 12, being the moved addressing information
+* 	  - the second descriptor (physical) buffer address is increased by 12.
+*
+* When the descriptors are returned by hcf_dma_tx_get, the transformation of the first two descriptors is
+* undone.
+*
+* Under any of the above scenarios, the assert BUF_CNT <= BUF_SIZE must be true for all descriptors
+* In case of encapsulation, BUF_SIZE of the 1st descriptor is asserted to be at least HFS_TYPE (0x4E), so it is NOT tested.
+*
+* Assert fails if
+* - ifbp has a recognizable out-of-range value.
+* - tx_cntl has a recognizable out-of-range value.
+* - NIC interrupts are not disabled while required by parameter action.
+* - in case encapsulation by the HCF is selected:
+*	  -	The FrameList does not consists of at least 2 Descriptors.
+*	  -	The first databuffer does not contain exactly the (space for) the 802.11 header (== 28 words)
+*	  -	The first databuffer does not have a size to additionally accomodate the 802.3 header and the
+*		SNAP header of the frame after encapsulation (== 39 words).
+*	  -	The second databuffer does not contain at least DA, SA and 'type/length' (==14 bytes or 7 words)
+*!! The 2nd part of the list of asserts should be kept in sync with put_frame_lst, in order to get
+*!! them in the WCI-spec !!!!
+* - DMA is not enabled
+* - descriptor list is NULL
+* - a descriptor in the descriptor list is not double word aligned
+* - a count of size field of a descriptor contains control bits, i.e. bits in the high order nibble.
+* - the DELWA descriptor is not a "singleton" DescriptorList.
+* - the DELWA descriptor is not the first Descriptor supplied
+* - a non_DMA descriptor is supplied before the DELWA Descriptor is supplied
+*!! - Possibly more checks could be added !!!!!!!!!!!!!
+*.DIAGRAM
+*
+*.NOTICE
+*
+*.ENDDOC				END DOCUMENTATION
+*
+*
+*1:	Write tx_cntl parameter to HFS_TX_CNTL field into the Hermes-specific header in buffer 1
+*4:	determine whether encapsulation is needed and write the type (tunnel or 1042) already at the appropriate
+*	offset in the 1st buffer
+*6:	Build the encapsualtion enveloppe in the free space at the end of the 1st buffer
+*	- Copy DA/SA fields from the 2nd buffer
+*   - Calculate total length of the message (snap-header + type-field + the length of all buffer fragments
+*     associated with the 802.3 frame (i.e all descriptors except the first), but not the DestinationAddress,
+*     SourceAddress and lenght-field)
+*     Assert the message length
+*	  Write length. Note that the message is in BE format, hence on LE platforms the length must be converted
+*	  ;? THIS IS NOT WHAT CURRENTLY IS IMPLEMENTED
+*	- Write snap header. Note that the last byte of the snap header is NOT copied, that byte is already in
+*	  place as result of the call to hcf_encap.
+*	Note that there are many ways to skin a cat. To express the offsets in the 1st buffer while writing
+*	the snap header, HFS_TYPE is choosen as a reference point to make it easier to grasp that the snap header
+*	and encapsualtion type are at least relative in the right.
+*8:	modify 1st descriptor to reflect moved part of the 802.3 header + Snap-header
+*	modify 2nd descriptor to skip the moved part of the 802.3 header (DA/SA
+*10: set each descriptor to 'DMA owned',  clear all other control bits.
+*	Set SOP bit on first descriptor. Set EOP bit on last descriptor.
+*12: Either append the current frame to an existing descriptor list or
+*14: create a list beginning with the current frame
+*16: remember the new end of the list
+*20: hand the frame over to the DMA engine
+************************************************************************************************************/
+void
+hcf_dma_tx_put( IFBP ifbp, DESC_STRCT *descp, hcf_16 tx_cntl )
+{
+DESC_STRCT	*p = descp->next_desc_addr;
+int			i;
+
+#if HCF_ASSERT
+	int x = ifbp->IFB_FWIdentity.comp_id == COMP_ID_FW_AP ? tx_cntl & ~HFS_TX_CNTL_PORT : tx_cntl;
+	HCFASSERT( (x & ~HCF_TX_CNTL_MASK ) == 0, tx_cntl )
+#endif // HCF_ASSERT
+	HCFLOGENTRY( HCF_TRACE_DMA_TX_PUT, 0xDA03 )
+	HCFASSERT( ifbp->IFB_Magic == HCF_MAGIC, ifbp->IFB_Magic )
+	HCFASSERT_INT
+	HCFASSERT( ( ifbp->IFB_CntlOpt & (USE_DMA|DMA_ENABLED) ) == (USE_DMA|DMA_ENABLED), ifbp->IFB_CntlOpt)
+
+	if ( descp->buf_addr ) {
+		*(hcf_16*)(descp->buf_addr + HFS_TX_CNTL) = tx_cntl;											/*1*/
+#if (HCF_ENCAP) == HCF_ENC
+		HCFASSERT( descp->next_desc_addr, 0 )									//at least 2 descripors
+		HCFASSERT( descp->BUF_CNT == HFS_ADDR_DEST, descp->BUF_CNT )	//exact length required for 1st buffer
+		HCFASSERT( descp->BUF_SIZE >= HCF_DMA_TX_BUF1_SIZE, descp->BUF_SIZE )	//minimal storage for encapsulation
+		HCFASSERT( p->BUF_CNT >= 14, p->BUF_CNT );					//at least DA, SA and 'type' in 2nd buffer
+
+#if (HCF_TYPE) & HCF_TYPE_CCX
+		/* if we are doing PPK +/- CMIC, or we are sending a DDP frame */
+		if ( ( ifbp->IFB_CKIPStat == HCF_ACT_CCX_ON ) ||
+			 ( ( p->BUF_CNT >= 20 )		 && ( ifbp->IFB_CKIPStat == HCF_ACT_CCX_OFF ) &&
+			 ( p->buf_addr[12] == 0xAA ) && ( p->buf_addr[13] == 0xAA ) &&
+			 ( p->buf_addr[14] == 0x03 ) && ( p->buf_addr[15] == 0x00 ) &&
+			 ( p->buf_addr[16] == 0x40 ) && ( p->buf_addr[17] == 0x96 ) &&
+			 ( p->buf_addr[18] == 0x00 ) && ( p->buf_addr[19] == 0x00 )))
+		{
+			/* copy the DA/SA to the first buffer */
+			for ( i = 0; i < HCF_DASA_SIZE; i++ ) {
+				descp->buf_addr[i + HFS_ADDR_DEST] = p->buf_addr[i];
+			}
+			/* calculate the length of the second fragment only */
+			i = 0;
+			do { i += p->BUF_CNT; } while( p = p->next_desc_addr );
+			i -= HCF_DASA_SIZE ;
+			/* convert the length field to big endian, using the endian friendly macros */
+			i = CNV_SHORT_TO_BIG(i);		//!! this converts ONLY on LE platforms, how does that relate to the non-CCX code
+			*(hcf_16*)(&descp->buf_addr[HFS_LEN]) = (hcf_16)i;
+			descp->BUF_CNT = HFS_DAT;
+			// modify 2nd descriptor to skip the 'Da/Sa' fields
+			descp->next_desc_addr->buf_phys_addr += HCF_DASA_SIZE;
+			descp->next_desc_addr->BUF_CNT		 -= HCF_DASA_SIZE;
+		}
+		else
+#endif // HCF_TYPE_CCX
+		{
+			descp->buf_addr[HFS_TYPE-1] = hcf_encap(&descp->next_desc_addr->buf_addr[HCF_DASA_SIZE]);		/*4*/
+			if ( descp->buf_addr[HFS_TYPE-1] != ENC_NONE ) {
+				for ( i=0; i < HCF_DASA_SIZE; i++ ) {														/*6*/
+					descp->buf_addr[i + HFS_ADDR_DEST] = descp->next_desc_addr->buf_addr[i];
+				}
+				i = sizeof(snap_header) + 2 - ( 2*6 + 2 );
+				do { i += p->BUF_CNT; } while ( ( p = p->next_desc_addr ) != NULL );
+				*(hcf_16*)(&descp->buf_addr[HFS_LEN]) = CNV_END_SHORT(i);	//!! this converts on ALL platforms, how does that relate to the CCX code
+				for ( i=0; i < sizeof(snap_header) - 1; i++) {
+					descp->buf_addr[HFS_TYPE - sizeof(snap_header) + i] = snap_header[i];
+				}
+				descp->BUF_CNT = HFS_TYPE;																	/*8*/
+				descp->next_desc_addr->buf_phys_addr	+= HCF_DASA_SIZE;
+				descp->next_desc_addr->BUF_CNT			-= HCF_DASA_SIZE;
+			}
+		}
+#endif // HCF_ENC
+    }
+	put_frame_lst( ifbp, descp, DMA_TX );
+	HCFLOGEXIT( HCF_TRACE_DMA_TX_PUT )
+} // hcf_dma_tx_put
+
+#endif // HCF_DMA
+
+#if (HCF_DL_ONLY) == 0
+/************************************************************************************************************
+*
+*.MODULE		hcf_8 hcf_encap( wci_bufp type )
+*.PURPOSE		test whether RFC1042 or Bridge-Tunnel encapsulation is needed.
+*
+*.ARGUMENTS
+*	type		(Far) pointer to the (Big Endian) Type/Length field in the message
+*
+*.RETURNS
+*	ENC_NONE		len/type is "len" ( (BIG_ENDIAN)type <= 1500 )
+*	ENC_TUNNEL		len/type is "type" and 0x80F3 or 0x8137
+*	ENC_1042		len/type is "type" but not 0x80F3 or 0x8137
+*
+*.CONDITIONS
+*	NIC Interrupts	d.c
+*
+*.DESCRIPTION
+* Type must point to the Len/Type field of the message, this is the 2-byte field immediately after the 6 byte
+* Destination Address and 6 byte Source Address.  The 2 successive bytes addressed by type are interpreted as
+* a Big Endian value.  If that value is less than or equal to 1500, the message is assumed to be in 802.3
+* format.  Otherwise the message is assumed to be in Ethernet-II format.  Depending on the value of Len/Typ,
+* Bridge Tunnel or RFC1042 encapsulation is needed.
+*
+*.DIAGRAM
+*
+*  1:	presume 802.3, hence preset return value at ENC_NONE
+*  2:	convert type from "network" Endian format to native Endian
+*  4:	the litmus test to distinguish type and len.
+*	The hard code "magic" value of 1500 is intentional and should NOT be replaced by a mnemonic because it is
+*	not related at all to the maximum frame size supported  by the Hermes.
+*  6:	check type against:
+*		0x80F3	//AppleTalk Address Resolution Protocol (AARP)
+*		0x8137	//IPX
+*	to determine the type of encapsulation
+*
+*.ENDDOC				END DOCUMENTATION
+*
+************************************************************************************************************/
+#if HCF_ENCAP	//i.e HCF_ENC or HCF_ENC_SUP
+#if ! ( (HCF_ENCAP) & HCF_ENC_SUP )
+HCF_STATIC
+#endif // HCF_ENCAP
+hcf_8
+hcf_encap( wci_bufp type )
+{
+
+hcf_8	rc = ENC_NONE;																					/* 1 */
+hcf_16	t = (hcf_16)(*type<<8) + *(type+1);																/* 2 */
+
+	if ( t > 1500 ) {																					/* 4 */
+		if ( t == 0x8137 || t == 0x80F3 ) {
+			rc = ENC_TUNNEL;																			/* 6 */
+		} else {
+			rc = ENC_1042;
+		}
+	}
+	return rc;
+} // hcf_encap
+#endif // HCF_ENCAP
+#endif // HCF_DL_ONLY
+
+
+/************************************************************************************************************
+*
+*.MODULE		int hcf_get_info( IFBP ifbp, LTVP ltvp )
+*.PURPOSE		Obtains transient and persistent configuration information from the Card and from the HCF.
+*
+*.ARGUMENTS
+*	ifbp		address of the Interface Block
+*	ltvp		address of LengthTypeValue structure specifying the "what" and the "how much" of the
+*				information to be collected from the HCF or from the Hermes
+*
+*.RETURNS
+*	HCF_ERR_LEN			The provided buffer was too small
+*	HCF_SUCCESS			Success
+*!!	via cmd_exe ( type >= CFG_RID_FW_MIN )
+*	HCF_ERR_NO_NIC		NIC removed during retrieval
+*	HCF_ERR_TIME_OUT	Expected Hermes event did not occure in expected time
+*!!	via cmd_exe and setup_bap (type >= CFG_RID_FW_MIN )
+*	HCF_ERR_DEFUNCT_...	HCF is in defunct mode (bits 0x7F reflect cause)
+*
+*.DESCRIPTION
+* The T-field of the LTV-record (provided by the MSF in parameter ltvp) specifies the RID wanted. The RID
+* information identified by the T-field is copied into the V-field.
+* On entry, the L-field specifies the size of the buffer, also called the "Initial DataLength". The L-value
+* includes the size of the T-field, but not the size of the L-field itself.
+* On return, the L-field indicates the number of words actually contained by the Type and Value fields.
+* As the size of the Type field in the LTV-record is included in the "Initial DataLength" of the record, the
+* V-field can contain at most "Initial DataLength" - 1 words of data.
+* Copying stops if either the complete Information is copied or if the number of words indicated by the
+* "Initial DataLength" were copied.  The "Initial DataLength" acts as a safe guard against Configuration
+* Information blocks that have different sizes for different F/W versions, e.g. when later versions support
+* more tallies than earlier versions.
+* If the size of Value field of the RID exceeds the size of the "Initial DataLength" -1, as much data
+* as fits is copied, and an error status of HCF_ERR_LEN is returned.
+*
+* It is the responsibility of the MSF to detect card removal and re-insertion and not call the HCF when the
+* NIC is absent. The MSF cannot, however, timely detect a Card removal if the Card is removed while
+* hcf_get_info is in progress.  Therefore, the HCF performs its own check on Card presence after the read
+* operation of the NIC data.  If the Card is not present or removed during the execution of hcf_get_info,
+* HCF_ERR_NO_NIC is returned and the content of the Data Buffer is unpredictable. This check is not performed
+* in case of the "HCF embedded" pseudo RIDs like CFG_TALLIES.
+*
+* Assert fails if
+* - ifbp has a recognizable out-of-range value.
+* - reentrancy, may be  caused by calling hcf_functions without adequate protection
+*	against NIC interrupts or multi-threading.
+* - ltvp is a NULL pointer.
+* - length field of the LTV-record at entry is 0 or 1 or has an excessive value (i.e. exceeds HCF_MAX_LTV).
+* - type field of the LTV-record is invalid.
+*
+*.DIAGRAM
+*	Hcf_get_mb_info copies the contents of the oldest MailBox Info block in the MailBox to PC RAM. If len is
+*	less than the size of the MailBox Info block, only as much as fits in the PC RAM buffer is copied. After
+*	the copying the MailBox Read pointer is updated to point to the next MailBox Info block, hence the
+*	remainder of an "oversized" MailBox Info block is lost. The truncation of the MailBox Info block is NOT
+*	reflected in the return status. Note that hcf_get_info guarantees the length of the PC RAM buffer meets
+*	the minimum requirements of at least 2, so no PC RAM buffer overrun.
+*
+*	Calling hcf_get_mb_info when their is no MailBox Info block available or when there is no MailBox at all,
+*	results in a "NULL" MailBox Info block.
+*
+*12:	see NOTICE
+*17: The return status of cmd_wait and the first hcfio_in_string can be ignored, because when one fails, the
+*	other fails via the IFB_DefunctStat mechanism
+*20: "HCFASSERT( rc == HCF_SUCCESS, rc )" is not suitable because this will always trigger as side effect of
+*	the HCFASSERT in hcf_put_info which calls hcf_get_info to figure out whether the RID exists at all.
+
+*.NOTICE
+*
+*	"HCF embedded" pseudo RIDs:
+*	CFG_MB_INFO, CFG_TALLIES, CFG_DRV_IDENTITY, CFG_DRV_SUP_RANGE, CFG_DRV_ACT_RANGES_PRI,
+*	CFG_DRV_ACT_RANGES_STA, CFG_DRV_ACT_RANGES_HSI
+*	Note the HCF_ERR_LEN is NOT adequately set, when L >= 2 but less than needed
+*
+*	Remarks: Transfers operation information and transient and persistent configuration information from the
+*	Card and from the HCF to the MSF.
+*	The exact layout of the provided data structure depends on the action code. Copying stops if either the
+*	complete Configuration Information is copied or if the number of bytes indicated by len is copied.  Len
+*	acts as a safe guard against Configuration Information blocks which have different sizes for different
+*	Hermes versions, e.g. when later versions support more tallies than earlier versions. It is a conscious
+*	decision that unused parts of the PC RAM buffer are not cleared.
+*
+*	Remarks: The only error against which is protected is the "Read error" as result of Card removal. Only the
+*	last hcf_io_string need to be protected because if the first fails the second will fail as well. Checking
+*	for cmd_exe errors is supposed superfluous because problems in cmd_exe are already caught or will be
+*	caught by hcf_enable.
+*
+*	CFG_MB_INFO: copy the oldest MailBox Info Block or the "null" block if none available.
+*
+*	The mechanism to HCF_ASSERT on invalid typ-codes in the LTV record is based on the following strategy:
+*	  - during the pseudo-asynchronous Hermes commands (diagnose, download)	only CFG_MB_INFO is acceptable
+*	  -	some codes (e.g. CFG_TALLIES) are explicitly handled by the HCF which implies that these codes
+*		are valid
+*	  - all other codes in the range 0xFC00 through 0xFFFF are passed to the Hermes.  The Hermes returns an
+*		LTV record with a zero value in the L-field for all Typ-codes it does not recognize. This is
+*		defined and intended behavior, so HCF_ASSERT does not catch on this phenomena.
+*	  -	all remaining codes are invalid and cause an ASSERT.
+*
+*.CONDITIONS
+* In case of USB, HCF_MAX_MSG ;?USED;? to limit the amount of data that can be retrieved via hcf_get_info.
+*
+*
+*.ENDDOC				END DOCUMENTATION
+*
+************************************************************************************************************/
+int
+hcf_get_info( IFBP ifbp, LTVP ltvp )
+{
+
+int			rc = HCF_SUCCESS;
+hcf_16		len = ltvp->len;
+hcf_16		type = ltvp->typ;
+wci_recordp	p = &ltvp->len;		//destination word pointer (in LTV record)
+hcf_16		*q = NULL;				/* source word pointer  Note!! DOS COM can't cope with FAR
+									 * as a consequence MailBox must be near which is usually true anyway
+									 */
+int			i;
+
+	HCFLOGENTRY( HCF_TRACE_GET_INFO, ltvp->typ )
+	HCFASSERT( ifbp->IFB_Magic == HCF_MAGIC, ifbp->IFB_Magic )
+	HCFASSERT_INT
+	HCFASSERT( ltvp, 0 )
+	HCFASSERT( 1 < ltvp->len && ltvp->len <= HCF_MAX_LTV + 1, MERGE_2( ltvp->typ, ltvp->len ) )
+
+	ltvp->len = 0;								//default to: No Info Available
+#if defined MSF_COMPONENT_ID || (HCF_EXT) & HCF_EXT_MB //filter out all specials
+	for ( i = 0; ( q = xxxx[i] ) != NULL && q[1] != type; i++ ) /*NOP*/;
+#endif // MSF_COMPONENT_ID / HCF_EXT_MB
+#if HCF_TALLIES
+	if ( type == CFG_TALLIES ) {													/*3*/
+		(void)hcf_action( ifbp, HCF_ACT_TALLIES );
+		q = (hcf_16*)&ifbp->IFB_TallyLen;
+	}
+#endif // HCF_TALLIES
+#if (HCF_EXT) & HCF_EXT_MB
+	if ( type == CFG_MB_INFO ) {
+		if ( ifbp->IFB_MBInfoLen ) {
+			if ( ifbp->IFB_MBp[ifbp->IFB_MBRp] == 0xFFFF ) {
+				ifbp->IFB_MBRp = 0; //;?Probably superfluous
+			}
+			q = &ifbp->IFB_MBp[ifbp->IFB_MBRp];
+			ifbp->IFB_MBRp += *q + 1;	//update read pointer
+			if ( ifbp->IFB_MBp[ifbp->IFB_MBRp] == 0xFFFF ) {
+				ifbp->IFB_MBRp = 0;
+			}
+			ifbp->IFB_MBInfoLen = ifbp->IFB_MBp[ifbp->IFB_MBRp];
+		}
+	}
+#endif // HCF_EXT_MB
+	if ( q != NULL ) {						//a special or CFG_TALLIES or CFG_MB_INFO
+		i = min( len, *q ) + 1;				//total size of destination (including T-field)
+		while ( i-- ) {
+			*p++ = *q;
+#if (HCF_TALLIES) & HCF_TALLIES_RESET
+			if ( q > &ifbp->IFB_TallyTyp && type == CFG_TALLIES ) {
+				*q = 0;
+			}
+#endif // HCF_TALLIES_RESET
+			q++;
+		}
+	} else {								// not a special nor CFG_TALLIES nor CFG_MB_INFO
+		if ( type == CFG_CNTL_OPT ) {										//read back effective options
+			ltvp->len = 2;
+			ltvp->val[0] = ifbp->IFB_CntlOpt;
+#if (HCF_EXT) & HCF_EXT_NIC_ACCESS
+		} else if ( type == CFG_PROD_DATA ) {  //only needed for some test tool on top of H-II NDIS driver
+hcf_io		io_port;
+wci_bufp	pt;					//pointer with the "right" type, just to help ease writing macros with embedded assembly
+			OPW( HREG_AUX_PAGE, (hcf_16)(PLUG_DATA_OFFSET >> 7) );
+			OPW( HREG_AUX_OFFSET, (hcf_16)(PLUG_DATA_OFFSET & 0x7E) );
+			io_port = ifbp->IFB_IOBase + HREG_AUX_DATA;		//to prevent side effects of the MSF-defined macro
+			p = ltvp->val;					//destination char pointer (in LTV record)
+			if ( ( i = len - 1 ) > 0 ) {
+				pt = (wci_bufp)p;	//just to help ease writing macros with embedded assembly
+				IN_PORT_STRING_8_16( io_port, pt, i ); //space used by T: -1
+			}
+		} else if ( type == CFG_CMD_HCF ) {
+#define P ((CFG_CMD_HCF_STRCT FAR *)ltvp)
+			HCFASSERT( P->cmd == CFG_CMD_HCF_REG_ACCESS, P->cmd )		//only Hermes register access supported
+			if ( P->cmd == CFG_CMD_HCF_REG_ACCESS ) {
+				HCFASSERT( P->mode < ifbp->IFB_IOBase, P->mode )		//Check Register space
+				ltvp->len = min( len, 4 );								//RESTORE ltv length
+				P->add_info = IPW( P->mode );
+			}
+#undef P
+#endif // HCF_EXT_NIC_ACCESS
+#if (HCF_ASSERT) & HCF_ASSERT_PRINTF
+        } else if (type == CFG_FW_PRINTF) {
+           rc = fw_printf(ifbp, (CFG_FW_PRINTF_STRCT*)ltvp);
+#endif // HCF_ASSERT_PRINTF
+		} else if ( type >= CFG_RID_FW_MIN ) {
+//;? by using HCMD_BUSY option when calling cmd_exe, using a get_frag with length 0 just to set up the
+//;? BAP and calling cmd_cmpl, you could merge the 2 Busy waits. Whether this really helps (and what
+//;? would be the optimal sequence in cmd_exe and get_frag) would have to be MEASURED
+/*17*/		if ( ( rc = cmd_exe( ifbp, HCMD_ACCESS, type ) ) == HCF_SUCCESS &&
+				 ( rc = setup_bap( ifbp, type, 0, IO_IN ) ) == HCF_SUCCESS ) {
+				get_frag( ifbp, (wci_bufp)&ltvp->len, 2*len+2 BE_PAR(2) );
+				if ( IPW( HREG_STAT ) == 0xFFFF ) {					//NIC removal test
+					ltvp->len = 0;
+					HCFASSERT( DO_ASSERT, type )
+				}
+			}
+/*12*/	} else HCFASSERT( DO_ASSERT, type ) /*NOP*/; //NOP in case HCFASSERT is dummy
+	}
+	if ( len < ltvp->len ) {
+		ltvp->len = len;
+		if ( rc == HCF_SUCCESS ) {
+			rc = HCF_ERR_LEN;
+		}
+	}
+	HCFASSERT( rc == HCF_SUCCESS || ( rc == HCF_ERR_LEN && ifbp->IFB_AssertTrace & 1<<HCF_TRACE_PUT_INFO ),
+			   MERGE_2( type, rc ) )																/*20*/
+	HCFLOGEXIT( HCF_TRACE_GET_INFO )
+	return rc;
+} // hcf_get_info
+
+
+/************************************************************************************************************
+*
+*.MODULE		int hcf_put_info( IFBP ifbp, LTVP ltvp )
+*.PURPOSE		Transfers operation and configuration information to the Card and to the HCF.
+*
+*.ARGUMENTS
+*	ifbp		address of the Interface Block
+*	ltvp		specifies the RID (as defined by Hermes I/F) or pseudo-RID (as defined by WCI)
+*
+*.RETURNS
+*	HCF_SUCCESS
+*!!	via cmd_exe
+*	HCF_ERR_NO_NIC 		NIC removed during data retrieval
+*	HCF_ERR_TIME_OUT	Expected F/W event did not occur in time
+*	HCF_ERR_DEFUNCT_...
+*!!	via download				CFG_DLNV_START <= type <= CFG_DL_STOP
+*!!	via put_info				CFG_RID_CFG_MIN <= type <= CFG_RID_CFG_MAX
+*!!	via put_frag
+*
+*.DESCRIPTION
+* The L-field of the LTV-record (provided by the MSF in parameter ltvp) specifies the size of the buffer.
+* The L-value includes the size of the T-field, but not the size of the L-field.
+* The T- field specifies the RID placed in the V-field by the MSF.
+*
+* Not all CFG-codes can be used for hcf_put_info.  The following CFG-codes are valid for hcf_put_info:
+* o One of the CFG-codes in the group "Network Parameters, Static Configuration Entities"
+* Changes made by hcf_put_info to CFG_codes in this group will not affect the F/W
+* and HCF behavior until hcf_cntl_port( HCF_PORT_ENABLE) is called.
+* o One of the CFG-codes in the group "Network Parameters, Dynamic Configuration Entities"
+* Changes made by hcf_put_info to CFG_codes will affect the F/W and HCF behavior immediately.
+* o CFG_PROG.
+* This code is used to initiate and terminate the process to download data either to
+* volatile or to non-volatile RAM on the NIC as well as for the actual download.
+* o CFG-codes related to the HCF behavior.
+* The related CFG-codes are:
+*  - CFG_REG_MB
+*  - CFG_REG_ASSERT_RTNP
+*  - CFG_REG_INFO_LOG
+*  - CFG_CMD_NIC
+*  - CFG_CMD_DONGLE
+*  - CFG_CMD_HCF
+*  - CFG_NOTIFY
+*
+* All LTV-records "unknown" to the HCF are forwarded to the F/W.
+*
+* Assert fails if
+* - ifbp has a recognizable out-of-range value.
+* - ltvp is a NULL pointer.
+* - hcf_put_info was called without prior call to hcf_connect
+* - type field of the LTV-record is invalid, i.e. neither HCF nor F/W can handle the value.
+* - length field of the LTV-record at entry is less than 1 or exceeds MAX_LTV_SIZE.
+* - registering a MailBox with size less than 60 or a non-aligned buffer address is used.
+* - reentrancy, may be  caused by calling hcf_functions without adequate protection against
+*	NIC interrupts or multi-threading.
+*
+*.DIAGRAM
+*
+*.NOTICE
+*	Remarks:  In case of Hermes Configuration LTVs, the codes for the type are "cleverly" chosen to be
+*	identical to the RID. Hermes Configuration information is copied from the provided data structure into the
+*	Card.
+*	In case of HCF Configuration LTVs, the type values are chosen in a range which does not overlap the
+*	RID-range.
+*
+*20:
+*
+*.ENDDOC				END DOCUMENTATION
+*
+************************************************************************************************************/
+
+int
+hcf_put_info( IFBP ifbp, LTVP ltvp )
+{
+int rc = HCF_SUCCESS;
+
+	HCFLOGENTRY( HCF_TRACE_PUT_INFO, ltvp->typ )
+	HCFASSERT( ifbp->IFB_Magic == HCF_MAGIC, ifbp->IFB_Magic )
+	HCFASSERT_INT
+	HCFASSERT( ltvp, 0 )
+	HCFASSERT( 1 < ltvp->len && ltvp->len <= HCF_MAX_LTV + 1, ltvp->len )
+
+											//all codes between 0xFA00 and 0xFCFF are passed to Hermes
+#if (HCF_TYPE) & HCF_TYPE_WPA
+ {	hcf_16 i;
+	hcf_32 FAR * key_p;
+
+	if ( ltvp->typ == CFG_ADD_TKIP_DEFAULT_KEY || ltvp->typ == CFG_ADD_TKIP_MAPPED_KEY ) {
+		key_p = (hcf_32*)((CFG_ADD_TKIP_MAPPED_KEY_STRCT FAR *)ltvp)->tx_mic_key;
+		i = TX_KEY;		//i.e. TxKeyIndicator == 1, KeyID == 0
+		if ( ltvp->typ == CFG_ADD_TKIP_DEFAULT_KEY ) {
+			key_p = (hcf_32*)((CFG_ADD_TKIP_DEFAULT_KEY_STRCT FAR *)ltvp)->tx_mic_key;
+			i = CNV_LITTLE_TO_SHORT(((CFG_ADD_TKIP_DEFAULT_KEY_STRCT FAR *)ltvp)->tkip_key_id_info);
+		}
+		if ( i & TX_KEY ) {	/* TxKeyIndicator == 1
+							   (either really set by MSF in case of DEFAULT or faked by HCF in case of MAPPED ) */
+			ifbp->IFB_MICTxCntl = (hcf_16)( HFS_TX_CNTL_MIC | (i & KEY_ID )<<8 );
+			ifbp->IFB_MICTxKey[0] = CNV_LONGP_TO_LITTLE( key_p );
+			ifbp->IFB_MICTxKey[1] = CNV_LONGP_TO_LITTLE( (key_p+1) );
+		}
+		i = ( i & KEY_ID ) * 2;
+		ifbp->IFB_MICRxKey[i]   = CNV_LONGP_TO_LITTLE( (key_p+2) );
+		ifbp->IFB_MICRxKey[i+1] = CNV_LONGP_TO_LITTLE( (key_p+3) );
+	}
+#define P ((CFG_REMOVE_TKIP_DEFAULT_KEY_STRCT FAR *)ltvp)
+	if ( ( ltvp->typ == CFG_REMOVE_TKIP_MAPPED_KEY )	||
+		 ( ltvp->typ == CFG_REMOVE_TKIP_DEFAULT_KEY &&
+		   ( (ifbp->IFB_MICTxCntl >> 8) & KEY_ID ) == CNV_SHORT_TO_LITTLE(P->tkip_key_id )
+		 )
+		) { ifbp->IFB_MICTxCntl = 0; }		//disable MIC-engine
+#undef P
+ }
+#endif // HCF_TYPE_WPA
+
+	if ( ltvp->typ == CFG_PROG ) {
+		rc = download( ifbp, (CFG_PROG_STRCT FAR *)ltvp );
+	} else switch (ltvp->typ) {
+#if (HCF_ASSERT) & HCF_ASSERT_RT_MSF_RTN
+	  case CFG_REG_ASSERT_RTNP:											//Register MSF Routines
+#define P ((CFG_REG_ASSERT_RTNP_STRCT FAR *)ltvp)
+		ifbp->IFB_AssertRtn = P->rtnp;
+//		ifbp->IFB_AssertLvl = P->lvl;		//TODO not yet supported so default is set in hcf_connect
+		HCFASSERT( DO_ASSERT, MERGE_2( HCF_ASSERT, 0xCAF1 ) )	//just to proof that the complete assert machinery is working
+#undef P
+		break;
+#endif // HCF_ASSERT_RT_MSF_RTN
+#if (HCF_EXT) & HCF_EXT_INFO_LOG
+	  case CFG_REG_INFO_LOG:											//Register Log filter
+		ifbp->IFB_RIDLogp = ((CFG_RID_LOG_STRCT FAR*)ltvp)->recordp;
+		break;
+#endif // HCF_EXT_INFO_LOG
+	  case CFG_CNTL_OPT:												//overrule option
+		HCFASSERT( ( ltvp->val[0] & ~(USE_DMA | USE_16BIT) ) == 0, ltvp->val[0] )
+		if ( ( ltvp->val[0] & USE_DMA ) == 0 ) ifbp->IFB_CntlOpt &= ~USE_DMA;
+		ifbp->IFB_CntlOpt |=  ltvp->val[0] & USE_16BIT;
+		break;
+#if (HCF_EXT) & HCF_EXT_MB
+	  case CFG_REG_MB:													//Register MailBox
+#define P ((CFG_REG_MB_STRCT FAR *)ltvp)
+		HCFASSERT( ( (hcf_32)P->mb_addr & 0x0001 ) == 0, (hcf_32)P->mb_addr )
+		HCFASSERT( (P)->mb_size >= 60, (P)->mb_size )
+		ifbp->IFB_MBp = P->mb_addr;
+		/* if no MB present, size must be 0 for ;?the old;? put_info_mb to work correctly */
+		ifbp->IFB_MBSize = ifbp->IFB_MBp == NULL ? 0 : P->mb_size;
+		ifbp->IFB_MBWp = ifbp->IFB_MBRp	= 0;
+		ifbp->IFB_MBp[0] = 0;											//flag the MailBox as empty
+		ifbp->IFB_MBInfoLen = 0;
+		HCFASSERT( ifbp->IFB_MBSize >= 60 || ifbp->IFB_MBp == NULL, ifbp->IFB_MBSize )
+#undef P
+		break;
+	  case CFG_MB_INFO:													//store MailBoxInfoBlock
+		rc = put_info_mb( ifbp, (CFG_MB_INFO_STRCT FAR *)ltvp );
+		break;
+#endif // HCF_EXT_MB
+
+#if (HCF_EXT) & HCF_EXT_NIC_ACCESS
+	  case CFG_CMD_NIC:
+#define P ((CFG_CMD_NIC_STRCT FAR *)ltvp)
+		OPW( HREG_PARAM_2, P->parm2 );
+		OPW( HREG_PARAM_1, P->parm1 );
+		rc = cmd_exe( ifbp, P->cmd, P->parm0 );
+		P->hcf_stat = (hcf_16)rc;
+		P->stat = IPW( HREG_STAT );
+		P->resp0 = IPW( HREG_RESP_0 );
+		P->resp1 = IPW( HREG_RESP_1 );
+		P->resp2 = IPW( HREG_RESP_2 );
+		P->ifb_err_cmd = ifbp->IFB_ErrCmd;
+		P->ifb_err_qualifier = ifbp->IFB_ErrQualifier;
+#undef P
+		break;
+	  case CFG_CMD_HCF:
+#define P ((CFG_CMD_HCF_STRCT FAR *)ltvp)
+		HCFASSERT( P->cmd == CFG_CMD_HCF_REG_ACCESS, P->cmd )		//only Hermes register access supported
+		if ( P->cmd == CFG_CMD_HCF_REG_ACCESS ) {
+			HCFASSERT( P->mode < ifbp->IFB_IOBase, P->mode )		//Check Register space
+			OPW( P->mode, P->add_info);
+		}
+#undef P
+		break;
+#endif // HCF_EXT_NIC_ACCESS
+
+#if (HCF_ASSERT) & HCF_ASSERT_PRINTF
+      case CFG_FW_PRINTF_BUFFER_LOCATION:
+        ifbp->IFB_FwPfBuff = *(CFG_FW_PRINTF_BUFFER_LOCATION_STRCT*)ltvp;
+        break;
+#endif // HCF_ASSERT_PRINTF
+
+	  default:						//pass everything unknown above the "FID" range to the Hermes or Dongle
+		rc = put_info( ifbp, ltvp );
+	}
+	//DO NOT !!! HCFASSERT( rc == HCF_SUCCESS, rc )												/* 20 */
+	HCFLOGEXIT( HCF_TRACE_PUT_INFO )
+	return rc;
+} // hcf_put_info
+
+
+#if (HCF_DL_ONLY) == 0
+/************************************************************************************************************
+*
+*.MODULE		int hcf_rcv_msg( IFBP ifbp, DESC_STRCT *descp, unsigned int offset )
+*.PURPOSE		All: decapsulate a message.
+*				pre-HermesII.5: verify MIC.
+*				non-USB, non-DMA mode: Transfer a message from the NIC to the Host and acknowledge reception.
+*				USB: Transform a message from proprietary USB format to 802.3 format
+*
+*.ARGUMENTS
+*	ifbp		address of the Interface Block
+*	descp		Pointer to the Descriptor List location.
+*	offset		USB: not used
+*				non-USB: specifies the beginning of the data to be obtained (0 corresponds with DestAddr field
+*				of frame).
+*
+*.RETURNS
+*	HCF_SUCCESS			No SSN error ( or HCF_ERR_MIC already reported by hcf_service_nic)
+*	HCF_ERR_MIC			message contains an erroneous MIC ( HCF_SUCCESS is reported if HCF_ERR_MIC is already
+*						reported by hcf_service_nic)
+* 	HCF_ERR_NO_NIC		NIC removed during data retrieval
+* 	HCF_ERR_DEFUNCT...
+*
+*.DESCRIPTION
+* The Receive Message Function can be executed by the MSF to obtain the Data Info fields of the message that
+* is reported to be available by the Service NIC Function.
+*
+* The Receive Message Function copies the message data available in the Card memory into a buffer structure
+* provided by the MSF.
+* Only data of the message indicated by the Service NIC Function can be obtained.
+* Execution of the Service NIC function may result in the availability of a new message, but it definitely
+* makes the message reported by the preceding Service NIC function, unavailable.
+*
+* in non-USB/non-DMA mode, hcf_rcv_msg starts the copy process at the (non-negative) offset requested by the
+* parameter offset, relative to HFS_ADDR_DEST, e.g offset 0 starts copying from the Destination Address, the
+* very begin of the 802.3 frame message. Offset must either lay within the part of the 802.3 frame as stored
+* by hcf_service_nic in the lookahead buffer or be just behind it, i.e. the first byte not yet read.
+* When offset is within lookahead, data is copied from lookahead.
+* When offset is beyond lookahead, data is read directly from RxFS in NIC with disregard of the actual value
+* of offset
+*
+*.NOTICE:
+* o at entry: look ahead buffer as passed with hcf_service_nic is still accessible and unchanged
+* o at exit: Receive Frame in NIC memory is released
+*
+* Description:
+* Starting at the byte indicated by the Offset value, the bytes are copied from the Data Info
+* Part of the current Receive Frame Structure to the Host memory data buffer structure
+* identified by descp.
+* The maximum value for Offset is the number of characters of the 802.3 frame read into the
+* look ahead buffer by hcf_service_nic (i.e. the look ahead buffer size minus
+* Control and 802.11 fields)
+* If Offset is less than the maximum value, copying starts from the look ahead buffer till the
+* end of that buffer is reached
+* Then (or if the maximum value is specified for Offset), the
+* message is directly copied from NIC memory to Host memory.
+* If an invalid (i.e. too large) offset is specified, an assert catches but the buffer contents are
+* undefined.
+* Copying stops if either:
+* o the end of the 802.3 frame is reached
+* o the Descriptor with a NULL pointer in the next_desc_addr field is reached
+*
+* When the copying stops, the receiver is ack'ed, thus freeing the NIC memory where the frame is stored
+* As a consequence, hcf_rcv_msg can only be called once for any particular Rx frame.
+*
+* For the time being (PCI Bus mastering not yet supported), only the following fields of each
+* of the descriptors in the descriptor list must be set by the MSF:
+* o buf_cntl.buf_dim[1]
+* o *next_desc_addr
+* o *buf_addr
+* At return from hcf_rcv_msg, the field buf_cntl.buf_dim[0] of the used Descriptors reflects
+* the number of bytes in the buffer corresponding with the Descriptor.
+* On the last used Descriptor, buf_cntl.buf_dim[0] is less or equal to buf_cntl.buf_dim[1].
+* On all preceding Descriptors buf_cntl.buf_dim[0] is equal to buf_cntl.buf_dim[1].
+* On all succeeding (unused) Descriptors, buf_cntl.buf_dim[0] is zero.
+* Note: this I/F is based on the assumptions how the I/F needed for PCI Bus mastering will
+* be, so it may change.
+*
+* The most likely handling of HCF_ERR_NO_NIC by the MSF is to drop the already copied
+* data as elegantly as possible under the constraints and requirements posed by the (N)OS.
+* If no received Frame Structure is pending, "Success" rather than "Read error" is returned.
+* This error constitutes a logic flaw in the MSF
+* The HCF can only catch a minority of this
+* type of errors
+* Based on consistency ideas, the HCF catches none of these errors.
+*
+* Assert fails if
+* - ifbp has a recognizable out-of-range value
+* - there is no unacknowledged Rx-message available
+* - offset is out of range (outside look ahead buffer)
+* - descp is a NULL pointer
+* - any of the descriptors is not double word aligned
+* - reentrancy, may be  caused by calling hcf_functions without adequate protection
+* 	against NIC interrupts or multi-threading.
+* - Interrupts are enabled.
+*
+*.DIAGRAM
+*
+*.NOTICE
+* - by using unsigned int as type for offset, no need to worry about negative offsets
+* - Asserting on being enabled/present is superfluous, since a non-zero IFB_lal implies that hcf_service_nic
+*   was called and detected a Rx-message. A zero IFB_lal will set the BUF_CNT field of at least the first
+*   descriptor to zero.
+*
+*.ENDDOC				END DOCUMENTATION
+*
+************************************************************************************************************/
+int
+hcf_rcv_msg( IFBP ifbp, DESC_STRCT *descp, unsigned int offset )
+{
+int			rc = HCF_SUCCESS;
+wci_bufp	cp;										//char oriented working pointer
+hcf_16		i;
+int			tot_len = ifbp->IFB_RxLen - offset;		//total length
+wci_bufp	lap = ifbp->IFB_lap + offset;			//start address in LookAhead Buffer
+hcf_16		lal = ifbp->IFB_lal - offset;			//available data within LookAhead Buffer
+hcf_16		j;
+
+	HCFLOGENTRY( HCF_TRACE_RCV_MSG, offset )
+	HCFASSERT( ifbp->IFB_Magic == HCF_MAGIC, ifbp->IFB_Magic )
+	HCFASSERT_INT
+	HCFASSERT( descp, HCF_TRACE_RCV_MSG )
+	HCFASSERT( ifbp->IFB_RxLen, HCF_TRACE_RCV_MSG )
+	HCFASSERT( ifbp->IFB_RxLen >= offset, MERGE_2( offset, ifbp->IFB_RxLen ) )
+	HCFASSERT( ifbp->IFB_lal >= offset, offset )
+	HCFASSERT( (ifbp->IFB_CntlOpt & USE_DMA) == 0, 0xDADA )
+
+	if ( tot_len < 0 ) {
+		lal = 0; tot_len = 0;				//suppress all copying activity in the do--while loop
+	}
+	do {									//loop over all available fragments
+		// obnoxious hcf.c(1480) : warning C4769: conversion of near pointer to long integer
+		HCFASSERT( ((hcf_32)descp & 3 ) == 0, (hcf_32)descp )
+		cp = descp->buf_addr;
+		j = min( (hcf_16)tot_len, descp->BUF_SIZE );	//minimum of "what's` available" and fragment size
+		descp->BUF_CNT = j;
+		tot_len -= j;						//adjust length still to go
+		if ( lal ) {						//if lookahead Buffer not yet completely copied
+			i = min( lal, j );				//minimum of "what's available" in LookAhead and fragment size
+			lal -= i;						//adjust length still available in LookAhead
+			j -= i;							//adjust length still available in current fragment
+			/*;? while loop could be improved by moving words but that is complicated on platforms with
+			 * alignment requirements*/
+			while ( i-- ) *cp++ = *lap++;
+		}
+		if ( j ) {	//if LookAhead Buffer exhausted but still space in fragment, copy directly from NIC RAM
+			get_frag( ifbp, cp, j BE_PAR(0) );
+			CALC_RX_MIC( cp, j );
+		}
+	} while ( ( descp = descp->next_desc_addr ) != NULL );
+#if (HCF_TYPE) & HCF_TYPE_WPA
+	if ( ifbp->IFB_RxFID ) {
+		rc = check_mic( ifbp );				//prevents MIC error report if hcf_service_nic already consumed all
+	}
+#endif // HCF_TYPE_WPA
+	(void)hcf_action( ifbp, HCF_ACT_RX_ACK );		//only 1 shot to get the data, so free the resources in the NIC
+	HCFASSERT( rc == HCF_SUCCESS, rc )
+	HCFLOGEXIT( HCF_TRACE_RCV_MSG )
+	return rc;
+} // hcf_rcv_msg
+#endif // HCF_DL_ONLY
+
+
+#if (HCF_DL_ONLY) == 0
+/************************************************************************************************************
+*
+*.MODULE		int hcf_send_msg( IFBP ifbp, DESC_STRCT *descp, hcf_16 tx_cntl )
+*.PURPOSE		Encapsulate a message and append padding and MIC.
+*				non-USB: Transfers the resulting message from Host to NIC and initiates transmission.
+*				USB: Transfer resulting message into a flat buffer.
+*
+*.ARGUMENTS
+*	ifbp		address of the Interface Block
+*	descp		pointer to the DescriptorList or NULL
+*	tx_cntl		indicates MAC-port and (Hermes) options
+*					HFS_TX_CNTL_SPECTRALINK
+*					HFS_TX_CNTL_PRIO
+*					HFS_TX_CNTL_TX_OK
+*					HFS_TX_CNTL_TX_EX
+*					HFS_TX_CNTL_TX_DELAY
+*					HFS_TX_CNTL_TX_CONT
+*					HCF_PORT_0				 MAC Port 0 (default)
+*					HCF_PORT_1 (AP only)	 MAC Port 1
+*					HCF_PORT_2 (AP only)	 MAC Port 2
+*					HCF_PORT_3 (AP only)	 MAC Port 3
+*					HCF_PORT_4 (AP only)	 MAC Port 4
+*					HCF_PORT_5 (AP only)	 MAC Port 5
+*					HCF_PORT_6 (AP only)	 MAC Port 6
+*
+*.RETURNS
+*	HCF_SUCCESS
+*	HCF_ERR_DEFUNCT_..
+*	HCF_ERR_TIME_OUT
+*
+*.DESCRIPTION:
+* The Send Message Function embodies 2 functions:
+* o transfers a message (including MAC header) from the provided buffer structure in Host memory to the Transmit
+* Frame Structure (TxFS) in NIC memory.
+* o Issue a send command to the F/W to actually transmit the contents of the TxFS.
+*
+* Control is based on the Resource Indicator IFB_RscInd.
+* The Resource Indicator is maintained by the HCF and should only be interpreted but not changed by the MSF.
+* The MSF must check IFB_RscInd to be non-zero before executing the call to the Send Message Function.
+* When no resources are available, the MSF must handle the queuing of the Transmit frame and check the
+* Resource Indicator periodically after calling hcf_service_nic.
+*
+* The Send Message Functions transfers a message to NIC memory when it is called with a non-NULL descp.
+* Before the Send Message Function is invoked this way, the Resource Indicator (IFB_RscInd) must be checked.
+* If the Resource is not available, Send Message Function execution must be postponed until after processing of
+* a next hcf_service_nic it appears that the Resource has become available.
+* The message is copied from the buffer structure identified by descp to the NIC.
+* Copying stops if a NULL pointer in the next_desc_addr field is reached.
+* Hcf_send_msg does not check for transmit buffer overflow, because the F/W does this protection.
+* In case of a transmit buffer overflow, the surplus which does not fit in the buffer is simply dropped.
+*
+* The Send Message Function activates the F/W to actually send the message to the medium when the
+* HFS_TX_CNTL_TX_DELAY bit of the tx_cntl parameter is not set.
+* If the descp parameter of the current call is non-NULL, the message as represented by descp is send.
+* If the descp parameter of the current call is NULL, and if the preceding call of the Send Message Function had
+* a non-NULL descp and the preceding call had the HFS_TX_CNTL_TX_DELAY bit of tx_cntl set, then the message as
+* represented by the descp of the preceding call is send.
+*
+* Hcf_send_msg supports encapsulation (see HCF_ENCAP) of Ethernet-II frames.
+* An Ethernet-II frame is transferred to the Transmit Frame structure as an 802.3 frame.
+* Hcf_send_msg distinguishes between an 802.3 and an Ethernet-II frame by looking at the data length/type field
+* of the frame. If this field contains a value larger than 1514, the frame is considered to be an Ethernet-II
+* frame, otherwise it is treated as an 802.3 frame.
+* To ease implementation of the HCF, this type/type field must be located in the first descriptor structure,
+* i.e. the 1st fragment must have a size of at least 14 (to contain DestAddr, SrcAddr and Len/Type field).
+* An Ethernet-II frame is encapsulated by inserting a SNAP header between the addressing information and the
+* type field.  This insertion is transparent for the MSF.
+* The HCF contains a fixed table that stores a number of types. If the value specified by the type/type field
+* occurs in this table, Bridge Tunnel Encapsulation is used, otherwise RFC1042 encapsulation is used.
+* Bridge Tunnel uses	AA AA 03 00 00 F8 as SNAP header,
+* RFC1042 uses	AA AA 03 00 00 00 as SNAP header.
+* The table currently contains:
+* 0 0x80F3	AppleTalk Address Resolution Protocol (AARP)
+* 0 0x8137	IPX
+*
+* The algorithm to distinguish between 802.3 and Ethernet-II frames limits the maximum length for frames of
+* 802.3 frames to 1514 bytes.
+* Encapsulation can be suppressed by means of the system constant HCF_ENCAP, e.g. to support proprietary
+* protocols with 802.3 like frames with a size larger than 1514 bytes.
+*
+* In case the HCF encapsulates the frame, the number of bytes that is actually transmitted is determined by the
+* cumulative value of the buf_cntl.buf_dim[0] fields.
+* In case the HCF does not encapsulate the frame, the number of bytes that is actually transmitted is not
+* determined by the cumulative value of the buf_cntl.buf_dim[DESC_CNTL_CNT] fields of the desc_strct's but by
+* the Length field of the 802.3 frame.
+* If there is a conflict between the cumulative value of the buf_cntl.buf_dim[0] fields and the
+* 802.3 Length field the 802.3 Length field determines the number of bytes actually transmitted by the NIC while
+* the cumulative value of the buf_cntl.buf_dim[0] fields determines the position of the MIC, hence a mismatch
+* will result in MIC errors on the Receiving side.
+* Currently this problem is flagged on the Transmit side by an Assert.
+* The following fields of each of the descriptors in the descriptor list must be set by the MSF:
+* o buf_cntl.buf_dim[0]
+* o *next_desc_addr
+* o *buf_addr
+*
+* All bits of the tx_cntl parameter except HFS_TX_CNTL_TX_DELAY and the HCF_PORT# bits are passed to the F/W via
+* the HFS_TX_CNTL field of the TxFS.
+*
+* Note that hcf_send_msg does not detect NIC absence.  The MSF is supposed to have its own -platform dependent-
+* way to recognize card removal/insertion.
+* The total system must be robust against card removal and there is no principal difference between card removal
+* just after hcf_send_msg returns but before the actual transmission took place or sometime earlier.
+*
+* Assert fails if
+* - ifbp has a recognizable out-of-range value
+* - descp is a NULL pointer
+* - no resources for PIF available.
+* - Interrupts are enabled.
+* - reentrancy, may be  caused by calling hcf_functions without adequate protection
+*	against NIC interrupts or multi-threading.
+*
+*.DIAGRAM
+*4:	for the normal case (i.e. no HFS_TX_CNTL_TX_DELAY option active), a fid is acquired via the
+*	routine get_fid.  If no FID is acquired, the remainder is skipped without an error notification.  After
+*	all, the MSF is not supposed to call hcf_send_msg when no Resource is available.
+*7:	The ControlField of the TxFS is written.  Since put_frag can only return the fatal Defunct or "No NIC", the
+*	return status can be ignored because when it fails, cmd_wait will fail as well.  (see also the note on the
+*	need for a return code below).
+*	Note that HFS_TX_CNTL has different values for H-I, H-I/SSN and H-II and HFS_ADDR_DEST has different
+*	values for H-I (regardless of SSN) and H-II.
+*	By writing 17, 1 or 2 ( implying 16, 0 or 1 garbage word after HFS_TX_CNTL) the BAP just gets to
+*	HFS_ADDR_DEST for H-I, H-I/SSN and H-II respectively.
+*10: if neither encapsulation nor MIC calculation is needed, splitting the first fragment in two does not
+*	really help but it makes the flow easier to follow to do not optimize on this difference
+*
+*	hcf_send_msg checks whether the frame is an Ethernet-II rather than an "official" 802.3 frame.
+*	The E-II check is based on the length/type field in the MAC header. If this field has a value larger than
+*	1500, E-II is assumed. The implementation of this test fails if the length/type field is not in the first
+*	descriptor.  If E-II is recognized, a SNAP header is inserted. This SNAP header represents either RFC1042
+*	or Bridge-Tunnel encapsulation, depending on the return status of the support routine hcf_encap.
+*
+*.NOTICE
+*	hcf_send_msg leaves the responsibility to only send messages on enabled ports at the MSF level.
+*	This is considered the strategy which is sufficiently adequate for all "robust" MSFs, have the least
+*	processor utilization and being still acceptable robust at the WCI !!!!!
+*
+*	hcf_send_msg does not NEED a return value to report NIC absence or removal during the execution of
+*	hcf_send_msg(), because the MSF and higher layers must be able to cope anyway with the NIC being removed
+*	after a successful completion of hcf_send_msg() but before the actual transmission took place.
+*	To accommodate user expectations the current implementation does report NIC absence.
+*	Defunct blocks all NIC access and will (also) be reported on a number of other calls.
+*
+*	hcf_send_msg does not check for transmit buffer overflow because the Hermes does this protection.
+*	In case of a transmit buffer overflow, the surplus which does not fit in the buffer is simply dropped.
+*	Note that this possibly results in the transmission of incomplete frames.
+*
+*	After some deliberation with F/W team, it is decided that - being in the twilight zone of not knowing
+*	whether the problem at hand is an MSF bug, HCF buf, F/W bug, H/W malfunction or even something else - there
+*	is no "best thing to do" in case of a failing send, hence the HCF considers the TxFID ownership to be taken
+*	over by the F/W and hopes for an Allocate event in due time
+*
+*.ENDDOC				END DOCUMENTATION
+*
+************************************************************************************************************/
+int
+hcf_send_msg( IFBP ifbp, DESC_STRCT *descp, hcf_16 tx_cntl )
+{
+int			rc = HCF_SUCCESS;
+DESC_STRCT	*p /* = descp*/;		//working pointer
+hcf_16		len;					// total byte count
+hcf_16		i;
+
+hcf_16		fid = 0;
+
+	HCFASSERT( ifbp->IFB_RscInd || descp == NULL, ifbp->IFB_RscInd )
+	HCFASSERT( (ifbp->IFB_CntlOpt & USE_DMA) == 0, 0xDADB )
+
+	HCFLOGENTRY( HCF_TRACE_SEND_MSG, tx_cntl )
+	HCFASSERT( ifbp->IFB_Magic == HCF_MAGIC, ifbp->IFB_Magic )
+	HCFASSERT_INT
+	/* obnoxious c:/hcf/hcf.c(1480) : warning C4769: conversion of near pointer to long integer,
+	 * so skip */
+	HCFASSERT( ((hcf_32)descp & 3 ) == 0, (hcf_32)descp )
+#if HCF_ASSERT
+{	int x = ifbp->IFB_FWIdentity.comp_id == COMP_ID_FW_AP ? tx_cntl & ~HFS_TX_CNTL_PORT : tx_cntl;
+	HCFASSERT( (x & ~HCF_TX_CNTL_MASK ) == 0, tx_cntl )
+}
+#endif // HCF_ASSERT
+
+	if ( descp ) ifbp->IFB_TxFID = 0;				//cancel a pre-put message
+
+#if (HCF_EXT) & HCF_EXT_TX_CONT				// Continuous transmit test
+	if ( tx_cntl == HFS_TX_CNTL_TX_CONT ) {
+	 	if ( ( fid = get_fid( ifbp ) ) != 0 ) {
+											//setup BAP to begin of TxFS
+			(void)setup_bap( ifbp, fid, 0, IO_OUT );
+											//copy all the fragments in a transparent fashion
+		 	for ( p = descp; p; p = p->next_desc_addr ) {
+			/* obnoxious warning C4769: conversion of near pointer to long integer */
+				HCFASSERT( ((hcf_32)p & 3 ) == 0, (hcf_32)p )
+				put_frag( ifbp, p->buf_addr, p->BUF_CNT BE_PAR(0) );
+			}
+			rc = cmd_exe( ifbp, HCMD_THESEUS | HCMD_BUSY | HCMD_STARTPREAMBLE, fid );
+			if ( ifbp->IFB_RscInd == 0 ) {
+				ifbp->IFB_RscInd = get_fid( ifbp );
+			}
+		}
+											// een slecht voorbeeld doet goed volgen ;?
+		HCFLOGEXIT( HCF_TRACE_SEND_MSG )
+		return rc;
+	}
+#endif // HCF_EXT_TX_CONT
+									/* the following initialization code is redundant for a pre-put message
+									 * but moving it inside the "if fid" logic makes the merging with the
+									 * USB flow awkward
+									 */
+#if (HCF_TYPE) & HCF_TYPE_WPA
+	tx_cntl |= ifbp->IFB_MICTxCntl;
+#endif // HCF_TYPE_WPA
+	if ( (fid = ifbp->IFB_TxFID) == 0 && ( fid = get_fid( ifbp ) ) != 0 ) 		/* 4 */
+			/* skip the next compound statement if:
+			   - pre-put message or
+			   - no fid available (which should never occur if the MSF adheres to the WCI)
+			 */
+	{		// to match the closing curly bracket of above "if" in case of HCF_TYPE_USB
+											//calculate total length ;? superfluous unless CCX or Encapsulation
+		len = 0;
+		p = descp;
+		do len += p->BUF_CNT; while ( ( p = p->next_desc_addr ) != NULL );
+		p = descp;
+//;?	HCFASSERT( len <= HCF_MAX_MSG, len )
+/*7*/	(void)setup_bap( ifbp, fid, HFS_TX_CNTL, IO_OUT );
+#if (HCF_TYPE) & HCF_TYPE_TX_DELAY
+		HCFASSERT( ( descp != NULL ) ^ ( tx_cntl & HFS_TX_CNTL_TX_DELAY ), tx_cntl )
+		if ( tx_cntl & HFS_TX_CNTL_TX_DELAY ) {
+			tx_cntl &= ~HFS_TX_CNTL_TX_DELAY;		//!!HFS_TX_CNTL_TX_DELAY no longer available
+			ifbp->IFB_TxFID = fid;
+			fid = 0;								//!!fid no longer available, be careful when modifying code
+		}
+#endif // HCF_TYPE_TX_DELAY
+		OPW( HREG_DATA_1, tx_cntl ) ;
+		OPW( HREG_DATA_1, 0 );
+#if ! ( (HCF_TYPE) & HCF_TYPE_CCX )
+		HCFASSERT( p->BUF_CNT >= 14, p->BUF_CNT )
+											/* assume DestAddr/SrcAddr/Len/Type ALWAYS contained in 1st fragment
+											 * otherwise life gets too cumbersome for MIC and Encapsulation !!!!!!!!
+		if ( p->BUF_CNT >= 14 ) {	alternatively: add a safety escape !!!!!!!!!!!! }	*/
+#endif // HCF_TYPE_CCX
+		CALC_TX_MIC( NULL, -1 );		//initialize MIC
+/*10*/	put_frag( ifbp, p->buf_addr, HCF_DASA_SIZE BE_PAR(0) );	//write DA, SA with MIC calculation
+		CALC_TX_MIC( p->buf_addr, HCF_DASA_SIZE );		//MIC over DA, SA
+		CALC_TX_MIC( null_addr, 4 );		//MIC over (virtual) priority field
+#if (HCF_TYPE) & HCF_TYPE_CCX
+		//!!be careful do not use positive test on HCF_ACT_CCX_OFF, because IFB_CKIPStat is initially 0
+		if(( ifbp->IFB_CKIPStat == HCF_ACT_CCX_ON ) ||
+           ((GET_BUF_CNT(p) >= 20 )   && ( ifbp->IFB_CKIPStat == HCF_ACT_CCX_OFF ) &&
+            (p->buf_addr[12] == 0xAA) && (p->buf_addr[13] == 0xAA) &&
+            (p->buf_addr[14] == 0x03) && (p->buf_addr[15] == 0x00) &&
+            (p->buf_addr[16] == 0x40) && (p->buf_addr[17] == 0x96) &&
+            (p->buf_addr[18] == 0x00) && (p->buf_addr[19] == 0x00)))
+        {
+            i = HCF_DASA_SIZE;
+
+            OPW( HREG_DATA_1, CNV_SHORT_TO_BIG( len - i ));
+
+            /* need to send out the remainder of the fragment */
+			put_frag( ifbp, &p->buf_addr[i], GET_BUF_CNT(p) - i BE_PAR(0) );
+        }
+        else
+#endif // HCF_TYPE_CCX
+		{
+											//if encapsulation needed
+#if (HCF_ENCAP) == HCF_ENC
+											//write length (with SNAP-header,Type, without //DA,SA,Length ) no MIC calc.
+			if ( ( snap_header[sizeof(snap_header)-1] = hcf_encap( &p->buf_addr[HCF_DASA_SIZE] ) ) != ENC_NONE ) {
+				OPW( HREG_DATA_1, CNV_END_SHORT( len + (sizeof(snap_header) + 2) - ( 2*6 + 2 ) ) );
+											//write splice with MIC calculation
+				put_frag( ifbp, snap_header, sizeof(snap_header) BE_PAR(0) );
+				CALC_TX_MIC( snap_header, sizeof(snap_header) );	//MIC over 6 byte SNAP
+				i = HCF_DASA_SIZE;
+			} else
+#endif // HCF_ENC
+			{
+				OPW( HREG_DATA_1, *(wci_recordp)&p->buf_addr[HCF_DASA_SIZE] );
+				i = 14;
+			}
+											//complete 1st fragment starting with Type with MIC calculation
+			put_frag( ifbp, &p->buf_addr[i], p->BUF_CNT - i BE_PAR(0) );
+			CALC_TX_MIC( &p->buf_addr[i], p->BUF_CNT - i );
+		}
+											//do the remaining fragments with MIC calculation
+		while ( ( p = p->next_desc_addr ) != NULL ) {
+			/* obnoxious c:/hcf/hcf.c(1480) : warning C4769: conversion of near pointer to long integer,
+			 * so skip */
+			HCFASSERT( ((hcf_32)p & 3 ) == 0, (hcf_32)p )
+			put_frag( ifbp, p->buf_addr, p->BUF_CNT BE_PAR(0) );
+			CALC_TX_MIC( p->buf_addr, p->BUF_CNT );
+		}
+											//pad message, finalize MIC calculation and write MIC to NIC
+		put_frag_finalize( ifbp );
+	}
+	if ( fid ) {
+/*16*/	rc = cmd_exe( ifbp, HCMD_BUSY | HCMD_TX | HCMD_RECL, fid );
+		ifbp->IFB_TxFID = 0;
+			/* probably this (i.e. no RscInd AND "HREG_EV_ALLOC") at this point in time occurs so infrequent,
+			 * that it might just as well be acceptable to skip this
+			 * "optimization" code and handle that additional interrupt once in a while
+			 */
+// 180 degree error in logic ;? #if ALLOC_15
+/*20*/	if ( ifbp->IFB_RscInd == 0 ) {
+			ifbp->IFB_RscInd = get_fid( ifbp );
+		}
+// #endif // ALLOC_15
+	}
+//	HCFASSERT( level::ifbp->IFB_RscInd, ifbp->IFB_RscInd )
+	HCFLOGEXIT( HCF_TRACE_SEND_MSG )
+	return rc;
+} // hcf_send_msg
+#endif // HCF_DL_ONLY
+
+
+#if (HCF_DL_ONLY) == 0
+/************************************************************************************************************
+*
+*.MODULE		int hcf_service_nic( IFBP ifbp, wci_bufp bufp, unsigned int len )
+*.PURPOSE		Services (most) NIC events.
+*				Provides received message
+*				Provides status information.
+*
+*.ARGUMENTS
+*	ifbp		address of the Interface Block
+*  In non-DMA mode:
+*	bufp		address of char buffer, sufficiently large to hold the first part of the RxFS up through HFS_TYPE
+*	len			length in bytes of buffer specified by bufp
+*				value between HFS_TYPE + 2 and HFS_ADDR_DEST + HCF_MAX_MSG
+*
+*.RETURNS
+*	HCF_SUCCESS
+*	HCF_ERR_MIC	message contains an erroneous MIC (only if frame fits completely in bufp)
+*
+*.DESCRIPTION
+*
+* MSF-accessible fields of Result Block
+* - IFB_RxLen			0 or Frame size.
+* - IFB_MBInfoLen		0 or the L-field of the oldest MBIB.
+* - IFB_RscInd
+* - IFB_HCF_Tallies		updated if a corresponding event occurred.
+* - IFB_NIC_Tallies		updated if a Tally Info frame received from the NIC.
+* - IFB_DmaPackets
+* - IFB_TxFsStat
+* - IFB_TxFsSwSup
+* - IFB_LinkStat		reflects new link status or 0x0000 if no change relative to previous hcf_service_nic call.
+or
+* - IFB_LinkStat		link status, 0x8000 reflects change relative to previous hcf_service_nic call.
+*
+* When IFB_MBInfoLen is non-zero, at least one MBIB is available.
+*
+* IFB_RxLen	reflects the number of received bytes in 802.3 view (Including DestAddr, SrcAddr and Length,
+* excluding MIC-padding, MIC and sum check) of active Rx Frame Structure. If no Rx Data s available, IFB_RxLen
+* equals 0x0000.
+* Repeated execution causes the Service NIC Function to provide information about subsequently received
+* messages, irrespective whether a hcf_rcv_msg or hcf_action(HCF_ACT_RX) is performed in between.
+*
+* When IFB_RxLen is non-zero, a Received Frame Structure is available to be routed to the protocol stack.
+* When Monitor Mode is not active, this is guaranteed to be an error-free non-WMP frame.
+* In case of Monitor Mode, it may also be a frame with an error or a WMP frame.
+* Erroneous frames have a non-zero error-sub field in the HFS_STAT field in the look ahead buffer.
+*
+* If a Receive message is available in NIC RAM, the Receive Frame Structure is (partly) copied from the NIC to
+* the buffer identified by bufp.
+* Copying stops either after len bytes or when the complete 802.3 frame is copied.
+* During the copying the message is decapsulated (if appropriate).
+* If the frame is read completely by hcf_service_nic (i.e. the frame fits completely in the lookahead buffer),
+* the frame is automatically ACK'ed to the F/W and still available via the look ahead buffer and hcf_rcv_msg.
+* Only if the frame is read completely by hcf_service_nic, hcf_service_nic checks the MIC and sets the return
+* status accordingly.  In this case, hcf_rcv_msg does not check the MIC.
+*
+* The MIC calculation algorithm works more efficient if the length of the look ahead buffer is
+* such that it fits exactly 4 n bytes of the 802.3 frame, i.e. len == HFS_ADDR_DEST + 4*n.
+*
+* The Service NIC Function supports the NIC event service handling process.
+* It performs the appropriate actions to service the NIC, such that the event cause is eliminated and related
+* information is saved.
+* The Service NIC Function is executed by the MSF ISR or polling routine as first step to determine the event
+* cause(s).  It is the responsibility of the MSF to perform all not directly NIC related interrupt service
+* actions, e.g. in a PC environment this includes servicing the PIC, and managing the Processor Interrupt
+* Enabling/Disabling.
+* In case of a polled based system, the Service NIC Function must be executed "frequently".
+* The Service NIC Function may have side effects related to the Mailbox and Resource Indicator (IFB_RscInd).
+*
+* hcf_service_nic returns:
+* - The length of the data in the available MBIB (IFB_MBInfoLen)
+* - Changes in the link status (IFB_LinkStat)
+* - The length of the data in the available Receive Frame Structure (IFB_RxLen)
+* - updated IFB_RscInd
+* - Updated Tallies
+*
+* hcf_service_nic is presumed to neither interrupt other HCF-tasks nor to be interrupted by other HCF-tasks.
+* A way to achieve this is to precede hcf_service_nic as well as all other HCF-tasks with a call to
+* hcf_action to disable the card interrupts and, after all work is completed, with a call to hcf_action to
+* restore (which is not necessarily the same as enabling) the card interrupts.
+* In case of a polled environment, it is assumed that the MSF programmer is sufficiently familiar with the
+* specific requirements of that environment to translate the interrupt strategy to a polled strategy.
+*
+* hcf_service_nic services the following Hermes events:
+* - HREG_EV_INFO		Asynchronous Information Frame
+* - HREG_EV_INFO_DROP	WMAC did not have sufficient RAM to build Unsolicited Information Frame
+* - HREG_EV_TX_EXC		(if applicable, i.e. selected via HCF_EXT_INT_TX_EX bit of HCF_EXT)
+* - HREG_EV_SLEEP_REQ	(if applicable, i.e. selected via HCF_DDS/HCF_CDS bit of HCF_SLEEP)
+* ** in non_DMA mode
+* - HREG_EV_ALLOC		Asynchronous part of Allocation/Reclaim completed while out of resources at
+* 						completion of hcf_send_msg/notify
+* - HREG_EV_RX			the detection of the availability of received messages
+* 						including WaveLAN Management Protocol (WMP) message processing
+* ** in DMA mode
+* - HREG_EV_RDMAD
+* - HREG_EV_TDMAD
+*!! hcf_service_nic does not service the following Hermes events:
+*!! 	HREG_EV_TX 			(the "OK" Tx Event) is no longer supported by the WCI, if it occurs it is unclear
+*!! 						what the cause is, so no meaningful strategy is available. Not acking the bit is
+*!! 						probably the best help that can be given to the debugger.
+*!! 	HREG_EV_CMD			handled in cmd_wait.
+*!! 	HREG_EV_FW_DMA 		(i.e. HREG_EV_RXDMA, HREG_EV_TXDMA and_EV_LPESC) are either not used or used
+*!! 						between the F/W and the DMA engine.
+*!! 	HREG_EV_ACK_REG_READY is only applicable for H-II (i.e. not HII.5 and up, see DAWA)
+*
+*	If, in non-DMA mode, a Rx message is available, its length is reflected by the IFB_RxLen field of the IFB.
+*	This length reflects the data itself and the Destination Address, Source Address and DataLength/Type field
+*	but not the SNAP-header in case of decapsulation by the HCF.  If no message is available, IFB_RxLen is
+*	zero.  Former versions of the HCF handled WMP messages and supported a "monitor" mode in hcf_service_nic,
+*	which deposited certain or all Rx messages in the MailBox. The responsibility to handle these frames is
+*	moved to the MSF. The HCF offers as supports hcf_put_info with CFG_MB_INFO as parameter to emulate the old
+* 	implementation under control of the MSF.
+*
+* **Rx Buffer free strategy
+*	When hcf_service_nic reports the availability of a non-DMA message, the MSF can access that message by
+*	means of hcf_rcv_msg. It must be prevented that the LAN Controller writes new data in the NIC buffer
+*	before the MSF is finished with the current message. The NIC buffer is returned to the LAN Controller
+*	when:
+*	 - the complete frame fits in the lookahead buffer or
+*	 - hcf_rcv_msg is called or
+*	 - hcf_action with HCF_ACT_RX is called or
+*	 - hcf_service_nic is called again
+*	It can be reasoned that hcf_action( INT_ON ) should not be given before the MSF has completely processed
+*	a reported Rx-frame. The reason is that the INT_ON action is guaranteed to cause a (Rx-)interrupt (the
+*	MSF is processing a Rx-frame, hence the Rx-event bit in the Hermes register must be active). This
+*	interrupt will cause hcf_service_nic to be called, which will cause the ack-ing of the "last" Rx-event
+*	to the Hermes, causing the Hermes to discard the associated NIC RAM buffer.
+* Assert fails if
+* - ifbp is zero or other recognizable out-of-range value.
+* - hcf_service_nic is called without a prior call to hcf_connect.
+* - interrupts are enabled.
+* - reentrancy, may be  caused by calling hcf_functions without adequate protection
+*	against NIC interrupts or multi-threading.
+*
+*
+*.DIAGRAM
+*1:	IFB_LinkStat is cleared, if a LinkStatus frame is received, IFB_LinkStat will be updated accordingly
+*	by isr_info.
+or
+*1:	IFB_LinkStat change indication is cleared. If a LinkStatus frame is received, IFB_LinkStat will be updated
+*	accordingly by isr_info.
+*2: IFB_RxLen must be cleared before the NIC presence check otherwise:
+*	 -	this value may stay non-zero if the NIC is pulled out at an inconvenient moment.
+*	 -	the RxAck on a zero-FID needs a zero-value for IFB_RxLen to work
+*	 Note that as side-effect of the hcf_action call, the remainder of Rx related info is re-initialized as
+*	 well.
+*4:	In case of Defunct mode, the information supplied by Hermes is unreliable, so the body of
+*	hcf_service_nic is skipped. Since hcf_cntl turns into a NOP if Primary or Station F/W is incompatible,
+*	hcf_service_nic is also skipped in those cases.
+*	To prevent that hcf_service_nic reports bogus information to the MSF with all - possibly difficult to
+*	debug - undesirable side effects, it is paramount to check the NIC presence. In former days the presence
+*	test was based on the Hermes register HREG_SW_0. Since in HCF_ACT_INT_OFF is choosen for strategy based on
+*	HREG_EV_STAT, this is now also used in hcf_service_nic. The motivation to change strategy is partly
+*	due to inconsistent F/W implementations with respect to HREG_SW_0 manipulation around reset and download.
+*	Note that in polled environments Card Removal is not detected by INT_OFF which makes the check in
+*	hcf_service_nic even more important.
+*8:	The event status register of the Hermes is sampled
+*	The assert checks for unexpected events ;?????????????????????????????????????.
+*	 - HREG_EV_INFO_DROP is explicitly excluded from the acceptable HREG_EV_STAT bits because it indicates
+*	   a too heavily loaded system.
+*	 - HREG_EV_ACK_REG_READY is 0x0000 for H-I (and hopefully H-II.5)
+*
+*
+*	HREG_EV_TX_EXC is accepted (via HREG_EV_TX_EXT) if and only if HCF_EXT_INT_TX_EX set in the HCF_EXT
+*	definition at compile time.
+*	The following activities are handled:
+*	 -	Alloc events are handled by hcf_send_msg (and notify). Only if there is no "spare" resource, the
+*		alloc event is superficially serviced by hcf_service_nic to create a pseudo-resource with value
+*		0x001. This value is recognized by get_fid (called by hcf_send_msg and notify) where the real
+*		TxFid is retrieved and the Hermes is acked and - hopefully - the "normal" case with a spare TxFid
+*		in IFB_RscInd is restored.
+*	 -	Info drop events are handled by incrementing a tally
+*	 -	LinkEvent (including solicited and unsolicited tallies) are handled by procedure isr_info.
+*	-	TxEx (if selected at compile time) is handled by copying the significant part of the TxFS
+*		into the IFB for further processing by the MSF.
+*		Note the complication of the zero-FID protection sub-scheme in DAWA.
+*	Note, the Ack of all of above events is handled at the end of hcf_service_nic
+*16: In case of  non-DMA ( either not compiled in or due to a run-time choice):
+*	If an Rx-frame is available, first the FID of that frame is read, including the complication of the
+*	zero-FID protection sub-scheme in DAWA. Note that such a zero-FID is acknowledged at the end of
+*	hcf_service_nic and that this depends on the IFB_RxLen initialization in the begin of hcf_service_nic.
+*	The Assert validates the HCF assumption about Hermes implementation upon which the range of
+*	Pseudo-RIDs is based.
+*	Then the control fields up to the start of the 802.3 frame are read from the NIC into the lookahead buffer.
+*	The status field is converted to native Endianess.
+*	The length is, after implicit Endianess conversion if needed, and adjustment for the 14 bytes of the
+*	802.3 MAC header, stored in IFB_RxLen.
+*	In MAC Monitor mode, 802.11 control frames with a TOTAL length of 14 are received, so without this
+*	length adjustment, IFB_RxLen could not be used to distinguish these frames from "no frame".
+*	No MIC calculation processes are associated with the reading of these Control fields.
+*26: This length test feels like superfluous robustness against malformed frames, but it turned out to be
+*	needed in the real (hostile) world.
+*	The decapsulation check needs sufficient data to represent DA, SA, L, SNAP and Type which amounts to
+*	22 bytes. In MAC Monitor mode, 802.11 control frames with a smaller length are received. To prevent
+*	that the implementation goes haywire, a check on the length is needed.
+*	The actual decapsulation takes place on the fly in the copying process by overwriting the SNAP header.
+*	Note that in case of decapsulation the SNAP header is not passed to the MSF, hence IFB_RxLen must be
+*	compensated for the SNAP header length.
+*	The 22 bytes needed for decapsulation are (more than) sufficient for the exceptional handling of the
+*	MIC algorithm of the L-field (replacing the 2 byte L-field with 4 0x00 bytes).
+*30: The 12 in the no-SSN branch corresponds with the get_frag, the 2 with the IPW of the SSN branch
+*32: If Hermes reported MIC-presence, than the MIC engine is initialized with the non-dummy MIC calculation
+*	routine address and appropriate key.
+*34: The 8 bytes after the DA, SA, L are read and it is checked whether decapsulation is needed i.e.:
+*	  - the Hermes reported Tunnel encapsulation or
+*	  - the Hermes reported 1042 Encapsulation and hcf_encap reports that the HCF would not have used
+*		1042 as the encapsulation mechanism
+*	Note that the first field of the RxFS in bufp has Native Endianess due to the conversion done by the
+*	BE_PAR in get_frag.
+*36: The Type field is the only word kept (after moving) of the just read 8 bytes, it is moved to the
+*	L-field.  The original L-field and 6 byte SNAP header are discarded, so IFB_RxLen and buf_addr must
+*	be adjusted by 8.
+*40: Determine how much of the frame (starting with DA) fits in the Lookahead buffer, then read the not-yet
+*	read data into the lookahead buffer.
+*	If the lookahead buffer contains the complete message, check the MIC. The majority considered this
+*	I/F more appropriate then have the MSF call hcf_get_data only to check the MIC.
+*44: Since the complete message is copied from NIC RAM to PC RAM, the Rx can be acknowledged to the Hermes
+*	to optimize the flow ( a better chance to get new Rx data in the next pass through hcf_service_nic ).
+*	This acknowledgement can not be done via hcf_action( HCF_ACT_RX_ACK ) because this also clears
+*	IFB_RxLEN thus corrupting the I/F to the MSF.
+*;?: In case of DMA (compiled in and activated):
+
+
+*54: Limiting the number of places where the F/W is acked (e.g. the merging of the Rx-ACK with the other
+*	ACKs), is supposed to diminish the potential of race conditions in the F/W.
+*	Note 1: The CMD event is acknowledged in cmd_cmpl
+*	Note 2: HREG_EV_ACK_REG_READY is 0x0000 for H-I (and hopefully H-II.5)
+*	Note 3: The ALLOC event is acknowledged in get_fid (except for the initialization flow)
+*
+*.NOTICE
+* The Non-DMA HREG_EV_RX is handled different compared with the other F/W events.
+* The HREG_EV_RX event is acknowledged by the first hcf_service_nic call after the
+* hcf_service_nic call that reported the occurrence of this event.
+* This acknowledgment
+* makes the next Receive Frame Structure (if any) available.
+* An updated IFB_RxLen
+* field reflects this availability.
+*
+*.NOTICE
+* The minimum size for Len must supply space for:
+* -	an F/W dependent number of bytes of Control Info field including the 802.11 Header field
+* -	Destination Address
+* -	Source Address
+* -	Length field
+* -	[ SNAP Header]
+* -	[ Ethernet-II Type]
+* This results in 68 for Hermes-I and 80 for Hermes-II
+* This way the minimum amount of information is available needed by the HCF to determine whether the frame
+* must be decapsulated.
+*.ENDDOC				END DOCUMENTATION
+*
+************************************************************************************************************/
+int
+hcf_service_nic( IFBP ifbp, wci_bufp bufp, unsigned int len )
+{
+
+int			rc = HCF_SUCCESS;
+hcf_16		stat;
+wci_bufp	buf_addr;
+hcf_16 		i;
+
+	HCFLOGENTRY( HCF_TRACE_SERVICE_NIC, ifbp->IFB_IntOffCnt )
+	HCFASSERT( ifbp->IFB_Magic == HCF_MAGIC, ifbp->IFB_Magic )
+	HCFASSERT_INT
+
+	ifbp->IFB_LinkStat = 0; // ;? to be obsoleted ASAP												/* 1*/
+	ifbp->IFB_DSLinkStat &= ~CFG_LINK_STAT_CHANGE;													/* 1*/
+	(void)hcf_action( ifbp, HCF_ACT_RX_ACK );														/* 2*/
+	if ( ifbp->IFB_CardStat == 0 && ( stat = IPW( HREG_EV_STAT ) ) != 0xFFFF ) {					/* 4*/
+/*		IF_NOT_DMA( HCFASSERT( !( stat & ~HREG_EV_BASIC_MASK, stat ) )
+ *		IF_NOT_USE_DMA( HCFASSERT( !( stat & ~HREG_EV_BASIC_MASK, stat ) )
+ *		IF_USE_DMA( HCFASSERT( !( stat & ~( HREG_EV_BASIC_MASK ^ ( HREG_EV_...DMA.... ), stat ) )
+ */
+																									/* 8*/
+		if ( ifbp->IFB_RscInd == 0 && stat & HREG_EV_ALLOC ) { //Note: IFB_RscInd is ALWAYS 1 for DMA
+			ifbp->IFB_RscInd = 1;
+		}
+		IF_TALLY( if ( stat & HREG_EV_INFO_DROP ) ifbp->IFB_HCF_Tallies.NoBufInfo++; )
+#if (HCF_EXT) & HCF_EXT_INT_TICK
+		if ( stat & HREG_EV_TICK ) {
+			ifbp->IFB_TickCnt++;
+		}
+#if 0 // (HCF_SLEEP) & HCF_DDS
+		if ( ifbp->IFB_TickCnt == 3 && ( ifbp->IFB_DSLinkStat & CFG_LINK_STAT_CONNECTED ) == 0 ) {
+CFG_DDS_TICK_TIME_STRCT ltv;
+			// 2 second period (with 1 tick uncertanty) in not-connected mode -->go into DS_OOR
+			hcf_action( ifbp, HCF_ACT_SLEEP );
+			ifbp->IFB_DSLinkStat |= CFG_LINK_STAT_DS_OOR; //set OutOfRange
+			ltv.len = 2;
+			ltv.typ = CFG_DDS_TICK_TIME;
+			ltv.tick_time = ( ( ifbp->IFB_DSLinkStat & CFG_LINK_STAT_TIMER ) + 0x10 ) *64; //78 is more right
+			hcf_put_info( ifbp, (LTVP)&ltv );
+			printk( "<5>Preparing for sleep, link_status: %04X, timer : %d\n",
+					ifbp->IFB_DSLinkStat, ltv.tick_time );//;?remove me 1 day
+			ifbp->IFB_TickCnt++; //;?just to make sure we do not keep on printing above message
+			if ( ltv.tick_time < 300 * 125 ) ifbp->IFB_DSLinkStat += 0x0010;
+
+		}
+#endif // HCF_DDS
+#endif // HCF_EXT_INT_TICK
+		if ( stat & HREG_EV_INFO ) {
+			isr_info( ifbp );
+		}
+#if (HCF_EXT) & HCF_EXT_INT_TX_EX
+		if ( stat & HREG_EV_TX_EXT && ( i = IPW( HREG_TX_COMPL_FID ) ) != 0 /*DAWA*/ ) {
+			DAWA_ZERO_FID( HREG_TX_COMPL_FID )
+			(void)setup_bap( ifbp, i, 0, IO_IN );
+			get_frag( ifbp, &ifbp->IFB_TxFsStat, HFS_SWSUP BE_PAR(1) );
+		}
+#endif // HCF_EXT_INT_TX_EX
+//!rlav DMA engine will handle the rx event, not the driver
+#if HCF_DMA
+		if ( !( ifbp->IFB_CntlOpt & USE_DMA ) ) //!! be aware of the logical indentations
+#endif // HCF_DMA
+/*16*/	  if ( stat & HREG_EV_RX && ( ifbp->IFB_RxFID = IPW( HREG_RX_FID ) ) != 0 ) { //if 0 then DAWA_ACK
+			HCFASSERT( bufp, len )
+			HCFASSERT( len >= HFS_DAT + 2, len )
+			DAWA_ZERO_FID( HREG_RX_FID )
+			HCFASSERT( ifbp->IFB_RxFID < CFG_PROD_DATA, ifbp->IFB_RxFID)
+			(void)setup_bap( ifbp, ifbp->IFB_RxFID, 0, IO_IN );
+			get_frag( ifbp, bufp, HFS_ADDR_DEST BE_PAR(1) );
+			ifbp->IFB_lap = buf_addr = bufp + HFS_ADDR_DEST;
+			ifbp->IFB_RxLen = (hcf_16)(bufp[HFS_DAT_LEN] + (bufp[HFS_DAT_LEN+1]<<8) + 2*6 + 2);
+/*26*/		if ( ifbp->IFB_RxLen >= 22 ) {		// convenient for MIC calculation (5 DWs + 1 "skipped" W)
+												//.  get DA,SA,Len/Type and (SNAP,Type or 8 data bytes)
+/*30*/			get_frag( ifbp, buf_addr, 22 BE_PAR(0) );
+/*32*/			CALC_RX_MIC( bufp, -1 );		//.  initialize MIC
+				CALC_RX_MIC( buf_addr, HCF_DASA_SIZE );	//.  MIC over DA, SA
+				CALC_RX_MIC( null_addr, 4 );	//.  MIC over (virtual) priority field
+				CALC_RX_MIC( buf_addr+14, 8 );	//.  skip Len, MIC over SNAP,Type or 8 data bytes)
+				buf_addr += 22;
+#if (HCF_TYPE) & HCF_TYPE_CCX
+//!!be careful do not use positive test on HCF_ACT_CCX_OFF, because IFB_CKIPStat is initially 0
+				if( ifbp->IFB_CKIPStat != HCF_ACT_CCX_ON  )
+#endif // HCF_TYPE_CCX
+				{
+#if (HCF_ENCAP) == HCF_ENC
+					HCFASSERT( len >= HFS_DAT + 2 + sizeof(snap_header), len )
+/*34*/ 				i = *(wci_recordp)&bufp[HFS_STAT] & ( HFS_STAT_MSG_TYPE | HFS_STAT_ERR );
+					if ( i == HFS_STAT_TUNNEL ||
+						 ( i == HFS_STAT_1042 && hcf_encap( (wci_bufp)&bufp[HFS_TYPE] ) != ENC_TUNNEL ) ) {
+												//.  copy E-II Type to 802.3 LEN field
+/*36*/					bufp[HFS_LEN  ] = bufp[HFS_TYPE  ];
+						bufp[HFS_LEN+1] = bufp[HFS_TYPE+1];
+												//.  discard Snap by overwriting with data
+						ifbp->IFB_RxLen -= (HFS_TYPE - HFS_LEN);
+						buf_addr -= ( HFS_TYPE - HFS_LEN ); // this happens to bring us at a DW boundary of 36
+					}
+#endif // HCF_ENC
+				}
+			}
+/*40*/		ifbp->IFB_lal = min( (hcf_16)(len - HFS_ADDR_DEST), ifbp->IFB_RxLen );
+			i = ifbp->IFB_lal - ( buf_addr - ( bufp + HFS_ADDR_DEST ) );
+			get_frag( ifbp, buf_addr, i BE_PAR(0) );
+			CALC_RX_MIC( buf_addr, i );
+#if (HCF_TYPE) & HCF_TYPE_WPA
+			if ( ifbp->IFB_lal == ifbp->IFB_RxLen ) {
+				rc = check_mic( ifbp );
+			}
+#endif // HCF_TYPE_WPA
+/*44*/		if ( len - HFS_ADDR_DEST >= ifbp->IFB_RxLen ) {
+				ifbp->IFB_RxFID = 0;
+			} else { /* IFB_RxFID is cleared, so  you do not get another Rx_Ack at next entry of hcf_service_nic */
+				stat &= (hcf_16)~HREG_EV_RX;	//don't ack Rx if processing not yet completed
+			}
+		}
+		// in case of DMA: signal availability of rx and/or tx packets to MSF
+		IF_USE_DMA( ifbp->IFB_DmaPackets |= stat & ( HREG_EV_RDMAD | HREG_EV_TDMAD ); )
+		// rlav : pending HREG_EV_RDMAD or HREG_EV_TDMAD events get acknowledged here.
+/*54*/	stat &= (hcf_16)~( HREG_EV_SLEEP_REQ | HREG_EV_CMD | HREG_EV_ACK_REG_READY | HREG_EV_ALLOC | HREG_EV_FW_DMA );
+//a positive mask would be easier to understand /*54*/	stat &= (hcf_16)~( HREG_EV_SLEEP_REQ | HREG_EV_CMD | HREG_EV_ACK_REG_READY | HREG_EV_ALLOC | HREG_EV_FW_DMA );
+		IF_USE_DMA( stat &= (hcf_16)~HREG_EV_RX; )
+		if ( stat ) {
+			DAWA_ACK( stat );	/*DAWA*/
+		}
+	}
+	HCFLOGEXIT( HCF_TRACE_SERVICE_NIC )
+	return rc;
+} // hcf_service_nic
+#endif // HCF_DL_ONLY
+
+
+/************************************************************************************************************
+************************** H C F   S U P P O R T   R O U T I N E S ******************************************
+************************************************************************************************************/
+
+
+/************************************************************************************************************
+*
+*.SUBMODULE		void calc_mic( hcf_32* p, hcf_32 m )
+*.PURPOSE		calculate MIC on a quad byte.
+*
+*.ARGUMENTS
+*	p			address of the MIC
+*	m			32 bit value to be processed by the MIC calculation engine
+*
+*.RETURNS		N.A.
+*
+*.DESCRIPTION
+* calc_mic is the implementation of the MIC algorithm. It is a monkey-see monkey-do copy of
+* Michael::appendByte()
+* of Appendix C of ..........
+*
+*
+*.DIAGRAM
+*
+*.NOTICE
+*.ENDDOC				END DOCUMENTATION
+*
+************************************************************************************************************/
+
+#if (HCF_TYPE) & HCF_TYPE_WPA
+
+#define ROL32( A, n ) ( ((A) << (n)) | ( ((A)>>(32-(n)))  & ( (1UL << (n)) - 1 ) ) )
+#define ROR32( A, n ) ROL32( (A), 32-(n) )
+
+#define L	*p
+#define R	*(p+1)
+
+void
+calc_mic( hcf_32* p, hcf_32 m )
+{
+#if HCF_BIG_ENDIAN
+	m = (m >> 16) | (m << 16);
+#endif // HCF_BIG_ENDIAN
+	L ^= m;
+	R ^= ROL32( L, 17 );
+	L += R;
+	R ^= ((L & 0xff00ff00) >> 8) | ((L & 0x00ff00ff) << 8);
+	L += R;
+	R ^= ROL32( L, 3 );
+	L += R;
+	R ^= ROR32( L, 2 );
+	L += R;
+} // calc_mic
+#undef R
+#undef L
+#endif // HCF_TYPE_WPA
+
+
+
+#if (HCF_TYPE) & HCF_TYPE_WPA
+/************************************************************************************************************
+*
+*.SUBMODULE		void calc_mic_rx_frag( IFBP ifbp, wci_bufp p, int len )
+*.PURPOSE		calculate MIC on a single fragment.
+*
+*.ARGUMENTS
+*	ifbp		address of the Interface Block
+*	bufp		(byte) address of buffer
+*	len			length in bytes of buffer specified by bufp
+*
+*.RETURNS		N.A.
+*
+*.DESCRIPTION
+* calc_mic_rx_frag ........
+*
+* The MIC is located in the IFB.
+* The MIC is separate for Tx and Rx, thus allowing hcf_send_msg to occur between hcf_service_nic and
+* hcf_rcv_msg.
+*
+*
+*.DIAGRAM
+*
+*.NOTICE
+*.ENDDOC				END DOCUMENTATION
+*
+************************************************************************************************************/
+void
+calc_mic_rx_frag( IFBP ifbp, wci_bufp p, int len )
+{
+static union { hcf_32 x32; hcf_16 x16[2]; hcf_8 x8[4]; } x;	//* area to accumulate 4 bytes input for MIC engine
+int i;
+
+	if ( len == -1 ) {								//initialize MIC housekeeping
+		i = *(wci_recordp)&p[HFS_STAT];
+		/* i = CNV_SHORTP_TO_LITTLE(&p[HFS_STAT]); should not be neede to prevent alignment poroblems
+		 * since len == -1 if and only if p is lookahaead buffer which MUST be word aligned
+		 * to be re-investigated by NvR
+		 */
+
+		if ( ( i & HFS_STAT_MIC ) == 0 ) {
+			ifbp->IFB_MICRxCarry = 0xFFFF;			//suppress MIC calculation
+		} else {
+			ifbp->IFB_MICRxCarry = 0;
+//*	Note that "coincidentally" the bit positions used in HFS_STAT
+//*	correspond with the offset of the key in IFB_MICKey
+			i = ( i & HFS_STAT_MIC_KEY_ID ) >> 10;	/* coincidentally no shift needed for i itself */
+			ifbp->IFB_MICRx[0] = CNV_LONG_TO_LITTLE(ifbp->IFB_MICRxKey[i  ]);
+			ifbp->IFB_MICRx[1] = CNV_LONG_TO_LITTLE(ifbp->IFB_MICRxKey[i+1]);
+		}
+	} else {
+		if ( ifbp->IFB_MICRxCarry == 0 ) {
+			x.x32 = CNV_LONGP_TO_LITTLE(p);
+			p += 4;
+			if ( len < 4 ) {
+				ifbp->IFB_MICRxCarry = (hcf_16)len;
+			} else {
+				ifbp->IFB_MICRxCarry = 4;
+				len -= 4;
+			}
+		} else while ( ifbp->IFB_MICRxCarry < 4 && len ) {		//note for hcf_16 applies: 0xFFFF > 4
+			x.x8[ifbp->IFB_MICRxCarry++] = *p++;
+			len--;
+		}
+		while ( ifbp->IFB_MICRxCarry == 4 ) {	//contrived so we have only 1 call to calc_mic so we could bring it in-line
+			calc_mic( ifbp->IFB_MICRx, x.x32 );
+			x.x32 = CNV_LONGP_TO_LITTLE(p);
+			p += 4;
+			if ( len < 4 ) {
+				ifbp->IFB_MICRxCarry = (hcf_16)len;
+			}
+			len -= 4;
+		}
+	}
+} // calc_mic_rx_frag
+#endif // HCF_TYPE_WPA
+
+
+#if (HCF_TYPE) & HCF_TYPE_WPA
+/************************************************************************************************************
+*
+*.SUBMODULE		void calc_mic_tx_frag( IFBP ifbp, wci_bufp p, int len )
+*.PURPOSE		calculate MIC on a single fragment.
+*
+*.ARGUMENTS
+*	ifbp		address of the Interface Block
+*	bufp		(byte) address of buffer
+*	len			length in bytes of buffer specified by bufp
+*
+*.RETURNS		N.A.
+*
+*.DESCRIPTION
+* calc_mic_tx_frag ........
+*
+* The MIC is located in the IFB.
+* The MIC is separate for Tx and Rx, thus allowing hcf_send_msg to occur between hcf_service_nic and
+* hcf_rcv_msg.
+*
+*
+*.DIAGRAM
+*
+*.NOTICE
+*.ENDDOC				END DOCUMENTATION
+*
+************************************************************************************************************/
+void
+calc_mic_tx_frag( IFBP ifbp, wci_bufp p, int len )
+{
+static union { hcf_32 x32; hcf_16 x16[2]; hcf_8 x8[4]; } x;	//* area to accumulate 4 bytes input for MIC engine
+
+														//if initialization request
+	if ( len == -1 ) {
+														//.  presume MIC calculation disabled
+		ifbp->IFB_MICTxCarry = 0xFFFF;
+														//.  if MIC calculation enabled
+		if ( ifbp->IFB_MICTxCntl ) {
+														//.  .  clear MIC carry
+			ifbp->IFB_MICTxCarry = 0;
+														//.  .  initialize MIC-engine
+			ifbp->IFB_MICTx[0] = CNV_LONG_TO_LITTLE(ifbp->IFB_MICTxKey[0]);	/*Tx always uses Key 0 */
+			ifbp->IFB_MICTx[1] = CNV_LONG_TO_LITTLE(ifbp->IFB_MICTxKey[1]);
+		}
+														//else
+	} else {
+														//.  if MIC enabled (Tx) / if MIC present (Rx)
+														//.  and no carry from previous calc_mic_frag
+		if ( ifbp->IFB_MICTxCarry == 0 ) {
+														//.  .  preset accu with 4 bytes from buffer
+			x.x32 = CNV_LONGP_TO_LITTLE(p);
+														//.  .  adjust pointer accordingly
+			p += 4;
+														//.  .  if buffer contained less then 4 bytes
+			if ( len < 4 ) {
+														//.  .  .  promote valid bytes in accu to carry
+														//.  .  .  flag accu to contain incomplete double word
+				ifbp->IFB_MICTxCarry = (hcf_16)len;
+														//.  .  else
+			} else {
+														//.  .  .  flag accu to contain complete double word
+				ifbp->IFB_MICTxCarry = 4;
+														//.  .  adjust remaining buffer length
+				len -= 4;
+			}
+														//.  else if MIC enabled
+														//.  and if carry bytes from previous calc_mic_tx_frag
+														//.  .  move (1-3) bytes from carry into accu
+		} else while ( ifbp->IFB_MICTxCarry < 4 && len ) {		/* note for hcf_16 applies: 0xFFFF > 4 */
+			x.x8[ifbp->IFB_MICTxCarry++] = *p++;
+			len--;
+		}
+														//.  while accu contains complete double word
+														//.  and MIC enabled
+		while ( ifbp->IFB_MICTxCarry == 4 ) {
+														//.  .  pass accu to MIC engine
+			calc_mic( ifbp->IFB_MICTx, x.x32 );
+														//.  .  copy next 4 bytes from buffer to accu
+			x.x32 = CNV_LONGP_TO_LITTLE(p);
+														//.  .  adjust buffer pointer
+			p += 4;
+														//.  .  if buffer contained less then 4 bytes
+														//.  .  .  promote valid bytes in accu to carry
+														//.  .  .  flag accu to contain incomplete double word
+			if ( len < 4 ) {
+				ifbp->IFB_MICTxCarry = (hcf_16)len;
+			}
+														//.  .  adjust remaining buffer length
+			len -= 4;
+		}
+	}
+} // calc_mic_tx_frag
+#endif // HCF_TYPE_WPA
+
+
+#if HCF_PROT_TIME
+/************************************************************************************************************
+*
+*.SUBMODULE		void calibrate( IFBP ifbp )
+*.PURPOSE		calibrates the S/W protection counter against the Hermes Timer tick.
+*
+*.ARGUMENTS
+*	ifbp		address of the Interface Block
+*
+*.RETURNS		N.A.
+*
+*.DESCRIPTION
+* calibrates the S/W protection counter against the Hermes Timer tick
+* IFB_TickIni is the value used to initialize the S/W protection counter such that the expiration period
+* more or less independent of the processor speed. If IFB_TickIni is not yet calibrated, it is done now.
+* This calibration is "reasonably" accurate because the Hermes is in a quiet state as a result of the
+* Initialize command.
+*
+*
+*.DIAGRAM
+*
+*1:	IFB_TickIni is initialized at INI_TICK_INI by hcf_connect. If calibrate succeeds, IFB_TickIni is
+*	guaranteed to be changed. As a consequence there will be only 1 shot at calibration (regardless of the
+*	number of init calls) under normal circumstances.
+*2:	Calibration is done HCF_PROT_TIME_CNT times. This diminish the effects of jitter and interference,
+*	especially in a pre-emptive environment. HCF_PROT_TIME_CNT is in the range of 16 through 32 and derived
+*	from the HCF_PROT_TIME specified by the MSF programmer. The divisor needed to scale HCF_PROT_TIME into the
+*	16-32 range, is used as a multiplicator after the calibration, to scale the found value back to the
+*	requested range. This way a compromise is achieved between accuracy and duration of the calibration
+*	process.
+*3:	Acknowledge the Timer Tick Event.
+*	Each cycle is limited to at most INI_TICK_INI samples of the TimerTick status of the Hermes.
+*	Since the start of calibrate is unrelated to the Hermes Internal Timer, the first interval may last from 0
+*	to the normal interval, all subsequent intervals should be the full length of the Hermes Tick interval.
+*	The Hermes Timer Tick is not reprogrammed by the HCF, hence it is running at the default of 10 k
+*	microseconds.
+*4:	If the Timer Tick Event is continuously up (prot_cnt still has the value INI_TICK_INI) or no Timer Tick
+*	Event occurred before the protection counter expired, reset IFB_TickIni to INI_TICK_INI,
+*	set the defunct bit of IFB_CardStat (thus rendering the Hermes inoperable) and exit the calibrate routine.
+*8:	ifbp->IFB_TickIni is multiplied to scale the found value back to the requested range as explained under 2.
+*
+*.NOTICE
+* o Although there are a number of viewpoints possible, calibrate() uses as error strategy that a single
+*	failure of the Hermes TimerTick is considered fatal.
+* o There is no hard and concrete time-out value defined for Hermes activities. The default 1 seconds is
+*	believed to be sufficiently "relaxed" for real life and to be sufficiently short to be still useful in an
+*	environment with humans.
+* o Note that via IFB_DefunctStat time outs in cmd_wait and in hcfio_string block all Hermes access till the
+*	next init so functions which call a mix of cmd_wait and hcfio_string only need to check the return status
+*	of the last call
+* o The return code is preset at Time out.
+*	The additional complication that no calibrated value for the protection count can be assumed since
+*	calibrate() does not yet have determined a calibrated value (a catch 22), is handled by setting the
+*	initial value at INI_TICK_INI (by hcf_connect). This approach is considered safe, because:
+*	  - the HCF does not use the pipeline mechanism of Hermes commands.
+*	  - the likelihood of failure (the only time when protection count is relevant) is small.
+*	  - the time will be sufficiently large on a fast machine (busy bit drops on good NIC before counter
+*		expires)
+*	  - the time will be sufficiently small on a slow machine (counter expires on bad NIC before the end user
+*	  	switches the power off in despair
+*	The time needed to wrap a 32 bit counter around is longer than many humans want to wait, hence the more or
+*	less arbitrary value of 0x40000L is chosen, assuming it does not take too long on an XT and is not too
+*	short on a scream-machine.
+*
+*.ENDDOC				END DOCUMENTATION
+*
+************************************************************************************************************/
+HCF_STATIC void
+calibrate( IFBP ifbp )
+{
+int		cnt = HCF_PROT_TIME_CNT;
+hcf_32	prot_cnt;
+
+	HCFTRACE( ifbp, HCF_TRACE_CALIBRATE );
+	if ( ifbp->IFB_TickIni == INI_TICK_INI ) {													/*1*/
+		ifbp->IFB_TickIni = 0;																	/*2*/
+			while ( cnt-- ) {
+				prot_cnt = INI_TICK_INI;
+				OPW( HREG_EV_ACK, HREG_EV_TICK );												/*3*/
+				while ( (IPW( HREG_EV_STAT ) & HREG_EV_TICK) == 0 && --prot_cnt ) {
+					ifbp->IFB_TickIni++;
+				}
+				if ( prot_cnt == 0 || prot_cnt == INI_TICK_INI ) {								/*4*/
+					ifbp->IFB_TickIni = INI_TICK_INI;
+					ifbp->IFB_DefunctStat = HCF_ERR_DEFUNCT_TIMER;
+					ifbp->IFB_CardStat |= CARD_STAT_DEFUNCT;
+					HCFASSERT( DO_ASSERT, prot_cnt )
+				}
+			}
+		ifbp->IFB_TickIni <<= HCF_PROT_TIME_SHFT;												/*8*/
+	}
+	HCFTRACE( ifbp, HCF_TRACE_CALIBRATE | HCF_TRACE_EXIT );
+} // calibrate
+#endif // HCF_PROT_TIME
+
+
+#if (HCF_DL_ONLY) == 0
+#if (HCF_TYPE) & HCF_TYPE_WPA
+/************************************************************************************************************
+*
+*.SUBMODULE		int check_mic( IFBP ifbp )
+*.PURPOSE		verifies the MIC of a received non-USB frame.
+*
+*.ARGUMENTS
+*	ifbp		address of the Interface Block
+*
+*.RETURNS
+*	HCF_SUCCESS
+*	HCF_ERR_MIC
+*
+*.DESCRIPTION
+*
+*
+*.DIAGRAM
+*
+*4:	test whether or not a MIC is reported by the Hermes
+*14: the calculated MIC and the received MIC are compared, the return status is set when there is a mismatch
+*
+*.NOTICE
+*.ENDDOC				END DOCUMENTATION
+*
+************************************************************************************************************/
+int
+check_mic( IFBP ifbp )
+{
+int		rc = HCF_SUCCESS;
+hcf_32 x32[2];				//* area to save rcvd 8 bytes MIC
+
+													//if MIC present in RxFS
+	if ( *(wci_recordp)&ifbp->IFB_lap[-HFS_ADDR_DEST] & HFS_STAT_MIC ) {
+	//or if ( ifbp->IFB_MICRxCarry != 0xFFFF )
+		CALC_RX_MIC( mic_pad, 8 );					//.  process up to 3 remaining bytes of data and append 5 to 8 bytes of padding to MIC calculation
+		get_frag( ifbp, (wci_bufp)x32, 8 BE_PAR(0));//.  get 8 byte MIC from NIC
+													//.  if calculated and received MIC do not match
+													//.  .  set status at HCF_ERR_MIC
+/*14*/  if ( x32[0] != CNV_LITTLE_TO_LONG(ifbp->IFB_MICRx[0]) ||
+        	 x32[1] != CNV_LITTLE_TO_LONG(ifbp->IFB_MICRx[1])	  ) {
+			rc = HCF_ERR_MIC;
+		}
+	}
+													//return status
+	return rc;
+} // check_mic
+#endif // HCF_TYPE_WPA
+#endif // HCF_DL_ONLY
+
+
+/************************************************************************************************************
+*
+*.SUBMODULE		int cmd_cmpl( IFBP ifbp )
+*.PURPOSE		waits for Hermes Command Completion.
+*
+*.ARGUMENTS
+*	ifbp		address of the Interface Block
+*
+*.RETURNS
+*	IFB_DefunctStat
+*	HCF_ERR_TIME_OUT
+*	HCF_ERR_DEFUNCT_CMD_SEQ
+*	HCF_SUCCESS
+*
+*.DESCRIPTION
+*
+*
+*.DIAGRAM
+*
+*2:	Once cmd_cmpl is called, the Busy option bit in IFB_Cmd must be cleared
+*4:	If Status register and command code don't match either:
+*	 - the Hermes and Host are out of sync ( a fatal error)
+*	 - error bits are reported via the Status Register.
+*	Out of sync is considered fatal and brings the HCF in Defunct mode
+*	Errors reported via the Status Register should be caused by sequence violations in Hermes command
+*	sequences and hence these bugs should have been found during engineering testing. Since there is no
+*	strategy to cope with this problem, it might as well be ignored at run time. Note that for any particular
+*	situation where a strategy is formulated to handle the consequences of a particular bug causing a
+*	particular Error situation reported via the Status Register, the bug should be removed rather than adding
+*	logic to cope with the consequences of the bug.
+*	There have been HCF versions where an error report via the Status Register even brought the HCF in defunct
+*	mode (although it was not yet named like that at that time). This is particular undesirable behavior for a
+*	general library.
+*	Simply reporting the error (as "interesting") is debatable. There also have been HCF versions with this
+*	strategy using the "vague" HCF_FAILURE code.
+*	The error is reported via:
+*	 - MiscErr tally of the HCF Tally set
+*	 - the (informative) fields IFB_ErrCmd and IFB_ErrQualifier
+*	 - the assert mechanism
+*8:	Here the Defunct case and the Status error are separately treated
+*
+*
+*.ENDDOC				END DOCUMENTATION
+*
+************************************************************************************************************/
+HCF_STATIC int
+cmd_cmpl( IFBP ifbp )
+{
+
+PROT_CNT_INI
+int		rc = HCF_SUCCESS;
+hcf_16	stat;
+
+	HCFLOGENTRY( HCF_TRACE_CMD_CPL, ifbp->IFB_Cmd )
+	ifbp->IFB_Cmd &= ~HCMD_BUSY;												/* 2 */
+	HCF_WAIT_WHILE( (IPW( HREG_EV_STAT) & HREG_EV_CMD) == 0 );					/* 4 */
+	stat = IPW( HREG_STAT );
+#if HCF_PROT_TIME
+	if ( prot_cnt == 0 ) {
+		IF_TALLY( ifbp->IFB_HCF_Tallies.MiscErr++; )
+		rc = HCF_ERR_TIME_OUT;
+		HCFASSERT( DO_ASSERT, ifbp->IFB_Cmd )
+	} else
+#endif // HCF_PROT_TIME
+	{
+		DAWA_ACK( HREG_EV_CMD );
+/*4*/	if ( stat != (ifbp->IFB_Cmd & HCMD_CMD_CODE) ) {
+/*8*/		if ( ( (stat ^ ifbp->IFB_Cmd ) & HCMD_CMD_CODE) != 0 ) {
+				rc = ifbp->IFB_DefunctStat = HCF_ERR_DEFUNCT_CMD_SEQ;
+				ifbp->IFB_CardStat |= CARD_STAT_DEFUNCT;
+			}
+			IF_TALLY( ifbp->IFB_HCF_Tallies.MiscErr++; )
+			ifbp->IFB_ErrCmd = stat;
+			ifbp->IFB_ErrQualifier = IPW( HREG_RESP_0 );
+			HCFASSERT( DO_ASSERT, MERGE_2( IPW( HREG_PARAM_0 ), ifbp->IFB_Cmd ) )
+			HCFASSERT( DO_ASSERT, MERGE_2( ifbp->IFB_ErrQualifier, ifbp->IFB_ErrCmd ) )
+		}
+	}
+	HCFASSERT( rc == HCF_SUCCESS, rc)
+	HCFLOGEXIT( HCF_TRACE_CMD_CPL )
+	return rc;
+} // cmd_cmpl
+
+
+/************************************************************************************************************
+*
+*.SUBMODULE		int cmd_exe( IFBP ifbp, int cmd_code, int par_0 )
+*.PURPOSE		Executes synchronous part of Hermes Command and - optionally - waits for Command Completion.
+*
+*.ARGUMENTS
+*	ifbp		address of the Interface Block
+*	cmd_code
+*	par_0
+*
+*.RETURNS
+*	IFB_DefunctStat
+*	HCF_ERR_DEFUNCT_CMD_SEQ
+*	HCF_SUCCESS
+*	HCF_ERR_TO_BE_ADDED	<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
+*
+*.DESCRIPTION
+* Executes synchronous Hermes Command and waits for Command Completion
+*
+* The general HCF strategy is to wait for command completion. As a consequence:
+* - the read of the busy bit before writing the command register is superfluous
+* - the Hermes requirement that no Inquiry command may be executed if there is still an unacknowledged
+*	Inquiry command outstanding, is automatically met.
+* The Tx command uses the "Busy" bit in the cmd_code parameter to deviate from this general HCF strategy.
+* The idea is that by not busy-waiting on completion of this frequently used command the processor
+* utilization is diminished while using the busy-wait on all other seldom used commands the flow is kept
+* simple.
+*
+*
+*
+*.DIAGRAM
+*
+*1:	skip the body of cmd_exe when in defunct mode or when - based on the S/W Support register write and
+*	read back test - there is apparently no NIC.
+*	Note: we gave up on the "old" strategy to write the S/W Support register at magic only when needed. Due to
+*	the intricateness of Hermes F/W varieties ( which behave differently as far as corruption of the S/W
+*	Support register is involved), the increasing number of Hermes commands which do an implicit initialize
+*	(thus modifying the S/W Support register) and the workarounds of some OS/Support S/W induced aspects (e.g.
+*	the System Soft library at WinNT which postpones the actual mapping of I/O space up to 30 seconds after
+*	giving the go-ahead), the "magic" strategy is now reduced to a simple write and read back. This means that
+*	problems like a bug tramping over the memory mapped Hermes registers will no longer be noticed as side
+*	effect of the S/W Support register check.
+*2:	check whether the preceding command skipped the busy wait and if so, check for command completion
+*
+*.NOTICE
+*.ENDDOC				END DOCUMENTATION
+*
+************************************************************************************************************/
+
+HCF_STATIC int
+cmd_exe( IFBP ifbp, hcf_16 cmd_code, hcf_16 par_0 )	//if HCMD_BUSY of cmd_code set, then do NOT wait for completion
+{
+int rc;
+
+	HCFLOGENTRY( HCF_TRACE_CMD_EXE, cmd_code )
+	HCFASSERT( (cmd_code & HCMD_CMD_CODE) != HCMD_TX || cmd_code & HCMD_BUSY, cmd_code ) //Tx must have Busy bit set
+	OPW( HREG_SW_0, HCF_MAGIC );
+	if ( IPW( HREG_SW_0 ) == HCF_MAGIC ) {														/* 1 */
+		rc = ifbp->IFB_DefunctStat;
+	}
+	else rc = HCF_ERR_NO_NIC;
+	if ( rc == HCF_SUCCESS ) {
+		//;?is this a hot idea, better MEASURE performance impact
+/*2*/	if ( ifbp->IFB_Cmd & HCMD_BUSY ) {
+			rc = cmd_cmpl( ifbp );
+		}
+		OPW( HREG_PARAM_0, par_0 );
+		OPW( HREG_CMD, cmd_code &~HCMD_BUSY );
+		ifbp->IFB_Cmd = cmd_code;
+		if ( (cmd_code & HCMD_BUSY) == 0 ) {	//;?is this a hot idea, better MEASURE performance impact
+			rc = cmd_cmpl( ifbp );
+		}
+	}
+	HCFASSERT( rc == HCF_SUCCESS, MERGE_2( rc, cmd_code ) )
+	HCFLOGEXIT( HCF_TRACE_CMD_EXE )
+	return rc;
+} // cmd_exe
+
+
+/************************************************************************************************************
+*
+*.SUBMODULE		int download( IFBP ifbp, CFG_PROG_STRCT FAR *ltvp )
+*.PURPOSE		downloads F/W image into NIC and initiates execution of the downloaded F/W.
+*
+*.ARGUMENTS
+*	ifbp		address of the Interface Block
+*	ltvp		specifies the pseudo-RID (as defined by WCI)
+*
+*.RETURNS
+*
+*.DESCRIPTION
+*
+*
+*.DIAGRAM
+*1:	First, Ack everything to unblock a (possibly) blocked cmd pipe line
+*	Note 1: it is very likely that an Alloc event is pending and very well possible that a (Send) Cmd event is
+*	pending
+*	Note 2: it is assumed that this strategy takes away the need to ack every conceivable event after an
+*	Hermes Initialize
+*
+*
+*.ENDDOC				END DOCUMENTATION
+*
+************************************************************************************************************/
+HCF_STATIC int
+download( IFBP ifbp, CFG_PROG_STRCT FAR *ltvp )						//Hermes-II download (volatile only)
+{
+hcf_16				i;
+int					rc = HCF_SUCCESS;
+wci_bufp			cp;
+hcf_io				io_port = ifbp->IFB_IOBase + HREG_AUX_DATA;
+
+	HCFLOGENTRY( HCF_TRACE_DL, ltvp->typ )
+#if (HCF_TYPE) & HCF_TYPE_PRELOADED
+	HCFASSERT( DO_ASSERT, ltvp->mode )
+#else
+													//if initial "program" LTV
+	if ( ifbp->IFB_DLMode == CFG_PROG_STOP && ltvp->mode == CFG_PROG_VOLATILE) {
+													//.  switch Hermes to initial mode
+/*1*/	OPW( HREG_EV_ACK, ~HREG_EV_SLEEP_REQ );
+		rc = cmd_exe( ifbp, HCMD_INI, 0 );	/* HCMD_INI can not be part of init() because that is called on
+											 * other occasions as well */
+		rc = init( ifbp );
+	}
+													//if final "program" LTV
+	if ( ltvp->mode == CFG_PROG_STOP && ifbp->IFB_DLMode == CFG_PROG_VOLATILE) {
+													//.  start tertiary (or secondary)
+		OPW( HREG_PARAM_1, (hcf_16)(ltvp->nic_addr >> 16) );
+		rc = cmd_exe( ifbp, HCMD_EXECUTE, (hcf_16) ltvp->nic_addr );
+		if (rc == HCF_SUCCESS) {
+			rc = init( ifbp );	/*;? do we really want to skip init if cmd_exe failed, i.e.
+								 *	 IFB_FW_Comp_Id is than possibly incorrect */
+	  	}
+													//else (non-final)
+	} else {
+													//.  if mode == Readback SEEPROM
+#if 0	//;? as long as the next if contains a hard coded 0, might as well leave it out even more obvious
+		if ( 0 /*len is definitely not want we want;?*/ && ltvp->mode == CFG_PROG_SEEPROM_READBACK ) {
+			OPW( HREG_PARAM_1, (hcf_16)(ltvp->nic_addr >> 16) );
+			OPW( HREG_PARAM_2, MUL_BY_2(ltvp->len - 4));
+													//.  .  perform Hermes prog cmd with appropriate mode bits
+			rc = cmd_exe( ifbp, HCMD_PROGRAM | ltvp->mode, (hcf_16)ltvp->nic_addr );
+													//.  .  set up NIC RAM addressability according Resp0-1
+			OPW( HREG_AUX_PAGE,   IPW( HREG_RESP_1) );
+			OPW( HREG_AUX_OFFSET, IPW( HREG_RESP_0) );
+													//.  .  set up L-field of LTV according Resp2
+			i = ( IPW( HREG_RESP_2 ) + 1 ) / 2;  // i contains max buffer size in words, a probably not very useful piece of information ;?
+/*Nico's code based on i is the "real amount of data available"
+			if ( ltvp->len - 4 < i ) rc = HCF_ERR_LEN;
+			else ltvp->len = i + 4;
+*/
+/* Rolands code based on the idea that a MSF should not ask for more than is available
+			// check if number of bytes requested exceeds max buffer size
+			if ( ltvp->len - 4 > i ) {
+				rc = HCF_ERR_LEN;
+				ltvp->len = i + 4;
+			}
+*/
+													//.  .  copy data from NIC via AUX port to LTV
+			cp = (wci_bufp)ltvp->host_addr;						/*IN_PORT_STRING_8_16 macro may modify its parameters*/
+			i = ltvp->len - 4;
+			IN_PORT_STRING_8_16( io_port, cp, i );		//!!!WORD length, cp MUST be a char pointer	// $$ char
+													//.  else (non-final programming)
+		} else
+#endif //;? as long as the above if contains a hard coded 0, might as well leave it out even more obvious
+		{											//.  .  get number of words to program
+			HCFASSERT( ltvp->segment_size, *ltvp->host_addr )
+			i = ltvp->segment_size/2;
+													//.  .  copy data (words) from LTV via AUX port to NIC
+			cp = (wci_bufp)ltvp->host_addr;						//OUT_PORT_STRING_8_16 macro may modify its parameters
+													//.  .  if mode == volatile programming
+			if ( ltvp->mode == CFG_PROG_VOLATILE ) {
+													//.  .  .  set up NIC RAM addressability via AUX port
+				OPW( HREG_AUX_PAGE, (hcf_16)(ltvp->nic_addr >> 16 << 9 | (ltvp->nic_addr & 0xFFFF) >> 7 ) );
+				OPW( HREG_AUX_OFFSET, (hcf_16)(ltvp->nic_addr & 0x007E) );
+				OUT_PORT_STRING_8_16( io_port, cp, i );		//!!!WORD length, cp MUST be a char pointer
+			}
+		}
+	}
+	ifbp->IFB_DLMode = ltvp->mode;					//save state in IFB_DLMode
+#endif // HCF_TYPE_PRELOADED
+	HCFASSERT( rc == HCF_SUCCESS, rc )
+	HCFLOGEXIT( HCF_TRACE_DL )
+	return rc;
+} // download
+
+
+#if (HCF_ASSERT) & HCF_ASSERT_PRINTF
+/**************************************************
+* Certain Hermes-II firmware versions can generate
+* debug information. This debug information is
+* contained in a buffer in nic-RAM, and can be read
+* via the aux port.
+**************************************************/
+HCF_STATIC int
+fw_printf(IFBP ifbp, CFG_FW_PRINTF_STRCT FAR *ltvp)
+{
+    int rc = HCF_SUCCESS;
+    hcf_16 fw_cnt;
+//    hcf_32 DbMsgBuffer = 0x29D2, DbMsgCount= 0x000029D0;
+//    hcf_16 DbMsgSize=0x00000080;
+    hcf_32 DbMsgBuffer;
+    CFG_FW_PRINTF_BUFFER_LOCATION_STRCT *p = &ifbp->IFB_FwPfBuff;
+    ltvp->len = 1;
+    if ( p->DbMsgSize != 0 ) {
+        // first, check the counter in nic-RAM and compare it to the latest counter value of the HCF
+        OPW( HREG_AUX_PAGE, (hcf_16)(p->DbMsgCount >> 7) );
+        OPW( HREG_AUX_OFFSET, (hcf_16)(p->DbMsgCount & 0x7E) );
+        fw_cnt = ((IPW( HREG_AUX_DATA) >>1 ) & ((hcf_16)p->DbMsgSize - 1));
+        if ( fw_cnt != ifbp->IFB_DbgPrintF_Cnt ) {
+//    DbgPrint("fw_cnt=%d IFB_DbgPrintF_Cnt=%d\n", fw_cnt, ifbp->IFB_DbgPrintF_Cnt);
+            DbMsgBuffer = p->DbMsgBuffer + ifbp->IFB_DbgPrintF_Cnt * 6; // each entry is 3 words
+            OPW( HREG_AUX_PAGE, (hcf_16)(DbMsgBuffer >> 7) );
+            OPW( HREG_AUX_OFFSET, (hcf_16)(DbMsgBuffer & 0x7E) );
+            ltvp->msg_id     = IPW(HREG_AUX_DATA);
+            ltvp->msg_par    = IPW(HREG_AUX_DATA);
+            ltvp->msg_tstamp = IPW(HREG_AUX_DATA);
+            ltvp->len = 4;
+            ifbp->IFB_DbgPrintF_Cnt++;
+            ifbp->IFB_DbgPrintF_Cnt &= (p->DbMsgSize - 1);
+        }
+    }
+    return rc;
+};
+#endif // HCF_ASSERT_PRINTF
+
+
+#if (HCF_DL_ONLY) == 0
+/************************************************************************************************************
+*
+*.SUBMODULE		hcf_16 get_fid( IFBP ifbp )
+*.PURPOSE		get allocated FID for either transmit or notify.
+*
+*.ARGUMENTS
+*	ifbp		address of the Interface Block
+*
+*.RETURNS
+*	0	no FID available
+*	<>0	FID number
+*
+*.DESCRIPTION
+*
+*
+*.DIAGRAM
+*	The preference is to use a "pending" alloc. If no alloc is pending, then - if available - the "spare" FID
+*	is used.
+*	If the spare FID is used, IFB_RscInd (representing the spare FID) must be cleared
+*	If the pending alloc is used, the alloc event must be acknowledged to the Hermes.
+*	In case the spare FID was depleted and the IFB_RscInd has been "faked" as pseudo resource with a 0x0001
+*	value by hcf_service_nic, IFB_RscInd has to be "corrected" again to its 0x0000 value.
+*
+*	Note that due to the Hermes-II H/W problems which are intended to be worked around by DAWA, the Alloc bit
+*	in the Event register is no longer a reliable indication of the presence/absence of a FID. The "Clear FID"
+*	part of the DAWA logic, together with the choice of the definition of the return information from get_fid,
+*	handle this automatically, i.e. without additional code in get_fid.
+*.ENDDOC				END DOCUMENTATION
+*
+************************************************************************************************************/
+HCF_STATIC hcf_16
+get_fid( IFBP ifbp )
+{
+
+hcf_16 fid = 0;
+#if ( (HCF_TYPE) & HCF_TYPE_HII5 ) == 0
+PROT_CNT_INI
+#endif // HCF_TYPE_HII5
+
+	IF_DMA( HCFASSERT(!(ifbp->IFB_CntlOpt & USE_DMA), ifbp->IFB_CntlOpt) )
+
+	if ( IPW( HREG_EV_STAT) & HREG_EV_ALLOC) {
+		fid = IPW( HREG_ALLOC_FID );
+		HCFASSERT( fid, ifbp->IFB_RscInd )
+		DAWA_ZERO_FID( HREG_ALLOC_FID )
+#if ( (HCF_TYPE) & HCF_TYPE_HII5 ) == 0
+		HCF_WAIT_WHILE( ( IPW( HREG_EV_STAT ) & HREG_EV_ACK_REG_READY ) == 0 );
+		HCFASSERT( prot_cnt, IPW( HREG_EV_STAT ) )
+#endif // HCF_TYPE_HII5
+		DAWA_ACK( HREG_EV_ALLOC );			//!!note that HREG_EV_ALLOC is written only once
+// 180 degree error in logic ;? #if ALLOC_15
+		if ( ifbp->IFB_RscInd == 1 ) {
+			ifbp->IFB_RscInd = 0;
+		}
+//#endif // ALLOC_15
+	} else {
+// 180 degree error in logic ;? #if ALLOC_15
+		fid = ifbp->IFB_RscInd;
+//#endif // ALLOC_15
+		ifbp->IFB_RscInd = 0;
+	}
+	return fid;
+} // get_fid
+#endif // HCF_DL_ONLY
+
+
+/************************************************************************************************************
+*
+*.SUBMODULE		void get_frag( IFBP ifbp, wci_bufp bufp, int len BE_PAR( int word_len ) )
+*.PURPOSE		reads with 16/32 bit I/O via BAP1 port from NIC RAM to Host memory.
+*
+*.ARGUMENTS
+*	ifbp		address of the Interface Block
+*	bufp		(byte) address of buffer
+*	len			length in bytes of buffer specified by bufp
+*	word_len	Big Endian only: number of leading bytes to swap in pairs
+*
+*.RETURNS		N.A.
+*
+*.DESCRIPTION
+* process the single byte (if applicable) read by the previous get_frag and copy len (or len-1) bytes from
+* NIC to bufp.
+* On a Big Endian platform, the parameter word_len controls the number of leading bytes whose endianess is
+* converted (i.e. byte swapped)
+*
+*
+*.DIAGRAM
+*10: The PCMCIA card can be removed in the middle of the transfer. By depositing a "magic number" in the
+*	HREG_SW_0 register of the Hermes at initialization time and by verifying this register, it can be
+*	determined whether the card is still present. The return status is set accordingly.
+*	Clearing the buffer is a (relative) cheap way to prevent that failing I/O results in run-away behavior
+*	because the garbage in the buffer is interpreted by the caller irrespective of the return status (e.g.
+*	hcf_service_nic has this behavior).
+*
+*.NOTICE
+*	It turns out DOS ODI uses zero length fragments. The HCF code can cope with it, but as a consequence, no
+*	Assert on len is possible
+*
+*.ENDDOC				END DOCUMENTATION
+*
+************************************************************************************************************/
+HCF_STATIC void
+get_frag( IFBP ifbp, wci_bufp bufp, int len BE_PAR( int word_len ) )
+{
+hcf_io		io_port = ifbp->IFB_IOBase + HREG_DATA_1;	//BAP data register
+wci_bufp	p = bufp;									//working pointer
+int			i;											//prevent side effects from macro
+int			j;
+
+	HCFASSERT( ((hcf_32)bufp & (HCF_ALIGN-1) ) == 0, (hcf_32)bufp )
+
+/*1:	here recovery logic for intervening BAP access between hcf_service_nic and hcf_rcv_msg COULD be added
+ * 	if current access is RxInitial
+ * 	.  persistent_offset += len
+ */
+
+	i = len;
+													//if buffer length > 0 and carry from previous get_frag
+	if ( i && ifbp->IFB_CarryIn ) {
+													//.  move carry to buffer
+													//.  adjust buffer length and pointer accordingly
+		*p++ = (hcf_8)(ifbp->IFB_CarryIn>>8);
+		i--;
+													//.  clear carry flag
+		ifbp->IFB_CarryIn = 0;
+	}
+#if (HCF_IO) & HCF_IO_32BITS
+	//skip zero-length I/O, single byte I/O and I/O not worthwhile (i.e. less than 6 bytes)for DW logic
+													//if buffer length >= 6 and 32 bits I/O support
+	if ( !(ifbp->IFB_CntlOpt & USE_16BIT) && i >= 6 ) {
+hcf_32 FAR	*p4; //prevent side effects from macro
+		if ( ( (hcf_32)p & 0x1 ) == 0 ) {			//.  if buffer at least word aligned
+			if ( (hcf_32)p & 0x2 ) {				//.  .  if buffer not double word aligned
+													//.  .  .  read single word to get double word aligned
+				*(wci_recordp)p = IN_PORT_WORD( io_port );
+													//.  .  .  adjust buffer length and pointer accordingly
+				p += 2;
+				i -= 2;
+			}
+													//.  .  read as many double word as possible
+			p4 = (hcf_32 FAR *)p;
+			j = i/4;
+			IN_PORT_STRING_32( io_port, p4, j );
+													//.  .  adjust buffer length and pointer accordingly
+			p += i & ~0x0003;
+			i &= 0x0003;
+		}
+	}
+#endif // HCF_IO_32BITS
+													//if no 32-bit support OR byte aligned OR 1-3 bytes left
+	if ( i ) {
+													//.  read as many word as possible in "alignment safe" way
+		j = i/2;
+		IN_PORT_STRING_8_16( io_port, p, j );
+													//.  if 1 byte left
+		if ( i & 0x0001 ) {
+													//.  .  read 1 word
+			ifbp->IFB_CarryIn = IN_PORT_WORD( io_port );
+													//.  .  store LSB in last char of buffer
+			bufp[len-1] = (hcf_8)ifbp->IFB_CarryIn;
+													//.  .  save MSB in carry, set carry flag
+			ifbp->IFB_CarryIn |= 0x1;
+		}
+	}
+#if HCF_BIG_ENDIAN
+	HCFASSERT( word_len == 0 || word_len == 2 || word_len == 4, word_len )
+	HCFASSERT( word_len == 0 || ((hcf_32)bufp & 1 ) == 0, (hcf_32)bufp )
+	HCFASSERT( word_len <= len, MERGE2( word_len, len ) )
+	//see put_frag for an alternative implementation, but be carefull about what are int's and what are
+	//hcf_16's
+	if ( word_len ) {								//.  if there is anything to convert
+hcf_8 c;
+		c = bufp[1];								//.  .  convert the 1st hcf_16
+		bufp[1] = bufp[0];
+		bufp[0] = c;
+		if ( word_len > 1 ) {						//.  .  if there is to convert more than 1 word ( i.e 2 )
+			c = bufp[3];							//.  .  .  convert the 2nd hcf_16
+			bufp[3] = bufp[2];
+			bufp[2] = c;
+		}
+	}
+#endif // HCF_BIG_ENDIAN
+} // get_frag
+
+/************************************************************************************************************
+*
+*.SUBMODULE		int init( IFBP ifbp )
+*.PURPOSE		Handles common initialization aspects (H-I init, calibration, config.mngmt, allocation).
+*
+*.ARGUMENTS
+*	ifbp		address of the Interface Block
+*
+*.RETURNS
+*	HCF_ERR_INCOMP_PRI
+*	HCF_ERR_INCOMP_FW
+*	HCF_ERR_TIME_OUT
+*	>>hcf_get_info
+*		HCF_ERR_NO_NIC
+*		HCF_ERR_LEN
+*
+*.DESCRIPTION
+* init will successively:
+* - in case of a (non-preloaded) H-I, initialize the NIC
+* - calibrate the S/W protection timer against the Hermes Timer
+* - collect HSI, "active" F/W Configuration Management Information
+* - in case active F/W is Primary F/W: collect Primary F/W Configuration Management Information
+* - check HSI and Primary F/W compatibility with the HCF
+* - in case active F/W is Station or AP F/W: check Station or AP F/W compatibility with the HCF
+* - in case active F/W is not Primary F/W: allocate FIDs to be used in transmit/notify process
+*
+*
+*.DIAGRAM
+*2:	drop all error status bits in IFB_CardStat since they are expected to be re-evaluated.
+*4:	Ack everything except HREG_EV_SLEEP_REQ. It is very likely that an Alloc event is pending and
+*	very well possible that a Send Cmd event is pending. Acking HREG_EV_SLEEP_REQ is handled by hcf_action(
+*	HCF_ACT_INT_ON ) !!!
+*10: Calibrate the S/W time-out protection mechanism by calling calibrate(). Note that possible errors
+*	in the calibration process are nor reported by init but will show up via the defunct mechanism in
+*	subsequent hcf-calls.
+*14: usb_check_comp() is called to have the minimal visual clutter for the legacy H-I USB dongle
+*	compatibility check.
+*16: The following configuration management related information is retrieved from the NIC:
+*	 - HSI supplier
+*	 - F/W Identity
+*	 - F/W supplier
+*	 if appropriate:
+*	 - PRI Identity
+*	 - PRI supplier
+*	 appropriate means on H-I: always
+*	 and on H-II if F/W supplier reflects a primary (i.e. only after an Hermes Reset or Init
+*	 command).
+*	 QUESTION ;? !!!!!! should, For each of the above RIDs the Endianess is converted to native Endianess.
+*	 Only the return code of the first hcf_get_info is used. All hcf_get_info calls are made, regardless of
+*	 the success or failure of the 1st hcf_get_info. The assumptions are:
+*	  - if any call fails, they all fail, so remembering the result of the 1st call is adequate
+*	  - a failing call will overwrite the L-field with a 0x0000 value, which services both as an
+*		error indication for the values cached in the IFB as making mmd_check_comp fail.
+*	 In case of H-I, when getting the F/W identity fails, the F/W is assumed to be H-I AP F/W pre-dating
+*	 version 9.0 and the F/W Identity and Supplier are faked accordingly.
+*	 In case of H-II, the Primary, Station and AP Identity are merged into a single F/W Identity.
+*	 The same applies to the Supplier information. As a consequence the PRI information can no longer be
+*	 retrieved when a Tertiary runs. To accommodate MSFs and Utilities who depend on PRI information being
+*	 available at any time, this information is cached in the IFB. In this cache the generic "F/W" value of
+*	 the typ-fields is overwritten with the specific (legacy) "PRI" values. To actually re-route the (legacy)
+*	 PRI request via hcf_get_info, the xxxx-table must be set.  In case of H-I, this caching, modifying and
+*	 re-routing is not needed because PRI information is always available directly from the NIC. For
+*	 consistency the caching fields in the IFB are filled with the PRI information anyway.
+*18: mdd_check_comp() is called to check the Supplier Variant and Range of the Host-S/W I/F (HSI) and the
+*	Primary Firmware Variant and Range against the Top and Bottom level supported by this HCF.  If either of
+*	these tests fails, the CARD_STAT_INCOMP_PRI bit of IFB_CardStat is set
+*	Note: There should always be a primary except during production, so this makes the HCF in its current form
+*	unsuitable for manufacturing test systems like the FTS. This can be remedied by an adding a test like
+*	ifbp->IFB_PRISup.id == COMP_ID_PRI
+*20: In case there is Tertiary F/W and this F/W is Station F/W, the Supplier Variant and Range of the Station
+*	Firmware function as retrieved from the Hermes is checked against the Top and Bottom level supported by
+*	this HCF.
+*	Note: ;? the tertiary F/W compatibility checks could be moved to the DHF, which already has checked the
+*	CFI and MFI compatibility of the image with the NIC before the image was downloaded.
+*28: In case of non-Primary F/W: allocates and acknowledge a (TX or Notify) FID and allocates without
+*	acknowledge another (TX or Notify) FID (the so-called 1.5 alloc scheme) with the following steps:
+*	- execute the allocate command by calling cmd_exe
+*	- wait till either the alloc event or a time-out occurs
+*	- regardless whether the alloc event occurs, call get_fid to
+*	  - read the FID and save it in IFB_RscInd to be used as "spare FID"
+*	  - acknowledge the alloc event
+*	  - do another "half" allocate to complete the "1.5 Alloc scheme"
+*	  Note that above 3 steps do not harm and thus give the "cheapest" acceptable strategy.
+*	  If a time-out occurred, then report time out status (after all)
+*
+*.ENDDOC				END DOCUMENTATION
+*
+************************************************************************************************************/
+HCF_STATIC int
+init( IFBP ifbp )
+{
+
+int	rc = HCF_SUCCESS;
+
+	HCFLOGENTRY( HCF_TRACE_INIT, 0 )
+
+	ifbp->IFB_CardStat = 0;																			/* 2*/
+	OPW( HREG_EV_ACK, ~HREG_EV_SLEEP_REQ ); 											/* 4*/
+	IF_PROT_TIME( calibrate( ifbp ); ) 													/*10*/
+#if 0 // OOR
+	ifbp->IFB_FWIdentity.len = 2;							//misuse the IFB space for a put
+	ifbp->IFB_FWIdentity.typ = CFG_TICK_TIME;
+	ifbp->IFB_FWIdentity.comp_id = (1000*1000)/1024 + 1;	//roughly 1 second
+	hcf_put_info( ifbp, (LTVP)&ifbp->IFB_FWIdentity.len );
+#endif // OOR
+	ifbp->IFB_FWIdentity.len = sizeof(CFG_FW_IDENTITY_STRCT)/sizeof(hcf_16) - 1;
+	ifbp->IFB_FWIdentity.typ = CFG_FW_IDENTITY;
+	rc = hcf_get_info( ifbp, (LTVP)&ifbp->IFB_FWIdentity.len );
+/* ;? conversion should not be needed for mmd_check_comp */
+#if HCF_BIG_ENDIAN
+	ifbp->IFB_FWIdentity.comp_id       = CNV_LITTLE_TO_SHORT( ifbp->IFB_FWIdentity.comp_id );
+	ifbp->IFB_FWIdentity.variant       = CNV_LITTLE_TO_SHORT( ifbp->IFB_FWIdentity.variant );
+	ifbp->IFB_FWIdentity.version_major = CNV_LITTLE_TO_SHORT( ifbp->IFB_FWIdentity.version_major );
+	ifbp->IFB_FWIdentity.version_minor = CNV_LITTLE_TO_SHORT( ifbp->IFB_FWIdentity.version_minor );
+#endif // HCF_BIG_ENDIAN
+#if defined MSF_COMPONENT_ID																		/*14*/
+	if ( rc == HCF_SUCCESS ) {																		/*16*/
+		ifbp->IFB_HSISup.len = sizeof(CFG_SUP_RANGE_STRCT)/sizeof(hcf_16) - 1;
+		ifbp->IFB_HSISup.typ = CFG_NIC_HSI_SUP_RANGE;
+		rc = hcf_get_info( ifbp, (LTVP)&ifbp->IFB_HSISup.len );
+/* ;? conversion should not be needed for mmd_check_comp , BUT according to a report of a BE-user it is
+ * should be resolved in the WARP release
+ * since some compilers make ugly but unnecessary code of these instructions even for LE,
+ * it is conditionally compiled */
+#if HCF_BIG_ENDIAN
+		ifbp->IFB_HSISup.role    = CNV_LITTLE_TO_SHORT( ifbp->IFB_HSISup.role );
+		ifbp->IFB_HSISup.id      = CNV_LITTLE_TO_SHORT( ifbp->IFB_HSISup.id );
+		ifbp->IFB_HSISup.variant = CNV_LITTLE_TO_SHORT( ifbp->IFB_HSISup.variant );
+		ifbp->IFB_HSISup.bottom  = CNV_LITTLE_TO_SHORT( ifbp->IFB_HSISup.bottom );
+		ifbp->IFB_HSISup.top     = CNV_LITTLE_TO_SHORT( ifbp->IFB_HSISup.top );
+#endif // HCF_BIG_ENDIAN
+		ifbp->IFB_FWSup.len = sizeof(CFG_SUP_RANGE_STRCT)/sizeof(hcf_16) - 1;
+		ifbp->IFB_FWSup.typ = CFG_FW_SUP_RANGE;
+		(void)hcf_get_info( ifbp, (LTVP)&ifbp->IFB_FWSup.len );
+/* ;? conversion should not be needed for mmd_check_comp */
+#if HCF_BIG_ENDIAN
+		ifbp->IFB_FWSup.role    = CNV_LITTLE_TO_SHORT( ifbp->IFB_FWSup.role );
+		ifbp->IFB_FWSup.id      = CNV_LITTLE_TO_SHORT( ifbp->IFB_FWSup.id );
+		ifbp->IFB_FWSup.variant = CNV_LITTLE_TO_SHORT( ifbp->IFB_FWSup.variant );
+		ifbp->IFB_FWSup.bottom  = CNV_LITTLE_TO_SHORT( ifbp->IFB_FWSup.bottom );
+		ifbp->IFB_FWSup.top     = CNV_LITTLE_TO_SHORT( ifbp->IFB_FWSup.top );
+#endif // HCF_BIG_ENDIAN
+
+		if ( ifbp->IFB_FWSup.id == COMP_ID_PRI ) {												/* 20*/
+int i = sizeof( CFG_FW_IDENTITY_STRCT) + sizeof(CFG_SUP_RANGE_STRCT );
+			while ( i-- ) ((hcf_8*)(&ifbp->IFB_PRIIdentity))[i] = ((hcf_8*)(&ifbp->IFB_FWIdentity))[i];
+			ifbp->IFB_PRIIdentity.typ = CFG_PRI_IDENTITY;
+			ifbp->IFB_PRISup.typ = CFG_PRI_SUP_RANGE;
+			xxxx[xxxx_PRI_IDENTITY_OFFSET] = &ifbp->IFB_PRIIdentity.len;
+			xxxx[xxxx_PRI_IDENTITY_OFFSET+1] = &ifbp->IFB_PRISup.len;
+		}
+		if ( !mmd_check_comp( (void*)&cfg_drv_act_ranges_hsi, &ifbp->IFB_HSISup)				 /* 22*/
+#if ( (HCF_TYPE) & HCF_TYPE_PRELOADED ) == 0
+//;? the PRI compatibility check is only relevant for DHF
+			 || !mmd_check_comp( (void*)&cfg_drv_act_ranges_pri, &ifbp->IFB_PRISup)
+#endif // HCF_TYPE_PRELOADED
+		   ) {
+			ifbp->IFB_CardStat = CARD_STAT_INCOMP_PRI;
+			rc = HCF_ERR_INCOMP_PRI;
+		}
+		if ( ( ifbp->IFB_FWSup.id == COMP_ID_STA &&	!mmd_check_comp( (void*)&cfg_drv_act_ranges_sta, &ifbp->IFB_FWSup) ) ||
+			 ( ifbp->IFB_FWSup.id == COMP_ID_APF && !mmd_check_comp( (void*)&cfg_drv_act_ranges_apf, &ifbp->IFB_FWSup) )
+		   ) {																					/* 24 */
+			ifbp->IFB_CardStat |= CARD_STAT_INCOMP_FW;
+			rc = HCF_ERR_INCOMP_FW;
+		}
+	}
+#endif // MSF_COMPONENT_ID
+#if (HCF_DL_ONLY) == 0																			/* 28 */
+	if ( rc == HCF_SUCCESS && ifbp->IFB_FWIdentity.comp_id >= COMP_ID_FW_STA ) {
+PROT_CNT_INI
+		/**************************************************************************************
+		* rlav: the DMA engine needs the host to cause a 'hanging alloc event' for it to consume.
+		* not sure if this is the right spot in the HCF, thinking about hcf_enable...
+		**************************************************************************************/
+		rc = cmd_exe( ifbp, HCMD_ALLOC, 0 );
+// 180 degree error in logic ;? #if ALLOC_15
+//		ifbp->IFB_RscInd = 1;	//let's hope that by the time hcf_send_msg isa called, there will be a FID
+//#else
+		if ( rc == HCF_SUCCESS ) {
+			HCF_WAIT_WHILE( (IPW( HREG_EV_STAT ) & HREG_EV_ALLOC) == 0 );
+			IF_PROT_TIME( HCFASSERT(prot_cnt, IPW( HREG_EV_STAT ) ) /*NOP*/;)
+#if HCF_DMA
+			if ( ! ( ifbp->IFB_CntlOpt & USE_DMA ) )
+#endif // HCF_DMA
+			{
+				ifbp->IFB_RscInd = get_fid( ifbp );
+				HCFASSERT( ifbp->IFB_RscInd, 0 )
+				cmd_exe( ifbp, HCMD_ALLOC, 0 );
+				IF_PROT_TIME( if ( prot_cnt == 0 ) rc = HCF_ERR_TIME_OUT; )
+			}
+		}
+//#endif // ALLOC_15
+	}
+#endif // HCF_DL_ONLY
+	HCFASSERT( rc == HCF_SUCCESS, rc )
+	HCFLOGEXIT( HCF_TRACE_INIT )
+	return rc;
+} // init
+
+#if (HCF_DL_ONLY) == 0
+/************************************************************************************************************
+*
+*.SUBMODULE		void isr_info( IFBP ifbp )
+*.PURPOSE		handles link events.
+*
+*.ARGUMENTS
+*	ifbp		address of the Interface Block
+*
+*.RETURNS		N.A.
+*
+*.DESCRIPTION
+*
+*
+*.DIAGRAM
+*1:	First the FID number corresponding with the InfoEvent is determined.
+*	Note the complication of the zero-FID protection sub-scheme in DAWA.
+*	Next the L-field and the T-field are fetched into scratch buffer info.
+*2:	In case of tallies, the 16 bits Hermes values are accumulated in the IFB into 32 bits values. Info[0]
+*	is (expected to be) HCF_NIC_TAL_CNT + 1. The contraption "while ( info[0]-- >1 )" rather than
+*	"while ( --info[0] )" is used because it is dangerous to determine the length of the Value field by
+*	decrementing info[0]. As a result of a bug in some version of the F/W, info[0] may be 0, resulting
+*	in a very long loop in the pre-decrement logic.
+*4:	In case of a link status frame, the information is copied to the IFB field IFB_linkStat
+*6:	All other than Tallies (including "unknown" ones) are checked against the selection set by the MSF
+*	via CFG_RID_LOG. If a match is found or the selection set has the wild-card type (i.e non-NULL buffer
+*	pointer at the terminating zero-type), the frame is copied to the (type-specific) log buffer.
+*	Note that to accumulate tallies into IFB AND to log them or to log a frame when a specific match occures
+*	AND based on the wild-card selection, you have to call setup_bap again after the 1st copy.
+*
+*.ENDDOC				END DOCUMENTATION
+*
+************************************************************************************************************/
+HCF_STATIC void
+isr_info( IFBP ifbp )
+{
+hcf_16	info[2], fid;
+#if (HCF_EXT) & HCF_EXT_INFO_LOG
+RID_LOGP	ridp = ifbp->IFB_RIDLogp;	//NULL or pointer to array of RID_LOG structures (terminated by zero typ)
+#endif // HCF_EXT_INFO_LOG
+
+	HCFTRACE( ifbp, HCF_TRACE_ISR_INFO );																/* 1 */
+	fid = IPW( HREG_INFO_FID );
+	DAWA_ZERO_FID( HREG_INFO_FID )
+	if ( fid ) {
+		(void)setup_bap( ifbp, fid, 0, IO_IN );
+		get_frag( ifbp, (wci_bufp)info, 4 BE_PAR(2) );
+		HCFASSERT( info[0] <= HCF_MAX_LTV + 1, MERGE_2( info[1], info[0] ) )  //;? a smaller value makes more sense
+#if (HCF_TALLIES) & HCF_TALLIES_NIC		//Hermes tally support
+		if ( info[1] == CFG_TALLIES ) {
+hcf_32	*p;
+/*2*/		if ( info[0] > HCF_NIC_TAL_CNT ) {
+				info[0] = HCF_NIC_TAL_CNT + 1;
+			}
+			p = (hcf_32*)&ifbp->IFB_NIC_Tallies;
+			while ( info[0]-- >1 ) *p++ += IPW( HREG_DATA_1 );	//request may return zero length
+		}
+		else
+#endif // HCF_TALLIES_NIC
+		{
+/*4*/		if ( info[1] == CFG_LINK_STAT ) {
+				ifbp->IFB_LinkStat = IPW( HREG_DATA_1 );
+			}
+#if (HCF_EXT) & HCF_EXT_INFO_LOG
+/*6*/		while ( 1 ) {
+				if ( ridp->typ == 0 || ridp->typ == info[1] ) {
+					if ( ridp->bufp ) {
+						HCFASSERT( ridp->len >= 2, ridp->typ )
+						ridp->bufp[0] = min((hcf_16)(ridp->len - 1), info[0] ); 	//save L
+						ridp->bufp[1] = info[1];						//save T
+						get_frag( ifbp, (wci_bufp)&ridp->bufp[2], (ridp->bufp[0] - 1)*2 BE_PAR(0) );
+					}
+					break;
+				}
+				ridp++;
+			}
+#endif // HCF_EXT_INFO_LOG
+		}
+		HCFTRACE( ifbp, HCF_TRACE_ISR_INFO | HCF_TRACE_EXIT );
+	}
+	return;
+} // isr_info
+#endif // HCF_DL_ONLY
+
+//
+//
+// #endif // HCF_TALLIES_NIC
+// /*4*/	if ( info[1] == CFG_LINK_STAT ) {
+// 			ifbp->IFB_DSLinkStat = IPW( HREG_DATA_1 ) | CFG_LINK_STAT_CHANGE;	//corrupts BAP !! ;?
+// 			ifbp->IFB_LinkStat = ifbp->IFB_DSLinkStat & CFG_LINK_STAT_FW; //;? to be obsoleted
+// 			printk( "<4>linkstatus: %04x\n", ifbp->IFB_DSLinkStat );		//;?remove me 1 day
+// #if (HCF_SLEEP) & HCF_DDS
+// 			if ( ( ifbp->IFB_DSLinkStat & CFG_LINK_STAT_CONNECTED ) == 0 ) { 	//even values are disconnected etc.
+// 				ifbp->IFB_TickCnt = 0;				//start 2 second period (with 1 tick uncertanty)
+// 				printk( "<5>isr_info: AwaitConnection phase started, IFB_TickCnt = 0\n" );		//;?remove me 1 day
+// 			}
+// #endif // HCF_DDS
+// 		}
+// #if (HCF_EXT) & HCF_EXT_INFO_LOG
+// /*6*/	while ( 1 ) {
+// 			if ( ridp->typ == 0 || ridp->typ == info[1] ) {
+// 				if ( ridp->bufp ) {
+// 					HCFASSERT( ridp->len >= 2, ridp->typ )
+// 					(void)setup_bap( ifbp, fid, 2, IO_IN );			//restore BAP for tallies, linkstat and specific type followed by wild card
+// 					ridp->bufp[0] = min( ridp->len - 1, info[0] ); 	//save L
+// 					get_frag( ifbp, (wci_bufp)&ridp->bufp[1], ridp->bufp[0]*2 BE_PAR(0) );
+// 				}
+// 				break; //;?this break is no longer needed due to setup_bap but lets concentrate on DDS first
+// 			}
+// 			ridp++;
+// 		}
+// #endif // HCF_EXT_INFO_LOG
+// 	}
+// 	HCFTRACE( ifbp, HCF_TRACE_ISR_INFO | HCF_TRACE_EXIT );
+//
+//
+//
+//
+//	return;
+//} // isr_info
+//#endif // HCF_DL_ONLY
+
+
+/************************************************************************************************************
+*
+*.SUBMODULE		void mdd_assert( IFBP ifbp, unsigned int line_number, hcf_32 q )
+*.PURPOSE		filters assert on level and interfaces to the MSF supplied msf_assert routine.
+*
+*.ARGUMENTS
+*	ifbp		address of the Interface Block
+*	line_number	line number of the line which caused the assert
+*	q			qualifier, additional information which may give a clue about the problem
+*
+*.RETURNS		N.A.
+*
+*.DESCRIPTION
+*
+*
+*.DIAGRAM
+*
+*.NOTICE
+* mdd_assert has been through a turmoil, renaming hcf_assert to assert and hcf_assert again and supporting off
+* and on being called from the MSF level and other ( immature ) ModularDriverDevelopment modules like DHF and
+* MMD.
+ * !!!! The assert routine is not an hcf_..... routine in the sense that it may be called by the MSF,
+ *		however it is called from mmd.c and dhf.c, so it must be external.
+ *		To prevent namespace pollution it needs a prefix, to prevent that MSF programmers think that
+ *		they are allowed to call the assert logic, the prefix HCF can't be used, so MDD is selected!!!!
+ *
+* When called from the DHF module the line number is incremented by DHF_FILE_NAME_OFFSET and when called from
+* the MMD module by MMD_FILE_NAME_OFFSET.
+*
+*.ENDDOC				END DOCUMENTATION
+*
+************************************************************************************************************/
+#if HCF_ASSERT
+void
+mdd_assert( IFBP ifbp, unsigned int line_number, hcf_32 q )
+{
+hcf_16	run_time_flag = ifbp->IFB_AssertLvl;
+
+	if ( run_time_flag /* > ;?????? */ ) { //prevent recursive behavior, later to be extended to level filtering
+		ifbp->IFB_AssertQualifier = q;
+		ifbp->IFB_AssertLine = (hcf_16)line_number;
+#if (HCF_ASSERT) & ( HCF_ASSERT_LNK_MSF_RTN | HCF_ASSERT_RT_MSF_RTN )
+		if ( ifbp->IFB_AssertRtn ) {
+			ifbp->IFB_AssertRtn( line_number, ifbp->IFB_AssertTrace, q );
+		}
+#endif // HCF_ASSERT_LNK_MSF_RTN / HCF_ASSERT_RT_MSF_RTN
+#if (HCF_ASSERT) & HCF_ASSERT_SW_SUP
+		OPW( HREG_SW_2, line_number );
+		OPW( HREG_SW_2, ifbp->IFB_AssertTrace );
+		OPW( HREG_SW_2, (hcf_16)q );
+		OPW( HREG_SW_2, (hcf_16)(q >> 16 ) );
+#endif // HCF_ASSERT_SW_SUP
+
+#if (HCF_EXT) & HCF_EXT_MB && (HCF_ASSERT) & HCF_ASSERT_MB
+		ifbp->IFB_AssertLvl = 0;									// prevent recursive behavior
+		hcf_put_info( ifbp, (LTVP)&ifbp->IFB_AssertStrct );
+		ifbp->IFB_AssertLvl = run_time_flag;						// restore appropriate filter level
+#endif // HCF_EXT_MB / HCF_ASSERT_MB
+	}
+} // mdd_assert
+#endif // HCF_ASSERT
+
+
+/************************************************************************************************************
+*
+*.SUBMODULE		void put_frag( IFBP ifbp, wci_bufp bufp, int len BE_PAR( int word_len ) )
+*.PURPOSE		writes with 16/32 bit I/O via BAP1 port from Host memory to NIC RAM.
+*
+*.ARGUMENTS
+*	ifbp		address of the Interface Block
+*	bufp		(byte) address of buffer
+*	len			length in bytes of buffer specified by bufp
+*	word_len	Big Endian only: number of leading bytes to swap in pairs
+*
+*.RETURNS		N.A.
+*
+*.DESCRIPTION
+* process the single byte (if applicable) not yet written by the previous put_frag and copy len
+* (or len-1) bytes from bufp to NIC.
+*
+*
+*.DIAGRAM
+*
+*.NOTICE
+*	It turns out DOS ODI uses zero length fragments. The HCF code can cope with it, but as a consequence, no
+*	Assert on len is possible
+*
+*.ENDDOC				END DOCUMENTATION
+*
+************************************************************************************************************/
+HCF_STATIC void
+put_frag( IFBP ifbp, wci_bufp bufp, int len BE_PAR( int word_len ) )
+{
+hcf_io		io_port = ifbp->IFB_IOBase + HREG_DATA_1;	//BAP data register
+int			i;											//prevent side effects from macro
+hcf_16		j;
+	HCFASSERT( ((hcf_32)bufp & (HCF_ALIGN-1) ) == 0, (hcf_32)bufp )
+#if HCF_BIG_ENDIAN
+	HCFASSERT( word_len == 0 || word_len == 2 || word_len == 4, word_len )
+	HCFASSERT( word_len == 0 || ((hcf_32)bufp & 1 ) == 0, (hcf_32)bufp )
+	HCFASSERT( word_len <= len, MERGE_2( word_len, len ) )
+
+	if ( word_len ) {									//if there is anything to convert
+ 														//.  convert and write the 1st hcf_16
+		j = bufp[1] | bufp[0]<<8;
+		OUT_PORT_WORD( io_port, j );
+														//.  update pointer and counter accordingly
+		len -= 2;
+		bufp += 2;
+		if ( word_len > 1 ) {							//.  if there is to convert more than 1 word ( i.e 2 )
+ 														//.  .  convert and write the 2nd hcf_16
+			j = bufp[1] | bufp[0]<<8;	/*bufp is already incremented by 2*/
+			OUT_PORT_WORD( io_port, j );
+														//.  .  update pointer and counter accordingly
+			len -= 2;
+			bufp += 2;
+		}
+	}
+#endif // HCF_BIG_ENDIAN
+	i = len;
+	if ( i && ifbp->IFB_CarryOut ) {					//skip zero-length
+		j = ((*bufp)<<8) + ( ifbp->IFB_CarryOut & 0xFF );
+		OUT_PORT_WORD( io_port, j );
+		bufp++; i--;
+		ifbp->IFB_CarryOut = 0;
+	}
+#if (HCF_IO) & HCF_IO_32BITS
+	//skip zero-length I/O, single byte I/O and I/O not worthwhile (i.e. less than 6 bytes)for DW logic
+													//if buffer length >= 6 and 32 bits I/O support
+	if ( !(ifbp->IFB_CntlOpt & USE_16BIT) && i >= 6 ) {
+hcf_32 FAR	*p4; //prevent side effects from macro
+		if ( ( (hcf_32)bufp & 0x1 ) == 0 ) {			//.  if buffer at least word aligned
+			if ( (hcf_32)bufp & 0x2 ) {				//.  .  if buffer not double word aligned
+                                                 	//.  .  .  write a single word to get double word aligned
+				j = *(wci_recordp)bufp;		//just to help ease writing macros with embedded assembly
+				OUT_PORT_WORD( io_port, j );
+													//.  .  .  adjust buffer length and pointer accordingly
+				bufp += 2; i -= 2;
+			}
+													//.  .  write as many double word as possible
+			p4 = (hcf_32 FAR *)bufp;
+			j = (hcf_16)i/4;
+			OUT_PORT_STRING_32( io_port, p4, j );
+													//.  .  adjust buffer length and pointer accordingly
+			bufp += i & ~0x0003;
+			i &= 0x0003;
+		}
+	}
+#endif // HCF_IO_32BITS
+													//if no 32-bit support OR byte aligned OR 1 word left
+	if ( i ) {
+													//.  if odd number of bytes left
+		if ( i & 0x0001 ) {
+													//.  .  save left over byte (before bufp is corrupted) in carry, set carry flag
+			ifbp->IFB_CarryOut = (hcf_16)bufp[i-1] | 0x0100;	//note that i and bufp are always simultaneously modified, &bufp[i-1] is invariant
+		}
+													//.  write as many word as possible in "alignment safe" way
+		j = (hcf_16)i/2;
+		OUT_PORT_STRING_8_16( io_port, bufp, j );
+	}
+} // put_frag
+
+
+/************************************************************************************************************
+*
+*.SUBMODULE		void put_frag_finalize( IFBP ifbp )
+*.PURPOSE		cleanup after put_frag for trailing odd byte and MIC transfer to NIC.
+*
+*.ARGUMENTS
+*	ifbp		address of the Interface Block
+*
+*.RETURNS		N.A.
+*
+*.DESCRIPTION
+* finalize the MIC calculation with the padding pattern, output the last byte (if applicable)
+* of the message and the MIC to the TxFS
+*
+*
+*.DIAGRAM
+*2:	1 byte of the last put_frag may be still in IFB_CarryOut ( the put_frag carry holder ), so ........
+*	1 - 3 bytes of the last put_frag may be still in IFB_tx_32 ( the MIC engine carry holder ), so ........
+*	The call to the MIC calculation routine feeds these remaining bytes (if any) of put_frag and the
+*	just as many bytes of the padding as needed to the MIC calculation engine. Note that the "unneeded" pad
+*	bytes simply end up in the MIC engine carry holder and are never used.
+*8:	write the remainder of the MIC and possible some garbage to NIC RAM
+*	Note: i is always 4 (a loop-invariant of the while in point 2)
+*
+*.NOTICE
+*
+*.ENDDOC				END DOCUMENTATION
+*
+************************************************************************************************************/
+HCF_STATIC void
+put_frag_finalize( IFBP ifbp )
+{
+#if (HCF_TYPE) & HCF_TYPE_WPA
+	if ( ifbp->IFB_MICTxCarry != 0xFFFF) {		//if MIC calculation active
+		CALC_TX_MIC( mic_pad, 8);				//.  feed (up to 8 bytes of) virtual padding to MIC engine
+												//.  write (possibly) trailing byte + (most of) MIC
+		put_frag( ifbp, (wci_bufp)ifbp->IFB_MICTx, 8 BE_PAR(0) );
+	}
+#endif // HCF_TYPE_WPA
+	put_frag( ifbp, null_addr, 1 BE_PAR(0) );	//write (possibly) trailing data or MIC byte
+} // put_frag_finalize
+
+
+/************************************************************************************************************
+*
+*.SUBMODULE		int put_info( IFBP ifbp, LTVP ltvp )
+*.PURPOSE		support routine to handle the "basic" task of hcf_put_info to pass RIDs to the NIC.
+*
+*.ARGUMENTS
+*	ifbp		address of the Interface Block
+*	ltvp		address in NIC RAM where LVT-records are located
+*
+*.RETURNS
+*	HCF_SUCCESS
+*	>>put_frag
+*	>>cmd_wait
+*
+*.DESCRIPTION
+*
+*
+*.DIAGRAM
+*20: do not write RIDs to NICs which have incompatible Firmware
+*24: If the RID does not exist, the L-field is set to zero.
+*	Note that some RIDs can not be read, e.g. the pseudo RIDs for direct Hermes commands and CFG_DEFAULT_KEYS
+*28: If the RID is written successful, pass it to the NIC by means of an Access Write command
+*
+*.NOTICE
+*	The mechanism to HCF_ASSERT on invalid typ-codes in the LTV record is based on the following strategy:
+*	  -	some codes (e.g. CFG_REG_MB) are explicitly handled by the HCF which implies that these codes
+*		are valid. These codes are already consumed by hcf_put_info.
+*	  - all other codes are passed to the Hermes. Before the put action is executed, hcf_get_info is called
+*		with an LTV record with a value of 1 in	the L-field and the intended put action type in the Typ-code
+*		field. If the put action type is valid, it is also valid as a get action type code - except
+*		for CFG_DEFAULT_KEYS and CFG_ADD_TKIP_DEFAULT_KEY - so the HCF_ASSERT logic of hcf_get_info should
+*		not catch.
+*
+*.ENDDOC				END DOCUMENTATION
+*
+************************************************************************************************************/
+HCF_STATIC int
+put_info( IFBP ifbp, LTVP ltvp	)
+{
+
+int rc = HCF_SUCCESS;
+
+	HCFASSERT( ifbp->IFB_CardStat == 0, MERGE_2( ltvp->typ, ifbp->IFB_CardStat ) )
+	HCFASSERT( CFG_RID_CFG_MIN <= ltvp->typ && ltvp->typ <= CFG_RID_CFG_MAX, ltvp->typ )
+
+	if ( ifbp->IFB_CardStat == 0 &&																/* 20*/
+		 ( ( CFG_RID_CFG_MIN <= ltvp->typ    && ltvp->typ <= CFG_RID_CFG_MAX ) ||
+		   ( CFG_RID_ENG_MIN <= ltvp->typ /* && ltvp->typ <= 0xFFFF */       )     ) ) {
+#if HCF_ASSERT //FCC8, FCB0, FCB4, FCB6, FCB7, FCB8, FCC0, FCC4, FCBC, FCBD, FCBE, FCBF
+ {
+ hcf_16		t = ltvp->typ;
+ LTV_STRCT 	x = { 2, t, {0} };															/*24*/
+	hcf_get_info( ifbp, (LTVP)&x );
+	if ( x.len == 0 &&
+		 ( t != CFG_DEFAULT_KEYS && t != CFG_ADD_TKIP_DEFAULT_KEY && t != CFG_REMOVE_TKIP_DEFAULT_KEY &&
+		   t != CFG_ADD_TKIP_MAPPED_KEY && t != CFG_REMOVE_TKIP_MAPPED_KEY &&
+		   t != CFG_HANDOVER_ADDR && t != CFG_DISASSOCIATE_ADDR &&
+		   t != CFG_FCBC && t != CFG_FCBD && t != CFG_FCBE && t != CFG_FCBF &&
+		   t != CFG_DEAUTHENTICATE_ADDR
+		 )
+		) {
+		HCFASSERT( DO_ASSERT, ltvp->typ )
+		}
+ }
+#endif // HCF_ASSERT
+
+		rc = setup_bap( ifbp, ltvp->typ, 0, IO_OUT );
+		put_frag( ifbp, (wci_bufp)ltvp, 2*ltvp->len + 2 BE_PAR(2) );
+/*28*/	if ( rc == HCF_SUCCESS ) {
+			rc = cmd_exe( ifbp, HCMD_ACCESS + HCMD_ACCESS_WRITE, ltvp->typ );
+		}
+	}
+	return rc;
+} // put_info
+
+
+#if (HCF_DL_ONLY) == 0
+/************************************************************************************************************
+*
+*.SUBMODULE		int put_info_mb( IFBP ifbp, CFG_MB_INFO_STRCT FAR * ltvp )
+*.PURPOSE	 	accumulates a ( series of) buffers into a single Info block into the MailBox.
+*
+*.ARGUMENTS
+*	ifbp		address of the Interface Block
+*	ltvp		address of structure specifying the "type" and the fragments of the information to be synthesized
+*				as an LTV into the MailBox
+*
+*.RETURNS
+*
+*.DESCRIPTION
+* If the data does not fit (including no MailBox is available), the IFB_MBTally is incremented and an
+* error status is returned.
+* HCF_ASSERT does not catch.
+* Calling put_info_mb when their is no MailBox available, is considered a design error in the MSF.
+*
+* Note that there is always at least 1 word of unused space in the mail box.
+* As a consequence:
+* - no problem in pointer arithmetic (MB_RP == MB_WP means unambiguously mail box is completely empty
+* - There is always free space to write an L field with a value of zero after each MB_Info block.  This
+*   allows for an easy scan mechanism in the "get MB_Info block" logic.
+*
+*
+*.DIAGRAM
+*1:	Calculate L field of the MBIB, i.e. 1 for the T-field + the cumulative length of the fragments.
+*2:	The free space in the MailBox is calculated (2a: free part from Write Ptr to Read Ptr, 2b: free part
+*	turns out to wrap around) . If this space suffices to store the number of words reflected by len (T-field
+*	+ Value-field) plus the additional MailBox Info L-field + a trailing 0 to act as the L-field of a trailing
+*	dummy or empty LTV record, then a MailBox Info block is build in the MailBox consisting of
+*	  - the value len in the first word
+*	  - type in the second word
+*	  - a copy of the contents of the fragments in the second and higher word
+*
+*4:	Since put_info_mb() can more or less directly be called from the MSF level, the I/F must be robust
+*	against out-of-range variables. As failsafe coding, the MB update is skipped by changing tlen to 0 if
+*	len == 0; This will indirectly cause an assert as result of the violation of the next if clause.
+*6:	Check whether the free space in MailBox suffices (this covers the complete absence of the MailBox).
+*	Note that len is unsigned, so even MSF I/F violation works out O.K.
+*	The '2' in the expression "len+2" is used because 1 word is needed for L itself and 1 word is needed
+*	for the zero-sentinel
+*8:	update MailBox Info length report to MSF with "oldest" MB Info Block size. Be carefull here, if you get
+*	here before the MailBox is registered, you can't read from the buffer addressed by IFB_MBp (it is the
+*	Null buffer) so don't move this code till the end of this routine but keep it where there is garuanteed
+*	a buffer.
+*
+*.NOTICE
+*	boundary testing depends on the fact that IFB_MBSize is guaranteed to be zero if no MailBox is present,
+*	and to a lesser degree, that IFB_MBWp = IFB_MBRp = 0
+*
+*.ENDDOC				END DOCUMENTATION
+*
+************************************************************************************************************/
+#if (HCF_EXT) & HCF_EXT_MB
+
+HCF_STATIC int
+put_info_mb( IFBP ifbp, CFG_MB_INFO_STRCT FAR * ltvp )
+{
+
+int			rc = HCF_SUCCESS;
+hcf_16		i;						//work counter
+hcf_16		*dp;					//destination pointer (in MailBox)
+wci_recordp	sp;						//source pointer
+hcf_16		len;					//total length to copy to MailBox
+hcf_16		tlen;					//free length/working length/offset in WMP frame
+
+	if ( ifbp->IFB_MBp == NULL ) return rc;  //;?not sufficient
+	HCFASSERT( ifbp->IFB_MBp != NULL, 0 )					//!!!be careful, don't get into an endless recursion
+	HCFASSERT( ifbp->IFB_MBSize, 0 )
+
+	len = 1;																							/* 1 */
+	for ( i = 0; i < ltvp->frag_cnt; i++ ) {
+		len += ltvp->frag_buf[i].frag_len;
+	}
+	if ( ifbp->IFB_MBRp > ifbp->IFB_MBWp ) {
+		tlen = ifbp->IFB_MBRp - ifbp->IFB_MBWp;															/* 2a*/
+	} else {
+		if ( ifbp->IFB_MBRp == ifbp->IFB_MBWp ) {
+			ifbp->IFB_MBRp = ifbp->IFB_MBWp = 0;	// optimize Wrapping
+		}
+		tlen = ifbp->IFB_MBSize - ifbp->IFB_MBWp;														/* 2b*/
+		if ( ( tlen <= len + 2 ) && ( len + 2 < ifbp->IFB_MBRp ) ) {	//if trailing space is too small but
+																	//	 leading space is sufficiently large
+			ifbp->IFB_MBp[ifbp->IFB_MBWp] = 0xFFFF;					//flag dummy LTV to fill the trailing space
+			ifbp->IFB_MBWp = 0;										//reset WritePointer to begin of MailBox
+			tlen = ifbp->IFB_MBRp;									//get new available space size
+		}
+	}
+	dp = &ifbp->IFB_MBp[ifbp->IFB_MBWp];
+	if ( len == 0 ) {
+		tlen = 0; //;? what is this good for
+	}
+	if ( len + 2 >= tlen ){																				/* 6 */
+		//Do Not ASSERT, this is a normal condition
+		IF_TALLY( ifbp->IFB_HCF_Tallies.NoBufMB++; ) /*NOP to cover against analomies with empty compound*/;
+		rc = HCF_ERR_LEN;
+	} else {
+		*dp++ = len;									//write Len (= size of T+V in words to MB_Info block
+		*dp++ = ltvp->base_typ;							//write Type to MB_Info block
+		ifbp->IFB_MBWp += len + 1;						//update WritePointer of MailBox
+		for ( i = 0; i < ltvp->frag_cnt; i++ ) {				// process each of the fragments
+			sp = ltvp->frag_buf[i].frag_addr;
+			len = ltvp->frag_buf[i].frag_len;
+			while ( len-- ) *dp++ = *sp++;
+		}
+		ifbp->IFB_MBp[ifbp->IFB_MBWp] = 0;				//to assure get_info for CFG_MB_INFO stops
+		ifbp->IFB_MBInfoLen = ifbp->IFB_MBp[ifbp->IFB_MBRp];											/* 8 */
+	}
+	return rc;
+} // put_info_mb
+
+#endif // HCF_EXT_MB
+#endif // HCF_DL_ONLY
+
+
+/************************************************************************************************************
+*
+*.SUBMODULE		int setup_bap( IFBP ifbp, hcf_16 fid, int offset, int type )
+*.PURPOSE		set up data access to NIC RAM via BAP_1.
+*
+*.ARGUMENTS
+*	ifbp			address of I/F Block
+*	fid				FID/RID
+*	offset			!!even!! offset in FID/RID
+*	type			IO_IN, IO_OUT
+*
+*.RETURNS
+*	HCF_SUCCESS					O.K
+*	HCF_ERR_NO_NIC				card is removed
+*	HCF_ERR_DEFUNCT_TIME_OUT	Fatal malfunction detected
+*	HCF_ERR_DEFUNCT_.....		if and only if IFB_DefunctStat <> 0
+*
+*.DESCRIPTION
+*
+* A non-zero return status indicates:
+* - the NIC is considered nonoperational, e.g. due to a time-out of some Hermes activity in the past
+* - BAP_1 could not properly be initialized
+* - the card is removed before completion of the data transfer
+* In all other cases, a zero is returned.
+* BAP Initialization failure indicates an H/W error which is very likely to signal complete H/W failure.
+* Once a BAP Initialization failure has occurred all subsequent interactions with the Hermes will return a
+* "defunct" status till the Hermes is re-initialized by means of an hcf_connect.
+*
+* A BAP is a set of registers (Offset, Select and Data) offering read/write access to a particular FID or
+* RID. This access is based on a auto-increment feature.
+* There are two BAPs but these days the HCF uses only BAP_1 and leaves BAP_0 to the PCI Busmastering H/W.
+*
+* The BAP-mechanism is based on the Busy bit in the Offset register (see the Hermes definition). The waiting
+* for Busy must occur between writing the Offset register and accessing the Data register. The
+* implementation to wait for the Busy bit drop after each write to the Offset register, implies that the
+* requirement that the Busy bit is low  before the Select register is written, is automatically met.
+* BAP-setup may be time consuming (e.g. 380 usec for large offsets occurs frequently). The wait for Busy bit
+* drop is protected by a loop counter, which is initialized with IFB_TickIni, which is calibrated in init.
+*
+* The NIC I/F is optimized for word transfer and can only handle word transfer at a word boundary in NIC
+* RAM. The intended solution for transfer of a single byte has multiple H/W flaws. There have been different
+* S/W Workaround strategies. RID access is hcf_16 based by "nature", so no byte access problems.  For Tx/Rx
+* FID access,  the byte logic became obsolete by absorbing it in the double word oriented nature of the MIC
+* feature.
+*
+*
+*.DIAGRAM
+*
+*2:	the test on rc checks whether the HCF went into "defunct" mode ( e.g. BAP initialization or a call to
+*	cmd_wait did ever fail).
+*4:	the select register and offset register are set
+*	the offset register is monitored till a successful condition (no busy bit) is detected or till the
+*	(calibrated) protection counter expires
+*	If the counter expires, this is reflected in IFB_DefunctStat, so all subsequent calls to setup_bap fail
+*	immediately ( see 2)
+*6:	initialization of the carry as used by pet/get_frag
+*8:	HREG_OFFSET_ERR is ignored as error because:
+*	 a: the Hermes is robust against it
+*	 b: it is not known what causes it (probably a bug), hence no strategy can be specified which level is
+*		to handle this error in which way. In the past, it could be induced by the MSF level, e.g. by calling
+*		hcf_rcv_msg while there was no Rx-FID available. Since this is an MSF-error which is caught by ASSERT,
+*		there is no run-time action required by the HCF.
+*	Lumping the Offset error in with the Busy bit error, as has been done in the past turns out to be a
+*	disaster or a life saver, just depending on what the cause of the error is. Since no prediction can be
+*	done about the future, it is "felt" to be the best strategy to ignore this error. One day the code was
+*	accompanied by the following comment:
+*	//	ignore HREG_OFFSET_ERR, someone, supposedly the MSF programmer ;) made a bug. Since we don't know
+*	//	what is going on, we might as well go on - under management pressure - by ignoring it
+*
+*.ENDDOC                          END DOCUMENTATION
+*
+************************************************************************************************************/
+HCF_STATIC int
+setup_bap( IFBP ifbp, hcf_16 fid, int offset, int type )
+{
+PROT_CNT_INI
+int	rc;
+
+	HCFTRACE( ifbp, HCF_TRACE_STRIO );
+	if ( ( rc = ifbp->IFB_DefunctStat ) == HCF_SUCCESS ) {										/*2*/
+		OPW( HREG_SELECT_1, fid );																/*4*/
+		OPW( HREG_OFFSET_1, offset );
+		if ( type == IO_IN ) {
+			ifbp->IFB_CarryIn = 0;
+		}
+		else ifbp->IFB_CarryOut = 0;
+		HCF_WAIT_WHILE( IPW( HREG_OFFSET_1) & HCMD_BUSY );
+		HCFASSERT( !( IPW( HREG_OFFSET_1) & HREG_OFFSET_ERR ), MERGE_2( fid, offset ) )			/*8*/
+		if ( prot_cnt == 0 ) {
+			HCFASSERT( DO_ASSERT, MERGE_2( fid, offset ) )
+			rc = ifbp->IFB_DefunctStat = HCF_ERR_DEFUNCT_TIME_OUT;
+			ifbp->IFB_CardStat |= CARD_STAT_DEFUNCT;
+		}
+	}
+	HCFTRACE( ifbp, HCF_TRACE_STRIO | HCF_TRACE_EXIT );
+	return rc;
+} // setup_bap
+
diff --git a/drivers/staging/wlags49_h2/hcf.h b/drivers/staging/wlags49_h2/hcf.h
new file mode 100644
index 000000000000..2cd573944cdc
--- /dev/null
+++ b/drivers/staging/wlags49_h2/hcf.h
@@ -0,0 +1,405 @@
+
+//   vim:tw=110:ts=4:
+#ifndef HCF_H
+#define HCF_H 1
+
+/************************************************************************************************************
+*
+* FILE	 : hcf.h
+*
+* DATE   : $Date: 2004/08/05 11:47:10 $   $Revision: 1.7 $
+* Original: 2004/05/19 07:26:01    Revision: 1.56      Tag: hcf7_t20040602_01
+* Original: 2004/05/12 08:47:23    Revision: 1.53      Tag: hcf7_t7_20040513_01
+* Original: 2004/04/15 09:24:42    Revision: 1.46      Tag: hcf7_t7_20040415_01
+* Original: 2004/04/08 15:18:16    Revision: 1.45      Tag: t7_20040413_01
+* Original: 2004/04/01 15:32:55    Revision: 1.43      Tag: t7_20040401_01
+* Original: 2004/03/10 15:39:28    Revision: 1.39      Tag: t20040310_01
+* Original: 2004/03/04 11:03:38    Revision: 1.37      Tag: t20040304_01
+* Original: 2004/03/02 14:51:21    Revision: 1.35      Tag: t20040302_03
+* Original: 2004/02/24 13:00:28    Revision: 1.28      Tag: t20040224_01
+* Original: 2004/02/09 14:50:14    Revision: 1.26      Tag: t20040219_01
+*
+* AUTHOR : Nico Valster
+*
+* SPECIFICATION: ..........
+*
+* DESC   : Definitions and Prototypes for MSF as well as HCF sources
+*
+*		   Customizable via HCFCFG.H
+*
+*
+**************************************************************************************************************
+
+**************************************************************************************************************
+*
+*
+* SOFTWARE LICENSE
+*
+* This software is provided subject to the following terms and conditions,
+* which you should read carefully before using the software.  Using this
+* software indicates your acceptance of these terms and conditions.  If you do
+* not agree with these terms and conditions, do not use the software.
+*
+* COPYRIGHT © 1994 - 1995	by AT&T.				All Rights Reserved
+* COPYRIGHT © 1996 - 2000 by Lucent Technologies.	All Rights Reserved
+* COPYRIGHT © 2001 - 2004	by Agere Systems Inc.	All Rights Reserved
+* All rights reserved.
+*
+* Redistribution and use in source or binary forms, with or without
+* modifications, are permitted provided that the following conditions are met:
+*
+* . Redistributions of source code must retain the above copyright notice, this
+*    list of conditions and the following Disclaimer as comments in the code as
+*    well as in the documentation and/or other materials provided with the
+*    distribution.
+*
+* . Redistributions in binary form must reproduce the above copyright notice,
+*    this list of conditions and the following Disclaimer in the documentation
+*    and/or other materials provided with the distribution.
+*
+* . Neither the name of Agere Systems Inc. nor the names of the contributors
+*    may be used to endorse or promote products derived from this software
+*    without specific prior written permission.
+*
+* Disclaimer
+*
+* THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
+* INCLUDING, BUT NOT LIMITED TO, INFRINGEMENT AND THE IMPLIED WARRANTIES OF
+* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  ANY
+* USE, MODIFICATION OR DISTRIBUTION OF THIS SOFTWARE IS SOLELY AT THE USERS OWN
+* RISK. IN NO EVENT SHALL AGERE SYSTEMS INC. OR CONTRIBUTORS BE LIABLE FOR ANY
+* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+* ON ANY THEORY OF LIABILITY, INCLUDING, BUT NOT LIMITED TO, CONTRACT, STRICT
+* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+* OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+* DAMAGE.
+*
+*
+*************************************************************************************************************/
+
+
+#include "hcfcfg.h"	// System Constants to be defined by the MSF-programmer to tailor the HCF
+#include "mdd.h"	// Include file common for HCF, MSF
+
+
+/************************************************************************************************/
+/**************************************  MACROS  ************************************************/
+/************************************************************************************************/
+
+#define LOF(x) 			(sizeof(x)/sizeof(hcf_16)-1)
+
+/*	Endianess
+ *	Little Endian (a.k.a. Intel), least significant byte first
+ *	Big Endian (a.k.a. Motorola), most significant byte first
+ *
+ * The following macros are supplied
+ *  o CNV_LITTLE_TO_SHORT(w)			interprets the 16-bits input value as Little Endian, returns an hcf_16
+ * 	o CNV_BIG_TO_SHORT(w)				interprets the 16-bits input value as Big Endian, returns an hcf_16
+ *
+ */
+
+/* To increase portability, use unsigned char and unsigned char * when accessing parts of larger
+ * types to convert their Endianess
+ */
+
+#define CNV_END_SHORT(w)  (hcf_16)( ((hcf_16)(w) & 0x00FF) << 8 | ((hcf_16)(w) & 0xFF00) >> 8 )
+#define CNV_END_LONG(dw)  (hcf_32)( (dw >> 24) | ((dw >> 8) & 0xff00) | ((dw << 8) & 0xff0000) | (dw << 24) )
+
+#if HCF_BIG_ENDIAN
+//******************************************** B I G   E N D I A N *******************************************
+#define CNV_LITTLE_TO_SHORT(w)	CNV_END_SHORT(w)	//    endianess conversion needed
+#define CNV_BIG_TO_SHORT(w)		(w)				// no endianess conversion needed
+#define CNV_LITTLE_TO_LONG(dw)	CNV_END_LONG(dw)
+#define CNV_LONG_TO_LITTLE(dw)	CNV_END_LONG(dw)
+#else
+//****************************************** L I T T L E   E N D I A N ****************************************
+#define CNV_LITTLE_TO_SHORT(w) 	(w)				// no endianess conversion needed
+#define CNV_BIG_TO_SHORT(w)		CNV_END_SHORT(w)	//    endianess conversion needed
+#define CNV_LITTLE_TO_LONG(dw)	(dw)
+#define CNV_LONG_TO_LITTLE(dw)	(dw)
+
+#if defined HCF_ALIGN && HCF_ALIGN > 1
+#define CNV_SHORTP_TO_LITTLE(pw)	((hcf_16)(*(hcf_8 *)pw)) 			| ((hcf_16)(*((hcf_8 *)pw+1)) << 8)
+#define CNV_LONGP_TO_LITTLE(pdw)	((hcf_32)(*(hcf_8 *)pdw)) 			| ((hcf_32)(*((hcf_8 *)pdw+1)) << 8) 	| \
+									((hcf_32)(*((hcf_8 *)pdw+2)) << 16) | ((hcf_32)(*((hcf_8 *)pdw+3)) << 24)
+#else
+#define CNV_LONGP_TO_LITTLE(pdw)	(*(hcf_32 *)pdw)
+#define CNV_SHORTP_TO_LITTLE(pw)	(*(hcf_16 *)pw)
+#endif
+
+#endif // HCF_BIG_ENDIAN
+
+// conversion macros which can be expressed in other macros
+#define CNV_SHORT_TO_LITTLE(w)	CNV_LITTLE_TO_SHORT(w)
+#define CNV_SHORT_TO_BIG(w)		CNV_BIG_TO_SHORT(w)
+
+/************************************************************************************************/
+/**************************************  END OF MACROS  *****************************************/
+/************************************************************************************************/
+
+/***********************************************************************************************************/
+/*****************                                                  ****************************************/
+/***********************************************************************************************************/
+
+// offsets Transmit/Receive Frame Structure
+#define HFS_STAT				0x0000
+#define HFS_SWSUP				0x0006					//SW Support
+#define HFS_Q_INFO				0x0006					//Signal/Silence level
+#define HFS_RATE				0x0008					//RxFlow/Rate
+#define 	HFS_STAT_ERR		RX_STAT_ERR				//link "natural" HCF name to "natural" MSF name
+#define HFS_TX_CNTL				0x0036
+														// H-I     H-II
+#define HFS_DAT_LEN				(HFS_ADDR_DEST - 2)		// 0x002C  0x0038
+#define HFS_ADDR_DEST			0x003A					// 0x002E  0x003A
+#define HFS_ADDR_SRC			(HFS_ADDR_DEST + 6)		// 0x0034  0x0040
+#define HFS_LEN					(HFS_ADDR_SRC  + 6)		// 0x003A  0x0046
+#define HFS_DAT					(HFS_LEN       + 2)		// 0x003C  0x0048
+#define HFS_TYPE				(HFS_DAT       + 6)		// 0x0042  0x004E
+
+
+//=============================  D E S C R I P T O R   S T R U C T U R E  ==============================
+//;?MDD.H stuff ;?
+
+#if HCF_BIG_ENDIAN
+#define DESC_STRCT_CNT		0
+#define DESC_STRCT_SIZE		1
+#else
+#define DESC_STRCT_CNT		1
+#define DESC_STRCT_SIZE		0
+#endif // HCF_BIG_ENDIAN
+
+#define	BUF_CNT				buf_dim[DESC_STRCT_CNT]
+#define	BUF_SIZE			buf_dim[DESC_STRCT_SIZE]
+
+typedef struct DESC_STRCT {
+	hcf_16					buf_dim[2];
+	hcf_32					buf_phys_addr;
+	hcf_32					next_desc_phys_addr;	// physical address of next descriptor
+	hcf_32					desc_phys_addr;			// physical address of this descriptor
+	struct DESC_STRCT 		*next_desc_addr;
+	hcf_8	FAR				*buf_addr;
+#if (HCF_EXT) & HCF_EXT_DESC_STRCT
+	void FAR			   *DESC_MSFSup;			// pointer for arbitrary use by the MSF
+#endif // HCF_DESC_STRCT_EXT
+} DESC_STRCT;
+
+#define HCF_DASA_SIZE			12							//size in bytes for DA/SA
+
+#define DESC_CNT_MASK 			0x0FFF
+
+#define GET_BUF_SIZE(descp)       ((descp)->BUF_SIZE)
+#define GET_BUF_CNT(descp)        ((descp)->BUF_CNT)
+#define SET_BUF_SIZE(descp, size) (descp)->BUF_SIZE = size;
+#define SET_BUF_CNT(descp, count) (descp)->BUF_CNT = count;
+
+//=========================================  T A L L I E S  ===================================================
+
+typedef struct  {  //Hermes Tallies (IFB substructure)
+  hcf_32	TxUnicastFrames;
+  hcf_32	TxMulticastFrames;
+  hcf_32	TxFragments;
+  hcf_32	TxUnicastOctets;
+  hcf_32	TxMulticastOctets;
+  hcf_32	TxDeferredTransmissions;
+  hcf_32	TxSingleRetryFrames;
+  hcf_32	TxMultipleRetryFrames;
+  hcf_32	TxRetryLimitExceeded;
+  hcf_32	TxDiscards;
+  hcf_32	RxUnicastFrames;
+  hcf_32	RxMulticastFrames;
+  hcf_32	RxFragments;
+  hcf_32	RxUnicastOctets;
+  hcf_32	RxMulticastOctets;
+  hcf_32	RxFCSErrors;
+  hcf_32	RxDiscardsNoBuffer;
+  hcf_32	TxDiscardsWrongSA;
+  hcf_32	RxWEPUndecryptable;
+  hcf_32	RxMsgInMsgFragments;
+  hcf_32	RxMsgInBadMsgFragments;
+  hcf_32	RxDiscardsWEPICVError;
+  hcf_32	RxDiscardsWEPExcluded;
+#if (HCF_EXT) & HCF_EXT_TALLIES_FW
+  hcf_32	TalliesExtra[32];
+#endif // HCF_EXT_TALLIES_FW
+} CFG_HERMES_TALLIES_STRCT;
+
+typedef struct  {  //HCF Tallies (IFB substructure)
+  hcf_32	NoBufInfo;  				//No buffer available for unsolicited Notify frame
+  hcf_32	NoBufMB;					//No space available in MailBox
+  hcf_32	MiscErr;					/* Command errors
+  										 *  - time out on completion synchronous part Hermes Command
+  										 *  - completed Hermes Command doesn't match original command
+  										 *  - status of completed Hermes Command contains error bits
+  										 */
+#if (HCF_EXT) & HCF_EXT_TALLIES_FW
+  hcf_32	EngCnt[8];
+#endif // HCF_EXT_TALLIES_FW
+} CFG_HCF_TALLIES_STRCT;
+
+//Note this way to define ..._TAL_CNT implies that all tallies must keep the same (hcf_32) size
+#if (HCF_TALLIES) & ( HCF_TALLIES_NIC | HCF_TALLIES_HCF )
+#if (HCF_TALLIES) & HCF_TALLIES_NIC	//Hermes tally support
+#define		HCF_NIC_TAL_CNT	(sizeof(CFG_HERMES_TALLIES_STRCT)/ sizeof(hcf_32))
+#else
+#define		HCF_NIC_TAL_CNT	0
+#endif // HCF_TALLIES
+#if (HCF_TALLIES) & HCF_TALLIES_HCF	//HCF tally support
+#define		HCF_HCF_TAL_CNT	(sizeof(CFG_HCF_TALLIES_STRCT)   / sizeof(hcf_32))
+#else
+#define		HCF_HCF_TAL_CNT	0
+#endif // HCF_TALLIES
+#define HCF_TOT_TAL_CNT ( HCF_NIC_TAL_CNT + HCF_NIC_TAL_CNT )
+#endif // HCF_TALLIES_NIC / HCF_TALLIES_HCF
+
+
+/***********************************************************************************************************/
+/********************************** I N T E R F A C E   B L O C K ******************************************/
+/***********************************************************************************************************/
+
+#define IFB_VERSION 0x0E	 			// initially 0, to be incremented by every IFB layout change
+
+typedef struct  {
+  hcf_io		IFB_IOBase;				// I/O address of Hermes chip as passed by MSF at hcf_connect call
+  hcf_16		IFB_IORange;			// I/O Range used by Hermes chip
+  hcf_16		IFB_DLMode;				// Download Mode state
+  hcf_16		IFB_Cmd;				// cmd in progress flag, to be ack-ed before next cmd can be issued
+  hcf_16		IFB_RxFID;				// FID of "current" RxFS (non-DMA mode)
+//;?#if tx_delay option
+  hcf_16		IFB_TxFID;				// fid storage during "delayed" send
+//;?#endif tx_delay option
+  hcf_16		IFB_RxLen;				//
+  hcf_16		IFB_DefunctStat;		// BAP initialization or Cmd Completion failed
+  hcf_16		IFB_ErrCmd;				// contents Status reg when error bits and/or mismatch in cmd_wait
+  hcf_16		IFB_ErrQualifier;		// contents Resp0  reg when error bits and/or mismatch in cmd_wait
+  hcf_16		IFB_lal;				// LookAhead Length
+  wci_bufp		IFB_lap;				// LookAhead Buffer pointer
+  hcf_16		IFB_LinkStat;			// Link Status
+  hcf_16		IFB_DSLinkStat;			// Link Status, new strategy introduced for DeepSleep
+  hcf_16		IFB_CarryIn;			// carry and carry-flag to move 1 byte from one get_frag to the next
+  hcf_16		IFB_CarryOut;			// carry and carry-flag to move 1 byte from one put_frag to the next
+  hcf_16		IFB_Version;			// IFB_VERSION, incremented by every SIGNIFICANT IFB layout change
+  hcf_16		IFB_CardStat;			// NIC error / F/W incompatibility status
+  hcf_16  		IFB_RscInd;				// non-DMA: TxFID available, DMA: always 1
+  hcf_16		IFB_CntlOpt;			// flags: 32 bits I/O, DMA available, DMA enabled
+  hcf_16		IFB_BusType;			// BusType, derived via CFG_NIC_BUS_TYPE
+  CFG_FW_IDENTITY_STRCT	 IFB_FWIdentity; /* keep FWIdentity/Sup and PRIIdentity/Sup in sequence
+										  * because of the (dumb) copy in init() */
+#if defined MSF_COMPONENT_ID
+  CFG_SUP_RANGE_STRCT	 IFB_FWSup;
+  CFG_PRI_IDENTITY_STRCT IFB_PRIIdentity;
+  CFG_SUP_RANGE_STRCT	 IFB_PRISup;
+  CFG_SUP_RANGE_STRCT	 IFB_HSISup;
+#endif // MSF_COMPONENT_ID
+#if (HCF_EXT) & HCF_EXT_INFO_LOG
+  RID_LOGP		IFB_RIDLogp;			// pointer to RID_LOG structure
+#endif // HCF_EXT_INFO_LOG
+#if HCF_PROT_TIME
+  hcf_32	 	IFB_TickIni;			// initialization of S/W counter based protection loop
+#endif // HCF_PROT_TIME
+#if (HCF_EXT) & HCF_EXT_INT_TICK
+  int			IFB_TickCnt;			// Hermes Timer Tick Counter
+#endif // HCF_EXT_INT_TICK
+#if (HCF_EXT) & HCF_EXT_MB
+  hcf_16 	   *IFB_MBp;				// pointer to the MailBox
+  hcf_16		IFB_MBSize;				// size of the MailBox
+  hcf_16		IFB_MBWp;				// zero-based write index into the MailBox
+  hcf_16		IFB_MBRp;				// zero-based read  index into the MailBox
+  hcf_16		IFB_MBInfoLen;			// contents of L-field of the oldest available MailBoxInfoBlock
+#endif // HCF_EXT_MB
+#if (HCF_TYPE) & HCF_TYPE_WPA
+  hcf_16		IFB_MICTxCntl;			// MIC bit and Key index in TxControl field of TxFS
+  hcf_32		IFB_MICTxKey[2];		// calculating key
+  hcf_32		IFB_MICTx[2];   	  	// Tx MIC calculation Engine state
+  hcf_16		IFB_MICTxCarry;			// temp length, carries over from one Tx fragment to another
+  hcf_16		IFB_MICRxCarry;			// temp length, carries over from one Rx fragment to another
+  hcf_32		IFB_MICRxKey[4*2];		// 4 checking keys
+  hcf_32		IFB_MICRx[2]; 	 		// Rx MIC calculation Engine state
+#endif // HCF_TYPE_WPA
+#if HCF_ASSERT
+#if (HCF_ASSERT) & HCF_ASSERT_MB
+  CFG_MB_INFO_RANGE1_STRCT	IFB_AssertStrct; // Add some complication to the HCF as prize for the new MSF I/F
+#endif // HCF_ASSERT_MB
+  										// target of above IFB_AssertStrct
+  hcf_16		IFB_AssertLine;			//  - line number ( + encoded module name )
+  hcf_16		IFB_AssertTrace;		//  - bit based trace of all hcf_.... invocations
+  hcf_32		IFB_AssertQualifier;	//  - qualifier
+  hcf_16		IFB_AssertLvl;			// Assert Filtering, Not yet implemented
+  hcf_16		IFB_AssertWhere;		// Where parameter of the Assert macro
+#if (HCF_ASSERT) & ( HCF_ASSERT_LNK_MSF_RTN | HCF_ASSERT_RT_MSF_RTN )
+  MSF_ASSERT_RTNP	IFB_AssertRtn;		// MSF Assert Call back routine (inspired by GEF, DrDobbs Nov 1998 )
+#endif // HCF_ASSERT_LNK_MSF_RTN
+#if (HCF_ASSERT) & HCF_ASSERT_PRINTF	// engineering facilty intended as F/W debugging aid
+   hcf_16       IFB_DbgPrintF_Cnt;
+   CFG_FW_PRINTF_BUFFER_LOCATION_STRCT IFB_FwPfBuff;
+#endif // HCF_ASSERT_PRINTF
+#endif // HCF_ASSERT
+#if ! defined HCF_INT_OFF
+  hcf_16 volatile IFB_IntOffCnt;		// 0xFFFF based HCF_ACT_INT_OFF nesting counter, DeepSleep flag
+#endif // HCF_INT_OFF
+#if (HCF_TYPE) & HCF_TYPE_CCX
+  hcf_16         IFB_CKIPStat;			// CKIP Status flag
+#endif // HCF_TYPE_CCX
+#if (HCF_TALLIES) & ( HCF_TALLIES_NIC | HCF_TALLIES_HCF )	//Hermes and/or HCF tally support
+  hcf_32		IFB_Silly_you_should_align;	//;?
+  hcf_16		IFB_TallyLen;			// Tally length (to build an LTV)
+  hcf_16		IFB_TallyTyp;			// Tally Type (to build an LTV)
+#endif // HCF_TALLIES_NIC / HCF_TALLIES_HCF
+#if (HCF_TALLIES) & HCF_TALLIES_NIC		//Hermes tally support
+  CFG_HERMES_TALLIES_STRCT	IFB_NIC_Tallies;
+#endif // HCF_TALLIES_NIC
+#if (HCF_TALLIES) & HCF_TALLIES_HCF		//HCF tally support
+  CFG_HCF_TALLIES_STRCT		IFB_HCF_Tallies;
+#endif // HCF_TALLIES_HCF
+#if HCF_DMA
+  //used for a pool of destination_address descriptor/buffers, used during tx encapsulation points to the
+  //first/last descriptor in the descriptor chain, so we can easily remove and append a packet.
+  DESC_STRCT	*IFB_FirstDesc[2];
+  DESC_STRCT	*IFB_LastDesc[2];
+  DESC_STRCT	*IFB_ConfinedDesc[2];	// pointers to descriptor used for host reclaim purposes.
+  hcf_16		IFB_DmaPackets;			// HREG_EV_[TX/RX]DMA_DONE flags, reports DMA Frame availability to MSF
+#endif // HCF_DMA
+#if (HCF_EXT) & HCF_EXT_INT_TX_EX
+  hcf_16		IFB_TxFsStat;			// Tx message monitoring
+  hcf_16		IFB_TxFsGap[2];			//;?make this robust
+  hcf_16		IFB_TxFsSwSup;
+#endif // HCF_EXT_INT_TX_EX
+  hcf_16		IFB_Magic;				/* "Magic" signature, to help the debugger interpret a memory dump
+										 * also the last field cleared at hcf_connect
+										 */
+#if (HCF_EXT) & HCF_EXT_IFB_STRCT		// for usage by the MSF
+  void FAR	   *IFB_MSFSup;				// pointer for arbitrary use by the MSF
+#endif // HCF_EXT_IFB_STRCT_EXT
+} IFB_STRCT;
+
+typedef IFB_STRCT*	IFBP;
+
+
+/***********************************************************************************************************/
+/**********************   W C I    F U N C T I O N S    P R O T O T Y P E S   ******************************/
+/***********************************************************************************************************/
+
+EXTERN_C int		 hcf_action			(IFBP ifbp, hcf_16 cmd );
+EXTERN_C int		 hcf_connect		(IFBP ifbp, hcf_io io_base );
+#if (HCF_ENCAP) & HCF_ENC_SUP
+EXTERN_C hcf_8 		 hcf_encap			(wci_bufp type );
+#endif // HCF_ENC_SUP
+EXTERN_C int		 hcf_get_info		(IFBP ifbp, LTVP ltvp );
+EXTERN_C int		 hcf_service_nic	(IFBP ifbp, wci_bufp bufp, unsigned int len );
+EXTERN_C int		 hcf_cntl			(IFBP ifbp, hcf_16 cmd );
+EXTERN_C int		 hcf_put_info		(IFBP ifbp, LTVP ltvp );
+EXTERN_C int		 hcf_rcv_msg		(IFBP ifbp, DESC_STRCT *descp, unsigned int offset );
+EXTERN_C int		 hcf_send_msg       (IFBP ifbp, DESC_STRCT *dp, hcf_16 tx_cntl );
+#if HCF_DMA
+EXTERN_C void		 hcf_dma_tx_put 	(IFBP ifbp, DESC_STRCT *d, hcf_16 tx_cntl );
+EXTERN_C DESC_STRCT* hcf_dma_tx_get		(IFBP ifbp );
+EXTERN_C DESC_STRCT* hcf_dma_rx_get		(IFBP ifbp );
+EXTERN_C void		 hcf_dma_rx_put		(IFBP ifbp, DESC_STRCT *d );
+#endif // HCF_DMA
+#if (HCF_ASSERT) & HCF_ASSERT_LNK_MSF_RTN
+EXTERN_C void		 msf_assert	 		(unsigned int line_number, hcf_16 trace, hcf_32 qual );
+#endif // HCF_ASSERT_LNK_MSF_RTN
+
+#endif  // HCF_H
+
diff --git a/drivers/staging/wlags49_h2/hcfcfg.h b/drivers/staging/wlags49_h2/hcfcfg.h
new file mode 100644
index 000000000000..83475b1060a1
--- /dev/null
+++ b/drivers/staging/wlags49_h2/hcfcfg.h
@@ -0,0 +1,2344 @@
+
+//   vim:tw=110:ts=4:
+#ifndef HCFCFG_H
+#define HCFCFG_H 1
+
+/*************************************************************************************************************
+*
+* FILE	 : hcfcfg.tpl // hcfcfg.h
+*
+* DATE   : $Date: 2004/08/05 11:47:10 $   $Revision: 1.6 $
+* Original: 2004/04/08 15:18:16    Revision: 1.40      Tag: t20040408_01
+* Original: 2004/04/01 15:32:55    Revision: 1.38      Tag: t7_20040401_01
+* Original: 2004/03/10 15:39:28    Revision: 1.34      Tag: t20040310_01
+* Original: 2004/03/03 14:10:12    Revision: 1.32      Tag: t20040304_01
+* Original: 2004/03/02 09:27:12    Revision: 1.30      Tag: t20040302_03
+* Original: 2004/02/24 13:00:28    Revision: 1.25      Tag: t20040224_01
+* Original: 2004/02/18 17:13:57    Revision: 1.23      Tag: t20040219_01
+*
+* AUTHOR : Nico Valster
+*
+* DESC   : HCF Customization Macros
+* hcfcfg.tpl list all #defines which must be specified to:
+*   adjust the HCF functions defined in HCF.C to the characteristics of a specific environment
+*		o maximum sizes for messages
+*		o Endianess
+*	Compiler specific macros
+*		o port I/O macros
+*		o type definitions
+*
+* By copying HCFCFG.TPL to HCFCFG.H and -if needed- modifying the #defines the WCI functionality can be
+* tailored
+*
+* Supported environments:
+* WVLAN_41	Miniport								NDIS 3.1
+* WVLAN_42	Packet									Microsoft Visual C 1.5
+* WVLAN_43	16 bits DOS ODI							Microsoft Visual C 1.5
+* WVLAN_44	32 bits ODI (__NETWARE_386__)			WATCOM
+* WVLAN_45	MAC_OS									MPW?, Symantec?
+* WVLAN_46	Windows CE (_WIN32_WCE)					Microsoft ?
+* WVLAN_47	LINUX  (__LINUX__)						GCC, discarded, based on GPL'ed HCF-light
+* WVLAN_48	Miniport								NDIS 5
+* WVLAN_49	LINUX  (__LINUX__)						GCC, originally based on pre-compiled HCF_library
+* 													migrated to use the HCF sources when Lucent Technologies
+* 													brought the HCF module under GPL
+* WVLAN_51	Miniport USB							NDIS 5
+* WVLAN_52	Miniport								NDIS 4
+* WVLAN_53	VxWorks END Station driver
+* WVLAN_54	VxWorks END Access Point driver
+* WVLAN_81	WavePoint								BORLAND C
+* WCITST	Inhouse test tool						Microsoft Visual C 1.5
+* WSU		WaveLAN Station Update					Microsoft Visual C ??
+* SCO UNIX	not yet actually used ?					?
+* __ppc		OEM supplied							?
+* _AM29K	OEM supplied							?
+* ?			OEM supplied							Microtec Research 80X86 Compiler
+*
+**************************************************************************************************************
+*
+*
+* SOFTWARE LICENSE
+*
+* This software is provided subject to the following terms and conditions,
+* which you should read carefully before using the software.  Using this
+* software indicates your acceptance of these terms and conditions.  If you do
+* not agree with these terms and conditions, do not use the software.
+*
+* COPYRIGHT © 1994 - 1995	by AT&T.				All Rights Reserved
+* COPYRIGHT © 1996 - 2000 by Lucent Technologies.	All Rights Reserved
+* COPYRIGHT © 2001 - 2004	by Agere Systems Inc.	All Rights Reserved
+* All rights reserved.
+*
+* Redistribution and use in source or binary forms, with or without
+* modifications, are permitted provided that the following conditions are met:
+*
+* . Redistributions of source code must retain the above copyright notice, this
+*    list of conditions and the following Disclaimer as comments in the code as
+*    well as in the documentation and/or other materials provided with the
+*    distribution.
+*
+* . Redistributions in binary form must reproduce the above copyright notice,
+*    this list of conditions and the following Disclaimer in the documentation
+*    and/or other materials provided with the distribution.
+*
+* . Neither the name of Agere Systems Inc. nor the names of the contributors
+*    may be used to endorse or promote products derived from this software
+*    without specific prior written permission.
+*
+* Disclaimer
+*
+* THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
+* INCLUDING, BUT NOT LIMITED TO, INFRINGEMENT AND THE IMPLIED WARRANTIES OF
+* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  ANY
+* USE, MODIFICATION OR DISTRIBUTION OF THIS SOFTWARE IS SOLELY AT THE USERS OWN
+* RISK. IN NO EVENT SHALL AGERE SYSTEMS INC. OR CONTRIBUTORS BE LIABLE FOR ANY
+* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+* ON ANY THEORY OF LIABILITY, INCLUDING, BUT NOT LIMITED TO, CONTRACT, STRICT
+* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+* OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+* DAMAGE.
+*
+*
+*************************************************************************************************************/
+
+/*	Alignment
+*	Some platforms can access words on odd boundaries (with possibly an performance impact), at other
+*	platforms such an access may result in a memory access violation.
+*	It is assumed that everywhere where the HCF casts a char pointer into a word pointer, the alignment
+*	criteria are met. This put some restrictions on the MSF, which are assumed to be "automatically" fulfilled
+*	at the applicable platforms
+*	To assert this assumption, the macro HCF_ALIGN can be defined. The default value is 1, meaning byte
+*	alignment (or no alignment), a value of 2 means word alignment, a value of 4 means double word alignment
+*/
+
+/*****************************    IN_PORT_STRING_8_16  S a m p l e s *****************************************
+
+		// C implementation which let the processor handle the word-at-byte-boundary problem
+#define IN_PORT_STRING_8_16( port, addr, n) while ( n-- ) 	\
+	{ *(hcf_16 FAR*)addr = IN_PORT_WORD( port ); ((hcf_8 FAR*)addr)+=2; }
+
+		// C implementation which handles the word-at-byte-boundary problem
+#define IN_PORT_STRING_8_16( port, addr, n)	while ( n-- )	 \
+	{ hcf_16 i = IN_PORT_WORD(port); *((hcf_8 FAR*)addr)++ = (hcf_8)i; *((hcf_8 FAR*)addr)++ = (hcf_8)(i>>8);}
+
+		// Assembler implementation
+#define IN_PORT_STRING_8_16( port, addr, len) __asm		\
+{														\
+	__asm push di										\
+	__asm push es										\
+	__asm mov cx,len									\
+	__asm les di,addr									\
+	__asm mov dx,port									\
+	__asm rep insw										\
+	__asm pop es										\
+	__asm pop di										\
+}
+
+
+*****************************   OUT_PORT_STRING_8_16  S a m p l e s ******************************************
+
+		// C implementation which let the processor handle the word-at-byte-boundary problem
+#define OUT_PORT_STRING_8_16( port, addr, n)	while ( n-- ) \
+	{ OUT_PORT_WORD( port, *(hcf_16 FAR*)addr ) ; ((hcf_8 FAR*)addr)+=2; }
+
+		// C implementation which handles the word-at-byte-boundary problem
+#define OUT_PORT_STRING_8_16( port, addr, n)	while ( n-- ) \
+	{ OUT_PORT_WORD( port, *((hcf_8 FAR*)addr) | *(((hcf_8 FAR*)addr)+1)<<8  ); (hcf_8 FAR*)addr+=2; }
+
+		// Assembler implementation
+#define OUT_PORT_STRING_8_16( port, addr, len) __asm	\
+{														\
+	__asm push si										\
+	__asm push ds										\
+	__asm mov cx,len									\
+	__asm lds si,addr									\
+	__asm mov dx,port									\
+	__asm rep outsw										\
+	__asm pop ds										\
+	__asm pop si										\
+}
+
+*************************************************************************************************************/
+
+
+/************************************************************************************************/
+/******************  C O M P I L E R   S P E C I F I C   M A C R O S  ***************************/
+/************************************************************************************************/
+/*************************************************************************************************
+*
+*			!!!!!!!!!!!!!!!!!!!!!!!!! Note to the HCF-implementor !!!!!!!!!!!!!!!!!!!!!!!!!
+*			!!!! Do not call these macros with parameters which introduce side effects !!!!
+*			!!!!!!!!!!!!!!!!!!!!!!!!! Note to the HCF-implementor !!!!!!!!!!!!!!!!!!!!!!!!!
+*
+*
+* By selecting the appropriate Macro definitions by means of modifying the "#ifdef 0/1" lines, the HCF can be
+* adjusted for the I/O characteristics of a specific compiler
+*
+* If needed the macros can be modified or replaced with definitions appropriate for your personal platform.
+* If you need to make such changes it is appreciated if you inform Agere Systems
+* That way the changes can become part of the next release of the WCI
+*
+* For convenience of the MSF-programmer, all macros are allowed to modify their parameters (although some
+* might argue that this would constitute bad coding practice). This has its implications on the HCF, e.g. as a
+* consequence these macros should not be called with parameters which have side effects, e.g auto-increment.
+*
+* in the Microsoft implementation of inline assembly it is O.K. to corrupt all flags except the direction flag
+* and to corrupt all registers except the segment registers and EDI, ESI, ESP and EBP (or their 16 bits
+* equivalents).  Other environments may have other constraints
+*
+* in the Intel environment it is O.K to have a word (as a 16 bits quantity) at a byte boundary, hence
+* IN_/OUT_PORT_STRING_8_16 can move words between PC-memory and NIC-memory with as only constraint that the
+* words are on a word boundary in NIC-memory. This does not hold true for all conceivable environments, e.g.
+* an Motorola 68xxx does not allow this. Probably/hopefully the boundary conditions imposed by these type of
+* platforms prevent this case from materializing.  If this is not the case, OUT_PORT_STRING_8_16 must be coded
+* by combining two Host memory hcf_8 values at a time to a single hcf_16 value to be passed to the NIC and
+* IN_PORT_STRING_8_16 the single hcf_16 retrieved from the NIC must be split in two hcf_8 values to be stored
+* in Host memory (see the sample code above)
+*
+*	The prototypes and functional description of the macros are:
+*
+*	hcf_16	IN_PORT_WORD( hcf_16 port )
+*			Reads a word (16 bits) from the specified port
+*
+*	void	OUT_PORT_WORD( hcf_16 port, hcf_16 value)
+*			Writes a word (16 bits) to the specified port
+*
+*	hcf_16	IN_PORT_DWORD( hcf_16 port )
+*			Reads a dword (32 bits) from the specified port
+*
+*	void	OUT_PORT_DWORD( hcf_16 port, hcf_32 value)
+*			Writes a dword (32 bits) to the specified port
+*
+*	void	IN_PORT_STRING_8_16( port, addr, len)
+*			Reads len number of words (16 bits) from NIC memory via the specified port to the (FAR)
+*			byte-pointer addr in PC-RAM
+*			Note that len specifies the number of words, NOT the number of bytes
+*			!!!NOTE, although len specifies the number of words, addr MUST be a char pointer NOTE!!!
+*			See also the common notes for IN_PORT_STRING_8_16 and OUT_PORT_STRING_8_16
+*
+*	void	OUT_PORT_STRING_8_16( port, addr, len)
+*			Writes len number of words (16 bits) from the (FAR) byte-pointer addr in PC-RAM via the specified
+*			port to NIC memory
+*			Note that len specifies the number of words, NOT the number of bytes.
+*			!!!NOTE, although len specifies the number of words, addr MUST be a char pointer NOTE!!!
+*
+*			The peculiar combination of word-length and char pointers for IN_PORT_STRING_8_16 as well as
+*			OUT_PORT_STRING_8_16 is justified by the assumption that it offers a more optimal algorithm
+*
+*	void	IN_PORT_STRING_32( port, addr, len)
+*			Reads len number of double-words (32 bits) from NIC memory via the specified port to the (FAR)
+*			double-word address addr in PC-RAM
+*
+*	void	OUT_PORT_STRING_32( port, addr, len)
+*			Writes len number of double-words (32 bits) from the (FAR) double-word address addr in PC-RAM via
+*			the specified port to NIC memory
+*
+*			!!!!!!!!!!!!!!!!!!!!!!!!! Note to the HCF-implementor !!!!!!!!!!!!!!!!!!!!!!!!!
+*			!!!! Do not call these macros with parameters which introduce side effects !!!!
+*			!!!!!!!!!!!!!!!!!!!!!!!!! Note to the HCF-implementor !!!!!!!!!!!!!!!!!!!!!!!!!
+*
+*************************************************************************************************/
+
+/****************************  define INT Types  ******************************/
+typedef unsigned char			hcf_8;
+typedef unsigned short			hcf_16;
+typedef unsigned long			hcf_32;
+
+/****************************  define I/O Types  ******************************/
+#define HCF_IO_MEM     			0x0001	// memory mapped I/O	( 0: Port I/O )
+#define HCF_IO_32BITS   	  	0x0002 	// 32Bits support		( 0: only 16 Bits I/O)
+
+/****************************** #define HCF_TYPE ********************************/
+#define HCF_TYPE_NONE			0x0000	// No type
+#define HCF_TYPE_WPA			0x0001	// WPA support
+#define HCF_TYPE_USB			0x0002	// reserved (USB Dongle driver support)
+//#define HCF_TYPE_HII			0x0004	// Hermes-II, to discriminate H-I and H-II CFG_HCF_OPT_STRCT
+#define HCF_TYPE_WARP			0x0008	// WARP F/W
+#define HCF_TYPE_PRELOADED		0x0040	// pre-loaded F/W
+#define HCF_TYPE_HII5			0x0080	// Hermes-2.5 H/W
+#define HCF_TYPE_CCX			0x0100	// CKIP
+#define HCF_TYPE_BEAGLE_HII5	0x0200	// Beagle Hermes-2.5 H/W
+#define HCF_TYPE_TX_DELAY		0x4000	// Delayed transmission ( non-DMA only)
+
+/****************************** #define HCF_ASSERT ******************************/
+#define HCF_ASSERT_NONE			0x0000	// No assert support
+#define HCF_ASSERT_PRINTF		0x0001	// Hermes generated debug info
+#define HCF_ASSERT_SW_SUP		0x0002	// logging via Hermes support register
+#define HCF_ASSERT_MB			0x0004	// logging via Mailbox
+#define HCF_ASSERT_RT_MSF_RTN	0x4000	// dynamically binding of msf_assert routine
+#define HCF_ASSERT_LNK_MSF_RTN	0x8000	// statically binding of msf_assert routine
+
+/****************************** #define HCF_ENCAP *******************************/
+#define HCF_ENC_NONE			0x0000	// No encapsulation support
+#define HCF_ENC					0x0001	// HCF handles En-/Decapsulation
+#define HCF_ENC_SUP				0x0002	// HCF supports MSF to handle En-/Decapsulation
+
+/****************************** #define HCF_EXT *********************************/
+#define HCF_EXT_NONE			0x0000	// No expanded features
+#define HCF_EXT_INFO_LOG		0x0001	// logging of Hermes Info frames
+//#define HCF_EXT_INT_TX_OK		0x0002	// RESERVED!!! monitoring successful Tx message
+#define HCF_EXT_INT_TX_EX		0x0004	// monitoring unsuccessful Tx message
+//#define HCF_EXT_MON_MODE		0x0008	// LEGACY
+#define HCF_EXT_TALLIES_FW		0x0010	// support for up to 32 Hermes Engineering tallies
+#define HCF_EXT_TALLIES_HCF		0x0020	// support for up to 8 HCF Engineering tallies
+#define HCF_EXT_NIC_ACCESS		0x0040	// direct access via Aux-ports and to Hermes registers and commands
+#define HCF_EXT_MB				0x0080	// MailBox code expanded
+#define HCF_EXT_IFB_STRCT 		0x0100	// MSF custom pointer in IFB
+#define HCF_EXT_DESC_STRCT 		0x0200	// MSF custom pointer in Descriptor
+#define HCF_EXT_TX_CONT			0x4000	// Continuous transmit test
+#define HCF_EXT_INT_TICK		0x8000	// enables TimerTick interrupt generation
+
+/****************************** #define HCF_SLEEP *******************************/
+#define HCF_DDS					0x0001	// Disconnected Deep Sleep
+#define HCF_CDS					0x0002	// Connected Deep Sleep
+
+/****************************** #define HCF_TALLIES ******************************/
+#define HCF_TALLIES_NONE		0x0000	// No tally support
+#define HCF_TALLIES_NIC			0x0001	// Hermes Tallies accumulated in IFB
+#define HCF_TALLIES_HCF			0x0002	// HCF Tallies accumulated in IFB
+#define HCF_TALLIES_RESET		0x8000	// Tallies in IFB are reset when reported via hcf_get_info
+
+
+/************************************************************************************************/
+/******************************  M I N I P O R T    N D I S *************************************/
+/************************************************************************************************/
+
+#if defined WVLAN_41 || defined WVLAN_48 || defined WVLAN_52 || defined _WIN32_WCE
+
+#ifndef WVLAN_46
+#define HCF_EXT   (HCF_EXT_INFO_LOG | HCF_EXT_MB | HCF_EXT_NIC_ACCESS )
+#else
+#define HCF_EXT ( HCF_EXT_TX_CONT | HCF_EXT_INFO_LOG | HCF_EXT_MB | HCF_EXT_NIC_ACCESS )
+#endif
+#define HCF_DLV 1			//H-I legacy, superfluous for H-II
+
+#ifdef _WIN32_WCE
+#define HCF_IO     HCF_IO_MEM
+#define HCF_DMA		0			// To enable DMA
+#endif
+
+#if _VARIANT == 7
+#define HCF_SLEEP HCF_CDS
+#endif // _VARIANT == 7
+
+#if _VARIANT == 5 || _VARIANT == 6
+#define _WARP
+#define _AES
+#define HCF_SLEEP HCF_CDS
+#if _VARIANT == 6
+//! #define _RSN
+#endif // _VARIANT == 6
+#ifndef _WIN32_WCE
+#define HCF_IO     HCF_IO_32BITS
+#define HCF_DMA		1			// To enable DMA
+#endif
+#endif // _VARIANT == 5 || _VARIANT == 6
+
+
+//HWi for migration purposes I defined a define which will be TRUE for ALL drivers
+//Meaning that _CCX defined code which we think will get a all driver OK flag can be defined from _CCX to _CCX_OK
+#if defined WVLAN_48 // && !defined _WIN32_WCE
+#if _VARIANT == 4 || _VARIANT == 6
+#define _CCX_OK		1
+#endif // _VARIANT == 4 || _VARIANT == 6
+#endif // WVLAN_48
+
+//#if !defined WVLAN_46
+#if defined WVLAN_48
+#if _VARIANT == 4 || _VARIANT == 6
+#define _CCX
+#define HCF_MAX_MSG_CKIP_PADDING    86 //, use 86 for rx fragmentation. 28 is enuf for MIC+PPK encapsulation
+#define HCF_MAX_MSG					( 1514 + HCF_MAX_MSG_CKIP_PADDING  ) // need extra padding for CKIP (need to subtract 28 for NDIS)
+#endif // _VARIANT == 4 || _VARIANT == 6
+#endif // WVLAN_48
+//#endif // WVLAN_46
+
+#if !defined WVLAN_46
+#define _PEEK
+#endif
+
+#ifndef _WIN32_WCE
+// ASSERT already used by WinCE...
+#ifdef ASSERT
+#undef ASSERT
+#define  ASSERT(x) ASSERTDEBUGMSG((x), (TEXT("SIMULATE ASSERT:")))
+#endif
+#endif
+
+
+#if defined WVLAN_41
+#define	MSF_COMPONENT_ID			COMP_ID_MINIPORT_NDIS_31
+#endif // WVLAN_41
+#if defined WVLAN_48 && !defined _WIN32_WCE
+#define	MSF_COMPONENT_ID			COMP_ID_MINIPORT_NDIS_50
+#endif // WVLAN_48 / _WIN32_WCE
+#if defined WVLAN_52 && !defined _WIN32_WCE
+#define	MSF_COMPONENT_ID			COMP_ID_MINIPORT_NDIS_40
+#endif // WVLAN_52 / _WIN32_WCE
+#if defined WVLAN_46
+#define	MSF_COMPONENT_ID			COMP_ID_WIN_CE
+#endif // _WIN32_WCE
+
+#define	MSF_COMPONENT_VAR			_VARIANT
+
+#define	T1__HCF_TYPE					(HCF_TYPE_NONE)
+
+#define T2__HCF_TYPE					(T1__HCF_TYPE)
+
+#ifdef _WARP
+#define T3__HCF_TYPE					(T2__HCF_TYPE | HCF_TYPE_HII5 | HCF_TYPE_WARP )
+#else
+#if _VARIANT == 7
+#define T3__HCF_TYPE					(T2__HCF_TYPE | HCF_TYPE_HII5)
+#else // _VARIANT == 7
+#define T3__HCF_TYPE					(T2__HCF_TYPE)
+#endif // _VARIANT == 7
+#endif // _WARP
+
+#ifdef _CCX_OK
+#define T4__HCF_TYPE					(T3__HCF_TYPE | HCF_TYPE_CCX)
+#else
+#define T4__HCF_TYPE					(T3__HCF_TYPE)
+#endif // _CCX_OK
+
+//not suitable for H-II #define HCF_CFG_STA_1_BOTTOM        	16
+
+// Default WPA in ON for all drivers except for WARP driver
+#ifdef _WARP
+#define T5__HCF_TYPE					(T4__HCF_TYPE)
+#else // _WARP
+#define T5__HCF_TYPE					(T4__HCF_TYPE | HCF_TYPE_WPA)
+#endif // _WARP
+
+#define HCF_TYPE						(T5__HCF_TYPE)
+
+// This is needed to get aux_ctrl() from the HCF for WlFreezeAndDump()
+#if (defined DBG && DBG != 0)
+#ifndef STATIC
+#define STATIC
+#endif
+#endif
+
+#if !defined SOFTRONICS_CODE && !defined _APIDLL && !defined _WIN32_WCE
+#include <ndis.h>
+#endif // SOFTRONICS_CODE / _APIDLL / _WIN32_WCE
+#if defined _WIN32_WCE
+#include <windows.h>
+#include <winnt.h>
+#endif  // _WIN32_WCE
+#include "version.h"
+
+#define	MSF_COMPONENT_MAJOR_VER		TPI_MAJOR_VERSION
+#define	MSF_COMPONENT_MINOR_VER		TPI_MINOR_VERSION
+
+#if !defined _APIDLL && !defined _WIN32_WCE
+
+__inline UCHAR NDIS_IN_BYTE( ULONG port )
+{
+    UCHAR value;
+    NdisRawReadPortUchar(port , &value);
+    return (value);
+}
+
+__inline ULONG NDIS_IN_LONG( ULONG port )
+{
+    ULONG value;
+    NdisRawReadPortUlong(port , &value);
+    return (value);
+}
+__inline USHORT NDIS_IN_WORD( ULONG port )
+{
+    USHORT value;
+    NdisRawReadPortUshort(port , &value);
+    return (value);
+}
+
+#define IN_PORT_DWORD(port)			NDIS_IN_LONG( (ULONG) (port) )
+#define IN_PORT_WORD(port)			NDIS_IN_WORD( (ULONG) (port) )
+#define OUT_PORT_DWORD(port, value)	NdisRawWritePortUlong((ULONG) (port) , value)
+#define OUT_PORT_WORD(port, value)	NdisRawWritePortUshort((ULONG) (port) , (USHORT) (value))
+
+#define  IN_PORT_STRING_8_16(port, addr, len)	IN_PORT_STRING_16(port, addr, len)
+#define  OUT_PORT_STRING_8_16(port, addr, len)	OUT_PORT_STRING_16(port, addr, len)
+
+#define IN_PORT_STRING_32(port, addr, len)		{					\
+	NdisRawReadPortBufferUlong(port, addr, (len));					\
+}
+
+#define OUT_PORT_STRING_32(port, addr, len)	{						\
+	NdisRawWritePortBufferUlong(port, addr, (len));					\
+}
+
+#define IN_PORT_STRING_16(port, addr, len)	NdisRawReadPortBufferUshort(port, addr, (len));
+#define OUT_PORT_STRING_16(port, addr, len)	NdisRawWritePortBufferUshort(port, addr, (len));
+
+#endif //  _APIDLL / _WIN32_WCE
+
+#if defined _WIN32_WCE
+
+#define HCF_ALIGN 2
+#define HCF_MEM_IO					1 // overrule standard Port I/O with Memory mapped I/O
+#define HCF_PROT_TIME				49
+
+#define  		IN_PORT_BYTE			CE_IN_PORT_BYTE
+#define  		OUT_PORT_BYTE			CE_OUT_PORT_BYTE
+#define  		IN_PORT_WORD			CE_IN_PORT_WORD
+#define  		OUT_PORT_WORD			CE_OUT_PORT_WORD
+#define  		IN_PORT_STRING_16		CE_IN_PORT_STRING
+#define  		OUT_PORT_STRING_16		CE_OUT_PORT_STRING
+
+extern hcf_8  CE_IN_PORT_BYTE(hcf_32 port);
+extern void   CE_OUT_PORT_BYTE(hcf_32 port, hcf_8 value);
+extern hcf_16 CE_IN_PORT_WORD(hcf_32 port);
+extern void   CE_OUT_PORT_WORD(hcf_32 port, hcf_16 value);
+extern void   CE_IN_PORT_STRING(hcf_32 port, void *addr, hcf_16 len);
+extern void   CE_OUT_PORT_STRING(hcf_32 port, void *addr, hcf_16 len);
+
+
+#endif
+
+#if defined _DEBUG || (defined DBG && DBG != 0)
+#define HCF_ASSERT ( HCF_ASSERT_LNK_MSF_RTN | HCF_ASSERT_RT_MSF_RTN | HCF_ASSERT_PRINTF ) //0xC001
+//#define HCF_ASSERT ( HCF_ASSERT_LNK_MSF_RTN | HCF_ASSERT_RT_MSF_RTN | HCF_ASSERT_PRINTF | HCF_ASSERT_MB ) //just to test
+#endif // _DEBUG || DBG
+
+#if defined DEBUG || defined _DEBUG || (defined DBG && DBG != 0)
+#ifdef _WIN32_WCE
+#define DBGA2W(DBGSTR)	CeConvertAnsiToUnicodeLen((char*)DBGSTR)
+#define OUTPUTDEBUGMSG(dprintf_exp)			((void)((! ZONE_DEBUG) ? 0:ce_debug_out dprintf_exp))
+#define ASSERTDEBUGMSG(cond, dprintf_exp)			((void)((cond) ? 0:ce_debug_out dprintf_exp))
+
+#define ZONE_ERROR      DEBUGZONE(0)
+#define ZONE_WARN       DEBUGZONE(1)
+#define ZONE_FUNCTION   DEBUGZONE(2)
+#define ZONE_INIT       DEBUGZONE(3)
+#define ZONE_INTR       DEBUGZONE(4)
+#define ZONE_RCV        DEBUGZONE(5)
+#define ZONE_XMIT		DEBUGZONE(6)
+#define ZONE_ASSERT 	DEBUGZONE(7)
+#define ZONE_DEBUG 		DEBUGZONE(8)
+#define ZONE_OEM 		DEBUGZONE(9)
+#define ZONE_HCF		DEBUGZONE(10)
+#define ZONE_PORTIO		DEBUGZONE(11)
+#define ZONE_LOGTOFILE	DEBUGZONE(15)
+
+#else // !(_WIN32_WCE)
+
+#define OUTPUTDEBUGMSG(dprintf_exp)					((void) (DbgPrint dprintf_exp))
+// the assertdebugmsg macro will print filename, line followed by a caller-defined text, when cond == 0
+#define ASSERTDEBUGMSG(cond, print)	((void)((cond) ? 0: (DbgPrint("%s %s:%d - ", print, __FILE__, __LINE__))))
+
+#define ZONE_ERROR      1
+#define ZONE_WARN       1
+#define ZONE_FUNCTION   1
+#define ZONE_INIT       1
+#define ZONE_INTR       1
+#define ZONE_RCV        1
+#define ZONE_XMIT		1
+#define ZONE_ASSERT 	1
+#define ZONE_DEBUG 		1
+#define ZONE_OEM 		1
+#define ZONE_HCF		1
+#define ZONE_PORTIO		1
+#define ZONE_LOGTOFILE	1
+
+#endif // _WIN32_WCE
+#ifndef DBGA2W
+#define DBGA2W
+#endif	// DBGA2W
+
+#else // !(defined DEBUG || defined _DEBUG || (defined DBG && DBG != 0) )
+#define OUTPUTDEBUGMSG(dprintf_exp)
+#define ASSERTDEBUGMSG(cond, dprintf_exp)
+#endif // DEBUG / DBG
+
+#if !defined HCF_MAX_MSG_CKIP_PADDING
+#define HCF_MAX_MSG_CKIP_PADDING 0
+#endif // 		HCF_MAX_MSG_CKIP_PADDING
+
+#if !defined	HCF_MAX_MSG
+#define			HCF_MAX_MSG				1514
+#endif // 		HCF_MAX_MSG
+
+#define			HCF_LEGACY			1	//;?nv je moet wat
+
+#endif //WVLAN_41 / WVLAN_48 / WVLAN_52 / _WIN32_WCE
+
+
+/************************************************************************************************/
+/****************************  P A C K E T   D R I V E R  ***************************************/
+/**********************************  D O S   O D I  *********************************************/
+/************************************************************************************************/
+
+#if defined WVLAN_42 || defined WVLAN_43
+
+#pragma warning ( disable: 4001 )
+#define FAR  __far										//segmented 16 bits mode
+#define BASED __based(__segname("_CODE"))				//force all the "const" structures in the CODE segment
+
+//#define HCF_IO     0									//no DMA, no 32 bits
+
+//~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ To ease testing the different options ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+#define	HCF_EXT						HCF_EXT_MB
+#define HCF_PROT_TIME				49					//49*10240 microseconds H/W failure protection timer
+
+//~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ To ease testing the different options ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+/********************************  CONFIGURATION MANAGEMENT *****************************************/
+#ifdef WVLAN_42
+#define	MSF_COMPONENT_ID			COMP_ID_PACKET
+#define	MSF_COMPONENT_VAR			1
+#define	MSF_COMPONENT_MAJOR_VER		6
+#define	MSF_COMPONENT_MINOR_VER		12
+#endif // WVLAN_42
+
+#ifdef WVLAN_43
+#define	MSF_COMPONENT_ID			COMP_ID_ODI_16
+#define	MSF_COMPONENT_VAR			1
+#define	MSF_COMPONENT_MAJOR_VER		6
+#define	MSF_COMPONENT_MINOR_VER		10
+#endif // WVLAN_43
+
+/**************************************  INPUT / OUTPUT **********************************************/
+#ifndef H_2_INC
+#include <stdio.h>
+#include <conio.h>
+#if 1 //temorary use functions defined in hcf.c
+#ifndef _DEBUG
+#pragma intrinsic( _inp, _inpw, _outp, _outpw )
+#endif // _DEBUG
+
+#define IN_PORT_WORD(port)			((hcf_16)_inpw( (hcf_io)(port) ))
+#define OUT_PORT_WORD(port, value)	((void)_outpw( (hcf_io)(port), value ))
+
+#if 1		// C implementation which let the processor handle the word-at-byte-boundary problem
+#define IN_PORT_STRING_8_16( port, addr, n)		while (n--) \
+	{ *(hcf_16 FAR*)addr = IN_PORT_WORD( port ); ((hcf_8 FAR*)addr)+=2; }
+#define OUT_PORT_STRING_8_16( port, addr, n)	while (n--) \
+	{ OUT_PORT_WORD( port, *(hcf_16 FAR*)addr ) ; ((hcf_8 FAR*)addr)+=2; }
+#elif 0		// C implementation which handles the word-at-byte-boundary problem
+#define IN_PORT_STRING_8_16( port, addr, n)		while ( n-- ) \
+	{ hcf_16 i = IN_PORT_WORD(port); *((hcf_8 FAR*)addr)++ = (hcf_8)i; *((hcf_8 FAR*)addr)++ = (hcf_8)(i>>8);}
+#define OUT_PORT_STRING_8_16( port, addr, n)	while ( n-- ) \
+	{ OUT_PORT_WORD( port, *((hcf_8 FAR*)addr) | *(((hcf_8 FAR*)addr)+1)<<8  ); (hcf_8 FAR*)addr+=2; }
+#else												// Assembler implementation
+#define IN_PORT_STRING_8_16( port, addr, n) __asm	\
+{													\
+	__asm push di									\
+	__asm push es									\
+	__asm mov cx,n									\
+	__asm les di,addr								\
+	__asm mov dx,port								\
+	__asm rep insw									\
+	__asm pop es									\
+	__asm pop di									\
+}
+
+#define OUT_PORT_STRING_8_16( port, addr, n) __asm	\
+{													\
+	__asm push si									\
+	__asm push ds									\
+	__asm mov cx,n									\
+	__asm lds si,addr								\
+	__asm mov dx,port								\
+	__asm rep outsw									\
+	__asm pop ds									\
+	__asm pop si									\
+}
+
+#endif // Asm or C implementation
+#define IN_PORT_STRING_32( port, addr, n)	{ int n2 = 2*n; IN_PORT_STRING_8_16(port, addr, n2) }
+#define OUT_PORT_STRING_32( port, addr, n)	{ int n2 = 2*n; OUT_PORT_STRING_8_16(port, addr, n2) }
+#endif // 0 //temorary use functions defined in hcf.c
+#endif // H_2_INC
+
+#endif	// WVLAN_42 / WVLAN_43
+
+
+
+/************************************************************************************************/
+/****************************  D O S  H - I / II  L O A D E R  **********************************/
+/************************************************************************************************/
+
+#if defined H0_LDR || defined H1_LDR || defined H2_LDR || defined H5_LDR
+
+#if defined H0_LDR				//implies H-I
+#define HCF_DLV		0			//H-I legacy, meaningless under H-II
+#define HCF_DLNV	1			//H-I legacy, meaningless under H-II
+#endif // H0_LDR
+
+#if defined H1_LDR 				//implies H-I
+#define HCF_DLV		1			//H-I legacy, meaningless under H-II
+#define HCF_DLNV	0			//H-I legacy, meaningless under H-II
+#endif // H1_LDR / H2_LDR
+
+//#if defined H2_LDR : not needed, H-II defaults are O.K for H2_LDR
+
+#ifdef H5_LDR
+#define HCF_TYPE			(HCF_TYPE_HII5 | HCF_TYPE_WARP )
+//;? why does only this subset of the H_LDRs need HCF_TYPE to be defined here
+#endif
+
+#define HCF_ASSERT			HCF_ASSERT_LNK_MSF_RTN	//support dynamic linking of msf_assert routine
+#define HCF_ENCAP			0
+#define HCF_INT_ON			0
+#define HCF_TALLIES			0
+
+#define	MSF_COMPONENT_ID			COMP_ID_ODI_16 //;?By lack of any better
+#define	MSF_COMPONENT_VAR			1
+#define	MSF_COMPONENT_MAJOR_VER		0
+#define	MSF_COMPONENT_MINOR_VER		0
+
+#include <stdio.h>
+#include <conio.h>
+#if defined NDEBUG
+#pragma intrinsic( _inp, _inpw, _outp, _outpw )
+#endif // NDEBUG
+
+#if 0						//use 0 to replace I/O Macros with logging facility
+#define IN_PORT_WORD(port)			((hcf_16)_inpw( (hcf_io)(port) ))
+#define OUT_PORT_WORD(port, value)	((void)_outpw( (hcf_io)(port), value ))
+#define IN_PORT_STRING_16( port, addr, n)	\
+		while ( n-- ) { *(hcf_16 FAR*)addr = IN_PORT_WORD( port ); (cast)addr += 2; }
+#define OUT_PORT_STRING_16( port, addr, n)	\
+		while ( n-- ) { OUT_PORT_WORD( port, *(hcf_16 FAR*)addr ) ; (cast)addr  += 2; }
+#endif						//use 0 to replace I/O Macros with logging facility
+
+#endif	// H0_LDR / H1_LDR / H2_LDR
+
+
+
+/************************************************************************************************/
+/****************************  H C F  D E M O  P R O G R A M  ***********************************/
+/************************************************************************************************/
+
+#if defined HCF_DEMO
+
+#define HCF_DLV		1				//;?should become the default !defaults to 1 anyway for H-II
+//#define HCF_DLNV	0				//defaults to 0 anyway for H-II
+
+#define HCF_ASSERT	HCF_ASSERT_LNK_MSF_RTN			//support dynamic linking of msf_assert routine
+
+#define HCF_ENCAP			0
+#define HCF_INT_ON			0
+#define HCF_TALLIES			( HCF_TALLIES_NIC | HCF_TALLIES_HCF )
+
+//#define	MSF_COMPONENT_ID		NO configuration management
+
+#include <stdio.h>
+#include <conio.h>
+#if defined NDEBUG
+#pragma intrinsic( _inp, _inpw, _outp, _outpw )
+#endif // NDEBUG
+
+#if 0						//use 0 to replace I/O Macros with logging facility
+#define IN_PORT_WORD(port)			((hcf_16)_inpw( (hcf_io)(port) ))
+#define OUT_PORT_WORD(port, value)	((void)_outpw( (hcf_io)(port), value ))
+#define IN_PORT_STRING_16( port, addr, n)	\
+		while ( n-- ) { *(hcf_16 FAR*)addr = IN_PORT_WORD( port ); (cast)addr += 2; }
+#define OUT_PORT_STRING_16( port, addr, n)	\
+		while ( n-- ) { OUT_PORT_WORD( port, *(hcf_16 FAR*)addr ) ; (cast)addr  += 2; }
+#endif						//use 0 to replace I/O Macros with logging facility
+
+#endif	// HCF_DEMO
+
+
+
+/************************************************************************************************/
+/***********************************  M A C  O S   **********************************************/
+/************************************************************************************************/
+
+#if defined WVLAN_45
+
+#include "Version.h"
+
+#define MSF_COMPONENT_ID            COMP_ID_MAC_OS
+#define MSF_COMPONENT_VAR           VARIANT
+#define MSF_COMPONENT_MAJOR_VER     VERSION_MAJOR
+#define MSF_COMPONENT_MINOR_VER     VERSION_MINOR
+
+#define MAC_OS                      1
+
+#define HCF_BIG_ENDIAN 1       		// selects Big Endian (a.k.a. Motorola), most significant byte first
+
+#if defined DEBUG
+#define HCF_ASSERT	HCF_ASSERT_MB	// logging via Mailbox
+#endif // DEBUG
+
+#ifdef  __cplusplus
+extern "C" {
+#endif // __cplusplus
+extern volatile unsigned char *MacIOaddr;
+extern hcf_16 IN_PORT_WORD(hcf_16 port);
+extern void   OUT_PORT_WORD(hcf_16 port, hcf_16 value);
+extern void   IN_PORT_STRING_16(hcf_16 port, void *addr, hcf_16 len);
+extern void   OUT_PORT_STRING_16(hcf_16 port, void *addr, hcf_16 len);
+
+#define SwapBytes(t)    (((t) >> 8) + (((t) & 0xff) << 8))
+
+#ifdef  __cplusplus
+}
+#endif // __cplusplus
+
+#endif  // WVLAN_45
+
+
+
+/************************************************************************************************/
+/******************************************  L I N U X  *****************************************/
+/************************************************************************************************/
+
+#ifdef WVLAN_49
+#include <asm/io.h>
+//#include <linux/module.h>
+#include <wl_version.h>
+
+/* The following macro ensures that no symbols are exported, minimizing the chance of a symbol
+   collision in the kernel */
+//EXPORT_NO_SYMBOLS;  //;?this place seems not appropriately to me
+
+//#define HCF_SLEEP (HCF_CDS | HCF_DDS )
+#define HCF_SLEEP (HCF_CDS)
+
+//#define HCF_TYPE    (HCF_TYPE_HII5|HCF_TYPE_STA|HCF_TYPE_AP)
+#ifdef HERMES25
+#ifdef WARP
+#define HCF_TYPE    ( HCF_TYPE_WARP | HCF_TYPE_HII5 )
+#else
+#define HCF_TYPE    HCF_TYPE_HII5
+#endif // WARP
+#else
+#define HCF_TYPE    HCF_TYPE_NONE
+#endif // HERMES25
+
+#ifdef ENABLE_DMA
+#define HCF_DMA		1
+#endif // ENABLE_DMA
+
+/* We now need a switch to include support for the Mailbox and other necessary extensions */
+#define HCF_EXT ( HCF_EXT_MB | HCF_EXT_INFO_LOG | HCF_EXT_INT_TICK )//get deepsleep exercise going
+
+/* ;? The Linux MSF still uses these definitions; define it here until it's removed */
+#ifndef HCF_TYPE_HII
+#define HCF_TYPE_HII 0x0004
+#endif
+
+#ifndef HCF_TYPE_AP
+#define HCF_TYPE_AP  0x0010
+#endif
+
+#ifndef HCF_TYPE_STA
+#define HCF_TYPE_STA 0x0020
+#endif  // HCF_TYPE_STA
+
+/* Guarantees word alignment */
+#define HCF_ALIGN		2
+
+/* Endian macros CNV_INT_TO_LITTLE() and CNV_LITTLE_TO_INT() were renamed to
+   CNV_SHORT_TO_LITTLE() and CNV_LITTLE_TO_SHORT() */
+#ifndef CNV_INT_TO_LITTLE
+#define CNV_INT_TO_LITTLE   CNV_SHORT_TO_LITTLE
+#endif
+
+#ifndef CNV_LITTLE_TO_INT
+#define CNV_LITTLE_TO_INT   CNV_LITTLE_TO_SHORT
+#endif
+
+#define	HCF_ERR_BUSY			0x06
+
+/* UIL defines were removed from the HCF */
+#define UIL_SUCCESS					HCF_SUCCESS
+#define UIL_ERR_TIME_OUT			HCF_ERR_TIME_OUT
+#define UIL_ERR_NO_NIC				HCF_ERR_NO_NIC
+#define UIL_ERR_LEN					HCF_ERR_LEN
+#define UIL_ERR_MIN					HCF_ERR_MAX	/*end of HCF errors which are passed through to UIL
+												  *** ** *** ****** ***** *** ****** ******* ** ***  */
+#define UIL_ERR_IN_USE				0x44
+#define UIL_ERR_WRONG_IFB			0x46
+#define UIL_ERR_MAX					0x7F		/*upper boundary of UIL errors without HCF-pendant
+                                                  ***** ******** ** *** ****** ******* *** *******  */
+#define UIL_ERR_BUSY			    HCF_ERR_BUSY
+#define UIL_ERR_DIAG_1			    HCF_ERR_DIAG_1
+#define UIL_FAILURE					0xFF	/* 20010705 nv this relick should be eridicated */
+#define UIL_ERR_PIF_CONFLICT		0x40	//obsolete
+#define UIL_ERR_INCOMP_DRV			0x41	//obsolete
+#define UIL_ERR_DOS_CALL			0x43	//obsolete
+#define UIL_ERR_NO_DRV				0x42	//obsolete
+#define UIL_ERR_NSTL				0x45	//obsolete
+
+
+
+#if 0  //;? #ifdef get this going LATER HERMES25
+#define HCF_IO              HCF_IO_32BITS
+#define HCF_DMA             1
+#define HCF_DESC_STRCT_EXT  4
+
+/* Switch for BusMaster DMA support. Note that the above define includes the DMA-specific HCF
+   code in the build. This define sets the MSF to use DMA; if ENABLE_DMA is not defined, then
+   port I/O will be used in the build */
+#ifndef BUS_PCMCIA
+#define ENABLE_DMA
+#endif  // USE_PCMCIA
+
+#endif  // HERMES25
+
+
+/* Overrule standard WaveLAN Packet Size when in DMA mode */
+#ifdef ENABLE_DMA
+#define HCF_MAX_PACKET_SIZE 2304
+#else
+#define HCF_MAX_PACKET_SIZE 1514
+#endif  // ENABLE_DMA
+
+/* The following sets the component ID, as well as the versioning. See also wl_version.h */
+#define	MSF_COMPONENT_ID	COMP_ID_LINUX
+
+#define	MSF_COMPONENT_VAR			DRV_VARIANT
+#define MSF_COMPONENT_MAJOR_VER     DRV_MAJOR_VERSION
+#define MSF_COMPONENT_MINOR_VER     DRV_MINOR_VERSION
+
+/* Define the following to turn on assertions in the HCF */
+//#define HCF_ASSERT  0x8000
+#define HCF_ASSERT			HCF_ASSERT_LNK_MSF_RTN	// statically binding of msf_assert routine
+
+#ifdef USE_BIG_ENDIAN
+#define HCF_BIG_ENDIAN  1
+#else
+#define HCF_BIG_ENDIAN  0
+#endif  /* USE_BIG_ENDIAN */
+
+/* Define the following if your system uses memory-mapped IO */
+//#define HCF_MEM_IO
+
+/* The following defines the standard macros required by the HCF to move data to/from the card */
+#define IN_PORT_BYTE(port)			((hcf_8)inb( (hcf_io)(port) ))
+#define IN_PORT_WORD(port)			((hcf_16)inw( (hcf_io)(port) ))
+#define OUT_PORT_BYTE(port, value)	(outb( (hcf_8) (value), (hcf_io)(port) ))
+#define OUT_PORT_WORD(port, value)	(outw((hcf_16) (value), (hcf_io)(port) ))
+
+#define IN_PORT_STRING_16(port, dst, n)    insw((hcf_io)(port), dst, n)
+#define OUT_PORT_STRING_16(port, src, n)   outsw((hcf_io)(port), src, n)
+//#define IN_PORT_STRINGL(port, dst, n)   insl((port), (dst), (n))
+//#define OUT_PORT_STRINGL(port, src, n)  outsl((port), (src), (n))
+#define IN_PORT_STRING_32(port, dst, n)   insl((port), (dst), (n))
+#define OUT_PORT_STRING_32(port, src, n)  outsl((port), (src), (n))
+#define IN_PORT_HCF32(port)          inl( (hcf_io)(port) )
+#define OUT_PORT_HCF32(port, value)  outl((hcf_32)(value), (hcf_io)(port) )
+
+#define IN_PORT_DWORD(port)          IN_PORT_HCF32(port)
+#define OUT_PORT_DWORD(port, value)  OUT_PORT_HCF32(port, value)
+
+#define  IN_PORT_STRING_8_16(port, addr, len)	IN_PORT_STRING_16(port, addr, len)
+#define  OUT_PORT_STRING_8_16(port, addr, len)	OUT_PORT_STRING_16(port, addr, len)
+
+
+#ifndef OUTPUTDEBUGMSG
+#define OUTPUTDEBUGMSG(dprintf_exp)
+#endif
+
+
+#ifndef ASSERTDEBUGMSG
+#define ASSERTDEBUGMSG(cond, dprintf_exp)
+#endif
+
+#ifndef CFG_SCAN_CHANNELS_2GHZ
+#define CFG_SCAN_CHANNELS_2GHZ 0xFCC2
+#endif /* CFG_SCAN_CHANNELS_2GHZ */
+
+#define HCF_MAX_MSG 1600 //get going ;?
+#endif	// WVLAN_49
+
+
+
+/************************************************************************************************/
+/*********************************************  Q N X  ******************************************/
+/************************************************************************************************/
+
+#if defined  __QNX__ || defined WVLAN_50
+
+#define MSF_COMPONENT_ID		0   //Although there is no DUI support, we need this to get ...
+#define MSF_COMPONENT_VAR		0	//...compatibilty check to function
+#define MSF_COMPONENT_MAJOR_VER	0	//...;?this is worth looking into to make this a more
+#define MSF_COMPONENT_MINOR_VER	0	//..."defined" I/F so OEMers can figure out what to do
+
+#include <conio.h>
+
+#define IN_PORT_WORD(port)			((hcf_16)inpw( (hcf_io)(port) ))
+#define OUT_PORT_WORD(port, value)	(outpw( (hcf_io)(port), (hcf_16) (value) ))
+/*
+#define IN_PORT_STRING_16( port, addr, n)	\
+		while ( n-- ) { *(hcf_16*)addr = IN_PORT_WORD( port ); (cast)addr += 2; }
+#define OUT_PORT_STRING_16( port, addr, n)	\
+		while ( n-- ) { OUT_PORT_WORD( port, *(hcf_16*)addr ) ; (cast)addr  += 2; }
+*/
+
+#endif	// QNX / WVLAN_50
+
+
+
+/************************************************************************************************/
+/*********************************************  B E O S  ****************************************/
+/************************************************************************************************/
+
+#if defined  __BEOS__
+
+#define MSF_COMPONENT_ID		0   //Although there is no DUI support, we need this to get ...
+#define MSF_COMPONENT_VAR		0	//...compatibilty check to function
+#define MSF_COMPONENT_MAJOR_VER	0	//...;?this is worth looking into to make this a more
+#define MSF_COMPONENT_MINOR_VER	0	//..."defined" I/F so OEMers can figure out what to do
+
+#include <drivers/Drivers.h>
+#include <drivers/KernelExport.h>
+
+uint8 read_io_8 (int);
+void write_io_8 (int, uint8);
+uint16 read_io_16 (int);
+void write_io_16 (int, uint16);
+
+#define IN_PORT_WORD(port)			((hcf_16)read_io_16( (hcf_io)(port) ))
+#define OUT_PORT_WORD(port, value)	(write_io_16( (hcf_io)(port), (hcf_16) (value) ))
+/*
+#define IN_PORT_STRING_16( port, addr, n)	\
+		while ( n-- ) { *(hcf_16*)addr = IN_PORT_WORD( port ); (cast)addr += 2; }
+#define OUT_PORT_STRING_16( port, addr, n)	\
+		while ( n-- ) { OUT_PORT_WORD( port, *(hcf_16*)addr ) ; (cast)addr  += 2; }
+*/
+#endif	// __BEOS__
+
+
+
+/************************************************************************************************/
+/********************************  U S B   D O N G L E  *****************************************/
+/************************************************************************************************/
+
+#if defined USB
+#include "gpif.h"
+
+#define	MSF_COMPONENT_MAJOR_VER		0
+#define	MSF_COMPONENT_MINOR_VER		1
+
+#define IN_PORT_WORD(port)			(Hermes_IO_Read( (hcf_8)(port)))
+#define OUT_PORT_WORD(port, value)	(Hermes_IO_Write( (hcf_8)port, /*(hcf_16)*/(value) ) )
+/* !!!! NOTE USB supports only 16-bits I/O and no 8-bits I/O
+ * as a consequence the IN_/OUT_PORT_STRING_16 macros use hcf_16* rather than hcf_8 pointers
+ * to get more optimal code
+ * therefore the pointers are incremented by 1 (which means two "bytes") rather than by 2
+ */
+//#define IN_PORT_STRING_16( port, addr, n)	while ( n-- ) { *((hcf_16*)addr)++ = IN_PORT_WORD( port ); }
+//#define OUT_PORT_STRING_16( port, addr, n)	while ( n-- ) { OUT_PORT_WORD( port, *((hcf_16*)addr)++ ); }
+#define IN_PORT_STRING_16( port, dst, n)	while ( n-- ) { *dst++ = IN_PORT_WORD( port ); }
+#define OUT_PORT_STRING_16( port, src, n)	while ( n-- ) { OUT_PORT_WORD( port, *src++ ); }
+
+//#define HCF_TYPE	( HCF_TYPE_AP | HCF_TYPE_WPA )
+#define HCF_TYPE	HCF_TYPE_WPA
+
+#endif	// USB
+
+
+/************************************************************************************************/
+/******************************************  FreeBSD  *******************************************/
+/************************************************************************************************/
+
+#if defined __FREE_BSD__
+
+#define	MSF_COMPONENT_ID			COMP_ID_FreeBSD
+#define	MSF_COMPONENT_VAR			1
+#define	MSF_COMPONENT_MAJOR_VER		1
+#define	MSF_COMPONENT_MINOR_VER		0
+
+#define HCF_IO 						HCF_IO_MEM		// overrule standard Port I/O with Memory mapped I/O
+
+#include <machine/cpufunc.h>
+
+#define IN_PORT_WORD(port)			((hcf_16)inw( (hcf_io)(port) ))
+#define OUT_PORT_WORD(port, value)	(outw((hcf_io)(port), (hcf_16)(value)))
+
+/*
+#define IN_PORT_STRING_16( port, addr, n)	\
+		while ( n-- ) { *(hcf_16*)addr = IN_PORT_WORD( port ); (cast)addr += 2; }
+#define OUT_PORT_STRING_16( port, addr, n)	\
+		while ( n-- ) { OUT_PORT_WORD( port, *(hcf_16*)addr ) ; (cast)addr  += 2; }
+*/
+#endif	// __FREE_BSD__
+
+
+
+/************************************************************************************************/
+/*********************************  W A V E P O I N T  ******************************************/
+/************************************************************************************************/
+
+#if defined WVLAN_81	/* BORLANDC */
+
+#define EXTERN_C  extern	// needed because DHF uses this instead of 'extern'
+
+#define	MSF_COMPONENT_ID	COMP_ID_AP1
+#define	MSF_COMPONENT_VAR			1
+#define	MSF_COMPONENT_MAJOR_VER		4
+#define	MSF_COMPONENT_MINOR_VER		0
+
+#define HCF_PROT_TIME				49	//49*10240 microseconds H/W failure protection timer
+
+//#define HCF_ASSERT	HCF_ASSERT_MB	// logging via Mailbox	/* debug build only */
+
+#if !defined FAR
+#define FAR  far						// segmented 16 bits mode
+#endif // FAR
+
+#define IN_PORT_WORD(port)					(inport( (hcf_io)(port) ))
+#define OUT_PORT_WORD(port, value)			(outport( (hcf_io)(port), value ))
+
+#define IN_PORT_STRING_16(port, addr, len)	\
+	asm { push di; push es; mov cx,len; les di,addr; mov dx,port; rep insw; pop es; pop di }
+
+#define OUT_PORT_STRING_16(port, addr, len)	\
+	asm { push si; push ds; mov cx,len; lds si,addr; mov dx,port; rep outsw; pop ds; pop si }
+
+#endif // WVLAN_81
+
+
+/************************************************************************************************/
+/********************************  W A V E L A U N C H  *****************************************/
+/************************************************************************************************/
+
+#if defined WVLAUNCH
+
+#include "DriverX.h"
+extern HWDEVICE*	g_pDevice;
+
+//#define	MSF_COMPONENT_ID			0  //;? to get around browser problem
+
+#define IN_PORT_WORD(port)	HwInpw( g_pDevice, port )
+#define OUT_PORT_WORD(port, value)	HwOutpw( g_pDevice, port, value )
+
+
+// C implementation which let the processor handle the word-at-byte-boundary problem
+/*
+#define IN_PORT_STRING_16( port, addr, n)	\
+		while ( n-- ) { *(hcf_16 FAR*)addr = IN_PORT_WORD( port ); (cast)addr += 2; }
+#define OUT_PORT_STRING_16( port, addr, n)	\
+		while ( n-- ) { OUT_PORT_WORD( port, *(hcf_16 FAR*)addr ) ; (cast)addr  += 2; }
+*/
+#endif // WVLAUNCH
+
+
+
+/************************************************************************************************/
+/*************************************  W C I T S T *********************************************/
+/************************************************************************************************/
+
+#if defined WCITST
+#define MSF_COMPONENT_ID		0   //Although there is no DUI support, we need this to get ...
+#define MSF_COMPONENT_VAR		0	//...compatibilty check to function
+#define MSF_COMPONENT_MAJOR_VER	0	//...;?this is worth looking into to make this a more
+#define MSF_COMPONENT_MINOR_VER	0	//..."defined" I/F so OEMers can figure out what to do
+
+//#define HCF_ENCAP				HCF_ENC_NONE	//to get going
+//~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ To ease testing the different options ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#define HCF_TYPE (HCF_TYPE_WPA | HCF_TYPE_PRELOADED) // Hermes-I for HCF6, II for HCF7
+#define 		HCF_DMA				1
+//#define LLB	//!!!!MIC Debug Only
+#if defined LLB && !((HCF_TYPE) & HCF_TYPE_WPA)
+err: no LLB unless SSN;
+#endif // LLB / HCF_TYPE_WPA
+//#define HCF_ALIGN 2
+#define HCF_DLV		1			//just to change memory layout ????;?
+//~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ To ease testing the different options ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+#define HCF_ASSERT	HCF_ASSERT_SW_SUP	// logging via Hermes support registerr
+//#define HCF_ASSERT		HCF_ASSERT_MB		// logging via Mailbox
+
+#if defined __GNUC__
+#include "stdio.h"
+//#include "unistd.h"	//ioperm   libc5
+#include "sys/io.h"	//ioperm   glibc
+#define extern		//see IO Port Programming mini-HOWTO
+//#include "asm/io.h"	//
+#define IN_PORT_WORD(port)			inw( (hcf_io)(port) )
+#define IN_PORT_DWORD(port)			inl( (hcf_io)(port) )
+#define OUT_PORT_WORD(port, value)	outw( (hcf_io)(port), (hcf_16)(value) )
+#define OUT_PORT_DWORD(port, value)	outl( (hcf_io)(port), (hcf_16)(value) )
+#else
+#pragma warning ( disable: 4001 )
+#define FAR  __far					// segmented 16 bits mode
+
+#include <stdio.h>
+#include <conio.h>
+#ifndef _DEBUG
+#pragma intrinsic( _inp, _inpw, _outp, _outpw )
+#endif // _DEBUG
+
+#ifdef LOG
+extern FILE* utm_logfile;
+hcf_16	ipw( hcf_16 port );
+hcf_8	ipb( hcf_16 port );
+void	opw( hcf_16 port, hcf_16 value );
+void	opb( hcf_16 port, hcf_8 value );
+
+#define IN_PORT_WORD(port)			ipw( (hcf_io)(port) )
+#define OUT_PORT_WORD(port, value)	opw( (hcf_io)(port), (hcf_16)(value) )
+#else // LOG
+#define IN_PORT_WORD(port)			((hcf_16)_inpw( (hcf_io)(port) ))
+#define OUT_PORT_WORD(port, value)	((void)_outpw( (hcf_io)(port), value ))
+#endif // LOG
+
+#if 1 //ASM example
+#define IN_PORT_STRING_16( port, addr, len) __asm		\
+{														\
+	__asm push di										\
+	__asm push es										\
+	__asm mov cx,len									\
+	__asm les di,addr									\
+	__asm mov dx,port									\
+	__asm rep insw										\
+	__asm pop es										\
+	__asm pop di										\
+}
+
+#define OUT_PORT_STRING_16( port, addr, len) __asm		\
+{														\
+	__asm push si										\
+	__asm push ds										\
+	__asm mov cx,len									\
+	__asm lds si,addr									\
+	__asm mov dx,port									\
+	__asm rep outsw										\
+	__asm pop ds										\
+	__asm pop si										\
+}
+
+#endif	// asm example
+
+#endif // __GCC__
+
+#if ! defined IN_PORT_STRING_16
+#define IN_PORT_STRING_16( port, addr, n)  while (n--) \
+	{ *(hcf_16 FAR*)addr = IN_PORT_WORD( port ); ((hcf_16 FAR*)addr)++; }
+#define OUT_PORT_STRING_16( port, addr, n) while (n--) \
+	{ OUT_PORT_WORD( port, *(hcf_16 FAR*)addr ); ((hcf_16 FAR*)addr)++; }
+#endif // IN_PORT_STRING_16
+
+#endif	// WCITST
+
+
+/************************************************************************************************/
+/*******************************  Motorola Power PC 800 family  *********************************/
+/************************************************************************************************/
+/* known users: LH@I
+ */
+
+#if defined I_MPC8XX
+
+#define MSF_COMPONENT_VAR		0
+#define MSF_COMPONENT_ID		0
+#define MSF_COMPONENT_MAJOR_VER	1
+#define MSF_COMPONENT_MINOR_VER	0
+
+#define HCF_HSI_VAR				1
+
+#define HCF_BIG_ENDIAN			1
+#define HCF_IO 					HCF_IO_MEM		// overrule standard Port I/O with Memory mapped I/O
+
+#include "o_portbl.h"
+#include "ipcmcia.h"
+typedef o_uint8_t  hcf_8;
+typedef o_uint16_t hcf_16;
+typedef o_uint32_t hcf_32;
+
+/***************************************************************************/
+
+
+#ifdef _lint
+#else
+asm hcf_16 IN_PORT_WORD(int port)
+{
+% reg port
+    lhbrx r3,r0,port
+    eieio
+}
+#endif // _lint
+
+
+#ifdef _lint
+#else
+asm void OUT_PORT_WORD(int port, hcf_16 value)
+{
+% reg port, value
+    sthbrx value,r0,port
+    eieio
+}
+#endif // _lint
+
+/***************************************************************************/
+
+#define IN_PORT_STRING_16(port, addr, len)               \
+   {                                                  \
+      unsigned l = (len);                             \
+      hcf_16 *d = (volatile hcf_16 *)(addr);          \
+      while (l--)                                     \
+      {                                               \
+         *d++ = *(volatile hcf_16 *)(port);           \
+         EIEIO();                                     \
+      }                                               \
+   }
+
+#define OUT_PORT_STRING_16(port, addr, len)           \
+   {                                                  \
+      unsigned l = (len);                             \
+      hcf_16 *s = (volatile hcf_16 *)(addr);          \
+      while (l--)                                     \
+      {                                               \
+         *(volatile hcf_16 *)(port) = *s++;           \
+         EIEIO();                                     \
+      }                                               \
+   }
+
+#endif	// I_MPC8XX
+
+
+
+/************************************************************************************************/
+/**********************************   Diab or High C 29K   **************************************/
+/************************************************************************************************/
+/* known users: GK@C
+ */
+
+#if defined _AM29K
+
+#define MSF_COMPONENT_VAR		0
+#define MSF_COMPONENT_ID		COMP_ID_AP1
+#define MSF_COMPONENT_MAJOR_VER	1
+#define MSF_COMPONENT_MINOR_VER	0
+
+#define HCF_BIG_ENDIAN			1
+#define HCF_IO 					HCF_IO_MEM		// overrule standard Port I/O with Memory mapped I/O
+
+#define SwapBytes(t)    /*lint -e572*/(((t) >> 8) + (((t) & 0xff) << 8))/*lint +e572*/
+
+#if defined __ppc
+    #ifndef __GNUC__
+        #define __asm__     asm
+    #endif
+
+    #if ! defined _lint
+        #define EIEIO()     __asm__(" eieio")
+    #else
+        #define EIEIO()
+    #endif
+
+    static hcf_16 IN_PORT_WORD(int port) {
+        hcf_16 value = *(volatile hcf_16 *)(port); EIEIO();
+        value = SwapBytes(value);
+        return value;
+    }
+
+    #define OUT_PORT_WORD(port, value)      \
+            { *(volatile hcf_16 *)(port) = SwapBytes(value); EIEIO(); }
+#else
+    #define IN_PORT_WORD(port) (*(volatile hcf_16 *)(port))
+    #define OUT_PORT_WORD(port, value) (*(volatile hcf_16 *)(port) = (value))
+#endif // __ppc
+
+/***************************************************************************/
+
+#define IN_PORT_STRING_16( port, addr, len)        {                       \
+                        unsigned l = (len);                             \
+                        hcf_16 t, *d = (volatile hcf_16 *)(addr);       \
+                        while (l--) {                                   \
+                            t = IN_PORT_WORD(port);                     \
+                            *d++ = SwapBytes(t);                        \
+                        }                                               \
+                                                }
+
+#define OUT_PORT_STRING_16( port, addr, len)        {                       \
+                        unsigned l = (len);                             \
+                        hcf_16 t, *s = (volatile hcf_16 *)(addr);        \
+                        while (l--) {                                   \
+                            t = *s++;                                   \
+                            OUT_PORT_WORD(port, SwapBytes(t));          \
+                        }                                               \
+                                                }
+
+#if PRODUCT == 9150
+    #define HCF_ASSERT	HCF_ASSERT_MB	// logging via Mailbox
+    #undef MSF_COMPONENT_ID
+#endif // 9150
+
+#endif	// _AM29K
+
+
+
+/************************************************************************************************/
+/*****************************************  MPC860 **********************************************/
+/************************************************************************************************/
+/* known users: RR
+ */
+
+#if defined CPU
+#if CPU == PPC860
+
+#define MSF_COMPONENT_VAR		0
+#define MSF_COMPONENT_ID		0
+#define MSF_COMPONENT_MAJOR_VER	1
+#define MSF_COMPONENT_MINOR_VER	0
+
+#define HCF_BIG_ENDIAN			1
+#define HCF_IO 					HCF_IO_MEM		// overrule standard Port I/O with Memory mapped I/O
+
+#define SwapBytes(t)    /*lint -e572*/(((t) >> 8) + (((t) & 0xff) << 8))/*lint +e572*/
+
+#ifndef __GNUC__
+    #define __asm__     asm
+#endif
+
+#if ! defined _lint
+    #define EIEIO()     __asm__(" eieio")
+#else
+    #define EIEIO()
+#endif
+
+static hcf_16 IN_PORT_WORD(int port) {
+    hcf_16 value = *(volatile hcf_16 *)(port); EIEIO();
+    value = SwapBytes(value);
+    return value;
+    #ifdef __GNUC__
+        /* the following serves to avoid the compiler warnings that
+         * IN_PORT_WORD() is not used in some files */
+        (void)IN_PORT_WORD;
+    #endif
+}
+
+#define OUT_PORT_WORD(port, value)      \
+        { *(volatile hcf_16 *)(port) = SwapBytes(value); EIEIO(); }
+
+/***************************************************************************/
+
+#define IN_PORT_STRING_16( port, addr, len)        {                       \
+                        unsigned l = (len);                             \
+                        hcf_16 t;                                       \
+                        volatile hcf_16 *d = (volatile hcf_16 *)(addr); \
+                        while (l--) {                                   \
+                            t = IN_PORT_WORD(port);                     \
+                            *d++ = SwapBytes(t);                        \
+                        }                                               \
+                                                }
+
+#define OUT_PORT_STRING_16( port, addr, len)        {                       \
+                        unsigned l = (len);                             \
+                        hcf_16 t;                                       \
+                        volatile hcf_16 *s = (volatile hcf_16 *)(addr);  \
+                        while (l--) {                                   \
+                            t = *s++;                                   \
+                            OUT_PORT_WORD(port, SwapBytes(t));          \
+                        }                                               \
+                                                }
+
+#if PRODUCT == 9150
+    #define HCF_ASSERT	HCF_ASSERT_MB	// logging via Mailbox
+    #undef MSF_COMPONENT_ID
+#endif
+
+#endif	/* PPC860 */
+#endif	/* CPU */
+
+
+
+/************************************************************************************************/
+/****************************  Microtec Research 80X86 Compiler *********************************/
+/************************************************************************************************/
+
+#if 0
+
+//#undef HCF_TYPE									// Hermes-I Station F/W without SSN support
+
+#define MSF_COMPONENT_VAR       0
+#define MSF_COMPONENT_ID        0
+#define MSF_COMPONENT_MAJOR_VER 1
+#define MSF_COMPONENT_MINOR_VER 0
+
+extern int far inp( int );
+extern void far outp( int, int );
+extern int far inpw( int );
+extern void far outpw( int, int );
+
+#define IN_PORT_WORD(port)		((hcf_16)inpw( (hcf_io)(port) ))
+#define OUT_PORT_WORD(port, value)	((void)outpw( (hcf_io)(port), value ))
+
+#define IN_PORT_STRING_16( port, addr, len)        {                       \
+                        unsigned l = (len);                             \
+                        hcf_16 *d = (hcf_16 *)(addr);                   \
+                        while (l--) *d++ =  IN_PORT_WORD(port);         \
+                                                }
+
+#define OUT_PORT_STRING_16( port, addr, len)        {                       \
+                        unsigned l = (len);                             \
+                        hcf_16 *s = (hcf_16 *)(addr);                    \
+                        while (l--) OUT_PORT_WORD(port, *s++);          \
+                                                }
+#endif	/* Microtec 80X86 C Compiler */
+
+
+
+/************************************************************************************************/
+/******************************  W A V E L A N  E C  ********************************************/
+/************************************************************************************************/
+/* known users: KM
+ */
+
+#ifdef mc68302
+
+#define	MSF_COMPONENT_ID			COMP_ID_EC
+
+#include <version.h>
+
+#define	MSF_COMPONENT_VAR			1
+#define	MSF_COMPONENT_MAJOR_VER		MAJOR_VERSION
+#define	MSF_COMPONENT_MINOR_VER		MINOR_VERSION
+
+#define HCF_BIG_ENDIAN				1
+#define HCF_IO 						HCF_IO_MEM		// overrule standard Port I/O with Memory mapped I/O
+
+#define SwapBytes(t)	/*lint -e572*/(((t) >> 8) + (((t) & 0xff) << 8))/*lint +e572*/
+
+#define PCMCIA_ADDRESS 0xc80000UL
+
+#define IN_PORT_2BYTES(port)			 (*(hcf_16 *)(port))
+#if 0
+static hcf_16 IN_PORT_WORD(hcf_32 port) // should be hcf_io, not hcf_32
+{
+  hcf_16 word = IN_PORT_2BYTES(port);
+  return SwapBytes(word);
+}
+#else
+static hcf_16 swap_var;
+#define IN_PORT_WORD(port) \
+  (((swap_var = IN_PORT_2BYTES(port)) >> 8) + (((swap_var) & 0xff) << 8))
+#endif
+#define OUT_PORT_2BYTES(port, value)	 (*(hcf_16 *)(port) = (hcf_16)(value))
+#define OUT_PORT_WORD(port, value)		 OUT_PORT_2BYTES(port, SwapBytes(value))
+
+/*
+#define IN_PORT_STRING_16(port, addr, len)	  \
+	while ((len)--) {*(hcf_16 *)(addr) = IN_PORT_2BYTES(port); ((cast)addr) += 2; }
+#define OUT_PORT_STRING_16(port, addr, len)	  \
+	while ((len)--) {OUT_PORT_2BYTES((port), *(hcf_16 *)(addr)) ; ((cast)addr)  += 2; }
+*/
+
+#endif	/* mc68302 */
+
+
+
+/************************************************************************************************/
+/*********************************  NGAP   ***************************************/
+/************************************************************************************************/
+
+#if defined __VX_WORKS__	/* VxWorks */
+
+#if defined WLC_STATION
+//#undef HCF_TYPE 				/* Hermes-I Station F/W without SSN support */
+#define MSF_COMPONENT_ID	COMP_ID_VX_WORKS_ENDSTA
+#else
+#define MSF_COMPONENT_ID	COMP_ID_VX_WORKS_ENDAP
+#endif	// WLC_STATION
+
+#define HCF_YIELD (taskDelay(0) == 0)
+
+#define    MSF_COMPONENT_VAR              1
+#define    MSF_COMPONENT_MAJOR_VER        1
+#define    MSF_COMPONENT_MINOR_VER        0
+
+// #define HCF_ASSERT	HCF_ASSERT_MB	// logging via Mailbox
+
+#if defined PC486BSP
+
+#define IN_PORT_WORD(port)            (sysInWord ((hcf_io)(port)))
+#define OUT_PORT_WORD(port, value)        (sysOutWord ((hcf_io)(port), (hcf_16) (value)))
+#define IN_PORT_STRING_16(port, addr, n)        (sysInWordString ((hcf_io)(port), addr, n))
+#define OUT_PORT_STRING_16(port, addr, n)        (sysOutWordString ((hcf_io)(port), addr, n))
+
+#elif defined AS2000BSP
+
+#define HCF_IO 						HCF_IO_MEM		// overrule standard Port I/O with Memory mapped I/O
+
+/* Define PCI stuff here. */
+unsigned short sysRead16( unsigned short *port );
+void sysWrite16( unsigned short *port, unsigned short value );
+
+#define PCI_IN_BYTE( port ) \
+	*(unsigned char *)( port )
+
+#define PCI_IN_WORD( port ) \
+	sysRead16( (unsigned short *)( port ) )
+
+#define PCI_OUT_BYTE( port, value ) \
+	*(unsigned char *)( port ) = (unsigned char)( value )
+
+#define PCI_OUT_WORD( port, value ) \
+	sysWrite16( (unsigned short *)( port ), (unsigned short)( value ) )
+
+#define IN_PORT_WORD( port ) \
+	PCI_IN_WORD( port )
+
+#define OUT_PORT_WORD( port, value ) \
+	PCI_OUT_WORD( port, value )
+
+#define IN_PORT_STRING_16( port, buf, len ) \
+	do { \
+		hcf_16 *p; \
+	 \
+	 	for ( p = (hcf_16 *)(buf); p < &( (hcf_16 *)(buf) )[ (int)len ]; p++ ) { \
+			*p = PCI_IN_WORD( port ); \
+		} \
+	} while ( 0 )
+
+#define OUT_PORT_STRING_16( port, buf, len ) \
+	do { \
+		const hcf_16 *p; \
+	 \
+	 	for ( p = (const hcf_16 *)( buf ); p < &( (const hcf_16 *)(buf) )[ (int)len ]; p++ ) { \
+			PCI_OUT_WORD( port, *p ); \
+		} \
+	} while ( 0 )
+
+#elif defined FADS860BSP /* elif defined AS2000BSP */
+
+#define HCF_BIG_ENDIAN 1
+
+#define HCF_IO 						HCF_IO_MEM		// overrule standard Port I/O with Memory mapped I/O
+
+#ifndef __GNUC__
+    #define __asm__     asm
+#endif
+
+#if ! defined _lint
+    #define EIEIO()     __asm__(" eieio")
+#else
+    #define EIEIO()
+#endif
+
+static hcf_16 IN_PORT_WORD(int port) {
+    hcf_16 value = *(volatile hcf_16 *)(port); EIEIO();
+    value = ((value & 0xff00) >> 8) + ((value & 0x00ff) << 8);
+/*  value = CNV_LITTLE_TO_SHORT(value); */
+    return value;
+    #ifdef __GNUC__
+        /* the following serves to avoid the compiler warnings that
+         * IN_PORT_WORD() is not used in some files */
+        (void)IN_PORT_WORD;
+    #endif
+}
+
+#define OUT_PORT_WORD(port, value)                                      \
+        { *(volatile hcf_16 *)(port) = CNV_SHORT_TO_LITTLE(value); EIEIO(); }
+
+/***********************************************************************/
+
+#define IN_PORT_STRING_16( port, addr, len)        {                       \
+                        unsigned l = (len);                             \
+                        volatile hcf_16 *d = (volatile hcf_16 *)(addr); \
+                        while (l--) {                                   \
+                            *d++ = *(volatile hcf_16 *)(port);          \
+                            EIEIO();                                    \
+                        }                                               \
+                                                }
+
+#define OUT_PORT_STRING_16( port, addr, len)        {                       \
+                        unsigned l = (len);                             \
+                        volatile hcf_16 *s = (volatile hcf_16 *)(addr);  \
+                        while (l--) {                                   \
+                            *(volatile hcf_16 *)(port) = *s++;          \
+                            EIEIO();                                    \
+                        }                                               \
+                                                }
+
+#elif defined DAYTONABSP
+
+#define HCF_BIG_ENDIAN 1
+
+#define HCF_IO 						HCF_IO_MEM		// overrule standard Port I/O with Memory mapped I/O
+
+#ifndef __GNUC__
+    #define __asm__     asm
+#endif
+
+#define IN_PORT_WORD(port)              (sysOrinocoInWord((unsigned long)(port)))
+#define OUT_PORT_WORD(port,value)       (sysOrinocoOutWord((unsigned long)(port), (unsigned short)(value)))
+
+#define IN_PORT_STRING_16(port,addr,len)   (sysOrinocoInString((port), (addr), (len)))
+#define OUT_PORT_STRING_16(port,addr,len)   (sysOrinocoOutString((port), (addr), (len)))
+
+extern unsigned char    sysOrinocoInByte    (unsigned long port);
+extern unsigned short   sysOrinocoInWord    (unsigned long port);
+extern void             sysOrinocoInString  (unsigned long port, void *addr, unsigned short len);
+
+extern void             sysOrinocoOutByte   (unsigned long port, unsigned char value);
+extern void             sysOrinocoOutWord   (unsigned long port, unsigned short value);
+extern void             sysOrinocoOutString (unsigned long port, void *addr, unsigned short len);
+
+#elif defined ALPHA_BSP
+
+#define HCF_BIG_ENDIAN 1
+
+#define HCF_IO 						HCF_IO_MEM		// overrule standard Port I/O with Memory mapped I/O
+
+#ifndef __GNUC__
+    #define __asm__     asm
+#endif
+
+#define IN_PORT_WORD(port)              (sysOrinocoInWord((unsigned long)(port)))
+#define OUT_PORT_WORD(port,value)       (sysOrinocoOutWord((unsigned long)(port), (unsigned short)(value)))
+
+#define IN_PORT_STRING_16(port,addr,len)   (sysOrinocoInString((port), (addr), (len)))
+#define OUT_PORT_STRING_16(port,addr,len)   (sysOrinocoOutString((port), (addr), (len)))
+
+extern unsigned char    sysOrinocoInByte    (unsigned long port);
+extern unsigned short   sysOrinocoInWord    (unsigned long port);
+extern void             sysOrinocoInString  (unsigned long port, void *addr, unsigned short len);
+
+extern void             sysOrinocoOutByte   (unsigned long port, unsigned char value);
+extern void             sysOrinocoOutWord   (unsigned long port, unsigned short value);
+extern void             sysOrinocoOutString (unsigned long port, void *addr, unsigned short len);
+
+#else
+
+err: /* commented here */ /*	"BSP is not defined..." */
+
+#endif	/* else PC486BSP */
+
+#endif	// __VX_WORKS__
+
+
+
+/************************************************************************************************/
+/******************************  VXWORKS. Motorola Sandpoint PowerPC 824X ***********************/
+/************************************************************************************************/
+#ifdef __VX_WORKS_SANDPOINT_824X__
+
+#include <vxWorks.h>
+#include <sysLib.h>
+#include <taskLib.h>
+
+#ifdef WVLAN_53
+#define	MSF_COMPONENT_ID            COMP_ID_VX_WORKS_ENDSTA
+#endif /* WVLAN_53 */
+
+#ifdef WVLAN_54
+#define	MSF_COMPONENT_ID            COMP_ID_VX_WORKS_ENDAP
+#endif /* WVLAN_54 */
+
+#ifdef WVLAN_56
+#define	MSF_COMPONENT_ID            COMP_ID_VX_WORKS_END
+#endif /* WVLAN_56 */
+
+#if !defined MSF_COMPONENT_ID
+#error "you must define an MSF component ID: WVLAN_53, WVLAN_54, WVLAN_56"
+#endif
+
+#define	MSF_COMPONENT_VAR			1
+
+#define HCF_EXT                         HCF_EXT_INFO_LOG
+#define HCF_SLEEP                       ( HCF_CDS | HCF_DDS )
+//#define HCF_SLEEP                       ( HCF_DDS )
+
+#ifndef HCF_ACT_WAKEUP
+#define HCF_ACT_WAKEUP                  0x1D
+#endif // HCF_ACT_WAKEUP
+
+#if defined FATNIC | defined BEAGLE_H253
+#define T1__HCF_TYPE                    HCF_TYPE_STA
+#else
+#define T1__HCF_TYPE                    HCF_TYPE_AP | HCF_TYPE_STA
+#endif
+
+#ifdef HERMES_USB
+#define T2__HCF_TYPE					(T1__HCF_TYPE | HCF_TYPE_USB)
+#else // HERMES_USB
+#define T2__HCF_TYPE					(T1__HCF_TYPE)
+#endif // HERMES_USB
+
+#ifdef _WARP
+#define T3__HCF_TYPE					(T2__HCF_TYPE | HCF_TYPE_HII5)
+#else // _WARP
+#define T3__HCF_TYPE					(T2__HCF_TYPE | HCF_TYPE_WPA | HCF_TYPE_HII)
+#endif // WARP
+
+#ifdef _CCX
+#define T4__HCF_TYPE					(T3__HCF_TYPE | HCF_TYPE_CCX)
+#else // _WARP
+#define T4__HCF_TYPE					(T3__HCF_TYPE)
+#endif // _CCX
+
+#define T5__HCF_TYPE					(T4__HCF_TYPE)
+
+// Default to TYPE_AP + SSN!
+#define HCF_TYPE						(T5__HCF_TYPE )
+
+
+
+#define	MSF_COMPONENT_MAJOR_VER		2
+#define	MSF_COMPONENT_MINOR_VER		0
+
+#define HCF_IO                      HCF_IO_MEM
+#define HCF_DMA                     0
+#define HCF_MEM_IO                  1
+#define HCF_BIG_ENDIAN              1
+
+//#define support_32bits 1
+
+#define IN_PORT_WORD(port)			        (sysInWord( (hcf_io)(port) ))
+#define OUT_PORT_WORD(port, value)	        (sysOutWord( (hcf_io)(port), (hcf_16)(value) ))
+#define IN_PORT_DWORD(port)			        (sysInLong( (hcf_io)(port) ))
+#define OUT_PORT_DWORD(port, value)	        (sysOutLong( (hcf_io)(port), (hcf_16)(value) ))
+#define IN_PORT_STRING_16(port, dst, n)	    (sysInWordString((hcf_io)(port), (hcf_16 *)dst, n))
+#define OUT_PORT_STRING_16(port, src, n)    (sysOutWordString((hcf_io)(port), (hcf_16 *)src, n))
+
+#ifdef WVLAN_DEBUG
+#define DBG                         1
+#define _DEBUG                      1
+#endif
+
+/* we'll need to add these prints someday */
+#define OUTPUTDEBUGMSG(dprintf_exp)
+#define ASSERTDEBUGMSG(cond, dprintf_exp)
+
+#define HCF_INTERFACE_CONNECT(ifbp)
+#define HCF_INTERFACE_DISCONNECT(ifbp)
+#define HCF_ENTER_INTERFACE_FUNCT(ibfb)
+#define HCF_LEAVE_INTERFACE_FUNCT(ifbp)
+
+#define CNV_END_INT(w)    ( ((hcf_16)(w) & 0x00FF) << 8 | ((hcf_16)(w) & 0xFF00) >> 8 )
+#define CNV_LITTLE_TO_INT(w)	CNV_END_INT(w)
+#define CNV_INT_TO_LITTLE(w)	CNV_LITTLE_TO_INT(w)
+
+#endif /* __VX_WORKS_SANDPOINT_824X__ */
+
+/************************************************************************************************/
+/*************************************  VXWORKS. ARM T8300 IPPhone  *****************************/
+/************************************************************************************************/
+#if defined( IPT_T8300 ) || defined( IPT_T8307 )
+
+#include <vxWorks.h>
+#include <sysLib.h>
+#include <taskLib.h>
+
+#define HCF_ALIGN                   4       /* default to 4 byte alignment */
+
+#define BEAGLE_H253	/* Hermes 2.5.3 build, better to be in the project file */
+#define OOR_DDS		/* Hermes 2.5.3 build, better to be in the project file */
+#define FATNIC
+
+
+#ifdef WVLAN_53
+#define	MSF_COMPONENT_ID            COMP_ID_VX_WORKS_ENDSTA
+#endif /* WVLAN_53 */
+
+#ifdef WVLAN_54
+#define	MSF_COMPONENT_ID            COMP_ID_VX_WORKS_ENDAP
+#endif /* WVLAN_54 */
+
+#ifdef WVLAN_56
+#define	MSF_COMPONENT_ID            COMP_ID_VX_WORKS_END
+#endif /* WVLAN_56 */
+
+#if !defined MSF_COMPONENT_ID
+#error "you must define an MSF component ID: WVLAN_53, WVLAN_54, WVLAN_56"
+#endif
+
+#define	MSF_COMPONENT_VAR			1
+
+#define HCF_EXT                         HCF_EXT_INFO_LOG
+//#define HCF_EXT                         HCF_EXT_INFO_LOG | HCF_EXT_MB
+#define HCF_SLEEP                       ( HCF_CDS | HCF_DDS )
+//#define HCF_SLEEP                       ( HCF_DDS )
+
+#ifndef HCF_ACT_WAKEUP
+#define HCF_ACT_WAKEUP                  0x1D
+#endif // HCF_ACT_WAKEUP
+
+#if defined FATNIC || defined BEAGLE_H253
+#define T1__HCF_TYPE                    HCF_TYPE_STA
+#else
+//#define T1__HCF_TYPE                    HCF_TYPE_AP | HCF_TYPE_STA
+#define T1__HCF_TYPE                    HCF_TYPE_STA		/* dz, Station code only */
+#endif
+
+#ifdef HERMES_USB
+#define T2__HCF_TYPE					(T1__HCF_TYPE | HCF_TYPE_USB)
+#else // HERMES_USB
+#define T2__HCF_TYPE					(T1__HCF_TYPE)
+#endif // HERMES_USB
+
+#ifdef _WARP
+#define T3__HCF_TYPE					(T2__HCF_TYPE | HCF_TYPE_HII5)
+#else // _WARP
+#define T3__HCF_TYPE					(T2__HCF_TYPE | HCF_TYPE_WPA | HCF_TYPE_HII)
+//#define T3__HCF_TYPE					(T2__HCF_TYPE | HCF_TYPE_HII)	/* dz. no WPA support at this time, test code */
+#endif // WARP
+
+#ifdef _CCX
+#define T4__HCF_TYPE					(T3__HCF_TYPE | HCF_TYPE_CCX)
+#else // _WARP
+#define T4__HCF_TYPE					(T3__HCF_TYPE)
+#endif // _CCX
+
+#define T5__HCF_TYPE					(T4__HCF_TYPE)
+
+// Default to TYPE_AP + SSN!
+#define HCF_TYPE						(T5__HCF_TYPE )
+
+
+#define	MSF_COMPONENT_MAJOR_VER		2
+#define	MSF_COMPONENT_MINOR_VER		0
+
+#define HCF_IO                      HCF_IO_MEM
+#define HCF_DMA                     0
+#define HCF_MEM_IO                  1
+
+
+/* Endian is determined by vxWorks project compile option */
+#if (_BYTE_ORDER == _BIG_ENDIAN)
+#undef  HCF_LITTLE_ENDIAN
+#define HCF_BIG_ENDIAN              1
+#endif
+
+
+#define CNV_END(w)    ( ((hcf_16)(w) & 0x00FF) << 8 | ((hcf_16)(w) & 0xFF00) >> 8 )
+#if defined HCF_BIG_ENDIAN
+//******************************************** B I G   E N D I A N *******************************************
+#define CNV_LITTLE_TO_INT(w)    CNV_END(w)	//    endianess conversion needed
+#define CNV_BIG_TO_INT(w)		(w)			// no endianess conversion needed
+#else
+//****************************************** L I T T L E   E N D I A N ****************************************
+#define CNV_LITTLE_TO_INT(w) 	(w)			// no endianess conversion needed
+#define CNV_BIG_TO_INT(w)       CNV_END(w)	//    endianess conversion needed
+#endif // HCF_BIG_ENDIAN
+
+// conversion macros which can be expressed in other macros
+#define CNV_INT_TO_LITTLE(w)	CNV_LITTLE_TO_INT(w)
+#define CNV_INT_TO_BIG(w)		CNV_BIG_TO_INT(w)
+
+
+
+#define IN_PORT_WORD( port )            *((volatile hcf_16 *)( port ))
+#define OUT_PORT_WORD( port, value )    *((volatile hcf_16 *)( port )) = ((hcf_16)( value ))
+//#define IN_PORT_BYTE( port )            *((volatile hcf_8 *)( port ))
+
+#define IN_PORT_STRING( port, addr, len) {		\
+	unsigned l = len;								\
+	hcf_16  *d = (hcf_16 *)(addr);					\
+	hcf_16   t;										\
+	while (l--) {									\
+		t = IN_PORT_WORD(port);						\
+		*d++ = CNV_LITTLE_TO_INT(t);				\
+	}												\
+} // IN_PORT_STRING
+
+#define OUT_PORT_STRING( port, addr, len) {		\
+	unsigned l = (len);								\
+	hcf_16  *s = (hcf_16 *)(addr);					\
+	hcf_16   t;										\
+	while (l--) {									\
+		t = *s++;									\
+		t = CNV_LITTLE_TO_INT(t);					\
+		OUT_PORT_WORD(port, t);						\
+	}												\
+} // OUT_PORT_STRING
+
+#define IN_PORT_STRING_16(port, dst, n)	    {	\
+	unsigned l = (n);								\
+	hcf_16  *d = (hcf_16 *)(dst);					\
+	while (l--) {									\
+		*d++ = IN_PORT_WORD(port);					\
+	}												\
+} // IN_PORT_STRING_16
+
+#define OUT_PORT_STRING_16(port, src, n)	{	\
+	hcf_16   t;										\
+	int l = (n);									\
+	hcf_16  *s = (hcf_16 *)(src);					\
+	while (l--) {									\
+		t = *s++;									\
+		OUT_PORT_WORD(port, t);						\
+	}												\
+} // OUT_PORT_STRING_16
+
+/* #define HCF_YIELD                       (taskDelay(0) == 0) */
+
+
+
+#ifdef WVLAN_DEBUG
+#define DBG                         1
+#define _DEBUG                      1
+#endif
+
+/* we'll need to add these prints someday */
+#define OUTPUTDEBUGMSG(dprintf_exp)
+#define ASSERTDEBUGMSG(cond, dprintf_exp)
+
+#define HCF_INTERFACE_CONNECT(ifbp)
+#define HCF_INTERFACE_DISCONNECT(ifbp)
+#define HCF_ENTER_INTERFACE_FUNCT(ibfb)
+#define HCF_LEAVE_INTERFACE_FUNCT(ifbp)
+
+#define sysInWord(offsetAddr)  IN_PORT_WORD(offsetAddr)
+#define sysInByte(offsetAddr)  IN_PORT_BYTE(offsetAddr)
+#define sysOutWord(addr, value) OUT_PORT_WORD(addr, value)
+
+#endif /*IPT_T8300 */
+
+/************************************************************************************************************/
+/***********************************                                   **************************************/
+/************************************************************************************************************/
+#if ! defined 	HCF_ALIGN
+#define 		HCF_ALIGN			1		//default to no alignment
+#endif // 		HCF_ALIGN
+
+#if ! defined 	HCF_ASSERT
+#define 		HCF_ASSERT			0
+#endif //		HCF_ASSERT
+
+#if ! defined	HCF_BIG_ENDIAN
+#define 		HCF_BIG_ENDIAN		0
+#endif // 		HCF_BIG_ENDIAN
+
+#if ! defined	HCF_DL_ONLY
+#define 		HCF_DL_ONLY			0
+#endif // 		HCF_DL_ONLY
+
+#if ! defined	HCF_DMA
+#define 		HCF_DMA				0
+#endif // 		HCF_DMA
+
+#if ! defined	HCF_ENCAP
+#define			HCF_ENCAP			HCF_ENC
+#endif //		HCF_ENCAP
+
+#if ! defined	HCF_ENTRY
+#define			HCF_ENTRY( ifbp )
+#endif //		HCF_ENTRY
+
+#if ! defined	HCF_EXIT
+#define			HCF_EXIT( ifbp )
+#endif //		HCF_EXIT
+
+#if ! defined	HCF_EXT
+#define			HCF_EXT				0
+#endif //		HCF_EXT
+
+#if ! defined	HCF_INT_ON
+#define			HCF_INT_ON			1
+#endif //		HCF_INT_ON
+
+#if ! defined	HCF_IO
+#define			HCF_IO				0		//default 16 bits support only, port I/O
+#endif //		HCF_IO
+
+#if ! defined	HCF_LEGACY
+#define			HCF_LEGACY			0
+#endif //		HCF_LEGACY
+
+#if ! defined	HCF_MAX_LTV
+#define 		HCF_MAX_LTV			1200	// sufficient for all known purposes
+#endif //		HCF_MAX_LTV
+
+#if ! defined	HCF_PROT_TIME
+#define 		HCF_PROT_TIME		100		// number of 10K microsec protection timer against H/W malfunction
+#endif // 		HCF_PROT_TIME
+
+#if ! defined	HCF_SLEEP
+#define			HCF_SLEEP			0
+#endif //		HCF_SLEEP
+
+#if ! defined	HCF_TALLIES
+#define			HCF_TALLIES			( HCF_TALLIES_NIC | HCF_TALLIES_HCF )
+#endif //		HCF_TALLIES
+
+#if ! defined 	HCF_TYPE
+#define 		HCF_TYPE 			0
+#endif //		HCF_TYPE
+
+#if				HCF_BIG_ENDIAN
+#undef			HCF_BIG_ENDIAN
+#define			HCF_BIG_ENDIAN		1		//just for convenience of generating cfg_hcf_opt
+#endif //	 	HCF_BIG_ENDIAN
+
+#if				HCF_DL_ONLY
+#undef			HCF_DL_ONLY
+#define			HCF_DL_ONLY			1		//just for convenience of generating cfg_hcf_opt
+#endif //		HCF_DL_ONLY
+
+#if				HCF_DMA
+#undef			HCF_DMA
+#define			HCF_DMA				1		//just for convenience of generating cfg_hcf_opt
+#endif //		HCF_DMA
+
+#if				HCF_INT_ON
+#undef			HCF_INT_ON
+#define			HCF_INT_ON			1		//just for convenience of generating cfg_hcf_opt
+#endif //		HCF_INT_ON
+
+
+#if ! defined IN_PORT_STRING_8_16
+#define  IN_PORT_STRING_8_16(port, addr, len)	IN_PORT_STRING_16(port, addr, len)
+#define  OUT_PORT_STRING_8_16(port, addr, len)	OUT_PORT_STRING_16(port, addr, len)
+#endif // IN_PORT_STRING_8_16
+
+/************************************************************************************************/
+/**********                                                                         *************/
+/************************************************************************************************/
+
+#if ! defined	FAR
+#define 		FAR						// default to flat 32-bits code
+#endif // 		FAR
+
+typedef hcf_8  FAR *wci_bufp;			// segmented 16-bits or flat 32-bits pointer to 8 bits unit
+typedef hcf_16 FAR *wci_recordp;		// segmented 16-bits or flat 32-bits pointer to 16 bits unit
+
+/*	I/O Address size
+*	Platforms which use port mapped I/O will (in general) have a 64k I/O space, conveniently expressed in a
+*	16-bits quantity
+*	Platforms which use memory mapped I/O will (in general) have an I/O space much larger than 64k, and need a
+*	32-bits quantity to express the I/O base
+*/
+
+#if HCF_IO & HCF_IO_MEM
+typedef hcf_32 hcf_io;
+#else
+typedef hcf_16 hcf_io;
+#endif //HCF_IO
+
+#if 	HCF_PROT_TIME > 128
+#define HCF_PROT_TIME_SHFT	3
+#define HCF_PROT_TIME_DIV	8
+#elif 	HCF_PROT_TIME > 64
+#define HCF_PROT_TIME_SHFT	2
+#define HCF_PROT_TIME_DIV	4
+#elif 	HCF_PROT_TIME > 32
+#define HCF_PROT_TIME_SHFT	1
+#define HCF_PROT_TIME_DIV	2
+#else //HCF_PROT_TIME >= 19
+#define HCF_PROT_TIME_SHFT	0
+#define HCF_PROT_TIME_DIV	1
+#endif
+
+#define HCF_PROT_TIME_CNT (HCF_PROT_TIME / HCF_PROT_TIME_DIV)
+
+
+/************************************************************************************************************/
+/******************************************* . . . . . . . . .  *********************************************/
+/************************************************************************************************************/
+
+/* MSF_COMPONENT_ID is used to define the CFG_IDENTITY_STRCT in HCF.C
+* CFG_IDENTITY_STRCT is defined in HCF.C purely based on convenience arguments.
+* The HCF can not have the knowledge to determine the ComponentId field of the Identity record (aka as
+* Version Record), therefore the MSF part of the Drivers must supply this value via the System Constant
+* MSF_COMPONENT_ID.
+* There is a set of values predefined in MDD.H (format COMP_ID_.....)
+*
+* Note that taking MSF_COMPONENT_ID as a default value for DUI_COMPAT_VAR is purely an implementation
+* convenience, the numerical values of these two quantities have none functional relationship whatsoever.
+*/
+
+#if defined	MSF_COMPONENT_ID
+
+#if ! defined	DUI_COMPAT_VAR
+#define			DUI_COMPAT_VAR		MSF_COMPONENT_ID
+#endif //		DUI_COMPAT_VAR
+
+#if ! defined	DUI_COMPAT_BOT		//;?this way utilities can lower as well raise the bottom
+#define			DUI_COMPAT_BOT		8
+#endif //		DUI_COMPAT_BOT
+
+#if ! defined	DUI_COMPAT_TOP		//;?this way utilities can lower as well raise the top
+#define			DUI_COMPAT_TOP       8
+#endif //		DUI_COMPAT_TOP
+
+#endif // MSF_COMPONENT_ID
+
+#if (HCF_TYPE) & HCF_TYPE_HII5
+
+#if ! defined	HCF_HSI_VAR_5
+#define			HCF_HSI_VAR_5
+#endif //		HCF_HSI_VAR_5
+
+#if ! defined	HCF_APF_VAR_4
+#define			HCF_APF_VAR_4
+#endif //		HCF_APF_VAR_4
+
+#if (HCF_TYPE) & HCF_TYPE_WARP
+#if ! defined	HCF_STA_VAR_4
+#define			HCF_STA_VAR_4
+#endif //		HCF_STA_VAR_4
+#else
+#if ! defined	HCF_STA_VAR_2
+#define			HCF_STA_VAR_2
+#endif //		HCF_STA_VAR_2
+#endif
+
+#if defined HCF_HSI_VAR_4
+err: HSI variants 4 correspond with HII;
+#endif // HCF_HSI_VAR_4
+
+#else
+
+#if ! defined	HCF_HSI_VAR_4
+#define			HCF_HSI_VAR_4		//Hermes-II all types (for the time being!)
+#endif //		HCF_HSI_VAR_4
+
+#if ! defined	HCF_APF_VAR_2
+#define 		HCF_APF_VAR_2
+#endif //		HCF_APF_VAR_2
+
+#if ! defined	HCF_STA_VAR_2
+#define			HCF_STA_VAR_2
+#endif //		HCF_STA_VAR_2
+
+#endif // HCF_TYPE_HII5
+
+#if ! defined	HCF_PRI_VAR_3
+#define		HCF_PRI_VAR_3
+#endif //		HCF_PRI_VAR_3
+
+#if defined HCF_HSI_VAR_1 || defined HCF_HSI_VAR_2 || defined HCF_HSI_VAR_3
+err: HSI variants 1, 2 and 3 correspond with H-I only;
+#endif // HCF_HSI_VAR_1, HCF_HSI_VAR_2, HCF_HSI_VAR_3
+
+#if defined HCF_PRI_VAR_1 || defined HCF_PRI_VAR_2
+err: primary variants 1 and 2 correspond with H-I only;
+#endif // HCF_PRI_VAR_1 / HCF_PRI_VAR_2
+
+
+/************************************************************************************************************/
+/******************************************* . . . . . . . . .  *********************************************/
+/************************************************************************************************************/
+
+
+/* The BASED customization macro is used to resolves the SS!=DS conflict for the Interrupt Service logic in
+ * DOS Drivers. Due to the cumbersomeness of mixing C and assembler local BASED variables still end up in the
+ * wrong segment. The workaround is that the HCF uses only global BASED variables or IFB-based variables.
+ * The "BASED" construction (supposedly) only amounts to something in the small memory model.
+ *
+ * Note that the whole BASED rigmarole is needlessly complicated because both the Microsoft Compiler and
+ * Linker are unnecessary restrictive in what far pointer manipulation they allow
+ */
+
+#if ! defined	BASED
+#define 		BASED
+#endif //		BASED
+
+#if ! defined	EXTERN_C
+#ifdef __cplusplus
+#define			EXTERN_C extern "C"
+#else
+#define			EXTERN_C
+#endif // __cplusplus
+#endif //		EXTERN_C
+
+#if ! defined	NULL
+#define			NULL	((void *) 0)
+#endif //		NULL
+
+#if ! defined	TEXT
+#define			TEXT(x)	x
+#endif //		TEXT
+
+#if !defined	_TCHAR_DEFINED
+#define 		TCHAR	char
+#endif //		_TCHAR_DEFINED
+
+/************************************************************************************************************/
+/*********************** C O N F L I C T   D E T E C T I O N  &  R E S O L U T I O N ************************/
+/************************************************************************************************************/
+#if defined HCF_LITTLE_ENDIAN
+err: HCF_LITTLE_ENDIAN is obsolete;
+#endif // 	HCF_LITTLE_ENDIAN
+
+#if defined HCF_INT_OFF
+err: HCF_INT_OFF is obsolete;
+#endif //HCF_INT_OFF
+
+#if HCF_ALIGN != 1 && HCF_ALIGN != 2 && HCF_ALIGN != 4 && HCF_ALIGN != 8
+err: invalid value for HCF_ALIGN;
+#endif // HCF_ALIGN
+
+#if (HCF_ASSERT) & ~( HCF_ASSERT_PRINTF | HCF_ASSERT_SW_SUP | HCF_ASSERT_MB | HCF_ASSERT_RT_MSF_RTN | \
+					  HCF_ASSERT_LNK_MSF_RTN )
+err: invalid value for HCF_ASSERT;
+#endif // HCF_ASSERT
+
+#if (HCF_ASSERT) & HCF_ASSERT_MB && ! ( (HCF_EXT) & HCF_EXT_MB )		//detect potential conflict
+err: these macros are not used consistently;
+#endif // HCF_ASSERT_MB / HCF_EXT_MB
+
+#if HCF_BIG_ENDIAN != 0 && HCF_BIG_ENDIAN != 1
+err: invalid value for HCF_BIG_ENDIAN;
+#endif // HCF_BIG_ENDIAN
+
+#if HCF_DL_ONLY != 0 && HCF_DL_ONLY != 1
+err: invalid value for HCF_DL_ONLY;
+#endif // HCF_DL_ONLY
+
+#if HCF_DMA != 0 && HCF_DMA != 1
+err: invalid value for HCF_DMA;
+#endif // HCF_DMA
+
+#if (HCF_ENCAP) & ~( HCF_ENC | HCF_ENC_SUP )
+err: invalid value for HCF_ENCAP;
+#endif // HCF_ENCAP
+
+#if (HCF_EXT) & ~( HCF_EXT_INFO_LOG | HCF_EXT_INT_TX_EX | HCF_EXT_TALLIES_FW | HCF_EXT_TALLIES_HCF	| \
+				   HCF_EXT_NIC_ACCESS | HCF_EXT_MB | HCF_EXT_INT_TICK | \
+				   HCF_EXT_IFB_STRCT | HCF_EXT_DESC_STRCT | HCF_EXT_TX_CONT )
+err: invalid value for HCF_EXT;
+#endif // HCF_EXT
+
+#if HCF_INT_ON != 0 && HCF_INT_ON != 1
+err: invalid value for HCF_INT_ON;
+#endif // HCF_INT_ON
+
+#if (HCF_IO) & ~( HCF_IO_MEM | HCF_IO_32BITS )
+err: invalid value for HCF_IO;
+#endif // HCF_IO
+
+#if HCF_LEGACY != 0 && HCF_LEGACY != 1
+err: invalid value for HCF_LEGACY;
+#endif // HCF_LEGACY
+
+#if HCF_MAX_LTV < 16 || HCF_MAX_LTV > 2304
+err: invalid value for HCF_MAX_LTV;
+#endif // HCF_MAX_LTV
+
+#if HCF_PROT_TIME != 0 && ( HCF_PROT_TIME < 19 || 256 < HCF_PROT_TIME )
+err: below minimum .08 second required by Hermes or possibly above hcf_32 capacity;
+#endif // HCF_PROT_TIME
+
+#if (HCF_SLEEP) & ~( HCF_CDS | HCF_DDS )
+err: invalid value for HCF_SLEEP;
+#endif // HCF_SLEEP
+
+#if (HCF_SLEEP) && ! (HCF_INT_ON)
+err: these macros are not used consistently;
+#endif // HCF_SLEEP / HCF_INT_ON
+
+#if (HCF_SLEEP) && ! ( (HCF_EXT) & HCF_EXT_INT_TICK )
+//;? err: these macros are not used consistently;
+#endif // HCF_SLEEP / HCF_EXT_INT_TICK
+
+#if (HCF_TALLIES) & ~( HCF_TALLIES_HCF | HCF_TALLIES_NIC | HCF_TALLIES_RESET ) || \
+	(HCF_TALLIES) == HCF_TALLIES_RESET
+err: invalid value for HCF_TALLIES;
+#endif // HCF_TALLIES
+
+#if (HCF_TYPE) & ~(HCF_TYPE_WPA | HCF_TYPE_USB | HCF_TYPE_PRELOADED | HCF_TYPE_HII5 | HCF_TYPE_WARP | \
+		HCF_TYPE_CCX /* | HCF_TYPE_TX_DELAY */ )
+err: invalid value for HCF_TYPE;
+#endif //HCF_TYPE
+
+#if (HCF_TYPE) & HCF_TYPE_WARP && (HCF_TYPE) & HCF_TYPE_WPA
+err: at most 1 of these macros should be defined;
+#endif //HCF_TYPE_WARP / HCF_TYPE_WPA
+
+#endif //HCFCFG_H
+
diff --git a/drivers/staging/wlags49_h2/hcfdef.h b/drivers/staging/wlags49_h2/hcfdef.h
new file mode 100644
index 000000000000..f7e74bfbadfa
--- /dev/null
+++ b/drivers/staging/wlags49_h2/hcfdef.h
@@ -0,0 +1,809 @@
+
+//   vim:tw=110:ts=4:
+#ifndef HCFDEFC_H
+#define HCFDEFC_H 1
+
+/*************************************************************************************************
+*
+* FILE	 : HCFDEF.H
+*
+* DATE   : $Date: 2004/08/05 11:47:10 $   $Revision: 1.8 $
+* Original: 2004/05/28 14:05:35    Revision: 1.59      Tag: hcf7_t20040602_01
+* Original: 2004/05/13 15:31:45    Revision: 1.53      Tag: hcf7_t7_20040513_01
+* Original: 2004/04/15 09:24:42    Revision: 1.44      Tag: hcf7_t7_20040415_01
+* Original: 2004/04/13 14:22:45    Revision: 1.43      Tag: t7_20040413_01
+* Original: 2004/04/01 15:32:55    Revision: 1.40      Tag: t7_20040401_01
+* Original: 2004/03/10 15:39:28    Revision: 1.36      Tag: t20040310_01
+* Original: 2004/03/03 14:10:12    Revision: 1.34      Tag: t20040304_01
+* Original: 2004/03/02 09:27:12    Revision: 1.32      Tag: t20040302_03
+* Original: 2004/02/24 13:00:29    Revision: 1.29      Tag: t20040224_01
+* Original: 2004/02/18 17:13:57    Revision: 1.26      Tag: t20040219_01
+*
+* AUTHOR : Nico Valster
+*
+* SPECIFICATION: ...........
+*
+* DESC   : Definitions and Prototypes for HCF only
+*
+**************************************************************************************************
+*
+*
+* SOFTWARE LICENSE
+*
+* This software is provided subject to the following terms and conditions,
+* which you should read carefully before using the software.  Using this
+* software indicates your acceptance of these terms and conditions.  If you do
+* not agree with these terms and conditions, do not use the software.
+*
+* COPYRIGHT © 1994 - 1995	by AT&T.				All Rights Reserved
+* COPYRIGHT © 1996 - 2000 by Lucent Technologies.	All Rights Reserved
+* COPYRIGHT © 2001 - 2004	by Agere Systems Inc.	All Rights Reserved
+* All rights reserved.
+*
+* Redistribution and use in source or binary forms, with or without
+* modifications, are permitted provided that the following conditions are met:
+*
+* . Redistributions of source code must retain the above copyright notice, this
+*    list of conditions and the following Disclaimer as comments in the code as
+*    well as in the documentation and/or other materials provided with the
+*    distribution.
+*
+* . Redistributions in binary form must reproduce the above copyright notice,
+*    this list of conditions and the following Disclaimer in the documentation
+*    and/or other materials provided with the distribution.
+*
+* . Neither the name of Agere Systems Inc. nor the names of the contributors
+*    may be used to endorse or promote products derived from this software
+*    without specific prior written permission.
+*
+* Disclaimer
+*
+* THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
+* INCLUDING, BUT NOT LIMITED TO, INFRINGEMENT AND THE IMPLIED WARRANTIES OF
+* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  ANY
+* USE, MODIFICATION OR DISTRIBUTION OF THIS SOFTWARE IS SOLELY AT THE USERS OWN
+* RISK. IN NO EVENT SHALL AGERE SYSTEMS INC. OR CONTRIBUTORS BE LIABLE FOR ANY
+* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+* ON ANY THEORY OF LIABILITY, INCLUDING, BUT NOT LIMITED TO, CONTRACT, STRICT
+* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+* OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+* DAMAGE.
+*
+*
+*************************************************************************************************/
+
+
+/************************************************************************************************/
+/*********************************  P R E F I X E S  ********************************************/
+/************************************************************************************************/
+//IFB_		Interface Block
+//HCMD_		Hermes Command
+//HFS_		Hermes (Transmit/Receive) Frame Structure
+//HREG_		Hermes Register
+
+/*************************************************************************************************/
+
+#if 0 //
+#define BIT0  0x0001
+#define BIT1  0x0002
+#define BIT2  0x0004
+#define BIT3  0x0008
+#define BIT4  0x0010
+#define BIT5  0x0020
+#define BIT6  0x0040
+#define BIT7  0x0080
+#define BIT8  0x0100
+#define BIT9  0x0200
+#define BIT10 0x0400
+#define BIT11 0x0800
+#define BIT12 0x1000
+#define BIT13 0x2000
+#define BIT14 0x4000
+#define BIT15 0x8000
+#define BIT16 0x00010000
+#define BIT17 0x00020000
+#define BIT18 0x00040000
+#define BIT19 0x00080000
+#define BIT20 0x00100000
+#define BIT21 0x00200000
+#define BIT22 0x00400000
+#define BIT23 0x00800000
+#define BIT24 0x01000000
+#define BIT25 0x02000000
+#define BIT26 0x04000000
+#define BIT27 0x08000000
+#define BIT28 0x10000000
+#define BIT29 0x20000000
+#define BIT30 0x40000000
+#define BIT31 0x80000000
+#endif // 0
+
+/************************************************************************************************/
+/********************************* GENERAL EQUATES **********************************************/
+/************************************************************************************************/
+
+
+#define HCF_MAGIC				0x7D37	// "}7" Handle validation
+
+#define	PLUG_DATA_OFFSET        0x00000800	//needed by some test tool on top of H-II NDIS driver
+
+#define INI_TICK_INI			0x00040000L
+
+#define IO_IN					0		//hcfio_in_string
+#define IO_OUT					1		//hcfio_out_string
+
+//DO_ASSERT, create an artificial FALSE to force an ASSERT without the nasty compiler warning
+#define DO_ASSERT				( assert_ifbp->IFB_Magic != HCF_MAGIC && assert_ifbp->IFB_Magic == HCF_MAGIC )
+#define NT_ASSERT				0x0000		//, NEVER_TESTED
+#define NEVER_TESTED			MERGE_2( 0xEFFE, 0xFEEF )
+#define SE_ASSERT				0x5EFF		/* Side Effect, HCFASSERT invokation which are only called for the
+											 * side effect and which should never trigger */
+#define DHF_FILE_NAME_OFFSET	10000		//to distinguish DHF from HCF asserts by means of line number
+#define MMD_FILE_NAME_OFFSET	20000		//to distinguish MMD from HCF asserts by means of line number
+
+// trace codes used to
+// 1: profile execution times via HCF_TRACE and HCF_TRACE_VALUE
+// 2: hierarchical flow information via HCFLOGENTRY / HCFLOGEXIT
+
+//#define HCF_TRACE_CONNECT		useless
+//#define HCF_TRACE_DISCONNECT	useless
+#define HCF_TRACE_ACTION		0x0000  // 0x0001
+#define HCF_TRACE_CNTL			0x0001  // 0x0002
+#define HCF_TRACE_DMA_RX_GET	0x0002  // 0x0004
+#define HCF_TRACE_DMA_RX_PUT	0x0003  // 0x0008
+#define HCF_TRACE_DMA_TX_GET	0x0004  // 0x0010
+#define HCF_TRACE_DMA_TX_PUT	0x0005  // 0x0020
+#define HCF_TRACE_GET_INFO		0x0006  // 0x0040
+#define HCF_TRACE_PUT_INFO		0x0007  // 0x0080
+#define HCF_TRACE_RCV_MSG		0x0008  // 0x0100
+#define HCF_TRACE_SEND_MSG		0x0009  // 0x0200
+#define HCF_TRACE_SERVICE_NIC	0x000A  // 0x0400
+// #define HCF_TRACE_           0x000C  // 0x1000
+// #define HCF_TRACE_           0x000D  // 0x2000
+// #define HCF_TRACE_           0x000E  // 0x4000
+// #define HCF_TRACE_           0x000F  // 0x8000
+//	============================================ HCF_TRACE_... codes below 0x0010 are asserted on re-entry
+#define HCF_TRACE_ACTION_KLUDGE	0x0010  /* once you start introducing kludges there is no end to it
+										 * this is an escape to do not assert on re-entrancy problem caused
+										 * by HCF_ACT_INT_FORCE_ON used to get Microsofts NDIS drivers going
+										 */
+#define HCF_TRACE_STRIO			0x0020
+#define HCF_TRACE_ALLOC			0X0021
+#define HCF_TRACE_DL			0X0023
+#define HCF_TRACE_ISR_INFO		0X0024
+#define HCF_TRACE_CALIBRATE		0x0026
+
+#define HCF_TRACE_CMD_CPL 		0x0040
+#define HCF_TRACE_CMD_EXE		0x0041
+#define HCF_TRACE_GET_FID		0x0042
+#define HCF_TRACE_GET_FRAG		0x0043
+#define HCF_TRACE_INIT			0x0044
+#define HCF_TRACE_PUT_FRAG		0x0045
+#define HCF_TRACE_SETUP_BAP		0x0046
+
+#define	HCF_TRACE_EXIT 			0x8000	// Keil C warns "long constant truncated to int"
+
+//#define BAP_0					HREG_DATA_0		//Used by DMA controller to access NIC RAM
+#define BAP_1					HREG_DATA_1		//Used by HCF to access NIC RAM
+
+
+//************************* Hermes Receive/Transmit Frame Structures
+//HFS_STAT
+//see MMD.H for HFS_STAT_ERR
+#define 	HFS_STAT_MSG_TYPE	0xE000	//Hermes reported Message Type
+#define 	HFS_STAT_MIC_KEY_ID	0x1800	//MIC key used (if any)
+#define 	HFS_STAT_1042		0x2000	//RFC1042 Encoded
+#define 	HFS_STAT_TUNNEL		0x4000	//Bridge-Tunnel Encoded
+#define 	HFS_STAT_WMP_MSG	0x6000	//WaveLAN-II Management Protocol Frame
+#if (HCF_TYPE) & HCF_TYPE_WPA
+#define 	HFS_STAT_MIC		0x0010	//Frame contains MIC  //;? re-instate when F/W ready
+#endif
+
+//************************* Hermes Register Offsets and Command bits
+#define HREG_IO_RANGE			0x80		//I/O Range used by Hermes
+
+
+//************************* Command/Status
+#define HREG_CMD				0x00		//
+#define 	HCMD_CMD_CODE			0x3F
+#define HREG_PARAM_0			0x02		//
+#define HREG_PARAM_1			0x04		//
+#define HREG_PARAM_2			0x06		//
+#define HREG_STAT				0x08		//
+#define 	HREG_STAT_CMD_CODE		0x003F	//
+#define		HREG_STAT_DIAG_ERR		0x0100
+#define		HREG_STAT_INQUIRE_ERR	0x0500
+#define 	HREG_STAT_CMD_RESULT	0x7F00	//
+#define HREG_RESP_0				0x0A		//
+#define HREG_RESP_1				0x0C		//
+#define HREG_RESP_2				0x0E		//
+
+
+//************************* FID Management
+#define HREG_INFO_FID			0x10		//
+#define HREG_RX_FID				0x20		//
+#define HREG_ALLOC_FID  		0x22		//
+#define HREG_TX_COMPL_FID  		0x24		//
+
+
+//************************* BAP
+//20031030 HWi Inserted this again because the dongle code uses this (GPIF.C)
+//#define HREG_SELECT_0			0x18		//
+//#define HREG_OFFSET_0			0x1C		//
+//#define HREG_DATA_0			0x36		//
+
+//#define 	HREG_OFFSET_BUSY		0x8000	// use HCMD_BUSY
+#define 	HREG_OFFSET_ERR			0x4000	//
+//rsrvd #define 	HREG_OFFSET_DATA_OFFSET	0x0FFF	//
+
+#define HREG_SELECT_1			0x1A		//
+#define HREG_OFFSET_1			0x1E		//
+#define HREG_DATA_1				0x38		//
+
+
+//************************* Event
+#define HREG_EV_STAT			0x30		//
+#define HREG_INT_EN				0x32		//
+#define HREG_EV_ACK				0x34		//
+
+#define    HREG_EV_TICK				0x8000	//Auxiliary Timer Tick
+//#define  HREG_EV_RES				0x4000	//H-I only: H/W error (Wait Time-out)
+#define    HREG_EV_INFO_DROP		0x2000	//WMAC did not have sufficient RAM to build Unsollicited Frame
+#if (HCF_TYPE) & HCF_TYPE_HII5
+#define    HREG_EV_ACK_REG_READY	0x0000
+#else
+#define    HREG_EV_ACK_REG_READY	0x1000	//Workaround Kludge bit for H-II (not H-II.5)
+#endif // HCF_TYPE_HII5
+#if (HCF_SLEEP) & ( HCF_CDS | HCF_DDS )
+#define    HREG_EV_SLEEP_REQ		0x0800
+#else
+#define    HREG_EV_SLEEP_REQ		0x0000
+#endif // HCF_CDS / HCF_DDS
+#if HCF_DMA
+//#define    HREG_EV_LPESC			0x0400 // firmware sets this bit and clears it, not for host usage.
+#define    HREG_EV_RDMAD			0x0200 // rx frame in host memory
+#define    HREG_EV_TDMAD			0x0100 // tx frame in host memory processed
+//#define    HREG_EV_RXDMA			0x0040 // firmware kicks off DMA engine (bit is not for host usage)
+//#define    HREG_EV_TXDMA			0x0020 // firmware kicks off DMA engine (bit is not for host usage)
+#define    HREG_EV_FW_DMA			0x0460 // firmware / DMA engine I/F (bits are not for host usage)
+#else
+#define    HREG_EV_FW_DMA			0x0000
+#endif // HCF_DMA
+#define    HREG_EV_INFO				0x0080	// Asynchronous Information Frame
+#define    HREG_EV_CMD				0x0010	// Command completed, Status and Response available
+#define    HREG_EV_ALLOC			0x0008	// Asynchronous part of Allocation/Reclaim completed
+#define    HREG_EV_TX_EXC			0x0004	// Asynchronous Transmission unsuccessful completed
+#define    HREG_EV_TX				0x0002	// Asynchronous Transmission successful completed
+#define    HREG_EV_RX				0x0001	// Asynchronous Receive Frame
+
+#define    HREG_EV_TX_EXT 			( (HCF_EXT) & (HCF_EXT_INT_TX_EX | HCF_EXT_INT_TICK ) )
+									/* HREG_EV_TX_EXT := 0x0000 or HREG_EV_TX_EXC and/or HREG_EV_TICK
+									 * could be extended with HREG_EV_TX */
+#if HCF_EXT_INT_TX_EX != HREG_EV_TX_EXC
+err: these values should match;
+#endif // HCF_EXT_INT_TX_EX / HREG_EV_TX_EXC
+
+#if HCF_EXT_INT_TICK != HREG_EV_TICK
+err: these values should match;
+#endif // HCF_EXT_INT_TICK / HREG_EV_TICK
+
+//************************* Host Software
+#define HREG_SW_0				0x28		//
+#define HREG_SW_1				0x2A		//
+#define HREG_SW_2				0x2C		//
+//rsrvd #define HREG_SW_3		0x2E		//
+//************************* Control and Auxiliary Port
+
+#define HREG_IO					0x12
+#define		HREG_IO_SRESET			0x0001
+#define		HREG_IO_WAKEUP_ASYNC	0x0002
+#define		HREG_IO_WOKEN_UP		0x0004
+#define HREG_CNTL				0x14		//
+//#define		HREG_CNTL_WAKEUP_SYNC	0x0001
+#define		HREG_CNTL_AUX_ENA_STAT	0xC000
+#define		HREG_CNTL_AUX_DIS_STAT	0x0000
+#define		HREG_CNTL_AUX_ENA_CNTL	0x8000
+#define		HREG_CNTL_AUX_DIS_CNTL	0x4000
+#define		HREG_CNTL_AUX_DSD		0x2000
+#define		HREG_CNTL_AUX_ENA		(HREG_CNTL_AUX_ENA_CNTL | HREG_CNTL_AUX_DIS_CNTL )
+#define HREG_SPARE				0x16		//
+#define HREG_AUX_PAGE			0x3A		//
+#define HREG_AUX_OFFSET			0x3C		//
+#define HREG_AUX_DATA			0x3E		//
+
+#if HCF_DMA
+//************************* DMA (bus mastering)
+	// Be carefull to use these registers only at a genuine 32 bits NIC
+	// On 16 bits NICs, these addresses are mapped into the range 0x00 through 0x3F with all consequences
+	// thereof, e.g.  HREG_DMA_CTRL register maps to HREG_CMD.
+#define HREG_DMA_CTRL						0x0040
+#define HREG_TXDMA_PTR32					0x0044
+#define HREG_TXDMA_PRIO_PTR32				0x0048
+#define HREG_TXDMA_HIPRIO_PTR32				0x004C
+#define HREG_RXDMA_PTR32					0x0050
+#define HREG_CARDDETECT_1					0x007C // contains 7D37
+#define HREG_CARDDETECT_2					0x007E // contains 7DE7
+#define HREG_FREETIMER						0x0058
+#define HREG_DMA_RX_CNT						0x0026
+
+/******************************************************************************
+* Defines for the bits in the DmaControl register (@40h)
+******************************************************************************/
+#define HREG_DMA_CTRL_RXHWEN				0x80000000 // high word enable bit
+#define HREG_DMA_CTRL_RXRESET				0x40000000 // tx dma init bit
+#define HREG_DMA_CTRL_RXBAP1				BIT29
+#define HREG_DMA_CTRL_RX_STALLED			BIT28
+#define HREG_DMA_CTRL_RXAUTOACK_DMADONE		BIT27 // no host involvement req. for TDMADONE event
+#define HREG_DMA_CTRL_RXAUTOACK_INFO		BIT26 // no host involvement req. for alloc event
+#define HREG_DMA_CTRL_RXAUTOACK_DMAEN		0x02000000 // no host involvement req. for TxDMAen event
+#define HREG_DMA_CTRL_RXAUTOACK_RX			0x01000000 // no host involvement req. for tx event
+#define HREG_DMA_CTRL_RX_BUSY				BIT23 // read only bit
+//#define HREG_DMA_CTRL_RX_RBUFCONT_PLAIN		0	  // bits 21..20
+//#define HREG_DMA_CTRL_RX_MODE_PLAIN_DMA		0	  // mode 0
+#define HREG_DMA_CTRL_RX_MODE_SINGLE_PACKET	0x00010000 // mode 1
+#define HREG_DMA_CTRL_RX_MODE_MULTI_PACKET	0x00020000 // mode 2
+//#define HREG_DMA_CTRL_RX_MODE_DISABLE		(0x00020000|0x00010000) // disable tx dma engine
+#define HREG_DMA_CTRL_TXHWEN				0x8000 // low word enable bit
+#define HREG_DMA_CTRL_TXRESET				0x4000 // rx dma init bit
+#define HREG_DMA_CTRL_TXBAP1				BIT13
+#define HREG_DMA_CTRL_TXAUTOACK_DMADONE		BIT11 // no host involvement req. for RxDMADONE event
+#define HREG_DMA_CTRL_TXAUTOACK_DMAEN		0x00000400 // no host involvement req. for RxDMAen event
+#define HREG_DMA_CTRL_TXAUTOACK_DMAALLOC	0x00000200  // no host involvement req. for info event
+#define HREG_DMA_CTRL_TXAUTOACK_TX			0x00000100  // no host involvement req. for rx event
+#define HREG_DMA_CTRL_TX_BUSY				BIT7  // read only bit
+//#define HREG_DMA_CTRL_TX_TBUFCONT_PLAIN		0	  // bits 6..5
+//#define HREG_DMA_CTRL_TX_MODE_PLAIN_DMA		0	  // mode 0
+#define HREG_DMA_CTRL_TX_MODE_SINGLE_PACKET	BIT0 // mode 1
+#define HREG_DMA_CTRL_TX_MODE_MULTI_PACKET	0x00000002 // mode 2
+//#define HREG_DMA_CTRL_TX_MODE_DISABLE		(0x00000001|0x00000002) // disable tx dma engine
+
+//configuration DWORD to configure DMA for mode2 operation, using BAP0 as the DMA BAP.
+#define DMA_CTRLSTAT_GO (HREG_DMA_CTRL_RXHWEN | HREG_DMA_CTRL_RX_MODE_MULTI_PACKET | \
+                         HREG_DMA_CTRL_RXAUTOACK_DMAEN | HREG_DMA_CTRL_RXAUTOACK_RX | \
+                         HREG_DMA_CTRL_TXHWEN | /*;?HREG_DMA_CTRL_TX_TBUFCONT_PLAIN |*/ \
+                         HREG_DMA_CTRL_TX_MODE_MULTI_PACKET | HREG_DMA_CTRL_TXAUTOACK_DMAEN |\
+                         HREG_DMA_CTRL_TXAUTOACK_DMAALLOC)
+
+//configuration DWORD to reset both the Tx and Rx DMA engines
+#define DMA_CTRLSTAT_RESET (HREG_DMA_CTRL_RXHWEN | HREG_DMA_CTRL_RXRESET | HREG_DMA_CTRL_TXHWEN | HREG_DMA_CTRL_TXRESET)
+
+//#define DESC_DMA_OWNED     		0x80000000 					// BIT31
+#define DESC_DMA_OWNED     		0x8000	 					// BIT31
+#define DESC_SOP   			 	0x8000 						// BIT15
+#define DESC_EOP   			 	0x4000 						// BIT14
+
+#define DMA_RX				0
+#define DMA_TX				1
+
+// #define IFB_RxFirstDesc		IFB_FirstDesc[DMA_RX]
+// #define IFB_TxFirstDesc		IFB_FirstDesc[DMA_TX]
+// #define IFB_RxLastDesc		IFB_LastDesc[DMA_RX]
+// #define IFB_TxLastDesc		IFB_LastDesc[DMA_TX]
+
+#endif // HCF_DMA
+//
+/************************************************************************************************/
+/**********************************  EQUATES  ***************************************************/
+/************************************************************************************************/
+
+
+// Hermes Command Codes and Qualifier bits
+#define 	HCMD_BUSY			0x8000	// Busy bit, applicable for all commands
+#define HCMD_INI				0x0000	//
+#define HCMD_ENABLE				HCF_CNTL_ENABLE		// 0x0001
+#define HCMD_DISABLE			HCF_CNTL_DISABLE	// 0x0002
+#define HCMD_CONNECT			HCF_CNTL_CONNECT	// 0x0003
+#define HCMD_EXECUTE			0x0004	//
+#define HCMD_DISCONNECT			HCF_CNTL_DISCONNECT	// 0x0005
+#define HCMD_SLEEP				0x0006	//
+#define HCMD_CONTINUE			HCF_CNTL_CONTINUE	// 0x0007
+#define 	HCMD_RETRY			0x0100	// Retry bit
+#define HCMD_ALLOC				0x000A	//
+#define HCMD_TX					0x000B	//
+#define 	HCMD_RECL			0x0100	// Reclaim bit, applicable for Tx and Inquire
+#define HCMD_INQUIRE			0x0011	//
+#define HCMD_ACCESS				0x0021	//
+#define 	HCMD_ACCESS_WRITE	0x0100	// Write bit
+#define HCMD_PROGRAM			0x0022	//
+#define HCMD_READ_MIF			0x0030
+#define HCMD_WRITE_MIF			0x0031
+#define HCMD_THESEUS			0x0038
+#define 	HCMD_STARTPREAMBLE  0x0E00	// Start continuous preamble Tx
+#define 	HCMD_STOP			0x0F00	// Stop Theseus test mode
+
+
+//Configuration Management
+//
+
+#define CFG_DRV_ACT_RANGES_PRI_3_BOTTOM	1	// Default Bottom Compatibility for Primary Firmware - driver I/F
+#define CFG_DRV_ACT_RANGES_PRI_3_TOP	1	// Default Top    Compatibility for Primary Firmware - driver I/F
+
+#define CFG_DRV_ACT_RANGES_HSI_4_BOTTOM	1	// Default Bottom Compatibility for H/W - driver I/F
+#define CFG_DRV_ACT_RANGES_HSI_4_TOP	1	// Default Top    Compatibility for H/W - driver I/F
+
+#define CFG_DRV_ACT_RANGES_HSI_5_BOTTOM	1	// Default Bottom Compatibility for H/W - driver I/F
+#define CFG_DRV_ACT_RANGES_HSI_5_TOP	1	// Default Top    Compatibility for H/W - driver I/F
+
+#if (HCF_TYPE) & HCF_TYPE_WPA
+#define CFG_DRV_ACT_RANGES_APF_1_BOTTOM	16	// Default Bottom Compatibility for AP Firmware - driver I/F
+#define CFG_DRV_ACT_RANGES_APF_1_TOP    16	// Default Top    Compatibility for AP Firmware - driver I/F
+#else  //;? is this REALLY O.K.
+#define CFG_DRV_ACT_RANGES_APF_1_BOTTOM	1	// Default Bottom Compatibility for AP Firmware - driver I/F
+#define CFG_DRV_ACT_RANGES_APF_1_TOP    1	// Default Top    Compatibility for AP Firmware - driver I/F
+#endif // HCF_TYPE_WPA
+
+#define CFG_DRV_ACT_RANGES_APF_2_BOTTOM	2	// Default Bottom Compatibility for AP Firmware - driver I/F
+#define CFG_DRV_ACT_RANGES_APF_2_TOP    2	// Default Top    Compatibility for AP Firmware - driver I/F
+
+#define CFG_DRV_ACT_RANGES_APF_3_BOTTOM	1	// Default Bottom Compatibility for AP Firmware - driver I/F
+#define CFG_DRV_ACT_RANGES_APF_3_TOP    1	// Default Top    Compatibility for AP Firmware - driver I/F
+
+#define CFG_DRV_ACT_RANGES_APF_4_BOTTOM	1	// Default Bottom Compatibility for AP Firmware - driver I/F
+#define CFG_DRV_ACT_RANGES_APF_4_TOP    1	// Default Top    Compatibility for AP Firmware - driver I/F
+
+#if (HCF_TYPE) & HCF_TYPE_HII5
+#define CFG_DRV_ACT_RANGES_STA_2_BOTTOM	6	// Default Bottom Compatibility for Station Firmware - driver I/F
+#define CFG_DRV_ACT_RANGES_STA_2_TOP    6	// Default Top    Compatibility for Station Firmware - driver I/F
+#else // (HCF_TYPE) & HCF_TYPE_HII5
+#define CFG_DRV_ACT_RANGES_STA_2_BOTTOM	1	// Default Bottom Compatibility for Station Firmware - driver I/F
+#define CFG_DRV_ACT_RANGES_STA_2_TOP    2	// Default Top    Compatibility for Station Firmware - driver I/F
+#endif // (HCF_TYPE) & HCF_TYPE_HII5
+
+#define CFG_DRV_ACT_RANGES_STA_3_BOTTOM	1	// Default Bottom Compatibility for Station Firmware - driver I/F
+#define CFG_DRV_ACT_RANGES_STA_3_TOP    1	// Default Top    Compatibility for Station Firmware - driver I/F
+
+#define CFG_DRV_ACT_RANGES_STA_4_BOTTOM	1	// Default Bottom Compatibility for Station Firmware - driver I/F
+#define CFG_DRV_ACT_RANGES_STA_4_TOP    1	// Default Top    Compatibility for Station Firmware - driver I/F
+
+//---------------------------------------------------------------------------------------------------------------------
+#if defined HCF_CFG_PRI_1_TOP || defined HCF_CFG_PRI_1_BOTTOM
+err: PRI_1 not supported for H-I;	// Compatibility for Primary Firmware - driver I/F
+#endif // HCF_CFG_PRI_1_TOP / HCF_CFG_PRI_1_BOTTOM
+
+#if defined HCF_CFG_PRI_2_TOP || defined HCF_CFG_PRI_2_BOTTOM
+err: PRI_2 not supported for H-I;	// Compatibility for Primary Firmware - driver I/F
+#endif // HCF_CFG_PRI_2_TOP / HCF_CFG_PRI_2_BOTTOM
+
+#ifdef HCF_CFG_PRI_3_TOP									// Top Compatibility for Primary Firmware - driver I/F
+#if HCF_CFG_PRI_3_TOP == 0 || \
+	CFG_DRV_ACT_RANGES_PRI_3_BOTTOM <= HCF_CFG_PRI_3_TOP && HCF_CFG_PRI_3_TOP <= CFG_DRV_ACT_RANGES_PRI_3_TOP
+#undef CFG_DRV_ACT_RANGES_PRI_3_TOP
+#define CFG_DRV_ACT_RANGES_PRI_3_TOP	HCF_CFG_PRI_3_TOP
+#else
+err: ;
+#endif
+#endif // HCF_CFG_PRI_3_TOP
+
+#ifdef HCF_CFG_PRI_3_BOTTOM                       			// Bottom Compatibility for Primary Firmware - driver I/F
+#if CFG_DRV_ACT_RANGES_PRI_3_BOTTOM <= HCF_CFG_PRI_3_BOTTOM && HCF_CFG_PRI_3_BOTTOM <= CFG_DRV_ACT_RANGES_PRI_3_TOP
+#undef CFG_DRV_ACT_RANGES_PRI_3_BOTTOM
+#define CFG_DRV_ACT_RANGES_PRI_3_BOTTOM	HCF_CFG_PRI_3_BOTTOM
+#else
+err: ;
+#endif
+#endif // HCF_CFG_PRI_3_BOTTOM
+
+
+//---------------------------------------------------------------------------------------------------------------------
+#if defined HCF_CFG_HSI_0_TOP || defined HCF_CFG_HSI_0_BOTTOM
+err: HSI_0 not supported for H-I;	// Compatibility for HSI I/F
+#endif // HCF_CFG_HSI_0_TOP / HCF_CFG_HSI_0_BOTTOM
+
+#if defined HCF_CFG_HSI_1_TOP || defined HCF_CFG_HSI_1_BOTTOM
+err: HSI_1 not supported for H-I;	// Compatibility for HSI I/F
+#endif // HCF_CFG_HSI_1_TOP / HCF_CFG_HSI_1_BOTTOM
+
+#if defined HCF_CFG_HSI_2_TOP || defined HCF_CFG_HSI_2_BOTTOM
+err: HSI_2 not supported for H-I;	// Compatibility for HSI I/F
+#endif // HCF_CFG_HSI_2_TOP / HCF_CFG_HSI_2_BOTTOM
+
+#if defined HCF_CFG_HSI_3_TOP || defined HCF_CFG_HSI_3_BOTTOM
+err: HSI_3 not supported for H-I;	// Compatibility for HSI I/F
+#endif // HCF_CFG_HSI_3_TOP / HCF_CFG_HSI_3_BOTTOM
+
+#ifdef HCF_CFG_HSI_4_TOP 									// Top Compatibility for HSI I/F
+#if HCF_CFG_HSI_4_TOP == 0 || \
+	CFG_DRV_ACT_RANGES_HSI_4_BOTTOM <= CF_CFG_HSI_4_TOP && HCF_CFG_HSI_4_TOP <= CFG_DRV_ACT_RANGES_HSI_4_TOP
+#undef CFG_DRV_ACT_RANGES_HSI_4_TOP
+#define CFG_DRV_ACT_RANGES_HSI_4_TOP	HCF_CFG_HSI_4_TOP
+#else
+err: ;
+#endif
+#endif // HCF_CFG_HSI_4_TOP
+
+#ifdef HCF_CFG_HSI_4_BOTTOM								// Bottom Compatibility for HSI I/F
+#if CFG_DRV_ACT_RANGES_HSI_4_BOTTOM <= HCF_CFG_HSI_4_BOTTOM && HCF_CFG_HSI_4_BOTTOM <= CFG_DRV_ACT_RANGES_HSI_4_TOP
+#undef CFG_DRV_ACT_RANGES_HSI_4_BOTTOM
+#define CFG_DRV_ACT_RANGES_HSI_4_BOTTOM	HCF_CFG_HSI_4_BOTTOM
+#else
+err: ;
+#endif
+#endif // HCF_CFG_HSI_4_BOTTOM
+
+#ifdef HCF_CFG_HSI_5_TOP 									// Top Compatibility for HSI I/F
+#if HCF_CFG_HSI_5_TOP == 0 || \
+	CFG_DRV_ACT_RANGES_HSI_5_BOTTOM <= CF_CFG_HSI_5_TOP && HCF_CFG_HSI_5_TOP <= CFG_DRV_ACT_RANGES_HSI_5_TOP
+#undef CFG_DRV_ACT_RANGES_HSI_5_TOP
+#define CFG_DRV_ACT_RANGES_HSI_5_TOP	HCF_CFG_HSI_5_TOP
+#else
+err: ;
+#endif
+#endif // HCF_CFG_HSI_5_TOP
+
+#ifdef HCF_CFG_HSI_5_BOTTOM								// Bottom Compatibility for HSI I/F
+#if CFG_DRV_ACT_RANGES_HSI_5_BOTTOM <= HCF_CFG_HSI_5_BOTTOM && HCF_CFG_HSI_5_BOTTOM <= CFG_DRV_ACT_RANGES_HSI_5_TOP
+#undef CFG_DRV_ACT_RANGES_HSI_5_BOTTOM
+#define CFG_DRV_ACT_RANGES_HSI_5_BOTTOM	HCF_CFG_HSI_5_BOTTOM
+#else
+err: ;
+#endif
+#endif // HCF_CFG_HSI_5_BOTTOM
+//---------------------------------------------------------------------------------------------------------------------
+#if defined HCF_CFG_APF_1_TOP || defined HCF_CFG_APF_1_BOTTOM
+err: APF_1 not supported for H-I;	// Compatibility for AP Firmware - driver I/F
+#endif // HCF_CFG_APF_1_TOP / HCF_CFG_APF_1_BOTTOM
+
+#ifdef HCF_CFG_APF_2_TOP                  					// Top Compatibility for AP Firmware - driver I/F
+#if HCF_CFG_APF_2_TOP == 0 || \
+	CFG_DRV_ACT_RANGES_APF_2_BOTTOM <= HCF_CFG_APF_2_TOP && HCF_CFG_APF_2_TOP <= CFG_DRV_ACT_RANGES_APF_2_TOP
+#undef CFG_DRV_ACT_RANGES_APF_2_TOP
+#define CFG_DRV_ACT_RANGES_APF_2_TOP	HCF_CFG_APF_2_TOP
+#else
+err: ;
+#endif
+#endif // HCF_CFG_APF_TOP
+
+#ifdef HCF_CFG_APF_2_BOTTOM                       			// Bottom Compatibility for AP Firmware - driver I/F
+#if CFG_DRV_ACT_RANGES_APF_2_BOTTOM <= HCF_CFG_APF_2_BOTTOM && HCF_CFG_APF_2_BOTTOM <= CFG_DRV_ACT_RANGES_APF_2_TOP
+#undef CFG_DRV_ACT_RANGES_APF_2_BOTTOM
+#define CFG_DRV_ACT_RANGES_APF_2_BOTTOM	HCF_CFG_APF_2_BOTTOM
+#else
+err: ;
+#endif
+#endif // HCF_CFG_APF_BOTTOM
+
+//---------------------------------------------------------------------------------------------------------------------
+#if defined HCF_CFG_STA_1_TOP || defined HCF_CFG_STA_1_BOTTOM
+err: STA_1 not supported for H-I;	// Compatibility for Station Firmware - driver I/F
+#endif // HCF_CFG_STA_1_TOP / HCF_CFG_STA_1_BOTTOM
+
+#ifdef HCF_CFG_STA_2_TOP                  					// Top Compatibility for Station Firmware - driver I/F
+#if HCF_CFG_STA_2_TOP == 0 || \
+	CFG_DRV_ACT_RANGES_STA_2_BOTTOM <= HCF_CFG_STA_2_TOP && HCF_CFG_STA_2_TOP <= CFG_DRV_ACT_RANGES_STA_2_TOP
+#undef CFG_DRV_ACT_RANGES_STA_2_TOP
+#define CFG_DRV_ACT_RANGES_STA_2_TOP	HCF_CFG_STA_2_TOP
+#else
+err: ;
+#endif
+#endif // HCF_CFG_STA_TOP
+
+#ifdef HCF_CFG_STA_2_BOTTOM                       			// Bottom Compatibility for Station Firmware - driver I/F
+#if CFG_DRV_ACT_RANGES_STA_2_BOTTOM <= HCF_CFG_STA_2_BOTTOM && HCF_CFG_STA_2_BOTTOM <= CFG_DRV_ACT_RANGES_STA_2_TOP
+#undef CFG_DRV_ACT_RANGES_STA_2_BOTTOM
+#define CFG_DRV_ACT_RANGES_STA_2_BOTTOM	HCF_CFG_STA_2_BOTTOM
+#else
+err: ;
+#endif
+#endif // HCF_CFG_STA_BOTTOM
+
+
+/************************************************************************************************/
+/**************************************  MACROS  ************************************************/
+/************************************************************************************************/
+
+/* min and max macros */
+#if ! defined max
+#define max(a,b)  		(((a) > (b)) ? (a) : (b))
+#endif
+#if ! defined min
+#define min(a,b)  		(((a) < (b)) ? (a) : (b))
+#endif
+
+#ifdef HCF_SLEEP
+#if defined MSF_WAIT
+err: MSF should no longer supply this macro;
+#else
+#define MSF_WAIT(x) 																			\
+	{ PROT_CNT_INI														\
+		HCF_WAIT_WHILE( ( IPW( HREG_IO ) & HREG_IO_WOKEN_UP ) == 0 );						\
+		HCFASSERT( prot_cnt, IPW( HREG_IO ) )							\
+	}
+#endif // MSF_WAIT
+#else
+#define MSF_WAIT(x)	/*NOP*/
+#endif // HCF_SLEEP
+
+#define LOF(x) 			(sizeof(x)/sizeof(hcf_16)-1)
+
+#define MUL_BY_2( x )	( (x) << 1 )						//used to multiply by 2
+#define DIV_BY_2( x )	( (x) >> 1 )						//used to divide by 2
+
+//resolve problems on for some 16 bits compilers to create 32 bit values
+#define MERGE_2( hw, lw )	( ( ((hcf_32)(hw)) << 16 ) | ((hcf_16)(lw)) )
+
+#if ! defined HCF_STATIC
+#define		  HCF_STATIC	static
+#endif //	  HCF_STATIC
+
+#if ( (HCF_TYPE) & HCF_TYPE_HII5 ) == 0
+#define DAWA_ACK( mask) {													\
+	OPW( HREG_EV_ACK, mask | HREG_EV_ACK_REG_READY );						\
+	OPW( HREG_EV_ACK, (mask & ~HREG_EV_ALLOC) | HREG_EV_ACK_REG_READY ); 	}
+#define DAWA_ZERO_FID(reg) OPW( reg, 0 );
+#else
+#define DAWA_ACK( mask)   OPW( HREG_EV_ACK, mask );
+#define DAWA_ZERO_FID(reg)
+#endif // HCF_TYPE_HII5
+
+#if (HCF_TYPE) & HCF_TYPE_WPA
+#define	CALC_RX_MIC( p, len ) calc_mic_rx_frag( ifbp, p, len )
+#define	CALC_TX_MIC( p, len ) calc_mic_tx_frag( ifbp, p, len )
+#define IF_SSN(x)  x
+#define IF_NOT_SSN(x)
+#else
+#define	CALC_RX_MIC( p, len )
+#define	CALC_TX_MIC( p, len )
+#define MIC_RX_RTN( mic, dw )
+#define MIC_TX_RTN( mic, dw )
+#define IF_SSN(x)
+#define IF_NOT_SSN(x) x
+#endif // HCF_TYPE_WPA
+
+#if HCF_TALLIES & HCF_TALLIES_HCF		//HCF tally support
+#define IF_TALLY(x)  x
+#else
+#define IF_TALLY(x)
+#endif // HCF_TALLIES_HCF
+
+
+#if HCF_DMA
+#define IF_DMA(x)			x
+#define IF_NOT_DMA(x)
+#define IF_USE_DMA(x) 		if (   ifbp->IFB_CntlOpt & USE_DMA  ) x
+#define IF_NOT_USE_DMA(x)	if ( !(ifbp->IFB_CntlOpt & USE_DMA) ) x
+#else
+#define IF_DMA(x)
+#define IF_NOT_DMA(x)		x
+#define IF_USE_DMA(x)
+#define IF_NOT_USE_DMA(x) 	x
+#endif // HCF_DMA
+
+
+#define IPW(x) ((hcf_16)IN_PORT_WORD( ifbp->IFB_IOBase + (x) ) )
+#define OPW(x, y) OUT_PORT_WORD( ifbp->IFB_IOBase + (x), y )
+	/* make sure the implementation of HCF_WAIT_WHILE is such that there may be multiple HCF_WAIT_WHILE calls
+	 * in a row and that when one fails all subsequent fail immediately without reinitialization of prot_cnt
+	 */
+#if HCF_PROT_TIME == 0
+#define PROT_CNT_INI
+#define IF_PROT_TIME(x)
+#if defined HCF_YIELD
+#define HCF_WAIT_WHILE( x ) while ( (x) && (HCF_YIELD) ) /*NOP*/;
+#else
+#define HCF_WAIT_WHILE( x ) while ( x ) /*NOP*/;
+#endif // HCF_YIELD
+#else
+#define PROT_CNT_INI 	hcf_32 prot_cnt = ifbp->IFB_TickIni;
+#define IF_PROT_TIME(x)	x
+#if defined HCF_YIELD
+#define HCF_WAIT_WHILE( x ) while ( prot_cnt && (x) && (HCF_YIELD) ) prot_cnt--;
+#else
+#include <linux/delay.h>
+#define HCF_WAIT_WHILE( x ) while ( prot_cnt && (x) ) { udelay(2); prot_cnt--; }
+#endif // HCF_YIELD
+#endif // HCF_PROT_TIME
+
+#if defined HCF_EX_INT
+//#if HCF_EX_INT & ~( HCF_EX_INT_TX_EX | HCF_EX_INT_TX_OK | HCF_EX_INT_TICK )
+;? out dated checking
+err: you used an invalid bitmask;
+// #endif // HCF_EX_INT validation
+// #else
+// #define HCF_EX_INT 0x000
+#endif // HCF_EX_INT
+
+#if 0 //get compiler going
+#if HCF_EX_INT_TICK	!= HREG_EV_TICK
+;? out dated checking
+err: someone redefined these macros while the implemenation assumes they are equal;
+#endif
+#if HCF_EX_INT_TX_OK != HFS_TX_CNTL_TX_OK || HFS_TX_CNTL_TX_OK != HREG_EV_TX_OK
+;? out dated checking
+err: someone redefined these macros while the implemenation assumes they are equal;
+#endif
+#if HCF_EX_INT_TX_EX != HFS_TX_CNTL_TX_EX || HFS_TX_CNTL_TX_EX != HREG_EV_TX_EX
+;? out dated checking
+err: someone redefined these macros while the implemenation assumes they are equal;
+#endif
+#endif // 0 get compiler going
+
+
+/* The assert in HCFLOGENTRY checks against re-entrancy. Re-entrancy could be caused by MSF logic at
+ * task-level calling hcf_functions without shielding with HCF_ACT_ON/_OFF. When an interrupt occurs,
+ * the ISR could (either directly or indirectly) cause re-entering of the interrupted HCF-routine.
+ *
+ * The "(ifbp->IFB_AssertWhere = where)" test in HCFLOGENTRY services ALSO as a statement to get around:
+ * #pragma warning: conditional expression is constant
+ * on the if-statement
+ */
+#if HCF_ASSERT
+#define HCFASSERT(x,q) {if (!(x)) {mdd_assert(        ifbp, __LINE__                   , q );}}
+#define MMDASSERT(x,q) {if (!(x)) {mdd_assert( assert_ifbp, __LINE__ + FILE_NAME_OFFSET, q );}}
+
+#define HCFLOGENTRY( where, what ) 														\
+{if ( (ifbp->IFB_AssertWhere = where) <= 15 ) {											\
+	HCF_ENTRY( ifbp ); 																	\
+	HCFASSERT( (ifbp->IFB_AssertTrace & 1<<((where)&0xF)) == 0, ifbp->IFB_AssertTrace );		\
+	ifbp->IFB_AssertTrace |= 1<<((where)&0xF);												\
+	}																					\
+HCFTRACE(ifbp, where )																	\
+HCFTRACEVALUE(ifbp, what )																\
+}
+
+#define HCFLOGEXIT( where ) 															\
+{if ( (ifbp->IFB_AssertWhere = where) <= 15 ) {											\
+  	HCF_EXIT( ifbp ); 																	\
+	ifbp->IFB_AssertTrace &= ~(1<<((where)&0xF));												\
+	}						 															\
+HCFTRACE(ifbp, (where)|HCF_TRACE_EXIT )													\
+}
+
+#else // HCF_ASSERT
+#define HCFASSERT( x, q )
+#define MMDASSERT( x, q )
+#define HCFLOGENTRY( where, what ) 	  	{HCF_ENTRY( ifbp );}
+#define HCFLOGEXIT( where ) 		  	{HCF_EXIT( ifbp );}
+#endif // HCF_ASSERT
+
+#if HCF_INT_ON
+/* ;? HCFASSERT_INT
+ * #if (HCF_SLEEP) & HCF_DDS
+ * #define HCFASSERT_INT HCFASSERT( ifbp->IFB_IntOffCnt != 0xFFFF && ifbp->IFB_IntOffCnt != 0xFFFE, \
+ * 								 ifbp->IFB_IntOffCnt )
+ * #else
+ */
+#define HCFASSERT_INT HCFASSERT( ifbp->IFB_IntOffCnt != 0xFFFF, ifbp->IFB_IntOffCnt )
+// #endif // HCF_DDS
+#else
+#define HCFASSERT_INT
+#endif // HCF_INT_ON
+
+
+#if defined HCF_TRACE
+#define HCFTRACE(ifbp, where )	   {OPW( HREG_SW_1, where );}
+//#define HCFTRACE(ifbp, where )	   {HCFASSERT( DO_ASSERT, where );}
+#define HCFTRACEVALUE(ifbp, what ) {OPW( HREG_SW_2, what  );}
+//#define HCFTRACEVALUE(ifbp, what ) {HCFASSERT( DO_ASSERT, what  );}
+#else
+#define HCFTRACE(ifbp, where )
+#define HCFTRACEVALUE(ifbp, what )
+#endif // HCF_TRACE
+
+
+#if HCF_BIG_ENDIAN
+#define BE_PAR(x)				,x
+#else
+#define BE_PAR(x)
+#endif // HCF_BIG_ENDIAN
+
+/************************************************************************************************/
+/**************************************  END OF MACROS  *****************************************/
+/************************************************************************************************/
+
+/************************************************************************************************/
+/***************************************  PROTOTYPES  *******************************************/
+/************************************************************************************************/
+
+#if HCF_ASSERT
+extern IFBP BASED assert_ifbp;			//to make asserts easily work under MMD and DHF
+EXTERN_C void		 mdd_assert			(IFBP ifbp, unsigned int line_number, hcf_32 q );
+#endif //HCF_ASSERT
+
+#if ! ( (HCF_IO) & HCF_IO_32BITS )				// defined 16 bits only
+#undef OUT_PORT_STRING_32
+#undef IN_PORT_STRING_32
+#endif // HCF_IO
+#endif	//HCFDEFC_H
+
diff --git a/drivers/staging/wlags49_h2/man/wlags49.4 b/drivers/staging/wlags49_h2/man/wlags49.4
new file mode 100644
index 000000000000..a34588530740
--- /dev/null
+++ b/drivers/staging/wlags49_h2/man/wlags49.4
@@ -0,0 +1,734 @@
+.\" vim:tw=78:
+.\" Copyright (c) 1999-2003 Agere Systems Inc. -- http://www.agere.com
+.\" wlags49.4 7.20-abg 04/28/2004 13:30:00
+.\"
+.TH WLAGS49 4 "04/28/2004 13:30:00" "pcmcia-cs"
+.SH NAME
+wlags49 \- Agere Systems Wireless PC Card / PCI device drivers
+
+wlags49_h2_cs.o \- Hermes-II Card Services (PCMCIA/CF) driver
+.br
+wlags49_h2.o    \- Hermes-II MiniPCI driver
+.br
+wlags49_h25.o   \- Hermes-II.5 PCI/CardBus driver
+.br
+wlags49_h25_cs.o\- Hermes-II.5 Card Services (PCMCIA/CF) driver
+
+.SH SYNOPSIS
+.nh
+.fi
+.B insmod wlags49_[h1,h2]_[cs].o
+.br
+.RB [ Authentication=n ]
+.RB [ AuthKeyMngmtSuite=???? ]
+.RB [ BRSC2GHz=b ]\p
+.RB [ BRSC5GHz=b ]
+.RB [ Coexistence=n ]
+.RB [ Configured=???? ]\p
+.RB [ ConnectionControl=???? ]
+.RB [ CreateIBSS=s ]
+.RB [ DebugFlag=n ]\p
+.RB [ DesiredSSID=s ]
+.RB [ DownloadFirmware=n ]
+.RB [ DriverEnable=???? ]\p
+.RB [ EnableEncryption=s ]
+.RB [ Encryption=???? ]
+.RB [ ExcludeUnencrypted=s ]\p
+.RB [ IntraBSSRelay=s ]
+.RB [ IrqList=i,j,... ]
+.RB [ IrqMask=n ]\p
+.RB [ Key1=s ]
+.RB [ Key2=s ]
+.RB [ Key3=s ]
+.RB [ Key4=s ]\p
+.RB [ LoadBalancing=s ]
+.RB [ MaxSleepDuration=n ]
+.RB [ MediumDistribution=s ]\p
+.RB [ MicroWaveRobustness=s ]
+.RB [ MulticastPMBuffering=s ]
+.RB [ MulticastRate=n ]\p
+.RB [ MulticastReceive=s ]
+.RB [ NetworkAddress=n,n,n,n,n,n ]
+.RB [ NetworkType=???? ]\p
+.RB [ OwnATIMWindow=n ]
+.RB [ OwnBeaconInterval=n ]
+.RB [ OwnChannel=n ]\p
+.RB [ OwnDTIMPeriod=n ]
+.RB [ OwnName=s ]
+.RB [ OwnSSID=s ]\p
+.RB [ pc_debug=n ]
+.RB [ PMEnabled=b ]
+.RB [ PMHoldoverDuration=n ]\p
+.RB [ PortType=n ]
+.RB [ PowerMode=???? ]
+.RB [ PromiscuousMode=s ]\p
+.RB [ RejectANY=s ]
+.RB [ RTSThreshold=n ]\p
+.RB [ RTSThreshold1=n ]
+.RB [ RTSThreshold2=n ]
+.RB [ RTSThreshold3=n ]\p
+.RB [ RTSThreshold4=n ]
+.RB [ RTSThreshold5=n ]
+.RB [ RTSThreshold6=n ]\p
+.RB [ SRSC2GHz=b ]
+.RB [ SRSC5GHz=b ]
+.RB [ SystemScale=n ]\p
+.RB [ TxKey=n ]
+.RB [ TxRateControl=n ]\p
+.RB [ TxRateControl1=n ]
+.RB [ TxRateControl2=n ]
+.RB [ TxRateControl3=n ]\p
+.RB [ TxRateControl4=n ]
+.RB [ TxRateControl5=n ]
+.RB [ TxRateControl6=n ]\p
+.RB [ WDSAddress=n,n,n,n,n,n ]\p
+.RB [ WDSAddress1=n,n,n,n,n,n ]
+.RB [ WDSAddress2=n,n,n,n,n,n ]\p
+.RB [ WDSAddress3=n,n,n,n,n,n ]
+.RB [ WDSAddress4=n,n,n,n,n,n ]\p
+.RB [ WDSAddress5=n,n,n,n,n,n ]
+.RB [ WDSAddress6=n,n,n,n,n,n ]\p
+.fi
+
+
+
+.SH DESCRIPTION
+.I wlags49
+is the low-level Card Services / PCI driver for the
+.B Wireless PC Card, Wireless Integrated Card, Wireless Embedded Card
+and other wireless adapters based on the Agere Systems Hermes-II, and Hermes-II.5 wireless MAC. When this driver is attached to a card, it
+allocates the next available ethernet device (eth0..eth#). This
+device name will be passed on to
+.IR cardmgr (8),
+or the PCI subsystem, for the card configuration, and reported in the kernel log file
+with the I/O base address and MAC address used by the card.
+.SH FEATURES
+ \- Hot plug/unplug
+ \- Access Point and peer-to-peer communication
+ \- Card power management
+ \- Support for Hermes-II & Hermes-II.5 based PCMCIA, Mini PCI, and CardBus cards
+ \- Wired Equivalent Privacy (WEP)
+ \- WPA-PSK support (EXPERIMENTAL)
+ \- Driver utility interface (UIL)
+ \- Wireless Extensions
+ \- Software AP mode
+.SH PARAMETERS
+.TP
+.B Authentication=n
+Algorithm used for Authentication.
+.BR
+    1 \- Open System
+.BR
+    2 \- Shared Key
+.BR
+    Default: 1
+.TP
+.B Auth_key_mgmt_suite
+???????????????
+.TP
+.B BRSC2GHz=b
+Sets the card\'s Basic Rate Set in the 2.4GHz band. See SRSC2GHz
+for the value\'s format.
+.BR
+    Default: 15 (or 0x000F, only 11b rates to accept legacy 11b stations)
+.TP
+.B BRSC5GHz-b
+Sets the card\'s Basic Rate Set in the 5.0GHz band. See SRSC2GHz for the
+value\'s format
+.BR
+    Default: 4080 (or 0x0FF0, all 11a rates)
+.TP
+.B Coexistence=n
+Used to make the 802.11a/b/g coexistence behavior more strict.
+.BR
+    Default \- 0 (Use standard behavior)
+.TP
+.B ConnectionControl=n
+Configures the card\'s connection control process in dealing with multiple
+bands (802.11b/g vs. 802.11a).
+.BR
+    0 \- Single Band operation in 2GHz
+.BR
+    1 \- Single Band operation in 5GHz
+.BR
+    2 \- Multiple Band operation starting with 2GHz
+.BR
+    3 \- Multiple Band operation starting with 5GHz
+.BR
+    Default \- 2
+.TP
+.B Configured
+???????????????
+.TP
+.B ConnectionControl
+???????????????
+.TP
+.B CreateIBSS=s
+Enable or disable IBSS Creation.
+For correct operation, specification of a OwnSSID is required.
+This mode requires firmware 6.04 or higher.
+.BR
+    N \- Disable
+.BR
+    Y \- Enable
+.BR
+    Default: N
+.TP
+.B DebugFlag=n
+Selects the driver debugging level. This parameter is only available
+if the module is compiled with debugging enabled. Refer to the
+file
+.B debug.h
+in the source directory for information on the flag values.
+.BR
+    0x00000001L \- DBG_ERROR_ON
+.BR
+    0x00000002L \- DBG_WARNING_ON
+.BR
+    0x00000004L \- DBG_NOTICE_ON
+.BR
+    0x00000008L \- DBG_TRACE_ON
+.BR
+    0x00000010L \- DBG_VERBOSE_ON
+.BR
+    0x00000020L \- DBG_PARAM_ON
+.BR
+    0x00000040L \- DBG_BREAK_ON
+.BR
+    0x00000100L \- DBG_RX_ON
+.BR
+    0x00000200L \- DBG_TX_ON
+.BR
+    0x00000400L \- DBG_DS_ON
+.BR
+If the module is compiled with debugging enabled, DebugFlag
+defaults to DBG_ERROR_ON, DBG_WARNING_ON and DBG_BREAK_ON.
+DebugFlag overrules pc_debug.
+.TP
+.B DesiredSSID=s
+Same as OwnSSID.
+.TP
+.B DownloadFirmware=n
+This release of the driver introduces the ability to perform downloads of the STA/AP
+firmware. In fact, this is required for Hermes-II based cards. This parameter tells
+the driver which version of the firmware to download to the card.
+.BR
+    0 \- No download performed (Hermes-I only)
+.BR
+    1 \- Download STA firmware
+.BR
+    2 \- Download AP firmware
+.BR
+    Default: 1, when STA mode functionality is
+                included in the build
+             2, when code is built exclusively for
+                AP mode
+.TP
+.B DriverEnable
+???????????????
+.TP
+.B EnableEncryption=n
+Set the method of Data encryption.
+.BR
+    0 \- Disable
+.BR
+    1 \- Enable WEP Encryption
+.BR
+    2 \- Enable WPA with TKIP encryption
+.BR
+    Default: 0
+.TP
+.B Encryption
+???????????????
+.TP
+.B ExcludeUnencrypted=s
+Controls how the stations must communicate with the AP.
+.BR
+    Y \- Stations must enable encryption and provide
+         the proper encryption key to communicate
+         with the AP.
+.BR
+    N \- Stations do not need to enable encryption
+         to communicate with the AP.
+.BR
+    Default: N
+.TP
+.B IntraBSSRelay=s
+Controls the automatic relay of received messages that are destined for other
+stations in the BSS.
+.BR
+    Y \- Messages are relayed to the appropriate
+         station(s).
+.BR
+    N \- Messages are passed up to the host.
+.BR
+    Default: Y
+.TP
+.B IrqList=i,j,...
+Specifies the set of interrupts (up to 4) that may be allocated by
+this driver. This overrides the values set in the
+.B IrqMask
+parameter. NOTE: This parameter is for PCMCIA only.
+.TP
+.B IrqMask=n
+Specifies a mask of valid interrupts that may be allocated by this driver.
+If
+.B IrqList
+is also specified, the values in
+.B IrqList
+are used instead. NOTE: This parameter is for PCMCIA only.
+.BR
+    Default: 0xdeb8 (IRQ 3,4,5,7,9,10,11,12,14,15)
+.TP
+.B Key1=s
+Specifies one of 4 possible keys for the Data encryption.
+One of these keys, identified by TxKey,
+is used for the enciphering of Data that is transmitted by this station.
+All keys specified can be used for the deciphering of Data that is received.
+.BR
+The key value can be an ASCII character string or a hexadecimal value.
+The length of the key value can be 5 characters or 10 hexadecimal digits for
+the standard encryption (Silver or Gold card), or 13 characters or 26
+hexadecimal digits for the encryption with extended keys (Gold card only).
+The keys defined in the station must match the keys defined in the access
+points; both on value and number (1 through 4).
+.BR
+In 2.0 series Linux kernel modules, values that begin with a number are
+considered integers. In this case a hexadecimal value string or a character
+string starting with a number, will need to be surrounded by escaped
+double quotes (ie. Key1=\\"0x1122334455\\" Key2=\\"12xyz\\").
+.BR
+    5 or 13, printable character string, or
+.BR
+    10 or 26 hex digits if preceded by "0x".
+.BR
+    If this parameter is omitted, the default of the MAC is used ( = 0-length).
+.TP
+.B Key2=s
+Same as Key1.
+.TP
+.B Key3=s
+Same as Key1.
+.TP
+.B Key4=s
+Same as Key1.
+.TP
+.B LoadBalancing=s
+Control for the Load Balancing algorithm for both STAs and APs. The AP
+includes a load balancing element in the Probe Response and Beacon frames.
+The STA uses this info to select an AP, not only based on comms quality, but
+also on the load of that AP.
+.BR
+    Default: Y
+.TP
+.B MaxDataLength
+???????????????
+.TP
+.B MaxSleepDuration=n
+Set the maximum Power Management sleep duration in milliseconds.
+Valid values are 0 to 65535 milliseconds.
+.BR
+    Default: 100
+.TP
+.B MediumDistribution=s
+Control for the distribution of medium parameters, like communication
+thresholds, microwave robustness, RTS/CTS thresholds, by APs. The associated
+stations replace their own values with the received values.
+.BR
+    Default=Y
+.TP
+.B MicroWaveRobustness=s
+Enable or disable Microwave Oven Robustness.
+.BR
+    N \- Disable
+.BR
+    Y \- Enable
+.BR
+    Default: N
+.TP
+.B MulticastPMBuffering=s
+Controls buffering of multicast MAC frames for transmission after DTIM. If no,
+multicast MAC frames are directly placed in the output queue.
+.BR
+    Default: Y
+.TP
+.B MulticastRate=n
+Sets the data rate for multicast message transmission.
+.BR
+    1 \- Fixed 1Mb/s
+    2 \- Fixed 2Mb/s
+    3 \- Fixed 5.5Mb/s
+    4 \- Fixed 11Mb/s
+.BR
+    Default: 2
+
+For Hermes-II.5, an INTEGER CONVERTED bit mask representing the
+rate to multicast, where the rates supported are as follows:
+
+Bit  : 15|14|13|12|11|10|09|08|07|06|05|04|03|02|01|00
+.br
+------------------------------------------------------
+.br
+Rate : XX|XX|XX|XX|54|48|36|24|18|12| 9| 6|11|5.5|2| 1
+
+    Default: 4 (Translates to 0x0004 = 5.5 Mb/sec)
+
+.TP
+.B MulticastReceive=s
+Enable or disable receiving of all multicast packets when Card Power Management
+is enabled. When enabled, the station will wake up frequently
+to receive the multicast frames. This causes less optimal power savings.
+.BR
+    N \- Disable
+.BR
+    Y \- Enable
+.BR
+    Default: Y
+.TP
+.B NetworkAddress=n,n,n,n,n,n
+Sets the adapter hardware ethernet address (MAC address) to the value
+specified. Note that this is to be used to specify a Local MAC address. Do
+not specify this parameter if the card\'s universal address is to be used.
+Valid values are six hexadecimal digit-pairs (prefixed with 0x).
+.BR
+    Default: <factory assigned address>
+.TP
+.B NetworkType
+???????????????
+.TP
+.B OwnATIMWindow=n
+ATIM window time used for creating an IBSS.
+.BR
+    Range: 0..100
+.BR
+    Default: 0
+.TP
+.B OwnBeaconInterval=b
+Beacon Interval in TU
+.BR
+    Range 20..200
+.BR
+    Default \- 100
+.TP
+.B channel=n
+Same as OwnChannel.
+.TP
+.B OwnChannel=n
+Sets the channel the Ad-Hoc or IBSS mode will use.
+The default channel for Ad-Hoc mode is determined by the Wireless PC Card.
+The default channel for IBSS is set to 10 by the driver.
+This value has no effect when the adapter is used with an Access Point
+(BSS network) since the Access Point automatically determines the channel.
+Valid values are 0 to 14. However the channels allowed in
+your region are subject to local regulations and are limited at
+manufacturing time of the Wireless PC Card. When the provided value is
+not allowed, the value remains unchanged.
+.BR
+    0 \- Use default channel
+.BR
+    Default: 0
+.TP
+.B OwnDTIMPeriod=n
+The number of beacon intervals between successive Delivery Traffic Identification
+Maps (DTIMs).
+.BR
+    Range: 1..65535
+.BR
+    Default: 1
+.TP
+.B OwnName=s
+Sets the station name to the specified string value. This parameter
+is used for diagnostic purposes, as a user\-friendly identification
+of this system. This parameter accepts a maximum of 32 characters.
+.BR
+    Default: Linux
+.TP
+.B OwnSSID=s
+Sets the card network name to the specified string value. This parameter
+accepts a maximum of 32 characters. Whitespace in the network name
+will need to be escaped with a backslash (ie. OwnSSID=My\\ Network).
+.BR
+    Default: ANY
+.TP
+.B pc_debug=n
+Selects the PCMCIA debugging level. This parameter is only available
+if the module is compiled with debugging enabled. A non\-zero value
+enables debugging. Higher values yield more information, i.e. for any value all
+lower values are implied.
+.BR
+    8 \- DBG_DS_ON
+.BR
+    7 \- DBG_RX_ON | DBG_TX_ON
+.BR
+    6 \- DBG_PARAM_ON
+.BR
+    5 \- DBG_TRACE_ON
+.BR
+    4 \- DBG_VERBOSE_ON
+.BR
+If the module is compiled with debugging enabled, pc_debug defaults to 5.
+DebugFlag overrules pc_debug.
+.BR
+The name pc_debug rather than PcDebug, since pc_debug is used by many PCMCIA driver.
+.TP
+.B PMEnabled=b
+Sets the card\'s Power Management state.
+.BR
+    0 \- Disable
+.BR
+    1 \- Enable Enhanced Mode
+.BR
+    2 \- Enabled Standard Mode
+.BR
+    0x8000 \- Enhanced?????? Mode (to be combined with 0x0001 or 0x0002)
+
+    Default: 0 (Disabled)
+.TP
+.B PMHoldoverDuration=n
+Time that the station remains in an awake state after a MAC frame transfer if
+Enhanced Power Save is active.
+.BR
+    Range: 1..1000
+.BR
+    Default: 100
+.TP
+.B PowerMode
+???????????????
+.TP
+.B PortType=n
+Selects the type of network operation.
+.BR
+    1 \- Normal Operation (BSS or IBSS)
+.BR
+    3 \- Ad-Hoc Demo Mode
+.BR
+    Default: 1
+.TP
+.B PromiscuousMode=s
+Switch for promiscuous mode reception.
+.BR
+    Default: N
+.TP
+.B RejectANY=s
+Controls how stations associate to the device.
+.BR
+    Y \- Stations must provide the correct SSID to
+         associate to the AP.
+.BR
+    N \- Stations are not required to provide the
+         correct SSID to associate to the AP.
+         Known as an \'open\' network.
+.BR
+    Default - N
+.TP
+.B RTSThreshold=n
+Controls the RTS/CTS handshake threshold for transmissions in Station mode.
+Valid values are 0 to 2347.
+.BR
+    500  \- Hidden Stations
+.BR
+    2347 \- No RTS/CTS
+.BR
+    Default: 2347
+.TP
+.B RTSThreshold1=n
+Same as RTSThreshold, only for port 1 of in AccessPoint mode.
+.TP
+.B RTSThreshold2=n
+Same as RTSThreshold1, only for port 2.
+.TP
+.B RTSThreshold3=n
+Same as RTSThreshold1, only for port 3.
+.TP
+.B RTSThreshold4=n
+Same as RTSThreshold1, only for port 4.
+.TP
+.B RTSThreshold5=n
+Same as RTSThreshold1, only for port 5.
+.TP
+.B RTSThreshold6=n
+Same as RTSThreshold1, only for port 6.
+.TP
+.B SRSC2GHz=b
+Sets the card\'s Supported Rate Set in the 2.4GHz band. The value
+is an INTEGER CONVERTED bit mask representing the rates to support,
+where the rates supported are as follows:
+
+Bit  : 15|14|13|12|11|10|09|08|07|06|05|04|03|02|01|00
+.br
+------------------------------------------------------
+.br
+Rate : XX|XX|XX|XX|54|48|36|24|18|12| 9| 6|11|5.5|2| 1
+.BR
+    Default: 4095 (or 0x0FFF, all 11b and 11g rates)
+.TP
+.B SRSC5GHz=b
+Sets the card\'s Supported Rate Set in the 5.0GHz band. See SRSC2GHz
+for the value\'s format.
+.BR
+    Default: 4080 (or 0x0FF0, all 11a rates)
+.TP
+.B SystemScale=n
+Sets the distance between Access Points in the network. This value
+influences the Modem Thresholds (EnergyDetectThreshold,
+CarrierDetectThreshold and DeferThreshold) and
+the Roaming Thresholds (CellSearchThreshold and OutOfRangeThreshold).
+.BR
+    1 \- Large
+.BR
+    2 \- Medium
+.BR
+    3 \- Small
+.BR
+    Default: 1
+.TP
+.B TxRateControl=n
+Sets the data rate to be used by the transmitter. For Hermes-II:
+.BR
+    1 \- Fixed Low (1 Mb/sec)
+.BR
+    2 \- Fixed Standard (2 Mb/sec)
+.BR
+    3 \- Auto Rate Select High (11, 5.5, 2, 1 Mb/sec)
+.BR
+    4 \- Fixed Medium (5.5 Mb/sec)
+.BR
+    5 \- Fixed High (11 Mb/sec)
+.BR
+    6 \- Auto Rate Select Standard (2, 1 Mb/sec)
+.BR
+    7 \- Auto Rate Select Medium (5.5, 2, 1 Mb/sec)
+.BR
+    Default: 3
+
+For Hermes-II.5, an INTEGER CONVERTED bit mask representing all of the
+rates to support, where the rates supported are as follows:
+
+Bit  : 15|14|13|12|11|10|09|08|07|06|05|04|03|02|01|00
+.br
+------------------------------------------------------
+.br
+Rate : XX|XX|XX|XX|54|48|36|24|18|12| 9| 6|11|5.5|2| 1
+.BR
+    Default: 4095 (Translates to 0xFFF, which is all rates)
+.TP
+.B RTSThreshold=n
+Sets the number of octets in a message or fragment above which a
+RTS/CTS handshake is performed.
+Valid values are 0 to 2347.
+.BR
+    500  \- Hidden Stations
+.BR
+    2347 \- No RTS/CTS
+.BR
+    Default: 2347
+.TP
+.B TxKey=n
+Designates which of the keys is to be used for the enciphering of data that is
+transmitted by this station.
+.BR
+    Integer in the range 1..4.
+.BR
+    Default: 1
+.TP
+.B TxPowLevel
+???????????????
+.TP
+.B TxRateControl=n
+Sets the data rate to be used by the transmitter in Station mode.
+.BR
+    1 \- Fixed Low
+.BR
+    2 \- Fixed Standard
+.BR
+    3 \- Auto Rate Select (High)
+.BR
+    4 \- Fixed Medium
+.BR
+    5 \- Fixed High
+.BR
+    6 \- Auto Rate Select (Standard)
+.BR
+    7 \- Auto Rate Select (Medium)
+.BR
+    Default: 3
+
+For Hermes-II.5, an INTEGER CONVERTED bit mask representing all of the
+rates to support, where the rates supported are as follows:
+
+Bit  : 15|14|13|12|11|10|09|08|07|06|05|04|03|02|01|00
+.br
+------------------------------------------------------
+.br
+Rate : XX|XX|XX|XX|54|48|36|24|18|12| 9| 6|11|5.5|2| 1
+.BR
+    Default: 4095 (Translates to 0xFFF, which is all rates)
+
+.TP
+.B TxRateControl1=n
+Same as TxRateControl, only for port 1 in AccessPoint mode.
+.TP
+.B TxRateControl2=n
+Same as TxRateControl1, only for port 2.
+.TP
+.B TxRateControl3=n
+Same as TxRateControl1, only for port 3.
+.TP
+.B TxRateControl4=n
+Same as TxRateControl1, only for port 4.
+.TP
+.B TxRateControl5=n
+Same as TxRateControl1, only for port 5.
+.TP
+.B TxRateControl6=n
+Same as TxRateControl1, only for port 6.
+.TP
+.B VendorDescription
+???????????????
+.TP
+.B WDSAddress=n,n,n,n,n,n
+MAC address that identifies the corresponding node of the WDS port in Station mode.
+Note that for WDS to work properly, a bridge interface must be setup between the device and
+the wds network devices created by the driver. For more information on bridge
+interfaces, please refer to the man page for \'brctl\'.
+.BR
+    Default: 00:00:00:00:00:00
+.TP
+.B WDSAddress1=n,n,n,n,n,n
+Same as WDSAddress, only for port 1 in AccessPoint mode.
+.TP
+.B WDSAddress2=n,n,n,n,n,n
+Same as WDSAddress1, only for port 2.
+.TP
+.B WDSAddress3=n,n,n,n,n,n
+Same as WDSAddress1, only for port 3.
+.TP
+.B WDSAddress4=n,n,n,n,n,n
+Same as WDSAddress1, only for port 4.
+.TP
+.B WDSAddress5=n,n,n,n,n,n
+Same as WDSAddress1, only for port 5.
+.TP
+.B WDSAddress6=n,n,n,n,n,n
+Same as WDSAddress1, only for port 6.
+.SH SECURITY
+On a multi-user system only the system administrator needs access to the WEP
+encryption keys. In this case, consider removing the read permission for
+normal users of the PCMCIA config.opts file, the system log file, and any
+Agere proprietary iwconfig-eth<n> scripts.
+.SH CONTACT
+If you encounter problems when installing or using this product, or would like
+information about our other "Wireless" products, please contact your local
+Authorized "Wireless" Reseller or Agere Systems sales office.
+
+Addresses and telephone numbers of the Agere Systems sales offices are
+listed on our Agere Systems web site.
+.TP
+.B WWW
+http://www.agere.com
+.SH SEE ALSO
+.BR cardmgr (8),
+.BR pcmcia (5),
+.BR ifconfig (8),
+.BR insmod (8),
+.BR brctl (8).
diff --git a/drivers/staging/wlags49_h2/mdd.h b/drivers/staging/wlags49_h2/mdd.h
new file mode 100644
index 000000000000..b45c7ddd92e2
--- /dev/null
+++ b/drivers/staging/wlags49_h2/mdd.h
@@ -0,0 +1,1156 @@
+
+//   vim:tw=110:ts=4:
+#ifndef MDD_H
+#define MDD_H 1
+
+/*************************************************************************************************************
+*
+* FILE		: mdd.h
+*
+* DATE		: $Date: 2004/08/05 11:47:10 $   $Revision: 1.6 $
+* Original		: 2004/05/25 05:59:37    Revision: 1.57      Tag: hcf7_t20040602_01
+* Original		: 2004/05/13 15:31:45    Revision: 1.54      Tag: hcf7_t7_20040513_01
+* Original		: 2004/04/15 09:24:41    Revision: 1.47      Tag: hcf7_t7_20040415_01
+* Original		: 2004/04/13 14:22:45    Revision: 1.46      Tag: t7_20040413_01
+* Original		: 2004/04/01 15:32:55    Revision: 1.42      Tag: t7_20040401_01
+* Original		: 2004/03/10 15:39:28    Revision: 1.38      Tag: t20040310_01
+* Original		: 2004/03/04 11:03:37    Revision: 1.36      Tag: t20040304_01
+* Original		: 2004/03/02 09:27:11    Revision: 1.34      Tag: t20040302_03
+* Original		: 2004/02/24 13:00:27    Revision: 1.29      Tag: t20040224_01
+* Original		: 2004/02/18 17:13:57    Revision: 1.26      Tag: t20040219_01
+*
+* AUTHOR	: Nico Valster
+*
+* DESC		: Definitions and Prototypes for HCF, DHF, MMD and MSF
+*
+***************************************************************************************************************
+*
+*
+* SOFTWARE LICENSE
+*
+* This software is provided subject to the following terms and conditions,
+* which you should read carefully before using the software.  Using this
+* software indicates your acceptance of these terms and conditions.  If you do
+* not agree with these terms and conditions, do not use the software.
+*
+* COPYRIGHT © 1994 - 1995	by AT&T.				All Rights Reserved
+* COPYRIGHT © 1996 - 2000 by Lucent Technologies.	All Rights Reserved
+* COPYRIGHT © 2001 - 2004	by Agere Systems Inc.	All Rights Reserved
+* All rights reserved.
+*
+* Redistribution and use in source or binary forms, with or without
+* modifications, are permitted provided that the following conditions are met:
+*
+* . Redistributions of source code must retain the above copyright notice, this
+*    list of conditions and the following Disclaimer as comments in the code as
+*    well as in the documentation and/or other materials provided with the
+*    distribution.
+*
+* . Redistributions in binary form must reproduce the above copyright notice,
+*    this list of conditions and the following Disclaimer in the documentation
+*    and/or other materials provided with the distribution.
+*
+* . Neither the name of Agere Systems Inc. nor the names of the contributors
+*    may be used to endorse or promote products derived from this software
+*    without specific prior written permission.
+*
+* Disclaimer
+*
+* THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
+* INCLUDING, BUT NOT LIMITED TO, INFRINGEMENT AND THE IMPLIED WARRANTIES OF
+* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  ANY
+* USE, MODIFICATION OR DISTRIBUTION OF THIS SOFTWARE IS SOLELY AT THE USERS OWN
+* RISK. IN NO EVENT SHALL AGERE SYSTEMS INC. OR CONTRIBUTORS BE LIABLE FOR ANY
+* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+* ON ANY THEORY OF LIABILITY, INCLUDING, BUT NOT LIMITED TO, CONTRACT, STRICT
+* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+* OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+* DAMAGE.
+*
+*
+************************************************************************************************************/
+
+
+/************************************************************************************************************
+*
+* The macros Xn(...) and XXn(...) are used to define the LTV's (short for Length Type Value[ ]) ,
+* aka RIDs, processed by the Hermes.
+* The n in Xn and XXn reflects the number of "Value" fields in these RIDs.
+*
+* Xn(...) : Macros used for RIDs which use only type hcf_16 for the "V" fields of the LTV.
+* Xn takes as parameters a RID name and "n" name(s), one for each of the "V" fields of the LTV.
+*
+* XXn(...) : Macros used for RIDs which use at least one other type then hcf_16 for a "V" field
+* of the LTV.
+* XXn(..) takes as parameters a RID name and "n" pair(s) of type and name, one for each "V" field
+* of the LTV
+
+ ******************************************  e x a m p l e s  ***********************************************
+
+* X1(RID_NAME, parameters...) : expands to :
+*    typedef struct RID_NAME_STRCT {
+*         hcf_16  len;
+*         hcf_16  typ;
+*         hcf_16  par1;
+*    } RID_NAME_STRCT;
+
+* X2(RID_NAME, parameters...) : expands to :
+*    typedef struct RID_NAME_STRCT {
+*         hcf_16  len;
+*         hcf_16  typ;
+*         hcf_16  par1;
+*         hcf_16  par2;
+*    } RID_NAME_STRCT;
+
+
+* XX1(RID_NAME, par1type, par1name, ...) : expands to :
+*    typedef struct RID_NAME_STRCT {
+*       hcf_16    len;
+*       hcf_16    typ;
+*       par1type  par1name;
+*    } RID_NAME_STRCT;
+
+************************************************************************************************************/
+
+/******************************* XX Sub-macro definitions **************************************************/
+
+#define XX1( name, type1, par1 )	\
+typedef struct {				  	\
+	hcf_16	len;                	\
+	hcf_16	typ;                	\
+	type1	par1;               	\
+} name##_STRCT;
+
+#define XX2( name, type1, par1, type2, par2 )	\
+typedef struct {				   	\
+	hcf_16	len;                	\
+	hcf_16	typ;                	\
+	type1	par1;               	\
+	type2	par2;               	\
+} name##_STRCT;
+
+#define XX3( name, type1, par1, type2, par2, type3, par3 )	\
+typedef struct name##_STRCT {   	\
+	hcf_16	len;                	\
+	hcf_16	typ;                	\
+	type1	par1;               	\
+	type2	par2;               	\
+	type3	par3;               	\
+} name##_STRCT;
+
+#define XX4( name, type1, par1, type2, par2, type3, par3, type4, par4 )	\
+typedef struct {				  	\
+	hcf_16	len;                	\
+	hcf_16	typ;                	\
+	type1	par1;               	\
+	type2	par2;               	\
+	type3	par3;               	\
+	type4	par4;               	\
+} name##_STRCT;
+
+#define X1( name, par1 )	\
+typedef struct name##_STRCT {   	\
+	hcf_16	len;                	\
+	hcf_16	typ;                	\
+	hcf_16	par1;               	\
+} name##_STRCT;
+
+#define X2( name, par1, par2 )		\
+typedef struct {			    	\
+	hcf_16	len;                	\
+	hcf_16	typ;                	\
+	hcf_16	par1;               	\
+	hcf_16	par2;               	\
+} name##_STRCT;
+
+#define X3( name, par1, par2, par3 )		\
+typedef struct {			    	\
+	hcf_16	len;                	\
+	hcf_16	typ;                	\
+	hcf_16	par1;               	\
+	hcf_16	par2;               	\
+	hcf_16	par3;               	\
+} name##_STRCT;
+
+#define X4( name, par1, par2, par3, par4 )		\
+typedef struct {			    	\
+	hcf_16	len;                	\
+	hcf_16	typ;                	\
+	hcf_16	par1;               	\
+	hcf_16	par2;               	\
+	hcf_16	par3;               	\
+	hcf_16	par4;               	\
+} name##_STRCT;
+
+#define X5( name, par1, par2, par3, par4, par5 )		\
+typedef struct {			    	\
+	hcf_16	len;                	\
+	hcf_16	typ;                	\
+	hcf_16	par1;               	\
+	hcf_16	par2;               	\
+	hcf_16	par3;               	\
+	hcf_16	par4;               	\
+	hcf_16	par5;               	\
+} name##_STRCT;
+
+#define X6( name, par1, par2, par3, par4, par5, par6 )		\
+typedef struct {			    	\
+	hcf_16	len;                	\
+	hcf_16	typ;                	\
+	hcf_16	par1;               	\
+	hcf_16	par2;               	\
+	hcf_16	par3;               	\
+	hcf_16	par4;               	\
+	hcf_16	par5;               	\
+	hcf_16	par6;               	\
+} name##_STRCT;
+
+#define X8( name, par1, par2, par3, par4, par5, par6, par7, par8 )		\
+typedef struct {			    	\
+	hcf_16	len;                	\
+	hcf_16	typ;                	\
+	hcf_16	par1;               	\
+	hcf_16	par2;               	\
+	hcf_16	par3;               	\
+	hcf_16	par4;               	\
+	hcf_16	par5;               	\
+	hcf_16	par6;               	\
+	hcf_16	par7;               	\
+	hcf_16	par8;               	\
+} name##_STRCT;
+
+#define X11( name, par1, par2, par3, par4, par5, par6, par7, par8, par9, par10, par11 )		\
+typedef struct {			    	\
+	hcf_16	len;                	\
+	hcf_16	typ;                	\
+	hcf_16	par1;               	\
+	hcf_16	par2;               	\
+	hcf_16	par3;               	\
+	hcf_16	par4;               	\
+	hcf_16	par5;               	\
+	hcf_16	par6;               	\
+	hcf_16	par7;               	\
+	hcf_16	par8;               	\
+	hcf_16	par9;               	\
+	hcf_16	par10;               	\
+	hcf_16	par11;               	\
+} name##_STRCT;
+
+/******************************* Substructure definitions **************************************************/
+
+//apparently not needed (CFG_CNF_COUNTRY)
+typedef struct CHANNEL_SET {				//channel set structure used in the CFG_CNF_COUNTRY LTV
+	hcf_16	first_channel;
+	hcf_16	number_of_channels;
+	hcf_16	max_tx_output_level;
+} CHANNEL_SET;
+
+typedef struct KEY_STRCT {					// key structure used in the CFG_DEFAULT_KEYS LTV
+    hcf_16  len;	              				//length of key
+    hcf_8   key[14];							//encryption key
+} KEY_STRCT;
+
+typedef struct SCAN_RS_STRCT {				// Scan Result structure used in the CFG_SCAN LTV
+	hcf_16	channel_id;
+	hcf_16	noise_level;
+	hcf_16	signal_level;
+	hcf_8	bssid[6];
+	hcf_16	beacon_interval_time;
+	hcf_16	capability;
+	hcf_16	ssid_len;
+	hcf_8	ssid_val[32];
+} SCAN_RS_STRCT;
+
+typedef struct CFG_RANGE_SPEC_STRCT {		// range specification structure used in CFG_RANGES, CFG_RANGE1 etc
+	hcf_16	variant;
+	hcf_16	bottom;
+	hcf_16	top;
+} CFG_RANGE_SPEC_STRCT;
+
+typedef struct CFG_RANGE_SPEC_BYTE_STRCT {	// byte oriented range specification structure used in CFG_RANGE_B LTV
+	hcf_8	variant[2];
+	hcf_8	bottom[2];
+	hcf_8	top[2];
+} CFG_RANGE_SPEC_BYTE_STRCT;
+
+//used to set up "T" functionality for Info frames, i.e. log info frames in MSF supplied buffer and MailBox
+XX1( RID_LOG, unsigned short FAR*, bufp )
+typedef RID_LOG_STRCT  FAR *RID_LOGP;
+XX1( CFG_RID_LOG, RID_LOGP, recordp )
+
+ X1( LTV,		val[1] )												/*minimum LTV proto typ	*/
+ X1( LTV_MAX,	val[HCF_MAX_LTV] )										/*maximum LTV proto typ	*/
+XX2( CFG_REG_MB, hcf_16* , mb_addr, hcf_16, mb_size )
+
+typedef struct CFG_MB_INFO_FRAG {	// specification of buffer fragment
+	unsigned short FAR*	frag_addr;
+	hcf_16				frag_len;
+} CFG_MB_INFO_FRAG;
+
+/* Mail Box Info Block structures,
+ * the base form: CFG_MB_INFO_STRCT
+ * and the derived forms: CFG_MB_INFO_RANGE<n>_STRCT with n is 1, 2, 3 or 20
+ * predefined for a payload of 1, and up to 2, 3 and 20 CFG_MB_INFO_FRAG elements */
+XX3( CFG_MB_INFO,		  hcf_16, base_typ, hcf_16, frag_cnt, CFG_MB_INFO_FRAG, frag_buf[ 1] )
+XX3( CFG_MB_INFO_RANGE1,  hcf_16, base_typ, hcf_16, frag_cnt, CFG_MB_INFO_FRAG, frag_buf[ 1] )
+XX3( CFG_MB_INFO_RANGE2,  hcf_16, base_typ, hcf_16, frag_cnt, CFG_MB_INFO_FRAG, frag_buf[ 2] )
+XX3( CFG_MB_INFO_RANGE3,  hcf_16, base_typ, hcf_16, frag_cnt, CFG_MB_INFO_FRAG, frag_buf[ 3] )
+XX3( CFG_MB_INFO_RANGE20, hcf_16, base_typ, hcf_16, frag_cnt, CFG_MB_INFO_FRAG, frag_buf[20] )
+
+XX3( CFG_MB_ASSERT, hcf_16, line, hcf_16, trace, hcf_32, qualifier )	/*MBInfoBlock for asserts	*/
+#if (HCF_ASSERT) & ( HCF_ASSERT_LNK_MSF_RTN | HCF_ASSERT_RT_MSF_RTN )
+typedef void (MSF_ASSERT_RTN)( unsigned int , hcf_16, hcf_32 );
+typedef MSF_ASSERT_RTN /*can't link FAR*/ * MSF_ASSERT_RTNP;
+/* CFG_REG_ASSERT_RTNP (0x0832)	(de-)register MSF Callback routines
+ * lvl:  Assert level filtering (not yet implemented)
+ * rtnp: address of MSF_ASSERT_RTN (native Endian format) */
+XX2( CFG_REG_ASSERT_RTNP, hcf_16, lvl, MSF_ASSERT_RTNP, rtnp )
+#endif // HCF_ASSERT_LNK_MSF_RTN / HCF_ASSERT_RT_MSF_RTN
+
+ X1( CFG_HCF_OPT, val[20] )											  	/*(Compile time) options	*/
+ X3( CFG_CMD_HCF, cmd, mode, add_info )									/*HCF Engineering command	*/
+
+typedef struct {
+	hcf_16		len;
+	hcf_16		typ;
+	hcf_16		mode;			// PROG_STOP/VOLATILE [FLASH/SEEPROM/SEEPROM_READBACK]
+	hcf_16		segment_size;  	// size of the segment in bytes
+	hcf_32		nic_addr;  		// destination address (in NIC memory)
+	hcf_16		flags;			// 0x0001	: CRC Yes/No
+//	hcf_32		flags;			// 0x0001	: CRC Yes/No
+	/* ;? still not the whole story
+	 * flags is extended from 16 to 32 bits to force that compiling FW.C produces the same structures
+	 * in memory as FUPU4 BIN files.
+	 * Note that the problem arises from the violation of the constraint to use packing at byte boundaries
+	 * as was stipulated in the WCI-specification
+	 * The Pack pragma can't resolve this issue, because that impacts all members of the structure with
+	 * disregard of their actual size, so aligning host_addr under MSVC 1.5 at 4 bytes, also aligns
+	 * len, typ etc on 4 bytes
+	 * */
+//	hcf_16		pad; 	 		//!! be careful alignment problems for Bin download versus C download
+	hcf_8 FAR   *host_addr;  	// source address (in Host memory)
+} CFG_PROG_STRCT; // segment_descp;
+
+// a structure used for transporting debug-related information from firmware
+// via the HCF, into the MSF
+typedef struct {
+    hcf_16      len;
+    hcf_16      typ;
+    hcf_16      msg_id, msg_par, msg_tstamp;
+} CFG_FW_PRINTF_STRCT;
+
+// a structure used to define the location and size of a certain debug-related
+// buffer in nic-ram.
+typedef struct {
+    hcf_16      len;
+    hcf_16      typ;
+    hcf_32      DbMsgCount, 	// ds (nicram) address of a counter
+                DbMsgBuffer, 	// ds (nicram) address of the buffer
+                DbMsgSize, 		// number of entries (each 3 word in size) in this buffer
+                DbMsgIntrvl;	// ds (nicram) address of interval for generating InfDrop event
+} CFG_FW_PRINTF_BUFFER_LOCATION_STRCT;
+
+XX3( CFG_RANGES,	hcf_16, role, hcf_16, id, CFG_RANGE_SPEC_STRCT, var_rec[ 1] ) /*Actor/Supplier range (1 variant)*/
+XX3( CFG_RANGE1,	hcf_16, role, hcf_16, id, CFG_RANGE_SPEC_STRCT, var_rec[ 1] ) /*Actor/Supplier range (1 variant)*/
+XX3( CFG_RANGE2,	hcf_16, role, hcf_16, id, CFG_RANGE_SPEC_STRCT, var_rec[ 2] ) /*Actor range ( 2 variants)		*/
+XX3( CFG_RANGE3,	hcf_16, role, hcf_16, id, CFG_RANGE_SPEC_STRCT, var_rec[ 3] ) /*Actor range ( 3 variants)		*/
+XX3( CFG_RANGE4,	hcf_16, role, hcf_16, id, CFG_RANGE_SPEC_STRCT, var_rec[ 4] ) /*Actor range ( 4 variants)		*/
+XX3( CFG_RANGE5,	hcf_16, role, hcf_16, id, CFG_RANGE_SPEC_STRCT, var_rec[ 5] ) /*Actor range ( 5 variants)		*/
+XX3( CFG_RANGE6,	hcf_16, role, hcf_16, id, CFG_RANGE_SPEC_STRCT, var_rec[ 6] ) /*Actor range ( 6 variants)		*/
+XX3( CFG_RANGE7,	hcf_16, role, hcf_16, id, CFG_RANGE_SPEC_STRCT, var_rec[ 7] ) /*Actor range ( 7 variants)		*/
+XX3( CFG_RANGE20,	hcf_16, role, hcf_16, id, CFG_RANGE_SPEC_STRCT, var_rec[20] ) /*Actor range (20 variants)		*/
+
+/*Frames */
+ X3( CFG_ASSOC_STAT,  assoc_stat, station_addr[3], val[46] ) 	/*Association status, basic					*/
+ X2( CFG_ASSOC_STAT3, assoc_stat, station_addr[3] ) 								/*assoc_stat:3			*/
+ X3( CFG_ASSOC_STAT1, assoc_stat, station_addr[3], frame_body[43] )					/*assoc_stat:1			*/
+ X4( CFG_ASSOC_STAT2, assoc_stat, station_addr[3], old_ap_addr[3], frame_body[43] )	/*assoc_stat:2			*/
+
+/*Static Configurations */
+ X1( CFG_CNF_PORT_TYPE,				port_type			 ) /*[STA] Connection control characteristics				*/
+ X1( CFG_MAC_ADDR,					mac_addr[3] 		 ) /*general: FC01,FC08,FC11,FC12,FC13,FC14,FC15,FC16 		*/
+ X1( CFG_CNF_OWN_MAC_ADDR,			mac_addr[3]			 )
+ X1( CFG_ID,						ssid[17]			 ) /*0xFC02, 0xFC04, 0xFC0E 								*/
+/*	X1( CFG_DESIRED_SSID,			ssid[17]			 )	see Dynamic Configurations								*/
+ X1( CFG_CNF_OWN_CHANNEL,			channel				 ) /*Communication channel for BSS creation					*/
+ X1( CFG_CNF_OWN_SSID,				ssid[17]			 )
+ X1( CFG_CNF_OWN_ATIM_WINDOW,		atim_window			 )
+ X1( CFG_CNF_SYSTEM_SCALE,			system_scale		 )
+ X1( CFG_CNF_MAX_DATA_LEN,			max_data_len		 )
+ X1( CFG_CNF_WDS_ADDR,				mac_addr[3]			 ) /*[STA] MAC Address of corresponding WDS Link node		*/
+ X1( CFG_CNF_PM_ENABLED,			pm_enabled			 ) /*[STA] Switch for ESS Power Management (PM) On/Off		*/
+ X1( CFG_CNF_PM_EPS,				pm_eps				 ) /*[STA] Switch for ESS PM EPS/PS Mode					*/
+ X1( CFG_CNF_MCAST_RX,				mcast_rx			 ) /*[STA] Switch for ESS PM Multicast reception On/Off		*/
+ X1( CFG_CNF_MAX_SLEEP_DURATION,	duration			 ) /*[STA] Maximum sleep time for ESS PM					*/
+ X1( CFG_CNF_PM_HOLDOVER_DURATION,	duration			 ) /*[STA] Holdover time for ESS PM							*/
+ X1( CFG_CNF_OWN_NAME,				ssid[17]			 ) /*Identification text for diagnostic purposes			*/
+ X1( CFG_CNF_OWN_DTIM_PERIOD,		period				 ) /*[AP] Beacon intervals between successive DTIMs			*/
+ X1( CFG_CNF_WDS_ADDR1,				mac_addr[3]			 ) /*[AP] Port 1 MAC Adrs of corresponding WDS Link node	*/
+ X1( CFG_CNF_WDS_ADDR2,				mac_addr[3]			 ) /*[AP] Port 2 MAC Adrs of corresponding WDS Link node	*/
+ X1( CFG_CNF_WDS_ADDR3,				mac_addr[3]			 ) /*[AP] Port 3 MAC Adrs of corresponding WDS Link node	*/
+ X1( CFG_CNF_WDS_ADDR4,				mac_addr[3]			 ) /*[AP] Port 4 MAC Adrs of corresponding WDS Link node	*/
+ X1( CFG_CNF_WDS_ADDR5,				mac_addr[3]			 ) /*[AP] Port 5 MAC Adrs of corresponding WDS Link node	*/
+ X1( CFG_CNF_WDS_ADDR6,				mac_addr[3]			 ) /*[AP] Port 6 MAC Adrs of corresponding WDS Link node	*/
+ X1( CFG_CNF_MCAST_PM_BUF,			mcast_pm_buf		 ) /*[AP] Switch for PM buffering of Multicast Messages	*/
+ X1( CFG_CNF_REJECT_ANY,			reject_any			 ) /*[AP] Switch for PM buffering of Multicast Messages	*/
+//X1( CFG_CNF_ENCRYPTION_ENABLED,	encryption			 ) /*specify encryption type of Tx/Rx messages				*/
+ X1( CFG_CNF_ENCRYPTION,			encryption			 ) /*specify encryption type of Tx/Rx messages				*/
+ X1( CFG_CNF_AUTHENTICATION,		authentication		 ) /*selects Authentication algorithm						*/
+ X1( CFG_CNF_EXCL_UNENCRYPTED,		exclude_unencrypted	 ) /*[AP] Switch for 'clear-text' rx message acceptance		*/
+ X1( CFG_CNF_MCAST_RATE,			mcast_rate			 ) /*Transmit Data rate for Multicast frames				*/
+ X1( CFG_CNF_INTRA_BSS_RELAY,		intra_bss_relay		 ) /*[AP] Switch for IntraBBS relay							*/
+ X1( CFG_CNF_MICRO_WAVE,			micro_wave			 ) /*MicroWave (Robustness)									*/
+ X1( CFG_CNF_LOAD_BALANCING,		load_balancing		 ) /*Load Balancing	  (Boolean, 0=OFF, 1=ON, default=1)		*/
+ X1( CFG_CNF_MEDIUM_DISTRIBUTION,	medium_distribution	 ) /*Medium Distribution (Boolean, 0=OFF, 1=ON, default=1)	*/
+ X1( CFG_CNF_GROUP_ADDR_FILTER,		group_addr_filter	 ) /*Group Address Filter								   	*/
+ X1( CFG_CNF_TX_POW_LVL,			tx_pow_lvl			 ) /*Tx Power Level										   	*/
+XX4( CFG_CNF_COUNTRY_INFO,								 \
+		hcf_16, n_channel_sets, hcf_16, country_code[2], \
+		hcf_16, environment, CHANNEL_SET, channel_set[1] ) /*Current Country Info  									*/
+XX4( CFG_CNF_COUNTRY_INFO_MAX,							 \
+		hcf_16, n_channel_sets, hcf_16, country_code[2], \
+		hcf_16, environment, CHANNEL_SET, channel_set[14]) /*Current Country Info  									*/
+
+/*Dynamic Configurations */
+ X1( CFG_DESIRED_SSID,			ssid[17]					 )	/*[STA] Service Set identification for connection	*/
+#define GROUP_ADDR_SIZE			(32 * 6)						//32 6-byte MAC-addresses
+ X1( CFG_GROUP_ADDR,			mac_addr[GROUP_ADDR_SIZE/2]	 )	/*[STA] Multicast MAC Addresses for Rx-message		*/
+ X1( CFG_CREATE_IBSS,			create_ibss					 )	/*[STA] Switch for IBSS creation On/Off				*/
+ X1( CFG_RTS_THRH,				rts_thrh					 )	/*[STA] Frame length used for RTS/CTS handshake		*/
+ X1( CFG_TX_RATE_CNTL,			tx_rate_cntl				 )	/*[STA] Data rate control for message transmission	*/
+ X1( CFG_PROMISCUOUS_MODE,		promiscuous_mode			 )	/*[STA] Switch for Promiscuous mode reception On/Of	*/
+ X1( CFG_WOL,					wake_on_lan					 )	/*[STA] Switch for Wake-On-LAN mode					*/
+ X1( CFG_RTS_THRH0,				rts_thrh					 )	/*[AP] Port 0 frame length for RTS/CTS handshake	*/
+ X1( CFG_RTS_THRH1,				rts_thrh					 )	/*[AP] Port 1 frame length for RTS/CTS handshake	*/
+ X1( CFG_RTS_THRH2,				rts_thrh					 )	/*[AP] Port 2 frame length for RTS/CTS handshake	*/
+ X1( CFG_RTS_THRH3,				rts_thrh					 )	/*[AP] Port 3 frame length for RTS/CTS handshake	*/
+ X1( CFG_RTS_THRH4,				rts_thrh					 )	/*[AP] Port 4 frame length for RTS/CTS handshake	*/
+ X1( CFG_RTS_THRH5,				rts_thrh					 )	/*[AP] Port 5 frame length for RTS/CTS handshake	*/
+ X1( CFG_RTS_THRH6,				rts_thrh					 )	/*[AP] Port 6 frame length for RTS/CTS handshake	*/
+ X1( CFG_TX_RATE_CNTL0,			rate_cntl 					 )	/*[AP] Port 0 data rate control for transmission	*/
+ X1( CFG_TX_RATE_CNTL1,			rate_cntl					 )	/*[AP] Port 1 data rate control for transmission	*/
+ X1( CFG_TX_RATE_CNTL2,			rate_cntl					 )	/*[AP] Port 2 data rate control for transmission	*/
+ X1( CFG_TX_RATE_CNTL3,			rate_cntl					 )	/*[AP] Port 3 data rate control for transmission	*/
+ X1( CFG_TX_RATE_CNTL4,			rate_cntl					 )	/*[AP] Port 4 data rate control for transmission	*/
+ X1( CFG_TX_RATE_CNTL5,			rate_cntl					 )	/*[AP] Port 5 data rate control for transmission	*/
+ X1( CFG_TX_RATE_CNTL6,			rate_cntl					 )	/*[AP] Port 6 data rate control for transmission	*/
+XX1( CFG_DEFAULT_KEYS,			KEY_STRCT, key[4]			 )	/*defines set of encryption keys					*/
+ X1( CFG_TX_KEY_ID,				tx_key_id					 )	/*select key for encryption of Tx messages			*/
+ X1( CFG_SCAN_SSID,				ssid[17]					 )	/*identification for connection						*/
+ X5( CFG_ADD_TKIP_DEFAULT_KEY,								 \
+		 tkip_key_id_info, tkip_key_iv_info[4], tkip_key[8], \
+		 tx_mic_key[4], rx_mic_key[4] 						 )	/*										       		*/
+ X6( CFG_ADD_TKIP_MAPPED_KEY,	bssid[3], tkip_key[8], 		 \
+		 tsc[4], rsc[4], tx_mic_key[4], rx_mic_key[4] 		 )	/*										       		*/
+ X1( CFG_SET_SSN_AUTHENTICATION_SUITE, 						 \
+		 ssn_authentication_suite							 )	/*											   		*/
+ X1( CFG_REMOVE_TKIP_DEFAULT_KEY,tkip_key_id				 )	/*											   		*/
+ X1( CFG_TICK_TIME,				tick_time					 )	/*Auxiliary Timer tick interval						*/
+ X1( CFG_DDS_TICK_TIME,			tick_time					 )	/*Disconnected DeepSleep Timer tick interval		*/
+
+/**********************************************************************
+* Added for Pattern-matching WakeOnLan. (See firmware design note WMDN281C)
+**********************************************************************/
+#define WOL_PATTERNS				5		// maximum of 5 patterns in firmware
+#define WOL_PATTERN_LEN				124		// maximum 124 bytes pattern length per pattern in firmware
+#define WOL_MASK_LEN			 	30		// maximum 30 bytes mask length per pattern in firmware
+#define WOL_BUF_SIZE	(WOL_PATTERNS * (WOL_PATTERN_LEN + WOL_MASK_LEN + 6) / 2)
+X2( CFG_WOL_PATTERNS, nPatterns, buffer[WOL_BUF_SIZE]		 )  /*[STA] WakeOnLan pattern match, room for 5 patterns*/
+
+ X5( CFG_SUP_RANGE,		role, id, variant, bottom, top				   ) /*[PRI] Primary Supplier compatibility range		*/
+/* NIC Information */
+ X4( CFG_IDENTITY,			comp_id, variant, version_major, version_minor ) /*identification Prototype							*/
+#define CFG_DRV_IDENTITY_STRCT	CFG_IDENTITY_STRCT
+#define CFG_PRI_IDENTITY_STRCT	CFG_IDENTITY_STRCT
+#define CFG_NIC_IDENTITY_STRCT	CFG_IDENTITY_STRCT
+#define CFG_FW_IDENTITY_STRCT	CFG_IDENTITY_STRCT
+ X1( CFG_RID_INF_MIN,		y											   ) /*lowest value representing an Information RID		*/
+ X1( CFG_MAX_LOAD_TIME,		max_load_time								   ) /*[PRI] Max response time of the Download command	*/
+ X3( CFG_DL_BUF,			buf_page, buf_offset, buf_len				   ) /*[PRI] Download buffer location and size			*/
+// X5( CFG_PRI_SUP_RANGE,		role, id, variant, bottom, top				   ) /*[PRI] Primary Supplier compatibility range		*/
+ X5( CFG_CFI_ACT_RANGES_PRI,role, id, variant, bottom, top				   ) /*[PRI] Controller Actor compatibility ranges		*/
+// X5( CFG_NIC_HSI_SUP_RANGE,	role, id, variant, bottom, top				   ) /*H/W - S/W I/F supplier range						*/
+ X1( CFG_NIC_SERIAL_NUMBER,	serial_number[17]							   ) /*[PRI] Network I/F Card serial number				*/
+ X5( CFG_NIC_MFI_SUP_RANGE,	role, id, variant, bottom, top				   ) /*[PRI] Modem I/F Supplier compatibility range		*/
+ X5( CFG_NIC_CFI_SUP_RANGE,	role, id, variant, bottom, top				   ) /*[PRI] Controller I/F Supplier compatibility range*/
+//H-I X1( CFG_CHANNEL_LIST,		channel_list								   ) /*Allowed communication channels					*/
+//H-I XX2( CFG_REG_DOMAINS,		hcf_16, num_domain, hcf_8, reg_domains[10]	   ) /*List of intended regulatory domains				*/
+ X1( CFG_NIC_TEMP_TYPE,		temp_type									   ) /*Hardware temperature range code					*/
+//H-I X1( CFG_CIS,				cis[240]									   ) /*PC Card Standard Card Information Structure		*/
+ X5( CFG_NIC_PROFILE,													   \
+		 profile_code, capability_options, allowed_data_rates, val4, val5  ) /*Card Profile										*/
+// X5( CFG_FW_SUP_RANGE,		role, id, variant, bottom, top				   ) /*[STA] Station I/F Supplier compatibility range	*/
+ X5( CFG_MFI_ACT_RANGES,	role, id, variant, bottom, top				   ) /*[STA] Modem I/F Actor compatibility ranges		*/
+ X5( CFG_CFI_ACT_RANGES_STA,role, id, variant, bottom, top				   ) /*[STA] Controller I/F Actor compatibility ranges	*/
+ X5( CFG_MFI_ACT_RANGES_STA,role, id, variant, bottom, top				   ) /*[STA] Controller I/F Actor compatibility ranges	*/
+ X1( CFG_NIC_BUS_TYPE,		nic_bus_type								   ) /*NIC bustype derived from BUSSEL host I/F signals */
+
+/*	MAC INFORMATION	*/
+ X1( CFG_PORT_STAT,				port_stat							 ) /*[STA] Actual MAC Port connection control status		*/
+ X1( CFG_CUR_SSID,				ssid[17]							 ) /*[STA] Identification of the actually connected SS		*/
+ X1( CFG_CUR_BSSID,				mac_addr[3]							 ) /*[STA] Identification of the actually connected BSS		*/
+ X3( CFG_COMMS_QUALITY,			coms_qual, signal_lvl, noise_lvl	 ) /*[STA] Quality of the Basic Service Set connection		*/
+ X1( CFG_CUR_TX_RATE,			rate								 ) /*[STA] Actual transmit data rate						*/
+ X1( CFG_CUR_BEACON_INTERVAL,	interval							 ) /*Beacon transmit interval time for BSS creation			*/
+#if (HCF_TYPE) & HCF_TYPE_WARP
+ X11( CFG_CUR_SCALE_THRH,											 \
+	 carrier_detect_thrh_cck, carrier_detect_thrh_ofdm, defer_thrh,	 \
+	 energy_detect_thrh, rssi_on_thrh_deviation, 					 \
+	 rssi_off_thrh_deviation, cck_drop_thrh, ofdm_drop_thrh, 		 \
+	 cell_search_thrh, out_of_range_thrh, delta_snr				 )
+#else
+ X6( CFG_CUR_SCALE_THRH,											 \
+	 energy_detect_thrh, carrier_detect_thrh, defer_thrh, 			 \
+	 cell_search_thrh, out_of_range_thrh, delta_snr					 ) /*Actual System Scale thresholds settings				*/
+#endif // HCF_TYPE_WARP
+ X1( CFG_PROTOCOL_RSP_TIME,		time								 ) /*Max time to await a response to a request message		*/
+ X1( CFG_CUR_SHORT_RETRY_LIMIT,	limit								 ) /*Max number of transmit attempts for short frames		*/
+ X1( CFG_CUR_LONG_RETRY_LIMIT,	limit								 ) /*Max number of transmit attempts for long frames		*/
+ X1( CFG_MAX_TX_LIFETIME,		time								 ) /*Max transmit frame handling duration					*/
+ X1( CFG_MAX_RX_LIFETIME,		time								 ) /*Max received frame handling duration					*/
+ X1( CFG_CF_POLLABLE,			cf_pollable							 ) /*[STA] Contention Free pollable capability indication	*/
+ X2( CFG_AUTHENTICATION_ALGORITHMS,authentication_type, type_enabled ) /*Authentication Algorithm								*/
+ X1( CFG_PRIVACY_OPT_IMPLEMENTED,privacy_opt_implemented			 ) /*WEP Option availability indication						*/
+ X1( CFG_CUR_REMOTE_RATES,		rates								 ) /*CurrentRemoteRates										*/
+ X1( CFG_CUR_USED_RATES,		rates								 ) /*CurrentUsedRates										*/
+ X1( CFG_CUR_SYSTEM_SCALE,		current_system_scale				 ) /*CurrentUsedRates										*/
+ X1( CFG_CUR_TX_RATE1,			rate 								 ) /*[AP] Actual Port 1 transmit data rate					*/
+ X1( CFG_CUR_TX_RATE2,			rate								 ) /*[AP] Actual Port 2 transmit data rate					*/
+ X1( CFG_CUR_TX_RATE3,			rate								 ) /*[AP] Actual Port 3 transmit data rate					*/
+ X1( CFG_CUR_TX_RATE4,			rate								 ) /*[AP] Actual Port 4 transmit data rate					*/
+ X1( CFG_CUR_TX_RATE5,			rate								 ) /*[AP] Actual Port 5 transmit data rate					*/
+ X1( CFG_CUR_TX_RATE6,			rate								 ) /*[AP] Actual Port 6 transmit data rate					*/
+ X1( CFG_OWN_MAC_ADDR,			mac_addr[3]							 ) /*[AP] Unique local node MAC Address						*/
+ X3( CFG_PCF_INFO,				medium_occupancy_limit, 			 \
+		 						cfp_period, cfp_max_duration 		 ) /*[AP] Point Coordination Function capability info		*/
+ X1( CFG_CUR_SSN_INFO_ELEMENT, ssn_info_element[1]				 	 ) /*    													*/
+ X4( CFG_CUR_TKIP_IV_INFO, 											 \
+		 tkip_seq_cnt0[4], tkip_seq_cnt1[4], 						 \
+		 tkip_seq_cnt2[4], tkip_seq_cnt3[4]  						 ) /*    													*/
+ X2( CFG_CUR_ASSOC_REQ_INFO,	frame_type, frame_body[1]			 ) /*	0xFD8C												*/
+ X2( CFG_CUR_ASSOC_RESP_INFO,	frame_type, frame_body[1]			 ) /*	0xFD8D												*/
+
+
+/*	Modem INFORMATION */
+ X1( CFG_PHY_TYPE,				phy_type 							 ) /*Physical layer type indication							*/
+ X1( CFG_CUR_CHANNEL,			current_channel						 ) /*Actual frequency channel used for transmission			*/
+ X1( CFG_CUR_POWER_STATE,		current_power_state					 ) /*Actual power consumption status						*/
+ X1( CFG_CCAMODE,				cca_mode							 ) /*Clear channel assessment mode indication				*/
+ X1( CFG_SUPPORTED_DATA_RATES,	rates[5]							 ) /*Data rates capability information						*/
+
+
+/* FRAMES */
+XX1( CFG_SCAN,					SCAN_RS_STRCT, scan_result[32]		 ) /*Scan results											*/
+
+
+
+//--------------------------------------------------------------------------------------
+// UIL management function to be passed to WaveLAN/IEEE Drivers in DUI_STRCT field fun
+//--------------------------------------------------------------------------------------
+
+// HCF and UIL Common
+#define MDD_ACT_SCAN			0x06					// Hermes Inquire Scan (F101) command
+#define MDD_ACT_PRS_SCAN 		0x07					// Hermes Probe Response Scan (F102) command
+
+// UIL Specific
+#define UIL_FUN_CONNECT			0x00					// Perform connect command
+#define UIL_FUN_DISCONNECT		0x01					// Perform disconnect command
+#define UIL_FUN_ACTION			0x02					// Perform UIL Action command.
+#define UIL_FUN_SEND_DIAG_MSG	0x03					// Send a diagnostic message.
+#define UIL_FUN_GET_INFO		0x04					// Retrieve information from NIC.
+#define UIL_FUN_PUT_INFO		0x05					// Put information on NIC.
+
+/*	UIL_ACT_TALLIES				0x05		 			* this should not be exported to the USF
+											 			* it is solely intended as a strategic choice for the MSF to either
+											 			* - use HCF_ACT_TALLIES and direct IFB access
+														* - use CFG_TALLIES
+														*/
+#define UIL_ACT_SCAN			MDD_ACT_SCAN
+#define UIL_ACT_PRS_SCAN 		MDD_ACT_PRS_SCAN
+#define UIL_ACT_BLOCK	 		0x0B
+#define UIL_ACT_UNBLOCK	 		0x0C
+#define UIL_ACT_RESET	 		0x80
+#define UIL_ACT_REBIND	 		0x81
+#define UIL_ACT_APPLY	 		0x82
+#define UIL_ACT_DISCONNECT		0x83	//;?040108 possibly obsolete	//Special for WINCE
+
+// HCF Specific
+/* Note that UIL_ACT-codes must match HCF_ACT-codes across a run-time bound I/F
+ * The initial matching is achieved by "#define HCF_ACT_xxx HCF_UIL_ACT_xxx" where appropriate
+ * In other words, these codes should never, ever change to minimize migration problems between
+ * combinations of old drivers and new utilities and vice versa
+ */
+#define HCF_DISCONNECT			0x01					//disconnect request for hcf_connect (invalid as IO Address)
+#define HCF_ACT_TALLIES 		0x05					// ! UIL_ACT_TALLIES does not exist ! Hermes Inquire Tallies (F100) cmd
+#if ( (HCF_TYPE) & HCF_TYPE_WARP ) == 0
+#define HCF_ACT_SCAN			MDD_ACT_SCAN
+#endif // HCF_TYPE_WARP
+#define HCF_ACT_PRS_SCAN		MDD_ACT_PRS_SCAN
+#if HCF_INT_ON
+#define HCF_ACT_INT_OFF 		0x0D					// Disable Interrupt generation
+#define HCF_ACT_INT_ON			0x0E					// Enable Interrupt generation
+#define HCF_ACT_INT_FORCE_ON	0x0F					// Enforce Enable Interrupt generation
+#endif // HCF_INT_ON
+#define HCF_ACT_RX_ACK			0x15					// Receiever ACK (optimization)
+#if (HCF_TYPE) & HCF_TYPE_CCX
+#define HCF_ACT_CCX_ON			0x1A					// enable CKIP
+#define HCF_ACT_CCX_OFF			0x1B					// disable CKIP
+#endif // HCF_TYPE_CCX
+#if (HCF_SLEEP) & HCF_DDS
+#define HCF_ACT_SLEEP			0x1C					// DDS Sleep request
+//#define HCF_ACT_WAKEUP		0x1D					// DDS Wakeup request
+#endif // HCF_DDS
+
+/*	HCF_ACT_MAX							// xxxx: start value for UIL-range, NOT to be passed to HCF
+ *										Too bad, there was originally no spare room created to use
+ *										HCF_ACT_MAX as an equivalent of HCF_ERR_MAX. Since creating
+ *										this room in retrospect would create a backward incompatibility
+ *										we will just have to live with the haphazard sequence of
+ *										UIL- and HCF specific codes. Theoretically this could be
+ *										corrected when and if there will ever be an overall
+ *										incompatibility introduced for another reason
+ */
+
+/*============================================================= HERMES RECORDS	============================*/
+#define CFG_RID_FW_MIN							0xFA00	//lowest value representing a Hermes-II based RID
+// #define CFG_PDA_BEGIN						0xFA	//
+// #define CFG_PDA_END							0xFA	//
+// #define CFG_PDA_NIC_TOP_LVL_ASSEMBLY_NUMBER	0xFA	//
+// #define CFG_PDA_PCB_TRACER_NUMBER			0xFA	//
+// #define CFG_PDA_RMM_TRACER_NUMBER			0xFA	//
+// #define CFG_PDA_RMM_COMP_ID					0xFA	//
+// #define CFG_PDA_								0xFA	//
+
+/*============================================================= CONFIGURATION RECORDS	=====================*/
+/*============================================================= mask 0xFCxx				=====================*/
+#define CFG_RID_CFG_MIN					0xFC00		//lowest value representing a Hermes configuration  RID
+
+//	NETWORK PARAMETERS, STATIC CONFIGURATION ENTITIES
+//FC05, FC0B, FC0C, FC0D: SEE W2DN149
+
+#define CFG_CNF_PORT_TYPE				0xFC00		//[STA] Connection control characteristics
+#define CFG_CNF_OWN_MAC_ADDR			0xFC01		//[STA] MAC Address of this node
+//										0xFC02		see DYNAMIC CONFIGURATION ENTITIES
+#define CFG_CNF_OWN_CHANNEL				0xFC03		//Communication channel for BSS creation
+#define CFG_CNF_OWN_SSID				0xFC04		//IBSS creation (STA) or ESS (AP) Service Set Ident
+#define CFG_CNF_OWN_ATIM_WINDOW			0xFC05		//[STA] ATIM Window time for IBSS creation
+#define CFG_CNF_SYSTEM_SCALE			0xFC06		//System Scale that specifies the AP density
+#define CFG_CNF_MAX_DATA_LEN			0xFC07		//Maximum length of MAC Frame Body data
+#define CFG_CNF_PM_ENABLED				0xFC09		//[STA] Switch for ESS Power Management (PM)
+#define CFG_CNF_MCAST_RX				0xFC0B		//[STA] Switch for ESS PM Multicast reception On/Off
+#define CFG_CNF_MAX_SLEEP_DURATION		0xFC0C		//[STA] Maximum sleep time for ESS PM
+#define CFG_CNF_HOLDOVER_DURATION		0xFC0D		//[STA] Holdover time for ESS PM
+#define CFG_CNF_OWN_NAME				0xFC0E		//Identification text for diagnostic purposes
+
+#define CFG_CNF_OWN_DTIM_PERIOD			0xFC10		//[AP] Beacon intervals between successive DTIMs
+#define CFG_CNF_WDS_ADDR1				0xFC11		//[AP] Port 1 MAC Adrs of corresponding WDS Link node
+#define CFG_CNF_WDS_ADDR2				0xFC12		//[AP] Port 2 MAC Adrs of corresponding WDS Link node
+#define CFG_CNF_WDS_ADDR3				0xFC13		//[AP] Port 3 MAC Adrs of corresponding WDS Link node
+#define CFG_CNF_WDS_ADDR4				0xFC14		//[AP] Port 4 MAC Adrs of corresponding WDS Link node
+#define CFG_CNF_WDS_ADDR5				0xFC15		//[AP] Port 5 MAC Adrs of corresponding WDS Link node
+#define CFG_CNF_WDS_ADDR6				0xFC16		//[AP] Port 6 MAC Adrs of corresponding WDS Link node
+#define CFG_CNF_PM_MCAST_BUF			0xFC17		//[AP] Switch for PM buffereing of Multicast Messages
+#define CFG_CNF_MCAST_PM_BUF			CFG_CNF_PM_MCAST_BUF	//name does not match H-II spec
+#define CFG_CNF_REJECT_ANY				0xFC18		//[AP] Switch for PM buffereing of Multicast Messages
+
+#define CFG_CNF_ENCRYPTION				0xFC20		//select en/de-cryption of Tx/Rx messages
+#define CFG_CNF_AUTHENTICATION			0xFC21		//[STA] selects Authentication algorithm
+#define CFG_CNF_EXCL_UNENCRYPTED		0xFC22		//[AP] Switch for 'clear-text' rx message acceptance
+#define CFG_CNF_MCAST_RATE				0xFC23		//Transmit Data rate for Multicast frames
+#define CFG_CNF_INTRA_BSS_RELAY			0xFC24		//[AP] Switch for IntraBBS relay
+#define CFG_CNF_MICRO_WAVE				0xFC25		//MicroWave (Robustness)
+#define CFG_CNF_LOAD_BALANCING		 	0xFC26		//Load Balancing		 (Boolean, 0=OFF, 1=ON, default=1)
+#define CFG_CNF_MEDIUM_DISTRIBUTION	 	0xFC27		//Medium Distribution	 (Boolean, 0=OFF, 1=ON, default=1)
+#define CFG_CNF_RX_ALL_GROUP_ADDR		0xFC28		//[STA] Group Address Filter
+#define CFG_CNF_COUNTRY_INFO			0xFC29		//Country Info
+#if (HCF_TYPE) & HCF_TYPE_WARP
+#define CFG_CNF_TX_POW_LVL				0xFC2A		//TxPower Level
+#define CFG_CNF_CONNECTION_CNTL			0xFC30		//[STA] Connection Control
+#define CFG_CNF_OWN_BEACON_INTERVAL		0xFC31		//[AP]
+#define CFG_CNF_SHORT_RETRY_LIMIT		0xFC32		//
+#define CFG_CNF_LONG_RETRY_LIMIT		0xFC33		//
+#define CFG_CNF_TX_EVENT_MODE			0xFC34		//
+#define CFG_CNF_WIFI_COMPATIBLE			0xFC35		//[STA] Wifi compatible
+#endif // HCF_TYPE_WARP
+#if (HCF_TYPE) & HCF_TYPE_BEAGLE_HII5
+#define CFG_VOICE_RETRY_LIMIT			0xFC36		/* Voice frame retry limit. Range: 1-15, default: 4 */
+#define CFG_VOICE_CONTENTION_WINDOW		0xFC37		/* Contention window for voice frames. */
+#endif	// BEAGLE_HII5
+
+//	NETWORK PARAMETERS, DYNAMIC CONFIGURATION ENTITIES
+#define CFG_DESIRED_SSID				0xFC02		//[STA] Service Set identification for connection and scan
+
+#define CFG_GROUP_ADDR					0xFC80		//[STA] Multicast MAC Addresses for Rx-message
+#define CFG_CREATE_IBSS					0xFC81		//[STA] Switch for IBSS creation On/Off
+#define CFG_RTS_THRH					0xFC83		//Frame length used for RTS/CTS handshake
+#define CFG_TX_RATE_CNTL				0xFC84		//[STA] Data rate control for message transmission
+#define CFG_PROMISCUOUS_MODE			0xFC85		//[STA] Switch for Promiscuous mode reception On/Off
+#define CFG_WOL							0xFC86		//[STA] Switch for Wake-On-LAN mode
+#define CFG_WOL_PATTERNS				0xFC87		//[STA] Patterns for Wake-On-LAN
+#define CFG_SUPPORTED_RATE_SET_CNTL		0xFC88		//
+#define CFG_BASIC_RATE_SET_CNTL			0xFC89		//
+
+#define CFG_SOFTWARE_ACK_MODE			0xFC90		//
+#define CFG_RTS_THRH0					0xFC97		//[AP] Port 0 frame length for RTS/CTS handshake
+#define CFG_RTS_THRH1					0xFC98		//[AP] Port 1 frame length for RTS/CTS handshake
+#define CFG_RTS_THRH2					0xFC99		//[AP] Port 2 frame length for RTS/CTS handshake
+#define CFG_RTS_THRH3					0xFC9A		//[AP] Port 3 frame length for RTS/CTS handshake
+#define CFG_RTS_THRH4					0xFC9B		//[AP] Port 4 frame length for RTS/CTS handshake
+#define CFG_RTS_THRH5					0xFC9C		//[AP] Port 5 frame length for RTS/CTS handshake
+#define CFG_RTS_THRH6					0xFC9D		//[AP] Port 6 frame length for RTS/CTS handshake
+
+#define CFG_TX_RATE_CNTL0				0xFC9E		//[AP] Port 0 data rate control for transmission
+#define CFG_TX_RATE_CNTL1				0xFC9F		//[AP] Port 1 data rate control for transmission
+#define CFG_TX_RATE_CNTL2				0xFCA0		//[AP] Port 2 data rate control for transmission
+#define CFG_TX_RATE_CNTL3				0xFCA1		//[AP] Port 3 data rate control for transmission
+#define CFG_TX_RATE_CNTL4				0xFCA2		//[AP] Port 4 data rate control for transmission
+#define CFG_TX_RATE_CNTL5				0xFCA3		//[AP] Port 5 data rate control for transmission
+#define CFG_TX_RATE_CNTL6				0xFCA4		//[AP] Port 6 data rate control for transmission
+
+#define CFG_DEFAULT_KEYS				0xFCB0		//defines set of encryption keys
+#define CFG_TX_KEY_ID					0xFCB1		//select key for encryption of Tx messages
+#define CFG_SCAN_SSID					0xFCB2		//Scan SSID
+#define CFG_ADD_TKIP_DEFAULT_KEY		0xFCB4		//set KeyID and TxKey indication
+#define 	KEY_ID							0x0003		//KeyID mask for tkip_key_id_info field
+#define 	TX_KEY							0x8000		//Default Tx Key flag of tkip_key_id_info field
+#define CFG_SET_WPA_AUTH_KEY_MGMT_SUITE	0xFCB5		//Authenticated Key Management Suite
+#define CFG_REMOVE_TKIP_DEFAULT_KEY		0xFCB6		//invalidate KeyID and TxKey indication
+#define CFG_ADD_TKIP_MAPPED_KEY			0xFCB7		//set MAC address pairwise station
+#define CFG_REMOVE_TKIP_MAPPED_KEY		0xFCB8		//invalidate MAC address pairwise station
+#define CFG_SET_WPA_CAPABILITIES_INFO	0xFCB9		//WPA Capabilities
+#define CFG_CACHED_PMK_ADDR				0xFCBA		//set MAC address of pre-authenticated AP
+#define CFG_REMOVE_CACHED_PMK_ADDR		0xFCBB		//invalidate MAC address of pre-authenticated AP
+#define CFG_FCBC	0xFCBC	//FW codes ahead of available documentation, so ???????
+#define CFG_FCBD	0xFCBD	//FW codes ahead of available documentation, so ???????
+#define CFG_FCBE	0xFCBE	//FW codes ahead of available documentation, so ???????
+#define CFG_FCBF	0xFCBF	//FW codes ahead of available documentation, so ???????
+
+#define CFG_HANDOVER_ADDR				0xFCC0		//[AP] Station MAC Adrress re-associated with other AP
+#define CFG_SCAN_CHANNEL				0xFCC2		//Channel set for host requested scan
+//;?#define CFG_SCAN_CHANNEL_MASK			0xFCC2		// contains
+#define CFG_DISASSOCIATE_ADDR			0xFCC4		//[AP] Station MAC Adrress to be disassociated
+#define CFG_PROBE_DATA_RATE				0xFCC5		//WARP connection control
+#define CFG_FRAME_BURST_LIMIT			0xFCC6		//
+#define CFG_COEXISTENSE_BEHAVIOUR		0xFCC7		//[AP]
+#define CFG_DEAUTHENTICATE_ADDR			0xFCC8		//MAC address of Station to be deauthenticated
+
+//	BEHAVIOR PARAMETERS
+#define CFG_TICK_TIME					0xFCE0		//Auxiliary Timer tick interval
+#define CFG_DDS_TICK_TIME				0xFCE1		//Disconnected DeepSleep Timer tick interval
+//#define CFG_CNF_COUNTRY					0xFCFE	apparently not needed ;?
+#define CFG_RID_CFG_MAX					0xFCFF		//highest value representing an Configuration RID
+
+
+/*============================================================= INFORMATION RECORDS 	=====================*/
+/*============================================================= mask 0xFDxx				=====================*/
+//	NIC INFORMATION
+#define CFG_RID_INF_MIN					0xFD00	//lowest value representing an Information RID
+#define CFG_MAX_LOAD_TIME				0xFD00	//[INT] Maximum response time of the Download command.
+#define CFG_DL_BUF						0xFD01	//[INT] Download buffer location and size.
+#define CFG_PRI_IDENTITY				0xFD02	//[PRI] Primary Functions firmware identification.
+#define CFG_PRI_SUP_RANGE				0xFD03	//[PRI] Primary Functions I/F Supplier compatibility range.
+#define CFG_NIC_HSI_SUP_RANGE			0xFD09	//H/W - S/W I/F supplier range
+#define CFG_NIC_SERIAL_NUMBER			0xFD0A	//[PRI] Network Interface Card serial number.
+#define CFG_NIC_IDENTITY				0xFD0B	//[PRI] Network Interface Card identification.
+#define CFG_NIC_MFI_SUP_RANGE			0xFD0C	//[PRI] Modem I/F Supplier compatibility range.
+#define CFG_NIC_CFI_SUP_RANGE			0xFD0D	//[PRI] Controller I/F Supplier compatibility range.
+#define CFG_CHANNEL_LIST				0xFD10	//Allowed communication channels.
+#define CFG_NIC_TEMP_TYPE  				0xFD12	//Hardware temperature range code.
+#define CFG_CIS							0xFD13	//PC Card Standard Card Information Structure
+#define CFG_NIC_PROFILE					0xFD14	//Card Profile
+#define CFG_FW_IDENTITY					0xFD20	//firmware identification.
+#define CFG_FW_SUP_RANGE				0xFD21	//firmware Supplier compatibility range.
+#define CFG_MFI_ACT_RANGES_STA			0xFD22	//[STA] Modem I/F Actor compatibility ranges.
+#define CFG_CFI_ACT_RANGES_STA			0xFD23	//[STA] Controller I/F Actor compatibility ranges.
+#define CFG_NIC_BUS_TYPE				0xFD24	//Card Bustype
+#define 	CFG_NIC_BUS_TYPE_PCCARD_CF		0x0000	//16 bit PC Card or Compact Flash
+#define 	CFG_NIC_BUS_TYPE_USB			0x0001	//USB
+#define 	CFG_NIC_BUS_TYPE_CARDBUS		0x0002	//CardBus
+#define 	CFG_NIC_BUS_TYPE_PCI			0x0003	//(mini)PCI
+#define CFG_DOMAIN_CODE						0xFD25
+
+//	MAC INFORMATION
+#define CFG_PORT_STAT					0xFD40	//Actual MAC Port connection control status
+#define CFG_CUR_SSID					0xFD41	//[STA] Identification of the actually connected SS
+#define CFG_CUR_BSSID					0xFD42	//[STA] Identification of the actually connected BSS
+#define CFG_COMMS_QUALITY				0xFD43	//[STA] Quality of the Basic Service Set connection
+#define CFG_CUR_TX_RATE					0xFD44	//[STA] Actual transmit data rate
+#define CFG_CUR_BEACON_INTERVAL			0xFD45	//Beacon transmit interval time for BSS creation
+#define CFG_CUR_SCALE_THRH				0xFD46	//Actual System Scale thresholds settings
+#define CFG_PROTOCOL_RSP_TIME			0xFD47	//Max time to await a response to a request message
+#define CFG_CUR_SHORT_RETRY_LIMIT		0xFD48	//Max number of transmit attempts for short frames
+#define CFG_CUR_LONG_RETRY_LIMIT		0xFD49	//Max number of transmit attempts for long frames
+#define CFG_MAX_TX_LIFETIME				0xFD4A	//Max transmit frame handling duration
+#define CFG_MAX_RX_LIFETIME				0xFD4B	//Max received frame handling duration
+#define CFG_CF_POLLABLE					0xFD4C	//[STA] Contention Free pollable capability indication
+#define CFG_AUTHENTICATION_ALGORITHMS	0xFD4D	//Available Authentication Algorithms indication
+#define CFG_PRIVACY_OPT_IMPLEMENTED		0xFD4F	//WEP Option availability indication
+
+#define CFG_CUR_REMOTE_RATES			0xFD50	//[STA] CurrentRemoteRates
+#define CFG_CUR_USED_RATES				0xFD51	//[STA] CurrentUsedRates
+#define CFG_CUR_SYSTEM_SCALE			0xFD52	//[STA] CurrentSystemScale
+
+#define CFG_CUR_TX_RATE1				0xFD80	//[AP] Actual Port 1 transmit data rate
+#define CFG_CUR_TX_RATE2				0xFD81	//[AP] Actual Port 2 transmit data rate
+#define CFG_CUR_TX_RATE3				0xFD82	//[AP] Actual Port 3 transmit data rate
+#define CFG_CUR_TX_RATE4				0xFD83	//[AP] Actual Port 4 transmit data rate
+#define CFG_CUR_TX_RATE5				0xFD84	//[AP] Actual Port 5 transmit data rate
+#define CFG_CUR_TX_RATE6				0xFD85	//[AP] Actual Port 6 transmit data rate
+#define CFG_NIC_MAC_ADDR				0xFD86	//Unique local node MAC Address
+#define CFG_PCF_INFO					0xFD87	//[AP] Point Coordination Function capability info
+//*RESERVED* #define CFG_HIGHEST_BASIC_RATE			0xFD88	//
+#define CFG_CUR_COUNTRY_INFO			0xFD89	//
+#define CFG_CUR_SSN_INFO_ELEMENT		0xFD8A	//
+#define CFG_CUR_TKIP_IV_INFO			0xFD8B	//
+#define CFG_CUR_ASSOC_REQ_INFO			0xFD8C	//
+#define CFG_CUR_ASSOC_RESP_INFO			0xFD8D	//
+#define CFG_CUR_LOAD					0xFD8E	//[AP] current load on AP's channel
+
+#define CFG_SECURITY_CAPABILITIES		0xFD90	//Combined capabilities information
+
+//	MODEM INFORMATION
+#define CFG_PHY_TYPE					0xFDC0	//Physical layer type indication
+#define CFG_CUR_CHANNEL					0xFDC1	//Actual frequency channel used for transmission
+#define CFG_CUR_POWER_STATE				0xFDC2	//Actual power consumption status
+#define CFG_CCA_MODE					0xFDC3	//Clear channel assessment mode indication
+#define CFG_SUPPORTED_DATA_RATES		0xFDC6	//Data rates capability information
+
+#define CFG_RID_INF_MAX					0xFDFF	//highest value representing an Information RID
+
+//	ENGINEERING INFORMATION
+#define CFG_RID_ENG_MIN					0xFFE0	//lowest value representing a Hermes engineering RID
+
+
+/****************************** General define *************************************************************/
+
+
+//IFB field related
+//		IFB_CardStat
+#define CARD_STAT_INCOMP_PRI			0x2000U	// no compatible HSI / primary F/W
+#define CARD_STAT_INCOMP_FW				0x1000U	// no compatible station / tertiary F/W
+#define CARD_STAT_DEFUNCT				0x0100U	// HCF is in Defunct mode
+//		IFB_RxStat
+#define RX_STAT_PRIO					0x00E0U	//Priority subfield
+#define RX_STAT_ERR						0x000FU	//Error mask
+#define 	RX_STAT_UNDECR				0x0002U	//Non-decryptable encrypted message
+#define 	RX_STAT_FCS_ERR				0x0001U	//FCS error
+
+// SNAP header for E-II Encapsulation
+#define ENC_NONE			            0xFF
+#define ENC_1042    			        0x00
+#define ENC_TUNNEL      	    		0xF8
+/****************************** Xxxxxxxx *******************************************************************/
+
+
+#define HCF_SUCCESS					0x00	// OK
+#define HCF_ERR_TIME_OUT			0x04	// Expected Hermes event did not occure in expected time
+#define HCF_ERR_NO_NIC				0x05	/* card not found (usually yanked away during hcfio_in_string
+										  	 * Also: card is either absent or disabled while it should be neither */
+#define HCF_ERR_LEN					0x08	/* buffer size insufficient
+		 								  	 *		  -	IFB_ConfigTable too small
+		 								  	 *		  -	hcf_get_info buffer has a size of 0 or 1 or less than needed
+		 							  		 *			to accomodate all data
+		 							  		 *		  -	hcf_put_info: CFG_DLNV_DATA exceeds intermediate
+											 *		  buffer size */
+#define HCF_ERR_INCOMP_PRI			0x09	// primary functions are not compatible
+#define HCF_ERR_INCOMP_FW			0x0A	// station functions are compatible
+#define HCF_ERR_MIC					0x0D	// MIC check fails
+#define HCF_ERR_SLEEP				0x0E	// NIC in sleep mode
+#define HCF_ERR_MAX					0x3F	/* end of HCF range
+											   *** ** *** ****** *** *************** */
+#define HCF_ERR_DEFUNCT				0x80	// BIT, reflecting that the HCF is in defunct mode (bits 0x7F reflect cause)
+#define HCF_ERR_DEFUNCT_AUX			0x82	// Timeout on acknowledgement on en/disabling AUX registers
+#define HCF_ERR_DEFUNCT_TIMER		0x83	// Timeout on timer calibration during initialization process
+#define HCF_ERR_DEFUNCT_TIME_OUT	0x84	// Timeout on Busy bit drop during BAP setup
+#define HCF_ERR_DEFUNCT_CMD_SEQ		0x86	// Hermes and HCF are out of sync in issuing/processing commands
+
+#define HCF_INT_PENDING				0x01	// return status of hcf_act( HCF_ACT_INT_OFF )
+
+#define HCF_PORT_0 					0x0000	// Station supports only single MAC Port
+#define HCF_PORT_1 					0x0100	// HCF_PORT_1 through HCF_PORT_6 are only supported by AP F/W
+#define HCF_PORT_2 					0x0200
+#define HCF_PORT_3 					0x0300
+#define HCF_PORT_4 					0x0400
+#define HCF_PORT_5 					0x0500
+#define HCF_PORT_6 					0x0600
+
+#define HCF_CNTL_ENABLE				0x01
+#define HCF_CNTL_DISABLE			0x02
+#define HCF_CNTL_CONNECT			0x03
+#define HCF_CNTL_DISCONNECT			0x05
+#define HCF_CNTL_CONTINUE			0x07
+
+#define USE_DMA 					0x0001
+#define USE_16BIT 					0x0002
+#define DMA_ENABLED					0x8000	//weak name, it really means: F/W enabled and DMA selected
+
+//#define HCF_DMA_FD_CNT	 		(2*29) 						//size in bytes of one Tx/RxFS minus DA/SA
+//;?the MSF ( H2PCI.C uses the next 2 mnemonics )
+#define HCF_DMA_RX_BUF1_SIZE		(HFS_ADDR_DEST + 8)			//extra bytes for LEN/SNAP if decapsulation
+#define HCF_DMA_TX_BUF1_SIZE		(HFS_ADDR_DEST + 2*6 + 8)	//extra bytes for DA/SA/LEN/SNAP if encapsulation
+
+//HFS_TX_CNTL
+/* Note that the HCF_.... System Constants influence the HFS_.... values below
+ * 								H-I		H-I	 |	H-II	H-II	H-II.5
+ *										WPA	 |			WPA
+ * HFS_TX_CNTL_TX_OK			0002	0002 |	0002	0002	 N/A	<<<<<<<<deprecated
+ * HFS_TX_CNTL_TX_EX			0004	0004 |	0004	0004	 N/A
+ * HFS_TX_CNTL_MIC				 N/A	0010 |	 N/A	0010	 N/A
+ * HFS_TX_CNTL_TID				 N/A	 N/A |	 N/A	 N/A	000F
+ * HFS_TX_CNTL_SERVICE_CLASS	 N/A	 N/A |	 N/A	 N/A	00C0
+ * HFS_TX_CNTL_PORT				0700	0700 |	0700	0700	0700
+ * HFS_TX_CNTL_MIC_KEY_ID		1800	1800 |	0000	1800	 N/A
+ * HFS_TX_CNTL_CKIP				0000	0000 |	0000	2000	2000
+ * HFS_TX_CNTL_TX_DELAY			4000	4000 |	4000	4000	 N/A
+ * HFS_TX_CNTL_ACTION			 N/A	 N/A |	 N/A	 N/A	4000
+ * 								====	==== |	====	====	====
+ * 								5F06	5F16 |	4706	7F06	67CF
+ *
+ * HCF_TX_CNTL_MASK specifies the bits allowed on the Host I/F
+ * note: bit 0x4000 has different meaning for H-II and H-II.5
+ * note: [] indicate bits which are possibly added by the HCF to TxControl at the Host I/F
+ * note: () indicate bits which are supposedly never ever used in a WCI environment
+ * note: ? denote bits which seem not to be documented in the documents I have available
+ */
+//H-I:     HCF_TX_CNTL_MASK	0x47FE	//TX_DELAY, MACPort, Priority, (StrucType), TxEx, TxOK
+//H-I WPA: HCF_TX_CNTL_MASK	0x5FE6	//TX_DELAY, MICKey, MACPort, Priority, (StrucType), TxEx, TxOK
+#if (HCF_TYPE) & HCF_TYPE_WARP
+#define  HCF_TX_CNTL_MASK	0x27E7	//no TX_DELAY?, CCX, MACPort, Priority, (StrucType), TxEx, TxOK, Spectralink
+//#elif (HCF_TYPE) & HCF_TYPE_WPA
+//#define  HCF_TX_CNTL_MASK	0x7F06	//TX_DELAY, CKIP?, MICKeyID, MACPort, [MIC],TxEx, TxOK (TAR419D7)
+#else
+#define  HCF_TX_CNTL_MASK	0x67E7	//TX_DELAY?, CCX, MACPort, Priority, (StrucType), TxEx, TxOK, Spectralink
+#endif // HCF_TYPE_WARP
+
+#define HFS_TX_CNTL_TX_EX			0x0004U
+
+#if (HCF_TYPE) & HCF_TYPE_WPA
+#define HFS_TX_CNTL_MIC				0x0010U	//802.3 format with TKIP		;?changes to 0x0008 for H-II
+#define HFS_TX_CNTL_MIC_KEY_ID		0x1800U	//MIC Key ID subfield
+#endif // HCF_TYPE_WPA
+
+#define HFS_TX_CNTL_PORT			0x0700U	//Port subfield of TxControl field of Transmit Frame Structure
+
+#if (HCF_TYPE) & HCF_TYPE_CCX
+#define HFS_TX_CNTL_CKIP			0x2000U	//CKIP encrypted flag
+#endif // HCF_TYPE_CCX
+
+#if (HCF_TYPE) & HCF_TYPE_TX_DELAY
+#define HFS_TX_CNTL_TX_DELAY		0x4000U	//decouple "put data" and send
+#endif // HCF_TYPE_TX_DELAY
+#define HFS_TX_CNTL_TX_CONT			0x4000u	//engineering: continuous transmit
+
+/*============================================================= HCF Defined RECORDS	=========================*/
+#define CFG_PROD_DATA					0x0800 		//Plug Data (Engineering Test purposes only)
+#define CFG_DL_EEPROM					0x0806		//Up/Download I2PROM for USB
+#define		CFG_PDA							0x0002		//Download PDA
+#define		CFG_MEM_I2PROM					0x0004		//Up/Download EEPROM
+
+#define		CFG_MEM_READ					0x0000
+#define		CFG_MEM_WRITE					0x0001
+
+#define CFG_NULL						0x0820		//Empty Mail Box Info Block
+#define CFG_MB_INFO						0x0820		//Mail Box Info Block
+#define CFG_WMP							0x0822		//WaveLAN Management Protocol
+
+#if defined MSF_COMPONENT_ID
+#define CFG_DRV_INFO					0x0825		//Driver Information structure (see CFG_DRV_INFO_STRCT for details)
+#define CFG_DRV_IDENTITY				0x0826		//driver identity (see CFG_DRV_IDENTITY_STRCT for details)
+#define CFG_DRV_SUP_RANGE				0x0827      //Supplier range of driver - utility I/F
+#define CFG_DRV_ACT_RANGES_PRI			0x0828      //(Acceptable) Actor range for Primary Firmware - driver I/F
+#define CFG_DRV_ACT_RANGES_STA			0x0829      //(Acceptable) Actor range for Station Firmware - driver I/F
+#define CFG_DRV_ACT_RANGES_HSI 			0x082A      //(Acceptable) Actor range for H/W - driver I/F
+#define CFG_DRV_ACT_RANGES_APF			0x082B		//(Acceptable) Actor range for AP Firmware - driver I/F
+#define CFG_HCF_OPT						0x082C		//HCF (Compile time) options
+#endif // MSF_COMPONENT_ID
+
+#define CFG_REG_MB						0x0830		//Register Mail Box
+#define CFG_MB_ASSERT					0x0831		//Assert information
+#define CFG_REG_ASSERT_RTNP				0x0832		//(de-)register MSF Assert Callback routine
+#if (HCF_EXT) & HCF_EXT_INFO_LOG
+#define CFG_REG_INFO_LOG				0x0839		//(de-)register Info frames to Log
+#endif // HCF_INFO_LOG
+#define CFG_CNTL_OPT					0x083A		//Control options
+
+#define CFG_PROG						0x0857		//Program NIC memory
+#define 	CFG_PROG_STOP					0x0000
+#define 	CFG_PROG_VOLATILE				0x0100
+//#define 	CFG_PROG_FLASH					0x0300		//restore if H-II non-volatile is introduced
+//#define 	CFG_PROG_SEEPROM				0x1300		//restore if H-II non-volatile is introduced
+#define 	CFG_PROG_SEEPROM_READBACK 		0x0400
+
+#define CFG_FW_PRINTF                       0x0858      //Related to firmware debug printf functionality
+#define CFG_FW_PRINTF_BUFFER_LOCATION       0x0859      //Also related to firmware debug printf functionality
+
+#define CFG_CMD_NIC						0x0860		//Hermes Engineering command
+#define CFG_CMD_HCF						0x0863		//HCF Engineering command
+#define 	CFG_CMD_HCF_REG_ACCESS			0x0000	//Direct register access
+#define 	CFG_CMD_HCF_RX_MON				0x0001	//Rx-monitor
+
+
+/*============================================================= MSF Defined RECORDS	========================*/
+#define CFG_ENCRYPT_STRING				0x0900		//transfer encryption info from CPL to MSF
+#define CFG_AP_MODE						0x0901		//control mode of STAP driver from CPL
+#define CFG_DRIVER_ENABLE				0x0902		//extend&export En-/Disable facility to Utility
+#define CFG_PCI_COMMAND					0x0903		//PCI adapter (Ooievaar) structure
+#define CFG_WOLAS_ENABLE				0x0904		//extend&export En-/Disable WOLAS facility to Utility
+#define CFG_COUNTRY_STRING				0x0905		//transfer CountryInfo info from CPL to MSF
+#define CFG_FW_DUMP						0x0906		//transfer nic memory to utility
+#define CFG_POWER_MODE					0x0907		//controls the PM mode of the card
+#define CFG_CONNECTION_MODE				0x0908		//controls the mode of the FW (ESS/AP/IBSS/ADHOC)
+#define CFG_IFB							0x0909		//byte wise copy of IFB
+#define CFG_MSF_TALLIES					0x090A		//MSF tallies (int's, rx and tx)
+#define CFG_CURRENT_LINK_STATUS			0x090B		//Latest link status got trough 0xF200 LinkEvent
+
+/*============================================================ INFORMATION FRAMES =========================*/
+#define CFG_INFO_FRAME_MIN				0xF000		//lowest value representing an Informatio Frame
+
+#define CFG_TALLIES						0xF100		//Communications Tallies
+#define CFG_SCAN						0xF101		//Scan results
+#define CFG_PRS_SCAN					0xF102		//Probe Response Scan results
+
+#define CFG_LINK_STAT 					0xF200		//Link Status
+	/* 1 through 5 are F/W defined values, produced by CFG_LINK_STAT frame
+	 * 1 through 5 are shared by CFG_LINK_STAT, IFB_LinkStat and IFB_DSLinkStat
+	 * 1 plays a double role as CFG_LINK_STAT_CONNECTED and as bit reflecting:
+	 *	 - connected: ON
+	 *	 - disconnected: OFF
+	 */
+#define 	CFG_LINK_STAT_CONNECTED			0x0001
+#define 	CFG_LINK_STAT_DISCONNECTED		0x0002
+#define 	CFG_LINK_STAT_AP_CHANGE			0x0003
+#define 	CFG_LINK_STAT_AP_OOR			0x0004
+#define 	CFG_LINK_STAT_AP_IR				0x0005
+#define 	CFG_LINK_STAT_FW				0x000F	//mask to isolate F/W defined bits
+//#define 	CFG_LINK_STAT_TIMER				0x0FF0	//mask to isolate OOR timer
+//#define 	CFG_LINK_STAT_DS_OOR			0x2000	//2000 and up are IFB_LinkStat specific
+//#define 	CFG_LINK_STAT_DS_IR				0x4000
+#define 	CFG_LINK_STAT_CHANGE			0x8000
+#define CFG_ASSOC_STAT					0xF201		//Association Status
+#define CFG_SECURITY_STAT				0xF202		//Security Status
+#define CFG_UPDATED_INFO_RECORD			0xF204		//Updated Info Record
+
+/*============================================================ CONFIGURATION RECORDS ======================*/
+/***********************************************************************************************************/
+
+/****************************** S T R U C T U R E   D E F I N I T I O N S **********************************/
+
+//Quick&Dirty to get download for DOS ODI Hermes-II running typedef LTV_STRCT FAR *	LTVP;
+typedef LTV_STRCT FAR *	LTVP;   // i.s.o #define LTVP LTV_STRCT FAR *
+
+#if defined WVLAN_42 || defined WVLAN_43 //;?keepup with legacy a little while longer (4aug2003)
+typedef struct DUI_STRCT {			/* "legacy", still used by WVLAN42/43, NDIS drivers use WLAPI			*/
+	void  FAR	*ifbp;				/* Pointer to IFB
+									 *	returned from MSF to USF by uil_connect
+				 					 *	passed from USF to MSF as a "magic cookie" by all other UIL function calls
+				 					 */
+	hcf_16		stat;				// status returned from MSF to USF
+	hcf_16		fun;				// command code from USF to MSF
+	LTV_STRCT	ltv;				/* LTV structure
+			 						 *** during uil_put_info:
+						 			 *	  the L, T and V-fields carry information from USF to MSF
+									 *** during uil_get_info:
+									 *	  the L and T fields carry information from USF to MSF
+									 *	  the L and V-fields carry information from MSF to USF
+			 						 */
+} DUI_STRCT;
+typedef DUI_STRCT FAR *	DUIP;
+#endif //defined WVLAN_42 || defined WVLAN_43 //;?keepup with legacy a liitle while longer (4aug2003)
+
+
+typedef struct CFG_CMD_NIC_STRCT {	// CFG_CMD_NIC (0x0860)		Hermes Engineering command
+	hcf_16	len;					//default length of RID
+	hcf_16	typ;					//RID identification as defined by Hermes
+	hcf_16	cmd;					//Command code (0x003F) and control bits (0xFFC0)
+	hcf_16	parm0;					//parameters for Hermes Param0 register
+	hcf_16	parm1;					//parameters for Hermes Param1 register
+	hcf_16	parm2;					//parameters for Hermes Param2 register
+	hcf_16	stat;					//result code from Hermes Status register
+	hcf_16	resp0;					//responses from Hermes Resp0 register
+	hcf_16	resp1;					//responses from Hermes Resp1 register
+	hcf_16	resp2;					//responses from Hermes Resp2 register
+	hcf_16	hcf_stat;				//result code from cmd_exe routine
+	hcf_16	ifb_err_cmd;			//IFB_ErrCmd
+	hcf_16	ifb_err_qualifier;		//IFB_ErrQualifier
+} CFG_CMD_NIC_STRCT;
+
+
+typedef struct CFG_DRV_INFO_STRCT {		//CFG_DRV_INFO (0x0825) driver information
+	hcf_16	len;					//default length of RID
+	hcf_16	typ;					//RID identification as defined by Hermes
+	hcf_8	driver_name[8];			//Driver name, 8 bytes, right zero padded
+	hcf_16	driver_version;			//BCD 2 digit major and 2 digit minor driver version
+	hcf_16	HCF_version;   			//BCD 2 digit major and 2 digit minor HCF version
+	hcf_16	driver_stat;			//
+	hcf_16	IO_address;				//base IO address used by NIC
+	hcf_16	IO_range;				//range of IO addresses used by NIC
+	hcf_16	IRQ_number;				//Interrupt used by NIC
+	hcf_16	card_stat;				/*NIC status
+									@*	0x8000	Card present
+									@*	0x4000	Card Enabled
+									@*	0x2000	Driver incompatible with NIC Primary Functions
+									@*	0x1000	Driver incompatible with NIC Station Functions				*/
+	hcf_16	frame_type;				/*Frame type
+									@*	0x000	802.3
+									@*	0x008	802.11														*/
+	hcf_32	drv_info;				/*driver specific info
+									 * CE: virtual I/O base													*/
+}CFG_DRV_INFO_STRCT;
+
+#define COMP_ID_FW_PRI					21		//Primary Functions Firmware
+#define COMP_ID_FW_INTERMEDIATE			22		//Intermediate Functions Firmware
+#define COMP_ID_FW_STA					31		//Station Functions Firmware
+#define COMP_ID_FW_AP					32		//AP Functions Firmware
+#define COMP_ID_FW_AP_FAKE			   331		//AP Functions Firmware
+
+#define COMP_ID_MINIPORT_NDIS_31		41		//Windows 9x/NT Miniport NDIS 3.1
+#define COMP_ID_PACKET					42		//Packet
+#define COMP_ID_ODI_16					43		//DOS ODI
+#define COMP_ID_ODI_32					44		//32-bits ODI
+#define COMP_ID_MAC_OS					45		//Macintosh OS
+#define COMP_ID_WIN_CE					46		//Windows CE Miniport
+//#define COMP_ID_LINUX_PD				47		//Linux, HCF-light based, MSF source code in Public Domain
+#define COMP_ID_MINIPORT_NDIS_50		48		//Windows 9x/NT Miniport NDIS 5.0
+#define COMP_ID_LINUX					49		/*Linux, GPL'ed HCF based, full source code in Public Domain
+										  		 *thanks to Andreas Neuhaus								*/
+#define COMP_ID_QNX						50		//QNX
+#define COMP_ID_MINIPORT_NDIS_50_USB	51		//Windows 9x/NT Miniport NDIS 4.0
+#define COMP_ID_MINIPORT_NDIS_40		52		//Windows 9x/NT Miniport NDIS 4.0
+#define COMP_ID_VX_WORKS_ENDSTA			53		// VxWorks END Station driver
+#define COMP_ID_VX_WORKS_ENDAP			54		// VxWorks END Access Point driver
+//;?#define COMP_ID_MAC_OS_????			55		//;?check with HM
+#define COMP_ID_VX_WORKS_END			56		// VxWorks END Station/Access Point driver
+//										57		//NucleusOS@ARM Driver.
+#define COMP_ID_WSU						63		/* WaveLAN Station Firmware Update utility
+												 *	variant 1: Windows
+												 *	variant 2: DOS
+												 */
+#define COMP_ID_AP1						81		//WaveLAN/IEEE AP
+#define COMP_ID_EC						83		//WaveLAN/IEEE Ethernet Converter
+#define COMP_ID_UBL						87		//USB Boot Loader
+
+#define COMP_ROLE_SUPL					0x00	//supplier
+#define COMP_ROLE_ACT					0x01	//actor
+
+												//Supplier			  - actor
+#define COMP_ID_MFI						0x01	//Modem		 		  - Firmware	I/F
+#define COMP_ID_CFI						0x02	//Controller		  - Firmware	I/F
+#define COMP_ID_PRI						0x03	//Primary Firmware	  - Driver		I/F
+#define COMP_ID_STA						0x04	//Station Firmware	  - Driver		I/F
+#define COMP_ID_DUI						0x05	//Driver			  - Utility		I/F
+#define COMP_ID_HSI						0x06	//H/W                 - Driver		I/F
+#define COMP_ID_DAI						0x07	//API                 - Driver		I/F
+#define COMP_ID_APF						0x08	//H/W                 - Driver		I/F
+#define COMP_ID_INT						0x09	//Intermediate FW     - Driver		I/F
+
+#ifdef HCF_LEGACY
+#define HCF_ACT_ACS_SCAN				HCF_ACT_PRS_SCAN
+#define UIL_ACT_ACS_SCAN 				UIL_ACT_PRS_SCAN
+#define MDD_ACT_ACS_SCAN	 			MDD_ACT_PRS_SCAN
+#define CFG_ACS_SCAN					CFG_PRS_SCAN
+#endif // HCF_LEGACY
+
+#endif // MDD_H
+
diff --git a/drivers/staging/wlags49_h2/mmd.c b/drivers/staging/wlags49_h2/mmd.c
new file mode 100644
index 000000000000..de138c481a9e
--- /dev/null
+++ b/drivers/staging/wlags49_h2/mmd.c
@@ -0,0 +1,251 @@
+
+//   vim:tw=110:ts=4:
+/************************************************************************************************************
+*
+* FILE	  : mmd.c
+*
+* DATE    : $Date: 2004/07/23 11:57:45 $   $Revision: 1.4 $
+* Original: 2004/05/28 14:05:35    Revision: 1.32      Tag: hcf7_t20040602_01
+* Original: 2004/05/13 15:31:45    Revision: 1.30      Tag: hcf7_t7_20040513_01
+* Original: 2004/04/15 09:24:42    Revision: 1.25      Tag: hcf7_t7_20040415_01
+* Original: 2004/04/08 15:18:17    Revision: 1.24      Tag: t7_20040413_01
+* Original: 2004/04/01 15:32:55    Revision: 1.22      Tag: t7_20040401_01
+* Original: 2004/03/10 15:39:28    Revision: 1.18      Tag: t20040310_01
+* Original: 2004/03/03 14:10:12    Revision: 1.16      Tag: t20040304_01
+* Original: 2004/03/02 09:27:12    Revision: 1.14      Tag: t20040302_03
+* Original: 2004/02/24 13:00:29    Revision: 1.12      Tag: t20040224_01
+* Original: 2004/01/30 09:59:33    Revision: 1.11      Tag: t20040219_01
+*
+* AUTHOR  : Nico Valster
+*
+* DESC    : Common routines for HCF, MSF, UIL as well as USF sources
+*
+* Note: relative to Asserts, the following can be observed:
+*	Since the IFB is not known inside the routine, the macro HCFASSERT is replaced with MDDASSERT.
+*	Also the line number reported in the assert is raised by FILE_NAME_OFFSET (20000) to discriminate the
+*	MMD Asserts from HCF and DHF asserts.
+*
+***************************************************************************************************************
+*
+*
+* SOFTWARE LICENSE
+*
+* This software is provided subject to the following terms and conditions,
+* which you should read carefully before using the software.  Using this
+* software indicates your acceptance of these terms and conditions.  If you do
+* not agree with these terms and conditions, do not use the software.
+*
+* COPYRIGHT © 2001 - 2004	by Agere Systems Inc.	All Rights Reserved
+* All rights reserved.
+*
+* Redistribution and use in source or binary forms, with or without
+* modifications, are permitted provided that the following conditions are met:
+*
+* . Redistributions of source code must retain the above copyright notice, this
+*    list of conditions and the following Disclaimer as comments in the code as
+*    well as in the documentation and/or other materials provided with the
+*    distribution.
+*
+* . Redistributions in binary form must reproduce the above copyright notice,
+*    this list of conditions and the following Disclaimer in the documentation
+*    and/or other materials provided with the distribution.
+*
+* . Neither the name of Agere Systems Inc. nor the names of the contributors
+*    may be used to endorse or promote products derived from this software
+*    without specific prior written permission.
+*
+* Disclaimer
+*
+* THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
+* INCLUDING, BUT NOT LIMITED TO, INFRINGEMENT AND THE IMPLIED WARRANTIES OF
+* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  ANY
+* USE, MODIFICATION OR DISTRIBUTION OF THIS SOFTWARE IS SOLELY AT THE USERS OWN
+* RISK. IN NO EVENT SHALL AGERE SYSTEMS INC. OR CONTRIBUTORS BE LIABLE FOR ANY
+* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+* ON ANY THEORY OF LIABILITY, INCLUDING, BUT NOT LIMITED TO, CONTRACT, STRICT
+* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+* OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+* DAMAGE.
+*
+*
+**************************************************************************************************************/
+
+#include "hcf.h"				// Needed as long as we do not really sort out the mess
+#include "hcfdef.h"				// get CNV_LITTLE_TO_SHORT
+#include "mmd.h"				// MoreModularDriver common include file
+
+//to distinguish DHF from HCF asserts by means of line number
+#undef	FILE_NAME_OFFSET
+#define FILE_NAME_OFFSET DHF_FILE_NAME_OFFSET
+
+
+/*************************************************************************************************************
+*
+*.MODULE		CFG_RANGE_SPEC_STRCT* mmd_check_comp( CFG_RANGES_STRCT *actp, CFG_SUP_RANGE_STRCT *supp )
+*.PURPOSE		Checks compatibility between an actor and a supplier.
+*
+*.ARGUMENTS
+*	actp
+*	supp
+*
+*.RETURNS
+*	NULL	incompatible
+*	<>NULL	pointer to matching CFG_RANGE_SPEC_STRCT substructure in actor-structure matching the supplier
+*
+*.NARRATIVE
+*
+*  Parameters:
+*	actp	address of the actor specification
+*	supp	address of the supplier specification
+*
+*	Description: mmd_check_comp is a support routine to check the compatibility between an actor and a
+*	supplier.  mmd_check_comp is independent of the endianess of the actp and supp structures. This is
+*	achieved by checking the "bottom" or "role" fields of these structures. Since these fields are restricted
+*	to a limited range, comparing the contents to a value with a known endian-ess gives a clue to their actual
+*	endianess.
+*
+*.DIAGRAM
+*1a: The role-field of the actor structure has a known non-zero, not "byte symmetric" value (namely
+*	COMP_ROLE_ACT or 0x0001), so if and only the contents of this field matches COMP_ROLE_ACT (in Native
+*	Endian format), the actor structure is Native Endian.
+*2a: Since the role-field of the supplier structure is 0x0000, the test as used for the actor does not work
+*	for a supplier. A supplier has always exactly 1 variant,top,bottom record with (officially, but see the
+*	note below) each of these 3 values in the range 1 through 99, so one byte of the word value of variant,
+*	top and bottom words is 0x00 and the other byte is non-zero. Whether the lowest address byte or the
+*	highest address byte is non-zero depends on the Endianess of the LTV. If and only if the word value of
+*	bottom is less than 0x0100, the supplier is Native Endian.
+*	NOTE: the variant field of the supplier structure can not be used for the Endian Detection Algorithm,
+*	because a a zero-valued variant has been used as Controlled Deployment indication in the past.
+*	Note: An actor may have multiple sets of variant,top,bottom records, including dummy sets with variant,
+*	top and bottom fields with a zero-value. As a consequence the endianess of the actor can not be determined
+*	based on its variant,top,bottom values.
+*
+*	Note: the L and T field of the structures are always in Native Endian format, so you can not draw
+*	conclusions concerning the Endianess of the structure based on these two fields.
+*
+*1b/2b
+*	The only purpose of the CFG_RANGE_SPEC_BYTE_STRCT is to give easy access to the non-zero byte of the word
+*	value of variant, top and bottom. The variables sup_endian and act_endian are used for the supplier and
+*	actor structure respectively. These variables must be 0 when the structure has LE format and 1 if the
+*	structure has BE format. This can be phrased as:
+*	the variable is false (i.e 0x0000) if either
+*		(the platform is LE and the LTV is the same as the platform)
+*	or
+*		(the platform is BE and the LTV differs from the platform).
+*	the variable is true (i.e 0x0001) if either
+*		(the platform is BE and the LTV is the same as the platform)
+*	or
+*		(the platform is LE and the LTV differs from the platform).
+*
+*	Alternatively this can be phrased as:
+*	if the platform is LE
+*		if the LTV is LE (i.e the same as the platform), then the variable = 0
+*		else (the LTV is BE (i.e. different from the platform) ), then the variable = 1
+*	if the platform is BE
+*		if the LTV is BE (i.e the same as the platform), then the variable = 1
+*		else (the LTV is LE (i.e. different from the platform) ), then the variable = 0
+*
+*	This is implemented as:
+*	#if HCF_BIG_ENDIAN == 0	//platform is LE
+*		sup/act_endian becomes reverse of structure-endianess as determined in 1a/1b
+*	#endif
+*6:	Each of the actor variant-bottom-top records is checked against the (single) supplier variant-bottom-top
+*	range till either an acceptable match is found or all actor records are tried. As explained above, due to
+*	the limited ranges of these values, checking a byte is acceptable and suitable.
+*8:	depending on whether a match was found or not (as reflected by the value of the control variable of the
+*	for loop), the NULL pointer or a pointer to the matching Number/Bottom/Top record of the Actor structure
+*	is returned.
+*	As an additional safety, checking the supplier length protects against invalid Supplier structures, which
+*	may be caused by failing hcf_get_info (in which case the len-field is zero). Note that the contraption
+*	"supp->len != sizeof(CFG_SUP_RANGE_STRCT)/sizeof(hcf_16) - 1"
+*	did turn out not to work for a compiler which padded the structure definition.
+*
+* Note: when consulting references like DesignNotes and Architecture specifications there is a confusing use
+*	of the notions number and variant. This resulted in an inconsistent use in the HCF nomenclature as well.
+*	This makes the logic hard to follow and one has to be very much aware of the context when walking through
+*	the code.
+* NOTE: The Endian Detection Algorithm places limitations on future extensions of the fields, i.e. they should
+*	stay within the currently defined boundaries of 1 through 99 (although 1 through 255) would work as well
+*	and there should never be used a zero value for the bottom of a valid supplier.
+* Note: relative to Asserts, the following can be observed:
+*	1: Supplier variant 0x0000 has been used for Controlled Deployment
+*	2: An actor may have one or more variant record specifications with a top of zero and a non-zero bottom
+*	to override the HCF default support of a particular variant by the MSF programmer via hcfcfg.h
+*	3:	An actor range can be specified as all zeros, e.g. as padding in the automatically generated firmware
+*	image files.
+*.ENDDOC				END DOCUMENTATION
+*************************************************************************************************************/
+CFG_RANGE_SPEC_STRCT*
+mmd_check_comp( CFG_RANGES_STRCT *actp, CFG_SUP_RANGE_STRCT *supp )
+{
+
+CFG_RANGE_SPEC_BYTE_STRCT  *actq = (CFG_RANGE_SPEC_BYTE_STRCT*)actp->var_rec;
+CFG_RANGE_SPEC_BYTE_STRCT  *supq = (CFG_RANGE_SPEC_BYTE_STRCT*)&(supp->variant);
+hcf_16	i;
+int		act_endian;					//actor endian flag
+int		sup_endian;					//supplier endian flag
+
+	act_endian = actp->role == COMP_ROLE_ACT;	//true if native endian				/* 1a */
+	sup_endian = supp->bottom < 0x0100;		 	//true if native endian				/* 2a */
+
+#if HCF_ASSERT
+	MMDASSERT( supp->len == 6, 																supp->len )
+	MMDASSERT( actp->len >= 6 && actp->len%3 == 0, 											actp->len )
+
+	if ( act_endian ) {							//native endian
+		MMDASSERT( actp->role == COMP_ROLE_ACT,												actp->role )
+		MMDASSERT( 1 <= actp->id && actp->id <= 99,  										actp->id )
+	} else {									//non-native endian
+		MMDASSERT( actp->role == CNV_END_SHORT(COMP_ROLE_ACT),	 							actp->role )
+		MMDASSERT( 1 <= CNV_END_SHORT(actp->id) && CNV_END_SHORT(actp->id) <= 99,				actp->id )
+	}
+	if ( sup_endian ) {							//native endian
+		MMDASSERT( supp->role == COMP_ROLE_SUPL, 											supp->role )
+		MMDASSERT( 1 <= supp->id      && supp->id <= 99,  									supp->id )
+		MMDASSERT( 1 <= supp->variant && supp->variant <= 99,  								supp->variant )
+		MMDASSERT( 1 <= supp->bottom  && supp->bottom <= 99, 								supp->bottom )
+		MMDASSERT( 1 <= supp->top     && supp->top <= 99, 		 							supp->top )
+		MMDASSERT( supp->bottom <= supp->top,							supp->bottom << 8 | supp->top )
+	} else {									//non-native endian
+		MMDASSERT( supp->role == CNV_END_SHORT(COMP_ROLE_SUPL), 								supp->role )
+		MMDASSERT( 1 <= CNV_END_SHORT(supp->id) && CNV_END_SHORT(supp->id) <= 99,				supp->id )
+		MMDASSERT( 1 <= CNV_END_SHORT(supp->variant) && CNV_END_SHORT(supp->variant) <= 99,		supp->variant )
+		MMDASSERT( 1 <= CNV_END_SHORT(supp->bottom)  && CNV_END_SHORT(supp->bottom) <=99,		supp->bottom )
+		MMDASSERT( 1 <= CNV_END_SHORT(supp->top)     && CNV_END_SHORT(supp->top) <=99,  		supp->top )
+		MMDASSERT( CNV_END_SHORT(supp->bottom) <= CNV_END_SHORT(supp->top),	supp->bottom << 8 |	supp->top )
+	}
+#endif // HCF_ASSERT
+
+#if HCF_BIG_ENDIAN == 0
+	act_endian = !act_endian;																		/* 1b*/
+	sup_endian = !sup_endian;																		/* 2b*/
+#endif // HCF_BIG_ENDIAN
+
+	for ( i = actp->len ; i > 3; actq++, i -= 3 ) {													/* 6 */
+		MMDASSERT( actq->variant[act_endian] <= 99, i<<8 | actq->variant[act_endian] )
+		MMDASSERT( actq->bottom[act_endian] <= 99 , i<<8 | actq->bottom[act_endian] )
+		MMDASSERT( actq->top[act_endian] <= 99	  , i<<8 | actq->top[act_endian] )
+		MMDASSERT( actq->bottom[act_endian] <= actq->top[act_endian], i<<8 | actq->bottom[act_endian] )
+		if ( actq->variant[act_endian] == supq->variant[sup_endian] &&
+			 actq->bottom[act_endian]  <= supq->top[sup_endian] &&
+			 actq->top[act_endian]     >= supq->bottom[sup_endian]
+		   ) break;
+	}
+	if ( i <= 3 || supp->len != 6 /*sizeof(CFG_SUP_RANGE_STRCT)/sizeof(hcf_16) - 1 */ ) {
+	   actq = NULL;																					/* 8 */
+	}
+#if HCF_ASSERT
+	if ( actq == NULL ) {
+		for ( i = 0; i <= supp->len; i += 2 ) {
+			MMDASSERT( DO_ASSERT, MERGE_2( ((hcf_16*)supp)[i], ((hcf_16*)supp)[i+1] ) );
+		}
+		for ( i = 0; i <= actp->len; i += 2 ) {
+			MMDASSERT( DO_ASSERT, MERGE_2( ((hcf_16*)actp)[i], ((hcf_16*)actp)[i+1] ) );
+		}
+	}
+#endif // HCF_ASSERT
+	return (CFG_RANGE_SPEC_STRCT*)actq;
+} // mmd_check_comp
+
diff --git a/drivers/staging/wlags49_h2/mmd.h b/drivers/staging/wlags49_h2/mmd.h
new file mode 100644
index 000000000000..06890c1b30a4
--- /dev/null
+++ b/drivers/staging/wlags49_h2/mmd.h
@@ -0,0 +1,78 @@
+
+//   vim:tw=110:ts=4:
+#ifndef MMD_H
+#define MMD_H 1
+
+/*************************************************************************************************************
+*
+* FILE	  : mmd.h
+*
+* DATE    : $Date: 2004/07/19 08:16:14 $   $Revision: 1.2 $
+* Original: 2004/05/17 07:33:14    Revision: 1.18      Tag: hcf7_t20040602_01
+* Original: 2004/05/11 06:22:59    Revision: 1.17      Tag: hcf7_t7_20040513_01
+* Original: 2004/04/15 09:24:42    Revision: 1.13      Tag: hcf7_t7_20040415_01
+* Original: 2004/04/08 15:18:17    Revision: 1.12      Tag: t7_20040413_01
+* Original: 2004/04/01 15:32:55    Revision: 1.10      Tag: t7_20040401_01
+* Original: 2004/03/04 16:47:50    Revision: 1.7      Tag: t20040310_01
+* Original: 2004/03/03 12:47:05    Revision: 1.6      Tag: t20040304_01
+* Original: 2004/02/25 14:14:39    Revision: 1.5      Tag: t20040302_03
+* Original: 2004/02/24 13:00:29    Revision: 1.4      Tag: t20040224_01
+* Original: 2004/01/30 09:59:33    Revision: 1.3      Tag: t20040219_01
+*
+* AUTHOR  : Nico Valster
+*
+* DESC    : Definitions and Prototypes for HCF, MSF, UIL as well as USF sources
+*
+***************************************************************************************************************
+*
+*
+* SOFTWARE LICENSE
+*
+* This software is provided subject to the following terms and conditions,
+* which you should read carefully before using the software.  Using this
+* software indicates your acceptance of these terms and conditions.  If you do
+* not agree with these terms and conditions, do not use the software.
+*
+* COPYRIGHT © 2001 - 2004	by Agere Systems Inc.	All Rights Reserved
+* All rights reserved.
+*
+* Redistribution and use in source or binary forms, with or without
+* modifications, are permitted provided that the following conditions are met:
+*
+* . Redistributions of source code must retain the above copyright notice, this
+*    list of conditions and the following Disclaimer as comments in the code as
+*    well as in the documentation and/or other materials provided with the
+*    distribution.
+*
+* . Redistributions in binary form must reproduce the above copyright notice,
+*    this list of conditions and the following Disclaimer in the documentation
+*    and/or other materials provided with the distribution.
+*
+* . Neither the name of Agere Systems Inc. nor the names of the contributors
+*    may be used to endorse or promote products derived from this software
+*    without specific prior written permission.
+*
+* Disclaimer
+*
+* THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
+* INCLUDING, BUT NOT LIMITED TO, INFRINGEMENT AND THE IMPLIED WARRANTIES OF
+* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  ANY
+* USE, MODIFICATION OR DISTRIBUTION OF THIS SOFTWARE IS SOLELY AT THE USERS OWN
+* RISK. IN NO EVENT SHALL AGERE SYSTEMS INC. OR CONTRIBUTORS BE LIABLE FOR ANY
+* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+* ON ANY THEORY OF LIABILITY, INCLUDING, BUT NOT LIMITED TO, CONTRACT, STRICT
+* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+* OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+* DAMAGE.
+*
+*
+**************************************************************************************************************/
+#ifndef HCF_H
+#include "hcf.h"	//just to get going with swig
+#endif
+
+EXTERN_C CFG_RANGE_SPEC_STRCT* mmd_check_comp( CFG_RANGES_STRCT *actp, CFG_SUP_RANGE_STRCT *supp );
+
+#endif // MMD_H
diff --git a/drivers/staging/wlags49_h2/sta_h2.c b/drivers/staging/wlags49_h2/sta_h2.c
new file mode 100644
index 000000000000..f9a38523724c
--- /dev/null
+++ b/drivers/staging/wlags49_h2/sta_h2.c
@@ -0,0 +1,4480 @@
+/*
+ * File:	sta_h24.236
+ *
+ * Abstract:	This file contains memory image 'fw_image'.
+ *
+ * Contents:	Total size of the memory image: 69294 bytes.
+ *		Total number of blocks: 4 blocks.
+ *		Block  1 : load address 00000060, 390 bytes.
+ *		Block  2 : load address 00000C16, 9496 bytes.
+ *		Block  3 : load address 001E312E, 15786 bytes.
+ *		Block  4 : load address 001F4000, 43622 bytes.
+ *
+ * Identity:	component id: 31 (variant 3) version 2.36
+ *
+ * Compatibility:
+ *		supplying interface 4 (variant 2) : 2 - 5
+ *		acting on interface 1 (variant 4) : 6 - 7
+ *		acting on interface 1 (variant 5) : 6 - 7
+ *		acting on interface 1 (variant 6) : 6 - 7
+ *		acting on interface 2 (variant 2) : 1 - 2
+ *
+ * Generated:	by g:\fw\fupu3.exe version 4.26
+ *
+ * Commandline:	g:\fw\fupu3.exe /f=4 /n=fw_image /i=r3023600.hex
+ */
+
+
+#include "hcfcfg.h"				// to get hcf_16 etc defined as well as
+                                // possible settings which inluence mdd.h or dhf.h
+#include "mdd.h"   				//to get COMP_ID_STA etc defined
+#include "dhf.h"   				//used to be "fhfmem.h", to get memblock,plugrecord,
+
+static const hcf_8 fw_image_1_data[] = {
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1C, 0x0D, 0x00, 0x00,
+	 0x3A, 0x0C, 0x00, 0x00, 0x3A, 0x0C, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x1B, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1B, 0x00, 0x1B, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0A, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x86, 0x19, 0x86, 0x19, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x00,
+	 0x06, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0xEA, 0x00, 0x00, 0xFF, 0x07, 0x01, 0x00, 0x64, 0x00, 0x64, 0x00, 0x10, 0x27, 0x10, 0x27,
+	 0x14, 0x00, 0xD0, 0x07, 0xD0, 0x07, 0x10, 0x27, 0x2F, 0x00, 0x32, 0x00, 0x32, 0x00, 0x05, 0x00,
+	 0x02, 0x00, 0x02, 0x00, 0x10, 0x27, 0x05, 0x00, 0x00, 0x02, 0x00, 0x02, 0x13, 0x00, 0x0A, 0x00,
+	 0x07, 0x00, 0x03, 0x00, 0x32, 0x00, 0x00, 0x00, 0x00, 0x00, 0x2A, 0x09, 0x2B, 0x09, 0x2B, 0x09,
+	 0x03, 0x00, 0x00, 0x00, 0x00, 0x6E, 0x00, 0x14, 0x01, 0x00, 0x40, 0x00, 0x32, 0x00, 0x32, 0x00,
+	 0x0A, 0x00, 0x02, 0x00, 0x06, 0x00, 0x01, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x01, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+
+};  /* fw_image_1_data */
+
+static const hcf_8 fw_image_2_data[] = {
+	 0x4B, 0xA3, 0x00, 0x0A, 0x10, 0x01, 0x68, 0xA4, 0xB0, 0x01, 0x84, 0x01, 0x30, 0x33, 0x31, 0x33,
+	 0x44, 0x44, 0x30, 0x33, 0x31, 0x33, 0x30, 0x33, 0x31, 0x33, 0x32, 0x33, 0x32, 0x33, 0x90, 0x00,
+	 0x78, 0x04, 0xAE, 0xE4, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B,
+	 0x0C, 0x0D, 0x0E, 0x0F, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xA5, 0xC6, 0x84, 0xF8, 0x99, 0xEE,
+	 0x8D, 0xF6, 0x0D, 0xFF, 0xBD, 0xD6, 0xB1, 0xDE, 0x54, 0x91, 0x50, 0x60, 0x03, 0x02, 0xA9, 0xCE,
+	 0x7D, 0x56, 0x19, 0xE7, 0x62, 0xB5, 0xE6, 0x4D, 0x9A, 0xEC, 0x45, 0x8F, 0x9D, 0x1F, 0x40, 0x89,
+	 0x87, 0xFA, 0x15, 0xEF, 0xEB, 0xB2, 0xC9, 0x8E, 0x0B, 0xFB, 0xEC, 0x41, 0x67, 0xB3, 0xFD, 0x5F,
+	 0xEA, 0x45, 0xBF, 0x23, 0xF7, 0x53, 0x96, 0xE4, 0x5B, 0x9B, 0xC2, 0x75, 0x1C, 0xE1, 0xAE, 0x3D,
+	 0x6A, 0x4C, 0x5A, 0x6C, 0x41, 0x7E, 0x02, 0xF5, 0x4F, 0x83, 0x5C, 0x68, 0xF4, 0x51, 0x34, 0xD1,
+	 0x08, 0xF9, 0x93, 0xE2, 0x73, 0xAB, 0x53, 0x62, 0x3F, 0x2A, 0x0C, 0x08, 0x52, 0x95, 0x65, 0x46,
+	 0x5E, 0x9D, 0x28, 0x30, 0xA1, 0x37, 0x0F, 0x0A, 0xB5, 0x2F, 0x09, 0x0E, 0x36, 0x24, 0x9B, 0x1B,
+	 0x3D, 0xDF, 0x26, 0xCD, 0x69, 0x4E, 0xCD, 0x7F, 0x9F, 0xEA, 0x1B, 0x12, 0x9E, 0x1D, 0x74, 0x58,
+	 0x2E, 0x34, 0x2D, 0x36, 0xB2, 0xDC, 0xEE, 0xB4, 0xFB, 0x5B, 0xF6, 0xA4, 0x4D, 0x76, 0x61, 0xB7,
+	 0xCE, 0x7D, 0x7B, 0x52, 0x3E, 0xDD, 0x71, 0x5E, 0x97, 0x13, 0xF5, 0xA6, 0x68, 0xB9, 0x00, 0x00,
+	 0x2C, 0xC1, 0x60, 0x40, 0x1F, 0xE3, 0xC8, 0x79, 0xED, 0xB6, 0xBE, 0xD4, 0x46, 0x8D, 0xD9, 0x67,
+	 0x4B, 0x72, 0xDE, 0x94, 0xD4, 0x98, 0xE8, 0xB0, 0x4A, 0x85, 0x6B, 0xBB, 0x2A, 0xC5, 0xE5, 0x4F,
+	 0x16, 0xED, 0xC5, 0x86, 0xD7, 0x9A, 0x55, 0x66, 0x94, 0x11, 0xCF, 0x8A, 0x10, 0xE9, 0x06, 0x04,
+	 0x81, 0xFE, 0xF0, 0xA0, 0x44, 0x78, 0xBA, 0x25, 0xE3, 0x4B, 0xF3, 0xA2, 0xFE, 0x5D, 0xC0, 0x80,
+	 0x8A, 0x05, 0xAD, 0x3F, 0xBC, 0x21, 0x48, 0x70, 0x04, 0xF1, 0xDF, 0x63, 0xC1, 0x77, 0x75, 0xAF,
+	 0x63, 0x42, 0x30, 0x20, 0x1A, 0xE5, 0x0E, 0xFD, 0x6D, 0xBF, 0x4C, 0x81, 0x14, 0x18, 0x35, 0x26,
+	 0x2F, 0xC3, 0xE1, 0xBE, 0xA2, 0x35, 0xCC, 0x88, 0x39, 0x2E, 0x57, 0x93, 0xF2, 0x55, 0x82, 0xFC,
+	 0x47, 0x7A, 0xAC, 0xC8, 0xE7, 0xBA, 0x2B, 0x32, 0x95, 0xE6, 0xA0, 0xC0, 0x98, 0x19, 0xD1, 0x9E,
+	 0x7F, 0xA3, 0x66, 0x44, 0x7E, 0x54, 0xAB, 0x3B, 0x83, 0x0B, 0xCA, 0x8C, 0x29, 0xC7, 0xD3, 0x6B,
+	 0x3C, 0x28, 0x79, 0xA7, 0xE2, 0xBC, 0x1D, 0x16, 0x76, 0xAD, 0x3B, 0xDB, 0x56, 0x64, 0x4E, 0x74,
+	 0x1E, 0x14, 0xDB, 0x92, 0x0A, 0x0C, 0x6C, 0x48, 0xE4, 0xB8, 0x5D, 0x9F, 0x6E, 0xBD, 0xEF, 0x43,
+	 0xA6, 0xC4, 0xA8, 0x39, 0xA4, 0x31, 0x37, 0xD3, 0x8B, 0xF2, 0x32, 0xD5, 0x43, 0x8B, 0x59, 0x6E,
+	 0xB7, 0xDA, 0x8C, 0x01, 0x64, 0xB1, 0xD2, 0x9C, 0xE0, 0x49, 0xB4, 0xD8, 0xFA, 0xAC, 0x07, 0xF3,
+	 0x25, 0xCF, 0xAF, 0xCA, 0x8E, 0xF4, 0xE9, 0x47, 0x18, 0x10, 0xD5, 0x6F, 0x88, 0xF0, 0x6F, 0x4A,
+	 0x72, 0x5C, 0x24, 0x38, 0xF1, 0x57, 0xC7, 0x73, 0x51, 0x97, 0x23, 0xCB, 0x7C, 0xA1, 0x9C, 0xE8,
+	 0x21, 0x3E, 0xDD, 0x96, 0xDC, 0x61, 0x86, 0x0D, 0x85, 0x0F, 0x90, 0xE0, 0x42, 0x7C, 0xC4, 0x71,
+	 0xAA, 0xCC, 0xD8, 0x90, 0x05, 0x06, 0x01, 0xF7, 0x12, 0x1C, 0xA3, 0xC2, 0x5F, 0x6A, 0xF9, 0xAE,
+	 0xD0, 0x69, 0x91, 0x17, 0x58, 0x99, 0x27, 0x3A, 0xB9, 0x27, 0x38, 0xD9, 0x13, 0xEB, 0xB3, 0x2B,
+	 0x33, 0x22, 0xBB, 0xD2, 0x70, 0xA9, 0x89, 0x07, 0xA7, 0x33, 0xB6, 0x2D, 0x22, 0x3C, 0x92, 0x15,
+	 0x20, 0xC9, 0x49, 0x87, 0xFF, 0xAA, 0x78, 0x50, 0x7A, 0xA5, 0x8F, 0x03, 0xF8, 0x59, 0x80, 0x09,
+	 0x17, 0x1A, 0xDA, 0x65, 0x31, 0xD7, 0xC6, 0x84, 0xB8, 0xD0, 0xC3, 0x82, 0xB0, 0x29, 0x77, 0x5A,
+	 0x11, 0x1E, 0xCB, 0x7B, 0xFC, 0xA8, 0xD6, 0x6D, 0x3A, 0x2C, 0x00, 0x30, 0x00, 0x31, 0x00, 0x33,
+	 0x00, 0x34, 0x00, 0x35, 0x00, 0x36, 0x00, 0x37, 0x00, 0x38, 0x00, 0x38, 0x00, 0x3A, 0x00, 0x3B,
+	 0x00, 0x3C, 0x00, 0x3D, 0x00, 0x3E, 0x00, 0x3F, 0x00, 0x3F, 0x09, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x0A, 0x02, 0x14,
+	 0x05, 0x32, 0x0B, 0x37, 0x08, 0x50, 0x0B, 0x6E, 0x00, 0x00, 0x01, 0x00, 0x02, 0x00, 0x3F, 0x00,
+	 0x0C, 0x00, 0x30, 0x00, 0x03, 0x00, 0x0F, 0x00, 0x3E, 0x00, 0x3C, 0x00, 0x02, 0x00, 0x04, 0x00,
+	 0x0A, 0x00, 0x0B, 0x00, 0x10, 0x00, 0x16, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x63, 0x00, 0x63, 0x00, 0x20, 0x00, 0x63, 0x00, 0x63, 0x00, 0x20, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x0A, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0B, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0C, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x0D, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0E, 0x00, 0x00, 0x00, 0x00, 0x00, 0xA0, 0x10,
+	 0xEE, 0x10, 0xA6, 0x10, 0xE8, 0x10, 0xAC, 0x10, 0xE2, 0x10, 0xB2, 0x10, 0xDC, 0x10, 0xB8, 0x10,
+	 0xD6, 0x10, 0xBE, 0x10, 0xD0, 0x10, 0xC4, 0x10, 0xCA, 0x10, 0x07, 0x01, 0x00, 0x00, 0x0A, 0x22,
+	 0x00, 0x04, 0x08, 0x01, 0x00, 0x00, 0x0A, 0x26, 0x00, 0x04, 0x09, 0x01, 0x00, 0x00, 0x0A, 0x2A,
+	 0x00, 0x04, 0x0A, 0x01, 0x00, 0x00, 0x0A, 0x2E, 0x00, 0x04, 0x0B, 0x01, 0x00, 0x00, 0x10, 0x24,
+	 0x04, 0x04, 0x0C, 0x01, 0x00, 0x00, 0x10, 0x28, 0x04, 0x04, 0x0D, 0x01, 0x00, 0x00, 0x10, 0x2C,
+	 0x04, 0x04, 0x0E, 0x01, 0x00, 0x00, 0x10, 0x30, 0x04, 0x04, 0x0F, 0x01, 0x00, 0x00, 0x16, 0x34,
+	 0x08, 0x04, 0x10, 0x01, 0x00, 0x00, 0x16, 0x38, 0x08, 0x04, 0x11, 0x01, 0x00, 0x00, 0x16, 0x3C,
+	 0x08, 0x04, 0x12, 0x01, 0x00, 0x00, 0x16, 0x40, 0x08, 0x04, 0x13, 0x01, 0x00, 0x00, 0x17, 0x64,
+	 0x0C, 0x0B, 0x14, 0x01, 0x00, 0x00, 0x17, 0x68, 0x0C, 0x0B, 0x15, 0x01, 0x00, 0x00, 0x17, 0x6C,
+	 0x0C, 0x0B, 0x16, 0x01, 0x00, 0x00, 0x17, 0x70, 0x0C, 0x0B, 0x17, 0x01, 0x00, 0x00, 0x17, 0x74,
+	 0x0C, 0x0B, 0x18, 0x01, 0x00, 0x00, 0x17, 0x78, 0x0C, 0x0B, 0x19, 0x01, 0x00, 0x00, 0x17, 0x7C,
+	 0x0C, 0x0B, 0x1A, 0x01, 0x00, 0x00, 0x17, 0x80, 0x0C, 0x0B, 0x1B, 0x01, 0x00, 0x00, 0x17, 0x84,
+	 0x0C, 0x0B, 0x1C, 0x01, 0x00, 0x00, 0x17, 0x88, 0x0C, 0x0B, 0x1D, 0x01, 0x00, 0x00, 0x17, 0x8C,
+	 0x0C, 0x0B, 0x1E, 0x01, 0x00, 0x00, 0x1D, 0x95, 0x17, 0x04, 0x1F, 0x01, 0x00, 0x00, 0x1D, 0x99,
+	 0x17, 0x04, 0x20, 0x01, 0x00, 0x00, 0x1D, 0x9D, 0x17, 0x04, 0x21, 0x01, 0x00, 0x00, 0x1D, 0xA1,
+	 0x17, 0x04, 0x22, 0x01, 0x00, 0x00, 0x0E, 0xA5, 0x00, 0x00, 0x10, 0x11, 0x30, 0x11, 0x50, 0x11,
+	 0x70, 0x11, 0xC8, 0x11, 0x18, 0x11, 0x38, 0x11, 0x58, 0x11, 0x78, 0x11, 0xD0, 0x11, 0x20, 0x11,
+	 0x40, 0x11, 0x60, 0x11, 0x80, 0x11, 0xD8, 0x11, 0x28, 0x11, 0x48, 0x11, 0x68, 0x11, 0x88, 0x11,
+	 0xE0, 0x11, 0x90, 0x11, 0x98, 0x11, 0xA0, 0x11, 0xA8, 0x11, 0xB0, 0x11, 0xB8, 0x11, 0xC0, 0x11,
+	 0xE8, 0x11, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xBE, 0x1E, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x74, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x36, 0x25, 0x4F, 0x25, 0x72, 0x25, 0xE1, 0x24, 0xE1, 0x24, 0xE1, 0x24, 0xAC, 0x25,
+	 0x02, 0x2B, 0xE1, 0x24, 0xE1, 0x24, 0xE1, 0x24, 0xF3, 0x2D, 0xE1, 0x24, 0xE1, 0x24, 0xE1, 0x24,
+	 0xE1, 0x24, 0xE1, 0x24, 0x8B, 0x27, 0xE1, 0x24, 0xE1, 0x24, 0xE1, 0x24, 0xE1, 0x24, 0xE1, 0x24,
+	 0xE1, 0x24, 0xE1, 0x24, 0xE1, 0x24, 0xE1, 0x24, 0xE1, 0x24, 0xE1, 0x24, 0xE1, 0x24, 0xE1, 0x24,
+	 0xE1, 0x24, 0xE1, 0x24, 0xE5, 0x27, 0xE1, 0x24, 0xE1, 0x24, 0xE1, 0x24, 0xE1, 0x24, 0xE1, 0x24,
+	 0xE1, 0x24, 0xE1, 0x24, 0xE1, 0x24, 0xE1, 0x24, 0xE1, 0x24, 0xE1, 0x24, 0xE1, 0x24, 0xE1, 0x24,
+	 0xE1, 0x24, 0x59, 0x27, 0x73, 0x27, 0xE1, 0x24, 0xE1, 0x24, 0xE1, 0x24, 0xE1, 0x24, 0xE1, 0x24,
+	 0xE1, 0x24, 0x47, 0x23, 0xCE, 0x25, 0xE1, 0x25, 0x91, 0x26, 0x95, 0x26, 0xE1, 0x24, 0xE1, 0x24,
+	 0x44, 0x27, 0x51, 0xEA, 0xFF, 0xE9, 0x00, 0x00, 0x48, 0xEA, 0x00, 0x00, 0x00, 0x00, 0xC9, 0xEA,
+	 0x65, 0x25, 0x89, 0x25, 0x00, 0x00, 0xF8, 0x2A, 0x00, 0x00, 0x00, 0x00, 0x13, 0x2B, 0xE0, 0xFC,
+	 0x4C, 0x28, 0xC6, 0x2A, 0x5A, 0x00, 0x02, 0x00, 0xF9, 0xFF, 0x4C, 0x28, 0x62, 0x28, 0x00, 0x01,
+	 0x02, 0x00, 0xF7, 0xFF, 0x4C, 0x28, 0x62, 0x28, 0x50, 0x28, 0x06, 0x00, 0xF0, 0xFF, 0x4C, 0x28,
+	 0x29, 0x28, 0x00, 0x00, 0x00, 0x02, 0xF6, 0xFF, 0x4C, 0x28, 0x62, 0x28, 0x6C, 0x00, 0x02, 0x00,
+	 0xF4, 0xFF, 0x4C, 0x28, 0x62, 0x28, 0xAA, 0x01, 0x02, 0x00, 0xF5, 0xFF, 0x4C, 0x28, 0xCF, 0x2A,
+	 0x42, 0x28, 0x02, 0x00, 0xE0, 0xFF, 0x4C, 0x28, 0x62, 0x28, 0xCE, 0x2D, 0x02, 0x00, 0xE1, 0xFF,
+	 0x4C, 0x28, 0x62, 0x28, 0xD0, 0x2D, 0x02, 0x00, 0xE2, 0xFF, 0x4C, 0x28, 0x62, 0x28, 0xD2, 0x2D,
+	 0x02, 0x00, 0xE3, 0xFF, 0x4C, 0x28, 0x62, 0x28, 0xCA, 0x2D, 0x02, 0x00, 0x03, 0xFC, 0x4C, 0x28,
+	 0x17, 0x2A, 0x16, 0x2D, 0x02, 0x00, 0x04, 0xFC, 0x4C, 0x28, 0x5C, 0x28, 0x58, 0x28, 0x22, 0x00,
+	 0x06, 0xFC, 0x4C, 0x28, 0x62, 0x28, 0x40, 0x28, 0x02, 0x00, 0x07, 0xFC, 0x4C, 0x28, 0x62, 0x28,
+	 0x9C, 0x28, 0x02, 0x00, 0x0E, 0xFC, 0x4C, 0x28, 0x29, 0x2A, 0xA6, 0x28, 0x22, 0x00, 0xB1, 0xFC,
+	 0x4C, 0x28, 0x1D, 0x2B, 0xA2, 0x29, 0x02, 0x00, 0x20, 0xFC, 0x4C, 0x28, 0x62, 0x28, 0xCC, 0x28,
+	 0x02, 0x00, 0x25, 0xFC, 0x4C, 0x28, 0x62, 0x28, 0xD6, 0x28, 0x02, 0x00, 0x26, 0xFC, 0x4C, 0x28,
+	 0x62, 0x28, 0xD8, 0x28, 0x02, 0x00, 0x27, 0xFC, 0x4C, 0x28, 0x62, 0x28, 0xDA, 0x28, 0x02, 0x00,
+	 0xB2, 0xFC, 0x4C, 0x28, 0x5C, 0x28, 0xC6, 0x29, 0x22, 0x00, 0xC1, 0xFC, 0x4C, 0x28, 0x62, 0x28,
+	 0x5A, 0x2D, 0x20, 0x00, 0xB0, 0xFC, 0x1F, 0x28, 0x22, 0x2B, 0x00, 0x00, 0x00, 0x00, 0xC4, 0xFC,
+	 0x1F, 0x28, 0xE7, 0x2A, 0x00, 0x00, 0x08, 0x00, 0xC8, 0xFC, 0x1F, 0x28, 0xE2, 0x2A, 0x00, 0x00,
+	 0x08, 0x00, 0xB4, 0xFC, 0x1F, 0x28, 0x60, 0x2B, 0x00, 0x00, 0x00, 0x00, 0xB6, 0xFC, 0x1F, 0x28,
+	 0x11, 0x2C, 0x00, 0x00, 0x00, 0x00, 0xB7, 0xFC, 0x1F, 0x28, 0x3B, 0x2C, 0x00, 0x00, 0x00, 0x00,
+	 0xB8, 0xFC, 0x1F, 0x28, 0x98, 0x2C, 0x00, 0x00, 0x00, 0x00, 0xB5, 0xFC, 0x4C, 0x28, 0x62, 0x28,
+	 0xC6, 0x2D, 0x02, 0x00, 0xB9, 0xFC, 0x4C, 0x28, 0x62, 0x28, 0xC8, 0x2D, 0x02, 0x00, 0x90, 0xFD,
+	 0x4C, 0x28, 0x29, 0x28, 0xCC, 0x2D, 0x02, 0x00, 0x23, 0xFC, 0x4C, 0x28, 0x62, 0x28, 0xD2, 0x28,
+	 0x02, 0x00, 0x29, 0xFC, 0x44, 0x29, 0xF1, 0x28, 0x00, 0x00, 0x00, 0x00, 0xC2, 0xFC, 0x4C, 0x28,
+	 0x62, 0x28, 0x0E, 0x2D, 0x02, 0x00, 0x32, 0xFC, 0x4C, 0x28, 0x62, 0x28, 0xA0, 0x01, 0x02, 0x00,
+	 0x33, 0xFC, 0x4C, 0x28, 0x62, 0x28, 0xA2, 0x01, 0x02, 0x00, 0x00, 0xFC, 0x4C, 0x28, 0x62, 0x28,
+	 0x56, 0x28, 0x02, 0x00, 0x01, 0xFC, 0x4C, 0x28, 0x62, 0x28, 0x50, 0x28, 0x06, 0x00, 0x02, 0xFC,
+	 0x4C, 0x28, 0xDC, 0x28, 0xA4, 0x29, 0x22, 0x00, 0x05, 0xFC, 0x4C, 0x28, 0x62, 0x28, 0x46, 0x28,
+	 0x02, 0x00, 0x08, 0xFC, 0x4C, 0x28, 0x62, 0x28, 0x4A, 0x28, 0x06, 0x00, 0x09, 0xFC, 0x4C, 0x28,
+	 0x62, 0x28, 0x9E, 0x28, 0x02, 0x00, 0x0B, 0xFC, 0x4C, 0x28, 0x62, 0x28, 0xA0, 0x28, 0x02, 0x00,
+	 0x0C, 0xFC, 0x4C, 0x28, 0x62, 0x28, 0xA2, 0x28, 0x02, 0x00, 0x0D, 0xFC, 0x4C, 0x28, 0x62, 0x28,
+	 0xA4, 0x28, 0x02, 0x00, 0x21, 0xFC, 0x4C, 0x28, 0x62, 0x28, 0xCE, 0x28, 0x02, 0x00, 0x80, 0xFC,
+	 0xB8, 0x28, 0xC8, 0x28, 0xE2, 0x28, 0xC0, 0x00, 0x81, 0xFC, 0x4C, 0x28, 0x62, 0x28, 0xA8, 0x01,
+	 0x02, 0x00, 0x83, 0xFC, 0x4C, 0x28, 0x62, 0x28, 0xAC, 0x01, 0x02, 0x00, 0x85, 0xFC, 0x4C, 0x28,
+	 0x49, 0x2A, 0xA6, 0x01, 0x02, 0x00, 0x86, 0xFC, 0x4C, 0x28, 0x5B, 0x2A, 0xB2, 0x01, 0x02, 0x00,
+	 0x28, 0xFC, 0x4C, 0x28, 0x62, 0x28, 0xDC, 0x28, 0x02, 0x00, 0x87, 0xFC, 0x4C, 0x28, 0x62, 0x28,
+	 0xEC, 0x29, 0x22, 0x03, 0x84, 0xFC, 0x4C, 0x28, 0x70, 0x2A, 0xB0, 0x01, 0x02, 0x00, 0x2B, 0xFC,
+	 0x4C, 0x28, 0x62, 0x28, 0x14, 0x31, 0x02, 0x00, 0xF8, 0xFF, 0x4C, 0x28, 0x62, 0x28, 0x0E, 0x31,
+	 0x02, 0x00, 0xF3, 0xFF, 0x4C, 0x28, 0x62, 0x28, 0x16, 0x31, 0x02, 0x00, 0x20, 0xFD, 0x7D, 0x28,
+	 0x29, 0x28, 0x23, 0x34, 0x08, 0x00, 0x21, 0xFD, 0x7D, 0x28, 0x29, 0x28, 0x27, 0x34, 0x0A, 0x00,
+	 0x22, 0xFD, 0x7D, 0x28, 0x29, 0x28, 0x2C, 0x34, 0x16, 0x00, 0x23, 0xFD, 0x7D, 0x28, 0x29, 0x28,
+	 0x37, 0x34, 0x0A, 0x00, 0x10, 0xFD, 0x4C, 0x28, 0x29, 0x28, 0x74, 0x01, 0x02, 0x00, 0x45, 0xFD,
+	 0x4C, 0x28, 0x29, 0x28, 0x00, 0x01, 0x02, 0x00, 0x47, 0xFD, 0x4C, 0x28, 0x29, 0x28, 0x78, 0x01,
+	 0x02, 0x00, 0x48, 0xFD, 0x9A, 0x29, 0x29, 0x28, 0xA0, 0x01, 0x02, 0x00, 0x49, 0xFD, 0x9A, 0x29,
+	 0x29, 0x28, 0xA2, 0x01, 0x02, 0x00, 0x4A, 0xFD, 0x4C, 0x28, 0x29, 0x28, 0x98, 0x01, 0x02, 0x00,
+	 0x4B, 0xFD, 0x4C, 0x28, 0x29, 0x28, 0x9A, 0x01, 0x02, 0x00, 0x4D, 0xFD, 0x7D, 0x28, 0x29, 0x28,
+	 0x3C, 0x34, 0x04, 0x00, 0x4F, 0xFD, 0xAE, 0x29, 0x29, 0x28, 0x1A, 0x2D, 0x02, 0x00, 0xC0, 0xFD,
+	 0x7D, 0x28, 0x29, 0x28, 0x3E, 0x34, 0x02, 0x00, 0xC2, 0xFD, 0xA4, 0x29, 0x29, 0x28, 0x00, 0x00,
+	 0x02, 0x00, 0xC3, 0xFD, 0x7D, 0x28, 0x29, 0x28, 0x3F, 0x34, 0x02, 0x00, 0x40, 0xFD, 0x75, 0x28,
+	 0x29, 0x28, 0xB8, 0x01, 0x02, 0x00, 0x24, 0xFD, 0xCB, 0x29, 0x29, 0x28, 0x00, 0x00, 0x02, 0x00,
+	 0x91, 0xFD, 0x4C, 0x28, 0x29, 0x28, 0x20, 0x24, 0x02, 0x00, 0x93, 0xFD, 0x4C, 0x28, 0x29, 0x28,
+	 0x26, 0x24, 0x02, 0x00, 0xC1, 0xFD, 0x4C, 0x28, 0x29, 0x28, 0xFE, 0x00, 0x02, 0x00, 0xC6, 0xFD,
+	 0xAA, 0x28, 0x29, 0x28, 0x28, 0x2D, 0x0A, 0x00, 0x89, 0xFD, 0x5B, 0x29, 0x29, 0x28, 0x00, 0x00,
+	 0x00, 0x00, 0x8A, 0xFD, 0x9A, 0x28, 0x29, 0x28, 0xA0, 0x2D, 0x24, 0x00, 0x41, 0xFD, 0x4C, 0x28,
+	 0x29, 0x28, 0x7A, 0x2D, 0x22, 0x00, 0x42, 0xFD, 0x4C, 0x28, 0x29, 0x28, 0x02, 0x01, 0x06, 0x00,
+	 0x43, 0xFD, 0xD8, 0x29, 0x29, 0x28, 0x00, 0x00, 0x06, 0x00, 0x44, 0xFD, 0xB8, 0x29, 0x29, 0x28,
+	 0xB4, 0x01, 0x02, 0x00, 0x46, 0xFD, 0x4C, 0x28, 0x29, 0x28, 0xBA, 0x01, 0x0C, 0x00, 0x4C, 0xFD,
+	 0x4C, 0x28, 0x29, 0x28, 0xEA, 0x29, 0x02, 0x00, 0x50, 0xFD, 0x4C, 0x28, 0x29, 0x28, 0xF4, 0x00,
+	 0x02, 0x00, 0x51, 0xFD, 0x4C, 0x28, 0x29, 0x28, 0xF6, 0x00, 0x02, 0x00, 0x52, 0xFD, 0x4C, 0x28,
+	 0x29, 0x28, 0xC6, 0x01, 0x02, 0x00, 0x8F, 0xFD, 0xEB, 0x29, 0x29, 0x28, 0x00, 0x00, 0x08, 0x00,
+	 0x92, 0xFD, 0x4C, 0x28, 0x29, 0x28, 0x54, 0x2D, 0x02, 0x00, 0x8C, 0xFD, 0x3F, 0x28, 0x29, 0x28,
+	 0x08, 0x2E, 0x56, 0x00, 0x8D, 0xFD, 0x3F, 0x28, 0x29, 0x28, 0x62, 0x2E, 0x14, 0x00, 0x00, 0xF1,
+	 0x46, 0x00, 0xE3, 0x27, 0x3A, 0x01, 0x01, 0xF1, 0x44, 0x07, 0xE1, 0x27, 0x3C, 0x01, 0x00, 0x03,
+	 0x2A, 0x68, 0x1E, 0x00, 0x76, 0x01, 0xFE, 0x00, 0xD6, 0x01, 0x02, 0x01, 0x3E, 0x01, 0xB8, 0x01,
+	 0x74, 0x27, 0x5A, 0x01, 0x20, 0x24, 0x20, 0x00, 0x00, 0x00, 0xBA, 0x1C, 0x00, 0x00, 0xBE, 0x1E,
+	 0x54, 0x01, 0x0B, 0x00, 0xBA, 0x00, 0xE4, 0x00, 0x3C, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC4, 0xAF, 0x37, 0xAF, 0x43, 0xB0,
+	 0x4C, 0xB0, 0x48, 0xAF, 0xDE, 0xAF, 0xB6, 0xAF, 0x1C, 0x33, 0x7F, 0x32, 0x1C, 0x33, 0xF3, 0x32,
+	 0x89, 0x32, 0x7D, 0x32, 0x3B, 0x33, 0x4C, 0x33, 0x4C, 0x33, 0x4C, 0x33, 0x55, 0x33, 0x70, 0x33,
+	 0xCD, 0x33, 0xE9, 0x33, 0xF4, 0x32, 0x07, 0x33, 0xDB, 0x32, 0x10, 0x00, 0x12, 0x00, 0x13, 0x00,
+	 0x20, 0x00, 0x21, 0x00, 0x22, 0x00, 0x30, 0x00, 0x31, 0x00, 0x32, 0x00, 0x33, 0x00, 0x34, 0x00,
+	 0x35, 0x00, 0x36, 0x00, 0x37, 0x00, 0x38, 0x00, 0x39, 0x00, 0x3A, 0x00, 0x00, 0x00, 0x14, 0x01,
+	 0x14, 0x01, 0x14, 0x01, 0x14, 0x01, 0x14, 0x01, 0x14, 0x01, 0x14, 0x01, 0x14, 0x01, 0xF3, 0x02,
+	 0xAD, 0x03, 0x60, 0x04, 0x04, 0x05, 0x07, 0x06, 0x08, 0x07, 0x0A, 0x08, 0x16, 0x09, 0x44, 0x0A,
+	 0x04, 0x0B, 0x40, 0x0C, 0x80, 0x0D, 0x00, 0x0E, 0x84, 0x0F, 0x01, 0x10, 0x10, 0x11, 0x02, 0x14,
+	 0x40, 0x20, 0x32, 0x21, 0x32, 0x22, 0x04, 0x23, 0x01, 0x24, 0x0F, 0x25, 0x00, 0x26, 0x00, 0x27,
+	 0x00, 0x28, 0x00, 0x29, 0x00, 0x2A, 0x01, 0x2B, 0x06, 0x2C, 0x00, 0x38, 0x00, 0x39, 0xD6, 0x3A,
+	 0x00, 0x3B, 0x00, 0x3C, 0x14, 0x3D, 0x7F, 0x3E, 0x00, 0x3F, 0x68, 0x40, 0x75, 0x41, 0x07, 0x42,
+	 0x07, 0x43, 0x00, 0x45, 0x3B, 0x4A, 0x00, 0x4B, 0x00, 0x4C, 0x0F, 0x4D, 0x02, 0x75, 0x00, 0x76,
+	 0x80, 0x00, 0x08, 0x01, 0x09, 0x01, 0x09, 0x01, 0x0A, 0x01, 0x0A, 0x01, 0x0B, 0x01, 0x0B, 0x01,
+	 0x0C, 0x01, 0x0C, 0x01, 0x0D, 0x01, 0x0D, 0x01, 0x0E, 0x01, 0x0E, 0x01, 0x0F, 0x01, 0x0F, 0x01,
+	 0x10, 0x01, 0x10, 0x01, 0x11, 0x01, 0x11, 0x01, 0x12, 0x01, 0x12, 0x01, 0x13, 0x01, 0x13, 0x01,
+	 0x14, 0x01, 0x14, 0x01, 0x15, 0x01, 0x15, 0x01, 0x16, 0x01, 0x16, 0x01, 0x17, 0x01, 0x17, 0x01,
+	 0x18, 0x01, 0x18, 0x01, 0x19, 0x01, 0x19, 0x01, 0x4D, 0x01, 0x4D, 0x01, 0x4E, 0x01, 0x4E, 0x01,
+	 0x4F, 0x01, 0x4F, 0x01, 0x50, 0x01, 0x50, 0x01, 0x51, 0x01, 0x51, 0x01, 0x52, 0x01, 0x52, 0x01,
+	 0x53, 0x01, 0x53, 0x01, 0x54, 0x01, 0x54, 0x01, 0x65, 0x01, 0x65, 0x01, 0x66, 0x01, 0x66, 0x01,
+	 0x67, 0x01, 0x67, 0x01, 0x68, 0x01, 0x68, 0x01, 0x69, 0x01, 0x69, 0x01, 0x6A, 0x01, 0x6A, 0x01,
+	 0x6B, 0x01, 0x6B, 0x01, 0x6C, 0x01, 0x6C, 0x01, 0x6D, 0x01, 0x6D, 0x01, 0x6E, 0x01, 0x6E, 0x01,
+	 0x6F, 0x01, 0x6F, 0x01, 0x70, 0x01, 0x70, 0x01, 0x71, 0x01, 0x71, 0x01, 0x72, 0x01, 0x72, 0x01,
+	 0x73, 0x01, 0x73, 0x01, 0x74, 0x01, 0x74, 0x01, 0x75, 0x01, 0x75, 0x01, 0x76, 0x01, 0x76, 0x01,
+	 0x77, 0x01, 0x77, 0x01, 0x78, 0x01, 0x78, 0x01, 0x79, 0x01, 0x79, 0x01, 0x7A, 0x01, 0x7A, 0x01,
+	 0x7B, 0x01, 0x7B, 0x01, 0x7C, 0x01, 0x7C, 0x01, 0x7D, 0x01, 0x7D, 0x01, 0x7E, 0x01, 0x7E, 0x01,
+	 0x7F, 0x01, 0x7F, 0x01, 0x7F, 0x01, 0x7F, 0x01, 0x7F, 0x01, 0x7F, 0x01, 0x7F, 0x01, 0x7F, 0x01,
+	 0x7F, 0x01, 0x7F, 0x01, 0x7F, 0x01, 0x7F, 0x01, 0x7F, 0x01, 0x7F, 0x01, 0x7F, 0x01, 0x7F, 0x01,
+	 0x7F, 0x01, 0x7F, 0x01, 0x7F, 0x01, 0x7F, 0x01, 0x7F, 0x01, 0x7F, 0x01, 0x7F, 0x01, 0x7F, 0x01,
+	 0x7F, 0x01, 0x80, 0x12, 0x80, 0x12, 0x80, 0x12, 0x80, 0x12, 0x80, 0x12, 0x80, 0x12, 0x80, 0x12,
+	 0x80, 0x12, 0x80, 0x12, 0x80, 0x12, 0x80, 0x12, 0x80, 0x12, 0x80, 0x12, 0x80, 0x12, 0x80, 0x13,
+	 0x80, 0x13, 0x80, 0x13, 0x80, 0x13, 0x80, 0x13, 0x80, 0x13, 0x80, 0x13, 0x80, 0x13, 0x80, 0x13,
+	 0x80, 0x13, 0x80, 0x13, 0x80, 0x13, 0x80, 0x13, 0x80, 0x13, 0x51, 0x44, 0x51, 0x44, 0x51, 0x44,
+	 0x51, 0x44, 0x51, 0x44, 0x51, 0x44, 0x51, 0x44, 0x51, 0x44, 0x51, 0x44, 0x51, 0x44, 0x51, 0x44,
+	 0x51, 0x44, 0x51, 0x44, 0x51, 0x44, 0x22, 0x46, 0x22, 0x46, 0x22, 0x46, 0x22, 0x46, 0x22, 0x46,
+	 0x22, 0x46, 0x22, 0x46, 0x22, 0x46, 0x22, 0x46, 0x22, 0x46, 0x22, 0x46, 0x23, 0x46, 0x23, 0x46,
+	 0x23, 0x46, 0x1C, 0x47, 0x1C, 0x47, 0x1C, 0x47, 0x1C, 0x47, 0x1C, 0x47, 0x1C, 0x47, 0x1C, 0x47,
+	 0x1C, 0x47, 0x1C, 0x47, 0x1C, 0x47, 0x1C, 0x47, 0x1C, 0x47, 0x1C, 0x47, 0x1D, 0x47, 0x9A, 0x48,
+	 0xDA, 0x48, 0x1A, 0x48, 0x5A, 0x48, 0x9A, 0x48, 0xDA, 0x48, 0x1A, 0x48, 0x5A, 0x48, 0x9A, 0x48,
+	 0xDA, 0x48, 0x1A, 0x48, 0x5A, 0x48, 0x9A, 0x48, 0x33, 0x48, 0x78, 0x49, 0x78, 0x49, 0x79, 0x49,
+	 0x79, 0x49, 0x79, 0x49, 0x79, 0x49, 0x7A, 0x49, 0x7A, 0x49, 0x7A, 0x49, 0x7A, 0x49, 0x7B, 0x49,
+	 0x7B, 0x49, 0x7B, 0x49, 0x7C, 0x49, 0x32, 0x00, 0x46, 0x00, 0x5A, 0x00, 0x6E, 0x00, 0x82, 0x00,
+	 0x96, 0x00, 0xAA, 0x00, 0xBE, 0x00, 0xD2, 0x00, 0xE6, 0x00, 0xFA, 0x00, 0x0E, 0x01, 0x22, 0x01,
+	 0x52, 0x01, 0x05, 0x00, 0x04, 0x00, 0x04, 0x00, 0x04, 0x00, 0x04, 0x00, 0x03, 0x00, 0x03, 0x00,
+	 0x03, 0x00, 0x03, 0x00, 0x03, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x00, 0x02, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x03, 0x00, 0x15, 0x00, 0x6E, 0x6F, 0x6E, 0x2D, 0x73, 0x70, 0x65, 0x63, 0x69, 0x66, 0x69, 0x65,
+	 0x64, 0x20, 0x53, 0x53, 0x49, 0x44, 0x20, 0x21, 0x21, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+	 0x20, 0x20, 0x20, 0x20, 0x01, 0x00, 0x00, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+	 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+	 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x00, 0x09, 0x00, 0x00, 0x01, 0x00, 0x64, 0x00, 0x64, 0x00,
+	 0x00, 0x00, 0x48, 0x45, 0x52, 0x4D, 0x45, 0x53, 0x20, 0x32, 0x00, 0x20, 0x20, 0x20, 0x20, 0x20,
+	 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+	 0x20, 0x20, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x02, 0x00, 0x01, 0x00,
+	 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x04, 0x00,
+	 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x03, 0x00, 0x15, 0x00, 0x6E, 0x6F, 0x6E, 0x2D, 0x73, 0x70, 0x65, 0x63, 0x69, 0x66, 0x69, 0x65,
+	 0x64, 0x20, 0x53, 0x53, 0x49, 0x44, 0x20, 0x21, 0x21, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+	 0x20, 0x20, 0x20, 0x20, 0x01, 0x00, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+	 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+	 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x00, 0x09, 0x00, 0x00, 0x01, 0x00, 0x64, 0x00, 0x64, 0x00,
+	 0x00, 0x00, 0x48, 0x45, 0x52, 0x4D, 0x45, 0x53, 0x20, 0x32, 0x00, 0x20, 0x20, 0x20, 0x20, 0x20,
+	 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+	 0x20, 0x20, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x02, 0x00, 0x01, 0x00,
+	 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x46, 0x69, 0x72, 0x73, 0x74, 0x20, 0x57, 0x61, 0x76, 0x65, 0x4C, 0x41, 0x4E, 0x20, 0x49, 0x49,
+	 0x20, 0x53, 0x53, 0x49, 0x44, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+	 0x00, 0x00, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+	 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+	 0x20, 0x20, 0x28, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x2B, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x19, 0x00, 0x02, 0x01, 0x82, 0x84, 0x8B, 0x96, 0x00, 0x00, 0x00, 0x00, 0x1E, 0x85, 0x00, 0x01,
+	 0x7F, 0x00, 0x00, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x20, 0x00, 0x20, 0x00, 0x10, 0x00, 0x08, 0x00, 0x00, 0x01, 0x00, 0x01,
+	 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x20, 0x43, 0x75, 0x72, 0x72, 0x65, 0x6E, 0x74, 0x20, 0x53,
+	 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x20, 0x53, 0x65, 0x74, 0x20, 0x49, 0x64, 0x65, 0x6E, 0x74,
+	 0x69, 0x66, 0x69, 0x65, 0x72, 0x20, 0x00, 0x00, 0x00, 0x00, 0x06, 0xDD, 0x00, 0x50, 0xF2, 0x01,
+	 0x01, 0x00, 0x00, 0x50, 0xF2, 0x05, 0x02, 0x00, 0x00, 0x50, 0xF2, 0x02, 0x00, 0x50, 0xF2, 0x04,
+	 0x02, 0x00, 0x00, 0x50, 0xF2, 0x00, 0x00, 0x50, 0xF2, 0x01, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x15, 0x00, 0x14, 0x00, 0x15, 0x00, 0x36, 0x00, 0x10, 0x00, 0x10, 0x00, 0x10, 0x00, 0x14, 0x00,
+	 0x11, 0x00, 0x36, 0x00, 0x01, 0x00, 0x04, 0x00, 0x7A, 0x2D, 0x28, 0x2D, 0x0C, 0x2F, 0x10, 0x2F,
+	 0x14, 0x2F, 0xA0, 0x2D, 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0xC6, 0x29, 0x28, 0x2D,
+	 0xFF, 0xFF, 0x00, 0x00, 0x7A, 0x2D, 0x28, 0x2D, 0x0C, 0x2F, 0x10, 0x2F, 0x14, 0x2F, 0xA0, 0x2D,
+	 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x7A, 0x2D, 0x28, 0x2D, 0xFF, 0xFF, 0xE6, 0x2D,
+	 0x34, 0x2D, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x03, 0x03, 0x00, 0x02, 0x06, 0x00, 0x00, 0x06, 0x07,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00,
+	 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+
+};  /* fw_image_2_data */
+
+static const hcf_8 fw_image_3_data[] = {
+	 0x00, 0xE1, 0x30, 0x40, 0x02, 0x36, 0xA1, 0xFF, 0x83, 0xFF, 0x8D, 0xFF, 0x5C, 0x44, 0x5C, 0x43,
+	 0x5C, 0x42, 0x5C, 0x41, 0x5C, 0x40, 0xAC, 0xFF, 0xAD, 0xFF, 0xE7, 0xE1, 0xAD, 0x60, 0x08, 0x78,
+	 0xFF, 0xFF, 0x30, 0x44, 0x02, 0xA8, 0x00, 0xE1, 0x03, 0x02, 0x28, 0xE2, 0x40, 0xFF, 0xA1, 0xFF,
+	 0x84, 0xFF, 0xBB, 0x60, 0x18, 0x64, 0x40, 0x42, 0xB0, 0x60, 0x97, 0x64, 0x40, 0x40, 0xBD, 0xF3,
+	 0x80, 0xFB, 0x0F, 0x60, 0x9A, 0x63, 0xCA, 0xF3, 0xBD, 0xDB, 0x00, 0x60, 0x9A, 0x64, 0xBD, 0xDB,
+	 0x02, 0x64, 0xBD, 0xDB, 0x04, 0x64, 0xA3, 0xDB, 0x5C, 0x49, 0x0A, 0x64, 0x40, 0x4B, 0x5C, 0x5C,
+	 0x01, 0x60, 0x39, 0xE2, 0x04, 0x60, 0x00, 0x7A, 0x89, 0xFF, 0x03, 0x60, 0xFF, 0x73, 0x88, 0xFF,
+	 0xB0, 0x60, 0x97, 0x78, 0xFF, 0xFF, 0x30, 0x44, 0x02, 0xA8, 0x00, 0xE1, 0x06, 0x02, 0x40, 0xFF,
+	 0x42, 0xFF, 0x43, 0xFF, 0x44, 0xFF, 0x45, 0xFF, 0xA1, 0xFF, 0x88, 0xFF, 0x85, 0xFF, 0x21, 0xE1,
+	 0x5C, 0x40, 0xBB, 0x60, 0x20, 0x78, 0xFF, 0xFF, 0xA2, 0xFF, 0x30, 0x44, 0x02, 0xA8, 0x00, 0xE1,
+	 0x01, 0x02, 0xA1, 0xFF, 0x86, 0xFF, 0x88, 0xFF, 0x5C, 0x46, 0x5C, 0x49, 0x5C, 0x40, 0xE7, 0x60,
+	 0x58, 0x4F, 0x31, 0x78, 0xFF, 0xFF, 0xC7, 0x60, 0x58, 0x4F, 0xF6, 0x78, 0xFF, 0xFF, 0xCA, 0x60,
+	 0x58, 0x4F, 0x83, 0x78, 0xFF, 0xFF, 0xDD, 0x60, 0x58, 0x4F, 0x3D, 0x78, 0xFF, 0xFF, 0x1B, 0x60,
+	 0x58, 0x4F, 0x37, 0x78, 0xFF, 0xFF, 0xEC, 0x60, 0x58, 0x4F, 0x75, 0x78, 0xFF, 0xFF, 0xE0, 0x60,
+	 0x58, 0x4F, 0x1B, 0x78, 0xFF, 0xFF, 0xE4, 0x60, 0x58, 0x4F, 0xDC, 0x78, 0xFF, 0xFF, 0xF3, 0x60,
+	 0x58, 0x4F, 0xEB, 0x78, 0xFF, 0xFF, 0x13, 0xE1, 0xA3, 0xFF, 0xBF, 0x60, 0xE7, 0x78, 0xFF, 0xFF,
+	 0x03, 0xE1, 0xA3, 0xFF, 0xFE, 0xFC, 0xFF, 0xFC, 0x23, 0x60, 0xF4, 0x63, 0x17, 0xFD, 0xAE, 0xFF,
+	 0x25, 0x60, 0x11, 0x78, 0xFF, 0xFF, 0x2A, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x08, 0x26, 0x1A, 0x00,
+	 0x80, 0x3A, 0x15, 0x00, 0x81, 0xF1, 0x32, 0xF2, 0x33, 0xF2, 0xD0, 0x80, 0x82, 0xF1, 0x0F, 0x02,
+	 0xD0, 0x80, 0x34, 0xF2, 0x83, 0xF1, 0x0B, 0x02, 0xD0, 0x80, 0xFF, 0xFF, 0x08, 0x02, 0xDF, 0x60,
+	 0x58, 0x4F, 0x28, 0x78, 0xFF, 0xFF, 0x20, 0x60, 0x58, 0x4F, 0xBF, 0x78, 0xFF, 0xFF, 0x19, 0x60,
+	 0xE8, 0x78, 0xFF, 0xFF, 0x00, 0xF4, 0xAA, 0x60, 0xAA, 0x65, 0x09, 0xF2, 0x5A, 0xD0, 0xD4, 0x80,
+	 0x03, 0x64, 0x12, 0x02, 0xD0, 0x80, 0x1D, 0x60, 0x60, 0x65, 0x0E, 0x02, 0x5A, 0xD2, 0xFF, 0xFF,
+	 0xD4, 0x80, 0x01, 0x60, 0x00, 0x65, 0x08, 0x02, 0x5A, 0xD2, 0xFF, 0xFF, 0xD4, 0x80, 0xFF, 0xFF,
+	 0x03, 0x02, 0x19, 0x60, 0xE8, 0x78, 0xFF, 0xFF, 0x01, 0x60, 0xD6, 0x65, 0xA5, 0xD1, 0x5A, 0xD1,
+	 0x44, 0x48, 0x5A, 0xD1, 0x44, 0x4A, 0x26, 0x46, 0x3F, 0xF2, 0x00, 0xF4, 0x44, 0x4C, 0xD8, 0x83,
+	 0x70, 0x61, 0x68, 0x65, 0xD7, 0x80, 0xFF, 0xFF, 0x07, 0x0E, 0x08, 0xF2, 0x08, 0x00, 0x68, 0x65,
+	 0xD7, 0x80, 0xFF, 0xFF, 0x01, 0x0E, 0x03, 0x00, 0x19, 0x60, 0xFE, 0x78, 0xFF, 0xFF, 0x58, 0x4F,
+	 0x79, 0x00, 0x9C, 0x80, 0x01, 0x65, 0x02, 0x02, 0x00, 0x65, 0x02, 0x00, 0xFF, 0x3B, 0xF7, 0x01,
+	 0x58, 0x4F, 0x70, 0x00, 0x9C, 0x80, 0x45, 0x42, 0xEA, 0x02, 0x58, 0x4F, 0x6B, 0x00, 0x9C, 0x80,
+	 0xFF, 0xFF, 0xE5, 0x02, 0x58, 0x4F, 0x66, 0x00, 0x9C, 0x80, 0xFF, 0xFF, 0x03, 0x02, 0x00, 0x65,
+	 0x45, 0x42, 0xF8, 0x01, 0xFF, 0x3A, 0x29, 0x00, 0x60, 0x47, 0xFF, 0xB5, 0x28, 0x44, 0xFF, 0xB4,
+	 0x94, 0x80, 0xFF, 0xFF, 0xD4, 0x02, 0x60, 0x45, 0x28, 0x47, 0x2A, 0x5F, 0x40, 0x48, 0x2A, 0x47,
+	 0x2C, 0x5F, 0x40, 0x4A, 0x2C, 0x47, 0x65, 0x5F, 0x40, 0x4C, 0x10, 0x64, 0x40, 0x42, 0x28, 0x45,
+	 0x05, 0x00, 0x58, 0x4F, 0x47, 0x00, 0x94, 0x80, 0x28, 0x45, 0x26, 0x02, 0x58, 0x4F, 0x42, 0x00,
+	 0x94, 0x80, 0x2A, 0x45, 0x21, 0x02, 0x58, 0x4F, 0x3D, 0x00, 0x94, 0x80, 0xFF, 0xFF, 0x1C, 0x02,
+	 0x22, 0x44, 0x4C, 0x82, 0x2C, 0x45, 0x31, 0x03, 0xEC, 0x01, 0x10, 0x65, 0x45, 0x42, 0x28, 0x45,
+	 0x94, 0x80, 0x2A, 0x45, 0x21, 0x02, 0x58, 0x4F, 0x2D, 0x00, 0x94, 0x80, 0x2C, 0x45, 0x1C, 0x02,
+	 0x58, 0x4F, 0x28, 0x00, 0x94, 0x80, 0xFF, 0xFF, 0x17, 0x02, 0x22, 0x44, 0x4C, 0x82, 0x28, 0x45,
+	 0x1C, 0x03, 0x58, 0x4F, 0x1F, 0x00, 0xEC, 0x01, 0x40, 0x4B, 0x28, 0x47, 0x40, 0x48, 0x2A, 0x47,
+	 0x40, 0x4A, 0x2C, 0x47, 0x60, 0x45, 0x2A, 0x5E, 0x40, 0x4C, 0x2A, 0x44, 0x28, 0x5E, 0x40, 0x4A,
+	 0x28, 0x44, 0x65, 0x5E, 0x40, 0x48, 0x2B, 0x44, 0x68, 0x65, 0xD7, 0x80, 0xFF, 0xFF, 0x17, 0x0E,
+	 0x90, 0x01, 0x26, 0x46, 0xC5, 0x60, 0x5B, 0x78, 0xFF, 0xFF, 0xB9, 0xFF, 0x26, 0x46, 0xC5, 0x60,
+	 0x5B, 0x78, 0xFF, 0xFF, 0xC9, 0x81, 0xCB, 0x83, 0x07, 0x1C, 0x01, 0x1D, 0x08, 0x00, 0x00, 0xF4,
+	 0x01, 0xF2, 0xFF, 0xFF, 0xFF, 0xB4, 0xD8, 0x81, 0x5A, 0xD2, 0x2F, 0x58, 0xFF, 0xFF, 0x26, 0x46,
+	 0xC5, 0x60, 0x58, 0x4F, 0x78, 0x78, 0xFF, 0xFF, 0x02, 0x60, 0x00, 0x63, 0x00, 0xF4, 0x84, 0x65,
+	 0x78, 0x61, 0xA5, 0xD0, 0xDA, 0x85, 0x80, 0x3A, 0x02, 0x00, 0x00, 0xF4, 0x04, 0x65, 0x64, 0x44,
+	 0x00, 0x7F, 0xCD, 0x81, 0xBD, 0xDB, 0x05, 0x03, 0x64, 0x47, 0x00, 0x7F, 0xCD, 0x81, 0xBD, 0xDB,
+	 0xF0, 0x02, 0x1C, 0x60, 0xAC, 0x63, 0x29, 0x60, 0xEC, 0x64, 0x08, 0x65, 0xC4, 0x81, 0x61, 0x44,
+	 0xA3, 0xDB, 0x1C, 0x60, 0xAA, 0x61, 0x00, 0x64, 0xA1, 0xDB, 0x29, 0x60, 0xEC, 0x61, 0xA1, 0xD3,
+	 0xFF, 0xFF, 0x60, 0x43, 0x1C, 0x60, 0xB0, 0x61, 0xA1, 0xDD, 0x1C, 0x60, 0xB0, 0x61, 0xA1, 0xD3,
+	 0xFF, 0xFF, 0x60, 0x45, 0x1C, 0x60, 0xAA, 0x61, 0xA1, 0xD3, 0xFF, 0xFF, 0xD4, 0x80, 0xFF, 0xFF,
+	 0x01, 0x03, 0x03, 0x00, 0x1A, 0x60, 0xD6, 0x78, 0xFF, 0xFF, 0x1C, 0x60, 0xA8, 0x61, 0x01, 0x64,
+	 0xA1, 0xDB, 0x02, 0x60, 0x00, 0x61, 0x41, 0x4C, 0x03, 0x60, 0x00, 0x61, 0x41, 0x4A, 0x1C, 0x60,
+	 0xAC, 0x61, 0xA1, 0xD3, 0xFF, 0xFF, 0x40, 0x48, 0x1C, 0x60, 0xB2, 0x63, 0x28, 0x41, 0x06, 0x65,
+	 0xD5, 0x81, 0xA1, 0xD3, 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x26, 0x01, 0xA4, 0x60, 0x41, 0xA3, 0xDB,
+	 0x2A, 0x43, 0x28, 0x45, 0xA5, 0xD1, 0xDA, 0x85, 0x64, 0x44, 0x00, 0x7F, 0xCD, 0x81, 0xBD, 0xDB,
+	 0x05, 0x03, 0x64, 0x47, 0x00, 0x7F, 0xCD, 0x81, 0xBD, 0xDB, 0xF4, 0x02, 0x28, 0x41, 0x1C, 0x60,
+	 0xB2, 0x63, 0xA3, 0xD3, 0xFF, 0xFF, 0x60, 0x45, 0x45, 0x8B, 0x1C, 0x60, 0xAE, 0x61, 0x2B, 0xD3,
+	 0xA1, 0xDB, 0x2C, 0x41, 0x28, 0x42, 0x4A, 0xD3, 0xFF, 0xFF, 0x60, 0x45, 0x45, 0x8C, 0x00, 0x7F,
+	 0x01, 0x7E, 0x40, 0x48, 0x1C, 0x60, 0xB2, 0x61, 0xA1, 0xD3, 0xFF, 0xFF, 0x60, 0x45, 0x00, 0x64,
+	 0xD4, 0x80, 0xFF, 0xFF, 0x43, 0x03, 0x65, 0x44, 0xFF, 0xA4, 0xA1, 0xDB, 0x1C, 0x60, 0xAE, 0x61,
+	 0xA1, 0xD3, 0x28, 0x45, 0xA4, 0x80, 0xFF, 0xFF, 0x07, 0x03, 0x2C, 0xD3, 0x2A, 0xD3, 0x60, 0x45,
+	 0xD4, 0x80, 0xFF, 0xFF, 0x01, 0x03, 0x14, 0x00, 0x28, 0x44, 0xE0, 0x84, 0xFF, 0xFF, 0x02, 0x24,
+	 0x01, 0x00, 0x08, 0x00, 0x2B, 0x44, 0x58, 0x8B, 0x1C, 0x60, 0xAE, 0x63, 0x2B, 0xD3, 0xA3, 0xDB,
+	 0x00, 0x7F, 0x01, 0x7E, 0x40, 0x48, 0x2A, 0x44, 0x58, 0x8A, 0x2C, 0x44, 0x58, 0x8C, 0xD2, 0x01,
+	 0x1C, 0x60, 0xA8, 0x61, 0x00, 0x64, 0xA1, 0xDB, 0x1C, 0x60, 0xAC, 0x61, 0xA1, 0xD3, 0xFF, 0xFF,
+	 0x60, 0x45, 0xFA, 0xA4, 0x60, 0x41, 0xA1, 0xD3, 0xFF, 0xFF, 0x60, 0x41, 0xC5, 0x81, 0x06, 0xA1,
+	 0x41, 0x48, 0x65, 0x41, 0xFC, 0xA1, 0xA1, 0xD3, 0x28, 0x41, 0x60, 0x40, 0x01, 0x26, 0x01, 0xA4,
+	 0x60, 0x45, 0xC5, 0x81, 0x61, 0x43, 0x1C, 0x60, 0xAC, 0x61, 0xA1, 0xDD, 0x1C, 0x60, 0xA8, 0x61,
+	 0xA1, 0xD3, 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x26, 0x0D, 0x00, 0x1C, 0x60, 0xAA, 0x61, 0xA1, 0xD3,
+	 0xFF, 0xFF, 0x01, 0xA4, 0xA1, 0xDB, 0xFF, 0xFF, 0x1A, 0x60, 0x2C, 0x78, 0xFF, 0xFF, 0x19, 0x60,
+	 0xE8, 0x78, 0xFF, 0xFF, 0x19, 0x60, 0xEC, 0x78, 0xFF, 0xFF, 0x00, 0x66, 0x01, 0x60, 0xBA, 0x61,
+	 0x1F, 0x60, 0x08, 0x63, 0xA1, 0xD3, 0x04, 0xA1, 0x20, 0x7F, 0xBD, 0xDB, 0x32, 0x7E, 0x21, 0x7F,
+	 0xBD, 0xDB, 0xA1, 0xD3, 0xFF, 0xFF, 0x22, 0x7F, 0xA3, 0xDB, 0x10, 0x00, 0x01, 0x60, 0xBA, 0x61,
+	 0x1F, 0x60, 0x08, 0x63, 0xA1, 0xD3, 0x00, 0x66, 0x20, 0x7F, 0xBD, 0xDB, 0x59, 0xD3, 0xFF, 0xFF,
+	 0x21, 0x7F, 0xBD, 0xDB, 0x59, 0xD3, 0xFF, 0xFF, 0x22, 0x7F, 0xA3, 0xDB, 0x0F, 0x60, 0xD8, 0x62,
+	 0xA2, 0xD1, 0x9F, 0x60, 0xFF, 0x64, 0xA0, 0x84, 0xA2, 0xDB, 0xDE, 0xFE, 0x0B, 0x04, 0x0F, 0x60,
+	 0xDA, 0x62, 0x40, 0x60, 0x00, 0x64, 0xA2, 0xDB, 0x1A, 0x60, 0xFD, 0x64, 0x5A, 0xDB, 0xCF, 0xFE,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x24, 0x60, 0x9A, 0x62, 0x1F, 0x60, 0x06, 0x64, 0xA2, 0xDB, 0x20, 0x64,
+	 0x4A, 0xDB, 0xFF, 0xFF, 0x2D, 0xFF, 0x0F, 0x60, 0xDA, 0x62, 0x20, 0x60, 0x00, 0x64, 0xA2, 0xDB,
+	 0x1B, 0x60, 0x25, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60, 0xD8, 0x62,
+	 0xA2, 0xD1, 0x9F, 0x60, 0xFF, 0x64, 0xA0, 0x84, 0xA2, 0xDB, 0xBE, 0xFE, 0x0F, 0x60, 0xD0, 0x62,
+	 0xA2, 0xD1, 0x40, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x2E, 0x58, 0xFF, 0xFF,
+	 0x10, 0x60, 0x1E, 0x62, 0x1E, 0x60, 0xF4, 0x64, 0xA2, 0xDB, 0x1A, 0x60, 0x8A, 0x62, 0x00, 0x64,
+	 0xA2, 0xDB, 0x06, 0xA2, 0x10, 0x60, 0x40, 0x64, 0xA2, 0xDB, 0x06, 0x64, 0x5A, 0xDB, 0x5A, 0xDB,
+	 0x1A, 0x60, 0x96, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x06, 0xA2, 0x10, 0x60, 0x44, 0x64, 0xA2, 0xDB,
+	 0x06, 0x64, 0x5A, 0xDB, 0x5A, 0xDB, 0x1A, 0x60, 0xA2, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x06, 0xA2,
+	 0x10, 0x60, 0x48, 0x64, 0xA2, 0xDB, 0x06, 0x64, 0x5A, 0xDB, 0x5A, 0xDB, 0xC0, 0xF1, 0x1A, 0x60,
+	 0xA6, 0x62, 0xA2, 0xD9, 0x10, 0x60, 0x3E, 0x62, 0x20, 0x60, 0x99, 0x64, 0xA2, 0xDB, 0x10, 0x60,
+	 0x42, 0x62, 0x20, 0x60, 0xA3, 0x64, 0xA2, 0xDB, 0x10, 0x60, 0x46, 0x62, 0x20, 0x60, 0xAD, 0x64,
+	 0xA2, 0xDB, 0x00, 0x60, 0x70, 0x61, 0xAE, 0x60, 0x58, 0x4D, 0xC4, 0x78, 0xFF, 0xFF, 0x66, 0x44,
+	 0x63, 0xFB, 0x04, 0x64, 0x03, 0xFA, 0xA9, 0xF3, 0x07, 0xFA, 0x00, 0x64, 0x3E, 0xFA, 0x3F, 0xFA,
+	 0x0F, 0x60, 0xDA, 0x62, 0x00, 0x60, 0x02, 0x64, 0xA2, 0xDB, 0x1B, 0x60, 0x8A, 0x64, 0x5A, 0xDB,
+	 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60, 0xD8, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x03, 0x64,
+	 0x6A, 0xFB, 0x0F, 0x4E, 0xE0, 0x60, 0x58, 0x4F, 0x8E, 0x78, 0xFF, 0xFF, 0x0E, 0x4F, 0x00, 0x64,
+	 0x6C, 0xFB, 0x63, 0xF5, 0xEB, 0xF3, 0x2F, 0xFA, 0xEC, 0xF3, 0x30, 0xFA, 0xED, 0xF3, 0x31, 0xFA,
+	 0x81, 0xF3, 0x2C, 0xFA, 0x32, 0xFA, 0x82, 0xF3, 0x2D, 0xFA, 0x33, 0xFA, 0x83, 0xF3, 0x2E, 0xFA,
+	 0x34, 0xFA, 0xBC, 0xF3, 0x19, 0xFA, 0x06, 0x60, 0x80, 0x64, 0x0E, 0xFA, 0x20, 0x60, 0x58, 0x4E,
+	 0x71, 0x78, 0xFF, 0xFF, 0xF7, 0x60, 0xFF, 0x65, 0x20, 0x44, 0x24, 0x80, 0x0F, 0x60, 0xD0, 0x62,
+	 0xA2, 0xD1, 0x80, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x0F, 0x60, 0xD8, 0x62,
+	 0xA2, 0xD1, 0xFF, 0x60, 0x8F, 0x64, 0xA0, 0x84, 0xA2, 0xDB, 0xC1, 0xF1, 0x1A, 0x60, 0x9A, 0x62,
+	 0xA2, 0xD9, 0x24, 0x60, 0xAA, 0x62, 0x1A, 0x60, 0x96, 0x64, 0xA2, 0xDB, 0x02, 0x64, 0x4A, 0xDB,
+	 0xFF, 0xFF, 0x04, 0xFF, 0x00, 0x64, 0x6C, 0xFB, 0x0F, 0x60, 0xDA, 0x62, 0x00, 0x60, 0x74, 0x64,
+	 0xA2, 0xDB, 0x1B, 0x60, 0xDE, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60,
+	 0xD8, 0x62, 0xA2, 0xD1, 0x00, 0x60, 0x04, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x05, 0x03, 0xA0, 0x84,
+	 0xA2, 0xDB, 0x1E, 0x60, 0xF4, 0x78, 0xFF, 0xFF, 0x00, 0x60, 0x40, 0x64, 0xA0, 0x80, 0x9C, 0x84,
+	 0x03, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0xE0, 0x01, 0x00, 0x60, 0x20, 0x64, 0xA0, 0x80, 0x9C, 0x84,
+	 0x11, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x20, 0x40, 0x50, 0x27, 0xD6, 0x01, 0xAF, 0xF3, 0xFF, 0xFF,
+	 0xFE, 0xA0, 0xFF, 0xFF, 0xD1, 0x06, 0x6C, 0xF3, 0xFF, 0xFF, 0xF6, 0xA0, 0xDC, 0x84, 0x01, 0x05,
+	 0xA2, 0xDB, 0xCA, 0x01, 0x00, 0x60, 0x10, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0xCE, 0x03, 0xA0, 0x84,
+	 0xA2, 0xDB, 0x00, 0x00, 0xE0, 0xF3, 0x29, 0x45, 0xD4, 0x80, 0x6C, 0xF3, 0x03, 0x04, 0x1C, 0x60,
+	 0x55, 0x78, 0xFF, 0xFF, 0xF6, 0xA0, 0xFF, 0xFF, 0x03, 0x04, 0x1C, 0x60, 0x55, 0x78, 0xFF, 0xFF,
+	 0x0F, 0x60, 0xDA, 0x62, 0x00, 0x60, 0x64, 0x64, 0xA2, 0xDB, 0x1C, 0x60, 0x2A, 0x64, 0x5A, 0xDB,
+	 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60, 0xD8, 0x62, 0xA2, 0xD1, 0x00, 0x60, 0x04, 0x64,
+	 0xA0, 0x80, 0x9C, 0x84, 0x05, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x1E, 0x60, 0xF4, 0x78, 0xFF, 0xFF,
+	 0x00, 0x60, 0x40, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x03, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0xD2, 0x01,
+	 0x00, 0x60, 0x20, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0xE4, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x20, 0x40,
+	 0x50, 0x27, 0xDF, 0x01, 0xAF, 0xF3, 0xFF, 0xFF, 0xFE, 0xA0, 0xFF, 0xFF, 0xC3, 0x06, 0x6C, 0xF3,
+	 0xFF, 0xFF, 0xF6, 0xA0, 0xDC, 0x84, 0x01, 0x05, 0xA2, 0xDB, 0xBC, 0x01, 0x0F, 0x60, 0xD8, 0x62,
+	 0x00, 0x64, 0xA2, 0xDB, 0x20, 0x40, 0x40, 0x2B, 0x0B, 0x00, 0x0F, 0x60, 0xDA, 0x62, 0x80, 0x60,
+	 0x00, 0x64, 0xA2, 0xDB, 0x1C, 0x60, 0x55, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x1C, 0x60, 0x92, 0x65, 0x01, 0x64, 0xA5, 0xDB, 0xC2, 0xF1, 0x1A, 0x60, 0x9A, 0x62, 0xA2, 0xD9,
+	 0x0C, 0x64, 0x53, 0xFB, 0x1C, 0x60, 0x77, 0x64, 0x6B, 0xFB, 0x1F, 0x60, 0x72, 0x78, 0xFF, 0xFF,
+	 0x24, 0x60, 0xAA, 0x62, 0x1A, 0x60, 0xA2, 0x64, 0xA2, 0xDB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF,
+	 0x04, 0xFF, 0x0F, 0x60, 0xD8, 0x62, 0xA2, 0xD1, 0xFF, 0x60, 0xDF, 0x64, 0xA0, 0x84, 0xA2, 0xDB,
+	 0x88, 0xF1, 0x19, 0x60, 0x86, 0x63, 0xD3, 0x80, 0x68, 0xFD, 0x5F, 0x03, 0x68, 0xF3, 0xE2, 0xF1,
+	 0x60, 0x43, 0x29, 0x44, 0xA3, 0xD3, 0xC0, 0x85, 0xD4, 0x80, 0x5B, 0xD3, 0x56, 0x06, 0x60, 0x43,
+	 0x08, 0xA3, 0xBE, 0xD3, 0x83, 0xF1, 0xA3, 0xD3, 0xD0, 0x80, 0x82, 0xF1, 0x05, 0x02, 0xBF, 0xD3,
+	 0xD0, 0x80, 0x81, 0xF1, 0x01, 0x02, 0xD0, 0x80, 0xF8, 0xA3, 0x2B, 0x02, 0x1C, 0x60, 0xAB, 0x64,
+	 0x6B, 0xFB, 0x1F, 0x60, 0x29, 0x78, 0xFF, 0xFF, 0x01, 0xB0, 0x84, 0xF3, 0x3E, 0x03, 0x63, 0xF5,
+	 0x48, 0x7E, 0x2A, 0xFA, 0x24, 0x60, 0x74, 0x62, 0x24, 0x60, 0x28, 0x64, 0xA2, 0xDB, 0x66, 0x44,
+	 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xC1, 0xFE, 0x0F, 0x60, 0xDA, 0x62,
+	 0x00, 0x60, 0x01, 0x64, 0xA2, 0xDB, 0x1C, 0x60, 0xC8, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58,
+	 0xFF, 0xFF, 0x0F, 0x60, 0xD8, 0x62, 0xA2, 0xD1, 0xFF, 0x60, 0xFE, 0x64, 0xA0, 0x84, 0xA2, 0xDB,
+	 0x1C, 0x00, 0x2D, 0x60, 0x7A, 0x65, 0xA5, 0xD3, 0x65, 0x41, 0x10, 0xA3, 0x01, 0xA4, 0xFE, 0xB4,
+	 0xC4, 0x85, 0xFE, 0xA1, 0xBD, 0xD3, 0x59, 0xD1, 0xFF, 0xFF, 0xD0, 0x80, 0xD5, 0x80, 0x05, 0x02,
+	 0x01, 0x03, 0xF8, 0x01, 0x1E, 0x60, 0xE8, 0x78, 0xFF, 0xFF, 0x68, 0xF3, 0x88, 0xF1, 0x04, 0xA4,
+	 0xD0, 0x80, 0xFF, 0xFF, 0x02, 0x03, 0x68, 0xFB, 0xA1, 0x01, 0xE0, 0xF3, 0x29, 0x45, 0xD4, 0x80,
+	 0xFF, 0xFF, 0x0C, 0x07, 0x24, 0x60, 0xAA, 0x62, 0x1A, 0x60, 0x96, 0x64, 0xA2, 0xDB, 0x03, 0x64,
+	 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x1B, 0x60, 0xB1, 0x78, 0xFF, 0xFF, 0xE1, 0xF3, 0x29, 0x45,
+	 0xD4, 0x80, 0xFF, 0xFF, 0x17, 0x06, 0x04, 0x65, 0xE9, 0x60, 0x58, 0x4E, 0x7B, 0x78, 0xFF, 0xFF,
+	 0x05, 0x64, 0xDC, 0xFB, 0xF2, 0xF3, 0xFF, 0xFF, 0x01, 0xBC, 0xF2, 0xFB, 0x24, 0x60, 0xAA, 0x62,
+	 0x1A, 0x60, 0x96, 0x64, 0xA2, 0xDB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x1D, 0x60,
+	 0x6D, 0x78, 0xFF, 0xFF, 0x0F, 0x60, 0xDA, 0x62, 0x00, 0x60, 0x74, 0x64, 0xA2, 0xDB, 0x1D, 0x60,
+	 0x24, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60, 0xD8, 0x62, 0xA2, 0xD1,
+	 0x00, 0x60, 0x04, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x05, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x1E, 0x60,
+	 0xF4, 0x78, 0xFF, 0xFF, 0x00, 0x60, 0x40, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x05, 0x03, 0xA0, 0x84,
+	 0xA2, 0xDB, 0x1C, 0x60, 0x87, 0x78, 0xFF, 0xFF, 0x00, 0x60, 0x20, 0x64, 0xA0, 0x80, 0x9C, 0x84,
+	 0x17, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x20, 0x40, 0x50, 0x27, 0xA7, 0x01, 0xAF, 0xF3, 0x6C, 0xF3,
+	 0xFE, 0xA0, 0xF6, 0xA0, 0x0A, 0x06, 0x03, 0x04, 0x00, 0x64, 0x55, 0xFB, 0x40, 0x49, 0x6C, 0xF3,
+	 0xFF, 0xFF, 0xF6, 0xA0, 0xDC, 0x84, 0x01, 0x05, 0xA2, 0xDB, 0x1C, 0x60, 0x87, 0x78, 0xFF, 0xFF,
+	 0x00, 0x60, 0x10, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0xC6, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x24, 0x60,
+	 0xAA, 0x62, 0x1A, 0x60, 0xA2, 0x64, 0xA2, 0xDB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF,
+	 0x1C, 0x60, 0x55, 0x78, 0xFF, 0xFF, 0x1C, 0x60, 0xEC, 0x78, 0xFF, 0xFF, 0x0F, 0x60, 0xD8, 0x62,
+	 0x00, 0x64, 0xA2, 0xDB, 0x20, 0x40, 0x40, 0x2B, 0x0B, 0x00, 0x0F, 0x60, 0xDA, 0x62, 0x80, 0x60,
+	 0x00, 0x64, 0xA2, 0xDB, 0x1D, 0x60, 0x6D, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x1C, 0x60, 0x92, 0x65, 0x00, 0x64, 0xA5, 0xDB, 0xC3, 0xF1, 0x1A, 0x60, 0x9A, 0x62, 0xA2, 0xD9,
+	 0x1F, 0x60, 0x80, 0x64, 0xA0, 0xD3, 0xFF, 0xFF, 0x08, 0xB4, 0x01, 0xBC, 0x29, 0x02, 0xA2, 0xDB,
+	 0x0F, 0x60, 0xD8, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x0F, 0x4E, 0xE4, 0x60, 0x58, 0x4F, 0xFB, 0x78,
+	 0xFF, 0xFF, 0x0E, 0x4F, 0x0F, 0x60, 0xDA, 0x62, 0x10, 0x60, 0x00, 0x64, 0xA2, 0xDB, 0x1D, 0x60,
+	 0xA4, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x1F, 0x60, 0x80, 0x64, 0xA0, 0xD3,
+	 0xFF, 0xFF, 0x60, 0x40, 0x0C, 0x26, 0x0C, 0x00, 0x24, 0x60, 0xAA, 0x62, 0x1A, 0x60, 0x96, 0x64,
+	 0xA2, 0xDB, 0x02, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x1E, 0x60, 0x97, 0x78, 0xFF, 0xFF,
+	 0x01, 0x64, 0x31, 0x60, 0x2A, 0x62, 0xA2, 0xDB, 0x0D, 0x64, 0x53, 0xFB, 0x1D, 0x60, 0xC3, 0x64,
+	 0x6B, 0xFB, 0x1F, 0x60, 0x72, 0x78, 0xFF, 0xFF, 0x24, 0x60, 0xAA, 0x62, 0x1A, 0x60, 0xA2, 0x64,
+	 0xA2, 0xDB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x0F, 0x60, 0xD8, 0x62, 0xA2, 0xD1,
+	 0xFF, 0x60, 0xDF, 0x64, 0xA0, 0x84, 0xA2, 0xDB, 0x88, 0xF1, 0x19, 0x60, 0x86, 0x63, 0xD3, 0x80,
+	 0x68, 0xFD, 0x01, 0x02, 0x43, 0x00, 0x68, 0xF3, 0x29, 0x41, 0xA0, 0xD1, 0x58, 0xD3, 0xD1, 0x80,
+	 0x64, 0x45, 0x60, 0x43, 0x0F, 0x05, 0x08, 0xA3, 0xBE, 0xD3, 0x83, 0xF1, 0xA3, 0xD3, 0xD0, 0x80,
+	 0x82, 0xF1, 0x05, 0x02, 0xBF, 0xD3, 0xD0, 0x80, 0x81, 0xF1, 0x01, 0x02, 0xD0, 0x80, 0xF8, 0xA3,
+	 0x07, 0x02, 0x45, 0x49, 0x1E, 0x60, 0x2A, 0x64, 0x6B, 0xFB, 0x1F, 0x60, 0x29, 0x78, 0xFF, 0xFF,
+	 0x2D, 0x60, 0x7A, 0x65, 0xA5, 0xD3, 0x65, 0x41, 0x10, 0xA3, 0x01, 0xA4, 0xFE, 0xB4, 0xC4, 0x85,
+	 0xFE, 0xA1, 0xBD, 0xD3, 0x59, 0xD1, 0xFF, 0xFF, 0xD0, 0x80, 0xD5, 0x80, 0x0F, 0x02, 0xF9, 0x02,
+	 0x05, 0x65, 0xE9, 0x60, 0x58, 0x4E, 0x7B, 0x78, 0xFF, 0xFF, 0x04, 0x64, 0xDC, 0xFB, 0xF2, 0xF3,
+	 0xFF, 0xFF, 0xFE, 0xB4, 0xF2, 0xFB, 0x1E, 0x60, 0xE8, 0x78, 0xFF, 0xFF, 0x68, 0xF3, 0x88, 0xF1,
+	 0x04, 0xA4, 0xD0, 0x80, 0xFF, 0xFF, 0x02, 0x03, 0x68, 0xFB, 0xBD, 0x01, 0xE1, 0xF3, 0x29, 0x45,
+	 0xD4, 0x80, 0xFF, 0xFF, 0x75, 0x05, 0x1E, 0x60, 0x2A, 0x63, 0x6B, 0xFD, 0x1A, 0x60, 0x4C, 0x63,
+	 0x1F, 0x60, 0x29, 0x78, 0xFF, 0xFF, 0x24, 0x60, 0xAA, 0x62, 0x1A, 0x60, 0x96, 0x64, 0xA2, 0xDB,
+	 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x05, 0x65, 0xE9, 0x60, 0x58, 0x4E, 0x7B, 0x78,
+	 0xFF, 0xFF, 0x1F, 0x60, 0x52, 0x61, 0x00, 0x64, 0xA1, 0xDB, 0x04, 0x64, 0xDC, 0xFB, 0xF2, 0xF3,
+	 0xFF, 0xFF, 0xFE, 0xB4, 0xF2, 0xFB, 0x84, 0xF3, 0x63, 0xF5, 0x48, 0x7E, 0x2A, 0xFA, 0x02, 0x60,
+	 0x00, 0x65, 0x20, 0x44, 0x34, 0x80, 0x24, 0x60, 0x74, 0x62, 0x24, 0x60, 0x28, 0x64, 0xA2, 0xDB,
+	 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xC1, 0xFE, 0x0F, 0x60,
+	 0xDA, 0x62, 0x00, 0x60, 0x01, 0x64, 0xA2, 0xDB, 0x1E, 0x60, 0x61, 0x64, 0x5A, 0xDB, 0xCF, 0xFE,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60, 0xD8, 0x62, 0xA2, 0xD1, 0xFF, 0x60, 0xFE, 0x64, 0xA0, 0x84,
+	 0xA2, 0xDB, 0x1A, 0x60, 0x9A, 0x62, 0x00, 0x60, 0x32, 0x64, 0xA2, 0xDB, 0x24, 0x60, 0xAA, 0x62,
+	 0x1A, 0x60, 0x96, 0x64, 0xA2, 0xDB, 0x02, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x0F, 0x60,
+	 0xDA, 0x62, 0x00, 0x60, 0x10, 0x64, 0xA2, 0xDB, 0x1E, 0x60, 0x81, 0x64, 0x5A, 0xDB, 0xCF, 0xFE,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60, 0xD8, 0x62, 0xA2, 0xD1, 0xFF, 0x60, 0xEF, 0x64, 0xA0, 0x84,
+	 0xA2, 0xDB, 0xFD, 0x60, 0xFF, 0x65, 0x20, 0x44, 0x24, 0x80, 0x0F, 0x60, 0xD0, 0x62, 0xA2, 0xD1,
+	 0x80, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x1B, 0x60, 0xB1, 0x78, 0xFF, 0xFF,
+	 0x0F, 0x60, 0xDA, 0x62, 0x00, 0x60, 0x74, 0x64, 0xA2, 0xDB, 0x1E, 0x60, 0xA2, 0x64, 0x5A, 0xDB,
+	 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60, 0xD8, 0x62, 0xA2, 0xD1, 0x00, 0x60, 0x04, 0x64,
+	 0xA0, 0x80, 0x9C, 0x84, 0x05, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x1E, 0x60, 0xF4, 0x78, 0xFF, 0xFF,
+	 0x00, 0x60, 0x40, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x05, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x1D, 0x60,
+	 0xD3, 0x78, 0xFF, 0xFF, 0x00, 0x60, 0x20, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x17, 0x03, 0xA0, 0x84,
+	 0xA2, 0xDB, 0x20, 0x40, 0x50, 0x27, 0xDD, 0x01, 0xAF, 0xF3, 0x6C, 0xF3, 0xFE, 0xA0, 0xF6, 0xA0,
+	 0x0A, 0x06, 0x03, 0x04, 0x00, 0x64, 0x55, 0xFB, 0x40, 0x49, 0x6C, 0xF3, 0xFF, 0xFF, 0xF6, 0xA0,
+	 0xDC, 0x84, 0x01, 0x05, 0xA2, 0xDB, 0x1D, 0x60, 0xD3, 0x78, 0xFF, 0xFF, 0x00, 0x60, 0x10, 0x64,
+	 0xA0, 0x80, 0x9C, 0x84, 0xC6, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x24, 0x60, 0xAA, 0x62, 0x1A, 0x60,
+	 0xA2, 0x64, 0xA2, 0xDB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x1D, 0x60, 0x6D, 0x78,
+	 0xFF, 0xFF, 0x08, 0x60, 0x00, 0x65, 0x20, 0x44, 0x34, 0x80, 0x0F, 0x60, 0xEA, 0x62, 0xA2, 0xD1,
+	 0x00, 0x60, 0x20, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x24, 0x60, 0xAA, 0x62, 0x1A, 0x60,
+	 0x8A, 0x64, 0xA2, 0xDB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x24, 0x60, 0xAA, 0x62,
+	 0x1A, 0x60, 0x96, 0x64, 0xA2, 0xDB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x24, 0x60,
+	 0xAA, 0x62, 0x1A, 0x60, 0xA2, 0x64, 0xA2, 0xDB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF,
+	 0x0F, 0x60, 0xD8, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x5A, 0xDB, 0x00, 0x64, 0x6A, 0xFB, 0x0F, 0x60,
+	 0xD0, 0x62, 0xA2, 0xD1, 0x02, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x0F, 0x60,
+	 0xDA, 0x62, 0x00, 0x60, 0x02, 0x64, 0xA2, 0xDB, 0x1B, 0x60, 0x8A, 0x64, 0x5A, 0xDB, 0xCF, 0xFE,
+	 0x2F, 0x58, 0xFF, 0xFF, 0xA3, 0xD3, 0x7F, 0xF1, 0x7E, 0xFB, 0xD0, 0x80, 0x00, 0x64, 0x40, 0x03,
+	 0x0F, 0x60, 0xD8, 0x62, 0xA2, 0xD1, 0xBF, 0x60, 0xFF, 0x64, 0xA0, 0x84, 0xA2, 0xDB, 0xDE, 0xFE,
+	 0x0B, 0x04, 0x0F, 0x60, 0xDA, 0x62, 0x40, 0x60, 0x00, 0x64, 0xA2, 0xDB, 0x1F, 0x60, 0x2F, 0x64,
+	 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60, 0xD8, 0x62, 0xA2, 0xD1, 0xDF, 0x60,
+	 0xFF, 0x64, 0xA0, 0x84, 0xA2, 0xDB, 0x7E, 0xF1, 0x7F, 0xF9, 0x24, 0x60, 0x9A, 0x62, 0xA2, 0xD9,
+	 0x1E, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x2D, 0xFF, 0x0F, 0x60, 0xDA, 0x62, 0x20, 0x60, 0x00, 0x64,
+	 0xA2, 0xDB, 0x1F, 0x60, 0x5E, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0xBE, 0xFE,
+	 0x0F, 0x60, 0xD8, 0x62, 0xA2, 0xD1, 0xDF, 0x60, 0xFF, 0x64, 0xA0, 0x84, 0xA2, 0xDB, 0x0F, 0x60,
+	 0xD0, 0x62, 0xA2, 0xD1, 0x40, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x01, 0x64,
+	 0x6B, 0xF7, 0xFF, 0xFF, 0xFF, 0xFF, 0x02, 0x60, 0x00, 0x65, 0x20, 0x44, 0x34, 0x80, 0x0F, 0x60,
+	 0xD8, 0x62, 0xA2, 0xD1, 0x7F, 0x60, 0xFF, 0x64, 0xA0, 0x84, 0xA2, 0xDB, 0x20, 0x40, 0x51, 0x23,
+	 0x0B, 0x00, 0x0F, 0x60, 0xDA, 0x62, 0x80, 0x60, 0x00, 0x64, 0xA2, 0xDB, 0x1F, 0x60, 0x76, 0x64,
+	 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60, 0xD8, 0x62, 0xA2, 0xD1, 0x7F, 0x60,
+	 0xFF, 0x61, 0xA1, 0x84, 0x5A, 0xD1, 0x4A, 0xDB, 0xA1, 0x84, 0x5A, 0xDB, 0x40, 0x60, 0x00, 0x65,
+	 0x20, 0x44, 0x34, 0x80, 0x02, 0x64, 0x8C, 0xFB, 0xFF, 0xFF, 0xC1, 0xFE, 0x8C, 0xF3, 0x00, 0x65,
+	 0xD4, 0x80, 0xFF, 0xFF, 0x12, 0x03, 0x0F, 0x60, 0xD8, 0x62, 0xA2, 0xD1, 0x7F, 0x60, 0xFF, 0x64,
+	 0xA0, 0x84, 0xA2, 0xDB, 0x0F, 0x60, 0xDA, 0x62, 0x80, 0x60, 0x00, 0x64, 0xA2, 0xDB, 0x1F, 0x60,
+	 0x99, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x2D, 0x60, 0x7A, 0x64, 0x54, 0xFB,
+	 0x0F, 0x60, 0xD8, 0x62, 0xA2, 0xD1, 0xEF, 0x60, 0xFF, 0x64, 0xA0, 0x84, 0xA2, 0xDB, 0x1A, 0x60,
+	 0x58, 0x4E, 0xDC, 0x78, 0xFF, 0xFF, 0x0F, 0x4E, 0xEC, 0x60, 0x58, 0x4F, 0xB9, 0x78, 0xFF, 0xFF,
+	 0x0E, 0x4F, 0x0F, 0x60, 0xDA, 0x62, 0x10, 0x60, 0x00, 0x64, 0xA2, 0xDB, 0x1F, 0x60, 0xD3, 0x64,
+	 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x1A, 0x60, 0x58, 0x4E, 0xED, 0x78, 0xFF, 0xFF,
+	 0x24, 0x60, 0xAA, 0x62, 0x1A, 0x60, 0x96, 0x64, 0xA2, 0xDB, 0x02, 0x64, 0x4A, 0xDB, 0xFF, 0xFF,
+	 0x04, 0xFF, 0x0F, 0x60, 0xD8, 0x62, 0xA2, 0xD1, 0xEF, 0x60, 0xEF, 0x64, 0xA0, 0x84, 0xA2, 0xDB,
+	 0x01, 0x64, 0x8C, 0xFB, 0xBF, 0x60, 0xFF, 0x65, 0x20, 0x44, 0x24, 0x80, 0x01, 0x60, 0x14, 0x62,
+	 0xA2, 0xD1, 0x12, 0x60, 0x46, 0x63, 0xC3, 0x85, 0xC6, 0xA3, 0x3A, 0xA3, 0xD7, 0x80, 0xAF, 0xF3,
+	 0x09, 0x04, 0xFE, 0xA0, 0x6C, 0xF3, 0x3A, 0x06, 0xF6, 0xA0, 0x00, 0x64, 0x37, 0x04, 0x55, 0xFB,
+	 0x40, 0x49, 0x34, 0x00, 0x08, 0xA3, 0xBE, 0xD3, 0x83, 0xF1, 0xA3, 0xD3, 0xD0, 0x80, 0x82, 0xF1,
+	 0x05, 0x02, 0xBF, 0xD3, 0xD0, 0x80, 0x81, 0xF1, 0x01, 0x02, 0xD0, 0x80, 0xF8, 0xA3, 0xE5, 0x02,
+	 0xBE, 0xD3, 0x5A, 0xD1, 0x60, 0x47, 0x40, 0x4A, 0x64, 0x47, 0x40, 0x48, 0x20, 0x60, 0x58, 0x4E,
+	 0x45, 0x78, 0xFF, 0xFF, 0x0A, 0x48, 0x20, 0x60, 0x58, 0x4E, 0x55, 0x78, 0xFF, 0xFF, 0x20, 0x60,
+	 0x58, 0x4E, 0x71, 0x78, 0xFF, 0xFF, 0x01, 0x60, 0x2E, 0x65, 0x6C, 0xF3, 0xA5, 0xD3, 0xF6, 0xA0,
+	 0x40, 0xBC, 0x06, 0x04, 0xA5, 0xDB, 0x6A, 0xF1, 0xFF, 0x60, 0xFB, 0x64, 0xA0, 0x84, 0x6A, 0xFB,
+	 0x6C, 0xF3, 0xFF, 0xFF, 0x00, 0xB8, 0xCC, 0x84, 0x01, 0x03, 0xA2, 0xDB, 0xFD, 0x60, 0xFF, 0x65,
+	 0x20, 0x44, 0x24, 0x80, 0x0F, 0x60, 0xD0, 0x62, 0xA2, 0xD1, 0x80, 0x60, 0x00, 0x64, 0xB0, 0x84,
+	 0xA2, 0xDB, 0xCF, 0xFE, 0xC1, 0xFE, 0x6B, 0xF7, 0xFF, 0xFF, 0xFF, 0xFF, 0x55, 0xF1, 0x28, 0x44,
+	 0xD0, 0x84, 0x03, 0xA4, 0x03, 0x0E, 0xE8, 0x84, 0xE8, 0x84, 0x04, 0x00, 0xFA, 0xA4, 0xE8, 0x84,
+	 0xE8, 0x87, 0xC0, 0xBF, 0xC0, 0x84, 0xA2, 0xDB, 0x2E, 0x58, 0xFF, 0xFF, 0x56, 0xF1, 0x28, 0x44,
+	 0xD0, 0x84, 0x1F, 0xA4, 0x06, 0x0E, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84,
+	 0x07, 0x00, 0xC2, 0xA4, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x87, 0xF8, 0xBF,
+	 0xC0, 0x84, 0x5C, 0xF1, 0x56, 0xFB, 0xD0, 0x80, 0xFF, 0xFF, 0x01, 0x05, 0x64, 0x44, 0x52, 0xFB,
+	 0x2E, 0x58, 0xFF, 0xFF, 0x52, 0xF1, 0x00, 0x65, 0x20, 0x40, 0x20, 0x2A, 0x06, 0x00, 0x5C, 0xF3,
+	 0xFF, 0xFF, 0xD0, 0x80, 0x64, 0x45, 0x01, 0x06, 0x60, 0x45, 0x2F, 0x67, 0xD4, 0x80, 0xFF, 0xFF,
+	 0x01, 0x06, 0x60, 0x45, 0x55, 0xF1, 0x8B, 0x67, 0xD0, 0x80, 0x60, 0x41, 0x02, 0x24, 0x64, 0x41,
+	 0xD5, 0x84, 0x80, 0x65, 0xC4, 0x87, 0x01, 0x05, 0x00, 0x64, 0xFF, 0xB4, 0x40, 0x49, 0x20, 0x40,
+	 0x20, 0x2A, 0x06, 0x00, 0x2E, 0x43, 0xF3, 0x60, 0x58, 0x4E, 0xA8, 0x78, 0xFF, 0xFF, 0x43, 0x4E,
+	 0x2E, 0x58, 0xFF, 0xFF, 0x0F, 0x60, 0xD8, 0x62, 0xA2, 0xD1, 0x00, 0x60, 0x08, 0x64, 0xB0, 0x84,
+	 0xA2, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60, 0xD8, 0x62, 0xA2, 0xD1, 0x00, 0x60,
+	 0x10, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60, 0xD8, 0x62,
+	 0xA2, 0xD1, 0x00, 0x60, 0x20, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x0F, 0x60, 0xF6, 0x62,
+	 0xA2, 0xD1, 0x00, 0x60, 0x40, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x26, 0x46, 0x27, 0xF2, 0x70, 0x63, 0x60, 0x40, 0x0A, 0x36, 0x06, 0x00, 0x14, 0x36, 0x0A, 0x00,
+	 0x37, 0x36, 0x04, 0x00, 0x6E, 0x36, 0x04, 0x00, 0xD0, 0x63, 0x04, 0x00, 0x33, 0x63, 0x02, 0x00,
+	 0x21, 0x63, 0x00, 0x00, 0x1F, 0x60, 0x5A, 0x61, 0xA1, 0xDD, 0x26, 0x46, 0xBF, 0xF2, 0x01, 0x60,
+	 0x00, 0x65, 0xF4, 0xA1, 0xD5, 0x80, 0x00, 0xF4, 0x02, 0x24, 0x65, 0x41, 0x41, 0x48, 0x1E, 0x65,
+	 0x02, 0x60, 0x00, 0x63, 0xA5, 0xD0, 0xDA, 0x85, 0x80, 0x3A, 0x02, 0x00, 0x00, 0xF4, 0x04, 0x65,
+	 0x64, 0x44, 0x00, 0x7F, 0xCD, 0x81, 0xBD, 0xDB, 0x05, 0x03, 0x64, 0x47, 0x00, 0x7F, 0xCD, 0x81,
+	 0xBD, 0xDB, 0xF0, 0x02, 0x02, 0x60, 0x00, 0x63, 0x28, 0x41, 0xBD, 0xD3, 0xBD, 0xD1, 0xFD, 0xA0,
+	 0xFF, 0xFF, 0x07, 0x03, 0x64, 0x44, 0xE0, 0x85, 0xD1, 0x81, 0xFE, 0xA1, 0xC7, 0x83, 0xF5, 0x0D,
+	 0x04, 0x00, 0x1A, 0x60, 0x4C, 0x61, 0xA3, 0xD3, 0xA1, 0xDB, 0x31, 0x40, 0x06, 0x26, 0x58, 0x00,
+	 0x00, 0x64, 0x70, 0xFB, 0x02, 0x60, 0x00, 0x63, 0x28, 0x41, 0xBD, 0xD3, 0xBD, 0xD1, 0xFC, 0xA0,
+	 0xFB, 0xA0, 0x08, 0x03, 0x28, 0x03, 0x64, 0x44, 0xE0, 0x85, 0xD1, 0x81, 0xFE, 0xA1, 0xC7, 0x83,
+	 0xF4, 0x0D, 0x46, 0x00, 0xBD, 0xD3, 0xBD, 0xD3, 0x00, 0xB8, 0x70, 0xFB, 0x6F, 0xFB, 0xBD, 0xD3,
+	 0x3F, 0x02, 0xA3, 0xD3, 0x60, 0x45, 0x60, 0x47, 0xB4, 0x84, 0x60, 0x41, 0x3F, 0xB5, 0xE8, 0x84,
+	 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0x72, 0xFB, 0x65, 0x47, 0xE0, 0x84,
+	 0xE0, 0x84, 0x71, 0xFB, 0x64, 0x44, 0xE0, 0x85, 0xFA, 0xA3, 0xC7, 0x83, 0x1A, 0x60, 0x44, 0x62,
+	 0x61, 0x44, 0xA2, 0xDB, 0xD2, 0x01, 0xBD, 0xD3, 0xA3, 0xD3, 0x00, 0xB8, 0x6E, 0xFB, 0x74, 0xFB,
+	 0x1F, 0x02, 0x87, 0xF1, 0x70, 0xF3, 0x6D, 0xF9, 0x04, 0x65, 0x60, 0x40, 0x00, 0x3A, 0x06, 0x65,
+	 0x31, 0x44, 0xB4, 0x84, 0x40, 0x51, 0x02, 0x2A, 0x0B, 0x00, 0x08, 0xBC, 0x40, 0x51, 0x72, 0xF3,
+	 0x71, 0xF1, 0x00, 0xB8, 0x64, 0x45, 0x01, 0x03, 0x67, 0x45, 0x65, 0x50, 0xCC, 0x84, 0x73, 0xFB,
+	 0x0F, 0x60, 0xEA, 0x62, 0xA2, 0xD1, 0x01, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE,
+	 0x0F, 0x60, 0xEC, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0x60, 0x40, 0x80, 0x2A, 0x84, 0x00, 0x1F, 0x60,
+	 0x52, 0x61, 0x01, 0x64, 0xA1, 0xDB, 0x22, 0x60, 0x58, 0x4E, 0x3E, 0x78, 0xFF, 0xFF, 0x26, 0x46,
+	 0x00, 0xF4, 0x0D, 0xF2, 0x80, 0xFB, 0x00, 0x64, 0x86, 0xFB, 0x0F, 0x60, 0xEA, 0x62, 0xA2, 0xD1,
+	 0x00, 0x60, 0x80, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x26, 0x46, 0x3F, 0xF2, 0x00, 0xF4,
+	 0x1E, 0x65, 0xF4, 0xA4, 0xD4, 0xA0, 0x60, 0x41, 0x01, 0x06, 0x2C, 0x61, 0x41, 0x48, 0x02, 0x60,
+	 0x00, 0x63, 0xA5, 0xD0, 0xDA, 0x85, 0x80, 0x3A, 0x02, 0x00, 0x00, 0xF4, 0x04, 0x65, 0x64, 0x44,
+	 0x00, 0x7F, 0xCD, 0x81, 0xBD, 0xDB, 0x05, 0x03, 0x64, 0x47, 0x00, 0x7F, 0xCD, 0x81, 0xBD, 0xDB,
+	 0xF0, 0x02, 0x02, 0x60, 0x00, 0x63, 0x28, 0x41, 0xBD, 0xD3, 0xBD, 0xD1, 0x01, 0xA8, 0xC9, 0x81,
+	 0x06, 0x03, 0x64, 0x44, 0xD1, 0x81, 0xE0, 0x85, 0x42, 0x06, 0xC7, 0x83, 0xF5, 0x01, 0x43, 0x48,
+	 0x2D, 0x60, 0x2A, 0x63, 0x43, 0x4A, 0x64, 0x41, 0x28, 0x43, 0x00, 0x65, 0x45, 0x4C, 0x65, 0x5C,
+	 0xBD, 0xD3, 0x61, 0x40, 0x00, 0x36, 0x27, 0x00, 0xCD, 0x81, 0x60, 0x40, 0x02, 0x36, 0x60, 0x45,
+	 0x04, 0x36, 0x60, 0x45, 0x82, 0x36, 0x60, 0x45, 0x84, 0x36, 0x60, 0x45, 0x0B, 0x36, 0x60, 0x45,
+	 0x8B, 0x36, 0x60, 0x45, 0x16, 0x36, 0x60, 0x45, 0x96, 0x36, 0x60, 0x45, 0x65, 0x40, 0x00, 0x36,
+	 0xE7, 0x01, 0x64, 0x44, 0xDC, 0x9C, 0x2C, 0x44, 0x00, 0x3A, 0x02, 0x00, 0x45, 0x4C, 0xE0, 0x01,
+	 0x2C, 0x5E, 0x65, 0x5F, 0x00, 0x65, 0x45, 0x4C, 0x43, 0x48, 0x2A, 0x43, 0xBD, 0xDB, 0xFF, 0xFF,
+	 0x43, 0x4A, 0x28, 0x43, 0xD5, 0x01, 0x2D, 0x60, 0x28, 0x64, 0x60, 0xFE, 0xA0, 0xD9, 0xFF, 0xFF,
+	 0x20, 0xFE, 0x64, 0x40, 0x01, 0x3A, 0x39, 0x00, 0x2A, 0x43, 0x65, 0x44, 0xA3, 0xDB, 0x35, 0x00,
+	 0x23, 0x60, 0x34, 0x78, 0xFF, 0xFF, 0xDC, 0xF3, 0xFF, 0xFF, 0x03, 0xA8, 0x02, 0xA8, 0x02, 0x03,
+	 0x41, 0x02, 0xF6, 0x01, 0x0F, 0x60, 0xEA, 0x62, 0xA2, 0xD1, 0xFF, 0x60, 0xFB, 0x64, 0xA0, 0x84,
+	 0xA2, 0xDB, 0x24, 0x60, 0xAA, 0x62, 0x1A, 0x60, 0x66, 0x64, 0xA2, 0xDB, 0x02, 0x64, 0x4A, 0xDB,
+	 0xFF, 0xFF, 0x04, 0xFF, 0x26, 0x46, 0x1F, 0x60, 0x5A, 0x61, 0xA1, 0xD3, 0x25, 0xF2, 0x60, 0x45,
+	 0x24, 0xF0, 0x00, 0xF4, 0x64, 0x43, 0xC7, 0x83, 0x60, 0x41, 0x02, 0x24, 0x01, 0xA1, 0x0A, 0xF0,
+	 0x09, 0xF2, 0xD1, 0x80, 0xFF, 0xFF, 0x09, 0x07, 0x04, 0x04, 0x63, 0x45, 0xD4, 0x80, 0xFF, 0xFF,
+	 0x04, 0x06, 0x22, 0x60, 0x58, 0x4E, 0x3E, 0x78, 0xFF, 0xFF, 0x26, 0x46, 0x26, 0xF0, 0xFF, 0x67,
+	 0x20, 0x88, 0x64, 0x5F, 0x40, 0x4A, 0x20, 0x60, 0x58, 0x4E, 0x45, 0x78, 0xFF, 0xFF, 0x0A, 0x48,
+	 0x20, 0x60, 0x58, 0x4E, 0x55, 0x78, 0xFF, 0xFF, 0x20, 0x60, 0x58, 0x4E, 0x71, 0x78, 0xFF, 0xFF,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60, 0xDA, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0x60, 0x40, 0x40, 0x22,
+	 0xAF, 0x01, 0x01, 0x60, 0x2E, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0xBF, 0xB4, 0xA2, 0xDB, 0x1F, 0x60,
+	 0x5A, 0x61, 0xA1, 0xD3, 0x26, 0x46, 0x60, 0x45, 0x1E, 0x60, 0xFE, 0x63, 0x00, 0xF4, 0x09, 0xF2,
+	 0xBD, 0xDB, 0xFF, 0xFF, 0x0A, 0xF2, 0xBD, 0xDB, 0x0B, 0xF2, 0xFF, 0xFF, 0xBD, 0xDB, 0x0C, 0xF2,
+	 0xA3, 0xDB, 0xFA, 0xA3, 0x26, 0x46, 0xA3, 0xD3, 0x24, 0xF0, 0x00, 0x61, 0xD0, 0x84, 0xF1, 0x81,
+	 0xD4, 0x84, 0xF1, 0x81, 0xBD, 0xDB, 0xA3, 0xD3, 0x03, 0xB1, 0x03, 0xA9, 0x25, 0xF0, 0x42, 0xFE,
+	 0x05, 0x03, 0xFD, 0xA1, 0xCC, 0x84, 0x01, 0x02, 0xCC, 0x84, 0x00, 0x61, 0xF1, 0x81, 0xD0, 0x84,
+	 0xF1, 0x81, 0xBD, 0xDB, 0xA3, 0xD3, 0x03, 0xB1, 0x03, 0xA9, 0x28, 0xF0, 0x42, 0xFE, 0x01, 0x03,
+	 0xCC, 0x84, 0xF1, 0x81, 0xD0, 0x84, 0xF1, 0x81, 0xBD, 0xDB, 0xA3, 0xD3, 0x03, 0xB1, 0x03, 0xA9,
+	 0x29, 0xF0, 0x01, 0x03, 0xCC, 0x84, 0xD0, 0x84, 0xA3, 0xDB, 0x1F, 0x60, 0x52, 0x61, 0xA1, 0xD3,
+	 0xFF, 0xFF, 0x02, 0xA8, 0xFF, 0xFF, 0x02, 0x02, 0x2E, 0x58, 0xFF, 0xFF, 0xF5, 0xFE, 0x1E, 0x60,
+	 0xFE, 0x64, 0xA0, 0xD1, 0x06, 0xA4, 0xA0, 0xD3, 0x64, 0x45, 0x60, 0x40, 0x80, 0x2B, 0x03, 0x00,
+	 0xFF, 0x60, 0xFF, 0x64, 0x94, 0x85, 0x00, 0x60, 0x96, 0x64, 0xD4, 0x80, 0xFF, 0xFF, 0x0B, 0x06,
+	 0x1F, 0x60, 0x52, 0x61, 0xA1, 0xD3, 0x6A, 0xF3, 0x00, 0xA8, 0x04, 0xB0, 0x04, 0x02, 0x03, 0x03,
+	 0x23, 0x60, 0x10, 0x78, 0xFF, 0xFF, 0x26, 0x46, 0x00, 0xF4, 0x09, 0xF2, 0x5A, 0xD2, 0x40, 0x48,
+	 0x40, 0x4A, 0x5A, 0xD2, 0x5A, 0xD2, 0x40, 0x4C, 0x60, 0x41, 0x5A, 0xD0, 0x80, 0xF9, 0x40, 0x63,
+	 0xAD, 0x80, 0xF0, 0xA3, 0x09, 0x02, 0x3C, 0x03, 0x2C, 0x41, 0x2A, 0x44, 0x40, 0x4C, 0x28, 0x44,
+	 0x40, 0x4A, 0x00, 0x64, 0x40, 0x48, 0xF4, 0x01, 0xD1, 0x80, 0x01, 0x02, 0x31, 0x04, 0x10, 0xA3,
+	 0x80, 0x60, 0x00, 0x65, 0xA5, 0x80, 0xCF, 0x83, 0x08, 0x02, 0x28, 0x44, 0x60, 0x88, 0x2A, 0x44,
+	 0x70, 0x8A, 0x2C, 0x44, 0x70, 0x8C, 0xF1, 0x81, 0xF5, 0x01, 0xE7, 0xA3, 0x64, 0x44, 0x00, 0xA8,
+	 0x00, 0x62, 0x02, 0x02, 0x00, 0x61, 0x1C, 0x00, 0xE0, 0x84, 0xDE, 0x82, 0xFD, 0x04, 0x42, 0xFE,
+	 0xF8, 0x84, 0x62, 0x45, 0xC7, 0x83, 0x60, 0x45, 0x02, 0xFE, 0xD5, 0x84, 0x02, 0x05, 0x01, 0x05,
+	 0x61, 0x44, 0xCF, 0x83, 0x60, 0x41, 0x08, 0x03, 0x28, 0x44, 0x60, 0x88, 0x2A, 0x44, 0x70, 0x8A,
+	 0x2C, 0x44, 0x70, 0x8C, 0xF1, 0x81, 0xF1, 0x01, 0xCE, 0x82, 0xE9, 0x81, 0xFD, 0x02, 0xF1, 0x81,
+	 0x09, 0xF2, 0xFF, 0xFF, 0x60, 0x47, 0xE8, 0x84, 0xE8, 0x84, 0x5A, 0xD2, 0x3F, 0xB5, 0xE0, 0x84,
+	 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xB4, 0x84, 0x61, 0x45, 0xD4, 0x84,
+	 0xC0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x93, 0x1F, 0x60, 0x52, 0x61, 0xA1, 0xD3,
+	 0xFF, 0xFF, 0x00, 0xA8, 0xFF, 0xFF, 0x02, 0x03, 0x2E, 0x58, 0xFF, 0xFF, 0x10, 0x65, 0x73, 0x44,
+	 0xD4, 0x93, 0x6A, 0xF3, 0x26, 0x46, 0x04, 0xBC, 0xA2, 0xDB, 0x26, 0xF0, 0xFF, 0x67, 0x20, 0x88,
+	 0x64, 0x5F, 0x40, 0x4A, 0x20, 0x60, 0x58, 0x4E, 0x45, 0x78, 0xFF, 0xFF, 0x0A, 0x48, 0x20, 0x60,
+	 0x58, 0x4E, 0x55, 0x78, 0xFF, 0xFF, 0x20, 0x60, 0x58, 0x4E, 0x71, 0x78, 0xFF, 0xFF, 0x6C, 0xF3,
+	 0xFF, 0xFF, 0x00, 0xB8, 0xCC, 0x84, 0x01, 0x03, 0xA2, 0xDB, 0x0F, 0x60, 0xD8, 0x62, 0xA2, 0xD1,
+	 0x00, 0x60, 0x40, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x24, 0x60, 0xAA, 0x62, 0x1A, 0x60,
+	 0xA2, 0x64, 0xA2, 0xDB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x0F, 0x60, 0xD8, 0x62,
+	 0xA2, 0xD1, 0xFF, 0x60, 0xDF, 0x64, 0xA0, 0x84, 0xA2, 0xDB, 0x26, 0x46, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x28, 0xF3, 0xFF, 0xFF, 0x60, 0x47, 0x0F, 0xB4, 0x59, 0x00, 0xFF, 0x67, 0x23, 0x58, 0xFF, 0xFF,
+	 0x24, 0x60, 0x9E, 0x65, 0x04, 0x64, 0xA5, 0xDB, 0x12, 0x00, 0x24, 0x60, 0x9E, 0x65, 0x0C, 0x64,
+	 0xA5, 0xDB, 0x0D, 0x00, 0x24, 0x60, 0x9E, 0x65, 0x06, 0x64, 0xA5, 0xDB, 0xFF, 0xFF, 0x2D, 0xFF,
+	 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x24, 0x60, 0x9E, 0x65, 0x08, 0x64, 0xA5, 0xDB, 0x23, 0x60,
+	 0xA1, 0x64, 0xA1, 0xFB, 0xFF, 0xFF, 0x2D, 0xFF, 0x25, 0x60, 0x11, 0x78, 0xFF, 0xFF, 0x29, 0xF3,
+	 0x7F, 0xFB, 0xA4, 0xFB, 0x02, 0x60, 0xEE, 0x64, 0xA3, 0xFB, 0x07, 0x64, 0xA5, 0xFB, 0x23, 0x60,
+	 0xA1, 0x64, 0xA1, 0xFB, 0xFF, 0xFF, 0xDF, 0xFE, 0x00, 0x64, 0x19, 0xFF, 0x25, 0x60, 0x11, 0x78,
+	 0xFF, 0xFF, 0x24, 0x60, 0x0D, 0x63, 0x0C, 0x60, 0x16, 0x64, 0xA0, 0xDD, 0x62, 0xFF, 0x23, 0x60,
+	 0x8E, 0x63, 0xA1, 0xFD, 0xFF, 0xFF, 0x1A, 0xFF, 0x25, 0x60, 0x11, 0x78, 0xFF, 0xFF, 0xA3, 0x60,
+	 0x4B, 0x63, 0x0C, 0x60, 0x16, 0x64, 0xA0, 0xDD, 0x62, 0xFF, 0x29, 0xF5, 0x24, 0x60, 0x7A, 0x63,
+	 0x24, 0x60, 0x4C, 0x64, 0xBD, 0xDB, 0x66, 0x44, 0xBD, 0xDB, 0x02, 0x64, 0xA3, 0xDB, 0xFF, 0xFF,
+	 0x2B, 0xFF, 0xF9, 0xFE, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0xA7, 0x01, 0x00, 0x36, 0xA8, 0x01,
+	 0x01, 0x36, 0xAB, 0x01, 0x02, 0x36, 0xAE, 0x01, 0x03, 0x36, 0xB5, 0x01, 0x04, 0x36, 0xD1, 0x01,
+	 0x05, 0x36, 0xCF, 0x01, 0x06, 0x36, 0xF1, 0x01, 0x07, 0x36, 0xCB, 0x01, 0x08, 0x36, 0xB7, 0x01,
+	 0x09, 0x36, 0x0C, 0x00, 0x0A, 0x36, 0x0D, 0x00, 0x0B, 0x36, 0x0E, 0x00, 0x0C, 0x36, 0x17, 0x00,
+	 0x0D, 0x36, 0x0D, 0x00, 0x0E, 0x36, 0x1E, 0x00, 0x0F, 0x36, 0x32, 0x00, 0x02, 0x60, 0x00, 0x64,
+	 0x08, 0x00, 0x04, 0x60, 0x00, 0x64, 0x05, 0x00, 0x00, 0x60, 0x01, 0x64, 0x02, 0x00, 0x20, 0x60,
+	 0x00, 0x64, 0x32, 0x45, 0xB4, 0x85, 0x45, 0x52, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x24, 0x60,
+	 0xD1, 0x63, 0x0C, 0x60, 0x16, 0x64, 0xA0, 0xDD, 0x62, 0xFF, 0xFF, 0xFF, 0x1A, 0xFF, 0x00, 0x67,
+	 0x23, 0x58, 0xFF, 0xFF, 0x3F, 0x40, 0x02, 0x2B, 0x05, 0x00, 0x90, 0x60, 0x00, 0xE8, 0x24, 0x60,
+	 0x0D, 0x63, 0x04, 0x00, 0x91, 0x60, 0x00, 0xE8, 0x24, 0x60, 0xBB, 0x63, 0x28, 0xE8, 0x0C, 0x60,
+	 0x16, 0x64, 0xA0, 0xDD, 0x62, 0xFF, 0xFF, 0xFF, 0x1A, 0xFF, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF,
+	 0x91, 0x60, 0x00, 0xE8, 0x28, 0xE8, 0xD9, 0x60, 0xFE, 0x64, 0x32, 0x45, 0xA4, 0x85, 0x45, 0x52,
+	 0x99, 0xFF, 0xA5, 0x4F, 0xFF, 0xB4, 0x07, 0xFB, 0x98, 0xFF, 0xA3, 0x60, 0x4B, 0x63, 0x0C, 0x60,
+	 0x16, 0x64, 0xA0, 0xDD, 0x62, 0xFF, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x08, 0xE1, 0xA1, 0xFF,
+	 0xFF, 0xFF, 0x43, 0xFF, 0x01, 0x60, 0x00, 0xE1, 0x28, 0xF3, 0x47, 0xFF, 0x60, 0x40, 0x07, 0x37,
+	 0x4B, 0x00, 0x05, 0x3B, 0x04, 0x00, 0xFF, 0x0A, 0x80, 0xE1, 0xA1, 0xFF, 0xFF, 0xFF, 0x29, 0xF5,
+	 0x2A, 0xF3, 0x47, 0xFF, 0x3F, 0xF0, 0x01, 0x1B, 0x01, 0x64, 0x60, 0x56, 0xAD, 0xE2, 0xB5, 0xFF,
+	 0x6C, 0x40, 0x40, 0xE1, 0xA1, 0xFF, 0x00, 0xF4, 0x6E, 0x61, 0x12, 0x62, 0x64, 0x43, 0x01, 0xE1,
+	 0x03, 0x64, 0xE2, 0xD0, 0xC9, 0x81, 0x64, 0x4C, 0xCC, 0x84, 0xDA, 0x82, 0xFA, 0x02, 0x01, 0x60,
+	 0x00, 0x6B, 0x9A, 0xFF, 0xCA, 0x82, 0x03, 0x00, 0x00, 0xF4, 0x81, 0xF2, 0xFF, 0xFF, 0x7A, 0xD0,
+	 0xA1, 0xFF, 0x64, 0x4C, 0xFC, 0x1C, 0xF8, 0x1D, 0x00, 0xB9, 0x06, 0x1E, 0x02, 0x02, 0x00, 0xF4,
+	 0xDA, 0x82, 0x5A, 0xD2, 0xA1, 0xFF, 0x60, 0x4D, 0x3F, 0x40, 0x02, 0x2B, 0x08, 0x00, 0x28, 0xF3,
+	 0xA5, 0x60, 0xC4, 0x65, 0x60, 0x40, 0x0E, 0x3B, 0x02, 0x00, 0x80, 0x4C, 0xFE, 0x01, 0xA1, 0xFF,
+	 0x87, 0x4E, 0x87, 0x4C, 0x87, 0x4C, 0x87, 0x4C, 0x87, 0x4C, 0x67, 0x4C, 0xFF, 0xFF, 0xBC, 0xFF,
+	 0x00, 0xE1, 0xD5, 0xFE, 0xA1, 0xFF, 0xFF, 0xFF, 0x00, 0x64, 0x40, 0x46, 0x60, 0x41, 0xB5, 0xFF,
+	 0xB7, 0xFF, 0xB4, 0xFF, 0x29, 0xF5, 0x3F, 0xF0, 0x24, 0xF2, 0x44, 0x43, 0x40, 0x44, 0x00, 0xF4,
+	 0xF3, 0x60, 0xA0, 0x65, 0x10, 0x62, 0x5A, 0xD2, 0xD9, 0x81, 0xD4, 0x80, 0xFF, 0xFF, 0xFB, 0x02,
+	 0x61, 0x45, 0x24, 0x44, 0xD4, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xFD, 0xA5, 0x48, 0x60,
+	 0x00, 0x64, 0xC4, 0x9D, 0x0D, 0x60, 0x00, 0x6B, 0x24, 0x44, 0xC0, 0x83, 0xBB, 0xFF, 0x29, 0xF5,
+	 0x01, 0xE1, 0x00, 0xF4, 0x6C, 0x61, 0x10, 0x62, 0x05, 0x00, 0x00, 0xF4, 0x01, 0xF2, 0xFF, 0xFF,
+	 0x60, 0x41, 0x04, 0x62, 0xA1, 0xFF, 0xFF, 0xFF, 0x01, 0x10, 0x1A, 0x00, 0x26, 0x44, 0x01, 0x26,
+	 0x0C, 0x00, 0x24, 0x44, 0xC8, 0x84, 0x40, 0x44, 0x02, 0x03, 0x6C, 0x45, 0xF3, 0x01, 0x03, 0x15,
+	 0x01, 0x64, 0x05, 0xFA, 0x15, 0x00, 0x6C, 0x45, 0xED, 0x01, 0x23, 0x44, 0xC8, 0x84, 0x40, 0x43,
+	 0x02, 0x03, 0x6C, 0x45, 0xE7, 0x01, 0x00, 0x64, 0x01, 0x15, 0x01, 0x64, 0x6C, 0x45, 0x05, 0xFB,
+	 0xE2, 0xD2, 0xDA, 0x82, 0xC9, 0x81, 0x60, 0x4C, 0xDD, 0x1C, 0xD7, 0x03, 0xBC, 0xFF, 0xDA, 0x01,
+	 0x00, 0xE1, 0xD5, 0xFE, 0xA1, 0xFF, 0xFF, 0xFF, 0x08, 0xE1, 0xA1, 0xFF, 0x67, 0x4C, 0x43, 0xFF,
+	 0xAD, 0x4F, 0x02, 0xBC, 0x00, 0x7F, 0xA0, 0x5D, 0x01, 0xE1, 0x01, 0x60, 0x69, 0x6B, 0xA5, 0x60,
+	 0xC4, 0x64, 0x60, 0x4C, 0xBB, 0xFF, 0xA1, 0xFF, 0xFF, 0xFF, 0x60, 0x4C, 0xA1, 0xFF, 0xFF, 0xFF,
+	 0x60, 0x4C, 0xFC, 0x01, 0x29, 0xF3, 0x2A, 0xF1, 0x07, 0xB5, 0x04, 0xE1, 0x65, 0x41, 0x64, 0x54,
+	 0xCD, 0xE2, 0x95, 0x81, 0xA1, 0x5D, 0xA1, 0xFF, 0xFF, 0xFF, 0xF9, 0x01, 0x61, 0x44, 0xFE, 0xFB,
+	 0xFF, 0xFD, 0xFF, 0x01, 0x7F, 0x67, 0x01, 0x61, 0x23, 0x58, 0xFF, 0xFF, 0xB1, 0xFE, 0x08, 0x05,
+	 0xB0, 0xFE, 0x09, 0x05, 0xB2, 0xFE, 0xB3, 0xFE, 0x78, 0x43, 0x01, 0x61, 0x24, 0x60, 0xDD, 0x78,
+	 0x2D, 0x60, 0x5D, 0x78, 0xFF, 0xFF, 0x28, 0xF3, 0x29, 0xF1, 0x40, 0x44, 0x44, 0x45, 0x2A, 0xF1,
+	 0x2B, 0xF1, 0x44, 0x46, 0x44, 0x47, 0x3F, 0xB4, 0xE0, 0x85, 0x1F, 0x60, 0x88, 0x64, 0x44, 0xD7,
+	 0x58, 0x43, 0xFF, 0xFF, 0x60, 0x45, 0x1C, 0x60, 0xB4, 0x7C, 0xA4, 0xD3, 0x61, 0x43, 0x04, 0xB4,
+	 0x24, 0x44, 0x02, 0x03, 0x13, 0xFF, 0x06, 0x00, 0x3F, 0xB4, 0xB4, 0x84, 0xFF, 0x27, 0x05, 0xFD,
+	 0x04, 0xFB, 0x10, 0x75, 0xA1, 0xFF, 0xFF, 0xFF, 0x86, 0x3E, 0xB4, 0xFE, 0x0B, 0x05, 0xB5, 0xFE,
+	 0x02, 0x24, 0xA1, 0xF7, 0xFF, 0xFF, 0xFF, 0xFF, 0xB7, 0xFE, 0x07, 0x05, 0x78, 0x43, 0x01, 0x61,
+	 0x24, 0x60, 0xDD, 0x78, 0x2D, 0x60, 0x98, 0x78, 0xFF, 0xFF, 0x36, 0x44, 0x00, 0x7F, 0xF2, 0xA0,
+	 0x60, 0x45, 0x05, 0x05, 0x20, 0x60, 0x16, 0x64, 0x44, 0xD7, 0xFF, 0xFF, 0xFF, 0xFF, 0x78, 0x43,
+	 0x01, 0x61, 0x24, 0x60, 0xDD, 0x78, 0x78, 0x43, 0x01, 0x61, 0x24, 0x60, 0xDD, 0x78, 0x7F, 0x60,
+	 0xC0, 0x64, 0x24, 0x45, 0xA4, 0x80, 0x7F, 0x67, 0x02, 0x61, 0x10, 0x02, 0x10, 0x64, 0x40, 0x40,
+	 0x02, 0x64, 0x40, 0x50, 0x61, 0xFF, 0x3F, 0x40, 0x40, 0x26, 0x04, 0x00, 0x10, 0xE0, 0x46, 0x60,
+	 0x09, 0xE0, 0x00, 0x00, 0x27, 0xF1, 0x00, 0x66, 0x20, 0x78, 0x42, 0xFE, 0x23, 0x58, 0xFF, 0xFF,
+	 0x7F, 0x60, 0xC0, 0x64, 0x24, 0x45, 0xA4, 0x80, 0x7F, 0x67, 0x02, 0x61, 0x1A, 0x02, 0x1C, 0x60,
+	 0xB4, 0x63, 0xA3, 0xD3, 0x07, 0x7C, 0x20, 0xB5, 0x0C, 0xB5, 0x04, 0x03, 0x03, 0x02, 0xDC, 0xF9,
+	 0x00, 0x67, 0x0F, 0x00, 0x00, 0x61, 0x41, 0x56, 0xC7, 0xFE, 0xAC, 0x01, 0x36, 0x47, 0xFF, 0x23,
+	 0x04, 0x00, 0x00, 0x7F, 0x60, 0x41, 0x7F, 0x67, 0x04, 0x00, 0x20, 0x44, 0x80, 0xBC, 0x40, 0x40,
+	 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x7F, 0x60, 0xC0, 0x64, 0x24, 0x45, 0xA4, 0x80, 0x7F, 0x67,
+	 0x02, 0x61, 0x31, 0x02, 0x1C, 0x60, 0xB4, 0x63, 0xA3, 0xD3, 0x01, 0x7C, 0x20, 0xB5, 0x0C, 0xB5,
+	 0x03, 0x03, 0x02, 0x02, 0xDC, 0xF9, 0xFF, 0xFF, 0x02, 0x61, 0x41, 0x56, 0xC7, 0xFE, 0x25, 0x60,
+	 0x11, 0x78, 0xFF, 0xFF, 0x9F, 0xF1, 0x20, 0x44, 0x64, 0x40, 0xFF, 0x26, 0x1B, 0x00, 0x7F, 0xB4,
+	 0x40, 0x40, 0x5C, 0x5E, 0x82, 0xFF, 0x26, 0x44, 0xFD, 0xB4, 0x40, 0x46, 0x5C, 0x41, 0x87, 0xFF,
+	 0x62, 0xFF, 0x00, 0x63, 0x24, 0x60, 0x5E, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0x00, 0xA8, 0x60, 0x46,
+	 0x04, 0x03, 0x09, 0xF2, 0x0F, 0xFC, 0xAC, 0x86, 0xFB, 0x01, 0x24, 0x60, 0x9E, 0x62, 0x06, 0x64,
+	 0xA2, 0xDB, 0x2D, 0xFF, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x00, 0x67, 0x20, 0x40, 0x80, 0x2A,
+	 0x02, 0x00, 0x7F, 0x67, 0x06, 0x61, 0x60, 0x45, 0x1C, 0x60, 0xB4, 0x7C, 0xA4, 0xD3, 0x61, 0x43,
+	 0x04, 0xB4, 0x24, 0x44, 0x02, 0x03, 0x13, 0xFF, 0x55, 0x01, 0x3F, 0xB4, 0xB4, 0x84, 0xFF, 0x27,
+	 0x05, 0xFD, 0x04, 0xFB, 0x20, 0x40, 0x80, 0x2A, 0x02, 0x00, 0x10, 0x75, 0x07, 0x00, 0x2D, 0x60,
+	 0x9C, 0x62, 0x01, 0x64, 0xA2, 0xDB, 0xFF, 0xFF, 0x08, 0x60, 0x10, 0x75, 0x43, 0x01, 0x25, 0x46,
+	 0x01, 0xF2, 0x08, 0xF0, 0x60, 0x47, 0x03, 0xB4, 0x03, 0xAC, 0x7F, 0x67, 0x03, 0x61, 0x08, 0x02,
+	 0x24, 0x60, 0x7A, 0x64, 0x40, 0x4B, 0x2C, 0x60, 0x58, 0x4D, 0xD8, 0x78, 0xFF, 0xFF, 0x00, 0x67,
+	 0x23, 0x58, 0xFF, 0xFF, 0x24, 0x40, 0x01, 0x2B, 0x49, 0x00, 0x25, 0x44, 0x1F, 0xB4, 0xE0, 0x85,
+	 0x25, 0x60, 0xEB, 0x64, 0xC4, 0x98, 0xFF, 0xFF, 0xC0, 0xFE, 0x3D, 0x00, 0xC1, 0xFE, 0x3B, 0x00,
+	 0xC2, 0xFE, 0x39, 0x00, 0xC3, 0xFE, 0x37, 0x00, 0xC4, 0xFE, 0x35, 0x00, 0xC5, 0xFE, 0x33, 0x00,
+	 0xC6, 0xFE, 0x31, 0x00, 0xC7, 0xFE, 0x2F, 0x00, 0xC8, 0xFE, 0x2D, 0x00, 0xC9, 0xFE, 0x2B, 0x00,
+	 0xCA, 0xFE, 0x29, 0x00, 0xCB, 0xFE, 0x27, 0x00, 0xCC, 0xFE, 0x25, 0x00, 0xCD, 0xFE, 0x23, 0x00,
+	 0xCE, 0xFE, 0x21, 0x00, 0xCF, 0xFE, 0x1F, 0x00, 0xD0, 0xFE, 0x1D, 0x00, 0xD1, 0xFE, 0x1B, 0x00,
+	 0xD2, 0xFE, 0x19, 0x00, 0xD3, 0xFE, 0x17, 0x00, 0xD4, 0xFE, 0x15, 0x00, 0xD5, 0xFE, 0x13, 0x00,
+	 0xD6, 0xFE, 0x11, 0x00, 0xD7, 0xFE, 0x0F, 0x00, 0xD8, 0xFE, 0x0D, 0x00, 0xD9, 0xFE, 0x0B, 0x00,
+	 0xDA, 0xFE, 0x09, 0x00, 0xDB, 0xFE, 0x07, 0x00, 0xDC, 0xFE, 0x05, 0x00, 0xDD, 0xFE, 0x03, 0x00,
+	 0xDE, 0xFE, 0x01, 0x00, 0xDF, 0xFE, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x00, 0x64, 0x9F, 0xFE,
+	 0xF0, 0x84, 0xFF, 0xFF, 0x9E, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x9D, 0xFE, 0xF0, 0x84, 0xFF, 0xFF,
+	 0x9C, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x9B, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x9A, 0xFE, 0xF0, 0x84,
+	 0xFF, 0xFF, 0x99, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x98, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x97, 0xFE,
+	 0xF0, 0x84, 0xFF, 0xFF, 0x96, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x95, 0xFE, 0xF0, 0x84, 0xFF, 0xFF,
+	 0x94, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x93, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x92, 0xFE, 0xF0, 0x84,
+	 0xFF, 0xFF, 0x91, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x90, 0xFE, 0xF0, 0x84, 0x06, 0xFB, 0x8F, 0xFE,
+	 0xF0, 0x84, 0xFF, 0xFF, 0x8E, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x8D, 0xFE, 0xF0, 0x84, 0xFF, 0xFF,
+	 0x8C, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x8B, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x8A, 0xFE, 0xF0, 0x84,
+	 0xFF, 0xFF, 0x89, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x88, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x87, 0xFE,
+	 0xF0, 0x84, 0xFF, 0xFF, 0x86, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x85, 0xFE, 0xF0, 0x84, 0xFF, 0xFF,
+	 0x84, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x83, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x82, 0xFE, 0xF0, 0x84,
+	 0xFF, 0xFF, 0x81, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x80, 0xFE, 0xF0, 0x84, 0x05, 0xFB, 0x00, 0x67,
+	 0x23, 0x58, 0xFF, 0xFF, 0x5C, 0x5C, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x24, 0x40, 0x01, 0x27,
+	 0x55, 0x00, 0x05, 0x60, 0x00, 0x63, 0x05, 0xFD, 0x30, 0x44, 0xBD, 0xDB, 0x31, 0x44, 0xBD, 0xDB,
+	 0x32, 0x44, 0xBD, 0xDB, 0x33, 0x44, 0xBD, 0xDB, 0x34, 0x44, 0xBD, 0xDB, 0x35, 0x44, 0xBD, 0xDB,
+	 0x36, 0x44, 0xBD, 0xDB, 0x37, 0x44, 0xBD, 0xDB, 0x38, 0x44, 0xBD, 0xDB, 0x39, 0x44, 0xBD, 0xDB,
+	 0x3A, 0x44, 0xBD, 0xDB, 0x3B, 0x44, 0xBD, 0xDB, 0x3C, 0x44, 0xBD, 0xDB, 0x3D, 0x44, 0xBD, 0xDB,
+	 0x3E, 0x44, 0xBD, 0xDB, 0x3F, 0x44, 0xBD, 0xDB, 0x02, 0x61, 0x61, 0x44, 0x02, 0x36, 0x82, 0xFF,
+	 0x03, 0x36, 0x83, 0xFF, 0x04, 0x36, 0x84, 0xFF, 0x05, 0x36, 0x85, 0xFF, 0x06, 0x36, 0x86, 0xFF,
+	 0x07, 0x36, 0x87, 0xFF, 0x20, 0x44, 0xBD, 0xDB, 0x21, 0x44, 0xBD, 0xDB, 0x22, 0x44, 0xBD, 0xDB,
+	 0x23, 0x44, 0xBD, 0xDB, 0x24, 0x44, 0xBD, 0xDB, 0x25, 0x44, 0xBD, 0xDB, 0x26, 0x44, 0xBD, 0xDB,
+	 0x27, 0x44, 0xBD, 0xDB, 0x28, 0x44, 0xBD, 0xDB, 0x29, 0x44, 0xBD, 0xDB, 0x2A, 0x44, 0xBD, 0xDB,
+	 0x2B, 0x44, 0xBD, 0xDB, 0x2C, 0x44, 0xBD, 0xDB, 0x2D, 0x44, 0xBD, 0xDB, 0x2E, 0x44, 0xBD, 0xDB,
+	 0x2F, 0x44, 0xBD, 0xDB, 0xDD, 0x81, 0x08, 0x3A, 0xD0, 0x01, 0x54, 0x00, 0x27, 0x40, 0x10, 0x26,
+	 0x30, 0x00, 0x26, 0x44, 0x01, 0x36, 0x2D, 0x00, 0x02, 0x36, 0x82, 0xFF, 0x03, 0x36, 0x83, 0xFF,
+	 0x04, 0x36, 0x84, 0xFF, 0x05, 0x36, 0x85, 0xFF, 0x06, 0x36, 0x86, 0xFF, 0x25, 0x44, 0x00, 0x36,
+	 0x44, 0x40, 0x01, 0x36, 0x44, 0x41, 0x02, 0x36, 0x44, 0x42, 0x03, 0x36, 0x44, 0x43, 0x04, 0x36,
+	 0x44, 0x44, 0x05, 0x36, 0x44, 0x45, 0x06, 0x36, 0x44, 0x46, 0x07, 0x36, 0x44, 0x47, 0x08, 0x36,
+	 0x44, 0x48, 0x09, 0x36, 0x44, 0x49, 0x0A, 0x36, 0x44, 0x4A, 0x0B, 0x36, 0x44, 0x4B, 0x0C, 0x36,
+	 0x44, 0x4C, 0x0D, 0x36, 0x44, 0x4D, 0x0E, 0x36, 0x44, 0x4E, 0x0F, 0x36, 0x44, 0x4F, 0x87, 0xFF,
+	 0x21, 0x00, 0x25, 0x44, 0x10, 0x36, 0x44, 0x50, 0x11, 0x36, 0x44, 0x51, 0x12, 0x36, 0x44, 0x52,
+	 0x13, 0x36, 0x44, 0x53, 0x14, 0x36, 0x44, 0x54, 0x15, 0x36, 0x44, 0x55, 0x16, 0x36, 0x44, 0x56,
+	 0x17, 0x36, 0x44, 0x57, 0x18, 0x36, 0x44, 0x58, 0x19, 0x36, 0x44, 0x59, 0x1A, 0x36, 0x44, 0x5A,
+	 0x1B, 0x36, 0x44, 0x5B, 0x1C, 0x36, 0x44, 0x5C, 0x1D, 0x36, 0x44, 0x5D, 0x1E, 0x36, 0x44, 0x5E,
+	 0x1F, 0x36, 0x44, 0x5F, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x25, 0x46, 0xAE, 0x60, 0x58, 0x4F,
+	 0x6F, 0x78, 0xFF, 0xFF, 0x03, 0x61, 0x7F, 0x67, 0x0B, 0x02, 0x00, 0xF0, 0x24, 0x60, 0x7A, 0x62,
+	 0x04, 0x64, 0xA2, 0xDB, 0x5A, 0xD9, 0x0A, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0x00, 0x67,
+	 0x23, 0x58, 0xFF, 0xFF, 0x40, 0x60, 0xC0, 0x64, 0x24, 0x45, 0xA4, 0x80, 0x7F, 0x67, 0x02, 0x61,
+	 0x11, 0x02, 0x24, 0x60, 0x9E, 0x62, 0x1A, 0x64, 0xA2, 0xDB, 0x00, 0x60, 0x50, 0x63, 0x5A, 0xDD,
+	 0x27, 0x60, 0x6E, 0x64, 0xA1, 0xFB, 0x2D, 0xFF, 0x25, 0x60, 0x11, 0x78, 0xFF, 0xFF, 0x2A, 0xF3,
+	 0x05, 0xFB, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x40, 0x60, 0xC0, 0x64, 0x24, 0x45, 0xA4, 0x80,
+	 0x7F, 0x67, 0x02, 0x61, 0x0F, 0x02, 0x24, 0x60, 0x9E, 0x62, 0x1C, 0x64, 0xA2, 0xDB, 0x00, 0x60,
+	 0x50, 0x63, 0x5A, 0xDD, 0x27, 0x60, 0x88, 0x64, 0xA1, 0xFB, 0x2D, 0xFF, 0x25, 0x60, 0x11, 0x78,
+	 0xFF, 0xFF, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x7F, 0x60, 0xC0, 0x64, 0x24, 0x45, 0xA4, 0x80,
+	 0x02, 0x61, 0x3E, 0x02, 0x25, 0x45, 0x20, 0x44, 0x80, 0x2A, 0x3A, 0x00, 0xF1, 0x60, 0x00, 0x64,
+	 0xD4, 0x80, 0xFF, 0xFF, 0x0B, 0x03, 0xF1, 0x60, 0x01, 0x64, 0xD4, 0x80, 0xFF, 0xFF, 0x06, 0x03,
+	 0xF1, 0x60, 0x02, 0x64, 0xD4, 0x80, 0xFF, 0xFF, 0x30, 0x03, 0x29, 0x00, 0x2D, 0x60, 0x0E, 0x62,
+	 0xA2, 0xD1, 0xBA, 0xF3, 0x1F, 0x60, 0x82, 0x61, 0xA0, 0x84, 0xA1, 0xDB, 0x25, 0x45, 0x23, 0x60,
+	 0xE4, 0x63, 0x02, 0x61, 0xBD, 0xD3, 0xBD, 0xD1, 0xD4, 0x80, 0xBD, 0xD3, 0xBD, 0xD5, 0xCD, 0x81,
+	 0x02, 0x03, 0x15, 0x03, 0xF7, 0x01, 0xA2, 0xFF, 0xA6, 0xD3, 0x40, 0x4C, 0x00, 0xA8, 0x67, 0x43,
+	 0x0C, 0x02, 0xA2, 0xDD, 0x42, 0x48, 0x64, 0x41, 0xAE, 0x60, 0x58, 0x4D, 0xC4, 0x78, 0xFF, 0xFF,
+	 0x66, 0x44, 0x28, 0xDB, 0x02, 0x03, 0x2C, 0x58, 0xA3, 0xFF, 0x0C, 0x61, 0x03, 0x00, 0x04, 0x61,
+	 0x7F, 0x67, 0x01, 0x00, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x2D, 0x60, 0x0E, 0x62, 0xA2, 0xD1,
+	 0xBA, 0xF3, 0x1F, 0x60, 0x82, 0x61, 0xA0, 0x84, 0xA1, 0xDB, 0x1F, 0x60, 0x86, 0x61, 0x01, 0x64,
+	 0xA1, 0xDB, 0xFF, 0xFF, 0xC4, 0xFE, 0xEE, 0x01, 0xC6, 0xFE, 0xEC, 0x01, 0x7E, 0x60, 0xC0, 0x64,
+	 0x24, 0x45, 0xA4, 0x80, 0x02, 0x61, 0x3F, 0x02, 0x25, 0x45, 0xF8, 0x2B, 0x3B, 0x00, 0x2E, 0xF5,
+	 0x67, 0x44, 0xD4, 0x80, 0x20, 0x60, 0x24, 0x63, 0x39, 0x03, 0x60, 0x61, 0x24, 0x44, 0x01, 0x27,
+	 0x29, 0x00, 0xA3, 0xFC, 0xA4, 0xF8, 0xBD, 0xD3, 0xA3, 0xD1, 0xD4, 0x80, 0xCD, 0x81, 0x08, 0x24,
+	 0x64, 0x58, 0x08, 0xA3, 0xF8, 0x02, 0x08, 0x60, 0x00, 0x63, 0xBD, 0xD3, 0xA3, 0xD1, 0xFE, 0xA0,
+	 0xFA, 0x60, 0x00, 0x64, 0xD0, 0x80, 0x14, 0x02, 0x13, 0x02, 0x04, 0xA3, 0xBE, 0xD3, 0xBD, 0xD1,
+	 0x0F, 0x18, 0xD4, 0x80, 0x0D, 0x18, 0x03, 0x03, 0xC3, 0x83, 0xC3, 0x83, 0xF7, 0x01, 0x64, 0x41,
+	 0xDD, 0x81, 0xE1, 0x81, 0xCB, 0x83, 0x46, 0x65, 0x2F, 0x60, 0x58, 0x4F, 0x01, 0x78, 0xFF, 0xFF,
+	 0x00, 0x67, 0x0A, 0x00, 0xBD, 0xD3, 0xBE, 0xD1, 0xD4, 0x80, 0xCD, 0x81, 0x08, 0x24, 0x64, 0x58,
+	 0x08, 0xA3, 0xF8, 0x02, 0x04, 0x61, 0x7F, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x0F, 0x64, 0x23, 0xFA,
+	 0x67, 0x44, 0x24, 0xFA, 0x62, 0x41, 0x3C, 0x60, 0x00, 0x65, 0x1A, 0x63, 0x68, 0x60, 0x28, 0x64,
+	 0x65, 0x46, 0x58, 0xD0, 0x2E, 0xF5, 0x59, 0xD8, 0xFB, 0x1F, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF,
+	 0xCB, 0x83, 0xBF, 0xD1, 0x4A, 0x65, 0x64, 0x43, 0xBD, 0xD3, 0xFF, 0xFF, 0x60, 0x41, 0x01, 0x26,
+	 0xDC, 0x81, 0xE9, 0x84, 0xDC, 0x84, 0x23, 0xFA, 0x09, 0x00, 0x4B, 0xD3, 0xFF, 0xFF, 0x60, 0x41,
+	 0xE8, 0x84, 0xDC, 0x84, 0x23, 0xFA, 0xBF, 0xD1, 0x4A, 0x65, 0x64, 0x43, 0x2F, 0x60, 0x58, 0x4F,
+	 0x01, 0x78, 0xFF, 0xFF, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x25, 0xF2, 0xFF, 0xFF, 0xE0, 0xA0,
+	 0x20, 0x64, 0x01, 0x06, 0x25, 0xFA, 0x23, 0xF2, 0xDF, 0xD1, 0xCC, 0x84, 0xE0, 0x85, 0x0B, 0x06,
+	 0xBF, 0xD1, 0x64, 0x41, 0xD5, 0x80, 0x64, 0x43, 0x01, 0x06, 0x65, 0x41, 0x4A, 0x65, 0x29, 0x60,
+	 0x58, 0x4F, 0x83, 0x78, 0xFF, 0xFF, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0xDC, 0xF3, 0x02, 0x63,
+	 0x23, 0xFC, 0x07, 0xB4, 0x25, 0xFA, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x4B, 0xD3, 0xBF, 0xD3,
+	 0x60, 0x41, 0xC9, 0x83, 0xE9, 0x81, 0xDD, 0x81, 0xA3, 0xFA, 0xE0, 0x81, 0x3C, 0x60, 0x00, 0x67,
+	 0x02, 0x24, 0x02, 0xA4, 0x60, 0x47, 0x40, 0x4B, 0xC9, 0x81, 0x4A, 0x65, 0xAB, 0x46, 0x59, 0xD0,
+	 0xAB, 0x46, 0xA5, 0xD8, 0xDA, 0x85, 0x80, 0x3A, 0x02, 0x00, 0x00, 0xF4, 0x04, 0x65, 0xF6, 0x1F,
+	 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0xFC, 0xA3, 0xA3, 0xD1, 0x4C, 0x65, 0xA4, 0xD3, 0xDA, 0x83,
+	 0x60, 0x47, 0x25, 0xFA, 0x00, 0x7E, 0x60, 0x47, 0x01, 0x26, 0xDC, 0x84, 0x60, 0x41, 0xE8, 0x84,
+	 0xD8, 0x84, 0x23, 0xFA, 0xAB, 0x01, 0xFC, 0xA3, 0xA3, 0xD1, 0x4C, 0x65, 0xA4, 0xD3, 0xDA, 0x83,
+	 0x00, 0x7F, 0x25, 0xFA, 0x60, 0x41, 0x01, 0x26, 0xDD, 0x81, 0xE9, 0x84, 0xD8, 0x84, 0x23, 0xFA,
+	 0x9D, 0x01, 0x28, 0x60, 0xE2, 0x63, 0xBF, 0xD3, 0xFF, 0xFF, 0x60, 0x41, 0xE8, 0x84, 0xDC, 0x84,
+	 0x23, 0xFA, 0x4A, 0x65, 0x2F, 0x60, 0x58, 0x4F, 0x01, 0x78, 0xFF, 0xFF, 0x00, 0x67, 0x23, 0x58,
+	 0xFF, 0xFF, 0x28, 0x60, 0xE2, 0x63, 0x23, 0xF2, 0xC0, 0x65, 0xCC, 0x84, 0xE0, 0x81, 0x0A, 0x04,
+	 0xBF, 0xDB, 0xD5, 0x80, 0x07, 0x03, 0x01, 0x06, 0x65, 0x41, 0x61, 0x44, 0xBF, 0xDB, 0x4A, 0x65,
+	 0x58, 0x4F, 0xAA, 0x00, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x03, 0x4E, 0x28, 0x60, 0x58, 0x43,
+	 0x5C, 0x78, 0xFF, 0xFF, 0x29, 0x60, 0xC6, 0x61, 0x29, 0x60, 0xA4, 0x62, 0xA2, 0xD3, 0xA1, 0xDB,
+	 0xCC, 0x84, 0xA8, 0x83, 0x05, 0x04, 0x29, 0x60, 0xA4, 0x64, 0x58, 0xD1, 0x59, 0xD9, 0xFD, 0x1F,
+	 0x0E, 0x43, 0x81, 0x01, 0x23, 0xF2, 0x1C, 0x60, 0x8E, 0x65, 0x60, 0x41, 0x1C, 0x60, 0x2A, 0x63,
+	 0xA3, 0xDB, 0xFF, 0xA1, 0x48, 0x64, 0x58, 0xD0, 0x7E, 0xA8, 0x5B, 0xD9, 0x02, 0x02, 0x00, 0xF4,
+	 0x02, 0x64, 0xFF, 0xA1, 0xD7, 0x80, 0x02, 0x03, 0x01, 0x03, 0xF5, 0x01, 0x2E, 0xF5, 0x00, 0x60,
+	 0x2F, 0x65, 0x25, 0xF2, 0x00, 0x63, 0xCC, 0x84, 0x03, 0xA3, 0xFD, 0x05, 0x4A, 0x64, 0xD7, 0x80,
+	 0x1B, 0x60, 0xC6, 0x61, 0x2F, 0x05, 0xA1, 0xDD, 0xE3, 0x83, 0xFE, 0xA3, 0x58, 0xD0, 0x7E, 0xA8,
+	 0x59, 0xD9, 0x02, 0x02, 0x00, 0xF4, 0x02, 0x64, 0xF9, 0x1F, 0x00, 0x63, 0x59, 0xDD, 0x2E, 0xF5,
+	 0x1B, 0x60, 0xC6, 0x64, 0x25, 0xF0, 0xA0, 0xD3, 0xD3, 0x80, 0x01, 0xB0, 0x04, 0x03, 0x01, 0xA4,
+	 0x03, 0x03, 0xA2, 0xDB, 0x01, 0x00, 0xA2, 0xDD, 0x1B, 0x60, 0xCE, 0x63, 0x10, 0x60, 0x5A, 0x65,
+	 0xBD, 0xD3, 0xBD, 0xD1, 0xE0, 0x84, 0xC4, 0x82, 0x10, 0x60, 0x7A, 0x65, 0x07, 0x64, 0x64, 0x41,
+	 0x5A, 0xDB, 0xD6, 0x80, 0xCD, 0x81, 0x06, 0x03, 0xFB, 0x02, 0x25, 0xF2, 0x02, 0xA3, 0xCC, 0x84,
+	 0xA2, 0xDA, 0xEC, 0x02, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x1C, 0x60, 0x2A, 0x61, 0xA1, 0xD3,
+	 0x23, 0xFA, 0xE0, 0x83, 0x4A, 0x65, 0x04, 0x02, 0x02, 0x63, 0x23, 0xFC, 0xA5, 0xFC, 0x09, 0x00,
+	 0xDB, 0x83, 0x59, 0xD1, 0xA5, 0xD8, 0xDA, 0x85, 0x80, 0x3A, 0x02, 0x00, 0x00, 0xF4, 0x04, 0x65,
+	 0xF8, 0x1F, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x1B, 0x60, 0xC6, 0x62, 0xA2, 0xD3, 0x00, 0x61,
+	 0x02, 0xA4, 0xFE, 0xA0, 0x23, 0xFA, 0x1B, 0x03, 0xFA, 0xA4, 0xFD, 0xA4, 0x01, 0xA1, 0xFD, 0x07,
+	 0x61, 0x43, 0x23, 0xF2, 0x25, 0xFC, 0xE0, 0x83, 0x02, 0xA3, 0x1B, 0x60, 0xC6, 0x61, 0x00, 0x60,
+	 0x4A, 0x64, 0x59, 0xD1, 0x58, 0xD8, 0x7E, 0x3A, 0x02, 0x00, 0x00, 0xF4, 0x02, 0x64, 0xF9, 0x1F,
+	 0x25, 0xF2, 0x23, 0xF2, 0x01, 0xB0, 0xCC, 0x84, 0x04, 0x02, 0x23, 0xFA, 0x02, 0x00, 0x00, 0x64,
+	 0x25, 0xFA, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x41, 0x4B, 0x65, 0x42, 0x80, 0x64, 0xD4, 0x85,
+	 0x2B, 0x41, 0x00, 0xA1, 0x55, 0x8B, 0x0D, 0x03, 0x02, 0x04, 0x65, 0x41, 0x02, 0x00, 0x00, 0x64,
+	 0x40, 0x4B, 0xCA, 0x84, 0x58, 0xD0, 0xC9, 0x81, 0xBD, 0xD9, 0xFC, 0x02, 0x00, 0xF4, 0x04, 0x65,
+	 0xEC, 0x01, 0x2F, 0x58, 0xFF, 0xFF, 0xFC, 0xA3, 0xA3, 0xD3, 0x02, 0x7C, 0xA0, 0xD3, 0x23, 0xF8,
+	 0xDC, 0x84, 0x25, 0xFA, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x02, 0x64, 0x23, 0xFA, 0x01, 0x64,
+	 0x9D, 0xFE, 0x02, 0x28, 0x02, 0x64, 0x25, 0xFA, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x2D, 0x60,
+	 0x1A, 0x62, 0xA2, 0xD3, 0x02, 0x7C, 0x23, 0xF8, 0x01, 0xB4, 0x25, 0xFA, 0x00, 0x67, 0x23, 0x58,
+	 0xFF, 0xFF, 0xFC, 0xA3, 0xA3, 0xD1, 0x02, 0x64, 0x23, 0xFA, 0xA4, 0xD3, 0x00, 0x63, 0x60, 0x40,
+	 0x0A, 0x37, 0x01, 0x63, 0x14, 0x37, 0x02, 0x63, 0x37, 0x37, 0x06, 0x63, 0x6E, 0x37, 0x0B, 0x63,
+	 0x25, 0xFC, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x02, 0x64, 0x23, 0xFA, 0x88, 0xFF, 0x75, 0x44,
+	 0x8D, 0xFF, 0xE8, 0x87, 0xE8, 0x84, 0xE8, 0x84, 0x03, 0xB4, 0x25, 0xFA, 0x00, 0x67, 0x23, 0x58,
+	 0xFF, 0xFF, 0x04, 0x64, 0x23, 0xFA, 0x86, 0xFF, 0x29, 0x44, 0x87, 0xFF, 0x25, 0xFA, 0x55, 0xF3,
+	 0x52, 0xF1, 0x80, 0x65, 0xC4, 0x87, 0x00, 0x7F, 0x26, 0xFA, 0x64, 0x44, 0xC4, 0x87, 0x00, 0x7F,
+	 0x27, 0xFA, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x05, 0x64, 0x23, 0xFA, 0x52, 0x63, 0xB7, 0xF3,
+	 0x4B, 0xDA, 0xB6, 0xF3, 0x4B, 0xDA, 0xB5, 0xF3, 0x4B, 0xDA, 0x60, 0x41, 0x88, 0xFF, 0x72, 0x5C,
+	 0x89, 0xFF, 0x4A, 0xD8, 0xA2, 0x48, 0x20, 0x23, 0x0E, 0x00, 0x64, 0x40, 0x80, 0x27, 0x15, 0x00,
+	 0xDC, 0x84, 0xBD, 0xDA, 0xBD, 0xD2, 0x11, 0x04, 0xDC, 0x84, 0xA2, 0xDA, 0xA3, 0xD2, 0x0D, 0x04,
+	 0xDC, 0x84, 0xA3, 0xDA, 0x0A, 0x00, 0x52, 0x63, 0xB7, 0xF3, 0x4B, 0xDA, 0xB6, 0xF3, 0x4B, 0xDA,
+	 0xB5, 0xF3, 0x4B, 0xDA, 0x54, 0x90, 0x4C, 0x63, 0xE0, 0x02, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF,
+	 0x25, 0xF0, 0x2D, 0x60, 0x16, 0x65, 0x23, 0xF2, 0xA5, 0xD9, 0x02, 0xA8, 0x64, 0x44, 0x07, 0x02,
+	 0x00, 0xBC, 0xF2, 0xA4, 0x04, 0x03, 0x03, 0x07, 0x28, 0x60, 0x44, 0x62, 0xA2, 0xD9, 0x00, 0x67,
+	 0x23, 0x58, 0xFF, 0xFF, 0x20, 0x63, 0x28, 0x60, 0xA4, 0x61, 0x48, 0x64, 0x58, 0xD0, 0x59, 0xD9,
+	 0xFD, 0x1F, 0x25, 0xF0, 0x20, 0x64, 0xD0, 0x81, 0xFF, 0xFF, 0x02, 0x07, 0x25, 0xFA, 0x0F, 0x00,
+	 0x28, 0x60, 0xA8, 0x63, 0xC3, 0x83, 0x01, 0x2A, 0x06, 0x00, 0xCF, 0x83, 0xA3, 0xD3, 0xCD, 0x81,
+	 0x00, 0x7F, 0xBD, 0xDB, 0x04, 0x03, 0x00, 0x64, 0xC9, 0x81, 0xBD, 0xDB, 0xFD, 0x02, 0x00, 0x67,
+	 0x23, 0x58, 0xFF, 0xFF, 0x23, 0xF2, 0x25, 0xF0, 0x02, 0xA8, 0x01, 0x60, 0xA6, 0x62, 0x09, 0x02,
+	 0xA2, 0xD9, 0x64, 0x41, 0x32, 0x44, 0x02, 0xB5, 0x00, 0xB9, 0xD4, 0x84, 0x08, 0x28, 0x02, 0xBC,
+	 0x40, 0x52, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x23, 0xF2, 0x25, 0xF0, 0x02, 0xA8, 0x01, 0x60,
+	 0xB2, 0x62, 0x0C, 0x02, 0xA2, 0xD9, 0x64, 0x41, 0x32, 0x44, 0x40, 0xB5, 0x00, 0xB9, 0xD4, 0x84,
+	 0x08, 0x24, 0x03, 0x00, 0x40, 0xBC, 0x02, 0xB5, 0xD4, 0x84, 0x40, 0x52, 0x00, 0x67, 0x23, 0x58,
+	 0xFF, 0xFF, 0x23, 0xF2, 0x25, 0xF0, 0x01, 0x60, 0xB0, 0x63, 0xA3, 0xD9, 0xA9, 0xF1, 0x20, 0x61,
+	 0x41, 0x4B, 0x64, 0x43, 0xD8, 0xF3, 0x63, 0x45, 0x66, 0x41, 0x65, 0x46, 0x8C, 0xFA, 0x60, 0x40,
+	 0x01, 0x36, 0x06, 0x00, 0x02, 0x36, 0x04, 0x00, 0x04, 0x36, 0x02, 0x00, 0x05, 0x3A, 0x02, 0x00,
+	 0x00, 0x64, 0x01, 0x00, 0x01, 0x64, 0x6F, 0xFA, 0x79, 0xF3, 0x7A, 0xF1, 0xFF, 0xFF, 0xA0, 0x84,
+	 0x65, 0x43, 0x02, 0x02, 0x79, 0xF3, 0xFF, 0xFF, 0x60, 0x41, 0x0F, 0x60, 0xAE, 0x65, 0xD8, 0xF3,
+	 0xFF, 0xFF, 0xE0, 0x84, 0x44, 0xD3, 0x61, 0x45, 0xA4, 0x80, 0xFF, 0xFF, 0x04, 0x02, 0xE8, 0x84,
+	 0xA4, 0x80, 0xFF, 0xFF, 0xFC, 0x03, 0xA4, 0x84, 0x7B, 0xFB, 0x6F, 0xF0, 0x60, 0x47, 0x90, 0x84,
+	 0x6F, 0xFA, 0x60, 0x47, 0x60, 0x45, 0x80, 0x64, 0xE8, 0x84, 0xA4, 0x80, 0xFF, 0xFF, 0xFC, 0x03,
+	 0xA4, 0x84, 0x70, 0xF0, 0x70, 0xFA, 0x00, 0x61, 0xE8, 0x84, 0xFF, 0xFF, 0x02, 0x05, 0xDD, 0x81,
+	 0xFB, 0x01, 0xE1, 0x81, 0x0F, 0x60, 0xA2, 0x65, 0x45, 0xD3, 0x0E, 0xFA, 0x66, 0x43, 0x0C, 0xF4,
+	 0x2B, 0x41, 0x4D, 0x8B, 0x02, 0xA3, 0xB6, 0x02, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x23, 0xF2,
+	 0x25, 0xF0, 0x02, 0xA8, 0x00, 0x67, 0x02, 0x02, 0x2D, 0xF9, 0x2C, 0xF9, 0x23, 0x58, 0xFF, 0xFF,
+	 0x28, 0x60, 0x42, 0x61, 0x23, 0xF2, 0x25, 0xF2, 0x02, 0xA8, 0x00, 0xA8, 0x09, 0x02, 0x07, 0x03,
+	 0xD0, 0xA0, 0x30, 0x65, 0x03, 0x04, 0xA7, 0xA0, 0x59, 0x65, 0x01, 0x06, 0x65, 0x44, 0xA1, 0xDB,
+	 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x31, 0x60, 0x2C, 0x61, 0x01, 0x64, 0xA1, 0xDB, 0x04, 0x00,
+	 0x31, 0x60, 0x2C, 0x61, 0x00, 0x64, 0xA1, 0xDB, 0x7E, 0x60, 0xC0, 0x64, 0x24, 0x45, 0xA4, 0x80,
+	 0x7F, 0x67, 0x02, 0x61, 0x0E, 0x02, 0x06, 0x61, 0x41, 0x56, 0xC7, 0xFE, 0x25, 0x60, 0x11, 0x78,
+	 0xFF, 0xFF, 0x36, 0x47, 0xFF, 0x23, 0x04, 0x00, 0x00, 0x7F, 0x60, 0x41, 0x7F, 0x67, 0x01, 0x00,
+	 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x7E, 0x60, 0xC0, 0x64, 0x24, 0x45, 0xA4, 0x80, 0x7F, 0x67,
+	 0x02, 0x61, 0x12, 0x02, 0x2D, 0x60, 0x58, 0x61, 0x65, 0x43, 0xA1, 0xDD, 0x0C, 0x61, 0x41, 0x56,
+	 0xC7, 0xFE, 0x25, 0x60, 0x11, 0x78, 0xFF, 0xFF, 0x36, 0x47, 0xFF, 0x23, 0x04, 0x00, 0x00, 0x7F,
+	 0x60, 0x41, 0x7F, 0x67, 0x01, 0x00, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x25, 0xF0, 0x29, 0x60,
+	 0xA2, 0x62, 0xA2, 0xD9, 0x19, 0x00, 0x2D, 0x60, 0x1A, 0x64, 0xA0, 0xD1, 0xA0, 0xF9, 0x0C, 0x60,
+	 0x38, 0x62, 0x40, 0x63, 0x00, 0x64, 0x5A, 0xDB, 0xFE, 0x1F, 0x64, 0x40, 0x01, 0x2A, 0x0C, 0x00,
+	 0x04, 0x65, 0x0C, 0x60, 0x38, 0x61, 0x48, 0x64, 0x3E, 0x63, 0x7C, 0xA8, 0x58, 0xD0, 0x59, 0xD9,
+	 0x02, 0x02, 0x00, 0xF4, 0x02, 0x64, 0xF9, 0x1F, 0x29, 0x60, 0xA2, 0x62, 0xA2, 0xD1, 0x0D, 0x60,
+	 0x1C, 0x65, 0x02, 0xFE, 0x64, 0x44, 0xF8, 0x84, 0xF8, 0x84, 0xF8, 0x87, 0x60, 0x41, 0x64, 0x44,
+	 0xE0, 0x84, 0xE0, 0x84, 0xC4, 0x84, 0x3E, 0xFB, 0x60, 0x42, 0x61, 0x44, 0x03, 0xA2, 0x60, 0xFE,
+	 0xA2, 0xDB, 0xFF, 0xFF, 0x20, 0xFE, 0x64, 0x44, 0x0C, 0x60, 0x3A, 0x65, 0xE0, 0x84, 0xE0, 0x84,
+	 0xE0, 0x84, 0xE0, 0x84, 0xC4, 0x84, 0x40, 0xFB, 0xFF, 0xFF, 0x00, 0x67, 0x00, 0x61, 0x23, 0x58,
+	 0xFF, 0xFF, 0x2D, 0x60, 0x1A, 0x64, 0xA0, 0xD1, 0xA0, 0xF9, 0x00, 0x64, 0x40, 0x41, 0x64, 0x40,
+	 0x01, 0x2A, 0xA4, 0x00, 0x4A, 0x64, 0xA0, 0xD2, 0xFF, 0xFF, 0x40, 0x42, 0x80, 0x2B, 0x04, 0x00,
+	 0xFF, 0xB4, 0x40, 0x42, 0x01, 0x64, 0x40, 0x41, 0xA9, 0xF3, 0x46, 0x4B, 0x60, 0x46, 0x20, 0x63,
+	 0xE3, 0x83, 0xAB, 0x46, 0x26, 0xF0, 0xAB, 0x46, 0x55, 0xF8, 0xAB, 0x46, 0x27, 0xF0, 0xAB, 0x46,
+	 0x56, 0xF8, 0xAB, 0x46, 0x28, 0xF0, 0xAB, 0x46, 0x57, 0xF8, 0x66, 0x44, 0x02, 0xA6, 0xF1, 0x1F,
+	 0xA9, 0xF3, 0xFF, 0xFF, 0x60, 0x46, 0xAB, 0x46, 0x0C, 0x60, 0x7A, 0x65, 0x22, 0x44, 0xFF, 0xB4,
+	 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xC4, 0x81, 0xC9, 0x81, 0x52, 0x64, 0x0E, 0x63,
+	 0x58, 0xD0, 0x59, 0xD9, 0xFD, 0x1F, 0x21, 0x44, 0x01, 0x2A, 0x08, 0x00, 0xAB, 0x46, 0xF0, 0xA1,
+	 0x6E, 0x64, 0x0E, 0x63, 0x59, 0xD1, 0x58, 0xD8, 0xFD, 0x1F, 0xAB, 0x46, 0x22, 0x44, 0xFF, 0xB4,
+	 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0x0C, 0x60, 0xDC, 0x65, 0xC4, 0x81, 0x60, 0x45, 0xC9, 0x81,
+	 0x62, 0x64, 0x06, 0x63, 0x58, 0xD0, 0x59, 0xD9, 0xFD, 0x1F, 0x21, 0x44, 0x01, 0x2A, 0x08, 0x00,
+	 0xAB, 0x46, 0xF8, 0xA1, 0xAE, 0x64, 0x06, 0x63, 0x59, 0xD1, 0x58, 0xD8, 0xFD, 0x1F, 0xAB, 0x46,
+	 0x65, 0x44, 0x0C, 0x60, 0xFC, 0x65, 0xC4, 0x81, 0xC9, 0x81, 0x6A, 0x64, 0x06, 0x63, 0x58, 0xD0,
+	 0x59, 0xD9, 0xFD, 0x1F, 0x22, 0x44, 0xFF, 0xB4, 0xE0, 0x84, 0xE0, 0x85, 0xC4, 0x84, 0x0C, 0x60,
+	 0xC2, 0x65, 0xC4, 0x81, 0x72, 0x64, 0x04, 0x63, 0x58, 0xD0, 0x59, 0xD9, 0xFD, 0x1F, 0xAB, 0x46,
+	 0x21, 0x44, 0x01, 0x2A, 0x06, 0x00, 0xFA, 0xA1, 0x88, 0x64, 0x04, 0x63, 0x59, 0xD1, 0x58, 0xD8,
+	 0xFD, 0x1F, 0x37, 0xF0, 0x21, 0x44, 0x01, 0x2A, 0x13, 0x00, 0x22, 0x44, 0x3D, 0xFB, 0x60, 0x41,
+	 0x02, 0xFE, 0xF8, 0x84, 0xF8, 0x84, 0xF8, 0x84, 0x3C, 0xFB, 0x0C, 0x60, 0xBE, 0x63, 0x88, 0xFF,
+	 0xCD, 0x81, 0x06, 0xA3, 0xFD, 0x0D, 0x8D, 0xFF, 0x3B, 0xFD, 0x64, 0x47, 0x80, 0xBF, 0x60, 0x5C,
+	 0x22, 0x43, 0x80, 0x61, 0x88, 0xFF, 0xCF, 0x83, 0xE1, 0x81, 0xFD, 0x0D, 0x8D, 0xFF, 0x61, 0x47,
+	 0x31, 0x91, 0xB1, 0x84, 0x37, 0xFA, 0x1F, 0x63, 0xE3, 0x83, 0x66, 0x44, 0x02, 0xA6, 0x37, 0xF0,
+	 0x66, 0x44, 0xB1, 0x9C, 0x37, 0xF8, 0x02, 0xA6, 0xFA, 0x1F, 0xAB, 0x46, 0x00, 0x67, 0x00, 0x61,
+	 0x23, 0x58, 0xFF, 0xFF, 0x23, 0xF2, 0x25, 0xF0, 0x02, 0xA8, 0x00, 0x67, 0x22, 0x02, 0x3D, 0xF1,
+	 0x64, 0x44, 0x03, 0xB4, 0x40, 0x42, 0xD0, 0x80, 0xA9, 0xF3, 0xFF, 0xFF, 0x60, 0x46, 0xB7, 0xF4,
+	 0x80, 0x61, 0x02, 0x02, 0xE3, 0x83, 0xEB, 0x83, 0x22, 0x44, 0x88, 0xFF, 0xCC, 0x84, 0xE1, 0x81,
+	 0xFD, 0x0D, 0x8D, 0xFF, 0x61, 0x47, 0x31, 0x91, 0x9D, 0x85, 0xA7, 0x83, 0x37, 0xFC, 0x1F, 0x63,
+	 0xE3, 0x83, 0x66, 0x44, 0x02, 0xA6, 0xB7, 0xF2, 0x66, 0x44, 0xA5, 0x81, 0xB7, 0xFA, 0x02, 0xA6,
+	 0xFA, 0x1F, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x2D, 0x60, 0x1A, 0x64, 0xA0, 0xD1, 0xA0, 0xF9,
+	 0x64, 0x40, 0x01, 0x2A, 0x4E, 0x00, 0x27, 0xF2, 0x1C, 0x60, 0xBA, 0x65, 0x60, 0x47, 0x00, 0x7F,
+	 0xE0, 0x84, 0x44, 0xD3, 0x66, 0x41, 0x60, 0x46, 0x60, 0x43, 0x05, 0xF2, 0x16, 0x18, 0x61, 0x46,
+	 0x27, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x04, 0xF2, 0x0C, 0x02, 0x61, 0x46, 0x26, 0xF0, 0x63, 0x46,
+	 0xD0, 0x80, 0x03, 0xF2, 0x06, 0x02, 0x61, 0x46, 0x25, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0xFF, 0xFF,
+	 0x07, 0x03, 0x80, 0xF4, 0xFF, 0xFF, 0x63, 0x46, 0xE8, 0x1B, 0xA9, 0xF3, 0x08, 0xFE, 0x60, 0x43,
+	 0x61, 0x46, 0x01, 0x03, 0x2A, 0x00, 0x43, 0x4B, 0xAB, 0x46, 0x37, 0xF2, 0x80, 0x60, 0x30, 0x7C,
+	 0xB0, 0x84, 0xA2, 0xDA, 0x4E, 0x61, 0x6E, 0x64, 0x0E, 0x63, 0xAB, 0x46, 0x59, 0xD0, 0xAB, 0x46,
+	 0x58, 0xD8, 0xFB, 0x1F, 0x88, 0x64, 0x04, 0x63, 0xAB, 0x46, 0x59, 0xD0, 0xAB, 0x46, 0x58, 0xD8,
+	 0xFB, 0x1F, 0xD9, 0x81, 0x98, 0x64, 0x04, 0x63, 0xAB, 0x46, 0x59, 0xD0, 0xAB, 0x46, 0x58, 0xD8,
+	 0xFB, 0x1F, 0xD9, 0x81, 0xAE, 0x64, 0x0E, 0x63, 0xAB, 0x46, 0x59, 0xD0, 0xAB, 0x46, 0x58, 0xD8,
+	 0xFB, 0x1F, 0x00, 0x67, 0x00, 0x61, 0x23, 0x58, 0xFF, 0xFF, 0x01, 0x67, 0x20, 0x61, 0x23, 0x58,
+	 0xFF, 0xFF, 0x2D, 0x60, 0x1A, 0x64, 0xA0, 0xD1, 0xA0, 0xF9, 0x64, 0x40, 0x01, 0x2A, 0x31, 0x00,
+	 0x27, 0xF2, 0x1C, 0x60, 0xBA, 0x65, 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD3, 0x66, 0x41,
+	 0x60, 0x46, 0x60, 0x43, 0x05, 0xF2, 0x16, 0x18, 0x61, 0x46, 0x27, 0xF0, 0x63, 0x46, 0xD0, 0x80,
+	 0x04, 0xF2, 0x0C, 0x02, 0x61, 0x46, 0x26, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x03, 0xF2, 0x06, 0x02,
+	 0x61, 0x46, 0x25, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0xFF, 0xFF, 0x07, 0x03, 0x80, 0xF4, 0xFF, 0xFF,
+	 0x63, 0x46, 0xE8, 0x1B, 0xA9, 0xF3, 0x08, 0xFE, 0x60, 0x43, 0x61, 0x46, 0x01, 0x03, 0x0D, 0x00,
+	 0x43, 0x4B, 0xAB, 0x46, 0x37, 0xF2, 0x80, 0x60, 0x30, 0x61, 0x9D, 0x85, 0xA4, 0x84, 0xA2, 0xDA,
+	 0xAB, 0x46, 0x00, 0x67, 0x00, 0x61, 0x23, 0x58, 0xFF, 0xFF, 0x01, 0x67, 0x20, 0x61, 0x23, 0x58,
+	 0xFF, 0xFF, 0xA2, 0xFF, 0x46, 0x45, 0x02, 0xF0, 0x09, 0x60, 0x08, 0x64, 0xD0, 0x80, 0x00, 0xF4,
+	 0x01, 0xF2, 0x66, 0x5C, 0x25, 0x46, 0x56, 0x02, 0x70, 0x27, 0x54, 0x00, 0x12, 0x64, 0x03, 0xFA,
+	 0x04, 0xF8, 0x0E, 0xF2, 0x87, 0xFC, 0x8D, 0xFC, 0x8E, 0xFC, 0xDA, 0x82, 0x16, 0x61, 0x00, 0x63,
+	 0xC9, 0x81, 0x5A, 0xDC, 0xFD, 0x02, 0x60, 0x40, 0xF0, 0x3B, 0x16, 0x00, 0x32, 0x44, 0xAF, 0xF3,
+	 0x01, 0xB0, 0xFA, 0xA0, 0x08, 0x24, 0x2C, 0x05, 0xDC, 0x83, 0xF0, 0x67, 0x0E, 0xFA, 0x24, 0x60,
+	 0x5E, 0x64, 0x2B, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xAF, 0xFD, 0x2B, 0xFF,
+	 0xFE, 0x64, 0x3B, 0x42, 0x4A, 0xDB, 0x4F, 0x00, 0xB0, 0xF3, 0x06, 0x65, 0xD4, 0x80, 0xDC, 0x83,
+	 0x17, 0x05, 0xB0, 0xFD, 0x98, 0xFE, 0x04, 0x04, 0x00, 0x7F, 0x08, 0x7E, 0x0E, 0xFA, 0x3B, 0xFF,
+	 0x24, 0x60, 0x52, 0x64, 0x2B, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0x0E, 0xF2,
+	 0x2B, 0xFF, 0x60, 0x40, 0x08, 0x26, 0xF7, 0xFE, 0xFD, 0x64, 0x3B, 0x42, 0x4A, 0xDB, 0x32, 0x00,
+	 0xAC, 0xF3, 0xFF, 0xFF, 0xD8, 0xA0, 0xFF, 0xFF, 0x0D, 0x04, 0x24, 0x60, 0x6A, 0x64, 0x2B, 0xDB,
+	 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xFC, 0x64, 0x3B, 0x42,
+	 0x4A, 0xDB, 0x21, 0x00, 0x46, 0x45, 0x00, 0x64, 0x2B, 0xDB, 0x25, 0x44, 0x5A, 0xDB, 0x02, 0x64,
+	 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xA2, 0xFF, 0x00, 0xF4, 0x01, 0xF0, 0x0A, 0x18, 0x70, 0x67,
+	 0xA0, 0x80, 0xF0, 0x67, 0x06, 0x03, 0xC0, 0x84, 0x01, 0xFA, 0x25, 0x46, 0x25, 0x44, 0x80, 0xFC,
+	 0x05, 0xFA, 0xAF, 0x60, 0x58, 0x4E, 0x95, 0x78, 0xFF, 0xFF, 0xD4, 0xFE, 0xA3, 0xFF, 0xFF, 0x64,
+	 0x3B, 0x42, 0x4A, 0xDB, 0xD4, 0xFE, 0xA3, 0xFF, 0x2D, 0x58, 0xFF, 0xFF, 0x24, 0x60, 0x58, 0x64,
+	 0x40, 0x47, 0x58, 0x4F, 0x0D, 0x00, 0x24, 0x60, 0x4C, 0x64, 0x40, 0x47, 0x58, 0x4F, 0x18, 0x00,
+	 0x24, 0x60, 0x64, 0x64, 0x40, 0x47, 0x58, 0x4F, 0x03, 0x00, 0x25, 0x60, 0x11, 0x78, 0xFF, 0xFF,
+	 0x27, 0xD5, 0x0E, 0xF2, 0x0B, 0x18, 0x60, 0x40, 0x01, 0x2A, 0x08, 0x00, 0x24, 0x60, 0x7A, 0x64,
+	 0x40, 0x4B, 0x2C, 0x60, 0x58, 0x4D, 0xD8, 0x78, 0xFF, 0xFF, 0xF2, 0x01, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x27, 0xD5, 0x0E, 0xF2, 0x14, 0x18, 0x60, 0x40, 0x01, 0x2A, 0x11, 0x00, 0x02, 0xF0, 0x09, 0x60,
+	 0x08, 0x64, 0xD0, 0x80, 0xA2, 0xFF, 0xB0, 0xF3, 0x02, 0x02, 0xCC, 0x84, 0xB0, 0xFB, 0x24, 0x60,
+	 0x7A, 0x64, 0x40, 0x4B, 0x2C, 0x60, 0x58, 0x4D, 0xD8, 0x78, 0xFF, 0xFF, 0xE9, 0x01, 0x2F, 0x58,
+	 0xFF, 0xFF, 0xFB, 0x64, 0x3A, 0x42, 0x4A, 0xDB, 0xA2, 0xFF, 0xB3, 0xF3, 0xAF, 0xF3, 0xCC, 0x80,
+	 0xFD, 0xA0, 0x01, 0x14, 0x1E, 0x05, 0xAE, 0x60, 0x58, 0x4D, 0x9B, 0x78, 0xFF, 0xFF, 0xA2, 0xFF,
+	 0x18, 0x03, 0xF0, 0x67, 0x0E, 0xFA, 0x24, 0x60, 0x7A, 0x62, 0x24, 0x60, 0x5E, 0x64, 0xA2, 0xDB,
+	 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xF6, 0x64, 0x3A, 0x42,
+	 0x4A, 0xDB, 0xB3, 0xF3, 0xAF, 0xF3, 0xCC, 0x83, 0xDC, 0x84, 0x01, 0x15, 0xB3, 0xFD, 0xAF, 0xFB,
+	 0xD4, 0xFE, 0xB2, 0xF3, 0xB0, 0xF3, 0x00, 0xA8, 0xB1, 0xF1, 0x03, 0x02, 0xD0, 0x80, 0xFF, 0xFF,
+	 0x27, 0x05, 0xAE, 0x60, 0x58, 0x4D, 0x9B, 0x78, 0xFF, 0xFF, 0xA2, 0xFF, 0x21, 0x03, 0x00, 0x63,
+	 0xB2, 0xF3, 0x0E, 0xFC, 0xCC, 0x84, 0xFF, 0x3A, 0xB2, 0xFB, 0x98, 0xFE, 0x03, 0x04, 0x08, 0xBB,
+	 0x0E, 0xFC, 0x3B, 0xFF, 0x24, 0x60, 0x7A, 0x62, 0x24, 0x60, 0x52, 0x64, 0xA2, 0xDB, 0x66, 0x44,
+	 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xF7, 0x64, 0x3A, 0x42, 0x4A, 0xDB,
+	 0xB0, 0xF3, 0x0E, 0xF2, 0xDC, 0x83, 0x08, 0xB0, 0xB0, 0xFD, 0x08, 0x28, 0xF7, 0xFE, 0xD4, 0xFE,
+	 0xA3, 0xFF, 0x25, 0x60, 0x11, 0x78, 0xFF, 0xFF, 0xB9, 0xFE, 0x13, 0xFF, 0x24, 0x40, 0x80, 0x2B,
+	 0x0B, 0x00, 0xA2, 0xFF, 0x25, 0x46, 0x09, 0xF4, 0x0E, 0xF2, 0x05, 0x18, 0x08, 0xBC, 0x0E, 0xFA,
+	 0xFF, 0xFF, 0xF7, 0xFE, 0x01, 0x00, 0xD8, 0xFE, 0xA3, 0xFF, 0x25, 0x46, 0x3E, 0xF2, 0x00, 0xF4,
+	 0x08, 0xF0, 0x25, 0x46, 0x06, 0xB4, 0xFF, 0x7F, 0x10, 0xBC, 0x06, 0x26, 0xFD, 0x7F, 0x0E, 0xFA,
+	 0x3E, 0xF2, 0x3F, 0xF2, 0x60, 0x41, 0x08, 0x2A, 0x64, 0x47, 0x3F, 0xFA, 0x60, 0x45, 0x27, 0x60,
+	 0xFC, 0x62, 0xA2, 0xD3, 0xA3, 0xFC, 0xAB, 0xFC, 0x91, 0xFC, 0xD4, 0x80, 0xC0, 0x60, 0xE1, 0x65,
+	 0xA5, 0x80, 0x01, 0x04, 0x07, 0x03, 0x23, 0xF0, 0x08, 0x64, 0xB0, 0x84, 0xA2, 0xDA, 0x2E, 0x60,
+	 0xC5, 0x78, 0xFF, 0xFF, 0x2F, 0x60, 0x58, 0x4F, 0x0F, 0x78, 0xFF, 0xFF, 0x14, 0x04, 0x23, 0xF0,
+	 0x04, 0x64, 0xB0, 0x84, 0xA2, 0xDA, 0xB8, 0xF1, 0x27, 0x60, 0x96, 0x64, 0xA0, 0xD3, 0xFF, 0xFF,
+	 0xDC, 0x84, 0xDC, 0x80, 0xD0, 0x80, 0x04, 0x03, 0xA2, 0xDB, 0x08, 0x24, 0xC6, 0xFE, 0x02, 0x00,
+	 0x20, 0x60, 0x00, 0x75, 0x83, 0x00, 0xDC, 0xF3, 0xA9, 0xF1, 0x07, 0xB4, 0x64, 0x43, 0xFD, 0xA0,
+	 0x2C, 0xF2, 0x71, 0x02, 0x01, 0xB0, 0x64, 0x43, 0x78, 0x02, 0x2E, 0xF2, 0x1C, 0x60, 0xBA, 0x65,
+	 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD3, 0x66, 0x41, 0x60, 0x46, 0x60, 0x43, 0x05, 0xF2,
+	 0x16, 0x18, 0x61, 0x46, 0x2E, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x04, 0xF2, 0x0C, 0x02, 0x61, 0x46,
+	 0x2D, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x03, 0xF2, 0x06, 0x02, 0x61, 0x46, 0x2C, 0xF0, 0x63, 0x46,
+	 0xD0, 0x80, 0xFF, 0xFF, 0x07, 0x03, 0x80, 0xF4, 0xFF, 0xFF, 0x63, 0x46, 0xE8, 0x1B, 0xA9, 0xF3,
+	 0x08, 0xFE, 0x60, 0x43, 0x61, 0x46, 0x51, 0x03, 0x63, 0x46, 0x80, 0xF6, 0x25, 0x46, 0x43, 0x18,
+	 0x2E, 0xF2, 0x66, 0x41, 0x1C, 0x60, 0xBA, 0x65, 0x60, 0x47, 0x00, 0x7F, 0xA9, 0xF1, 0xE0, 0x84,
+	 0x44, 0xD3, 0x64, 0x43, 0x11, 0x18, 0x60, 0x46, 0x00, 0xF2, 0xFF, 0xFF, 0xFC, 0x1B, 0x66, 0x44,
+	 0x64, 0x46, 0x80, 0xF0, 0x60, 0x46, 0x80, 0xF8, 0x65, 0x46, 0x65, 0x43, 0x80, 0xF0, 0x01, 0xFA,
+	 0x80, 0xFC, 0x64, 0x46, 0x80, 0xF8, 0x0B, 0x00, 0x64, 0x46, 0x62, 0x43, 0x00, 0xF2, 0xA3, 0xDB,
+	 0x60, 0x46, 0x80, 0xF0, 0x81, 0xFC, 0x80, 0xFC, 0x64, 0x46, 0x80, 0xF8, 0x60, 0x43, 0x61, 0x46,
+	 0x43, 0x4B, 0x2C, 0xF0, 0xAD, 0xF0, 0x2E, 0xF2, 0xAB, 0x46, 0x03, 0xF8, 0x84, 0xF8, 0x05, 0xFA,
+	 0x03, 0x64, 0x06, 0xFA, 0xAB, 0x46, 0x1E, 0x60, 0xBC, 0x61, 0xA1, 0xD3, 0x1E, 0x60, 0xFE, 0x7C,
+	 0xD0, 0x80, 0xFF, 0xFF, 0x07, 0x03, 0xA0, 0xDD, 0xDA, 0x9C, 0xA1, 0xD9, 0x49, 0xD3, 0xFF, 0xFF,
+	 0xDC, 0x84, 0xA1, 0xDB, 0x0A, 0x00, 0xDC, 0xF3, 0x02, 0xA3, 0xFE, 0xA0, 0xF9, 0xA0, 0x01, 0x06,
+	 0x04, 0x02, 0x23, 0xF0, 0x04, 0x64, 0xB0, 0x84, 0xA2, 0xDA, 0x07, 0xFC, 0x23, 0xF2, 0xFF, 0xFF,
+	 0x27, 0x1B, 0x27, 0x60, 0xFE, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0x60, 0x40, 0x00, 0x3A, 0x10, 0x00,
+	 0x24, 0x60, 0x7A, 0x62, 0x24, 0x60, 0x22, 0x64, 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64,
+	 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0x0E, 0xF2, 0xC1, 0xFE, 0x10, 0xAC, 0x0E, 0xFA, 0x1F, 0x00,
+	 0x24, 0x60, 0x7A, 0x62, 0x24, 0x60, 0x34, 0x64, 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64,
+	 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0x0E, 0xF2, 0xC8, 0xFE, 0x10, 0xAC, 0x0E, 0xFA, 0x0F, 0x00,
+	 0x24, 0x60, 0x7A, 0x62, 0x24, 0x60, 0x46, 0x64, 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64,
+	 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0x0E, 0xF2, 0xCE, 0xFE, 0x10, 0xAC, 0x0E, 0xFA, 0x25, 0x60,
+	 0x11, 0x78, 0xFF, 0xFF, 0xCB, 0x84, 0xC9, 0x83, 0xFF, 0xFF, 0x08, 0x04, 0x58, 0xD1, 0xA5, 0xD8,
+	 0xDA, 0x85, 0x80, 0x3A, 0x02, 0x00, 0x00, 0xF4, 0x04, 0x65, 0xF8, 0x1F, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x3E, 0xF2, 0xCC, 0xF1, 0x08, 0xB0, 0x19, 0xF8, 0x3B, 0x02, 0xEB, 0xF1, 0x2F, 0xF8, 0xEC, 0xF3,
+	 0x30, 0xFA, 0x60, 0x45, 0xED, 0xF3, 0x31, 0xFA, 0x46, 0x4A, 0x00, 0xF4, 0x60, 0x43, 0x05, 0xF2,
+	 0x06, 0xF2, 0xD0, 0x80, 0x07, 0xF0, 0x05, 0x02, 0xD4, 0x80, 0xD3, 0x80, 0x02, 0x02, 0xDC, 0xF3,
+	 0x03, 0x03, 0xAA, 0x46, 0x42, 0xFE, 0x25, 0x00, 0x60, 0x40, 0x03, 0x2A, 0x10, 0x00, 0x02, 0xF2,
+	 0x03, 0xF0, 0x04, 0xF2, 0x60, 0x43, 0xAA, 0x46, 0x2C, 0xFC, 0x2D, 0xF8, 0x2E, 0xFA, 0x81, 0xF1,
+	 0x32, 0xF8, 0x82, 0xF1, 0x33, 0xF8, 0x83, 0xF1, 0x34, 0xF8, 0x08, 0x64, 0x10, 0x00, 0x02, 0xF2,
+	 0x03, 0xF0, 0x04, 0xF2, 0x60, 0x43, 0xAA, 0x46, 0x32, 0xFC, 0x33, 0xF8, 0x34, 0xFA, 0x81, 0xF1,
+	 0x2C, 0xF8, 0x82, 0xF1, 0x2D, 0xF8, 0x83, 0xF1, 0x2E, 0xF8, 0x01, 0x60, 0x08, 0x64, 0x2A, 0xFA,
+	 0x02, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x30, 0x44, 0x02, 0xA8, 0x00, 0xE1, 0x03, 0x02, 0x42, 0xFF,
+	 0x47, 0xFF, 0xA1, 0xFF, 0x80, 0xFF, 0x90, 0xFF, 0x98, 0xFF, 0x88, 0xFF, 0x84, 0xE1, 0xFF, 0xFF,
+	 0x00, 0x00, 0xA1, 0xFF, 0xFF, 0xFF, 0x87, 0x3E, 0x2D, 0x60, 0x9C, 0x64, 0xA0, 0xD3, 0xFF, 0xFF,
+	 0x01, 0x1B, 0xF7, 0x01, 0x87, 0xFF, 0x20, 0x44, 0x80, 0xFF, 0x60, 0x40, 0x80, 0x26, 0xF1, 0x01,
+	 0xC0, 0x60, 0x40, 0xEC, 0xC0, 0x60, 0x00, 0xED, 0xC0, 0x60, 0x80, 0xEE, 0xAC, 0x4F, 0xBF, 0xB4,
+	 0xA0, 0x5C, 0x2D, 0x60, 0x1A, 0x62, 0xA2, 0xD1, 0xFF, 0xFF, 0x64, 0x40, 0x02, 0x27, 0x06, 0x00,
+	 0x28, 0xE2, 0x24, 0xE2, 0xBF, 0xFF, 0xFF, 0xFF, 0x75, 0x40, 0x10, 0x00, 0x28, 0xE2, 0x24, 0xE2,
+	 0x00, 0x60, 0x00, 0x61, 0x00, 0x60, 0x94, 0xE0, 0xBF, 0xFF, 0xFF, 0xFF, 0xA1, 0x50, 0x75, 0x40,
+	 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x60, 0x10, 0xE0, 0x2D, 0x60, 0x9C, 0x62,
+	 0x00, 0x64, 0xA2, 0xDB, 0x01, 0x60, 0x39, 0xE2, 0x04, 0x60, 0x00, 0x7A, 0xAC, 0x4F, 0x40, 0xBC,
+	 0x00, 0x7F, 0xA0, 0x5C, 0xC0, 0x60, 0xD9, 0xEC, 0xC0, 0x60, 0x0F, 0xED, 0xC0, 0x60, 0x8F, 0xEE,
+	 0xAE, 0x4F, 0x04, 0xBC, 0x00, 0x7F, 0xA0, 0x5E, 0x26, 0x61, 0xCD, 0x81, 0xFF, 0xFF, 0xFD, 0x02,
+	 0xAE, 0x4F, 0xFB, 0xB4, 0xA0, 0x5E, 0xAD, 0x01, 0x80, 0xFF, 0x90, 0xFF, 0x98, 0xFF, 0x2F, 0x60,
+	 0x54, 0x63, 0x20, 0x44, 0xBD, 0xDB, 0x21, 0x44, 0xBD, 0xDB, 0x22, 0x44, 0xBD, 0xDB, 0x23, 0x44,
+	 0xBD, 0xDB, 0x24, 0x44, 0xBD, 0xDB, 0x25, 0x44, 0xBD, 0xDB, 0x26, 0x44, 0xBD, 0xDB, 0x27, 0x44,
+	 0xBD, 0xDB, 0x28, 0x44, 0xBD, 0xDB, 0x29, 0x44, 0xBD, 0xDB, 0x2A, 0x44, 0xBD, 0xDB, 0x2B, 0x44,
+	 0xBD, 0xDB, 0x2C, 0x44, 0xBD, 0xDB, 0x2D, 0x44, 0xBD, 0xDB, 0x2E, 0x44, 0xBD, 0xDB, 0x2F, 0x44,
+	 0xBD, 0xDB, 0x2F, 0x60, 0x48, 0x64, 0xA0, 0xDD, 0x30, 0x60, 0x74, 0x63, 0x2F, 0x60, 0x4A, 0x64,
+	 0xA0, 0xDD, 0x2F, 0x60, 0x4C, 0x63, 0x30, 0x44, 0xA3, 0xDB, 0x2F, 0x60, 0x4E, 0x63, 0x31, 0x44,
+	 0xA3, 0xDB, 0x2F, 0x60, 0x50, 0x63, 0x32, 0x44, 0xA3, 0xDB, 0x2F, 0x60, 0x52, 0x63, 0x33, 0x44,
+	 0xA3, 0xDB, 0x81, 0xFF, 0x91, 0xFF, 0x58, 0x51, 0x4B, 0x00, 0x82, 0xFF, 0x92, 0xFF, 0x58, 0x51,
+	 0x47, 0x00, 0x83, 0xFF, 0x93, 0xFF, 0x58, 0x51, 0x43, 0x00, 0x84, 0xFF, 0x94, 0xFF, 0x58, 0x51,
+	 0x3F, 0x00, 0x85, 0xFF, 0x95, 0xFF, 0x58, 0x51, 0x3B, 0x00, 0x86, 0xFF, 0x96, 0xFF, 0x58, 0x51,
+	 0x37, 0x00, 0x87, 0xFF, 0x97, 0xFF, 0x58, 0x51, 0x33, 0x00, 0x80, 0xFF, 0x90, 0xFF, 0x99, 0xFF,
+	 0x2F, 0x60, 0x48, 0x64, 0xA0, 0xD1, 0x30, 0x44, 0x64, 0x43, 0xBD, 0xDB, 0x31, 0x44, 0xBD, 0xDB,
+	 0x32, 0x44, 0xBD, 0xDB, 0x33, 0x44, 0xBD, 0xDB, 0x34, 0x44, 0xBD, 0xDB, 0x35, 0x44, 0xBD, 0xDB,
+	 0x36, 0x44, 0xBD, 0xDB, 0x37, 0x44, 0xBD, 0xDB, 0x38, 0x44, 0xBD, 0xDB, 0x39, 0x44, 0xBD, 0xDB,
+	 0x3A, 0x44, 0xBD, 0xDB, 0x3B, 0x44, 0xBD, 0xDB, 0x3C, 0x44, 0xBD, 0xDB, 0x3D, 0x44, 0xBD, 0xDB,
+	 0x3E, 0x44, 0xBD, 0xDB, 0x3F, 0x44, 0xBD, 0xDB, 0xEF, 0x60, 0x48, 0x64, 0x0A, 0xFB, 0x40, 0x21,
+	 0xFE, 0x01, 0x80, 0xFF, 0x90, 0xFF, 0x98, 0xFF, 0x88, 0xFF, 0xA1, 0xFF, 0xFF, 0xFF, 0x87, 0x3E,
+	 0x42, 0x50, 0x40, 0x53, 0x2F, 0x60, 0x4A, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0x40, 0x52, 0x33, 0x44,
+	 0x32, 0x42, 0xA2, 0xDB, 0xDA, 0x82, 0xA2, 0xDD, 0xDA, 0x83, 0x65, 0x44, 0xBD, 0xDB, 0x61, 0x44,
+	 0xBD, 0xDB, 0x66, 0x44, 0xBD, 0xDB, 0xBD, 0xD9, 0x30, 0x44, 0xBD, 0xDB, 0x99, 0xFF, 0xA4, 0x4C,
+	 0xBD, 0xDB, 0xA5, 0x4C, 0xBD, 0xDB, 0xA0, 0x4C, 0xBD, 0xDB, 0xA1, 0x4C, 0xBD, 0xDB, 0x98, 0xFF,
+	 0x2F, 0x60, 0x4A, 0x64, 0xA0, 0xDD, 0x2F, 0x60, 0x4C, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0x40, 0x50,
+	 0x2F, 0x60, 0x50, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0x40, 0x52, 0x2F, 0x60, 0x52, 0x62, 0xA2, 0xD3,
+	 0xFF, 0xFF, 0x40, 0x53, 0x31, 0x41, 0x2F, 0x60, 0x4E, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0x40, 0x51,
+	 0x2F, 0x60, 0x48, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0x60, 0x43, 0x20, 0x44, 0xBD, 0xDB, 0x21, 0x44,
+	 0xBD, 0xDB, 0x22, 0x44, 0xBD, 0xDB, 0x23, 0x44, 0xBD, 0xDB, 0x24, 0x44, 0xBD, 0xDB, 0x25, 0x44,
+	 0xBD, 0xDB, 0x26, 0x44, 0xBD, 0xDB, 0x27, 0x44, 0xBD, 0xDB, 0x28, 0x44, 0xBD, 0xDB, 0x29, 0x44,
+	 0xBD, 0xDB, 0x2A, 0x44, 0xBD, 0xDB, 0x2B, 0x44, 0xBD, 0xDB, 0x2C, 0x44, 0xBD, 0xDB, 0x2D, 0x44,
+	 0xBD, 0xDB, 0x2E, 0x44, 0xBD, 0xDB, 0x2F, 0x44, 0xBD, 0xDB, 0x2F, 0x60, 0x48, 0x64, 0xA0, 0xDD,
+	 0x61, 0x58, 0xFF, 0xFF, 0x24, 0xE2, 0x2D, 0xF3, 0x2C, 0xF3, 0x00, 0xBD, 0xCC, 0x84, 0x08, 0x03,
+	 0x2C, 0xFB, 0x06, 0x02, 0x65, 0x44, 0x2C, 0xFB, 0x8A, 0xFF, 0x80, 0x60, 0x00, 0x75, 0x88, 0xFF,
+	 0xF2, 0xF3, 0x31, 0x40, 0x01, 0x2A, 0x44, 0x00, 0x60, 0x43, 0x04, 0xB0, 0x02, 0xB0, 0x08, 0x24,
+	 0x16, 0x02, 0x29, 0x44, 0xFF, 0xFF, 0x00, 0xA8, 0xCC, 0x81, 0x0E, 0x03, 0x41, 0x49, 0x37, 0x02,
+	 0x63, 0x40, 0x08, 0x2A, 0x09, 0x00, 0xF7, 0xB3, 0x31, 0x60, 0x1E, 0x7C, 0xA4, 0xD1, 0xAD, 0x4F,
+	 0xFD, 0xB4, 0xA0, 0x5D, 0x44, 0x49, 0x2B, 0x00, 0x63, 0x40, 0x02, 0x2A, 0x14, 0x00, 0x31, 0x60,
+	 0x20, 0x64, 0xA0, 0xD3, 0x31, 0x60, 0x1C, 0x7C, 0xA4, 0xDB, 0x40, 0x49, 0x31, 0x60, 0x22, 0x64,
+	 0xA0, 0xD3, 0x31, 0x60, 0x1E, 0x7C, 0xA4, 0xDB, 0x0C, 0xBB, 0xFD, 0xB3, 0xAD, 0x4F, 0x02, 0xBC,
+	 0x00, 0x7F, 0xA0, 0x5D, 0x14, 0x00, 0x31, 0x60, 0x24, 0x64, 0xA0, 0xD3, 0x31, 0x60, 0x1C, 0x7C,
+	 0x0E, 0x18, 0xA4, 0xDB, 0x40, 0x49, 0x31, 0x60, 0x26, 0x64, 0xA0, 0xD3, 0x31, 0x60, 0x1E, 0x7C,
+	 0xA4, 0xDB, 0x08, 0xBB, 0xFB, 0xB3, 0xAD, 0x4F, 0x02, 0xBC, 0x00, 0x7F, 0xA0, 0x5D, 0xF2, 0xFD,
+	 0x01, 0x60, 0x4E, 0x61, 0xA1, 0xD3, 0x61, 0x43, 0x17, 0x18, 0x58, 0xD3, 0x62, 0x41, 0x03, 0x18,
+	 0xCC, 0x84, 0xA1, 0xDB, 0x11, 0x00, 0x49, 0xD3, 0xA3, 0xDB, 0x06, 0xA1, 0xA1, 0xD3, 0x59, 0xD1,
+	 0x60, 0x45, 0xA5, 0xD3, 0x59, 0xD1, 0xB0, 0x84, 0xA5, 0xDB, 0x64, 0x44, 0x06, 0x36, 0xCD, 0xFE,
+	 0x07, 0x36, 0xD6, 0xFE, 0xE5, 0x01, 0x23, 0x46, 0xB0, 0x60, 0xA4, 0x78, 0xFF, 0xFF, 0x46, 0x43,
+	 0x24, 0x60, 0xA4, 0x61, 0xA1, 0xD3, 0x59, 0xD1, 0x06, 0x1B, 0x59, 0xD3, 0x59, 0xD1, 0x03, 0x1B,
+	 0x59, 0xD3, 0x59, 0xD1, 0xF0, 0x18, 0x00, 0x63, 0x49, 0xDD, 0x60, 0x40, 0x02, 0x36, 0x11, 0x00,
+	 0x03, 0x36, 0x32, 0x00, 0x01, 0x36, 0x08, 0x00, 0x05, 0x3A, 0xEA, 0x01, 0xA4, 0xD3, 0x5A, 0xD3,
+	 0x9C, 0x85, 0xA4, 0x84, 0xA2, 0xDB, 0xE4, 0x01, 0x01, 0x60, 0x4E, 0x61, 0x00, 0x64, 0xA1, 0xDB,
+	 0xDF, 0x01, 0x31, 0x60, 0x3C, 0x64, 0x40, 0x45, 0x22, 0x00, 0x01, 0x60, 0x4E, 0x66, 0xA6, 0xD3,
+	 0x04, 0xA1, 0x60, 0x43, 0xA1, 0xD3, 0xC9, 0x81, 0x60, 0x45, 0x00, 0xBB, 0xA1, 0xDB, 0xBE, 0xD3,
+	 0x09, 0x03, 0xD4, 0x84, 0x9C, 0x84, 0xDC, 0x84, 0xFF, 0xFF, 0x04, 0x0E, 0xA3, 0xD1, 0x63, 0x46,
+	 0x64, 0x43, 0xF2, 0x01, 0x9C, 0x84, 0xDC, 0x85, 0x49, 0xDD, 0x61, 0x44, 0x00, 0xBB, 0xA6, 0xDB,
+	 0x02, 0x03, 0x65, 0x44, 0xBE, 0xDB, 0xBC, 0x01, 0x31, 0x60, 0x17, 0x64, 0x40, 0x45, 0x01, 0x60,
+	 0x4E, 0x66, 0xA6, 0xD3, 0xFF, 0xFF, 0xD0, 0x80, 0x0F, 0x18, 0x02, 0x03, 0x60, 0x46, 0xF9, 0x01,
+	 0x58, 0xD3, 0xA4, 0xD3, 0x60, 0x45, 0x00, 0x63, 0xA4, 0xDD, 0x05, 0x18, 0x58, 0xD3, 0xFF, 0xFF,
+	 0xC4, 0x83, 0xA2, 0xDD, 0xCA, 0x84, 0xA6, 0xDB, 0x25, 0x58, 0x64, 0x41, 0x00, 0x60, 0x46, 0x74,
+	 0xCD, 0xE2, 0x04, 0xE1, 0x02, 0x60, 0x00, 0xE1, 0x3F, 0x44, 0x40, 0x26, 0x0B, 0x00, 0x01, 0x2A,
+	 0x05, 0x00, 0x42, 0x60, 0x09, 0xE0, 0x60, 0x60, 0x1C, 0xE0, 0x04, 0x00, 0x42, 0x60, 0x09, 0xE0,
+	 0x80, 0x60, 0x1C, 0xE0, 0x04, 0x29, 0xFE, 0x01, 0xC4, 0xE2, 0x43, 0x64, 0x3A, 0xDB, 0xA4, 0xF3,
+	 0xFF, 0xFF, 0x60, 0x41, 0x3F, 0x44, 0x02, 0x27, 0x84, 0x00, 0x20, 0x2B, 0xFF, 0x01, 0x80, 0xE1,
+	 0x95, 0x60, 0x80, 0xE7, 0x61, 0x40, 0x40, 0x2B, 0x0D, 0x00, 0x05, 0x63, 0x32, 0x60, 0x58, 0x4F,
+	 0x6A, 0x78, 0xFF, 0xFF, 0x28, 0x63, 0xFF, 0xFF, 0xFE, 0x1F, 0x01, 0x63, 0x32, 0x60, 0x58, 0x4F,
+	 0x6A, 0x78, 0xFF, 0xFF, 0xFF, 0xB1, 0xCD, 0x81, 0xE1, 0x85, 0x27, 0x60, 0x3C, 0x64, 0x44, 0xD1,
+	 0xFF, 0xFF, 0x64, 0x43, 0x32, 0x60, 0x58, 0x4F, 0x6A, 0x78, 0xFF, 0xFF, 0x00, 0x60, 0x00, 0x63,
+	 0x32, 0x60, 0x58, 0x4F, 0x6A, 0x78, 0xFF, 0xFF, 0x27, 0x60, 0x58, 0x61, 0x29, 0x60, 0xE8, 0x62,
+	 0xA2, 0xD3, 0x45, 0xD1, 0x47, 0xBC, 0xE0, 0x84, 0x62, 0x45, 0x64, 0x5F, 0xE8, 0x83, 0x32, 0x60,
+	 0x58, 0x4F, 0x6A, 0x78, 0xFF, 0xFF, 0xA3, 0xF3, 0xCD, 0xE2, 0x60, 0x54, 0x04, 0xE1, 0x04, 0x29,
+	 0xFE, 0x01, 0xC4, 0xE2, 0x15, 0x60, 0xA2, 0xE7, 0x38, 0x69, 0xFF, 0xFF, 0x68, 0x44, 0x01, 0x16,
+	 0xFD, 0x01, 0x01, 0x2A, 0x36, 0x00, 0x03, 0x60, 0x80, 0x7C, 0xA3, 0x83, 0x29, 0x60, 0xE8, 0x62,
+	 0xA2, 0xD1, 0x43, 0xBB, 0xB3, 0x83, 0x95, 0x60, 0x80, 0xE7, 0x32, 0x60, 0x58, 0x4F, 0x6A, 0x78,
+	 0xFF, 0xFF, 0xE3, 0x83, 0x15, 0x60, 0xA2, 0xE7, 0x38, 0x69, 0xFF, 0xFF, 0x68, 0x41, 0x01, 0x16,
+	 0xFD, 0x01, 0x63, 0x47, 0x61, 0x40, 0x01, 0x2A, 0x03, 0x00, 0x00, 0x3A, 0xCC, 0x84, 0x02, 0x00,
+	 0x07, 0x3A, 0xDC, 0x84, 0xFF, 0xB4, 0xA5, 0xDB, 0x60, 0x47, 0xE8, 0x84, 0x47, 0x65, 0x29, 0x60,
+	 0xE8, 0x62, 0xA2, 0xD3, 0xB4, 0x85, 0xB4, 0x83, 0x80, 0xE1, 0x95, 0x60, 0x80, 0xE7, 0x32, 0x60,
+	 0x58, 0x4F, 0x6A, 0x78, 0xFF, 0xFF, 0xA3, 0xF3, 0xCD, 0xE2, 0x60, 0x54, 0x04, 0x29, 0xFE, 0x01,
+	 0xC4, 0xE2, 0xA4, 0xF3, 0xFF, 0xFF, 0xFF, 0xFF, 0x80, 0x2B, 0x04, 0x00, 0x32, 0x60, 0x43, 0x78,
+	 0xFF, 0xFF, 0xFF, 0x01, 0xA4, 0xF3, 0x80, 0xE1, 0xCC, 0x84, 0xE0, 0x85, 0x15, 0x60, 0xA2, 0xE7,
+	 0x26, 0x60, 0x78, 0x64, 0x58, 0x4F, 0x4F, 0x00, 0x26, 0x60, 0x94, 0x64, 0x58, 0x4F, 0x4B, 0x00,
+	 0x26, 0x60, 0xB0, 0x64, 0x58, 0x4F, 0x47, 0x00, 0x26, 0x60, 0xCC, 0x64, 0x58, 0x4F, 0x43, 0x00,
+	 0x26, 0x60, 0xE8, 0x64, 0x58, 0x4F, 0x3F, 0x00, 0x27, 0x60, 0x04, 0x64, 0x58, 0x4F, 0x3B, 0x00,
+	 0x27, 0x60, 0x20, 0x64, 0x58, 0x4F, 0x37, 0x00, 0x01, 0x68, 0xFF, 0x6A, 0xFF, 0xFF, 0x01, 0x16,
+	 0xFE, 0x01, 0x3F, 0x44, 0x20, 0x27, 0x00, 0x00, 0x3F, 0x40, 0x40, 0x26, 0x08, 0x00, 0x00, 0x60,
+	 0x18, 0x64, 0x00, 0x60, 0x00, 0x65, 0x94, 0x84, 0xA0, 0x50, 0x1D, 0x60, 0x19, 0xE2, 0xC4, 0xE2,
+	 0x00, 0x63, 0xA3, 0xFD, 0x32, 0x7B, 0x4D, 0xE2, 0xBF, 0xFE, 0xC4, 0xE2, 0x41, 0xFF, 0xE0, 0xFE,
+	 0xE1, 0xFE, 0xE2, 0xFE, 0x43, 0xFF, 0x44, 0xFF, 0x46, 0xFF, 0xA5, 0xF3, 0x62, 0xFF, 0x60, 0x40,
+	 0x05, 0x36, 0x2D, 0xFF, 0x07, 0x36, 0xD5, 0xFE, 0x08, 0xE1, 0x88, 0x60, 0x85, 0x71, 0x8D, 0xE2,
+	 0xA2, 0x60, 0x16, 0x78, 0xFF, 0xFF, 0x50, 0xEC, 0x63, 0x4A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01,
+	 0x40, 0xEC, 0x2F, 0x58, 0xFF, 0xFF, 0x44, 0xD3, 0x80, 0x7C, 0x60, 0x48, 0x60, 0x47, 0x00, 0x7F,
+	 0xB0, 0x8A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x2F, 0x58, 0xFF, 0xFF, 0x42, 0xFF, 0x40, 0xFF,
+	 0xDD, 0xFE, 0xAD, 0x4F, 0x00, 0x7F, 0x01, 0xBC, 0xA0, 0x5D, 0x00, 0xEE, 0x19, 0x61, 0xCD, 0x81,
+	 0xFF, 0xFF, 0xFD, 0x02, 0x43, 0x45, 0x20, 0x44, 0x60, 0xBC, 0x40, 0x40, 0x02, 0x60, 0xEE, 0x63,
+	 0x7F, 0xF3, 0xA3, 0xFD, 0x40, 0x7F, 0xA4, 0xFB, 0x05, 0x64, 0xA5, 0xFB, 0xDF, 0xFE, 0x19, 0xFF,
+	 0x24, 0x60, 0xDD, 0x64, 0x3F, 0x40, 0x01, 0x2B, 0x02, 0x00, 0x32, 0x60, 0xA2, 0x64, 0xA6, 0xFB,
+	 0xBB, 0x60, 0x20, 0x78, 0xFF, 0xFF, 0x04, 0xEE, 0xAD, 0x4F, 0x00, 0x7F, 0x01, 0xBC, 0xA0, 0x5D,
+	 0x19, 0x61, 0xCD, 0x81, 0xFF, 0xFF, 0xFD, 0x02, 0xAD, 0x4F, 0x00, 0x7F, 0x01, 0xBC, 0xA0, 0x5D,
+	 0x00, 0xEE, 0x15, 0x60, 0xA2, 0xE7, 0x25, 0x60, 0x02, 0x63, 0x25, 0x60, 0x76, 0x65, 0xDF, 0xFE,
+	 0x80, 0xE1, 0xBD, 0xD3, 0xFF, 0xFF, 0x60, 0x48, 0x60, 0x47, 0x80, 0xBC, 0x00, 0x7F, 0x60, 0x4A,
+	 0xD7, 0x80, 0xA1, 0xFF, 0xFF, 0xFF, 0xF5, 0x02, 0x25, 0x60, 0x76, 0x63, 0x26, 0x60, 0x78, 0x65,
+	 0xBD, 0xD3, 0xFF, 0xFF, 0x60, 0x48, 0x60, 0x47, 0x80, 0xBC, 0x00, 0x7F, 0x60, 0x4A, 0xD7, 0x80,
+	 0xA1, 0xFF, 0xFF, 0xFF, 0xF5, 0x02, 0x3F, 0x40, 0x20, 0x2B, 0x00, 0x00, 0x01, 0x68, 0xFF, 0x6A,
+	 0xBF, 0xFE, 0x33, 0x60, 0x8A, 0x78, 0xFF, 0xFF, 0x3F, 0x40, 0x20, 0x2B, 0xAD, 0x00, 0x01, 0x16,
+	 0xFE, 0x01, 0x38, 0x69, 0xA1, 0xFF, 0xFF, 0xFF, 0x68, 0x44, 0x01, 0x2A, 0xA5, 0x00, 0x27, 0x60,
+	 0xB4, 0x64, 0xA0, 0xD3, 0xFF, 0xFF, 0xDC, 0x84, 0xFF, 0xFF, 0x08, 0x28, 0xA2, 0xDB, 0x7F, 0xF1,
+	 0x80, 0x60, 0x00, 0x64, 0xB0, 0x9C, 0x01, 0x00, 0x7F, 0xF1, 0xDD, 0xFE, 0xAD, 0x4F, 0x00, 0x7F,
+	 0x01, 0xBC, 0xA0, 0x5D, 0x00, 0xEE, 0x43, 0x45, 0x20, 0x44, 0x20, 0xBC, 0x40, 0x40, 0x02, 0x60,
+	 0xEE, 0x64, 0xA3, 0xFB, 0xA4, 0xF9, 0x05, 0x64, 0xA5, 0xFB, 0xDF, 0xFE, 0x19, 0xFF, 0x83, 0x00,
+	 0x20, 0x44, 0x20, 0xBC, 0x40, 0x40, 0x43, 0x45, 0xA4, 0xD1, 0xDA, 0x83, 0xC3, 0x85, 0x80, 0xE1,
+	 0xDF, 0xFE, 0xBD, 0xD3, 0xFF, 0xFF, 0x60, 0x48, 0x60, 0x47, 0x80, 0xBC, 0x00, 0x7F, 0x60, 0x4A,
+	 0xD7, 0x80, 0xA1, 0xFF, 0xF6, 0x02, 0xBF, 0xFE, 0x6E, 0x00, 0x3F, 0x40, 0x40, 0x26, 0x13, 0x00,
+	 0x0B, 0x60, 0xF8, 0x62, 0xA2, 0xD1, 0x00, 0x60, 0x10, 0x64, 0x90, 0x84, 0xA0, 0x50, 0xF8, 0xA2,
+	 0xA2, 0xD1, 0x0A, 0x60, 0x19, 0x64, 0x90, 0x84, 0xA0, 0x52, 0x06, 0xA2, 0xA2, 0xD1, 0x46, 0x60,
+	 0x09, 0x64, 0x90, 0x84, 0xA0, 0x50, 0xAD, 0x4F, 0xFE, 0xB4, 0xA0, 0x5D, 0xAD, 0x4F, 0xFD, 0xB4,
+	 0xA0, 0x5D, 0x02, 0xEE, 0xBD, 0xFE, 0x50, 0x00, 0x80, 0xE1, 0x01, 0x16, 0xFE, 0x01, 0x64, 0x48,
+	 0x92, 0x6A, 0xA1, 0xFF, 0xFF, 0xFF, 0x68, 0x40, 0x27, 0x60, 0xA2, 0x64, 0xA0, 0xD3, 0xFF, 0xFF,
+	 0xDC, 0x84, 0xFF, 0xFF, 0x08, 0x28, 0xA2, 0xDB, 0x3F, 0x00, 0x80, 0xE1, 0x01, 0x16, 0xFE, 0x01,
+	 0x01, 0x68, 0xA7, 0x6A, 0xA1, 0xFF, 0xFF, 0xFF, 0x68, 0x40, 0x36, 0x00, 0x20, 0x44, 0x20, 0xBC,
+	 0x40, 0x40, 0x80, 0xE1, 0x64, 0x46, 0x01, 0x16, 0xFE, 0x01, 0x21, 0x69, 0xA1, 0xFF, 0xFF, 0xFF,
+	 0x68, 0x5E, 0x01, 0x16, 0xFE, 0x01, 0x22, 0x69, 0xA1, 0xFF, 0xFF, 0xFF, 0x68, 0x5F, 0x26, 0xFA,
+	 0x1C, 0xF2, 0x01, 0x16, 0xFE, 0x01, 0x3A, 0x69, 0xA1, 0xFF, 0xFF, 0xFF, 0x68, 0x5F, 0x27, 0xFA,
+	 0x1B, 0x00, 0x20, 0x44, 0x20, 0xBC, 0x40, 0x40, 0x43, 0x45, 0xBE, 0xD5, 0xA4, 0xD2, 0x5A, 0x86,
+	 0xEF, 0xA0, 0x11, 0x61, 0x01, 0x06, 0x60, 0x41, 0x24, 0x60, 0xE0, 0x63, 0x80, 0xE1, 0xBD, 0xD3,
+	 0x26, 0x42, 0x01, 0x16, 0xFE, 0x01, 0x60, 0x49, 0xA1, 0xFF, 0xFF, 0xFF, 0x68, 0x44, 0xCD, 0x81,
+	 0xA2, 0xDA, 0x5A, 0x86, 0xF4, 0x02, 0x25, 0x43, 0x21, 0xE1, 0x00, 0x64, 0xBF, 0xDB, 0x20, 0x44,
+	 0x20, 0x2A, 0x07, 0x00, 0x07, 0xB4, 0x04, 0x36, 0xC3, 0xFE, 0x06, 0x36, 0xCC, 0xFE, 0x07, 0x36,
+	 0xD5, 0xFE, 0x20, 0x44, 0xD8, 0xB4, 0x40, 0x40, 0x20, 0x44, 0x40, 0x2A, 0x07, 0x00, 0x9F, 0xFE,
+	 0x1E, 0x05, 0xBF, 0xB4, 0x40, 0x40, 0xA6, 0xF7, 0xFF, 0xFF, 0xFF, 0xFF, 0x24, 0x60, 0x80, 0x63,
+	 0xBD, 0xD3, 0x02, 0x61, 0x17, 0x1B, 0x04, 0xA3, 0xBD, 0xD3, 0x02, 0x61, 0x13, 0x1B, 0x04, 0xA3,
+	 0xBD, 0xD3, 0x02, 0x61, 0x0F, 0x1B, 0x04, 0xA3, 0xBD, 0xD3, 0x04, 0x61, 0x0B, 0x1B, 0x04, 0xA3,
+	 0xBD, 0xD3, 0x06, 0x61, 0x07, 0x1B, 0x04, 0xA3, 0xBD, 0xD3, 0x07, 0x61, 0x03, 0x1B, 0xBB, 0x60,
+	 0x20, 0x78, 0xFF, 0xFF, 0xA3, 0xD1, 0x40, 0x44, 0x20, 0x44, 0x07, 0xB5, 0xD4, 0x85, 0x35, 0x80,
+	 0x24, 0x45, 0x24, 0x60, 0xBC, 0x64, 0x44, 0xD7, 0xFF, 0xFF, 0xFF, 0xFF, 0x80, 0xE1, 0x43, 0x45,
+	 0x20, 0x44, 0x20, 0xBC, 0x40, 0x40, 0x64, 0x43, 0xBD, 0xD3, 0xBD, 0xD1, 0x40, 0x44, 0x10, 0x27,
+	 0x10, 0x00, 0xFF, 0x60, 0x7F, 0x65, 0x15, 0x60, 0xA2, 0x64, 0x24, 0x40, 0x08, 0x2B, 0xA4, 0x84,
+	 0xA0, 0x57, 0xFF, 0xFF, 0x64, 0x49, 0xFF, 0xFF, 0x68, 0x44, 0x01, 0x16, 0xFD, 0x01, 0x00, 0x7F,
+	 0xA3, 0xDB, 0xA1, 0x01, 0x80, 0xE1, 0x43, 0x45, 0x20, 0x44, 0x20, 0xBC, 0x40, 0x40, 0x64, 0x43,
+	 0xBD, 0xD3, 0xBD, 0xD1, 0x40, 0x44, 0x10, 0x2B, 0x11, 0x00, 0xA3, 0xD3, 0xFF, 0xFF, 0x15, 0x60,
+	 0x80, 0xE7, 0x24, 0x40, 0x07, 0x27, 0x02, 0x00, 0x50, 0xEC, 0x00, 0x00, 0x60, 0x4A, 0xFF, 0xFF,
+	 0x01, 0x16, 0xFE, 0x01, 0x24, 0x40, 0x20, 0x2B, 0x40, 0xEC, 0x0F, 0x00, 0x15, 0x60, 0x22, 0x64,
+	 0x24, 0x40, 0x08, 0x27, 0x80, 0xBC, 0xA3, 0xD3, 0xA0, 0x57, 0x60, 0x48, 0x64, 0x44, 0x80, 0xBC,
+	 0xFF, 0xB4, 0x60, 0x4A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x75, 0x01, 0x42, 0x6F, 0x6F, 0x74,
+	 0x63, 0x6F, 0x64, 0x65, 0x20, 0x21, 0x21, 0x20, 0x20, 0x00, 0x53, 0x54, 0x41, 0x2F, 0x41, 0x50,
+	 0x20, 0x46, 0x75, 0x6E, 0x63, 0x27, 0x73, 0x00, 0x1F, 0x00, 0x03, 0x00, 0x02, 0x00, 0x24, 0x00,
+	 0x00, 0x00, 0x04, 0x00, 0x02, 0x00, 0x02, 0x00, 0x05, 0x00, 0x01, 0x00, 0x01, 0x00, 0x04, 0x00,
+	 0x06, 0x00, 0x07, 0x00, 0x05, 0x00, 0x06, 0x00, 0x07, 0x00, 0x06, 0x00, 0x06, 0x00, 0x07, 0x00,
+	 0x01, 0x00, 0x02, 0x00, 0x02, 0x00, 0x01, 0x00, 0x02, 0x00, 0x01, 0x00, 0x01, 0x00, 0x02, 0x00,
+	 0x02, 0x00, 0x40, 0x00, 0x32, 0x00, 0x32, 0x00, 0x0A, 0x00, 0x02, 0x00, 0x06, 0x00, 0x40, 0x00,
+	 0x32, 0x00, 0x36, 0x00, 0x0A, 0x00, 0x02, 0x00, 0x06, 0x00, 0x40, 0x00, 0x3B, 0x00, 0x40, 0x00,
+	 0x17, 0x00, 0x07, 0x00, 0x07, 0x00, 0x4A, 0x00, 0x40, 0x00, 0x4A, 0x00, 0x1E, 0x00, 0x0C, 0x00,
+	 0x08, 0x00, 0x57, 0x00, 0x4D, 0x00, 0x57, 0x00, 0x2B, 0x00, 0x19, 0x00, 0x08, 0x00, 0x5D, 0x00,
+	 0x53, 0x00, 0x5D, 0x00, 0x31, 0x00, 0x1F, 0x00, 0x08, 0x00, 0xA9, 0xF3, 0x21, 0x61, 0x00, 0x7C,
+	 0x01, 0x00, 0x00, 0xFA, 0x60, 0x46, 0xFE, 0x63, 0xA3, 0xD8, 0xFE, 0x1F, 0xCD, 0x81, 0xD8, 0x84,
+	 0xF8, 0x02, 0x21, 0x61, 0x80, 0x67, 0x40, 0x4A, 0xA9, 0xF5, 0x14, 0x60, 0x02, 0x65, 0x01, 0x7C,
+	 0x07, 0x18, 0x2A, 0x43, 0x02, 0xFC, 0x5F, 0x8A, 0x8E, 0xF8, 0x70, 0xF8, 0x00, 0xF4, 0xF8, 0x01,
+	 0x2E, 0x58, 0xFF, 0xFF, 0x3F, 0x40, 0x40, 0x26, 0x0A, 0x00, 0x42, 0x60, 0x09, 0xE0, 0x3F, 0x40,
+	 0x01, 0x2A, 0x03, 0x00, 0x60, 0x60, 0x1C, 0xE0, 0x02, 0x00, 0x80, 0x60, 0x1C, 0xE0, 0x40, 0xEC,
+	 0x00, 0xED, 0x02, 0xEE, 0x80, 0x60, 0x58, 0xEC, 0x80, 0x60, 0x00, 0xED, 0x80, 0x60, 0x82, 0xEE,
+	 0xC0, 0x60, 0x59, 0xEC, 0xC0, 0x60, 0x07, 0xED, 0xAD, 0x4F, 0xFE, 0xB4, 0xA0, 0x5D, 0x00, 0xF3,
+	 0x28, 0xFB, 0x40, 0x44, 0x2F, 0x60, 0x52, 0x7C, 0x20, 0xF9, 0xA2, 0x60, 0x00, 0x7C, 0x21, 0xF9,
+	 0xA2, 0x60, 0xE0, 0x7C, 0x22, 0xF9, 0x18, 0x60, 0x97, 0x7C, 0x23, 0xF9, 0x18, 0x60, 0xA8, 0x7C,
+	 0x24, 0xF9, 0x18, 0x60, 0xD2, 0x7C, 0x25, 0xF9, 0x18, 0x60, 0xE3, 0x7C, 0x26, 0xF9, 0x91, 0x60,
+	 0x00, 0xE8, 0x28, 0xE8, 0x44, 0x60, 0x02, 0xE6, 0x10, 0x67, 0x40, 0x52, 0x10, 0x60, 0x04, 0xE6,
+	 0x08, 0x60, 0x00, 0x63, 0xFA, 0x60, 0x00, 0x65, 0xBD, 0xD3, 0xBD, 0xD3, 0x02, 0xA8, 0xD4, 0x80,
+	 0x4A, 0x02, 0x49, 0x02, 0xDB, 0x83, 0xFA, 0x60, 0x27, 0x65, 0x5B, 0xD3, 0xBF, 0xD1, 0x1A, 0x18,
+	 0xC3, 0x83, 0xD4, 0x80, 0xC3, 0x83, 0xF9, 0x02, 0xDB, 0x83, 0xD3, 0x83, 0xD3, 0x86, 0x64, 0x41,
+	 0xCD, 0x81, 0xA6, 0xD1, 0xDA, 0x86, 0x25, 0x60, 0x02, 0x65, 0x00, 0x60, 0x72, 0x63, 0xA5, 0xD3,
+	 0xDA, 0x85, 0x90, 0x84, 0xFF, 0x27, 0x02, 0x00, 0xA2, 0xD9, 0x01, 0x00, 0xF8, 0x1F, 0xCD, 0x81,
+	 0xFF, 0xFF, 0xEF, 0x02, 0x08, 0x60, 0x06, 0x63, 0xFA, 0x60, 0x28, 0x65, 0x5B, 0xD3, 0xBF, 0xD1,
+	 0x0B, 0x18, 0xC3, 0x83, 0xD4, 0x80, 0xC3, 0x83, 0xF9, 0x02, 0xBF, 0xD3, 0x29, 0x60, 0xE8, 0x62,
+	 0x0E, 0xB4, 0xE0, 0x84, 0xE0, 0x84, 0xA2, 0xDB, 0x08, 0x60, 0x06, 0x63, 0xFD, 0x60, 0x0C, 0x65,
+	 0x5B, 0xD3, 0xBF, 0xD1, 0x10, 0x18, 0xC3, 0x83, 0xD4, 0x80, 0xC3, 0x83, 0xF9, 0x02, 0xFA, 0xA3,
+	 0xA3, 0xD3, 0x02, 0x60, 0x00, 0x65, 0xF7, 0xA0, 0xFC, 0xA0, 0x0D, 0x05, 0x04, 0x05, 0x78, 0x43,
+	 0x02, 0x61, 0x24, 0x60, 0xDD, 0x78, 0x21, 0x60, 0x00, 0x65, 0x3F, 0x43, 0x3F, 0x43, 0x21, 0x60,
+	 0x00, 0x65, 0xC0, 0x60, 0x8F, 0xEE, 0xB7, 0x84, 0x40, 0x5F, 0x00, 0x60, 0x30, 0xE2, 0x00, 0x60,
+	 0x50, 0xE2, 0x00, 0x60, 0x79, 0xE2, 0x00, 0x60, 0x90, 0xE2, 0x01, 0x60, 0xD0, 0xE2, 0x01, 0x60,
+	 0xF0, 0xE2, 0x01, 0x60, 0xB0, 0xE2, 0x26, 0x64, 0x35, 0xFB, 0x01, 0x60, 0x30, 0x64, 0x0A, 0xA4,
+	 0x38, 0xFB, 0x60, 0x45, 0x00, 0x60, 0xF8, 0x64, 0x0A, 0xA4, 0x39, 0xFB, 0x35, 0xF1, 0x0A, 0x64,
+	 0xC4, 0x84, 0x36, 0xFB, 0xC0, 0x84, 0x0A, 0xA4, 0x37, 0xFB, 0x09, 0x60, 0x2A, 0x64, 0xB9, 0xFB,
+	 0x82, 0xFF, 0x92, 0xFF, 0x5C, 0x41, 0x5C, 0x46, 0x5C, 0x47, 0x00, 0xE1, 0xA3, 0x60, 0x4B, 0x63,
+	 0x0C, 0x60, 0x16, 0x64, 0xA0, 0xDD, 0x87, 0xFF, 0x97, 0xFF, 0x0C, 0x60, 0x02, 0x64, 0x40, 0x5A,
+	 0x06, 0xA4, 0x40, 0x5B, 0x5C, 0x5E, 0x5C, 0x51, 0x28, 0x60, 0x44, 0x62, 0xA2, 0xD3, 0x7F, 0xFB,
+	 0x2D, 0x60, 0xCC, 0x61, 0x27, 0x7C, 0xA1, 0xD9, 0x6D, 0x60, 0x1C, 0x63, 0x7F, 0xA3, 0xE3, 0x87,
+	 0x00, 0x7F, 0xAA, 0xFB, 0x02, 0x60, 0x7F, 0x64, 0x00, 0x60, 0x42, 0x65, 0xD4, 0x84, 0xAB, 0xFB,
+	 0xDC, 0x84, 0xA9, 0xFB, 0x24, 0x60, 0x0E, 0x62, 0xA2, 0xDB, 0x34, 0x60, 0x58, 0x4E, 0x64, 0x78,
+	 0xFF, 0xFF, 0xAB, 0xF1, 0xAA, 0xF3, 0x7C, 0x63, 0xAD, 0xFB, 0x60, 0x46, 0x01, 0xFC, 0xDC, 0x84,
+	 0xD0, 0x80, 0x00, 0xFA, 0xFA, 0x04, 0xAE, 0xFB, 0x60, 0x46, 0x00, 0x64, 0x00, 0xFA, 0x63, 0x44,
+	 0x80, 0x7F, 0x01, 0xFA, 0xAB, 0xF3, 0xAA, 0xF1, 0xDC, 0x84, 0xD0, 0x84, 0xAC, 0xFB, 0x03, 0x60,
+	 0x26, 0x61, 0xAE, 0x60, 0x58, 0x4D, 0xB1, 0x78, 0xFF, 0xFF, 0x66, 0x44, 0x2E, 0xFB, 0x82, 0xFF,
+	 0x40, 0x42, 0x87, 0xFF, 0xAC, 0xF3, 0xB4, 0xFB, 0x08, 0x60, 0x00, 0x63, 0xFA, 0x60, 0x00, 0x65,
+	 0xBD, 0xD3, 0xA3, 0xD3, 0x02, 0xA8, 0xD4, 0x80, 0x24, 0x02, 0x23, 0x02, 0x2D, 0x60, 0x1A, 0x62,
+	 0xA2, 0xD1, 0xFF, 0xFF, 0x64, 0x40, 0x80, 0x26, 0x1C, 0x00, 0x04, 0xA3, 0xFD, 0x60, 0x0D, 0x65,
+	 0x5B, 0xD3, 0xBF, 0xD1, 0x16, 0x18, 0xC3, 0x83, 0xD4, 0x80, 0xC3, 0x83, 0xF9, 0x02, 0xBF, 0xD3,
+	 0xAD, 0x49, 0xFE, 0xA0, 0x00, 0x64, 0x0E, 0x04, 0x08, 0xB1, 0x20, 0xBC, 0x08, 0x28, 0x18, 0xBC,
+	 0x1C, 0x60, 0xB8, 0x63, 0x07, 0x7C, 0xA3, 0xD9, 0x1C, 0x60, 0xB6, 0x63, 0x05, 0x7C, 0xA3, 0xD9,
+	 0x01, 0x00, 0x00, 0x64, 0x1C, 0x60, 0xB4, 0x63, 0xA3, 0xDB, 0x00, 0x64, 0x40, 0x50, 0x63, 0xFF,
+	 0x60, 0xFF, 0x66, 0xFF, 0x65, 0xFF, 0x64, 0xFF, 0x61, 0xFF, 0x62, 0xFF, 0x49, 0x60, 0x02, 0xE1,
+	 0x52, 0x60, 0x02, 0xE1, 0x5B, 0x60, 0x02, 0xE1, 0x65, 0x60, 0x02, 0xE1, 0x6C, 0x60, 0x02, 0xE1,
+	 0x76, 0x60, 0x02, 0xE1, 0x41, 0x60, 0x02, 0xE1, 0x04, 0x65, 0x2D, 0x60, 0x18, 0x64, 0x44, 0xD3,
+	 0xEF, 0x60, 0x58, 0x4E, 0xBD, 0x78, 0xFF, 0xFF, 0x24, 0x60, 0x9E, 0x65, 0x0C, 0x64, 0xA5, 0xDB,
+	 0x36, 0x60, 0x1E, 0x64, 0xA1, 0xFB, 0x2D, 0xFF, 0x06, 0x61, 0x41, 0x4B, 0x09, 0x60, 0x08, 0x61,
+	 0xAE, 0x60, 0x58, 0x4D, 0xB1, 0x78, 0xFF, 0xFF, 0xF0, 0x67, 0x0E, 0xFA, 0x24, 0x60, 0x7A, 0x62,
+	 0x24, 0x60, 0x5E, 0x64, 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF,
+	 0x2B, 0xFF, 0x2B, 0x41, 0x4D, 0x8B, 0xFF, 0xFF, 0xE9, 0x02, 0x06, 0x61, 0x41, 0x4B, 0x09, 0x60,
+	 0x08, 0x61, 0xAE, 0x60, 0x58, 0x4D, 0xB1, 0x78, 0xFF, 0xFF, 0x24, 0x60, 0x7A, 0x62, 0x24, 0x60,
+	 0x52, 0x64, 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF,
+	 0x2B, 0x41, 0x4D, 0x8B, 0xFF, 0xFF, 0xEB, 0x02, 0x19, 0x60, 0x17, 0x78, 0xFF, 0xFF, 0x00, 0xEA,
+	 0x00, 0xEB, 0x50, 0x60, 0x03, 0xEA, 0x51, 0x60, 0x13, 0xEA, 0x52, 0x60, 0x30, 0xEA, 0x53, 0x60,
+	 0x40, 0xEA, 0x54, 0x60, 0x52, 0xEA, 0x55, 0x60, 0x6D, 0xEA, 0x56, 0x60, 0x71, 0xEA, 0x57, 0x60,
+	 0x8B, 0xEA, 0x58, 0x60, 0x47, 0xEA, 0x59, 0x60, 0xA0, 0xEA, 0x5A, 0x60, 0xB2, 0xEA, 0x5B, 0x60,
+	 0xC1, 0xEA, 0x5C, 0x60, 0xD7, 0xEA, 0x5D, 0x60, 0xEB, 0xEA, 0x5E, 0x60, 0xA0, 0xEA, 0x50, 0x60,
+	 0x36, 0xEB, 0x51, 0x60, 0x37, 0xEB, 0x52, 0x60, 0x20, 0xEB, 0x53, 0x60, 0xE4, 0xEB, 0x54, 0x60,
+	 0x34, 0xEB, 0x55, 0x60, 0x58, 0xEB, 0x56, 0x60, 0x48, 0xEB, 0x57, 0x60, 0xD0, 0xEB, 0x58, 0x60,
+	 0xC3, 0xEB, 0x59, 0x60, 0xFC, 0xEB, 0x5A, 0x60, 0x34, 0xEB, 0x5B, 0x60, 0x58, 0xEB, 0x5C, 0x60,
+	 0xC0, 0xEB, 0x5D, 0x60, 0xD0, 0xEB, 0x5E, 0x60, 0x91, 0xEB, 0x00, 0xEA, 0x00, 0xEB, 0xE0, 0x60,
+	 0x02, 0xEA, 0xE0, 0x60, 0x03, 0xEB, 0xA0, 0x60, 0x00, 0xEB, 0xB0, 0x60, 0x00, 0xEB, 0xAB, 0x48,
+	 0x40, 0x3B, 0x01, 0x00, 0xFC, 0x01, 0x00, 0xEB, 0x03, 0x60, 0x02, 0x62, 0x62, 0x44, 0xA2, 0xDB,
+	 0x0F, 0x64, 0x60, 0x7F, 0xA0, 0x5A, 0x80, 0x60, 0x00, 0xEA, 0xA0, 0x60, 0x00, 0xEA, 0xD1, 0x60,
+	 0x00, 0xEA, 0x3F, 0x40, 0x40, 0x26, 0x08, 0x00, 0x00, 0x60, 0x18, 0x64, 0x00, 0x60, 0x00, 0x65,
+	 0x94, 0x84, 0xA0, 0x50, 0x1D, 0x60, 0x19, 0xE2, 0x24, 0x44, 0xFF, 0xB4, 0x04, 0xFB, 0x50, 0x60,
+	 0x00, 0x64, 0x05, 0xFB, 0x10, 0x60, 0x10, 0x75, 0x25, 0x60, 0x11, 0x78, 0xFF, 0xFF, 0x3F, 0x41,
+	 0xA5, 0x4C, 0x50, 0x37, 0x04, 0x00, 0x01, 0xB9, 0x41, 0x5F, 0xB5, 0x60, 0x55, 0xE0, 0x0C, 0x60,
+	 0x10, 0x62, 0xA2, 0xD3, 0x01, 0x60, 0x01, 0x65, 0xD4, 0x80, 0x5A, 0xD1, 0x0F, 0x02, 0x5A, 0xD3,
+	 0x3C, 0x60, 0x00, 0x66, 0xE0, 0x87, 0x40, 0x4A, 0x68, 0x60, 0x28, 0x61, 0x64, 0x44, 0xC8, 0x84,
+	 0x0C, 0x63, 0xAA, 0x46, 0x58, 0xD0, 0xAA, 0x46, 0x59, 0xD8, 0xFB, 0x1F, 0x08, 0x60, 0x00, 0x63,
+	 0xFA, 0x60, 0x00, 0x65, 0xBD, 0xD3, 0xA3, 0xD3, 0x02, 0xA8, 0xD4, 0x80, 0x61, 0x02, 0x60, 0x02,
+	 0x6E, 0x60, 0x58, 0x61, 0x3C, 0x60, 0x00, 0x66, 0x41, 0x4B, 0x2B, 0x41, 0x6E, 0x60, 0xA0, 0x7C,
+	 0xD1, 0x80, 0xA1, 0xD2, 0x25, 0x05, 0x59, 0xD0, 0x60, 0x45, 0x59, 0xD2, 0x44, 0x47, 0xE0, 0x87,
+	 0x40, 0x4A, 0x59, 0xD2, 0x59, 0x8B, 0x40, 0x4C, 0x08, 0x60, 0x00, 0x63, 0xBE, 0xD3, 0xBD, 0xD1,
+	 0xEC, 0x18, 0xD4, 0x80, 0xEA, 0x18, 0x03, 0x03, 0xC3, 0x83, 0xC3, 0x83, 0xF7, 0x01, 0x67, 0x44,
+	 0xC0, 0x84, 0xE0, 0x85, 0x2C, 0x44, 0xD4, 0x80, 0x63, 0x41, 0x01, 0x06, 0x65, 0x44, 0xC8, 0x83,
+	 0xAA, 0x46, 0x59, 0xD1, 0x27, 0xD8, 0x5A, 0x87, 0xFC, 0x1F, 0xAA, 0x46, 0x2B, 0x41, 0xD5, 0x01,
+	 0x6E, 0x60, 0xA0, 0x61, 0x41, 0x4B, 0x2B, 0x41, 0x6E, 0x60, 0xD8, 0x7C, 0xD1, 0x80, 0xA1, 0xD2,
+	 0x27, 0x05, 0x59, 0xD0, 0x60, 0x45, 0x59, 0xD2, 0x44, 0x47, 0xE0, 0x87, 0x40, 0x4A, 0x59, 0xD2,
+	 0x59, 0x8B, 0x40, 0x4C, 0x08, 0x60, 0x00, 0x63, 0xBE, 0xD3, 0xBD, 0xD1, 0xEC, 0x18, 0xD4, 0x80,
+	 0xEA, 0x18, 0x03, 0x03, 0xC3, 0x83, 0xC3, 0x83, 0xF7, 0x01, 0x04, 0xA3, 0xA3, 0xD1, 0x5A, 0x88,
+	 0x2C, 0x43, 0xD3, 0x80, 0xFF, 0xFF, 0x01, 0x06, 0x64, 0x43, 0xCF, 0x83, 0xAA, 0x46, 0x60, 0xFE,
+	 0x28, 0xD1, 0x5E, 0x88, 0x27, 0xD8, 0x5A, 0x87, 0xFB, 0x1F, 0x20, 0xFE, 0xAA, 0x46, 0xD3, 0x01,
+	 0xB8, 0xFE, 0xB9, 0xFE, 0xBA, 0xFE, 0xBB, 0xFE, 0xBD, 0xFE, 0xBF, 0xFE, 0x2D, 0x60, 0x1A, 0x62,
+	 0xA2, 0xD3, 0x12, 0x63, 0x60, 0x40, 0x01, 0x27, 0x05, 0x00, 0x0B, 0x60, 0xEA, 0x62, 0x00, 0x64,
+	 0x5A, 0xDB, 0xFE, 0x1F, 0x34, 0x60, 0x81, 0x78, 0xFF, 0xFF, 0xF1, 0xFF, 0xF6, 0x6C, 0x1E, 0x00,
+	 0x04, 0x00, 0xF2, 0xFF, 0xFA, 0x6C, 0x1E, 0x00, 0x04, 0x00, 0xFB, 0xFF, 0x02, 0x6D, 0x1E, 0x00,
+	 0x04, 0x00, 0xF1, 0xFF, 0x8C, 0x64, 0x1E, 0x00, 0x04, 0x00, 0xF2, 0xFF, 0x90, 0x64, 0x1E, 0x00,
+	 0x04, 0x00, 0xFB, 0xFF, 0x98, 0x64, 0x1E, 0x00, 0x04, 0x00, 0x86, 0xFD, 0x50, 0x28, 0x00, 0x00,
+	 0x06, 0x00, 0x10, 0xFD, 0x74, 0x01, 0x00, 0x00, 0x02, 0x00, 0x14, 0xFD, 0x18, 0x2D, 0x00, 0x00,
+	 0x0A, 0x00, 0x20, 0xFA, 0x94, 0x26, 0x00, 0x00, 0x0E, 0x00, 0x21, 0xFA, 0x78, 0x26, 0x00, 0x00,
+	 0x0E, 0x00, 0x22, 0xFA, 0xB0, 0x26, 0x00, 0x00, 0x0E, 0x00, 0x23, 0xFA, 0x64, 0x25, 0x00, 0x00,
+	 0x01, 0x00, 0x24, 0xFA, 0x58, 0x27, 0x00, 0x00, 0x0E, 0x00, 0x25, 0xFA, 0x78, 0x25, 0x00, 0x00,
+	 0x80, 0x00, 0x26, 0xFA, 0x5E, 0x25, 0x00, 0x00, 0x01, 0x00,
+
+};  /* fw_image_3_data */
+
+static const hcf_8 fw_image_4_data[] = {
+	 0xA2, 0x60, 0xDD, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xA2, 0x60, 0xC3, 0x78, 0x41, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xA2, 0x60, 0xC9, 0x78, 0xC4, 0xE2, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xA2, 0x60, 0x19, 0x78, 0x43, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x44, 0xFF, 0x20, 0x54, 0xCD, 0xE2, 0xA2, 0x60, 0xDB, 0x78, 0x08, 0xE1, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xA2, 0x60, 0xDD, 0x78, 0x44, 0xE2, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xA2, 0x60, 0xDD, 0x78, 0x46, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xA2, 0x60, 0xDD, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xA8, 0x60, 0x73, 0x78, 0x4C, 0x4E, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xA7, 0x60, 0xFB, 0x78, 0x4C, 0xE2, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xC4, 0xE2, 0x84, 0xFF, 0x22, 0x58, 0x82, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xA3, 0x60, 0x7E, 0x78, 0x43, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xE4, 0xE2, 0xA8, 0x60, 0x14, 0x78, 0xB5, 0xF3, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xBA, 0x60, 0xCE, 0x78, 0x64, 0xE2, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xA8, 0x60, 0x87, 0x78, 0xA4, 0xE2, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xA8, 0x60, 0x55, 0x78, 0x47, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xAE, 0x60, 0x1E, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xAE, 0x60, 0x4B, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xAC, 0x60, 0xD8, 0x78, 0x42, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xAD, 0x60, 0x08, 0x78, 0x43, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xAD, 0x60, 0x08, 0x78, 0x44, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xAF, 0x60, 0xC0, 0x78, 0x45, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xAD, 0x60, 0x0B, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x00, 0x60, 0x83, 0x64, 0x80, 0x29, 0x09, 0xFB, 0xAD, 0x60, 0xE6, 0x78, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x31, 0x60, 0x16, 0x78, 0x40, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x30, 0x60, 0xA1, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xB9, 0x60, 0x4B, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xB8, 0x60, 0xBB, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xB0, 0x60, 0x89, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xA1, 0xFF, 0xFF, 0xFF, 0x83, 0x3E, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xBB, 0x60, 0x25, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x01,
+	 0x41, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x01,
+	 0x42, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x01,
+	 0xB0, 0xFF, 0xB1, 0xFF, 0x40, 0xFF, 0x43, 0xFF, 0xBB, 0x60, 0x20, 0x78, 0x44, 0xFF, 0xFF, 0x01,
+	 0xBB, 0x60, 0x25, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x01,
+	 0x33, 0x60, 0x9B, 0x78, 0x45, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x01,
+	 0xBB, 0x60, 0x20, 0x78, 0x84, 0xE2, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x01,
+	 0xBB, 0x60, 0x1F, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x01,
+	 0xBF, 0x60, 0xDB, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xEB, 0x60, 0x1F, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xBF, 0x60, 0xE3, 0x78, 0x42, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xBF, 0x60, 0xE3, 0x78, 0x24, 0xE2, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xE9, 0x60, 0xE3, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xBF, 0x60, 0xE3, 0x78, 0x44, 0xE2, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xBF, 0x60, 0xE3, 0x78, 0x84, 0xE2, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xBF, 0x60, 0xE3, 0x78, 0x47, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x24, 0x60, 0xE5, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x25, 0x60, 0x14, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x25, 0x60, 0x32, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x25, 0x60, 0x11, 0x78, 0x28, 0xE2, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x25, 0x60, 0x11, 0x78, 0x44, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x25, 0x60, 0x11, 0x78, 0x45, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x25, 0x60, 0x11, 0x78, 0x46, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x00, 0x60, 0x87, 0x64, 0x80, 0x29, 0x09, 0xFB, 0x47, 0xFF, 0x25, 0x60, 0x11, 0x78, 0xFF, 0xFF,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x2F, 0x60, 0x63, 0x78, 0x42, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x2F, 0x60, 0xB3, 0x78, 0x47, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x30, 0x44, 0x02, 0xA8, 0x00, 0xE1, 0x07, 0x02, 0x62, 0xFF, 0x63, 0xFF, 0x64, 0xFF, 0x65, 0xFF,
+	 0x66, 0xFF, 0xBF, 0xFE, 0xA1, 0xFF, 0x82, 0xFF, 0x88, 0xFF, 0x6C, 0x40, 0x41, 0xFF, 0xC4, 0xE2,
+	 0x43, 0xFF, 0x5C, 0x49, 0x08, 0xE1, 0xA2, 0x60, 0x16, 0x78, 0xFF, 0xFF, 0xA1, 0xFF, 0x98, 0xFF,
+	 0x80, 0x3E, 0x9F, 0xFE, 0x03, 0x04, 0x31, 0x60, 0x75, 0x78, 0xFF, 0xFF, 0xE2, 0xFE, 0x40, 0x05,
+	 0xE0, 0xFE, 0x5B, 0x05, 0xE1, 0xFE, 0xF2, 0x04, 0x29, 0x40, 0x08, 0x26, 0xEF, 0x01, 0x72, 0x44,
+	 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xB5, 0xF3, 0xE8, 0x85, 0xFF, 0xB7,
+	 0xE0, 0x84, 0xE0, 0x84, 0xB4, 0x85, 0x73, 0x44, 0xD4, 0x84, 0x10, 0x65, 0xD4, 0x80, 0xFF, 0xFF,
+	 0x26, 0x04, 0x3F, 0x40, 0x40, 0x26, 0x13, 0x00, 0x0B, 0x60, 0xF8, 0x62, 0xA2, 0xD1, 0x00, 0x60,
+	 0x10, 0x64, 0x90, 0x84, 0xA0, 0x50, 0xF8, 0xA2, 0xA2, 0xD1, 0x0A, 0x60, 0x19, 0x64, 0x90, 0x84,
+	 0xA0, 0x52, 0x06, 0xA2, 0xA2, 0xD1, 0x46, 0x60, 0x09, 0x64, 0x90, 0x84, 0xA0, 0x50, 0xF2, 0xF4,
+	 0x31, 0x60, 0x18, 0x7C, 0x63, 0x40, 0x01, 0x26, 0x08, 0x00, 0xA4, 0xD3, 0xFF, 0xFF, 0x01, 0xB4,
+	 0xFF, 0xFF, 0x03, 0x02, 0xAD, 0x4F, 0xFE, 0xB4, 0xA0, 0x5D, 0x02, 0xEE, 0xBD, 0xFE, 0xBE, 0x01,
+	 0x21, 0x46, 0x5E, 0x62, 0x9A, 0xFF, 0x07, 0xE1, 0xA1, 0xFF, 0xFF, 0xFF, 0x06, 0x25, 0x10, 0x00,
+	 0xA2, 0xDC, 0x7A, 0xDC, 0x7A, 0xDC, 0x62, 0x62, 0x01, 0x5D, 0x7A, 0xDC, 0x7A, 0xDC, 0x7A, 0xDC,
+	 0x7A, 0xDC, 0x44, 0xFF, 0x06, 0x25, 0x04, 0x00, 0x0E, 0xE1, 0x02, 0x60, 0x01, 0xE1, 0x9E, 0x01,
+	 0x62, 0xFF, 0xC4, 0xE2, 0x41, 0xFF, 0x0A, 0xE1, 0x99, 0x01, 0xC8, 0x74, 0xCD, 0xE2, 0x29, 0x44,
+	 0x08, 0xBC, 0x40, 0x49, 0x05, 0xE1, 0x31, 0x60, 0x1A, 0x63, 0xA3, 0xD3, 0xF2, 0xF3, 0x06, 0x18,
+	 0x28, 0x40, 0x08, 0x2A, 0x05, 0x00, 0x28, 0x40, 0x48, 0x36, 0x02, 0x00, 0x02, 0xBC, 0xF2, 0xFB,
+	 0x3F, 0x40, 0x01, 0x2B, 0xFF, 0xFF, 0xA1, 0xFF, 0x67, 0x4C, 0x06, 0x61, 0xCD, 0x81, 0x04, 0x25,
+	 0x30, 0x00, 0x87, 0x4C, 0xFB, 0x02, 0x28, 0x40, 0x40, 0x2B, 0x02, 0x00, 0x15, 0x60, 0x6F, 0x6B,
+	 0xF3, 0x60, 0xA0, 0x64, 0x04, 0x25, 0x25, 0x00, 0x80, 0x4C, 0x30, 0x64, 0x3A, 0xDB, 0x44, 0xFF,
+	 0x04, 0x25, 0x1F, 0x00, 0x04, 0x60, 0x00, 0x65, 0x25, 0x44, 0x37, 0x36, 0xB4, 0x84, 0x6E, 0x36,
+	 0xB4, 0x84, 0x80, 0x4E, 0x24, 0x41, 0x04, 0x25, 0x14, 0x00, 0x61, 0x4C, 0x64, 0xA1, 0x61, 0x54,
+	 0xA1, 0xFF, 0xFF, 0xFF, 0x04, 0x25, 0x0D, 0x00, 0x67, 0x4E, 0x07, 0x64, 0x1C, 0xFB, 0x00, 0xE1,
+	 0x02, 0x60, 0x01, 0xE1, 0x53, 0x01, 0x33, 0xF3, 0xFD, 0x11, 0xFC, 0x18, 0x40, 0x64, 0x3A, 0xDB,
+	 0x0A, 0x00, 0xC4, 0xE2, 0x27, 0x44, 0x20, 0x2A, 0x04, 0x00, 0x42, 0x64, 0x3A, 0xDB, 0x67, 0x4C,
+	 0x02, 0x00, 0x41, 0x64, 0x3A, 0xDB, 0x62, 0xFF, 0x08, 0xE1, 0xE2, 0xFE, 0x72, 0x52, 0x5C, 0x49,
+	 0x32, 0x7B, 0x4D, 0xE2, 0x3B, 0x01, 0x08, 0xE1, 0x39, 0x01, 0xA1, 0xFF, 0x98, 0xFF, 0x80, 0x3E,
+	 0x30, 0x44, 0x02, 0xA8, 0x00, 0xE1, 0x02, 0x02, 0xA1, 0xFF, 0xFF, 0xFF, 0x82, 0xFF, 0x88, 0xFF,
+	 0x48, 0xE2, 0x01, 0x70, 0xCE, 0xF1, 0x00, 0x6B, 0x89, 0xFF, 0x64, 0x54, 0x88, 0xFF, 0x9F, 0xFE,
+	 0x02, 0x05, 0x64, 0x44, 0x60, 0x54, 0xCD, 0xE2, 0xC2, 0x64, 0x3A, 0xDB, 0xBC, 0xFF, 0xB5, 0xFF,
+	 0x1D, 0xFF, 0x26, 0x44, 0x02, 0xB4, 0x40, 0x46, 0x3C, 0x44, 0x00, 0xBC, 0xFF, 0xFF, 0x06, 0x03,
+	 0x27, 0x40, 0x26, 0x22, 0x03, 0x00, 0x02, 0x64, 0x31, 0xFB, 0xC0, 0xFE, 0x27, 0x44, 0x20, 0x2A,
+	 0x04, 0x00, 0xA0, 0x60, 0x00, 0xEA, 0xB0, 0x60, 0x00, 0xEA, 0x5C, 0x4D, 0x27, 0x44, 0x18, 0xB4,
+	 0x40, 0x47, 0x00, 0xE1, 0x6C, 0x40, 0x44, 0xE2, 0xC4, 0xE2, 0x47, 0xFF, 0xB7, 0xFF, 0xB4, 0xFF,
+	 0x32, 0xF1, 0x08, 0x29, 0x09, 0x00, 0x64, 0x40, 0x07, 0x22, 0x06, 0x00, 0x43, 0xFF, 0x27, 0x44,
+	 0x10, 0xBC, 0x40, 0x47, 0x00, 0x64, 0x32, 0xFB, 0x31, 0x41, 0x3C, 0x44, 0x01, 0xB1, 0x00, 0xBC,
+	 0x0A, 0x02, 0x09, 0x03, 0x32, 0xF3, 0x00, 0x7C, 0x01, 0xB4, 0xFF, 0xFF, 0x04, 0x03, 0x32, 0xF9,
+	 0x02, 0x64, 0x31, 0xFB, 0xC0, 0xFE, 0x48, 0x60, 0x2D, 0x7D, 0x08, 0x60, 0x00, 0x6B, 0x00, 0x64,
+	 0x33, 0xFB, 0x0C, 0x60, 0x16, 0x64, 0xA0, 0xD7, 0xFF, 0xFF, 0xFF, 0xFF, 0x32, 0xF3, 0x08, 0x29,
+	 0x0A, 0x00, 0x60, 0x40, 0x07, 0x22, 0x07, 0x00, 0xFE, 0xB4, 0x32, 0xFB, 0x27, 0x44, 0x10, 0xBC,
+	 0xF7, 0xB4, 0x40, 0x47, 0x43, 0xFF, 0x00, 0x64, 0x3A, 0xDB, 0x01, 0x60, 0x08, 0xE1, 0x31, 0x40,
+	 0x01, 0x2A, 0x04, 0x00, 0x00, 0x64, 0x33, 0xFB, 0x01, 0x60, 0x0A, 0xE1, 0xE5, 0xFE, 0x1D, 0x05,
+	 0x27, 0x44, 0x10, 0x26, 0x1D, 0x00, 0x9F, 0xFE, 0x02, 0x04, 0x02, 0xE1, 0x10, 0x00, 0x3E, 0xE1,
+	 0x31, 0x44, 0x01, 0x2A, 0x0C, 0x00, 0x0E, 0x0A, 0x28, 0x44, 0x04, 0x27, 0x07, 0x00, 0xD4, 0x36,
+	 0x05, 0x00, 0xC4, 0x36, 0x03, 0x00, 0xAE, 0x4F, 0xF7, 0xB4, 0xA0, 0x5E, 0xBF, 0xE1, 0xA1, 0xFF,
+	 0xFF, 0xFF, 0x81, 0x3E, 0xAB, 0x60, 0x2C, 0x78, 0xFF, 0xFF, 0xA3, 0x60, 0xEC, 0x78, 0xFF, 0xFF,
+	 0x27, 0x44, 0x08, 0x26, 0xFF, 0xFF, 0xBA, 0x60, 0x70, 0x78, 0xFF, 0xFF, 0x48, 0xF3, 0x32, 0xF1,
+	 0x00, 0x63, 0x64, 0x40, 0x03, 0x22, 0x66, 0x00, 0x31, 0x40, 0x08, 0x26, 0xF4, 0x01, 0xCD, 0xE2,
+	 0x84, 0xE1, 0x70, 0x41, 0xAD, 0x80, 0x71, 0x40, 0x80, 0x27, 0xED, 0x12, 0x03, 0x03, 0xBA, 0x60,
+	 0xE7, 0x78, 0xFF, 0xFF, 0xA1, 0xFF, 0xFF, 0xFF, 0xC4, 0xE2, 0x32, 0xFD, 0x60, 0x40, 0x01, 0x2A,
+	 0xDF, 0x01, 0x00, 0x63, 0x32, 0xFD, 0x6C, 0x40, 0x3C, 0x46, 0x3E, 0xF2, 0x2A, 0xF0, 0x27, 0x41,
+	 0x44, 0x48, 0x20, 0xB9, 0x01, 0xB4, 0xF7, 0xB1, 0x0A, 0x03, 0x64, 0x40, 0x08, 0x27, 0x07, 0x00,
+	 0x0F, 0x60, 0x92, 0x63, 0x00, 0x64, 0x45, 0xFB, 0x46, 0xFB, 0xBD, 0xDB, 0xA3, 0xDB, 0xCB, 0x0A,
+	 0x31, 0x60, 0x0E, 0x7C, 0xA4, 0xD3, 0xFF, 0xFF, 0x17, 0x18, 0x28, 0x40, 0xD4, 0x36, 0x14, 0x00,
+	 0xAC, 0x4C, 0x80, 0x2A, 0x11, 0x00, 0x31, 0x60, 0x14, 0x7C, 0xA4, 0xD3, 0xFF, 0xFF, 0x0C, 0x18,
+	 0x31, 0x60, 0x16, 0x7C, 0xA4, 0xD3, 0x31, 0x60, 0x10, 0x7C, 0xA4, 0xD3, 0x60, 0x45, 0xD4, 0x80,
+	 0xDC, 0x84, 0x02, 0x03, 0xA4, 0xDB, 0xAF, 0x01, 0x31, 0x60, 0x10, 0x7C, 0x00, 0x64, 0xA4, 0xDB,
+	 0x41, 0x47, 0x3F, 0x40, 0x01, 0x2B, 0x0D, 0x00, 0xF6, 0xFE, 0x67, 0x4C, 0x05, 0x60, 0x69, 0x6B,
+	 0x31, 0x60, 0x0E, 0x7C, 0xA4, 0xD3, 0xFF, 0xFF, 0x04, 0x18, 0xAE, 0x4F, 0x08, 0xBC, 0x00, 0x7F,
+	 0xA0, 0x5E, 0x02, 0xE1, 0x01, 0x60, 0x08, 0xE1, 0xF0, 0xFE, 0x84, 0xFF, 0xBB, 0x60, 0x18, 0x64,
+	 0x40, 0x42, 0x82, 0xFF, 0xE5, 0xFE, 0x03, 0x04, 0xA8, 0x60, 0x24, 0x78, 0xFF, 0xFF, 0xE4, 0xFE,
+	 0x0A, 0x04, 0x1D, 0xFF, 0x00, 0xEB, 0x60, 0x7F, 0xA0, 0x5A, 0x80, 0x60, 0x00, 0xEA, 0xA0, 0x60,
+	 0x00, 0xEA, 0xD1, 0x60, 0x00, 0xEA, 0x43, 0xFF, 0xE6, 0xFE, 0x03, 0x05, 0xA3, 0x60, 0x4B, 0x78,
+	 0xFF, 0xFF, 0x3C, 0x44, 0x60, 0x46, 0x0F, 0xF0, 0x40, 0x42, 0x64, 0x40, 0x01, 0x2A, 0x03, 0x00,
+	 0xA6, 0x60, 0xB1, 0x78, 0xFF, 0xFF, 0x0B, 0x64, 0x3A, 0xDB, 0x1C, 0x42, 0x22, 0x46, 0x13, 0xF2,
+	 0xFF, 0x65, 0x60, 0x47, 0x2A, 0xF2, 0x40, 0x45, 0x40, 0x48, 0x04, 0x2B, 0x17, 0x00, 0x16, 0xF2,
+	 0x1D, 0xF2, 0x40, 0x43, 0x0F, 0xF2, 0x40, 0x44, 0x25, 0x5E, 0x3F, 0x40, 0x01, 0x27, 0x40, 0x45,
+	 0x0F, 0x64, 0x14, 0xF0, 0x35, 0xF2, 0xA0, 0x82, 0x0F, 0xB4, 0xCA, 0x85, 0xD4, 0x80, 0x10, 0xF2,
+	 0x01, 0x02, 0x2B, 0xFA, 0x27, 0x44, 0x40, 0xBC, 0x40, 0x47, 0x13, 0x00, 0x17, 0xF2, 0x2C, 0xF0,
+	 0x40, 0x43, 0x1B, 0xF2, 0x1D, 0xFA, 0x40, 0x44, 0x64, 0x40, 0x01, 0x2A, 0x02, 0x00, 0xAB, 0xFC,
+	 0x05, 0x00, 0x28, 0x40, 0xA4, 0x36, 0x02, 0x00, 0x11, 0xF2, 0x2B, 0xFA, 0x27, 0x44, 0xBF, 0xB4,
+	 0x40, 0x47, 0x28, 0x40, 0x40, 0x2B, 0xFF, 0xFF, 0xAB, 0x60, 0x4A, 0x78, 0xFF, 0xFF, 0x22, 0x46,
+	 0x2C, 0xF0, 0x27, 0x44, 0xDF, 0xB4, 0x40, 0x47, 0xB5, 0xFF, 0xBC, 0xFF, 0x47, 0xFF, 0xB7, 0xFF,
+	 0xB4, 0xFF, 0x48, 0x60, 0x2D, 0x7D, 0x08, 0x60, 0x00, 0x6B, 0x64, 0x40, 0x01, 0x2A, 0x09, 0x00,
+	 0x28, 0x44, 0x04, 0x27, 0x05, 0x00, 0xD4, 0x3A, 0x03, 0x00, 0xAE, 0x4F, 0xF7, 0xB4, 0xA0, 0x5E,
+	 0x1B, 0x00, 0x2A, 0xF0, 0x01, 0x65, 0x64, 0x40, 0xA4, 0x3A, 0x04, 0x65, 0x27, 0x44, 0x34, 0x87,
+	 0x36, 0xF3, 0xB4, 0xFF, 0x60, 0x5B, 0x4D, 0xE2, 0x04, 0x64, 0x3A, 0xDB, 0x01, 0x60, 0x0A, 0xE1,
+	 0x28, 0x44, 0x04, 0x27, 0x05, 0x00, 0xD4, 0x3A, 0x03, 0x00, 0xAE, 0x4F, 0xF7, 0xB4, 0xA0, 0x5E,
+	 0x2B, 0xE1, 0xA1, 0xFF, 0xFF, 0xFF, 0x81, 0x3E, 0x06, 0x64, 0x3A, 0xDB, 0x22, 0x46, 0x01, 0x64,
+	 0x31, 0xFB, 0xC0, 0xFE, 0xBA, 0x60, 0xF0, 0x78, 0xFF, 0xFF, 0xB5, 0xFF, 0xA1, 0xFF, 0x6C, 0x40,
+	 0x3F, 0x40, 0x01, 0x2B, 0x03, 0x00, 0x67, 0x4C, 0x05, 0x60, 0x69, 0x6B, 0x02, 0xE1, 0x01, 0x60,
+	 0x08, 0xE1, 0xC4, 0xE2, 0x08, 0x64, 0x3A, 0xDB, 0xF0, 0xFE, 0x25, 0x46, 0x01, 0xF2, 0x61, 0x45,
+	 0xD4, 0x9E, 0x21, 0x46, 0x16, 0xFA, 0x2A, 0x44, 0x72, 0x45, 0x24, 0xFA, 0xB5, 0xF3, 0x06, 0x04,
+	 0xE4, 0xE2, 0xDC, 0x9C, 0x29, 0x40, 0x01, 0x26, 0x64, 0x44, 0xB5, 0xF9, 0x25, 0xFA, 0xB6, 0xF3,
+	 0x02, 0x04, 0xDC, 0x84, 0xB6, 0xFB, 0x28, 0xFA, 0xB7, 0xF3, 0x02, 0x04, 0xDC, 0x84, 0xB7, 0xFB,
+	 0x29, 0xFA, 0x2D, 0x44, 0x04, 0x2A, 0x06, 0x00, 0x28, 0x40, 0xA4, 0x36, 0x03, 0x00, 0xA5, 0x60,
+	 0x77, 0x78, 0xFF, 0xFF, 0x26, 0x43, 0x84, 0xBB, 0xFC, 0xB3, 0x21, 0x46, 0x01, 0x5D, 0x0F, 0xFC,
+	 0x5C, 0x46, 0x25, 0x44, 0x06, 0xFA, 0x05, 0xFF, 0x27, 0x44, 0x01, 0x2A, 0x13, 0x00, 0x50, 0xFE,
+	 0x28, 0x40, 0x08, 0x3A, 0x12, 0x00, 0x2F, 0xF2, 0x30, 0xF0, 0x60, 0x43, 0x31, 0xF2, 0x22, 0x46,
+	 0x64, 0x41, 0x2C, 0xF0, 0x2D, 0xF0, 0xD3, 0x80, 0x2E, 0xF0, 0xD1, 0x80, 0xD0, 0x80, 0x27, 0x44,
+	 0x09, 0x0C, 0x03, 0x00, 0x27, 0x44, 0x06, 0x22, 0x05, 0x00, 0xB8, 0xB4, 0x40, 0x47, 0x02, 0x64,
+	 0x31, 0xFB, 0xC0, 0xFE, 0xD4, 0x64, 0x40, 0x48, 0x0D, 0x64, 0x3A, 0xDB, 0x31, 0x60, 0x12, 0x7C,
+	 0x7C, 0x44, 0xA4, 0xDB, 0x21, 0x46, 0x1C, 0xF2, 0x7C, 0xF1, 0xFF, 0xB4, 0xD0, 0x80, 0xFF, 0xFF,
+	 0x01, 0x06, 0x64, 0x44, 0x40, 0x45, 0x0A, 0x36, 0x70, 0x64, 0x14, 0x36, 0x38, 0x64, 0x37, 0x3A,
+	 0x03, 0x00, 0x04, 0x7F, 0x40, 0x45, 0x15, 0x64, 0x6E, 0x3A, 0x03, 0x00, 0x84, 0x7F, 0x40, 0x45,
+	 0x0B, 0x64, 0x40, 0x44, 0x00, 0x63, 0x28, 0x44, 0xA4, 0x36, 0x0B, 0x00, 0x04, 0x2B, 0x09, 0x00,
+	 0x30, 0xF3, 0x24, 0x45, 0xD4, 0x84, 0xCA, 0x65, 0xD4, 0x83, 0x31, 0x60, 0x12, 0x7C, 0x01, 0x64,
+	 0xA4, 0xDB, 0xD4, 0x64, 0x1A, 0x00, 0x0F, 0x64, 0x3A, 0xDB, 0x21, 0x46, 0x70, 0x63, 0x1C, 0xF2,
+	 0xCA, 0x65, 0x40, 0x45, 0x0A, 0x36, 0x70, 0x64, 0x14, 0x36, 0x38, 0x64, 0x37, 0x3A, 0x03, 0x00,
+	 0x04, 0x7F, 0x40, 0x45, 0x15, 0x64, 0x6E, 0x3A, 0x03, 0x00, 0x84, 0x7F, 0x40, 0x45, 0x0B, 0x64,
+	 0x40, 0x44, 0x2B, 0xF2, 0xC4, 0x85, 0xD4, 0x83, 0xC4, 0x64, 0x40, 0x48, 0x2F, 0xF0, 0xB0, 0xF0,
+	 0xB1, 0xF2, 0x00, 0xE1, 0xA1, 0xFF, 0xFF, 0xFF, 0x80, 0x4E, 0x83, 0x4C, 0x9A, 0xFF, 0x84, 0x4C,
+	 0x85, 0x4C, 0x81, 0x4C, 0xA1, 0xFF, 0x98, 0xFF, 0x87, 0x4F, 0x87, 0x4C, 0x87, 0x4F, 0x87, 0x4D,
+	 0x87, 0x4C, 0x01, 0x08, 0x01, 0x00, 0xFF, 0xFF, 0x87, 0x4C, 0x87, 0x4C, 0x87, 0x4C, 0x87, 0x4C,
+	 0xFF, 0xFF, 0xFF, 0xFF, 0x6A, 0x44, 0xBC, 0xFF, 0xC4, 0xE2, 0x0C, 0x74, 0x04, 0xE1, 0xA1, 0xFF,
+	 0x35, 0xF3, 0xC4, 0xE2, 0x60, 0x54, 0x89, 0xFF, 0x13, 0x74, 0x88, 0xFF, 0xB5, 0xFF, 0x47, 0xFF,
+	 0x29, 0x44, 0xF7, 0xB4, 0x40, 0x49, 0xB7, 0xFF, 0xB4, 0xFF, 0x48, 0x60, 0x2D, 0x7D, 0x08, 0x60,
+	 0x00, 0x6B, 0x28, 0x40, 0xC4, 0x36, 0x08, 0x00, 0x31, 0x60, 0x12, 0x7C, 0xA4, 0xD3, 0xFF, 0xFF,
+	 0x03, 0x1B, 0xAE, 0x4F, 0xF7, 0xB4, 0xA0, 0x5E, 0x27, 0x44, 0x01, 0x2A, 0x05, 0x00, 0xFE, 0xB4,
+	 0x40, 0x47, 0xA4, 0x60, 0x7C, 0x78, 0xFF, 0xFF, 0xA3, 0x60, 0x3E, 0x78, 0xFF, 0xFF, 0x28, 0x40,
+	 0xB4, 0x3A, 0x09, 0x00, 0x27, 0x44, 0x07, 0x22, 0x05, 0x00, 0xF8, 0xB4, 0x40, 0x47, 0x02, 0x64,
+	 0x31, 0xFB, 0xC0, 0xFE, 0x90, 0x01, 0x28, 0x44, 0xD4, 0x36, 0x03, 0x00, 0xA6, 0x60, 0x98, 0x78,
+	 0xFF, 0xFF, 0x48, 0xE2, 0x27, 0x44, 0xFB, 0xB4, 0x40, 0x47, 0x2D, 0x60, 0x5A, 0x63, 0xA3, 0xD3,
+	 0xB0, 0x60, 0x58, 0x4D, 0xD8, 0x78, 0xFF, 0xFF, 0x34, 0xFB, 0x1C, 0x42, 0x22, 0x46, 0x2A, 0xF0,
+	 0xF7, 0x60, 0xFF, 0x64, 0xA0, 0x84, 0xA2, 0xDA, 0x60, 0x40, 0x40, 0x2B, 0xCC, 0x00, 0x22, 0xF2,
+	 0xFF, 0xFF, 0x60, 0x40, 0x22, 0x26, 0x42, 0x00, 0x01, 0x26, 0x03, 0x00, 0x04, 0x26, 0x07, 0x00,
+	 0xC2, 0x00, 0x04, 0x2B, 0xC0, 0x00, 0xA9, 0xF3, 0xFF, 0xFF, 0x60, 0x46, 0x01, 0x00, 0x07, 0xF4,
+	 0x47, 0xF2, 0xFF, 0xFF, 0xDC, 0x84, 0x47, 0xFA, 0x0D, 0x60, 0x3E, 0x62, 0x80, 0xFF, 0xBE, 0x60,
+	 0x78, 0x44, 0x02, 0xA4, 0xA2, 0xDB, 0xDE, 0x78, 0xFF, 0xFF, 0x82, 0xFF, 0xA9, 0xF3, 0x66, 0x5C,
+	 0xD0, 0x80, 0x00, 0x7C, 0x07, 0x03, 0x66, 0x43, 0x22, 0x46, 0x22, 0xF2, 0x63, 0x46, 0x60, 0x40,
+	 0x01, 0x2A, 0x01, 0x00, 0x3C, 0xF1, 0x47, 0xF0, 0x64, 0x41, 0x64, 0x47, 0xFF, 0xB4, 0x60, 0x5F,
+	 0x20, 0xBC, 0x80, 0x26, 0x80, 0xAC, 0x60, 0x47, 0x22, 0x46, 0x3A, 0xFA, 0x64, 0x44, 0x20, 0x7F,
+	 0x34, 0x94, 0x3B, 0xFA, 0x08, 0x60, 0x00, 0xEA, 0x0F, 0x64, 0x60, 0x7F, 0xA0, 0x5A, 0x80, 0x60,
+	 0x00, 0xEA, 0xA0, 0x60, 0x00, 0xEA, 0xD1, 0x60, 0x00, 0xEA, 0x85, 0x00, 0x2A, 0xF2, 0x00, 0x60,
+	 0x7C, 0x62, 0x60, 0x40, 0x40, 0x2B, 0x27, 0x00, 0xA2, 0xD3, 0x00, 0x61, 0x60, 0xFE, 0xA0, 0xD3,
+	 0xDE, 0x82, 0xA2, 0xD1, 0xFF, 0xFF, 0x20, 0xFE, 0x64, 0x5F, 0xDC, 0x84, 0xF1, 0x81, 0xC0, 0x2B,
+	 0x04, 0x00, 0x80, 0x2A, 0x02, 0x00, 0x7F, 0xA4, 0xDC, 0x84, 0xFF, 0x3B, 0x03, 0x00, 0x60, 0x47,
+	 0xDC, 0x87, 0x01, 0x61, 0xC0, 0x80, 0x00, 0x36, 0xDC, 0x84, 0x4E, 0xDB, 0x60, 0xFE, 0xDA, 0x82,
+	 0xA2, 0xD1, 0xFF, 0xFF, 0xC1, 0x84, 0xF0, 0x22, 0x10, 0xA4, 0xF0, 0x2A, 0x01, 0x00, 0x00, 0x64,
+	 0xA2, 0xDB, 0xFF, 0xFF, 0x20, 0xFE, 0x00, 0x60, 0x7C, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0xA0, 0xD3,
+	 0x5A, 0xD1, 0x3A, 0xFA, 0x3B, 0xF8, 0x74, 0x62, 0xA2, 0xD0, 0xFF, 0xFF, 0x64, 0x44, 0xE0, 0x7F,
+	 0xA0, 0x5A, 0x64, 0x47, 0xE1, 0x7F, 0x5A, 0xD0, 0xA0, 0x5A, 0x64, 0x44, 0xE2, 0x7F, 0xA0, 0x5A,
+	 0x00, 0x60, 0x80, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0xA0, 0xD1, 0x5A, 0xD1, 0x64, 0x45, 0x64, 0x44,
+	 0xE3, 0x7F, 0xA0, 0x5A, 0x64, 0x47, 0xE4, 0x7F, 0x5A, 0xD1, 0xA0, 0x5A, 0x64, 0x44, 0xE5, 0x7F,
+	 0xA0, 0x5A, 0x64, 0x47, 0xE6, 0x7F, 0x5A, 0xD1, 0xA0, 0x5A, 0x64, 0x44, 0xE7, 0x7F, 0xA0, 0x5A,
+	 0x65, 0x40, 0x0D, 0x3A, 0x1C, 0x00, 0x64, 0x47, 0xE8, 0x7F, 0x5A, 0xD1, 0xA0, 0x5A, 0x64, 0x44,
+	 0xE9, 0x7F, 0xA0, 0x5A, 0x64, 0x47, 0xEA, 0x7F, 0x5A, 0xD1, 0xA0, 0x5A, 0x64, 0x44, 0xEB, 0x7F,
+	 0xA0, 0x5A, 0x64, 0x47, 0xEC, 0x7F, 0x5A, 0xD1, 0xA0, 0x5A, 0x64, 0x44, 0xED, 0x7F, 0xA0, 0x5A,
+	 0x64, 0x47, 0xEE, 0x7F, 0x5A, 0xD1, 0xA0, 0x5A, 0x64, 0x44, 0xEF, 0x7F, 0xA0, 0x5A, 0x08, 0x60,
+	 0x00, 0xEA, 0x65, 0x44, 0x02, 0xA4, 0x60, 0x7F, 0xA0, 0x5A, 0x80, 0x60, 0x00, 0xEA, 0xA0, 0x60,
+	 0x00, 0xEA, 0xD1, 0x60, 0x00, 0xEA, 0x0B, 0xF2, 0xFF, 0xFF, 0x7F, 0xB4, 0x0C, 0xF0, 0x04, 0x02,
+	 0x64, 0x46, 0x00, 0xF0, 0x04, 0x64, 0x22, 0x46, 0x03, 0xFA, 0x60, 0x41, 0x64, 0x46, 0x01, 0xF2,
+	 0xFC, 0xA1, 0x61, 0x45, 0xD4, 0x84, 0xFF, 0xFF, 0x08, 0x02, 0x00, 0xF0, 0x04, 0x63, 0x64, 0x46,
+	 0x01, 0xF2, 0x22, 0x46, 0x1A, 0xFA, 0x03, 0xFC, 0x02, 0x00, 0x22, 0x46, 0x1A, 0xFA, 0x35, 0xF2,
+	 0x04, 0xF8, 0xDC, 0x84, 0x35, 0xFA, 0x14, 0xF2, 0x0F, 0xB5, 0x0F, 0xB4, 0xCC, 0x84, 0x94, 0x80,
+	 0x04, 0x60, 0x00, 0x65, 0x2A, 0xF2, 0x01, 0x02, 0x94, 0x84, 0x2A, 0xFA, 0x95, 0xFC, 0x06, 0x00,
+	 0xC4, 0x3A, 0x07, 0x00, 0x27, 0x44, 0xFD, 0xB4, 0x40, 0x47, 0x48, 0xE2, 0xA4, 0x60, 0x0B, 0x78,
+	 0xFF, 0xFF, 0x28, 0x44, 0x04, 0x26, 0x05, 0x00, 0x68, 0x3A, 0x03, 0x00, 0x32, 0x44, 0x00, 0x27,
+	 0x03, 0x00, 0xA3, 0x60, 0x4B, 0x78, 0xFF, 0xFF, 0x0A, 0x64, 0x3A, 0xDB, 0xA3, 0x60, 0x4B, 0x78,
+	 0xFF, 0xFF, 0x0E, 0x64, 0x3A, 0xDB, 0x10, 0x60, 0x00, 0x65, 0x3C, 0x46, 0x2A, 0xF2, 0x13, 0xF0,
+	 0xA4, 0x84, 0xB4, 0xBC, 0x40, 0x48, 0x7C, 0xF1, 0x64, 0x47, 0xFF, 0xB4, 0x60, 0x45, 0xD0, 0x80,
+	 0x70, 0x61, 0x01, 0x06, 0x64, 0x44, 0x0A, 0x36, 0x70, 0x64, 0x14, 0x36, 0x38, 0x64, 0x37, 0x36,
+	 0x15, 0x64, 0x6E, 0x36, 0x0B, 0x64, 0x40, 0x4E, 0xA0, 0x63, 0x0A, 0x64, 0x65, 0x40, 0x0A, 0x36,
+	 0x03, 0x00, 0x38, 0x61, 0x14, 0x64, 0xEB, 0x83, 0x40, 0x45, 0x43, 0x44, 0x02, 0x60, 0x5E, 0x65,
+	 0x2A, 0xF2, 0x2B, 0xF2, 0x60, 0x40, 0x04, 0x2B, 0x04, 0x00, 0x2E, 0x45, 0xD4, 0x85, 0xC5, 0x84,
+	 0x05, 0x00, 0x1B, 0xF0, 0xC5, 0x84, 0xC0, 0x84, 0x2E, 0x45, 0xC4, 0x84, 0x60, 0x43, 0x28, 0x44,
+	 0x00, 0xE1, 0xA1, 0xFF, 0x80, 0x4E, 0x83, 0x4C, 0x9A, 0xFF, 0x56, 0x62, 0x7A, 0xD4, 0x7A, 0xD4,
+	 0x7A, 0xD4, 0x5C, 0x62, 0x7A, 0xD4, 0x7A, 0xD4, 0x7A, 0xD4, 0xA1, 0xFF, 0x98, 0xFF, 0x87, 0x4F,
+	 0x87, 0x4C, 0x87, 0x4F, 0x87, 0x4D, 0x87, 0x4C, 0x01, 0x08, 0x01, 0x00, 0xFF, 0xFF, 0x87, 0x4C,
+	 0x87, 0x4C, 0x87, 0x4C, 0x87, 0x4C, 0xFF, 0xFF, 0xFF, 0xFF, 0x6A, 0x44, 0xBC, 0xFF, 0xB5, 0xFF,
+	 0x47, 0xFF, 0x27, 0x44, 0x02, 0xBC, 0x40, 0x47, 0x36, 0xF3, 0xB7, 0xFF, 0xB4, 0xFF, 0x48, 0x60,
+	 0x2D, 0x7D, 0x08, 0x60, 0x00, 0x6B, 0x60, 0x5B, 0x4D, 0xE2, 0xA4, 0x60, 0x6C, 0x78, 0xFF, 0xFF,
+	 0x21, 0x46, 0xB5, 0xFF, 0xBC, 0xFF, 0x47, 0xFF, 0xB7, 0xFF, 0xB4, 0xFF, 0x48, 0x60, 0x2D, 0x7D,
+	 0x08, 0x60, 0x00, 0x6B, 0x28, 0x44, 0x04, 0x27, 0x09, 0x00, 0xD4, 0x36, 0x04, 0x00, 0x0C, 0x22,
+	 0x02, 0x00, 0x0C, 0x3A, 0x03, 0x00, 0xAE, 0x4F, 0xF7, 0xB4, 0xA0, 0x5E, 0x26, 0x43, 0x25, 0x44,
+	 0x06, 0xFA, 0x2A, 0x44, 0x72, 0x45, 0x24, 0xFA, 0xB5, 0xF3, 0x06, 0x04, 0xE4, 0xE2, 0xDC, 0x9C,
+	 0x29, 0x40, 0x01, 0x26, 0x64, 0x44, 0xB5, 0xF9, 0x25, 0xFA, 0xB6, 0xF3, 0x02, 0x04, 0xDC, 0x84,
+	 0xB6, 0xFB, 0x28, 0xFA, 0xB7, 0xF3, 0x02, 0x04, 0xDC, 0x84, 0xB7, 0xFB, 0x29, 0xFA, 0x2D, 0x40,
+	 0x01, 0x2A, 0x0E, 0x00, 0x1D, 0xFF, 0x26, 0x44, 0x02, 0xBC, 0x40, 0x46, 0x27, 0x44, 0x07, 0x22,
+	 0x05, 0x00, 0xF8, 0xB4, 0x40, 0x47, 0x06, 0x64, 0x31, 0xFB, 0xC0, 0xFE, 0x30, 0xF1, 0x76, 0x00,
+	 0xFC, 0xB3, 0x32, 0x40, 0x01, 0x2A, 0x06, 0x00, 0x0A, 0xBB, 0x0F, 0xFC, 0xCB, 0xFE, 0xA3, 0x60,
+	 0x4B, 0x78, 0xFF, 0xFF, 0x2D, 0x44, 0x04, 0x26, 0x28, 0x00, 0x0F, 0xFC, 0x05, 0xFF, 0xDC, 0xF3,
+	 0x28, 0x40, 0x80, 0x3A, 0x22, 0x00, 0x60, 0x40, 0x03, 0x3A, 0x1F, 0x00, 0x32, 0xF2, 0x81, 0xF1,
+	 0x33, 0xF2, 0xD0, 0x80, 0x82, 0xF1, 0x19, 0x02, 0xD0, 0x80, 0x34, 0xF2, 0x83, 0xF1, 0x15, 0x02,
+	 0xD0, 0x80, 0x3C, 0x44, 0x12, 0x02, 0xAC, 0x86, 0xBB, 0xFE, 0x0F, 0x03, 0x2A, 0xF2, 0x21, 0x46,
+	 0x60, 0x40, 0x80, 0x3A, 0x0A, 0x00, 0x01, 0x64, 0x31, 0xFB, 0xC0, 0xFE, 0x00, 0x64, 0x32, 0xFB,
+	 0x84, 0xFF, 0xBB, 0x60, 0x18, 0x64, 0x40, 0x42, 0x82, 0xFF, 0x30, 0xF1, 0x27, 0x44, 0x05, 0x22,
+	 0x2D, 0x00, 0xFA, 0xB4, 0x40, 0x47, 0x2D, 0x44, 0x10, 0x2A, 0x24, 0x00, 0x28, 0x40, 0xD4, 0x3A,
+	 0x21, 0x00, 0x31, 0x40, 0x08, 0x26, 0x00, 0x7C, 0x2B, 0x44, 0xD0, 0x80, 0x70, 0x45, 0x02, 0x28,
+	 0x64, 0x44, 0xC4, 0x84, 0xFF, 0xFF, 0x04, 0x24, 0x00, 0xB4, 0x60, 0x50, 0x08, 0x28, 0x01, 0x00,
+	 0x20, 0x29, 0x6D, 0xE2, 0x1C, 0x60, 0x9A, 0x63, 0x1D, 0xF0, 0xC0, 0x64, 0xC0, 0x84, 0xA3, 0xD1,
+	 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xC0, 0x84, 0xA3, 0xDB, 0xA4, 0x60,
+	 0x7C, 0x78, 0xFF, 0xFF, 0x02, 0x64, 0x31, 0xFB, 0xC0, 0xFE, 0x07, 0x00, 0x02, 0x2A, 0x05, 0x00,
+	 0xFD, 0xB4, 0x40, 0x47, 0x06, 0x64, 0x31, 0xFB, 0xC0, 0xFE, 0x05, 0x64, 0x3A, 0xDB, 0x28, 0x44,
+	 0xA4, 0x3A, 0x04, 0x00, 0x39, 0xF1, 0x25, 0x44, 0x0A, 0x36, 0x38, 0xF1, 0x31, 0x40, 0x08, 0x26,
+	 0x00, 0x7C, 0x2B, 0x44, 0xD0, 0x80, 0x70, 0x45, 0x02, 0x28, 0x64, 0x44, 0xC4, 0x84, 0xFF, 0xFF,
+	 0x04, 0x24, 0x00, 0xB4, 0x28, 0x40, 0xE4, 0x36, 0x00, 0xB4, 0x60, 0x50, 0x08, 0x28, 0x01, 0x00,
+	 0x20, 0x29, 0x6D, 0xE2, 0xA3, 0x60, 0x3E, 0x78, 0xFF, 0xFF, 0x21, 0x46, 0xB5, 0xFF, 0xBC, 0xFF,
+	 0x47, 0xFF, 0xB7, 0xFF, 0xB4, 0xFF, 0x48, 0x60, 0x2D, 0x7D, 0x08, 0x60, 0x00, 0x6B, 0xAE, 0x4F,
+	 0xF7, 0xB4, 0xA0, 0x5E, 0x27, 0x44, 0x07, 0x22, 0x05, 0x00, 0xF8, 0xB4, 0x40, 0x47, 0x06, 0x64,
+	 0x31, 0xFB, 0xC0, 0xFE, 0xE7, 0x01, 0x27, 0x44, 0x05, 0x22, 0x09, 0x00, 0xBA, 0xB4, 0x40, 0x47,
+	 0x3C, 0x46, 0x02, 0x64, 0x31, 0xFB, 0xC0, 0xFE, 0xA3, 0x60, 0x4B, 0x78, 0xFF, 0xFF, 0x27, 0x44,
+	 0x02, 0x2A, 0x06, 0x00, 0xFD, 0xB4, 0x40, 0x47, 0x06, 0x64, 0x31, 0xFB, 0xC0, 0xFE, 0xF4, 0x01,
+	 0xF3, 0x0A, 0x7C, 0x50, 0x6D, 0xE2, 0xF0, 0x01, 0x72, 0x45, 0xDC, 0x84, 0xB5, 0xFB, 0x11, 0x64,
+	 0x3A, 0xDB, 0xB6, 0xF3, 0x06, 0x04, 0xDC, 0x84, 0xB6, 0xFB, 0xB7, 0xF3, 0x02, 0x04, 0xDC, 0x84,
+	 0xB7, 0xFB, 0xA3, 0x60, 0x56, 0x78, 0xFF, 0xFF, 0x00, 0x61, 0x12, 0x64, 0x3A, 0xDB, 0x1E, 0x60,
+	 0xFE, 0x63, 0xBD, 0xD3, 0x72, 0x45, 0x44, 0x8A, 0x02, 0x28, 0x02, 0x00, 0xE4, 0xE2, 0xDD, 0x81,
+	 0x02, 0x28, 0x02, 0x00, 0xE4, 0xE2, 0xDD, 0x81, 0xBD, 0xD3, 0xB5, 0xF1, 0x61, 0x45, 0xC0, 0x84,
+	 0x00, 0x61, 0x02, 0x24, 0x01, 0xB9, 0xC4, 0x84, 0x60, 0x55, 0x2A, 0x52, 0xB5, 0xFB, 0x02, 0x24,
+	 0x01, 0xB9, 0xBD, 0xD3, 0xB6, 0xF1, 0x61, 0x45, 0xC0, 0x84, 0x00, 0x61, 0x02, 0x24, 0x01, 0xB9,
+	 0xC4, 0x84, 0xB6, 0xFB, 0x02, 0x24, 0x01, 0xB9, 0xBD, 0xD3, 0xB7, 0xF1, 0x61, 0x45, 0xC0, 0x84,
+	 0xC4, 0x84, 0xB7, 0xFB, 0xA3, 0x60, 0xEF, 0x78, 0xFF, 0xFF, 0x31, 0x40, 0x04, 0x0A, 0xAE, 0x4F,
+	 0xF7, 0xB4, 0xA0, 0x5E, 0x09, 0x00, 0x31, 0x60, 0x0E, 0x7C, 0xA4, 0xD3, 0xFF, 0xFF, 0x04, 0x18,
+	 0xAE, 0x4F, 0x08, 0xBC, 0x00, 0x7F, 0xA0, 0x5E, 0x9F, 0x01, 0xA1, 0xFF, 0xFF, 0xFF, 0x01, 0x25,
+	 0x09, 0x00, 0x04, 0x25, 0x03, 0x00, 0x47, 0xFF, 0x32, 0x74, 0x96, 0x01, 0xC4, 0xE2, 0xAB, 0x60,
+	 0x2C, 0x78, 0xFF, 0xFF, 0x4C, 0x4E, 0x47, 0xFF, 0x31, 0x60, 0x0E, 0x7C, 0xA4, 0xD3, 0xFF, 0xFF,
+	 0x04, 0x18, 0xAE, 0x4F, 0x08, 0xBC, 0x00, 0x7F, 0xA0, 0x5E, 0x32, 0x74, 0xCD, 0xE2, 0xA8, 0x60,
+	 0x8A, 0x78, 0x00, 0x61, 0x10, 0x64, 0x3A, 0xDB, 0xA3, 0x60, 0x4B, 0x78, 0xFF, 0xFF, 0xA3, 0x60,
+	 0x4B, 0x78, 0xFF, 0xFF, 0x5C, 0x4D, 0x26, 0x44, 0x02, 0x26, 0x0C, 0x00, 0x3E, 0x46, 0x09, 0xF2,
+	 0x1E, 0x41, 0x03, 0x1B, 0xAA, 0x60, 0xDB, 0x78, 0xFF, 0xFF, 0x40, 0x5E, 0xFD, 0xFB, 0x21, 0x44,
+	 0x02, 0x64, 0x40, 0x46, 0x41, 0x5D, 0x21, 0x46, 0x00, 0xF2, 0x46, 0x45, 0x87, 0xFC, 0x4C, 0xE2,
+	 0x01, 0x64, 0x33, 0xFB, 0x01, 0x60, 0x0E, 0xE1, 0x03, 0xE1, 0x3F, 0x40, 0x01, 0x27, 0x00, 0x00,
+	 0x21, 0x69, 0xB6, 0xFF, 0xA1, 0xFF, 0x6C, 0x5E, 0xB6, 0xFF, 0xB7, 0xFF, 0x60, 0x5C, 0x20, 0x64,
+	 0x3A, 0xDB, 0x68, 0x43, 0x26, 0xFC, 0x22, 0x69, 0x64, 0x44, 0xA1, 0xFF, 0xFF, 0xFF, 0x6C, 0x5F,
+	 0x60, 0x43, 0x26, 0xF2, 0xFF, 0xFF, 0x68, 0x5F, 0x26, 0xFA, 0x3A, 0x69, 0x1D, 0xFC, 0x2E, 0x44,
+	 0x36, 0xF1, 0x1C, 0xFA, 0xC3, 0x94, 0xCD, 0xE2, 0x2E, 0x44, 0x14, 0x36, 0x12, 0x00, 0x0A, 0x36,
+	 0x0F, 0x00, 0x63, 0x45, 0xE3, 0x83, 0xE3, 0x83, 0xC7, 0x83, 0xE3, 0x83, 0xC7, 0x83, 0xFF, 0xFF,
+	 0x37, 0x36, 0x05, 0x00, 0x6E, 0x36, 0x04, 0x00, 0xAA, 0x60, 0xF3, 0x78, 0xFF, 0xFF, 0xEB, 0x83,
+	 0xEB, 0x83, 0xEB, 0x83, 0xEB, 0x83, 0xFF, 0xFF, 0x80, 0x27, 0xCF, 0x83, 0x1B, 0xFC, 0x01, 0x64,
+	 0x51, 0xFB, 0xA1, 0xFF, 0x1C, 0xF2, 0x29, 0x41, 0xF9, 0x81, 0x52, 0x4A, 0x71, 0x89, 0x68, 0x5F,
+	 0x27, 0xFA, 0x6C, 0x40, 0x03, 0x15, 0xAB, 0x60, 0x04, 0x78, 0xFF, 0xFF, 0x88, 0x60, 0x85, 0x71,
+	 0x8D, 0xE2, 0xB9, 0xF1, 0xFC, 0xA3, 0xD3, 0x80, 0x43, 0x43, 0x03, 0x04, 0xAA, 0x60, 0xFB, 0x78,
+	 0xFF, 0xFF, 0x32, 0x40, 0x01, 0x2A, 0x4C, 0x00, 0x9A, 0xFF, 0x23, 0x43, 0x18, 0x61, 0xA1, 0xFF,
+	 0x8C, 0x44, 0xCB, 0x83, 0x2A, 0xFA, 0x40, 0x48, 0x40, 0x27, 0x04, 0xA1, 0x60, 0x40, 0x03, 0x2B,
+	 0x01, 0x00, 0x06, 0xA1, 0x88, 0xB0, 0x88, 0x36, 0xD9, 0x81, 0x62, 0x45, 0x23, 0x44, 0x54, 0x94,
+	 0x28, 0x40, 0x04, 0x26, 0x00, 0x64, 0x3F, 0xFA, 0xC9, 0x81, 0x65, 0x42, 0x7A, 0xDC, 0x00, 0xB9,
+	 0xFD, 0x1C, 0x00, 0xF4, 0x6E, 0x61, 0x10, 0x62, 0x14, 0x02, 0x05, 0x1D, 0x12, 0x1E, 0x0C, 0x00,
+	 0x00, 0xF4, 0x7C, 0x61, 0x02, 0x62, 0x7A, 0xDC, 0x63, 0x40, 0xFD, 0x1C, 0xF9, 0x1D, 0xFF, 0xB1,
+	 0x08, 0x1E, 0x02, 0x02, 0x00, 0xF4, 0x02, 0x62, 0xB6, 0xFF, 0xB7, 0xFF, 0xA1, 0xFF, 0x6C, 0x44,
+	 0x5A, 0xDA, 0x98, 0xFF, 0x01, 0x60, 0x08, 0xE1, 0x81, 0xE1, 0xA1, 0xFF, 0x6C, 0x40, 0xA1, 0xFF,
+	 0x47, 0xFF, 0x26, 0x44, 0xFD, 0xB4, 0x84, 0xBC, 0x01, 0x15, 0x7F, 0xB4, 0x40, 0x46, 0xA1, 0xFF,
+	 0x6C, 0x40, 0x14, 0x63, 0x01, 0x11, 0x01, 0x00, 0xFD, 0x1F, 0xAA, 0x60, 0x6E, 0x78, 0xFF, 0xFF,
+	 0x9A, 0xFF, 0x54, 0x63, 0x12, 0x64, 0x40, 0x46, 0x00, 0x64, 0x0F, 0xFA, 0xA1, 0xFF, 0xEB, 0xF1,
+	 0x12, 0x61, 0x50, 0xFE, 0x2D, 0x60, 0x52, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x2A,
+	 0x0B, 0x00, 0x8C, 0x45, 0x98, 0xF8, 0x00, 0x64, 0x3A, 0xFA, 0x3B, 0xFA, 0x3C, 0xFA, 0x3D, 0xFA,
+	 0xBF, 0x60, 0xFF, 0x64, 0xA4, 0x84, 0x01, 0x00, 0x8C, 0x44, 0xEC, 0xF0, 0xBD, 0xDA, 0x40, 0x48,
+	 0x04, 0x26, 0x40, 0x00, 0xA1, 0xFF, 0x8C, 0x44, 0xBD, 0xDA, 0x30, 0xFB, 0x6C, 0x44, 0xBD, 0xDA,
+	 0xFF, 0xFF, 0x01, 0x26, 0x24, 0x00, 0xD0, 0x80, 0xA1, 0xFF, 0x8C, 0x44, 0x6C, 0x5C, 0xF2, 0xFE,
+	 0xBD, 0xDA, 0xED, 0xF3, 0xD4, 0x80, 0xD0, 0x80, 0xBD, 0xD8, 0x2D, 0x44, 0x15, 0x0C, 0x32, 0x40,
+	 0x02, 0x2A, 0x07, 0x00, 0x28, 0x42, 0x0C, 0xB2, 0x08, 0x3A, 0x03, 0x00, 0x10, 0xBC, 0x40, 0x4D,
+	 0x4D, 0x00, 0x03, 0x0A, 0xAB, 0x60, 0x09, 0x78, 0xFF, 0xFF, 0x11, 0xBC, 0x40, 0x4D, 0x28, 0x45,
+	 0xBF, 0x60, 0xFF, 0x64, 0x24, 0x88, 0x42, 0x00, 0x30, 0xBC, 0x40, 0x4D, 0x3F, 0x00, 0x20, 0xB9,
+	 0x5C, 0x8E, 0xA1, 0xFF, 0x8C, 0x44, 0xBD, 0xDA, 0xDC, 0x9C, 0x6C, 0x44, 0xF2, 0xFE, 0xBD, 0xDA,
+	 0x08, 0x28, 0x44, 0x4E, 0xDC, 0x84, 0x2E, 0x5C, 0xB0, 0x84, 0xEF, 0xB1, 0x08, 0x24, 0x40, 0xB9,
+	 0x41, 0x46, 0x2C, 0x00, 0x8C, 0x44, 0x04, 0x61, 0xBD, 0xDA, 0x50, 0xFE, 0x80, 0x27, 0x00, 0x64,
+	 0x30, 0xFB, 0x8C, 0x44, 0xBD, 0xDA, 0xD0, 0x80, 0x8C, 0x44, 0xBD, 0xDA, 0xD4, 0x80, 0x00, 0x65,
+	 0x8C, 0x44, 0xED, 0xF1, 0xBD, 0xDA, 0xD0, 0x80, 0x28, 0x44, 0x03, 0x0C, 0xA0, 0x2A, 0x0A, 0x00,
+	 0x11, 0x00, 0x10, 0x65, 0x60, 0x40, 0xC4, 0x36, 0x04, 0x00, 0xD4, 0x3A, 0x08, 0x00, 0x27, 0x40,
+	 0x40, 0x26, 0x30, 0x65, 0x00, 0x64, 0x3F, 0xFA, 0x46, 0x4E, 0x35, 0x8D, 0x5F, 0x00, 0x40, 0x26,
+	 0xF9, 0x01, 0x30, 0x65, 0x9D, 0xDC, 0x9D, 0xDC, 0x9D, 0xDC, 0xF4, 0x01, 0x00, 0xE1, 0x23, 0x43,
+	 0xE8, 0xA3, 0x6A, 0x62, 0x9A, 0xFF, 0xA1, 0xFF, 0x28, 0x44, 0x03, 0x2B, 0x04, 0x00, 0x7A, 0xDC,
+	 0x7A, 0xDC, 0x7A, 0xDC, 0x28, 0x44, 0x88, 0xB0, 0x88, 0x2A, 0x03, 0x00, 0x70, 0x62, 0x7A, 0xDC,
+	 0x28, 0x44, 0x40, 0x2B, 0x13, 0x00, 0x72, 0x62, 0x7A, 0xDC, 0x04, 0xE6, 0x7A, 0xDC, 0x3B, 0xF2,
+	 0xFF, 0xFF, 0xFF, 0xFF, 0x20, 0x2B, 0x02, 0x00, 0x7A, 0xDC, 0x7A, 0xDC, 0x08, 0x60, 0x00, 0xEB,
+	 0xFC, 0xA3, 0x25, 0xFF, 0x3F, 0xFC, 0x04, 0xA3, 0xB0, 0xFF, 0x01, 0x00, 0x3F, 0xFC, 0xCF, 0x83,
+	 0xDF, 0x83, 0x04, 0x02, 0x00, 0xF4, 0x10, 0x62, 0x6C, 0x61, 0x1F, 0x00, 0x27, 0x03, 0xCB, 0x83,
+	 0xFF, 0x60, 0xFE, 0x65, 0x0E, 0xA3, 0xA7, 0x84, 0xF2, 0xA3, 0x00, 0xF4, 0x10, 0x62, 0x6C, 0x61,
+	 0x7A, 0xDC, 0xFE, 0x1C, 0x03, 0x1D, 0x7C, 0xA8, 0xD9, 0x81, 0x0A, 0x02, 0x00, 0xF4, 0x02, 0x62,
+	 0xA7, 0x84, 0x7A, 0x61, 0x7A, 0xDC, 0xFE, 0x1C, 0xF9, 0x1D, 0x7C, 0xA8, 0xD9, 0x81, 0xF6, 0x03,
+	 0xFF, 0xB1, 0x0C, 0x1E, 0x02, 0x02, 0x00, 0xF4, 0x02, 0x62, 0xA1, 0xFF, 0x01, 0x60, 0x0C, 0xE1,
+	 0xB6, 0xFF, 0xB7, 0xFF, 0xA1, 0xFF, 0xCD, 0x81, 0x6C, 0x44, 0x5A, 0xDA, 0x98, 0xFF, 0x00, 0xE6,
+	 0x7C, 0x44, 0x33, 0xFB, 0x01, 0x60, 0x0C, 0xE1, 0x83, 0xE1, 0xA1, 0xFF, 0x8C, 0x44, 0x46, 0x45,
+	 0xA1, 0xFF, 0x14, 0x63, 0x01, 0x10, 0xFE, 0x1F, 0x01, 0x60, 0x08, 0xE1, 0x0A, 0x64, 0x60, 0x54,
+	 0x47, 0xFF, 0x50, 0x4B, 0x67, 0x50, 0x69, 0xE2, 0x6A, 0x40, 0x40, 0x2B, 0x01, 0x15, 0x29, 0x00,
+	 0x6C, 0x40, 0x28, 0x40, 0x03, 0x26, 0x15, 0x00, 0x31, 0x40, 0x20, 0x2A, 0x03, 0x00, 0x28, 0x40,
+	 0x50, 0x3A, 0x0F, 0x00, 0x2D, 0x44, 0x20, 0x2A, 0x0C, 0x00, 0x2B, 0x44, 0xAC, 0x80, 0x28, 0x40,
+	 0xB4, 0x3A, 0x03, 0x00, 0x02, 0x03, 0x30, 0xFB, 0x04, 0x00, 0x2B, 0x50, 0xA4, 0x60, 0x85, 0x78,
+	 0x04, 0xE1, 0x04, 0xE1, 0xA1, 0xFF, 0x35, 0xF1, 0x26, 0x44, 0x64, 0x54, 0xCD, 0xE2, 0x84, 0xBC,
+	 0x2D, 0x40, 0x0C, 0x22, 0xFD, 0xB4, 0x40, 0x46, 0x23, 0x64, 0x3A, 0xDB, 0xA7, 0x60, 0x18, 0x78,
+	 0xFF, 0xFF, 0x27, 0x40, 0x26, 0x22, 0x04, 0x00, 0x02, 0x64, 0x31, 0xFB, 0xC0, 0xFE, 0xFF, 0xFF,
+	 0x6C, 0x40, 0xB7, 0xFF, 0xB4, 0xFF, 0x48, 0x60, 0x2D, 0x7D, 0x08, 0x60, 0x00, 0x6B, 0x37, 0xF3,
+	 0x2B, 0x45, 0xD4, 0x80, 0xFF, 0xFF, 0x02, 0x28, 0x65, 0x44, 0x60, 0x50, 0xA0, 0x4C, 0x20, 0xBC,
+	 0xFF, 0xB4, 0xA0, 0x51, 0x35, 0xF1, 0x74, 0x44, 0xC0, 0x94, 0x32, 0x40, 0x02, 0x2A, 0x18, 0x00,
+	 0x28, 0x44, 0xA4, 0x36, 0x04, 0x00, 0x0C, 0xB4, 0xFF, 0xFF, 0x04, 0x36, 0x11, 0x00, 0x26, 0x43,
+	 0xFD, 0xB3, 0x04, 0xBB, 0x43, 0x46, 0x01, 0x2A, 0x03, 0x00, 0x28, 0x47, 0x40, 0xBF, 0x40, 0x48,
+	 0x0A, 0xBB, 0x0F, 0xFC, 0x50, 0x4B, 0x67, 0x50, 0x00, 0x64, 0x30, 0xFB, 0x05, 0xFF, 0xC6, 0x01,
+	 0x24, 0x64, 0x3A, 0xDB, 0x28, 0x44, 0x04, 0x2A, 0x06, 0x00, 0xAE, 0x4F, 0xF7, 0xB4, 0xA0, 0x5E,
+	 0xA3, 0x60, 0x3E, 0x78, 0xFF, 0xFF, 0x1D, 0xFF, 0x48, 0xE2, 0x27, 0x44, 0x06, 0x22, 0x05, 0x00,
+	 0xF9, 0xB4, 0x40, 0x47, 0x02, 0x64, 0x31, 0xFB, 0xC0, 0xFE, 0x26, 0x40, 0x10, 0x2A, 0x18, 0x00,
+	 0x26, 0xF2, 0xFF, 0xFF, 0x60, 0x47, 0xFF, 0xB4, 0xC0, 0xA0, 0xFF, 0xFF, 0x11, 0x0E, 0xB8, 0xF1,
+	 0x27, 0x60, 0x92, 0x64, 0xA0, 0xD3, 0xFF, 0xFF, 0xDC, 0x84, 0xDC, 0x80, 0xD0, 0x80, 0x04, 0x03,
+	 0xA2, 0xDB, 0x08, 0x24, 0xC6, 0xFE, 0x04, 0x00, 0x8A, 0xFF, 0x20, 0x60, 0x00, 0x75, 0x88, 0xFF,
+	 0xA7, 0x60, 0xE5, 0x78, 0xFF, 0xFF, 0xB8, 0xF1, 0x27, 0x60, 0x94, 0x64, 0xA0, 0xD3, 0xFF, 0xFF,
+	 0xDC, 0x84, 0xDC, 0x80, 0xD0, 0x80, 0x04, 0x03, 0xA2, 0xDB, 0x08, 0x24, 0xC6, 0xFE, 0x04, 0x00,
+	 0x8A, 0xFF, 0x20, 0x60, 0x00, 0x75, 0x88, 0xFF, 0x2A, 0x64, 0x3A, 0xDB, 0x5C, 0x41, 0x87, 0xE1,
+	 0xA1, 0xFF, 0x6C, 0x40, 0x02, 0x00, 0x29, 0x64, 0x3A, 0xDB, 0x01, 0x60, 0x08, 0xE1, 0x87, 0xE1,
+	 0xA1, 0xFF, 0x6C, 0x40, 0x11, 0x00, 0x27, 0x60, 0xA6, 0x64, 0xA0, 0xD3, 0xFF, 0xFF, 0xDC, 0x84,
+	 0xFF, 0xFF, 0x08, 0x28, 0xA2, 0xDB, 0xF1, 0x01, 0x01, 0x60, 0x08, 0xE1, 0x21, 0x64, 0x3A, 0xDB,
+	 0x03, 0x00, 0x01, 0x60, 0x08, 0xE1, 0x6C, 0x40, 0x00, 0x64, 0x33, 0xFB, 0x32, 0x74, 0x40, 0x63,
+	 0x01, 0x16, 0xFE, 0x01, 0x01, 0x68, 0x01, 0x11, 0x09, 0x00, 0xA7, 0x6A, 0x22, 0x64, 0x3A, 0xDB,
+	 0x03, 0x60, 0xC9, 0x63, 0x01, 0x11, 0x02, 0x00, 0x6C, 0x40, 0xFC, 0x1F, 0x6C, 0x40, 0xB5, 0xFF,
+	 0x6C, 0x40, 0xBC, 0xFF, 0x6C, 0x40, 0xB7, 0xFF, 0xB4, 0xFF, 0x48, 0x60, 0x2D, 0x7D, 0x08, 0x60,
+	 0x00, 0x6B, 0xAE, 0x4F, 0xF7, 0xB4, 0xA0, 0x5E, 0x03, 0x0A, 0xA3, 0x60, 0x4B, 0x78, 0xFF, 0xFF,
+	 0x01, 0x64, 0x51, 0xFB, 0x31, 0x60, 0x0E, 0x7C, 0xA4, 0xD3, 0xFF, 0xFF, 0x04, 0x18, 0xAE, 0x4F,
+	 0x08, 0xBC, 0x00, 0x7F, 0xA0, 0x5E, 0x27, 0x44, 0x06, 0x22, 0x06, 0x00, 0xF9, 0xB4, 0x40, 0x47,
+	 0x02, 0x64, 0x31, 0xFB, 0xC0, 0xFE, 0x48, 0xE2, 0x27, 0x64, 0x3A, 0xDB, 0xB3, 0xE1, 0xA1, 0xFF,
+	 0xFF, 0xFF, 0x81, 0x3E, 0x54, 0x62, 0x22, 0x46, 0xA2, 0xD0, 0x16, 0x63, 0x7C, 0x41, 0x44, 0x48,
+	 0x80, 0x36, 0x04, 0x61, 0x28, 0x40, 0x50, 0x36, 0x04, 0x61, 0x41, 0x4E, 0x28, 0x44, 0xA4, 0x36,
+	 0x0E, 0x63, 0x1C, 0x60, 0x9C, 0x62, 0xA2, 0xD1, 0x24, 0x44, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84,
+	 0xE8, 0x84, 0xE8, 0x84, 0xC0, 0x84, 0xA2, 0xDB, 0x9A, 0xFF, 0xA1, 0xFF, 0x2D, 0x60, 0x52, 0x62,
+	 0xA2, 0xD3, 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x2A, 0x06, 0x00, 0x18, 0xF2, 0xAA, 0xF0, 0xFF, 0xFF,
+	 0xB4, 0x84, 0x08, 0x36, 0x2A, 0xFA, 0x54, 0x62, 0xA2, 0xD2, 0xFF, 0xFF, 0x6A, 0x40, 0x80, 0x4E,
+	 0x7A, 0xD4, 0x7A, 0xD4, 0x7A, 0xD4, 0x7A, 0xD4, 0x7A, 0xD4, 0x7A, 0xD4, 0x7A, 0xD4, 0xFF, 0xFF,
+	 0x01, 0x1D, 0x78, 0x00, 0x7A, 0xD4, 0x7A, 0xD4, 0x7A, 0xD4, 0x7A, 0xD4, 0x28, 0x40, 0x03, 0x2B,
+	 0x04, 0x00, 0x7A, 0xD4, 0x7A, 0xD4, 0x7A, 0xD4, 0x6A, 0x40, 0x70, 0x62, 0x28, 0x44, 0x88, 0xB0,
+	 0x88, 0x36, 0x7A, 0xD4, 0x28, 0x40, 0x40, 0x2B, 0x0B, 0x00, 0x72, 0x62, 0x7A, 0xD4, 0x7A, 0xD4,
+	 0xA2, 0xD2, 0xFF, 0xFF, 0x60, 0x40, 0x20, 0x2B, 0x02, 0x00, 0x7A, 0xD4, 0x7A, 0xD4, 0x46, 0x00,
+	 0x23, 0x43, 0xCF, 0x83, 0xDF, 0x83, 0x02, 0x03, 0x55, 0x03, 0x04, 0x00, 0x03, 0xF0, 0x04, 0xF4,
+	 0x64, 0x42, 0x37, 0x00, 0x2E, 0x40, 0x04, 0x2A, 0x21, 0x00, 0xA1, 0xFF, 0x02, 0xFE, 0x10, 0x25,
+	 0x42, 0xFE, 0x72, 0x45, 0x65, 0x4C, 0xB5, 0xF3, 0x03, 0x04, 0xE4, 0xE2, 0xDC, 0x84, 0xB5, 0xFB,
+	 0xA1, 0xFF, 0x80, 0x4C, 0xB6, 0xF3, 0x02, 0x04, 0xDC, 0x84, 0xB6, 0xFB, 0x80, 0x4C, 0xB7, 0xF3,
+	 0x02, 0x04, 0xDC, 0x84, 0xB7, 0xFB, 0x80, 0x4C, 0x5C, 0x4E, 0xF8, 0xA3, 0x03, 0xF2, 0x9A, 0xF2,
+	 0x04, 0xF4, 0xFF, 0xB1, 0xF8, 0xA1, 0x06, 0xA4, 0x60, 0x42, 0x09, 0x00, 0x03, 0xF2, 0x9A, 0xF2,
+	 0x04, 0xF4, 0xC8, 0x82, 0xFF, 0xB1, 0x03, 0x00, 0x00, 0xF4, 0x81, 0xF2, 0xFF, 0xB1, 0x7A, 0xD4,
+	 0xFF, 0xFF, 0xFD, 0x1C, 0xF9, 0x1D, 0xFF, 0xB1, 0x17, 0x1E, 0x02, 0x02, 0x00, 0xF4, 0xDA, 0x82,
+	 0xDA, 0x82, 0xA2, 0xD2, 0xA1, 0xFF, 0x09, 0x74, 0x80, 0x4D, 0x0E, 0x00, 0x03, 0xF2, 0x9A, 0xF2,
+	 0x04, 0xF4, 0x23, 0x43, 0xA1, 0xFF, 0xA0, 0xD2, 0xFE, 0xA1, 0xCB, 0x83, 0x80, 0x4E, 0xAF, 0x83,
+	 0x02, 0x1D, 0x02, 0x03, 0xED, 0x01, 0xE3, 0x01, 0xA1, 0xFF, 0x28, 0x40, 0x40, 0x2B, 0x02, 0x00,
+	 0x9C, 0x4E, 0x9C, 0x4C, 0xA1, 0xFF, 0xDA, 0x83, 0x66, 0x44, 0x22, 0x46, 0x0C, 0xFA, 0x0B, 0xFC,
+	 0x87, 0x4F, 0x87, 0x4C, 0x87, 0x4F, 0x87, 0x4D, 0x87, 0x4C, 0x01, 0x08, 0x01, 0x00, 0xFF, 0xFF,
+	 0x87, 0x4C, 0x87, 0x4C, 0x87, 0x4C, 0x87, 0x4C, 0xFF, 0xFF, 0xFF, 0xFF, 0x6A, 0x44, 0xBC, 0xFF,
+	 0x01, 0x60, 0x08, 0xE1, 0x0C, 0x74, 0x04, 0xE1, 0xA1, 0xFF, 0x35, 0xF3, 0xC4, 0xE2, 0x60, 0x54,
+	 0x89, 0xFF, 0x13, 0x74, 0x88, 0xFF, 0x29, 0x44, 0xF7, 0xB4, 0x40, 0x49, 0x34, 0x64, 0x3A, 0xDB,
+	 0x06, 0xE1, 0x47, 0xFF, 0xA4, 0x60, 0x47, 0x78, 0xFF, 0xFF, 0xFF, 0x01, 0x10, 0x61, 0x7F, 0x60,
+	 0xC0, 0x64, 0xA0, 0x80, 0x7F, 0x67, 0x02, 0x63, 0x26, 0x02, 0x98, 0xFE, 0x1A, 0x05, 0x24, 0x60,
+	 0x52, 0x62, 0xA2, 0xD5, 0x0E, 0xF2, 0x15, 0x18, 0x02, 0x18, 0x09, 0xF4, 0xFB, 0x01, 0x23, 0x44,
+	 0x00, 0xA8, 0x08, 0x7E, 0x0A, 0x02, 0x66, 0x44, 0x11, 0xFB, 0x46, 0x43, 0x23, 0x47, 0x80, 0xBF,
+	 0x3B, 0x42, 0x04, 0xA2, 0xA2, 0xDB, 0x08, 0xB9, 0x10, 0x7E, 0x00, 0x7F, 0x0E, 0xFA, 0x00, 0x67,
+	 0x0A, 0x00, 0x20, 0x44, 0xDC, 0x85, 0x0F, 0xB4, 0xFA, 0xA0, 0x7F, 0x67, 0x07, 0x63, 0x03, 0x05,
+	 0x45, 0x40, 0x00, 0x67, 0xD8, 0xFE, 0xFF, 0x27, 0x05, 0xFD, 0x0A, 0x7E, 0x04, 0xFB, 0x61, 0x55,
+	 0x4A, 0x00, 0x28, 0xFB, 0x01, 0xF3, 0x29, 0xFB, 0x44, 0x46, 0x40, 0x45, 0x10, 0x61, 0x7E, 0x60,
+	 0xC0, 0x64, 0xA0, 0x80, 0x7F, 0x67, 0x02, 0x63, 0x31, 0x02, 0xAE, 0x60, 0x58, 0x4F, 0x6F, 0x78,
+	 0xFF, 0xFF, 0x7F, 0x67, 0x03, 0x63, 0x2A, 0x02, 0x26, 0x40, 0x01, 0x2B, 0x24, 0x00, 0x98, 0xFE,
+	 0x19, 0x05, 0x24, 0x60, 0x52, 0x62, 0xA2, 0xD5, 0x0E, 0xF2, 0x14, 0x18, 0x02, 0x18, 0x09, 0xF4,
+	 0xFB, 0x01, 0x23, 0x44, 0x00, 0xA8, 0x08, 0x7E, 0x0A, 0x02, 0x66, 0x44, 0x11, 0xFB, 0x46, 0x43,
+	 0x23, 0x47, 0x80, 0xBF, 0x3B, 0x42, 0x04, 0xA2, 0xA2, 0xDB, 0x08, 0xB9, 0x10, 0x7E, 0x00, 0x7F,
+	 0x0E, 0xFA, 0x09, 0x00, 0x20, 0x44, 0xDC, 0x85, 0x0F, 0xB4, 0xFA, 0xA0, 0x7F, 0x67, 0x07, 0x63,
+	 0x05, 0x05, 0x45, 0x40, 0xD8, 0xFE, 0x00, 0x67, 0xD0, 0xFE, 0xD9, 0xFE, 0xFF, 0x27, 0x05, 0xFD,
+	 0x0B, 0x7E, 0x04, 0xFB, 0x1C, 0x60, 0xB4, 0x63, 0xA3, 0xD3, 0xFF, 0xFF, 0x20, 0xB0, 0x80, 0xBC,
+	 0x08, 0x28, 0xA3, 0xDB, 0x61, 0x55, 0x63, 0x00, 0x04, 0xB5, 0x82, 0xB5, 0x25, 0x02, 0x04, 0x03,
+	 0x20, 0x44, 0x7F, 0xB4, 0x40, 0x40, 0xA3, 0xD3, 0x99, 0xFE, 0x04, 0x04, 0x02, 0xBC, 0xFE, 0xB4,
+	 0xA3, 0xDB, 0x56, 0x00, 0xDC, 0xF3, 0x20, 0x40, 0x80, 0x26, 0x52, 0x00, 0xA3, 0xD3, 0xFF, 0xA0,
+	 0xF8, 0xB4, 0x02, 0x02, 0xA3, 0xDB, 0x1C, 0x00, 0x04, 0xBC, 0xBF, 0xB4, 0xA3, 0xDB, 0x08, 0xB0,
+	 0x01, 0x64, 0x08, 0x24, 0x02, 0x64, 0x28, 0xFB, 0x20, 0x44, 0x80, 0xBC, 0x40, 0x40, 0xD0, 0xFE,
+	 0x3F, 0x00, 0xBF, 0xB4, 0xA3, 0xDB, 0x3C, 0x00, 0x40, 0xB0, 0xFF, 0xFF, 0xFA, 0x02, 0xF8, 0xB4,
+	 0xA3, 0xDB, 0x08, 0xB5, 0x07, 0x7C, 0x01, 0x02, 0xDC, 0xF9, 0x20, 0x44, 0x7F, 0xB4, 0x40, 0x40,
+	 0x1C, 0x60, 0xB4, 0x63, 0xA3, 0xD3, 0xFF, 0xFF, 0x20, 0xB5, 0x07, 0xB5, 0x08, 0x28, 0xC4, 0x02,
+	 0x99, 0xFE, 0x26, 0x05, 0x20, 0x44, 0x80, 0x26, 0x23, 0x00, 0x20, 0x2A, 0x00, 0x00, 0x40, 0x2A,
+	 0x1F, 0x00, 0xBF, 0xB4, 0x40, 0x40, 0x09, 0x00, 0xA8, 0xFF, 0x20, 0x44, 0x99, 0xFE, 0x02, 0x05,
+	 0x80, 0x2A, 0x03, 0x00, 0x40, 0xBC, 0x40, 0x40, 0x13, 0x00, 0x00, 0xF1, 0x80, 0xBC, 0x40, 0x40,
+	 0x64, 0x44, 0xE0, 0x84, 0xE8, 0x84, 0x0A, 0x36, 0x29, 0x01, 0x0B, 0x36, 0x5A, 0x01, 0x28, 0xFB,
+	 0x01, 0xF1, 0x29, 0xF9, 0x02, 0xF1, 0x2A, 0xF9, 0x03, 0xF1, 0x2B, 0xF9, 0xD0, 0xFE, 0xAE, 0xFF,
+	 0xA1, 0xFF, 0xFF, 0xFF, 0x82, 0x3E, 0x75, 0x44, 0x02, 0xB0, 0x01, 0xB0, 0x29, 0x02, 0xDC, 0x02,
+	 0x04, 0xB0, 0x08, 0xB0, 0x0B, 0x02, 0x20, 0x02, 0x40, 0x26, 0xA7, 0xFF, 0x8C, 0xFF, 0x75, 0x40,
+	 0x80, 0x2B, 0x01, 0x00, 0xAB, 0xFF, 0x75, 0x44, 0x8D, 0xFF, 0xEA, 0x01, 0x0A, 0xF3, 0xAA, 0xFF,
+	 0x60, 0x40, 0x20, 0x2B, 0x02, 0x00, 0x60, 0xFF, 0x0D, 0x00, 0x01, 0x26, 0x0C, 0x00, 0xC0, 0x60,
+	 0x00, 0x7C, 0xA0, 0x84, 0x80, 0x3B, 0x02, 0x00, 0xC0, 0x67, 0x03, 0x00, 0x40, 0x3B, 0x02, 0x00,
+	 0x00, 0x67, 0x0A, 0xFB, 0xD5, 0x01, 0xD4, 0x01, 0xAB, 0xFF, 0x38, 0xFF, 0x00, 0x00, 0xD0, 0x01,
+	 0x79, 0x63, 0xFF, 0xFF, 0xFF, 0x1F, 0xA9, 0xFF, 0x77, 0x44, 0x60, 0x57, 0x10, 0x60, 0x00, 0x75,
+	 0x40, 0x4A, 0x01, 0x2A, 0x1C, 0x00, 0x24, 0x44, 0xAC, 0x86, 0x08, 0xF2, 0x18, 0x03, 0x24, 0x60,
+	 0x58, 0x65, 0xD4, 0x80, 0x0E, 0xF2, 0x02, 0x03, 0xA5, 0xD5, 0x04, 0x00, 0x01, 0xBC, 0x0E, 0xFA,
+	 0x09, 0xF4, 0xD1, 0xFE, 0x46, 0x44, 0x0B, 0x18, 0x66, 0x44, 0x10, 0xFB, 0x66, 0x47, 0x20, 0xBF,
+	 0x3B, 0x42, 0x04, 0xA2, 0xA2, 0xDB, 0x0E, 0xF2, 0x01, 0x75, 0x10, 0xBC, 0x0E, 0xFA, 0x2A, 0x44,
+	 0x08, 0x2A, 0x18, 0x00, 0x23, 0x44, 0x00, 0xA8, 0x5C, 0x43, 0x14, 0x03, 0x24, 0x60, 0x52, 0x62,
+	 0xA2, 0xD5, 0x01, 0x00, 0x09, 0xF4, 0x0E, 0xF2, 0x0D, 0x18, 0x08, 0xB0, 0x18, 0xAC, 0xFA, 0x03,
+	 0x0E, 0xFA, 0x66, 0x43, 0x11, 0xFD, 0x46, 0x43, 0x23, 0x47, 0x80, 0xBF, 0x3B, 0x42, 0x04, 0xA2,
+	 0xA2, 0xDB, 0x08, 0x75, 0x2A, 0x44, 0x06, 0x22, 0x2D, 0x00, 0x22, 0x44, 0x00, 0xA8, 0x60, 0x46,
+	 0x0E, 0xF2, 0x28, 0x03, 0x10, 0xB0, 0x01, 0xBC, 0x03, 0x02, 0x00, 0x64, 0x40, 0x42, 0x22, 0x00,
+	 0x0E, 0xFA, 0xD1, 0xFE, 0x24, 0x60, 0x4C, 0x64, 0x40, 0x47, 0x58, 0x4F, 0x84, 0x00, 0x46, 0x42,
+	 0x19, 0x02, 0x22, 0x47, 0x40, 0xBF, 0x3B, 0x42, 0x04, 0xA2, 0xA2, 0xDB, 0x23, 0xF2, 0x66, 0x43,
+	 0x00, 0xA8, 0x0E, 0xF2, 0x08, 0x02, 0x60, 0x40, 0x02, 0x2A, 0xE4, 0x01, 0x12, 0xFD, 0x10, 0x64,
+	 0x0E, 0xFA, 0x02, 0x75, 0x07, 0x00, 0x60, 0x40, 0x04, 0x2A, 0xDC, 0x01, 0x12, 0xFD, 0x10, 0x64,
+	 0x0E, 0xFA, 0x04, 0x75, 0x2A, 0x44, 0x80, 0x2A, 0x19, 0x00, 0x21, 0x44, 0xAC, 0x86, 0x0E, 0xF2,
+	 0x15, 0x03, 0x01, 0xBC, 0x0E, 0xFA, 0xD1, 0xFE, 0x24, 0x60, 0x64, 0x64, 0x40, 0x47, 0x58, 0x4F,
+	 0x5A, 0x00, 0x46, 0x41, 0x0B, 0x02, 0x21, 0x47, 0x10, 0xBF, 0x3B, 0x42, 0x04, 0xA2, 0xA2, 0xDB,
+	 0x0E, 0xF2, 0x66, 0x43, 0x08, 0xFD, 0x10, 0xBC, 0x0E, 0xFA, 0x80, 0x75, 0x2A, 0x44, 0x10, 0xB0,
+	 0x20, 0x44, 0x15, 0x03, 0x7F, 0xB4, 0x40, 0x40, 0x1C, 0x60, 0xB4, 0x63, 0xA3, 0xD3, 0xFF, 0xFF,
+	 0x20, 0xB0, 0x80, 0xB0, 0x09, 0x03, 0x08, 0x03, 0x40, 0xBC, 0x7F, 0xB4, 0x04, 0xB0, 0xA3, 0xDB,
+	 0x03, 0x03, 0x20, 0x44, 0x80, 0xBC, 0x40, 0x40, 0xAC, 0x60, 0xD8, 0x78, 0xFF, 0xFF, 0x2A, 0x40,
+	 0x08, 0x2B, 0x01, 0x00, 0x10, 0xFF, 0xAD, 0x60, 0x08, 0x78, 0xFF, 0xFF, 0xE8, 0xFE, 0x14, 0x05,
+	 0xEA, 0xFE, 0x24, 0x05, 0xE9, 0xFE, 0x1C, 0x05, 0xE7, 0xFE, 0x09, 0x05, 0x47, 0xFF, 0x20, 0x44,
+	 0x0F, 0x22, 0x03, 0x00, 0xCC, 0x84, 0x40, 0x40, 0x0F, 0x22, 0xB8, 0xFE, 0xEC, 0x01, 0x23, 0x41,
+	 0x00, 0xB9, 0x5C, 0x4A, 0xE8, 0x02, 0x6A, 0x01, 0x24, 0x41, 0x00, 0xB9, 0x24, 0x60, 0x58, 0x65,
+	 0x45, 0x47, 0xE1, 0x02, 0x58, 0x4F, 0x0F, 0x00, 0xDE, 0x02, 0x5C, 0x4A, 0x46, 0x44, 0x4C, 0x01,
+	 0x22, 0x41, 0x00, 0xB9, 0x5C, 0x4A, 0x08, 0x24, 0x7D, 0x01, 0xD5, 0x01, 0x21, 0x41, 0x00, 0xB9,
+	 0x5C, 0x4A, 0xA2, 0x03, 0xD0, 0x01, 0x27, 0xD3, 0x03, 0x00, 0x10, 0xB0, 0x09, 0xF2, 0x04, 0x03,
+	 0xAC, 0x86, 0x0E, 0xF2, 0xFA, 0x02, 0x08, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x0E, 0xF3, 0x0F, 0x60,
+	 0xFE, 0x65, 0x0C, 0xF3, 0x24, 0x86, 0x24, 0x46, 0x60, 0x40, 0xFB, 0x3B, 0x07, 0x00, 0x80, 0x26,
+	 0x02, 0x00, 0x23, 0x46, 0x03, 0x4C, 0x46, 0x61, 0x3A, 0x65, 0x0C, 0x00, 0x2E, 0xF3, 0x40, 0x45,
+	 0xF8, 0x2B, 0x02, 0x00, 0x40, 0x45, 0x03, 0x00, 0x58, 0x4F, 0x39, 0x00, 0x07, 0x02, 0x58, 0x4F,
+	 0x45, 0x00, 0x04, 0x05, 0x66, 0x50, 0x65, 0x52, 0x61, 0x51, 0x09, 0x00, 0x26, 0x47, 0x00, 0xBF,
+	 0x0E, 0xFB, 0x2E, 0xF5, 0x05, 0xF0, 0x80, 0x60, 0x64, 0x50, 0x00, 0x72, 0x7E, 0x71, 0xAC, 0xFF,
+	 0xAD, 0x60, 0x08, 0x78, 0xFF, 0xFF, 0x8E, 0xFF, 0x0F, 0xF3, 0x0F, 0x60, 0xFE, 0x65, 0x24, 0x86,
+	 0x0D, 0xF3, 0x2E, 0xF3, 0x40, 0x45, 0xF8, 0x2B, 0x02, 0x00, 0x40, 0x45, 0x03, 0x00, 0x58, 0x4F,
+	 0x16, 0x00, 0x07, 0x02, 0x58, 0x4F, 0x22, 0x00, 0x04, 0x05, 0x66, 0x50, 0x65, 0x52, 0x61, 0x51,
+	 0x09, 0x00, 0x26, 0x47, 0x00, 0xBF, 0x0F, 0xFB, 0x2E, 0xF5, 0x05, 0xF0, 0x80, 0x60, 0x64, 0x50,
+	 0x00, 0x72, 0x7E, 0x71, 0x8D, 0xFF, 0xAD, 0xFF, 0xAD, 0x60, 0x08, 0x78, 0xFF, 0xFF, 0x25, 0x44,
+	 0xAA, 0xF1, 0xAB, 0xF1, 0xD0, 0x80, 0xD0, 0x80, 0x07, 0x04, 0x01, 0x06, 0x05, 0x00, 0x25, 0x46,
+	 0x01, 0xF0, 0x03, 0x67, 0xA0, 0x85, 0x94, 0x80, 0x2F, 0x58, 0xFF, 0xFF, 0x25, 0x46, 0x26, 0x41,
+	 0x46, 0x63, 0x01, 0xF2, 0xFF, 0xFF, 0xFF, 0xB5, 0xD5, 0x81, 0x00, 0xF2, 0x05, 0x04, 0x04, 0x63,
+	 0x60, 0x46, 0xF7, 0x1B, 0x42, 0xFE, 0x0D, 0x00, 0x61, 0x44, 0xC5, 0x81, 0x63, 0x45, 0xC5, 0x81,
+	 0x9C, 0x84, 0xDC, 0x84, 0x01, 0xF2, 0xF0, 0x85, 0xF0, 0x80, 0x65, 0x44, 0xF8, 0x85, 0xFF, 0xFF,
+	 0x02, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0xA2, 0xFF, 0x24, 0x60, 0x6A, 0x62, 0xA2, 0xD3, 0xFF, 0xFF,
+	 0xAC, 0x86, 0x0E, 0xF2, 0x07, 0x03, 0x00, 0xA8, 0x09, 0xF2, 0xFA, 0x02, 0x01, 0x67, 0x0E, 0xFA,
+	 0x08, 0xFE, 0x17, 0x00, 0xAC, 0xF3, 0xFF, 0xFF, 0xD8, 0xA0, 0x00, 0xB4, 0x12, 0x06, 0x09, 0x60,
+	 0x08, 0x61, 0x41, 0x4A, 0x7C, 0xA1, 0x0E, 0xA1, 0xA2, 0xFF, 0xAE, 0x60, 0x58, 0x4E, 0xE4, 0x78,
+	 0xFF, 0xFF, 0xA3, 0xFF, 0x06, 0x03, 0x2A, 0x43, 0xAF, 0x60, 0x58, 0x4E, 0x05, 0x78, 0xFF, 0xFF,
+	 0x08, 0xFE, 0xA3, 0xFF, 0x2D, 0x58, 0xFF, 0xFF, 0x41, 0x4A, 0x7C, 0xA1, 0x0E, 0xA1, 0xA2, 0xFF,
+	 0xAE, 0x60, 0x58, 0x4E, 0xE4, 0x78, 0xFF, 0xFF, 0x07, 0x03, 0x2A, 0x43, 0xAF, 0x60, 0x58, 0x4E,
+	 0x05, 0x78, 0xFF, 0xFF, 0x08, 0xFE, 0x0D, 0x00, 0x24, 0x60, 0x6A, 0x62, 0xA2, 0xD3, 0xFF, 0xFF,
+	 0xAC, 0x86, 0x0E, 0xF2, 0x06, 0x03, 0x00, 0xA8, 0x09, 0xF2, 0xFA, 0x02, 0x01, 0x67, 0x0E, 0xFA,
+	 0x08, 0xFE, 0xA3, 0xFF, 0x2D, 0x58, 0xFF, 0xFF, 0xAD, 0xF3, 0x7C, 0x63, 0x00, 0xBE, 0x40, 0x45,
+	 0x1A, 0x03, 0x00, 0x65, 0x65, 0x44, 0xDC, 0x85, 0x84, 0xA1, 0x00, 0xF2, 0x06, 0x06, 0x01, 0xFC,
+	 0x00, 0xA8, 0x60, 0x46, 0xF7, 0x02, 0x40, 0x45, 0x0E, 0x00, 0xAC, 0xF3, 0x00, 0x63, 0xD4, 0x84,
+	 0xAC, 0xFB, 0x80, 0x60, 0x7C, 0x64, 0x01, 0xFA, 0x00, 0xF0, 0x00, 0xFC, 0xD3, 0x80, 0xAD, 0xF9,
+	 0x02, 0x02, 0xAE, 0xF9, 0x08, 0xFE, 0x2E, 0x58, 0xFF, 0xFF, 0x66, 0x44, 0x25, 0x46, 0x05, 0xFA,
+	 0x06, 0xFA, 0x01, 0xF0, 0x03, 0x67, 0x02, 0xFC, 0xB0, 0x84, 0x3A, 0x7E, 0x01, 0xFA, 0x12, 0x64,
+	 0x03, 0xFA, 0x00, 0xF0, 0x04, 0xF8, 0x00, 0x64, 0x0C, 0x61, 0x10, 0x63, 0x59, 0xDA, 0xFE, 0x1F,
+	 0x2E, 0x58, 0xFF, 0xFF, 0x27, 0x43, 0xE3, 0x81, 0xE9, 0x81, 0x03, 0x05, 0x16, 0x03, 0x00, 0x61,
+	 0x01, 0x00, 0xE4, 0x63, 0x61, 0x46, 0xBF, 0xD2, 0x27, 0x45, 0xDC, 0x84, 0xA2, 0xDA, 0xBE, 0xD2,
+	 0x25, 0x46, 0x88, 0xF8, 0x04, 0x1B, 0x25, 0x44, 0x61, 0x46, 0xA3, 0xDA, 0x04, 0x00, 0x0A, 0xFA,
+	 0x60, 0x46, 0x25, 0x44, 0x09, 0xFA, 0x61, 0x46, 0xBE, 0xDA, 0x2F, 0x58, 0xFF, 0xFF, 0x25, 0x44,
+	 0x00, 0xA8, 0x07, 0x4B, 0x0C, 0x03, 0x58, 0x4F, 0x33, 0x00, 0x0B, 0x47, 0x24, 0x60, 0x5E, 0x65,
+	 0x27, 0x44, 0xD4, 0x80, 0x00, 0x64, 0x01, 0x02, 0x0F, 0xFA, 0x58, 0x4F, 0xD3, 0x01, 0x70, 0x00,
+	 0x25, 0x43, 0xE3, 0x84, 0x7C, 0x41, 0x02, 0x04, 0xE8, 0x81, 0xE4, 0x63, 0x61, 0x46, 0xA3, 0xD2,
+	 0x00, 0x7C, 0x40, 0x45, 0xBF, 0xD8, 0xA3, 0xD8, 0xBE, 0xD8, 0x27, 0x42, 0x5A, 0xD3, 0x25, 0x5C,
+	 0x60, 0x41, 0x02, 0x1B, 0x27, 0xD9, 0x05, 0x00, 0x25, 0x46, 0x0A, 0xFA, 0x61, 0x46, 0x25, 0x44,
+	 0x09, 0xFA, 0x25, 0x44, 0x27, 0x43, 0x00, 0x61, 0x60, 0x46, 0x09, 0xF2, 0x08, 0xFC, 0x00, 0xA8,
+	 0xDD, 0x81, 0xFA, 0x02, 0xBF, 0xD1, 0x66, 0x44, 0xBE, 0xDB, 0xC1, 0x84, 0xBF, 0xDB, 0x48, 0x00,
+	 0x25, 0x46, 0xE4, 0x63, 0x08, 0xF2, 0x89, 0xF2, 0x1E, 0x18, 0x40, 0x47, 0xE0, 0x84, 0xE8, 0x85,
+	 0x02, 0x05, 0xE8, 0x83, 0x00, 0x65, 0x65, 0x46, 0xBF, 0xD2, 0x61, 0x5C, 0xCC, 0x84, 0xA2, 0xDA,
+	 0x25, 0x46, 0x0A, 0xF2, 0x00, 0xB9, 0x65, 0x46, 0x08, 0x24, 0xBE, 0xDA, 0x02, 0x1B, 0xA3, 0xD8,
+	 0x02, 0x00, 0x60, 0x46, 0x89, 0xFA, 0x00, 0xB9, 0x61, 0x46, 0x08, 0x28, 0x0A, 0xFA, 0x25, 0x46,
+	 0x89, 0xFC, 0x8A, 0xFC, 0x88, 0xFC, 0x2F, 0x58, 0xFF, 0xFF, 0x00, 0x61, 0x28, 0x65, 0x25, 0x43,
+	 0xAE, 0xF3, 0xAF, 0x83, 0x00, 0xBE, 0x18, 0x03, 0x02, 0x03, 0x00, 0xFC, 0x01, 0x00, 0xAD, 0xFD,
+	 0x63, 0x46, 0x65, 0x44, 0xCC, 0x85, 0x00, 0xF2, 0x07, 0x02, 0xAE, 0xF5, 0x00, 0x64, 0x00, 0xFA,
+	 0xDE, 0x60, 0xAF, 0x64, 0x09, 0xFB, 0x08, 0x00, 0x66, 0x43, 0x00, 0xBE, 0xDD, 0x81, 0xF1, 0x02,
+	 0xAC, 0xF1, 0xAE, 0xFD, 0xC1, 0x84, 0xAC, 0xFB, 0x2E, 0x58, 0xFF, 0xFF, 0x00, 0x66, 0x46, 0x45,
+	 0x29, 0x43, 0xFC, 0xA3, 0x66, 0x44, 0xBD, 0xDB, 0x25, 0x44, 0xBD, 0xDB, 0x00, 0x64, 0xBD, 0xDB,
+	 0x03, 0x61, 0x0E, 0x65, 0x24, 0x60, 0x72, 0x63, 0x43, 0x49, 0xA3, 0xD3, 0x06, 0xA3, 0x00, 0xA8,
+	 0xCD, 0x81, 0x04, 0x02, 0xF9, 0x02, 0xAD, 0x60, 0x08, 0x78, 0xFF, 0xFF, 0x01, 0x26, 0xE6, 0x01,
+	 0xD4, 0x80, 0x60, 0x45, 0xE3, 0x05, 0xF6, 0xA3, 0xBD, 0xD1, 0xBD, 0xD1, 0x44, 0x47, 0x44, 0x48,
+	 0x44, 0x45, 0x24, 0x60, 0xB0, 0x64, 0x44, 0xD7, 0xFF, 0xFF, 0xFF, 0xFF, 0x24, 0x60, 0x22, 0x63,
+	 0x0D, 0x65, 0x00, 0x61, 0x41, 0x48, 0xA3, 0xD3, 0x06, 0xA3, 0xAC, 0x86, 0x00, 0x61, 0x09, 0x03,
+	 0x00, 0xF2, 0x09, 0xF0, 0xAC, 0x86, 0x00, 0xF2, 0xDD, 0x81, 0xFC, 0x02, 0x64, 0x44, 0xAC, 0x86,
+	 0xF6, 0x01, 0x61, 0x44, 0x25, 0x46, 0x27, 0xDA, 0x65, 0x44, 0x28, 0x45, 0x45, 0x88, 0xCC, 0x85,
+	 0x5A, 0x87, 0xE9, 0x02, 0x00, 0x64, 0x27, 0xDA, 0x5A, 0xDA, 0x5A, 0x87, 0xA9, 0xF3, 0xA8, 0xF1,
+	 0x02, 0xA4, 0x60, 0x46, 0x60, 0x45, 0x00, 0x61, 0x1E, 0xF2, 0xFF, 0xFF, 0xAC, 0x86, 0x00, 0xF2,
+	 0x04, 0x03, 0xAC, 0x86, 0x00, 0xF2, 0xDD, 0x81, 0xFC, 0x02, 0x65, 0x44, 0x02, 0xA5, 0x65, 0x46,
+	 0x64, 0x44, 0xCC, 0x9C, 0xFF, 0xFF, 0xF0, 0x02, 0x61, 0x44, 0x25, 0x46, 0x27, 0xDA, 0x5A, 0x87,
+	 0x28, 0x45, 0x45, 0x88, 0x00, 0x64, 0x27, 0xDA, 0x5A, 0x87, 0x06, 0x60, 0x40, 0x65, 0xAD, 0xF3,
+	 0x01, 0x61, 0xAC, 0x86, 0x00, 0xF2, 0x03, 0x03, 0xD5, 0x80, 0xDD, 0x81, 0xFA, 0x04, 0xCD, 0x84,
+	 0x25, 0x46, 0x27, 0xDA, 0x28, 0x45, 0xC4, 0x84, 0x5A, 0xDA, 0xDA, 0x81, 0xAC, 0xF1, 0x59, 0xD8,
+	 0x24, 0x60, 0x20, 0x64, 0x18, 0x63, 0xA0, 0xD1, 0x06, 0xA4, 0x59, 0xD8, 0xFC, 0x1F, 0x00, 0x64,
+	 0x59, 0xDA, 0x59, 0xDA, 0x01, 0x60, 0x5C, 0x64, 0x0A, 0x63, 0x58, 0xD1, 0x59, 0xD8, 0xFD, 0x1F,
+	 0xDC, 0xF1, 0x59, 0xD8, 0x75, 0x01, 0x07, 0x4B, 0xAF, 0x60, 0x58, 0x4F, 0x70, 0x78, 0xFF, 0xFF,
+	 0x0B, 0x47, 0x58, 0x4F, 0x21, 0x00, 0x6C, 0x01, 0x07, 0x4B, 0xAF, 0x60, 0x58, 0x4F, 0x70, 0x78,
+	 0xFF, 0xFF, 0x0B, 0x47, 0x27, 0x44, 0x00, 0xBE, 0x08, 0xF0, 0x15, 0x03, 0x64, 0x42, 0x4A, 0xD3,
+	 0x09, 0xF2, 0xDC, 0x83, 0xA2, 0xDD, 0x25, 0x43, 0x09, 0xFC, 0x63, 0x46, 0x27, 0x43, 0x0A, 0xFC,
+	 0x09, 0xFA, 0x08, 0xF8, 0x00, 0xA8, 0x66, 0x43, 0x03, 0x02, 0x64, 0x44, 0x58, 0xDD, 0x03, 0x00,
+	 0x60, 0x46, 0x25, 0x44, 0x0A, 0xFA, 0x4C, 0x01, 0x27, 0x43, 0xE3, 0x81, 0xE9, 0x81, 0x03, 0x05,
+	 0x16, 0x03, 0x00, 0x61, 0x01, 0x00, 0xE4, 0x63, 0x61, 0x46, 0xBF, 0xD2, 0x27, 0x45, 0xDC, 0x84,
+	 0xA2, 0xDA, 0xA3, 0xD2, 0x25, 0x46, 0x88, 0xF8, 0x04, 0x1B, 0x25, 0x44, 0x61, 0x46, 0xBE, 0xDA,
+	 0x04, 0x00, 0x09, 0xFA, 0x60, 0x46, 0x25, 0x44, 0x0A, 0xFA, 0x61, 0x46, 0xA3, 0xDA, 0x2F, 0x58,
+	 0xFF, 0xFF, 0xA0, 0xFE, 0x07, 0x05, 0xA3, 0xFE, 0x07, 0x05, 0xA1, 0xFE, 0x52, 0x05, 0x60, 0x64,
+	 0x3B, 0xDB, 0x12, 0x00, 0x20, 0x58, 0xFF, 0xFF, 0x4F, 0xF7, 0xFF, 0xFF, 0xFF, 0xFF, 0x1C, 0x60,
+	 0xB8, 0x63, 0xA3, 0xD3, 0xFF, 0xFF, 0xFB, 0xB4, 0xA3, 0xDB, 0xA0, 0x4C, 0x59, 0xBC, 0xFF, 0xB4,
+	 0xA0, 0x51, 0xA0, 0x4C, 0x7D, 0xB4, 0xA0, 0x51, 0xA1, 0xFF, 0xFF, 0xFF, 0x83, 0x3E, 0x40, 0x60,
+	 0x0B, 0x65, 0x2B, 0x44, 0x00, 0x63, 0xE8, 0x80, 0xF8, 0x84, 0x02, 0x24, 0x94, 0x84, 0xF3, 0x83,
+	 0xCD, 0x81, 0xFF, 0xFF, 0xF8, 0x02, 0xDF, 0x83, 0x2F, 0x58, 0x40, 0x4B, 0x00, 0x62, 0x01, 0x64,
+	 0xD4, 0x80, 0xE0, 0x84, 0x1A, 0x03, 0xD4, 0x80, 0xE0, 0x84, 0x15, 0x03, 0x61, 0x44, 0x11, 0x61,
+	 0xE0, 0x84, 0xCD, 0x81, 0xFD, 0x04, 0x01, 0x00, 0xE0, 0x84, 0xF2, 0x82, 0xFF, 0xFF, 0x02, 0x24,
+	 0xC6, 0x82, 0x02, 0x28, 0xD6, 0x82, 0xE2, 0x80, 0xCD, 0x81, 0x02, 0x28, 0x01, 0xBC, 0xF4, 0x02,
+	 0x01, 0x2A, 0xC6, 0x82, 0x03, 0x00, 0xE9, 0x81, 0xF2, 0x82, 0x61, 0x44, 0x2D, 0x58, 0xFF, 0xFF,
+	 0x00, 0xA8, 0x10, 0x61, 0x04, 0x03, 0xF0, 0x84, 0xCD, 0x81, 0xFD, 0x04, 0x61, 0x44, 0x2D, 0x58,
+	 0xFF, 0xFF, 0x00, 0x64, 0x3B, 0xDB, 0x3C, 0x44, 0xAC, 0x80, 0xFF, 0xFF, 0xBD, 0x02, 0x8B, 0xF3,
+	 0x8C, 0xF3, 0x02, 0xA8, 0x02, 0xA8, 0x08, 0x02, 0x00, 0x64, 0x8D, 0xFB, 0x8B, 0xFB, 0x8C, 0xFB,
+	 0x00, 0x64, 0x8E, 0xFB, 0xCA, 0xFE, 0x2D, 0x00, 0x03, 0x02, 0x00, 0x64, 0x8C, 0xFB, 0xCA, 0xFE,
+	 0x01, 0x64, 0x3B, 0xDB, 0x24, 0x60, 0x28, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0x00, 0xA8, 0x60, 0x46,
+	 0x14, 0x03, 0xDC, 0xF3, 0x2A, 0xF2, 0xFD, 0xA0, 0x60, 0x40, 0x80, 0x3A, 0x29, 0x00, 0x28, 0x02,
+	 0x9B, 0xFE, 0x26, 0x05, 0x24, 0x60, 0x6E, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB,
+	 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xE5, 0x01, 0x8C, 0xF3, 0xFF, 0xFF, 0x01, 0xA8,
+	 0xFF, 0xFF, 0x07, 0x02, 0x24, 0x60, 0x22, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0x00, 0xA8, 0x60, 0x46,
+	 0x0F, 0x02, 0x86, 0xFF, 0x20, 0x40, 0x52, 0x27, 0x07, 0x00, 0x9A, 0xFE, 0x05, 0x04, 0x9D, 0xFE,
+	 0x03, 0x04, 0xF1, 0xFE, 0x12, 0x64, 0x3B, 0xDB, 0x84, 0xFF, 0xB0, 0x60, 0x97, 0x78, 0xFF, 0xFF,
+	 0x66, 0x44, 0xFC, 0xFB, 0x46, 0x5C, 0x2D, 0x60, 0x5A, 0x63, 0xA3, 0xD3, 0xB0, 0x60, 0x58, 0x4D,
+	 0xD8, 0x78, 0xFF, 0xFF, 0x0D, 0xF2, 0x60, 0x5C, 0x64, 0x5F, 0x0D, 0xFA, 0x11, 0x64, 0x3B, 0xDB,
+	 0x9D, 0xFE, 0x0B, 0x05, 0x24, 0x60, 0x92, 0x65, 0x08, 0x64, 0xA5, 0xDB, 0xB1, 0x60, 0x4D, 0x64,
+	 0x4F, 0xFB, 0x2D, 0xFF, 0xB0, 0x60, 0xA4, 0x78, 0xFF, 0xFF, 0x07, 0xF0, 0x00, 0x64, 0xD0, 0x80,
+	 0xA9, 0xF3, 0x07, 0x02, 0x23, 0xF0, 0x04, 0x64, 0xB0, 0x84, 0xA2, 0xDA, 0xB8, 0x60, 0x36, 0x78,
+	 0xFF, 0xFF, 0xD0, 0x80, 0xD8, 0xF3, 0x40, 0x03, 0x60, 0x40, 0x03, 0x3A, 0x3D, 0x00, 0x66, 0x41,
+	 0x64, 0x46, 0x6F, 0xF2, 0x61, 0x46, 0x64, 0x41, 0x4D, 0xF1, 0x60, 0x40, 0x03, 0x3A, 0x34, 0x00,
+	 0x64, 0x40, 0xFF, 0x22, 0x31, 0x00, 0x05, 0x7E, 0x66, 0x45, 0x61, 0x46, 0x6F, 0xFA, 0x65, 0x46,
+	 0x07, 0xF0, 0x00, 0x65, 0x65, 0x43, 0x66, 0x41, 0x64, 0x46, 0x70, 0xF2, 0x8C, 0xFA, 0x00, 0xA8,
+	 0x6F, 0xF2, 0x15, 0x03, 0x60, 0x47, 0xFF, 0xB5, 0x70, 0xF2, 0x00, 0xBB, 0xFF, 0xA0, 0x07, 0x03,
+	 0x0E, 0x06, 0xE8, 0x84, 0xA4, 0x80, 0xFF, 0xFF, 0x02, 0x02, 0xFB, 0x04, 0x08, 0x00, 0xB9, 0x81,
+	 0xE8, 0x84, 0xD9, 0x81, 0xFD, 0x04, 0x0F, 0x60, 0xA2, 0x65, 0x45, 0xD3, 0x0E, 0xFA, 0x0C, 0xF4,
+	 0xFF, 0xFF, 0x00, 0x64, 0x4D, 0xFB, 0x4C, 0xFB, 0x07, 0xF0, 0x66, 0x41, 0x64, 0x46, 0x0E, 0xF2,
+	 0x61, 0x46, 0xFF, 0xFF, 0xF0, 0x7E, 0x4E, 0xFB, 0x2A, 0xF2, 0x00, 0x63, 0x40, 0x47, 0x50, 0x36,
+	 0x05, 0x00, 0xA4, 0x36, 0x03, 0x00, 0x80, 0x36, 0x01, 0x00, 0x01, 0x63, 0x48, 0xFD, 0x40, 0x47,
+	 0x08, 0x2A, 0x0A, 0x00, 0x03, 0x2F, 0x08, 0x00, 0x81, 0xF1, 0x2C, 0xF8, 0x82, 0xF1, 0xFF, 0xFF,
+	 0x2D, 0xF8, 0x83, 0xF1, 0x2E, 0xF8, 0xFF, 0xFF, 0x4A, 0xF3, 0x35, 0xFA, 0x10, 0xA4, 0x4A, 0xFB,
+	 0x00, 0x64, 0x15, 0xFA, 0x16, 0xFA, 0x0F, 0xFA, 0xFF, 0xFF, 0x07, 0xF0, 0x66, 0x43, 0x64, 0x46,
+	 0x0E, 0xF0, 0x63, 0x46, 0x00, 0x7F, 0x64, 0x5E, 0x4B, 0xFB, 0x64, 0x44, 0x00, 0x7E, 0xDB, 0xFB,
+	 0x07, 0xF0, 0xA9, 0xF3, 0xFF, 0xFF, 0xD0, 0x80, 0xFF, 0xFF, 0x03, 0x03, 0xDB, 0xF3, 0xDA, 0xFB,
+	 0x60, 0x41, 0x03, 0xF2, 0x00, 0xF4, 0x01, 0xF2, 0xFC, 0xA5, 0x00, 0x7F, 0xD4, 0x84, 0x27, 0x45,
+	 0x3C, 0x46, 0x1A, 0xFA, 0x22, 0x63, 0x7B, 0x60, 0xFF, 0x64, 0xA4, 0x84, 0x03, 0x2B, 0x1C, 0x63,
+	 0x2A, 0xFA, 0x60, 0x40, 0xA4, 0x36, 0x14, 0x63, 0x43, 0x4C, 0x00, 0x7C, 0x22, 0xF8, 0x64, 0x41,
+	 0x07, 0xF0, 0x66, 0x43, 0x64, 0x46, 0x36, 0xF2, 0x63, 0x46, 0xFF, 0xB4, 0x22, 0xFA, 0x60, 0x40,
+	 0x00, 0x36, 0x76, 0x00, 0x2A, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x08, 0x3A, 0xA5, 0x00, 0x03, 0xF2,
+	 0x00, 0xF4, 0xA0, 0xD2, 0xAA, 0x60, 0xAA, 0x65, 0x5A, 0xD0, 0xD4, 0x80, 0x03, 0x64, 0x0A, 0x02,
+	 0xD0, 0x80, 0x00, 0x64, 0x5A, 0xD0, 0x06, 0x02, 0xD0, 0x80, 0xF8, 0x7F, 0xD0, 0x80, 0x01, 0x03,
+	 0x01, 0x02, 0x01, 0x61, 0x62, 0x43, 0x46, 0x43, 0x3C, 0x46, 0x07, 0xF4, 0x36, 0xF2, 0xFF, 0xFF,
+	 0xA3, 0x46, 0x60, 0x40, 0x22, 0x26, 0x5C, 0x00, 0x60, 0x45, 0x63, 0x42, 0x5A, 0xD0, 0xCD, 0x81,
+	 0x3C, 0x46, 0x14, 0x02, 0x64, 0x44, 0x88, 0x3A, 0x11, 0x00, 0x8E, 0x3B, 0x0F, 0x00, 0x65, 0x44,
+	 0x01, 0x26, 0x7A, 0x00, 0x04, 0x26, 0x03, 0x00, 0x10, 0x26, 0x01, 0x00, 0x2D, 0x00, 0xA3, 0x46,
+	 0x37, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x80, 0x2B, 0x6F, 0x00, 0x56, 0x00, 0xA3, 0x46, 0x65, 0x44,
+	 0x01, 0x26, 0x0B, 0x00, 0x04, 0x26, 0x03, 0x00, 0x10, 0x26, 0x01, 0x00, 0x1D, 0x00, 0x37, 0xF2,
+	 0xFF, 0xFF, 0x60, 0x40, 0x80, 0x27, 0x48, 0x00, 0x17, 0x00, 0xA9, 0xF3, 0xFF, 0xFF, 0x60, 0x46,
+	 0x36, 0xF2, 0x66, 0x43, 0xFF, 0xB4, 0x3C, 0x46, 0x22, 0xF0, 0x60, 0x47, 0xB0, 0x84, 0x22, 0xFA,
+	 0x63, 0x46, 0x37, 0xF0, 0x60, 0x40, 0x04, 0x27, 0x03, 0x00, 0x10, 0x27, 0x01, 0x00, 0x04, 0x00,
+	 0x64, 0x40, 0x80, 0x27, 0x31, 0x00, 0x00, 0x00, 0x3C, 0x46, 0x02, 0x65, 0xB7, 0x60, 0x66, 0x78,
+	 0xFF, 0xFF, 0xCD, 0x81, 0x63, 0x42, 0x5A, 0xD0, 0x3C, 0x46, 0x26, 0x02, 0x64, 0x44, 0x88, 0x3A,
+	 0x23, 0x00, 0x77, 0x37, 0x39, 0x00, 0x78, 0x37, 0x37, 0x00, 0x8E, 0x37, 0x35, 0x00, 0xF1, 0x01,
+	 0x2D, 0x60, 0x52, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x2A, 0x2D, 0x00, 0x07, 0x00,
+	 0x2D, 0x60, 0x52, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x2A, 0xE2, 0x01, 0x3C, 0x46,
+	 0x3E, 0xF2, 0x40, 0x60, 0x00, 0x65, 0xF0, 0x84, 0xA4, 0x84, 0x18, 0xFA, 0x2A, 0xF2, 0xBF, 0x60,
+	 0xFF, 0x65, 0xA4, 0x84, 0x2A, 0xFA, 0x18, 0x00, 0x3C, 0x46, 0x22, 0xF0, 0x80, 0x67, 0xB0, 0x84,
+	 0xA2, 0xDA, 0xFF, 0xFF, 0x3F, 0xF2, 0x3E, 0xF0, 0x08, 0xA4, 0x60, 0x41, 0x22, 0xF2, 0xFF, 0xFF,
+	 0x60, 0x40, 0x01, 0x26, 0x03, 0x00, 0x04, 0x26, 0x03, 0x00, 0x06, 0x00, 0x04, 0x2B, 0x04, 0x00,
+	 0x61, 0x44, 0x64, 0x40, 0x10, 0x26, 0x3F, 0xFA, 0x3C, 0x46, 0x2C, 0xF2, 0x27, 0x40, 0x01, 0x27,
+	 0x32, 0xF2, 0xD5, 0xF1, 0x60, 0x40, 0x01, 0x26, 0x53, 0x00, 0x09, 0x60, 0x00, 0x64, 0xD0, 0x80,
+	 0x3F, 0xF2, 0x09, 0x06, 0x2C, 0x45, 0xC4, 0x84, 0xD0, 0x80, 0x40, 0x4A, 0x40, 0x06, 0x60, 0x43,
+	 0x64, 0x44, 0x54, 0x88, 0x18, 0x00, 0x60, 0x45, 0x28, 0x60, 0x36, 0x64, 0xA0, 0xD3, 0xDB, 0xF3,
+	 0x00, 0xBC, 0x60, 0x47, 0xEC, 0xA0, 0x33, 0x03, 0x32, 0x07, 0x2C, 0x44, 0xC4, 0x81, 0x02, 0x60,
+	 0x1C, 0x65, 0x45, 0x4A, 0xD5, 0x80, 0x2C, 0x45, 0x2A, 0x06, 0x27, 0x40, 0x04, 0x27, 0x30, 0x00,
+	 0x2A, 0x43, 0xD7, 0x85, 0x45, 0x48, 0xD6, 0xF1, 0x0F, 0xF2, 0xD3, 0x80, 0x01, 0x65, 0x01, 0x07,
+	 0x00, 0x65, 0xB4, 0x84, 0x0F, 0xFA, 0x00, 0x63, 0x3F, 0xF2, 0x28, 0x45, 0x60, 0x41, 0xD4, 0x84,
+	 0xDF, 0x83, 0xFC, 0x07, 0x14, 0xFC, 0x61, 0x44, 0x01, 0x36, 0x02, 0x00, 0x09, 0x3A, 0x06, 0x00,
+	 0x28, 0x44, 0x48, 0x88, 0x2A, 0x44, 0xC8, 0x83, 0x43, 0x4A, 0xE5, 0x01, 0x17, 0xFA, 0x04, 0x60,
+	 0x00, 0x64, 0x27, 0x45, 0xB4, 0x84, 0x2A, 0xFA, 0x28, 0x43, 0x16, 0xFC, 0x0D, 0x00, 0x3F, 0xF2,
+	 0x2C, 0x45, 0xD6, 0xF1, 0xC4, 0x81, 0xD1, 0x80, 0x0F, 0xF2, 0x01, 0x06, 0x01, 0xBC, 0x0F, 0xFA,
+	 0x3F, 0xF2, 0x17, 0xFA, 0x01, 0x64, 0x14, 0xFA, 0x07, 0xF0, 0x66, 0x43, 0x64, 0x46, 0x0E, 0xF0,
+	 0x63, 0x46, 0x00, 0x7F, 0x64, 0x5E, 0x4B, 0xFB, 0x64, 0x44, 0x00, 0x7E, 0xDB, 0xFB, 0x7C, 0xF1,
+	 0x60, 0x43, 0x60, 0x47, 0xD0, 0x80, 0xC0, 0x65, 0x01, 0x06, 0x64, 0x44, 0x0A, 0x36, 0x70, 0x64,
+	 0x14, 0x36, 0x38, 0x64, 0x37, 0x36, 0x15, 0x64, 0x6E, 0x36, 0x0B, 0x64, 0x44, 0x86, 0x2A, 0xF2,
+	 0x07, 0xF0, 0x60, 0x40, 0xB0, 0x3A, 0x03, 0x00, 0x40, 0x3B, 0x01, 0x00, 0x12, 0x00, 0x0C, 0xB4,
+	 0x08, 0x3A, 0x55, 0x00, 0x22, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x80, 0x2B, 0x50, 0x00, 0x17, 0xF2,
+	 0x22, 0xF0, 0xFF, 0xFF, 0x64, 0x40, 0x22, 0x22, 0x04, 0x00, 0x00, 0xA8, 0x01, 0xA8, 0x47, 0x03,
+	 0x46, 0x03, 0x3C, 0x46, 0x2A, 0xF0, 0x40, 0x67, 0xB0, 0x84, 0xA2, 0xDA, 0x60, 0x45, 0x22, 0xF2,
+	 0xFF, 0xFF, 0x60, 0x43, 0x60, 0x40, 0x01, 0x26, 0x03, 0x00, 0x04, 0x26, 0x0A, 0x00, 0x02, 0x00,
+	 0x04, 0x27, 0x07, 0x00, 0x65, 0x44, 0x2A, 0x65, 0x60, 0x40, 0x03, 0x2B, 0x24, 0x65, 0x45, 0x4C,
+	 0x2E, 0x00, 0x65, 0x44, 0x2E, 0x65, 0x60, 0x40, 0x03, 0x2B, 0x28, 0x65, 0x45, 0x4C, 0x07, 0xF0,
+	 0xA9, 0xF3, 0xFF, 0xFF, 0xD0, 0x80, 0x00, 0x7C, 0x03, 0x03, 0x63, 0x40, 0x01, 0x2A, 0x01, 0x00,
+	 0x3D, 0xF1, 0x2A, 0xF2, 0xFF, 0xFF, 0x08, 0xB0, 0x3E, 0xF2, 0x19, 0x03, 0x60, 0x47, 0xE8, 0x84,
+	 0xE8, 0x84, 0xE8, 0x84, 0x03, 0xB4, 0xD0, 0x80, 0xFF, 0xFF, 0x11, 0x03, 0x24, 0x60, 0x6E, 0x62,
+	 0x24, 0x60, 0x46, 0x64, 0xA2, 0xDB, 0x3C, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF,
+	 0x2B, 0xFF, 0x5C, 0x5C, 0xFC, 0xFC, 0xCE, 0xFE, 0xB0, 0x60, 0xE1, 0x78, 0xFF, 0xFF, 0xDB, 0xF1,
+	 0x2C, 0x45, 0x64, 0x43, 0x17, 0xF2, 0x4B, 0xF1, 0xC4, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x81,
+	 0x63, 0x40, 0x37, 0x37, 0xE1, 0x81, 0x64, 0x45, 0xB0, 0x60, 0x58, 0x4D, 0xB6, 0x78, 0xFF, 0xFF,
+	 0xAE, 0x82, 0xFC, 0xA2, 0x0A, 0x03, 0x63, 0x40, 0x6E, 0x3B, 0x06, 0x00, 0x60, 0x41, 0x04, 0x0D,
+	 0x63, 0x44, 0x80, 0x7E, 0xDB, 0xFB, 0x61, 0x44, 0xDC, 0x84, 0x2B, 0xF0, 0x1B, 0xFA, 0x64, 0x44,
+	 0x80, 0x27, 0x34, 0x00, 0x16, 0xF2, 0x0F, 0xF0, 0xAC, 0x84, 0x2C, 0x45, 0x29, 0x03, 0x4B, 0xF1,
+	 0xC4, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x81, 0x63, 0x40, 0x37, 0x37, 0xE1, 0x81, 0x64, 0x45,
+	 0x0F, 0xF0, 0xB0, 0x60, 0x58, 0x4D, 0xB6, 0x78, 0xFF, 0xFF, 0xAE, 0x82, 0xFC, 0xA2, 0x0A, 0x03,
+	 0x63, 0x40, 0x6E, 0x3B, 0x06, 0x00, 0x60, 0x41, 0x04, 0x0D, 0x80, 0x67, 0xB0, 0x84, 0x0F, 0xFA,
+	 0x61, 0x44, 0xDC, 0x84, 0x1D, 0xFA, 0xDE, 0x65, 0xC4, 0x85, 0x26, 0x41, 0xE1, 0x81, 0xC5, 0x84,
+	 0x2B, 0xFA, 0x1B, 0xF0, 0xDE, 0x64, 0xC0, 0x85, 0x26, 0x44, 0xE0, 0x84, 0xC4, 0x84, 0x10, 0xFA,
+	 0x26, 0x44, 0x2C, 0xF0, 0x0A, 0xA4, 0x64, 0x40, 0x01, 0x26, 0x00, 0x64, 0x11, 0xFA, 0xDB, 0xF3,
+	 0x13, 0xFA, 0xFF, 0xFF, 0x0D, 0xF2, 0x3E, 0xF0, 0x60, 0x47, 0xFF, 0xB4, 0x64, 0x41, 0x01, 0xB1,
+	 0x01, 0x63, 0x1D, 0x02, 0x60, 0x41, 0xFF, 0x22, 0x04, 0x00, 0xB0, 0x60, 0x58, 0x4F, 0xA7, 0x78,
+	 0xFF, 0xFF, 0x0F, 0x60, 0x92, 0x64, 0xA0, 0xDD, 0x2D, 0x60, 0x5A, 0x62, 0xA2, 0xD3, 0xB0, 0x60,
+	 0x58, 0x4D, 0xD8, 0x78, 0xFF, 0xFF, 0x60, 0x41, 0x01, 0x63, 0x61, 0x40, 0xFF, 0x22, 0x04, 0x00,
+	 0xB0, 0x60, 0x58, 0x4F, 0xA7, 0x78, 0xFF, 0xFF, 0x0F, 0x60, 0x94, 0x64, 0xA0, 0xDD, 0x2A, 0xF2,
+	 0xFF, 0xFF, 0x60, 0x40, 0x40, 0x27, 0x03, 0x00, 0xB5, 0x60, 0x19, 0x78, 0xFF, 0xFF, 0x22, 0xF2,
+	 0x46, 0x43, 0x60, 0x40, 0x22, 0x26, 0x8B, 0x00, 0x01, 0x26, 0x05, 0x00, 0x04, 0x26, 0x0C, 0x00,
+	 0xB5, 0x60, 0x19, 0x78, 0xFF, 0xFF, 0x04, 0x27, 0x03, 0x00, 0xB5, 0x60, 0x19, 0x78, 0xFF, 0xFF,
+	 0xA9, 0xF3, 0xFF, 0xFF, 0x60, 0x46, 0x02, 0x00, 0x07, 0xF4, 0xFF, 0xFF, 0xA3, 0x46, 0x2A, 0xF2,
+	 0xA3, 0x46, 0x60, 0x40, 0x08, 0x27, 0x3B, 0x00, 0xA9, 0xF3, 0x66, 0x5C, 0xD0, 0x80, 0x37, 0xF0,
+	 0x08, 0x03, 0x64, 0x40, 0x10, 0x2A, 0x12, 0x00, 0xFF, 0x60, 0xEF, 0x64, 0xA0, 0x84, 0x37, 0xFA,
+	 0x24, 0x00, 0x3D, 0xF3, 0x01, 0x61, 0x60, 0x43, 0xCF, 0x83, 0xE1, 0x81, 0xFD, 0x0D, 0xE9, 0x81,
+	 0xA1, 0x80, 0xFF, 0xFF, 0x03, 0x03, 0x91, 0x84, 0x37, 0xFA, 0x17, 0x00, 0x47, 0xF2, 0xFF, 0xFF,
+	 0x10, 0xA0, 0xFF, 0xFF, 0x02, 0x04, 0xFF, 0x60, 0xFF, 0x64, 0xDC, 0x84, 0x47, 0xFA, 0x46, 0xF2,
+	 0x16, 0x04, 0xDC, 0x84, 0x46, 0xFA, 0x45, 0xF2, 0x08, 0x04, 0xDC, 0x84, 0x45, 0xFA, 0x05, 0x04,
+	 0x37, 0xF2, 0xFF, 0xFF, 0xE0, 0x84, 0xE8, 0x84, 0x37, 0xFA, 0x0D, 0x60, 0x3E, 0x62, 0x80, 0xFF,
+	 0x78, 0x44, 0x03, 0xA4, 0xA2, 0xDB, 0xBE, 0x60, 0x66, 0x78, 0xFF, 0xFF, 0x84, 0xFF, 0x0D, 0x60,
+	 0x3E, 0x62, 0x80, 0xFF, 0x78, 0x44, 0x03, 0xA4, 0xA2, 0xDB, 0xBE, 0x60, 0xDE, 0x78, 0xFF, 0xFF,
+	 0x84, 0xFF, 0xA9, 0xF3, 0x66, 0x5C, 0xD0, 0x80, 0x00, 0x7C, 0x07, 0x03, 0x66, 0x43, 0x3C, 0x46,
+	 0x22, 0xF2, 0x63, 0x46, 0x60, 0x40, 0x01, 0x2A, 0x01, 0x00, 0x3C, 0xF1, 0x47, 0xF0, 0x64, 0x41,
+	 0x64, 0x47, 0xFF, 0xB4, 0x60, 0x5F, 0x20, 0xBC, 0x80, 0x26, 0x80, 0xAC, 0x60, 0x47, 0xA3, 0x46,
+	 0x3A, 0xFA, 0x64, 0x44, 0x20, 0x7F, 0x34, 0x94, 0x3B, 0xFA, 0xA3, 0x46, 0x46, 0xF2, 0x45, 0xF0,
+	 0xA3, 0x46, 0x3C, 0xFA, 0x3D, 0xF8, 0x08, 0x60, 0x00, 0xEA, 0x0F, 0x64, 0x60, 0x7F, 0xA0, 0x5A,
+	 0x80, 0x60, 0x00, 0xEA, 0xA0, 0x60, 0x00, 0xEA, 0xD1, 0x60, 0x00, 0xEA, 0x8A, 0x00, 0x2A, 0xF2,
+	 0xFF, 0xFF, 0x60, 0x40, 0x08, 0x27, 0x35, 0x00, 0x2A, 0xF2, 0x00, 0x60, 0x7C, 0x62, 0x60, 0x40,
+	 0x40, 0x2B, 0x27, 0x00, 0xA2, 0xD3, 0x00, 0x61, 0x60, 0xFE, 0xA0, 0xD3, 0xDE, 0x82, 0xA2, 0xD1,
+	 0xFF, 0xFF, 0x20, 0xFE, 0x64, 0x5F, 0xDC, 0x84, 0xF1, 0x81, 0xC0, 0x2B, 0x04, 0x00, 0x80, 0x2A,
+	 0x02, 0x00, 0x7F, 0xA4, 0xDC, 0x84, 0xFF, 0x3B, 0x03, 0x00, 0x60, 0x47, 0xDC, 0x87, 0x01, 0x61,
+	 0xC0, 0x80, 0x00, 0x36, 0xDC, 0x84, 0x4E, 0xDB, 0x60, 0xFE, 0xDA, 0x82, 0xA2, 0xD1, 0xFF, 0xFF,
+	 0xC1, 0x84, 0xF0, 0x22, 0x10, 0xA4, 0xF0, 0x2A, 0x01, 0x00, 0x00, 0x64, 0xA2, 0xDB, 0xFF, 0xFF,
+	 0x20, 0xFE, 0x00, 0x60, 0x7C, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0xA0, 0xD3, 0x5A, 0xD1, 0x3A, 0xFA,
+	 0x3B, 0xF8, 0x74, 0x62, 0xA2, 0xD0, 0xFF, 0xFF, 0x64, 0x44, 0xE0, 0x7F, 0xA0, 0x5A, 0x64, 0x47,
+	 0xE1, 0x7F, 0x5A, 0xD0, 0xA0, 0x5A, 0x64, 0x44, 0xE2, 0x7F, 0xA0, 0x5A, 0x00, 0x60, 0x80, 0x62,
+	 0xA2, 0xD3, 0xFF, 0xFF, 0xA0, 0xD1, 0x5A, 0xD1, 0x64, 0x45, 0x64, 0x44, 0xE3, 0x7F, 0xA0, 0x5A,
+	 0x64, 0x47, 0xE4, 0x7F, 0x5A, 0xD1, 0xA0, 0x5A, 0x64, 0x44, 0xE5, 0x7F, 0xA0, 0x5A, 0x64, 0x47,
+	 0xE6, 0x7F, 0x5A, 0xD1, 0xA0, 0x5A, 0x64, 0x44, 0xE7, 0x7F, 0xA0, 0x5A, 0x65, 0x40, 0x0D, 0x3A,
+	 0x1C, 0x00, 0x64, 0x47, 0xE8, 0x7F, 0x5A, 0xD1, 0xA0, 0x5A, 0x64, 0x44, 0xE9, 0x7F, 0xA0, 0x5A,
+	 0x64, 0x47, 0xEA, 0x7F, 0x5A, 0xD1, 0xA0, 0x5A, 0x64, 0x44, 0xEB, 0x7F, 0xA0, 0x5A, 0x64, 0x47,
+	 0xEC, 0x7F, 0x5A, 0xD1, 0xA0, 0x5A, 0x64, 0x44, 0xED, 0x7F, 0xA0, 0x5A, 0x64, 0x47, 0xEE, 0x7F,
+	 0x5A, 0xD1, 0xA0, 0x5A, 0x64, 0x44, 0xEF, 0x7F, 0xA0, 0x5A, 0x08, 0x60, 0x00, 0xEA, 0x65, 0x44,
+	 0x02, 0xA4, 0x60, 0x7F, 0xA0, 0x5A, 0x80, 0x60, 0x00, 0xEA, 0xA0, 0x60, 0x00, 0xEA, 0xD1, 0x60,
+	 0x00, 0xEA, 0x02, 0x64, 0x3B, 0xDB, 0xB8, 0x60, 0xBE, 0x78, 0xFF, 0xFF, 0x66, 0x44, 0xFC, 0xFB,
+	 0x07, 0xF0, 0x00, 0x64, 0xD0, 0x80, 0xA9, 0xF3, 0x17, 0x03, 0xD0, 0x80, 0x66, 0x41, 0x64, 0x46,
+	 0x6F, 0xF2, 0x61, 0x46, 0x7B, 0x03, 0x60, 0x40, 0x00, 0x36, 0x78, 0x00, 0x47, 0xF1, 0x07, 0xF0,
+	 0x64, 0x40, 0x02, 0x26, 0x01, 0x00, 0x0B, 0x00, 0x03, 0x12, 0xB6, 0x60, 0x38, 0x78, 0xFF, 0xFF,
+	 0xFC, 0x0A, 0xB7, 0x60, 0x56, 0x78, 0xFF, 0xFF, 0xB7, 0x60, 0x56, 0x78, 0xFF, 0xFF, 0x66, 0x41,
+	 0x64, 0x46, 0x0E, 0xF2, 0x60, 0x45, 0x61, 0x46, 0x10, 0x7E, 0x4E, 0xFB, 0x65, 0x44, 0x60, 0x40,
+	 0x01, 0x36, 0x5C, 0x00, 0x02, 0x36, 0x5D, 0x00, 0x03, 0x36, 0x34, 0x00, 0x04, 0x36, 0x45, 0x00,
+	 0x67, 0x00, 0x00, 0x64, 0x4C, 0xFB, 0x66, 0x41, 0x64, 0x46, 0x6F, 0xF2, 0xFF, 0xFF, 0x05, 0x7E,
+	 0x6F, 0xFA, 0x61, 0x46, 0x00, 0x65, 0x65, 0x43, 0x66, 0x41, 0x64, 0x46, 0x70, 0xF2, 0x8C, 0xFA,
+	 0x00, 0xA8, 0x6F, 0xF2, 0x15, 0x03, 0x60, 0x47, 0xFF, 0xB5, 0x70, 0xF2, 0x00, 0xBB, 0xFF, 0xA0,
+	 0x07, 0x03, 0x0E, 0x06, 0xE8, 0x84, 0xA4, 0x80, 0xFF, 0xFF, 0x02, 0x02, 0xFB, 0x04, 0x08, 0x00,
+	 0xB9, 0x81, 0xE8, 0x84, 0xD9, 0x81, 0xFD, 0x04, 0x0F, 0x60, 0xA2, 0x65, 0x45, 0xD3, 0x0E, 0xFA,
+	 0x0C, 0xF4, 0xFF, 0xFF, 0x66, 0x41, 0x64, 0x46, 0x0E, 0xF2, 0x61, 0x46, 0xFF, 0xFF, 0xA0, 0x7E,
+	 0x4E, 0xFB, 0x24, 0x00, 0x4C, 0xF3, 0xFF, 0xFF, 0xDC, 0x84, 0x4C, 0xFB, 0xCB, 0xF3, 0x60, 0x45,
+	 0xD4, 0x80, 0xFF, 0xFF, 0x1B, 0x02, 0x24, 0x60, 0xA6, 0x62, 0x0F, 0x60, 0x96, 0x64, 0xA2, 0xDB,
+	 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0xBC, 0x01, 0x4C, 0xF3, 0x66, 0x41, 0xDC, 0x84,
+	 0x4C, 0xFB, 0x64, 0x46, 0x6F, 0xF2, 0xFF, 0xFF, 0x03, 0x7E, 0x6F, 0xFA, 0x61, 0x46, 0x66, 0x41,
+	 0x64, 0x46, 0x0E, 0xF2, 0x61, 0x46, 0xFF, 0xFF, 0xA4, 0x7E, 0x4E, 0xFB, 0xB7, 0x60, 0x56, 0x78,
+	 0xFF, 0xFF, 0x66, 0x41, 0x64, 0x46, 0x6F, 0xF2, 0xFF, 0xFF, 0x01, 0x7E, 0x6F, 0xFA, 0x61, 0x46,
+	 0x66, 0x41, 0x64, 0x46, 0x0E, 0xF2, 0x61, 0x46, 0xFF, 0xFF, 0xA8, 0x7E, 0x4E, 0xFB, 0xEE, 0x01,
+	 0x66, 0x41, 0x64, 0x46, 0x6F, 0xF2, 0x8C, 0xFA, 0x60, 0x47, 0x70, 0xF2, 0xFF, 0xB5, 0x08, 0x18,
+	 0xE4, 0x84, 0xA4, 0x80, 0xFF, 0xFF, 0x03, 0x02, 0xFB, 0x04, 0x01, 0x64, 0x01, 0x00, 0x00, 0x64,
+	 0x0C, 0xF4, 0x00, 0xA8, 0xFF, 0xFF, 0xDD, 0x02, 0x66, 0x41, 0x64, 0x46, 0x6F, 0xF2, 0xFF, 0xFF,
+	 0x60, 0x47, 0x70, 0xF2, 0xFF, 0xB5, 0x61, 0x46, 0x00, 0xA8, 0xFF, 0xFF, 0x29, 0x03, 0xE0, 0x84,
+	 0xA4, 0x80, 0xFF, 0xFF, 0xFC, 0x03, 0x66, 0x41, 0x64, 0x46, 0x70, 0xFA, 0x61, 0x46, 0x01, 0x65,
+	 0x65, 0x43, 0x66, 0x41, 0x64, 0x46, 0x70, 0xF2, 0x8C, 0xFA, 0x00, 0xA8, 0x6F, 0xF2, 0x15, 0x03,
+	 0x60, 0x47, 0xFF, 0xB5, 0x70, 0xF2, 0x00, 0xBB, 0xFF, 0xA0, 0x07, 0x03, 0x0E, 0x06, 0xE8, 0x84,
+	 0xA4, 0x80, 0xFF, 0xFF, 0x02, 0x02, 0xFB, 0x04, 0x08, 0x00, 0xB9, 0x81, 0xE8, 0x84, 0xD9, 0x81,
+	 0xFD, 0x04, 0x0F, 0x60, 0xA2, 0x65, 0x45, 0xD3, 0x0E, 0xFA, 0x0C, 0xF4, 0xFF, 0xFF, 0x95, 0x01,
+	 0x94, 0x01, 0x65, 0x44, 0x60, 0x40, 0x01, 0x36, 0xA1, 0x01, 0x02, 0x36, 0x01, 0x00, 0x9E, 0x01,
+	 0x66, 0x41, 0x64, 0x46, 0x6F, 0xF2, 0xFF, 0xFF, 0x01, 0x7E, 0x6F, 0xFA, 0x61, 0x46, 0x00, 0x65,
+	 0x65, 0x43, 0x66, 0x41, 0x64, 0x46, 0x70, 0xF2, 0x8C, 0xFA, 0x00, 0xA8, 0x6F, 0xF2, 0x15, 0x03,
+	 0x60, 0x47, 0xFF, 0xB5, 0x70, 0xF2, 0x00, 0xBB, 0xFF, 0xA0, 0x07, 0x03, 0x0E, 0x06, 0xE8, 0x84,
+	 0xA4, 0x80, 0xFF, 0xFF, 0x02, 0x02, 0xFB, 0x04, 0x08, 0x00, 0xB9, 0x81, 0xE8, 0x84, 0xD9, 0x81,
+	 0xFD, 0x04, 0x0F, 0x60, 0xA2, 0x65, 0x45, 0xD3, 0x0E, 0xFA, 0x0C, 0xF4, 0xFF, 0xFF, 0x66, 0x41,
+	 0x64, 0x46, 0x0E, 0xF2, 0x61, 0x46, 0xD0, 0x7E, 0x4E, 0xFB, 0xB7, 0x60, 0x56, 0x78, 0xFF, 0xFF,
+	 0x60, 0x45, 0x66, 0x41, 0x64, 0x46, 0x0E, 0xF2, 0x61, 0x46, 0x20, 0x7E, 0x4E, 0xFB, 0x65, 0x44,
+	 0x60, 0x40, 0x01, 0x36, 0x0B, 0x00, 0x02, 0x36, 0x1A, 0x00, 0x03, 0x36, 0x53, 0x00, 0x04, 0x36,
+	 0x70, 0x00, 0x05, 0x36, 0x14, 0x00, 0xB7, 0x60, 0x56, 0x78, 0xFF, 0xFF, 0x07, 0xF0, 0x66, 0x41,
+	 0x64, 0x46, 0x6F, 0xF2, 0xFF, 0xFF, 0x02, 0x7E, 0x6F, 0xFA, 0x61, 0x46, 0x66, 0x41, 0x64, 0x46,
+	 0x0E, 0xF2, 0x61, 0x46, 0xB0, 0x7E, 0x4E, 0xFB, 0xB7, 0x60, 0x56, 0x78, 0xFF, 0xFF, 0x07, 0xF0,
+	 0x01, 0x65, 0x65, 0x43, 0x66, 0x41, 0x64, 0x46, 0x70, 0xF2, 0x8C, 0xFA, 0x00, 0xA8, 0x6F, 0xF2,
+	 0x15, 0x03, 0x60, 0x47, 0xFF, 0xB5, 0x70, 0xF2, 0x00, 0xBB, 0xFF, 0xA0, 0x07, 0x03, 0x0E, 0x06,
+	 0xE8, 0x84, 0xA4, 0x80, 0xFF, 0xFF, 0x02, 0x02, 0xFB, 0x04, 0x08, 0x00, 0xB9, 0x81, 0xE8, 0x84,
+	 0xD9, 0x81, 0xFD, 0x04, 0x0F, 0x60, 0xA2, 0x65, 0x45, 0xD3, 0x0E, 0xFA, 0x0C, 0xF4, 0xFF, 0xFF,
+	 0x66, 0x41, 0x64, 0x46, 0x6F, 0xF2, 0x00, 0x63, 0x03, 0x7E, 0x6F, 0xFA, 0x61, 0x46, 0x4C, 0xFD,
+	 0x66, 0x41, 0x64, 0x46, 0x0E, 0xF2, 0x61, 0x46, 0xB4, 0x7E, 0x4E, 0xFB, 0x24, 0x60, 0xA6, 0x62,
+	 0x0F, 0x60, 0x96, 0x64, 0xA2, 0xDB, 0x02, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0xB7, 0x60,
+	 0x56, 0x78, 0xFF, 0xFF, 0x66, 0x41, 0x64, 0x46, 0x70, 0xF2, 0x4C, 0xF3, 0x02, 0xB0, 0x61, 0x46,
+	 0xCC, 0x84, 0x05, 0x03, 0x04, 0x28, 0x4C, 0xFB, 0xB7, 0x60, 0x56, 0x78, 0xFF, 0xFF, 0x04, 0x28,
+	 0x4C, 0xFB, 0x66, 0x41, 0x64, 0x46, 0x6F, 0xF2, 0xFF, 0xFF, 0x04, 0x7E, 0x6F, 0xFA, 0x61, 0x46,
+	 0x66, 0x41, 0x64, 0x46, 0x0E, 0xF2, 0x61, 0x46, 0xB8, 0x7E, 0x4E, 0xFB, 0xB7, 0x60, 0x56, 0x78,
+	 0xFF, 0xFF, 0x66, 0x41, 0x64, 0x46, 0x6F, 0xF2, 0xFF, 0xFF, 0x60, 0x47, 0xFF, 0xB5, 0x70, 0xF2,
+	 0x61, 0x46, 0xFF, 0xA0, 0xFF, 0xFF, 0x35, 0x06, 0xE8, 0x84, 0xA4, 0x80, 0xFF, 0xFF, 0x02, 0x02,
+	 0xFB, 0x04, 0x2F, 0x00, 0x64, 0x46, 0x70, 0xFA, 0x01, 0x65, 0x65, 0x43, 0x66, 0x41, 0x64, 0x46,
+	 0x70, 0xF2, 0x8C, 0xFA, 0x00, 0xA8, 0x6F, 0xF2, 0x15, 0x03, 0x60, 0x47, 0xFF, 0xB5, 0x70, 0xF2,
+	 0x00, 0xBB, 0xFF, 0xA0, 0x07, 0x03, 0x0E, 0x06, 0xE8, 0x84, 0xA4, 0x80, 0xFF, 0xFF, 0x02, 0x02,
+	 0xFB, 0x04, 0x08, 0x00, 0xB9, 0x81, 0xE8, 0x84, 0xD9, 0x81, 0xFD, 0x04, 0x0F, 0x60, 0xA2, 0x65,
+	 0x45, 0xD3, 0x0E, 0xFA, 0x0C, 0xF4, 0xFF, 0xFF, 0x6F, 0xF2, 0x00, 0x63, 0x03, 0x7E, 0x6F, 0xFA,
+	 0x3C, 0x46, 0x4C, 0xFD, 0x66, 0x41, 0x64, 0x46, 0x0E, 0xF2, 0x61, 0x46, 0xC0, 0x7E, 0x4E, 0xFB,
+	 0x5D, 0x00, 0x5C, 0x00, 0x65, 0x44, 0x60, 0x40, 0x01, 0x36, 0x03, 0x00, 0x02, 0x36, 0x18, 0x00,
+	 0x55, 0x00, 0x66, 0x41, 0x64, 0x46, 0x70, 0xF2, 0x61, 0x46, 0x01, 0xB0, 0xFF, 0xFF, 0x4E, 0x02,
+	 0x07, 0xF0, 0x66, 0x41, 0x64, 0x46, 0x6F, 0xF2, 0xFF, 0xFF, 0x02, 0x7E, 0x6F, 0xFA, 0x61, 0x46,
+	 0x66, 0x41, 0x64, 0x46, 0x0E, 0xF2, 0x61, 0x46, 0xE0, 0x7E, 0x4E, 0xFB, 0x3F, 0x00, 0x3E, 0x00,
+	 0x07, 0xF0, 0x66, 0x41, 0x64, 0x46, 0x6F, 0xF2, 0xFF, 0xFF, 0x01, 0x7E, 0x6F, 0xFA, 0x60, 0x47,
+	 0xFF, 0xB5, 0x70, 0xF2, 0x61, 0x46, 0xFF, 0xA0, 0xFF, 0xFF, 0xF1, 0x06, 0xE8, 0x84, 0xA4, 0x80,
+	 0xFF, 0xFF, 0x02, 0x02, 0xFB, 0x04, 0xEB, 0x01, 0x66, 0x41, 0x64, 0x46, 0x70, 0xFA, 0x61, 0x46,
+	 0x00, 0x65, 0x65, 0x43, 0x66, 0x41, 0x64, 0x46, 0x70, 0xF2, 0x8C, 0xFA, 0x00, 0xA8, 0x6F, 0xF2,
+	 0x15, 0x03, 0x60, 0x47, 0xFF, 0xB5, 0x70, 0xF2, 0x00, 0xBB, 0xFF, 0xA0, 0x07, 0x03, 0x0E, 0x06,
+	 0xE8, 0x84, 0xA4, 0x80, 0xFF, 0xFF, 0x02, 0x02, 0xFB, 0x04, 0x08, 0x00, 0xB9, 0x81, 0xE8, 0x84,
+	 0xD9, 0x81, 0xFD, 0x04, 0x0F, 0x60, 0xA2, 0x65, 0x45, 0xD3, 0x0E, 0xFA, 0x0C, 0xF4, 0xFF, 0xFF,
+	 0x66, 0x41, 0x64, 0x46, 0x0E, 0xF2, 0x61, 0x46, 0xE4, 0x7E, 0x4E, 0xFB, 0x03, 0x64, 0x3B, 0xDB,
+	 0xCA, 0xFE, 0x47, 0xF1, 0x01, 0x65, 0x32, 0x40, 0x04, 0x27, 0x08, 0x00, 0x2C, 0xF2, 0x64, 0x45,
+	 0x02, 0x22, 0x04, 0x00, 0x60, 0x40, 0x01, 0x26, 0x01, 0x00, 0xE3, 0x00, 0x14, 0xF2, 0x65, 0x40,
+	 0x01, 0x26, 0x1D, 0x00, 0x60, 0x45, 0x05, 0x64, 0x3B, 0xDB, 0x65, 0x44, 0xCC, 0x85, 0xB8, 0xF1,
+	 0x27, 0x60, 0x78, 0x64, 0xA0, 0xD3, 0xFF, 0xFF, 0xD8, 0x80, 0xC4, 0x84, 0x0B, 0x03, 0x07, 0x05,
+	 0xDC, 0x80, 0xD0, 0x80, 0x04, 0x03, 0xA2, 0xDB, 0x09, 0x04, 0xC6, 0xFE, 0x07, 0x00, 0x00, 0x64,
+	 0xB8, 0x84, 0xA2, 0xDB, 0x8A, 0xFF, 0x20, 0x60, 0x00, 0x75, 0x88, 0xFF, 0xAF, 0x00, 0x60, 0x41,
+	 0x2A, 0xF0, 0x00, 0x60, 0x0C, 0x64, 0xA0, 0x84, 0x04, 0x36, 0x02, 0x00, 0x0C, 0x3A, 0x01, 0x00,
+	 0xA5, 0x00, 0x61, 0x45, 0x60, 0x41, 0xB8, 0xF1, 0x27, 0x60, 0x78, 0x64, 0xA0, 0xD3, 0xFF, 0xFF,
+	 0xD8, 0x80, 0xC4, 0x84, 0x0B, 0x03, 0x07, 0x05, 0xDC, 0x80, 0xD0, 0x80, 0x04, 0x03, 0xA2, 0xDB,
+	 0x09, 0x04, 0xC6, 0xFE, 0x07, 0x00, 0x00, 0x64, 0xB8, 0x84, 0xA2, 0xDB, 0x8A, 0xFF, 0x20, 0x60,
+	 0x00, 0x75, 0x88, 0xFF, 0x61, 0x40, 0x08, 0x36, 0x01, 0x00, 0x88, 0x00, 0x14, 0xF2, 0x1C, 0x65,
+	 0x60, 0x41, 0x00, 0x63, 0xCD, 0x81, 0xC7, 0x83, 0xFD, 0x02, 0x3F, 0xF0, 0x2C, 0xF2, 0xC3, 0x83,
+	 0x60, 0x40, 0x01, 0x2A, 0x29, 0x00, 0xB8, 0xF1, 0x27, 0x60, 0x76, 0x64, 0xA0, 0xD3, 0xFF, 0xFF,
+	 0xDC, 0x84, 0xDC, 0x80, 0xD0, 0x80, 0x04, 0x03, 0xA2, 0xDB, 0x08, 0x24, 0xC6, 0xFE, 0x04, 0x00,
+	 0x8A, 0xFF, 0x20, 0x60, 0x00, 0x75, 0x88, 0xFF, 0xB8, 0xF1, 0x27, 0x60, 0x7C, 0x64, 0xA0, 0xD3,
+	 0x63, 0x45, 0xD8, 0x80, 0xC4, 0x84, 0x0B, 0x03, 0x07, 0x05, 0xDC, 0x80, 0xD0, 0x80, 0x04, 0x03,
+	 0xA2, 0xDB, 0x09, 0x04, 0xC6, 0xFE, 0x07, 0x00, 0x00, 0x64, 0xB8, 0x84, 0xA2, 0xDB, 0x8A, 0xFF,
+	 0x20, 0x60, 0x00, 0x75, 0x88, 0xFF, 0x52, 0x00, 0xB8, 0xF1, 0x27, 0x60, 0x74, 0x64, 0xA0, 0xD3,
+	 0xFF, 0xFF, 0xDC, 0x84, 0xDC, 0x80, 0xD0, 0x80, 0x04, 0x03, 0xA2, 0xDB, 0x08, 0x24, 0xC6, 0xFE,
+	 0x04, 0x00, 0x8A, 0xFF, 0x20, 0x60, 0x00, 0x75, 0x88, 0xFF, 0xB8, 0xF1, 0x27, 0x60, 0x7A, 0x64,
+	 0xA0, 0xD3, 0x63, 0x45, 0xD8, 0x80, 0xC4, 0x84, 0x0B, 0x03, 0x07, 0x05, 0xDC, 0x80, 0xD0, 0x80,
+	 0x04, 0x03, 0xA2, 0xDB, 0x09, 0x04, 0xC6, 0xFE, 0x07, 0x00, 0x00, 0x64, 0xB8, 0x84, 0xA2, 0xDB,
+	 0x8A, 0xFF, 0x20, 0x60, 0x00, 0x75, 0x88, 0xFF, 0x15, 0xF2, 0xFF, 0xFF, 0x0F, 0xB4, 0x00, 0xA8,
+	 0x01, 0xA8, 0x24, 0x03, 0x12, 0x03, 0xB8, 0xF1, 0x27, 0x60, 0x82, 0x64, 0xA0, 0xD3, 0xFF, 0xFF,
+	 0xDC, 0x84, 0xDC, 0x80, 0xD0, 0x80, 0x04, 0x03, 0xA2, 0xDB, 0x08, 0x24, 0xC6, 0xFE, 0x04, 0x00,
+	 0x8A, 0xFF, 0x20, 0x60, 0x00, 0x75, 0x88, 0xFF, 0x11, 0x00, 0xB8, 0xF1, 0x27, 0x60, 0x80, 0x64,
+	 0xA0, 0xD3, 0xFF, 0xFF, 0xDC, 0x84, 0xDC, 0x80, 0xD0, 0x80, 0x04, 0x03, 0xA2, 0xDB, 0x08, 0x24,
+	 0xC6, 0xFE, 0x04, 0x00, 0x8A, 0xFF, 0x20, 0x60, 0x00, 0x75, 0x88, 0xFF, 0x04, 0x64, 0x3B, 0xDB,
+	 0x24, 0x60, 0x6E, 0x62, 0x24, 0x60, 0x46, 0x64, 0xA2, 0xDB, 0x3C, 0x44, 0x5A, 0xDB, 0x02, 0x64,
+	 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0x5C, 0x5C, 0xFC, 0xFC, 0xCE, 0xFE, 0xB0, 0x60, 0xE1, 0x78,
+	 0xFF, 0xFF, 0x0F, 0xF0, 0x15, 0xF2, 0x64, 0x41, 0x01, 0x2A, 0x02, 0x00, 0xD1, 0xF1, 0x02, 0x00,
+	 0xD0, 0xF1, 0xFF, 0xFF, 0x64, 0x45, 0xDC, 0x84, 0xD4, 0x80, 0x15, 0xFA, 0x30, 0x07, 0x61, 0x40,
+	 0x01, 0x2A, 0x09, 0x00, 0x27, 0x60, 0xA8, 0x64, 0xA0, 0xD3, 0xFF, 0xFF, 0xDC, 0x84, 0xFF, 0xFF,
+	 0x08, 0x28, 0xA2, 0xDB, 0x08, 0x00, 0x27, 0x60, 0xAA, 0x64, 0xA0, 0xD3, 0xFF, 0xFF, 0xDC, 0x84,
+	 0xFF, 0xFF, 0x08, 0x28, 0xA2, 0xDB, 0x2A, 0xF0, 0x08, 0x67, 0xB0, 0x84, 0xA2, 0xDA, 0x00, 0x64,
+	 0x48, 0xFB, 0x2D, 0x60, 0x52, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x2A, 0x0C, 0x00,
+	 0x3C, 0x46, 0x3E, 0xF2, 0x40, 0x60, 0x00, 0x65, 0xF0, 0x84, 0xA4, 0x84, 0x18, 0xFA, 0x2A, 0xF2,
+	 0xBF, 0x60, 0xFF, 0x65, 0xA4, 0x84, 0x2A, 0xFA, 0xB2, 0x60, 0xFC, 0x78, 0xFF, 0xFF, 0x00, 0x64,
+	 0x49, 0xFB, 0xB8, 0xF1, 0x27, 0x60, 0x82, 0x64, 0xA0, 0xD3, 0xFF, 0xFF, 0xDC, 0x84, 0xDC, 0x80,
+	 0xD0, 0x80, 0x04, 0x03, 0xA2, 0xDB, 0x08, 0x24, 0xC6, 0xFE, 0x04, 0x00, 0x8A, 0xFF, 0x20, 0x60,
+	 0x00, 0x75, 0x88, 0xFF, 0xB8, 0xF1, 0x27, 0x60, 0x84, 0x64, 0xA0, 0xD3, 0xFF, 0xFF, 0xDC, 0x84,
+	 0xDC, 0x80, 0xD0, 0x80, 0x04, 0x03, 0xA2, 0xDB, 0x08, 0x24, 0xC6, 0xFE, 0x04, 0x00, 0x8A, 0xFF,
+	 0x20, 0x60, 0x00, 0x75, 0x88, 0xFF, 0x2D, 0x60, 0x5A, 0x63, 0xA3, 0xD3, 0xB0, 0x60, 0x58, 0x4D,
+	 0xD8, 0x78, 0xFF, 0xFF, 0x0D, 0xF2, 0x60, 0x5C, 0x64, 0x5F, 0x0D, 0xFA, 0x23, 0xF0, 0x01, 0x64,
+	 0xB0, 0x84, 0xA2, 0xDA, 0x7B, 0x01, 0xB9, 0x60, 0x43, 0x78, 0xFF, 0xFF, 0x21, 0x64, 0x3B, 0xDB,
+	 0x31, 0xF3, 0x01, 0x63, 0xC4, 0xB4, 0x31, 0xFB, 0x32, 0xFD, 0xB8, 0x60, 0xEF, 0x62, 0x42, 0x40,
+	 0xA0, 0x4C, 0x40, 0xBC, 0x7D, 0xB4, 0xA0, 0x51, 0xA0, 0xFE, 0x1A, 0xFF, 0x24, 0x60, 0x3A, 0x64,
+	 0x08, 0xF0, 0x07, 0xF0, 0xD0, 0x80, 0x24, 0x60, 0x40, 0x62, 0x14, 0x02, 0xA2, 0xD3, 0x01, 0x63,
+	 0xAC, 0x86, 0x07, 0xF2, 0x0F, 0x03, 0xD0, 0x80, 0x09, 0xF2, 0xFA, 0x02, 0x23, 0xFC, 0x24, 0x60,
+	 0x6E, 0x62, 0x24, 0x60, 0x46, 0x64, 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB,
+	 0xFF, 0xFF, 0x2B, 0xFF, 0x3C, 0x46, 0x06, 0x64, 0xA1, 0xFF, 0x49, 0xFB, 0x83, 0x3E, 0x31, 0xF3,
+	 0x87, 0x60, 0x80, 0x61, 0x1D, 0xF0, 0x60, 0x40, 0x01, 0x2A, 0x15, 0x00, 0xFE, 0xB4, 0x31, 0xFB,
+	 0x00, 0x64, 0x49, 0xFB, 0x01, 0x64, 0x47, 0xFB, 0x2D, 0x60, 0x5A, 0x63, 0xA3, 0xD3, 0xB0, 0x60,
+	 0x58, 0x4D, 0xD8, 0x78, 0xFF, 0xFF, 0x00, 0x71, 0x64, 0x5F, 0x0D, 0xFA, 0x40, 0x64, 0x3B, 0xDB,
+	 0xB9, 0x60, 0x43, 0x78, 0xFF, 0xFF, 0x02, 0x2A, 0x1B, 0x00, 0xD1, 0x91, 0x8D, 0xE2, 0x41, 0x64,
+	 0x3B, 0xDB, 0x31, 0xF3, 0x2D, 0x60, 0x62, 0x63, 0xFD, 0xB4, 0x31, 0xFB, 0xA3, 0xD3, 0xB0, 0x60,
+	 0x58, 0x4D, 0xD8, 0x78, 0xFF, 0xFF, 0x02, 0x63, 0x60, 0x5C, 0x0D, 0xF2, 0x47, 0xFD, 0xFF, 0xB5,
+	 0x60, 0x47, 0xD0, 0x80, 0xDC, 0x84, 0x1F, 0x03, 0x60, 0x47, 0xB4, 0x84, 0x0D, 0xFA, 0x1B, 0x00,
+	 0x08, 0x2A, 0x07, 0x00, 0x42, 0x64, 0x3B, 0xDB, 0x31, 0xF3, 0xFF, 0xFF, 0xF7, 0xB4, 0x31, 0xFB,
+	 0x12, 0x00, 0x10, 0x2A, 0x09, 0x00, 0x43, 0x64, 0x3B, 0xDB, 0x31, 0xF3, 0xFF, 0xFF, 0xEF, 0xB4,
+	 0x31, 0xFB, 0xB8, 0x60, 0xBE, 0x78, 0xFF, 0xFF, 0x44, 0x64, 0x3B, 0xDB, 0x31, 0xF3, 0xFF, 0xFF,
+	 0xDF, 0xB4, 0x31, 0xFB, 0x00, 0x00, 0x2A, 0x64, 0x3B, 0xDB, 0xB0, 0x60, 0x97, 0x64, 0x40, 0x40,
+	 0xB5, 0x60, 0x1E, 0x78, 0xFF, 0xFF, 0x1C, 0x60, 0xB8, 0x63, 0xA3, 0xD3, 0xFF, 0xFF, 0x02, 0xB5,
+	 0x04, 0xB5, 0x04, 0x03, 0x03, 0x03, 0xBA, 0x60, 0x3C, 0x78, 0xFF, 0xFF, 0x86, 0xFF, 0x20, 0x44,
+	 0x84, 0xFF, 0x20, 0x2A, 0x04, 0x00, 0xF3, 0x60, 0x58, 0x4E, 0x14, 0x78, 0xFF, 0xFF, 0x31, 0x40,
+	 0x01, 0x26, 0x17, 0x00, 0xA0, 0x4C, 0x49, 0xBC, 0xFF, 0xB4, 0xA0, 0x51, 0x1C, 0x60, 0xB8, 0x63,
+	 0xA3, 0xD3, 0xFF, 0xFF, 0x02, 0xB5, 0x04, 0xBC, 0x09, 0x03, 0x60, 0x40, 0x01, 0x26, 0xED, 0xE2,
+	 0xFE, 0xB4, 0xA3, 0xDB, 0xA0, 0x4C, 0x7D, 0xB4, 0xA0, 0x51, 0x03, 0x00, 0xA0, 0x4C, 0x6D, 0xB4,
+	 0xA0, 0x51, 0xDC, 0xF3, 0xFF, 0xFF, 0xFD, 0xA0, 0xFF, 0xFF, 0x48, 0x03, 0x31, 0x40, 0x04, 0x2A,
+	 0x3E, 0x00, 0x6D, 0xF3, 0x74, 0xF3, 0xCC, 0x83, 0x6D, 0xFD, 0xCC, 0x84, 0x74, 0xFB, 0x1F, 0x02,
+	 0x31, 0x40, 0x02, 0x2A, 0x12, 0x00, 0x6F, 0xF3, 0x70, 0xF1, 0xCC, 0x84, 0x6F, 0xFB, 0x0D, 0x02,
+	 0x6F, 0xF9, 0x31, 0x44, 0x08, 0xBC, 0x40, 0x51, 0x72, 0xF3, 0x71, 0xF1, 0x00, 0xB8, 0x64, 0x45,
+	 0x01, 0x03, 0x67, 0x45, 0x65, 0x50, 0xCC, 0x84, 0x73, 0xFB, 0x28, 0x60, 0x00, 0x64, 0xA0, 0xD3,
+	 0x6E, 0xF1, 0x00, 0xB8, 0x74, 0xF9, 0x03, 0x03, 0x87, 0xF3, 0x6D, 0xFB, 0x04, 0x00, 0x6D, 0xF3,
+	 0x87, 0xF1, 0x15, 0x1B, 0x6D, 0xF9, 0x31, 0x40, 0x01, 0x2A, 0x11, 0x00, 0xDD, 0xFE, 0x0F, 0x05,
+	 0xBA, 0xFE, 0xAD, 0x4F, 0x00, 0x7F, 0x01, 0xBC, 0xA0, 0x5D, 0x00, 0xEE, 0x7F, 0xF1, 0x02, 0x60,
+	 0xEE, 0x64, 0xA3, 0xFB, 0xA4, 0xF9, 0x04, 0x64, 0xA5, 0xFB, 0xDF, 0xFE, 0x19, 0xFF, 0x1A, 0x60,
+	 0x42, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0xCC, 0x84, 0xFF, 0x2B, 0xA2, 0xDB, 0x31, 0x40, 0x01, 0x2A,
+	 0x29, 0x00, 0x9D, 0xFE, 0x27, 0x04, 0x26, 0x0A, 0x9F, 0xFE, 0x24, 0x05, 0x85, 0xFF, 0x20, 0x44,
+	 0x84, 0xFF, 0x40, 0x26, 0x1F, 0x00, 0x3F, 0x40, 0x20, 0x2B, 0x1C, 0x00, 0x38, 0x69, 0xFF, 0xFF,
+	 0x68, 0x44, 0x01, 0x16, 0xFD, 0x01, 0x01, 0x2A, 0x15, 0x00, 0x27, 0x60, 0xB4, 0x64, 0xA0, 0xD3,
+	 0xFF, 0xFF, 0xDC, 0x84, 0xFF, 0xFF, 0x08, 0x28, 0xA2, 0xDB, 0x7F, 0xF1, 0x02, 0x60, 0xEE, 0x64,
+	 0xA3, 0xFB, 0xFF, 0xFF, 0x80, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA4, 0xFB, 0x04, 0x64, 0xA5, 0xFB,
+	 0xDF, 0xFE, 0x19, 0xFF, 0x10, 0x64, 0x3B, 0xDB, 0x80, 0xF3, 0x73, 0x45, 0xE0, 0x84, 0xE0, 0x84,
+	 0xE0, 0x84, 0xE0, 0x84, 0xC4, 0x93, 0xC9, 0xFE, 0x49, 0xF3, 0x3C, 0x46, 0x27, 0x18, 0xCC, 0x84,
+	 0x49, 0xFB, 0x24, 0x02, 0xBB, 0x60, 0x18, 0x64, 0x40, 0x42, 0xFC, 0xFC, 0x00, 0x64, 0x5C, 0x5C,
+	 0x32, 0xFB, 0x82, 0xFF, 0x5C, 0x47, 0x84, 0xFF, 0x62, 0xFF, 0x27, 0x60, 0xA4, 0x64, 0xA0, 0xD3,
+	 0xFF, 0xFF, 0xDC, 0x84, 0xFF, 0xFF, 0x08, 0x28, 0xA2, 0xDB, 0x23, 0xF0, 0x01, 0x64, 0xB0, 0x84,
+	 0xA2, 0xDA, 0x24, 0x60, 0x6E, 0x62, 0x24, 0x60, 0x46, 0x64, 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB,
+	 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xC1, 0xFE, 0xCE, 0xFE, 0x6A, 0xF3, 0xFF, 0xFF,
+	 0x60, 0x41, 0xFD, 0xB4, 0xA2, 0xDB, 0x61, 0x44, 0x01, 0xB0, 0x02, 0xB0, 0x0C, 0x03, 0x0B, 0x02,
+	 0x9D, 0xFE, 0x09, 0x04, 0x24, 0x60, 0xA6, 0x62, 0x1A, 0x60, 0xA2, 0x64, 0xA2, 0xDB, 0x02, 0x64,
+	 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x07, 0x00, 0x80, 0xF3, 0x73, 0x45, 0xE0, 0x84, 0xE0, 0x84,
+	 0xE0, 0x84, 0xE0, 0x84, 0xC4, 0x93, 0x1C, 0x60, 0xB4, 0x63, 0xA3, 0xD3, 0xAD, 0x49, 0x20, 0xB5,
+	 0x08, 0xB1, 0x23, 0x03, 0xE1, 0x81, 0x10, 0xB5, 0x95, 0x81, 0x60, 0x41, 0x18, 0x02, 0x1C, 0x60,
+	 0xB6, 0x7C, 0xA4, 0xD3, 0xFF, 0xFF, 0xCC, 0x84, 0xA4, 0xDB, 0x17, 0x02, 0x05, 0x64, 0xA4, 0xDB,
+	 0x61, 0x44, 0x07, 0xB4, 0xFF, 0xFF, 0x11, 0x02, 0x08, 0xB1, 0xE1, 0x81, 0x95, 0x81, 0xA3, 0xD3,
+	 0x0C, 0x03, 0x08, 0xAC, 0x01, 0xBC, 0xA3, 0xDB, 0xFF, 0xFF, 0x13, 0xFF, 0x06, 0x00, 0x10, 0xAC,
+	 0xA3, 0xDB, 0x1C, 0x60, 0xB6, 0x63, 0x05, 0x7C, 0xA3, 0xD9, 0xB0, 0x60, 0xA4, 0x78, 0xFF, 0xFF,
+	 0x46, 0xF3, 0x45, 0xF1, 0x05, 0x1B, 0x64, 0x44, 0x03, 0x1B, 0x0F, 0x60, 0x92, 0x62, 0xA2, 0xD3,
+	 0x45, 0xFB, 0x00, 0x63, 0x46, 0xFD, 0x60, 0x41, 0x25, 0x64, 0x3B, 0xDB, 0x27, 0x44, 0xEF, 0xB4,
+	 0x40, 0x47, 0x00, 0xB9, 0x71, 0x40, 0x80, 0x27, 0x01, 0x12, 0x2B, 0x03, 0xBA, 0x60, 0x93, 0x62,
+	 0x84, 0xFF, 0x42, 0x42, 0x82, 0xFF, 0xA0, 0x4C, 0x14, 0xBC, 0xFF, 0xB4, 0xA0, 0x51, 0x31, 0x0A,
+	 0xA1, 0xFF, 0xFF, 0xFF, 0x81, 0x3E, 0x70, 0x44, 0xAC, 0x80, 0x2B, 0x0A, 0x71, 0x40, 0x80, 0x27,
+	 0xF7, 0x12, 0x45, 0xF3, 0x4C, 0x02, 0x15, 0x18, 0x31, 0x60, 0x0E, 0x7C, 0xA4, 0xD3, 0xFF, 0xFF,
+	 0x0B, 0x18, 0x31, 0x60, 0x10, 0x7C, 0xA4, 0xD3, 0xFF, 0xFF, 0x06, 0x18, 0xAC, 0x4C, 0x80, 0x26,
+	 0x03, 0x00, 0x00, 0x64, 0x45, 0xFB, 0x05, 0x00, 0x45, 0xF3, 0xFF, 0xFF, 0xCC, 0x84, 0x45, 0xFB,
+	 0xDF, 0x02, 0x06, 0x0A, 0xA0, 0x4C, 0xFB, 0xB4, 0xA0, 0x51, 0xA3, 0x60, 0x99, 0x78, 0xFF, 0xFF,
+	 0x84, 0xFF, 0xBA, 0x60, 0x70, 0x64, 0x40, 0x42, 0x82, 0xFF, 0xA0, 0x4C, 0x14, 0xBC, 0xFF, 0xB4,
+	 0xA0, 0x51, 0xAB, 0x60, 0x2C, 0x78, 0xFF, 0xFF, 0x3C, 0x44, 0xAC, 0x80, 0x32, 0xF1, 0x25, 0x03,
+	 0x64, 0x40, 0x07, 0x22, 0x22, 0x00, 0xA3, 0x60, 0x7B, 0x78, 0xFF, 0xFF, 0xA0, 0x4C, 0x1C, 0xBC,
+	 0xDF, 0xB4, 0xA0, 0x51, 0x31, 0x40, 0x08, 0x2A, 0xEF, 0x01, 0x73, 0xF3, 0x71, 0xF1, 0x00, 0xA0,
+	 0xDC, 0x80, 0x05, 0x03, 0x08, 0x03, 0xCC, 0x84, 0x73, 0xFB, 0x67, 0x50, 0x08, 0x00, 0xCC, 0x84,
+	 0x73, 0xFB, 0x64, 0x50, 0x04, 0x00, 0x31, 0x44, 0xF7, 0xB4, 0x40, 0x51, 0x06, 0x00, 0x28, 0x64,
+	 0x3A, 0xDB, 0xA0, 0x4C, 0x30, 0xBC, 0xF3, 0xB4, 0xA0, 0x51, 0xA1, 0xFF, 0xFF, 0xFF, 0x81, 0x3E,
+	 0x28, 0x64, 0x3B, 0xDB, 0x0F, 0x60, 0x94, 0x62, 0xA2, 0xD3, 0x32, 0x40, 0x02, 0x27, 0x16, 0x00,
+	 0x46, 0xFB, 0x14, 0x18, 0xBB, 0x60, 0x06, 0x64, 0x84, 0xFF, 0x40, 0x42, 0x82, 0xFF, 0xA0, 0x4C,
+	 0x14, 0xBC, 0xF7, 0xB4, 0xA0, 0x51, 0xA1, 0xFF, 0xFF, 0xFF, 0x81, 0x3E, 0x70, 0x44, 0xAC, 0x80,
+	 0x46, 0xF3, 0xB7, 0x0A, 0xDC, 0x02, 0xCC, 0x84, 0x46, 0xFB, 0xF5, 0x02, 0x84, 0xFF, 0xBB, 0x60,
+	 0x18, 0x64, 0x40, 0x42, 0x82, 0xFF, 0x27, 0x44, 0x08, 0xBC, 0x40, 0x47, 0xBB, 0xE1, 0x04, 0x00,
+	 0x3A, 0xE1, 0x31, 0x40, 0x01, 0x26, 0xBB, 0xE1, 0xA3, 0x60, 0x6F, 0x78, 0xFF, 0xFF, 0x43, 0xFF,
+	 0x39, 0xE1, 0xA1, 0xFF, 0xFF, 0xFF, 0x84, 0x3E, 0xFB, 0x01, 0xA0, 0x4C, 0x3D, 0x46, 0x2A, 0xF2,
+	 0x46, 0x4D, 0x10, 0x25, 0x0E, 0x00, 0x09, 0xE1, 0xA1, 0xFF, 0x66, 0x40, 0x0F, 0xF2, 0x01, 0x29,
+	 0x02, 0x00, 0x40, 0xFF, 0x0A, 0xBC, 0xA2, 0xDA, 0x08, 0x25, 0xE9, 0x01, 0xCB, 0xFE, 0x5C, 0x5D,
+	 0xE7, 0x01, 0x44, 0xFF, 0x31, 0xF2, 0x1C, 0x60, 0xBA, 0x65, 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84,
+	 0x44, 0xD3, 0x66, 0x41, 0x60, 0x46, 0x60, 0x43, 0x05, 0xF2, 0x16, 0x18, 0x61, 0x46, 0x31, 0xF0,
+	 0x63, 0x46, 0xD0, 0x80, 0x04, 0xF2, 0x0C, 0x02, 0x61, 0x46, 0x30, 0xF0, 0x63, 0x46, 0xD0, 0x80,
+	 0x03, 0xF2, 0x06, 0x02, 0x61, 0x46, 0x2F, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0xFF, 0xFF, 0x07, 0x03,
+	 0x80, 0xF4, 0xFF, 0xFF, 0x63, 0x46, 0xE8, 0x1B, 0xA9, 0xF3, 0x08, 0xFE, 0x60, 0x43, 0x61, 0x46,
+	 0x07, 0xFC, 0x3F, 0xF2, 0x09, 0x60, 0xB0, 0x65, 0xD4, 0x80, 0x2A, 0xF2, 0xC4, 0x05, 0x08, 0x25,
+	 0xB6, 0x01, 0x00, 0x64, 0x0D, 0x60, 0x2C, 0x61, 0x40, 0x4B, 0xA1, 0xDB, 0x2D, 0x46, 0x3B, 0xF2,
+	 0xA9, 0xF1, 0x87, 0xF4, 0x60, 0x40, 0x20, 0x2B, 0x12, 0x00, 0xD3, 0x80, 0x2C, 0xF0, 0xB3, 0x03,
+	 0x07, 0xF4, 0x64, 0x40, 0x01, 0x26, 0xA9, 0xF5, 0xB6, 0xF4, 0x2D, 0x46, 0x04, 0x64, 0x04, 0xB3,
+	 0x22, 0xFA, 0x04, 0x03, 0xBC, 0x60, 0x72, 0x78, 0xFF, 0xFF, 0x01, 0x00, 0xDE, 0x00, 0x74, 0x62,
+	 0xA2, 0xD0, 0xFF, 0xFF, 0x64, 0x44, 0xE0, 0x7F, 0xA0, 0x5B, 0x64, 0x47, 0xE1, 0x7F, 0x5A, 0xD0,
+	 0xA0, 0x5B, 0x64, 0x44, 0xE2, 0x7F, 0xA0, 0x5B, 0x64, 0x47, 0x7C, 0x5F, 0xE8, 0x84, 0xE8, 0x85,
+	 0x0C, 0x60, 0x3A, 0x64, 0x44, 0xD3, 0x5A, 0xD1, 0x03, 0x1B, 0xBC, 0x60, 0x65, 0x78, 0xFF, 0xFF,
+	 0x60, 0x45, 0x64, 0x44, 0xE3, 0x7F, 0xA0, 0x5B, 0x64, 0x47, 0xE4, 0x7F, 0x5A, 0xD1, 0xA0, 0x5B,
+	 0x64, 0x44, 0xE5, 0x7F, 0xA0, 0x5B, 0x64, 0x47, 0xE6, 0x7F, 0x5A, 0xD1, 0xA0, 0x5B, 0x64, 0x44,
+	 0xE7, 0x7F, 0xA0, 0x5B, 0x65, 0x40, 0x0D, 0x3A, 0x1C, 0x00, 0x64, 0x47, 0xE8, 0x7F, 0x5A, 0xD1,
+	 0xA0, 0x5B, 0x64, 0x44, 0xE9, 0x7F, 0xA0, 0x5B, 0x64, 0x47, 0xEA, 0x7F, 0x5A, 0xD1, 0xA0, 0x5B,
+	 0x64, 0x44, 0xEB, 0x7F, 0xA0, 0x5B, 0x64, 0x47, 0xEC, 0x7F, 0x5A, 0xD1, 0xA0, 0x5B, 0x64, 0x44,
+	 0xED, 0x7F, 0xA0, 0x5B, 0x64, 0x47, 0xEE, 0x7F, 0x5A, 0xD1, 0xA0, 0x5B, 0x64, 0x44, 0xEF, 0x7F,
+	 0xA0, 0x5B, 0x65, 0x44, 0xD8, 0x84, 0x08, 0x25, 0x76, 0x00, 0x60, 0x7F, 0xA0, 0x5B, 0x80, 0x60,
+	 0x00, 0xEB, 0xA0, 0x60, 0x00, 0xEB, 0xD1, 0x60, 0x00, 0xEB, 0x3F, 0xF2, 0x04, 0x65, 0xC4, 0x83,
+	 0x0A, 0xE1, 0xB3, 0xFF, 0x9A, 0xFF, 0xCB, 0x83, 0x00, 0xF4, 0x10, 0x62, 0x6C, 0x61, 0x0E, 0xA3,
+	 0xAB, 0x84, 0xF2, 0xA3, 0xA1, 0xFF, 0x08, 0x00, 0x00, 0xF4, 0x81, 0xF2, 0x02, 0x62, 0xC9, 0x81,
+	 0xAB, 0x84, 0xA1, 0xFF, 0x01, 0x00, 0xA2, 0xDC, 0x7A, 0xD4, 0xFD, 0x1C, 0xA2, 0xDC, 0x08, 0x25,
+	 0x52, 0x00, 0xF2, 0x1D, 0x7C, 0xA8, 0xD9, 0x81, 0xEF, 0x03, 0xFF, 0xB1, 0x09, 0x1E, 0x02, 0x02,
+	 0x00, 0xF4, 0x02, 0x62, 0x5A, 0xD2, 0x89, 0xFF, 0x80, 0x4F, 0x6F, 0x44, 0xA2, 0xDA, 0x88, 0xFF,
+	 0x98, 0xFF, 0x09, 0xE1, 0xA1, 0xFF, 0x3D, 0x46, 0x08, 0x25, 0x3D, 0x00, 0x40, 0xFF, 0x0F, 0xF0,
+	 0x0A, 0x64, 0xB0, 0x84, 0x16, 0x14, 0xF7, 0xB4, 0xA2, 0xDA, 0x0D, 0x60, 0x2C, 0x62, 0xA2, 0xD3,
+	 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x2A, 0x0C, 0x00, 0xF1, 0xF5, 0xF0, 0xF4, 0x0D, 0x60, 0x2C, 0x61,
+	 0x59, 0xD1, 0x37, 0xF8, 0x05, 0x64, 0x59, 0xD1, 0xCC, 0x84, 0xBD, 0xD8, 0xFC, 0x02, 0x2D, 0x46,
+	 0x0D, 0x01, 0xA2, 0xDA, 0x2D, 0x46, 0x3B, 0xF0, 0xFF, 0xFF, 0x64, 0x40, 0x20, 0x2B, 0x18, 0x00,
+	 0xF1, 0xF5, 0xB7, 0xF0, 0x2A, 0x44, 0xA4, 0x84, 0xFF, 0xFF, 0x2F, 0x26, 0x10, 0x00, 0x2D, 0x46,
+	 0x64, 0x44, 0x3A, 0xF0, 0xBC, 0xF0, 0x64, 0x5F, 0x3D, 0xF0, 0x07, 0xF4, 0xF0, 0xF4, 0xFF, 0xFF,
+	 0x08, 0xA3, 0x5B, 0xD8, 0x65, 0x5C, 0x5B, 0xD8, 0x5B, 0xDA, 0x2D, 0x46, 0x01, 0x00, 0x2D, 0x46,
+	 0xBB, 0x60, 0x36, 0x78, 0xFF, 0xFF, 0x98, 0xFF, 0x43, 0xFF, 0x40, 0xFF, 0xB0, 0xFF, 0xB1, 0xFF,
+	 0x2D, 0x46, 0x0D, 0x60, 0x2C, 0x61, 0xA1, 0xD3, 0x2D, 0x46, 0x60, 0x40, 0x01, 0x2A, 0x0A, 0x00,
+	 0xF1, 0xF5, 0xF0, 0xF4, 0x59, 0xD1, 0x37, 0xF8, 0x05, 0x64, 0x59, 0xD1, 0xCC, 0x84, 0xBD, 0xD8,
+	 0xFC, 0x02, 0x2D, 0x46, 0xBB, 0x60, 0x20, 0x78, 0xFF, 0xFF, 0x98, 0xFF, 0x09, 0xE1, 0xA1, 0xFF,
+	 0x3D, 0x46, 0x08, 0x25, 0xE0, 0x01, 0x0F, 0xF2, 0x40, 0xFF, 0x02, 0xBC, 0xA2, 0xDA, 0xBB, 0x60,
+	 0x36, 0x78, 0xFF, 0xFF, 0x00, 0x64, 0x0D, 0x60, 0x2C, 0x62, 0xA2, 0xDB, 0x04, 0x64, 0x22, 0xFA,
+	 0x87, 0xF4, 0xA9, 0xF1, 0xFF, 0xFF, 0xD3, 0x80, 0x3B, 0xF2, 0xE7, 0x03, 0x60, 0x47, 0xC0, 0xB7,
+	 0x02, 0xFE, 0xF0, 0x84, 0xF0, 0x84, 0xF0, 0x84, 0x00, 0xA8, 0x40, 0x4A, 0x16, 0x03, 0xE0, 0x81,
+	 0x61, 0x43, 0x42, 0xFE, 0x00, 0x64, 0xF0, 0x84, 0xFE, 0x1F, 0x40, 0x4A, 0xE1, 0x84, 0xE0, 0x84,
+	 0x2D, 0x46, 0x07, 0xF4, 0xE0, 0x81, 0x37, 0xF0, 0x2A, 0x47, 0x0C, 0x60, 0x7A, 0x63, 0xA0, 0x84,
+	 0x47, 0x9C, 0x10, 0x03, 0x7C, 0x44, 0xA0, 0x63, 0x11, 0x00, 0x20, 0x64, 0x40, 0x4A, 0x63, 0x46,
+	 0x37, 0xF0, 0x66, 0x44, 0x64, 0x40, 0x80, 0x2B, 0x05, 0x00, 0x00, 0x60, 0x70, 0x7C, 0x00, 0x60,
+	 0x90, 0x63, 0x04, 0x00, 0x2D, 0x46, 0xBC, 0x60, 0x65, 0x78, 0xFF, 0xFF, 0x2D, 0x46, 0xEE, 0xFB,
+	 0xEF, 0xF9, 0xF0, 0xFD, 0x07, 0xF2, 0xF1, 0xFB, 0x60, 0x46, 0x37, 0xF0, 0x2A, 0x44, 0x0D, 0x60,
+	 0x2C, 0x62, 0x5A, 0xD9, 0x00, 0x65, 0x45, 0x4B, 0xA0, 0x84, 0xFF, 0xFF, 0x3F, 0x22, 0x05, 0x00,
+	 0x90, 0x84, 0x37, 0xFA, 0x01, 0x64, 0x40, 0x4B, 0x21, 0x00, 0xAD, 0x46, 0x0A, 0xA3, 0x3D, 0xF2,
+	 0xAD, 0x46, 0xA3, 0xD0, 0xAD, 0x46, 0xD0, 0x80, 0x3C, 0xF2, 0xAD, 0x46, 0x02, 0x03, 0x16, 0x07,
+	 0x14, 0x04, 0x5B, 0xD0, 0xAD, 0x46, 0xD0, 0x80, 0x3B, 0xF2, 0x03, 0x03, 0xAD, 0x46, 0x0E, 0x07,
+	 0x0C, 0x04, 0x3A, 0xF0, 0xAD, 0x46, 0x5B, 0xD0, 0x64, 0x5F, 0xD0, 0x80, 0x2B, 0x44, 0x18, 0x07,
+	 0x04, 0x03, 0xD0, 0x84, 0x10, 0xA4, 0xFF, 0xFF, 0x13, 0x07, 0x7F, 0x01, 0x01, 0x64, 0x0D, 0x60,
+	 0x2C, 0x62, 0xA2, 0xDB, 0x2D, 0x46, 0x0D, 0x60, 0x3C, 0x62, 0x80, 0xFF, 0x78, 0x44, 0x03, 0xA4,
+	 0xA2, 0xDB, 0xBD, 0x60, 0x0B, 0x78, 0xFF, 0xFF, 0x85, 0xFF, 0x2D, 0x46, 0x08, 0x25, 0x53, 0x01,
+	 0x2D, 0x46, 0x0D, 0x60, 0x3C, 0x62, 0x80, 0xFF, 0x78, 0x44, 0x03, 0xA4, 0xA2, 0xDB, 0xBD, 0x60,
+	 0x94, 0x78, 0xFF, 0xFF, 0x85, 0xFF, 0x2D, 0x46, 0x08, 0x25, 0x45, 0x01, 0x00, 0x60, 0x0F, 0x64,
+	 0xBB, 0x60, 0xD3, 0x78, 0xFF, 0xFF, 0x07, 0xF4, 0x66, 0x41, 0x03, 0xF2, 0x04, 0xF2, 0x40, 0x42,
+	 0x05, 0xF2, 0x40, 0x43, 0x40, 0x44, 0x61, 0x46, 0x3C, 0xF2, 0x3D, 0xF2, 0x40, 0x40, 0x40, 0x41,
+	 0x0D, 0x60, 0x70, 0x65, 0x00, 0x61, 0xEF, 0xF1, 0xEE, 0xF5, 0x44, 0x4C, 0x2C, 0x5C, 0xE9, 0x80,
+	 0x00, 0x64, 0xF0, 0x84, 0xF0, 0x84, 0xC0, 0x83, 0xBD, 0xD2, 0x24, 0x5C, 0x90, 0x9C, 0x64, 0x47,
+	 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47,
+	 0x90, 0x9C, 0x20, 0x44, 0x40, 0x80, 0xDB, 0x83, 0xBD, 0xD2, 0x20, 0x5C, 0x90, 0x9C, 0x64, 0x47,
+	 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47,
+	 0x90, 0x9C, 0x21, 0x44, 0x40, 0x81, 0xDB, 0x83, 0xBD, 0xD2, 0x21, 0x5C, 0x90, 0x9C, 0x64, 0x47,
+	 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47,
+	 0x90, 0x9C, 0x22, 0x44, 0x40, 0x82, 0xDB, 0x83, 0xBD, 0xD2, 0x22, 0x5C, 0x90, 0x9C, 0x64, 0x47,
+	 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47,
+	 0x90, 0x9C, 0x23, 0x44, 0x40, 0x83, 0xF2, 0xA3, 0xBD, 0xD2, 0x23, 0x5C, 0x90, 0x9C, 0x64, 0x47,
+	 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47,
+	 0x90, 0x9C, 0x24, 0x44, 0xC0, 0x9C, 0x41, 0x84, 0xDD, 0x81, 0x08, 0x2A, 0xA7, 0x01, 0x0D, 0x60,
+	 0x2E, 0x61, 0x05, 0x64, 0xF0, 0xF4, 0xF1, 0xF5, 0xFE, 0xA3, 0x5B, 0xD0, 0xCC, 0x84, 0x59, 0xD9,
+	 0xFC, 0x02, 0xF0, 0xF3, 0xF1, 0xF5, 0x60, 0x42, 0x20, 0x44, 0xA2, 0xDA, 0x21, 0x44, 0x5A, 0xDA,
+	 0x22, 0x44, 0x5A, 0xDA, 0x23, 0x44, 0x5A, 0xDA, 0x24, 0x44, 0x5A, 0xDA, 0x61, 0x46, 0x0D, 0x60,
+	 0x3C, 0x62, 0xA2, 0xD7, 0xFF, 0xFF, 0xFF, 0xFF, 0x66, 0x41, 0xF0, 0xF3, 0xF1, 0xF5, 0xA0, 0xD2,
+	 0x5A, 0xD0, 0x40, 0x40, 0x44, 0x41, 0x5A, 0xD2, 0x5A, 0xD0, 0x40, 0x42, 0x5A, 0xD0, 0x44, 0x43,
+	 0x61, 0x46, 0xBA, 0xF0, 0x3B, 0xF2, 0x44, 0x44, 0x65, 0x5F, 0x40, 0x85, 0xEF, 0xF4, 0xEE, 0xF5,
+	 0x43, 0x4C, 0x0D, 0x60, 0x70, 0x65, 0xBD, 0xD2, 0x25, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F,
+	 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C,
+	 0x20, 0x44, 0x40, 0x80, 0xBD, 0xD2, 0x20, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84,
+	 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C, 0x21, 0x44,
+	 0x40, 0x81, 0xBD, 0xD2, 0x21, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1,
+	 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C, 0x22, 0x44, 0x40, 0x82,
+	 0xBD, 0xD2, 0x22, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44,
+	 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C, 0x23, 0x44, 0x40, 0x83, 0xBD, 0xD2,
+	 0x23, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F,
+	 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C, 0x24, 0x44, 0x40, 0x84, 0xBD, 0xD2, 0x24, 0x5C,
+	 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84,
+	 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C, 0x25, 0x44, 0x40, 0x85, 0x61, 0x46, 0x3A, 0xF0, 0xFF, 0xFF,
+	 0x64, 0x44, 0xE0, 0x7F, 0xA0, 0x5B, 0x64, 0x47, 0xE1, 0x7F, 0x5A, 0xD0, 0xA0, 0x5B, 0x64, 0x44,
+	 0xE2, 0x7F, 0xA0, 0x5B, 0x64, 0x47, 0xEE, 0xF5, 0xBD, 0xD2, 0x25, 0x5C, 0x90, 0x84, 0xE8, 0x80,
+	 0xF8, 0x84, 0x20, 0x5C, 0x40, 0x80, 0x20, 0x44, 0xE4, 0x7F, 0xA0, 0x5B, 0x20, 0x47, 0xE5, 0x7F,
+	 0xA0, 0x5B, 0xBD, 0xD2, 0x20, 0x5C, 0x90, 0x84, 0xE8, 0x80, 0xF8, 0x84, 0x21, 0x5C, 0x40, 0x81,
+	 0x21, 0x44, 0xE6, 0x7F, 0xA0, 0x5B, 0x21, 0x47, 0xE7, 0x7F, 0xA0, 0x5B, 0x21, 0x44, 0xE8, 0x80,
+	 0xF8, 0x84, 0x22, 0x5C, 0x40, 0x82, 0x22, 0x44, 0xE8, 0x7F, 0xA0, 0x5B, 0x22, 0x47, 0xE9, 0x7F,
+	 0xA0, 0x5B, 0x22, 0x44, 0xE8, 0x80, 0xF8, 0x84, 0x23, 0x5C, 0x40, 0x83, 0x23, 0x44, 0xEA, 0x7F,
+	 0xA0, 0x5B, 0x23, 0x47, 0xEB, 0x7F, 0xA0, 0x5B, 0x23, 0x44, 0xE8, 0x80, 0xF8, 0x84, 0x24, 0x5C,
+	 0x40, 0x84, 0x24, 0x44, 0xEC, 0x7F, 0xA0, 0x5B, 0x24, 0x47, 0xED, 0x7F, 0xA0, 0x5B, 0x24, 0x44,
+	 0xE8, 0x80, 0xF8, 0x84, 0x25, 0x5C, 0x40, 0x85, 0x25, 0x44, 0xEE, 0x7F, 0xA0, 0x5B, 0x25, 0x47,
+	 0xEF, 0x7F, 0xA0, 0x5B, 0x2C, 0x43, 0xA3, 0xD2, 0x25, 0x5C, 0x90, 0x81, 0xE9, 0x84, 0xE3, 0x7F,
+	 0xA0, 0x5B, 0x0D, 0x60, 0x3C, 0x62, 0xA2, 0xD7, 0xFF, 0xFF, 0xFF, 0xFF, 0xEB, 0xF3, 0x5A, 0xD3,
+	 0x40, 0x48, 0x5A, 0xD3, 0x40, 0x49, 0x40, 0x4A, 0x00, 0x60, 0x70, 0x7C, 0x44, 0x4D, 0x45, 0xF2,
+	 0x46, 0xF2, 0x40, 0x47, 0x40, 0x46, 0x0D, 0x60, 0x70, 0x65, 0x00, 0x61, 0x2D, 0x5C, 0xE9, 0x80,
+	 0x00, 0x64, 0xF0, 0x84, 0xF0, 0x84, 0xC0, 0x83, 0xBD, 0xD2, 0x2A, 0x5C, 0x90, 0x9C, 0x64, 0x47,
+	 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47,
+	 0x90, 0x9C, 0x26, 0x44, 0x40, 0x86, 0xDB, 0x83, 0xBD, 0xD2, 0x26, 0x5C, 0x90, 0x9C, 0x64, 0x47,
+	 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47,
+	 0x90, 0x9C, 0x27, 0x44, 0x40, 0x87, 0xDB, 0x83, 0xBD, 0xD2, 0x27, 0x5C, 0x90, 0x9C, 0x64, 0x47,
+	 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47,
+	 0x90, 0x9C, 0x28, 0x44, 0x40, 0x88, 0xDB, 0x83, 0xBD, 0xD2, 0x28, 0x5C, 0x90, 0x9C, 0x64, 0x47,
+	 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47,
+	 0x90, 0x9C, 0x29, 0x44, 0x40, 0x89, 0xF2, 0xA3, 0xBD, 0xD2, 0x29, 0x5C, 0x90, 0x9C, 0x64, 0x47,
+	 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47,
+	 0x90, 0x9C, 0x2A, 0x44, 0xC0, 0x9C, 0x41, 0x8A, 0xDD, 0x81, 0x08, 0x2A, 0xA7, 0x01, 0x26, 0x44,
+	 0x40, 0xFA, 0x27, 0x44, 0x41, 0xFA, 0x28, 0x44, 0x42, 0xFA, 0x29, 0x44, 0x43, 0xFA, 0x2A, 0x44,
+	 0x44, 0xFA, 0x0D, 0x60, 0x3E, 0x62, 0xA2, 0xD7, 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x60, 0x80, 0x7C,
+	 0x44, 0x4D, 0x2D, 0x42, 0xA2, 0xD2, 0x5A, 0xD0, 0x40, 0x46, 0x44, 0x47, 0x5A, 0xD2, 0x5A, 0xD0,
+	 0x40, 0x48, 0x5A, 0xD0, 0x44, 0x49, 0x47, 0xF2, 0x44, 0x4A, 0x40, 0x8B, 0x60, 0x5C, 0x64, 0x47,
+	 0xE0, 0x7F, 0xA0, 0x5A, 0xFF, 0xB4, 0x20, 0xBC, 0x7F, 0xB4, 0xE1, 0x7F, 0xA0, 0x5A, 0x64, 0x44,
+	 0xE2, 0x7F, 0xA0, 0x5A, 0x00, 0x60, 0x70, 0x63, 0x0D, 0x60, 0x70, 0x65, 0xBD, 0xD2, 0x2B, 0x5C,
+	 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84,
+	 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C, 0x26, 0x44, 0x40, 0x86, 0xBD, 0xD2, 0x26, 0x5C, 0x90, 0x9C,
+	 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1,
+	 0x64, 0x47, 0x90, 0x9C, 0x27, 0x44, 0x40, 0x87, 0xBD, 0xD2, 0x27, 0x5C, 0x90, 0x9C, 0x64, 0x47,
+	 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47,
+	 0x90, 0x9C, 0x28, 0x44, 0x40, 0x88, 0xBD, 0xD2, 0x28, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F,
+	 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C,
+	 0x29, 0x44, 0x40, 0x89, 0xBD, 0xD2, 0x29, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84,
+	 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C, 0x2A, 0x44,
+	 0x40, 0x8A, 0xBD, 0xD2, 0x2A, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1,
+	 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C, 0x2B, 0x44, 0x40, 0x8B,
+	 0xBD, 0xD2, 0x2B, 0x5C, 0x90, 0x84, 0xE8, 0x80, 0xF8, 0x84, 0x26, 0x5C, 0x40, 0x86, 0x26, 0x44,
+	 0xE4, 0x7F, 0xA0, 0x5A, 0x26, 0x47, 0xE5, 0x7F, 0xA0, 0x5A, 0xBD, 0xD2, 0x26, 0x5C, 0x90, 0x84,
+	 0xE8, 0x80, 0xF8, 0x84, 0x27, 0x5C, 0x40, 0x87, 0x27, 0x44, 0xE6, 0x7F, 0xA0, 0x5A, 0x27, 0x47,
+	 0xE7, 0x7F, 0xA0, 0x5A, 0x27, 0x44, 0xE8, 0x80, 0xF8, 0x84, 0x28, 0x5C, 0x40, 0x88, 0x28, 0x44,
+	 0xE8, 0x7F, 0xA0, 0x5A, 0x28, 0x47, 0xE9, 0x7F, 0xA0, 0x5A, 0x28, 0x44, 0xE8, 0x80, 0xF8, 0x84,
+	 0x29, 0x5C, 0x40, 0x89, 0x29, 0x44, 0xEA, 0x7F, 0xA0, 0x5A, 0x29, 0x47, 0xEB, 0x7F, 0xA0, 0x5A,
+	 0x29, 0x44, 0xE8, 0x80, 0xF8, 0x84, 0x2A, 0x5C, 0x40, 0x8A, 0x2A, 0x44, 0xEC, 0x7F, 0xA0, 0x5A,
+	 0x2A, 0x47, 0xED, 0x7F, 0xA0, 0x5A, 0x2A, 0x44, 0xE8, 0x80, 0xF8, 0x84, 0x2B, 0x5C, 0x40, 0x8B,
+	 0x2B, 0x44, 0xEE, 0x7F, 0xA0, 0x5A, 0x2B, 0x47, 0xEF, 0x7F, 0xA0, 0x5A, 0x38, 0xF0, 0x2B, 0x44,
+	 0x90, 0x84, 0xE8, 0x84, 0xE3, 0x7F, 0xA0, 0x5A, 0x0D, 0x60, 0x3E, 0x62, 0xA2, 0xD7, 0xFF, 0xFF,
+	 0xFF, 0xFF, 0xE4, 0x60, 0xC8, 0x78, 0xFF, 0xFF, 0x0F, 0x60, 0xD0, 0x62, 0xA2, 0xD1, 0x80, 0x60,
+	 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x32, 0x00, 0xDC, 0xF3, 0x31, 0x41, 0x01, 0xB1,
+	 0x03, 0xA8, 0x2D, 0x03, 0x17, 0x02, 0x20, 0x40, 0x04, 0x2B, 0x0C, 0x00, 0xBB, 0xFE, 0xCA, 0xFE,
+	 0x24, 0x60, 0xAA, 0x62, 0x1A, 0x60, 0x66, 0x64, 0xA2, 0xDB, 0x02, 0x64, 0x4A, 0xDB, 0xFF, 0xFF,
+	 0x04, 0xFF, 0x08, 0x00, 0x0F, 0x60, 0xD2, 0x62, 0xA2, 0xD1, 0x00, 0x60, 0x04, 0x64, 0xB0, 0x84,
+	 0xA2, 0xDB, 0xCF, 0xFE, 0x0F, 0x60, 0xF6, 0x62, 0xA2, 0xD1, 0x00, 0x60, 0x80, 0x64, 0xB0, 0x84,
+	 0xA2, 0xDB, 0xCF, 0xFE, 0x0C, 0x00, 0xA9, 0xFE, 0xD8, 0x05, 0xAB, 0xFE, 0x0C, 0x05, 0xA8, 0xFE,
+	 0xC8, 0x05, 0xAA, 0xFE, 0xC9, 0x05, 0x78, 0x43, 0x01, 0x61, 0x24, 0x60, 0xDD, 0x78, 0xA1, 0xFF,
+	 0xFF, 0xFF, 0xFF, 0xFF, 0x85, 0x3E, 0x24, 0x60, 0x5E, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0x00, 0xA8,
+	 0x60, 0x46, 0x03, 0x02, 0xBF, 0x60, 0xE7, 0x78, 0xFF, 0xFF, 0x26, 0x45, 0xD4, 0x80, 0x0F, 0xF0,
+	 0xF9, 0x03, 0x64, 0x44, 0x70, 0xB0, 0x70, 0x2A, 0x14, 0x00, 0x27, 0x60, 0xB2, 0x64, 0xA0, 0xD3,
+	 0xFF, 0xFF, 0xDC, 0x84, 0xFF, 0xFF, 0x08, 0x28, 0xA2, 0xDB, 0xA2, 0xFF, 0xAF, 0xF3, 0xFF, 0xFF,
+	 0xCC, 0x84, 0xFE, 0xA0, 0xAF, 0xFB, 0x01, 0x07, 0xD4, 0xFE, 0xA3, 0xFF, 0xC5, 0x60, 0x5B, 0x78,
+	 0xFF, 0xFF, 0x64, 0x40, 0x02, 0x26, 0x09, 0x00, 0x66, 0x45, 0x09, 0xF4, 0x0F, 0xF2, 0x02, 0x18,
+	 0x65, 0x46, 0xE3, 0x1B, 0x00, 0x64, 0x40, 0x46, 0xCA, 0x01, 0xA2, 0xFF, 0xAF, 0xF3, 0x46, 0x46,
+	 0xCC, 0x84, 0xFE, 0xA0, 0xAF, 0xFB, 0x01, 0x07, 0xD4, 0xFE, 0xA3, 0xFF, 0x0F, 0xF0, 0xA3, 0xFC,
+	 0x64, 0x44, 0x80, 0x26, 0x22, 0x00, 0xB8, 0xF1, 0x27, 0x60, 0x92, 0x64, 0xA0, 0xD3, 0xFF, 0xFF,
+	 0xDC, 0x84, 0xDC, 0x80, 0xD0, 0x80, 0x04, 0x03, 0xA2, 0xDB, 0x08, 0x24, 0xC6, 0xFE, 0x04, 0x00,
+	 0x8A, 0xFF, 0x20, 0x60, 0x00, 0x75, 0x88, 0xFF, 0x32, 0x44, 0x01, 0x2A, 0x03, 0x00, 0x07, 0x60,
+	 0x01, 0x64, 0x04, 0x00, 0x02, 0x2A, 0x06, 0x00, 0x00, 0x60, 0x01, 0x64, 0x23, 0xFA, 0xC5, 0x60,
+	 0x67, 0x78, 0xFF, 0xFF, 0xC5, 0x60, 0x5B, 0x78, 0xFF, 0xFF, 0x08, 0x26, 0x3F, 0x00, 0x2A, 0xF2,
+	 0x60, 0x63, 0x60, 0x40, 0x02, 0x2B, 0x66, 0x63, 0xBE, 0xD2, 0x83, 0xF1, 0xA3, 0xD2, 0xD0, 0x80,
+	 0x82, 0xF1, 0x18, 0x02, 0xBF, 0xD2, 0xD0, 0x80, 0x81, 0xF1, 0x14, 0x02, 0xD0, 0x80, 0xFF, 0xFF,
+	 0x11, 0x02, 0xB8, 0xF1, 0x27, 0x60, 0x9E, 0x64, 0xA0, 0xD3, 0xFF, 0xFF, 0xDC, 0x84, 0xDC, 0x80,
+	 0xD0, 0x80, 0x04, 0x03, 0xA2, 0xDB, 0x08, 0x24, 0xC6, 0xFE, 0x04, 0x00, 0x8A, 0xFF, 0x20, 0x60,
+	 0x00, 0x75, 0x88, 0xFF, 0x32, 0x44, 0x01, 0x2A, 0x03, 0x00, 0x07, 0x60, 0x02, 0x64, 0x04, 0x00,
+	 0x02, 0x2A, 0x06, 0x00, 0x00, 0x60, 0x02, 0x64, 0x23, 0xFA, 0xC5, 0x60, 0x67, 0x78, 0xFF, 0xFF,
+	 0x2A, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0xB0, 0x3A, 0x06, 0x00, 0x00, 0x60, 0x02, 0x64, 0x23, 0xFA,
+	 0xC1, 0x60, 0x11, 0x78, 0xFF, 0xFF, 0xC5, 0x60, 0x5B, 0x78, 0xFF, 0xFF, 0x32, 0x44, 0x01, 0x2A,
+	 0x4A, 0x00, 0x28, 0x60, 0xE2, 0x63, 0xBF, 0xD3, 0x00, 0x65, 0xB4, 0x81, 0xDB, 0x83, 0x3D, 0x03,
+	 0xBF, 0xD3, 0xA3, 0xD3, 0x40, 0x48, 0xBE, 0xD3, 0x40, 0x4A, 0x2E, 0xF0, 0x40, 0x4C, 0xD0, 0x80,
+	 0x2D, 0xF0, 0x08, 0x02, 0x2A, 0x44, 0xD0, 0x80, 0x2C, 0xF0, 0x04, 0x02, 0x28, 0x44, 0xD0, 0x80,
+	 0xFF, 0xFF, 0x2B, 0x03, 0x31, 0xF0, 0x2C, 0x44, 0xD0, 0x80, 0x30, 0xF0, 0x08, 0x02, 0x2A, 0x44,
+	 0xD0, 0x80, 0x2F, 0xF0, 0x04, 0x02, 0x28, 0x44, 0xD0, 0x80, 0xFF, 0xFF, 0x1E, 0x03, 0x34, 0xF0,
+	 0x2C, 0x44, 0xD0, 0x80, 0x33, 0xF0, 0x08, 0x02, 0x2A, 0x44, 0xD0, 0x80, 0x32, 0xF0, 0x04, 0x02,
+	 0x28, 0x44, 0xD0, 0x80, 0xFF, 0xFF, 0x11, 0x03, 0x38, 0xF0, 0x2C, 0x44, 0xD0, 0x80, 0x37, 0xF0,
+	 0x08, 0x02, 0x2A, 0x44, 0xD0, 0x80, 0x36, 0xF0, 0x04, 0x02, 0x28, 0x44, 0xD0, 0x80, 0xFF, 0xFF,
+	 0x04, 0x03, 0xFA, 0xA1, 0x06, 0xA3, 0xB7, 0x03, 0xC3, 0x01, 0x07, 0x60, 0x00, 0x64, 0x23, 0xFA,
+	 0xC5, 0x60, 0x67, 0x78, 0xFF, 0xFF, 0x2A, 0xF2, 0x0F, 0xF0, 0x60, 0x45, 0xA4, 0x36, 0x08, 0x00,
+	 0x0C, 0xB4, 0x04, 0x36, 0x02, 0x00, 0x0C, 0x3A, 0x06, 0x00, 0xC5, 0x60, 0x5B, 0x78, 0xFF, 0xFF,
+	 0xC2, 0x60, 0xDD, 0x78, 0xFF, 0xFF, 0x0F, 0xF0, 0x65, 0x40, 0x40, 0x2B, 0x22, 0x00, 0x32, 0x40,
+	 0x08, 0x26, 0x1F, 0x00, 0x07, 0xF4, 0x36, 0xF2, 0xFF, 0xFF, 0x37, 0xB4, 0x26, 0x46, 0x19, 0x02,
+	 0x2C, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x26, 0x11, 0x00, 0xB8, 0xF1, 0x27, 0x60, 0x98, 0x64,
+	 0xA0, 0xD3, 0xFF, 0xFF, 0xDC, 0x84, 0xDC, 0x80, 0xD0, 0x80, 0x04, 0x03, 0xA2, 0xDB, 0x08, 0x24,
+	 0xC6, 0xFE, 0x04, 0x00, 0x8A, 0xFF, 0x20, 0x60, 0x00, 0x75, 0x88, 0xFF, 0xC5, 0x60, 0x5B, 0x78,
+	 0xFF, 0xFF, 0x2A, 0xF2, 0x64, 0x40, 0x60, 0x26, 0x03, 0x00, 0xC2, 0x60, 0xAF, 0x78, 0xFF, 0xFF,
+	 0x60, 0x41, 0xA9, 0xF3, 0x07, 0xFA, 0x61, 0x44, 0x80, 0x3A, 0x06, 0x00, 0xE5, 0x60, 0x58, 0x4F,
+	 0xE7, 0x78, 0xFF, 0xFF, 0x2A, 0xF2, 0x10, 0x00, 0x60, 0x40, 0x40, 0x3A, 0x0D, 0x00, 0xDC, 0xF3,
+	 0xFF, 0xFF, 0x07, 0xB4, 0x03, 0x3A, 0xE2, 0x01, 0xC6, 0x60, 0x58, 0x4D, 0x4F, 0x78, 0xFF, 0xFF,
+	 0xDD, 0x02, 0xA9, 0xF3, 0x07, 0xFA, 0xD1, 0x00, 0x5E, 0x63, 0x60, 0x40, 0x02, 0x2B, 0x64, 0x63,
+	 0x50, 0xFE, 0xBD, 0xD2, 0x81, 0xF1, 0xBD, 0xD2, 0xD0, 0x80, 0x82, 0xF1, 0xBD, 0xD2, 0xD0, 0x80,
+	 0x83, 0xF1, 0x2A, 0xF2, 0xD0, 0x80, 0x60, 0x40, 0x08, 0x3A, 0x07, 0x00, 0x01, 0x0C, 0xC6, 0x01,
+	 0xDE, 0x60, 0x58, 0x4F, 0xFE, 0x78, 0xFF, 0xFF, 0xB8, 0x00, 0x26, 0x0C, 0xC6, 0x60, 0x58, 0x4D,
+	 0x4F, 0x78, 0xFF, 0xFF, 0xBB, 0x02, 0x1F, 0x60, 0x52, 0x61, 0x02, 0x64, 0xA1, 0xDB, 0x1F, 0x60,
+	 0x5A, 0x61, 0x00, 0x64, 0xA1, 0xDB, 0x22, 0x60, 0x58, 0x4E, 0x3E, 0x78, 0xFF, 0xFF, 0x1F, 0x60,
+	 0x04, 0x64, 0xA0, 0xD3, 0xFF, 0xFF, 0x60, 0x40, 0x80, 0x27, 0x08, 0x00, 0x0F, 0x60, 0xEA, 0x62,
+	 0xA2, 0xD1, 0x00, 0x60, 0x04, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x1F, 0x60, 0x52, 0x62,
+	 0x00, 0x64, 0xA2, 0xDB, 0x9B, 0x01, 0x91, 0x00, 0xC6, 0x60, 0x58, 0x4D, 0x4F, 0x78, 0xFF, 0xFF,
+	 0xFA, 0x02, 0x0F, 0x60, 0xCE, 0x61, 0xA1, 0xD3, 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x36, 0x07, 0x00,
+	 0x01, 0x64, 0xA1, 0xDB, 0x01, 0x65, 0xE9, 0x60, 0x58, 0x4E, 0x7B, 0x78, 0xFF, 0xFF, 0x26, 0x46,
+	 0x31, 0xF2, 0x1C, 0x60, 0xBA, 0x65, 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD3, 0x66, 0x41,
+	 0x60, 0x46, 0x60, 0x43, 0x05, 0xF2, 0x16, 0x18, 0x61, 0x46, 0x31, 0xF0, 0x63, 0x46, 0xD0, 0x80,
+	 0x04, 0xF2, 0x0C, 0x02, 0x61, 0x46, 0x30, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x03, 0xF2, 0x06, 0x02,
+	 0x61, 0x46, 0x2F, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0xFF, 0xFF, 0x07, 0x03, 0x80, 0xF4, 0xFF, 0xFF,
+	 0x63, 0x46, 0xE8, 0x1B, 0xA9, 0xF3, 0x08, 0xFE, 0x60, 0x43, 0x61, 0x46, 0xA9, 0xF1, 0x43, 0x43,
+	 0xD3, 0x80, 0xFF, 0xFF, 0x04, 0x02, 0xC5, 0x60, 0x58, 0x4F, 0xA5, 0x78, 0xFF, 0xFF, 0x32, 0x40,
+	 0x08, 0x2A, 0x05, 0x00, 0x63, 0x46, 0x80, 0x60, 0x02, 0x64, 0x06, 0xFA, 0x26, 0x46, 0xD8, 0xF3,
+	 0x63, 0x45, 0x66, 0x41, 0x65, 0x46, 0x8C, 0xFA, 0x60, 0x40, 0x01, 0x36, 0x06, 0x00, 0x02, 0x36,
+	 0x04, 0x00, 0x04, 0x36, 0x02, 0x00, 0x05, 0x3A, 0x02, 0x00, 0x00, 0x64, 0x01, 0x00, 0x01, 0x64,
+	 0x6F, 0xFA, 0x79, 0xF3, 0x7A, 0xF1, 0xFF, 0xFF, 0xA0, 0x84, 0x65, 0x43, 0x02, 0x02, 0x79, 0xF3,
+	 0xFF, 0xFF, 0x60, 0x41, 0x0F, 0x60, 0xAE, 0x65, 0xD8, 0xF3, 0xFF, 0xFF, 0xE0, 0x84, 0x44, 0xD3,
+	 0x61, 0x45, 0xA4, 0x80, 0xFF, 0xFF, 0x04, 0x02, 0xE8, 0x84, 0xA4, 0x80, 0xFF, 0xFF, 0xFC, 0x03,
+	 0xA4, 0x84, 0x7B, 0xFB, 0x6F, 0xF0, 0x60, 0x47, 0x90, 0x84, 0x6F, 0xFA, 0x60, 0x47, 0x60, 0x45,
+	 0x80, 0x64, 0xE8, 0x84, 0xA4, 0x80, 0xFF, 0xFF, 0xFC, 0x03, 0xA4, 0x84, 0x70, 0xF0, 0x70, 0xFA,
+	 0x00, 0x61, 0xE8, 0x84, 0xFF, 0xFF, 0x02, 0x05, 0xDD, 0x81, 0xFB, 0x01, 0xE1, 0x81, 0x0F, 0x60,
+	 0xA2, 0x65, 0x45, 0xD3, 0x0E, 0xFA, 0x66, 0x43, 0x0C, 0xF4, 0xB8, 0xF1, 0x27, 0x60, 0x8C, 0x64,
+	 0xA0, 0xD3, 0xFF, 0xFF, 0xDC, 0x84, 0xDC, 0x80, 0xD0, 0x80, 0x04, 0x03, 0xA2, 0xDB, 0x08, 0x24,
+	 0xC6, 0xFE, 0x04, 0x00, 0x8A, 0xFF, 0x20, 0x60, 0x00, 0x75, 0x88, 0xFF, 0x27, 0xF2, 0xFF, 0xFF,
+	 0x60, 0x40, 0x01, 0x3B, 0x12, 0x00, 0xB8, 0xF1, 0x27, 0x60, 0x9A, 0x64, 0xA0, 0xD3, 0xFF, 0xFF,
+	 0xDC, 0x84, 0xDC, 0x80, 0xD0, 0x80, 0x04, 0x03, 0xA2, 0xDB, 0x08, 0x24, 0xC6, 0xFE, 0x04, 0x00,
+	 0x8A, 0xFF, 0x20, 0x60, 0x00, 0x75, 0x88, 0xFF, 0x13, 0x00, 0x02, 0x3B, 0x11, 0x00, 0xB8, 0xF1,
+	 0x27, 0x60, 0x9C, 0x64, 0xA0, 0xD3, 0xFF, 0xFF, 0xDC, 0x84, 0xDC, 0x80, 0xD0, 0x80, 0x04, 0x03,
+	 0xA2, 0xDB, 0x08, 0x24, 0xC6, 0xFE, 0x04, 0x00, 0x8A, 0xFF, 0x20, 0x60, 0x00, 0x75, 0x88, 0xFF,
+	 0x1B, 0xF2, 0xFF, 0xFF, 0xE4, 0xA4, 0x3E, 0xFA, 0x2A, 0xF2, 0x28, 0x41, 0x40, 0xA8, 0x01, 0xB1,
+	 0x02, 0x02, 0x62, 0x02, 0x92, 0x00, 0x60, 0x40, 0x08, 0x2A, 0x2B, 0x00, 0xB8, 0xF1, 0x27, 0x60,
+	 0x8A, 0x64, 0xA0, 0xD3, 0xFF, 0xFF, 0xDC, 0x84, 0xDC, 0x80, 0xD0, 0x80, 0x04, 0x03, 0xA2, 0xDB,
+	 0x08, 0x24, 0xC6, 0xFE, 0x04, 0x00, 0x8A, 0xFF, 0x20, 0x60, 0x00, 0x75, 0x88, 0xFF, 0x1B, 0xF2,
+	 0xFF, 0xFF, 0x60, 0x45, 0xB8, 0xF1, 0x27, 0x60, 0x90, 0x64, 0xA0, 0xD3, 0xFF, 0xFF, 0xD8, 0x80,
+	 0xC4, 0x84, 0x0B, 0x03, 0x07, 0x05, 0xDC, 0x80, 0xD0, 0x80, 0x04, 0x03, 0xA2, 0xDB, 0x09, 0x04,
+	 0xC6, 0xFE, 0x07, 0x00, 0x00, 0x64, 0xB8, 0x84, 0xA2, 0xDB, 0x8A, 0xFF, 0x20, 0x60, 0x00, 0x75,
+	 0x88, 0xFF, 0x0F, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x40, 0x26, 0x28, 0x00, 0x32, 0x44, 0x02, 0x26,
+	 0x25, 0x00, 0x10, 0x2B, 0x29, 0x00, 0x28, 0x60, 0xE2, 0x63, 0xBF, 0xD3, 0x2C, 0xF0, 0x00, 0xA8,
+	 0x60, 0x41, 0x0D, 0x03, 0x50, 0xFE, 0xBD, 0xD3, 0x2D, 0xF0, 0xD0, 0x80, 0xBD, 0xD3, 0x2E, 0xF0,
+	 0xD0, 0x80, 0xBD, 0xD3, 0x2C, 0xF0, 0xD0, 0x80, 0xFA, 0xA1, 0x10, 0x0C, 0xF3, 0x02, 0x50, 0xFE,
+	 0x60, 0x60, 0x01, 0x64, 0xD0, 0x80, 0x2D, 0xF0, 0x1D, 0x64, 0xD0, 0x80, 0x2E, 0xF0, 0x01, 0x64,
+	 0xD0, 0x80, 0xFF, 0xFF, 0x03, 0x0C, 0xC5, 0x60, 0x5B, 0x78, 0xFF, 0xFF, 0x32, 0x40, 0x40, 0x2A,
+	 0x03, 0x00, 0x19, 0x60, 0x22, 0x78, 0xFF, 0xFF, 0xC5, 0x60, 0x55, 0x78, 0xFF, 0xFF, 0x32, 0x40,
+	 0x40, 0x26, 0xF7, 0x01, 0x2A, 0xF0, 0xFF, 0xFF, 0x64, 0x40, 0x08, 0x2A, 0x2A, 0x00, 0xDC, 0xF3,
+	 0xFF, 0xFF, 0x07, 0xB4, 0x03, 0xA8, 0xFF, 0xFF, 0x03, 0x03, 0x32, 0x40, 0x02, 0x2A, 0x1D, 0x00,
+	 0x03, 0x67, 0xA0, 0x84, 0x00, 0x37, 0x64, 0x63, 0x60, 0x40, 0x02, 0x37, 0x5E, 0x63, 0x60, 0x40,
+	 0x01, 0x37, 0x58, 0x63, 0x60, 0x40, 0x03, 0x37, 0x0D, 0x00, 0xBD, 0xD2, 0x81, 0xF1, 0xBD, 0xD2,
+	 0xD0, 0x80, 0x82, 0xF1, 0x07, 0x02, 0xD0, 0x80, 0xBD, 0xD2, 0x83, 0xF1, 0x03, 0x02, 0xD0, 0x80,
+	 0xFF, 0xFF, 0x03, 0x03, 0xC5, 0x60, 0x5B, 0x78, 0xFF, 0xFF, 0xDE, 0x60, 0x58, 0x4F, 0xFE, 0x78,
+	 0xFF, 0xFF, 0x2A, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x08, 0x26, 0x06, 0x00, 0x20, 0x40, 0x10, 0x2B,
+	 0x03, 0x00, 0xC5, 0x60, 0x55, 0x78, 0xFF, 0xFF, 0x87, 0xF4, 0xA9, 0xF1, 0x27, 0x1B, 0x31, 0xF2,
+	 0x1C, 0x60, 0xBA, 0x65, 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD3, 0x66, 0x41, 0x60, 0x46,
+	 0x60, 0x43, 0x05, 0xF2, 0x16, 0x18, 0x61, 0x46, 0x31, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x04, 0xF2,
+	 0x0C, 0x02, 0x61, 0x46, 0x30, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x03, 0xF2, 0x06, 0x02, 0x61, 0x46,
+	 0x2F, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0xFF, 0xFF, 0x07, 0x03, 0x80, 0xF4, 0xFF, 0xFF, 0x63, 0x46,
+	 0xE8, 0x1B, 0xA9, 0xF3, 0x08, 0xFE, 0x60, 0x43, 0x61, 0x46, 0x03, 0x00, 0xD3, 0x80, 0xFF, 0xFF,
+	 0xD6, 0x03, 0x43, 0x43, 0xDC, 0xF3, 0x32, 0x40, 0x02, 0x26, 0x04, 0x00, 0x07, 0xB4, 0x03, 0xA8,
+	 0x2A, 0xF2, 0x5F, 0x02, 0xA9, 0xF1, 0x23, 0x43, 0xD3, 0x80, 0xFF, 0xFF, 0x5A, 0x02, 0xC5, 0x60,
+	 0x58, 0x4F, 0xA5, 0x78, 0xFF, 0xFF, 0x32, 0x40, 0x02, 0x2A, 0x05, 0x00, 0x63, 0x46, 0x02, 0x64,
+	 0x06, 0xFA, 0x26, 0x46, 0x4E, 0x00, 0x32, 0x40, 0x08, 0x2A, 0x05, 0x00, 0x63, 0x46, 0x80, 0x60,
+	 0x02, 0x64, 0x06, 0xFA, 0x26, 0x46, 0xD8, 0xF3, 0x63, 0x45, 0x66, 0x41, 0x65, 0x46, 0x8C, 0xFA,
+	 0x60, 0x40, 0x01, 0x36, 0x06, 0x00, 0x02, 0x36, 0x04, 0x00, 0x04, 0x36, 0x02, 0x00, 0x05, 0x3A,
+	 0x02, 0x00, 0x00, 0x64, 0x01, 0x00, 0x01, 0x64, 0x6F, 0xFA, 0x79, 0xF3, 0x7A, 0xF1, 0xFF, 0xFF,
+	 0xA0, 0x84, 0x65, 0x43, 0x02, 0x02, 0x79, 0xF3, 0xFF, 0xFF, 0x60, 0x41, 0x0F, 0x60, 0xAE, 0x65,
+	 0xD8, 0xF3, 0xFF, 0xFF, 0xE0, 0x84, 0x44, 0xD3, 0x61, 0x45, 0xA4, 0x80, 0xFF, 0xFF, 0x04, 0x02,
+	 0xE8, 0x84, 0xA4, 0x80, 0xFF, 0xFF, 0xFC, 0x03, 0xA4, 0x84, 0x7B, 0xFB, 0x6F, 0xF0, 0x60, 0x47,
+	 0x90, 0x84, 0x6F, 0xFA, 0x60, 0x47, 0x60, 0x45, 0x80, 0x64, 0xE8, 0x84, 0xA4, 0x80, 0xFF, 0xFF,
+	 0xFC, 0x03, 0xA4, 0x84, 0x70, 0xF0, 0x70, 0xFA, 0x00, 0x61, 0xE8, 0x84, 0xFF, 0xFF, 0x02, 0x05,
+	 0xDD, 0x81, 0xFB, 0x01, 0xE1, 0x81, 0x0F, 0x60, 0xA2, 0x65, 0x45, 0xD3, 0x0E, 0xFA, 0x66, 0x43,
+	 0x0C, 0xF4, 0x07, 0xFC, 0x43, 0x43, 0x02, 0xFE, 0x1D, 0xF0, 0x1C, 0x60, 0x9A, 0x62, 0xC0, 0x64,
+	 0xC0, 0x84, 0xA2, 0xD1, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xC0, 0x84,
+	 0xA2, 0xDB, 0x2A, 0xF2, 0x63, 0x45, 0x0C, 0xB4, 0x08, 0x3A, 0x0A, 0x00, 0xDC, 0xF3, 0x23, 0x46,
+	 0x07, 0xB4, 0xFD, 0xA0, 0x06, 0xF2, 0x26, 0x46, 0x03, 0x03, 0x60, 0x40, 0x02, 0x2A, 0x0D, 0x00,
+	 0x2A, 0xF2, 0x35, 0xF0, 0x60, 0x40, 0xA4, 0x36, 0x0B, 0x00, 0x08, 0x2B, 0x0C, 0x00, 0x23, 0x46,
+	 0x22, 0xF2, 0x26, 0x46, 0xD0, 0x80, 0xFF, 0xFF, 0x06, 0x02, 0xC5, 0x60, 0x5B, 0x78, 0xFF, 0xFF,
+	 0xC5, 0x60, 0x55, 0x78, 0xFF, 0xFF, 0x23, 0x46, 0x1E, 0xF2, 0x26, 0x46, 0x44, 0x4C, 0x0F, 0x26,
+	 0x1D, 0x00, 0x00, 0xBC, 0x40, 0x45, 0x0B, 0x03, 0x00, 0x64, 0x23, 0x46, 0x1E, 0xFA, 0x26, 0x46,
+	 0xA2, 0xFF, 0xAF, 0x60, 0x58, 0x4E, 0x95, 0x78, 0xFF, 0xFF, 0xA3, 0xFF, 0x26, 0x46, 0x2A, 0xF0,
+	 0x2C, 0x44, 0x64, 0x40, 0x04, 0x27, 0x0A, 0x00, 0x23, 0x46, 0x22, 0xFA, 0x26, 0x46, 0x1B, 0xF2,
+	 0xFF, 0xFF, 0xE4, 0xA4, 0x3E, 0xFA, 0xC4, 0x60, 0xAD, 0x78, 0xFF, 0xFF, 0x3F, 0xF2, 0x02, 0xFA,
+	 0xA2, 0xFF, 0x16, 0xF0, 0xFF, 0xFF, 0x64, 0x44, 0x01, 0x26, 0xDC, 0x9C, 0xB3, 0xF3, 0x2A, 0xF2,
+	 0xDC, 0x83, 0xB3, 0xFD, 0x06, 0xF4, 0x01, 0xF8, 0x26, 0x46, 0x60, 0x40, 0x40, 0x2B, 0x18, 0x00,
+	 0x64, 0x44, 0x00, 0x65, 0xFF, 0xB4, 0xFC, 0xA4, 0x06, 0xF0, 0x03, 0x03, 0x64, 0x46, 0x0C, 0x0D,
+	 0x02, 0x65, 0x26, 0x46, 0x00, 0xF2, 0xFF, 0xFF, 0xD0, 0x80, 0xFF, 0xFF, 0x02, 0x03, 0x60, 0x46,
+	 0xF9, 0x01, 0x01, 0xF2, 0xFF, 0xFF, 0xD4, 0x84, 0x01, 0xFA, 0x66, 0x44, 0x26, 0x46, 0x06, 0xFA,
+	 0x06, 0xF4, 0x00, 0xF2, 0x80, 0xFC, 0x40, 0x45, 0xAF, 0x60, 0x58, 0x4E, 0x95, 0x78, 0xFF, 0xFF,
+	 0xA3, 0xFF, 0x26, 0x46, 0x2C, 0x44, 0x0F, 0x26, 0x14, 0x00, 0x23, 0x46, 0x22, 0xFA, 0x26, 0x44,
+	 0x1E, 0xFA, 0x26, 0x46, 0x1B, 0xF2, 0xFF, 0xFF, 0xE4, 0xA4, 0x3E, 0xFA, 0x24, 0x60, 0x74, 0x62,
+	 0x00, 0x64, 0xA2, 0xDB, 0x26, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF,
+	 0x6F, 0x00, 0xA3, 0x46, 0x22, 0xF2, 0x60, 0x45, 0xDC, 0x84, 0xD4, 0x80, 0x22, 0xFA, 0xA3, 0x46,
+	 0x6C, 0x02, 0x2A, 0xF0, 0xA3, 0x46, 0x1E, 0xF2, 0xA3, 0x46, 0x00, 0xBC, 0x00, 0xF2, 0x01, 0x02,
+	 0x64, 0x00, 0x44, 0x4C, 0x3F, 0xF0, 0x60, 0x43, 0x23, 0x46, 0x1E, 0xF4, 0x09, 0x60, 0x00, 0x65,
+	 0x3F, 0xF2, 0x26, 0x46, 0xC0, 0x84, 0xD4, 0x80, 0x60, 0x45, 0x57, 0x07, 0x80, 0xFC, 0x1B, 0xF2,
+	 0x06, 0xF2, 0x60, 0x41, 0x23, 0x46, 0x1E, 0xF4, 0x1B, 0xF0, 0x06, 0xF0, 0xC1, 0x81, 0x06, 0xFA,
+	 0x05, 0xFA, 0x9B, 0xFA, 0x65, 0x44, 0x3F, 0xFA, 0x64, 0x46, 0x00, 0xFC, 0x63, 0x46, 0x01, 0xF2,
+	 0x10, 0x61, 0xF2, 0xA4, 0x01, 0xFA, 0xC8, 0x83, 0x02, 0x64, 0x59, 0xD0, 0x58, 0xD8, 0xFD, 0x1F,
+	 0x06, 0x45, 0x24, 0x60, 0x74, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x25, 0x44, 0x5A, 0xDB, 0x02, 0x64,
+	 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xA2, 0xFF, 0x00, 0xF4, 0x01, 0xF0, 0x0A, 0x18, 0x70, 0x67,
+	 0xA0, 0x80, 0xF0, 0x67, 0x06, 0x03, 0xC0, 0x84, 0x01, 0xFA, 0x25, 0x46, 0x25, 0x44, 0x80, 0xFC,
+	 0x05, 0xFA, 0xAF, 0x60, 0x58, 0x4E, 0x95, 0x78, 0xFF, 0xFF, 0xD4, 0xFE, 0xA3, 0xFF, 0x2C, 0x44,
+	 0x04, 0x27, 0x16, 0x00, 0x23, 0x46, 0x1E, 0xF2, 0x9E, 0xFC, 0x60, 0x46, 0x46, 0x46, 0x3F, 0xF2,
+	 0x00, 0xF4, 0x60, 0x47, 0x08, 0xFA, 0x26, 0x46, 0x2C, 0x43, 0x2A, 0xFC, 0x06, 0xF4, 0x00, 0x64,
+	 0x00, 0xFA, 0x01, 0xF0, 0x80, 0x60, 0x00, 0x64, 0xB0, 0x84, 0x01, 0xFA, 0x26, 0x46, 0x1D, 0x00,
+	 0x00, 0x66, 0x46, 0x46, 0xBF, 0x60, 0xEB, 0x78, 0xFF, 0xFF, 0xA3, 0x46, 0x1E, 0xF0, 0x9E, 0xFC,
+	 0x00, 0x63, 0x33, 0x85, 0xA3, 0x46, 0x0D, 0x03, 0xA3, 0x46, 0x22, 0xF2, 0x0F, 0x65, 0xA4, 0x85,
+	 0xD4, 0x84, 0x22, 0xFA, 0xA3, 0x46, 0xA2, 0xFF, 0xAF, 0x60, 0x58, 0x4E, 0x95, 0x78, 0xFF, 0xFF,
+	 0xA3, 0xFF, 0x26, 0x46, 0xC5, 0x60, 0x5B, 0x78, 0xFF, 0xFF, 0x2A, 0xF2, 0x32, 0xF0, 0x60, 0x40,
+	 0x08, 0x2A, 0x5C, 0x00, 0x01, 0x2B, 0x2F, 0x00, 0x64, 0x40, 0x01, 0x2A, 0x2C, 0x00, 0xB8, 0xF1,
+	 0x27, 0x60, 0x8A, 0x64, 0xA0, 0xD3, 0xFF, 0xFF, 0xDC, 0x84, 0xDC, 0x80, 0xD0, 0x80, 0x04, 0x03,
+	 0xA2, 0xDB, 0x08, 0x24, 0xC6, 0xFE, 0x04, 0x00, 0x8A, 0xFF, 0x20, 0x60, 0x00, 0x75, 0x88, 0xFF,
+	 0x1B, 0xF2, 0xFF, 0xFF, 0x60, 0x45, 0xB8, 0xF1, 0x27, 0x60, 0x90, 0x64, 0xA0, 0xD3, 0xFF, 0xFF,
+	 0xD8, 0x80, 0xC4, 0x84, 0x0B, 0x03, 0x07, 0x05, 0xDC, 0x80, 0xD0, 0x80, 0x04, 0x03, 0xA2, 0xDB,
+	 0x09, 0x04, 0xC6, 0xFE, 0x07, 0x00, 0x00, 0x64, 0xB8, 0x84, 0xA2, 0xDB, 0x8A, 0xFF, 0x20, 0x60,
+	 0x00, 0x75, 0x88, 0xFF, 0x2B, 0x00, 0xB8, 0xF1, 0x27, 0x60, 0x88, 0x64, 0xA0, 0xD3, 0xFF, 0xFF,
+	 0xDC, 0x84, 0xDC, 0x80, 0xD0, 0x80, 0x04, 0x03, 0xA2, 0xDB, 0x08, 0x24, 0xC6, 0xFE, 0x04, 0x00,
+	 0x8A, 0xFF, 0x20, 0x60, 0x00, 0x75, 0x88, 0xFF, 0x1B, 0xF2, 0xFF, 0xFF, 0x60, 0x45, 0xB8, 0xF1,
+	 0x27, 0x60, 0x8E, 0x64, 0xA0, 0xD3, 0xFF, 0xFF, 0xD8, 0x80, 0xC4, 0x84, 0x0B, 0x03, 0x07, 0x05,
+	 0xDC, 0x80, 0xD0, 0x80, 0x04, 0x03, 0xA2, 0xDB, 0x09, 0x04, 0xC6, 0xFE, 0x07, 0x00, 0x00, 0x64,
+	 0xB8, 0x84, 0xA2, 0xDB, 0x8A, 0xFF, 0x20, 0x60, 0x00, 0x75, 0x88, 0xFF, 0x07, 0xF4, 0xFF, 0xFF,
+	 0x22, 0xF2, 0x26, 0x46, 0x0F, 0xB4, 0xDC, 0x85, 0xB8, 0xF1, 0x27, 0x60, 0x8C, 0x64, 0xA0, 0xD3,
+	 0xFF, 0xFF, 0xD8, 0x80, 0xC4, 0x84, 0x0B, 0x03, 0x07, 0x05, 0xDC, 0x80, 0xD0, 0x80, 0x04, 0x03,
+	 0xA2, 0xDB, 0x09, 0x04, 0xC6, 0xFE, 0x07, 0x00, 0x00, 0x64, 0xB8, 0x84, 0xA2, 0xDB, 0x8A, 0xFF,
+	 0x20, 0x60, 0x00, 0x75, 0x88, 0xFF, 0x27, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x3B, 0x12, 0x00,
+	 0xB8, 0xF1, 0x27, 0x60, 0x9A, 0x64, 0xA0, 0xD3, 0xFF, 0xFF, 0xDC, 0x84, 0xDC, 0x80, 0xD0, 0x80,
+	 0x04, 0x03, 0xA2, 0xDB, 0x08, 0x24, 0xC6, 0xFE, 0x04, 0x00, 0x8A, 0xFF, 0x20, 0x60, 0x00, 0x75,
+	 0x88, 0xFF, 0x13, 0x00, 0x02, 0x3B, 0x11, 0x00, 0xB8, 0xF1, 0x27, 0x60, 0x9C, 0x64, 0xA0, 0xD3,
+	 0xFF, 0xFF, 0xDC, 0x84, 0xDC, 0x80, 0xD0, 0x80, 0x04, 0x03, 0xA2, 0xDB, 0x08, 0x24, 0xC6, 0xFE,
+	 0x04, 0x00, 0x8A, 0xFF, 0x20, 0x60, 0x00, 0x75, 0x88, 0xFF, 0xC6, 0x60, 0x85, 0x78, 0xFF, 0xFF,
+	 0xBF, 0x60, 0xEB, 0x78, 0xFF, 0xFF, 0x24, 0x60, 0x74, 0x64, 0x40, 0x4B, 0x2C, 0x60, 0x58, 0x4D,
+	 0xD8, 0x78, 0xFF, 0xFF, 0x00, 0x66, 0x46, 0x46, 0xBF, 0x60, 0xEB, 0x78, 0xFF, 0xFF, 0x24, 0x60,
+	 0x74, 0x62, 0x24, 0x60, 0x58, 0x64, 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB,
+	 0xFF, 0xFF, 0x2B, 0xFF, 0xF8, 0xFE, 0x00, 0x66, 0x46, 0x46, 0xBF, 0x60, 0xEB, 0x78, 0xFF, 0xFF,
+	 0x2A, 0xF2, 0x58, 0x63, 0x60, 0x47, 0x01, 0x27, 0x64, 0x63, 0x31, 0x60, 0x28, 0x62, 0x61, 0x5C,
+	 0xA2, 0xD9, 0xBD, 0xD0, 0xBD, 0xD0, 0x64, 0x45, 0x64, 0x41, 0xBD, 0xD0, 0x00, 0xF4, 0x04, 0xF8,
+	 0x83, 0xFA, 0x82, 0xF8, 0xA6, 0x46, 0x02, 0xB0, 0x5E, 0x63, 0x04, 0x03, 0x64, 0x63, 0x03, 0xB0,
+	 0x02, 0x3A, 0x6C, 0x63, 0x3F, 0xF2, 0xBD, 0xD0, 0xBD, 0xD0, 0x64, 0x45, 0x64, 0x41, 0xBD, 0xD0,
+	 0xA6, 0x46, 0x07, 0xF8, 0x86, 0xFA, 0x85, 0xF8, 0x60, 0x47, 0x08, 0xFA, 0x31, 0x60, 0x28, 0x62,
+	 0xA2, 0xD1, 0x26, 0x46, 0x64, 0x41, 0x2F, 0x58, 0xFF, 0xFF, 0xA9, 0xF5, 0x00, 0xF2, 0x26, 0x46,
+	 0x31, 0xF0, 0x39, 0x18, 0x66, 0x41, 0x1C, 0x60, 0xBA, 0x65, 0x64, 0x47, 0x00, 0x7F, 0xA9, 0xF1,
+	 0xE0, 0x84, 0x44, 0xD3, 0x64, 0x43, 0x11, 0x18, 0x60, 0x46, 0x00, 0xF2, 0xFF, 0xFF, 0xFC, 0x1B,
+	 0x66, 0x44, 0x64, 0x46, 0x80, 0xF0, 0x60, 0x46, 0x80, 0xF8, 0x65, 0x46, 0x65, 0x43, 0x80, 0xF0,
+	 0x01, 0xFA, 0x80, 0xFC, 0x64, 0x46, 0x80, 0xF8, 0x0B, 0x00, 0x64, 0x46, 0x62, 0x43, 0x00, 0xF2,
+	 0xA3, 0xDB, 0x60, 0x46, 0x80, 0xF0, 0x81, 0xFC, 0x80, 0xFC, 0x64, 0x46, 0x80, 0xF8, 0x60, 0x43,
+	 0x61, 0x46, 0x1E, 0x60, 0xBC, 0x61, 0xA1, 0xD3, 0x1E, 0x60, 0xFE, 0x7C, 0xD0, 0x80, 0xFF, 0xFF,
+	 0x07, 0x03, 0xA0, 0xDD, 0xDA, 0x9C, 0xA1, 0xD9, 0x49, 0xD3, 0xFF, 0xFF, 0xDC, 0x84, 0xA1, 0xDB,
+	 0xC6, 0x60, 0x40, 0x78, 0xFF, 0xFF, 0x20, 0x7C, 0x72, 0x44, 0xFF, 0xB4, 0xD0, 0x80, 0xFF, 0xFF,
+	 0x02, 0x04, 0xD0, 0x84, 0xFB, 0x01, 0xE0, 0x83, 0xA9, 0xF3, 0x02, 0xA3, 0x43, 0x93, 0xA9, 0xF3,
+	 0xFF, 0xFF, 0x02, 0xA5, 0xD7, 0x80, 0x04, 0xA5, 0x08, 0x24, 0x65, 0x43, 0x66, 0x41, 0x63, 0x46,
+	 0x05, 0xF2, 0x00, 0xF0, 0x81, 0xF0, 0x02, 0x18, 0x64, 0x46, 0x81, 0xF8, 0x07, 0x1B, 0x1C, 0x60,
+	 0xBA, 0x65, 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD9, 0x02, 0x00, 0x65, 0x46, 0x00, 0xF8,
+	 0xA9, 0xF3, 0x63, 0x45, 0x60, 0x46, 0x00, 0xF2, 0xFF, 0xFF, 0xD4, 0x80, 0x01, 0x18, 0xFA, 0x04,
+	 0x80, 0xF8, 0x65, 0x46, 0x00, 0xFA, 0x06, 0xF2, 0xFF, 0xFF, 0x00, 0x7E, 0x06, 0xFA, 0x61, 0x46,
+	 0x31, 0xF0, 0x66, 0x41, 0x1C, 0x60, 0xBA, 0x65, 0x64, 0x47, 0x00, 0x7F, 0xA9, 0xF1, 0xE0, 0x84,
+	 0x44, 0xD3, 0x64, 0x43, 0x11, 0x18, 0x60, 0x46, 0x00, 0xF2, 0xFF, 0xFF, 0xFC, 0x1B, 0x66, 0x44,
+	 0x64, 0x46, 0x80, 0xF0, 0x60, 0x46, 0x80, 0xF8, 0x65, 0x46, 0x65, 0x43, 0x80, 0xF0, 0x01, 0xFA,
+	 0x80, 0xFC, 0x64, 0x46, 0x80, 0xF8, 0x0B, 0x00, 0x64, 0x46, 0x62, 0x43, 0x00, 0xF2, 0xA3, 0xDB,
+	 0x60, 0x46, 0x80, 0xF0, 0x81, 0xFC, 0x80, 0xFC, 0x64, 0x46, 0x80, 0xF8, 0x60, 0x43, 0x61, 0x46,
+	 0x2F, 0xF2, 0x30, 0xF0, 0x31, 0xF0, 0x64, 0x45, 0x46, 0x43, 0x63, 0x46, 0x03, 0xFA, 0x06, 0xF2,
+	 0x84, 0xF8, 0x00, 0x7E, 0x06, 0xFA, 0x05, 0xF8, 0xA3, 0x46, 0x2F, 0x58, 0xFF, 0xFF, 0xDC, 0xF3,
+	 0x2A, 0xF2, 0x07, 0xB0, 0x03, 0x3A, 0x2A, 0x00, 0x00, 0xF4, 0x09, 0xF2, 0x60, 0x45, 0x80, 0x3A,
+	 0x05, 0x00, 0x0E, 0xF2, 0xFF, 0xFF, 0x02, 0xB0, 0x0F, 0xF2, 0x20, 0x03, 0x60, 0x47, 0x00, 0x3A,
+	 0x1D, 0x00, 0x60, 0x41, 0x00, 0x36, 0x13, 0x00, 0xDA, 0x85, 0x2D, 0x60, 0x7A, 0x63, 0xBD, 0xD1,
+	 0xFF, 0xFF, 0xD1, 0x80, 0xFF, 0xFF, 0x12, 0x02, 0x60, 0xFE, 0xBD, 0xD3, 0xA5, 0xD0, 0xDE, 0x85,
+	 0xD0, 0x80, 0xCD, 0x81, 0x0B, 0x02, 0xF9, 0x02, 0x20, 0xFE, 0x00, 0x64, 0x0A, 0x00, 0x26, 0x46,
+	 0x48, 0xFE, 0x65, 0x40, 0x40, 0x3A, 0x02, 0x00, 0x01, 0x64, 0x03, 0x00, 0x08, 0xFE, 0x20, 0xFE,
+	 0x00, 0x64, 0x40, 0x48, 0x26, 0x46, 0x2D, 0x58, 0xFF, 0xFF, 0x2D, 0x60, 0x52, 0x62, 0xA2, 0xD3,
+	 0x18, 0xF2, 0x60, 0x40, 0x01, 0x26, 0x2A, 0xFA, 0x2A, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x08, 0x26,
+	 0x03, 0x00, 0xC7, 0x60, 0x6D, 0x78, 0xFF, 0xFF, 0x3F, 0xF0, 0x32, 0x40, 0x10, 0x2A, 0x20, 0x00,
+	 0x2C, 0xF0, 0x64, 0x41, 0x60, 0x40, 0x40, 0x27, 0x1B, 0x00, 0xCD, 0x81, 0xDD, 0x81, 0x18, 0x03,
+	 0x17, 0x03, 0x64, 0x40, 0x01, 0x26, 0x14, 0x00, 0x01, 0x61, 0x13, 0x00, 0xB8, 0xF1, 0x27, 0x60,
+	 0xA0, 0x64, 0xA0, 0xD3, 0xFF, 0xFF, 0xDC, 0x84, 0xDC, 0x80, 0xD0, 0x80, 0x04, 0x03, 0xA2, 0xDB,
+	 0x08, 0x24, 0xC6, 0xFE, 0x04, 0x00, 0x8A, 0xFF, 0x20, 0x60, 0x00, 0x75, 0x88, 0xFF, 0x23, 0x00,
+	 0x00, 0x61, 0x60, 0x40, 0x18, 0x36, 0x1F, 0x00, 0xC5, 0x60, 0x58, 0x4F, 0x78, 0x78, 0xFF, 0xFF,
+	 0x0F, 0xF0, 0xEB, 0xF1, 0x64, 0x44, 0x60, 0x22, 0x19, 0x00, 0xDC, 0xF3, 0xFF, 0xFF, 0x07, 0xB4,
+	 0xFD, 0xA0, 0x2A, 0xF2, 0x03, 0x02, 0x08, 0xB0, 0xFF, 0xFF, 0x10, 0x02, 0x32, 0xF2, 0x33, 0xF2,
+	 0xD0, 0x80, 0xEC, 0xF1, 0x0B, 0x02, 0xD0, 0x80, 0x34, 0xF2, 0x08, 0x02, 0xED, 0xF1, 0xFF, 0xFF,
+	 0xD0, 0x80, 0x0F, 0xF0, 0x03, 0x02, 0xC7, 0x60, 0xB9, 0x78, 0xFF, 0xFF, 0x00, 0xF4, 0xAA, 0x60,
+	 0xAA, 0x65, 0x09, 0xF2, 0x5A, 0xD0, 0xD4, 0x80, 0x03, 0x64, 0x4F, 0x02, 0xD0, 0x80, 0x00, 0x64,
+	 0x5A, 0xD0, 0x4B, 0x02, 0x64, 0x45, 0xD4, 0x80, 0xF8, 0x7F, 0x08, 0x02, 0x5A, 0xD0, 0x26, 0x46,
+	 0x64, 0x45, 0x23, 0xF0, 0x20, 0x67, 0xB0, 0x84, 0xA2, 0xDA, 0x0B, 0x00, 0xD4, 0x80, 0x1D, 0x60,
+	 0x60, 0x64, 0x16, 0x02, 0x5A, 0xD0, 0x26, 0x46, 0x64, 0x45, 0x23, 0xF0, 0x40, 0x67, 0xB0, 0x84,
+	 0xA2, 0xDA, 0x65, 0x44, 0x88, 0x3A, 0x07, 0x00, 0x77, 0x37, 0x08, 0x00, 0x78, 0x37, 0x06, 0x00,
+	 0x8E, 0x37, 0x04, 0x00, 0x2A, 0x00, 0x81, 0x3A, 0x28, 0x00, 0x80, 0x37, 0x00, 0x61, 0x25, 0x00,
+	 0xD4, 0x80, 0x01, 0x60, 0x00, 0x64, 0x5A, 0xD0, 0x20, 0x02, 0xD0, 0x80, 0x5A, 0xD0, 0x1D, 0x02,
+	 0x26, 0x46, 0x64, 0x47, 0x7F, 0xB4, 0xFD, 0xA0, 0x09, 0x03, 0x17, 0x07, 0x32, 0x40, 0x02, 0x26,
+	 0x47, 0x00, 0x23, 0xF0, 0x60, 0x67, 0xB0, 0x84, 0xA2, 0xDA, 0x42, 0x00, 0x0F, 0xF2, 0x32, 0x40,
+	 0x02, 0x26, 0x3E, 0x00, 0xF2, 0xF3, 0xFF, 0xFF, 0x02, 0xBC, 0xF2, 0xFB, 0xEB, 0x60, 0x58, 0x4F,
+	 0xA5, 0x78, 0xFF, 0xFF, 0xC7, 0x60, 0xC3, 0x78, 0xFF, 0xFF, 0x26, 0x46, 0x61, 0x40, 0x01, 0x2A,
+	 0x12, 0x00, 0xB8, 0xF1, 0x27, 0x60, 0xA0, 0x64, 0xA0, 0xD3, 0xFF, 0xFF, 0xDC, 0x84, 0xDC, 0x80,
+	 0xD0, 0x80, 0x04, 0x03, 0xA2, 0xDB, 0x08, 0x24, 0xC6, 0xFE, 0x04, 0x00, 0x8A, 0xFF, 0x20, 0x60,
+	 0x00, 0x75, 0x88, 0xFF, 0x6E, 0x00, 0x0F, 0xF2, 0x81, 0xF1, 0x2A, 0xF2, 0x60, 0x40, 0x20, 0x2A,
+	 0x12, 0x00, 0x5E, 0x63, 0x60, 0x40, 0x02, 0x2B, 0x64, 0x63, 0xBD, 0xD2, 0xBD, 0xD2, 0xD0, 0x80,
+	 0x82, 0xF1, 0x08, 0x02, 0xD0, 0x80, 0xA3, 0xD2, 0x83, 0xF1, 0x04, 0x02, 0xD0, 0x80, 0xFF, 0xFF,
+	 0x01, 0x02, 0x06, 0x00, 0x56, 0x00, 0x2A, 0xF2, 0xFF, 0xFF, 0xFF, 0xFF, 0x48, 0x36, 0x51, 0x00,
+	 0xF2, 0xF3, 0xFF, 0xFF, 0x02, 0xBC, 0xF2, 0xFB, 0x59, 0x00, 0x26, 0x46, 0x2A, 0xF2, 0xFF, 0xFF,
+	 0xFF, 0xFF, 0x0C, 0x26, 0x46, 0x00, 0xB0, 0x36, 0x15, 0x00, 0x10, 0x36, 0x13, 0x00, 0x30, 0x36,
+	 0x11, 0x00, 0xC0, 0x36, 0x02, 0x00, 0xA0, 0x3A, 0x12, 0x00, 0x81, 0xF1, 0x32, 0xF2, 0x33, 0xF2,
+	 0xD0, 0x80, 0x82, 0xF1, 0x36, 0x02, 0xD0, 0x80, 0x34, 0xF2, 0x83, 0xF1, 0x32, 0x02, 0xD0, 0x80,
+	 0xFF, 0xFF, 0x2F, 0x02, 0xDB, 0x60, 0x58, 0x4F, 0xD2, 0x78, 0xFF, 0xFF, 0x26, 0x00, 0x50, 0x3A,
+	 0x05, 0x00, 0xEF, 0x60, 0x58, 0x4F, 0xE3, 0x78, 0xFF, 0xFF, 0x1F, 0x00, 0x40, 0x3A, 0x05, 0x00,
+	 0xE8, 0x60, 0x58, 0x4F, 0x60, 0x78, 0xFF, 0xFF, 0x18, 0x00, 0x80, 0x3A, 0x15, 0x00, 0x81, 0xF1,
+	 0x32, 0xF2, 0x33, 0xF2, 0xD0, 0x80, 0x82, 0xF1, 0x14, 0x02, 0xD0, 0x80, 0x34, 0xF2, 0x83, 0xF1,
+	 0x10, 0x02, 0xD0, 0x80, 0xFF, 0xFF, 0x0D, 0x02, 0xDF, 0x60, 0x58, 0x4F, 0x28, 0x78, 0xFF, 0xFF,
+	 0x20, 0x60, 0x58, 0x4F, 0xBF, 0x78, 0xFF, 0xFF, 0x04, 0x00, 0x66, 0x44, 0x00, 0xA8, 0xFF, 0xFF,
+	 0x0A, 0x03, 0x26, 0x46, 0x24, 0x60, 0x74, 0x64, 0x40, 0x4B, 0x2C, 0x60, 0x58, 0x4D, 0xD8, 0x78,
+	 0xFF, 0xFF, 0x00, 0x66, 0x46, 0x46, 0xC5, 0x60, 0x58, 0x78, 0xFF, 0xFF, 0x2A, 0xF2, 0x3B, 0xF0,
+	 0x60, 0x40, 0x40, 0x2B, 0x1E, 0x00, 0xC0, 0x60, 0x00, 0x64, 0x64, 0x40, 0x20, 0x2B, 0x19, 0x00,
+	 0x22, 0xF2, 0xFF, 0xFF, 0x04, 0xB4, 0xFF, 0xFF, 0x14, 0x03, 0xC0, 0x60, 0x00, 0x64, 0x26, 0x46,
+	 0xA0, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0x23, 0xF2, 0x10, 0xBD, 0xB4, 0x9C, 0x3F, 0xF2,
+	 0x23, 0xF8, 0x3F, 0xF2, 0xFF, 0xFF, 0xF8, 0xA4, 0x3F, 0xFA, 0x00, 0xF4, 0x60, 0x47, 0x08, 0xFA,
+	 0x26, 0x46, 0x24, 0x60, 0x74, 0x62, 0x24, 0x60, 0x58, 0x64, 0xA2, 0xDB, 0x26, 0x44, 0x5A, 0xDB,
+	 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xF8, 0xFE, 0xCB, 0x01, 0x00, 0x60, 0x30, 0x61,
+	 0xAE, 0x60, 0x58, 0x4D, 0xC4, 0x78, 0xFF, 0xFF, 0x66, 0x44, 0x60, 0xFB, 0x00, 0x60, 0x30, 0x61,
+	 0xAE, 0x60, 0x58, 0x4D, 0xC4, 0x78, 0xFF, 0xFF, 0x66, 0x44, 0x5F, 0xFB, 0x00, 0x60, 0x02, 0x61,
+	 0xAE, 0x60, 0x58, 0x4D, 0xC4, 0x78, 0xFF, 0xFF, 0x66, 0x44, 0x66, 0xFB, 0x10, 0x60, 0x26, 0x62,
+	 0xC9, 0x60, 0xC7, 0x64, 0xA2, 0xDB, 0x2F, 0x58, 0xFF, 0xFF, 0x00, 0x64, 0x3B, 0x42, 0x5A, 0xDB,
+	 0x01, 0x64, 0xDC, 0xFB, 0xF2, 0xF3, 0xFF, 0xFF, 0xFE, 0xB4, 0xF2, 0xFB, 0x0F, 0x60, 0xF0, 0x62,
+	 0x00, 0x64, 0xA2, 0xDB, 0x00, 0x60, 0x14, 0x63, 0x01, 0x60, 0xC4, 0x61, 0x28, 0x60, 0x3E, 0x64,
+	 0x58, 0xD1, 0x59, 0xD9, 0xFD, 0x1F, 0x00, 0x60, 0x88, 0x63, 0x27, 0x60, 0xB4, 0x61, 0x28, 0x60,
+	 0x54, 0x64, 0x58, 0xD1, 0x59, 0xD9, 0xFD, 0x1F, 0x28, 0x60, 0x2C, 0x62, 0xA2, 0xD1, 0xFF, 0xFF,
+	 0x64, 0x45, 0xA9, 0xF1, 0x66, 0x41, 0x64, 0x46, 0x36, 0xF2, 0xFF, 0xFF, 0x65, 0x40, 0x01, 0x36,
+	 0x22, 0x64, 0x36, 0xFA, 0x61, 0x46, 0x32, 0x45, 0x28, 0x60, 0x3C, 0x62, 0xA2, 0xD1, 0x10, 0x67,
+	 0xB4, 0x85, 0x64, 0x40, 0x01, 0x2A, 0x94, 0x85, 0x45, 0x52, 0xFF, 0x60, 0xE7, 0x65, 0x32, 0x41,
+	 0xA5, 0x81, 0x2D, 0x60, 0x1A, 0x62, 0xA2, 0xD1, 0x28, 0x60, 0x2C, 0x62, 0xA2, 0xD3, 0x64, 0x40,
+	 0x01, 0x2A, 0x0D, 0x00, 0x08, 0x65, 0xFF, 0xA0, 0xFF, 0xFF, 0x01, 0x03, 0x08, 0x00, 0x28, 0x60,
+	 0x30, 0x62, 0xA2, 0xD3, 0xB5, 0x81, 0x10, 0x65, 0x60, 0x40, 0x01, 0x26, 0xB5, 0x81, 0x41, 0x52,
+	 0x2D, 0x60, 0x1A, 0x62, 0xA2, 0xD3, 0x31, 0x60, 0x18, 0x63, 0xF0, 0x84, 0xF0, 0x84, 0xF0, 0x84,
+	 0x01, 0xB5, 0xF0, 0x84, 0xF0, 0x84, 0x03, 0xB4, 0x65, 0x5C, 0xA3, 0xD9, 0x31, 0x60, 0x1A, 0x63,
+	 0x02, 0xA8, 0xA3, 0xDB, 0x1B, 0x02, 0x07, 0x60, 0xD0, 0x64, 0x31, 0x60, 0x1C, 0x63, 0xA3, 0xDB,
+	 0x31, 0x60, 0x24, 0x63, 0xA3, 0xDB, 0x00, 0x60, 0xC8, 0x64, 0x31, 0x60, 0x1E, 0x63, 0xA3, 0xDB,
+	 0x31, 0x60, 0x26, 0x63, 0xA3, 0xDB, 0x00, 0x60, 0x64, 0x64, 0x31, 0x60, 0x20, 0x63, 0xA3, 0xDB,
+	 0x01, 0x60, 0x90, 0x64, 0x31, 0x60, 0x22, 0x63, 0xA3, 0xDB, 0x08, 0x00, 0x0A, 0x64, 0x31, 0x60,
+	 0x20, 0x63, 0xA3, 0xDB, 0x01, 0x64, 0x31, 0x60, 0x22, 0x63, 0xA3, 0xDB, 0x2D, 0x60, 0x1A, 0x62,
+	 0xA2, 0xD1, 0x01, 0x64, 0x64, 0x40, 0x40, 0x2A, 0x03, 0x00, 0x31, 0x60, 0x0E, 0x7C, 0xA4, 0xDB,
+	 0x12, 0x60, 0x28, 0x63, 0xBA, 0xF3, 0x0E, 0x61, 0x60, 0x45, 0x65, 0x44, 0xE8, 0x85, 0x05, 0x64,
+	 0xCD, 0x81, 0x02, 0x28, 0x00, 0x64, 0xBD, 0xDB, 0xF8, 0x02, 0x2D, 0x60, 0x78, 0x61, 0x27, 0x60,
+	 0xB6, 0x64, 0x20, 0x63, 0x58, 0xD1, 0x59, 0xD9, 0xFD, 0x1F, 0xBD, 0xF1, 0x80, 0xF9, 0x1A, 0x63,
+	 0x01, 0x60, 0x00, 0x61, 0x00, 0x64, 0x59, 0xDB, 0xFE, 0x1F, 0x40, 0x40, 0x01, 0x64, 0x87, 0xFB,
+	 0x28, 0x60, 0xCC, 0x61, 0xA1, 0xD3, 0x2E, 0x60, 0x96, 0x61, 0xFE, 0xA4, 0xE0, 0x84, 0x04, 0x24,
+	 0x0F, 0x00, 0xE0, 0x84, 0x41, 0x91, 0x2D, 0x60, 0xCC, 0x62, 0xA2, 0xD3, 0xA1, 0xD1, 0x2D, 0x60,
+	 0xC4, 0x62, 0xA0, 0x83, 0xA2, 0xDD, 0x59, 0xD1, 0x2D, 0x60, 0xC2, 0x62, 0xA0, 0x83, 0xA2, 0xDD,
+	 0xE5, 0xF3, 0x7F, 0xFB, 0x1B, 0x60, 0xC6, 0x61, 0xA1, 0xD3, 0xFF, 0xFF, 0x00, 0xB8, 0x10, 0x60,
+	 0x5C, 0x65, 0x0D, 0x03, 0x1B, 0x60, 0xCE, 0x63, 0xE5, 0xF3, 0xA3, 0xD1, 0xE0, 0x84, 0xC4, 0x84,
+	 0xA0, 0xD3, 0xFF, 0xFF, 0x01, 0xB0, 0xFF, 0xFF, 0x02, 0x02, 0xE5, 0xF9, 0x7F, 0xF9, 0xE5, 0xF3,
+	 0x01, 0x61, 0xCC, 0x84, 0xFF, 0xFF, 0x02, 0x03, 0xE1, 0x81, 0xFB, 0x01, 0xBA, 0xF3, 0x61, 0x45,
+	 0xA4, 0x80, 0xFF, 0xFF, 0x0B, 0x02, 0x00, 0xB8, 0x01, 0x63, 0x08, 0x03, 0xE8, 0x84, 0xFF, 0xFF,
+	 0x02, 0x24, 0x02, 0x00, 0xDF, 0x83, 0xFA, 0x01, 0xE5, 0xFD, 0x7F, 0xFD, 0x0F, 0x60, 0xF0, 0x62,
+	 0x00, 0x64, 0xA2, 0xDB, 0xDE, 0xFE, 0x0B, 0x04, 0x0F, 0x60, 0xF2, 0x62, 0x40, 0x60, 0x00, 0x64,
+	 0xA2, 0xDB, 0xC8, 0x60, 0xF7, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x7F, 0xF1,
+	 0x24, 0x60, 0x9A, 0x62, 0xA2, 0xD9, 0x0C, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x2D, 0xFF, 0x07, 0x64,
+	 0xD0, 0xFB, 0x0F, 0x60, 0xF2, 0x62, 0x20, 0x60, 0x00, 0x64, 0xA2, 0xDB, 0xC9, 0x60, 0x34, 0x64,
+	 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60, 0xF0, 0x62, 0x00, 0x64, 0xA2, 0xDB,
+	 0xBE, 0xFE, 0x0F, 0x60, 0xD0, 0x62, 0xA2, 0xD1, 0x40, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB,
+	 0xCF, 0xFE, 0x01, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0xE3, 0xF3, 0xFF, 0xFF, 0x60, 0x40, 0x05, 0x3A,
+	 0x03, 0x00, 0x68, 0x60, 0xBA, 0x61, 0x11, 0x00, 0x04, 0x3A, 0x03, 0x00, 0x68, 0x60, 0xAE, 0x61,
+	 0x0C, 0x00, 0x03, 0x3A, 0x03, 0x00, 0x68, 0x60, 0xA2, 0x61, 0x07, 0x00, 0x02, 0x3A, 0x03, 0x00,
+	 0x68, 0x60, 0x96, 0x61, 0x02, 0x00, 0x68, 0x60, 0x8A, 0x61, 0x3C, 0x60, 0x00, 0x66, 0x01, 0x60,
+	 0xB8, 0x64, 0x0A, 0x63, 0x59, 0xD0, 0x58, 0xD9, 0xFD, 0x1F, 0x01, 0x60, 0xBE, 0x61, 0xE4, 0xF3,
+	 0x00, 0x66, 0x00, 0xA8, 0x04, 0x65, 0x01, 0x03, 0xA1, 0xDB, 0x1F, 0x60, 0x08, 0x63, 0x55, 0xD3,
+	 0xFF, 0xFF, 0x20, 0x7F, 0xBD, 0xDB, 0x59, 0xD3, 0xFF, 0xFF, 0x21, 0x7F, 0xBD, 0xDB, 0x59, 0xD3,
+	 0xFF, 0xFF, 0x22, 0x7F, 0xA3, 0xDB, 0x0F, 0x60, 0xF0, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0xDE, 0xFE,
+	 0x0B, 0x04, 0x0F, 0x60, 0xF2, 0x62, 0x40, 0x60, 0x00, 0x64, 0xA2, 0xDB, 0xC9, 0x60, 0x7B, 0x64,
+	 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x24, 0x60, 0x9A, 0x62, 0x1F, 0x60, 0x06, 0x64,
+	 0xA2, 0xDB, 0x20, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x2D, 0xFF, 0x0F, 0x60, 0xF2, 0x62, 0x20, 0x60,
+	 0x00, 0x64, 0xA2, 0xDB, 0xC9, 0x60, 0xA0, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF,
+	 0xBE, 0xFE, 0x0F, 0x60, 0xD0, 0x62, 0xA2, 0xD1, 0x40, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB,
+	 0xCF, 0xFE, 0xC5, 0xFE, 0x20, 0x40, 0x20, 0x2A, 0x08, 0x00, 0x10, 0x60, 0x02, 0x62, 0xA2, 0xD1,
+	 0x00, 0x60, 0x04, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x0F, 0x60, 0xEA, 0x62, 0xA2, 0xD1,
+	 0x00, 0x60, 0x02, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x0F, 0x60, 0xF0, 0x62, 0x00, 0x64,
+	 0xA2, 0xDB, 0x5A, 0xDB, 0x0E, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x64,
+	 0x3B, 0x42, 0x5A, 0xDB, 0x0F, 0x60, 0xF0, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x02, 0x64, 0x8B, 0xFB,
+	 0xFF, 0xFF, 0xC1, 0xFE, 0x10, 0x60, 0x1A, 0x62, 0xA2, 0xD1, 0x01, 0x60, 0xDF, 0x64, 0xB0, 0x84,
+	 0xA2, 0xDB, 0xCF, 0xFE, 0x24, 0x60, 0xA8, 0x63, 0x01, 0x64, 0xBD, 0xDB, 0xFF, 0xFF, 0x04, 0xFF,
+	 0x0F, 0x60, 0xF0, 0x62, 0xA2, 0xD1, 0x00, 0x60, 0x08, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE,
+	 0x0F, 0x60, 0xF2, 0x62, 0x00, 0x60, 0x08, 0x64, 0xA2, 0xDB, 0xC9, 0x60, 0xF3, 0x64, 0x5A, 0xDB,
+	 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x08, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0x0F, 0x60, 0xF0, 0x62,
+	 0xA2, 0xD1, 0x7F, 0x60, 0xFF, 0x64, 0xA0, 0x84, 0xA2, 0xDB, 0x8B, 0xF3, 0x00, 0x65, 0xD4, 0x80,
+	 0xFF, 0xFF, 0x0B, 0x03, 0x0F, 0x60, 0xF2, 0x62, 0x80, 0x60, 0x00, 0x64, 0xA2, 0xDB, 0xC9, 0x60,
+	 0xF3, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0xDE, 0xFE, 0x0E, 0x04, 0x09, 0x64,
+	 0x3B, 0x42, 0x5A, 0xDB, 0x0F, 0x60, 0xF2, 0x62, 0x20, 0x60, 0x00, 0x64, 0xA2, 0xDB, 0xCA, 0x60,
+	 0x1D, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x0A, 0x64, 0x3B, 0x42, 0x5A, 0xDB,
+	 0x24, 0x60, 0x9A, 0x62, 0x06, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x2D, 0xFF, 0x0F, 0x60, 0xF0, 0x62,
+	 0x00, 0x64, 0xA2, 0xDB, 0x5A, 0xDB, 0xBE, 0xFE, 0xDA, 0xFE, 0x24, 0x60, 0x34, 0x61, 0xCA, 0x60,
+	 0x58, 0x4E, 0x57, 0x78, 0xFF, 0xFF, 0x24, 0x60, 0x22, 0x61, 0xCA, 0x60, 0x58, 0x4E, 0x57, 0x78,
+	 0xFF, 0xFF, 0x24, 0x60, 0x28, 0x61, 0xCA, 0x60, 0x58, 0x4E, 0x57, 0x78, 0xFF, 0xFF, 0x24, 0x60,
+	 0x46, 0x61, 0xCA, 0x60, 0x58, 0x4E, 0x57, 0x78, 0xFF, 0xFF, 0x24, 0x60, 0x4C, 0x61, 0xCA, 0x60,
+	 0x58, 0x4E, 0x57, 0x78, 0xFF, 0xFF, 0x24, 0x60, 0x58, 0x61, 0xCA, 0x60, 0x58, 0x4E, 0x57, 0x78,
+	 0xFF, 0xFF, 0xC5, 0xFE, 0x0E, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0x2F, 0x58, 0xFF, 0xFF, 0xA1, 0xD3,
+	 0x0E, 0x57, 0x24, 0x00, 0x0E, 0xF2, 0x44, 0x4C, 0x80, 0xB0, 0x10, 0xB0, 0x0B, 0x03, 0x24, 0x60,
+	 0x74, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF,
+	 0x2B, 0xFF, 0x13, 0x00, 0x12, 0x02, 0xF0, 0x37, 0x09, 0x00, 0x02, 0xF0, 0x09, 0x60, 0x08, 0x64,
+	 0xD0, 0x80, 0xA2, 0xFF, 0xB0, 0xF3, 0x02, 0x02, 0xCC, 0x84, 0xB0, 0xFB, 0x24, 0x60, 0x74, 0x64,
+	 0x40, 0x4B, 0x2C, 0x60, 0x58, 0x4D, 0xD8, 0x78, 0xFF, 0xFF, 0x2C, 0x44, 0xAC, 0x86, 0x09, 0xF0,
+	 0xD9, 0x02, 0x37, 0x58, 0xFF, 0xFF, 0x1A, 0x60, 0x66, 0x63, 0x00, 0x64, 0xA3, 0xDB, 0x06, 0xA3,
+	 0x10, 0x60, 0x4C, 0x64, 0xBD, 0xDB, 0xBD, 0xDB, 0x06, 0x64, 0xA3, 0xDB, 0x00, 0x63, 0x10, 0x60,
+	 0x9E, 0x62, 0xA2, 0xDD, 0x10, 0x60, 0x4A, 0x62, 0xCF, 0x60, 0x16, 0x64, 0xA2, 0xDB, 0x10, 0x60,
+	 0x24, 0x62, 0xCE, 0x60, 0xE2, 0x64, 0xA2, 0xDB, 0x0F, 0x60, 0xEC, 0x62, 0x00, 0x60, 0x02, 0x64,
+	 0xA2, 0xDB, 0xCA, 0x60, 0xFB, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x68, 0x60,
+	 0x7E, 0x61, 0x3C, 0x60, 0x00, 0x66, 0x01, 0x60, 0xB8, 0x64, 0x0A, 0x63, 0x59, 0xD0, 0x58, 0xD9,
+	 0xFD, 0x1F, 0x01, 0x60, 0xBE, 0x61, 0xE4, 0xF3, 0x00, 0x66, 0x00, 0xA8, 0x04, 0x65, 0x01, 0x03,
+	 0xA1, 0xDB, 0x1F, 0x60, 0x08, 0x63, 0x55, 0xD3, 0xFF, 0xFF, 0x20, 0x7F, 0xBD, 0xDB, 0x59, 0xD3,
+	 0xFF, 0xFF, 0x21, 0x7F, 0xBD, 0xDB, 0x59, 0xD3, 0xFF, 0xFF, 0x22, 0x7F, 0xA3, 0xDB, 0x0F, 0x60,
+	 0xEA, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0xDE, 0xFE, 0x0B, 0x04, 0x0F, 0x60, 0xEC, 0x62, 0x40, 0x60,
+	 0x00, 0x64, 0xA2, 0xDB, 0xCA, 0x60, 0xC7, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x24, 0x60, 0x9A, 0x62, 0x1F, 0x60, 0x06, 0x64, 0xA2, 0xDB, 0x20, 0x64, 0x4A, 0xDB, 0xFF, 0xFF,
+	 0x2D, 0xFF, 0x0F, 0x60, 0xEC, 0x62, 0x20, 0x60, 0x00, 0x64, 0xA2, 0xDB, 0xCA, 0x60, 0xEC, 0x64,
+	 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60, 0xEA, 0x62, 0x00, 0x64, 0xA2, 0xDB,
+	 0xBE, 0xFE, 0x0F, 0x60, 0xD0, 0x62, 0xA2, 0xD1, 0x40, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB,
+	 0xCF, 0xFE, 0x2E, 0x58, 0xFF, 0xFF, 0x10, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0x0F, 0x60, 0xEA, 0x62,
+	 0x00, 0x64, 0xA2, 0xDB, 0xBA, 0xFE, 0x27, 0x60, 0xB6, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0x03, 0xA8,
+	 0x02, 0xA8, 0x04, 0x03, 0x0F, 0x02, 0xCE, 0x60, 0xB3, 0x78, 0xFF, 0xFF, 0xCD, 0x60, 0xEF, 0x78,
+	 0xFF, 0xFF, 0x1F, 0x60, 0x80, 0x65, 0xA5, 0xD3, 0xFF, 0xFF, 0xF3, 0xB4, 0xA5, 0xDB, 0xCB, 0x60,
+	 0x22, 0x78, 0xFF, 0xFF, 0x01, 0x63, 0x1A, 0x60, 0x40, 0x64, 0xA0, 0xDD, 0x1F, 0x60, 0x80, 0x64,
+	 0x00, 0x63, 0xA0, 0xDD, 0x11, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0x0F, 0x60, 0xEA, 0x62, 0x00, 0x64,
+	 0xA2, 0xDB, 0xBA, 0xFE, 0x02, 0x64, 0xDC, 0xFB, 0xF2, 0xF3, 0xFF, 0xFF, 0x01, 0xBC, 0xF2, 0xFB,
+	 0x44, 0x60, 0x44, 0x64, 0x81, 0xFB, 0x82, 0xFB, 0x83, 0xFB, 0xFF, 0xFF, 0x20, 0x40, 0x04, 0x2B,
+	 0x19, 0x00, 0x9B, 0xFE, 0x09, 0x04, 0xBB, 0xFE, 0x0F, 0x60, 0xD0, 0x62, 0xA2, 0xD1, 0x80, 0x60,
+	 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x12, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0x0F, 0x60,
+	 0xEC, 0x62, 0x80, 0x60, 0x00, 0x64, 0xA2, 0xDB, 0xCB, 0x60, 0x36, 0x64, 0x5A, 0xDB, 0xCF, 0xFE,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x08, 0x60, 0x00, 0x65, 0x20, 0x44, 0x34, 0x80, 0x0D, 0x64, 0x53, 0xFB,
+	 0x29, 0x60, 0xA4, 0x64, 0x54, 0xFB, 0x13, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0x0F, 0x60, 0xCE, 0x61,
+	 0xA1, 0xD1, 0x02, 0x60, 0x00, 0x65, 0x20, 0x44, 0x34, 0x80, 0x64, 0x40, 0x01, 0x2A, 0x07, 0x00,
+	 0x00, 0x64, 0xA1, 0xDB, 0x02, 0x65, 0xE9, 0x60, 0x58, 0x4E, 0x7B, 0x78, 0xFF, 0xFF, 0xCA, 0x60,
+	 0x58, 0x4E, 0xA7, 0x78, 0xFF, 0xFF, 0x1F, 0x60, 0x80, 0x62, 0x1A, 0x60, 0x40, 0x65, 0xA2, 0xD3,
+	 0xA5, 0xD1, 0x60, 0x40, 0x0C, 0x22, 0x04, 0x00, 0x04, 0x61, 0xD1, 0x80, 0xFF, 0xFF, 0x2D, 0x05,
+	 0x0F, 0x60, 0xEA, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x0F, 0x4E, 0xE4, 0x60, 0x58, 0x4F, 0xFB, 0x78,
+	 0xFF, 0xFF, 0x0E, 0x4F, 0x0F, 0x60, 0xEC, 0x62, 0x10, 0x60, 0x00, 0x64, 0xA2, 0xDB, 0xCB, 0x60,
+	 0x95, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x1F, 0x60, 0x80, 0x64, 0xA0, 0xD3,
+	 0xFF, 0xFF, 0x60, 0x40, 0x0C, 0x26, 0x11, 0x00, 0xFD, 0x60, 0xFF, 0x65, 0x20, 0x44, 0x24, 0x80,
+	 0x0F, 0x60, 0xD0, 0x62, 0xA2, 0xD1, 0x80, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE,
+	 0x0F, 0x60, 0xEA, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x38, 0x00, 0x0F, 0x60, 0xEA, 0x62, 0x00, 0x64,
+	 0xA2, 0xDB, 0x0F, 0x4E, 0xEC, 0x60, 0x58, 0x4F, 0xB9, 0x78, 0xFF, 0xFF, 0x0E, 0x4F, 0x0F, 0x60,
+	 0xEC, 0x62, 0x10, 0x60, 0x00, 0x64, 0xA2, 0xDB, 0xCB, 0x60, 0xC2, 0x64, 0x5A, 0xDB, 0xCF, 0xFE,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x14, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0xFD, 0x60, 0xFF, 0x65, 0x20, 0x44,
+	 0x24, 0x80, 0x0F, 0x60, 0xD0, 0x62, 0xA2, 0xD1, 0x80, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB,
+	 0xCF, 0xFE, 0x0F, 0x60, 0xEA, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x88, 0xF1, 0x19, 0x60, 0x86, 0x63,
+	 0xD3, 0x80, 0x20, 0x44, 0x05, 0x03, 0x10, 0xBC, 0x40, 0x40, 0xCD, 0x60, 0xE8, 0x78, 0xFF, 0xFF,
+	 0x89, 0xF3, 0xFF, 0xFF, 0xD0, 0x80, 0x20, 0x44, 0x06, 0x02, 0xD4, 0xF3, 0xFF, 0xFF, 0x00, 0xA8,
+	 0xFF, 0xFF, 0x1E, 0x02, 0x72, 0x00, 0x10, 0xBC, 0x40, 0x40, 0x64, 0x42, 0x5A, 0xD1, 0x06, 0x63,
+	 0xA4, 0xD1, 0xC3, 0x83, 0x7F, 0xF9, 0xBD, 0xD1, 0x81, 0xF9, 0xBD, 0xD1, 0xFF, 0xFF, 0x82, 0xF9,
+	 0xBD, 0xD1, 0x83, 0xF9, 0x04, 0xA3, 0xBD, 0xD1, 0x2D, 0x60, 0x7A, 0x64, 0x64, 0x41, 0xDD, 0x81,
+	 0xFE, 0xB1, 0xA0, 0xD9, 0x04, 0x03, 0xBD, 0xD1, 0xC9, 0x81, 0x58, 0xD9, 0xFC, 0x02, 0x1E, 0x00,
+	 0xE5, 0xF3, 0x7F, 0xFB, 0x29, 0x60, 0xA4, 0x61, 0xA1, 0xD3, 0xFF, 0xFF, 0x00, 0xA8, 0x2D, 0x60,
+	 0x7A, 0x63, 0x02, 0x02, 0x27, 0x60, 0xB8, 0x61, 0xA1, 0xD3, 0xBD, 0xDB, 0xDC, 0x84, 0xFE, 0xB4,
+	 0x59, 0xD1, 0xC8, 0x84, 0xBD, 0xD9, 0xFC, 0x02, 0xED, 0xF3, 0x72, 0x45, 0xEC, 0xF3, 0x94, 0x83,
+	 0x83, 0xFD, 0x94, 0x83, 0x82, 0xFD, 0x65, 0x5F, 0x02, 0x64, 0x81, 0xFB, 0x0F, 0x60, 0xEA, 0x62,
+	 0x00, 0x64, 0xA2, 0xDB, 0xDE, 0xFE, 0x0B, 0x04, 0x0F, 0x60, 0xEC, 0x62, 0x40, 0x60, 0x00, 0x64,
+	 0xA2, 0xDB, 0xCC, 0x60, 0x26, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x18, 0x64,
+	 0x3B, 0x42, 0x5A, 0xDB, 0x7F, 0xF1, 0x24, 0x60, 0x9A, 0x62, 0xA2, 0xD9, 0x1E, 0x64, 0x4A, 0xDB,
+	 0xFF, 0xFF, 0x2D, 0xFF, 0x0F, 0x60, 0xEC, 0x62, 0x20, 0x60, 0x00, 0x64, 0xA2, 0xDB, 0xCC, 0x60,
+	 0x4D, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60, 0xEA, 0x62, 0x00, 0x64,
+	 0xA2, 0xDB, 0xBE, 0xFE, 0x0F, 0x60, 0xD0, 0x62, 0xA2, 0xD1, 0x40, 0x60, 0x00, 0x64, 0xB0, 0x84,
+	 0xA2, 0xDB, 0xCF, 0xFE, 0xCC, 0x60, 0xAD, 0x78, 0xFF, 0xFF, 0x16, 0x64, 0x3B, 0x42, 0x5A, 0xDB,
+	 0xFF, 0x60, 0xEF, 0x65, 0x20, 0x44, 0x24, 0x80, 0xCA, 0x60, 0x58, 0x4E, 0xA7, 0x78, 0xFF, 0xFF,
+	 0x17, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0x02, 0x64, 0xDC, 0xFB, 0xF2, 0xF3, 0xFF, 0xFF, 0x01, 0xBC,
+	 0xF2, 0xFB, 0xF7, 0x60, 0xFF, 0x65, 0x20, 0x44, 0x24, 0x80, 0x0F, 0x60, 0xD0, 0x62, 0xA2, 0xD1,
+	 0x80, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x0F, 0x60, 0xEA, 0x62, 0x00, 0x64,
+	 0xA2, 0xDB, 0xDA, 0xFE, 0xC1, 0xFE, 0x1A, 0x60, 0x40, 0x62, 0xA2, 0xD1, 0x1A, 0x60, 0x6A, 0x62,
+	 0xA2, 0xD9, 0x24, 0x60, 0xAA, 0x62, 0x1A, 0x60, 0x66, 0x64, 0xA2, 0xDB, 0x02, 0x64, 0x4A, 0xDB,
+	 0xFF, 0xFF, 0x04, 0xFF, 0x0F, 0x60, 0xEC, 0x62, 0x00, 0x60, 0x06, 0x64, 0xA2, 0xDB, 0xCB, 0x60,
+	 0x22, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x1A, 0x60, 0x40, 0x61, 0x75, 0x60, 0x30, 0x65, 0xA1, 0xD3,
+	 0xFF, 0xFF, 0xFF, 0xA0, 0xE0, 0x84, 0x02, 0x02, 0x03, 0x60, 0xE8, 0x64, 0xD4, 0x80, 0xFF, 0xFF,
+	 0x01, 0x04, 0x65, 0x44, 0xA1, 0xDB, 0x2F, 0x58, 0xFF, 0xFF, 0x79, 0xF3, 0x7A, 0xFB, 0x1F, 0x60,
+	 0x52, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0xFF, 0x60, 0xDF, 0x65, 0x20, 0x44, 0x24, 0x80, 0xBF, 0xF1,
+	 0x1A, 0x60, 0x6A, 0x62, 0xA2, 0xD9, 0x24, 0x60, 0xAA, 0x62, 0x1A, 0x60, 0x66, 0x64, 0xA2, 0xDB,
+	 0x02, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0xF7, 0x60, 0xFF, 0x65, 0x20, 0x44, 0x24, 0x80,
+	 0x10, 0x26, 0x67, 0x00, 0x00, 0x64, 0xB5, 0xFB, 0xB6, 0xFB, 0xB7, 0xFB, 0x00, 0x75, 0x00, 0x72,
+	 0xBD, 0xF1, 0x80, 0xF9, 0x64, 0x44, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x93, 0xE6, 0xF1,
+	 0x86, 0xF9, 0x28, 0x60, 0xD2, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0x01, 0xA8, 0xFF, 0xFF, 0x08, 0x02,
+	 0x01, 0x60, 0xB0, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0x01, 0xA8, 0xFF, 0xFF, 0x01, 0x03, 0x02, 0x64,
+	 0x60, 0x41, 0x2D, 0x60, 0x28, 0x63, 0xBD, 0xD3, 0xA3, 0xD3, 0xFF, 0xB5, 0x65, 0x5C, 0xCD, 0x81,
+	 0x80, 0xBF, 0x0E, 0x03, 0x80, 0xBF, 0xBD, 0xDB, 0x65, 0x44, 0xC8, 0x84, 0xFF, 0xFF, 0x0B, 0x03,
+	 0x60, 0x45, 0xCD, 0x81, 0xA3, 0xD3, 0x07, 0x03, 0xCD, 0x81, 0x80, 0xBF, 0x01, 0x03, 0x80, 0xBC,
+	 0x60, 0x47, 0xBD, 0xDB, 0x00, 0x65, 0x64, 0x41, 0x2D, 0x60, 0x2A, 0x63, 0xBD, 0xD3, 0xFF, 0xFF,
+	 0x80, 0xB0, 0xFF, 0xFF, 0x01, 0x03, 0x60, 0x45, 0x60, 0x47, 0x80, 0xB0, 0xFF, 0xFF, 0x01, 0x03,
+	 0x60, 0x45, 0xC9, 0x81, 0xFF, 0xFF, 0xF2, 0x02, 0x65, 0x44, 0x7F, 0xB4, 0x02, 0x3A, 0x02, 0x00,
+	 0x0A, 0x64, 0x15, 0x00, 0x04, 0x3A, 0x02, 0x00, 0x14, 0x64, 0x11, 0x00, 0x0A, 0x3A, 0x02, 0x00,
+	 0x32, 0x64, 0x0D, 0x00, 0x0B, 0x3A, 0x02, 0x00, 0x37, 0x64, 0x09, 0x00, 0x10, 0x3A, 0x02, 0x00,
+	 0x50, 0x64, 0x05, 0x00, 0x16, 0x3A, 0x02, 0x00, 0x6E, 0x64, 0x01, 0x00, 0x14, 0x64, 0x7C, 0xFB,
+	 0x28, 0x00, 0x0F, 0x60, 0xEA, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x0F, 0x60, 0xEC, 0x62, 0x00, 0x60,
+	 0x84, 0x64, 0xA2, 0xDB, 0xCD, 0x60, 0x40, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x0F, 0x60, 0xEA, 0x62, 0xA2, 0xD1, 0x00, 0x60, 0x80, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x0D, 0x03,
+	 0xA0, 0x84, 0xA2, 0xDB, 0x0F, 0x60, 0xEA, 0x62, 0xA2, 0xD1, 0xFF, 0x60, 0x7F, 0x61, 0xA1, 0x84,
+	 0x5A, 0xD1, 0x4A, 0xDB, 0xA1, 0x84, 0x5A, 0xDB, 0x04, 0x00, 0xBB, 0xFE, 0xCB, 0x60, 0x22, 0x78,
+	 0xFF, 0xFF, 0x28, 0x60, 0x2C, 0x62, 0xA2, 0xD1, 0x00, 0x65, 0x64, 0x40, 0x01, 0x36, 0x22, 0x65,
+	 0x64, 0x40, 0x07, 0x36, 0x01, 0x65, 0xA9, 0xF3, 0x66, 0x5C, 0x60, 0x46, 0x1F, 0x63, 0xE3, 0x83,
+	 0xB6, 0xF8, 0x02, 0xA6, 0x66, 0x44, 0xFC, 0x1F, 0x28, 0x60, 0x2C, 0x62, 0xA2, 0xD3, 0xFF, 0xFF,
+	 0x60, 0x40, 0x07, 0x3A, 0x04, 0x00, 0xA9, 0xF3, 0x04, 0x65, 0x60, 0x46, 0xB6, 0xF8, 0x64, 0x46,
+	 0xA9, 0xF3, 0x32, 0x41, 0x60, 0x45, 0x08, 0xB1, 0x66, 0x41, 0x17, 0x03, 0x65, 0x46, 0x29, 0x60,
+	 0xA2, 0x62, 0xA2, 0xD3, 0x06, 0xF0, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0x80, 0xBF,
+	 0xB0, 0x84, 0x06, 0xFA, 0x66, 0x43, 0x02, 0xA3, 0x63, 0x46, 0x06, 0xF0, 0xFF, 0xFF, 0xB0, 0x84,
+	 0x06, 0xFA, 0x61, 0x46, 0x32, 0x44, 0x10, 0xBC, 0x40, 0x52, 0x1F, 0x60, 0x52, 0x62, 0x01, 0x64,
+	 0xA2, 0xDB, 0x0F, 0x4E, 0xE7, 0x60, 0x58, 0x4F, 0x51, 0x78, 0xFF, 0xFF, 0x0E, 0x4F, 0x0F, 0x60,
+	 0xEA, 0x62, 0xA2, 0xD1, 0xFF, 0x60, 0xFB, 0x64, 0xA0, 0x84, 0xA2, 0xDB, 0x0F, 0x60, 0xEC, 0x62,
+	 0x00, 0x60, 0x04, 0x64, 0xA2, 0xDB, 0xCB, 0x60, 0x11, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x24, 0x60,
+	 0xAA, 0x62, 0x1A, 0x60, 0x66, 0x64, 0xA2, 0xDB, 0x02, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF,
+	 0xBB, 0xFE, 0x20, 0x44, 0x04, 0x27, 0x12, 0x00, 0x10, 0x26, 0x02, 0x00, 0xDB, 0xFE, 0x16, 0x00,
+	 0x0F, 0x60, 0xCE, 0x61, 0xA1, 0xD3, 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x36, 0x07, 0x00, 0x01, 0x64,
+	 0xA1, 0xDB, 0x01, 0x65, 0xE9, 0x60, 0x58, 0x4E, 0x7B, 0x78, 0xFF, 0xFF, 0x0F, 0x60, 0xD0, 0x62,
+	 0xA2, 0xD1, 0x80, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x01, 0x64, 0x8C, 0xFB,
+	 0xFF, 0x60, 0xEF, 0x65, 0x20, 0x44, 0x24, 0x80, 0x03, 0x64, 0xDC, 0xFB, 0xF2, 0xF3, 0xFF, 0xFF,
+	 0xFE, 0xB4, 0xF2, 0xFB, 0xC1, 0xFE, 0x1E, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x15, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0xBB, 0xFE, 0xCF, 0x60, 0xD6, 0x78, 0xFF, 0xFF, 0x28, 0x60,
+	 0x2C, 0x62, 0xA2, 0xD1, 0x00, 0x65, 0x64, 0x40, 0x01, 0x36, 0x22, 0x65, 0xA9, 0xF3, 0x66, 0x5C,
+	 0x60, 0x46, 0x1F, 0x63, 0xE3, 0x83, 0xB6, 0xF8, 0x02, 0xA6, 0x66, 0x44, 0xFC, 0x1F, 0x64, 0x46,
+	 0x79, 0xF1, 0xA9, 0xF3, 0x7A, 0xF9, 0x02, 0xA4, 0xD8, 0xF3, 0x60, 0x45, 0x66, 0x41, 0x65, 0x46,
+	 0x8C, 0xFA, 0x60, 0x40, 0x01, 0x36, 0x06, 0x00, 0x02, 0x36, 0x04, 0x00, 0x04, 0x36, 0x02, 0x00,
+	 0x05, 0x3A, 0x02, 0x00, 0x00, 0x64, 0x01, 0x00, 0x01, 0x64, 0x6F, 0xFA, 0x79, 0xF3, 0x7A, 0xF1,
+	 0xFF, 0xFF, 0xA0, 0x84, 0x65, 0x43, 0x02, 0x02, 0x79, 0xF3, 0xFF, 0xFF, 0x60, 0x41, 0x0F, 0x60,
+	 0xAE, 0x65, 0xD8, 0xF3, 0xFF, 0xFF, 0xE0, 0x84, 0x44, 0xD3, 0x61, 0x45, 0xA4, 0x80, 0xFF, 0xFF,
+	 0x04, 0x02, 0xE8, 0x84, 0xA4, 0x80, 0xFF, 0xFF, 0xFC, 0x03, 0xA4, 0x84, 0x7B, 0xFB, 0x6F, 0xF0,
+	 0x60, 0x47, 0x90, 0x84, 0x6F, 0xFA, 0x60, 0x47, 0x60, 0x45, 0x80, 0x64, 0xE8, 0x84, 0xA4, 0x80,
+	 0xFF, 0xFF, 0xFC, 0x03, 0xA4, 0x84, 0x70, 0xF0, 0x70, 0xFA, 0x00, 0x61, 0xE8, 0x84, 0xFF, 0xFF,
+	 0x02, 0x05, 0xDD, 0x81, 0xFB, 0x01, 0xE1, 0x81, 0x0F, 0x60, 0xA2, 0x65, 0x45, 0xD3, 0x0E, 0xFA,
+	 0x66, 0x43, 0x0C, 0xF4, 0xA9, 0xF1, 0x02, 0x64, 0xC0, 0x85, 0x0C, 0x61, 0x32, 0x40, 0x08, 0x2A,
+	 0x15, 0x00, 0x29, 0x60, 0xA2, 0x62, 0xA2, 0xD3, 0x66, 0x41, 0x65, 0x46, 0x06, 0xF0, 0xE0, 0x84,
+	 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0x80, 0xBF, 0xB0, 0x83, 0x06, 0xFC, 0x66, 0x42, 0xFE, 0xA2,
+	 0x62, 0x46, 0x06, 0xF0, 0xFF, 0xFF, 0xB0, 0x84, 0x06, 0xFA, 0x61, 0x46, 0x1D, 0x64, 0x3B, 0x42,
+	 0x5A, 0xDB, 0x0B, 0x64, 0xDC, 0xFB, 0xF2, 0xF3, 0xFF, 0xFF, 0xFE, 0xB4, 0xF2, 0xFB, 0x01, 0x65,
+	 0xE9, 0x60, 0x58, 0x4E, 0x7B, 0x78, 0xFF, 0xFF, 0xE5, 0xF1, 0x7F, 0xF9, 0x0F, 0x60, 0xEA, 0x62,
+	 0x00, 0x64, 0xA2, 0xDB, 0xDE, 0xFE, 0x0B, 0x04, 0x0F, 0x60, 0xEC, 0x62, 0x40, 0x60, 0x00, 0x64,
+	 0xA2, 0xDB, 0xCE, 0x60, 0x76, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x7F, 0xF1,
+	 0x24, 0x60, 0x9A, 0x62, 0xA2, 0xD9, 0x1E, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x2D, 0xFF, 0x0F, 0x60,
+	 0xEC, 0x62, 0x20, 0x60, 0x00, 0x64, 0xA2, 0xDB, 0xCE, 0x60, 0x9A, 0x64, 0x5A, 0xDB, 0xCF, 0xFE,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60, 0xEA, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x5A, 0xDB, 0xBE, 0xFE,
+	 0x0F, 0x60, 0xD0, 0x62, 0xA2, 0xD1, 0x40, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE,
+	 0x01, 0x64, 0x8C, 0xFB, 0xFF, 0x60, 0xDF, 0x65, 0x20, 0x44, 0x24, 0x80, 0x1E, 0x64, 0x3B, 0x42,
+	 0x5A, 0xDB, 0x2F, 0x58, 0xFF, 0xFF, 0x1C, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0x06, 0x64, 0xDC, 0xFB,
+	 0xF2, 0xF3, 0xFF, 0xFF, 0xFE, 0xB4, 0xF2, 0xFB, 0xE5, 0xF1, 0x7F, 0xF9, 0x0F, 0x60, 0xEA, 0x62,
+	 0x00, 0x64, 0xA2, 0xDB, 0x01, 0x64, 0x8C, 0xFB, 0xFF, 0x60, 0xDF, 0x65, 0x20, 0x44, 0x24, 0x80,
+	 0xA9, 0xF1, 0x66, 0x45, 0x64, 0x46, 0x66, 0x43, 0x02, 0xA3, 0x63, 0x46, 0x02, 0x64, 0x06, 0xFA,
+	 0x04, 0x63, 0x04, 0x61, 0x01, 0x60, 0xCE, 0x64, 0x58, 0xD1, 0x59, 0xD8, 0xFD, 0x1F, 0x65, 0x46,
+	 0x01, 0x65, 0xE9, 0x60, 0x58, 0x4E, 0x7B, 0x78, 0xFF, 0xFF, 0x1E, 0x64, 0x3B, 0x42, 0x5A, 0xDB,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x1F, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0x00, 0x64, 0x68, 0xFB, 0x69, 0xFB,
+	 0xA9, 0xF1, 0x0E, 0x64, 0x66, 0x41, 0x64, 0x42, 0x02, 0xA2, 0x62, 0x46, 0x06, 0xF0, 0xFF, 0x60,
+	 0xFC, 0x64, 0xA0, 0x84, 0x06, 0xFA, 0x61, 0x46, 0xDC, 0xF3, 0xFF, 0xFF, 0x04, 0xA8, 0x0F, 0x60,
+	 0xCE, 0x64, 0x07, 0x03, 0xA0, 0xD1, 0xFF, 0xFF, 0x64, 0x40, 0x01, 0x2A, 0x02, 0x00, 0x00, 0x63,
+	 0xA0, 0xDD, 0x01, 0x64, 0xDC, 0xFB, 0xF2, 0xF3, 0xFF, 0xFF, 0xFE, 0xB4, 0xF2, 0xFB, 0x0F, 0x60,
+	 0xEA, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x0F, 0x60, 0xEC, 0x62, 0x00, 0x60, 0x02, 0x64, 0xA2, 0xDB,
+	 0xCA, 0x60, 0xFB, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60, 0xEA, 0x62,
+	 0xA2, 0xD1, 0x00, 0x60, 0x04, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x28, 0x60, 0x3A, 0x64, 0xA0, 0xD3, 0x00, 0xF4, 0x60, 0x40, 0x01, 0x3A, 0x42, 0x00, 0x18, 0x65,
+	 0x22, 0x61, 0x02, 0x60, 0x00, 0x63, 0xA5, 0xD0, 0xDA, 0x85, 0x80, 0x3A, 0x02, 0x00, 0x00, 0xF4,
+	 0x04, 0x65, 0x64, 0x44, 0x00, 0x7F, 0xCD, 0x81, 0xBD, 0xDB, 0x05, 0x03, 0x64, 0x47, 0x00, 0x7F,
+	 0xCD, 0x81, 0xBD, 0xDB, 0xF0, 0x02, 0x02, 0x60, 0x00, 0x63, 0xBD, 0xD3, 0xBD, 0xD3, 0x01, 0xA8,
+	 0xE0, 0x85, 0x27, 0x02, 0xC7, 0x83, 0xBD, 0xD3, 0xBD, 0xD3, 0x81, 0xA8, 0x0D, 0xA8, 0x21, 0x02,
+	 0x20, 0x02, 0xBD, 0xD3, 0xBD, 0xD3, 0x00, 0xA8, 0x60, 0xA8, 0x1B, 0x02, 0xBD, 0xD3, 0x19, 0x02,
+	 0x1D, 0xA8, 0xA3, 0xD1, 0x16, 0x02, 0xE3, 0xF9, 0x01, 0x60, 0xB8, 0x64, 0x63, 0x41, 0x0A, 0x63,
+	 0x59, 0xD1, 0x58, 0xD9, 0xFD, 0x1F, 0x59, 0xD1, 0x59, 0xD3, 0xFF, 0xFF, 0x60, 0x47, 0x64, 0x5E,
+	 0xD6, 0xFB, 0x59, 0xD1, 0x28, 0x60, 0x36, 0x64, 0xA0, 0xD9, 0x28, 0x60, 0xD6, 0x64, 0xA0, 0xD9,
+	 0x23, 0x00, 0x28, 0x60, 0x40, 0x64, 0xA0, 0xD3, 0xE3, 0xFB, 0x60, 0x40, 0x05, 0x3A, 0x03, 0x00,
+	 0x68, 0x60, 0xBA, 0x61, 0x11, 0x00, 0x04, 0x3A, 0x03, 0x00, 0x68, 0x60, 0xAE, 0x61, 0x0C, 0x00,
+	 0x03, 0x3A, 0x03, 0x00, 0x68, 0x60, 0xA2, 0x61, 0x07, 0x00, 0x02, 0x3A, 0x03, 0x00, 0x68, 0x60,
+	 0x96, 0x61, 0x02, 0x00, 0x68, 0x60, 0x8A, 0x61, 0x3C, 0x60, 0x00, 0x66, 0x01, 0x60, 0xB8, 0x64,
+	 0x0A, 0x63, 0x59, 0xD0, 0x58, 0xD9, 0xFD, 0x1F, 0x01, 0x60, 0xBE, 0x61, 0xE4, 0xF3, 0x00, 0x66,
+	 0x00, 0xA8, 0x04, 0x65, 0x01, 0x03, 0xA1, 0xDB, 0x1F, 0x60, 0x08, 0x63, 0x55, 0xD3, 0xFF, 0xFF,
+	 0x20, 0x7F, 0xBD, 0xDB, 0x59, 0xD3, 0xFF, 0xFF, 0x21, 0x7F, 0xBD, 0xDB, 0x59, 0xD3, 0xFF, 0xFF,
+	 0x22, 0x7F, 0xA3, 0xDB, 0x0F, 0x60, 0xEA, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0xDE, 0xFE, 0x0B, 0x04,
+	 0x0F, 0x60, 0xEC, 0x62, 0x40, 0x60, 0x00, 0x64, 0xA2, 0xDB, 0xCF, 0x60, 0xA2, 0x64, 0x5A, 0xDB,
+	 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x24, 0x60, 0x9A, 0x62, 0x1F, 0x60, 0x06, 0x64, 0xA2, 0xDB,
+	 0x20, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x2D, 0xFF, 0x0F, 0x60, 0xEC, 0x62, 0x20, 0x60, 0x00, 0x64,
+	 0xA2, 0xDB, 0xCF, 0x60, 0xC7, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60,
+	 0xEA, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0xBE, 0xFE, 0x0F, 0x60, 0xD0, 0x62, 0xA2, 0xD1, 0x40, 0x60,
+	 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x2E, 0x58, 0xFF, 0xFF, 0x40, 0x64, 0x3B, 0x42,
+	 0x5A, 0xDB, 0xBC, 0xF1, 0x1A, 0x60, 0x6A, 0x62, 0xA2, 0xD9, 0x60, 0xF5, 0xEB, 0xF1, 0x2F, 0xF8,
+	 0xEC, 0xF1, 0x30, 0xF8, 0xED, 0xF1, 0x31, 0xF8, 0xBC, 0xF1, 0x19, 0xF8, 0xF8, 0x60, 0x80, 0x64,
+	 0x0E, 0xFA, 0x00, 0x64, 0x3E, 0xFA, 0xA9, 0xF1, 0x07, 0xF8, 0x00, 0x60, 0xD0, 0x63, 0x19, 0x60,
+	 0x84, 0x64, 0xA3, 0xDB, 0x44, 0x60, 0x44, 0x64, 0x81, 0xFB, 0x82, 0xFB, 0x83, 0xFB, 0x31, 0x44,
+	 0xF9, 0xB4, 0x40, 0x51, 0x00, 0x60, 0xD0, 0x63, 0x01, 0x60, 0x10, 0x65, 0xA3, 0xD3, 0xA5, 0xD1,
+	 0x04, 0xA4, 0xA3, 0xDB, 0xD0, 0x80, 0xA0, 0xD1, 0x0A, 0x06, 0x41, 0x64, 0x3B, 0x42, 0x5A, 0xDB,
+	 0x0F, 0x60, 0xEA, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0xCC, 0x60, 0x5D, 0x78, 0xFF, 0xFF, 0x44, 0x47,
+	 0x28, 0x60, 0x2C, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0xFF, 0xA4, 0xFF, 0xFF, 0x08, 0x07, 0x0E, 0x61,
+	 0x41, 0xD3, 0x32, 0x40, 0x08, 0x26, 0x03, 0x00, 0x10, 0xB0, 0xFF, 0xFF, 0xD3, 0x02, 0x42, 0x64,
+	 0x3B, 0x42, 0x5A, 0xDB, 0x0F, 0x60, 0xEA, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0xDE, 0xFE, 0x0B, 0x04,
+	 0x0F, 0x60, 0xEC, 0x62, 0x40, 0x60, 0x00, 0x64, 0xA2, 0xDB, 0xD0, 0x60, 0x22, 0x64, 0x5A, 0xDB,
+	 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x27, 0xD1, 0x7F, 0xF9, 0x24, 0x60, 0x9A, 0x62, 0xA2, 0xD9,
+	 0x1E, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x2D, 0xFF, 0x0F, 0x60, 0xEC, 0x62, 0x20, 0x60, 0x00, 0x64,
+	 0xA2, 0xDB, 0xD0, 0x60, 0x47, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60,
+	 0xEA, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0xBE, 0xFE, 0x0F, 0x60, 0xD0, 0x62, 0xA2, 0xD1, 0x40, 0x60,
+	 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x1A, 0x60, 0x6A, 0x62, 0x07, 0x60, 0xD0, 0x64,
+	 0xA2, 0xDB, 0x24, 0x60, 0xAA, 0x62, 0x1A, 0x60, 0x66, 0x64, 0xA2, 0xDB, 0x02, 0x64, 0x4A, 0xDB,
+	 0xFF, 0xFF, 0x04, 0xFF, 0x27, 0x43, 0x06, 0xA3, 0xBD, 0xD3, 0x81, 0xFB, 0xBD, 0xD3, 0x82, 0xFB,
+	 0xA3, 0xD3, 0x83, 0xFB, 0x0F, 0x60, 0xEA, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x0F, 0x60, 0xEC, 0x62,
+	 0x01, 0x60, 0x04, 0x64, 0xA2, 0xDB, 0xD0, 0x60, 0x79, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58,
+	 0xFF, 0xFF, 0xBC, 0xF1, 0x1A, 0x60, 0x6A, 0x62, 0xA2, 0xD9, 0x0F, 0x60, 0xEA, 0x62, 0xA2, 0xD1,
+	 0xFE, 0x60, 0xFF, 0x61, 0xA1, 0x84, 0x5A, 0xD1, 0x4A, 0xDB, 0xA1, 0x84, 0x5A, 0xDB, 0x0F, 0x60,
+	 0xEA, 0x62, 0xA2, 0xD1, 0x00, 0x60, 0x04, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x05, 0x03, 0xA0, 0x84,
+	 0xA2, 0xDB, 0xCF, 0x60, 0xF2, 0x78, 0xFF, 0xFF, 0x00, 0x60, 0x08, 0x65, 0x20, 0x44, 0x34, 0x80,
+	 0x5F, 0xF5, 0xEB, 0xF1, 0x2F, 0xF8, 0xEC, 0xF1, 0x30, 0xF8, 0xED, 0xF1, 0x31, 0xF8, 0xBC, 0xF1,
+	 0x19, 0xF8, 0x80, 0x7E, 0xF8, 0x7F, 0x0E, 0xFA, 0x00, 0x64, 0x3E, 0xFA, 0xA9, 0xF1, 0x07, 0xF8,
+	 0x2B, 0xFA, 0xB0, 0x64, 0x2A, 0xFA, 0x27, 0x43, 0x06, 0xA3, 0xBD, 0xD1, 0x2C, 0xF8, 0x32, 0xF8,
+	 0xBD, 0xD1, 0x2D, 0xF8, 0x33, 0xF8, 0xA3, 0xD1, 0x2E, 0xF8, 0x34, 0xF8, 0x06, 0x63, 0x3F, 0xFC,
+	 0x1F, 0x60, 0x54, 0x61, 0xDC, 0xF3, 0xA1, 0xD3, 0x03, 0xA8, 0xAC, 0x83, 0x0F, 0x02, 0x0E, 0x03,
+	 0x1F, 0x60, 0x56, 0x61, 0xA1, 0xD1, 0x66, 0x45, 0x00, 0xF4, 0x09, 0xFC, 0x01, 0x64, 0x0A, 0xFA,
+	 0x0B, 0xF8, 0x1F, 0x60, 0x54, 0x61, 0x00, 0x64, 0xA1, 0xDB, 0x28, 0x00, 0x28, 0x60, 0x2E, 0x64,
+	 0xA0, 0xD3, 0x66, 0x45, 0x00, 0xF4, 0x60, 0x40, 0x01, 0x36, 0x16, 0x00, 0x02, 0x36, 0xC7, 0x00,
+	 0x03, 0x36, 0x07, 0x00, 0x04, 0x36, 0x10, 0x00, 0x05, 0x36, 0xC1, 0x00, 0x06, 0x36, 0x01, 0x00,
+	 0x0B, 0x00, 0x80, 0x64, 0x09, 0xFA, 0x01, 0x63, 0x0A, 0xFC, 0x00, 0x64, 0x0B, 0xFA, 0x2D, 0x60,
+	 0x54, 0x62, 0x03, 0x64, 0xA2, 0xDB, 0x0A, 0x00, 0x00, 0x64, 0x09, 0xFA, 0x01, 0x63, 0x0A, 0xFC,
+	 0x00, 0x64, 0x0B, 0xFA, 0x2D, 0x60, 0x54, 0x62, 0x01, 0x64, 0xA2, 0xDB, 0x24, 0x60, 0x74, 0x62,
+	 0x24, 0x60, 0x28, 0x64, 0xA2, 0xDB, 0x65, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF,
+	 0x2B, 0xFF, 0x00, 0x66, 0xDC, 0xF3, 0x46, 0x46, 0xFD, 0xA0, 0xC1, 0xFE, 0x02, 0x02, 0x2F, 0x58,
+	 0xFF, 0xFF, 0x01, 0x64, 0x69, 0xFB, 0x43, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0x1A, 0x60, 0x44, 0x62,
+	 0xA2, 0xD3, 0xFF, 0xFF, 0x64, 0xA4, 0xA2, 0xDB, 0x1A, 0x60, 0x44, 0x62, 0xA2, 0xD1, 0x1A, 0x60,
+	 0x6A, 0x62, 0xA2, 0xD9, 0x24, 0x60, 0xAA, 0x62, 0x1A, 0x60, 0x66, 0x64, 0xA2, 0xDB, 0x02, 0x64,
+	 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x0F, 0x60, 0xEC, 0x62, 0x00, 0x60, 0x0C, 0x64, 0xA2, 0xDB,
+	 0xD1, 0x60, 0x2E, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60, 0xEA, 0x62,
+	 0xA2, 0xD1, 0x00, 0x60, 0x08, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x56, 0x03, 0xA0, 0x84, 0xA2, 0xDB,
+	 0x24, 0x60, 0xAA, 0x62, 0x1A, 0x60, 0x66, 0x64, 0xA2, 0xDB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF,
+	 0x04, 0xFF, 0x00, 0x64, 0x69, 0xFB, 0x0F, 0x60, 0xEA, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x26, 0x46,
+	 0x00, 0xF4, 0x09, 0xF2, 0x0A, 0xF2, 0x00, 0xA8, 0x0B, 0xF2, 0x02, 0xA8, 0x16, 0x02, 0x00, 0xA8,
+	 0x1A, 0x02, 0x19, 0x02, 0x26, 0x46, 0x24, 0x60, 0x74, 0x64, 0x40, 0x4B, 0x2C, 0x60, 0x58, 0x4D,
+	 0xD8, 0x78, 0xFF, 0xFF, 0x00, 0x66, 0x46, 0x46, 0x20, 0x40, 0x08, 0x2A, 0x03, 0x00, 0xD3, 0x60,
+	 0x48, 0x78, 0xFF, 0xFF, 0xD9, 0x60, 0x68, 0x78, 0xFF, 0xFF, 0x09, 0xF2, 0x0A, 0xF2, 0x80, 0xA8,
+	 0x0B, 0xF2, 0x02, 0xA8, 0xE4, 0x03, 0x44, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0x0B, 0xF2, 0x26, 0x46,
+	 0x40, 0x59, 0x02, 0x60, 0x00, 0x61, 0x2F, 0xF2, 0xA1, 0xDB, 0x30, 0xF2, 0x41, 0x58, 0x59, 0xDB,
+	 0x31, 0xF2, 0x59, 0xDB, 0x26, 0x46, 0x24, 0x60, 0x74, 0x64, 0x40, 0x4B, 0x2C, 0x60, 0x58, 0x4D,
+	 0xD8, 0x78, 0xFF, 0xFF, 0x00, 0x66, 0x46, 0x46, 0x03, 0x65, 0xE9, 0x60, 0x58, 0x4E, 0x4C, 0x78,
+	 0xFF, 0xFF, 0xDC, 0x60, 0xAA, 0x78, 0xFF, 0xFF, 0xFF, 0x60, 0xFB, 0x64, 0xA0, 0x84, 0xA2, 0xDB,
+	 0x00, 0x64, 0x69, 0xFB, 0x0F, 0x60, 0xEA, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x20, 0x40, 0x08, 0x2A,
+	 0x03, 0x00, 0xCF, 0x60, 0xF2, 0x78, 0xFF, 0xFF, 0xD7, 0x60, 0xDD, 0x78, 0xFF, 0xFF, 0x01, 0x63,
+	 0x09, 0xFC, 0x32, 0x40, 0x08, 0x26, 0x1A, 0x00, 0x28, 0x60, 0x2C, 0x62, 0xA2, 0xD3, 0xFF, 0xFF,
+	 0x60, 0x40, 0x0B, 0x36, 0x03, 0x00, 0xD0, 0x60, 0xEC, 0x78, 0xFF, 0xFF, 0x01, 0x64, 0xA2, 0xDB,
+	 0x2D, 0x60, 0x56, 0x62, 0x0B, 0x64, 0xA2, 0xDB, 0x2D, 0x60, 0x54, 0x62, 0x02, 0x64, 0xA2, 0xDB,
+	 0xA9, 0xF1, 0x66, 0x41, 0x64, 0x46, 0x22, 0x64, 0x36, 0xFA, 0x61, 0x46, 0x01, 0x64, 0x0A, 0xFA,
+	 0x00, 0x64, 0x0B, 0xFA, 0x01, 0x64, 0x69, 0xFB, 0x0F, 0x60, 0xEA, 0x62, 0x00, 0x64, 0xA2, 0xDB,
+	 0x24, 0x60, 0x74, 0x62, 0x24, 0x60, 0x28, 0x64, 0xA2, 0xDB, 0x65, 0x44, 0x5A, 0xDB, 0x02, 0x64,
+	 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0x00, 0x66, 0xDC, 0xF3, 0x46, 0x46, 0xFD, 0xA0, 0xC1, 0xFE,
+	 0x02, 0x02, 0x2F, 0x58, 0xFF, 0xFF, 0x24, 0x60, 0xAA, 0x62, 0x1A, 0x60, 0x66, 0x64, 0xA2, 0xDB,
+	 0x02, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x0F, 0x60, 0xEC, 0x62, 0x00, 0x60, 0x0C, 0x64,
+	 0xA2, 0xDB, 0xD1, 0x60, 0xEF, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60,
+	 0xEA, 0x62, 0xA2, 0xD1, 0x00, 0x60, 0x08, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x3B, 0x03, 0xA0, 0x84,
+	 0xA2, 0xDB, 0x24, 0x60, 0xAA, 0x62, 0x1A, 0x60, 0x66, 0x64, 0xA2, 0xDB, 0x03, 0x64, 0x4A, 0xDB,
+	 0xFF, 0xFF, 0x04, 0xFF, 0x00, 0x64, 0x69, 0xFB, 0x26, 0x46, 0x00, 0xF4, 0x09, 0xF2, 0x0A, 0xF2,
+	 0x01, 0xA8, 0x0B, 0xF2, 0x02, 0xA8, 0x04, 0x02, 0x00, 0xA8, 0x02, 0x02, 0x01, 0x02, 0x31, 0x00,
+	 0xD2, 0x60, 0x58, 0x4D, 0xF6, 0x78, 0xFF, 0xFF, 0x0B, 0xF2, 0x26, 0x46, 0x40, 0x59, 0x02, 0x60,
+	 0x00, 0x61, 0x2F, 0xF2, 0xA1, 0xDB, 0x30, 0xF2, 0x41, 0x58, 0x59, 0xDB, 0x31, 0xF2, 0x59, 0xDB,
+	 0x26, 0x46, 0x24, 0x60, 0x74, 0x64, 0x40, 0x4B, 0x2C, 0x60, 0x58, 0x4D, 0xD8, 0x78, 0xFF, 0xFF,
+	 0x00, 0x66, 0x46, 0x46, 0x03, 0x65, 0xE9, 0x60, 0x58, 0x4E, 0x4C, 0x78, 0xFF, 0xFF, 0xDC, 0x60,
+	 0xAA, 0x78, 0xFF, 0xFF, 0xD2, 0x60, 0x58, 0x4D, 0xF6, 0x78, 0xFF, 0xFF, 0x00, 0x64, 0x69, 0xFB,
+	 0x20, 0x40, 0x08, 0x2A, 0x03, 0x00, 0xCF, 0x60, 0xF2, 0x78, 0xFF, 0xFF, 0xD7, 0x60, 0xDD, 0x78,
+	 0xFF, 0xFF, 0x26, 0x46, 0x40, 0x60, 0x00, 0x65, 0x2A, 0xF2, 0x2F, 0xF0, 0xB4, 0x84, 0x2A, 0xFA,
+	 0x2C, 0xF8, 0x32, 0xF8, 0x30, 0xF2, 0x2D, 0xFA, 0x33, 0xFA, 0x31, 0xF2, 0x2E, 0xFA, 0x34, 0xFA,
+	 0xEB, 0xF3, 0x2F, 0xFA, 0xEC, 0xF3, 0x30, 0xFA, 0xED, 0xF3, 0x31, 0xFA, 0xCC, 0xF1, 0x19, 0xF8,
+	 0x1C, 0xF0, 0x13, 0xF8, 0x00, 0x64, 0x3E, 0xFA, 0x00, 0xF4, 0x03, 0x64, 0x0A, 0xFA, 0x00, 0x64,
+	 0x0B, 0xFA, 0x01, 0x63, 0x69, 0xFD, 0x0F, 0x60, 0xEA, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x24, 0x60,
+	 0x74, 0x62, 0x24, 0x60, 0x28, 0x64, 0xA2, 0xDB, 0x26, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB,
+	 0xFF, 0xFF, 0x2B, 0xFF, 0x00, 0x66, 0xDC, 0xF3, 0x46, 0x46, 0xFD, 0xA0, 0xC1, 0xFE, 0x02, 0x02,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x24, 0x60, 0xAA, 0x62, 0x1A, 0x60, 0x66, 0x64, 0xA2, 0xDB, 0x02, 0x64,
+	 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x0F, 0x60, 0xEC, 0x62, 0x00, 0x60, 0x0C, 0x64, 0xA2, 0xDB,
+	 0xD2, 0x60, 0x8E, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60, 0xEA, 0x62,
+	 0xA2, 0xD1, 0x00, 0x60, 0x08, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x51, 0x03, 0xA0, 0x84, 0xA2, 0xDB,
+	 0x24, 0x60, 0xAA, 0x62, 0x1A, 0x60, 0x66, 0x64, 0xA2, 0xDB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF,
+	 0x04, 0xFF, 0x00, 0x64, 0x69, 0xFB, 0x26, 0x46, 0x00, 0xF4, 0x09, 0xF2, 0x0A, 0xF2, 0x01, 0xA8,
+	 0x0B, 0xF2, 0x04, 0xA8, 0x1A, 0x02, 0x00, 0xA8, 0x18, 0x02, 0x17, 0x02, 0xD2, 0x60, 0x58, 0x4D,
+	 0xF6, 0x78, 0xFF, 0xFF, 0x26, 0x46, 0x24, 0x60, 0x74, 0x64, 0x40, 0x4B, 0x2C, 0x60, 0x58, 0x4D,
+	 0xD8, 0x78, 0xFF, 0xFF, 0x00, 0x66, 0x46, 0x46, 0x20, 0x40, 0x08, 0x2A, 0x03, 0x00, 0xD3, 0x60,
+	 0x48, 0x78, 0xFF, 0xFF, 0xD9, 0x60, 0x68, 0x78, 0xFF, 0xFF, 0xD2, 0x60, 0x58, 0x4D, 0xF6, 0x78,
+	 0xFF, 0xFF, 0x0B, 0xF2, 0x26, 0x46, 0x40, 0x59, 0x02, 0x60, 0x00, 0x61, 0x2F, 0xF2, 0xA1, 0xDB,
+	 0x30, 0xF2, 0x41, 0x58, 0x59, 0xDB, 0x31, 0xF2, 0x59, 0xDB, 0x26, 0x46, 0x24, 0x60, 0x74, 0x64,
+	 0x40, 0x4B, 0x2C, 0x60, 0x58, 0x4D, 0xD8, 0x78, 0xFF, 0xFF, 0x00, 0x66, 0x46, 0x46, 0x03, 0x65,
+	 0xE9, 0x60, 0x58, 0x4E, 0x4C, 0x78, 0xFF, 0xFF, 0xDC, 0x60, 0xAA, 0x78, 0xFF, 0xFF, 0xD2, 0x60,
+	 0x58, 0x4D, 0xF6, 0x78, 0xFF, 0xFF, 0x00, 0x64, 0x69, 0xFB, 0x20, 0x40, 0x08, 0x2A, 0x03, 0x00,
+	 0xCF, 0x60, 0xF2, 0x78, 0xFF, 0xFF, 0xD7, 0x60, 0xDD, 0x78, 0xFF, 0xFF, 0x2D, 0x60, 0x56, 0x62,
+	 0xA2, 0xD3, 0xFF, 0xFF, 0x60, 0x40, 0x0B, 0x3A, 0x07, 0x00, 0x28, 0x60, 0x2C, 0x62, 0x0B, 0x64,
+	 0xA2, 0xDB, 0x2D, 0x60, 0x56, 0x62, 0xA2, 0xDF, 0x2D, 0x58, 0xFF, 0xFF, 0x28, 0x60, 0x2C, 0x62,
+	 0xA2, 0xD3, 0x61, 0x43, 0xA5, 0xD2, 0x60, 0x40, 0x0B, 0x2A, 0x30, 0x00, 0x85, 0x3A, 0x30, 0x00,
+	 0x60, 0x41, 0x65, 0x44, 0x0A, 0xA4, 0xA0, 0xD0, 0x2D, 0x60, 0x52, 0x62, 0x64, 0x40, 0x18, 0x26,
+	 0x06, 0x00, 0xA2, 0xDF, 0x28, 0x60, 0x2C, 0x62, 0x01, 0x64, 0xA2, 0xDB, 0x02, 0x00, 0x01, 0x64,
+	 0xA2, 0xDB, 0x61, 0x44, 0x60, 0x47, 0xFF, 0xB4, 0x02, 0xA4, 0x2E, 0x60, 0x62, 0x61, 0xA1, 0xD1,
+	 0xDF, 0x83, 0xC0, 0x84, 0xA1, 0xDB, 0xD0, 0x81, 0xCD, 0x84, 0x4C, 0x91, 0x60, 0x43, 0x60, 0xFE,
+	 0xA5, 0xD2, 0xDE, 0x85, 0x7F, 0x26, 0x02, 0x00, 0x00, 0xF4, 0x04, 0x65, 0x5D, 0x93, 0xA3, 0xDB,
+	 0x5D, 0x93, 0xA5, 0xD2, 0xF6, 0x1F, 0x5D, 0x93, 0x20, 0xFE, 0xDF, 0x83, 0x2D, 0x58, 0xFF, 0xFF,
+	 0x2D, 0x60, 0x52, 0x62, 0xA2, 0xDF, 0x28, 0x60, 0x2C, 0x62, 0x01, 0x64, 0xA2, 0xDB, 0xF6, 0x01,
+	 0x45, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0x2E, 0x60, 0xEA, 0x7C, 0x2E, 0x60, 0xDE, 0x63, 0xA3, 0xD9,
+	 0x64, 0x41, 0x29, 0x60, 0xA4, 0x63, 0xBD, 0xD3, 0x00, 0x7C, 0x03, 0x1B, 0x27, 0x43, 0x10, 0xA3,
+	 0xBD, 0xD3, 0xFF, 0xFF, 0x60, 0x45, 0x64, 0x5F, 0xA1, 0xDB, 0x65, 0x44, 0xBD, 0xD1, 0xC8, 0x84,
+	 0x59, 0xD8, 0xFC, 0x05, 0x27, 0x41, 0x10, 0xA1, 0xA1, 0xD1, 0xFF, 0xFF, 0xC1, 0x81, 0x01, 0x26,
+	 0xDD, 0x81, 0x41, 0x4C, 0x59, 0xD1, 0x7C, 0x44, 0xB0, 0x84, 0x59, 0xD1, 0x59, 0xD1, 0xB0, 0x84,
+	 0xB0, 0x84, 0xFF, 0xFF, 0x02, 0x02, 0x67, 0x44, 0x5D, 0x00, 0x2D, 0x60, 0xE6, 0x63, 0xDD, 0x60,
+	 0x18, 0x64, 0xBD, 0xDA, 0x50, 0x60, 0x00, 0x64, 0xBD, 0xDA, 0x01, 0x60, 0xF2, 0x64, 0xBD, 0xDA,
+	 0x00, 0x60, 0x01, 0x64, 0xBD, 0xDA, 0x2C, 0x41, 0x59, 0xD3, 0x50, 0x60, 0x00, 0x7C, 0x60, 0x40,
+	 0x02, 0x2A, 0x03, 0x00, 0x01, 0x60, 0xF2, 0x64, 0x0E, 0x00, 0x04, 0x2A, 0x03, 0x00, 0x02, 0x60,
+	 0xF2, 0x64, 0x09, 0x00, 0x10, 0x2A, 0x03, 0x00, 0x04, 0x60, 0xF2, 0x64, 0x04, 0x00, 0x20, 0x2A,
+	 0x04, 0x00, 0x05, 0x60, 0xF2, 0x64, 0xBD, 0xD9, 0xBD, 0xDB, 0x01, 0x64, 0xBD, 0xDB, 0x59, 0xD3,
+	 0x50, 0x60, 0x00, 0x7C, 0x60, 0x40, 0x02, 0x2A, 0x03, 0x00, 0x01, 0x60, 0xF2, 0x64, 0x0E, 0x00,
+	 0x04, 0x2A, 0x03, 0x00, 0x02, 0x60, 0xF2, 0x64, 0x09, 0x00, 0x10, 0x2A, 0x03, 0x00, 0x04, 0x60,
+	 0xF2, 0x64, 0x04, 0x00, 0x20, 0x2A, 0x04, 0x00, 0x05, 0x60, 0xF2, 0x64, 0xBD, 0xD9, 0xBD, 0xDB,
+	 0x01, 0x64, 0xBD, 0xDB, 0x59, 0xD3, 0x50, 0x60, 0x00, 0x7C, 0x60, 0x40, 0x01, 0x2A, 0x03, 0x00,
+	 0x00, 0x60, 0xF2, 0x64, 0x09, 0x00, 0x02, 0x2A, 0x03, 0x00, 0x01, 0x60, 0xF2, 0x64, 0x04, 0x00,
+	 0x04, 0x2A, 0x02, 0x00, 0x02, 0x60, 0xF2, 0x64, 0xBD, 0xD9, 0xBD, 0xDB, 0x59, 0xD3, 0xBD, 0xDA,
+	 0x2D, 0x60, 0xE6, 0x64, 0x2E, 0x60, 0xE4, 0x62, 0xA2, 0xDB, 0x60, 0xF5, 0x00, 0x64, 0x2B, 0xFA,
+	 0x00, 0x64, 0x2A, 0xFA, 0x27, 0x43, 0x06, 0xA3, 0xBD, 0xD1, 0x2C, 0xF8, 0x32, 0xF8, 0xBD, 0xD1,
+	 0x2D, 0xF8, 0x33, 0xF8, 0xA3, 0xD1, 0x2E, 0xF8, 0x34, 0xF8, 0x00, 0xF4, 0x01, 0x63, 0x32, 0x40,
+	 0x08, 0x26, 0x10, 0xBB, 0x28, 0x60, 0x2C, 0x62, 0xA2, 0xD1, 0xFF, 0xFF, 0x64, 0x40, 0xFE, 0x26,
+	 0x10, 0xBB, 0x09, 0xFC, 0x27, 0x42, 0x0C, 0xA2, 0x28, 0x60, 0x02, 0x63, 0xA2, 0xD3, 0xA3, 0xD3,
+	 0x00, 0xBD, 0x01, 0x63, 0xAC, 0x81, 0x09, 0x03, 0x08, 0x03, 0xB0, 0x60, 0x58, 0x4D, 0xB6, 0x78,
+	 0xFF, 0xFF, 0x00, 0xB8, 0x01, 0x63, 0x01, 0x03, 0x60, 0x43, 0x1A, 0x60, 0x3E, 0x64, 0xA0, 0xDD,
+	 0x12, 0x61, 0x59, 0xDC, 0x28, 0x60, 0x2C, 0x62, 0xA2, 0xD3, 0xFF, 0x60, 0xFF, 0x7C, 0x60, 0x40,
+	 0x0B, 0x2A, 0x02, 0x00, 0x2D, 0x60, 0x32, 0x7C, 0x2E, 0x60, 0xE6, 0x62, 0xA2, 0xD9, 0x2E, 0x60,
+	 0xDE, 0x64, 0x40, 0x48, 0xD9, 0x81, 0xFF, 0x60, 0xF2, 0x64, 0xE8, 0x60, 0x58, 0x4D, 0xE8, 0x78,
+	 0xFF, 0xFF, 0x60, 0xF5, 0x3F, 0xFC, 0xDB, 0x83, 0x2E, 0x60, 0x08, 0x62, 0xA2, 0xDD, 0x00, 0x7C,
+	 0x5A, 0xD9, 0x63, 0x41, 0x2E, 0x60, 0x0C, 0x63, 0x12, 0x65, 0x00, 0xF4, 0xCD, 0x84, 0x4C, 0x91,
+	 0x60, 0x43, 0x60, 0xFE, 0xA5, 0xD2, 0xDE, 0x85, 0x7F, 0x26, 0x02, 0x00, 0x00, 0xF4, 0x04, 0x65,
+	 0x5D, 0x93, 0xA3, 0xDB, 0x5D, 0x93, 0xA5, 0xD2, 0xF6, 0x1F, 0x5D, 0x93, 0x20, 0xFE, 0xDF, 0x83,
+	 0x60, 0xF5, 0x24, 0x60, 0x74, 0x62, 0x24, 0x60, 0x28, 0x64, 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB,
+	 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0x00, 0x66, 0x46, 0x46, 0xC1, 0xFE, 0x06, 0x64,
+	 0x69, 0xFB, 0x46, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0x24, 0x60, 0xAA, 0x62, 0x1A, 0x60, 0x66, 0x64,
+	 0xA2, 0xDB, 0x02, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x0F, 0x60, 0xEC, 0x62, 0x00, 0x60,
+	 0x1C, 0x64, 0xA2, 0xDB, 0xD4, 0x60, 0x68, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x0F, 0x60, 0xEA, 0x62, 0xA2, 0xD1, 0x00, 0x60, 0x08, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x3A, 0x03,
+	 0xA0, 0x84, 0xA2, 0xDB, 0x24, 0x60, 0xAA, 0x62, 0x1A, 0x60, 0x66, 0x64, 0xA2, 0xDB, 0x03, 0x64,
+	 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x0F, 0x60, 0xEA, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x26, 0x46,
+	 0x00, 0xF4, 0x0A, 0xF2, 0x00, 0x63, 0x00, 0xA8, 0x69, 0xFD, 0x5A, 0x03, 0x0A, 0xF2, 0x26, 0x46,
+	 0x40, 0x59, 0x02, 0x60, 0x00, 0x61, 0x2F, 0xF2, 0xA1, 0xDB, 0x30, 0xF2, 0x41, 0x58, 0x59, 0xDB,
+	 0x31, 0xF2, 0x59, 0xDB, 0x26, 0x46, 0x24, 0x60, 0x74, 0x64, 0x40, 0x4B, 0x2C, 0x60, 0x58, 0x4D,
+	 0xD8, 0x78, 0xFF, 0xFF, 0x00, 0x66, 0x46, 0x46, 0x05, 0x65, 0xE9, 0x60, 0x58, 0x4E, 0x4C, 0x78,
+	 0xFF, 0xFF, 0xDC, 0x60, 0xAA, 0x78, 0xFF, 0xFF, 0x47, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0xCF, 0x60,
+	 0xF2, 0x78, 0xFF, 0xFF, 0x00, 0x60, 0x10, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x21, 0x03, 0xA0, 0x84,
+	 0xA2, 0xDB, 0x24, 0x60, 0xAA, 0x62, 0x1A, 0x60, 0x66, 0x64, 0xA2, 0xDB, 0x03, 0x64, 0x4A, 0xDB,
+	 0xFF, 0xFF, 0x04, 0xFF, 0x26, 0x46, 0x24, 0x60, 0x74, 0x64, 0x40, 0x4B, 0x2C, 0x60, 0x58, 0x4D,
+	 0xD8, 0x78, 0xFF, 0xFF, 0x00, 0x66, 0x46, 0x46, 0x00, 0x64, 0x69, 0xFB, 0x0F, 0x60, 0xEA, 0x62,
+	 0x00, 0x64, 0xA2, 0xDB, 0x49, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0xD0, 0x60, 0x94, 0x78, 0xFF, 0xFF,
+	 0xFF, 0x60, 0xFB, 0x64, 0xA0, 0x84, 0xA2, 0xDB, 0x00, 0x64, 0x69, 0xFB, 0x0F, 0x60, 0xEA, 0x62,
+	 0x00, 0x64, 0xA2, 0xDB, 0x4A, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0xCF, 0x60, 0xF2, 0x78, 0xFF, 0xFF,
+	 0x48, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0x09, 0xF0, 0x2E, 0x60, 0x64, 0x63, 0x10, 0x64, 0xBD, 0xDB,
+	 0xBD, 0xD9, 0x0A, 0xF0, 0xBD, 0xD9, 0x0B, 0xF0, 0xBD, 0xD9, 0x0C, 0xF2, 0xBD, 0xDB, 0x60, 0x47,
+	 0xFF, 0xB4, 0x0A, 0xA5, 0x2E, 0x60, 0x62, 0x61, 0x65, 0x5C, 0xA1, 0xD9, 0x60, 0x41, 0x1A, 0x65,
+	 0xCD, 0x84, 0x4C, 0x91, 0x60, 0x43, 0x60, 0xFE, 0xA5, 0xD2, 0xDE, 0x85, 0x7F, 0x26, 0x02, 0x00,
+	 0x00, 0xF4, 0x04, 0x65, 0x5D, 0x93, 0xA3, 0xDB, 0x5D, 0x93, 0xA5, 0xD2, 0xF6, 0x1F, 0x5D, 0x93,
+	 0x20, 0xFE, 0xDF, 0x83, 0xD3, 0x60, 0x58, 0x4D, 0x06, 0x78, 0xFF, 0xFF, 0x0B, 0xF2, 0xFF, 0xFF,
+	 0x07, 0xB4, 0x01, 0x61, 0x03, 0x03, 0xCC, 0x84, 0xE1, 0x81, 0xFD, 0x02, 0x61, 0x44, 0x96, 0xFB,
+	 0x27, 0x45, 0x02, 0x62, 0x46, 0xD3, 0x5A, 0xD1, 0x60, 0x47, 0x56, 0xFB, 0x64, 0x47, 0x55, 0xFB,
+	 0x00, 0x64, 0x5C, 0xFB, 0x0C, 0x62, 0x46, 0xD3, 0x80, 0xFB, 0x0B, 0xF0, 0x0F, 0x60, 0xFF, 0x64,
+	 0xA0, 0x84, 0x85, 0xFB, 0x26, 0x46, 0x32, 0xF0, 0x81, 0xF9, 0x33, 0xF0, 0x0E, 0x63, 0xC7, 0x81,
+	 0x82, 0xF9, 0x34, 0xF0, 0x83, 0xF9, 0x59, 0xD1, 0xFF, 0xFF, 0x64, 0x44, 0x01, 0x2A, 0xC8, 0x84,
+	 0x60, 0x43, 0x2D, 0x60, 0x78, 0x64, 0x58, 0xD9, 0x59, 0xD1, 0x58, 0xD9, 0xFD, 0x1F, 0x28, 0x60,
+	 0x2C, 0x62, 0xA2, 0xD1, 0x59, 0xD3, 0x64, 0x40, 0x01, 0x36, 0x22, 0x64, 0x64, 0x40, 0x00, 0x36,
+	 0x50, 0x94, 0xA9, 0xF1, 0xFF, 0xFF, 0x44, 0x47, 0xA7, 0x46, 0x36, 0xFA, 0xB7, 0xFC, 0xA7, 0x46,
+	 0x1A, 0x60, 0x3E, 0x62, 0xA2, 0xD3, 0x87, 0xFB, 0x31, 0xF2, 0x1C, 0x60, 0xBA, 0x65, 0x60, 0x47,
+	 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD3, 0x66, 0x41, 0x60, 0x46, 0x60, 0x43, 0x05, 0xF2, 0x16, 0x18,
+	 0x61, 0x46, 0x31, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x04, 0xF2, 0x0C, 0x02, 0x61, 0x46, 0x30, 0xF0,
+	 0x63, 0x46, 0xD0, 0x80, 0x03, 0xF2, 0x06, 0x02, 0x61, 0x46, 0x2F, 0xF0, 0x63, 0x46, 0xD0, 0x80,
+	 0xFF, 0xFF, 0x07, 0x03, 0x80, 0xF4, 0xFF, 0xFF, 0x63, 0x46, 0xE8, 0x1B, 0xA9, 0xF3, 0x08, 0xFE,
+	 0x60, 0x43, 0x61, 0x46, 0xA9, 0xF1, 0xFF, 0xFF, 0xD3, 0x80, 0x31, 0xF2, 0x27, 0x02, 0x66, 0x41,
+	 0x1C, 0x60, 0xBA, 0x65, 0x60, 0x47, 0x00, 0x7F, 0xA9, 0xF1, 0xE0, 0x84, 0x44, 0xD3, 0x64, 0x43,
+	 0x11, 0x18, 0x60, 0x46, 0x00, 0xF2, 0xFF, 0xFF, 0xFC, 0x1B, 0x66, 0x44, 0x64, 0x46, 0x80, 0xF0,
+	 0x60, 0x46, 0x80, 0xF8, 0x65, 0x46, 0x65, 0x43, 0x80, 0xF0, 0x01, 0xFA, 0x80, 0xFC, 0x64, 0x46,
+	 0x80, 0xF8, 0x0B, 0x00, 0x64, 0x46, 0x62, 0x43, 0x00, 0xF2, 0xA3, 0xDB, 0x60, 0x46, 0x80, 0xF0,
+	 0x81, 0xFC, 0x80, 0xFC, 0x64, 0x46, 0x80, 0xF8, 0x60, 0x43, 0x61, 0x46, 0x43, 0x47, 0x00, 0xF4,
+	 0x18, 0x65, 0x0C, 0x61, 0x02, 0x60, 0x00, 0x63, 0xA5, 0xD0, 0xDA, 0x85, 0x64, 0x44, 0x00, 0x7F,
+	 0xCD, 0x81, 0xBD, 0xDB, 0x05, 0x03, 0x64, 0x47, 0x00, 0x7F, 0xCD, 0x81, 0xBD, 0xDB, 0xF4, 0x02,
+	 0x02, 0x60, 0x02, 0x61, 0xA1, 0xD3, 0x00, 0x65, 0x60, 0x43, 0x59, 0xD3, 0xFF, 0xFF, 0x7F, 0xB4,
+	 0x02, 0x3A, 0x02, 0x00, 0x01, 0x64, 0x15, 0x00, 0x04, 0x3A, 0x02, 0x00, 0x02, 0x64, 0x11, 0x00,
+	 0x0A, 0x3A, 0x02, 0x00, 0x04, 0x64, 0x0D, 0x00, 0x0B, 0x3A, 0x02, 0x00, 0x08, 0x64, 0x09, 0x00,
+	 0x10, 0x3A, 0x02, 0x00, 0x10, 0x64, 0x05, 0x00, 0x16, 0x3A, 0x02, 0x00, 0x20, 0x64, 0x01, 0x00,
+	 0x00, 0x64, 0xCF, 0x83, 0xB4, 0x85, 0xE1, 0x02, 0x65, 0x44, 0x7A, 0xFB, 0x02, 0x60, 0x02, 0x61,
+	 0xA1, 0xD3, 0x00, 0x65, 0x60, 0x43, 0x59, 0xD3, 0xFF, 0xFF, 0x80, 0xB0, 0xFF, 0xFF, 0x01, 0x03,
+	 0x60, 0x45, 0xCF, 0x83, 0x65, 0x44, 0xF7, 0x02, 0x7F, 0xB4, 0x02, 0x3A, 0x02, 0x00, 0x0A, 0x64,
+	 0x15, 0x00, 0x04, 0x3A, 0x02, 0x00, 0x14, 0x64, 0x11, 0x00, 0x0A, 0x3A, 0x02, 0x00, 0x32, 0x64,
+	 0x0D, 0x00, 0x0B, 0x3A, 0x02, 0x00, 0x37, 0x64, 0x09, 0x00, 0x10, 0x3A, 0x02, 0x00, 0x50, 0x64,
+	 0x05, 0x00, 0x16, 0x3A, 0x02, 0x00, 0x6E, 0x64, 0x01, 0x00, 0x14, 0x64, 0x7C, 0xFB, 0x27, 0x44,
+	 0xD8, 0xF3, 0x60, 0x45, 0x66, 0x41, 0x65, 0x46, 0x8C, 0xFA, 0x60, 0x40, 0x01, 0x36, 0x06, 0x00,
+	 0x02, 0x36, 0x04, 0x00, 0x04, 0x36, 0x02, 0x00, 0x05, 0x3A, 0x02, 0x00, 0x00, 0x64, 0x01, 0x00,
+	 0x01, 0x64, 0x6F, 0xFA, 0x79, 0xF3, 0x7A, 0xF1, 0xFF, 0xFF, 0xA0, 0x84, 0x65, 0x43, 0x02, 0x02,
+	 0x79, 0xF3, 0xFF, 0xFF, 0x60, 0x41, 0x0F, 0x60, 0xAE, 0x65, 0xD8, 0xF3, 0xFF, 0xFF, 0xE0, 0x84,
+	 0x44, 0xD3, 0x61, 0x45, 0xA4, 0x80, 0xFF, 0xFF, 0x04, 0x02, 0xE8, 0x84, 0xA4, 0x80, 0xFF, 0xFF,
+	 0xFC, 0x03, 0xA4, 0x84, 0x7B, 0xFB, 0x6F, 0xF0, 0x60, 0x47, 0x90, 0x84, 0x6F, 0xFA, 0x60, 0x47,
+	 0x60, 0x45, 0x80, 0x64, 0xE8, 0x84, 0xA4, 0x80, 0xFF, 0xFF, 0xFC, 0x03, 0xA4, 0x84, 0x70, 0xF0,
+	 0x70, 0xFA, 0x00, 0x61, 0xE8, 0x84, 0xFF, 0xFF, 0x02, 0x05, 0xDD, 0x81, 0xFB, 0x01, 0xE1, 0x81,
+	 0x0F, 0x60, 0xA2, 0x65, 0x45, 0xD3, 0x0E, 0xFA, 0x66, 0x43, 0x0C, 0xF4, 0x2D, 0x60, 0xD2, 0x62,
+	 0xA2, 0xD3, 0x2D, 0x60, 0xD0, 0x62, 0xA2, 0xD1, 0x60, 0x47, 0x28, 0x60, 0x2C, 0x62, 0xA2, 0xD1,
+	 0xB0, 0x84, 0x64, 0x40, 0x01, 0x36, 0x22, 0x64, 0x64, 0x40, 0x00, 0x36, 0x50, 0x94, 0xA7, 0x46,
+	 0x36, 0xFA, 0xB7, 0xFC, 0xA7, 0x46, 0x80, 0x60, 0x03, 0x65, 0x32, 0x40, 0x08, 0x2A, 0x03, 0x65,
+	 0xA7, 0x46, 0x06, 0xF0, 0x7F, 0x60, 0xFF, 0x64, 0xA0, 0x84, 0xB4, 0x84, 0x06, 0xFA, 0xB7, 0xFC,
+	 0xA7, 0x46, 0x26, 0x46, 0x2F, 0xF0, 0x30, 0xF0, 0x64, 0x43, 0x31, 0xF2, 0x27, 0x46, 0x03, 0xFC,
+	 0x04, 0xF8, 0x05, 0xFA, 0x26, 0x46, 0xCF, 0x60, 0x58, 0x4E, 0x20, 0x78, 0xFF, 0xFF, 0x26, 0x46,
+	 0x24, 0x60, 0x74, 0x64, 0x40, 0x4B, 0x2C, 0x60, 0x58, 0x4D, 0xD8, 0x78, 0xFF, 0xFF, 0x00, 0x66,
+	 0x46, 0x46, 0x01, 0x64, 0x8C, 0xFB, 0x28, 0x60, 0x38, 0x62, 0xA2, 0xD3, 0x20, 0x41, 0x00, 0xBC,
+	 0x20, 0xB9, 0x01, 0x03, 0x41, 0x40, 0x1F, 0x60, 0x52, 0x61, 0x00, 0x64, 0xA1, 0xDB, 0x04, 0x64,
+	 0xC1, 0xFE, 0xDC, 0xFB, 0xF2, 0xF3, 0xFF, 0xFF, 0xFE, 0xB4, 0xF2, 0xFB, 0xF7, 0x60, 0xFF, 0x65,
+	 0x20, 0x44, 0x24, 0x80, 0x0F, 0x60, 0xD0, 0x62, 0xA2, 0xD1, 0x80, 0x60, 0x00, 0x64, 0xB0, 0x84,
+	 0xA2, 0xDB, 0xCF, 0xFE, 0x01, 0x65, 0xE9, 0x60, 0x58, 0x4E, 0x7B, 0x78, 0xFF, 0xFF, 0x0F, 0x60,
+	 0xD8, 0x62, 0xA2, 0xD1, 0x00, 0x60, 0x02, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x0C, 0x64,
+	 0x69, 0xFB, 0x0F, 0x60, 0xEC, 0x62, 0x00, 0x60, 0x31, 0x64, 0xA2, 0xDB, 0xD6, 0x60, 0xC4, 0x64,
+	 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x10, 0x60, 0x0E, 0x62, 0x00, 0x64, 0xA2, 0xDB,
+	 0x5A, 0xDB, 0x0F, 0x60, 0xEA, 0x62, 0xA2, 0xD1, 0x00, 0x60, 0x01, 0x64, 0xA0, 0x80, 0x9C, 0x84,
+	 0x10, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x31, 0x60, 0x2C, 0x61, 0xA1, 0xD3, 0xFF, 0xFF, 0x03, 0x1B,
+	 0xDC, 0x60, 0xD0, 0x78, 0xFF, 0xFF, 0xDC, 0x60, 0xD0, 0x78, 0xFF, 0xFF, 0xD7, 0x60, 0x67, 0x78,
+	 0xFF, 0xFF, 0x00, 0x60, 0x10, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0xF8, 0x03, 0xA0, 0x84, 0xA2, 0xDB,
+	 0xA9, 0xF3, 0xFF, 0xFF, 0x02, 0xA4, 0x60, 0x43, 0x66, 0x41, 0x63, 0x46, 0x05, 0xF2, 0x00, 0xF0,
+	 0x81, 0xF0, 0x02, 0x18, 0x64, 0x46, 0x81, 0xF8, 0x07, 0x1B, 0x1C, 0x60, 0xBA, 0x65, 0x60, 0x47,
+	 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD9, 0x02, 0x00, 0x65, 0x46, 0x00, 0xF8, 0xA9, 0xF3, 0x63, 0x45,
+	 0x60, 0x46, 0x00, 0xF2, 0xFF, 0xFF, 0xD4, 0x80, 0x01, 0x18, 0xFA, 0x04, 0x80, 0xF8, 0x65, 0x46,
+	 0x00, 0xFA, 0x06, 0xF2, 0xFF, 0xFF, 0x00, 0x7E, 0x06, 0xFA, 0x61, 0x46, 0x4B, 0x64, 0x3B, 0x42,
+	 0x5A, 0xDB, 0x0F, 0x60, 0xEA, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x01, 0x60, 0x2E, 0x62, 0xA2, 0xD3,
+	 0xFF, 0xFF, 0x10, 0xB0, 0xFF, 0xFF, 0x13, 0x03, 0x0F, 0x60, 0xEC, 0x62, 0x04, 0x60, 0x00, 0x64,
+	 0xA2, 0xDB, 0xD7, 0x60, 0x2F, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x0F, 0x60, 0xF6, 0x62, 0xA2, 0xD1,
+	 0x01, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x6A, 0xF3,
+	 0xFF, 0xFF, 0x01, 0xB0, 0xFF, 0xFF, 0x13, 0x03, 0x0F, 0x60, 0xD8, 0x62, 0xA2, 0xD1, 0x00, 0x60,
+	 0x04, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x0F, 0x60, 0xEC, 0x62, 0x02, 0x60, 0x00, 0x64,
+	 0xA2, 0xDB, 0xD7, 0x60, 0x47, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60,
+	 0xEA, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x00, 0x64, 0x69, 0xFB, 0xD7, 0x60, 0x58, 0x4E, 0x77, 0x78,
+	 0xFF, 0xFF, 0x02, 0x64, 0x8C, 0xFB, 0x02, 0x64, 0xC1, 0xFE, 0xDC, 0xFB, 0xF2, 0xF3, 0xFF, 0xFF,
+	 0x01, 0xBC, 0xF2, 0xFB, 0x02, 0x65, 0xE9, 0x60, 0x58, 0x4E, 0x7B, 0x78, 0xFF, 0xFF, 0x03, 0x60,
+	 0xE8, 0x63, 0x1A, 0x60, 0x40, 0x64, 0xA0, 0xDD, 0xCB, 0x60, 0x1A, 0x78, 0xFF, 0xFF, 0x00, 0x60,
+	 0x20, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0xFF, 0xFF, 0x08, 0x24, 0x54, 0x01, 0xA0, 0x84, 0xA2, 0xDB,
+	 0x00, 0x63, 0x69, 0xFD, 0x0F, 0x60, 0xEA, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x15, 0x00, 0x24, 0x60,
+	 0xAA, 0x62, 0x1A, 0x60, 0x66, 0x64, 0xA2, 0xDB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF,
+	 0x00, 0x64, 0x69, 0xFB, 0x0F, 0x60, 0xEA, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x01, 0x64, 0x8C, 0xFB,
+	 0xFF, 0xFF, 0xC1, 0xFE, 0x2E, 0x58, 0xFF, 0xFF, 0x50, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0x0F, 0x60,
+	 0xEA, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x01, 0x60, 0x2E, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0x10, 0xB0,
+	 0xFF, 0xFF, 0x13, 0x03, 0x0F, 0x60, 0xF6, 0x62, 0xA2, 0xD1, 0x01, 0x60, 0x00, 0x64, 0xB0, 0x84,
+	 0xA2, 0xDB, 0xCF, 0xFE, 0x0F, 0x60, 0xEC, 0x62, 0x04, 0x60, 0x00, 0x64, 0xA2, 0xDB, 0xD7, 0x60,
+	 0x8F, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0xBC, 0xF1, 0x1A, 0x60, 0x6A, 0x62,
+	 0xA2, 0xD9, 0x7F, 0xF1, 0x7E, 0xF9, 0x02, 0x64, 0x8C, 0xFB, 0xFF, 0xFF, 0xC1, 0xFE, 0x8C, 0xF3,
+	 0x00, 0x65, 0xD4, 0x80, 0xFF, 0xFF, 0x0F, 0x03, 0x0F, 0x60, 0xEA, 0x62, 0x00, 0x64, 0xA2, 0xDB,
+	 0x0F, 0x60, 0xEC, 0x62, 0x80, 0x60, 0x00, 0x64, 0xA2, 0xDB, 0xD7, 0x60, 0xB3, 0x64, 0x5A, 0xDB,
+	 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60, 0xEA, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x51, 0x64,
+	 0x3B, 0x42, 0x5A, 0xDB, 0x19, 0x60, 0x84, 0x64, 0x68, 0xFB, 0x1A, 0x60, 0x46, 0x63, 0x81, 0xF3,
+	 0xBD, 0xDB, 0x82, 0xF3, 0xBD, 0xDB, 0x83, 0xF3, 0xA3, 0xDB, 0x01, 0x60, 0x10, 0x65, 0x68, 0xF3,
+	 0xA5, 0xD1, 0x04, 0xA4, 0x68, 0xFB, 0xD0, 0x80, 0xA0, 0xD3, 0x20, 0x07, 0x40, 0x47, 0x60, 0x41,
+	 0x0E, 0x65, 0x45, 0xD3, 0x28, 0x60, 0x2C, 0x62, 0xA2, 0xD1, 0xFF, 0xFF, 0x03, 0x1B, 0x10, 0xB0,
+	 0xFF, 0xFF, 0xEB, 0x02, 0x27, 0x44, 0x06, 0xA4, 0x60, 0x41, 0xA1, 0xD1, 0x81, 0xF3, 0x82, 0xF1,
+	 0xD0, 0x80, 0x59, 0xD3, 0x08, 0x02, 0xD0, 0x80, 0x83, 0xF3, 0x59, 0xD1, 0x04, 0x02, 0xD0, 0x80,
+	 0xFF, 0xFF, 0x01, 0x02, 0x03, 0x00, 0xD8, 0x60, 0x99, 0x78, 0xFF, 0xFF, 0x1A, 0x60, 0x46, 0x63,
+	 0xBD, 0xD3, 0x81, 0xFB, 0xBD, 0xD3, 0x82, 0xFB, 0xA3, 0xD3, 0x83, 0xFB, 0x53, 0x64, 0x3B, 0x42,
+	 0x5A, 0xDB, 0x0F, 0x60, 0xEA, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0xDE, 0xFE, 0x0B, 0x04, 0x0F, 0x60,
+	 0xEC, 0x62, 0x40, 0x60, 0x00, 0x64, 0xA2, 0xDB, 0xD8, 0x60, 0x06, 0x64, 0x5A, 0xDB, 0xCF, 0xFE,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x7E, 0xF1, 0x7F, 0xF9, 0x24, 0x60, 0x9A, 0x62, 0xA2, 0xD9, 0x1E, 0x64,
+	 0x4A, 0xDB, 0xFF, 0xFF, 0x2D, 0xFF, 0x0F, 0x60, 0xEC, 0x62, 0x20, 0x60, 0x00, 0x64, 0xA2, 0xDB,
+	 0xD8, 0x60, 0x36, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60, 0xEA, 0x62,
+	 0x00, 0x64, 0xA2, 0xDB, 0xBE, 0xFE, 0x0F, 0x60, 0xD0, 0x62, 0xA2, 0xD1, 0x40, 0x60, 0x00, 0x64,
+	 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x01, 0x63, 0x8C, 0xFD, 0x0F, 0x60, 0xD8, 0x62, 0xA2, 0xD1,
+	 0x00, 0x60, 0x02, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0xC1, 0xFE, 0x54, 0x64, 0x3B, 0x42,
+	 0x5A, 0xDB, 0x31, 0x44, 0xF9, 0xB4, 0x40, 0x51, 0x01, 0x60, 0xBA, 0x61, 0x1F, 0x60, 0x08, 0x63,
+	 0xA1, 0xD3, 0xFF, 0xFF, 0x20, 0x7F, 0xBD, 0xDB, 0x59, 0xD3, 0xFF, 0xFF, 0x21, 0x7F, 0xBD, 0xDB,
+	 0x59, 0xD3, 0xFF, 0xFF, 0x22, 0x7F, 0xA3, 0xDB, 0x0F, 0x60, 0xEA, 0x62, 0x00, 0x64, 0xA2, 0xDB,
+	 0xDE, 0xFE, 0x0B, 0x04, 0x0F, 0x60, 0xEC, 0x62, 0x40, 0x60, 0x00, 0x64, 0xA2, 0xDB, 0xD8, 0x60,
+	 0x64, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x24, 0x60, 0x9A, 0x62, 0x1F, 0x60,
+	 0x06, 0x64, 0xA2, 0xDB, 0x20, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x2D, 0xFF, 0x0F, 0x60, 0xEC, 0x62,
+	 0x20, 0x60, 0x00, 0x64, 0xA2, 0xDB, 0xD8, 0x60, 0x89, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58,
+	 0xFF, 0xFF, 0x0F, 0x60, 0xEA, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0xBE, 0xFE, 0x0F, 0x60, 0xD0, 0x62,
+	 0xA2, 0xD1, 0x40, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0xD6, 0x60, 0xB7, 0x78,
+	 0xFF, 0xFF, 0x27, 0x43, 0x2D, 0x60, 0x7A, 0x65, 0xA5, 0xD3, 0x65, 0x41, 0x10, 0xA3, 0x01, 0xA4,
+	 0xFE, 0xB4, 0xC4, 0x85, 0xFE, 0xA1, 0xBD, 0xD3, 0x59, 0xD1, 0xFF, 0xFF, 0xD0, 0x80, 0xD5, 0x80,
+	 0x02, 0x02, 0x04, 0x03, 0xF8, 0x01, 0xD7, 0x60, 0xDD, 0x78, 0xFF, 0xFF, 0x55, 0x64, 0x3B, 0x42,
+	 0x5A, 0xDB, 0x0F, 0x60, 0xEA, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0xDE, 0xFE, 0x0B, 0x04, 0x0F, 0x60,
+	 0xEC, 0x62, 0x40, 0x60, 0x00, 0x64, 0xA2, 0xDB, 0xD8, 0x60, 0xB1, 0x64, 0x5A, 0xDB, 0xCF, 0xFE,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x27, 0xD1, 0x7F, 0xF9, 0x24, 0x60, 0x9A, 0x62, 0xA2, 0xD9, 0x1E, 0x64,
+	 0x4A, 0xDB, 0xFF, 0xFF, 0x2D, 0xFF, 0x0F, 0x60, 0xEC, 0x62, 0x20, 0x60, 0x00, 0x64, 0xA2, 0xDB,
+	 0xD8, 0x60, 0xD6, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60, 0xEA, 0x62,
+	 0x00, 0x64, 0xA2, 0xDB, 0xBE, 0xFE, 0x0F, 0x60, 0xD0, 0x62, 0xA2, 0xD1, 0x40, 0x60, 0x00, 0x64,
+	 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x01, 0x60, 0xBA, 0x61, 0x1F, 0x60, 0x08, 0x63, 0xA1, 0xD3,
+	 0xFF, 0xFF, 0x20, 0x7F, 0xBD, 0xDB, 0x21, 0x60, 0x32, 0x64, 0xBD, 0xDB, 0x04, 0xA1, 0xA1, 0xD3,
+	 0xFF, 0xFF, 0x22, 0x7F, 0xA3, 0xDB, 0x0F, 0x60, 0xEA, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0xDE, 0xFE,
+	 0x0B, 0x04, 0x0F, 0x60, 0xEC, 0x62, 0x40, 0x60, 0x00, 0x64, 0xA2, 0xDB, 0xD8, 0x60, 0xF3, 0x64,
+	 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x24, 0x60, 0x9A, 0x62, 0x1F, 0x60, 0x06, 0x64,
+	 0xA2, 0xDB, 0x20, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x2D, 0xFF, 0x0F, 0x60, 0xEC, 0x62, 0x20, 0x60,
+	 0x00, 0x64, 0xA2, 0xDB, 0xD9, 0x60, 0x18, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x0F, 0x60, 0xEA, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0xBE, 0xFE, 0x0F, 0x60, 0xD0, 0x62, 0xA2, 0xD1,
+	 0x40, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x1A, 0x60, 0x6A, 0x62, 0x07, 0x60,
+	 0xD0, 0x64, 0xA2, 0xDB, 0x24, 0x60, 0xAA, 0x62, 0x1A, 0x60, 0x66, 0x64, 0xA2, 0xDB, 0x02, 0x64,
+	 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x27, 0x43, 0x06, 0xA3, 0xBD, 0xD3, 0x81, 0xFB, 0xBD, 0xD3,
+	 0x82, 0xFB, 0xA3, 0xD3, 0x83, 0xFB, 0x31, 0x44, 0xF9, 0xB4, 0x40, 0x51, 0x0F, 0x60, 0xEA, 0x62,
+	 0x00, 0x64, 0xA2, 0xDB, 0x0F, 0x60, 0xEC, 0x62, 0x01, 0x60, 0x04, 0x64, 0xA2, 0xDB, 0xD9, 0x60,
+	 0x4D, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0xBC, 0xF1, 0x1A, 0x60, 0x6A, 0x62,
+	 0xA2, 0xD9, 0x0F, 0x60, 0xEA, 0x62, 0xA2, 0xD1, 0xFE, 0x60, 0xFF, 0x61, 0xA1, 0x84, 0x5A, 0xD1,
+	 0x4A, 0xDB, 0xA1, 0x84, 0x5A, 0xDB, 0x0F, 0x60, 0xEA, 0x62, 0xA2, 0xD1, 0x00, 0x60, 0x04, 0x64,
+	 0xA0, 0x80, 0x9C, 0x84, 0x05, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0xD7, 0x60, 0xDD, 0x78, 0xFF, 0xFF,
+	 0x27, 0x42, 0x0C, 0xA2, 0x28, 0x60, 0x02, 0x63, 0xA2, 0xD3, 0xA3, 0xD3, 0x00, 0xBD, 0x01, 0x63,
+	 0xAC, 0x81, 0x09, 0x03, 0x08, 0x03, 0xB0, 0x60, 0x58, 0x4D, 0xB6, 0x78, 0xFF, 0xFF, 0x00, 0xB8,
+	 0x01, 0x63, 0x01, 0x03, 0x60, 0x43, 0x1A, 0x60, 0x3E, 0x64, 0xA0, 0xDD, 0x60, 0xF5, 0x00, 0x64,
+	 0x2B, 0xFA, 0x20, 0x64, 0x2A, 0xFA, 0x27, 0x43, 0x06, 0xA3, 0xBD, 0xD1, 0x2C, 0xF8, 0x32, 0xF8,
+	 0xBD, 0xD1, 0x2D, 0xF8, 0x33, 0xF8, 0xA3, 0xD1, 0x2E, 0xF8, 0x34, 0xF8, 0xEB, 0xF1, 0x2F, 0xF8,
+	 0xEC, 0xF1, 0x30, 0xF8, 0xED, 0xF1, 0x31, 0xF8, 0xBC, 0xF1, 0x19, 0xF8, 0xF8, 0x60, 0x80, 0x64,
+	 0x0E, 0xFA, 0x00, 0xF4, 0x01, 0x63, 0x32, 0x40, 0x08, 0x26, 0x10, 0xBB, 0x28, 0x60, 0x2C, 0x62,
+	 0xA2, 0xD1, 0xFF, 0xFF, 0x64, 0x40, 0xFE, 0x26, 0x10, 0xBB, 0x09, 0xFC, 0x1A, 0x60, 0x3E, 0x64,
+	 0xA0, 0xD3, 0x12, 0x61, 0x59, 0xDA, 0x1A, 0x60, 0x46, 0x63, 0xBD, 0xD1, 0x59, 0xD8, 0xBD, 0xD1,
+	 0x59, 0xD8, 0xA3, 0xD1, 0x59, 0xD8, 0x2E, 0x60, 0xDE, 0x64, 0x40, 0x48, 0xD9, 0x81, 0xFF, 0x60,
+	 0xF2, 0x64, 0xE8, 0x60, 0x58, 0x4D, 0xE8, 0x78, 0xFF, 0xFF, 0x60, 0xF5, 0x3F, 0xFC, 0xDB, 0x83,
+	 0x2E, 0x60, 0x08, 0x62, 0xA2, 0xDD, 0x20, 0x7C, 0x5A, 0xD9, 0x63, 0x41, 0x2E, 0x60, 0x0C, 0x63,
+	 0x12, 0x65, 0x00, 0xF4, 0xCD, 0x84, 0x4C, 0x91, 0x60, 0x43, 0x60, 0xFE, 0xA5, 0xD2, 0xDE, 0x85,
+	 0x7F, 0x26, 0x02, 0x00, 0x00, 0xF4, 0x04, 0x65, 0x5D, 0x93, 0xA3, 0xDB, 0x5D, 0x93, 0xA5, 0xD2,
+	 0xF6, 0x1F, 0x5D, 0x93, 0x20, 0xFE, 0xDF, 0x83, 0x60, 0xF5, 0x24, 0x60, 0x74, 0x62, 0x24, 0x60,
+	 0x28, 0x64, 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF,
+	 0x00, 0x66, 0x46, 0x46, 0xC1, 0xFE, 0x14, 0x64, 0x69, 0xFB, 0x56, 0x64, 0x3B, 0x42, 0x5A, 0xDB,
+	 0x1A, 0x60, 0x44, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0x64, 0xA4, 0xA2, 0xDB, 0x1A, 0x60, 0x44, 0x62,
+	 0xA2, 0xD1, 0x1A, 0x60, 0x6A, 0x62, 0xA2, 0xD9, 0x24, 0x60, 0xAA, 0x62, 0x1A, 0x60, 0x66, 0x64,
+	 0xA2, 0xDB, 0x02, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x0F, 0x60, 0xEC, 0x62, 0x00, 0x60,
+	 0x1C, 0x64, 0xA2, 0xDB, 0xDA, 0x60, 0x10, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x0F, 0x60, 0xEA, 0x62, 0xA2, 0xD1, 0x00, 0x60, 0x04, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x0E, 0x03,
+	 0xA0, 0x84, 0xA2, 0xDB, 0x57, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0x00, 0x64, 0x69, 0xFB, 0x0F, 0x60,
+	 0xEA, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0xD7, 0x60, 0xDD, 0x78, 0xFF, 0xFF, 0x00, 0x60, 0x10, 0x64,
+	 0xA0, 0x80, 0x9C, 0x84, 0x17, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x24, 0x60, 0xAA, 0x62, 0x1A, 0x60,
+	 0x66, 0x64, 0xA2, 0xDB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x58, 0x64, 0x3B, 0x42,
+	 0x5A, 0xDB, 0x00, 0x64, 0x69, 0xFB, 0x0F, 0x60, 0xEA, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0xDB, 0x60,
+	 0xCB, 0x78, 0xFF, 0xFF, 0x00, 0x60, 0x08, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x3A, 0x03, 0xA0, 0x84,
+	 0xA2, 0xDB, 0x24, 0x60, 0xAA, 0x62, 0x1A, 0x60, 0x66, 0x64, 0xA2, 0xDB, 0x03, 0x64, 0x4A, 0xDB,
+	 0xFF, 0xFF, 0x04, 0xFF, 0x00, 0x64, 0x69, 0xFB, 0x0F, 0x60, 0xEA, 0x62, 0x00, 0x64, 0xA2, 0xDB,
+	 0x26, 0x46, 0x00, 0xF4, 0x0A, 0xF2, 0xFF, 0xFF, 0x2C, 0x18, 0x59, 0x64, 0x3B, 0x42, 0x5A, 0xDB,
+	 0x0A, 0xF2, 0x26, 0x46, 0x40, 0x59, 0x02, 0x60, 0x00, 0x61, 0x2F, 0xF2, 0xA1, 0xDB, 0x30, 0xF2,
+	 0x41, 0x58, 0x59, 0xDB, 0x31, 0xF2, 0x59, 0xDB, 0x26, 0x46, 0x24, 0x60, 0x74, 0x64, 0x40, 0x4B,
+	 0x2C, 0x60, 0x58, 0x4D, 0xD8, 0x78, 0xFF, 0xFF, 0x00, 0x66, 0x46, 0x46, 0x05, 0x65, 0xE9, 0x60,
+	 0x58, 0x4E, 0x4C, 0x78, 0xFF, 0xFF, 0xDC, 0x60, 0xAA, 0x78, 0xFF, 0xFF, 0xD7, 0x60, 0xDD, 0x78,
+	 0xFF, 0xFF, 0x5A, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0x78, 0x43, 0x02, 0x61, 0x24, 0x60, 0xDD, 0x78,
+	 0xFF, 0xFF, 0x5B, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0x09, 0xF0, 0x2E, 0x60, 0x64, 0x63, 0x30, 0x64,
+	 0xBD, 0xDB, 0xBD, 0xD9, 0x0A, 0xF0, 0xBD, 0xD9, 0x0B, 0xF0, 0xBD, 0xD9, 0x0C, 0xF2, 0xBD, 0xDB,
+	 0x60, 0x47, 0xFF, 0xB4, 0x0A, 0xA5, 0x2E, 0x60, 0x62, 0x62, 0x65, 0x5C, 0xA2, 0xD9, 0x60, 0x41,
+	 0x1A, 0x65, 0xCD, 0x84, 0x4C, 0x91, 0x60, 0x43, 0x60, 0xFE, 0xA5, 0xD2, 0xDE, 0x85, 0x7F, 0x26,
+	 0x02, 0x00, 0x00, 0xF4, 0x04, 0x65, 0x5D, 0x93, 0xA3, 0xDB, 0x5D, 0x93, 0xA5, 0xD2, 0xF6, 0x1F,
+	 0x5D, 0x93, 0x20, 0xFE, 0xDF, 0x83, 0xD3, 0x60, 0x58, 0x4D, 0x06, 0x78, 0xFF, 0xFF, 0x0B, 0xF2,
+	 0xFF, 0xFF, 0x07, 0xB4, 0x01, 0x61, 0x03, 0x03, 0xCC, 0x84, 0xE1, 0x81, 0xFD, 0x02, 0x61, 0x44,
+	 0x96, 0xFB, 0x27, 0x45, 0x02, 0x62, 0x46, 0xD3, 0x5A, 0xD1, 0x60, 0x47, 0x56, 0xFB, 0x64, 0x47,
+	 0x55, 0xFB, 0x00, 0x64, 0x5C, 0xFB, 0x0C, 0x62, 0x46, 0xD3, 0x80, 0xFB, 0x0B, 0xF0, 0x0F, 0x60,
+	 0xFF, 0x64, 0xA0, 0x84, 0x85, 0xFB, 0x1A, 0x60, 0x3E, 0x62, 0xA2, 0xD3, 0x87, 0xFB, 0x26, 0x46,
+	 0x32, 0xF0, 0x81, 0xF9, 0x33, 0xF0, 0x82, 0xF9, 0x34, 0xF0, 0x83, 0xF9, 0x00, 0xF4, 0x18, 0x65,
+	 0x0C, 0x61, 0x02, 0x60, 0x00, 0x63, 0xA5, 0xD0, 0xDA, 0x85, 0x64, 0x44, 0x00, 0x7F, 0xCD, 0x81,
+	 0xBD, 0xDB, 0x05, 0x03, 0x64, 0x47, 0x00, 0x7F, 0xCD, 0x81, 0xBD, 0xDB, 0xF4, 0x02, 0x02, 0x60,
+	 0x02, 0x61, 0xA1, 0xD3, 0x00, 0x65, 0x60, 0x43, 0x59, 0xD3, 0xFF, 0xFF, 0x7F, 0xB4, 0x02, 0x3A,
+	 0x02, 0x00, 0x01, 0x64, 0x15, 0x00, 0x04, 0x3A, 0x02, 0x00, 0x02, 0x64, 0x11, 0x00, 0x0A, 0x3A,
+	 0x02, 0x00, 0x04, 0x64, 0x0D, 0x00, 0x0B, 0x3A, 0x02, 0x00, 0x08, 0x64, 0x09, 0x00, 0x10, 0x3A,
+	 0x02, 0x00, 0x10, 0x64, 0x05, 0x00, 0x16, 0x3A, 0x02, 0x00, 0x20, 0x64, 0x01, 0x00, 0x00, 0x64,
+	 0xCF, 0x83, 0xB4, 0x85, 0xE1, 0x02, 0x65, 0x44, 0x7A, 0xFB, 0x02, 0x60, 0x02, 0x61, 0xA1, 0xD3,
+	 0x00, 0x65, 0x60, 0x43, 0x59, 0xD3, 0xFF, 0xFF, 0x80, 0xB0, 0xFF, 0xFF, 0x01, 0x03, 0x60, 0x45,
+	 0xCF, 0x83, 0x65, 0x44, 0xF7, 0x02, 0x7F, 0xB4, 0x02, 0x3A, 0x02, 0x00, 0x0A, 0x64, 0x15, 0x00,
+	 0x04, 0x3A, 0x02, 0x00, 0x14, 0x64, 0x11, 0x00, 0x0A, 0x3A, 0x02, 0x00, 0x32, 0x64, 0x0D, 0x00,
+	 0x0B, 0x3A, 0x02, 0x00, 0x37, 0x64, 0x09, 0x00, 0x10, 0x3A, 0x02, 0x00, 0x50, 0x64, 0x05, 0x00,
+	 0x16, 0x3A, 0x02, 0x00, 0x6E, 0x64, 0x01, 0x00, 0x14, 0x64, 0x7C, 0xFB, 0xA9, 0xF3, 0xFF, 0xFF,
+	 0x02, 0xA4, 0xD8, 0xF3, 0x60, 0x45, 0x66, 0x41, 0x65, 0x46, 0x8C, 0xFA, 0x60, 0x40, 0x01, 0x36,
+	 0x06, 0x00, 0x02, 0x36, 0x04, 0x00, 0x04, 0x36, 0x02, 0x00, 0x05, 0x3A, 0x02, 0x00, 0x00, 0x64,
+	 0x01, 0x00, 0x01, 0x64, 0x6F, 0xFA, 0x79, 0xF3, 0x7A, 0xF1, 0xFF, 0xFF, 0xA0, 0x84, 0x65, 0x43,
+	 0x02, 0x02, 0x79, 0xF3, 0xFF, 0xFF, 0x60, 0x41, 0x0F, 0x60, 0xAE, 0x65, 0xD8, 0xF3, 0xFF, 0xFF,
+	 0xE0, 0x84, 0x44, 0xD3, 0x61, 0x45, 0xA4, 0x80, 0xFF, 0xFF, 0x04, 0x02, 0xE8, 0x84, 0xA4, 0x80,
+	 0xFF, 0xFF, 0xFC, 0x03, 0xA4, 0x84, 0x7B, 0xFB, 0x6F, 0xF0, 0x60, 0x47, 0x90, 0x84, 0x6F, 0xFA,
+	 0x60, 0x47, 0x60, 0x45, 0x80, 0x64, 0xE8, 0x84, 0xA4, 0x80, 0xFF, 0xFF, 0xFC, 0x03, 0xA4, 0x84,
+	 0x70, 0xF0, 0x70, 0xFA, 0x00, 0x61, 0xE8, 0x84, 0xFF, 0xFF, 0x02, 0x05, 0xDD, 0x81, 0xFB, 0x01,
+	 0xE1, 0x81, 0x0F, 0x60, 0xA2, 0x65, 0x45, 0xD3, 0x0E, 0xFA, 0x66, 0x43, 0x0C, 0xF4, 0xA9, 0xF3,
+	 0x1C, 0x60, 0xBA, 0x65, 0x02, 0xA4, 0x60, 0x46, 0x05, 0xF0, 0x60, 0x41, 0x64, 0x47, 0x00, 0x7F,
+	 0xE0, 0x84, 0x00, 0x7C, 0x44, 0xD9, 0x26, 0x46, 0x31, 0xF2, 0x61, 0x5C, 0x60, 0x47, 0x00, 0x7F,
+	 0xE0, 0x84, 0x44, 0xD9, 0x26, 0x46, 0x2F, 0xF0, 0x61, 0x46, 0x03, 0xF8, 0x26, 0x46, 0x30, 0xF0,
+	 0x61, 0x46, 0x04, 0xF8, 0x26, 0x46, 0x31, 0xF0, 0x61, 0x46, 0x05, 0xF8, 0x26, 0x46, 0xCF, 0x60,
+	 0x58, 0x4E, 0x20, 0x78, 0xFF, 0xFF, 0x26, 0x46, 0x24, 0x60, 0x74, 0x64, 0x40, 0x4B, 0x2C, 0x60,
+	 0x58, 0x4D, 0xD8, 0x78, 0xFF, 0xFF, 0x00, 0x66, 0x46, 0x46, 0x03, 0x65, 0xE9, 0x60, 0x58, 0x4E,
+	 0x7B, 0x78, 0xFF, 0xFF, 0x01, 0x63, 0x8C, 0xFD, 0x0F, 0x60, 0xD8, 0x62, 0xA2, 0xD1, 0x00, 0x60,
+	 0x02, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0xC1, 0xFE, 0x5C, 0x64, 0x3B, 0x42, 0x5A, 0xDB,
+	 0xD6, 0x60, 0xB7, 0x78, 0xFF, 0xFF, 0xFF, 0x60, 0xF7, 0x65, 0x20, 0x44, 0x24, 0x80, 0xD0, 0x60,
+	 0x98, 0x78, 0xFF, 0xFF, 0xDC, 0xF3, 0xFF, 0xFF, 0xFD, 0xA0, 0x2A, 0xF2, 0x03, 0x03, 0xDC, 0x60,
+	 0x7B, 0x78, 0xFF, 0xFF, 0x60, 0x40, 0xB0, 0x36, 0x11, 0x00, 0xC0, 0x36, 0x02, 0x00, 0x2F, 0x58,
+	 0xFF, 0xFF, 0x26, 0x46, 0x24, 0x60, 0x74, 0x64, 0x40, 0x4B, 0x2C, 0x60, 0x58, 0x4D, 0xD8, 0x78,
+	 0xFF, 0xFF, 0x00, 0x66, 0x46, 0x46, 0xD0, 0x60, 0x98, 0x78, 0xFF, 0xFF, 0x66, 0x45, 0x00, 0xF4,
+	 0x0A, 0xF2, 0x0B, 0xF2, 0xFE, 0xA0, 0xF3, 0xA0, 0x6F, 0x02, 0x60, 0x41, 0x09, 0xF2, 0x20, 0x03,
+	 0x00, 0xA0, 0xFF, 0xA0, 0x53, 0x03, 0x65, 0x03, 0x00, 0xA0, 0xFF, 0xFF, 0x4F, 0x03, 0x1F, 0x60,
+	 0x54, 0x61, 0x01, 0x64, 0xA1, 0xDB, 0x1F, 0x60, 0x56, 0x61, 0x0D, 0x64, 0xA1, 0xDB, 0x1F, 0x60,
+	 0x58, 0x61, 0x03, 0x64, 0xA1, 0xDB, 0x26, 0x46, 0x24, 0x60, 0x74, 0x64, 0x40, 0x4B, 0x2C, 0x60,
+	 0x58, 0x4D, 0xD8, 0x78, 0xFF, 0xFF, 0x00, 0x66, 0x46, 0x46, 0xD0, 0x60, 0x98, 0x78, 0xFF, 0xFF,
+	 0x28, 0x60, 0x2E, 0x61, 0xA1, 0xD3, 0xFF, 0xFF, 0xFE, 0xA0, 0x1F, 0x60, 0x54, 0x61, 0x17, 0x02,
+	 0x01, 0x64, 0xA1, 0xDB, 0x1F, 0x60, 0x56, 0x61, 0x00, 0x64, 0xA1, 0xDB, 0x1F, 0x60, 0x58, 0x61,
+	 0x01, 0x64, 0xA1, 0xDB, 0x26, 0x46, 0x24, 0x60, 0x74, 0x64, 0x40, 0x4B, 0x2C, 0x60, 0x58, 0x4D,
+	 0xD8, 0x78, 0xFF, 0xFF, 0x00, 0x66, 0x46, 0x46, 0xD0, 0x60, 0x98, 0x78, 0xFF, 0xFF, 0x02, 0x64,
+	 0xA1, 0xDB, 0x1F, 0x60, 0x56, 0x61, 0x00, 0x64, 0xA1, 0xDB, 0x1F, 0x60, 0x58, 0x61, 0x01, 0x64,
+	 0xA1, 0xDB, 0x26, 0x46, 0x24, 0x60, 0x74, 0x64, 0x40, 0x4B, 0x2C, 0x60, 0x58, 0x4D, 0xD8, 0x78,
+	 0xFF, 0xFF, 0x00, 0x66, 0x46, 0x46, 0xD0, 0x60, 0x98, 0x78, 0xFF, 0xFF, 0x65, 0x46, 0x07, 0xF4,
+	 0x06, 0xF2, 0xFF, 0xFF, 0x01, 0x7E, 0x06, 0xFA, 0x65, 0x46, 0x26, 0x46, 0x24, 0x60, 0x74, 0x64,
+	 0x40, 0x4B, 0x2C, 0x60, 0x58, 0x4D, 0xD8, 0x78, 0xFF, 0xFF, 0x00, 0x66, 0x46, 0x46, 0x2F, 0x58,
+	 0xFF, 0xFF, 0xD2, 0x60, 0x41, 0x78, 0xFF, 0xFF, 0x0A, 0xF2, 0x09, 0xF2, 0xFC, 0xA0, 0xFF, 0xA0,
+	 0x11, 0x02, 0x0A, 0x02, 0x0B, 0xF2, 0x65, 0x46, 0x0A, 0x1B, 0x66, 0x41, 0x07, 0xF4, 0x06, 0xF2,
+	 0xFF, 0xFF, 0x01, 0x7E, 0x06, 0xFA, 0x61, 0x46, 0xD0, 0x60, 0x98, 0x78, 0xFF, 0xFF, 0x26, 0x46,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x65, 0x46, 0x69, 0xF1, 0x2A, 0xF2, 0x64, 0x41, 0x60, 0x40, 0xA0, 0x3A,
+	 0x02, 0x00, 0x08, 0xB1, 0x04, 0x00, 0xC0, 0x3A, 0x0C, 0x00, 0x04, 0xB1, 0xFF, 0xFF, 0x20, 0x03,
+	 0x0F, 0x60, 0xEA, 0x62, 0xA2, 0xD1, 0x00, 0x60, 0x10, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE,
+	 0x17, 0x00, 0xB0, 0x3A, 0x02, 0x00, 0x01, 0x65, 0x07, 0x00, 0x10, 0x3A, 0x02, 0x00, 0x02, 0x65,
+	 0x03, 0x00, 0x30, 0x3A, 0x0D, 0x00, 0x10, 0x65, 0xA5, 0x80, 0xFF, 0xFF, 0x09, 0x03, 0x0F, 0x60,
+	 0xEA, 0x62, 0xA2, 0xD1, 0x00, 0x60, 0x08, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x00, 0x66,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x28, 0x60, 0x2E, 0x64, 0xA0, 0xD3, 0xFF, 0xFF, 0xFC, 0xA0, 0xFF, 0xFF,
+	 0x16, 0x04, 0x0F, 0x60, 0xEC, 0x62, 0x00, 0x60, 0x02, 0x64, 0xA2, 0xDB, 0xDC, 0x60, 0xBC, 0x64,
+	 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x2D, 0x60, 0x58, 0x65, 0xA5, 0xD1, 0x01, 0x60,
+	 0x00, 0x64, 0xA0, 0x80, 0xFF, 0xFF, 0x03, 0x03, 0xD0, 0x60, 0x98, 0x78, 0xFF, 0xFF, 0x20, 0x40,
+	 0x08, 0x2A, 0x03, 0x00, 0xCF, 0x60, 0xF2, 0x78, 0xFF, 0xFF, 0xD7, 0x60, 0xDD, 0x78, 0xFF, 0xFF,
+	 0x4E, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0x2E, 0xF5, 0xFF, 0xFF, 0x27, 0xF2, 0x1C, 0x60, 0xBA, 0x65,
+	 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD3, 0x66, 0x41, 0x60, 0x46, 0x60, 0x43, 0x05, 0xF2,
+	 0x16, 0x18, 0x61, 0x46, 0x27, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x04, 0xF2, 0x0C, 0x02, 0x61, 0x46,
+	 0x26, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x03, 0xF2, 0x06, 0x02, 0x61, 0x46, 0x25, 0xF0, 0x63, 0x46,
+	 0xD0, 0x80, 0xFF, 0xFF, 0x07, 0x03, 0x80, 0xF4, 0xFF, 0xFF, 0x63, 0x46, 0xE8, 0x1B, 0xA9, 0xF3,
+	 0x08, 0xFE, 0x60, 0x43, 0x61, 0x46, 0x25, 0xF2, 0x26, 0xF0, 0xA7, 0xF2, 0xA8, 0xF0, 0x66, 0xF5,
+	 0xFF, 0xFF, 0x00, 0xF4, 0xFF, 0xFF, 0x89, 0xF8, 0x66, 0xF5, 0xFF, 0xFF, 0x07, 0xFC, 0x2C, 0xFA,
+	 0x2D, 0xF8, 0xAE, 0xFA, 0xEB, 0xF3, 0x2F, 0xFA, 0xEC, 0xF3, 0x30, 0xFA, 0xED, 0xF3, 0x31, 0xFA,
+	 0x81, 0xF3, 0x32, 0xFA, 0x82, 0xF3, 0x33, 0xFA, 0x83, 0xF3, 0x34, 0xFA, 0x31, 0x60, 0x2C, 0x61,
+	 0xA1, 0xD3, 0xFF, 0xFF, 0x03, 0x1B, 0x00, 0x60, 0xA0, 0x64, 0x02, 0x00, 0x00, 0x60, 0xC0, 0x64,
+	 0x2A, 0xFA, 0x02, 0x63, 0x3F, 0xFC, 0xAB, 0xFC, 0x00, 0x64, 0x3E, 0xFA, 0xCC, 0xF1, 0x19, 0xF8,
+	 0x24, 0x60, 0x74, 0x62, 0x24, 0x60, 0x28, 0x64, 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64,
+	 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0x00, 0x66, 0x46, 0x46, 0xC1, 0xFE, 0x0F, 0x60, 0xEA, 0x62,
+	 0x00, 0x64, 0xA2, 0xDB, 0xD6, 0x60, 0xC2, 0x78, 0xFF, 0xFF, 0x00, 0x60, 0x3A, 0x61, 0xAE, 0x60,
+	 0x58, 0x4D, 0xC4, 0x78, 0xFF, 0xFF, 0x66, 0x44, 0x62, 0xFB, 0xA9, 0xF3, 0x07, 0xFA, 0x0C, 0x60,
+	 0x80, 0x64, 0xBC, 0xF1, 0x19, 0xF8, 0x0E, 0xFA, 0x00, 0x64, 0x3E, 0xFA, 0x3F, 0xFA, 0x00, 0x60,
+	 0x3A, 0x61, 0xAE, 0x60, 0x58, 0x4D, 0xC4, 0x78, 0xFF, 0xFF, 0x66, 0x44, 0x61, 0xFB, 0xA9, 0xF3,
+	 0x07, 0xFA, 0x0C, 0x60, 0x80, 0x64, 0x0E, 0xFA, 0xBC, 0xF1, 0x19, 0xF8, 0x00, 0x64, 0x3E, 0xFA,
+	 0x3F, 0xFA, 0x10, 0x60, 0x20, 0x62, 0xDE, 0x60, 0xDC, 0x64, 0xA2, 0xDB, 0x0F, 0x60, 0xE0, 0x62,
+	 0x00, 0x60, 0x80, 0x64, 0xA2, 0xDB, 0xDD, 0x60, 0x71, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58,
+	 0xFF, 0xFF, 0x20, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0x27, 0x60, 0xB6, 0x62, 0xA2, 0xD3, 0xFF, 0xFF,
+	 0x01, 0xA8, 0x03, 0xA8, 0x04, 0x03, 0x03, 0x03, 0xDE, 0x60, 0xCA, 0x78, 0xFF, 0xFF, 0x04, 0x60,
+	 0x00, 0x65, 0x20, 0x44, 0x34, 0x80, 0x0F, 0x60, 0xDE, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x9B, 0xFE,
+	 0x03, 0x05, 0x20, 0x40, 0x4B, 0x23, 0x0E, 0x00, 0x0F, 0x60, 0xE0, 0x62, 0x80, 0x60, 0x00, 0x64,
+	 0xA2, 0xDB, 0xDD, 0x60, 0x83, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x21, 0x64, 0x3B, 0x42, 0x5A, 0xDB,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x1F, 0x60, 0x86, 0x61, 0xA1, 0xD3, 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x2A,
+	 0x07, 0x00, 0x90, 0x60, 0x00, 0x65, 0x20, 0x44, 0x34, 0x80, 0x00, 0x64, 0xA1, 0xDB, 0x04, 0x00,
+	 0x10, 0x60, 0x00, 0x65, 0x20, 0x44, 0x34, 0x80, 0x8C, 0xF3, 0x58, 0xFB, 0x84, 0xF1, 0xBA, 0xFE,
+	 0x01, 0xA8, 0x59, 0xF9, 0x04, 0x02, 0x02, 0x64, 0x8C, 0xFB, 0xFF, 0xFF, 0xC1, 0xFE, 0x64, 0x47,
+	 0xDC, 0xF3, 0x10, 0xB0, 0x04, 0xA8, 0x33, 0x02, 0x32, 0x02, 0x62, 0xF5, 0xEB, 0xF1, 0x2F, 0xF8,
+	 0xEC, 0xF1, 0x30, 0xF8, 0xED, 0xF1, 0x31, 0xF8, 0x81, 0xF1, 0x2C, 0xF8, 0x32, 0xF8, 0x82, 0xF1,
+	 0x2D, 0xF8, 0x33, 0xF8, 0x83, 0xF1, 0x2E, 0xF8, 0x34, 0xF8, 0x10, 0x60, 0x48, 0x64, 0x2A, 0xFA,
+	 0x24, 0x60, 0x74, 0x62, 0x24, 0x60, 0x28, 0x64, 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64,
+	 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xC1, 0xFE, 0x22, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0x0F, 0x60,
+	 0xE0, 0x62, 0x00, 0x60, 0x01, 0x64, 0xA2, 0xDB, 0xDD, 0x60, 0xEA, 0x64, 0x5A, 0xDB, 0xCF, 0xFE,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x23, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0x10, 0x67, 0x84, 0xFB, 0x8C, 0xF3,
+	 0xFF, 0xFF, 0x00, 0xA8, 0xFF, 0xFF, 0x0B, 0x03, 0x0F, 0x60, 0xE0, 0x62, 0x80, 0x60, 0x00, 0x64,
+	 0xA2, 0xDB, 0xDD, 0x60, 0xEF, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60,
+	 0xDE, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x1B, 0x60, 0xC6, 0x65, 0x1F, 0x60, 0x80, 0x64, 0xA0, 0xD3,
+	 0x05, 0x7C, 0x08, 0xB0, 0xA5, 0xD3, 0x05, 0x02, 0x00, 0xB8, 0xFF, 0xFF, 0x02, 0x03, 0x15, 0x7C,
+	 0x0B, 0x00, 0xDC, 0xF3, 0x12, 0x60, 0x26, 0x63, 0x03, 0xA8, 0x7F, 0xF3, 0x05, 0x02, 0xE0, 0x85,
+	 0x47, 0xD3, 0xFF, 0xFF, 0x07, 0xBC, 0xA2, 0xDB, 0x53, 0xF9, 0x29, 0x60, 0xC6, 0x64, 0x54, 0xFB,
+	 0x24, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0x0F, 0x4E, 0xEC, 0x60, 0x58, 0x4F, 0xB9, 0x78, 0xFF, 0xFF,
+	 0x0E, 0x4F, 0x0F, 0x60, 0xE0, 0x62, 0x10, 0x60, 0x00, 0x64, 0xA2, 0xDB, 0xDE, 0x60, 0x34, 0x64,
+	 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x25, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0xFF, 0xFF,
+	 0x59, 0xF3, 0x84, 0xFB, 0x60, 0x40, 0x10, 0x27, 0xDA, 0xFE, 0xDC, 0xF3, 0x00, 0xA8, 0x04, 0xA8,
+	 0x27, 0x02, 0x26, 0x02, 0x61, 0xF5, 0xEB, 0xF1, 0x2F, 0xF8, 0xEC, 0xF1, 0x30, 0xF8, 0xED, 0xF1,
+	 0x31, 0xF8, 0x81, 0xF1, 0x2C, 0xF8, 0x82, 0xF1, 0x2D, 0xF8, 0x83, 0xF1, 0x2E, 0xF8, 0xA4, 0x64,
+	 0x2A, 0xFA, 0x85, 0xF1, 0xC0, 0x67, 0xB0, 0x84, 0x2B, 0xFA, 0x24, 0x60, 0x74, 0x62, 0x24, 0x60,
+	 0x28, 0x64, 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF,
+	 0xC1, 0xFE, 0x20, 0x60, 0x00, 0x65, 0x20, 0x44, 0x34, 0x80, 0x26, 0x64, 0x3B, 0x42, 0x5A, 0xDB,
+	 0x9E, 0xF5, 0xFF, 0xFF, 0x07, 0x1B, 0x20, 0x40, 0x80, 0x2B, 0x5C, 0x00, 0x7F, 0x60, 0xFF, 0x65,
+	 0x20, 0x44, 0x24, 0x80, 0x00, 0x64, 0x41, 0xFB, 0xF1, 0x60, 0x01, 0x64, 0x24, 0xFA, 0xDA, 0x85,
+	 0x19, 0x60, 0x86, 0x63, 0x89, 0xF1, 0x43, 0x4C, 0xD3, 0x80, 0xBE, 0xD1, 0x14, 0x05, 0x65, 0x40,
+	 0x80, 0x2A, 0x02, 0x00, 0x00, 0xF4, 0x04, 0x65, 0x64, 0x43, 0x32, 0x61, 0x0F, 0x4E, 0x2F, 0x60,
+	 0x58, 0x4F, 0x01, 0x78, 0xFF, 0xFF, 0x0E, 0x4F, 0x2C, 0x43, 0x04, 0xA3, 0x41, 0xF3, 0xFF, 0xFF,
+	 0x32, 0xA4, 0x41, 0xFB, 0xE7, 0x01, 0x20, 0x47, 0x20, 0xB0, 0x20, 0xAF, 0x0F, 0x03, 0x40, 0x40,
+	 0x0F, 0x60, 0xE0, 0x62, 0x00, 0x60, 0x01, 0x64, 0xA2, 0xDB, 0xDE, 0x60, 0xA3, 0x64, 0x5A, 0xDB,
+	 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x27, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0x9E, 0xF1, 0x41, 0xF3,
+	 0xFF, 0xFF, 0x02, 0xA4, 0xE8, 0x84, 0x64, 0x46, 0x23, 0xFA, 0x24, 0x60, 0x74, 0x62, 0x24, 0x60,
+	 0x64, 0x64, 0xA2, 0xDB, 0x5A, 0xD9, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0x00, 0x64,
+	 0x9E, 0xFB, 0xFA, 0xFE, 0xEB, 0x60, 0xFF, 0x65, 0x20, 0x44, 0x24, 0x80, 0x0F, 0x60, 0xD0, 0x62,
+	 0xA2, 0xD1, 0x80, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x58, 0xF3, 0x8C, 0xFB,
+	 0xFF, 0xFF, 0xC1, 0xFE, 0x0F, 0x60, 0xDE, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x0F, 0x60, 0xE0, 0x62,
+	 0x00, 0x60, 0x80, 0x64, 0xA2, 0xDB, 0xDD, 0x60, 0x71, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2E, 0x64,
+	 0x3B, 0x42, 0x5A, 0xDB, 0x2F, 0x58, 0xFF, 0xFF, 0x2F, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0x9E, 0xF1,
+	 0x00, 0x64, 0xB0, 0x86, 0x9E, 0xFB, 0x07, 0x03, 0x24, 0x60, 0x74, 0x64, 0x40, 0x4B, 0x2C, 0x60,
+	 0x58, 0x4D, 0xD8, 0x78, 0xFF, 0xFF, 0xEB, 0x60, 0xFF, 0x65, 0x20, 0x44, 0x24, 0x80, 0x0F, 0x60,
+	 0xDE, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x0F, 0x60, 0xE0, 0x62, 0x00, 0x60, 0x80, 0x64, 0xA2, 0xDB,
+	 0xDD, 0x60, 0x71, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x97, 0xF3, 0x26, 0x46,
+	 0x60, 0x43, 0x01, 0x2A, 0x22, 0x00, 0x0F, 0xF2, 0x2A, 0xF0, 0x60, 0x40, 0x10, 0x2A, 0x10, 0x00,
+	 0x64, 0x40, 0x04, 0x27, 0x1A, 0x00, 0xFD, 0xB3, 0x64, 0x40, 0x20, 0x27, 0x02, 0xBB, 0x0F, 0x60,
+	 0xF6, 0x62, 0xA2, 0xD1, 0x00, 0x60, 0x08, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x0C, 0x00,
+	 0xFB, 0xB3, 0x64, 0x40, 0x20, 0x27, 0x04, 0xBB, 0x0F, 0x60, 0xF6, 0x62, 0xA2, 0xD1, 0x00, 0x60,
+	 0x10, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x97, 0xFD, 0x26, 0x46, 0x2F, 0x58, 0xFF, 0xFF,
+	 0xDC, 0xF3, 0x3F, 0xF2, 0x04, 0xA8, 0x57, 0xFB, 0x02, 0x03, 0x2F, 0x58, 0xFF, 0xFF, 0x00, 0xF4,
+	 0x1E, 0x63, 0x08, 0x64, 0x40, 0x48, 0xBD, 0xD2, 0xFF, 0xFF, 0x60, 0x47, 0x05, 0x36, 0x0B, 0x00,
+	 0xFF, 0xB5, 0xC7, 0x83, 0x01, 0x2A, 0xF7, 0x01, 0x4F, 0xD2, 0x5B, 0xD2, 0x60, 0x40, 0x05, 0x37,
+	 0x08, 0x00, 0xDF, 0x83, 0xF5, 0x01, 0xFF, 0xB5, 0x65, 0x41, 0x47, 0x8A, 0x5B, 0xD2, 0xDF, 0x83,
+	 0x07, 0x00, 0x00, 0x7F, 0xDC, 0x85, 0x47, 0x8A, 0x60, 0x41, 0x5B, 0xD2, 0xDB, 0x83, 0x60, 0x47,
+	 0x01, 0xB0, 0xFE, 0xB5, 0x02, 0x03, 0x02, 0x64, 0x40, 0x48, 0x85, 0xF1, 0x65, 0x44, 0xE0, 0x84,
+	 0xE0, 0x84, 0xE0, 0x84, 0xFD, 0xA1, 0xE1, 0x81, 0xE1, 0x81, 0xE1, 0x85, 0xC4, 0x81, 0xD0, 0x84,
+	 0xD1, 0x80, 0x2A, 0x07, 0x29, 0x06, 0x9C, 0x84, 0xDC, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x85,
+	 0x96, 0xF3, 0xC7, 0x83, 0x01, 0x26, 0x60, 0x47, 0xAB, 0x83, 0xFC, 0xA3, 0x02, 0x00, 0x03, 0x04,
+	 0x00, 0xF4, 0x84, 0xA3, 0xFC, 0x01, 0x80, 0x65, 0x47, 0xD0, 0x28, 0x41, 0xA0, 0x80, 0xFE, 0xA1,
+	 0x16, 0x03, 0x09, 0x02, 0x10, 0x60, 0x14, 0x62, 0xA2, 0xD1, 0x00, 0x60, 0x10, 0x64, 0xB0, 0x84,
+	 0xA2, 0xDB, 0xCF, 0xFE, 0x1E, 0x00, 0x10, 0x60, 0x14, 0x62, 0xA2, 0xD1, 0x00, 0x60, 0x04, 0x64,
+	 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x15, 0x00, 0x28, 0x41, 0xFE, 0xA1, 0xFF, 0xFF, 0x09, 0x03,
+	 0x10, 0x60, 0x14, 0x62, 0xA2, 0xD1, 0x00, 0x60, 0x08, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE,
+	 0x08, 0x00, 0x10, 0x60, 0x14, 0x62, 0xA2, 0xD1, 0x00, 0x60, 0x02, 0x64, 0xB0, 0x84, 0xA2, 0xDB,
+	 0xCF, 0xFE, 0x0F, 0x60, 0xF6, 0x62, 0xA2, 0xD1, 0x00, 0x60, 0x04, 0x64, 0xB0, 0x84, 0xA2, 0xDB,
+	 0xCF, 0xFE, 0x20, 0x40, 0x20, 0x2A, 0x58, 0x00, 0x26, 0x46, 0x3F, 0xF2, 0x00, 0xF4, 0x60, 0x43,
+	 0xF4, 0xA3, 0x00, 0x60, 0x1D, 0x61, 0x00, 0x60, 0x80, 0x65, 0x60, 0xFE, 0x81, 0xA1, 0x7F, 0xA1,
+	 0x02, 0x06, 0x00, 0xF4, 0x03, 0x61, 0xDD, 0x81, 0xA1, 0xD2, 0xCF, 0x83, 0xD4, 0x80, 0x2D, 0x03,
+	 0x17, 0x03, 0xCF, 0x83, 0x61, 0x44, 0x80, 0xA0, 0x28, 0x03, 0x02, 0x02, 0x00, 0xF4, 0x03, 0x61,
+	 0xDD, 0x81, 0xA1, 0xD2, 0xCF, 0x83, 0x81, 0xA1, 0x20, 0x03, 0x05, 0x07, 0x7F, 0xA1, 0xCC, 0x84,
+	 0xDD, 0x81, 0xE4, 0x03, 0xF7, 0x01, 0x00, 0xF4, 0x00, 0xB8, 0x04, 0x61, 0xE4, 0x03, 0xF2, 0x01,
+	 0x01, 0x60, 0xFF, 0x63, 0x46, 0x48, 0x41, 0x4A, 0xDD, 0x81, 0xA1, 0xD0, 0xDF, 0x83, 0xA3, 0xD9,
+	 0x64, 0x44, 0xDD, 0x81, 0xA1, 0xD0, 0xDF, 0x83, 0xA3, 0xD9, 0xCC, 0x84, 0x81, 0xA1, 0x05, 0x03,
+	 0x7F, 0xA1, 0xF7, 0x04, 0x00, 0xF4, 0x03, 0x61, 0xF4, 0x01, 0x20, 0xFE, 0x00, 0xBB, 0x02, 0x60,
+	 0x00, 0x63, 0x08, 0x24, 0x11, 0x00, 0xBD, 0xD3, 0x06, 0x65, 0xD4, 0x80, 0xBD, 0xD3, 0x0C, 0x02,
+	 0x60, 0x40, 0x60, 0x3A, 0x09, 0x00, 0x1D, 0x3B, 0x07, 0x00, 0xBD, 0xD3, 0xFF, 0xFF, 0xFF, 0xB5,
+	 0x00, 0x7E, 0x5C, 0xFB, 0x65, 0x44, 0x5B, 0xFB, 0x26, 0x46, 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60,
+	 0xF6, 0x62, 0xA2, 0xD1, 0x00, 0x60, 0x20, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x2F, 0x58,
+	 0xFF, 0xFF, 0x0F, 0x60, 0xF6, 0x62, 0xA2, 0xD1, 0x02, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB,
+	 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x00, 0x63, 0x97, 0xFD, 0x1A, 0x60, 0x72, 0x63, 0x00, 0x64,
+	 0xA3, 0xDB, 0x06, 0xA3, 0x10, 0x60, 0x50, 0x64, 0xBD, 0xDB, 0xBD, 0xDB, 0x06, 0x64, 0xA3, 0xDB,
+	 0x10, 0x60, 0x4E, 0x62, 0xE0, 0x60, 0x07, 0x64, 0xA2, 0xDB, 0xD2, 0xF1, 0x1A, 0x60, 0x76, 0x62,
+	 0xA2, 0xD9, 0x1A, 0x60, 0x7E, 0x63, 0x00, 0x64, 0xA3, 0xDB, 0x06, 0xA3, 0x10, 0x60, 0x54, 0x64,
+	 0xBD, 0xDB, 0xBD, 0xDB, 0x06, 0x64, 0xA3, 0xDB, 0x10, 0x60, 0x52, 0x62, 0xE0, 0x60, 0x11, 0x64,
+	 0xA2, 0xDB, 0x28, 0x60, 0x04, 0x62, 0xA2, 0xD1, 0x1A, 0x60, 0x82, 0x62, 0xA2, 0xD9, 0x00, 0x60,
+	 0x3A, 0x61, 0xAE, 0x60, 0x58, 0x4D, 0xC4, 0x78, 0xFF, 0xFF, 0x66, 0x44, 0x64, 0xFB, 0xA9, 0xF3,
+	 0x07, 0xFA, 0xBC, 0xF3, 0x19, 0xFA, 0xF8, 0x60, 0x80, 0x64, 0x0E, 0xFA, 0x00, 0x64, 0x3E, 0xFA,
+	 0x3F, 0xFA, 0x00, 0x60, 0x3A, 0x61, 0xAE, 0x60, 0x58, 0x4D, 0xC4, 0x78, 0xFF, 0xFF, 0x66, 0x44,
+	 0x65, 0xFB, 0xA9, 0xF3, 0x07, 0xFA, 0xBC, 0xF3, 0x19, 0xFA, 0x24, 0x60, 0x80, 0x64, 0x0E, 0xFA,
+	 0x00, 0x64, 0x3E, 0xFA, 0x3F, 0xFA, 0x10, 0x60, 0x14, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x5A, 0xDB,
+	 0x10, 0x60, 0x28, 0x62, 0xE0, 0x60, 0x77, 0x64, 0xA2, 0xDB, 0x2F, 0x58, 0xFF, 0xFF, 0x00, 0x63,
+	 0x97, 0xFD, 0xBA, 0xFE, 0xFE, 0x60, 0xFF, 0x65, 0x20, 0x44, 0x24, 0x80, 0x84, 0xFD, 0x0F, 0x60,
+	 0xEA, 0x62, 0xA2, 0xD1, 0x04, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x0F, 0x60,
+	 0xF6, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x5A, 0xDB, 0x2F, 0x58, 0xFF, 0xFF, 0x28, 0x60, 0x04, 0x62,
+	 0xA2, 0xD1, 0x1A, 0x60, 0x82, 0x62, 0xA2, 0xD9, 0x27, 0x60, 0xFE, 0x62, 0xA2, 0xD3, 0xFF, 0xFF,
+	 0x0A, 0x1B, 0x00, 0x64, 0x84, 0xFB, 0xBA, 0xFE, 0x0F, 0x60, 0xF6, 0x62, 0x00, 0x64, 0xA2, 0xDB,
+	 0x5A, 0xDB, 0x2F, 0x58, 0xFF, 0xFF, 0xBA, 0xFE, 0x97, 0xF3, 0x00, 0x63, 0x84, 0xFD, 0x10, 0xBC,
+	 0x97, 0xFB, 0xFE, 0x60, 0xFF, 0x65, 0x20, 0x44, 0x24, 0x80, 0x0F, 0x60, 0xD0, 0x62, 0xA2, 0xD1,
+	 0x80, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x00, 0x60, 0x64, 0x63, 0x1A, 0x60,
+	 0x42, 0x64, 0xA0, 0xDD, 0x0F, 0x60, 0xF6, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x0F, 0x60, 0xF8, 0x62,
+	 0x01, 0x60, 0x04, 0x64, 0xA2, 0xDB, 0xE0, 0x60, 0xC9, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58,
+	 0xFF, 0xFF, 0x0F, 0x60, 0xF6, 0x62, 0xA2, 0xD1, 0x01, 0x60, 0x00, 0x64, 0xA0, 0x80, 0x9C, 0x84,
+	 0x03, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0xA3, 0x01, 0x31, 0x40, 0x04, 0x2A, 0xE3, 0x01, 0x20, 0x40,
+	 0x52, 0x23, 0x12, 0x00, 0x0F, 0x60, 0xF6, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x10, 0x60, 0x14, 0x62,
+	 0x00, 0x64, 0xA2, 0xDB, 0x0F, 0x60, 0xF8, 0x62, 0x81, 0x60, 0x00, 0x64, 0xA2, 0xDB, 0xE0, 0x60,
+	 0xC9, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0xDB, 0x01, 0x0F, 0x60, 0xF6, 0x62, 0x00, 0x64, 0xA2, 0xDB,
+	 0x01, 0x60, 0x00, 0x65, 0x20, 0x44, 0x34, 0x80, 0x65, 0xF5, 0xBC, 0xF1, 0x19, 0xF8, 0x81, 0xF1,
+	 0x2C, 0xF8, 0x32, 0xF8, 0x82, 0xF1, 0x2D, 0xF8, 0x33, 0xF8, 0x83, 0xF1, 0x2E, 0xF8, 0x34, 0xF8,
+	 0xEB, 0xF1, 0x2F, 0xF8, 0xEC, 0xF1, 0x30, 0xF8, 0xED, 0xF1, 0x31, 0xF8, 0x11, 0x60, 0x48, 0x64,
+	 0x2A, 0xFA, 0x00, 0x64, 0x2B, 0xFA, 0x23, 0xFA, 0x24, 0x60, 0x74, 0x62, 0x24, 0x60, 0x28, 0x64,
+	 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xC1, 0xFE,
+	 0x0F, 0x60, 0xF8, 0x62, 0x00, 0x60, 0x01, 0x64, 0xA2, 0xDB, 0xE1, 0x60, 0x23, 0x64, 0x5A, 0xDB,
+	 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x65, 0xF5, 0x23, 0xF2, 0xFF, 0xFF, 0x01, 0x18, 0x7B, 0x01,
+	 0x10, 0x67, 0x84, 0xFB, 0x03, 0x64, 0x98, 0xFB, 0xFE, 0x60, 0xFF, 0x65, 0x20, 0x44, 0x24, 0x80,
+	 0x0F, 0x60, 0xD0, 0x62, 0xA2, 0xD1, 0x80, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE,
+	 0x0F, 0x60, 0xF6, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x0F, 0x60, 0xF8, 0x62, 0x81, 0x60, 0x00, 0x64,
+	 0xA2, 0xDB, 0xE1, 0x60, 0x46, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x0D, 0x00, 0x0F, 0x60, 0xF6, 0x62,
+	 0xA2, 0xD1, 0x01, 0x60, 0x00, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x05, 0x03, 0xA0, 0x84, 0xA2, 0xDB,
+	 0xE0, 0x60, 0x77, 0x78, 0xFF, 0xFF, 0x46, 0x60, 0x00, 0x65, 0x20, 0x41, 0x8E, 0xF3, 0xA5, 0x80,
+	 0x01, 0xB0, 0x01, 0x02, 0x06, 0x00, 0x0F, 0x60, 0xF6, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x2F, 0x58,
+	 0xFF, 0xFF, 0x1A, 0x60, 0x42, 0x65, 0xA5, 0xD3, 0x01, 0x63, 0x8C, 0xFD, 0x27, 0x1B, 0x00, 0x60,
+	 0x64, 0x64, 0xA5, 0xDB, 0x65, 0xF5, 0xBC, 0xF1, 0x19, 0xF8, 0x81, 0xF1, 0x2C, 0xF8, 0x32, 0xF8,
+	 0x82, 0xF1, 0x2D, 0xF8, 0x33, 0xF8, 0x83, 0xF1, 0x2E, 0xF8, 0x34, 0xF8, 0xEB, 0xF1, 0x2F, 0xF8,
+	 0xEC, 0xF1, 0x30, 0xF8, 0xED, 0xF1, 0x31, 0xF8, 0x11, 0x60, 0x48, 0x64, 0x2A, 0xFA, 0x00, 0x64,
+	 0x2B, 0xFA, 0x23, 0xFA, 0x24, 0x60, 0x74, 0x62, 0x24, 0x60, 0x28, 0x64, 0xA2, 0xDB, 0x66, 0x44,
+	 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0x06, 0x00, 0x97, 0xF3, 0x32, 0x40,
+	 0x02, 0x26, 0x02, 0x00, 0x40, 0x2A, 0xDA, 0xFE, 0xC1, 0xFE, 0x0F, 0x60, 0xF6, 0x62, 0x00, 0x64,
+	 0xA2, 0xDB, 0x0F, 0x60, 0xF8, 0x62, 0x01, 0x60, 0x82, 0x64, 0xA2, 0xDB, 0xE1, 0x60, 0xA4, 0x64,
+	 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60, 0xF6, 0x62, 0xA2, 0xD1, 0x01, 0x60,
+	 0x00, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x05, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0xE0, 0x60, 0x77, 0x78,
+	 0xFF, 0xFF, 0x00, 0x60, 0x02, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x06, 0x03, 0xA0, 0x84, 0xA2, 0xDB,
+	 0xBA, 0xFE, 0xE3, 0x60, 0xC8, 0x78, 0xFF, 0xFF, 0x02, 0x64, 0x8C, 0xFB, 0x01, 0x60, 0x00, 0x65,
+	 0x20, 0x44, 0x34, 0x80, 0xBA, 0xFE, 0xC1, 0xFE, 0x0F, 0x60, 0xF6, 0x62, 0x00, 0x64, 0xA2, 0xDB,
+	 0x10, 0x60, 0x14, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x0F, 0x60, 0xF8, 0x62, 0x01, 0x60, 0x46, 0x64,
+	 0xA2, 0xDB, 0xE1, 0x60, 0xD7, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60,
+	 0xF6, 0x62, 0xA2, 0xD1, 0x01, 0x60, 0x00, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x05, 0x03, 0xA0, 0x84,
+	 0xA2, 0xDB, 0xE0, 0x60, 0x77, 0x78, 0xFF, 0xFF, 0x00, 0x60, 0x04, 0x64, 0xA0, 0x80, 0x9C, 0x84,
+	 0x3C, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x10, 0x60, 0x14, 0x62, 0xA2, 0xD1, 0x00, 0x60, 0x08, 0x64,
+	 0xA0, 0x80, 0x9C, 0x84, 0x03, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x34, 0x01, 0x00, 0x60, 0x02, 0x64,
+	 0xA0, 0x80, 0x9C, 0x84, 0x0C, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x28, 0x60, 0x00, 0x62, 0xA2, 0xD1,
+	 0x97, 0xF3, 0x00, 0x61, 0xD1, 0x80, 0xF7, 0xB4, 0xF0, 0x03, 0x97, 0xFB, 0x35, 0x00, 0x00, 0x60,
+	 0x10, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x0F, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x28, 0x60, 0x00, 0x62,
+	 0xA2, 0xD1, 0x97, 0xF3, 0x00, 0x61, 0xD1, 0x80, 0x08, 0xBC, 0x03, 0x02, 0xE2, 0x60, 0xE8, 0x78,
+	 0xFF, 0xFF, 0x97, 0xFB, 0x21, 0x00, 0x00, 0x60, 0x04, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x05, 0x03,
+	 0xA0, 0x84, 0xA2, 0xDB, 0xE2, 0x60, 0xE8, 0x78, 0xFF, 0xFF, 0x0F, 0x60, 0xF6, 0x62, 0xA2, 0xD1,
+	 0x00, 0x60, 0x40, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x03, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0xC5, 0x01,
+	 0x00, 0x60, 0x02, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x05, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0xE3, 0x60,
+	 0xC8, 0x78, 0xFF, 0xFF, 0x2F, 0x58, 0xFF, 0xFF, 0x02, 0x63, 0x97, 0xF3, 0x8C, 0xFD, 0x01, 0xBC,
+	 0xC1, 0xFE, 0x97, 0xFB, 0xD2, 0xF1, 0x1A, 0x60, 0x76, 0x62, 0xA2, 0xD9, 0x0F, 0x60, 0xF6, 0x62,
+	 0x00, 0x64, 0xA2, 0xDB, 0x10, 0x60, 0x14, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x0F, 0x60, 0xF8, 0x62,
+	 0x01, 0x60, 0x34, 0x64, 0xA2, 0xDB, 0xE2, 0x60, 0x62, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x24, 0x60,
+	 0xAA, 0x62, 0x1A, 0x60, 0x72, 0x64, 0xA2, 0xDB, 0x02, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60, 0xF6, 0x62, 0xA2, 0xD1, 0x01, 0x60, 0x00, 0x64, 0xA0, 0x80,
+	 0x9C, 0x84, 0x0E, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x24, 0x60, 0xAA, 0x62, 0x1A, 0x60, 0x72, 0x64,
+	 0xA2, 0xDB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0xE0, 0x60, 0x77, 0x78, 0xFF, 0xFF,
+	 0x00, 0x60, 0x10, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x17, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x97, 0xF3,
+	 0xFF, 0xFF, 0x60, 0x40, 0x04, 0x2A, 0x01, 0x00, 0xD2, 0x01, 0x24, 0x60, 0xAA, 0x62, 0x1A, 0x60,
+	 0x72, 0x64, 0xA2, 0xDB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x97, 0xF3, 0xFF, 0xFF,
+	 0x60, 0x40, 0x08, 0x2A, 0x4D, 0x00, 0x54, 0x00, 0x10, 0x60, 0x14, 0x62, 0xA2, 0xD1, 0x00, 0x60,
+	 0x10, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x08, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x97, 0xF3, 0xFF, 0xFF,
+	 0x08, 0xBC, 0x97, 0xFB, 0x2F, 0x58, 0xFF, 0xFF, 0x00, 0x60, 0x02, 0x64, 0xA0, 0x80, 0x9C, 0x84,
+	 0x03, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0xAB, 0x01, 0x00, 0x60, 0x04, 0x64, 0xA0, 0x80, 0x9C, 0x84,
+	 0x0C, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x24, 0x60, 0xAA, 0x62, 0x1A, 0x60, 0x72, 0x64, 0xA2, 0xDB,
+	 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x2B, 0x00, 0x00, 0x60, 0x08, 0x64, 0xA0, 0x80,
+	 0x9C, 0x84, 0x0C, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x24, 0x60, 0xAA, 0x62, 0x1A, 0x60, 0x72, 0x64,
+	 0xA2, 0xDB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x13, 0x00, 0x0F, 0x60, 0xF6, 0x62,
+	 0xA2, 0xD1, 0x00, 0x60, 0x20, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x08, 0x03, 0xA0, 0x84, 0xA2, 0xDB,
+	 0x97, 0xF3, 0xFF, 0xFF, 0x60, 0x40, 0x08, 0x2A, 0x04, 0x00, 0x0A, 0x00, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x00, 0x00, 0x97, 0xF3, 0xFF, 0xFF, 0xFE, 0xB4, 0x97, 0xFB, 0xE1, 0x60, 0x2A, 0x78, 0xFF, 0xFF,
+	 0x27, 0x60, 0xFE, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0x01, 0xA8, 0xFF, 0xFF, 0x03, 0x02, 0xE3, 0x60,
+	 0xD1, 0x78, 0xFF, 0xFF, 0x97, 0xF3, 0x01, 0x63, 0x8C, 0xFD, 0x21, 0xBC, 0x97, 0xFB, 0x64, 0xF5,
+	 0x81, 0xF1, 0x2C, 0xF8, 0x82, 0xF1, 0x2D, 0xF8, 0x83, 0xF1, 0x2E, 0xF8, 0x85, 0xF1, 0xC0, 0x67,
+	 0xB0, 0x84, 0x2B, 0xFA, 0xBC, 0xF1, 0x19, 0xF8, 0xEB, 0xF1, 0x2F, 0xF8, 0xEC, 0xF1, 0x30, 0xF8,
+	 0xED, 0xF1, 0x31, 0xF8, 0x10, 0x60, 0xA4, 0x64, 0x2A, 0xFA, 0x24, 0x60, 0x74, 0x62, 0x24, 0x60,
+	 0x28, 0x64, 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF,
+	 0xC1, 0xFE, 0x1A, 0x60, 0x76, 0x62, 0x00, 0x60, 0x50, 0x64, 0xA2, 0xDB, 0x24, 0x60, 0xAA, 0x62,
+	 0x1A, 0x60, 0x72, 0x64, 0xA2, 0xDB, 0x02, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x0F, 0x60,
+	 0xF6, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x10, 0x60, 0x14, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x0F, 0x60,
+	 0xF8, 0x62, 0x01, 0x60, 0x2C, 0x64, 0xA2, 0xDB, 0xE3, 0x60, 0x3A, 0x64, 0x5A, 0xDB, 0xCF, 0xFE,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60, 0xF6, 0x62, 0xA2, 0xD1, 0x01, 0x60, 0x00, 0x64, 0xA0, 0x80,
+	 0x9C, 0x84, 0x0E, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x24, 0x60, 0xAA, 0x62, 0x1A, 0x60, 0x72, 0x64,
+	 0xA2, 0xDB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0xE0, 0x60, 0x77, 0x78, 0xFF, 0xFF,
+	 0x10, 0x60, 0x14, 0x62, 0xA2, 0xD1, 0x00, 0x60, 0x04, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x03, 0x03,
+	 0xA0, 0x84, 0xA2, 0xDB, 0x8D, 0x01, 0x0F, 0x60, 0xF6, 0x62, 0xA2, 0xD1, 0x00, 0x60, 0x08, 0x64,
+	 0xA0, 0x80, 0x9C, 0x84, 0x08, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x97, 0xF3, 0xFF, 0xFF, 0x02, 0xB0,
+	 0xFF, 0xFF, 0x4E, 0x03, 0x7D, 0x01, 0x00, 0x60, 0x08, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x03, 0x03,
+	 0xA0, 0x84, 0xA2, 0xDB, 0x45, 0x00, 0x00, 0x60, 0x02, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x16, 0x03,
+	 0xA0, 0x84, 0xA2, 0xDB, 0x24, 0x60, 0xAA, 0x62, 0x1A, 0x60, 0x72, 0x64, 0xA2, 0xDB, 0x03, 0x64,
+	 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x28, 0x60, 0x00, 0x62, 0xA2, 0xD3, 0x97, 0xF3, 0x00, 0xA8,
+	 0xF7, 0xB4, 0x2E, 0x03, 0x97, 0xFB, 0xE2, 0x60, 0x3C, 0x78, 0xFF, 0xFF, 0x00, 0x60, 0x10, 0x64,
+	 0xA0, 0x80, 0x9C, 0x84, 0x17, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x24, 0x60, 0xAA, 0x62, 0x1A, 0x60,
+	 0x72, 0x64, 0xA2, 0xDB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x28, 0x60, 0x00, 0x62,
+	 0xA2, 0xD3, 0x97, 0xF3, 0x00, 0xA8, 0x08, 0xBC, 0x01, 0x02, 0x42, 0x01, 0x97, 0xFB, 0xE2, 0x60,
+	 0x3C, 0x78, 0xFF, 0xFF, 0x0F, 0x60, 0xF6, 0x62, 0xA2, 0xD1, 0x00, 0x60, 0x20, 0x64, 0xA0, 0x80,
+	 0x9C, 0x84, 0x03, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x02, 0x00, 0x2F, 0x58, 0xFF, 0xFF, 0x00, 0x00,
+	 0x24, 0x60, 0xAA, 0x62, 0x1A, 0x60, 0x72, 0x64, 0xA2, 0xDB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF,
+	 0x04, 0xFF, 0x97, 0xF3, 0xFF, 0xFF, 0xFE, 0xB4, 0x97, 0xFB, 0xE1, 0x60, 0x2A, 0x78, 0xFF, 0xFF,
+	 0x97, 0xF3, 0x01, 0x63, 0x8C, 0xFD, 0x01, 0xBC, 0x97, 0xFB, 0x00, 0x64, 0x84, 0xFB, 0xC1, 0xFE,
+	 0x29, 0x00, 0x97, 0xF3, 0x01, 0x63, 0x8C, 0xFD, 0x01, 0xBC, 0x97, 0xFB, 0x00, 0x64, 0x84, 0xFB,
+	 0x64, 0xF5, 0x81, 0xF1, 0x2C, 0xF8, 0x82, 0xF1, 0x2D, 0xF8, 0x83, 0xF1, 0x2E, 0xF8, 0x85, 0xF1,
+	 0xC0, 0x67, 0xB0, 0x84, 0x2B, 0xFA, 0xBC, 0xF1, 0x19, 0xF8, 0xEB, 0xF1, 0x2F, 0xF8, 0xEC, 0xF1,
+	 0x30, 0xF8, 0xED, 0xF1, 0x31, 0xF8, 0x00, 0x60, 0xA4, 0x64, 0x2A, 0xFA, 0x24, 0x60, 0x74, 0x62,
+	 0x24, 0x60, 0x28, 0x64, 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF,
+	 0x2B, 0xFF, 0xC1, 0xFE, 0x24, 0x60, 0xAA, 0x62, 0x1A, 0x60, 0x7E, 0x64, 0xA2, 0xDB, 0x02, 0x64,
+	 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x0F, 0x60, 0xF6, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x10, 0x60,
+	 0x14, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x0F, 0x60, 0xF8, 0x62, 0x03, 0x60, 0x0E, 0x64, 0xA2, 0xDB,
+	 0xE4, 0x60, 0x16, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60, 0xF6, 0x62,
+	 0xA2, 0xD1, 0x01, 0x60, 0x00, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x0E, 0x03, 0xA0, 0x84, 0xA2, 0xDB,
+	 0x24, 0x60, 0xAA, 0x62, 0x1A, 0x60, 0x7E, 0x64, 0xA2, 0xDB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF,
+	 0x04, 0xFF, 0xE0, 0x60, 0x77, 0x78, 0xFF, 0xFF, 0x00, 0x60, 0x0A, 0x64, 0xA0, 0x80, 0x9C, 0x84,
+	 0x03, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0xC6, 0x01, 0x00, 0x60, 0x04, 0x64, 0xA0, 0x80, 0x9C, 0x84,
+	 0x15, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x10, 0x60, 0x14, 0x62, 0xA2, 0xD1, 0x00, 0x60, 0x04, 0x64,
+	 0xA0, 0x80, 0x9C, 0x84, 0x03, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x8B, 0x01, 0x00, 0x60, 0x12, 0x64,
+	 0xA0, 0x80, 0x9C, 0x84, 0x03, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0xAC, 0x01, 0x0F, 0x60, 0xF6, 0x62,
+	 0xA2, 0xD1, 0x02, 0x60, 0x00, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0xAD, 0x03, 0xA0, 0x84, 0xA2, 0xDB,
+	 0x10, 0x67, 0x84, 0xFB, 0x0F, 0x60, 0xF6, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x10, 0x60, 0x14, 0x62,
+	 0x00, 0x64, 0xA2, 0xDB, 0x65, 0xF5, 0xBC, 0xF1, 0x19, 0xF8, 0x81, 0xF1, 0x2C, 0xF8, 0x32, 0xF8,
+	 0x82, 0xF1, 0x2D, 0xF8, 0x33, 0xF8, 0x83, 0xF1, 0x2E, 0xF8, 0x34, 0xF8, 0xEB, 0xF1, 0x2F, 0xF8,
+	 0xEC, 0xF1, 0x30, 0xF8, 0xED, 0xF1, 0x31, 0xF8, 0x11, 0x60, 0x48, 0x64, 0x2A, 0xFA, 0x00, 0x64,
+	 0x2B, 0xFA, 0x23, 0xFA, 0x24, 0x60, 0x74, 0x62, 0x24, 0x60, 0x28, 0x64, 0xA2, 0xDB, 0x66, 0x44,
+	 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0x97, 0xF3, 0xC1, 0xFE, 0xFE, 0xB4,
+	 0x97, 0xFB, 0x0F, 0x60, 0xF8, 0x62, 0x00, 0x60, 0x03, 0x64, 0xA2, 0xDB, 0xE4, 0x60, 0x94, 0x64,
+	 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60, 0xF6, 0x62, 0xA2, 0xD1, 0x00, 0x60,
+	 0x02, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x03, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x29, 0x01, 0x65, 0xF5,
+	 0x23, 0xF2, 0x98, 0xF3, 0x04, 0x18, 0xCC, 0x84, 0x98, 0xFB, 0x01, 0x03, 0x21, 0x01, 0xE1, 0x60,
+	 0x2A, 0x78, 0xFF, 0xFF, 0x27, 0x60, 0xFE, 0x62, 0xA2, 0xD3, 0x84, 0xF1, 0x02, 0xA8, 0x2A, 0xF2,
+	 0x03, 0x02, 0xB0, 0x84, 0x2A, 0xFA, 0x08, 0x00, 0x0F, 0x60, 0xF6, 0x62, 0xA2, 0xD1, 0x00, 0x60,
+	 0x02, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x24, 0x60, 0x74, 0x62, 0x24, 0x60, 0x22, 0x64,
+	 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xC1, 0xFE,
+	 0x24, 0x60, 0x34, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0x00, 0xA8, 0x60, 0x46, 0xDB, 0x02, 0xBF, 0x60,
+	 0xE7, 0x78, 0xFF, 0xFF, 0x0F, 0x60, 0xFC, 0x62, 0xA2, 0xD1, 0x00, 0x60, 0x02, 0x64, 0xB0, 0x84,
+	 0xA2, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x1A, 0x60, 0xAE, 0x63, 0x00, 0x64, 0xA3, 0xDB,
+	 0x06, 0xA3, 0x10, 0x60, 0x5C, 0x64, 0xBD, 0xDB, 0xBD, 0xDB, 0x06, 0x64, 0xA3, 0xDB, 0x10, 0x60,
+	 0x5A, 0x62, 0xE4, 0x60, 0xD2, 0x64, 0xA2, 0xDB, 0x1F, 0x60, 0x5C, 0x62, 0xA2, 0xD1, 0x1A, 0x60,
+	 0xB2, 0x62, 0xA2, 0xD9, 0x10, 0x60, 0x2A, 0x62, 0xE4, 0x60, 0xF9, 0x64, 0xA2, 0xDB, 0x2F, 0x58,
+	 0xFF, 0xFF, 0x2F, 0x58, 0xFF, 0xFF, 0x1F, 0x60, 0x80, 0x65, 0xA5, 0xD3, 0xFF, 0xFF, 0x02, 0xBC,
+	 0xF3, 0xB4, 0x01, 0xB0, 0xA5, 0xDB, 0x0C, 0x02, 0x12, 0x60, 0x26, 0x61, 0x00, 0x64, 0x1A, 0x63,
+	 0x59, 0xDB, 0xFE, 0x1F, 0x1F, 0x60, 0x5C, 0x61, 0x0A, 0x64, 0x1A, 0x63, 0x59, 0xDB, 0xFE, 0x1F,
+	 0x7F, 0xF3, 0x7E, 0xFB, 0x01, 0x64, 0x7F, 0xFB, 0x01, 0x61, 0xCC, 0x84, 0xFF, 0xFF, 0x02, 0x03,
+	 0xE1, 0x81, 0xFB, 0x01, 0xBA, 0xF3, 0x61, 0x45, 0xA4, 0x80, 0xFF, 0xFF, 0x69, 0x03, 0x0F, 0x60,
+	 0xFC, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0xDE, 0xFE, 0x0B, 0x04, 0x0F, 0x60, 0xFE, 0x62, 0x40, 0x60,
+	 0x00, 0x64, 0xA2, 0xDB, 0xE5, 0x60, 0x1F, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x7F, 0xF1, 0x24, 0x60, 0x9A, 0x62, 0xA2, 0xD9, 0x1E, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x2D, 0xFF,
+	 0x0F, 0x60, 0xFE, 0x62, 0x20, 0x60, 0x00, 0x64, 0xA2, 0xDB, 0xE5, 0x60, 0x43, 0x64, 0x5A, 0xDB,
+	 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0xBE, 0xFE, 0x0F, 0x60, 0xD0, 0x62, 0xA2, 0xD1, 0x40, 0x60,
+	 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x0F, 0x60, 0xFC, 0x62, 0x00, 0x64, 0xA2, 0xDB,
+	 0x0F, 0x60, 0xFE, 0x62, 0x00, 0x60, 0x1A, 0x64, 0xA2, 0xDB, 0xE5, 0x60, 0x64, 0x64, 0x5A, 0xDB,
+	 0xCF, 0xFE, 0x24, 0x60, 0xAA, 0x62, 0x1A, 0x60, 0xAE, 0x64, 0xA2, 0xDB, 0x02, 0x64, 0x4A, 0xDB,
+	 0xFF, 0xFF, 0x04, 0xFF, 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60, 0xFC, 0x62, 0xA2, 0xD1, 0x00, 0x60,
+	 0x08, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x0C, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x24, 0x60, 0xAA, 0x62,
+	 0x1A, 0x60, 0xAE, 0x64, 0xA2, 0xDB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x26, 0x00,
+	 0x00, 0x60, 0x10, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x0B, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x24, 0x60,
+	 0xAA, 0x62, 0x1A, 0x60, 0xAE, 0x64, 0xA2, 0xDB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF,
+	 0x12, 0x60, 0x26, 0x65, 0x7F, 0xF3, 0xFF, 0xFF, 0x04, 0xA4, 0xF2, 0xA0, 0xFF, 0xFF, 0x01, 0x06,
+	 0xF1, 0xA4, 0x01, 0x36, 0x0B, 0x00, 0x00, 0x36, 0x04, 0xA4, 0x60, 0x41, 0xE0, 0x84, 0xC4, 0x84,
+	 0xA0, 0xD3, 0xFF, 0xFF, 0x00, 0xB8, 0x61, 0x44, 0xEF, 0x02, 0x75, 0x01, 0x1F, 0x60, 0x80, 0x65,
+	 0xA5, 0xD3, 0x7E, 0xF1, 0xFC, 0xB4, 0xA5, 0xDB, 0x7F, 0xF9, 0x0F, 0x60, 0xFC, 0x62, 0x00, 0x64,
+	 0xA2, 0xDB, 0xDE, 0xFE, 0x0B, 0x04, 0x0F, 0x60, 0xFE, 0x62, 0x40, 0x60, 0x00, 0x64, 0xA2, 0xDB,
+	 0xE5, 0x60, 0xA5, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x7F, 0xF1, 0x24, 0x60,
+	 0x9A, 0x62, 0xA2, 0xD9, 0x1E, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x2D, 0xFF, 0x0F, 0x60, 0xFE, 0x62,
+	 0x20, 0x60, 0x00, 0x64, 0xA2, 0xDB, 0xE5, 0x60, 0xC9, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58,
+	 0xFF, 0xFF, 0xBE, 0xFE, 0x0F, 0x60, 0xD0, 0x62, 0xA2, 0xD1, 0x40, 0x60, 0x00, 0x64, 0xB0, 0x84,
+	 0xA2, 0xDB, 0xCF, 0xFE, 0x0F, 0x60, 0xFC, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x5A, 0xDB, 0x0F, 0x60,
+	 0xD0, 0x62, 0xA2, 0xD1, 0x10, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x2F, 0x58,
+	 0xFF, 0xFF, 0xE6, 0x60, 0xE9, 0x78, 0xFF, 0xFF, 0xE6, 0x60, 0xED, 0x78, 0xFF, 0xFF, 0x1F, 0x60,
+	 0x80, 0x63, 0xA3, 0xD3, 0x26, 0x46, 0x02, 0xB0, 0x3F, 0xF2, 0xF6, 0x03, 0x02, 0x60, 0x00, 0x63,
+	 0x01, 0x60, 0x00, 0x65, 0xD4, 0x80, 0x00, 0xF4, 0x02, 0x24, 0x65, 0x44, 0x12, 0x65, 0x60, 0x41,
+	 0xA5, 0xD0, 0xDA, 0x85, 0x80, 0x3A, 0x02, 0x00, 0x00, 0xF4, 0x04, 0x65, 0x64, 0x44, 0x00, 0x7F,
+	 0xCD, 0x81, 0xBD, 0xDB, 0x05, 0x03, 0x64, 0x47, 0x00, 0x7F, 0xCD, 0x81, 0xBD, 0xDB, 0xF0, 0x02,
+	 0x02, 0x60, 0x14, 0x63, 0xA3, 0xD3, 0xFF, 0xFF, 0x01, 0xB4, 0xFF, 0xFF, 0x37, 0x02, 0x29, 0x60,
+	 0xA4, 0x64, 0xA0, 0xD1, 0x1F, 0x60, 0x0E, 0x63, 0x31, 0x18, 0x64, 0x41, 0x44, 0x4B, 0x29, 0x60,
+	 0xA6, 0x65, 0xA5, 0xD1, 0xDA, 0x85, 0x64, 0x44, 0x00, 0x7F, 0xCD, 0x81, 0xBD, 0xDB, 0x05, 0x03,
+	 0x64, 0x47, 0x00, 0x7F, 0xCD, 0x81, 0xBD, 0xDB, 0xF4, 0x02, 0x02, 0x60, 0x1A, 0x61, 0xA1, 0xD3,
+	 0x2B, 0x45, 0x60, 0x40, 0x00, 0x36, 0x1A, 0x00, 0x01, 0x36, 0x18, 0x00, 0xD4, 0x80, 0x65, 0x43,
+	 0xB0, 0x02, 0x1F, 0x60, 0x0C, 0x64, 0xE3, 0x83, 0xFE, 0xA3, 0x59, 0xD1, 0x58, 0xD3, 0x40, 0x4B,
+	 0xD0, 0x80, 0x2B, 0x44, 0x02, 0x02, 0xF9, 0x1F, 0x09, 0x00, 0x02, 0x60, 0x1A, 0x61, 0x65, 0x43,
+	 0xE3, 0x83, 0xFE, 0xA3, 0x59, 0xD3, 0xFF, 0xFF, 0x9C, 0x1B, 0xFC, 0x1F, 0x26, 0x46, 0x3F, 0xF0,
+	 0x01, 0x60, 0x00, 0x64, 0xD0, 0x80, 0x64, 0x41, 0x01, 0x05, 0x60, 0x41, 0xF4, 0xA1, 0x02, 0x60,
+	 0x18, 0x63, 0xBD, 0xD3, 0xBD, 0xD1, 0xFD, 0xA0, 0xF9, 0xA0, 0x08, 0x03, 0x35, 0x03, 0xFE, 0xA1,
+	 0x64, 0x42, 0xE2, 0x85, 0xD1, 0x81, 0xC7, 0x83, 0x84, 0x06, 0xF3, 0x01, 0x12, 0x60, 0x26, 0x65,
+	 0xBD, 0xD3, 0xFD, 0xA1, 0xE0, 0x84, 0xC4, 0x85, 0x05, 0x64, 0xA5, 0xDB, 0x1F, 0x60, 0x80, 0x65,
+	 0xA5, 0xD3, 0x41, 0x48, 0x04, 0xBC, 0xA5, 0xDB, 0x12, 0x60, 0x28, 0x65, 0x12, 0x60, 0x44, 0x61,
+	 0x49, 0xD3, 0xD6, 0x80, 0x00, 0xB8, 0x0E, 0x03, 0xFB, 0x03, 0x62, 0x45, 0x12, 0x60, 0x26, 0x61,
+	 0x59, 0xD3, 0xD6, 0x80, 0x00, 0xB8, 0x06, 0x03, 0xFB, 0x03, 0x05, 0x64, 0xA2, 0xDB, 0xD6, 0x80,
+	 0x02, 0xA2, 0xFC, 0x02, 0x0F, 0x60, 0xFC, 0x62, 0xA2, 0xD1, 0x00, 0x60, 0x10, 0x64, 0xB0, 0x84,
+	 0xA2, 0xDB, 0xCF, 0xFE, 0x28, 0x41, 0xC5, 0x01, 0x63, 0x45, 0x04, 0x60, 0x00, 0x63, 0xD7, 0x83,
+	 0xEB, 0x83, 0xD3, 0x80, 0x65, 0x43, 0x01, 0x05, 0x54, 0x00, 0xFE, 0xA3, 0x43, 0x4B, 0xA3, 0xD3,
+	 0x63, 0x41, 0x60, 0x43, 0x1B, 0x60, 0xC6, 0x64, 0xA0, 0xDD, 0xE3, 0x83, 0xFE, 0xA3, 0x59, 0xD1,
+	 0x58, 0xD9, 0xFD, 0x1F, 0x00, 0x63, 0x58, 0xDD, 0x2B, 0x43, 0xBD, 0xD1, 0x1F, 0x60, 0x78, 0x64,
+	 0x64, 0x41, 0xBD, 0xD1, 0x58, 0xD9, 0xBD, 0xD1, 0xFC, 0xA1, 0x41, 0x4B, 0x58, 0xD9, 0xBD, 0xD1,
+	 0xA0, 0xD9, 0x12, 0x60, 0x26, 0x61, 0x12, 0x60, 0x42, 0x65, 0x00, 0x64, 0xD5, 0x80, 0x59, 0xDB,
+	 0xFD, 0x02, 0x12, 0x60, 0x24, 0x65, 0xBD, 0xD3, 0xA3, 0xD1, 0xE0, 0x84, 0xC4, 0x82, 0x12, 0x60,
+	 0x44, 0x65, 0x05, 0x64, 0x64, 0x41, 0x5A, 0xDB, 0xD6, 0x80, 0xCD, 0x81, 0x22, 0x03, 0xFB, 0x02,
+	 0x1F, 0x60, 0x5A, 0x61, 0x4B, 0xD1, 0x04, 0xA3, 0xBD, 0xD3, 0xFF, 0xFF, 0xF6, 0xA0, 0xC1, 0x82,
+	 0x05, 0x05, 0x64, 0x41, 0x5A, 0xDB, 0xCD, 0x81, 0xFF, 0xFF, 0xFC, 0x02, 0x2B, 0x41, 0xFD, 0xA1,
+	 0x41, 0x4B, 0xDF, 0x07, 0x0F, 0x60, 0xFC, 0x62, 0xA2, 0xD1, 0x00, 0x60, 0x08, 0x64, 0xB0, 0x84,
+	 0xA2, 0xDB, 0xCF, 0xFE, 0x1F, 0x60, 0x80, 0x65, 0xA5, 0xD3, 0xFF, 0xFF, 0x08, 0xBC, 0xA5, 0xDB,
+	 0xFF, 0xFF, 0x20, 0xFE, 0x26, 0x46, 0x2F, 0x58, 0xFF, 0xFF, 0x20, 0xFE, 0x9A, 0xFF, 0x5C, 0x61,
+	 0x3F, 0xF2, 0xFF, 0xFF, 0x83, 0xA0, 0xFF, 0xFF, 0x04, 0x28, 0x39, 0x00, 0xF4, 0xA4, 0x60, 0x43,
+	 0x00, 0xF4, 0x1E, 0x62, 0x60, 0xFE, 0xA2, 0xD2, 0xFF, 0xFF, 0x60, 0x40, 0x85, 0x36, 0x10, 0x00,
+	 0xDE, 0x82, 0xA2, 0xD2, 0xFF, 0xFF, 0x20, 0xFE, 0xFF, 0xB4, 0x02, 0xA4, 0x53, 0x93, 0x51, 0x91,
+	 0x05, 0x0E, 0xFF, 0xA4, 0x42, 0x92, 0x63, 0x40, 0x61, 0x40, 0xEC, 0x1C, 0x98, 0xFF, 0xD9, 0x01,
+	 0x20, 0xFE, 0x05, 0x64, 0x00, 0x7C, 0x42, 0x92, 0x60, 0xFE, 0xDE, 0x82, 0xA2, 0xD2, 0xDE, 0x82,
+	 0xA2, 0xD0, 0xFF, 0xFF, 0x20, 0xFE, 0x64, 0x5F, 0x60, 0x43, 0x60, 0xFE, 0xDE, 0x82, 0xA2, 0xD2,
+	 0xDE, 0x82, 0xA2, 0xD0, 0xFF, 0xFF, 0x20, 0xFE, 0x64, 0x5F, 0x98, 0xFF, 0x01, 0xA3, 0x01, 0xA4,
+	 0x2D, 0x60, 0x5A, 0x62, 0xA2, 0xDD, 0x2D, 0x60, 0x5E, 0x62, 0xA2, 0xDB, 0xBA, 0x01, 0x98, 0xFF,
+	 0xB8, 0x01, 0x00, 0x60, 0xA0, 0x61, 0xAE, 0x60, 0x58, 0x4D, 0xC4, 0x78, 0xFF, 0xFF, 0x66, 0x44,
+	 0x5D, 0xFB, 0x04, 0x64, 0x03, 0xFA, 0x80, 0x64, 0x2A, 0xFA, 0xCC, 0xF1, 0x19, 0xF8, 0x00, 0x64,
+	 0x3E, 0xFA, 0x00, 0x60, 0x80, 0x64, 0x0E, 0xFA, 0xA9, 0xF1, 0x07, 0xF8, 0x67, 0x44, 0x2C, 0xFA,
+	 0x2D, 0xFA, 0x2E, 0xFA, 0x10, 0x60, 0x1C, 0x62, 0xE8, 0x60, 0xDF, 0x64, 0xA2, 0xDB, 0x2F, 0x58,
+	 0xFF, 0xFF, 0x5D, 0xF5, 0xEB, 0xF1, 0x2F, 0xF8, 0xEC, 0xF1, 0x30, 0xF8, 0xED, 0xF1, 0x31, 0xF8,
+	 0x81, 0xF1, 0x32, 0xF8, 0x82, 0xF1, 0x33, 0xF8, 0x83, 0xF1, 0x34, 0xF8, 0x28, 0x60, 0x2C, 0x62,
+	 0xA2, 0xD1, 0x02, 0x64, 0x64, 0x40, 0xFE, 0x26, 0x10, 0xBC, 0x32, 0x40, 0x08, 0x26, 0x10, 0xBC,
+	 0x2F, 0x60, 0x44, 0x62, 0xA2, 0xDB, 0x28, 0x60, 0x2A, 0x62, 0xA2, 0xD1, 0x2D, 0x60, 0x7A, 0x64,
+	 0x02, 0x18, 0x27, 0x60, 0xDA, 0x64, 0x2E, 0x60, 0xAE, 0x62, 0xA2, 0xDB, 0x2E, 0x60, 0xCA, 0x62,
+	 0xA2, 0xDB, 0x2D, 0x60, 0xA6, 0x61, 0x28, 0x60, 0xCC, 0x62, 0xA2, 0xD3, 0x2E, 0x60, 0x96, 0x65,
+	 0xFE, 0xA4, 0xE0, 0x84, 0x02, 0x05, 0x67, 0x44, 0x99, 0x00, 0xE0, 0x84, 0xC4, 0x85, 0x2D, 0x60,
+	 0xCC, 0x62, 0xA2, 0xD3, 0xA5, 0xD1, 0xDA, 0x85, 0x2D, 0x60, 0xC4, 0x62, 0xA0, 0x83, 0xA2, 0xDD,
+	 0xA5, 0xD1, 0x2D, 0x60, 0xC2, 0x62, 0xA0, 0x83, 0xA2, 0xDD, 0x2D, 0x60, 0xA0, 0x61, 0xDD, 0x60,
+	 0x06, 0x64, 0xA1, 0xDB, 0x06, 0xA1, 0x2D, 0x60, 0xCA, 0x62, 0xA2, 0xD3, 0x2D, 0x60, 0xC2, 0x62,
+	 0x60, 0x40, 0xFD, 0xA0, 0xA2, 0xD3, 0x74, 0x03, 0x50, 0x60, 0x00, 0x7C, 0x60, 0x40, 0x02, 0x2A,
+	 0x03, 0x00, 0x01, 0x60, 0xF2, 0x63, 0x0E, 0x00, 0x04, 0x2A, 0x03, 0x00, 0x02, 0x60, 0xF2, 0x63,
+	 0x09, 0x00, 0x10, 0x2A, 0x03, 0x00, 0x04, 0x60, 0xF2, 0x63, 0x04, 0x00, 0x20, 0x2A, 0x04, 0x00,
+	 0x05, 0x60, 0xF2, 0x63, 0x59, 0xD9, 0x59, 0xDD, 0x2D, 0x60, 0xCA, 0x62, 0xA2, 0xD3, 0x2D, 0x60,
+	 0xC4, 0x62, 0xFE, 0xA0, 0xA2, 0xD3, 0x54, 0x03, 0x00, 0x60, 0x00, 0x63, 0x59, 0xDD, 0x61, 0x45,
+	 0x60, 0x40, 0x01, 0x2A, 0x04, 0x00, 0x00, 0x60, 0xF2, 0x63, 0x59, 0xD9, 0x59, 0xDD, 0x60, 0x40,
+	 0x02, 0x2A, 0x04, 0x00, 0x01, 0x60, 0xF2, 0x63, 0x59, 0xD9, 0x59, 0xDD, 0x60, 0x40, 0x04, 0x2A,
+	 0x04, 0x00, 0x02, 0x60, 0xF2, 0x63, 0x59, 0xD9, 0x59, 0xDD, 0x60, 0x40, 0x10, 0x2A, 0x04, 0x00,
+	 0x04, 0x60, 0xF2, 0x63, 0x59, 0xD9, 0x59, 0xDD, 0x60, 0x40, 0x20, 0x2A, 0x04, 0x00, 0x05, 0x60,
+	 0xF2, 0x63, 0x59, 0xD9, 0x59, 0xDD, 0xD5, 0x83, 0xEB, 0x83, 0xEB, 0x83, 0xA5, 0xDD, 0x2D, 0x60,
+	 0xCA, 0x62, 0xA2, 0xD3, 0x2D, 0x60, 0xC6, 0x62, 0xFF, 0xA0, 0xA2, 0xD3, 0x21, 0x03, 0x00, 0x60,
+	 0x00, 0x63, 0x59, 0xDD, 0x61, 0x45, 0x60, 0x40, 0x01, 0x2A, 0x04, 0x00, 0x00, 0x60, 0xF2, 0x63,
+	 0x59, 0xD9, 0x59, 0xDD, 0x60, 0x40, 0x02, 0x2A, 0x04, 0x00, 0x01, 0x60, 0xF2, 0x63, 0x59, 0xD9,
+	 0x59, 0xDD, 0x60, 0x40, 0x04, 0x2A, 0x04, 0x00, 0x02, 0x60, 0xF2, 0x63, 0x59, 0xD9, 0x59, 0xDD,
+	 0xD5, 0x83, 0xEB, 0x83, 0xEB, 0x83, 0xA5, 0xDD, 0x2D, 0x60, 0xC8, 0x62, 0xA2, 0xD1, 0x59, 0xD9,
+	 0x2D, 0x60, 0xA0, 0x65, 0xD5, 0x84, 0xDD, 0x7F, 0xA5, 0xDB, 0x65, 0x44, 0x2E, 0x60, 0xB8, 0x62,
+	 0xA2, 0xDB, 0x2E, 0x60, 0xD4, 0x62, 0xA2, 0xDB, 0x0F, 0x60, 0xD4, 0x62, 0x00, 0x60, 0x04, 0x64,
+	 0xA2, 0xDB, 0xE8, 0x60, 0x2F, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60,
+	 0xD2, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x7F, 0xF1, 0x2F, 0x60, 0x0E, 0x62, 0xA2, 0xD9, 0x2E, 0x60,
+	 0xB6, 0x65, 0xE9, 0x60, 0x58, 0x4D, 0x32, 0x78, 0xFF, 0xFF, 0x5D, 0xF5, 0x00, 0xF4, 0x80, 0xF1,
+	 0x06, 0xF8, 0x2F, 0x60, 0x44, 0x62, 0xA2, 0xD3, 0x07, 0xFA, 0x2E, 0x60, 0xAE, 0x64, 0x40, 0x48,
+	 0x10, 0x61, 0x00, 0x60, 0x00, 0x64, 0xE8, 0x60, 0x58, 0x4D, 0xE8, 0x78, 0xFF, 0xFF, 0x5D, 0xF5,
+	 0x3F, 0xFC, 0xDB, 0xFE, 0x24, 0x60, 0x74, 0x62, 0x24, 0x60, 0x28, 0x64, 0xA2, 0xDB, 0x66, 0x44,
+	 0x5A, 0xDB, 0x04, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xC1, 0xFE, 0x2F, 0x58, 0xFF, 0xFF,
+	 0xDC, 0xF3, 0x9B, 0xFE, 0xFD, 0xA0, 0x25, 0x04, 0x24, 0x02, 0x04, 0x64, 0x03, 0xFA, 0x00, 0xF4,
+	 0x09, 0xF2, 0xFF, 0xFF, 0x60, 0x47, 0x00, 0x3A, 0x1C, 0x00, 0x60, 0x43, 0x00, 0x36, 0x1C, 0x00,
+	 0xE0, 0xA0, 0xDA, 0x85, 0x16, 0x07, 0x2D, 0x60, 0x7A, 0x61, 0xA1, 0xD1, 0xFF, 0xFF, 0xD3, 0x80,
+	 0xCB, 0x83, 0x0F, 0x02, 0x07, 0x0E, 0x59, 0xD3, 0xA5, 0xD0, 0xDA, 0x85, 0xD0, 0x80, 0xFF, 0xFF,
+	 0x08, 0x02, 0xF9, 0x1F, 0x13, 0x1E, 0xA5, 0xD0, 0x59, 0xD3, 0xFF, 0xFF, 0x90, 0x80, 0xFF, 0x22,
+	 0x0D, 0x00, 0xE8, 0x60, 0xDD, 0x78, 0xFF, 0xFF, 0x28, 0x60, 0x2A, 0x62, 0xA2, 0xD3, 0xFF, 0xFF,
+	 0x60, 0x40, 0x01, 0x2A, 0x03, 0x00, 0x27, 0x60, 0xDA, 0x64, 0x02, 0x00, 0x2D, 0x60, 0x7A, 0x64,
+	 0x2E, 0x60, 0xCA, 0x62, 0xA2, 0xDB, 0x26, 0x46, 0x2F, 0xF2, 0x2C, 0xFA, 0x30, 0xF2, 0x2D, 0xFA,
+	 0x31, 0xF2, 0x2E, 0xFA, 0xEB, 0xF1, 0x2F, 0xF8, 0xEC, 0xF1, 0x30, 0xF8, 0xED, 0xF1, 0x31, 0xF8,
+	 0x81, 0xF1, 0x32, 0xF8, 0x82, 0xF1, 0x33, 0xF8, 0x83, 0xF1, 0x34, 0xF8, 0x50, 0x63, 0x2A, 0xFC,
+	 0xCC, 0xF3, 0x19, 0xFA, 0x00, 0x64, 0x3E, 0xFA, 0xA9, 0xF3, 0x07, 0xFA, 0x00, 0xF4, 0x80, 0xF1,
+	 0x06, 0xF8, 0x2F, 0x60, 0x44, 0x62, 0xA2, 0xD3, 0x07, 0xFA, 0x2E, 0x60, 0xD2, 0x65, 0xE9, 0x60,
+	 0x58, 0x4D, 0x32, 0x78, 0xFF, 0xFF, 0x2E, 0x60, 0xCA, 0x64, 0x40, 0x48, 0x10, 0x61, 0x00, 0x60,
+	 0x00, 0x64, 0xE8, 0x60, 0x58, 0x4D, 0xE8, 0x78, 0xFF, 0xFF, 0x26, 0x46, 0x3F, 0xFC, 0x24, 0x60,
+	 0x74, 0x62, 0x24, 0x60, 0x28, 0x64, 0xA2, 0xDB, 0x26, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB,
+	 0xFF, 0xFF, 0x2B, 0xFF, 0xC1, 0xFE, 0x00, 0x66, 0x46, 0x46, 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60,
+	 0xD2, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x5A, 0xDB, 0x00, 0x64, 0x94, 0xFB, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x2F, 0x60, 0x46, 0x62, 0xA2, 0xDB, 0xCD, 0x81, 0x28, 0xD3, 0x5A, 0x88, 0xDC, 0x83, 0x39, 0x18,
+	 0xFB, 0x03, 0x61, 0x40, 0x7F, 0x3A, 0x07, 0x00, 0x2F, 0x60, 0x46, 0x62, 0xA2, 0xD3, 0x03, 0x61,
+	 0x7C, 0xA4, 0xA2, 0xDB, 0x00, 0xF4, 0x60, 0xFE, 0xA3, 0xD1, 0xDD, 0x81, 0xA1, 0xD8, 0x61, 0x40,
+	 0x7F, 0x3A, 0x09, 0x00, 0x20, 0xFE, 0x2F, 0x60, 0x46, 0x62, 0xA2, 0xD3, 0x03, 0x61, 0x7C, 0xA4,
+	 0xA2, 0xDB, 0x00, 0xF4, 0x60, 0xFE, 0xCF, 0x83, 0xA3, 0xD3, 0xDD, 0x81, 0xA1, 0xDA, 0xFF, 0xB4,
+	 0x00, 0x7F, 0x15, 0x03, 0xDB, 0x83, 0x61, 0x40, 0x7F, 0x3A, 0x0B, 0x00, 0x20, 0xFE, 0x60, 0x45,
+	 0x2F, 0x60, 0x46, 0x62, 0xA2, 0xD3, 0x03, 0x61, 0x7C, 0xA4, 0xA2, 0xDB, 0x65, 0x44, 0x00, 0xF4,
+	 0x60, 0xFE, 0xA3, 0xD1, 0xDF, 0x83, 0xDD, 0x81, 0xCC, 0x84, 0xA1, 0xD8, 0xEC, 0x02, 0x20, 0xFE,
+	 0xC3, 0x01, 0x2F, 0x60, 0x46, 0x62, 0xA2, 0xD1, 0xFD, 0xA1, 0xFF, 0xB1, 0xC1, 0x83, 0xA2, 0xDD,
+	 0x2D, 0x58, 0xFF, 0xFF, 0x67, 0x5C, 0x1B, 0x60, 0xC6, 0x61, 0xA1, 0xD3, 0xA5, 0xD9, 0x12, 0x18,
+	 0x60, 0x43, 0x2F, 0x60, 0x14, 0x64, 0xA5, 0xDB, 0x60, 0xFE, 0xA0, 0xDD, 0xFF, 0xFF, 0x20, 0xFE,
+	 0xDC, 0x84, 0xCF, 0x83, 0xE3, 0x83, 0x59, 0xD1, 0xDC, 0x84, 0x60, 0xFE, 0xA0, 0xD9, 0xFF, 0xFF,
+	 0x20, 0xFE, 0xF9, 0x1F, 0x2D, 0x58, 0xFF, 0xFF, 0x0E, 0x57, 0x32, 0x40, 0x40, 0x26, 0x29, 0x00,
+	 0x45, 0x48, 0x00, 0x60, 0x10, 0x61, 0xAE, 0x60, 0x58, 0x4D, 0xC4, 0x78, 0xFF, 0xFF, 0x21, 0x03,
+	 0xF2, 0x60, 0x02, 0x64, 0x24, 0xFA, 0x00, 0x60, 0x48, 0x61, 0x28, 0x44, 0x59, 0xDA, 0x03, 0x64,
+	 0x38, 0x43, 0xBD, 0xD1, 0xCC, 0x84, 0x59, 0xD8, 0xFC, 0x02, 0x39, 0x44, 0x59, 0xDA, 0x28, 0x60,
+	 0x2E, 0x64, 0xA0, 0xD3, 0x59, 0xDA, 0x07, 0x64, 0x23, 0xFA, 0x24, 0x60, 0x74, 0x62, 0x24, 0x60,
+	 0x64, 0x64, 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF,
+	 0xFA, 0xFE, 0x37, 0x58, 0xFF, 0xFF, 0x0E, 0x57, 0x32, 0x40, 0x40, 0x26, 0x1C, 0x00, 0x45, 0x48,
+	 0x00, 0x60, 0x06, 0x61, 0xAE, 0x60, 0x58, 0x4D, 0xC4, 0x78, 0xFF, 0xFF, 0x14, 0x03, 0x02, 0x64,
+	 0x23, 0xFA, 0xF2, 0x60, 0x00, 0x64, 0x5A, 0xDA, 0x28, 0x44, 0x5A, 0xDA, 0xFF, 0xFF, 0x24, 0x60,
+	 0x74, 0x62, 0x24, 0x60, 0x64, 0x64, 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB,
+	 0xFF, 0xFF, 0x2B, 0xFF, 0xFA, 0xFE, 0x37, 0x58, 0xFF, 0xFF, 0xA2, 0xFF, 0x32, 0x40, 0x40, 0x26,
+	 0x3E, 0x00, 0x9D, 0xF3, 0x67, 0x43, 0xDC, 0x84, 0xCC, 0x84, 0x39, 0x03, 0x60, 0x46, 0x0A, 0x02,
+	 0x9D, 0xFD, 0x00, 0x60, 0x46, 0x61, 0xAE, 0x60, 0x58, 0x4D, 0xC4, 0x78, 0xFF, 0xFF, 0x66, 0x44,
+	 0x9D, 0xFB, 0x2E, 0x03, 0x46, 0x4B, 0x27, 0x60, 0x72, 0x61, 0x18, 0x64, 0x23, 0xFA, 0xF1, 0x60,
+	 0x00, 0x64, 0x24, 0xFA, 0x4A, 0x65, 0xA2, 0xFF, 0x2C, 0x63, 0x00, 0x64, 0x59, 0xD1, 0xA2, 0xDB,
+	 0xA5, 0xD8, 0xDA, 0x85, 0x80, 0x3A, 0x02, 0x00, 0x00, 0xF4, 0x04, 0x65, 0xF7, 0x1F, 0x12, 0x63,
+	 0x59, 0xD1, 0xA5, 0xD8, 0xDA, 0x85, 0x80, 0x3A, 0x02, 0x00, 0x00, 0xF4, 0x04, 0x65, 0xF8, 0x1F,
+	 0x24, 0x60, 0x74, 0x62, 0x24, 0x60, 0x64, 0x64, 0xA2, 0xDB, 0x2B, 0x44, 0x5A, 0xDB, 0x02, 0x64,
+	 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xFA, 0xFE, 0xA6, 0xFE, 0x00, 0x64, 0x9D, 0xFB, 0xA3, 0xFF,
+	 0xBF, 0x60, 0xE7, 0x78, 0xFF, 0xFF, 0xA6, 0xFE, 0xB8, 0x05, 0xA7, 0xFE, 0x12, 0x05, 0xA5, 0xFE,
+	 0x03, 0x04, 0xEA, 0x60, 0xC5, 0x78, 0xFF, 0xFF, 0xA4, 0xFE, 0xF2, 0x04, 0x0F, 0x60, 0xDE, 0x62,
+	 0xA2, 0xD1, 0x00, 0x60, 0x80, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0xBF, 0x60, 0xE7, 0x78,
+	 0xFF, 0xFF, 0x36, 0x45, 0x20, 0x60, 0x08, 0x64, 0x44, 0xD7, 0xFF, 0xFF, 0xFF, 0xFF, 0x9F, 0xF3,
+	 0xFF, 0xFF, 0x01, 0xB0, 0x00, 0x64, 0x41, 0x03, 0x9F, 0xFB, 0x31, 0x44, 0xE8, 0xB4, 0x40, 0x51,
+	 0x6A, 0x44, 0xFF, 0xFF, 0x80, 0x26, 0xFC, 0x01, 0x61, 0xFF, 0x62, 0xFF, 0x10, 0x60, 0x1A, 0x62,
+	 0xA2, 0xD1, 0x00, 0x60, 0x20, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x34, 0x60, 0x58, 0x4E,
+	 0x64, 0x78, 0xFF, 0xFF, 0x1E, 0x60, 0xBC, 0x62, 0x1E, 0x60, 0xBE, 0x64, 0xA2, 0xDB, 0x00, 0x64,
+	 0x4A, 0xDB, 0x01, 0x60, 0xFE, 0x63, 0x1C, 0x60, 0xB8, 0x61, 0x00, 0x64, 0x59, 0xDB, 0xFE, 0x1F,
+	 0x1C, 0x63, 0x10, 0x60, 0x5C, 0x64, 0x58, 0xD1, 0xFF, 0xFF, 0x08, 0x1B, 0xFC, 0x1F, 0x00, 0x60,
+	 0x62, 0x63, 0x1B, 0x60, 0xC4, 0x64, 0x00, 0x7C, 0x58, 0xD9, 0xFE, 0x1F, 0x1C, 0x60, 0xB4, 0x63,
+	 0xA3, 0xD3, 0xFF, 0xFF, 0x04, 0xB0, 0xFF, 0xFF, 0x05, 0x03, 0x02, 0x65, 0xE9, 0x60, 0x58, 0x4E,
+	 0x7B, 0x78, 0xFF, 0xFF, 0xBF, 0x60, 0xE7, 0x78, 0xFF, 0xFF, 0xEA, 0x60, 0xC5, 0x78, 0xFF, 0xFF,
+	 0x0F, 0x60, 0xEA, 0x62, 0xA2, 0xD1, 0x00, 0x60, 0x01, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE,
+	 0x74, 0x00, 0x28, 0x60, 0x50, 0x63, 0xBD, 0xD3, 0xBD, 0xD1, 0xBD, 0xD1, 0xB0, 0x84, 0xB0, 0x84,
+	 0xFF, 0xFF, 0x07, 0x02, 0x8C, 0xFB, 0x31, 0x44, 0xFE, 0xB4, 0x40, 0x51, 0x0D, 0x64, 0x05, 0xFB,
+	 0x64, 0x00, 0x28, 0xF3, 0x9F, 0xF1, 0x60, 0x47, 0x64, 0x41, 0x07, 0xB1, 0x07, 0xB4, 0x08, 0x24,
+	 0x67, 0x4C, 0x50, 0xFB, 0x01, 0x61, 0x03, 0x03, 0xCC, 0x84, 0xE1, 0x81, 0xFD, 0x02, 0xA1, 0x80,
+	 0xB1, 0x83, 0x53, 0x02, 0x9F, 0xFD, 0x28, 0x60, 0x44, 0x62, 0xA2, 0xD3, 0xE5, 0xFB, 0x7F, 0xFB,
+	 0x24, 0x60, 0x5E, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0x00, 0xA8, 0x60, 0x46, 0x46, 0x5E, 0x31, 0x44,
+	 0x01, 0xBC, 0x40, 0x51, 0xD8, 0xF3, 0x01, 0x63, 0x03, 0xA8, 0x4E, 0xFD, 0x05, 0x02, 0x02, 0x63,
+	 0x14, 0x60, 0x00, 0x64, 0xDB, 0xFB, 0x0C, 0x00, 0x02, 0xA8, 0x01, 0x63, 0x03, 0x03, 0x0A, 0x60,
+	 0x00, 0x64, 0x03, 0x00, 0x02, 0x63, 0x14, 0x60, 0x00, 0x64, 0xDB, 0xFB, 0x00, 0x64, 0x4E, 0xFB,
+	 0x4B, 0xFD, 0xA9, 0xF5, 0xFF, 0xFF, 0x0E, 0xF0, 0x0F, 0x60, 0xA2, 0x65, 0x28, 0x60, 0xD2, 0x62,
+	 0xA2, 0xD3, 0xFF, 0xFF, 0xFE, 0xA0, 0x03, 0xA8, 0x11, 0x06, 0x79, 0xF1, 0x06, 0x02, 0x64, 0x44,
+	 0x08, 0x2A, 0x09, 0x00, 0x06, 0x64, 0x44, 0xD3, 0x0D, 0x00, 0x64, 0x44, 0x20, 0x2A, 0x03, 0x00,
+	 0x0A, 0x64, 0x44, 0xD3, 0x07, 0x00, 0x01, 0x64, 0x44, 0xD3, 0x04, 0x00, 0xE8, 0x84, 0xE0, 0x84,
+	 0x44, 0xD3, 0x00, 0x00, 0x0E, 0xFA, 0xED, 0xE2, 0x0F, 0x4E, 0xC8, 0x60, 0x58, 0x4F, 0x15, 0x78,
+	 0xFF, 0xFF, 0x0E, 0x4F, 0xBF, 0x60, 0xE7, 0x78, 0xFF, 0xFF, 0xD7, 0xFE, 0xBF, 0x60, 0xE7, 0x78,
+	 0xFF, 0xFF, 0x0F, 0x60, 0xEA, 0x62, 0xA2, 0xD1, 0x00, 0x60, 0x02, 0x64, 0xB0, 0x84, 0xA2, 0xDB,
+	 0xCF, 0xFE, 0xF3, 0x01, 0x24, 0x60, 0x46, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0x00, 0xA8, 0x60, 0x46,
+	 0x0E, 0xF2, 0x4D, 0x03, 0x60, 0x40, 0xF0, 0x37, 0x3A, 0x00, 0xFF, 0x37, 0x2F, 0x00, 0xFD, 0x37,
+	 0x27, 0x00, 0xF8, 0x37, 0x0A, 0x00, 0x60, 0x47, 0xFF, 0xB5, 0x0F, 0x60, 0xD2, 0x62, 0x46, 0xD1,
+	 0x00, 0x60, 0x01, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x24, 0x60, 0x74, 0x62, 0x00, 0x64,
+	 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xDA, 0x01,
+	 0x06, 0xB4, 0xFD, 0x7F, 0x0E, 0xFA, 0x24, 0x60, 0x74, 0x62, 0x24, 0x60, 0x4C, 0x64, 0xA2, 0xDB,
+	 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xF9, 0xFE, 0xCA, 0x01,
+	 0x23, 0xF0, 0x60, 0x40, 0x04, 0x26, 0xEC, 0x1B, 0x02, 0x26, 0xEA, 0x18, 0xA2, 0xFF, 0x02, 0xF0,
+	 0x09, 0x60, 0x08, 0x64, 0xD0, 0x80, 0xB0, 0xF3, 0x02, 0x02, 0xCC, 0x84, 0xB0, 0xFB, 0x24, 0x60,
+	 0x74, 0x64, 0x40, 0x4B, 0x2C, 0x60, 0x58, 0x4D, 0xD8, 0x78, 0xFF, 0xFF, 0xB3, 0x01, 0xAC, 0xFE,
+	 0x09, 0x05, 0xAD, 0xFE, 0x10, 0x05, 0xAE, 0xFE, 0xAD, 0x05, 0xAF, 0xFE, 0x3A, 0x05, 0xBF, 0x60,
+	 0xE7, 0x78, 0xFF, 0xFF, 0x0F, 0x60, 0xD0, 0x62, 0xA2, 0xD1, 0x20, 0x60, 0x00, 0x64, 0xB0, 0x84,
+	 0xA2, 0xDB, 0xCF, 0xFE, 0xF4, 0x01, 0x10, 0x60, 0x32, 0x65, 0x0B, 0x61, 0x07, 0x00, 0xA2, 0xDD,
+	 0x58, 0x4F, 0x64, 0x58, 0xFF, 0xFF, 0x00, 0xB9, 0xFF, 0xFF, 0x08, 0x03, 0x00, 0x63, 0xA5, 0xD1,
+	 0x5A, 0xD3, 0xDA, 0x85, 0x00, 0xA8, 0xCD, 0x81, 0xF2, 0x02, 0xF8, 0x02, 0xE0, 0x01, 0x0F, 0x60,
+	 0xCE, 0x62, 0x10, 0x60, 0x12, 0x65, 0xEB, 0x60, 0x5F, 0x63, 0x00, 0x64, 0x5A, 0xDB, 0xD6, 0x80,
+	 0xFF, 0xFF, 0x04, 0x03, 0x5A, 0xDB, 0x5A, 0xDB, 0x5A, 0xDD, 0xF9, 0x01, 0x10, 0x60, 0x30, 0x65,
+	 0x00, 0x64, 0x5A, 0xDB, 0xD6, 0x80, 0xFF, 0xFF, 0x02, 0x03, 0x5A, 0xDD, 0xFB, 0x01, 0x2F, 0x58,
+	 0xFF, 0xFF, 0x0F, 0x60, 0xD2, 0x64, 0x40, 0x41, 0x0F, 0x60, 0xD0, 0x63, 0xA3, 0xD1, 0x00, 0x64,
+	 0xD0, 0x80, 0x0B, 0x61, 0x08, 0x03, 0xBD, 0xDB, 0xA3, 0xD3, 0xFF, 0xFF, 0xB0, 0x84, 0xCD, 0x81,
+	 0xA3, 0xDB, 0x06, 0xA3, 0xF9, 0x02, 0x10, 0x60, 0x1A, 0x63, 0xA3, 0xD1, 0x00, 0x64, 0xD0, 0x80,
+	 0x0C, 0x61, 0x19, 0x03, 0xBD, 0xDB, 0x64, 0x44, 0xFE, 0xA3, 0x02, 0xA3, 0xCD, 0x81, 0xE8, 0x84,
+	 0xE3, 0x03, 0x02, 0x05, 0xE1, 0x03, 0xF9, 0x01, 0x99, 0xFB, 0x9B, 0xFD, 0x61, 0x5C, 0xA3, 0xD3,
+	 0x9A, 0xF9, 0x03, 0x18, 0x58, 0x4F, 0x60, 0x58, 0xFF, 0xFF, 0x9B, 0xF3, 0x9A, 0xF1, 0x60, 0x43,
+	 0x99, 0xF3, 0x64, 0x41, 0xEA, 0x01, 0x21, 0x43, 0x10, 0x60, 0x14, 0x65, 0xD7, 0x80, 0xBD, 0xD1,
+	 0xBD, 0xD3, 0x03, 0x02, 0xBF, 0x60, 0xE7, 0x78, 0xFF, 0xFF, 0xA0, 0x84, 0xBD, 0xD1, 0x43, 0x41,
+	 0xF5, 0x03, 0xEB, 0x60, 0x64, 0x64, 0x64, 0x58, 0x40, 0x4F, 0x2A, 0xF0, 0x83, 0x60, 0xFF, 0x65,
+	 0x64, 0x47, 0x03, 0x2B, 0x01, 0x00, 0x14, 0x00, 0x03, 0x26, 0x03, 0xAC, 0x60, 0x47, 0xA4, 0x84,
+	 0x2A, 0xFA, 0x2F, 0xF2, 0x2C, 0xFA, 0x30, 0xF2, 0x2D, 0xFA, 0x31, 0xF2, 0x2E, 0xFA, 0x64, 0x41,
+	 0xEB, 0xF3, 0x2F, 0xFA, 0x60, 0x43, 0xEC, 0xF3, 0x30, 0xFA, 0xED, 0xF1, 0x31, 0xF8, 0x19, 0x00,
+	 0x60, 0x47, 0xA4, 0x84, 0x2A, 0xFA, 0x2F, 0xF2, 0x2C, 0xFA, 0x30, 0xF2, 0x2D, 0xFA, 0x31, 0xF2,
+	 0x2E, 0xFA, 0x36, 0xF2, 0x32, 0xFA, 0x37, 0xF2, 0x33, 0xFA, 0x38, 0xF2, 0x34, 0xFA, 0xEB, 0xF3,
+	 0x2F, 0xFA, 0x36, 0xFA, 0xEC, 0xF3, 0x30, 0xFA, 0x37, 0xFA, 0xED, 0xF3, 0x31, 0xFA, 0x38, 0xFA,
+	 0x64, 0x41, 0x1C, 0xF2, 0x13, 0xFA, 0x00, 0xF4, 0x0D, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x80, 0x2B,
+	 0x18, 0x00, 0x81, 0x67, 0xA2, 0xDA, 0xEC, 0x60, 0x58, 0x4E, 0x5A, 0x78, 0xFF, 0xFF, 0x26, 0x46,
+	 0x3F, 0xFC, 0x24, 0x60, 0x74, 0x62, 0x24, 0x60, 0x28, 0x64, 0xA2, 0xDB, 0x26, 0x44, 0x5A, 0xDB,
+	 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xC1, 0xFE, 0x00, 0x66, 0x46, 0x46, 0x2F, 0x58,
+	 0xFF, 0xFF, 0x26, 0x46, 0x3F, 0xF0, 0x42, 0x64, 0xD0, 0x80, 0xFF, 0xFF, 0x01, 0x04, 0x3F, 0xFA,
+	 0x07, 0xF2, 0xA9, 0xF1, 0x01, 0x1B, 0x07, 0xF8, 0x1C, 0xF2, 0x13, 0xFA, 0x26, 0xF2, 0x27, 0xF0,
+	 0x60, 0x47, 0x00, 0xF4, 0x1F, 0xFA, 0x64, 0x47, 0x20, 0xFA, 0x61, 0x44, 0x21, 0xFA, 0x01, 0x67,
+	 0x0D, 0xFA, 0x10, 0x61, 0x28, 0x60, 0x06, 0x64, 0x1E, 0x63, 0x58, 0xD1, 0xCD, 0x81, 0xBD, 0xD8,
+	 0xFC, 0x02, 0xBB, 0xF1, 0xD8, 0xF1, 0x64, 0x5E, 0x64, 0x5F, 0x44, 0x63, 0xBD, 0xDA, 0x28, 0x60,
+	 0x00, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0x4A, 0xD3, 0x60, 0x45,
+	 0x60, 0x40, 0x01, 0x36, 0x03, 0x64, 0x02, 0x36, 0x01, 0x64, 0xB4, 0x84, 0x06, 0xA2, 0xA2, 0xD1,
+	 0xBD, 0xDA, 0x64, 0x47, 0xBD, 0xDA, 0xD5, 0xF3, 0xD6, 0xF1, 0x60, 0x47, 0xBD, 0xDA, 0x64, 0x47,
+	 0xE3, 0xF1, 0xBD, 0xDA, 0x64, 0x44, 0xBD, 0xDA, 0x26, 0x46, 0x00, 0x64, 0x23, 0xF0, 0x3B, 0xF0,
+	 0x64, 0x40, 0x10, 0x2A, 0x06, 0x00, 0xC0, 0x67, 0xA0, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84,
+	 0x10, 0xBC, 0x3E, 0xFA, 0x24, 0x60, 0x74, 0x62, 0x24, 0x60, 0x34, 0x64, 0xA2, 0xDB, 0x26, 0x44,
+	 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xC8, 0xFE, 0x00, 0x66, 0x46, 0x46,
+	 0x2F, 0x58, 0xFF, 0xFF, 0xB4, 0xF3, 0x1F, 0xFA, 0x32, 0x47, 0x07, 0xFA, 0x24, 0x7E, 0x02, 0x7F,
+	 0x08, 0xFA, 0xD8, 0xF1, 0x09, 0xF8, 0x01, 0x60, 0x01, 0x64, 0x0A, 0xFA, 0x01, 0x64, 0x0B, 0xFA,
+	 0x24, 0x60, 0x74, 0x62, 0x18, 0x64, 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x0A, 0x64, 0x5A, 0xDB,
+	 0xFF, 0xFF, 0x2B, 0xFF, 0x52, 0x63, 0x2E, 0x58, 0xFF, 0xFF, 0x00, 0x60, 0x2A, 0x61, 0xAE, 0x60,
+	 0x58, 0x4D, 0xC4, 0x78, 0xFF, 0xFF, 0x66, 0x44, 0x5E, 0xFB, 0x04, 0x64, 0x03, 0xFA, 0x67, 0x44,
+	 0x2C, 0xFA, 0x2D, 0xFA, 0x2E, 0xFA, 0x32, 0xFA, 0x33, 0xFA, 0x34, 0xFA, 0x12, 0x60, 0x80, 0x64,
+	 0xA9, 0xF1, 0x0E, 0xFA, 0x07, 0xF8, 0x00, 0x64, 0x3E, 0xFA, 0x1A, 0x60, 0x4E, 0x63, 0xA3, 0xDB,
+	 0x06, 0xA3, 0x10, 0x60, 0x38, 0x64, 0xBD, 0xDB, 0x04, 0x64, 0xBD, 0xDB, 0x06, 0x64, 0xA3, 0xDB,
+	 0x10, 0x60, 0x36, 0x62, 0xEF, 0x60, 0xA9, 0x64, 0xA2, 0xDB, 0x1A, 0x60, 0x5A, 0x63, 0x00, 0x64,
+	 0xA3, 0xDB, 0x06, 0xA3, 0x10, 0x60, 0x3C, 0x64, 0xBD, 0xDB, 0x08, 0x64, 0xBD, 0xDB, 0x06, 0x64,
+	 0xA3, 0xDB, 0x10, 0x60, 0x3A, 0x62, 0xEF, 0x60, 0xB3, 0x64, 0xA2, 0xDB, 0x10, 0x60, 0x22, 0x62,
+	 0xEF, 0x60, 0x93, 0x64, 0xA2, 0xDB, 0x00, 0x64, 0x31, 0x60, 0x2A, 0x62, 0xA2, 0xDB, 0x2F, 0x58,
+	 0xFF, 0xFF, 0x5E, 0xF5, 0xEB, 0xF1, 0x2F, 0xF8, 0xEC, 0xF1, 0x30, 0xF8, 0xED, 0xF1, 0x31, 0xF8,
+	 0xCC, 0xF1, 0x19, 0xF8, 0x30, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0x0F, 0x60, 0xE4, 0x62, 0x00, 0x64,
+	 0xA2, 0xDB, 0x00, 0x63, 0x8A, 0xFD, 0x1C, 0x60, 0x96, 0x65, 0xA5, 0xDD, 0x19, 0x60, 0x86, 0x63,
+	 0x88, 0xFD, 0x89, 0xFD, 0x20, 0x40, 0x10, 0x2B, 0x05, 0x00, 0x1F, 0x60, 0x82, 0x61, 0xA1, 0xD3,
+	 0xFF, 0xFF, 0x59, 0x18, 0x5E, 0xF5, 0x40, 0x64, 0x2A, 0xFA, 0x54, 0xF3, 0x00, 0xF4, 0x60, 0x43,
+	 0xBD, 0xD1, 0x04, 0x65, 0x64, 0x47, 0xA5, 0xDA, 0x64, 0x41, 0xDD, 0x81, 0xE9, 0x81, 0x62, 0x44,
+	 0x04, 0x03, 0xBD, 0xD1, 0xCD, 0x81, 0x58, 0xD8, 0xFC, 0x02, 0x58, 0x8B, 0x2D, 0x60, 0x28, 0x63,
+	 0xA3, 0xD1, 0x2B, 0x44, 0xC8, 0x84, 0x64, 0x41, 0xFF, 0xB1, 0x61, 0x45, 0x03, 0xA1, 0xE9, 0x81,
+	 0x41, 0x4C, 0xBD, 0xD1, 0xCD, 0x81, 0x58, 0xD8, 0xFC, 0x02, 0x2B, 0xD2, 0x2B, 0x43, 0x60, 0x47,
+	 0x01, 0x7E, 0x54, 0xF1, 0xA3, 0xDA, 0xA4, 0xD3, 0xCB, 0x83, 0x44, 0x8B, 0xF8, 0x84, 0x2C, 0x41,
+	 0x0C, 0x04, 0xBE, 0xD2, 0xFF, 0xFF, 0x60, 0x47, 0xBE, 0xDA, 0x00, 0x7E, 0xA3, 0xD2, 0x60, 0x45,
+	 0x00, 0x7F, 0xB4, 0x84, 0xCD, 0x81, 0xBD, 0xDA, 0xF4, 0x02, 0x5E, 0xF5, 0x2B, 0x44, 0x04, 0xA4,
+	 0x3F, 0xFA, 0x7F, 0xF3, 0x7E, 0xFB, 0x1F, 0x60, 0x84, 0x61, 0x01, 0x64, 0x54, 0xF1, 0xA1, 0xDB,
+	 0x7F, 0xFB, 0xA4, 0xD3, 0x04, 0x65, 0x53, 0xF3, 0x01, 0x18, 0x0C, 0x65, 0xF3, 0xB4, 0xB4, 0x84,
+	 0x53, 0xFB, 0x02, 0xB0, 0xFF, 0xFF, 0x16, 0x03, 0x7F, 0xF3, 0xFF, 0xFF, 0x60, 0x47, 0x0F, 0xB4,
+	 0x7F, 0xFB, 0x01, 0x03, 0x0F, 0x00, 0xEE, 0x60, 0x4F, 0x78, 0xFF, 0xFF, 0x53, 0xF1, 0x7F, 0xF3,
+	 0x64, 0x40, 0x02, 0x26, 0xF8, 0x01, 0xF3, 0xA0, 0x04, 0xA4, 0x01, 0x04, 0xF1, 0xA4, 0x10, 0x36,
+	 0xF2, 0x01, 0x7F, 0xFB, 0x20, 0x40, 0x10, 0x2B, 0x12, 0x00, 0x7F, 0xF3, 0x1F, 0x60, 0x82, 0x61,
+	 0xA1, 0xD1, 0xCC, 0x84, 0x01, 0x61, 0x08, 0x24, 0x03, 0x00, 0xE1, 0x81, 0xCC, 0x84, 0xFB, 0x01,
+	 0xA1, 0x84, 0x53, 0xF1, 0xE4, 0x03, 0x1F, 0x60, 0x84, 0x61, 0xA1, 0xDB, 0x19, 0x00, 0x53, 0xF3,
+	 0xFF, 0xFF, 0x10, 0xB0, 0x12, 0x60, 0x26, 0x63, 0x02, 0x03, 0x10, 0x60, 0x5C, 0x63, 0x31, 0x60,
+	 0x2A, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0x0C, 0x1B, 0x7F, 0xF3, 0xFF, 0xFF, 0xE0, 0x85, 0x47, 0xD3,
+	 0x53, 0xF1, 0x01, 0xB0, 0x06, 0xB0, 0xCB, 0x03, 0x64, 0x40, 0x03, 0x26, 0x01, 0x00, 0xC7, 0x03,
+	 0x7F, 0xF3, 0x01, 0x61, 0xCC, 0x84, 0xFF, 0xFF, 0x02, 0x03, 0xE1, 0x81, 0xFB, 0x01, 0xBA, 0xF3,
+	 0x61, 0x45, 0xA4, 0x80, 0xFF, 0xFF, 0xBB, 0x03, 0x31, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0x0F, 0x60,
+	 0xE4, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0xDE, 0xFE, 0x0B, 0x04, 0x0F, 0x60, 0xE6, 0x62, 0x40, 0x60,
+	 0x00, 0x64, 0xA2, 0xDB, 0xED, 0x60, 0x70, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x7F, 0xF1, 0x24, 0x60, 0x9A, 0x62, 0xA2, 0xD9, 0x1E, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x2D, 0xFF,
+	 0x0F, 0x60, 0xE6, 0x62, 0x20, 0x60, 0x00, 0x64, 0xA2, 0xDB, 0xED, 0x60, 0xA3, 0x64, 0x5A, 0xDB,
+	 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0xBE, 0xFE, 0x0F, 0x60, 0xD0, 0x62, 0xA2, 0xD1, 0x40, 0x60,
+	 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x0F, 0x60, 0xE4, 0x62, 0x00, 0x64, 0xA2, 0xDB,
+	 0x5E, 0xF5, 0x24, 0x60, 0x74, 0x62, 0x24, 0x60, 0x28, 0x64, 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB,
+	 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0x00, 0x64, 0x51, 0xFB, 0x0F, 0x60, 0xE6, 0x62,
+	 0x00, 0x60, 0x01, 0x64, 0xA2, 0xDB, 0xED, 0x60, 0xCD, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0xC1, 0xFE,
+	 0x33, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0x2F, 0x58, 0xFF, 0xFF, 0x34, 0x64, 0x3B, 0x42, 0x5A, 0xDB,
+	 0x0F, 0x60, 0xE4, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0xC6, 0xF1, 0x1A, 0x60, 0x52, 0x62, 0xA2, 0xD9,
+	 0x24, 0x60, 0xAA, 0x62, 0x1A, 0x60, 0x4E, 0x64, 0xA2, 0xDB, 0x02, 0x64, 0x4A, 0xDB, 0xFF, 0xFF,
+	 0x04, 0xFF, 0xC7, 0xF1, 0x1A, 0x60, 0x5E, 0x62, 0xA2, 0xD9, 0x24, 0x60, 0xA8, 0x62, 0xA2, 0xD3,
+	 0xFF, 0xFF, 0xFD, 0x1B, 0x24, 0x60, 0xAA, 0x62, 0x1A, 0x60, 0x5A, 0x64, 0xA2, 0xDB, 0x02, 0x64,
+	 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x0F, 0x60, 0xE6, 0x62, 0x00, 0x60, 0x08, 0x64, 0xA2, 0xDB,
+	 0xED, 0x60, 0xFE, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x51, 0xF1, 0x0F, 0x60,
+	 0xE4, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x64, 0x40, 0xFF, 0x26, 0x03, 0x00, 0xED, 0x60, 0x36, 0x78,
+	 0xFF, 0xFF, 0x02, 0x0A, 0x00, 0x64, 0x51, 0xFB, 0xC8, 0xF1, 0x1A, 0x60, 0x5E, 0x62, 0xA2, 0xD9,
+	 0x0F, 0x60, 0xE6, 0x62, 0x00, 0x60, 0x0C, 0x64, 0xA2, 0xDB, 0xEE, 0x60, 0x24, 0x64, 0x5A, 0xDB,
+	 0xCF, 0xFE, 0x24, 0x60, 0xAA, 0x62, 0x1A, 0x60, 0x5A, 0x64, 0xA2, 0xDB, 0x02, 0x64, 0x4A, 0xDB,
+	 0xFF, 0xFF, 0x04, 0xFF, 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60, 0xE4, 0x62, 0xA2, 0xD1, 0x00, 0x60,
+	 0x04, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x0C, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x24, 0x60, 0xAA, 0x62,
+	 0x1A, 0x60, 0x5A, 0x64, 0xA2, 0xDB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x14, 0x00,
+	 0xFF, 0x60, 0xF7, 0x64, 0xA0, 0x84, 0xA2, 0xDB, 0x51, 0xF3, 0xDB, 0x0A, 0x00, 0xA0, 0x00, 0x64,
+	 0x02, 0x03, 0x51, 0xFB, 0xD6, 0x01, 0x24, 0x60, 0xAA, 0x62, 0x1A, 0x60, 0x4E, 0x64, 0xA2, 0xDB,
+	 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0xED, 0x60, 0x36, 0x78, 0xFF, 0xFF, 0x35, 0x64,
+	 0x3B, 0x42, 0x5A, 0xDB, 0x24, 0x60, 0xAA, 0x62, 0x1A, 0x60, 0x4E, 0x64, 0xA2, 0xDB, 0x03, 0x64,
+	 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x53, 0xF3, 0xFF, 0xFF, 0xE3, 0xB4, 0x53, 0xFB, 0x1F, 0x60,
+	 0x80, 0x64, 0xA0, 0xD3, 0xFF, 0xFF, 0xFE, 0xB4, 0xA2, 0xDB, 0x00, 0x64, 0x31, 0x60, 0x2A, 0x62,
+	 0xA2, 0xDB, 0x0F, 0x60, 0xE4, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0xDE, 0xFE, 0x0E, 0x04, 0x32, 0x64,
+	 0x3B, 0x42, 0x5A, 0xDB, 0x0F, 0x60, 0xE6, 0x62, 0x40, 0x60, 0x00, 0x64, 0xA2, 0xDB, 0xEE, 0x60,
+	 0x69, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x7E, 0xF1, 0x7F, 0xF9, 0x24, 0x60,
+	 0x9A, 0x62, 0xA2, 0xD9, 0x1E, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x2D, 0xFF, 0x0F, 0x60, 0xE6, 0x62,
+	 0x20, 0x60, 0x00, 0x64, 0xA2, 0xDB, 0xEE, 0x60, 0x91, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58,
+	 0xFF, 0xFF, 0xBE, 0xFE, 0x0F, 0x60, 0xD0, 0x62, 0xA2, 0xD1, 0x40, 0x60, 0x00, 0x64, 0xB0, 0x84,
+	 0xA2, 0xDB, 0xCF, 0xFE, 0x1A, 0x60, 0x06, 0x63, 0x1C, 0x61, 0x00, 0x64, 0xCD, 0x81, 0xBD, 0xDB,
+	 0xFD, 0x02, 0x12, 0x60, 0x46, 0x61, 0x8A, 0xF3, 0x61, 0x43, 0xC6, 0xA5, 0x47, 0xD1, 0x0F, 0x04,
+	 0xBE, 0xD5, 0x1A, 0x60, 0x02, 0x63, 0xC3, 0x83, 0xC3, 0x83, 0xC3, 0x83, 0x43, 0xD3, 0xBE, 0xD1,
+	 0xDC, 0x84, 0xA3, 0xDB, 0x66, 0x44, 0xC0, 0x84, 0xBE, 0xDB, 0x65, 0x44, 0xED, 0x01, 0x1A, 0x60,
+	 0x06, 0x63, 0x0E, 0x61, 0x41, 0x4B, 0xBD, 0xD3, 0xBD, 0xD1, 0x00, 0xBD, 0x64, 0x41, 0x19, 0x03,
+	 0x01, 0xA8, 0x61, 0x44, 0x02, 0xA8, 0x15, 0x03, 0x02, 0x02, 0xE9, 0x84, 0x12, 0x00, 0x65, 0x47,
+	 0x60, 0x45, 0x61, 0x44, 0x09, 0x61, 0xCD, 0x81, 0xE0, 0x84, 0xFF, 0x23, 0xFC, 0x01, 0x02, 0x24,
+	 0xC4, 0x84, 0x02, 0x28, 0xD4, 0x84, 0xCD, 0x81, 0x01, 0x0E, 0x01, 0xBC, 0x02, 0x03, 0xE0, 0x84,
+	 0xF6, 0x01, 0x00, 0x7F, 0x2B, 0x41, 0x4D, 0x8B, 0xBF, 0xDB, 0xDD, 0x02, 0x12, 0x60, 0x46, 0x61,
+	 0x8A, 0xF3, 0x61, 0x43, 0xC6, 0xA5, 0x47, 0xD1, 0x0A, 0x04, 0xDA, 0x86, 0x1A, 0x60, 0x04, 0x63,
+	 0xC3, 0x83, 0xC3, 0x83, 0xC3, 0x83, 0x43, 0xD1, 0xA6, 0xD9, 0x65, 0x44, 0xF2, 0x01, 0x36, 0x64,
+	 0x3B, 0x42, 0x5A, 0xDB, 0x53, 0xF3, 0x8A, 0xF1, 0xF3, 0xB4, 0x53, 0xFB, 0x12, 0x60, 0x46, 0x63,
+	 0xC3, 0x85, 0x45, 0x4A, 0x19, 0x60, 0x86, 0x65, 0x89, 0xF3, 0x45, 0x4C, 0x40, 0x48, 0x20, 0x40,
+	 0x20, 0x2A, 0x02, 0x00, 0x00, 0x65, 0x45, 0x4B, 0x2A, 0x45, 0xD7, 0x80, 0x02, 0x65, 0x23, 0x05,
+	 0x47, 0xD1, 0x02, 0x65, 0x47, 0xD3, 0x0A, 0x65, 0xD0, 0x81, 0x47, 0xD3, 0x01, 0x05, 0x00, 0x61,
+	 0xF2, 0xA3, 0x01, 0xB0, 0x61, 0x44, 0x11, 0x03, 0x20, 0x40, 0x20, 0x2A, 0x08, 0x00, 0xF3, 0x60,
+	 0x58, 0x4E, 0x3E, 0x78, 0xFF, 0xFF, 0x2B, 0x44, 0x02, 0xA4, 0x40, 0x4B, 0x61, 0x44, 0x2C, 0x42,
+	 0xA2, 0xDB, 0x5A, 0xDD, 0x5A, 0x8C, 0x3A, 0xA3, 0xDF, 0x01, 0x28, 0x42, 0x4A, 0xDD, 0x4A, 0xDB,
+	 0x42, 0x48, 0x3A, 0xA3, 0xD9, 0x01, 0x28, 0x44, 0x88, 0xFB, 0x88, 0xF1, 0x19, 0x60, 0x86, 0x63,
+	 0x44, 0x48, 0x28, 0x45, 0xD7, 0x80, 0xA3, 0xD1, 0x15, 0x05, 0x04, 0x65, 0x46, 0xD3, 0x28, 0x45,
+	 0xD6, 0x80, 0xD0, 0x80, 0x02, 0x04, 0x04, 0xA3, 0xF5, 0x01, 0xF7, 0x06, 0x62, 0x46, 0xA2, 0xD9,
+	 0xA3, 0xDB, 0x5B, 0xD3, 0x66, 0x42, 0x5A, 0xD1, 0xA2, 0xDB, 0xA3, 0xD9, 0xFE, 0xA3, 0xA3, 0xD1,
+	 0x66, 0x42, 0xEB, 0x01, 0x88, 0xF3, 0x89, 0xF1, 0x60, 0x43, 0x44, 0x48, 0x28, 0x45, 0xD7, 0x80,
+	 0xA3, 0xD1, 0x15, 0x05, 0x04, 0x65, 0x46, 0xD3, 0x28, 0x45, 0xD6, 0x80, 0xD0, 0x80, 0x02, 0x04,
+	 0x04, 0xA3, 0xF5, 0x01, 0xF7, 0x06, 0x62, 0x46, 0xA2, 0xD9, 0xA3, 0xDB, 0x5B, 0xD3, 0x66, 0x42,
+	 0x5A, 0xD1, 0xA2, 0xDB, 0xA3, 0xD9, 0xFE, 0xA3, 0xA3, 0xD1, 0x66, 0x42, 0xEB, 0x01, 0x0F, 0x60,
+	 0xD0, 0x62, 0xA2, 0xD1, 0x10, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x20, 0x40,
+	 0x80, 0x2B, 0x17, 0x00, 0x00, 0x60, 0x04, 0x61, 0xAE, 0x60, 0x58, 0x4D, 0xC4, 0x78, 0xFF, 0xFF,
+	 0x01, 0x64, 0x23, 0xFA, 0xF1, 0x60, 0x02, 0x64, 0x24, 0xFA, 0x24, 0x60, 0x74, 0x62, 0x24, 0x60,
+	 0x64, 0x64, 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF,
+	 0xFA, 0xFE, 0x0F, 0x60, 0xE4, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x5A, 0xDB, 0x3E, 0x64, 0x3B, 0x42,
+	 0x5A, 0xDB, 0x2F, 0x58, 0xFF, 0xFF, 0x3F, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0x24, 0x60, 0xAA, 0x62,
+	 0x1A, 0x60, 0x4E, 0x64, 0xA2, 0xDB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x00, 0x64,
+	 0x53, 0xFB, 0x0F, 0x60, 0xE4, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x5A, 0xDB, 0xBE, 0xFE, 0x2F, 0x58,
+	 0xFF, 0xFF, 0x0F, 0x60, 0xE4, 0x62, 0xA2, 0xD1, 0x00, 0x60, 0x04, 0x64, 0xB0, 0x84, 0xA2, 0xDB,
+	 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x0F, 0x60, 0xE4, 0x62, 0xA2, 0xD1, 0x00, 0x60, 0x08, 0x64,
+	 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x79, 0xFB, 0xAC, 0x85, 0x60, 0x41,
+	 0x20, 0x03, 0x01, 0x60, 0x00, 0x63, 0x08, 0x64, 0xE9, 0x81, 0xCC, 0x84, 0x02, 0x24, 0xDF, 0x83,
+	 0xFB, 0x02, 0x2D, 0x60, 0x28, 0x64, 0xA0, 0xDD, 0x65, 0x41, 0x2D, 0x60, 0x2A, 0x63, 0x0F, 0x60,
+	 0xC0, 0x64, 0xE9, 0x81, 0x58, 0xD1, 0xFD, 0x04, 0xA3, 0xD9, 0x0B, 0x03, 0x58, 0xD1, 0xE9, 0x81,
+	 0x60, 0x45, 0xFC, 0x04, 0xA3, 0xD1, 0x64, 0x47, 0xB0, 0x84, 0xBD, 0xDB, 0x00, 0xB9, 0x65, 0x44,
+	 0xF0, 0x02, 0x2E, 0x58, 0xFF, 0xFF, 0x3C, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0x20, 0x40, 0x90, 0x2B,
+	 0x03, 0x00, 0xF2, 0x60, 0xE5, 0x78, 0xFF, 0xFF, 0x53, 0xF3, 0x8A, 0xF1, 0x04, 0xB0, 0x07, 0x60,
+	 0x40, 0x64, 0xD0, 0x80, 0x21, 0x03, 0x20, 0x06, 0x26, 0x46, 0x8A, 0xF1, 0x12, 0x60, 0x46, 0x63,
+	 0xC3, 0x83, 0x7F, 0xF3, 0x26, 0xF0, 0xBD, 0xDB, 0x64, 0x44, 0x00, 0x7F, 0xBD, 0xDB, 0x64, 0x47,
+	 0x00, 0x7F, 0xBD, 0xDB, 0x32, 0xF0, 0xBD, 0xD9, 0x33, 0xF0, 0xBD, 0xD9, 0x34, 0xF0, 0xBD, 0xD9,
+	 0x00, 0xF4, 0x0D, 0xF0, 0xBD, 0xD9, 0x0E, 0xF0, 0xBD, 0xD9, 0x00, 0x64, 0x0F, 0xF0, 0xA3, 0xDB,
+	 0x64, 0x47, 0x60, 0x45, 0x00, 0x37, 0x03, 0x00, 0xF2, 0x60, 0xDF, 0x78, 0xFF, 0xFF, 0xBD, 0xDB,
+	 0xE0, 0xA0, 0x1F, 0x61, 0x00, 0xB8, 0xF8, 0x07, 0xF7, 0x03, 0x60, 0xFE, 0xDD, 0x81, 0xA1, 0xD0,
+	 0xCC, 0x84, 0xBD, 0xD9, 0xFB, 0x02, 0x65, 0x40, 0x01, 0x26, 0xDF, 0x83, 0x20, 0xFE, 0x2D, 0x60,
+	 0xE4, 0x62, 0xA2, 0xDD, 0x60, 0xFE, 0xDD, 0x81, 0xA1, 0xD0, 0xFF, 0xFF, 0x64, 0x40, 0x01, 0x3A,
+	 0x04, 0x00, 0xDD, 0x81, 0xA1, 0xD0, 0xFF, 0xFF, 0xC1, 0x81, 0xDD, 0x81, 0xA1, 0xD0, 0xFF, 0xFF,
+	 0x64, 0x40, 0x03, 0x36, 0x03, 0x00, 0xF2, 0x60, 0xDF, 0x78, 0xFF, 0xFF, 0xD9, 0x81, 0xA1, 0xD0,
+	 0x7F, 0xF3, 0xFF, 0xFF, 0xD0, 0x80, 0x20, 0xFE, 0x08, 0x24, 0x03, 0x00, 0xF2, 0x60, 0xDF, 0x78,
+	 0xFF, 0xFF, 0x26, 0x46, 0x3F, 0xF2, 0x00, 0xF4, 0x60, 0x43, 0xF4, 0xA3, 0x00, 0x60, 0x1D, 0x61,
+	 0x00, 0x60, 0x80, 0x65, 0x60, 0xFE, 0x81, 0xA1, 0x7F, 0xA1, 0x02, 0x06, 0x00, 0xF4, 0x03, 0x61,
+	 0xDD, 0x81, 0xA1, 0xD2, 0xCF, 0x83, 0xD4, 0x80, 0x2D, 0x03, 0x17, 0x03, 0xCF, 0x83, 0x61, 0x44,
+	 0x80, 0xA0, 0x28, 0x03, 0x02, 0x02, 0x00, 0xF4, 0x03, 0x61, 0xDD, 0x81, 0xA1, 0xD2, 0xCF, 0x83,
+	 0x81, 0xA1, 0x20, 0x03, 0x05, 0x07, 0x7F, 0xA1, 0xCC, 0x84, 0xDD, 0x81, 0xE4, 0x03, 0xF7, 0x01,
+	 0x00, 0xF4, 0x00, 0xB8, 0x04, 0x61, 0xE4, 0x03, 0xF2, 0x01, 0x01, 0x60, 0xFF, 0x63, 0x46, 0x48,
+	 0x41, 0x4A, 0xDD, 0x81, 0xA1, 0xD0, 0xDF, 0x83, 0xA3, 0xD9, 0x64, 0x44, 0xDD, 0x81, 0xA1, 0xD0,
+	 0xDF, 0x83, 0xA3, 0xD9, 0xCC, 0x84, 0x81, 0xA1, 0x05, 0x03, 0x7F, 0xA1, 0xF7, 0x04, 0x00, 0xF4,
+	 0x03, 0x61, 0xF4, 0x01, 0x20, 0xFE, 0x00, 0xBB, 0x02, 0x60, 0x00, 0x61, 0x45, 0x03, 0x60, 0xFE,
+	 0xDD, 0x81, 0xA1, 0xD1, 0xFF, 0xFF, 0x64, 0x40, 0x00, 0x3A, 0x3E, 0x00, 0xDD, 0x81, 0xA1, 0xD1,
+	 0xFF, 0xFF, 0x64, 0x40, 0x60, 0x3A, 0x38, 0x00, 0xDD, 0x81, 0xA1, 0xD1, 0xFF, 0xFF, 0x64, 0x40,
+	 0x1D, 0x3A, 0x32, 0x00, 0xDD, 0x81, 0xA1, 0xD3, 0xFF, 0xFF, 0x20, 0xFE, 0xFF, 0xB4, 0x1C, 0x60,
+	 0x96, 0x65, 0xA5, 0xD3, 0x60, 0x5C, 0x02, 0xA4, 0xA5, 0xDB, 0xFE, 0xA5, 0x1A, 0x60, 0xC6, 0x64,
+	 0x44, 0xD9, 0x00, 0x7C, 0x60, 0xFE, 0xDD, 0x81, 0xA1, 0xD1, 0xFF, 0xFF, 0x20, 0xFE, 0x1B, 0x60,
+	 0x06, 0x64, 0xC4, 0x82, 0x64, 0x44, 0xFF, 0xB4, 0xA2, 0xDB, 0x12, 0x60, 0x48, 0x65, 0x8A, 0xF3,
+	 0xFF, 0xFF, 0xC4, 0x82, 0x64, 0x44, 0xA2, 0xD3, 0xFF, 0xB5, 0xD4, 0x80, 0xFF, 0xFF, 0x02, 0x05,
+	 0x65, 0x44, 0xA2, 0xDB, 0x09, 0x00, 0x20, 0xFE, 0x28, 0x46, 0x2A, 0x41, 0xFF, 0xB1, 0x60, 0xFE,
+	 0x82, 0x64, 0xA1, 0xDA, 0xFF, 0xFF, 0x20, 0xFE, 0x26, 0x46, 0x3F, 0xF2, 0x00, 0xF4, 0x60, 0x43,
+	 0xF4, 0xA3, 0x00, 0x60, 0x1D, 0x61, 0x00, 0x60, 0xDD, 0x65, 0x60, 0xFE, 0x81, 0xA1, 0x7F, 0xA1,
+	 0x02, 0x06, 0x00, 0xF4, 0x03, 0x61, 0xDD, 0x81, 0xA1, 0xD2, 0xCF, 0x83, 0xD4, 0x80, 0x2D, 0x03,
+	 0x17, 0x03, 0xCF, 0x83, 0x61, 0x44, 0x80, 0xA0, 0x28, 0x03, 0x02, 0x02, 0x00, 0xF4, 0x03, 0x61,
+	 0xDD, 0x81, 0xA1, 0xD2, 0xCF, 0x83, 0x81, 0xA1, 0x20, 0x03, 0x05, 0x07, 0x7F, 0xA1, 0xCC, 0x84,
+	 0xDD, 0x81, 0xE4, 0x03, 0xF7, 0x01, 0x00, 0xF4, 0x00, 0xB8, 0x04, 0x61, 0xE4, 0x03, 0xF2, 0x01,
+	 0x02, 0x60, 0x00, 0x63, 0x46, 0x48, 0x41, 0x4A, 0xDD, 0x81, 0xA1, 0xD0, 0xDF, 0x83, 0xA3, 0xD9,
+	 0x64, 0x44, 0xDD, 0x81, 0xA1, 0xD0, 0xDF, 0x83, 0xA3, 0xD9, 0xCC, 0x84, 0x81, 0xA1, 0x05, 0x03,
+	 0x7F, 0xA1, 0xF7, 0x04, 0x00, 0xF4, 0x03, 0x61, 0xF4, 0x01, 0x20, 0xFE, 0x00, 0xBB, 0x02, 0x60,
+	 0x00, 0x61, 0x08, 0x24, 0xA6, 0x00, 0x2D, 0x60, 0xD6, 0x62, 0xA2, 0xDF, 0x2D, 0x60, 0xD8, 0x62,
+	 0xA2, 0xDF, 0x2D, 0x60, 0xDA, 0x62, 0xA2, 0xDF, 0x2D, 0x60, 0xDC, 0x62, 0xA2, 0xDF, 0x60, 0xFE,
+	 0xDD, 0x64, 0xA1, 0xDB, 0xDD, 0x81, 0xA1, 0xD3, 0xFF, 0xFF, 0xFA, 0xA4, 0xFF, 0xFF, 0x04, 0x34,
+	 0x9A, 0x01, 0xDD, 0x81, 0xA1, 0xD1, 0xFF, 0xFF, 0x64, 0x40, 0x00, 0x3A, 0x94, 0x01, 0xDD, 0x81,
+	 0xA1, 0xD1, 0xFF, 0xFF, 0x64, 0x40, 0x50, 0x3A, 0x8E, 0x01, 0xDD, 0x81, 0xA1, 0xD1, 0xFF, 0xFF,
+	 0x64, 0x40, 0xF2, 0x3A, 0x88, 0x01, 0xDD, 0x81, 0xA1, 0xD1, 0xFF, 0xFF, 0x64, 0x40, 0x01, 0x3A,
+	 0xDC, 0x00, 0xDD, 0x81, 0xA1, 0xD1, 0xFF, 0xFF, 0x64, 0x40, 0x01, 0x3A, 0xD6, 0x00, 0xDD, 0x81,
+	 0xA1, 0xD1, 0xFF, 0xFF, 0x64, 0x40, 0x00, 0x3A, 0xD0, 0x00, 0x60, 0x5C, 0x00, 0x36, 0x39, 0x00,
+	 0x00, 0x64, 0xF2, 0x60, 0x58, 0x4E, 0x57, 0x78, 0xFF, 0xFF, 0x65, 0x40, 0x08, 0x26, 0xF7, 0x01,
+	 0x2D, 0x60, 0xD6, 0x62, 0xA2, 0xDB, 0x64, 0x40, 0x00, 0x36, 0x31, 0x00, 0xDD, 0x81, 0xA1, 0xD3,
+	 0xDD, 0x81, 0xF2, 0x60, 0x58, 0x4E, 0x57, 0x78, 0xFF, 0xFF, 0x65, 0x40, 0x08, 0x26, 0xF5, 0x01,
+	 0x2D, 0x60, 0xD8, 0x62, 0xA2, 0xDB, 0x64, 0x40, 0x00, 0x36, 0x27, 0x00, 0xDD, 0x81, 0xA1, 0xD3,
+	 0xDD, 0x81, 0xF2, 0x60, 0x58, 0x4E, 0x57, 0x78, 0xFF, 0xFF, 0x65, 0x40, 0x08, 0x26, 0xF5, 0x01,
+	 0x2D, 0x60, 0xDA, 0x62, 0xA2, 0xDB, 0x64, 0x40, 0x00, 0x36, 0x1D, 0x00, 0xDD, 0x81, 0xA1, 0xD1,
+	 0x2D, 0x60, 0xDC, 0x62, 0xA2, 0xD9, 0xDD, 0x81, 0xA1, 0xD1, 0x2D, 0x60, 0xDD, 0x62, 0xA2, 0xD9,
+	 0x18, 0x00, 0x20, 0xFE, 0x2D, 0x60, 0xD6, 0x62, 0x00, 0x60, 0x04, 0x64, 0xA2, 0xDB, 0x20, 0xFE,
+	 0x2D, 0x60, 0xD8, 0x62, 0x00, 0x60, 0x04, 0x64, 0xA2, 0xDB, 0x20, 0xFE, 0x2D, 0x60, 0xDA, 0x62,
+	 0x00, 0x60, 0x02, 0x64, 0xA2, 0xDB, 0x20, 0xFE, 0x2D, 0x60, 0xDC, 0x62, 0x00, 0x60, 0x00, 0x64,
+	 0xA2, 0xDB, 0x20, 0xFE, 0x02, 0x60, 0x00, 0x65, 0x2D, 0x60, 0x9E, 0x63, 0xD5, 0x84, 0xDC, 0x84,
+	 0xBD, 0xDB, 0x60, 0x41, 0x66, 0x44, 0x63, 0x46, 0xCD, 0x83, 0xC7, 0x81, 0x60, 0x45, 0x60, 0xFE,
+	 0x5D, 0x93, 0xA3, 0xD3, 0x5D, 0x93, 0xA6, 0xDB, 0xDE, 0x86, 0xFA, 0x1F, 0x66, 0x43, 0x65, 0x46,
+	 0x20, 0xFE, 0x20, 0xFE, 0x2D, 0x60, 0xE4, 0x62, 0xA2, 0xD1, 0xFF, 0xFF, 0x64, 0x43, 0x00, 0x64,
+	 0x2D, 0x60, 0xCE, 0x61, 0xA1, 0xDB, 0x2D, 0x60, 0xC2, 0x62, 0xA2, 0xD1, 0x2D, 0x60, 0xD6, 0x62,
+	 0xA2, 0xD3, 0xFF, 0xFF, 0xA0, 0x84, 0xFF, 0xFF, 0x10, 0x26, 0x07, 0x00, 0x04, 0x26, 0x07, 0x00,
+	 0x20, 0x26, 0x07, 0x00, 0x02, 0x26, 0x07, 0x00, 0x48, 0x00, 0x10, 0x7C, 0x05, 0x00, 0x04, 0x7C,
+	 0x03, 0x00, 0x20, 0x7C, 0x01, 0x00, 0x02, 0x7C, 0x2D, 0x60, 0xCE, 0x61, 0xA1, 0xD9, 0x50, 0x94,
+	 0x2D, 0x60, 0xD0, 0x61, 0xA1, 0xDB, 0x2D, 0x60, 0xC4, 0x61, 0xA1, 0xD1, 0x2D, 0x60, 0xD8, 0x61,
+	 0xA1, 0xD3, 0x2D, 0x60, 0xCE, 0x61, 0xA0, 0x84, 0xA1, 0xD1, 0xFF, 0xFF, 0x10, 0x26, 0x05, 0x00,
+	 0x04, 0x26, 0x05, 0x00, 0x01, 0x26, 0x08, 0x00, 0x28, 0x00, 0x10, 0x7C, 0x06, 0x00, 0x64, 0x40,
+	 0x10, 0x26, 0x23, 0x00, 0x04, 0x7C, 0x01, 0x00, 0x01, 0x7C, 0x2D, 0x60, 0xD0, 0x61, 0xA1, 0xD9,
+	 0x50, 0x94, 0x2D, 0x60, 0xD2, 0x61, 0xA1, 0xDB, 0x2D, 0x60, 0xC6, 0x61, 0xA1, 0xD1, 0x2D, 0x60,
+	 0xDA, 0x61, 0xA1, 0xD3, 0xFF, 0xFF, 0xA0, 0x84, 0x60, 0x40, 0x02, 0x26, 0x05, 0x00, 0x04, 0x26,
+	 0x05, 0x00, 0x01, 0x26, 0x05, 0x00, 0x09, 0x00, 0x02, 0x7C, 0x03, 0x00, 0x04, 0x7C, 0x01, 0x00,
+	 0x20, 0x7C, 0x2D, 0x60, 0xD2, 0x61, 0xA1, 0xD9, 0x0D, 0x00, 0x50, 0x94, 0x2D, 0x60, 0xCE, 0x62,
+	 0xA2, 0xDB, 0x2D, 0x60, 0xD0, 0x62, 0xA2, 0xDB, 0x2D, 0x60, 0xD2, 0x62, 0xA2, 0xDB, 0x2D, 0x60,
+	 0xD4, 0x62, 0xA2, 0xDB, 0x7C, 0x44, 0x2D, 0x60, 0xCE, 0x61, 0xA1, 0xD1, 0xBD, 0xD9, 0x2D, 0x60,
+	 0xD0, 0x61, 0xA1, 0xD1, 0xB0, 0x84, 0xBD, 0xD9, 0x2D, 0x60, 0xD2, 0x61, 0xA1, 0xD1, 0xB0, 0x84,
+	 0xBD, 0xD9, 0x2D, 0x60, 0xC8, 0x61, 0xA1, 0xD1, 0xB0, 0x84, 0xBD, 0xD9, 0x08, 0x28, 0x68, 0x00,
+	 0x28, 0x60, 0x2C, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0xFF, 0xA0, 0xFF, 0xFF, 0x0C, 0x24, 0x60, 0x00,
+	 0x60, 0x40, 0x0B, 0x36, 0x5D, 0x00, 0x20, 0x40, 0x10, 0x27, 0x5A, 0x00, 0x88, 0x00, 0x20, 0xFE,
+	 0x00, 0x65, 0x60, 0xFE, 0x2D, 0x60, 0xDE, 0x62, 0xA2, 0xDB, 0xE0, 0x84, 0xE0, 0x84, 0x08, 0x20,
+	 0x03, 0x00, 0x01, 0x64, 0xA2, 0xDB, 0x02, 0x64, 0x02, 0xA5, 0x64, 0x44, 0xD4, 0x9C, 0xD4, 0x80,
+	 0x2D, 0x60, 0xE0, 0x62, 0x02, 0x05, 0x08, 0x65, 0x41, 0x00, 0xA2, 0xD9, 0x7C, 0x44, 0x2D, 0x60,
+	 0xE2, 0x62, 0xA2, 0xDB, 0xDD, 0x81, 0xA1, 0xD1, 0x00, 0x65, 0x64, 0x40, 0x00, 0x3A, 0x01, 0x65,
+	 0xDD, 0x81, 0xA1, 0xD1, 0xFF, 0xFF, 0x64, 0x40, 0x50, 0x3A, 0x01, 0x65, 0xDD, 0x81, 0xA1, 0xD1,
+	 0xFF, 0xFF, 0x64, 0x40, 0xF2, 0x3A, 0x01, 0x65, 0xDD, 0x81, 0xA1, 0xD1, 0x65, 0x40, 0x00, 0x3A,
+	 0x18, 0x00, 0x00, 0x60, 0x00, 0x65, 0x64, 0x40, 0x00, 0x36, 0x01, 0x65, 0x64, 0x40, 0x01, 0x36,
+	 0x02, 0x65, 0x64, 0x40, 0x02, 0x36, 0x04, 0x65, 0x64, 0x40, 0x04, 0x36, 0x10, 0x65, 0x64, 0x40,
+	 0x05, 0x36, 0x20, 0x65, 0x65, 0x5C, 0x2D, 0x60, 0xE2, 0x62, 0xA2, 0xD3, 0xFF, 0xFF, 0xB0, 0x84,
+	 0xA2, 0xDB, 0x2D, 0x60, 0xDE, 0x62, 0xA2, 0xD3, 0x00, 0x65, 0xFF, 0xA4, 0xA2, 0xDB, 0xCA, 0x02,
+	 0x2D, 0x60, 0xE2, 0x62, 0xA2, 0xD3, 0x2D, 0x60, 0xE0, 0x62, 0xA2, 0xD1, 0x2E, 0x58, 0xFF, 0xFF,
+	 0x20, 0xFE, 0x8A, 0xF3, 0xFF, 0xFF, 0x3A, 0xA4, 0x8A, 0xFB, 0x3D, 0x64, 0x3B, 0x42, 0x5A, 0xDB,
+	 0x89, 0xF3, 0x7F, 0xF1, 0x04, 0xA4, 0x89, 0xFB, 0x12, 0x60, 0x22, 0x63, 0x53, 0xF3, 0x64, 0x41,
+	 0x08, 0xB0, 0xE1, 0x85, 0x1C, 0x03, 0xFE, 0xA1, 0x47, 0xD3, 0x02, 0x06, 0xFB, 0xB4, 0xA3, 0xDB,
+	 0xDD, 0x81, 0x5B, 0xD3, 0x0C, 0x24, 0x02, 0x00, 0xFB, 0xB4, 0xA3, 0xDB, 0x5B, 0xD3, 0xDD, 0x81,
+	 0x02, 0xBC, 0xA3, 0xDB, 0x0E, 0x65, 0xDD, 0x81, 0xD5, 0x80, 0x5B, 0xD3, 0x08, 0x05, 0xFB, 0xB4,
+	 0xA3, 0xDB, 0xDD, 0x81, 0xD5, 0x80, 0x5B, 0xD3, 0x02, 0x03, 0xFB, 0xB4, 0xA3, 0xDB, 0xFF, 0xFF,
+	 0x20, 0xFE, 0x26, 0x46, 0x31, 0x40, 0x20, 0x2A, 0x18, 0x00, 0x3F, 0xF2, 0x47, 0x65, 0xC4, 0x84,
+	 0xE8, 0x84, 0x23, 0xFA, 0xF1, 0x60, 0x02, 0x64, 0x24, 0xFA, 0x24, 0x60, 0x74, 0x62, 0x24, 0x60,
+	 0x64, 0x64, 0xA2, 0xDB, 0x26, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF,
+	 0xFA, 0xFE, 0x00, 0x66, 0x46, 0x46, 0x2F, 0x58, 0xFF, 0xFF, 0x26, 0x46, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x16, 0x63, 0x1C, 0x60, 0x8C, 0x62, 0x00, 0x64, 0x5A, 0xDB, 0xFE, 0x1F, 0x5B, 0xFB, 0x5C, 0xFB,
+	 0x1C, 0x60, 0x92, 0x63, 0x02, 0x64, 0xA3, 0xDB, 0x1A, 0x60, 0xC6, 0x62, 0x3E, 0x63, 0x00, 0x64,
+	 0x5A, 0xDB, 0xFE, 0x1F, 0x2E, 0x58, 0xFF, 0xFF, 0x1C, 0x60, 0x98, 0x62, 0xA2, 0xD3, 0x00, 0x63,
+	 0xF8, 0xA0, 0x01, 0xA4, 0x03, 0x03, 0xA2, 0xDB, 0x2E, 0x58, 0xFF, 0xFF, 0xA2, 0xDD, 0x1C, 0x60,
+	 0x9A, 0x62, 0xA2, 0xD1, 0xA2, 0xDD, 0x5A, 0xD3, 0xA2, 0xDD, 0xC0, 0x81, 0x61, 0x44, 0x02, 0x24,
+	 0xFF, 0xFF, 0xE9, 0x81, 0xE9, 0x81, 0xE9, 0x81, 0xE9, 0x81, 0x5A, 0xD3, 0xE9, 0x81, 0xE8, 0x83,
+	 0xEB, 0x83, 0xEB, 0x83, 0xEB, 0x83, 0xEB, 0x85, 0xD4, 0x85, 0xC5, 0x83, 0xA2, 0xDD, 0x1C, 0x60,
+	 0x8E, 0x62, 0x63, 0x47, 0x00, 0x7F, 0xA2, 0xDB, 0x2E, 0x58, 0xFF, 0xFF, 0x1C, 0x60, 0xA0, 0x65,
+	 0xA5, 0xDD, 0x1B, 0x60, 0x46, 0x65, 0x61, 0x44, 0x2B, 0x41, 0x45, 0xDB, 0x60, 0x41, 0x1B, 0x60,
+	 0x86, 0x65, 0x0A, 0xA3, 0xA3, 0xD1, 0x2B, 0x44, 0x44, 0xD9, 0x1C, 0x60, 0xA0, 0x65, 0xA5, 0xD3,
+	 0xFF, 0xFF, 0x60, 0x43, 0x00, 0xB9, 0xFF, 0xFF, 0x4C, 0x03, 0x06, 0xA3, 0xBD, 0xD1, 0x81, 0xF3,
+	 0x82, 0xF1, 0xD0, 0x80, 0xBD, 0xD3, 0x22, 0x02, 0x83, 0xF3, 0xD0, 0x80, 0xA3, 0xD1, 0x1E, 0x02,
+	 0xD0, 0x80, 0xFF, 0xFF, 0x1B, 0x02, 0x8A, 0xF3, 0x12, 0x60, 0x46, 0x63, 0xC6, 0xA5, 0x47, 0xD1,
+	 0x7F, 0xF3, 0xFF, 0xFF, 0xD0, 0x80, 0xFF, 0xFF, 0x08, 0x28, 0xFF, 0x61, 0x61, 0x43, 0x1A, 0x60,
+	 0xC6, 0x65, 0x2B, 0x44, 0x44, 0xD1, 0x1C, 0x60, 0x8E, 0x65, 0xA5, 0xD1, 0x64, 0x44, 0xD0, 0x81,
+	 0x1C, 0x60, 0x92, 0x65, 0x01, 0x05, 0x00, 0x61, 0xA5, 0xD3, 0x15, 0x00, 0x1A, 0x60, 0xC6, 0x65,
+	 0x2B, 0x44, 0x44, 0xD1, 0x1C, 0x60, 0x8E, 0x65, 0x64, 0x43, 0xA5, 0xD1, 0x64, 0x65, 0x63, 0x44,
+	 0xC0, 0x84, 0xD4, 0x80, 0xFF, 0xFF, 0x02, 0x06, 0x00, 0x61, 0x13, 0x00, 0x61, 0x43, 0xD0, 0x81,
+	 0x1C, 0x60, 0x92, 0x65, 0xA5, 0xD3, 0xE9, 0x81, 0xE9, 0x81, 0xCC, 0x84, 0xCC, 0x84, 0x02, 0x03,
+	 0x02, 0x03, 0xE9, 0x81, 0xE9, 0x81, 0xE9, 0x81, 0xE9, 0x85, 0xD7, 0x84, 0x60, 0x41, 0x01, 0x05,
+	 0x00, 0x61, 0x1C, 0x60, 0xA0, 0x65, 0xA5, 0xD3, 0xFF, 0xFF, 0x60, 0x43, 0x2E, 0x58, 0xFF, 0xFF,
+	 0x1C, 0x60, 0x94, 0x65, 0xA5, 0xD1, 0x5B, 0xF3, 0x64, 0x41, 0xCD, 0x81, 0xCD, 0x81, 0x02, 0x03,
+	 0x02, 0x03, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x85, 0x29, 0x44, 0x54, 0x89, 0x2E, 0x58,
+	 0xFF, 0xFF, 0xED, 0xF3, 0x1A, 0x60, 0xBE, 0x63, 0x0F, 0xB4, 0x01, 0xA4, 0xE0, 0x87, 0xE0, 0x84,
+	 0xE0, 0x84, 0xBD, 0xDB, 0x10, 0x60, 0x58, 0x64, 0xBD, 0xDB, 0x02, 0x64, 0xBD, 0xDB, 0x06, 0x64,
+	 0xA3, 0xDB, 0x24, 0x60, 0xAA, 0x62, 0x1A, 0x60, 0xBA, 0x64, 0xA2, 0xDB, 0x02, 0x64, 0x4A, 0xDB,
+	 0xFF, 0xFF, 0x04, 0xFF, 0x2E, 0x58, 0xFF, 0xFF, 0x1A, 0x60, 0xBE, 0x63, 0xEA, 0x60, 0x60, 0x64,
+	 0xBD, 0xDB, 0x10, 0x60, 0x58, 0x64, 0xBD, 0xDB, 0x02, 0x64, 0xBD, 0xDB, 0x06, 0x64, 0xA3, 0xDB,
+	 0x24, 0x60, 0xAA, 0x62, 0x1A, 0x60, 0xBA, 0x64, 0xA2, 0xDB, 0x02, 0x64, 0x4A, 0xDB, 0xFF, 0xFF,
+	 0x04, 0xFF, 0x2E, 0x58, 0xFF, 0xFF, 0x16, 0x63, 0x1C, 0x60, 0x8C, 0x62, 0x00, 0x64, 0x5A, 0xDB,
+	 0xFE, 0x1F, 0x5B, 0xFB, 0x5C, 0xFB, 0x1C, 0x60, 0x92, 0x63, 0x02, 0x64, 0xA3, 0xDB, 0x1A, 0x60,
+	 0xC6, 0x62, 0x3E, 0x63, 0x00, 0x64, 0x5A, 0xDB, 0xFE, 0x1F, 0x10, 0x60, 0x56, 0x62, 0xF5, 0x60,
+	 0x29, 0x64, 0xA2, 0xDB, 0x10, 0x60, 0x2C, 0x62, 0xF5, 0x60, 0x15, 0x64, 0xA2, 0xDB, 0x10, 0x60,
+	 0x02, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x10, 0x60, 0x04, 0x62, 0x00, 0x60, 0x04, 0x64, 0xA2, 0xDB,
+	 0xF4, 0x60, 0x16, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x20, 0x44, 0x40, 0x26,
+	 0x03, 0x00, 0xF4, 0x60, 0xEA, 0x78, 0xFF, 0xFF, 0x20, 0x40, 0x52, 0x23, 0x07, 0x00, 0x5A, 0xF3,
+	 0xFF, 0xFF, 0x01, 0xA4, 0x5A, 0xFB, 0xF4, 0x60, 0xD7, 0x78, 0xFF, 0xFF, 0x40, 0x60, 0x00, 0x65,
+	 0x20, 0x44, 0x34, 0x80, 0x1C, 0x60, 0x92, 0x65, 0x02, 0x64, 0xA5, 0xDB, 0x1A, 0x60, 0xC4, 0x62,
+	 0x7E, 0x63, 0x00, 0x64, 0x5A, 0xDB, 0xFE, 0x1F, 0x1C, 0x60, 0x96, 0x62, 0xA2, 0xDD, 0x8C, 0xF3,
+	 0x58, 0xFB, 0x02, 0x64, 0x8C, 0xFB, 0xFF, 0xFF, 0xC1, 0xFE, 0x8C, 0xF3, 0xFF, 0xFF, 0x00, 0xA8,
+	 0xFF, 0xFF, 0x0B, 0x03, 0x10, 0x60, 0x04, 0x62, 0x80, 0x60, 0x00, 0x64, 0xA2, 0xDB, 0xF4, 0x60,
+	 0x3D, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x04, 0x64, 0x53, 0xFB, 0x29, 0x60,
+	 0xA4, 0x64, 0x54, 0xFB, 0x0F, 0x4E, 0xEC, 0x60, 0x58, 0x4F, 0xB9, 0x78, 0xFF, 0xFF, 0x0E, 0x4F,
+	 0x10, 0x60, 0x02, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x10, 0x60, 0x04, 0x62, 0x10, 0x60, 0x00, 0x64,
+	 0xA2, 0xDB, 0xF4, 0x60, 0x67, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x58, 0xF3,
+	 0x8C, 0xFB, 0xCA, 0xFE, 0xC1, 0xFE, 0x1C, 0x60, 0xA2, 0x62, 0x66, 0x44, 0xA2, 0xDB, 0x5A, 0xDD,
+	 0x61, 0x44, 0x5A, 0xDB, 0x67, 0xF5, 0xCC, 0xF1, 0x19, 0xF8, 0xF8, 0x60, 0x80, 0x64, 0x0E, 0xFA,
+	 0xA9, 0xF1, 0x07, 0xF8, 0x01, 0x60, 0x60, 0x67, 0x2C, 0xFA, 0x1D, 0x64, 0x2D, 0xFA, 0x01, 0x64,
+	 0x2E, 0xFA, 0xEB, 0xF1, 0x2F, 0xF8, 0xEC, 0xF1, 0x30, 0xF8, 0xED, 0xF1, 0x31, 0xF8, 0x81, 0xF1,
+	 0x32, 0xF8, 0x82, 0xF1, 0x33, 0xF8, 0x83, 0xF1, 0x34, 0xF8, 0x08, 0x64, 0x2A, 0xFA, 0x40, 0x63,
+	 0x3F, 0xFC, 0x00, 0xF4, 0x02, 0x62, 0xCB, 0x83, 0x00, 0x64, 0x5A, 0xDA, 0xFE, 0x1F, 0x1C, 0x60,
+	 0x8E, 0x65, 0xA5, 0xD3, 0x02, 0xFA, 0x19, 0x60, 0x88, 0x64, 0xA0, 0xD1, 0x0A, 0x61, 0x41, 0xD3,
+	 0x03, 0xFA, 0x06, 0x61, 0x06, 0x63, 0x00, 0x65, 0x1B, 0x60, 0x86, 0x64, 0x44, 0xD1, 0x59, 0xD8,
+	 0x1B, 0x60, 0x46, 0x64, 0x44, 0xD1, 0x59, 0xD8, 0x1A, 0x60, 0xC6, 0x64, 0x44, 0xD1, 0x59, 0xD8,
+	 0x1B, 0x60, 0x06, 0x64, 0x44, 0xD1, 0x59, 0xD8, 0x65, 0x44, 0x02, 0xA4, 0x60, 0x45, 0xEC, 0x1F,
+	 0x67, 0xF5, 0x24, 0x60, 0x74, 0x62, 0x24, 0x60, 0x22, 0x64, 0xA2, 0xDB, 0x66, 0x44, 0x5A, 0xDB,
+	 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0x1C, 0x60, 0xA2, 0x62, 0xA2, 0xD5, 0x5A, 0xD3,
+	 0x5A, 0xD3, 0x60, 0x43, 0x60, 0x41, 0x0F, 0x60, 0xEA, 0x62, 0xA2, 0xD1, 0x00, 0x60, 0x20, 0x64,
+	 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0xBF, 0x60, 0xFF, 0x65, 0x20, 0x44, 0x24, 0x80, 0xF3, 0x60,
+	 0x58, 0x4E, 0xD4, 0x78, 0xFF, 0xFF, 0x10, 0x60, 0x02, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x10, 0x60,
+	 0x04, 0x62, 0x10, 0x60, 0x02, 0x64, 0xA2, 0xDB, 0xF4, 0x60, 0x16, 0x64, 0x5A, 0xDB, 0xCF, 0xFE,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x1C, 0x60, 0xA4, 0x63, 0x66, 0x44, 0xA3, 0xDB, 0x00, 0x60, 0x40, 0x61,
+	 0xAE, 0x60, 0x58, 0x4D, 0xC4, 0x78, 0xFF, 0xFF, 0x66, 0x44, 0x67, 0xFB, 0x04, 0x64, 0x03, 0xFA,
+	 0x1C, 0x60, 0xA4, 0x63, 0xA3, 0xD1, 0x00, 0x64, 0x64, 0x46, 0xA3, 0xDB, 0x00, 0x60, 0x40, 0x65,
+	 0x20, 0x44, 0x34, 0x80, 0xF3, 0x60, 0x58, 0x4E, 0xB9, 0x78, 0xFF, 0xFF, 0x10, 0x60, 0x02, 0x62,
+	 0x00, 0x64, 0xA2, 0xDB, 0x10, 0x60, 0x04, 0x62, 0x00, 0x60, 0x02, 0x64, 0xA2, 0xDB, 0xF4, 0x60,
+	 0x16, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x24, 0x60, 0xAA, 0x62, 0x1A, 0x60,
+	 0xBA, 0x64, 0xA2, 0xDB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x10, 0x60, 0x02, 0x62,
+	 0x00, 0x64, 0xA2, 0xDB, 0x5A, 0xDB, 0xFF, 0x60, 0x9F, 0x65, 0x20, 0x44, 0x24, 0x80, 0x2F, 0x58,
+	 0xFF, 0xFF, 0x10, 0x60, 0x02, 0x62, 0xA2, 0xD1, 0x00, 0x60, 0x02, 0x64, 0xB0, 0x84, 0xA2, 0xDB,
+	 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF,
+
+};  /* fw_image_4_data */
+
+static const CFG_IDENTITY_STRCT fw_image_infoidentity[] = {
+	{
+		sizeof( CFG_IDENTITY_STRCT ) / sizeof(hcf_16) - 1,
+		CFG_FW_IDENTITY,
+		COMP_ID_FW_STA,
+		3,							//Variant
+		2,							//Major
+		36							//Minor
+	},
+	{ 0000, 0000, 0000, 0000, 0000, 0000 }		//endsentinel
+};
+
+static const CFG_PROG_STRCT fw_image_code[] = {
+	{
+		8,
+		CFG_PROG,
+		CFG_PROG_VOLATILE,			// mode
+		0x0186,		// sizeof(fw_image_1_data),
+		0x00000060,					// Target address in NIC Memory
+		0x0000,						// CRC: yes/no	TYPE: primary/station/tertiary
+		(hcf_8 FAR   *) fw_image_1_data
+	},
+	{
+		8,
+		CFG_PROG,
+		CFG_PROG_VOLATILE,			// mode
+		0x2518,		// sizeof(fw_image_2_data),
+		0x00000C16,					// Target address in NIC Memory
+		0x0000,						// CRC: yes/no	TYPE: primary/station/tertiary
+		(hcf_8 FAR   *) fw_image_2_data
+	},
+	{
+		8,
+		CFG_PROG,
+		CFG_PROG_VOLATILE,			// mode
+		0x3daa,		// sizeof(fw_image_3_data),
+		0x001E312E,					// Target address in NIC Memory
+		0x0000,						// CRC: yes/no	TYPE: primary/station/tertiary
+		(hcf_8 FAR   *) fw_image_3_data
+	},
+	{
+		8,
+		CFG_PROG,
+		CFG_PROG_VOLATILE,			// mode
+		0xaa66,		// sizeof(fw_image_4_data),
+		0x001F4000,					// Target address in NIC Memory
+		0x0000,						// CRC: yes/no	TYPE: primary/station/tertiary
+		(hcf_8 FAR   *) fw_image_4_data
+	},
+	{
+		5,
+		CFG_PROG,
+		CFG_PROG_STOP,				// mode
+		0000,
+ 	0x000F368E,					// Start execution address
+	},
+	{ 0000, 0000, 0000, 0000, 00000000, 0000, 00000000}
+};
+
+static const CFG_RANGE20_STRCT fw_image_infocompat[] = {
+	{	3 + ((20 * sizeof(CFG_RANGE_SPEC_STRCT)) / sizeof(hcf_16)),
+		CFG_FW_SUP_RANGE,
+		COMP_ROLE_SUPL,
+		COMP_ID_STA,
+		{
+			{ 2, 2, 5 }  				//variant, bottom, top
+		}
+	},
+	{	3 + ((20 * sizeof(CFG_RANGE_SPEC_STRCT)) / sizeof(hcf_16)),
+		CFG_MFI_ACT_RANGES_STA,
+		COMP_ROLE_ACT,
+		COMP_ID_MFI,
+		{
+			{ 4, 6, 7 }, 				//variant, bottom, top
+			{ 5, 6, 7 }, 				//variant, bottom, top
+			{ 6, 6, 7 }  				//variant, bottom, top
+		}
+	},
+	{	3 + ((20 * sizeof(CFG_RANGE_SPEC_STRCT)) / sizeof(hcf_16)),
+		CFG_CFI_ACT_RANGES_STA,
+		COMP_ROLE_ACT,
+		COMP_ID_CFI,
+		{
+			{ 2, 1, 2 }  				//variant, bottom, top
+		}
+	},
+	{ 0000, 0000, 0000, 0000, { { 0000, 0000, 0000 } } }	//endsentinel
+};
+
+memimage fw_image = {
+	"FUPU7D37dhfwci\001C",			//signature, <format number>, C/Bin type
+	(CFG_PROG_STRCT *) fw_image_code,
+	0x000F368E,
+	00000000,					//(dummy) pdaplug
+	00000000,					//(dummy) priplug
+	(CFG_RANGE20_STRCT *) fw_image_infocompat,
+	(CFG_IDENTITY_STRCT *) fw_image_infoidentity,
+};
+
diff --git a/drivers/staging/wlags49_h2/sta_h25.c b/drivers/staging/wlags49_h2/sta_h25.c
new file mode 100644
index 000000000000..86ca1cdd8497
--- /dev/null
+++ b/drivers/staging/wlags49_h2/sta_h25.c
@@ -0,0 +1,5255 @@
+/*
+ * File:	sta_h54.136
+ *
+ * Abstract:	This file contains memory image 'fw_image'.
+ *
+ * Contents:	Total size of the memory image: 81742 bytes.
+ *		Total number of blocks: 4 blocks.
+ *		Block  1 : load address 00000060, 388 bytes.
+ *		Block  2 : load address 00000C16, 11278 bytes.
+ *		Block  3 : load address 001E3824, 21726 bytes.
+ *		Block  4 : load address 001F4000, 48350 bytes.
+ *
+ * Identity:	component id: 31 (variant 4) version 1.36
+ *
+ * Compatibility:
+ *		supplying interface 4 (variant 4) : 1 - 2
+ *		acting on interface 1 (variant 7) : 3 - 3
+ *		acting on interface 1 (variant 8) : 1 - 1
+ *		acting on interface 2 (variant 4) : 1 - 2
+ *
+ * Generated:	by g:\fw\fupu3.exe version 4.26
+ *
+ * Commandline:	g:\fw\fupu3.exe /f=4 /n=fw_image /i=r4013600.hex
+ */
+
+
+#include "hcfcfg.h"				// to get hcf_16 etc defined as well as
+                                // possible settings which inluence mdd.h or dhf.h
+#include "mdd.h"   				//to get COMP_ID_STA etc defined
+#include "dhf.h"   				//used to be "fhfmem.h", to get memblock,plugrecord,
+
+static const hcf_8 fw_image_1_data[] = {
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xDA, 0x0C, 0x00, 0x00,
+	 0x00, 0x0D, 0x00, 0x00, 0x00, 0x0D, 0x65, 0x37, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x1B, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1B, 0x00, 0x1B, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0A, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x14, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xB2, 0x1B, 0xB2, 0x1B,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00,
+	 0x02, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x05, 0x00, 0x02, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xEA, 0x00, 0x00, 0xFF, 0x07,
+	 0x01, 0x00, 0x64, 0x00, 0x64, 0x00, 0x10, 0x27, 0x10, 0x27, 0x14, 0x00, 0xD0, 0x07, 0xD0, 0x07,
+	 0x10, 0x27, 0x2F, 0x00, 0x32, 0x00, 0x32, 0x00, 0x05, 0x00, 0x02, 0x00, 0x02, 0x00, 0x10, 0x27,
+	 0x05, 0x00, 0x00, 0x02, 0x00, 0x02, 0x13, 0x00, 0x07, 0x00, 0x03, 0x00, 0x32, 0x00, 0x02, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x2A, 0x09, 0x2B, 0x09, 0x2B, 0x09, 0xFF, 0x0F, 0xF0, 0x0F,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x14, 0x01, 0x00, 0x40, 0x00, 0x32, 0x00, 0x32, 0x00, 0x0A, 0x00,
+	 0x02, 0x00, 0x06, 0x00, 0x02, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00,
+
+};  /* fw_image_1_data */
+
+static const hcf_8 fw_image_2_data[] = {
+	 0xF4, 0xA3, 0x00, 0x16, 0x08, 0x40, 0x0F, 0xD2, 0xE1, 0x28, 0xA5, 0x7C, 0x50, 0x30, 0xF1, 0x84,
+	 0x44, 0x08, 0xAB, 0xAE, 0xA5, 0xB8, 0xFC, 0xBA, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05,
+	 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xA5, 0xC6, 0x84, 0xF8, 0x99, 0xEE,
+	 0x8D, 0xF6, 0x0D, 0xFF, 0xBD, 0xD6, 0xB1, 0xDE, 0x54, 0x91, 0x50, 0x60, 0x03, 0x02, 0xA9, 0xCE,
+	 0x7D, 0x56, 0x19, 0xE7, 0x62, 0xB5, 0xE6, 0x4D, 0x9A, 0xEC, 0x45, 0x8F, 0x9D, 0x1F, 0x40, 0x89,
+	 0x87, 0xFA, 0x15, 0xEF, 0xEB, 0xB2, 0xC9, 0x8E, 0x0B, 0xFB, 0xEC, 0x41, 0x67, 0xB3, 0xFD, 0x5F,
+	 0xEA, 0x45, 0xBF, 0x23, 0xF7, 0x53, 0x96, 0xE4, 0x5B, 0x9B, 0xC2, 0x75, 0x1C, 0xE1, 0xAE, 0x3D,
+	 0x6A, 0x4C, 0x5A, 0x6C, 0x41, 0x7E, 0x02, 0xF5, 0x4F, 0x83, 0x5C, 0x68, 0xF4, 0x51, 0x34, 0xD1,
+	 0x08, 0xF9, 0x93, 0xE2, 0x73, 0xAB, 0x53, 0x62, 0x3F, 0x2A, 0x0C, 0x08, 0x52, 0x95, 0x65, 0x46,
+	 0x5E, 0x9D, 0x28, 0x30, 0xA1, 0x37, 0x0F, 0x0A, 0xB5, 0x2F, 0x09, 0x0E, 0x36, 0x24, 0x9B, 0x1B,
+	 0x3D, 0xDF, 0x26, 0xCD, 0x69, 0x4E, 0xCD, 0x7F, 0x9F, 0xEA, 0x1B, 0x12, 0x9E, 0x1D, 0x74, 0x58,
+	 0x2E, 0x34, 0x2D, 0x36, 0xB2, 0xDC, 0xEE, 0xB4, 0xFB, 0x5B, 0xF6, 0xA4, 0x4D, 0x76, 0x61, 0xB7,
+	 0xCE, 0x7D, 0x7B, 0x52, 0x3E, 0xDD, 0x71, 0x5E, 0x97, 0x13, 0xF5, 0xA6, 0x68, 0xB9, 0x00, 0x00,
+	 0x2C, 0xC1, 0x60, 0x40, 0x1F, 0xE3, 0xC8, 0x79, 0xED, 0xB6, 0xBE, 0xD4, 0x46, 0x8D, 0xD9, 0x67,
+	 0x4B, 0x72, 0xDE, 0x94, 0xD4, 0x98, 0xE8, 0xB0, 0x4A, 0x85, 0x6B, 0xBB, 0x2A, 0xC5, 0xE5, 0x4F,
+	 0x16, 0xED, 0xC5, 0x86, 0xD7, 0x9A, 0x55, 0x66, 0x94, 0x11, 0xCF, 0x8A, 0x10, 0xE9, 0x06, 0x04,
+	 0x81, 0xFE, 0xF0, 0xA0, 0x44, 0x78, 0xBA, 0x25, 0xE3, 0x4B, 0xF3, 0xA2, 0xFE, 0x5D, 0xC0, 0x80,
+	 0x8A, 0x05, 0xAD, 0x3F, 0xBC, 0x21, 0x48, 0x70, 0x04, 0xF1, 0xDF, 0x63, 0xC1, 0x77, 0x75, 0xAF,
+	 0x63, 0x42, 0x30, 0x20, 0x1A, 0xE5, 0x0E, 0xFD, 0x6D, 0xBF, 0x4C, 0x81, 0x14, 0x18, 0x35, 0x26,
+	 0x2F, 0xC3, 0xE1, 0xBE, 0xA2, 0x35, 0xCC, 0x88, 0x39, 0x2E, 0x57, 0x93, 0xF2, 0x55, 0x82, 0xFC,
+	 0x47, 0x7A, 0xAC, 0xC8, 0xE7, 0xBA, 0x2B, 0x32, 0x95, 0xE6, 0xA0, 0xC0, 0x98, 0x19, 0xD1, 0x9E,
+	 0x7F, 0xA3, 0x66, 0x44, 0x7E, 0x54, 0xAB, 0x3B, 0x83, 0x0B, 0xCA, 0x8C, 0x29, 0xC7, 0xD3, 0x6B,
+	 0x3C, 0x28, 0x79, 0xA7, 0xE2, 0xBC, 0x1D, 0x16, 0x76, 0xAD, 0x3B, 0xDB, 0x56, 0x64, 0x4E, 0x74,
+	 0x1E, 0x14, 0xDB, 0x92, 0x0A, 0x0C, 0x6C, 0x48, 0xE4, 0xB8, 0x5D, 0x9F, 0x6E, 0xBD, 0xEF, 0x43,
+	 0xA6, 0xC4, 0xA8, 0x39, 0xA4, 0x31, 0x37, 0xD3, 0x8B, 0xF2, 0x32, 0xD5, 0x43, 0x8B, 0x59, 0x6E,
+	 0xB7, 0xDA, 0x8C, 0x01, 0x64, 0xB1, 0xD2, 0x9C, 0xE0, 0x49, 0xB4, 0xD8, 0xFA, 0xAC, 0x07, 0xF3,
+	 0x25, 0xCF, 0xAF, 0xCA, 0x8E, 0xF4, 0xE9, 0x47, 0x18, 0x10, 0xD5, 0x6F, 0x88, 0xF0, 0x6F, 0x4A,
+	 0x72, 0x5C, 0x24, 0x38, 0xF1, 0x57, 0xC7, 0x73, 0x51, 0x97, 0x23, 0xCB, 0x7C, 0xA1, 0x9C, 0xE8,
+	 0x21, 0x3E, 0xDD, 0x96, 0xDC, 0x61, 0x86, 0x0D, 0x85, 0x0F, 0x90, 0xE0, 0x42, 0x7C, 0xC4, 0x71,
+	 0xAA, 0xCC, 0xD8, 0x90, 0x05, 0x06, 0x01, 0xF7, 0x12, 0x1C, 0xA3, 0xC2, 0x5F, 0x6A, 0xF9, 0xAE,
+	 0xD0, 0x69, 0x91, 0x17, 0x58, 0x99, 0x27, 0x3A, 0xB9, 0x27, 0x38, 0xD9, 0x13, 0xEB, 0xB3, 0x2B,
+	 0x33, 0x22, 0xBB, 0xD2, 0x70, 0xA9, 0x89, 0x07, 0xA7, 0x33, 0xB6, 0x2D, 0x22, 0x3C, 0x92, 0x15,
+	 0x20, 0xC9, 0x49, 0x87, 0xFF, 0xAA, 0x78, 0x50, 0x7A, 0xA5, 0x8F, 0x03, 0xF8, 0x59, 0x80, 0x09,
+	 0x17, 0x1A, 0xDA, 0x65, 0x31, 0xD7, 0xC6, 0x84, 0xB8, 0xD0, 0xC3, 0x82, 0xB0, 0x29, 0x77, 0x5A,
+	 0x11, 0x1E, 0xCB, 0x7B, 0xFC, 0xA8, 0xD6, 0x6D, 0x3A, 0x2C, 0x00, 0x30, 0x00, 0x31, 0x00, 0x33,
+	 0x00, 0x34, 0x00, 0x35, 0x00, 0x36, 0x00, 0x37, 0x00, 0x38, 0x00, 0x38, 0x00, 0x3A, 0x00, 0x3B,
+	 0x00, 0x3C, 0x00, 0x3D, 0x00, 0x3E, 0x00, 0x3F, 0x00, 0x3F, 0x59, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x59, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xE6, 0x28, 0x10, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x01, 0x0A, 0x02, 0x14, 0x05, 0x32, 0x0B, 0x37, 0x08, 0x50, 0x0B, 0x6E,
+	 0x02, 0x00, 0x04, 0x00, 0x0B, 0x00, 0x16, 0x00, 0x0C, 0x00, 0x12, 0x00, 0x18, 0x00, 0x24, 0x00,
+	 0x30, 0x00, 0x48, 0x00, 0x60, 0x00, 0x6C, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x39, 0x00, 0x39, 0x00, 0x20, 0x00, 0x39, 0x00, 0x39, 0x00, 0x20, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x0A, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0B, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0C, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x0D, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0E, 0x00, 0x00, 0x00, 0x00, 0x00, 0xF0, 0x10,
+	 0x3E, 0x11, 0xF6, 0x10, 0x38, 0x11, 0xFC, 0x10, 0x32, 0x11, 0x02, 0x11, 0x2C, 0x11, 0x08, 0x11,
+	 0x26, 0x11, 0x0E, 0x11, 0x20, 0x11, 0x14, 0x11, 0x1A, 0x11, 0x07, 0x01, 0x00, 0x00, 0x16, 0x22,
+	 0x00, 0x04, 0x08, 0x01, 0x00, 0x00, 0x16, 0x26, 0x00, 0x04, 0x09, 0x01, 0x00, 0x00, 0x16, 0x2A,
+	 0x00, 0x04, 0x0A, 0x01, 0x00, 0x00, 0x16, 0x2E, 0x00, 0x04, 0x0B, 0x01, 0x00, 0x00, 0x10, 0x24,
+	 0x04, 0x04, 0x0C, 0x01, 0x00, 0x00, 0x10, 0x28, 0x04, 0x04, 0x0D, 0x01, 0x00, 0x00, 0x10, 0x2C,
+	 0x04, 0x04, 0x0E, 0x01, 0x00, 0x00, 0x10, 0x30, 0x04, 0x04, 0x0F, 0x01, 0x00, 0x00, 0x14, 0x34,
+	 0x08, 0x84, 0x10, 0x01, 0x00, 0x00, 0x14, 0x38, 0x08, 0x84, 0x11, 0x01, 0x00, 0x00, 0x14, 0x3C,
+	 0x08, 0x84, 0x12, 0x01, 0x00, 0x00, 0x14, 0x40, 0x08, 0x84, 0x13, 0x01, 0x00, 0x00, 0x17, 0x64,
+	 0x0C, 0x8B, 0x14, 0x01, 0x00, 0x00, 0x17, 0x68, 0x0C, 0x8B, 0x15, 0x01, 0x00, 0x00, 0x17, 0x6C,
+	 0x0C, 0x8B, 0x16, 0x01, 0x00, 0x00, 0x17, 0x70, 0x0C, 0x8B, 0x17, 0x01, 0x00, 0x00, 0x17, 0x74,
+	 0x0C, 0x8B, 0x18, 0x01, 0x00, 0x00, 0x17, 0x78, 0x0C, 0x8B, 0x19, 0x01, 0x00, 0x00, 0x17, 0x7C,
+	 0x0C, 0x8B, 0x1A, 0x01, 0x00, 0x00, 0x17, 0x80, 0x0C, 0x8B, 0x1B, 0x01, 0x00, 0x00, 0x17, 0x84,
+	 0x0C, 0x8B, 0x1C, 0x01, 0x00, 0x00, 0x17, 0x88, 0x0C, 0x8B, 0x1D, 0x01, 0x00, 0x00, 0x17, 0x8C,
+	 0x0C, 0x8B, 0x1E, 0x01, 0x00, 0x00, 0x0E, 0x95, 0x17, 0x04, 0x1F, 0x01, 0x00, 0x00, 0x0E, 0x99,
+	 0x17, 0x04, 0x20, 0x01, 0x00, 0x00, 0x0E, 0x9D, 0x17, 0x04, 0x21, 0x01, 0x00, 0x00, 0x0E, 0xA1,
+	 0x17, 0x04, 0x22, 0x01, 0x00, 0x00, 0x0E, 0xA5, 0x00, 0x00, 0x60, 0x11, 0x80, 0x11, 0xA0, 0x11,
+	 0xC0, 0x11, 0x18, 0x12, 0x68, 0x11, 0x88, 0x11, 0xA8, 0x11, 0xC8, 0x11, 0x20, 0x12, 0x70, 0x11,
+	 0x90, 0x11, 0xB0, 0x11, 0xD0, 0x11, 0x28, 0x12, 0x78, 0x11, 0x98, 0x11, 0xB8, 0x11, 0xD8, 0x11,
+	 0x30, 0x12, 0xE0, 0x11, 0xE8, 0x11, 0xF0, 0x11, 0xF8, 0x11, 0x00, 0x12, 0x08, 0x12, 0x10, 0x12,
+	 0x38, 0x12, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x0A, 0x0A, 0x7F,
+	 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F,
+	 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x1E, 0x1E, 0x1E, 0x1E,
+	 0x1E, 0x1E, 0x1E, 0x1E, 0x1E, 0x1E, 0x1E, 0x0A, 0x0A, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x10, 0x10,
+	 0x10, 0x10, 0x17, 0x17, 0x17, 0x17, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F,
+	 0x7F, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14,
+	 0x14, 0x14, 0x14, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x11, 0x11, 0x11, 0x11, 0x7F, 0x7F, 0x7F, 0x7F,
+	 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E,
+	 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x16, 0x16,
+	 0x16, 0x16, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F,
+	 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x0A, 0x0A, 0x0A, 0x0A, 0x0A, 0x0A,
+	 0x0A, 0x0A, 0x0A, 0x0A, 0x0A, 0x0A, 0x0A, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F,
+	 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x0A,
+	 0x0A, 0x0A, 0x0A, 0x7F, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14,
+	 0x14, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F,
+	 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x10, 0x10, 0x10, 0x10, 0x7F, 0x14, 0x14,
+	 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x0A, 0x0A, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F,
+	 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F,
+	 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14,
+	 0x14, 0x14, 0x14, 0x14, 0x14, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F,
+	 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F,
+	 0x7F, 0x7F, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14,
+	 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F,
+	 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x9D, 0x9D, 0xA1, 0xB4,
+	 0x10, 0x10, 0x00, 0x9D, 0x08, 0x02, 0x06, 0x00, 0xA5, 0xA5, 0xAA, 0xB4, 0x10, 0x10, 0x00, 0xA2,
+	 0x15, 0x05, 0x07, 0x00, 0xAA, 0xAA, 0xB4, 0xB4, 0x10, 0x10, 0x00, 0xA7, 0x1C, 0x0A, 0x08, 0x00,
+	 0xB7, 0xB7, 0xC1, 0xC1, 0x10, 0x10, 0x00, 0xB4, 0x29, 0x17, 0x08, 0x00, 0xBD, 0xBD, 0xC7, 0xC7,
+	 0x10, 0x10, 0x00, 0xBA, 0x2F, 0x1D, 0x08, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC4, 0x1F, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x74, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x42, 0x2A, 0x5B, 0x2A, 0x7E, 0x2A, 0x71, 0x30, 0xEE, 0x29, 0x88, 0x30, 0xB8, 0x2A,
+	 0x9F, 0x30, 0xEE, 0x29, 0xEE, 0x29, 0xEE, 0x29, 0x21, 0x35, 0xEE, 0x29, 0xEE, 0x29, 0xEE, 0x29,
+	 0xEE, 0x29, 0xEE, 0x29, 0x93, 0x2C, 0xEE, 0x29, 0xEE, 0x29, 0xEE, 0x29, 0xEE, 0x29, 0xEE, 0x29,
+	 0xEE, 0x29, 0xEE, 0x29, 0xEE, 0x29, 0xEE, 0x29, 0xEE, 0x29, 0xEE, 0x29, 0xEE, 0x29, 0xEE, 0x29,
+	 0xEE, 0x29, 0xEE, 0x29, 0xDE, 0x2C, 0xEE, 0x29, 0xEE, 0x29, 0xEE, 0x29, 0xEE, 0x29, 0xEE, 0x29,
+	 0xEE, 0x29, 0xEE, 0x29, 0xEE, 0x29, 0xEE, 0x29, 0xEE, 0x29, 0xEE, 0x29, 0xEE, 0x29, 0xEE, 0x29,
+	 0xEE, 0x29, 0x61, 0x2C, 0x7C, 0x2C, 0xEE, 0x29, 0xEE, 0x29, 0xEE, 0x29, 0xEE, 0x29, 0xEE, 0x29,
+	 0xEE, 0x29, 0xE1, 0x27, 0xD7, 0x2A, 0xEA, 0x2A, 0x9A, 0x2B, 0x9E, 0x2B, 0xEE, 0x29, 0xEE, 0x29,
+	 0x4D, 0x2C, 0xA1, 0xF2, 0x62, 0xF2, 0x00, 0x00, 0x99, 0xF2, 0xEE, 0xF2, 0x12, 0xF3, 0x48, 0xF3,
+	 0x00, 0x00, 0x00, 0x00, 0x70, 0x2A, 0x94, 0x2A, 0x00, 0x00, 0x67, 0x30, 0x7E, 0x30, 0x95, 0x30,
+	 0xAF, 0x30, 0x00, 0x00, 0x00, 0x00, 0xE0, 0xFC, 0x45, 0x2D, 0xF7, 0x2F, 0x5A, 0x00, 0x02, 0x00,
+	 0xF9, 0xFF, 0x45, 0x2D, 0x5B, 0x2D, 0xFC, 0x00, 0x02, 0x00, 0xF7, 0xFF, 0x45, 0x2D, 0x5B, 0x2D,
+	 0xAA, 0x2D, 0x06, 0x00, 0xF0, 0xFF, 0x45, 0x2D, 0x22, 0x2D, 0x00, 0x00, 0x00, 0x02, 0xF6, 0xFF,
+	 0x45, 0x2D, 0x5B, 0x2D, 0x6C, 0x00, 0x02, 0x00, 0xF4, 0xFF, 0x45, 0x2D, 0x5B, 0x2D, 0xA6, 0x01,
+	 0x02, 0x00, 0xF5, 0xFF, 0x45, 0x2D, 0x00, 0x30, 0x9C, 0x2D, 0x02, 0x00, 0xED, 0xFF, 0x45, 0x2D,
+	 0x12, 0x30, 0x98, 0x32, 0x02, 0x00, 0xEC, 0xFF, 0x45, 0x2D, 0x40, 0x30, 0x9A, 0x32, 0x02, 0x00,
+	 0xEB, 0xFF, 0x45, 0x2D, 0x46, 0x30, 0x9C, 0x32, 0x02, 0x00, 0xEE, 0xFF, 0x45, 0x2D, 0x4C, 0x30,
+	 0x12, 0x33, 0x02, 0x00, 0xDA, 0xFF, 0x45, 0x2D, 0x5B, 0x2D, 0xF2, 0x13, 0x0C, 0x00, 0xEA, 0xFF,
+	 0x45, 0x2D, 0x22, 0x2D, 0x4C, 0x33, 0x06, 0x00, 0xE9, 0xFF, 0x45, 0x2D, 0x5B, 0x2D, 0x52, 0x33,
+	 0x02, 0x00, 0xE8, 0xFF, 0x45, 0x2D, 0x5B, 0x2D, 0x54, 0x33, 0x02, 0x00, 0xE7, 0xFF, 0x45, 0x2D,
+	 0x5B, 0x2D, 0x56, 0x33, 0x02, 0x00, 0xE6, 0xFF, 0x45, 0x2D, 0x5B, 0x2D, 0x58, 0x33, 0x02, 0x00,
+	 0xE5, 0xFF, 0x45, 0x2D, 0x5B, 0x2D, 0x5A, 0x33, 0x10, 0x00, 0xE4, 0xFF, 0x45, 0x2D, 0x5B, 0x2D,
+	 0x6A, 0x33, 0x18, 0x00, 0xDB, 0xFF, 0x45, 0x2D, 0x5B, 0x2D, 0x82, 0x33, 0x02, 0x00, 0xDC, 0xFF,
+	 0x45, 0x2D, 0x5B, 0x2D, 0x84, 0x33, 0x02, 0x00, 0xE1, 0xFF, 0x45, 0x2D, 0x5B, 0x2D, 0x5A, 0x34,
+	 0x02, 0x00, 0xE0, 0xFF, 0x45, 0x2D, 0x5B, 0x2D, 0x58, 0x34, 0x02, 0x00, 0xE3, 0xFF, 0x45, 0x2D,
+	 0x5B, 0x2D, 0x3C, 0x34, 0x02, 0x00, 0xE2, 0xFF, 0x93, 0x2D, 0x22, 0x2D, 0xF2, 0x33, 0x24, 0x00,
+	 0x03, 0xFC, 0x45, 0x2D, 0x01, 0x2F, 0x8C, 0x32, 0x02, 0x00, 0x04, 0xFC, 0x45, 0x2D, 0x55, 0x2D,
+	 0xB4, 0x2D, 0x22, 0x00, 0x06, 0xFC, 0x45, 0x2D, 0x5B, 0x2D, 0x9A, 0x2D, 0x02, 0x00, 0x07, 0xFC,
+	 0x45, 0x2D, 0x5B, 0x2D, 0xF8, 0x2D, 0x02, 0x00, 0x0E, 0xFC, 0x45, 0x2D, 0x2A, 0x2F, 0x02, 0x2E,
+	 0x22, 0x00, 0xB1, 0xFC, 0x45, 0x2D, 0x39, 0x31, 0x00, 0x2F, 0x02, 0x00, 0x20, 0xFC, 0x45, 0x2D,
+	 0x5B, 0x2D, 0x28, 0x2E, 0x02, 0x00, 0x25, 0xFC, 0x45, 0x2D, 0x5B, 0x2D, 0x34, 0x2E, 0x02, 0x00,
+	 0x26, 0xFC, 0x45, 0x2D, 0x5B, 0x2D, 0x36, 0x2E, 0x02, 0x00, 0x27, 0xFC, 0x45, 0x2D, 0x5B, 0x2D,
+	 0x38, 0x2E, 0x02, 0x00, 0xB2, 0xFC, 0x45, 0x2D, 0x55, 0x2D, 0x24, 0x2F, 0x22, 0x00, 0xC1, 0xFC,
+	 0x45, 0x2D, 0x5B, 0x2D, 0x9E, 0x33, 0x20, 0x00, 0xB0, 0xFC, 0x18, 0x2D, 0x3D, 0x31, 0x00, 0x00,
+	 0x00, 0x00, 0xC4, 0xFC, 0x18, 0x2D, 0x57, 0x30, 0x00, 0x00, 0x08, 0x00, 0xC8, 0xFC, 0x18, 0x2D,
+	 0x55, 0x30, 0x00, 0x00, 0x08, 0x00, 0xB4, 0xFC, 0x18, 0x2D, 0x71, 0x31, 0x00, 0x00, 0x00, 0x00,
+	 0xB6, 0xFC, 0x18, 0x2D, 0x19, 0x32, 0x00, 0x00, 0x00, 0x00, 0xB7, 0xFC, 0x18, 0x2D, 0x43, 0x32,
+	 0x00, 0x00, 0x00, 0x00, 0xB8, 0xFC, 0x18, 0x2D, 0x99, 0x32, 0x00, 0x00, 0x00, 0x00, 0xBC, 0xFC,
+	 0x18, 0x2D, 0xD2, 0x32, 0x00, 0x00, 0x00, 0x00, 0xBD, 0xFC, 0x18, 0x2D, 0x58, 0x33, 0x00, 0x00,
+	 0x00, 0x00, 0xBE, 0xFC, 0x18, 0x2D, 0x82, 0x33, 0x00, 0x00, 0x00, 0x00, 0xBF, 0xFC, 0x18, 0x2D,
+	 0xCF, 0x33, 0x00, 0x00, 0x00, 0x00, 0xB3, 0xFC, 0x45, 0x2D, 0x5B, 0x2D, 0xA0, 0x0F, 0x10, 0x00,
+	 0xB5, 0xFC, 0x45, 0x2D, 0x5B, 0x2D, 0x38, 0x34, 0x02, 0x00, 0xB9, 0xFC, 0x45, 0x2D, 0x5B, 0x2D,
+	 0x3A, 0x34, 0x02, 0x00, 0x90, 0xFD, 0x45, 0x2D, 0x22, 0x2D, 0x3E, 0x34, 0x02, 0x00, 0x88, 0xFC,
+	 0x45, 0x2D, 0x5B, 0x2D, 0x72, 0x32, 0x04, 0x00, 0x89, 0xFC, 0x45, 0x2D, 0x5B, 0x2D, 0x76, 0x32,
+	 0x04, 0x00, 0xC5, 0xFC, 0x45, 0x2D, 0x5B, 0x2D, 0x7A, 0x32, 0x04, 0x00, 0x23, 0xFC, 0x45, 0x2D,
+	 0x5B, 0x2D, 0x2E, 0x2E, 0x04, 0x00, 0x2A, 0xFC, 0x45, 0x2D, 0xE9, 0x2D, 0xB0, 0x2D, 0x02, 0x00,
+	 0xC7, 0xFD, 0x45, 0x2D, 0x22, 0x2D, 0xA0, 0x32, 0x0A, 0x00, 0x29, 0xFC, 0x3C, 0x2E, 0x00, 0x2E,
+	 0x00, 0x00, 0x00, 0x00, 0xC2, 0xFC, 0x45, 0x2D, 0x5B, 0x2D, 0x80, 0x32, 0x08, 0x00, 0x32, 0xFC,
+	 0x45, 0x2D, 0x5B, 0x2D, 0x98, 0x01, 0x02, 0x00, 0x33, 0xFC, 0x45, 0x2D, 0x5B, 0x2D, 0x9A, 0x01,
+	 0x02, 0x00, 0x35, 0xFC, 0x45, 0x2D, 0x5B, 0x2D, 0x88, 0x32, 0x02, 0x00, 0xC7, 0xFC, 0x45, 0x2D,
+	 0xD3, 0x2F, 0x8A, 0x32, 0x02, 0x00, 0x00, 0xFC, 0x45, 0x2D, 0x5B, 0x2D, 0xB2, 0x2D, 0x02, 0x00,
+	 0x01, 0xFC, 0x45, 0x2D, 0x5B, 0x2D, 0xAA, 0x2D, 0x06, 0x00, 0x02, 0xFC, 0x45, 0x2D, 0xD5, 0x2D,
+	 0x02, 0x2F, 0x22, 0x00, 0x05, 0xFC, 0x45, 0x2D, 0x5B, 0x2D, 0xA0, 0x2D, 0x02, 0x00, 0x08, 0xFC,
+	 0x45, 0x2D, 0x5B, 0x2D, 0xA4, 0x2D, 0x06, 0x00, 0x09, 0xFC, 0x45, 0x2D, 0x5B, 0x2D, 0xFA, 0x2D,
+	 0x02, 0x00, 0x0B, 0xFC, 0x45, 0x2D, 0x5B, 0x2D, 0xFC, 0x2D, 0x02, 0x00, 0x0C, 0xFC, 0x45, 0x2D,
+	 0x5B, 0x2D, 0xFE, 0x2D, 0x02, 0x00, 0x0D, 0xFC, 0x45, 0x2D, 0x5B, 0x2D, 0x00, 0x2E, 0x02, 0x00,
+	 0x21, 0xFC, 0x45, 0x2D, 0x5B, 0x2D, 0x2A, 0x2E, 0x02, 0x00, 0x80, 0xFC, 0xB1, 0x2D, 0xC1, 0x2D,
+	 0x40, 0x2E, 0xC0, 0x00, 0x81, 0xFC, 0x45, 0x2D, 0x5B, 0x2D, 0xA4, 0x01, 0x02, 0x00, 0x83, 0xFC,
+	 0x45, 0x2D, 0x5B, 0x2D, 0xA8, 0x01, 0x02, 0x00, 0x85, 0xFC, 0x45, 0x2D, 0x4A, 0x2F, 0xA0, 0x01,
+	 0x02, 0x00, 0x86, 0xFC, 0x45, 0x2D, 0x6E, 0x2F, 0xB0, 0x01, 0x02, 0x00, 0x28, 0xFC, 0x45, 0x2D,
+	 0x5B, 0x2D, 0x3A, 0x2E, 0x02, 0x00, 0x90, 0xFC, 0x45, 0x2D, 0x5C, 0x2F, 0xA2, 0x01, 0x02, 0x00,
+	 0x87, 0xFC, 0x45, 0x2D, 0x8C, 0x2F, 0x50, 0x2F, 0x22, 0x03, 0x30, 0xFC, 0x45, 0x2D, 0x5B, 0x2D,
+	 0x3C, 0x2E, 0x02, 0x00, 0x84, 0xFC, 0x45, 0x2D, 0x92, 0x2F, 0xAC, 0x01, 0x04, 0x00, 0x2B, 0xFC,
+	 0x45, 0x2D, 0x5B, 0x2D, 0xE2, 0x37, 0x02, 0x00, 0xF8, 0xFF, 0x45, 0x2D, 0x5B, 0x2D, 0xDC, 0x37,
+	 0x02, 0x00, 0xF3, 0xFF, 0x45, 0x2D, 0x5B, 0x2D, 0xE4, 0x37, 0x02, 0x00, 0x20, 0xFD, 0x76, 0x2D,
+	 0x22, 0x2D, 0x5E, 0x40, 0x08, 0x00, 0x21, 0xFD, 0x76, 0x2D, 0x22, 0x2D, 0x62, 0x40, 0x0A, 0x00,
+	 0x22, 0xFD, 0x76, 0x2D, 0x22, 0x2D, 0x67, 0x40, 0x16, 0x00, 0x23, 0xFD, 0x76, 0x2D, 0x22, 0x2D,
+	 0x72, 0x40, 0x0A, 0x00, 0x45, 0xFD, 0x45, 0x2D, 0x22, 0x2D, 0xFC, 0x00, 0x02, 0x00, 0x47, 0xFD,
+	 0x45, 0x2D, 0x22, 0x2D, 0x72, 0x01, 0x02, 0x00, 0x48, 0xFD, 0x91, 0x2E, 0x22, 0x2D, 0x98, 0x01,
+	 0x02, 0x00, 0x49, 0xFD, 0x91, 0x2E, 0x22, 0x2D, 0x9A, 0x01, 0x02, 0x00, 0x4A, 0xFD, 0x45, 0x2D,
+	 0x22, 0x2D, 0x92, 0x01, 0x02, 0x00, 0x4B, 0xFD, 0x45, 0x2D, 0x22, 0x2D, 0x94, 0x01, 0x02, 0x00,
+	 0x4D, 0xFD, 0x76, 0x2D, 0x22, 0x2D, 0x77, 0x40, 0x0C, 0x00, 0x4F, 0xFD, 0xA5, 0x2E, 0x22, 0x2D,
+	 0x90, 0x32, 0x02, 0x00, 0xC2, 0xFD, 0x9B, 0x2E, 0x22, 0x2D, 0x00, 0x00, 0x02, 0x00, 0x40, 0xFD,
+	 0x6E, 0x2D, 0x22, 0x2D, 0xB6, 0x01, 0x02, 0x00, 0x24, 0xFD, 0xB5, 0x2E, 0x22, 0x2D, 0x00, 0x00,
+	 0x02, 0x00, 0x91, 0xFD, 0x45, 0x2D, 0x22, 0x2D, 0xC6, 0x25, 0x02, 0x00, 0x93, 0xFD, 0x45, 0x2D,
+	 0x22, 0x2D, 0xCC, 0x25, 0x02, 0x00, 0x8F, 0xFD, 0xD5, 0x2E, 0x22, 0x2D, 0x00, 0x00, 0x08, 0x00,
+	 0xC1, 0xFD, 0x00, 0x31, 0x22, 0x2D, 0xFA, 0x00, 0x02, 0x00, 0xC6, 0xFD, 0x45, 0x2D, 0x22, 0x2D,
+	 0xF8, 0x37, 0x04, 0x00, 0x25, 0xFD, 0x45, 0x2D, 0x22, 0x2D, 0x9E, 0x01, 0x02, 0x00, 0x89, 0xFD,
+	 0xB9, 0x30, 0x22, 0x2D, 0x00, 0x00, 0x00, 0x00, 0x8A, 0xFD, 0x93, 0x2D, 0x22, 0x2D, 0x12, 0x34,
+	 0x24, 0x00, 0x41, 0xFD, 0x45, 0x2D, 0x22, 0x2D, 0xBE, 0x33, 0x22, 0x00, 0x42, 0xFD, 0x45, 0x2D,
+	 0x22, 0x2D, 0xFE, 0x00, 0x06, 0x00, 0x43, 0xFD, 0xC2, 0x2E, 0x22, 0x2D, 0x00, 0x00, 0x06, 0x00,
+	 0x44, 0xFD, 0xAC, 0x2E, 0x22, 0x2D, 0xB2, 0x01, 0x02, 0x00, 0x46, 0xFD, 0x21, 0x31, 0x22, 0x2D,
+	 0x00, 0x00, 0x00, 0x00, 0x4C, 0xFD, 0x45, 0x2D, 0x22, 0x2D, 0x46, 0x2F, 0x02, 0x00, 0x50, 0xFD,
+	 0x45, 0x2D, 0x22, 0x2D, 0xF2, 0x00, 0x02, 0x00, 0x51, 0xFD, 0x45, 0x2D, 0x22, 0x2D, 0xF4, 0x00,
+	 0x02, 0x00, 0x52, 0xFD, 0x45, 0x2D, 0x22, 0x2D, 0xC4, 0x01, 0x02, 0x00, 0x8C, 0xFD, 0x38, 0x2D,
+	 0x22, 0x2D, 0x98, 0x34, 0x56, 0x00, 0x8D, 0xFD, 0x38, 0x2D, 0x22, 0x2D, 0xF2, 0x34, 0x14, 0x00,
+	 0x00, 0xF1, 0x46, 0x00, 0xDC, 0x2C, 0x36, 0x01, 0x01, 0xF1, 0x84, 0x07, 0xDA, 0x2C, 0x38, 0x01,
+	 0x00, 0x03, 0xA0, 0x80, 0x1E, 0x00, 0x70, 0x01, 0xFA, 0x00, 0xD4, 0x01, 0xFE, 0x00, 0x3A, 0x01,
+	 0xB6, 0x01, 0xCC, 0x2C, 0x54, 0x01, 0xC6, 0x25, 0x20, 0x00, 0x00, 0x00, 0xC0, 0x1D, 0x00, 0x00,
+	 0xC4, 0x1F, 0x4E, 0x01, 0x0B, 0x00, 0xB8, 0x00, 0xEC, 0x00, 0x44, 0x00, 0x46, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x1C, 0x09, 0x08, 0x24, 0x28, 0x06, 0x0C, 0x18, 0x08, 0x30, 0x14, 0x0C,
+	 0x08, 0x36, 0x10, 0x12, 0x24, 0xB7, 0x97, 0xB6, 0xA3, 0xB7, 0xAC, 0xB7, 0xA8, 0xB6, 0x3E, 0xB7,
+	 0x16, 0xB7, 0x79, 0x3E, 0x57, 0x3D, 0x79, 0x3E, 0xF9, 0x3D, 0x5F, 0x3D, 0x52, 0x3D, 0x33, 0x3E,
+	 0x55, 0x3E, 0x6A, 0x3E, 0xAC, 0x3E, 0xD8, 0x3E, 0xF8, 0x3D, 0x22, 0x46, 0x22, 0x46, 0x22, 0x46,
+	 0x22, 0x46, 0x22, 0x46, 0x22, 0x46, 0x22, 0x46, 0x22, 0x46, 0x22, 0x46, 0x22, 0x46, 0x22, 0x46,
+	 0x23, 0x46, 0x23, 0x46, 0x23, 0x46, 0x1C, 0x47, 0x1C, 0x47, 0x1C, 0x47, 0x1C, 0x47, 0x1C, 0x47,
+	 0x1C, 0x47, 0x1C, 0x47, 0x1C, 0x47, 0x1C, 0x47, 0x1C, 0x47, 0x1C, 0x47, 0x1C, 0x47, 0x1C, 0x47,
+	 0x1D, 0x47, 0x9A, 0x48, 0xDA, 0x48, 0x1A, 0x48, 0x5A, 0x48, 0x9A, 0x48, 0xDA, 0x48, 0x1A, 0x48,
+	 0x5A, 0x48, 0x9A, 0x48, 0xDA, 0x48, 0x1A, 0x48, 0x5A, 0x48, 0x9A, 0x48, 0x33, 0x48, 0x78, 0x49,
+	 0x78, 0x49, 0x79, 0x49, 0x79, 0x49, 0x79, 0x49, 0x79, 0x49, 0x7A, 0x49, 0x7A, 0x49, 0x7A, 0x49,
+	 0x7A, 0x49, 0x7B, 0x49, 0x7B, 0x49, 0x7B, 0x49, 0x7C, 0x49, 0xD8, 0x03, 0xDC, 0x03, 0xE0, 0x03,
+	 0xE4, 0x03, 0xF0, 0x03, 0xF4, 0x03, 0xF8, 0x03, 0x0A, 0x04, 0x0E, 0x04, 0x12, 0x04, 0x16, 0x04,
+	 0x0C, 0x04, 0x10, 0x04, 0x14, 0x04, 0x18, 0x04, 0x1C, 0x04, 0x20, 0x04, 0x24, 0x04, 0x28, 0x04,
+	 0x4C, 0x04, 0x50, 0x04, 0x54, 0x04, 0x58, 0x04, 0x5C, 0x04, 0x60, 0x04, 0x64, 0x04, 0x68, 0x04,
+	 0x6C, 0x04, 0x70, 0x04, 0x74, 0x04, 0x7D, 0x04, 0x81, 0x04, 0x85, 0x04, 0x89, 0x04, 0x8D, 0x04,
+	 0x10, 0x00, 0x8E, 0x19, 0xAC, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x80, 0x3C, 0x0C, 0x00, 0x00,
+	 0xFF, 0x3F, 0x44, 0x04, 0x00, 0x00, 0xD3, 0x22, 0x44, 0x04, 0x9C, 0x02, 0xCB, 0x54, 0x44, 0x04,
+	 0x00, 0x00, 0x01, 0x00, 0x44, 0x04, 0x00, 0x00, 0x00, 0x03, 0x00, 0x0C, 0x71, 0x00, 0x30, 0x50,
+	 0x20, 0x00, 0x80, 0xBF, 0x1F, 0xA6, 0x28, 0x00, 0x0B, 0x02, 0x60, 0x84, 0x4C, 0x00, 0x02, 0x00,
+	 0x4B, 0x1C, 0x98, 0x00, 0x00, 0x00, 0x20, 0x0B, 0x34, 0x04, 0xFD, 0x34, 0x34, 0x00, 0x38, 0x04,
+	 0xFD, 0x34, 0x34, 0x00, 0x3C, 0x04, 0x01, 0x00, 0x10, 0x00, 0x00, 0x08, 0x00, 0x52, 0x14, 0x00,
+	 0x04, 0x08, 0x0E, 0x32, 0x00, 0xA6, 0x10, 0x08, 0xC4, 0x03, 0x50, 0x60, 0x18, 0x08, 0xF0, 0x3F,
+	 0xFC, 0x01, 0x10, 0x0C, 0x00, 0x00, 0x80, 0x04, 0x14, 0x0C, 0x00, 0x00, 0x00, 0x41, 0x20, 0x0C,
+	 0xB0, 0x00, 0xB0, 0xB8, 0x24, 0x0C, 0x00, 0x00, 0xAB, 0x05, 0x2C, 0x0C, 0x80, 0x05, 0x00, 0xFF,
+	 0x30, 0x0C, 0x00, 0x00, 0xB0, 0x04, 0x34, 0x0C, 0x03, 0x00, 0x00, 0xE8, 0x44, 0x0C, 0x04, 0x00,
+	 0xFF, 0x0F, 0x00, 0x10, 0x2E, 0x00, 0x0C, 0xE3, 0x44, 0x04, 0x00, 0x00, 0x01, 0x04, 0x44, 0x04,
+	 0x00, 0x00, 0x01, 0x01, 0x44, 0x04, 0x00, 0x00, 0x01, 0x00, 0x44, 0x04, 0x00, 0x00, 0x01, 0x04,
+	 0x44, 0x04, 0x00, 0x00, 0x80, 0x03, 0x48, 0x0C, 0x00, 0x00, 0x7F, 0x00, 0x04, 0x04, 0x08, 0x48,
+	 0x00, 0x00, 0x04, 0x04, 0x08, 0x40, 0x00, 0x00, 0x00, 0x0C, 0x71, 0x00, 0x30, 0x30, 0x00, 0x00,
+	 0x5E, 0x40, 0x01, 0x00, 0x18, 0x00, 0x36, 0xC0, 0xE8, 0x0E, 0x1C, 0x00, 0x78, 0xC8, 0xA5, 0x40,
+	 0x24, 0x00, 0x9E, 0xB0, 0xB9, 0x95, 0x08, 0x08, 0x00, 0xEA, 0x40, 0x01, 0x0C, 0x08, 0x00, 0xEA,
+	 0x00, 0x00, 0x1C, 0x08, 0x00, 0x00, 0x42, 0x07, 0x20, 0x08, 0x7B, 0x00, 0xD4, 0x09, 0x2C, 0x04,
+	 0x14, 0x00, 0x50, 0x14, 0x30, 0x04, 0x28, 0x0F, 0x28, 0x7F, 0x18, 0x08, 0x20, 0x00, 0xFC, 0x01,
+	 0x04, 0x10, 0x69, 0x00, 0xFD, 0xC3, 0x08, 0x10, 0x69, 0x00, 0xFD, 0xC3, 0x08, 0x0C, 0x00, 0x00,
+	 0x00, 0x00, 0x48, 0x0C, 0x00, 0x00, 0x00, 0x00, 0x48, 0x0C, 0x00, 0x00, 0x7F, 0x00, 0x04, 0x04,
+	 0x08, 0x48, 0x02, 0x00, 0x00, 0x00, 0x5E, 0x48, 0x00, 0x00, 0x04, 0x04, 0x08, 0x40, 0x02, 0x00,
+	 0x00, 0x0C, 0x71, 0x00, 0x30, 0x50, 0x00, 0x00, 0x5E, 0x48, 0x01, 0x00, 0x18, 0x00, 0x3A, 0xC0,
+	 0xE8, 0x04, 0x1C, 0x00, 0x78, 0xD0, 0xA5, 0x40, 0x24, 0x00, 0x9E, 0xB0, 0xB9, 0x85, 0x2C, 0x04,
+	 0x14, 0x00, 0x50, 0x14, 0x30, 0x04, 0x28, 0x0F, 0x28, 0x7F, 0x08, 0x08, 0x00, 0xEA, 0x40, 0x01,
+	 0x0C, 0x08, 0x00, 0xEA, 0x00, 0x00, 0x1C, 0x08, 0x00, 0x00, 0x42, 0x07, 0x20, 0x08, 0x7B, 0x00,
+	 0xD4, 0x09, 0x18, 0x08, 0xF0, 0x3F, 0xFC, 0x01, 0x04, 0x10, 0x69, 0x00, 0xDD, 0xCD, 0x08, 0x10,
+	 0x69, 0x00, 0xDD, 0xCD, 0x08, 0x0C, 0x00, 0x00, 0x00, 0x00, 0x48, 0x0C, 0x00, 0x00, 0x00, 0x00,
+	 0x08, 0x04, 0x40, 0x01, 0x41, 0x01, 0x0C, 0x04, 0x40, 0x04, 0x41, 0x04, 0x10, 0x04, 0xD6, 0x08,
+	 0x56, 0x0A, 0x14, 0x04, 0x42, 0x02, 0x56, 0x0A, 0x18, 0x04, 0x56, 0x0A, 0x40, 0x02, 0x1C, 0x04,
+	 0x42, 0x0A, 0x42, 0x2A, 0x20, 0x04, 0xC2, 0x00, 0xD6, 0x08, 0x24, 0x04, 0xD6, 0x08, 0xC0, 0x00,
+	 0x28, 0x04, 0xC2, 0x08, 0xC2, 0x28, 0x08, 0x04, 0x40, 0x01, 0x41, 0x01, 0x0C, 0x04, 0x00, 0x01,
+	 0x01, 0x01, 0x10, 0x04, 0x56, 0x0A, 0x56, 0x0A, 0x14, 0x04, 0x42, 0x02, 0x56, 0x0A, 0x18, 0x04,
+	 0x56, 0x0A, 0x40, 0x02, 0x1C, 0x04, 0x42, 0x0A, 0x42, 0x2A, 0x20, 0x04, 0x42, 0x02, 0x56, 0x0A,
+	 0x24, 0x04, 0x56, 0x0A, 0x40, 0x02, 0x28, 0x04, 0x42, 0x0A, 0x42, 0x2A, 0x08, 0x04, 0x40, 0x01,
+	 0x41, 0x01, 0x0C, 0x04, 0x40, 0x04, 0x41, 0x04, 0x10, 0x04, 0xCE, 0x08, 0x4E, 0x0A, 0x14, 0x04,
+	 0x42, 0x02, 0x4E, 0x0A, 0x18, 0x04, 0x4E, 0x0A, 0x40, 0x02, 0x1C, 0x04, 0x42, 0x0A, 0x42, 0x2A,
+	 0x20, 0x04, 0xC2, 0x00, 0xCE, 0x08, 0x24, 0x04, 0xCE, 0x08, 0xC0, 0x00, 0x28, 0x04, 0xC2, 0x08,
+	 0xC2, 0x28, 0x08, 0x04, 0x40, 0x01, 0x41, 0x01, 0x0C, 0x04, 0x00, 0x01, 0x01, 0x01, 0x10, 0x04,
+	 0x4E, 0x0A, 0x4E, 0x0A, 0x14, 0x04, 0x42, 0x02, 0x4E, 0x0A, 0x18, 0x04, 0x4E, 0x0A, 0x40, 0x02,
+	 0x1C, 0x04, 0x42, 0x0A, 0x42, 0x2A, 0x20, 0x04, 0x42, 0x02, 0x4E, 0x0A, 0x24, 0x04, 0x4E, 0x0A,
+	 0x40, 0x02, 0x28, 0x04, 0x42, 0x0A, 0x42, 0x2A, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00,
+	 0x01, 0x00, 0x01, 0x00, 0x01, 0x00, 0x02, 0x00, 0x03, 0x00, 0x05, 0x00, 0xA0, 0x16, 0xA0, 0x16,
+	 0xA0, 0x16, 0xA0, 0x16, 0xA0, 0x16, 0xA0, 0x16, 0xA0, 0x16, 0xA0, 0x16, 0xA0, 0x16, 0xA0, 0x16,
+	 0xA0, 0x16, 0xA0, 0x16, 0xA0, 0x16, 0xA0, 0x16, 0xA0, 0x16, 0xA0, 0x16, 0xA0, 0x16, 0xA0, 0x16,
+	 0xA0, 0x16, 0xA0, 0x16, 0xA0, 0x16, 0xA0, 0x16, 0xA0, 0x16, 0xA0, 0x16, 0xA0, 0x16, 0xA0, 0x16,
+	 0xA0, 0x16, 0xA0, 0x16, 0xA0, 0x17, 0xA0, 0x17, 0xA0, 0x17, 0xA0, 0x18, 0xFF, 0x06, 0xFF, 0x06,
+	 0xFF, 0x06, 0xFF, 0x06, 0xFF, 0x06, 0xFF, 0x06, 0xFF, 0x06, 0xFF, 0x06, 0xFF, 0x06, 0xFF, 0x06,
+	 0xFF, 0x06, 0xFF, 0x06, 0xFF, 0x06, 0xFF, 0x06, 0xFF, 0x06, 0xFF, 0x06, 0xFF, 0x06, 0xFF, 0x06,
+	 0xFF, 0x06, 0xFF, 0x06, 0xFF, 0x06, 0xFF, 0x06, 0xFF, 0x06, 0xFF, 0x06, 0xFF, 0x06, 0xFF, 0x06,
+	 0xFF, 0x06, 0xFF, 0x06, 0xFF, 0x06, 0xFF, 0x06, 0xFF, 0x06, 0xFF, 0x06, 0x00, 0x00, 0x65, 0x00,
+	 0x65, 0x00, 0x65, 0x00, 0x65, 0x00, 0x5D, 0x00, 0x52, 0x00, 0x48, 0x00, 0x40, 0x00, 0x38, 0x00,
+	 0x31, 0x00, 0x2C, 0x00, 0x27, 0x00, 0x23, 0x00, 0x1F, 0x00, 0x00, 0x00, 0x65, 0x00, 0x65, 0x00,
+	 0x65, 0x00, 0x65, 0x00, 0x5D, 0x00, 0x52, 0x00, 0x48, 0x00, 0x40, 0x00, 0x38, 0x00, 0x31, 0x00,
+	 0x2C, 0x00, 0x27, 0x00, 0x23, 0x00, 0x1F, 0x00, 0x00, 0x00, 0x19, 0x00, 0x19, 0x00, 0x19, 0x00,
+	 0x19, 0x00, 0x19, 0x00, 0x19, 0x00, 0x19, 0x00, 0x19, 0x00, 0x19, 0x00, 0x19, 0x00, 0x19, 0x00,
+	 0x19, 0x00, 0x19, 0x00, 0x19, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0C, 0x00,
+	 0x0C, 0x00, 0x0C, 0x00, 0x0C, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x15, 0x00, 0x6E, 0x6F, 0x6E, 0x2D,
+	 0x73, 0x70, 0x65, 0x63, 0x69, 0x66, 0x69, 0x65, 0x64, 0x20, 0x53, 0x53, 0x49, 0x44, 0x20, 0x21,
+	 0x21, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x01, 0x00, 0x00, 0x20,
+	 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+	 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x00, 0x09,
+	 0x00, 0x00, 0x01, 0x00, 0x64, 0x00, 0x64, 0x00, 0x00, 0x00, 0x48, 0x45, 0x52, 0x4D, 0x45, 0x53,
+	 0x20, 0x32, 0x00, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+	 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x01, 0x00, 0x01, 0x00, 0x04, 0x00, 0x10, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00,
+	 0x01, 0x00, 0x02, 0x00, 0x02, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x14, 0x00, 0x01, 0x00, 0x15, 0x00,
+	 0x6E, 0x6F, 0x6E, 0x2D, 0x73, 0x70, 0x65, 0x63, 0x69, 0x66, 0x69, 0x65, 0x64, 0x20, 0x53, 0x53,
+	 0x49, 0x44, 0x20, 0x21, 0x21, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+	 0x01, 0x00, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+	 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+	 0x20, 0x20, 0x00, 0x09, 0x00, 0x00, 0x01, 0x00, 0x64, 0x00, 0x64, 0x00, 0x00, 0x00, 0x48, 0x45,
+	 0x52, 0x4D, 0x45, 0x53, 0x20, 0x32, 0x00, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+	 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x01, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x04, 0x00, 0x10, 0x00, 0x01, 0x00, 0x00, 0x00,
+	 0x01, 0x00, 0x01, 0x00, 0x01, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46, 0x69,
+	 0x72, 0x73, 0x74, 0x20, 0x57, 0x61, 0x76, 0x65, 0x4C, 0x41, 0x4E, 0x20, 0x49, 0x49, 0x20, 0x53,
+	 0x53, 0x49, 0x44, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x00, 0x00,
+	 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+	 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+	 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0x0F, 0xF0, 0x0F,
+	 0x0F, 0x00, 0x50, 0x01, 0x02, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x2B, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x19, 0x00, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14,
+	 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14,
+	 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14,
+	 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x14, 0x00,
+	 0x14, 0x00, 0x14, 0x00, 0x14, 0x00, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x24, 0x00, 0xFF, 0x00, 0x09, 0x00, 0x09, 0x00, 0x09, 0x00, 0x09, 0x00, 0x0A, 0x00, 0x0A, 0x00,
+	 0x0B, 0x00, 0x0B, 0x00, 0x14, 0x00, 0x14, 0x00, 0x14, 0x00, 0x0A, 0x00, 0x00, 0x00, 0x02, 0x01,
+	 0x02, 0x04, 0x0B, 0x16, 0x00, 0x00, 0x00, 0x00, 0x02, 0x01, 0x82, 0x84, 0x8B, 0x96, 0x00, 0x00,
+	 0x00, 0x00, 0x1C, 0x85, 0x00, 0x00, 0x66, 0x00, 0x00, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x14, 0x00, 0x01, 0x00,
+	 0x00, 0x00, 0x03, 0x00, 0x20, 0x00, 0x1B, 0x00, 0x17, 0x00, 0x11, 0x00, 0x10, 0x00, 0x0B, 0x00,
+	 0x0B, 0x00, 0x09, 0x00, 0x17, 0x00, 0x14, 0x00, 0x10, 0x00, 0x0D, 0x00, 0x0B, 0x00, 0x09, 0x00,
+	 0x08, 0x00, 0x07, 0x00, 0x0D, 0x00, 0x0A, 0x00, 0x09, 0x00, 0x08, 0x00, 0x05, 0x00, 0x05, 0x00,
+	 0xD8, 0x0C, 0xC0, 0x08, 0x90, 0x0D, 0x60, 0x09, 0x48, 0x0E, 0x30, 0x0A, 0x24, 0x0F, 0x18, 0x0B,
+	 0x0B, 0x6E, 0x0B, 0x37, 0x02, 0x14, 0x01, 0x0A, 0x04, 0x00, 0x04, 0x00, 0x04, 0x00, 0x03, 0x00,
+	 0x07, 0x00, 0x07, 0x00, 0x07, 0x00, 0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x20, 0x43, 0x75, 0x72, 0x72, 0x65,
+	 0x6E, 0x74, 0x20, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x20, 0x53, 0x65, 0x74, 0x20, 0x49,
+	 0x64, 0x65, 0x6E, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x20, 0x05, 0x00, 0x00, 0x00, 0x01, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x30, 0x01, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0xDD, 0x00, 0x50,
+	 0xF2, 0x01, 0x01, 0x00, 0x00, 0x50, 0xF2, 0x05, 0x02, 0x00, 0x00, 0x50, 0xF2, 0x02, 0x00, 0x50,
+	 0xF2, 0x04, 0x02, 0x00, 0x00, 0x50, 0xF2, 0x00, 0x00, 0x50, 0xF2, 0x01, 0x06, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x15, 0x00, 0x14, 0x00, 0x15, 0x00, 0x36, 0x00, 0x10, 0x00, 0x10, 0x00, 0x10, 0x00, 0x14, 0x00,
+	 0x11, 0x00, 0x36, 0x00, 0x01, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x01, 0x00, 0x10, 0x00, 0xBE, 0x33, 0x1E, 0x33, 0xCC, 0x35, 0xD0, 0x35, 0xD4, 0x35, 0x12, 0x34,
+	 0x04, 0x36, 0x08, 0x36, 0xF2, 0x33, 0x00, 0x00, 0x00, 0x00, 0x24, 0x2F, 0x14, 0x33, 0x08, 0x36,
+	 0xFF, 0xFF, 0x00, 0x00, 0xBE, 0x33, 0x1E, 0x33, 0xCC, 0x35, 0xD0, 0x35, 0xD4, 0x35, 0x12, 0x34,
+	 0x04, 0x36, 0x08, 0x36, 0xF2, 0x33, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x00, 0x00, 0xBE, 0x33, 0x14, 0x33, 0x08, 0x36, 0x5C, 0x34, 0x2A, 0x33, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x03, 0x03, 0x00, 0x02, 0x06, 0x00, 0x00, 0x06, 0x07,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x2A,
+	 0x00, 0x00, 0x08, 0x32, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x05, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xDD, 0x00, 0x30, 0x00, 0xFF, 0xFF, 0x1D, 0xFA,
+	 0xF9, 0xF9, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x19, 0x0A,
+	 0x09, 0x46, 0x1C, 0x60, 0x18, 0x00, 0x19, 0x1D, 0x09, 0x42, 0x1C, 0x60, 0x00, 0x00,
+
+};  /* fw_image_2_data */
+
+static const hcf_8 fw_image_3_data[] = {
+	 0x2A, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x08, 0x26, 0x1A, 0x00, 0x80, 0x3A, 0x15, 0x00, 0x7F, 0xF1,
+	 0x32, 0xF2, 0x33, 0xF2, 0xD0, 0x80, 0x80, 0xF1, 0x0F, 0x02, 0xD0, 0x80, 0x34, 0xF2, 0x81, 0xF1,
+	 0x0B, 0x02, 0xD0, 0x80, 0xFF, 0xFF, 0x08, 0x02, 0xE9, 0x60, 0x58, 0x4F, 0x30, 0x78, 0xFF, 0xFF,
+	 0x24, 0x60, 0x58, 0x4F, 0xE3, 0x78, 0xFF, 0xFF, 0x1C, 0x60, 0xD7, 0x78, 0xFF, 0xFF, 0x00, 0xF4,
+	 0xAA, 0x60, 0xAA, 0x65, 0x09, 0xF2, 0x5A, 0xD0, 0xD4, 0x80, 0x03, 0x64, 0x12, 0x02, 0xD0, 0x80,
+	 0x1D, 0x60, 0x60, 0x65, 0x0E, 0x02, 0x5A, 0xD2, 0xFF, 0xFF, 0xD4, 0x80, 0x01, 0x60, 0x00, 0x65,
+	 0x08, 0x02, 0x5A, 0xD2, 0xFF, 0xFF, 0xD4, 0x80, 0xFF, 0xFF, 0x03, 0x02, 0x1C, 0x60, 0xD7, 0x78,
+	 0xFF, 0xFF, 0x00, 0x60, 0xEA, 0xF1, 0x5A, 0xD1, 0x44, 0x48, 0x5A, 0xD1, 0x44, 0x4A, 0x26, 0x46,
+	 0x3F, 0xF2, 0x00, 0xF4, 0x44, 0x4C, 0xD8, 0x83, 0x70, 0x61, 0x68, 0x65, 0xD7, 0x80, 0xFF, 0xFF,
+	 0x07, 0x0E, 0x08, 0xF2, 0x08, 0x00, 0x68, 0x65, 0xD7, 0x80, 0xFF, 0xFF, 0x01, 0x0E, 0x03, 0x00,
+	 0x1C, 0x60, 0xED, 0x78, 0xFF, 0xFF, 0x58, 0x4F, 0x79, 0x00, 0x9C, 0x80, 0x01, 0x65, 0x02, 0x02,
+	 0x00, 0x65, 0x02, 0x00, 0xFF, 0x3B, 0xF7, 0x01, 0x58, 0x4F, 0x70, 0x00, 0x9C, 0x80, 0x45, 0x42,
+	 0xEA, 0x02, 0x58, 0x4F, 0x6B, 0x00, 0x9C, 0x80, 0xFF, 0xFF, 0xE5, 0x02, 0x58, 0x4F, 0x66, 0x00,
+	 0x9C, 0x80, 0xFF, 0xFF, 0x03, 0x02, 0x00, 0x65, 0x45, 0x42, 0xF8, 0x01, 0xFF, 0x3A, 0x29, 0x00,
+	 0x60, 0x47, 0xFF, 0xB5, 0x28, 0x44, 0xFF, 0xB4, 0x94, 0x80, 0xFF, 0xFF, 0xD4, 0x02, 0x60, 0x45,
+	 0x28, 0x47, 0x2A, 0x5F, 0x40, 0x48, 0x2A, 0x47, 0x2C, 0x5F, 0x40, 0x4A, 0x2C, 0x47, 0x65, 0x5F,
+	 0x40, 0x4C, 0x10, 0x64, 0x40, 0x42, 0x28, 0x45, 0x05, 0x00, 0x58, 0x4F, 0x47, 0x00, 0x94, 0x80,
+	 0x28, 0x45, 0x26, 0x02, 0x58, 0x4F, 0x42, 0x00, 0x94, 0x80, 0x2A, 0x45, 0x21, 0x02, 0x58, 0x4F,
+	 0x3D, 0x00, 0x94, 0x80, 0xFF, 0xFF, 0x1C, 0x02, 0x22, 0x44, 0x4C, 0x82, 0x2C, 0x45, 0x31, 0x03,
+	 0xEC, 0x01, 0x10, 0x65, 0x45, 0x42, 0x28, 0x45, 0x94, 0x80, 0x2A, 0x45, 0x21, 0x02, 0x58, 0x4F,
+	 0x2D, 0x00, 0x94, 0x80, 0x2C, 0x45, 0x1C, 0x02, 0x58, 0x4F, 0x28, 0x00, 0x94, 0x80, 0xFF, 0xFF,
+	 0x17, 0x02, 0x22, 0x44, 0x4C, 0x82, 0x28, 0x45, 0x1C, 0x03, 0x58, 0x4F, 0x1F, 0x00, 0xEC, 0x01,
+	 0x40, 0x4B, 0x28, 0x47, 0x40, 0x48, 0x2A, 0x47, 0x40, 0x4A, 0x2C, 0x47, 0x60, 0x45, 0x2A, 0x5E,
+	 0x40, 0x4C, 0x2A, 0x44, 0x28, 0x5E, 0x40, 0x4A, 0x28, 0x44, 0x65, 0x5E, 0x40, 0x48, 0x2B, 0x44,
+	 0x68, 0x65, 0xD7, 0x80, 0xFF, 0xFF, 0x17, 0x0E, 0x90, 0x01, 0x26, 0x46, 0xD0, 0x60, 0xB5, 0x78,
+	 0xFF, 0xFF, 0xB9, 0xFF, 0x26, 0x46, 0xD0, 0x60, 0xB5, 0x78, 0xFF, 0xFF, 0xC9, 0x81, 0xCB, 0x83,
+	 0x07, 0x1C, 0x01, 0x1D, 0x08, 0x00, 0x00, 0xF4, 0x01, 0xF2, 0xFF, 0xFF, 0xFF, 0xB4, 0xD8, 0x81,
+	 0x5A, 0xD2, 0x2F, 0x58, 0xFF, 0xFF, 0x26, 0x46, 0xD0, 0x60, 0x58, 0x4F, 0xD1, 0x78, 0xFF, 0xFF,
+	 0x01, 0x60, 0xFE, 0x61, 0x00, 0xF4, 0x12, 0x63, 0x6A, 0x64, 0x01, 0x65, 0xBD, 0xD0, 0xC8, 0x84,
+	 0x59, 0xD9, 0xFC, 0x02, 0x65, 0x40, 0x01, 0x3A, 0x05, 0x00, 0x00, 0xF4, 0x00, 0x65, 0x0E, 0x64,
+	 0x04, 0x63, 0xF4, 0x01, 0x2F, 0x60, 0x58, 0x64, 0x0E, 0x60, 0xD9, 0xFB, 0x1D, 0x60, 0xB0, 0x64,
+	 0xA0, 0xDF, 0x17, 0x60, 0xA8, 0xF3, 0x0E, 0x60, 0xDB, 0xFB, 0x0E, 0x60, 0xDB, 0xF3, 0x0E, 0x60,
+	 0xD8, 0xF3, 0x60, 0x45, 0xD4, 0x80, 0xFF, 0xFF, 0x03, 0x02, 0x1D, 0x60, 0x7B, 0x78, 0xFF, 0xFF,
+	 0x01, 0x64, 0x0E, 0x60, 0xD7, 0xFB, 0x0E, 0x60, 0xD9, 0xF3, 0x02, 0x60, 0x00, 0x61, 0x40, 0x48,
+	 0x40, 0x4A, 0xFA, 0xA4, 0xA0, 0xD3, 0x41, 0x4C, 0xDC, 0x84, 0xA8, 0x84, 0x0E, 0x60, 0xDC, 0xFB,
+	 0x28, 0x45, 0x44, 0x8B, 0x2B, 0xD3, 0x0E, 0x60, 0xDA, 0xFB, 0x28, 0x42, 0x4A, 0xD3, 0x2C, 0x45,
+	 0x44, 0x8C, 0x01, 0x64, 0x40, 0x48, 0x0E, 0x60, 0xDC, 0xF3, 0xFF, 0xFF, 0x36, 0x18, 0xCC, 0x84,
+	 0xA2, 0xDB, 0x0E, 0x60, 0xDA, 0xF3, 0x28, 0x45, 0xA4, 0x80, 0xFF, 0xFF, 0x08, 0x03, 0x60, 0xFE,
+	 0x2C, 0xD3, 0x2A, 0xD3, 0x60, 0x45, 0xD4, 0x80, 0x20, 0xFE, 0x01, 0x03, 0x12, 0x00, 0x28, 0x44,
+	 0xE0, 0x84, 0xFF, 0xFF, 0x02, 0x24, 0x01, 0x00, 0x06, 0x00, 0x2B, 0x44, 0x58, 0x8B, 0x2B, 0xD3,
+	 0x0E, 0x60, 0xDA, 0xFB, 0x01, 0x64, 0x40, 0x48, 0x2A, 0x44, 0x5C, 0x8A, 0x2C, 0x44, 0x5C, 0x8C,
+	 0xDA, 0x01, 0x00, 0x64, 0x0E, 0x60, 0xD7, 0xFB, 0x0E, 0x60, 0xD9, 0xF3, 0xFF, 0xFF, 0x60, 0x45,
+	 0xFA, 0xA4, 0xA0, 0xD3, 0xFF, 0xFF, 0xC4, 0x81, 0x65, 0x44, 0xFC, 0xA4, 0xA0, 0xD3, 0x06, 0xA1,
+	 0xDC, 0x84, 0xA8, 0x84, 0x44, 0x94, 0x0E, 0x60, 0xD9, 0xFB, 0x0E, 0x60, 0xD7, 0xF3, 0xFF, 0xFF,
+	 0x60, 0x40, 0x01, 0x26, 0x09, 0x00, 0x0E, 0x60, 0xD8, 0xF3, 0xFF, 0xFF, 0xDC, 0x84, 0xA2, 0xDB,
+	 0x94, 0x01, 0x1C, 0x60, 0xD7, 0x78, 0xFF, 0xFF, 0x1C, 0x60, 0xDB, 0x78, 0xFF, 0xFF, 0x00, 0x60,
+	 0x2E, 0x61, 0xB6, 0x60, 0x58, 0x4D, 0x25, 0x78, 0xFF, 0xFF, 0x66, 0x44, 0x5F, 0xFB, 0x01, 0x60,
+	 0x05, 0x61, 0xB6, 0x60, 0x58, 0x4D, 0x25, 0x78, 0xFF, 0xFF, 0x66, 0x44, 0x5E, 0xFB, 0x00, 0x60,
+	 0x02, 0x61, 0xB6, 0x60, 0x58, 0x4D, 0x25, 0x78, 0xFF, 0xFF, 0x66, 0x44, 0x65, 0xFB, 0x1F, 0x60,
+	 0x6D, 0x64, 0x08, 0x60, 0x36, 0xFB, 0x2F, 0x58, 0xFF, 0xFF, 0x01, 0x64, 0xDB, 0xFB, 0xF1, 0xF3,
+	 0xFF, 0xFF, 0xFE, 0xB4, 0xF1, 0xFB, 0x10, 0x60, 0x30, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x00, 0x60,
+	 0x14, 0x63, 0x01, 0x60, 0xC2, 0x61, 0x2D, 0x60, 0x98, 0x64, 0x58, 0xD1, 0x59, 0xD9, 0xFD, 0x1F,
+	 0x00, 0x60, 0x8A, 0x63, 0x2D, 0x60, 0x0C, 0x61, 0x2D, 0x60, 0xB0, 0x64, 0x58, 0xD1, 0x59, 0xD9,
+	 0xFD, 0x1F, 0x16, 0x60, 0xAB, 0xF3, 0x19, 0x60, 0x48, 0xF1, 0xFF, 0xB5, 0x64, 0x40, 0x02, 0x2B,
+	 0x0B, 0x00, 0x60, 0x40, 0x03, 0x2E, 0x08, 0x00, 0x80, 0x2B, 0x06, 0x00, 0x32, 0x44, 0x00, 0x60,
+	 0x80, 0x63, 0x3C, 0x94, 0x40, 0x52, 0x05, 0x00, 0x32, 0x44, 0xFF, 0x60, 0x7F, 0x63, 0x2C, 0x94,
+	 0x40, 0x52, 0x65, 0x43, 0x16, 0x60, 0xAB, 0xFD, 0x16, 0x60, 0xC2, 0xF1, 0x66, 0x41, 0xA6, 0xF5,
+	 0x3A, 0xF2, 0x64, 0x40, 0x01, 0x36, 0x22, 0x64, 0x3A, 0xFA, 0x61, 0x46, 0x32, 0x45, 0x16, 0x60,
+	 0xCB, 0xF1, 0x10, 0x67, 0xB4, 0x85, 0x64, 0x40, 0x01, 0x2A, 0x94, 0x85, 0x45, 0x52, 0xFF, 0x60,
+	 0xE7, 0x65, 0x32, 0x41, 0xA5, 0x81, 0x16, 0x60, 0xC2, 0xF3, 0x08, 0x65, 0xFF, 0xA0, 0xFF, 0xFF,
+	 0x01, 0x03, 0x07, 0x00, 0x16, 0x60, 0xC4, 0xF3, 0xB5, 0x81, 0x10, 0x65, 0x60, 0x40, 0x01, 0x26,
+	 0xB5, 0x81, 0x41, 0x52, 0x19, 0x60, 0x48, 0xF3, 0x37, 0x60, 0xE6, 0x63, 0xF0, 0x84, 0xF0, 0x84,
+	 0xF0, 0x84, 0x03, 0xB5, 0xF0, 0x84, 0xF0, 0x84, 0x03, 0xB4, 0x65, 0x5C, 0xA3, 0xD9, 0x37, 0x60,
+	 0xE8, 0x63, 0x02, 0xA8, 0xA3, 0xDB, 0x15, 0x02, 0x00, 0x60, 0xC8, 0x64, 0x1B, 0x60, 0xF5, 0xFB,
+	 0x1B, 0x60, 0xF9, 0xFB, 0x07, 0x60, 0xD0, 0x64, 0x1B, 0x60, 0xF6, 0xFB, 0x1B, 0x60, 0xFA, 0xFB,
+	 0x01, 0x60, 0x90, 0x64, 0x1B, 0x60, 0xF7, 0xFB, 0x00, 0x60, 0x64, 0x64, 0x1B, 0x60, 0xF8, 0xFB,
+	 0x06, 0x00, 0x64, 0x64, 0x1B, 0x60, 0xF7, 0xFB, 0x64, 0x64, 0x1B, 0x60, 0xF8, 0xFB, 0x19, 0x60,
+	 0x48, 0xF1, 0x01, 0x64, 0x64, 0x40, 0x40, 0x2A, 0x02, 0x00, 0x1B, 0x60, 0xEE, 0xFB, 0x33, 0x60,
+	 0xBC, 0x61, 0x2D, 0x60, 0x0E, 0x64, 0x20, 0x63, 0x58, 0xD1, 0x59, 0xD9, 0xFD, 0x1F, 0xBA, 0xF1,
+	 0x7E, 0xF9, 0x1A, 0x63, 0x00, 0x60, 0xFC, 0x61, 0x00, 0x64, 0x59, 0xDB, 0xFE, 0x1F, 0x40, 0x40,
+	 0x01, 0x64, 0x85, 0xFB, 0x17, 0x60, 0x14, 0xF3, 0x35, 0x60, 0x36, 0x61, 0xFE, 0xA4, 0xE0, 0x84,
+	 0x04, 0x24, 0x0C, 0x00, 0xE0, 0x84, 0x41, 0x91, 0x1A, 0x60, 0x1F, 0xF3, 0xA1, 0xD1, 0x59, 0xD1,
+	 0xA0, 0x83, 0x1A, 0x60, 0x1B, 0xFD, 0xA0, 0x83, 0x1A, 0x60, 0x1A, 0xFD, 0xE4, 0xF3, 0x7D, 0xFB,
+	 0xCF, 0xF1, 0x10, 0x60, 0xEC, 0x63, 0x2F, 0x18, 0x60, 0x40, 0x01, 0x27, 0x12, 0x00, 0xCC, 0x84,
+	 0x06, 0xA3, 0xFD, 0x02, 0xA3, 0xD3, 0x10, 0x60, 0xF2, 0x63, 0x25, 0x1B, 0x11, 0x60, 0x44, 0x65,
+	 0xA3, 0xD3, 0x06, 0xA3, 0xD7, 0x80, 0x02, 0x1B, 0xFB, 0x04, 0x1D, 0x00, 0xF8, 0xA3, 0xA3, 0xD3,
+	 0x18, 0x00, 0x11, 0x60, 0x60, 0x63, 0x12, 0x60, 0x40, 0x65, 0xA3, 0xD1, 0x08, 0xA3, 0xD0, 0x80,
+	 0xD7, 0x80, 0x02, 0x03, 0xFA, 0x04, 0x0F, 0x00, 0xFA, 0xA3, 0xA3, 0xD3, 0x11, 0x60, 0x62, 0x63,
+	 0x0A, 0x1B, 0xA3, 0xD3, 0x08, 0xA3, 0xD7, 0x80, 0x02, 0x1B, 0xFB, 0x04, 0x04, 0x00, 0xF6, 0xA3,
+	 0xA3, 0xD3, 0xE4, 0xFB, 0x7D, 0xFB, 0x2E, 0x60, 0x2E, 0x64, 0x2D, 0x60, 0x8A, 0x63, 0xA0, 0xD1,
+	 0xA3, 0xD9, 0x64, 0x41, 0x58, 0xD1, 0x5B, 0xD9, 0x7D, 0xF3, 0x66, 0x45, 0xA6, 0xF5, 0x60, 0x40,
+	 0x01, 0x27, 0x08, 0x00, 0x91, 0xFA, 0x61, 0x44, 0xFD, 0x60, 0x58, 0x4E, 0xAC, 0x78, 0xFF, 0xFF,
+	 0x12, 0xFA, 0x07, 0x00, 0x11, 0xF8, 0x64, 0x44, 0xFD, 0x60, 0x58, 0x4E, 0xAC, 0x78, 0xFF, 0xFF,
+	 0x12, 0xFA, 0x65, 0x46, 0x46, 0x48, 0xE2, 0xF3, 0xFF, 0xFF, 0x60, 0x40, 0x05, 0x3A, 0x03, 0x00,
+	 0x14, 0x60, 0x22, 0x66, 0x11, 0x00, 0x04, 0x3A, 0x03, 0x00, 0x14, 0x60, 0x16, 0x66, 0x0C, 0x00,
+	 0x03, 0x3A, 0x03, 0x00, 0x14, 0x60, 0x0A, 0x66, 0x07, 0x00, 0x02, 0x3A, 0x03, 0x00, 0x13, 0x60,
+	 0xFE, 0x66, 0x02, 0x00, 0x13, 0x60, 0xF2, 0x66, 0x60, 0xFE, 0xA6, 0xD3, 0xDE, 0x86, 0x13, 0x60,
+	 0xDC, 0xFB, 0xA6, 0xD3, 0xDE, 0x86, 0x28, 0x60, 0x29, 0x63, 0xA3, 0xDB, 0x28, 0x60, 0xA1, 0x63,
+	 0xA3, 0xDB, 0xA6, 0xD3, 0xDE, 0x86, 0x13, 0x60, 0xDB, 0xFB, 0xA6, 0xD3, 0xDE, 0x86, 0x27, 0x60,
+	 0xB9, 0x63, 0xA3, 0xDB, 0x20, 0xFE, 0xA6, 0xD3, 0xDA, 0x86, 0x60, 0x43, 0x1F, 0xB3, 0x63, 0x5C,
+	 0x1F, 0x60, 0x00, 0xB4, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xB0, 0x85, 0x14, 0x60, 0x12, 0xF3,
+	 0xFF, 0xFF, 0xFC, 0x60, 0x00, 0xB4, 0xB4, 0x84, 0xA2, 0xDB, 0x14, 0x60, 0x4E, 0xFB, 0x28, 0x60,
+	 0xC4, 0x63, 0xA3, 0xD3, 0xA6, 0xD1, 0xDE, 0x86, 0x80, 0x60, 0x7F, 0xB5, 0x64, 0x44, 0x60, 0x47,
+	 0xE8, 0x84, 0x7F, 0x60, 0x80, 0xB4, 0xB4, 0x84, 0xA3, 0xDB, 0x60, 0xFE, 0xA6, 0xD3, 0xDE, 0x86,
+	 0x13, 0x60, 0xDF, 0xFB, 0xA6, 0xD3, 0xDE, 0x86, 0x00, 0x60, 0xDF, 0xFB, 0xA6, 0xD3, 0xDE, 0x86,
+	 0x00, 0x60, 0xE0, 0xFB, 0xA6, 0xD3, 0x00, 0x60, 0xE1, 0xFB, 0x20, 0xFE, 0x28, 0x46, 0x19, 0x60,
+	 0x4D, 0xF1, 0x00, 0x60, 0xCF, 0xF3, 0x64, 0x40, 0x00, 0x3A, 0x0F, 0x00, 0x60, 0x40, 0x01, 0x36,
+	 0x05, 0x00, 0x02, 0x36, 0x03, 0x00, 0x07, 0x36, 0x01, 0x00, 0x07, 0x00, 0x10, 0x60, 0xF0, 0x64,
+	 0x00, 0x7C, 0x44, 0xA4, 0xA0, 0xD9, 0x06, 0xA4, 0xA0, 0xD9, 0x36, 0x40, 0x08, 0x3A, 0x03, 0x00,
+	 0xF3, 0x60, 0x0A, 0x78, 0xFF, 0xFF, 0x00, 0x63, 0x10, 0x60, 0x10, 0xFD, 0x10, 0x60, 0x30, 0x62,
+	 0x00, 0x64, 0xA2, 0xDB, 0xDE, 0xFE, 0x0A, 0x04, 0x40, 0x60, 0x00, 0x64, 0x08, 0x60, 0x19, 0xFB,
+	 0x1E, 0x60, 0x8D, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x7D, 0xF1, 0x13, 0x60,
+	 0x1A, 0xF9, 0x0C, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x2D, 0xFF, 0x07, 0x64, 0xCC, 0xFB, 0x20, 0x60,
+	 0x00, 0x64, 0x08, 0x60, 0x19, 0xFB, 0x1F, 0x60, 0x53, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58,
+	 0xFF, 0xFF, 0x10, 0x60, 0x30, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0xBE, 0xFE, 0x08, 0x60, 0x08, 0xF1,
+	 0x40, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0xC5, 0xFE, 0x08, 0x60, 0x15, 0xF1,
+	 0x00, 0x60, 0x02, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x00, 0x64, 0x08, 0x60, 0x18, 0xFB,
+	 0x5A, 0xDB, 0x2F, 0x58, 0xFF, 0xFF, 0x10, 0x60, 0x30, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x02, 0x64,
+	 0x89, 0xFB, 0xFF, 0xFF, 0xC1, 0xFE, 0x08, 0x60, 0x30, 0xF1, 0x00, 0x60, 0xDF, 0x64, 0xB0, 0x84,
+	 0xA2, 0xDB, 0xCF, 0xFE, 0x01, 0x64, 0x13, 0x60, 0x21, 0xFB, 0xFF, 0xFF, 0x04, 0xFF, 0x08, 0x60,
+	 0x18, 0xF1, 0x00, 0x60, 0x08, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x00, 0x60, 0x08, 0x64,
+	 0x08, 0x60, 0x19, 0xFB, 0x1F, 0x60, 0x92, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x08, 0x60, 0x18, 0xF1, 0x7F, 0x60, 0xFF, 0x64, 0xA0, 0x84, 0xA2, 0xDB, 0x89, 0xF3, 0x00, 0x65,
+	 0xD4, 0x80, 0xFF, 0xFF, 0x0A, 0x03, 0x80, 0x60, 0x00, 0x64, 0x08, 0x60, 0x19, 0xFB, 0x1F, 0x60,
+	 0x92, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x95, 0xF3, 0xFF, 0xFF, 0x7F, 0xB4,
+	 0x95, 0xFB, 0xDE, 0xFE, 0x0A, 0x04, 0x20, 0x60, 0x00, 0x64, 0x08, 0x60, 0x19, 0xFB, 0x1F, 0x60,
+	 0xB7, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x26, 0x60, 0x34, 0x62, 0x06, 0x64,
+	 0x4A, 0xDB, 0xFF, 0xFF, 0x2D, 0xFF, 0x00, 0x64, 0x08, 0x60, 0x18, 0xFB, 0x5A, 0xDB, 0xBE, 0xFE,
+	 0xDA, 0xFE, 0x25, 0x60, 0xDA, 0x61, 0x1F, 0x60, 0x58, 0x4E, 0xEA, 0x78, 0xFF, 0xFF, 0x25, 0x60,
+	 0xC8, 0x61, 0x1F, 0x60, 0x58, 0x4E, 0xEA, 0x78, 0xFF, 0xFF, 0x25, 0x60, 0xCE, 0x61, 0x1F, 0x60,
+	 0x58, 0x4E, 0xEA, 0x78, 0xFF, 0xFF, 0x25, 0x60, 0xEC, 0x61, 0x1F, 0x60, 0x58, 0x4E, 0xEA, 0x78,
+	 0xFF, 0xFF, 0x25, 0x60, 0xF2, 0x61, 0x1F, 0x60, 0x58, 0x4E, 0xEA, 0x78, 0xFF, 0xFF, 0x25, 0x60,
+	 0xFE, 0x61, 0x1F, 0x60, 0x58, 0x4E, 0xEA, 0x78, 0xFF, 0xFF, 0xC5, 0xFE, 0x2F, 0x58, 0xFF, 0xFF,
+	 0xA1, 0xD3, 0x0E, 0x57, 0x23, 0x00, 0x0E, 0xF2, 0x44, 0x4C, 0x80, 0xB0, 0x10, 0xB0, 0x0A, 0x03,
+	 0x00, 0x64, 0x13, 0x60, 0x0D, 0xFB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF,
+	 0x2B, 0xFF, 0x13, 0x00, 0x12, 0x02, 0xF0, 0x37, 0x09, 0x00, 0x02, 0xF0, 0x09, 0x60, 0x08, 0x64,
+	 0xD0, 0x80, 0xA2, 0xFF, 0xAD, 0xF3, 0x02, 0x02, 0xCC, 0x84, 0xAD, 0xFB, 0x26, 0x60, 0x1A, 0x64,
+	 0x40, 0x4B, 0x34, 0x60, 0x58, 0x4D, 0x08, 0x78, 0xFF, 0xFF, 0x2C, 0x44, 0xAC, 0x86, 0x09, 0xF0,
+	 0xDA, 0x02, 0x37, 0x58, 0xFF, 0xFF, 0x2E, 0x58, 0xFF, 0xFF, 0x2E, 0x58, 0xFF, 0xFF, 0x23, 0x60,
+	 0x85, 0x64, 0x08, 0x60, 0x32, 0xFB, 0x1C, 0x60, 0xB6, 0x62, 0xA2, 0xDF, 0x06, 0xA2, 0x10, 0x60,
+	 0x88, 0x64, 0xA2, 0xDB, 0x06, 0x64, 0x5A, 0xDB, 0x5A, 0xDB, 0x1C, 0x60, 0xC2, 0x62, 0xA2, 0xDF,
+	 0x06, 0xA2, 0x10, 0x60, 0x8C, 0x64, 0xA2, 0xDB, 0x06, 0x64, 0x5A, 0xDB, 0x5A, 0xDB, 0x1C, 0x60,
+	 0xCE, 0x62, 0xA2, 0xDF, 0x06, 0xA2, 0x10, 0x60, 0x90, 0x64, 0xA2, 0xDB, 0x06, 0x64, 0x5A, 0xDB,
+	 0x5A, 0xDB, 0xBD, 0xF1, 0x0E, 0x60, 0x69, 0xF9, 0x24, 0x60, 0xC1, 0x64, 0x08, 0x60, 0x43, 0xFB,
+	 0x24, 0x60, 0xCA, 0x64, 0x08, 0x60, 0x45, 0xFB, 0x24, 0x60, 0xD3, 0x64, 0x08, 0x60, 0x47, 0xFB,
+	 0x00, 0x60, 0x3A, 0x61, 0xB6, 0x60, 0x58, 0x4D, 0x22, 0x78, 0xFF, 0xFF, 0x66, 0x44, 0x62, 0xFB,
+	 0x04, 0x64, 0x03, 0xFA, 0xA6, 0xF3, 0x07, 0xFA, 0x00, 0x64, 0x3E, 0xFA, 0x3F, 0xFA, 0x00, 0x60,
+	 0x02, 0x64, 0x08, 0x60, 0x0D, 0xFB, 0x20, 0x60, 0x63, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58,
+	 0xFF, 0xFF, 0x10, 0x60, 0x18, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x03, 0x64, 0x69, 0xFB, 0x0F, 0x4E,
+	 0xEA, 0x60, 0x58, 0x4F, 0x34, 0x78, 0xFF, 0xFF, 0x0E, 0x4F, 0x00, 0x64, 0x6B, 0xFB, 0x62, 0xF5,
+	 0xEA, 0xF3, 0x2F, 0xFA, 0xEB, 0xF3, 0x30, 0xFA, 0xEC, 0xF3, 0x31, 0xFA, 0x7F, 0xF3, 0x2C, 0xFA,
+	 0x32, 0xFA, 0x80, 0xF3, 0x2D, 0xFA, 0x33, 0xFA, 0x81, 0xF3, 0x2E, 0xFA, 0x34, 0xFA, 0xB9, 0xF3,
+	 0x19, 0xFA, 0x06, 0x60, 0x80, 0x64, 0x0E, 0xFA, 0xF7, 0x60, 0xFF, 0x65, 0x20, 0x44, 0x24, 0x80,
+	 0x08, 0x60, 0x08, 0xF1, 0x80, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x08, 0x60,
+	 0x0C, 0xF1, 0xFF, 0x60, 0x8F, 0x64, 0xA0, 0x84, 0xA2, 0xDB, 0xBE, 0xF1, 0x0E, 0x60, 0x63, 0xF9,
+	 0x1C, 0x60, 0xC2, 0x64, 0x13, 0x60, 0x22, 0xFB, 0x02, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF,
+	 0x00, 0x64, 0x6B, 0xFB, 0x00, 0x60, 0x74, 0x64, 0x08, 0x60, 0x0D, 0xFB, 0x20, 0x60, 0xAE, 0x64,
+	 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x08, 0x60, 0x0C, 0xF1, 0x00, 0x60, 0x04, 0x64,
+	 0xA0, 0x80, 0x9C, 0x84, 0x05, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x23, 0x60, 0x85, 0x78, 0xFF, 0xFF,
+	 0x00, 0x60, 0x40, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x03, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0xE2, 0x01,
+	 0x00, 0x60, 0x20, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x11, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x20, 0x40,
+	 0x50, 0x27, 0xD8, 0x01, 0xAC, 0xF3, 0xFF, 0xFF, 0xFE, 0xA0, 0xFF, 0xFF, 0x0F, 0x06, 0x6B, 0xF3,
+	 0xFF, 0xFF, 0xEC, 0xA0, 0xDC, 0x84, 0x01, 0x05, 0xA2, 0xDB, 0xCC, 0x01, 0x00, 0x60, 0x10, 0x64,
+	 0xA0, 0x80, 0x9C, 0x84, 0xCF, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x01, 0x00, 0xC3, 0x01, 0x01, 0x64,
+	 0x19, 0x60, 0xF3, 0xFB, 0xDF, 0xF3, 0x29, 0x45, 0xD4, 0x80, 0x6B, 0xF3, 0x03, 0x04, 0x21, 0x60,
+	 0x28, 0x78, 0xFF, 0xFF, 0xEC, 0xA0, 0x00, 0x64, 0x04, 0x04, 0x40, 0x49, 0x21, 0x60, 0x28, 0x78,
+	 0xFF, 0xFF, 0x00, 0x60, 0x64, 0x64, 0x08, 0x60, 0x0D, 0xFB, 0x20, 0x60, 0xFD, 0x64, 0x5A, 0xDB,
+	 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x08, 0x60, 0x0C, 0xF1, 0x00, 0x60, 0x04, 0x64, 0xA0, 0x80,
+	 0x9C, 0x84, 0x05, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x23, 0x60, 0x85, 0x78, 0xFF, 0xFF, 0x00, 0x60,
+	 0x40, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x03, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0xD0, 0x01, 0x00, 0x60,
+	 0x20, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0xE5, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x20, 0x40, 0x50, 0x27,
+	 0xE0, 0x01, 0xAC, 0xF3, 0xFF, 0xFF, 0xFE, 0xA0, 0xFF, 0xFF, 0x07, 0x06, 0x6B, 0xF3, 0xFF, 0xFF,
+	 0xEC, 0xA0, 0xDC, 0x84, 0x01, 0x05, 0xA2, 0xDB, 0xBA, 0x01, 0xB9, 0x01, 0x33, 0x60, 0xE6, 0x65,
+	 0xA5, 0xDF, 0xBF, 0xF1, 0x0E, 0x60, 0x63, 0xF9, 0xE0, 0xF3, 0x29, 0x45, 0x03, 0xA4, 0xD4, 0x80,
+	 0x01, 0x63, 0x01, 0x05, 0x00, 0x63, 0x53, 0xFD, 0x7D, 0xF3, 0x01, 0x60, 0x00, 0x65, 0xA4, 0x80,
+	 0x24, 0x44, 0xFE, 0xB4, 0x01, 0x03, 0x01, 0xBC, 0x40, 0x44, 0x21, 0x60, 0x45, 0x64, 0x6A, 0xFB,
+	 0x23, 0x60, 0xF6, 0x78, 0xFF, 0xFF, 0x1C, 0x60, 0xCE, 0x64, 0x13, 0x60, 0x22, 0xFB, 0x03, 0x64,
+	 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x08, 0x60, 0x0C, 0xF1, 0xFF, 0x60, 0xDF, 0x64, 0xA0, 0x84,
+	 0xA2, 0xDB, 0x86, 0xF1, 0x1B, 0x60, 0xB2, 0x63, 0xD3, 0x80, 0x67, 0xFD, 0x43, 0x03, 0x67, 0xF3,
+	 0xE1, 0xF1, 0x60, 0x43, 0x29, 0x44, 0xA3, 0xD3, 0xC0, 0x85, 0xD4, 0x80, 0x5B, 0xD3, 0x3A, 0x06,
+	 0x60, 0x43, 0x08, 0xA3, 0xBE, 0xD3, 0x81, 0xF1, 0xA3, 0xD3, 0xD0, 0x80, 0x80, 0xF1, 0x05, 0x02,
+	 0xBF, 0xD3, 0xD0, 0x80, 0x7F, 0xF1, 0x01, 0x02, 0xD0, 0x80, 0xF8, 0xA3, 0x28, 0x02, 0x21, 0x60,
+	 0x77, 0x64, 0x6A, 0xFB, 0x23, 0x60, 0xB4, 0x78, 0xFF, 0xFF, 0x01, 0xB0, 0x82, 0xF3, 0x22, 0x03,
+	 0x62, 0xF5, 0x48, 0x7E, 0x2A, 0xFA, 0x25, 0x60, 0xCE, 0x64, 0x13, 0x60, 0x0D, 0xFB, 0x66, 0x44,
+	 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xC1, 0xFE, 0x00, 0x60, 0x01, 0x64,
+	 0x08, 0x60, 0x0D, 0xFB, 0x21, 0x60, 0x92, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x08, 0x60, 0x0C, 0xF1, 0xFF, 0x60, 0xFE, 0x64, 0xA0, 0x84, 0xA2, 0xDB, 0x03, 0x00, 0x23, 0x60,
+	 0x7A, 0x78, 0xFF, 0xFF, 0x6B, 0xF3, 0xFF, 0xFF, 0xEC, 0xA0, 0x00, 0x64, 0x02, 0x04, 0x40, 0x49,
+	 0x15, 0x00, 0xDF, 0xF3, 0x29, 0x45, 0xD4, 0x80, 0xFF, 0xFF, 0x0B, 0x07, 0x1C, 0x60, 0xC2, 0x64,
+	 0x13, 0x60, 0x22, 0xFB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x20, 0x60, 0x86, 0x78,
+	 0xFF, 0xFF, 0xE0, 0xF3, 0x29, 0x45, 0xD4, 0x80, 0xFF, 0xFF, 0x16, 0x06, 0x04, 0x65, 0xF1, 0x60,
+	 0x58, 0x4E, 0xC3, 0x78, 0xFF, 0xFF, 0x05, 0x64, 0xDB, 0xFB, 0xF1, 0xF3, 0xFF, 0xFF, 0x01, 0xBC,
+	 0xF1, 0xFB, 0x1C, 0x60, 0xC2, 0x64, 0x13, 0x60, 0x22, 0xFB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF,
+	 0x04, 0xFF, 0x22, 0x60, 0x1B, 0x78, 0xFF, 0xFF, 0x00, 0x60, 0x74, 0x64, 0x08, 0x60, 0x0D, 0xFB,
+	 0x21, 0x60, 0xD8, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x08, 0x60, 0x0C, 0xF1,
+	 0x00, 0x60, 0x04, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x05, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x23, 0x60,
+	 0x85, 0x78, 0xFF, 0xFF, 0x00, 0x60, 0x40, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x03, 0x03, 0xA0, 0x84,
+	 0xA2, 0xDB, 0xB0, 0x01, 0x00, 0x60, 0x20, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x15, 0x03, 0xA0, 0x84,
+	 0xA2, 0xDB, 0x20, 0x40, 0x50, 0x27, 0xA6, 0x01, 0xAC, 0xF3, 0x6B, 0xF3, 0xFE, 0xA0, 0xEC, 0xA0,
+	 0x0A, 0x06, 0x03, 0x04, 0x00, 0x64, 0x55, 0xFB, 0x40, 0x49, 0x6B, 0xF3, 0xFF, 0xFF, 0xEC, 0xA0,
+	 0xDC, 0x84, 0x01, 0x05, 0xA2, 0xDB, 0x96, 0x01, 0x00, 0x60, 0x10, 0x64, 0xA0, 0x80, 0x9C, 0x84,
+	 0x0D, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x1C, 0x60, 0xCE, 0x64, 0x13, 0x60, 0x22, 0xFB, 0x03, 0x64,
+	 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x21, 0x60, 0x28, 0x78, 0xFF, 0xFF, 0x21, 0x60, 0x9C, 0x78,
+	 0xFF, 0xFF, 0x7D, 0xF3, 0x01, 0x60, 0x00, 0x65, 0xA4, 0x80, 0x24, 0x44, 0xFE, 0xB4, 0x01, 0x03,
+	 0x01, 0xBC, 0x02, 0xB0, 0xFB, 0xB4, 0x01, 0x03, 0x04, 0xBC, 0x40, 0x44, 0xC0, 0xF1, 0x0E, 0x60,
+	 0x63, 0xF9, 0xCF, 0xF3, 0x20, 0x60, 0x20, 0x65, 0x30, 0x1B, 0xA5, 0xD3, 0x24, 0x40, 0x01, 0x26,
+	 0x16, 0x00, 0x60, 0x40, 0x20, 0x26, 0x29, 0x00, 0x01, 0xBC, 0xA5, 0xDB, 0x08, 0x60, 0x1E, 0xF1,
+	 0x00, 0x60, 0x20, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x10, 0x60, 0x00, 0x64, 0x08, 0x60,
+	 0x0D, 0xFB, 0x22, 0x60, 0x5F, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x60, 0x40,
+	 0x10, 0x26, 0x13, 0x00, 0x01, 0xBC, 0xA5, 0xDB, 0x08, 0x60, 0x1E, 0xF1, 0x00, 0x60, 0x40, 0x64,
+	 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x10, 0x60, 0x00, 0x64, 0x08, 0x60, 0x0D, 0xFB, 0x22, 0x60,
+	 0x5F, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x0D, 0x64, 0x53, 0xFB, 0x22, 0x60,
+	 0x67, 0x64, 0x6A, 0xFB, 0x23, 0x60, 0xF6, 0x78, 0xFF, 0xFF, 0x1C, 0x60, 0xCE, 0x64, 0x13, 0x60,
+	 0x22, 0xFB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x08, 0x60, 0x0C, 0xF1, 0xFF, 0x60,
+	 0xDF, 0x64, 0xA0, 0x84, 0xA2, 0xDB, 0x86, 0xF1, 0x1B, 0x60, 0xB2, 0x63, 0xD3, 0x80, 0x67, 0xFD,
+	 0x07, 0x02, 0x24, 0x44, 0x04, 0xB0, 0xFF, 0xFF, 0x36, 0x03, 0x05, 0xAC, 0x40, 0x44, 0xA6, 0x01,
+	 0x67, 0xF3, 0x29, 0x41, 0xA0, 0xD1, 0x58, 0xD3, 0xD1, 0x80, 0x64, 0x45, 0x60, 0x43, 0x2B, 0x05,
+	 0x08, 0xA3, 0xBE, 0xD3, 0x81, 0xF1, 0xA3, 0xD3, 0xD0, 0x80, 0x80, 0xF1, 0x05, 0x02, 0xBF, 0xD3,
+	 0xD0, 0x80, 0x7F, 0xF1, 0x01, 0x02, 0xD0, 0x80, 0xF8, 0xA3, 0x07, 0x02, 0x45, 0x49, 0x22, 0x60,
+	 0xCD, 0x64, 0x6A, 0xFB, 0x23, 0x60, 0xB4, 0x78, 0xFF, 0xFF, 0x05, 0x65, 0xF1, 0x60, 0x58, 0x4E,
+	 0xC3, 0x78, 0xFF, 0xFF, 0x04, 0x64, 0xDB, 0xFB, 0xF1, 0xF3, 0xFF, 0xFF, 0xFE, 0xB4, 0xF1, 0xFB,
+	 0x23, 0x60, 0x7A, 0x78, 0xFF, 0xFF, 0x67, 0xF3, 0x86, 0xF1, 0x04, 0xA4, 0xD0, 0x80, 0xFF, 0xFF,
+	 0x02, 0x03, 0x67, 0xFB, 0xCD, 0x01, 0x6B, 0xF3, 0xFF, 0xFF, 0xEC, 0xA0, 0xFF, 0xFF, 0x01, 0x04,
+	 0x75, 0x00, 0xE0, 0xF3, 0x29, 0x45, 0xD4, 0x80, 0xFF, 0xFF, 0x70, 0x05, 0x7D, 0xF3, 0xFF, 0xFF,
+	 0x60, 0x40, 0x01, 0x27, 0x08, 0x00, 0x22, 0x60, 0xCD, 0x63, 0x6A, 0xFD, 0x1C, 0x60, 0x78, 0x63,
+	 0x23, 0x60, 0xB4, 0x78, 0xFF, 0xFF, 0x1C, 0x60, 0xC2, 0x64, 0x13, 0x60, 0x22, 0xFB, 0x03, 0x64,
+	 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x05, 0x65, 0xF1, 0x60, 0x58, 0x4E, 0xC3, 0x78, 0xFF, 0xFF,
+	 0x20, 0x60, 0x14, 0x61, 0xA1, 0xDF, 0x04, 0x64, 0xDB, 0xFB, 0xF1, 0xF3, 0xFF, 0xFF, 0xFE, 0xB4,
+	 0xF1, 0xFB, 0x82, 0xF3, 0x62, 0xF5, 0x48, 0x7E, 0x2A, 0xFA, 0x02, 0x60, 0x00, 0x65, 0x20, 0x44,
+	 0x34, 0x80, 0x25, 0x60, 0xCE, 0x64, 0x13, 0x60, 0x0D, 0xFB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64,
+	 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xC1, 0xFE, 0x00, 0x60, 0x01, 0x64, 0x08, 0x60, 0x0D, 0xFB,
+	 0x23, 0x60, 0x00, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x08, 0x60, 0x0C, 0xF1,
+	 0xFF, 0x60, 0xFE, 0x64, 0xA0, 0x84, 0xA2, 0xDB, 0x00, 0x60, 0x32, 0x64, 0x0E, 0x60, 0x63, 0xFB,
+	 0x1C, 0x60, 0xC2, 0x64, 0x13, 0x60, 0x22, 0xFB, 0x02, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF,
+	 0x00, 0x60, 0x10, 0x64, 0x08, 0x60, 0x0D, 0xFB, 0x23, 0x60, 0x1C, 0x64, 0x5A, 0xDB, 0xCF, 0xFE,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x08, 0x60, 0x0C, 0xF1, 0xFF, 0x60, 0xEF, 0x64, 0xA0, 0x84, 0xA2, 0xDB,
+	 0xFD, 0x60, 0xFF, 0x65, 0x20, 0x44, 0x24, 0x80, 0x08, 0x60, 0x08, 0xF1, 0x80, 0x60, 0x00, 0x64,
+	 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x20, 0x60, 0x86, 0x78, 0xFF, 0xFF, 0x00, 0x60, 0x74, 0x64,
+	 0x08, 0x60, 0x0D, 0xFB, 0x23, 0x60, 0x3A, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x08, 0x60, 0x0C, 0xF1, 0x00, 0x60, 0x04, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x05, 0x03, 0xA0, 0x84,
+	 0xA2, 0xDB, 0x23, 0x60, 0x85, 0x78, 0xFF, 0xFF, 0x00, 0x60, 0x40, 0x64, 0xA0, 0x80, 0x9C, 0x84,
+	 0x03, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x67, 0x01, 0x00, 0x60, 0x20, 0x64, 0xA0, 0x80, 0x9C, 0x84,
+	 0x15, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x20, 0x40, 0x50, 0x27, 0xE0, 0x01, 0xAC, 0xF3, 0x6B, 0xF3,
+	 0xFE, 0xA0, 0xEC, 0xA0, 0x0A, 0x06, 0x03, 0x04, 0x00, 0x64, 0x55, 0xFB, 0x40, 0x49, 0x6B, 0xF3,
+	 0xFF, 0xFF, 0xEC, 0xA0, 0xDC, 0x84, 0x01, 0x05, 0xA2, 0xDB, 0x4D, 0x01, 0x00, 0x60, 0x10, 0x64,
+	 0xA0, 0x80, 0x9C, 0x84, 0xCB, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x1C, 0x60, 0xCE, 0x64, 0x13, 0x60,
+	 0x22, 0xFB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x22, 0x60, 0x1B, 0x78, 0xFF, 0xFF,
+	 0x08, 0x60, 0x00, 0x65, 0x20, 0x44, 0x34, 0x80, 0x08, 0x60, 0x15, 0xF1, 0x00, 0x60, 0x20, 0x64,
+	 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x1C, 0x60, 0xB6, 0x64, 0x13, 0x60, 0x22, 0xFB, 0x03, 0x64,
+	 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x1C, 0x60, 0xC2, 0x64, 0x13, 0x60, 0x22, 0xFB, 0x03, 0x64,
+	 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x1C, 0x60, 0xCE, 0x64, 0x13, 0x60, 0x22, 0xFB, 0x03, 0x64,
+	 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x00, 0x64, 0x08, 0x60, 0x0C, 0xFB, 0x5A, 0xDB, 0x00, 0x64,
+	 0x69, 0xFB, 0x08, 0x60, 0x08, 0xF1, 0x02, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE,
+	 0x00, 0x60, 0x02, 0x64, 0x08, 0x60, 0x0D, 0xFB, 0x20, 0x60, 0x63, 0x64, 0x5A, 0xDB, 0xCF, 0xFE,
+	 0x2F, 0x58, 0xFF, 0xFF, 0xA3, 0xD3, 0x7D, 0xF1, 0x7C, 0xFB, 0xD0, 0x80, 0x00, 0x64, 0x39, 0x03,
+	 0x08, 0x60, 0x0C, 0xF1, 0xBF, 0x60, 0xFF, 0x64, 0xA0, 0x84, 0xA2, 0xDB, 0xDE, 0xFE, 0x0A, 0x04,
+	 0x40, 0x60, 0x00, 0x64, 0x08, 0x60, 0x0D, 0xFB, 0x23, 0x60, 0xBA, 0x64, 0x5A, 0xDB, 0xCF, 0xFE,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x08, 0x60, 0x0C, 0xF1, 0xDF, 0x60, 0xFF, 0x64, 0xA0, 0x84, 0xA2, 0xDB,
+	 0x7C, 0xF1, 0x7D, 0xF9, 0x13, 0x60, 0x1A, 0xF9, 0x0E, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x2D, 0xFF,
+	 0x20, 0x60, 0x00, 0x64, 0x08, 0x60, 0x0D, 0xFB, 0x23, 0x60, 0xE4, 0x64, 0x5A, 0xDB, 0xCF, 0xFE,
+	 0x2F, 0x58, 0xFF, 0xFF, 0xBE, 0xFE, 0x08, 0x60, 0x0C, 0xF1, 0xDF, 0x60, 0xFF, 0x64, 0xA0, 0x84,
+	 0xA2, 0xDB, 0x08, 0x60, 0x08, 0xF1, 0x40, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE,
+	 0x01, 0x64, 0x6A, 0xF7, 0xFF, 0xFF, 0xFF, 0xFF, 0x02, 0x60, 0x00, 0x65, 0x20, 0x44, 0x34, 0x80,
+	 0x08, 0x60, 0x0C, 0xF1, 0x7F, 0x60, 0xFF, 0x64, 0xA0, 0x84, 0xA2, 0xDB, 0x20, 0x40, 0x51, 0x23,
+	 0x0A, 0x00, 0x80, 0x60, 0x00, 0x64, 0x08, 0x60, 0x0D, 0xFB, 0x23, 0x60, 0xFA, 0x64, 0x5A, 0xDB,
+	 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x08, 0x60, 0x0C, 0xF1, 0x7F, 0x60, 0xFF, 0x61, 0xA1, 0x84,
+	 0x5A, 0xD1, 0x4A, 0xDB, 0xA1, 0x84, 0x5A, 0xDB, 0x02, 0x64, 0x8A, 0xFB, 0xFF, 0xFF, 0xC1, 0xFE,
+	 0x8A, 0xF3, 0x00, 0x65, 0xD4, 0x80, 0xFF, 0xFF, 0x10, 0x03, 0x08, 0x60, 0x0C, 0xF1, 0x7F, 0x60,
+	 0xFF, 0x64, 0xA0, 0x84, 0xA2, 0xDB, 0x80, 0x60, 0x00, 0x64, 0x08, 0x60, 0x0D, 0xFB, 0x24, 0x60,
+	 0x16, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x33, 0x60, 0xBE, 0x64, 0x54, 0xFB,
+	 0x08, 0x60, 0x0C, 0xF1, 0xEF, 0x60, 0xFF, 0x64, 0xA0, 0x84, 0xA2, 0xDB, 0x24, 0x44, 0x01, 0xB0,
+	 0xFF, 0xFF, 0x08, 0x02, 0x08, 0x60, 0x12, 0xF1, 0x00, 0x60, 0x10, 0x64, 0xB0, 0x84, 0xA2, 0xDB,
+	 0xCF, 0xFE, 0x07, 0x00, 0x08, 0x60, 0x12, 0xF1, 0x00, 0x60, 0x20, 0x64, 0xB0, 0x84, 0xA2, 0xDB,
+	 0xCF, 0xFE, 0x10, 0x60, 0x00, 0x64, 0x08, 0x60, 0x0D, 0xFB, 0x24, 0x60, 0x55, 0x64, 0x5A, 0xDB,
+	 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x1C, 0x60, 0xC2, 0x64, 0x13, 0x60, 0x22, 0xFB, 0x02, 0x64,
+	 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x08, 0x60, 0x0C, 0xF1, 0xEF, 0x60, 0xEF, 0x64, 0xA0, 0x84,
+	 0xA2, 0xDB, 0x01, 0x64, 0x8A, 0xFB, 0x6B, 0xF3, 0x00, 0x60, 0x95, 0xF3, 0xEC, 0xA0, 0x40, 0xBC,
+	 0x06, 0x04, 0xA2, 0xDB, 0x69, 0xF1, 0xFF, 0x60, 0xFB, 0x64, 0xA0, 0x84, 0x69, 0xFB, 0xFD, 0x60,
+	 0xFF, 0x65, 0x20, 0x44, 0x24, 0x80, 0x08, 0x60, 0x08, 0xF1, 0x80, 0x60, 0x00, 0x64, 0xB0, 0x84,
+	 0xA2, 0xDB, 0xCF, 0xFE, 0xC1, 0xFE, 0x6A, 0xF7, 0xFF, 0xFF, 0xFF, 0xFF, 0x55, 0xF1, 0x28, 0x44,
+	 0xD0, 0x84, 0x03, 0xA4, 0x03, 0x0E, 0xE8, 0x84, 0xE8, 0x84, 0x04, 0x00, 0xFA, 0xA4, 0xE8, 0x84,
+	 0xE8, 0x87, 0xC0, 0xBF, 0xC0, 0x84, 0xA2, 0xDB, 0x2E, 0x58, 0xFF, 0xFF, 0x56, 0xF1, 0x28, 0x44,
+	 0xD0, 0x84, 0x1F, 0xA4, 0x06, 0x0E, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84,
+	 0x07, 0x00, 0xC2, 0xA4, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x87, 0xF8, 0xBF,
+	 0xC0, 0x84, 0x5B, 0xF1, 0x56, 0xFB, 0xD0, 0x80, 0xFF, 0xFF, 0x01, 0x05, 0x64, 0x44, 0x52, 0xFB,
+	 0x2E, 0x58, 0xFF, 0xFF, 0x52, 0xF1, 0x2F, 0x67, 0xD0, 0x80, 0x60, 0x45, 0x02, 0x28, 0x64, 0x45,
+	 0x55, 0xF1, 0x8B, 0x67, 0xD0, 0x80, 0x60, 0x41, 0x02, 0x24, 0x64, 0x41, 0xD5, 0x84, 0x80, 0x65,
+	 0xC4, 0x87, 0x01, 0x05, 0x00, 0x64, 0xFF, 0xB4, 0x40, 0x49, 0x2E, 0x58, 0xFF, 0xFF, 0x08, 0x60,
+	 0x0C, 0xF1, 0x00, 0x60, 0x08, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x08, 0x60, 0x0C, 0xF1, 0x00, 0x60, 0x10, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x2F, 0x58,
+	 0xFF, 0xFF, 0x08, 0x60, 0x0C, 0xF1, 0x00, 0x60, 0x20, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE,
+	 0x08, 0x60, 0x1B, 0xF1, 0x00, 0x60, 0x40, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x2F, 0x58,
+	 0xFF, 0xFF, 0x26, 0x46, 0x27, 0xF2, 0x70, 0x63, 0x60, 0x40, 0x0A, 0x36, 0x10, 0x00, 0x14, 0x36,
+	 0x14, 0x00, 0x37, 0x36, 0x0E, 0x00, 0x6E, 0x36, 0x0E, 0x00, 0x06, 0x36, 0x04, 0x00, 0x09, 0x36,
+	 0x04, 0x00, 0x18, 0x63, 0x0A, 0x00, 0x30, 0x63, 0x08, 0x00, 0x26, 0x63, 0x06, 0x00, 0xD0, 0x63,
+	 0x04, 0x00, 0x33, 0x63, 0x02, 0x00, 0x21, 0x63, 0x00, 0x00, 0x10, 0x60, 0x0E, 0xFD, 0x26, 0x46,
+	 0x3F, 0xF2, 0x87, 0xF0, 0x00, 0xF4, 0x45, 0x43, 0x03, 0x4B, 0x60, 0x43, 0xF4, 0xA3, 0x00, 0x60,
+	 0x1D, 0x61, 0x00, 0x60, 0x01, 0x65, 0x01, 0x60, 0xFF, 0x64, 0x40, 0x4C, 0xFD, 0x60, 0x58, 0x4E,
+	 0x7A, 0x78, 0xFF, 0xFF, 0x00, 0xBB, 0xFF, 0xFF, 0x00, 0x02, 0x00, 0x64, 0x40, 0x4A, 0x60, 0xFE,
+	 0x02, 0x60, 0x00, 0x63, 0xBD, 0xD3, 0xBD, 0xD3, 0x60, 0x41, 0xFE, 0x60, 0x58, 0x4E, 0x2C, 0x78,
+	 0xFF, 0xFF, 0x20, 0xFE, 0x26, 0x46, 0x3F, 0xF2, 0x00, 0xF4, 0x60, 0x43, 0xF4, 0xA3, 0x00, 0x60,
+	 0x1D, 0x61, 0x00, 0x60, 0x32, 0x65, 0x01, 0x60, 0xFF, 0x64, 0x40, 0x4C, 0xFD, 0x60, 0x58, 0x4E,
+	 0x7A, 0x78, 0xFF, 0xFF, 0x00, 0xBB, 0xFF, 0xFF, 0x0B, 0x03, 0x60, 0xFE, 0x02, 0x60, 0x00, 0x63,
+	 0xBD, 0xD3, 0xBD, 0xD3, 0x60, 0x41, 0xFE, 0x60, 0x58, 0x4E, 0x2C, 0x78, 0xFF, 0xFF, 0x20, 0xFE,
+	 0x2A, 0x44, 0xFC, 0x60, 0x58, 0x4E, 0x34, 0x78, 0xFF, 0xFF, 0x26, 0x46, 0x3F, 0xF2, 0x01, 0x60,
+	 0x00, 0x65, 0xF4, 0xA4, 0xD4, 0x80, 0x60, 0x41, 0x02, 0x24, 0x65, 0x41, 0x41, 0x48, 0x00, 0xF4,
+	 0x1E, 0x65, 0x02, 0x60, 0x00, 0x63, 0xA5, 0xD0, 0xDA, 0x85, 0x80, 0x3A, 0x02, 0x00, 0x00, 0xF4,
+	 0x04, 0x65, 0x64, 0x44, 0x00, 0x7F, 0xCD, 0x81, 0xBD, 0xDB, 0x05, 0x03, 0x64, 0x47, 0x00, 0x7F,
+	 0xCD, 0x81, 0xBD, 0xDB, 0xF0, 0x02, 0x02, 0x60, 0x00, 0x63, 0x28, 0x41, 0xBD, 0xD3, 0xBD, 0xD1,
+	 0xFD, 0xA0, 0xFE, 0xA1, 0x07, 0x03, 0x09, 0x06, 0x64, 0x44, 0xE0, 0x85, 0xD1, 0x81, 0xC7, 0x83,
+	 0xF5, 0x07, 0x03, 0x00, 0xA3, 0xD3, 0x0E, 0x60, 0x3C, 0xFB, 0x31, 0x40, 0x06, 0x26, 0x57, 0x00,
+	 0x00, 0x64, 0x6F, 0xFB, 0x02, 0x60, 0x00, 0x63, 0x28, 0x41, 0xBD, 0xD3, 0xBD, 0xD1, 0xFC, 0xA0,
+	 0xFB, 0xA0, 0x09, 0x03, 0x28, 0x03, 0x64, 0x44, 0xE0, 0x85, 0xC7, 0x83, 0xD1, 0x81, 0xFE, 0xA1,
+	 0x46, 0x06, 0xF3, 0x07, 0x44, 0x00, 0xBD, 0xD3, 0xBD, 0xD3, 0x00, 0xB8, 0x6F, 0xFB, 0x6E, 0xFB,
+	 0xBD, 0xD3, 0x3D, 0x02, 0xA3, 0xD3, 0x60, 0x45, 0x60, 0x47, 0xB4, 0x84, 0x60, 0x41, 0x3F, 0xB5,
+	 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0x71, 0xFB, 0x65, 0x47,
+	 0xE0, 0x84, 0xE0, 0x84, 0x70, 0xFB, 0x64, 0x44, 0xE0, 0x85, 0xFA, 0xA3, 0xC7, 0x83, 0x61, 0x44,
+	 0x0E, 0x60, 0x38, 0xFB, 0xD2, 0x01, 0xBD, 0xD3, 0xA3, 0xD3, 0x00, 0xB8, 0x6D, 0xFB, 0x73, 0xFB,
+	 0x1E, 0x02, 0x85, 0xF1, 0x6F, 0xF3, 0x6C, 0xF9, 0x04, 0x65, 0x60, 0x40, 0x00, 0x3A, 0x06, 0x65,
+	 0x31, 0x44, 0xB4, 0x84, 0x40, 0x51, 0x02, 0x2A, 0x0B, 0x00, 0x08, 0xBC, 0x40, 0x51, 0x71, 0xF3,
+	 0x70, 0xF1, 0x00, 0xB8, 0x64, 0x45, 0x01, 0x03, 0x67, 0x45, 0x65, 0x50, 0xCC, 0x84, 0x72, 0xFB,
+	 0x08, 0x60, 0x15, 0xF1, 0x01, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x08, 0x60,
+	 0x16, 0xF3, 0xFF, 0xFF, 0x60, 0x40, 0x80, 0x2A, 0x3F, 0x00, 0x01, 0x64, 0x10, 0x60, 0x0A, 0xFB,
+	 0x26, 0x60, 0x58, 0x4E, 0x65, 0x78, 0xFF, 0xFF, 0x26, 0x46, 0x00, 0xF4, 0x0D, 0xF2, 0x7E, 0xFB,
+	 0x00, 0x64, 0x84, 0xFB, 0x26, 0x46, 0x3F, 0xF2, 0x00, 0xF4, 0x60, 0x43, 0xF4, 0xA3, 0x00, 0x60,
+	 0x1D, 0x61, 0x00, 0x60, 0x07, 0x65, 0x01, 0x60, 0xFF, 0x64, 0x40, 0x4C, 0xFD, 0x60, 0x58, 0x4E,
+	 0x7A, 0x78, 0xFF, 0xFF, 0x00, 0xBB, 0xFF, 0xFF, 0x14, 0x03, 0x02, 0x60, 0x00, 0x65, 0xA5, 0xD3,
+	 0x1C, 0x60, 0xE6, 0x63, 0xFF, 0xB4, 0x01, 0xA4, 0x60, 0x41, 0xA5, 0xD1, 0xDA, 0x85, 0x64, 0x44,
+	 0x00, 0x7F, 0xCD, 0x81, 0xBD, 0xDB, 0x05, 0x03, 0x64, 0x47, 0x00, 0x7F, 0xCD, 0x81, 0xBD, 0xDB,
+	 0xF4, 0x02, 0x08, 0x60, 0x15, 0xF1, 0x00, 0x60, 0x80, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE,
+	 0x32, 0x00, 0x27, 0x60, 0x57, 0x78, 0xFF, 0xFF, 0xDB, 0xF3, 0xFF, 0xFF, 0x03, 0xA8, 0x02, 0xA8,
+	 0x02, 0x03, 0x3E, 0x02, 0xF6, 0x01, 0x08, 0x60, 0x15, 0xF1, 0xFF, 0x60, 0xFB, 0x64, 0xA0, 0x84,
+	 0xA2, 0xDB, 0x1C, 0x60, 0x92, 0x64, 0x13, 0x60, 0x22, 0xFB, 0x02, 0x64, 0x4A, 0xDB, 0xFF, 0xFF,
+	 0x04, 0xFF, 0x26, 0x46, 0x10, 0x60, 0x0E, 0xF3, 0x25, 0xF2, 0x60, 0x45, 0x24, 0xF0, 0x00, 0xF4,
+	 0x64, 0x43, 0xC7, 0x83, 0x60, 0x41, 0x02, 0x24, 0x01, 0xA1, 0x0A, 0xF0, 0x09, 0xF2, 0xD1, 0x80,
+	 0xFF, 0xFF, 0x09, 0x07, 0x04, 0x04, 0x63, 0x45, 0xD4, 0x80, 0xFF, 0xFF, 0x04, 0x06, 0x26, 0x60,
+	 0x58, 0x4E, 0x65, 0x78, 0xFF, 0xFF, 0x26, 0x46, 0x26, 0xF0, 0xFF, 0x67, 0x20, 0x88, 0x64, 0x5F,
+	 0x40, 0x4A, 0x24, 0x60, 0x58, 0x4E, 0x80, 0x78, 0xFF, 0xFF, 0x0A, 0x48, 0x24, 0x60, 0x58, 0x4E,
+	 0x90, 0x78, 0xFF, 0xFF, 0x24, 0x60, 0x58, 0x4E, 0xAC, 0x78, 0xFF, 0xFF, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x08, 0x60, 0x0D, 0xF3, 0xFF, 0xFF, 0x60, 0x40, 0x40, 0x22, 0xB3, 0x01, 0x00, 0x60, 0x95, 0xF3,
+	 0xFF, 0xFF, 0xBF, 0xB4, 0xA2, 0xDB, 0x10, 0x60, 0x0E, 0xF3, 0x26, 0x46, 0x60, 0x45, 0x20, 0x60,
+	 0x04, 0x63, 0x00, 0xF4, 0x09, 0xF2, 0xBD, 0xDB, 0xFF, 0xFF, 0x0A, 0xF2, 0xBD, 0xDB, 0x0B, 0xF2,
+	 0xFF, 0xFF, 0xBD, 0xDB, 0x0C, 0xF2, 0xA3, 0xDB, 0xFA, 0xA3, 0x26, 0x46, 0xA3, 0xD3, 0x24, 0xF0,
+	 0x00, 0x61, 0xD0, 0x84, 0xF1, 0x81, 0xD4, 0x84, 0xF1, 0x81, 0xBD, 0xDB, 0xA3, 0xD3, 0x03, 0xB1,
+	 0x03, 0xA9, 0x25, 0xF0, 0x42, 0xFE, 0x05, 0x03, 0xFD, 0xA1, 0xCC, 0x84, 0x01, 0x02, 0xCC, 0x84,
+	 0x00, 0x61, 0xF1, 0x81, 0xD0, 0x84, 0xF1, 0x81, 0xBD, 0xDB, 0xA3, 0xD3, 0x03, 0xB1, 0x03, 0xA9,
+	 0x28, 0xF0, 0x42, 0xFE, 0x01, 0x03, 0xCC, 0x84, 0xF1, 0x81, 0xD0, 0x84, 0xF1, 0x81, 0xBD, 0xDB,
+	 0xA3, 0xD3, 0x03, 0xB1, 0x03, 0xA9, 0x29, 0xF0, 0x01, 0x03, 0xCC, 0x84, 0xD0, 0x84, 0xA3, 0xDB,
+	 0x10, 0x60, 0x0A, 0xF3, 0xFF, 0xFF, 0x02, 0xA8, 0xFF, 0xFF, 0x02, 0x02, 0x2E, 0x58, 0xFF, 0xFF,
+	 0xF5, 0xFE, 0x10, 0x60, 0x02, 0xF1, 0x06, 0xA2, 0xA2, 0xD3, 0x64, 0x45, 0x60, 0x40, 0x80, 0x2B,
+	 0x03, 0x00, 0xFF, 0x60, 0xFF, 0x64, 0x94, 0x85, 0x00, 0x60, 0x96, 0x64, 0xD4, 0x80, 0xFF, 0xFF,
+	 0x0A, 0x06, 0x10, 0x60, 0x0A, 0xF3, 0x69, 0xF3, 0x00, 0xA8, 0x04, 0xB0, 0x04, 0x02, 0x03, 0x03,
+	 0x27, 0x60, 0x33, 0x78, 0xFF, 0xFF, 0x26, 0x46, 0x00, 0xF4, 0x09, 0xF2, 0x5A, 0xD2, 0x40, 0x48,
+	 0x40, 0x4A, 0x5A, 0xD2, 0x5A, 0xD2, 0x40, 0x4C, 0x60, 0x41, 0x5A, 0xD0, 0x7E, 0xF9, 0x40, 0x63,
+	 0xAD, 0x80, 0xF0, 0xA3, 0x09, 0x02, 0x3C, 0x03, 0x2C, 0x41, 0x2A, 0x44, 0x40, 0x4C, 0x28, 0x44,
+	 0x40, 0x4A, 0x00, 0x64, 0x40, 0x48, 0xF4, 0x01, 0xD1, 0x80, 0x01, 0x02, 0x31, 0x04, 0x10, 0xA3,
+	 0x80, 0x60, 0x00, 0x65, 0xA5, 0x80, 0xCF, 0x83, 0x08, 0x02, 0x28, 0x44, 0x60, 0x88, 0x2A, 0x44,
+	 0x70, 0x8A, 0x2C, 0x44, 0x70, 0x8C, 0xF1, 0x81, 0xF5, 0x01, 0xE7, 0xA3, 0x64, 0x44, 0x00, 0xA8,
+	 0x00, 0x62, 0x02, 0x02, 0x00, 0x61, 0x1C, 0x00, 0xE0, 0x84, 0xDE, 0x82, 0xFD, 0x04, 0x42, 0xFE,
+	 0xF8, 0x84, 0x62, 0x45, 0xC7, 0x83, 0x60, 0x45, 0x02, 0xFE, 0xD5, 0x84, 0x02, 0x05, 0x01, 0x05,
+	 0x61, 0x44, 0xCF, 0x83, 0x60, 0x41, 0x08, 0x03, 0x28, 0x44, 0x60, 0x88, 0x2A, 0x44, 0x70, 0x8A,
+	 0x2C, 0x44, 0x70, 0x8C, 0xF1, 0x81, 0xF1, 0x01, 0xCE, 0x82, 0xE9, 0x81, 0xFD, 0x02, 0xF1, 0x81,
+	 0x09, 0xF2, 0xFF, 0xFF, 0x60, 0x47, 0xE8, 0x84, 0xE8, 0x84, 0x5A, 0xD2, 0x3F, 0xB5, 0xE0, 0x84,
+	 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xB4, 0x84, 0x61, 0x45, 0xD4, 0x84,
+	 0xC0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x93, 0x10, 0x60, 0x0A, 0xF3, 0xFF, 0xFF,
+	 0x02, 0x18, 0x2E, 0x58, 0xFF, 0xFF, 0x16, 0x65, 0x32, 0x40, 0x80, 0x26, 0x16, 0x65, 0x73, 0x44,
+	 0xD4, 0x93, 0x69, 0xF3, 0x26, 0x46, 0x04, 0xBC, 0xA2, 0xDB, 0x26, 0xF0, 0xFF, 0x67, 0x20, 0x88,
+	 0x64, 0x5F, 0x40, 0x4A, 0x24, 0x60, 0x58, 0x4E, 0x80, 0x78, 0xFF, 0xFF, 0x0A, 0x48, 0x24, 0x60,
+	 0x58, 0x4E, 0x90, 0x78, 0xFF, 0xFF, 0x24, 0x60, 0x58, 0x4E, 0xAC, 0x78, 0xFF, 0xFF, 0x6B, 0xF3,
+	 0xFF, 0xFF, 0xC8, 0x84, 0xFF, 0xFF, 0x01, 0x05, 0x00, 0x64, 0x6B, 0xFB, 0x08, 0x60, 0x0C, 0xF1,
+	 0x00, 0x60, 0x40, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x1C, 0x60, 0xCE, 0x64, 0x13, 0x60,
+	 0x22, 0xFB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x08, 0x60, 0x0C, 0xF1, 0xFF, 0x60,
+	 0xDF, 0x64, 0xA0, 0x84, 0xA2, 0xDB, 0x26, 0x46, 0x2F, 0x58, 0xFF, 0xFF, 0x08, 0x60, 0x1E, 0xF1,
+	 0x00, 0x60, 0x02, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x1C, 0x60,
+	 0xDA, 0x63, 0xA3, 0xDF, 0x06, 0xA3, 0x10, 0x60, 0xA4, 0x64, 0xBD, 0xDB, 0xBD, 0xDB, 0x06, 0x64,
+	 0xA3, 0xDB, 0x27, 0x60, 0x68, 0x64, 0x08, 0x60, 0x51, 0xFB, 0x10, 0x60, 0x0F, 0xF1, 0x0E, 0x60,
+	 0x6F, 0xF9, 0x27, 0x60, 0xCF, 0x64, 0x08, 0x60, 0x38, 0xFB, 0x11, 0x60, 0x44, 0x63, 0x08, 0x60,
+	 0x66, 0xFD, 0x12, 0x60, 0x40, 0x63, 0x08, 0x60, 0x67, 0xFD, 0xCF, 0xF3, 0x02, 0x63, 0x01, 0x1B,
+	 0xCF, 0xFD, 0xCF, 0xF3, 0xFF, 0xFF, 0xF7, 0xA0, 0x01, 0x64, 0x01, 0x06, 0xCF, 0xFB, 0xCF, 0xF3,
+	 0xCF, 0xFB, 0xCF, 0xF3, 0x12, 0x60, 0x78, 0x63, 0x26, 0x18, 0xCC, 0x84, 0xFF, 0xFF, 0x02, 0x03,
+	 0x2A, 0xA3, 0xFB, 0x01, 0x63, 0x46, 0x10, 0x60, 0xF2, 0x63, 0x0E, 0x61, 0x60, 0xFE, 0xA6, 0xD1,
+	 0xDE, 0x86, 0x01, 0x64, 0x64, 0x40, 0x7F, 0x36, 0x00, 0x64, 0xA3, 0xDB, 0xDB, 0x83, 0xA3, 0xD9,
+	 0xCD, 0x81, 0x04, 0xA3, 0xF4, 0x02, 0x11, 0x60, 0x62, 0x63, 0x1C, 0x61, 0xA6, 0xD1, 0xDE, 0x86,
+	 0x01, 0x64, 0x64, 0x40, 0x7F, 0x36, 0x00, 0x64, 0xA3, 0xDB, 0xDB, 0x83, 0xA3, 0xD9, 0xCD, 0x81,
+	 0x06, 0xA3, 0xF4, 0x02, 0x20, 0xFE, 0x00, 0x60, 0x60, 0x64, 0x08, 0x60, 0x1F, 0xFB, 0x27, 0x60,
+	 0xE1, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x11, 0x60, 0x44, 0x63, 0x08, 0x60,
+	 0x66, 0xFD, 0x12, 0x60, 0x40, 0x63, 0x08, 0x60, 0x67, 0xFD, 0x00, 0x60, 0x60, 0x64, 0x08, 0x60,
+	 0x1F, 0xFB, 0x27, 0x60, 0xE1, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x28, 0xF3,
+	 0xFF, 0xFF, 0x60, 0x47, 0x0F, 0xB4, 0x98, 0x00, 0xFF, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x04, 0x64,
+	 0x13, 0x60, 0x1C, 0xFB, 0x27, 0x00, 0x0C, 0x64, 0x3F, 0x40, 0x02, 0x2B, 0x23, 0x00, 0x29, 0xF1,
+	 0x13, 0x60, 0x1C, 0xFB, 0x5A, 0xD9, 0x27, 0x60, 0xFD, 0x64, 0x9F, 0xFB, 0xFF, 0xFF, 0x2D, 0xFF,
+	 0x2A, 0x60, 0x1D, 0x78, 0xFF, 0xFF, 0x29, 0x60, 0x1C, 0x63, 0x09, 0x61, 0x3D, 0x60, 0x58, 0x4D,
+	 0x23, 0x78, 0xFF, 0xFF, 0x75, 0x00, 0x95, 0xF3, 0xFF, 0xFF, 0x7F, 0xB4, 0x95, 0xFB, 0x06, 0x64,
+	 0x13, 0x60, 0x1C, 0xFB, 0xFF, 0xFF, 0x2D, 0xFF, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x08, 0x64,
+	 0x13, 0x60, 0x1C, 0xFB, 0x28, 0x60, 0x7A, 0x64, 0x9F, 0xFB, 0xFF, 0xFF, 0x2D, 0xFF, 0x2A, 0x60,
+	 0x1D, 0x78, 0xFF, 0xFF, 0x29, 0xF3, 0x12, 0x60, 0x45, 0x65, 0x60, 0x5C, 0x3F, 0x40, 0x02, 0x2B,
+	 0x13, 0x00, 0x00, 0x37, 0x11, 0x00, 0x01, 0x3B, 0x53, 0x00, 0x11, 0x60, 0x65, 0x63, 0xFF, 0xB7,
+	 0x60, 0x5C, 0xA3, 0xD3, 0x08, 0xA3, 0x00, 0x7E, 0xD0, 0x80, 0xD7, 0x80, 0x02, 0x03, 0xF9, 0x02,
+	 0x47, 0x00, 0xF4, 0xA3, 0xA3, 0xD3, 0x05, 0x00, 0x00, 0xBC, 0xF2, 0xA4, 0x41, 0x03, 0x40, 0x07,
+	 0x64, 0x44, 0x7D, 0xFB, 0xA1, 0xFB, 0x07, 0x64, 0xA2, 0xFB, 0x28, 0x60, 0x7A, 0x64, 0x9F, 0xFB,
+	 0xFF, 0xFF, 0xDF, 0xFE, 0x00, 0x64, 0x19, 0xFF, 0x2A, 0x60, 0x1D, 0x78, 0xFF, 0xFF, 0x88, 0xFF,
+	 0xBA, 0x60, 0x98, 0x71, 0x8D, 0xE2, 0x01, 0x11, 0x09, 0x00, 0x71, 0x40, 0x80, 0x27, 0xFB, 0x01,
+	 0x88, 0xE2, 0xBA, 0x60, 0xD0, 0x64, 0x03, 0xFB, 0x8D, 0xFF, 0x15, 0x00, 0x8D, 0xFF, 0x28, 0x60,
+	 0xFB, 0x63, 0x06, 0x60, 0x0B, 0xFD, 0xFF, 0xFF, 0x62, 0xFF, 0x28, 0x60, 0x67, 0x63, 0x9F, 0xFD,
+	 0xFF, 0xFF, 0x1A, 0xFF, 0x2A, 0x60, 0x1D, 0x78, 0xFF, 0xFF, 0xA3, 0x60, 0xF4, 0x63, 0x06, 0x60,
+	 0x0B, 0xFD, 0xFF, 0xFF, 0x62, 0xFF, 0x29, 0xF5, 0x26, 0x60, 0x20, 0x63, 0x25, 0x60, 0xF2, 0x64,
+	 0xBD, 0xDB, 0x66, 0x44, 0xBD, 0xDB, 0x02, 0x64, 0xA3, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xF9, 0xFE,
+	 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x68, 0x01, 0x00, 0x36, 0x69, 0x01, 0x01, 0x36, 0x6B, 0x01,
+	 0x02, 0x36, 0x81, 0x01, 0x03, 0x36, 0x8B, 0x01, 0x04, 0x36, 0xC1, 0x01, 0x05, 0x36, 0xBF, 0x01,
+	 0x06, 0x36, 0xF1, 0x01, 0x07, 0x36, 0xBB, 0x01, 0x08, 0x36, 0x8C, 0x01, 0x09, 0x36, 0x0C, 0x00,
+	 0x0A, 0x36, 0x0D, 0x00, 0x0B, 0x36, 0x0E, 0x00, 0x0C, 0x36, 0x17, 0x00, 0x0D, 0x36, 0x0D, 0x00,
+	 0x0E, 0x36, 0x1D, 0x00, 0x0F, 0x36, 0x41, 0x00, 0x02, 0x60, 0x00, 0x64, 0x08, 0x00, 0x04, 0x60,
+	 0x00, 0x64, 0x05, 0x00, 0x00, 0x60, 0x01, 0x64, 0x02, 0x00, 0x20, 0x60, 0x00, 0x64, 0x32, 0x45,
+	 0xB4, 0x85, 0x45, 0x52, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x29, 0x60, 0xDE, 0x63, 0x06, 0x60,
+	 0x0B, 0xFD, 0x62, 0xFF, 0xFF, 0xFF, 0x1A, 0xFF, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x3F, 0x40,
+	 0x02, 0x2B, 0x15, 0x00, 0x88, 0xFF, 0xBA, 0x60, 0x98, 0x71, 0x8D, 0xE2, 0x01, 0x11, 0x09, 0x00,
+	 0x71, 0x40, 0x80, 0x27, 0xFB, 0x01, 0x88, 0xE2, 0xBA, 0x60, 0xD0, 0x64, 0x03, 0xFB, 0x8D, 0xFF,
+	 0x11, 0x00, 0x8D, 0xFF, 0x90, 0x60, 0x00, 0xE8, 0x28, 0x60, 0xFB, 0x63, 0x04, 0x00, 0x91, 0x60,
+	 0x00, 0xE8, 0x29, 0x60, 0xC4, 0x63, 0x2A, 0xE8, 0x06, 0x60, 0x0B, 0xFD, 0xFF, 0xFF, 0x62, 0xFF,
+	 0xFF, 0xFF, 0x1A, 0xFF, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0xF1, 0xF3, 0xFF, 0xFF, 0xEF, 0xB4,
+	 0xF1, 0xFB, 0xAD, 0x4F, 0xFD, 0xB4, 0xA0, 0x5D, 0xD0, 0x60, 0x00, 0xE8, 0x2A, 0xE8, 0xD9, 0x60,
+	 0xFE, 0x64, 0x32, 0x45, 0xA4, 0x85, 0x45, 0x52, 0x99, 0xFF, 0xA5, 0x4F, 0xFF, 0xB4, 0x07, 0xFB,
+	 0x98, 0xFF, 0xA3, 0x60, 0xF4, 0x63, 0x06, 0x60, 0x0B, 0xFD, 0x62, 0xFF, 0x00, 0x67, 0x23, 0x58,
+	 0xFF, 0xFF, 0x08, 0xE1, 0xA1, 0xFF, 0xFF, 0xFF, 0x43, 0xFF, 0x01, 0x60, 0x00, 0xE1, 0x28, 0xF3,
+	 0x47, 0xFF, 0x60, 0x40, 0x07, 0x37, 0x66, 0x00, 0x05, 0x3B, 0x04, 0x00, 0xFF, 0x0A, 0x80, 0xE1,
+	 0xA1, 0xFF, 0xFF, 0xFF, 0x1B, 0x60, 0xF3, 0xF1, 0xAD, 0x4F, 0x00, 0x7F, 0xFA, 0xB4, 0x64, 0x41,
+	 0x7D, 0xF1, 0x02, 0xB1, 0x04, 0x65, 0x02, 0x02, 0x64, 0x40, 0x01, 0x2B, 0x01, 0x65, 0xB4, 0x84,
+	 0xA0, 0x5D, 0x29, 0xF5, 0x2A, 0xF3, 0x47, 0xFF, 0x3F, 0xF0, 0x01, 0x1B, 0x01, 0x64, 0x60, 0x56,
+	 0xAD, 0xE2, 0xB5, 0xFF, 0x6C, 0x40, 0x40, 0xE1, 0xA1, 0xFF, 0x00, 0xF4, 0x6E, 0x61, 0x12, 0x62,
+	 0x64, 0x43, 0x01, 0xE1, 0x03, 0x64, 0xE2, 0xD0, 0xC9, 0x81, 0x64, 0x4C, 0xCC, 0x84, 0xDA, 0x82,
+	 0xFA, 0x02, 0x01, 0x60, 0x00, 0x6B, 0x9A, 0xFF, 0xCA, 0x82, 0x03, 0x00, 0x00, 0xF4, 0x81, 0xF2,
+	 0xFF, 0xFF, 0x7A, 0xD0, 0xA1, 0xFF, 0x64, 0x4C, 0xFC, 0x1C, 0xF8, 0x1D, 0x00, 0xB9, 0x06, 0x1E,
+	 0x02, 0x02, 0x00, 0xF4, 0xDA, 0x82, 0x5A, 0xD2, 0xA1, 0xFF, 0x60, 0x4D, 0x3F, 0x40, 0x02, 0x2B,
+	 0x10, 0x00, 0x28, 0xF3, 0xA5, 0x60, 0xC4, 0x65, 0x60, 0x40, 0x0E, 0x3B, 0x0A, 0x00, 0xF1, 0xF3,
+	 0xFF, 0xFF, 0x10, 0xBC, 0xF1, 0xFB, 0xAD, 0x4F, 0x02, 0xBC, 0x00, 0x7F, 0xA0, 0x5D, 0x85, 0x4C,
+	 0xFE, 0x01, 0xF1, 0xF3, 0xFF, 0xFF, 0x02, 0xBC, 0xF1, 0xFB, 0xA1, 0xFF, 0x87, 0x4E, 0x87, 0x4C,
+	 0x87, 0x4C, 0x87, 0x4C, 0x87, 0x4C, 0x67, 0x4C, 0xFF, 0xFF, 0xBC, 0xFF, 0x00, 0xE1, 0xD5, 0xFE,
+	 0xA1, 0xFF, 0xFF, 0xFF, 0x00, 0x64, 0x40, 0x46, 0x60, 0x41, 0xB5, 0xFF, 0xB7, 0xFF, 0xB4, 0xFF,
+	 0x29, 0xF5, 0x3F, 0xF0, 0x24, 0xF2, 0x44, 0x43, 0x40, 0x4D, 0x00, 0xF4, 0xF3, 0x60, 0xA0, 0x65,
+	 0x10, 0x62, 0x5A, 0xD2, 0xD9, 0x81, 0xD4, 0x80, 0xFF, 0xFF, 0xFB, 0x02, 0x61, 0x45, 0x2D, 0x44,
+	 0xD4, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xFD, 0xA5, 0x48, 0x60, 0x00, 0x64, 0xC4, 0x9D,
+	 0x0D, 0x60, 0x00, 0x6B, 0x2D, 0x44, 0xC0, 0x83, 0xBB, 0xFF, 0x29, 0xF5, 0x01, 0xE1, 0x00, 0xF4,
+	 0x6C, 0x61, 0x10, 0x62, 0x05, 0x00, 0x00, 0xF4, 0x01, 0xF2, 0xFF, 0xFF, 0x60, 0x41, 0x04, 0x62,
+	 0xA1, 0xFF, 0xFF, 0xFF, 0x01, 0x10, 0x1A, 0x00, 0x26, 0x44, 0x01, 0x26, 0x0C, 0x00, 0x2D, 0x44,
+	 0xC8, 0x84, 0x40, 0x4D, 0x02, 0x03, 0x6C, 0x45, 0xF3, 0x01, 0x03, 0x15, 0x01, 0x64, 0x05, 0xFA,
+	 0x15, 0x00, 0x6C, 0x45, 0xED, 0x01, 0x23, 0x44, 0xC8, 0x84, 0x40, 0x43, 0x02, 0x03, 0x6C, 0x45,
+	 0xE7, 0x01, 0x00, 0x64, 0x01, 0x15, 0x01, 0x64, 0x6C, 0x45, 0x05, 0xFB, 0xE2, 0xD2, 0xDA, 0x82,
+	 0xC9, 0x81, 0x60, 0x4C, 0xDD, 0x1C, 0xD7, 0x03, 0xBC, 0xFF, 0xDA, 0x01, 0x00, 0xE1, 0xD5, 0xFE,
+	 0xA1, 0xFF, 0xFF, 0xFF, 0x08, 0xE1, 0xA1, 0xFF, 0x67, 0x4C, 0x43, 0xFF, 0xF1, 0xF3, 0xFF, 0xFF,
+	 0x10, 0xBC, 0xF1, 0xFB, 0xAD, 0x4F, 0x02, 0xBC, 0x00, 0x7F, 0xA0, 0x5D, 0x01, 0xE1, 0x01, 0x60,
+	 0x69, 0x6B, 0xA5, 0x60, 0xC4, 0x64, 0x60, 0x4C, 0xBB, 0xFF, 0xA1, 0xFF, 0xFF, 0xFF, 0x60, 0x4C,
+	 0xA1, 0xFF, 0xFF, 0xFF, 0x60, 0x4C, 0xFC, 0x01, 0x29, 0xF3, 0x2A, 0xF1, 0x07, 0xB5, 0x04, 0xE1,
+	 0x65, 0x41, 0x64, 0x54, 0xCD, 0xE2, 0x95, 0x81, 0xA1, 0x5D, 0xA1, 0xFF, 0xFF, 0xFF, 0xF9, 0x01,
+	 0x61, 0x44, 0xFE, 0xFB, 0xFF, 0xFD, 0xFF, 0x01, 0x7F, 0x67, 0x01, 0x61, 0x23, 0x58, 0xFF, 0xFF,
+	 0xB1, 0xFE, 0x08, 0x05, 0xB0, 0xFE, 0x09, 0x05, 0xB2, 0xFE, 0xB3, 0xFE, 0x78, 0x43, 0x01, 0x61,
+	 0x29, 0x60, 0xEA, 0x78, 0x34, 0x60, 0x8D, 0x78, 0xFF, 0xFF, 0x28, 0xF3, 0x29, 0xF1, 0x40, 0x44,
+	 0x44, 0x45, 0x2A, 0xF1, 0x2B, 0xF1, 0x44, 0x46, 0x44, 0x47, 0x3F, 0xB4, 0xE0, 0x85, 0x20, 0x60,
+	 0x28, 0x64, 0x44, 0xD7, 0x58, 0x43, 0xFF, 0xFF, 0x60, 0x45, 0x0E, 0x60, 0xDD, 0xF3, 0x61, 0x43,
+	 0x04, 0xB4, 0x24, 0x44, 0x02, 0x03, 0x13, 0xFF, 0x06, 0x00, 0x3F, 0xB4, 0xB4, 0x84, 0xFF, 0x27,
+	 0x05, 0xFD, 0x04, 0xFB, 0x10, 0x75, 0xA1, 0xFF, 0xFF, 0xFF, 0x86, 0x3E, 0xB4, 0xFE, 0x0B, 0x05,
+	 0xB5, 0xFE, 0x02, 0x24, 0x9F, 0xF7, 0xFF, 0xFF, 0xFF, 0xFF, 0xB7, 0xFE, 0x07, 0x05, 0x78, 0x43,
+	 0x01, 0x61, 0x29, 0x60, 0xEA, 0x78, 0x34, 0x60, 0xC8, 0x78, 0xFF, 0xFF, 0x36, 0x44, 0x00, 0x7F,
+	 0xEE, 0xA0, 0x60, 0x45, 0x05, 0x05, 0x20, 0x60, 0xBA, 0x64, 0x44, 0xD7, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x78, 0x43, 0x01, 0x61, 0x29, 0x60, 0xEA, 0x78, 0x78, 0x43, 0x01, 0x61, 0x29, 0x60, 0xEA, 0x78,
+	 0x7F, 0x60, 0xC0, 0x64, 0x24, 0x45, 0xA4, 0x80, 0x7F, 0x67, 0x02, 0x61, 0x10, 0x02, 0x10, 0x64,
+	 0x40, 0x40, 0x02, 0x64, 0x40, 0x50, 0x61, 0xFF, 0x3F, 0x40, 0x40, 0x26, 0x04, 0x00, 0x10, 0xE0,
+	 0x46, 0x60, 0x09, 0xE0, 0x00, 0x00, 0x27, 0xF1, 0x00, 0x66, 0x20, 0x78, 0x42, 0xFE, 0x23, 0x58,
+	 0xFF, 0xFF, 0x7F, 0x60, 0xC0, 0x64, 0x24, 0x45, 0xA4, 0x80, 0x7F, 0x67, 0x02, 0x61, 0x1A, 0x02,
+	 0x0E, 0x60, 0xDD, 0xF3, 0x07, 0x7C, 0x20, 0xB5, 0x0C, 0xB5, 0x04, 0x03, 0x03, 0x02, 0xDB, 0xF9,
+	 0x00, 0x67, 0x10, 0x00, 0x00, 0x61, 0x41, 0x56, 0xC7, 0xFE, 0xAD, 0x01, 0x36, 0x47, 0xFF, 0x23,
+	 0x04, 0x00, 0x00, 0x7F, 0x60, 0x41, 0x7F, 0x67, 0x05, 0x00, 0x62, 0xFF, 0x20, 0x44, 0x80, 0xBC,
+	 0x40, 0x40, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x7F, 0x60, 0xC0, 0x64, 0x24, 0x45, 0xA4, 0x80,
+	 0x7F, 0x67, 0x02, 0x61, 0x31, 0x02, 0x0E, 0x60, 0xDD, 0xF3, 0x01, 0x7C, 0x20, 0xB5, 0x0C, 0xB5,
+	 0x03, 0x03, 0x02, 0x02, 0xDB, 0xF9, 0xFF, 0xFF, 0x02, 0x61, 0x41, 0x56, 0xC7, 0xFE, 0x2A, 0x60,
+	 0x1D, 0x78, 0xFF, 0xFF, 0x9D, 0xF1, 0x20, 0x44, 0x64, 0x40, 0xFF, 0x26, 0x1C, 0x00, 0x7F, 0xB4,
+	 0x40, 0x40, 0x5C, 0x5E, 0x82, 0xFF, 0x26, 0x44, 0xFD, 0xB4, 0x40, 0x46, 0x5C, 0x41, 0x87, 0xFF,
+	 0x62, 0xFF, 0x13, 0x60, 0x02, 0xF3, 0xFF, 0xFF, 0x00, 0xA8, 0x60, 0x46, 0x04, 0x03, 0x09, 0xF2,
+	 0x8F, 0xFC, 0xAC, 0x86, 0xFB, 0x01, 0x95, 0xF3, 0xFF, 0xFF, 0x7F, 0xB4, 0x95, 0xFB, 0x06, 0x64,
+	 0x13, 0x60, 0x1C, 0xFB, 0x2D, 0xFF, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x00, 0x67, 0x20, 0x40,
+	 0x80, 0x2A, 0x02, 0x00, 0x7F, 0x67, 0x06, 0x61, 0x60, 0x45, 0x0E, 0x60, 0xDD, 0xF3, 0x61, 0x43,
+	 0x04, 0xB4, 0x24, 0x44, 0x02, 0x03, 0x13, 0xFF, 0x56, 0x01, 0x3F, 0xB4, 0xB4, 0x84, 0xFF, 0x27,
+	 0x05, 0xFD, 0x04, 0xFB, 0x20, 0x40, 0x80, 0x2A, 0x02, 0x00, 0x10, 0x75, 0x05, 0x00, 0x01, 0x64,
+	 0x19, 0x60, 0xF7, 0xFB, 0x08, 0x60, 0x10, 0x75, 0x46, 0x01, 0x25, 0x46, 0x01, 0xF2, 0x08, 0xF0,
+	 0x60, 0x47, 0x03, 0xB4, 0x03, 0xAC, 0x7F, 0x67, 0x03, 0x61, 0x08, 0x02, 0x26, 0x60, 0x20, 0x64,
+	 0x40, 0x4B, 0x34, 0x60, 0x58, 0x4D, 0x08, 0x78, 0xFF, 0xFF, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF,
+	 0x24, 0x40, 0x01, 0x2B, 0x49, 0x00, 0x25, 0x44, 0x1F, 0xB4, 0xE0, 0x85, 0x2A, 0x60, 0xF4, 0x64,
+	 0xC4, 0x98, 0xFF, 0xFF, 0xC0, 0xFE, 0x3D, 0x00, 0xC1, 0xFE, 0x3B, 0x00, 0xC2, 0xFE, 0x39, 0x00,
+	 0xC3, 0xFE, 0x37, 0x00, 0xC4, 0xFE, 0x35, 0x00, 0xC5, 0xFE, 0x33, 0x00, 0xC6, 0xFE, 0x31, 0x00,
+	 0xC7, 0xFE, 0x2F, 0x00, 0xC8, 0xFE, 0x2D, 0x00, 0xC9, 0xFE, 0x2B, 0x00, 0xCA, 0xFE, 0x29, 0x00,
+	 0xCB, 0xFE, 0x27, 0x00, 0xCC, 0xFE, 0x25, 0x00, 0xCD, 0xFE, 0x23, 0x00, 0xCE, 0xFE, 0x21, 0x00,
+	 0xCF, 0xFE, 0x1F, 0x00, 0xD0, 0xFE, 0x1D, 0x00, 0xD1, 0xFE, 0x1B, 0x00, 0xD2, 0xFE, 0x19, 0x00,
+	 0xD3, 0xFE, 0x17, 0x00, 0xD4, 0xFE, 0x15, 0x00, 0xD5, 0xFE, 0x13, 0x00, 0xD6, 0xFE, 0x11, 0x00,
+	 0xD7, 0xFE, 0x0F, 0x00, 0xD8, 0xFE, 0x0D, 0x00, 0xD9, 0xFE, 0x0B, 0x00, 0xDA, 0xFE, 0x09, 0x00,
+	 0xDB, 0xFE, 0x07, 0x00, 0xDC, 0xFE, 0x05, 0x00, 0xDD, 0xFE, 0x03, 0x00, 0xDE, 0xFE, 0x01, 0x00,
+	 0xDF, 0xFE, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x00, 0x64, 0x9F, 0xFE, 0xF0, 0x84, 0xFF, 0xFF,
+	 0x9E, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x9D, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x9C, 0xFE, 0xF0, 0x84,
+	 0xFF, 0xFF, 0x9B, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x9A, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x99, 0xFE,
+	 0xF0, 0x84, 0xFF, 0xFF, 0x98, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x97, 0xFE, 0xF0, 0x84, 0xFF, 0xFF,
+	 0x96, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x95, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x94, 0xFE, 0xF0, 0x84,
+	 0xFF, 0xFF, 0x93, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x92, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x91, 0xFE,
+	 0xF0, 0x84, 0xFF, 0xFF, 0x90, 0xFE, 0xF0, 0x84, 0x06, 0xFB, 0x8F, 0xFE, 0xF0, 0x84, 0xFF, 0xFF,
+	 0x8E, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x8D, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x8C, 0xFE, 0xF0, 0x84,
+	 0xFF, 0xFF, 0x8B, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x8A, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x89, 0xFE,
+	 0xF0, 0x84, 0xFF, 0xFF, 0x88, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x87, 0xFE, 0xF0, 0x84, 0xFF, 0xFF,
+	 0x86, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x85, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x84, 0xFE, 0xF0, 0x84,
+	 0xFF, 0xFF, 0x83, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x82, 0xFE, 0xF0, 0x84, 0xFF, 0xFF, 0x81, 0xFE,
+	 0xF0, 0x84, 0xFF, 0xFF, 0x80, 0xFE, 0xF0, 0x84, 0x05, 0xFB, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF,
+	 0x5C, 0x5C, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x24, 0x40, 0x01, 0x27, 0x55, 0x00, 0x05, 0x60,
+	 0x00, 0x63, 0x05, 0xFD, 0x30, 0x44, 0xBD, 0xDB, 0x31, 0x44, 0xBD, 0xDB, 0x32, 0x44, 0xBD, 0xDB,
+	 0x33, 0x44, 0xBD, 0xDB, 0x34, 0x44, 0xBD, 0xDB, 0x35, 0x44, 0xBD, 0xDB, 0x36, 0x44, 0xBD, 0xDB,
+	 0x37, 0x44, 0xBD, 0xDB, 0x38, 0x44, 0xBD, 0xDB, 0x39, 0x44, 0xBD, 0xDB, 0x3A, 0x44, 0xBD, 0xDB,
+	 0x3B, 0x44, 0xBD, 0xDB, 0x3C, 0x44, 0xBD, 0xDB, 0x3D, 0x44, 0xBD, 0xDB, 0x3E, 0x44, 0xBD, 0xDB,
+	 0x3F, 0x44, 0xBD, 0xDB, 0x02, 0x61, 0x61, 0x44, 0x02, 0x36, 0x82, 0xFF, 0x03, 0x36, 0x83, 0xFF,
+	 0x04, 0x36, 0x84, 0xFF, 0x05, 0x36, 0x85, 0xFF, 0x06, 0x36, 0x86, 0xFF, 0x07, 0x36, 0x87, 0xFF,
+	 0x20, 0x44, 0xBD, 0xDB, 0x21, 0x44, 0xBD, 0xDB, 0x22, 0x44, 0xBD, 0xDB, 0x23, 0x44, 0xBD, 0xDB,
+	 0x24, 0x44, 0xBD, 0xDB, 0x25, 0x44, 0xBD, 0xDB, 0x26, 0x44, 0xBD, 0xDB, 0x27, 0x44, 0xBD, 0xDB,
+	 0x28, 0x44, 0xBD, 0xDB, 0x29, 0x44, 0xBD, 0xDB, 0x2A, 0x44, 0xBD, 0xDB, 0x2B, 0x44, 0xBD, 0xDB,
+	 0x2C, 0x44, 0xBD, 0xDB, 0x2D, 0x44, 0xBD, 0xDB, 0x2E, 0x44, 0xBD, 0xDB, 0x2F, 0x44, 0xBD, 0xDB,
+	 0xDD, 0x81, 0x08, 0x3A, 0xD0, 0x01, 0x54, 0x00, 0x27, 0x40, 0x10, 0x26, 0x30, 0x00, 0x26, 0x44,
+	 0x01, 0x36, 0x2D, 0x00, 0x02, 0x36, 0x82, 0xFF, 0x03, 0x36, 0x83, 0xFF, 0x04, 0x36, 0x84, 0xFF,
+	 0x05, 0x36, 0x85, 0xFF, 0x06, 0x36, 0x86, 0xFF, 0x25, 0x44, 0x00, 0x36, 0x44, 0x40, 0x01, 0x36,
+	 0x44, 0x41, 0x02, 0x36, 0x44, 0x42, 0x03, 0x36, 0x44, 0x43, 0x04, 0x36, 0x44, 0x44, 0x05, 0x36,
+	 0x44, 0x45, 0x06, 0x36, 0x44, 0x46, 0x07, 0x36, 0x44, 0x47, 0x08, 0x36, 0x44, 0x48, 0x09, 0x36,
+	 0x44, 0x49, 0x0A, 0x36, 0x44, 0x4A, 0x0B, 0x36, 0x44, 0x4B, 0x0C, 0x36, 0x44, 0x4C, 0x0D, 0x36,
+	 0x44, 0x4D, 0x0E, 0x36, 0x44, 0x4E, 0x0F, 0x36, 0x44, 0x4F, 0x87, 0xFF, 0x21, 0x00, 0x25, 0x44,
+	 0x10, 0x36, 0x44, 0x50, 0x11, 0x36, 0x44, 0x51, 0x12, 0x36, 0x44, 0x52, 0x13, 0x36, 0x44, 0x53,
+	 0x14, 0x36, 0x44, 0x54, 0x15, 0x36, 0x44, 0x55, 0x16, 0x36, 0x44, 0x56, 0x17, 0x36, 0x44, 0x57,
+	 0x18, 0x36, 0x44, 0x58, 0x19, 0x36, 0x44, 0x59, 0x1A, 0x36, 0x44, 0x5A, 0x1B, 0x36, 0x44, 0x5B,
+	 0x1C, 0x36, 0x44, 0x5C, 0x1D, 0x36, 0x44, 0x5D, 0x1E, 0x36, 0x44, 0x5E, 0x1F, 0x36, 0x44, 0x5F,
+	 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x25, 0x46, 0xB5, 0x60, 0x58, 0x4F, 0xCE, 0x78, 0xFF, 0xFF,
+	 0x03, 0x61, 0x7F, 0x67, 0x0A, 0x02, 0x00, 0xF0, 0x04, 0x64, 0x13, 0x60, 0x10, 0xFB, 0x5A, 0xD9,
+	 0x0A, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x40, 0x60,
+	 0xC0, 0x64, 0x24, 0x45, 0xA4, 0x80, 0x7F, 0x67, 0x02, 0x61, 0x12, 0x02, 0x14, 0x64, 0x13, 0x60,
+	 0x1C, 0xFB, 0x00, 0x60, 0x50, 0x63, 0x5A, 0xDD, 0x2C, 0x60, 0x75, 0x64, 0x9F, 0xFB, 0x2D, 0xFF,
+	 0x2A, 0x60, 0x1D, 0x78, 0xFF, 0xFF, 0x2A, 0xF3, 0x05, 0xFB, 0x2B, 0xF3, 0x06, 0xFB, 0x00, 0x67,
+	 0x23, 0x58, 0xFF, 0xFF, 0x40, 0x60, 0xC0, 0x64, 0x24, 0x45, 0xA4, 0x80, 0x7F, 0x67, 0x02, 0x61,
+	 0x0E, 0x02, 0x16, 0x64, 0x13, 0x60, 0x1C, 0xFB, 0x00, 0x60, 0x50, 0x63, 0x5A, 0xDD, 0x2C, 0x60,
+	 0x90, 0x64, 0x9F, 0xFB, 0x2D, 0xFF, 0x2A, 0x60, 0x1D, 0x78, 0xFF, 0xFF, 0x00, 0x67, 0x23, 0x58,
+	 0xFF, 0xFF, 0x7F, 0x60, 0xC0, 0x64, 0x24, 0x45, 0xA4, 0x80, 0x02, 0x61, 0x38, 0x02, 0x25, 0x45,
+	 0x20, 0x44, 0x80, 0x2A, 0x34, 0x00, 0xF1, 0x60, 0x00, 0x64, 0xD4, 0x80, 0xFF, 0xFF, 0x06, 0x03,
+	 0xF1, 0x60, 0x02, 0x64, 0xD4, 0x80, 0xFF, 0xFF, 0x2F, 0x03, 0x28, 0x00, 0x19, 0x60, 0x40, 0xF1,
+	 0xB7, 0xF3, 0x20, 0x60, 0x22, 0x61, 0xA0, 0x84, 0xA1, 0xDB, 0x25, 0x45, 0x25, 0x60, 0x86, 0x63,
+	 0x02, 0x61, 0xBD, 0xD3, 0xBD, 0xD1, 0xD4, 0x80, 0xBD, 0xD3, 0xBD, 0xD5, 0xCD, 0x81, 0x02, 0x03,
+	 0x15, 0x03, 0xF7, 0x01, 0xA2, 0xFF, 0xA6, 0xD3, 0x40, 0x4C, 0x00, 0xA8, 0x67, 0x43, 0x0C, 0x02,
+	 0xA2, 0xDD, 0x42, 0x48, 0x64, 0x41, 0xB6, 0x60, 0x58, 0x4D, 0x25, 0x78, 0xFF, 0xFF, 0x66, 0x44,
+	 0x28, 0xDB, 0x02, 0x03, 0x2C, 0x58, 0xA3, 0xFF, 0x0C, 0x61, 0x03, 0x00, 0x04, 0x61, 0x7F, 0x67,
+	 0x01, 0x00, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x01, 0x64, 0x10, 0x60, 0x13, 0xFB, 0xFF, 0xFF,
+	 0xC4, 0xFE, 0xF7, 0x01, 0xC6, 0xFE, 0xF5, 0x01, 0x7E, 0x60, 0xC0, 0x64, 0x24, 0x45, 0xA4, 0x80,
+	 0x02, 0x61, 0x3F, 0x02, 0x25, 0x45, 0xF8, 0x2B, 0x3B, 0x00, 0x2E, 0xF5, 0x67, 0x44, 0xD4, 0x80,
+	 0x20, 0x60, 0xCC, 0x63, 0x39, 0x03, 0x79, 0x61, 0x24, 0x44, 0x01, 0x27, 0x29, 0x00, 0xA3, 0xFC,
+	 0xA4, 0xF8, 0xBD, 0xD3, 0xA3, 0xD1, 0xD4, 0x80, 0xCD, 0x81, 0x08, 0x24, 0x64, 0x58, 0x08, 0xA3,
+	 0xF8, 0x02, 0x08, 0x60, 0x00, 0x63, 0xBD, 0xD3, 0xA3, 0xD1, 0xFE, 0xA0, 0xFA, 0x60, 0x00, 0x64,
+	 0xD0, 0x80, 0x14, 0x02, 0x13, 0x02, 0x04, 0xA3, 0xBE, 0xD3, 0xBD, 0xD1, 0x0F, 0x18, 0xD4, 0x80,
+	 0x0D, 0x18, 0x03, 0x03, 0xC3, 0x83, 0xC3, 0x83, 0xF7, 0x01, 0x64, 0x41, 0xDD, 0x81, 0xE1, 0x81,
+	 0xCB, 0x83, 0x46, 0x65, 0x36, 0x60, 0x58, 0x4F, 0x22, 0x78, 0xFF, 0xFF, 0x00, 0x67, 0x0A, 0x00,
+	 0xBD, 0xD3, 0xBE, 0xD1, 0xD4, 0x80, 0xCD, 0x81, 0x08, 0x24, 0x64, 0x58, 0x08, 0xA3, 0xF8, 0x02,
+	 0x04, 0x61, 0x7F, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x0F, 0x64, 0x23, 0xFA, 0x67, 0x44, 0x24, 0xFA,
+	 0x62, 0x41, 0x3C, 0x60, 0x00, 0x65, 0x1A, 0x63, 0x80, 0x60, 0x9E, 0x64, 0x65, 0x46, 0x58, 0xD0,
+	 0x2E, 0xF5, 0x59, 0xD8, 0xFB, 0x1F, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0xCB, 0x83, 0xBF, 0xD1,
+	 0x4A, 0x65, 0x64, 0x43, 0xBD, 0xD3, 0xFF, 0xFF, 0x60, 0x41, 0x01, 0x26, 0xDC, 0x81, 0xE9, 0x84,
+	 0xDC, 0x84, 0x23, 0xFA, 0x09, 0x00, 0x4B, 0xD3, 0xFF, 0xFF, 0x60, 0x41, 0xE8, 0x84, 0xDC, 0x84,
+	 0x23, 0xFA, 0xBF, 0xD1, 0x4A, 0x65, 0x64, 0x43, 0x36, 0x60, 0x58, 0x4F, 0x22, 0x78, 0xFF, 0xFF,
+	 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x25, 0xF2, 0xFF, 0xFF, 0xE0, 0xA0, 0x20, 0x64, 0x01, 0x06,
+	 0x25, 0xFA, 0x23, 0xF2, 0xDF, 0xD1, 0xCC, 0x84, 0xE0, 0x85, 0x0B, 0x06, 0xBF, 0xD1, 0x64, 0x41,
+	 0xD5, 0x80, 0x64, 0x43, 0x01, 0x06, 0x65, 0x41, 0x4A, 0x65, 0x2E, 0x60, 0x58, 0x4F, 0x7A, 0x78,
+	 0xFF, 0xFF, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0xDB, 0xF3, 0x02, 0x63, 0x23, 0xFC, 0x07, 0xB4,
+	 0x25, 0xFA, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x4B, 0xD3, 0xBF, 0xD3, 0x60, 0x41, 0xC9, 0x83,
+	 0xE9, 0x81, 0xDD, 0x81, 0xA3, 0xFA, 0xE0, 0x81, 0x3C, 0x60, 0x00, 0x67, 0x02, 0x24, 0x02, 0xA4,
+	 0x60, 0x47, 0x40, 0x4B, 0xC9, 0x81, 0x4A, 0x65, 0xAB, 0x46, 0x59, 0xD0, 0xAB, 0x46, 0xA5, 0xD8,
+	 0xDA, 0x85, 0x80, 0x3A, 0x02, 0x00, 0x00, 0xF4, 0x04, 0x65, 0xF6, 0x1F, 0x00, 0x67, 0x23, 0x58,
+	 0xFF, 0xFF, 0xFC, 0xA3, 0xA3, 0xD1, 0x4C, 0x65, 0xA4, 0xD3, 0xDA, 0x83, 0x60, 0x47, 0x25, 0xFA,
+	 0x00, 0x7E, 0x60, 0x47, 0x01, 0x26, 0xDC, 0x84, 0x60, 0x41, 0xE8, 0x84, 0xD8, 0x84, 0x23, 0xFA,
+	 0xAB, 0x01, 0xFC, 0xA3, 0xA3, 0xD1, 0x4C, 0x65, 0xA4, 0xD3, 0xDA, 0x83, 0x00, 0x7F, 0x25, 0xFA,
+	 0x60, 0x41, 0x01, 0x26, 0xDD, 0x81, 0xE9, 0x84, 0xD8, 0x84, 0x23, 0xFA, 0x9D, 0x01, 0x2E, 0x60,
+	 0x40, 0x63, 0xBF, 0xD3, 0xFF, 0xFF, 0x60, 0x41, 0xE8, 0x84, 0xDC, 0x84, 0x23, 0xFA, 0x4A, 0x65,
+	 0x36, 0x60, 0x58, 0x4F, 0x22, 0x78, 0xFF, 0xFF, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x2E, 0x60,
+	 0x40, 0x63, 0x23, 0xF2, 0xC0, 0x65, 0xCC, 0x84, 0xE0, 0x81, 0x0A, 0x04, 0xBF, 0xDB, 0xD5, 0x80,
+	 0x07, 0x03, 0x01, 0x06, 0x65, 0x41, 0x61, 0x44, 0xBF, 0xDB, 0x4A, 0x65, 0x58, 0x4F, 0xA8, 0x00,
+	 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x03, 0x4E, 0x2D, 0x60, 0x58, 0x43, 0x55, 0x78, 0xFF, 0xFF,
+	 0x2F, 0x60, 0x24, 0x61, 0x17, 0x60, 0x81, 0xF3, 0xA1, 0xDB, 0xCC, 0x84, 0xA8, 0x83, 0x05, 0x04,
+	 0x2F, 0x60, 0x02, 0x64, 0x58, 0xD1, 0x59, 0xD9, 0xFD, 0x1F, 0x0E, 0x43, 0x82, 0x01, 0x23, 0xF2,
+	 0x25, 0xF2, 0x02, 0xA8, 0xF8, 0xA0, 0x0F, 0x02, 0xEC, 0xA0, 0x0D, 0x04, 0x0C, 0x07, 0x19, 0x60,
+	 0x4F, 0xF1, 0xFF, 0xFF, 0xD0, 0x80, 0xFF, 0xFF, 0x04, 0x07, 0x19, 0x60, 0x4F, 0xFB, 0x19, 0x60,
+	 0x53, 0xFB, 0x16, 0x60, 0xD8, 0xFB, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x23, 0xF2, 0x1D, 0x60,
+	 0xAE, 0x65, 0x60, 0x41, 0x1D, 0x60, 0x4A, 0x63, 0xA3, 0xDB, 0xFF, 0xA1, 0x48, 0x64, 0x58, 0xD0,
+	 0x7E, 0xA8, 0x5B, 0xD9, 0x02, 0x02, 0x00, 0xF4, 0x02, 0x64, 0xFF, 0xA1, 0xD7, 0x80, 0x02, 0x03,
+	 0x01, 0x03, 0xF5, 0x01, 0x2E, 0xF5, 0x00, 0x60, 0x2F, 0x65, 0x25, 0xF2, 0x00, 0x63, 0xCC, 0x84,
+	 0x03, 0xA3, 0xFD, 0x05, 0x4A, 0x64, 0xD7, 0x80, 0x1C, 0x60, 0xE6, 0x61, 0x18, 0x05, 0xA1, 0xDD,
+	 0xE3, 0x83, 0xFE, 0xA3, 0x58, 0xD0, 0x7E, 0xA8, 0x59, 0xD9, 0x02, 0x02, 0x00, 0xF4, 0x02, 0x64,
+	 0xF9, 0x1F, 0x00, 0x63, 0x59, 0xDD, 0x2E, 0xF5, 0x25, 0xF0, 0x0E, 0x60, 0x73, 0xF3, 0xD3, 0x80,
+	 0x01, 0xB0, 0x04, 0x03, 0x01, 0xA4, 0x03, 0x03, 0xA2, 0xDB, 0x01, 0x00, 0xA2, 0xDD, 0x00, 0x67,
+	 0x23, 0x58, 0xFF, 0xFF, 0x1D, 0x60, 0x4A, 0x61, 0xA1, 0xD3, 0x23, 0xFA, 0xE0, 0x83, 0x4A, 0x65,
+	 0x04, 0x02, 0x02, 0x63, 0x23, 0xFC, 0xA5, 0xFC, 0x09, 0x00, 0xDB, 0x83, 0x59, 0xD1, 0xA5, 0xD8,
+	 0xDA, 0x85, 0x80, 0x3A, 0x02, 0x00, 0x00, 0xF4, 0x04, 0x65, 0xF8, 0x1F, 0x00, 0x67, 0x23, 0x58,
+	 0xFF, 0xFF, 0x0E, 0x60, 0x73, 0xF3, 0x00, 0x61, 0x02, 0xA4, 0xFE, 0xA0, 0x23, 0xFA, 0x1B, 0x03,
+	 0xFA, 0xA4, 0xFD, 0xA4, 0x01, 0xA1, 0xFD, 0x07, 0x61, 0x43, 0x23, 0xF2, 0x25, 0xFC, 0xE0, 0x83,
+	 0x02, 0xA3, 0x1C, 0x60, 0xE6, 0x61, 0x00, 0x60, 0x4A, 0x64, 0x59, 0xD1, 0x58, 0xD8, 0x7E, 0x3A,
+	 0x02, 0x00, 0x00, 0xF4, 0x02, 0x64, 0xF9, 0x1F, 0x25, 0xF2, 0x23, 0xF2, 0x01, 0xB0, 0xCC, 0x84,
+	 0x04, 0x02, 0x23, 0xFA, 0x02, 0x00, 0x00, 0x64, 0x25, 0xFA, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF,
+	 0x41, 0x4B, 0x65, 0x42, 0x80, 0x64, 0xD4, 0x85, 0x2B, 0x41, 0x00, 0xA1, 0x55, 0x8B, 0x0D, 0x03,
+	 0x02, 0x04, 0x65, 0x41, 0x02, 0x00, 0x00, 0x64, 0x40, 0x4B, 0xCA, 0x84, 0x58, 0xD0, 0xC9, 0x81,
+	 0xBD, 0xD9, 0xFC, 0x02, 0x00, 0xF4, 0x04, 0x65, 0xEC, 0x01, 0x2F, 0x58, 0xFF, 0xFF, 0xFC, 0xA3,
+	 0xA3, 0xD3, 0x02, 0x7C, 0xA0, 0xD3, 0x23, 0xF8, 0xDC, 0x84, 0x25, 0xFA, 0x00, 0x67, 0x23, 0x58,
+	 0xFF, 0xFF, 0x02, 0x64, 0x23, 0xFA, 0x01, 0x64, 0x9D, 0xFE, 0x02, 0x28, 0x02, 0x64, 0x25, 0xFA,
+	 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x02, 0x7C, 0x23, 0xF8, 0x01, 0x64, 0x25, 0xFA, 0x00, 0x67,
+	 0x23, 0x58, 0xFF, 0xFF, 0xFC, 0xA3, 0xA3, 0xD1, 0x02, 0x64, 0x23, 0xFA, 0xA4, 0xD3, 0x25, 0xFA,
+	 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x02, 0x64, 0x23, 0xFA, 0x88, 0xFF, 0x75, 0x44, 0x8D, 0xFF,
+	 0xE8, 0x87, 0xE8, 0x84, 0xE8, 0x84, 0x03, 0xB4, 0x25, 0xFA, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF,
+	 0x04, 0x64, 0x23, 0xFA, 0x86, 0xFF, 0x29, 0x44, 0x87, 0xFF, 0x25, 0xFA, 0x55, 0xF3, 0x52, 0xF1,
+	 0x80, 0x65, 0xC4, 0x87, 0x00, 0x7F, 0x26, 0xFA, 0x64, 0x44, 0xC4, 0x87, 0x00, 0x7F, 0x27, 0xFA,
+	 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x05, 0x64, 0x23, 0xFA, 0x52, 0x63, 0xB4, 0xF3, 0x4B, 0xDA,
+	 0xB3, 0xF3, 0x4B, 0xDA, 0xB2, 0xF3, 0x4B, 0xDA, 0x60, 0x41, 0x88, 0xFF, 0x72, 0x5C, 0x89, 0xFF,
+	 0x4A, 0xD8, 0xA2, 0x48, 0x20, 0x23, 0x0E, 0x00, 0x64, 0x40, 0x80, 0x27, 0x15, 0x00, 0xDC, 0x84,
+	 0xBD, 0xDA, 0xBD, 0xD2, 0x11, 0x04, 0xDC, 0x84, 0xA2, 0xDA, 0xA3, 0xD2, 0x0D, 0x04, 0xDC, 0x84,
+	 0xA3, 0xDA, 0x0A, 0x00, 0x52, 0x63, 0xB4, 0xF3, 0x4B, 0xDA, 0xB3, 0xF3, 0x4B, 0xDA, 0xB2, 0xF3,
+	 0x4B, 0xDA, 0x54, 0x90, 0x4C, 0x63, 0xE0, 0x02, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x25, 0xF0,
+	 0x23, 0xF2, 0x19, 0x60, 0x46, 0xF9, 0x02, 0xA8, 0x64, 0x44, 0x1F, 0x02, 0x3F, 0x40, 0x02, 0x2B,
+	 0x16, 0x00, 0x00, 0x37, 0x14, 0x00, 0x01, 0x3B, 0x18, 0x00, 0x12, 0x60, 0x45, 0x65, 0x11, 0x60,
+	 0x65, 0x63, 0xFF, 0xB7, 0x60, 0x5C, 0xA3, 0xD3, 0x08, 0xA3, 0x00, 0x7E, 0xD0, 0x80, 0xD7, 0x80,
+	 0x03, 0x03, 0xF9, 0x02, 0x7F, 0x67, 0x0A, 0x00, 0xF4, 0xA3, 0xA3, 0xD1, 0x04, 0x00, 0x00, 0xBC,
+	 0xF2, 0xA4, 0x03, 0x03, 0x02, 0x07, 0x16, 0x60, 0xCF, 0xF9, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF,
+	 0x20, 0x63, 0x2E, 0x60, 0x00, 0x61, 0x48, 0x64, 0x58, 0xD0, 0x59, 0xD9, 0xFD, 0x1F, 0x25, 0xF0,
+	 0x20, 0x64, 0xD0, 0x81, 0xFF, 0xFF, 0x02, 0x07, 0x25, 0xFA, 0x0F, 0x00, 0x2E, 0x60, 0x04, 0x63,
+	 0xC3, 0x83, 0x01, 0x2A, 0x06, 0x00, 0xCF, 0x83, 0xA3, 0xD3, 0xCD, 0x81, 0x00, 0x7F, 0xBD, 0xDB,
+	 0x04, 0x03, 0x00, 0x64, 0xC9, 0x81, 0xBD, 0xDB, 0xFD, 0x02, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF,
+	 0x23, 0xF2, 0x25, 0xF0, 0x02, 0xA8, 0x01, 0x60, 0xA0, 0x62, 0x09, 0x02, 0xA2, 0xD9, 0x64, 0x41,
+	 0x32, 0x44, 0x02, 0xB5, 0x00, 0xB9, 0xD4, 0x84, 0x08, 0x28, 0x02, 0xBC, 0x40, 0x52, 0x00, 0x67,
+	 0x23, 0x58, 0xFF, 0xFF, 0x23, 0xF2, 0x25, 0xF0, 0x02, 0xA8, 0x01, 0x60, 0xA2, 0x62, 0x09, 0x02,
+	 0xA2, 0xD9, 0x64, 0x41, 0x32, 0x44, 0x04, 0xB5, 0x00, 0xB9, 0xD4, 0x84, 0x08, 0x28, 0x04, 0xBC,
+	 0x40, 0x52, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x23, 0xF2, 0x25, 0xF0, 0x02, 0xA8, 0x01, 0x60,
+	 0xB0, 0x62, 0x15, 0x02, 0xA2, 0xD9, 0x64, 0x41, 0x32, 0x44, 0x40, 0xB5, 0x00, 0xB9, 0xD4, 0x84,
+	 0x08, 0x24, 0x0C, 0x00, 0x40, 0xBC, 0x02, 0xB5, 0xD4, 0x84, 0x43, 0xF9, 0x37, 0x60, 0x76, 0x63,
+	 0xD3, 0x80, 0x2F, 0x60, 0x50, 0x7C, 0x02, 0x03, 0x43, 0xFD, 0xA4, 0xDF, 0x40, 0x52, 0x00, 0x67,
+	 0x23, 0x58, 0xFF, 0xFF, 0x37, 0x60, 0x76, 0x64, 0x43, 0xFB, 0x2D, 0x60, 0x5B, 0x78, 0xFF, 0xFF,
+	 0x23, 0xF2, 0x25, 0xF0, 0x01, 0x60, 0xAC, 0x63, 0x7F, 0x67, 0x39, 0x18, 0xA3, 0xD9, 0x26, 0xF0,
+	 0x7F, 0x67, 0x35, 0x18, 0x5B, 0xD9, 0x16, 0x60, 0x87, 0xF3, 0x25, 0xF0, 0x60, 0x40, 0x03, 0x3A,
+	 0x2D, 0x00, 0xA6, 0xF3, 0x20, 0x63, 0xE3, 0x83, 0x60, 0x46, 0x0F, 0xF8, 0x30, 0x61, 0x94, 0xFA,
+	 0x01, 0x61, 0x91, 0xFA, 0x16, 0x64, 0x12, 0xFA, 0x60, 0x40, 0x10, 0x36, 0x05, 0x00, 0x12, 0x36,
+	 0x08, 0x00, 0x0C, 0x36, 0x0B, 0x00, 0x0F, 0x00, 0x40, 0x61, 0xA1, 0x80, 0x0A, 0x64, 0x11, 0x02,
+	 0xF3, 0x01, 0x10, 0x61, 0xA1, 0x80, 0x0E, 0x64, 0x0C, 0x02, 0xEE, 0x01, 0x08, 0x61, 0xA1, 0x80,
+	 0x10, 0x64, 0x07, 0x02, 0xE9, 0x01, 0xE1, 0x81, 0xA1, 0x80, 0x05, 0x05, 0xC8, 0x84, 0x01, 0x02,
+	 0xE3, 0x01, 0x12, 0xFA, 0x91, 0xFA, 0x66, 0x44, 0x02, 0xA6, 0xD7, 0x1F, 0x00, 0x67, 0x23, 0x58,
+	 0xFF, 0xFF, 0x25, 0xF2, 0x19, 0x60, 0x45, 0xFB, 0x19, 0x60, 0x4C, 0xF3, 0xFF, 0xFF, 0x60, 0x40,
+	 0x08, 0x26, 0x18, 0x00, 0x19, 0x60, 0x45, 0xF3, 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x2A, 0x0A, 0x00,
+	 0x19, 0x60, 0x7B, 0xF3, 0xFF, 0xFF, 0x02, 0xBC, 0x60, 0x44, 0xA2, 0xDB, 0x19, 0x60, 0x45, 0xF3,
+	 0xFF, 0xFF, 0x60, 0x40, 0x02, 0x2A, 0x06, 0x00, 0x19, 0x60, 0x7B, 0xF3, 0xFF, 0xFF, 0x04, 0xBC,
+	 0x60, 0x44, 0xA2, 0xDB, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x23, 0xF2, 0x25, 0xF0, 0x02, 0xA8,
+	 0x00, 0x67, 0x02, 0x02, 0x2D, 0xF9, 0x2C, 0xF9, 0x23, 0x58, 0xFF, 0xFF, 0x23, 0xF2, 0x25, 0xF2,
+	 0x02, 0xA8, 0x00, 0xA8, 0x0A, 0x02, 0x07, 0x03, 0xD0, 0xA0, 0x30, 0x65, 0x03, 0x04, 0xA7, 0xA0,
+	 0x59, 0x65, 0x01, 0x06, 0x65, 0x44, 0x16, 0x60, 0xCE, 0xFB, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF,
+	 0x25, 0xF2, 0x19, 0x60, 0x4C, 0xFB, 0xFF, 0xFF, 0x08, 0x2A, 0x25, 0x00, 0x19, 0x60, 0x7B, 0xF3,
+	 0xFF, 0xFF, 0xE9, 0xB4, 0x60, 0x44, 0x19, 0x60, 0x4C, 0xF1, 0xFF, 0xFF, 0x64, 0x40, 0x01, 0x26,
+	 0x02, 0xBC, 0x64, 0x40, 0x02, 0x2A, 0x04, 0xBC, 0x64, 0x40, 0x04, 0x26, 0x08, 0x00, 0x19, 0x60,
+	 0x7B, 0xFB, 0x13, 0x64, 0xCB, 0xFB, 0x01, 0x60, 0x67, 0x64, 0x37, 0xFB, 0x0C, 0x00, 0x10, 0xBC,
+	 0x19, 0x60, 0x7B, 0xFB, 0x08, 0x64, 0xCB, 0xFB, 0xA1, 0xF3, 0x01, 0x60, 0x67, 0x7C, 0x60, 0x40,
+	 0x01, 0x27, 0x5B, 0x7C, 0x37, 0xF9, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x25, 0xF2, 0x19, 0x60,
+	 0x4D, 0xFB, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x25, 0xF2, 0x19, 0x60, 0x4E, 0xFB, 0x00, 0x67,
+	 0x23, 0x58, 0xFF, 0xFF, 0x25, 0xF2, 0x19, 0x60, 0x89, 0xFB, 0xFF, 0xFF, 0x0F, 0x22, 0x41, 0x75,
+	 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x01, 0x64, 0x01, 0x00, 0x00, 0x64, 0x1B, 0x60, 0xFE, 0xFB,
+	 0x7E, 0x60, 0xC0, 0x64, 0x24, 0x45, 0xA4, 0x80, 0x7F, 0x67, 0x02, 0x61, 0x0E, 0x02, 0x06, 0x61,
+	 0x41, 0x56, 0xC7, 0xFE, 0x2A, 0x60, 0x1D, 0x78, 0xFF, 0xFF, 0x36, 0x47, 0xFF, 0x23, 0x04, 0x00,
+	 0x00, 0x7F, 0x60, 0x41, 0x7F, 0x67, 0x01, 0x00, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x7F, 0x60,
+	 0xC0, 0x64, 0x24, 0x45, 0xA4, 0x80, 0x7F, 0x67, 0x02, 0x61, 0x0E, 0x02, 0x08, 0x61, 0x41, 0x56,
+	 0xC7, 0xFE, 0x2A, 0x60, 0x1D, 0x78, 0xFF, 0xFF, 0x36, 0x47, 0xFF, 0x23, 0x04, 0x00, 0x00, 0x7F,
+	 0x60, 0x41, 0x7F, 0x67, 0x01, 0x00, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x7F, 0x60, 0xC0, 0x64,
+	 0x24, 0x45, 0xA4, 0x80, 0x7F, 0x67, 0x02, 0x61, 0x0E, 0x02, 0x0A, 0x61, 0x41, 0x56, 0xC7, 0xFE,
+	 0x2A, 0x60, 0x1D, 0x78, 0xFF, 0xFF, 0x36, 0x47, 0xFF, 0x23, 0x04, 0x00, 0x00, 0x7F, 0x60, 0x41,
+	 0x7F, 0x67, 0x01, 0x00, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x7E, 0x60, 0xC0, 0x64, 0x24, 0x45,
+	 0xA4, 0x80, 0x7F, 0x67, 0x02, 0x61, 0x11, 0x02, 0x65, 0x43, 0x19, 0x60, 0xA5, 0xFD, 0x0C, 0x61,
+	 0x41, 0x56, 0xC7, 0xFE, 0x2A, 0x60, 0x1D, 0x78, 0xFF, 0xFF, 0x36, 0x47, 0xFF, 0x23, 0x04, 0x00,
+	 0x00, 0x7F, 0x60, 0x41, 0x7F, 0x67, 0x01, 0x00, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x20, 0x64,
+	 0x23, 0xFA, 0x4A, 0x61, 0x10, 0x60, 0xDA, 0x64, 0xA0, 0xD1, 0xA1, 0xD8, 0x58, 0xD1, 0x59, 0xD8,
+	 0x58, 0xD1, 0x59, 0xD8, 0x01, 0xA1, 0x10, 0x60, 0xF2, 0x63, 0x5D, 0x65, 0xA3, 0xD3, 0x02, 0xA3,
+	 0x02, 0x1B, 0x7F, 0x64, 0x01, 0x00, 0xA3, 0xD3, 0x60, 0xFE, 0x5D, 0xDA, 0x20, 0xFE, 0xD5, 0x80,
+	 0x04, 0xA3, 0xF4, 0x02, 0x01, 0xA1, 0x10, 0x60, 0xE0, 0x64, 0xA0, 0xD1, 0xA1, 0xD8, 0x58, 0xD1,
+	 0x59, 0xD8, 0x58, 0xD1, 0x59, 0xD8, 0x01, 0xA1, 0x60, 0xFE, 0x07, 0x63, 0x7F, 0x64, 0xCF, 0x83,
+	 0x5D, 0xDA, 0xFD, 0x02, 0x20, 0xFE, 0x12, 0x60, 0x40, 0x7C, 0x11, 0x60, 0x62, 0x63, 0x7F, 0x65,
+	 0xA3, 0xD3, 0x02, 0xA3, 0x02, 0x1B, 0x7F, 0x64, 0x01, 0x00, 0xA3, 0xD3, 0x60, 0xFE, 0x5D, 0xDA,
+	 0x20, 0xFE, 0xD5, 0x80, 0x06, 0xA3, 0x03, 0x02, 0x46, 0x45, 0x00, 0xF4, 0x03, 0x61, 0xD3, 0x80,
+	 0xFF, 0xFF, 0xEE, 0x04, 0x25, 0x46, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x02, 0x63, 0x7D, 0xF3,
+	 0x23, 0xFC, 0x60, 0x40, 0x01, 0x23, 0x17, 0x00, 0x01, 0x60, 0xFF, 0x65, 0xA4, 0x84, 0x11, 0x60,
+	 0x60, 0x61, 0x12, 0x60, 0x40, 0x65, 0xA1, 0xD1, 0xD5, 0x80, 0xD0, 0x80, 0x0B, 0x03, 0x02, 0x03,
+	 0x08, 0xA1, 0xF9, 0x01, 0x04, 0xA1, 0xA1, 0xD3, 0x01, 0x60, 0x00, 0x65, 0x60, 0x47, 0xFF, 0xB4,
+	 0xB4, 0x84, 0x01, 0x00, 0xFF, 0x64, 0x25, 0xFA, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x0C, 0x63,
+	 0x23, 0xFC, 0xE2, 0xF3, 0x13, 0x60, 0xF2, 0x63, 0xCC, 0x84, 0xFF, 0xFF, 0x02, 0x06, 0x0C, 0xA3,
+	 0xFB, 0x01, 0x48, 0x61, 0x61, 0x44, 0x18, 0xA5, 0x60, 0xFE, 0xBD, 0xD3, 0x20, 0xFE, 0x00, 0x7F,
+	 0x59, 0xDA, 0xD5, 0x80, 0xFF, 0xFF, 0xF8, 0x04, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF, 0x25, 0xF0,
+	 0x17, 0x60, 0x80, 0xF9, 0x11, 0x00, 0x0C, 0x60, 0xFE, 0x62, 0x40, 0x63, 0x5A, 0xDF, 0xFE, 0x1F,
+	 0x04, 0x65, 0x0C, 0x60, 0xFE, 0x61, 0x48, 0x64, 0x3E, 0x63, 0x7C, 0xA8, 0x58, 0xD0, 0x59, 0xD9,
+	 0x02, 0x02, 0x00, 0xF4, 0x02, 0x64, 0xF9, 0x1F, 0x17, 0x60, 0x80, 0xF1, 0x0C, 0x60, 0xDA, 0x65,
+	 0x02, 0xFE, 0x64, 0x44, 0xF8, 0x84, 0xF8, 0x84, 0xF8, 0x87, 0x60, 0x41, 0x64, 0x44, 0xE0, 0x84,
+	 0xE0, 0x84, 0xC4, 0x84, 0x3E, 0xFB, 0x60, 0x42, 0x61, 0x44, 0x03, 0xA2, 0x60, 0xFE, 0xA2, 0xDB,
+	 0x20, 0xFE, 0x64, 0x44, 0x0D, 0x60, 0x00, 0x65, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84,
+	 0xC4, 0x84, 0x40, 0xFB, 0xFF, 0xFF, 0x00, 0x67, 0x00, 0x61, 0x23, 0x58, 0xFF, 0xFF, 0x5C, 0x41,
+	 0x25, 0xF2, 0xFF, 0xFF, 0x40, 0x42, 0x80, 0x2B, 0x04, 0x00, 0xFF, 0xB4, 0x40, 0x42, 0x01, 0x64,
+	 0x40, 0x41, 0xA6, 0xF3, 0x46, 0x4B, 0x60, 0x46, 0x20, 0x63, 0xE3, 0x83, 0xAB, 0x46, 0x26, 0xF0,
+	 0xAB, 0x46, 0x59, 0xF8, 0xAB, 0x46, 0x27, 0xF0, 0xAB, 0x46, 0x5A, 0xF8, 0xAB, 0x46, 0x28, 0xF0,
+	 0xAB, 0x46, 0x5B, 0xF8, 0x66, 0x44, 0x02, 0xA6, 0xF1, 0x1F, 0xA6, 0xF3, 0xFF, 0xFF, 0x60, 0x46,
+	 0xAB, 0x46, 0x0C, 0x60, 0x38, 0x65, 0x22, 0x44, 0xFF, 0xB4, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84,
+	 0xE0, 0x84, 0xC4, 0x81, 0xC9, 0x81, 0x52, 0x64, 0x0E, 0x63, 0x58, 0xD0, 0x59, 0xD9, 0xFD, 0x1F,
+	 0x21, 0x44, 0x01, 0x2A, 0x08, 0x00, 0xAB, 0x46, 0xF0, 0xA1, 0x76, 0x64, 0x0E, 0x63, 0x59, 0xD1,
+	 0x58, 0xD8, 0xFD, 0x1F, 0xAB, 0x46, 0x22, 0x44, 0xFF, 0xB4, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84,
+	 0x0C, 0x60, 0x9A, 0x65, 0xC4, 0x81, 0x60, 0x45, 0xC9, 0x81, 0x62, 0x64, 0x06, 0x63, 0x58, 0xD0,
+	 0x59, 0xD9, 0xFD, 0x1F, 0x21, 0x44, 0x01, 0x2A, 0x08, 0x00, 0xAB, 0x46, 0xF8, 0xA1, 0xB6, 0x64,
+	 0x06, 0x63, 0x59, 0xD1, 0x58, 0xD8, 0xFD, 0x1F, 0xAB, 0x46, 0x65, 0x44, 0x0C, 0x60, 0xBA, 0x65,
+	 0xC4, 0x81, 0xC9, 0x81, 0x6A, 0x64, 0x06, 0x63, 0x58, 0xD0, 0x59, 0xD9, 0xFD, 0x1F, 0x22, 0x44,
+	 0xFF, 0xB4, 0xE0, 0x84, 0xE0, 0x85, 0xC4, 0x84, 0x0C, 0x60, 0x80, 0x65, 0xC4, 0x81, 0x72, 0x64,
+	 0x04, 0x63, 0x58, 0xD0, 0x59, 0xD9, 0xFD, 0x1F, 0xAB, 0x46, 0x21, 0x44, 0x01, 0x2A, 0x06, 0x00,
+	 0xFA, 0xA1, 0x90, 0x64, 0x04, 0x63, 0x59, 0xD1, 0x58, 0xD8, 0xFD, 0x1F, 0x3B, 0xF0, 0x21, 0x44,
+	 0x01, 0x2A, 0x13, 0x00, 0x22, 0x44, 0x3D, 0xFB, 0x60, 0x41, 0x02, 0xFE, 0xF8, 0x84, 0xF8, 0x84,
+	 0xF8, 0x84, 0x3C, 0xFB, 0x0C, 0x60, 0x7C, 0x63, 0x88, 0xFF, 0xCD, 0x81, 0x06, 0xA3, 0xFD, 0x0D,
+	 0x8D, 0xFF, 0x3B, 0xFD, 0x64, 0x47, 0x80, 0xBF, 0x60, 0x5C, 0x22, 0x43, 0x80, 0x61, 0x88, 0xFF,
+	 0xCF, 0x83, 0xE1, 0x81, 0xFD, 0x0D, 0x8D, 0xFF, 0x61, 0x47, 0x31, 0x91, 0xB1, 0x84, 0x3B, 0xFA,
+	 0x1F, 0x63, 0xE3, 0x83, 0x66, 0x44, 0x02, 0xA6, 0x3B, 0xF0, 0x66, 0x44, 0xB1, 0x9C, 0x3B, 0xF8,
+	 0x02, 0xA6, 0xFA, 0x1F, 0xAB, 0x46, 0x00, 0x67, 0x00, 0x61, 0x23, 0x58, 0xFF, 0xFF, 0x23, 0xF2,
+	 0x25, 0xF0, 0x02, 0xA8, 0x00, 0x67, 0x22, 0x02, 0x3D, 0xF1, 0x64, 0x44, 0x03, 0xB4, 0x40, 0x42,
+	 0xD0, 0x80, 0xA6, 0xF3, 0xFF, 0xFF, 0x60, 0x46, 0xBB, 0xF4, 0x80, 0x61, 0x02, 0x02, 0xE3, 0x83,
+	 0xEB, 0x83, 0x22, 0x44, 0x88, 0xFF, 0xCC, 0x84, 0xE1, 0x81, 0xFD, 0x0D, 0x8D, 0xFF, 0x61, 0x47,
+	 0x31, 0x91, 0x9D, 0x85, 0xA7, 0x83, 0x3B, 0xFC, 0x1F, 0x63, 0xE3, 0x83, 0x66, 0x44, 0x02, 0xA6,
+	 0xBB, 0xF2, 0x66, 0x44, 0xA5, 0x81, 0xBB, 0xFA, 0x02, 0xA6, 0xFA, 0x1F, 0x00, 0x67, 0x23, 0x58,
+	 0xFF, 0xFF, 0x27, 0xF2, 0x1D, 0x60, 0xC0, 0x65, 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD3,
+	 0x66, 0x41, 0x60, 0x46, 0x60, 0x43, 0x05, 0xF2, 0x16, 0x18, 0x61, 0x46, 0x27, 0xF0, 0x63, 0x46,
+	 0xD0, 0x80, 0x04, 0xF2, 0x0C, 0x02, 0x61, 0x46, 0x26, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x03, 0xF2,
+	 0x06, 0x02, 0x61, 0x46, 0x25, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0xFF, 0xFF, 0x07, 0x03, 0x80, 0xF4,
+	 0xFF, 0xFF, 0x63, 0x46, 0xE8, 0x1B, 0xA6, 0xF3, 0x08, 0xFE, 0x60, 0x43, 0x61, 0x46, 0x01, 0x03,
+	 0x2A, 0x00, 0x43, 0x4B, 0xAB, 0x46, 0x3B, 0xF2, 0x80, 0x60, 0x30, 0x7C, 0xB0, 0x84, 0xA2, 0xDA,
+	 0x4E, 0x61, 0x76, 0x64, 0x0E, 0x63, 0xAB, 0x46, 0x59, 0xD0, 0xAB, 0x46, 0x58, 0xD8, 0xFB, 0x1F,
+	 0x90, 0x64, 0x04, 0x63, 0xAB, 0x46, 0x59, 0xD0, 0xAB, 0x46, 0x58, 0xD8, 0xFB, 0x1F, 0xD9, 0x81,
+	 0xA0, 0x64, 0x04, 0x63, 0xAB, 0x46, 0x59, 0xD0, 0xAB, 0x46, 0x58, 0xD8, 0xFB, 0x1F, 0xD9, 0x81,
+	 0xB6, 0x64, 0x0E, 0x63, 0xAB, 0x46, 0x59, 0xD0, 0xAB, 0x46, 0x58, 0xD8, 0xFB, 0x1F, 0x00, 0x67,
+	 0x00, 0x61, 0x23, 0x58, 0xFF, 0xFF, 0x01, 0x67, 0x20, 0x61, 0x23, 0x58, 0xFF, 0xFF, 0x27, 0xF2,
+	 0x1D, 0x60, 0xC0, 0x65, 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD3, 0x66, 0x41, 0x60, 0x46,
+	 0x60, 0x43, 0x05, 0xF2, 0x16, 0x18, 0x61, 0x46, 0x27, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x04, 0xF2,
+	 0x0C, 0x02, 0x61, 0x46, 0x26, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x03, 0xF2, 0x06, 0x02, 0x61, 0x46,
+	 0x25, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0xFF, 0xFF, 0x07, 0x03, 0x80, 0xF4, 0xFF, 0xFF, 0x63, 0x46,
+	 0xE8, 0x1B, 0xA6, 0xF3, 0x08, 0xFE, 0x60, 0x43, 0x61, 0x46, 0x01, 0x03, 0x0D, 0x00, 0x43, 0x4B,
+	 0xAB, 0x46, 0x3B, 0xF2, 0x80, 0x60, 0x30, 0x61, 0x9D, 0x85, 0xA4, 0x84, 0xA2, 0xDA, 0xAB, 0x46,
+	 0x00, 0x67, 0x00, 0x61, 0x23, 0x58, 0xFF, 0xFF, 0x01, 0x67, 0x20, 0x61, 0x23, 0x58, 0xFF, 0xFF,
+	 0x00, 0x64, 0x40, 0x41, 0x4A, 0x64, 0xA0, 0xD2, 0xFF, 0xFF, 0x40, 0x42, 0x80, 0x2B, 0x04, 0x00,
+	 0xFF, 0xB4, 0x40, 0x42, 0x01, 0x64, 0x40, 0x41, 0xA6, 0xF3, 0x46, 0x4B, 0x60, 0x46, 0x20, 0x63,
+	 0xE3, 0x83, 0xAB, 0x46, 0x32, 0xF0, 0xAB, 0x46, 0x59, 0xF8, 0xAB, 0x46, 0x33, 0xF0, 0xAB, 0x46,
+	 0x5A, 0xF8, 0xAB, 0x46, 0x34, 0xF0, 0xAB, 0x46, 0x5B, 0xF8, 0x66, 0x44, 0x02, 0xA6, 0xF1, 0x1F,
+	 0xA6, 0xF3, 0xFF, 0xFF, 0x60, 0x46, 0xAB, 0x46, 0x0C, 0x60, 0x38, 0x65, 0x22, 0x44, 0xFF, 0xB4,
+	 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xC4, 0x81, 0xC9, 0x81, 0x4A, 0x64, 0x0E, 0x63,
+	 0x58, 0xD0, 0x59, 0xD9, 0xFD, 0x1F, 0x21, 0x44, 0x01, 0x2A, 0x08, 0x00, 0xAB, 0x46, 0xF0, 0xA1,
+	 0x76, 0x64, 0x0E, 0x63, 0x59, 0xD1, 0x58, 0xD8, 0xFD, 0x1F, 0xAB, 0x46, 0x22, 0x44, 0xFF, 0xB4,
+	 0xE0, 0x84, 0xE0, 0x85, 0xC4, 0x84, 0x0C, 0x60, 0x80, 0x65, 0xC4, 0x81, 0x5A, 0x64, 0x04, 0x63,
+	 0x58, 0xD0, 0x59, 0xD9, 0xFD, 0x1F, 0xAB, 0x46, 0x21, 0x44, 0x01, 0x2A, 0x06, 0x00, 0xFA, 0xA1,
+	 0x90, 0x64, 0x04, 0x63, 0x59, 0xD1, 0x58, 0xD8, 0xFD, 0x1F, 0x3B, 0xF0, 0x21, 0x44, 0x01, 0x2A,
+	 0x13, 0x00, 0x22, 0x44, 0x3D, 0xFB, 0x60, 0x41, 0x02, 0xFE, 0xF8, 0x84, 0xF8, 0x84, 0xF8, 0x84,
+	 0x3C, 0xFB, 0x0C, 0x60, 0x7C, 0x63, 0x88, 0xFF, 0xCD, 0x81, 0x06, 0xA3, 0xFD, 0x0D, 0x8D, 0xFF,
+	 0x3B, 0xFD, 0x64, 0x47, 0x80, 0xBF, 0x60, 0x5C, 0x22, 0x43, 0x80, 0x61, 0x88, 0xFF, 0xCF, 0x83,
+	 0xE1, 0x81, 0xFD, 0x0D, 0x8D, 0xFF, 0x61, 0x47, 0x31, 0x91, 0xB1, 0x84, 0x3B, 0xFA, 0x1F, 0x63,
+	 0xE3, 0x83, 0x66, 0x44, 0x02, 0xA6, 0x3B, 0xF0, 0x66, 0x44, 0xB1, 0x9C, 0x3B, 0xF8, 0x02, 0xA6,
+	 0xFA, 0x1F, 0xAB, 0x46, 0x00, 0x67, 0x00, 0x61, 0x23, 0x58, 0xFF, 0xFF, 0x23, 0xF2, 0x25, 0xF0,
+	 0x02, 0xA8, 0x00, 0x67, 0x22, 0x02, 0x3D, 0xF1, 0x64, 0x44, 0x03, 0xB4, 0x40, 0x42, 0xD0, 0x80,
+	 0xA6, 0xF3, 0xFF, 0xFF, 0x60, 0x46, 0xBB, 0xF4, 0x80, 0x61, 0x02, 0x02, 0xE3, 0x83, 0xEB, 0x83,
+	 0x22, 0x44, 0x88, 0xFF, 0xCC, 0x84, 0xE1, 0x81, 0xFD, 0x0D, 0x8D, 0xFF, 0x61, 0x47, 0x31, 0x91,
+	 0x9D, 0x85, 0xA7, 0x83, 0x3B, 0xFC, 0x1F, 0x63, 0xE3, 0x83, 0x66, 0x44, 0x02, 0xA6, 0xBB, 0xF2,
+	 0x66, 0x44, 0xA5, 0x81, 0xBB, 0xFA, 0x02, 0xA6, 0xFA, 0x1F, 0x00, 0x67, 0x23, 0x58, 0xFF, 0xFF,
+	 0x27, 0xF2, 0x1D, 0x60, 0xC0, 0x65, 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD3, 0x66, 0x41,
+	 0x60, 0x46, 0x60, 0x43, 0x05, 0xF2, 0x16, 0x18, 0x61, 0x46, 0x27, 0xF0, 0x63, 0x46, 0xD0, 0x80,
+	 0x04, 0xF2, 0x0C, 0x02, 0x61, 0x46, 0x26, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x03, 0xF2, 0x06, 0x02,
+	 0x61, 0x46, 0x25, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0xFF, 0xFF, 0x07, 0x03, 0x80, 0xF4, 0xFF, 0xFF,
+	 0x63, 0x46, 0xE8, 0x1B, 0xA6, 0xF3, 0x08, 0xFE, 0x60, 0x43, 0x61, 0x46, 0x01, 0x03, 0x21, 0x00,
+	 0x43, 0x4B, 0xAB, 0x46, 0x3B, 0xF2, 0x80, 0x60, 0x30, 0x7C, 0xB0, 0x84, 0xA2, 0xDA, 0x4E, 0x61,
+	 0x76, 0x64, 0x0E, 0x63, 0xAB, 0x46, 0x59, 0xD0, 0xAB, 0x46, 0x58, 0xD8, 0xFB, 0x1F, 0x90, 0x64,
+	 0x04, 0x63, 0xAB, 0x46, 0x59, 0xD0, 0xAB, 0x46, 0x58, 0xD8, 0xFB, 0x1F, 0xA0, 0x64, 0x04, 0x63,
+	 0xAB, 0x46, 0x59, 0xD0, 0xAB, 0x46, 0x58, 0xD8, 0xFB, 0x1F, 0x00, 0x67, 0x00, 0x61, 0x23, 0x58,
+	 0xFF, 0xFF, 0x01, 0x67, 0x20, 0x61, 0x23, 0x58, 0xFF, 0xFF, 0x27, 0xF2, 0x1D, 0x60, 0xC0, 0x65,
+	 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD3, 0x66, 0x41, 0x60, 0x46, 0x60, 0x43, 0x05, 0xF2,
+	 0x16, 0x18, 0x61, 0x46, 0x27, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x04, 0xF2, 0x0C, 0x02, 0x61, 0x46,
+	 0x26, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x03, 0xF2, 0x06, 0x02, 0x61, 0x46, 0x25, 0xF0, 0x63, 0x46,
+	 0xD0, 0x80, 0xFF, 0xFF, 0x07, 0x03, 0x80, 0xF4, 0xFF, 0xFF, 0x63, 0x46, 0xE8, 0x1B, 0xA6, 0xF3,
+	 0x08, 0xFE, 0x60, 0x43, 0x61, 0x46, 0x01, 0x03, 0x0D, 0x00, 0x43, 0x4B, 0xAB, 0x46, 0x3B, 0xF2,
+	 0x80, 0x60, 0x30, 0x61, 0x9D, 0x85, 0xA4, 0x84, 0xA2, 0xDA, 0xAB, 0x46, 0x00, 0x67, 0x00, 0x61,
+	 0x23, 0x58, 0xFF, 0xFF, 0x01, 0x67, 0x20, 0x61, 0x23, 0x58, 0xFF, 0xFF, 0xA2, 0xFF, 0x46, 0x45,
+	 0x02, 0xF0, 0x09, 0x60, 0x08, 0x64, 0xD0, 0x80, 0x00, 0xF4, 0x01, 0xF2, 0x66, 0x5C, 0x25, 0x46,
+	 0x56, 0x02, 0x70, 0x27, 0x54, 0x00, 0x12, 0x64, 0x03, 0xFA, 0x04, 0xF8, 0x0E, 0xF2, 0x87, 0xFC,
+	 0x8D, 0xFC, 0x8E, 0xFC, 0xDA, 0x82, 0x16, 0x61, 0x00, 0x63, 0xC9, 0x81, 0x5A, 0xDC, 0xFD, 0x02,
+	 0x60, 0x40, 0xF0, 0x3B, 0x16, 0x00, 0x32, 0x44, 0xAC, 0xF3, 0x01, 0xB0, 0xFA, 0xA0, 0x08, 0x24,
+	 0x2C, 0x05, 0xDC, 0x83, 0xF0, 0x67, 0x0E, 0xFA, 0x26, 0x60, 0x04, 0x64, 0x2B, 0xDB, 0x66, 0x44,
+	 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xAC, 0xFD, 0x2B, 0xFF, 0xFE, 0x64, 0x3B, 0x42, 0x4A, 0xDB,
+	 0x4F, 0x00, 0xAD, 0xF3, 0x05, 0x65, 0xD4, 0x80, 0xDC, 0x83, 0x17, 0x05, 0xAD, 0xFD, 0x98, 0xFE,
+	 0x04, 0x04, 0x00, 0x7F, 0x08, 0x7E, 0x0E, 0xFA, 0x3B, 0xFF, 0x25, 0x60, 0xF8, 0x64, 0x2B, 0xDB,
+	 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0x0E, 0xF2, 0x2B, 0xFF, 0x60, 0x40, 0x08, 0x26,
+	 0xF7, 0xFE, 0xFD, 0x64, 0x3B, 0x42, 0x4A, 0xDB, 0x32, 0x00, 0xA9, 0xF3, 0xFF, 0xFF, 0xD8, 0xA0,
+	 0xFF, 0xFF, 0x0D, 0x04, 0x26, 0x60, 0x10, 0x64, 0x2B, 0xDB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64,
+	 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xFC, 0x64, 0x3B, 0x42, 0x4A, 0xDB, 0x21, 0x00, 0x46, 0x45,
+	 0x00, 0x64, 0x2B, 0xDB, 0x25, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF,
+	 0xA2, 0xFF, 0x00, 0xF4, 0x01, 0xF0, 0x0A, 0x18, 0x70, 0x67, 0xA0, 0x80, 0xF0, 0x67, 0x06, 0x03,
+	 0xC0, 0x84, 0x01, 0xFA, 0x25, 0x46, 0x25, 0x44, 0x80, 0xFC, 0x05, 0xFA, 0xB6, 0x60, 0x58, 0x4E,
+	 0xF5, 0x78, 0xFF, 0xFF, 0xD4, 0xFE, 0xA3, 0xFF, 0xFF, 0x64, 0x3B, 0x42, 0x4A, 0xDB, 0xD4, 0xFE,
+	 0xA3, 0xFF, 0x2D, 0x58, 0xFF, 0xFF, 0x25, 0x60, 0xFE, 0x64, 0x40, 0x47, 0x58, 0x4F, 0x0D, 0x00,
+	 0x25, 0x60, 0xF2, 0x64, 0x40, 0x47, 0x58, 0x4F, 0x18, 0x00, 0x26, 0x60, 0x0A, 0x64, 0x40, 0x47,
+	 0x58, 0x4F, 0x03, 0x00, 0x2A, 0x60, 0x1D, 0x78, 0xFF, 0xFF, 0x27, 0xD5, 0x0E, 0xF2, 0x0B, 0x18,
+	 0x60, 0x40, 0x01, 0x2A, 0x08, 0x00, 0x26, 0x60, 0x20, 0x64, 0x40, 0x4B, 0x34, 0x60, 0x58, 0x4D,
+	 0x08, 0x78, 0xFF, 0xFF, 0xF2, 0x01, 0x2F, 0x58, 0xFF, 0xFF, 0x27, 0xD5, 0x0E, 0xF2, 0x14, 0x18,
+	 0x60, 0x40, 0x01, 0x2A, 0x11, 0x00, 0x02, 0xF0, 0x09, 0x60, 0x08, 0x64, 0xD0, 0x80, 0xA2, 0xFF,
+	 0xAD, 0xF3, 0x02, 0x02, 0xCC, 0x84, 0xAD, 0xFB, 0x26, 0x60, 0x20, 0x64, 0x40, 0x4B, 0x34, 0x60,
+	 0x58, 0x4D, 0x08, 0x78, 0xFF, 0xFF, 0xE9, 0x01, 0x2F, 0x58, 0xFF, 0xFF, 0xFB, 0x64, 0x3A, 0x42,
+	 0x4A, 0xDB, 0xA2, 0xFF, 0xB0, 0xF3, 0xAC, 0xF3, 0xCC, 0x80, 0xFD, 0xA0, 0x01, 0x14, 0x1D, 0x05,
+	 0xB5, 0x60, 0x58, 0x4D, 0xFA, 0x78, 0xFF, 0xFF, 0xA2, 0xFF, 0x17, 0x03, 0xF0, 0x67, 0x0E, 0xFA,
+	 0x26, 0x60, 0x04, 0x64, 0x13, 0x60, 0x10, 0xFB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB,
+	 0xFF, 0xFF, 0x2B, 0xFF, 0xF6, 0x64, 0x3A, 0x42, 0x4A, 0xDB, 0xB0, 0xF3, 0xAC, 0xF3, 0xCC, 0x83,
+	 0xDC, 0x84, 0x01, 0x15, 0xB0, 0xFD, 0xAC, 0xFB, 0xD4, 0xFE, 0xAF, 0xF3, 0xAD, 0xF3, 0x00, 0xA8,
+	 0xAE, 0xF1, 0x03, 0x02, 0xD0, 0x80, 0xFF, 0xFF, 0x26, 0x05, 0xB5, 0x60, 0x58, 0x4D, 0xFA, 0x78,
+	 0xFF, 0xFF, 0xA2, 0xFF, 0x20, 0x03, 0x00, 0x63, 0xAF, 0xF3, 0x0E, 0xFC, 0xCC, 0x84, 0xFF, 0x3A,
+	 0xAF, 0xFB, 0x98, 0xFE, 0x03, 0x04, 0x08, 0xBB, 0x0E, 0xFC, 0x3B, 0xFF, 0x25, 0x60, 0xF8, 0x64,
+	 0x13, 0x60, 0x10, 0xFB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF,
+	 0xF7, 0x64, 0x3A, 0x42, 0x4A, 0xDB, 0xAD, 0xF3, 0x0E, 0xF2, 0xDC, 0x83, 0x08, 0xB0, 0xAD, 0xFD,
+	 0x08, 0x28, 0xF7, 0xFE, 0xD4, 0xFE, 0xA3, 0xFF, 0x2A, 0x60, 0x1D, 0x78, 0xFF, 0xFF, 0xB9, 0xFE,
+	 0x13, 0xFF, 0x24, 0x40, 0x80, 0x2B, 0x0B, 0x00, 0xA2, 0xFF, 0x25, 0x46, 0x09, 0xF4, 0x0E, 0xF2,
+	 0x05, 0x18, 0x08, 0xBC, 0x0E, 0xFA, 0xFF, 0xFF, 0xF7, 0xFE, 0x01, 0x00, 0xD8, 0xFE, 0xA3, 0xFF,
+	 0x25, 0x46, 0x3E, 0xF2, 0x00, 0xF4, 0x08, 0xF0, 0x25, 0x46, 0x06, 0xB4, 0xFF, 0x7F, 0x10, 0xBC,
+	 0x06, 0x26, 0xFD, 0x7F, 0x0E, 0xFA, 0x3E, 0xF2, 0x3F, 0xF2, 0x60, 0x41, 0x08, 0x2A, 0x64, 0x47,
+	 0x3F, 0xFA, 0x60, 0x45, 0xB9, 0xFC, 0x16, 0x60, 0xAA, 0xF3, 0xA3, 0xFC, 0xAB, 0xFC, 0x91, 0xFC,
+	 0xD4, 0x80, 0x18, 0x60, 0x21, 0x65, 0xA5, 0x80, 0x01, 0x04, 0x07, 0x03, 0x23, 0xF0, 0x08, 0x64,
+	 0xB0, 0x84, 0xA2, 0xDA, 0x35, 0x60, 0xEA, 0x78, 0xFF, 0xFF, 0x36, 0x60, 0x58, 0x4F, 0x30, 0x78,
+	 0xFF, 0xFF, 0x0B, 0x04, 0x23, 0xF0, 0x04, 0x64, 0xB0, 0x84, 0xA2, 0xDA, 0x2C, 0x60, 0xEE, 0x64,
+	 0xF1, 0x60, 0x78, 0x41, 0xE4, 0x78, 0xB5, 0xF1, 0x83, 0x00, 0xDB, 0xF3, 0xA6, 0xF1, 0x07, 0xB4,
+	 0x64, 0x43, 0xFD, 0xA0, 0x2C, 0xF2, 0x71, 0x02, 0x01, 0xB0, 0x64, 0x43, 0x78, 0x02, 0x2E, 0xF2,
+	 0x1D, 0x60, 0xC0, 0x65, 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD3, 0x66, 0x41, 0x60, 0x46,
+	 0x60, 0x43, 0x05, 0xF2, 0x16, 0x18, 0x61, 0x46, 0x2E, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x04, 0xF2,
+	 0x0C, 0x02, 0x61, 0x46, 0x2D, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x03, 0xF2, 0x06, 0x02, 0x61, 0x46,
+	 0x2C, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0xFF, 0xFF, 0x07, 0x03, 0x80, 0xF4, 0xFF, 0xFF, 0x63, 0x46,
+	 0xE8, 0x1B, 0xA6, 0xF3, 0x08, 0xFE, 0x60, 0x43, 0x61, 0x46, 0x51, 0x03, 0x63, 0x46, 0x80, 0xF6,
+	 0x25, 0x46, 0x43, 0x18, 0x2E, 0xF2, 0x66, 0x41, 0x1D, 0x60, 0xC0, 0x65, 0x60, 0x47, 0x00, 0x7F,
+	 0xA6, 0xF1, 0xE0, 0x84, 0x44, 0xD3, 0x64, 0x43, 0x11, 0x18, 0x60, 0x46, 0x00, 0xF2, 0xFF, 0xFF,
+	 0xFC, 0x1B, 0x66, 0x44, 0x64, 0x46, 0x80, 0xF0, 0x60, 0x46, 0x80, 0xF8, 0x65, 0x46, 0x65, 0x43,
+	 0x80, 0xF0, 0x01, 0xFA, 0x80, 0xFC, 0x64, 0x46, 0x80, 0xF8, 0x0B, 0x00, 0x64, 0x46, 0x62, 0x43,
+	 0x00, 0xF2, 0xA3, 0xDB, 0x60, 0x46, 0x80, 0xF0, 0x81, 0xFC, 0x80, 0xFC, 0x64, 0x46, 0x80, 0xF8,
+	 0x60, 0x43, 0x61, 0x46, 0x43, 0x4B, 0x2C, 0xF0, 0xAD, 0xF0, 0x2E, 0xF2, 0xAB, 0x46, 0x03, 0xF8,
+	 0x84, 0xF8, 0x05, 0xFA, 0x03, 0x64, 0x06, 0xFA, 0xAB, 0x46, 0x1F, 0x60, 0xC2, 0x61, 0xA1, 0xD3,
+	 0x20, 0x60, 0x04, 0x7C, 0xD0, 0x80, 0xFF, 0xFF, 0x07, 0x03, 0xA0, 0xDD, 0xDA, 0x9C, 0xA1, 0xD9,
+	 0x49, 0xD3, 0xFF, 0xFF, 0xDC, 0x84, 0xA1, 0xDB, 0x0A, 0x00, 0xDB, 0xF3, 0x02, 0xA3, 0xFE, 0xA0,
+	 0xF9, 0xA0, 0x01, 0x06, 0x04, 0x02, 0x23, 0xF0, 0x04, 0x64, 0xB0, 0x84, 0xA2, 0xDA, 0x07, 0xFC,
+	 0x23, 0xF2, 0xFF, 0xFF, 0x24, 0x1B, 0x16, 0x60, 0xAB, 0xF3, 0xFF, 0xFF, 0x60, 0x40, 0x00, 0x3A,
+	 0x0F, 0x00, 0x25, 0x60, 0xC8, 0x64, 0x13, 0x60, 0x10, 0xFB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64,
+	 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0x0E, 0xF2, 0xC1, 0xFE, 0x10, 0xAC, 0x0E, 0xFA, 0x1D, 0x00,
+	 0x25, 0x60, 0xDA, 0x64, 0x13, 0x60, 0x10, 0xFB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB,
+	 0xFF, 0xFF, 0x2B, 0xFF, 0x0E, 0xF2, 0xC8, 0xFE, 0x10, 0xAC, 0x0E, 0xFA, 0x0E, 0x00, 0x25, 0x60,
+	 0xEC, 0x64, 0x13, 0x60, 0x10, 0xFB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF,
+	 0x2B, 0xFF, 0x0E, 0xF2, 0xCE, 0xFE, 0x10, 0xAC, 0x0E, 0xFA, 0x2A, 0x60, 0x1D, 0x78, 0xFF, 0xFF,
+	 0xCB, 0x84, 0xC9, 0x83, 0xFF, 0xFF, 0x08, 0x04, 0x58, 0xD1, 0xA5, 0xD8, 0xDA, 0x85, 0x80, 0x3A,
+	 0x02, 0x00, 0x00, 0xF4, 0x04, 0x65, 0xF8, 0x1F, 0x2F, 0x58, 0xFF, 0xFF, 0x3E, 0xF2, 0xC9, 0xF1,
+	 0x08, 0xB0, 0x19, 0xF8, 0x57, 0x02, 0xEA, 0xF1, 0x2F, 0xF8, 0xEB, 0xF3, 0x30, 0xFA, 0x60, 0x45,
+	 0xEC, 0xF3, 0x31, 0xFA, 0x46, 0x4A, 0x00, 0xF4, 0x60, 0x43, 0x05, 0xF2, 0x06, 0xF2, 0xD0, 0x80,
+	 0x07, 0xF0, 0x05, 0x02, 0xD4, 0x80, 0xD3, 0x80, 0x02, 0x02, 0xDB, 0xF3, 0x03, 0x03, 0xAA, 0x46,
+	 0x42, 0xFE, 0x41, 0x00, 0x60, 0x40, 0x03, 0x2A, 0x20, 0x00, 0x02, 0xF2, 0x03, 0xF0, 0x04, 0xF2,
+	 0x60, 0x43, 0xAA, 0x46, 0x2C, 0xFC, 0x2D, 0xF8, 0x2E, 0xFA, 0x7F, 0xF1, 0x32, 0xF8, 0x80, 0xF1,
+	 0x33, 0xF8, 0x81, 0xF1, 0x34, 0xF8, 0x08, 0x64, 0x32, 0x40, 0x04, 0x2A, 0x0D, 0x00, 0x2C, 0xF0,
+	 0x39, 0xF0, 0x64, 0x40, 0x01, 0x26, 0x08, 0x00, 0x3E, 0xF2, 0xFF, 0xFF, 0x00, 0x60, 0xC0, 0xB4,
+	 0xE8, 0x84, 0xB0, 0x9C, 0x39, 0xF8, 0x88, 0x64, 0x1C, 0x00, 0x02, 0xF2, 0x03, 0xF0, 0x04, 0xF2,
+	 0x60, 0x43, 0xAA, 0x46, 0x32, 0xFC, 0x33, 0xF8, 0x34, 0xFA, 0x7F, 0xF1, 0x2C, 0xF8, 0x80, 0xF1,
+	 0x2D, 0xF8, 0x81, 0xF1, 0x2E, 0xF8, 0x01, 0x60, 0x08, 0x64, 0x32, 0x40, 0x04, 0x2A, 0x09, 0x00,
+	 0x3E, 0xF2, 0x39, 0xF0, 0x00, 0x60, 0xC0, 0xB4, 0xE8, 0x84, 0xB0, 0x9C, 0x39, 0xF8, 0x01, 0x60,
+	 0x88, 0x64, 0x2A, 0xFA, 0x02, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x36, 0x60, 0x22, 0x63, 0x20, 0x44,
+	 0xBD, 0xDB, 0x21, 0x44, 0xBD, 0xDB, 0x22, 0x44, 0xBD, 0xDB, 0x23, 0x44, 0xBD, 0xDB, 0x24, 0x44,
+	 0xBD, 0xDB, 0x25, 0x44, 0xBD, 0xDB, 0x26, 0x44, 0xBD, 0xDB, 0x27, 0x44, 0xBD, 0xDB, 0x28, 0x44,
+	 0xBD, 0xDB, 0x29, 0x44, 0xBD, 0xDB, 0x2A, 0x44, 0xBD, 0xDB, 0x2B, 0x44, 0xBD, 0xDB, 0x2C, 0x44,
+	 0xBD, 0xDB, 0x2D, 0x44, 0xBD, 0xDB, 0x2E, 0x44, 0xBD, 0xDB, 0x2F, 0x44, 0xBD, 0xDB, 0x1B, 0x60,
+	 0x0B, 0xFD, 0x37, 0x60, 0x42, 0x63, 0x1B, 0x60, 0x0C, 0xFD, 0x30, 0x44, 0x1B, 0x60, 0x0D, 0xFB,
+	 0x31, 0x44, 0x1B, 0x60, 0x0E, 0xFB, 0x32, 0x44, 0x1B, 0x60, 0x0F, 0xFB, 0x33, 0x44, 0x1B, 0x60,
+	 0x10, 0xFB, 0x81, 0xFF, 0x91, 0xFF, 0x58, 0x51, 0x44, 0x00, 0x82, 0xFF, 0x92, 0xFF, 0x58, 0x51,
+	 0x40, 0x00, 0x83, 0xFF, 0x93, 0xFF, 0x58, 0x51, 0x3C, 0x00, 0x84, 0xFF, 0x94, 0xFF, 0x58, 0x51,
+	 0x38, 0x00, 0x85, 0xFF, 0x95, 0xFF, 0x58, 0x51, 0x34, 0x00, 0x86, 0xFF, 0x96, 0xFF, 0x58, 0x51,
+	 0x30, 0x00, 0x87, 0xFF, 0x97, 0xFF, 0x58, 0x51, 0x2C, 0x00, 0x80, 0xFF, 0x90, 0xFF, 0x99, 0xFF,
+	 0x1B, 0x60, 0x0B, 0xF1, 0x30, 0x44, 0x64, 0x43, 0xBD, 0xDB, 0x31, 0x44, 0xBD, 0xDB, 0x32, 0x44,
+	 0xBD, 0xDB, 0x33, 0x44, 0xBD, 0xDB, 0x34, 0x44, 0xBD, 0xDB, 0x35, 0x44, 0xBD, 0xDB, 0x36, 0x44,
+	 0xBD, 0xDB, 0x37, 0x44, 0xBD, 0xDB, 0x38, 0x44, 0xBD, 0xDB, 0x39, 0x44, 0xBD, 0xDB, 0x3A, 0x44,
+	 0xBD, 0xDB, 0x3B, 0x44, 0xBD, 0xDB, 0x3C, 0x44, 0xBD, 0xDB, 0x3D, 0x44, 0xBD, 0xDB, 0x3E, 0x44,
+	 0xBD, 0xDB, 0x3F, 0x44, 0xBD, 0xDB, 0xF6, 0x60, 0x16, 0x64, 0x0A, 0xFB, 0x40, 0x21, 0xFE, 0x01,
+	 0x74, 0x00, 0x42, 0x50, 0x40, 0x53, 0x1B, 0x60, 0x0C, 0xF3, 0xFF, 0xFF, 0x40, 0x52, 0x33, 0x44,
+	 0x32, 0x42, 0xA2, 0xDB, 0xDA, 0x82, 0xA2, 0xDD, 0xDA, 0x83, 0x65, 0x44, 0xBD, 0xDB, 0x61, 0x44,
+	 0xBD, 0xDB, 0x66, 0x44, 0xBD, 0xDB, 0xBD, 0xD9, 0x30, 0x44, 0xBD, 0xDB, 0x99, 0xFF, 0xA4, 0x4C,
+	 0xBD, 0xDB, 0xA5, 0x4C, 0xBD, 0xDB, 0xA0, 0x4C, 0xBD, 0xDB, 0xA1, 0x4C, 0xBD, 0xDB, 0x98, 0xFF,
+	 0x1B, 0x60, 0x0C, 0xFD, 0x1B, 0x60, 0x0D, 0xF3, 0xFF, 0xFF, 0x40, 0x50, 0x1B, 0x60, 0x0F, 0xF3,
+	 0xFF, 0xFF, 0x40, 0x52, 0x1B, 0x60, 0x10, 0xF3, 0xFF, 0xFF, 0x40, 0x53, 0x31, 0x41, 0x1B, 0x60,
+	 0x0E, 0xF3, 0xFF, 0xFF, 0x40, 0x51, 0x1B, 0x60, 0x0B, 0xF3, 0xFF, 0xFF, 0x60, 0x43, 0x20, 0x44,
+	 0xBD, 0xDB, 0x21, 0x44, 0xBD, 0xDB, 0x22, 0x44, 0xBD, 0xDB, 0x23, 0x44, 0xBD, 0xDB, 0x24, 0x44,
+	 0xBD, 0xDB, 0x25, 0x44, 0xBD, 0xDB, 0x26, 0x44, 0xBD, 0xDB, 0x27, 0x44, 0xBD, 0xDB, 0x28, 0x44,
+	 0xBD, 0xDB, 0x29, 0x44, 0xBD, 0xDB, 0x2A, 0x44, 0xBD, 0xDB, 0x2B, 0x44, 0xBD, 0xDB, 0x2C, 0x44,
+	 0xBD, 0xDB, 0x2D, 0x44, 0xBD, 0xDB, 0x2E, 0x44, 0xBD, 0xDB, 0x2F, 0x44, 0xBD, 0xDB, 0x1B, 0x60,
+	 0x0B, 0xFD, 0x61, 0x58, 0xFF, 0xFF, 0x2F, 0x60, 0x4E, 0x63, 0xA3, 0xD3, 0x33, 0x5C, 0x02, 0xA4,
+	 0xBD, 0xDB, 0xFE, 0xB4, 0xE0, 0x85, 0xC4, 0x85, 0x47, 0xD9, 0x34, 0x44, 0x5B, 0xDB, 0x44, 0xF3,
+	 0x5B, 0xDB, 0xA1, 0xFF, 0xFF, 0xFF, 0x87, 0x3E, 0x84, 0xE1, 0xA1, 0xFF, 0xFF, 0xFF, 0x87, 0x3E,
+	 0xFF, 0x01, 0x86, 0xE1, 0x80, 0xFF, 0x90, 0xFF, 0x88, 0xFF, 0xA1, 0xFF, 0xFF, 0xFF, 0x87, 0x3E,
+	 0x19, 0x60, 0xF7, 0xF3, 0xFF, 0xFF, 0x10, 0x1B, 0x32, 0x40, 0x80, 0x2A, 0xF6, 0x01, 0x9D, 0xFE,
+	 0xF4, 0x05, 0xDB, 0xF3, 0xFF, 0xFF, 0x04, 0xA8, 0x33, 0x60, 0xE2, 0x62, 0x01, 0x02, 0xBD, 0x00,
+	 0xA2, 0xD3, 0xFF, 0xFF, 0x4A, 0x1B, 0xE9, 0x01, 0x87, 0xFF, 0x20, 0x44, 0x80, 0xFF, 0x60, 0x40,
+	 0x80, 0x26, 0xE3, 0x01, 0xF1, 0xFC, 0xAD, 0x4F, 0xFD, 0xB4, 0xA0, 0x5D, 0xC0, 0x60, 0x40, 0xEC,
+	 0xC0, 0x60, 0x00, 0xED, 0xC0, 0x60, 0x80, 0xEE, 0xAC, 0x4F, 0xBF, 0xB4, 0xA0, 0x5C, 0x19, 0x60,
+	 0x48, 0xF1, 0xFF, 0xFF, 0x64, 0x40, 0x02, 0x27, 0x06, 0x00, 0x28, 0xE2, 0x24, 0xE2, 0x40, 0x21,
+	 0xFE, 0x01, 0x75, 0x40, 0x0D, 0x00, 0x28, 0xE2, 0x24, 0xE2, 0x75, 0x40, 0x80, 0x2B, 0xAB, 0xFF,
+	 0x14, 0xE0, 0x94, 0xE0, 0x40, 0x21, 0xFE, 0x01, 0x10, 0xE0, 0x75, 0x40, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x33, 0x60, 0xEE, 0x62, 0xA2, 0xDF, 0x01, 0x60, 0x39, 0xE2, 0x04, 0x60, 0x00, 0x7A, 0xAC, 0x4F,
+	 0x40, 0xBC, 0x00, 0x7F, 0xA0, 0x5C, 0xC0, 0x60, 0x59, 0xEC, 0xC0, 0x60, 0x07, 0xED, 0xC0, 0x60,
+	 0x8F, 0xEE, 0xAE, 0x4F, 0x04, 0xBC, 0x00, 0x7F, 0xA0, 0x5E, 0x26, 0x61, 0xCD, 0x81, 0xFF, 0xFF,
+	 0xFD, 0x02, 0xAE, 0x4F, 0xFB, 0xB4, 0xA0, 0x5E, 0xA0, 0x01, 0xF1, 0xFC, 0xAD, 0x4F, 0xFD, 0xB4,
+	 0xA0, 0x5D, 0x15, 0x60, 0x80, 0xE7, 0xC0, 0x60, 0x40, 0xEC, 0xC0, 0x60, 0x00, 0xED, 0xAC, 0x4F,
+	 0xBF, 0xB4, 0xA0, 0x5C, 0xC0, 0x60, 0x84, 0xEE, 0xAE, 0x4F, 0x04, 0xBC, 0x00, 0x7F, 0xA0, 0x5E,
+	 0x00, 0x7A, 0x0F, 0x60, 0x19, 0xE2, 0x0E, 0x60, 0x36, 0xF3, 0xFF, 0xFF, 0x60, 0x41, 0x75, 0x44,
+	 0x80, 0x2B, 0xAB, 0xFF, 0x80, 0x27, 0x08, 0x00, 0x14, 0xE0, 0x94, 0xE0, 0x34, 0xE2, 0x61, 0x5A,
+	 0x48, 0x21, 0xFE, 0x01, 0x00, 0xE0, 0x75, 0x40, 0x0A, 0x60, 0x19, 0xE2, 0x00, 0x64, 0x19, 0x60,
+	 0xF1, 0xFB, 0x08, 0x60, 0x15, 0xF1, 0x08, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE,
+	 0x01, 0x64, 0x19, 0x60, 0xF2, 0xFB, 0xFF, 0xFF, 0x10, 0xE0, 0x01, 0x60, 0x34, 0xE2, 0xFF, 0xFF,
+	 0x05, 0x7A, 0xAC, 0x4F, 0x40, 0xBC, 0x00, 0x7F, 0xA0, 0x5C, 0xC0, 0x60, 0x59, 0xEC, 0xC0, 0x60,
+	 0x07, 0xED, 0xC0, 0x60, 0x8F, 0xEE, 0xAE, 0x4F, 0x04, 0xBC, 0x00, 0x7F, 0xA0, 0x5E, 0x1B, 0x60,
+	 0xF3, 0xF1, 0xAD, 0x4F, 0x00, 0x7F, 0xFA, 0xB4, 0x64, 0x41, 0x7D, 0xF1, 0x02, 0xB1, 0x04, 0x65,
+	 0x02, 0x02, 0x64, 0x40, 0x01, 0x2B, 0x01, 0x65, 0xB4, 0x84, 0xA0, 0x5D, 0x26, 0x61, 0xCD, 0x81,
+	 0xFF, 0xFF, 0xFD, 0x02, 0xAE, 0x4F, 0xFB, 0xB4, 0xA0, 0x5E, 0x1B, 0x60, 0xF3, 0xF1, 0xAD, 0x4F,
+	 0x00, 0x7F, 0xFA, 0xB4, 0x64, 0x41, 0x7D, 0xF1, 0x02, 0xB1, 0x04, 0x65, 0x02, 0x02, 0x64, 0x40,
+	 0x01, 0x2B, 0x01, 0x65, 0xB4, 0x84, 0xA0, 0x5D, 0x30, 0x01, 0x19, 0x60, 0xF3, 0xF3, 0xFF, 0xFF,
+	 0x01, 0x1B, 0x2B, 0x01, 0x31, 0x44, 0x04, 0x2A, 0x28, 0x01, 0x08, 0x26, 0x26, 0x01, 0x19, 0x60,
+	 0xF4, 0xF3, 0xFF, 0xFF, 0x01, 0x18, 0x21, 0x01, 0x7E, 0xF5, 0xF1, 0xFC, 0xAD, 0x4F, 0xFD, 0xB4,
+	 0xA0, 0x5D, 0x15, 0x60, 0x80, 0xE7, 0xC0, 0x60, 0x40, 0xEC, 0xC0, 0x60, 0x00, 0xED, 0xAC, 0x4F,
+	 0xBF, 0xB4, 0xA0, 0x5C, 0xC0, 0x60, 0x84, 0xEE, 0xAE, 0x4F, 0x04, 0xBC, 0x00, 0x7F, 0xA0, 0x5E,
+	 0x00, 0x7A, 0x2D, 0x60, 0x5A, 0x63, 0xA3, 0xD1, 0x05, 0x60, 0xDC, 0x64, 0xD0, 0x80, 0x00, 0x64,
+	 0x01, 0x06, 0x01, 0x64, 0x40, 0x4E, 0xB2, 0xF1, 0x66, 0x41, 0xE1, 0x81, 0xE1, 0x81, 0xE1, 0x81,
+	 0xE1, 0x81, 0x61, 0x46, 0x73, 0x42, 0x5A, 0x92, 0x3F, 0x64, 0xA0, 0x84, 0x60, 0x47, 0xE0, 0x84,
+	 0xE0, 0x85, 0x62, 0x47, 0xE8, 0x84, 0xE8, 0x84, 0x3F, 0xB4, 0x60, 0x41, 0x64, 0x44, 0x14, 0x90,
+	 0x3F, 0x26, 0xCC, 0x84, 0x14, 0x90, 0x3F, 0x26, 0xCC, 0x84, 0x62, 0x41, 0x60, 0x55, 0xB2, 0xFB,
+	 0x72, 0x5C, 0x67, 0x42, 0xD2, 0x80, 0xA2, 0x48, 0x20, 0x2B, 0x05, 0x00, 0x01, 0x02, 0x7C, 0x5C,
+	 0x04, 0x60, 0x00, 0x64, 0xC4, 0x85, 0xE8, 0xE2, 0xE4, 0xE2, 0x61, 0x42, 0x49, 0x91, 0x64, 0x44,
+	 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xB4, 0x84, 0x60, 0x45,
+	 0x51, 0x94, 0x04, 0x60, 0x00, 0x61, 0x01, 0x0D, 0x44, 0x94, 0x62, 0x41, 0x19, 0x60, 0xF5, 0xF1,
+	 0x61, 0x42, 0x64, 0x43, 0xCF, 0x83, 0xCF, 0x83, 0x03, 0x03, 0xE3, 0x83, 0x48, 0x94, 0xFE, 0x1F,
+	 0x2E, 0x40, 0x01, 0x26, 0xE0, 0x84, 0x60, 0x41, 0xE9, 0x81, 0xE9, 0x81, 0xE9, 0x81, 0xE9, 0x81,
+	 0x44, 0x94, 0xE9, 0x81, 0xE9, 0x81, 0x54, 0x94, 0xE9, 0x81, 0xE9, 0x81, 0xE9, 0x81, 0x44, 0x94,
+	 0xE9, 0x81, 0xE9, 0x81, 0xE9, 0x81, 0x54, 0x94, 0x19, 0xE2, 0x2E, 0x40, 0x01, 0x26, 0xE8, 0x84,
+	 0x29, 0x61, 0x54, 0x91, 0x61, 0x43, 0x11, 0x06, 0x75, 0x44, 0x80, 0x2B, 0xAB, 0xFF, 0x80, 0x27,
+	 0x0C, 0x00, 0x14, 0xE0, 0x94, 0xE0, 0x34, 0xE2, 0x61, 0x5A, 0x48, 0x21, 0xFE, 0x01, 0x00, 0xE0,
+	 0x7A, 0x43, 0x15, 0xA1, 0x75, 0x40, 0x80, 0x2B, 0x06, 0xA1, 0x5D, 0x91, 0x61, 0x44, 0x2E, 0x40,
+	 0x01, 0x26, 0xE0, 0x84, 0x60, 0x43, 0xEB, 0x83, 0xEB, 0x83, 0xEB, 0x83, 0x89, 0xFF, 0x10, 0xE0,
+	 0x80, 0x60, 0x00, 0x75, 0x88, 0xFF, 0xEB, 0x83, 0xEB, 0x83, 0x5C, 0x94, 0xEB, 0x83, 0x5C, 0x94,
+	 0xEB, 0x83, 0xEB, 0x83, 0xEB, 0x83, 0xEB, 0x83, 0xEB, 0x83, 0x4C, 0x94, 0x2E, 0x40, 0x01, 0x26,
+	 0xE8, 0x84, 0x60, 0x43, 0x65, 0x41, 0x62, 0x45, 0xD5, 0x85, 0x04, 0x60, 0x00, 0x61, 0x01, 0x0D,
+	 0xC5, 0x85, 0xC4, 0x84, 0x60, 0x43, 0x62, 0x41, 0xE1, 0x81, 0xE1, 0x81, 0xE1, 0x81, 0xE1, 0x81,
+	 0xE1, 0x81, 0xE1, 0x9C, 0x00, 0x61, 0xDD, 0x81, 0x58, 0x94, 0x4A, 0x92, 0xFC, 0x05, 0x41, 0x4F,
+	 0x00, 0x61, 0x62, 0x45, 0x1C, 0x60, 0x0A, 0xF3, 0xE3, 0x83, 0xF1, 0x81, 0xE3, 0x83, 0xF1, 0x81,
+	 0xE3, 0x83, 0xF1, 0x81, 0xE3, 0x83, 0xF1, 0x81, 0xE3, 0x83, 0xF1, 0x81, 0xE3, 0x83, 0xF1, 0x81,
+	 0xA0, 0x52, 0xB2, 0xF3, 0xC3, 0x9C, 0x44, 0x94, 0x01, 0x04, 0xDC, 0x84, 0x60, 0x55, 0xB2, 0xFB,
+	 0x64, 0x52, 0xE9, 0xE2, 0x65, 0x53, 0xB3, 0xF3, 0x06, 0x04, 0xDC, 0x84, 0xB3, 0xFB, 0xB4, 0xF3,
+	 0x02, 0x04, 0xDC, 0x84, 0xB4, 0xFB, 0x2F, 0x43, 0xCF, 0x83, 0x6C, 0xF3, 0xFF, 0xFF, 0x5C, 0x94,
+	 0xFF, 0xFF, 0x0C, 0x24, 0x01, 0x64, 0x6C, 0xFB, 0x16, 0x60, 0xAC, 0xF1, 0xFF, 0xFF, 0x03, 0x1B,
+	 0x31, 0x40, 0x02, 0x2A, 0x07, 0x00, 0x73, 0xF3, 0xFF, 0xFF, 0x5C, 0x94, 0xFF, 0xFF, 0x0C, 0x24,
+	 0x00, 0x64, 0x73, 0xFB, 0x19, 0x60, 0xF5, 0xF3, 0x01, 0x7C, 0x5C, 0x94, 0x00, 0x36, 0x01, 0x64,
+	 0xA2, 0xDB, 0x19, 0x60, 0xF2, 0xF9, 0x01, 0x60, 0x34, 0xE2, 0x32, 0x7A, 0xAC, 0x4F, 0x40, 0xBC,
+	 0x00, 0x7F, 0xA0, 0x5C, 0xC0, 0x60, 0x59, 0xEC, 0xC0, 0x60, 0x07, 0xED, 0xC0, 0x60, 0x8F, 0xEE,
+	 0xAE, 0x4F, 0x04, 0xBC, 0x00, 0x7F, 0xA0, 0x5E, 0x0A, 0x61, 0xCD, 0x81, 0xFF, 0xFF, 0xFD, 0x02,
+	 0xAE, 0x4F, 0xFB, 0xB4, 0xA0, 0x5E, 0x1B, 0x60, 0xF3, 0xF1, 0xAD, 0x4F, 0x00, 0x7F, 0xFA, 0xB4,
+	 0x64, 0x41, 0x7D, 0xF1, 0x02, 0xB1, 0x04, 0x65, 0x02, 0x02, 0x64, 0x40, 0x01, 0x2B, 0x01, 0x65,
+	 0xB4, 0x84, 0xA0, 0x5D, 0x37, 0x60, 0x7F, 0x78, 0xFF, 0xFF, 0x24, 0xE2, 0x2D, 0xF3, 0x2C, 0xF3,
+	 0x00, 0xBD, 0xCC, 0x84, 0x08, 0x03, 0x2C, 0xFB, 0x06, 0x02, 0x65, 0x44, 0x2C, 0xFB, 0x8A, 0xFF,
+	 0x80, 0x60, 0x00, 0x75, 0x88, 0xFF, 0x44, 0xF3, 0xFF, 0xFF, 0xDC, 0x84, 0x44, 0xFB, 0x2F, 0x60,
+	 0x4A, 0x65, 0x2F, 0x60, 0x48, 0x61, 0xA5, 0xD3, 0xA1, 0xD3, 0x11, 0x18, 0xCC, 0x84, 0xA1, 0xDB,
+	 0x0E, 0x02, 0xA5, 0xD3, 0xA1, 0xDB, 0x17, 0x60, 0xA7, 0xF3, 0x17, 0x60, 0xA6, 0xF1, 0xA2, 0xDB,
+	 0xD0, 0x80, 0xFF, 0xFF, 0x04, 0x03, 0x8A, 0xFF, 0x20, 0x60, 0x00, 0x75, 0x88, 0xFF, 0xF1, 0xF3,
+	 0x31, 0x40, 0x01, 0x2A, 0x3D, 0x00, 0x60, 0x43, 0x04, 0xB0, 0x02, 0xB0, 0x08, 0x24, 0x16, 0x02,
+	 0x10, 0xB0, 0x29, 0x44, 0x34, 0x02, 0x00, 0xA8, 0xCC, 0x81, 0x0D, 0x03, 0x41, 0x49, 0x2F, 0x02,
+	 0x63, 0x40, 0x08, 0x2A, 0x08, 0x00, 0xF7, 0xB3, 0x1B, 0x60, 0xF6, 0xF1, 0xAD, 0x4F, 0xFD, 0xB4,
+	 0xA0, 0x5D, 0x44, 0x49, 0x24, 0x00, 0x63, 0x40, 0x02, 0x2A, 0x10, 0x00, 0x1B, 0x60, 0xF7, 0xF3,
+	 0x1B, 0x60, 0xF5, 0xFB, 0x40, 0x49, 0x1B, 0x60, 0xF8, 0xF3, 0x1B, 0x60, 0xF6, 0xFB, 0x0C, 0xBB,
+	 0xFD, 0xB3, 0xAD, 0x4F, 0x02, 0xBC, 0x00, 0x7F, 0xA0, 0x5D, 0x11, 0x00, 0x1B, 0x60, 0xF9, 0xF3,
+	 0x37, 0x60, 0xEA, 0x7C, 0x0C, 0x18, 0xA4, 0xDB, 0x40, 0x49, 0x1B, 0x60, 0xFA, 0xF3, 0x1B, 0x60,
+	 0xF6, 0xFB, 0x08, 0xBB, 0xFB, 0xB3, 0xAD, 0x4F, 0x02, 0xBC, 0x00, 0x7F, 0xA0, 0x5D, 0xF1, 0xFD,
+	 0x00, 0x60, 0xA4, 0xF3, 0x62, 0x43, 0x17, 0x18, 0x58, 0xD3, 0x62, 0x41, 0x03, 0x18, 0xCC, 0x84,
+	 0xA1, 0xDB, 0x11, 0x00, 0x49, 0xD3, 0xA3, 0xDB, 0x06, 0xA1, 0xA1, 0xD3, 0x59, 0xD1, 0x60, 0x45,
+	 0xA5, 0xD3, 0x59, 0xD1, 0xB0, 0x84, 0xA5, 0xDB, 0x64, 0x44, 0x06, 0x36, 0xCD, 0xFE, 0x07, 0x36,
+	 0xD6, 0xFE, 0xE6, 0x01, 0x23, 0x46, 0xB8, 0x60, 0x03, 0x78, 0xFF, 0xFF, 0x46, 0x43, 0x26, 0x60,
+	 0x3E, 0x61, 0xA1, 0xD3, 0x59, 0xD1, 0x06, 0x1B, 0x59, 0xD3, 0x59, 0xD1, 0x03, 0x1B, 0x59, 0xD3,
+	 0x59, 0xD1, 0xF0, 0x18, 0x00, 0x63, 0x49, 0xDD, 0x60, 0x40, 0x02, 0x36, 0x11, 0x00, 0x03, 0x36,
+	 0x32, 0x00, 0x01, 0x36, 0x08, 0x00, 0x05, 0x3A, 0xEA, 0x01, 0xA4, 0xD3, 0x5A, 0xD3, 0x9C, 0x85,
+	 0xA4, 0x84, 0xA2, 0xDB, 0xE4, 0x01, 0x01, 0x60, 0x48, 0x61, 0x00, 0x64, 0xA1, 0xDB, 0xDF, 0x01,
+	 0x3A, 0x60, 0x3E, 0x64, 0x40, 0x45, 0x22, 0x00, 0x01, 0x60, 0x48, 0x66, 0xA6, 0xD3, 0x04, 0xA1,
+	 0x60, 0x43, 0xA1, 0xD3, 0xC9, 0x81, 0x60, 0x45, 0x00, 0xBB, 0xA1, 0xDB, 0xBE, 0xD3, 0x09, 0x03,
+	 0xD4, 0x84, 0x9C, 0x84, 0xDC, 0x84, 0xFF, 0xFF, 0x04, 0x0E, 0xA3, 0xD1, 0x63, 0x46, 0x64, 0x43,
+	 0xF2, 0x01, 0x9C, 0x84, 0xDC, 0x85, 0x49, 0xDD, 0x61, 0x44, 0x00, 0xBB, 0xA6, 0xDB, 0x02, 0x03,
+	 0x65, 0x44, 0xBE, 0xDB, 0xBC, 0x01, 0x3A, 0x60, 0x19, 0x64, 0x40, 0x45, 0x01, 0x60, 0x48, 0x66,
+	 0xA6, 0xD3, 0xFF, 0xFF, 0xD0, 0x80, 0x0F, 0x18, 0x02, 0x03, 0x60, 0x46, 0xF9, 0x01, 0x58, 0xD3,
+	 0xA4, 0xD3, 0x60, 0x45, 0x00, 0x63, 0xA4, 0xDD, 0x05, 0x18, 0x58, 0xD3, 0xFF, 0xFF, 0xC4, 0x83,
+	 0xA2, 0xDD, 0xCA, 0x84, 0xA6, 0xDB, 0x25, 0x58, 0x64, 0x41, 0x00, 0x60, 0x46, 0x74, 0xCD, 0xE2,
+	 0x04, 0xE1, 0x02, 0x60, 0x00, 0xE1, 0x3F, 0x44, 0x40, 0x26, 0x05, 0x00, 0x1C, 0x60, 0x0F, 0xF3,
+	 0x5A, 0xD1, 0xA0, 0x50, 0xA4, 0x50, 0x3F, 0x40, 0x02, 0x2B, 0x03, 0x00, 0x3A, 0x60, 0xB7, 0x78,
+	 0xFF, 0xFF, 0x04, 0x29, 0xFE, 0x01, 0xC4, 0xE2, 0x43, 0x64, 0x3A, 0xDB, 0xA1, 0xF3, 0xFF, 0xFF,
+	 0x60, 0x41, 0x3F, 0x44, 0xFF, 0x01, 0x3F, 0x40, 0x40, 0x26, 0x05, 0x00, 0x1C, 0x60, 0x0D, 0xF3,
+	 0x5A, 0xD1, 0xA0, 0x50, 0xA4, 0x52, 0xC4, 0xE2, 0x32, 0x7B, 0x4D, 0xE2, 0xBF, 0xFE, 0xC4, 0xE2,
+	 0x41, 0xFF, 0xE0, 0xFE, 0xE1, 0xFE, 0xE2, 0xFE, 0x43, 0xFF, 0x44, 0xFF, 0x46, 0xFF, 0xA2, 0xF3,
+	 0x62, 0xFF, 0x60, 0x40, 0x05, 0x36, 0x2D, 0xFF, 0x07, 0x36, 0xD5, 0xFE, 0x08, 0xE1, 0x88, 0x60,
+	 0x85, 0x71, 0x8D, 0xE2, 0xA2, 0x60, 0x41, 0x78, 0xFF, 0xFF, 0x00, 0x60, 0x10, 0x62, 0x3D, 0x60,
+	 0x58, 0x4D, 0x3B, 0x78, 0xFF, 0xFF, 0x64, 0x41, 0xA9, 0x9C, 0x60, 0x45, 0x3D, 0x60, 0x58, 0x4D,
+	 0x0F, 0x78, 0xFF, 0xFF, 0xA1, 0xF1, 0x09, 0x60, 0xB4, 0x61, 0x64, 0x44, 0x01, 0x27, 0x24, 0x00,
+	 0x60, 0x40, 0x0E, 0x3A, 0x0D, 0x00, 0x01, 0x7C, 0x14, 0x60, 0x6F, 0xF9, 0x44, 0x60, 0x08, 0x7C,
+	 0x14, 0x60, 0x41, 0xF9, 0x16, 0x60, 0x62, 0xF1, 0x02, 0x60, 0xB0, 0x61, 0xB1, 0x9C, 0x26, 0x00,
+	 0x00, 0x7C, 0x14, 0x60, 0x6F, 0xF9, 0x40, 0x60, 0x08, 0x7C, 0x14, 0x60, 0x41, 0xF9, 0x16, 0x60,
+	 0x62, 0xF1, 0x02, 0x60, 0x90, 0x61, 0xB1, 0x9C, 0x09, 0x60, 0x67, 0x65, 0xFF, 0xB4, 0xC4, 0x85,
+	 0xE0, 0x84, 0xE0, 0x84, 0xC4, 0x81, 0x12, 0x00, 0xFF, 0xB4, 0xED, 0xA0, 0x2C, 0x60, 0xC6, 0x61,
+	 0x04, 0x04, 0xE2, 0xA0, 0xD9, 0x81, 0x01, 0x04, 0xD9, 0x81, 0xA1, 0xD1, 0x02, 0x60, 0x50, 0x61,
+	 0x26, 0x60, 0xF0, 0x65, 0xE0, 0x84, 0x44, 0xD3, 0xB1, 0x9C, 0xC8, 0x81, 0x61, 0x47, 0x00, 0x7E,
+	 0xE9, 0x81, 0x07, 0x60, 0xF0, 0x65, 0xA5, 0x81, 0x0B, 0xB9, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x85,
+	 0xB5, 0x85, 0x04, 0x60, 0x44, 0x62, 0x3D, 0x60, 0x58, 0x4D, 0x0F, 0x78, 0xFF, 0xFF, 0xA1, 0xF3,
+	 0xC8, 0x61, 0x61, 0x54, 0xCD, 0xE2, 0x60, 0x40, 0x01, 0x27, 0x2E, 0x00, 0xCC, 0x84, 0xE0, 0x85,
+	 0x15, 0x60, 0xA2, 0xE7, 0x26, 0x60, 0x80, 0x64, 0x3D, 0x60, 0x58, 0x4F, 0x04, 0x78, 0xFF, 0xFF,
+	 0x26, 0x60, 0x9C, 0x64, 0x3D, 0x60, 0x58, 0x4F, 0x04, 0x78, 0xFF, 0xFF, 0x26, 0x60, 0xB8, 0x64,
+	 0x3D, 0x60, 0x58, 0x4F, 0x04, 0x78, 0xFF, 0xFF, 0x26, 0x60, 0xD4, 0x64, 0x3D, 0x60, 0x58, 0x4F,
+	 0x04, 0x78, 0xFF, 0xFF, 0x75, 0x64, 0x06, 0x61, 0x61, 0x48, 0x60, 0x44, 0x80, 0xBC, 0xFF, 0xB4,
+	 0x60, 0x4A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x28, 0x60, 0xE6, 0x7C, 0x07, 0x60, 0xE8, 0xF9,
+	 0x28, 0x60, 0x6E, 0x63, 0x14, 0x61, 0x21, 0x00, 0x14, 0x60, 0xDF, 0xF1, 0xFF, 0xB4, 0xED, 0xA0,
+	 0x64, 0x41, 0x04, 0x04, 0xE2, 0xA0, 0xD9, 0x81, 0x01, 0x04, 0xD9, 0x81, 0xA1, 0xD1, 0x14, 0x60,
+	 0x0E, 0xF3, 0x64, 0x41, 0xFF, 0xB1, 0xFF, 0x60, 0x00, 0x65, 0xA4, 0x84, 0x34, 0x94, 0xA2, 0xDB,
+	 0x5A, 0xD3, 0x64, 0x41, 0xA5, 0x81, 0xFF, 0xB4, 0x34, 0x94, 0xA2, 0xDB, 0x29, 0x60, 0x52, 0x7C,
+	 0x07, 0x60, 0xE8, 0xF9, 0x27, 0x60, 0xFC, 0x63, 0x13, 0x61, 0x3D, 0x60, 0x58, 0x4D, 0x23, 0x78,
+	 0xFF, 0xFF, 0x07, 0x60, 0xE8, 0xF3, 0x31, 0x40, 0x80, 0x26, 0x36, 0xA4, 0x07, 0x60, 0xE8, 0xFB,
+	 0x60, 0x43, 0x09, 0x61, 0x3D, 0x60, 0x58, 0x4D, 0x23, 0x78, 0xFF, 0xFF, 0xA1, 0xF3, 0x29, 0x60,
+	 0xBE, 0x61, 0x00, 0x7C, 0x7E, 0x63, 0x59, 0xD9, 0xFE, 0x1F, 0x60, 0x40, 0x01, 0x27, 0x03, 0x00,
+	 0x2A, 0x60, 0x40, 0x65, 0x15, 0x00, 0xFF, 0xB4, 0xF9, 0xA0, 0x2A, 0x60, 0x62, 0x65, 0x01, 0x7C,
+	 0x0D, 0x04, 0xED, 0xA0, 0x2A, 0x60, 0x84, 0x65, 0x11, 0x7C, 0x08, 0x04, 0xE2, 0xA0, 0x2A, 0x60,
+	 0xA6, 0x65, 0x21, 0x7C, 0x03, 0x04, 0x2A, 0x60, 0xC8, 0x65, 0x31, 0x7C, 0x64, 0x5F, 0x7D, 0xFB,
+	 0xA5, 0xD3, 0xDA, 0x85, 0xF0, 0xA0, 0x29, 0x60, 0xBE, 0x61, 0x08, 0x06, 0x40, 0x54, 0x58, 0x53,
+	 0x08, 0xFF, 0x37, 0x60, 0x7A, 0x64, 0x43, 0xFB, 0x08, 0xFF, 0xFF, 0x01, 0x60, 0x43, 0x60, 0x46,
+	 0xA5, 0xD1, 0xDA, 0x85, 0xA5, 0xD3, 0xDA, 0x85, 0x59, 0xD9, 0x59, 0xDB, 0x59, 0xD9, 0x59, 0xDB,
+	 0xFB, 0x1F, 0x0C, 0x63, 0xA5, 0xD1, 0xDA, 0x85, 0xA5, 0xD3, 0xDA, 0x85, 0x59, 0xD9, 0x59, 0xDB,
+	 0x59, 0xD9, 0x59, 0xDB, 0xF7, 0x1F, 0x66, 0x44, 0x0E, 0x63, 0x53, 0x93, 0x60, 0x40, 0x10, 0x36,
+	 0x07, 0x00, 0x65, 0x44, 0x48, 0xD3, 0x59, 0xD9, 0x59, 0xDB, 0x59, 0xD9, 0x59, 0xDB, 0xFB, 0x1F,
+	 0x16, 0x60, 0x39, 0xF1, 0x7D, 0xF3, 0x64, 0x43, 0xDB, 0x81, 0x2C, 0x60, 0x54, 0x65, 0x60, 0x40,
+	 0x01, 0x37, 0x12, 0x00, 0x11, 0x37, 0x17, 0x00, 0x21, 0x37, 0x1D, 0x00, 0x31, 0x37, 0x22, 0x00,
+	 0xA3, 0xD1, 0x16, 0x60, 0x34, 0xF5, 0x64, 0x44, 0xFF, 0xB4, 0x16, 0x60, 0x33, 0xFB, 0x64, 0x47,
+	 0xFF, 0xB4, 0x16, 0x60, 0x2A, 0xF1, 0x1D, 0x00, 0xA1, 0xD3, 0x16, 0x60, 0x35, 0xF5, 0xFF, 0xB4,
+	 0x16, 0x60, 0x2B, 0xF1, 0x16, 0x00, 0xA1, 0xD3, 0x16, 0x60, 0x36, 0xF5, 0x60, 0x47, 0xFF, 0xB4,
+	 0x16, 0x60, 0x2C, 0xF1, 0x0E, 0x00, 0x59, 0xD3, 0x16, 0x60, 0x37, 0xF5, 0xFF, 0xB4, 0x16, 0x60,
+	 0x2D, 0xF1, 0x07, 0x00, 0x59, 0xD3, 0x16, 0x60, 0x38, 0xF5, 0x60, 0x47, 0xFF, 0xB4, 0x16, 0x60,
+	 0x2E, 0xF1, 0x16, 0x60, 0x32, 0xFB, 0x16, 0x60, 0x2F, 0xF9, 0x66, 0x42, 0xFC, 0xA2, 0xA2, 0xD3,
+	 0x2B, 0x60, 0x42, 0x63, 0xCC, 0x84, 0xE8, 0x84, 0xCC, 0x81, 0x63, 0x45, 0xA6, 0xD3, 0xDA, 0x82,
+	 0xFF, 0xB4, 0xFF, 0xFF, 0x03, 0x03, 0x60, 0x40, 0x80, 0x2B, 0x03, 0x00, 0xDA, 0x86, 0xCD, 0x81,
+	 0xF5, 0x01, 0x00, 0xB9, 0xA6, 0xD3, 0x0B, 0x03, 0x5A, 0xD1, 0xDA, 0x86, 0xFF, 0xB4, 0xE0, 0x84,
+	 0xC4, 0x84, 0x5C, 0x90, 0xBD, 0xD9, 0xFD, 0x02, 0xCD, 0x81, 0x66, 0x42, 0xF2, 0x02, 0x5A, 0xD3,
+	 0x2B, 0x60, 0x80, 0x65, 0xD7, 0x80, 0xBD, 0xDB, 0xFD, 0x02, 0x7D, 0xF3, 0x19, 0x60, 0x7B, 0xF1,
+	 0x60, 0x40, 0x01, 0x27, 0x09, 0x00, 0x64, 0x40, 0x10, 0x26, 0x06, 0x00, 0x13, 0x64, 0xCB, 0xFB,
+	 0x01, 0x60, 0x67, 0x64, 0x37, 0xFB, 0x09, 0x00, 0x08, 0x64, 0xCB, 0xFB, 0xA1, 0xF3, 0x01, 0x60,
+	 0x67, 0x7C, 0x60, 0x40, 0x01, 0x27, 0x5B, 0x7C, 0x37, 0xF9, 0x19, 0x60, 0x4D, 0xF1, 0x7D, 0xF3,
+	 0x64, 0x40, 0x00, 0x3A, 0x1B, 0x00, 0x60, 0x40, 0x01, 0x27, 0x0D, 0x00, 0x32, 0x60, 0xAB, 0x63,
+	 0x4C, 0x94, 0x0E, 0xA5, 0x60, 0xFE, 0xA0, 0xD1, 0xA5, 0xD3, 0x19, 0x60, 0x72, 0xF9, 0x19, 0x60,
+	 0x73, 0xFB, 0x20, 0xFE, 0x0B, 0x00, 0xFF, 0xB4, 0xF8, 0xA4, 0x32, 0x60, 0xC8, 0x63, 0x4C, 0x94,
+	 0x60, 0xFE, 0xA0, 0xD1, 0xFF, 0xFF, 0x19, 0x60, 0x73, 0xF9, 0x20, 0xFE, 0x19, 0x60, 0x75, 0xF3,
+	 0x16, 0x60, 0xD8, 0xF1, 0x60, 0x43, 0xD3, 0x80, 0x19, 0x60, 0x76, 0xF3, 0x01, 0x07, 0x63, 0x5C,
+	 0xD0, 0x80, 0xFF, 0xFF, 0x01, 0x07, 0x60, 0x5C, 0x19, 0x60, 0x4F, 0xF9, 0x19, 0x60, 0x53, 0xF9,
+	 0x7D, 0xF3, 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x27, 0x0A, 0x00, 0xFF, 0xB5, 0x10, 0x60, 0xF4, 0x63,
+	 0x65, 0x41, 0xCD, 0x81, 0x06, 0xA3, 0xFD, 0x02, 0xFA, 0xA3, 0xA3, 0xD3, 0x0F, 0x00, 0x01, 0x60,
+	 0xFF, 0x65, 0xA4, 0x84, 0x11, 0x60, 0x60, 0x61, 0xA1, 0xD1, 0xFF, 0xFF, 0xD0, 0x80, 0x08, 0xA1,
+	 0xFB, 0x02, 0xFC, 0xA1, 0xA1, 0xD3, 0x19, 0x60, 0x4F, 0xF1, 0xFF, 0xB4, 0xD0, 0x80, 0xFF, 0xFF,
+	 0x04, 0x07, 0x19, 0x60, 0x4F, 0xFB, 0x19, 0x60, 0x53, 0xFB, 0x19, 0x60, 0x4F, 0xF3, 0x19, 0x60,
+	 0x72, 0xF1, 0x19, 0x60, 0x74, 0xFB, 0xD0, 0x80, 0xFF, 0xFF, 0x02, 0x04, 0x19, 0x60, 0x74, 0xF9,
+	 0x2C, 0x60, 0x74, 0x63, 0x2B, 0x60, 0x02, 0x65, 0x16, 0x60, 0x33, 0xF1, 0x2A, 0x60, 0xEA, 0x61,
+	 0x2C, 0x60, 0x62, 0x64, 0x40, 0x4F, 0x04, 0x64, 0xC3, 0x60, 0x58, 0x4D, 0x1A, 0x78, 0xFF, 0xFF,
+	 0x19, 0x60, 0x4F, 0xF3, 0x19, 0x60, 0x73, 0xF1, 0x19, 0x60, 0x74, 0xFB, 0xD0, 0x80, 0xFF, 0xFF,
+	 0x02, 0x04, 0x19, 0x60, 0x74, 0xF9, 0x2C, 0x60, 0x7C, 0x63, 0x16, 0x60, 0x32, 0xF1, 0x2B, 0x60,
+	 0x42, 0x65, 0x2C, 0x60, 0x60, 0x64, 0x40, 0x4F, 0x08, 0x64, 0xC3, 0x60, 0x58, 0x4D, 0x1A, 0x78,
+	 0xFF, 0xFF, 0x7D, 0xF3, 0x08, 0x7C, 0x38, 0xF9, 0x2B, 0x60, 0xDA, 0x61, 0x60, 0x40, 0x01, 0x2B,
+	 0x0E, 0x00, 0x01, 0x37, 0x06, 0x00, 0x11, 0x37, 0x03, 0x00, 0x21, 0x3B, 0x1E, 0xA1, 0x1E, 0xA1,
+	 0x1E, 0xA1, 0x1C, 0x63, 0x2B, 0x60, 0xBC, 0x64, 0x59, 0xD1, 0x58, 0xD9, 0xFD, 0x1F, 0x16, 0x60,
+	 0x2F, 0xF3, 0x00, 0x7C, 0x60, 0x45, 0x70, 0x62, 0x3D, 0x60, 0x58, 0x4D, 0x0F, 0x78, 0xFF, 0xFF,
+	 0x04, 0x29, 0xFE, 0x01, 0x00, 0x60, 0x10, 0x62, 0x3D, 0x60, 0x58, 0x4D, 0x3B, 0x78, 0xFF, 0xFF,
+	 0x01, 0x61, 0xB1, 0x9C, 0x60, 0x45, 0x3D, 0x60, 0x58, 0x4D, 0x0F, 0x78, 0xFF, 0xFF, 0x3A, 0x60,
+	 0x95, 0x78, 0xFF, 0xFF, 0x44, 0xD3, 0x80, 0x7C, 0x60, 0x48, 0x60, 0x47, 0x00, 0x7F, 0xB0, 0x8A,
+	 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x2F, 0x58, 0xFF, 0xFF, 0xD5, 0x60, 0x84, 0xE7, 0x62, 0x47,
+	 0x80, 0xBF, 0x60, 0x4A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x64, 0x4A, 0xFF, 0xFF, 0x01, 0x16,
+	 0xFE, 0x01, 0x65, 0x4A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x95, 0x60, 0x84, 0xE7, 0x2D, 0x58,
+	 0xFF, 0xFF, 0x00, 0x7C, 0xBD, 0xD3, 0xD5, 0x60, 0x84, 0xE7, 0x60, 0x47, 0x80, 0xBF, 0x60, 0x4A,
+	 0xBD, 0xD3, 0x01, 0x16, 0xFE, 0x01, 0x90, 0x8A, 0xBD, 0xD3, 0x01, 0x16, 0xFE, 0x01, 0x90, 0x8A,
+	 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0xCD, 0x81, 0x95, 0x60, 0x84, 0xE7, 0xEB, 0x02, 0x2D, 0x58,
+	 0xFF, 0xFF, 0xD5, 0x60, 0x84, 0xE7, 0x62, 0x4A, 0x02, 0x64, 0x01, 0x16, 0xFE, 0x01, 0xCC, 0x84,
+	 0xFF, 0xFF, 0xFD, 0x02, 0x7C, 0x49, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x68, 0x5C, 0x7C, 0x49,
+	 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x68, 0x44, 0x95, 0x60, 0x84, 0xE7, 0x2D, 0x58, 0xFF, 0xFF,
+	 0x40, 0xFF, 0x20, 0x44, 0xBF, 0xB4, 0x40, 0x40, 0x03, 0x00, 0x20, 0x44, 0x40, 0xBC, 0x40, 0x40,
+	 0x43, 0x45, 0x20, 0x44, 0x20, 0xBC, 0x40, 0x40, 0x02, 0x00, 0x43, 0x45, 0xF6, 0x01, 0x00, 0x64,
+	 0x19, 0x60, 0xF2, 0xFB, 0x3F, 0x44, 0x40, 0x26, 0x05, 0x00, 0x1C, 0x60, 0x0F, 0xF3, 0x5A, 0xD1,
+	 0xA0, 0x50, 0xA4, 0x50, 0xAE, 0x4F, 0xFD, 0xB4, 0x04, 0xBC, 0xA0, 0x5E, 0x00, 0x60, 0x02, 0x71,
+	 0x8D, 0xE2, 0x40, 0xE1, 0x40, 0x29, 0xFE, 0x01, 0x04, 0xAC, 0xA0, 0x5E, 0xFF, 0xFF, 0x00, 0x60,
+	 0x10, 0x62, 0x19, 0x60, 0x8E, 0x7C, 0x00, 0x60, 0xAC, 0x65, 0x3D, 0x60, 0x58, 0x4D, 0x0F, 0x78,
+	 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x60, 0x10, 0x62, 0x3D, 0x60, 0x58, 0x4D, 0x3B, 0x78, 0xFF, 0xFF,
+	 0x60, 0x40, 0x19, 0x60, 0x8E, 0x64, 0x64, 0x40, 0xD0, 0x80, 0x14, 0x71, 0x05, 0x03, 0x8D, 0xE2,
+	 0x40, 0xE1, 0x40, 0x29, 0xFE, 0x01, 0xE2, 0x01, 0x3F, 0x44, 0x40, 0x26, 0x05, 0x00, 0x1C, 0x60,
+	 0x0D, 0xF3, 0x5A, 0xD1, 0xA0, 0x50, 0xA4, 0x52, 0x27, 0x60, 0x36, 0x63, 0x1E, 0x61, 0x3D, 0x60,
+	 0x58, 0x4D, 0x23, 0x78, 0xFF, 0xFF, 0x00, 0x60, 0x14, 0x71, 0x8D, 0xE2, 0x40, 0xE1, 0x40, 0x29,
+	 0xFE, 0x01, 0x31, 0x44, 0x40, 0x26, 0x02, 0x00, 0x80, 0x26, 0x17, 0x00, 0x28, 0x60, 0xE6, 0x63,
+	 0x07, 0x60, 0xE8, 0xFD, 0x09, 0x61, 0x3D, 0x60, 0x58, 0x4D, 0x23, 0x78, 0xFF, 0xFF, 0x31, 0x44,
+	 0x40, 0x2A, 0x14, 0x00, 0x31, 0x44, 0x7F, 0xB4, 0x40, 0x51, 0xAE, 0x4C, 0x10, 0x26, 0x0E, 0x00,
+	 0x07, 0x60, 0xE9, 0xFB, 0x31, 0x44, 0x80, 0xBC, 0x40, 0x51, 0x29, 0x60, 0x1C, 0x63, 0x07, 0x60,
+	 0xE8, 0xFD, 0x09, 0x61, 0x3D, 0x60, 0x58, 0x4D, 0x23, 0x78, 0xFF, 0xFF, 0x27, 0x60, 0xEA, 0x63,
+	 0x03, 0x61, 0x3D, 0x60, 0x58, 0x4D, 0x23, 0x78, 0xFF, 0xFF, 0x00, 0x60, 0x10, 0x62, 0x19, 0x60,
+	 0x8F, 0x7C, 0x00, 0x60, 0xAC, 0x65, 0x3D, 0x60, 0x58, 0x4D, 0x0F, 0x78, 0xFF, 0xFF, 0x80, 0xE1,
+	 0xBF, 0xFE, 0xA1, 0x4F, 0x70, 0xB4, 0x50, 0x36, 0x0C, 0x00, 0x20, 0x36, 0x03, 0x00, 0x3A, 0x60,
+	 0x77, 0x78, 0xFF, 0xFF, 0x01, 0x60, 0x1A, 0xE1, 0xDF, 0xFE, 0x19, 0xFF, 0x00, 0xE1, 0xA1, 0xFF,
+	 0xFF, 0xFF, 0x20, 0x44, 0x40, 0x2A, 0x85, 0x00, 0x7D, 0xF1, 0x3B, 0x00, 0x83, 0x00, 0x19, 0x60,
+	 0xF2, 0xF3, 0xFF, 0xFF, 0x01, 0x18, 0x59, 0x01, 0x43, 0x45, 0x20, 0x44, 0x20, 0xBC, 0x40, 0x40,
+	 0x1C, 0x60, 0x0F, 0xF3, 0x3F, 0x40, 0x40, 0x26, 0x01, 0x00, 0xA0, 0x50, 0xAE, 0x4F, 0xFD, 0xB4,
+	 0xA0, 0x5E, 0xAC, 0x4F, 0x10, 0xBC, 0xA0, 0x5C, 0xFF, 0xFF, 0x10, 0xAC, 0xA0, 0x5C, 0x00, 0x60,
+	 0xC8, 0x71, 0x8D, 0xE2, 0x40, 0xE1, 0x40, 0x29, 0xFE, 0x01, 0x7D, 0xF1, 0x30, 0x61, 0x64, 0x44,
+	 0x01, 0x2B, 0x20, 0xA1, 0x30, 0x64, 0x61, 0x5F, 0x60, 0x45, 0x0C, 0x60, 0x00, 0x62, 0x00, 0x60,
+	 0x71, 0x7C, 0x3D, 0x60, 0x58, 0x4D, 0x0F, 0x78, 0xFF, 0xFF, 0x00, 0x60, 0xC8, 0x71, 0x8D, 0xE2,
+	 0x40, 0xE1, 0x40, 0x29, 0xFE, 0x01, 0x01, 0x60, 0x08, 0xE1, 0x7D, 0xF1, 0x20, 0x44, 0x40, 0xBC,
+	 0x40, 0x40, 0x19, 0x60, 0xF2, 0xF3, 0xFF, 0xFF, 0x03, 0x18, 0x3D, 0x60, 0x57, 0x78, 0xFF, 0xFF,
+	 0x1B, 0x60, 0xF3, 0xF1, 0xAD, 0x4F, 0x00, 0x7F, 0xFA, 0xB4, 0x64, 0x41, 0x7D, 0xF1, 0x02, 0xB1,
+	 0x04, 0x65, 0x02, 0x02, 0x64, 0x40, 0x01, 0x2B, 0x01, 0x65, 0xB4, 0x84, 0xA0, 0x5D, 0x20, 0x44,
+	 0x40, 0x2A, 0x43, 0x45, 0x20, 0xBC, 0x40, 0x40, 0xA1, 0xF9, 0x05, 0x64, 0xA2, 0xFB, 0xDF, 0xFE,
+	 0x19, 0xFF, 0xDD, 0xFE, 0x26, 0x00, 0x20, 0x44, 0x20, 0xBC, 0x40, 0x40, 0x43, 0x45, 0xA4, 0xD1,
+	 0xDA, 0x83, 0xC3, 0x85, 0x80, 0xE1, 0xDF, 0xFE, 0xBD, 0xD3, 0xFF, 0xFF, 0x60, 0x48, 0x60, 0x47,
+	 0x80, 0xBC, 0x00, 0x7F, 0x60, 0x4A, 0xD7, 0x80, 0xA1, 0xFF, 0xF6, 0x02, 0xBF, 0xFE, 0x11, 0x00,
+	 0x43, 0x45, 0xA4, 0xD1, 0xDA, 0x83, 0x0D, 0x18, 0x64, 0x44, 0x00, 0x61, 0xFA, 0xA4, 0xDD, 0x81,
+	 0xFD, 0x02, 0x3D, 0x60, 0x58, 0x4D, 0x23, 0x78, 0xFF, 0xFF, 0xBF, 0xFE, 0x02, 0x00, 0xF1, 0xFE,
+	 0x01, 0x00, 0x25, 0x43, 0x21, 0xE1, 0x00, 0x64, 0xBF, 0xDB, 0x20, 0x44, 0x20, 0x2A, 0x07, 0x00,
+	 0x07, 0xB4, 0x04, 0x36, 0xC3, 0xFE, 0x06, 0x36, 0xCC, 0xFE, 0x07, 0x36, 0xD5, 0xFE, 0x20, 0x44,
+	 0x98, 0xB4, 0x40, 0x40, 0x26, 0x60, 0x26, 0x63, 0xBD, 0xD3, 0x03, 0x61, 0x0F, 0x1B, 0x04, 0xA3,
+	 0xBD, 0xD3, 0x04, 0x61, 0x0B, 0x1B, 0x04, 0xA3, 0xBD, 0xD3, 0x06, 0x61, 0x07, 0x1B, 0x04, 0xA3,
+	 0xBD, 0xD3, 0x07, 0x61, 0x03, 0x1B, 0xC3, 0x60, 0x48, 0x78, 0xFF, 0xFF, 0xA3, 0xD1, 0x40, 0x44,
+	 0x20, 0x44, 0x07, 0xB5, 0xD4, 0x85, 0x35, 0x80, 0x24, 0x45, 0x26, 0x60, 0x66, 0x64, 0x44, 0xD7,
+	 0xFF, 0xFF, 0xFF, 0xFF, 0x43, 0x45, 0x20, 0x44, 0x20, 0xBC, 0x40, 0x40, 0x64, 0x43, 0xBD, 0xD3,
+	 0xBD, 0xD1, 0x40, 0x44, 0x10, 0x27, 0x19, 0x00, 0x3F, 0x40, 0x02, 0x2B, 0x06, 0x00, 0x24, 0x47,
+	 0x08, 0x2B, 0x13, 0x00, 0x07, 0xB4, 0x01, 0x36, 0x11, 0x00, 0xFF, 0x60, 0x7F, 0x65, 0x15, 0x60,
+	 0xA2, 0x64, 0x24, 0x40, 0x08, 0x2B, 0xA4, 0x84, 0xA0, 0x57, 0xFF, 0xFF, 0x64, 0x49, 0xFF, 0xFF,
+	 0x68, 0x44, 0x01, 0x16, 0xFD, 0x01, 0x00, 0x7F, 0xA3, 0xDB, 0xAB, 0x01, 0x64, 0x42, 0x3D, 0x60,
+	 0x58, 0x4D, 0x3B, 0x78, 0xFF, 0xFF, 0xBD, 0xD9, 0xA3, 0xDB, 0xA3, 0x01, 0x43, 0x45, 0x20, 0x44,
+	 0x20, 0xBC, 0x40, 0x40, 0x64, 0x43, 0xBD, 0xD3, 0xA3, 0xD1, 0x40, 0x44, 0x10, 0x2B, 0x16, 0x00,
+	 0xBE, 0xD1, 0xFF, 0xFF, 0x15, 0x60, 0x80, 0xE7, 0x24, 0x40, 0x07, 0x27, 0x04, 0x00, 0xAC, 0x4F,
+	 0x10, 0xBC, 0x00, 0x7F, 0xA0, 0x5C, 0x64, 0x4A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x24, 0x40,
+	 0x20, 0x27, 0x1D, 0x00, 0xAC, 0x4F, 0xEF, 0xB4, 0xA0, 0x5C, 0x19, 0x00, 0x3F, 0x40, 0x02, 0x2B,
+	 0x06, 0x00, 0x24, 0x47, 0x08, 0x2B, 0x13, 0x00, 0x07, 0xB4, 0x01, 0x36, 0x11, 0x00, 0x15, 0x60,
+	 0x22, 0x64, 0x24, 0x40, 0x08, 0x27, 0x80, 0xBC, 0x7C, 0x48, 0xBE, 0xD3, 0xA0, 0x57, 0x60, 0x48,
+	 0x64, 0x44, 0x80, 0xBC, 0xFF, 0xB4, 0x60, 0x4A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x69, 0x01,
+	 0x01, 0x61, 0x3D, 0x60, 0x58, 0x4D, 0x23, 0x78, 0xFF, 0xFF, 0x63, 0x01, 0x30, 0x44, 0x02, 0xA8,
+	 0x00, 0xE1, 0x07, 0x02, 0x62, 0xFF, 0x63, 0xFF, 0x64, 0xFF, 0x65, 0xFF, 0x66, 0xFF, 0xBF, 0xFE,
+	 0xA1, 0xFF, 0x82, 0xFF, 0x88, 0xFF, 0x6C, 0x40, 0x41, 0xFF, 0xC4, 0xE2, 0x43, 0xFF, 0x5C, 0x49,
+	 0x08, 0xE1, 0xA2, 0x60, 0x41, 0x78, 0xFF, 0xFF, 0x30, 0x44, 0x02, 0xA8, 0x00, 0xE1, 0x02, 0x02,
+	 0xA1, 0xFF, 0xFF, 0xFF, 0x82, 0xFF, 0x88, 0xFF, 0xA8, 0xE2, 0xCB, 0xF1, 0x00, 0x6B, 0x89, 0xFF,
+	 0x64, 0x54, 0x88, 0xFF, 0x9F, 0xFE, 0x02, 0x05, 0x64, 0x44, 0x60, 0x54, 0xCD, 0xE2, 0xC2, 0x64,
+	 0x3A, 0xDB, 0xBC, 0xFF, 0xB5, 0xFF, 0x1D, 0xFF, 0x26, 0x44, 0x02, 0xB4, 0x40, 0x46, 0x3C, 0x44,
+	 0x00, 0xBC, 0xFF, 0xFF, 0x06, 0x03, 0x27, 0x40, 0x26, 0x22, 0x03, 0x00, 0x02, 0x64, 0x31, 0xFB,
+	 0xC0, 0xFE, 0x27, 0x44, 0x20, 0x2A, 0x04, 0x00, 0xA0, 0x60, 0x00, 0xEA, 0xB0, 0x60, 0x00, 0xEA,
+	 0x5C, 0x44, 0x27, 0x44, 0x18, 0xB4, 0x40, 0x47, 0x00, 0xE1, 0x29, 0x40, 0x50, 0x2B, 0x37, 0x00,
+	 0xEF, 0x60, 0xFF, 0x65, 0x29, 0x44, 0x24, 0x89, 0x31, 0x40, 0x08, 0x26, 0x0B, 0x00, 0x21, 0x46,
+	 0xA7, 0xF4, 0x1D, 0xF2, 0xFF, 0xB3, 0x00, 0x7C, 0x05, 0x03, 0x06, 0x61, 0x5D, 0x91, 0x09, 0x60,
+	 0x02, 0x65, 0x02, 0x03, 0x00, 0x61, 0x15, 0x00, 0xD4, 0x80, 0x63, 0x45, 0xFB, 0x07, 0x65, 0x43,
+	 0x80, 0x60, 0x00, 0x62, 0xF6, 0x82, 0x53, 0x90, 0xE3, 0x83, 0xFC, 0x04, 0xEB, 0x83, 0xEB, 0x83,
+	 0xEA, 0x82, 0x5C, 0x94, 0xB2, 0x9C, 0xF3, 0x07, 0x64, 0x41, 0xDD, 0x81, 0xE1, 0x81, 0xE1, 0x81,
+	 0xE1, 0x81, 0x2B, 0x44, 0x54, 0x90, 0x70, 0x45, 0x02, 0x28, 0x61, 0x44, 0xC4, 0x84, 0xFF, 0xFF,
+	 0x04, 0x24, 0x00, 0xB4, 0x60, 0x50, 0x08, 0x28, 0x01, 0x00, 0x20, 0x29, 0x6D, 0xE2, 0xA4, 0xE2,
+	 0xC4, 0xE2, 0x47, 0xFF, 0xB6, 0xFF, 0xB7, 0xFF, 0xB4, 0xFF, 0x32, 0xF1, 0x08, 0x29, 0x09, 0x00,
+	 0x64, 0x40, 0x07, 0x22, 0x06, 0x00, 0x43, 0xFF, 0x27, 0x44, 0x10, 0xBC, 0x40, 0x47, 0x00, 0x64,
+	 0x32, 0xFB, 0x31, 0x41, 0x3C, 0x44, 0x01, 0xB1, 0x00, 0xBC, 0x0A, 0x02, 0x09, 0x03, 0x32, 0xF3,
+	 0x00, 0x7C, 0x01, 0xB4, 0xFF, 0xFF, 0x04, 0x03, 0x32, 0xF9, 0x02, 0x64, 0x31, 0xFB, 0xC0, 0xFE,
+	 0xC8, 0x60, 0x09, 0x7D, 0x00, 0x60, 0x00, 0x6B, 0x00, 0x64, 0x33, 0xFB, 0x0C, 0x60, 0x16, 0x64,
+	 0xA0, 0xD7, 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0xE1, 0x30, 0x40, 0x02, 0x36, 0xA1, 0xFF, 0x83, 0xFF,
+	 0x8D, 0xFF, 0x5C, 0x44, 0x5C, 0x43, 0x5C, 0x42, 0x5C, 0x41, 0x5C, 0x40, 0xAC, 0xFF, 0xAD, 0xFF,
+	 0xE7, 0xE1, 0xB3, 0x60, 0xFC, 0x78, 0xFF, 0xFF, 0x30, 0x44, 0x02, 0xA8, 0x00, 0xE1, 0x03, 0x02,
+	 0x28, 0xE2, 0x40, 0xFF, 0xA1, 0xFF, 0x84, 0xFF, 0xC2, 0x60, 0x45, 0x64, 0x40, 0x42, 0xB7, 0x60,
+	 0xF7, 0x64, 0x40, 0x40, 0xBA, 0xF3, 0x7E, 0xFB, 0x0F, 0x60, 0xE2, 0x63, 0xC7, 0xF3, 0xBD, 0xDB,
+	 0x00, 0x60, 0x9A, 0x64, 0xBD, 0xDB, 0x02, 0x64, 0xBD, 0xDB, 0x04, 0x64, 0xA3, 0xDB, 0x5C, 0x49,
+	 0x0A, 0x64, 0x40, 0x4B, 0x5C, 0x5C, 0x01, 0x60, 0x39, 0xE2, 0x04, 0x60, 0x00, 0x7A, 0x89, 0xFF,
+	 0x03, 0x60, 0xFF, 0x73, 0x88, 0xFF, 0xB7, 0x60, 0xF7, 0x78, 0xFF, 0xFF, 0x30, 0x44, 0x02, 0xA8,
+	 0x00, 0xE1, 0x06, 0x02, 0x40, 0xFF, 0x42, 0xFF, 0x43, 0xFF, 0x44, 0xFF, 0x45, 0xFF, 0xA1, 0xFF,
+	 0x88, 0xFF, 0x85, 0xFF, 0x21, 0xE1, 0x5C, 0x40, 0xC3, 0x60, 0x48, 0x78, 0xFF, 0xFF, 0xA2, 0xFF,
+	 0x30, 0x44, 0x02, 0xA8, 0x00, 0xE1, 0x01, 0x02, 0xA1, 0xFF, 0x86, 0xFF, 0x88, 0xFF, 0x5C, 0x46,
+	 0x5C, 0x49, 0x5C, 0x40, 0xEF, 0x60, 0x58, 0x4F, 0x1B, 0x78, 0xFF, 0xFF, 0x1D, 0x60, 0x58, 0x4F,
+	 0x81, 0x78, 0xFF, 0xFF, 0xD3, 0x60, 0x58, 0x4F, 0x58, 0x78, 0xFF, 0xFF, 0xE7, 0x60, 0x58, 0x4F,
+	 0x99, 0x78, 0xFF, 0xFF, 0x20, 0x60, 0x58, 0x4F, 0x19, 0x78, 0xFF, 0xFF, 0xF4, 0x60, 0x58, 0x4F,
+	 0xE9, 0x78, 0xFF, 0xFF, 0xE9, 0x60, 0x58, 0x4F, 0xCA, 0x78, 0xFF, 0xFF, 0x27, 0x60, 0x58, 0x4F,
+	 0x71, 0x78, 0xFF, 0xFF, 0xEE, 0x60, 0x58, 0x4F, 0x69, 0x78, 0xFF, 0xFF, 0x1F, 0xE1, 0xA3, 0xFF,
+	 0xCA, 0x60, 0xD4, 0x78, 0xFF, 0xFF, 0x03, 0xE1, 0xA3, 0xFF, 0xFE, 0xFC, 0xFF, 0xFC, 0x25, 0x60,
+	 0x96, 0x63, 0x17, 0xFD, 0xAE, 0xFF, 0x2A, 0x60, 0x1D, 0x78, 0xFF, 0xFF, 0x42, 0x6F, 0x6F, 0x74,
+	 0x63, 0x6F, 0x64, 0x65, 0x20, 0x21, 0x21, 0x20, 0x20, 0x00, 0x53, 0x54, 0x41, 0x2F, 0x41, 0x50,
+	 0x20, 0x46, 0x75, 0x6E, 0x63, 0x27, 0x73, 0x00, 0x1F, 0x00, 0x04, 0x00, 0x01, 0x00, 0x24, 0x00,
+	 0x00, 0x00, 0x04, 0x00, 0x04, 0x00, 0x01, 0x00, 0x02, 0x00, 0x01, 0x00, 0x01, 0x00, 0x04, 0x00,
+	 0x06, 0x00, 0x07, 0x00, 0x05, 0x00, 0x06, 0x00, 0x07, 0x00, 0x06, 0x00, 0x06, 0x00, 0x07, 0x00,
+	 0x01, 0x00, 0x02, 0x00, 0x02, 0x00, 0x01, 0x00, 0x02, 0x00, 0x01, 0x00, 0x01, 0x00, 0x02, 0x00,
+	 0x00, 0x00, 0x03, 0x00, 0x01, 0x00, 0xA6, 0xF3, 0x21, 0x61, 0x00, 0x7C, 0x01, 0x00, 0x00, 0xFA,
+	 0x60, 0x46, 0xFE, 0x63, 0xA3, 0xD8, 0xFE, 0x1F, 0xCD, 0x81, 0xD8, 0x84, 0xF8, 0x02, 0x21, 0x61,
+	 0x80, 0x67, 0x40, 0x4A, 0xA6, 0xF5, 0x05, 0x18, 0x2A, 0x43, 0x02, 0xFC, 0x5F, 0x8A, 0x00, 0xF4,
+	 0xFA, 0x01, 0x2E, 0x58, 0xFF, 0xFF, 0xA8, 0xF1, 0xA7, 0xF3, 0x7C, 0x63, 0xAA, 0xFB, 0x60, 0x46,
+	 0x01, 0xFC, 0xDC, 0x84, 0xD0, 0x80, 0x00, 0xFA, 0xFA, 0x04, 0xAB, 0xFB, 0x60, 0x46, 0x00, 0x64,
+	 0x00, 0xFA, 0x63, 0x44, 0x80, 0x7F, 0x01, 0xFA, 0xA8, 0xF3, 0xA7, 0xF1, 0xDC, 0x84, 0xD0, 0x84,
+	 0xA9, 0xFB, 0x03, 0x60, 0x26, 0x61, 0xB6, 0x60, 0x58, 0x4D, 0x0F, 0x78, 0xFF, 0xFF, 0x66, 0x44,
+	 0x2E, 0xFB, 0x82, 0xFF, 0x40, 0x42, 0x87, 0xFF, 0xA9, 0xF3, 0xB1, 0xFB, 0x00, 0x64, 0x40, 0x50,
+	 0x63, 0xFF, 0x60, 0xFF, 0x66, 0xFF, 0x65, 0xFF, 0x64, 0xFF, 0x61, 0xFF, 0x62, 0xFF, 0x49, 0x60,
+	 0x02, 0xE1, 0x52, 0x60, 0x02, 0xE1, 0x5C, 0x60, 0x02, 0xE1, 0x65, 0x60, 0x02, 0xE1, 0x6B, 0x60,
+	 0x02, 0xE1, 0x76, 0x60, 0x02, 0xE1, 0x41, 0x60, 0x02, 0xE1, 0x0C, 0x64, 0x13, 0x60, 0x1C, 0xFB,
+	 0x41, 0x60, 0x07, 0x64, 0x9F, 0xFB, 0x2D, 0xFF, 0x06, 0x61, 0x41, 0x4B, 0x09, 0x60, 0x08, 0x61,
+	 0xB6, 0x60, 0x58, 0x4D, 0x0F, 0x78, 0xFF, 0xFF, 0xF0, 0x67, 0x0E, 0xFA, 0x26, 0x60, 0x04, 0x64,
+	 0x13, 0x60, 0x10, 0xFB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF,
+	 0x2B, 0x41, 0x4D, 0x8B, 0xFF, 0xFF, 0xEA, 0x02, 0x05, 0x61, 0x41, 0x4B, 0x09, 0x60, 0x08, 0x61,
+	 0xB6, 0x60, 0x58, 0x4D, 0x0F, 0x78, 0xFF, 0xFF, 0x25, 0x60, 0xF8, 0x64, 0x13, 0x60, 0x10, 0xFB,
+	 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0x2B, 0x41, 0x4D, 0x8B,
+	 0xFF, 0xFF, 0xEC, 0x02, 0x40, 0x60, 0x45, 0x78, 0xFF, 0xFF, 0x00, 0xEA, 0x00, 0xEB, 0x50, 0x60,
+	 0x03, 0xEA, 0x51, 0x60, 0x13, 0xEA, 0x52, 0x60, 0x30, 0xEA, 0x53, 0x60, 0x40, 0xEA, 0x54, 0x60,
+	 0x52, 0xEA, 0x55, 0x60, 0x6D, 0xEA, 0x56, 0x60, 0x71, 0xEA, 0x57, 0x60, 0x8B, 0xEA, 0x58, 0x60,
+	 0x47, 0xEA, 0x59, 0x60, 0xA0, 0xEA, 0x5A, 0x60, 0xB2, 0xEA, 0x5B, 0x60, 0xC1, 0xEA, 0x5C, 0x60,
+	 0xD7, 0xEA, 0x5D, 0x60, 0xEB, 0xEA, 0x5E, 0x60, 0xA0, 0xEA, 0x50, 0x60, 0x36, 0xEB, 0x51, 0x60,
+	 0x37, 0xEB, 0x52, 0x60, 0x20, 0xEB, 0x53, 0x60, 0xE4, 0xEB, 0x54, 0x60, 0x34, 0xEB, 0x55, 0x60,
+	 0x58, 0xEB, 0x56, 0x60, 0x48, 0xEB, 0x57, 0x60, 0xD0, 0xEB, 0x58, 0x60, 0xC3, 0xEB, 0x59, 0x60,
+	 0xFC, 0xEB, 0x5A, 0x60, 0x34, 0xEB, 0x5B, 0x60, 0x58, 0xEB, 0x5C, 0x60, 0xC0, 0xEB, 0x5D, 0x60,
+	 0xD0, 0xEB, 0x5E, 0x60, 0x91, 0xEB, 0x00, 0xEA, 0x00, 0xEB, 0xE0, 0x60, 0x02, 0xEA, 0xE0, 0x60,
+	 0x03, 0xEB, 0xA0, 0x60, 0x00, 0xEB, 0xB0, 0x60, 0x00, 0xEB, 0xAB, 0x48, 0x40, 0x3B, 0x01, 0x00,
+	 0xFC, 0x01, 0x00, 0xEB, 0x03, 0x60, 0x02, 0x64, 0xA0, 0xDB, 0x0F, 0x64, 0x60, 0x7F, 0xA0, 0x5A,
+	 0x80, 0x60, 0x00, 0xEA, 0xA0, 0x60, 0x00, 0xEA, 0xD1, 0x60, 0x00, 0xEA, 0x24, 0x44, 0xFF, 0xB4,
+	 0x04, 0xFB, 0x50, 0x60, 0x00, 0x64, 0x05, 0xFB, 0x10, 0x60, 0x10, 0x75, 0x2A, 0x60, 0x1D, 0x78,
+	 0xFF, 0xFF, 0x3F, 0x40, 0x40, 0x26, 0x40, 0x00, 0x05, 0x60, 0xF9, 0xF1, 0x42, 0x60, 0x08, 0x64,
+	 0x09, 0x60, 0x19, 0x63, 0x64, 0x40, 0x01, 0x2B, 0x04, 0x00, 0x42, 0x60, 0x09, 0x64, 0x0A, 0x60,
+	 0x19, 0x63, 0x1C, 0x60, 0x0F, 0xFB, 0x04, 0x60, 0x00, 0xBC, 0x1C, 0x60, 0x0B, 0xFB, 0x1C, 0x60,
+	 0x0A, 0xFD, 0x1D, 0x60, 0x19, 0x63, 0x1C, 0x60, 0x0E, 0xFD, 0x80, 0x60, 0x1C, 0x64, 0x3F, 0x40,
+	 0x01, 0x2A, 0x02, 0x00, 0x60, 0x60, 0x1C, 0x64, 0x1C, 0x60, 0x10, 0xFB, 0x1C, 0x60, 0x0C, 0xFB,
+	 0x1C, 0x60, 0x0F, 0xF3, 0xA0, 0x50, 0xA0, 0x50, 0x0B, 0x60, 0xF8, 0x63, 0xA3, 0xD1, 0x38, 0x60,
+	 0x12, 0x61, 0xA1, 0xD3, 0xF8, 0xA3, 0x90, 0x84, 0xA2, 0xDB, 0xA3, 0xD1, 0x59, 0xD3, 0x06, 0xA3,
+	 0x90, 0x84, 0xA2, 0xDB, 0xA3, 0xD1, 0x59, 0xD3, 0xFE, 0xA3, 0x90, 0x84, 0xA2, 0xDB, 0xA3, 0xD1,
+	 0x59, 0xD3, 0xFF, 0xFF, 0x90, 0x84, 0xA2, 0xDB, 0x80, 0x60, 0x58, 0xEC, 0x80, 0x60, 0x00, 0xED,
+	 0x80, 0x60, 0x80, 0xEE, 0x40, 0xEC, 0x00, 0xED, 0x00, 0xEE, 0xC0, 0x60, 0x59, 0xEC, 0xC0, 0x60,
+	 0x07, 0xED, 0xC0, 0x60, 0x8F, 0xEE, 0xAD, 0x4F, 0xFA, 0xB4, 0xA0, 0x5D, 0x00, 0xF3, 0x28, 0xFB,
+	 0x40, 0x44, 0x37, 0x60, 0x7B, 0x7C, 0x20, 0xF9, 0x3F, 0x60, 0x18, 0x7C, 0x21, 0xF9, 0x3F, 0x60,
+	 0x2E, 0x7C, 0x22, 0xF9, 0x3F, 0x60, 0xC5, 0x7C, 0x23, 0xF9, 0x3F, 0x60, 0xD6, 0x7C, 0x24, 0xF9,
+	 0x40, 0x60, 0x00, 0x7C, 0x25, 0xF9, 0x40, 0x60, 0x11, 0x7C, 0x26, 0xF9, 0xD0, 0x60, 0x00, 0xE8,
+	 0x28, 0xE8, 0x44, 0x60, 0x01, 0xE6, 0x10, 0x67, 0x40, 0x52, 0x10, 0x60, 0x04, 0xE6, 0x08, 0x60,
+	 0x06, 0x63, 0xFD, 0x60, 0x0C, 0x65, 0x5B, 0xD3, 0xBF, 0xD1, 0x10, 0x18, 0xC3, 0x83, 0xD4, 0x80,
+	 0xC3, 0x83, 0xF9, 0x02, 0xFA, 0xA3, 0xA3, 0xD3, 0x02, 0x60, 0x00, 0x65, 0xF9, 0xA0, 0xFC, 0xA0,
+	 0x0D, 0x05, 0x04, 0x05, 0x78, 0x43, 0x02, 0x61, 0x29, 0x60, 0xEA, 0x78, 0x21, 0x60, 0x00, 0x65,
+	 0x3F, 0x43, 0x21, 0x60, 0x00, 0x65, 0xC0, 0x60, 0x8F, 0xEE, 0x08, 0x00, 0x02, 0x60, 0x00, 0x65,
+	 0x00, 0x60, 0x00, 0x64, 0x18, 0xFB, 0x3F, 0x43, 0x11, 0x60, 0x10, 0xE6, 0xB7, 0x84, 0x40, 0x5F,
+	 0x37, 0x60, 0xF8, 0x63, 0x3F, 0x40, 0x20, 0x27, 0x06, 0x00, 0x0F, 0x60, 0xFF, 0x64, 0xBD, 0xDB,
+	 0x0F, 0x60, 0xF0, 0x64, 0x03, 0x00, 0x0F, 0x64, 0xBD, 0xDB, 0x00, 0x64, 0xA3, 0xDB, 0x00, 0x60,
+	 0x30, 0xE2, 0x00, 0x60, 0x50, 0xE2, 0x00, 0x60, 0x79, 0xE2, 0x00, 0x60, 0x90, 0xE2, 0x01, 0x60,
+	 0xD0, 0xE2, 0x01, 0x60, 0xF0, 0xE2, 0x01, 0x60, 0xB0, 0xE2, 0x13, 0x64, 0xCB, 0xFB, 0x01, 0x60,
+	 0x67, 0x64, 0x37, 0xFB, 0x00, 0x60, 0x28, 0x64, 0x36, 0xFB, 0x09, 0x60, 0x2A, 0x64, 0xB6, 0xFB,
+	 0x82, 0xFF, 0x92, 0xFF, 0x5C, 0x41, 0x5C, 0x46, 0x5C, 0x47, 0x00, 0xE1, 0xA3, 0x60, 0xF4, 0x63,
+	 0x0C, 0x60, 0x16, 0x64, 0xA0, 0xDD, 0x87, 0xFF, 0x97, 0xFF, 0x0C, 0x60, 0x02, 0x64, 0x40, 0x5A,
+	 0x06, 0xA4, 0x40, 0x5B, 0x5C, 0x5E, 0x16, 0x60, 0xCF, 0xF3, 0x7D, 0xFB, 0x3F, 0x40, 0x01, 0x22,
+	 0x03, 0x00, 0x80, 0x60, 0x37, 0x7C, 0x02, 0x00, 0x80, 0x60, 0x27, 0x7C, 0x1A, 0x60, 0x1F, 0xF9,
+	 0x01, 0x60, 0x06, 0x64, 0xA7, 0xFB, 0x02, 0x60, 0x7F, 0x64, 0x00, 0x60, 0x42, 0x65, 0xD4, 0x84,
+	 0xA8, 0xFB, 0xDC, 0x84, 0xA6, 0xFB, 0x12, 0x60, 0xD8, 0xFB, 0x40, 0x60, 0x58, 0x4E, 0x7D, 0x78,
+	 0xFF, 0xFF, 0x3F, 0x40, 0x40, 0x26, 0x05, 0x00, 0x1C, 0x60, 0x0D, 0xF3, 0x5A, 0xD1, 0xA0, 0x50,
+	 0xA4, 0x52, 0x08, 0x60, 0x00, 0x63, 0xFA, 0x60, 0x00, 0x65, 0xBD, 0xD3, 0xA3, 0xD3, 0x02, 0xA8,
+	 0xD4, 0x80, 0x21, 0x02, 0x20, 0x02, 0x19, 0x60, 0x48, 0xF1, 0xFF, 0xFF, 0x64, 0x40, 0x80, 0x26,
+	 0x1A, 0x00, 0x04, 0xA3, 0xFD, 0x60, 0x0D, 0x65, 0x5B, 0xD3, 0xBF, 0xD1, 0x14, 0x18, 0xC3, 0x83,
+	 0xD4, 0x80, 0xC3, 0x83, 0xF9, 0x02, 0xBF, 0xD3, 0xAD, 0x49, 0xFE, 0xA0, 0x00, 0x64, 0x0C, 0x04,
+	 0x08, 0xB1, 0x20, 0xBC, 0x08, 0x28, 0x18, 0xBC, 0x07, 0x7C, 0x0E, 0x60, 0xDF, 0xF9, 0x05, 0x7C,
+	 0x0E, 0x60, 0xDE, 0xF9, 0x01, 0x00, 0x00, 0x64, 0x0E, 0x60, 0xDD, 0xFB, 0x40, 0x60, 0x95, 0x78,
+	 0xFF, 0xFF, 0x5C, 0x51, 0x3F, 0x41, 0xA5, 0x4C, 0x50, 0x37, 0x0B, 0x00, 0x01, 0xB9, 0x41, 0x5F,
+	 0xB5, 0x60, 0x55, 0xE0, 0x05, 0x60, 0xF9, 0xF1, 0xC0, 0x67, 0x90, 0x84, 0x3F, 0x40, 0x01, 0x26,
+	 0xA0, 0x50, 0x06, 0x60, 0x08, 0xF3, 0x01, 0x60, 0x01, 0x65, 0x01, 0x60, 0x02, 0x7C, 0xD4, 0x80,
+	 0xD0, 0x80, 0x01, 0x03, 0x10, 0x02, 0x5A, 0xD1, 0x5A, 0xD3, 0x3C, 0x60, 0x00, 0x66, 0xE0, 0x87,
+	 0x40, 0x4A, 0x80, 0x60, 0x9E, 0x61, 0x64, 0x44, 0xC8, 0x84, 0x0C, 0x63, 0xAA, 0x46, 0x58, 0xD0,
+	 0xAA, 0x46, 0x59, 0xD8, 0xFB, 0x1F, 0x08, 0x60, 0x00, 0x63, 0xFA, 0x60, 0x00, 0x65, 0xBD, 0xD3,
+	 0xA3, 0xD3, 0x02, 0xA8, 0xD4, 0x80, 0x07, 0x02, 0x06, 0x02, 0x8C, 0x60, 0xBA, 0x61, 0x3C, 0x60,
+	 0x00, 0x66, 0x41, 0x4B, 0x03, 0x00, 0x46, 0x60, 0x3B, 0x78, 0xFF, 0xFF, 0x2B, 0x41, 0x8D, 0x60,
+	 0x02, 0x7C, 0xD1, 0x80, 0xA1, 0xD2, 0x25, 0x05, 0x59, 0xD0, 0x60, 0x45, 0x59, 0xD2, 0x44, 0x47,
+	 0xE0, 0x87, 0x40, 0x4A, 0x59, 0xD2, 0x59, 0x8B, 0x40, 0x4C, 0x08, 0x60, 0x00, 0x63, 0xBE, 0xD3,
+	 0xBD, 0xD1, 0xEC, 0x18, 0xD4, 0x80, 0xEA, 0x18, 0x03, 0x03, 0xC3, 0x83, 0xC3, 0x83, 0xF7, 0x01,
+	 0x67, 0x44, 0xC0, 0x84, 0xE0, 0x85, 0x2C, 0x44, 0xD4, 0x80, 0x63, 0x41, 0x01, 0x06, 0x65, 0x44,
+	 0xC8, 0x83, 0xAA, 0x46, 0x59, 0xD1, 0x27, 0xD8, 0x5A, 0x87, 0xFC, 0x1F, 0xAA, 0x46, 0x2B, 0x41,
+	 0xD5, 0x01, 0x8D, 0x60, 0x02, 0x61, 0x41, 0x4B, 0x2B, 0x41, 0x8D, 0x60, 0x02, 0x7C, 0xD1, 0x80,
+	 0xA1, 0xD2, 0x27, 0x05, 0x59, 0xD0, 0x60, 0x45, 0x59, 0xD2, 0x44, 0x47, 0xE0, 0x87, 0x40, 0x4A,
+	 0x59, 0xD2, 0x59, 0x8B, 0x40, 0x4C, 0x08, 0x60, 0x00, 0x63, 0xBE, 0xD3, 0xBD, 0xD1, 0xEC, 0x18,
+	 0xD4, 0x80, 0xEA, 0x18, 0x03, 0x03, 0xC3, 0x83, 0xC3, 0x83, 0xF7, 0x01, 0x04, 0xA3, 0xA3, 0xD1,
+	 0x5A, 0x88, 0x2C, 0x43, 0xD3, 0x80, 0xFF, 0xFF, 0x01, 0x06, 0x64, 0x43, 0xCF, 0x83, 0xAA, 0x46,
+	 0x60, 0xFE, 0x28, 0xD1, 0x5E, 0x88, 0x27, 0xD8, 0x5A, 0x87, 0xFB, 0x1F, 0x20, 0xFE, 0xAA, 0x46,
+	 0xD3, 0x01, 0x07, 0x60, 0xEC, 0xF3, 0x20, 0x60, 0x00, 0x7C, 0x08, 0xB0, 0x10, 0xB0, 0x05, 0x02,
+	 0x04, 0x03, 0x07, 0x60, 0xEB, 0xF9, 0x07, 0x60, 0xEA, 0xF9, 0x02, 0xB0, 0x04, 0xB0, 0x0F, 0x02,
+	 0x13, 0x60, 0xD2, 0xF3, 0x0C, 0x03, 0x02, 0xBC, 0xA2, 0xDB, 0x14, 0x60, 0x65, 0xF3, 0x14, 0x60,
+	 0x29, 0xF3, 0x02, 0xBD, 0x02, 0xBC, 0xA2, 0xDB, 0x65, 0x44, 0x14, 0x60, 0x65, 0xFB, 0x07, 0x60,
+	 0xEC, 0xF3, 0x31, 0x41, 0x60, 0x40, 0x20, 0x2A, 0x40, 0xB9, 0x40, 0x26, 0x03, 0x00, 0x60, 0x40,
+	 0x01, 0x26, 0x80, 0xB9, 0x41, 0x51, 0xFA, 0x60, 0x3A, 0x65, 0x46, 0x60, 0x58, 0x4D, 0x4E, 0x78,
+	 0xFF, 0xFF, 0x03, 0x02, 0x44, 0x60, 0xAD, 0x78, 0xFF, 0xFF, 0x5B, 0xD3, 0xF8, 0x60, 0x3F, 0x65,
+	 0x00, 0x7F, 0xE0, 0x84, 0xE0, 0x84, 0x14, 0x60, 0x74, 0xF3, 0xE0, 0x9C, 0xA4, 0x84, 0xB0, 0x84,
+	 0xA2, 0xDB, 0x5A, 0xD3, 0xFF, 0xFF, 0xA4, 0x84, 0xB0, 0x84, 0xA2, 0xDB, 0xBD, 0xD3, 0xFF, 0xFF,
+	 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0xE0, 0x84, 0x14, 0x60, 0x77, 0xF3, 0xE0, 0x9C, 0xA4, 0x84,
+	 0xB0, 0x84, 0xA2, 0xDB, 0x5A, 0xD3, 0xFF, 0xFF, 0xA4, 0x84, 0xB0, 0x84, 0xA2, 0xDB, 0x28, 0x60,
+	 0xF4, 0x61, 0xA3, 0xD3, 0xFF, 0xFF, 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0xE0, 0x84, 0xA1, 0xD3,
+	 0xE0, 0x9C, 0xA4, 0x84, 0xB0, 0x84, 0xA1, 0xDB, 0xA3, 0xD3, 0xFF, 0xFF, 0x00, 0x7F, 0xE0, 0x84,
+	 0xE0, 0x84, 0x59, 0xD3, 0xE0, 0x9C, 0xA4, 0x84, 0xB0, 0x84, 0xA1, 0xDB, 0x14, 0x60, 0x7D, 0xF3,
+	 0xFF, 0xFF, 0xA4, 0x84, 0xB0, 0x84, 0xA2, 0xDB, 0x5A, 0xD3, 0xFF, 0xFF, 0xA4, 0x84, 0xB0, 0x84,
+	 0xA2, 0xDB, 0x14, 0x60, 0x80, 0xF3, 0xFF, 0xFF, 0xA4, 0x84, 0xB0, 0x84, 0xA2, 0xDB, 0x5A, 0xD3,
+	 0xFF, 0xFF, 0xA4, 0x84, 0xB0, 0x84, 0xA2, 0xDB, 0x14, 0x60, 0x83, 0xF3, 0xFF, 0xFF, 0xA4, 0x84,
+	 0xB0, 0x84, 0xA2, 0xDB, 0x5A, 0xD3, 0xFF, 0xFF, 0xA4, 0x84, 0xB0, 0x84, 0xA2, 0xDB, 0xA3, 0xD3,
+	 0xFF, 0xFF, 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0xE0, 0x84, 0x14, 0x60, 0x86, 0xF3, 0xE0, 0x9C,
+	 0xA4, 0x84, 0xB0, 0x84, 0xA2, 0xDB, 0x5A, 0xD3, 0xFF, 0xFF, 0xA4, 0x84, 0xB0, 0x84, 0xA2, 0xDB,
+	 0x14, 0x60, 0x89, 0xF3, 0xFF, 0xFF, 0xA4, 0x84, 0xB0, 0x84, 0xA2, 0xDB, 0x5A, 0xD3, 0xFF, 0xFF,
+	 0xA4, 0x84, 0xB0, 0x84, 0xA2, 0xDB, 0x14, 0x60, 0x8C, 0xF3, 0xFF, 0xFF, 0xA4, 0x84, 0xB0, 0x84,
+	 0xA2, 0xDB, 0x5A, 0xD3, 0xFF, 0xFF, 0xA4, 0x84, 0xB0, 0x84, 0xA2, 0xDB, 0x02, 0xA3, 0xA3, 0xD3,
+	 0xF8, 0x60, 0x3F, 0x65, 0x00, 0x7F, 0xE0, 0x84, 0xE0, 0x84, 0x14, 0x60, 0x8F, 0xF3, 0xE0, 0x9C,
+	 0xA4, 0x84, 0xB0, 0x84, 0xA2, 0xDB, 0x5A, 0xD3, 0xFF, 0xFF, 0xA4, 0x84, 0xB0, 0x84, 0xA2, 0xDB,
+	 0xBD, 0xD3, 0xFF, 0xFF, 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0xE0, 0x84, 0x14, 0x60, 0x92, 0xF3,
+	 0xE0, 0x9C, 0xA4, 0x84, 0xB0, 0x84, 0xA2, 0xDB, 0x5A, 0xD3, 0xFF, 0xFF, 0xA4, 0x84, 0xB0, 0x84,
+	 0xA2, 0xDB, 0x29, 0x60, 0x2A, 0x61, 0xA3, 0xD3, 0xFF, 0xFF, 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84,
+	 0xE0, 0x84, 0xA1, 0xD3, 0xE0, 0x9C, 0xA4, 0x84, 0xB0, 0x84, 0xA1, 0xDB, 0xA3, 0xD3, 0xFF, 0xFF,
+	 0x00, 0x7F, 0xE0, 0x84, 0xE0, 0x84, 0x59, 0xD3, 0xE0, 0x9C, 0xA4, 0x84, 0xB0, 0x84, 0xA1, 0xDB,
+	 0x14, 0x60, 0x98, 0xF3, 0xFF, 0xFF, 0xA4, 0x84, 0xB0, 0x84, 0xA2, 0xDB, 0x5A, 0xD3, 0xFF, 0xFF,
+	 0xA4, 0x84, 0xB0, 0x84, 0xA2, 0xDB, 0x14, 0x60, 0x9B, 0xF3, 0xFF, 0xFF, 0xA4, 0x84, 0xB0, 0x84,
+	 0xA2, 0xDB, 0x5A, 0xD3, 0xFF, 0xFF, 0xA4, 0x84, 0xB0, 0x84, 0xA2, 0xDB, 0x14, 0x60, 0x9E, 0xF3,
+	 0xFF, 0xFF, 0xA4, 0x84, 0xB0, 0x84, 0xA2, 0xDB, 0x5A, 0xD3, 0xFF, 0xFF, 0xA4, 0x84, 0xB0, 0x84,
+	 0xA2, 0xDB, 0xA3, 0xD3, 0xFF, 0xFF, 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0xE0, 0x84, 0x14, 0x60,
+	 0xA1, 0xF3, 0xE0, 0x9C, 0xA4, 0x84, 0xB0, 0x84, 0xA2, 0xDB, 0x5A, 0xD3, 0xFF, 0xFF, 0xA4, 0x84,
+	 0xB0, 0x84, 0xA2, 0xDB, 0x14, 0x60, 0xA4, 0xF3, 0xFF, 0xFF, 0xA4, 0x84, 0xB0, 0x84, 0xA2, 0xDB,
+	 0x5A, 0xD3, 0xFF, 0xFF, 0xA4, 0x84, 0xB0, 0x84, 0xA2, 0xDB, 0x14, 0x60, 0xA7, 0xF3, 0xFF, 0xFF,
+	 0xA4, 0x84, 0xB0, 0x84, 0xA2, 0xDB, 0x5A, 0xD3, 0xFF, 0xFF, 0xA4, 0x84, 0xB0, 0x84, 0xA2, 0xDB,
+	 0x00, 0x60, 0x6A, 0x63, 0x29, 0x60, 0x50, 0x61, 0x28, 0x60, 0xE4, 0x64, 0x58, 0xD1, 0x59, 0xD9,
+	 0xFD, 0x1F, 0x14, 0x60, 0xB0, 0xF3, 0xFF, 0xFF, 0x18, 0xAC, 0xA2, 0xDB, 0x5A, 0xD3, 0xFF, 0xFF,
+	 0x18, 0xAC, 0xA2, 0xDB, 0x14, 0x60, 0xB4, 0xF3, 0xFF, 0xFF, 0x18, 0xAC, 0xA2, 0xDB, 0x14, 0x60,
+	 0xB6, 0xF3, 0xFF, 0xFF, 0x18, 0xAC, 0xA2, 0xDB, 0x14, 0x60, 0xBD, 0xF3, 0xFF, 0xFF, 0x18, 0xAC,
+	 0xA2, 0xDB, 0x14, 0x60, 0xBF, 0xF3, 0xFF, 0xFF, 0x18, 0xAC, 0xA2, 0xDB, 0x14, 0x60, 0xCB, 0xF3,
+	 0xFF, 0xFF, 0x18, 0xAC, 0xA2, 0xDB, 0x5A, 0xD3, 0xFF, 0xFF, 0x18, 0xAC, 0xA2, 0xDB, 0x14, 0x60,
+	 0xCF, 0xF3, 0xFF, 0xFF, 0x18, 0xAC, 0xA2, 0xDB, 0x14, 0x60, 0xD1, 0xF3, 0xFF, 0xFF, 0x18, 0xAC,
+	 0xA2, 0xDB, 0x14, 0x60, 0xD8, 0xF3, 0xFF, 0xFF, 0x18, 0xAC, 0xA2, 0xDB, 0x14, 0x60, 0xDA, 0xF3,
+	 0xFF, 0xFF, 0x18, 0xAC, 0xA2, 0xDB, 0xFA, 0x60, 0x2C, 0x65, 0x46, 0x60, 0x58, 0x4D, 0x4E, 0x78,
+	 0xFF, 0xFF, 0x0E, 0x03, 0x63, 0x45, 0x2A, 0x60, 0xEA, 0x63, 0x06, 0x61, 0xA5, 0xD1, 0xDA, 0x85,
+	 0x64, 0x44, 0x0F, 0xB4, 0xBD, 0xDB, 0x64, 0x47, 0x0F, 0xB4, 0xCD, 0x81, 0xBD, 0xDB, 0xF6, 0x02,
+	 0xFA, 0x60, 0x30, 0x65, 0x46, 0x60, 0x58, 0x4D, 0x4E, 0x78, 0xFF, 0xFF, 0x14, 0x03, 0xBD, 0xD3,
+	 0x63, 0x46, 0x2B, 0x60, 0x82, 0x63, 0x15, 0x60, 0xD0, 0xFB, 0xDA, 0x85, 0xBD, 0xDB, 0x0E, 0x61,
+	 0xA6, 0xD1, 0xDA, 0x86, 0x64, 0x44, 0xFF, 0xB4, 0xA5, 0xDB, 0xDA, 0x85, 0x64, 0x47, 0xFF, 0xB4,
+	 0xCD, 0x81, 0xBD, 0xDB, 0xF5, 0x02, 0xFA, 0x60, 0x31, 0x65, 0x46, 0x60, 0x58, 0x4D, 0x4E, 0x78,
+	 0xFF, 0xFF, 0x22, 0x03, 0xBD, 0xD3, 0x15, 0x60, 0xEE, 0xFB, 0x5A, 0x81, 0x15, 0x60, 0xFD, 0xFB,
+	 0x5A, 0x82, 0x16, 0x60, 0x0C, 0xFB, 0x5A, 0x83, 0x16, 0x60, 0x1B, 0xFB, 0x5A, 0x84, 0x0E, 0x61,
+	 0xBD, 0xD1, 0xBD, 0xD5, 0x64, 0x44, 0xFF, 0xB4, 0x21, 0xDB, 0x5A, 0x81, 0x64, 0x47, 0xFF, 0xB4,
+	 0x22, 0xDB, 0x5A, 0x82, 0x66, 0x44, 0xFF, 0xB4, 0x23, 0xDB, 0x5A, 0x83, 0x66, 0x47, 0xFF, 0xB4,
+	 0x24, 0xDB, 0xCD, 0x81, 0x5A, 0x84, 0xEC, 0x02, 0xFA, 0x60, 0x47, 0x65, 0x46, 0x60, 0x58, 0x4D,
+	 0x4E, 0x78, 0xFF, 0xFF, 0x11, 0x03, 0x63, 0x45, 0x2C, 0x60, 0x54, 0x63, 0xA5, 0xD1, 0xDA, 0x85,
+	 0xBD, 0xD9, 0x02, 0x61, 0xA5, 0xD1, 0xDA, 0x85, 0x64, 0x47, 0x00, 0x7E, 0xBD, 0xDB, 0x64, 0x44,
+	 0x00, 0x7E, 0xCD, 0x81, 0xBD, 0xDB, 0xF6, 0x02, 0xFA, 0x60, 0x2E, 0x65, 0x46, 0x60, 0x58, 0x4D,
+	 0x4E, 0x78, 0xFF, 0xFF, 0x1F, 0x03, 0x63, 0x46, 0xFC, 0xA3, 0xA3, 0xD3, 0x2B, 0x60, 0x02, 0x63,
+	 0xCC, 0x84, 0xE8, 0x84, 0xCC, 0x81, 0x00, 0x36, 0x0D, 0x00, 0x63, 0x45, 0xA6, 0xD3, 0x5A, 0xD1,
+	 0xDA, 0x86, 0xFF, 0xB4, 0xE0, 0x84, 0xC4, 0x84, 0x5C, 0x90, 0xBD, 0xD9, 0xFD, 0x02, 0xCD, 0x81,
+	 0x66, 0x42, 0xF4, 0x02, 0x66, 0x42, 0x5A, 0xD3, 0x2B, 0x60, 0x42, 0x65, 0xBD, 0xDB, 0xD7, 0x80,
+	 0xFF, 0xFF, 0xFC, 0x02, 0x2C, 0x60, 0x68, 0x61, 0xFA, 0x60, 0x46, 0x65, 0x46, 0x60, 0x58, 0x4D,
+	 0x4E, 0x78, 0xFF, 0xFF, 0x01, 0x03, 0xA1, 0xDD, 0xD9, 0x81, 0xFA, 0x60, 0x2F, 0x65, 0x46, 0x60,
+	 0x58, 0x4D, 0x4E, 0x78, 0xFF, 0xFF, 0x01, 0x03, 0xA1, 0xDD, 0xD9, 0x81, 0xFA, 0x60, 0x3E, 0x65,
+	 0x46, 0x60, 0x58, 0x4D, 0x4E, 0x78, 0xFF, 0xFF, 0x01, 0x03, 0xA1, 0xDD, 0xD9, 0x81, 0xFA, 0x60,
+	 0x3F, 0x65, 0x46, 0x60, 0x58, 0x4D, 0x4E, 0x78, 0xFF, 0xFF, 0x01, 0x03, 0xA1, 0xDD, 0xD9, 0x81,
+	 0xFA, 0x60, 0x40, 0x65, 0x46, 0x60, 0x58, 0x4D, 0x4E, 0x78, 0xFF, 0xFF, 0x01, 0x03, 0xA1, 0xDD,
+	 0xD9, 0x81, 0xFA, 0x60, 0x3B, 0x65, 0x46, 0x60, 0x58, 0x4D, 0x4E, 0x78, 0xFF, 0xFF, 0x01, 0x03,
+	 0xA1, 0xDD, 0xFA, 0x60, 0x48, 0x65, 0x46, 0x60, 0x58, 0x4D, 0x4E, 0x78, 0xFF, 0xFF, 0x10, 0x03,
+	 0xBD, 0xD3, 0x2C, 0x60, 0xC4, 0x61, 0x0E, 0xB4, 0xBD, 0xD1, 0xA1, 0xDB, 0x64, 0x47, 0x0E, 0xB4,
+	 0xA3, 0xD1, 0x59, 0xDB, 0x64, 0x44, 0x0E, 0xB4, 0x59, 0xDB, 0x64, 0x47, 0x0E, 0xB4, 0x59, 0xDB,
+	 0xFA, 0x60, 0x29, 0x65, 0x46, 0x60, 0x58, 0x4D, 0x4E, 0x78, 0xFF, 0xFF, 0x07, 0x03, 0x04, 0xA3,
+	 0xA3, 0xD3, 0x20, 0x60, 0x00, 0x65, 0xB4, 0x84, 0x13, 0x60, 0xA6, 0xFB, 0xFA, 0x60, 0x2A, 0x65,
+	 0x46, 0x60, 0x58, 0x4D, 0x4E, 0x78, 0xFF, 0xFF, 0x30, 0x03, 0x04, 0xA3, 0xBD, 0xD1, 0x14, 0x60,
+	 0x4A, 0xF3, 0x64, 0x41, 0x64, 0x5E, 0xA2, 0xDB, 0x64, 0x47, 0x5A, 0xD3, 0x60, 0x5C, 0x64, 0x5F,
+	 0xA2, 0xDB, 0x14, 0x60, 0x60, 0xF3, 0xFF, 0x60, 0xC0, 0xB5, 0x61, 0x40, 0x80, 0x27, 0x05, 0x00,
+	 0xE9, 0x87, 0x3F, 0xB4, 0xB4, 0x84, 0xA2, 0xDB, 0x15, 0x00, 0x65, 0x44, 0xA2, 0xDB, 0xE1, 0x80,
+	 0xF9, 0x87, 0x01, 0x7F, 0x14, 0x60, 0x63, 0xF3, 0x60, 0x41, 0xE0, 0x84, 0xE0, 0x84, 0xE9, 0x81,
+	 0xF8, 0x84, 0xE9, 0x81, 0xF8, 0x84, 0xA2, 0xDB, 0x4A, 0xD3, 0xFF, 0x60, 0x80, 0x65, 0xA4, 0x84,
+	 0x34, 0x94, 0xA2, 0xDB, 0xDB, 0x83, 0x14, 0x60, 0xDF, 0xFD, 0xFA, 0x60, 0x2B, 0x65, 0x46, 0x60,
+	 0x58, 0x4D, 0x4E, 0x78, 0xFF, 0xFF, 0x07, 0x03, 0x04, 0xA3, 0xBD, 0xD3, 0x14, 0x60, 0x4D, 0xFB,
+	 0xA3, 0xD3, 0x14, 0x60, 0x11, 0xFB, 0xFA, 0x60, 0x3C, 0x65, 0x46, 0x60, 0x58, 0x4D, 0x4E, 0x78,
+	 0xFF, 0xFF, 0x1F, 0x03, 0xA3, 0xD3, 0xFC, 0x60, 0xFC, 0x65, 0xA4, 0x84, 0x60, 0x5C, 0x00, 0x7E,
+	 0xC0, 0x60, 0x00, 0xA0, 0x60, 0x43, 0x07, 0x04, 0x14, 0x60, 0x51, 0xF3, 0xFF, 0xFF, 0x03, 0x60,
+	 0xFF, 0xB4, 0x3C, 0x94, 0xA2, 0xDB, 0x28, 0x60, 0x2A, 0x61, 0x64, 0x44, 0x00, 0x7F, 0xC0, 0xA0,
+	 0x60, 0x47, 0x07, 0x04, 0x60, 0x43, 0xA1, 0xD3, 0xFF, 0xFF, 0x03, 0x60, 0xFF, 0xB4, 0x3C, 0x94,
+	 0xA1, 0xDB, 0xFA, 0x60, 0x49, 0x65, 0x46, 0x60, 0x58, 0x4D, 0x4E, 0x78, 0xFF, 0xFF, 0x1B, 0x03,
+	 0x32, 0x60, 0xAB, 0x61, 0x1C, 0x7C, 0x60, 0xFE, 0xA3, 0xD3, 0x5D, 0xD3, 0x0F, 0xB5, 0xD4, 0x84,
+	 0xA1, 0xDB, 0xBD, 0xD3, 0xFF, 0xFF, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0x5D, 0xD3,
+	 0x0F, 0xB5, 0xD4, 0x84, 0xA1, 0xDB, 0x67, 0x44, 0xC0, 0x9C, 0x64, 0x40, 0x00, 0x36, 0x10, 0x00,
+	 0x64, 0x40, 0x0E, 0x3A, 0xE9, 0x01, 0x20, 0xFE, 0xFA, 0x60, 0x4A, 0x65, 0x46, 0x60, 0x58, 0x4D,
+	 0x4E, 0x78, 0xFF, 0xFF, 0x05, 0x03, 0x32, 0x60, 0xC7, 0x61, 0x0E, 0x7C, 0x60, 0xFE, 0xDC, 0x01,
+	 0x20, 0xFE, 0xB8, 0xFE, 0xB9, 0xFE, 0xBA, 0xFE, 0xBB, 0xFE, 0xBD, 0xFE, 0xBF, 0xFE, 0x19, 0x60,
+	 0x48, 0xF3, 0x12, 0x63, 0x60, 0x40, 0x01, 0x27, 0x04, 0x00, 0x0B, 0x60, 0xEA, 0x62, 0x5A, 0xDF,
+	 0xFE, 0x1F, 0x41, 0x60, 0x6B, 0x78, 0xFF, 0xFF, 0x08, 0x60, 0x06, 0x63, 0xBE, 0xD3, 0xBD, 0xD1,
+	 0x07, 0x18, 0xD4, 0x80, 0x05, 0x18, 0x03, 0x03, 0xC3, 0x83, 0xC3, 0x83, 0xF7, 0x01, 0xDB, 0x83,
+	 0x00, 0xBC, 0x2D, 0x58, 0xFF, 0xFF, 0x86, 0xFD, 0xAA, 0x2D, 0x00, 0x00, 0x06, 0x00, 0x10, 0xFD,
+	 0x6E, 0x01, 0x00, 0x00, 0x02, 0x00, 0x14, 0xFD, 0x8E, 0x32, 0x00, 0x00, 0x0A, 0x00, 0x41, 0xFA,
+	 0x40, 0x2A, 0x00, 0x00, 0x22, 0x00, 0x42, 0xFA, 0x62, 0x2A, 0x00, 0x00, 0x22, 0x00, 0x43, 0xFA,
+	 0x84, 0x2A, 0x00, 0x00, 0x22, 0x00, 0x44, 0xFA, 0xA6, 0x2A, 0x00, 0x00, 0x22, 0x00, 0x45, 0xFA,
+	 0xC8, 0x2A, 0x00, 0x00, 0x22, 0x00, 0x25, 0xFD, 0x9E, 0x01, 0x00, 0x00, 0x02, 0x00,
+
+};  /* fw_image_3_data */
+
+static const hcf_8 fw_image_4_data[] = {
+	 0x6C, 0x40, 0xA1, 0xFF, 0x98, 0xFF, 0x80, 0x3E, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x41, 0xFF, 0x33, 0xF3, 0x02, 0x11, 0x31, 0x18, 0x1E, 0x00, 0x44, 0xFF, 0x2E, 0x00, 0xFF, 0xFF,
+	 0xC4, 0xE2, 0x27, 0x44, 0x20, 0x2A, 0x01, 0x00, 0xFF, 0xFF, 0x42, 0x64, 0x3A, 0xDB, 0x23, 0x00,
+	 0x41, 0xFF, 0xA2, 0x60, 0x45, 0x78, 0xE2, 0xFE, 0x40, 0x49, 0x02, 0x60, 0x01, 0xE1, 0x1D, 0x00,
+	 0x44, 0xFF, 0x1B, 0x09, 0x29, 0x44, 0x10, 0x2A, 0x04, 0x74, 0xCD, 0xE2, 0x10, 0x65, 0x0B, 0x00,
+	 0xA3, 0x60, 0xC1, 0x78, 0xA4, 0xE2, 0x29, 0x44, 0x20, 0x2A, 0x0D, 0x00, 0x20, 0xAC, 0xEC, 0x01,
+	 0xA3, 0x60, 0xC1, 0x78, 0x46, 0xFF, 0xB4, 0x84, 0x40, 0x49, 0xA1, 0xFF, 0xFF, 0xFF, 0x80, 0x3E,
+	 0xA3, 0x60, 0xC1, 0x78, 0xFF, 0xFF, 0x62, 0xFF, 0x08, 0xE1, 0xA1, 0xFF, 0x98, 0xFF, 0x80, 0x3E,
+	 0xAA, 0x60, 0xA5, 0x78, 0x4C, 0x4E, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xAA, 0x60, 0xB3, 0x78, 0x44, 0xE2, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xC4, 0xE2, 0x84, 0xFF, 0x22, 0x58, 0x82, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xA4, 0x60, 0x39, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xA1, 0xFF, 0xFF, 0xFF, 0xE1, 0x01, 0xFF, 0xFF,
+	 0x10, 0x29, 0xFA, 0x01, 0xE4, 0xE2, 0xAA, 0x60, 0x5F, 0x78, 0xB2, 0xF3, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xC1, 0x60, 0xFC, 0x78, 0x64, 0xE2, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xAA, 0x60, 0x46, 0x78, 0xAC, 0xE2, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x80, 0x29, 0xE2, 0x01, 0xAA, 0x60, 0xA2, 0x78, 0x47, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xB5, 0x60, 0x5C, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xB5, 0x60, 0x94, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xB3, 0x60, 0xC9, 0x78, 0x42, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xB3, 0x60, 0xFC, 0x78, 0x43, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xB3, 0x60, 0xFC, 0x78, 0x44, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xB7, 0x60, 0x20, 0x78, 0x45, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xB3, 0x60, 0xFF, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x00, 0x60, 0x83, 0x64, 0x80, 0x29, 0x09, 0xFB, 0xB5, 0x60, 0x25, 0x78, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x98, 0xFF, 0x3A, 0x60, 0x18, 0x78, 0x40, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x39, 0x60, 0x8F, 0x78, 0x98, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xC0, 0x60, 0x67, 0x78, 0x98, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xBF, 0x60, 0xE1, 0x78, 0x98, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xB7, 0x60, 0xE9, 0x78, 0x98, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xA1, 0xFF, 0x98, 0xFF, 0x83, 0x3E, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xC3, 0x60, 0x4D, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x01,
+	 0x41, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x01,
+	 0x42, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x01,
+	 0xB0, 0xFF, 0xB1, 0xFF, 0x40, 0xFF, 0x43, 0xFF, 0xC3, 0x60, 0x48, 0x78, 0x44, 0xFF, 0xFF, 0x01,
+	 0xC3, 0x60, 0x4D, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x01,
+	 0x3E, 0x60, 0x8C, 0x78, 0x45, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x01,
+	 0xC3, 0x60, 0x48, 0x78, 0x84, 0xE2, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x01,
+	 0xC3, 0x60, 0x47, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x01,
+	 0xCA, 0x60, 0xC8, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xF3, 0x60, 0x9A, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x42, 0xFF, 0xA1, 0xFF, 0xFF, 0xFF, 0x85, 0x3E, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xCA, 0x60, 0xD0, 0x78, 0x24, 0xE2, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xF2, 0x60, 0x47, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xCA, 0x60, 0xD0, 0x78, 0x44, 0xE2, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xCA, 0x60, 0xD0, 0x78, 0x84, 0xE2, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0xCA, 0x60, 0xD0, 0x78, 0x47, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x29, 0x60, 0xF2, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x2A, 0x60, 0x20, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x2A, 0x60, 0x3E, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x2A, 0x60, 0x1D, 0x78, 0x28, 0xE2, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x2A, 0x60, 0x1D, 0x78, 0x44, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x2A, 0x60, 0x1D, 0x78, 0x45, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x2A, 0x60, 0x1D, 0x78, 0x46, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x00, 0x60, 0x87, 0x64, 0x80, 0x29, 0x09, 0xFB, 0x47, 0xFF, 0x2A, 0x60, 0x1D, 0x78, 0xFF, 0xFF,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x43, 0xF7, 0xA7, 0xFF, 0x41, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x37, 0x60, 0x82, 0x78, 0x42, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	 0x36, 0x60, 0x8F, 0x78, 0x47, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	 0x41, 0xFF, 0x00, 0x60, 0x03, 0xE1, 0x21, 0x46, 0x66, 0x45, 0x00, 0xF4, 0x2E, 0x44, 0x09, 0xFA,
+	 0x6A, 0x61, 0x7F, 0x60, 0xFE, 0x63, 0xA1, 0xFF, 0x9A, 0xFF, 0x05, 0x11, 0x0A, 0x00, 0x00, 0xF4,
+	 0x01, 0xF2, 0x17, 0x18, 0x7A, 0x61, 0x02, 0x25, 0x04, 0x00, 0x6C, 0x44, 0x7A, 0xDA, 0xFB, 0x1C,
+	 0xF6, 0x11, 0xD9, 0x81, 0x41, 0xFF, 0x02, 0x1C, 0x00, 0xF4, 0xDA, 0x82, 0x41, 0xFF, 0xC9, 0x81,
+	 0xCB, 0x83, 0x6C, 0x44, 0x5A, 0xDA, 0x02, 0x1C, 0x00, 0xF4, 0x81, 0xF2, 0x6C, 0x44, 0x5A, 0xDA,
+	 0xCB, 0x83, 0x02, 0x74, 0x02, 0x60, 0x04, 0xE1, 0x80, 0x60, 0x00, 0x61, 0x5D, 0x93, 0xB5, 0xFF,
+	 0x98, 0xFF, 0x26, 0x44, 0xFD, 0xB4, 0x84, 0xBC, 0x40, 0x46, 0x65, 0x46, 0x00, 0x64, 0x23, 0xFA,
+	 0x3F, 0xFC, 0x63, 0x47, 0x0A, 0x63, 0x0F, 0xFC, 0x00, 0xF4, 0x08, 0xFA, 0xCB, 0xFE, 0x18, 0xE1,
+	 0x44, 0xFF, 0xA1, 0xFF, 0x98, 0xFF, 0x80, 0x3E, 0xE2, 0xFE, 0x03, 0x04, 0xA3, 0x60, 0x05, 0x78,
+	 0xFF, 0xFF, 0xE0, 0xFE, 0x03, 0x04, 0xA3, 0x60, 0x1B, 0x78, 0xFF, 0xFF, 0xE1, 0xFE, 0x07, 0x05,
+	 0x9F, 0xFE, 0x03, 0x04, 0x3A, 0x60, 0x77, 0x78, 0xFF, 0xFF, 0x43, 0xFF, 0xA9, 0x01, 0x95, 0xF3,
+	 0xFF, 0xFF, 0x80, 0xB4, 0xFF, 0xFF, 0x08, 0x24, 0x16, 0x00, 0x29, 0x44, 0x08, 0x26, 0xE1, 0x01,
+	 0x72, 0x44, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xB2, 0xF3, 0xE8, 0x85,
+	 0xFF, 0xB7, 0xE0, 0x84, 0xE0, 0x84, 0xB4, 0x85, 0x73, 0x44, 0xD4, 0x84, 0x10, 0x65, 0xD4, 0x80,
+	 0xFF, 0xFF, 0x01, 0x05, 0x8F, 0x00, 0x80, 0x60, 0x01, 0xE0, 0xD5, 0x60, 0x84, 0xE7, 0xA1, 0xF3,
+	 0x7C, 0x45, 0x60, 0x40, 0x01, 0x23, 0x02, 0x65, 0x8C, 0x60, 0x48, 0x6A, 0xFF, 0xFF, 0x01, 0x16,
+	 0xFE, 0x01, 0x00, 0x60, 0x00, 0x6A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x00, 0x60, 0x7F, 0x6A,
+	 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x84, 0x60, 0x04, 0x6A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01,
+	 0x48, 0x60, 0x08, 0x6A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x65, 0x4A, 0xFF, 0xFF, 0x01, 0x16,
+	 0xFE, 0x01, 0x84, 0x60, 0x04, 0x6A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x40, 0x60, 0x08, 0x6A,
+	 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x65, 0x4A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x95, 0x60,
+	 0x84, 0xE7, 0xBD, 0xFE, 0x0C, 0x60, 0x00, 0x62, 0x00, 0x60, 0x71, 0x7C, 0x00, 0x60, 0xB1, 0x65,
+	 0x3D, 0x60, 0x58, 0x4D, 0x0F, 0x78, 0xFF, 0xFF, 0x08, 0xE1, 0x62, 0xFF, 0xA3, 0xFF, 0xFF, 0xFF,
+	 0xA2, 0xFF, 0x02, 0x60, 0x08, 0xE1, 0xAE, 0x4F, 0x02, 0xBC, 0x00, 0x7F, 0xA0, 0x5E, 0x3F, 0x40,
+	 0x40, 0x26, 0x09, 0x00, 0x1C, 0x60, 0x09, 0xF3, 0x5A, 0xD1, 0xA0, 0x50, 0xA4, 0x52, 0x5A, 0xD3,
+	 0x5A, 0xD1, 0xA0, 0x50, 0xA4, 0x50, 0xDB, 0xF3, 0xF1, 0xF1, 0x01, 0xA8, 0x07, 0xA8, 0x0A, 0x03,
+	 0x09, 0x03, 0x64, 0x40, 0x01, 0x26, 0x09, 0x00, 0x1B, 0x60, 0xF3, 0xF3, 0xFF, 0xFF, 0x01, 0xB4,
+	 0xFF, 0xFF, 0x03, 0x02, 0xAD, 0x4F, 0xFA, 0xB4, 0xA0, 0x5D, 0x19, 0x60, 0xF6, 0xF1, 0x89, 0xFF,
+	 0x32, 0x40, 0x80, 0x2A, 0x1E, 0x00, 0x31, 0x40, 0x01, 0x2A, 0x1B, 0x00, 0x12, 0x60, 0xFF, 0xF3,
+	 0xFF, 0xFF, 0x00, 0xA8, 0x60, 0x46, 0x05, 0x03, 0x0E, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x2A,
+	 0x10, 0x00, 0x13, 0x60, 0x02, 0xF3, 0xFF, 0xFF, 0x00, 0xA8, 0x60, 0x46, 0x03, 0x03, 0x0F, 0xF2,
+	 0xFF, 0xFF, 0x07, 0x1B, 0x64, 0x40, 0x01, 0x26, 0x03, 0x00, 0x08, 0x60, 0x00, 0x75, 0x01, 0x00,
+	 0x10, 0xFF, 0x88, 0xFF, 0xA2, 0x60, 0x41, 0x78, 0xFF, 0xFF, 0x21, 0x46, 0x01, 0x5D, 0x5C, 0x62,
+	 0x03, 0xE1, 0x44, 0xFF, 0xA1, 0xFF, 0x9A, 0xFF, 0x7A, 0xDC, 0x7A, 0xDC, 0x7A, 0xDC, 0x62, 0x62,
+	 0x7A, 0xDC, 0x7A, 0xDC, 0x7A, 0xDC, 0xA1, 0xFF, 0x5A, 0xDC, 0x12, 0xE1, 0x02, 0x60, 0x01, 0xE1,
+	 0xA1, 0xFF, 0x98, 0xFF, 0x80, 0x3E, 0x28, 0x40, 0x40, 0x2B, 0x03, 0x00, 0x29, 0x40, 0x20, 0x27,
+	 0xA3, 0x00, 0xC8, 0x74, 0xCD, 0xE2, 0x29, 0x44, 0x08, 0xBC, 0x40, 0x49, 0x44, 0xFF, 0x05, 0xE1,
+	 0xDB, 0xF3, 0x37, 0x60, 0xE8, 0x63, 0x03, 0xA8, 0x04, 0xA8, 0x06, 0x03, 0x05, 0x03, 0xA3, 0xD3,
+	 0xFF, 0xFF, 0x01, 0xA8, 0x07, 0x18, 0x0A, 0x03, 0x28, 0x40, 0x08, 0x2A, 0x07, 0x00, 0x28, 0x40,
+	 0x48, 0x36, 0x04, 0x00, 0xF1, 0xF3, 0xFF, 0xFF, 0x02, 0xBC, 0xF1, 0xFB, 0x29, 0x44, 0xFF, 0x60,
+	 0xEF, 0x65, 0x24, 0x89, 0x40, 0x27, 0x3F, 0x00, 0x00, 0x00, 0x29, 0x40, 0x80, 0x27, 0x0B, 0x00,
+	 0x07, 0x61, 0xA1, 0xFF, 0xCD, 0x81, 0x04, 0x25, 0x61, 0x00, 0x87, 0x4C, 0xFB, 0x02, 0xF3, 0x60,
+	 0xA0, 0x64, 0x80, 0x4C, 0x07, 0x00, 0xA1, 0xFF, 0x9C, 0x4C, 0x9C, 0x4C, 0x9C, 0x4D, 0x05, 0x60,
+	 0xCF, 0x64, 0x80, 0x4C, 0x28, 0x40, 0x40, 0x2B, 0x05, 0x00, 0x29, 0x40, 0x20, 0x27, 0x02, 0x00,
+	 0x15, 0x60, 0x6F, 0x6B, 0x04, 0x25, 0x4A, 0x00, 0x30, 0x64, 0x3A, 0xDB, 0x44, 0xFF, 0x04, 0x25,
+	 0x45, 0x00, 0x04, 0x60, 0x00, 0x65, 0x25, 0x44, 0xB4, 0x84, 0x80, 0x4E, 0x2D, 0x41, 0x04, 0x25,
+	 0x3D, 0x00, 0x61, 0x4C, 0x00, 0x60, 0x8A, 0x65, 0xC5, 0x81, 0x61, 0x54, 0xA1, 0xFF, 0xFF, 0xFF,
+	 0x04, 0x25, 0x34, 0x00, 0x67, 0x4E, 0x07, 0x64, 0x1C, 0xFB, 0x00, 0xE1, 0x02, 0x60, 0x05, 0xE1,
+	 0xA1, 0xFF, 0x98, 0xFF, 0x80, 0x3E, 0x28, 0x40, 0x40, 0x27, 0x0A, 0x00, 0x1C, 0x65, 0x28, 0x40,
+	 0xA4, 0x36, 0x14, 0x65, 0x23, 0x44, 0xC4, 0x84, 0x28, 0x40, 0x08, 0x2A, 0x0C, 0x00, 0x07, 0x00,
+	 0x23, 0x44, 0x1C, 0xA4, 0x29, 0x40, 0x20, 0x27, 0x02, 0x00, 0x11, 0x60, 0x0F, 0x6B, 0x3C, 0x46,
+	 0x98, 0xF0, 0x23, 0x44, 0xC4, 0x84, 0x06, 0x74, 0x25, 0x5C, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84,
+	 0xE0, 0x84, 0xB0, 0x84, 0x80, 0x4C, 0x9C, 0x4C, 0x44, 0xFF, 0x18, 0xE1, 0x0A, 0x64, 0x1E, 0x74,
+	 0x02, 0x60, 0x05, 0xE1, 0x40, 0x40, 0xA1, 0xFF, 0x98, 0xFF, 0x80, 0x3E, 0xC4, 0xE2, 0x27, 0x44,
+	 0x20, 0x2A, 0x06, 0x00, 0x42, 0x64, 0x3A, 0xDB, 0x67, 0x4C, 0xB1, 0x60, 0xAD, 0x78, 0xFF, 0xFF,
+	 0x41, 0x64, 0x3A, 0xDB, 0x62, 0xFF, 0x08, 0xE1, 0xE2, 0xFE, 0x72, 0x52, 0xA1, 0xFF, 0x98, 0xFF,
+	 0x80, 0x3E, 0xA1, 0xFF, 0x98, 0xFF, 0x80, 0x3E, 0x28, 0x40, 0x08, 0x27, 0x5A, 0x01, 0x3C, 0x46,
+	 0x8B, 0xFF, 0x84, 0x60, 0x00, 0xE4, 0x0F, 0x60, 0x90, 0x64, 0xC9, 0x60, 0x58, 0x4F, 0x56, 0x78,
+	 0xFF, 0xFF, 0x3F, 0xF2, 0x00, 0x60, 0x18, 0x70, 0x18, 0x71, 0x20, 0x72, 0x00, 0xF2, 0x60, 0x53,
+	 0x20, 0xE1, 0xA1, 0xFF, 0x88, 0x75, 0x00, 0xE1, 0xFF, 0xFF, 0x60, 0x50, 0x75, 0x44, 0x12, 0x71,
+	 0x6E, 0x72, 0x81, 0x75, 0xFF, 0xFF, 0x88, 0xFF, 0xA3, 0x60, 0x21, 0x78, 0xFF, 0xFF, 0x32, 0xF3,
+	 0x08, 0x29, 0x0A, 0x00, 0x60, 0x40, 0x07, 0x22, 0x07, 0x00, 0xFE, 0xB4, 0x32, 0xFB, 0x27, 0x44,
+	 0x10, 0xBC, 0xF7, 0xB4, 0x40, 0x47, 0x43, 0xFF, 0x00, 0x64, 0x3A, 0xDB, 0x01, 0x60, 0x08, 0xE1,
+	 0x31, 0x40, 0x01, 0x2A, 0x06, 0x00, 0x00, 0x64, 0x33, 0xFB, 0x01, 0x60, 0x0A, 0xE1, 0x25, 0x11,
+	 0x24, 0x0A, 0xE5, 0xFE, 0x2D, 0x05, 0x32, 0x40, 0x80, 0x2A, 0x05, 0x00, 0x19, 0x60, 0xF2, 0xF3,
+	 0xFF, 0xFF, 0x01, 0x18, 0x16, 0x00, 0x9F, 0xFE, 0x14, 0x05, 0x9D, 0xFE, 0x12, 0x04, 0x31, 0x41,
+	 0x40, 0x2A, 0x0F, 0x00, 0x07, 0x60, 0xE9, 0xF1, 0xAE, 0x4C, 0x90, 0x80, 0x10, 0x2A, 0x09, 0x00,
+	 0x7F, 0xB1, 0x07, 0x60, 0xE9, 0xFB, 0x60, 0x40, 0x10, 0x2A, 0x80, 0xB9, 0x41, 0x51, 0xDF, 0xFE,
+	 0x19, 0xFF, 0x9F, 0xFE, 0x02, 0x04, 0x40, 0xE1, 0x08, 0x00, 0x7C, 0xE1, 0x31, 0x44, 0x01, 0x2A,
+	 0x04, 0x00, 0xFD, 0xE1, 0x27, 0x44, 0x10, 0x26, 0x06, 0x00, 0xA1, 0xFF, 0xFF, 0xFF, 0x81, 0x3E,
+	 0xAA, 0x60, 0x6F, 0x78, 0xFF, 0xFF, 0x27, 0x44, 0x08, 0x26, 0xFF, 0xFF, 0xC1, 0x60, 0xA3, 0x78,
+	 0xFF, 0xFF, 0x48, 0xF3, 0x32, 0xF1, 0x00, 0x63, 0x64, 0x40, 0x07, 0x26, 0x03, 0x00, 0xA5, 0x60,
+	 0x0F, 0x78, 0xFF, 0xFF, 0x43, 0xFF, 0x31, 0x40, 0x08, 0x26, 0xF0, 0x01, 0xCD, 0xE2, 0x85, 0xE1,
+	 0x70, 0x41, 0xAD, 0x80, 0x71, 0x40, 0x80, 0x27, 0xE9, 0x12, 0x03, 0x03, 0xC2, 0x60, 0x15, 0x78,
+	 0xFF, 0xFF, 0xA1, 0xFF, 0xFF, 0xFF, 0xC4, 0xE2, 0x32, 0xFD, 0x60, 0x40, 0x01, 0x2A, 0xDB, 0x01,
+	 0x00, 0x63, 0x32, 0xFD, 0x3C, 0x46, 0x3E, 0xF2, 0x2A, 0xF0, 0x27, 0x41, 0x44, 0x48, 0x20, 0xB9,
+	 0x01, 0xB4, 0xF7, 0xB1, 0x0A, 0x03, 0x64, 0x40, 0x08, 0x27, 0x07, 0x00, 0x0F, 0x60, 0xDA, 0x63,
+	 0x00, 0x64, 0x45, 0xFB, 0x46, 0xFB, 0xBD, 0xDB, 0xA3, 0xDB, 0xC8, 0x0A, 0xC7, 0x11, 0x1B, 0x60,
+	 0xEE, 0xF3, 0xFF, 0xFF, 0x14, 0x18, 0x28, 0x40, 0xD4, 0x36, 0x11, 0x00, 0xAC, 0x4C, 0x80, 0x2A,
+	 0x0E, 0x00, 0x1B, 0x60, 0xF1, 0xF3, 0xFF, 0xFF, 0x0A, 0x18, 0x1B, 0x60, 0xF2, 0xF3, 0x1B, 0x60,
+	 0xEF, 0xF3, 0x60, 0x45, 0xD4, 0x80, 0xDC, 0x84, 0x02, 0x03, 0xA2, 0xDB, 0xAF, 0x01, 0x00, 0x64,
+	 0x1B, 0x60, 0xEF, 0xFB, 0x41, 0x47, 0x22, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x10, 0x26, 0x04, 0x00,
+	 0x01, 0x2A, 0x05, 0x00, 0x10, 0x2B, 0x03, 0x00, 0x29, 0x47, 0x20, 0xBF, 0x40, 0x49, 0x1B, 0x60,
+	 0xEE, 0xF3, 0xFF, 0xFF, 0x04, 0x18, 0xAE, 0x4F, 0x08, 0xBC, 0x00, 0x7F, 0xA0, 0x5E, 0x05, 0xE1,
+	 0x01, 0x60, 0x08, 0xE1, 0x2A, 0xE8, 0x3C, 0x46, 0x0F, 0xF0, 0xFF, 0xFF, 0x64, 0x40, 0x01, 0x2A,
+	 0x03, 0x00, 0xA7, 0x60, 0xE1, 0x78, 0xFF, 0xFF, 0x7D, 0xF3, 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x27,
+	 0x0E, 0x00, 0x1F, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x40, 0x2B, 0x09, 0x00, 0x19, 0x60, 0x7B, 0xF3,
+	 0xFF, 0xFF, 0x60, 0x40, 0x02, 0x2A, 0x03, 0x00, 0xA8, 0x60, 0xEC, 0x78, 0xFF, 0xFF, 0x1F, 0xF2,
+	 0xC0, 0x60, 0x00, 0x65, 0xA4, 0x9C, 0x3F, 0x60, 0xCF, 0x65, 0x29, 0x44, 0xA4, 0x84, 0x30, 0x89,
+	 0x19, 0x60, 0x77, 0xF3, 0xFF, 0xFF, 0x19, 0x60, 0x55, 0xFB, 0x1F, 0xF2, 0x39, 0xF1, 0xE0, 0x60,
+	 0xFF, 0xB5, 0x0A, 0x18, 0x60, 0x47, 0x1F, 0xB4, 0xD0, 0x84, 0xE0, 0xA0, 0x02, 0x0D, 0x00, 0x64,
+	 0x02, 0x00, 0x01, 0x04, 0x1F, 0x64, 0x60, 0x47, 0xB4, 0x81, 0x07, 0x60, 0xEA, 0xF1, 0xFF, 0xFF,
+	 0xB1, 0x8C, 0x29, 0x40, 0x40, 0x2B, 0x10, 0x00, 0x29, 0x60, 0xC0, 0x65, 0x60, 0x47, 0x1F, 0xB4,
+	 0xE0, 0x84, 0xE0, 0x84, 0x44, 0xD3, 0x5A, 0xD1, 0x01, 0x60, 0x00, 0xE1, 0x01, 0x60, 0x09, 0x6B,
+	 0x60, 0x4C, 0xB5, 0xFF, 0x64, 0x4C, 0x14, 0x00, 0x29, 0x60, 0xC0, 0x65, 0x60, 0x47, 0x1F, 0xB4,
+	 0xE0, 0x84, 0xE0, 0x84, 0x44, 0xD3, 0x5A, 0xD1, 0x01, 0x60, 0x00, 0xE1, 0x05, 0x60, 0x69, 0x6B,
+	 0x60, 0x4C, 0xB5, 0xFF, 0x64, 0x4C, 0x7C, 0x44, 0x29, 0x40, 0x80, 0x2B, 0x67, 0x44, 0x60, 0x4C,
+	 0x00, 0xE1, 0x84, 0xFF, 0xC2, 0x60, 0x45, 0x64, 0x40, 0x42, 0x82, 0xFF, 0x0D, 0x00, 0xE5, 0xFE,
+	 0x03, 0x04, 0xAA, 0x60, 0x6F, 0x78, 0xFF, 0xFF, 0x32, 0xF1, 0xFF, 0xFF, 0x64, 0x40, 0x07, 0x22,
+	 0x43, 0xFF, 0xA3, 0x60, 0xF4, 0x78, 0xFF, 0xFF, 0x0B, 0x64, 0x3A, 0xDB, 0x01, 0x60, 0x0A, 0xE1,
+	 0x1C, 0x42, 0x22, 0x46, 0x13, 0xF2, 0xFF, 0x65, 0x60, 0x47, 0x2A, 0xF2, 0x40, 0x45, 0x40, 0x48,
+	 0x04, 0x2B, 0x13, 0x00, 0x16, 0xF2, 0x1D, 0xF2, 0x40, 0x43, 0x0F, 0xF2, 0x40, 0x4D, 0x0F, 0x64,
+	 0x14, 0xF0, 0x35, 0xF2, 0xA0, 0x82, 0x0F, 0xB4, 0xCA, 0x85, 0xD4, 0x80, 0x10, 0xF2, 0x01, 0x02,
+	 0x2B, 0xFA, 0x27, 0x44, 0x40, 0xBC, 0x40, 0x47, 0x13, 0x00, 0x17, 0xF2, 0x2C, 0xF0, 0x40, 0x43,
+	 0x1B, 0xF2, 0x1D, 0xFA, 0x40, 0x4D, 0x64, 0x40, 0x01, 0x2A, 0x02, 0x00, 0xAB, 0xFC, 0x05, 0x00,
+	 0x28, 0x40, 0xA4, 0x36, 0x02, 0x00, 0x11, 0xF2, 0x2B, 0xFA, 0x27, 0x44, 0xBF, 0xB4, 0x40, 0x47,
+	 0xF0, 0xFE, 0xB0, 0x60, 0xB0, 0x78, 0xFF, 0xFF, 0x22, 0x46, 0x2C, 0xF0, 0x27, 0x44, 0xDF, 0xB4,
+	 0x40, 0x47, 0x64, 0x40, 0x01, 0x26, 0x09, 0x00, 0x2A, 0xF2, 0x39, 0xF0, 0x8F, 0xB0, 0x88, 0x3A,
+	 0x0D, 0x00, 0x64, 0x44, 0x60, 0xB0, 0x20, 0x3A, 0x09, 0x00, 0x28, 0x44, 0x04, 0x27, 0x05, 0x00,
+	 0xD4, 0x3A, 0x03, 0x00, 0xAE, 0x4F, 0xF7, 0xB4, 0xA0, 0x5E, 0x11, 0x00, 0x2A, 0xF0, 0x01, 0x65,
+	 0x64, 0x40, 0xA4, 0x3A, 0x04, 0x65, 0x27, 0x44, 0x34, 0x87, 0x36, 0xF3, 0xFF, 0xFF, 0x60, 0x56,
+	 0xAD, 0xE2, 0x04, 0x64, 0x3A, 0xDB, 0x41, 0xE1, 0xA1, 0xFF, 0xFF, 0xFF, 0x81, 0x3E, 0x06, 0x64,
+	 0x3A, 0xDB, 0x22, 0x46, 0x01, 0x64, 0x31, 0xFB, 0xC0, 0xFE, 0xC2, 0x60, 0x1E, 0x78, 0xFF, 0xFF,
+	 0x28, 0x40, 0xC4, 0x3A, 0x0C, 0x00, 0x27, 0x44, 0xFD, 0xB4, 0x40, 0x47, 0xA8, 0xE2, 0x05, 0xE1,
+	 0x01, 0x60, 0x08, 0xE1, 0x2A, 0xE8, 0x3C, 0x46, 0xA4, 0x60, 0xBF, 0x78, 0xFF, 0xFF, 0x3F, 0x40,
+	 0x01, 0x2B, 0x05, 0x00, 0x67, 0x4C, 0x01, 0x60, 0x00, 0xE1, 0x05, 0x60, 0x69, 0x6B, 0x07, 0x60,
+	 0xEB, 0xF1, 0x1F, 0xF2, 0x2A, 0xE8, 0xB0, 0x81, 0x29, 0x40, 0x40, 0x2B, 0x14, 0x00, 0x61, 0x4C,
+	 0x29, 0x60, 0xC0, 0x65, 0x61, 0x47, 0x1F, 0xB4, 0xE0, 0x84, 0xE0, 0x84, 0x44, 0xD3, 0x5A, 0xD1,
+	 0x01, 0x60, 0x00, 0xE1, 0x01, 0x60, 0x09, 0x6B, 0x60, 0x4C, 0xB5, 0xFF, 0xFF, 0x60, 0xF2, 0x64,
+	 0x64, 0x4C, 0x40, 0x43, 0x18, 0x00, 0x29, 0x47, 0x80, 0xB7, 0x34, 0x94, 0x60, 0x4C, 0x29, 0x60,
+	 0xC0, 0x65, 0x61, 0x47, 0x1F, 0xB4, 0xE0, 0x84, 0xE0, 0x84, 0x44, 0xD3, 0x5A, 0xD1, 0x01, 0x60,
+	 0x00, 0xE1, 0x05, 0x60, 0x69, 0x6B, 0x60, 0x4C, 0xB5, 0xFF, 0x64, 0x4C, 0x7C, 0x44, 0x29, 0x40,
+	 0x80, 0x2B, 0x67, 0x44, 0x60, 0x4C, 0x40, 0xE1, 0x01, 0x60, 0x08, 0xE1, 0x28, 0x45, 0xBF, 0x60,
+	 0xFF, 0x64, 0x24, 0x88, 0xC4, 0xE2, 0x08, 0x64, 0x3A, 0xDB, 0x21, 0x46, 0x2A, 0x44, 0x72, 0x45,
+	 0x24, 0xFA, 0xB2, 0xF3, 0x06, 0x04, 0xE4, 0xE2, 0xDC, 0x9C, 0x29, 0x40, 0x01, 0x26, 0x64, 0x44,
+	 0xB2, 0xF9, 0x25, 0xFA, 0xB3, 0xF3, 0x02, 0x04, 0xDC, 0x84, 0xB3, 0xFB, 0x28, 0xFA, 0xB4, 0xF3,
+	 0x02, 0x04, 0xDC, 0x84, 0xB4, 0xFB, 0x29, 0xFA, 0x24, 0x44, 0x04, 0x2A, 0x06, 0x00, 0x28, 0x40,
+	 0xA4, 0x36, 0x03, 0x00, 0xA6, 0x60, 0xB1, 0x78, 0xFF, 0xFF, 0x26, 0x43, 0x84, 0xBB, 0xFC, 0xB3,
+	 0x21, 0x46, 0x01, 0x5D, 0x0F, 0xFC, 0x5C, 0x46, 0x05, 0xFF, 0x27, 0x44, 0x01, 0x2A, 0x13, 0x00,
+	 0x50, 0xFE, 0x28, 0x40, 0x08, 0x3A, 0x12, 0x00, 0x2F, 0xF2, 0x30, 0xF0, 0x60, 0x43, 0x31, 0xF2,
+	 0x22, 0x46, 0x64, 0x41, 0x2C, 0xF0, 0x2D, 0xF0, 0xD3, 0x80, 0x2E, 0xF0, 0xD1, 0x80, 0xD0, 0x80,
+	 0x27, 0x44, 0x09, 0x0C, 0x03, 0x00, 0x27, 0x44, 0x06, 0x22, 0x05, 0x00, 0xB8, 0xB4, 0x40, 0x47,
+	 0x02, 0x64, 0x31, 0xFB, 0xC0, 0xFE, 0xD4, 0x64, 0x40, 0x48, 0x0D, 0x64, 0x3A, 0xDB, 0x7C, 0x44,
+	 0x1B, 0x60, 0xF0, 0xFB, 0x21, 0x46, 0x1C, 0xF2, 0x00, 0xE1, 0xF0, 0xFE, 0x00, 0x63, 0x28, 0x44,
+	 0xA4, 0x36, 0x0A, 0x00, 0x04, 0x2B, 0x08, 0x00, 0x30, 0xF3, 0x2D, 0x45, 0xD4, 0x84, 0xCA, 0x65,
+	 0xD4, 0x83, 0x01, 0x64, 0x1B, 0x60, 0xF0, 0xFB, 0xD4, 0x64, 0x35, 0x00, 0x0F, 0x64, 0x3A, 0xDB,
+	 0x21, 0x46, 0x29, 0x40, 0x40, 0x27, 0x15, 0x00, 0x80, 0x27, 0x02, 0x00, 0xCA, 0x65, 0x01, 0x00,
+	 0x6A, 0x65, 0x1C, 0xF2, 0xFF, 0xFF, 0x04, 0x7F, 0x40, 0x45, 0x0A, 0x36, 0x70, 0x64, 0x14, 0x36,
+	 0x38, 0x64, 0x37, 0x36, 0x15, 0x64, 0x6E, 0x3A, 0x17, 0x00, 0x84, 0x7F, 0x40, 0x45, 0x0B, 0x64,
+	 0x13, 0x00, 0x1C, 0xF2, 0x1E, 0x65, 0x40, 0x45, 0x0B, 0x36, 0x1E, 0x64, 0x0F, 0x36, 0x16, 0x64,
+	 0x0A, 0x36, 0x12, 0x64, 0x0E, 0x36, 0x0E, 0x64, 0x09, 0x36, 0x0E, 0x64, 0x0D, 0x36, 0x0A, 0x64,
+	 0x08, 0x36, 0x0A, 0x64, 0x0C, 0x36, 0x0A, 0x64, 0x40, 0x4D, 0x00, 0xE1, 0xF0, 0xFE, 0x2B, 0xF2,
+	 0xC4, 0x85, 0xD4, 0x83, 0xC4, 0x64, 0x40, 0x48, 0x2F, 0xF0, 0xB0, 0xF0, 0xB1, 0xF2, 0xA1, 0xFF,
+	 0x12, 0x74, 0xCD, 0xE2, 0x80, 0x4E, 0x12, 0x74, 0x83, 0x4C, 0x12, 0x74, 0x9A, 0xFF, 0x84, 0x4C,
+	 0x12, 0x74, 0x85, 0x4C, 0x12, 0x74, 0x81, 0x4C, 0x12, 0x74, 0xA1, 0xFF, 0x98, 0xFF, 0xB2, 0x60,
+	 0x58, 0x4F, 0x2D, 0x78, 0xFF, 0xFF, 0x01, 0x60, 0x18, 0xE1, 0x78, 0x44, 0x03, 0xA4, 0x35, 0xFB,
+	 0xB2, 0x60, 0x70, 0x78, 0xFF, 0xFF, 0x29, 0x44, 0xF7, 0xB4, 0x40, 0x49, 0x28, 0x40, 0xC4, 0x36,
+	 0x07, 0x00, 0x1B, 0x60, 0xF0, 0xF3, 0xFF, 0xFF, 0x03, 0x1B, 0xAE, 0x4F, 0xF7, 0xB4, 0xA0, 0x5E,
+	 0x27, 0x44, 0x01, 0x2A, 0x05, 0x00, 0xFE, 0xB4, 0x40, 0x47, 0xA5, 0x60, 0x7F, 0x78, 0xFF, 0xFF,
+	 0x16, 0x60, 0xAB, 0xF3, 0xFF, 0xFF, 0x60, 0x40, 0x02, 0x36, 0xC1, 0xFE, 0xA3, 0x60, 0xE7, 0x78,
+	 0xFF, 0xFF, 0x28, 0x40, 0xB4, 0x3A, 0x0B, 0x00, 0x27, 0x44, 0x07, 0x22, 0x05, 0x00, 0xF8, 0xB4,
+	 0x40, 0x47, 0x02, 0x64, 0x31, 0xFB, 0xC0, 0xFE, 0xA6, 0x60, 0x3E, 0x78, 0xFF, 0xFF, 0x28, 0x44,
+	 0xD4, 0x36, 0x03, 0x00, 0xA7, 0x60, 0xC8, 0x78, 0xFF, 0xFF, 0xA8, 0xE2, 0x27, 0x44, 0xFB, 0xB4,
+	 0x40, 0x47, 0x1C, 0x42, 0x22, 0x46, 0x19, 0x60, 0xCF, 0xF3, 0xFF, 0xFF, 0x34, 0xFB, 0x2A, 0xF0,
+	 0xF7, 0x60, 0xFF, 0x64, 0xA0, 0x84, 0xA2, 0xDA, 0x60, 0x40, 0x40, 0x2B, 0xC4, 0x00, 0x22, 0xF2,
+	 0xFF, 0xFF, 0x60, 0x40, 0x22, 0x26, 0x3F, 0x00, 0x01, 0x26, 0x03, 0x00, 0x04, 0x26, 0x05, 0x00,
+	 0xBA, 0x00, 0x04, 0x2B, 0xB8, 0x00, 0xA6, 0xF5, 0x01, 0x00, 0x07, 0xF4, 0x4B, 0xF2, 0xFF, 0xFF,
+	 0xDC, 0x84, 0x4B, 0xFA, 0x0C, 0x60, 0xFC, 0x62, 0x80, 0xFF, 0xC8, 0x60, 0x78, 0x44, 0x02, 0xA4,
+	 0xA2, 0xDB, 0x8C, 0x78, 0xFF, 0xFF, 0x82, 0xFF, 0xA6, 0xF3, 0x66, 0x5C, 0xD0, 0x80, 0x00, 0x7C,
+	 0x07, 0x03, 0x66, 0x43, 0x22, 0x46, 0x22, 0xF2, 0x63, 0x46, 0x60, 0x40, 0x01, 0x2A, 0x01, 0x00,
+	 0x3C, 0xF1, 0x4B, 0xF0, 0x64, 0x41, 0x64, 0x47, 0x60, 0x5F, 0x20, 0xBC, 0x80, 0x26, 0x80, 0xAC,
+	 0x60, 0x47, 0x22, 0x46, 0x3A, 0xFA, 0x64, 0x44, 0x20, 0x7F, 0x34, 0x94, 0x3B, 0xFA, 0x08, 0x60,
+	 0x00, 0xEA, 0x0F, 0x64, 0x60, 0x7F, 0xA0, 0x5A, 0x80, 0x60, 0x00, 0xEA, 0xA0, 0x60, 0x00, 0xEA,
+	 0xD1, 0x60, 0x00, 0xEA, 0x80, 0x00, 0x2A, 0xF2, 0x00, 0x60, 0x7C, 0x62, 0x60, 0x40, 0x40, 0x2B,
+	 0x24, 0x00, 0xA2, 0xD3, 0x00, 0x61, 0x60, 0xFE, 0xA0, 0xD3, 0x5E, 0xD1, 0xFF, 0xFF, 0x20, 0xFE,
+	 0x64, 0x5F, 0xDC, 0x84, 0xF1, 0x81, 0xC0, 0x2B, 0x04, 0x00, 0x80, 0x2A, 0x02, 0x00, 0x7F, 0xA4,
+	 0xDC, 0x84, 0xFF, 0x3B, 0x03, 0x00, 0x60, 0x47, 0xDC, 0x87, 0x01, 0x61, 0xC0, 0x80, 0x00, 0x36,
+	 0xDC, 0x84, 0x4E, 0xDB, 0x60, 0xFE, 0x5A, 0xD1, 0xFF, 0xFF, 0xC1, 0x84, 0xF0, 0x22, 0x10, 0xA4,
+	 0xF0, 0x2A, 0x01, 0x00, 0x00, 0x64, 0xA2, 0xDB, 0x20, 0xFE, 0x00, 0x60, 0x3E, 0xF3, 0xFF, 0xFF,
+	 0xA0, 0xD3, 0x5A, 0xD1, 0x3A, 0xFA, 0x3B, 0xF8, 0x74, 0x62, 0xA2, 0xD0, 0xFF, 0xFF, 0x64, 0x44,
+	 0xE0, 0x7F, 0xA0, 0x5A, 0x64, 0x47, 0xE1, 0x7F, 0x5A, 0xD0, 0xA0, 0x5A, 0x64, 0x44, 0xE2, 0x7F,
+	 0xA0, 0x5A, 0x00, 0x60, 0x40, 0xF3, 0xFF, 0xFF, 0xA0, 0xD1, 0x5A, 0xD1, 0x64, 0x45, 0x64, 0x44,
+	 0xE3, 0x7F, 0xA0, 0x5A, 0x64, 0x47, 0xE4, 0x7F, 0x5A, 0xD1, 0xA0, 0x5A, 0x64, 0x44, 0xE5, 0x7F,
+	 0xA0, 0x5A, 0x64, 0x47, 0xE6, 0x7F, 0x5A, 0xD1, 0xA0, 0x5A, 0x64, 0x44, 0xE7, 0x7F, 0xA0, 0x5A,
+	 0x65, 0x40, 0x0D, 0x3A, 0x1C, 0x00, 0x64, 0x47, 0xE8, 0x7F, 0x5A, 0xD1, 0xA0, 0x5A, 0x64, 0x44,
+	 0xE9, 0x7F, 0xA0, 0x5A, 0x64, 0x47, 0xEA, 0x7F, 0x5A, 0xD1, 0xA0, 0x5A, 0x64, 0x44, 0xEB, 0x7F,
+	 0xA0, 0x5A, 0x64, 0x47, 0xEC, 0x7F, 0x5A, 0xD1, 0xA0, 0x5A, 0x64, 0x44, 0xED, 0x7F, 0xA0, 0x5A,
+	 0x64, 0x47, 0xEE, 0x7F, 0x5A, 0xD1, 0xA0, 0x5A, 0x64, 0x44, 0xEF, 0x7F, 0xA0, 0x5A, 0x08, 0x60,
+	 0x00, 0xEA, 0x65, 0x44, 0x02, 0xA4, 0x60, 0x7F, 0xA0, 0x5A, 0x80, 0x60, 0x00, 0xEA, 0xA0, 0x60,
+	 0x00, 0xEA, 0xD1, 0x60, 0x00, 0xEA, 0x0B, 0xF2, 0xFF, 0xFF, 0x7F, 0xB4, 0x0C, 0xF0, 0x04, 0x02,
+	 0x64, 0x46, 0x00, 0xF0, 0x04, 0x64, 0x22, 0x46, 0x03, 0xFA, 0x60, 0x41, 0x64, 0x46, 0x01, 0xF2,
+	 0xFC, 0xA1, 0x61, 0x45, 0xD4, 0x84, 0xFF, 0xFF, 0x08, 0x02, 0x00, 0xF0, 0x04, 0x63, 0x64, 0x46,
+	 0x01, 0xF2, 0x22, 0x46, 0x1A, 0xFA, 0x03, 0xFC, 0x02, 0x00, 0x22, 0x46, 0x1A, 0xFA, 0x35, 0xF2,
+	 0x04, 0xF8, 0xDC, 0x84, 0x35, 0xFA, 0x14, 0xF2, 0x0F, 0xB5, 0x0F, 0xB4, 0xCC, 0x84, 0x94, 0x80,
+	 0x04, 0x60, 0x00, 0x65, 0x2A, 0xF2, 0x01, 0x02, 0x94, 0x84, 0x2A, 0xFA, 0x95, 0xFC, 0x06, 0x00,
+	 0xC4, 0x3A, 0x07, 0x00, 0x27, 0x44, 0xFD, 0xB4, 0x40, 0x47, 0xA8, 0xE2, 0xA5, 0x60, 0x1C, 0x78,
+	 0xFF, 0xFF, 0x28, 0x44, 0x04, 0x26, 0x05, 0x00, 0x68, 0x3A, 0x03, 0x00, 0x32, 0x44, 0x00, 0x27,
+	 0x03, 0x00, 0xA3, 0x60, 0xF4, 0x78, 0xFF, 0xFF, 0x0A, 0x64, 0x3A, 0xDB, 0xA3, 0x60, 0xF4, 0x78,
+	 0xFF, 0xFF, 0x0E, 0x64, 0x3A, 0xDB, 0x3C, 0x44, 0x60, 0x46, 0x1E, 0xF0, 0x40, 0x42, 0x64, 0x40,
+	 0x40, 0x27, 0x48, 0x00, 0x1F, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x40, 0x27, 0x3C, 0x00, 0x80, 0x2B,
+	 0x0B, 0x00, 0xBF, 0x60, 0xFF, 0x65, 0x29, 0x44, 0x24, 0x89, 0x80, 0x60, 0x00, 0x65, 0x29, 0x44,
+	 0x34, 0x89, 0x80, 0x60, 0x00, 0x63, 0x05, 0x00, 0x3F, 0x60, 0xFF, 0x65, 0x29, 0x44, 0x24, 0x89,
+	 0x00, 0x63, 0x1E, 0xF2, 0x39, 0xF1, 0xC0, 0x60, 0xFF, 0xB5, 0x0A, 0x18, 0x60, 0x47, 0x1F, 0xB4,
+	 0xD0, 0x84, 0xE0, 0xA0, 0x02, 0x0D, 0x00, 0x64, 0x02, 0x00, 0x01, 0x04, 0x1F, 0x64, 0x60, 0x47,
+	 0xB4, 0x84, 0x07, 0x60, 0xEA, 0xF1, 0x3C, 0x94, 0xB0, 0x84, 0x60, 0x4C, 0x29, 0x60, 0xC0, 0x65,
+	 0x60, 0x47, 0x1F, 0xB4, 0xE0, 0x84, 0xE0, 0x84, 0x44, 0xD3, 0x5A, 0xD1, 0x01, 0x60, 0x00, 0xE1,
+	 0x05, 0x60, 0x69, 0x6B, 0x60, 0x4C, 0xB5, 0xFF, 0x64, 0x4C, 0x7C, 0x44, 0x29, 0x40, 0x80, 0x2B,
+	 0x67, 0x44, 0x60, 0x4C, 0x32, 0x00, 0x19, 0x60, 0x7B, 0xF3, 0xFF, 0xFF, 0x60, 0x40, 0x04, 0x26,
+	 0xCB, 0x01, 0xBF, 0x01, 0x40, 0x60, 0x00, 0x65, 0x29, 0x44, 0x34, 0x89, 0x40, 0x60, 0x00, 0x63,
+	 0x9F, 0xF2, 0x1E, 0xF2, 0x39, 0xF1, 0xC0, 0x60, 0xFF, 0xB5, 0x0A, 0x18, 0x60, 0x47, 0x1F, 0xB4,
+	 0xD0, 0x84, 0xE0, 0xA0, 0x02, 0x0D, 0x00, 0x64, 0x02, 0x00, 0x01, 0x04, 0x1F, 0x64, 0x60, 0x47,
+	 0xB4, 0x84, 0x07, 0x60, 0xEA, 0xF1, 0x3C, 0x94, 0xB0, 0x81, 0x61, 0x4C, 0x29, 0x60, 0xC0, 0x65,
+	 0x61, 0x47, 0x1F, 0xB4, 0xE0, 0x84, 0xE0, 0x84, 0x44, 0xD3, 0x5A, 0xD1, 0x01, 0x60, 0x00, 0xE1,
+	 0x01, 0x60, 0x09, 0x6B, 0x60, 0x4C, 0xB5, 0xFF, 0x64, 0x4C, 0x40, 0xE1, 0x01, 0x60, 0x08, 0xE1,
+	 0x84, 0xFF, 0xC2, 0x60, 0x45, 0x64, 0x40, 0x42, 0x82, 0xFF, 0x2A, 0xF2, 0x10, 0x60, 0x00, 0x65,
+	 0xA4, 0x84, 0xB4, 0xBC, 0x1E, 0xF0, 0x40, 0x48, 0x64, 0x40, 0x40, 0x27, 0x17, 0x00, 0x1C, 0xF2,
+	 0xFF, 0xFF, 0x60, 0x40, 0x0A, 0x36, 0x06, 0x00, 0x14, 0x36, 0x07, 0x00, 0x37, 0x36, 0x08, 0x00,
+	 0x6E, 0x36, 0x09, 0x00, 0x70, 0x7C, 0xA0, 0x63, 0x0F, 0x00, 0x38, 0x7C, 0x50, 0x63, 0x0C, 0x00,
+	 0x15, 0x7C, 0x1E, 0x63, 0x09, 0x00, 0x0B, 0x7C, 0x0F, 0x63, 0x06, 0x00, 0x9C, 0xF4, 0xFF, 0x65,
+	 0x63, 0x47, 0xA4, 0x9C, 0xA7, 0x84, 0x23, 0x00, 0x40, 0x45, 0x43, 0x4D, 0x00, 0xE1, 0xF0, 0xFE,
+	 0x29, 0x40, 0x80, 0x2B, 0x03, 0x00, 0x00, 0x60, 0x6A, 0x65, 0x02, 0x00, 0x00, 0x60, 0xCA, 0x65,
+	 0x1F, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x40, 0x27, 0x0E, 0x00, 0x2A, 0xF2, 0xFF, 0xFF, 0x60, 0x40,
+	 0x04, 0x27, 0x03, 0x00, 0x65, 0x44, 0xE0, 0x85, 0x12, 0x00, 0x2B, 0xF2, 0x11, 0xF0, 0xC0, 0x84,
+	 0xD0, 0x84, 0xC4, 0x83, 0x11, 0x00, 0x1E, 0x64, 0xC4, 0x84, 0x60, 0x45, 0x08, 0x00, 0x40, 0x45,
+	 0xFF, 0x60, 0xF8, 0x64, 0x40, 0x43, 0x00, 0xE1, 0xF0, 0xFE, 0x00, 0x60, 0x3C, 0x65, 0x91, 0xF4,
+	 0x1B, 0xF0, 0xC3, 0x84, 0xC4, 0x84, 0xC0, 0x83, 0x28, 0x44, 0xA1, 0xFF, 0x12, 0x74, 0x80, 0x4E,
+	 0x12, 0x74, 0x83, 0x4C, 0x9A, 0xFF, 0x12, 0x74, 0x56, 0x62, 0x7A, 0xD4, 0x12, 0x74, 0x7A, 0xD4,
+	 0x12, 0x74, 0x7A, 0xD4, 0x12, 0x74, 0x5C, 0x62, 0x7A, 0xD4, 0x12, 0x74, 0x7A, 0xD4, 0x12, 0x74,
+	 0x7A, 0xD4, 0x12, 0x74, 0xA1, 0xFF, 0x98, 0xFF, 0xB2, 0x60, 0x58, 0x4F, 0x2D, 0x78, 0xFF, 0xFF,
+	 0xBC, 0xFF, 0xB5, 0xFF, 0x01, 0x60, 0x18, 0xE1, 0x47, 0xFF, 0x27, 0x44, 0x02, 0xBC, 0x40, 0x47,
+	 0x36, 0xF3, 0xB6, 0xFF, 0xB7, 0xFF, 0xB4, 0xFF, 0xC8, 0x60, 0x09, 0x7D, 0x7C, 0x4B, 0x60, 0x56,
+	 0xAD, 0xE2, 0xA5, 0x60, 0x79, 0x78, 0xFF, 0xFF, 0x19, 0x60, 0x7B, 0xF3, 0x19, 0x60, 0x3B, 0xF3,
+	 0x60, 0x40, 0x04, 0x26, 0x0B, 0x00, 0x07, 0xB4, 0x60, 0x40, 0x01, 0x36, 0x07, 0x00, 0x29, 0x44,
+	 0xBF, 0x60, 0xFF, 0xB7, 0x80, 0xBF, 0x40, 0x49, 0x80, 0x67, 0x05, 0x00, 0x3F, 0x60, 0xFF, 0x65,
+	 0x29, 0x44, 0x24, 0x89, 0x00, 0x64, 0x16, 0x60, 0x50, 0xF1, 0xFF, 0xFF, 0x19, 0x60, 0x55, 0xF9,
+	 0x39, 0xF1, 0x16, 0x60, 0x3C, 0xF1, 0x64, 0x41, 0x64, 0x5E, 0x60, 0x45, 0x64, 0x47, 0x1F, 0xB4,
+	 0x54, 0x94, 0xE0, 0xA0, 0x02, 0x0D, 0x00, 0x64, 0x02, 0x00, 0x01, 0x04, 0x1F, 0x64, 0x60, 0x47,
+	 0x07, 0x60, 0xEA, 0xF1, 0xB4, 0x84, 0xB0, 0x8C, 0x29, 0x60, 0xC0, 0x7C, 0x60, 0x47, 0x1F, 0xB4,
+	 0xE0, 0x84, 0xE0, 0x84, 0x40, 0xD3, 0x5A, 0xD1, 0x01, 0x60, 0x00, 0xE1, 0x05, 0x60, 0x69, 0x6B,
+	 0x60, 0x4C, 0xB5, 0xFF, 0x64, 0x4C, 0x7C, 0x44, 0x29, 0x40, 0x80, 0x2B, 0x67, 0x44, 0x60, 0x4C,
+	 0x40, 0xE1, 0x01, 0x60, 0x08, 0xE1, 0x84, 0xFF, 0xC2, 0x60, 0x45, 0x64, 0x40, 0x42, 0x82, 0xFF,
+	 0x3C, 0x44, 0x60, 0x46, 0x40, 0x42, 0x13, 0x64, 0x3A, 0xDB, 0x10, 0x60, 0x00, 0x65, 0x3C, 0x46,
+	 0x2A, 0xF2, 0x19, 0x60, 0x3B, 0xF1, 0xA4, 0x84, 0xC4, 0xBC, 0x40, 0x48, 0x64, 0x44, 0x04, 0x26,
+	 0x09, 0x00, 0x02, 0x26, 0x0A, 0x00, 0x01, 0x26, 0x0B, 0x00, 0x08, 0x2A, 0x03, 0x00, 0x0B, 0x63,
+	 0x6E, 0x64, 0x08, 0x00, 0x15, 0x63, 0x37, 0x64, 0x05, 0x00, 0x38, 0x63, 0x14, 0x64, 0x02, 0x00,
+	 0x70, 0x63, 0x0A, 0x64, 0x43, 0x4D, 0x40, 0x45, 0x00, 0xE1, 0xF0, 0xFE, 0x00, 0x60, 0x1E, 0x64,
+	 0x1B, 0xF0, 0x11, 0xF0, 0xC0, 0x84, 0xC0, 0x84, 0x60, 0x43, 0x28, 0x44, 0xA1, 0xFF, 0x12, 0x74,
+	 0x80, 0x4E, 0x12, 0x74, 0x83, 0x4C, 0x9A, 0xFF, 0x12, 0x74, 0x5C, 0x62, 0x7A, 0xD4, 0x12, 0x74,
+	 0x7A, 0xD4, 0x12, 0x74, 0x7A, 0xD4, 0x12, 0x74, 0xA1, 0xFF, 0x98, 0xFF, 0xB2, 0x60, 0x58, 0x4F,
+	 0x2D, 0x78, 0xFF, 0xFF, 0x01, 0x60, 0x18, 0xE1, 0x78, 0x44, 0x03, 0xA4, 0x35, 0xFB, 0xB2, 0x60,
+	 0x70, 0x78, 0xFF, 0xFF, 0xC4, 0xE2, 0x08, 0x64, 0x3A, 0xDB, 0xA4, 0x60, 0xBF, 0x78, 0xFF, 0xFF,
+	 0x26, 0x43, 0x24, 0x40, 0x01, 0x2A, 0x0E, 0x00, 0x1D, 0xFF, 0x26, 0x44, 0x02, 0xBC, 0x40, 0x46,
+	 0x27, 0x44, 0x07, 0x22, 0x05, 0x00, 0xF8, 0xB4, 0x40, 0x47, 0x06, 0x64, 0x31, 0xFB, 0xC0, 0xFE,
+	 0x30, 0xF1, 0x81, 0x00, 0xFC, 0xB3, 0x32, 0x40, 0x01, 0x2A, 0x06, 0x00, 0x0A, 0xBB, 0x0F, 0xFC,
+	 0xCB, 0xFE, 0xA3, 0x60, 0xF4, 0x78, 0xFF, 0xFF, 0x24, 0x44, 0x04, 0x26, 0x29, 0x00, 0x0F, 0xFC,
+	 0x05, 0xFF, 0xDB, 0xF3, 0x28, 0x40, 0x80, 0x3A, 0x23, 0x00, 0x60, 0x40, 0x03, 0x3A, 0x20, 0x00,
+	 0x32, 0xF2, 0x7F, 0xF1, 0x33, 0xF2, 0xD0, 0x80, 0x80, 0xF1, 0x1A, 0x02, 0xD0, 0x80, 0x34, 0xF2,
+	 0x81, 0xF1, 0x16, 0x02, 0xD0, 0x80, 0x3C, 0x44, 0x13, 0x02, 0xAC, 0x86, 0xBB, 0xFE, 0x10, 0x03,
+	 0x2A, 0xF2, 0x21, 0x46, 0x60, 0x40, 0x80, 0x3A, 0x0B, 0x00, 0x01, 0x64, 0x31, 0xFB, 0xC0, 0xFE,
+	 0x00, 0x64, 0x32, 0xFB, 0x43, 0xFF, 0x84, 0xFF, 0xC2, 0x60, 0x45, 0x64, 0x40, 0x42, 0x82, 0xFF,
+	 0x30, 0xF1, 0x27, 0x44, 0x05, 0x22, 0x34, 0x00, 0xFA, 0xB4, 0x40, 0x47, 0x24, 0x44, 0x10, 0x2A,
+	 0x2B, 0x00, 0x28, 0x40, 0xD4, 0x3A, 0x28, 0x00, 0x31, 0x40, 0x08, 0x26, 0x00, 0x7C, 0x29, 0x40,
+	 0x50, 0x2B, 0x0D, 0x00, 0xEF, 0x60, 0xFF, 0x65, 0x29, 0x44, 0x24, 0x89, 0x31, 0x40, 0x08, 0x2A,
+	 0x06, 0x00, 0x1C, 0x60, 0x11, 0xF3, 0xFF, 0xFF, 0xE0, 0x85, 0x2B, 0x44, 0x05, 0x05, 0x2B, 0x44,
+	 0xFF, 0xA4, 0x01, 0xA4, 0x04, 0x24, 0x00, 0x64, 0xD0, 0x80, 0x70, 0x45, 0x02, 0x28, 0x64, 0x44,
+	 0xC4, 0x84, 0xFF, 0xFF, 0x04, 0x24, 0x00, 0xB4, 0x60, 0x50, 0x08, 0x28, 0x01, 0x00, 0x20, 0x29,
+	 0x6D, 0xE2, 0xA5, 0x60, 0x7F, 0x78, 0xFF, 0xFF, 0x02, 0x64, 0x31, 0xFB, 0xC0, 0xFE, 0x07, 0x00,
+	 0x02, 0x2A, 0x05, 0x00, 0xFD, 0xB4, 0x40, 0x47, 0x06, 0x64, 0x31, 0xFB, 0xC0, 0xFE, 0x05, 0x64,
+	 0x3A, 0xDB, 0x28, 0x44, 0xA4, 0x3A, 0x07, 0x00, 0x01, 0x60, 0x02, 0x7C, 0x25, 0x44, 0x0A, 0x3A,
+	 0x02, 0x00, 0x01, 0x60, 0x3A, 0x7C, 0x31, 0x40, 0x08, 0x26, 0x00, 0x7C, 0x29, 0x40, 0x50, 0x2B,
+	 0x0D, 0x00, 0xEF, 0x60, 0xFF, 0x65, 0x29, 0x44, 0x24, 0x89, 0x31, 0x40, 0x08, 0x2A, 0x06, 0x00,
+	 0x1C, 0x60, 0x11, 0xF3, 0xFF, 0xFF, 0xE0, 0x85, 0x2B, 0x44, 0x05, 0x05, 0x2B, 0x44, 0xFF, 0xA4,
+	 0x01, 0xA4, 0x04, 0x24, 0x00, 0x64, 0xD0, 0x80, 0x70, 0x45, 0x02, 0x28, 0x64, 0x44, 0xC4, 0x84,
+	 0xFF, 0xFF, 0x04, 0x24, 0x00, 0xB4, 0x28, 0x40, 0xE4, 0x36, 0x00, 0xB4, 0x60, 0x50, 0x08, 0x28,
+	 0x01, 0x00, 0x20, 0x29, 0x6D, 0xE2, 0xA3, 0x60, 0xE7, 0x78, 0xFF, 0xFF, 0x27, 0x44, 0x05, 0x22,
+	 0x09, 0x00, 0xBA, 0xB4, 0x40, 0x47, 0x3C, 0x46, 0x02, 0x64, 0x31, 0xFB, 0xC0, 0xFE, 0xA3, 0x60,
+	 0xF4, 0x78, 0xFF, 0xFF, 0x27, 0x44, 0x02, 0x2A, 0x06, 0x00, 0xFD, 0xB4, 0x40, 0x47, 0x06, 0x64,
+	 0x31, 0xFB, 0xC0, 0xFE, 0xF4, 0x01, 0xF3, 0x0A, 0x7C, 0x50, 0x6D, 0xE2, 0xF0, 0x01, 0x72, 0x45,
+	 0xDC, 0x84, 0xB2, 0xFB, 0x11, 0x64, 0x3A, 0xDB, 0xB3, 0xF3, 0x06, 0x04, 0xDC, 0x84, 0xB3, 0xFB,
+	 0xB4, 0xF3, 0x02, 0x04, 0xDC, 0x84, 0xB4, 0xFB, 0xA4, 0x60, 0x01, 0x78, 0xFF, 0xFF, 0x00, 0x61,
+	 0x12, 0x64, 0x3A, 0xDB, 0x20, 0x60, 0x04, 0x63, 0xBD, 0xD3, 0x72, 0x45, 0x44, 0x8A, 0x02, 0x28,
+	 0x03, 0x00, 0xE4, 0xE2, 0xDD, 0x81, 0x04, 0x00, 0x02, 0x28, 0x02, 0x00, 0xE4, 0xE2, 0xDD, 0x81,
+	 0xBD, 0xD3, 0xB2, 0xF1, 0x61, 0x45, 0xC0, 0x84, 0x00, 0x61, 0x02, 0x24, 0x01, 0xB9, 0xC4, 0x84,
+	 0x60, 0x55, 0x2A, 0x52, 0xE4, 0xE2, 0xB2, 0xFB, 0x02, 0x24, 0x01, 0xB9, 0xBD, 0xD3, 0xB3, 0xF1,
+	 0x61, 0x45, 0xC0, 0x84, 0x00, 0x61, 0x02, 0x24, 0x01, 0xB9, 0xC4, 0x84, 0xB3, 0xFB, 0x02, 0x24,
+	 0x01, 0xB9, 0xBD, 0xD3, 0xB4, 0xF1, 0x61, 0x45, 0xC0, 0x84, 0xC4, 0x84, 0xB4, 0xFB, 0xA5, 0x60,
+	 0x14, 0x78, 0xFF, 0xFF, 0xB0, 0x60, 0x9E, 0x78, 0xFF, 0xFF, 0x47, 0xFF, 0x1B, 0x60, 0xEE, 0xF3,
+	 0xFF, 0xFF, 0x04, 0x18, 0xAE, 0x4F, 0x08, 0xBC, 0x00, 0x7F, 0xA0, 0x5E, 0xC8, 0x74, 0xCD, 0xE2,
+	 0xAA, 0x60, 0xB9, 0x78, 0x00, 0x61, 0xA3, 0x60, 0xF4, 0x78, 0xFF, 0xFF, 0xAB, 0x60, 0xE8, 0x78,
+	 0xFF, 0xFF, 0x21, 0x46, 0x5C, 0x44, 0x26, 0x44, 0x02, 0x26, 0x01, 0x00, 0x3E, 0x46, 0x09, 0xF2,
+	 0x46, 0x41, 0x66, 0x40, 0xF3, 0x18, 0x40, 0x5E, 0xFD, 0xFB, 0x02, 0x64, 0x40, 0x46, 0x41, 0x5D,
+	 0x00, 0x64, 0x31, 0xFA, 0x00, 0xF2, 0x46, 0x45, 0x87, 0xFC, 0xAC, 0xE2, 0x01, 0x64, 0x33, 0xFB,
+	 0x32, 0x40, 0x01, 0x2A, 0x21, 0x00, 0x19, 0xF3, 0x01, 0x60, 0x1E, 0xE1, 0x1D, 0x18, 0x80, 0x64,
+	 0x40, 0x49, 0x00, 0xE1, 0x19, 0xFF, 0x08, 0x64, 0x2A, 0xFA, 0x5A, 0xDA, 0x2C, 0xFA, 0x5A, 0xDA,
+	 0x5A, 0xDA, 0xF1, 0xF3, 0xFF, 0xFF, 0x02, 0xBC, 0xF1, 0xFB, 0x72, 0x44, 0x24, 0xFA, 0xB2, 0xF3,
+	 0x25, 0xFA, 0xA1, 0xFF, 0xFF, 0xFF, 0xB6, 0xFF, 0xB7, 0xFF, 0xB4, 0xFF, 0xC8, 0x60, 0x09, 0x7D,
+	 0x7C, 0x4B, 0xA3, 0x60, 0xF4, 0x78, 0xFF, 0xFF, 0x01, 0xE1, 0x01, 0x60, 0x1A, 0xE1, 0x3F, 0x60,
+	 0xCF, 0x65, 0x29, 0x44, 0x24, 0x89, 0x2E, 0x44, 0x00, 0x36, 0x48, 0x00, 0x01, 0x3A, 0xE5, 0x00,
+	 0x88, 0xFF, 0x40, 0x67, 0x29, 0x45, 0x34, 0x89, 0x04, 0x64, 0x89, 0xFF, 0x60, 0x54, 0x88, 0xFF,
+	 0xA1, 0xFF, 0x6C, 0x45, 0x65, 0x44, 0x0F, 0xB4, 0x40, 0x45, 0x1C, 0xFA, 0x65, 0x44, 0x29, 0x41,
+	 0xF9, 0x81, 0x52, 0x4A, 0x71, 0x89, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x83, 0x1D, 0xFC,
+	 0x1B, 0xFC, 0x10, 0x60, 0x00, 0x65, 0x29, 0x44, 0x34, 0x89, 0x50, 0x4B, 0x67, 0x50, 0x69, 0xE2,
+	 0xB6, 0xF1, 0xFC, 0xA3, 0xD3, 0x80, 0x43, 0x43, 0x03, 0x04, 0xAB, 0x60, 0xDE, 0x78, 0xFF, 0xFF,
+	 0x09, 0x7C, 0xD3, 0x80, 0x9A, 0xFF, 0x03, 0x07, 0xAB, 0x60, 0xDE, 0x78, 0xFF, 0xFF, 0x25, 0x44,
+	 0x01, 0x26, 0x0F, 0xAC, 0x26, 0x60, 0x4A, 0x65, 0x44, 0xD3, 0x12, 0x65, 0x45, 0x46, 0x60, 0x47,
+	 0x40, 0x7F, 0x27, 0xFA, 0x8F, 0xFC, 0x18, 0x61, 0xEA, 0xF1, 0xA1, 0xFF, 0x6C, 0x44, 0xDC, 0x80,
+	 0xFF, 0xFF, 0x21, 0x03, 0x50, 0xFE, 0xAC, 0x60, 0xC1, 0x78, 0xFF, 0xFF, 0xC8, 0x60, 0x0B, 0x7D,
+	 0x08, 0x60, 0x00, 0x6B, 0xB5, 0xFF, 0xB7, 0xFF, 0xB4, 0xFF, 0xAA, 0x74, 0xCD, 0xE2, 0x01, 0x64,
+	 0x89, 0xFF, 0x60, 0x54, 0x88, 0xFF, 0x01, 0x60, 0x08, 0xE1, 0x05, 0xE1, 0xA1, 0xFF, 0xFF, 0xFF,
+	 0x04, 0x25, 0x8B, 0x00, 0x6C, 0x44, 0x0A, 0x36, 0x07, 0x00, 0x14, 0x36, 0x05, 0x00, 0x37, 0x36,
+	 0x03, 0x00, 0x6E, 0x36, 0x01, 0x00, 0x81, 0x00, 0x40, 0x45, 0x32, 0x74, 0xA1, 0xFF, 0x1C, 0xFA,
+	 0x40, 0x4E, 0x8C, 0x44, 0x60, 0x43, 0x1D, 0xFA, 0x01, 0xE1, 0x20, 0x64, 0x3A, 0xDB, 0x2E, 0x44,
+	 0x14, 0x36, 0x12, 0x00, 0x0A, 0x36, 0x0F, 0x00, 0x63, 0x45, 0xE3, 0x83, 0xE3, 0x83, 0xC7, 0x83,
+	 0xE3, 0x83, 0xC7, 0x83, 0xFF, 0xFF, 0x37, 0x36, 0x05, 0x00, 0x6E, 0x36, 0x04, 0x00, 0xAC, 0x60,
+	 0xBF, 0x78, 0xFF, 0xFF, 0xEB, 0x83, 0xEB, 0x83, 0xEB, 0x83, 0xEB, 0x83, 0xFF, 0xFF, 0x80, 0x27,
+	 0xCF, 0x83, 0x1B, 0xFC, 0x01, 0x64, 0x51, 0xFB, 0xA1, 0xFF, 0x29, 0x41, 0xF9, 0x81, 0x52, 0x4A,
+	 0x71, 0x89, 0x2E, 0x44, 0x27, 0xFA, 0xB6, 0xF1, 0xFC, 0xA3, 0xD3, 0x80, 0x43, 0x43, 0x03, 0x04,
+	 0xAB, 0x60, 0xDE, 0x78, 0xFF, 0xFF, 0x9A, 0xFF, 0x54, 0x63, 0x12, 0x64, 0x40, 0x46, 0x8F, 0xFC,
+	 0x18, 0x61, 0xEA, 0xF1, 0x50, 0xFE, 0x6C, 0x40, 0x9E, 0x15, 0x01, 0x60, 0x08, 0xE1, 0x80, 0xE1,
+	 0x00, 0x64, 0x33, 0xFB, 0x29, 0x40, 0x50, 0x2B, 0x0F, 0x00, 0x2B, 0x44, 0x70, 0x45, 0xC4, 0x84,
+	 0xFF, 0xFF, 0x04, 0x24, 0x00, 0xB4, 0x60, 0x50, 0x08, 0x28, 0x01, 0x00, 0x20, 0x29, 0x6D, 0xE2,
+	 0xEF, 0x60, 0xFF, 0x65, 0x29, 0x44, 0x24, 0x89, 0x01, 0x60, 0x18, 0xE1, 0x01, 0x11, 0x12, 0x00,
+	 0x29, 0x44, 0x20, 0xBC, 0x40, 0x49, 0x01, 0x64, 0x33, 0xFB, 0xB6, 0xFF, 0x00, 0xE1, 0x01, 0x60,
+	 0x1A, 0xE1, 0xA1, 0xFF, 0xFF, 0xFF, 0x6C, 0x40, 0xFC, 0x11, 0x01, 0x60, 0x18, 0xE1, 0xAE, 0x4F,
+	 0xF7, 0xB4, 0xA0, 0x5E, 0xB5, 0xFF, 0xB6, 0xFF, 0xB7, 0xFF, 0xB4, 0xFF, 0xC8, 0x60, 0x09, 0x7D,
+	 0x7C, 0x4B, 0x35, 0xE1, 0xAC, 0xE2, 0xAA, 0x60, 0x46, 0x78, 0xFF, 0xFF, 0x16, 0x60, 0x7F, 0xF3,
+	 0xFF, 0xFF, 0xDC, 0x84, 0x00, 0x36, 0x00, 0x3B, 0xA2, 0xDB, 0x21, 0x64, 0x3A, 0xDB, 0xBD, 0x01,
+	 0xAC, 0xE2, 0x01, 0x64, 0x33, 0xFB, 0x01, 0xE1, 0x3F, 0x60, 0xCF, 0x65, 0x29, 0x44, 0x24, 0x89,
+	 0x2E, 0x44, 0x00, 0x36, 0x21, 0x00, 0x01, 0x3A, 0xF0, 0x01, 0x88, 0xFF, 0x40, 0x67, 0x29, 0x45,
+	 0x34, 0x89, 0xA1, 0xFF, 0x6C, 0x45, 0x65, 0x44, 0x0F, 0xB4, 0x40, 0x45, 0x65, 0x44, 0x29, 0x41,
+	 0xF9, 0x81, 0x52, 0x4A, 0x71, 0x89, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x83, 0x0E, 0x7C,
+	 0xD3, 0x80, 0xFF, 0xFF, 0x03, 0x03, 0xAB, 0x60, 0xDE, 0x78, 0xFF, 0xFF, 0xA1, 0xFF, 0x6C, 0x44,
+	 0xDC, 0x80, 0xFF, 0xFF, 0xD2, 0x03, 0x41, 0x00, 0xC8, 0x60, 0x0B, 0x7D, 0x08, 0x60, 0x00, 0x6B,
+	 0xB5, 0xFF, 0xB7, 0xFF, 0xB4, 0xFF, 0xAA, 0x74, 0xCD, 0xE2, 0x01, 0x60, 0x08, 0xE1, 0x05, 0xE1,
+	 0xA1, 0xFF, 0xFF, 0xFF, 0x04, 0x25, 0xC1, 0x01, 0x6C, 0x44, 0x0A, 0x36, 0x07, 0x00, 0x14, 0x36,
+	 0x05, 0x00, 0x37, 0x36, 0x03, 0x00, 0x6E, 0x36, 0x01, 0x00, 0xB7, 0x01, 0x40, 0x45, 0x32, 0x74,
+	 0xA1, 0xFF, 0x40, 0x4E, 0x8C, 0x44, 0x60, 0x43, 0x01, 0xE1, 0x20, 0x64, 0x3A, 0xDB, 0x2E, 0x44,
+	 0x14, 0x36, 0x09, 0x00, 0x0A, 0x36, 0x07, 0x00, 0x37, 0x36, 0x05, 0x00, 0x6E, 0x36, 0x03, 0x00,
+	 0xAC, 0x60, 0xBF, 0x78, 0xFF, 0xFF, 0x01, 0x64, 0x51, 0xFB, 0xA1, 0xFF, 0x29, 0x41, 0xF9, 0x81,
+	 0x52, 0x4A, 0x71, 0x89, 0x0E, 0x7C, 0xD3, 0x80, 0x43, 0x43, 0x03, 0x03, 0xAB, 0x60, 0xDE, 0x78,
+	 0xFF, 0xFF, 0x6C, 0x40, 0xFF, 0xFF, 0x01, 0x15, 0x90, 0x01, 0x12, 0x64, 0x40, 0x46, 0xEA, 0xF1,
+	 0x50, 0xFE, 0xA1, 0xFF, 0x12, 0x61, 0x8C, 0x44, 0xEB, 0xF0, 0x40, 0x48, 0x8C, 0x44, 0x30, 0xFB,
+	 0x04, 0x61, 0x50, 0xFE, 0x8C, 0x44, 0xD0, 0x80, 0x8C, 0x44, 0xD4, 0x80, 0x8C, 0x44, 0xEC, 0xF1,
+	 0x00, 0x65, 0xD0, 0x80, 0x28, 0x44, 0x01, 0x0C, 0x13, 0x00, 0x10, 0x65, 0x60, 0x40, 0xC4, 0x36,
+	 0x04, 0x00, 0xD4, 0x3A, 0x0D, 0x00, 0x27, 0x40, 0x40, 0x26, 0x30, 0x65, 0x35, 0x84, 0xA1, 0xFF,
+	 0x8C, 0x44, 0x47, 0xFF, 0x50, 0x4B, 0x67, 0x50, 0x69, 0xE2, 0x6A, 0x44, 0x40, 0x2B, 0x09, 0x15,
+	 0x2C, 0x60, 0xEC, 0x64, 0xF1, 0x60, 0x78, 0x41, 0xE4, 0x78, 0xB5, 0xF1, 0x2A, 0x64, 0x3A, 0xDB,
+	 0x1C, 0x01, 0x29, 0x40, 0x10, 0x26, 0x02, 0x00, 0x04, 0x74, 0xCD, 0xE2, 0x8C, 0x44, 0xB6, 0xFF,
+	 0xB7, 0xFF, 0x01, 0x60, 0x18, 0xE1, 0x05, 0xE1, 0x00, 0x64, 0x33, 0xFB, 0xA1, 0xFF, 0x6C, 0x44,
+	 0xA1, 0xFF, 0x6C, 0x44, 0x29, 0x40, 0x40, 0x2B, 0x03, 0x00, 0xB6, 0xFF, 0xA1, 0xFF, 0x6C, 0x44,
+	 0xA1, 0xFF, 0x02, 0x74, 0x29, 0x44, 0x40, 0x27, 0x05, 0x74, 0xCD, 0xE2, 0xA1, 0xFF, 0xCB, 0xF3,
+	 0xC4, 0xE2, 0x89, 0xFF, 0x60, 0x54, 0x88, 0xFF, 0xDC, 0x84, 0xE0, 0x94, 0x26, 0x44, 0x84, 0xBC,
+	 0x40, 0x46, 0x23, 0x64, 0x3A, 0xDB, 0xB5, 0xFF, 0xBC, 0xFF, 0x47, 0xFF, 0xB6, 0xFF, 0xB7, 0xFF,
+	 0xB4, 0xFF, 0xC8, 0x60, 0x09, 0x7D, 0x7C, 0x4B, 0xA9, 0x60, 0x88, 0x78, 0xFF, 0xFF, 0x29, 0x64,
+	 0x3A, 0xDB, 0xA2, 0xFC, 0x32, 0x40, 0x01, 0x2A, 0xB9, 0x00, 0x01, 0x60, 0x1A, 0xE1, 0x23, 0x43,
+	 0xA1, 0xFF, 0xEC, 0x44, 0x2A, 0xFA, 0x40, 0x48, 0xA1, 0xFF, 0x7A, 0xDC, 0x7E, 0x36, 0x04, 0xA2,
+	 0xFC, 0x1C, 0x03, 0x1D, 0x00, 0x64, 0x3F, 0xFA, 0x2E, 0x00, 0x03, 0x2B, 0x04, 0x00, 0xA1, 0xFF,
+	 0x7A, 0xDC, 0x7A, 0xDC, 0x7A, 0xDC, 0x8F, 0xB0, 0x88, 0x3A, 0x03, 0x00, 0x70, 0x62, 0xA1, 0xFF,
+	 0x7A, 0xDC, 0x28, 0x40, 0x40, 0x2B, 0x06, 0x00, 0x72, 0x62, 0xA1, 0xFF, 0x7A, 0xDC, 0x7A, 0xDC,
+	 0x7A, 0xDC, 0x7A, 0xDC, 0x3F, 0xFC, 0x00, 0xF4, 0x10, 0x62, 0x6E, 0x61, 0xA1, 0xFF, 0x05, 0x1D,
+	 0x12, 0x1E, 0x0C, 0x00, 0x00, 0xF4, 0x7C, 0x61, 0x02, 0x62, 0x7A, 0xDC, 0x63, 0x40, 0xFD, 0x1C,
+	 0xF9, 0x1D, 0xFF, 0xB1, 0x08, 0x1E, 0x02, 0x02, 0x00, 0xF4, 0x02, 0x62, 0xB6, 0xFF, 0xB7, 0xFF,
+	 0xA1, 0xFF, 0x6C, 0x44, 0x5A, 0xDA, 0x98, 0xFF, 0xA1, 0xFF, 0x6C, 0x40, 0xA1, 0xFF, 0x47, 0xFF,
+	 0x7C, 0x44, 0x33, 0xFB, 0x26, 0x44, 0xFD, 0xB4, 0x84, 0xBC, 0x01, 0x15, 0x7F, 0xB4, 0x40, 0x46,
+	 0x6C, 0x40, 0xB6, 0xFF, 0xB7, 0xFF, 0xA1, 0xFF, 0x6C, 0x45, 0xA1, 0xFF, 0x7F, 0x60, 0x7F, 0x7C,
+	 0x6C, 0x44, 0xA0, 0x84, 0x15, 0xA7, 0x15, 0xA4, 0x21, 0x46, 0x26, 0xFA, 0x29, 0x40, 0x40, 0x2B,
+	 0x07, 0x00, 0xB6, 0xFF, 0x40, 0x60, 0x00, 0x65, 0xA1, 0xFF, 0x6C, 0x44, 0x1A, 0xFA, 0x09, 0x00,
+	 0x65, 0x44, 0x0F, 0xB4, 0x06, 0xA8, 0x80, 0x60, 0x00, 0x65, 0x08, 0x28, 0x7C, 0x45, 0x29, 0x44,
+	 0x34, 0x89, 0x27, 0xF0, 0x65, 0x44, 0x64, 0x5E, 0x27, 0xFA, 0x81, 0xE1, 0x01, 0x60, 0x18, 0xE1,
+	 0x01, 0x11, 0x12, 0x00, 0x29, 0x44, 0x20, 0xBC, 0x40, 0x49, 0x01, 0x64, 0x33, 0xFB, 0xB6, 0xFF,
+	 0x00, 0xE1, 0x01, 0x60, 0x1A, 0xE1, 0xA1, 0xFF, 0xFF, 0xFF, 0x6C, 0x40, 0xFC, 0x11, 0x01, 0x60,
+	 0x18, 0xE1, 0xAE, 0x4F, 0xF7, 0xB4, 0xA0, 0x5E, 0x00, 0x70, 0x00, 0x64, 0x40, 0x4B, 0x21, 0x46,
+	 0xB5, 0xFF, 0xBC, 0xFF, 0x47, 0xFF, 0xB6, 0xFF, 0xB7, 0xFF, 0xB4, 0xFF, 0xC8, 0x60, 0x09, 0x7D,
+	 0x7C, 0x4B, 0x28, 0x44, 0x04, 0x27, 0x09, 0x00, 0xD4, 0x36, 0x04, 0x00, 0x0C, 0x22, 0x02, 0x00,
+	 0x0C, 0x3A, 0x03, 0x00, 0xAE, 0x4F, 0xF7, 0xB4, 0xA0, 0x5E, 0x2A, 0x44, 0x72, 0x45, 0x24, 0xFA,
+	 0xB2, 0xF3, 0x06, 0x04, 0xE4, 0xE2, 0xDC, 0x9C, 0x29, 0x40, 0x01, 0x26, 0x64, 0x44, 0xB2, 0xF9,
+	 0x25, 0xFA, 0xB3, 0xF3, 0x02, 0x04, 0xDC, 0x84, 0xB3, 0xFB, 0x28, 0xFA, 0xB4, 0xF3, 0x02, 0x04,
+	 0xDC, 0x84, 0xB4, 0xFB, 0x29, 0xFA, 0xA9, 0x60, 0x88, 0x78, 0xFF, 0xFF, 0xA1, 0xFF, 0x19, 0x60,
+	 0xA3, 0xF3, 0x12, 0x61, 0x60, 0x40, 0x01, 0x2A, 0x08, 0x00, 0x00, 0x64, 0x3B, 0xFA, 0xBF, 0x60,
+	 0xFF, 0x65, 0x8C, 0x44, 0x3D, 0xFA, 0xA4, 0x84, 0x01, 0x00, 0x8C, 0x44, 0xEB, 0xF0, 0x2A, 0xFA,
+	 0x40, 0x48, 0x04, 0x26, 0x48, 0x00, 0xA1, 0xFF, 0x8C, 0x44, 0x5A, 0xDA, 0x30, 0xFB, 0x6C, 0x44,
+	 0x2C, 0xFA, 0xFF, 0xFF, 0x01, 0x26, 0x2B, 0x00, 0xD0, 0x80, 0xA1, 0xFF, 0x8C, 0x44, 0x6C, 0x5C,
+	 0x00, 0xE1, 0xF2, 0xFE, 0x2D, 0xFA, 0xEC, 0xF3, 0xD4, 0x80, 0xD0, 0x80, 0x2E, 0xF8, 0x24, 0x44,
+	 0x16, 0x0C, 0x32, 0x40, 0x02, 0x2A, 0x07, 0x00, 0x28, 0x42, 0x0C, 0xB2, 0x08, 0x3A, 0x03, 0x00,
+	 0x10, 0xBC, 0x40, 0x44, 0x61, 0x00, 0x04, 0x0A, 0xA1, 0xFF, 0xAB, 0x60, 0xE7, 0x78, 0xFF, 0xFF,
+	 0x11, 0xBC, 0x40, 0x44, 0x28, 0x45, 0xBF, 0x60, 0xFF, 0x64, 0x24, 0x88, 0x55, 0x00, 0x30, 0xBC,
+	 0x40, 0x44, 0x22, 0xF0, 0x40, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDA, 0x4D, 0x00, 0x20, 0xB9,
+	 0x5C, 0x8E, 0xA1, 0xFF, 0x8C, 0x44, 0x2D, 0xFA, 0xDC, 0x9C, 0x6C, 0x44, 0x00, 0xE1, 0xF2, 0xFE,
+	 0x2E, 0xFA, 0x08, 0x28, 0x44, 0x4E, 0xDC, 0x84, 0x2E, 0x5C, 0xB0, 0x84, 0xEF, 0xB1, 0x08, 0x24,
+	 0x40, 0xB9, 0x41, 0x46, 0x39, 0x00, 0x23, 0x41, 0x13, 0x64, 0x51, 0x90, 0x56, 0x63, 0x03, 0x04,
+	 0xAB, 0x60, 0xDE, 0x78, 0xFF, 0xFF, 0x8C, 0x44, 0x04, 0x61, 0x2B, 0xFA, 0x50, 0xFE, 0x80, 0x27,
+	 0x00, 0x64, 0x30, 0xFB, 0x8C, 0x44, 0x2C, 0xFA, 0xD0, 0x80, 0x8C, 0x44, 0x2D, 0xFA, 0xD4, 0x80,
+	 0x00, 0x65, 0x8C, 0x44, 0xEC, 0xF1, 0x2E, 0xFA, 0xD0, 0x80, 0x28, 0x44, 0x03, 0x0C, 0xA0, 0x2A,
+	 0x0A, 0x00, 0x11, 0x00, 0x10, 0x65, 0x60, 0x40, 0xC4, 0x36, 0x04, 0x00, 0xD4, 0x3A, 0x08, 0x00,
+	 0x27, 0x40, 0x40, 0x26, 0x30, 0x65, 0x00, 0x64, 0x3F, 0xFA, 0x46, 0x4E, 0x35, 0x84, 0x64, 0x00,
+	 0x40, 0x26, 0xF9, 0x01, 0x30, 0x65, 0x7A, 0xDC, 0x7A, 0xDC, 0x7A, 0xDC, 0x04, 0x61, 0xF3, 0x01,
+	 0xA1, 0xFF, 0xAB, 0x60, 0xA5, 0x78, 0xFF, 0xFF, 0xFF, 0x60, 0xFE, 0x65, 0x23, 0x43, 0xE8, 0xA3,
+	 0x80, 0x27, 0xF6, 0x01, 0x20, 0xE6, 0x08, 0x60, 0x00, 0xEB, 0x28, 0x44, 0x03, 0x2B, 0x05, 0x00,
+	 0x6A, 0x62, 0x7A, 0xDC, 0x7A, 0xDC, 0x7A, 0xDC, 0x28, 0x44, 0x8F, 0xB0, 0x88, 0x3A, 0x03, 0x00,
+	 0x70, 0x62, 0x7A, 0xDC, 0x28, 0x44, 0x40, 0x2B, 0x0D, 0x00, 0x72, 0x62, 0x7A, 0xDC, 0xA1, 0xFF,
+	 0x6C, 0x5C, 0x5A, 0xD8, 0xE4, 0x40, 0x20, 0x2B, 0x03, 0x00, 0x7A, 0xDC, 0x7A, 0xDC, 0xF8, 0xA3,
+	 0x25, 0xFF, 0xB0, 0xFF, 0x3F, 0xFC, 0x00, 0xF4, 0x10, 0x62, 0x10, 0x61, 0x57, 0x90, 0x6C, 0x61,
+	 0xA1, 0xFF, 0x09, 0x07, 0x02, 0x1D, 0x28, 0x1E, 0x1F, 0x00, 0xCB, 0x83, 0x7A, 0xDC, 0xFE, 0x1C,
+	 0xD9, 0x81, 0x22, 0x1E, 0x19, 0x00, 0xCB, 0x83, 0x0E, 0xA3, 0xA7, 0x84, 0xF2, 0xA3, 0x7A, 0xDC,
+	 0xFE, 0x1C, 0x03, 0x1D, 0x7C, 0xA8, 0xD9, 0x81, 0x0A, 0x02, 0x00, 0xF4, 0x02, 0x62, 0xA7, 0x84,
+	 0x7A, 0x61, 0x7A, 0xDC, 0xFE, 0x1C, 0xF9, 0x1D, 0x7C, 0xA8, 0xD9, 0x81, 0xF6, 0x03, 0xFF, 0xB1,
+	 0x0B, 0x1E, 0x02, 0x02, 0x00, 0xF4, 0x02, 0x62, 0xA1, 0xFF, 0xFF, 0xFF, 0xB6, 0xFF, 0xB7, 0xFF,
+	 0x6C, 0x44, 0x5A, 0xDA, 0xCD, 0x81, 0x64, 0x40, 0x46, 0x45, 0x28, 0x44, 0x40, 0x2B, 0x0E, 0x00,
+	 0x64, 0x40, 0x20, 0x2B, 0x0B, 0x00, 0x01, 0xA2, 0x62, 0x44, 0x46, 0x45, 0x21, 0x46, 0x00, 0xF4,
+	 0x02, 0x62, 0x9A, 0xFF, 0x7A, 0xDC, 0x7A, 0xDC, 0x7A, 0xDC, 0x7A, 0xDC, 0x01, 0x60, 0x18, 0xE1,
+	 0x24, 0x76, 0xAD, 0xE2, 0x41, 0xE1, 0x98, 0xFF, 0x00, 0xE6, 0x01, 0xF2, 0x61, 0x45, 0xD4, 0x9E,
+	 0x21, 0x46, 0x16, 0xFA, 0x25, 0x44, 0x06, 0xFA, 0xA1, 0xFF, 0x8C, 0x44, 0xA1, 0xFF, 0x47, 0xFF,
+	 0x29, 0x40, 0x50, 0x2B, 0x06, 0x00, 0x2B, 0x44, 0x1C, 0x60, 0x11, 0xFB, 0x70, 0x45, 0x44, 0x8B,
+	 0x01, 0x00, 0x50, 0x4B, 0x67, 0x50, 0x69, 0xE2, 0x25, 0x46, 0x01, 0xF2, 0x61, 0x45, 0xD4, 0x9E,
+	 0x21, 0x46, 0x16, 0xFA, 0x25, 0x45, 0x86, 0xF8, 0xFF, 0xFF, 0x6A, 0x44, 0x40, 0x2B, 0x03, 0x15,
+	 0xAF, 0x60, 0xF3, 0x78, 0xFF, 0xFF, 0x29, 0x40, 0x10, 0x26, 0x04, 0x00, 0x04, 0x74, 0xCD, 0xE2,
+	 0xA1, 0xFF, 0xFF, 0xFF, 0x6C, 0x44, 0xB6, 0xFF, 0xB7, 0xFF, 0xC4, 0xE2, 0x01, 0x60, 0x18, 0xE1,
+	 0x05, 0x76, 0xAD, 0xE2, 0x41, 0xE1, 0xA1, 0xFF, 0x6C, 0x45, 0xA1, 0xFF, 0x65, 0x41, 0x7F, 0x60,
+	 0x7F, 0x7C, 0x6C, 0x44, 0xA0, 0x84, 0x15, 0xA7, 0x15, 0xA4, 0x21, 0x46, 0x26, 0xFA, 0x22, 0x46,
+	 0x10, 0xFA, 0x21, 0x46, 0x29, 0x40, 0x40, 0x2B, 0x07, 0x00, 0xB6, 0xFF, 0xA1, 0xFF, 0x40, 0x60,
+	 0x00, 0x65, 0x6C, 0x44, 0x1A, 0xFA, 0x09, 0x00, 0x65, 0x44, 0x0F, 0xB4, 0x06, 0xA8, 0x80, 0x60,
+	 0x00, 0x65, 0x08, 0x28, 0x7C, 0x45, 0x29, 0x44, 0x34, 0x89, 0x00, 0x64, 0x33, 0xFB, 0x40, 0x21,
+	 0x00, 0x00, 0xAC, 0xE2, 0x05, 0xE1, 0x27, 0xF0, 0x65, 0x44, 0x64, 0x5E, 0x27, 0xFA, 0x28, 0x44,
+	 0x8F, 0xB0, 0x88, 0x3A, 0x09, 0x00, 0x39, 0xF2, 0xFF, 0xFF, 0x60, 0xB0, 0x20, 0x3A, 0x04, 0x00,
+	 0x24, 0x44, 0xFF, 0x60, 0xDF, 0xB4, 0x40, 0x44, 0x28, 0x40, 0x03, 0x26, 0xE2, 0x00, 0x31, 0x40,
+	 0x20, 0x2A, 0x03, 0x00, 0x28, 0x40, 0x50, 0x3A, 0xDC, 0x00, 0x24, 0x44, 0x20, 0x2A, 0xD9, 0x00,
+	 0x29, 0x40, 0x50, 0x2B, 0x0D, 0x00, 0xEF, 0x60, 0xFF, 0x65, 0x29, 0x44, 0x24, 0x89, 0x31, 0x40,
+	 0x08, 0x2A, 0x06, 0x00, 0x1C, 0x60, 0x11, 0xF3, 0xFF, 0xFF, 0xE0, 0x85, 0x2B, 0x44, 0x06, 0x05,
+	 0x2B, 0x44, 0xFF, 0xA4, 0x01, 0xA4, 0x04, 0x24, 0x00, 0x64, 0x40, 0x4B, 0xAC, 0x80, 0x28, 0x40,
+	 0xB4, 0x3A, 0x03, 0x00, 0x02, 0x03, 0x30, 0xFB, 0xBC, 0x00, 0x28, 0x44, 0xBF, 0x60, 0xFF, 0x65,
+	 0xA4, 0x84, 0x40, 0x48, 0x2B, 0x50, 0xA1, 0xFF, 0xFF, 0xFF, 0x01, 0x60, 0x08, 0xE1, 0x1C, 0xF2,
+	 0xC4, 0xE2, 0x40, 0x45, 0x28, 0x40, 0xC4, 0x36, 0x9C, 0x00, 0x29, 0x40, 0x40, 0x2B, 0x48, 0x00,
+	 0x32, 0x60, 0xFA, 0x63, 0x60, 0x40, 0x0B, 0x36, 0x20, 0x00, 0x0F, 0x36, 0x1B, 0x00, 0x0A, 0x36,
+	 0x16, 0x00, 0x0E, 0x36, 0x11, 0x00, 0x09, 0x36, 0x0C, 0x00, 0x0D, 0x36, 0x07, 0x00, 0x08, 0x36,
+	 0x02, 0x00, 0xA3, 0xD3, 0x15, 0x00, 0x02, 0xA3, 0xA3, 0xD3, 0x12, 0x00, 0x04, 0xA3, 0xA3, 0xD3,
+	 0x0F, 0x00, 0x06, 0xA3, 0xA3, 0xD3, 0x0C, 0x00, 0x08, 0xA3, 0xA3, 0xD3, 0x09, 0x00, 0x0A, 0xA3,
+	 0xA3, 0xD3, 0x06, 0x00, 0x0C, 0xA3, 0xA3, 0xD3, 0x03, 0x00, 0x0E, 0xA3, 0xA3, 0xD3, 0xFF, 0xFF,
+	 0x2C, 0x60, 0x7C, 0x63, 0x60, 0x40, 0x0C, 0x36, 0x19, 0x00, 0x08, 0x36, 0x15, 0x00, 0x0D, 0x36,
+	 0x11, 0x00, 0x09, 0x36, 0x0D, 0x00, 0x0E, 0x36, 0x09, 0x00, 0x0A, 0x36, 0x05, 0x00, 0x0F, 0x36,
+	 0x01, 0x00, 0x39, 0x00, 0x02, 0xA3, 0x37, 0x00, 0x04, 0xA3, 0x35, 0x00, 0x06, 0xA3, 0x33, 0x00,
+	 0x08, 0xA3, 0x31, 0x00, 0x0A, 0xA3, 0x2F, 0x00, 0x0C, 0xA3, 0x2D, 0x00, 0x0E, 0xA3, 0x2B, 0x00,
+	 0x33, 0x60, 0x0A, 0x63, 0x25, 0x44, 0x0A, 0x36, 0x0C, 0x00, 0x14, 0x36, 0x07, 0x00, 0x37, 0x36,
+	 0x02, 0x00, 0xA3, 0xD3, 0x09, 0x00, 0x02, 0xA3, 0xA3, 0xD3, 0x06, 0x00, 0x04, 0xA3, 0xA3, 0xD3,
+	 0x03, 0x00, 0x06, 0xA3, 0xA3, 0xD3, 0xFF, 0xFF, 0x40, 0x45, 0x0A, 0x36, 0x0D, 0x00, 0x14, 0x36,
+	 0x38, 0x64, 0x37, 0x3A, 0x03, 0x00, 0x04, 0x7F, 0x40, 0x45, 0x15, 0x64, 0x6E, 0x3A, 0x09, 0x00,
+	 0x84, 0x7F, 0x40, 0x45, 0x0B, 0x64, 0x05, 0x00, 0x29, 0x44, 0x7F, 0x60, 0xFF, 0xB4, 0x40, 0x49,
+	 0x70, 0x64, 0x40, 0x4D, 0x02, 0x00, 0x40, 0x45, 0x0A, 0x00, 0x2C, 0x60, 0x74, 0x63, 0x0A, 0x36,
+	 0x06, 0x00, 0x14, 0x36, 0x02, 0xA3, 0x37, 0x36, 0x04, 0xA3, 0x6E, 0x36, 0x06, 0xA3, 0x28, 0xA3,
+	 0xA3, 0xD1, 0xD8, 0xA3, 0x19, 0x60, 0x55, 0xF9, 0x39, 0xF1, 0xA3, 0xD1, 0x64, 0x41, 0x64, 0x5E,
+	 0x60, 0x45, 0x64, 0x47, 0x1F, 0xB4, 0x54, 0x94, 0xE0, 0xA0, 0x02, 0x0D, 0x00, 0x64, 0x02, 0x00,
+	 0x01, 0x04, 0x1F, 0x64, 0x60, 0x47, 0xB4, 0x85, 0x29, 0x44, 0xC0, 0x60, 0x00, 0xB4, 0xB4, 0x84,
+	 0x1F, 0xFA, 0xB5, 0xFF, 0xA1, 0xFF, 0xCB, 0xF3, 0xC4, 0xE2, 0x89, 0xFF, 0x60, 0x54, 0x88, 0xFF,
+	 0xDC, 0x84, 0xE0, 0x94, 0xFF, 0x60, 0xCF, 0x65, 0x29, 0x44, 0x24, 0x89, 0xA5, 0x60, 0x88, 0x78,
+	 0x04, 0xE1, 0xA1, 0xFF, 0xFF, 0xFF, 0xC4, 0xE2, 0xA1, 0xFF, 0xFF, 0x60, 0xCF, 0x65, 0x29, 0x44,
+	 0x24, 0x89, 0xCB, 0xF3, 0xC4, 0xE2, 0x89, 0xFF, 0x60, 0x54, 0x88, 0xFF, 0xDC, 0x84, 0xE0, 0x94,
+	 0x26, 0x44, 0x84, 0xBC, 0x24, 0x40, 0x0C, 0x22, 0xFD, 0xB4, 0x40, 0x46, 0x23, 0x64, 0x3A, 0xDB,
+	 0xAD, 0x60, 0x4F, 0x78, 0xFF, 0xFF, 0x27, 0x40, 0x26, 0x22, 0x05, 0x00, 0xF8, 0xB4, 0x40, 0x47,
+	 0x06, 0x64, 0x31, 0xFB, 0xC0, 0xFE, 0x29, 0x40, 0x10, 0x26, 0x02, 0x00, 0x04, 0x74, 0xCD, 0xE2,
+	 0x01, 0x60, 0x18, 0xE1, 0x01, 0x60, 0x18, 0xE1, 0x01, 0x11, 0x12, 0x00, 0x29, 0x44, 0x20, 0xBC,
+	 0x40, 0x49, 0x01, 0x64, 0x33, 0xFB, 0xB6, 0xFF, 0x00, 0xE1, 0x01, 0x60, 0x1A, 0xE1, 0xA1, 0xFF,
+	 0xFF, 0xFF, 0x6C, 0x40, 0xFC, 0x11, 0x01, 0x60, 0x18, 0xE1, 0xAE, 0x4F, 0xF7, 0xB4, 0xA0, 0x5E,
+	 0xB5, 0xFF, 0x47, 0xFF, 0xB6, 0xFF, 0xB7, 0xFF, 0xB4, 0xFF, 0xC8, 0x60, 0x09, 0x7D, 0x7C, 0x4B,
+	 0x29, 0x40, 0x50, 0x2B, 0x1B, 0x00, 0x31, 0x40, 0x08, 0x2A, 0x0D, 0x00, 0x1C, 0x60, 0x11, 0xF3,
+	 0xFF, 0xFF, 0xE0, 0x85, 0x2B, 0x44, 0x07, 0x04, 0x70, 0x45, 0xC4, 0x84, 0xEF, 0x60, 0xFF, 0x65,
+	 0x29, 0x44, 0x24, 0x89, 0x11, 0x00, 0x2B, 0x44, 0x70, 0x45, 0xC4, 0x84, 0xFF, 0xFF, 0x04, 0x24,
+	 0x00, 0xB4, 0x40, 0x4B, 0xEF, 0x60, 0xFF, 0x65, 0x29, 0x44, 0x24, 0x89, 0x37, 0xF3, 0x2B, 0x45,
+	 0xD4, 0x80, 0xFF, 0xFF, 0x02, 0x28, 0x65, 0x44, 0x60, 0x50, 0xA0, 0x4C, 0x20, 0xBC, 0xFF, 0xB4,
+	 0xA0, 0x51, 0x00, 0x60, 0x2E, 0x7C, 0x74, 0x44, 0xC0, 0x94, 0x32, 0x40, 0x02, 0x2A, 0x19, 0x00,
+	 0x28, 0x44, 0xA4, 0x36, 0x03, 0x00, 0x0C, 0xB4, 0x04, 0x36, 0x13, 0x00, 0x26, 0x43, 0xFD, 0xB3,
+	 0x04, 0xBB, 0x43, 0x46, 0x01, 0x2A, 0x03, 0x00, 0x28, 0x47, 0x40, 0xBF, 0x40, 0x48, 0x0A, 0xBB,
+	 0x0F, 0xFC, 0x50, 0x4B, 0x67, 0x50, 0x00, 0x64, 0x30, 0xFB, 0x05, 0xFF, 0xAD, 0x60, 0x4F, 0x78,
+	 0xFF, 0xFF, 0x24, 0x64, 0x3A, 0xDB, 0x28, 0x44, 0x04, 0x2A, 0x03, 0x00, 0xA3, 0x60, 0xE7, 0x78,
+	 0xFF, 0xFF, 0x32, 0x40, 0x04, 0x2A, 0x1C, 0x00, 0x28, 0x44, 0x0C, 0xB0, 0x08, 0x3A, 0x18, 0x00,
+	 0x2C, 0xF0, 0x22, 0xF0, 0x64, 0x40, 0x01, 0x26, 0x0B, 0x00, 0x64, 0x40, 0x40, 0x2B, 0x10, 0x00,
+	 0x8F, 0xB0, 0x88, 0x3A, 0x0D, 0x00, 0x39, 0xF2, 0xFF, 0xFF, 0x60, 0xB0, 0x20, 0x3A, 0x08, 0x00,
+	 0x26, 0x44, 0xFD, 0xB4, 0x04, 0xBC, 0x40, 0x46, 0xFC, 0xB4, 0x0F, 0xFA, 0x05, 0xFF, 0x01, 0x00,
+	 0x1D, 0xFF, 0x01, 0xE2, 0x26, 0x40, 0x10, 0x2A, 0x06, 0x00, 0x2C, 0x60, 0xEA, 0x64, 0xF1, 0x60,
+	 0x78, 0x41, 0xE4, 0x78, 0xB5, 0xF1, 0xA3, 0x60, 0xE7, 0x78, 0xFF, 0xFF, 0x03, 0x0A, 0xA3, 0x60,
+	 0xF4, 0x78, 0xFF, 0xFF, 0x01, 0x64, 0x51, 0xFB, 0x1B, 0x60, 0xEE, 0xF3, 0xFF, 0xFF, 0x04, 0x18,
+	 0xAE, 0x4F, 0x08, 0xBC, 0x00, 0x7F, 0xA0, 0x5E, 0xE1, 0xE1, 0xA1, 0xFF, 0xFF, 0xFF, 0x81, 0x3E,
+	 0x54, 0x62, 0x22, 0x46, 0xA2, 0xD0, 0x16, 0x63, 0x7C, 0x41, 0x44, 0x48, 0x80, 0x36, 0x04, 0x61,
+	 0x28, 0x40, 0x50, 0x36, 0x04, 0x61, 0x41, 0x4E, 0x28, 0x44, 0xA4, 0x36, 0x0E, 0x63, 0x9A, 0xFF,
+	 0xA1, 0xFF, 0x19, 0x60, 0xA3, 0xF3, 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x2A, 0x06, 0x00, 0x3D, 0xF2,
+	 0xAA, 0xF0, 0xFF, 0xFF, 0xB4, 0x84, 0x08, 0x36, 0x2A, 0xFA, 0x12, 0x74, 0xCD, 0xE2, 0x54, 0x62,
+	 0xA2, 0xD2, 0xFF, 0xFF, 0x6A, 0x40, 0x80, 0x4E, 0x12, 0x74, 0x7A, 0xD4, 0x12, 0x74, 0x7A, 0xD4,
+	 0x12, 0x74, 0x7A, 0xD4, 0x12, 0x74, 0x7A, 0xD4, 0x12, 0x74, 0x7A, 0xD4, 0x12, 0x74, 0x7A, 0xD4,
+	 0x12, 0x74, 0x7A, 0xD4, 0x12, 0x74, 0xFF, 0xFF, 0x01, 0x1D, 0xB2, 0x00, 0x7A, 0xD4, 0x12, 0x74,
+	 0x7A, 0xD4, 0x12, 0x74, 0x7A, 0xD4, 0x12, 0x74, 0x7A, 0xD4, 0x12, 0x74, 0x28, 0x40, 0x03, 0x2B,
+	 0x06, 0x00, 0x7A, 0xD4, 0x12, 0x74, 0x7A, 0xD4, 0x12, 0x74, 0x7A, 0xD4, 0x12, 0x74, 0x70, 0x62,
+	 0x28, 0x44, 0x8F, 0xB0, 0x88, 0x3A, 0x02, 0x00, 0x7A, 0xD4, 0x12, 0x74, 0x28, 0x40, 0x40, 0x2B,
+	 0x16, 0x00, 0x72, 0x62, 0x7A, 0xD4, 0x12, 0x74, 0x7A, 0xD2, 0x12, 0x74, 0x80, 0x4C, 0x20, 0x2B,
+	 0x05, 0x00, 0x12, 0x74, 0x7A, 0xD4, 0x12, 0x74, 0x7A, 0xD4, 0x12, 0x74, 0x22, 0xF2, 0xFF, 0xFF,
+	 0x60, 0x40, 0x10, 0x26, 0x04, 0x00, 0x26, 0x26, 0x4D, 0x00, 0x26, 0x27, 0x4B, 0x00, 0x23, 0x43,
+	 0xFF, 0xFF, 0x06, 0x1D, 0x2E, 0x1E, 0x00, 0x00, 0x03, 0xF0, 0x04, 0xF4, 0x64, 0x42, 0x3D, 0x00,
+	 0x2E, 0x40, 0x04, 0x2A, 0x27, 0x00, 0xA1, 0xFF, 0x02, 0xFE, 0x10, 0x25, 0x42, 0xFE, 0x12, 0x74,
+	 0x72, 0x45, 0x65, 0x4C, 0xB2, 0xF3, 0x03, 0x04, 0xE4, 0xE2, 0xDC, 0x84, 0xB2, 0xFB, 0xA1, 0xFF,
+	 0x12, 0x74, 0x80, 0x4C, 0x12, 0x74, 0xB3, 0xF3, 0x02, 0x04, 0xDC, 0x84, 0xB3, 0xFB, 0x80, 0x4C,
+	 0x12, 0x74, 0xB4, 0xF3, 0x02, 0x04, 0xDC, 0x84, 0xB4, 0xFB, 0x80, 0x4C, 0x12, 0x74, 0x5C, 0x4E,
+	 0xF8, 0xA3, 0x03, 0xF2, 0x9A, 0xF2, 0x04, 0xF4, 0xFF, 0xB1, 0xF8, 0xA1, 0x06, 0xA4, 0x60, 0x42,
+	 0x0A, 0x00, 0x4E, 0x00, 0x03, 0xF2, 0x9A, 0xF2, 0x04, 0xF4, 0xC8, 0x82, 0xFF, 0xB1, 0x03, 0x00,
+	 0x00, 0xF4, 0x81, 0xF2, 0xFF, 0xB1, 0x7A, 0xD4, 0x12, 0x74, 0xFD, 0x1C, 0xF9, 0x1D, 0xFF, 0xB1,
+	 0x1B, 0x1E, 0x02, 0x02, 0x00, 0xF4, 0xDA, 0x82, 0xDA, 0x82, 0xA2, 0xD2, 0xA1, 0xFF, 0x09, 0x74,
+	 0x60, 0x4D, 0x12, 0x00, 0x03, 0xF2, 0x9A, 0xF2, 0x04, 0xF4, 0x23, 0x43, 0xA1, 0xFF, 0x12, 0x74,
+	 0xA0, 0xD2, 0xFE, 0xA1, 0xCB, 0x83, 0x60, 0x4E, 0xAF, 0x83, 0x03, 0x1D, 0x05, 0x03, 0x12, 0x74,
+	 0xEB, 0x01, 0xA1, 0xFF, 0x12, 0x74, 0xDF, 0x01, 0x12, 0x74, 0xDA, 0x83, 0x66, 0x44, 0x22, 0x46,
+	 0x0C, 0xFA, 0x22, 0xF2, 0x0B, 0xFC, 0x28, 0x40, 0x40, 0x2B, 0x1A, 0x00, 0x10, 0x26, 0x04, 0x00,
+	 0x26, 0x26, 0x0F, 0x00, 0x26, 0x27, 0x0D, 0x00, 0x00, 0xF4, 0x02, 0x62, 0xA1, 0xFF, 0x12, 0x74,
+	 0x7A, 0xD4, 0x12, 0x74, 0x7A, 0xD4, 0x12, 0x74, 0x7A, 0xD4, 0x12, 0x74, 0x7A, 0xD4, 0x12, 0x74,
+	 0x07, 0x00, 0xA1, 0xFF, 0x12, 0x74, 0x9C, 0x4E, 0x12, 0x74, 0x9C, 0x4C, 0x12, 0x74, 0x00, 0x00,
+	 0x88, 0xFF, 0xA1, 0xFF, 0xB2, 0x60, 0x58, 0x4F, 0x2D, 0x78, 0xFF, 0xFF, 0x01, 0x60, 0x18, 0xE1,
+	 0x78, 0x44, 0x02, 0xA4, 0x35, 0xFB, 0xCC, 0x00, 0x29, 0x44, 0xF7, 0xB4, 0x40, 0x49, 0x34, 0x64,
+	 0x3A, 0xDB, 0x44, 0xE1, 0xA5, 0x60, 0x54, 0x78, 0xFF, 0xFF, 0x00, 0x6B, 0xBC, 0xFF, 0x15, 0xF3,
+	 0xFF, 0xFF, 0xDC, 0x84, 0x15, 0xFB, 0x78, 0x5C, 0x07, 0x00, 0x78, 0x5C, 0x2F, 0x00, 0x62, 0xFF,
+	 0xFF, 0xFF, 0xA1, 0xFF, 0x98, 0xFF, 0x80, 0x3E, 0x80, 0x60, 0x01, 0xE0, 0xD5, 0x60, 0x84, 0xE7,
+	 0xA1, 0xF3, 0x40, 0x60, 0x60, 0x40, 0x01, 0x23, 0x48, 0x60, 0x5E, 0x65, 0x80, 0x60, 0x00, 0x6A,
+	 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x65, 0x4A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x00, 0x60,
+	 0x00, 0x6A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x80, 0x60, 0x00, 0x6A, 0xFF, 0xFF, 0x01, 0x16,
+	 0xFE, 0x01, 0x65, 0x4A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x00, 0x60, 0x01, 0x6A, 0xFF, 0xFF,
+	 0x01, 0x16, 0xFE, 0x01, 0x95, 0x60, 0x84, 0xE7, 0x64, 0x58, 0xFF, 0xFF, 0x80, 0x60, 0x01, 0xE0,
+	 0xD5, 0x60, 0x84, 0xE7, 0xA1, 0xF3, 0x7C, 0x45, 0x60, 0x40, 0x01, 0x23, 0x02, 0x65, 0x8C, 0x60,
+	 0x48, 0x6A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x00, 0x60, 0x00, 0x6A, 0xFF, 0xFF, 0x01, 0x16,
+	 0xFE, 0x01, 0x00, 0x60, 0x7F, 0x6A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x84, 0x60, 0x04, 0x6A,
+	 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x48, 0x60, 0x08, 0x6A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01,
+	 0x65, 0x4A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x84, 0x60, 0x04, 0x6A, 0xFF, 0xFF, 0x01, 0x16,
+	 0xFE, 0x01, 0x40, 0x60, 0x08, 0x6A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x65, 0x4A, 0xFF, 0xFF,
+	 0x01, 0x16, 0xFE, 0x01, 0x8C, 0x60, 0x48, 0x6A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x00, 0x60,
+	 0x00, 0x6A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x00, 0x60, 0x00, 0x6A, 0xFF, 0xFF, 0x01, 0x16,
+	 0xFE, 0x01, 0x95, 0x60, 0x84, 0xE7, 0x64, 0x58, 0xFF, 0xFF, 0x12, 0x74, 0x6A, 0x40, 0x87, 0x4F,
+	 0x12, 0x74, 0x87, 0x4C, 0x12, 0x74, 0x29, 0x40, 0x40, 0x2B, 0x08, 0x00, 0x0A, 0x64, 0x89, 0xFF,
+	 0x60, 0x54, 0x88, 0xFF, 0x87, 0x4D, 0x12, 0x74, 0x87, 0x4D, 0x09, 0x00, 0x03, 0x64, 0x89, 0xFF,
+	 0x60, 0x54, 0x88, 0xFF, 0x87, 0x4F, 0x12, 0x74, 0x87, 0x4D, 0x12, 0x74, 0x87, 0x4D, 0x7C, 0x44,
+	 0x01, 0x08, 0x01, 0x00, 0x67, 0x44, 0x12, 0x74, 0x87, 0x4C, 0x12, 0x74, 0x87, 0x4C, 0x12, 0x74,
+	 0x87, 0x4C, 0x12, 0x74, 0x87, 0x4D, 0x12, 0x74, 0x87, 0x4D, 0x12, 0x74, 0x87, 0x4D, 0x12, 0x74,
+	 0x04, 0x21, 0x04, 0x00, 0xFF, 0x2A, 0x01, 0x00, 0x04, 0x00, 0x03, 0x00, 0xFF, 0x2A, 0x0D, 0x00,
+	 0x0C, 0x00, 0xBC, 0xFF, 0x61, 0xFF, 0x78, 0x5C, 0x57, 0x01, 0x78, 0x5C, 0x7F, 0x01, 0xB6, 0xFF,
+	 0xB7, 0xFF, 0xB4, 0xFF, 0xC8, 0x60, 0x09, 0x7D, 0x7C, 0x4B, 0x6A, 0x44, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x04, 0x74, 0xC4, 0xE2, 0x04, 0xE1, 0x29, 0x40, 0x40, 0x2B, 0x05, 0x00, 0xA1, 0xFF, 0xFF, 0xFF,
+	 0xBC, 0xFF, 0x14, 0x74, 0x01, 0x00, 0x04, 0x74, 0xC4, 0xE2, 0x04, 0xE1, 0xBC, 0xFF, 0xB5, 0xFF,
+	 0x47, 0xFF, 0xB6, 0xFF, 0xB7, 0xFF, 0xB4, 0xFF, 0xC8, 0x60, 0x09, 0x7D, 0x7C, 0x4B, 0x29, 0x40,
+	 0x40, 0x27, 0x04, 0x00, 0xC2, 0x60, 0x58, 0x4F, 0xBA, 0x78, 0xFF, 0xFF, 0xA1, 0xFF, 0x29, 0x40,
+	 0x10, 0x26, 0x6D, 0x00, 0x80, 0x60, 0x01, 0xE0, 0xD5, 0x60, 0x84, 0xE7, 0xA1, 0xF3, 0x40, 0x60,
+	 0x60, 0x40, 0x01, 0x23, 0x48, 0x60, 0x5E, 0x65, 0x80, 0x60, 0x00, 0x6A, 0xFF, 0xFF, 0x01, 0x16,
+	 0xFE, 0x01, 0x65, 0x4A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x00, 0x60, 0x00, 0x6A, 0xFF, 0xFF,
+	 0x01, 0x16, 0xFE, 0x01, 0x80, 0x60, 0x00, 0x6A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x65, 0x4A,
+	 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x00, 0x60, 0x01, 0x6A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01,
+	 0x95, 0x60, 0x84, 0xE7, 0x80, 0x60, 0x01, 0xE0, 0xD5, 0x60, 0x84, 0xE7, 0xA1, 0xF3, 0x7C, 0x45,
+	 0x60, 0x40, 0x01, 0x23, 0x02, 0x65, 0x8C, 0x60, 0x48, 0x6A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01,
+	 0x00, 0x60, 0x00, 0x6A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x00, 0x60, 0x7F, 0x6A, 0xFF, 0xFF,
+	 0x01, 0x16, 0xFE, 0x01, 0x84, 0x60, 0x04, 0x6A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x48, 0x60,
+	 0x08, 0x6A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x65, 0x4A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01,
+	 0x84, 0x60, 0x04, 0x6A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x40, 0x60, 0x08, 0x6A, 0xFF, 0xFF,
+	 0x01, 0x16, 0xFE, 0x01, 0x65, 0x4A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x8C, 0x60, 0x48, 0x6A,
+	 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x00, 0x60, 0x00, 0x6A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01,
+	 0x00, 0x60, 0x00, 0x6A, 0xFF, 0xFF, 0x01, 0x16, 0xFE, 0x01, 0x95, 0x60, 0x84, 0xE7, 0x01, 0x60,
+	 0x08, 0xE1, 0xFF, 0xFF, 0xC4, 0xE2, 0x29, 0x40, 0x40, 0x2B, 0x04, 0x00, 0xC2, 0x60, 0x58, 0x4F,
+	 0xBA, 0x78, 0xFF, 0xFF, 0xC2, 0x60, 0x58, 0x4F, 0xC5, 0x78, 0xFF, 0xFF, 0xA1, 0xFF, 0xCB, 0xF3,
+	 0xC4, 0xE2, 0x89, 0xFF, 0x60, 0x54, 0x88, 0xFF, 0xDC, 0x84, 0xE0, 0x94, 0x35, 0xF7, 0xFF, 0xFF,
+	 0xFF, 0xFF, 0xFF, 0x01, 0x10, 0x61, 0x7F, 0x60, 0xC0, 0x64, 0xA0, 0x80, 0x7F, 0x67, 0x02, 0x63,
+	 0x25, 0x02, 0x98, 0xFE, 0x19, 0x05, 0x12, 0x60, 0xFC, 0xF5, 0x0E, 0xF2, 0x15, 0x18, 0x02, 0x18,
+	 0x09, 0xF4, 0xFB, 0x01, 0x23, 0x44, 0x00, 0xA8, 0x08, 0x7E, 0x0A, 0x02, 0x66, 0x44, 0x11, 0xFB,
+	 0x46, 0x43, 0x23, 0x47, 0x80, 0xBF, 0x3B, 0x42, 0x04, 0xA2, 0xA2, 0xDB, 0x28, 0xB9, 0x10, 0x7E,
+	 0x00, 0x7F, 0x0E, 0xFA, 0x00, 0x67, 0x0A, 0x00, 0x20, 0x44, 0xDC, 0x85, 0x0F, 0xB4, 0xFB, 0xA0,
+	 0x7F, 0x67, 0x07, 0x63, 0x03, 0x05, 0x45, 0x40, 0x00, 0x67, 0xD8, 0xFE, 0xFF, 0x27, 0x05, 0xFD,
+	 0x0A, 0x7E, 0x04, 0xFB, 0x61, 0x55, 0x48, 0x00, 0x28, 0xFB, 0x01, 0xF3, 0x29, 0xFB, 0x44, 0x46,
+	 0x40, 0x45, 0x10, 0x61, 0x7E, 0x60, 0xC0, 0x64, 0xA0, 0x80, 0x7F, 0x67, 0x02, 0x63, 0x30, 0x02,
+	 0xB5, 0x60, 0x58, 0x4F, 0xCE, 0x78, 0xFF, 0xFF, 0x7F, 0x67, 0x03, 0x63, 0x29, 0x02, 0x26, 0x40,
+	 0x01, 0x2B, 0x23, 0x00, 0x98, 0xFE, 0x18, 0x05, 0x12, 0x60, 0xFC, 0xF5, 0x0E, 0xF2, 0x14, 0x18,
+	 0x02, 0x18, 0x09, 0xF4, 0xFB, 0x01, 0x23, 0x44, 0x00, 0xA8, 0x08, 0x7E, 0x0A, 0x02, 0x66, 0x44,
+	 0x11, 0xFB, 0x46, 0x43, 0x23, 0x47, 0x80, 0xBF, 0x3B, 0x42, 0x04, 0xA2, 0xA2, 0xDB, 0x08, 0xB9,
+	 0x10, 0x7E, 0x00, 0x7F, 0x0E, 0xFA, 0x09, 0x00, 0x20, 0x44, 0xDC, 0x85, 0x0F, 0xB4, 0xFB, 0xA0,
+	 0x7F, 0x67, 0x07, 0x63, 0x05, 0x05, 0x45, 0x40, 0xD8, 0xFE, 0x00, 0x67, 0xD0, 0xFE, 0xD9, 0xFE,
+	 0xFF, 0x27, 0x05, 0xFD, 0x0B, 0x7E, 0x04, 0xFB, 0x0E, 0x60, 0xDD, 0xF3, 0xFF, 0xFF, 0x20, 0xB0,
+	 0x80, 0xBC, 0x08, 0x28, 0xA2, 0xDB, 0x61, 0x55, 0x66, 0x00, 0x04, 0xB5, 0x82, 0xB5, 0x25, 0x02,
+	 0x04, 0x03, 0x20, 0x44, 0x7F, 0xB4, 0x40, 0x40, 0xA3, 0xD3, 0x99, 0xFE, 0x04, 0x04, 0x02, 0xBC,
+	 0xFE, 0xB4, 0xA3, 0xDB, 0x59, 0x00, 0xDB, 0xF3, 0x20, 0x40, 0x80, 0x26, 0x55, 0x00, 0xA3, 0xD3,
+	 0xFF, 0xA0, 0xF8, 0xB4, 0x02, 0x02, 0xA3, 0xDB, 0x1C, 0x00, 0x04, 0xBC, 0xBF, 0xB4, 0xA3, 0xDB,
+	 0x08, 0xB0, 0x01, 0x64, 0x08, 0x24, 0x02, 0x64, 0x28, 0xFB, 0x20, 0x44, 0x80, 0xBC, 0x40, 0x40,
+	 0xD0, 0xFE, 0x42, 0x00, 0xBF, 0xB4, 0xA3, 0xDB, 0x3F, 0x00, 0x40, 0xB0, 0xFF, 0xFF, 0xFA, 0x02,
+	 0xF8, 0xB4, 0xA3, 0xDB, 0x08, 0xB5, 0x07, 0x7C, 0x01, 0x02, 0xDB, 0xF9, 0x20, 0x44, 0x7F, 0xB4,
+	 0x40, 0x40, 0x1D, 0x60, 0xBA, 0x63, 0xA3, 0xD3, 0xFF, 0xFF, 0x20, 0xB5, 0x07, 0xB5, 0x08, 0x28,
+	 0xC4, 0x02, 0x99, 0xFE, 0x29, 0x05, 0x20, 0x44, 0x80, 0x26, 0x26, 0x00, 0x20, 0x2A, 0x03, 0x00,
+	 0xDF, 0xB4, 0x40, 0x40, 0x74, 0x00, 0x40, 0x2A, 0x1F, 0x00, 0xBF, 0xB4, 0x40, 0x40, 0x09, 0x00,
+	 0xA8, 0xFF, 0x20, 0x44, 0x99, 0xFE, 0x02, 0x05, 0x80, 0x2A, 0x03, 0x00, 0x40, 0xBC, 0x40, 0x40,
+	 0x13, 0x00, 0x00, 0xF1, 0x80, 0xBC, 0x40, 0x40, 0x64, 0x44, 0xE0, 0x84, 0xE8, 0x84, 0x0A, 0x36,
+	 0x29, 0x01, 0x0B, 0x36, 0x59, 0x01, 0x28, 0xFB, 0x01, 0xF1, 0x29, 0xF9, 0x02, 0xF1, 0x2A, 0xF9,
+	 0x03, 0xF1, 0x2B, 0xF9, 0xD0, 0xFE, 0xAE, 0xFF, 0xA1, 0xFF, 0xFF, 0xFF, 0x82, 0x3E, 0x75, 0x44,
+	 0x02, 0xB0, 0x01, 0xB0, 0x54, 0x02, 0xDC, 0x02, 0x04, 0xB0, 0x08, 0xB0, 0x10, 0x02, 0x2A, 0x02,
+	 0x40, 0x26, 0xA7, 0xFF, 0x8C, 0xFF, 0x75, 0x40, 0x80, 0x2B, 0x06, 0x00, 0xAB, 0xFF, 0x19, 0x60,
+	 0xF6, 0xF3, 0xFF, 0xFF, 0xFE, 0xB4, 0xA2, 0xDB, 0x75, 0x44, 0x8D, 0xFF, 0xE5, 0x01, 0x0A, 0xF3,
+	 0xAA, 0xFF, 0x60, 0x40, 0x20, 0x2B, 0x02, 0x00, 0x38, 0xFF, 0x0D, 0x00, 0x01, 0x26, 0x0C, 0x00,
+	 0xC0, 0x60, 0x00, 0x7C, 0xA0, 0x84, 0x80, 0x3B, 0x02, 0x00, 0xC0, 0x67, 0x03, 0x00, 0x40, 0x3B,
+	 0x02, 0x00, 0x00, 0x67, 0x0A, 0xFB, 0xD0, 0x01, 0x19, 0x60, 0xF6, 0xF3, 0xFF, 0xFF, 0xFE, 0xB4,
+	 0xA2, 0xDB, 0xCA, 0x01, 0x0B, 0xF1, 0xAB, 0xFF, 0x64, 0x44, 0xFF, 0x27, 0x1F, 0x00, 0x20, 0x26,
+	 0x03, 0x00, 0x02, 0x60, 0x00, 0x75, 0x1A, 0x00, 0x19, 0xF3, 0xFF, 0xFF, 0x03, 0x1B, 0x04, 0x60,
+	 0x00, 0x75, 0x0A, 0x64, 0xCC, 0x84, 0x19, 0xFB, 0x01, 0x60, 0x00, 0x75, 0x64, 0x40, 0x03, 0x22,
+	 0x0D, 0x00, 0x20, 0x44, 0x80, 0x2A, 0x03, 0x00, 0x20, 0xBC, 0x40, 0x40, 0x07, 0x00, 0xD9, 0xFE,
+	 0x81, 0x60, 0x0B, 0x64, 0x28, 0xFB, 0x2C, 0x44, 0x29, 0xFB, 0xD0, 0xFE, 0xA5, 0x01, 0xA9, 0xFF,
+	 0x77, 0x44, 0x60, 0x57, 0x40, 0x4A, 0x01, 0x2A, 0x31, 0x00, 0x24, 0x44, 0xAC, 0x86, 0x08, 0xF2,
+	 0x2D, 0x03, 0x25, 0x60, 0xFE, 0x65, 0xD4, 0x80, 0x0E, 0xF2, 0x02, 0x03, 0xA5, 0xD5, 0x04, 0x00,
+	 0x01, 0xBC, 0x0E, 0xFA, 0x09, 0xF4, 0xD1, 0xFE, 0x46, 0x44, 0x11, 0x1B, 0x32, 0x40, 0x80, 0x2A,
+	 0x1D, 0x00, 0x9D, 0xFE, 0x1B, 0x05, 0x13, 0x60, 0x02, 0xF3, 0xFF, 0xFF, 0x00, 0xA8, 0x60, 0x46,
+	 0x03, 0x03, 0x0F, 0xF2, 0xFF, 0xFF, 0x12, 0x1B, 0x08, 0x60, 0x00, 0x75, 0x0F, 0x00, 0x3F, 0xF2,
+	 0x48, 0x65, 0xC4, 0x84, 0x13, 0xFB, 0x66, 0x44, 0x10, 0xFB, 0x66, 0x47, 0x20, 0xBF, 0x3B, 0x42,
+	 0x04, 0xA2, 0xA2, 0xDB, 0x0E, 0xF2, 0x41, 0x75, 0x10, 0xBC, 0x0E, 0xFA, 0x2A, 0x44, 0x08, 0x2A,
+	 0x17, 0x00, 0x23, 0x44, 0x00, 0xA8, 0x5C, 0x43, 0x13, 0x03, 0x12, 0x60, 0xFC, 0xF5, 0x01, 0x00,
+	 0x09, 0xF4, 0x0E, 0xF2, 0x0D, 0x18, 0x08, 0xB0, 0x18, 0xAC, 0xFA, 0x03, 0x0E, 0xFA, 0x66, 0x43,
+	 0x11, 0xFD, 0x46, 0x43, 0x23, 0x47, 0x80, 0xBF, 0x3B, 0x42, 0x04, 0xA2, 0xA2, 0xDB, 0x28, 0x75,
+	 0x2A, 0x44, 0x06, 0x22, 0x2D, 0x00, 0x22, 0x44, 0x00, 0xA8, 0x60, 0x46, 0x0E, 0xF2, 0x28, 0x03,
+	 0x10, 0xB0, 0x01, 0xBC, 0x03, 0x02, 0x00, 0x64, 0x40, 0x42, 0x22, 0x00, 0x0E, 0xFA, 0xD1, 0xFE,
+	 0x25, 0x60, 0xF2, 0x64, 0x40, 0x47, 0x58, 0x4F, 0x94, 0x00, 0x46, 0x42, 0x19, 0x02, 0x22, 0x47,
+	 0x40, 0xBF, 0x3B, 0x42, 0x04, 0xA2, 0xA2, 0xDB, 0x23, 0xF2, 0x66, 0x43, 0x00, 0xA8, 0x0E, 0xF2,
+	 0x08, 0x02, 0x60, 0x40, 0x02, 0x2A, 0xE4, 0x01, 0x12, 0xFD, 0x10, 0x64, 0x0E, 0xFA, 0x02, 0x75,
+	 0x07, 0x00, 0x60, 0x40, 0x04, 0x2A, 0xDC, 0x01, 0x12, 0xFD, 0x10, 0x64, 0x0E, 0xFA, 0x04, 0x75,
+	 0x2A, 0x44, 0x80, 0x2A, 0x19, 0x00, 0x21, 0x44, 0xAC, 0x86, 0x0E, 0xF2, 0x15, 0x03, 0x01, 0xBC,
+	 0x0E, 0xFA, 0xD1, 0xFE, 0x26, 0x60, 0x0A, 0x64, 0x40, 0x47, 0x58, 0x4F, 0x6A, 0x00, 0x46, 0x41,
+	 0x0B, 0x02, 0x21, 0x47, 0x10, 0xBF, 0x3B, 0x42, 0x04, 0xA2, 0xA2, 0xDB, 0x0E, 0xF2, 0x66, 0x43,
+	 0x08, 0xFD, 0x10, 0xBC, 0x0E, 0xFA, 0x80, 0x75, 0x2A, 0x44, 0x10, 0xB0, 0x20, 0x44, 0x18, 0x03,
+	 0x7F, 0xB4, 0x40, 0x40, 0x1D, 0x60, 0xBA, 0x63, 0xA3, 0xD3, 0xFF, 0xFF, 0x20, 0xB0, 0x80, 0xB0,
+	 0x09, 0x03, 0x08, 0x03, 0x40, 0xBC, 0x7F, 0xB4, 0x04, 0xB0, 0xA3, 0xDB, 0x03, 0x03, 0x20, 0x44,
+	 0x80, 0xBC, 0x40, 0x40, 0x2A, 0x40, 0x08, 0x27, 0x03, 0x00, 0xB3, 0x60, 0xC9, 0x78, 0xFF, 0xFF,
+	 0x2A, 0x40, 0x08, 0x2B, 0x0F, 0x00, 0x32, 0x40, 0x80, 0x26, 0x05, 0x00, 0x19, 0x60, 0xF7, 0xF3,
+	 0xFF, 0xFF, 0x01, 0x1B, 0x07, 0x00, 0x19, 0x60, 0xF6, 0xF3, 0xFF, 0xFF, 0x01, 0xBC, 0xA2, 0xDB,
+	 0xFF, 0xFF, 0x10, 0xFF, 0xB3, 0x60, 0xFC, 0x78, 0xFF, 0xFF, 0xE8, 0xFE, 0x14, 0x05, 0xEA, 0xFE,
+	 0x23, 0x05, 0xE9, 0xFE, 0x1C, 0x05, 0xE7, 0xFE, 0x09, 0x05, 0x47, 0xFF, 0x20, 0x44, 0x0F, 0x22,
+	 0x03, 0x00, 0xCC, 0x84, 0x40, 0x40, 0x0F, 0x22, 0xB8, 0xFE, 0xEC, 0x01, 0x23, 0x41, 0x00, 0xB9,
+	 0x5C, 0x4A, 0xE8, 0x02, 0x5A, 0x01, 0x24, 0x41, 0x00, 0xB9, 0x25, 0x60, 0xFE, 0x65, 0x45, 0x47,
+	 0xE1, 0x02, 0x58, 0x4F, 0x0E, 0x00, 0xDE, 0x02, 0x5C, 0x4A, 0x46, 0x44, 0x38, 0x01, 0x22, 0x41,
+	 0x00, 0xB9, 0x5C, 0x4A, 0xD7, 0x02, 0x6C, 0x01, 0x21, 0x41, 0x00, 0xB9, 0x5C, 0x4A, 0x92, 0x03,
+	 0xD1, 0x01, 0x27, 0xD3, 0x03, 0x00, 0x10, 0xB0, 0x09, 0xF2, 0x04, 0x03, 0xAC, 0x86, 0x0E, 0xF2,
+	 0xFA, 0x02, 0x08, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x0E, 0xF3, 0x0F, 0x60, 0xFE, 0x65, 0x0C, 0xF3,
+	 0x24, 0x86, 0x24, 0x46, 0x60, 0x40, 0xFB, 0x3B, 0x07, 0x00, 0x80, 0x26, 0x02, 0x00, 0x23, 0x46,
+	 0x03, 0x4C, 0x46, 0x61, 0x3A, 0x65, 0x0C, 0x00, 0x2E, 0xF3, 0x40, 0x45, 0xF8, 0x2B, 0x02, 0x00,
+	 0x40, 0x45, 0x03, 0x00, 0x58, 0x4F, 0x5A, 0x00, 0x07, 0x02, 0x58, 0x4F, 0x66, 0x00, 0x04, 0x05,
+	 0x66, 0x50, 0x65, 0x52, 0x61, 0x51, 0x09, 0x00, 0x26, 0x47, 0x00, 0xBF, 0x0E, 0xFB, 0x2E, 0xF5,
+	 0x05, 0xF0, 0x80, 0x60, 0x64, 0x50, 0x00, 0x72, 0x7E, 0x71, 0xAC, 0xFF, 0x31, 0x40, 0x01, 0x2A,
+	 0x08, 0x00, 0x19, 0x60, 0xF2, 0xF3, 0xFF, 0xFF, 0x04, 0x18, 0x0C, 0x64, 0x13, 0x60, 0x13, 0xFB,
+	 0x2D, 0xFF, 0xB3, 0x60, 0xFC, 0x78, 0xFF, 0xFF, 0x8E, 0xFF, 0x0F, 0xF3, 0x0F, 0x60, 0xFE, 0x65,
+	 0x24, 0x86, 0x0D, 0xF3, 0x24, 0x46, 0x60, 0x40, 0xFB, 0x3B, 0x07, 0x00, 0x80, 0x26, 0x02, 0x00,
+	 0x23, 0x46, 0x03, 0x4C, 0x46, 0x61, 0x3A, 0x65, 0x0C, 0x00, 0x2E, 0xF3, 0x40, 0x45, 0xF8, 0x2B,
+	 0x02, 0x00, 0x40, 0x45, 0x03, 0x00, 0x58, 0x4F, 0x21, 0x00, 0x07, 0x02, 0x58, 0x4F, 0x2D, 0x00,
+	 0x04, 0x05, 0x66, 0x50, 0x65, 0x52, 0x61, 0x51, 0x09, 0x00, 0x26, 0x47, 0x00, 0xBF, 0x0F, 0xFB,
+	 0x2E, 0xF5, 0x05, 0xF0, 0x80, 0x60, 0x64, 0x50, 0x00, 0x72, 0x7E, 0x71, 0x8D, 0xFF, 0xAD, 0xFF,
+	 0x31, 0x40, 0x01, 0x2A, 0xCE, 0x01, 0x19, 0x60, 0xF2, 0xF3, 0xFF, 0xFF, 0x04, 0x18, 0x0C, 0x64,
+	 0x13, 0x60, 0x13, 0xFB, 0x2D, 0xFF, 0xB3, 0x60, 0xFC, 0x78, 0xFF, 0xFF, 0x25, 0x44, 0xA7, 0xF1,
+	 0xA8, 0xF1, 0xD0, 0x80, 0xD0, 0x80, 0x07, 0x04, 0x01, 0x06, 0x05, 0x00, 0x25, 0x46, 0x01, 0xF0,
+	 0x03, 0x67, 0xA0, 0x85, 0x94, 0x80, 0x2F, 0x58, 0xFF, 0xFF, 0x25, 0x46, 0x26, 0x41, 0x46, 0x63,
+	 0x01, 0xF2, 0xFF, 0xFF, 0xFF, 0xB5, 0xD5, 0x81, 0x00, 0xF2, 0x05, 0x04, 0x04, 0x63, 0x60, 0x46,
+	 0xF7, 0x1B, 0x42, 0xFE, 0x0D, 0x00, 0x61, 0x44, 0xC5, 0x81, 0x63, 0x45, 0xC5, 0x81, 0x9C, 0x84,
+	 0xDC, 0x84, 0x01, 0xF2, 0xF0, 0x85, 0xF0, 0x80, 0x65, 0x44, 0xF8, 0x85, 0xFF, 0xFF, 0x02, 0xFE,
+	 0x2F, 0x58, 0xFF, 0xFF, 0xA2, 0xFF, 0x13, 0x60, 0x08, 0xF3, 0xFF, 0xFF, 0xAC, 0x86, 0x0E, 0xF2,
+	 0x07, 0x03, 0x00, 0xA8, 0x09, 0xF2, 0xFA, 0x02, 0x01, 0x67, 0x0E, 0xFA, 0x08, 0xFE, 0x17, 0x00,
+	 0xA9, 0xF3, 0xFF, 0xFF, 0xD8, 0xA0, 0x00, 0xB4, 0x12, 0x06, 0x09, 0x60, 0x08, 0x61, 0x41, 0x4A,
+	 0x7C, 0xA1, 0x0E, 0xA1, 0xA2, 0xFF, 0xB6, 0x60, 0x58, 0x4E, 0x44, 0x78, 0xFF, 0xFF, 0xA3, 0xFF,
+	 0x06, 0x03, 0x2A, 0x43, 0xB6, 0x60, 0x58, 0x4E, 0x65, 0x78, 0xFF, 0xFF, 0x08, 0xFE, 0xA3, 0xFF,
+	 0x2D, 0x58, 0xFF, 0xFF, 0x41, 0x4A, 0x42, 0xA1, 0x03, 0x00, 0x41, 0x4A, 0x7C, 0xA1, 0x0E, 0xA1,
+	 0xA2, 0xFF, 0xB6, 0x60, 0x58, 0x4E, 0x44, 0x78, 0xFF, 0xFF, 0x07, 0x03, 0x2A, 0x43, 0xB6, 0x60,
+	 0x58, 0x4E, 0x65, 0x78, 0xFF, 0xFF, 0x08, 0xFE, 0x0C, 0x00, 0x13, 0x60, 0x08, 0xF3, 0xFF, 0xFF,
+	 0xAC, 0x86, 0x0E, 0xF2, 0x06, 0x03, 0x00, 0xA8, 0x09, 0xF2, 0xFA, 0x02, 0x01, 0x67, 0x0E, 0xFA,
+	 0x08, 0xFE, 0xA3, 0xFF, 0x2D, 0x58, 0xFF, 0xFF, 0xAA, 0xF3, 0x7C, 0x63, 0x00, 0xBE, 0x40, 0x45,
+	 0x1A, 0x03, 0x00, 0x65, 0x65, 0x44, 0xDC, 0x85, 0x84, 0xA1, 0x00, 0xF2, 0x06, 0x06, 0x01, 0xFC,
+	 0x00, 0xA8, 0x60, 0x46, 0xF7, 0x02, 0x40, 0x45, 0x0E, 0x00, 0xA9, 0xF3, 0x00, 0x63, 0xD4, 0x84,
+	 0xA9, 0xFB, 0x80, 0x60, 0x7C, 0x64, 0x01, 0xFA, 0x00, 0xF0, 0x00, 0xFC, 0xD3, 0x80, 0xAA, 0xF9,
+	 0x02, 0x02, 0xAB, 0xF9, 0x08, 0xFE, 0x2E, 0x58, 0xFF, 0xFF, 0x66, 0x44, 0x25, 0x46, 0x05, 0xFA,
+	 0x06, 0xFA, 0x01, 0xF0, 0x03, 0x67, 0x02, 0xFC, 0xB0, 0x84, 0x3A, 0x7E, 0x01, 0xFA, 0x12, 0x64,
+	 0x03, 0xFA, 0x00, 0xF0, 0x04, 0xF8, 0x00, 0x64, 0x0C, 0x61, 0x10, 0x63, 0x59, 0xDA, 0xFE, 0x1F,
+	 0x2E, 0x58, 0xFF, 0xFF, 0x27, 0x43, 0xE3, 0x81, 0xE9, 0x81, 0x03, 0x05, 0x16, 0x03, 0x00, 0x61,
+	 0x01, 0x00, 0xEC, 0x63, 0x61, 0x46, 0xBF, 0xD2, 0x27, 0x45, 0xDC, 0x84, 0xA2, 0xDA, 0xBE, 0xD2,
+	 0x25, 0x46, 0x88, 0xF8, 0x04, 0x1B, 0x25, 0x44, 0x61, 0x46, 0xA3, 0xDA, 0x04, 0x00, 0x0A, 0xFA,
+	 0x60, 0x46, 0x25, 0x44, 0x09, 0xFA, 0x61, 0x46, 0xBE, 0xDA, 0x2F, 0x58, 0xFF, 0xFF, 0x25, 0x44,
+	 0x00, 0xA8, 0x07, 0x4B, 0x0C, 0x03, 0x58, 0x4F, 0x33, 0x00, 0x0B, 0x47, 0x26, 0x60, 0x04, 0x65,
+	 0x27, 0x44, 0xD4, 0x80, 0x00, 0x64, 0x01, 0x02, 0x0F, 0xFA, 0x58, 0x4F, 0xD3, 0x01, 0x70, 0x00,
+	 0x25, 0x43, 0xE3, 0x84, 0x7C, 0x41, 0x02, 0x04, 0xE8, 0x81, 0xEC, 0x63, 0x61, 0x46, 0xA3, 0xD2,
+	 0x00, 0x7C, 0x40, 0x45, 0xBF, 0xD8, 0xA3, 0xD8, 0xBE, 0xD8, 0x27, 0x42, 0x5A, 0xD3, 0x25, 0x5C,
+	 0x60, 0x41, 0x02, 0x1B, 0x27, 0xD9, 0x05, 0x00, 0x25, 0x46, 0x0A, 0xFA, 0x61, 0x46, 0x25, 0x44,
+	 0x09, 0xFA, 0x25, 0x44, 0x27, 0x43, 0x00, 0x61, 0x60, 0x46, 0x09, 0xF2, 0x08, 0xFC, 0x00, 0xA8,
+	 0xDD, 0x81, 0xFA, 0x02, 0xBF, 0xD1, 0x66, 0x44, 0xBE, 0xDB, 0xC1, 0x84, 0xBF, 0xDB, 0x48, 0x00,
+	 0x25, 0x46, 0xEC, 0x63, 0x08, 0xF2, 0x89, 0xF2, 0x1E, 0x18, 0x40, 0x47, 0xE0, 0x84, 0xE8, 0x85,
+	 0x02, 0x05, 0xE8, 0x83, 0x00, 0x65, 0x65, 0x46, 0xBF, 0xD2, 0x61, 0x5C, 0xCC, 0x84, 0xA2, 0xDA,
+	 0x25, 0x46, 0x0A, 0xF2, 0x00, 0xB9, 0x65, 0x46, 0x08, 0x24, 0xBE, 0xDA, 0x02, 0x1B, 0xA3, 0xD8,
+	 0x02, 0x00, 0x60, 0x46, 0x89, 0xFA, 0x00, 0xB9, 0x61, 0x46, 0x08, 0x28, 0x0A, 0xFA, 0x25, 0x46,
+	 0x89, 0xFC, 0x8A, 0xFC, 0x88, 0xFC, 0x2F, 0x58, 0xFF, 0xFF, 0x00, 0x61, 0x28, 0x65, 0x25, 0x43,
+	 0xAB, 0xF3, 0xAF, 0x83, 0x00, 0xBE, 0x18, 0x03, 0x02, 0x03, 0x00, 0xFC, 0x01, 0x00, 0xAA, 0xFD,
+	 0x63, 0x46, 0x65, 0x44, 0xCC, 0x85, 0x00, 0xF2, 0x07, 0x02, 0xAB, 0xF5, 0x00, 0x64, 0x00, 0xFA,
+	 0xDE, 0x60, 0xAF, 0x64, 0x09, 0xFB, 0x08, 0x00, 0x66, 0x43, 0x00, 0xBE, 0xDD, 0x81, 0xF1, 0x02,
+	 0xA9, 0xF1, 0xAB, 0xFD, 0xC1, 0x84, 0xA9, 0xFB, 0x2E, 0x58, 0xFF, 0xFF, 0x00, 0x66, 0x46, 0x45,
+	 0x29, 0x43, 0xFC, 0xA3, 0x66, 0x44, 0xBD, 0xDB, 0x25, 0x44, 0xBD, 0xDB, 0x00, 0x64, 0xBD, 0xDB,
+	 0x03, 0x61, 0x0E, 0x65, 0x26, 0x60, 0x18, 0x63, 0x43, 0x49, 0xA3, 0xD3, 0x06, 0xA3, 0x00, 0xA8,
+	 0xCD, 0x81, 0x04, 0x02, 0xF9, 0x02, 0xB3, 0x60, 0xFC, 0x78, 0xFF, 0xFF, 0x01, 0x26, 0xE6, 0x01,
+	 0xD4, 0x80, 0x60, 0x45, 0xE3, 0x05, 0xF6, 0xA3, 0xBD, 0xD1, 0xBD, 0xD1, 0x44, 0x47, 0x44, 0x48,
+	 0x44, 0x45, 0x26, 0x60, 0x5A, 0x64, 0x44, 0xD7, 0xFF, 0xFF, 0xFF, 0xFF, 0x25, 0x60, 0xC8, 0x63,
+	 0x0D, 0x65, 0x00, 0x61, 0x41, 0x48, 0xA3, 0xD3, 0x06, 0xA3, 0xAC, 0x86, 0x00, 0x61, 0x09, 0x03,
+	 0x00, 0xF2, 0x09, 0xF0, 0xAC, 0x86, 0x00, 0xF2, 0xDD, 0x81, 0xFC, 0x02, 0x64, 0x44, 0xAC, 0x86,
+	 0xF6, 0x01, 0x61, 0x44, 0x25, 0x46, 0x27, 0xDA, 0x65, 0x44, 0x28, 0x45, 0x45, 0x88, 0xCC, 0x85,
+	 0x5A, 0x87, 0xE9, 0x02, 0x00, 0x64, 0x27, 0xDA, 0x5A, 0xDA, 0x5A, 0x87, 0xA6, 0xF3, 0xA5, 0xF1,
+	 0x02, 0xA4, 0x60, 0x46, 0x60, 0x45, 0x00, 0x61, 0x22, 0xF2, 0xFF, 0xFF, 0xAC, 0x86, 0x00, 0xF2,
+	 0x04, 0x03, 0xAC, 0x86, 0x00, 0xF2, 0xDD, 0x81, 0xFC, 0x02, 0x65, 0x44, 0x02, 0xA5, 0x65, 0x46,
+	 0x64, 0x44, 0xCC, 0x9C, 0xFF, 0xFF, 0xF0, 0x02, 0x61, 0x44, 0x25, 0x46, 0x27, 0xDA, 0x5A, 0x87,
+	 0x28, 0x45, 0x45, 0x88, 0x00, 0x64, 0x27, 0xDA, 0x5A, 0x87, 0x06, 0x60, 0x40, 0x65, 0xAA, 0xF3,
+	 0x01, 0x61, 0xAC, 0x86, 0x00, 0xF2, 0x03, 0x03, 0xD5, 0x80, 0xDD, 0x81, 0xFA, 0x04, 0xCD, 0x84,
+	 0x25, 0x46, 0x27, 0xDA, 0x28, 0x45, 0xC4, 0x84, 0x5A, 0xDA, 0xDA, 0x81, 0xA9, 0xF1, 0x59, 0xD8,
+	 0x25, 0x60, 0xC6, 0x64, 0x18, 0x63, 0xA0, 0xD1, 0x06, 0xA4, 0x59, 0xD8, 0xFC, 0x1F, 0x00, 0x64,
+	 0x59, 0xDA, 0x59, 0xDA, 0x01, 0x60, 0x56, 0x64, 0x0A, 0x63, 0x58, 0xD1, 0x59, 0xD8, 0xFD, 0x1F,
+	 0xDB, 0xF1, 0x59, 0xD8, 0x75, 0x01, 0x07, 0x4B, 0xB6, 0x60, 0x58, 0x4F, 0xD0, 0x78, 0xFF, 0xFF,
+	 0x0B, 0x47, 0x58, 0x4F, 0x21, 0x00, 0x6C, 0x01, 0x07, 0x4B, 0xB6, 0x60, 0x58, 0x4F, 0xD0, 0x78,
+	 0xFF, 0xFF, 0x0B, 0x47, 0x27, 0x44, 0x00, 0xBE, 0x08, 0xF0, 0x15, 0x03, 0x64, 0x42, 0x4A, 0xD3,
+	 0x09, 0xF2, 0xDC, 0x83, 0xA2, 0xDD, 0x25, 0x43, 0x09, 0xFC, 0x63, 0x46, 0x27, 0x43, 0x0A, 0xFC,
+	 0x09, 0xFA, 0x08, 0xF8, 0x00, 0xA8, 0x66, 0x43, 0x03, 0x02, 0x64, 0x44, 0x58, 0xDD, 0x03, 0x00,
+	 0x60, 0x46, 0x25, 0x44, 0x0A, 0xFA, 0x4C, 0x01, 0x27, 0x43, 0xE3, 0x81, 0xE9, 0x81, 0x03, 0x05,
+	 0x16, 0x03, 0x00, 0x61, 0x01, 0x00, 0xEC, 0x63, 0x61, 0x46, 0xBF, 0xD2, 0x27, 0x45, 0xDC, 0x84,
+	 0xA2, 0xDA, 0xA3, 0xD2, 0x25, 0x46, 0x88, 0xF8, 0x04, 0x1B, 0x25, 0x44, 0x61, 0x46, 0xBE, 0xDA,
+	 0x04, 0x00, 0x09, 0xFA, 0x60, 0x46, 0x25, 0x44, 0x0A, 0xFA, 0x61, 0x46, 0xA3, 0xDA, 0x2F, 0x58,
+	 0xFF, 0xFF, 0xA0, 0xFE, 0x07, 0x05, 0xA3, 0xFE, 0x07, 0x05, 0xA1, 0xFE, 0x48, 0x05, 0x60, 0x64,
+	 0x3B, 0xDB, 0x11, 0x00, 0x20, 0x58, 0xFF, 0xFF, 0x4F, 0xF7, 0xFF, 0xFF, 0xFF, 0xFF, 0x0E, 0x60,
+	 0xDF, 0xF3, 0xFF, 0xFF, 0xFB, 0xB4, 0xA2, 0xDB, 0xA0, 0x4C, 0x59, 0xBC, 0xFF, 0xB4, 0xA0, 0x51,
+	 0xA0, 0x4C, 0x7D, 0xB4, 0xA0, 0x51, 0xA1, 0xFF, 0xFF, 0xFF, 0x83, 0x3E, 0x40, 0x60, 0x0B, 0x65,
+	 0x2B, 0x44, 0x00, 0x63, 0xE8, 0x80, 0xF8, 0x84, 0x02, 0x24, 0x94, 0x84, 0xF3, 0x83, 0xCD, 0x81,
+	 0xFF, 0xFF, 0xF8, 0x02, 0xDF, 0x83, 0x2F, 0x58, 0x40, 0x4B, 0x00, 0x62, 0x01, 0x64, 0xD4, 0x80,
+	 0xE0, 0x84, 0x1A, 0x03, 0xD4, 0x80, 0xE0, 0x84, 0x15, 0x03, 0x61, 0x44, 0x11, 0x61, 0xE0, 0x84,
+	 0xCD, 0x81, 0xFD, 0x04, 0x01, 0x00, 0xE0, 0x84, 0xF2, 0x82, 0xFF, 0xFF, 0x02, 0x24, 0xC6, 0x82,
+	 0x02, 0x28, 0xD6, 0x82, 0xE2, 0x80, 0xCD, 0x81, 0x02, 0x28, 0x01, 0xBC, 0xF4, 0x02, 0x01, 0x2A,
+	 0xC6, 0x82, 0x03, 0x00, 0xE9, 0x81, 0xF2, 0x82, 0x61, 0x44, 0x2D, 0x58, 0xFF, 0xFF, 0x00, 0x64,
+	 0x3B, 0xDB, 0x3C, 0x44, 0xAC, 0x80, 0xFF, 0xFF, 0xC6, 0x02, 0x89, 0xF3, 0x8A, 0xF3, 0x02, 0xA8,
+	 0x02, 0xA8, 0x08, 0x02, 0x00, 0x64, 0x8B, 0xFB, 0x89, 0xFB, 0x8A, 0xFB, 0x00, 0x64, 0x8C, 0xFB,
+	 0xCA, 0xFE, 0x2A, 0x00, 0x03, 0x02, 0x00, 0x64, 0x8A, 0xFB, 0xCA, 0xFE, 0x01, 0x64, 0x3B, 0xDB,
+	 0x12, 0x60, 0xE7, 0xF3, 0xFF, 0xFF, 0x00, 0xA8, 0x60, 0x46, 0x13, 0x03, 0xDB, 0xF3, 0x2A, 0xF2,
+	 0xFD, 0xA0, 0x60, 0x40, 0x80, 0x3A, 0x33, 0x00, 0x32, 0x02, 0x9B, 0xFE, 0x30, 0x05, 0x00, 0x64,
+	 0x13, 0x60, 0x0A, 0xFB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF,
+	 0xE7, 0x01, 0x8A, 0xF3, 0xFF, 0xFF, 0x01, 0xA8, 0xFF, 0xFF, 0x06, 0x02, 0x12, 0x60, 0xE4, 0xF3,
+	 0xFF, 0xFF, 0x00, 0xA8, 0x60, 0x46, 0x1B, 0x02, 0x86, 0xFF, 0x20, 0x40, 0x12, 0x27, 0x13, 0x00,
+	 0x9A, 0xFE, 0x11, 0x04, 0x9D, 0xFE, 0x0F, 0x04, 0x95, 0xF3, 0xFF, 0xFF, 0x80, 0xBC, 0x95, 0xFB,
+	 0x84, 0xFF, 0xC2, 0x60, 0x45, 0x64, 0x40, 0x42, 0x06, 0x64, 0x13, 0x60, 0x16, 0xFB, 0xFF, 0xFF,
+	 0x2D, 0xFF, 0x12, 0x64, 0x3B, 0xDB, 0x84, 0xFF, 0xB7, 0x60, 0xF7, 0x78, 0xFF, 0xFF, 0x66, 0x44,
+	 0xFC, 0xFB, 0x46, 0x5C, 0x19, 0x60, 0xCF, 0xF3, 0x0D, 0xF2, 0x60, 0x5C, 0x64, 0x5F, 0x0D, 0xFA,
+	 0x11, 0x64, 0x3B, 0xDB, 0x9D, 0xFE, 0x06, 0x05, 0x08, 0x64, 0x13, 0x60, 0x16, 0xFB, 0x2D, 0xFF,
+	 0xFF, 0xFF, 0xA3, 0xFE, 0x07, 0xF0, 0x00, 0x64, 0xD0, 0x80, 0xFF, 0xFF, 0x07, 0x02, 0x23, 0xF0,
+	 0x04, 0x64, 0xB0, 0x84, 0xA2, 0xDA, 0xBF, 0x60, 0x79, 0x78, 0xFF, 0xFF, 0x2A, 0xF2, 0x00, 0x63,
+	 0x40, 0x47, 0x50, 0x36, 0x05, 0x00, 0xA4, 0x36, 0x03, 0x00, 0x80, 0x36, 0x01, 0x00, 0x01, 0x63,
+	 0x48, 0xFD, 0x40, 0x47, 0x08, 0x2A, 0x08, 0x00, 0x03, 0x2F, 0x06, 0x00, 0x7F, 0xF1, 0x2C, 0xF8,
+	 0x80, 0xF1, 0x2D, 0xF8, 0x81, 0xF1, 0x2E, 0xF8, 0x4A, 0xF3, 0x35, 0xFA, 0x10, 0xA4, 0x4A, 0xFB,
+	 0x00, 0x64, 0x15, 0xFA, 0x16, 0xFA, 0x0F, 0xFA, 0x07, 0xF0, 0xA6, 0xF3, 0xFF, 0xFF, 0xD0, 0x80,
+	 0xFF, 0xFF, 0x05, 0x03, 0x66, 0x43, 0x64, 0x46, 0x11, 0xF2, 0xD9, 0xFB, 0x63, 0x46, 0x03, 0xF2,
+	 0x00, 0xF4, 0x01, 0xF2, 0xFC, 0xA5, 0x00, 0x7F, 0xD4, 0x84, 0x27, 0x45, 0x3C, 0x46, 0x1A, 0xFA,
+	 0x22, 0x63, 0x7B, 0x60, 0xFF, 0x64, 0xA4, 0x84, 0x03, 0x2B, 0x1C, 0x63, 0x2A, 0xFA, 0x8F, 0xB0,
+	 0x88, 0x36, 0x02, 0xA3, 0x60, 0x40, 0xA4, 0x36, 0x14, 0x63, 0x43, 0x4C, 0x18, 0xFC, 0x00, 0x7C,
+	 0x22, 0xF8, 0x64, 0x41, 0x07, 0xF0, 0x66, 0x43, 0x64, 0x46, 0x3A, 0xF2, 0x63, 0x46, 0xFF, 0xB4,
+	 0x22, 0xFA, 0x60, 0x40, 0x00, 0x36, 0x82, 0x00, 0x2A, 0xF2, 0xFF, 0xFF, 0x0C, 0xB0, 0x08, 0x3A,
+	 0xAD, 0x00, 0x60, 0x40, 0x40, 0x26, 0xAA, 0x00, 0x03, 0xF2, 0x00, 0xF4, 0xA0, 0xD2, 0xAA, 0x60,
+	 0xAA, 0x65, 0x5A, 0xD0, 0xD4, 0x80, 0x03, 0x64, 0x0A, 0x02, 0xD0, 0x80, 0x00, 0x64, 0x5A, 0xD0,
+	 0x06, 0x02, 0xD0, 0x80, 0xF8, 0x7F, 0xD0, 0x80, 0x01, 0x03, 0x01, 0x02, 0x01, 0x61, 0x62, 0x43,
+	 0x46, 0x43, 0x3C, 0x46, 0x07, 0xF4, 0x3A, 0xF2, 0xFF, 0xFF, 0xA3, 0x46, 0x60, 0x40, 0x22, 0x26,
+	 0x64, 0x00, 0x60, 0x45, 0x63, 0x42, 0x5A, 0xD0, 0xCD, 0x81, 0x3C, 0x46, 0x1B, 0x02, 0x64, 0x44,
+	 0x88, 0x3A, 0x18, 0x00, 0x8E, 0x37, 0x03, 0x00, 0xC7, 0x37, 0x01, 0x00, 0x13, 0x00, 0x65, 0x44,
+	 0x01, 0x26, 0x7C, 0x00, 0x04, 0x26, 0x03, 0x00, 0x10, 0x26, 0x01, 0x00, 0x31, 0x00, 0xA3, 0x46,
+	 0x3B, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x80, 0x27, 0x5B, 0x00, 0xA3, 0x46, 0x00, 0x7C, 0x22, 0xF8,
+	 0xA3, 0x46, 0x6C, 0x00, 0xA3, 0x46, 0x65, 0x44, 0x01, 0x26, 0x0B, 0x00, 0x04, 0x26, 0x03, 0x00,
+	 0x10, 0x26, 0x01, 0x00, 0x1D, 0x00, 0x3B, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x80, 0x27, 0x48, 0x00,
+	 0x17, 0x00, 0xA6, 0xF3, 0xFF, 0xFF, 0x60, 0x46, 0x3A, 0xF2, 0x66, 0x43, 0xFF, 0xB4, 0x3C, 0x46,
+	 0x22, 0xF0, 0x60, 0x47, 0xB0, 0x84, 0x22, 0xFA, 0x63, 0x46, 0x3B, 0xF0, 0x60, 0x40, 0x04, 0x27,
+	 0x03, 0x00, 0x10, 0x27, 0x01, 0x00, 0x04, 0x00, 0x64, 0x40, 0x80, 0x27, 0x31, 0x00, 0x00, 0x00,
+	 0x3C, 0x46, 0x02, 0x65, 0xBF, 0x60, 0x19, 0x78, 0xFF, 0xFF, 0xCD, 0x81, 0x63, 0x42, 0x5A, 0xD0,
+	 0x3C, 0x46, 0x26, 0x02, 0x64, 0x44, 0x88, 0x3A, 0x23, 0x00, 0x77, 0x37, 0x37, 0x00, 0x78, 0x37,
+	 0x35, 0x00, 0x8E, 0x37, 0x33, 0x00, 0xC7, 0x37, 0x31, 0x00, 0x1A, 0x00, 0x19, 0x60, 0xA3, 0xF3,
+	 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x2A, 0x2A, 0x00, 0x06, 0x00, 0x19, 0x60, 0xA3, 0xF3, 0xFF, 0xFF,
+	 0x60, 0x40, 0x01, 0x2A, 0xE2, 0x01, 0x3C, 0x46, 0x3E, 0xF2, 0x40, 0x60, 0x00, 0x65, 0xF0, 0x84,
+	 0xA4, 0x84, 0x3D, 0xFA, 0x2A, 0xF2, 0xBF, 0x60, 0xFF, 0x65, 0xA4, 0x84, 0x2A, 0xFA, 0x16, 0x00,
+	 0x3C, 0x46, 0x22, 0xF0, 0x80, 0x67, 0xB0, 0x84, 0xA2, 0xDA, 0xFF, 0xFF, 0x3F, 0xF2, 0x3E, 0xF0,
+	 0x08, 0xA4, 0x60, 0x41, 0x22, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x26, 0x03, 0x00, 0x04, 0x26,
+	 0x03, 0x00, 0x04, 0x00, 0x04, 0x2B, 0x02, 0x00, 0x61, 0x44, 0x3F, 0xFA, 0x3C, 0x46, 0x2C, 0xF2,
+	 0x27, 0x40, 0x01, 0x27, 0x32, 0xF2, 0xD3, 0xF1, 0x60, 0x40, 0x01, 0x26, 0x47, 0x00, 0x09, 0x60,
+	 0x00, 0x64, 0xD0, 0x80, 0x3F, 0xF2, 0x09, 0x06, 0x2C, 0x45, 0xC4, 0x84, 0xD0, 0x80, 0x40, 0x4A,
+	 0x34, 0x06, 0x60, 0x43, 0x64, 0x44, 0x54, 0x88, 0x17, 0x00, 0x60, 0x45, 0x16, 0x60, 0xC8, 0xF3,
+	 0xDA, 0xF3, 0x00, 0xBC, 0x60, 0x47, 0xEC, 0xA0, 0x28, 0x03, 0x27, 0x07, 0x2C, 0x44, 0xC4, 0x81,
+	 0x02, 0x60, 0x1C, 0x65, 0x45, 0x4A, 0xD5, 0x80, 0x2C, 0x45, 0x1F, 0x06, 0x27, 0x40, 0x04, 0x27,
+	 0x25, 0x00, 0x2A, 0x43, 0xD7, 0x85, 0x45, 0x48, 0xD4, 0xF1, 0x0F, 0xF2, 0xD3, 0x80, 0x01, 0x65,
+	 0x01, 0x07, 0x00, 0x65, 0xB4, 0x84, 0x0F, 0xFA, 0x00, 0x63, 0x3F, 0xF2, 0x28, 0x45, 0x60, 0x41,
+	 0xD4, 0x84, 0xDF, 0x83, 0xFC, 0x07, 0x14, 0xFC, 0x17, 0xFA, 0x04, 0x60, 0x00, 0x64, 0x27, 0x45,
+	 0xB4, 0x84, 0x2A, 0xFA, 0x28, 0x43, 0x16, 0xFC, 0x0D, 0x00, 0x3F, 0xF2, 0x2C, 0x45, 0xD4, 0xF1,
+	 0xC4, 0x81, 0xD1, 0x80, 0x0F, 0xF2, 0x01, 0x06, 0x01, 0xBC, 0x0F, 0xFA, 0x3F, 0xF2, 0x17, 0xFA,
+	 0x01, 0x64, 0x14, 0xFA, 0xAA, 0xF2, 0x19, 0x60, 0x3F, 0xF3, 0x07, 0xF0, 0x66, 0x43, 0x64, 0x46,
+	 0x44, 0x44, 0x61, 0x40, 0x08, 0x26, 0x02, 0x00, 0x61, 0x40, 0x80, 0x36, 0x12, 0xF2, 0x63, 0x46,
+	 0x33, 0x60, 0x86, 0x61, 0x00, 0x7F, 0x60, 0x45, 0x45, 0xD3, 0xFF, 0xFF, 0x60, 0x45, 0x00, 0x7F,
+	 0x4B, 0xFB, 0x65, 0x44, 0x00, 0x7E, 0xDA, 0xFB, 0x07, 0xF0, 0x66, 0x43, 0x64, 0x46, 0x12, 0xF0,
+	 0x60, 0x47, 0x63, 0x46, 0x64, 0x40, 0x10, 0x2A, 0x1E, 0x00, 0x33, 0x60, 0x0A, 0x63, 0x60, 0x40,
+	 0x0A, 0x36, 0x0C, 0x00, 0x14, 0x36, 0x07, 0x00, 0x37, 0x36, 0x02, 0x00, 0xA3, 0xD3, 0x09, 0x00,
+	 0x02, 0xA3, 0xA3, 0xD3, 0x06, 0x00, 0x04, 0xA3, 0xA3, 0xD3, 0x03, 0x00, 0x06, 0xA3, 0xA3, 0xD3,
+	 0xFF, 0xFF, 0x60, 0x40, 0x0A, 0x36, 0x70, 0x64, 0x14, 0x36, 0x38, 0x64, 0x37, 0x36, 0x15, 0x64,
+	 0x6E, 0x36, 0x0B, 0x64, 0x39, 0x00, 0x32, 0x60, 0xFA, 0x63, 0x60, 0x40, 0x0B, 0x36, 0x20, 0x00,
+	 0x0F, 0x36, 0x1B, 0x00, 0x0A, 0x36, 0x16, 0x00, 0x0E, 0x36, 0x11, 0x00, 0x09, 0x36, 0x0C, 0x00,
+	 0x0D, 0x36, 0x07, 0x00, 0x08, 0x36, 0x02, 0x00, 0xA3, 0xD3, 0x15, 0x00, 0x02, 0xA3, 0xA3, 0xD3,
+	 0x12, 0x00, 0x04, 0xA3, 0xA3, 0xD3, 0x0F, 0x00, 0x06, 0xA3, 0xA3, 0xD3, 0x0C, 0x00, 0x08, 0xA3,
+	 0xA3, 0xD3, 0x09, 0x00, 0x0A, 0xA3, 0xA3, 0xD3, 0x06, 0x00, 0x0C, 0xA3, 0xA3, 0xD3, 0x03, 0x00,
+	 0x0E, 0xA3, 0xA3, 0xD3, 0xFF, 0xFF, 0x60, 0x40, 0x0B, 0x36, 0x1E, 0x64, 0x0F, 0x36, 0x16, 0x64,
+	 0x0A, 0x36, 0x12, 0x64, 0x0E, 0x36, 0x0E, 0x64, 0x09, 0x36, 0x0E, 0x64, 0x0D, 0x36, 0x0A, 0x64,
+	 0x08, 0x36, 0x0A, 0x64, 0x0C, 0x36, 0x0A, 0x64, 0x40, 0x46, 0x2A, 0xF2, 0x07, 0xF0, 0x60, 0x40,
+	 0xB0, 0x3A, 0x03, 0x00, 0x40, 0x3B, 0x01, 0x00, 0x12, 0x00, 0x0C, 0xB4, 0x08, 0x3A, 0x44, 0x00,
+	 0x22, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x80, 0x2B, 0x3F, 0x00, 0x17, 0xF2, 0x22, 0xF0, 0xFF, 0xFF,
+	 0x64, 0x40, 0x22, 0x22, 0x04, 0x00, 0x00, 0xA8, 0x01, 0xA8, 0x36, 0x03, 0x35, 0x03, 0x3C, 0x46,
+	 0x2A, 0xF0, 0x40, 0x67, 0xB0, 0x84, 0xA2, 0xDA, 0x60, 0x45, 0x22, 0xF2, 0xFF, 0xFF, 0x60, 0x43,
+	 0x60, 0x40, 0x01, 0x26, 0x05, 0x00, 0x04, 0x26, 0x1D, 0x00, 0x10, 0x26, 0x10, 0x00, 0x04, 0x00,
+	 0x04, 0x27, 0x18, 0x00, 0x10, 0x27, 0x0B, 0x00, 0x65, 0x44, 0x2A, 0x61, 0x60, 0x40, 0x03, 0x2B,
+	 0x24, 0x61, 0x8F, 0xB0, 0x88, 0x36, 0x02, 0xA1, 0x41, 0x4C, 0x98, 0xFA, 0x15, 0x00, 0x65, 0x44,
+	 0x32, 0x61, 0x60, 0x40, 0x03, 0x2B, 0x2C, 0x61, 0x8F, 0xB0, 0x88, 0x36, 0x02, 0xA1, 0x41, 0x4C,
+	 0x98, 0xFA, 0x0A, 0x00, 0x65, 0x44, 0x2E, 0x61, 0x60, 0x40, 0x03, 0x2B, 0x28, 0x61, 0x8F, 0xB0,
+	 0x88, 0x36, 0x02, 0xA1, 0x41, 0x4C, 0x98, 0xFA, 0x2A, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x40, 0x27,
+	 0x03, 0x00, 0xBC, 0x60, 0x46, 0x78, 0xFF, 0xFF, 0x22, 0xF2, 0x46, 0x43, 0x60, 0x40, 0x22, 0x26,
+	 0x09, 0x00, 0x01, 0x26, 0x0A, 0x00, 0x04, 0x26, 0x4B, 0x00, 0x10, 0x26, 0x10, 0x00, 0xBC, 0x60,
+	 0x46, 0x78, 0xFF, 0xFF, 0xBB, 0x60, 0xC1, 0x78, 0xFF, 0xFF, 0x04, 0x27, 0x3D, 0x00, 0x10, 0x27,
+	 0x03, 0x00, 0xBC, 0x60, 0x46, 0x78, 0xFF, 0xFF, 0xA6, 0xF3, 0x3C, 0xF1, 0x02, 0x00, 0x07, 0xF2,
+	 0x00, 0x7C, 0x40, 0x43, 0x2A, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x08, 0x27, 0x21, 0x00, 0xA3, 0x46,
+	 0x4B, 0xF2, 0xFF, 0xFF, 0xDC, 0x84, 0x4B, 0xFA, 0x4A, 0xF2, 0x08, 0x04, 0xDC, 0x84, 0x4A, 0xFA,
+	 0x49, 0xF2, 0x04, 0x04, 0xDC, 0x84, 0x49, 0xFA, 0x01, 0x04, 0xFF, 0xFF, 0xA6, 0xF3, 0x66, 0x5C,
+	 0xD0, 0x80, 0x00, 0x7C, 0x01, 0x02, 0x3C, 0xF1, 0x4B, 0xF0, 0x64, 0x47, 0x20, 0xBF, 0xA3, 0x46,
+	 0x3A, 0xF8, 0x3B, 0xFA, 0xA3, 0x46, 0x4A, 0xF2, 0x49, 0xF0, 0xA3, 0x46, 0x3C, 0xFA, 0x3D, 0xF8,
+	 0x0F, 0x60, 0x9E, 0x64, 0xA3, 0x46, 0x76, 0x61, 0x0E, 0x63, 0x59, 0xD0, 0x58, 0xD9, 0xFD, 0x1F,
+	 0xA3, 0x46, 0xBC, 0x60, 0x46, 0x78, 0xFF, 0xFF, 0xA6, 0xF3, 0xFF, 0xFF, 0x60, 0x46, 0x02, 0x00,
+	 0x07, 0xF4, 0xFF, 0xFF, 0xA3, 0x46, 0x2A, 0xF2, 0xA3, 0x46, 0x60, 0x40, 0x08, 0x27, 0x48, 0x00,
+	 0xA6, 0xF3, 0x66, 0x5C, 0xD0, 0x80, 0x3B, 0xF0, 0x08, 0x03, 0x64, 0x40, 0x10, 0x2A, 0x12, 0x00,
+	 0xFF, 0x60, 0xEF, 0x64, 0xA0, 0x84, 0x3B, 0xFA, 0x24, 0x00, 0x3D, 0xF3, 0x01, 0x61, 0x60, 0x43,
+	 0xCF, 0x83, 0xE1, 0x81, 0xFD, 0x0D, 0xE9, 0x81, 0xA1, 0x80, 0xFF, 0xFF, 0x03, 0x03, 0x91, 0x84,
+	 0x3B, 0xFA, 0x17, 0x00, 0x4B, 0xF2, 0xFF, 0xFF, 0x10, 0xA0, 0xFF, 0xFF, 0x02, 0x04, 0xFF, 0x60,
+	 0xFF, 0x64, 0xDC, 0x84, 0x4B, 0xFA, 0x4A, 0xF2, 0x16, 0x04, 0xDC, 0x84, 0x4A, 0xFA, 0x49, 0xF2,
+	 0x08, 0x04, 0xDC, 0x84, 0x49, 0xFA, 0x05, 0x04, 0x3B, 0xF2, 0xFF, 0xFF, 0xE0, 0x84, 0xE8, 0x84,
+	 0x3B, 0xFA, 0x0C, 0x60, 0xFC, 0x62, 0x80, 0xFF, 0x78, 0x44, 0x03, 0xA4, 0xA2, 0xDB, 0xC8, 0x60,
+	 0x15, 0x78, 0xFF, 0xFF, 0x84, 0xFF, 0x06, 0x60, 0x17, 0xE1, 0x77, 0x40, 0x8B, 0xFF, 0x02, 0x60,
+	 0x00, 0x75, 0xC9, 0x60, 0x58, 0x4F, 0xAD, 0x78, 0xFF, 0xFF, 0x01, 0x64, 0x06, 0x60, 0x7F, 0xFB,
+	 0x0C, 0x60, 0xFC, 0x62, 0x80, 0xFF, 0x78, 0x44, 0x03, 0xA4, 0xA2, 0xDB, 0xC8, 0x60, 0x8C, 0x78,
+	 0xFF, 0xFF, 0x84, 0xFF, 0x00, 0x7C, 0x06, 0x60, 0x7F, 0xF3, 0xA2, 0xD9, 0x60, 0x40, 0x01, 0x2A,
+	 0x04, 0x00, 0xC9, 0x60, 0x58, 0x4F, 0xF6, 0x78, 0xFF, 0xFF, 0x3C, 0x46, 0x07, 0xF4, 0xA6, 0xF3,
+	 0x66, 0x5C, 0xD0, 0x80, 0x00, 0x7C, 0x07, 0x03, 0x66, 0x43, 0x3C, 0x46, 0x22, 0xF2, 0x63, 0x46,
+	 0x60, 0x40, 0x01, 0x2A, 0x01, 0x00, 0x3C, 0xF1, 0x4B, 0xF0, 0x64, 0x41, 0x64, 0x47, 0xFF, 0xB4,
+	 0x60, 0x5F, 0x20, 0xBC, 0x80, 0x26, 0x80, 0xAC, 0x60, 0x47, 0xA3, 0x46, 0x3A, 0xFA, 0x64, 0x44,
+	 0x20, 0x7F, 0x34, 0x94, 0x3B, 0xFA, 0xA3, 0x46, 0x4A, 0xF2, 0x49, 0xF0, 0xA3, 0x46, 0x3C, 0xFA,
+	 0x3D, 0xF8, 0x80, 0x60, 0x10, 0xE0, 0x08, 0x60, 0x00, 0xEA, 0x0F, 0x64, 0x60, 0x7F, 0xA0, 0x5A,
+	 0x80, 0x60, 0x00, 0xEA, 0xA0, 0x60, 0x00, 0xEA, 0xD1, 0x60, 0x00, 0xEA, 0xBC, 0x60, 0x46, 0x78,
+	 0xFF, 0xFF, 0x2A, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x08, 0x27, 0x31, 0x00, 0x2A, 0xF2, 0x00, 0x60,
+	 0x7C, 0x62, 0x60, 0x40, 0x40, 0x2B, 0x24, 0x00, 0xA2, 0xD3, 0x00, 0x61, 0x60, 0xFE, 0xA0, 0xD3,
+	 0x5E, 0xD1, 0xFF, 0xFF, 0x20, 0xFE, 0x64, 0x5F, 0xDC, 0x84, 0xF1, 0x81, 0xC0, 0x2B, 0x04, 0x00,
+	 0x80, 0x2A, 0x02, 0x00, 0x7F, 0xA4, 0xDC, 0x84, 0xFF, 0x3B, 0x03, 0x00, 0x60, 0x47, 0xDC, 0x87,
+	 0x01, 0x61, 0xC0, 0x80, 0x00, 0x36, 0xDC, 0x84, 0x4E, 0xDB, 0x60, 0xFE, 0x5A, 0xD1, 0xFF, 0xFF,
+	 0xC1, 0x84, 0xF0, 0x22, 0x10, 0xA4, 0xF0, 0x2A, 0x01, 0x00, 0x00, 0x64, 0xA2, 0xDB, 0x20, 0xFE,
+	 0x00, 0x60, 0x3E, 0xF3, 0xFF, 0xFF, 0xA0, 0xD3, 0x5A, 0xD1, 0x3A, 0xFA, 0x3B, 0xF8, 0x74, 0x62,
+	 0xA2, 0xD0, 0xFF, 0xFF, 0x64, 0x44, 0xE0, 0x7F, 0xA0, 0x5A, 0x64, 0x47, 0xE1, 0x7F, 0x5A, 0xD0,
+	 0xA0, 0x5A, 0x64, 0x44, 0xE2, 0x7F, 0xA0, 0x5A, 0x00, 0x60, 0x40, 0xF3, 0xFF, 0xFF, 0xA0, 0xD1,
+	 0x5A, 0xD1, 0x64, 0x45, 0x64, 0x44, 0xE3, 0x7F, 0xA0, 0x5A, 0x64, 0x47, 0xE4, 0x7F, 0x5A, 0xD1,
+	 0xA0, 0x5A, 0x64, 0x44, 0xE5, 0x7F, 0xA0, 0x5A, 0x64, 0x47, 0xE6, 0x7F, 0x5A, 0xD1, 0xA0, 0x5A,
+	 0x64, 0x44, 0xE7, 0x7F, 0xA0, 0x5A, 0x65, 0x40, 0x0D, 0x3A, 0x1C, 0x00, 0x64, 0x47, 0xE8, 0x7F,
+	 0x5A, 0xD1, 0xA0, 0x5A, 0x64, 0x44, 0xE9, 0x7F, 0xA0, 0x5A, 0x64, 0x47, 0xEA, 0x7F, 0x5A, 0xD1,
+	 0xA0, 0x5A, 0x64, 0x44, 0xEB, 0x7F, 0xA0, 0x5A, 0x64, 0x47, 0xEC, 0x7F, 0x5A, 0xD1, 0xA0, 0x5A,
+	 0x64, 0x44, 0xED, 0x7F, 0xA0, 0x5A, 0x64, 0x47, 0xEE, 0x7F, 0x5A, 0xD1, 0xA0, 0x5A, 0x64, 0x44,
+	 0xEF, 0x7F, 0xA0, 0x5A, 0x08, 0x60, 0x00, 0xEA, 0x65, 0x44, 0x02, 0xA4, 0x60, 0x7F, 0xA0, 0x5A,
+	 0x80, 0x60, 0x00, 0xEA, 0xA0, 0x60, 0x00, 0xEA, 0xD1, 0x60, 0x00, 0xEA, 0x66, 0x45, 0xAA, 0xF2,
+	 0x19, 0x60, 0x3F, 0xF3, 0x24, 0x46, 0x61, 0x40, 0x08, 0x26, 0x02, 0x00, 0x61, 0x40, 0x80, 0x36,
+	 0x12, 0xF2, 0x65, 0x46, 0x60, 0x40, 0x10, 0x26, 0x34, 0x00, 0x2C, 0x45, 0x17, 0xF2, 0x4B, 0xF1,
+	 0xC4, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x81, 0x64, 0x45, 0x16, 0xA1, 0xB8, 0x60, 0x58, 0x4D,
+	 0x15, 0x78, 0xFF, 0xFF, 0x7D, 0xF1, 0x01, 0xA4, 0xE0, 0x84, 0xE0, 0x84, 0x64, 0x40, 0x01, 0x2B,
+	 0x06, 0xA4, 0x1B, 0xFA, 0xDA, 0xF3, 0x2C, 0x60, 0x7C, 0x65, 0x60, 0x40, 0x0B, 0x37, 0x00, 0x63,
+	 0x0F, 0x37, 0x02, 0x63, 0x0A, 0x37, 0x04, 0x63, 0x0E, 0x37, 0x06, 0x63, 0x09, 0x37, 0x08, 0x63,
+	 0x0D, 0x37, 0x0A, 0x63, 0x08, 0x37, 0x0C, 0x63, 0x0C, 0x37, 0x0E, 0x63, 0x28, 0xA3, 0x47, 0xD1,
+	 0xD8, 0xA3, 0xD7, 0x83, 0x19, 0x60, 0x77, 0xF9, 0x47, 0xD1, 0x40, 0x67, 0xB0, 0x84, 0x1F, 0xFA,
+	 0x58, 0x00, 0x2A, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x80, 0x36, 0x19, 0x00, 0x50, 0x36, 0x17, 0x00,
+	 0x40, 0x36, 0x15, 0x00, 0x00, 0x36, 0x13, 0x00, 0x20, 0x36, 0x11, 0x00, 0xA0, 0x36, 0x0F, 0x00,
+	 0xB0, 0x36, 0x0D, 0x00, 0xC0, 0x36, 0x0B, 0x00, 0xDA, 0xF3, 0xFF, 0xFF, 0x60, 0x40, 0x0A, 0x37,
+	 0x06, 0x00, 0x19, 0x60, 0x7B, 0xF3, 0x80, 0x60, 0x00, 0x61, 0x60, 0x40, 0x04, 0x26, 0x00, 0x61,
+	 0xDA, 0xF3, 0x2C, 0x60, 0x74, 0x65, 0x60, 0x40, 0x0A, 0x37, 0x00, 0x63, 0x14, 0x37, 0x02, 0x63,
+	 0x37, 0x37, 0x04, 0x63, 0x6E, 0x37, 0x06, 0x63, 0x28, 0xA3, 0x47, 0xD1, 0xD8, 0xA3, 0xD7, 0x83,
+	 0x19, 0x60, 0x77, 0xF9, 0x47, 0xD1, 0xFF, 0xFF, 0xB1, 0x84, 0x1F, 0xFA, 0xDA, 0xF1, 0x2C, 0x45,
+	 0x64, 0x43, 0x17, 0xF2, 0x4B, 0xF1, 0xC4, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x81, 0x63, 0x40,
+	 0x37, 0x37, 0xE1, 0x81, 0x64, 0x45, 0xB8, 0x60, 0x58, 0x4D, 0x15, 0x78, 0xFF, 0xFF, 0xAE, 0x82,
+	 0xFC, 0xA2, 0x0A, 0x03, 0x63, 0x40, 0x6E, 0x3B, 0x06, 0x00, 0x60, 0x41, 0x04, 0x0D, 0x63, 0x44,
+	 0x80, 0x7E, 0xDA, 0xFB, 0x61, 0x44, 0xDC, 0x84, 0x2B, 0xF0, 0x1B, 0xFA, 0x64, 0x44, 0x80, 0x27,
+	 0x58, 0x00, 0x07, 0xF0, 0x66, 0x45, 0x64, 0x46, 0x12, 0xF2, 0x65, 0x46, 0x60, 0x40, 0x10, 0x2A,
+	 0x31, 0x00, 0x16, 0xF2, 0x0F, 0xF0, 0xAC, 0x84, 0x2C, 0x45, 0x2C, 0x03, 0x4B, 0xF1, 0xC4, 0x84,
+	 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x81, 0x63, 0x40, 0x37, 0x37, 0xE1, 0x81, 0x64, 0x45, 0x0F, 0xF0,
+	 0xB8, 0x60, 0x58, 0x4D, 0x15, 0x78, 0xFF, 0xFF, 0xAE, 0x82, 0xFC, 0xA2, 0x0A, 0x03, 0x63, 0x40,
+	 0x6E, 0x3B, 0x06, 0x00, 0x60, 0x41, 0x04, 0x0D, 0x80, 0x67, 0xB0, 0x84, 0x0F, 0xFA, 0x61, 0x44,
+	 0xDC, 0x84, 0x1D, 0xFA, 0x1F, 0xF0, 0x01, 0x60, 0x3E, 0x65, 0x64, 0x40, 0x80, 0x27, 0x02, 0x00,
+	 0x02, 0x60, 0x5E, 0x65, 0x1B, 0xF0, 0x26, 0x41, 0xE1, 0x81, 0xC5, 0x81, 0x44, 0x94, 0xC1, 0x81,
+	 0x2B, 0xFA, 0x90, 0xFA, 0x26, 0x44, 0x2C, 0xF0, 0x0A, 0xA4, 0x66, 0x45, 0x24, 0x46, 0x92, 0xF2,
+	 0x65, 0x46, 0x9F, 0xF0, 0x61, 0x40, 0x10, 0x2A, 0x05, 0x00, 0x60, 0xA4, 0x65, 0x40, 0x80, 0x2B,
+	 0x60, 0xA4, 0x01, 0x00, 0x14, 0xA4, 0x64, 0x40, 0x01, 0x26, 0x00, 0x64, 0x60, 0x45, 0x2A, 0xF2,
+	 0x39, 0xF0, 0x8F, 0xB0, 0x88, 0x3A, 0x04, 0x00, 0x64, 0x44, 0x60, 0xB0, 0x20, 0x36, 0x00, 0x65,
+	 0x65, 0x44, 0x11, 0xFA, 0xDA, 0xF3, 0x13, 0xFA, 0x7C, 0x44, 0x1D, 0xFA, 0x0F, 0xF0, 0xFF, 0xFF,
+	 0x64, 0x40, 0x01, 0x2A, 0x6F, 0x00, 0x7D, 0xF1, 0x19, 0x60, 0x7B, 0xF3, 0x64, 0x40, 0x01, 0x27,
+	 0x03, 0x00, 0x60, 0x40, 0x02, 0x26, 0x14, 0x00, 0x07, 0xF0, 0x66, 0x43, 0x64, 0x46, 0x12, 0xF0,
+	 0x19, 0x60, 0x7C, 0xF3, 0x63, 0x46, 0x64, 0x40, 0x10, 0x2A, 0x20, 0x00, 0x60, 0x40, 0x02, 0x26,
+	 0x07, 0x00, 0x01, 0x26, 0x08, 0x00, 0x04, 0x26, 0x09, 0x00, 0x06, 0x61, 0x6E, 0x63, 0x08, 0x00,
+	 0x02, 0x61, 0x14, 0x63, 0x05, 0x00, 0x00, 0x61, 0x0A, 0x63, 0x02, 0x00, 0x04, 0x61, 0x37, 0x63,
+	 0x00, 0x64, 0x2C, 0x60, 0x9C, 0x65, 0x45, 0xD1, 0xD5, 0x81, 0x19, 0x60, 0x78, 0xF9, 0x2C, 0x60,
+	 0x74, 0x65, 0x45, 0xD1, 0x1C, 0xFC, 0xB0, 0x84, 0x1E, 0xFA, 0x3C, 0x00, 0x60, 0x40, 0x10, 0x2A,
+	 0x04, 0x00, 0x08, 0x61, 0x1E, 0x60, 0x0B, 0x63, 0x27, 0x00, 0x20, 0x2A, 0x04, 0x00, 0x0A, 0x61,
+	 0x16, 0x60, 0x0F, 0x63, 0x21, 0x00, 0x40, 0x2A, 0x04, 0x00, 0x0C, 0x61, 0x12, 0x60, 0x0A, 0x63,
+	 0x1B, 0x00, 0x80, 0x2A, 0x04, 0x00, 0x0E, 0x61, 0x0E, 0x60, 0x0E, 0x63, 0x15, 0x00, 0x01, 0x2B,
+	 0x04, 0x00, 0x10, 0x61, 0x0E, 0x60, 0x09, 0x63, 0x0F, 0x00, 0x02, 0x2B, 0x04, 0x00, 0x12, 0x61,
+	 0x0A, 0x60, 0x0D, 0x63, 0x09, 0x00, 0x04, 0x2B, 0x04, 0x00, 0x14, 0x61, 0x0A, 0x60, 0x08, 0x63,
+	 0x03, 0x00, 0x16, 0x61, 0x0A, 0x60, 0x0C, 0x63, 0x1E, 0xF0, 0x40, 0x67, 0x2C, 0x60, 0x9C, 0x65,
+	 0x45, 0xD1, 0xD5, 0x81, 0x19, 0x60, 0x78, 0xF9, 0x2C, 0x60, 0x74, 0x65, 0x45, 0xD1, 0x1C, 0xFC,
+	 0xB0, 0x84, 0x1E, 0xFA, 0xFF, 0xFF, 0x0D, 0xF2, 0x3E, 0xF0, 0x60, 0x47, 0xFF, 0xB4, 0x64, 0x41,
+	 0x01, 0xB1, 0x01, 0x63, 0x17, 0x02, 0x60, 0x41, 0xFF, 0x22, 0x04, 0x00, 0xB8, 0x60, 0x58, 0x4F,
+	 0x06, 0x78, 0xFF, 0xFF, 0x07, 0x60, 0xED, 0xFD, 0x19, 0x60, 0xCF, 0xF3, 0xFF, 0xFF, 0x60, 0x41,
+	 0x01, 0x63, 0x61, 0x40, 0xFF, 0x22, 0x04, 0x00, 0xB8, 0x60, 0x58, 0x4F, 0x06, 0x78, 0xFF, 0xFF,
+	 0x07, 0x60, 0xEE, 0xFD, 0x02, 0x64, 0x3B, 0xDB, 0xBF, 0x60, 0xE4, 0x78, 0xFF, 0xFF, 0x66, 0x44,
+	 0xFC, 0xFB, 0x07, 0xF0, 0x00, 0x64, 0xD0, 0x80, 0xA6, 0xF3, 0x0E, 0x03, 0xD0, 0x80, 0xFF, 0xFF,
+	 0x0B, 0x03, 0x47, 0xF1, 0x07, 0xF0, 0x64, 0x40, 0x02, 0x26, 0x01, 0x00, 0x08, 0x00, 0x03, 0x12,
+	 0xBE, 0x60, 0xA0, 0x78, 0xFF, 0xFF, 0xFC, 0x0A, 0xBF, 0x60, 0x00, 0x78, 0xFF, 0xFF, 0x87, 0xF0,
+	 0xA6, 0xF3, 0x10, 0xF0, 0xD4, 0x80, 0xFF, 0xFF, 0x3D, 0x03, 0x66, 0x43, 0x65, 0x46, 0xFF, 0x67,
+	 0x20, 0x85, 0x64, 0x5F, 0x40, 0x44, 0x15, 0xF0, 0x25, 0x44, 0xD0, 0x84, 0x03, 0xA4, 0x03, 0x0E,
+	 0xE8, 0x84, 0xE8, 0x84, 0x04, 0x00, 0xFA, 0xA4, 0xE8, 0x84, 0xE8, 0x87, 0xC0, 0xBF, 0xC0, 0x84,
+	 0x15, 0xFA, 0x40, 0x45, 0x14, 0xF0, 0x24, 0x44, 0xD0, 0x84, 0x1F, 0xA4, 0x06, 0x0E, 0xE8, 0x84,
+	 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0x07, 0x00, 0xC2, 0xA4, 0xE8, 0x84, 0xE8, 0x84,
+	 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x87, 0xF8, 0xBF, 0xC0, 0x84, 0x14, 0xFA, 0x60, 0x5C, 0x2F, 0x67,
+	 0xD0, 0x80, 0x60, 0x45, 0x02, 0x28, 0x64, 0x45, 0x25, 0x5C, 0x8B, 0x67, 0xD0, 0x80, 0x60, 0x41,
+	 0x02, 0x24, 0x64, 0x41, 0xD5, 0x84, 0x80, 0x65, 0xC4, 0x87, 0x01, 0x05, 0x00, 0x64, 0xFF, 0xB4,
+	 0x0E, 0xFA, 0x63, 0x46, 0x07, 0xF0, 0x66, 0x43, 0x64, 0x46, 0x17, 0xF2, 0x63, 0x46, 0x60, 0x40,
+	 0x00, 0x36, 0x2E, 0x00, 0x01, 0x36, 0x1E, 0x00, 0x03, 0x3A, 0x25, 0x00, 0x64, 0x46, 0x10, 0xF2,
+	 0x11, 0xFA, 0x12, 0xF2, 0x00, 0x61, 0x60, 0x47, 0x00, 0x7F, 0x12, 0xFA, 0x97, 0xFA, 0x46, 0x44,
+	 0x63, 0x46, 0xC2, 0x60, 0x58, 0x4E, 0x4C, 0x78, 0xFF, 0xFF, 0x65, 0x40, 0x00, 0x3A, 0x04, 0x00,
+	 0xC2, 0x60, 0x58, 0x4E, 0x96, 0x78, 0xFF, 0xFF, 0x07, 0xF0, 0x66, 0x43, 0x64, 0x46, 0x96, 0xFC,
+	 0x63, 0x46, 0x43, 0x00, 0x64, 0x46, 0x16, 0xF2, 0x00, 0x61, 0x20, 0x28, 0xFF, 0xA4, 0x97, 0xFA,
+	 0x16, 0xFA, 0x63, 0x46, 0x3A, 0x00, 0x64, 0x46, 0x00, 0x61, 0x97, 0xFA, 0x63, 0x46, 0x35, 0x00,
+	 0x07, 0xF0, 0x66, 0x41, 0x64, 0x46, 0x16, 0xF2, 0xFF, 0xFF, 0x20, 0x28, 0xFF, 0xA4, 0x16, 0xFA,
+	 0x93, 0xF4, 0x12, 0xF2, 0x20, 0x28, 0xFF, 0xA3, 0x13, 0xFC, 0x61, 0x46, 0x63, 0x40, 0x00, 0x3A,
+	 0x24, 0x00, 0xC2, 0x60, 0x58, 0x4E, 0x6D, 0x78, 0xFF, 0xFF, 0x61, 0x40, 0xFF, 0x36, 0x1D, 0x00,
+	 0x66, 0x41, 0x64, 0x46, 0x12, 0xF2, 0x93, 0xF4, 0x61, 0x46, 0x20, 0x28, 0x16, 0x00, 0x44, 0x44,
+	 0xC2, 0x60, 0x58, 0x4E, 0x4C, 0x78, 0xFF, 0xFF, 0x24, 0x5C, 0x65, 0x40, 0x00, 0x36, 0x06, 0x00,
+	 0x66, 0x41, 0x64, 0x46, 0x01, 0x64, 0x17, 0xFA, 0x61, 0x46, 0x07, 0x00, 0x66, 0x43, 0x64, 0x46,
+	 0xC2, 0x60, 0x58, 0x4E, 0x96, 0x78, 0xFF, 0xFF, 0x63, 0x46, 0xBF, 0x60, 0x00, 0x78, 0xFF, 0xFF,
+	 0x07, 0xF0, 0x66, 0x43, 0x64, 0x46, 0x17, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0xFF, 0x27, 0xFF, 0xFF,
+	 0x00, 0x36, 0x07, 0x00, 0x01, 0x36, 0x1C, 0x00, 0x02, 0x36, 0x24, 0x00, 0x03, 0x36, 0x43, 0x00,
+	 0xFF, 0xFF, 0x19, 0x60, 0xA9, 0xF1, 0x16, 0xF2, 0x43, 0x44, 0xD0, 0x80, 0x33, 0x60, 0x84, 0x61,
+	 0x09, 0x03, 0xA1, 0xD1, 0x33, 0x60, 0x82, 0x63, 0xC0, 0x84, 0x16, 0xFA, 0xA3, 0xD3, 0xFF, 0xFF,
+	 0x13, 0xFA, 0x39, 0x00, 0x96, 0xFC, 0xC2, 0x60, 0x58, 0x4E, 0x96, 0x78, 0xFF, 0xFF, 0x33, 0x00,
+	 0x43, 0x44, 0xC2, 0x60, 0x58, 0x4E, 0x96, 0x78, 0xFF, 0xFF, 0x19, 0x60, 0xC1, 0xF3, 0x96, 0xFC,
+	 0x13, 0xFA, 0x29, 0x00, 0x63, 0x46, 0x33, 0x60, 0x54, 0x63, 0xA3, 0xD3, 0x15, 0xF2, 0x60, 0x45,
+	 0xD4, 0x80, 0x07, 0xF0, 0x0C, 0x03, 0x66, 0x41, 0x44, 0x44, 0x64, 0x46, 0x12, 0xF2, 0x61, 0x46,
+	 0xC2, 0x60, 0x58, 0x4E, 0x4C, 0x78, 0xFF, 0xFF, 0x65, 0x40, 0x00, 0x3A, 0x19, 0x00, 0x66, 0x43,
+	 0x24, 0x46, 0xC2, 0x60, 0x58, 0x4E, 0x96, 0x78, 0xFF, 0xFF, 0x12, 0xF2, 0x91, 0xF2, 0x90, 0xFA,
+	 0x60, 0x5F, 0x12, 0xFA, 0x04, 0x00, 0xC2, 0x60, 0x58, 0x4E, 0x96, 0x78, 0xFF, 0xFF, 0x03, 0x64,
+	 0x17, 0xFA, 0x63, 0x46, 0x05, 0x00, 0x24, 0x43, 0x02, 0x64, 0x17, 0xFA, 0x63, 0x46, 0x00, 0x00,
+	 0x03, 0x64, 0x3B, 0xDB, 0xCA, 0xFE, 0x47, 0xF1, 0x01, 0x65, 0x32, 0x40, 0x04, 0x27, 0x11, 0x00,
+	 0x2C, 0xF2, 0x64, 0x45, 0x02, 0x22, 0x0D, 0x00, 0x60, 0x40, 0x01, 0x26, 0x0A, 0x00, 0x2A, 0xF2,
+	 0x39, 0xF0, 0x8F, 0xB0, 0x88, 0x3A, 0x77, 0x00, 0x64, 0x44, 0x60, 0xB0, 0x20, 0x36, 0x01, 0x00,
+	 0x72, 0x00, 0x14, 0xF2, 0x65, 0x40, 0x01, 0x26, 0x0C, 0x00, 0x60, 0x45, 0x05, 0x64, 0x3B, 0xDB,
+	 0x65, 0x44, 0xCC, 0x85, 0x2C, 0x60, 0xD0, 0x64, 0xF1, 0x60, 0x78, 0x41, 0xF0, 0x78, 0xB5, 0xF1,
+	 0x50, 0x00, 0x60, 0x41, 0x2A, 0xF0, 0x00, 0x60, 0x0C, 0x64, 0xA0, 0x84, 0x04, 0x36, 0x02, 0x00,
+	 0x0C, 0x3A, 0x01, 0x00, 0x46, 0x00, 0x61, 0x45, 0x60, 0x43, 0x2C, 0x60, 0xD0, 0x64, 0xF1, 0x60,
+	 0x78, 0x41, 0xF0, 0x78, 0xB5, 0xF1, 0x63, 0x40, 0x08, 0x36, 0x01, 0x00, 0x3A, 0x00, 0x14, 0xF2,
+	 0x1C, 0x65, 0x60, 0x41, 0x00, 0x63, 0xCD, 0x81, 0xC7, 0x83, 0xFD, 0x02, 0x3F, 0xF0, 0x2C, 0xF2,
+	 0xC3, 0x83, 0x60, 0x40, 0x01, 0x2A, 0x0D, 0x00, 0x2C, 0x60, 0xCE, 0x64, 0xF1, 0x60, 0x78, 0x41,
+	 0xE4, 0x78, 0xB5, 0xF1, 0x2C, 0x60, 0xD4, 0x64, 0xF1, 0x60, 0x78, 0x41, 0xEF, 0x78, 0x63, 0x45,
+	 0x20, 0x00, 0x2C, 0x60, 0xCC, 0x64, 0xF1, 0x60, 0x78, 0x41, 0xE4, 0x78, 0xB5, 0xF1, 0x2C, 0x60,
+	 0xD2, 0x64, 0xF1, 0x60, 0x78, 0x41, 0xEF, 0x78, 0x63, 0x45, 0x15, 0xF2, 0xFF, 0xFF, 0x0F, 0xB4,
+	 0x00, 0xA8, 0x01, 0xA8, 0x0E, 0x03, 0x07, 0x03, 0x2C, 0x60, 0xDA, 0x64, 0xF1, 0x60, 0x78, 0x41,
+	 0xE4, 0x78, 0xB5, 0xF1, 0x06, 0x00, 0x2C, 0x60, 0xD8, 0x64, 0xF1, 0x60, 0x78, 0x41, 0xE4, 0x78,
+	 0xB5, 0xF1, 0x04, 0x64, 0x3B, 0xDB, 0x25, 0x60, 0xEC, 0x64, 0x13, 0x60, 0x0A, 0xFB, 0x3C, 0x44,
+	 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0x5C, 0x5C, 0xFC, 0xFC, 0xCE, 0xFE,
+	 0xB8, 0x60, 0x37, 0x78, 0xFF, 0xFF, 0x2A, 0xF2, 0xFF, 0xFF, 0x50, 0xA8, 0x02, 0x7C, 0x09, 0x03,
+	 0x0F, 0xF0, 0x15, 0xF2, 0x64, 0x41, 0x01, 0x2A, 0x02, 0x00, 0xCD, 0xF1, 0x02, 0x00, 0xCC, 0xF1,
+	 0xFF, 0xFF, 0x64, 0x45, 0xDC, 0x84, 0xD4, 0x80, 0x15, 0xFA, 0x2D, 0x07, 0x61, 0x40, 0x01, 0x2A,
+	 0x08, 0x00, 0x16, 0x60, 0x80, 0xF3, 0xFF, 0xFF, 0xDC, 0x84, 0x00, 0x36, 0x00, 0x3B, 0xA2, 0xDB,
+	 0x07, 0x00, 0x16, 0x60, 0x81, 0xF3, 0xFF, 0xFF, 0xDC, 0x84, 0x00, 0x36, 0x00, 0x3B, 0xA2, 0xDB,
+	 0x2A, 0xF0, 0x08, 0x67, 0xB0, 0x84, 0xA2, 0xDA, 0x00, 0x64, 0x48, 0xFB, 0x19, 0x60, 0xA3, 0xF3,
+	 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x2A, 0x0C, 0x00, 0x3C, 0x46, 0x3E, 0xF2, 0x40, 0x60, 0x00, 0x65,
+	 0xF0, 0x84, 0xA4, 0x84, 0x3D, 0xFA, 0x2A, 0xF2, 0xBF, 0x60, 0xFF, 0x65, 0xA4, 0x84, 0x2A, 0xFA,
+	 0xBA, 0x60, 0x02, 0x78, 0xFF, 0xFF, 0x00, 0x64, 0x49, 0xFB, 0x2C, 0x60, 0xDA, 0x64, 0xF1, 0x60,
+	 0x78, 0x41, 0xE4, 0x78, 0xB5, 0xF1, 0x2C, 0x60, 0xDC, 0x64, 0xF1, 0x60, 0x78, 0x41, 0xE4, 0x78,
+	 0xB5, 0xF1, 0x27, 0x44, 0xF7, 0xB4, 0x40, 0x47, 0x23, 0xF0, 0x01, 0x64, 0xB0, 0x84, 0xA2, 0xDA,
+	 0x98, 0x01, 0xC0, 0x60, 0x5F, 0x78, 0xFF, 0xFF, 0x21, 0x64, 0x3B, 0xDB, 0x31, 0xF3, 0x01, 0x63,
+	 0xC4, 0xB4, 0x31, 0xFB, 0x32, 0xFD, 0xC0, 0x60, 0x14, 0x62, 0x42, 0x40, 0xA0, 0x4C, 0x40, 0xBC,
+	 0x7D, 0xB4, 0xA0, 0x51, 0xA0, 0xFE, 0x1A, 0xFF, 0x25, 0x60, 0xE0, 0x64, 0x08, 0xF0, 0x07, 0xF0,
+	 0xD0, 0x80, 0x25, 0x60, 0xE6, 0x62, 0x13, 0x02, 0xA2, 0xD3, 0x01, 0x63, 0xAC, 0x86, 0x07, 0xF2,
+	 0x0E, 0x03, 0xD0, 0x80, 0x09, 0xF2, 0xFA, 0x02, 0x23, 0xFC, 0x25, 0x60, 0xEC, 0x64, 0x13, 0x60,
+	 0x0A, 0xFB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0x3C, 0x46,
+	 0x06, 0x64, 0xA1, 0xFF, 0x49, 0xFB, 0x83, 0x3E, 0x31, 0xF3, 0x87, 0x60, 0x80, 0x61, 0x1D, 0xF0,
+	 0x60, 0x40, 0x01, 0x2A, 0x0F, 0x00, 0xFE, 0xB4, 0x31, 0xFB, 0x00, 0x64, 0x49, 0xFB, 0x01, 0x64,
+	 0x47, 0xFB, 0x00, 0x71, 0x05, 0x64, 0x64, 0x5F, 0x0D, 0xFA, 0x40, 0x64, 0x3B, 0xDB, 0xC0, 0x60,
+	 0x5F, 0x78, 0xFF, 0xFF, 0x02, 0x2A, 0x18, 0x00, 0xD1, 0x91, 0x8D, 0xE2, 0x41, 0x64, 0x3B, 0xDB,
+	 0x31, 0xF3, 0x33, 0x60, 0xA6, 0x63, 0xFD, 0xB4, 0x31, 0xFB, 0xA3, 0xD3, 0x02, 0x63, 0x60, 0x5C,
+	 0x0D, 0xF2, 0x47, 0xFD, 0xFF, 0xB5, 0x60, 0x47, 0xFF, 0xB4, 0xD0, 0x80, 0xDC, 0x84, 0x1F, 0x03,
+	 0x60, 0x47, 0xB4, 0x84, 0x0D, 0xFA, 0x1B, 0x00, 0x08, 0x2A, 0x07, 0x00, 0x42, 0x64, 0x3B, 0xDB,
+	 0x31, 0xF3, 0xFF, 0xFF, 0xF7, 0xB4, 0x31, 0xFB, 0x12, 0x00, 0x10, 0x2A, 0x09, 0x00, 0x43, 0x64,
+	 0x3B, 0xDB, 0x31, 0xF3, 0xFF, 0xFF, 0xEF, 0xB4, 0x31, 0xFB, 0xBF, 0x60, 0xE4, 0x78, 0xFF, 0xFF,
+	 0x44, 0x64, 0x3B, 0xDB, 0x31, 0xF3, 0xFF, 0xFF, 0xDF, 0xB4, 0x31, 0xFB, 0x00, 0x00, 0x2A, 0x64,
+	 0x3B, 0xDB, 0xB7, 0x60, 0xF7, 0x64, 0x40, 0x40, 0xBD, 0x60, 0xD7, 0x78, 0xFF, 0xFF, 0x0E, 0x60,
+	 0xDF, 0xF3, 0xFF, 0xFF, 0x02, 0xB5, 0x04, 0xB5, 0x04, 0x03, 0x03, 0x03, 0xC1, 0x60, 0x70, 0x78,
+	 0xFF, 0xFF, 0x31, 0x40, 0x01, 0x26, 0x16, 0x00, 0xA0, 0x4C, 0x49, 0xBC, 0xFF, 0xB4, 0xA0, 0x51,
+	 0x0E, 0x60, 0xDF, 0xF3, 0xFF, 0xFF, 0x02, 0xB5, 0x04, 0xBC, 0x09, 0x03, 0x60, 0x40, 0x01, 0x26,
+	 0xED, 0xE2, 0xFE, 0xB4, 0xA2, 0xDB, 0xA0, 0x4C, 0x7D, 0xB4, 0xA0, 0x51, 0x03, 0x00, 0xA0, 0x4C,
+	 0x6D, 0xB4, 0xA0, 0x51, 0xDB, 0xF3, 0xFF, 0xFF, 0xFD, 0xA0, 0xFF, 0xFF, 0x08, 0x24, 0x59, 0x00,
+	 0x31, 0x40, 0x04, 0x2A, 0x38, 0x00, 0x01, 0x64, 0x19, 0x60, 0xF4, 0xFB, 0x6C, 0xF3, 0x73, 0xF3,
+	 0xCC, 0x83, 0x6C, 0xFD, 0xCC, 0x84, 0x73, 0xFB, 0x1E, 0x02, 0x31, 0x40, 0x02, 0x2A, 0x12, 0x00,
+	 0x6E, 0xF3, 0x6F, 0xF1, 0xCC, 0x84, 0x6E, 0xFB, 0x0D, 0x02, 0x6E, 0xF9, 0x31, 0x44, 0x08, 0xBC,
+	 0x40, 0x51, 0x71, 0xF3, 0x70, 0xF1, 0x00, 0xB8, 0x64, 0x45, 0x01, 0x03, 0x67, 0x45, 0x65, 0x50,
+	 0xCC, 0x84, 0x72, 0xFB, 0x16, 0x60, 0xAC, 0xF3, 0x6D, 0xF1, 0x00, 0xB8, 0x73, 0xF9, 0x03, 0x03,
+	 0x85, 0xF3, 0x6C, 0xFB, 0x04, 0x00, 0x6C, 0xF3, 0x85, 0xF1, 0x0D, 0x1B, 0x6C, 0xF9, 0x31, 0x40,
+	 0x01, 0x2A, 0x09, 0x00, 0x9D, 0xFE, 0x07, 0x05, 0xBA, 0xFE, 0x08, 0x64, 0x13, 0x60, 0x16, 0xFB,
+	 0x2D, 0xFF, 0xFF, 0xFF, 0xA3, 0xFE, 0x32, 0x40, 0x80, 0x2A, 0x12, 0x00, 0x31, 0x40, 0x04, 0x2A,
+	 0x0F, 0x00, 0x16, 0x60, 0xAC, 0xF3, 0x6C, 0xF1, 0x03, 0x1B, 0x31, 0x40, 0x02, 0x2A, 0x06, 0x00,
+	 0x73, 0xF3, 0xFF, 0xFF, 0xD0, 0x80, 0xFF, 0xFF, 0x01, 0x07, 0x60, 0x5C, 0x19, 0x60, 0xF5, 0xF9,
+	 0x00, 0x64, 0x19, 0x60, 0xF4, 0xFB, 0x0E, 0x60, 0x37, 0xF3, 0xFF, 0xFF, 0xCC, 0x84, 0xFF, 0x2B,
+	 0xA2, 0xDB, 0xCF, 0xF1, 0x07, 0x60, 0xE9, 0xF3, 0x64, 0x40, 0x02, 0x3A, 0x3A, 0x00, 0x0A, 0x60,
+	 0x18, 0xF1, 0x10, 0xB4, 0x90, 0x80, 0xFF, 0xFF, 0x34, 0x03, 0x0A, 0x60, 0x18, 0xFB, 0x01, 0x63,
+	 0x60, 0x40, 0x10, 0x22, 0x00, 0x63, 0x08, 0x60, 0xC1, 0xFD, 0x08, 0x60, 0xC5, 0xFD, 0x08, 0x60,
+	 0xC9, 0xFD, 0x08, 0x60, 0xCD, 0xFD, 0x7D, 0xF3, 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x23, 0x21, 0x00,
+	 0x0B, 0x36, 0x07, 0x00, 0x0C, 0x36, 0x05, 0x00, 0x0D, 0x36, 0x03, 0x00, 0x0E, 0x36, 0x01, 0x00,
+	 0x18, 0x00, 0xDB, 0xF3, 0x01, 0x63, 0x0E, 0x60, 0x36, 0xFD, 0x60, 0x40, 0x03, 0x3A, 0x08, 0x00,
+	 0x08, 0x60, 0x15, 0xF1, 0x00, 0x60, 0x04, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x09, 0x00,
+	 0x04, 0x3A, 0x07, 0x00, 0x08, 0x60, 0x15, 0xF1, 0x00, 0x60, 0x10, 0x64, 0xB0, 0x84, 0xA2, 0xDB,
+	 0xCF, 0xFE, 0x10, 0x64, 0x3B, 0xDB, 0x7E, 0xF3, 0x73, 0x45, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84,
+	 0xE0, 0x84, 0xC4, 0x93, 0xC9, 0xFE, 0x49, 0xF3, 0x3C, 0x46, 0x25, 0x18, 0xCC, 0x84, 0x49, 0xFB,
+	 0x22, 0x02, 0xC2, 0x60, 0x45, 0x64, 0x40, 0x42, 0xFC, 0xFC, 0x00, 0x64, 0x5C, 0x5C, 0x32, 0xFB,
+	 0x82, 0xFF, 0x5C, 0x47, 0x84, 0xFF, 0x62, 0xFF, 0x16, 0x60, 0x7E, 0xF3, 0xFF, 0xFF, 0xDC, 0x84,
+	 0x00, 0x36, 0x00, 0x3B, 0xA2, 0xDB, 0x23, 0xF0, 0x01, 0x64, 0xB0, 0x84, 0xA2, 0xDA, 0x25, 0x60,
+	 0xEC, 0x64, 0x13, 0x60, 0x0A, 0xFB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF,
+	 0x2B, 0xFF, 0xC1, 0xFE, 0xCE, 0xFE, 0x69, 0xF3, 0xFF, 0xFF, 0x60, 0x41, 0xFD, 0xB4, 0xA2, 0xDB,
+	 0x61, 0x44, 0x01, 0xB0, 0x02, 0xB0, 0x0B, 0x03, 0x0A, 0x02, 0x9D, 0xFE, 0x08, 0x04, 0x1C, 0x60,
+	 0xCE, 0x64, 0x13, 0x60, 0x20, 0xFB, 0x02, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x07, 0x00,
+	 0x7E, 0xF3, 0x73, 0x45, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xC4, 0x93, 0x1D, 0x60,
+	 0xBA, 0x63, 0xA3, 0xD3, 0xAD, 0x49, 0x20, 0xB5, 0x08, 0xB1, 0x22, 0x03, 0xE1, 0x81, 0x10, 0xB5,
+	 0x95, 0x81, 0x60, 0x41, 0x18, 0x02, 0x1D, 0x60, 0xBC, 0x7C, 0xA4, 0xD3, 0xFF, 0xFF, 0xCC, 0x84,
+	 0xA4, 0xDB, 0x16, 0x02, 0x05, 0x64, 0xA4, 0xDB, 0x61, 0x44, 0x07, 0xB4, 0xFF, 0xFF, 0x10, 0x02,
+	 0x08, 0xB1, 0xE1, 0x81, 0x95, 0x81, 0xA3, 0xD3, 0x0B, 0x03, 0x08, 0xAC, 0x01, 0xBC, 0xA3, 0xDB,
+	 0xFF, 0xFF, 0x13, 0xFF, 0x05, 0x00, 0x10, 0xAC, 0xA3, 0xDB, 0x05, 0x7C, 0x0E, 0x60, 0xDE, 0xF9,
+	 0xB8, 0x60, 0x03, 0x78, 0xFF, 0xFF, 0x46, 0xF3, 0x45, 0xF1, 0x04, 0x1B, 0x64, 0x44, 0x02, 0x1B,
+	 0x07, 0x60, 0xED, 0xF3, 0x45, 0xFB, 0x00, 0x63, 0x46, 0xFD, 0x60, 0x41, 0x25, 0x64, 0x3B, 0xDB,
+	 0x27, 0x44, 0xEF, 0xB4, 0x40, 0x47, 0x00, 0xB9, 0x71, 0x40, 0x80, 0x27, 0x01, 0x12, 0x27, 0x03,
+	 0xC1, 0x60, 0xC5, 0x62, 0x84, 0xFF, 0x42, 0x42, 0x82, 0xFF, 0xA0, 0x4C, 0x14, 0xBC, 0xFF, 0xB4,
+	 0xA0, 0x51, 0x2D, 0x0A, 0xA1, 0xFF, 0xFF, 0xFF, 0x81, 0x3E, 0x70, 0x44, 0xAC, 0x80, 0x27, 0x0A,
+	 0x71, 0x40, 0x80, 0x27, 0xF7, 0x12, 0x45, 0xF3, 0x48, 0x02, 0x11, 0x18, 0x1B, 0x60, 0xEE, 0xF3,
+	 0x1B, 0x60, 0xEF, 0xF3, 0x07, 0x18, 0x06, 0x18, 0xAC, 0x4C, 0x80, 0x26, 0x03, 0x00, 0x00, 0x64,
+	 0x45, 0xFB, 0x05, 0x00, 0x45, 0xF3, 0xFF, 0xFF, 0xCC, 0x84, 0x45, 0xFB, 0xE3, 0x02, 0x06, 0x0A,
+	 0xA0, 0x4C, 0xFB, 0xB4, 0xA0, 0x51, 0xA4, 0x60, 0x58, 0x78, 0xFF, 0xFF, 0x84, 0xFF, 0xC1, 0x60,
+	 0xA3, 0x64, 0x40, 0x42, 0x82, 0xFF, 0xA0, 0x4C, 0x14, 0xBC, 0xFF, 0xB4, 0xA0, 0x51, 0xB0, 0x60,
+	 0x9E, 0x78, 0xFF, 0xFF, 0x3C, 0x44, 0xAC, 0x80, 0x32, 0xF1, 0x25, 0x03, 0x64, 0x40, 0x07, 0x22,
+	 0x22, 0x00, 0xA4, 0x60, 0x36, 0x78, 0xFF, 0xFF, 0xA0, 0x4C, 0x1C, 0xBC, 0xDF, 0xB4, 0xA0, 0x51,
+	 0x31, 0x40, 0x08, 0x2A, 0xEF, 0x01, 0x72, 0xF3, 0x70, 0xF1, 0x00, 0xA0, 0xDC, 0x80, 0x05, 0x03,
+	 0x08, 0x03, 0xCC, 0x84, 0x72, 0xFB, 0x67, 0x50, 0x08, 0x00, 0xCC, 0x84, 0x72, 0xFB, 0x64, 0x50,
+	 0x04, 0x00, 0x31, 0x44, 0xF7, 0xB4, 0x40, 0x51, 0x06, 0x00, 0x28, 0x64, 0x3A, 0xDB, 0xA0, 0x4C,
+	 0x30, 0xBC, 0xF3, 0xB4, 0xA0, 0x51, 0xA1, 0xFF, 0xFF, 0xFF, 0x81, 0x3E, 0x28, 0x64, 0x3B, 0xDB,
+	 0x07, 0x60, 0xEE, 0xF3, 0x32, 0x40, 0x02, 0x27, 0x16, 0x00, 0x46, 0xFB, 0x14, 0x18, 0xC2, 0x60,
+	 0x33, 0x64, 0x84, 0xFF, 0x40, 0x42, 0x82, 0xFF, 0xA0, 0x4C, 0x15, 0xBC, 0xF7, 0xB4, 0xA0, 0x51,
+	 0xA1, 0xFF, 0xFF, 0xFF, 0x81, 0x3E, 0x70, 0x44, 0xAC, 0x80, 0x46, 0xF3, 0xB8, 0x0A, 0xDD, 0x02,
+	 0xCC, 0x84, 0x46, 0xFB, 0xF5, 0x02, 0x84, 0xFF, 0xC2, 0x60, 0x45, 0x64, 0x40, 0x42, 0x82, 0xFF,
+	 0x27, 0x44, 0x08, 0xBC, 0x40, 0x47, 0xF9, 0xE1, 0x04, 0x00, 0x78, 0xE1, 0x31, 0x40, 0x01, 0x26,
+	 0xF9, 0xE1, 0xA4, 0x60, 0x2D, 0x78, 0xFF, 0xFF, 0x19, 0x60, 0xAB, 0xF1, 0x60, 0x45, 0x33, 0x60,
+	 0x6A, 0x61, 0xC5, 0x83, 0xA3, 0xD3, 0xFF, 0xFF, 0x60, 0x41, 0x66, 0x45, 0x24, 0x46, 0x0E, 0xF2,
+	 0x65, 0x46, 0x64, 0x45, 0xD5, 0x81, 0x61, 0x45, 0x00, 0x7F, 0xD4, 0x80, 0x64, 0x43, 0x08, 0x04,
+	 0xE3, 0x83, 0x63, 0x45, 0xC5, 0x81, 0x61, 0x45, 0xD4, 0x80, 0x02, 0x65, 0x03, 0x07, 0x03, 0x00,
+	 0x00, 0x65, 0x01, 0x00, 0x01, 0x65, 0x2E, 0x58, 0xFF, 0xFF, 0x66, 0x43, 0x64, 0x46, 0x8F, 0xF0,
+	 0x12, 0xF2, 0x91, 0xF2, 0x60, 0x40, 0x10, 0x36, 0x05, 0x00, 0x12, 0x36, 0x08, 0x00, 0x0C, 0x36,
+	 0x0B, 0x00, 0x0F, 0x00, 0x40, 0x61, 0xA5, 0x80, 0x0A, 0x64, 0x13, 0x02, 0xF3, 0x01, 0x10, 0x61,
+	 0xA5, 0x80, 0x0E, 0x64, 0x0E, 0x02, 0xEE, 0x01, 0x08, 0x61, 0xA5, 0x80, 0x10, 0x64, 0x09, 0x02,
+	 0xE9, 0x01, 0xE1, 0x81, 0xA5, 0x80, 0x03, 0x05, 0xC8, 0x84, 0x03, 0x02, 0xE3, 0x01, 0xFF, 0x61,
+	 0x02, 0x00, 0x12, 0xFA, 0x91, 0xFA, 0x63, 0x46, 0x2E, 0x58, 0xFF, 0xFF, 0x8F, 0xF0, 0x12, 0xF2,
+	 0x91, 0xF2, 0x60, 0x40, 0x0A, 0x36, 0x05, 0x00, 0x0E, 0x36, 0x08, 0x00, 0x10, 0x36, 0x0B, 0x00,
+	 0x0F, 0x00, 0x08, 0x61, 0xA5, 0x80, 0x10, 0x7E, 0x11, 0x02, 0xF3, 0x01, 0x04, 0x61, 0xA5, 0x80,
+	 0x12, 0x7E, 0x0C, 0x02, 0xEE, 0x01, 0x20, 0x61, 0xA5, 0x80, 0x0C, 0x7E, 0x07, 0x02, 0xE9, 0x01,
+	 0xE9, 0x81, 0xA5, 0x80, 0x05, 0x05, 0xD8, 0x84, 0x01, 0x02, 0xE3, 0x01, 0x12, 0xFA, 0x91, 0xFA,
+	 0x2E, 0x58, 0xFF, 0xFF, 0x28, 0x40, 0x08, 0x3A, 0x06, 0x00, 0x04, 0x60, 0x40, 0x62, 0x3D, 0x60,
+	 0x58, 0x4D, 0x3B, 0x78, 0xFF, 0xFF, 0x2F, 0x58, 0xFF, 0xFF, 0x64, 0x40, 0x01, 0x2B, 0x50, 0x00,
+	 0x28, 0x40, 0x08, 0x3A, 0x4D, 0x00, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0x19, 0x60,
+	 0x52, 0xFB, 0x7D, 0xF1, 0x2B, 0x60, 0x82, 0x63, 0x64, 0x40, 0x01, 0x27, 0x3C, 0xA3, 0x29, 0x40,
+	 0x40, 0x2B, 0x1E, 0xA3, 0xBD, 0xD1, 0x63, 0x45, 0x44, 0x4E, 0x0E, 0x61, 0xBD, 0xD1, 0xCD, 0x81,
+	 0xD0, 0x80, 0x01, 0x03, 0xFB, 0x04, 0xCB, 0x83, 0x19, 0x60, 0x55, 0xF3, 0x39, 0xF1, 0xD7, 0x83,
+	 0xEB, 0x83, 0x2E, 0x41, 0x5D, 0x93, 0xDF, 0x83, 0x19, 0x60, 0x51, 0xFD, 0x19, 0x60, 0x50, 0xFB,
+	 0x53, 0x93, 0xDF, 0x80, 0x10, 0x03, 0x38, 0xF3, 0xCF, 0x83, 0x08, 0x03, 0xDF, 0x83, 0x0B, 0x02,
+	 0xDF, 0x83, 0xDC, 0x84, 0xF0, 0xA0, 0x38, 0xFB, 0x06, 0x03, 0x03, 0x00, 0xCC, 0x84, 0x38, 0xFB,
+	 0x02, 0x03, 0x00, 0x63, 0x02, 0x00, 0x08, 0x64, 0x38, 0xFB, 0xE3, 0x80, 0xFB, 0x83, 0xC3, 0x83,
+	 0x63, 0x44, 0xFC, 0xA0, 0x02, 0x0E, 0x08, 0x07, 0x08, 0x00, 0x04, 0xA4, 0xFF, 0xFF, 0x05, 0x0D,
+	 0xFC, 0x64, 0xFF, 0x7F, 0x60, 0x43, 0x01, 0x00, 0x04, 0x63, 0x39, 0xFD, 0x19, 0x60, 0x54, 0xFD,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x19, 0x60, 0x74, 0xF3, 0x40, 0x4E, 0x60, 0x46, 0x2F, 0xDB, 0x44, 0x44,
+	 0xA1, 0xD3, 0xD9, 0x81, 0x48, 0x94, 0x24, 0x5C, 0xD0, 0x9C, 0x66, 0x42, 0x04, 0x06, 0xD2, 0x9C,
+	 0x2F, 0xD9, 0x64, 0x46, 0x24, 0x44, 0xE0, 0x84, 0x44, 0xD3, 0xA3, 0xDB, 0xFF, 0xB4, 0x60, 0x5C,
+	 0x66, 0x44, 0x22, 0xA4, 0xD0, 0x84, 0xE0, 0xA0, 0x02, 0x0D, 0x00, 0x64, 0x02, 0x00, 0x01, 0x04,
+	 0x1F, 0x64, 0xA2, 0xD3, 0x60, 0x5C, 0x64, 0x5E, 0x60, 0x47, 0x2F, 0xD1, 0x28, 0xA3, 0xA3, 0xD9,
+	 0xD8, 0xA3, 0x2E, 0x42, 0x4E, 0x8E, 0xBD, 0xDB, 0xDB, 0x02, 0x2D, 0x58, 0xFF, 0xFF, 0x43, 0xFF,
+	 0x39, 0xE1, 0xA1, 0xFF, 0xFF, 0xFF, 0x84, 0x3E, 0xFB, 0x01, 0x3D, 0x44, 0x00, 0xA8, 0xFF, 0xFF,
+	 0x03, 0x02, 0x40, 0xFF, 0x44, 0xFF, 0xF4, 0x01, 0xA0, 0x4C, 0x3D, 0x46, 0x2A, 0xF2, 0x46, 0x4D,
+	 0x92, 0xFC, 0x10, 0x25, 0x12, 0x00, 0x09, 0xE1, 0xA1, 0xFF, 0x2D, 0x46, 0x0F, 0xF2, 0x01, 0x29,
+	 0x06, 0x00, 0x2A, 0xF0, 0x40, 0xFF, 0x64, 0x40, 0x40, 0x2B, 0x08, 0xBC, 0x02, 0xBC, 0x0F, 0xFA,
+	 0x08, 0x25, 0xDD, 0x01, 0xCB, 0xFE, 0x5C, 0x5D, 0xDB, 0x01, 0x44, 0xFF, 0x31, 0xF2, 0x1D, 0x60,
+	 0xC0, 0x65, 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD3, 0x66, 0x41, 0x60, 0x46, 0x60, 0x43,
+	 0x05, 0xF2, 0x16, 0x18, 0x61, 0x46, 0x31, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x04, 0xF2, 0x0C, 0x02,
+	 0x61, 0x46, 0x30, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x03, 0xF2, 0x06, 0x02, 0x61, 0x46, 0x2F, 0xF0,
+	 0x63, 0x46, 0xD0, 0x80, 0xFF, 0xFF, 0x07, 0x03, 0x80, 0xF4, 0xFF, 0xFF, 0x63, 0x46, 0xE8, 0x1B,
+	 0xA6, 0xF3, 0x08, 0xFE, 0x60, 0x43, 0x61, 0x46, 0x07, 0xFC, 0x3F, 0xF2, 0x09, 0x60, 0xB0, 0x65,
+	 0xD4, 0x80, 0x2A, 0xF2, 0xC0, 0x05, 0x08, 0x25, 0xAA, 0x01, 0x5C, 0x4B, 0x0C, 0x60, 0xEA, 0x61,
+	 0xA1, 0xDF, 0x2D, 0x46, 0x3B, 0xF2, 0xA6, 0xF1, 0x87, 0xF4, 0x60, 0x40, 0x20, 0x2B, 0xC1, 0x00,
+	 0xD3, 0x80, 0x2C, 0xF0, 0xB0, 0x03, 0x07, 0xF4, 0x64, 0x40, 0x01, 0x26, 0xA6, 0xF5, 0xBA, 0xF4,
+	 0x2D, 0x46, 0x04, 0x64, 0x04, 0xB3, 0x22, 0xF0, 0x03, 0x03, 0xC5, 0x60, 0xE2, 0x78, 0xFF, 0xFF,
+	 0x10, 0x64, 0xB0, 0x9C, 0x3B, 0xF2, 0x22, 0xF8, 0x60, 0x47, 0xC0, 0xB7, 0x02, 0xFE, 0xF0, 0x84,
+	 0xF0, 0x84, 0xF0, 0x84, 0x00, 0xA8, 0x40, 0x4A, 0x17, 0x03, 0xE0, 0x81, 0x61, 0x43, 0x42, 0xFE,
+	 0x00, 0x64, 0xF0, 0x84, 0xFE, 0x1F, 0x40, 0x4A, 0xE1, 0x84, 0xE0, 0x84, 0x2D, 0x46, 0x07, 0xF4,
+	 0xE0, 0x81, 0x3B, 0xF0, 0x2A, 0x47, 0x0C, 0x60, 0x38, 0x63, 0xA0, 0x84, 0x47, 0x9C, 0x10, 0x03,
+	 0x7C, 0x44, 0x00, 0x60, 0xB2, 0x63, 0x1C, 0x00, 0x07, 0xF4, 0x3B, 0xF0, 0x66, 0x44, 0x64, 0x40,
+	 0x80, 0x2B, 0x06, 0x00, 0x00, 0x60, 0x78, 0x7C, 0x00, 0x60, 0xA2, 0x63, 0x43, 0x4C, 0x10, 0x00,
+	 0x2D, 0x46, 0xC5, 0x60, 0xD5, 0x78, 0xFF, 0xFF, 0x2D, 0x46, 0x22, 0xF2, 0x10, 0x60, 0x00, 0x7C,
+	 0xB0, 0x84, 0x22, 0xFA, 0x32, 0x40, 0x04, 0x26, 0x25, 0x00, 0xC5, 0x60, 0xD5, 0x78, 0xFF, 0xFF,
+	 0xED, 0xFB, 0xEE, 0xF9, 0xEF, 0xFD, 0xAD, 0x46, 0x3D, 0xF2, 0xAD, 0x46, 0xA3, 0xD0, 0xAD, 0x46,
+	 0xD0, 0x80, 0x3C, 0xF2, 0xAD, 0x46, 0x02, 0x03, 0x15, 0x07, 0xE6, 0x04, 0x5B, 0xD0, 0xAD, 0x46,
+	 0xD0, 0x80, 0x3A, 0xF2, 0x03, 0x03, 0xAD, 0x46, 0x0D, 0x07, 0xDE, 0x04, 0x3A, 0xF0, 0xAD, 0x46,
+	 0x5B, 0xD0, 0x64, 0x44, 0xD0, 0x80, 0x2B, 0x44, 0x05, 0x07, 0xD6, 0x03, 0xD0, 0x84, 0x10, 0xA4,
+	 0xFF, 0xFF, 0x00, 0x07, 0xEE, 0xF3, 0xED, 0xF5, 0xFE, 0xA4, 0x0F, 0x60, 0xBE, 0x61, 0x0E, 0x63,
+	 0x58, 0xD0, 0x59, 0xD9, 0xFD, 0x1F, 0x2D, 0x46, 0x8B, 0xFF, 0x2D, 0x46, 0x22, 0xF2, 0x20, 0x60,
+	 0x00, 0x7C, 0xB0, 0x84, 0x22, 0xFA, 0x0F, 0x60, 0xB0, 0x64, 0xC9, 0x60, 0x58, 0x4F, 0x56, 0x78,
+	 0xFF, 0xFF, 0x3F, 0xF2, 0x00, 0x60, 0x18, 0x70, 0x18, 0x71, 0x20, 0x72, 0x60, 0x53, 0x88, 0x75,
+	 0x00, 0xF2, 0x09, 0xE1, 0x60, 0x50, 0x12, 0x71, 0x6E, 0x72, 0x83, 0x75, 0xA1, 0xFF, 0xFF, 0xFF,
+	 0x08, 0x25, 0x1D, 0x00, 0x40, 0xFF, 0x02, 0xE1, 0xA1, 0xFF, 0xFF, 0xFF, 0x75, 0x40, 0x03, 0x2A,
+	 0x03, 0x00, 0x80, 0x75, 0x0A, 0x64, 0x0B, 0x00, 0x80, 0x75, 0x1B, 0xF3, 0x8B, 0xFF, 0x02, 0x60,
+	 0x00, 0x75, 0xFF, 0xFF, 0x02, 0x60, 0x00, 0x75, 0xDC, 0x84, 0xA2, 0xDB, 0x02, 0x64, 0x98, 0xFF,
+	 0x2D, 0x46, 0x0F, 0xF0, 0xFF, 0xFF, 0xB0, 0x84, 0xA2, 0xDA, 0x88, 0xFF, 0x0B, 0x01, 0x8B, 0xFF,
+	 0x02, 0x60, 0x00, 0x75, 0xFF, 0xFF, 0x02, 0x60, 0x00, 0x75, 0x88, 0xFF, 0xC5, 0x60, 0xBB, 0x78,
+	 0xFF, 0xFF, 0x22, 0xF0, 0x22, 0x64, 0xB0, 0x84, 0x22, 0xFA, 0x3A, 0xF0, 0xFF, 0xFF, 0x64, 0x44,
+	 0xE0, 0x7F, 0xA0, 0x5B, 0x64, 0x47, 0xE1, 0x7F, 0x5A, 0xD0, 0xA0, 0x5B, 0x64, 0x44, 0xE2, 0x7F,
+	 0xA0, 0x5B, 0x64, 0x47, 0x7C, 0x5F, 0xE8, 0x84, 0xE8, 0x85, 0x0D, 0x60, 0x00, 0x64, 0x44, 0xD3,
+	 0x5A, 0xD1, 0x03, 0x1B, 0xC5, 0x60, 0xD5, 0x78, 0xFF, 0xFF, 0x60, 0x45, 0x64, 0x44, 0xE3, 0x7F,
+	 0xA0, 0x5B, 0x64, 0x47, 0xE4, 0x7F, 0x5A, 0xD1, 0xA0, 0x5B, 0x64, 0x44, 0xE5, 0x7F, 0xA0, 0x5B,
+	 0x64, 0x47, 0xE6, 0x7F, 0x5A, 0xD1, 0xA0, 0x5B, 0x64, 0x44, 0xE7, 0x7F, 0xA0, 0x5B, 0x65, 0x40,
+	 0x0D, 0x3A, 0x1C, 0x00, 0x64, 0x47, 0xE8, 0x7F, 0x5A, 0xD1, 0xA0, 0x5B, 0x64, 0x44, 0xE9, 0x7F,
+	 0xA0, 0x5B, 0x64, 0x47, 0xEA, 0x7F, 0x5A, 0xD1, 0xA0, 0x5B, 0x64, 0x44, 0xEB, 0x7F, 0xA0, 0x5B,
+	 0x64, 0x47, 0xEC, 0x7F, 0x5A, 0xD1, 0xA0, 0x5B, 0x64, 0x44, 0xED, 0x7F, 0xA0, 0x5B, 0x64, 0x47,
+	 0xEE, 0x7F, 0x5A, 0xD1, 0xA0, 0x5B, 0x64, 0x44, 0xEF, 0x7F, 0xA0, 0x5B, 0x65, 0x44, 0xD8, 0x84,
+	 0x08, 0x25, 0x25, 0x00, 0x60, 0x7F, 0xA0, 0x5B, 0x80, 0x60, 0x00, 0xEB, 0xA0, 0x60, 0x00, 0xEB,
+	 0xD1, 0x60, 0x00, 0xEB, 0x22, 0xF2, 0x20, 0x60, 0x00, 0x7C, 0xB0, 0x84, 0x22, 0xFA, 0x3F, 0xF2,
+	 0x3B, 0xF0, 0x60, 0x43, 0xFC, 0xA4, 0x64, 0x40, 0x20, 0x2B, 0x04, 0x00, 0x08, 0xA4, 0x3F, 0xFA,
+	 0x08, 0xA3, 0xF8, 0xA3, 0x3F, 0xFA, 0x0A, 0xE1, 0xB3, 0xFF, 0x9A, 0xFF, 0xCB, 0x83, 0x00, 0xF4,
+	 0x10, 0x62, 0x6C, 0x61, 0x0E, 0xA3, 0xAB, 0x84, 0xF2, 0xA3, 0xA1, 0xFF, 0x09, 0x00, 0xDA, 0x00,
+	 0x00, 0xF4, 0x81, 0xF2, 0xFC, 0x18, 0x02, 0x62, 0xC9, 0x81, 0xAB, 0x84, 0x01, 0x00, 0xA2, 0xDC,
+	 0x7A, 0xD4, 0xFD, 0x1C, 0xA2, 0xDC, 0x08, 0x25, 0xCE, 0x00, 0xF2, 0x1D, 0x41, 0x44, 0x7C, 0xA8,
+	 0xD9, 0x81, 0xEE, 0x03, 0xFF, 0xB1, 0x98, 0xFF, 0x09, 0xE1, 0xA1, 0xFF, 0xFF, 0xFF, 0x64, 0x40,
+	 0x20, 0x27, 0x04, 0x00, 0x08, 0x25, 0xBF, 0x00, 0x7B, 0x1E, 0x6F, 0x00, 0x08, 0x25, 0xBB, 0x00,
+	 0x40, 0xFF, 0x42, 0x42, 0x46, 0x43, 0x06, 0x1E, 0x04, 0x02, 0x00, 0xF4, 0x02, 0x62, 0x42, 0x42,
+	 0x46, 0x43, 0x01, 0xA2, 0x63, 0x45, 0x01, 0xA2, 0x62, 0x43, 0x46, 0x4C, 0xC6, 0x60, 0x58, 0x4F,
+	 0x87, 0x78, 0xFF, 0xFF, 0x0A, 0xE1, 0x9A, 0xFF, 0x2D, 0x46, 0x12, 0xF2, 0x3B, 0xF0, 0x33, 0x1B,
+	 0x64, 0x40, 0x20, 0x2B, 0x38, 0x00, 0x2D, 0x5C, 0x24, 0x41, 0x02, 0xA1, 0x65, 0x43, 0x08, 0xA3,
+	 0x23, 0x46, 0x22, 0x42, 0x7E, 0x3A, 0x0A, 0x00, 0x00, 0xF4, 0x81, 0xF2, 0xB8, 0x18, 0x02, 0x62,
+	 0xC9, 0x81, 0xAB, 0x84, 0x03, 0x00, 0xA2, 0xDC, 0x7E, 0x36, 0xF6, 0x01, 0x15, 0x11, 0x7A, 0xD4,
+	 0xFF, 0xFF, 0xF9, 0x1C, 0xA2, 0xDC, 0xF0, 0x1D, 0xD9, 0x81, 0xFF, 0xB1, 0x41, 0x1E, 0x62, 0x40,
+	 0x7E, 0x3A, 0x02, 0x00, 0x00, 0xF4, 0x02, 0x62, 0x07, 0x11, 0x5A, 0xD2, 0x89, 0xFF, 0x80, 0x4F,
+	 0x6F, 0x44, 0xA2, 0xDA, 0x88, 0xFF, 0x34, 0x00, 0x62, 0x45, 0x33, 0xF3, 0xFF, 0xFF, 0x03, 0x1B,
+	 0x65, 0x42, 0xE5, 0x1D, 0xF2, 0x01, 0x98, 0xFF, 0x2D, 0x46, 0x01, 0x64, 0x12, 0xFA, 0x0F, 0xF0,
+	 0x0A, 0x64, 0xB0, 0x84, 0x41, 0x00, 0x24, 0x41, 0x02, 0xA1, 0x65, 0x43, 0x08, 0xA3, 0x23, 0x46,
+	 0x22, 0x42, 0x7E, 0x3A, 0x0A, 0x00, 0x00, 0xF4, 0x81, 0xF2, 0x5C, 0x18, 0x02, 0x62, 0xC9, 0x81,
+	 0xAB, 0x84, 0x03, 0x00, 0xA2, 0xDC, 0x7E, 0x36, 0xF6, 0x01, 0x7A, 0xD4, 0xFF, 0xFF, 0xFA, 0x1C,
+	 0xA2, 0xDC, 0xF1, 0x1D, 0xD9, 0x81, 0xFF, 0xB1, 0x0B, 0x1E, 0x62, 0x40, 0x7E, 0x3A, 0x02, 0x00,
+	 0x00, 0xF4, 0x02, 0x62, 0x5A, 0xD2, 0x89, 0xFF, 0x80, 0x4F, 0x6F, 0x44, 0xA2, 0xDA, 0x88, 0xFF,
+	 0x98, 0xFF, 0x2D, 0x46, 0x0F, 0xF0, 0x0A, 0x64, 0xB0, 0x84, 0x16, 0x14, 0xF7, 0xB4, 0xA2, 0xDA,
+	 0x06, 0x60, 0x75, 0xF3, 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x2A, 0x0B, 0x00, 0xF0, 0xF5, 0xEF, 0xF4,
+	 0x0C, 0x60, 0xEA, 0x61, 0x59, 0xD1, 0x3B, 0xF8, 0x05, 0x64, 0x59, 0xD1, 0xCC, 0x84, 0xBD, 0xD8,
+	 0xFC, 0x02, 0xC3, 0x60, 0x6A, 0x78, 0xFF, 0xFF, 0xA2, 0xDA, 0x2D, 0x46, 0x3B, 0xF0, 0xFF, 0xFF,
+	 0x64, 0x40, 0x20, 0x2B, 0x1C, 0x00, 0x07, 0xF4, 0xBB, 0xF0, 0x2A, 0x44, 0xA4, 0x84, 0xFF, 0xFF,
+	 0x2F, 0x26, 0x15, 0x00, 0x2D, 0x46, 0x64, 0x44, 0x3A, 0xF0, 0xBC, 0xF0, 0x64, 0x5F, 0x3D, 0xF0,
+	 0x07, 0xF4, 0xEF, 0xF4, 0xFF, 0xFF, 0x08, 0xA3, 0x5B, 0xD8, 0x65, 0x5C, 0x5B, 0xD8, 0x5B, 0xDA,
+	 0x2D, 0x46, 0xED, 0xF3, 0x3C, 0xFA, 0xEE, 0xF3, 0x3D, 0xFA, 0x2A, 0x44, 0x23, 0xFA, 0xC3, 0x60,
+	 0x6A, 0x78, 0xFF, 0xFF, 0xFF, 0xFF, 0x98, 0xFF, 0x43, 0xFF, 0x40, 0xFF, 0xB0, 0xFF, 0xB1, 0xFF,
+	 0x2D, 0x46, 0x0C, 0x60, 0xEA, 0x61, 0xA1, 0xD3, 0x2D, 0x46, 0x60, 0x40, 0x01, 0x2A, 0x0A, 0x00,
+	 0xF0, 0xF5, 0xEF, 0xF4, 0x59, 0xD1, 0x3B, 0xF8, 0x05, 0x64, 0x59, 0xD1, 0xCC, 0x84, 0xBD, 0xD8,
+	 0xFC, 0x02, 0x2D, 0x46, 0xC3, 0x60, 0x48, 0x78, 0xFF, 0xFF, 0x98, 0xFF, 0x09, 0xE1, 0xA1, 0xFF,
+	 0x2D, 0x46, 0x08, 0x25, 0xE0, 0x01, 0x0F, 0xF2, 0x40, 0xFF, 0x02, 0xBC, 0xA2, 0xDA, 0xC3, 0x60,
+	 0x6A, 0x78, 0xFF, 0xFF, 0xB0, 0x84, 0x22, 0xFA, 0xA0, 0x60, 0x00, 0xEB, 0xB0, 0x60, 0x00, 0xEB,
+	 0x00, 0x63, 0x3B, 0xF2, 0x06, 0x60, 0x75, 0xFD, 0x60, 0x47, 0xC0, 0xB7, 0x02, 0xFE, 0xF0, 0x84,
+	 0xF0, 0x84, 0xF0, 0x84, 0x00, 0xA8, 0x40, 0x4A, 0x16, 0x03, 0xE0, 0x81, 0x61, 0x43, 0x42, 0xFE,
+	 0x00, 0x64, 0xF0, 0x84, 0xFE, 0x1F, 0x40, 0x4A, 0xE1, 0x84, 0xE0, 0x84, 0x2D, 0x46, 0x07, 0xF4,
+	 0xE0, 0x81, 0x3B, 0xF0, 0x2A, 0x47, 0x0C, 0x60, 0x38, 0x63, 0xA0, 0x84, 0x47, 0x9C, 0x10, 0x03,
+	 0x7C, 0x44, 0xA8, 0x63, 0x0F, 0x00, 0x07, 0xF4, 0x20, 0x64, 0x40, 0x4A, 0x3B, 0xF0, 0x66, 0x44,
+	 0x64, 0x40, 0x80, 0x2B, 0x05, 0x00, 0x00, 0x60, 0x78, 0x7C, 0x00, 0x60, 0x98, 0x63, 0x02, 0x00,
+	 0x2D, 0x46, 0xBB, 0x01, 0x2D, 0x46, 0xED, 0xFB, 0xEE, 0xF9, 0xEF, 0xFD, 0x07, 0xF2, 0xF0, 0xFB,
+	 0x60, 0x46, 0x3B, 0xF0, 0x2A, 0x44, 0x06, 0x60, 0x76, 0xF9, 0x5C, 0x4B, 0xA0, 0x84, 0xFF, 0xFF,
+	 0x3F, 0x22, 0x05, 0x00, 0x90, 0x84, 0x3B, 0xFA, 0x01, 0x64, 0x40, 0x4B, 0x2C, 0x00, 0xAD, 0x46,
+	 0x0A, 0xA3, 0x3D, 0xF2, 0xAD, 0x46, 0xA3, 0xD0, 0xAD, 0x46, 0xD0, 0x80, 0x3C, 0xF2, 0xAD, 0x46,
+	 0x02, 0x03, 0x21, 0x07, 0x14, 0x04, 0x5B, 0xD0, 0xAD, 0x46, 0xD0, 0x80, 0x3B, 0xF2, 0x03, 0x03,
+	 0xAD, 0x46, 0x19, 0x07, 0x0C, 0x04, 0x3A, 0xF0, 0xAD, 0x46, 0x5B, 0xD0, 0x64, 0x5F, 0xD0, 0x80,
+	 0x2B, 0x44, 0x22, 0x07, 0x04, 0x03, 0xD0, 0x84, 0x10, 0xA4, 0xFF, 0xFF, 0x1D, 0x07, 0x2D, 0x46,
+	 0x22, 0xF2, 0x10, 0x60, 0x00, 0x7C, 0xB0, 0x84, 0x22, 0xFA, 0x32, 0x40, 0x04, 0x26, 0x14, 0x00,
+	 0xC5, 0x60, 0xD5, 0x78, 0xFF, 0xFF, 0x01, 0x64, 0x06, 0x60, 0x75, 0xFB, 0x2D, 0x46, 0x0C, 0x60,
+	 0xFA, 0x62, 0x80, 0xFF, 0x78, 0x44, 0x03, 0xA4, 0xA2, 0xDB, 0xC6, 0x60, 0xBC, 0x78, 0xFF, 0xFF,
+	 0x85, 0xFF, 0x2D, 0x46, 0x08, 0x25, 0x4F, 0x01, 0x2D, 0x46, 0x0C, 0x60, 0xFA, 0x62, 0x80, 0xFF,
+	 0x78, 0x44, 0x03, 0xA4, 0xA2, 0xDB, 0xC7, 0x60, 0x44, 0x78, 0xFF, 0xFF, 0x85, 0xFF, 0x2D, 0x46,
+	 0x08, 0x25, 0x41, 0x01, 0x00, 0x60, 0x0F, 0x64, 0x08, 0x25, 0x3C, 0x01, 0x60, 0x7F, 0xA0, 0x5B,
+	 0x80, 0x60, 0x00, 0xEB, 0xD3, 0x60, 0x00, 0xEB, 0xC4, 0x60, 0xC2, 0x78, 0xFF, 0xFF, 0x2D, 0x46,
+	 0x3B, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x20, 0x2B, 0x23, 0x00, 0x08, 0x61, 0x23, 0x11, 0x2D, 0x46,
+	 0x00, 0xF4, 0x0A, 0x62, 0x56, 0x92, 0x5A, 0xD0, 0x2C, 0x46, 0x64, 0x47, 0x63, 0x40, 0x7F, 0x2A,
+	 0x03, 0x00, 0x00, 0xF4, 0x03, 0x63, 0x46, 0x4C, 0x60, 0xFE, 0xDE, 0xD8, 0x7F, 0x3A, 0x03, 0x00,
+	 0x00, 0xF4, 0x03, 0x63, 0x46, 0x4C, 0xDE, 0xDA, 0xFE, 0xA1, 0x20, 0xFE, 0xE7, 0x02, 0x63, 0x41,
+	 0xFD, 0xA1, 0x46, 0x4C, 0x01, 0xF2, 0x2D, 0x46, 0x61, 0x5E, 0x16, 0xFA, 0x2C, 0x44, 0x06, 0xFA,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x2D, 0x5C, 0x3D, 0x44, 0x00, 0xA8, 0xD0, 0x80, 0xD8, 0x03, 0xD7, 0x03,
+	 0x2D, 0x46, 0x01, 0x64, 0x12, 0xFA, 0xF4, 0x01, 0x07, 0xF4, 0x66, 0x41, 0x03, 0xF2, 0x04, 0xF2,
+	 0x40, 0x42, 0x05, 0xF2, 0x40, 0x43, 0x40, 0x44, 0x61, 0x46, 0x3C, 0xF2, 0x3D, 0xF2, 0x40, 0x40,
+	 0x40, 0x41, 0x0D, 0x60, 0x70, 0x65, 0x00, 0x61, 0xEE, 0xF1, 0xED, 0xF5, 0x44, 0x4C, 0x2C, 0x5C,
+	 0xE9, 0x80, 0x00, 0x64, 0xF0, 0x84, 0xF0, 0x84, 0xC0, 0x83, 0xBD, 0xD2, 0x24, 0x5C, 0x90, 0x9C,
+	 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1,
+	 0x64, 0x47, 0x90, 0x9C, 0x20, 0x44, 0x40, 0x80, 0xDB, 0x83, 0xBD, 0xD2, 0x20, 0x5C, 0x90, 0x9C,
+	 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1,
+	 0x64, 0x47, 0x90, 0x9C, 0x21, 0x44, 0x40, 0x81, 0xDB, 0x83, 0xBD, 0xD2, 0x21, 0x5C, 0x90, 0x9C,
+	 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1,
+	 0x64, 0x47, 0x90, 0x9C, 0x22, 0x44, 0x40, 0x82, 0xDB, 0x83, 0xBD, 0xD2, 0x22, 0x5C, 0x90, 0x9C,
+	 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1,
+	 0x64, 0x47, 0x90, 0x9C, 0x23, 0x44, 0x40, 0x83, 0xF2, 0xA3, 0xBD, 0xD2, 0x23, 0x5C, 0x90, 0x9C,
+	 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1,
+	 0x64, 0x47, 0x90, 0x9C, 0x24, 0x44, 0xC0, 0x9C, 0x41, 0x84, 0xDD, 0x81, 0x08, 0x2A, 0xA7, 0x01,
+	 0x0C, 0x60, 0xEC, 0x61, 0x05, 0x64, 0xEF, 0xF4, 0xF0, 0xF5, 0xFE, 0xA3, 0x5B, 0xD0, 0xCC, 0x84,
+	 0x59, 0xD9, 0xFC, 0x02, 0xEF, 0xF3, 0xF0, 0xF5, 0x60, 0x42, 0x20, 0x44, 0xA2, 0xDA, 0x21, 0x44,
+	 0x5A, 0xDA, 0x22, 0x44, 0x5A, 0xDA, 0x23, 0x44, 0x5A, 0xDA, 0x24, 0x44, 0x5A, 0xDA, 0x61, 0x46,
+	 0x06, 0x60, 0x7D, 0xF7, 0xFF, 0xFF, 0xFF, 0xFF, 0x66, 0x41, 0xEF, 0xF3, 0xF0, 0xF5, 0xA0, 0xD2,
+	 0x5A, 0xD0, 0x40, 0x40, 0x44, 0x41, 0x5A, 0xD2, 0x5A, 0xD0, 0x40, 0x42, 0x5A, 0xD0, 0x44, 0x43,
+	 0x61, 0x46, 0xBA, 0xF0, 0x3B, 0xF2, 0x44, 0x44, 0x65, 0x5F, 0x40, 0x85, 0xEE, 0xF4, 0xED, 0xF5,
+	 0x43, 0x4C, 0x0D, 0x60, 0x70, 0x65, 0xBD, 0xD2, 0x25, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F,
+	 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C,
+	 0x20, 0x44, 0x40, 0x80, 0xBD, 0xD2, 0x20, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84,
+	 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C, 0x21, 0x44,
+	 0x40, 0x81, 0xBD, 0xD2, 0x21, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1,
+	 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C, 0x22, 0x44, 0x40, 0x82,
+	 0xBD, 0xD2, 0x22, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44,
+	 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C, 0x23, 0x44, 0x40, 0x83, 0xBD, 0xD2,
+	 0x23, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F,
+	 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C, 0x24, 0x44, 0x40, 0x84, 0xBD, 0xD2, 0x24, 0x5C,
+	 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84,
+	 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C, 0x25, 0x44, 0x40, 0x85, 0x61, 0x46, 0x3A, 0xF0, 0xFF, 0xFF,
+	 0x64, 0x44, 0xE0, 0x7F, 0xA0, 0x5B, 0x64, 0x47, 0xE1, 0x7F, 0x5A, 0xD0, 0xA0, 0x5B, 0x64, 0x44,
+	 0xE2, 0x7F, 0xA0, 0x5B, 0x64, 0x47, 0xED, 0xF5, 0xBD, 0xD2, 0x25, 0x5C, 0x90, 0x84, 0xE8, 0x80,
+	 0xF8, 0x84, 0x20, 0x5C, 0x40, 0x80, 0x20, 0x44, 0xE4, 0x7F, 0xA0, 0x5B, 0x20, 0x47, 0xE5, 0x7F,
+	 0xA0, 0x5B, 0xBD, 0xD2, 0x20, 0x5C, 0x90, 0x84, 0xE8, 0x80, 0xF8, 0x84, 0x21, 0x5C, 0x40, 0x81,
+	 0x21, 0x44, 0xE6, 0x7F, 0xA0, 0x5B, 0x21, 0x47, 0xE7, 0x7F, 0xA0, 0x5B, 0x21, 0x44, 0xE8, 0x80,
+	 0xF8, 0x84, 0x22, 0x5C, 0x40, 0x82, 0x22, 0x44, 0xE8, 0x7F, 0xA0, 0x5B, 0x22, 0x47, 0xE9, 0x7F,
+	 0xA0, 0x5B, 0x22, 0x44, 0xE8, 0x80, 0xF8, 0x84, 0x23, 0x5C, 0x40, 0x83, 0x23, 0x44, 0xEA, 0x7F,
+	 0xA0, 0x5B, 0x23, 0x47, 0xEB, 0x7F, 0xA0, 0x5B, 0x23, 0x44, 0xE8, 0x80, 0xF8, 0x84, 0x24, 0x5C,
+	 0x40, 0x84, 0x24, 0x44, 0xEC, 0x7F, 0xA0, 0x5B, 0x24, 0x47, 0xED, 0x7F, 0xA0, 0x5B, 0x24, 0x44,
+	 0xE8, 0x80, 0xF8, 0x84, 0x25, 0x5C, 0x40, 0x85, 0x25, 0x44, 0xEE, 0x7F, 0xA0, 0x5B, 0x25, 0x47,
+	 0xEF, 0x7F, 0xA0, 0x5B, 0x2C, 0x43, 0xA3, 0xD2, 0x25, 0x5C, 0x90, 0x81, 0xE9, 0x84, 0xE3, 0x7F,
+	 0xA0, 0x5B, 0x06, 0x60, 0x7D, 0xF7, 0xFF, 0xFF, 0xFF, 0xFF, 0xEA, 0xF3, 0x5A, 0xD3, 0x40, 0x48,
+	 0x5A, 0xD3, 0x40, 0x49, 0x40, 0x4A, 0x00, 0x60, 0x78, 0x7C, 0x44, 0x4D, 0x49, 0xF2, 0x4A, 0xF2,
+	 0x40, 0x47, 0x40, 0x46, 0x0D, 0x60, 0x70, 0x65, 0x00, 0x61, 0x2D, 0x5C, 0xE9, 0x80, 0x00, 0x64,
+	 0xF0, 0x84, 0xF0, 0x84, 0xC0, 0x83, 0xBD, 0xD2, 0x2A, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F,
+	 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C,
+	 0x26, 0x44, 0x40, 0x86, 0xDB, 0x83, 0xBD, 0xD2, 0x26, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F,
+	 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C,
+	 0x27, 0x44, 0x40, 0x87, 0xDB, 0x83, 0xBD, 0xD2, 0x27, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F,
+	 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C,
+	 0x28, 0x44, 0x40, 0x88, 0xDB, 0x83, 0xBD, 0xD2, 0x28, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F,
+	 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C,
+	 0x29, 0x44, 0x40, 0x89, 0xF2, 0xA3, 0xBD, 0xD2, 0x29, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F,
+	 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C,
+	 0x2A, 0x44, 0xC0, 0x9C, 0x41, 0x8A, 0xDD, 0x81, 0x08, 0x2A, 0xA7, 0x01, 0x26, 0x44, 0x44, 0xFA,
+	 0x27, 0x44, 0x45, 0xFA, 0x28, 0x44, 0x46, 0xFA, 0x29, 0x44, 0x47, 0xFA, 0x2A, 0x44, 0x48, 0xFA,
+	 0x06, 0x60, 0x7E, 0xF7, 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x60, 0x88, 0x7C, 0x44, 0x4D, 0x2D, 0x42,
+	 0xA2, 0xD2, 0x5A, 0xD0, 0x40, 0x46, 0x44, 0x47, 0x5A, 0xD2, 0x5A, 0xD0, 0x40, 0x48, 0x5A, 0xD0,
+	 0x44, 0x49, 0x4B, 0xF2, 0x44, 0x4A, 0x40, 0x8B, 0x60, 0x5C, 0x64, 0x47, 0xE0, 0x7F, 0xA0, 0x5A,
+	 0xFF, 0xB4, 0x20, 0xBC, 0x7F, 0xB4, 0xE1, 0x7F, 0xA0, 0x5A, 0x64, 0x44, 0xE2, 0x7F, 0xA0, 0x5A,
+	 0x00, 0x60, 0x78, 0x63, 0x0D, 0x60, 0x70, 0x65, 0xBD, 0xD2, 0x2B, 0x5C, 0x90, 0x9C, 0x64, 0x47,
+	 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47,
+	 0x90, 0x9C, 0x26, 0x44, 0x40, 0x86, 0xBD, 0xD2, 0x26, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F,
+	 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C,
+	 0x27, 0x44, 0x40, 0x87, 0xBD, 0xD2, 0x27, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84,
+	 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C, 0x28, 0x44,
+	 0x40, 0x88, 0xBD, 0xD2, 0x28, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1,
+	 0x64, 0x44, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C, 0x29, 0x44, 0x40, 0x89,
+	 0xBD, 0xD2, 0x29, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44,
+	 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C, 0x2A, 0x44, 0x40, 0x8A, 0xBD, 0xD2,
+	 0x2A, 0x5C, 0x90, 0x9C, 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x44, 0x00, 0x7F,
+	 0xE0, 0x84, 0x44, 0xD1, 0x64, 0x47, 0x90, 0x9C, 0x2B, 0x44, 0x40, 0x8B, 0xBD, 0xD2, 0x2B, 0x5C,
+	 0x90, 0x84, 0xE8, 0x80, 0xF8, 0x84, 0x26, 0x5C, 0x40, 0x86, 0x26, 0x44, 0xE4, 0x7F, 0xA0, 0x5A,
+	 0x26, 0x47, 0xE5, 0x7F, 0xA0, 0x5A, 0xBD, 0xD2, 0x26, 0x5C, 0x90, 0x84, 0xE8, 0x80, 0xF8, 0x84,
+	 0x27, 0x5C, 0x40, 0x87, 0x27, 0x44, 0xE6, 0x7F, 0xA0, 0x5A, 0x27, 0x47, 0xE7, 0x7F, 0xA0, 0x5A,
+	 0x27, 0x44, 0xE8, 0x80, 0xF8, 0x84, 0x28, 0x5C, 0x40, 0x88, 0x28, 0x44, 0xE8, 0x7F, 0xA0, 0x5A,
+	 0x28, 0x47, 0xE9, 0x7F, 0xA0, 0x5A, 0x28, 0x44, 0xE8, 0x80, 0xF8, 0x84, 0x29, 0x5C, 0x40, 0x89,
+	 0x29, 0x44, 0xEA, 0x7F, 0xA0, 0x5A, 0x29, 0x47, 0xEB, 0x7F, 0xA0, 0x5A, 0x29, 0x44, 0xE8, 0x80,
+	 0xF8, 0x84, 0x2A, 0x5C, 0x40, 0x8A, 0x2A, 0x44, 0xEC, 0x7F, 0xA0, 0x5A, 0x2A, 0x47, 0xED, 0x7F,
+	 0xA0, 0x5A, 0x2A, 0x44, 0xE8, 0x80, 0xF8, 0x84, 0x2B, 0x5C, 0x40, 0x8B, 0x2B, 0x44, 0xEE, 0x7F,
+	 0xA0, 0x5A, 0x2B, 0x47, 0xEF, 0x7F, 0xA0, 0x5A, 0x3C, 0xF0, 0x2B, 0x44, 0x90, 0x84, 0xE8, 0x84,
+	 0xE3, 0x7F, 0xA0, 0x5A, 0x06, 0x60, 0x7E, 0xF7, 0xFF, 0xFF, 0xFF, 0xFF, 0x60, 0x45, 0x00, 0xF0,
+	 0x84, 0x60, 0x00, 0xE3, 0x04, 0x71, 0x64, 0x50, 0x01, 0x2A, 0x04, 0x71, 0x5C, 0x61, 0x04, 0x63,
+	 0x59, 0xD0, 0x58, 0xD9, 0xFD, 0x1F, 0x3D, 0xF2, 0x60, 0x43, 0x60, 0x47, 0x5B, 0xDB, 0x3C, 0xF2,
+	 0xFF, 0xFF, 0x60, 0x47, 0x5B, 0xDB, 0x3A, 0xF2, 0xFF, 0xFF, 0x60, 0x47, 0x5B, 0xDB, 0x3F, 0xF2,
+	 0xFF, 0xFF, 0x60, 0x47, 0x5B, 0xDB, 0x81, 0x60, 0x18, 0xE3, 0x65, 0x43, 0xE3, 0x84, 0x60, 0x47,
+	 0x00, 0x7F, 0x60, 0x50, 0x7F, 0x64, 0x23, 0x94, 0x60, 0x51, 0x7C, 0x72, 0x04, 0x75, 0x0C, 0x60,
+	 0x16, 0x61, 0x16, 0x60, 0x00, 0x63, 0x59, 0xDD, 0x2A, 0xF2, 0x87, 0x60, 0x8F, 0x65, 0xA4, 0x87,
+	 0x40, 0xBF, 0x59, 0xDB, 0x56, 0x64, 0x0A, 0x63, 0x58, 0xD0, 0x59, 0xD9, 0xFD, 0x1F, 0x62, 0x64,
+	 0x04, 0x63, 0x58, 0xD0, 0x59, 0xD9, 0xFD, 0x1F, 0x35, 0xF2, 0x0F, 0x65, 0xA4, 0x9C, 0x59, 0xD9,
+	 0x06, 0x63, 0x59, 0xDF, 0xFE, 0x1F, 0x2A, 0xF2, 0xFF, 0xFF, 0x60, 0x45, 0x03, 0x2B, 0x05, 0x00,
+	 0x6A, 0x64, 0x04, 0x63, 0x58, 0xD0, 0x59, 0xD9, 0xFD, 0x1F, 0x65, 0x40, 0x8F, 0xB0, 0x88, 0x3A,
+	 0x02, 0x00, 0x39, 0xF0, 0x59, 0xD9, 0x2F, 0x58, 0xFF, 0xFF, 0x0C, 0x60, 0x16, 0x61, 0xA3, 0x46,
+	 0x00, 0xF4, 0x02, 0x64, 0x0A, 0x63, 0x58, 0xD0, 0x59, 0xD9, 0xFD, 0x1F, 0x59, 0xDF, 0x59, 0xDF,
+	 0xA0, 0x4C, 0x04, 0xBC, 0xFF, 0xB4, 0xA0, 0x51, 0x23, 0x44, 0x01, 0xA7, 0x80, 0xBF, 0x60, 0x50,
+	 0x80, 0x60, 0x38, 0x71, 0x80, 0x60, 0x7C, 0x72, 0x01, 0x76, 0xFF, 0xFF, 0x76, 0x44, 0x01, 0x3A,
+	 0xFD, 0x01, 0x40, 0x76, 0x40, 0x76, 0x42, 0xFF, 0xFF, 0xFF, 0x40, 0x76, 0x80, 0x60, 0x18, 0x70,
+	 0x80, 0x60, 0x18, 0x71, 0x80, 0x60, 0x7C, 0x72, 0x80, 0x60, 0x10, 0x73, 0x02, 0x76, 0x76, 0x44,
+	 0xFF, 0xFF, 0x76, 0x44, 0x02, 0x3A, 0xFD, 0x01, 0x40, 0x76, 0x42, 0xFF, 0x3C, 0x46, 0x00, 0xF2,
+	 0x80, 0x60, 0x00, 0xBC, 0x60, 0x50, 0x80, 0x60, 0x12, 0x71, 0x80, 0x60, 0x6E, 0x72, 0x3F, 0xF2,
+	 0xFF, 0xFF, 0xF8, 0xA7, 0x80, 0xBF, 0x60, 0x53, 0x04, 0x76, 0xFF, 0xFF, 0x88, 0xFF, 0x3C, 0x46,
+	 0x07, 0xF2, 0xFF, 0xFF, 0x40, 0x43, 0xA3, 0x46, 0x2F, 0x58, 0xFF, 0xFF, 0x77, 0x40, 0x8B, 0xFF,
+	 0xA0, 0x4B, 0x04, 0xE1, 0xFF, 0xFF, 0x76, 0x44, 0x04, 0x3A, 0xFD, 0x01, 0x40, 0x76, 0x42, 0xFF,
+	 0xFF, 0xFF, 0x10, 0x76, 0xFF, 0xFF, 0x76, 0x44, 0x20, 0x3A, 0xFD, 0x01, 0x40, 0x76, 0x42, 0xFF,
+	 0x63, 0x44, 0x00, 0x7F, 0xA0, 0x51, 0x02, 0x60, 0x00, 0x75, 0x88, 0xFF, 0xA0, 0x4C, 0xFB, 0xB4,
+	 0xA0, 0x51, 0x06, 0x60, 0x1F, 0xE1, 0x16, 0xFF, 0x2F, 0x58, 0xFF, 0xFF, 0x26, 0x46, 0x3F, 0xF2,
+	 0xFF, 0xFF, 0xF8, 0xA4, 0x3F, 0xFA, 0x00, 0xF4, 0x60, 0x47, 0x08, 0xFA, 0xA0, 0x48, 0x08, 0x26,
+	 0x07, 0x00, 0xA0, 0x4C, 0x04, 0xE1, 0xFF, 0xFF, 0xA1, 0xFF, 0xFF, 0xFF, 0x00, 0x7F, 0xA0, 0x51,
+	 0x42, 0xFF, 0x26, 0x46, 0x8B, 0xFF, 0x02, 0x60, 0x00, 0x75, 0x3C, 0xF2, 0x40, 0x76, 0x14, 0x1B,
+	 0x26, 0x46, 0x3B, 0xF2, 0x0C, 0x60, 0xBA, 0x63, 0x60, 0x47, 0xC0, 0xB4, 0xE8, 0x84, 0xE8, 0x84,
+	 0xE8, 0x84, 0x43, 0x93, 0xE3, 0x9C, 0x64, 0x47, 0x80, 0x7C, 0x64, 0x5F, 0x60, 0x50, 0x7F, 0x64,
+	 0x23, 0x97, 0x80, 0xBF, 0x60, 0x51, 0x07, 0x00, 0x01, 0xA7, 0x80, 0xBF, 0x60, 0x50, 0x80, 0x60,
+	 0x40, 0x71, 0x80, 0x60, 0x7C, 0x72, 0x01, 0x76, 0xFF, 0xFF, 0xA1, 0xFF, 0xFF, 0xFF, 0x0C, 0x21,
+	 0xFC, 0x01, 0x04, 0x25, 0xD5, 0x01, 0x40, 0x76, 0x43, 0xFF, 0x0C, 0x60, 0x22, 0x61, 0x26, 0x46,
+	 0x00, 0xF4, 0x02, 0x64, 0x0A, 0x63, 0x58, 0xD0, 0x59, 0xD9, 0xFD, 0x1F, 0x59, 0xDF, 0x59, 0xDF,
+	 0x80, 0x60, 0x18, 0x70, 0x80, 0x60, 0x24, 0x71, 0x80, 0x60, 0x7C, 0x72, 0x80, 0x60, 0x10, 0x73,
+	 0x02, 0x76, 0xFF, 0xFF, 0xA1, 0xFF, 0xFF, 0xFF, 0x0C, 0x21, 0xFC, 0x01, 0x04, 0x25, 0xB8, 0x01,
+	 0x40, 0x76, 0x43, 0xFF, 0x26, 0x46, 0x00, 0xF2, 0xFF, 0xFF, 0x60, 0x47, 0x80, 0xBF, 0x60, 0x50,
+	 0x80, 0x60, 0x12, 0x71, 0x3F, 0xF2, 0x80, 0x60, 0x6E, 0x72, 0x60, 0x47, 0x80, 0xBF, 0x60, 0x53,
+	 0x04, 0x76, 0xFF, 0xFF, 0xA1, 0xFF, 0xFF, 0xFF, 0x0C, 0x21, 0xFC, 0x01, 0x04, 0x25, 0xA0, 0x01,
+	 0x40, 0x76, 0x43, 0xFF, 0x08, 0x76, 0xFF, 0xFF, 0xA1, 0xFF, 0xFF, 0xFF, 0x0C, 0x21, 0xFC, 0x01,
+	 0x04, 0x25, 0x96, 0x01, 0x76, 0x5C, 0xFF, 0xFF, 0x40, 0x76, 0x43, 0xFF, 0x88, 0xFF, 0x26, 0x46,
+	 0x2F, 0x58, 0xFF, 0xFF, 0xEE, 0x60, 0x60, 0x78, 0xFF, 0xFF, 0x08, 0x60, 0x08, 0xF1, 0x80, 0x60,
+	 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x2F, 0x00, 0xDB, 0xF3, 0x31, 0x41, 0x01, 0xB1,
+	 0x03, 0xA8, 0x2A, 0x03, 0x15, 0x02, 0x20, 0x40, 0x04, 0x2B, 0x0B, 0x00, 0xBB, 0xFE, 0xCA, 0xFE,
+	 0x1C, 0x60, 0x92, 0x64, 0x13, 0x60, 0x22, 0xFB, 0x02, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF,
+	 0x07, 0x00, 0x08, 0x60, 0x09, 0xF1, 0x00, 0x60, 0x04, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE,
+	 0x08, 0x60, 0x1B, 0xF1, 0x00, 0x60, 0x80, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x0C, 0x00,
+	 0xA9, 0xFE, 0xDB, 0x05, 0xAB, 0xFE, 0x0C, 0x05, 0xA8, 0xFE, 0xCC, 0x05, 0xAA, 0xFE, 0xCD, 0x05,
+	 0x78, 0x43, 0x01, 0x61, 0x29, 0x60, 0xEA, 0x78, 0xA1, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x85, 0x3E,
+	 0x13, 0x60, 0x02, 0xF3, 0xFF, 0xFF, 0x00, 0xA8, 0x60, 0x46, 0x03, 0x02, 0xCA, 0x60, 0xD4, 0x78,
+	 0xFF, 0xFF, 0x26, 0x45, 0xD4, 0x80, 0x0F, 0xF0, 0xF9, 0x03, 0x64, 0x44, 0x70, 0xB0, 0x70, 0x2A,
+	 0x13, 0x00, 0x16, 0x60, 0x85, 0xF3, 0xFF, 0xFF, 0xDC, 0x84, 0x00, 0x36, 0x00, 0x3B, 0xA2, 0xDB,
+	 0xA2, 0xFF, 0xAC, 0xF3, 0xFF, 0xFF, 0xCC, 0x84, 0xFE, 0xA0, 0xAC, 0xFB, 0x01, 0x07, 0xD4, 0xFE,
+	 0xA3, 0xFF, 0xD0, 0x60, 0xB5, 0x78, 0xFF, 0xFF, 0x64, 0x40, 0x02, 0x26, 0x09, 0x00, 0x66, 0x45,
+	 0x09, 0xF4, 0x0F, 0xF2, 0x02, 0x18, 0x65, 0x46, 0xE4, 0x1B, 0x00, 0x64, 0x40, 0x46, 0xCC, 0x01,
+	 0xA2, 0xFF, 0xAC, 0xF3, 0x46, 0x46, 0xCC, 0x84, 0xFE, 0xA0, 0xAC, 0xFB, 0x01, 0x07, 0xD4, 0xFE,
+	 0xA3, 0xFF, 0x0F, 0xF0, 0xA3, 0xFC, 0x64, 0x44, 0x80, 0x26, 0x35, 0x00, 0x2C, 0x60, 0xEA, 0x64,
+	 0xF1, 0x60, 0x78, 0x41, 0xE4, 0x78, 0xB5, 0xF1, 0x32, 0x44, 0x01, 0x2A, 0x03, 0x00, 0x07, 0x60,
+	 0x01, 0x64, 0x22, 0x00, 0x02, 0x2A, 0x03, 0x00, 0x00, 0x60, 0x01, 0x64, 0x1D, 0x00, 0x04, 0x2A,
+	 0x1F, 0x00, 0x2A, 0xF2, 0xFF, 0xFF, 0x0C, 0xB0, 0x08, 0x3A, 0x1A, 0x00, 0x2C, 0xF0, 0x22, 0xF0,
+	 0x64, 0x40, 0x01, 0x26, 0x0B, 0x00, 0x64, 0x40, 0x40, 0x2B, 0x12, 0x00, 0x8F, 0xB0, 0x88, 0x3A,
+	 0x0F, 0x00, 0x39, 0xF2, 0xFF, 0xFF, 0x60, 0xB0, 0x20, 0x3A, 0x0A, 0x00, 0x23, 0xF2, 0x00, 0x60,
+	 0x01, 0x7C, 0xB0, 0x84, 0x23, 0xFA, 0x0C, 0x00, 0x23, 0xFA, 0xD0, 0x60, 0xC1, 0x78, 0xFF, 0xFF,
+	 0xD0, 0x60, 0xB5, 0x78, 0xFF, 0xFF, 0x22, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x10, 0x27, 0xF8, 0x01,
+	 0x0F, 0xF0, 0xFF, 0xFF, 0x64, 0x44, 0x08, 0x26, 0x64, 0x00, 0x2A, 0xF2, 0x60, 0x63, 0x60, 0x40,
+	 0x02, 0x2B, 0x66, 0x63, 0xBE, 0xD2, 0x81, 0xF1, 0xA3, 0xD2, 0xD0, 0x80, 0x80, 0xF1, 0x0D, 0x02,
+	 0xBF, 0xD2, 0xD0, 0x80, 0x7F, 0xF1, 0x09, 0x02, 0xD0, 0x80, 0xFF, 0xFF, 0x06, 0x02, 0x2C, 0x60,
+	 0xF6, 0x64, 0xF1, 0x60, 0x78, 0x41, 0xE4, 0x78, 0xB5, 0xF1, 0x32, 0x44, 0x01, 0x2A, 0x03, 0x00,
+	 0x07, 0x60, 0x02, 0x64, 0x04, 0x00, 0x02, 0x2A, 0x06, 0x00, 0x00, 0x60, 0x02, 0x64, 0x23, 0xFA,
+	 0xD0, 0x60, 0xC1, 0x78, 0xFF, 0xFF, 0x2A, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0xB0, 0x3A, 0x06, 0x00,
+	 0x00, 0x60, 0x02, 0x64, 0x23, 0xFA, 0xCC, 0x60, 0x31, 0x78, 0xFF, 0xFF, 0x32, 0x40, 0x04, 0x2A,
+	 0x2D, 0x00, 0x2A, 0xF2, 0xFF, 0xFF, 0x0C, 0xB0, 0x08, 0x3A, 0x28, 0x00, 0x2C, 0xF0, 0x22, 0xF0,
+	 0x64, 0x40, 0x01, 0x26, 0x0B, 0x00, 0x64, 0x40, 0x40, 0x2B, 0x20, 0x00, 0x8F, 0xB0, 0x88, 0x3A,
+	 0x1D, 0x00, 0x39, 0xF2, 0xFF, 0xFF, 0x60, 0xB0, 0x20, 0x3A, 0x18, 0x00, 0x2C, 0xF0, 0x66, 0x45,
+	 0x07, 0xF4, 0x64, 0x40, 0x01, 0x26, 0xA6, 0xF5, 0x3A, 0xF2, 0x65, 0x46, 0x60, 0x40, 0x00, 0x36,
+	 0x0D, 0x00, 0x22, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x10, 0x2A, 0x08, 0x00, 0x20, 0x2B, 0x06, 0x00,
+	 0x23, 0xF2, 0x00, 0x60, 0x02, 0x7C, 0xB0, 0x84, 0x23, 0xFA, 0x03, 0x00, 0xD0, 0x60, 0xB5, 0x78,
+	 0xFF, 0xFF, 0x32, 0x44, 0x01, 0x2A, 0x4A, 0x00, 0x2E, 0x60, 0x40, 0x63, 0xBF, 0xD3, 0x00, 0x65,
+	 0xB4, 0x81, 0xDB, 0x83, 0x3D, 0x03, 0xBF, 0xD3, 0xA3, 0xD3, 0x40, 0x48, 0xBE, 0xD3, 0x40, 0x4A,
+	 0x2E, 0xF0, 0x40, 0x4C, 0xD0, 0x80, 0x2D, 0xF0, 0x08, 0x02, 0x2A, 0x44, 0xD0, 0x80, 0x2C, 0xF0,
+	 0x04, 0x02, 0x28, 0x44, 0xD0, 0x80, 0xFF, 0xFF, 0x2B, 0x03, 0x31, 0xF0, 0x2C, 0x44, 0xD0, 0x80,
+	 0x30, 0xF0, 0x08, 0x02, 0x2A, 0x44, 0xD0, 0x80, 0x2F, 0xF0, 0x04, 0x02, 0x28, 0x44, 0xD0, 0x80,
+	 0xFF, 0xFF, 0x1E, 0x03, 0x34, 0xF0, 0x2C, 0x44, 0xD0, 0x80, 0x33, 0xF0, 0x08, 0x02, 0x2A, 0x44,
+	 0xD0, 0x80, 0x32, 0xF0, 0x04, 0x02, 0x28, 0x44, 0xD0, 0x80, 0xFF, 0xFF, 0x11, 0x03, 0x38, 0xF0,
+	 0x2C, 0x44, 0xD0, 0x80, 0x37, 0xF0, 0x08, 0x02, 0x2A, 0x44, 0xD0, 0x80, 0x36, 0xF0, 0x04, 0x02,
+	 0x28, 0x44, 0xD0, 0x80, 0xFF, 0xFF, 0x04, 0x03, 0xFA, 0xA1, 0x06, 0xA3, 0xB7, 0x03, 0xC3, 0x01,
+	 0x07, 0x60, 0x00, 0x64, 0x23, 0xFA, 0xD0, 0x60, 0xC1, 0x78, 0xFF, 0xFF, 0x2A, 0xF2, 0x0F, 0xF0,
+	 0x60, 0x45, 0xA4, 0x36, 0x08, 0x00, 0x0C, 0xB4, 0x04, 0x36, 0x02, 0x00, 0x0C, 0x3A, 0x06, 0x00,
+	 0xD0, 0x60, 0xB5, 0x78, 0xFF, 0xFF, 0xCE, 0x60, 0x7C, 0x78, 0xFF, 0xFF, 0x0F, 0xF0, 0x65, 0x40,
+	 0x40, 0x2B, 0x17, 0x00, 0x32, 0x40, 0x08, 0x26, 0x14, 0x00, 0x07, 0xF4, 0x3A, 0xF2, 0xFF, 0xFF,
+	 0x37, 0xB4, 0x26, 0x46, 0x0E, 0x02, 0x2C, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x26, 0x06, 0x00,
+	 0x2C, 0x60, 0xF0, 0x64, 0xF1, 0x60, 0x78, 0x41, 0xE4, 0x78, 0xB5, 0xF1, 0xD0, 0x60, 0xB5, 0x78,
+	 0xFF, 0xFF, 0x2A, 0xF2, 0x64, 0x40, 0x60, 0x26, 0x03, 0x00, 0xCE, 0x60, 0x4E, 0x78, 0xFF, 0xFF,
+	 0x60, 0x41, 0xA6, 0xF3, 0x07, 0xFA, 0x61, 0x44, 0x80, 0x3A, 0x02, 0x00, 0x2A, 0xF2, 0x12, 0x00,
+	 0x60, 0x40, 0x40, 0x3A, 0x0F, 0x00, 0xDB, 0xF3, 0xFF, 0xFF, 0x07, 0xB4, 0x03, 0x3A, 0xE6, 0x01,
+	 0xD1, 0x60, 0x58, 0x4D, 0xA6, 0x78, 0xFF, 0xFF, 0xE1, 0x02, 0xA6, 0xF3, 0x07, 0xFA, 0xCD, 0x60,
+	 0xE1, 0x78, 0xFF, 0xFF, 0x5E, 0x63, 0x60, 0x40, 0x02, 0x2B, 0x64, 0x63, 0x50, 0xFE, 0xBD, 0xD2,
+	 0x7F, 0xF1, 0xBD, 0xD2, 0xD0, 0x80, 0x80, 0xF1, 0xBD, 0xD2, 0xD0, 0x80, 0x81, 0xF1, 0x2A, 0xF2,
+	 0xD0, 0x80, 0x60, 0x40, 0x08, 0x3A, 0x09, 0x00, 0x01, 0x0C, 0xC8, 0x01, 0xE9, 0x60, 0x58, 0x4F,
+	 0x08, 0x78, 0xFF, 0xFF, 0xCD, 0x60, 0xE1, 0x78, 0xFF, 0xFF, 0x23, 0x0C, 0xD1, 0x60, 0x58, 0x4D,
+	 0xA6, 0x78, 0xFF, 0xFF, 0xBB, 0x02, 0x02, 0x64, 0x10, 0x60, 0x0A, 0xFB, 0x00, 0x64, 0x10, 0x60,
+	 0x0E, 0xFB, 0x26, 0x60, 0x58, 0x4E, 0x65, 0x78, 0xFF, 0xFF, 0x10, 0x60, 0x05, 0xF3, 0xFF, 0xFF,
+	 0x60, 0x40, 0x80, 0x27, 0x07, 0x00, 0x08, 0x60, 0x15, 0xF1, 0x00, 0x60, 0x04, 0x64, 0xB0, 0x84,
+	 0xA2, 0xDB, 0xCF, 0xFE, 0x00, 0x64, 0x10, 0x60, 0x0A, 0xFB, 0xA0, 0x01, 0xCD, 0x60, 0xE1, 0x78,
+	 0xFF, 0xFF, 0xDB, 0xF3, 0xFF, 0xFF, 0x07, 0xB4, 0xFD, 0xA0, 0xFF, 0xFF, 0x03, 0x03, 0x20, 0x40,
+	 0x10, 0x22, 0xF4, 0x01, 0x08, 0x60, 0x07, 0xF3, 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x36, 0x07, 0x00,
+	 0x01, 0x64, 0xA2, 0xDB, 0x01, 0x65, 0xF1, 0x60, 0x58, 0x4E, 0xC3, 0x78, 0xFF, 0xFF, 0x26, 0x46,
+	 0x31, 0xF2, 0x1D, 0x60, 0xC0, 0x65, 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD3, 0x66, 0x41,
+	 0x60, 0x46, 0x60, 0x43, 0x05, 0xF2, 0x16, 0x18, 0x61, 0x46, 0x31, 0xF0, 0x63, 0x46, 0xD0, 0x80,
+	 0x04, 0xF2, 0x0C, 0x02, 0x61, 0x46, 0x30, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x03, 0xF2, 0x06, 0x02,
+	 0x61, 0x46, 0x2F, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0xFF, 0xFF, 0x07, 0x03, 0x80, 0xF4, 0xFF, 0xFF,
+	 0x63, 0x46, 0xE8, 0x1B, 0xA6, 0xF3, 0x08, 0xFE, 0x60, 0x43, 0x61, 0x46, 0xA6, 0xF1, 0x43, 0x43,
+	 0xD3, 0x80, 0xFF, 0xFF, 0x03, 0x03, 0xCD, 0x60, 0xD9, 0x78, 0xFF, 0xFF, 0xD0, 0x60, 0x58, 0x4F,
+	 0xFC, 0x78, 0xFF, 0xFF, 0x03, 0x4B, 0x3F, 0xF2, 0x00, 0xF4, 0x60, 0x43, 0xF4, 0xA3, 0x00, 0x60,
+	 0x1D, 0x61, 0x00, 0x60, 0x01, 0x65, 0x01, 0x60, 0xFF, 0x64, 0x40, 0x4C, 0xFD, 0x60, 0x58, 0x4E,
+	 0x7A, 0x78, 0xFF, 0xFF, 0x00, 0xBB, 0xFF, 0xFF, 0x00, 0x02, 0x00, 0x64, 0x40, 0x4A, 0x60, 0xFE,
+	 0x02, 0x60, 0x00, 0x63, 0xBD, 0xD3, 0xBD, 0xD3, 0x60, 0x41, 0xFE, 0x60, 0x58, 0x4E, 0x2C, 0x78,
+	 0xFF, 0xFF, 0x20, 0xFE, 0x00, 0x65, 0x00, 0x64, 0x19, 0x60, 0x3B, 0xFB, 0x02, 0x00, 0x20, 0xFE,
+	 0xFF, 0x65, 0x02, 0x60, 0x00, 0x63, 0x60, 0xFE, 0xBD, 0xD3, 0xBD, 0xD3, 0x60, 0x41, 0x20, 0xFE,
+	 0xCD, 0x81, 0x60, 0x40, 0x80, 0x2A, 0x39, 0x00, 0x7F, 0xB4, 0x02, 0x3A, 0x02, 0x00, 0x01, 0x64,
+	 0x2E, 0x00, 0x04, 0x3A, 0x02, 0x00, 0x02, 0x64, 0x2A, 0x00, 0x0B, 0x3A, 0x02, 0x00, 0x04, 0x64,
+	 0x26, 0x00, 0x16, 0x3A, 0x02, 0x00, 0x08, 0x64, 0x22, 0x00, 0x0C, 0x3A, 0x02, 0x00, 0x10, 0x64,
+	 0x1E, 0x00, 0x12, 0x3A, 0x02, 0x00, 0x20, 0x64, 0x1A, 0x00, 0x18, 0x3A, 0x02, 0x00, 0x40, 0x64,
+	 0x16, 0x00, 0x24, 0x3A, 0x02, 0x00, 0x80, 0x64, 0x12, 0x00, 0x30, 0x3A, 0x02, 0x00, 0x01, 0x67,
+	 0x0E, 0x00, 0x48, 0x3A, 0x02, 0x00, 0x02, 0x67, 0x0A, 0x00, 0x60, 0x3A, 0x02, 0x00, 0x04, 0x67,
+	 0x06, 0x00, 0x6C, 0x3A, 0x02, 0x00, 0x08, 0x67, 0x02, 0x00, 0x00, 0x64, 0x00, 0x00, 0x19, 0x60,
+	 0x3B, 0xF1, 0xFF, 0xFF, 0xB0, 0x84, 0x19, 0x60, 0x3B, 0xFB, 0x61, 0x40, 0x00, 0x36, 0x05, 0x00,
+	 0x60, 0xFE, 0xBD, 0xD3, 0xFF, 0xFF, 0x20, 0xFE, 0xBB, 0x01, 0x65, 0x40, 0x00, 0x3A, 0x1E, 0x00,
+	 0x26, 0x46, 0x3F, 0xF2, 0x00, 0xF4, 0x60, 0x43, 0xF4, 0xA3, 0x00, 0x60, 0x1D, 0x61, 0x00, 0x60,
+	 0x32, 0x65, 0x01, 0x60, 0xFF, 0x64, 0x40, 0x4C, 0xFD, 0x60, 0x58, 0x4E, 0x7A, 0x78, 0xFF, 0xFF,
+	 0x00, 0xBB, 0xFF, 0xFF, 0x0B, 0x03, 0x60, 0xFE, 0x02, 0x60, 0x00, 0x63, 0xBD, 0xD3, 0xBD, 0xD3,
+	 0x60, 0x41, 0xFE, 0x60, 0x58, 0x4E, 0x2C, 0x78, 0xFF, 0xFF, 0x91, 0x01, 0x20, 0xFE, 0x00, 0x65,
+	 0xFC, 0x60, 0x58, 0x4E, 0xC7, 0x78, 0xFF, 0xFF, 0xA1, 0xF3, 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x27,
+	 0x04, 0x00, 0xFD, 0x60, 0x58, 0x4E, 0x11, 0x78, 0xFF, 0xFF, 0x20, 0xFE, 0x37, 0x60, 0xF8, 0x61,
+	 0xA1, 0xD1, 0xA1, 0xF3, 0x01, 0x60, 0xAC, 0x63, 0x60, 0x45, 0x2A, 0x44, 0x79, 0xFB, 0xA3, 0xD5,
+	 0x65, 0x40, 0x01, 0x27, 0x5B, 0xD5, 0x65, 0x40, 0x01, 0x27, 0x59, 0xD1, 0x66, 0x41, 0xA0, 0x84,
+	 0x24, 0x94, 0x2B, 0x46, 0x0F, 0xFA, 0x7A, 0xFB, 0x16, 0x64, 0x12, 0xFA, 0x01, 0x64, 0x11, 0xFA,
+	 0x66, 0x5C, 0xC2, 0x60, 0x58, 0x4E, 0x6D, 0x78, 0xFF, 0xFF, 0x7D, 0xF3, 0xFF, 0xFF, 0x60, 0x40,
+	 0x01, 0x27, 0x28, 0x00, 0x19, 0x60, 0x44, 0xF3, 0x32, 0x60, 0x88, 0x63, 0xA3, 0xD3, 0xFF, 0xFF,
+	 0x60, 0x40, 0x01, 0x2A, 0x0C, 0x00, 0x0F, 0x64, 0xFC, 0x60, 0x58, 0x4E, 0x34, 0x78, 0xFF, 0xFF,
+	 0xFF, 0x60, 0xFF, 0x63, 0x1A, 0x60, 0xB3, 0xFD, 0x1A, 0x60, 0xC3, 0xFD, 0x1C, 0x00, 0x19, 0x60,
+	 0x39, 0xF3, 0x3F, 0x40, 0x01, 0x27, 0x08, 0x00, 0x0F, 0x60, 0xFF, 0x65, 0xA4, 0x84, 0xFC, 0x60,
+	 0x58, 0x4E, 0x34, 0x78, 0xFF, 0xFF, 0x0F, 0x00, 0x0F, 0xB4, 0xFC, 0x60, 0x58, 0x4E, 0x34, 0x78,
+	 0xFF, 0xFF, 0x09, 0x00, 0x19, 0x60, 0x3A, 0xF3, 0x0F, 0x60, 0xFF, 0x65, 0xA4, 0x84, 0xFC, 0x60,
+	 0x58, 0x4E, 0x34, 0x78, 0xFF, 0xFF, 0xD3, 0x60, 0x58, 0x4E, 0x78, 0x78, 0xFF, 0xFF, 0x26, 0x46,
+	 0x23, 0x43, 0x32, 0x40, 0x08, 0x2A, 0x05, 0x00, 0x63, 0x46, 0x80, 0x60, 0x02, 0x64, 0x06, 0xFA,
+	 0x26, 0x46, 0x2C, 0x60, 0xE4, 0x64, 0xF1, 0x60, 0x78, 0x41, 0xE4, 0x78, 0xB5, 0xF1, 0x27, 0xF2,
+	 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x3B, 0x07, 0x00, 0x2C, 0x60, 0xF2, 0x64, 0xF1, 0x60, 0x78, 0x41,
+	 0xE4, 0x78, 0xB5, 0xF1, 0x08, 0x00, 0x02, 0x3B, 0x06, 0x00, 0x2C, 0x60, 0xF4, 0x64, 0xF1, 0x60,
+	 0x78, 0x41, 0xE4, 0x78, 0xB5, 0xF1, 0x1B, 0xF2, 0xFF, 0xFF, 0xE4, 0xA4, 0x3E, 0xFA, 0x2A, 0xF2,
+	 0x28, 0x41, 0x40, 0xA8, 0x01, 0xB1, 0x02, 0x02, 0x46, 0x02, 0x76, 0x00, 0x60, 0x40, 0x08, 0x2A,
+	 0x0F, 0x00, 0x2C, 0x60, 0xE2, 0x64, 0xF1, 0x60, 0x78, 0x41, 0xE4, 0x78, 0xB5, 0xF1, 0x1B, 0xF2,
+	 0xFF, 0xFF, 0x60, 0x45, 0x2C, 0x60, 0xE8, 0x64, 0xF1, 0x60, 0x78, 0x41, 0xF0, 0x78, 0xB5, 0xF1,
+	 0x0F, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x40, 0x26, 0x28, 0x00, 0x32, 0x44, 0x02, 0x26, 0x25, 0x00,
+	 0x10, 0x2B, 0x29, 0x00, 0x2E, 0x60, 0x40, 0x63, 0xBF, 0xD3, 0x2C, 0xF0, 0x00, 0xA8, 0x60, 0x41,
+	 0x0D, 0x03, 0x50, 0xFE, 0xBD, 0xD3, 0x2D, 0xF0, 0xD0, 0x80, 0xBD, 0xD3, 0x2E, 0xF0, 0xD0, 0x80,
+	 0xBD, 0xD3, 0x2C, 0xF0, 0xD0, 0x80, 0xFA, 0xA1, 0x10, 0x0C, 0xF3, 0x02, 0x50, 0xFE, 0x60, 0x60,
+	 0x01, 0x64, 0xD0, 0x80, 0x2D, 0xF0, 0x1D, 0x64, 0xD0, 0x80, 0x2E, 0xF0, 0x01, 0x64, 0xD0, 0x80,
+	 0xFF, 0xFF, 0x03, 0x0C, 0xD0, 0x60, 0xB5, 0x78, 0xFF, 0xFF, 0x32, 0x40, 0x40, 0x2A, 0x03, 0x00,
+	 0x1C, 0x60, 0x12, 0x78, 0xFF, 0xFF, 0xD0, 0x60, 0x6B, 0x78, 0xFF, 0xFF, 0x32, 0x40, 0x40, 0x26,
+	 0xF7, 0x01, 0x2A, 0xF0, 0xFF, 0xFF, 0x64, 0x40, 0x08, 0x2A, 0x2A, 0x00, 0xDB, 0xF3, 0xFF, 0xFF,
+	 0x07, 0xB4, 0x03, 0xA8, 0xFF, 0xFF, 0x03, 0x03, 0x32, 0x40, 0x02, 0x2A, 0x1D, 0x00, 0x03, 0x67,
+	 0xA0, 0x84, 0x00, 0x37, 0x64, 0x63, 0x60, 0x40, 0x02, 0x37, 0x5E, 0x63, 0x60, 0x40, 0x01, 0x37,
+	 0x58, 0x63, 0x60, 0x40, 0x03, 0x37, 0x0D, 0x00, 0xBD, 0xD2, 0x7F, 0xF1, 0xBD, 0xD2, 0xD0, 0x80,
+	 0x80, 0xF1, 0x07, 0x02, 0xD0, 0x80, 0xBD, 0xD2, 0x81, 0xF1, 0x03, 0x02, 0xD0, 0x80, 0xFF, 0xFF,
+	 0x03, 0x03, 0xD0, 0x60, 0xB5, 0x78, 0xFF, 0xFF, 0xE9, 0x60, 0x58, 0x4F, 0x08, 0x78, 0xFF, 0xFF,
+	 0x2A, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x08, 0x26, 0x06, 0x00, 0x20, 0x40, 0x10, 0x2B, 0x03, 0x00,
+	 0xD0, 0x60, 0x6B, 0x78, 0xFF, 0xFF, 0x87, 0xF4, 0xA6, 0xF1, 0x27, 0x1B, 0x31, 0xF2, 0x1D, 0x60,
+	 0xC0, 0x65, 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD3, 0x66, 0x41, 0x60, 0x46, 0x60, 0x43,
+	 0x05, 0xF2, 0x16, 0x18, 0x61, 0x46, 0x31, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x04, 0xF2, 0x0C, 0x02,
+	 0x61, 0x46, 0x30, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x03, 0xF2, 0x06, 0x02, 0x61, 0x46, 0x2F, 0xF0,
+	 0x63, 0x46, 0xD0, 0x80, 0xFF, 0xFF, 0x07, 0x03, 0x80, 0xF4, 0xFF, 0xFF, 0x63, 0x46, 0xE8, 0x1B,
+	 0xA6, 0xF3, 0x08, 0xFE, 0x60, 0x43, 0x61, 0x46, 0x03, 0x00, 0xD3, 0x80, 0xFF, 0xFF, 0xD6, 0x03,
+	 0x43, 0x43, 0xDB, 0xF3, 0x32, 0x40, 0x02, 0x26, 0x04, 0x00, 0x07, 0xB4, 0x03, 0xA8, 0x2A, 0xF2,
+	 0x45, 0x02, 0xA6, 0xF1, 0x23, 0x43, 0xD3, 0x80, 0xFF, 0xFF, 0x40, 0x02, 0xD0, 0x60, 0x58, 0x4F,
+	 0xFC, 0x78, 0xFF, 0xFF, 0x32, 0x40, 0x02, 0x2A, 0x05, 0x00, 0x63, 0x46, 0x02, 0x64, 0x06, 0xFA,
+	 0x26, 0x46, 0x34, 0x00, 0x32, 0x40, 0x08, 0x2A, 0x05, 0x00, 0x63, 0x46, 0x80, 0x60, 0x02, 0x64,
+	 0x06, 0xFA, 0x26, 0x46, 0x43, 0x43, 0x7D, 0xF3, 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x27, 0x09, 0x00,
+	 0x19, 0x60, 0x44, 0xF3, 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x2A, 0x03, 0x00, 0x23, 0x46, 0x0F, 0x64,
+	 0x10, 0x00, 0x37, 0x60, 0xF8, 0x61, 0xA1, 0xD1, 0xA1, 0xF3, 0x01, 0x60, 0xAC, 0x63, 0x60, 0x45,
+	 0xA3, 0xD3, 0x65, 0x40, 0x01, 0x27, 0x5B, 0xD3, 0x65, 0x40, 0x01, 0x27, 0x59, 0xD1, 0x23, 0x46,
+	 0xA0, 0x84, 0x0F, 0xFA, 0x7A, 0xFB, 0x79, 0xFB, 0x16, 0x64, 0x12, 0xFA, 0x01, 0x64, 0x11, 0xFA,
+	 0x66, 0x5C, 0xC2, 0x60, 0x58, 0x4E, 0x6D, 0x78, 0xFF, 0xFF, 0x26, 0x46, 0x07, 0xFC, 0x43, 0x43,
+	 0x2A, 0xF2, 0x63, 0x45, 0x0C, 0xB4, 0x08, 0x3A, 0x0A, 0x00, 0xDB, 0xF3, 0x23, 0x46, 0x07, 0xB4,
+	 0xFD, 0xA0, 0x06, 0xF2, 0x26, 0x46, 0x03, 0x03, 0x60, 0x40, 0x02, 0x2A, 0x0D, 0x00, 0x2A, 0xF2,
+	 0x35, 0xF0, 0x60, 0x40, 0xA4, 0x36, 0x0B, 0x00, 0x08, 0x2B, 0x0C, 0x00, 0x23, 0x46, 0x26, 0xF2,
+	 0x26, 0x46, 0xD0, 0x80, 0xFF, 0xFF, 0x06, 0x02, 0xD0, 0x60, 0xB5, 0x78, 0xFF, 0xFF, 0xD0, 0x60,
+	 0x6B, 0x78, 0xFF, 0xFF, 0x23, 0x46, 0x22, 0xF2, 0x26, 0x46, 0x44, 0x4C, 0x0F, 0x26, 0x1D, 0x00,
+	 0x00, 0xBC, 0x40, 0x45, 0x0B, 0x03, 0x00, 0x64, 0x23, 0x46, 0x22, 0xFA, 0x26, 0x46, 0xA2, 0xFF,
+	 0xB6, 0x60, 0x58, 0x4E, 0xF5, 0x78, 0xFF, 0xFF, 0xA3, 0xFF, 0x26, 0x46, 0x2A, 0xF0, 0x2C, 0x44,
+	 0x64, 0x40, 0x04, 0x27, 0x0A, 0x00, 0x23, 0x46, 0x26, 0xFA, 0x26, 0x46, 0x1B, 0xF2, 0xFF, 0xFF,
+	 0xE4, 0xA4, 0x3E, 0xFA, 0xD0, 0x60, 0x22, 0x78, 0xFF, 0xFF, 0x3F, 0xF2, 0x02, 0xFA, 0xA2, 0xFF,
+	 0x16, 0xF0, 0xFF, 0xFF, 0x64, 0x44, 0x01, 0x26, 0xDC, 0x9C, 0xB0, 0xF3, 0x2A, 0xF2, 0xDC, 0x83,
+	 0xB0, 0xFD, 0x06, 0xF4, 0x01, 0xF8, 0x26, 0x46, 0x60, 0x40, 0x40, 0x2B, 0x18, 0x00, 0x64, 0x44,
+	 0x00, 0x65, 0xFF, 0xB4, 0xFC, 0xA4, 0x06, 0xF0, 0x03, 0x03, 0x64, 0x46, 0x0C, 0x0D, 0x02, 0x65,
+	 0x26, 0x46, 0x00, 0xF2, 0xFF, 0xFF, 0xD0, 0x80, 0xFF, 0xFF, 0x02, 0x03, 0x60, 0x46, 0xF9, 0x01,
+	 0x01, 0xF2, 0xFF, 0xFF, 0xD4, 0x84, 0x01, 0xFA, 0x66, 0x44, 0x26, 0x46, 0x06, 0xFA, 0x06, 0xF4,
+	 0x00, 0xF2, 0x80, 0xFC, 0x40, 0x45, 0xB6, 0x60, 0x58, 0x4E, 0xF5, 0x78, 0xFF, 0xFF, 0xA3, 0xFF,
+	 0x26, 0x46, 0x2C, 0x44, 0x0F, 0x26, 0x13, 0x00, 0x23, 0x46, 0x26, 0xFA, 0x26, 0x44, 0x22, 0xFA,
+	 0x26, 0x46, 0x1B, 0xF2, 0xFF, 0xFF, 0xE4, 0xA4, 0x3E, 0xFA, 0x00, 0x64, 0x13, 0x60, 0x0D, 0xFB,
+	 0x26, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0x6E, 0x00, 0xA3, 0x46,
+	 0x26, 0xF2, 0x60, 0x45, 0xDC, 0x84, 0xD4, 0x80, 0x26, 0xFA, 0xA3, 0x46, 0x6B, 0x02, 0x2A, 0xF0,
+	 0xA3, 0x46, 0x22, 0xF2, 0xA3, 0x46, 0x00, 0xBC, 0x00, 0xF2, 0x01, 0x02, 0x63, 0x00, 0x44, 0x4C,
+	 0x3F, 0xF0, 0x60, 0x43, 0x23, 0x46, 0x22, 0xF4, 0x09, 0x60, 0x00, 0x65, 0x3F, 0xF2, 0x26, 0x46,
+	 0xC0, 0x84, 0xD4, 0x80, 0x60, 0x45, 0x56, 0x07, 0x80, 0xFC, 0x1B, 0xF2, 0x06, 0xF2, 0x60, 0x41,
+	 0x23, 0x46, 0x22, 0xF4, 0x1B, 0xF0, 0x06, 0xF0, 0xC1, 0x81, 0x06, 0xFA, 0x05, 0xFA, 0x9B, 0xFA,
+	 0x65, 0x44, 0x3F, 0xFA, 0x64, 0x46, 0x00, 0xFC, 0x63, 0x46, 0x01, 0xF2, 0x10, 0x61, 0xF2, 0xA4,
+	 0x01, 0xFA, 0xC8, 0x83, 0x02, 0x64, 0x59, 0xD0, 0x58, 0xD8, 0xFD, 0x1F, 0x06, 0x45, 0x00, 0x64,
+	 0x13, 0x60, 0x0D, 0xFB, 0x25, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF,
+	 0xA2, 0xFF, 0x00, 0xF4, 0x01, 0xF0, 0x0A, 0x18, 0x70, 0x67, 0xA0, 0x80, 0xF0, 0x67, 0x06, 0x03,
+	 0xC0, 0x84, 0x01, 0xFA, 0x25, 0x46, 0x25, 0x44, 0x80, 0xFC, 0x05, 0xFA, 0xB6, 0x60, 0x58, 0x4E,
+	 0xF5, 0x78, 0xFF, 0xFF, 0xD4, 0xFE, 0xA3, 0xFF, 0x2C, 0x44, 0x04, 0x27, 0x16, 0x00, 0x23, 0x46,
+	 0x22, 0xF2, 0xA2, 0xFC, 0x60, 0x46, 0x46, 0x46, 0x3F, 0xF2, 0x00, 0xF4, 0x60, 0x47, 0x08, 0xFA,
+	 0x26, 0x46, 0x2C, 0x43, 0x2A, 0xFC, 0x06, 0xF4, 0x00, 0x64, 0x00, 0xFA, 0x01, 0xF0, 0x80, 0x60,
+	 0x00, 0x64, 0xB0, 0x84, 0x01, 0xFA, 0x26, 0x46, 0x1D, 0x00, 0x00, 0x66, 0x46, 0x46, 0xCA, 0x60,
+	 0xD8, 0x78, 0xFF, 0xFF, 0xA3, 0x46, 0x22, 0xF0, 0xA2, 0xFC, 0x00, 0x63, 0x33, 0x85, 0xA3, 0x46,
+	 0x0D, 0x03, 0xA3, 0x46, 0x26, 0xF2, 0x0F, 0x65, 0xA4, 0x85, 0xD4, 0x84, 0x26, 0xFA, 0xA3, 0x46,
+	 0xA2, 0xFF, 0xB6, 0x60, 0x58, 0x4E, 0xF5, 0x78, 0xFF, 0xFF, 0xA3, 0xFF, 0x26, 0x46, 0xD0, 0x60,
+	 0xB5, 0x78, 0xFF, 0xFF, 0x2A, 0xF2, 0x32, 0xF0, 0x60, 0x40, 0x08, 0x2A, 0x24, 0x00, 0x01, 0x2B,
+	 0x13, 0x00, 0x64, 0x40, 0x01, 0x2A, 0x10, 0x00, 0x2C, 0x60, 0xE2, 0x64, 0xF1, 0x60, 0x78, 0x41,
+	 0xE4, 0x78, 0xB5, 0xF1, 0x1B, 0xF2, 0xFF, 0xFF, 0x60, 0x45, 0x2C, 0x60, 0xE8, 0x64, 0xF1, 0x60,
+	 0x78, 0x41, 0xF0, 0x78, 0xB5, 0xF1, 0x0F, 0x00, 0x2C, 0x60, 0xE0, 0x64, 0xF1, 0x60, 0x78, 0x41,
+	 0xE4, 0x78, 0xB5, 0xF1, 0x1B, 0xF2, 0xFF, 0xFF, 0x60, 0x45, 0x2C, 0x60, 0xE6, 0x64, 0xF1, 0x60,
+	 0x78, 0x41, 0xF0, 0x78, 0xB5, 0xF1, 0x07, 0xF4, 0xFF, 0xFF, 0x26, 0xF2, 0x26, 0x46, 0x0F, 0xB4,
+	 0xDC, 0x85, 0x2C, 0x60, 0xE4, 0x64, 0xF1, 0x60, 0x78, 0x41, 0xF0, 0x78, 0xB5, 0xF1, 0x27, 0xF2,
+	 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x3B, 0x07, 0x00, 0x2C, 0x60, 0xF2, 0x64, 0xF1, 0x60, 0x78, 0x41,
+	 0xE4, 0x78, 0xB5, 0xF1, 0x08, 0x00, 0x02, 0x3B, 0x06, 0x00, 0x2C, 0x60, 0xF4, 0x64, 0xF1, 0x60,
+	 0x78, 0x41, 0xE4, 0x78, 0xB5, 0xF1, 0x07, 0xF2, 0x26, 0xF0, 0x41, 0x18, 0x60, 0x46, 0xFF, 0x67,
+	 0x20, 0x88, 0x64, 0x5F, 0x40, 0x4A, 0x15, 0xF0, 0x28, 0x44, 0xD0, 0x84, 0x03, 0xA4, 0x03, 0x0E,
+	 0xE8, 0x84, 0xE8, 0x84, 0x04, 0x00, 0xFA, 0xA4, 0xE8, 0x84, 0xE8, 0x87, 0xC0, 0xBF, 0xC0, 0x84,
+	 0x15, 0xFA, 0x40, 0x48, 0x14, 0xF0, 0x2A, 0x44, 0xD0, 0x84, 0x1F, 0xA4, 0x06, 0x0E, 0xE8, 0x84,
+	 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0x07, 0x00, 0xC2, 0xA4, 0xE8, 0x84, 0xE8, 0x84,
+	 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x87, 0xF8, 0xBF, 0xC0, 0x84, 0x14, 0xFA, 0x33, 0x60, 0x4C, 0x63,
+	 0xBD, 0xDB, 0x60, 0x5C, 0x2F, 0x67, 0xD0, 0x80, 0x60, 0x45, 0x02, 0x28, 0x64, 0x45, 0x28, 0x5C,
+	 0xBD, 0xD9, 0x8B, 0x67, 0xD0, 0x80, 0x60, 0x41, 0x02, 0x24, 0x64, 0x41, 0xD5, 0x84, 0x80, 0x65,
+	 0xC4, 0x87, 0x01, 0x05, 0x00, 0x64, 0xFF, 0xB4, 0x0E, 0xFA, 0xA3, 0xDB, 0x26, 0x46, 0xD1, 0x60,
+	 0xDB, 0x78, 0xFF, 0xFF, 0xCA, 0x60, 0xD8, 0x78, 0xFF, 0xFF, 0x26, 0x60, 0x1A, 0x64, 0x40, 0x4B,
+	 0x34, 0x60, 0x58, 0x4D, 0x08, 0x78, 0xFF, 0xFF, 0x00, 0x66, 0x46, 0x46, 0xCA, 0x60, 0xD8, 0x78,
+	 0xFF, 0xFF, 0x25, 0x60, 0xFE, 0x64, 0x13, 0x60, 0x0D, 0xFB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64,
+	 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xF8, 0xFE, 0x00, 0x66, 0x46, 0x46, 0xCA, 0x60, 0xD8, 0x78,
+	 0xFF, 0xFF, 0x2A, 0xF2, 0x58, 0x63, 0x60, 0x47, 0x01, 0x27, 0x64, 0x63, 0x61, 0x5C, 0x1B, 0x60,
+	 0xFB, 0xF9, 0xBD, 0xD0, 0xBD, 0xD0, 0x64, 0x45, 0x64, 0x41, 0xBD, 0xD0, 0x00, 0xF4, 0x04, 0xF8,
+	 0x83, 0xFA, 0x82, 0xF8, 0xA6, 0x46, 0x02, 0xB0, 0x5E, 0x63, 0x04, 0x03, 0x64, 0x63, 0x03, 0xB0,
+	 0x02, 0x3A, 0x6C, 0x63, 0x3F, 0xF2, 0xBD, 0xD0, 0xBD, 0xD0, 0x64, 0x45, 0x64, 0x41, 0xBD, 0xD0,
+	 0xA6, 0x46, 0x07, 0xF8, 0x86, 0xFA, 0x85, 0xF8, 0x60, 0x47, 0x08, 0xFA, 0x1B, 0x60, 0xFB, 0xF1,
+	 0x26, 0x46, 0x64, 0x41, 0x2F, 0x58, 0xFF, 0xFF, 0xA6, 0xF5, 0x00, 0xF2, 0x26, 0x46, 0x31, 0xF0,
+	 0x39, 0x18, 0x66, 0x41, 0x1D, 0x60, 0xC0, 0x65, 0x64, 0x47, 0x00, 0x7F, 0xA6, 0xF1, 0xE0, 0x84,
+	 0x44, 0xD3, 0x64, 0x43, 0x11, 0x18, 0x60, 0x46, 0x00, 0xF2, 0xFF, 0xFF, 0xFC, 0x1B, 0x66, 0x44,
+	 0x64, 0x46, 0x80, 0xF0, 0x60, 0x46, 0x80, 0xF8, 0x65, 0x46, 0x65, 0x43, 0x80, 0xF0, 0x01, 0xFA,
+	 0x80, 0xFC, 0x64, 0x46, 0x80, 0xF8, 0x0B, 0x00, 0x64, 0x46, 0x62, 0x43, 0x00, 0xF2, 0xA3, 0xDB,
+	 0x60, 0x46, 0x80, 0xF0, 0x81, 0xFC, 0x80, 0xFC, 0x64, 0x46, 0x80, 0xF8, 0x60, 0x43, 0x61, 0x46,
+	 0x1F, 0x60, 0xC2, 0x61, 0xA1, 0xD3, 0x20, 0x60, 0x04, 0x7C, 0xD0, 0x80, 0xFF, 0xFF, 0x07, 0x03,
+	 0xA0, 0xDD, 0xDA, 0x9C, 0xA1, 0xD9, 0x49, 0xD3, 0xFF, 0xFF, 0xDC, 0x84, 0xA1, 0xDB, 0xD1, 0x60,
+	 0x97, 0x78, 0xFF, 0xFF, 0x20, 0x7C, 0x72, 0x44, 0xFF, 0xB4, 0xD0, 0x80, 0xFF, 0xFF, 0x02, 0x04,
+	 0xD0, 0x84, 0xFB, 0x01, 0xE0, 0x83, 0xA6, 0xF3, 0x02, 0xA3, 0x43, 0x93, 0xA6, 0xF3, 0xFF, 0xFF,
+	 0x02, 0xA5, 0xD7, 0x80, 0x04, 0xA5, 0x08, 0x24, 0x65, 0x43, 0x66, 0x41, 0x63, 0x46, 0x05, 0xF2,
+	 0x00, 0xF0, 0x81, 0xF0, 0x02, 0x18, 0x64, 0x46, 0x81, 0xF8, 0x07, 0x1B, 0x1D, 0x60, 0xC0, 0x65,
+	 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD9, 0x02, 0x00, 0x65, 0x46, 0x00, 0xF8, 0xA6, 0xF3,
+	 0x63, 0x45, 0x60, 0x46, 0x00, 0xF2, 0xFF, 0xFF, 0xD4, 0x80, 0x01, 0x18, 0xFA, 0x04, 0x80, 0xF8,
+	 0x65, 0x46, 0x00, 0xFA, 0x06, 0xF2, 0xFF, 0xFF, 0x00, 0x7E, 0x06, 0xFA, 0x61, 0x46, 0x31, 0xF0,
+	 0x66, 0x41, 0x1D, 0x60, 0xC0, 0x65, 0x64, 0x47, 0x00, 0x7F, 0xA6, 0xF1, 0xE0, 0x84, 0x44, 0xD3,
+	 0x64, 0x43, 0x11, 0x18, 0x60, 0x46, 0x00, 0xF2, 0xFF, 0xFF, 0xFC, 0x1B, 0x66, 0x44, 0x64, 0x46,
+	 0x80, 0xF0, 0x60, 0x46, 0x80, 0xF8, 0x65, 0x46, 0x65, 0x43, 0x80, 0xF0, 0x01, 0xFA, 0x80, 0xFC,
+	 0x64, 0x46, 0x80, 0xF8, 0x0B, 0x00, 0x64, 0x46, 0x62, 0x43, 0x00, 0xF2, 0xA3, 0xDB, 0x60, 0x46,
+	 0x80, 0xF0, 0x81, 0xFC, 0x80, 0xFC, 0x64, 0x46, 0x80, 0xF8, 0x60, 0x43, 0x61, 0x46, 0x2F, 0xF2,
+	 0x30, 0xF0, 0x31, 0xF0, 0x64, 0x45, 0x46, 0x43, 0x63, 0x46, 0x03, 0xFA, 0x06, 0xF2, 0x84, 0xF8,
+	 0x00, 0x7E, 0x06, 0xFA, 0x05, 0xF8, 0xA3, 0x46, 0x2F, 0x58, 0xFF, 0xFF, 0xDB, 0xF3, 0x2A, 0xF2,
+	 0x07, 0xB0, 0x03, 0x3A, 0x2A, 0x00, 0x00, 0xF4, 0x09, 0xF2, 0x60, 0x45, 0x80, 0x3A, 0x05, 0x00,
+	 0x0E, 0xF2, 0xFF, 0xFF, 0x02, 0xB0, 0x0F, 0xF2, 0x20, 0x03, 0x60, 0x47, 0x00, 0x3A, 0x1D, 0x00,
+	 0x60, 0x41, 0x00, 0x36, 0x13, 0x00, 0xDA, 0x85, 0x33, 0x60, 0xBE, 0x63, 0xBD, 0xD1, 0xFF, 0xFF,
+	 0xD1, 0x80, 0xFF, 0xFF, 0x12, 0x02, 0x60, 0xFE, 0xBD, 0xD3, 0xA5, 0xD0, 0xDE, 0x85, 0xD0, 0x80,
+	 0xCD, 0x81, 0x0B, 0x02, 0xF9, 0x02, 0x20, 0xFE, 0x00, 0x64, 0x09, 0x00, 0x26, 0x46, 0x48, 0xFE,
+	 0x65, 0x40, 0x40, 0x3A, 0x02, 0x00, 0x01, 0x64, 0x02, 0x00, 0x28, 0xFE, 0x00, 0x64, 0x40, 0x48,
+	 0x26, 0x46, 0x2D, 0x58, 0xFF, 0xFF, 0x19, 0x60, 0xA3, 0xF3, 0x3D, 0xF2, 0x60, 0x40, 0x01, 0x26,
+	 0x2A, 0xFA, 0x2A, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x08, 0x26, 0x03, 0x00, 0xD2, 0x60, 0xB5, 0x78,
+	 0xFF, 0xFF, 0x3F, 0xF0, 0x32, 0x40, 0x10, 0x2A, 0x0E, 0x00, 0x2C, 0xF0, 0x64, 0x41, 0x60, 0x40,
+	 0x40, 0x27, 0x09, 0x00, 0xCD, 0x81, 0xDD, 0x81, 0x06, 0x03, 0x05, 0x03, 0x64, 0x40, 0x01, 0x26,
+	 0x02, 0x00, 0x01, 0x61, 0x01, 0x00, 0x00, 0x61, 0x60, 0x40, 0x18, 0x36, 0x1F, 0x00, 0xD0, 0x60,
+	 0x58, 0x4F, 0xD1, 0x78, 0xFF, 0xFF, 0x0F, 0xF0, 0xEA, 0xF1, 0x64, 0x44, 0x60, 0x22, 0x19, 0x00,
+	 0xDB, 0xF3, 0xFF, 0xFF, 0x07, 0xB4, 0xFD, 0xA0, 0x2A, 0xF2, 0x03, 0x02, 0x08, 0xB0, 0xFF, 0xFF,
+	 0x10, 0x02, 0x32, 0xF2, 0x33, 0xF2, 0xD0, 0x80, 0xEB, 0xF1, 0x0B, 0x02, 0xD0, 0x80, 0x34, 0xF2,
+	 0x08, 0x02, 0xEC, 0xF1, 0xFF, 0xFF, 0xD0, 0x80, 0x0F, 0xF0, 0x03, 0x02, 0xD3, 0x60, 0x10, 0x78,
+	 0xFF, 0xFF, 0x00, 0xF4, 0xAA, 0x60, 0xAA, 0x65, 0x09, 0xF2, 0x5A, 0xD0, 0xD4, 0x80, 0x03, 0x64,
+	 0x57, 0x02, 0xD0, 0x80, 0x00, 0x64, 0x5A, 0xD0, 0x53, 0x02, 0x64, 0x45, 0xD4, 0x80, 0xF8, 0x7F,
+	 0x08, 0x02, 0x5A, 0xD0, 0x26, 0x46, 0x64, 0x45, 0x23, 0xF0, 0x20, 0x67, 0xB0, 0x84, 0xA2, 0xDA,
+	 0x0B, 0x00, 0xD4, 0x80, 0x1D, 0x60, 0x60, 0x64, 0x16, 0x02, 0x5A, 0xD0, 0x26, 0x46, 0x64, 0x45,
+	 0x23, 0xF0, 0x40, 0x67, 0xB0, 0x84, 0xA2, 0xDA, 0x65, 0x44, 0x88, 0x3A, 0x07, 0x00, 0x77, 0x37,
+	 0x08, 0x00, 0x78, 0x37, 0x06, 0x00, 0x8E, 0x37, 0x04, 0x00, 0x32, 0x00, 0x81, 0x3A, 0x30, 0x00,
+	 0x80, 0x37, 0x00, 0x61, 0x2D, 0x00, 0xD4, 0x80, 0x01, 0x60, 0x00, 0x64, 0x5A, 0xD0, 0x28, 0x02,
+	 0xD0, 0x80, 0x5A, 0xD0, 0x25, 0x02, 0x26, 0x46, 0x64, 0x47, 0x7F, 0xB4, 0xFD, 0xA0, 0x09, 0x03,
+	 0x1F, 0x07, 0x32, 0x40, 0x02, 0x26, 0x44, 0x00, 0x23, 0xF0, 0x60, 0x67, 0xB0, 0x84, 0xA2, 0xDA,
+	 0x3F, 0x00, 0x0F, 0xF2, 0x32, 0x40, 0x02, 0x26, 0x3B, 0x00, 0x2A, 0xF2, 0xFF, 0xFF, 0x60, 0x40,
+	 0x08, 0x2A, 0x07, 0x00, 0x60, 0x40, 0x48, 0x36, 0x04, 0x00, 0xF1, 0xF3, 0xFF, 0xFF, 0x02, 0xBC,
+	 0xF1, 0xFB, 0xF4, 0x60, 0x58, 0x4F, 0x1D, 0x78, 0xFF, 0xFF, 0xD3, 0x60, 0x1A, 0x78, 0xFF, 0xFF,
+	 0x26, 0x46, 0x61, 0x40, 0x01, 0x2A, 0x07, 0x00, 0x2C, 0x60, 0xF8, 0x64, 0xF1, 0x60, 0x78, 0x41,
+	 0xE4, 0x78, 0xB5, 0xF1, 0x85, 0x00, 0x0F, 0xF2, 0x7F, 0xF1, 0x2A, 0xF2, 0x60, 0x40, 0x20, 0x2A,
+	 0x12, 0x00, 0x5E, 0x63, 0x60, 0x40, 0x02, 0x2B, 0x64, 0x63, 0xBD, 0xD2, 0xBD, 0xD2, 0xD0, 0x80,
+	 0x80, 0xF1, 0x08, 0x02, 0xD0, 0x80, 0xA3, 0xD2, 0x81, 0xF1, 0x04, 0x02, 0xD0, 0x80, 0xFF, 0xFF,
+	 0x01, 0x02, 0x06, 0x00, 0x6D, 0x00, 0x2A, 0xF2, 0xFF, 0xFF, 0xFF, 0xFF, 0x48, 0x36, 0x68, 0x00,
+	 0x2A, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x08, 0x2A, 0x07, 0x00, 0x60, 0x40, 0x48, 0x36, 0x04, 0x00,
+	 0xF1, 0xF3, 0xFF, 0xFF, 0x02, 0xBC, 0xF1, 0xFB, 0x68, 0x00, 0x26, 0x46, 0x2A, 0xF2, 0xFF, 0xFF,
+	 0xFF, 0xFF, 0x0C, 0x26, 0x55, 0x00, 0xB0, 0x36, 0x15, 0x00, 0x10, 0x36, 0x13, 0x00, 0x30, 0x36,
+	 0x11, 0x00, 0xC0, 0x36, 0x02, 0x00, 0xA0, 0x3A, 0x12, 0x00, 0x7F, 0xF1, 0x32, 0xF2, 0x33, 0xF2,
+	 0xD0, 0x80, 0x80, 0xF1, 0x45, 0x02, 0xD0, 0x80, 0x34, 0xF2, 0x81, 0xF1, 0x41, 0x02, 0xD0, 0x80,
+	 0xFF, 0xFF, 0x3E, 0x02, 0xE6, 0x60, 0x58, 0x4F, 0x3D, 0x78, 0xFF, 0xFF, 0x35, 0x00, 0x50, 0x3A,
+	 0x05, 0x00, 0xF8, 0x60, 0x58, 0x4F, 0xE1, 0x78, 0xFF, 0xFF, 0x2E, 0x00, 0x40, 0x3A, 0x05, 0x00,
+	 0xF0, 0x60, 0x58, 0x4F, 0x99, 0x78, 0xFF, 0xFF, 0x27, 0x00, 0x80, 0x3A, 0x24, 0x00, 0x7F, 0xF1,
+	 0x32, 0xF2, 0x33, 0xF2, 0xD0, 0x80, 0x80, 0xF1, 0x23, 0x02, 0xD0, 0x80, 0x34, 0xF2, 0x81, 0xF1,
+	 0x1F, 0x02, 0xD0, 0x80, 0xFF, 0xFF, 0x1C, 0x02, 0xE9, 0x60, 0x58, 0x4F, 0x30, 0x78, 0xFF, 0xFF,
+	 0x7D, 0xF3, 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x27, 0x0A, 0x00, 0x19, 0x60, 0x4C, 0xF3, 0xFF, 0xFF,
+	 0x60, 0x40, 0x08, 0x26, 0x04, 0x00, 0xEE, 0x60, 0x58, 0x4F, 0x81, 0x78, 0xFF, 0xFF, 0x24, 0x60,
+	 0x58, 0x4F, 0xE3, 0x78, 0xFF, 0xFF, 0x04, 0x00, 0x66, 0x44, 0x00, 0xA8, 0xFF, 0xFF, 0x0A, 0x03,
+	 0x26, 0x46, 0x26, 0x60, 0x1A, 0x64, 0x40, 0x4B, 0x34, 0x60, 0x58, 0x4D, 0x08, 0x78, 0xFF, 0xFF,
+	 0x00, 0x66, 0x46, 0x46, 0xD0, 0x60, 0xB2, 0x78, 0xFF, 0xFF, 0x2A, 0xF2, 0x3B, 0xF0, 0x60, 0x40,
+	 0x40, 0x2B, 0x06, 0x00, 0xC0, 0x60, 0x00, 0x64, 0x64, 0x40, 0x20, 0x2B, 0x01, 0x00, 0x03, 0x00,
+	 0xD3, 0x60, 0x4C, 0x78, 0xFF, 0xFF, 0x22, 0xF2, 0xFF, 0xFF, 0x04, 0xB4, 0xFF, 0xFF, 0xF8, 0x03,
+	 0x23, 0xF2, 0x07, 0xF4, 0xBB, 0xF0, 0x26, 0x46, 0xA4, 0x84, 0xFF, 0xFF, 0x60, 0x40, 0x2F, 0x26,
+	 0xD7, 0x01, 0x12, 0xF0, 0xFF, 0xFF, 0x10, 0x1B, 0xCA, 0x60, 0x58, 0x4F, 0x16, 0x78, 0xFF, 0xFF,
+	 0x64, 0x40, 0x18, 0x36, 0x09, 0x00, 0x04, 0x65, 0xF1, 0x60, 0x58, 0x4E, 0x96, 0x78, 0xFF, 0xFF,
+	 0x26, 0x46, 0xD3, 0x60, 0x10, 0x78, 0xFF, 0xFF, 0x25, 0x60, 0xFE, 0x64, 0x13, 0x60, 0x0D, 0xFB,
+	 0x26, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xF8, 0xFE, 0xC0, 0x01,
+	 0x1C, 0x60, 0x92, 0x63, 0x00, 0x64, 0xA3, 0xDB, 0x06, 0xA3, 0x10, 0x60, 0x94, 0x64, 0xBD, 0xDB,
+	 0xBD, 0xDB, 0x06, 0x64, 0xA3, 0xDB, 0x00, 0x63, 0x08, 0x60, 0x77, 0xFD, 0xD9, 0x60, 0xA5, 0x64,
+	 0x08, 0x60, 0x49, 0xFB, 0xD9, 0x60, 0x6A, 0x64, 0x08, 0x60, 0x35, 0xFB, 0x00, 0x60, 0x02, 0x64,
+	 0x08, 0x60, 0x16, 0xFB, 0xD3, 0x60, 0x9C, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x7D, 0xF3, 0x33, 0x60, 0x20, 0x63, 0x60, 0x40, 0x01, 0x27, 0x03, 0x00, 0x19, 0x60, 0x3B, 0xF3,
+	 0x02, 0x00, 0x19, 0x60, 0x3C, 0xF3, 0x08, 0x61, 0x60, 0xFE, 0xA3, 0xD1, 0xFF, 0xFF, 0x20, 0xFE,
+	 0x00, 0xA8, 0xE8, 0x84, 0x0F, 0x03, 0x60, 0xFE, 0x02, 0x28, 0xF6, 0x01, 0x80, 0x62, 0xB2, 0x9C,
+	 0xBD, 0xD9, 0x7B, 0xF9, 0xCD, 0x81, 0x00, 0x36, 0x01, 0x00, 0xEE, 0x01, 0x36, 0x60, 0x0A, 0x63,
+	 0x08, 0x61, 0xEA, 0x01, 0x2E, 0x58, 0xFF, 0xFF, 0x10, 0x60, 0x2A, 0x62, 0x00, 0x64, 0xA2, 0xDB,
+	 0xBA, 0xFE, 0x16, 0x60, 0x87, 0xF3, 0xFF, 0xFF, 0x03, 0xA8, 0x02, 0xA8, 0x04, 0x03, 0x28, 0x02,
+	 0xD9, 0x60, 0x41, 0x78, 0xFF, 0xFF, 0xD8, 0x60, 0xD4, 0x78, 0xFF, 0xFF, 0x08, 0x60, 0x15, 0xF1,
+	 0x00, 0x60, 0x04, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x11, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0xAC, 0xF3,
+	 0xFF, 0xFF, 0xFE, 0xA0, 0xFF, 0xFF, 0x0A, 0x07, 0x1C, 0x60, 0x92, 0x64, 0x13, 0x60, 0x22, 0xFB,
+	 0x02, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x2F, 0x58, 0xFF, 0xFF, 0x20, 0x60, 0x20, 0x65,
+	 0xA5, 0xDF, 0x00, 0x64, 0x08, 0x60, 0x27, 0xFB, 0x5A, 0xDB, 0xD4, 0x60, 0xF6, 0x78, 0xFF, 0xFF,
+	 0x01, 0x63, 0x0E, 0x60, 0x36, 0xFD, 0x10, 0x60, 0x2A, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x00, 0x64,
+	 0x08, 0x60, 0x15, 0xFB, 0x5A, 0xDB, 0xBA, 0xFE, 0x02, 0x64, 0xDB, 0xFB, 0xF1, 0xF3, 0xFF, 0xFF,
+	 0x01, 0xBC, 0xF1, 0xFB, 0x44, 0x60, 0x44, 0x64, 0x7F, 0xFB, 0x80, 0xFB, 0x81, 0xFB, 0x08, 0x60,
+	 0x00, 0x65, 0x20, 0x44, 0x34, 0x80, 0x08, 0x60, 0x77, 0xF3, 0xFF, 0xFF, 0x15, 0x18, 0xA2, 0xDF,
+	 0x40, 0x60, 0x58, 0x4E, 0x7D, 0x78, 0xFF, 0xFF, 0x1F, 0x60, 0xC4, 0x64, 0x0F, 0x60, 0xE1, 0xFB,
+	 0x4A, 0xDF, 0x01, 0x60, 0xFE, 0x63, 0x1D, 0x60, 0xBE, 0x61, 0x00, 0x64, 0x59, 0xDB, 0xFE, 0x1F,
+	 0x10, 0x60, 0x0E, 0x62, 0xA2, 0xDF, 0x5B, 0x00, 0xCF, 0xF3, 0xFF, 0xFF, 0x52, 0x1B, 0x10, 0x60,
+	 0x2A, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x24, 0x40, 0x02, 0x22, 0x26, 0x00, 0x08, 0x60, 0x1E, 0xF1,
+	 0x00, 0x60, 0x20, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x10, 0x60, 0x00, 0x64, 0x08, 0x60,
+	 0x16, 0xFB, 0xD4, 0x60, 0x1F, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x10, 0x60,
+	 0x2A, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x08, 0x60, 0x1E, 0xF1, 0x00, 0x60, 0x40, 0x64, 0xB0, 0x84,
+	 0xA2, 0xDB, 0xCF, 0xFE, 0x10, 0x60, 0x00, 0x64, 0x08, 0x60, 0x16, 0xFB, 0xD4, 0x60, 0x59, 0x64,
+	 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x24, 0x40, 0x01, 0x26, 0x11, 0x00, 0x08, 0x60,
+	 0x1E, 0xF1, 0x00, 0x60, 0x20, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x10, 0x60, 0x00, 0x64,
+	 0x08, 0x60, 0x16, 0xFB, 0xD4, 0x60, 0x59, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x08, 0x60, 0x1E, 0xF1, 0x00, 0x60, 0x40, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x10, 0x60,
+	 0x00, 0x64, 0x08, 0x60, 0x16, 0xFB, 0xD4, 0x60, 0x59, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58,
+	 0xFF, 0xFF, 0xFD, 0x60, 0x89, 0x65, 0xF3, 0x60, 0x58, 0x4E, 0x27, 0x78, 0xFF, 0xFF, 0x10, 0x60,
+	 0x2A, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x00, 0x64, 0x08, 0x60, 0x15, 0xFB, 0x5A, 0xDB, 0x10, 0x60,
+	 0x4E, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0xF7, 0x60, 0xFF, 0x65, 0x20, 0x44, 0x24, 0x80, 0x08, 0x60,
+	 0x08, 0xF1, 0x80, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0xBB, 0xFE, 0xFD, 0x60,
+	 0x40, 0x65, 0xF3, 0x60, 0x58, 0x4E, 0x27, 0x78, 0xFF, 0xFF, 0x00, 0x60, 0x03, 0x64, 0x08, 0x60,
+	 0x28, 0xFB, 0xD4, 0x60, 0x87, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x08, 0x60,
+	 0x27, 0xF1, 0x00, 0x60, 0x02, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x07, 0x03, 0xA0, 0x84, 0xA2, 0xDB,
+	 0x10, 0x60, 0x4E, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0xE2, 0x01, 0x10, 0x60, 0x4E, 0x62, 0x00, 0x64,
+	 0xA2, 0xDB, 0x00, 0x64, 0x08, 0x60, 0x27, 0xFB, 0x5A, 0xDB, 0x20, 0x40, 0x04, 0x2B, 0x14, 0x00,
+	 0x9B, 0xFE, 0x08, 0x04, 0xBB, 0xFE, 0x08, 0x60, 0x08, 0xF1, 0x80, 0x60, 0x00, 0x64, 0xB0, 0x84,
+	 0xA2, 0xDB, 0xCF, 0xFE, 0x80, 0x60, 0x00, 0x64, 0x08, 0x60, 0x16, 0xFB, 0xD4, 0x60, 0x95, 0x64,
+	 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x08, 0x60, 0x00, 0x65, 0x20, 0x44, 0x34, 0x80,
+	 0x16, 0x60, 0xCC, 0xF3, 0x00, 0x61, 0x60, 0x40, 0x00, 0x36, 0x00, 0xB9, 0x60, 0x40, 0x01, 0x36,
+	 0x01, 0xB9, 0x60, 0x40, 0x02, 0x36, 0x06, 0xB9, 0x60, 0x40, 0x03, 0x36, 0x07, 0xB9, 0x41, 0x44,
+	 0x10, 0x60, 0x2A, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0xDE, 0xFE, 0x0A, 0x04, 0x40, 0x60, 0x00, 0x64,
+	 0x08, 0x60, 0x16, 0xFB, 0xD4, 0x60, 0xC8, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x7D, 0xF1, 0x13, 0x60, 0x1A, 0xF9, 0x0C, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x2D, 0xFF, 0x20, 0x60,
+	 0x00, 0x64, 0x08, 0x60, 0x16, 0xFB, 0xD4, 0x60, 0xE9, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58,
+	 0xFF, 0xFF, 0x10, 0x60, 0x2A, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0xBE, 0xFE, 0x08, 0x60, 0x08, 0xF1,
+	 0x40, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x75, 0x00, 0x10, 0x60, 0x2A, 0x62,
+	 0x00, 0x64, 0xA2, 0xDB, 0xBA, 0xFE, 0x02, 0x64, 0xDB, 0xFB, 0xF1, 0xF3, 0xFF, 0xFF, 0x01, 0xBC,
+	 0xF1, 0xFB, 0x44, 0x60, 0x44, 0x64, 0x7F, 0xFB, 0x80, 0xFB, 0x81, 0xFB, 0xFF, 0xFF, 0x20, 0x40,
+	 0x04, 0x2B, 0x14, 0x00, 0x9B, 0xFE, 0x08, 0x04, 0xBB, 0xFE, 0x08, 0x60, 0x08, 0xF1, 0x80, 0x60,
+	 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x80, 0x60, 0x00, 0x64, 0x08, 0x60, 0x16, 0xFB,
+	 0xD5, 0x60, 0x07, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x08, 0x60, 0x00, 0x65,
+	 0x20, 0x44, 0x34, 0x80, 0x08, 0x60, 0x07, 0xF1, 0x02, 0x60, 0x00, 0x65, 0x20, 0x44, 0x34, 0x80,
+	 0x64, 0x40, 0x01, 0x2A, 0x06, 0x00, 0xA2, 0xDF, 0x02, 0x65, 0xF1, 0x60, 0x58, 0x4E, 0xC3, 0x78,
+	 0xFF, 0xFF, 0xCF, 0xF3, 0x20, 0x60, 0x20, 0x65, 0x36, 0x1B, 0xA5, 0xD3, 0x24, 0x40, 0x01, 0x26,
+	 0x16, 0x00, 0x60, 0x40, 0x20, 0x26, 0x2F, 0x00, 0x01, 0xBC, 0xA5, 0xDB, 0x08, 0x60, 0x1E, 0xF1,
+	 0x00, 0x60, 0x20, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x10, 0x60, 0x00, 0x64, 0x08, 0x60,
+	 0x16, 0xFB, 0xD5, 0x60, 0x65, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x60, 0x40,
+	 0x10, 0x26, 0x19, 0x00, 0x01, 0xBC, 0xA5, 0xDB, 0x08, 0x60, 0x1E, 0xF1, 0x00, 0x60, 0x40, 0x64,
+	 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x10, 0x60, 0x00, 0x64, 0x08, 0x60, 0x16, 0xFB, 0xD5, 0x60,
+	 0x65, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0xFD, 0x60, 0x89, 0x65, 0xF3, 0x60,
+	 0x58, 0x4E, 0x27, 0x78, 0xFF, 0xFF, 0xCF, 0xF1, 0x07, 0x60, 0xE9, 0xF3, 0x64, 0x40, 0x02, 0x3A,
+	 0x0C, 0x00, 0x01, 0x63, 0x60, 0x40, 0x10, 0x22, 0x00, 0x63, 0x08, 0x60, 0xC1, 0xFD, 0x08, 0x60,
+	 0xC5, 0xFD, 0x08, 0x60, 0xC9, 0xFD, 0x08, 0x60, 0xCD, 0xFD, 0x10, 0x60, 0x2A, 0x62, 0x00, 0x64,
+	 0xA2, 0xDB, 0x01, 0x64, 0x53, 0xFB, 0x2F, 0x60, 0x02, 0x64, 0x54, 0xFB, 0x24, 0x40, 0x01, 0x26,
+	 0x11, 0x00, 0x08, 0x60, 0x12, 0xF1, 0x00, 0x60, 0x10, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE,
+	 0x10, 0x60, 0x00, 0x64, 0x08, 0x60, 0x16, 0xFB, 0xD5, 0x60, 0xAB, 0x64, 0x5A, 0xDB, 0xCF, 0xFE,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x08, 0x60, 0x12, 0xF1, 0x00, 0x60, 0x20, 0x64, 0xB0, 0x84, 0xA2, 0xDB,
+	 0xCF, 0xFE, 0x10, 0x60, 0x00, 0x64, 0x08, 0x60, 0x16, 0xFB, 0xD5, 0x60, 0xAB, 0x64, 0x5A, 0xDB,
+	 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0xFD, 0x60, 0xFF, 0x65, 0x20, 0x44, 0x24, 0x80, 0x08, 0x60,
+	 0x08, 0xF1, 0x80, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x10, 0x60, 0x2A, 0x62,
+	 0x00, 0x64, 0xA2, 0xDB, 0x86, 0xF1, 0x1B, 0x60, 0xB2, 0x63, 0xD3, 0x80, 0x20, 0x44, 0x03, 0x03,
+	 0xD8, 0x60, 0xD0, 0x78, 0xFF, 0xFF, 0x87, 0xF3, 0xFF, 0xFF, 0xD0, 0x80, 0xFF, 0xFF, 0x1B, 0x02,
+	 0x24, 0x44, 0x04, 0x22, 0x12, 0x00, 0x24, 0x44, 0x01, 0xAC, 0xFB, 0xB4, 0x40, 0x44, 0xF7, 0x60,
+	 0xFF, 0x65, 0x20, 0x44, 0x24, 0x80, 0x08, 0x60, 0x08, 0xF1, 0x80, 0x60, 0x00, 0x64, 0xB0, 0x84,
+	 0xA2, 0xDB, 0xCF, 0xFE, 0xD4, 0x60, 0xF6, 0x78, 0xFF, 0xFF, 0xD2, 0xF3, 0xFF, 0xFF, 0x00, 0xA8,
+	 0xFF, 0xFF, 0x1F, 0x02, 0x87, 0x00, 0x20, 0x44, 0x10, 0xBC, 0x40, 0x40, 0x64, 0x42, 0x5A, 0xD1,
+	 0x06, 0x63, 0xA4, 0xD1, 0xC3, 0x83, 0x7D, 0xF9, 0xBD, 0xD1, 0x7F, 0xF9, 0xBD, 0xD1, 0xFF, 0xFF,
+	 0x80, 0xF9, 0xBD, 0xD1, 0x81, 0xF9, 0x04, 0xA3, 0xBD, 0xD1, 0x33, 0x60, 0xBE, 0x64, 0x64, 0x41,
+	 0xDD, 0x81, 0xFE, 0xB1, 0xA0, 0xD9, 0x04, 0x03, 0xBD, 0xD1, 0xC9, 0x81, 0x58, 0xD9, 0xFC, 0x02,
+	 0x39, 0x00, 0xE4, 0xF3, 0x7D, 0xFB, 0x66, 0x41, 0x60, 0x40, 0x01, 0x27, 0x06, 0x00, 0x10, 0x60,
+	 0xF0, 0x63, 0x11, 0x60, 0x44, 0x65, 0x06, 0x66, 0x05, 0x00, 0x11, 0x60, 0x60, 0x63, 0x12, 0x60,
+	 0x40, 0x65, 0x08, 0x66, 0xA3, 0xD1, 0x4B, 0x93, 0xD0, 0x80, 0xD7, 0x80, 0x02, 0x03, 0xFA, 0x04,
+	 0x04, 0x00, 0x5B, 0x93, 0x02, 0xA3, 0x01, 0x64, 0xA3, 0xDB, 0x61, 0x46, 0x2F, 0x60, 0x02, 0x61,
+	 0xA1, 0xD3, 0xFF, 0xFF, 0x00, 0xA8, 0x33, 0x60, 0xBE, 0x63, 0x02, 0x02, 0x2D, 0x60, 0x10, 0x61,
+	 0xA1, 0xD3, 0xBD, 0xDB, 0xDC, 0x84, 0xFE, 0xB4, 0x59, 0xD1, 0xC8, 0x84, 0xBD, 0xD9, 0xFC, 0x02,
+	 0xEC, 0xF3, 0x72, 0x45, 0xEB, 0xF3, 0x94, 0x83, 0x81, 0xFD, 0x94, 0x83, 0x80, 0xFD, 0x65, 0x5F,
+	 0x02, 0x64, 0x7F, 0xFB, 0x10, 0x60, 0x2A, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0xDE, 0xFE, 0x0A, 0x04,
+	 0x40, 0x60, 0x00, 0x64, 0x08, 0x60, 0x16, 0xFB, 0xD6, 0x60, 0x3A, 0x64, 0x5A, 0xDB, 0xCF, 0xFE,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x7D, 0xF1, 0x13, 0x60, 0x1A, 0xF9, 0x0E, 0x64, 0x4A, 0xDB, 0xFF, 0xFF,
+	 0x2D, 0xFF, 0x20, 0x60, 0x00, 0x64, 0x08, 0x60, 0x16, 0xFB, 0xD6, 0x60, 0x5B, 0x64, 0x5A, 0xDB,
+	 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x10, 0x60, 0x2A, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0xBE, 0xFE,
+	 0x08, 0x60, 0x08, 0xF1, 0x40, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0xD7, 0x60,
+	 0x7B, 0x78, 0xFF, 0xFF, 0xFF, 0x60, 0xEF, 0x65, 0x20, 0x44, 0x24, 0x80, 0x02, 0x64, 0xDB, 0xFB,
+	 0xF1, 0xF3, 0xFF, 0xFF, 0x01, 0xBC, 0xF1, 0xFB, 0xF7, 0x60, 0xFF, 0x65, 0x20, 0x44, 0x24, 0x80,
+	 0x08, 0x60, 0x08, 0xF1, 0x80, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x10, 0x60,
+	 0x2A, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x24, 0x44, 0x02, 0x22, 0x03, 0x00, 0x01, 0xAC, 0x04, 0xBC,
+	 0x40, 0x44, 0x32, 0x40, 0x80, 0x2A, 0x8C, 0x00, 0x10, 0x60, 0x2A, 0x62, 0x00, 0x64, 0xA2, 0xDB,
+	 0xDE, 0xFE, 0x0A, 0x04, 0x40, 0x60, 0x00, 0x64, 0x08, 0x60, 0x16, 0xFB, 0xD6, 0x60, 0x8C, 0x64,
+	 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x10, 0x60, 0x2A, 0x62, 0x00, 0x64, 0xA2, 0xDB,
+	 0x95, 0xF3, 0xFF, 0xFF, 0x7F, 0xB4, 0x95, 0xFB, 0x26, 0x60, 0x34, 0x62, 0x06, 0x64, 0x4A, 0xDB,
+	 0xFF, 0xFF, 0x2D, 0xFF, 0xFF, 0xFF, 0xBE, 0xFE, 0x08, 0x60, 0x08, 0xF1, 0x40, 0x60, 0x00, 0x64,
+	 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0xDA, 0xFE, 0x10, 0x60, 0x2A, 0x62, 0x00, 0x64, 0xA2, 0xDB,
+	 0x12, 0x60, 0xFF, 0xF3, 0xFF, 0xFF, 0x00, 0xA8, 0x60, 0x46, 0x05, 0x03, 0x0E, 0xF2, 0xFF, 0xFF,
+	 0x60, 0x40, 0x01, 0x2A, 0x22, 0x00, 0x13, 0x60, 0x02, 0xF3, 0xFF, 0xFF, 0x00, 0xA8, 0x60, 0x46,
+	 0x03, 0x03, 0x0F, 0xF2, 0xFF, 0xFF, 0x19, 0x1B, 0x08, 0x60, 0x00, 0x64, 0x08, 0x60, 0x16, 0xFB,
+	 0xD6, 0x60, 0xE5, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x01, 0x64, 0x19, 0x60, 0xF1, 0xFB, 0x19, 0x60,
+	 0xF6, 0xF1, 0xFF, 0xFF, 0x64, 0x40, 0x01, 0x26, 0x05, 0x00, 0x89, 0xFF, 0x08, 0x60, 0x00, 0x75,
+	 0x88, 0xFF, 0x01, 0x00, 0x10, 0xFF, 0x2F, 0x58, 0xFF, 0xFF, 0x10, 0x60, 0x2A, 0x62, 0x00, 0x64,
+	 0xA2, 0xDB, 0xDE, 0xFE, 0x0A, 0x04, 0x40, 0x60, 0x00, 0x64, 0x08, 0x60, 0x16, 0xFB, 0xD6, 0x60,
+	 0xE5, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x10, 0x60, 0x2A, 0x62, 0x00, 0x64,
+	 0xA2, 0xDB, 0x7D, 0xF1, 0x13, 0x60, 0x1A, 0xF9, 0x08, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x2D, 0xFF,
+	 0x20, 0x60, 0x00, 0x64, 0x08, 0x60, 0x16, 0xFB, 0xD7, 0x60, 0x0A, 0x64, 0x5A, 0xDB, 0xCF, 0xFE,
+	 0x2F, 0x58, 0xFF, 0xFF, 0xBE, 0xFE, 0x08, 0x60, 0x08, 0xF1, 0x40, 0x60, 0x00, 0x64, 0xB0, 0x84,
+	 0xA2, 0xDB, 0xCF, 0xFE, 0xBA, 0xFE, 0x10, 0x60, 0x2A, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x1E, 0x00,
+	 0xDA, 0xFE, 0xC1, 0xFE, 0x0E, 0x60, 0x36, 0xF1, 0x0E, 0x60, 0x4B, 0xF9, 0x1C, 0x60, 0x92, 0x64,
+	 0x13, 0x60, 0x22, 0xFB, 0x02, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x00, 0x60, 0x06, 0x64,
+	 0x08, 0x60, 0x16, 0xFB, 0xD7, 0x60, 0x4E, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x00, 0x60, 0x02, 0x64,
+	 0x08, 0x60, 0x28, 0xFB, 0xD7, 0x60, 0x55, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x1C, 0x60, 0x6C, 0x61,
+	 0x75, 0x60, 0x30, 0x65, 0xA1, 0xD3, 0xFF, 0xFF, 0xFF, 0xA0, 0xE0, 0x84, 0x02, 0x02, 0x03, 0x60,
+	 0xE8, 0x64, 0xD4, 0x80, 0xFF, 0xFF, 0x01, 0x04, 0x65, 0x44, 0xA1, 0xDB, 0x32, 0x40, 0x80, 0x2A,
+	 0x03, 0x00, 0xD4, 0x60, 0xF6, 0x78, 0xFF, 0xFF, 0x2F, 0x58, 0xFF, 0xFF, 0x00, 0x64, 0x08, 0x60,
+	 0x27, 0xFB, 0x5A, 0xDB, 0xD4, 0x60, 0xF6, 0x78, 0xFF, 0xFF, 0x20, 0x40, 0x06, 0x23, 0x10, 0x00,
+	 0x08, 0x60, 0x27, 0xF1, 0x7F, 0x60, 0xFF, 0x64, 0xA0, 0x84, 0xA2, 0xDB, 0x80, 0x60, 0x00, 0x64,
+	 0x08, 0x60, 0x28, 0xFB, 0xD7, 0x60, 0x55, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x10, 0x60, 0x4E, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x00, 0x64, 0x08, 0x60, 0x27, 0xFB, 0x5A, 0xDB,
+	 0x1C, 0x60, 0x92, 0x64, 0x13, 0x60, 0x22, 0xFB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF,
+	 0xD3, 0x60, 0xD0, 0x78, 0xFF, 0xFF, 0x78, 0xF3, 0x79, 0xFB, 0x20, 0x60, 0x14, 0x62, 0xA2, 0xDF,
+	 0xFF, 0x60, 0xDF, 0x65, 0x20, 0x44, 0x24, 0x80, 0xBC, 0xF1, 0x0E, 0x60, 0x4B, 0xF9, 0x1C, 0x60,
+	 0x92, 0x64, 0x13, 0x60, 0x22, 0xFB, 0x02, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0xF7, 0x60,
+	 0xFF, 0x65, 0x20, 0x44, 0x24, 0x80, 0x10, 0x26, 0x38, 0x00, 0x00, 0x64, 0xB2, 0xFB, 0xB3, 0xFB,
+	 0xB4, 0xFB, 0x00, 0x75, 0x00, 0x72, 0xBA, 0xF1, 0x7E, 0xF9, 0x64, 0x44, 0xE0, 0x84, 0xE0, 0x84,
+	 0xE0, 0x84, 0xE0, 0x93, 0xE5, 0xF1, 0x84, 0xF9, 0x7D, 0xF3, 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x27,
+	 0x1E, 0x00, 0x19, 0x60, 0x44, 0xF3, 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x2A, 0x0A, 0x00, 0x0F, 0x64,
+	 0xFC, 0x60, 0x58, 0x4E, 0x34, 0x78, 0xFF, 0xFF, 0x67, 0x43, 0x1A, 0x60, 0xB3, 0xFD, 0x1A, 0x60,
+	 0xC3, 0xFD, 0xD3, 0x60, 0x58, 0x4E, 0x78, 0x78, 0xFF, 0xFF, 0x00, 0x65, 0xFC, 0x60, 0x58, 0x4E,
+	 0xC7, 0x78, 0xFF, 0xFF, 0xFD, 0x60, 0x58, 0x4E, 0x11, 0x78, 0xFF, 0xFF, 0x05, 0x00, 0xFF, 0x65,
+	 0xFC, 0x60, 0x58, 0x4E, 0xC7, 0x78, 0xFF, 0xFF, 0x44, 0x00, 0x10, 0x60, 0x2A, 0x62, 0x00, 0x64,
+	 0xA2, 0xDB, 0x00, 0x60, 0x84, 0x64, 0x08, 0x60, 0x16, 0xFB, 0xD7, 0x60, 0xDB, 0x64, 0x5A, 0xDB,
+	 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x08, 0x60, 0x15, 0xF1, 0x00, 0x60, 0x80, 0x64, 0xA0, 0x80,
+	 0x9C, 0x84, 0x2B, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x08, 0x60, 0x15, 0xF1, 0xFF, 0x60, 0x7F, 0x61,
+	 0xA1, 0x84, 0x5A, 0xD1, 0x4A, 0xDB, 0xA1, 0x84, 0x5A, 0xDB, 0x2E, 0x60, 0x2E, 0x64, 0x2D, 0x60,
+	 0x8A, 0x63, 0xA0, 0xD1, 0xA3, 0xD9, 0x64, 0x41, 0x58, 0xD1, 0x5B, 0xD9, 0x7D, 0xF3, 0x66, 0x45,
+	 0xA6, 0xF5, 0x60, 0x40, 0x01, 0x27, 0x08, 0x00, 0x91, 0xFA, 0x61, 0x44, 0xFD, 0x60, 0x58, 0x4E,
+	 0xAC, 0x78, 0xFF, 0xFF, 0x12, 0xFA, 0x07, 0x00, 0x11, 0xF8, 0x64, 0x44, 0xFD, 0x60, 0x58, 0x4E,
+	 0xAC, 0x78, 0xFF, 0xFF, 0x12, 0xFA, 0x65, 0x46, 0x04, 0x00, 0xBB, 0xFE, 0xD4, 0x60, 0xF6, 0x78,
+	 0xFF, 0xFF, 0x16, 0x60, 0xC2, 0xF1, 0x00, 0x65, 0x64, 0x40, 0x01, 0x36, 0x22, 0x65, 0x64, 0x40,
+	 0x07, 0x36, 0x01, 0x65, 0x64, 0x40, 0x0A, 0x36, 0x01, 0x65, 0x64, 0x40, 0x0B, 0x36, 0x22, 0x65,
+	 0xA6, 0xF3, 0x66, 0x5C, 0x60, 0x46, 0x1F, 0x63, 0xE3, 0x83, 0xBA, 0xF8, 0x02, 0xA6, 0x66, 0x44,
+	 0xFC, 0x1F, 0x16, 0x60, 0xC2, 0xF3, 0xFF, 0xFF, 0x60, 0x40, 0x07, 0x36, 0x03, 0x00, 0x0A, 0x36,
+	 0x06, 0x00, 0x09, 0x00, 0xA6, 0xF3, 0x04, 0x65, 0x60, 0x46, 0xBA, 0xF8, 0x04, 0x00, 0xA6, 0xF3,
+	 0x10, 0x65, 0x60, 0x46, 0xBA, 0xF8, 0x64, 0x46, 0xA6, 0xF3, 0x32, 0x41, 0x60, 0x45, 0x08, 0xB1,
+	 0x66, 0x41, 0x16, 0x03, 0x65, 0x46, 0x17, 0x60, 0x80, 0xF3, 0x06, 0xF0, 0xE0, 0x84, 0xE0, 0x84,
+	 0xE0, 0x84, 0xE0, 0x84, 0x80, 0xBF, 0xB0, 0x84, 0x06, 0xFA, 0x66, 0x43, 0x02, 0xA3, 0x63, 0x46,
+	 0x06, 0xF0, 0xFF, 0xFF, 0xB0, 0x84, 0x06, 0xFA, 0x61, 0x46, 0x32, 0x44, 0x10, 0xBC, 0x40, 0x52,
+	 0x01, 0x64, 0x10, 0x60, 0x0A, 0xFB, 0x0F, 0x4E, 0xEF, 0x60, 0x58, 0x4F, 0x3A, 0x78, 0xFF, 0xFF,
+	 0x0E, 0x4F, 0x08, 0x60, 0x15, 0xF1, 0xFF, 0x60, 0xFB, 0x64, 0xA0, 0x84, 0xA2, 0xDB, 0x00, 0x60,
+	 0x04, 0x64, 0x08, 0x60, 0x16, 0xFB, 0xD3, 0x60, 0xAE, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x1C, 0x60,
+	 0x92, 0x64, 0x13, 0x60, 0x22, 0xFB, 0x02, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0xBB, 0xFE,
+	 0x20, 0x44, 0x04, 0x27, 0x11, 0x00, 0x10, 0x26, 0x02, 0x00, 0xDB, 0xFE, 0x14, 0x00, 0x08, 0x60,
+	 0x07, 0xF3, 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x36, 0x07, 0x00, 0x01, 0x64, 0xA2, 0xDB, 0x01, 0x65,
+	 0xF1, 0x60, 0x58, 0x4E, 0xC3, 0x78, 0xFF, 0xFF, 0x08, 0x60, 0x08, 0xF1, 0x80, 0x60, 0x00, 0x64,
+	 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x01, 0x64, 0x8A, 0xFB, 0xFF, 0x60, 0xEF, 0x65, 0x20, 0x44,
+	 0x24, 0x80, 0x03, 0x64, 0xDB, 0xFB, 0xF1, 0xF3, 0xFF, 0xFF, 0xFE, 0xB4, 0xF1, 0xFB, 0xC1, 0xFE,
+	 0x00, 0x60, 0x02, 0x64, 0x08, 0x60, 0x28, 0xFB, 0xD8, 0x60, 0xAA, 0x64, 0x5A, 0xDB, 0xCF, 0xFE,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x20, 0x40, 0x06, 0x23, 0x10, 0x00, 0x08, 0x60, 0x27, 0xF1, 0x7F, 0x60,
+	 0xFF, 0x64, 0xA0, 0x84, 0xA2, 0xDB, 0x80, 0x60, 0x00, 0x64, 0x08, 0x60, 0x28, 0xFB, 0xD8, 0x60,
+	 0xAA, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x10, 0x60, 0x4E, 0x62, 0x00, 0x64,
+	 0xA2, 0xDB, 0x00, 0x64, 0x08, 0x60, 0x27, 0xFB, 0x5A, 0xDB, 0x1C, 0x60, 0x92, 0x64, 0x13, 0x60,
+	 0x22, 0xFB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0xD3, 0x60, 0xD0, 0x78, 0xFF, 0xFF,
+	 0xBB, 0xFE, 0xD9, 0x60, 0xB0, 0x78, 0xFF, 0xFF, 0x16, 0x60, 0xC2, 0xF1, 0x00, 0x65, 0x64, 0x40,
+	 0x01, 0x36, 0x22, 0x65, 0xA6, 0xF3, 0x66, 0x5C, 0x60, 0x46, 0x1F, 0x63, 0xE3, 0x83, 0xBA, 0xF8,
+	 0x02, 0xA6, 0x66, 0x44, 0xFC, 0x1F, 0x64, 0x46, 0xA6, 0xF1, 0x02, 0x64, 0xC0, 0x85, 0x0C, 0x61,
+	 0x32, 0x40, 0x08, 0x2A, 0x14, 0x00, 0x17, 0x60, 0x80, 0xF3, 0x66, 0x41, 0x65, 0x46, 0x06, 0xF0,
+	 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0x80, 0xBF, 0xB0, 0x83, 0x06, 0xFC, 0x66, 0x42,
+	 0xFE, 0xA2, 0x62, 0x46, 0x06, 0xF0, 0xFF, 0xFF, 0xB0, 0x84, 0x06, 0xFA, 0x61, 0x46, 0x0B, 0x64,
+	 0xDB, 0xFB, 0xF1, 0xF3, 0xFF, 0xFF, 0xFE, 0xB4, 0xF1, 0xFB, 0x01, 0x65, 0xF1, 0x60, 0x58, 0x4E,
+	 0xC3, 0x78, 0xFF, 0xFF, 0xE4, 0xF1, 0x7D, 0xF9, 0x10, 0x60, 0x2A, 0x62, 0x00, 0x64, 0xA2, 0xDB,
+	 0xDE, 0xFE, 0x0A, 0x04, 0x40, 0x60, 0x00, 0x64, 0x08, 0x60, 0x16, 0xFB, 0xD9, 0x60, 0x0C, 0x64,
+	 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x7D, 0xF1, 0x13, 0x60, 0x1A, 0xF9, 0x0E, 0x64,
+	 0x4A, 0xDB, 0xFF, 0xFF, 0x2D, 0xFF, 0x20, 0x60, 0x00, 0x64, 0x08, 0x60, 0x16, 0xFB, 0xD9, 0x60,
+	 0x2D, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x00, 0x64, 0x08, 0x60, 0x15, 0xFB,
+	 0x5A, 0xDB, 0xBE, 0xFE, 0x08, 0x60, 0x08, 0xF1, 0x40, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB,
+	 0xCF, 0xFE, 0x01, 0x64, 0x8A, 0xFB, 0xFF, 0x60, 0xDF, 0x65, 0x20, 0x44, 0x24, 0x80, 0x2F, 0x58,
+	 0xFF, 0xFF, 0x06, 0x64, 0xDB, 0xFB, 0xF1, 0xF3, 0xFF, 0xFF, 0xFE, 0xB4, 0xF1, 0xFB, 0xE4, 0xF1,
+	 0x7D, 0xF9, 0x10, 0x60, 0x2A, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x01, 0x64, 0x8A, 0xFB, 0xFF, 0x60,
+	 0xDF, 0x65, 0x20, 0x44, 0x24, 0x80, 0xA6, 0xF1, 0x66, 0x45, 0x64, 0x46, 0x66, 0x43, 0x02, 0xA3,
+	 0x63, 0x46, 0x02, 0x64, 0x06, 0xFA, 0x04, 0x63, 0x04, 0x61, 0x01, 0x60, 0xCC, 0x64, 0x58, 0xD1,
+	 0x59, 0xD8, 0xFD, 0x1F, 0x65, 0x46, 0x01, 0x65, 0xF1, 0x60, 0x58, 0x4E, 0xC3, 0x78, 0xFF, 0xFF,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x00, 0x64, 0x67, 0xFB, 0x68, 0xFB, 0xA6, 0xF1, 0x0E, 0x64, 0x66, 0x41,
+	 0x64, 0x42, 0x02, 0xA2, 0x62, 0x46, 0x06, 0xF0, 0xFF, 0x60, 0xFC, 0x64, 0xA0, 0x84, 0x06, 0xFA,
+	 0x61, 0x46, 0xDB, 0xF3, 0xFF, 0xFF, 0x04, 0xA8, 0x10, 0x60, 0x0E, 0x64, 0x07, 0x03, 0xA0, 0xD1,
+	 0xFF, 0xFF, 0x64, 0x40, 0x01, 0x2A, 0x02, 0x00, 0x00, 0x63, 0xA0, 0xDD, 0x01, 0x64, 0xDB, 0xFB,
+	 0xF1, 0xF3, 0xFF, 0xFF, 0xFE, 0xB4, 0xF1, 0xFB, 0x00, 0x63, 0x08, 0x60, 0x77, 0xFD, 0x10, 0x60,
+	 0x4E, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x00, 0x64, 0x08, 0x60, 0x27, 0xFB, 0x5A, 0xDB, 0x10, 0x60,
+	 0x2A, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x00, 0x60, 0x02, 0x64, 0x08, 0x60, 0x16, 0xFB, 0xD3, 0x60,
+	 0x9C, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x08, 0x60, 0x15, 0xF1, 0x00, 0x60,
+	 0x04, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x2E, 0x58, 0xFF, 0xFF,
+	 0x40, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0xB9, 0xF1, 0x0E, 0x60, 0x4B, 0xF9, 0x5F, 0xF5, 0xEA, 0xF1,
+	 0x2F, 0xF8, 0xEB, 0xF1, 0x30, 0xF8, 0xEC, 0xF1, 0x31, 0xF8, 0xB9, 0xF1, 0x19, 0xF8, 0xF8, 0x60,
+	 0x80, 0x64, 0x0E, 0xFA, 0x00, 0x64, 0x3E, 0xFA, 0xA6, 0xF1, 0x07, 0xF8, 0x1B, 0x60, 0xB0, 0x64,
+	 0x00, 0x60, 0x67, 0xFB, 0x44, 0x60, 0x44, 0x64, 0x7F, 0xFB, 0x80, 0xFB, 0x81, 0xFB, 0x31, 0x44,
+	 0xF9, 0xB4, 0x40, 0x51, 0x00, 0x60, 0xCE, 0x63, 0x01, 0x60, 0x0C, 0x65, 0xA3, 0xD3, 0xA5, 0xD1,
+	 0x04, 0xA4, 0xA3, 0xDB, 0xD0, 0x80, 0xA0, 0xD1, 0x0A, 0x06, 0x41, 0x64, 0x3B, 0x42, 0x5A, 0xDB,
+	 0x10, 0x60, 0x2A, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0xD6, 0x60, 0x6A, 0x78, 0xFF, 0xFF, 0x44, 0x47,
+	 0x16, 0x60, 0xC2, 0xF3, 0xFF, 0xFF, 0xFF, 0xA4, 0xFF, 0xFF, 0x09, 0x07, 0x0E, 0x61, 0x41, 0xD3,
+	 0x32, 0x40, 0x08, 0x26, 0x04, 0x00, 0x10, 0xB0, 0xFF, 0xFF, 0x01, 0x03, 0xD3, 0x01, 0x42, 0x64,
+	 0x3B, 0x42, 0x5A, 0xDB, 0x10, 0x60, 0x2A, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0xDE, 0xFE, 0x0A, 0x04,
+	 0x40, 0x60, 0x00, 0x64, 0x08, 0x60, 0x16, 0xFB, 0xD9, 0x60, 0xFA, 0x64, 0x5A, 0xDB, 0xCF, 0xFE,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x27, 0xD1, 0x7D, 0xF9, 0x13, 0x60, 0x1A, 0xF9, 0x0E, 0x64, 0x4A, 0xDB,
+	 0xFF, 0xFF, 0x2D, 0xFF, 0x20, 0x60, 0x00, 0x64, 0x08, 0x60, 0x16, 0xFB, 0xDA, 0x60, 0x1C, 0x64,
+	 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x10, 0x60, 0x2A, 0x62, 0x00, 0x64, 0xA2, 0xDB,
+	 0xBE, 0xFE, 0x08, 0x60, 0x08, 0xF1, 0x40, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE,
+	 0x07, 0x60, 0xD0, 0x64, 0x0E, 0x60, 0x4B, 0xFB, 0x1C, 0x60, 0x92, 0x64, 0x13, 0x60, 0x22, 0xFB,
+	 0x02, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x27, 0x43, 0x06, 0xA3, 0xBD, 0xD3, 0x7F, 0xFB,
+	 0xBD, 0xD3, 0x80, 0xFB, 0xA3, 0xD3, 0x81, 0xFB, 0x10, 0x60, 0x2A, 0x62, 0x00, 0x64, 0xA2, 0xDB,
+	 0x01, 0x60, 0x04, 0x64, 0x08, 0x60, 0x16, 0xFB, 0xDA, 0x60, 0x4A, 0x64, 0x5A, 0xDB, 0xCF, 0xFE,
+	 0x2F, 0x58, 0xFF, 0xFF, 0xB9, 0xF1, 0x0E, 0x60, 0x4B, 0xF9, 0x08, 0x60, 0x15, 0xF1, 0xFE, 0x60,
+	 0xFF, 0x61, 0xA1, 0x84, 0x5A, 0xD1, 0x4A, 0xDB, 0xA1, 0x84, 0x5A, 0xDB, 0x08, 0x60, 0x15, 0xF1,
+	 0x00, 0x60, 0x04, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x05, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0xD9, 0x60,
+	 0xCA, 0x78, 0xFF, 0xFF, 0x00, 0x60, 0x08, 0x65, 0x20, 0x44, 0x34, 0x80, 0x7D, 0xF1, 0x32, 0x60,
+	 0x7A, 0x61, 0xA1, 0xD3, 0x64, 0x40, 0x01, 0x27, 0x59, 0xD3, 0x32, 0x60, 0x7E, 0x61, 0xFD, 0x60,
+	 0x58, 0x4E, 0xAC, 0x78, 0xFF, 0xFF, 0xA1, 0xDB, 0x5E, 0xF5, 0xEA, 0xF1, 0x2F, 0xF8, 0xEB, 0xF1,
+	 0x30, 0xF8, 0xEC, 0xF1, 0x31, 0xF8, 0xB9, 0xF1, 0x19, 0xF8, 0x80, 0x7E, 0xF8, 0x7F, 0x0E, 0xFA,
+	 0x00, 0x64, 0x3E, 0xFA, 0xA6, 0xF1, 0x07, 0xF8, 0x2B, 0xFA, 0xB0, 0x64, 0x2A, 0xFA, 0x27, 0x43,
+	 0x06, 0xA3, 0xBD, 0xD1, 0x2C, 0xF8, 0x32, 0xF8, 0xBD, 0xD1, 0x2D, 0xF8, 0x33, 0xF8, 0xA3, 0xD1,
+	 0x2E, 0xF8, 0x34, 0xF8, 0x06, 0x63, 0x3F, 0xFC, 0x20, 0x60, 0x16, 0x61, 0xDB, 0xF3, 0xA1, 0xD3,
+	 0x03, 0xA8, 0xAC, 0x83, 0x0E, 0x02, 0x0D, 0x03, 0x20, 0x60, 0x18, 0x61, 0xA1, 0xD1, 0x66, 0x45,
+	 0x00, 0xF4, 0x09, 0xFC, 0x01, 0x64, 0x0A, 0xFA, 0x0B, 0xF8, 0x20, 0x60, 0x16, 0x61, 0xA1, 0xDF,
+	 0x25, 0x00, 0x16, 0x60, 0xC3, 0xF3, 0x66, 0x45, 0x00, 0xF4, 0x60, 0x40, 0x01, 0x36, 0x15, 0x00,
+	 0x02, 0x36, 0xBD, 0x00, 0x03, 0x36, 0x07, 0x00, 0x04, 0x36, 0x0F, 0x00, 0x05, 0x36, 0xB7, 0x00,
+	 0x06, 0x36, 0x01, 0x00, 0x0A, 0x00, 0x80, 0x64, 0x09, 0xFA, 0x01, 0x63, 0x0A, 0xFC, 0x00, 0x64,
+	 0x0B, 0xFA, 0x80, 0x60, 0xF4, 0x62, 0xA2, 0xDF, 0x09, 0x00, 0x00, 0x64, 0x09, 0xFA, 0x01, 0x63,
+	 0x0A, 0xFC, 0x00, 0x64, 0x0B, 0xFA, 0x80, 0x60, 0xF4, 0x62, 0xA2, 0xDF, 0x25, 0x60, 0xCE, 0x64,
+	 0x13, 0x60, 0x0D, 0xFB, 0x65, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF,
+	 0x00, 0x66, 0xDB, 0xF3, 0x46, 0x46, 0xFD, 0xA0, 0xC1, 0xFE, 0x02, 0x02, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x01, 0x64, 0x68, 0xFB, 0x43, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0x0E, 0x60, 0x38, 0xF3, 0xFF, 0xFF,
+	 0x64, 0xA4, 0xA2, 0xDB, 0x0E, 0x60, 0x38, 0xF1, 0x0E, 0x60, 0x4B, 0xF9, 0x1C, 0x60, 0x92, 0x64,
+	 0x13, 0x60, 0x22, 0xFB, 0x02, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x00, 0x60, 0x0C, 0x64,
+	 0x08, 0x60, 0x16, 0xFB, 0xDB, 0x60, 0x00, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x08, 0x60, 0x15, 0xF1, 0x00, 0x60, 0x08, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x55, 0x03, 0xA0, 0x84,
+	 0xA2, 0xDB, 0x1C, 0x60, 0x92, 0x64, 0x13, 0x60, 0x22, 0xFB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF,
+	 0x04, 0xFF, 0x00, 0x64, 0x68, 0xFB, 0x10, 0x60, 0x2A, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x26, 0x46,
+	 0x00, 0xF4, 0x09, 0xF2, 0x0A, 0xF2, 0x00, 0xA8, 0x0B, 0xF2, 0x02, 0xA8, 0x16, 0x02, 0x00, 0xA8,
+	 0x1A, 0x02, 0x19, 0x02, 0x26, 0x46, 0x26, 0x60, 0x1A, 0x64, 0x40, 0x4B, 0x34, 0x60, 0x58, 0x4D,
+	 0x08, 0x78, 0xFF, 0xFF, 0x00, 0x66, 0x46, 0x46, 0x20, 0x40, 0x08, 0x2A, 0x03, 0x00, 0xDC, 0x60,
+	 0xF6, 0x78, 0xFF, 0xFF, 0xE3, 0x60, 0x69, 0x78, 0xFF, 0xFF, 0x09, 0xF2, 0x0A, 0xF2, 0x80, 0xA8,
+	 0x0B, 0xF2, 0x02, 0xA8, 0xE4, 0x03, 0x44, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0x0B, 0xF2, 0x26, 0x46,
+	 0x40, 0x59, 0x02, 0x60, 0x00, 0x61, 0x2F, 0xF2, 0xA1, 0xDB, 0x30, 0xF2, 0x41, 0x58, 0x59, 0xDB,
+	 0x31, 0xF2, 0x59, 0xDB, 0x26, 0x46, 0x26, 0x60, 0x1A, 0x64, 0x40, 0x4B, 0x34, 0x60, 0x58, 0x4D,
+	 0x08, 0x78, 0xFF, 0xFF, 0x00, 0x66, 0x46, 0x46, 0x03, 0x65, 0xF1, 0x60, 0x58, 0x4E, 0x96, 0x78,
+	 0xFF, 0xFF, 0xE7, 0x60, 0x0B, 0x78, 0xFF, 0xFF, 0xFF, 0x60, 0xFB, 0x64, 0xA0, 0x84, 0xA2, 0xDB,
+	 0x00, 0x64, 0x68, 0xFB, 0x10, 0x60, 0x2A, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x20, 0x40, 0x08, 0x2A,
+	 0x03, 0x00, 0xD9, 0x60, 0xCA, 0x78, 0xFF, 0xFF, 0xE2, 0x60, 0x73, 0x78, 0xFF, 0xFF, 0x01, 0x63,
+	 0x09, 0xFC, 0x32, 0x40, 0x08, 0x26, 0x14, 0x00, 0x16, 0x60, 0xC2, 0xF3, 0xFF, 0xFF, 0x60, 0x40,
+	 0x0B, 0x36, 0x03, 0x00, 0xDA, 0x60, 0xC5, 0x78, 0xFF, 0xFF, 0x01, 0x64, 0xA2, 0xDB, 0x0B, 0x64,
+	 0x19, 0x60, 0xA4, 0xFB, 0xA6, 0xF1, 0x66, 0x41, 0x64, 0x46, 0x22, 0x64, 0x3A, 0xFA, 0x61, 0x46,
+	 0x01, 0x64, 0x0A, 0xFA, 0x00, 0x64, 0x0B, 0xFA, 0x01, 0x64, 0x40, 0x60, 0x7A, 0xFB, 0x01, 0x64,
+	 0x68, 0xFB, 0x10, 0x60, 0x2A, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x25, 0x60, 0xCE, 0x64, 0x13, 0x60,
+	 0x0D, 0xFB, 0x65, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0x00, 0x66,
+	 0xDB, 0xF3, 0x46, 0x46, 0xFD, 0xA0, 0xC1, 0xFE, 0x02, 0x02, 0x2F, 0x58, 0xFF, 0xFF, 0x1C, 0x60,
+	 0x92, 0x64, 0x13, 0x60, 0x22, 0xFB, 0x02, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x00, 0x60,
+	 0x0C, 0x64, 0x08, 0x60, 0x16, 0xFB, 0xDB, 0x60, 0xB9, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58,
+	 0xFF, 0xFF, 0x08, 0x60, 0x15, 0xF1, 0x00, 0x60, 0x08, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x3A, 0x03,
+	 0xA0, 0x84, 0xA2, 0xDB, 0x1C, 0x60, 0x92, 0x64, 0x13, 0x60, 0x22, 0xFB, 0x03, 0x64, 0x4A, 0xDB,
+	 0xFF, 0xFF, 0x04, 0xFF, 0x00, 0x64, 0x68, 0xFB, 0x26, 0x46, 0x00, 0xF4, 0x09, 0xF2, 0x0A, 0xF2,
+	 0x01, 0xA8, 0x0B, 0xF2, 0x02, 0xA8, 0x04, 0x02, 0x00, 0xA8, 0x02, 0x02, 0x01, 0x02, 0x31, 0x00,
+	 0xDC, 0x60, 0x58, 0x4D, 0xB9, 0x78, 0xFF, 0xFF, 0x0B, 0xF2, 0x26, 0x46, 0x40, 0x59, 0x02, 0x60,
+	 0x00, 0x61, 0x2F, 0xF2, 0xA1, 0xDB, 0x30, 0xF2, 0x41, 0x58, 0x59, 0xDB, 0x31, 0xF2, 0x59, 0xDB,
+	 0x26, 0x46, 0x26, 0x60, 0x1A, 0x64, 0x40, 0x4B, 0x34, 0x60, 0x58, 0x4D, 0x08, 0x78, 0xFF, 0xFF,
+	 0x00, 0x66, 0x46, 0x46, 0x03, 0x65, 0xF1, 0x60, 0x58, 0x4E, 0x96, 0x78, 0xFF, 0xFF, 0xE7, 0x60,
+	 0x0B, 0x78, 0xFF, 0xFF, 0xDC, 0x60, 0x58, 0x4D, 0xB9, 0x78, 0xFF, 0xFF, 0x00, 0x64, 0x68, 0xFB,
+	 0x20, 0x40, 0x08, 0x2A, 0x03, 0x00, 0xD9, 0x60, 0xCA, 0x78, 0xFF, 0xFF, 0xE2, 0x60, 0x73, 0x78,
+	 0xFF, 0xFF, 0x26, 0x46, 0x40, 0x60, 0x00, 0x65, 0x2A, 0xF2, 0x2F, 0xF0, 0xB4, 0x84, 0x2A, 0xFA,
+	 0x2C, 0xF8, 0x32, 0xF8, 0x30, 0xF2, 0x2D, 0xFA, 0x33, 0xFA, 0x31, 0xF2, 0x2E, 0xFA, 0x34, 0xFA,
+	 0xEA, 0xF3, 0x2F, 0xFA, 0xEB, 0xF3, 0x30, 0xFA, 0xEC, 0xF3, 0x31, 0xFA, 0xC9, 0xF1, 0x19, 0xF8,
+	 0x1C, 0xF0, 0x13, 0xF8, 0x00, 0x64, 0x3E, 0xFA, 0x00, 0xF4, 0x03, 0x64, 0x0A, 0xFA, 0x00, 0x64,
+	 0x0B, 0xFA, 0x01, 0x63, 0x68, 0xFD, 0x10, 0x60, 0x2A, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x25, 0x60,
+	 0xCE, 0x64, 0x13, 0x60, 0x0D, 0xFB, 0x26, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF,
+	 0x2B, 0xFF, 0x00, 0x66, 0xDB, 0xF3, 0x46, 0x46, 0xFD, 0xA0, 0xC1, 0xFE, 0x02, 0x02, 0x2F, 0x58,
+	 0xFF, 0xFF, 0x1C, 0x60, 0x92, 0x64, 0x13, 0x60, 0x22, 0xFB, 0x02, 0x64, 0x4A, 0xDB, 0xFF, 0xFF,
+	 0x04, 0xFF, 0x00, 0x60, 0x0C, 0x64, 0x08, 0x60, 0x16, 0xFB, 0xDC, 0x60, 0x53, 0x64, 0x5A, 0xDB,
+	 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x08, 0x60, 0x15, 0xF1, 0x00, 0x60, 0x08, 0x64, 0xA0, 0x80,
+	 0x9C, 0x84, 0x50, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x1C, 0x60, 0x92, 0x64, 0x13, 0x60, 0x22, 0xFB,
+	 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x00, 0x64, 0x68, 0xFB, 0x26, 0x46, 0x00, 0xF4,
+	 0x09, 0xF2, 0x0A, 0xF2, 0x01, 0xA8, 0x0B, 0xF2, 0x04, 0xA8, 0x1A, 0x02, 0x00, 0xA8, 0x18, 0x02,
+	 0x17, 0x02, 0xDC, 0x60, 0x58, 0x4D, 0xB9, 0x78, 0xFF, 0xFF, 0x26, 0x46, 0x26, 0x60, 0x1A, 0x64,
+	 0x40, 0x4B, 0x34, 0x60, 0x58, 0x4D, 0x08, 0x78, 0xFF, 0xFF, 0x00, 0x66, 0x46, 0x46, 0x20, 0x40,
+	 0x08, 0x2A, 0x03, 0x00, 0xDC, 0x60, 0xF6, 0x78, 0xFF, 0xFF, 0xE3, 0x60, 0x69, 0x78, 0xFF, 0xFF,
+	 0xDC, 0x60, 0x58, 0x4D, 0xB9, 0x78, 0xFF, 0xFF, 0x0B, 0xF2, 0x26, 0x46, 0x40, 0x59, 0x02, 0x60,
+	 0x00, 0x61, 0x2F, 0xF2, 0xA1, 0xDB, 0x30, 0xF2, 0x41, 0x58, 0x59, 0xDB, 0x31, 0xF2, 0x59, 0xDB,
+	 0x26, 0x46, 0x26, 0x60, 0x1A, 0x64, 0x40, 0x4B, 0x34, 0x60, 0x58, 0x4D, 0x08, 0x78, 0xFF, 0xFF,
+	 0x00, 0x66, 0x46, 0x46, 0x03, 0x65, 0xF1, 0x60, 0x58, 0x4E, 0x96, 0x78, 0xFF, 0xFF, 0xE7, 0x60,
+	 0x0B, 0x78, 0xFF, 0xFF, 0xDC, 0x60, 0x58, 0x4D, 0xB9, 0x78, 0xFF, 0xFF, 0x00, 0x64, 0x68, 0xFB,
+	 0x20, 0x40, 0x08, 0x2A, 0x03, 0x00, 0xD9, 0x60, 0xCA, 0x78, 0xFF, 0xFF, 0xE2, 0x60, 0x73, 0x78,
+	 0xFF, 0xFF, 0x19, 0x60, 0xA4, 0xF3, 0xFF, 0xFF, 0x60, 0x40, 0x0B, 0x3A, 0x06, 0x00, 0x0B, 0x64,
+	 0x16, 0x60, 0xC2, 0xFB, 0x33, 0x60, 0x48, 0x62, 0xA2, 0xDF, 0x2D, 0x58, 0xFF, 0xFF, 0x16, 0x60,
+	 0xC2, 0xF1, 0xA5, 0xD2, 0x64, 0x40, 0x0B, 0x2A, 0x20, 0x00, 0x85, 0x36, 0x0B, 0x00, 0x32, 0x3A,
+	 0x1E, 0x00, 0x60, 0x47, 0xFF, 0xB4, 0x02, 0xA4, 0xC4, 0x85, 0xA5, 0xD2, 0xFF, 0xFF, 0x60, 0x40,
+	 0x85, 0x3A, 0x15, 0x00, 0x65, 0x44, 0x0A, 0xA4, 0xA0, 0xD0, 0x33, 0x60, 0x46, 0x62, 0x64, 0x40,
+	 0x18, 0x26, 0x09, 0x00, 0xA2, 0xDF, 0x01, 0x64, 0x16, 0x60, 0xC2, 0xFB, 0x32, 0x41, 0x08, 0x65,
+	 0xB5, 0x81, 0x41, 0x52, 0x02, 0x00, 0x01, 0x64, 0xA2, 0xDB, 0x2D, 0x58, 0xFF, 0xFF, 0x33, 0x60,
+	 0x46, 0x62, 0xA2, 0xDF, 0x01, 0x64, 0x16, 0x60, 0xC2, 0xFB, 0xF7, 0x01, 0x45, 0x64, 0x3B, 0x42,
+	 0x5A, 0xDB, 0x35, 0x60, 0xAA, 0x7C, 0x35, 0x60, 0x98, 0x63, 0xA3, 0xD9, 0x64, 0x41, 0x2F, 0x60,
+	 0x02, 0x63, 0xBD, 0xD3, 0x00, 0x7C, 0x03, 0x1B, 0x27, 0x43, 0x10, 0xA3, 0xBD, 0xD3, 0xFF, 0xFF,
+	 0x60, 0x45, 0x64, 0x5F, 0xA1, 0xDB, 0x65, 0x44, 0xBD, 0xD1, 0xC8, 0x84, 0x59, 0xD8, 0xFC, 0x05,
+	 0x27, 0x41, 0x10, 0xA1, 0xA1, 0xD1, 0xFF, 0xFF, 0xC1, 0x81, 0x01, 0x26, 0xDD, 0x81, 0x41, 0x4C,
+	 0x59, 0xD1, 0x7C, 0x44, 0xB0, 0x84, 0x59, 0xD1, 0x59, 0xD1, 0xB0, 0x84, 0xB0, 0x84, 0xFF, 0xFF,
+	 0x02, 0x02, 0x67, 0x44, 0xC2, 0x00, 0x34, 0x60, 0x5C, 0x63, 0xD9, 0x81, 0x59, 0xD3, 0x38, 0x60,
+	 0x10, 0x62, 0x00, 0xBC, 0xA2, 0xDF, 0x09, 0x03, 0x01, 0x7C, 0xA2, 0xD9, 0x30, 0x60, 0x14, 0x64,
+	 0xBD, 0xDA, 0x00, 0x60, 0x01, 0x64, 0xBD, 0xDA, 0x58, 0x00, 0xDD, 0x60, 0x18, 0x64, 0xBD, 0xDA,
+	 0x50, 0x60, 0x00, 0x64, 0xBD, 0xDA, 0x01, 0x60, 0xF2, 0x64, 0xBD, 0xDA, 0x00, 0x60, 0x01, 0x64,
+	 0xBD, 0xDA, 0x2C, 0x41, 0x59, 0xD3, 0x50, 0x60, 0x00, 0x7C, 0x60, 0x40, 0x02, 0x2A, 0x03, 0x00,
+	 0x01, 0x60, 0xF2, 0x64, 0x0E, 0x00, 0x04, 0x2A, 0x03, 0x00, 0x02, 0x60, 0xF2, 0x64, 0x09, 0x00,
+	 0x10, 0x2A, 0x03, 0x00, 0x04, 0x60, 0xF2, 0x64, 0x04, 0x00, 0x20, 0x2A, 0x04, 0x00, 0x05, 0x60,
+	 0xF2, 0x64, 0xBD, 0xD9, 0xBD, 0xDB, 0x01, 0x64, 0xBD, 0xDB, 0x59, 0xD3, 0x50, 0x60, 0x00, 0x7C,
+	 0x60, 0x40, 0x02, 0x2A, 0x03, 0x00, 0x01, 0x60, 0xF2, 0x64, 0x0E, 0x00, 0x04, 0x2A, 0x03, 0x00,
+	 0x02, 0x60, 0xF2, 0x64, 0x09, 0x00, 0x10, 0x2A, 0x03, 0x00, 0x04, 0x60, 0xF2, 0x64, 0x04, 0x00,
+	 0x20, 0x2A, 0x04, 0x00, 0x05, 0x60, 0xF2, 0x64, 0xBD, 0xD9, 0xBD, 0xDB, 0x01, 0x64, 0xBD, 0xDB,
+	 0x59, 0xD3, 0x50, 0x60, 0x00, 0x7C, 0x60, 0x40, 0x01, 0x2A, 0x03, 0x00, 0x00, 0x60, 0xF2, 0x64,
+	 0x09, 0x00, 0x02, 0x2A, 0x03, 0x00, 0x01, 0x60, 0xF2, 0x64, 0x04, 0x00, 0x04, 0x2A, 0x02, 0x00,
+	 0x02, 0x60, 0xF2, 0x64, 0xBD, 0xD9, 0xBD, 0xDB, 0x4B, 0x00, 0x2C, 0x41, 0x59, 0xD3, 0x0F, 0x60,
+	 0x00, 0x7C, 0x60, 0x40, 0x02, 0x2A, 0x03, 0x00, 0x01, 0x60, 0xAC, 0x64, 0x0E, 0x00, 0x04, 0x2A,
+	 0x03, 0x00, 0x02, 0x60, 0xAC, 0x64, 0x09, 0x00, 0x10, 0x2A, 0x03, 0x00, 0x04, 0x60, 0xAC, 0x64,
+	 0x04, 0x00, 0x20, 0x2A, 0x04, 0x00, 0x05, 0x60, 0xAC, 0x64, 0xBD, 0xD9, 0xBD, 0xDB, 0x01, 0x64,
+	 0xBD, 0xDB, 0x59, 0xD3, 0x0F, 0x60, 0x00, 0x7C, 0x60, 0x40, 0x02, 0x2A, 0x03, 0x00, 0x01, 0x60,
+	 0xAC, 0x64, 0x0E, 0x00, 0x04, 0x2A, 0x03, 0x00, 0x02, 0x60, 0xAC, 0x64, 0x09, 0x00, 0x10, 0x2A,
+	 0x03, 0x00, 0x04, 0x60, 0xAC, 0x64, 0x04, 0x00, 0x20, 0x2A, 0x04, 0x00, 0x05, 0x60, 0xAC, 0x64,
+	 0xBD, 0xD9, 0xBD, 0xDB, 0x01, 0x64, 0xBD, 0xDB, 0x59, 0xD3, 0x0F, 0x60, 0x00, 0x7C, 0x60, 0x40,
+	 0x01, 0x2A, 0x03, 0x00, 0x00, 0x60, 0xAC, 0x64, 0x09, 0x00, 0x02, 0x2A, 0x03, 0x00, 0x01, 0x60,
+	 0xAC, 0x64, 0x04, 0x00, 0x04, 0x2A, 0x02, 0x00, 0x02, 0x60, 0xAC, 0x64, 0xBD, 0xD9, 0xBD, 0xDB,
+	 0x1C, 0x60, 0x08, 0xF3, 0xFF, 0xFF, 0x03, 0x18, 0x1A, 0x60, 0x2D, 0xF3, 0x03, 0x00, 0x1A, 0x60,
+	 0x1D, 0xF3, 0xFF, 0xFF, 0xBD, 0xDA, 0x34, 0x60, 0x5C, 0x64, 0x1A, 0x60, 0xCF, 0xFB, 0x5F, 0xF5,
+	 0x00, 0x64, 0x2B, 0xFA, 0x00, 0x64, 0x2A, 0xFA, 0x27, 0x43, 0x06, 0xA3, 0xBD, 0xD1, 0x2C, 0xF8,
+	 0x32, 0xF8, 0xBD, 0xD1, 0x2D, 0xF8, 0x33, 0xF8, 0xA3, 0xD1, 0x2E, 0xF8, 0x34, 0xF8, 0x00, 0xF4,
+	 0x01, 0x63, 0x32, 0x40, 0x08, 0x26, 0x10, 0xBB, 0x16, 0x60, 0xC2, 0xF1, 0xFF, 0xFF, 0x64, 0x40,
+	 0xFE, 0x26, 0x10, 0xBB, 0x7D, 0xF3, 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x27, 0x0A, 0x00, 0x19, 0x60,
+	 0x45, 0xF3, 0xFF, 0xFF, 0x60, 0x40, 0x02, 0x22, 0x20, 0xBB, 0x63, 0x44, 0xFF, 0xFF, 0x04, 0x7F,
+	 0x60, 0x43, 0x09, 0xFC, 0x27, 0x42, 0x0C, 0xA2, 0x2D, 0x60, 0x5A, 0x63, 0xA2, 0xD3, 0xA3, 0xD3,
+	 0x00, 0xBD, 0x01, 0x63, 0xAC, 0x81, 0x09, 0x03, 0x08, 0x03, 0xB8, 0x60, 0x58, 0x4D, 0x15, 0x78,
+	 0xFF, 0xFF, 0x00, 0xB8, 0x01, 0x63, 0x01, 0x03, 0x60, 0x43, 0x0E, 0x60, 0x35, 0xFD, 0x12, 0x61,
+	 0x59, 0xDC, 0x16, 0x60, 0xC2, 0xF3, 0xFF, 0x60, 0xFF, 0x7C, 0x60, 0x40, 0x0B, 0x2A, 0x02, 0x00,
+	 0x33, 0x60, 0x28, 0x7C, 0x1A, 0x60, 0xD0, 0xF9, 0x35, 0x60, 0x98, 0x64, 0x40, 0x48, 0xD9, 0x81,
+	 0xFF, 0x60, 0xF2, 0x64, 0xF1, 0x60, 0x58, 0x4D, 0x34, 0x78, 0xFF, 0xFF, 0x5F, 0xF5, 0x3F, 0xFC,
+	 0xDB, 0x83, 0x1A, 0x60, 0x4C, 0xFD, 0x00, 0x7C, 0x5A, 0xD9, 0x63, 0x41, 0x34, 0x60, 0x9C, 0x63,
+	 0x12, 0x65, 0x00, 0xF4, 0xCD, 0x84, 0x4C, 0x91, 0x60, 0x43, 0x60, 0xFE, 0xA5, 0xD2, 0xDE, 0x85,
+	 0x7F, 0x26, 0x02, 0x00, 0x00, 0xF4, 0x04, 0x65, 0x5D, 0x93, 0xA3, 0xDB, 0x5D, 0x93, 0xA5, 0xD2,
+	 0xF6, 0x1F, 0x5D, 0x93, 0x20, 0xFE, 0xDF, 0x83, 0x5F, 0xF5, 0x25, 0x60, 0xCE, 0x64, 0x13, 0x60,
+	 0x0D, 0xFB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0x00, 0x66,
+	 0x46, 0x46, 0xC1, 0xFE, 0x06, 0x64, 0x68, 0xFB, 0x46, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0x1C, 0x60,
+	 0x92, 0x64, 0x13, 0x60, 0x22, 0xFB, 0x02, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x00, 0x60,
+	 0x1C, 0x64, 0x08, 0x60, 0x16, 0xFB, 0xDE, 0x60, 0x84, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58,
+	 0xFF, 0xFF, 0xDE, 0x60, 0xCA, 0x78, 0xFF, 0xFF, 0x08, 0x60, 0x15, 0xF1, 0x00, 0x60, 0x08, 0x64,
+	 0xA0, 0x80, 0x9C, 0x84, 0xF6, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x1C, 0x60, 0x92, 0x64, 0x13, 0x60,
+	 0x22, 0xFB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x10, 0x60, 0x2A, 0x62, 0x00, 0x64,
+	 0xA2, 0xDB, 0x26, 0x46, 0x00, 0xF4, 0x0A, 0xF2, 0x00, 0x63, 0x00, 0xA8, 0x68, 0xFD, 0x06, 0x02,
+	 0x09, 0xF2, 0xFF, 0xFF, 0x01, 0xB0, 0x01, 0x7C, 0x5A, 0x02, 0x0A, 0xF8, 0x0A, 0xF2, 0x26, 0x46,
+	 0x40, 0x59, 0x02, 0x60, 0x00, 0x61, 0x2F, 0xF2, 0xA1, 0xDB, 0x30, 0xF2, 0x41, 0x58, 0x59, 0xDB,
+	 0x31, 0xF2, 0x59, 0xDB, 0x26, 0x46, 0x26, 0x60, 0x1A, 0x64, 0x40, 0x4B, 0x34, 0x60, 0x58, 0x4D,
+	 0x08, 0x78, 0xFF, 0xFF, 0x00, 0x66, 0x46, 0x46, 0x05, 0x65, 0xF1, 0x60, 0x58, 0x4E, 0x96, 0x78,
+	 0xFF, 0xFF, 0xE7, 0x60, 0x0B, 0x78, 0xFF, 0xFF, 0x47, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0xD9, 0x60,
+	 0xCA, 0x78, 0xFF, 0xFF, 0x00, 0x60, 0x10, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x20, 0x03, 0xA0, 0x84,
+	 0xA2, 0xDB, 0x1C, 0x60, 0x92, 0x64, 0x13, 0x60, 0x22, 0xFB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF,
+	 0x04, 0xFF, 0x26, 0x46, 0x26, 0x60, 0x1A, 0x64, 0x40, 0x4B, 0x34, 0x60, 0x58, 0x4D, 0x08, 0x78,
+	 0xFF, 0xFF, 0x00, 0x66, 0x46, 0x46, 0x00, 0x64, 0x68, 0xFB, 0x10, 0x60, 0x2A, 0x62, 0x00, 0x64,
+	 0xA2, 0xDB, 0x49, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0xDA, 0x60, 0x62, 0x78, 0xFF, 0xFF, 0xFF, 0x60,
+	 0xFB, 0x64, 0xA0, 0x84, 0xA2, 0xDB, 0x00, 0x64, 0x68, 0xFB, 0x10, 0x60, 0x2A, 0x62, 0x00, 0x64,
+	 0xA2, 0xDB, 0x4A, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0xD9, 0x60, 0xCA, 0x78, 0xFF, 0xFF, 0x48, 0x64,
+	 0x3B, 0x42, 0x5A, 0xDB, 0x0C, 0xF2, 0xFF, 0xFF, 0x60, 0x41, 0xFF, 0xB1, 0xFF, 0xA1, 0x60, 0x47,
+	 0xFF, 0xB4, 0x9B, 0x02, 0x9A, 0x03, 0x34, 0x60, 0xF4, 0x63, 0x10, 0x64, 0xBD, 0xDB, 0x66, 0x45,
+	 0x26, 0x46, 0x3F, 0xF2, 0x34, 0x60, 0xF2, 0x61, 0xC2, 0xA0, 0xFF, 0xFF, 0x01, 0x04, 0x3E, 0x64,
+	 0x65, 0x46, 0x02, 0xA4, 0xA1, 0xDB, 0xC8, 0x81, 0x12, 0x65, 0xCD, 0x84, 0x4C, 0x91, 0x60, 0x43,
+	 0x60, 0xFE, 0xA5, 0xD2, 0xDE, 0x85, 0x7F, 0x26, 0x02, 0x00, 0x00, 0xF4, 0x04, 0x65, 0x5D, 0x93,
+	 0xA3, 0xDB, 0x5D, 0x93, 0xA5, 0xD2, 0xF6, 0x1F, 0x5D, 0x93, 0x20, 0xFE, 0xDF, 0x83, 0x0C, 0xF2,
+	 0xFF, 0xFF, 0x1A, 0x65, 0x60, 0x47, 0xFF, 0xB4, 0xC4, 0x85, 0xDC, 0x60, 0x58, 0x4D, 0xC7, 0x78,
+	 0xFF, 0xFF, 0x0B, 0xF2, 0xFF, 0xFF, 0x07, 0xB4, 0x01, 0x61, 0x03, 0x03, 0xCC, 0x84, 0xE1, 0x81,
+	 0xFD, 0x02, 0x61, 0x44, 0x94, 0xFB, 0x27, 0x45, 0x02, 0x62, 0x46, 0xD3, 0x5A, 0xD1, 0x60, 0x47,
+	 0x56, 0xFB, 0x64, 0x47, 0x55, 0xFB, 0x00, 0x64, 0x5B, 0xFB, 0x0C, 0x62, 0x46, 0xD3, 0x7E, 0xFB,
+	 0x0B, 0xF0, 0x0F, 0x60, 0xFF, 0x64, 0xA0, 0x84, 0x83, 0xFB, 0x26, 0x46, 0x32, 0xF0, 0x7F, 0xF9,
+	 0x33, 0xF0, 0x0E, 0x63, 0xC7, 0x81, 0x80, 0xF9, 0x34, 0xF0, 0x81, 0xF9, 0x59, 0xD1, 0xFF, 0xFF,
+	 0x64, 0x44, 0x01, 0x2A, 0xC8, 0x84, 0x60, 0x43, 0x33, 0x60, 0xBC, 0x64, 0x58, 0xD9, 0x59, 0xD1,
+	 0x58, 0xD9, 0xFD, 0x1F, 0x16, 0x60, 0xC2, 0xF1, 0x59, 0xD3, 0x64, 0x40, 0x01, 0x36, 0x22, 0x64,
+	 0x64, 0x40, 0x00, 0x36, 0x50, 0x94, 0xA6, 0xF1, 0xFF, 0xFF, 0x44, 0x47, 0xA7, 0x46, 0x3A, 0xFA,
+	 0xBB, 0xFC, 0xA7, 0x46, 0x0E, 0x60, 0x35, 0xF3, 0x85, 0xFB, 0x2E, 0x60, 0x2E, 0x64, 0x2D, 0x60,
+	 0x8A, 0x63, 0xA0, 0xD1, 0xA3, 0xD9, 0x64, 0x41, 0x58, 0xD1, 0x5B, 0xD9, 0x7D, 0xF3, 0x66, 0x45,
+	 0xA6, 0xF5, 0x60, 0x40, 0x01, 0x27, 0x08, 0x00, 0x91, 0xFA, 0x61, 0x44, 0xFD, 0x60, 0x58, 0x4E,
+	 0xAC, 0x78, 0xFF, 0xFF, 0x12, 0xFA, 0x07, 0x00, 0x11, 0xF8, 0x64, 0x44, 0xFD, 0x60, 0x58, 0x4E,
+	 0xAC, 0x78, 0xFF, 0xFF, 0x12, 0xFA, 0x65, 0x46, 0x31, 0xF2, 0x1D, 0x60, 0xC0, 0x65, 0x60, 0x47,
+	 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD3, 0x66, 0x41, 0x60, 0x46, 0x60, 0x43, 0x05, 0xF2, 0x16, 0x18,
+	 0x61, 0x46, 0x31, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x04, 0xF2, 0x0C, 0x02, 0x61, 0x46, 0x30, 0xF0,
+	 0x63, 0x46, 0xD0, 0x80, 0x03, 0xF2, 0x06, 0x02, 0x61, 0x46, 0x2F, 0xF0, 0x63, 0x46, 0xD0, 0x80,
+	 0xFF, 0xFF, 0x07, 0x03, 0x80, 0xF4, 0xFF, 0xFF, 0x63, 0x46, 0xE8, 0x1B, 0xA6, 0xF3, 0x08, 0xFE,
+	 0x60, 0x43, 0x61, 0x46, 0xA6, 0xF1, 0xFF, 0xFF, 0xD3, 0x80, 0x31, 0xF2, 0x27, 0x02, 0x66, 0x41,
+	 0x1D, 0x60, 0xC0, 0x65, 0x60, 0x47, 0x00, 0x7F, 0xA6, 0xF1, 0xE0, 0x84, 0x44, 0xD3, 0x64, 0x43,
+	 0x11, 0x18, 0x60, 0x46, 0x00, 0xF2, 0xFF, 0xFF, 0xFC, 0x1B, 0x66, 0x44, 0x64, 0x46, 0x80, 0xF0,
+	 0x60, 0x46, 0x80, 0xF8, 0x65, 0x46, 0x65, 0x43, 0x80, 0xF0, 0x01, 0xFA, 0x80, 0xFC, 0x64, 0x46,
+	 0x80, 0xF8, 0x0B, 0x00, 0x64, 0x46, 0x62, 0x43, 0x00, 0xF2, 0xA3, 0xDB, 0x60, 0x46, 0x80, 0xF0,
+	 0x81, 0xFC, 0x80, 0xFC, 0x64, 0x46, 0x80, 0xF8, 0x60, 0x43, 0x61, 0x46, 0x43, 0x4B, 0x01, 0x65,
+	 0xFD, 0x60, 0x58, 0x4E, 0xDD, 0x78, 0xFF, 0xFF, 0x43, 0x47, 0x3F, 0xF2, 0x00, 0xF4, 0x60, 0x43,
+	 0xFA, 0xA3, 0x00, 0x60, 0x17, 0x61, 0x00, 0x60, 0x01, 0x65, 0x01, 0x60, 0xFF, 0x64, 0x40, 0x4C,
+	 0xFD, 0x60, 0x58, 0x4E, 0x7A, 0x78, 0xFF, 0xFF, 0x00, 0xBB, 0xFF, 0xFF, 0x00, 0x02, 0x00, 0x64,
+	 0x40, 0x4A, 0x60, 0xFE, 0x02, 0x60, 0x00, 0x63, 0xBD, 0xD3, 0xBD, 0xD3, 0x60, 0x41, 0xFE, 0x60,
+	 0x58, 0x4E, 0x2C, 0x78, 0xFF, 0xFF, 0x20, 0xFE, 0x00, 0x65, 0x00, 0x64, 0x19, 0x60, 0x3B, 0xFB,
+	 0x02, 0x00, 0x20, 0xFE, 0xFF, 0x65, 0x02, 0x60, 0x00, 0x63, 0x60, 0xFE, 0xBD, 0xD3, 0xBD, 0xD3,
+	 0x60, 0x41, 0x20, 0xFE, 0xCD, 0x81, 0x60, 0x40, 0x80, 0x2A, 0x39, 0x00, 0x7F, 0xB4, 0x02, 0x3A,
+	 0x02, 0x00, 0x01, 0x64, 0x2E, 0x00, 0x04, 0x3A, 0x02, 0x00, 0x02, 0x64, 0x2A, 0x00, 0x0B, 0x3A,
+	 0x02, 0x00, 0x04, 0x64, 0x26, 0x00, 0x16, 0x3A, 0x02, 0x00, 0x08, 0x64, 0x22, 0x00, 0x0C, 0x3A,
+	 0x02, 0x00, 0x10, 0x64, 0x1E, 0x00, 0x12, 0x3A, 0x02, 0x00, 0x20, 0x64, 0x1A, 0x00, 0x18, 0x3A,
+	 0x02, 0x00, 0x40, 0x64, 0x16, 0x00, 0x24, 0x3A, 0x02, 0x00, 0x80, 0x64, 0x12, 0x00, 0x30, 0x3A,
+	 0x02, 0x00, 0x01, 0x67, 0x0E, 0x00, 0x48, 0x3A, 0x02, 0x00, 0x02, 0x67, 0x0A, 0x00, 0x60, 0x3A,
+	 0x02, 0x00, 0x04, 0x67, 0x06, 0x00, 0x6C, 0x3A, 0x02, 0x00, 0x08, 0x67, 0x02, 0x00, 0x00, 0x64,
+	 0x00, 0x00, 0x19, 0x60, 0x3B, 0xF1, 0xFF, 0xFF, 0xB0, 0x84, 0x19, 0x60, 0x3B, 0xFB, 0x61, 0x40,
+	 0x00, 0x36, 0x05, 0x00, 0x60, 0xFE, 0xBD, 0xD3, 0xFF, 0xFF, 0x20, 0xFE, 0xBB, 0x01, 0x65, 0x40,
+	 0x00, 0x3A, 0x1E, 0x00, 0x26, 0x46, 0x3F, 0xF2, 0x00, 0xF4, 0x60, 0x43, 0xFA, 0xA3, 0x00, 0x60,
+	 0x17, 0x61, 0x00, 0x60, 0x32, 0x65, 0x01, 0x60, 0xFF, 0x64, 0x40, 0x4C, 0xFD, 0x60, 0x58, 0x4E,
+	 0x7A, 0x78, 0xFF, 0xFF, 0x00, 0xBB, 0xFF, 0xFF, 0x0B, 0x03, 0x60, 0xFE, 0x02, 0x60, 0x00, 0x63,
+	 0xBD, 0xD3, 0xBD, 0xD3, 0x60, 0x41, 0xFE, 0x60, 0x58, 0x4E, 0x2C, 0x78, 0xFF, 0xFF, 0x91, 0x01,
+	 0x20, 0xFE, 0x00, 0x65, 0xFC, 0x60, 0x58, 0x4E, 0xC7, 0x78, 0xFF, 0xFF, 0xA1, 0xF3, 0xFF, 0xFF,
+	 0x60, 0x40, 0x01, 0x27, 0x04, 0x00, 0xFD, 0x60, 0x58, 0x4E, 0x11, 0x78, 0xFF, 0xFF, 0x20, 0xFE,
+	 0x37, 0x60, 0xF8, 0x61, 0xA1, 0xD1, 0xA1, 0xF3, 0x01, 0x60, 0xAC, 0x63, 0x60, 0x45, 0x2A, 0x44,
+	 0x79, 0xFB, 0xA3, 0xD5, 0x65, 0x40, 0x01, 0x27, 0x5B, 0xD5, 0x65, 0x40, 0x01, 0x27, 0x59, 0xD1,
+	 0x66, 0x41, 0xA0, 0x84, 0x24, 0x94, 0x2B, 0x46, 0x0F, 0xFA, 0x7A, 0xFB, 0x16, 0x64, 0x12, 0xFA,
+	 0x01, 0x64, 0x11, 0xFA, 0x66, 0x5C, 0xC2, 0x60, 0x58, 0x4E, 0x6D, 0x78, 0xFF, 0xFF, 0x1A, 0x60,
+	 0x22, 0xF3, 0x1A, 0x60, 0x21, 0xF1, 0x60, 0x47, 0xB0, 0x84, 0x1C, 0x60, 0x08, 0xF1, 0xFF, 0xFF,
+	 0x01, 0x18, 0x80, 0xBC, 0x16, 0x60, 0xC2, 0xF1, 0xFF, 0xFF, 0x64, 0x40, 0x01, 0x36, 0x22, 0x64,
+	 0x64, 0x40, 0x00, 0x36, 0x50, 0x94, 0xA7, 0x46, 0x3A, 0xFA, 0xBB, 0xFC, 0xA7, 0x46, 0x80, 0x60,
+	 0x03, 0x65, 0x32, 0x40, 0x08, 0x2A, 0x03, 0x65, 0xA7, 0x46, 0x06, 0xF0, 0x7F, 0x60, 0xFF, 0x64,
+	 0xA0, 0x84, 0xB4, 0x84, 0x06, 0xFA, 0xBB, 0xFC, 0xA7, 0x46, 0x26, 0x46, 0x2F, 0xF0, 0x30, 0xF0,
+	 0x64, 0x43, 0x31, 0xF2, 0x27, 0x46, 0x03, 0xFC, 0x04, 0xF8, 0x05, 0xFA, 0x26, 0x46, 0xD9, 0x60,
+	 0x58, 0x4E, 0xAE, 0x78, 0xFF, 0xFF, 0x26, 0x46, 0x26, 0x60, 0x1A, 0x64, 0x40, 0x4B, 0x34, 0x60,
+	 0x58, 0x4D, 0x08, 0x78, 0xFF, 0xFF, 0x00, 0x66, 0x46, 0x46, 0x01, 0x64, 0x8A, 0xFB, 0x16, 0x60,
+	 0xC9, 0xF3, 0x20, 0x41, 0x00, 0xBC, 0x20, 0xB9, 0x01, 0x03, 0x41, 0x40, 0x20, 0x60, 0x14, 0x61,
+	 0xA1, 0xDF, 0x04, 0x64, 0xC1, 0xFE, 0xDB, 0xFB, 0xF1, 0xF3, 0xFF, 0xFF, 0xFE, 0xB4, 0xF1, 0xFB,
+	 0xF7, 0x60, 0xFF, 0x65, 0x20, 0x44, 0x24, 0x80, 0x08, 0x60, 0x08, 0xF1, 0x80, 0x60, 0x00, 0x64,
+	 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x01, 0x65, 0xF1, 0x60, 0x58, 0x4E, 0xC3, 0x78, 0xFF, 0xFF,
+	 0x33, 0x60, 0xE6, 0x65, 0xA5, 0xDF, 0x08, 0x60, 0x0C, 0xF1, 0x00, 0x60, 0x02, 0x64, 0xB0, 0x84,
+	 0xA2, 0xDB, 0xCF, 0xFE, 0x0C, 0x64, 0x68, 0xFB, 0x00, 0x60, 0x31, 0x64, 0x08, 0x60, 0x16, 0xFB,
+	 0xE1, 0x60, 0x36, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x00, 0x60, 0x02, 0x64, 0x08, 0x60, 0x28, 0xFB,
+	 0xE1, 0x60, 0xF7, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x00, 0x64, 0x08, 0x60,
+	 0x27, 0xFB, 0x5A, 0xDB, 0x08, 0x60, 0x15, 0xF1, 0x00, 0x60, 0x01, 0x64, 0xA0, 0x80, 0x9C, 0x84,
+	 0x0F, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x1B, 0x60, 0xFE, 0xF3, 0xFF, 0xFF, 0x03, 0x1B, 0xE7, 0x60,
+	 0x2E, 0x78, 0xFF, 0xFF, 0xE7, 0x60, 0x2E, 0x78, 0xFF, 0xFF, 0xE1, 0x60, 0xE7, 0x78, 0xFF, 0xFF,
+	 0x00, 0x60, 0x10, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0xF8, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0xA6, 0xF3,
+	 0xFF, 0xFF, 0x02, 0xA4, 0x60, 0x43, 0x66, 0x41, 0x63, 0x46, 0x05, 0xF2, 0x00, 0xF0, 0x81, 0xF0,
+	 0x02, 0x18, 0x64, 0x46, 0x81, 0xF8, 0x07, 0x1B, 0x1D, 0x60, 0xC0, 0x65, 0x60, 0x47, 0x00, 0x7F,
+	 0xE0, 0x84, 0x44, 0xD9, 0x02, 0x00, 0x65, 0x46, 0x00, 0xF8, 0xA6, 0xF3, 0x63, 0x45, 0x60, 0x46,
+	 0x00, 0xF2, 0xFF, 0xFF, 0xD4, 0x80, 0x01, 0x18, 0xFA, 0x04, 0x80, 0xF8, 0x65, 0x46, 0x00, 0xFA,
+	 0x06, 0xF2, 0xFF, 0xFF, 0x00, 0x7E, 0x06, 0xFA, 0x61, 0x46, 0x4B, 0x64, 0x3B, 0x42, 0x5A, 0xDB,
+	 0x10, 0x60, 0x2A, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x00, 0x60, 0x95, 0xF3, 0xFF, 0xFF, 0x10, 0xB0,
+	 0xFF, 0xFF, 0x11, 0x03, 0x04, 0x60, 0x00, 0x64, 0x08, 0x60, 0x16, 0xFB, 0xE1, 0x60, 0x9B, 0x64,
+	 0x5A, 0xDB, 0xCF, 0xFE, 0x08, 0x60, 0x1B, 0xF1, 0x01, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB,
+	 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x69, 0xF3, 0xFF, 0xFF, 0x01, 0xB0, 0xFF, 0xFF, 0x11, 0x03,
+	 0x08, 0x60, 0x0C, 0xF1, 0x00, 0x60, 0x04, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x02, 0x60,
+	 0x00, 0x64, 0x08, 0x60, 0x16, 0xFB, 0xE1, 0x60, 0xB1, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58,
+	 0xFF, 0xFF, 0x10, 0x60, 0x2A, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x00, 0x64, 0x68, 0xFB, 0xE2, 0x60,
+	 0x58, 0x4E, 0x13, 0x78, 0xFF, 0xFF, 0x02, 0x64, 0x8A, 0xFB, 0x02, 0x64, 0xC1, 0xFE, 0xDB, 0xFB,
+	 0xF1, 0xF3, 0xFF, 0xFF, 0x01, 0xBC, 0xF1, 0xFB, 0x02, 0x65, 0xF1, 0x60, 0x58, 0x4E, 0xC3, 0x78,
+	 0xFF, 0xFF, 0x03, 0x60, 0xE8, 0x63, 0x0E, 0x60, 0x36, 0xFD, 0x08, 0x60, 0x77, 0xF3, 0xFF, 0xFF,
+	 0x13, 0x1B, 0x16, 0x60, 0xCC, 0xF3, 0x00, 0x61, 0x60, 0x40, 0x00, 0x36, 0x00, 0xB9, 0x60, 0x40,
+	 0x01, 0x36, 0x01, 0xB9, 0x60, 0x40, 0x02, 0x36, 0x06, 0xB9, 0x60, 0x40, 0x03, 0x36, 0x07, 0xB9,
+	 0x41, 0x44, 0xD4, 0x60, 0xF6, 0x78, 0xFF, 0xFF, 0xD3, 0x60, 0xD0, 0x78, 0xFF, 0xFF, 0x00, 0x60,
+	 0x20, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0xFF, 0xFF, 0x08, 0x24, 0x46, 0x01, 0xA0, 0x84, 0xA2, 0xDB,
+	 0x00, 0x63, 0x68, 0xFD, 0x10, 0x60, 0x2A, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x30, 0x00, 0x20, 0x40,
+	 0x06, 0x23, 0x10, 0x00, 0x08, 0x60, 0x27, 0xF1, 0x7F, 0x60, 0xFF, 0x64, 0xA0, 0x84, 0xA2, 0xDB,
+	 0x80, 0x60, 0x00, 0x64, 0x08, 0x60, 0x28, 0xFB, 0xE1, 0x60, 0xF7, 0x64, 0x5A, 0xDB, 0xCF, 0xFE,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x00, 0x64, 0x08, 0x60, 0x27, 0xFB, 0x5A, 0xDB, 0x10, 0x60, 0x4E, 0x62,
+	 0x00, 0x64, 0xA2, 0xDB, 0x44, 0x01, 0x1C, 0x60, 0x92, 0x64, 0x13, 0x60, 0x22, 0xFB, 0x03, 0x64,
+	 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x00, 0x64, 0x68, 0xFB, 0x10, 0x60, 0x2A, 0x62, 0x00, 0x64,
+	 0xA2, 0xDB, 0x01, 0x64, 0x8A, 0xFB, 0xFF, 0xFF, 0xC1, 0xFE, 0x2E, 0x58, 0xFF, 0xFF, 0x50, 0x64,
+	 0x3B, 0x42, 0x5A, 0xDB, 0x10, 0x60, 0x2A, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x00, 0x60, 0x95, 0xF3,
+	 0xFF, 0xFF, 0x10, 0xB0, 0xFF, 0xFF, 0x11, 0x03, 0x08, 0x60, 0x1B, 0xF1, 0x01, 0x60, 0x00, 0x64,
+	 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x04, 0x60, 0x00, 0x64, 0x08, 0x60, 0x16, 0xFB, 0xE2, 0x60,
+	 0x2A, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0xB9, 0xF1, 0x0E, 0x60, 0x4B, 0xF9,
+	 0x7D, 0xF1, 0x7C, 0xF9, 0x02, 0x64, 0x8A, 0xFB, 0xFF, 0xFF, 0xC1, 0xFE, 0x8A, 0xF3, 0x00, 0x65,
+	 0xD4, 0x80, 0xFF, 0xFF, 0x0E, 0x03, 0x10, 0x60, 0x2A, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x80, 0x60,
+	 0x00, 0x64, 0x08, 0x60, 0x16, 0xFB, 0xE2, 0x60, 0x4A, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58,
+	 0xFF, 0xFF, 0x10, 0x60, 0x2A, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x51, 0x64, 0x3B, 0x42, 0x5A, 0xDB,
+	 0x1B, 0x60, 0xB0, 0x64, 0x67, 0xFB, 0x1C, 0x60, 0x72, 0x63, 0x7F, 0xF3, 0xBD, 0xDB, 0x80, 0xF3,
+	 0xBD, 0xDB, 0x81, 0xF3, 0xA3, 0xDB, 0x67, 0xF3, 0x00, 0x60, 0x86, 0xF1, 0x04, 0xA4, 0x67, 0xFB,
+	 0xD0, 0x80, 0xA0, 0xD3, 0x1F, 0x07, 0x40, 0x47, 0x60, 0x41, 0x0E, 0x65, 0x45, 0xD3, 0x16, 0x60,
+	 0xC2, 0xF1, 0xFF, 0xFF, 0x03, 0x1B, 0x10, 0xB0, 0xFF, 0xFF, 0xED, 0x02, 0x27, 0x44, 0x06, 0xA4,
+	 0x60, 0x41, 0xA1, 0xD1, 0x7F, 0xF3, 0x80, 0xF1, 0xD0, 0x80, 0x59, 0xD3, 0x08, 0x02, 0xD0, 0x80,
+	 0x81, 0xF3, 0x59, 0xD1, 0x04, 0x02, 0xD0, 0x80, 0xFF, 0xFF, 0x01, 0x02, 0x03, 0x00, 0xE2, 0x60,
+	 0xE6, 0x78, 0xFF, 0xFF, 0x1C, 0x60, 0x72, 0x63, 0xBD, 0xD3, 0x7F, 0xFB, 0xBD, 0xD3, 0x80, 0xFB,
+	 0xA3, 0xD3, 0x81, 0xFB, 0x53, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0x10, 0x60, 0x2A, 0x62, 0x00, 0x64,
+	 0xA2, 0xDB, 0xDE, 0xFE, 0x0A, 0x04, 0x40, 0x60, 0x00, 0x64, 0x08, 0x60, 0x16, 0xFB, 0xE2, 0x60,
+	 0x9A, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x7C, 0xF1, 0x7D, 0xF9, 0x13, 0x60,
+	 0x1A, 0xF9, 0x0E, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x2D, 0xFF, 0x20, 0x60, 0x00, 0x64, 0x08, 0x60,
+	 0x16, 0xFB, 0xE2, 0x60, 0xC7, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x10, 0x60,
+	 0x2A, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0xBE, 0xFE, 0x08, 0x60, 0x08, 0xF1, 0x40, 0x60, 0x00, 0x64,
+	 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x01, 0x63, 0x8A, 0xFD, 0x08, 0x60, 0x0C, 0xF1, 0x00, 0x60,
+	 0x02, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0xC1, 0xFE, 0x54, 0x64, 0x3B, 0x42, 0x5A, 0xDB,
+	 0x31, 0x44, 0xF9, 0xB4, 0x40, 0x51, 0xE1, 0x60, 0x22, 0x78, 0xFF, 0xFF, 0x27, 0x43, 0x33, 0x60,
+	 0xBE, 0x65, 0xA5, 0xD3, 0x65, 0x41, 0x10, 0xA3, 0x01, 0xA4, 0xFE, 0xB4, 0xC4, 0x85, 0xFE, 0xA1,
+	 0xBD, 0xD3, 0x59, 0xD1, 0xFF, 0xFF, 0xD0, 0x80, 0xD5, 0x80, 0x02, 0x02, 0x04, 0x03, 0xF8, 0x01,
+	 0xE2, 0x60, 0x73, 0x78, 0xFF, 0xFF, 0x55, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0x10, 0x60, 0x2A, 0x62,
+	 0x00, 0x64, 0xA2, 0xDB, 0xDE, 0xFE, 0x0A, 0x04, 0x40, 0x60, 0x00, 0x64, 0x08, 0x60, 0x16, 0xFB,
+	 0xE2, 0x60, 0xFE, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x27, 0xD1, 0x7D, 0xF9,
+	 0x13, 0x60, 0x1A, 0xF9, 0x0E, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x2D, 0xFF, 0x20, 0x60, 0x00, 0x64,
+	 0x08, 0x60, 0x16, 0xFB, 0xE3, 0x60, 0x20, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x10, 0x60, 0x2A, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0xBE, 0xFE, 0x08, 0x60, 0x08, 0xF1, 0x40, 0x60,
+	 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x07, 0x60, 0xD0, 0x64, 0x0E, 0x60, 0x4B, 0xFB,
+	 0x1C, 0x60, 0x92, 0x64, 0x13, 0x60, 0x22, 0xFB, 0x02, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF,
+	 0x27, 0x43, 0x06, 0xA3, 0xBD, 0xD3, 0x7F, 0xFB, 0xBD, 0xD3, 0x80, 0xFB, 0xA3, 0xD3, 0x81, 0xFB,
+	 0x31, 0x44, 0xF9, 0xB4, 0x40, 0x51, 0x10, 0x60, 0x2A, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x01, 0x60,
+	 0x04, 0x64, 0x08, 0x60, 0x16, 0xFB, 0xE3, 0x60, 0x51, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58,
+	 0xFF, 0xFF, 0xB9, 0xF1, 0x0E, 0x60, 0x4B, 0xF9, 0x08, 0x60, 0x15, 0xF1, 0xFE, 0x60, 0xFF, 0x61,
+	 0xA1, 0x84, 0x5A, 0xD1, 0x4A, 0xDB, 0xA1, 0x84, 0x5A, 0xDB, 0x08, 0x60, 0x15, 0xF1, 0x00, 0x60,
+	 0x04, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x05, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0xE2, 0x60, 0x73, 0x78,
+	 0xFF, 0xFF, 0x7D, 0xF1, 0x32, 0x60, 0x7A, 0x61, 0xA1, 0xD3, 0x64, 0x40, 0x01, 0x27, 0x59, 0xD3,
+	 0x32, 0x60, 0x7E, 0x61, 0xFD, 0x60, 0x58, 0x4E, 0xAC, 0x78, 0xFF, 0xFF, 0xA1, 0xDB, 0x27, 0x42,
+	 0x0C, 0xA2, 0xA2, 0xD3, 0x16, 0x60, 0xAD, 0xF3, 0x00, 0xBD, 0x01, 0x63, 0xAC, 0x81, 0x09, 0x03,
+	 0x08, 0x03, 0xB8, 0x60, 0x58, 0x4D, 0x15, 0x78, 0xFF, 0xFF, 0x00, 0xB8, 0x01, 0x63, 0x01, 0x03,
+	 0x60, 0x43, 0x0E, 0x60, 0x35, 0xFD, 0x5F, 0xF5, 0x00, 0x64, 0x2B, 0xFA, 0x20, 0x64, 0x2A, 0xFA,
+	 0x27, 0x43, 0x06, 0xA3, 0xBD, 0xD1, 0x2C, 0xF8, 0x32, 0xF8, 0xBD, 0xD1, 0x2D, 0xF8, 0x33, 0xF8,
+	 0xA3, 0xD1, 0x2E, 0xF8, 0x34, 0xF8, 0xEA, 0xF1, 0x2F, 0xF8, 0xEB, 0xF1, 0x30, 0xF8, 0xEC, 0xF1,
+	 0x31, 0xF8, 0xB9, 0xF1, 0x19, 0xF8, 0xF8, 0x60, 0x80, 0x64, 0x0E, 0xFA, 0x00, 0xF4, 0x01, 0x63,
+	 0x32, 0x40, 0x08, 0x26, 0x10, 0xBB, 0x16, 0x60, 0xC2, 0xF1, 0xFF, 0xFF, 0x64, 0x40, 0xFE, 0x26,
+	 0x10, 0xBB, 0x7D, 0xF3, 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x27, 0x0A, 0x00, 0x19, 0x60, 0x45, 0xF3,
+	 0xFF, 0xFF, 0x60, 0x40, 0x02, 0x22, 0x20, 0xBB, 0x63, 0x44, 0xFF, 0xFF, 0x04, 0x7F, 0x60, 0x43,
+	 0x09, 0xFC, 0x0E, 0x60, 0x35, 0xF3, 0x12, 0x61, 0x59, 0xDA, 0x1C, 0x60, 0x72, 0x63, 0xBD, 0xD1,
+	 0x59, 0xD8, 0xBD, 0xD1, 0x59, 0xD8, 0xA3, 0xD1, 0x59, 0xD8, 0x35, 0x60, 0x98, 0x64, 0x40, 0x48,
+	 0xD9, 0x81, 0xFF, 0x60, 0xF2, 0x64, 0xF1, 0x60, 0x58, 0x4D, 0x34, 0x78, 0xFF, 0xFF, 0x5F, 0xF5,
+	 0x3F, 0xFC, 0xDB, 0x83, 0x1A, 0x60, 0x4C, 0xFD, 0x20, 0x7C, 0x5A, 0xD9, 0x63, 0x41, 0x34, 0x60,
+	 0x9C, 0x63, 0x12, 0x65, 0x00, 0xF4, 0xCD, 0x84, 0x4C, 0x91, 0x60, 0x43, 0x60, 0xFE, 0xA5, 0xD2,
+	 0xDE, 0x85, 0x7F, 0x26, 0x02, 0x00, 0x00, 0xF4, 0x04, 0x65, 0x5D, 0x93, 0xA3, 0xDB, 0x5D, 0x93,
+	 0xA5, 0xD2, 0xF6, 0x1F, 0x5D, 0x93, 0x20, 0xFE, 0xDF, 0x83, 0x5F, 0xF5, 0x25, 0x60, 0xCE, 0x64,
+	 0x13, 0x60, 0x0D, 0xFB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF,
+	 0x00, 0x66, 0x46, 0x46, 0xC1, 0xFE, 0x16, 0x64, 0x68, 0xFB, 0x56, 0x64, 0x3B, 0x42, 0x5A, 0xDB,
+	 0x0E, 0x60, 0x38, 0xF3, 0xFF, 0xFF, 0x64, 0xA4, 0xA2, 0xDB, 0x0E, 0x60, 0x38, 0xF1, 0x0E, 0x60,
+	 0x4B, 0xF9, 0x1C, 0x60, 0x92, 0x64, 0x13, 0x60, 0x22, 0xFB, 0x02, 0x64, 0x4A, 0xDB, 0xFF, 0xFF,
+	 0x04, 0xFF, 0x00, 0x60, 0x1C, 0x64, 0x08, 0x60, 0x16, 0xFB, 0xE4, 0x60, 0x23, 0x64, 0x5A, 0xDB,
+	 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x08, 0x60, 0x15, 0xF1, 0x00, 0x60, 0x04, 0x64, 0xA0, 0x80,
+	 0x9C, 0x84, 0x0E, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x57, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0x00, 0x64,
+	 0x68, 0xFB, 0x10, 0x60, 0x2A, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0xE2, 0x60, 0x73, 0x78, 0xFF, 0xFF,
+	 0x00, 0x60, 0x10, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x16, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x1C, 0x60,
+	 0x92, 0x64, 0x13, 0x60, 0x22, 0xFB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x58, 0x64,
+	 0x3B, 0x42, 0x5A, 0xDB, 0x00, 0x64, 0x68, 0xFB, 0x10, 0x60, 0x2A, 0x62, 0x00, 0x64, 0xA2, 0xDB,
+	 0xE6, 0x60, 0x36, 0x78, 0xFF, 0xFF, 0x00, 0x60, 0x08, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x3D, 0x03,
+	 0xA0, 0x84, 0xA2, 0xDB, 0x1C, 0x60, 0x92, 0x64, 0x13, 0x60, 0x22, 0xFB, 0x03, 0x64, 0x4A, 0xDB,
+	 0xFF, 0xFF, 0x04, 0xFF, 0x00, 0x64, 0x68, 0xFB, 0x10, 0x60, 0x2A, 0x62, 0x00, 0x64, 0xA2, 0xDB,
+	 0x26, 0x46, 0x00, 0xF4, 0x0A, 0xF2, 0x09, 0xF2, 0x04, 0x1B, 0x01, 0xB0, 0x01, 0x7C, 0x2D, 0x02,
+	 0x0A, 0xF8, 0x59, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0x0A, 0xF2, 0x26, 0x46, 0x40, 0x59, 0x02, 0x60,
+	 0x00, 0x61, 0x2F, 0xF2, 0xA1, 0xDB, 0x30, 0xF2, 0x41, 0x58, 0x59, 0xDB, 0x31, 0xF2, 0x59, 0xDB,
+	 0x26, 0x46, 0x26, 0x60, 0x1A, 0x64, 0x40, 0x4B, 0x34, 0x60, 0x58, 0x4D, 0x08, 0x78, 0xFF, 0xFF,
+	 0x00, 0x66, 0x46, 0x46, 0x05, 0x65, 0xF1, 0x60, 0x58, 0x4E, 0x96, 0x78, 0xFF, 0xFF, 0xE7, 0x60,
+	 0x0B, 0x78, 0xFF, 0xFF, 0xE2, 0x60, 0x73, 0x78, 0xFF, 0xFF, 0x5A, 0x64, 0x3B, 0x42, 0x5A, 0xDB,
+	 0x78, 0x43, 0x02, 0x61, 0x29, 0x60, 0xEA, 0x78, 0xFF, 0xFF, 0x5B, 0x64, 0x3B, 0x42, 0x5A, 0xDB,
+	 0x0C, 0xF2, 0xFF, 0xFF, 0x60, 0x41, 0xFF, 0xB1, 0xFF, 0xA1, 0x60, 0x47, 0xFF, 0xB4, 0xC8, 0x02,
+	 0xC7, 0x03, 0x34, 0x60, 0xF4, 0x63, 0x30, 0x64, 0xBD, 0xDB, 0x66, 0x45, 0x26, 0x46, 0x3F, 0xF2,
+	 0x34, 0x60, 0xF2, 0x61, 0xC2, 0xA0, 0xFF, 0xFF, 0x01, 0x04, 0x3E, 0x64, 0x65, 0x46, 0x02, 0xA4,
+	 0xA1, 0xDB, 0xC8, 0x81, 0x12, 0x65, 0xCD, 0x84, 0x4C, 0x91, 0x60, 0x43, 0x60, 0xFE, 0xA5, 0xD2,
+	 0xDE, 0x85, 0x7F, 0x26, 0x02, 0x00, 0x00, 0xF4, 0x04, 0x65, 0x5D, 0x93, 0xA3, 0xDB, 0x5D, 0x93,
+	 0xA5, 0xD2, 0xF6, 0x1F, 0x5D, 0x93, 0x20, 0xFE, 0xDF, 0x83, 0x0C, 0xF2, 0xFF, 0xFF, 0x1A, 0x65,
+	 0x60, 0x47, 0xFF, 0xB4, 0xC4, 0x85, 0xDC, 0x60, 0x58, 0x4D, 0xC7, 0x78, 0xFF, 0xFF, 0x0B, 0xF2,
+	 0xFF, 0xFF, 0x07, 0xB4, 0x01, 0x61, 0x03, 0x03, 0xCC, 0x84, 0xE1, 0x81, 0xFD, 0x02, 0x61, 0x44,
+	 0x94, 0xFB, 0x27, 0x45, 0x02, 0x62, 0x46, 0xD3, 0x5A, 0xD1, 0x60, 0x47, 0x56, 0xFB, 0x64, 0x47,
+	 0x55, 0xFB, 0x00, 0x64, 0x5B, 0xFB, 0x0C, 0x62, 0x46, 0xD3, 0x7E, 0xFB, 0x0B, 0xF0, 0x0F, 0x60,
+	 0xFF, 0x64, 0xA0, 0x84, 0x83, 0xFB, 0x1C, 0x60, 0x6A, 0x62, 0xA2, 0xD3, 0x85, 0xFB, 0x26, 0x46,
+	 0x32, 0xF0, 0x7F, 0xF9, 0x33, 0xF0, 0x80, 0xF9, 0x34, 0xF0, 0x81, 0xF9, 0x2E, 0x60, 0x2E, 0x64,
+	 0x2D, 0x60, 0x8A, 0x63, 0xA0, 0xD1, 0xA3, 0xD9, 0x64, 0x41, 0x58, 0xD1, 0x5B, 0xD9, 0x7D, 0xF3,
+	 0x66, 0x45, 0xA6, 0xF5, 0x60, 0x40, 0x01, 0x27, 0x08, 0x00, 0x91, 0xFA, 0x61, 0x44, 0xFD, 0x60,
+	 0x58, 0x4E, 0xAC, 0x78, 0xFF, 0xFF, 0x12, 0xFA, 0x07, 0x00, 0x11, 0xF8, 0x64, 0x44, 0xFD, 0x60,
+	 0x58, 0x4E, 0xAC, 0x78, 0xFF, 0xFF, 0x12, 0xFA, 0x65, 0x46, 0xA6, 0xF3, 0xFF, 0xFF, 0x02, 0xA4,
+	 0x40, 0x4B, 0x3F, 0xF2, 0x00, 0xF4, 0x60, 0x43, 0xFA, 0xA3, 0x00, 0x60, 0x17, 0x61, 0x00, 0x60,
+	 0x01, 0x65, 0x01, 0x60, 0xFF, 0x64, 0x40, 0x4C, 0xFD, 0x60, 0x58, 0x4E, 0x7A, 0x78, 0xFF, 0xFF,
+	 0x00, 0xBB, 0xFF, 0xFF, 0x00, 0x02, 0x00, 0x64, 0x40, 0x4A, 0x60, 0xFE, 0x02, 0x60, 0x00, 0x63,
+	 0xBD, 0xD3, 0xBD, 0xD3, 0x60, 0x41, 0xFE, 0x60, 0x58, 0x4E, 0x2C, 0x78, 0xFF, 0xFF, 0x20, 0xFE,
+	 0x00, 0x65, 0x00, 0x64, 0x19, 0x60, 0x3B, 0xFB, 0x02, 0x00, 0x20, 0xFE, 0xFF, 0x65, 0x02, 0x60,
+	 0x00, 0x63, 0x60, 0xFE, 0xBD, 0xD3, 0xBD, 0xD3, 0x60, 0x41, 0x20, 0xFE, 0xCD, 0x81, 0x60, 0x40,
+	 0x80, 0x2A, 0x39, 0x00, 0x7F, 0xB4, 0x02, 0x3A, 0x02, 0x00, 0x01, 0x64, 0x2E, 0x00, 0x04, 0x3A,
+	 0x02, 0x00, 0x02, 0x64, 0x2A, 0x00, 0x0B, 0x3A, 0x02, 0x00, 0x04, 0x64, 0x26, 0x00, 0x16, 0x3A,
+	 0x02, 0x00, 0x08, 0x64, 0x22, 0x00, 0x0C, 0x3A, 0x02, 0x00, 0x10, 0x64, 0x1E, 0x00, 0x12, 0x3A,
+	 0x02, 0x00, 0x20, 0x64, 0x1A, 0x00, 0x18, 0x3A, 0x02, 0x00, 0x40, 0x64, 0x16, 0x00, 0x24, 0x3A,
+	 0x02, 0x00, 0x80, 0x64, 0x12, 0x00, 0x30, 0x3A, 0x02, 0x00, 0x01, 0x67, 0x0E, 0x00, 0x48, 0x3A,
+	 0x02, 0x00, 0x02, 0x67, 0x0A, 0x00, 0x60, 0x3A, 0x02, 0x00, 0x04, 0x67, 0x06, 0x00, 0x6C, 0x3A,
+	 0x02, 0x00, 0x08, 0x67, 0x02, 0x00, 0x00, 0x64, 0x00, 0x00, 0x19, 0x60, 0x3B, 0xF1, 0xFF, 0xFF,
+	 0xB0, 0x84, 0x19, 0x60, 0x3B, 0xFB, 0x61, 0x40, 0x00, 0x36, 0x05, 0x00, 0x60, 0xFE, 0xBD, 0xD3,
+	 0xFF, 0xFF, 0x20, 0xFE, 0xBB, 0x01, 0x65, 0x40, 0x00, 0x3A, 0x1E, 0x00, 0x26, 0x46, 0x3F, 0xF2,
+	 0x00, 0xF4, 0x60, 0x43, 0xFA, 0xA3, 0x00, 0x60, 0x17, 0x61, 0x00, 0x60, 0x32, 0x65, 0x01, 0x60,
+	 0xFF, 0x64, 0x40, 0x4C, 0xFD, 0x60, 0x58, 0x4E, 0x7A, 0x78, 0xFF, 0xFF, 0x00, 0xBB, 0xFF, 0xFF,
+	 0x0B, 0x03, 0x60, 0xFE, 0x02, 0x60, 0x00, 0x63, 0xBD, 0xD3, 0xBD, 0xD3, 0x60, 0x41, 0xFE, 0x60,
+	 0x58, 0x4E, 0x2C, 0x78, 0xFF, 0xFF, 0x91, 0x01, 0x20, 0xFE, 0x00, 0x65, 0xFC, 0x60, 0x58, 0x4E,
+	 0xC7, 0x78, 0xFF, 0xFF, 0xA1, 0xF3, 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x27, 0x04, 0x00, 0xFD, 0x60,
+	 0x58, 0x4E, 0x11, 0x78, 0xFF, 0xFF, 0x20, 0xFE, 0x37, 0x60, 0xF8, 0x61, 0xA1, 0xD1, 0xA1, 0xF3,
+	 0x01, 0x60, 0xAC, 0x63, 0x60, 0x45, 0x2A, 0x44, 0x79, 0xFB, 0xA3, 0xD5, 0x65, 0x40, 0x01, 0x27,
+	 0x5B, 0xD5, 0x65, 0x40, 0x01, 0x27, 0x59, 0xD1, 0x66, 0x41, 0xA0, 0x84, 0x24, 0x94, 0x2B, 0x46,
+	 0x0F, 0xFA, 0x7A, 0xFB, 0x16, 0x64, 0x12, 0xFA, 0x01, 0x64, 0x11, 0xFA, 0x66, 0x5C, 0xC2, 0x60,
+	 0x58, 0x4E, 0x6D, 0x78, 0xFF, 0xFF, 0xA6, 0xF3, 0xFF, 0xFF, 0x02, 0xA4, 0x40, 0x4B, 0x60, 0x46,
+	 0x00, 0x64, 0x17, 0xFA, 0x00, 0x64, 0x16, 0xFA, 0x13, 0xFA, 0x00, 0x65, 0x26, 0x46, 0xFD, 0x60,
+	 0x58, 0x4E, 0xDD, 0x78, 0xFF, 0xFF, 0xA6, 0xF3, 0x1D, 0x60, 0xC0, 0x65, 0x02, 0xA4, 0x60, 0x46,
+	 0x05, 0xF0, 0x60, 0x41, 0x64, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x00, 0x7C, 0x44, 0xD9, 0x26, 0x46,
+	 0x31, 0xF2, 0x61, 0x5C, 0x60, 0x47, 0x00, 0x7F, 0xE0, 0x84, 0x44, 0xD9, 0x26, 0x46, 0x2F, 0xF0,
+	 0x61, 0x46, 0x03, 0xF8, 0x26, 0x46, 0x30, 0xF0, 0x61, 0x46, 0x04, 0xF8, 0x26, 0x46, 0x31, 0xF0,
+	 0x61, 0x46, 0x05, 0xF8, 0x26, 0x46, 0xD9, 0x60, 0x58, 0x4E, 0xAE, 0x78, 0xFF, 0xFF, 0x26, 0x46,
+	 0x26, 0x60, 0x1A, 0x64, 0x40, 0x4B, 0x34, 0x60, 0x58, 0x4D, 0x08, 0x78, 0xFF, 0xFF, 0x00, 0x66,
+	 0x46, 0x46, 0x03, 0x65, 0xF1, 0x60, 0x58, 0x4E, 0xC3, 0x78, 0xFF, 0xFF, 0x01, 0x63, 0x8A, 0xFD,
+	 0x08, 0x60, 0x0C, 0xF1, 0x00, 0x60, 0x02, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0xC1, 0xFE,
+	 0x5C, 0x64, 0x3B, 0x42, 0x5A, 0xDB, 0xE1, 0x60, 0x22, 0x78, 0xFF, 0xFF, 0xFF, 0x60, 0xF7, 0x65,
+	 0x20, 0x44, 0x24, 0x80, 0xDA, 0x60, 0x74, 0x78, 0xFF, 0xFF, 0xDB, 0xF3, 0xFF, 0xFF, 0xFD, 0xA0,
+	 0x2A, 0xF2, 0x03, 0x03, 0xE6, 0x60, 0xDE, 0x78, 0xFF, 0xFF, 0x60, 0x40, 0xB0, 0x36, 0x11, 0x00,
+	 0xC0, 0x36, 0x02, 0x00, 0x2F, 0x58, 0xFF, 0xFF, 0x26, 0x46, 0x26, 0x60, 0x1A, 0x64, 0x40, 0x4B,
+	 0x34, 0x60, 0x58, 0x4D, 0x08, 0x78, 0xFF, 0xFF, 0x00, 0x66, 0x46, 0x46, 0xDA, 0x60, 0x74, 0x78,
+	 0xFF, 0xFF, 0x66, 0x45, 0x00, 0xF4, 0x0A, 0xF2, 0x0B, 0xF2, 0xFE, 0xA0, 0xF3, 0xA0, 0x67, 0x02,
+	 0x60, 0x41, 0x09, 0xF2, 0x1D, 0x03, 0x00, 0xA0, 0xFF, 0xA0, 0x4B, 0x03, 0x5D, 0x03, 0x00, 0xA0,
+	 0xFF, 0xFF, 0x47, 0x03, 0x01, 0x64, 0x10, 0x60, 0x0B, 0xFB, 0x0D, 0x64, 0x10, 0x60, 0x0C, 0xFB,
+	 0x03, 0x64, 0x10, 0x60, 0x0D, 0xFB, 0x26, 0x46, 0x26, 0x60, 0x1A, 0x64, 0x40, 0x4B, 0x34, 0x60,
+	 0x58, 0x4D, 0x08, 0x78, 0xFF, 0xFF, 0x00, 0x66, 0x46, 0x46, 0xDA, 0x60, 0x74, 0x78, 0xFF, 0xFF,
+	 0x16, 0x60, 0xC3, 0xF3, 0xFF, 0xFF, 0xFE, 0xA0, 0x20, 0x60, 0x16, 0x61, 0x15, 0x02, 0x01, 0x64,
+	 0xA1, 0xDB, 0x00, 0x64, 0x10, 0x60, 0x0C, 0xFB, 0x01, 0x64, 0x10, 0x60, 0x0D, 0xFB, 0x26, 0x46,
+	 0x26, 0x60, 0x1A, 0x64, 0x40, 0x4B, 0x34, 0x60, 0x58, 0x4D, 0x08, 0x78, 0xFF, 0xFF, 0x00, 0x66,
+	 0x46, 0x46, 0xDA, 0x60, 0x74, 0x78, 0xFF, 0xFF, 0x02, 0x64, 0xA1, 0xDB, 0x00, 0x64, 0x10, 0x60,
+	 0x0C, 0xFB, 0x01, 0x64, 0x10, 0x60, 0x0D, 0xFB, 0x26, 0x46, 0x26, 0x60, 0x1A, 0x64, 0x40, 0x4B,
+	 0x34, 0x60, 0x58, 0x4D, 0x08, 0x78, 0xFF, 0xFF, 0x00, 0x66, 0x46, 0x46, 0xDA, 0x60, 0x74, 0x78,
+	 0xFF, 0xFF, 0x65, 0x46, 0x07, 0xF4, 0x06, 0xF2, 0xFF, 0xFF, 0x01, 0x7E, 0x06, 0xFA, 0x65, 0x46,
+	 0x26, 0x46, 0x26, 0x60, 0x1A, 0x64, 0x40, 0x4B, 0x34, 0x60, 0x58, 0x4D, 0x08, 0x78, 0xFF, 0xFF,
+	 0x00, 0x66, 0x46, 0x46, 0x2F, 0x58, 0xFF, 0xFF, 0xDC, 0x60, 0x09, 0x78, 0xFF, 0xFF, 0x0A, 0xF2,
+	 0x09, 0xF2, 0xFC, 0xA0, 0xFF, 0xA0, 0x11, 0x02, 0x0A, 0x02, 0x0B, 0xF2, 0x65, 0x46, 0x0A, 0x1B,
+	 0x66, 0x41, 0x07, 0xF4, 0x06, 0xF2, 0xFF, 0xFF, 0x01, 0x7E, 0x06, 0xFA, 0x61, 0x46, 0xDA, 0x60,
+	 0x74, 0x78, 0xFF, 0xFF, 0x26, 0x46, 0x2F, 0x58, 0xFF, 0xFF, 0x65, 0x46, 0x68, 0xF1, 0x2A, 0xF2,
+	 0x64, 0x41, 0x60, 0x40, 0xA0, 0x3A, 0x02, 0x00, 0x08, 0xB1, 0x04, 0x00, 0xC0, 0x3A, 0x0B, 0x00,
+	 0x04, 0xB1, 0xFF, 0xFF, 0x1E, 0x03, 0x08, 0x60, 0x15, 0xF1, 0x00, 0x60, 0x10, 0x64, 0xB0, 0x84,
+	 0xA2, 0xDB, 0xCF, 0xFE, 0x16, 0x00, 0xB0, 0x3A, 0x02, 0x00, 0x01, 0x65, 0x07, 0x00, 0x10, 0x3A,
+	 0x02, 0x00, 0x02, 0x65, 0x03, 0x00, 0x30, 0x3A, 0x0C, 0x00, 0x10, 0x65, 0xA5, 0x80, 0xFF, 0xFF,
+	 0x08, 0x03, 0x08, 0x60, 0x15, 0xF1, 0x00, 0x60, 0x08, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE,
+	 0x00, 0x66, 0x2F, 0x58, 0xFF, 0xFF, 0x16, 0x60, 0xC3, 0xF3, 0xFF, 0xFF, 0xFC, 0xA0, 0xFF, 0xFF,
+	 0x14, 0x04, 0x00, 0x60, 0x02, 0x64, 0x08, 0x60, 0x16, 0xFB, 0xE7, 0x60, 0x1B, 0x64, 0x5A, 0xDB,
+	 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x19, 0x60, 0xA5, 0xF1, 0x01, 0x60, 0x00, 0x64, 0xA0, 0x80,
+	 0xFF, 0xFF, 0x03, 0x03, 0xDA, 0x60, 0x74, 0x78, 0xFF, 0xFF, 0x20, 0x40, 0x08, 0x2A, 0x03, 0x00,
+	 0xD9, 0x60, 0xCA, 0x78, 0xFF, 0xFF, 0xE2, 0x60, 0x73, 0x78, 0xFF, 0xFF, 0x4E, 0x64, 0x3B, 0x42,
+	 0x5A, 0xDB, 0x2E, 0xF5, 0xFF, 0xFF, 0x27, 0xF2, 0x1D, 0x60, 0xC0, 0x65, 0x60, 0x47, 0x00, 0x7F,
+	 0xE0, 0x84, 0x44, 0xD3, 0x66, 0x41, 0x60, 0x46, 0x60, 0x43, 0x05, 0xF2, 0x16, 0x18, 0x61, 0x46,
+	 0x27, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0x04, 0xF2, 0x0C, 0x02, 0x61, 0x46, 0x26, 0xF0, 0x63, 0x46,
+	 0xD0, 0x80, 0x03, 0xF2, 0x06, 0x02, 0x61, 0x46, 0x25, 0xF0, 0x63, 0x46, 0xD0, 0x80, 0xFF, 0xFF,
+	 0x07, 0x03, 0x80, 0xF4, 0xFF, 0xFF, 0x63, 0x46, 0xE8, 0x1B, 0xA6, 0xF3, 0x08, 0xFE, 0x60, 0x43,
+	 0x61, 0x46, 0x25, 0xF2, 0x26, 0xF0, 0xA7, 0xF2, 0xA8, 0xF0, 0x65, 0xF5, 0xFF, 0xFF, 0x00, 0xF4,
+	 0xFF, 0xFF, 0x89, 0xF8, 0x65, 0xF5, 0xFF, 0xFF, 0x07, 0xFC, 0x2C, 0xFA, 0x2D, 0xF8, 0xAE, 0xFA,
+	 0xEA, 0xF3, 0x2F, 0xFA, 0xEB, 0xF3, 0x30, 0xFA, 0xEC, 0xF3, 0x31, 0xFA, 0x7F, 0xF3, 0x32, 0xFA,
+	 0x80, 0xF3, 0x33, 0xFA, 0x81, 0xF3, 0x34, 0xFA, 0x1B, 0x60, 0xFE, 0xF3, 0xFF, 0xFF, 0x03, 0x1B,
+	 0x00, 0x60, 0xA0, 0x64, 0x02, 0x00, 0x00, 0x60, 0xC0, 0x64, 0x2A, 0xFA, 0x02, 0x63, 0x3F, 0xFC,
+	 0xAB, 0xFC, 0x00, 0x64, 0x3E, 0xFA, 0xC9, 0xF1, 0x19, 0xF8, 0x25, 0x60, 0xCE, 0x64, 0x13, 0x60,
+	 0x0D, 0xFB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0x00, 0x66,
+	 0x46, 0x46, 0xC1, 0xFE, 0x10, 0x60, 0x2A, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0xE1, 0x60, 0x34, 0x78,
+	 0xFF, 0xFF, 0x00, 0x60, 0x3A, 0x61, 0xB6, 0x60, 0x58, 0x4D, 0x22, 0x78, 0xFF, 0xFF, 0x66, 0x44,
+	 0x61, 0xFB, 0xA6, 0xF3, 0x07, 0xFA, 0x0C, 0x60, 0x80, 0x64, 0xB9, 0xF1, 0x19, 0xF8, 0x0E, 0xFA,
+	 0x00, 0x64, 0x3E, 0xFA, 0x3F, 0xFA, 0x00, 0x60, 0x3A, 0x61, 0xB6, 0x60, 0x58, 0x4D, 0x22, 0x78,
+	 0xFF, 0xFF, 0x66, 0x44, 0x60, 0xFB, 0xA6, 0xF3, 0x07, 0xFA, 0x0C, 0x60, 0x80, 0x64, 0x0E, 0xFA,
+	 0xB9, 0xF1, 0x19, 0xF8, 0x00, 0x64, 0x3E, 0xFA, 0x3F, 0xFA, 0xE8, 0x60, 0xEA, 0x64, 0x08, 0x60,
+	 0x33, 0xFB, 0x00, 0x60, 0x80, 0x64, 0x08, 0x60, 0x10, 0xFB, 0xE7, 0x60, 0xCB, 0x64, 0x5A, 0xDB,
+	 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x16, 0x60, 0x87, 0xF3, 0xFF, 0xFF, 0x01, 0xA8, 0x03, 0xA8,
+	 0x04, 0x03, 0x03, 0x03, 0xE8, 0x60, 0xDC, 0x78, 0xFF, 0xFF, 0x04, 0x60, 0x00, 0x65, 0x20, 0x44,
+	 0x34, 0x80, 0x10, 0x60, 0x1E, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x9B, 0xFE, 0x03, 0x05, 0x20, 0x40,
+	 0x4B, 0x23, 0x0A, 0x00, 0x80, 0x60, 0x00, 0x64, 0x08, 0x60, 0x10, 0xFB, 0xE7, 0x60, 0xD9, 0x64,
+	 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x10, 0x60, 0x13, 0xF3, 0xFF, 0xFF, 0x60, 0x40,
+	 0x01, 0x2A, 0x07, 0x00, 0x90, 0x60, 0x00, 0x65, 0x20, 0x44, 0x34, 0x80, 0x00, 0x64, 0xA2, 0xDB,
+	 0x04, 0x00, 0x10, 0x60, 0x00, 0x65, 0x20, 0x44, 0x34, 0x80, 0x8A, 0xF3, 0x58, 0xFB, 0x82, 0xF1,
+	 0xBA, 0xFE, 0x01, 0xA8, 0x59, 0xF9, 0x04, 0x02, 0x02, 0x64, 0x8A, 0xFB, 0xFF, 0xFF, 0xC1, 0xFE,
+	 0x64, 0x47, 0xDB, 0xF3, 0x10, 0xB0, 0x04, 0xA8, 0x2B, 0x02, 0x2A, 0x02, 0x61, 0xF5, 0xEA, 0xF1,
+	 0x2F, 0xF8, 0xEB, 0xF1, 0x30, 0xF8, 0xEC, 0xF1, 0x31, 0xF8, 0x7F, 0xF1, 0x2C, 0xF8, 0x32, 0xF8,
+	 0x80, 0xF1, 0x2D, 0xF8, 0x33, 0xF8, 0x81, 0xF1, 0x2E, 0xF8, 0x34, 0xF8, 0x10, 0x60, 0x48, 0x64,
+	 0x2A, 0xFA, 0x25, 0x60, 0xCE, 0x64, 0x13, 0x60, 0x0D, 0xFB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64,
+	 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xC1, 0xFE, 0x00, 0x60, 0x01, 0x64, 0x08, 0x60, 0x10, 0xFB,
+	 0xE8, 0x60, 0x36, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x10, 0x67, 0x82, 0xFB,
+	 0x8A, 0xF3, 0xFF, 0xFF, 0x00, 0xA8, 0xFF, 0xFF, 0x0A, 0x03, 0x80, 0x60, 0x00, 0x64, 0x08, 0x60,
+	 0x10, 0xFB, 0xE8, 0x60, 0x38, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x10, 0x60,
+	 0x1E, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x05, 0x7C, 0x53, 0xF9, 0x2F, 0x60, 0x24, 0x64, 0x54, 0xFB,
+	 0x19, 0x60, 0x40, 0xF3, 0xFF, 0xFF, 0x15, 0x18, 0x10, 0x60, 0x1E, 0x62, 0x00, 0x64, 0xA2, 0xDB,
+	 0x08, 0x60, 0x12, 0xF1, 0x00, 0x60, 0x10, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x10, 0x60,
+	 0x00, 0x64, 0x08, 0x60, 0x10, 0xFB, 0xE8, 0x60, 0x69, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58,
+	 0xFF, 0xFF, 0x19, 0x60, 0x41, 0xF3, 0xFF, 0x60, 0x80, 0x65, 0xA4, 0x80, 0x5A, 0xD3, 0x05, 0x02,
+	 0x04, 0x1B, 0x5A, 0xD3, 0xFF, 0xFF, 0x01, 0x1B, 0x15, 0x00, 0x10, 0x60, 0x1E, 0x62, 0x00, 0x64,
+	 0xA2, 0xDB, 0x08, 0x60, 0x12, 0xF1, 0x00, 0x60, 0x20, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE,
+	 0x10, 0x60, 0x00, 0x64, 0x08, 0x60, 0x10, 0xFB, 0xE8, 0x60, 0x8A, 0x64, 0x5A, 0xDB, 0xCF, 0xFE,
+	 0x2F, 0x58, 0xFF, 0xFF, 0xFF, 0xFF, 0x59, 0xF3, 0x82, 0xFB, 0x60, 0x40, 0x10, 0x27, 0xDA, 0xFE,
+	 0xDB, 0xF3, 0x00, 0xA8, 0x04, 0xA8, 0x23, 0x02, 0x22, 0x02, 0x60, 0xF5, 0xEA, 0xF1, 0x2F, 0xF8,
+	 0xEB, 0xF1, 0x30, 0xF8, 0xEC, 0xF1, 0x31, 0xF8, 0x7F, 0xF1, 0x2C, 0xF8, 0x80, 0xF1, 0x2D, 0xF8,
+	 0x81, 0xF1, 0x2E, 0xF8, 0xA4, 0x64, 0x2A, 0xFA, 0x83, 0xF1, 0xC0, 0x67, 0xB0, 0x84, 0x2B, 0xFA,
+	 0x25, 0x60, 0xCE, 0x64, 0x13, 0x60, 0x0D, 0xFB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB,
+	 0xFF, 0xFF, 0x2B, 0xFF, 0xC1, 0xFE, 0x20, 0x60, 0x00, 0x65, 0x20, 0x44, 0x34, 0x80, 0x00, 0x60,
+	 0x04, 0x61, 0xB6, 0x60, 0x58, 0x4D, 0x22, 0x78, 0xFF, 0xFF, 0x01, 0x64, 0x23, 0xFA, 0xF1, 0x60,
+	 0x02, 0x64, 0x24, 0xFA, 0x26, 0x60, 0x0A, 0x64, 0x13, 0x60, 0x0D, 0xFB, 0x66, 0x44, 0x5A, 0xDB,
+	 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xFA, 0xFE, 0xEB, 0x60, 0xFF, 0x65, 0x20, 0x44,
+	 0x24, 0x80, 0x08, 0x60, 0x08, 0xF1, 0x80, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE,
+	 0x58, 0xF3, 0x8A, 0xFB, 0xFF, 0xFF, 0xC1, 0xFE, 0x10, 0x60, 0x1E, 0x62, 0x00, 0x64, 0xA2, 0xDB,
+	 0x00, 0x60, 0x80, 0x64, 0x08, 0x60, 0x10, 0xFB, 0xE7, 0x60, 0xCB, 0x64, 0x5A, 0xDB, 0xCF, 0xFE,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x9C, 0xF1, 0x00, 0x64, 0xB0, 0x86, 0x9C, 0xFB, 0x07, 0x03, 0x26, 0x60,
+	 0x1A, 0x64, 0x40, 0x4B, 0x34, 0x60, 0x58, 0x4D, 0x08, 0x78, 0xFF, 0xFF, 0xEB, 0x60, 0xFF, 0x65,
+	 0x20, 0x44, 0x24, 0x80, 0x10, 0x60, 0x1E, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x00, 0x60, 0x80, 0x64,
+	 0x08, 0x60, 0x10, 0xFB, 0xE7, 0x60, 0xCB, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x95, 0xF3, 0x26, 0x46, 0x60, 0x43, 0x01, 0x2A, 0x20, 0x00, 0x0F, 0xF2, 0x2A, 0xF0, 0x60, 0x40,
+	 0x10, 0x2A, 0x0F, 0x00, 0x64, 0x40, 0x04, 0x27, 0x18, 0x00, 0xFD, 0xB3, 0x64, 0x40, 0x20, 0x27,
+	 0x02, 0xBB, 0x08, 0x60, 0x1B, 0xF1, 0x00, 0x60, 0x08, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE,
+	 0x0B, 0x00, 0xFB, 0xB3, 0x64, 0x40, 0x20, 0x27, 0x04, 0xBB, 0x08, 0x60, 0x1B, 0xF1, 0x00, 0x60,
+	 0x10, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x95, 0xFD, 0x26, 0x46, 0x2F, 0x58, 0xFF, 0xFF,
+	 0xDB, 0xF3, 0x3F, 0xF2, 0x04, 0xA8, 0x57, 0xFB, 0x02, 0x03, 0x2F, 0x58, 0xFF, 0xFF, 0x00, 0xF4,
+	 0x1E, 0x63, 0x08, 0x64, 0x40, 0x48, 0xBD, 0xD2, 0xFF, 0xFF, 0x60, 0x47, 0x05, 0x36, 0x0B, 0x00,
+	 0xFF, 0xB5, 0xC7, 0x83, 0x01, 0x2A, 0xF7, 0x01, 0x4F, 0xD2, 0x5B, 0xD2, 0x60, 0x40, 0x05, 0x37,
+	 0x0B, 0x00, 0xDF, 0x83, 0xF5, 0x01, 0xFF, 0xB5, 0x65, 0x41, 0xA3, 0xD2, 0x47, 0x8A, 0x60, 0x47,
+	 0x40, 0x4C, 0x5B, 0xD2, 0xDF, 0x83, 0x08, 0x00, 0x40, 0x4C, 0x00, 0x7F, 0xDC, 0x85, 0x47, 0x8A,
+	 0x60, 0x41, 0x5B, 0xD2, 0xDB, 0x83, 0x60, 0x47, 0x01, 0xB0, 0xFE, 0xB5, 0x02, 0x03, 0x02, 0x64,
+	 0x40, 0x48, 0x2C, 0x47, 0xFF, 0xB4, 0x73, 0xF1, 0x08, 0x28, 0x73, 0xFB, 0x83, 0xF1, 0x65, 0x44,
+	 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0xFD, 0xA1, 0xE1, 0x81, 0xE1, 0x81, 0xE1, 0x85, 0xC4, 0x81,
+	 0xD0, 0x84, 0xD1, 0x80, 0x28, 0x07, 0x27, 0x06, 0x9C, 0x84, 0xDC, 0x84, 0xE8, 0x84, 0xE8, 0x84,
+	 0xE8, 0x85, 0x94, 0xF3, 0xC7, 0x83, 0x01, 0x26, 0x60, 0x47, 0xAB, 0x83, 0xFC, 0xA3, 0x02, 0x00,
+	 0x03, 0x04, 0x00, 0xF4, 0x84, 0xA3, 0xFC, 0x01, 0x80, 0x65, 0x47, 0xD0, 0x28, 0x41, 0xA0, 0x80,
+	 0xFE, 0xA1, 0x14, 0x03, 0x08, 0x02, 0x08, 0x60, 0x2D, 0xF1, 0x00, 0x60, 0x10, 0x64, 0xB0, 0x84,
+	 0xA2, 0xDB, 0xCF, 0xFE, 0x1B, 0x00, 0x08, 0x60, 0x2D, 0xF1, 0x00, 0x60, 0x04, 0x64, 0xB0, 0x84,
+	 0xA2, 0xDB, 0xCF, 0xFE, 0x13, 0x00, 0x28, 0x41, 0xFE, 0xA1, 0xFF, 0xFF, 0x08, 0x03, 0x08, 0x60,
+	 0x2D, 0xF1, 0x00, 0x60, 0x08, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x07, 0x00, 0x08, 0x60,
+	 0x2D, 0xF1, 0x00, 0x60, 0x02, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x08, 0x60, 0x1B, 0xF1,
+	 0x00, 0x60, 0x04, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x26, 0x46, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x08, 0x60, 0x1B, 0xF1, 0x00, 0x60, 0x20, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x2F, 0x58,
+	 0xFF, 0xFF, 0x08, 0x60, 0x1B, 0xF1, 0x02, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x00, 0x63, 0x95, 0xFD, 0x1C, 0x60, 0x9E, 0x63, 0x00, 0x64, 0xA3, 0xDB,
+	 0x06, 0xA3, 0x10, 0x60, 0x98, 0x64, 0xBD, 0xDB, 0xBD, 0xDB, 0x06, 0x64, 0xA3, 0xDB, 0xE9, 0x60,
+	 0xB8, 0x64, 0x08, 0x60, 0x4B, 0xFB, 0xCE, 0xF1, 0x0E, 0x60, 0x51, 0xF9, 0x1C, 0x60, 0xAA, 0x63,
+	 0x00, 0x64, 0xA3, 0xDB, 0x06, 0xA3, 0x10, 0x60, 0x9C, 0x64, 0xBD, 0xDB, 0xBD, 0xDB, 0x06, 0x64,
+	 0xA3, 0xDB, 0xE9, 0x60, 0xC1, 0x64, 0x08, 0x60, 0x4D, 0xFB, 0x16, 0x60, 0xAE, 0xF1, 0x0E, 0x60,
+	 0x57, 0xF9, 0x00, 0x60, 0x3A, 0x61, 0xB6, 0x60, 0x58, 0x4D, 0x22, 0x78, 0xFF, 0xFF, 0x66, 0x44,
+	 0x63, 0xFB, 0xA6, 0xF3, 0x07, 0xFA, 0xB9, 0xF3, 0x19, 0xFA, 0xF8, 0x60, 0x80, 0x64, 0x0E, 0xFA,
+	 0x00, 0x64, 0x3E, 0xFA, 0x3F, 0xFA, 0x00, 0x60, 0x3A, 0x61, 0xB6, 0x60, 0x58, 0x4D, 0x22, 0x78,
+	 0xFF, 0xFF, 0x66, 0x44, 0x64, 0xFB, 0xA6, 0xF3, 0x07, 0xFA, 0xB9, 0xF3, 0x19, 0xFA, 0x24, 0x60,
+	 0x80, 0x64, 0x0E, 0xFA, 0x00, 0x64, 0x3E, 0xFA, 0x3F, 0xFA, 0x00, 0x64, 0x08, 0x60, 0x2D, 0xFB,
+	 0x5A, 0xDB, 0xEA, 0x60, 0x1F, 0x64, 0x08, 0x60, 0x37, 0xFB, 0x2F, 0x58, 0xFF, 0xFF, 0x00, 0x63,
+	 0x95, 0xFD, 0xBA, 0xFE, 0xFE, 0x60, 0xFF, 0x65, 0x20, 0x44, 0x24, 0x80, 0x82, 0xFD, 0x08, 0x60,
+	 0x15, 0xF1, 0x04, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x00, 0x64, 0x08, 0x60,
+	 0x1B, 0xFB, 0x5A, 0xDB, 0x2F, 0x58, 0xFF, 0xFF, 0x16, 0x60, 0xAB, 0xF3, 0xFF, 0xFF, 0x01, 0xA8,
+	 0xFF, 0xFF, 0x05, 0x03, 0x19, 0x60, 0xF0, 0xF1, 0x0E, 0x60, 0x57, 0xF9, 0x04, 0x00, 0x16, 0x60,
+	 0xAE, 0xF1, 0x0E, 0x60, 0x57, 0xF9, 0x16, 0x60, 0xAB, 0xF3, 0xFF, 0xFF, 0x09, 0x1B, 0x00, 0x64,
+	 0x82, 0xFB, 0xBA, 0xFE, 0x00, 0x64, 0x08, 0x60, 0x1B, 0xFB, 0x5A, 0xDB, 0x2F, 0x58, 0xFF, 0xFF,
+	 0xBA, 0xFE, 0x95, 0xF3, 0x00, 0x63, 0x82, 0xFD, 0x10, 0xBC, 0x95, 0xFB, 0xFE, 0x60, 0xFF, 0x65,
+	 0x20, 0x44, 0x24, 0x80, 0x08, 0x60, 0x08, 0xF1, 0x80, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB,
+	 0xCF, 0xFE, 0x00, 0x60, 0x64, 0x63, 0x0E, 0x60, 0x37, 0xFD, 0x10, 0x60, 0x36, 0x62, 0x00, 0x64,
+	 0xA2, 0xDB, 0x01, 0x60, 0x04, 0x64, 0x08, 0x60, 0x1C, 0xFB, 0xEA, 0x60, 0x73, 0x64, 0x5A, 0xDB,
+	 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x08, 0x60, 0x1B, 0xF1, 0x01, 0x60, 0x00, 0x64, 0xA0, 0x80,
+	 0x9C, 0x84, 0x03, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0xA2, 0x01, 0x31, 0x40, 0x04, 0x2A, 0xE5, 0x01,
+	 0x20, 0x40, 0x12, 0x23, 0x11, 0x00, 0x10, 0x60, 0x36, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x10, 0x60,
+	 0x5A, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x81, 0x60, 0x00, 0x64, 0x08, 0x60, 0x1C, 0xFB, 0xEA, 0x60,
+	 0x73, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0xDD, 0x01, 0x10, 0x60, 0x36, 0x62, 0x00, 0x64, 0xA2, 0xDB,
+	 0x01, 0x60, 0x00, 0x65, 0x20, 0x44, 0x34, 0x80, 0x64, 0xF5, 0xB9, 0xF1, 0x19, 0xF8, 0x7F, 0xF1,
+	 0x2C, 0xF8, 0x32, 0xF8, 0x80, 0xF1, 0x2D, 0xF8, 0x33, 0xF8, 0x81, 0xF1, 0x2E, 0xF8, 0x34, 0xF8,
+	 0xEA, 0xF1, 0x2F, 0xF8, 0xEB, 0xF1, 0x30, 0xF8, 0xEC, 0xF1, 0x31, 0xF8, 0x11, 0x60, 0x48, 0x64,
+	 0x2A, 0xFA, 0x00, 0x64, 0x2B, 0xFA, 0x23, 0xFA, 0x25, 0x60, 0xCE, 0x64, 0x13, 0x60, 0x0D, 0xFB,
+	 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xC1, 0xFE, 0x00, 0x60,
+	 0x01, 0x64, 0x08, 0x60, 0x1C, 0xFB, 0xEA, 0x60, 0xC9, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58,
+	 0xFF, 0xFF, 0x64, 0xF5, 0x23, 0xF2, 0xFF, 0xFF, 0x01, 0x18, 0x82, 0x01, 0x10, 0x67, 0x82, 0xFB,
+	 0x03, 0x64, 0x96, 0xFB, 0xFE, 0x60, 0xFF, 0x65, 0x20, 0x44, 0x24, 0x80, 0x08, 0x60, 0x08, 0xF1,
+	 0x80, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x10, 0x60, 0x36, 0x62, 0x00, 0x64,
+	 0xA2, 0xDB, 0x81, 0x60, 0x00, 0x64, 0x08, 0x60, 0x1C, 0xFB, 0xEA, 0x60, 0xEA, 0x64, 0x5A, 0xDB,
+	 0xCF, 0xFE, 0x0C, 0x00, 0x08, 0x60, 0x1B, 0xF1, 0x01, 0x60, 0x00, 0x64, 0xA0, 0x80, 0x9C, 0x84,
+	 0x05, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0xEA, 0x60, 0x1F, 0x78, 0xFF, 0xFF, 0x06, 0x60, 0x00, 0x65,
+	 0x20, 0x41, 0x8C, 0xF3, 0xA5, 0x80, 0x01, 0xB0, 0x01, 0x02, 0x06, 0x00, 0x10, 0x60, 0x36, 0x62,
+	 0x00, 0x64, 0xA2, 0xDB, 0x2F, 0x58, 0xFF, 0xFF, 0x1C, 0x60, 0x6E, 0x65, 0xA5, 0xD3, 0x01, 0x63,
+	 0x8A, 0xFD, 0x26, 0x1B, 0x00, 0x60, 0x64, 0x64, 0xA5, 0xDB, 0x64, 0xF5, 0xB9, 0xF1, 0x19, 0xF8,
+	 0x7F, 0xF1, 0x2C, 0xF8, 0x32, 0xF8, 0x80, 0xF1, 0x2D, 0xF8, 0x33, 0xF8, 0x81, 0xF1, 0x2E, 0xF8,
+	 0x34, 0xF8, 0xEA, 0xF1, 0x2F, 0xF8, 0xEB, 0xF1, 0x30, 0xF8, 0xEC, 0xF1, 0x31, 0xF8, 0x11, 0x60,
+	 0x48, 0x64, 0x2A, 0xFA, 0x00, 0x64, 0x2B, 0xFA, 0x23, 0xFA, 0x25, 0x60, 0xCE, 0x64, 0x13, 0x60,
+	 0x0D, 0xFB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0x06, 0x00,
+	 0x95, 0xF3, 0x32, 0x40, 0x02, 0x26, 0x02, 0x00, 0x40, 0x2A, 0xDA, 0xFE, 0xC1, 0xFE, 0x10, 0x60,
+	 0x36, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x01, 0x60, 0x82, 0x64, 0x08, 0x60, 0x1C, 0xFB, 0xEB, 0x60,
+	 0x45, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x08, 0x60, 0x1B, 0xF1, 0x01, 0x60,
+	 0x00, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x05, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0xEA, 0x60, 0x1F, 0x78,
+	 0xFF, 0xFF, 0x00, 0x60, 0x02, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x06, 0x03, 0xA0, 0x84, 0xA2, 0xDB,
+	 0xBA, 0xFE, 0xED, 0x60, 0x6D, 0x78, 0xFF, 0xFF, 0x02, 0x64, 0x8A, 0xFB, 0x01, 0x60, 0x00, 0x65,
+	 0x20, 0x44, 0x34, 0x80, 0xBA, 0xFE, 0xC1, 0xFE, 0x10, 0x60, 0x36, 0x62, 0x00, 0x64, 0xA2, 0xDB,
+	 0x10, 0x60, 0x5A, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x01, 0x60, 0x46, 0x64, 0x08, 0x60, 0x1C, 0xFB,
+	 0xEB, 0x60, 0x76, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x08, 0x60, 0x1B, 0xF1,
+	 0x01, 0x60, 0x00, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x05, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0xEA, 0x60,
+	 0x1F, 0x78, 0xFF, 0xFF, 0x00, 0x60, 0x04, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x45, 0x03, 0xA0, 0x84,
+	 0xA2, 0xDB, 0x08, 0x60, 0x2D, 0xF1, 0x00, 0x60, 0x08, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x0F, 0x03,
+	 0xA0, 0x84, 0xA2, 0xDB, 0x08, 0x60, 0x1B, 0xF1, 0x00, 0x60, 0x02, 0x64, 0xA0, 0x80, 0x9C, 0x84,
+	 0x05, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0xED, 0x60, 0x6D, 0x78, 0xFF, 0xFF, 0x31, 0x01, 0x00, 0x60,
+	 0x02, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x0B, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x16, 0x60, 0xAC, 0xF1,
+	 0x95, 0xF3, 0x00, 0x61, 0xD1, 0x80, 0xF7, 0xB4, 0xF1, 0x03, 0x95, 0xFB, 0x33, 0x00, 0x00, 0x60,
+	 0x10, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x0E, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x16, 0x60, 0xAC, 0xF1,
+	 0x95, 0xF3, 0x00, 0x61, 0xD1, 0x80, 0x08, 0xBC, 0x03, 0x02, 0xEC, 0x60, 0x9C, 0x78, 0xFF, 0xFF,
+	 0x95, 0xFB, 0x20, 0x00, 0x00, 0x60, 0x04, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x05, 0x03, 0xA0, 0x84,
+	 0xA2, 0xDB, 0xEC, 0x60, 0x9C, 0x78, 0xFF, 0xFF, 0x08, 0x60, 0x1B, 0xF1, 0x00, 0x60, 0x40, 0x64,
+	 0xA0, 0x80, 0x9C, 0x84, 0x03, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0xC8, 0x01, 0x00, 0x60, 0x02, 0x64,
+	 0xA0, 0x80, 0x9C, 0x84, 0x05, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0xED, 0x60, 0x6D, 0x78, 0xFF, 0xFF,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x02, 0x63, 0x95, 0xF3, 0x8A, 0xFD, 0x01, 0xBC, 0xC1, 0xFE, 0x95, 0xFB,
+	 0xCE, 0xF1, 0x0E, 0x60, 0x51, 0xF9, 0x10, 0x60, 0x36, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x10, 0x60,
+	 0x5A, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x01, 0x60, 0x34, 0x64, 0x08, 0x60, 0x1C, 0xFB, 0xEC, 0x60,
+	 0x05, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x1C, 0x60, 0x9E, 0x64, 0x13, 0x60, 0x22, 0xFB, 0x02, 0x64,
+	 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x2F, 0x58, 0xFF, 0xFF, 0x08, 0x60, 0x1B, 0xF1, 0x01, 0x60,
+	 0x00, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x0D, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x1C, 0x60, 0x9E, 0x64,
+	 0x13, 0x60, 0x22, 0xFB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0xEA, 0x60, 0x1F, 0x78,
+	 0xFF, 0xFF, 0x00, 0x60, 0x10, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x22, 0x03, 0xA0, 0x84, 0xA2, 0xDB,
+	 0x95, 0xF3, 0xFF, 0xFF, 0x60, 0x40, 0x04, 0x2A, 0x01, 0x00, 0xD5, 0x01, 0x1C, 0x60, 0x9E, 0x64,
+	 0x13, 0x60, 0x22, 0xFB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x95, 0xF3, 0xFF, 0xFF,
+	 0x60, 0x40, 0x08, 0x2A, 0x01, 0x00, 0x68, 0x00, 0x08, 0x60, 0x1B, 0xF1, 0x00, 0x60, 0x02, 0x64,
+	 0xA0, 0x80, 0x9C, 0x84, 0x59, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0xED, 0x60, 0x6D, 0x78, 0xFF, 0xFF,
+	 0x08, 0x60, 0x2D, 0xF1, 0x00, 0x60, 0x10, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x08, 0x03, 0xA0, 0x84,
+	 0xA2, 0xDB, 0x95, 0xF3, 0xFF, 0xFF, 0x08, 0xBC, 0x95, 0xFB, 0x2F, 0x58, 0xFF, 0xFF, 0x00, 0x60,
+	 0x02, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x03, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0xA4, 0x01, 0x00, 0x60,
+	 0x04, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x0B, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x1C, 0x60, 0x9E, 0x64,
+	 0x13, 0x60, 0x22, 0xFB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x35, 0x00, 0x00, 0x60,
+	 0x08, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x0B, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x1C, 0x60, 0x9E, 0x64,
+	 0x13, 0x60, 0x22, 0xFB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x1E, 0x00, 0x08, 0x60,
+	 0x1B, 0xF1, 0x00, 0x60, 0x20, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x14, 0x03, 0xA0, 0x84, 0xA2, 0xDB,
+	 0x95, 0xF3, 0xFF, 0xFF, 0x60, 0x40, 0x08, 0x2A, 0x01, 0x00, 0x16, 0x00, 0x08, 0x60, 0x1B, 0xF1,
+	 0x00, 0x60, 0x02, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x08, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0xED, 0x60,
+	 0x6D, 0x78, 0xFF, 0xFF, 0x2F, 0x58, 0xFF, 0xFF, 0x00, 0x00, 0x95, 0xF3, 0xFF, 0xFF, 0xFE, 0xB4,
+	 0x95, 0xFB, 0xEA, 0x60, 0xD0, 0x78, 0xFF, 0xFF, 0x16, 0x60, 0xAB, 0xF3, 0xFF, 0xFF, 0x01, 0xA8,
+	 0xFF, 0xFF, 0x03, 0x02, 0xED, 0x60, 0x76, 0x78, 0xFF, 0xFF, 0x95, 0xF3, 0x01, 0x63, 0x8A, 0xFD,
+	 0x21, 0xBC, 0x95, 0xFB, 0x63, 0xF5, 0x7F, 0xF1, 0x2C, 0xF8, 0x80, 0xF1, 0x2D, 0xF8, 0x81, 0xF1,
+	 0x2E, 0xF8, 0x83, 0xF1, 0xC0, 0x67, 0xB0, 0x84, 0x2B, 0xFA, 0xB9, 0xF1, 0x19, 0xF8, 0xEA, 0xF1,
+	 0x2F, 0xF8, 0xEB, 0xF1, 0x30, 0xF8, 0xEC, 0xF1, 0x31, 0xF8, 0x10, 0x60, 0xA4, 0x64, 0x2A, 0xFA,
+	 0x25, 0x60, 0xCE, 0x64, 0x13, 0x60, 0x0D, 0xFB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB,
+	 0xFF, 0xFF, 0x2B, 0xFF, 0xC1, 0xFE, 0x00, 0x60, 0x50, 0x64, 0x0E, 0x60, 0x51, 0xFB, 0x1C, 0x60,
+	 0x9E, 0x64, 0x13, 0x60, 0x22, 0xFB, 0x02, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x10, 0x60,
+	 0x36, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x10, 0x60, 0x5A, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x01, 0x60,
+	 0x2C, 0x64, 0x08, 0x60, 0x1C, 0xFB, 0xEC, 0x60, 0xE9, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58,
+	 0xFF, 0xFF, 0x08, 0x60, 0x1B, 0xF1, 0x01, 0x60, 0x00, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x0D, 0x03,
+	 0xA0, 0x84, 0xA2, 0xDB, 0x1C, 0x60, 0x9E, 0x64, 0x13, 0x60, 0x22, 0xFB, 0x03, 0x64, 0x4A, 0xDB,
+	 0xFF, 0xFF, 0x04, 0xFF, 0xEA, 0x60, 0x1F, 0x78, 0xFF, 0xFF, 0x08, 0x60, 0x2D, 0xF1, 0x00, 0x60,
+	 0x04, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x03, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x95, 0x01, 0x08, 0x60,
+	 0x1B, 0xF1, 0x00, 0x60, 0x08, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x08, 0x03, 0xA0, 0x84, 0xA2, 0xDB,
+	 0x95, 0xF3, 0xFF, 0xFF, 0x02, 0xB0, 0xFF, 0xFF, 0x49, 0x03, 0x86, 0x01, 0x00, 0x60, 0x08, 0x64,
+	 0xA0, 0x80, 0x9C, 0x84, 0x03, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x40, 0x00, 0x00, 0x60, 0x02, 0x64,
+	 0xA0, 0x80, 0x9C, 0x84, 0x14, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x1C, 0x60, 0x9E, 0x64, 0x13, 0x60,
+	 0x22, 0xFB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x16, 0x60, 0xAC, 0xF3, 0x95, 0xF3,
+	 0x00, 0xA8, 0xF7, 0xB4, 0x2B, 0x03, 0x95, 0xFB, 0xEB, 0x60, 0xE2, 0x78, 0xFF, 0xFF, 0x00, 0x60,
+	 0x10, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x15, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x1C, 0x60, 0x9E, 0x64,
+	 0x13, 0x60, 0x22, 0xFB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x16, 0x60, 0xAC, 0xF3,
+	 0x95, 0xF3, 0x00, 0xA8, 0x08, 0xBC, 0x01, 0x02, 0x4F, 0x01, 0x95, 0xFB, 0xEB, 0x60, 0xE2, 0x78,
+	 0xFF, 0xFF, 0x08, 0x60, 0x1B, 0xF1, 0x00, 0x60, 0x20, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x03, 0x03,
+	 0xA0, 0x84, 0xA2, 0xDB, 0x02, 0x00, 0x2F, 0x58, 0xFF, 0xFF, 0x00, 0x00, 0x1C, 0x60, 0x9E, 0x64,
+	 0x13, 0x60, 0x22, 0xFB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x95, 0xF3, 0xFF, 0xFF,
+	 0xFE, 0xB4, 0x95, 0xFB, 0xEA, 0x60, 0xD0, 0x78, 0xFF, 0xFF, 0x95, 0xF3, 0x01, 0x63, 0x8A, 0xFD,
+	 0x01, 0xBC, 0x95, 0xFB, 0x00, 0x64, 0x82, 0xFB, 0xC1, 0xFE, 0x28, 0x00, 0x95, 0xF3, 0x01, 0x63,
+	 0x8A, 0xFD, 0x01, 0xBC, 0x95, 0xFB, 0x00, 0x64, 0x82, 0xFB, 0x63, 0xF5, 0x7F, 0xF1, 0x2C, 0xF8,
+	 0x80, 0xF1, 0x2D, 0xF8, 0x81, 0xF1, 0x2E, 0xF8, 0x83, 0xF1, 0xC0, 0x67, 0xB0, 0x84, 0x2B, 0xFA,
+	 0xB9, 0xF1, 0x19, 0xF8, 0xEA, 0xF1, 0x2F, 0xF8, 0xEB, 0xF1, 0x30, 0xF8, 0xEC, 0xF1, 0x31, 0xF8,
+	 0x00, 0x60, 0xA4, 0x64, 0x2A, 0xFA, 0x25, 0x60, 0xCE, 0x64, 0x13, 0x60, 0x0D, 0xFB, 0x66, 0x44,
+	 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xC1, 0xFE, 0x1C, 0x60, 0xAA, 0x64,
+	 0x13, 0x60, 0x22, 0xFB, 0x02, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x10, 0x60, 0x36, 0x62,
+	 0x00, 0x64, 0xA2, 0xDB, 0x10, 0x60, 0x5A, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x03, 0x60, 0x0E, 0x64,
+	 0x08, 0x60, 0x1C, 0xFB, 0xED, 0x60, 0xB8, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x08, 0x60, 0x1B, 0xF1, 0x01, 0x60, 0x00, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x0D, 0x03, 0xA0, 0x84,
+	 0xA2, 0xDB, 0x1C, 0x60, 0xAA, 0x64, 0x13, 0x60, 0x22, 0xFB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF,
+	 0x04, 0xFF, 0xEA, 0x60, 0x1F, 0x78, 0xFF, 0xFF, 0x00, 0x60, 0x0A, 0x64, 0xA0, 0x80, 0x9C, 0x84,
+	 0x03, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0xCA, 0x01, 0x00, 0x60, 0x04, 0x64, 0xA0, 0x80, 0x9C, 0x84,
+	 0x14, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x08, 0x60, 0x2D, 0xF1, 0x00, 0x60, 0x04, 0x64, 0xA0, 0x80,
+	 0x9C, 0x84, 0x03, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x91, 0x01, 0x00, 0x60, 0x12, 0x64, 0xA0, 0x80,
+	 0x9C, 0x84, 0x03, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0xB1, 0x01, 0x08, 0x60, 0x1B, 0xF1, 0x02, 0x60,
+	 0x00, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0xB2, 0x03, 0xA0, 0x84, 0xA2, 0xDB, 0x10, 0x67, 0x82, 0xFB,
+	 0x10, 0x60, 0x36, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x10, 0x60, 0x5A, 0x62, 0x00, 0x64, 0xA2, 0xDB,
+	 0x64, 0xF5, 0xB9, 0xF1, 0x19, 0xF8, 0x7F, 0xF1, 0x2C, 0xF8, 0x32, 0xF8, 0x80, 0xF1, 0x2D, 0xF8,
+	 0x33, 0xF8, 0x81, 0xF1, 0x2E, 0xF8, 0x34, 0xF8, 0xEA, 0xF1, 0x2F, 0xF8, 0xEB, 0xF1, 0x30, 0xF8,
+	 0xEC, 0xF1, 0x31, 0xF8, 0x11, 0x60, 0x48, 0x64, 0x2A, 0xFA, 0x00, 0x64, 0x2B, 0xFA, 0x23, 0xFA,
+	 0x25, 0x60, 0xCE, 0x64, 0x13, 0x60, 0x0D, 0xFB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB,
+	 0xFF, 0xFF, 0x2B, 0xFF, 0x95, 0xF3, 0xC1, 0xFE, 0xFE, 0xB4, 0x95, 0xFB, 0x00, 0x60, 0x03, 0x64,
+	 0x08, 0x60, 0x1C, 0xFB, 0xEE, 0x60, 0x30, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x08, 0x60, 0x1B, 0xF1, 0x00, 0x60, 0x02, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x03, 0x03, 0xA0, 0x84,
+	 0xA2, 0xDB, 0x33, 0x01, 0x64, 0xF5, 0x23, 0xF2, 0x96, 0xF3, 0x04, 0x18, 0xCC, 0x84, 0x96, 0xFB,
+	 0x01, 0x03, 0x2B, 0x01, 0xEA, 0x60, 0xD0, 0x78, 0xFF, 0xFF, 0x16, 0x60, 0xAB, 0xF3, 0x82, 0xF1,
+	 0x02, 0xA8, 0x2A, 0xF2, 0x03, 0x02, 0xB0, 0x84, 0x2A, 0xFA, 0x07, 0x00, 0x08, 0x60, 0x1B, 0xF1,
+	 0x00, 0x60, 0x02, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x25, 0x60, 0xC8, 0x64, 0x13, 0x60,
+	 0x0D, 0xFB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xC1, 0xFE,
+	 0x12, 0x60, 0xED, 0xF3, 0xFF, 0xFF, 0x00, 0xA8, 0x60, 0x46, 0xDF, 0x02, 0xCA, 0x60, 0xD4, 0x78,
+	 0xFF, 0xFF, 0x10, 0x60, 0x48, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x00, 0x60, 0x06, 0x64, 0x08, 0x60,
+	 0x25, 0xFB, 0xEE, 0x60, 0x77, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x00, 0x60,
+	 0x18, 0x64, 0x08, 0x60, 0x25, 0xFB, 0xEE, 0x60, 0x77, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58,
+	 0xFF, 0xFF, 0x26, 0x46, 0x00, 0xF4, 0xDB, 0xF3, 0xFF, 0xFF, 0x07, 0xB4, 0x03, 0x36, 0x1B, 0x00,
+	 0x0E, 0xF0, 0x19, 0x60, 0x7B, 0xF3, 0xFF, 0xFF, 0xEF, 0xB4, 0x60, 0x44, 0x64, 0x40, 0x04, 0x27,
+	 0x07, 0x00, 0xA2, 0xDB, 0x13, 0x64, 0xCB, 0xFB, 0x01, 0x60, 0x67, 0x64, 0x37, 0xFB, 0x0B, 0x00,
+	 0x10, 0xBC, 0xA2, 0xDB, 0x08, 0x64, 0xCB, 0xFB, 0xA1, 0xF3, 0x01, 0x60, 0x67, 0x7C, 0x60, 0x40,
+	 0x01, 0x27, 0x5B, 0x7C, 0x37, 0xF9, 0x26, 0x46, 0x3F, 0xF2, 0x00, 0xF4, 0x60, 0x43, 0xF4, 0xA3,
+	 0x00, 0x60, 0x1D, 0x61, 0x00, 0x60, 0x2A, 0x65, 0x01, 0x60, 0xFF, 0x64, 0x40, 0x4C, 0xFD, 0x60,
+	 0x58, 0x4E, 0x7A, 0x78, 0xFF, 0xFF, 0x00, 0xBB, 0xFF, 0xFF, 0x01, 0x02, 0x3B, 0x00, 0x02, 0x60,
+	 0x01, 0x63, 0xA3, 0xD1, 0xDB, 0xF3, 0xFF, 0xFF, 0x07, 0xB4, 0x03, 0x36, 0x1F, 0x00, 0x19, 0x60,
+	 0x45, 0xF3, 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x26, 0x09, 0x00, 0x19, 0x60, 0x7B, 0xF3, 0xFF, 0xFF,
+	 0xFD, 0xB4, 0x60, 0x44, 0x64, 0x40, 0x02, 0x27, 0x02, 0xBC, 0xA2, 0xDB, 0x19, 0x60, 0x45, 0xF3,
+	 0xFF, 0xFF, 0x60, 0x40, 0x02, 0x26, 0x1C, 0x00, 0x19, 0x60, 0x7B, 0xF3, 0xFF, 0xFF, 0xFB, 0xB4,
+	 0x60, 0x44, 0x64, 0x40, 0x04, 0x27, 0x04, 0xBC, 0xA2, 0xDB, 0x12, 0x00, 0x64, 0x40, 0x02, 0x2B,
+	 0x06, 0x00, 0x19, 0x60, 0x7B, 0xF3, 0xFF, 0xFF, 0x02, 0xBC, 0x60, 0x44, 0xA2, 0xDB, 0x64, 0x40,
+	 0x04, 0x2B, 0x06, 0x00, 0x19, 0x60, 0x7B, 0xF3, 0xFF, 0xFF, 0x04, 0xBC, 0x60, 0x44, 0xA2, 0xDB,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x0E, 0xF0, 0xDB, 0xF3, 0xFF, 0xFF, 0x07, 0xB4, 0x03, 0x36, 0x18, 0x00,
+	 0x19, 0x60, 0x7B, 0xF3, 0xFF, 0xFF, 0x02, 0xBC, 0x60, 0x44, 0xFB, 0xB4, 0x60, 0x44, 0x64, 0x40,
+	 0x20, 0x2A, 0x0A, 0x00, 0x60, 0x43, 0x19, 0x60, 0x45, 0xF3, 0xFF, 0xFF, 0x60, 0x40, 0x02, 0x26,
+	 0x02, 0x00, 0x63, 0x44, 0x02, 0x00, 0x63, 0x44, 0x04, 0xBC, 0x19, 0x60, 0x7B, 0xFB, 0x09, 0x00,
+	 0x64, 0x40, 0x20, 0x26, 0x06, 0x00, 0x19, 0x60, 0x7B, 0xF3, 0xFF, 0xFF, 0x04, 0xBC, 0x60, 0x44,
+	 0xA2, 0xDB, 0x2F, 0x58, 0xFF, 0xFF, 0x00, 0x60, 0xB0, 0x61, 0xB6, 0x60, 0x58, 0x4D, 0x25, 0x78,
+	 0xFF, 0xFF, 0x66, 0x44, 0x5C, 0xFB, 0x04, 0x64, 0x03, 0xFA, 0x80, 0x64, 0x2A, 0xFA, 0xC9, 0xF1,
+	 0x19, 0xF8, 0x00, 0x64, 0x3E, 0xFA, 0x00, 0x60, 0x80, 0x64, 0x0E, 0xFA, 0xA6, 0xF1, 0x07, 0xF8,
+	 0x67, 0x44, 0x2C, 0xFA, 0x2D, 0xFA, 0x2E, 0xFA, 0xF1, 0x60, 0x2C, 0x64, 0x08, 0x60, 0x31, 0xFB,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x5C, 0xF5, 0xEA, 0xF1, 0x2F, 0xF8, 0xEB, 0xF1, 0x30, 0xF8, 0xEC, 0xF1,
+	 0x31, 0xF8, 0x7F, 0xF1, 0x32, 0xF8, 0x80, 0xF1, 0x33, 0xF8, 0x81, 0xF1, 0x34, 0xF8, 0x16, 0x60,
+	 0xC2, 0xF1, 0x02, 0x64, 0x64, 0x40, 0xFE, 0x26, 0x10, 0xBC, 0x32, 0x40, 0x08, 0x26, 0x10, 0xBC,
+	 0x20, 0xBC, 0xFB, 0x60, 0xFF, 0x65, 0x60, 0x44, 0xA4, 0x84, 0x1B, 0x60, 0x09, 0xFB, 0x16, 0x60,
+	 0xC1, 0xF1, 0x33, 0x60, 0xBE, 0x64, 0x02, 0x18, 0x2D, 0x60, 0x32, 0x64, 0x1A, 0x60, 0xAD, 0xFB,
+	 0x1A, 0x60, 0xBD, 0xFB, 0x34, 0x60, 0x18, 0x61, 0x17, 0x60, 0x14, 0xF3, 0x35, 0x60, 0x36, 0x65,
+	 0xFE, 0xA4, 0xE0, 0x84, 0x06, 0x05, 0x67, 0x44, 0x1A, 0x60, 0xB5, 0xFB, 0x1A, 0x60, 0xC5, 0xFB,
+	 0x4B, 0x00, 0xE0, 0x84, 0xC4, 0x85, 0x1A, 0x60, 0x1F, 0xF3, 0xA5, 0xD1, 0xDA, 0x85, 0xA0, 0x83,
+	 0x1A, 0x60, 0x1B, 0xFD, 0xA5, 0xD1, 0x34, 0x60, 0x34, 0x62, 0xA0, 0x83, 0xA2, 0xDD, 0x67, 0x44,
+	 0x1A, 0x60, 0xB5, 0xFB, 0x1A, 0x60, 0xC5, 0xFB, 0x1A, 0x60, 0x2C, 0xF3, 0xFF, 0xFF, 0x21, 0x18,
+	 0x33, 0x60, 0xF4, 0x61, 0x0F, 0x60, 0x00, 0x7C, 0x00, 0x60, 0xAC, 0x65, 0xEF, 0x60, 0x58, 0x4D,
+	 0xC1, 0x78, 0xFF, 0xFF, 0x1A, 0x60, 0x2D, 0xF1, 0x59, 0xD9, 0x33, 0x60, 0xF2, 0x65, 0xD5, 0x84,
+	 0x30, 0x7F, 0xA5, 0xDB, 0x65, 0x44, 0x1A, 0x60, 0xB5, 0xFB, 0x1A, 0x60, 0xC5, 0xFB, 0x1A, 0x60,
+	 0x2C, 0xF3, 0xFF, 0xFF, 0xFE, 0xA4, 0xFF, 0xFF, 0x08, 0x24, 0x03, 0x00, 0xFF, 0x60, 0xFF, 0x64,
+	 0x13, 0x00, 0x34, 0x60, 0x18, 0x61, 0x50, 0x60, 0x00, 0x7C, 0x00, 0x60, 0xF2, 0x65, 0xEF, 0x60,
+	 0x58, 0x4D, 0xC1, 0x78, 0xFF, 0xFF, 0x1A, 0x60, 0x1D, 0xF1, 0x59, 0xD9, 0x34, 0x60, 0x12, 0x65,
+	 0xD5, 0x84, 0xDD, 0x7F, 0xA5, 0xDB, 0x65, 0x44, 0x1A, 0x60, 0xB2, 0xFB, 0x1A, 0x60, 0xC2, 0xFB,
+	 0x79, 0x00, 0x1A, 0x60, 0x1E, 0xF3, 0x34, 0x60, 0x34, 0x62, 0xFD, 0xA0, 0xA2, 0xD3, 0xEE, 0x03,
+	 0x60, 0x40, 0x02, 0x2A, 0x02, 0x00, 0x01, 0x63, 0x0B, 0x00, 0x04, 0x2A, 0x02, 0x00, 0x02, 0x63,
+	 0x07, 0x00, 0x10, 0x2A, 0x02, 0x00, 0x04, 0x63, 0x03, 0x00, 0x20, 0x2A, 0x01, 0x00, 0x05, 0x63,
+	 0x63, 0x47, 0xB4, 0x83, 0x59, 0xD9, 0x59, 0xDD, 0x1A, 0x60, 0x1E, 0xF3, 0x1A, 0x60, 0x1B, 0xF3,
+	 0xFE, 0xA0, 0x40, 0x4C, 0xD3, 0x03, 0x00, 0x60, 0x00, 0x63, 0x59, 0xDD, 0x41, 0x4A, 0x2C, 0x40,
+	 0x01, 0x2A, 0x05, 0x00, 0x00, 0x63, 0x63, 0x47, 0xB4, 0x83, 0x59, 0xD9, 0x59, 0xDD, 0x2C, 0x40,
+	 0x02, 0x2A, 0x03, 0x00, 0x01, 0x63, 0x59, 0xD9, 0x59, 0xDD, 0x2C, 0x40, 0x04, 0x2A, 0x05, 0x00,
+	 0x02, 0x63, 0x63, 0x47, 0xB4, 0x83, 0x59, 0xD9, 0x59, 0xDD, 0x2C, 0x40, 0x10, 0x2A, 0x05, 0x00,
+	 0x04, 0x63, 0x63, 0x47, 0xB4, 0x83, 0x59, 0xD9, 0x59, 0xDD, 0x2C, 0x40, 0x20, 0x2A, 0x05, 0x00,
+	 0x05, 0x63, 0x63, 0x47, 0xB4, 0x83, 0x59, 0xD9, 0x59, 0xDD, 0x2A, 0x44, 0x51, 0x93, 0xEB, 0x83,
+	 0xEB, 0x83, 0xA0, 0xDD, 0x1A, 0x60, 0x1E, 0xF3, 0x1A, 0x60, 0x1C, 0xF3, 0xFF, 0xA0, 0x40, 0x4C,
+	 0x9D, 0x03, 0x59, 0xDF, 0x41, 0x4A, 0x2C, 0x40, 0x01, 0x2A, 0x05, 0x00, 0x00, 0x63, 0x63, 0x47,
+	 0xB4, 0x83, 0x59, 0xD9, 0x59, 0xDD, 0x2C, 0x40, 0x02, 0x2A, 0x05, 0x00, 0x01, 0x63, 0x63, 0x47,
+	 0xB4, 0x83, 0x59, 0xD9, 0x59, 0xDD, 0x2C, 0x40, 0x04, 0x2A, 0x05, 0x00, 0x02, 0x63, 0x63, 0x47,
+	 0xB4, 0x83, 0x59, 0xD9, 0x59, 0xDD, 0x2A, 0x44, 0x51, 0x93, 0xEB, 0x83, 0xEB, 0x83, 0xA0, 0xDD,
+	 0x2D, 0x58, 0xFF, 0xFF, 0x00, 0x60, 0x04, 0x64, 0x08, 0x60, 0x0A, 0xFB, 0xF0, 0x60, 0x44, 0x64,
+	 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x10, 0x60, 0x12, 0x62, 0x00, 0x64, 0xA2, 0xDB,
+	 0x7D, 0xF1, 0x35, 0x60, 0xCC, 0x64, 0x64, 0x40, 0x01, 0x2B, 0x01, 0x00, 0x67, 0x44, 0x1A, 0x60,
+	 0xAF, 0xFB, 0x1A, 0x60, 0xBF, 0xFB, 0x1A, 0x60, 0xE7, 0xF9, 0x35, 0x60, 0x62, 0x65, 0xF1, 0x60,
+	 0x58, 0x4D, 0x74, 0x78, 0xFF, 0xFF, 0x7D, 0xF3, 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x2B, 0x05, 0x00,
+	 0xFF, 0x60, 0xFF, 0x63, 0x1A, 0x60, 0xB3, 0xFD, 0x08, 0x00, 0x36, 0x60, 0x04, 0x63, 0x1A, 0x60,
+	 0xB3, 0xFD, 0xF1, 0x60, 0x58, 0x4D, 0x8C, 0x78, 0xFF, 0xFF, 0x5C, 0xF5, 0x00, 0xF4, 0x7E, 0xF1,
+	 0x06, 0xF8, 0x1B, 0x60, 0x09, 0xF3, 0x19, 0x60, 0x7B, 0xF1, 0xFB, 0x60, 0xFF, 0x65, 0x60, 0x44,
+	 0xA4, 0x84, 0x60, 0x47, 0x64, 0x40, 0x10, 0x26, 0x04, 0xBC, 0x60, 0x47, 0x07, 0xFA, 0x35, 0x60,
+	 0x5A, 0x64, 0x40, 0x48, 0x10, 0x61, 0x00, 0x60, 0x00, 0x64, 0xF1, 0x60, 0x58, 0x4D, 0x34, 0x78,
+	 0xFF, 0xFF, 0x5C, 0xF5, 0x3F, 0xFC, 0xDB, 0xFE, 0x25, 0x60, 0xCE, 0x64, 0x13, 0x60, 0x0D, 0xFB,
+	 0x66, 0x44, 0x5A, 0xDB, 0x04, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xC1, 0xFE, 0x2F, 0x58,
+	 0xFF, 0xFF, 0xDB, 0xF3, 0x9B, 0xFE, 0xFD, 0xA0, 0x25, 0x04, 0x24, 0x02, 0x04, 0x64, 0x03, 0xFA,
+	 0x00, 0xF4, 0x09, 0xF2, 0xFF, 0xFF, 0x60, 0x47, 0x00, 0x3A, 0x1C, 0x00, 0x60, 0x43, 0x00, 0x36,
+	 0x1C, 0x00, 0xE0, 0xA0, 0xDA, 0x85, 0x16, 0x07, 0x33, 0x60, 0xBE, 0x61, 0xA1, 0xD1, 0xFF, 0xFF,
+	 0xD3, 0x80, 0xCB, 0x83, 0x0F, 0x02, 0x07, 0x0E, 0x59, 0xD3, 0xA5, 0xD0, 0xDA, 0x85, 0xD0, 0x80,
+	 0xFF, 0xFF, 0x08, 0x02, 0xF9, 0x1F, 0x12, 0x1E, 0xA5, 0xD0, 0x59, 0xD3, 0xFF, 0xFF, 0x90, 0x80,
+	 0xFF, 0x22, 0x0C, 0x00, 0xF1, 0x60, 0x2A, 0x78, 0xFF, 0xFF, 0x16, 0x60, 0xC1, 0xF3, 0xFF, 0xFF,
+	 0x60, 0x40, 0x01, 0x2A, 0x03, 0x00, 0x2D, 0x60, 0x32, 0x64, 0x02, 0x00, 0x33, 0x60, 0xBE, 0x64,
+	 0x1A, 0x60, 0xBD, 0xFB, 0x26, 0x46, 0x2F, 0xF2, 0x2C, 0xFA, 0x30, 0xF2, 0x2D, 0xFA, 0x31, 0xF2,
+	 0x2E, 0xFA, 0xEA, 0xF1, 0x2F, 0xF8, 0xEB, 0xF1, 0x30, 0xF8, 0xEC, 0xF1, 0x31, 0xF8, 0x7F, 0xF1,
+	 0x32, 0xF8, 0x80, 0xF1, 0x33, 0xF8, 0x81, 0xF1, 0x34, 0xF8, 0x00, 0x65, 0xFD, 0x60, 0x58, 0x4E,
+	 0xDD, 0x78, 0xFF, 0xFF, 0x61, 0x44, 0x19, 0x60, 0x3F, 0xFB, 0x50, 0x63, 0x2A, 0xFC, 0xC9, 0xF3,
+	 0x19, 0xFA, 0x00, 0x64, 0x3E, 0xFA, 0xA6, 0xF3, 0x07, 0xFA, 0x00, 0xF4, 0x7E, 0xF1, 0x06, 0xF8,
+	 0x1B, 0x60, 0x09, 0xF3, 0x19, 0x60, 0x7B, 0xF1, 0xFB, 0x60, 0xFF, 0xB7, 0x64, 0x40, 0x10, 0x26,
+	 0x04, 0xBC, 0x60, 0x47, 0x07, 0xFA, 0x35, 0x60, 0x82, 0x65, 0xF1, 0x60, 0x58, 0x4D, 0x74, 0x78,
+	 0xFF, 0xFF, 0x7D, 0xF3, 0x36, 0x60, 0x04, 0x63, 0x60, 0x40, 0x01, 0x27, 0x67, 0x43, 0x1A, 0x60,
+	 0xC3, 0xFD, 0x35, 0x60, 0x7A, 0x64, 0x40, 0x48, 0x10, 0x61, 0x00, 0x60, 0x00, 0x64, 0xF1, 0x60,
+	 0x58, 0x4D, 0x34, 0x78, 0xFF, 0xFF, 0x26, 0x46, 0x3F, 0xFC, 0x25, 0x60, 0xCE, 0x64, 0x13, 0x60,
+	 0x0D, 0xFB, 0x26, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xC1, 0xFE,
+	 0x00, 0x66, 0x46, 0x46, 0x2F, 0x58, 0xFF, 0xFF, 0x00, 0x64, 0x08, 0x60, 0x09, 0xFB, 0x5A, 0xDB,
+	 0x00, 0x64, 0x92, 0xFB, 0x2F, 0x58, 0xFF, 0xFF, 0x1B, 0x60, 0x0A, 0xFB, 0xCD, 0x81, 0x28, 0xD3,
+	 0x5A, 0x88, 0xDC, 0x83, 0x31, 0x18, 0xFB, 0x03, 0x61, 0x40, 0x7F, 0x3A, 0x06, 0x00, 0x1B, 0x60,
+	 0x0A, 0xF3, 0x03, 0x61, 0x7C, 0xA4, 0xA2, 0xDB, 0x00, 0xF4, 0x60, 0xFE, 0xA3, 0xD1, 0x5D, 0xD8,
+	 0x61, 0x40, 0x7F, 0x3A, 0x08, 0x00, 0x20, 0xFE, 0x1B, 0x60, 0x0A, 0xF3, 0x03, 0x61, 0x7C, 0xA4,
+	 0xA2, 0xDB, 0x00, 0xF4, 0x60, 0xFE, 0xBF, 0xD3, 0x5D, 0xDA, 0xFF, 0xB4, 0x00, 0x7F, 0x12, 0x03,
+	 0xDF, 0x83, 0x61, 0x40, 0x7F, 0x3A, 0x0A, 0x00, 0x20, 0xFE, 0x60, 0x45, 0x1B, 0x60, 0x0A, 0xF3,
+	 0x03, 0x61, 0x7C, 0xA4, 0xA2, 0xDB, 0x65, 0x44, 0x00, 0xF4, 0x60, 0xFE, 0xBD, 0xD1, 0xCC, 0x84,
+	 0x5D, 0xD8, 0xEF, 0x02, 0x20, 0xFE, 0xCB, 0x01, 0x1B, 0x60, 0x0A, 0xF1, 0xFD, 0xA1, 0xFF, 0xB1,
+	 0xC1, 0x83, 0xA2, 0xDD, 0x2D, 0x58, 0xFF, 0xFF, 0x67, 0x5C, 0x1C, 0x60, 0xE6, 0x61, 0xA1, 0xD3,
+	 0xA5, 0xD9, 0x10, 0x18, 0x60, 0x43, 0x35, 0x60, 0xD4, 0x64, 0xA5, 0xDB, 0x60, 0xFE, 0xA0, 0xDD,
+	 0x20, 0xFE, 0xDC, 0x84, 0xCF, 0x83, 0xE3, 0x83, 0x59, 0xD1, 0xDC, 0x84, 0x60, 0xFE, 0xA0, 0xD9,
+	 0x20, 0xFE, 0xFA, 0x1F, 0x2D, 0x58, 0xFF, 0xFF, 0x19, 0x60, 0x7B, 0xF3, 0x36, 0x60, 0x06, 0x62,
+	 0x07, 0xB4, 0x60, 0xFE, 0xA2, 0xDB, 0x20, 0xFE, 0x2D, 0x58, 0xFF, 0xFF, 0x0E, 0x57, 0x32, 0x40,
+	 0x40, 0x26, 0x27, 0x00, 0x45, 0x48, 0x00, 0x60, 0x10, 0x61, 0xB6, 0x60, 0x58, 0x4D, 0x22, 0x78,
+	 0xFF, 0xFF, 0x1F, 0x03, 0xF2, 0x60, 0x02, 0x64, 0x24, 0xFA, 0x00, 0x60, 0x48, 0x61, 0x28, 0x44,
+	 0x59, 0xDA, 0x03, 0x64, 0x38, 0x43, 0xBD, 0xD1, 0xCC, 0x84, 0x59, 0xD8, 0xFC, 0x02, 0x39, 0x44,
+	 0x59, 0xDA, 0x16, 0x60, 0xC3, 0xF3, 0x59, 0xDA, 0x07, 0x64, 0x23, 0xFA, 0x26, 0x60, 0x0A, 0x64,
+	 0x13, 0x60, 0x0D, 0xFB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF,
+	 0xFA, 0xFE, 0x37, 0x58, 0xFF, 0xFF, 0x0E, 0x57, 0x32, 0x40, 0x40, 0x26, 0x1B, 0x00, 0x45, 0x48,
+	 0x00, 0x60, 0x06, 0x61, 0xB6, 0x60, 0x58, 0x4D, 0x22, 0x78, 0xFF, 0xFF, 0x13, 0x03, 0x02, 0x64,
+	 0x23, 0xFA, 0xF2, 0x60, 0x00, 0x64, 0x5A, 0xDA, 0x28, 0x44, 0x5A, 0xDA, 0xFF, 0xFF, 0x26, 0x60,
+	 0x0A, 0x64, 0x13, 0x60, 0x0D, 0xFB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF,
+	 0x2B, 0xFF, 0xFA, 0xFE, 0x37, 0x58, 0xFF, 0xFF, 0xA0, 0xD3, 0xFF, 0xFF, 0xDC, 0x84, 0xDC, 0x80,
+	 0xD0, 0x80, 0x03, 0x03, 0xA2, 0xDB, 0x08, 0x24, 0xC6, 0xFE, 0xDD, 0x98, 0xFF, 0xFF, 0xB5, 0xF1,
+	 0xA0, 0xD3, 0xFF, 0xFF, 0xD8, 0x80, 0xC4, 0x84, 0x0C, 0x03, 0x08, 0x05, 0xDC, 0x80, 0xD0, 0x80,
+	 0x05, 0x03, 0xA2, 0xDB, 0x02, 0x24, 0xC6, 0xFE, 0xDD, 0x98, 0xFF, 0xFF, 0xFF, 0x60, 0xFE, 0x64,
+	 0xA2, 0xDB, 0xDD, 0x98, 0xFF, 0xFF, 0xA2, 0xFF, 0x32, 0x40, 0x40, 0x26, 0x3C, 0x00, 0x9B, 0xF3,
+	 0x67, 0x43, 0xDC, 0x84, 0xCC, 0x84, 0x37, 0x03, 0x60, 0x46, 0x0A, 0x02, 0x9B, 0xFD, 0x00, 0x60,
+	 0x46, 0x61, 0xB6, 0x60, 0x58, 0x4D, 0x22, 0x78, 0xFF, 0xFF, 0x66, 0x44, 0x9B, 0xFB, 0x2C, 0x03,
+	 0x46, 0x4B, 0x2C, 0x60, 0xCA, 0x61, 0x18, 0x64, 0x23, 0xFA, 0xF1, 0x60, 0x00, 0x64, 0x24, 0xFA,
+	 0x4A, 0x65, 0xA2, 0xFF, 0x2C, 0x63, 0x59, 0xD1, 0xA2, 0xDF, 0xA5, 0xD8, 0xDA, 0x85, 0x80, 0x3A,
+	 0x02, 0x00, 0x00, 0xF4, 0x04, 0x65, 0xF7, 0x1F, 0x12, 0x63, 0x59, 0xD1, 0xA5, 0xD8, 0xDA, 0x85,
+	 0x80, 0x3A, 0x02, 0x00, 0x00, 0xF4, 0x04, 0x65, 0xF8, 0x1F, 0x26, 0x60, 0x0A, 0x64, 0x13, 0x60,
+	 0x0D, 0xFB, 0x2B, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xFA, 0xFE,
+	 0xA6, 0xFE, 0x00, 0x64, 0x9B, 0xFB, 0xA3, 0xFF, 0xCA, 0x60, 0xD4, 0x78, 0xFF, 0xFF, 0xA6, 0xFE,
+	 0xBA, 0x05, 0xA7, 0xFE, 0x11, 0x05, 0xA5, 0xFE, 0x03, 0x04, 0xF2, 0x60, 0xD8, 0x78, 0xFF, 0xFF,
+	 0xA4, 0xFE, 0xF2, 0x04, 0x08, 0x60, 0x0F, 0xF1, 0x00, 0x60, 0x80, 0x64, 0xB0, 0x84, 0xA2, 0xDB,
+	 0xCF, 0xFE, 0xCA, 0x60, 0xD4, 0x78, 0xFF, 0xFF, 0x36, 0x45, 0x20, 0x60, 0xA8, 0x64, 0x44, 0xD7,
+	 0xFF, 0xFF, 0xFF, 0xFF, 0x9D, 0xF3, 0xFF, 0xFF, 0x01, 0xB0, 0x00, 0x64, 0x2F, 0x03, 0x9D, 0xFB,
+	 0x31, 0x44, 0xE8, 0xB4, 0x40, 0x51, 0x6A, 0x44, 0xFF, 0xFF, 0x80, 0x26, 0xFC, 0x01, 0x61, 0xFF,
+	 0x62, 0xFF, 0x08, 0x60, 0x30, 0xF1, 0x00, 0x60, 0x20, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE,
+	 0x40, 0x60, 0x58, 0x4E, 0x7D, 0x78, 0xFF, 0xFF, 0x1F, 0x60, 0xC4, 0x64, 0x0F, 0x60, 0xE1, 0xFB,
+	 0x4A, 0xDF, 0x01, 0x60, 0xFE, 0x63, 0x1D, 0x60, 0xBE, 0x61, 0x00, 0x64, 0x59, 0xDB, 0xFE, 0x1F,
+	 0x0E, 0x60, 0xDD, 0xF3, 0xFF, 0xFF, 0x04, 0xB0, 0xFF, 0xFF, 0x05, 0x03, 0x02, 0x65, 0xF1, 0x60,
+	 0x58, 0x4E, 0xC3, 0x78, 0xFF, 0xFF, 0xCA, 0x60, 0xD4, 0x78, 0xFF, 0xFF, 0xF2, 0x60, 0xD8, 0x78,
+	 0xFF, 0xFF, 0x08, 0x60, 0x15, 0xF1, 0x00, 0x60, 0x01, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE,
+	 0x37, 0x00, 0x2D, 0x60, 0xAA, 0x63, 0xBD, 0xD3, 0xBD, 0xD1, 0xBD, 0xD1, 0xB0, 0x84, 0xB0, 0x84,
+	 0xFF, 0xFF, 0x07, 0x02, 0x8A, 0xFB, 0x31, 0x44, 0xFE, 0xB4, 0x40, 0x51, 0x0D, 0x64, 0x05, 0xFB,
+	 0x27, 0x00, 0x28, 0xF3, 0x9D, 0xF1, 0x60, 0x47, 0x64, 0x41, 0x07, 0xB1, 0x07, 0xB4, 0x50, 0xFB,
+	 0x01, 0x61, 0x03, 0x03, 0xCC, 0x84, 0xE1, 0x81, 0xFD, 0x02, 0xA1, 0x80, 0xB1, 0x83, 0x18, 0x02,
+	 0x9D, 0xFD, 0x16, 0x60, 0xCF, 0xF3, 0xE4, 0xFB, 0x7D, 0xFB, 0x13, 0x60, 0x02, 0xF3, 0xFF, 0xFF,
+	 0x00, 0xA8, 0x60, 0x46, 0x46, 0x5E, 0x31, 0x44, 0x01, 0xBC, 0x40, 0x51, 0xED, 0xE2, 0x0F, 0x4E,
+	 0x1D, 0x60, 0x58, 0x4F, 0x9F, 0x78, 0xFF, 0xFF, 0x0E, 0x4F, 0xCA, 0x60, 0xD4, 0x78, 0xFF, 0xFF,
+	 0xD7, 0xFE, 0xCA, 0x60, 0xD4, 0x78, 0xFF, 0xFF, 0xF2, 0x60, 0xE4, 0x64, 0x08, 0x60, 0x3B, 0xFB,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x2F, 0x58, 0xFF, 0xFF, 0x00, 0x64, 0x08, 0x60, 0x27, 0xFB, 0x5A, 0xDB,
+	 0x10, 0x60, 0x4E, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x2F, 0x58, 0xFF, 0xFF, 0x08, 0x60, 0x28, 0xF3,
+	 0xFF, 0xFF, 0x01, 0xB0, 0xFF, 0xFF, 0x1D, 0x03, 0x20, 0x40, 0x06, 0x23, 0x10, 0x00, 0x08, 0x60,
+	 0x27, 0xF1, 0x7F, 0x60, 0xFF, 0x64, 0xA0, 0x84, 0xA2, 0xDB, 0x80, 0x60, 0x00, 0x64, 0x08, 0x60,
+	 0x28, 0xFB, 0xF2, 0x60, 0xF4, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x1D, 0x60,
+	 0xA9, 0x78, 0xFF, 0xFF, 0x08, 0x60, 0x27, 0xF1, 0x00, 0x60, 0x01, 0x64, 0xB0, 0x84, 0xA2, 0xDB,
+	 0xCF, 0xFE, 0xC6, 0x01, 0x08, 0x60, 0x27, 0xF1, 0x00, 0x60, 0x02, 0x64, 0xB0, 0x84, 0xA2, 0xDB,
+	 0xCF, 0xFE, 0xDB, 0xF3, 0x01, 0x63, 0xFD, 0xA0, 0x08, 0x60, 0x77, 0xFD, 0x07, 0x02, 0x08, 0x60,
+	 0x30, 0xF1, 0x00, 0x60, 0x01, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0xB1, 0x01, 0x0E, 0x57,
+	 0x32, 0x40, 0x40, 0x26, 0x1B, 0x00, 0x45, 0x48, 0x00, 0x60, 0x06, 0x61, 0xB6, 0x60, 0x58, 0x4D,
+	 0x22, 0x78, 0xFF, 0xFF, 0x13, 0x03, 0x02, 0x64, 0x23, 0xFA, 0xF2, 0x60, 0x04, 0x64, 0x5A, 0xDA,
+	 0x28, 0x44, 0x5A, 0xDA, 0xFF, 0xFF, 0x26, 0x60, 0x0A, 0x64, 0x13, 0x60, 0x0D, 0xFB, 0x66, 0x44,
+	 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xFA, 0xFE, 0x37, 0x58, 0xFF, 0xFF,
+	 0x08, 0x60, 0x15, 0xF1, 0x00, 0x60, 0x02, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x88, 0x01,
+	 0x12, 0x60, 0xF6, 0xF3, 0xFF, 0xFF, 0x00, 0xA8, 0x60, 0x46, 0x0E, 0xF2, 0x4B, 0x03, 0x60, 0x40,
+	 0xF0, 0x37, 0x38, 0x00, 0xFF, 0x37, 0x2D, 0x00, 0xFD, 0x37, 0x25, 0x00, 0xF8, 0x37, 0x0A, 0x00,
+	 0x60, 0x47, 0xFF, 0xB5, 0x10, 0x60, 0x12, 0x62, 0x46, 0xD1, 0x00, 0x60, 0x01, 0x64, 0xB0, 0x84,
+	 0xA2, 0xDB, 0xCF, 0xFE, 0x00, 0x64, 0x13, 0x60, 0x0D, 0xFB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64,
+	 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xDC, 0x01, 0x06, 0xB4, 0xFD, 0x7F, 0x0E, 0xFA, 0x25, 0x60,
+	 0xF2, 0x64, 0x13, 0x60, 0x0D, 0xFB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF,
+	 0x2B, 0xFF, 0xF9, 0xFE, 0xCD, 0x01, 0x23, 0xF0, 0x60, 0x40, 0x04, 0x26, 0xED, 0x1B, 0x02, 0x26,
+	 0xEB, 0x18, 0xA2, 0xFF, 0x02, 0xF0, 0x09, 0x60, 0x08, 0x64, 0xD0, 0x80, 0xAD, 0xF3, 0x02, 0x02,
+	 0xCC, 0x84, 0xAD, 0xFB, 0x26, 0x60, 0x1A, 0x64, 0x40, 0x4B, 0x34, 0x60, 0x58, 0x4D, 0x08, 0x78,
+	 0xFF, 0xFF, 0xB6, 0x01, 0xAC, 0xFE, 0x09, 0x05, 0xAD, 0xFE, 0x0F, 0x05, 0xAE, 0xFE, 0xB0, 0x05,
+	 0xAF, 0xFE, 0x37, 0x05, 0xCA, 0x60, 0xD4, 0x78, 0xFF, 0xFF, 0x08, 0x60, 0x08, 0xF1, 0x20, 0x60,
+	 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0xF5, 0x01, 0x10, 0x60, 0x7A, 0x65, 0x0D, 0x61,
+	 0x07, 0x00, 0xA2, 0xDD, 0x58, 0x4F, 0x64, 0x58, 0xFF, 0xFF, 0x00, 0xB9, 0xFF, 0xFF, 0x08, 0x03,
+	 0x00, 0x63, 0xA5, 0xD1, 0x5A, 0xD3, 0xDA, 0x85, 0x00, 0xA8, 0xCD, 0x81, 0xF2, 0x02, 0xF8, 0x02,
+	 0xE1, 0x01, 0x10, 0x60, 0x0E, 0x62, 0x10, 0x60, 0x58, 0x65, 0xF3, 0x60, 0xD7, 0x63, 0x5A, 0xDF,
+	 0xD6, 0x80, 0xFF, 0xFF, 0x04, 0x03, 0x5A, 0xDF, 0x5A, 0xDF, 0x5A, 0xDD, 0xF9, 0x01, 0x10, 0x60,
+	 0x78, 0x65, 0x5A, 0xDF, 0xD6, 0x80, 0xFF, 0xFF, 0x02, 0x03, 0x5A, 0xDD, 0xFB, 0x01, 0x2F, 0x58,
+	 0xFF, 0xFF, 0x10, 0x60, 0x12, 0x64, 0x40, 0x41, 0x10, 0x60, 0x10, 0x63, 0xA3, 0xD1, 0x00, 0x64,
+	 0xD0, 0x80, 0x0C, 0x61, 0x08, 0x03, 0xBD, 0xDB, 0xA3, 0xD3, 0xFF, 0xFF, 0xB0, 0x84, 0xCD, 0x81,
+	 0xA3, 0xDB, 0x06, 0xA3, 0xF9, 0x02, 0x10, 0x60, 0x60, 0x63, 0xA3, 0xD1, 0x00, 0x64, 0xD0, 0x80,
+	 0x0D, 0x61, 0x19, 0x03, 0xBD, 0xDB, 0x64, 0x44, 0xFE, 0xA3, 0x02, 0xA3, 0xCD, 0x81, 0xE8, 0x84,
+	 0xE3, 0x03, 0x02, 0x05, 0xE1, 0x03, 0xF9, 0x01, 0x97, 0xFB, 0x99, 0xFD, 0x61, 0x5C, 0xA3, 0xD3,
+	 0x98, 0xF9, 0x03, 0x18, 0x58, 0x4F, 0x60, 0x58, 0xFF, 0xFF, 0x99, 0xF3, 0x98, 0xF1, 0x60, 0x43,
+	 0x97, 0xF3, 0x64, 0x41, 0xEA, 0x01, 0x21, 0x43, 0x10, 0x60, 0x5A, 0x65, 0xD7, 0x80, 0xBD, 0xD1,
+	 0xBD, 0xD3, 0x03, 0x02, 0xCA, 0x60, 0xD4, 0x78, 0xFF, 0xFF, 0xA0, 0x84, 0xBD, 0xD1, 0x43, 0x41,
+	 0xF5, 0x03, 0xF3, 0x60, 0xDC, 0x64, 0x64, 0x58, 0x40, 0x4F, 0x2A, 0xF0, 0x83, 0x60, 0xFF, 0x65,
+	 0x64, 0x47, 0x03, 0x2B, 0x01, 0x00, 0x14, 0x00, 0x03, 0x26, 0x03, 0xAC, 0x60, 0x47, 0xA4, 0x84,
+	 0x2A, 0xFA, 0x2F, 0xF2, 0x2C, 0xFA, 0x30, 0xF2, 0x2D, 0xFA, 0x31, 0xF2, 0x2E, 0xFA, 0x64, 0x41,
+	 0xEA, 0xF3, 0x2F, 0xFA, 0x60, 0x43, 0xEB, 0xF3, 0x30, 0xFA, 0xEC, 0xF1, 0x31, 0xF8, 0x19, 0x00,
+	 0x60, 0x47, 0xA4, 0x84, 0x2A, 0xFA, 0x2F, 0xF2, 0x2C, 0xFA, 0x30, 0xF2, 0x2D, 0xFA, 0x31, 0xF2,
+	 0x2E, 0xFA, 0x36, 0xF2, 0x32, 0xFA, 0x37, 0xF2, 0x33, 0xFA, 0x38, 0xF2, 0x34, 0xFA, 0xEA, 0xF3,
+	 0x2F, 0xFA, 0x36, 0xFA, 0xEB, 0xF3, 0x30, 0xFA, 0x37, 0xFA, 0xEC, 0xF3, 0x31, 0xFA, 0x38, 0xFA,
+	 0x64, 0x41, 0x1C, 0xF2, 0x13, 0xFA, 0x00, 0xF4, 0x0D, 0xF2, 0xFF, 0xFF, 0x60, 0x40, 0x80, 0x2B,
+	 0x17, 0x00, 0x81, 0x67, 0xA2, 0xDA, 0xF4, 0x60, 0x58, 0x4E, 0xCF, 0x78, 0xFF, 0xFF, 0x26, 0x46,
+	 0x3F, 0xFC, 0x25, 0x60, 0xCE, 0x64, 0x13, 0x60, 0x0D, 0xFB, 0x26, 0x44, 0x5A, 0xDB, 0x02, 0x64,
+	 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xC1, 0xFE, 0x00, 0x66, 0x46, 0x46, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x26, 0x46, 0x3F, 0xF0, 0x42, 0x64, 0xD0, 0x80, 0xFF, 0xFF, 0x01, 0x04, 0x3F, 0xFA, 0x07, 0xF2,
+	 0xA6, 0xF1, 0x01, 0x1B, 0x07, 0xF8, 0x1C, 0xF2, 0x13, 0xFA, 0x26, 0xF2, 0x27, 0xF0, 0x60, 0x47,
+	 0x00, 0xF4, 0x1F, 0xFA, 0x64, 0x47, 0x20, 0xFA, 0x61, 0x44, 0x21, 0xFA, 0x01, 0x67, 0x0D, 0xFA,
+	 0x10, 0x61, 0x2D, 0x60, 0x5E, 0x64, 0x1E, 0x63, 0x58, 0xD1, 0xCD, 0x81, 0xBD, 0xD8, 0xFC, 0x02,
+	 0xB8, 0xF1, 0xD6, 0xF1, 0x64, 0x5E, 0x64, 0x5F, 0x44, 0x63, 0xBD, 0xDA, 0x16, 0x60, 0xAC, 0xF3,
+	 0xFF, 0xFF, 0xE0, 0x84, 0xE0, 0x84, 0xE0, 0x84, 0x4A, 0xD3, 0x60, 0x45, 0x60, 0x40, 0x01, 0x36,
+	 0x03, 0x64, 0x02, 0x36, 0x01, 0x64, 0xB4, 0x84, 0x06, 0xA2, 0xA2, 0xD1, 0xBD, 0xDA, 0x64, 0x47,
+	 0xBD, 0xDA, 0xD3, 0xF3, 0xD4, 0xF1, 0x60, 0x47, 0xBD, 0xDA, 0x64, 0x47, 0xE2, 0xF1, 0xBD, 0xDA,
+	 0x64, 0x44, 0xBD, 0xDA, 0x26, 0x46, 0x00, 0x64, 0x23, 0xF0, 0x3B, 0xF0, 0x64, 0x40, 0x10, 0x2A,
+	 0x06, 0x00, 0xC0, 0x67, 0xA0, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0xE8, 0x84, 0x10, 0xBC, 0x3E, 0xFA,
+	 0x25, 0x60, 0xDA, 0x64, 0x13, 0x60, 0x0D, 0xFB, 0x26, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB,
+	 0xFF, 0xFF, 0x2B, 0xFF, 0xC8, 0xFE, 0x00, 0x66, 0x46, 0x46, 0x2F, 0x58, 0xFF, 0xFF, 0xB1, 0xF3,
+	 0x1F, 0xFA, 0x32, 0x47, 0x07, 0xFA, 0x24, 0x7E, 0x01, 0x7F, 0x08, 0xFA, 0xD6, 0xF1, 0x09, 0xF8,
+	 0x01, 0x60, 0x01, 0x64, 0x0A, 0xFA, 0x01, 0x64, 0x0B, 0xFA, 0x18, 0x64, 0x13, 0x60, 0x0D, 0xFB,
+	 0x66, 0x44, 0x5A, 0xDB, 0x0A, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0x52, 0x63, 0x2E, 0x58,
+	 0xFF, 0xFF, 0x00, 0x60, 0x2A, 0x61, 0xB6, 0x60, 0x58, 0x4D, 0x25, 0x78, 0xFF, 0xFF, 0x66, 0x44,
+	 0x5D, 0xFB, 0x04, 0x64, 0x03, 0xFA, 0x67, 0x44, 0x2C, 0xFA, 0x2D, 0xFA, 0x2E, 0xFA, 0x32, 0xFA,
+	 0x33, 0xFA, 0x34, 0xFA, 0x12, 0x60, 0x80, 0x64, 0xA6, 0xF1, 0x0E, 0xFA, 0x07, 0xF8, 0x00, 0x64,
+	 0x3E, 0xFA, 0x0E, 0x60, 0x3D, 0xFB, 0x06, 0xA2, 0x10, 0x60, 0x80, 0x64, 0xA2, 0xDB, 0x04, 0x64,
+	 0x5A, 0xDB, 0x06, 0x64, 0x5A, 0xDB, 0xF8, 0x60, 0xCF, 0x64, 0x08, 0x60, 0x3F, 0xFB, 0x00, 0x64,
+	 0x0E, 0x60, 0x43, 0xFB, 0x06, 0xA2, 0x10, 0x60, 0x84, 0x64, 0xA2, 0xDB, 0x08, 0x64, 0x5A, 0xDB,
+	 0x06, 0x64, 0x5A, 0xDB, 0xF8, 0x60, 0xD8, 0x64, 0x08, 0x60, 0x41, 0xFB, 0xF8, 0x60, 0xB4, 0x64,
+	 0x08, 0x60, 0x34, 0xFB, 0x00, 0x60, 0x30, 0x64, 0x08, 0x60, 0x13, 0xFB, 0xF5, 0x60, 0x31, 0x64,
+	 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x2F, 0x58, 0xFF, 0xFF, 0xF7, 0x60, 0x6C, 0x78,
+	 0xFF, 0xFF, 0x5D, 0xF5, 0xEA, 0xF1, 0x2F, 0xF8, 0xEB, 0xF1, 0x30, 0xF8, 0xEC, 0xF1, 0x31, 0xF8,
+	 0xC9, 0xF1, 0x19, 0xF8, 0x00, 0x63, 0x88, 0xFD, 0x1B, 0x60, 0xB2, 0x63, 0x86, 0xFD, 0x87, 0xFD,
+	 0x20, 0x40, 0x10, 0x2B, 0x00, 0x00, 0x5D, 0xF5, 0x40, 0x64, 0x2A, 0xFA, 0x7D, 0xF3, 0x7C, 0xFB,
+	 0x08, 0x60, 0x12, 0xF1, 0x00, 0x60, 0x10, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x03, 0x03, 0xA0, 0x84,
+	 0xA2, 0xDB, 0x03, 0x00, 0xF6, 0x60, 0xC6, 0x78, 0xFF, 0xFF, 0x19, 0x60, 0x3D, 0xF3, 0xFD, 0x60,
+	 0x58, 0x4E, 0xAC, 0x78, 0xFF, 0xFF, 0x19, 0x60, 0x3F, 0xFB, 0x19, 0x60, 0x39, 0xF3, 0x3F, 0x40,
+	 0x01, 0x27, 0x08, 0x00, 0x0F, 0x60, 0xFF, 0x65, 0xA4, 0x84, 0xFC, 0x60, 0x58, 0x4E, 0x34, 0x78,
+	 0xFF, 0xFF, 0x05, 0x00, 0x0F, 0xB4, 0xFC, 0x60, 0x58, 0x4E, 0x34, 0x78, 0xFF, 0xFF, 0x5D, 0xF5,
+	 0x35, 0x60, 0x70, 0x64, 0x00, 0xF4, 0x40, 0x48, 0x2F, 0x60, 0x24, 0x64, 0x20, 0x40, 0x10, 0x27,
+	 0x02, 0x00, 0x2F, 0x60, 0x02, 0x64, 0x28, 0xDB, 0x04, 0x61, 0x00, 0x60, 0x00, 0x64, 0xF1, 0x60,
+	 0x58, 0x4D, 0x34, 0x78, 0xFF, 0xFF, 0x5D, 0xF5, 0x3F, 0xFC, 0x01, 0x64, 0x54, 0xF1, 0x10, 0x60,
+	 0x12, 0xFB, 0x7D, 0xFB, 0xA4, 0xD3, 0x04, 0x65, 0x53, 0xF3, 0x01, 0x18, 0x0C, 0x65, 0xF3, 0xB4,
+	 0xB4, 0x84, 0x53, 0xFB, 0x0D, 0x00, 0xF7, 0x60, 0x6C, 0x78, 0xFF, 0xFF, 0x53, 0xF1, 0x7D, 0xF3,
+	 0xFF, 0xFF, 0xF3, 0xA0, 0x04, 0xA4, 0x01, 0x04, 0xF1, 0xA4, 0x10, 0x36, 0xF4, 0x01, 0x7D, 0xFB,
+	 0x20, 0x40, 0x10, 0x2B, 0x10, 0x00, 0x7D, 0xF3, 0x32, 0x60, 0x80, 0x61, 0xA1, 0xD1, 0xCC, 0x84,
+	 0x01, 0x61, 0x08, 0x24, 0x03, 0x00, 0xE1, 0x81, 0xCC, 0x84, 0xFB, 0x01, 0xA1, 0x84, 0x53, 0xF1,
+	 0xE6, 0x03, 0x10, 0x60, 0x12, 0xFB, 0x7D, 0xF3, 0x10, 0x60, 0xF2, 0x61, 0xCC, 0x84, 0xFF, 0xFF,
+	 0x02, 0x03, 0x06, 0xA1, 0xFB, 0x01, 0xA1, 0xD3, 0x53, 0xF1, 0x01, 0xB0, 0x02, 0xB0, 0xD7, 0x03,
+	 0x64, 0x40, 0x01, 0x26, 0x05, 0x00, 0x20, 0x40, 0x10, 0x27, 0x02, 0x00, 0xD0, 0x03, 0x00, 0x00,
+	 0x9D, 0xFE, 0x3D, 0x05, 0xBA, 0xFE, 0x10, 0x60, 0x24, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0xDE, 0xFE,
+	 0x0A, 0x04, 0x40, 0x60, 0x00, 0x64, 0x08, 0x60, 0x13, 0xFB, 0xF5, 0x60, 0xCB, 0x64, 0x5A, 0xDB,
+	 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x10, 0x60, 0x24, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x7D, 0xF1,
+	 0x13, 0x60, 0x1A, 0xF9, 0x08, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x2D, 0xFF, 0x20, 0x60, 0x00, 0x64,
+	 0x08, 0x60, 0x13, 0xFB, 0xF5, 0x60, 0xF0, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF,
+	 0xBE, 0xFE, 0x08, 0x60, 0x08, 0xF1, 0x40, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE,
+	 0x1B, 0x60, 0xF3, 0xF1, 0xAD, 0x4F, 0x00, 0x7F, 0xFA, 0xB4, 0x64, 0x41, 0x7D, 0xF1, 0x02, 0xB1,
+	 0x04, 0x65, 0x02, 0x02, 0x64, 0x40, 0x01, 0x2B, 0x01, 0x65, 0xB4, 0x84, 0xA0, 0x5D, 0x10, 0x60,
+	 0x24, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0xDE, 0xFE, 0x0A, 0x04, 0x40, 0x60, 0x00, 0x64, 0x08, 0x60,
+	 0x13, 0xFB, 0xF5, 0x60, 0xC8, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x7D, 0xF1,
+	 0x13, 0x60, 0x1A, 0xF9, 0x0E, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x2D, 0xFF, 0x20, 0x60, 0x00, 0x64,
+	 0x08, 0x60, 0x13, 0xFB, 0xF6, 0x60, 0x28, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF,
+	 0xBE, 0xFE, 0x08, 0x60, 0x08, 0xF1, 0x40, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE,
+	 0x10, 0x60, 0x24, 0x62, 0x00, 0x64, 0xA2, 0xDB, 0x5D, 0xF5, 0x25, 0x60, 0xCE, 0x64, 0x13, 0x60,
+	 0x0D, 0xFB, 0x66, 0x44, 0x5A, 0xDB, 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0x00, 0x64,
+	 0x51, 0xFB, 0x00, 0x60, 0x01, 0x64, 0x08, 0x60, 0x13, 0xFB, 0xF6, 0x60, 0x4C, 0x64, 0x5A, 0xDB,
+	 0xCF, 0xFE, 0xC1, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x10, 0x60, 0x24, 0x62, 0x00, 0x64, 0xA2, 0xDB,
+	 0xC3, 0xF1, 0x0E, 0x60, 0x3F, 0xF9, 0x1C, 0x60, 0x7A, 0x64, 0x13, 0x60, 0x22, 0xFB, 0x02, 0x64,
+	 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0xC4, 0xF1, 0x0E, 0x60, 0x45, 0xF9, 0x26, 0x60, 0x42, 0x62,
+	 0xA2, 0xD3, 0xFF, 0xFF, 0xFD, 0x1B, 0x1C, 0x60, 0x86, 0x64, 0x13, 0x60, 0x22, 0xFB, 0x02, 0x64,
+	 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x00, 0x60, 0x08, 0x64, 0x08, 0x60, 0x13, 0xFB, 0xF6, 0x60,
+	 0x75, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x51, 0xF1, 0x10, 0x60, 0x24, 0x62,
+	 0x00, 0x64, 0xA2, 0xDB, 0x64, 0x40, 0xFF, 0x26, 0x0B, 0x00, 0x53, 0xF3, 0xFF, 0xFF, 0x80, 0xB0,
+	 0xFF, 0xFF, 0x03, 0x03, 0xF7, 0x60, 0x65, 0x78, 0xFF, 0xFF, 0xF5, 0x60, 0x96, 0x78, 0xFF, 0xFF,
+	 0x02, 0x0A, 0x00, 0x64, 0x51, 0xFB, 0xC5, 0xF1, 0x0E, 0x60, 0x45, 0xF9, 0x00, 0x60, 0x0C, 0x64,
+	 0x08, 0x60, 0x13, 0xFB, 0xF6, 0x60, 0xA0, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x1C, 0x60, 0x86, 0x64,
+	 0x13, 0x60, 0x22, 0xFB, 0x02, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x08, 0x60, 0x12, 0xF1, 0x00, 0x60, 0x04, 0x64, 0xA0, 0x80, 0x9C, 0x84, 0x0B, 0x03, 0xA0, 0x84,
+	 0xA2, 0xDB, 0x1C, 0x60, 0x86, 0x64, 0x13, 0x60, 0x22, 0xFB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF,
+	 0x04, 0xFF, 0x13, 0x00, 0xFF, 0x60, 0xF7, 0x64, 0xA0, 0x84, 0xA2, 0xDB, 0x51, 0xF3, 0xDE, 0x0A,
+	 0x00, 0xA0, 0x00, 0x64, 0x02, 0x03, 0x51, 0xFB, 0xD9, 0x01, 0x1C, 0x60, 0x7A, 0x64, 0x13, 0x60,
+	 0x22, 0xFB, 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0xB7, 0x01, 0x19, 0x60, 0x3E, 0xF3,
+	 0xFD, 0x60, 0x58, 0x4E, 0xAC, 0x78, 0xFF, 0xFF, 0x19, 0x60, 0x3F, 0xFB, 0x19, 0x60, 0x3A, 0xF3,
+	 0x0F, 0x60, 0xFF, 0x65, 0xA4, 0x84, 0xFC, 0x60, 0x58, 0x4E, 0x34, 0x78, 0xFF, 0xFF, 0x5D, 0xF5,
+	 0x35, 0x60, 0x70, 0x64, 0x00, 0xF4, 0x40, 0x48, 0x2F, 0x60, 0x24, 0x64, 0x20, 0x40, 0x10, 0x27,
+	 0x02, 0x00, 0x2F, 0x60, 0x02, 0x64, 0x28, 0xDB, 0x04, 0x61, 0x00, 0x60, 0x00, 0x64, 0xF1, 0x60,
+	 0x58, 0x4D, 0x34, 0x78, 0xFF, 0xFF, 0x5D, 0xF5, 0x3F, 0xFC, 0x53, 0xF3, 0x20, 0x40, 0x10, 0x23,
+	 0x02, 0x00, 0x20, 0xBC, 0x04, 0x00, 0x60, 0x40, 0x01, 0x22, 0x40, 0xBC, 0x04, 0xBC, 0x80, 0xBC,
+	 0x53, 0xFB, 0x11, 0x60, 0x62, 0x64, 0x08, 0x60, 0x6C, 0xFB, 0x06, 0x64, 0x08, 0x60, 0x73, 0xFB,
+	 0x19, 0x60, 0x43, 0xF3, 0xFF, 0xFF, 0x07, 0xB4, 0xA2, 0xDB, 0x53, 0xF3, 0x08, 0x60, 0x6C, 0xF1,
+	 0x60, 0x40, 0x20, 0x26, 0x03, 0x00, 0x01, 0x26, 0x32, 0x00, 0x45, 0x00, 0x08, 0x60, 0x73, 0xF3,
+	 0xFF, 0xFF, 0xDD, 0xA0, 0x01, 0xA4, 0x58, 0x03, 0xA2, 0xDB, 0x32, 0x60, 0x82, 0x61, 0xE0, 0xA0,
+	 0xF0, 0xA0, 0x05, 0x05, 0x01, 0x05, 0x05, 0x00, 0x02, 0xA1, 0xF0, 0xA4, 0x02, 0x00, 0x04, 0xA1,
+	 0xE0, 0xA4, 0xA1, 0xD1, 0x01, 0x61, 0xDC, 0x84, 0xCC, 0x84, 0xFF, 0xFF, 0x02, 0x03, 0xE1, 0x81,
+	 0xFB, 0x01, 0xA1, 0x80, 0x10, 0x60, 0xE6, 0x64, 0x01, 0x02, 0xE0, 0x01, 0xA0, 0xD3, 0x11, 0x60,
+	 0x5A, 0x63, 0xFA, 0xA4, 0xCC, 0x84, 0x08, 0xA3, 0xFD, 0x02, 0xCF, 0xF1, 0xA3, 0xD3, 0x01, 0x18,
+	 0xD5, 0x18, 0xFE, 0xA3, 0xA3, 0xD3, 0x7D, 0xFB, 0xF5, 0x60, 0xC8, 0x78, 0xFF, 0xFF, 0x12, 0x60,
+	 0x40, 0x65, 0x64, 0x41, 0xA1, 0xD3, 0xD5, 0x80, 0x00, 0xB8, 0x26, 0x07, 0x02, 0x02, 0x08, 0xA1,
+	 0xF9, 0x01, 0x61, 0x44, 0x08, 0x60, 0x6C, 0xFB, 0x01, 0x64, 0xA1, 0xDB, 0x49, 0xD3, 0x7D, 0xFB,
+	 0xF5, 0x60, 0xC8, 0x78, 0xFF, 0xFF, 0x12, 0x60, 0x40, 0x65, 0x64, 0x41, 0xA1, 0xD3, 0xD5, 0x80,
+	 0x04, 0xB0, 0x12, 0x07, 0x02, 0x02, 0x08, 0xA1, 0xF9, 0x01, 0x61, 0x44, 0x08, 0x60, 0x6C, 0xFB,
+	 0x49, 0xD3, 0x7D, 0xFB, 0xF5, 0x60, 0xC8, 0x78, 0xFF, 0xFF, 0x10, 0x60, 0xD8, 0x65, 0xA5, 0xD3,
+	 0xFF, 0xFF, 0x08, 0xA4, 0xA5, 0xDB, 0x99, 0x01, 0x1C, 0x60, 0x7A, 0x64, 0x13, 0x60, 0x22, 0xFB,
+	 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x53, 0xF3, 0xFF, 0xFF, 0xE3, 0xB4, 0x53, 0xFB,
+	 0x10, 0x60, 0x10, 0xF3, 0xFF, 0xFF, 0xFE, 0xB4, 0xA2, 0xDB, 0x10, 0x60, 0x24, 0x62, 0x00, 0x64,
+	 0xA2, 0xDB, 0xDE, 0xFE, 0x0A, 0x04, 0x40, 0x60, 0x00, 0x64, 0x08, 0x60, 0x13, 0xFB, 0xF7, 0x60,
+	 0x7D, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x7C, 0xF1, 0x7D, 0xF9, 0x13, 0x60,
+	 0x1A, 0xF9, 0x0E, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x2D, 0xFF, 0x20, 0x60, 0x00, 0x64, 0x08, 0x60,
+	 0x13, 0xFB, 0xF7, 0x60, 0x9F, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0xBE, 0xFE,
+	 0x08, 0x60, 0x08, 0xF1, 0x40, 0x60, 0x00, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x53, 0xF3,
+	 0xFF, 0xFF, 0x80, 0xB0, 0xFF, 0xFF, 0x54, 0x02, 0x1C, 0x60, 0x32, 0x63, 0x1C, 0x61, 0xCD, 0x81,
+	 0xBD, 0xDF, 0xFD, 0x02, 0x14, 0x60, 0x32, 0x61, 0x88, 0xF3, 0x61, 0x43, 0xC4, 0xA5, 0x47, 0xD1,
+	 0x0F, 0x04, 0xBE, 0xD5, 0x1C, 0x60, 0x2E, 0x63, 0xC3, 0x83, 0xC3, 0x83, 0xC3, 0x83, 0x43, 0xD3,
+	 0xBE, 0xD1, 0xDC, 0x84, 0xA3, 0xDB, 0x66, 0x44, 0xC0, 0x84, 0xBE, 0xDB, 0x65, 0x44, 0xED, 0x01,
+	 0x1C, 0x60, 0x32, 0x63, 0x0E, 0x61, 0x41, 0x4B, 0xBD, 0xD3, 0xBD, 0xD1, 0x00, 0xBD, 0x64, 0x41,
+	 0x19, 0x03, 0x01, 0xA8, 0x61, 0x44, 0x02, 0xA8, 0x15, 0x03, 0x02, 0x02, 0xE9, 0x84, 0x12, 0x00,
+	 0x65, 0x47, 0x60, 0x45, 0x61, 0x44, 0x09, 0x61, 0xCD, 0x81, 0xE0, 0x84, 0xFF, 0x23, 0xFC, 0x01,
+	 0x02, 0x24, 0xC4, 0x84, 0x02, 0x28, 0xD4, 0x84, 0xCD, 0x81, 0x01, 0x0E, 0x01, 0xBC, 0x02, 0x03,
+	 0xE0, 0x84, 0xF6, 0x01, 0x00, 0x7F, 0x2B, 0x41, 0x4D, 0x8B, 0xBF, 0xDB, 0xDD, 0x02, 0x14, 0x60,
+	 0x32, 0x61, 0x88, 0xF3, 0x61, 0x43, 0xC4, 0xA5, 0x47, 0xD1, 0x0A, 0x04, 0xDA, 0x86, 0x1C, 0x60,
+	 0x30, 0x63, 0xC3, 0x83, 0xC3, 0x83, 0xC3, 0x83, 0x43, 0xD1, 0xA6, 0xD9, 0x65, 0x44, 0xF2, 0x01,
+	 0x53, 0xF3, 0x88, 0xF1, 0xF3, 0xB4, 0x53, 0xFB, 0x14, 0x60, 0x32, 0x63, 0xC3, 0x85, 0x45, 0x4A,
+	 0x1B, 0x60, 0xB2, 0x65, 0x87, 0xF3, 0x45, 0x4C, 0x40, 0x48, 0x2A, 0x45, 0xD7, 0x80, 0x02, 0x65,
+	 0x17, 0x05, 0x47, 0xD1, 0x02, 0x65, 0x47, 0xD3, 0x0A, 0x65, 0xD0, 0x81, 0x47, 0xD3, 0x01, 0x05,
+	 0x00, 0x61, 0xF2, 0xA3, 0x01, 0xB0, 0x61, 0x44, 0x05, 0x03, 0x2C, 0xDB, 0x5A, 0xDD, 0x5A, 0x8C,
+	 0x3C, 0xA3, 0xEB, 0x01, 0x28, 0x42, 0x4A, 0xDD, 0x4A, 0xDB, 0x42, 0x48, 0x3C, 0xA3, 0xE5, 0x01,
+	 0x28, 0x44, 0x86, 0xFB, 0x86, 0xF1, 0x1B, 0x60, 0xB2, 0x63, 0x44, 0x48, 0x28, 0x45, 0xD7, 0x80,
+	 0xA3, 0xD1, 0x15, 0x05, 0x04, 0x65, 0x46, 0xD3, 0x28, 0x45, 0xD6, 0x80, 0xD0, 0x80, 0x02, 0x04,
+	 0x04, 0xA3, 0xF5, 0x01, 0xF7, 0x06, 0x62, 0x46, 0xA2, 0xD9, 0xA3, 0xDB, 0x5B, 0xD3, 0x66, 0x42,
+	 0x5A, 0xD1, 0xA2, 0xDB, 0xA3, 0xD9, 0xFE, 0xA3, 0xA3, 0xD1, 0x66, 0x42, 0xEB, 0x01, 0x86, 0xF3,
+	 0x87, 0xF1, 0x60, 0x43, 0x44, 0x48, 0x28, 0x45, 0xD7, 0x80, 0xA3, 0xD1, 0x15, 0x05, 0x04, 0x65,
+	 0x46, 0xD3, 0x28, 0x45, 0xD6, 0x80, 0xD0, 0x80, 0x02, 0x04, 0x04, 0xA3, 0xF5, 0x01, 0xF7, 0x06,
+	 0x62, 0x46, 0xA2, 0xD9, 0xA3, 0xDB, 0x5B, 0xD3, 0x66, 0x42, 0x5A, 0xD1, 0xA2, 0xDB, 0xA3, 0xD9,
+	 0xFE, 0xA3, 0xA3, 0xD1, 0x66, 0x42, 0xEB, 0x01, 0x08, 0x60, 0x08, 0xF1, 0x10, 0x60, 0x00, 0x64,
+	 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x7D, 0xF1, 0x19, 0x60, 0x3D, 0xF3, 0x64, 0x40, 0x01, 0x27,
+	 0x27, 0x00, 0xFD, 0x60, 0x58, 0x4E, 0xAC, 0x78, 0xFF, 0xFF, 0x19, 0x60, 0x3F, 0xFB, 0x19, 0x60,
+	 0x39, 0xF3, 0x3F, 0x40, 0x01, 0x27, 0x16, 0x00, 0x0F, 0x60, 0xFF, 0x65, 0x60, 0x41, 0xDB, 0xF3,
+	 0xFF, 0xFF, 0x60, 0x40, 0x03, 0x36, 0x07, 0x00, 0x19, 0x60, 0x44, 0xF3, 0xFF, 0xFF, 0x60, 0x40,
+	 0x01, 0x2A, 0x01, 0x00, 0x0F, 0x61, 0x61, 0x44, 0xA4, 0x84, 0xFC, 0x60, 0x58, 0x4E, 0x34, 0x78,
+	 0xFF, 0xFF, 0x16, 0x00, 0x0F, 0xB4, 0xFC, 0x60, 0x58, 0x4E, 0x34, 0x78, 0xFF, 0xFF, 0x10, 0x00,
+	 0x5A, 0xD3, 0xFD, 0x60, 0x58, 0x4E, 0xAC, 0x78, 0xFF, 0xFF, 0x19, 0x60, 0x3F, 0xFB, 0x19, 0x60,
+	 0x3A, 0xF3, 0x0F, 0x60, 0xFF, 0x65, 0xA4, 0x84, 0xFC, 0x60, 0x58, 0x4E, 0x34, 0x78, 0xFF, 0xFF,
+	 0x00, 0x60, 0x30, 0x64, 0x08, 0x60, 0x13, 0xFB, 0xF5, 0x60, 0x31, 0x64, 0x5A, 0xDB, 0xCF, 0xFE,
+	 0x2F, 0x58, 0xFF, 0xFF, 0x2F, 0x58, 0xFF, 0xFF, 0x1C, 0x60, 0x7A, 0x64, 0x13, 0x60, 0x22, 0xFB,
+	 0x03, 0x64, 0x4A, 0xDB, 0xFF, 0xFF, 0x04, 0xFF, 0x00, 0x64, 0x53, 0xFB, 0x00, 0x64, 0x08, 0x60,
+	 0x12, 0xFB, 0x5A, 0xDB, 0xBE, 0xFE, 0x00, 0x60, 0x30, 0x64, 0x08, 0x60, 0x13, 0xFB, 0xF5, 0x60,
+	 0x31, 0x64, 0x5A, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF, 0x2F, 0x58, 0xFF, 0xFF, 0x08, 0x60,
+	 0x12, 0xF1, 0x00, 0x60, 0x04, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x2F, 0x58, 0xFF, 0xFF,
+	 0x08, 0x60, 0x12, 0xF1, 0x00, 0x60, 0x08, 0x64, 0xB0, 0x84, 0xA2, 0xDB, 0xCF, 0xFE, 0x2F, 0x58,
+	 0xFF, 0xFF, 0x20, 0x40, 0x90, 0x2B, 0x03, 0x00, 0xFB, 0x60, 0xFC, 0x78, 0xFF, 0xFF, 0x53, 0xF3,
+	 0x88, 0xF1, 0x04, 0xB0, 0x07, 0x60, 0x80, 0x64, 0xD0, 0x80, 0x20, 0x03, 0x1F, 0x06, 0x26, 0x46,
+	 0x88, 0xF1, 0x14, 0x60, 0x32, 0x63, 0xC3, 0x83, 0x7D, 0xF3, 0x26, 0xF0, 0xBD, 0xDB, 0x64, 0x44,
+	 0x00, 0x7F, 0xBD, 0xDB, 0x64, 0x47, 0x00, 0x7F, 0xBD, 0xDB, 0x32, 0xF0, 0xBD, 0xD9, 0x33, 0xF0,
+	 0xBD, 0xD9, 0x34, 0xF0, 0xBD, 0xD9, 0x00, 0xF4, 0x0D, 0xF0, 0xBD, 0xD9, 0x0E, 0xF0, 0xBD, 0xD9,
+	 0x0F, 0xF0, 0xA3, 0xDF, 0x64, 0x47, 0x60, 0x45, 0x00, 0x37, 0x03, 0x00, 0xFB, 0x60, 0xF7, 0x78,
+	 0xFF, 0xFF, 0xBD, 0xDB, 0xE0, 0xA0, 0x1F, 0x61, 0x00, 0xB8, 0xF8, 0x07, 0xF7, 0x03, 0x60, 0xFE,
+	 0x5D, 0xD0, 0xCC, 0x84, 0xBD, 0xD9, 0xFC, 0x02, 0x65, 0x40, 0x01, 0x26, 0xDF, 0x83, 0x5D, 0xD0,
+	 0xFF, 0xFF, 0x64, 0x40, 0x01, 0x3A, 0x03, 0x00, 0x5D, 0xD0, 0xFF, 0xFF, 0xC1, 0x81, 0x5D, 0xD0,
+	 0xFF, 0xFF, 0x64, 0x40, 0x03, 0x36, 0x07, 0x00, 0x53, 0xF3, 0xFF, 0xFF, 0x60, 0x40, 0x80, 0x2A,
+	 0xDD, 0x01, 0xCD, 0x81, 0x13, 0x00, 0x53, 0xF3, 0xFF, 0xFF, 0x60, 0x40, 0x80, 0x2A, 0x04, 0x00,
+	 0x5D, 0xD0, 0xFF, 0xFF, 0xC1, 0x81, 0x0A, 0x00, 0x59, 0xD0, 0x7D, 0xF3, 0xFF, 0xFF, 0xD0, 0x80,
+	 0x20, 0xFE, 0x08, 0x24, 0x03, 0x00, 0xFB, 0x60, 0xF7, 0x78, 0xFF, 0xFF, 0x7C, 0x44, 0x1A, 0x60,
+	 0x24, 0xFB, 0x1A, 0x60, 0x25, 0xFB, 0x1A, 0x60, 0x26, 0xFB, 0x1A, 0x60, 0x27, 0xFB, 0x1C, 0x60,
+	 0x08, 0xFB, 0x1C, 0x60, 0x04, 0xFB, 0x00, 0x64, 0x1C, 0x60, 0x04, 0xFB, 0x20, 0xFE, 0x37, 0x60,
+	 0xFE, 0x64, 0x40, 0x4A, 0xF9, 0x60, 0x58, 0x4D, 0xC3, 0x78, 0xFF, 0xFF, 0x1C, 0x60, 0x04, 0xF3,
+	 0xFF, 0xFF, 0x09, 0x18, 0xFF, 0xFF, 0x1C, 0x60, 0x06, 0xF3, 0x1C, 0x60, 0x07, 0xF5, 0x60, 0x41,
+	 0x00, 0x64, 0x1C, 0x60, 0x04, 0xFB, 0x20, 0xFE, 0x2A, 0xD1, 0xDA, 0x85, 0x64, 0x44, 0x01, 0xA0,
+	 0xFF, 0xFF, 0x01, 0x02, 0x79, 0x00, 0x45, 0x4A, 0x7C, 0x44, 0x60, 0xFE, 0xA1, 0xD2, 0xFF, 0xFF,
+	 0xD0, 0x80, 0x20, 0xFE, 0x01, 0x03, 0xEF, 0x01, 0x1C, 0x60, 0x04, 0xF3, 0xFF, 0xFF, 0x02, 0x18,
+	 0xDD, 0x81, 0x35, 0x00, 0x60, 0xFE, 0x5D, 0xD2, 0xFF, 0xFF, 0x60, 0x5C, 0x41, 0x94, 0x81, 0xA0,
+	 0x20, 0xFE, 0x2D, 0x04, 0x01, 0x64, 0x1C, 0x60, 0x04, 0xFB, 0xC1, 0x84, 0x84, 0xA4, 0x1C, 0x60,
+	 0x06, 0xFB, 0x00, 0xF2, 0x1C, 0x60, 0x07, 0xFB, 0x1C, 0x60, 0x05, 0xFD, 0x02, 0x60, 0x00, 0x63,
+	 0xCD, 0x85, 0x64, 0x44, 0xD8, 0x81, 0xCD, 0x84, 0x4C, 0x91, 0x60, 0x43, 0x60, 0xFE, 0xA5, 0xD2,
+	 0xDE, 0x85, 0x7F, 0x26, 0x02, 0x00, 0x00, 0xF4, 0x04, 0x65, 0x5D, 0x93, 0xA3, 0xDB, 0x5D, 0x93,
+	 0xA5, 0xD2, 0xF6, 0x1F, 0x5D, 0x93, 0x20, 0xFE, 0xDF, 0x83, 0x00, 0x60, 0x01, 0x61, 0x02, 0x60,
+	 0x00, 0x64, 0xE0, 0x87, 0x60, 0x46, 0x1C, 0x60, 0x05, 0xF3, 0xFF, 0xFF, 0x60, 0x43, 0x60, 0xFE,
+	 0xCD, 0x81, 0x20, 0xFE, 0x2A, 0x44, 0x38, 0x60, 0x00, 0x7C, 0xD0, 0x84, 0x38, 0x60, 0x04, 0x65,
+	 0x44, 0xD7, 0xFF, 0xFF, 0xFF, 0xFF, 0x1C, 0x60, 0x04, 0xF3, 0xFF, 0xFF, 0x08, 0x18, 0x1C, 0x60,
+	 0x06, 0xF3, 0x1C, 0x60, 0x07, 0xF5, 0x60, 0x41, 0x00, 0x64, 0x1C, 0x60, 0x04, 0xFB, 0x26, 0x44,
+	 0x01, 0xA4, 0x58, 0x90, 0xFF, 0xFF, 0x03, 0x02, 0x61, 0x44, 0x0B, 0xA5, 0x04, 0x00, 0x61, 0x44,
+	 0xFC, 0xA4, 0x8B, 0x7C, 0xC0, 0x85, 0xDD, 0x81, 0x66, 0x44, 0x1C, 0x60, 0x07, 0xFB, 0x26, 0x46,
+	 0x1B, 0xF0, 0x1C, 0x60, 0x07, 0xF5, 0x64, 0x44, 0xD4, 0x80, 0xFF, 0xFF, 0x02, 0x06, 0x2D, 0x58,
+	 0xFF, 0xFF, 0xFA, 0x60, 0xE7, 0x78, 0xFF, 0xFF, 0x60, 0xFE, 0x5D, 0xD2, 0xFF, 0xFF, 0x20, 0xFE,
+	 0xFF, 0xB4, 0x41, 0x94, 0x81, 0xA0, 0xFF, 0xFF, 0x02, 0x04, 0x00, 0xF4, 0x84, 0xA4, 0x60, 0x41,
+	 0x5D, 0x01, 0x1A, 0x60, 0x2C, 0xF3, 0xFF, 0xFF, 0x60, 0x40, 0x01, 0x3A, 0x6C, 0x01, 0x61, 0x5C,
+	 0x1A, 0x60, 0x2B, 0xF9, 0x60, 0xFE, 0x5D, 0xD2, 0xFF, 0xFF, 0xFE, 0xA4, 0xFF, 0xFF, 0x04, 0x20,
+	 0x02, 0x00, 0xFF, 0xA1, 0x60, 0x01, 0x5D, 0xD0, 0xFF, 0xFF, 0x64, 0x40, 0x01, 0x36, 0x02, 0x00,
+	 0xFE, 0xA1, 0x59, 0x01, 0x5D, 0xD0, 0xFF, 0xFF, 0x64, 0x40, 0x00, 0x36, 0x02, 0x00, 0xFD, 0xA1,
+	 0x52, 0x01, 0x01, 0x7C, 0x1C, 0x60, 0x08, 0xF9, 0x4C, 0x00, 0x1A, 0x60, 0x2C, 0xF3, 0xFF, 0xFF,
+	 0x01, 0x18, 0x49, 0x01, 0x00, 0x7C, 0x1C, 0x60, 0x08, 0xF9, 0x61, 0x5C, 0x1A, 0x60, 0x2B, 0xF9,
+	 0x60, 0xFE, 0x5D, 0xD2, 0xFF, 0xFF, 0xFA, 0xA4, 0xFF, 0xFF, 0x04, 0x20, 0x04, 0x00, 0xFF, 0xA1,
+	 0xF9, 0x60, 0x6B, 0x78, 0xFF, 0xFF, 0x5D, 0xD0, 0xFF, 0xFF, 0x64, 0x40, 0x00, 0x36, 0x04, 0x00,
+	 0xC9, 0x81, 0xF9, 0x60, 0x6B, 0x78, 0xFF, 0xFF, 0x5D, 0xD0, 0xFF, 0xFF, 0x64, 0x40, 0x50, 0x36,
+	 0x04, 0x00, 0xFD, 0xA1, 0xF9, 0x60, 0x6B, 0x78, 0xFF, 0xFF, 0x5D, 0xD0, 0xFF, 0xFF, 0x64, 0x40,
+	 0xF2, 0x36, 0x04, 0x00, 0xFC, 0xA1, 0xF9, 0x60, 0x6B, 0x78, 0xFF, 0xFF, 0x5D, 0xD0, 0xFF, 0xFF,
+	 0x64, 0x40, 0x01, 0x36, 0x04, 0x00, 0xFB, 0xA1, 0xF9, 0x60, 0x6B, 0x78, 0xFF, 0xFF, 0x5D, 0xD0,
+	 0xFF, 0xFF, 0x64, 0x40, 0x01, 0x36, 0x04, 0x00, 0xFA, 0xA1, 0xF9, 0x60, 0x6B, 0x78, 0xFF, 0xFF,
+	 0x5D, 0xD0, 0xFF, 0xFF, 0x64, 0x40, 0x00, 0x36, 0x04, 0x00, 0xF9, 0xA1, 0xF9, 0x60, 0x6B, 0x78,
+	 0xFF, 0xFF, 0x60, 0x5C, 0x00, 0x36, 0x32, 0x00, 0x00, 0x64, 0xFB, 0x60, 0x58, 0x4E, 0x66, 0x78,
+	 0xFF, 0xFF, 0x65, 0x40, 0x08, 0x26, 0xF7, 0x01, 0x1A, 0x60, 0x24, 0xFB, 0x64, 0x40, 0x00, 0x36,
+	 0x2A, 0x00, 0x5D, 0xD2, 0xDD, 0x81, 0xFB, 0x60, 0x58, 0x4E, 0x66, 0x78, 0xFF, 0xFF, 0x65, 0x40,
+	 0x08, 0x26, 0xF6, 0x01, 0x1A, 0x60, 0x25, 0xFB, 0x64, 0x40, 0x00, 0x36, 0x21, 0x00, 0x5D, 0xD2,
+	 0xDD, 0x81, 0xFB, 0x60, 0x58, 0x4E, 0x66, 0x78, 0xFF, 0xFF, 0x65, 0x40, 0x08, 0x26, 0xF6, 0x01,
+	 0x1A, 0x60, 0x26, 0xFB, 0x64, 0x40, 0x00, 0x36, 0x18, 0x00, 0x5D, 0xD0, 0x34, 0x60, 0x4E, 0x62,
+	 0xA2, 0xD9, 0x5D, 0xD0, 0x34, 0x60, 0x4F, 0x62, 0xA2, 0xD9, 0x14, 0x00, 0x20, 0xFE, 0x00, 0x60,
+	 0x04, 0x64, 0x1A, 0x60, 0x24, 0xFB, 0x20, 0xFE, 0x00, 0x60, 0x04, 0x64, 0x1A, 0x60, 0x25, 0xFB,
+	 0x20, 0xFE, 0x00, 0x60, 0x02, 0x64, 0x1A, 0x60, 0x26, 0xFB, 0x20, 0xFE, 0x00, 0x60, 0x00, 0x64,
+	 0x1A, 0x60, 0x27, 0xFB, 0x20, 0xFE, 0x1C, 0x60, 0x08, 0xF1, 0xFF, 0xFF, 0x03, 0x18, 0x01, 0x7C,
+	 0x1C, 0x60, 0x08, 0xF9, 0x1A, 0x60, 0x2B, 0xF1, 0xA2, 0xDD, 0x61, 0x44, 0x1A, 0x60, 0x28, 0xFB,
+	 0xD1, 0x84, 0xDC, 0x84, 0x64, 0x45, 0x34, 0x60, 0x10, 0x63, 0xBD, 0xDB, 0x60, 0x41, 0xCD, 0x84,
+	 0x4C, 0x91, 0x60, 0x43, 0x60, 0xFE, 0xA5, 0xD2, 0xDE, 0x85, 0x7F, 0x26, 0x02, 0x00, 0x00, 0xF4,
+	 0x04, 0x65, 0x5D, 0x93, 0xA3, 0xDB, 0x5D, 0x93, 0xA5, 0xD2, 0xF6, 0x1F, 0x5D, 0x93, 0x20, 0xFE,
+	 0xDF, 0x83, 0x1A, 0x60, 0x09, 0xF3, 0xFF, 0xFF, 0x60, 0x47, 0xA2, 0xDB, 0x1A, 0x60, 0x28, 0xF3,
+	 0x1A, 0x60, 0x2B, 0xF1, 0x60, 0x41, 0x64, 0x43, 0xF9, 0x60, 0x56, 0x78, 0xFF, 0xFF, 0x20, 0xFE,
+	 0x7C, 0x44, 0x1A, 0x60, 0x20, 0xFB, 0x1A, 0x60, 0x1A, 0xF1, 0x1A, 0x60, 0x24, 0xF3, 0xFF, 0xFF,
+	 0xA0, 0x84, 0xFF, 0xFF, 0x10, 0x26, 0x07, 0x00, 0x04, 0x26, 0x07, 0x00, 0x20, 0x26, 0x07, 0x00,
+	 0x02, 0x26, 0x07, 0x00, 0x3F, 0x00, 0x10, 0x7C, 0x05, 0x00, 0x04, 0x7C, 0x03, 0x00, 0x20, 0x7C,
+	 0x01, 0x00, 0x02, 0x7C, 0x1A, 0x60, 0x20, 0xF9, 0x7C, 0x44, 0x1A, 0x60, 0x21, 0xFB, 0x1A, 0x60,
+	 0x1B, 0xF1, 0x1A, 0x60, 0x25, 0xF3, 0x34, 0x60, 0x40, 0x61, 0xA0, 0x84, 0xA1, 0xD1, 0xFF, 0xFF,
+	 0x10, 0x26, 0x05, 0x00, 0x04, 0x26, 0x05, 0x00, 0x01, 0x26, 0x08, 0x00, 0x23, 0x00, 0x10, 0x7C,
+	 0x06, 0x00, 0x64, 0x40, 0x10, 0x26, 0x1E, 0x00, 0x04, 0x7C, 0x01, 0x00, 0x01, 0x7C, 0x1A, 0x60,
+	 0x21, 0xF9, 0x7C, 0x44, 0x1A, 0x60, 0x22, 0xFB, 0x1A, 0x60, 0x1C, 0xF1, 0x1A, 0x60, 0x26, 0xF3,
+	 0xFF, 0xFF, 0xA0, 0x84, 0x60, 0x40, 0x02, 0x26, 0x05, 0x00, 0x04, 0x26, 0x05, 0x00, 0x01, 0x26,
+	 0x05, 0x00, 0x08, 0x00, 0x02, 0x7C, 0x03, 0x00, 0x04, 0x7C, 0x01, 0x00, 0x20, 0x7C, 0x1A, 0x60,
+	 0x22, 0xF9, 0x09, 0x00, 0x7C, 0x44, 0x1A, 0x60, 0x20, 0xFB, 0x1A, 0x60, 0x21, 0xFB, 0x1A, 0x60,
+	 0x22, 0xFB, 0x1A, 0x60, 0x23, 0xFB, 0x7C, 0x44, 0x1A, 0x60, 0x20, 0xF1, 0xBD, 0xD9, 0x1A, 0x60,
+	 0x21, 0xF1, 0xB0, 0x84, 0xBD, 0xD9, 0x1A, 0x60, 0x22, 0xF1, 0xB0, 0x84, 0xBD, 0xD9, 0x1A, 0x60,
+	 0x1D, 0xF1, 0xB0, 0x84, 0xBD, 0xD9, 0x04, 0x03, 0x1C, 0x60, 0x08, 0xF1, 0xBD, 0xD9, 0x72, 0x00,
+	 0x16, 0x60, 0xC2, 0xF3, 0xFF, 0xFF, 0xFF, 0xA0, 0xFF, 0xFF, 0x0C, 0x24, 0x6B, 0x00, 0x60, 0x40,
+	 0x0B, 0x36, 0x68, 0x00, 0x20, 0x40, 0x10, 0x27, 0x65, 0x00, 0x91, 0x00, 0x20, 0xFE, 0x00, 0x65,
+	 0x60, 0xFE, 0x1A, 0x60, 0x28, 0xFB, 0xE0, 0x84, 0xE0, 0x84, 0x08, 0x20, 0x03, 0x00, 0x01, 0x64,
+	 0xA2, 0xDB, 0x02, 0x64, 0x02, 0xA5, 0x64, 0x44, 0xD4, 0x9C, 0xD4, 0x80, 0x34, 0x60, 0x52, 0x62,
+	 0x02, 0x05, 0x08, 0x65, 0x4D, 0x00, 0xA2, 0xD9, 0x7C, 0x44, 0x34, 0x60, 0x54, 0x62, 0xA2, 0xDB,
+	 0x20, 0xFE, 0x00, 0x64, 0x60, 0xFE, 0x1C, 0x60, 0x08, 0xF3, 0xFF, 0xFF, 0x00, 0xA0, 0x5D, 0xD0,
+	 0x00, 0x65, 0x04, 0x03, 0x64, 0x40, 0x00, 0x3A, 0x01, 0x65, 0x03, 0x00, 0x64, 0x40, 0x00, 0x3A,
+	 0x01, 0x65, 0x5D, 0xD0, 0x04, 0x03, 0x64, 0x40, 0x0F, 0x3A, 0x01, 0x65, 0x03, 0x00, 0x64, 0x40,
+	 0x50, 0x3A, 0x01, 0x65, 0x5D, 0xD0, 0x04, 0x03, 0x64, 0x40, 0xAC, 0x3A, 0x01, 0x65, 0x03, 0x00,
+	 0x64, 0x40, 0xF2, 0x3A, 0x01, 0x65, 0x5D, 0xD0, 0x65, 0x40, 0x00, 0x3A, 0x17, 0x00, 0x00, 0x60,
+	 0x00, 0x65, 0x64, 0x40, 0x00, 0x36, 0x01, 0x65, 0x64, 0x40, 0x01, 0x36, 0x02, 0x65, 0x64, 0x40,
+	 0x02, 0x36, 0x04, 0x65, 0x64, 0x40, 0x04, 0x36, 0x10, 0x65, 0x64, 0x40, 0x05, 0x36, 0x20, 0x65,
+	 0x65, 0x5C, 0x1A, 0x60, 0x2A, 0xF3, 0xFF, 0xFF, 0xB0, 0x84, 0xA2, 0xDB, 0x1A, 0x60, 0x28, 0xF3,
+	 0x00, 0x65, 0xFF, 0xA4, 0xA2, 0xDB, 0xBC, 0x02, 0x1A, 0x60, 0x2A, 0xF3, 0x1A, 0x60, 0x29, 0xF1,
+	 0x2E, 0x58, 0xFF, 0xFF, 0x20, 0xFE, 0x88, 0xF3, 0xFF, 0xFF, 0x3C, 0xA4, 0x88, 0xFB, 0x87, 0xF3,
+	 0x7D, 0xF1, 0x04, 0xA4, 0x87, 0xFB, 0x53, 0xF3, 0xFF, 0xFF, 0x60, 0x40, 0x80, 0x26, 0x0D, 0x00,
+	 0x7D, 0xF3, 0x10, 0x60, 0xF2, 0x61, 0xCC, 0x84, 0xFF, 0xFF, 0x02, 0x03, 0x06, 0xA1, 0xFB, 0x01,
+	 0xA1, 0xD3, 0xFF, 0xFF, 0x02, 0xBC, 0xA1, 0xDB, 0x12, 0x00, 0x7D, 0xF3, 0x11, 0x60, 0x60, 0x63,
+	 0x01, 0x60, 0xFF, 0x65, 0xA4, 0x84, 0x12, 0x60, 0x40, 0x65, 0xA3, 0xD1, 0xD7, 0x80, 0xD0, 0x80,
+	 0x06, 0x03, 0x02, 0x03, 0x08, 0xA3, 0xF9, 0x01, 0x02, 0xA3, 0x04, 0x64, 0xA3, 0xDB, 0x20, 0xFE,
+	 0x26, 0x46, 0x31, 0x40, 0x20, 0x2A, 0x35, 0x00, 0x3F, 0xF2, 0x47, 0x65, 0xC4, 0x84, 0xE8, 0x84,
+	 0x23, 0xFA, 0xF1, 0x60, 0x02, 0x64, 0x24, 0xFA, 0x7D, 0xF3, 0x01, 0x60, 0xFF, 0x65, 0xA4, 0x84,
+	 0x01, 0x23, 0x14, 0x00, 0x11, 0x60, 0x60, 0x61, 0x12, 0x60, 0x40, 0x65, 0xA1, 0xD1, 0xD5, 0x80,
+	 0xD0, 0x80, 0x0B, 0x03, 0x02, 0x03, 0x08, 0xA1, 0xF9, 0x01, 0x04, 0xA1, 0xA1, 0xD3, 0x01, 0x60,
+	 0x00, 0x65, 0x60, 0x47, 0xFF, 0xB4, 0xB4, 0x84, 0x01, 0x00, 0x01, 0x64, 0x00, 0xF4, 0x08, 0xFA,
+	 0xFF, 0xFF, 0x26, 0x46, 0x26, 0x60, 0x0A, 0x64, 0x13, 0x60, 0x0D, 0xFB, 0x26, 0x44, 0x5A, 0xDB,
+	 0x02, 0x64, 0x5A, 0xDB, 0xFF, 0xFF, 0x2B, 0xFF, 0xFA, 0xFE, 0x00, 0x66, 0x46, 0x46, 0x2F, 0x58,
+	 0xFF, 0xFF, 0x26, 0x46, 0x2F, 0x58, 0xFF, 0xFF, 0x78, 0xFB, 0xAC, 0x85, 0x60, 0x41, 0x55, 0x03,
+	 0x32, 0x60, 0x00, 0x63, 0x1B, 0x60, 0x04, 0xFD, 0x62, 0x43, 0x1A, 0x60, 0xB4, 0xFD, 0x1A, 0x60,
+	 0xBA, 0xFD, 0x1A, 0x60, 0xC4, 0xFD, 0x1A, 0x60, 0xCE, 0xFD, 0x00, 0x63, 0xE9, 0x81, 0x08, 0x64,
+	 0x02, 0x24, 0xDF, 0x83, 0xFB, 0x02, 0x53, 0x94, 0x32, 0x7F, 0x03, 0x06, 0x1B, 0x60, 0x04, 0xFB,
+	 0x08, 0x63, 0x63, 0x5E, 0x01, 0x7F, 0x19, 0x60, 0x8A, 0xFB, 0x65, 0x41, 0x33, 0x60, 0x16, 0x65,
+	 0x0F, 0x60, 0xF4, 0x64, 0xE9, 0x81, 0x58, 0xD1, 0xFD, 0x04, 0xCF, 0x83, 0xA5, 0xD9, 0x0C, 0x03,
+	 0xE9, 0x81, 0x58, 0xD1, 0xFD, 0x04, 0x40, 0x48, 0xA5, 0xD1, 0x64, 0x5F, 0x64, 0x5E, 0xA5, 0xDB,
+	 0xDA, 0x85, 0xCF, 0x83, 0x28, 0x44, 0xEE, 0x02, 0x00, 0xB9, 0xD8, 0x83, 0x15, 0x03, 0x36, 0x60,
+	 0x0A, 0x65, 0xE9, 0x81, 0xBD, 0xD1, 0x02, 0x05, 0xFC, 0x02, 0x17, 0x00, 0xA5, 0xD9, 0x15, 0x03,
+	 0xE9, 0x81, 0xBD, 0xD1, 0x02, 0x05, 0xFC, 0x02, 0x10, 0x00, 0xA5, 0xD3, 0xFF, 0xFF, 0x64, 0x5F,
+	 0xA5, 0xDB, 0xDA, 0x85, 0xEE, 0x02, 0x09, 0x00, 0x67, 0x43, 0x1A, 0x60, 0xB4, 0xFD, 0x1A, 0x60,
+	 0xBA, 0xFD, 0x1A, 0x60, 0xC4, 0xFD, 0x1A, 0x60, 0xCE, 0xFD, 0x2E, 0x45, 0x25, 0x60, 0x46, 0x64,
+	 0xD4, 0x80, 0xFF, 0xFF, 0x10, 0x03, 0x20, 0x40, 0x10, 0x27, 0x0D, 0x00, 0x33, 0x60, 0x1E, 0x61,
+	 0x19, 0x60, 0x8A, 0xF3, 0xA1, 0xDB, 0xFF, 0xB4, 0xCC, 0x84, 0xA8, 0x83, 0x33, 0x60, 0x14, 0x64,
+	 0x58, 0xD1, 0x59, 0xD9, 0xFD, 0x1F, 0x7D, 0xF3, 0x33, 0x60, 0x20, 0x63, 0x60, 0x40, 0x01, 0x27,
+	 0x03, 0x00, 0x19, 0x60, 0x3B, 0xF3, 0x02, 0x00, 0x19, 0x60, 0x3C, 0xF3, 0x08, 0x61, 0x60, 0xFE,
+	 0xA3, 0xD1, 0xFF, 0xFF, 0x20, 0xFE, 0x00, 0xA8, 0xE8, 0x84, 0x0F, 0x03, 0x60, 0xFE, 0x02, 0x28,
+	 0xF6, 0x01, 0x80, 0x62, 0xB2, 0x9C, 0xBD, 0xD9, 0x7B, 0xF9, 0xCD, 0x81, 0x00, 0x36, 0x01, 0x00,
+	 0xEE, 0x01, 0x36, 0x60, 0x0A, 0x63, 0x08, 0x61, 0xEA, 0x01, 0x2E, 0x58, 0xFF, 0xFF, 0x32, 0x60,
+	 0x76, 0x63, 0x65, 0x40, 0xFF, 0x36, 0x02, 0xA3, 0xA3, 0xD3, 0xFF, 0xFF, 0xE8, 0x84, 0xE8, 0x84,
+	 0xE8, 0x84, 0xE8, 0x84, 0x40, 0x26, 0x7F, 0xB4, 0x20, 0x26, 0x3F, 0xB4, 0x60, 0x45, 0x80, 0x63,
+	 0xFD, 0x60, 0x58, 0x4D, 0x34, 0x78, 0xFF, 0xFF, 0x19, 0x60, 0x7D, 0xFB, 0x40, 0x63, 0xFD, 0x60,
+	 0x58, 0x4D, 0x34, 0x78, 0xFF, 0xFF, 0x19, 0x60, 0x7E, 0xFB, 0x20, 0x63, 0xFD, 0x60, 0x58, 0x4D,
+	 0x34, 0x78, 0xFF, 0xFF, 0x19, 0x60, 0x7F, 0xFB, 0x10, 0x63, 0xFD, 0x60, 0x58, 0x4D, 0x34, 0x78,
+	 0xFF, 0xFF, 0x19, 0x60, 0x80, 0xFB, 0x08, 0x63, 0xFD, 0x60, 0x58, 0x4D, 0x34, 0x78, 0xFF, 0xFF,
+	 0x19, 0x60, 0x81, 0xFB, 0x04, 0x63, 0xFD, 0x60, 0x58, 0x4D, 0x34, 0x78, 0xFF, 0xFF, 0x19, 0x60,
+	 0x82, 0xFB, 0x02, 0x63, 0xFD, 0x60, 0x58, 0x4D, 0x34, 0x78, 0xFF, 0xFF, 0x19, 0x60, 0x83, 0xFB,
+	 0x01, 0x63, 0xFD, 0x60, 0x58, 0x4D, 0x34, 0x78, 0xFF, 0xFF, 0x19, 0x60, 0x84, 0xFB, 0x2E, 0x58,
+	 0xFF, 0xFF, 0x19, 0x60, 0x3B, 0xF3, 0xFF, 0xFF, 0x0F, 0xB4, 0x60, 0x45, 0x08, 0x63, 0xFD, 0x60,
+	 0x58, 0x4D, 0x5F, 0x78, 0xFF, 0xFF, 0x19, 0x60, 0x85, 0xFB, 0x04, 0x63, 0xFD, 0x60, 0x58, 0x4D,
+	 0x5F, 0x78, 0xFF, 0xFF, 0x19, 0x60, 0x86, 0xFB, 0x02, 0x63, 0xFD, 0x60, 0x58, 0x4D, 0x5F, 0x78,
+	 0xFF, 0xFF, 0x19, 0x60, 0x87, 0xFB, 0x01, 0x63, 0xFD, 0x60, 0x58, 0x4D, 0x5F, 0x78, 0xFF, 0xFF,
+	 0x19, 0x60, 0x88, 0xFB, 0x2E, 0x58, 0xFF, 0xFF, 0x63, 0x5C, 0xA7, 0x84, 0xEB, 0x83, 0x14, 0x02,
+	 0x01, 0x03, 0xFB, 0x01, 0x64, 0x44, 0x01, 0x36, 0x0B, 0x64, 0x02, 0x36, 0x0B, 0x64, 0x04, 0x36,
+	 0x0A, 0x64, 0x08, 0x36, 0x0A, 0x64, 0x10, 0x36, 0x09, 0x64, 0x20, 0x36, 0x09, 0x64, 0x40, 0x36,
+	 0x09, 0x64, 0x80, 0x36, 0x09, 0x64, 0x11, 0x00, 0x60, 0x40, 0x01, 0x36, 0x0B, 0x64, 0x02, 0x36,
+	 0x0F, 0x64, 0x04, 0x36, 0x0A, 0x64, 0x08, 0x36, 0x0E, 0x64, 0x10, 0x36, 0x09, 0x64, 0x20, 0x36,
+	 0x0D, 0x64, 0x40, 0x36, 0x08, 0x64, 0x80, 0x36, 0x0C, 0x64, 0x2D, 0x58, 0xFF, 0xFF, 0x63, 0x5C,
+	 0xA7, 0x84, 0xEB, 0x83, 0x0C, 0x02, 0x01, 0x03, 0xFB, 0x01, 0x64, 0x44, 0x01, 0x36, 0x0A, 0x64,
+	 0x02, 0x36, 0x14, 0x64, 0x04, 0x36, 0x37, 0x64, 0x08, 0x36, 0x6E, 0x64, 0x09, 0x00, 0x60, 0x40,
+	 0x01, 0x36, 0x0A, 0x64, 0x02, 0x36, 0x14, 0x64, 0x04, 0x36, 0x37, 0x64, 0x08, 0x36, 0x6E, 0x64,
+	 0x2D, 0x58, 0xFF, 0xFF, 0x60, 0xFE, 0x81, 0xA1, 0x7F, 0xA1, 0x02, 0x06, 0x00, 0xF4, 0x03, 0x61,
+	 0x5D, 0xD2, 0xCF, 0x83, 0xD4, 0x80, 0x25, 0x03, 0x16, 0x03, 0xCF, 0x83, 0x61, 0x44, 0x80, 0xA0,
+	 0x20, 0x03, 0x02, 0x02, 0x00, 0xF4, 0x03, 0x61, 0x5D, 0xD2, 0xCF, 0x83, 0x81, 0xA1, 0x19, 0x03,
+	 0x05, 0x07, 0x7F, 0xA1, 0xCC, 0x84, 0xDD, 0x81, 0xE6, 0x03, 0xF7, 0x01, 0x00, 0xF4, 0x00, 0xB8,
+	 0x04, 0x61, 0xE6, 0x03, 0xF2, 0x01, 0x2C, 0x43, 0x5D, 0xD0, 0xDE, 0xD9, 0x64, 0x44, 0x5D, 0xD0,
+	 0xDE, 0xD9, 0xCC, 0x84, 0x81, 0xA1, 0x05, 0x03, 0x7F, 0xA1, 0xF9, 0x04, 0x00, 0xF4, 0x03, 0x61,
+	 0xF6, 0x01, 0x20, 0xFE, 0x2E, 0x58, 0xFF, 0xFF, 0x01, 0x3A, 0x02, 0x00, 0x16, 0x64, 0x2B, 0x00,
+	 0x02, 0x3A, 0x02, 0x00, 0x14, 0x64, 0x27, 0x00, 0x04, 0x3A, 0x02, 0x00, 0x12, 0x64, 0x23, 0x00,
+	 0x08, 0x3A, 0x02, 0x00, 0x10, 0x64, 0x1F, 0x00, 0x10, 0x3A, 0x02, 0x00, 0x0E, 0x64, 0x1B, 0x00,
+	 0x20, 0x3A, 0x02, 0x00, 0x0C, 0x64, 0x17, 0x00, 0x40, 0x3A, 0x02, 0x00, 0x0A, 0x64, 0x13, 0x00,
+	 0x80, 0x3A, 0x02, 0x00, 0x08, 0x64, 0x0F, 0x00, 0x01, 0x3B, 0x02, 0x00, 0x06, 0x64, 0x0B, 0x00,
+	 0x02, 0x3B, 0x02, 0x00, 0x04, 0x64, 0x07, 0x00, 0x04, 0x3B, 0x02, 0x00, 0x02, 0x64, 0x03, 0x00,
+	 0x08, 0x3B, 0xFF, 0x01, 0x00, 0x64, 0x2E, 0x58, 0xFF, 0xFF, 0x27, 0xF2, 0xFF, 0xFF, 0x60, 0x40,
+	 0x36, 0x3A, 0x02, 0x00, 0x00, 0x61, 0x30, 0x00, 0x30, 0x3A, 0x02, 0x00, 0x02, 0x61, 0x2C, 0x00,
+	 0x24, 0x3A, 0x02, 0x00, 0x04, 0x61, 0x28, 0x00, 0x18, 0x3A, 0x02, 0x00, 0x06, 0x61, 0x24, 0x00,
+	 0x12, 0x3A, 0x02, 0x00, 0x08, 0x61, 0x20, 0x00, 0x0C, 0x3A, 0x02, 0x00, 0x0A, 0x61, 0x1C, 0x00,
+	 0x09, 0x3A, 0x02, 0x00, 0x0C, 0x61, 0x18, 0x00, 0x06, 0x3A, 0x02, 0x00, 0x0E, 0x61, 0x14, 0x00,
+	 0x6E, 0x3A, 0x02, 0x00, 0x10, 0x61, 0x10, 0x00, 0x37, 0x3A, 0x02, 0x00, 0x12, 0x61, 0x0C, 0x00,
+	 0x14, 0x3A, 0x02, 0x00, 0x14, 0x61, 0x08, 0x00, 0x0A, 0x3A, 0x02, 0x00, 0x16, 0x61, 0x04, 0x00,
+	 0x78, 0x43, 0x03, 0x61, 0x29, 0x60, 0xEA, 0x78, 0x65, 0x40, 0x01, 0x3A, 0x13, 0x00, 0x66, 0x45,
+	 0x2B, 0x46, 0x92, 0xFA, 0x65, 0x46, 0x26, 0xF2, 0xFF, 0xFF, 0x60, 0x41, 0x00, 0x7F, 0x60, 0x45,
+	 0x61, 0x47, 0x00, 0x7F, 0xD4, 0x84, 0x66, 0x41, 0x2B, 0x46, 0x0E, 0xF2, 0x60, 0x45, 0x65, 0x5E,
+	 0x0E, 0xFA, 0x61, 0x46, 0x2E, 0x58, 0xFF, 0xFF, 0xCD, 0x81, 0x7F, 0xB4, 0x02, 0x3A, 0x02, 0x00,
+	 0x01, 0x64, 0x32, 0x00, 0x04, 0x3A, 0x02, 0x00, 0x02, 0x64, 0x2E, 0x00, 0x0B, 0x3A, 0x02, 0x00,
+	 0x04, 0x64, 0x2A, 0x00, 0x16, 0x3A, 0x02, 0x00, 0x08, 0x64, 0x26, 0x00, 0x0C, 0x3A, 0x02, 0x00,
+	 0x10, 0x64, 0x22, 0x00, 0x12, 0x3A, 0x02, 0x00, 0x20, 0x64, 0x1E, 0x00, 0x18, 0x3A, 0x02, 0x00,
+	 0x40, 0x64, 0x1A, 0x00, 0x24, 0x3A, 0x02, 0x00, 0x80, 0x64, 0x16, 0x00, 0x30, 0x3A, 0x03, 0x00,
+	 0x00, 0x7E, 0x01, 0x7F, 0x11, 0x00, 0x48, 0x3A, 0x03, 0x00, 0x00, 0x7E, 0x02, 0x7F, 0x0C, 0x00,
+	 0x60, 0x3A, 0x03, 0x00, 0x00, 0x7E, 0x04, 0x7F, 0x07, 0x00, 0x6C, 0x3A, 0x03, 0x00, 0x00, 0x7E,
+	 0x08, 0x7F, 0x02, 0x00, 0x00, 0x64, 0x00, 0x00, 0x20, 0xFE, 0x2A, 0x45, 0x34, 0x8A, 0x60, 0xFE,
+	 0x61, 0x40, 0x00, 0x36, 0x02, 0x00, 0xBD, 0xD3, 0xBF, 0x01, 0x2E, 0x58, 0xFF, 0xFF,
+
+};  /* fw_image_4_data */
+
+static const CFG_IDENTITY_STRCT fw_image_infoidentity[] = {
+	{
+		sizeof( CFG_IDENTITY_STRCT ) / sizeof(hcf_16) - 1,
+		CFG_FW_IDENTITY,
+		COMP_ID_FW_STA,
+		4,							//Variant
+		1,							//Major
+		36							//Minor
+	},
+	{ 0000, 0000, 0000, 0000, 0000, 0000 }		//endsentinel
+};
+
+static const CFG_PROG_STRCT fw_image_code[] = {
+	{
+		8,
+		CFG_PROG,
+		CFG_PROG_VOLATILE,			// mode
+		0x0184,		// sizeof(fw_image_1_data),
+		0x00000060,					// Target address in NIC Memory
+		0x0000,						// CRC: yes/no	TYPE: primary/station/tertiary
+		(hcf_8 FAR   *) fw_image_1_data
+	},
+	{
+		8,
+		CFG_PROG,
+		CFG_PROG_VOLATILE,			// mode
+		0x2c0e,		// sizeof(fw_image_2_data),
+		0x00000C16,					// Target address in NIC Memory
+		0x0000,						// CRC: yes/no	TYPE: primary/station/tertiary
+		(hcf_8 FAR   *) fw_image_2_data
+	},
+	{
+		8,
+		CFG_PROG,
+		CFG_PROG_VOLATILE,			// mode
+		0x54de,		// sizeof(fw_image_3_data),
+		0x001E3824,					// Target address in NIC Memory
+		0x0000,						// CRC: yes/no	TYPE: primary/station/tertiary
+		(hcf_8 FAR   *) fw_image_3_data
+	},
+	{
+		8,
+		CFG_PROG,
+		CFG_PROG_VOLATILE,			// mode
+		0xbcde,		// sizeof(fw_image_4_data),
+		0x001F4000,					// Target address in NIC Memory
+		0x0000,						// CRC: yes/no	TYPE: primary/station/tertiary
+		(hcf_8 FAR   *) fw_image_4_data
+	},
+	{
+		5,
+		CFG_PROG,
+		CFG_PROG_STOP,				// mode
+		0000,
+ 	0x000F429B,					// Start execution address
+	},
+	{ 0000, 0000, 0000, 0000, 00000000, 0000, 00000000}
+};
+
+static const CFG_RANGE20_STRCT fw_image_infocompat[] = {
+	{	3 + ((20 * sizeof(CFG_RANGE_SPEC_STRCT)) / sizeof(hcf_16)),
+		CFG_FW_SUP_RANGE,
+		COMP_ROLE_SUPL,
+		COMP_ID_STA,
+		{
+			{ 4, 1, 2 }  				//variant, bottom, top
+		}
+	},
+	{	3 + ((20 * sizeof(CFG_RANGE_SPEC_STRCT)) / sizeof(hcf_16)),
+		CFG_MFI_ACT_RANGES_STA,
+		COMP_ROLE_ACT,
+		COMP_ID_MFI,
+		{
+			{ 7, 3, 3 }, 				//variant, bottom, top
+			{ 8, 1, 1 }  				//variant, bottom, top
+		}
+	},
+	{	3 + ((20 * sizeof(CFG_RANGE_SPEC_STRCT)) / sizeof(hcf_16)),
+		CFG_CFI_ACT_RANGES_STA,
+		COMP_ROLE_ACT,
+		COMP_ID_CFI,
+		{
+			{ 4, 1, 2 }  				//variant, bottom, top
+		}
+	},
+	{ 0000, 0000, 0000, 0000, { { 0000, 0000, 0000 } } }	//endsentinel
+};
+
+memimage fw_image = {
+	"FUPU7D37dhfwci\001C",			//signature, <format number>, C/Bin type
+	(CFG_PROG_STRCT *) fw_image_code,
+	0x000F429B,
+	00000000,					//(dummy) pdaplug
+	00000000,					//(dummy) priplug
+	(CFG_RANGE20_STRCT *) fw_image_infocompat,
+	(CFG_IDENTITY_STRCT *) fw_image_infoidentity,
+};
+
diff --git a/drivers/staging/wlags49_h2/wl_cs.c b/drivers/staging/wlags49_h2/wl_cs.c
new file mode 100644
index 000000000000..811a8daa660e
--- /dev/null
+++ b/drivers/staging/wlags49_h2/wl_cs.c
@@ -0,0 +1,702 @@
+/*******************************************************************************
+ * Agere Systems Inc.
+ * Wireless device driver for Linux (wlags49).
+ *
+ * Copyright (c) 1998-2003 Agere Systems Inc.
+ * All rights reserved.
+ *   http://www.agere.com
+ *
+ * Initially developed by TriplePoint, Inc.
+ *   http://www.triplepoint.com
+ *
+ *------------------------------------------------------------------------------
+ *
+ *   This file contains processing and initialization specific to Card Services
+ *   devices (PCMCIA, CF).
+ *
+ *------------------------------------------------------------------------------
+ *
+ * SOFTWARE LICENSE
+ *
+ * This software is provided subject to the following terms and conditions,
+ * which you should read carefully before using the software.  Using this
+ * software indicates your acceptance of these terms and conditions.  If you do
+ * not agree with these terms and conditions, do not use the software.
+ *
+ * Copyright © 2003 Agere Systems Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source or binary forms, with or without
+ * modifications, are permitted provided that the following conditions are met:
+ *
+ * . Redistributions of source code must retain the above copyright notice, this
+ *    list of conditions and the following Disclaimer as comments in the code as
+ *    well as in the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * . Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following Disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ *
+ * . Neither the name of Agere Systems Inc. nor the names of the contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * Disclaimer
+ *
+ * THIS SOFTWARE IS PROVIDED “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, INFRINGEMENT AND THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  ANY
+ * USE, MODIFICATION OR DISTRIBUTION OF THIS SOFTWARE IS SOLELY AT THE USERS OWN
+ * RISK. IN NO EVENT SHALL AGERE SYSTEMS INC. OR CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, INCLUDING, BUT NOT LIMITED TO, CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ *
+ ******************************************************************************/
+
+/*******************************************************************************
+ *  include files
+ ******************************************************************************/
+#include <wl_version.h>
+
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/ptrace.h>
+#include <linux/slab.h>
+#include <linux/ctype.h>
+#include <linux/string.h>
+#include <linux/timer.h>
+#include <linux/interrupt.h>
+#include <linux/in.h>
+#include <linux/delay.h>
+#include <asm/io.h>
+#include <asm/system.h>
+#include <asm/bitops.h>
+
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/skbuff.h>
+#include <linux/if_arp.h>
+#include <linux/ioport.h>
+
+#include <pcmcia/cs_types.h>
+#include <pcmcia/cs.h>
+#include <pcmcia/cistpl.h>
+#include <pcmcia/cisreg.h>
+#include <pcmcia/ciscode.h>
+#include <pcmcia/ds.h>
+#include <debug.h>
+
+#include <hcf.h>
+#include <dhf.h>
+#include <hcfdef.h>
+
+#include <wl_if.h>
+#include <wl_internal.h>
+#include <wl_util.h>
+#include <wl_main.h>
+#include <wl_netdev.h>
+#include <wl_cs.h>
+#include <wl_sysfs.h>
+
+
+/*******************************************************************************
+ *  macro definitions
+ ******************************************************************************/
+#define CS_CHECK(fn, ret) do { \
+                    last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; \
+            } while (0)
+
+/*******************************************************************************
+ *  global definitions
+ ******************************************************************************/
+#if DBG
+extern dbg_info_t *DbgInfo;
+#endif  /* DBG */
+
+
+/*******************************************************************************
+ *	wl_adapter_attach()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Creates an instance of the driver, allocating local data structures for
+ *  one device. The device is registered with Card Services.
+ *
+ *  PARAMETERS:
+ *
+ *      none
+ *
+ *  RETURNS:
+ *
+ *      pointer to an allocated dev_link_t structure
+ *      NULL on failure
+ *
+ ******************************************************************************/
+static int wl_adapter_attach(struct pcmcia_device *link)
+{
+    struct net_device   *dev;
+    struct wl_private	*lp;
+    /*------------------------------------------------------------------------*/
+
+    DBG_FUNC( "wl_adapter_attach" );
+    DBG_ENTER( DbgInfo );
+
+    dev = wl_device_alloc();
+    if(dev == NULL) {
+        DBG_ERROR( DbgInfo, "wl_device_alloc returned NULL\n");
+	return -ENOMEM;
+    }
+
+    link->io.NumPorts1      = HCF_NUM_IO_PORTS;
+    link->io.Attributes1    = IO_DATA_PATH_WIDTH_16;
+    link->io.IOAddrLines    = 6;
+    link->irq.Attributes    = IRQ_TYPE_DYNAMIC_SHARING | IRQ_HANDLE_PRESENT;
+    link->irq.IRQInfo1      = IRQ_INFO2_VALID | IRQ_LEVEL_ID;
+    link->irq.Handler       = &wl_isr;
+    link->conf.Attributes   = CONF_ENABLE_IRQ;
+    link->conf.IntType      = INT_MEMORY_AND_IO;
+    link->conf.ConfigIndex  = 5;
+    link->conf.Present      = PRESENT_OPTION;
+
+    link->priv = link->irq.Instance = dev;
+    lp = wl_priv(dev);
+    lp->link = link;
+
+    wl_adapter_insert(link);
+
+    DBG_LEAVE( DbgInfo );
+    return 0;
+} // wl_adapter_attach
+/*============================================================================*/
+
+
+
+/*******************************************************************************
+ *	wl_adapter_detach()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      This deletes a driver "instance". The device is de-registered with Card
+ *  Services. If it has been released, then the net device is unregistered, and
+ *  all local data structures are freed. Otherwise, the structures will be
+ *  freed when the device is released.
+ *
+ *  PARAMETERS:
+ *
+ *      link    - pointer to the dev_link_t structure representing the device to
+ *                detach
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+static void wl_adapter_detach(struct pcmcia_device *link)
+{
+    struct net_device   *dev = link->priv;
+    /*------------------------------------------------------------------------*/
+
+
+    DBG_FUNC( "wl_adapter_detach" );
+    DBG_ENTER( DbgInfo );
+    DBG_PARAM( DbgInfo, "link", "0x%p", link );
+
+    wl_adapter_release(link);
+
+    if (dev) {
+	unregister_wlags_sysfs(dev);
+	unregister_netdev(dev);
+    }
+
+    wl_device_dealloc(dev);
+
+    DBG_LEAVE( DbgInfo );
+} // wl_adapter_detach
+/*============================================================================*/
+
+
+/*******************************************************************************
+ *	wl_adapter_release()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      After a card is removed, this routine will release the PCMCIA
+ *  configuration. If the device is still open, this will be postponed until it
+ *  is closed.
+ *
+ *  PARAMETERS:
+ *
+ *      arg - a u_long representing a pointer to a dev_link_t structure for the
+ *            device to be released.
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+void wl_adapter_release( struct pcmcia_device *link )
+{
+    DBG_FUNC( "wl_adapter_release" );
+    DBG_ENTER( DbgInfo );
+    DBG_PARAM( DbgInfo, "link", "0x%p", link);
+
+    /* Stop hardware */
+    wl_remove(link->priv);
+
+    pcmcia_disable_device(link);
+
+    DBG_LEAVE( DbgInfo );
+} // wl_adapter_release
+/*============================================================================*/
+
+static int wl_adapter_suspend(struct pcmcia_device *link)
+{
+    struct net_device *dev = link->priv;
+
+    //if (link->open) {
+	netif_device_detach(dev);
+	wl_suspend(dev);
+//// CHECK!            pcmcia_release_configuration(link->handle);
+    //}
+
+    return 0;
+} // wl_adapter_suspend
+
+static int wl_adapter_resume(struct pcmcia_device *link)
+{
+	struct net_device *dev = link->priv;
+
+	wl_resume(dev);
+
+	netif_device_attach( dev );
+
+	return 0;
+} // wl_adapter_resume
+
+/*******************************************************************************
+ *	wl_adapter_insert()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      wl_adapter_insert() is scheduled to run after a CARD_INSERTION event is
+ *  received, to configure the PCMCIA socket, and to make the ethernet device
+ *  available to the system.
+ *
+ *  PARAMETERS:
+ *
+ *      link    - pointer to the dev_link_t structure representing the device to
+ *                insert
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+void wl_adapter_insert( struct pcmcia_device *link )
+{
+    struct net_device       *dev;
+    int i;
+    int                     last_fn, last_ret;
+    /*------------------------------------------------------------------------*/
+
+    DBG_FUNC( "wl_adapter_insert" );
+    DBG_ENTER( DbgInfo );
+    DBG_PARAM( DbgInfo, "link", "0x%p", link );
+
+    dev     = link->priv;
+
+    /* Do we need to allocate an interrupt? */
+    link->conf.Attributes |= CONF_ENABLE_IRQ;
+
+    CS_CHECK(RequestIO, pcmcia_request_io(link, &link->io));
+    CS_CHECK(RequestIRQ, pcmcia_request_irq(link, &link->irq));
+    CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link, &link->conf));
+
+
+    dev->irq        = link->irq.AssignedIRQ;
+    dev->base_addr  = link->io.BasePort1;
+
+    SET_NETDEV_DEV(dev, &handle_to_dev(link));
+    if (register_netdev(dev) != 0) {
+	printk("%s: register_netdev() failed\n", MODULE_NAME);
+	goto failed;
+    }
+    link->dev_node = &( wl_priv(dev) )->node;
+    strcpy(( wl_priv(dev) )->node.dev_name, dev->name);
+    register_wlags_sysfs(dev);
+
+    printk(KERN_INFO "%s: Wireless, io_addr %#03lx, irq %d, ""mac_address ",
+               dev->name, dev->base_addr, dev->irq);
+    for( i = 0; i < ETH_ALEN; i++ ) {
+        printk("%02X%c", dev->dev_addr[i], ((i < (ETH_ALEN-1)) ? ':' : '\n'));
+    }
+
+    DBG_LEAVE( DbgInfo );
+    return;
+
+
+cs_failed:
+    cs_error( link, last_fn, last_ret );
+
+
+failed:
+    wl_adapter_release( link );
+
+    DBG_LEAVE(DbgInfo);
+    return;
+} // wl_adapter_insert
+/*============================================================================*/
+
+
+/*******************************************************************************
+ *	wl_adapter_open()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Open the device.
+ *
+ *  PARAMETERS:
+ *
+ *      dev - a pointer to a net_device structure representing the network
+ *            device to open.
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+int wl_adapter_open( struct net_device *dev )
+{
+    struct wl_private *lp = wl_priv(dev);
+    struct pcmcia_device *link = lp->link;
+    int         result = 0;
+    int         hcf_status = HCF_SUCCESS;
+    /*------------------------------------------------------------------------*/
+
+
+    DBG_FUNC( "wl_adapter_open" );
+    DBG_ENTER( DbgInfo );
+	DBG_PRINT( "%s\n", VERSION_INFO );
+    DBG_PARAM( DbgInfo, "dev", "%s (0x%p)", dev->name, dev );
+
+    if(!pcmcia_dev_present(link))
+    {
+        DBG_LEAVE( DbgInfo );
+        return -ENODEV;
+    }
+
+    link->open++;
+
+    hcf_status = wl_open( dev );
+
+    if( hcf_status != HCF_SUCCESS ) {
+        link->open--;
+        result = -ENODEV;
+    }
+
+    DBG_LEAVE( DbgInfo );
+    return result;
+} // wl_adapter_open
+/*============================================================================*/
+
+
+/*******************************************************************************
+ *	wl_adapter_close()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Close the device.
+ *
+ *  PARAMETERS:
+ *
+ *      dev - a pointer to a net_device structure representing the network
+ *            device to close.
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+int wl_adapter_close( struct net_device *dev )
+{
+    struct wl_private *lp = wl_priv(dev);
+    struct pcmcia_device *link = lp->link;
+    /*------------------------------------------------------------------------*/
+
+
+    DBG_FUNC( "wl_adapter_close" );
+    DBG_ENTER( DbgInfo );
+    DBG_PARAM( DbgInfo, "dev", "%s (0x%p)", dev->name, dev );
+
+    if( link == NULL ) {
+        DBG_LEAVE( DbgInfo );
+        return -ENODEV;
+    }
+
+    DBG_TRACE( DbgInfo, "%s: Shutting down adapter.\n", dev->name );
+    wl_close( dev );
+
+    link->open--;
+
+    DBG_LEAVE( DbgInfo );
+    return 0;
+} // wl_adapter_close
+/*============================================================================*/
+
+static struct pcmcia_device_id wl_adapter_ids[] = {
+#if ! ((HCF_TYPE) & HCF_TYPE_HII5)
+	PCMCIA_DEVICE_MANF_CARD(0x0156, 0x0003),
+	PCMCIA_DEVICE_PROD_ID12("Agere Systems", "Wireless PC Card Model 0110",
+			    0x33103a9b, 0xe175b0dd),
+#else
+	PCMCIA_DEVICE_MANF_CARD(0x0156, 0x0004),
+	PCMCIA_DEVICE_PROD_ID12("Linksys", "WCF54G_Wireless-G_CompactFlash_Card",
+                            0x0733cc81, 0x98a599e1),
+#endif  // (HCF_TYPE) & HCF_TYPE_HII5
+	PCMCIA_DEVICE_NULL,
+	};
+MODULE_DEVICE_TABLE(pcmcia, wl_adapter_ids);
+
+static struct pcmcia_driver wlags49_driver = {
+    .owner          = THIS_MODULE,
+    .drv            = {
+	.name   = DRIVER_NAME,
+    },
+    .probe	= wl_adapter_attach,
+    .remove	= wl_adapter_detach,
+    .id_table	= wl_adapter_ids,
+    .suspend	= wl_adapter_suspend,
+    .resume	= wl_adapter_resume,
+};
+
+
+
+/*******************************************************************************
+ *	wl_adapter_init_module()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Called by init_module() to perform PCMCIA driver initialization.
+ *
+ *  PARAMETERS:
+ *
+ *      N/A
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      -1 on error
+ *
+ ******************************************************************************/
+int wl_adapter_init_module( void )
+{
+    int ret;
+    /*------------------------------------------------------------------------*/
+
+
+    DBG_FUNC( "wl_adapter_init_module" );
+    DBG_ENTER( DbgInfo );
+    DBG_TRACE( DbgInfo, "wl_adapter_init_module() -- PCMCIA\n" );
+
+    ret = pcmcia_register_driver(&wlags49_driver);
+
+    DBG_LEAVE( DbgInfo );
+    return ret;
+} // wl_adapter_init_module
+/*============================================================================*/
+
+
+/*******************************************************************************
+ *	wl_adapter_cleanup_module()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Called by cleanup_module() to perform driver uninitialization.
+ *
+ *  PARAMETERS:
+ *
+ *      N/A
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+void wl_adapter_cleanup_module( void )
+{
+    DBG_FUNC( "wl_adapter_cleanup_module" );
+    DBG_ENTER( DbgInfo );
+    DBG_TRACE( DbgInfo, "wl_adapter_cleanup_module() -- PCMCIA\n" );
+
+
+    pcmcia_unregister_driver(&wlags49_driver);
+
+    DBG_LEAVE( DbgInfo );
+    return;
+} // wl_adapter_cleanup_module
+/*============================================================================*/
+
+
+/*******************************************************************************
+ *	wl_adapter_is_open()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Check with Card Services to determine if this device is open.
+ *
+ *  PARAMETERS:
+ *
+ *      dev - a pointer to the net_device structure whose open status will be
+ *            checked
+ *
+ *  RETURNS:
+ *
+ *      nonzero if device is open
+ *      0 otherwise
+ *
+ ******************************************************************************/
+int wl_adapter_is_open( struct net_device *dev )
+{
+    struct wl_private *lp = wl_priv(dev);
+    struct pcmcia_device *link = lp->link;
+
+    if(!pcmcia_dev_present(link)) {
+        return 0;
+    }
+
+    return( link->open );
+} // wl_adapter_is_open
+/*============================================================================*/
+
+
+#if DBG
+
+/*******************************************************************************
+ *	DbgEvent()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Converts the card serivces events to text for debugging.
+ *
+ *  PARAMETERS:
+ *
+ *      mask    - a integer representing the error(s) being reported by Card
+ *                Services.
+ *
+ *  RETURNS:
+ *
+ *      a pointer to a string describing the error(s)
+ *
+ ******************************************************************************/
+const char* DbgEvent( int mask )
+{
+    static char DbgBuffer[256];
+    char *pBuf;
+    /*------------------------------------------------------------------------*/
+
+
+    pBuf    = DbgBuffer;
+    *pBuf   = '\0';
+
+
+    if( mask & CS_EVENT_WRITE_PROTECT )
+        strcat( pBuf, "WRITE_PROTECT " );
+
+    if(mask & CS_EVENT_CARD_LOCK)
+        strcat( pBuf, "CARD_LOCK " );
+
+    if(mask & CS_EVENT_CARD_INSERTION)
+        strcat( pBuf, "CARD_INSERTION " );
+
+    if(mask & CS_EVENT_CARD_REMOVAL)
+        strcat( pBuf, "CARD_REMOVAL " );
+
+    if(mask & CS_EVENT_BATTERY_DEAD)
+        strcat( pBuf, "BATTERY_DEAD " );
+
+    if(mask & CS_EVENT_BATTERY_LOW)
+        strcat( pBuf, "BATTERY_LOW " );
+
+    if(mask & CS_EVENT_READY_CHANGE)
+        strcat( pBuf, "READY_CHANGE " );
+
+    if(mask & CS_EVENT_CARD_DETECT)
+        strcat( pBuf, "CARD_DETECT " );
+
+    if(mask & CS_EVENT_RESET_REQUEST)
+        strcat( pBuf, "RESET_REQUEST " );
+
+    if(mask & CS_EVENT_RESET_PHYSICAL)
+        strcat( pBuf, "RESET_PHYSICAL " );
+
+    if(mask & CS_EVENT_CARD_RESET)
+        strcat( pBuf, "CARD_RESET " );
+
+    if(mask & CS_EVENT_REGISTRATION_COMPLETE)
+        strcat( pBuf, "REGISTRATION_COMPLETE " );
+
+    // if(mask & CS_EVENT_RESET_COMPLETE)
+    //     strcat( pBuf, "RESET_COMPLETE " );
+
+    if(mask & CS_EVENT_PM_SUSPEND)
+        strcat( pBuf, "PM_SUSPEND " );
+
+    if(mask & CS_EVENT_PM_RESUME)
+        strcat( pBuf, "PM_RESUME " );
+
+    if(mask & CS_EVENT_INSERTION_REQUEST)
+        strcat( pBuf, "INSERTION_REQUEST " );
+
+    if(mask & CS_EVENT_EJECTION_REQUEST)
+        strcat( pBuf, "EJECTION_REQUEST " );
+
+    if(mask & CS_EVENT_MTD_REQUEST)
+        strcat( pBuf, "MTD_REQUEST " );
+
+    if(mask & CS_EVENT_ERASE_COMPLETE)
+        strcat( pBuf, "ERASE_COMPLETE " );
+
+    if(mask & CS_EVENT_REQUEST_ATTENTION)
+        strcat( pBuf, "REQUEST_ATTENTION " );
+
+    if(mask & CS_EVENT_CB_DETECT)
+        strcat( pBuf, "CB_DETECT " );
+
+    if(mask & CS_EVENT_3VCARD)
+        strcat( pBuf, "3VCARD " );
+
+    if(mask & CS_EVENT_XVCARD)
+        strcat( pBuf, "XVCARD " );
+
+
+    if( *pBuf ) {
+        pBuf[strlen(pBuf) - 1] = '\0';
+    } else {
+        if( mask != 0x0 ) {
+            sprintf( pBuf, "<<0x%08x>>", mask );
+        }
+    }
+
+    return pBuf;
+} // DbgEvent
+/*============================================================================*/
+
+#endif  /* DBG */
diff --git a/drivers/staging/wlags49_h2/wl_cs.h b/drivers/staging/wlags49_h2/wl_cs.h
new file mode 100644
index 000000000000..2a0e67450fbe
--- /dev/null
+++ b/drivers/staging/wlags49_h2/wl_cs.h
@@ -0,0 +1,95 @@
+/*******************************************************************************
+ * Agere Systems Inc.
+ * Wireless device driver for Linux (wlags49).
+ *
+ * Copyright (c) 1998-2003 Agere Systems Inc.
+ * All rights reserved.
+ *   http://www.agere.com
+ *
+ * Initially developed by TriplePoint, Inc.
+ *   http://www.triplepoint.com
+ *
+ *------------------------------------------------------------------------------
+ *
+ *   Header describing information required for the driver to support PCMCIA.
+ *
+ *------------------------------------------------------------------------------
+ *
+ * SOFTWARE LICENSE
+ *
+ * This software is provided subject to the following terms and conditions,
+ * which you should read carefully before using the software.  Using this
+ * software indicates your acceptance of these terms and conditions.  If you do
+ * not agree with these terms and conditions, do not use the software.
+ *
+ * Copyright © 2003 Agere Systems Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source or binary forms, with or without
+ * modifications, are permitted provided that the following conditions are met:
+ *
+ * . Redistributions of source code must retain the above copyright notice, this
+ *    list of conditions and the following Disclaimer as comments in the code as
+ *    well as in the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * . Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following Disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ *
+ * . Neither the name of Agere Systems Inc. nor the names of the contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * Disclaimer
+ *
+ * THIS SOFTWARE IS PROVIDED “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, INFRINGEMENT AND THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  ANY
+ * USE, MODIFICATION OR DISTRIBUTION OF THIS SOFTWARE IS SOLELY AT THE USERS OWN
+ * RISK. IN NO EVENT SHALL AGERE SYSTEMS INC. OR CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, INCLUDING, BUT NOT LIMITED TO, CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ *
+ ******************************************************************************/
+
+#ifndef __WL_CS_H__
+#define __WL_CS_H__
+
+
+
+
+/*******************************************************************************
+ *  function protoypes
+ ******************************************************************************/
+
+void wl_adapter_insert(struct pcmcia_device *link);
+
+void wl_adapter_release(struct pcmcia_device *link);
+
+int wl_adapter_event(event_t event, int priority, event_callback_args_t *args );
+
+int wl_adapter_init_module( void );
+
+void wl_adapter_cleanup_module( void );
+
+int wl_adapter_open(struct net_device *dev);
+
+int wl_adapter_close(struct net_device *dev);
+
+int wl_adapter_is_open(struct net_device *dev);
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,27)
+void cs_error(client_handle_t handle, int func, int ret);
+#endif
+
+const char *DbgEvent( int mask );
+
+
+
+#endif  // __WL_CS_H__
diff --git a/drivers/staging/wlags49_h2/wl_enc.c b/drivers/staging/wlags49_h2/wl_enc.c
new file mode 100644
index 000000000000..48c44c8fdb28
--- /dev/null
+++ b/drivers/staging/wlags49_h2/wl_enc.c
@@ -0,0 +1,231 @@
+
+/*******************************************************************************
+ * Agere Systems Inc.
+ * Wireless device driver for Linux (wlags49).
+ *
+ * Copyright (c) 1998-2003 Agere Systems Inc.
+ * All rights reserved.
+ *   http://www.agere.com
+ *
+ * Initially developed by TriplePoint, Inc.
+ *   http://www.triplepoint.com
+ *
+ *------------------------------------------------------------------------------
+ *
+ *   This file defines functions related to WEP key coding/decoding.
+ *
+ *------------------------------------------------------------------------------
+ *
+ * SOFTWARE LICENSE
+ *
+ * This software is provided subject to the following terms and conditions,
+ * which you should read carefully before using the software.  Using this
+ * software indicates your acceptance of these terms and conditions.  If you do
+ * not agree with these terms and conditions, do not use the software.
+ *
+ * Copyright © 2003 Agere Systems Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source or binary forms, with or without
+ * modifications, are permitted provided that the following conditions are met:
+ *
+ * . Redistributions of source code must retain the above copyright notice, this
+ *    list of conditions and the following Disclaimer as comments in the code as
+ *    well as in the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * . Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following Disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ *
+ * . Neither the name of Agere Systems Inc. nor the names of the contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * Disclaimer
+ *
+ * THIS SOFTWARE IS PROVIDED “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, INFRINGEMENT AND THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  ANY
+ * USE, MODIFICATION OR DISTRIBUTION OF THIS SOFTWARE IS SOLELY AT THE USERS OWN
+ * RISK. IN NO EVENT SHALL AGERE SYSTEMS INC. OR CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, INCLUDING, BUT NOT LIMITED TO, CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ *
+ ******************************************************************************/
+
+/*******************************************************************************
+ *  include files
+ ******************************************************************************/
+#include <wl_version.h>
+
+#include <debug.h>
+#include <hcf.h>
+
+#include <wl_enc.h>
+
+
+
+
+/*******************************************************************************
+ *  global definitions
+ ******************************************************************************/
+#if DBG
+
+extern dbg_info_t *DbgInfo;
+
+#endif  /* DBG */
+
+
+
+
+/*******************************************************************************
+ *	wl_wep_code()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      This function encodes a set of wep keys for privacy
+ *
+ *  PARAMETERS:
+ *
+ *      szCrypt -
+ *      szDest  -
+ *      Data    -
+ *      nLen    -
+ *
+ *  RETURNS:
+ *
+ *      OK
+ *
+ ******************************************************************************/
+int wl_wep_code( char *szCrypt, char *szDest, void *Data, int nLen )
+{
+    int     i;
+    int     t;
+    int     k ;
+    char    bits;
+    char    *szData = (char *) Data;
+    /*------------------------------------------------------------------------*/
+
+
+    for( i = bits = 0 ; i < MACADDRESS_STR_LEN; i++ ) {
+	    bits ^= szCrypt[i];
+	    bits += szCrypt[i];
+    }
+
+    for( i = t = *szDest = 0; i < nLen; i++, t++ ) {
+	    k = szData[i] ^ ( bits + i );
+
+
+        switch( i % 3 ) {
+
+        case 0 :
+
+            szDest[t]   = ((k & 0xFC) >> 2) + CH_START ;
+			szDest[t+1] = ((k & 0x03) << 4) + CH_START ;
+	        szDest[t+2] = '\0';
+
+            break;
+
+
+        case 1 :
+
+            szDest[t]  += (( k & 0xF0 ) >> 4 );
+			szDest[t+1] = (( k & 0x0F ) << 2 ) + CH_START ;
+	        szDest[t+2] = '\0';
+
+            break;
+
+
+        case 2 :
+
+            szDest[t]  += (( k & 0xC0 ) >> 6 );
+			szDest[t+1] = ( k & 0x3F ) + CH_START ;
+	        szDest[t+2] = '\0';
+	        t++;
+
+            break;
+        }
+    }
+
+    return( strlen( szDest )) ;
+
+}
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wl_wep_decode()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      This function decodes a set of WEP keys for use by the card.
+ *
+ *  PARAMETERS:
+ *
+ *      szCrypt -
+ *      szDest  -
+ *      Data    -
+ *
+ *  RETURNS:
+ *
+ *      OK
+ *
+ ******************************************************************************/
+int wl_wep_decode( char *szCrypt, void *Dest, char *szData )
+{
+    int     i;
+    int     t;
+    int     nLen;
+    char    bits;
+    char    *szDest = Dest;
+  /*------------------------------------------------------------------------*/
+
+
+  for( i = bits = 0 ; i < 12; i++ ) {
+      bits ^= szCrypt[i] ;
+      bits += szCrypt[i] ;
+  }
+
+  nLen = ( strlen( szData ) * 3) / 4 ;
+
+  for( i = t = 0; i < nLen; i++, t++ ) {
+      switch( i % 3 ) {
+      case 0 :
+
+          szDest[i] = ((( szData[t]-CH_START ) & 0x3f ) << 2 ) +
+                      ((( szData[t+1]-CH_START ) & 0x30 ) >> 4 );
+	      break;
+
+
+      case 1 :
+          szDest[i] = ((( szData[t]-CH_START ) & 0x0f ) << 4 ) +
+                      ((( szData[t+1]-CH_START ) & 0x3c ) >> 2 );
+	      break;
+
+
+      case 2 :
+          szDest[i] = ((( szData[t]-CH_START ) & 0x03 ) << 6 ) +
+                       (( szData[t+1]-CH_START ) & 0x3f );
+	      t++;
+	      break;
+      }
+
+	szDest[i] ^= ( bits + i ) ;
+
+  }
+
+  return( i ) ;
+
+}
+/*============================================================================*/
+
diff --git a/drivers/staging/wlags49_h2/wl_enc.h b/drivers/staging/wlags49_h2/wl_enc.h
new file mode 100644
index 000000000000..b4f54d81f311
--- /dev/null
+++ b/drivers/staging/wlags49_h2/wl_enc.h
@@ -0,0 +1,118 @@
+/*******************************************************************************
+ * Agere Systems Inc.
+ * Wireless device driver for Linux (wlags49).
+ *
+ * Copyright (c) 1998-2003 Agere Systems Inc.
+ * All rights reserved.
+ *   http://www.agere.com
+ *
+ * Initially developed by TriplePoint, Inc.
+ *   http://www.triplepoint.com
+ *
+ *------------------------------------------------------------------------------
+ *
+ *   Header for performing coding/decoding of the WEP keys.
+ *
+ *------------------------------------------------------------------------------
+ *
+ * SOFTWARE LICENSE
+ *
+ * This software is provided subject to the following terms and conditions,
+ * which you should read carefully before using the software.  Using this
+ * software indicates your acceptance of these terms and conditions.  If you do
+ * not agree with these terms and conditions, do not use the software.
+ *
+ * Copyright © 2003 Agere Systems Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source or binary forms, with or without
+ * modifications, are permitted provided that the following conditions are met:
+ *
+ * . Redistributions of source code must retain the above copyright notice, this
+ *    list of conditions and the following Disclaimer as comments in the code as
+ *    well as in the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * . Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following Disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ *
+ * . Neither the name of Agere Systems Inc. nor the names of the contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * Disclaimer
+ *
+ * THIS SOFTWARE IS PROVIDED “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, INFRINGEMENT AND THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  ANY
+ * USE, MODIFICATION OR DISTRIBUTION OF THIS SOFTWARE IS SOLELY AT THE USERS OWN
+ * RISK. IN NO EVENT SHALL AGERE SYSTEMS INC. OR CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, INCLUDING, BUT NOT LIMITED TO, CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ *
+ ******************************************************************************/
+
+#ifndef __WAVELAN2_ENCRYPTION_H__
+#define __WAVELAN2_ENCRYPTION_H__
+
+
+
+
+/*******************************************************************************
+ * constant definitions
+ ******************************************************************************/
+#define CRYPT_CODE					"57617665A5D6"
+#define ENCRYPTION_LEN				102
+#define ENCRYPTION_MAGIC			0x48576877L	// HWhw
+#define DEF_CRYPT_STR				"G?TIUEA]d5MAdZV'eUb&&6.)'&:,'VF/(FR2)6^5*'*8*W6;+GB>,7NA-'ZD-X&G.H2J/8>M0(JP0XVS1HbV29.Y3):\\3YF_4IRb56"
+
+#define DEFAULT_CRYPT_MAC			"W\x01\x6B\x66\xA5\x5A"
+#define CH_START					'&'
+#define MACADDRESS_STR_LEN			12
+
+#define KEY_LEN                     14
+#define NUM_KEYS                    4
+
+#define KEY_LENGTH_NONE_ASCII       0
+#define KEY_LENGTH_64_BIT_ASCII     5
+#define KEY_LENGTH_128_BIT_ASCII    13
+
+#define KEY_LENGTH_NONE_HEX         ( KEY_LENGTH_NONE_ASCII    * sizeof( unsigned short ))
+#define KEY_LENGTH_64_BIT_HEX       ( KEY_LENGTH_64_BIT_ASCII  * sizeof( unsigned short ))
+#define KEY_LENGTH_128_BIT_HEX      ( KEY_LENGTH_128_BIT_ASCII * sizeof( unsigned short ))
+
+
+
+
+/*******************************************************************************
+ * type definitions
+ ******************************************************************************/
+typedef struct _encstct
+{
+	hcf_32	                   dwMagic;
+	hcf_16	                   wTxKeyID;
+	hcf_16	                   wEnabled;
+	CFG_DEFAULT_KEYS_STRCT     EncStr;
+}
+ENCSTRCT, *PENCSTRCT;
+
+
+
+
+/*******************************************************************************
+ * function prrottypes
+ ******************************************************************************/
+int wl_wep_code( char *szCrypt, char *szDest, void *Data, int nLen );
+
+int wl_wep_decode( char *szCrypt, void *Dest, char *szData );
+
+
+
+
+#endif  // __WAVELAN2_ENCRYPTION_H__
diff --git a/drivers/staging/wlags49_h2/wl_if.h b/drivers/staging/wlags49_h2/wl_if.h
new file mode 100644
index 000000000000..ed2b4135a10e
--- /dev/null
+++ b/drivers/staging/wlags49_h2/wl_if.h
@@ -0,0 +1,234 @@
+/*******************************************************************************
+ * Agere Systems Inc.
+ * Wireless device driver for Linux (wlags49).
+ *
+ * Copyright (c) 1998-2003 Agere Systems Inc.
+ * All rights reserved.
+ *   http://www.agere.com
+ *
+ * Initially developed by TriplePoint, Inc.
+ *   http://www.triplepoint.com
+ *
+ *------------------------------------------------------------------------------
+ *
+ *   Driver common header for info needed by driver source and user-space
+ *   processes communicating with the driver.
+ *
+ *------------------------------------------------------------------------------
+ *
+ * SOFTWARE LICENSE
+ *
+ * This software is provided subject to the following terms and conditions,
+ * which you should read carefully before using the software.  Using this
+ * software indicates your acceptance of these terms and conditions.  If you do
+ * not agree with these terms and conditions, do not use the software.
+ *
+ * Copyright © 2003 Agere Systems Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source or binary forms, with or without
+ * modifications, are permitted provided that the following conditions are met:
+ *
+ * . Redistributions of source code must retain the above copyright notice, this
+ *    list of conditions and the following Disclaimer as comments in the code as
+ *    well as in the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * . Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following Disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ *
+ * . Neither the name of Agere Systems Inc. nor the names of the contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * Disclaimer
+ *
+ * THIS SOFTWARE IS PROVIDED “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, INFRINGEMENT AND THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  ANY
+ * USE, MODIFICATION OR DISTRIBUTION OF THIS SOFTWARE IS SOLELY AT THE USERS OWN
+ * RISK. IN NO EVENT SHALL AGERE SYSTEMS INC. OR CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, INCLUDING, BUT NOT LIMITED TO, CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ *
+ ******************************************************************************/
+
+#ifndef __WAVELAN2_IF_H__
+#define __WAVELAN2_IF_H__
+
+
+
+
+/*******************************************************************************
+ *  constant definitions
+ ******************************************************************************/
+#define MAX_LTV_BUF_SIZE            (512 - (sizeof(hcf_16) * 2))
+
+#define HCF_TALLIES_SIZE            (sizeof(CFG_HERMES_TALLIES_STRCT) + \
+                                     (sizeof(hcf_16) * 2))
+
+#define HCF_MAX_MULTICAST           16
+#define HCF_MAX_NAME_LEN            32
+#define MAX_LINE_SIZE   			256
+#define HCF_NUM_IO_PORTS            0x80
+#define TX_TIMEOUT                  ((800 * HZ) / 1000)
+
+
+//#define HCF_MIN_COMM_QUALITY        0
+//#define HCF_MAX_COMM_QUALITY        92
+//#define HCF_MIN_SIGNAL_LEVEL        47
+//#define HCF_MAX_SIGNAL_LEVEL        138
+//#define HCF_MIN_NOISE_LEVEL         47
+//#define HCF_MAX_NOISE_LEVEL         138
+//#define HCF_0DBM_OFFSET             149
+
+// PE1DNN
+// Better data from the real world. Not scientific but empirical data gathered
+// from a Thomson Speedtouch 110 which is identified as:
+// PCMCIA Info: "Agere Systems" "Wireless PC Card Model 0110"
+//              Manufacture ID: 0156,0003
+// Lowest measurment for noise floor seen is value 54
+// Highest signal strength in close proximity to the AP seen is value 118
+// Very good must be arround 100 (otherwise its never "full scale"
+// All other constants are derrived from these. This makes the signal gauge
+// work for me...
+#define HCF_MIN_SIGNAL_LEVEL        54
+#define HCF_MAX_SIGNAL_LEVEL        100
+#define HCF_MIN_NOISE_LEVEL         HCF_MIN_SIGNAL_LEVEL
+#define HCF_MAX_NOISE_LEVEL         HCF_MAX_SIGNAL_LEVEL
+#define HCF_0DBM_OFFSET             (HCF_MAX_SIGNAL_LEVEL + 1)
+#define HCF_MIN_COMM_QUALITY        0
+#define HCF_MAX_COMM_QUALITY        (HCF_MAX_SIGNAL_LEVEL - HCF_MIN_NOISE_LEVEL + 1)
+
+
+/* For encryption (WEP) */
+#define MIN_KEY_SIZE                5       // 40 bits RC4 - WEP
+#define MAX_KEY_SIZE                13      // 104 bits
+#define MAX_KEYS                    4
+
+#define RADIO_CHANNELS              14
+#define RADIO_SENSITIVITY_LEVELS    3
+#define RADIO_TX_POWER_MWATT        32
+#define RADIO_TX_POWER_DBM          15
+
+#define MIN_RTS_BYTES               0
+#define MAX_RTS_BYTES               2347
+
+#define MAX_RATES                   8
+#define MEGABIT                     1024*1024
+
+#define HCF_FAILURE                 0xFF
+#define UIL_FAILURE		            0xFF
+#define CFG_UIL_CONNECT             0xA123          // Define differently?
+#define CFG_UIL_CONNECT_ACK_CODE    0x5653435A      // VSCZ
+#define WVLAN2_UIL_CONNECTED        (0x01L << 0)
+#define WVLAN2_UIL_BUSY             (0x01L << 1)
+
+
+
+
+/*******************************************************************************
+ * driver ioctl interface
+ ******************************************************************************/
+#define WVLAN2_IOCTL_UIL            SIOCDEVPRIVATE
+
+/* The UIL Interface used in conjunction with the WVLAN2_IOCTL_UIL code above
+   is defined in mdd.h. A quick reference of the UIL codes is listed below */
+/*
+UIL_FUN_CONNECT
+UIL_FUN_DISCONNECT
+UIL_FUN_ACTION
+    UIL_ACT_BLOCK
+    UIL_ACT_UNBLOCK
+    UIL_ACT_SCA
+    UIL_ACT_DIAG
+    UIL_ACT_APPLY
+UIL_FUN_SEND_DIAG_MSG
+UIL_FUN_GET_INFO
+UIL_FUN_PUT_INFO
+*/
+
+#define SIOCSIWNETNAME              SIOCDEVPRIVATE+1
+#define SIOCGIWNETNAME              SIOCDEVPRIVATE+2
+#define SIOCSIWSTANAME              SIOCDEVPRIVATE+3
+#define SIOCGIWSTANAME              SIOCDEVPRIVATE+4
+#define SIOCSIWPORTTYPE             SIOCDEVPRIVATE+5
+#define SIOCGIWPORTTYPE             SIOCDEVPRIVATE+6
+
+/* IOCTL code for the RTS interface */
+#define WL_IOCTL_RTS                SIOCDEVPRIVATE+7
+
+/* IOCTL subcodes for WL_IOCTL_RTS */
+#define WL_IOCTL_RTS_READ           1
+#define WL_IOCTL_RTS_WRITE          2
+#define WL_IOCTL_RTS_BATCH_READ     3
+#define WL_IOCTL_RTS_BATCH_WRITE    4
+
+
+/*******************************************************************************
+ * STRUCTURE DEFINITIONS
+ ******************************************************************************/
+typedef struct
+{
+    __u16   length;
+    __u8    name[HCF_MAX_NAME_LEN];
+}
+wvName_t;
+
+
+typedef struct
+{
+    hcf_16      len;
+    hcf_16      typ;
+    union
+    {
+        hcf_8       u8[MAX_LTV_BUF_SIZE / sizeof(hcf_8)];
+        hcf_16      u16[MAX_LTV_BUF_SIZE / sizeof(hcf_16)];
+        hcf_32      u32[MAX_LTV_BUF_SIZE / sizeof(hcf_32)];
+    } u;
+}
+ltv_t;
+
+
+struct uilreq
+{
+    union
+    {
+        char    ifrn_name[IFNAMSIZ];
+    } ifr_ifrn;
+
+    IFBP        hcfCtx;
+    __u8        command;
+    __u8        result;
+
+    /* The data field in this structure is typically an LTV of some type. The
+       len field is the size of the buffer in bytes, as opposed to words (like
+       the L-field in the LTV */
+    __u16       len;
+    void       *data;
+};
+
+
+struct rtsreq
+{
+    union
+    {
+        char    ifrn_name[IFNAMSIZ];
+    }
+    ifr_ifrn;
+
+    __u16   typ;
+    __u16   reg;
+    __u16   len;
+    __u16   *data;
+};
+
+
+#endif  // __WAVELAN2_IF_H__
+
diff --git a/drivers/staging/wlags49_h2/wl_internal.h b/drivers/staging/wlags49_h2/wl_internal.h
new file mode 100644
index 000000000000..466fb6215acd
--- /dev/null
+++ b/drivers/staging/wlags49_h2/wl_internal.h
@@ -0,0 +1,1056 @@
+/*******************************************************************************
+ * Agere Systems Inc.
+ * Wireless device driver for Linux (wlags49).
+ *
+ * Copyright (c) 1998-2003 Agere Systems Inc.
+ * All rights reserved.
+ *   http://www.agere.com
+ *
+ * Initially developed by TriplePoint, Inc.
+ *   http://www.triplepoint.com
+ *
+ *------------------------------------------------------------------------------
+ *
+ *   Header for defintions and macros internal to the drvier.
+ *
+ *------------------------------------------------------------------------------
+ *
+ * SOFTWARE LICENSE
+ *
+ * This software is provided subject to the following terms and conditions,
+ * which you should read carefully before using the software.  Using this
+ * software indicates your acceptance of these terms and conditions.  If you do
+ * not agree with these terms and conditions, do not use the software.
+ *
+ * Copyright © 2003 Agere Systems Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source or binary forms, with or without
+ * modifications, are permitted provided that the following conditions are met:
+ *
+ * . Redistributions of source code must retain the above copyright notice, this
+ *    list of conditions and the following Disclaimer as comments in the code as
+ *    well as in the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * . Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following Disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ *
+ * . Neither the name of Agere Systems Inc. nor the names of the contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * Disclaimer
+ *
+ * THIS SOFTWARE IS PROVIDED “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, INFRINGEMENT AND THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  ANY
+ * USE, MODIFICATION OR DISTRIBUTION OF THIS SOFTWARE IS SOLELY AT THE USERS OWN
+ * RISK. IN NO EVENT SHALL AGERE SYSTEMS INC. OR CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, INCLUDING, BUT NOT LIMITED TO, CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ *
+ ******************************************************************************/
+
+#ifndef __WAVELAN2_H__
+#define __WAVELAN2_H__
+
+
+
+
+/*******************************************************************************
+ *  include files
+ ******************************************************************************/
+#include <linux/version.h>
+#ifdef BUS_PCMCIA
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,27)
+#include <pcmcia/version.h>
+#endif
+#include <pcmcia/cs_types.h>
+#include <pcmcia/cs.h>
+#include <pcmcia/cistpl.h>
+#include <pcmcia/cisreg.h>
+#include <pcmcia/ciscode.h>
+#include <pcmcia/ds.h>
+#endif  // BUS_PCMCIA
+
+#ifdef HAS_WIRELESS_EXTENSIONS
+#include <linux/wireless.h>
+#if WIRELESS_EXT > 13
+#include <net/iw_handler.h>
+#endif // WIRELESS_EXT > 13
+#define USE_DBM
+#define RETURN_CURRENT_NETWORKNAME
+#define USE_FREQUENCY
+#endif // HAS_WIRELESS_EXTENSIONS/
+
+#include <linux/list.h>
+
+#include <linux/interrupt.h>
+
+
+
+
+/*******************************************************************************
+ *  constant definitions
+ ******************************************************************************/
+#define p_u8    __u8
+#define p_s8    __s8
+#define p_u16   __u16
+#define p_s16   __s16
+#define p_u32   __u32
+#define p_s32   __s32
+#define p_char  char
+
+#define MAX_KEY_LEN         (2 + (13 * 2)) // 0x plus 13 hex digit pairs
+#define MB_SIZE             1024
+#define MAX_ENC_LEN         104
+
+#define MAX_SCAN_TIME_SEC   8
+#define MAX_NAPS            32
+
+#define CFG_MB_INFO         0x0820		//Mail Box Info Block
+
+#define NUM_WDS_PORTS       6
+
+#define WVLAN_MAX_LOOKAHEAD (HCF_MAX_MSG+46) /* as per s0005MIC_4.doc */
+
+
+/* Min/Max/Default Parameter Values */
+#if 0 //;? (HCF_TYPE) & HCF_TYPE_AP
+//;? why this difference depending on compile option, seems to me it should depend on runtime if anything
+#define PARM_DEFAULT_SSID                       "LinuxAP"
+#else
+#define PARM_DEFAULT_SSID                       "ANY"
+#endif // HCF_TYPE_AP
+
+#define PARM_MIN_NAME_LEN                       1
+#define PARM_MAX_NAME_LEN                       32
+
+
+/* The following definitions pertain to module and profile parameters */
+// #define PARM_AP_MODE                            APMode
+// #define PARM_NAME_AP_MODE						TEXT("APMode")
+// #define PARM_DEFAULT_AP_MODE					FALSE
+
+#define PARM_AUTHENTICATION                     Authentication
+#define PARM_NAME_AUTHENTICATION				TEXT("Authentication")
+#define PARM_MIN_AUTHENTICATION                 1
+#define PARM_MAX_AUTHENTICATION                 2
+#define PARM_DEFAULT_AUTHENTICATION             1
+
+#define PARM_AUTH_KEY_MGMT_SUITE                AuthKeyMgmtSuite
+#define PARM_NAME_AUTH_KEY_MGMT_SUITE           TEXT("AuthKeyMgmtSuite")
+#define PARM_MIN_AUTH_KEY_MGMT_SUITE            0
+#define PARM_MAX_AUTH_KEY_MGMT_SUITE            4
+#define PARM_DEFAULT_AUTH_KEY_MGMT_SUITE        0
+
+#define PARM_BRSC_2GHZ                          BRSC2GHz
+#define PARM_NAME_BRSC_2GHZ                     TEXT("BRSC2GHz")
+#define PARM_MIN_BRSC                           0x0000
+#define PARM_MAX_BRSC                           0x0FFF
+#define PARM_DEFAULT_BRSC_2GHZ                  0x000F
+
+#define PARM_BRSC_5GHZ                          BRSC5GHz
+#define PARM_NAME_BRSC_5GHZ                     TEXT("BRSC5GHz")
+#define PARM_DEFAULT_BRSC_5GHZ                  0x0150
+
+#define PARM_COEXISTENCE                        Coexistence
+#define PARM_NAME_COEXISTENCE                   TEXT("Coexistence")
+#define PARM_MIN_COEXISTENCE                    0x0000
+#define PARM_MAX_COEXISTENCE                    0x0007
+#define PARM_DEFAULT_COEXISTENCE                0x0000
+
+#define PARM_CONFIGURED                         Configured
+#define PARM_NAME_CONFIGURED					TEXT("Configured")
+
+#define PARM_CONNECTION_CONTROL                 ConnectionControl
+#define PARM_NAME_CONNECTION_CONTROL            TEXT("ConnectionControl")
+#define PARM_MIN_CONNECTION_CONTROL             0
+#define PARM_MAX_CONNECTION_CONTROL             3
+#define PARM_DEFAULT_CONNECTION_CONTROL         2
+
+#define PARM_CREATE_IBSS                        CreateIBSS
+#define PARM_NAME_CREATE_IBSS                   TEXT("CreateIBSS")
+#define PARM_DEFAULT_CREATE_IBSS                FALSE
+#define PARM_DEFAULT_CREATE_IBSS_STR            "N"
+
+#define PARM_DEBUG_FLAG             	    	DebugFlag
+#define PARM_NAME_DEBUG_FLAG            		TEXT("DebugFlag")
+#define PARM_MIN_DEBUG_FLAG             		0
+#define PARM_MAX_DEBUG_FLAG             		0xFFFF
+#define PARM_DEFAULT_DEBUG_FLAG         		0xFFFF
+
+#define PARM_DESIRED_SSID                       DesiredSSID
+#define PARM_NAME_DESIRED_SSID                  TEXT("DesiredSSID")
+
+#define PARM_DOWNLOAD_FIRMWARE                  DownloadFirmware
+#define PARM_NAME_DOWNLOAD_FIRMWARE             TEXT("DownloadFirmware")
+
+#define PARM_DRIVER_ENABLE                      DriverEnable
+#define PARM_NAME_DRIVER_ENABLE					TEXT("DriverEnable")
+#define PARM_DEFAULT_DRIVER_ENABLE				TRUE
+
+#define PARM_ENABLE_ENCRYPTION                  EnableEncryption
+#define PARM_NAME_ENABLE_ENCRYPTION             TEXT("EnableEncryption")
+#define PARM_MIN_ENABLE_ENCRYPTION              0
+#define PARM_MAX_ENABLE_ENCRYPTION              7
+#define PARM_DEFAULT_ENABLE_ENCRYPTION          0
+
+#define PARM_ENCRYPTION                         Encryption
+#define PARM_NAME_ENCRYPTION                    TEXT("Encryption")
+
+#define PARM_EXCLUDE_UNENCRYPTED                ExcludeUnencrypted
+#define PARM_NAME_EXCLUDE_UNENCRYPTED           TEXT("ExcludeUnencrypted")
+#define PARM_DEFAULT_EXCLUDE_UNENCRYPTED        TRUE
+#define PARM_DEFAULT_EXCLUDE_UNENCRYPTED_STR    "N"
+
+#define PARM_INTRA_BSS_RELAY                    IntraBSSRelay
+#define PARM_NAME_INTRA_BSS_RELAY               TEXT("IntraBSSRelay")
+#define PARM_DEFAULT_INTRA_BSS_RELAY            TRUE
+#define PARM_DEFAULT_INTRA_BSS_RELAY_STR        "Y"
+
+#define PARM_KEY1                               Key1
+#define PARM_NAME_KEY1                          TEXT("Key1")
+#define PARM_KEY2                               Key2
+#define PARM_NAME_KEY2                          TEXT("Key2")
+#define PARM_KEY3                               Key3
+#define PARM_NAME_KEY3                          TEXT("Key3")
+#define PARM_KEY4                               Key4
+#define PARM_NAME_KEY4                          TEXT("Key4")
+
+//;? #define PARM_KEY_FORMAT                         AsciiHex
+//;? #define PARM_NAME_KEY_FORMAT                    TEXT("AsciiHex")
+
+#define PARM_LOAD_BALANCING                     LoadBalancing
+#define PARM_NAME_LOAD_BALANCING                TEXT("LoadBalancing")
+#define PARM_DEFAULT_LOAD_BALANCING             TRUE
+#define PARM_DEFAULT_LOAD_BALANCING_STR         "Y"
+
+#define PARM_MAX_DATA_LENGTH                    MaxDataLength
+#define PARM_NAME_MAX_DATA_LENGTH				TEXT("MaxDataLength")
+
+#define PARM_MAX_SLEEP                          MaxSleepDuration
+#define PARM_NAME_MAX_SLEEP                     TEXT("MaxSleepDuration")
+#define PARM_MIN_MAX_PM_SLEEP                   1								//;?names nearly right?
+#define PARM_MAX_MAX_PM_SLEEP                   65535
+#define PARM_DEFAULT_MAX_PM_SLEEP               100
+
+#define PARM_MEDIUM_DISTRIBUTION                MediumDistribution
+#define PARM_NAME_MEDIUM_DISTRIBUTION           TEXT("MediumDistribution")
+#define PARM_DEFAULT_MEDIUM_DISTRIBUTION        TRUE
+#define PARM_DEFAULT_MEDIUM_DISTRIBUTION_STR    "Y"
+
+#define PARM_MICROWAVE_ROBUSTNESS               MicroWaveRobustness
+#define PARM_NAME_MICROWAVE_ROBUSTNESS          TEXT("MicroWaveRobustness")
+#define PARM_DEFAULT_MICROWAVE_ROBUSTNESS       FALSE
+#define PARM_DEFAULT_MICROWAVE_ROBUSTNESS_STR   "N"
+
+#define PARM_MULTICAST_PM_BUFFERING             MulticastPMBuffering
+#define PARM_NAME_MULTICAST_PM_BUFFERING	    TEXT("MulticastPMBuffering")
+#define PARM_DEFAULT_MULTICAST_PM_BUFFERING     TRUE
+#define PARM_DEFAULT_MULTICAST_PM_BUFFERING_STR "Y"
+
+#define PARM_MULTICAST_RATE                     MulticastRate
+#define PARM_NAME_MULTICAST_RATE                TEXT("MulticastRate")
+#ifdef WARP
+#define PARM_MIN_MULTICAST_RATE                 0x0001
+#define PARM_MAX_MULTICAST_RATE                 0x0fff
+#define PARM_DEFAULT_MULTICAST_RATE_2GHZ        0x0004
+#define PARM_DEFAULT_MULTICAST_RATE_5GHZ        0x0010
+#else
+#define PARM_MIN_MULTICAST_RATE                 0x0001
+#define PARM_MAX_MULTICAST_RATE                 0x0004
+#define PARM_DEFAULT_MULTICAST_RATE_2GHZ        0x0002
+#define PARM_DEFAULT_MULTICAST_RATE_5GHZ        0x0000
+#endif  // WARP
+
+#define PARM_MULTICAST_RX                       MulticastReceive
+#define PARM_NAME_MULTICAST_RX                  TEXT("MulticastReceive")
+#define PARM_DEFAULT_MULTICAST_RX               TRUE
+#define PARM_DEFAULT_MULTICAST_RX_STR           "Y"
+
+#define PARM_NETWORK_ADDR                       NetworkAddress
+#define PARM_NAME_NETWORK_ADDR                  TEXT("NetworkAddress")
+#define PARM_DEFAULT_NETWORK_ADDR               { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF }
+
+#define PARM_NETWORK_TYPE                       NetworkType
+#define PARM_NAME_NETWORK_TYPE					TEXT("NetworkType")
+#define PARM_DEFAULT_NETWORK_TYPE   			0
+
+#define PARM_OWN_ATIM_WINDOW                    OwnATIMWindow
+#define PARM_NAME_OWN_ATIM_WINDOW				TEXT("OwnATIMWindow")
+#define PARM_MIN_OWN_ATIM_WINDOW                0
+#define PARM_MAX_OWN_ATIM_WINDOW                100
+#define PARM_DEFAULT_OWN_ATIM_WINDOW            0
+
+#define PARM_OWN_BEACON_INTERVAL                OwnBeaconInterval
+#define PARM_NAME_OWN_BEACON_INTERVAL           TEXT("OwnBeaconInterval")
+#define PARM_MIN_OWN_BEACON_INTERVAL            20
+#define PARM_MAX_OWN_BEACON_INTERVAL            200
+#define PARM_DEFAULT_OWN_BEACON_INTERVAL        100
+
+#define PARM_OWN_CHANNEL                        OwnChannel
+#define PARM_NAME_OWN_CHANNEL                   TEXT("OwnChannel")
+#define PARM_MIN_OWN_CHANNEL                    1
+#define PARM_MAX_OWN_CHANNEL                    161
+#define PARM_DEFAULT_OWN_CHANNEL                10
+
+#define PARM_OWN_DTIM_PERIOD                    OwnDTIMPeriod
+#define PARM_NAME_OWN_DTIM_PERIOD	            TEXT("OwnDTIMPeriod")
+#define PARM_MIN_OWN_DTIM_PERIOD                1
+#define PARM_MAX_OWN_DTIM_PERIOD                65535
+#define PARM_DEFAULT_OWN_DTIM_PERIOD            1
+
+#define PARM_OWN_NAME                           OwnName
+#define PARM_NAME_OWN_NAME                      TEXT("OwnName")
+#define PARM_DEFAULT_OWN_NAME                   "Linux"
+
+#define PARM_OWN_SSID                           OwnSSID
+#define PARM_NAME_OWN_SSID                      TEXT("OwnSSID")
+
+#define PARM_PM_ENABLED                         PMEnabled
+#define PARM_NAME_PM_ENABLED                    TEXT("PMEnabled")
+#define PARM_MAX_PM_ENABLED						3
+
+#define PARM_PMEPS                              PMEPS
+#define PARM_NAME_PMEPS                         TEXT("PMEPS")
+
+#define PARM_PM_HOLDOVER_DURATION               PMHoldoverDuration
+#define PARM_NAME_PM_HOLDOVER_DURATION          TEXT("PMHoldoverDuration")
+#define PARM_MIN_PM_HOLDOVER_DURATION           1
+#define PARM_MAX_PM_HOLDOVER_DURATION           1000
+#define PARM_DEFAULT_PM_HOLDOVER_DURATION       100
+
+#define PARM_PM_MODE                            PowerMode
+#define PARM_NAME_PM_MODE                       TEXT("PowerMode")
+
+#define PARM_PORT_TYPE                          PortType
+#define PARM_NAME_PORT_TYPE                     TEXT("PortType")
+#define PARM_MIN_PORT_TYPE                      1
+#define PARM_MAX_PORT_TYPE                      3
+#define PARM_DEFAULT_PORT_TYPE                  1
+
+#define PARM_PROMISCUOUS_MODE                   PromiscuousMode
+#define PARM_NAME_PROMISCUOUS_MODE              TEXT("PromiscuousMode")
+#define PARM_DEFAULT_PROMISCUOUS_MODE           FALSE
+#define PARM_DEFAULT_PROMISCUOUS_MODE_STR       "N"
+
+#define PARM_REJECT_ANY                         RejectANY
+#define PARM_NAME_REJECT_ANY				    TEXT("RejectANY")
+#define PARM_DEFAULT_REJECT_ANY                 FALSE
+#define PARM_DEFAULT_REJECT_ANY_STR             "N"
+
+#define PARM_RTS_THRESHOLD                      RTSThreshold
+#define PARM_NAME_RTS_THRESHOLD                 TEXT("RTSThreshold")
+#define PARM_MIN_RTS_THRESHOLD                  0
+#define PARM_MAX_RTS_THRESHOLD                  2347
+#define PARM_DEFAULT_RTS_THRESHOLD              2347
+
+#define PARM_RTS_THRESHOLD1                     RTSThreshold1
+#define PARM_NAME_RTS_THRESHOLD1                TEXT("RTSThreshold1")
+#define PARM_RTS_THRESHOLD2                     RTSThreshold2
+#define PARM_NAME_RTS_THRESHOLD2                TEXT("RTSThreshold2")
+#define PARM_RTS_THRESHOLD3                     RTSThreshold3
+#define PARM_NAME_RTS_THRESHOLD3                TEXT("RTSThreshold3")
+#define PARM_RTS_THRESHOLD4                     RTSThreshold4
+#define PARM_NAME_RTS_THRESHOLD4                TEXT("RTSThreshold4")
+#define PARM_RTS_THRESHOLD5                     RTSThreshold5
+#define PARM_NAME_RTS_THRESHOLD5                TEXT("RTSThreshold5")
+#define PARM_RTS_THRESHOLD6                     RTSThreshold6
+#define PARM_NAME_RTS_THRESHOLD6                TEXT("RTSThreshold6")
+
+#define PARM_SRSC_2GHZ                          SRSC2GHz
+#define PARM_NAME_SRSC_2GHZ                     TEXT("SRSC2GHz")
+#define PARM_MIN_SRSC                           0x0000
+#define PARM_MAX_SRSC                           0x0FFF
+#define PARM_DEFAULT_SRSC_2GHZ                  0x0FFF
+
+#define PARM_SRSC_5GHZ                          SRSC5GHz
+#define PARM_NAME_SRSC_5GHZ                     TEXT("SRSC5GHz")
+#define PARM_DEFAULT_SRSC_5GHZ                  0x0FF0
+
+#define PARM_SYSTEM_SCALE                       SystemScale
+#define PARM_NAME_SYSTEM_SCALE                  TEXT("SystemScale")
+#define PARM_MIN_SYSTEM_SCALE                   1
+#define PARM_MAX_SYSTEM_SCALE                   5
+#define PARM_DEFAULT_SYSTEM_SCALE               1
+
+#define PARM_TX_KEY                             TxKey
+#define PARM_NAME_TX_KEY                        TEXT("TxKey")
+#define PARM_MIN_TX_KEY                         1
+#define PARM_MAX_TX_KEY                         4
+#define PARM_DEFAULT_TX_KEY                     1
+
+#define PARM_TX_POW_LEVEL                       TxPowLevel
+#define PARM_NAME_TX_POW_LEVEL                  TEXT("TxPowLevel")
+#define PARM_MIN_TX_POW_LEVEL                   1   // 20 dBm
+#define PARM_MAX_TX_POW_LEVEL                   6   //  8 dBm
+#define PARM_DEFAULT_TX_POW_LEVEL               3   // 15 dBm
+
+#define PARM_TX_RATE                            TxRateControl
+#define PARM_NAME_TX_RATE                       TEXT("TxRateControl")
+#define PARM_MIN_TX_RATE                        0x0001
+#ifdef WARP
+#define PARM_MAX_TX_RATE                        0x0FFF
+#define PARM_DEFAULT_TX_RATE_2GHZ               0x0FFF
+#define PARM_DEFAULT_TX_RATE_5GHZ               0x0FF0
+#else
+#define PARM_MAX_TX_RATE                        0x0007
+#define PARM_DEFAULT_TX_RATE_2GHZ               0x0003
+#define PARM_DEFAULT_TX_RATE_5GHZ               0x0000
+#endif  // WARP
+
+#define PARM_TX_RATE1                           TxRateControl1
+#define PARM_NAME_TX_RATE1                      TEXT("TxRateControl1")
+#define PARM_TX_RATE2                           TxRateControl2
+#define PARM_NAME_TX_RATE2                      TEXT("TxRateControl2")
+#define PARM_TX_RATE3                           TxRateControl3
+#define PARM_NAME_TX_RATE3                      TEXT("TxRateControl3")
+#define PARM_TX_RATE4                           TxRateControl4
+#define PARM_NAME_TX_RATE4                      TEXT("TxRateControl4")
+#define PARM_TX_RATE5                           TxRateControl5
+#define PARM_NAME_TX_RATE5                      TEXT("TxRateControl5")
+#define PARM_TX_RATE6                           TxRateControl6
+#define PARM_NAME_TX_RATE6                      TEXT("TxRateControl6")
+
+#define PARM_VENDORDESCRIPTION                  VendorDescription
+#define PARM_NAME_VENDORDESCRIPTION				TEXT("VendorDescription")
+
+#define PARM_WDS_ADDRESS                        WDSAddress
+#define PARM_NAME_WDS_ADDRESS					TEXT("WDSAddress")
+
+#define PARM_WDS_ADDRESS1                       WDSAddress1
+#define PARM_NAME_WDS_ADDRESS1					TEXT("WDSAddress1")
+#define PARM_WDS_ADDRESS2                       WDSAddress2
+#define PARM_NAME_WDS_ADDRESS2					TEXT("WDSAddress2")
+#define PARM_WDS_ADDRESS3                       WDSAddress3
+#define PARM_NAME_WDS_ADDRESS3					TEXT("WDSAddress3")
+#define PARM_WDS_ADDRESS4                       WDSAddress4
+#define PARM_NAME_WDS_ADDRESS4					TEXT("WDSAddress4")
+#define PARM_WDS_ADDRESS5                       WDSAddress5
+#define PARM_NAME_WDS_ADDRESS5					TEXT("WDSAddress5")
+#define PARM_WDS_ADDRESS6                       WDSAddress6
+#define PARM_NAME_WDS_ADDRESS6					TEXT("WDSAddress6")
+
+/*
+#define PARM_LONG_RETRY_LIMIT                   LongRetryLimit
+#define PARM_NAME_LONG_RETRY_LIMIT              TEXT("LongRetryLimit")
+#define PARM_MIN_LONG_RETRY_LIMIT               1
+#define PARM_MAX_LONG_RETRY_LIMIT               15
+#define PARM_DEFAULT_LONG_RETRY_LIMIT           3
+
+
+#define PARM_PROBE_DATA_RATES                   ProbeDataRates
+#define PARM_NAME_PROBE_DATA_RATES              TEXT("ProbeDataRates")
+#define PARM_MIN_PROBE_DATA_RATES               0x0000
+#define PARM_MAX_PROBE_DATA_RATES               0x0FFF
+#define PARM_DEFAULT_PROBE_DATA_RATES_2GHZ      0x0002
+#define PARM_DEFAULT_PROBE_DATA_RATES_5GHZ      0x0010
+
+#define PARM_SHORT_RETRY_LIMIT                  ShortRetryLimit
+#define PARM_NAME_SHORT_RETRY_LIMIT             TEXT("ShortRetryLimit")
+#define PARM_MIN_SHORT_RETRY_LIMIT              1
+#define PARM_MAX_SHORT_RETRY_LIMIT              15
+#define PARM_DEFAULT_SHORT_RETRY_LIMIT          7
+
+
+*/
+
+/*******************************************************************************
+ *  state definitions
+ ******************************************************************************/
+/* The following constants are used to track state the device */
+#define WL_FRIMWARE_PRESENT     1 // Download if needed
+#define WL_FRIMWARE_NOT_PRESENT	0 // Skip over download, assume its already there
+#define WL_HANDLING_INT         1 // Actually call the HCF to switch interrupts on/off
+#define WL_NOT_HANDLING_INT     0 // Not yet handling interrupts, do not switch on/off
+
+/*******************************************************************************
+ *  macro definitions
+ ******************************************************************************/
+/* The following macro ensures that no symbols are exported, minimizing the
+   chance of a symbol collision in the kernel */
+// EXPORT_NO_SYMBOLS;
+
+#define NELEM(arr) (sizeof(arr) / sizeof(arr[0]))
+
+#define WVLAN_VALID_MAC_ADDRESS( x ) \
+((x[0]!=0xFF) && (x[1]!=0xFF) && (x[2]!=0xFF) && (x[3]!=0xFF) && (x[4]!=0xFF) && (x[5]!=0xFF))
+
+
+
+
+/*******************************************************************************
+ * type definitions
+ ******************************************************************************/
+#undef FALSE
+#undef TRUE
+
+typedef enum
+{
+	FALSE = 0,
+	TRUE  = 1
+}
+bool_t;
+
+
+typedef struct _ScanResult
+{
+	//hcf_16        len;
+	//hcf_16        typ;
+	int             scan_complete;
+	int             num_aps;
+	SCAN_RS_STRCT   APTable [MAX_NAPS];
+}
+ScanResult;
+
+
+typedef struct _LINK_STATUS_STRCT
+{
+	hcf_16  len;
+	hcf_16  typ;
+	hcf_16  linkStatus;     /* 1..5 */
+}
+LINK_STATUS_STRCT;
+
+
+typedef struct _ASSOC_STATUS_STRCT
+{
+	hcf_16  len;
+	hcf_16  typ;
+	hcf_16  assocStatus;            /* 1..3 */
+	hcf_8   staAddr[ETH_ALEN];
+	hcf_8   oldApAddr[ETH_ALEN];
+}
+ASSOC_STATUS_STRCT;
+
+
+typedef struct _SECURITY_STATUS_STRCT
+{
+	hcf_16  len;
+	hcf_16  typ;
+	hcf_16  securityStatus;     /* 1..3 */
+	hcf_8   staAddr[ETH_ALEN];
+	hcf_16  reason;
+}
+SECURITY_STATUS_STRCT;
+
+#define WVLAN_WMP_PDU_TYPE_LT_REQ       0x00
+#define WVLAN_WMP_PDU_TYPE_LT_RSP       0x01
+#define WVLAN_WMP_PDU_TYPE_APL_REQ      0x02
+#define WVLAN_WMP_PDU_TYPE_APL_RSP      0x03
+
+typedef struct wvlan_eth_hdr
+{
+	unsigned char   dst[ETH_ALEN];           /* Destination address. */
+	unsigned char   src[ETH_ALEN];           /* Source address. */
+	unsigned short  len;                    /* Length of the PDU. */
+}
+WVLAN_ETH_HDR, *PWVLAN_ETH_HDR;
+
+typedef struct wvlan_llc_snap
+{
+	unsigned char   dsap;                   /* DSAP (0xAA) */
+	unsigned char   ssap;                   /* SSAP (0xAA) */
+	unsigned char   ctrl;                   /* Control (0x03) */
+	unsigned char   oui[3];                 /* Organization Unique ID (00-60-1d). */
+	unsigned char   specid[2];              /* Specific ID code (00-01). */
+}
+WVLAN_LLC_SNAP, *PWVLAN_LLC_SNAP;
+
+
+typedef struct wvlan_lt_hdr
+{
+	unsigned char   version;                /* Version (0x00) */
+	unsigned char   type;                   /* PDU type: 0-req/1-resp. */
+	unsigned short  id;                     /* Identifier to associate resp to req. */
+}
+WVLAN_LT_HDR, *PWVLAN_LT_HDR;
+
+
+typedef struct wvlan_wmp_hdr
+{
+	unsigned char   version;                /* Version  */
+	unsigned char   type;                   /* PDU type */
+}
+WVLAN_WMP_HDR, *PWVLAN_WMP_HDR;
+
+
+#define FILLER_SIZE             1554
+#define TEST_PATTERN_SIZE       54
+
+
+typedef struct wvlan_lt_req
+{
+	unsigned char   Filler[TEST_PATTERN_SIZE];   /* minimal length of 54 bytes */
+}
+WVLAN_LT_REQ, *PWVLAN_LT_REQ;
+
+
+typedef struct wvlan_lt_rsp
+{
+	char           name[32];
+	/* Measured Data */
+	unsigned char  signal;
+	unsigned char  noise;
+	unsigned char  rxFlow;
+	unsigned char  dataRate;
+	unsigned short protocol;
+	/* Capabilities */
+	unsigned char  station;
+	unsigned char  dataRateCap;
+	unsigned char  powerMgmt[4];
+	unsigned char  robustness[4];
+	unsigned char  scaling;
+	unsigned char  reserved[5];
+}
+WVLAN_LT_RSP, *PWVLAN_LT_RSP;
+
+
+typedef struct wvlan_rx_wmp_hdr
+{
+	unsigned short status;
+	unsigned short reserved1[2];
+	unsigned char  silence;
+	unsigned char  signal;
+	unsigned char  rate;
+	unsigned char  rxFlow;
+	unsigned short reserved2[2];
+	unsigned short frameControl;
+	unsigned short duration;
+	unsigned short address1[3];
+	unsigned short address2[3];
+	unsigned short address3[3];
+	unsigned short sequenceControl;
+	unsigned short address4[3];
+#ifndef HERMES25	//;?just to be on the safe side of inherited but not comprehended code #ifdef HERMES2
+	unsigned short seems_to_be_unused_reserved3[5];  //;?
+	unsigned short seems_to_be_unused_reserved4;	 //;?
+#endif // HERMES25
+	unsigned short HeaderDataLen;
+}
+WVLAN_RX_WMP_HDR, *PWVLAN_RX_WMP_HDR;
+
+
+typedef struct wvlan_linktest_req_pdu
+{
+	WVLAN_ETH_HDR     ethHdr;
+	WVLAN_LLC_SNAP    llcSnap;
+	WVLAN_LT_HDR      ltHdr;
+	WVLAN_LT_REQ      ltReq;
+}
+WVLAN_LINKTEST_REQ_PDU, *PWVLAN_LINKTEST_REQ_PDU;
+
+
+typedef struct wvlan_linktest_rsp_pdu
+{
+	WVLAN_RX_WMP_HDR  wmpRxHdr;
+	WVLAN_ETH_HDR     ethHdr;
+	WVLAN_LLC_SNAP    llcSnap;
+	WVLAN_LT_HDR      ltHdr;
+	WVLAN_LT_RSP      ltRsp;
+}
+WVLAN_LINKTEST_RSP_PDU, *PWVLAN_LINKTEST_RSP_PDU;
+
+
+typedef struct _LINKTEST_RSP_STRCT
+{
+	hcf_16                   len;
+	hcf_16                   typ;
+	WVLAN_LINKTEST_RSP_PDU   ltRsp;
+}
+LINKTEST_RSP_STRCT;
+
+
+typedef struct wvlan_wmp_rsp_pdu
+{
+	WVLAN_RX_WMP_HDR  wmpRxHdr;
+	WVLAN_ETH_HDR     ethHdr;
+	WVLAN_LLC_SNAP    llcSnap;
+	WVLAN_WMP_HDR     wmpHdr;
+}
+WVLAN_WMP_RSP_PDU, *PWVLAN_WMP_RSP_PDU;
+
+
+typedef struct _WMP_RSP_STRCT
+{
+	hcf_16              len;
+	hcf_16              typ;
+	WVLAN_WMP_RSP_PDU   wmpRsp;
+}
+WMP_RSP_STRCT;
+
+
+typedef struct _PROBE_RESP
+{
+	// first part: 802.11
+	hcf_16	length;
+	hcf_16	infoType;
+	hcf_16	reserved0;
+	//hcf_8	signal;
+	hcf_8	silence;
+	hcf_8	signal;     // Moved signal here as signal/noise values were flipped
+	hcf_8	rxFlow;
+	hcf_8	rate;
+	hcf_16	reserved1[2];
+
+	// second part:
+	hcf_16	frameControl;
+	hcf_16	durID;
+	hcf_8	address1[6];
+	hcf_8	address2[6];
+	hcf_8	BSSID[6];					//! this is correct, right ?
+	hcf_16	sequence;
+	hcf_8	address4[6];
+
+#ifndef WARP
+	hcf_8	reserved2[12];
+#endif // WARP
+
+	hcf_16	dataLength;
+										// the information in the next 3 fields (DA/SA/LenType) is actually not filled in.
+	hcf_8	DA[6];
+	hcf_8	SA[6];
+
+#ifdef WARP
+	hcf_8   channel;
+	hcf_8   band;
+#else
+	hcf_16	lenType;
+#endif  // WARP
+
+	hcf_8	timeStamp[8];
+	hcf_16	beaconInterval;
+	hcf_16	capability;
+	hcf_8	rawData[200];				//! <<< think about this number !
+	hcf_16	flags;
+}
+PROBE_RESP, *PPROBE_RESP;
+
+
+typedef struct _ProbeResult
+{
+	int         scan_complete;
+	int         num_aps;
+	PROBE_RESP  ProbeTable[MAX_NAPS];
+}
+ProbeResult;
+
+/* Definitions used to parse capabilities out of the probe responses */
+#define CAPABILITY_ESS      0x0001
+#define CAPABILITY_IBSS     0x0002
+#define CAPABILITY_PRIVACY  0x0010
+
+/* Definitions used to parse the Information Elements out of probe responses */
+#define DS_INFO_ELEM                        0x03
+#define GENERIC_INFO_ELEM                   0xdd
+#define WPA_MAX_IE_LEN                      40
+#define WPA_SELECTOR_LEN                    4
+#define WPA_OUI_TYPE                        { 0x00, 0x50, 0xf2, 1 }
+#define WPA_VERSION                         1
+#define WPA_AUTH_KEY_MGMT_UNSPEC_802_1X     { 0x00, 0x50, 0xf2, 1 }
+#define WPA_AUTH_KEY_MGMT_PSK_OVER_802_1X   { 0x00, 0x50, 0xf2, 2 }
+#define WPA_CIPHER_SUITE_NONE               { 0x00, 0x50, 0xf2, 0 }
+#define WPA_CIPHER_SUITE_WEP40              { 0x00, 0x50, 0xf2, 1 }
+#define WPA_CIPHER_SUITE_TKIP               { 0x00, 0x50, 0xf2, 2 }
+#define WPA_CIPHER_SUITE_WRAP               { 0x00, 0x50, 0xf2, 3 }
+#define WPA_CIPHER_SUITE_CCMP               { 0x00, 0x50, 0xf2, 4 }
+#define WPA_CIPHER_SUITE_WEP104             { 0x00, 0x50, 0xf2, 5 }
+
+typedef enum wvlan_drv_mode
+{
+	WVLAN_DRV_MODE_NO_DOWNLOAD,     /* this is the same as STA for Hermes 1    */
+				                    /* it is also only applicable for Hermes 1 */
+	WVLAN_DRV_MODE_STA,
+	WVLAN_DRV_MODE_AP,
+	WVLAN_DRV_MODE_MAX
+}
+WVLAN_DRV_MODE, *PWVLAN_DRV_MODE;
+
+
+typedef enum wvlan_port_state
+{
+	WVLAN_PORT_STATE_ENABLED,
+	WVLAN_PORT_STATE_DISABLED,
+	WVLAN_PORT_STATE_CONNECTED
+}
+WVLAN_PORT_STATE, *PWVLAN_PORT_STATE;
+
+/*
+typedef enum wvlan_connect_state
+{
+	WVLAN_CONNECT_STATE_CONNECTED,
+	WVLAN_CONNECT_STATE_DISCONNECTED
+}
+WVLAN_CONNECT_STATE, *PWVLAN_CONNECT_STATE;
+*/
+
+typedef enum wvlan_pm_state
+{
+	WVLAN_PM_STATE_DISABLED,
+	WVLAN_PM_STATE_ENHANCED,
+	WVLAN_PM_STATE_STANDARD
+}
+WVLAN_PM_STATE, *PWVLAN_PM_STATE;
+
+
+typedef struct wvlan_frame
+{
+	struct sk_buff  *skb;       /* sk_buff for frame. */
+	hcf_16          port;       /* MAC port for the frame. */
+	hcf_16          len;        /* Length of the frame. */
+}
+WVLAN_FRAME, *PWVLAN_FRAME;
+
+
+typedef struct wvlan_lframe
+{
+	struct list_head    node;   /* Node in the list */
+	WVLAN_FRAME	        frame;  /* Frame. */
+}
+WVLAN_LFRAME, *PWVLAN_LFRAME;
+
+
+
+#define DEFAULT_NUM_TX_FRAMES           48
+#define TX_Q_LOW_WATER_MARK             (DEFAULT_NUM_TX_FRAMES/3)
+
+#define WVLAN_MAX_TX_QUEUES             1
+
+
+#ifdef USE_WDS
+
+typedef struct wvlan_wds_if
+{
+	struct net_device           *dev;
+	int                         is_registered;
+	int                         netif_queue_on;
+	struct net_device_stats     stats;
+	hcf_16                      rtsThreshold;
+	hcf_16                      txRateCntl;
+	hcf_8                       wdsAddress[ETH_ALEN];
+} WVLAN_WDS_IF, *PWVLAN_WDS_IF;
+
+#endif  // USE_WDS
+
+
+
+#define NUM_RX_DESC 5
+#define NUM_TX_DESC 5
+
+typedef struct dma_strct
+{
+	DESC_STRCT  *tx_packet[NUM_TX_DESC];
+	DESC_STRCT  *rx_packet[NUM_RX_DESC];
+	DESC_STRCT  *rx_reclaim_desc, *tx_reclaim_desc; // Descriptors for host-reclaim purposes (see HCF)
+	int         tx_rsc_ind; // DMA Tx resource indicator is maintained in the MSF, not in the HCF
+	int         rx_rsc_ind; // Also added rx rsource indicator so that cleanup can be performed if alloc fails
+	int         status;
+} DMA_STRCT;
+
+
+/* Macros used in DMA support */
+/* get bus address of {rx,tx}dma structure member, in little-endian byte order */
+#define WL_DMA_BUS_ADDR_LE(str, i, mem) \
+	cpu_to_le32(str##_dma_addr[(i)] + ((hcf_8 *)&str[(i)]->mem - (hcf_8 *)str[(i)]))
+
+
+struct wl_private
+{
+
+#ifdef BUS_PCMCIA
+	dev_node_t                  node;
+	struct pcmcia_device	    *link;
+#endif // BUS_PCMCIA
+
+
+	struct net_device           *dev;
+//	struct net_device           *dev_next;
+	spinlock_t                  slock;
+	struct tasklet_struct       task;
+	struct net_device_stats     stats;
+
+
+#ifdef WIRELESS_EXT
+	struct iw_statistics        wstats;
+//	int                         spy_number;
+//	u_char                      spy_address[IW_MAX_SPY][ETH_ALEN];
+//	struct iw_quality           spy_stat[IW_MAX_SPY];
+	struct iw_spy_data          spy_data;
+	struct iw_public_data	wireless_data;
+#endif // WIRELESS_EXT
+
+
+	IFB_STRCT                   hcfCtx;
+//;? struct timer_list			timer_oor;
+//;? hcf_16						timer_oor_cnt;
+	u_long						wlags49_type;		//controls output in /proc/wlags49
+	u_long                      flags;
+	hcf_16						DebugFlag;
+	int                         is_registered;
+	int                         is_handling_int;
+	int                         firmware_present;
+	char                        sysfsCreated;
+	CFG_DRV_INFO_STRCT          driverInfo;
+	CFG_IDENTITY_STRCT          driverIdentity;
+	CFG_FW_IDENTITY_STRCT       StationIdentity;
+	CFG_PRI_IDENTITY_STRCT      PrimaryIdentity;
+	CFG_PRI_IDENTITY_STRCT      NICIdentity;
+
+	ltv_t                       ltvRecord;
+	u_long                      txBytes;
+	hcf_16                      maxPort;        /* 0 for STA, 6 for AP */
+
+	/* Elements used for async notification from hardware */
+	RID_LOG_STRCT				RidList[10];
+	ltv_t                       updatedRecord;
+	PROBE_RESP				    ProbeResp;
+	ASSOC_STATUS_STRCT          assoc_stat;
+	SECURITY_STATUS_STRCT       sec_stat;
+
+	u_char                      lookAheadBuf[WVLAN_MAX_LOOKAHEAD];
+
+	hcf_8                       PortType;           // 1 - 3 (1 [Normal] | 3 [AdHoc])
+	hcf_16                      Channel;            // 0 - 14 (0)
+	hcf_16                      TxRateControl[2];
+	hcf_8                       DistanceBetweenAPs; // 1 - 3 (1)
+	hcf_16                      RTSThreshold;       // 0 - 2347 (2347)
+	hcf_16                      PMEnabled;          // 0 - 2, 8001 - 8002 (0)
+	hcf_8                       MicrowaveRobustness;// 0 - 1 (0)
+	hcf_8                       CreateIBSS;         // 0 - 1 (0)
+	hcf_8                       MulticastReceive;   // 0 - 1 (1)
+	hcf_16                      MaxSleepDuration;   // 0 - 65535 (100)
+	hcf_8                       MACAddress[ETH_ALEN];
+	char                        NetworkName[HCF_MAX_NAME_LEN+1];
+	char                        StationName[HCF_MAX_NAME_LEN+1];
+	hcf_8                       EnableEncryption;   // 0 - 1 (0)
+	char                        Key1[MAX_KEY_LEN+1];
+	char                        Key2[MAX_KEY_LEN+1];
+	char                        Key3[MAX_KEY_LEN+1];
+	char                        Key4[MAX_KEY_LEN+1];
+	hcf_8                       TransmitKeyID;      // 1 - 4 (1)
+	CFG_DEFAULT_KEYS_STRCT	    DefaultKeys;
+	u_char                      mailbox[MB_SIZE];
+	char                        szEncryption[MAX_ENC_LEN];
+
+	hcf_16                      driverEnable;
+	hcf_16                      wolasEnable;
+	hcf_16                      atimWindow;
+	hcf_16                      holdoverDuration;
+	hcf_16                      MulticastRate[2];
+
+	hcf_16                      authentication; // is this AP specific?
+	hcf_16                      promiscuousMode;
+	WVLAN_DRV_MODE              DownloadFirmware;   // 0 - 2 (0 [None] | 1 [STA] | 2 [AP])
+
+	char						fw_image_filename[MAX_LINE_SIZE+1];
+
+	hcf_16                      AuthKeyMgmtSuite;
+
+	hcf_16                      loadBalancing;
+	hcf_16                      mediumDistribution;
+	hcf_16                      txPowLevel;
+	//hcf_16                      shortRetryLimit;
+	//hcf_16                      longRetryLimit;
+	hcf_16                      srsc[2];
+	hcf_16                      brsc[2];
+	hcf_16                      connectionControl;
+	//hcf_16                      probeDataRates[2];
+	hcf_16                      ownBeaconInterval;
+	hcf_16                      coexistence;
+
+	WVLAN_FRAME                 txF;
+	WVLAN_LFRAME                txList[DEFAULT_NUM_TX_FRAMES];
+	struct list_head            txFree;
+	struct list_head            txQ[WVLAN_MAX_TX_QUEUES];
+	int                         netif_queue_on;
+	int                         txQ_count;
+	DESC_STRCT                  desc_rx;
+	DESC_STRCT                  desc_tx;
+
+	WVLAN_PORT_STATE            portState;
+
+	ScanResult                  scan_results;
+	ProbeResult                 probe_results;
+	int                         probe_num_aps;
+
+	int                         use_dma;
+	DMA_STRCT                   dma;
+#ifdef USE_RTS
+	int                         useRTS;
+#endif  // USE_RTS
+	hcf_8                       DTIMPeriod;         // 1 - 255 (1)
+	hcf_16                      multicastPMBuffering;
+	hcf_8                       RejectAny;          // 0 - 1 (0)
+	hcf_8                       ExcludeUnencrypted; // 0 - 1 (1)
+	hcf_16                      intraBSSRelay;
+#ifdef USE_WDS
+	WVLAN_WDS_IF                wds_port[NUM_WDS_PORTS];
+#endif // USE_WDS
+}; // wl_private
+
+#ifdef HAVE_NETDEV_PRIV
+#define wl_priv(dev) ((struct wl_private *) netdev_priv(dev))
+#else
+extern inline struct wl_private *wl_priv(struct net_device *dev)
+{
+    return dev->priv;
+}
+#endif
+
+/********************************************************************/
+/* Locking and synchronization functions                            */
+/********************************************************************/
+
+/* These functions *must* be inline or they will break horribly on
+ * SPARC, due to its weird semantics for save/restore flags. extern
+ * inline should prevent the kernel from linking or module from
+ * loading if they are not inlined. */
+extern inline void wl_lock(struct wl_private *lp,
+	                       unsigned long *flags)
+{
+	spin_lock_irqsave(&lp->slock, *flags);
+}
+
+extern inline void wl_unlock(struct wl_private *lp,
+	                          unsigned long *flags)
+{
+	spin_unlock_irqrestore(&lp->slock, *flags);
+}
+
+/********************************************************************/
+/* Interrupt enable disable functions                               */
+/********************************************************************/
+
+extern inline void wl_act_int_on(struct wl_private *lp)
+{
+	/*
+	 * Only do something when the driver is handling
+	 * interrupts. Handling starts at wl_open and
+	 * ends at wl_close when not in RTS mode
+	 */
+	if(lp->is_handling_int == WL_HANDLING_INT) {
+		hcf_action( &lp->hcfCtx, HCF_ACT_INT_ON );
+	}
+}
+
+extern inline void wl_act_int_off(struct wl_private *lp)
+{
+	/*
+	 * Only do something when the driver is handling
+	 * interrupts. Handling starts at wl_open and
+	 * ends at wl_close when not in RTS mode
+	 */
+	if(lp->is_handling_int == WL_HANDLING_INT) {
+		hcf_action( &lp->hcfCtx, HCF_ACT_INT_OFF );
+	}
+}
+
+#endif  // __WAVELAN2_H__
diff --git a/drivers/staging/wlags49_h2/wl_main.c b/drivers/staging/wlags49_h2/wl_main.c
new file mode 100644
index 000000000000..16764a000942
--- /dev/null
+++ b/drivers/staging/wlags49_h2/wl_main.c
@@ -0,0 +1,3866 @@
+/*******************************************************************************
+ * Agere Systems Inc.
+ * Wireless device driver for Linux (wlags49).
+ *
+ * Copyright (c) 1998-2003 Agere Systems Inc.
+ * All rights reserved.
+ *   http://www.agere.com
+ *
+ * Initially developed by TriplePoint, Inc.
+ *   http://www.triplepoint.com
+ *
+ *------------------------------------------------------------------------------
+ *
+ *   This file contains the main driver entry points and other adapter
+ *   specific routines.
+ *
+ *------------------------------------------------------------------------------
+ *
+ * SOFTWARE LICENSE
+ *
+ * This software is provided subject to the following terms and conditions,
+ * which you should read carefully before using the software.  Using this
+ * software indicates your acceptance of these terms and conditions.  If you do
+ * not agree with these terms and conditions, do not use the software.
+ *
+ * Copyright © 2003 Agere Systems Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source or binary forms, with or without
+ * modifications, are permitted provided that the following conditions are met:
+ *
+ * . Redistributions of source code must retain the above copyright notice, this
+ *    list of conditions and the following Disclaimer as comments in the code as
+ *    well as in the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * . Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following Disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ *
+ * . Neither the name of Agere Systems Inc. nor the names of the contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * Disclaimer
+ *
+ * THIS SOFTWARE IS PROVIDED “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, INFRINGEMENT AND THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  ANY
+ * USE, MODIFICATION OR DISTRIBUTION OF THIS SOFTWARE IS SOLELY AT THE USERS OWN
+ * RISK. IN NO EVENT SHALL AGERE SYSTEMS INC. OR CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, INCLUDING, BUT NOT LIMITED TO, CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ *
+ ******************************************************************************/
+
+/*******************************************************************************
+ *  constant definitions
+ ******************************************************************************/
+
+/* Allow support for calling system fcns to access F/W iamge file */
+#define __KERNEL_SYSCALLS__
+
+/*******************************************************************************
+ *  include files
+ ******************************************************************************/
+#include <wl_version.h>
+
+#include <linux/module.h>
+#include <linux/proc_fs.h>
+#include <linux/types.h>
+#include <linux/kernel.h>
+// #include <linux/sched.h>
+// #include <linux/ptrace.h>
+// #include <linux/slab.h>
+// #include <linux/ctype.h>
+// #include <linux/string.h>
+// #include <linux/timer.h>
+//#include <linux/interrupt.h>
+// #include <linux/tqueue.h>
+// #include <linux/in.h>
+// #include <linux/delay.h>
+// #include <asm/io.h>
+// #include <asm/system.h>
+// #include <asm/bitops.h>
+#include <linux/unistd.h>
+#include <asm/uaccess.h>
+
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+// #include <linux/skbuff.h>
+// #include <linux/if_arp.h>
+// #include <linux/ioport.h>
+
+#define BIN_DL 0
+#if BIN_DL
+#include <linux/vmalloc.h>
+#endif // BIN_DL
+
+
+#include <debug.h>
+
+#include <hcf.h>
+#include <dhf.h>
+//in order to get around:: wl_main.c:2229: `HREG_EV_RDMAD' undeclared (first use in this function)
+#include <hcfdef.h>
+
+#include <wl_if.h>
+#include <wl_internal.h>
+#include <wl_util.h>
+#include <wl_main.h>
+#include <wl_netdev.h>
+#include <wl_wext.h>
+
+#ifdef USE_PROFILE
+#include <wl_profile.h>
+#endif  /* USE_PROFILE */
+
+#ifdef BUS_PCMCIA
+#include <wl_cs.h>
+#endif  /* BUS_PCMCIA */
+
+#ifdef BUS_PCI
+#include <wl_pci.h>
+#endif  /* BUS_PCI */
+/*******************************************************************************
+ *	macro defintions
+ ******************************************************************************/
+#define VALID_PARAM(C) \
+	{ \
+		if (!(C)) \
+		{ \
+			printk(KERN_INFO "Wireless, parameter error: \"%s\"\n", #C); \
+			goto failed; \
+		} \
+	}
+/*******************************************************************************
+ *	local functions
+ ******************************************************************************/
+void wl_isr_handler( unsigned long p );
+
+#if 0 //SCULL_USE_PROC /* don't waste space if unused */
+//int scull_read_procmem(char *buf, char **start, off_t offset, int len, int unused);
+int scull_read_procmem(char *buf, char **start, off_t offset, int len, int *eof, void *data );
+static int write_int(struct file *file, const char *buffer, unsigned long count, void *data);
+static void proc_write(const char *name, write_proc_t *w, void *data);
+
+#endif /* SCULL_USE_PROC */
+
+/*******************************************************************************
+ * module parameter definitions - set with 'insmod'
+ ******************************************************************************/
+static p_u16    irq_mask                = 0xdeb8; // IRQ3,4,5,7,9,10,11,12,14,15
+static p_s8     irq_list[4]             = { -1 };
+
+#if 0
+MODULE_PARM(irq_mask,               "h");
+MODULE_PARM_DESC(irq_mask,               "IRQ mask [0xdeb8]");
+MODULE_PARM(irq_list,               "1-4b");
+MODULE_PARM_DESC(irq_list,               "IRQ list [<irq_mask>]");
+#endif
+
+static p_u8     PARM_AUTHENTICATION        	= PARM_DEFAULT_AUTHENTICATION;
+static p_u16    PARM_AUTH_KEY_MGMT_SUITE   	= PARM_DEFAULT_AUTH_KEY_MGMT_SUITE;
+static p_u16    PARM_BRSC_2GHZ             	= PARM_DEFAULT_BRSC_2GHZ;
+static p_u16    PARM_BRSC_5GHZ             	= PARM_DEFAULT_BRSC_5GHZ;
+static p_u16    PARM_COEXISTENCE           	= PARM_DEFAULT_COEXISTENCE;
+static p_u16    PARM_CONNECTION_CONTROL    	= PARM_DEFAULT_CONNECTION_CONTROL;  //;?rename and move
+static p_char  *PARM_CREATE_IBSS           	= PARM_DEFAULT_CREATE_IBSS_STR;
+static p_char  *PARM_DESIRED_SSID          	= PARM_DEFAULT_SSID;
+static p_char  *PARM_DOWNLOAD_FIRMWARE      = "";
+static p_u16    PARM_ENABLE_ENCRYPTION     	= PARM_DEFAULT_ENABLE_ENCRYPTION;
+static p_char  *PARM_EXCLUDE_UNENCRYPTED   	= PARM_DEFAULT_EXCLUDE_UNENCRYPTED_STR;
+static p_char  *PARM_INTRA_BSS_RELAY       	= PARM_DEFAULT_INTRA_BSS_RELAY_STR;
+static p_char  *PARM_KEY1                  	= "";
+static p_char  *PARM_KEY2                  	= "";
+static p_char  *PARM_KEY3                  	= "";
+static p_char  *PARM_KEY4                  	= "";
+static p_char  *PARM_LOAD_BALANCING        	= PARM_DEFAULT_LOAD_BALANCING_STR;
+static p_u16    PARM_MAX_SLEEP             	= PARM_DEFAULT_MAX_PM_SLEEP;
+static p_char  *PARM_MEDIUM_DISTRIBUTION   	= PARM_DEFAULT_MEDIUM_DISTRIBUTION_STR;
+static p_char  *PARM_MICROWAVE_ROBUSTNESS  	= PARM_DEFAULT_MICROWAVE_ROBUSTNESS_STR;
+static p_char  *PARM_MULTICAST_PM_BUFFERING	= PARM_DEFAULT_MULTICAST_PM_BUFFERING_STR;
+static p_u16    PARM_MULTICAST_RATE        	= PARM_DEFAULT_MULTICAST_RATE_2GHZ;
+static p_char  *PARM_MULTICAST_RX          	= PARM_DEFAULT_MULTICAST_RX_STR;
+static p_u8     PARM_NETWORK_ADDR[ETH_ALEN]	= PARM_DEFAULT_NETWORK_ADDR;
+static p_u16    PARM_OWN_ATIM_WINDOW       	= PARM_DEFAULT_OWN_ATIM_WINDOW;
+static p_u16    PARM_OWN_BEACON_INTERVAL   	= PARM_DEFAULT_OWN_BEACON_INTERVAL;
+static p_u8     PARM_OWN_CHANNEL           	= PARM_DEFAULT_OWN_CHANNEL;
+static p_u8     PARM_OWN_DTIM_PERIOD       	= PARM_DEFAULT_OWN_DTIM_PERIOD;
+static p_char  *PARM_OWN_NAME              	= PARM_DEFAULT_OWN_NAME;
+static p_char  *PARM_OWN_SSID              	= PARM_DEFAULT_SSID;
+static p_u16	PARM_PM_ENABLED            	= WVLAN_PM_STATE_DISABLED;
+static p_u16    PARM_PM_HOLDOVER_DURATION  	= PARM_DEFAULT_PM_HOLDOVER_DURATION;
+static p_u8     PARM_PORT_TYPE             	= PARM_DEFAULT_PORT_TYPE;
+static p_char  *PARM_PROMISCUOUS_MODE      	= PARM_DEFAULT_PROMISCUOUS_MODE_STR;
+static p_char  *PARM_REJECT_ANY            	= PARM_DEFAULT_REJECT_ANY_STR;
+#ifdef USE_WDS
+static p_u16    PARM_RTS_THRESHOLD1        	= PARM_DEFAULT_RTS_THRESHOLD;
+static p_u16    PARM_RTS_THRESHOLD2        	= PARM_DEFAULT_RTS_THRESHOLD;
+static p_u16    PARM_RTS_THRESHOLD3        	= PARM_DEFAULT_RTS_THRESHOLD;
+static p_u16    PARM_RTS_THRESHOLD4        	= PARM_DEFAULT_RTS_THRESHOLD;
+static p_u16    PARM_RTS_THRESHOLD5        	= PARM_DEFAULT_RTS_THRESHOLD;
+static p_u16    PARM_RTS_THRESHOLD6        	= PARM_DEFAULT_RTS_THRESHOLD;
+#endif // USE_WDS
+static p_u16    PARM_RTS_THRESHOLD         	= PARM_DEFAULT_RTS_THRESHOLD;
+static p_u16    PARM_SRSC_2GHZ             	= PARM_DEFAULT_SRSC_2GHZ;
+static p_u16    PARM_SRSC_5GHZ             	= PARM_DEFAULT_SRSC_5GHZ;
+static p_u8     PARM_SYSTEM_SCALE          	= PARM_DEFAULT_SYSTEM_SCALE;
+static p_u8     PARM_TX_KEY                	= PARM_DEFAULT_TX_KEY;
+static p_u16    PARM_TX_POW_LEVEL          	= PARM_DEFAULT_TX_POW_LEVEL;
+#ifdef USE_WDS
+static p_u16    PARM_TX_RATE1              	= PARM_DEFAULT_TX_RATE_2GHZ;
+static p_u16    PARM_TX_RATE2              	= PARM_DEFAULT_TX_RATE_2GHZ;
+static p_u16    PARM_TX_RATE3              	= PARM_DEFAULT_TX_RATE_2GHZ;
+static p_u16    PARM_TX_RATE4              	= PARM_DEFAULT_TX_RATE_2GHZ;
+static p_u16    PARM_TX_RATE5              	= PARM_DEFAULT_TX_RATE_2GHZ;
+static p_u16    PARM_TX_RATE6              	= PARM_DEFAULT_TX_RATE_2GHZ;
+#endif // USE_WDS
+static p_u16    PARM_TX_RATE               	= PARM_DEFAULT_TX_RATE_2GHZ;
+#ifdef USE_WDS
+static p_u8     PARM_WDS_ADDRESS1[ETH_ALEN]	= PARM_DEFAULT_NETWORK_ADDR;
+static p_u8     PARM_WDS_ADDRESS2[ETH_ALEN]	= PARM_DEFAULT_NETWORK_ADDR;
+static p_u8     PARM_WDS_ADDRESS3[ETH_ALEN]	= PARM_DEFAULT_NETWORK_ADDR;
+static p_u8     PARM_WDS_ADDRESS4[ETH_ALEN]	= PARM_DEFAULT_NETWORK_ADDR;
+static p_u8     PARM_WDS_ADDRESS5[ETH_ALEN]	= PARM_DEFAULT_NETWORK_ADDR;
+static p_u8     PARM_WDS_ADDRESS6[ETH_ALEN]	= PARM_DEFAULT_NETWORK_ADDR;
+#endif // USE_WDS
+
+
+#if 0
+MODULE_PARM(PARM_DESIRED_SSID,          "s");
+MODULE_PARM_DESC(PARM_DESIRED_SSID,             "Network Name (<string>) [ANY]");
+MODULE_PARM(PARM_OWN_SSID,              "s");
+MODULE_PARM_DESC(PARM_OWN_SSID,                 "Network Name (<string>) [ANY]");
+MODULE_PARM(PARM_OWN_CHANNEL,           "b");
+MODULE_PARM_DESC(PARM_OWN_CHANNEL,              "Channel (0 - 14) [0]");
+MODULE_PARM(PARM_SYSTEM_SCALE,          "b");
+MODULE_PARM_DESC(PARM_SYSTEM_SCALE,             "Distance Between APs (1 - 3) [1]");
+MODULE_PARM(PARM_TX_RATE,               "b");
+MODULE_PARM_DESC(PARM_TX_RATE,                  "Transmit Rate Control");
+MODULE_PARM(PARM_RTS_THRESHOLD,         "h");
+MODULE_PARM_DESC(PARM_RTS_THRESHOLD,            "Medium Reservation (RTS/CTS Fragment Length) (256 - 2347) [2347]");
+MODULE_PARM(PARM_MICROWAVE_ROBUSTNESS,  "s");
+MODULE_PARM_DESC(PARM_MICROWAVE_ROBUSTNESS,     "Microwave Oven Robustness Enabled (<string> N or Y) [N]");
+MODULE_PARM(PARM_OWN_NAME,              "s");
+MODULE_PARM_DESC(PARM_OWN_NAME,                 "Station Name (<string>) [Linux]");
+
+MODULE_PARM(PARM_ENABLE_ENCRYPTION,     "b");
+MODULE_PARM_DESC(PARM_ENABLE_ENCRYPTION,        "Encryption Mode (0 - 7) [0]");
+
+MODULE_PARM(PARM_KEY1,                  "s");
+MODULE_PARM_DESC(PARM_KEY1,                     "Data Encryption Key 1 (<string>) []");
+MODULE_PARM(PARM_KEY2,                  "s");
+MODULE_PARM_DESC(PARM_KEY2,                     "Data Encryption Key 2 (<string>) []");
+MODULE_PARM(PARM_KEY3,                  "s");
+MODULE_PARM_DESC(PARM_KEY3,                     "Data Encryption Key 3 (<string>) []");
+MODULE_PARM(PARM_KEY4,                  "s");
+MODULE_PARM_DESC(PARM_KEY4,                     "Data Encryption Key 4 (<string>) []");
+MODULE_PARM(PARM_TX_KEY,                "b");
+MODULE_PARM_DESC(PARM_TX_KEY,                   "Transmit Key ID (1 - 4) [1]");
+MODULE_PARM(PARM_MULTICAST_RATE,        "b");
+MODULE_PARM_DESC(PARM_MULTICAST_RATE,           "Multicast Rate");
+MODULE_PARM(PARM_DOWNLOAD_FIRMWARE,     "s");
+MODULE_PARM_DESC(PARM_DOWNLOAD_FIRMWARE,        "filename of firmware image");
+
+MODULE_PARM(PARM_AUTH_KEY_MGMT_SUITE,   "b");
+MODULE_PARM_DESC(PARM_AUTH_KEY_MGMT_SUITE,      "Authentication Key Management suite (0-4) [0]");
+
+MODULE_PARM(PARM_LOAD_BALANCING,        "s");
+MODULE_PARM_DESC(PARM_LOAD_BALANCING,           "Load Balancing Enabled (<string> N or Y) [Y]");
+MODULE_PARM(PARM_MEDIUM_DISTRIBUTION,   "s");
+MODULE_PARM_DESC(PARM_MEDIUM_DISTRIBUTION,      "Medium Distribution Enabled (<string> N or Y) [Y]");
+MODULE_PARM(PARM_TX_POW_LEVEL,          "b");
+MODULE_PARM_DESC(PARM_TX_POW_LEVEL,             "Transmit Power (0 - 6) [3]");
+MODULE_PARM(PARM_SRSC_2GHZ,             "b");
+MODULE_PARM_DESC(PARM_SRSC_2GHZ,                "Supported Rate Set Control 2.4 GHz");
+MODULE_PARM(PARM_SRSC_5GHZ,             "b");
+MODULE_PARM_DESC(PARM_SRSC_5GHZ,                "Supported Rate Set Control 5.0 GHz");
+MODULE_PARM(PARM_BRSC_2GHZ,             "b");
+MODULE_PARM_DESC(PARM_BRSC_2GHZ,                "Basic Rate Set Control 2.4 GHz");
+MODULE_PARM(PARM_BRSC_5GHZ,             "b");
+MODULE_PARM_DESC(PARM_BRSC_5GHZ,                "Basic Rate Set Control 5.0 GHz");
+#if 1 //;? (HCF_TYPE) & HCF_TYPE_STA
+//;?seems reasonable that even an AP-only driver could afford this small additional footprint
+MODULE_PARM(PARM_PM_ENABLED,            "h");
+MODULE_PARM_DESC(PARM_PM_ENABLED,               "Power Management State (0 - 2, 8001 - 8002) [0]");
+MODULE_PARM(PARM_PORT_TYPE,             "b");
+MODULE_PARM_DESC(PARM_PORT_TYPE,                "Port Type (1 - 3) [1]");
+//;?MODULE_PARM(PARM_CREATE_IBSS,           "s");
+//;?MODULE_PARM_DESC(PARM_CREATE_IBSS,              "Create IBSS (<string> N or Y) [N]");
+//;?MODULE_PARM(PARM_MULTICAST_RX,          "s");
+//;?MODULE_PARM_DESC(PARM_MULTICAST_RX,             "Multicast Receive Enable (<string> N or Y) [Y]");
+//;?MODULE_PARM(PARM_MAX_SLEEP,             "h");
+//;?MODULE_PARM_DESC(PARM_MAX_SLEEP,                "Maximum Power Management Sleep Duration (0 - 65535) [100]");
+//;?MODULE_PARM(PARM_NETWORK_ADDR,          "6b");
+//;?MODULE_PARM_DESC(PARM_NETWORK_ADDR,             "Hardware Ethernet Address ([0x00-0xff],[0x00-0xff],[0x00-0xff],[0x00-0xff],[0x00-0xff],[0x00-0xff]) [<factory value>]");
+//;?MODULE_PARM(PARM_AUTHENTICATION,        "b");
+//
+//tracker 12448
+//;?MODULE_PARM_DESC(PARM_AUTHENTICATION,           "Authentication Type (0-2) [0] 0=Open 1=SharedKey 2=LEAP");
+//;?MODULE_PARM_DESC(authentication,         "Authentication Type (1-2) [1] 1=Open 2=SharedKey");
+//tracker 12448
+//
+//;?MODULE_PARM(PARM_OWN_ATIM_WINDOW,       "b");
+//;?MODULE_PARM_DESC(PARM_OWN_ATIM_WINDOW,          "ATIM Window time in TU for IBSS creation (0-100) [0]");
+//;?MODULE_PARM(PARM_PM_HOLDOVER_DURATION,  "b");
+//;?MODULE_PARM_DESC(PARM_PM_HOLDOVER_DURATION,     "Time station remains awake after MAC frame transfer when PM is on (0-65535) [100]");
+//;?MODULE_PARM(PARM_PROMISCUOUS_MODE,      "s");
+//;?MODULE_PARM_DESC(PARM_PROMISCUOUS_MODE,         "Promiscuous Mode Enable (<string> Y or N ) [N]" );
+//;?
+MODULE_PARM(PARM_CONNECTION_CONTROL,    "b");
+MODULE_PARM_DESC(PARM_CONNECTION_CONTROL,       "Connection Control (0 - 3) [2]");
+#endif /* HCF_STA */
+#if 1 //;? (HCF_TYPE) & HCF_TYPE_AP
+					//;?should we restore this to allow smaller memory footprint
+MODULE_PARM(PARM_OWN_DTIM_PERIOD,       "b");
+MODULE_PARM_DESC(PARM_OWN_DTIM_PERIOD,          "DTIM Period (0 - 255) [1]");
+MODULE_PARM(PARM_REJECT_ANY,            "s");
+MODULE_PARM_DESC(PARM_REJECT_ANY,               "Closed System (<string> N or Y) [N]");
+MODULE_PARM(PARM_EXCLUDE_UNENCRYPTED,   "s");
+MODULE_PARM_DESC(PARM_EXCLUDE_UNENCRYPTED,      "Deny non-encrypted (<string> N or Y) [Y]");
+MODULE_PARM(PARM_MULTICAST_PM_BUFFERING,"s");
+MODULE_PARM_DESC(PARM_MULTICAST_PM_BUFFERING,   "Buffer MAC frames for Tx after DTIM (<string> Y or N) [Y]");
+MODULE_PARM(PARM_INTRA_BSS_RELAY,       "s");
+MODULE_PARM_DESC(PARM_INTRA_BSS_RELAY,          "IntraBSS Relay (<string> N or Y) [Y]");
+MODULE_PARM(PARM_RTS_THRESHOLD1,        "h");
+MODULE_PARM_DESC(PARM_RTS_THRESHOLD1,           "RTS Threshold, WDS Port 1 (256 - 2347) [2347]");
+MODULE_PARM(PARM_RTS_THRESHOLD2,        "h");
+MODULE_PARM_DESC(PARM_RTS_THRESHOLD2,           "RTS Threshold, WDS Port 2 (256 - 2347) [2347]");
+MODULE_PARM(PARM_RTS_THRESHOLD3,        "h");
+MODULE_PARM_DESC(PARM_RTS_THRESHOLD3,           "RTS Threshold, WDS Port 3 (256 - 2347) [2347]");
+MODULE_PARM(PARM_RTS_THRESHOLD4,        "h");
+MODULE_PARM_DESC(PARM_RTS_THRESHOLD4,           "RTS Threshold, WDS Port 4 (256 - 2347) [2347]");
+MODULE_PARM(PARM_RTS_THRESHOLD5,        "h");
+MODULE_PARM_DESC(PARM_RTS_THRESHOLD5,           "RTS Threshold, WDS Port 5 (256 - 2347) [2347]");
+MODULE_PARM(PARM_RTS_THRESHOLD6,        "h");
+MODULE_PARM_DESC(PARM_RTS_THRESHOLD6,           "RTS Threshold, WDS Port 6 (256 - 2347) [2347]");
+MODULE_PARM(PARM_TX_RATE1,              "b");
+MODULE_PARM_DESC(PARM_TX_RATE1,                 "Transmit Rate Control, WDS Port 1 (1 - 7) [3]");
+MODULE_PARM(PARM_TX_RATE2,              "b");
+MODULE_PARM_DESC(PARM_TX_RATE2,                 "Transmit Rate Control, WDS Port 2 (1 - 7) [3]");
+MODULE_PARM(PARM_TX_RATE3,              "b");
+MODULE_PARM_DESC(PARM_TX_RATE3,                 "Transmit Rate Control, WDS Port 3 (1 - 7) [3]");
+MODULE_PARM(PARM_TX_RATE4,              "b");
+MODULE_PARM_DESC(PARM_TX_RATE4,                 "Transmit Rate Control, WDS Port 4 (1 - 7) [3]");
+MODULE_PARM(PARM_TX_RATE5,              "b");
+MODULE_PARM_DESC(PARM_TX_RATE5,                 "Transmit Rate Control, WDS Port 5 (1 - 7) [3]");
+MODULE_PARM(PARM_TX_RATE6,              "b");
+MODULE_PARM_DESC(PARM_TX_RATE6,                 "Transmit Rate Control, WDS Port 6 (1 - 7) [3]");
+MODULE_PARM(PARM_WDS_ADDRESS1,          "6b");
+MODULE_PARM_DESC(PARM_WDS_ADDRESS1,             "MAC Address, WDS Port 1 ([0x00-0xff],[0x00-0xff],[0x00-0xff],[0x00-0xff],[0x00-0xff],[0x00-0xff]) [{0}]");
+MODULE_PARM(PARM_WDS_ADDRESS2,          "6b");
+MODULE_PARM_DESC(PARM_WDS_ADDRESS2,             "MAC Address, WDS Port 2 ([0x00-0xff],[0x00-0xff],[0x00-0xff],[0x00-0xff],[0x00-0xff],[0x00-0xff]) [{0}]");
+MODULE_PARM(PARM_WDS_ADDRESS3,          "6b");
+MODULE_PARM_DESC(PARM_WDS_ADDRESS3,             "MAC Address, WDS Port 3 ([0x00-0xff],[0x00-0xff],[0x00-0xff],[0x00-0xff],[0x00-0xff],[0x00-0xff]) [{0}]");
+MODULE_PARM(PARM_WDS_ADDRESS4,          "6b");
+MODULE_PARM_DESC(PARM_WDS_ADDRESS4,             "MAC Address, WDS Port 4 ([0x00-0xff],[0x00-0xff],[0x00-0xff],[0x00-0xff],[0x00-0xff],[0x00-0xff]) [{0}]");
+MODULE_PARM(PARM_WDS_ADDRESS5,          "6b");
+MODULE_PARM_DESC(PARM_WDS_ADDRESS5,             "MAC Address, WDS Port 5 ([0x00-0xff],[0x00-0xff],[0x00-0xff],[0x00-0xff],[0x00-0xff],[0x00-0xff]) [{0}]");
+MODULE_PARM(PARM_WDS_ADDRESS6,          "6b");
+MODULE_PARM_DESC(PARM_WDS_ADDRESS6,             "MAC Address, WDS Port 6 ([0x00-0xff],[0x00-0xff],[0x00-0xff],[0x00-0xff],[0x00-0xff],[0x00-0xff]) [{0}]");
+
+MODULE_PARM(PARM_OWN_BEACON_INTERVAL,   "b");
+MODULE_PARM_DESC(PARM_OWN_BEACON_INTERVAL,      "Own Beacon Interval (20 - 200) [100]");
+MODULE_PARM(PARM_COEXISTENCE,   "b");
+MODULE_PARM_DESC(PARM_COEXISTENCE,      "Coexistence (0-7) [0]");
+
+#endif /* HCF_AP */
+#endif
+
+/* END NEW PARAMETERS */
+/*******************************************************************************
+ * debugging specifics
+ ******************************************************************************/
+#if DBG
+
+static p_u32    pc_debug = DBG_LVL;
+//MODULE_PARM(pc_debug, "i");
+/*static ;?conflicts with my understanding of CL parameters and breaks now I moved
+ * the correspondig logic to wl_profile
+ */ p_u32    DebugFlag = ~0; //recognizable "undefined value" rather then DBG_DEFAULTS;
+//MODULE_PARM(DebugFlag, "l");
+
+dbg_info_t   wl_info = { DBG_MOD_NAME, 0, 0 };
+dbg_info_t  *DbgInfo = &wl_info;
+
+#endif /* DBG */
+#ifdef USE_RTS
+
+static p_char  *useRTS = "N";
+MODULE_PARM( useRTS, "s" );
+MODULE_PARM_DESC( useRTS, "Use RTS test interface (<string> N or Y) [N]" );
+
+#endif  /* USE_RTS */
+/*******************************************************************************
+ * firmware download specifics
+ ******************************************************************************/
+extern struct CFG_RANGE2_STRCT BASED
+	cfg_drv_act_ranges_pri; 	    // describes primary-actor range of HCF
+
+#if 0 //;? (HCF_TYPE) & HCF_TYPE_AP
+extern memimage ap;                 // AP firmware image to be downloaded
+#endif /* HCF_AP */
+
+#if 1 //;? (HCF_TYPE) & HCF_TYPE_STA
+//extern memimage station;            // STA firmware image to be downloaded
+extern memimage fw_image;            // firmware image to be downloaded
+#endif /* HCF_STA */
+
+
+/*******************************************************************************
+ *	wl_insert()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      wl_insert() is scheduled to run after a CARD_INSERTION event is
+ *  received, to configure the PCMCIA socket, and to make the ethernet device
+ *  available to the system.
+ *
+ *  PARAMETERS:
+ *
+ *      dev - a pointer to the net_device struct of the wireless device
+ *
+ *  RETURNS:
+ *
+ *      TRUE or FALSE
+ *
+ ******************************************************************************/
+int wl_insert( struct net_device *dev )
+{
+	int                     result = 0;
+	int                     hcf_status = HCF_SUCCESS;
+	int                     i;
+	unsigned long           flags = 0;
+	struct wl_private       *lp = wl_priv(dev);
+	/*------------------------------------------------------------------------*/
+	DBG_FUNC( "wl_insert" );
+	DBG_ENTER( DbgInfo );
+
+	/* Initialize the adapter hardware. */
+	memset( &( lp->hcfCtx ), 0, sizeof( IFB_STRCT ));
+
+	/* Initialize the adapter parameters. */
+	spin_lock_init( &( lp->slock ));
+
+	/* Intialize states */
+	//lp->lockcount = 0; //PE1DNN
+        lp->is_handling_int = WL_NOT_HANDLING_INT;
+	lp->firmware_present = WL_FRIMWARE_NOT_PRESENT;
+
+	lp->dev = dev;
+
+	DBG_PARAM( DbgInfo, "irq_mask", "0x%04x", irq_mask & 0x0FFFF );
+	DBG_PARAM( DbgInfo, "irq_list", "0x%02x 0x%02x 0x%02x 0x%02x",
+			   irq_list[0] & 0x0FF, irq_list[1] & 0x0FF,
+			   irq_list[2] & 0x0FF, irq_list[3] & 0x0FF );
+	DBG_PARAM( DbgInfo, PARM_NAME_DESIRED_SSID, "\"%s\"", PARM_DESIRED_SSID );
+	DBG_PARAM( DbgInfo, PARM_NAME_OWN_SSID, "\"%s\"", PARM_OWN_SSID );
+	DBG_PARAM( DbgInfo, PARM_NAME_OWN_CHANNEL, "%d", PARM_OWN_CHANNEL);
+	DBG_PARAM( DbgInfo, PARM_NAME_SYSTEM_SCALE, "%d", PARM_SYSTEM_SCALE );
+	DBG_PARAM( DbgInfo, PARM_NAME_TX_RATE, "%d", PARM_TX_RATE );
+	DBG_PARAM( DbgInfo, PARM_NAME_RTS_THRESHOLD, "%d", PARM_RTS_THRESHOLD );
+	DBG_PARAM( DbgInfo, PARM_NAME_MICROWAVE_ROBUSTNESS, "\"%s\"", PARM_MICROWAVE_ROBUSTNESS );
+	DBG_PARAM( DbgInfo, PARM_NAME_OWN_NAME, "\"%s\"", PARM_OWN_NAME );
+//;?		DBG_PARAM( DbgInfo, PARM_NAME_ENABLE_ENCRYPTION, "\"%s\"", PARM_ENABLE_ENCRYPTION );
+	DBG_PARAM( DbgInfo, PARM_NAME_KEY1, "\"%s\"", PARM_KEY1 );
+	DBG_PARAM( DbgInfo, PARM_NAME_KEY2, "\"%s\"", PARM_KEY2 );
+	DBG_PARAM( DbgInfo, PARM_NAME_KEY3, "\"%s\"", PARM_KEY3 );
+	DBG_PARAM( DbgInfo, PARM_NAME_KEY4, "\"%s\"", PARM_KEY4 );
+	DBG_PARAM( DbgInfo, PARM_NAME_TX_KEY, "%d", PARM_TX_KEY );
+	DBG_PARAM( DbgInfo, PARM_NAME_MULTICAST_RATE, "%d", PARM_MULTICAST_RATE );
+	DBG_PARAM( DbgInfo, PARM_NAME_DOWNLOAD_FIRMWARE, "\"%s\"", PARM_DOWNLOAD_FIRMWARE );
+	DBG_PARAM( DbgInfo, PARM_NAME_AUTH_KEY_MGMT_SUITE, "%d", PARM_AUTH_KEY_MGMT_SUITE );
+//;?#if (HCF_TYPE) & HCF_TYPE_STA
+					//;?should we make this code conditional depending on in STA mode
+//;?        DBG_PARAM( DbgInfo, PARM_NAME_PORT_TYPE, "%d", PARM_PORT_TYPE );
+		DBG_PARAM( DbgInfo, PARM_NAME_PM_ENABLED, "%04x", PARM_PM_ENABLED );
+//;?        DBG_PARAM( DbgInfo, PARM_NAME_CREATE_IBSS, "\"%s\"", PARM_CREATE_IBSS );
+//;?        DBG_PARAM( DbgInfo, PARM_NAME_MULTICAST_RX, "\"%s\"", PARM_MULTICAST_RX );
+//;?        DBG_PARAM( DbgInfo, PARM_NAME_MAX_SLEEP, "%d", PARM_MAX_SLEEP );
+//;?        DBG_PARAM( DbgInfo, PARM_NAME_NETWORK_ADDR, "\"%s\"", DbgHwAddr( PARM_NETWORK_ADDR ));
+//;?        DBG_PARAM( DbgInfo, PARM_NAME_AUTHENTICATION, "%d", PARM_AUTHENTICATION );
+//;?        DBG_PARAM( DbgInfo, PARM_NAME_OWN_ATIM_WINDOW, "%d", PARM_OWN_ATIM_WINDOW );
+//;?        DBG_PARAM( DbgInfo, PARM_NAME_PM_HOLDOVER_DURATION, "%d", PARM_PM_HOLDOVER_DURATION );
+//;?        DBG_PARAM( DbgInfo, PARM_NAME_PROMISCUOUS_MODE, "\"%s\"", PARM_PROMISCUOUS_MODE );
+//;?#endif /* HCF_STA */
+#if 1 //;? (HCF_TYPE) & HCF_TYPE_AP
+		//;?should we restore this to allow smaller memory footprint
+		//;?I guess: no, since this is Debug mode only
+	DBG_PARAM( DbgInfo, PARM_NAME_OWN_DTIM_PERIOD, "%d", PARM_OWN_DTIM_PERIOD );
+	DBG_PARAM( DbgInfo, PARM_NAME_REJECT_ANY, "\"%s\"", PARM_REJECT_ANY );
+	DBG_PARAM( DbgInfo, PARM_NAME_EXCLUDE_UNENCRYPTED, "\"%s\"", PARM_EXCLUDE_UNENCRYPTED );
+	DBG_PARAM( DbgInfo, PARM_NAME_MULTICAST_PM_BUFFERING, "\"%s\"", PARM_MULTICAST_PM_BUFFERING );
+	DBG_PARAM( DbgInfo, PARM_NAME_INTRA_BSS_RELAY, "\"%s\"", PARM_INTRA_BSS_RELAY );
+#ifdef USE_WDS
+	DBG_PARAM( DbgInfo, PARM_NAME_RTS_THRESHOLD1, "%d", PARM_RTS_THRESHOLD1 );
+	DBG_PARAM( DbgInfo, PARM_NAME_RTS_THRESHOLD2, "%d", PARM_RTS_THRESHOLD2 );
+	DBG_PARAM( DbgInfo, PARM_NAME_RTS_THRESHOLD3, "%d", PARM_RTS_THRESHOLD3 );
+	DBG_PARAM( DbgInfo, PARM_NAME_RTS_THRESHOLD4, "%d", PARM_RTS_THRESHOLD4 );
+	DBG_PARAM( DbgInfo, PARM_NAME_RTS_THRESHOLD5, "%d", PARM_RTS_THRESHOLD5 );
+	DBG_PARAM( DbgInfo, PARM_NAME_RTS_THRESHOLD6, "%d", PARM_RTS_THRESHOLD6 );
+	DBG_PARAM( DbgInfo, PARM_NAME_TX_RATE1, "%d", PARM_TX_RATE1 );
+	DBG_PARAM( DbgInfo, PARM_NAME_TX_RATE2, "%d", PARM_TX_RATE2 );
+	DBG_PARAM( DbgInfo, PARM_NAME_TX_RATE3, "%d", PARM_TX_RATE3 );
+	DBG_PARAM( DbgInfo, PARM_NAME_TX_RATE4, "%d", PARM_TX_RATE4 );
+	DBG_PARAM( DbgInfo, PARM_NAME_TX_RATE5, "%d", PARM_TX_RATE5 );
+	DBG_PARAM( DbgInfo, PARM_NAME_TX_RATE6, "%d", PARM_TX_RATE6 );
+	DBG_PARAM( DbgInfo, PARM_NAME_WDS_ADDRESS1, "\"%s\"", DbgHwAddr( PARM_WDS_ADDRESS1 ));
+	DBG_PARAM( DbgInfo, PARM_NAME_WDS_ADDRESS2, "\"%s\"", DbgHwAddr( PARM_WDS_ADDRESS2 ));
+	DBG_PARAM( DbgInfo, PARM_NAME_WDS_ADDRESS3, "\"%s\"", DbgHwAddr( PARM_WDS_ADDRESS3 ));
+	DBG_PARAM( DbgInfo, PARM_NAME_WDS_ADDRESS4, "\"%s\"", DbgHwAddr( PARM_WDS_ADDRESS4 ));
+	DBG_PARAM( DbgInfo, PARM_NAME_WDS_ADDRESS5, "\"%s\"", DbgHwAddr( PARM_WDS_ADDRESS5 ));
+	DBG_PARAM( DbgInfo, PARM_NAME_WDS_ADDRESS6, "\"%s\"", DbgHwAddr( PARM_WDS_ADDRESS6 ));
+#endif /* USE_WDS */
+#endif /* HCF_AP */
+
+	VALID_PARAM( !PARM_DESIRED_SSID || ( strlen( PARM_DESIRED_SSID ) <= PARM_MAX_NAME_LEN ));
+	VALID_PARAM( !PARM_OWN_SSID || ( strlen( PARM_OWN_SSID ) <= PARM_MAX_NAME_LEN ));
+	VALID_PARAM(( PARM_OWN_CHANNEL <= PARM_MAX_OWN_CHANNEL ));
+	VALID_PARAM(( PARM_SYSTEM_SCALE >= PARM_MIN_SYSTEM_SCALE ) && ( PARM_SYSTEM_SCALE <= PARM_MAX_SYSTEM_SCALE ));
+	VALID_PARAM(( PARM_TX_RATE >= PARM_MIN_TX_RATE ) && ( PARM_TX_RATE <= PARM_MAX_TX_RATE ));
+	VALID_PARAM(( PARM_RTS_THRESHOLD <= PARM_MAX_RTS_THRESHOLD ));
+	VALID_PARAM( !PARM_MICROWAVE_ROBUSTNESS || strchr( "NnYy", PARM_MICROWAVE_ROBUSTNESS[0] ) != NULL );
+	VALID_PARAM( !PARM_OWN_NAME || ( strlen( PARM_NAME_OWN_NAME ) <= PARM_MAX_NAME_LEN ));
+	VALID_PARAM(( PARM_ENABLE_ENCRYPTION <= PARM_MAX_ENABLE_ENCRYPTION ));
+	VALID_PARAM( is_valid_key_string( PARM_KEY1 ));
+	VALID_PARAM( is_valid_key_string( PARM_KEY2 ));
+	VALID_PARAM( is_valid_key_string( PARM_KEY3 ));
+	VALID_PARAM( is_valid_key_string( PARM_KEY4 ));
+	VALID_PARAM(( PARM_TX_KEY >= PARM_MIN_TX_KEY ) && ( PARM_TX_KEY <= PARM_MAX_TX_KEY ));
+
+	VALID_PARAM(( PARM_MULTICAST_RATE >= PARM_MIN_MULTICAST_RATE ) &&
+					( PARM_MULTICAST_RATE <= PARM_MAX_MULTICAST_RATE ));
+
+	VALID_PARAM( !PARM_DOWNLOAD_FIRMWARE || ( strlen( PARM_DOWNLOAD_FIRMWARE ) <= 255 /*;?*/ ));
+	VALID_PARAM(( PARM_AUTH_KEY_MGMT_SUITE < PARM_MAX_AUTH_KEY_MGMT_SUITE ));
+
+	VALID_PARAM( !PARM_LOAD_BALANCING || strchr( "NnYy", PARM_LOAD_BALANCING[0] ) != NULL );
+	VALID_PARAM( !PARM_MEDIUM_DISTRIBUTION || strchr( "NnYy", PARM_MEDIUM_DISTRIBUTION[0] ) != NULL );
+	VALID_PARAM(( PARM_TX_POW_LEVEL <= PARM_MAX_TX_POW_LEVEL ));
+
+ 	VALID_PARAM(( PARM_PORT_TYPE >= PARM_MIN_PORT_TYPE ) && ( PARM_PORT_TYPE <= PARM_MAX_PORT_TYPE ));
+	VALID_PARAM( PARM_PM_ENABLED <= WVLAN_PM_STATE_STANDARD ||
+				 ( PARM_PM_ENABLED & 0x7FFF ) <= WVLAN_PM_STATE_STANDARD );
+ 	VALID_PARAM( !PARM_CREATE_IBSS || strchr( "NnYy", PARM_CREATE_IBSS[0] ) != NULL );
+ 	VALID_PARAM( !PARM_MULTICAST_RX || strchr( "NnYy", PARM_MULTICAST_RX[0] ) != NULL );
+ 	VALID_PARAM(( PARM_MAX_SLEEP <= PARM_MAX_MAX_PM_SLEEP ));
+ 	VALID_PARAM(( PARM_AUTHENTICATION <= PARM_MAX_AUTHENTICATION ));
+ 	VALID_PARAM(( PARM_OWN_ATIM_WINDOW <= PARM_MAX_OWN_ATIM_WINDOW ));
+ 	VALID_PARAM(( PARM_PM_HOLDOVER_DURATION <= PARM_MAX_PM_HOLDOVER_DURATION ));
+ 	VALID_PARAM( !PARM_PROMISCUOUS_MODE || strchr( "NnYy", PARM_PROMISCUOUS_MODE[0] ) != NULL );
+	VALID_PARAM(( PARM_CONNECTION_CONTROL <= PARM_MAX_CONNECTION_CONTROL ));
+
+	VALID_PARAM(( PARM_OWN_DTIM_PERIOD >= PARM_MIN_OWN_DTIM_PERIOD ));
+	VALID_PARAM( !PARM_REJECT_ANY || strchr( "NnYy", PARM_REJECT_ANY[0] ) != NULL );
+	VALID_PARAM( !PARM_EXCLUDE_UNENCRYPTED || strchr( "NnYy", PARM_EXCLUDE_UNENCRYPTED[0] ) != NULL );
+	VALID_PARAM( !PARM_MULTICAST_PM_BUFFERING || strchr( "NnYy", PARM_MULTICAST_PM_BUFFERING[0] ) != NULL );
+	VALID_PARAM( !PARM_INTRA_BSS_RELAY || strchr( "NnYy", PARM_INTRA_BSS_RELAY[0] ) != NULL );
+#ifdef USE_WDS
+	VALID_PARAM(( PARM_RTS_THRESHOLD1 <= PARM_MAX_RTS_THRESHOLD ));
+	VALID_PARAM(( PARM_RTS_THRESHOLD2 <= PARM_MAX_RTS_THRESHOLD ));
+	VALID_PARAM(( PARM_RTS_THRESHOLD3 <= PARM_MAX_RTS_THRESHOLD ));
+	VALID_PARAM(( PARM_RTS_THRESHOLD4 <= PARM_MAX_RTS_THRESHOLD ));
+	VALID_PARAM(( PARM_RTS_THRESHOLD5 <= PARM_MAX_RTS_THRESHOLD ));
+	VALID_PARAM(( PARM_RTS_THRESHOLD6 <= PARM_MAX_RTS_THRESHOLD ));
+	VALID_PARAM(( PARM_TX_RATE1 >= PARM_MIN_TX_RATE ) && (PARM_TX_RATE1 <= PARM_MAX_TX_RATE ));
+	VALID_PARAM(( PARM_TX_RATE2 >= PARM_MIN_TX_RATE ) && (PARM_TX_RATE2 <= PARM_MAX_TX_RATE ));
+	VALID_PARAM(( PARM_TX_RATE3 >= PARM_MIN_TX_RATE ) && (PARM_TX_RATE3 <= PARM_MAX_TX_RATE ));
+	VALID_PARAM(( PARM_TX_RATE4 >= PARM_MIN_TX_RATE ) && (PARM_TX_RATE4 <= PARM_MAX_TX_RATE ));
+	VALID_PARAM(( PARM_TX_RATE5 >= PARM_MIN_TX_RATE ) && (PARM_TX_RATE5 <= PARM_MAX_TX_RATE ));
+	VALID_PARAM(( PARM_TX_RATE6 >= PARM_MIN_TX_RATE ) && (PARM_TX_RATE6 <= PARM_MAX_TX_RATE ));
+#endif /* USE_WDS */
+
+	VALID_PARAM(( PARM_OWN_BEACON_INTERVAL >= PARM_MIN_OWN_BEACON_INTERVAL ) && ( PARM_OWN_BEACON_INTERVAL <= PARM_MAX_OWN_BEACON_INTERVAL ));
+	VALID_PARAM(( PARM_COEXISTENCE <= PARM_COEXISTENCE ));
+
+	/* Set the driver parameters from the passed in parameters. */
+
+	/* THESE MODULE PARAMETERS ARE TO BE DEPRECATED IN FAVOR OF A NAMING CONVENTION
+	   WHICH IS INLINE WITH THE FORTHCOMING WAVELAN API */
+
+	/* START NEW PARAMETERS */
+
+	lp->Channel             = PARM_OWN_CHANNEL;
+	lp->DistanceBetweenAPs  = PARM_SYSTEM_SCALE;
+
+	/* Need to determine how to handle the new bands for 5GHz */
+	lp->TxRateControl[0]    = PARM_DEFAULT_TX_RATE_2GHZ;
+	lp->TxRateControl[1]    = PARM_DEFAULT_TX_RATE_5GHZ;
+
+	lp->RTSThreshold        = PARM_RTS_THRESHOLD;
+
+	/* Need to determine how to handle the new bands for 5GHz */
+	lp->MulticastRate[0]    = PARM_DEFAULT_MULTICAST_RATE_2GHZ;
+	lp->MulticastRate[1]    = PARM_DEFAULT_MULTICAST_RATE_5GHZ;
+
+	if ( strchr( "Yy", PARM_MICROWAVE_ROBUSTNESS[0] ) != NULL ) {
+		lp->MicrowaveRobustness = 1;
+	} else {
+		lp->MicrowaveRobustness = 0;
+	}
+	if ( PARM_DESIRED_SSID && ( strlen( PARM_DESIRED_SSID ) <= HCF_MAX_NAME_LEN )) {
+		strcpy( lp->NetworkName, PARM_DESIRED_SSID );
+	}
+	if ( PARM_OWN_SSID && ( strlen( PARM_OWN_SSID ) <= HCF_MAX_NAME_LEN )) {
+		strcpy( lp->NetworkName, PARM_OWN_SSID );
+	}
+	if ( PARM_OWN_NAME && ( strlen( PARM_OWN_NAME ) <= HCF_MAX_NAME_LEN )) {
+		strcpy( lp->StationName, PARM_OWN_NAME );
+	}
+	lp->EnableEncryption = PARM_ENABLE_ENCRYPTION;
+	if ( PARM_KEY1 && ( strlen( PARM_KEY1 ) <= MAX_KEY_LEN )) {
+		strcpy( lp->Key1, PARM_KEY1 );
+	}
+	if ( PARM_KEY2 && ( strlen( PARM_KEY2 ) <= MAX_KEY_LEN )) {
+		strcpy( lp->Key2, PARM_KEY2 );
+	}
+	if ( PARM_KEY3 && ( strlen( PARM_KEY3 ) <= MAX_KEY_LEN )) {
+		strcpy( lp->Key3, PARM_KEY3 );
+	}
+	if ( PARM_KEY4 && ( strlen( PARM_KEY4 ) <= MAX_KEY_LEN )) {
+		strcpy( lp->Key4, PARM_KEY4 );
+	}
+
+	lp->TransmitKeyID = PARM_TX_KEY;
+
+	key_string2key( lp->Key1, &(lp->DefaultKeys.key[0] ));
+	key_string2key( lp->Key2, &(lp->DefaultKeys.key[1] ));
+	key_string2key( lp->Key3, &(lp->DefaultKeys.key[2] ));
+	key_string2key( lp->Key4, &(lp->DefaultKeys.key[3] ));
+
+	lp->DownloadFirmware = 1 ; //;?to be upgraded PARM_DOWNLOAD_FIRMWARE;
+	lp->AuthKeyMgmtSuite = PARM_AUTH_KEY_MGMT_SUITE;
+
+	if ( strchr( "Yy", PARM_LOAD_BALANCING[0] ) != NULL ) {
+		lp->loadBalancing = 1;
+	} else {
+		lp->loadBalancing = 0;
+	}
+
+	if ( strchr( "Yy", PARM_MEDIUM_DISTRIBUTION[0] ) != NULL ) {
+		lp->mediumDistribution = 1;
+	} else {
+		lp->mediumDistribution = 0;
+	}
+
+	lp->txPowLevel = PARM_TX_POW_LEVEL;
+
+	lp->srsc[0] = PARM_SRSC_2GHZ;
+	lp->srsc[1] = PARM_SRSC_5GHZ;
+	lp->brsc[0] = PARM_BRSC_2GHZ;
+	lp->brsc[1] = PARM_BRSC_5GHZ;
+#if 1 //;? (HCF_TYPE) & HCF_TYPE_STA
+//;?seems reasonable that even an AP-only driver could afford this small additional footprint
+	lp->PortType            = PARM_PORT_TYPE;
+	lp->MaxSleepDuration    = PARM_MAX_SLEEP;
+	lp->authentication      = PARM_AUTHENTICATION;
+	lp->atimWindow          = PARM_OWN_ATIM_WINDOW;
+	lp->holdoverDuration    = PARM_PM_HOLDOVER_DURATION;
+	lp->PMEnabled           = PARM_PM_ENABLED;  //;?
+	if ( strchr( "Yy", PARM_CREATE_IBSS[0] ) != NULL ) {
+		lp->CreateIBSS = 1;
+	} else {
+		lp->CreateIBSS = 0;
+	}
+	if ( strchr( "Nn", PARM_MULTICAST_RX[0] ) != NULL ) {
+		lp->MulticastReceive = 0;
+	} else {
+		lp->MulticastReceive = 1;
+	}
+	if ( strchr( "Yy", PARM_PROMISCUOUS_MODE[0] ) != NULL ) {
+		lp->promiscuousMode = 1;
+	} else {
+		lp->promiscuousMode = 0;
+	}
+	for( i = 0; i < ETH_ALEN; i++ ) {
+	   lp->MACAddress[i] = PARM_NETWORK_ADDR[i];
+	}
+
+	lp->connectionControl = PARM_CONNECTION_CONTROL;
+
+#endif /* HCF_STA */
+#if 1 //;? (HCF_TYPE) & HCF_TYPE_AP
+	//;?should we restore this to allow smaller memory footprint
+	lp->DTIMPeriod = PARM_OWN_DTIM_PERIOD;
+
+	if ( strchr( "Yy", PARM_REJECT_ANY[0] ) != NULL ) {
+		lp->RejectAny = 1;
+	} else {
+		lp->RejectAny = 0;
+	}
+	if ( strchr( "Nn", PARM_EXCLUDE_UNENCRYPTED[0] ) != NULL ) {
+		lp->ExcludeUnencrypted = 0;
+	} else {
+		lp->ExcludeUnencrypted = 1;
+	}
+	if ( strchr( "Yy", PARM_MULTICAST_PM_BUFFERING[0] ) != NULL ) {
+		lp->multicastPMBuffering = 1;
+	} else {
+		lp->multicastPMBuffering = 0;
+	}
+	if ( strchr( "Yy", PARM_INTRA_BSS_RELAY[0] ) != NULL ) {
+		lp->intraBSSRelay = 1;
+	} else {
+		lp->intraBSSRelay = 0;
+	}
+
+	lp->ownBeaconInterval = PARM_OWN_BEACON_INTERVAL;
+	lp->coexistence       = PARM_COEXISTENCE;
+
+#ifdef USE_WDS
+	lp->wds_port[0].rtsThreshold    = PARM_RTS_THRESHOLD1;
+	lp->wds_port[1].rtsThreshold    = PARM_RTS_THRESHOLD2;
+	lp->wds_port[2].rtsThreshold    = PARM_RTS_THRESHOLD3;
+	lp->wds_port[3].rtsThreshold    = PARM_RTS_THRESHOLD4;
+	lp->wds_port[4].rtsThreshold    = PARM_RTS_THRESHOLD5;
+	lp->wds_port[5].rtsThreshold    = PARM_RTS_THRESHOLD6;
+	lp->wds_port[0].txRateCntl      = PARM_TX_RATE1;
+	lp->wds_port[1].txRateCntl      = PARM_TX_RATE2;
+	lp->wds_port[2].txRateCntl      = PARM_TX_RATE3;
+	lp->wds_port[3].txRateCntl      = PARM_TX_RATE4;
+	lp->wds_port[4].txRateCntl      = PARM_TX_RATE5;
+	lp->wds_port[5].txRateCntl      = PARM_TX_RATE6;
+
+	for( i = 0; i < ETH_ALEN; i++ ) {
+		lp->wds_port[0].wdsAddress[i] = PARM_WDS_ADDRESS1[i];
+	}
+	for( i = 0; i < ETH_ALEN; i++ ) {
+		lp->wds_port[1].wdsAddress[i] = PARM_WDS_ADDRESS2[i];
+	}
+	for( i = 0; i < ETH_ALEN; i++ ) {
+		lp->wds_port[2].wdsAddress[i] = PARM_WDS_ADDRESS3[i];
+	}
+	for( i = 0; i < ETH_ALEN; i++ ) {
+		lp->wds_port[3].wdsAddress[i] = PARM_WDS_ADDRESS4[i];
+	}
+	for( i = 0; i < ETH_ALEN; i++ ) {
+		lp->wds_port[4].wdsAddress[i] = PARM_WDS_ADDRESS5[i];
+	}
+	for( i = 0; i < ETH_ALEN; i++ ) {
+		lp->wds_port[5].wdsAddress[i] = PARM_WDS_ADDRESS6[i];
+	}
+#endif  /* USE_WDS */
+#endif  /* HCF_AP */
+#ifdef USE_RTS
+	if ( strchr( "Yy", useRTS[0] ) != NULL ) {
+		lp->useRTS = 1;
+	} else {
+		lp->useRTS = 0;
+	}
+#endif  /* USE_RTS */
+
+
+	/* END NEW PARAMETERS */
+
+
+	wl_lock( lp, &flags );
+
+	/* Initialize the portState variable */
+	lp->portState = WVLAN_PORT_STATE_DISABLED;
+
+	/* Initialize the ScanResult struct */
+	memset( &( lp->scan_results ), 0, sizeof( lp->scan_results ));
+	lp->scan_results.scan_complete = FALSE;
+
+	/* Initialize the ProbeResult struct */
+	memset( &( lp->probe_results ), 0, sizeof( lp->probe_results ));
+	lp->probe_results.scan_complete = FALSE;
+	lp->probe_num_aps = 0;
+
+
+	/* Initialize Tx queue stuff */
+	memset( lp->txList, 0, sizeof( lp->txList ));
+
+	INIT_LIST_HEAD( &( lp->txFree ));
+
+	lp->txF.skb  = NULL;
+	lp->txF.port = 0;
+
+
+	for( i = 0; i < DEFAULT_NUM_TX_FRAMES; i++ ) {
+		list_add_tail( &( lp->txList[i].node ), &( lp->txFree ));
+	}
+
+
+	for( i = 0; i < WVLAN_MAX_TX_QUEUES; i++ ) {
+		INIT_LIST_HEAD( &( lp->txQ[i] ));
+	}
+
+	lp->netif_queue_on = TRUE;
+	lp->txQ_count = 0;
+	/* Initialize the use_dma element in the adapter structure. Not sure if
+	   this should be a compile-time or run-time configurable. So for now,
+	   implement as run-time and just define here */
+#ifdef WARP
+#ifdef ENABLE_DMA
+	DBG_TRACE( DbgInfo, "HERMES 2.5 BUSMASTER DMA MODE\n" );
+	lp->use_dma = 1;
+#else
+	DBG_TRACE( DbgInfo, "HERMES 2.5 PORT I/O MODE\n" );
+	lp->use_dma = 0;
+#endif // ENABLE_DMA
+#endif // WARP
+
+	/* Register the ISR handler information here, so that it's not done
+	   repeatedly in the ISR */
+        tasklet_init(&lp->task, wl_isr_handler, (unsigned long)lp);
+
+        /* Connect to the adapter */
+        DBG_TRACE( DbgInfo, "Calling hcf_connect()...\n" );
+        hcf_status = hcf_connect( &lp->hcfCtx, dev->base_addr );
+	//HCF_ERR_INCOMP_FW is acceptable, because download must still take place
+	//HCF_ERR_INCOMP_PRI is not acceptable
+	if ( hcf_status != HCF_SUCCESS && hcf_status != HCF_ERR_INCOMP_FW ) {
+		DBG_ERROR( DbgInfo, "hcf_connect() failed, status: 0x%x\n", hcf_status );
+		wl_unlock( lp, &flags );
+		goto hcf_failed;
+	}
+
+	//;?should set HCF_version and how about driver_stat
+	lp->driverInfo.IO_address       = dev->base_addr;
+	lp->driverInfo.IO_range         = HCF_NUM_IO_PORTS;	//;?conditionally 0x40 or 0x80 seems better
+	lp->driverInfo.IRQ_number       = dev->irq;
+	lp->driverInfo.card_stat        = lp->hcfCtx.IFB_CardStat;
+	//;? what happened to frame_type
+
+	/* Fill in the driver identity structure */
+	lp->driverIdentity.len              = ( sizeof( lp->driverIdentity ) / sizeof( hcf_16 )) - 1;
+	lp->driverIdentity.typ              = CFG_DRV_IDENTITY;
+	lp->driverIdentity.comp_id          = DRV_IDENTITY;
+	lp->driverIdentity.variant          = DRV_VARIANT;
+	lp->driverIdentity.version_major    = DRV_MAJOR_VERSION;
+	lp->driverIdentity.version_minor    = DRV_MINOR_VERSION;
+
+
+	/* Start the card here - This needs to be done in order to get the
+	   MAC address for the network layer */
+	DBG_TRACE( DbgInfo, "Calling wvlan_go() to perform a card reset...\n" );
+	hcf_status = wl_go( lp );
+
+	if ( hcf_status != HCF_SUCCESS ) {
+		DBG_ERROR( DbgInfo, "wl_go() failed\n" );
+		wl_unlock( lp, &flags );
+		goto hcf_failed;
+	}
+
+	/* Certain RIDs must be set before enabling the ports */
+	wl_put_ltv_init( lp );
+
+#if 0 //;?why was this already commented out in wl_lkm_720
+	/* Enable the ports */
+	if ( wl_adapter_is_open( lp->dev )) {
+		/* Enable the ports */
+		DBG_TRACE( DbgInfo, "Enabling Port 0\n" );
+		hcf_status = wl_enable( lp );
+
+		if ( hcf_status != HCF_SUCCESS ) {
+			DBG_TRACE( DbgInfo, "Enable port 0 failed: 0x%x\n", hcf_status );
+		}
+
+#if (HCF_TYPE) & HCF_TYPE_AP
+		DBG_TRACE( DbgInfo, "Enabling WDS Ports\n" );
+		//wl_enable_wds_ports( lp );
+#endif  /* (HCF_TYPE) & HCF_TYPE_AP */
+
+	}
+#endif
+
+	/* Fill out the MAC address information in the net_device struct */
+	memcpy( lp->dev->dev_addr, lp->MACAddress, ETH_ALEN );
+	dev->addr_len = ETH_ALEN;
+
+	lp->is_registered = TRUE;
+
+#ifdef USE_PROFILE
+	/* Parse the config file for the sake of creating WDS ports if WDS is
+	   configured there but not in the module options */
+	parse_config( dev );
+#endif  /* USE_PROFILE */
+
+	/* If we're going into AP Mode, register the "virtual" ethernet devices
+	   needed for WDS */
+	WL_WDS_NETDEV_REGISTER( lp );
+
+	/* Reset the DownloadFirmware variable in the private struct. If the
+	   config file is not used, this will not matter; if it is used, it
+	   will be reparsed in wl_open(). This is done because logic in wl_open
+	   used to check if a firmware download is needed is broken by parsing
+	   the file here; however, this parsing is needed to register WDS ports
+	   in AP mode, if they are configured */
+	lp->DownloadFirmware = WVLAN_DRV_MODE_STA; //;?download_firmware;
+
+#ifdef USE_RTS
+	if ( lp->useRTS == 1 ) {
+		DBG_TRACE( DbgInfo, "ENTERING RTS MODE...\n" );
+                wl_act_int_off( lp );
+                lp->is_handling_int = WL_NOT_HANDLING_INT; // Not handling interrupts anymore
+
+		wl_disable( lp );
+
+        	hcf_connect( &lp->hcfCtx, HCF_DISCONNECT);
+	}
+#endif  /* USE_RTS */
+
+	wl_unlock( lp, &flags );
+
+	DBG_TRACE( DbgInfo, "%s: Wireless, io_addr %#03lx, irq %d, ""mac_address ",
+			   dev->name, dev->base_addr, dev->irq );
+
+	for( i = 0; i < ETH_ALEN; i++ ) {
+		printk( "%02X%c", dev->dev_addr[i], (( i < ( ETH_ALEN-1 )) ? ':' : '\n' ));
+	}
+
+#if 0 //SCULL_USE_PROC /* don't waste space if unused */
+	create_proc_read_entry( "wlags", 0, NULL, scull_read_procmem, dev );
+	proc_mkdir("driver/wlags49", 0);
+	proc_write("driver/wlags49/wlags49_type", write_int, &lp->wlags49_type);
+#endif /* SCULL_USE_PROC */
+
+	DBG_LEAVE( DbgInfo );
+	return result;
+
+hcf_failed:
+	wl_hcf_error( dev, hcf_status );
+
+failed:
+
+	DBG_ERROR( DbgInfo, "wl_insert() FAILED\n" );
+
+	if ( lp->is_registered == TRUE ) {
+		lp->is_registered = FALSE;
+	}
+
+	WL_WDS_NETDEV_DEREGISTER( lp );
+
+	result = -EFAULT;
+
+
+	DBG_LEAVE( DbgInfo );
+	return result;
+} // wl_insert
+/*============================================================================*/
+
+
+/*******************************************************************************
+ *	wl_reset()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Reset the adapter.
+ *
+ *  PARAMETERS:
+ *
+ *      dev - a pointer to the net_device struct of the wireless device
+ *
+ *  RETURNS:
+ *
+ *      an HCF status code
+ *
+ ******************************************************************************/
+int wl_reset(struct net_device *dev)
+{
+	struct wl_private  *lp = wl_priv(dev);
+	int                 hcf_status = HCF_SUCCESS;
+	/*------------------------------------------------------------------------*/
+	DBG_FUNC( "wl_reset" );
+	DBG_ENTER( DbgInfo );
+	DBG_PARAM( DbgInfo, "dev", "%s (0x%p)", dev->name, dev );
+	DBG_PARAM( DbgInfo, "dev->base_addr", "(%#03lx)", dev->base_addr );
+
+	/*
+         * The caller should already have a lock and
+         * disable the interrupts, we do not lock here,
+         * nor do we enable/disable interrupts!
+         */
+
+	DBG_TRACE( DbgInfo, "Device Base Address: %#03lx\n", dev->base_addr );
+	if ( dev->base_addr ) {
+		/* Shutdown the adapter. */
+		hcf_connect( &lp->hcfCtx, HCF_DISCONNECT );
+
+		/* Reset the driver information. */
+		lp->txBytes = 0;
+
+		/* Connect to the adapter. */
+        	hcf_status = hcf_connect( &lp->hcfCtx, dev->base_addr );
+		if ( hcf_status != HCF_SUCCESS && hcf_status != HCF_ERR_INCOMP_FW ) {
+			DBG_ERROR( DbgInfo, "hcf_connect() failed, status: 0x%x\n", hcf_status );
+			goto out;
+		}
+
+		/* Check if firmware is present, if not change state */
+		if ( hcf_status == HCF_ERR_INCOMP_FW ) {
+			lp->firmware_present = WL_FRIMWARE_NOT_PRESENT;
+		}
+
+		/* Initialize the portState variable */
+		lp->portState = WVLAN_PORT_STATE_DISABLED;
+
+		/* Restart the adapter. */
+		hcf_status = wl_go( lp );
+		if ( hcf_status != HCF_SUCCESS ) {
+			DBG_ERROR( DbgInfo, "wl_go() failed, status: 0x%x\n", hcf_status );
+			goto out;
+		}
+
+		/* Certain RIDs must be set before enabling the ports */
+		wl_put_ltv_init( lp );
+	} else {
+		DBG_ERROR( DbgInfo, "Device Base Address INVALID!!!\n" );
+	}
+
+out:
+	DBG_LEAVE( DbgInfo );
+	return hcf_status;
+} // wl_reset
+/*============================================================================*/
+
+
+/*******************************************************************************
+ *	wl_go()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Reset the adapter.
+ *
+ *  PARAMETERS:
+ *
+ *      dev - a pointer to the net_device struct of the wireless device
+ *
+ *  RETURNS:
+ *
+ *      an HCF status code
+ *
+ ******************************************************************************/
+int wl_go( struct wl_private *lp )
+{
+	int  	hcf_status = HCF_SUCCESS;
+	char	*cp = NULL;			//fw_image
+	int	retries = 0;
+	/*------------------------------------------------------------------------*/
+	DBG_FUNC( "wl_go" );
+	DBG_ENTER( DbgInfo );
+
+	hcf_status = wl_disable( lp );
+	if ( hcf_status != HCF_SUCCESS ) {
+		DBG_TRACE( DbgInfo, "Disable port 0 failed: 0x%x\n", hcf_status );
+
+		while (( hcf_status != HCF_SUCCESS ) && (retries < 10)) {
+			retries++;
+			hcf_status = wl_disable( lp );
+		}
+		if ( hcf_status == HCF_SUCCESS ) {
+			DBG_TRACE( DbgInfo, "Disable port 0 succes : %d retries\n", retries );
+		} else {
+			DBG_TRACE( DbgInfo, "Disable port 0 failed after: %d retries\n", retries );
+		}
+	}
+
+#if 1 //;? (HCF_TYPE) & HCF_TYPE_AP
+	//DBG_TRACE( DbgInfo, "Disabling WDS Ports\n" );
+	//wl_disable_wds_ports( lp );
+#endif  /* (HCF_TYPE) & HCF_TYPE_AP */
+
+//;?what was the purpose of this
+// 	/* load the appropriate firmware image, depending on driver mode */
+// 	lp->ltvRecord.len   = ( sizeof( CFG_RANGE20_STRCT ) / sizeof( hcf_16 )) - 1;
+// 	lp->ltvRecord.typ   = CFG_DRV_ACT_RANGES_PRI;
+// 	hcf_get_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+#if BIN_DL
+	if ( strlen( lp->fw_image_filename ) ) {
+mm_segment_t	fs;
+int		    	file_desc;
+int 			rc;
+
+		DBG_TRACE( DbgInfo, "F/W image:%s:\n", lp->fw_image_filename );
+		/* Obtain a user-space process context, storing the original context */
+		fs = get_fs( );
+		set_fs( get_ds( ));
+		file_desc = open( lp->fw_image_filename, O_RDONLY, 0 );
+		if ( file_desc == -1 ) {
+			DBG_ERROR( DbgInfo, "No image file found\n" );
+		} else {
+			DBG_TRACE( DbgInfo, "F/W image file found\n" );
+#define DHF_ALLOC_SIZE 96000			//just below 96K, let's hope it suffices for now and for the future
+			cp = (char*)vmalloc( DHF_ALLOC_SIZE );
+			if ( cp == NULL ) {
+				DBG_ERROR( DbgInfo, "error in vmalloc\n" );
+			} else {
+				rc = read( file_desc, cp, DHF_ALLOC_SIZE );
+				if ( rc == DHF_ALLOC_SIZE ) {
+					DBG_ERROR( DbgInfo, "buffer too small, %d\n", DHF_ALLOC_SIZE );
+				} else if ( rc > 0 ) {
+					DBG_TRACE( DbgInfo, "read O.K.: %d bytes  %.12s\n", rc, cp );
+					rc = read( file_desc, &cp[rc], 1 );
+					if ( rc == 0 ) { //;/change to an until-loop at rc<=0
+						DBG_TRACE( DbgInfo, "no more to read\n" );
+					}
+				}
+				if ( rc != 0 ) {
+					DBG_ERROR( DbgInfo, "file not read in one swoop or other error"\
+										", give up, too complicated, rc = %0X\n", rc );
+					DBG_ERROR( DbgInfo, "still have to change code to get a real download now !!!!!!!!\n" );
+				} else {
+					DBG_TRACE( DbgInfo, "before dhf_download_binary\n" );
+					hcf_status = dhf_download_binary( (memimage *)cp );
+					DBG_TRACE( DbgInfo, "after dhf_download_binary, before dhf_download_fw\n" );
+					//;?improve error flow/handling
+					hcf_status = dhf_download_fw( &lp->hcfCtx, (memimage *)cp );
+					DBG_TRACE( DbgInfo, "after dhf_download_fw\n" );
+				}
+				vfree( cp );
+			}
+			close( file_desc );
+		}
+		set_fs( fs );			/* Return to the original context */
+	}
+#endif // BIN_DL
+
+	/* If firmware is present but the type is unknown then download anyway */
+	if ( (lp->firmware_present == WL_FRIMWARE_PRESENT)
+	     &&
+	     ( CNV_INT_TO_LITTLE( lp->hcfCtx.IFB_FWIdentity.comp_id ) != COMP_ID_FW_STA )
+	     &&
+	     ( CNV_INT_TO_LITTLE( lp->hcfCtx.IFB_FWIdentity.comp_id ) != COMP_ID_FW_AP ) ) {
+		/* Unknown type, download needed.  */
+		lp->firmware_present = WL_FRIMWARE_NOT_PRESENT;
+	}
+
+	if(lp->firmware_present == WL_FRIMWARE_NOT_PRESENT)
+	{
+		if ( cp == NULL ) {
+			DBG_TRACE( DbgInfo, "Downloading STA firmware...\n" );
+//			hcf_status = dhf_download_fw( &lp->hcfCtx, &station );
+			hcf_status = dhf_download_fw( &lp->hcfCtx, &fw_image );
+		}
+		if ( hcf_status != HCF_SUCCESS ) {
+			DBG_ERROR( DbgInfo, "Firmware Download failed\n" );
+			DBG_LEAVE( DbgInfo );
+			return hcf_status;
+		}
+	}
+	/* Report the FW versions */
+	//;?obsolete, use the available IFB info:: wl_get_pri_records( lp );
+	if ( CNV_INT_TO_LITTLE( lp->hcfCtx.IFB_FWIdentity.comp_id ) == COMP_ID_FW_STA  ) {
+		DBG_TRACE( DbgInfo, "downloaded station F/W\n" );
+	} else if ( CNV_INT_TO_LITTLE( lp->hcfCtx.IFB_FWIdentity.comp_id ) == COMP_ID_FW_AP  ) {
+		DBG_TRACE( DbgInfo, "downloaded AP F/W\n" );
+	} else {
+		DBG_ERROR( DbgInfo, "unknown F/W type\n" );
+	}
+
+	/*
+         * Downloaded, no need to repeat this next time, assume the
+         * contents stays in the card until it is powered off. Note we
+         * do not switch firmware on the fly, the firmware is fixed in
+         * the driver for now.
+         */
+	lp->firmware_present = WL_FRIMWARE_PRESENT;
+
+	DBG_TRACE( DbgInfo, "ComponentID:%04x variant:%04x major:%04x minor:%04x\n",
+				CNV_INT_TO_LITTLE( lp->hcfCtx.IFB_FWIdentity.comp_id ),
+				CNV_INT_TO_LITTLE( lp->hcfCtx.IFB_FWIdentity.variant ),
+				CNV_INT_TO_LITTLE( lp->hcfCtx.IFB_FWIdentity.version_major ),
+				CNV_INT_TO_LITTLE( lp->hcfCtx.IFB_FWIdentity.version_minor ));
+
+	/* now we wil get the MAC address of the card */
+	lp->ltvRecord.len = 4;
+	if ( CNV_INT_TO_LITTLE( lp->hcfCtx.IFB_FWIdentity.comp_id ) == COMP_ID_FW_AP  ) {
+		lp->ltvRecord.typ = CFG_NIC_MAC_ADDR;
+	} else
+	{
+		lp->ltvRecord.typ = CFG_CNF_OWN_MAC_ADDR;
+	}
+	hcf_status = hcf_get_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+	if ( hcf_status != HCF_SUCCESS ) {
+		DBG_ERROR( DbgInfo, "Could not retrieve MAC address\n" );
+		DBG_LEAVE( DbgInfo );
+		return hcf_status;
+	}
+	memcpy( lp->MACAddress, &lp->ltvRecord.u.u8[0], ETH_ALEN );
+	DBG_TRACE( DbgInfo, "Card MAC Address: %s\n", DbgHwAddr( lp->MACAddress ));
+
+	/* Write out configuration to the device, enable, and reconnect. However,
+	   only reconnect if in AP mode. For STA mode, need to wait for passive scan
+	   completion before a connect can be issued */
+	wl_put_ltv( lp );
+	/* Enable the ports */
+	hcf_status = wl_enable( lp );
+
+	if ( lp->DownloadFirmware == WVLAN_DRV_MODE_AP ) {
+#ifdef USE_WDS
+		wl_enable_wds_ports( lp );
+#endif // USE_WDS
+		hcf_status = wl_connect( lp );
+	}
+	DBG_LEAVE( DbgInfo );
+	return hcf_status;
+} // wl_go
+/*============================================================================*/
+
+
+/*******************************************************************************
+ *	wl_set_wep_keys()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Write TxKeyID and WEP keys to the adapter. This is separated from
+ *  wl_apply() to allow dynamic WEP key updates through the wireless
+ *  extensions.
+ *
+ *  PARAMETERS:
+ *
+ *      lp  - a pointer to the wireless adapter's private structure
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+void wl_set_wep_keys( struct wl_private *lp )
+{
+	int count = 0;
+	/*------------------------------------------------------------------------*/
+	DBG_FUNC( "wl_set_wep_keys" );
+	DBG_ENTER( DbgInfo );
+	DBG_PARAM( DbgInfo, "lp", "%s (0x%p)", lp->dev->name, lp );
+	if ( lp->EnableEncryption ) {
+		/* NOTE: CFG_CNF_ENCRYPTION is set in wl_put_ltv() as it's a static
+				 RID */
+
+		/* set TxKeyID */
+		lp->ltvRecord.len = 2;
+		lp->ltvRecord.typ       = CFG_TX_KEY_ID;
+		lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE(lp->TransmitKeyID - 1);
+
+		hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+		DBG_TRACE( DbgInfo, "Key 1 len: %d\n", lp->DefaultKeys.key[0].len );
+		DBG_TRACE( DbgInfo, "Key 2 len: %d\n", lp->DefaultKeys.key[1].len );
+		DBG_TRACE( DbgInfo, "Key 3 len: %d\n", lp->DefaultKeys.key[2].len );
+		DBG_TRACE( DbgInfo, "Key 4 len: %d\n", lp->DefaultKeys.key[3].len );
+
+		/* write keys */
+		lp->DefaultKeys.len = sizeof( lp->DefaultKeys ) / sizeof( hcf_16 ) - 1;
+		lp->DefaultKeys.typ = CFG_DEFAULT_KEYS;
+
+		/* endian translate the appropriate key information */
+		for( count = 0; count < MAX_KEYS; count++ ) {
+			lp->DefaultKeys.key[count].len = CNV_INT_TO_LITTLE( lp->DefaultKeys.key[count].len );
+		}
+
+		hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->DefaultKeys ));
+
+		/* Reverse the above endian translation, since these keys are accessed
+		   elsewhere */
+		for( count = 0; count < MAX_KEYS; count++ ) {
+			lp->DefaultKeys.key[count].len = CNV_INT_TO_LITTLE( lp->DefaultKeys.key[count].len );
+		}
+
+		DBG_NOTICE( DbgInfo, "encrypt: %d, ID: %d\n", lp->EnableEncryption, lp->TransmitKeyID );
+		DBG_NOTICE( DbgInfo, "set key: %s(%d) [%d]\n", lp->DefaultKeys.key[lp->TransmitKeyID-1].key, lp->DefaultKeys.key[lp->TransmitKeyID-1].len, lp->TransmitKeyID-1 );
+	}
+
+	DBG_LEAVE( DbgInfo );
+} // wl_set_wep_keys
+/*============================================================================*/
+
+
+/*******************************************************************************
+ *	wl_apply()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Write the parameters to the adapter. (re-)enables the card if device is
+ *  open. Returns hcf_status of hcf_enable().
+ *
+ *  PARAMETERS:
+ *
+ *      lp  - a pointer to the wireless adapter's private structure
+ *
+ *  RETURNS:
+ *
+ *      an HCF status code
+ *
+ ******************************************************************************/
+int wl_apply(struct wl_private *lp)
+{
+	int hcf_status = HCF_SUCCESS;
+	/*------------------------------------------------------------------------*/
+	DBG_FUNC( "wl_apply" );
+	DBG_ENTER( DbgInfo );
+	DBG_ASSERT( lp != NULL);
+	DBG_PARAM( DbgInfo, "lp", "%s (0x%p)", lp->dev->name, lp );
+
+	if ( !( lp->flags & WVLAN2_UIL_BUSY )) {
+		/* The adapter parameters have changed:
+				disable card
+				reload parameters
+				enable card
+		*/
+
+		if ( wl_adapter_is_open( lp->dev )) {
+			/* Disconnect and disable if necessary */
+			hcf_status = wl_disconnect( lp );
+			if ( hcf_status != HCF_SUCCESS ) {
+				DBG_ERROR( DbgInfo, "Disconnect failed\n" );
+				DBG_LEAVE( DbgInfo );
+				return -1;
+			}
+			hcf_status = wl_disable( lp );
+			if ( hcf_status != HCF_SUCCESS ) {
+				DBG_ERROR( DbgInfo, "Disable failed\n" );
+				DBG_LEAVE( DbgInfo );
+				return -1;
+			} else {
+				/* Write out configuration to the device, enable, and reconnect.
+				   However, only reconnect if in AP mode. For STA mode, need to
+				   wait for passive scan completion before a connect can be
+				   issued */
+				hcf_status = wl_put_ltv( lp );
+
+				if ( hcf_status == HCF_SUCCESS ) {
+					hcf_status = wl_enable( lp );
+
+					if ( CNV_INT_TO_LITTLE( lp->hcfCtx.IFB_FWIdentity.comp_id ) == COMP_ID_FW_AP  ) {
+						hcf_status = wl_connect( lp );
+					}
+				} else {
+					DBG_WARNING( DbgInfo, "wl_put_ltv() failed\n" );
+				}
+			}
+		}
+	}
+
+	DBG_LEAVE( DbgInfo );
+	return hcf_status;
+} // wl_apply
+/*============================================================================*/
+
+
+/*******************************************************************************
+ *	wl_put_ltv_init()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Used to set basic parameters for card initialization.
+ *
+ *  PARAMETERS:
+ *
+ *      lp  - a pointer to the wireless adapter's private structure
+ *
+ *  RETURNS:
+ *
+ *      an HCF status code
+ *
+ ******************************************************************************/
+int wl_put_ltv_init( struct wl_private *lp )
+{
+	int i;
+	int hcf_status;
+	CFG_RID_LOG_STRCT *RidLog;
+	/*------------------------------------------------------------------------*/
+	DBG_FUNC( "wl_put_ltv_init" );
+	DBG_ENTER( DbgInfo );
+	if ( lp == NULL ) {
+		DBG_ERROR( DbgInfo, "lp pointer is NULL\n" );
+		DBG_LEAVE( DbgInfo );
+		return -1;
+	}
+	/* DMA/IO */
+	lp->ltvRecord.len = 2;
+	lp->ltvRecord.typ = CFG_CNTL_OPT;
+
+	/* The Card Services build must ALWAYS configure for 16-bit I/O. PCI or
+	   CardBus can be set to either 16/32 bit I/O, or Bus Master DMA, but only
+	   for Hermes-2.5 */
+#ifdef BUS_PCMCIA
+	lp->ltvRecord.u.u16[0] = CNV_INT_TO_LITTLE( USE_16BIT );
+#else
+	if ( lp->use_dma ) {
+		lp->ltvRecord.u.u16[0] = CNV_INT_TO_LITTLE( USE_DMA );
+	} else {
+		lp->ltvRecord.u.u16[0] = CNV_INT_TO_LITTLE( 0 );
+	}
+
+#endif
+	hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+	DBG_TRACE( DbgInfo, "CFG_CNTL_OPT                      : 0x%04x\n",
+			   lp->ltvRecord.u.u16[0] );
+	DBG_TRACE( DbgInfo, "CFG_CNTL_OPT result               : 0x%04x\n",
+			   hcf_status );
+
+	/* Register the list of RIDs on which asynchronous notification is
+	   required. Note that this mechanism replaces the mailbox, so the mailbox
+	   can be queried by the host (if desired) without contention from us */
+	i=0;
+
+	lp->RidList[i].len     = sizeof( lp->ProbeResp );
+	lp->RidList[i].typ     = CFG_ACS_SCAN;
+	lp->RidList[i].bufp    = (wci_recordp)&lp->ProbeResp;
+	//lp->ProbeResp.infoType = 0xFFFF;
+	i++;
+
+	lp->RidList[i].len     = sizeof( lp->assoc_stat );
+	lp->RidList[i].typ     = CFG_ASSOC_STAT;
+	lp->RidList[i].bufp    = (wci_recordp)&lp->assoc_stat;
+	lp->assoc_stat.len     = 0xFFFF;
+	i++;
+
+	lp->RidList[i].len     = 4;
+	lp->RidList[i].typ     = CFG_UPDATED_INFO_RECORD;
+	lp->RidList[i].bufp    = (wci_recordp)&lp->updatedRecord;
+	lp->updatedRecord.len  = 0xFFFF;
+	i++;
+
+	lp->RidList[i].len     = sizeof( lp->sec_stat );
+	lp->RidList[i].typ     = CFG_SECURITY_STAT;
+	lp->RidList[i].bufp    = (wci_recordp)&lp->sec_stat;
+	lp->sec_stat.len       = 0xFFFF;
+	i++;
+
+	lp->RidList[i].typ     = 0;    // Terminate List
+
+	RidLog = (CFG_RID_LOG_STRCT *)&lp->ltvRecord;
+	RidLog->len     = 3;
+	RidLog->typ     = CFG_REG_INFO_LOG;
+	RidLog->recordp = (RID_LOGP)&lp->RidList[0];
+
+	hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+	DBG_TRACE( DbgInfo, "CFG_REG_INFO_LOG\n" );
+	DBG_TRACE( DbgInfo, "CFG_REG_INFO_LOG result           : 0x%04x\n",
+			   hcf_status );
+	DBG_LEAVE( DbgInfo );
+	return hcf_status;
+} // wl_put_ltv_init
+/*============================================================================*/
+
+
+/*******************************************************************************
+ *	wl_put_ltv()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Used by wvlan_apply() and wvlan_go to set the card's configuration.
+ *
+ *  PARAMETERS:
+ *
+ *      lp  - a pointer to the wireless adapter's private structure
+ *
+ *  RETURNS:
+ *
+ *      an HCF status code
+ *
+ ******************************************************************************/
+int wl_put_ltv( struct wl_private *lp )
+{
+	int len;
+	int hcf_status;
+	/*------------------------------------------------------------------------*/
+	DBG_FUNC( "wl_put_ltv" );
+	DBG_ENTER( DbgInfo );
+
+	if ( lp == NULL ) {
+		DBG_ERROR( DbgInfo, "lp pointer is NULL\n" );
+		return -1;
+	}
+	if ( CNV_INT_TO_LITTLE( lp->hcfCtx.IFB_FWIdentity.comp_id ) == COMP_ID_FW_AP  ) {
+		lp->maxPort = 6;			//;?why set this here and not as part of download process
+	} else {
+		lp->maxPort = 0;
+	}
+
+	/* Send our configuration to the card. Perform any endian translation
+	   necessary */
+	/* Register the Mailbox; VxWorks does this elsewhere; why;? */
+	lp->ltvRecord.len       = 4;
+	lp->ltvRecord.typ       = CFG_REG_MB;
+	lp->ltvRecord.u.u32[0]  = (u_long)&( lp->mailbox );
+	lp->ltvRecord.u.u16[2]  = ( MB_SIZE / sizeof( hcf_16 ));
+	hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+	/* Max Data Length */
+	lp->ltvRecord.len       = 2;
+	lp->ltvRecord.typ       = CFG_CNF_MAX_DATA_LEN;
+	lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( HCF_MAX_PACKET_SIZE );
+	hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+	/* System Scale / Distance between APs */
+	lp->ltvRecord.len       = 2;
+	lp->ltvRecord.typ       = CFG_CNF_SYSTEM_SCALE;
+	lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->DistanceBetweenAPs );
+	hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+	/* Channel */
+	if ( lp->CreateIBSS && ( lp->Channel == 0 )) {
+		DBG_TRACE( DbgInfo, "Create IBSS" );
+		lp->Channel = 10;
+	}
+	lp->ltvRecord.len       = 2;
+	lp->ltvRecord.typ       = CFG_CNF_OWN_CHANNEL;
+	lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->Channel );
+	hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+	/* Microwave Robustness */
+	lp->ltvRecord.len       = 2;
+	lp->ltvRecord.typ       = CFG_CNF_MICRO_WAVE;
+	lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->MicrowaveRobustness );
+	hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+	/* Load Balancing */
+	lp->ltvRecord.len       = 2;
+	lp->ltvRecord.typ       = CFG_CNF_LOAD_BALANCING;
+	lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->loadBalancing );
+	hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+	/* Medium Distribution */
+	lp->ltvRecord.len       = 2;
+	lp->ltvRecord.typ       = CFG_CNF_MEDIUM_DISTRIBUTION;
+	lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->mediumDistribution );
+	hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+	/* Country Code */
+
+#ifdef WARP
+	/* Tx Power Level (for supported cards) */
+	lp->ltvRecord.len       = 2;
+	lp->ltvRecord.typ       = CFG_CNF_TX_POW_LVL;
+	lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->txPowLevel );
+	hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+	/* Short Retry Limit */
+	/*lp->ltvRecord.len       = 2;
+	lp->ltvRecord.typ       = 0xFC32;
+	lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->shortRetryLimit );
+	hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+	*/
+
+	/* Long Retry Limit */
+	/*lp->ltvRecord.len       = 2;
+	lp->ltvRecord.typ       = 0xFC33;
+	lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->longRetryLimit );
+	hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+	*/
+
+	/* Supported Rate Set Control */
+	lp->ltvRecord.len       = 3;
+	lp->ltvRecord.typ       = CFG_SUPPORTED_RATE_SET_CNTL; //0xFC88;
+	lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->srsc[0] );
+	lp->ltvRecord.u.u16[1]  = CNV_INT_TO_LITTLE( lp->srsc[1] );
+	hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+	/* Basic Rate Set Control */
+	lp->ltvRecord.len       = 3;
+	lp->ltvRecord.typ       = CFG_BASIC_RATE_SET_CNTL; //0xFC89;
+	lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->brsc[0] );
+	lp->ltvRecord.u.u16[1]  = CNV_INT_TO_LITTLE( lp->brsc[1] );
+	hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+	/* Frame Burst Limit */
+	/* Defined, but not currently available in Firmware */
+
+#endif // WARP
+
+#ifdef WARP
+	/* Multicast Rate */
+	lp->ltvRecord.len       = 3;
+	lp->ltvRecord.typ       = CFG_CNF_MCAST_RATE;
+	lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->MulticastRate[0] );
+	lp->ltvRecord.u.u16[1]  = CNV_INT_TO_LITTLE( lp->MulticastRate[1] );
+#else
+	lp->ltvRecord.len       = 2;
+	lp->ltvRecord.typ       = CFG_CNF_MCAST_RATE;
+	lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->MulticastRate[0] );
+#endif // WARP
+	hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+	/* Own Name (Station Nickname) */
+	if (( len = ( strlen( lp->StationName ) + 1 ) & ~0x01 ) != 0 ) {
+		//DBG_TRACE( DbgInfo, "CFG_CNF_OWN_NAME                  : %s\n",
+		//           lp->StationName );
+
+		lp->ltvRecord.len       = 2 + ( len / sizeof( hcf_16 ));
+		lp->ltvRecord.typ       = CFG_CNF_OWN_NAME;
+		lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( strlen( lp->StationName ));
+
+		memcpy( &( lp->ltvRecord.u.u8[2] ), lp->StationName, len );
+	} else {
+		//DBG_TRACE( DbgInfo, "CFG_CNF_OWN_NAME                  : EMPTY\n" );
+
+		lp->ltvRecord.len       = 2;
+		lp->ltvRecord.typ       = CFG_CNF_OWN_NAME;
+		lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( 0 );
+	}
+
+	hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+	//DBG_TRACE( DbgInfo, "CFG_CNF_OWN_NAME result           : 0x%04x\n",
+	//           hcf_status );
+
+	/* The following are set in STA mode only */
+	if ( CNV_INT_TO_LITTLE( lp->hcfCtx.IFB_FWIdentity.comp_id ) == COMP_ID_FW_STA  ) {
+
+		/* RTS Threshold */
+		lp->ltvRecord.len       = 2;
+		lp->ltvRecord.typ       = CFG_RTS_THRH;
+		lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->RTSThreshold );
+		hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+		/* Port Type */
+		lp->ltvRecord.len       = 2;
+		lp->ltvRecord.typ       = CFG_CNF_PORT_TYPE;
+		lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->PortType );
+		hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+		/* Tx Rate Control */
+#ifdef WARP
+		lp->ltvRecord.len       = 3;
+		lp->ltvRecord.typ       = CFG_TX_RATE_CNTL;
+		lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->TxRateControl[0] );
+		lp->ltvRecord.u.u16[1]  = CNV_INT_TO_LITTLE( lp->TxRateControl[1] );
+#else
+		lp->ltvRecord.len       = 2;
+		lp->ltvRecord.typ       = CFG_TX_RATE_CNTL;
+		lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->TxRateControl[0] );
+#endif  // WARP
+
+//;?skip temporarily to see whether the RID or something else is the probelm hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+		DBG_TRACE( DbgInfo, "CFG_TX_RATE_CNTL 2.4GHz           : 0x%04x\n",
+				   lp->TxRateControl[0] );
+		DBG_TRACE( DbgInfo, "CFG_TX_RATE_CNTL 5.0GHz           : 0x%04x\n",
+				   lp->TxRateControl[1] );
+		DBG_TRACE( DbgInfo, "CFG_TX_RATE_CNTL result           : 0x%04x\n",
+				   hcf_status );
+		/* Power Management */
+		lp->ltvRecord.len       = 2;
+		lp->ltvRecord.typ       = CFG_CNF_PM_ENABLED;
+		lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->PMEnabled );
+//		lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( 0x8001 );
+		DBG_TRACE( DbgInfo, "CFG_CNF_PM_ENABLED                : 0x%04x\n", lp->PMEnabled );
+		hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+		/* Multicast Receive */
+		lp->ltvRecord.len       = 2;
+		lp->ltvRecord.typ       = CFG_CNF_MCAST_RX;
+		lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->MulticastReceive );
+		hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+		/* Max Sleep Duration */
+		lp->ltvRecord.len       = 2;
+		lp->ltvRecord.typ       = CFG_CNF_MAX_SLEEP_DURATION;
+		lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->MaxSleepDuration );
+		hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+		/* Create IBSS */
+		lp->ltvRecord.len       = 2;
+		lp->ltvRecord.typ       = CFG_CREATE_IBSS;
+		lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->CreateIBSS );
+		hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+		/* Desired SSID */
+		if ((( len = ( strlen( lp->NetworkName ) + 1 ) & ~0x01 ) != 0 ) &&
+			 ( strcmp( lp->NetworkName, "ANY" ) != 0 ) &&
+			 ( strcmp( lp->NetworkName, "any" ) != 0 )) {
+			//DBG_TRACE( DbgInfo, "CFG_DESIRED_SSID                  : %s\n",
+			//           lp->NetworkName );
+
+			lp->ltvRecord.len       = 2 + (len / sizeof(hcf_16));
+			lp->ltvRecord.typ       = CFG_DESIRED_SSID;
+			lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( strlen( lp->NetworkName ));
+
+			memcpy( &( lp->ltvRecord.u.u8[2] ), lp->NetworkName, len );
+		} else {
+			//DBG_TRACE( DbgInfo, "CFG_DESIRED_SSID                  : ANY\n" );
+
+			lp->ltvRecord.len       = 2;
+			lp->ltvRecord.typ       = CFG_DESIRED_SSID;
+			lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( 0 );
+		}
+
+		hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+		//DBG_TRACE( DbgInfo, "CFG_DESIRED_SSID result           : 0x%04x\n",
+		//           hcf_status );
+		/* Own ATIM window */
+		lp->ltvRecord.len       = 2;
+		lp->ltvRecord.typ       = CFG_CNF_OWN_ATIM_WINDOW;
+		lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->atimWindow );
+		hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+
+		/* Holdover Duration */
+		lp->ltvRecord.len       = 2;
+		lp->ltvRecord.typ       = CFG_CNF_HOLDOVER_DURATION;
+		lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->holdoverDuration );
+		hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+		/* Promiscuous Mode */
+		lp->ltvRecord.len       = 2;
+		lp->ltvRecord.typ       = CFG_PROMISCUOUS_MODE;
+		lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->promiscuousMode );
+		hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+		/* Authentication */
+		lp->ltvRecord.len       = 2;
+		lp->ltvRecord.typ       = CFG_CNF_AUTHENTICATION;
+		lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->authentication );
+		hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+#ifdef WARP
+		/* Connection Control */
+		lp->ltvRecord.len       = 2;
+		lp->ltvRecord.typ       = CFG_CNF_CONNECTION_CNTL;
+		lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->connectionControl );
+		hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+
+
+		/* Probe data rate */
+		/*lp->ltvRecord.len       = 3;
+		lp->ltvRecord.typ       = CFG_PROBE_DATA_RATE;
+		lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->probeDataRates[0] );
+		lp->ltvRecord.u.u16[1]  = CNV_INT_TO_LITTLE( lp->probeDataRates[1] );
+		hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+		DBG_TRACE( DbgInfo, "CFG_PROBE_DATA_RATE 2.4GHz        : 0x%04x\n",
+				   lp->probeDataRates[0] );
+		DBG_TRACE( DbgInfo, "CFG_PROBE_DATA_RATE 5.0GHz        : 0x%04x\n",
+				   lp->probeDataRates[1] );
+		DBG_TRACE( DbgInfo, "CFG_PROBE_DATA_RATE result        : 0x%04x\n",
+				   hcf_status );*/
+#endif // WARP
+	} else {
+		/* The following are set in AP mode only */
+#if 0 //;? (HCF_TYPE) & HCF_TYPE_AP
+		//;?should we restore this to allow smaller memory footprint
+
+		/* DTIM Period */
+		lp->ltvRecord.len       = 2;
+		lp->ltvRecord.typ       = CFG_CNF_OWN_DTIM_PERIOD;
+		lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->DTIMPeriod );
+		hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+		/* Multicast PM Buffering */
+		lp->ltvRecord.len       = 2;
+		lp->ltvRecord.typ       = CFG_CNF_MCAST_PM_BUF;
+		lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->multicastPMBuffering );
+		hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+		/* Reject ANY - Closed System */
+		lp->ltvRecord.len       = 2;
+		lp->ltvRecord.typ       = CFG_CNF_REJECT_ANY;
+		lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->RejectAny );
+
+		hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+		/* Exclude Unencrypted */
+		lp->ltvRecord.len       = 2;
+		lp->ltvRecord.typ       = CFG_CNF_EXCL_UNENCRYPTED;
+		lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->ExcludeUnencrypted );
+
+		hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+		/* IntraBSS Relay */
+		lp->ltvRecord.len       = 2;
+		lp->ltvRecord.typ       = CFG_CNF_INTRA_BSS_RELAY;
+		lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->intraBSSRelay );
+		hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+		/* RTS Threshold 0 */
+		lp->ltvRecord.len       = 2;
+		lp->ltvRecord.typ       = CFG_RTS_THRH0;
+		lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->RTSThreshold );
+
+		hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+		/* Tx Rate Control 0 */
+#ifdef WARP
+		lp->ltvRecord.len       = 3;
+		lp->ltvRecord.typ       = CFG_TX_RATE_CNTL0;
+		lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->TxRateControl[0] );
+		lp->ltvRecord.u.u16[1]  = CNV_INT_TO_LITTLE( lp->TxRateControl[1] );
+#else
+		lp->ltvRecord.len       = 2;
+		lp->ltvRecord.typ       = CFG_TX_RATE_CNTL0;
+		lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->TxRateControl[0] );
+#endif  // WARP
+
+		hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+		/* Own Beacon Interval */
+		lp->ltvRecord.len       = 2;
+		lp->ltvRecord.typ       = 0xFC31;
+		lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->ownBeaconInterval );
+		hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+		/* Co-Existence Behavior */
+		lp->ltvRecord.len       = 2;
+		lp->ltvRecord.typ       = 0xFCC7;
+		lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->coexistence );
+		hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+#ifdef USE_WDS
+
+		/* RTS Threshold 1 */
+		lp->ltvRecord.len       = 2;
+		lp->ltvRecord.typ       = CFG_RTS_THRH1;
+		lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->wds_port[0].rtsThreshold );
+		hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+		/* RTS Threshold 2 */
+		lp->ltvRecord.len       = 2;
+		lp->ltvRecord.typ       = CFG_RTS_THRH2;
+		lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->wds_port[1].rtsThreshold );
+		hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+
+		/* RTS Threshold 3 */
+		lp->ltvRecord.len       = 2;
+		lp->ltvRecord.typ       = CFG_RTS_THRH3;
+		lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->wds_port[2].rtsThreshold );
+		hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+
+		/* RTS Threshold 4 */
+		lp->ltvRecord.len       = 2;
+		lp->ltvRecord.typ       = CFG_RTS_THRH4;
+		lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->wds_port[3].rtsThreshold );
+		hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+
+		/* RTS Threshold 5 */
+		lp->ltvRecord.len       = 2;
+		lp->ltvRecord.typ       = CFG_RTS_THRH5;
+		lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->wds_port[4].rtsThreshold );
+		hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+		/* RTS Threshold 6 */
+		lp->ltvRecord.len       = 2;
+		lp->ltvRecord.typ       = CFG_RTS_THRH6;
+		lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->wds_port[5].rtsThreshold );
+		hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+#if 0
+		/* TX Rate Control 1 */
+		lp->ltvRecord.len       = 2;
+		lp->ltvRecord.typ       = CFG_TX_RATE_CNTL1;
+		lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->wds_port[0].txRateCntl );
+		hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+		/* TX Rate Control 2 */
+		lp->ltvRecord.len       = 2;
+		lp->ltvRecord.typ       = CFG_TX_RATE_CNTL2;
+		lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->wds_port[1].txRateCntl );
+		hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+		/* TX Rate Control 3 */
+		lp->ltvRecord.len       = 2;
+		lp->ltvRecord.typ       = CFG_TX_RATE_CNTL3;
+		lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->wds_port[2].txRateCntl );
+		hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+		/* TX Rate Control 4 */
+		lp->ltvRecord.len       = 2;
+		lp->ltvRecord.typ       = CFG_TX_RATE_CNTL4;
+		lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->wds_port[3].txRateCntl );
+		hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+		/* TX Rate Control 5 */
+		lp->ltvRecord.len       = 2;
+		lp->ltvRecord.typ       = CFG_TX_RATE_CNTL5;
+		lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->wds_port[4].txRateCntl );
+		hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+		/* TX Rate Control 6 */
+		lp->ltvRecord.len       = 2;
+		lp->ltvRecord.typ       = CFG_TX_RATE_CNTL6;
+		lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->wds_port[5].txRateCntl );
+		hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+#endif
+
+		/* WDS addresses.  It's okay to blindly send these parameters, because
+		   the port needs to be enabled, before anything is done with it. */
+
+		/* WDS Address 1 */
+		lp->ltvRecord.len      = 4;
+		lp->ltvRecord.typ      = CFG_CNF_WDS_ADDR1;
+
+		memcpy( &lp->ltvRecord.u.u8[0], lp->wds_port[0].wdsAddress, ETH_ALEN );
+		hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+		/* WDS Address 2 */
+		lp->ltvRecord.len      = 4;
+		lp->ltvRecord.typ      = CFG_CNF_WDS_ADDR2;
+
+		memcpy( &lp->ltvRecord.u.u8[0], lp->wds_port[1].wdsAddress, ETH_ALEN );
+		hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+		/* WDS Address 3 */
+		lp->ltvRecord.len      = 4;
+		lp->ltvRecord.typ      = CFG_CNF_WDS_ADDR3;
+
+		memcpy( &lp->ltvRecord.u.u8[0], lp->wds_port[2].wdsAddress, ETH_ALEN );
+		hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+		/* WDS Address 4 */
+		lp->ltvRecord.len      = 4;
+		lp->ltvRecord.typ      = CFG_CNF_WDS_ADDR4;
+
+		memcpy( &lp->ltvRecord.u.u8[0], lp->wds_port[3].wdsAddress, ETH_ALEN );
+		hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+		/* WDS Address 5 */
+		lp->ltvRecord.len      = 4;
+		lp->ltvRecord.typ      = CFG_CNF_WDS_ADDR5;
+
+		memcpy( &lp->ltvRecord.u.u8[0], lp->wds_port[4].wdsAddress, ETH_ALEN );
+		hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+		/* WDS Address 6 */
+		lp->ltvRecord.len      = 4;
+		lp->ltvRecord.typ      = CFG_CNF_WDS_ADDR6;
+
+		memcpy( &lp->ltvRecord.u.u8[0], lp->wds_port[5].wdsAddress, ETH_ALEN );
+		hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+#endif  /* USE_WDS */
+#endif  /* (HCF_TYPE) & HCF_TYPE_AP */
+	}
+
+	/* Own MAC Address */
+	//DBG_TRACE( DbgInfo, "MAC Address                       : %s\n",
+	//           DbgHwAddr( lp->MACAddress ));
+
+	if ( WVLAN_VALID_MAC_ADDRESS( lp->MACAddress )) {
+		/* Make the MAC address valid by:
+				Clearing the multicast bit
+				Setting the local MAC address bit
+		*/
+		//lp->MACAddress[0] &= ~0x03;  //;?why is this commented out already in 720
+		//lp->MACAddress[0] |= 0x02;
+
+		lp->ltvRecord.len = 1 + ( ETH_ALEN / sizeof( hcf_16 ));
+		if ( CNV_INT_TO_LITTLE( lp->hcfCtx.IFB_FWIdentity.comp_id ) == COMP_ID_FW_AP  ) {
+			//DBG_TRACE( DbgInfo, "CFG_NIC_MAC_ADDR\n" );
+			lp->ltvRecord.typ = CFG_NIC_MAC_ADDR;
+		} else {
+			//DBG_TRACE( DbgInfo, "CFG_CNF_OWN_MAC_ADDR\n" );
+			lp->ltvRecord.typ = CFG_CNF_OWN_MAC_ADDR;
+		}
+		/* MAC address is byte aligned, no endian conversion needed */
+		memcpy( &( lp->ltvRecord.u.u8[0] ), lp->MACAddress, ETH_ALEN );
+		hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+		//DBG_TRACE( DbgInfo, "CFG_XXX_MAC_ADDR result           : 0x%04x\n",
+		//           hcf_status );
+
+		/* Update the MAC address in the netdevice struct */
+		memcpy( lp->dev->dev_addr, lp->MACAddress, ETH_ALEN ); //;?what is the purpose of this seemingly complex logic
+	}
+	/* Own SSID */
+	if ((( len = ( strlen( lp->NetworkName ) + 1 ) & ~0x01 ) != 0 ) &&
+				 ( strcmp( lp->NetworkName, "ANY" ) != 0 ) &&
+				 ( strcmp( lp->NetworkName, "any" ) != 0 )) {
+		//DBG_TRACE( DbgInfo, "CFG_CNF_OWN_SSID                  : %s\n",
+		//           lp->NetworkName );
+		lp->ltvRecord.len       = 2 + (len / sizeof(hcf_16));
+		lp->ltvRecord.typ       = CFG_CNF_OWN_SSID;
+		lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( strlen( lp->NetworkName ));
+
+		memcpy( &( lp->ltvRecord.u.u8[2] ), lp->NetworkName, len );
+	} else {
+		//DBG_TRACE( DbgInfo, "CFG_CNF_OWN_SSID                  : ANY\n" );
+		lp->ltvRecord.len       = 2;
+		lp->ltvRecord.typ       = CFG_CNF_OWN_SSID;
+		lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( 0 );
+	}
+
+	hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+	//DBG_TRACE( DbgInfo, "CFG_CNF_OWN_SSID result           : 0x%04x\n",
+	//           hcf_status );
+	/* enable/disable encryption */
+	lp->ltvRecord.len       = 2;
+	lp->ltvRecord.typ       = CFG_CNF_ENCRYPTION;
+	lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->EnableEncryption );
+	hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+	/* Set the Authentication Key Management Suite */
+	lp->ltvRecord.len       = 2;
+	lp->ltvRecord.typ       = CFG_SET_WPA_AUTH_KEY_MGMT_SUITE;
+	lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( lp->AuthKeyMgmtSuite );
+	hcf_status = hcf_put_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+	/* WEP Keys */
+	wl_set_wep_keys( lp );
+
+	/* Country Code */
+	/* countryInfo, ltvCountryInfo, CFG_CNF_COUNTRY_INFO */
+
+	DBG_LEAVE( DbgInfo );
+	return hcf_status;
+} // wl_put_ltv
+/*============================================================================*/
+
+
+/*******************************************************************************
+ *	init_module()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Load the kernel module.
+ *
+ *  PARAMETERS:
+ *
+ *      N/A
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      an errno value otherwise
+ *
+ ******************************************************************************/
+static int __init wl_module_init( void )
+{
+	int result;
+	/*------------------------------------------------------------------------*/
+
+	DBG_FUNC( "wl_module_init" );
+
+#if DBG
+	/* Convert "standard" PCMCIA parameter pc_debug to a reasonable DebugFlag value.
+	 * NOTE: The values all fall through to the lower values. */
+	DbgInfo->DebugFlag = 0;
+	DbgInfo->DebugFlag = DBG_TRACE_ON;		//;?get this mess resolved one day
+	if ( pc_debug ) switch( pc_debug ) {
+	  case 8:
+		DbgInfo->DebugFlag |= DBG_DS_ON;
+	  case 7:
+		DbgInfo->DebugFlag |= DBG_RX_ON | DBG_TX_ON;
+	  case 6:
+		DbgInfo->DebugFlag |= DBG_PARAM_ON;
+	  case 5:
+		DbgInfo->DebugFlag |= DBG_TRACE_ON;
+	  case 4:
+		DbgInfo->DebugFlag |= DBG_VERBOSE_ON;
+	  case 1:
+		DbgInfo->DebugFlag |= DBG_DEFAULTS;
+	  default:
+		break;
+	}
+#endif /* DBG */
+
+	DBG_ENTER( DbgInfo );
+	printk(KERN_INFO "%s\n", VERSION_INFO);
+    	printk(KERN_INFO "*** Modified for kernel 2.6 by Henk de Groot <pe1dnn@amsat.org>\n");
+        printk(KERN_INFO "*** Based on 7.18 version by Andrey Borzenkov <arvidjaar@mail.ru> $Revision: 39 $\n");
+
+
+// ;?#if (HCF_TYPE) & HCF_TYPE_AP
+// 	DBG_PRINT( "Access Point Mode (AP) Support: YES\n" );
+// #else
+// 	DBG_PRINT( "Access Point Mode (AP) Support: NO\n" );
+// #endif /* (HCF_TYPE) & HCF_TYPE_AP */
+
+	result = wl_adapter_init_module( );
+	DBG_LEAVE( DbgInfo );
+	return result;
+} // init_module
+/*============================================================================*/
+
+
+/*******************************************************************************
+ *	cleanup_module()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Unload the kernel module.
+ *
+ *  PARAMETERS:
+ *
+ *      N/A
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+static void __exit wl_module_exit( void )
+{
+	DBG_FUNC( "wl_module_exit" );
+	DBG_ENTER(DbgInfo);
+
+	wl_adapter_cleanup_module( );
+#if 0 //SCULL_USE_PROC /* don't waste space if unused */
+	remove_proc_entry( "wlags", NULL );		//;?why so a-symmetric compared to location of create_proc_read_entry
+#endif
+
+	DBG_LEAVE( DbgInfo );
+	return;
+} // cleanup_module
+/*============================================================================*/
+
+module_init(wl_module_init);
+module_exit(wl_module_exit);
+
+/*******************************************************************************
+ *	wl_isr()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      The Interrupt Service Routine for the driver.
+ *
+ *  PARAMETERS:
+ *
+ *      irq     -   the irq the interrupt came in on
+ *      dev_id  -   a buffer containing information about the request
+ *      regs    -
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+irqreturn_t wl_isr( int irq, void *dev_id, struct pt_regs *regs )
+{
+	int                 events;
+	struct net_device   *dev = (struct net_device *) dev_id;
+	struct wl_private   *lp = NULL;
+	/*------------------------------------------------------------------------*/
+	if (( dev == NULL ) || ( !netif_device_present( dev ))) {
+		return IRQ_NONE;
+	}
+
+	/* Set the wl_private pointer (lp), now that we know that dev is non-null */
+	lp = wl_priv(dev);
+
+#ifdef USE_RTS
+	if ( lp->useRTS == 1 ) {
+		DBG_PRINT( "EXITING ISR, IN RTS MODE...\n" );
+		return;
+		}
+#endif  /* USE_RTS */
+
+	/* If we have interrupts pending, then put them on a system task
+	   queue. Otherwise turn interrupts back on */
+	events = hcf_action( &lp->hcfCtx, HCF_ACT_INT_OFF );
+
+	if ( events == HCF_INT_PENDING ) {
+		/* Schedule the ISR handler as a bottom-half task in the
+		   tq_immediate queue */
+		tasklet_schedule(&lp->task);
+	} else {
+		//DBG_PRINT( "NOT OUR INTERRUPT\n" );
+		hcf_action( &lp->hcfCtx, HCF_ACT_INT_ON );
+	}
+
+	return IRQ_RETVAL(events == HCF_INT_PENDING);
+} // wl_isr
+/*============================================================================*/
+
+
+/*******************************************************************************
+ *	wl_isr_handler()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      The ISR handler, scheduled to run in a deferred context by the ISR. This
+ *      is where the ISR's work actually gets done.
+ *
+ *  PARAMETERS:
+ *
+ *      lp  - a pointer to the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+#define WVLAN_MAX_INT_SERVICES  50
+
+void wl_isr_handler( unsigned long p )
+{
+	struct net_device       *dev;
+	unsigned long           flags;
+	bool_t                  stop = TRUE;
+	int                     count;
+	int                     result;
+        struct wl_private       *lp = (struct wl_private *)p;
+	/*------------------------------------------------------------------------*/
+
+	if ( lp == NULL ) {
+		DBG_PRINT( "wl_isr_handler  lp adapter pointer is NULL!!!\n" );
+	} else {
+		wl_lock( lp, &flags );
+
+		dev = (struct net_device *)lp->dev;
+		if ( dev != NULL && netif_device_present( dev ) ) stop = FALSE;
+		for( count = 0; stop == FALSE && count < WVLAN_MAX_INT_SERVICES; count++ ) {
+			stop = TRUE;
+			result = hcf_service_nic( &lp->hcfCtx,
+									  (wci_bufp)lp->lookAheadBuf,
+									  sizeof( lp->lookAheadBuf ));
+			if ( result == HCF_ERR_MIC ) {
+				wl_wext_event_mic_failed( dev ); 	/* Send an event that MIC failed */
+				//;?this seems wrong if HCF_ERR_MIC coincides with another event, stop gets FALSE
+				//so why not do it always ;?
+			}
+
+#ifndef USE_MBOX_SYNC
+			if ( lp->hcfCtx.IFB_MBInfoLen != 0 ) {	/* anything in the mailbox */
+				wl_mbx( lp );
+				stop = FALSE;
+			}
+#endif
+			/* Check for a Link status event */
+			if ( ( lp->hcfCtx.IFB_LinkStat & CFG_LINK_STAT_FW ) != 0 ) {
+				wl_process_link_status( lp );
+				stop = FALSE;
+			}
+			/* Check for probe response events */
+			if ( lp->ProbeResp.infoType != 0 &&
+				lp->ProbeResp.infoType != 0xFFFF ) {
+				wl_process_probe_response( lp );
+				memset( &lp->ProbeResp, 0, sizeof( lp->ProbeResp ));
+				lp->ProbeResp.infoType = 0xFFFF;
+				stop = FALSE;
+			}
+			/* Check for updated record events */
+			if ( lp->updatedRecord.len != 0xFFFF ) {
+				wl_process_updated_record( lp );
+				lp->updatedRecord.len = 0xFFFF;
+				stop = FALSE;
+			}
+			/* Check for association status events */
+			if ( lp->assoc_stat.len != 0xFFFF ) {
+				wl_process_assoc_status( lp );
+				lp->assoc_stat.len = 0xFFFF;
+				stop = FALSE;
+			}
+			/* Check for security status events */
+			if ( lp->sec_stat.len != 0xFFFF ) {
+				wl_process_security_status( lp );
+				lp->sec_stat.len = 0xFFFF;
+				stop = FALSE;
+			}
+
+#ifdef ENABLE_DMA
+			if ( lp->use_dma ) {
+				/* Check for DMA Rx packets */
+				if ( lp->hcfCtx.IFB_DmaPackets & HREG_EV_RDMAD ) {
+					wl_rx_dma( dev );
+					stop = FALSE;
+				}
+				/* Return Tx DMA descriptors to host */
+				if ( lp->hcfCtx.IFB_DmaPackets & HREG_EV_TDMAD ) {
+					wl_pci_dma_hcf_reclaim_tx( lp );
+					stop = FALSE;
+				}
+			}
+			else
+#endif // ENABLE_DMA
+			{
+				/* Check for Rx packets */
+				if ( lp->hcfCtx.IFB_RxLen != 0 ) {
+					wl_rx( dev );
+					stop = FALSE;
+				}
+				/* Make sure that queued frames get sent */
+				if ( wl_send( lp )) {
+					stop = FALSE;
+				}
+			}
+		}
+		/* We're done, so turn interrupts which were turned off in wl_isr, back on */
+		hcf_action( &lp->hcfCtx, HCF_ACT_INT_ON );
+		wl_unlock( lp, &flags );
+	}
+	return;
+} // wl_isr_handler
+/*============================================================================*/
+
+
+/*******************************************************************************
+ *	wl_remove()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Notify the adapter that it has been removed. Since the adapter is gone,
+ *  we should no longer try to talk to it.
+ *
+ *  PARAMETERS:
+ *
+ *      dev - a pointer to the device's net_device structure
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+void wl_remove( struct net_device *dev )
+{
+	struct wl_private   *lp = wl_priv(dev);
+	unsigned long   flags;
+	/*------------------------------------------------------------------------*/
+	DBG_FUNC( "wl_remove" );
+	DBG_ENTER( DbgInfo );
+
+	DBG_PARAM( DbgInfo, "dev", "%s (0x%p)", dev->name, dev );
+
+	wl_lock( lp, &flags );
+
+	/* stop handling interrupts */
+	wl_act_int_off( lp );
+        lp->is_handling_int = WL_NOT_HANDLING_INT;
+
+	/*
+         * Disable the ports: just change state: since the
+         * card is gone it is useless to talk to it and at
+         * disconnect all state information is lost anyway.
+         */
+	/* Reset portState */
+	lp->portState = WVLAN_PORT_STATE_DISABLED;
+
+#if 0 //;? (HCF_TYPE) & HCF_TYPE_AP
+#ifdef USE_WDS
+	//wl_disable_wds_ports( lp );
+#endif // USE_WDS
+#endif  /* (HCF_TYPE) & HCF_TYPE_AP */
+
+	/* Mark the device as unregistered */
+	lp->is_registered = FALSE;
+
+	/* Deregister the WDS ports as well */
+	WL_WDS_NETDEV_DEREGISTER( lp );
+#ifdef USE_RTS
+	if ( lp->useRTS == 1 ) {
+		wl_unlock( lp, &flags );
+
+		DBG_LEAVE( DbgInfo );
+		return;
+	}
+#endif  /* USE_RTS */
+
+	/* Inform the HCF that the card has been removed */
+	hcf_connect( &lp->hcfCtx, HCF_DISCONNECT );
+
+	wl_unlock( lp, &flags );
+
+	DBG_LEAVE( DbgInfo );
+	return;
+} // wl_remove
+/*============================================================================*/
+
+
+/*******************************************************************************
+ *	wl_suspend()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Power-down and halt the adapter.
+ *
+ *  PARAMETERS:
+ *
+ *      dev - a pointer to the device's net_device structure
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+void wl_suspend( struct net_device *dev )
+{
+	struct wl_private  *lp = wl_priv(dev);
+	unsigned long   flags;
+	/*------------------------------------------------------------------------*/
+	DBG_FUNC( "wl_suspend" );
+	DBG_ENTER( DbgInfo );
+
+	DBG_PARAM( DbgInfo, "dev", "%s (0x%p)", dev->name, dev );
+
+	/* The adapter is suspended:
+			Stop the adapter
+			Power down
+	*/
+	wl_lock( lp, &flags );
+
+	/* Disable interrupt handling */
+	wl_act_int_off( lp );
+
+	/* Disconnect */
+	wl_disconnect( lp );
+
+	/* Disable */
+	wl_disable( lp );
+
+        /* Disconnect from the adapter */
+	hcf_connect( &lp->hcfCtx, HCF_DISCONNECT );
+
+	/* Reset portState to be sure (should have been done by wl_disable */
+	lp->portState = WVLAN_PORT_STATE_DISABLED;
+
+	wl_unlock( lp, &flags );
+
+	DBG_LEAVE( DbgInfo );
+	return;
+} // wl_suspend
+/*============================================================================*/
+
+
+/*******************************************************************************
+ *	wl_resume()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Resume a previously suspended adapter.
+ *
+ *  PARAMETERS:
+ *
+ *      dev - a pointer to the device's net_device structure
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+void wl_resume(struct net_device *dev)
+{
+	struct wl_private  *lp = wl_priv(dev);
+	unsigned long   flags;
+	/*------------------------------------------------------------------------*/
+	DBG_FUNC( "wl_resume" );
+	DBG_ENTER( DbgInfo );
+
+	DBG_PARAM( DbgInfo, "dev", "%s (0x%p)", dev->name, dev );
+
+	wl_lock( lp, &flags );
+
+        /* Connect to the adapter */
+	hcf_connect( &lp->hcfCtx, dev->base_addr );
+
+	/* Reset portState */
+	lp->portState = WVLAN_PORT_STATE_DISABLED;
+
+	/* Power might have been off, assume the card lost the firmware*/
+	lp->firmware_present = WL_FRIMWARE_NOT_PRESENT;
+
+	/* Reload the firmware and restart */
+	wl_reset( dev );
+
+	/* Resume interrupt handling */
+	wl_act_int_on( lp );
+
+	wl_unlock( lp, &flags );
+
+	DBG_LEAVE( DbgInfo );
+	return;
+} // wl_resume
+/*============================================================================*/
+
+
+/*******************************************************************************
+ *	wl_release()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      This function perfroms a check on the device and calls wl_remove() if
+ *  necessary. This function can be used for all bus types, but exists mostly
+ *  for the benefit of the Card Services driver, as there are times when
+ *  wl_remove() does not get called.
+ *
+ *  PARAMETERS:
+ *
+ *      dev - a pointer to the device's net_device structure
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+void wl_release( struct net_device *dev )
+{
+	struct wl_private  *lp = wl_priv(dev);
+	/*------------------------------------------------------------------------*/
+	DBG_FUNC( "wl_release" );
+	DBG_ENTER( DbgInfo );
+
+	DBG_PARAM( DbgInfo, "dev", "%s (0x%p)", dev->name, dev );
+	/* If wl_remove() hasn't been called (i.e. when Card Services is shut
+	   down with the card in the slot), then call it */
+	if ( lp->is_registered == TRUE ) {
+		DBG_TRACE( DbgInfo, "Calling unregister_netdev(), as it wasn't called yet\n" );
+		wl_remove( dev );
+
+		lp->is_registered = FALSE;
+	}
+
+	DBG_LEAVE( DbgInfo );
+	return;
+} // wl_release
+/*============================================================================*/
+
+
+/*******************************************************************************
+ *	wl_get_irq_mask()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Accessor function to retrieve the irq_mask module parameter
+ *
+ *  PARAMETERS:
+ *
+ *      N/A
+ *
+ *  RETURNS:
+ *
+ *      The irq_mask module parameter
+ *
+ ******************************************************************************/
+p_u16 wl_get_irq_mask( void )
+{
+	return irq_mask;
+} // wl_get_irq_mask
+/*============================================================================*/
+
+
+/*******************************************************************************
+ *	wl_get_irq_list()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Accessor function to retrieve the irq_list module parameter
+ *
+ *  PARAMETERS:
+ *
+ *      N/A
+ *
+ *  RETURNS:
+ *
+ *      The irq_list module parameter
+ *
+ ******************************************************************************/
+p_s8 * wl_get_irq_list( void )
+{
+	return irq_list;
+} // wl_get_irq_list
+/*============================================================================*/
+
+
+
+/*******************************************************************************
+ *	wl_enable()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Used to enable MAC ports
+ *
+ *  PARAMETERS:
+ *
+ *      lp      - pointer to the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+int wl_enable( struct wl_private *lp )
+{
+	int hcf_status = HCF_SUCCESS;
+	/*------------------------------------------------------------------------*/
+	DBG_FUNC( "wl_enable" );
+	DBG_ENTER( DbgInfo );
+
+	if ( lp->portState == WVLAN_PORT_STATE_ENABLED ) {
+		DBG_TRACE( DbgInfo, "No action: Card already enabled\n" );
+	} else if ( lp->portState == WVLAN_PORT_STATE_CONNECTED ) {
+		//;?suspicuous logic, how can you be connected without being enabled so this is probably dead code
+		DBG_TRACE( DbgInfo, "No action: Card already connected\n" );
+	} else {
+		hcf_status = hcf_cntl( &lp->hcfCtx, HCF_CNTL_ENABLE );
+		if ( hcf_status == HCF_SUCCESS ) {
+			/* Set the status of the NIC to enabled */
+			lp->portState = WVLAN_PORT_STATE_ENABLED;   //;?bad mnemonic, NIC iso PORT
+#ifdef ENABLE_DMA
+			if ( lp->use_dma ) {
+				wl_pci_dma_hcf_supply( lp );  //;?always succes?
+			}
+#endif
+		}
+	}
+	if ( hcf_status != HCF_SUCCESS ) {  //;?make this an assert
+		DBG_TRACE( DbgInfo, "failed: 0x%x\n", hcf_status );
+	}
+	DBG_LEAVE( DbgInfo );
+	return hcf_status;
+} // wl_enable
+/*============================================================================*/
+
+
+#ifdef USE_WDS
+/*******************************************************************************
+ *	wl_enable_wds_ports()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Used to enable the WDS MAC ports 1-6
+ *
+ *  PARAMETERS:
+ *
+ *      lp      - pointer to the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+void wl_enable_wds_ports( struct wl_private * lp )
+{
+
+	DBG_FUNC( "wl_enable_wds_ports" );
+	DBG_ENTER( DbgInfo );
+	if ( CNV_INT_TO_LITTLE( lp->hcfCtx.IFB_FWIdentity.comp_id ) == COMP_ID_FW_AP  ){
+		DBG_ERROR( DbgInfo, "!!!!;? someone misunderstood something !!!!!\n" );
+	}
+	DBG_LEAVE( DbgInfo );
+	return;
+} // wl_enable_wds_ports
+#endif  /* USE_WDS */
+/*============================================================================*/
+
+
+/*******************************************************************************
+ *	wl_connect()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Used to connect a MAC port
+ *
+ *  PARAMETERS:
+ *
+ *      lp      - pointer to the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+int wl_connect( struct wl_private *lp )
+{
+	int hcf_status;
+	/*------------------------------------------------------------------------*/
+
+	DBG_FUNC( "wl_connect" );
+	DBG_ENTER( DbgInfo );
+
+	if ( lp->portState != WVLAN_PORT_STATE_ENABLED ) {
+		DBG_TRACE( DbgInfo, "No action: Not in enabled state\n" );
+		DBG_LEAVE( DbgInfo );
+		return HCF_SUCCESS;
+	}
+	hcf_status = hcf_cntl( &lp->hcfCtx, HCF_CNTL_CONNECT );
+	if ( hcf_status == HCF_SUCCESS ) {
+		lp->portState = WVLAN_PORT_STATE_CONNECTED;
+	}
+	DBG_LEAVE( DbgInfo );
+	return hcf_status;
+} // wl_connect
+/*============================================================================*/
+
+
+/*******************************************************************************
+ *	wl_disconnect()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Used to disconnect a MAC port
+ *
+ *  PARAMETERS:
+ *
+ *      lp      - pointer to the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+int wl_disconnect( struct wl_private *lp )
+{
+	int hcf_status;
+	/*------------------------------------------------------------------------*/
+
+	DBG_FUNC( "wl_disconnect" );
+	DBG_ENTER( DbgInfo );
+
+	if ( lp->portState != WVLAN_PORT_STATE_CONNECTED ) {
+		DBG_TRACE( DbgInfo, "No action: Not in connected state\n" );
+		DBG_LEAVE( DbgInfo );
+		return HCF_SUCCESS;
+	}
+	hcf_status = hcf_cntl( &lp->hcfCtx, HCF_CNTL_DISCONNECT );
+	if ( hcf_status == HCF_SUCCESS ) {
+		lp->portState = WVLAN_PORT_STATE_ENABLED;
+	}
+	DBG_LEAVE( DbgInfo );
+	return hcf_status;
+} // wl_disconnect
+/*============================================================================*/
+
+
+/*******************************************************************************
+ *	wl_disable()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Used to disable MAC ports
+ *
+ *  PARAMETERS:
+ *
+ *      lp      - pointer to the device's private adapter structure
+ *      port    - the MAC port to disable
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+int wl_disable( struct wl_private *lp )
+{
+	int hcf_status = HCF_SUCCESS;
+	/*------------------------------------------------------------------------*/
+	DBG_FUNC( "wl_disable" );
+	DBG_ENTER( DbgInfo );
+
+	if ( lp->portState == WVLAN_PORT_STATE_DISABLED ) {
+		DBG_TRACE( DbgInfo, "No action: Port state is disabled\n" );
+	} else {
+		hcf_status = hcf_cntl( &lp->hcfCtx, HCF_CNTL_DISABLE );
+		if ( hcf_status == HCF_SUCCESS ) {
+			/* Set the status of the port to disabled */ //;?bad mnemonic use NIC iso PORT
+			lp->portState = WVLAN_PORT_STATE_DISABLED;
+
+#ifdef ENABLE_DMA
+			if ( lp->use_dma ) {
+				wl_pci_dma_hcf_reclaim( lp );
+			}
+#endif
+		}
+	}
+	if ( hcf_status != HCF_SUCCESS ) {
+		DBG_TRACE( DbgInfo, "failed: 0x%x\n", hcf_status );
+	}
+	DBG_LEAVE( DbgInfo );
+	return hcf_status;
+} // wl_disable
+/*============================================================================*/
+
+
+#ifdef USE_WDS
+/*******************************************************************************
+ *	wl_disable_wds_ports()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Used to disable the WDS MAC ports 1-6
+ *
+ *  PARAMETERS:
+ *
+ *      lp      - pointer to the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+void wl_disable_wds_ports( struct wl_private * lp )
+{
+
+	DBG_FUNC( "wl_disable_wds_ports" );
+	DBG_ENTER( DbgInfo );
+
+	if ( CNV_INT_TO_LITTLE( lp->hcfCtx.IFB_FWIdentity.comp_id ) == COMP_ID_FW_AP  ){
+		DBG_ERROR( DbgInfo, "!!!!;? someone misunderstood something !!!!!\n" );
+	}
+// 	if ( CNV_INT_TO_LITTLE( lp->hcfCtx.IFB_FWIdentity.comp_id ) == COMP_ID_FW_AP  ) {
+// 		wl_disable( lp, HCF_PORT_1 );
+// 		wl_disable( lp, HCF_PORT_2 );
+// 		wl_disable( lp, HCF_PORT_3 );
+// 		wl_disable( lp, HCF_PORT_4 );
+// 		wl_disable( lp, HCF_PORT_5 );
+// 		wl_disable( lp, HCF_PORT_6 );
+// 	}
+	DBG_LEAVE( DbgInfo );
+	return;
+} // wl_disable_wds_ports
+#endif // USE_WDS
+/*============================================================================*/
+
+
+#ifndef USE_MBOX_SYNC
+/*******************************************************************************
+ *	wl_mbx()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *      This function is used to read and process a mailbox message.
+ *
+ *
+ *  PARAMETERS:
+ *
+ *      lp      - pointer to the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      an HCF status code
+ *
+ ******************************************************************************/
+int wl_mbx( struct wl_private *lp )
+{
+	int hcf_status = HCF_SUCCESS;
+	/*------------------------------------------------------------------------*/
+	DBG_FUNC( "wl_mbx" );
+	DBG_ENTER( DbgInfo );
+	DBG_TRACE( DbgInfo, "Mailbox Info: IFB_MBInfoLen: %d\n",
+			   lp->hcfCtx.IFB_MBInfoLen );
+
+	memset( &( lp->ltvRecord ), 0, sizeof( ltv_t ));
+
+	lp->ltvRecord.len = MB_SIZE;
+	lp->ltvRecord.typ = CFG_MB_INFO;
+	hcf_status = hcf_get_info( &lp->hcfCtx, (LTVP)&( lp->ltvRecord ));
+
+	if ( hcf_status != HCF_SUCCESS ) {
+		DBG_ERROR( DbgInfo, "hcf_get_info returned 0x%x\n", hcf_status );
+
+		DBG_LEAVE( DbgInfo );
+		return hcf_status;
+	}
+
+	if ( lp->ltvRecord.typ == CFG_MB_INFO ) {
+		DBG_LEAVE( DbgInfo );
+		return hcf_status;
+	}
+	/* Endian translate the mailbox data, then process the message */
+	wl_endian_translate_mailbox( &( lp->ltvRecord ));
+	wl_process_mailbox( lp );
+	DBG_LEAVE( DbgInfo );
+	return hcf_status;
+} // wl_mbx
+/*============================================================================*/
+
+
+/*******************************************************************************
+ *	wl_endian_translate_mailbox()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      This function will perform the tedious task of endian translating all
+ *  fields withtin a mailbox message which need translating.
+ *
+ *  PARAMETERS:
+ *
+ *      ltv - pointer to the LTV to endian translate
+ *
+ *  RETURNS:
+ *
+ *      none
+ *
+ ******************************************************************************/
+void wl_endian_translate_mailbox( ltv_t *ltv )
+{
+
+	DBG_FUNC( "wl_endian_translate_mailbox" );
+	DBG_ENTER( DbgInfo );
+	switch( ltv->typ ) {
+	  case CFG_TALLIES:
+		break;
+
+	  case CFG_SCAN:
+		{
+			int num_aps;
+			SCAN_RS_STRCT *aps = (SCAN_RS_STRCT *)&ltv->u.u8[0];
+
+			num_aps = (hcf_16)(( (size_t)(ltv->len - 1 ) * 2 ) /
+								 ( sizeof( SCAN_RS_STRCT )));
+
+			while( num_aps >= 1 ) {
+				num_aps--;
+
+				aps[num_aps].channel_id =
+					CNV_LITTLE_TO_INT( aps[num_aps].channel_id );
+
+				aps[num_aps].noise_level =
+					CNV_LITTLE_TO_INT( aps[num_aps].noise_level );
+
+				aps[num_aps].signal_level =
+					CNV_LITTLE_TO_INT( aps[num_aps].signal_level );
+
+				aps[num_aps].beacon_interval_time =
+					CNV_LITTLE_TO_INT( aps[num_aps].beacon_interval_time );
+
+				aps[num_aps].capability =
+					CNV_LITTLE_TO_INT( aps[num_aps].capability );
+
+				aps[num_aps].ssid_len =
+					CNV_LITTLE_TO_INT( aps[num_aps].ssid_len );
+
+				aps[num_aps].ssid_val[aps[num_aps].ssid_len] = 0;
+			}
+		}
+		break;
+
+	  case CFG_ACS_SCAN:
+		{
+			PROBE_RESP *probe_resp = (PROBE_RESP *)ltv;
+
+			probe_resp->frameControl   = CNV_LITTLE_TO_INT( probe_resp->frameControl );
+			probe_resp->durID          = CNV_LITTLE_TO_INT( probe_resp->durID );
+			probe_resp->sequence       = CNV_LITTLE_TO_INT( probe_resp->sequence );
+			probe_resp->dataLength     = CNV_LITTLE_TO_INT( probe_resp->dataLength );
+#ifndef WARP
+			probe_resp->lenType        = CNV_LITTLE_TO_INT( probe_resp->lenType );
+#endif // WARP
+			probe_resp->beaconInterval = CNV_LITTLE_TO_INT( probe_resp->beaconInterval );
+			probe_resp->capability     = CNV_LITTLE_TO_INT( probe_resp->capability );
+			probe_resp->flags          = CNV_LITTLE_TO_INT( probe_resp->flags );
+		}
+		break;
+
+	  case CFG_LINK_STAT:
+#define ls ((LINK_STATUS_STRCT *)ltv)
+			ls->linkStatus = CNV_LITTLE_TO_INT( ls->linkStatus );
+		break;
+#undef ls
+
+	  case CFG_ASSOC_STAT:
+		{
+			ASSOC_STATUS_STRCT *as = (ASSOC_STATUS_STRCT *)ltv;
+
+			as->assocStatus = CNV_LITTLE_TO_INT( as->assocStatus );
+		}
+		break;
+
+	  case CFG_SECURITY_STAT:
+		{
+			SECURITY_STATUS_STRCT *ss = (SECURITY_STATUS_STRCT *)ltv;
+
+			ss->securityStatus  = CNV_LITTLE_TO_INT( ss->securityStatus );
+			ss->reason          = CNV_LITTLE_TO_INT( ss->reason );
+		}
+		break;
+
+	  case CFG_WMP:
+		break;
+
+	  case CFG_NULL:
+		break;
+
+	default:
+		break;
+	}
+
+	DBG_LEAVE( DbgInfo );
+	return;
+} // wl_endian_translate_mailbox
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_process_mailbox()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      This function will process the mailbox data.
+ *
+ *  PARAMETERS:
+ *
+ *      ltv - pointer to the LTV to be processed.
+ *
+ *  RETURNS:
+ *
+ *      none
+ *
+ ******************************************************************************/
+void wl_process_mailbox( struct wl_private *lp )
+{
+	ltv_t   *ltv;
+	hcf_16  ltv_val = 0xFFFF;
+	/*------------------------------------------------------------------------*/
+	DBG_FUNC( "wl_process_mailbox" );
+	DBG_ENTER( DbgInfo );
+	ltv = &( lp->ltvRecord );
+
+	switch( ltv->typ ) {
+
+	  case CFG_TALLIES:
+		DBG_TRACE( DbgInfo, "CFG_TALLIES\n" );
+		break;
+	  case CFG_SCAN:
+		DBG_TRACE( DbgInfo, "CFG_SCAN\n" );
+
+		{
+			int num_aps;
+			SCAN_RS_STRCT *aps = (SCAN_RS_STRCT *)&ltv->u.u8[0];
+
+			num_aps = (hcf_16)(( (size_t)(ltv->len - 1 ) * 2 ) /
+								 ( sizeof( SCAN_RS_STRCT )));
+
+			lp->scan_results.num_aps = num_aps;
+
+			DBG_TRACE( DbgInfo, "Number of APs: %d\n", num_aps );
+
+			while( num_aps >= 1 ) {
+				num_aps--;
+
+				DBG_TRACE( DbgInfo, "AP              : %d\n", num_aps );
+				DBG_TRACE( DbgInfo, "=========================\n" );
+				DBG_TRACE( DbgInfo, "Channel ID      : 0x%04x\n",
+						   aps[num_aps].channel_id );
+				DBG_TRACE( DbgInfo, "Noise Level     : 0x%04x\n",
+						   aps[num_aps].noise_level );
+				DBG_TRACE( DbgInfo, "Signal Level    : 0x%04x\n",
+						   aps[num_aps].signal_level );
+				DBG_TRACE( DbgInfo, "Beacon Interval : 0x%04x\n",
+						   aps[num_aps].beacon_interval_time );
+				DBG_TRACE( DbgInfo, "Capability      : 0x%04x\n",
+						   aps[num_aps].capability );
+				DBG_TRACE( DbgInfo, "SSID Length     : 0x%04x\n",
+						   aps[num_aps].ssid_len );
+				DBG_TRACE( DbgInfo, "BSSID           : %s\n",
+						   DbgHwAddr( aps[num_aps].bssid ));
+
+				if ( aps[num_aps].ssid_len != 0 ) {
+					DBG_TRACE( DbgInfo, "SSID            : %s.\n",
+							   aps[num_aps].ssid_val );
+				} else {
+					DBG_TRACE( DbgInfo, "SSID            : %s.\n", "ANY" );
+				}
+
+				DBG_TRACE( DbgInfo, "\n" );
+
+				/* Copy the info to the ScanResult structure in the private
+				   adapter struct */
+				memcpy( &( lp->scan_results.APTable[num_aps]), &( aps[num_aps] ),
+						sizeof( SCAN_RS_STRCT ));
+			}
+
+			/* Set scan result to true so that any scan requests will
+			   complete */
+			lp->scan_results.scan_complete = TRUE;
+		}
+
+		break;
+	  case CFG_ACS_SCAN:
+		DBG_TRACE( DbgInfo, "CFG_ACS_SCAN\n" );
+
+		{
+			PROBE_RESP  *probe_rsp = (PROBE_RESP *)ltv;
+			hcf_8       *wpa_ie = NULL;
+			hcf_16      wpa_ie_len = 0;
+
+			DBG_TRACE( DbgInfo, "(%s) =========================\n",
+					   lp->dev->name );
+
+			DBG_TRACE( DbgInfo, "(%s) length      : 0x%04x.\n",
+					   lp->dev->name, probe_rsp->length );
+
+			if ( probe_rsp->length > 1 ) {
+				DBG_TRACE( DbgInfo, "(%s) infoType    : 0x%04x.\n",
+						   lp->dev->name, probe_rsp->infoType );
+
+				DBG_TRACE( DbgInfo, "(%s) signal      : 0x%02x.\n",
+						   lp->dev->name, probe_rsp->signal );
+
+				DBG_TRACE( DbgInfo, "(%s) silence     : 0x%02x.\n",
+						   lp->dev->name, probe_rsp->silence );
+
+				DBG_TRACE( DbgInfo, "(%s) rxFlow      : 0x%02x.\n",
+						   lp->dev->name, probe_rsp->rxFlow );
+
+				DBG_TRACE( DbgInfo, "(%s) rate        : 0x%02x.\n",
+						   lp->dev->name, probe_rsp->rate );
+
+				DBG_TRACE( DbgInfo, "(%s) frame cntl  : 0x%04x.\n",
+						   lp->dev->name, probe_rsp->frameControl );
+
+				DBG_TRACE( DbgInfo, "(%s) durID       : 0x%04x.\n",
+						   lp->dev->name, probe_rsp->durID );
+
+				DBG_TRACE( DbgInfo, "(%s) address1    : %s\n",
+						   lp->dev->name, DbgHwAddr( probe_rsp->address1 ));
+
+				DBG_TRACE( DbgInfo, "(%s) address2    : %s\n",
+						   lp->dev->name, DbgHwAddr( probe_rsp->address2 ));
+
+				DBG_TRACE( DbgInfo, "(%s) BSSID       : %s\n",
+						   lp->dev->name, DbgHwAddr( probe_rsp->BSSID ));
+
+				DBG_TRACE( DbgInfo, "(%s) sequence    : 0x%04x.\n",
+						   lp->dev->name, probe_rsp->sequence );
+
+				DBG_TRACE( DbgInfo, "(%s) address4    : %s\n",
+						   lp->dev->name, DbgHwAddr( probe_rsp->address4 ));
+
+				DBG_TRACE( DbgInfo, "(%s) datalength  : 0x%04x.\n",
+						   lp->dev->name, probe_rsp->dataLength );
+
+				DBG_TRACE( DbgInfo, "(%s) DA          : %s\n",
+						   lp->dev->name, DbgHwAddr( probe_rsp->DA ));
+
+				DBG_TRACE( DbgInfo, "(%s) SA          : %s\n",
+						   lp->dev->name, DbgHwAddr( probe_rsp->SA ));
+
+				//DBG_TRACE( DbgInfo, "(%s) lenType     : 0x%04x.\n",
+				//           lp->dev->name, probe_rsp->lenType );
+
+				DBG_TRACE( DbgInfo, "(%s) timeStamp   : %s\n",
+						   lp->dev->name, DbgHwAddr( probe_rsp->timeStamp ));
+
+				DBG_TRACE( DbgInfo, "(%s) beaconInt   : 0x%04x.\n",
+						   lp->dev->name, probe_rsp->beaconInterval );
+
+				DBG_TRACE( DbgInfo, "(%s) capability  : 0x%04x.\n",
+						   lp->dev->name, probe_rsp->capability );
+
+				DBG_TRACE( DbgInfo, "(%s) SSID len    : 0x%04x.\n",
+						   lp->dev->name, probe_rsp->rawData[1] );
+
+				if ( probe_rsp->rawData[1] > 0 ) {
+					char ssid[HCF_MAX_NAME_LEN];
+
+					memset( ssid, 0, sizeof( ssid ));
+					strncpy( ssid, &probe_rsp->rawData[2],
+							 probe_rsp->rawData[1] );
+
+					DBG_TRACE( DbgInfo, "(%s) SSID        : %s\n",
+							   lp->dev->name, ssid );
+				}
+
+				/* Parse out the WPA-IE, if one exists */
+				wpa_ie = wl_parse_wpa_ie( probe_rsp, &wpa_ie_len );
+				if ( wpa_ie != NULL ) {
+					DBG_TRACE( DbgInfo, "(%s) WPA-IE      : %s\n",
+					lp->dev->name, wl_print_wpa_ie( wpa_ie, wpa_ie_len ));
+				}
+
+				DBG_TRACE( DbgInfo, "(%s) flags       : 0x%04x.\n",
+						   lp->dev->name, probe_rsp->flags );
+			}
+
+			DBG_TRACE( DbgInfo, "\n\n" );
+			/* If probe response length is 1, then the scan is complete */
+			if ( probe_rsp->length == 1 ) {
+				DBG_TRACE( DbgInfo, "SCAN COMPLETE\n" );
+				lp->probe_results.num_aps = lp->probe_num_aps;
+				lp->probe_results.scan_complete = TRUE;
+
+				/* Reset the counter for the next scan request */
+				lp->probe_num_aps = 0;
+
+				/* Send a wireless extensions event that the scan completed */
+				wl_wext_event_scan_complete( lp->dev );
+			} else {
+				/* Only copy to the table if the entry is unique; APs sometimes
+				   respond more than once to a probe */
+				if ( lp->probe_num_aps == 0 ) {
+					/* Copy the info to the ScanResult structure in the private
+					adapter struct */
+					memcpy( &( lp->probe_results.ProbeTable[lp->probe_num_aps] ),
+							probe_rsp, sizeof( PROBE_RESP ));
+
+					/* Increment the number of APs detected */
+					lp->probe_num_aps++;
+				} else {
+					int count;
+					int unique = 1;
+
+					for( count = 0; count < lp->probe_num_aps; count++ ) {
+						if ( memcmp( &( probe_rsp->BSSID ),
+							lp->probe_results.ProbeTable[count].BSSID,
+							ETH_ALEN ) == 0 ) {
+							unique = 0;
+						}
+					}
+
+					if ( unique ) {
+						/* Copy the info to the ScanResult structure in the
+						private adapter struct. Only copy if there's room in the
+						table */
+						if ( lp->probe_num_aps < MAX_NAPS )
+						{
+							memcpy( &( lp->probe_results.ProbeTable[lp->probe_num_aps] ),
+									probe_rsp, sizeof( PROBE_RESP ));
+						}
+						else
+						{
+							DBG_WARNING( DbgInfo, "Num of scan results exceeds storage, truncating\n" );
+						}
+
+						/* Increment the number of APs detected. Note I do this
+						   here even when I don't copy the probe response to the
+						   buffer in order to detect the overflow condition */
+						lp->probe_num_aps++;
+					}
+				}
+			}
+		}
+
+		break;
+
+	  case CFG_LINK_STAT:
+#define ls ((LINK_STATUS_STRCT *)ltv)
+		DBG_TRACE( DbgInfo, "CFG_LINK_STAT\n" );
+
+		switch( ls->linkStatus ) {
+		  case 1:
+			DBG_TRACE( DbgInfo, "Link Status : Connected\n" );
+			wl_wext_event_ap( lp->dev );
+			break;
+
+		  case 2:
+			DBG_TRACE( DbgInfo, "Link Status : Disconnected\n"  );
+			break;
+
+		  case 3:
+			DBG_TRACE( DbgInfo, "Link Status : Access Point Change\n" );
+			break;
+
+		  case 4:
+			DBG_TRACE( DbgInfo, "Link Status : Access Point Out of Range\n" );
+			break;
+
+		  case 5:
+			DBG_TRACE( DbgInfo, "Link Status : Access Point In Range\n" );
+			break;
+
+		default:
+			DBG_TRACE( DbgInfo, "Link Status : UNKNOWN (0x%04x)\n",
+					   ls->linkStatus );
+			break;
+		}
+
+		break;
+#undef ls
+
+	  case CFG_ASSOC_STAT:
+		DBG_TRACE( DbgInfo, "CFG_ASSOC_STAT\n" );
+
+		{
+			ASSOC_STATUS_STRCT *as = (ASSOC_STATUS_STRCT *)ltv;
+
+			switch( as->assocStatus ) {
+			  case 1:
+				DBG_TRACE( DbgInfo, "Association Status : STA Associated\n" );
+				break;
+
+			  case 2:
+				DBG_TRACE( DbgInfo, "Association Status : STA Reassociated\n" );
+				break;
+
+			  case 3:
+				DBG_TRACE( DbgInfo, "Association Status : STA Disassociated\n" );
+				break;
+
+			default:
+				DBG_TRACE( DbgInfo, "Association Status : UNKNOWN (0x%04x)\n",
+						   as->assocStatus );
+				break;
+			}
+
+			DBG_TRACE( DbgInfo, "STA Address        : %s\n",
+					   DbgHwAddr( as->staAddr ));
+
+			if (( as->assocStatus == 2 )  && ( as->len == 8 )) {
+				DBG_TRACE( DbgInfo, "Old AP Address     : %s\n",
+						   DbgHwAddr( as->oldApAddr ));
+			}
+		}
+
+		break;
+
+	  case CFG_SECURITY_STAT:
+		DBG_TRACE( DbgInfo, "CFG_SECURITY_STAT\n" );
+
+		{
+			SECURITY_STATUS_STRCT *ss = (SECURITY_STATUS_STRCT *)ltv;
+
+			switch( ss->securityStatus ) {
+			  case 1:
+				DBG_TRACE( DbgInfo, "Security Status : Dissassociate [AP]\n" );
+				break;
+
+			  case 2:
+				DBG_TRACE( DbgInfo, "Security Status : Deauthenticate [AP]\n" );
+				break;
+
+			  case 3:
+				DBG_TRACE( DbgInfo, "Security Status : Authenticate Fail [STA] or [AP]\n" );
+				break;
+
+			  case 4:
+				DBG_TRACE( DbgInfo, "Security Status : MIC Fail\n" );
+				break;
+
+			  case 5:
+				DBG_TRACE( DbgInfo, "Security Status : Associate Fail\n" );
+				break;
+
+			default:
+				DBG_TRACE( DbgInfo, "Security Status : UNKNOWN %d\n",
+						   ss->securityStatus );
+				break;
+			}
+
+			DBG_TRACE( DbgInfo, "STA Address     : %s\n", DbgHwAddr( ss->staAddr ));
+
+			DBG_TRACE( DbgInfo, "Reason          : 0x%04x \n", ss->reason );
+		}
+
+		break;
+
+	  case CFG_WMP:
+		DBG_TRACE( DbgInfo, "CFG_WMP, size is %d bytes\n", ltv->len );
+		{
+			WMP_RSP_STRCT *wmp_rsp = (WMP_RSP_STRCT *)ltv;
+
+			DBG_TRACE( DbgInfo, "CFG_WMP, pdu type is 0x%x\n",
+					   wmp_rsp->wmpRsp.wmpHdr.type );
+
+			switch( wmp_rsp->wmpRsp.wmpHdr.type ) {
+			  case WVLAN_WMP_PDU_TYPE_LT_RSP:
+				{
+#if DBG
+					LINKTEST_RSP_STRCT  *lt_rsp = (LINKTEST_RSP_STRCT *)ltv;
+#endif // DBG
+					DBG_TRACE( DbgInfo, "LINK TEST RESULT\n" );
+					DBG_TRACE( DbgInfo, "================\n" );
+					DBG_TRACE( DbgInfo, "Length        : %d.\n",     lt_rsp->len );
+
+					DBG_TRACE( DbgInfo, "Name          : %s.\n",     lt_rsp->ltRsp.ltRsp.name );
+					DBG_TRACE( DbgInfo, "Signal Level  : 0x%02x.\n", lt_rsp->ltRsp.ltRsp.signal );
+					DBG_TRACE( DbgInfo, "Noise  Level  : 0x%02x.\n", lt_rsp->ltRsp.ltRsp.noise );
+					DBG_TRACE( DbgInfo, "Receive Flow  : 0x%02x.\n", lt_rsp->ltRsp.ltRsp.rxFlow );
+					DBG_TRACE( DbgInfo, "Data Rate     : 0x%02x.\n", lt_rsp->ltRsp.ltRsp.dataRate );
+					DBG_TRACE( DbgInfo, "Protocol      : 0x%04x.\n", lt_rsp->ltRsp.ltRsp.protocol );
+					DBG_TRACE( DbgInfo, "Station       : 0x%02x.\n", lt_rsp->ltRsp.ltRsp.station );
+					DBG_TRACE( DbgInfo, "Data Rate Cap : 0x%02x.\n", lt_rsp->ltRsp.ltRsp.dataRateCap );
+
+					DBG_TRACE( DbgInfo, "Power Mgmt    : 0x%02x 0x%02x 0x%02x 0x%02x.\n",
+								lt_rsp->ltRsp.ltRsp.powerMgmt[0],
+								lt_rsp->ltRsp.ltRsp.powerMgmt[1],
+								lt_rsp->ltRsp.ltRsp.powerMgmt[2],
+								lt_rsp->ltRsp.ltRsp.powerMgmt[3] );
+
+					DBG_TRACE( DbgInfo, "Robustness    : 0x%02x 0x%02x 0x%02x 0x%02x.\n",
+								lt_rsp->ltRsp.ltRsp.robustness[0],
+								lt_rsp->ltRsp.ltRsp.robustness[1],
+								lt_rsp->ltRsp.ltRsp.robustness[2],
+								lt_rsp->ltRsp.ltRsp.robustness[3] );
+
+					DBG_TRACE( DbgInfo, "Scaling       : 0x%02x.\n", lt_rsp->ltRsp.ltRsp.scaling );
+				}
+
+				break;
+
+			default:
+				break;
+			}
+		}
+
+		break;
+
+	  case CFG_NULL:
+		DBG_TRACE( DbgInfo, "CFG_NULL\n" );
+		break;
+
+	  case CFG_UPDATED_INFO_RECORD:        // Updated Information Record
+		DBG_TRACE( DbgInfo, "UPDATED INFORMATION RECORD\n" );
+
+		ltv_val = CNV_INT_TO_LITTLE( ltv->u.u16[0] );
+
+		/* Check and see which RID was updated */
+		switch( ltv_val ) {
+		  case CFG_CUR_COUNTRY_INFO:  // Indicate Passive Scan Completion
+			DBG_TRACE( DbgInfo, "Updated country info\n" );
+
+			/* Do I need to hold off on updating RIDs until the process is
+			   complete? */
+			wl_connect( lp );
+			break;
+
+		  case CFG_PORT_STAT:    // Wait for Connect Event
+			//wl_connect( lp );
+
+			break;
+
+		default:
+			DBG_WARNING( DbgInfo, "Unknown RID: 0x%04x\n", ltv_val );
+		}
+
+		break;
+
+	default:
+		DBG_TRACE( DbgInfo, "UNKNOWN MESSAGE: 0x%04x\n", ltv->typ );
+		break;
+	}
+	DBG_LEAVE( DbgInfo );
+	return;
+} // wl_process_mailbox
+/*============================================================================*/
+#endif  /* ifndef USE_MBOX_SYNC */
+
+#ifdef USE_WDS
+/*******************************************************************************
+ *	wl_wds_netdev_register()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      This function registers net_device structures with the system's network
+ *      layer for use with the WDS ports.
+ *
+ *
+ *  PARAMETERS:
+ *
+ *      lp      - pointer to the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+void wl_wds_netdev_register( struct wl_private *lp )
+{
+	int count;
+	/*------------------------------------------------------------------------*/
+	DBG_FUNC( "wl_wds_netdev_register" );
+	DBG_ENTER( DbgInfo );
+	//;?why is there no USE_WDS clause like in wl_enable_wds_ports
+	if ( CNV_INT_TO_LITTLE( lp->hcfCtx.IFB_FWIdentity.comp_id ) == COMP_ID_FW_AP  ) {
+		for( count = 0; count < NUM_WDS_PORTS; count++ ) {
+			if ( WVLAN_VALID_MAC_ADDRESS( lp->wds_port[count].wdsAddress )) {
+				if ( register_netdev( lp->wds_port[count].dev ) != 0 ) {
+					DBG_WARNING( DbgInfo, "net device for WDS port %d could not be registered\n",
+								( count + 1 ));
+				}
+				lp->wds_port[count].is_registered = TRUE;
+
+				/* Fill out the net_device structs with the MAC addr */
+				memcpy( lp->wds_port[count].dev->dev_addr, lp->MACAddress, ETH_ALEN );
+				lp->wds_port[count].dev->addr_len = ETH_ALEN;
+			}
+		}
+	}
+	DBG_LEAVE( DbgInfo );
+	return;
+} // wl_wds_netdev_register
+/*============================================================================*/
+
+
+/*******************************************************************************
+ *	wl_wds_netdev_deregister()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      This function deregisters the WDS net_device structures used by the
+ *      system's network layer.
+ *
+ *
+ *  PARAMETERS:
+ *
+ *      lp      - pointer to the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+void wl_wds_netdev_deregister( struct wl_private *lp )
+{
+	int count;
+	/*------------------------------------------------------------------------*/
+	DBG_FUNC( "wl_wds_netdev_deregister" );
+	DBG_ENTER( DbgInfo );
+	if ( CNV_INT_TO_LITTLE( lp->hcfCtx.IFB_FWIdentity.comp_id ) == COMP_ID_FW_AP  ) {
+		for( count = 0; count < NUM_WDS_PORTS; count++ ) {
+			if ( WVLAN_VALID_MAC_ADDRESS( lp->wds_port[count].wdsAddress )) {
+				unregister_netdev( lp->wds_port[count].dev );
+			}
+			lp->wds_port[count].is_registered = FALSE;
+		}
+	}
+	DBG_LEAVE( DbgInfo );
+	return;
+} // wl_wds_netdev_deregister
+/*============================================================================*/
+#endif  /* USE_WDS */
+
+
+#if 0 //SCULL_USE_PROC /* don't waste space if unused */
+/*
+ * The proc filesystem: function to read and entry
+ */
+int printf_hcf_16( char *s, char *buf, hcf_16* p, int n );
+int printf_hcf_16( char *s, char *buf, hcf_16* p, int n ) {
+
+int i, len;
+
+	len = sprintf(buf, "%s", s );
+	while ( len < 20 ) len += sprintf(buf+len, " " );
+	len += sprintf(buf+len,": " );
+	for ( i = 0; i < n; i++ ) {
+		if ( len % 80 > 75 ) {
+			len += sprintf(buf+len,"\n" );
+		}
+		len += sprintf(buf+len,"%04X ", p[i] );
+	}
+	len += sprintf(buf+len,"\n" );
+	return len;
+} // printf_hcf_16
+
+int printf_hcf_8( char *s, char *buf, hcf_8* p, int n );
+int printf_hcf_8( char *s, char *buf, hcf_8* p, int n ) {
+
+int i, len;
+
+	len = sprintf(buf, "%s", s );
+	while ( len < 20 ) len += sprintf(buf+len, " " );
+	len += sprintf(buf+len,": " );
+	for ( i = 0; i <= n; i++ ) {
+		if ( len % 80 > 77 ) {
+			len += sprintf(buf+len,"\n" );
+		}
+		len += sprintf(buf+len,"%02X ", p[i] );
+	}
+	len += sprintf(buf+len,"\n" );
+	return len;
+} // printf_hcf8
+
+int printf_strct( char *s, char *buf, hcf_16* p );
+int printf_strct( char *s, char *buf, hcf_16* p ) {
+
+int i, len;
+
+	len = sprintf(buf, "%s", s );
+	while ( len < 20 ) len += sprintf(buf+len, " " );
+	len += sprintf(buf+len,": " );
+	for ( i = 0; i <= *p; i++ ) {
+		if ( len % 80 > 75 ) {
+			len += sprintf(buf+len,"\n" );
+		}
+		len += sprintf(buf+len,"%04X ", p[i] );
+	}
+	len += sprintf(buf+len,"\n" );
+	return len;
+} // printf_strct
+
+int scull_read_procmem(char *buf, char **start, off_t offset, int len, int *eof, void *data )
+{
+	struct wl_private	*lp = NULL;
+	IFBP				ifbp;
+   	CFG_HERMES_TALLIES_STRCT *p;
+
+    #define LIMIT (PAGE_SIZE-80) /* don't print any more after this size */
+
+    len=0;
+
+	if ( ( lp = ((struct net_device *)data)->priv ) == NULL ) {
+        len += sprintf(buf+len,"No wl_private in scull_read_procmem\n" );
+	} else if ( lp->wlags49_type == 0 ){
+   	    ifbp = &lp->hcfCtx;
+   	    len += sprintf(buf+len,"Magic:               0x%04X\n", ifbp->IFB_Magic );
+   	    len += sprintf(buf+len,"IOBase:              0x%04X\n", ifbp->IFB_IOBase );
+   	    len += sprintf(buf+len,"LinkStat:            0x%04X\n", ifbp->IFB_LinkStat );
+   	    len += sprintf(buf+len,"DSLinkStat:          0x%04X\n", ifbp->IFB_DSLinkStat );
+   	    len += sprintf(buf+len,"TickIni:         0x%08lX\n", ifbp->IFB_TickIni );
+   	    len += sprintf(buf+len,"TickCnt:             0x%04X\n", ifbp->IFB_TickCnt );
+   	    len += sprintf(buf+len,"IntOffCnt:           0x%04X\n", ifbp->IFB_IntOffCnt );
+		len += printf_hcf_16( "IFB_FWIdentity", &buf[len],
+							  &ifbp->IFB_FWIdentity.len, ifbp->IFB_FWIdentity.len + 1 );
+	} else if ( lp->wlags49_type == 1 ) {
+   	    len += sprintf(buf+len,"Channel:              0x%04X\n", lp->Channel );
+/****** len += sprintf(buf+len,"slock:                  %d\n", lp->slock );		*/
+//x		struct tq_struct            "task:               0x%04X\n", lp->task );
+//x		struct net_device_stats     "stats:              0x%04X\n", lp->stats );
+#ifdef WIRELESS_EXT
+//x		struct iw_statistics        "wstats:             0x%04X\n", lp->wstats );
+//x   	    len += sprintf(buf+len,"spy_number:           0x%04X\n", lp->spy_number );
+//x		u_char                      spy_address[IW_MAX_SPY][ETH_ALEN];
+//x		struct iw_quality           spy_stat[IW_MAX_SPY];
+#endif // WIRELESS_EXT
+   	    len += sprintf(buf+len,"IFB:                  0x%p\n", &lp->hcfCtx );
+   	    len += sprintf(buf+len,"flags:                %#.8lX\n", lp->flags );  //;?use this format from now on
+   	    len += sprintf(buf+len,"DebugFlag(wl_private) 0x%04X\n", lp->DebugFlag );
+#if DBG
+   	    len += sprintf(buf+len,"DebugFlag (DbgInfo):   0x%08lX\n", DbgInfo->DebugFlag );
+#endif // DBG
+   	    len += sprintf(buf+len,"is_registered:        0x%04X\n", lp->is_registered );
+//x		CFG_DRV_INFO_STRCT          "driverInfo:         0x%04X\n", lp->driverInfo );
+		len += printf_strct( "driverInfo", &buf[len], (hcf_16*)&lp->driverInfo );
+//x		CFG_IDENTITY_STRCT          "driverIdentity:     0x%04X\n", lp->driverIdentity );
+		len += printf_strct( "driverIdentity", &buf[len], (hcf_16*)&lp->driverIdentity );
+//x		CFG_FW_IDENTITY_STRCT       "StationIdentity:    0x%04X\n", lp->StationIdentity );
+		len += printf_strct( "StationIdentity", &buf[len], (hcf_16*)&lp->StationIdentity );
+//x		CFG_PRI_IDENTITY_STRCT      "PrimaryIdentity:    0x%04X\n", lp->PrimaryIdentity );
+		len += printf_strct( "PrimaryIdentity", &buf[len], (hcf_16*)&lp->hcfCtx.IFB_PRIIdentity );
+		len += printf_strct( "PrimarySupplier", &buf[len], (hcf_16*)&lp->hcfCtx.IFB_PRISup );
+//x		CFG_PRI_IDENTITY_STRCT      "NICIdentity:        0x%04X\n", lp->NICIdentity );
+		len += printf_strct( "NICIdentity", &buf[len], (hcf_16*)&lp->NICIdentity );
+//x		ltv_t                       "ltvRecord:          0x%04X\n", lp->ltvRecord );
+   	    len += sprintf(buf+len,"txBytes:              0x%08lX\n", lp->txBytes );
+   	    len += sprintf(buf+len,"maxPort:              0x%04X\n", lp->maxPort );        /* 0 for STA, 6 for AP */
+	/* Elements used for async notification from hardware */
+//x		RID_LOG_STRCT				RidList[10];
+//x		ltv_t                       "updatedRecord:      0x%04X\n", lp->updatedRecord );
+//x		PROBE_RESP				    "ProbeResp:                    0x%04X\n", lp->ProbeResp );
+//x		ASSOC_STATUS_STRCT          "assoc_stat:         0x%04X\n", lp->assoc_stat );
+//x		SECURITY_STATUS_STRCT       "sec_stat:           0x%04X\n", lp->sec_stat );
+//x		u_char                      lookAheadBuf[WVLAN_MAX_LOOKAHEAD];
+   	    len += sprintf(buf+len,"PortType:             0x%04X\n", lp->PortType );           // 1 - 3 (1 [Normal] | 3 [AdHoc])
+   	    len += sprintf(buf+len,"Channel:              0x%04X\n", lp->Channel );            // 0 - 14 (0)
+//x		hcf_16                      TxRateControl[2];
+   	    len += sprintf(buf+len,"TxRateControl[2]:     0x%04X 0x%04X\n",
+						lp->TxRateControl[0], lp->TxRateControl[1] );
+   	    len += sprintf(buf+len,"DistanceBetweenAPs:   0x%04X\n", lp->DistanceBetweenAPs ); // 1 - 3 (1)
+   	    len += sprintf(buf+len,"RTSThreshold:         0x%04X\n", lp->RTSThreshold );       // 0 - 2347 (2347)
+   	    len += sprintf(buf+len,"PMEnabled:            0x%04X\n", lp->PMEnabled );          // 0 - 2, 8001 - 8002 (0)
+   	    len += sprintf(buf+len,"MicrowaveRobustness:  0x%04X\n", lp->MicrowaveRobustness );// 0 - 1 (0)
+   	    len += sprintf(buf+len,"CreateIBSS:           0x%04X\n", lp->CreateIBSS );         // 0 - 1 (0)
+   	    len += sprintf(buf+len,"MulticastReceive:     0x%04X\n", lp->MulticastReceive );   // 0 - 1 (1)
+   	    len += sprintf(buf+len,"MaxSleepDuration:     0x%04X\n", lp->MaxSleepDuration );   // 0 - 65535 (100)
+//x		hcf_8                       MACAddress[ETH_ALEN];
+		len += printf_hcf_8( "MACAddress", &buf[len], lp->MACAddress, ETH_ALEN );
+//x		char                        NetworkName[HCF_MAX_NAME_LEN+1];
+   	    len += sprintf(buf+len,"NetworkName:          %.32s\n", lp->NetworkName );
+//x		char                        StationName[HCF_MAX_NAME_LEN+1];
+   	    len += sprintf(buf+len,"EnableEncryption:     0x%04X\n", lp->EnableEncryption );   // 0 - 1 (0)
+//x		char                        Key1[MAX_KEY_LEN+1];
+		len += printf_hcf_8( "Key1", &buf[len], lp->Key1, MAX_KEY_LEN );
+//x		char                        Key2[MAX_KEY_LEN+1];
+//x		char                        Key3[MAX_KEY_LEN+1];
+//x		char                        Key4[MAX_KEY_LEN+1];
+   	    len += sprintf(buf+len,"TransmitKeyID:        0x%04X\n", lp->TransmitKeyID );      // 1 - 4 (1)
+//x		CFG_DEFAULT_KEYS_STRCT	    "DefaultKeys:         0x%04X\n", lp->DefaultKeys );
+//x		u_char                      mailbox[MB_SIZE];
+//x		char                        szEncryption[MAX_ENC_LEN];
+   	    len += sprintf(buf+len,"driverEnable:         0x%04X\n", lp->driverEnable );
+   	    len += sprintf(buf+len,"wolasEnable:          0x%04X\n", lp->wolasEnable );
+   	    len += sprintf(buf+len,"atimWindow:           0x%04X\n", lp->atimWindow );
+   	    len += sprintf(buf+len,"holdoverDuration:     0x%04X\n", lp->holdoverDuration );
+//x		hcf_16                      MulticastRate[2];
+   	    len += sprintf(buf+len,"authentication:       0x%04X\n", lp->authentication ); // is this AP specific?
+   	    len += sprintf(buf+len,"promiscuousMode:      0x%04X\n", lp->promiscuousMode );
+   	    len += sprintf(buf+len,"DownloadFirmware:     0x%04X\n", lp->DownloadFirmware );   // 0 - 2 (0 [None] | 1 [STA] | 2 [AP])
+   	    len += sprintf(buf+len,"AuthKeyMgmtSuite:     0x%04X\n", lp->AuthKeyMgmtSuite );
+   	    len += sprintf(buf+len,"loadBalancing:        0x%04X\n", lp->loadBalancing );
+   	    len += sprintf(buf+len,"mediumDistribution:   0x%04X\n", lp->mediumDistribution );
+   	    len += sprintf(buf+len,"txPowLevel:           0x%04X\n", lp->txPowLevel );
+//   	    len += sprintf(buf+len,"shortRetryLimit:    0x%04X\n", lp->shortRetryLimit );
+//   	    len += sprintf(buf+len,"longRetryLimit:     0x%04X\n", lp->longRetryLimit );
+//x		hcf_16                      srsc[2];
+//x		hcf_16                      brsc[2];
+   	    len += sprintf(buf+len,"connectionControl:    0x%04X\n", lp->connectionControl );
+//x		//hcf_16                      probeDataRates[2];
+   	    len += sprintf(buf+len,"ownBeaconInterval:    0x%04X\n", lp->ownBeaconInterval );
+   	    len += sprintf(buf+len,"coexistence:          0x%04X\n", lp->coexistence );
+//x		WVLAN_FRAME                 "txF:                0x%04X\n", lp->txF );
+//x		WVLAN_LFRAME                txList[DEFAULT_NUM_TX_FRAMES];
+//x		struct list_head            "txFree:             0x%04X\n", lp->txFree );
+//x		struct list_head            txQ[WVLAN_MAX_TX_QUEUES];
+   	    len += sprintf(buf+len,"netif_queue_on:       0x%04X\n", lp->netif_queue_on );
+   	    len += sprintf(buf+len,"txQ_count:            0x%04X\n", lp->txQ_count );
+//x		DESC_STRCT                  "desc_rx:            0x%04X\n", lp->desc_rx );
+//x		DESC_STRCT                  "desc_tx:            0x%04X\n", lp->desc_tx );
+//x		WVLAN_PORT_STATE            "portState:          0x%04X\n", lp->portState );
+//x		ScanResult                  "scan_results:       0x%04X\n", lp->scan_results );
+//x		ProbeResult                 "probe_results:      0x%04X\n", lp->probe_results );
+   	    len += sprintf(buf+len,"probe_num_aps:        0x%04X\n", lp->probe_num_aps );
+   	    len += sprintf(buf+len,"use_dma:              0x%04X\n", lp->use_dma );
+//x		DMA_STRCT                   "dma:                0x%04X\n", lp->dma );
+#ifdef USE_RTS
+   	    len += sprintf(buf+len,"useRTS:               0x%04X\n", lp->useRTS );
+#endif  // USE_RTS
+#if 1 //;? (HCF_TYPE) & HCF_TYPE_AP
+		//;?should we restore this to allow smaller memory footprint
+		//;?I guess not. This should be brought under Debug mode only
+   	    len += sprintf(buf+len,"DTIMPeriod:           0x%04X\n", lp->DTIMPeriod );         // 1 - 255 (1)
+   	    len += sprintf(buf+len,"multicastPMBuffering: 0x%04X\n", lp->multicastPMBuffering );
+   	    len += sprintf(buf+len,"RejectAny:            0x%04X\n", lp->RejectAny );          // 0 - 1 (0)
+   	    len += sprintf(buf+len,"ExcludeUnencrypted:   0x%04X\n", lp->ExcludeUnencrypted ); // 0 - 1 (1)
+   	    len += sprintf(buf+len,"intraBSSRelay:        0x%04X\n", lp->intraBSSRelay );
+   	    len += sprintf(buf+len,"wlags49_type:             0x%08lX\n", lp->wlags49_type );
+#ifdef USE_WDS
+//x		WVLAN_WDS_IF                wds_port[NUM_WDS_PORTS];
+#endif // USE_WDS
+#endif // HCF_AP
+	} else if ( lp->wlags49_type == 2 ){
+        len += sprintf(buf+len,"tallies to be added\n" );
+//Hermes Tallies (IFB substructure) {
+   	    p = &lp->hcfCtx.IFB_NIC_Tallies;
+        len += sprintf(buf+len,"TxUnicastFrames:          %08lX\n", p->TxUnicastFrames );
+        len += sprintf(buf+len,"TxMulticastFrames:        %08lX\n", p->TxMulticastFrames );
+        len += sprintf(buf+len,"TxFragments:              %08lX\n", p->TxFragments );
+        len += sprintf(buf+len,"TxUnicastOctets:          %08lX\n", p->TxUnicastOctets );
+        len += sprintf(buf+len,"TxMulticastOctets:        %08lX\n", p->TxMulticastOctets );
+        len += sprintf(buf+len,"TxDeferredTransmissions:  %08lX\n", p->TxDeferredTransmissions );
+        len += sprintf(buf+len,"TxSingleRetryFrames:      %08lX\n", p->TxSingleRetryFrames );
+        len += sprintf(buf+len,"TxMultipleRetryFrames:    %08lX\n", p->TxMultipleRetryFrames );
+        len += sprintf(buf+len,"TxRetryLimitExceeded:     %08lX\n", p->TxRetryLimitExceeded );
+        len += sprintf(buf+len,"TxDiscards:               %08lX\n", p->TxDiscards );
+        len += sprintf(buf+len,"RxUnicastFrames:          %08lX\n", p->RxUnicastFrames );
+        len += sprintf(buf+len,"RxMulticastFrames:        %08lX\n", p->RxMulticastFrames );
+        len += sprintf(buf+len,"RxFragments:              %08lX\n", p->RxFragments );
+        len += sprintf(buf+len,"RxUnicastOctets:          %08lX\n", p->RxUnicastOctets );
+        len += sprintf(buf+len,"RxMulticastOctets:        %08lX\n", p->RxMulticastOctets );
+        len += sprintf(buf+len,"RxFCSErrors:              %08lX\n", p->RxFCSErrors );
+        len += sprintf(buf+len,"RxDiscardsNoBuffer:       %08lX\n", p->RxDiscardsNoBuffer );
+        len += sprintf(buf+len,"TxDiscardsWrongSA:        %08lX\n", p->TxDiscardsWrongSA );
+        len += sprintf(buf+len,"RxWEPUndecryptable:       %08lX\n", p->RxWEPUndecryptable );
+        len += sprintf(buf+len,"RxMsgInMsgFragments:      %08lX\n", p->RxMsgInMsgFragments );
+        len += sprintf(buf+len,"RxMsgInBadMsgFragments:   %08lX\n", p->RxMsgInBadMsgFragments );
+        len += sprintf(buf+len,"RxDiscardsWEPICVError:    %08lX\n", p->RxDiscardsWEPICVError );
+        len += sprintf(buf+len,"RxDiscardsWEPExcluded:    %08lX\n", p->RxDiscardsWEPExcluded );
+#if (HCF_EXT) & HCF_EXT_TALLIES_FW
+        //to be added ;?
+#endif // HCF_EXT_TALLIES_FW
+	} else if ( lp->wlags49_type & 0x8000 ) {	//;?kludgy but it is unclear to me were else to place this
+#if DBG
+		DbgInfo->DebugFlag = lp->wlags49_type & 0x7FFF;
+#endif // DBG
+		lp->wlags49_type = 0;				//default to IFB again ;?
+	} else {
+        len += sprintf(buf+len,"unknown value for wlags49_type: 0x%08lX\n", lp->wlags49_type );
+        len += sprintf(buf+len,"0x0000 - IFB\n" );
+        len += sprintf(buf+len,"0x0001 - wl_private\n" );
+        len += sprintf(buf+len,"0x0002 - Tallies\n" );
+        len += sprintf(buf+len,"0x8xxx - Change debufflag\n" );
+        len += sprintf(buf+len,"ERROR    0001\nWARNING  0002\nNOTICE   0004\nTRACE    0008\n" );
+        len += sprintf(buf+len,"VERBOSE  0010\nPARAM    0020\nBREAK    0040\nRX       0100\n" );
+        len += sprintf(buf+len,"TX       0200\nDS       0400\n" );
+	}
+    return len;
+} // scull_read_procmem
+
+static void proc_write(const char *name, write_proc_t *w, void *data)
+{
+	struct proc_dir_entry * entry = create_proc_entry(name, S_IFREG | S_IWUSR, NULL);
+	if (entry) {
+		entry->write_proc = w;
+		entry->data = data;
+	}
+} // proc_write
+
+static int write_int(struct file *file, const char *buffer, unsigned long count, void *data)
+{
+	static char		proc_number[11];
+	unsigned int	nr = 0;
+
+	DBG_FUNC( "write_int" );
+	DBG_ENTER( DbgInfo );
+
+	if (count > 9) {
+		count = -EINVAL;
+	} else if ( copy_from_user(proc_number, buffer, count) ) {
+		count = -EFAULT;
+	}
+	if  (count > 0 ) {
+		proc_number[count] = 0;
+		nr = wl_atoi( proc_number );
+ 		*(unsigned int *)data = nr;
+		if ( nr & 0x8000 ) {	//;?kludgy but it is unclear to me were else to place this
+#if DBG
+			DbgInfo->DebugFlag = nr & 0x7FFF;
+#endif // DBG
+		}
+	}
+	DBG_PRINT( "value: %08X\n", nr );
+	DBG_LEAVE( DbgInfo );
+	return count;
+} // write_int
+
+#endif /* SCULL_USE_PROC */
+
+#ifdef DN554
+#define RUN_AT(x)		(jiffies+(x))		//"borrowed" from include/pcmcia/k_compat.h
+#define DS_OOR	0x8000		//Deepsleep OutOfRange Status
+
+		lp->timer_oor_cnt = DS_OOR;
+		init_timer( &lp->timer_oor );
+		lp->timer_oor.function = timer_oor;
+		lp->timer_oor.data = (unsigned long)lp;
+		lp->timer_oor.expires = RUN_AT( 3 * HZ );
+		add_timer( &lp->timer_oor );
+		printk( "<5>wl_enable: %ld\n", jiffies );		//;?remove me 1 day
+#endif //DN554
+#ifdef DN554
+/*******************************************************************************
+ *	timer_oor()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *
+ *  PARAMETERS:
+ *
+ *      arg - a u_long representing a pointer to a dev_link_t structure for the
+ *            device to be released.
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+void timer_oor( u_long arg )
+{
+	struct wl_private       *lp = (struct wl_private *)arg;
+
+    /*------------------------------------------------------------------------*/
+
+    DBG_FUNC( "timer_oor" );
+    DBG_ENTER( DbgInfo );
+    DBG_PARAM( DbgInfo, "arg", "0x%08lx", arg );
+
+	printk( "<5>timer_oor: %ld 0x%04X\n", jiffies, lp->timer_oor_cnt );		//;?remove me 1 day
+	lp->timer_oor_cnt += 10;
+    if ( (lp->timer_oor_cnt & ~DS_OOR) > 300 ) {
+		lp->timer_oor_cnt = 300;
+	}
+	lp->timer_oor_cnt |= DS_OOR;
+	init_timer( &lp->timer_oor );
+	lp->timer_oor.function = timer_oor;
+	lp->timer_oor.data = (unsigned long)lp;
+	lp->timer_oor.expires = RUN_AT( (lp->timer_oor_cnt & ~DS_OOR) * HZ );
+	add_timer( &lp->timer_oor );
+
+    DBG_LEAVE( DbgInfo );
+} // timer_oor
+#endif //DN554
+
+MODULE_LICENSE("Dual BSD/GPL");
diff --git a/drivers/staging/wlags49_h2/wl_main.h b/drivers/staging/wlags49_h2/wl_main.h
new file mode 100644
index 000000000000..d593ae535fb8
--- /dev/null
+++ b/drivers/staging/wlags49_h2/wl_main.h
@@ -0,0 +1,138 @@
+/*******************************************************************************
+ * Agere Systems Inc.
+ * Wireless device driver for Linux (wlags49).
+ *
+ * Copyright (c) 1998-2003 Agere Systems Inc.
+ * All rights reserved.
+ *   http://www.agere.com
+ *
+ * Initially developed by TriplePoint, Inc.
+ *   http://www.triplepoint.com
+ *
+ *------------------------------------------------------------------------------
+ *
+ *   Header describing device specific routines and driver init/un-init.
+ *
+ *------------------------------------------------------------------------------
+ *
+ * SOFTWARE LICENSE
+ *
+ * This software is provided subject to the following terms and conditions,
+ * which you should read carefully before using the software.  Using this
+ * software indicates your acceptance of these terms and conditions.  If you do
+ * not agree with these terms and conditions, do not use the software.
+ *
+ * Copyright © 2003 Agere Systems Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source or binary forms, with or without
+ * modifications, are permitted provided that the following conditions are met:
+ *
+ * . Redistributions of source code must retain the above copyright notice, this
+ *    list of conditions and the following Disclaimer as comments in the code as
+ *    well as in the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * . Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following Disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ *
+ * . Neither the name of Agere Systems Inc. nor the names of the contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * Disclaimer
+ *
+ * THIS SOFTWARE IS PROVIDED “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, INFRINGEMENT AND THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  ANY
+ * USE, MODIFICATION OR DISTRIBUTION OF THIS SOFTWARE IS SOLELY AT THE USERS OWN
+ * RISK. IN NO EVENT SHALL AGERE SYSTEMS INC. OR CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, INCLUDING, BUT NOT LIMITED TO, CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ *
+ ******************************************************************************/
+
+#ifndef __WL_MAIN_H__
+#define __WL_MAIN_H__
+
+
+
+
+/*******************************************************************************
+ *  function prototypes
+ ******************************************************************************/
+int wl_insert( struct net_device *dev );
+
+void wl_set_wep_keys( struct wl_private *lp );
+
+int wl_put_ltv_init( struct wl_private *lp );
+
+int wl_put_ltv( struct wl_private *lp );
+
+p_u16 wl_get_irq_mask( void );
+
+p_s8 * wl_get_irq_list( void );
+
+int wl_reset( struct net_device *dev );
+
+int wl_go( struct wl_private *lp );
+
+int wl_apply( struct wl_private *lp );
+
+irqreturn_t wl_isr( int irq, void *dev_id, struct pt_regs *regs );
+
+void wl_remove( struct net_device *dev );
+
+void wl_suspend( struct net_device *dev );
+
+void wl_resume( struct net_device *dev );
+
+void wl_release( struct net_device *dev );
+
+int wl_enable( struct wl_private *lp );
+
+int wl_connect( struct wl_private *lp );
+
+int wl_disable( struct wl_private *lp );
+
+int wl_disconnect( struct wl_private *lp );
+
+void wl_enable_wds_ports( struct wl_private * lp );
+
+void wl_disable_wds_ports( struct wl_private * lp );
+
+#ifndef USE_MBOX_SYNC
+
+int wl_mbx( struct wl_private *lp );
+void wl_endian_translate_mailbox( ltv_t *ltv );
+void wl_process_mailbox( struct wl_private *lp );
+
+#endif  /* USE_MBOX_SYNC */
+
+
+#ifdef USE_WDS
+
+void wl_wds_netdev_register( struct wl_private *lp );
+void wl_wds_netdev_deregister( struct wl_private *lp );
+
+#endif  /* USE_WDS */
+
+
+#ifdef USE_WDS
+
+#define WL_WDS_NETDEV_REGISTER( ARG )   wl_wds_netdev_register( ARG )
+#define WL_WDS_NETDEV_DEREGISTER( ARG ) wl_wds_netdev_deregister( ARG )
+
+#else
+
+#define WL_WDS_NETDEV_REGISTER( ARG )
+#define WL_WDS_NETDEV_DEREGISTER( ARG )
+
+#endif  /* USE_WDS */
+#endif  // __WL_MAIN_H__
diff --git a/drivers/staging/wlags49_h2/wl_netdev.c b/drivers/staging/wlags49_h2/wl_netdev.c
new file mode 100644
index 000000000000..ac3890247965
--- /dev/null
+++ b/drivers/staging/wlags49_h2/wl_netdev.c
@@ -0,0 +1,2070 @@
+/*******************************************************************************
+ * Agere Systems Inc.
+ * Wireless device driver for Linux (wlags49).
+ *
+ * Copyright (c) 1998-2003 Agere Systems Inc.
+ * All rights reserved.
+ *   http://www.agere.com
+ *
+ * Initially developed by TriplePoint, Inc.
+ *   http://www.triplepoint.com
+ *
+ *------------------------------------------------------------------------------
+ *
+ *   This file contains handler functions registered with the net_device
+ *   structure.
+ *
+ *------------------------------------------------------------------------------
+ *
+ * SOFTWARE LICENSE
+ *
+ * This software is provided subject to the following terms and conditions,
+ * which you should read carefully before using the software.  Using this
+ * software indicates your acceptance of these terms and conditions.  If you do
+ * not agree with these terms and conditions, do not use the software.
+ *
+ * Copyright © 2003 Agere Systems Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source or binary forms, with or without
+ * modifications, are permitted provided that the following conditions are met:
+ *
+ * . Redistributions of source code must retain the above copyright notice, this
+ *    list of conditions and the following Disclaimer as comments in the code as
+ *    well as in the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * . Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following Disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ *
+ * . Neither the name of Agere Systems Inc. nor the names of the contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * Disclaimer
+ *
+ * THIS SOFTWARE IS PROVIDED “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, INFRINGEMENT AND THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  ANY
+ * USE, MODIFICATION OR DISTRIBUTION OF THIS SOFTWARE IS SOLELY AT THE USERS OWN
+ * RISK. IN NO EVENT SHALL AGERE SYSTEMS INC. OR CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, INCLUDING, BUT NOT LIMITED TO, CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ *
+ ******************************************************************************/
+
+/*******************************************************************************
+ * include files
+ ******************************************************************************/
+#include <wl_version.h>
+
+#include <linux/module.h>
+#include <linux/types.h>
+#include <linux/kernel.h>
+// #include <linux/sched.h>
+// #include <linux/ptrace.h>
+// #include <linux/slab.h>
+// #include <linux/ctype.h>
+// #include <linux/string.h>
+//#include <linux/timer.h>
+// #include <linux/interrupt.h>
+// #include <linux/in.h>
+// #include <linux/delay.h>
+// #include <linux/skbuff.h>
+// #include <asm/io.h>
+// #include <asm/system.h>
+// #include <asm/bitops.h>
+
+#include <linux/netdevice.h>
+#include <linux/ethtool.h>
+#include <linux/etherdevice.h>
+// #include <linux/skbuff.h>
+// #include <linux/if_arp.h>
+// #include <linux/ioport.h>
+
+#include <debug.h>
+
+#include <hcf.h>
+#include <dhf.h>
+// #include <hcfdef.h>
+
+#include <wl_if.h>
+#include <wl_internal.h>
+#include <wl_util.h>
+#include <wl_priv.h>
+#include <wl_main.h>
+#include <wl_netdev.h>
+#include <wl_wext.h>
+
+#ifdef USE_PROFILE
+#include <wl_profile.h>
+#endif  /* USE_PROFILE */
+
+#ifdef BUS_PCMCIA
+#include <wl_cs.h>
+#endif  /* BUS_PCMCIA */
+
+#ifdef BUS_PCI
+#include <wl_pci.h>
+#endif  /* BUS_PCI */
+
+
+/*******************************************************************************
+ * global variables
+ ******************************************************************************/
+#if DBG
+extern dbg_info_t *DbgInfo;
+#endif  /* DBG */
+
+
+#if HCF_ENCAP
+#define MTU_MAX (HCF_MAX_MSG - ETH_HLEN - 8)
+#else
+#define MTU_MAX (HCF_MAX_MSG - ETH_HLEN)
+#endif
+
+//static int mtu = MTU_MAX;
+//MODULE_PARM(mtu, "i");
+//MODULE_PARM_DESC(mtu, "MTU");
+
+/*******************************************************************************
+ * macros
+ ******************************************************************************/
+#define BLOCK_INPUT(buf, len) \
+    desc->buf_addr = buf; \
+    desc->BUF_SIZE = len; \
+    status = hcf_rcv_msg(&(lp->hcfCtx), desc, 0)
+
+#define BLOCK_INPUT_DMA(buf, len) memcpy( buf, desc_next->buf_addr, pktlen )
+
+/*******************************************************************************
+ * function prototypes
+ ******************************************************************************/
+
+/*******************************************************************************
+ *	wl_init()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      We never need to do anything when a "Wireless" device is "initialized"
+ *  by the net software, because we only register already-found cards.
+ *
+ *  PARAMETERS:
+ *
+ *      dev - a pointer to the device's net_device structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+int wl_init( struct net_device *dev )
+{
+//    unsigned long       flags;
+//    struct wl_private   *lp = wl_priv(dev);
+    /*------------------------------------------------------------------------*/
+
+    DBG_FUNC( "wl_init" );
+    DBG_ENTER( DbgInfo );
+
+    DBG_PARAM( DbgInfo, "dev", "%s (0x%p)", dev->name, dev );
+
+    /* Nothing to do, but grab the spinlock anyway just in case we ever need
+       this routine */
+//  wl_lock( lp, &flags );
+//  wl_unlock( lp, &flags );
+
+    DBG_LEAVE( DbgInfo );
+    return 0;
+} // wl_init
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_config()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Implement the SIOCSIFMAP interface.
+ *
+ *  PARAMETERS:
+ *
+ *      dev - a pointer to the device's net_device structure
+ *      map - a pointer to the device's ifmap structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno otherwise
+ *
+ ******************************************************************************/
+int wl_config( struct net_device *dev, struct ifmap *map )
+{
+    DBG_FUNC( "wl_config" );
+    DBG_ENTER( DbgInfo );
+
+    DBG_PARAM( DbgInfo, "dev", "%s (0x%p)", dev->name, dev );
+    DBG_PARAM( DbgInfo, "map", "0x%p", map );
+
+    /* The only thing we care about here is a port change. Since this not needed,
+       ignore the request. */
+    DBG_TRACE( DbgInfo, "%s: %s called.\n", dev->name, __FUNC__ );
+
+    DBG_LEAVE( DbgInfo );
+    return 0;
+} // wl_config
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_stats()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Return the current device statistics.
+ *
+ *  PARAMETERS:
+ *
+ *      dev - a pointer to the device's net_device structure
+ *
+ *  RETURNS:
+ *
+ *      a pointer to a net_device_stats structure containing the network
+ *      statistics.
+ *
+ ******************************************************************************/
+struct net_device_stats *wl_stats( struct net_device *dev )
+{
+#ifdef USE_WDS
+    int                         count;
+#endif  /* USE_WDS */
+    unsigned long               flags;
+    struct net_device_stats     *pStats;
+    struct wl_private           *lp = wl_priv(dev);
+    /*------------------------------------------------------------------------*/
+
+    //DBG_FUNC( "wl_stats" );
+    //DBG_ENTER( DbgInfo );
+    //DBG_PARAM( DbgInfo, "dev", "%s (0x%p)", dev->name, dev );
+
+    pStats = NULL;
+
+    wl_lock( lp, &flags );
+
+#ifdef USE_RTS
+    if( lp->useRTS == 1 ) {
+	wl_unlock( lp, &flags );
+
+	//DBG_LEAVE( DbgInfo );
+	return NULL;
+    }
+#endif  /* USE_RTS */
+
+    /* Return the statistics for the appropriate device */
+#ifdef USE_WDS
+
+    for( count = 0; count < NUM_WDS_PORTS; count++ ) {
+	if( dev == lp->wds_port[count].dev ) {
+	    pStats = &( lp->wds_port[count].stats );
+	}
+    }
+
+#endif  /* USE_WDS */
+
+    /* If pStats is still NULL, then the device is not a WDS port */
+    if( pStats == NULL ) {
+        pStats = &( lp->stats );
+    }
+
+    wl_unlock( lp, &flags );
+
+    //DBG_LEAVE( DbgInfo );
+
+    return pStats;
+} // wl_stats
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_open()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Open the device.
+ *
+ *  PARAMETERS:
+ *
+ *      dev - a pointer to the device's net_device structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno otherwise
+ *
+ ******************************************************************************/
+int wl_open(struct net_device *dev)
+{
+    int                 status = HCF_SUCCESS;
+    struct wl_private   *lp = wl_priv(dev);
+    unsigned long       flags;
+    /*------------------------------------------------------------------------*/
+
+    DBG_FUNC( "wl_open" );
+    DBG_ENTER( DbgInfo );
+
+    wl_lock( lp, &flags );
+
+#ifdef USE_RTS
+    if( lp->useRTS == 1 ) {
+	DBG_TRACE( DbgInfo, "Skipping device open, in RTS mode\n" );
+	wl_unlock( lp, &flags );
+	DBG_LEAVE( DbgInfo );
+	return -EIO;
+    }
+#endif  /* USE_RTS */
+
+#ifdef USE_PROFILE
+    parse_config( dev );
+#endif
+
+    if( lp->portState == WVLAN_PORT_STATE_DISABLED ) {
+	DBG_TRACE( DbgInfo, "Enabling Port 0\n" );
+	status = wl_enable( lp );
+
+        if( status != HCF_SUCCESS ) {
+            DBG_TRACE( DbgInfo, "Enable port 0 failed: 0x%x\n", status );
+        }
+    }
+
+    // Holding the lock too long, make a gap to allow other processes
+    wl_unlock(lp, &flags);
+    wl_lock( lp, &flags );
+
+    if ( strlen( lp->fw_image_filename ) ) {
+	DBG_TRACE( DbgInfo, ";???? Kludgy way to force a download\n" );
+	status = wl_go( lp );
+    } else {
+	status = wl_apply( lp );
+    }
+
+    // Holding the lock too long, make a gap to allow other processes
+    wl_unlock(lp, &flags);
+    wl_lock( lp, &flags );
+
+    if( status != HCF_SUCCESS ) {
+	// Unsuccesfull, try reset of the card to recover
+	status = wl_reset( dev );
+    }
+
+    // Holding the lock too long, make a gap to allow other processes
+    wl_unlock(lp, &flags);
+    wl_lock( lp, &flags );
+
+    if( status == HCF_SUCCESS ) {
+	netif_carrier_on( dev );
+	WL_WDS_NETIF_CARRIER_ON( lp );
+
+	lp->is_handling_int = WL_HANDLING_INT; // Start handling interrupts
+        wl_act_int_on( lp );
+
+	netif_start_queue( dev );
+	WL_WDS_NETIF_START_QUEUE( lp );
+    } else {
+        wl_hcf_error( dev, status );		/* Report the error */
+        netif_device_detach( dev );		/* Stop the device and queue */
+    }
+
+    wl_unlock( lp, &flags );
+
+    DBG_LEAVE( DbgInfo );
+    return status;
+} // wl_open
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_close()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Close the device.
+ *
+ *  PARAMETERS:
+ *
+ *      dev - a pointer to the device's net_device structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno otherwise
+ *
+ ******************************************************************************/
+int wl_close( struct net_device *dev )
+{
+    struct wl_private   *lp = wl_priv(dev);
+    unsigned long   flags;
+    /*------------------------------------------------------------------------*/
+
+    DBG_FUNC("wl_close");
+    DBG_ENTER(DbgInfo);
+    DBG_PARAM(DbgInfo, "dev", "%s (0x%p)", dev->name, dev);
+
+    /* Mark the adapter as busy */
+    netif_stop_queue( dev );
+    WL_WDS_NETIF_STOP_QUEUE( lp );
+
+    netif_carrier_off( dev );
+    WL_WDS_NETIF_CARRIER_OFF( lp );
+
+    /* Shutdown the adapter:
+            Disable adapter interrupts
+            Stop Tx/Rx
+            Update statistics
+            Set low power mode
+    */
+
+    wl_lock( lp, &flags );
+
+    wl_act_int_off( lp );
+    lp->is_handling_int = WL_NOT_HANDLING_INT; // Stop handling interrupts
+
+#ifdef USE_RTS
+    if( lp->useRTS == 1 ) {
+	DBG_TRACE( DbgInfo, "Skipping device close, in RTS mode\n" );
+	wl_unlock( lp, &flags );
+	DBG_LEAVE( DbgInfo );
+	return -EIO;
+    }
+#endif  /* USE_RTS */
+
+    /* Disable the ports */
+    wl_disable( lp );
+
+    wl_unlock( lp, &flags );
+
+    DBG_LEAVE( DbgInfo );
+    return 0;
+} // wl_close
+/*============================================================================*/
+
+static void wl_get_drvinfo(struct net_device *dev, struct ethtool_drvinfo *info)
+{
+    strncpy(info->driver, DRIVER_NAME, sizeof(info->driver) - 1);
+    strncpy(info->version, DRV_VERSION_STR, sizeof(info->version) - 1);
+//	strncpy(info.fw_version, priv->fw_name,
+//	sizeof(info.fw_version) - 1);
+
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2,6,20))
+    if (dev->dev.parent) {
+    	dev_set_name(dev->dev.parent, "%s", info->bus_info);
+	//strncpy(info->bus_info, dev->dev.parent->bus_id,
+	//	sizeof(info->bus_info) - 1);
+#else
+	    if (dev->class_dev.parent) {
+		sizeof(info->bus_info) - 1);
+#endif
+    } else {
+	snprintf(info->bus_info, sizeof(info->bus_info) - 1,
+		"PCMCIA FIXME");
+//		    "PCMCIA 0x%lx", priv->hw.iobase);
+    }
+} // wl_get_drvinfo
+
+static struct ethtool_ops wl_ethtool_ops = {
+    .get_drvinfo = wl_get_drvinfo,
+    .get_link = ethtool_op_get_link,
+};
+
+
+/*******************************************************************************
+ *	wl_ioctl()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      The IOCTL handler for the device.
+ *
+ *  PARAMETERS:
+ *
+ *      dev - a pointer to the device's net_device struct.
+ *      rq  - a pointer to the IOCTL request buffer.
+ *      cmd - the IOCTL command code.
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+int wl_ioctl( struct net_device *dev, struct ifreq *rq, int cmd )
+{
+    struct wl_private  *lp = wl_priv(dev);
+    unsigned long           flags;
+    int                     ret = 0;
+    /*------------------------------------------------------------------------*/
+
+    DBG_FUNC( "wl_ioctl" );
+    DBG_ENTER(DbgInfo);
+    DBG_PARAM(DbgInfo, "dev", "%s (0x%p)", dev->name, dev);
+    DBG_PARAM(DbgInfo, "rq", "0x%p", rq);
+    DBG_PARAM(DbgInfo, "cmd", "0x%04x", cmd);
+
+    wl_lock( lp, &flags );
+
+    wl_act_int_off( lp );
+
+#ifdef USE_RTS
+    if( lp->useRTS == 1 ) {
+	/* Handle any RTS IOCTL here */
+	if( cmd == WL_IOCTL_RTS ) {
+	    DBG_TRACE( DbgInfo, "IOCTL: WL_IOCTL_RTS\n" );
+	    ret = wvlan_rts( (struct rtsreq *)rq, dev->base_addr );
+	} else {
+	    DBG_TRACE( DbgInfo, "IOCTL not supported in RTS mode: 0x%X\n", cmd );
+	    ret = -EOPNOTSUPP;
+	}
+
+	goto out_act_int_on_unlock;
+    }
+#endif  /* USE_RTS */
+
+    /* Only handle UIL IOCTL requests when the UIL has the system blocked. */
+    if( !(( lp->flags & WVLAN2_UIL_BUSY ) && ( cmd != WVLAN2_IOCTL_UIL ))) {
+#ifdef USE_UIL
+	struct uilreq  *urq = (struct uilreq *)rq;
+#endif /* USE_UIL */
+
+	switch( cmd ) {
+		// ================== Private IOCTLs (up to 16) ==================
+#ifdef USE_UIL
+	case WVLAN2_IOCTL_UIL:
+	     DBG_TRACE( DbgInfo, "IOCTL: WVLAN2_IOCTL_UIL\n" );
+	     ret = wvlan_uil( urq, lp );
+	     break;
+#endif  /* USE_UIL */
+
+	default:
+	     DBG_TRACE(DbgInfo, "IOCTL CODE NOT SUPPORTED: 0x%X\n", cmd );
+	     ret = -EOPNOTSUPP;
+	     break;
+	}
+    } else {
+	DBG_WARNING( DbgInfo, "DEVICE IS BUSY, CANNOT PROCESS REQUEST\n" );
+	ret = -EBUSY;
+    }
+
+#ifdef USE_RTS
+out_act_int_on_unlock:
+#endif  /* USE_RTS */
+    wl_act_int_on( lp );
+
+    wl_unlock( lp, &flags );
+
+    DBG_LEAVE( DbgInfo );
+    return ret;
+} // wl_ioctl
+/*============================================================================*/
+
+#ifdef CONFIG_NET_POLL_CONTROLLER
+void wl_poll(struct net_device *dev)
+{
+    struct wl_private *lp = wl_priv(dev);
+    unsigned long flags;
+    struct pt_regs regs;
+
+    wl_lock( lp, &flags );
+    wl_isr(dev->irq, dev, &regs);
+    wl_unlock( lp, &flags );
+}
+#endif
+
+/*******************************************************************************
+ *	wl_tx_timeout()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      The handler called when, for some reason, a Tx request is not completed.
+ *
+ *  PARAMETERS:
+ *
+ *      dev - a pointer to the device's net_device struct.
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+void wl_tx_timeout( struct net_device *dev )
+{
+#ifdef USE_WDS
+    int                     count;
+#endif  /* USE_WDS */
+    unsigned long           flags;
+    struct wl_private       *lp = wl_priv(dev);
+    struct net_device_stats *pStats = NULL;
+    /*------------------------------------------------------------------------*/
+
+    DBG_FUNC( "wl_tx_timeout" );
+    DBG_ENTER( DbgInfo );
+
+    DBG_WARNING( DbgInfo, "%s: Transmit timeout.\n", dev->name );
+
+    wl_lock( lp, &flags );
+
+#ifdef USE_RTS
+    if( lp->useRTS == 1 ) {
+	DBG_TRACE( DbgInfo, "Skipping tx_timeout handler, in RTS mode\n" );
+	wl_unlock( lp, &flags );
+
+	DBG_LEAVE( DbgInfo );
+	return;
+    }
+#endif  /* USE_RTS */
+
+    /* Figure out which device (the "root" device or WDS port) this timeout
+       is for */
+#ifdef USE_WDS
+
+    for( count = 0; count < NUM_WDS_PORTS; count++ ) {
+	if( dev == lp->wds_port[count].dev ) {
+	    pStats = &( lp->wds_port[count].stats );
+
+	    /* Break the loop so that we can use the counter to access WDS
+	       information in the private structure */
+	    break;
+	}
+    }
+
+#endif  /* USE_WDS */
+
+    /* If pStats is still NULL, then the device is not a WDS port */
+    if( pStats == NULL ) {
+	pStats = &( lp->stats );
+    }
+
+    /* Accumulate the timeout error */
+    pStats->tx_errors++;
+
+    wl_unlock( lp, &flags );
+
+    DBG_LEAVE( DbgInfo );
+    return;
+} // wl_tx_timeout
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_send()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      The routine which performs data transmits.
+ *
+ *  PARAMETERS:
+ *
+ *      lp  - a pointer to the device's wl_private struct.
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      1 on error
+ *
+ ******************************************************************************/
+int wl_send( struct wl_private *lp )
+{
+
+    int                 status;
+    DESC_STRCT          *desc;
+    WVLAN_LFRAME        *txF = NULL;
+    struct list_head    *element;
+    int                 len;
+    /*------------------------------------------------------------------------*/
+
+    DBG_FUNC( "wl_send" );
+
+    if( lp == NULL ) {
+        DBG_ERROR( DbgInfo, "Private adapter struct is NULL\n" );
+        return FALSE;
+    }
+    if( lp->dev == NULL ) {
+        DBG_ERROR( DbgInfo, "net_device struct in wl_private is NULL\n" );
+        return FALSE;
+    }
+
+    /* Check for the availability of FIDs; if none are available, don't take any
+       frames off the txQ */
+    if( lp->hcfCtx.IFB_RscInd == 0 ) {
+        return FALSE;
+    }
+
+    /* Reclaim the TxQ Elements and place them back on the free queue */
+    if( !list_empty( &( lp->txQ[0] ))) {
+        element = lp->txQ[0].next;
+
+        txF = (WVLAN_LFRAME * )list_entry( element, WVLAN_LFRAME, node );
+        if( txF != NULL ) {
+            lp->txF.skb  = txF->frame.skb;
+            lp->txF.port = txF->frame.port;
+
+            txF->frame.skb  = NULL;
+            txF->frame.port = 0;
+
+            list_del( &( txF->node ));
+            list_add( element, &( lp->txFree ));
+
+            lp->txQ_count--;
+
+            if( lp->txQ_count < TX_Q_LOW_WATER_MARK ) {
+                if( lp->netif_queue_on == FALSE ) {
+                    DBG_TX( DbgInfo, "Kickstarting Q: %d\n", lp->txQ_count );
+                    netif_wake_queue( lp->dev );
+                    WL_WDS_NETIF_WAKE_QUEUE( lp );
+                    lp->netif_queue_on = TRUE;
+                }
+            }
+        }
+    }
+
+    if( lp->txF.skb == NULL ) {
+        return FALSE;
+    }
+
+    /* If the device has resources (FIDs) available, then Tx the packet */
+    /* Format the TxRequest and send it to the adapter */
+    len = lp->txF.skb->len < ETH_ZLEN ? ETH_ZLEN : lp->txF.skb->len;
+
+    desc                    = &( lp->desc_tx );
+    desc->buf_addr          = lp->txF.skb->data;
+    desc->BUF_CNT           = len;
+    desc->next_desc_addr    = NULL;
+
+    status = hcf_send_msg( &( lp->hcfCtx ), desc, lp->txF.port );
+
+    if( status == HCF_SUCCESS ) {
+        lp->dev->trans_start = jiffies;
+
+        DBG_TX( DbgInfo, "Transmit...\n" );
+
+        if( lp->txF.port == HCF_PORT_0 ) {
+            lp->stats.tx_packets++;
+            lp->stats.tx_bytes += lp->txF.skb->len;
+        }
+
+#ifdef USE_WDS
+        else
+        {
+            lp->wds_port[(( lp->txF.port >> 8 ) - 1)].stats.tx_packets++;
+            lp->wds_port[(( lp->txF.port >> 8 ) - 1)].stats.tx_bytes += lp->txF.skb->len;
+        }
+
+#endif  /* USE_WDS */
+
+        /* Free the skb and perform queue cleanup, as the buffer was
+            transmitted successfully */
+        dev_kfree_skb( lp->txF.skb );
+
+        lp->txF.skb = NULL;
+        lp->txF.port = 0;
+    }
+
+    return TRUE;
+} // wl_send
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_tx()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      The Tx handler function for the network layer.
+ *
+ *  PARAMETERS:
+ *
+ *      skb - a pointer to the sk_buff structure containing the data to transfer.
+ *      dev - a pointer to the device's net_device structure.
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      1 on error
+ *
+ ******************************************************************************/
+int wl_tx( struct sk_buff *skb, struct net_device *dev, int port )
+{
+    unsigned long           flags;
+    struct wl_private       *lp = wl_priv(dev);
+    WVLAN_LFRAME            *txF = NULL;
+    struct list_head        *element;
+    /*------------------------------------------------------------------------*/
+
+    DBG_FUNC( "wl_tx" );
+
+    /* Grab the spinlock */
+    wl_lock( lp, &flags );
+
+    if( lp->flags & WVLAN2_UIL_BUSY ) {
+        DBG_WARNING( DbgInfo, "UIL has device blocked\n" );
+        /* Start dropping packets here??? */
+	wl_unlock( lp, &flags );
+        return 1;
+    }
+
+#ifdef USE_RTS
+    if( lp->useRTS == 1 ) {
+        DBG_PRINT( "RTS: we're getting a Tx...\n" );
+	wl_unlock( lp, &flags );
+        return 1;
+    }
+#endif  /* USE_RTS */
+
+    if( !lp->use_dma ) {
+        /* Get an element from the queue */
+        element = lp->txFree.next;
+        txF = (WVLAN_LFRAME *)list_entry( element, WVLAN_LFRAME, node );
+        if( txF == NULL ) {
+            DBG_ERROR( DbgInfo, "Problem with list_entry\n" );
+	    wl_unlock( lp, &flags );
+            return 1;
+        }
+        /* Fill out the frame */
+        txF->frame.skb = skb;
+        txF->frame.port = port;
+        /* Move the frame to the txQ */
+        /* NOTE: Here's where we would do priority queueing */
+        list_del( &( txF->node ));
+        list_add( &( txF->node ), &( lp->txQ[0] ));
+
+        lp->txQ_count++;
+        if( lp->txQ_count >= DEFAULT_NUM_TX_FRAMES ) {
+            DBG_TX( DbgInfo, "Q Full: %d\n", lp->txQ_count );
+            if( lp->netif_queue_on == TRUE ) {
+                netif_stop_queue( lp->dev );
+                WL_WDS_NETIF_STOP_QUEUE( lp );
+                lp->netif_queue_on = FALSE;
+            }
+        }
+    }
+    wl_act_int_off( lp ); /* Disable Interrupts */
+
+    /* Send the data to the hardware using the appropriate method */
+#ifdef ENABLE_DMA
+    if( lp->use_dma ) {
+        wl_send_dma( lp, skb, port );
+    }
+    else
+#endif
+    {
+        wl_send( lp );
+    }
+    /* Re-enable Interrupts, release the spinlock and return */
+    wl_act_int_on( lp );
+    wl_unlock( lp, &flags );
+    return 0;
+} // wl_tx
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_rx()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      The routine which performs data reception.
+ *
+ *  PARAMETERS:
+ *
+ *      dev - a pointer to the device's net_device structure.
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      1 on error
+ *
+ ******************************************************************************/
+int wl_rx(struct net_device *dev)
+{
+    int                     port;
+    struct sk_buff          *skb;
+    struct wl_private       *lp = wl_priv(dev);
+    int                     status;
+    hcf_16                  pktlen;
+    hcf_16                  hfs_stat;
+    DESC_STRCT              *desc;
+    /*------------------------------------------------------------------------*/
+
+    DBG_FUNC("wl_rx")
+    DBG_PARAM(DbgInfo, "dev", "%s (0x%p)", dev->name, dev);
+
+    if(!( lp->flags & WVLAN2_UIL_BUSY )) {
+
+#ifdef USE_RTS
+        if( lp->useRTS == 1 ) {
+            DBG_PRINT( "RTS: We're getting an Rx...\n" );
+            return -EIO;
+        }
+#endif  /* USE_RTS */
+
+        /* Read the HFS_STAT register from the lookahead buffer */
+        hfs_stat = (hcf_16)(( lp->lookAheadBuf[HFS_STAT] ) |
+                            ( lp->lookAheadBuf[HFS_STAT + 1] << 8 ));
+
+        /* Make sure the frame isn't bad */
+        if(( hfs_stat & HFS_STAT_ERR ) != HCF_SUCCESS ) {
+            DBG_WARNING( DbgInfo, "HFS_STAT_ERROR (0x%x) in Rx Packet\n",
+                         lp->lookAheadBuf[HFS_STAT] );
+            return -EIO;
+        }
+
+        /* Determine what port this packet is for */
+        port = ( hfs_stat >> 8 ) & 0x0007;
+        DBG_RX( DbgInfo, "Rx frame for port %d\n", port );
+
+        if(( pktlen = lp->hcfCtx.IFB_RxLen ) != 0 ) {
+            if(( skb = ALLOC_SKB( pktlen )) != NULL ) {
+                /* Set the netdev based on the port */
+                switch( port ) {
+#ifdef USE_WDS
+                case 1:
+                case 2:
+                case 3:
+                case 4:
+                case 5:
+                case 6:
+                    skb->dev = lp->wds_port[port-1].dev;
+                    break;
+#endif  /* USE_WDS */
+
+                case 0:
+                default:
+                    skb->dev = dev;
+                    break;
+                }
+
+                desc = &( lp->desc_rx );
+
+                desc->next_desc_addr = NULL;
+
+/*
+#define BLOCK_INPUT(buf, len) \
+    desc->buf_addr = buf; \
+    desc->BUF_SIZE = len; \
+    status = hcf_rcv_msg(&(lp->hcfCtx), desc, 0)
+*/
+
+                GET_PACKET( skb->dev, skb, pktlen );
+
+                if( status == HCF_SUCCESS ) {
+                    netif_rx( skb );
+
+                    if( port == 0 ) {
+                        lp->stats.rx_packets++;
+                        lp->stats.rx_bytes += pktlen;
+                    }
+#ifdef USE_WDS
+                    else
+                    {
+                        lp->wds_port[port-1].stats.rx_packets++;
+                        lp->wds_port[port-1].stats.rx_bytes += pktlen;
+                    }
+#endif  /* USE_WDS */
+
+                    dev->last_rx = jiffies;
+
+#ifdef WIRELESS_EXT
+#ifdef WIRELESS_SPY
+                    if( lp->spydata.spy_number > 0 ) {
+                        char *srcaddr = skb->mac.raw + MAC_ADDR_SIZE;
+
+                        wl_spy_gather( dev, srcaddr );
+                    }
+#endif /* WIRELESS_SPY */
+#endif /* WIRELESS_EXT */
+                } else {
+                    DBG_ERROR( DbgInfo, "Rx request to card FAILED\n" );
+
+                    if( port == 0 ) {
+                        lp->stats.rx_dropped++;
+                    }
+#ifdef USE_WDS
+                    else
+                    {
+                        lp->wds_port[port-1].stats.rx_dropped++;
+                    }
+#endif  /* USE_WDS */
+
+                    dev_kfree_skb( skb );
+                }
+            } else {
+                DBG_ERROR( DbgInfo, "Could not alloc skb\n" );
+
+                if( port == 0 ) {
+                    lp->stats.rx_dropped++;
+                }
+#ifdef USE_WDS
+                else
+                {
+                    lp->wds_port[port-1].stats.rx_dropped++;
+                }
+#endif  /* USE_WDS */
+            }
+        }
+    }
+
+    return 0;
+} // wl_rx
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_multicast()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Function to handle multicast packets
+ *
+ *  PARAMETERS:
+ *
+ *      dev - a pointer to the device's net_device structure.
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+#ifdef NEW_MULTICAST
+
+void wl_multicast( struct net_device *dev )
+{
+#if 1 //;? (HCF_TYPE) & HCF_TYPE_STA //;?should we return an error status in AP mode
+//;?seems reasonable that even an AP-only driver could afford this small additional footprint
+
+    int                 x;
+    struct dev_mc_list  *mclist;
+    struct wl_private   *lp = wl_priv(dev);
+    unsigned long       flags;
+    /*------------------------------------------------------------------------*/
+
+    DBG_FUNC( "wl_multicast" );
+    DBG_ENTER( DbgInfo );
+    DBG_PARAM( DbgInfo, "dev", "%s (0x%p)", dev->name, dev );
+
+    if( !wl_adapter_is_open( dev )) {
+        DBG_LEAVE( DbgInfo );
+        return;
+    }
+
+#if DBG
+    if( DBG_FLAGS( DbgInfo ) & DBG_PARAM_ON ) {
+        DBG_PRINT("  flags: %s%s%s\n",
+            ( dev->flags & IFF_PROMISC ) ? "Promiscous " : "",
+            ( dev->flags & IFF_MULTICAST ) ? "Multicast " : "",
+            ( dev->flags & IFF_ALLMULTI ) ? "All-Multicast" : "" );
+
+        DBG_PRINT( "  mc_count: %d\n", dev->mc_count );
+
+        for( x = 0, mclist = dev->mc_list; mclist && x < dev->mc_count;
+             x++, mclist = mclist->next ) {
+            DBG_PRINT( "    %s (%d)\n", DbgHwAddr(mclist->dmi_addr),
+                       mclist->dmi_addrlen );
+        }
+    }
+#endif /* DBG */
+
+    if(!( lp->flags & WVLAN2_UIL_BUSY )) {
+
+#ifdef USE_RTS
+        if( lp->useRTS == 1 ) {
+            DBG_TRACE( DbgInfo, "Skipping multicast, in RTS mode\n" );
+
+            DBG_LEAVE( DbgInfo );
+            return;
+        }
+#endif  /* USE_RTS */
+
+        wl_lock( lp, &flags );
+        wl_act_int_off( lp );
+
+		if ( CNV_INT_TO_LITTLE( lp->hcfCtx.IFB_FWIdentity.comp_id ) == COMP_ID_FW_STA  ) {
+            if( dev->flags & IFF_PROMISC ) {
+                /* Enable promiscuous mode */
+                lp->ltvRecord.len       = 2;
+                lp->ltvRecord.typ       = CFG_PROMISCUOUS_MODE;
+                lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( 1 );
+                DBG_PRINT( "Enabling Promiscuous mode (IFF_PROMISC)\n" );
+                hcf_put_info( &( lp->hcfCtx ), (LTVP)&( lp->ltvRecord ));
+            }
+            else if(( dev->mc_count > HCF_MAX_MULTICAST ) ||
+                    ( dev->flags & IFF_ALLMULTI )) {
+                /* Shutting off this filter will enable all multicast frames to
+                   be sent up from the device; however, this is a static RID, so
+                   a call to wl_apply() is needed */
+                lp->ltvRecord.len       = 2;
+                lp->ltvRecord.typ       = CFG_CNF_RX_ALL_GROUP_ADDR;
+                lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( 0 );
+                DBG_PRINT( "Enabling all multicast mode (IFF_ALLMULTI)\n" );
+                hcf_put_info( &( lp->hcfCtx ), (LTVP)&( lp->ltvRecord ));
+                wl_apply( lp );
+            }
+            else if( dev->mc_count != 0 ) {
+                /* Set the multicast addresses */
+                lp->ltvRecord.len = ( dev->mc_count * 3 ) + 1;
+                lp->ltvRecord.typ = CFG_GROUP_ADDR;
+
+                for( x = 0, mclist = dev->mc_list;
+                ( x < dev->mc_count ) && ( mclist != NULL );
+                    x++, mclist = mclist->next ) {
+                    memcpy( &( lp->ltvRecord.u.u8[x * ETH_ALEN] ),
+                            mclist->dmi_addr, ETH_ALEN );
+                }
+                DBG_PRINT( "Setting multicast list\n" );
+                hcf_put_info( &( lp->hcfCtx ), (LTVP)&( lp->ltvRecord ));
+            } else {
+                /* Disable promiscuous mode */
+                lp->ltvRecord.len       = 2;
+                lp->ltvRecord.typ       = CFG_PROMISCUOUS_MODE;
+                lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( 0 );
+                DBG_PRINT( "Disabling Promiscuous mode\n" );
+                hcf_put_info( &( lp->hcfCtx ), (LTVP)&( lp->ltvRecord ));
+
+                /* Disable multicast mode */
+                lp->ltvRecord.len = 2;
+                lp->ltvRecord.typ = CFG_GROUP_ADDR;
+                DBG_PRINT( "Disabling Multicast mode\n" );
+                hcf_put_info( &( lp->hcfCtx ), (LTVP)&( lp->ltvRecord ));
+
+                /* Turning on this filter will prevent all multicast frames from
+                   being sent up from the device; however, this is a static RID,
+                   so a call to wl_apply() is needed */
+                lp->ltvRecord.len       = 2;
+                lp->ltvRecord.typ       = CFG_CNF_RX_ALL_GROUP_ADDR;
+                lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( 1 );
+                DBG_PRINT( "Disabling all multicast mode (IFF_ALLMULTI)\n" );
+                hcf_put_info( &( lp->hcfCtx ), (LTVP)&( lp->ltvRecord ));
+                wl_apply( lp );
+            }
+        }
+        wl_act_int_on( lp );
+	wl_unlock( lp, &flags );
+    }
+    DBG_LEAVE( DbgInfo );
+#endif /* HCF_STA */
+} // wl_multicast
+/*============================================================================*/
+
+#else /* NEW_MULTICAST */
+
+void wl_multicast( struct net_device *dev, int num_addrs, void *addrs )
+{
+    DBG_FUNC( "wl_multicast");
+    DBG_ENTER(DbgInfo);
+
+    DBG_PARAM( DbgInfo, "dev", "%s (0x%p)", dev->name, dev );
+    DBG_PARAM( DbgInfo, "num_addrs", "%d", num_addrs );
+    DBG_PARAM( DbgInfo, "addrs", "0x%p", addrs );
+
+#error Obsolete set multicast interface!
+
+    DBG_LEAVE( DbgInfo );
+} // wl_multicast
+/*============================================================================*/
+
+#endif /* NEW_MULTICAST */
+
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2,6,30))
+static const struct net_device_ops wl_netdev_ops =
+{
+    .ndo_start_xmit         = &wl_tx_port0,
+
+    .ndo_set_config         = &wl_config,
+    .ndo_get_stats          = &wl_stats,
+    .ndo_set_multicast_list = &wl_multicast,
+
+    .ndo_init               = &wl_insert,
+    .ndo_open               = &wl_adapter_open,
+    .ndo_stop               = &wl_adapter_close,
+    .ndo_do_ioctl           = &wl_ioctl,
+
+#ifdef HAVE_TX_TIMEOUT
+    .ndo_tx_timeout         = &wl_tx_timeout,
+#endif
+
+#ifdef CONFIG_NET_POLL_CONTROLLER
+    .ndo_poll_controller    = wl_poll,
+#endif
+};
+#endif // (LINUX_VERSION_CODE > KERNEL_VERSION(2,6,30))
+
+/*******************************************************************************
+ *	wl_device_alloc()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Create instances of net_device and wl_private for the new adapter
+ *  and register the device's entry points in the net_device structure.
+ *
+ *  PARAMETERS:
+ *
+ *      N/A
+ *
+ *  RETURNS:
+ *
+ *      a pointer to an allocated and initialized net_device struct for this
+ *      device.
+ *
+ ******************************************************************************/
+struct net_device * wl_device_alloc( void )
+{
+    struct net_device   *dev = NULL;
+    struct wl_private   *lp = NULL;
+    /*------------------------------------------------------------------------*/
+
+    DBG_FUNC( "wl_device_alloc" );
+    DBG_ENTER( DbgInfo );
+
+    /* Alloc a net_device struct */
+    dev = alloc_etherdev(sizeof(struct wl_private));
+    if (!dev)
+        return NULL;
+
+    /* Initialize the 'next' pointer in the struct. Currently only used for PCI,
+       but do it here just in case it's used for other buses in the future */
+    lp = wl_priv(dev);
+
+
+    /* Check MTU */
+    if( dev->mtu > MTU_MAX )
+    {
+	    DBG_WARNING( DbgInfo, "%s: MTU set too high, limiting to %d.\n",
+                        dev->name, MTU_MAX );
+    	dev->mtu = MTU_MAX;
+    }
+
+    /* Setup the function table in the device structure. */
+
+    dev->wireless_handlers = (struct iw_handler_def *)&wl_iw_handler_def;
+    lp->wireless_data.spy_data = &lp->spy_data;
+    dev->wireless_data = &lp->wireless_data;
+
+#if (LINUX_VERSION_CODE > KERNEL_VERSION(2,6,30))
+    dev->netdev_ops = &wl_netdev_ops;
+#else
+    dev->hard_start_xmit    = &wl_tx_port0;
+
+    dev->set_config         = &wl_config;
+    dev->get_stats          = &wl_stats;
+    dev->set_multicast_list = &wl_multicast;
+
+    dev->init               = &wl_insert;
+    dev->open               = &wl_adapter_open;
+    dev->stop               = &wl_adapter_close;
+    dev->do_ioctl           = &wl_ioctl;
+
+#ifdef HAVE_TX_TIMEOUT
+    dev->tx_timeout         = &wl_tx_timeout;
+#endif
+
+#ifdef CONFIG_NET_POLL_CONTROLLER
+    dev->poll_controller = wl_poll;
+#endif
+
+#endif // (LINUX_VERSION_CODE > KERNEL_VERSION(2,6,30))
+
+#ifdef HAVE_TX_TIMEOUT
+    dev->watchdog_timeo     = TX_TIMEOUT;
+#endif
+
+    dev->ethtool_ops	    = &wl_ethtool_ops;
+
+    netif_stop_queue( dev );
+
+    /* Allocate virutal devices for WDS support if needed */
+    WL_WDS_DEVICE_ALLOC( lp );
+
+    DBG_LEAVE( DbgInfo );
+    return dev;
+} // wl_device_alloc
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_device_dealloc()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Free instances of net_device and wl_private strcutres for an adapter
+ *  and perform basic cleanup.
+ *
+ *  PARAMETERS:
+ *
+ *      dev - a pointer to the device's net_device structure.
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+void wl_device_dealloc( struct net_device *dev )
+{
+//    struct wl_private   *lp = wl_priv(dev);
+    /*------------------------------------------------------------------------*/
+
+    DBG_FUNC( "wl_device_dealloc" );
+    DBG_ENTER( DbgInfo );
+
+    /* Dealloc the WDS ports */
+    WL_WDS_DEVICE_DEALLOC( lp );
+
+    free_netdev( dev );
+
+    DBG_LEAVE( DbgInfo );
+    return;
+} // wl_device_dealloc
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_tx_port0()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      The handler routine for Tx over HCF_PORT_0.
+ *
+ *  PARAMETERS:
+ *
+ *      skb - a pointer to the sk_buff to transmit.
+ *      dev - a pointer to a net_device structure representing HCF_PORT_0.
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+int wl_tx_port0( struct sk_buff *skb, struct net_device *dev )
+{
+    DBG_TX( DbgInfo, "Tx on Port 0\n" );
+
+    return wl_tx( skb, dev, HCF_PORT_0 );
+#ifdef ENABLE_DMA
+    return wl_tx_dma( skb, dev, HCF_PORT_0 );
+#endif
+} // wl_tx_port0
+/*============================================================================*/
+
+#ifdef USE_WDS
+
+/*******************************************************************************
+ *	wl_tx_port1()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      The handler routine for Tx over HCF_PORT_1.
+ *
+ *  PARAMETERS:
+ *
+ *      skb - a pointer to the sk_buff to transmit.
+ *      dev - a pointer to a net_device structure representing HCF_PORT_1.
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+int wl_tx_port1( struct sk_buff *skb, struct net_device *dev )
+{
+    DBG_TX( DbgInfo, "Tx on Port 1\n" );
+    return wl_tx( skb, dev, HCF_PORT_1 );
+} // wl_tx_port1
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_tx_port2()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      The handler routine for Tx over HCF_PORT_2.
+ *
+ *  PARAMETERS:
+ *
+ *      skb - a pointer to the sk_buff to transmit.
+ *      dev - a pointer to a net_device structure representing HCF_PORT_2.
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+int wl_tx_port2( struct sk_buff *skb, struct net_device *dev )
+{
+    DBG_TX( DbgInfo, "Tx on Port 2\n" );
+    return wl_tx( skb, dev, HCF_PORT_2 );
+} // wl_tx_port2
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_tx_port3()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      The handler routine for Tx over HCF_PORT_3.
+ *
+ *  PARAMETERS:
+ *
+ *      skb - a pointer to the sk_buff to transmit.
+ *      dev - a pointer to a net_device structure representing HCF_PORT_3.
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+int wl_tx_port3( struct sk_buff *skb, struct net_device *dev )
+{
+    DBG_TX( DbgInfo, "Tx on Port 3\n" );
+    return wl_tx( skb, dev, HCF_PORT_3 );
+} // wl_tx_port3
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_tx_port4()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      The handler routine for Tx over HCF_PORT_4.
+ *
+ *  PARAMETERS:
+ *
+ *      skb - a pointer to the sk_buff to transmit.
+ *      dev - a pointer to a net_device structure representing HCF_PORT_4.
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+int wl_tx_port4( struct sk_buff *skb, struct net_device *dev )
+{
+    DBG_TX( DbgInfo, "Tx on Port 4\n" );
+    return wl_tx( skb, dev, HCF_PORT_4 );
+} // wl_tx_port4
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_tx_port5()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      The handler routine for Tx over HCF_PORT_5.
+ *
+ *  PARAMETERS:
+ *
+ *      skb - a pointer to the sk_buff to transmit.
+ *      dev - a pointer to a net_device structure representing HCF_PORT_5.
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+int wl_tx_port5( struct sk_buff *skb, struct net_device *dev )
+{
+    DBG_TX( DbgInfo, "Tx on Port 5\n" );
+    return wl_tx( skb, dev, HCF_PORT_5 );
+} // wl_tx_port5
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_tx_port6()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      The handler routine for Tx over HCF_PORT_6.
+ *
+ *  PARAMETERS:
+ *
+ *      skb - a pointer to the sk_buff to transmit.
+ *      dev - a pointer to a net_device structure representing HCF_PORT_6.
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+int wl_tx_port6( struct sk_buff *skb, struct net_device *dev )
+{
+    DBG_TX( DbgInfo, "Tx on Port 6\n" );
+    return wl_tx( skb, dev, HCF_PORT_6 );
+} // wl_tx_port6
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_wds_device_alloc()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Create instances of net_device to represent the WDS ports, and register
+ *  the device's entry points in the net_device structure.
+ *
+ *  PARAMETERS:
+ *
+ *      lp  - a pointer to the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      N/A, but will place pointers to the allocated and initialized net_device
+ *      structs in the private adapter structure.
+ *
+ ******************************************************************************/
+void wl_wds_device_alloc( struct wl_private *lp )
+{
+    int count;
+    /*------------------------------------------------------------------------*/
+
+    DBG_FUNC( "wl_wds_device_alloc" );
+    DBG_ENTER( DbgInfo );
+
+    /* WDS support requires additional net_device structs to be allocated,
+       so that user space apps can use these virtual devices to specify the
+       port on which to Tx/Rx */
+    for( count = 0; count < NUM_WDS_PORTS; count++ ) {
+        struct net_device *dev_wds = NULL;
+
+        dev_wds = kmalloc( sizeof( struct net_device ), GFP_KERNEL );
+        memset( dev_wds, 0, sizeof( struct net_device ));
+
+        ether_setup( dev_wds );
+
+        lp->wds_port[count].dev = dev_wds;
+
+        /* Re-use wl_init for all the devices, as it currently does nothing, but
+           is required. Re-use the stats/tx_timeout handler for all as well; the
+           WDS port which is requesting these operations can be determined by
+           the net_device pointer. Set the private member of all devices to point
+           to the same net_device struct; that way, all information gets
+           funnelled through the one "real" net_device. Name the WDS ports
+           "wds<n>" */
+        lp->wds_port[count].dev->init           = &wl_init;
+        lp->wds_port[count].dev->get_stats      = &wl_stats;
+        lp->wds_port[count].dev->tx_timeout     = &wl_tx_timeout;
+        lp->wds_port[count].dev->watchdog_timeo = TX_TIMEOUT;
+        lp->wds_port[count].dev->priv           = lp;
+
+        sprintf( lp->wds_port[count].dev->name, "wds%d", count );
+    }
+
+    /* Register the Tx handlers */
+    lp->wds_port[0].dev->hard_start_xmit = &wl_tx_port1;
+    lp->wds_port[1].dev->hard_start_xmit = &wl_tx_port2;
+    lp->wds_port[2].dev->hard_start_xmit = &wl_tx_port3;
+    lp->wds_port[3].dev->hard_start_xmit = &wl_tx_port4;
+    lp->wds_port[4].dev->hard_start_xmit = &wl_tx_port5;
+    lp->wds_port[5].dev->hard_start_xmit = &wl_tx_port6;
+
+    WL_WDS_NETIF_STOP_QUEUE( lp );
+
+    DBG_LEAVE( DbgInfo );
+    return;
+} // wl_wds_device_alloc
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_wds_device_dealloc()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Free instances of net_device structures used to support WDS.
+ *
+ *  PARAMETERS:
+ *
+ *      lp  - a pointer to the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+void wl_wds_device_dealloc( struct wl_private *lp )
+{
+    int count;
+    /*------------------------------------------------------------------------*/
+
+    DBG_FUNC( "wl_wds_device_dealloc" );
+    DBG_ENTER( DbgInfo );
+
+    for( count = 0; count < NUM_WDS_PORTS; count++ ) {
+        struct net_device *dev_wds = NULL;
+
+        dev_wds = lp->wds_port[count].dev;
+
+        if( dev_wds != NULL ) {
+            if( dev_wds->flags & IFF_UP ) {
+                dev_close( dev_wds );
+                dev_wds->flags &= ~( IFF_UP | IFF_RUNNING );
+            }
+
+            kfree( dev_wds );
+            lp->wds_port[count].dev = NULL;
+        }
+    }
+
+    DBG_LEAVE( DbgInfo );
+    return;
+} // wl_wds_device_dealloc
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_wds_netif_start_queue()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Used to start the netif queues of all the "virtual" network devices
+ *      which repesent the WDS ports.
+ *
+ *  PARAMETERS:
+ *
+ *      lp  - a pointer to the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+void wl_wds_netif_start_queue( struct wl_private *lp )
+{
+    int count;
+    /*------------------------------------------------------------------------*/
+
+    if( lp != NULL ) {
+        for( count = 0; count < NUM_WDS_PORTS; count++ ) {
+            if( lp->wds_port[count].is_registered &&
+                lp->wds_port[count].netif_queue_on == FALSE ) {
+                netif_start_queue( lp->wds_port[count].dev );
+                lp->wds_port[count].netif_queue_on = TRUE;
+            }
+        }
+    }
+
+    return;
+} // wl_wds_netif_start_queue
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_wds_netif_stop_queue()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Used to stop the netif queues of all the "virtual" network devices
+ *      which repesent the WDS ports.
+ *
+ *  PARAMETERS:
+ *
+ *      lp  - a pointer to the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+void wl_wds_netif_stop_queue( struct wl_private *lp )
+{
+    int count;
+    /*------------------------------------------------------------------------*/
+
+    if( lp != NULL ) {
+        for( count = 0; count < NUM_WDS_PORTS; count++ ) {
+            if( lp->wds_port[count].is_registered &&
+                lp->wds_port[count].netif_queue_on == TRUE ) {
+                netif_stop_queue( lp->wds_port[count].dev );
+                lp->wds_port[count].netif_queue_on = FALSE;
+            }
+        }
+    }
+
+    return;
+} // wl_wds_netif_stop_queue
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_wds_netif_wake_queue()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Used to wake the netif queues of all the "virtual" network devices
+ *      which repesent the WDS ports.
+ *
+ *  PARAMETERS:
+ *
+ *      lp  - a pointer to the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+void wl_wds_netif_wake_queue( struct wl_private *lp )
+{
+    int count;
+    /*------------------------------------------------------------------------*/
+
+    if( lp != NULL ) {
+        for( count = 0; count < NUM_WDS_PORTS; count++ ) {
+            if( lp->wds_port[count].is_registered &&
+                lp->wds_port[count].netif_queue_on == FALSE ) {
+                netif_wake_queue( lp->wds_port[count].dev );
+                lp->wds_port[count].netif_queue_on = TRUE;
+            }
+        }
+    }
+
+    return;
+} // wl_wds_netif_wake_queue
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_wds_netif_carrier_on()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Used to signal the network layer that carrier is present on all of the
+ *      "virtual" network devices which repesent the WDS ports.
+ *
+ *  PARAMETERS:
+ *
+ *      lp  - a pointer to the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+void wl_wds_netif_carrier_on( struct wl_private *lp )
+{
+    int count;
+    /*------------------------------------------------------------------------*/
+
+    if( lp != NULL ) {
+        for( count = 0; count < NUM_WDS_PORTS; count++ ) {
+            if( lp->wds_port[count].is_registered ) {
+                netif_carrier_on( lp->wds_port[count].dev );
+            }
+        }
+    }
+
+    return;
+} // wl_wds_netif_carrier_on
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_wds_netif_carrier_off()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Used to signal the network layer that carrier is NOT present on all of
+ *      the "virtual" network devices which repesent the WDS ports.
+ *
+ *  PARAMETERS:
+ *
+ *      lp  - a pointer to the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+void wl_wds_netif_carrier_off( struct wl_private *lp )
+{
+    int count;
+    /*------------------------------------------------------------------------*/
+
+    if( lp != NULL ) {
+        for( count = 0; count < NUM_WDS_PORTS; count++ ) {
+            if( lp->wds_port[count].is_registered ) {
+                netif_carrier_off( lp->wds_port[count].dev );
+            }
+        }
+    }
+
+    return;
+} // wl_wds_netif_carrier_off
+/*============================================================================*/
+
+#endif  /* USE_WDS */
+
+#ifdef ENABLE_DMA
+/*******************************************************************************
+ *	wl_send_dma()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      The routine which performs data transmits when using busmaster DMA.
+ *
+ *  PARAMETERS:
+ *
+ *      lp   - a pointer to the device's wl_private struct.
+ *      skb  - a pointer to the network layer's data buffer.
+ *      port - the Hermes port on which to transmit.
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      1 on error
+ *
+ ******************************************************************************/
+int wl_send_dma( struct wl_private *lp, struct sk_buff *skb, int port )
+{
+    int         len;
+    DESC_STRCT *desc = NULL;
+    DESC_STRCT *desc_next = NULL;
+    /*------------------------------------------------------------------------*/
+
+    DBG_FUNC( "wl_send_dma" );
+
+    if( lp == NULL )
+    {
+        DBG_ERROR( DbgInfo, "Private adapter struct is NULL\n" );
+        return FALSE;
+    }
+
+    if( lp->dev == NULL )
+    {
+        DBG_ERROR( DbgInfo, "net_device struct in wl_private is NULL\n" );
+        return FALSE;
+    }
+
+    /* AGAIN, ALL THE QUEUEING DONE HERE IN I/O MODE IS NOT PERFORMED */
+
+    if( skb == NULL )
+    {
+        DBG_WARNING (DbgInfo, "Nothing to send.\n");
+        return FALSE;
+    }
+
+    len = skb->len;
+
+    /* Get a free descriptor */
+    desc = wl_pci_dma_get_tx_packet( lp );
+
+    if( desc == NULL )
+    {
+        if( lp->netif_queue_on == TRUE ) {
+            netif_stop_queue( lp->dev );
+            WL_WDS_NETIF_STOP_QUEUE( lp );
+            lp->netif_queue_on = FALSE;
+
+            dev_kfree_skb( skb );
+            return 0;
+        }
+    }
+
+    SET_BUF_CNT( desc, /*HCF_DMA_FD_CNT*/HFS_ADDR_DEST );
+    SET_BUF_SIZE( desc, HCF_DMA_TX_BUF1_SIZE );
+
+    desc_next = desc->next_desc_addr;
+
+    if( desc_next->buf_addr == NULL )
+    {
+        DBG_ERROR( DbgInfo, "DMA descriptor buf_addr is NULL\n" );
+        return FALSE;
+    }
+
+    /* Copy the payload into the DMA packet */
+    memcpy( desc_next->buf_addr, skb->data, len );
+
+    SET_BUF_CNT( desc_next, len );
+    SET_BUF_SIZE( desc_next, HCF_MAX_PACKET_SIZE );
+
+    hcf_dma_tx_put( &( lp->hcfCtx ), desc, 0 );
+
+    /* Free the skb and perform queue cleanup, as the buffer was
+            transmitted successfully */
+    dev_kfree_skb( skb );
+
+    return TRUE;
+} // wl_send_dma
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_rx_dma()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      The routine which performs data reception when using busmaster DMA.
+ *
+ *  PARAMETERS:
+ *
+ *      dev - a pointer to the device's net_device structure.
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      1 on error
+ *
+ ******************************************************************************/
+int wl_rx_dma( struct net_device *dev )
+{
+    int                      port;
+    hcf_16                   pktlen;
+    hcf_16                   hfs_stat;
+    struct sk_buff          *skb;
+    struct wl_private       *lp = NULL;
+    DESC_STRCT              *desc, *desc_next;
+    //CFG_MB_INFO_RANGE2_STRCT x;
+    /*------------------------------------------------------------------------*/
+
+    DBG_FUNC("wl_rx")
+    DBG_PARAM(DbgInfo, "dev", "%s (0x%p)", dev->name, dev);
+
+    if((( lp = (struct wl_private *)dev->priv ) != NULL ) &&
+          !( lp->flags & WVLAN2_UIL_BUSY )) {
+
+#ifdef USE_RTS
+        if( lp->useRTS == 1 ) {
+            DBG_PRINT( "RTS: We're getting an Rx...\n" );
+            return -EIO;
+        }
+#endif  /* USE_RTS */
+
+        //if( lp->dma.status == 0 )
+        //{
+            desc = hcf_dma_rx_get( &( lp->hcfCtx ));
+
+            if( desc != NULL )
+            {
+                /* Check and see if we rcvd. a WMP frame */
+                /*
+                if((( *(hcf_8 *)&desc->buf_addr[HFS_STAT] ) &
+                    ( HFS_STAT_MSG_TYPE | HFS_STAT_ERR )) == HFS_STAT_WMP_MSG )
+                {
+                    DBG_TRACE( DbgInfo, "Got a WMP frame\n" );
+
+                    x.len = sizeof( CFG_MB_INFO_RANGE2_STRCT ) / sizeof( hcf_16 );
+				    x.typ = CFG_MB_INFO;
+				    x.base_typ = CFG_WMP;
+				    x.frag_cnt = 2;
+				    x.frag_buf[0].frag_len  = GET_BUF_CNT( descp ) / sizeof( hcf_16 );
+				    x.frag_buf[0].frag_addr = (hcf_8 *) descp->buf_addr ;
+				    x.frag_buf[1].frag_len  = ( GET_BUF_CNT( descp->next_desc_addr ) + 1 ) / sizeof( hcf_16 );
+				    x.frag_buf[1].frag_addr = (hcf_8 *) descp->next_desc_addr->buf_addr ;
+
+                    hcf_put_info( &( lp->hcfCtx ), (LTVP)&x );
+                }
+                */
+
+                desc_next = desc->next_desc_addr;
+
+                /* Make sure the buffer isn't empty */
+                if( GET_BUF_CNT( desc ) == 0 ) {
+                    DBG_WARNING( DbgInfo, "Buffer is empty!\n" );
+
+                    /* Give the descriptor back to the HCF */
+                    hcf_dma_rx_put( &( lp->hcfCtx ), desc );
+                    return -EIO;
+                }
+
+                /* Read the HFS_STAT register from the lookahead buffer */
+                hfs_stat = (hcf_16)( desc->buf_addr[HFS_STAT/2] );
+
+                /* Make sure the frame isn't bad */
+                if(( hfs_stat & HFS_STAT_ERR ) != HCF_SUCCESS )
+                {
+                    DBG_WARNING( DbgInfo, "HFS_STAT_ERROR (0x%x) in Rx Packet\n",
+                                desc->buf_addr[HFS_STAT/2] );
+
+                    /* Give the descriptor back to the HCF */
+                    hcf_dma_rx_put( &( lp->hcfCtx ), desc );
+                    return -EIO;
+                }
+
+                /* Determine what port this packet is for */
+                port = ( hfs_stat >> 8 ) & 0x0007;
+                DBG_RX( DbgInfo, "Rx frame for port %d\n", port );
+
+                if(( pktlen = GET_BUF_CNT( desc_next )) != 0 ) {
+                    if(( skb = ALLOC_SKB( pktlen )) != NULL ) {
+                        switch( port ) {
+#ifdef USE_WDS
+                        case 1:
+                        case 2:
+                        case 3:
+                        case 4:
+                        case 5:
+                        case 6:
+                            skb->dev = lp->wds_port[port-1].dev;
+                            break;
+#endif  /* USE_WDS */
+
+                        case 0:
+                        default:
+                            skb->dev = dev;
+                            break;
+                        }
+
+                        GET_PACKET_DMA( skb->dev, skb, pktlen );
+
+                        /* Give the descriptor back to the HCF */
+                        hcf_dma_rx_put( &( lp->hcfCtx ), desc );
+
+                        netif_rx( skb );
+
+                        if( port == 0 ) {
+                            lp->stats.rx_packets++;
+                            lp->stats.rx_bytes += pktlen;
+                        }
+#ifdef USE_WDS
+                        else
+                        {
+                            lp->wds_port[port-1].stats.rx_packets++;
+                            lp->wds_port[port-1].stats.rx_bytes += pktlen;
+                        }
+#endif  /* USE_WDS */
+
+                        dev->last_rx = jiffies;
+
+                    } else {
+                        DBG_ERROR( DbgInfo, "Could not alloc skb\n" );
+
+                        if( port == 0 )
+	                    {
+	                        lp->stats.rx_dropped++;
+	                    }
+#ifdef USE_WDS
+                        else
+                        {
+                            lp->wds_port[port-1].stats.rx_dropped++;
+                        }
+#endif  /* USE_WDS */
+                    }
+                }
+            }
+        //}
+    }
+
+    return 0;
+} // wl_rx_dma
+/*============================================================================*/
+#endif  // ENABLE_DMA
diff --git a/drivers/staging/wlags49_h2/wl_netdev.h b/drivers/staging/wlags49_h2/wl_netdev.h
new file mode 100644
index 000000000000..632ab2e6302c
--- /dev/null
+++ b/drivers/staging/wlags49_h2/wl_netdev.h
@@ -0,0 +1,154 @@
+/*******************************************************************************
+ * Agere Systems Inc.
+ * Wireless device driver for Linux (wlags49).
+ *
+ * Copyright (c) 1998-2003 Agere Systems Inc.
+ * All rights reserved.
+ *   http://www.agere.com
+ *
+ * Initially developed by TriplePoint, Inc.
+ *   http://www.triplepoint.com
+ *
+ *------------------------------------------------------------------------------
+ *
+ *   Header describing information required by the network layerentry points
+ *   into the driver.
+ *
+ *------------------------------------------------------------------------------
+ *
+ * SOFTWARE LICENSE
+ *
+ * This software is provided subject to the following terms and conditions,
+ * which you should read carefully before using the software.  Using this
+ * software indicates your acceptance of these terms and conditions.  If you do
+ * not agree with these terms and conditions, do not use the software.
+ *
+ * Copyright © 2003 Agere Systems Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source or binary forms, with or without
+ * modifications, are permitted provided that the following conditions are met:
+ *
+ * . Redistributions of source code must retain the above copyright notice, this
+ *    list of conditions and the following Disclaimer as comments in the code as
+ *    well as in the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * . Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following Disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ *
+ * . Neither the name of Agere Systems Inc. nor the names of the contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * Disclaimer
+ *
+ * THIS SOFTWARE IS PROVIDED “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, INFRINGEMENT AND THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  ANY
+ * USE, MODIFICATION OR DISTRIBUTION OF THIS SOFTWARE IS SOLELY AT THE USERS OWN
+ * RISK. IN NO EVENT SHALL AGERE SYSTEMS INC. OR CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, INCLUDING, BUT NOT LIMITED TO, CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ *
+ ******************************************************************************/
+
+#ifndef __WL_NETDEV_H__
+#define __WL_NETDEV_H__
+
+
+
+
+/*******************************************************************************
+ *  function prototypes
+ ******************************************************************************/
+int wl_init( struct net_device *dev );
+
+int wl_config( struct net_device *dev, struct ifmap *map );
+
+struct net_device *wl_device_alloc( void );
+
+void wl_device_dealloc( struct net_device *dev );
+
+int wl_open( struct net_device *dev );
+
+int wl_close( struct net_device *dev );
+
+int wl_ioctl( struct net_device *dev, struct ifreq *rq, int cmd );
+
+int wl_tx( struct sk_buff *skb, struct net_device *dev, int port );
+
+int wl_send( struct wl_private *lp );
+
+int wl_rx( struct net_device *dev );
+
+void wl_tx_timeout( struct net_device *dev );
+
+struct net_device_stats *wl_stats( struct net_device *dev );
+
+
+#ifdef ENABLE_DMA
+int wl_send_dma( struct wl_private *lp, struct sk_buff *skb, int port );
+int wl_rx_dma( struct net_device *dev );
+#endif
+
+#ifdef NEW_MULTICAST
+void wl_multicast( struct net_device *dev );
+#else
+void wl_multicast( struct net_device *dev, int num_addrs, void *addrs );
+#endif // NEW_MULTICAST
+
+
+int wl_tx_port0( struct sk_buff *skb, struct net_device *dev );
+
+
+#ifdef USE_WDS
+
+int wl_tx_port1( struct sk_buff *skb, struct net_device *dev );
+int wl_tx_port2( struct sk_buff *skb, struct net_device *dev );
+int wl_tx_port3( struct sk_buff *skb, struct net_device *dev );
+int wl_tx_port4( struct sk_buff *skb, struct net_device *dev );
+int wl_tx_port5( struct sk_buff *skb, struct net_device *dev );
+int wl_tx_port6( struct sk_buff *skb, struct net_device *dev );
+
+void wl_wds_device_alloc( struct wl_private *lp );
+void wl_wds_device_dealloc( struct wl_private *lp );
+void wl_wds_netif_start_queue( struct wl_private *lp );
+void wl_wds_netif_stop_queue( struct wl_private *lp );
+void wl_wds_netif_wake_queue( struct wl_private *lp );
+void wl_wds_netif_carrier_on( struct wl_private *lp );
+void wl_wds_netif_carrier_off( struct wl_private *lp );
+
+#endif  /* USE_WDS */
+
+
+#ifdef USE_WDS
+
+#define WL_WDS_DEVICE_ALLOC( ARG )      wl_wds_device_alloc( ARG )
+#define WL_WDS_DEVICE_DEALLOC( ARG )    wl_wds_device_dealloc( ARG )
+#define WL_WDS_NETIF_START_QUEUE( ARG ) wl_wds_netif_start_queue( ARG )
+#define WL_WDS_NETIF_STOP_QUEUE( ARG )  wl_wds_netif_stop_queue( ARG )
+#define WL_WDS_NETIF_WAKE_QUEUE( ARG )  wl_wds_netif_wake_queue( ARG )
+#define WL_WDS_NETIF_CARRIER_ON( ARG )  wl_wds_netif_carrier_on( ARG )
+#define WL_WDS_NETIF_CARRIER_OFF( ARG ) wl_wds_netif_carrier_off( ARG )
+
+#else
+
+#define WL_WDS_DEVICE_ALLOC( ARG )
+#define WL_WDS_DEVICE_DEALLOC( ARG )
+#define WL_WDS_NETIF_START_QUEUE( ARG )
+#define WL_WDS_NETIF_STOP_QUEUE( ARG )
+#define WL_WDS_NETIF_WAKE_QUEUE( ARG )
+#define WL_WDS_NETIF_CARRIER_ON( ARG )
+#define WL_WDS_NETIF_CARRIER_OFF( ARG )
+
+#endif  /* USE_WDS */
+
+
+#endif  // __WL_NETDEV_H__
diff --git a/drivers/staging/wlags49_h2/wl_pci.c b/drivers/staging/wlags49_h2/wl_pci.c
new file mode 100644
index 000000000000..a3db111d4a95
--- /dev/null
+++ b/drivers/staging/wlags49_h2/wl_pci.c
@@ -0,0 +1,1581 @@
+/*******************************************************************************
+ * Agere Systems Inc.
+ * Wireless device driver for Linux (wlags49).
+ *
+ * Copyright (c) 1998-2003 Agere Systems Inc.
+ * All rights reserved.
+ *   http://www.agere.com
+ *
+ * Initially developed by TriplePoint, Inc.
+ *   http://www.triplepoint.com
+ *
+ *------------------------------------------------------------------------------
+ *
+ *   This file contains processing and initialization specific to PCI/miniPCI
+ *   devices.
+ *
+ *------------------------------------------------------------------------------
+ *
+ * SOFTWARE LICENSE
+ *
+ * This software is provided subject to the following terms and conditions,
+ * which you should read carefully before using the software.  Using this
+ * software indicates your acceptance of these terms and conditions.  If you do
+ * not agree with these terms and conditions, do not use the software.
+ *
+ * Copyright © 2003 Agere Systems Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source or binary forms, with or without
+ * modifications, are permitted provided that the following conditions are met:
+ *
+ * . Redistributions of source code must retain the above copyright notice, this
+ *    list of conditions and the following Disclaimer as comments in the code as
+ *    well as in the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * . Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following Disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ *
+ * . Neither the name of Agere Systems Inc. nor the names of the contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * Disclaimer
+ *
+ * THIS SOFTWARE IS PROVIDED “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, INFRINGEMENT AND THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  ANY
+ * USE, MODIFICATION OR DISTRIBUTION OF THIS SOFTWARE IS SOLELY AT THE USERS OWN
+ * RISK. IN NO EVENT SHALL AGERE SYSTEMS INC. OR CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, INCLUDING, BUT NOT LIMITED TO, CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ *
+ ******************************************************************************/
+
+/*******************************************************************************
+ * include files
+ ******************************************************************************/
+#include <wireless/wl_version.h>
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/pci.h>
+#include <linux/init.h>
+#include <linux/sched.h>
+#include <linux/ptrace.h>
+#include <linux/slab.h>
+#include <linux/ctype.h>
+#include <linux/string.h>
+//#include <linux/timer.h>
+#include <linux/interrupt.h>
+#include <linux/in.h>
+#include <linux/delay.h>
+#include <asm/system.h>
+#include <asm/io.h>
+#include <asm/irq.h>
+#include <asm/system.h>
+#include <asm/bitops.h>
+#include <asm/uaccess.h>
+
+#include <linux/ethtool.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/skbuff.h>
+#include <linux/if_arp.h>
+#include <linux/ioport.h>
+
+#include <hcf/debug.h>
+
+#include <hcf.h>
+#include <dhf.h>
+#include <hcfdef.h>
+
+#include <wireless/wl_if.h>
+#include <wireless/wl_internal.h>
+#include <wireless/wl_util.h>
+#include <wireless/wl_main.h>
+#include <wireless/wl_netdev.h>
+#include <wireless/wl_pci.h>
+
+
+/*******************************************************************************
+ * global variables
+ ******************************************************************************/
+#if DBG
+extern dbg_info_t *DbgInfo;
+#endif  // DBG
+
+/* define the PCI device Table Cardname and id tables */
+enum hermes_pci_versions {
+	CH_Agere_Systems_Mini_PCI_V1 = 0,
+};
+
+static struct pci_device_id wl_pci_tbl[] __devinitdata = {
+	{ WL_LKM_PCI_VENDOR_ID, WL_LKM_PCI_DEVICE_ID_0, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CH_Agere_Systems_Mini_PCI_V1 },
+    { WL_LKM_PCI_VENDOR_ID, WL_LKM_PCI_DEVICE_ID_1, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CH_Agere_Systems_Mini_PCI_V1 },
+    { WL_LKM_PCI_VENDOR_ID, WL_LKM_PCI_DEVICE_ID_2, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CH_Agere_Systems_Mini_PCI_V1 },
+	{ }			/* Terminating entry */
+};
+
+MODULE_DEVICE_TABLE(pci, wl_pci_tbl);
+
+/*******************************************************************************
+ * function prototypes
+ ******************************************************************************/
+int __devinit wl_pci_probe( struct pci_dev *pdev,
+                                const struct pci_device_id *ent );
+void __devexit wl_pci_remove(struct pci_dev *pdev);
+int wl_pci_setup( struct pci_dev *pdev );
+void wl_pci_enable_cardbus_interrupts( struct pci_dev *pdev );
+
+#ifdef ENABLE_DMA
+int wl_pci_dma_alloc( struct pci_dev *pdev, struct wl_private *lp );
+int wl_pci_dma_free( struct pci_dev *pdev, struct wl_private *lp );
+int wl_pci_dma_alloc_tx_packet( struct pci_dev *pdev, struct wl_private *lp,
+                                DESC_STRCT **desc );
+int wl_pci_dma_free_tx_packet( struct pci_dev *pdev, struct wl_private *lp,
+                                DESC_STRCT **desc );
+int wl_pci_dma_alloc_rx_packet( struct pci_dev *pdev, struct wl_private *lp,
+                                DESC_STRCT **desc );
+int wl_pci_dma_free_rx_packet( struct pci_dev *pdev, struct wl_private *lp,
+                                DESC_STRCT **desc );
+int wl_pci_dma_alloc_desc_and_buf( struct pci_dev *pdev, struct wl_private *lp,
+                                   DESC_STRCT **desc, int size );
+int wl_pci_dma_free_desc_and_buf( struct pci_dev *pdev, struct wl_private *lp,
+                                   DESC_STRCT **desc );
+int wl_pci_dma_alloc_desc( struct pci_dev *pdev, struct wl_private *lp,
+                           DESC_STRCT **desc );
+int wl_pci_dma_free_desc( struct pci_dev *pdev, struct wl_private *lp,
+                           DESC_STRCT **desc );
+int wl_pci_dma_alloc_buf( struct pci_dev *pdev, struct wl_private *lp,
+                          DESC_STRCT *desc, int size );
+int wl_pci_dma_free_buf( struct pci_dev *pdev, struct wl_private *lp,
+                          DESC_STRCT *desc );
+
+void wl_pci_dma_hcf_reclaim_rx( struct wl_private *lp );
+#endif  // ENABLE_DMA
+
+/*******************************************************************************
+ * PCI module function registration
+ ******************************************************************************/
+static struct pci_driver wl_driver =
+{
+	name:		MODULE_NAME,
+    id_table:	wl_pci_tbl,
+	probe:		wl_pci_probe,
+	remove:		__devexit_p(wl_pci_remove),
+    suspend:    NULL,
+    resume:     NULL,
+};
+
+/*******************************************************************************
+ *	wl_adapter_init_module()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Called by init_module() to perform PCI-specific driver initialization.
+ *
+ *  PARAMETERS:
+ *
+ *      N/A
+ *
+ *  RETURNS:
+ *
+ *      0
+ *
+ ******************************************************************************/
+int wl_adapter_init_module( void )
+{
+    int result;
+    /*------------------------------------------------------------------------*/
+
+    DBG_FUNC( "wl_adapter_init_module()" );
+    DBG_ENTER( DbgInfo );
+    DBG_TRACE( DbgInfo, "wl_adapter_init_module() -- PCI\n" );
+
+    result = pci_register_driver( &wl_driver ); //;?replace with pci_module_init, Rubini pg 490
+	//;? why not do something with the result
+
+    DBG_LEAVE( DbgInfo );
+    return 0;
+} // wl_adapter_init_module
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_adapter_cleanup_module()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Called by cleanup_module() to perform PCI-specific driver cleanup.
+ *
+ *  PARAMETERS:
+ *
+ *      N/A
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+void wl_adapter_cleanup_module( void )
+{
+	//;?how comes wl_adapter_cleanup_module is located in a seemingly pci specific module
+    DBG_FUNC( "wl_adapter_cleanup_module" );
+    DBG_ENTER( DbgInfo );
+
+	//;?DBG_TRACE below feels like nearly redundant in the light of DBG_ENTER above
+    DBG_TRACE( DbgInfo, "wl_adapter_cleanup_module() -- PCI\n" );
+
+    pci_unregister_driver( &wl_driver );
+
+    DBG_LEAVE( DbgInfo );
+    return;
+} // wl_adapter_cleanup_module
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_adapter_insert()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Called by wl_pci_probe() to continue the process of device insertion.
+ *
+ *  PARAMETERS:
+ *
+ *      dev - a pointer to the device's net_device structure
+ *
+ *  RETURNS:
+ *
+ *      TRUE or FALSE
+ *
+ ******************************************************************************/
+int wl_adapter_insert( struct net_device *dev )
+{
+    int result = FALSE;
+    /*------------------------------------------------------------------------*/
+
+    DBG_FUNC( "wl_adapter_insert" );
+    DBG_ENTER( DbgInfo );
+
+    DBG_TRACE( DbgInfo, "wl_adapter_insert() -- PCI\n" );
+
+    if( dev == NULL ) {
+        DBG_ERROR( DbgInfo, "net_device pointer is NULL!!!\n" );
+    } else if( dev->priv == NULL ) {
+        DBG_ERROR( DbgInfo, "wl_private pointer is NULL!!!\n" );
+    } else if( wl_insert( dev ) ) { /* Perform remaining device initialization */
+		result = TRUE;
+	} else {
+        DBG_TRACE( DbgInfo, "wl_insert() FAILED\n" );
+    }
+    DBG_LEAVE( DbgInfo );
+    return result;
+} // wl_adapter_insert
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_adapter_open()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Open the device.
+ *
+ *  PARAMETERS:
+ *
+ *      dev - a pointer to the device's net_device structure
+ *
+ *  RETURNS:
+ *
+ *      an HCF status code
+ *
+ ******************************************************************************/
+int wl_adapter_open( struct net_device *dev )
+{
+    int         result = 0;
+    int         hcf_status = HCF_SUCCESS;
+    /*------------------------------------------------------------------------*/
+
+    DBG_FUNC( "wl_adapter_open" );
+    DBG_ENTER( DbgInfo );
+
+    DBG_TRACE( DbgInfo, "wl_adapter_open() -- PCI\n" );
+
+    hcf_status = wl_open( dev );
+
+    if( hcf_status != HCF_SUCCESS ) {
+        result = -ENODEV;
+    }
+
+    DBG_LEAVE( DbgInfo );
+    return result;
+} // wl_adapter_open
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_adapter_close()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Close the device
+ *
+ *  PARAMETERS:
+ *
+ *      dev - a pointer to the device's net_device structure
+ *
+ *  RETURNS:
+ *
+ *      0
+ *
+ ******************************************************************************/
+int wl_adapter_close( struct net_device *dev )
+{
+    DBG_FUNC( "wl_adapter_close" );
+    DBG_ENTER( DbgInfo );
+
+    DBG_TRACE( DbgInfo, "wl_adapter_close() -- PCI\n" );
+    DBG_TRACE( DbgInfo, "%s: Shutting down adapter.\n", dev->name );
+
+    wl_close( dev );
+
+    DBG_LEAVE( DbgInfo );
+    return 0;
+} // wl_adapter_close
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_adapter_is_open()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Check whether this device is open. Returns
+ *
+ *  PARAMETERS:
+ *
+ *      dev - a pointer to the device's net_device structure
+ *
+ *  RETURNS:
+ *
+ *      nonzero if device is open.
+ *
+ ******************************************************************************/
+int wl_adapter_is_open( struct net_device *dev )
+{
+    /* This function is used in PCMCIA to check the status of the 'open' field
+       in the dev_link_t structure associated with a network device. There
+       doesn't seem to be an analog to this for PCI, and checking the status
+       contained in the net_device structure doesn't have the same effect.
+       For now, return TRUE, but find out if this is necessary for PCI. */
+
+    return TRUE;
+} // wl_adapter_is_open
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_pci_probe()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Registered in the pci_driver structure, this function is called when the
+ *  PCI subsystem finds a new PCI device which matches the infomation contained
+ *  in the pci_device_id table.
+ *
+ *  PARAMETERS:
+ *
+ *      pdev    - a pointer to the device's pci_dev structure
+ *      ent     - this device's entry in the pci_device_id table
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+int __devinit wl_pci_probe( struct pci_dev *pdev,
+                                const struct pci_device_id *ent )
+{
+    int result;
+    /*------------------------------------------------------------------------*/
+
+    DBG_FUNC( "wl_pci_probe" );
+    DBG_ENTER( DbgInfo );
+	DBG_PRINT( "%s\n", VERSION_INFO );
+
+    result = wl_pci_setup( pdev );
+
+    DBG_LEAVE( DbgInfo );
+
+    return result;
+} // wl_pci_probe
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_pci_remove()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Registered in the pci_driver structure, this function is called when the
+ *  PCI subsystem detects that a PCI device which matches the infomation
+ *  contained in the pci_device_id table has been removed.
+ *
+ *  PARAMETERS:
+ *
+ *      pdev - a pointer to the device's pci_dev structure
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+void __devexit wl_pci_remove(struct pci_dev *pdev)
+{
+    struct net_device       *dev = NULL;
+    /*------------------------------------------------------------------------*/
+
+    DBG_FUNC( "wl_pci_remove" );
+    DBG_ENTER( DbgInfo );
+
+    /* Make sure the pci_dev pointer passed in is valid */
+    if( pdev == NULL ) {
+        DBG_ERROR( DbgInfo, "PCI subsys passed in an invalid pci_dev pointer\n" );
+        return;
+    }
+
+    dev = (struct net_device *)pci_get_drvdata( pdev );
+    if( dev == NULL ) {
+        DBG_ERROR( DbgInfo, "Could not retrieve net_device structure\n" );
+        return;
+    }
+
+    /* Perform device cleanup */
+    wl_remove( dev );
+    free_irq( dev->irq, dev );
+
+#ifdef ENABLE_DMA
+    wl_pci_dma_free( pdev, (struct wl_private *)dev->priv );
+#endif
+
+    wl_device_dealloc( dev );
+
+    DBG_LEAVE( DbgInfo );
+    return;
+} // wl_pci_remove
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_pci_setup()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Called by wl_pci_probe() to begin a device's initialization process.
+ *
+ *  PARAMETERS:
+ *
+ *      pdev - a pointer to the device's pci_dev structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+int wl_pci_setup( struct pci_dev *pdev )
+{
+    int                 result = 0;
+    struct net_device   *dev = NULL;
+    struct wl_private   *lp = NULL;
+    /*------------------------------------------------------------------------*/
+
+    DBG_FUNC( "wl_pci_setup" );
+    DBG_ENTER( DbgInfo );
+
+    /* Make sure the pci_dev pointer passed in is valid */
+    if( pdev == NULL ) {
+        DBG_ERROR( DbgInfo, "PCI subsys passed in an invalid pci_dev pointer\n" );
+        return -ENODEV;
+    }
+
+    result = pci_enable_device( pdev );
+    if( result != 0 ) {
+        DBG_ERROR( DbgInfo, "pci_enable_device() failed\n" );
+        DBG_LEAVE( DbgInfo );
+        return result;
+    }
+
+    /* We found our device! Let's register it with the system */
+    DBG_TRACE( DbgInfo, "Found our device, now registering\n" );
+    dev = wl_device_alloc( );
+    if( dev == NULL ) {
+        DBG_ERROR( DbgInfo, "Could not register device!!!\n" );
+        DBG_LEAVE( DbgInfo );
+        return -ENOMEM;
+    }
+
+    /* Make sure that space was allocated for our private adapter struct */
+    if( dev->priv == NULL ) {
+        DBG_ERROR( DbgInfo, "Private adapter struct was not allocated!!!\n" );
+        DBG_LEAVE( DbgInfo );
+        return -ENOMEM;
+    }
+
+#ifdef ENABLE_DMA
+    /* Allocate DMA Descriptors */
+    if( wl_pci_dma_alloc( pdev, (struct wl_private *)dev->priv ) < 0 ) {
+        DBG_ERROR( DbgInfo, "Could not allocate DMA descriptor memory!!!\n" );
+        DBG_LEAVE( DbgInfo );
+        return -ENOMEM;
+    }
+#endif
+
+    /* Register our private adapter structure with PCI */
+    pci_set_drvdata( pdev, dev );
+
+    /* Fill out bus specific information in the net_device struct */
+    dev->irq = pdev->irq;
+    SET_MODULE_OWNER( dev );
+
+    DBG_TRACE( DbgInfo, "Device Base Address: %#03lx\n", pdev->resource[0].start );
+	dev->base_addr = pdev->resource[0].start;
+
+    /* Initialize our device here */
+    if( !wl_adapter_insert( dev )) {
+        DBG_ERROR( DbgInfo, "wl_adapter_insert() FAILED!!!\n" );
+        wl_device_dealloc( dev );
+        DBG_LEAVE( DbgInfo );
+        return -EINVAL;
+    }
+
+    /* Register our ISR */
+    DBG_TRACE( DbgInfo, "Registering ISR...\n" );
+
+    result = request_irq(dev->irq, wl_isr, SA_SHIRQ, dev->name, dev);
+    if( result ) {
+        DBG_WARNING( DbgInfo, "Could not register ISR!!!\n" );
+        DBG_LEAVE( DbgInfo );
+        return result;
+	}
+
+    /* Make sure interrupts are enabled properly for CardBus */
+    lp = (struct wl_private *)dev->priv;
+
+    if( lp->hcfCtx.IFB_BusType == CFG_NIC_BUS_TYPE_CARDBUS ||
+	    lp->hcfCtx.IFB_BusType == CFG_NIC_BUS_TYPE_PCI 		) {
+        DBG_TRACE( DbgInfo, "This is a PCI/CardBus card, enable interrupts\n" );
+        wl_pci_enable_cardbus_interrupts( pdev );
+    }
+
+    /* Enable bus mastering */
+    pci_set_master( pdev );
+
+    DBG_LEAVE( DbgInfo );
+    return 0;
+} // wl_pci_setup
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_pci_enable_cardbus_interrupts()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Called by wl_pci_setup() to enable interrupts on a CardBus device. This
+ *  is done by writing bit 15 to the function event mask register. This
+ *  CardBus-specific register is located in BAR2 (counting from BAR0), in memory
+ *  space at byte offset 1f4 (7f4 for WARP).
+ *
+ *  PARAMETERS:
+ *
+ *      pdev - a pointer to the device's pci_dev structure
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+void wl_pci_enable_cardbus_interrupts( struct pci_dev *pdev )
+{
+    u32                 bar2_reg;
+    u32                 mem_addr_bus;
+    u32                 func_evt_mask_reg;
+    void                *mem_addr_kern = NULL;
+    /*------------------------------------------------------------------------*/
+
+    DBG_FUNC( "wl_pci_enable_cardbus_interrupts" );
+    DBG_ENTER( DbgInfo );
+
+    /* Initialize to known bad values */
+    bar2_reg = 0xdeadbeef;
+    mem_addr_bus = 0xdeadbeef;
+
+    /* Read the BAR2 register; this register contains the base address of the
+       memory region where the function event mask register lives */
+    pci_read_config_dword( pdev, PCI_BASE_ADDRESS_2, &bar2_reg );
+    mem_addr_bus = bar2_reg & PCI_BASE_ADDRESS_MEM_MASK;
+
+    /* Once the base address is obtained, remap the memory region to kernel
+       space so we can retrieve the register */
+    mem_addr_kern = ioremap( mem_addr_bus, 0x200 );
+
+#ifdef HERMES25
+#define REG_OFFSET  0x07F4
+#else
+#define REG_OFFSET  0x01F4
+#endif // HERMES25
+
+#define BIT15       0x8000
+
+    /* Retrieve the functional event mask register, enable interrupts by
+       setting Bit 15, and write back the value */
+    func_evt_mask_reg = *(u32 *)( mem_addr_kern + REG_OFFSET );
+    func_evt_mask_reg |= BIT15;
+    *(u32 *)( mem_addr_kern + REG_OFFSET ) = func_evt_mask_reg;
+
+    /* Once complete, unmap the region and exit */
+    iounmap( mem_addr_kern );
+
+    DBG_LEAVE( DbgInfo );
+    return;
+} // wl_pci_enable_cardbus_interrupts
+/*============================================================================*/
+
+#ifdef ENABLE_DMA
+/*******************************************************************************
+ *	wl_pci_dma_alloc()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Allocates all resources needed for PCI/CardBus DMA operation
+ *
+ *  PARAMETERS:
+ *
+ *      pdev - a pointer to the device's pci_dev structure
+ *      lp  - the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+int wl_pci_dma_alloc( struct pci_dev *pdev, struct wl_private *lp )
+{
+    int i;
+    int status = 0;
+    /*------------------------------------------------------------------------*/
+
+    DBG_FUNC( "wl_pci_dma_alloc" );
+    DBG_ENTER( DbgInfo );
+
+//     lp->dma.tx_rsc_ind = lp->dma.rx_rsc_ind = 0;
+//
+//     /* Alloc for the Tx chain and its reclaim descriptor */
+//     for( i = 0; i < NUM_TX_DESC; i++ ) {
+//         status = wl_pci_dma_alloc_tx_packet( pdev, lp, &lp->dma.tx_packet[i] );
+//         if( status == 0 ) {
+//             DBG_PRINT( "lp->dma.tx_packet[%d] :                 0x%p\n", i, lp->dma.tx_packet[i] );
+//             DBG_PRINT( "lp->dma.tx_packet[%d]->next_desc_addr : 0x%p\n", i, lp->dma.tx_packet[i]->next_desc_addr );
+//             lp->dma.tx_rsc_ind++;
+//         } else {
+//             DBG_ERROR( DbgInfo, "Could not alloc DMA Tx Packet\n" );
+//             break;
+//         }
+//     }
+//     if( status == 0 ) {
+//         status = wl_pci_dma_alloc_desc( pdev, lp, &lp->dma.tx_reclaim_desc );
+//         DBG_PRINT( "lp->dma.tx_reclaim_desc: 0x%p\n", lp->dma.tx_reclaim_desc );
+//     }
+//     /* Alloc for the Rx chain and its reclaim descriptor */
+//     if( status == 0 ) {
+//         for( i = 0; i < NUM_RX_DESC; i++ ) {
+//             status = wl_pci_dma_alloc_rx_packet( pdev, lp, &lp->dma.rx_packet[i] );
+//             if( status == 0 ) {
+//                 DBG_PRINT( "lp->dma.rx_packet[%d]                 : 0x%p\n", i, lp->dma.rx_packet[i] );
+//                 DBG_PRINT( "lp->dma.rx_packet[%d]->next_desc_addr : 0x%p\n", i, lp->dma.rx_packet[i]->next_desc_addr );
+//                 lp->dma.rx_rsc_ind++;
+//             } else {
+//                 DBG_ERROR( DbgInfo, "Could not alloc DMA Rx Packet\n" );
+//                 break;
+//             }
+//         }
+//     }
+//     if( status == 0 ) {
+//         status = wl_pci_dma_alloc_desc( pdev, lp, &lp->dma.rx_reclaim_desc );
+//         DBG_PRINT( "lp->dma.rx_reclaim_desc: 0x%p\n", lp->dma.rx_reclaim_desc );
+//     }
+//     /* Store status, as host should not call HCF functions if this fails */
+//     lp->dma.status = status;  //;?all useages of dma.status have been commented out
+//     DBG_LEAVE( DbgInfo );
+    return status;
+} // wl_pci_dma_alloc
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_pci_dma_free()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Deallocated all resources needed for PCI/CardBus DMA operation
+ *
+ *  PARAMETERS:
+ *
+ *      pdev - a pointer to the device's pci_dev structure
+ *      lp  - the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+int wl_pci_dma_free( struct pci_dev *pdev, struct wl_private *lp )
+{
+    int i;
+    int status = 0;
+    /*------------------------------------------------------------------------*/
+
+    DBG_FUNC( "wl_pci_dma_free" );
+    DBG_ENTER( DbgInfo );
+
+    /* Reclaim all Rx packets that were handed over to the HCF */
+    /* Do I need to do this? Before this free is called, I've already disabled
+       the port which will call wl_pci_dma_hcf_reclaim */
+    //if( lp->dma.status == 0 )
+    //{
+    //    wl_pci_dma_hcf_reclaim( lp );
+    //}
+
+    /* Free everything needed for DMA Rx */
+    for( i = 0; i < NUM_RX_DESC; i++ ) {
+        if( lp->dma.rx_packet[i] ) {
+            status = wl_pci_dma_free_rx_packet( pdev, lp, &lp->dma.rx_packet[i] );
+            if( status != 0 ) {
+                DBG_WARNING( DbgInfo, "Problem freeing Rx packet\n" );
+            }
+        }
+    }
+    lp->dma.rx_rsc_ind = 0;
+
+    if( lp->dma.rx_reclaim_desc ) {
+        status = wl_pci_dma_free_desc( pdev, lp, &lp->dma.rx_reclaim_desc );
+        if( status != 0 ) {
+            DBG_WARNING( DbgInfo, "Problem freeing Rx reclaim descriptor\n" );
+        }
+    }
+
+    /* Free everything needed for DMA Tx */
+    for( i = 0; i < NUM_TX_DESC; i++ ) {
+        if( lp->dma.tx_packet[i] ) {
+            status = wl_pci_dma_free_tx_packet( pdev, lp, &lp->dma.tx_packet[i] );
+            if( status != 0 ) {
+                DBG_WARNING( DbgInfo, "Problem freeing Tx packet\n" );
+            }
+        }
+    }
+    lp->dma.tx_rsc_ind = 0;
+
+    if( lp->dma.tx_reclaim_desc ) {
+        status = wl_pci_dma_free_desc( pdev, lp, &lp->dma.tx_reclaim_desc );
+        if( status != 0 ) {
+            DBG_WARNING( DbgInfo, "Problem freeing Tx reclaim descriptor\n" );
+        }
+    }
+
+    DBG_LEAVE( DbgInfo );
+    return status;
+} // wl_pci_dma_free
+
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_pci_dma_alloc_tx_packet()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Allocates a single Tx packet, consisting of several descriptors and
+ *      buffers. Data to transmit is first copied into the 'payload' buffer
+ *      before being transmitted.
+ *
+ *  PARAMETERS:
+ *
+ *      pdev    - a pointer to the device's pci_dev structure
+ *      lp      - the device's private adapter structure
+ *      desc    - a pointer which will reference the descriptor to be alloc'd.
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+int wl_pci_dma_alloc_tx_packet( struct pci_dev *pdev, struct wl_private *lp,
+                                DESC_STRCT **desc )
+{
+//     int status = 0;
+//     /*------------------------------------------------------------------------*/
+//
+//     if( desc == NULL ) {
+//         status = -EFAULT;
+//     }
+//     if( status == 0 ) {
+//         status = wl_pci_dma_alloc_desc_and_buf( pdev, lp, desc,
+//                                                 HCF_DMA_TX_BUF1_SIZE );
+//
+//         if( status == 0 ) {
+//             status = wl_pci_dma_alloc_desc_and_buf( pdev, lp,
+//                                                     &( (*desc)->next_desc_addr ),
+//                                                     HCF_MAX_PACKET_SIZE );
+//         }
+//     }
+//     if( status == 0 ) {
+//         (*desc)->next_desc_phys_addr = (*desc)->next_desc_addr->desc_phys_addr;
+//     }
+//     return status;
+} // wl_pci_dma_alloc_tx_packet
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_pci_dma_free_tx_packet()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Frees a single Tx packet, described in the corresponding alloc function.
+ *
+ *  PARAMETERS:
+ *
+ *      pdev    - a pointer to the device's pci_dev structure
+ *      lp      - the device's private adapter structure
+ *      desc    - a pointer which will reference the descriptor to be alloc'd.
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+int wl_pci_dma_free_tx_packet( struct pci_dev *pdev, struct wl_private *lp,
+                                DESC_STRCT **desc )
+{
+    int status = 0;
+    /*------------------------------------------------------------------------*/
+
+    if( *desc == NULL ) {
+        DBG_PRINT( "Null descriptor\n" );
+        status = -EFAULT;
+    }
+	//;?the "limited" NDIS strategy, assuming a frame consists ALWAYS out of 2
+	//descriptors, make this robust
+    if( status == 0 && (*desc)->next_desc_addr ) {
+        status = wl_pci_dma_free_desc_and_buf( pdev, lp, &(*desc)->next_desc_addr );
+    }
+    if( status == 0 ) {
+        status = wl_pci_dma_free_desc_and_buf( pdev, lp, desc );
+    }
+    return status;
+} // wl_pci_dma_free_tx_packet
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_pci_dma_alloc_rx_packet()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Allocates a single Rx packet, consisting of two descriptors and one
+ *      contiguous buffer. THe buffer starts with the hermes-specific header.
+ *      One descriptor points at the start, the other at offset 0x3a of the
+ *      buffer.
+ *
+ *  PARAMETERS:
+ *
+ *      pdev    - a pointer to the device's pci_dev structure
+ *      lp      - the device's private adapter structure
+ *      desc    - a pointer which will reference the descriptor to be alloc'd.
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+int wl_pci_dma_alloc_rx_packet( struct pci_dev *pdev, struct wl_private *lp,
+                                DESC_STRCT **desc )
+{
+    int         status = 0;
+    DESC_STRCT  *p;
+    /*------------------------------------------------------------------------*/
+
+//     if( desc == NULL ) {
+//         status = -EFAULT;
+//     }
+// 	//;?the "limited" NDIS strategy, assuming a frame consists ALWAYS out of 2
+// 	//descriptors, make this robust
+//     if( status == 0 ) {
+//         status = wl_pci_dma_alloc_desc( pdev, lp, desc );
+// 	}
+//     if( status == 0 ) {
+//         status = wl_pci_dma_alloc_buf( pdev, lp, *desc, HCF_MAX_PACKET_SIZE );
+//     }
+//     if( status == 0 ) {
+//         status = wl_pci_dma_alloc_desc( pdev, lp, &p );
+//     }
+//     if( status == 0 ) {
+//         /* Size of 1st descriptor becomes 0x3a bytes */
+//         SET_BUF_SIZE( *desc, HCF_DMA_RX_BUF1_SIZE );
+//
+//         /* Make 2nd descriptor point at offset 0x3a of the buffer */
+//         SET_BUF_SIZE( p, ( HCF_MAX_PACKET_SIZE - HCF_DMA_RX_BUF1_SIZE ));
+//         p->buf_addr       = (*desc)->buf_addr + HCF_DMA_RX_BUF1_SIZE;
+//         p->buf_phys_addr  = (*desc)->buf_phys_addr + HCF_DMA_RX_BUF1_SIZE;
+//         p->next_desc_addr = NULL;
+//
+//         /* Chain 2nd descriptor to 1st descriptor */
+//         (*desc)->next_desc_addr      = p;
+//         (*desc)->next_desc_phys_addr = p->desc_phys_addr;
+//     }
+
+    return status;
+} // wl_pci_dma_alloc_rx_packet
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_pci_dma_free_rx_packet()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Frees a single Rx packet, described in the corresponding alloc function.
+ *
+ *  PARAMETERS:
+ *
+ *      pdev    - a pointer to the device's pci_dev structure
+ *      lp      - the device's private adapter structure
+ *      desc    - a pointer which will reference the descriptor to be alloc'd.
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+int wl_pci_dma_free_rx_packet( struct pci_dev *pdev, struct wl_private *lp,
+                                DESC_STRCT **desc )
+{
+    int status = 0;
+    DESC_STRCT *p;
+    /*------------------------------------------------------------------------*/
+
+    if( *desc == NULL ) {
+        status = -EFAULT;
+    }
+    if( status == 0 ) {
+        p = (*desc)->next_desc_addr;
+
+        /* Free the 2nd descriptor */
+        if( p != NULL ) {
+            p->buf_addr      = NULL;
+            p->buf_phys_addr = 0;
+
+            status = wl_pci_dma_free_desc( pdev, lp, &p );
+        }
+    }
+
+    /* Free the buffer and 1st descriptor */
+    if( status == 0 ) {
+        SET_BUF_SIZE( *desc, HCF_MAX_PACKET_SIZE );
+        status = wl_pci_dma_free_desc_and_buf( pdev, lp, desc );
+    }
+    return status;
+} // wl_pci_dma_free_rx_packet
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_pci_dma_alloc_desc_and_buf()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Allocates a DMA descriptor and buffer, and associates them with one
+ *      another.
+ *
+ *  PARAMETERS:
+ *
+ *      pdev  - a pointer to the device's pci_dev structure
+ *      lp    - the device's private adapter structure
+ *      desc  - a pointer which will reference the descriptor to be alloc'd
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+int wl_pci_dma_alloc_desc_and_buf( struct pci_dev *pdev, struct wl_private *lp,
+                                   DESC_STRCT **desc, int size )
+{
+    int status = 0;
+    /*------------------------------------------------------------------------*/
+
+//     if( desc == NULL ) {
+//         status = -EFAULT;
+//     }
+//     if( status == 0 ) {
+//         status = wl_pci_dma_alloc_desc( pdev, lp, desc );
+//
+//         if( status == 0 ) {
+//             status = wl_pci_dma_alloc_buf( pdev, lp, *desc, size );
+//         }
+//     }
+    return status;
+} // wl_pci_dma_alloc_desc_and_buf
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_pci_dma_free_desc_and_buf()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Frees a DMA descriptor and associated buffer.
+ *
+ *  PARAMETERS:
+ *
+ *      pdev  - a pointer to the device's pci_dev structure
+ *      lp    - the device's private adapter structure
+ *      desc  - a pointer which will reference the descriptor to be alloc'd
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+int wl_pci_dma_free_desc_and_buf( struct pci_dev *pdev, struct wl_private *lp,
+                                   DESC_STRCT **desc )
+{
+    int status = 0;
+    /*------------------------------------------------------------------------*/
+
+    if( desc == NULL ) {
+        status = -EFAULT;
+    }
+    if( status == 0 && *desc == NULL ) {
+        status = -EFAULT;
+    }
+    if( status == 0 ) {
+        status = wl_pci_dma_free_buf( pdev, lp, *desc );
+
+        if( status == 0 ) {
+            status = wl_pci_dma_free_desc( pdev, lp, desc );
+        }
+    }
+    return status;
+} // wl_pci_dma_free_desc_and_buf
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_pci_dma_alloc_desc()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Allocates one DMA descriptor in cache coherent memory.
+ *
+ *  PARAMETERS:
+ *
+ *      pdev - a pointer to the device's pci_dev structure
+ *      lp  - the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+int wl_pci_dma_alloc_desc( struct pci_dev *pdev, struct wl_private *lp,
+                           DESC_STRCT **desc )
+{
+//     int         status = 0;
+//     dma_addr_t  pa;
+//     /*------------------------------------------------------------------------*/
+//
+//     DBG_FUNC( "wl_pci_dma_alloc_desc" );
+//     DBG_ENTER( DbgInfo );
+//
+//     if( desc == NULL ) {
+//         status = -EFAULT;
+//     }
+//     if( status == 0 ) {
+//         *desc = pci_alloc_consistent( pdev, sizeof( DESC_STRCT ), &pa );
+//     }
+//     if( *desc == NULL ) {
+//         DBG_ERROR( DbgInfo, "pci_alloc_consistent() failed\n" );
+//         status = -ENOMEM;
+//     } else {
+//         memset( *desc, 0, sizeof( DESC_STRCT ));
+//         (*desc)->desc_phys_addr = cpu_to_le32( pa );
+//     }
+//     DBG_LEAVE( DbgInfo );
+//     return status;
+} // wl_pci_dma_alloc_desc
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_pci_dma_free_desc()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Frees one DMA descriptor in cache coherent memory.
+ *
+ *  PARAMETERS:
+ *
+ *      pdev - a pointer to the device's pci_dev structure
+ *      lp  - the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+int wl_pci_dma_free_desc( struct pci_dev *pdev, struct wl_private *lp,
+                           DESC_STRCT **desc )
+{
+    int         status = 0;
+    /*------------------------------------------------------------------------*/
+
+    if( *desc == NULL ) {
+        status = -EFAULT;
+    }
+    if( status == 0 ) {
+        pci_free_consistent( pdev, sizeof( DESC_STRCT ), *desc,
+                             (*desc)->desc_phys_addr );
+    }
+    *desc = NULL;
+    return status;
+} // wl_pci_dma_free_desc
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_pci_dma_alloc_buf()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Allocates one DMA buffer in cache coherent memory, and associates a DMA
+ *      descriptor with this buffer.
+ *
+ *  PARAMETERS:
+ *
+ *      pdev - a pointer to the device's pci_dev structure
+ *      lp  - the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+int wl_pci_dma_alloc_buf( struct pci_dev *pdev, struct wl_private *lp,
+                          DESC_STRCT *desc, int size )
+{
+    int         status = 0;
+    dma_addr_t  pa;
+    /*------------------------------------------------------------------------*/
+
+//     DBG_FUNC( "wl_pci_dma_alloc_buf" );
+//     DBG_ENTER( DbgInfo );
+//
+//     if( desc == NULL ) {
+//         status = -EFAULT;
+//     }
+//     if( status == 0 && desc->buf_addr != NULL ) {
+//         status = -EFAULT;
+//     }
+//     if( status == 0 ) {
+//         desc->buf_addr = pci_alloc_consistent( pdev, size, &pa );
+//     }
+//     if( desc->buf_addr == NULL ) {
+//         DBG_ERROR( DbgInfo, "pci_alloc_consistent() failed\n" );
+//         status = -ENOMEM;
+//     } else {
+//         desc->buf_phys_addr = cpu_to_le32( pa );
+//         SET_BUF_SIZE( desc, size );
+//     }
+//     DBG_LEAVE( DbgInfo );
+    return status;
+} // wl_pci_dma_alloc_buf
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_pci_dma_free_buf()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Allocates one DMA buffer in cache coherent memory, and associates a DMA
+ *      descriptor with this buffer.
+ *
+ *  PARAMETERS:
+ *
+ *      pdev - a pointer to the device's pci_dev structure
+ *      lp  - the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+int wl_pci_dma_free_buf( struct pci_dev *pdev, struct wl_private *lp,
+                         DESC_STRCT *desc )
+{
+    int         status = 0;
+    /*------------------------------------------------------------------------*/
+
+    if( desc == NULL ) {
+        status = -EFAULT;
+    }
+    if( status == 0 && desc->buf_addr == NULL ) {
+        status = -EFAULT;
+    }
+    if( status == 0 ) {
+        pci_free_consistent( pdev, GET_BUF_SIZE( desc ), desc->buf_addr,
+                             desc->buf_phys_addr );
+
+        desc->buf_addr = 0;
+        desc->buf_phys_addr = 0;
+        SET_BUF_SIZE( desc, 0 );
+    }
+    return status;
+} // wl_pci_dma_free_buf
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_pci_dma_hcf_supply()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Supply HCF with DMA-related resources. These consist of:
+ *          - buffers and descriptors for receive purposes
+ *          - one 'reclaim' descriptor for the transmit path, used to fulfill a
+ *            certain H25 DMA engine requirement
+ *          - one 'reclaim' descriptor for the receive path, used to fulfill a
+ *            certain H25 DMA engine requirement
+ *
+ *      This function is called at start-of-day or at re-initialization.
+ *
+ *  PARAMETERS:
+ *
+ *      lp  - the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+void wl_pci_dma_hcf_supply( struct wl_private *lp )
+{
+    int i;
+    /*------------------------------------------------------------------------*/
+
+    DBG_FUNC( "wl_pci_dma_hcf_supply" );
+    DBG_ENTER( DbgInfo );
+
+    //if( lp->dma.status == 0 );
+    //{
+        /* Hand over the Rx/Tx reclaim descriptors to the HCF */
+        if( lp->dma.tx_reclaim_desc ) {
+            DBG_PRINT( "lp->dma.tx_reclaim_desc: 0x%p\n", lp->dma.tx_reclaim_desc );
+            hcf_dma_tx_put( &lp->hcfCtx, lp->dma.tx_reclaim_desc, 0 );
+            lp->dma.tx_reclaim_desc = NULL;
+            DBG_PRINT( "lp->dma.tx_reclaim_desc: 0x%p\n", lp->dma.tx_reclaim_desc );
+        }
+        if( lp->dma.rx_reclaim_desc ) {
+            DBG_PRINT( "lp->dma.rx_reclaim_desc: 0x%p\n", lp->dma.rx_reclaim_desc );
+            hcf_dma_rx_put( &lp->hcfCtx, lp->dma.rx_reclaim_desc );
+            lp->dma.rx_reclaim_desc = NULL;
+            DBG_PRINT( "lp->dma.rx_reclaim_desc: 0x%p\n", lp->dma.rx_reclaim_desc );
+        }
+        /* Hand over the Rx descriptor chain to the HCF */
+        for( i = 0; i < NUM_RX_DESC; i++ ) {
+            DBG_PRINT( "lp->dma.rx_packet[%d]:    0x%p\n", i, lp->dma.rx_packet[i] );
+            hcf_dma_rx_put( &lp->hcfCtx, lp->dma.rx_packet[i] );
+            lp->dma.rx_packet[i] = NULL;
+            DBG_PRINT( "lp->dma.rx_packet[%d]:    0x%p\n", i, lp->dma.rx_packet[i] );
+        }
+    //}
+
+    DBG_LEAVE( DbgInfo );
+    return;
+} // wl_pci_dma_hcf_supply
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_pci_dma_hcf_reclaim()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Return DMA-related resources from the HCF. These consist of:
+ *          - buffers and descriptors for receive purposes
+ *          - buffers and descriptors for transmit purposes
+ *          - one 'reclaim' descriptor for the transmit path, used to fulfill a
+ *            certain H25 DMA engine requirement
+ *          - one 'reclaim' descriptor for the receive path, used to fulfill a
+ *            certain H25 DMA engine requirement
+ *
+ *      This function is called at end-of-day or at re-initialization.
+ *
+ *  PARAMETERS:
+ *
+ *      lp  - the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+void wl_pci_dma_hcf_reclaim( struct wl_private *lp )
+{
+    int i;
+    /*------------------------------------------------------------------------*/
+
+    DBG_FUNC( "wl_pci_dma_hcf_reclaim" );
+    DBG_ENTER( DbgInfo );
+
+    wl_pci_dma_hcf_reclaim_rx( lp );
+    for( i = 0; i < NUM_RX_DESC; i++ ) {
+        DBG_PRINT( "rx_packet[%d] 0x%p\n", i, lp->dma.rx_packet[i] );
+//         if( lp->dma.rx_packet[i] == NULL ) {
+//             DBG_PRINT( "wl_pci_dma_hcf_reclaim: rx_packet[%d] NULL\n", i );
+//         }
+    }
+
+    wl_pci_dma_hcf_reclaim_tx( lp );
+    for( i = 0; i < NUM_TX_DESC; i++ ) {
+        DBG_PRINT( "tx_packet[%d] 0x%p\n", i, lp->dma.tx_packet[i] );
+//         if( lp->dma.tx_packet[i] == NULL ) {
+//             DBG_PRINT( "wl_pci_dma_hcf_reclaim: tx_packet[%d] NULL\n", i );
+//         }
+     }
+
+    DBG_LEAVE( DbgInfo );
+    return;
+} // wl_pci_dma_hcf_reclaim
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_pci_dma_hcf_reclaim_rx()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Reclaim Rx packets that have already been processed by the HCF.
+ *
+ *  PARAMETERS:
+ *
+ *      lp  - the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+void wl_pci_dma_hcf_reclaim_rx( struct wl_private *lp )
+{
+    int         i;
+    DESC_STRCT *p;
+    /*------------------------------------------------------------------------*/
+
+    DBG_FUNC( "wl_pci_dma_hcf_reclaim_rx" );
+    DBG_ENTER( DbgInfo );
+
+    //if( lp->dma.status == 0 )
+    //{
+        while ( ( p = hcf_dma_rx_get( &lp->hcfCtx ) ) != NULL ) {
+            if( p && p->buf_addr == NULL ) {
+                /* A reclaim descriptor is being given back by the HCF. Reclaim
+                   descriptors have a NULL buf_addr */
+                lp->dma.rx_reclaim_desc = p;
+            	DBG_PRINT( "reclaim_descriptor: 0x%p\n", p );
+                continue;
+            }
+            for( i = 0; i < NUM_RX_DESC; i++ ) {
+                if( lp->dma.rx_packet[i] == NULL ) {
+                    break;
+                }
+            }
+            /* An Rx buffer descriptor is being given back by the HCF */
+            lp->dma.rx_packet[i] = p;
+            lp->dma.rx_rsc_ind++;
+        	DBG_PRINT( "rx_packet[%d] 0x%p\n", i, lp->dma.rx_packet[i] );
+        }
+    //}
+    DBG_LEAVE( DbgInfo );
+} // wl_pci_dma_hcf_reclaim_rx
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_pci_dma_get_tx_packet()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Obtains a Tx descriptor from the chain to use for Tx.
+ *
+ *  PARAMETERS:
+ *
+ *      lp - a pointer to the device's wl_private structure.
+ *
+ *  RETURNS:
+ *
+ *      A pointer to the retrieved descriptor
+ *
+ ******************************************************************************/
+DESC_STRCT * wl_pci_dma_get_tx_packet( struct wl_private *lp )
+{
+    int i;
+    DESC_STRCT *desc = NULL;
+    /*------------------------------------------------------------------------*/
+
+    for( i = 0; i < NUM_TX_DESC; i++ ) {
+        if( lp->dma.tx_packet[i] ) {
+            break;
+        }
+    }
+
+    if( i != NUM_TX_DESC ) {
+        desc = lp->dma.tx_packet[i];
+
+        lp->dma.tx_packet[i] = NULL;
+        lp->dma.tx_rsc_ind--;
+
+        memset( desc->buf_addr, 0, HCF_DMA_TX_BUF1_SIZE );
+    }
+
+    return desc;
+} // wl_pci_dma_get_tx_packet
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_pci_dma_put_tx_packet()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Returns a Tx descriptor to the chain.
+ *
+ *  PARAMETERS:
+ *
+ *      lp   - a pointer to the device's wl_private structure.
+ *      desc - a pointer to the descriptor to return.
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+void wl_pci_dma_put_tx_packet( struct wl_private *lp, DESC_STRCT *desc )
+{
+    int i;
+    /*------------------------------------------------------------------------*/
+
+    for( i = 0; i < NUM_TX_DESC; i++ ) {
+        if( lp->dma.tx_packet[i] == NULL ) {
+            break;
+        }
+    }
+
+    if( i != NUM_TX_DESC ) {
+        lp->dma.tx_packet[i] = desc;
+        lp->dma.tx_rsc_ind++;
+    }
+} // wl_pci_dma_put_tx_packet
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wl_pci_dma_hcf_reclaim_tx()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Reclaim Tx packets that have either been processed by the HCF due to a
+ *      port disable or a Tx completion.
+ *
+ *  PARAMETERS:
+ *
+ *      lp  - the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+void wl_pci_dma_hcf_reclaim_tx( struct wl_private *lp )
+{
+    int         i;
+    DESC_STRCT *p;
+    /*------------------------------------------------------------------------*/
+
+    DBG_FUNC( "wl_pci_dma_hcf_reclaim_tx" );
+    DBG_ENTER( DbgInfo );
+
+    //if( lp->dma.status == 0 )
+    //{
+        while ( ( p = hcf_dma_tx_get( &lp->hcfCtx ) ) != NULL ) {
+
+            if( p != NULL && p->buf_addr == NULL ) {
+                /* A Reclaim descriptor is being given back by the HCF. Reclaim
+                   descriptors have a NULL buf_addr */
+                lp->dma.tx_reclaim_desc = p;
+            	DBG_PRINT( "reclaim_descriptor: 0x%p\n", p );
+                continue;
+            }
+            for( i = 0; i < NUM_TX_DESC; i++ ) {
+                if( lp->dma.tx_packet[i] == NULL ) {
+                    break;
+                }
+            }
+            /* An Rx buffer descriptor is being given back by the HCF */
+            lp->dma.tx_packet[i] = p;
+            lp->dma.tx_rsc_ind++;
+        	DBG_PRINT( "tx_packet[%d] 0x%p\n", i, lp->dma.tx_packet[i] );
+        }
+    //}
+
+    if( lp->netif_queue_on == FALSE ) {
+        netif_wake_queue( lp->dev );
+        WL_WDS_NETIF_WAKE_QUEUE( lp );
+        lp->netif_queue_on = TRUE;
+    }
+    DBG_LEAVE( DbgInfo );
+    return;
+} // wl_pci_dma_hcf_reclaim_tx
+/*============================================================================*/
+#endif  // ENABLE_DMA
diff --git a/drivers/staging/wlags49_h2/wl_pci.h b/drivers/staging/wlags49_h2/wl_pci.h
new file mode 100644
index 000000000000..18d7b514ea6c
--- /dev/null
+++ b/drivers/staging/wlags49_h2/wl_pci.h
@@ -0,0 +1,109 @@
+/*******************************************************************************
+ * Agere Systems Inc.
+ * Wireless device driver for Linux (wlags49).
+ *
+ * Copyright (c) 1998-2003 Agere Systems Inc.
+ * All rights reserved.
+ *   http://www.agere.com
+ *
+ * Initially developed by TriplePoint, Inc.
+ *   http://www.triplepoint.com
+ *
+ *------------------------------------------------------------------------------
+ *
+ *   Header describing information required for the driver to support PCI.
+ *
+ *------------------------------------------------------------------------------
+ *
+ * SOFTWARE LICENSE
+ *
+ * This software is provided subject to the following terms and conditions,
+ * which you should read carefully before using the software.  Using this
+ * software indicates your acceptance of these terms and conditions.  If you do
+ * not agree with these terms and conditions, do not use the software.
+ *
+ * Copyright © 2003 Agere Systems Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source or binary forms, with or without
+ * modifications, are permitted provided that the following conditions are met:
+ *
+ * . Redistributions of source code must retain the above copyright notice, this
+ *    list of conditions and the following Disclaimer as comments in the code as
+ *    well as in the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * . Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following Disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ *
+ * . Neither the name of Agere Systems Inc. nor the names of the contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * Disclaimer
+ *
+ * THIS SOFTWARE IS PROVIDED “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, INFRINGEMENT AND THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  ANY
+ * USE, MODIFICATION OR DISTRIBUTION OF THIS SOFTWARE IS SOLELY AT THE USERS OWN
+ * RISK. IN NO EVENT SHALL AGERE SYSTEMS INC. OR CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, INCLUDING, BUT NOT LIMITED TO, CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ *
+ ******************************************************************************/
+
+#ifndef __WL_PCI_H__
+#define __WL_PCI_H__
+
+
+
+
+/*******************************************************************************
+ *  constant definitions
+ ******************************************************************************/
+#define WL_LKM_PCI_VENDOR_ID    0x11C1  // Lucent Microelectronics
+#define WL_LKM_PCI_DEVICE_ID_0  0xAB30  // Mini PCI
+#define WL_LKM_PCI_DEVICE_ID_1  0xAB34  // Mini PCI
+#define WL_LKM_PCI_DEVICE_ID_2  0xAB11  // WARP CardBus
+
+
+
+
+/*******************************************************************************
+ *  function prototypes
+ ******************************************************************************/
+int wl_adapter_init_module( void );
+
+void wl_adapter_cleanup_module( void );
+
+int wl_adapter_insert( struct net_device *dev );
+
+int wl_adapter_open( struct net_device *dev );
+
+int wl_adapter_close( struct net_device *dev );
+
+int wl_adapter_is_open( struct net_device *dev );
+
+
+#ifdef ENABLE_DMA
+
+void wl_pci_dma_hcf_supply( struct wl_private *lp );
+
+void wl_pci_dma_hcf_reclaim( struct wl_private *lp );
+
+DESC_STRCT * wl_pci_dma_get_tx_packet( struct wl_private *lp );
+
+void wl_pci_dma_put_tx_packet( struct wl_private *lp, DESC_STRCT *desc );
+
+void wl_pci_dma_hcf_reclaim_tx( struct wl_private *lp );
+
+#endif  // ENABLE_DMA
+
+
+#endif  // __WL_PCI_H__
diff --git a/drivers/staging/wlags49_h2/wl_priv.c b/drivers/staging/wlags49_h2/wl_priv.c
new file mode 100644
index 000000000000..ee610c76457e
--- /dev/null
+++ b/drivers/staging/wlags49_h2/wl_priv.c
@@ -0,0 +1,2078 @@
+/*******************************************************************************
+ * Agere Systems Inc.
+ * Wireless device driver for Linux (wlags49).
+ *
+ * Copyright (c) 1998-2003 Agere Systems Inc.
+ * All rights reserved.
+ *   http://www.agere.com
+ *
+ * Initially developed by TriplePoint, Inc.
+ *   http://www.triplepoint.com
+ *
+ *------------------------------------------------------------------------------
+ *
+ *   This file defines handling routines for the private IOCTLs
+ *
+ *------------------------------------------------------------------------------
+ *
+ * SOFTWARE LICENSE
+ *
+ * This software is provided subject to the following terms and conditions,
+ * which you should read carefully before using the software.  Using this
+ * software indicates your acceptance of these terms and conditions.  If you do
+ * not agree with these terms and conditions, do not use the software.
+ *
+ * Copyright © 2003 Agere Systems Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source or binary forms, with or without
+ * modifications, are permitted provided that the following conditions are met:
+ *
+ * . Redistributions of source code must retain the above copyright notice, this
+ *    list of conditions and the following Disclaimer as comments in the code as
+ *    well as in the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * . Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following Disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ *
+ * . Neither the name of Agere Systems Inc. nor the names of the contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * Disclaimer
+ *
+ * THIS SOFTWARE IS PROVIDED “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, INFRINGEMENT AND THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  ANY
+ * USE, MODIFICATION OR DISTRIBUTION OF THIS SOFTWARE IS SOLELY AT THE USERS OWN
+ * RISK. IN NO EVENT SHALL AGERE SYSTEMS INC. OR CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, INCLUDING, BUT NOT LIMITED TO, CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ *
+ ******************************************************************************/
+
+/*******************************************************************************
+ * include files
+ ******************************************************************************/
+#include <wl_version.h>
+
+#include <linux/if_arp.h>
+#include <linux/ioport.h>
+#include <linux/delay.h>
+#include <asm/uaccess.h>
+
+#include <debug.h>
+#include <hcf.h>
+#include <hcfdef.h>
+
+#include <wl_if.h>
+#include <wl_internal.h>
+#include <wl_enc.h>
+#include <wl_main.h>
+#include <wl_priv.h>
+#include <wl_util.h>
+#include <wl_netdev.h>
+
+int wvlan_uil_connect( struct uilreq *urq, struct wl_private *lp );
+int wvlan_uil_disconnect( struct uilreq *urq, struct wl_private *lp );
+int wvlan_uil_action( struct uilreq *urq, struct wl_private *lp );
+int wvlan_uil_block( struct uilreq *urq, struct wl_private *lp );
+int wvlan_uil_unblock( struct uilreq *urq, struct wl_private *lp );
+int wvlan_uil_send_diag_msg( struct uilreq *urq, struct wl_private *lp );
+int wvlan_uil_put_info( struct uilreq *urq, struct wl_private *lp );
+int wvlan_uil_get_info( struct uilreq *urq, struct wl_private *lp );
+
+int cfg_driver_info( struct uilreq *urq, struct wl_private *lp );
+int cfg_driver_identity( struct uilreq *urq, struct wl_private *lp );
+
+
+/*******************************************************************************
+ * global variables
+ ******************************************************************************/
+#if DBG
+extern dbg_info_t *DbgInfo;
+#endif  // DBG
+
+
+
+
+/* If USE_UIL is not defined, then none of the UIL Interface code below will
+   be included in the build */
+#ifdef USE_UIL
+
+/*******************************************************************************
+ *	wvlan_uil()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      The handler function for the UIL interface.
+ *
+ *  PARAMETERS:
+ *
+ *      urq - a pointer to the UIL request buffer
+ *      lp  - a pointer to the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+int wvlan_uil( struct uilreq *urq, struct wl_private *lp )
+{
+	int ioctl_ret = 0;
+	/*------------------------------------------------------------------------*/
+
+	DBG_FUNC( "wvlan_uil" );
+	DBG_ENTER( DbgInfo );
+
+	switch( urq->command ) {
+	  case UIL_FUN_CONNECT:
+		DBG_TRACE(DbgInfo, "IOCTL: WVLAN2_IOCTL_UIL -- WVLAN2_UIL_CONNECT\n");
+		ioctl_ret = wvlan_uil_connect( urq, lp );
+		break;
+	  case UIL_FUN_DISCONNECT:
+		DBG_TRACE(DbgInfo, "IOCTL: WVLAN2_IOCTL_UIL -- WVLAN2_UIL_DISCONNECT\n");
+		ioctl_ret = wvlan_uil_disconnect( urq, lp );
+		break;
+	  case UIL_FUN_ACTION:
+		DBG_TRACE(DbgInfo, "IOCTL: WVLAN2_IOCTL_UIL -- WVLAN2_UIL_ACTION\n" );
+		ioctl_ret = wvlan_uil_action( urq, lp );
+		break;
+	  case UIL_FUN_SEND_DIAG_MSG:
+		DBG_TRACE(DbgInfo, "IOCTL: WVLAN2_IOCTL_UIL -- WVLAN2_UIL_SEND_DIAG_MSG\n");
+		ioctl_ret = wvlan_uil_send_diag_msg( urq, lp );
+		break;
+	  case UIL_FUN_GET_INFO:
+		DBG_TRACE(DbgInfo, "IOCTL: WVLAN2_IOCTL_UIL -- WVLAN2_UIL_GET_INFO\n");
+		ioctl_ret = wvlan_uil_get_info( urq, lp );
+		break;
+	  case UIL_FUN_PUT_INFO:
+		DBG_TRACE(DbgInfo, "IOCTL: WVLAN2_IOCTL_UIL -- WVLAN2_UIL_PUT_INFO\n");
+		ioctl_ret = wvlan_uil_put_info( urq, lp );
+		break;
+	default:
+		DBG_TRACE(DbgInfo, "IOCTL: WVLAN2_IOCTL_UIL -- UNSUPPORTED UIL CODE: 0x%X", urq->command );
+		ioctl_ret = -EOPNOTSUPP;
+		break;
+	}
+	DBG_LEAVE( DbgInfo );
+	return ioctl_ret;
+} // wvlan_uil
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wvlan_uil_connect()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Connect to the UIL in order to make a request.
+ *
+ *  PARAMETERS:
+ *
+ *      urq - a pointer to the UIL request buffer
+ *      lp  - a pointer to the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      UIL_SUCCESS
+ *      UIL_ERR_xxx value otherwise
+ *
+ ******************************************************************************/
+int wvlan_uil_connect( struct uilreq *urq, struct wl_private *lp )
+{
+	int result = 0;
+	/*------------------------------------------------------------------------*/
+
+
+	DBG_FUNC( "wvlan_uil_connect" );
+	DBG_ENTER( DbgInfo );
+
+
+	if( !( lp->flags & WVLAN2_UIL_CONNECTED )) {
+		lp->flags |= WVLAN2_UIL_CONNECTED;
+		urq->hcfCtx = &( lp->hcfCtx );
+		urq->result = UIL_SUCCESS;
+	} else {
+		DBG_WARNING( DbgInfo, "UIL_ERR_IN_USE\n" );
+		urq->result = UIL_ERR_IN_USE;
+	}
+
+	DBG_LEAVE( DbgInfo );
+	return result;
+} // wvlan_uil_connect
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wvlan_uil_disconnect()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Disonnect from the UIL after a request has been completed.
+ *
+ *  PARAMETERS:
+ *
+ *      urq - a pointer to the UIL request buffer
+ *      lp  - a pointer to the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      UIL_SUCCESS
+ *      UIL_ERR_xxx value otherwise
+ *
+ ******************************************************************************/
+int wvlan_uil_disconnect( struct uilreq *urq, struct wl_private *lp )
+{
+	int result = 0;
+	/*------------------------------------------------------------------------*/
+
+
+	DBG_FUNC( "wvlan_uil_disconnect" );
+	DBG_ENTER( DbgInfo );
+
+
+	if( urq->hcfCtx == &( lp->hcfCtx )) {
+		if (lp->flags & WVLAN2_UIL_CONNECTED) {
+			lp->flags &= ~WVLAN2_UIL_CONNECTED;
+			/*
+			if (lp->flags & WVLAN2_UIL_BUSY) {
+				lp->flags &= ~WVLAN2_UIL_BUSY;
+				netif_start_queue(lp->dev);
+			}
+			*/
+		}
+
+		urq->hcfCtx = NULL;
+		urq->result = UIL_SUCCESS;
+	} else {
+		DBG_ERROR( DbgInfo, "UIL_ERR_WRONG_IFB\n" );
+		urq->result = UIL_ERR_WRONG_IFB;
+	}
+
+	DBG_LEAVE( DbgInfo );
+	return result;
+} // wvlan_uil_disconnect
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wvlan_uil_action()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Handler for the UIL_ACT_xxx subcodes associated with UIL_FUN_ACTION
+ *
+ *  PARAMETERS:
+ *
+ *      urq - a pointer to the UIL request buffer
+ *      lp  - a pointer to the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      UIL_SUCCESS
+ *      UIL_ERR_xxx value otherwise
+ *
+ ******************************************************************************/
+int wvlan_uil_action( struct uilreq *urq, struct wl_private *lp )
+{
+	int     result = 0;
+	ltv_t   *ltv;
+	/*------------------------------------------------------------------------*/
+
+
+	DBG_FUNC( "wvlan_uil_action" );
+	DBG_ENTER( DbgInfo );
+
+
+	if( urq->hcfCtx == &( lp->hcfCtx )) {
+		/* Make sure there's an LTV in the request buffer */
+		ltv = (ltv_t *)urq->data;
+		if( ltv != NULL ) {
+			/* Switch on the Type field of the LTV contained in the request
+			   buffer */
+			switch( ltv->typ ) {
+			case UIL_ACT_BLOCK:
+				DBG_TRACE( DbgInfo, "UIL_ACT_BLOCK\n" );
+				result = wvlan_uil_block( urq, lp );
+				break;
+			case UIL_ACT_UNBLOCK:
+				DBG_TRACE( DbgInfo, "UIL_ACT_UNBLOCK\n" );
+				result = wvlan_uil_unblock( urq, lp );
+				break;
+			case UIL_ACT_SCAN:
+				DBG_TRACE( DbgInfo, "UIL_ACT_SCAN\n" );
+				urq->result = hcf_action( &( lp->hcfCtx ), MDD_ACT_SCAN );
+				break;
+			case UIL_ACT_APPLY:
+				DBG_TRACE( DbgInfo, "UIL_ACT_APPLY\n" );
+				urq->result = wl_apply( lp );
+				break;
+			case UIL_ACT_RESET:
+				DBG_TRACE( DbgInfo, "UIL_ACT_RESET\n" );
+				urq->result = wl_go( lp );
+				break;
+			default:
+				DBG_WARNING( DbgInfo, "Unknown action code: 0x%x\n", ltv->typ );
+				break;
+			}
+		} else {
+			DBG_ERROR( DbgInfo, "Bad LTV for this action\n" );
+			urq->result = UIL_ERR_LEN;
+		}
+	} else {
+		DBG_ERROR( DbgInfo, "UIL_ERR_WRONG_IFB\n" );
+		urq->result = UIL_ERR_WRONG_IFB;
+	}
+
+	DBG_LEAVE( DbgInfo );
+	return result;
+} // wvlan_uil_action
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wvlan_uil_block()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Sets a block in the driver to prevent access to the card by other
+ *  processes.
+ *
+ *  PARAMETERS:
+ *
+ *      urq - a pointer to the UIL request buffer
+ *      lp  - a pointer to the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      UIL_SUCCESS
+ *      UIL_ERR_xxx value otherwise
+ *
+ ******************************************************************************/
+
+int wvlan_uil_block( struct uilreq *urq, struct wl_private *lp )
+{
+	int result = 0;
+	/*------------------------------------------------------------------------*/
+
+
+	DBG_FUNC( "wvlan_uil_block" );
+	DBG_ENTER( DbgInfo );
+
+	if( urq->hcfCtx == &( lp->hcfCtx )) {
+		if( capable( CAP_NET_ADMIN )) {
+			lp->flags |= WVLAN2_UIL_BUSY;
+			netif_stop_queue(lp->dev);
+			WL_WDS_NETIF_STOP_QUEUE( lp );
+			urq->result = UIL_SUCCESS;
+		} else {
+			DBG_ERROR( DbgInfo, "EPERM\n" );
+			urq->result = UIL_FAILURE;
+			result = -EPERM;
+		}
+	} else {
+		DBG_ERROR( DbgInfo, "UIL_ERR_WRONG_IFB\n" );
+		urq->result = UIL_ERR_WRONG_IFB;
+	}
+
+	DBG_LEAVE( DbgInfo );
+	return result;
+} // wvlan_uil_block
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wvlan_uil_unblock()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Unblocks the driver to restore access to the card by other processes.
+ *
+ *  PARAMETERS:
+ *
+ *      urq - a pointer to the UIL request buffer
+ *      lp  - a pointer to the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      UIL_SUCCESS
+ *      UIL_ERR_xxx value otherwise
+ *
+ ******************************************************************************/
+int wvlan_uil_unblock( struct uilreq *urq, struct wl_private *lp )
+{
+	int result = 0;
+	/*------------------------------------------------------------------------*/
+
+
+	DBG_FUNC( "wvlan_uil_unblock" );
+	DBG_ENTER( DbgInfo );
+
+	if( urq->hcfCtx == &( lp->hcfCtx )) {
+		if( capable( CAP_NET_ADMIN )) {
+			if (lp->flags & WVLAN2_UIL_BUSY) {
+				lp->flags &= ~WVLAN2_UIL_BUSY;
+				netif_wake_queue(lp->dev);
+				WL_WDS_NETIF_WAKE_QUEUE( lp );
+			}
+		} else {
+			DBG_ERROR( DbgInfo, "EPERM\n" );
+			urq->result = UIL_FAILURE;
+			result = -EPERM;
+		}
+	} else {
+		DBG_ERROR( DbgInfo, "UIL_ERR_WRONG_IFB\n" );
+		urq->result = UIL_ERR_WRONG_IFB;
+	}
+
+	DBG_LEAVE( DbgInfo );
+	return result;
+} // wvlan_uil_unblock
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wvlan_uil_send_diag_msg()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Sends a diagnostic message to the card.
+ *
+ *  PARAMETERS:
+ *
+ *      urq - a pointer to the UIL request buffer
+ *      lp  - a pointer to the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      UIL_SUCCESS
+ *      UIL_ERR_xxx value otherwise
+ *
+ ******************************************************************************/
+int wvlan_uil_send_diag_msg( struct uilreq *urq, struct wl_private *lp )
+{
+	int         result = 0;
+	DESC_STRCT  Descp[1];
+	/*------------------------------------------------------------------------*/
+
+
+	DBG_FUNC( "wvlan_uil_send_diag_msg" );
+	DBG_ENTER( DbgInfo );
+
+	if( urq->hcfCtx == &( lp->hcfCtx )) {
+		if( capable( CAP_NET_ADMIN )) {
+			if ((urq->data != NULL) && (urq->len != 0)) {
+				if (lp->hcfCtx.IFB_RscInd != 0) {
+					u_char *data;
+
+					// Verify the user buffer
+					result = verify_area(VERIFY_READ, urq->data, urq->len);
+					if (result != 0) {
+						DBG_ERROR( DbgInfo, "verify_area failed, result: %d\n", result );
+						urq->result = UIL_FAILURE;
+						DBG_LEAVE( DbgInfo );
+						return result;
+					}
+
+					if ((data = kmalloc(urq->len, GFP_KERNEL)) != NULL) {
+						memset( Descp, 0, sizeof( DESC_STRCT ));
+						memcpy( data, urq->data, urq->len );
+
+						Descp[0].buf_addr       = (wci_bufp)data;
+						Descp[0].BUF_CNT        = urq->len;
+						Descp[0].next_desc_addr = 0;    // terminate list
+
+						hcf_send_msg( &(lp->hcfCtx),  &Descp[0], HCF_PORT_0 );
+						kfree( data );
+					} else {
+						DBG_ERROR( DbgInfo, "ENOMEM\n" );
+						urq->result = UIL_FAILURE;
+						result = -ENOMEM;
+						DBG_LEAVE( DbgInfo );
+						return result;
+					}
+
+				} else {
+					urq->result = UIL_ERR_BUSY;
+				}
+
+			} else {
+				urq->result = UIL_FAILURE;
+			}
+		} else {
+			DBG_ERROR( DbgInfo, "EPERM\n" );
+			urq->result = UIL_FAILURE;
+			result = -EPERM;
+		}
+	} else {
+		DBG_ERROR( DbgInfo, "UIL_ERR_WRONG_IFB\n" );
+		urq->result = UIL_ERR_WRONG_IFB;
+	}
+
+	DBG_LEAVE( DbgInfo );
+	return result;
+} // wvlan_uil_send_diag_msg
+/*============================================================================*/
+
+
+/*******************************************************************************
+ *	wvlan_uil_put_info()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Sends a specific RID directly to the driver to set configuration info.
+ *
+ *  PARAMETERS:
+ *
+ *      urq - a pointer to the UIL request buffer
+ *      lp  - a pointer to the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      UIL_SUCCESS
+ *      UIL_ERR_xxx value otherwise
+ *
+ ******************************************************************************/
+int wvlan_uil_put_info( struct uilreq *urq, struct wl_private *lp )
+{
+	int                     result = 0;
+	ltv_t                   *pLtv;
+	bool_t                  ltvAllocated = FALSE;
+	ENCSTRCT                sEncryption;
+
+#ifdef USE_WDS
+	hcf_16                  hcfPort  = HCF_PORT_0;
+#endif  /* USE_WDS */
+	/*------------------------------------------------------------------------*/
+	DBG_FUNC( "wvlan_uil_put_info" );
+	DBG_ENTER( DbgInfo );
+
+
+	if( urq->hcfCtx == &( lp->hcfCtx )) {
+		if( capable( CAP_NET_ADMIN )) {
+			if(( urq->data != NULL ) && ( urq->len != 0 )) {
+				/* Make sure that we have at least a command and length to send. */
+				if( urq->len < ( sizeof( hcf_16 ) * 2 )) {
+					urq->len = sizeof( lp->ltvRecord );
+					urq->result = UIL_ERR_LEN;
+					DBG_ERROR( DbgInfo, "No Length/Type in LTV!!!\n" );
+					DBG_ERROR( DbgInfo, "UIL_ERR_LEN\n" );
+					DBG_LEAVE( DbgInfo );
+					return result;
+				}
+
+				/* Verify the user buffer */
+				result = verify_area( VERIFY_READ, urq->data, urq->len );
+				if( result != 0 ) {
+					urq->result = UIL_FAILURE;
+					DBG_ERROR( DbgInfo, "verify_area(), VERIFY_READ FAILED\n" );
+					DBG_LEAVE( DbgInfo );
+					return result;
+				}
+
+				/* Get only the command and length information. */
+				copy_from_user( &( lp->ltvRecord ), urq->data, sizeof( hcf_16 ) * 2 );
+
+				/* Make sure the incoming LTV record length is within the bounds of the
+				   IOCTL length */
+				if((( lp->ltvRecord.len + 1 ) * sizeof( hcf_16 )) > urq->len ) {
+					urq->len = sizeof( lp->ltvRecord );
+					urq->result = UIL_ERR_LEN;
+					DBG_ERROR( DbgInfo, "UIL_ERR_LEN\n" );
+					DBG_LEAVE( DbgInfo );
+					return result;
+				}
+
+				/* If the requested length is greater than the size of our local
+				   LTV record, try to allocate it from the kernel stack.
+				   Otherwise, we just use our local LTV record. */
+				if( urq->len > sizeof( lp->ltvRecord )) {
+					if(( pLtv = (ltv_t *)kmalloc( urq->len, GFP_KERNEL )) != NULL ) {
+						ltvAllocated = TRUE;
+					} else {
+						DBG_ERROR( DbgInfo, "Alloc FAILED\n" );
+						urq->len = sizeof( lp->ltvRecord );
+						urq->result = UIL_ERR_LEN;
+						result = -ENOMEM;
+						DBG_LEAVE( DbgInfo );
+						return result;
+					}
+				} else {
+					pLtv = &( lp->ltvRecord );
+				}
+
+				/* Copy the data from the user's buffer into the local LTV
+				   record data area. */
+				copy_from_user( pLtv, urq->data, urq->len );
+
+
+				/* We need to snoop the commands to see if there is anything we
+				   need to store for the purposes of a reset or start/stop
+				   sequence. Perform endian translation as needed */
+				switch( pLtv->typ ) {
+				case CFG_CNF_PORT_TYPE:
+					lp->PortType    = pLtv->u.u16[0];
+					pLtv->u.u16[0]  = CNV_INT_TO_LITTLE( pLtv->u.u16[0] );
+					break;
+				case CFG_CNF_OWN_MAC_ADDR:
+					/* TODO: determine if we are going to store anything based on this */
+					break;
+				case CFG_CNF_OWN_CHANNEL:
+					lp->Channel     = pLtv->u.u16[0];
+					pLtv->u.u16[0]  = CNV_INT_TO_LITTLE( pLtv->u.u16[0] );
+					break;
+				/* CFG_CNF_OWN_SSID currently same as CNF_DESIRED_SSID. Do we
+				   need seperate storage for this? */
+				//case CFG_CNF_OWN_SSID:
+				case CFG_CNF_OWN_ATIM_WINDOW:
+					lp->atimWindow  = pLtv->u.u16[0];
+					pLtv->u.u16[0]  = CNV_INT_TO_LITTLE( pLtv->u.u16[0] );
+					break;
+				case CFG_CNF_SYSTEM_SCALE:
+					lp->DistanceBetweenAPs  = pLtv->u.u16[0];
+					pLtv->u.u16[0]          = CNV_INT_TO_LITTLE( pLtv->u.u16[0] );
+
+				case CFG_CNF_MAX_DATA_LEN:
+					/* TODO: determine if we are going to store anything based
+					   on this */
+					break;
+				case CFG_CNF_PM_ENABLED:
+					lp->PMEnabled   = pLtv->u.u16[0];
+					pLtv->u.u16[0]  = CNV_INT_TO_LITTLE( pLtv->u.u16[0] );
+					break;
+				case CFG_CNF_MCAST_RX:
+					lp->MulticastReceive    = pLtv->u.u16[0];
+					pLtv->u.u16[0]          = CNV_INT_TO_LITTLE( pLtv->u.u16[0] );
+					break;
+				case CFG_CNF_MAX_SLEEP_DURATION:
+					lp->MaxSleepDuration    = pLtv->u.u16[0];
+					pLtv->u.u16[0]          = CNV_INT_TO_LITTLE( pLtv->u.u16[0] );
+					break;
+				case CFG_CNF_HOLDOVER_DURATION:
+					lp->holdoverDuration    = pLtv->u.u16[0];
+					pLtv->u.u16[0]          = CNV_INT_TO_LITTLE( pLtv->u.u16[0] );
+					break;
+				case CFG_CNF_OWN_NAME:
+					memset( lp->StationName, 0, sizeof( lp->StationName ));
+					memcpy( (void *)lp->StationName, (void *)&pLtv->u.u8[2], (size_t)pLtv->u.u16[0]);
+					pLtv->u.u16[0] = CNV_INT_TO_LITTLE( pLtv->u.u16[0] );
+					break;
+				case CFG_CNF_LOAD_BALANCING:
+					lp->loadBalancing       = pLtv->u.u16[0];
+					pLtv->u.u16[0]          = CNV_INT_TO_LITTLE( pLtv->u.u16[0] );
+					break;
+				case CFG_CNF_MEDIUM_DISTRIBUTION:
+					lp->mediumDistribution  = pLtv->u.u16[0];
+					pLtv->u.u16[0]          = CNV_INT_TO_LITTLE( pLtv->u.u16[0] );
+					break;
+#ifdef WARP
+				case CFG_CNF_TX_POW_LVL:
+					lp->txPowLevel          = pLtv->u.u16[0];
+					pLtv->u.u16[0]          = CNV_INT_TO_LITTLE( pLtv->u.u16[0] );
+					break;
+				//case CFG_CNF_SHORT_RETRY_LIMIT:    // Short Retry Limit
+				//case 0xFC33:    // Long Retry Limit
+				case CFG_SUPPORTED_RATE_SET_CNTL:        // Supported Rate Set Control
+					lp->srsc[0]             = pLtv->u.u16[0];
+					lp->srsc[1]             = pLtv->u.u16[1];
+					pLtv->u.u16[0]          = CNV_INT_TO_LITTLE( pLtv->u.u16[0] );
+					pLtv->u.u16[1]          = CNV_INT_TO_LITTLE( pLtv->u.u16[1] );
+					break;
+				case CFG_BASIC_RATE_SET_CNTL:        // Basic Rate Set Control
+					lp->brsc[0]             = pLtv->u.u16[0];
+					lp->brsc[1]             = pLtv->u.u16[1];
+					pLtv->u.u16[0]          = CNV_INT_TO_LITTLE( pLtv->u.u16[0] );
+					pLtv->u.u16[1]          = CNV_INT_TO_LITTLE( pLtv->u.u16[1] );
+					break;
+				case CFG_CNF_CONNECTION_CNTL:
+					lp->connectionControl   = pLtv->u.u16[0];
+					pLtv->u.u16[0]          = CNV_INT_TO_LITTLE( pLtv->u.u16[0] );
+					break;
+				//case CFG_PROBE_DATA_RATE:
+#endif  // HERMES25
+
+#if 1 //;? (HCF_TYPE) & HCF_TYPE_AP
+		//;?should we restore this to allow smaller memory footprint
+
+				case CFG_CNF_OWN_DTIM_PERIOD:
+					lp->DTIMPeriod  = pLtv->u.u16[0];
+					pLtv->u.u16[0]  = CNV_INT_TO_LITTLE( pLtv->u.u16[0] );
+					break;
+#ifdef WARP
+				case CFG_CNF_OWN_BEACON_INTERVAL:        // Own Beacon Interval
+					lp->ownBeaconInterval   = pLtv->u.u16[0];
+					pLtv->u.u16[0]          = CNV_INT_TO_LITTLE( pLtv->u.u16[0] );
+					break;
+#endif // WARP
+				case CFG_COEXISTENSE_BEHAVIOUR:         // Coexistence behavior
+					lp->coexistence         = pLtv->u.u16[0];
+					pLtv->u.u16[0]          = CNV_INT_TO_LITTLE( pLtv->u.u16[0] );
+					break;
+#ifdef USE_WDS
+				case CFG_CNF_WDS_ADDR1:
+					memcpy( &lp->wds_port[0].wdsAddress, &pLtv->u.u8[0], ETH_ALEN );
+					hcfPort = HCF_PORT_1;
+					break;
+				case CFG_CNF_WDS_ADDR2:
+					memcpy( &lp->wds_port[1].wdsAddress, &pLtv->u.u8[0], ETH_ALEN );
+					hcfPort = HCF_PORT_2;
+					break;
+				case CFG_CNF_WDS_ADDR3:
+					memcpy( &lp->wds_port[2].wdsAddress, &pLtv->u.u8[0], ETH_ALEN );
+					hcfPort = HCF_PORT_3;
+					break;
+				case CFG_CNF_WDS_ADDR4:
+					memcpy( &lp->wds_port[3].wdsAddress, &pLtv->u.u8[0], ETH_ALEN );
+					hcfPort = HCF_PORT_4;
+					break;
+				case CFG_CNF_WDS_ADDR5:
+					memcpy( &lp->wds_port[4].wdsAddress, &pLtv->u.u8[0], ETH_ALEN );
+					hcfPort = HCF_PORT_5;
+					break;
+				case CFG_CNF_WDS_ADDR6:
+					memcpy( &lp->wds_port[5].wdsAddress, &pLtv->u.u8[0], ETH_ALEN );
+					hcfPort = HCF_PORT_6;
+					break;
+#endif  /* USE_WDS */
+
+				case CFG_CNF_MCAST_PM_BUF:
+					lp->multicastPMBuffering    = pLtv->u.u16[0];
+					pLtv->u.u16[0]              = CNV_INT_TO_LITTLE( pLtv->u.u16[0] );
+					break;
+				case CFG_CNF_REJECT_ANY:
+					lp->RejectAny   = pLtv->u.u16[0];
+					pLtv->u.u16[0]  = CNV_INT_TO_LITTLE( pLtv->u.u16[0] );
+					break;
+#endif
+
+				case CFG_CNF_ENCRYPTION:
+					lp->EnableEncryption    = pLtv->u.u16[0];
+					pLtv->u.u16[0]          = CNV_INT_TO_LITTLE( pLtv->u.u16[0] );
+					break;
+				case CFG_CNF_AUTHENTICATION:
+					lp->authentication  = pLtv->u.u16[0];
+					pLtv->u.u16[0]      = CNV_INT_TO_LITTLE( pLtv->u.u16[0] );
+					break;
+#if 1 //;? (HCF_TYPE) & HCF_TYPE_AP
+		//;?should we restore this to allow smaller memory footprint
+
+				//case CFG_CNF_EXCL_UNENCRYPTED:
+					//lp->ExcludeUnencrypted  = pLtv->u.u16[0];
+					//pLtv->u.u16[0]          = CNV_INT_TO_LITTLE( pLtv->u.u16[0] );
+					//break;
+				case CFG_CNF_MCAST_RATE:
+					/* TODO: determine if we are going to store anything based on this */
+					break;
+				case CFG_CNF_INTRA_BSS_RELAY:
+					lp->intraBSSRelay   = pLtv->u.u16[0];
+					pLtv->u.u16[0]      = CNV_INT_TO_LITTLE( pLtv->u.u16[0] );
+					break;
+#endif
+
+				case CFG_CNF_MICRO_WAVE:
+					/* TODO: determine if we are going to store anything based on this */
+					break;
+				//case CFG_CNF_LOAD_BALANCING:
+					/* TODO: determine if we are going to store anything based on this */
+					//break;
+				//case CFG_CNF_MEDIUM_DISTRIBUTION:
+					/* TODO: determine if we are going to store anything based on this */
+					//break;
+				//case CFG_CNF_RX_ALL_GROUP_ADDRESS:
+					// TODO: determine if we are going to store anything based on this
+					//break;
+				//case CFG_CNF_COUNTRY_INFO:
+					/* TODO: determine if we are going to store anything based on this */
+					//break;
+				case CFG_CNF_OWN_SSID:
+				//case CNF_DESIRED_SSID:
+				case CFG_DESIRED_SSID:
+					memset( lp->NetworkName, 0, sizeof( lp->NetworkName ));
+					memcpy( (void *)lp->NetworkName, (void *)&pLtv->u.u8[2], (size_t)pLtv->u.u16[0] );
+					pLtv->u.u16[0] = CNV_INT_TO_LITTLE( pLtv->u.u16[0] );
+
+					/* take care of the special network name "ANY" case */
+					if(( strlen( &pLtv->u.u8[2]        ) == 0 ) ||
+					   ( strcmp( &pLtv->u.u8[2], "ANY" ) == 0 ) ||
+					   ( strcmp( &pLtv->u.u8[2], "any" ) == 0 )) {
+						/* set the SSID_STRCT llen field (u16[0]) to zero, and the
+						effectually null the string u8[2] */
+						pLtv->u.u16[0] = 0;
+						pLtv->u.u8[2]  = 0;
+					}
+					break;
+				case CFG_GROUP_ADDR:
+					/* TODO: determine if we are going to store anything based on this */
+					break;
+				case CFG_CREATE_IBSS:
+					lp->CreateIBSS  = pLtv->u.u16[0];
+					pLtv->u.u16[0]  = CNV_INT_TO_LITTLE( pLtv->u.u16[0] );
+					break;
+				case CFG_RTS_THRH:
+					lp->RTSThreshold    = pLtv->u.u16[0];
+					pLtv->u.u16[0]      = CNV_INT_TO_LITTLE( pLtv->u.u16[0] );
+					break;
+				case CFG_TX_RATE_CNTL:
+					lp->TxRateControl[0]    = pLtv->u.u16[0];
+					lp->TxRateControl[1]    = pLtv->u.u16[1];
+					pLtv->u.u16[0]          = CNV_INT_TO_LITTLE( pLtv->u.u16[0] );
+					pLtv->u.u16[1]          = CNV_INT_TO_LITTLE( pLtv->u.u16[1] );
+					break;
+				case CFG_PROMISCUOUS_MODE:
+					/* TODO: determine if we are going to store anything based on this */
+					break;
+				//case CFG_WAKE_ON_LAN:
+					/* TODO: determine if we are going to store anything based on this */
+					//break;
+#if 1 //;? #if (HCF_TYPE) & HCF_TYPE_AP
+		//;?should we restore this to allow smaller memory footprint
+				case CFG_RTS_THRH0:
+					lp->RTSThreshold    = pLtv->u.u16[0];
+					pLtv->u.u16[0]      = CNV_INT_TO_LITTLE( pLtv->u.u16[0] );
+					break;
+				case CFG_TX_RATE_CNTL0:
+//;?no idea what this should be, get going so comment it out					lp->TxRateControl   = pLtv->u.u16[0];
+					pLtv->u.u16[0]      = CNV_INT_TO_LITTLE( pLtv->u.u16[0] );
+					break;
+#ifdef USE_WDS
+				case CFG_RTS_THRH1:
+					lp->wds_port[0].rtsThreshold    = pLtv->u.u16[0];
+					pLtv->u.u16[0]                  = CNV_INT_TO_LITTLE( pLtv->u.u16[0] );
+					hcfPort                         = HCF_PORT_1;
+					break;
+				case CFG_RTS_THRH2:
+					lp->wds_port[1].rtsThreshold    = pLtv->u.u16[0];
+					pLtv->u.u16[0]                  = CNV_INT_TO_LITTLE( pLtv->u.u16[0] );
+					hcfPort                         = HCF_PORT_2;
+					break;
+				case CFG_RTS_THRH3:
+					lp->wds_port[2].rtsThreshold    = pLtv->u.u16[0];
+					pLtv->u.u16[0]                  = CNV_INT_TO_LITTLE( pLtv->u.u16[0] );
+					hcfPort                         = HCF_PORT_3;
+					break;
+				case CFG_RTS_THRH4:
+					lp->wds_port[3].rtsThreshold    = pLtv->u.u16[0];
+					pLtv->u.u16[0]                  = CNV_INT_TO_LITTLE( pLtv->u.u16[0] );
+					hcfPort                         = HCF_PORT_4;
+					break;
+				case CFG_RTS_THRH5:
+					lp->wds_port[4].rtsThreshold    = pLtv->u.u16[0];
+					pLtv->u.u16[0]                  = CNV_INT_TO_LITTLE( pLtv->u.u16[0] );
+					hcfPort                         = HCF_PORT_5;
+					break;
+				case CFG_RTS_THRH6:
+					lp->wds_port[5].rtsThreshold    = pLtv->u.u16[0];
+					pLtv->u.u16[0]                  = CNV_INT_TO_LITTLE( pLtv->u.u16[0] );
+					hcfPort                         = HCF_PORT_6;
+					break;
+				case CFG_TX_RATE_CNTL1:
+					lp->wds_port[0].txRateCntl  = pLtv->u.u16[0];
+					pLtv->u.u16[0]              = CNV_INT_TO_LITTLE( pLtv->u.u16[0] );
+					hcfPort                     = HCF_PORT_1;
+					break;
+				case CFG_TX_RATE_CNTL2:
+					lp->wds_port[1].txRateCntl  = pLtv->u.u16[0];
+					pLtv->u.u16[0]              = CNV_INT_TO_LITTLE( pLtv->u.u16[0] );
+					hcfPort                     = HCF_PORT_2;
+					break;
+				case CFG_TX_RATE_CNTL3:
+					lp->wds_port[2].txRateCntl  = pLtv->u.u16[0];
+					pLtv->u.u16[0]              = CNV_INT_TO_LITTLE( pLtv->u.u16[0] );
+					hcfPort                     = HCF_PORT_3;
+					break;
+				case CFG_TX_RATE_CNTL4:
+					lp->wds_port[3].txRateCntl  = pLtv->u.u16[0];
+					pLtv->u.u16[0]              = CNV_INT_TO_LITTLE( pLtv->u.u16[0] );
+					hcfPort                     = HCF_PORT_4;
+					break;
+				case CFG_TX_RATE_CNTL5:
+					lp->wds_port[4].txRateCntl  = pLtv->u.u16[0];
+					pLtv->u.u16[0]              = CNV_INT_TO_LITTLE( pLtv->u.u16[0] );
+					hcfPort                     = HCF_PORT_5;
+					break;
+				case CFG_TX_RATE_CNTL6:
+					lp->wds_port[5].txRateCntl  = pLtv->u.u16[0];
+					pLtv->u.u16[0]              = CNV_INT_TO_LITTLE( pLtv->u.u16[0] );
+					hcfPort                     = HCF_PORT_6;
+					break;
+#endif  /* USE_WDS */
+#endif  /* (HCF_TYPE) & HCF_TYPE_AP */
+
+				case CFG_DEFAULT_KEYS:
+					{
+						CFG_DEFAULT_KEYS_STRCT *pKeys = (CFG_DEFAULT_KEYS_STRCT *)pLtv;
+
+						pKeys->key[0].len = CNV_INT_TO_LITTLE( pKeys->key[0].len );
+						pKeys->key[1].len = CNV_INT_TO_LITTLE( pKeys->key[1].len );
+						pKeys->key[2].len = CNV_INT_TO_LITTLE( pKeys->key[2].len );
+						pKeys->key[3].len = CNV_INT_TO_LITTLE( pKeys->key[3].len );
+
+						memcpy( (void *)&(lp->DefaultKeys), (void *)pKeys,
+								sizeof( CFG_DEFAULT_KEYS_STRCT ));
+					}
+					break;
+				case CFG_TX_KEY_ID:
+					lp->TransmitKeyID   = pLtv->u.u16[0];
+					pLtv->u.u16[0]      = CNV_INT_TO_LITTLE( pLtv->u.u16[0] );
+					break;
+				case CFG_SCAN_SSID:
+					/* TODO: determine if we are going to store anything based on this */
+					break;
+				case CFG_TICK_TIME:
+					/* TODO: determine if we are going to store anything based on this */
+					break;
+				/* these RIDS are Info RIDs, and should they be allowed for puts??? */
+				case CFG_MAX_LOAD_TIME:
+				case CFG_DL_BUF:
+				//case CFG_HSI_SUP_RANGE:
+				case CFG_NIC_SERIAL_NUMBER:
+				case CFG_NIC_IDENTITY:
+				case CFG_NIC_MFI_SUP_RANGE:
+				case CFG_NIC_CFI_SUP_RANGE:
+				case CFG_NIC_TEMP_TYPE:
+				case CFG_NIC_PROFILE:
+				case CFG_FW_IDENTITY:
+				case CFG_FW_SUP_RANGE:
+				case CFG_MFI_ACT_RANGES_STA:
+				case CFG_CFI_ACT_RANGES_STA:
+				case CFG_PORT_STAT:
+				case CFG_CUR_SSID:
+				case CFG_CUR_BSSID:
+				case CFG_COMMS_QUALITY:
+				case CFG_CUR_TX_RATE:
+				case CFG_CUR_BEACON_INTERVAL:
+				case CFG_CUR_SCALE_THRH:
+				case CFG_PROTOCOL_RSP_TIME:
+				case CFG_CUR_SHORT_RETRY_LIMIT:
+				case CFG_CUR_LONG_RETRY_LIMIT:
+				case CFG_MAX_TX_LIFETIME:
+				case CFG_MAX_RX_LIFETIME:
+				case CFG_CF_POLLABLE:
+				case CFG_AUTHENTICATION_ALGORITHMS:
+				case CFG_PRIVACY_OPT_IMPLEMENTED:
+				//case CFG_CURRENT_REMOTE_RATES:
+				//case CFG_CURRENT_USED_RATES:
+				//case CFG_CURRENT_SYSTEM_SCALE:
+				//case CFG_CURRENT_TX_RATE1:
+				//case CFG_CURRENT_TX_RATE2:
+				//case CFG_CURRENT_TX_RATE3:
+				//case CFG_CURRENT_TX_RATE4:
+				//case CFG_CURRENT_TX_RATE5:
+				//case CFG_CURRENT_TX_RATE6:
+				case CFG_NIC_MAC_ADDR:
+				case CFG_PCF_INFO:
+				//case CFG_CURRENT_COUNTRY_INFO:
+				case CFG_PHY_TYPE:
+				case CFG_CUR_CHANNEL:
+				//case CFG_CURRENT_POWER_STATE:
+				//case CFG_CCAMODE:
+				case CFG_SUPPORTED_DATA_RATES:
+					break;
+				case CFG_AP_MODE:
+//;?				lp->DownloadFirmware = ( pLtv->u.u16[0] ) + 1;
+					DBG_ERROR( DbgInfo, "set CFG_AP_MODE no longer supported\n" );
+					break;
+				case CFG_ENCRYPT_STRING:
+					/* TODO: ENDIAN TRANSLATION HERE??? */
+					memset( lp->szEncryption, 0, sizeof( lp->szEncryption ));
+					memcpy( (void *)lp->szEncryption,  (void *)&pLtv->u.u8[0],
+							( pLtv->len * sizeof( hcf_16 )) );
+					wl_wep_decode( CRYPT_CODE, &sEncryption,
+								    lp->szEncryption );
+
+					/* the Linux driver likes to use 1-4 for the key IDs, and then
+					convert to 0-3 when sending to the card.  The Windows code
+					base used 0-3 in the API DLL, which was ported to Linux.  For
+					the sake of the user experience, we decided to keep 0-3 as the
+					numbers used in the DLL; and will perform the +1 conversion here.
+					We could have converted  the entire Linux driver, but this is
+					less obtrusive.  This may be a "todo" to convert the whole driver */
+					lp->TransmitKeyID    = sEncryption.wTxKeyID + 1;
+					lp->EnableEncryption = sEncryption.wEnabled;
+
+					memcpy( &lp->DefaultKeys, &sEncryption.EncStr,
+							sizeof( CFG_DEFAULT_KEYS_STRCT ));
+					break;
+				/*case CFG_COUNTRY_STRING:
+					memset( lp->countryString, 0, sizeof( lp->countryString ));
+					memcpy( (void *)lp->countryString, (void *)&pLtv->u.u8[2], (size_t)pLtv->u.u16[0]);
+					break;
+				*/
+
+				case CFG_DRIVER_ENABLE:
+					lp->driverEnable    = pLtv->u.u16[0];
+					pLtv->u.u16[0]      = CNV_INT_TO_LITTLE( pLtv->u.u16[0] );
+					break;
+				case CFG_WOLAS_ENABLE:
+					lp->wolasEnable = pLtv->u.u16[0];
+					pLtv->u.u16[0]  = CNV_INT_TO_LITTLE( pLtv->u.u16[0] );
+					break;
+				case CFG_SET_WPA_AUTH_KEY_MGMT_SUITE:
+					lp->AuthKeyMgmtSuite = pLtv->u.u16[0];
+					pLtv->u.u16[0]  = CNV_INT_TO_LITTLE( pLtv->u.u16[0] );
+					break;
+				case CFG_DISASSOCIATE_ADDR:
+					pLtv->u.u16[ETH_ALEN / 2] = CNV_INT_TO_LITTLE( pLtv->u.u16[ETH_ALEN / 2] );
+					break;
+				case CFG_ADD_TKIP_DEFAULT_KEY:
+				case CFG_REMOVE_TKIP_DEFAULT_KEY:
+					/* Endian convert the Tx Key Information */
+					pLtv->u.u16[0] = CNV_INT_TO_LITTLE( pLtv->u.u16[0] );
+					break;
+				case CFG_ADD_TKIP_MAPPED_KEY:
+					break;
+				case CFG_REMOVE_TKIP_MAPPED_KEY:
+					break;
+				/* some RIDs just can't be put */
+				case CFG_MB_INFO:
+				case CFG_IFB:
+				default:
+					break;
+				}
+
+				/* This code will prevent Static Configuration Entities from
+				   being sent to the card, as they require a call to
+				   UIL_ACT_APPLY to take effect. Dynamic Entities will be sent
+				   immediately */
+				switch( pLtv->typ ) {
+				case CFG_CNF_PORT_TYPE:
+				case CFG_CNF_OWN_MAC_ADDR:
+				case CFG_CNF_OWN_CHANNEL:
+				case CFG_CNF_OWN_SSID:
+				case CFG_CNF_OWN_ATIM_WINDOW:
+				case CFG_CNF_SYSTEM_SCALE:
+				case CFG_CNF_MAX_DATA_LEN:
+				case CFG_CNF_PM_ENABLED:
+				case CFG_CNF_MCAST_RX:
+				case CFG_CNF_MAX_SLEEP_DURATION:
+				case CFG_CNF_HOLDOVER_DURATION:
+				case CFG_CNF_OWN_NAME:
+				case CFG_CNF_LOAD_BALANCING:
+				case CFG_CNF_MEDIUM_DISTRIBUTION:
+#ifdef WARP
+				case CFG_CNF_TX_POW_LVL:
+				case CFG_CNF_CONNECTION_CNTL:
+				//case CFG_PROBE_DATA_RATE:
+#endif // HERMES25
+#if 1 //;? (HCF_TYPE) & HCF_TYPE_AP
+		//;?should we restore this to allow smaller memory footprint
+				case CFG_CNF_OWN_DTIM_PERIOD:
+#ifdef WARP
+				case CFG_CNF_OWN_BEACON_INTERVAL:                    // Own Beacon Interval
+#endif // WARP
+#ifdef USE_WDS
+				case CFG_CNF_WDS_ADDR1:
+				case CFG_CNF_WDS_ADDR2:
+				case CFG_CNF_WDS_ADDR3:
+				case CFG_CNF_WDS_ADDR4:
+				case CFG_CNF_WDS_ADDR5:
+				case CFG_CNF_WDS_ADDR6:
+#endif
+				case CFG_CNF_MCAST_PM_BUF:
+				case CFG_CNF_REJECT_ANY:
+#endif
+
+				case CFG_CNF_ENCRYPTION:
+				case CFG_CNF_AUTHENTICATION:
+#if 1 //;? (HCF_TYPE) & HCF_TYPE_AP
+		//;?should we restore this to allow smaller memory footprint
+
+				case CFG_CNF_EXCL_UNENCRYPTED:
+				case CFG_CNF_MCAST_RATE:
+				case CFG_CNF_INTRA_BSS_RELAY:
+#endif
+
+				case CFG_CNF_MICRO_WAVE:
+				//case CFG_CNF_LOAD_BALANCING:
+				//case CFG_CNF_MEDIUM_DISTRIBUTION:
+				//case CFG_CNF_RX_ALL_GROUP_ADDRESS:
+				//case CFG_CNF_COUNTRY_INFO:
+				//case CFG_COUNTRY_STRING:
+				case CFG_AP_MODE:
+				case CFG_ENCRYPT_STRING:
+				//case CFG_DRIVER_ENABLE:
+				case CFG_WOLAS_ENABLE:
+				case CFG_MB_INFO:
+				case CFG_IFB:
+					break;
+				/* Deal with this dynamic MSF RID, as it's required for WPA */
+				case CFG_DRIVER_ENABLE:
+					if( lp->driverEnable ) {
+						//hcf_cntl_port( &( lp->hcfCtx ),
+						//               HCF_PORT_ENABLE | HCF_PORT_0 );
+						// //hcf_cntl( &( lp->hcfCtx ),
+						// //         HCF_PORT_ENABLE | HCF_PORT_0 );
+						//hcf_cntl( &( lp->hcfCtx ), HCF_CNTL_ENABLE );
+						// //hcf_cntl( &( lp->hcfCtx ), HCF_CNTL_CONNECT );
+
+						hcf_cntl( &( lp->hcfCtx ), HCF_CNTL_ENABLE | HCF_PORT_0 );
+						hcf_cntl( &( lp->hcfCtx ), HCF_CNTL_CONNECT );
+					} else {
+						//hcf_cntl_port( &( lp->hcfCtx ),
+						//               HCF_PORT_DISABLE | HCF_PORT_0 );
+						// //hcf_cntl( &( lp->hcfCtx ),
+						// //         HCF_PORT_DISABLE | HCF_PORT_0 );
+						//hcf_cntl( &( lp->hcfCtx ), HCF_CNTL_DISABLE );
+						// //hcf_cntl( &( lp->hcfCtx ), HCF_CNTL_DISCONNECT );
+
+						hcf_cntl( &( lp->hcfCtx ), HCF_CNTL_DISABLE | HCF_PORT_0 );
+						hcf_cntl( &( lp->hcfCtx ), HCF_CNTL_DISCONNECT );
+					}
+					break;
+				default:
+    					wl_act_int_off( lp );
+					urq->result = hcf_put_info(&(lp->hcfCtx), (LTVP) pLtv);
+    					wl_act_int_on( lp );
+					break;
+				}
+
+				if( ltvAllocated ) {
+					kfree( pLtv );
+				}
+			} else {
+				urq->result = UIL_FAILURE;
+			}
+		} else {
+			DBG_ERROR( DbgInfo, "EPERM\n" );
+			urq->result = UIL_FAILURE;
+			result = -EPERM;
+		}
+	} else {
+		DBG_ERROR( DbgInfo, "UIL_ERR_WRONG_IFB\n" );
+		urq->result = UIL_ERR_WRONG_IFB;
+	}
+
+	DBG_LEAVE( DbgInfo );
+	return result;
+} // wvlan_uil_put_info
+/*============================================================================*/
+
+/*******************************************************************************
+ *	wvlan_uil_get_info()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Sends a specific RID directly to the driver to retrieve configuration
+ *      info.
+ *
+ *  PARAMETERS:
+ *
+ *      urq - a pointer to the UIL request buffer
+ *      lp  - a pointer to the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      UIL_SUCCESS
+ *      UIL_ERR_xxx value otherwise
+ *
+ ******************************************************************************/
+int wvlan_uil_get_info( struct uilreq *urq, struct wl_private *lp )
+{
+	int result = 0;
+	int i;
+	/*------------------------------------------------------------------------*/
+
+	DBG_FUNC( "wvlan_uil_get_info" );
+	DBG_ENTER( DbgInfo );
+
+	if( urq->hcfCtx == &( lp->hcfCtx )) {
+		if(( urq->data != NULL ) && ( urq->len != 0 )) {
+			ltv_t      *pLtv;
+			bool_t      ltvAllocated = FALSE;
+
+			/* Make sure that we have at least a command and length */
+			if( urq->len < ( sizeof( hcf_16 ) * 2 )) {
+				urq->len = sizeof( lp->ltvRecord );
+				DBG_ERROR( DbgInfo, "No Length/Type in LTV!!!\n" );
+				DBG_ERROR( DbgInfo, "UIL_ERR_LEN\n" );
+				urq->result = UIL_ERR_LEN;
+				DBG_LEAVE( DbgInfo );
+				return result;
+			}
+
+			/* Verify the user's LTV record header. */
+			result = verify_area( VERIFY_READ, urq->data, sizeof( hcf_16 ) * 2 );
+			if( result != 0 ) {
+				DBG_ERROR( DbgInfo, "verify_area(), VERIFY_READ FAILED\n" );
+				urq->result = UIL_FAILURE;
+				DBG_LEAVE( DbgInfo );
+				return result;
+			}
+
+			/* Get only the command and length information. */
+			result = copy_from_user( &( lp->ltvRecord ), urq->data, sizeof( hcf_16 ) * 2 );
+
+			/* Make sure the incoming LTV record length is within the bounds of
+			   the IOCTL length. */
+			if((( lp->ltvRecord.len + 1 ) * sizeof( hcf_16 )) > urq->len ) {
+				DBG_ERROR( DbgInfo, "Incoming LTV too big\n" );
+				urq->len = sizeof( lp->ltvRecord );
+				urq->result = UIL_ERR_LEN;
+				DBG_LEAVE( DbgInfo );
+				return result;
+			}
+
+			/* Determine if hcf_get_info() is needed or not */
+			switch ( lp->ltvRecord.typ ) {
+			case CFG_NIC_IDENTITY:
+				memcpy( &lp->ltvRecord.u.u8[0], &lp->NICIdentity, sizeof( lp->NICIdentity ));
+				break;
+			case CFG_PRI_IDENTITY:
+				memcpy( &lp->ltvRecord.u.u8[0], &lp->PrimaryIdentity, sizeof( lp->PrimaryIdentity ));
+				break;
+			case CFG_AP_MODE:
+				DBG_ERROR( DbgInfo, "set CFG_AP_MODE no longer supported, so is get useful ????\n" );
+				lp->ltvRecord.u.u16[0] =
+					CNV_INT_TO_LITTLE( lp->hcfCtx.IFB_FWIdentity.comp_id ) == COMP_ID_FW_AP;
+				break;
+			//case CFG_DRV_INFO:
+			case CFG_ENCRYPT_STRING:
+			case CFG_COUNTRY_STRING:
+			case CFG_DRIVER_ENABLE:
+			case CFG_WOLAS_ENABLE:
+				// TODO: determine if we're going to support these
+				urq->result = UIL_FAILURE;
+				break;
+			case CFG_DRV_INFO:
+				DBG_TRACE( DbgInfo, "Intercept CFG_DRV_INFO\n" );
+				result = cfg_driver_info( urq, lp );
+				break;
+			case CFG_DRV_IDENTITY:
+				DBG_TRACE( DbgInfo, "Intercept CFG_DRV_IDENTITY\n" );
+				result = cfg_driver_identity( urq, lp );
+				break;
+			case CFG_IFB:
+				/* IFB can be a security hole */
+				if( !capable( CAP_NET_ADMIN )) {
+					result = -EPERM;
+					break;
+				}
+
+				/* Else fall through to the default */
+
+			case CFG_FW_IDENTITY:   // For Hermes-1, this is cached
+			default:
+
+				/* Verify the user buffer */
+				result = verify_area( VERIFY_WRITE, urq->data, urq->len );
+				if( result != 0 ) {
+					DBG_ERROR( DbgInfo, "verify_area(), VERIFY_WRITE FAILED\n" );
+					urq->result = UIL_FAILURE;
+					break;
+				}
+
+				/* If the requested length is greater than the size of our local
+				   LTV record, try to allocate it from the kernel stack.
+				   Otherwise, we just use our local LTV record. */
+				if( urq->len > sizeof( lp->ltvRecord )) {
+					if(( pLtv = (ltv_t *)kmalloc( urq->len, GFP_KERNEL )) != NULL ) {
+						ltvAllocated = TRUE;
+
+						/* Copy the command/length information into the new buffer. */
+						memcpy( pLtv, &( lp->ltvRecord ), sizeof( hcf_16 ) * 2 );
+					} else {
+						urq->len = sizeof( lp->ltvRecord );
+						urq->result = UIL_ERR_LEN;
+						DBG_ERROR( DbgInfo, "kmalloc FAILED\n" );
+						DBG_ERROR( DbgInfo, "UIL_ERR_LEN\n" );
+						result = -ENOMEM;
+						break;
+					}
+				} else {
+					pLtv = &( lp->ltvRecord );
+				}
+
+    				wl_act_int_off( lp );
+				urq->result = hcf_get_info( &( lp->hcfCtx ), (LTVP) pLtv );
+    				wl_act_int_on( lp );
+
+				// Copy the LTV into the user's buffer.
+				//copy_to_user( urq->data, pLtv, urq->len );
+
+				//if( ltvAllocated )
+				//{
+				//    kfree( pLtv );
+				//}
+
+				//urq->result = UIL_SUCCESS;
+				break;
+			}
+
+			/* Handle endian conversion of special fields */
+			switch( lp->ltvRecord.typ ) {
+			/* simple int gets just need the first hcf_16 byte flipped */
+			case CFG_CNF_PORT_TYPE:
+			case CFG_CNF_OWN_CHANNEL:
+			case CFG_CNF_OWN_ATIM_WINDOW:
+			case CFG_CNF_SYSTEM_SCALE:
+			case CFG_CNF_MAX_DATA_LEN:
+			case CFG_CNF_PM_ENABLED:
+			case CFG_CNF_MCAST_RX:
+			case CFG_CNF_MAX_SLEEP_DURATION:
+			case CFG_CNF_HOLDOVER_DURATION:
+			case CFG_CNF_OWN_DTIM_PERIOD:
+			case CFG_CNF_MCAST_PM_BUF:
+			case CFG_CNF_REJECT_ANY:
+			case CFG_CNF_ENCRYPTION:
+			case CFG_CNF_AUTHENTICATION:
+			case CFG_CNF_EXCL_UNENCRYPTED:
+			case CFG_CNF_INTRA_BSS_RELAY:
+			case CFG_CNF_MICRO_WAVE:
+			case CFG_CNF_LOAD_BALANCING:
+			case CFG_CNF_MEDIUM_DISTRIBUTION:
+#ifdef WARP
+			case CFG_CNF_TX_POW_LVL:
+			case CFG_CNF_CONNECTION_CNTL:
+			case CFG_CNF_OWN_BEACON_INTERVAL:                          // Own Beacon Interval
+			case CFG_COEXISTENSE_BEHAVIOUR:                            // Coexistence Behavior
+			//case CFG_CNF_RX_ALL_GROUP_ADDRESS:
+#endif // HERMES25
+			case CFG_CREATE_IBSS:
+			case CFG_RTS_THRH:
+			case CFG_PROMISCUOUS_MODE:
+			//case CFG_WAKE_ON_LAN:
+			case CFG_RTS_THRH0:
+			case CFG_RTS_THRH1:
+			case CFG_RTS_THRH2:
+			case CFG_RTS_THRH3:
+			case CFG_RTS_THRH4:
+			case CFG_RTS_THRH5:
+			case CFG_RTS_THRH6:
+			case CFG_TX_RATE_CNTL0:
+			case CFG_TX_RATE_CNTL1:
+			case CFG_TX_RATE_CNTL2:
+			case CFG_TX_RATE_CNTL3:
+			case CFG_TX_RATE_CNTL4:
+			case CFG_TX_RATE_CNTL5:
+			case CFG_TX_RATE_CNTL6:
+			case CFG_TX_KEY_ID:
+			case CFG_TICK_TIME:
+			case CFG_MAX_LOAD_TIME:
+			case CFG_NIC_TEMP_TYPE:
+			case CFG_PORT_STAT:
+			case CFG_CUR_TX_RATE:
+			case CFG_CUR_BEACON_INTERVAL:
+			case CFG_PROTOCOL_RSP_TIME:
+			case CFG_CUR_SHORT_RETRY_LIMIT:
+			case CFG_CUR_LONG_RETRY_LIMIT:
+			case CFG_MAX_TX_LIFETIME:
+			case CFG_MAX_RX_LIFETIME:
+			case CFG_CF_POLLABLE:
+			case CFG_PRIVACY_OPT_IMPLEMENTED:
+			//case CFG_CURRENT_REMOTE_RATES:
+			//case CFG_CURRENT_USED_RATES:
+			//case CFG_CURRENT_SYSTEM_SCALE:
+			//case CFG_CURRENT_TX_RATE1:
+			//case CFG_CURRENT_TX_RATE2:
+			//case CFG_CURRENT_TX_RATE3:
+			//case CFG_CURRENT_TX_RATE4:
+			//case CFG_CURRENT_TX_RATE5:
+			//case CFG_CURRENT_TX_RATE6:
+			case CFG_PHY_TYPE:
+			case CFG_CUR_CHANNEL:
+			//case CFG_CURRENT_POWER_STATE:
+			//case CFG_CCAMODE:
+			//    lp->ltvRecord.u.u16[0] = CNV_INT_TO_LITTLE( lp->ltvRecord.u.u16[0] );
+			//    break;
+			/* name string gets just need the first hcf_16 byte flipped (length of string) */
+			case CFG_CNF_OWN_SSID:
+			case CFG_CNF_OWN_NAME:
+			//case CNF_DESIRED_SSID:
+			case CFG_DESIRED_SSID:
+			case CFG_SCAN_SSID:
+			case CFG_CUR_SSID:
+				lp->ltvRecord.u.u16[0] = CNV_INT_TO_LITTLE( lp->ltvRecord.u.u16[0] );
+				break;
+			/* non-length counted strings need no byte flipping */
+			case CFG_CNF_OWN_MAC_ADDR:
+			/* this case is no longer valid: CFG_CNF_WDS_ADDR */
+			case CFG_CNF_WDS_ADDR1:
+			case CFG_CNF_WDS_ADDR2:
+			case CFG_CNF_WDS_ADDR3:
+			case CFG_CNF_WDS_ADDR4:
+			case CFG_CNF_WDS_ADDR5:
+			case CFG_CNF_WDS_ADDR6:
+			case CFG_GROUP_ADDR:
+			case CFG_NIC_SERIAL_NUMBER:
+			case CFG_CUR_BSSID:
+			case CFG_NIC_MAC_ADDR:
+			case CFG_SUPPORTED_DATA_RATES:  /* need to ensure we can treat this as a string */
+				break;
+			//case CFG_CNF_COUNTRY_INFO:      /* special case, see page 75  of 022486, Rev C. */
+			//case CFG_CURRENT_COUNTRY_INFO:  /* special case, see page 101 of 022486, Rev C. */
+			/*
+				lp->ltvRecord.u.u16[0] = CNV_INT_TO_LITTLE( lp->ltvRecord.u.u16[0] );
+				lp->ltvRecord.u.u16[3] = CNV_INT_TO_LITTLE( lp->ltvRecord.u.u16[3] );
+
+				for( i = 4; i < lp->ltvRecord.len; i++ ) {
+					lp->ltvRecord.u.u16[i] = CNV_INT_TO_LITTLE( lp->ltvRecord.u.u16[i] );
+				}
+				break;
+			*/
+
+			case CFG_DEFAULT_KEYS:
+				{
+					CFG_DEFAULT_KEYS_STRCT *pKeys = (CFG_DEFAULT_KEYS_STRCT *)&lp->ltvRecord.u.u8[0];
+
+					pKeys[0].len = CNV_INT_TO_LITTLE( pKeys[0].len );
+					pKeys[1].len = CNV_INT_TO_LITTLE( pKeys[1].len );
+					pKeys[2].len = CNV_INT_TO_LITTLE( pKeys[2].len );
+					pKeys[3].len = CNV_INT_TO_LITTLE( pKeys[3].len );
+				}
+				break;
+			case CFG_CNF_MCAST_RATE:
+			case CFG_TX_RATE_CNTL:
+			case CFG_SUPPORTED_RATE_SET_CNTL:    // Supported Rate Set Control
+			case CFG_BASIC_RATE_SET_CNTL:    // Basic Rate Set Control
+				lp->ltvRecord.u.u16[0] = CNV_INT_TO_LITTLE( lp->ltvRecord.u.u16[0] );
+				lp->ltvRecord.u.u16[1] = CNV_INT_TO_LITTLE( lp->ltvRecord.u.u16[1] );
+				break;
+			case CFG_DL_BUF:
+			case CFG_NIC_IDENTITY:
+			case CFG_COMMS_QUALITY:
+			case CFG_PCF_INFO:
+				lp->ltvRecord.u.u16[0] = CNV_INT_TO_LITTLE( lp->ltvRecord.u.u16[0] );
+				lp->ltvRecord.u.u16[1] = CNV_INT_TO_LITTLE( lp->ltvRecord.u.u16[1] );
+				lp->ltvRecord.u.u16[2] = CNV_INT_TO_LITTLE( lp->ltvRecord.u.u16[2] );
+				break;
+			case CFG_FW_IDENTITY:
+				lp->ltvRecord.u.u16[0] = CNV_INT_TO_LITTLE( lp->ltvRecord.u.u16[0] );
+				lp->ltvRecord.u.u16[1] = CNV_INT_TO_LITTLE( lp->ltvRecord.u.u16[1] );
+				lp->ltvRecord.u.u16[2] = CNV_INT_TO_LITTLE( lp->ltvRecord.u.u16[2] );
+				lp->ltvRecord.u.u16[3] = CNV_INT_TO_LITTLE( lp->ltvRecord.u.u16[3] );
+				break;
+			//case CFG_HSI_SUP_RANGE:
+			case CFG_NIC_MFI_SUP_RANGE:
+			case CFG_NIC_CFI_SUP_RANGE:
+			case CFG_NIC_PROFILE:
+			case CFG_FW_SUP_RANGE:
+				lp->ltvRecord.u.u16[0] = CNV_INT_TO_LITTLE( lp->ltvRecord.u.u16[0] );
+				lp->ltvRecord.u.u16[1] = CNV_INT_TO_LITTLE( lp->ltvRecord.u.u16[1] );
+				lp->ltvRecord.u.u16[2] = CNV_INT_TO_LITTLE( lp->ltvRecord.u.u16[2] );
+				lp->ltvRecord.u.u16[3] = CNV_INT_TO_LITTLE( lp->ltvRecord.u.u16[3] );
+				lp->ltvRecord.u.u16[4] = CNV_INT_TO_LITTLE( lp->ltvRecord.u.u16[4] );
+				break;
+			case CFG_MFI_ACT_RANGES_STA:
+			case CFG_CFI_ACT_RANGES_STA:
+			case CFG_CUR_SCALE_THRH:
+			case CFG_AUTHENTICATION_ALGORITHMS:
+				for( i = 0; i < ( lp->ltvRecord.len - 1 ); i++ ) {
+					lp->ltvRecord.u.u16[i] = CNV_INT_TO_LITTLE( lp->ltvRecord.u.u16[i] );
+				}
+				break;
+			/* done at init time, and endian handled then */
+			case CFG_PRI_IDENTITY:
+				break;
+			case CFG_MB_INFO:
+				//wvlanEndianTranslateMailbox( pLtv );
+				break;
+			/* MSF and HCF RIDS */
+			case CFG_IFB:
+			case CFG_DRV_INFO:
+			case CFG_AP_MODE:
+			case CFG_ENCRYPT_STRING:
+			case CFG_COUNTRY_STRING:
+			case CFG_DRIVER_ENABLE:
+			case CFG_WOLAS_ENABLE:
+			default:
+				break;
+			}
+
+			// Copy the LTV into the user's buffer.
+			copy_to_user( urq->data, &( lp->ltvRecord ), urq->len );
+
+			if( ltvAllocated ) {
+				kfree( &( lp->ltvRecord ));
+			}
+
+			urq->result = UIL_SUCCESS;
+		} else {
+			urq->result = UIL_FAILURE;
+		}
+	} else {
+		DBG_ERROR( DbgInfo, "UIL_ERR_WRONG_IFB\n" );
+		urq->result = UIL_ERR_WRONG_IFB;
+	}
+
+	DBG_LEAVE( DbgInfo );
+	return result;
+} // wvlan_uil_get_info
+/*============================================================================*/
+
+
+
+
+
+/*******************************************************************************
+ *	cfg_driver_info()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Retrieves driver information.
+ *
+ *  PARAMETERS:
+ *
+ *      urq - a pointer to the UIL request buffer
+ *      lp  - a pointer to the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      UIL_SUCCESS
+ *      UIL_ERR_xxx value otherwise
+ *
+ ******************************************************************************/
+int cfg_driver_info( struct uilreq *urq, struct wl_private *lp )
+{
+	int result = 0;
+	/*------------------------------------------------------------------------*/
+
+
+	DBG_FUNC( "cfg_driver_info" );
+	DBG_ENTER( DbgInfo );
+
+
+	/* Make sure that user buffer can handle the driver information buffer */
+	if( urq->len < sizeof( lp->driverInfo )) {
+		urq->len = sizeof( lp->driverInfo );
+		urq->result = UIL_ERR_LEN;
+		DBG_LEAVE( DbgInfo );
+		return result;
+	}
+
+	/* Verify the user buffer. */
+	result = verify_area( VERIFY_WRITE, urq->data, sizeof( lp->driverInfo ));
+	if( result != 0 ) {
+		urq->result = UIL_FAILURE;
+		DBG_LEAVE( DbgInfo );
+		return result;
+	}
+
+	lp->driverInfo.card_stat = lp->hcfCtx.IFB_CardStat;
+
+	// Copy the driver information into the user's buffer.
+	urq->result = UIL_SUCCESS;
+	copy_to_user( urq->data, &( lp->driverInfo ), sizeof( lp->driverInfo ));
+
+	DBG_LEAVE( DbgInfo );
+	return result;
+} // cfg_driver_info
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	cfg_driver_identity()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Retrieves ID information from the card.
+ *
+ *  PARAMETERS:
+ *
+ *      urq - a pointer to the UIL request buffer
+ *      lp  - a pointer to the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      UIL_SUCCESS
+ *      UIL_ERR_xxx value otherwise
+ *
+ ******************************************************************************/
+int cfg_driver_identity( struct uilreq *urq, struct wl_private *lp )
+{
+	int result = 0;
+	/*------------------------------------------------------------------------*/
+
+
+	DBG_FUNC( "wvlan_driver_identity" );
+	DBG_ENTER( DbgInfo );
+
+
+	/* Make sure that user buffer can handle the driver identity structure. */
+	if( urq->len < sizeof( lp->driverIdentity )) {
+		urq->len = sizeof( lp->driverIdentity );
+		urq->result = UIL_ERR_LEN;
+		DBG_LEAVE( DbgInfo );
+		return result;
+	}
+
+	/* Verify the user buffer. */
+	result = verify_area( VERIFY_WRITE, urq->data, sizeof( lp->driverIdentity ));
+	if( result != 0 ) {
+		urq->result = UIL_FAILURE;
+		DBG_LEAVE( DbgInfo );
+		return result;
+	}
+
+	/* Copy the driver identity into the user's buffer. */
+	urq->result = UIL_SUCCESS;
+	copy_to_user( urq->data, &( lp->driverIdentity ), sizeof( lp->driverIdentity ));
+
+	DBG_LEAVE( DbgInfo );
+	return result;
+} // cfg_driver_identity
+/*============================================================================*/
+
+
+#endif  /* USE_UIL */
+
+
+/* If WIRELESS_EXT is not defined, then the functions that follow will not be
+   included in the build. */
+/* NOTE: Are these still even needed? */
+#ifdef WIRELESS_EXT
+
+
+/*******************************************************************************
+ *	wvlan_set_netname()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Set the ESSID of the card.
+ *
+ *  PARAMETERS:
+ *
+ *      wrq - a pointer to the wireless request buffer
+ *      lp  - a pointer to the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+int wvlan_set_netname(struct net_device *dev,
+		      struct iw_request_info *info,
+		      union iwreq_data *wrqu,
+		      char *extra)
+{
+        struct wl_private *lp = wl_priv(dev);
+        unsigned long flags;
+	int ret = 0;
+	/*------------------------------------------------------------------------*/
+
+
+	DBG_FUNC( "wvlan_set_netname" );
+	DBG_ENTER( DbgInfo );
+
+        wl_lock(lp, &flags);
+
+        memset( lp->NetworkName, 0, sizeof( lp->NetworkName ));
+        memcpy( lp->NetworkName, extra, wrqu->data.length);
+
+	/* Commit the adapter parameters */
+	wl_apply(lp);
+        wl_unlock(lp, &flags);
+
+	DBG_LEAVE( DbgInfo );
+	return ret;
+} // wvlan_set_netname
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wvlan_get_netname()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Get the ESSID of the card.
+ *
+ *  PARAMETERS:
+ *
+ *      wrq - a pointer to the wireless request buffer
+ *      lp  - a pointer to the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+int wvlan_get_netname(struct net_device *dev,
+		      struct iw_request_info *info,
+		      union iwreq_data *wrqu,
+		      char *extra)
+{
+        struct wl_private *lp = wl_priv(dev);
+        unsigned long flags;
+        int         ret = 0;
+        int         status = -1;
+        wvName_t   *pName;
+	/*------------------------------------------------------------------------*/
+
+
+        DBG_FUNC( "wvlan_get_netname" );
+        DBG_ENTER( DbgInfo );
+
+        wl_lock(lp, &flags);
+
+        /* Get the current network name */
+        lp->ltvRecord.len = 1 + ( sizeof( *pName ) / sizeof( hcf_16 ));
+        lp->ltvRecord.typ = CFG_CUR_SSID;
+
+        status = hcf_get_info( &( lp->hcfCtx ), (LTVP)&( lp->ltvRecord ));
+
+        if( status == HCF_SUCCESS ) {
+                pName = (wvName_t *)&( lp->ltvRecord.u.u32 );
+
+		memset(extra, '\0', HCF_MAX_NAME_LEN);
+		wrqu->data.length = pName->length;
+
+                memcpy(extra, pName->name, pName->length);
+        } else {
+                ret = -EFAULT;
+	}
+
+        wl_unlock(lp, &flags);
+
+        DBG_LEAVE( DbgInfo );
+        return ret;
+} // wvlan_get_netname
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wvlan_set_station_nickname()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Set the card's station nickname.
+ *
+ *  PARAMETERS:
+ *
+ *      wrq - a pointer to the wireless request buffer
+ *      lp  - a pointer to the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+int wvlan_set_station_nickname(struct net_device *dev,
+		      struct iw_request_info *info,
+		      union iwreq_data *wrqu,
+		      char *extra)
+{
+        struct wl_private *lp = wl_priv(dev);
+        unsigned long flags;
+        int         ret = 0;
+	/*------------------------------------------------------------------------*/
+
+
+        DBG_FUNC( "wvlan_set_station_nickname" );
+        DBG_ENTER( DbgInfo );
+
+        wl_lock(lp, &flags);
+
+        memset( lp->StationName, 0, sizeof( lp->StationName ));
+
+        memcpy( lp->StationName, extra, wrqu->data.length);
+
+        /* Commit the adapter parameters */
+        wl_apply( lp );
+        wl_unlock(lp, &flags);
+
+        DBG_LEAVE( DbgInfo );
+        return ret;
+} // wvlan_set_station_nickname
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wvlan_get_station_nickname()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Get the card's station nickname.
+ *
+ *  PARAMETERS:
+ *
+ *      wrq - a pointer to the wireless request buffer
+ *      lp  - a pointer to the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+int wvlan_get_station_nickname(struct net_device *dev,
+		      struct iw_request_info *info,
+		      union iwreq_data *wrqu,
+		      char *extra)
+{
+        struct wl_private *lp = wl_priv(dev);
+        unsigned long flags;
+	int         ret = 0;
+	int         status = -1;
+	wvName_t   *pName;
+	/*------------------------------------------------------------------------*/
+
+
+        DBG_FUNC( "wvlan_get_station_nickname" );
+        DBG_ENTER( DbgInfo );
+
+        wl_lock( lp, &flags );
+
+        /* Get the current station name */
+        lp->ltvRecord.len = 1 + ( sizeof( *pName ) / sizeof( hcf_16 ));
+        lp->ltvRecord.typ = CFG_CNF_OWN_NAME;
+
+        status = hcf_get_info( &( lp->hcfCtx ), (LTVP)&( lp->ltvRecord ));
+
+        if( status == HCF_SUCCESS ) {
+                pName = (wvName_t *)&( lp->ltvRecord.u.u32 );
+
+		memset(extra, '\0', HCF_MAX_NAME_LEN);
+		wrqu->data.length = pName->length;
+		memcpy(extra, pName->name, pName->length);
+        } else {
+                ret = -EFAULT;
+        }
+
+        wl_unlock(lp, &flags);
+
+//out:
+        DBG_LEAVE( DbgInfo );
+	return ret;
+} // wvlan_get_station_nickname
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wvlan_set_porttype()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Set the card's porttype
+ *
+ *  PARAMETERS:
+ *
+ *      wrq - a pointer to the wireless request buffer
+ *      lp  - a pointer to the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+int wvlan_set_porttype(struct net_device *dev,
+		      struct iw_request_info *info,
+		      union iwreq_data *wrqu,
+		      char *extra)
+{
+        struct wl_private *lp = wl_priv(dev);
+        unsigned long flags;
+        int     ret = 0;
+	hcf_16  portType;
+	/*------------------------------------------------------------------------*/
+
+
+        DBG_FUNC( "wvlan_set_porttype" );
+        DBG_ENTER( DbgInfo );
+
+        wl_lock(lp, &flags);
+
+        /* Validate the new value */
+        portType = *((__u32 *)extra);
+
+        if( !(( portType == 1 ) || ( portType == 3 ))) {
+                ret = -EINVAL;
+		goto out_unlock;
+        }
+
+        lp->PortType = portType;
+
+        /* Commit the adapter parameters */
+        wl_apply( lp );
+
+out_unlock:
+        wl_unlock(lp, &flags);
+
+//out:
+        DBG_LEAVE( DbgInfo );
+        return ret;
+}
+
+/*============================================================================*/
+
+
+/*******************************************************************************
+ *	wvlan_get_porttype()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Get the card's porttype
+ *
+ *  PARAMETERS:
+ *
+ *      wrq - a pointer to the wireless request buffer
+ *      lp  - a pointer to the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+int wvlan_get_porttype(struct net_device *dev,
+		      struct iw_request_info *info,
+		      union iwreq_data *wrqu,
+		      char *extra)
+{
+        struct wl_private *lp = wl_priv(dev);
+        unsigned long flags;
+        int     ret = 0;
+        int     status = -1;
+        hcf_16  *pPortType;
+        __u32 *pData = (__u32 *)extra;
+	/*------------------------------------------------------------------------*/
+
+
+        DBG_FUNC( "wvlan_get_porttype" );
+        DBG_ENTER( DbgInfo );
+
+        wl_lock( lp, &flags );
+
+        /* Get the current port type */
+        lp->ltvRecord.len = 1 + ( sizeof( *pPortType ) / sizeof( hcf_16 ));
+        lp->ltvRecord.typ = CFG_CNF_PORT_TYPE;
+
+        status = hcf_get_info( &( lp->hcfCtx ), (LTVP)&( lp->ltvRecord ));
+
+        if( status == HCF_SUCCESS ) {
+                pPortType = (hcf_16 *)&( lp->ltvRecord.u.u32 );
+
+                *pData = CNV_LITTLE_TO_INT( *pPortType );
+        } else {
+            ret = -EFAULT;
+	}
+
+        wl_unlock(lp, &flags);
+
+//out:
+        DBG_LEAVE( DbgInfo );
+        return ret;
+} // wvlan_get_porttype
+/*============================================================================*/
+
+#endif  // WIRELESS_EXT
+
+
+
+
+#ifdef USE_RTS
+/*******************************************************************************
+ *	wvlan_rts()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      IOCTL handler for RTS commands
+ *
+ *  PARAMETERS:
+ *
+ *      rrq - a pointer to the rts request buffer
+ *      lp  - a pointer to the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+int wvlan_rts( struct rtsreq *rrq, __u32 io_base )
+{
+	int ioctl_ret = 0;
+	/*------------------------------------------------------------------------*/
+
+
+	DBG_FUNC( "wvlan_rts" );
+	DBG_ENTER( DbgInfo );
+
+
+	DBG_PRINT( "io_base: 0x%08x\n", io_base );
+
+	switch( rrq->typ ) {
+	  case WL_IOCTL_RTS_READ:
+		DBG_TRACE(DbgInfo, "IOCTL: WVLAN2_IOCTL_RTS -- WL_IOCTL_RTS_READ\n");
+		rrq->data[0] = IN_PORT_WORD( io_base + rrq->reg );
+		DBG_TRACE( DbgInfo, "  reg 0x%04x ==> 0x%04x\n", rrq->reg, CNV_LITTLE_TO_SHORT( rrq->data[0] ) );
+		break;
+	  case WL_IOCTL_RTS_WRITE:
+		DBG_TRACE(DbgInfo, "IOCTL: WVLAN2_IOCTL_RTS -- WL_IOCTL_RTS_WRITE\n");
+		OUT_PORT_WORD( io_base + rrq->reg, rrq->data[0] );
+		DBG_TRACE( DbgInfo, "  reg 0x%04x <== 0x%04x\n", rrq->reg, CNV_LITTLE_TO_SHORT( rrq->data[0] ) );
+		break;
+	  case WL_IOCTL_RTS_BATCH_READ:
+		DBG_TRACE(DbgInfo, "IOCTL: WVLAN2_IOCTL_RTS -- WL_IOCTL_RTS_BATCH_READ\n");
+		IN_PORT_STRING_16( io_base + rrq->reg, rrq->data, rrq->len );
+		DBG_TRACE( DbgInfo, "  reg 0x%04x ==> %d bytes\n", rrq->reg, rrq->len * sizeof (__u16 ) );
+		break;
+	  case WL_IOCTL_RTS_BATCH_WRITE:
+		DBG_TRACE(DbgInfo, "IOCTL: WVLAN2_IOCTL_RTS -- WL_IOCTL_RTS_BATCH_WRITE\n");
+		OUT_PORT_STRING_16( io_base + rrq->reg, rrq->data, rrq->len );
+		DBG_TRACE( DbgInfo, "  reg 0x%04x <== %d bytes\n", rrq->reg, rrq->len * sizeof (__u16) );
+		break;
+	default:
+
+		DBG_TRACE(DbgInfo, "IOCTL: WVLAN2_IOCTL_RTS -- UNSUPPORTED RTS CODE: 0x%X", rrq->typ );
+		ioctl_ret = -EOPNOTSUPP;
+		break;
+	}
+
+	DBG_LEAVE( DbgInfo );
+	return ioctl_ret;
+} // wvlan_rts
+/*============================================================================*/
+
+#endif  /* USE_RTS */
diff --git a/drivers/staging/wlags49_h2/wl_priv.h b/drivers/staging/wlags49_h2/wl_priv.h
new file mode 100644
index 000000000000..9b0254497aa7
--- /dev/null
+++ b/drivers/staging/wlags49_h2/wl_priv.h
@@ -0,0 +1,121 @@
+/*******************************************************************************
+ * Agere Systems Inc.
+ * Wireless device driver for Linux (wlags49).
+ *
+ * Copyright (c) 1998-2003 Agere Systems Inc.
+ * All rights reserved.
+ *   http://www.agere.com
+ *
+ * Initially developed by TriplePoint, Inc.
+ *   http://www.triplepoint.com
+ *
+ *------------------------------------------------------------------------------
+ *
+ *   Header describing information required for the private IOCTL handlers.
+ *
+ *------------------------------------------------------------------------------
+ *
+ * SOFTWARE LICENSE
+ *
+ * This software is provided subject to the following terms and conditions,
+ * which you should read carefully before using the software.  Using this
+ * software indicates your acceptance of these terms and conditions.  If you do
+ * not agree with these terms and conditions, do not use the software.
+ *
+ * Copyright © 2003 Agere Systems Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source or binary forms, with or without
+ * modifications, are permitted provided that the following conditions are met:
+ *
+ * . Redistributions of source code must retain the above copyright notice, this
+ *    list of conditions and the following Disclaimer as comments in the code as
+ *    well as in the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * . Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following Disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ *
+ * . Neither the name of Agere Systems Inc. nor the names of the contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * Disclaimer
+ *
+ * THIS SOFTWARE IS PROVIDED “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, INFRINGEMENT AND THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  ANY
+ * USE, MODIFICATION OR DISTRIBUTION OF THIS SOFTWARE IS SOLELY AT THE USERS OWN
+ * RISK. IN NO EVENT SHALL AGERE SYSTEMS INC. OR CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, INCLUDING, BUT NOT LIMITED TO, CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ *
+ ******************************************************************************/
+
+#ifndef __WL_PRIV_H__
+#define __WL_PRIV_H__
+
+
+
+
+/*******************************************************************************
+ *  function prototypes
+ ******************************************************************************/
+#ifdef WIRELESS_EXT
+
+
+int wvlan_set_netname( struct net_device *,  struct iw_request_info *, union iwreq_data *, char *extra );
+
+int wvlan_get_netname( struct net_device *,  struct iw_request_info *, union iwreq_data *, char *extra );
+
+int wvlan_set_station_nickname( struct net_device *,  struct iw_request_info *, union iwreq_data *, char *extra );
+
+int wvlan_get_station_nickname( struct net_device *,  struct iw_request_info *, union iwreq_data *, char *extra );
+
+int wvlan_set_porttype( struct net_device *,  struct iw_request_info *, union iwreq_data *, char *extra );
+
+int wvlan_get_porttype( struct net_device *,  struct iw_request_info *, union iwreq_data *, char *extra );
+
+
+#endif  // WIRELESS_EXT
+
+
+
+
+#ifdef USE_UIL
+
+int wvlan_uil( struct uilreq *urq, struct wl_private *lp );
+
+// int wvlan_uil_connect( struct uilreq *urq, struct wl_private *lp );
+// int wvlan_uil_disconnect( struct uilreq *urq, struct wl_private *lp );
+// int wvlan_uil_action( struct uilreq *urq, struct wl_private *lp );
+// int wvlan_uil_block( struct uilreq *urq, struct wl_private *lp );
+// int wvlan_uil_unblock( struct uilreq *urq, struct wl_private *lp );
+// int wvlan_uil_send_diag_msg( struct uilreq *urq, struct wl_private *lp );
+// int wvlan_uil_put_info( struct uilreq *urq, struct wl_private *lp );
+// int wvlan_uil_get_info( struct uilreq *urq, struct wl_private *lp );
+
+//int cfg_driver_info( struct uilreq *urq, struct wl_private *lp );
+//int cfg_driver_identity( struct uilreq *urq, struct wl_private *lp );
+
+#endif  // USE_UIL
+
+
+#ifdef USE_RTS
+
+int wvlan_rts( struct rtsreq *rrq, __u32 io_base );
+int wvlan_rts_read( __u16 reg, __u16 *val, __u32 io_base );
+int wvlan_rts_write( __u16 reg, __u16 val, __u32 io_base );
+int wvlan_rts_batch_read( struct rtsreq *rrq, __u32 io_base );
+int wvlan_rts_batch_write( struct rtsreq *rrq, __u32 io_base );
+
+#endif  // USE_RTS
+
+
+#endif  // __WL_PRIV_H__
diff --git a/drivers/staging/wlags49_h2/wl_profile.c b/drivers/staging/wlags49_h2/wl_profile.c
new file mode 100644
index 000000000000..715f027a923f
--- /dev/null
+++ b/drivers/staging/wlags49_h2/wl_profile.c
@@ -0,0 +1,1111 @@
+/*******************************************************************************
+ * Agere Systems Inc.
+ * Wireless device driver for Linux (wlags49).
+ *
+ * Copyright (c) 1998-2003 Agere Systems Inc.
+ * All rights reserved.
+ *   http://www.agere.com
+ *
+ * Initially developed by TriplePoint, Inc.
+ *   http://www.triplepoint.com
+ *
+ *------------------------------------------------------------------------------
+ *
+ *   This file defines routines required to parse configuration parameters
+ *   listed in a config file, if that config file exists.
+ *
+ *------------------------------------------------------------------------------
+ *
+ * SOFTWARE LICENSE
+ *
+ * This software is provided subject to the following terms and conditions,
+ * which you should read carefully before using the software.  Using this
+ * software indicates your acceptance of these terms and conditions.  If you do
+ * not agree with these terms and conditions, do not use the software.
+ *
+ * Copyright © 2003 Agere Systems Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source or binary forms, with or without
+ * modifications, are permitted provided that the following conditions are met:
+ *
+ * . Redistributions of source code must retain the above copyright notice, this
+ *    list of conditions and the following Disclaimer as comments in the code as
+ *    well as in the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * . Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following Disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ *
+ * . Neither the name of Agere Systems Inc. nor the names of the contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * Disclaimer
+ *
+ * THIS SOFTWARE IS PROVIDED “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, INFRINGEMENT AND THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  ANY
+ * USE, MODIFICATION OR DISTRIBUTION OF THIS SOFTWARE IS SOLELY AT THE USERS OWN
+ * RISK. IN NO EVENT SHALL AGERE SYSTEMS INC. OR CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, INCLUDING, BUT NOT LIMITED TO, CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ *
+ ******************************************************************************/
+
+/* Only include this file if USE_PROFILE is defined */
+#ifdef USE_PROFILE
+
+
+
+
+/*******************************************************************************
+ *  constant definitions
+ ******************************************************************************/
+
+
+/* Allow support for calling system fcns to parse config file */
+#define __KERNEL_SYSCALLS__
+
+
+
+
+/*******************************************************************************
+ * include files
+ ******************************************************************************/
+#include <wl_version.h>
+
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/unistd.h>
+#include <asm/uaccess.h>
+#include <limits.h>
+
+#define BIN_DL 1
+
+#include <debug.h>
+#include <hcf.h>
+//#include <hcfdef.h>
+
+#include <wl_if.h>
+#include <wl_internal.h>
+#include <wl_util.h>
+#include <wl_enc.h>
+#include <wl_main.h>
+#include <wl_profile.h>
+
+
+/*******************************************************************************
+ * global variables
+ ******************************************************************************/
+
+/* Definition needed to prevent unresolved external in unistd.h */
+static int errno;
+
+#if DBG
+extern p_u32    DebugFlag;
+extern dbg_info_t *DbgInfo;
+#endif
+
+int parse_yes_no( char* value );
+
+
+int parse_yes_no( char* value ) {
+int rc = 0;										//default to NO for invalid parameters
+
+	if ( strlen( value ) == 1 ) {
+		if ( ( value[0] | ('Y'^'y') ) == 'y' ) rc = 1;
+//	} else {
+//		this should not be debug time info, it is an enduser data entry error ;?
+//		DBG_WARNING( DbgInfo, "%s invalid; will be ignored\n", PARM_NAME_MICROWAVE_ROBUSTNESS );
+	}
+	return rc;
+} // parse_yes_no
+
+
+/*******************************************************************************
+ *	parse_config()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      This function opens the device's config file and parses the options from
+ *   it, so that it can properly configure itself. If no configuration file
+ *   or configuration is present, then continue to use the options already
+ *   parsed from config.opts or wireless.opts.
+ *
+ *  PARAMETERS:
+ *
+ *      dev - a pointer to the device's net_device structure
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+void parse_config( struct net_device *dev )
+{
+	int				    file_desc;
+#if 0 // BIN_DL
+	int 	 			rc;
+	char				*cp = NULL;
+#endif // BIN_DL
+	char                buffer[MAX_LINE_SIZE];
+	char                filename[MAX_LINE_SIZE];
+	mm_segment_t	    fs;
+	struct wl_private   *wvlan_config = NULL;
+	ENCSTRCT            sEncryption;
+	/*------------------------------------------------------------------------*/
+
+	DBG_FUNC( "parse_config" );
+	DBG_ENTER( DbgInfo );
+
+	/* Get the wavelan specific info for this device */
+	wvlan_config = (struct wl_private *)dev->priv;
+	if ( wvlan_config == NULL ) {
+		DBG_ERROR( DbgInfo, "Wavelan specific info struct not present?\n" );
+		return;
+	}
+
+	/* setup the default encryption string */
+	strcpy( wvlan_config->szEncryption, DEF_CRYPT_STR );
+
+	/* Obtain a user-space process context, storing the original context */
+	fs = get_fs( );
+	set_fs( get_ds( ));
+
+	/* Determine the filename for this device and attempt to open it */
+	sprintf( filename, "%s%s", ROOT_CONFIG_FILENAME, dev->name );
+	file_desc = open( filename, O_RDONLY, 0 );
+	if ( file_desc != -1 ) {
+		DBG_TRACE( DbgInfo, "Wireless config file found. Parsing options...\n" );
+
+		/* Read out the options */
+		while( readline( file_desc, buffer )) {
+			translate_option( buffer, wvlan_config );
+		}
+		/* Close the file */
+		close( file_desc );	//;?even if file_desc == -1 ???
+	} else {
+		DBG_TRACE( DbgInfo, "No iwconfig file found for this device; "
+				   "config.opts or wireless.opts will be used\n" );
+	}
+	/* Return to the original context */
+	set_fs( fs );
+
+	/* convert the WEP keys, if read in as key1, key2, type of data */
+	if ( wvlan_config->EnableEncryption ) {
+		memset( &sEncryption, 0, sizeof( sEncryption ));
+
+		wl_wep_decode( CRYPT_CODE, &sEncryption,
+						   wvlan_config->szEncryption );
+
+		/* the Linux driver likes to use 1-4 for the key IDs, and then
+		   convert to 0-3 when sending to the card.  The Windows code
+		   base used 0-3 in the API DLL, which was ported to Linux.  For
+		   the sake of the user experience, we decided to keep 0-3 as the
+		   numbers used in the DLL; and will perform the +1 conversion here.
+		   We could have converted  the entire Linux driver, but this is
+		   less obtrusive.  This may be a "todo" to convert the whole driver */
+		sEncryption.wEnabled = wvlan_config->EnableEncryption;
+		sEncryption.wTxKeyID = wvlan_config->TransmitKeyID - 1;
+
+		memcpy( &sEncryption.EncStr, &wvlan_config->DefaultKeys,
+				sizeof( CFG_DEFAULT_KEYS_STRCT ));
+
+		memset( wvlan_config->szEncryption, 0, sizeof( wvlan_config->szEncryption ));
+
+		wl_wep_code( CRYPT_CODE, wvlan_config->szEncryption, &sEncryption,
+						 sizeof( sEncryption ));
+	}
+
+	/* decode the encryption string for the call to wl_commit() */
+	wl_wep_decode( CRYPT_CODE, &sEncryption, wvlan_config->szEncryption );
+
+	wvlan_config->TransmitKeyID    = sEncryption.wTxKeyID + 1;
+	wvlan_config->EnableEncryption = sEncryption.wEnabled;
+
+	memcpy( &wvlan_config->DefaultKeys, &sEncryption.EncStr,
+			sizeof( CFG_DEFAULT_KEYS_STRCT ));
+
+#if 0 //BIN_DL
+		/* Obtain a user-space process context, storing the original context */
+		fs = get_fs( );
+		set_fs( get_ds( ));
+
+		//;?just to fake something
+		strcpy(/*wvlan_config->fw_image_*/filename, "/etc/agere/fw.bin" );
+		file_desc = open( /*wvlan_config->fw_image_*/filename, 0, 0 );
+		if ( file_desc == -1 ) {
+			DBG_ERROR( DbgInfo, "No image file found\n" );
+		} else {
+			DBG_TRACE( DbgInfo, "F/W image file found\n" );
+#define DHF_ALLOC_SIZE 96000			//just below 96K, let's hope it suffices for now and for the future
+			cp = (char*)vmalloc( DHF_ALLOC_SIZE );
+			if ( cp == NULL ) {
+				DBG_ERROR( DbgInfo, "error in vmalloc\n" );
+			} else {
+				rc = read( file_desc, cp, DHF_ALLOC_SIZE );
+				if ( rc == DHF_ALLOC_SIZE ) {
+					DBG_ERROR( DbgInfo, "buffer too small, %d\n", DHF_ALLOC_SIZE );
+				} else if ( rc > 0 ) {
+					DBG_TRACE( DbgInfo, "read O.K.: %d bytes  %.12s\n", rc, cp );
+					rc = read( file_desc, &cp[rc], 1 );
+					if ( rc == 0 ) {
+						DBG_TRACE( DbgInfo, "no more to read\n" );
+					}
+				}
+				if ( rc != 0 ) {
+					DBG_ERROR( DbgInfo, "file not read in one swoop or other error"\
+										", give up, too complicated, rc = %0X\n", rc );
+				}
+				vfree( cp );
+			}
+			close( file_desc );
+		}
+		set_fs( fs );			/* Return to the original context */
+#endif // BIN_DL
+
+	DBG_LEAVE( DbgInfo );
+	return;
+} // parse_config
+
+/*******************************************************************************
+ *	readline()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      This function reads in data from a given file one line at a time,
+ *   converting the detected newline character '\n' to a null '\0'. Note that
+ *   the file descriptor must be valid before calling this function.
+ *
+ *  PARAMETERS:
+ *
+ *      filedesc    - the file descriptor for the open configuration file
+ *      buffer      - a buffer pointer, passed in by the caller, to which the
+ *                    line will be stored.
+ *
+ *  RETURNS:
+ *
+ *      the number of bytes read
+ *      -1 on error
+ *
+ ******************************************************************************/
+int readline( int filedesc, char *buffer )
+{
+	int result = -1;
+	int bytes_read = 0;
+	/*------------------------------------------------------------------------*/
+
+	/* Make sure the file descriptor is good */
+	if ( filedesc != -1 ) {
+		/* Read in from the file byte by byte until a newline is reached */
+		while(( result = read( filedesc, &buffer[bytes_read], 1 )) == 1 ) {
+			if ( buffer[bytes_read] == '\n' ) {
+				buffer[bytes_read] = '\0';
+				bytes_read++;
+				break;
+			}
+			bytes_read++;
+		}
+	}
+
+	/* Return the number of bytes read */
+	if ( result == -1 ) {
+		return result;
+	} else {
+		return bytes_read;
+	}
+} // readline
+/*============================================================================*/
+
+/*******************************************************************************
+ *	translate_option()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      This function takes a line read in from the config file and parses out
+ *   the key/value pairs. It then determines which key has been parsed and sets
+ *   the card's configuration based on the value given.
+ *
+ *  PARAMETERS:
+ *
+ *      buffer - a buffer containing a line to translate
+ *      config - a pointer to the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+void translate_option( char *buffer, struct wl_private *lp )
+{
+	unsigned int value_convert = 0;
+	int string_length = 0;
+	char *key = NULL;
+	char *value = NULL;
+	u_char mac_value[ETH_ALEN];
+	/*------------------------------------------------------------------------*/
+
+	DBG_FUNC( "translate_option" );
+
+	if ( buffer == NULL || lp == NULL ) {
+		DBG_ERROR( DbgInfo, "Config file buffer and/or wavelan buffer ptr NULL\n" );
+		return;
+	}
+
+	ParseConfigLine( buffer, &key, &value );
+
+	if ( key == NULL || value == NULL ) {
+		return;
+	}
+
+	/* Determine which key it is and perform the appropriate action */
+
+	/* Configuration parameters used in all scenarios */
+#if DBG
+	/* handle DebugFlag as early as possible so it starts its influence as early
+	 * as possible
+	 */
+	if ( strcmp( key, PARM_NAME_DEBUG_FLAG ) == 0 ) {
+		if ( DebugFlag == ~0 ) {			//if DebugFlag is not specified on the command line
+			if ( DbgInfo->DebugFlag == 0 ) {	/* if pc_debug did not set DebugFlag (i.e.pc_debug is
+											 * not specified or specified outside the 4-8 range
+											 */
+				DbgInfo->DebugFlag |= DBG_DEFAULTS;
+			}
+		} else {
+			DbgInfo->DebugFlag = wl_atoi( value ); //;?DebugFlag;
+		}
+		DbgInfo->DebugFlag = wl_atoi( value ); //;?Delete ASAP
+	}
+#endif /* DBG */
+	if ( strcmp( key, PARM_NAME_AUTH_KEY_MGMT_SUITE ) == 0 ) {
+		DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_AUTH_KEY_MGMT_SUITE, value );
+
+		value_convert = wl_atoi( value );
+		if (( value_convert >= PARM_MIN_AUTH_KEY_MGMT_SUITE ) || ( value_convert <= PARM_MAX_AUTH_KEY_MGMT_SUITE )) {
+			lp->AuthKeyMgmtSuite = value_convert;
+		} else {
+			DBG_WARNING( DbgInfo, "%s invalid; will be ignored\n", PARM_NAME_AUTH_KEY_MGMT_SUITE );
+		}
+	}
+	else if ( strcmp( key, PARM_NAME_BRSC_2GHZ ) == 0 ) {
+		DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_BRSC_2GHZ, value );
+
+		value_convert = wl_atoi( value );
+		if (( value_convert >= PARM_MIN_BRSC ) || ( value_convert <= PARM_MAX_BRSC )) {
+			lp->brsc[0] = value_convert;
+		} else {
+			DBG_WARNING( DbgInfo, "%s invaid; will be ignored\n", PARM_NAME_BRSC_2GHZ );
+		}
+	}
+	else if ( strcmp( key, PARM_NAME_BRSC_5GHZ ) == 0 ) {
+		DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_BRSC_5GHZ, value );
+
+		value_convert = wl_atoi( value );
+		if (( value_convert >= PARM_MIN_BRSC ) || ( value_convert <= PARM_MAX_BRSC )) {
+			lp->brsc[1] = value_convert;
+		} else {
+			DBG_WARNING( DbgInfo, "%s invaid; will be ignored\n", PARM_NAME_BRSC_5GHZ );
+		}
+	}
+	else if (( strcmp( key, PARM_NAME_DESIRED_SSID ) == 0 ) || ( strcmp( key, PARM_NAME_OWN_SSID ) == 0 )) {
+		DBG_TRACE( DbgInfo, "SSID, value: %s\n", value );
+
+		memset( lp->NetworkName, 0, ( PARM_MAX_NAME_LEN + 1 ));
+
+		/* Make sure the value isn't too long */
+		string_length = strlen( value );
+		if ( string_length > PARM_MAX_NAME_LEN ) {
+			DBG_WARNING( DbgInfo, "SSID too long; will be truncated\n" );
+			string_length = PARM_MAX_NAME_LEN;
+		}
+
+		memcpy( lp->NetworkName, value, string_length );
+	}
+#if 0
+	else if ( strcmp( key, PARM_NAME_DOWNLOAD_FIRMWARE ) == 0 ) {
+		DBG_TRACE( DbgInfo, "DOWNLOAD_FIRMWARE, value: %s\n", value );
+		memset( lp->fw_image_filename, 0, ( MAX_LINE_SIZE + 1 ));
+		/* Make sure the value isn't too long */
+		string_length = strlen( value );
+		if ( string_length > MAX_LINE_SIZE ) {
+			DBG_WARNING( DbgInfo, "F/W image file name too long; will be ignored\n" );
+		} else {
+			memcpy( lp->fw_image_filename, value, string_length );
+		}
+	}
+#endif
+	else if ( strcmp( key, PARM_NAME_ENABLE_ENCRYPTION ) == 0 ) {
+		DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_ENABLE_ENCRYPTION, value );
+
+		value_convert = wl_atoi( value );
+		if (( value_convert >= PARM_MIN_ENABLE_ENCRYPTION ) && ( value_convert <= PARM_MAX_ENABLE_ENCRYPTION )) {
+			lp->EnableEncryption = value_convert;
+		} else {
+			DBG_WARNING( DbgInfo, "%s invalid; will be ignored\n", PARM_NAME_ENABLE_ENCRYPTION );
+		}
+	}
+	else if ( strcmp( key, PARM_NAME_ENCRYPTION ) == 0 ) {
+		DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_ENCRYPTION, value );
+
+		memset( lp->szEncryption, 0, sizeof( lp->szEncryption ));
+
+		/* Make sure the value isn't too long */
+		string_length = strlen( value );
+		if ( string_length > sizeof( lp->szEncryption ) ) {
+			DBG_WARNING( DbgInfo, "%s too long; will be truncated\n", PARM_NAME_ENCRYPTION );
+			string_length = sizeof( lp->szEncryption );
+		}
+
+		memcpy( lp->szEncryption, value, string_length );
+	}
+	else if ( strcmp( key, PARM_NAME_KEY1 ) == 0 ) {
+		DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_KEY1, value );
+
+		if ( is_valid_key_string( value )) {
+			memset( lp->DefaultKeys.key[0].key, 0, MAX_KEY_SIZE );
+
+			key_string2key( value, &lp->DefaultKeys.key[0] );
+		} else {
+			 DBG_WARNING( DbgInfo, "%s invalid; will be ignored\n", PARM_NAME_KEY1 );
+		}
+	}
+	else if ( strcmp( key, PARM_NAME_KEY2 ) == 0 ) {
+		DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_KEY2, value );
+
+		if ( is_valid_key_string( value )) {
+			memset( lp->DefaultKeys.key[1].key, 0, MAX_KEY_SIZE );
+
+			key_string2key( value, &lp->DefaultKeys.key[1] );
+		} else {
+			 DBG_WARNING( DbgInfo, "%s invalid; will be ignored\n", PARM_NAME_KEY2 );
+		}
+	}
+	else if ( strcmp( key, PARM_NAME_KEY3 ) == 0 ) {
+		DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_KEY3, value );
+
+		if ( is_valid_key_string( value )) {
+			memset( lp->DefaultKeys.key[2].key, 0, MAX_KEY_SIZE );
+
+			key_string2key( value, &lp->DefaultKeys.key[2] );
+		} else {
+			 DBG_WARNING( DbgInfo, "%s invalid; will be ignored\n", PARM_NAME_KEY3 );
+		}
+	}
+	else if ( strcmp( key, PARM_NAME_KEY4 ) == 0 ) {
+		DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_KEY4, value );
+
+		if ( is_valid_key_string( value )) {
+			memset( lp->DefaultKeys.key[3].key, 0, MAX_KEY_SIZE );
+
+			key_string2key( value, &lp->DefaultKeys.key[3] );
+		} else {
+			 DBG_WARNING( DbgInfo, "%s invalid; will be ignored\n", PARM_NAME_KEY4 );
+		}
+	}
+	/* New Parameters for WARP */
+	else if ( strcmp( key, PARM_NAME_LOAD_BALANCING ) == 0 ) {
+		DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_LOAD_BALANCING, value );
+		lp->loadBalancing = parse_yes_no(value);
+	}
+	else if ( strcmp( key, PARM_NAME_MEDIUM_DISTRIBUTION ) == 0 ) {
+		DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_MEDIUM_DISTRIBUTION, value );
+		lp->mediumDistribution = parse_yes_no(value);
+	}
+	else if ( strcmp( key, PARM_NAME_MICROWAVE_ROBUSTNESS) == 0 ) {
+		DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_MICROWAVE_ROBUSTNESS, value );
+		lp->MicrowaveRobustness = parse_yes_no(value);
+	}
+	else if ( strcmp( key, PARM_NAME_MULTICAST_RATE ) == 0 ) {
+		DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_MULTICAST_RATE, value );
+
+		value_convert = wl_atoi( value );
+
+		if (( value_convert >= PARM_MIN_MULTICAST_RATE ) && ( value_convert <= PARM_MAX_MULTICAST_RATE )) {
+			lp->MulticastRate[0] = value_convert;
+		} else {
+			DBG_WARNING( DbgInfo, "%s invalid; will be ignored\n", PARM_NAME_MULTICAST_RATE );
+		}
+	}
+	else if ( strcmp( key, PARM_NAME_OWN_CHANNEL ) == 0 ) {
+		DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_OWN_CHANNEL, value );
+
+		value_convert = wl_atoi( value );
+		if ( wl_is_a_valid_chan( value_convert )) {
+			if ( value_convert > 14 ) {
+				value_convert = value_convert | 0x100;
+			}
+			lp->Channel = value_convert;
+		} else {
+			DBG_WARNING( DbgInfo, "%s invalid; will be ignored\n", PARM_NAME_OWN_CHANNEL );
+		}
+	}
+	else if ( strcmp( key, PARM_NAME_OWN_NAME ) == 0 ) {
+		DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_OWN_NAME, value );
+
+		memset( lp->StationName, 0, ( PARM_MAX_NAME_LEN + 1 ));
+
+		/* Make sure the value isn't too long */
+		string_length = strlen( value );
+		if ( string_length > PARM_MAX_NAME_LEN ) {
+			DBG_WARNING( DbgInfo, "%s too long; will be truncated\n", PARM_NAME_OWN_NAME );
+			string_length = PARM_MAX_NAME_LEN;
+		}
+
+		memcpy( lp->StationName, value, string_length );
+	}
+	else if ( strcmp( key, PARM_NAME_RTS_THRESHOLD ) == 0 ) {
+		DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_RTS_THRESHOLD, value );
+
+		value_convert = wl_atoi( value );
+		if (( value_convert >= PARM_MIN_RTS_THRESHOLD ) && ( value_convert <= PARM_MAX_RTS_THRESHOLD )) {
+			lp->RTSThreshold = value_convert;
+		} else {
+			DBG_WARNING( DbgInfo, "%s invalid; will be ignored\n", PARM_NAME_RTS_THRESHOLD );
+		}
+	}
+	else if ( strcmp( key, PARM_NAME_SRSC_2GHZ ) == 0 ) {
+		DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_SRSC_2GHZ, value );
+
+		value_convert = wl_atoi( value );
+		if (( value_convert >= PARM_MIN_SRSC ) || ( value_convert <= PARM_MAX_SRSC )) {
+			lp->srsc[0] = value_convert;
+		} else {
+			DBG_WARNING( DbgInfo, "%s invaid; will be ignored\n", PARM_NAME_SRSC_2GHZ );
+		}
+	}
+	else if ( strcmp( key, PARM_NAME_SRSC_5GHZ ) == 0 ) {
+		DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_SRSC_5GHZ, value );
+
+		value_convert = wl_atoi( value );
+		if (( value_convert >= PARM_MIN_SRSC ) || ( value_convert <= PARM_MAX_SRSC )) {
+			lp->srsc[1] = value_convert;
+		} else {
+			DBG_WARNING( DbgInfo, "%s invaid; will be ignored\n", PARM_NAME_SRSC_5GHZ );
+		}
+	}
+	else if ( strcmp( key, PARM_NAME_SYSTEM_SCALE ) == 0 ) {
+		DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_SYSTEM_SCALE, value );
+
+		value_convert = wl_atoi( value );
+		if (( value_convert >= PARM_MIN_SYSTEM_SCALE ) && ( value_convert <= PARM_MAX_SYSTEM_SCALE )) {
+			lp->DistanceBetweenAPs = value_convert;
+		} else {
+			DBG_WARNING( DbgInfo, "%s invalid; will be ignored\n", PARM_NAME_SYSTEM_SCALE );
+		}
+	}
+	else if ( strcmp( key, PARM_NAME_TX_KEY ) == 0 ) {
+		DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_TX_KEY, value );
+
+		value_convert = wl_atoi( value );
+		if (( value_convert >= PARM_MIN_TX_KEY ) && ( value_convert <= PARM_MAX_TX_KEY )) {
+			lp->TransmitKeyID = wl_atoi( value );
+		} else {
+			DBG_WARNING( DbgInfo, "%s invalid; will be ignored\n", PARM_NAME_TX_KEY );
+		}
+	}
+	else if ( strcmp( key, PARM_NAME_TX_RATE ) == 0 ) {
+		DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_TX_RATE, value );
+
+		value_convert = wl_atoi( value );
+		if (( value_convert >= PARM_MIN_TX_RATE ) && ( value_convert <= PARM_MAX_TX_RATE )) {
+			lp->TxRateControl[0] = value_convert;
+		} else {
+			DBG_WARNING( DbgInfo, "%s invalid; will be ignored\n", PARM_NAME_TX_RATE );
+		}
+	}
+	else if ( strcmp( key, PARM_NAME_TX_POW_LEVEL ) == 0 ) {
+		DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_TX_POW_LEVEL, value );
+
+		value_convert = wl_atoi( value );
+		if (( value_convert >= PARM_MIN_TX_POW_LEVEL ) || ( value_convert <= PARM_MAX_TX_POW_LEVEL )) {
+			lp->txPowLevel = value_convert;
+		} else {
+			DBG_WARNING( DbgInfo, "%s invalid; will be ignored\n", PARM_NAME_TX_POW_LEVEL );
+		}
+	}
+
+	/* Need to add? : Country code, Short/Long retry */
+
+	/* Configuration parameters specific to STA mode */
+#if 1 //;? (HCF_TYPE) & HCF_TYPE_STA
+//;?seems reasonable that even an AP-only driver could afford this small additional footprint
+	if ( CNV_INT_TO_LITTLE( lp->hcfCtx.IFB_FWIdentity.comp_id ) == COMP_ID_FW_STA  ) {
+					//;?should we return an error status in AP mode
+		if ( strcmp( key, PARM_NAME_PORT_TYPE ) == 0 ) {
+			DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_PORT_TYPE, value );
+
+			value_convert = wl_atoi( value );
+			if (( value_convert == PARM_MIN_PORT_TYPE ) || ( value_convert == PARM_MAX_PORT_TYPE )) {
+				lp->PortType = value_convert;
+			} else {
+				DBG_WARNING( DbgInfo, "%s invalid; will be ignored\n", PARM_NAME_PORT_TYPE );
+			}
+		}
+		else if ( strcmp( key, PARM_NAME_PM_ENABLED ) == 0 ) {
+			DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_PM_ENABLED, value );
+			value_convert = wl_atoi( value );
+	/* ;? how about wl_main.c containing
+	 * VALID_PARAM( PARM_PM_ENABLED <= WVLAN_PM_STATE_STANDARD ||
+	 *					 ( PARM_PM_ENABLED & 0x7FFF ) <= WVLAN_PM_STATE_STANDARD );
+	 */
+			if ( ( value_convert & 0x7FFF ) <= PARM_MAX_PM_ENABLED) {
+				lp->PMEnabled = value_convert;
+			} else {
+				DBG_WARNING( DbgInfo, "%s invalid; will be ignored\n", PARM_NAME_PM_ENABLED );
+				//;?this is a data entry error, hence not a DBG_WARNING
+			}
+		}
+		else if ( strcmp( key, PARM_NAME_CREATE_IBSS ) == 0 ) {
+			DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_CREATE_IBSS, value );
+			lp->CreateIBSS = parse_yes_no(value);
+		}
+		else if ( strcmp( key, PARM_NAME_MULTICAST_RX ) == 0 ) {
+			DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_MULTICAST_RX, value );
+			lp->MulticastReceive = parse_yes_no(value);
+		}
+		else if ( strcmp( key, PARM_NAME_MAX_SLEEP ) == 0 ) {
+			DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_MAX_SLEEP, value );
+
+			value_convert = wl_atoi( value );
+			if (( value_convert >= 0 ) && ( value_convert <= 65535 )) {
+				lp->MaxSleepDuration = value_convert;
+			} else {
+				DBG_WARNING( DbgInfo, "%s invalid; will be ignored\n", PARM_NAME_MAX_SLEEP );
+			}
+		}
+		else if ( strcmp( key, PARM_NAME_NETWORK_ADDR ) == 0 ) {
+			DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_NETWORK_ADDR, value );
+
+			if ( parse_mac_address( value, mac_value ) == ETH_ALEN ) {
+				memcpy( lp->MACAddress, mac_value, ETH_ALEN );
+			} else {
+				DBG_WARNING( DbgInfo, "%s invalid; will be ignored\n", PARM_NAME_NETWORK_ADDR );
+			}
+		}
+		else if ( strcmp( key, PARM_NAME_AUTHENTICATION ) == 0 ) {
+			DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_AUTHENTICATION, value );
+
+			value_convert = wl_atoi( value );
+			if (( value_convert >= PARM_MIN_AUTHENTICATION ) && ( value_convert <= PARM_MAX_AUTHENTICATION )) {
+				lp->authentication = value_convert;
+			} else {
+				DBG_WARNING( DbgInfo, "%s invalid; will be ignored\n", PARM_NAME_AUTHENTICATION );
+			}
+		}
+		else if ( strcmp( key, PARM_NAME_OWN_ATIM_WINDOW ) == 0 ) {
+			DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_OWN_ATIM_WINDOW, value );
+
+			value_convert = wl_atoi( value );
+			if (( value_convert >= PARM_MIN_OWN_ATIM_WINDOW ) && ( value_convert <= PARM_MAX_OWN_ATIM_WINDOW )) {
+				lp->atimWindow = value_convert;
+			} else {
+				DBG_WARNING( DbgInfo, "%s invalid; will be ignored\n", PARM_NAME_OWN_ATIM_WINDOW );
+			}
+		}
+		else if ( strcmp( key, PARM_NAME_PM_HOLDOVER_DURATION ) == 0 ) {
+			DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_PM_HOLDOVER_DURATION, value );
+
+			value_convert = wl_atoi( value );
+			if (( value_convert >= PARM_MIN_PM_HOLDOVER_DURATION ) && ( value_convert <= PARM_MAX_PM_HOLDOVER_DURATION )) {
+				lp->holdoverDuration = value_convert;
+			} else {
+				DBG_WARNING( DbgInfo, "%s invalid; will be ignored\n", PARM_NAME_PM_HOLDOVER_DURATION );
+			}
+		}
+		else if ( strcmp( key, PARM_NAME_PROMISCUOUS_MODE ) == 0 ) {
+			DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_PROMISCUOUS_MODE, value );
+			lp->promiscuousMode = parse_yes_no(value);
+		}
+		else if ( strcmp( key, PARM_NAME_CONNECTION_CONTROL ) == 0 ) {
+			DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_CONNECTION_CONTROL, value );
+
+			value_convert = wl_atoi( value );
+			if (( value_convert >= PARM_MIN_CONNECTION_CONTROL ) && ( value_convert <= PARM_MAX_CONNECTION_CONTROL )) {
+				lp->connectionControl = value_convert;
+			} else {
+				DBG_WARNING( DbgInfo, "%s invalid; will be ignored\n", PARM_NAME_CONNECTION_CONTROL );
+			}
+		}
+
+		/* Need to add? : Probe Data Rate */
+	}
+#endif  /* (HCF_TYPE) & HCF_TYPE_STA */
+
+	/* Configuration parameters specific to AP mode */
+#if 1 //;? (HCF_TYPE) & HCF_TYPE_AP
+		//;?should we restore this to allow smaller memory footprint
+	if ( CNV_INT_TO_LITTLE( lp->hcfCtx.IFB_FWIdentity.comp_id ) == COMP_ID_FW_AP  ) {
+		if ( strcmp( key, PARM_NAME_OWN_DTIM_PERIOD ) == 0 ) {
+			DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_OWN_DTIM_PERIOD, value );
+
+			value_convert = wl_atoi( value );
+			if ( value_convert >= PARM_MIN_OWN_DTIM_PERIOD ) {
+				lp->DTIMPeriod = value_convert;
+			} else {
+				DBG_WARNING( DbgInfo, "%s invalid; will be ignored\n", PARM_NAME_OWN_DTIM_PERIOD );
+			}
+		}
+		else if ( strcmp( key, PARM_NAME_REJECT_ANY ) == 0 ) {
+			DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_REJECT_ANY, value );
+			lp->RejectAny = parse_yes_no(value);
+		}
+		else if ( strcmp( key, PARM_NAME_EXCLUDE_UNENCRYPTED ) == 0 ) {
+			DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_EXCLUDE_UNENCRYPTED, value );
+			lp->ExcludeUnencrypted = parse_yes_no(value);
+		}
+		else if ( strcmp( key, PARM_NAME_MULTICAST_PM_BUFFERING ) == 0 ) {
+			DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_MULTICAST_PM_BUFFERING, value );
+			lp->ExcludeUnencrypted = parse_yes_no(value);
+		}
+		else if ( strcmp( key, PARM_NAME_INTRA_BSS_RELAY ) == 0 ) {
+			DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_INTRA_BSS_RELAY, value );
+			lp->ExcludeUnencrypted = parse_yes_no(value);
+		}
+		else if ( strcmp( key, PARM_NAME_OWN_BEACON_INTERVAL ) == 0 ) {
+			DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_OWN_BEACON_INTERVAL, value );
+
+			value_convert = wl_atoi( value );
+			if ( value_convert >= PARM_MIN_OWN_BEACON_INTERVAL ) {
+				lp->ownBeaconInterval = value_convert;
+			} else {
+				DBG_WARNING( DbgInfo, "%s invalid; will be ignored\n", PARM_NAME_OWN_BEACON_INTERVAL );
+			}
+		}
+		else if ( strcmp( key, PARM_NAME_COEXISTENCE ) == 0 ) {
+			DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_COEXISTENCE, value );
+
+			value_convert = wl_atoi( value );
+			if ( value_convert >= PARM_MIN_COEXISTENCE ) {
+				lp->coexistence = value_convert;
+			} else {
+				DBG_WARNING( DbgInfo, "%s invalid; will be ignored\n", PARM_NAME_COEXISTENCE );
+			}
+		}
+
+#ifdef USE_WDS
+		else if ( strcmp( key, PARM_NAME_RTS_THRESHOLD1 ) == 0 ) {
+			DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_RTS_THRESHOLD1, value );
+
+			value_convert = wl_atoi( value );
+			if (( value_convert >= PARM_MIN_RTS_THRESHOLD ) && ( value_convert <= PARM_MAX_RTS_THRESHOLD )) {
+				lp->wds_port[0].rtsThreshold = value_convert;
+			} else {
+				DBG_WARNING( DbgInfo, "%s invalid; will be ignored\n", PARM_NAME_RTS_THRESHOLD1 );
+			}
+		}
+		else if ( strcmp( key, PARM_NAME_RTS_THRESHOLD2 ) == 0 ) {
+			DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_RTS_THRESHOLD2, value );
+
+			value_convert = wl_atoi( value );
+			if (( value_convert >= PARM_MIN_RTS_THRESHOLD ) && ( value_convert <= PARM_MAX_RTS_THRESHOLD )) {
+				lp->wds_port[1].rtsThreshold = value_convert;
+			} else {
+				DBG_WARNING( DbgInfo, "%s invalid; will be ignored\n", PARM_NAME_RTS_THRESHOLD2 );
+			}
+		}
+		else if ( strcmp( key, PARM_NAME_RTS_THRESHOLD3 ) == 0 ) {
+			DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_RTS_THRESHOLD3, value );
+
+			value_convert = wl_atoi( value );
+			if (( value_convert >= PARM_MIN_RTS_THRESHOLD ) && ( value_convert <= PARM_MAX_RTS_THRESHOLD )) {
+				lp->wds_port[2].rtsThreshold = value_convert;
+			} else {
+				DBG_WARNING( DbgInfo, "%s invalid; will be ignored\n", PARM_NAME_RTS_THRESHOLD3 );
+			}
+		}
+		else if ( strcmp( key, PARM_NAME_RTS_THRESHOLD4 ) == 0 ) {
+			DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_RTS_THRESHOLD4, value );
+
+			value_convert = wl_atoi( value );
+			if (( value_convert >= PARM_MIN_RTS_THRESHOLD ) && ( value_convert <= PARM_MAX_RTS_THRESHOLD )) {
+				lp->wds_port[3].rtsThreshold = value_convert;
+			} else {
+				DBG_WARNING( DbgInfo, "%s invalid; will be ignored\n", PARM_NAME_RTS_THRESHOLD4 );
+			}
+		}
+		else if ( strcmp( key, PARM_NAME_RTS_THRESHOLD5 ) == 0 ) {
+			DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_RTS_THRESHOLD5, value );
+
+			value_convert = wl_atoi( value );
+			if (( value_convert >= PARM_MIN_RTS_THRESHOLD ) && ( value_convert <= PARM_MAX_RTS_THRESHOLD )) {
+				lp->wds_port[4].rtsThreshold = value_convert;
+			} else {
+				DBG_WARNING( DbgInfo, "%s invalid; will be ignored\n", PARM_NAME_RTS_THRESHOLD5 );
+			}
+		}
+		else if ( strcmp( key, PARM_NAME_RTS_THRESHOLD6 ) == 0 ) {
+			DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_RTS_THRESHOLD6, value );
+
+			value_convert = wl_atoi( value );
+			if (( value_convert >= PARM_MIN_RTS_THRESHOLD ) && ( value_convert <= PARM_MAX_RTS_THRESHOLD )) {
+				lp->wds_port[5].rtsThreshold = value_convert;
+			} else {
+				DBG_WARNING( DbgInfo, "%s invalid; will be ignored\n", PARM_NAME_RTS_THRESHOLD6 );
+			}
+		}
+		else if ( strcmp( key, PARM_NAME_TX_RATE1 ) == 0 ) {
+			DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_TX_RATE1, value );
+
+			value_convert = wl_atoi( value );
+			if (( value_convert >= PARM_MIN_TX_RATE ) && ( value_convert <= PARM_MAX_TX_RATE )) {
+				lp->wds_port[0].txRateCntl = value_convert;
+			} else {
+				DBG_WARNING( DbgInfo, "%s invalid; will be ignored\n", PARM_NAME_TX_RATE1 );
+			}
+		}
+		else if ( strcmp( key, PARM_NAME_TX_RATE2 ) == 0 ) {
+			DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_TX_RATE2, value );
+
+			value_convert = wl_atoi( value );
+			if (( value_convert >= PARM_MIN_TX_RATE ) && ( value_convert <= PARM_MAX_TX_RATE )) {
+				lp->wds_port[1].txRateCntl = value_convert;
+			} else {
+				DBG_WARNING( DbgInfo, "%s invalid; will be ignored\n", PARM_NAME_TX_RATE2 );
+			}
+		}
+		else if ( strcmp( key, PARM_NAME_TX_RATE3 ) == 0 ) {
+			DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_TX_RATE3, value );
+
+			value_convert = wl_atoi( value );
+			if (( value_convert >= PARM_MIN_TX_RATE ) && ( value_convert <= PARM_MAX_TX_RATE )) {
+				lp->wds_port[2].txRateCntl = value_convert;
+			} else {
+				DBG_WARNING( DbgInfo, "%s invalid; will be ignored\n", PARM_NAME_TX_RATE3 );
+			}
+		}
+		else if ( strcmp( key, PARM_NAME_TX_RATE4 ) == 0 ) {
+			DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_TX_RATE4, value );
+
+			value_convert = wl_atoi( value );
+			if (( value_convert >= PARM_MIN_TX_RATE ) && ( value_convert <= PARM_MAX_TX_RATE )) {
+				lp->wds_port[3].txRateCntl = value_convert;
+			} else {
+				DBG_WARNING( DbgInfo, "%s invalid; will be ignored\n", PARM_NAME_TX_RATE4 );
+			}
+		}
+		else if ( strcmp( key, PARM_NAME_TX_RATE5 ) == 0 ) {
+			DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_TX_RATE5, value );
+
+			value_convert = wl_atoi( value );
+			if (( value_convert >= PARM_MIN_TX_RATE ) && ( value_convert <= PARM_MAX_TX_RATE )) {
+				lp->wds_port[4].txRateCntl = value_convert;
+			} else {
+				DBG_WARNING( DbgInfo, "%s invalid; will be ignored\n", PARM_NAME_TX_RATE5 );
+			}
+		}
+		else if ( strcmp( key, PARM_NAME_TX_RATE6 ) == 0 ) {
+			DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_TX_RATE6, value );
+
+			value_convert = wl_atoi( value );
+			if (( value_convert >= PARM_MIN_TX_RATE ) && ( value_convert <= PARM_MAX_TX_RATE )) {
+				lp->wds_port[5].txRateCntl = value_convert;
+			} else {
+				DBG_WARNING( DbgInfo, "%s invalid; will be ignored\n", PARM_NAME_TX_RATE6 );
+			}
+		}
+		else if ( strcmp( key, PARM_NAME_WDS_ADDRESS1 ) == 0 ) {
+			DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_WDS_ADDRESS1, value );
+
+			if ( parse_mac_address( value, mac_value ) == ETH_ALEN ) {
+				memcpy( lp->wds_port[0].wdsAddress, mac_value, ETH_ALEN );
+			} else {
+				DBG_WARNING( DbgInfo, "%s invalid; will be ignored\n", PARM_NAME_WDS_ADDRESS1 );
+			}
+		}
+		else if ( strcmp( key, PARM_NAME_WDS_ADDRESS2 ) == 0 ) {
+			DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_WDS_ADDRESS2, value );
+
+			if ( parse_mac_address( value, mac_value ) == ETH_ALEN ) {
+				memcpy( lp->wds_port[1].wdsAddress, mac_value, ETH_ALEN );
+			} else {
+				DBG_WARNING( DbgInfo, "%s invalid; will be ignored\n", PARM_NAME_WDS_ADDRESS2 );
+			}
+		}
+		else if ( strcmp( key, PARM_NAME_WDS_ADDRESS3 ) == 0 ) {
+			DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_WDS_ADDRESS3, value );
+
+			if ( parse_mac_address( value, mac_value ) == ETH_ALEN ) {
+				memcpy( lp->wds_port[2].wdsAddress, mac_value, ETH_ALEN );
+			} else {
+				DBG_WARNING( DbgInfo, "%s invalid; will be ignored\n", PARM_NAME_WDS_ADDRESS3 );
+			}
+		}
+		else if ( strcmp( key, PARM_NAME_WDS_ADDRESS4 ) == 0 ) {
+			DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_WDS_ADDRESS4, value );
+
+			if ( parse_mac_address( value, mac_value ) == ETH_ALEN ) {
+				memcpy( lp->wds_port[3].wdsAddress, mac_value, ETH_ALEN );
+			} else {
+				DBG_WARNING( DbgInfo, "%s invalid; will be ignored\n", PARM_NAME_WDS_ADDRESS4 );
+			}
+		}
+		else if ( strcmp( key, PARM_NAME_WDS_ADDRESS5 ) == 0 ) {
+			DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_WDS_ADDRESS5, value );
+
+			if ( parse_mac_address( value, mac_value ) == ETH_ALEN ) {
+				memcpy( lp->wds_port[4].wdsAddress, mac_value, ETH_ALEN );
+			} else {
+				DBG_WARNING( DbgInfo, "%s invalid; will be ignored\n", PARM_NAME_WDS_ADDRESS5 );
+			}
+		}
+		else if ( strcmp( key, PARM_NAME_WDS_ADDRESS6 ) == 0 ) {
+			DBG_TRACE( DbgInfo, "%s, value: %s\n", PARM_NAME_WDS_ADDRESS6, value );
+
+			if ( parse_mac_address( value, mac_value ) == ETH_ALEN ) {
+				memcpy( lp->wds_port[5].wdsAddress, mac_value, ETH_ALEN );
+			} else {
+				DBG_WARNING( DbgInfo, "%s invalid; will be ignored\n", PARM_NAME_WDS_ADDRESS6 );
+			}
+		}
+#endif  /* USE_WDS */
+	}
+#endif  /* (HCF_TYPE) & HCF_TYPE_AP */
+
+	return;
+} // translate_option
+/*============================================================================*/
+
+/*******************************************************************************
+ *	parse_mac_address()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      This function will parse a mac address string and convert it to a byte
+ *   array.
+ *
+ *  PARAMETERS:
+ *
+ *      value       - the MAC address, represented as a string
+ *      byte_array  - the MAC address, represented as a byte array of length
+ *                    ETH_ALEN
+ *
+ *  RETURNS:
+ *
+ *      The number of bytes in the final MAC address, should equal to ETH_ALEN.
+ *
+ ******************************************************************************/
+int parse_mac_address( char *value, u_char *byte_array )
+{
+	int     value_offset = 0;
+	int     array_offset = 0;
+	int     field_offset = 0;
+	char    byte_field[3];
+	/*------------------------------------------------------------------------*/
+
+	memset( byte_field, '\0', 3 );
+
+	while( value[value_offset] != '\0' ) {
+		/* Skip over the colon chars seperating the bytes, if they exist */
+		if ( value[value_offset] == ':' ) {
+			value_offset++;
+			continue;
+		}
+
+		byte_field[field_offset] = value[value_offset];
+		field_offset++;
+		value_offset++;
+
+		/* Once the byte_field is filled, convert it and store it */
+		if ( field_offset == 2 ) {
+			byte_field[field_offset] = '\0';
+			byte_array[array_offset] = simple_strtoul( byte_field, NULL, 16 );
+			field_offset = 0;
+			array_offset++;
+		}
+	}
+
+	/* Use the array_offset as a check; 6 bytes should be written to the
+	   byte_array */
+	return array_offset;
+} // parse_mac_address
+/*============================================================================*/
+
+/*******************************************************************************
+ *	ParseConfigLine()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Parses a line from the configuration file into an L-val and an R-val,
+ *  representing a key/value pair.
+ *
+ *  PARAMETERS:
+ *
+ *      pszLine     - the line from the config file to parse
+ *      ppszLVal    - the resulting L-val (Key)
+ *      ppszRVal    - the resulting R-val (Value)
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+void ParseConfigLine( char *pszLine, char **ppszLVal, char **ppszRVal )
+{
+	int i;
+	int size;
+	/*------------------------------------------------------------------------*/
+
+	DBG_FUNC( "ParseConfigLine" );
+	DBG_ENTER( DbgInfo );
+
+	/* get a snapshot of our string size */
+	size      = strlen( pszLine );
+	*ppszLVal = NULL;
+	*ppszRVal = NULL;
+
+	if ( pszLine[0] != '#' &&							/* skip the line if it is a comment */
+		 pszLine[0] != '\n'&&							/* if it's an empty UNIX line, do nothing */
+		 !( pszLine[0] == '\r' && pszLine[1] == '\n' )	/* if it's an empty MS-DOS line, do nothing */
+	    ) {
+		/* advance past any whitespace, and assign the L-value */
+		for( i = 0; i < size; i++ ) {
+			if ( pszLine[i] != ' ' ) {
+				*ppszLVal = &pszLine[i];
+				break;
+			}
+		}
+		/* advance to the end of the l-value*/
+		for( i++; i < size; i++ ) {
+			if ( pszLine[i] == ' ' || pszLine[i] == '=' ) {
+				pszLine[i] = '\0';
+				break;
+			}
+		}
+		/* make any whitespace and the equal sign a NULL character, and
+		   advance to the R-Value */
+		for( i++; i < size; i++ ) {
+			if ( pszLine[i] == ' ' || pszLine[i] == '=' ) {
+				pszLine[i] = '\0';
+				continue;
+			}
+			*ppszRVal = &pszLine[i];
+			break;
+		}
+		/* make the line ending character(s) a NULL */
+		for( i++; i < size; i++ ) {
+			if ( pszLine[i] == '\n' ) {
+				pszLine[i] = '\0';
+			}
+			if (( pszLine[i] == '\r' ) && ( pszLine[i+1] == '\n' )) {
+				pszLine[i] = '\0';
+			}
+		}
+	}
+	DBG_LEAVE( DbgInfo );
+} // ParseConfigLine
+/*============================================================================*/
+
+#endif  // USE_PROFILE
diff --git a/drivers/staging/wlags49_h2/wl_profile.h b/drivers/staging/wlags49_h2/wl_profile.h
new file mode 100644
index 000000000000..81db8e8c6ba8
--- /dev/null
+++ b/drivers/staging/wlags49_h2/wl_profile.h
@@ -0,0 +1,87 @@
+/*******************************************************************************
+ * Agere Systems Inc.
+ * Wireless device driver for Linux (wlags49).
+ *
+ * Copyright (c) 1998-2003 Agere Systems Inc.
+ * All rights reserved.
+ *   http://www.agere.com
+ *
+ * Initially developed by TriplePoint, Inc.
+ *   http://www.triplepoint.com
+ *
+ *------------------------------------------------------------------------------
+ *
+ *   Header describing information required for the config parsing routines.
+ *
+ *------------------------------------------------------------------------------
+ *
+ * SOFTWARE LICENSE
+ *
+ * This software is provided subject to the following terms and conditions,
+ * which you should read carefully before using the software.  Using this
+ * software indicates your acceptance of these terms and conditions.  If you do
+ * not agree with these terms and conditions, do not use the software.
+ *
+ * Copyright © 2003 Agere Systems Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source or binary forms, with or without
+ * modifications, are permitted provided that the following conditions are met:
+ *
+ * . Redistributions of source code must retain the above copyright notice, this
+ *    list of conditions and the following Disclaimer as comments in the code as
+ *    well as in the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * . Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following Disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ *
+ * . Neither the name of Agere Systems Inc. nor the names of the contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * Disclaimer
+ *
+ * THIS SOFTWARE IS PROVIDED “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, INFRINGEMENT AND THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  ANY
+ * USE, MODIFICATION OR DISTRIBUTION OF THIS SOFTWARE IS SOLELY AT THE USERS OWN
+ * RISK. IN NO EVENT SHALL AGERE SYSTEMS INC. OR CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, INCLUDING, BUT NOT LIMITED TO, CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ *
+ ******************************************************************************/
+
+#ifndef __WL_PROFILE_H__
+#define __WL_PROFILE_H__
+
+
+
+
+/*******************************************************************************
+ *  constant definitions
+ ******************************************************************************/
+#define ROOT_CONFIG_FILENAME "/etc/agere/iwconfig-"
+
+
+/*******************************************************************************
+ *  function prototypes
+ ******************************************************************************/
+void parse_config( struct net_device *dev );
+
+int readline( int filedesc, char *buffer );
+
+void translate_option( char *buffer, struct wl_private *lp );
+
+int parse_mac_address( char *value, u_char *byte_array );
+
+void ParseConfigLine( char *pszLine, char **ppszLVal, char **ppszRVal );
+
+
+#endif  // __WL_PROFILE_H__
diff --git a/drivers/staging/wlags49_h2/wl_sysfs.c b/drivers/staging/wlags49_h2/wl_sysfs.c
new file mode 100644
index 000000000000..864e01a736c8
--- /dev/null
+++ b/drivers/staging/wlags49_h2/wl_sysfs.c
@@ -0,0 +1,135 @@
+/*
+ * ex: sw=4
+ */
+
+#include <linux/kernel.h>
+#include <linux/netdevice.h>
+#include <linux/if_arp.h>
+#include <net/sock.h>
+#include <linux/rtnetlink.h>
+#include <linux/wireless.h>
+#include <net/iw_handler.h>
+#include <linux/sysfs.h>
+
+#include <debug.h>
+#include <hcf.h>
+#include <hcfdef.h>
+
+#include <wl_if.h>
+#include <wl_internal.h>
+#include <wl_util.h>
+#include <wl_main.h>
+#include <wl_wext.h>
+#include <wl_priv.h>
+
+static inline int dev_isalive(const struct net_device *dev)
+{
+            return dev->reg_state == NETREG_REGISTERED;
+}
+
+/*
+ * empirically even if tallies are defined as 32 bits entities, only
+ * high 16 bits are relevant; low half is always zero. It means tallies
+ * are pretty much useless for traffic counting but at least give overview
+ * about where error come from
+ */
+static ssize_t show_tallies(struct device *d, struct device_attribute *attr,
+			    char *buf)
+{
+    struct net_device *dev = to_net_dev(d);
+    struct wl_private *lp = wl_priv(dev);
+    unsigned long flags;
+    CFG_HERMES_TALLIES_STRCT tallies;
+    ssize_t ret = -EINVAL;
+
+    read_lock(&dev_base_lock);
+    if (dev_isalive(dev)) {
+	wl_lock(lp, &flags);
+
+	if ((ret = wl_get_tallies(lp, &tallies)) == 0) {
+		wl_unlock(lp, &flags);
+		ret = snprintf(buf, PAGE_SIZE,
+		    "TxUnicastFrames:           %u\n"
+		    "TxMulticastFrames:         %u\n"
+		    "TxFragments:               %u\n"
+		    "TxUnicastOctets:           %u\n"
+		    "TxMulticastOctets:         %u\n"
+		    "TxDeferredTransmissions:   %u\n"
+		    "TxSingleRetryFrames:       %u\n"
+		    "TxMultipleRetryFrames:     %u\n"
+		    "TxRetryLimitExceeded:      %u\n"
+		    "TxDiscards:                %u\n"
+		    "RxUnicastFrames:           %u\n"
+		    "RxMulticastFrames:         %u\n"
+		    "RxFragments:               %u\n"
+		    "RxUnicastOctets:           %u\n"
+		    "RxMulticastOctets:         %u\n"
+		    "RxFCSErrors:               %u\n"
+		    "RxDiscardsNoBuffer:        %u\n"
+		    "TxDiscardsWrongSA:         %u\n"
+		    "RxWEPUndecryptable:        %u\n"
+		    "RxMsgInMsgFragments:       %u\n"
+		    "RxMsgInBadMsgFragments:    %u\n"
+		    "RxDiscardsWEPICVError:     %u\n"
+		    "RxDiscardsWEPExcluded:     %u\n"
+		    ,
+		    (unsigned int)tallies.TxUnicastFrames,
+		    (unsigned int)tallies.TxMulticastFrames,
+		    (unsigned int)tallies.TxFragments,
+		    (unsigned int)tallies.TxUnicastOctets,
+		    (unsigned int)tallies.TxMulticastOctets,
+		    (unsigned int)tallies.TxDeferredTransmissions,
+		    (unsigned int)tallies.TxSingleRetryFrames,
+		    (unsigned int)tallies.TxMultipleRetryFrames,
+		    (unsigned int)tallies.TxRetryLimitExceeded,
+		    (unsigned int)tallies.TxDiscards,
+		    (unsigned int)tallies.RxUnicastFrames,
+		    (unsigned int)tallies.RxMulticastFrames,
+		    (unsigned int)tallies.RxFragments,
+		    (unsigned int)tallies.RxUnicastOctets,
+		    (unsigned int)tallies.RxMulticastOctets,
+		    (unsigned int)tallies.RxFCSErrors,
+		    (unsigned int)tallies.RxDiscardsNoBuffer,
+		    (unsigned int)tallies.TxDiscardsWrongSA,
+		    (unsigned int)tallies.RxWEPUndecryptable,
+		    (unsigned int)tallies.RxMsgInMsgFragments,
+		    (unsigned int)tallies.RxMsgInBadMsgFragments,
+		    (unsigned int)tallies.RxDiscardsWEPICVError,
+		    (unsigned int)tallies.RxDiscardsWEPExcluded);
+	    } else {
+		wl_unlock( lp, &flags );
+	    }
+    }
+
+    read_unlock(&dev_base_lock);
+    return ret;
+}
+
+static DEVICE_ATTR(tallies, S_IRUGO, show_tallies, NULL);
+
+static struct attribute *wlags_attrs[] = {
+    &dev_attr_tallies.attr,
+    NULL
+};
+
+static struct attribute_group wlags_group = {
+    .name = "wlags",
+    .attrs = wlags_attrs,
+};
+
+void register_wlags_sysfs(struct net_device *net)
+{
+    struct device *dev = &(net->dev);
+    struct wl_private *lp = wl_priv(net);
+
+    lp->sysfsCreated = sysfs_create_group(&dev->kobj, &wlags_group);
+}
+
+void unregister_wlags_sysfs(struct net_device *net)
+{
+    struct device *dev = &(net->dev);
+    struct wl_private *lp = wl_priv(net);
+
+    if (lp->sysfsCreated)
+	sysfs_remove_group(&dev->kobj, &wlags_group);
+}
diff --git a/drivers/staging/wlags49_h2/wl_sysfs.h b/drivers/staging/wlags49_h2/wl_sysfs.h
new file mode 100644
index 000000000000..6d96d03cf490
--- /dev/null
+++ b/drivers/staging/wlags49_h2/wl_sysfs.h
@@ -0,0 +1,7 @@
+#ifdef CONFIG_SYSFS
+extern void register_wlags_sysfs(struct net_device *);
+extern void unregister_wlags_sysfs(struct net_device *);
+#else
+static void register_wlags_sysfs(struct net_device *) { return; };
+static void unregister_wlags_sysfs(struct net_device *) { return; };
+#endif
diff --git a/drivers/staging/wlags49_h2/wl_util.c b/drivers/staging/wlags49_h2/wl_util.c
new file mode 100644
index 000000000000..ac1e7f38f982
--- /dev/null
+++ b/drivers/staging/wlags49_h2/wl_util.c
@@ -0,0 +1,1587 @@
+/*******************************************************************************
+ * Agere Systems Inc.
+ * Wireless device driver for Linux (wlags49).
+ *
+ * Copyright (c) 1998-2003 Agere Systems Inc.
+ * All rights reserved.
+ *   http://www.agere.com
+ *
+ * Initially developed by TriplePoint, Inc.
+ *   http://www.triplepoint.com
+ *
+ *------------------------------------------------------------------------------
+ *
+ *   This file defines misc utility functions.
+ *
+ *------------------------------------------------------------------------------
+ *
+ * SOFTWARE LICENSE
+ *
+ * This software is provided subject to the following terms and conditions,
+ * which you should read carefully before using the software.  Using this
+ * software indicates your acceptance of these terms and conditions.  If you do
+ * not agree with these terms and conditions, do not use the software.
+ *
+ * Copyright © 2003 Agere Systems Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source or binary forms, with or without
+ * modifications, are permitted provided that the following conditions are met:
+ *
+ * . Redistributions of source code must retain the above copyright notice, this
+ *    list of conditions and the following Disclaimer as comments in the code as
+ *    well as in the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * . Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following Disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ *
+ * . Neither the name of Agere Systems Inc. nor the names of the contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * Disclaimer
+ *
+ * THIS SOFTWARE IS PROVIDED “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, INFRINGEMENT AND THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  ANY
+ * USE, MODIFICATION OR DISTRIBUTION OF THIS SOFTWARE IS SOLELY AT THE USERS OWN
+ * RISK. IN NO EVENT SHALL AGERE SYSTEMS INC. OR CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, INCLUDING, BUT NOT LIMITED TO, CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ *
+ ******************************************************************************/
+
+/*******************************************************************************
+ *  include files
+ ******************************************************************************/
+#include <wl_version.h>
+
+#include <linux/kernel.h>
+// #include <linux/sched.h>
+// #include <linux/ptrace.h>
+#include <linux/ctype.h>
+// #include <linux/string.h>
+// #include <linux/timer.h>
+// #include <linux/interrupt.h>
+// #include <linux/in.h>
+// #include <linux/delay.h>
+// #include <asm/io.h>
+// #include <asm/system.h>
+// #include <asm/bitops.h>
+
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+// #include <linux/skbuff.h>
+// #include <linux/if_arp.h>
+// #include <linux/ioport.h>
+
+#include <debug.h>
+#include <hcf.h>
+// #include <hcfdef.h>
+
+#include <wl_if.h>
+#include <wl_internal.h>
+#include <wl_util.h>
+#include <wl_wext.h>
+#include <wl_main.h>
+
+
+
+/*******************************************************************************
+ * global variables
+ ******************************************************************************/
+
+/* A matrix which maps channels to frequencies */
+#define MAX_CHAN_FREQ_MAP_ENTRIES   50
+static const long chan_freq_list[][MAX_CHAN_FREQ_MAP_ENTRIES] =
+{
+    {1,2412},
+    {2,2417},
+    {3,2422},
+    {4,2427},
+    {5,2432},
+    {6,2437},
+    {7,2442},
+    {8,2447},
+    {9,2452},
+    {10,2457},
+    {11,2462},
+    {12,2467},
+    {13,2472},
+    {14,2484},
+    {36,5180},
+    {40,5200},
+    {44,5220},
+    {48,5240},
+    {52,5260},
+    {56,5280},
+    {60,5300},
+    {64,5320},
+    {149,5745},
+    {153,5765},
+    {157,5785},
+    {161,5805}
+};
+
+#if DBG
+extern dbg_info_t *DbgInfo;
+#endif  /* DBG */
+
+
+
+
+/*******************************************************************************
+ *	dbm()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Return an energy value in dBm.
+ *
+ *  PARAMETERS:
+ *
+ *      value - the energy value to be converted
+ *
+ *  RETURNS:
+ *
+ *      the value in dBm
+ *
+ ******************************************************************************/
+int dbm( int value )
+{
+    /* Truncate the value to be between min and max. */
+    if( value < HCF_MIN_SIGNAL_LEVEL )
+        value = HCF_MIN_SIGNAL_LEVEL;
+
+    if( value > HCF_MAX_SIGNAL_LEVEL )
+        value = HCF_MAX_SIGNAL_LEVEL;
+
+    /* Return the energy value in dBm. */
+    return ( value - HCF_0DBM_OFFSET );
+} // dbm
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	percent()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Return a value as a percentage of min to max.
+ *
+ *  PARAMETERS:
+ *
+ *      value   - the value in question
+ *      min     - the minimum range value
+ *      max     - the maximum range value
+ *
+ *  RETURNS:
+ *
+ *      the percentage value
+ *
+ ******************************************************************************/
+int percent( int value, int min, int max )
+{
+    /* Truncate the value to be between min and max. */
+    if( value < min )
+        value = min;
+
+    if( value > max )
+        value = max;
+
+    /* Return the value as a percentage of min to max. */
+    return ((( value - min ) * 100 ) / ( max - min ));
+} // percent
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	is_valid_key_string()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Checks to determine if the WEP key string is valid
+ *
+ *  PARAMETERS:
+ *
+ *      s - the string in question
+ *
+ *  RETURNS:
+ *
+ *      non-zero if the string contains a valid key
+ *
+ ******************************************************************************/
+int is_valid_key_string( char *s )
+{
+    int l;
+    int i;
+    /*------------------------------------------------------------------------*/
+
+
+    l = strlen( s );
+
+    /* 0x followed by 5 or 13 hexadecimal digit pairs is valid */
+    if( s[0] == '0' && ( s[1] == 'x' || s[1] == 'X' )) {
+        if( l == 12 || l == 28 ) {
+            for( i = 2; i < l; i++ ) {
+                if( !isxdigit( s[i] ))
+                    return 0;
+            }
+
+            return 1;
+        } else {
+            return 0;
+        }
+    }
+
+    /* string with 0, 5, or 13 characters is valid */
+    else
+    {
+        return( l == 0 || l == 5 || l == 13 );
+    }
+} // is_valid_key_string
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	hexdigit2int()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Converts a hexadecimal digit character to an integer
+ *
+ *  PARAMETERS:
+ *
+ *      c   - the hexadecimal digit character
+ *
+ *  RETURNS:
+ *
+ *      the converted integer
+ *
+ ******************************************************************************/
+int hexdigit2int( char c )
+{
+   if( c >= '0' && c <= '9' )
+       return c - '0';
+
+   if( c >= 'A' && c <= 'F' )
+       return c - 'A' + 10;
+
+   if( c >= 'a' && c <= 'f' )
+       return c - 'a' + 10;
+
+   return 0;
+} // hexdigit2int
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	key_string2key()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Converts a key_string to a key, Assumes the key_string is validated with
+ *  is_valid_key_string().
+ *
+ *  PARAMETERS:
+ *
+ *      ks  - the valid key string
+ *      key - a pointer to a KEY_STRUCT where the converted key information will
+ *            be stored.
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+void key_string2key( char *ks, KEY_STRCT *key )
+{
+    int l,i,n;
+    char *p;
+    /*------------------------------------------------------------------------*/
+
+
+    l = strlen( ks );
+
+    /* 0x followed by hexadecimal digit pairs */
+    if( ks[0] == '0' && ( ks[1] == 'x' || ks[1] == 'X' )) {
+        n = 0;
+        p = (char *)key->key;
+
+        for( i = 2; i < l; i+=2 ) {
+           *p++ = ( hexdigit2int( ks[i] ) << 4 ) + hexdigit2int (ks[i+1] );
+           n++;
+        }
+
+        /* Note that endian translation of the length field is not needed here
+          because it's performed in wl_put_ltv() */
+        key->len = n;
+    }
+    /* character string */
+    else
+    {
+        strcpy( (char *)key->key, ks );
+        key->len = l;
+    }
+
+    return;
+} // key_string2key
+/*============================================================================*/
+
+
+
+
+#if DBG
+/*******************************************************************************
+ *	DbgHwAddr()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Convert a hardware ethernet address to a character string
+ *
+ *  PARAMETERS:
+ *
+ *      hwAddr  - an ethernet address
+ *
+ *  RETURNS:
+ *
+ *      a pointer to a string representing the ethernet address
+ *
+ ******************************************************************************/
+const char *DbgHwAddr(unsigned char *hwAddr)
+{
+    static char     buffer[18];
+    /*------------------------------------------------------------------------*/
+
+
+    sprintf( buffer, "%02X:%02X:%02X:%02X:%02X:%02X",
+             hwAddr[0], hwAddr[1], hwAddr[2], hwAddr[3], hwAddr[4], hwAddr[5] );
+
+    return buffer;
+} // DbgHwAddr
+/*============================================================================*/
+
+#endif /* DBG */
+
+
+
+
+/*******************************************************************************
+ *	wl_has_wep()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Checks to see if the device supports WEP
+ *
+ *  PARAMETERS:
+ *
+ *      ifbp    - the IFB pointer of the device in question
+ *
+ *  RETURNS:
+ *
+ *      1 if WEP is known enabled, else 0
+ *
+ ******************************************************************************/
+int wl_has_wep (IFBP ifbp)
+{
+    CFG_PRIVACY_OPT_IMPLEMENTED_STRCT ltv;
+	int rc, privacy;
+    /*------------------------------------------------------------------------*/
+
+
+	/* This function allows us to distiguish bronze cards from other types, to
+       know if WEP exists. Does not distinguish (because there's no way to)
+       between silver and gold cards. */
+    ltv.len = 2;
+    ltv.typ = CFG_PRIVACY_OPT_IMPLEMENTED;
+
+	rc = hcf_get_info( ifbp, (LTVP) &ltv );
+
+	privacy = CNV_LITTLE_TO_INT( ltv.privacy_opt_implemented );
+
+	//return rc ? 0 : privacy;
+    return 1;
+} // wl_has_wep
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wl_hcf_error()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Report the type of HCF error message
+ *
+ *  PARAMETERS:
+ *
+ *      none
+ *
+ *  RETURNS:
+ *
+ *      A descriptive string indicating the error, quiet otherwise.
+ *
+ ******************************************************************************/
+void wl_hcf_error( struct net_device *dev, int hcfStatus )
+{
+    char     buffer[64], *pMsg;
+    /*------------------------------------------------------------------------*/
+
+
+    if( hcfStatus != HCF_SUCCESS ) {
+        switch( hcfStatus ) {
+
+        case HCF_ERR_TIME_OUT:
+
+            pMsg = "Expected adapter event did not occur in expected time";
+            break;
+
+
+        case HCF_ERR_NO_NIC:
+
+            pMsg = "Card not found (ejected unexpectedly)";
+            break;
+
+
+        case HCF_ERR_LEN:
+
+            pMsg = "Command buffer size insufficient";
+            break;
+
+
+        case HCF_ERR_INCOMP_PRI:
+
+            pMsg = "Primary functions are not compatible";
+            break;
+
+
+        case HCF_ERR_INCOMP_FW:
+
+            pMsg = "Primary functions are compatible, "
+                "station/ap functions are not";
+            break;
+
+
+        case HCF_ERR_BUSY:
+
+            pMsg = "Inquire cmd while another Inquire in progress";
+            break;
+
+
+        //case HCF_ERR_SEQ_BUG:
+
+        //    pMsg = "Unexpected command completed";
+        //    break;
+
+
+        case HCF_ERR_DEFUNCT_AUX:
+
+            pMsg = "Timeout on ack for enable/disable of AUX registers";
+            break;
+
+
+        case HCF_ERR_DEFUNCT_TIMER:
+            pMsg = "Timeout on timer calibration during initialization process";
+            break;
+
+
+        case HCF_ERR_DEFUNCT_TIME_OUT:
+            pMsg = "Timeout on Busy bit drop during BAP setup";
+            break;
+
+
+        case HCF_ERR_DEFUNCT_CMD_SEQ:
+            pMsg = "Hermes and HCF are out of sync";
+            break;
+
+
+        default:
+
+            sprintf( buffer, "Error code %d", hcfStatus );
+            pMsg = buffer;
+            break;
+        }
+
+        printk( KERN_INFO "%s: Wireless, HCF failure: \"%s\"\n",
+                dev->name, pMsg );
+    }
+} // wl_hcf_error
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wl_endian_translate_event()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Determines what type of data is in the mailbox and performs the proper
+ *  endian translation.
+ *
+ *  PARAMETERS:
+ *
+ *      pLtv - an LTV pointer
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+void wl_endian_translate_event( ltv_t *pLtv )
+{
+    DBG_FUNC( "wl_endian_translate_event" );
+    DBG_ENTER( DbgInfo );
+
+
+    switch( pLtv->typ ) {
+    case CFG_TALLIES:
+        break;
+
+
+    case CFG_SCAN:
+        {
+            int numAPs;
+            SCAN_RS_STRCT *pAps = (SCAN_RS_STRCT*)&pLtv->u.u8[0];
+
+            numAPs = (hcf_16)(( (size_t)( pLtv->len - 1 ) * 2 ) /
+                                (sizeof( SCAN_RS_STRCT )));
+
+            while( numAPs >= 1 ) {
+                numAPs--;
+
+                pAps[numAPs].channel_id           =
+                    CNV_LITTLE_TO_INT( pAps[numAPs].channel_id );
+
+                pAps[numAPs].noise_level          =
+                    CNV_LITTLE_TO_INT( pAps[numAPs].noise_level );
+
+                pAps[numAPs].signal_level         =
+                    CNV_LITTLE_TO_INT( pAps[numAPs].signal_level );
+
+                pAps[numAPs].beacon_interval_time =
+                    CNV_LITTLE_TO_INT( pAps[numAPs].beacon_interval_time );
+
+                pAps[numAPs].capability           =
+                    CNV_LITTLE_TO_INT( pAps[numAPs].capability );
+
+                pAps[numAPs].ssid_len             =
+                    CNV_LITTLE_TO_INT( pAps[numAPs].ssid_len );
+
+                pAps[numAPs].ssid_val[pAps[numAPs].ssid_len] = 0;
+
+            }
+        }
+        break;
+
+
+    case CFG_ACS_SCAN:
+        {
+            PROBE_RESP *probe_resp = (PROBE_RESP *)pLtv;
+
+            probe_resp->frameControl   = CNV_LITTLE_TO_INT( probe_resp->frameControl );
+            probe_resp->durID          = CNV_LITTLE_TO_INT( probe_resp->durID );
+            probe_resp->sequence       = CNV_LITTLE_TO_INT( probe_resp->sequence );
+            probe_resp->dataLength     = CNV_LITTLE_TO_INT( probe_resp->dataLength );
+
+#ifndef WARP
+            probe_resp->lenType        = CNV_LITTLE_TO_INT( probe_resp->lenType );
+#endif // WARP
+
+            probe_resp->beaconInterval = CNV_LITTLE_TO_INT( probe_resp->beaconInterval );
+            probe_resp->capability     = CNV_LITTLE_TO_INT( probe_resp->capability );
+            probe_resp->flags          = CNV_LITTLE_TO_INT( probe_resp->flags );
+        }
+        break;
+
+
+    case CFG_LINK_STAT:
+#define ls ((LINK_STATUS_STRCT *)pLtv)
+            ls->linkStatus = CNV_LITTLE_TO_INT( ls->linkStatus );
+        break;
+#undef ls
+
+    case CFG_ASSOC_STAT:
+        {
+            ASSOC_STATUS_STRCT *pAs = (ASSOC_STATUS_STRCT *)pLtv;
+
+            pAs->assocStatus = CNV_LITTLE_TO_INT( pAs->assocStatus );
+        }
+        break;
+
+
+    case CFG_SECURITY_STAT:
+        {
+            SECURITY_STATUS_STRCT *pSs = (SECURITY_STATUS_STRCT *)pLtv;
+
+            pSs->securityStatus = CNV_LITTLE_TO_INT( pSs->securityStatus );
+            pSs->reason         = CNV_LITTLE_TO_INT( pSs->reason );
+        }
+        break;
+
+
+    case CFG_WMP:
+        break;
+
+
+    case CFG_NULL:
+        break;
+
+
+    default:
+        break;
+    }
+
+    DBG_LEAVE( DbgInfo );
+    return;
+} // wl_endian_translate_event
+/*============================================================================*/
+
+
+/*******************************************************************************
+ *	msf_assert()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Print statement used to display asserts from within the HCF. Only called
+ *  when asserts in the HCF are turned on. See hcfcfg.h for more information.
+ *
+ *  PARAMETERS:
+ *
+ *      file_namep  - the filename in which the assert occurred.
+ *      line_number - the line number on which the assert occurred.
+ *      trace       - a comment associated with the assert.
+ *      qual        - return code or other value related to the assert
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+void msf_assert( unsigned int line_number, hcf_16 trace, hcf_32 qual )
+{
+    DBG_PRINT( "HCF ASSERT: Line %d, VAL: 0x%.8x\n", line_number, /*;?*/(u32)qual );
+} // msf_assert
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wl_parse_ds_ie()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      This function parses the Direct Sequence Parameter Set IE, used to
+ *      determine channel/frequency information.
+ *
+ *  PARAMETERS:
+ *
+ *      probe_rsp - a pointer to a PROBE_RESP structure containing the probe
+ *                  response.
+ *
+ *  RETURNS:
+ *
+ *      The channel on which the BSS represented by this probe response is
+ *      transmitting.
+ *
+ ******************************************************************************/
+hcf_8 wl_parse_ds_ie( PROBE_RESP *probe_rsp )
+{
+    int     i;
+    int     ie_length = 0;
+    hcf_8   *buf;
+    hcf_8   buf_size;
+    /*------------------------------------------------------------------------*/
+
+
+    if( probe_rsp == NULL ) {
+        return 0;
+    }
+
+    buf      = probe_rsp->rawData;
+    buf_size = sizeof( probe_rsp->rawData );
+
+
+    for( i = 0; i < buf_size; i++ ) {
+        if( buf[i] == DS_INFO_ELEM ) {
+            /* Increment by 1 to get the length, and test it; in a DS element,
+               length should always be 1 */
+            i++;
+            ie_length = buf[i];
+
+            if( buf[i] == 1 ) {
+                /* Get the channel information */
+                i++;
+                return buf[i];
+            }
+        }
+    }
+
+    /* If we get here, we didn't find a DS-IE, which is strange */
+    return 0;
+} // wl_parse_ds_ie
+
+
+/*******************************************************************************
+ *	wl_parse_wpa_ie()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      This function parses the Probe Response for a valid WPA-IE.
+ *
+ *  PARAMETERS:
+ *
+ *      probe_rsp - a pointer to a PROBE_RESP structure containing the probe
+ *                  response
+ *      length    - a pointer to an hcf_16 in which the size of the WPA-IE will
+ *                  be stored (if found).
+ *
+ *  RETURNS:
+ *
+ *      A pointer to the location in the probe response buffer where a valid
+ *      WPA-IE lives. The length of this IE is written back to the 'length'
+ *      argument passed to the function.
+ *
+ ******************************************************************************/
+hcf_8 * wl_parse_wpa_ie( PROBE_RESP *probe_rsp, hcf_16 *length )
+{
+    int     i;
+    int     ie_length = 0;
+    hcf_8   *buf;
+    hcf_8   buf_size;
+    hcf_8   wpa_oui[] = WPA_OUI_TYPE;
+    /*------------------------------------------------------------------------*/
+
+
+    if( probe_rsp == NULL || length == NULL ) {
+        return NULL;
+    }
+
+    buf      = probe_rsp->rawData;
+    buf_size = sizeof( probe_rsp->rawData );
+    *length  = 0;
+
+
+    for( i = 0; i < buf_size; i++ ) {
+        if( buf[i] == GENERIC_INFO_ELEM ) {
+            /* Increment by one to get the IE length */
+            i++;
+            ie_length = probe_rsp->rawData[i];
+
+            /* Increment by one to point to the IE payload */
+            i++;
+
+            /* Does the IE contain a WPA OUI? If not, it's a proprietary IE */
+            if( memcmp( &buf[i], &wpa_oui, WPA_SELECTOR_LEN ) == 0 ) {
+                /* Pass back length and return a pointer to the WPA-IE */
+                /* NOTE: Length contained in the WPA-IE is only the length of
+                   the payload. The entire WPA-IE, including the IE identifier
+                   and the length, is 2 bytes larger */
+                *length = ie_length + 2;
+
+                /* Back up the pointer 2 bytes to include the IE identifier and
+                   the length in the buffer returned */
+                i -= 2;
+                return &buf[i];
+            }
+
+            /* Increment past this non-WPA IE and continue looking */
+            i += ( ie_length - 1 );
+        }
+    }
+
+    /* If we're here, we didn't find a WPA-IE in the buffer */
+    return NULL;
+} // wl_parse_wpa_ie
+
+
+/*******************************************************************************
+ *	wl_print_wpa_ie()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Function used to take a WPA Information Element (WPA-IE) buffer and
+ *      display it in a readable format.
+ *
+ *  PARAMETERS:
+ *
+ *      buffer - the byte buffer containing the WPA-IE
+ *      length - the length of the above buffer
+ *
+ *  RETURNS:
+ *
+ *      A pointer to the formatted WPA-IE string. Note that the format used is
+ *      byte-by-byte printing as %02x hex values with no spaces. This is
+ *      required for proper operation with some WPA supplicants.
+ *
+ ******************************************************************************/
+hcf_8 * wl_print_wpa_ie( hcf_8 *buffer, int length )
+{
+    int count;
+    int rows;
+    int remainder;
+    int rowsize = 4;
+    hcf_8 row_buf[64];
+    static hcf_8 output[512];
+    /*------------------------------------------------------------------------*/
+
+
+    memset( output, 0, sizeof( output ));
+    memset( row_buf, 0, sizeof( row_buf ));
+
+
+    /* Determine how many rows will be needed, and the remainder */
+    rows = length / rowsize;
+    remainder = length % rowsize;
+
+
+    /* Format the rows */
+    for( count = 0; count < rows; count++ ) {
+        sprintf( row_buf, "%02x%02x%02x%02x",
+                 buffer[count*rowsize], buffer[count*rowsize+1],
+                 buffer[count*rowsize+2], buffer[count*rowsize+3]);
+        strcat( output, row_buf );
+    }
+
+    memset( row_buf, 0, sizeof( row_buf ));
+
+
+    /* Format the remainder */
+    for( count = 0; count < remainder; count++ ) {
+        sprintf( row_buf, "%02x", buffer[(rows*rowsize)+count]);
+        strcat( output, row_buf );
+    }
+
+    return output;
+} // wl_print_wpa_ie
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wl_is_a_valid_chan()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Checks if a given channel is valid
+ *
+ *  PARAMETERS:
+ *
+ *      channel - the channel
+ *
+ *  RETURNS:
+ *
+ *      1 if TRUE
+ *      0 if FALSE
+ *
+ ******************************************************************************/
+int wl_is_a_valid_chan( int channel )
+{
+    int i;
+    /*------------------------------------------------------------------------*/
+
+
+    /* Strip out the high bit set by the FW for 802.11a channels */
+    if( channel & 0x100 ) {
+        channel = channel & 0x0FF;
+    }
+
+    /* Iterate through the matrix and retrieve the frequency */
+    for( i = 0; i < MAX_CHAN_FREQ_MAP_ENTRIES; i++ ) {
+        if( chan_freq_list[i][0] == channel ) {
+            return 1;
+        }
+    }
+
+    return 0;
+} // wl_is_a_valid_chan
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wl_get_chan_from_freq()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Checks if a given frequency is valid
+ *
+ *  PARAMETERS:
+ *
+ *      freq - the frequency
+ *
+ *  RETURNS:
+ *
+ *      1 if TRUE
+ *      0 if FALSE
+ *
+ ******************************************************************************/
+int wl_is_a_valid_freq( long frequency )
+{
+    int i;
+    /*------------------------------------------------------------------------*/
+
+
+    /* Iterate through the matrix and retrieve the channel */
+    for( i = 0; i < MAX_CHAN_FREQ_MAP_ENTRIES; i++ ) {
+        if( chan_freq_list[i][1] == frequency ) {
+            return 1;
+        }
+    }
+
+    return 0;
+} // wl_is_a_valid_freq
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wl_get_freq_from_chan()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Function used to look up the frequency for a given channel on which the
+ *      adapter is Tx/Rx.
+ *
+ *  PARAMETERS:
+ *
+ *      channel - the channel
+ *
+ *  RETURNS:
+ *
+ *      The corresponding frequency
+ *
+ ******************************************************************************/
+long wl_get_freq_from_chan( int channel )
+{
+    int i;
+    /*------------------------------------------------------------------------*/
+
+
+    /* Strip out the high bit set by the FW for 802.11a channels */
+    if( channel & 0x100 ) {
+        channel = channel & 0x0FF;
+    }
+
+    /* Iterate through the matrix and retrieve the frequency */
+    for( i = 0; i < MAX_CHAN_FREQ_MAP_ENTRIES; i++ ) {
+        if( chan_freq_list[i][0] == channel ) {
+            return chan_freq_list[i][1];
+        }
+    }
+
+    return 0;
+} // wl_get_freq_from_chan
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wl_get_chan_from_freq()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Function used to look up the channel for a given frequency on which the
+ *      adapter is Tx/Rx.
+ *
+ *  PARAMETERS:
+ *
+ *      frequency - the frequency
+ *
+ *  RETURNS:
+ *
+ *      The corresponding channel
+ *
+ ******************************************************************************/
+int wl_get_chan_from_freq( long frequency )
+{
+    int i;
+    /*------------------------------------------------------------------------*/
+
+
+    /* Iterate through the matrix and retrieve the channel */
+    for( i = 0; i < MAX_CHAN_FREQ_MAP_ENTRIES; i++ ) {
+        if( chan_freq_list[i][1] == frequency ) {
+            return chan_freq_list[i][0];
+        }
+    }
+
+    return 0;
+} // wl_get_chan_from_freq
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wl_process_link_status()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Process the link status message signaled by the device.
+ *
+ *  PARAMETERS:
+ *
+ *      lp - a pointer to the device's private structure
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+void wl_process_link_status( struct wl_private *lp )
+{
+    hcf_16 link_stat;
+    /*------------------------------------------------------------------------*/
+
+    DBG_FUNC( "wl_process_link_status" );
+    DBG_ENTER( DbgInfo );
+
+    if( lp != NULL ) {
+        //link_stat = lp->hcfCtx.IFB_DSLinkStat & CFG_LINK_STAT_FW;
+        link_stat = lp->hcfCtx.IFB_LinkStat & CFG_LINK_STAT_FW;
+        switch( link_stat ) {
+        case 1:
+            DBG_TRACE( DbgInfo, "Link Status : Connected\n" );
+            wl_wext_event_ap( lp->dev );
+            break;
+        case 2:
+            DBG_TRACE( DbgInfo, "Link Status : Disconnected\n"  );
+            break;
+        case 3:
+            DBG_TRACE( DbgInfo, "Link Status : Access Point Change\n" );
+            break;
+        case 4:
+            DBG_TRACE( DbgInfo, "Link Status : Access Point Out of Range\n" );
+            break;
+        case 5:
+            DBG_TRACE( DbgInfo, "Link Status : Access Point In Range\n" );
+            break;
+        default:
+            DBG_TRACE( DbgInfo, "Link Status : UNKNOWN (0x%04x)\n", link_stat );
+            break;
+        }
+    }
+    DBG_LEAVE( DbgInfo );
+    return;
+} // wl_process_link_status
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wl_process_probe_response()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Process the probe responses retunred by the device as a result of an
+ *      active scan.
+ *
+ *  PARAMETERS:
+ *
+ *      lp - a pointer to the device's private structure
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+void wl_process_probe_response( struct wl_private *lp )
+{
+    PROBE_RESP  *probe_rsp;
+    hcf_8       *wpa_ie = NULL;
+    hcf_16      wpa_ie_len = 0;
+    /*------------------------------------------------------------------------*/
+
+
+    DBG_FUNC( "wl_process_probe_response" );
+    DBG_ENTER( DbgInfo );
+
+
+    if( lp != NULL ) {
+        probe_rsp = (PROBE_RESP *)&lp->ProbeResp;
+
+        wl_endian_translate_event( (ltv_t *)probe_rsp );
+
+        DBG_TRACE( DbgInfo, "(%s) =========================\n", lp->dev->name );
+        DBG_TRACE( DbgInfo, "(%s) length      : 0x%04x.\n",  lp->dev->name,
+                probe_rsp->length );
+
+        if( probe_rsp->length > 1 ) {
+            DBG_TRACE( DbgInfo, "(%s) infoType    : 0x%04x.\n", lp->dev->name,
+                    probe_rsp->infoType );
+
+            DBG_TRACE( DbgInfo, "(%s) signal      : 0x%02x.\n", lp->dev->name,
+                    probe_rsp->signal );
+
+            DBG_TRACE( DbgInfo, "(%s) silence     : 0x%02x.\n", lp->dev->name,
+                    probe_rsp->silence );
+
+            DBG_TRACE( DbgInfo, "(%s) rxFlow      : 0x%02x.\n", lp->dev->name,
+                    probe_rsp->rxFlow );
+
+            DBG_TRACE( DbgInfo, "(%s) rate        : 0x%02x.\n", lp->dev->name,
+                    probe_rsp->rate );
+
+            DBG_TRACE( DbgInfo, "(%s) frame cntl  : 0x%04x.\n", lp->dev->name,
+                    probe_rsp->frameControl );
+
+            DBG_TRACE( DbgInfo, "(%s) durID       : 0x%04x.\n", lp->dev->name,
+                    probe_rsp->durID );
+
+            DBG_TRACE( DbgInfo, "(%s) address1    : %s\n", lp->dev->name,
+                    DbgHwAddr( probe_rsp->address1 ));
+
+            DBG_TRACE( DbgInfo, "(%s) address2    : %s\n", lp->dev->name,
+                    DbgHwAddr( probe_rsp->address2 ));
+
+            DBG_TRACE( DbgInfo, "(%s) BSSID       : %s\n", lp->dev->name,
+                    DbgHwAddr( probe_rsp->BSSID ));
+
+            DBG_TRACE( DbgInfo, "(%s) sequence    : 0x%04x.\n", lp->dev->name,
+                    probe_rsp->sequence );
+
+            DBG_TRACE( DbgInfo, "(%s) address4    : %s\n", lp->dev->name,
+                    DbgHwAddr( probe_rsp->address4 ));
+
+            DBG_TRACE( DbgInfo, "(%s) datalength  : 0x%04x.\n", lp->dev->name,
+                    probe_rsp->dataLength );
+
+            DBG_TRACE( DbgInfo, "(%s) DA          : %s\n", lp->dev->name,
+                    DbgHwAddr( probe_rsp->DA ));
+
+            DBG_TRACE( DbgInfo, "(%s) SA          : %s\n", lp->dev->name,
+                    DbgHwAddr( probe_rsp->SA ));
+
+#ifdef WARP
+
+            DBG_TRACE( DbgInfo, "(%s) channel     : %d\n", lp->dev->name,
+                    probe_rsp->channel );
+
+            DBG_TRACE( DbgInfo, "(%s) band        : %d\n", lp->dev->name,
+                    probe_rsp->band );
+#else
+            DBG_TRACE( DbgInfo, "(%s) lenType     : 0x%04x.\n", lp->dev->name,
+                    probe_rsp->lenType );
+#endif  // WARP
+
+            DBG_TRACE( DbgInfo, "(%s) timeStamp   : %d.%d.%d.%d.%d.%d.%d.%d\n",
+                    lp->dev->name,
+                    probe_rsp->timeStamp[0],
+                    probe_rsp->timeStamp[1],
+                    probe_rsp->timeStamp[2],
+                    probe_rsp->timeStamp[3],
+                    probe_rsp->timeStamp[4],
+                    probe_rsp->timeStamp[5],
+                    probe_rsp->timeStamp[6],
+                    probe_rsp->timeStamp[7]);
+
+            DBG_TRACE( DbgInfo, "(%s) beaconInt   : 0x%04x.\n", lp->dev->name,
+                    probe_rsp->beaconInterval );
+
+            DBG_TRACE( DbgInfo, "(%s) capability  : 0x%04x.\n", lp->dev->name,
+                    probe_rsp->capability );
+
+            DBG_TRACE( DbgInfo, "(%s) SSID len    : 0x%04x.\n", lp->dev->name,
+                    probe_rsp->rawData[1] );
+
+
+            if( probe_rsp->rawData[1] > 0 ) {
+                char ssid[HCF_MAX_NAME_LEN];
+
+                memset( ssid, 0, sizeof( ssid ));
+                strncpy( ssid, &probe_rsp->rawData[2],
+                            probe_rsp->rawData[1] );
+
+                DBG_TRACE( DbgInfo, "(%s) SSID        : %s\n",
+                            lp->dev->name, ssid );
+            }
+
+
+            /* Parse out the WPA-IE, if one exists */
+            wpa_ie = wl_parse_wpa_ie( probe_rsp, &wpa_ie_len );
+            if( wpa_ie != NULL ) {
+                DBG_TRACE( DbgInfo, "(%s) WPA-IE      : %s\n",
+                lp->dev->name, wl_print_wpa_ie( wpa_ie, wpa_ie_len ));
+            }
+
+            DBG_TRACE( DbgInfo, "(%s) flags       : 0x%04x.\n",
+                        lp->dev->name, probe_rsp->flags );
+        }
+
+        DBG_TRACE( DbgInfo, "\n" );
+
+
+        /* If probe response length is 1, then the scan is complete */
+        if( probe_rsp->length == 1 ) {
+            DBG_TRACE( DbgInfo, "SCAN COMPLETE\n" );
+            lp->probe_results.num_aps = lp->probe_num_aps;
+            lp->probe_results.scan_complete = TRUE;
+
+            /* Reset the counter for the next scan request */
+            lp->probe_num_aps = 0;
+
+            /* Send a wireless extensions event that the scan completed */
+            wl_wext_event_scan_complete( lp->dev );
+        } else {
+            /* Only copy to the table if the entry is unique; APs sometimes
+                respond more than once to a probe */
+            if( lp->probe_num_aps == 0 ) {
+                /* Copy the info to the ScanResult structure in the private
+                adapter struct */
+                memcpy( &( lp->probe_results.ProbeTable[lp->probe_num_aps] ),
+                        probe_rsp, sizeof( PROBE_RESP ));
+
+                /* Increment the number of APs detected */
+                lp->probe_num_aps++;
+            } else {
+                int count;
+                int unique = 1;
+
+                for( count = 0; count < lp->probe_num_aps; count++ ) {
+                    if( memcmp( &( probe_rsp->BSSID ),
+                        lp->probe_results.ProbeTable[count].BSSID,
+                        ETH_ALEN ) == 0 ) {
+                        unique = 0;
+                    }
+                }
+
+                if( unique ) {
+                    /* Copy the info to the ScanResult structure in the
+                    private adapter struct. Only copy if there's room in the
+                    table */
+                    if( lp->probe_num_aps < MAX_NAPS )
+                    {
+                        memcpy( &( lp->probe_results.ProbeTable[lp->probe_num_aps] ),
+                                probe_rsp, sizeof( PROBE_RESP ));
+                    }
+                    else
+                    {
+                        DBG_WARNING( DbgInfo, "Num of scan results exceeds storage, truncating\n" );
+                    }
+
+                    /* Increment the number of APs detected. Note I do this
+                        here even when I don't copy the probe response to the
+                        buffer in order to detect the overflow condition */
+                    lp->probe_num_aps++;
+                }
+            }
+        }
+    }
+
+    DBG_LEAVE( DbgInfo );
+    return;
+} // wl_process_probe_response
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wl_process_updated_record()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Process the updated information record message signaled by the device.
+ *
+ *  PARAMETERS:
+ *
+ *      lp - a pointer to the device's private structure
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+void wl_process_updated_record( struct wl_private *lp )
+{
+    DBG_FUNC( "wl_process_updated_record" );
+    DBG_ENTER( DbgInfo );
+
+
+    if( lp != NULL ) {
+        lp->updatedRecord.u.u16[0] = CNV_LITTLE_TO_INT( lp->updatedRecord.u.u16[0] );
+
+        switch( lp->updatedRecord.u.u16[0] ) {
+        case CFG_CUR_COUNTRY_INFO:
+            DBG_TRACE( DbgInfo, "Updated Record: CFG_CUR_COUNTRY_INFO\n" );
+            wl_connect( lp );
+            break;
+
+        case CFG_PORT_STAT:
+            DBG_TRACE( DbgInfo, "Updated Record: WAIT_FOR_CONNECT (0xFD40)\n" );
+            //wl_connect( lp );
+            break;
+
+        default:
+            DBG_TRACE( DbgInfo, "UNKNOWN: 0x%04x\n",
+                       lp->updatedRecord.u.u16[0] );
+        }
+    }
+
+    DBG_LEAVE( DbgInfo );
+    return;
+} // wl_process_updated_record
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wl_process_assoc_status()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Process the association status event signaled by the device.
+ *
+ *  PARAMETERS:
+ *
+ *      lp - a pointer to the device's private structure
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+void wl_process_assoc_status( struct wl_private *lp )
+{
+    ASSOC_STATUS_STRCT *assoc_stat;
+    /*------------------------------------------------------------------------*/
+
+
+    DBG_FUNC( "wl_process_assoc_status" );
+    DBG_ENTER( DbgInfo );
+
+
+    if( lp != NULL ) {
+        assoc_stat = (ASSOC_STATUS_STRCT *)&lp->assoc_stat;
+
+        wl_endian_translate_event( (ltv_t *)assoc_stat );
+
+        switch( assoc_stat->assocStatus ) {
+        case 1:
+            DBG_TRACE( DbgInfo, "Association Status : STA Associated\n" );
+            break;
+
+        case 2:
+            DBG_TRACE( DbgInfo, "Association Status : STA Reassociated\n" );
+            break;
+
+        case 3:
+            DBG_TRACE( DbgInfo, "Association Status : STA Disassociated\n" );
+            break;
+
+        default:
+            DBG_TRACE( DbgInfo, "Association Status : UNKNOWN (0x%04x)\n",
+                        assoc_stat->assocStatus );
+            break;
+        }
+
+        DBG_TRACE( DbgInfo, "STA Address        : %s\n",
+                    DbgHwAddr( assoc_stat->staAddr ));
+
+        if(( assoc_stat->assocStatus == 2 )  && ( assoc_stat->len == 8 )) {
+            DBG_TRACE( DbgInfo, "Old AP Address     : %s\n",
+                        DbgHwAddr( assoc_stat->oldApAddr ));
+        }
+    }
+
+    DBG_LEAVE( DbgInfo );
+    return;
+} // wl_process_assoc_status
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wl_process_security_status()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Process the security status message signaled by the device.
+ *
+ *  PARAMETERS:
+ *
+ *      lp - a pointer to the device's private structure
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+void wl_process_security_status( struct wl_private *lp )
+{
+    SECURITY_STATUS_STRCT *sec_stat;
+    /*------------------------------------------------------------------------*/
+
+
+    DBG_FUNC( "wl_process_security_status" );
+    DBG_ENTER( DbgInfo );
+
+
+    if( lp != NULL ) {
+        sec_stat = (SECURITY_STATUS_STRCT *)&lp->sec_stat;
+
+        wl_endian_translate_event( (ltv_t *)sec_stat );
+
+        switch( sec_stat->securityStatus ) {
+        case 1:
+            DBG_TRACE( DbgInfo, "Security Status : Dissassociate [AP]\n" );
+            break;
+
+        case 2:
+            DBG_TRACE( DbgInfo, "Security Status : Deauthenticate [AP]\n" );
+            break;
+
+        case 3:
+            DBG_TRACE( DbgInfo, "Security Status : Authenticate Fail [STA] or [AP]\n" );
+            break;
+
+        case 4:
+            DBG_TRACE( DbgInfo, "Security Status : MIC Fail\n" );
+            break;
+
+        case 5:
+            DBG_TRACE( DbgInfo, "Security Status : Associate Fail\n" );
+            break;
+
+        default:
+            DBG_TRACE( DbgInfo, "Security Status : UNKNOWN (0x%04x)\n",
+                        sec_stat->securityStatus );
+            break;
+        }
+
+        DBG_TRACE( DbgInfo, "STA Address     : %s\n",
+                   DbgHwAddr( sec_stat->staAddr ));
+        DBG_TRACE( DbgInfo, "Reason          : 0x%04x \n", sec_stat->reason );
+
+    }
+
+    DBG_LEAVE( DbgInfo );
+    return;
+} // wl_process_security_status
+/*============================================================================*/
+
+int wl_get_tallies(struct wl_private *lp,
+		   CFG_HERMES_TALLIES_STRCT *tallies)
+{
+    int ret = 0;
+    int status;
+    CFG_HERMES_TALLIES_STRCT *pTallies;
+
+    DBG_FUNC( "wl_get_tallies" );
+    DBG_ENTER(DbgInfo);
+
+    /* Get the current tallies from the adapter */
+    lp->ltvRecord.len = 1 + HCF_TOT_TAL_CNT * sizeof(hcf_16);
+    lp->ltvRecord.typ = CFG_TALLIES;
+
+    status = hcf_get_info(&(lp->hcfCtx), (LTVP)&(lp->ltvRecord));
+
+    if( status == HCF_SUCCESS ) {
+	pTallies = (CFG_HERMES_TALLIES_STRCT *)&(lp->ltvRecord.u.u32);
+	memcpy(tallies, pTallies, sizeof(*tallies));
+    	DBG_TRACE( DbgInfo, "Get tallies okay, dixe: %d\n", sizeof(*tallies) );
+    } else {
+    	DBG_TRACE( DbgInfo, "Get tallies failed\n" );
+	ret = -EFAULT;
+    }
+
+    DBG_LEAVE( DbgInfo );
+
+    return ret;
+}
+
+/*******************************************************************************
+ *	wl_atoi()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Believe it or not, we need our own implementation of atoi in the kernel.
+ *
+ *  PARAMETERS:
+ *
+ *      string  - the ASCII string to convert to an integer
+ *
+ *  RETURNS:
+ *
+ *      unsigned integer
+ *
+ ******************************************************************************/
+unsigned int wl_atoi( char *string )
+{
+unsigned int base = 10;				//default to decimal
+unsigned int value = 0;
+unsigned int c;
+int i = strlen( string );
+
+	if ( i > 2 && string[0] == '0' && ( string[1] | ('X'^'x') ) == 'x' ) {
+		base = 16;
+		string +=2;
+	}
+	while ( ( c = *string++ ) != '\0' ) {
+		if ( value > UINT_MAX / base ) {	//test for overrun
+			DBG_FUNC( "wl_atoi" );	//don't overload the log file with good messages
+			DBG_ENTER( DbgInfo );
+			DBG_ERROR( DbgInfo, "string \"%s\", lenght exceeds expectations\n", string );
+			printk( "<1>string \"%s\", lenght exceeds expectations\n", string );
+			DBG_LEAVE( DbgInfo );
+			break;
+		}
+		c -= '0';
+		if ( 0 <= c && c <= 9 ) value = base * value + c;
+		else if ( base == 16 ) {
+			c += '0';
+			c |= 'A'^'a';
+			c = c - 'a'+ 10;
+			if ( 10 <= c && c <= 15 ) value = base * value + c;
+		}
+	}
+	return value;
+} // wl_atoi
+
diff --git a/drivers/staging/wlags49_h2/wl_util.h b/drivers/staging/wlags49_h2/wl_util.h
new file mode 100644
index 000000000000..16cd6c578adb
--- /dev/null
+++ b/drivers/staging/wlags49_h2/wl_util.h
@@ -0,0 +1,105 @@
+/*******************************************************************************
+ * Agere Systems Inc.
+ * Wireless device driver for Linux (wlags49).
+ *
+ * Copyright (c) 1998-2003 Agere Systems Inc.
+ * All rights reserved.
+ *   http://www.agere.com
+ *
+ * Initially developed by TriplePoint, Inc.
+ *   http://www.triplepoint.com
+ *
+ *------------------------------------------------------------------------------
+ *
+ *   Header describing information required for utility functions used
+ *   throughout the driver.
+ *
+ *------------------------------------------------------------------------------
+ *
+ * SOFTWARE LICENSE
+ *
+ * This software is provided subject to the following terms and conditions,
+ * which you should read carefully before using the software.  Using this
+ * software indicates your acceptance of these terms and conditions.  If you do
+ * not agree with these terms and conditions, do not use the software.
+ *
+ * Copyright © 2003 Agere Systems Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source or binary forms, with or without
+ * modifications, are permitted provided that the following conditions are met:
+ *
+ * . Redistributions of source code must retain the above copyright notice, this
+ *    list of conditions and the following Disclaimer as comments in the code as
+ *    well as in the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * . Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following Disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ *
+ * . Neither the name of Agere Systems Inc. nor the names of the contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * Disclaimer
+ *
+ * THIS SOFTWARE IS PROVIDED “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, INFRINGEMENT AND THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  ANY
+ * USE, MODIFICATION OR DISTRIBUTION OF THIS SOFTWARE IS SOLELY AT THE USERS OWN
+ * RISK. IN NO EVENT SHALL AGERE SYSTEMS INC. OR CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, INCLUDING, BUT NOT LIMITED TO, CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ *
+ ******************************************************************************/
+
+#ifndef __WL_UTIL_H__
+#define __WL_UTIL_H__
+
+/*******************************************************************************
+ *  function prototypes
+ ******************************************************************************/
+int dbm( int value );
+
+int is_valid_key_string( char *s );
+
+void key_string2key( char *ks, KEY_STRCT *key );
+
+int hexdigit2int( char c );
+
+void wl_hcf_error( struct net_device *dev, int hcfStatus );
+
+void wl_endian_translate_event( ltv_t *pLtv );
+
+int wl_has_wep( IFBP ifbp );
+
+
+#if DBG
+const char *DbgHwAddr( unsigned char *hwAddr );
+#endif // DBG
+
+hcf_8   wl_parse_ds_ie( PROBE_RESP *probe_rsp );
+hcf_8 * wl_parse_wpa_ie( PROBE_RESP *probe_rsp, hcf_16 *length );
+hcf_8 * wl_print_wpa_ie( hcf_8 *buffer, int length );
+
+int wl_get_tallies(struct wl_private *, CFG_HERMES_TALLIES_STRCT *);
+int wl_is_a_valid_chan( int channel );
+int wl_is_a_valid_freq( long frequency );
+long wl_get_freq_from_chan( int channel );
+int wl_get_chan_from_freq( long frequency );
+
+void wl_process_link_status( struct wl_private *lp );
+void wl_process_probe_response( struct wl_private *lp );
+void wl_process_updated_record( struct wl_private *lp );
+void wl_process_assoc_status( struct wl_private *lp );
+void wl_process_security_status( struct wl_private *lp );
+
+unsigned int wl_atoi( char *string );
+
+#endif  // __WL_UTIL_H__
diff --git a/drivers/staging/wlags49_h2/wl_version.h b/drivers/staging/wlags49_h2/wl_version.h
new file mode 100644
index 000000000000..a5e604cd1983
--- /dev/null
+++ b/drivers/staging/wlags49_h2/wl_version.h
@@ -0,0 +1,179 @@
+/*******************************************************************************
+ * Agere Systems Inc.
+ * Wireless device driver for Linux (wlags49).
+ *
+ * Copyright (c) 1998-2003 Agere Systems Inc.
+ * All rights reserved.
+ *   http://www.agere.com
+ *
+ * Initially developed by TriplePoint, Inc.
+ *   http://www.triplepoint.com
+ *
+ *------------------------------------------------------------------------------
+ *
+ *   This header file contains version information for the code base, as well as
+ *   special definitions and macros needed by certain versions of the code.
+ *
+ *------------------------------------------------------------------------------
+ *
+ * SOFTWARE LICENSE
+ *
+ * This software is provided subject to the following terms and conditions,
+ * which you should read carefully before using the software.  Using this
+ * software indicates your acceptance of these terms and conditions.  If you do
+ * not agree with these terms and conditions, do not use the software.
+ *
+ * Copyright © 2003 Agere Systems Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source or binary forms, with or without
+ * modifications, are permitted provided that the following conditions are met:
+ *
+ * . Redistributions of source code must retain the above copyright notice, this
+ *    list of conditions and the following Disclaimer as comments in the code as
+ *    well as in the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * . Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following Disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ *
+ * . Neither the name of Agere Systems Inc. nor the names of the contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * Disclaimer
+ *
+ * THIS SOFTWARE IS PROVIDED “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, INFRINGEMENT AND THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  ANY
+ * USE, MODIFICATION OR DISTRIBUTION OF THIS SOFTWARE IS SOLELY AT THE USERS OWN
+ * RISK. IN NO EVENT SHALL AGERE SYSTEMS INC. OR CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, INCLUDING, BUT NOT LIMITED TO, CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ *
+ ******************************************************************************/
+
+#ifndef __WL_VERSION_H__
+#define __WL_VERSION_H__
+
+/*******************************************************************************
+ *  include files
+ ******************************************************************************/
+//#include <linux/config.h>
+#include <linux/version.h>
+
+#ifndef CONFIG_MODVERSIONS
+#define __NO_VERSION__
+#endif  // CONFIG_MODVERSIONS
+
+/*******************************************************************************
+ *  constant definitions
+ ******************************************************************************/
+
+#define VENDOR_NAME         "Agere Systems, http://www.agere.com"
+
+#define DRIVER_NAME         "wlags49"
+#define DRV_IDENTITY        49
+
+#define DRV_MAJOR_VERSION   7
+#define DRV_MINOR_VERSION   22
+#define DRV_VERSION_STR     "7.22"
+
+
+#if defined BUS_PCMCIA
+#define BUS_TYPE            "PCMCIA"
+#elif defined BUS_PCI
+#define BUS_TYPE            "PCI"
+#else
+err: define bus type;
+#endif  // BUS_XXX
+
+#if defined HERMES25
+#define HW_TYPE				"HII.5"
+#else
+#define HW_TYPE				"HII"
+#endif // HERMES25
+
+#if defined WARP
+#define FW_TYPE				"WARP"
+#else
+#define FW_TYPE				"BEAGLE"
+#endif // WARP
+
+#if defined HERMES25
+#if defined WARP
+#define DRV_VARIANT         3
+#else
+#define DRV_VARIANT         4
+#endif // WARP
+#else
+#define DRV_VARIANT         2
+#endif // HERMES25
+
+#ifdef BUS_PCMCIA
+#if defined HERMES25
+#define MODULE_NAME         DRIVER_NAME "_h25_cs"
+#else
+#define MODULE_NAME         DRIVER_NAME "_h2_cs"
+#endif  /* HERMES25 */
+#elif defined BUS_PCI
+#if defined HERMES25
+#define MODULE_NAME         DRIVER_NAME "_h25"
+#else
+#define MODULE_NAME         DRIVER_NAME "_h2"
+#endif  /* HERMES25 */
+#endif  /* BUS_XXX */
+
+#ifdef DBG
+#define MODULE_DATE         __DATE__ " " __TIME__
+#else
+#define MODULE_DATE         "07/18/2004 13:30:00"
+#endif // DBG
+
+//#define STR2(m) #m
+//#define STR1(m) STR2(m)
+//#define MODULE_NAME			STR1( MOD_NAME )
+
+#define VERSION_INFO        MODULE_NAME " v" DRV_VERSION_STR \
+							" for " BUS_TYPE ", " 											   	 \
+							MODULE_DATE " by " VENDOR_NAME
+
+#define WIRELESS_SUPPORT    15  // The version of wireless extensions we support
+
+//#define DBG_MOD_NAME         DRIVER_NAME ":" BUS_TYPE ":" HW_TYPE ":" FW_TYPE
+#define DBG_MOD_NAME        MODULE_NAME
+
+
+
+/*******************************************************************************
+ *  bus architechture specific defines, includes, etc.
+ ******************************************************************************/
+/*
+ * There doesn't seem to be a difference for PCMCIA and PCI anymore, at least
+ * for PCMCIA the same defines are needed now as previously only used for PCI
+ */
+#if USE_WEXT
+#define HAS_WIRELESS_EXTENSIONS
+#endif  // USE_WEXT
+
+#define NEW_MULTICAST
+#define ALLOC_SKB(len)   dev_alloc_skb(len+2)
+#define GET_PACKET(dev, skb, count)\
+                        skb_reserve((skb), 2); \
+                        BLOCK_INPUT(skb_put((skb), (count)), (count)); \
+                        (skb)->protocol = eth_type_trans((skb), (dev))
+#define GET_PACKET_DMA(dev, skb, count)\
+                        skb_reserve((skb), 2); \
+                        BLOCK_INPUT_DMA(skb_put((skb), (count)), (count)); \
+                        (skb)->protocol = eth_type_trans((skb), (dev))
+
+
+
+
+#endif  // __WL_VERSION_H__
diff --git a/drivers/staging/wlags49_h2/wl_wext.c b/drivers/staging/wlags49_h2/wl_wext.c
new file mode 100644
index 000000000000..4434e0065488
--- /dev/null
+++ b/drivers/staging/wlags49_h2/wl_wext.c
@@ -0,0 +1,4130 @@
+/*******************************************************************************
+ * Agere Systems Inc.
+ * Wireless device driver for Linux (wlags49).
+ *
+ * Copyright (c) 1998-2003 Agere Systems Inc.
+ * All rights reserved.
+ *   http://www.agere.com
+ *
+ * Initially developed by TriplePoint, Inc.
+ *   http://www.triplepoint.com
+ *
+ *------------------------------------------------------------------------------
+ *
+ * SOFTWARE LICENSE
+ *
+ * This software is provided subject to the following terms and conditions,
+ * which you should read carefully before using the software.  Using this
+ * software indicates your acceptance of these terms and conditions.  If you do
+ * not agree with these terms and conditions, do not use the software.
+ *
+ * Copyright © 2003 Agere Systems Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source or binary forms, with or without
+ * modifications, are permitted provided that the following conditions are met:
+ *
+ * . Redistributions of source code must retain the above copyright notice, this
+ *    list of conditions and the following Disclaimer as comments in the code as
+ *    well as in the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * . Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following Disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ *
+ * . Neither the name of Agere Systems Inc. nor the names of the contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * Disclaimer
+ *
+ * THIS SOFTWARE IS PROVIDED “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, INFRINGEMENT AND THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  ANY
+ * USE, MODIFICATION OR DISTRIBUTION OF THIS SOFTWARE IS SOLELY AT THE USERS OWN
+ * RISK. IN NO EVENT SHALL AGERE SYSTEMS INC. OR CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, INCLUDING, BUT NOT LIMITED TO, CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ *
+ ******************************************************************************/
+
+/*******************************************************************************
+ *  include files
+ ******************************************************************************/
+#include <wl_version.h>
+
+#include <linux/if_arp.h>
+#include <linux/ioport.h>
+#include <linux/delay.h>
+#include <asm/uaccess.h>
+
+#include <debug.h>
+#include <hcf.h>
+#include <hcfdef.h>
+
+#include <wl_if.h>
+#include <wl_internal.h>
+#include <wl_util.h>
+#include <wl_main.h>
+#include <wl_wext.h>
+#include <wl_priv.h>
+
+
+
+/* If WIRELESS_EXT is not defined (as a result of HAS_WIRELESS_EXTENSIONS
+   #including linux/wireless.h), then these functions do not need to be included
+   in the build. */
+#ifdef WIRELESS_EXT
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,27)
+#define IWE_STREAM_ADD_EVENT(info, buf, end, iwe, len) \
+    iwe_stream_add_event(buf, end, iwe, len)
+#define IWE_STREAM_ADD_POINT(info, buf, end, iwe, msg) \
+    iwe_stream_add_point(buf, end, iwe, msg)
+#else
+#define IWE_STREAM_ADD_EVENT(info, buf, end, iwe, len) \
+    iwe_stream_add_event(info, buf, end, iwe, len)
+#define IWE_STREAM_ADD_POINT(info, buf, end, iwe, msg) \
+    iwe_stream_add_point(info, buf, end, iwe, msg)
+#endif
+
+
+
+/*******************************************************************************
+ * global definitions
+ ******************************************************************************/
+#if DBG
+extern dbg_info_t *DbgInfo;
+#endif  // DBG
+
+
+
+
+/*******************************************************************************
+ *	wireless_commit()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Commit
+ *  protocol used.
+ *
+ *  PARAMETERS:
+ *
+ *      wrq - the wireless request buffer
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+static int wireless_commit(struct net_device *dev,
+			   struct iw_request_info *info,
+			   union iwreq_data *rqu, char *extra)
+{
+	struct wl_private *lp = wl_priv(dev);
+	unsigned long flags;
+	int ret = 0;
+	/*------------------------------------------------------------------------*/
+
+	DBG_FUNC( "wireless_commit" );
+	DBG_ENTER(DbgInfo);
+
+	if(lp->portState == WVLAN_PORT_STATE_DISABLED) {
+		ret = -EBUSY;
+		goto out;
+	}
+
+	wl_lock( lp, &flags );
+
+    	wl_act_int_off( lp );
+
+	wl_apply(lp);
+
+    	wl_act_int_on( lp );
+
+	wl_unlock(lp, &flags);
+
+out:
+	DBG_LEAVE( DbgInfo );
+	return ret;
+} // wireless_commit
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wireless_get_protocol()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Returns a vendor-defined string that should identify the wireless
+ *  protocol used.
+ *
+ *  PARAMETERS:
+ *
+ *      wrq - the wireless request buffer
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+static int wireless_get_protocol(struct net_device *dev, struct iw_request_info *info, char *name, char *extra)
+{
+	DBG_FUNC( "wireless_get_protocol" );
+	DBG_ENTER( DbgInfo );
+
+	/* Originally, the driver was placing the string "Wireless" here. However,
+	   the wireless extensions (/linux/wireless.h) indicate this string should
+	   describe the wireless protocol. */
+
+	strcpy(name, "IEEE 802.11b");
+
+	DBG_LEAVE(DbgInfo);
+	return 0;
+} // wireless_get_protocol
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wireless_set_frequency()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Sets the frequency (channel) on which the card should Tx/Rx.
+ *
+ *  PARAMETERS:
+ *
+ *      wrq - the wireless request buffer
+ *      lp  - the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+static int wireless_set_frequency(struct net_device *dev, struct iw_request_info *info, struct iw_freq *freq, char *extra)
+{
+	struct wl_private *lp = wl_priv(dev);
+	unsigned long flags;
+	int channel = 0;
+	int ret     = 0;
+	/*------------------------------------------------------------------------*/
+
+
+	DBG_FUNC( "wireless_set_frequency" );
+	DBG_ENTER( DbgInfo );
+
+	if(lp->portState == WVLAN_PORT_STATE_DISABLED) {
+		ret = -EBUSY;
+		goto out;
+	}
+
+	if( !capable( CAP_NET_ADMIN )) {
+		ret = -EPERM;
+		DBG_LEAVE( DbgInfo );
+		return ret;
+	}
+
+
+	/* If frequency specified, look up channel */
+	if( freq->e == 1 ) {
+		int f = freq->m / 100000;
+		channel = wl_get_chan_from_freq( f );
+	}
+
+
+	/* Channel specified */
+	if( freq->e == 0 ) {
+		channel = freq->m;
+	}
+
+
+	/* If the channel is an 802.11a channel, set Bit 8 */
+	if( channel > 14 ) {
+		channel = channel | 0x100;
+	}
+
+
+	wl_lock( lp, &flags );
+
+    	wl_act_int_off( lp );
+
+	lp->Channel = channel;
+
+
+	/* Commit the adapter parameters */
+	wl_apply( lp );
+
+	/* Send an event that channel/freq has been set */
+	wl_wext_event_freq( lp->dev );
+
+    	wl_act_int_on( lp );
+
+	wl_unlock(lp, &flags);
+
+out:
+	DBG_LEAVE( DbgInfo );
+	return ret;
+} // wireless_set_frequency
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wireless_get_frequency()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Gets the frequency (channel) on which the card is Tx/Rx.
+ *
+ *  PARAMETERS:
+ *
+ *      wrq - the wireless request buffer
+ *      lp  - the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+static int wireless_get_frequency(struct net_device *dev, struct iw_request_info *info, struct iw_freq *freq, char *extra)
+
+{
+	struct wl_private *lp = wl_priv(dev);
+	unsigned long flags;
+	int ret = -1;
+	/*------------------------------------------------------------------------*/
+
+
+	DBG_FUNC( "wireless_get_frequency" );
+	DBG_ENTER( DbgInfo );
+
+	if(lp->portState == WVLAN_PORT_STATE_DISABLED) {
+		ret = -EBUSY;
+		goto out;
+	}
+
+	wl_lock( lp, &flags );
+
+    	wl_act_int_off( lp );
+
+	lp->ltvRecord.len = 2;
+	lp->ltvRecord.typ = CFG_CUR_CHANNEL;
+
+	ret = hcf_get_info( &(lp->hcfCtx), (LTVP)&( lp->ltvRecord ));
+	if( ret == HCF_SUCCESS ) {
+		hcf_16 channel = CNV_LITTLE_TO_INT( lp->ltvRecord.u.u16[0] );
+
+#ifdef USE_FREQUENCY
+
+		freq->m = wl_get_freq_from_chan( channel ) * 100000;
+		freq->e = 1;
+#else
+
+		freq->m = channel;
+		freq->e = 0;
+
+#endif /* USE_FREQUENCY */
+	}
+
+    	wl_act_int_on( lp );
+
+	wl_unlock(lp, &flags);
+
+	ret = (ret == HCF_SUCCESS ? 0 : -EFAULT);
+
+out:
+	DBG_LEAVE( DbgInfo );
+	return ret;
+} // wireless_get_frequency
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wireless_get_range()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      This function is used to provide misc info and statistics about the
+ *  wireless device.
+ *
+ *  PARAMETERS:
+ *
+ *      wrq - the wireless request buffer
+ *      lp  - the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+static int wireless_get_range(struct net_device *dev, struct iw_request_info *info, struct iw_point *data, char *extra)
+{
+	struct wl_private *lp = wl_priv(dev);
+	unsigned long      flags;
+	struct iw_range   *range = (struct iw_range *) extra;
+	int                ret = 0;
+	int                status = -1;
+	int                count;
+	__u16             *pTxRate;
+	int                retries = 0;
+	/*------------------------------------------------------------------------*/
+
+
+	DBG_FUNC( "wireless_get_range" );
+	DBG_ENTER( DbgInfo );
+
+	/* Set range information */
+	data->length = sizeof(struct iw_range);
+	memset(range, 0, sizeof(struct iw_range));
+
+	wl_lock( lp, &flags );
+
+    	wl_act_int_off( lp );
+
+	/* Set range information */
+	memset( range, 0, sizeof( struct iw_range ));
+
+retry:
+	/* Get the current transmit rate from the adapter */
+	lp->ltvRecord.len = 1 + (sizeof(*pTxRate) / sizeof(hcf_16));
+	lp->ltvRecord.typ = CFG_CUR_TX_RATE;
+
+	status = hcf_get_info( &( lp->hcfCtx ), (LTVP)&( lp->ltvRecord ));
+	if( status != HCF_SUCCESS ) {
+		/* Recovery action: reset and retry up to 10 times */
+		DBG_TRACE( DbgInfo, "Get CFG_CUR_TX_RATE failed: 0x%x\n", status );
+
+		if (retries < 10) {
+			retries++;
+
+			/* Holding the lock too long, make a gap to allow other processes */
+			wl_unlock(lp, &flags);
+			wl_lock( lp, &flags );
+
+			status = wl_reset( dev );
+			if ( status != HCF_SUCCESS ) {
+				DBG_TRACE( DbgInfo, "reset failed: 0x%x\n", status );
+
+				ret = -EFAULT;
+				goto out_unlock;
+			}
+
+			/* Holding the lock too long, make a gap to allow other processes */
+			wl_unlock(lp, &flags);
+			wl_lock( lp, &flags );
+
+			goto retry;
+
+		} else {
+			DBG_TRACE( DbgInfo, "Get CFG_CUR_TX_RATE failed: %d retries\n", retries );
+			ret = -EFAULT;
+			goto out_unlock;
+		}
+	}
+
+	/* Holding the lock too long, make a gap to allow other processes */
+	wl_unlock(lp, &flags);
+	wl_lock( lp, &flags );
+
+	pTxRate = (__u16 *)&( lp->ltvRecord.u.u32 );
+
+	range->throughput = CNV_LITTLE_TO_INT( *pTxRate ) * MEGABIT;
+
+	if (retries > 0) {
+		DBG_TRACE( DbgInfo, "Get CFG_CUR_TX_RATE succes: %d retries\n", retries );
+	}
+
+	// NWID - NOT SUPPORTED
+
+
+	/* Channel/Frequency Info */
+	range->num_channels = RADIO_CHANNELS;
+
+
+	/* Signal Level Thresholds */
+	range->sensitivity = RADIO_SENSITIVITY_LEVELS;
+
+
+	/* Link quality */
+#ifdef USE_DBM
+
+	range->max_qual.qual     = (u_char)HCF_MAX_COMM_QUALITY;
+
+	/* If the value returned in /proc/net/wireless is greater than the maximum range,
+	   iwconfig assumes that the value is in dBm. Because an unsigned char is used,
+	   it requires a bit of contorsion... */
+
+	range->max_qual.level   = (u_char)( dbm( HCF_MIN_SIGNAL_LEVEL ) - 1 );
+	range->max_qual.noise   = (u_char)( dbm( HCF_MIN_NOISE_LEVEL ) - 1 );
+#else
+
+	range->max_qual.qual    = 100;
+	range->max_qual.level   = 100;
+	range->max_qual.noise   = 100;
+
+#endif /* USE_DBM */
+
+
+	/* Set available rates */
+	range->num_bitrates = 0;
+
+	lp->ltvRecord.len = 6;
+	lp->ltvRecord.typ = CFG_SUPPORTED_DATA_RATES;
+
+	status = hcf_get_info( &( lp->hcfCtx ), (LTVP)&( lp->ltvRecord ));
+	if( status == HCF_SUCCESS ) {
+		for( count = 0; count < MAX_RATES; count++ )
+			if( lp->ltvRecord.u.u8[count+2] != 0 ) {
+				range->bitrate[count] = lp->ltvRecord.u.u8[count+2] * MEGABIT / 2;
+				range->num_bitrates++;
+			}
+	} else {
+		DBG_TRACE( DbgInfo, "CFG_SUPPORTED_DATA_RATES: 0x%x\n", status );
+		ret = -EFAULT;
+		goto out_unlock;
+	}
+
+	/* RTS Threshold info */
+	range->min_rts   = MIN_RTS_BYTES;
+	range->max_rts   = MAX_RTS_BYTES;
+
+	// Frag Threshold info - NOT SUPPORTED
+
+	// Power Management info - NOT SUPPORTED
+
+	/* Encryption */
+
+#if WIRELESS_EXT > 8
+
+	/* Holding the lock too long, make a gap to allow other processes */
+	wl_unlock(lp, &flags);
+	wl_lock( lp, &flags );
+
+	/* Is WEP supported? */
+
+	if( wl_has_wep( &( lp->hcfCtx ))) {
+		/* WEP: RC4 40 bits */
+		range->encoding_size[0]      = MIN_KEY_SIZE;
+
+		/* RC4 ~128 bits */
+		range->encoding_size[1]      = MAX_KEY_SIZE;
+		range->num_encoding_sizes    = 2;
+		range->max_encoding_tokens   = MAX_KEYS;
+	}
+
+#endif /* WIRELESS_EXT > 8 */
+
+	/* Tx Power Info */
+	range->txpower_capa  = IW_TXPOW_MWATT;
+	range->num_txpower   = 1;
+	range->txpower[0]    = RADIO_TX_POWER_MWATT;
+
+#if WIRELESS_EXT > 10
+
+	/* Wireless Extension Info */
+	range->we_version_compiled   = WIRELESS_EXT;
+	range->we_version_source     = WIRELESS_SUPPORT;
+
+	// Retry Limits and Lifetime - NOT SUPPORTED
+
+#endif
+
+
+#if WIRELESS_EXT > 11
+
+	/* Holding the lock too long, make a gap to allow other processes */
+	wl_unlock(lp, &flags);
+	wl_lock( lp, &flags );
+
+	DBG_TRACE( DbgInfo, "calling wl_wireless_stats\n" );
+	wl_wireless_stats( lp->dev );
+	range->avg_qual = lp->wstats.qual;
+	DBG_TRACE( DbgInfo, "wl_wireless_stats done\n" );
+
+#endif
+
+	/* Event capability (kernel + driver) */
+	range->event_capa[0] = (IW_EVENT_CAPA_K_0 |
+				IW_EVENT_CAPA_MASK(SIOCGIWAP) |
+				IW_EVENT_CAPA_MASK(SIOCGIWSCAN));
+	range->event_capa[1] = IW_EVENT_CAPA_K_1;
+	range->event_capa[4] = (IW_EVENT_CAPA_MASK(IWEVREGISTERED) |
+				IW_EVENT_CAPA_MASK(IWEVCUSTOM) |
+				IW_EVENT_CAPA_MASK(IWEVEXPIRED));
+
+	range->enc_capa = IW_ENC_CAPA_WPA | IW_ENC_CAPA_CIPHER_TKIP;
+
+out_unlock:
+    	wl_act_int_on( lp );
+
+	wl_unlock(lp, &flags);
+
+	DBG_LEAVE(DbgInfo);
+	return ret;
+} // wireless_get_range
+/*============================================================================*/
+
+
+/*******************************************************************************
+ *	wireless_get_bssid()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Gets the BSSID the wireless device is currently associated with.
+ *
+ *  PARAMETERS:
+ *
+ *      wrq - the wireless request buffer
+ *      lp  - the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+static int wireless_get_bssid(struct net_device *dev, struct iw_request_info *info, struct sockaddr *ap_addr, char *extra)
+{
+	struct wl_private *lp = wl_priv(dev);
+	unsigned long flags;
+	int ret = 0;
+#if 1 //;? (HCF_TYPE) & HCF_TYPE_STA
+	int status = -1;
+#endif /* (HCF_TYPE) & HCF_TYPE_STA */
+	/*------------------------------------------------------------------------*/
+
+
+	DBG_FUNC( "wireless_get_bssid" );
+	DBG_ENTER( DbgInfo );
+
+	if(lp->portState == WVLAN_PORT_STATE_DISABLED) {
+		ret = -EBUSY;
+		goto out;
+	}
+
+	wl_lock( lp, &flags );
+
+    	wl_act_int_off( lp );
+
+	memset( &ap_addr->sa_data, 0, ETH_ALEN );
+
+	ap_addr->sa_family = ARPHRD_ETHER;
+
+	/* Assume AP mode here, which means the BSSID is our own MAC address. In
+	   STA mode, this address will be overwritten with the actual BSSID using
+	   the code below. */
+	memcpy(&ap_addr->sa_data, lp->dev->dev_addr, ETH_ALEN);
+
+
+#if 1 //;? (HCF_TYPE) & HCF_TYPE_STA
+					//;?should we return an error status in AP mode
+
+	if ( CNV_INT_TO_LITTLE( lp->hcfCtx.IFB_FWIdentity.comp_id ) == COMP_ID_FW_STA  ) {
+		/* Get Current BSSID */
+		lp->ltvRecord.typ = CFG_CUR_BSSID;
+		lp->ltvRecord.len = 4;
+		status = hcf_get_info( &( lp->hcfCtx ), (LTVP)&( lp->ltvRecord ));
+
+		if( status == HCF_SUCCESS ) {
+			/* Copy info into sockaddr struct */
+			memcpy(&ap_addr->sa_data, lp->ltvRecord.u.u8, ETH_ALEN);
+		} else {
+			ret = -EFAULT;
+		}
+	}
+
+#endif // (HCF_TYPE) & HCF_TYPE_STA
+
+    	wl_act_int_on( lp );
+
+	wl_unlock(lp, &flags);
+
+out:
+	DBG_LEAVE(DbgInfo);
+	return ret;
+} // wireless_get_bssid
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wireless_get_ap_list()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Gets the results of a network scan.
+ *
+ *  PARAMETERS:
+ *
+ *      wrq - the wireless request buffer
+ *      lp  - the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ *  NOTE: SIOCGIWAPLIST has been deprecated by SIOCSIWSCAN. This function
+ *       implements SIOCGIWAPLIST only to provide backwards compatibility. For
+ *       all systems using WIRELESS_EXT v14 and higher, use SIOCSIWSCAN!
+ *
+ ******************************************************************************/
+static int wireless_get_ap_list (struct net_device *dev, struct iw_request_info *info, struct iw_point *data, char *extra)
+{
+	struct wl_private *lp = wl_priv(dev);
+	unsigned long	  flags;
+	int                 ret;
+	int                 num_aps = -1;
+	int                 sec_count = 0;
+	hcf_32              count;
+	struct sockaddr     *hwa = NULL;
+	struct iw_quality   *qual = NULL;
+#ifdef WARP
+	ScanResult			*p = &lp->scan_results;
+#else
+	ProbeResult         *p = &lp->probe_results;
+#endif  // WARP
+	/*------------------------------------------------------------------------*/
+
+	DBG_FUNC( "wireless_get_ap_list" );
+	DBG_ENTER( DbgInfo );
+
+	if(lp->portState == WVLAN_PORT_STATE_DISABLED) {
+		ret = -EBUSY;
+		goto out;
+	}
+
+	wl_lock( lp, &flags );
+
+    	wl_act_int_off( lp );
+
+	/* Set the completion state to FALSE */
+	lp->scan_results.scan_complete = FALSE;
+	lp->probe_results.scan_complete = FALSE;
+	/* Channels to scan */
+	lp->ltvRecord.len       = 2;
+	lp->ltvRecord.typ       = CFG_SCAN_CHANNELS_2GHZ;
+	lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( 0x7FFF );
+	ret = hcf_put_info( &( lp->hcfCtx ), (LTVP)&( lp->ltvRecord ));
+	DBG_TRACE( DbgInfo, "CFG_SCAN_CHANNELS_2GHZ result: 0x%x\n", ret );
+
+	/* Set the SCAN_SSID to "ANY". Using this RID for scan prevents the need to
+	   disassociate from the network we are currently on */
+	lp->ltvRecord.len       = 2;
+	lp->ltvRecord.typ       = CFG_SCAN_SSID;
+	lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( 0 );
+	ret = hcf_put_info( &( lp->hcfCtx ), (LTVP)&( lp->ltvRecord ));
+	DBG_TRACE( DbgInfo, "CFG_SCAN_SSID to 'any' ret: 0x%x\n", ret );
+
+	/* Initiate the scan */
+#ifdef WARP
+	ret = hcf_action( &( lp->hcfCtx ), MDD_ACT_SCAN );
+#else
+	ret = hcf_action( &( lp->hcfCtx ), HCF_ACT_ACS_SCAN );
+#endif  // WARP
+
+    	wl_act_int_on( lp );
+
+	//;? unlock? what about the access to lp below? is it broken?
+	wl_unlock(lp, &flags);
+
+	if( ret == HCF_SUCCESS ) {
+		DBG_TRACE( DbgInfo, "SUCCESSFULLY INITIATED SCAN...\n" );
+		while( (*p).scan_complete == FALSE && ret == HCF_SUCCESS ) {
+			DBG_TRACE( DbgInfo, "Waiting for scan results...\n" );
+			/* Abort the scan if we've waited for more than MAX_SCAN_TIME_SEC */
+			if( sec_count++ > MAX_SCAN_TIME_SEC ) {
+				ret = -EIO;
+			} else {
+				/* Wait for 1 sec in 10ms intervals, scheduling the kernel to do
+				   other things in the meantime, This prevents system lockups by
+				   giving some time back to the kernel */
+				for( count = 0; count < 100; count ++ ) {
+					mdelay( 10 );
+					schedule( );
+				}
+			}
+		}
+
+		rmb();
+
+		if ( ret != HCF_SUCCESS ) {
+			DBG_ERROR( DbgInfo, "timeout waiting for scan results\n" );
+		} else {
+			num_aps             = (*p)/*lp->probe_results*/.num_aps;
+			if (num_aps > IW_MAX_AP) {
+				num_aps = IW_MAX_AP;
+			}
+			data->length = num_aps;
+			hwa = (struct sockaddr *)extra;
+			qual = (struct iw_quality *) extra +
+					( sizeof( struct sockaddr ) * num_aps );
+
+			/* This flag is used to tell the user if we provide quality
+			   information. Since we provide signal/noise levels but no
+			   quality info on a scan, this is set to 0. Setting to 1 and
+			   providing a quality of 0 produces weird results. If we ever
+			   provide quality (or can calculate it), this can be changed */
+			data->flags = 0;
+
+			for( count = 0; count < num_aps; count++ ) {
+#ifdef WARP
+				memcpy( hwa[count].sa_data,
+						(*p)/*lp->scan_results*/.APTable[count].bssid, ETH_ALEN );
+#else  //;?why use BSSID and bssid as names in seemingly very comparable situations
+				DBG_PRINT( "BSSID: %s\n", DbgHwAddr( (*p)/*lp->probe_results*/.ProbeTable[count].BSSID ));
+				memcpy( hwa[count].sa_data,
+						(*p)/*lp->probe_results*/.ProbeTable[count].BSSID, ETH_ALEN );
+#endif // WARP
+			}
+			/* Once the data is copied to the wireless struct, invalidate the
+			   scan result to initiate a rescan on the next request */
+			(*p)/*lp->probe_results*/.scan_complete = FALSE;
+			/* Send the wireless event that the scan has completed, just in case
+			   it's needed */
+			wl_wext_event_scan_complete( lp->dev );
+		}
+	}
+out:
+	DBG_LEAVE( DbgInfo );
+	return ret;
+} // wireless_get_ap_list
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wireless_set_sensitivity()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Sets the sensitivity (distance between APs) of the wireless card.
+ *
+ *  PARAMETERS:
+ *
+ *      wrq - the wireless request buffer
+ *      lp  - the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+static int wireless_set_sensitivity(struct net_device *dev, struct iw_request_info *info, struct iw_param *sens, char *extra)
+{
+	struct wl_private *lp = wl_priv(dev);
+	unsigned long flags;
+	int ret = 0;
+	int dens = sens->value;
+	/*------------------------------------------------------------------------*/
+
+
+	DBG_FUNC( "wireless_set_sensitivity" );
+	DBG_ENTER( DbgInfo );
+
+	if(lp->portState == WVLAN_PORT_STATE_DISABLED) {
+		ret = -EBUSY;
+		goto out;
+	}
+
+	if(( dens < 1 ) || ( dens > 3 )) {
+		ret = -EINVAL;
+		goto out;
+	}
+
+	wl_lock( lp, &flags );
+
+    	wl_act_int_off( lp );
+
+	lp->DistanceBetweenAPs = dens;
+	wl_apply( lp );
+
+    	wl_act_int_on( lp );
+
+	wl_unlock(lp, &flags);
+
+out:
+	DBG_LEAVE( DbgInfo );
+	return ret;
+} // wireless_set_sensitivity
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wireless_get_sensitivity()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Gets the sensitivity (distance between APs) of the wireless card.
+ *
+ *  PARAMETERS:
+ *
+ *      wrq - the wireless request buffer
+ *      lp  - the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+static int wireless_get_sensitivity(struct net_device *dev, struct iw_request_info *info, struct iw_param *sens, char *extra)
+{
+	struct wl_private *lp = wl_priv(dev);
+	int ret = 0;
+	/*------------------------------------------------------------------------*/
+	/*------------------------------------------------------------------------*/
+
+
+	DBG_FUNC( "wireless_get_sensitivity" );
+	DBG_ENTER( DbgInfo );
+
+	if(lp->portState == WVLAN_PORT_STATE_DISABLED) {
+		ret = -EBUSY;
+		goto out;
+	}
+
+	/* not worth locking ... */
+	sens->value = lp->DistanceBetweenAPs;
+	sens->fixed = 0;	/* auto */
+out:
+	DBG_LEAVE( DbgInfo );
+	return ret;
+} // wireless_get_sensitivity
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wireless_set_essid()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Sets the ESSID (network name) that the wireless device should associate
+ *  with.
+ *
+ *  PARAMETERS:
+ *
+ *      wrq - the wireless request buffer
+ *      lp  - the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+static int wireless_set_essid(struct net_device *dev, struct iw_request_info *info, struct iw_point *data, char *ssid)
+{
+	struct wl_private *lp = wl_priv(dev);
+	unsigned long flags;
+	int ret = 0;
+
+	DBG_FUNC( "wireless_set_essid" );
+	DBG_ENTER( DbgInfo );
+
+	if(lp->portState == WVLAN_PORT_STATE_DISABLED) {
+		ret = -EBUSY;
+		goto out;
+	}
+
+	if (data->flags != 0 && data->length > HCF_MAX_NAME_LEN + 1) {
+		ret = -EINVAL;
+		goto out;
+	}
+
+	wl_lock( lp, &flags );
+
+    	wl_act_int_off( lp );
+
+	memset( lp->NetworkName, 0, sizeof( lp->NetworkName ));
+
+	/* data->flags is zero to ask for "any" */
+	if( data->flags == 0 ) {
+		/* Need this because in STAP build PARM_DEFAULT_SSID is "LinuxAP"
+		 * ;?but there ain't no STAP anymore*/
+		if ( CNV_INT_TO_LITTLE( lp->hcfCtx.IFB_FWIdentity.comp_id ) == COMP_ID_FW_STA  ) {
+			strcpy( lp->NetworkName, "ANY" );
+		} else {
+			//strcpy( lp->NetworkName, "ANY" );
+			strcpy( lp->NetworkName, PARM_DEFAULT_SSID );
+		}
+	} else {
+		memcpy( lp->NetworkName, ssid, data->length );
+	}
+
+	DBG_NOTICE( DbgInfo, "set NetworkName: %s\n", ssid );
+
+	/* Commit the adapter parameters */
+	wl_apply( lp );
+
+	/* Send an event that ESSID has been set */
+	wl_wext_event_essid( lp->dev );
+
+    	wl_act_int_on( lp );
+
+	wl_unlock(lp, &flags);
+
+out:
+	DBG_LEAVE( DbgInfo );
+	return ret;
+} // wireless_set_essid
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wireless_get_essid()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Gets the ESSID (network name) that the wireless device is associated
+ *  with.
+ *
+ *  PARAMETERS:
+ *
+ *      wrq - the wireless request buffer
+ *      lp  - the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+static int wireless_get_essid(struct net_device *dev, struct iw_request_info *info, struct iw_point *data, char *essid)
+
+{
+	struct wl_private *lp = wl_priv(dev);
+	unsigned long flags;
+	int         ret = 0;
+	int         status = -1;
+	wvName_t    *pName;
+	/*------------------------------------------------------------------------*/
+
+
+	DBG_FUNC( "wireless_get_essid" );
+	DBG_ENTER( DbgInfo );
+
+	if(lp->portState == WVLAN_PORT_STATE_DISABLED) {
+		ret = -EBUSY;
+		goto out;
+	}
+
+	wl_lock( lp, &flags );
+
+    	wl_act_int_off( lp );
+
+	/* Get the desired network name */
+	lp->ltvRecord.len = 1 + ( sizeof( *pName ) / sizeof( hcf_16 ));
+
+
+#if 1 //;? (HCF_TYPE) & HCF_TYPE_STA
+					//;?should we return an error status in AP mode
+
+	lp->ltvRecord.typ = CFG_DESIRED_SSID;
+
+#endif
+
+
+#if 1 //;? (HCF_TYPE) & HCF_TYPE_AP
+		//;?should we restore this to allow smaller memory footprint
+
+	if ( CNV_INT_TO_LITTLE( lp->hcfCtx.IFB_FWIdentity.comp_id ) == COMP_ID_FW_AP  ) {
+		lp->ltvRecord.typ = CFG_CNF_OWN_SSID;
+	}
+
+#endif // HCF_AP
+
+
+	status = hcf_get_info( &( lp->hcfCtx ), (LTVP)&( lp->ltvRecord ));
+	if( status == HCF_SUCCESS ) {
+		pName = (wvName_t *)&( lp->ltvRecord.u.u32 );
+
+		/* Endian translate the string length */
+		pName->length = CNV_LITTLE_TO_INT( pName->length );
+
+		/* Copy the information into the user buffer */
+		data->length = pName->length;
+
+		/* NOTE: Null terminating is necessary for proper display of the SSID in
+		   the wireless tools */
+		data->length = pName->length + 1;
+		if( pName->length < HCF_MAX_NAME_LEN ) {
+			pName->name[pName->length] = '\0';
+		}
+
+		data->flags = 1;
+
+
+#if 1 //;? (HCF_TYPE) & HCF_TYPE_STA
+					//;?should we return an error status in AP mode
+#ifdef RETURN_CURRENT_NETWORKNAME
+
+		/* if desired is null ("any"), return current or "any" */
+		if( pName->name[0] == '\0' ) {
+			/* Get the current network name */
+			lp->ltvRecord.len = 1 + ( sizeof(*pName ) / sizeof( hcf_16 ));
+			lp->ltvRecord.typ = CFG_CUR_SSID;
+
+			status = hcf_get_info( &( lp->hcfCtx ), (LTVP)&( lp->ltvRecord ));
+
+			if( status == HCF_SUCCESS ) {
+				pName = (wvName_t *)&( lp->ltvRecord.u.u32 );
+
+				/* Endian translate the string length */
+				pName->length = CNV_LITTLE_TO_INT( pName->length );
+
+				/* Copy the information into the user buffer */
+				data->length = pName->length + 1;
+				if( pName->length < HCF_MAX_NAME_LEN ) {
+					pName->name[pName->length] = '\0';
+				}
+
+				data->flags = 1;
+			} else {
+				ret = -EFAULT;
+				goto out_unlock;
+			}
+		}
+
+#endif // RETURN_CURRENT_NETWORKNAME
+#endif // HCF_STA
+
+		data->length--;
+
+		if (pName->length > IW_ESSID_MAX_SIZE) {
+			ret = -EFAULT;
+			goto out_unlock;
+		}
+
+		memcpy(essid, pName->name, pName->length);
+	} else {
+		ret = -EFAULT;
+		goto out_unlock;
+	}
+
+out_unlock:
+    	wl_act_int_on( lp );
+
+	wl_unlock(lp, &flags);
+
+out:
+	DBG_LEAVE( DbgInfo );
+	return ret;
+} // wireless_get_essid
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wireless_set_encode()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *     Sets the encryption keys and status (enable or disable).
+ *
+ *  PARAMETERS:
+ *
+ *      wrq - the wireless request buffer
+ *      lp  - the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+static int wireless_set_encode(struct net_device *dev, struct iw_request_info *info, struct iw_point *erq, char *keybuf)
+{
+	struct wl_private *lp = wl_priv(dev);
+	unsigned long flags;
+	int     ret = 0;
+
+#if 1 //;? #if WIRELESS_EXT > 8 - used unconditionally in the rest of the code...
+	hcf_8   encryption_state;
+#endif // WIRELESS_EXT > 8
+	/*------------------------------------------------------------------------*/
+
+
+	DBG_FUNC( "wireless_set_encode" );
+	DBG_ENTER( DbgInfo );
+
+	if(lp->portState == WVLAN_PORT_STATE_DISABLED) {
+		ret = -EBUSY;
+		goto out;
+	}
+
+	wl_lock( lp, &flags );
+
+    	wl_act_int_off( lp );
+
+	/* Is encryption supported? */
+	if( !wl_has_wep( &( lp->hcfCtx ))) {
+		DBG_WARNING( DbgInfo, "WEP not supported on this device\n" );
+		ret = -EOPNOTSUPP;
+		goto out_unlock;
+	}
+
+	DBG_NOTICE( DbgInfo, "pointer: %p, length: %d, flags: %#x\n",
+				keybuf, erq->length,
+				erq->flags);
+
+	/* Save state of Encryption switch */
+	encryption_state = lp->EnableEncryption;
+
+	/* Basic checking: do we have a key to set? */
+	if((erq->length) != 0) {
+		int index   = ( erq->flags & IW_ENCODE_INDEX ) - 1;
+		int tk      = lp->TransmitKeyID - 1;		// current key
+
+
+		/* Check the size of the key */
+		switch(erq->length) {
+		case 0:
+			break;
+
+		case MIN_KEY_SIZE:
+		case MAX_KEY_SIZE:
+
+			/* Check the index */
+			if(( index < 0 ) || ( index >= MAX_KEYS )) {
+				index = tk;
+			}
+
+			/* Cleanup */
+			memset( lp->DefaultKeys.key[index].key, 0, MAX_KEY_SIZE );
+
+			/* Copy the key in the driver */
+			memcpy( lp->DefaultKeys.key[index].key, keybuf, erq->length);
+
+			/* Set the length */
+			lp->DefaultKeys.key[index].len = erq->length;
+
+			DBG_NOTICE( DbgInfo, "encoding.length: %d\n", erq->length );
+			DBG_NOTICE( DbgInfo, "set key: %s(%d) [%d]\n", lp->DefaultKeys.key[index].key,
+						lp->DefaultKeys.key[index].len, index );
+
+			/* Enable WEP (if possible) */
+			if(( index == tk ) && ( lp->DefaultKeys.key[tk].len > 0 )) {
+				lp->EnableEncryption = 1;
+			}
+
+			break;
+
+		default:
+			DBG_WARNING( DbgInfo, "Invalid Key length\n" );
+			ret = -EINVAL;
+			goto out_unlock;
+		}
+	} else {
+		int index = ( erq->flags & IW_ENCODE_INDEX ) - 1;
+
+
+		/* Do we want to just set the current transmit key? */
+		if(( index >= 0 ) && ( index < MAX_KEYS )) {
+			DBG_NOTICE( DbgInfo, "index: %d; len: %d\n", index,
+						lp->DefaultKeys.key[index].len );
+
+			if( lp->DefaultKeys.key[index].len > 0 ) {
+				lp->TransmitKeyID       = index + 1;
+				lp->EnableEncryption    = 1;
+			} else {
+				DBG_WARNING( DbgInfo, "Problem setting the current TxKey\n" );
+				DBG_LEAVE( DbgInfo );
+				ret = -EINVAL;
+			}
+		}
+	}
+
+	/* Read the flags */
+	if( erq->flags & IW_ENCODE_DISABLED ) {
+		lp->EnableEncryption = 0;	// disable encryption
+	} else {
+		lp->EnableEncryption = 1;
+	}
+
+	if( erq->flags & IW_ENCODE_RESTRICTED ) {
+		DBG_WARNING( DbgInfo, "IW_ENCODE_RESTRICTED invalid\n" );
+		ret = -EINVAL;		// Invalid
+	}
+
+	DBG_TRACE( DbgInfo, "encryption_state :       %d\n", encryption_state );
+	DBG_TRACE( DbgInfo, "lp->EnableEncryption :   %d\n", lp->EnableEncryption );
+	DBG_TRACE( DbgInfo, "erq->length            : %d\n",
+			   erq->length);
+	DBG_TRACE( DbgInfo, "erq->flags             : 0x%x\n",
+			   erq->flags);
+
+	/* Write the changes to the card */
+	if( ret == 0 ) {
+		DBG_NOTICE( DbgInfo, "encrypt: %d, ID: %d\n", lp->EnableEncryption,
+					lp->TransmitKeyID );
+
+		if( lp->EnableEncryption == encryption_state ) {
+			if( erq->length != 0 ) {
+				/* Dynamic WEP key update */
+				wl_set_wep_keys( lp );
+			}
+		} else {
+			/* To switch encryption on/off, soft reset is required */
+			wl_apply( lp );
+		}
+	}
+
+	/* Send an event that Encryption has been set */
+	wl_wext_event_encode( dev );
+
+out_unlock:
+
+    	wl_act_int_on( lp );
+
+	wl_unlock(lp, &flags);
+
+out:
+	DBG_LEAVE( DbgInfo );
+	return ret;
+} // wireless_set_encode
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wireless_get_encode()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *     Gets the encryption keys and status.
+ *
+ *  PARAMETERS:
+ *
+ *      wrq - the wireless request buffer
+ *      lp  - the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+static int wireless_get_encode(struct net_device *dev, struct iw_request_info *info, struct iw_point *erq, char *key)
+
+{
+	struct wl_private *lp = wl_priv(dev);
+	unsigned long flags;
+	int ret = 0;
+	int index;
+	/*------------------------------------------------------------------------*/
+
+
+	DBG_FUNC( "wireless_get_encode" );
+	DBG_ENTER( DbgInfo );
+	DBG_NOTICE(DbgInfo, "GIWENCODE: encrypt: %d, ID: %d\n", lp->EnableEncryption, lp->TransmitKeyID);
+
+	if(lp->portState == WVLAN_PORT_STATE_DISABLED) {
+		ret = -EBUSY;
+		goto out;
+	}
+
+	/* Only super-user can see WEP key */
+	if( !capable( CAP_NET_ADMIN )) {
+		ret = -EPERM;
+		DBG_LEAVE( DbgInfo );
+		return ret;
+	}
+
+	wl_lock( lp, &flags );
+
+    	wl_act_int_off( lp );
+
+	/* Is it supported? */
+	if( !wl_has_wep( &( lp->hcfCtx ))) {
+		ret = -EOPNOTSUPP;
+		goto out_unlock;
+	}
+
+	/* Basic checking */
+	index = (erq->flags & IW_ENCODE_INDEX ) - 1;
+
+
+	/* Set the flags */
+	erq->flags = 0;
+
+	if( lp->EnableEncryption == 0 ) {
+		erq->flags |= IW_ENCODE_DISABLED;
+	}
+
+	/* Which key do we want */
+	if(( index < 0 ) || ( index >= MAX_KEYS )) {
+		index = lp->TransmitKeyID - 1;
+	}
+
+	erq->flags |= index + 1;
+
+	/* Copy the key to the user buffer */
+	erq->length = lp->DefaultKeys.key[index].len;
+
+	memcpy(key, lp->DefaultKeys.key[index].key, erq->length);
+
+out_unlock:
+
+    	wl_act_int_on( lp );
+
+	wl_unlock(lp, &flags);
+
+out:
+	DBG_LEAVE( DbgInfo );
+	return ret;
+} // wireless_get_encode
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wireless_set_nickname()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *     Sets the nickname, or station name, of the wireless device.
+ *
+ *  PARAMETERS:
+ *
+ *      wrq - the wireless request buffer
+ *      lp  - the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+static int wireless_set_nickname(struct net_device *dev, struct iw_request_info *info, struct iw_point *data, char *nickname)
+{
+	struct wl_private *lp = wl_priv(dev);
+	unsigned long flags;
+	int ret = 0;
+	/*------------------------------------------------------------------------*/
+
+
+	DBG_FUNC( "wireless_set_nickname" );
+	DBG_ENTER( DbgInfo );
+
+	if(lp->portState == WVLAN_PORT_STATE_DISABLED) {
+		ret = -EBUSY;
+		goto out;
+	}
+
+#if 0 //;? Needed, was present in original code but not in 7.18 Linux 2.6 kernel version
+	if( !capable(CAP_NET_ADMIN )) {
+		ret = -EPERM;
+		DBG_LEAVE( DbgInfo );
+		return ret;
+	}
+#endif
+
+	/* Validate the new value */
+	if(data->length > HCF_MAX_NAME_LEN) {
+		ret = -EINVAL;
+		goto out;
+	}
+
+	wl_lock( lp, &flags );
+
+    	wl_act_int_off( lp );
+
+	memset( lp->StationName, 0, sizeof( lp->StationName ));
+
+	memcpy( lp->StationName, nickname, data->length );
+
+	/* Commit the adapter parameters */
+	wl_apply( lp );
+
+    	wl_act_int_on( lp );
+
+	wl_unlock(lp, &flags);
+
+out:
+	DBG_LEAVE( DbgInfo );
+	return ret;
+} // wireless_set_nickname
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wireless_get_nickname()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *     Gets the nickname, or station name, of the wireless device.
+ *
+ *  PARAMETERS:
+ *
+ *      wrq - the wireless request buffer
+ *      lp  - the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+static int wireless_get_nickname(struct net_device *dev, struct iw_request_info *info, struct iw_point *data, char *nickname)
+{
+	struct wl_private *lp = wl_priv(dev);
+	unsigned long flags;
+	int         ret = 0;
+	int         status = -1;
+	wvName_t    *pName;
+	/*------------------------------------------------------------------------*/
+
+
+	DBG_FUNC( "wireless_get_nickname" );
+	DBG_ENTER( DbgInfo );
+
+	if(lp->portState == WVLAN_PORT_STATE_DISABLED) {
+		ret = -EBUSY;
+		goto out;
+	}
+
+	wl_lock( lp, &flags );
+
+    	wl_act_int_off( lp );
+
+	/* Get the current station name */
+	lp->ltvRecord.len = 1 + ( sizeof( *pName ) / sizeof( hcf_16 ));
+	lp->ltvRecord.typ = CFG_CNF_OWN_NAME;
+
+	status = hcf_get_info( &( lp->hcfCtx ), (LTVP)&( lp->ltvRecord ));
+
+	if( status == HCF_SUCCESS ) {
+		pName = (wvName_t *)&( lp->ltvRecord.u.u32 );
+
+		/* Endian translate the length */
+		pName->length = CNV_LITTLE_TO_INT( pName->length );
+
+		if ( pName->length > IW_ESSID_MAX_SIZE ) {
+			ret = -EFAULT;
+		} else {
+			/* Copy the information into the user buffer */
+			data->length = pName->length;
+			memcpy(nickname, pName->name, pName->length);
+		}
+	} else {
+		ret = -EFAULT;
+	}
+
+    	wl_act_int_on( lp );
+
+	wl_unlock(lp, &flags);
+
+out:
+	DBG_LEAVE(DbgInfo);
+	return ret;
+} // wireless_get_nickname
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wireless_set_porttype()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *     Sets the port type of the wireless device.
+ *
+ *  PARAMETERS:
+ *
+ *      wrq - the wireless request buffer
+ *      lp  - the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+static int wireless_set_porttype(struct net_device *dev, struct iw_request_info *info, __u32 *mode, char *extra)
+{
+	struct wl_private *lp = wl_priv(dev);
+	unsigned long flags;
+	int ret = 0;
+	hcf_16  portType;
+	hcf_16	createIBSS;
+	/*------------------------------------------------------------------------*/
+
+	DBG_FUNC( "wireless_set_porttype" );
+	DBG_ENTER( DbgInfo );
+
+	if(lp->portState == WVLAN_PORT_STATE_DISABLED) {
+		ret = -EBUSY;
+		goto out;
+	}
+
+	wl_lock( lp, &flags );
+
+    	wl_act_int_off( lp );
+
+	/* Validate the new value */
+	switch( *mode ) {
+	case IW_MODE_ADHOC:
+
+		/* When user requests ad-hoc, set IBSS mode! */
+		portType         = 1;
+		createIBSS       = 1;
+
+		lp->DownloadFirmware = WVLAN_DRV_MODE_STA; //1;
+
+		break;
+
+
+	case IW_MODE_AUTO:
+	case IW_MODE_INFRA:
+
+		/* Both automatic and infrastructure set port to BSS/STA mode */
+		portType         = 1;
+		createIBSS       = 0;
+
+		lp->DownloadFirmware = WVLAN_DRV_MODE_STA; //1;
+
+		break;
+
+
+#if 0 //;? (HCF_TYPE) & HCF_TYPE_AP
+
+	case IW_MODE_MASTER:
+
+		/* Set BSS/AP mode */
+		portType             = 1;
+
+		lp->CreateIBSS       = 0;
+		lp->DownloadFirmware = WVLAN_DRV_MODE_AP; //2;
+
+		break;
+
+#endif /* (HCF_TYPE) & HCF_TYPE_AP */
+
+
+	default:
+
+		portType   = 0;
+		createIBSS = 0;
+		ret = -EINVAL;
+	}
+
+	if( portType != 0 ) {
+		/* Only do something if there is a mode change */
+		if( ( lp->PortType != portType ) || (lp->CreateIBSS != createIBSS)) {
+			lp->PortType   = portType;
+			lp->CreateIBSS = createIBSS;
+
+			/* Commit the adapter parameters */
+			wl_go( lp );
+
+			/* Send an event that mode has been set */
+			wl_wext_event_mode( lp->dev );
+		}
+	}
+
+    	wl_act_int_on( lp );
+
+	wl_unlock(lp, &flags);
+
+out:
+	DBG_LEAVE( DbgInfo );
+	return ret;
+} // wireless_set_porttype
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wireless_get_porttype()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *     Gets the port type of the wireless device.
+ *
+ *  PARAMETERS:
+ *
+ *      wrq - the wireless request buffer
+ *      lp  - the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+static int wireless_get_porttype(struct net_device *dev, struct iw_request_info *info, __u32 *mode, char *extra)
+
+{
+	struct wl_private *lp = wl_priv(dev);
+	unsigned long flags;
+	int     ret = 0;
+	int     status = -1;
+	hcf_16  *pPortType;
+	/*------------------------------------------------------------------------*/
+
+
+	DBG_FUNC( "wireless_get_porttype" );
+	DBG_ENTER( DbgInfo );
+
+	if(lp->portState == WVLAN_PORT_STATE_DISABLED) {
+		ret = -EBUSY;
+		goto out;
+	}
+
+	wl_lock( lp, &flags );
+
+    	wl_act_int_off( lp );
+
+	/* Get the current port type */
+	lp->ltvRecord.len = 1 + ( sizeof( *pPortType ) / sizeof( hcf_16 ));
+	lp->ltvRecord.typ = CFG_CNF_PORT_TYPE;
+
+	status = hcf_get_info( &( lp->hcfCtx ), (LTVP)&( lp->ltvRecord ));
+
+	if( status == HCF_SUCCESS ) {
+		pPortType = (hcf_16 *)&( lp->ltvRecord.u.u32 );
+
+		*pPortType = CNV_LITTLE_TO_INT( *pPortType );
+
+		switch( *pPortType ) {
+		case 1:
+
+#if 0
+#if (HCF_TYPE) & HCF_TYPE_AP
+
+			if ( CNV_INT_TO_LITTLE( lp->hcfCtx.IFB_FWIdentity.comp_id ) == COMP_ID_FW_AP  ) {
+				*mode = IW_MODE_MASTER;
+			} else {
+				*mode = IW_MODE_INFRA;
+			}
+
+#else
+
+			*mode = IW_MODE_INFRA;
+
+#endif  /* (HCF_TYPE) & HCF_TYPE_AP */
+#endif
+
+			if ( CNV_INT_TO_LITTLE( lp->hcfCtx.IFB_FWIdentity.comp_id ) == COMP_ID_FW_AP  ) {
+				*mode =  IW_MODE_MASTER;
+			} else {
+				if( lp->CreateIBSS ) {
+					*mode = IW_MODE_ADHOC;
+				} else {
+					*mode = IW_MODE_INFRA;
+				}
+			}
+
+			break;
+
+
+		case 3:
+			*mode = IW_MODE_ADHOC;
+			break;
+
+		default:
+			ret = -EFAULT;
+			break;
+		}
+	} else {
+		ret = -EFAULT;
+	}
+
+    	wl_act_int_on( lp );
+
+	wl_unlock(lp, &flags);
+
+out:
+	DBG_LEAVE( DbgInfo );
+	return ret;
+} // wireless_get_porttype
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wireless_set_power()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *     Sets the power management settings of the wireless device.
+ *
+ *  PARAMETERS:
+ *
+ *      wrq - the wireless request buffer
+ *      lp  - the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+static int wireless_set_power(struct net_device *dev, struct iw_request_info *info, struct iw_param *wrq, char *extra)
+{
+	struct wl_private *lp = wl_priv(dev);
+	unsigned long flags;
+	int ret = 0;
+	/*------------------------------------------------------------------------*/
+
+
+	DBG_FUNC( "wireless_set_power" );
+	DBG_ENTER( DbgInfo );
+
+	if(lp->portState == WVLAN_PORT_STATE_DISABLED) {
+		ret = -EBUSY;
+		goto out;
+	}
+
+	DBG_PRINT( "THIS CORRUPTS PMEnabled ;?!!!!!!!!!!!!!!!!!!!!!!!!!!!!!\n" );
+
+#if 0 //;? Needed, was present in original code but not in 7.18 Linux 2.6 kernel version
+	if( !capable( CAP_NET_ADMIN )) {
+		ret = -EPERM;
+
+		DBG_LEAVE( DbgInfo );
+		return ret;
+	}
+#endif
+
+	wl_lock( lp, &flags );
+
+    	wl_act_int_off( lp );
+
+	/* Set the power management state based on the 'disabled' value */
+	if( wrq->disabled ) {
+		lp->PMEnabled = 0;
+	} else {
+		lp->PMEnabled = 1;
+	}
+
+	/* Commit the adapter parameters */
+	wl_apply( lp );
+
+    	wl_act_int_on( lp );
+
+	wl_unlock(lp, &flags);
+
+out:
+	DBG_LEAVE( DbgInfo );
+	return ret;
+} // wireless_set_power
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wireless_get_power()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *     Gets the power management settings of the wireless device.
+ *
+ *  PARAMETERS:
+ *
+ *      wrq - the wireless request buffer
+ *      lp  - the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+static int wireless_get_power(struct net_device *dev, struct iw_request_info *info, struct iw_param *rrq, char *extra)
+
+{
+	struct wl_private *lp = wl_priv(dev);
+	unsigned long flags;
+	int ret = 0;
+	/*------------------------------------------------------------------------*/
+	DBG_FUNC( "wireless_get_power" );
+	DBG_ENTER( DbgInfo );
+
+	if(lp->portState == WVLAN_PORT_STATE_DISABLED) {
+		ret = -EBUSY;
+		goto out;
+	}
+
+	DBG_PRINT( "THIS IS PROBABLY AN OVER-SIMPLIFICATION ;?!!!!!!!!!!!!!!!!!!!!!!!!!!!!!\n" );
+
+	wl_lock( lp, &flags );
+
+    	wl_act_int_off( lp );
+
+	rrq->flags = 0;
+	rrq->value = 0;
+
+	if( lp->PMEnabled ) {
+		rrq->disabled = 0;
+	} else {
+		rrq->disabled = 1;
+	}
+
+    	wl_act_int_on( lp );
+
+	wl_unlock(lp, &flags);
+
+out:
+	DBG_LEAVE( DbgInfo );
+	return ret;
+} // wireless_get_power
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wireless_get_tx_power()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *     Gets the transmit power of the wireless device's radio.
+ *
+ *  PARAMETERS:
+ *
+ *      wrq - the wireless request buffer
+ *      lp  - the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+static int wireless_get_tx_power(struct net_device *dev, struct iw_request_info *info, struct iw_param *rrq, char *extra)
+{
+	struct wl_private *lp = wl_priv(dev);
+	unsigned long flags;
+	int ret = 0;
+	/*------------------------------------------------------------------------*/
+	DBG_FUNC( "wireless_get_tx_power" );
+	DBG_ENTER( DbgInfo );
+
+	if(lp->portState == WVLAN_PORT_STATE_DISABLED) {
+		ret = -EBUSY;
+		goto out;
+	}
+
+	wl_lock( lp, &flags );
+
+    	wl_act_int_off( lp );
+
+#ifdef USE_POWER_DBM
+	rrq->value = RADIO_TX_POWER_DBM;
+	rrq->flags = IW_TXPOW_DBM;
+#else
+	rrq->value = RADIO_TX_POWER_MWATT;
+	rrq->flags = IW_TXPOW_MWATT;
+#endif
+	rrq->fixed = 1;
+	rrq->disabled = 0;
+
+    	wl_act_int_on( lp );
+
+	wl_unlock(lp, &flags);
+
+out:
+	DBG_LEAVE( DbgInfo );
+	return ret;
+} // wireless_get_tx_power
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wireless_set_rts_threshold()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *     Sets the RTS threshold for the wireless card.
+ *
+ *  PARAMETERS:
+ *
+ *      wrq - the wireless request buffer
+ *      lp  - the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+static int wireless_set_rts_threshold (struct net_device *dev, struct iw_request_info *info, struct iw_param *rts, char *extra)
+{
+	int ret = 0;
+	struct wl_private *lp = wl_priv(dev);
+	unsigned long flags;
+	int rthr = rts->value;
+	/*------------------------------------------------------------------------*/
+
+
+	DBG_FUNC( "wireless_set_rts_threshold" );
+	DBG_ENTER( DbgInfo );
+
+	if(lp->portState == WVLAN_PORT_STATE_DISABLED) {
+		ret = -EBUSY;
+		goto out;
+	}
+
+	if(rts->fixed == 0) {
+		ret = -EINVAL;
+		goto out;
+	}
+
+#if WIRELESS_EXT > 8
+	if( rts->disabled ) {
+		rthr = 2347;
+	}
+#endif /* WIRELESS_EXT > 8 */
+
+	if(( rthr < 256 ) || ( rthr > 2347 )) {
+		ret = -EINVAL;
+		goto out;
+	}
+
+	wl_lock( lp, &flags );
+
+    	wl_act_int_off( lp );
+
+	lp->RTSThreshold = rthr;
+
+	wl_apply( lp );
+
+    	wl_act_int_on( lp );
+
+	wl_unlock(lp, &flags);
+
+out:
+	DBG_LEAVE( DbgInfo );
+	return ret;
+} // wireless_set_rts_threshold
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wireless_get_rts_threshold()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *     Gets the RTS threshold for the wireless card.
+ *
+ *  PARAMETERS:
+ *
+ *      wrq - the wireless request buffer
+ *      lp  - the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+static int wireless_get_rts_threshold (struct net_device *dev, struct iw_request_info *info, struct iw_param *rts, char *extra)
+{
+	int ret = 0;
+	struct wl_private *lp = wl_priv(dev);
+	unsigned long flags;
+	/*------------------------------------------------------------------------*/
+
+	DBG_FUNC( "wireless_get_rts_threshold" );
+	DBG_ENTER( DbgInfo );
+
+	if(lp->portState == WVLAN_PORT_STATE_DISABLED) {
+		ret = -EBUSY;
+		goto out;
+	}
+
+	wl_lock( lp, &flags );
+
+    	wl_act_int_off( lp );
+
+	rts->value = lp->RTSThreshold;
+
+#if WIRELESS_EXT > 8
+
+	rts->disabled = ( rts->value == 2347 );
+
+#endif /* WIRELESS_EXT > 8 */
+
+	rts->fixed = 1;
+
+    	wl_act_int_on( lp );
+
+	wl_unlock(lp, &flags);
+
+out:
+	DBG_LEAVE( DbgInfo );
+	return ret;
+} // wireless_get_rts_threshold
+/*============================================================================*/
+
+
+
+
+
+/*******************************************************************************
+ *	wireless_set_rate()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Set the default data rate setting used by the wireless device.
+ *
+ *  PARAMETERS:
+ *
+ *      wrq - the wireless request buffer
+ *      lp  - the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+static int wireless_set_rate(struct net_device *dev, struct iw_request_info *info, struct iw_param *rrq, char *extra)
+{
+	struct wl_private *lp = wl_priv(dev);
+	unsigned long flags;
+	int ret = 0;
+#ifdef WARP
+	int status = -1;
+	int index = 0;
+#endif  // WARP
+	/*------------------------------------------------------------------------*/
+
+
+	DBG_FUNC( "wireless_set_rate" );
+	DBG_ENTER( DbgInfo );
+
+	if(lp->portState == WVLAN_PORT_STATE_DISABLED) {
+		ret = -EBUSY;
+		goto out;
+	}
+
+	wl_lock( lp, &flags );
+
+    	wl_act_int_off( lp );
+
+#ifdef WARP
+
+	/* Determine if the card is operating in the 2.4 or 5.0 GHz band; check
+	   if Bit 9 is set in the current channel RID */
+	lp->ltvRecord.len = 2;
+	lp->ltvRecord.typ = CFG_CUR_CHANNEL;
+
+	status = hcf_get_info( &( lp->hcfCtx ), (LTVP)&( lp->ltvRecord ));
+
+	if( status == HCF_SUCCESS ) {
+		index = ( CNV_LITTLE_TO_INT( lp->ltvRecord.u.u16[0] ) & 0x100 ) ? 1 : 0;
+
+		DBG_PRINT( "Index: %d\n", index );
+	} else {
+		DBG_ERROR( DbgInfo, "Could not determine radio frequency\n" );
+		DBG_LEAVE( DbgInfo );
+		ret = -EINVAL;
+		goto out_unlock;
+	}
+
+	if( rrq->value > 0 &&
+		rrq->value <= 1 * MEGABIT ) {
+		lp->TxRateControl[index] = 0x0001;
+	}
+	else if( rrq->value > 1 * MEGABIT &&
+			rrq->value <= 2 * MEGABIT ) {
+		if( rrq->fixed == 1 ) {
+			lp->TxRateControl[index] = 0x0002;
+		} else {
+			lp->TxRateControl[index] = 0x0003;
+		}
+	}
+	else if( rrq->value > 2 * MEGABIT &&
+			rrq->value <= 5 * MEGABIT ) {
+		if( rrq->fixed == 1 ) {
+			lp->TxRateControl[index] = 0x0004;
+		} else {
+			lp->TxRateControl[index] = 0x0007;
+		}
+	}
+	else if( rrq->value > 5 * MEGABIT &&
+			rrq->value <= 6 * MEGABIT ) {
+		if( rrq->fixed == 1 ) {
+			lp->TxRateControl[index] = 0x0010;
+		} else {
+			lp->TxRateControl[index] = 0x0017;
+		}
+	}
+	else if( rrq->value > 6 * MEGABIT &&
+			rrq->value <= 9 * MEGABIT ) {
+		if( rrq->fixed == 1 ) {
+			lp->TxRateControl[index] = 0x0020;
+		} else {
+			lp->TxRateControl[index] = 0x0037;
+		}
+	}
+	else if( rrq->value > 9 * MEGABIT &&
+			rrq->value <= 11 * MEGABIT ) {
+		if( rrq->fixed == 1 ) {
+			lp->TxRateControl[index] = 0x0008;
+		} else {
+			lp->TxRateControl[index] = 0x003F;
+		}
+	}
+	else if( rrq->value > 11 * MEGABIT &&
+			rrq->value <= 12 * MEGABIT ) {
+		if( rrq->fixed == 1 ) {
+			lp->TxRateControl[index] = 0x0040;
+		} else {
+			lp->TxRateControl[index] = 0x007F;
+		}
+	}
+	else if( rrq->value > 12 * MEGABIT &&
+			rrq->value <= 18 * MEGABIT ) {
+		if( rrq->fixed == 1 ) {
+			lp->TxRateControl[index] = 0x0080;
+		} else {
+			lp->TxRateControl[index] = 0x00FF;
+		}
+	}
+	else if( rrq->value > 18 * MEGABIT &&
+			rrq->value <= 24 * MEGABIT ) {
+		if( rrq->fixed == 1 ) {
+			lp->TxRateControl[index] = 0x0100;
+		} else {
+			lp->TxRateControl[index] = 0x01FF;
+		}
+	}
+	else if( rrq->value > 24 * MEGABIT &&
+			rrq->value <= 36 * MEGABIT ) {
+		if( rrq->fixed == 1 ) {
+			lp->TxRateControl[index] = 0x0200;
+		} else {
+			lp->TxRateControl[index] = 0x03FF;
+		}
+	}
+	else if( rrq->value > 36 * MEGABIT &&
+			rrq->value <= 48 * MEGABIT ) {
+		if( rrq->fixed == 1 ) {
+			lp->TxRateControl[index] = 0x0400;
+		} else {
+			lp->TxRateControl[index] = 0x07FF;
+		}
+	}
+	else if( rrq->value > 48 * MEGABIT &&
+			rrq->value <= 54 * MEGABIT ) {
+		if( rrq->fixed == 1 ) {
+			lp->TxRateControl[index] = 0x0800;
+		} else {
+			lp->TxRateControl[index] = 0x0FFF;
+		}
+	}
+	else if( rrq->fixed == 0 ) {
+		/* In this case, the user has not specified a bitrate, only the "auto"
+		   moniker. So, set to all supported rates */
+		lp->TxRateControl[index] = PARM_MAX_TX_RATE;
+	} else {
+		rrq->value = 0;
+		ret = -EINVAL;
+		goto out_unlock;
+	}
+
+
+#else
+
+	if( rrq->value > 0 &&
+			rrq->value <= 1 * MEGABIT ) {
+		lp->TxRateControl[0] = 1;
+	}
+	else if( rrq->value > 1 * MEGABIT &&
+			rrq->value <= 2 * MEGABIT ) {
+		if( rrq->fixed ) {
+			lp->TxRateControl[0] = 2;
+		} else {
+			lp->TxRateControl[0] = 6;
+		}
+	}
+	else if( rrq->value > 2 * MEGABIT &&
+			rrq->value <= 5 * MEGABIT ) {
+		if( rrq->fixed ) {
+			lp->TxRateControl[0] = 4;
+		} else {
+			lp->TxRateControl[0] = 7;
+		}
+	}
+	else if( rrq->value > 5 * MEGABIT &&
+			rrq->value <= 11 * MEGABIT ) {
+		if( rrq->fixed)  {
+			lp->TxRateControl[0] = 5;
+		} else {
+			lp->TxRateControl[0] = 3;
+		}
+	}
+	else if( rrq->fixed == 0 ) {
+		/* In this case, the user has not specified a bitrate, only the "auto"
+		   moniker. So, set the rate to 11Mb auto */
+		lp->TxRateControl[0] = 3;
+	} else {
+		rrq->value = 0;
+		ret = -EINVAL;
+		goto out_unlock;
+	}
+
+#endif  // WARP
+
+
+	/* Commit the adapter parameters */
+	wl_apply( lp );
+
+out_unlock:
+
+    	wl_act_int_on( lp );
+
+	wl_unlock(lp, &flags);
+
+out:
+	DBG_LEAVE( DbgInfo );
+	return ret;
+} // wireless_set_rate
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wireless_get_rate()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Get the default data rate setting used by the wireless device.
+ *
+ *  PARAMETERS:
+ *
+ *      wrq - the wireless request buffer
+ *      lp  - the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+static int wireless_get_rate(struct net_device *dev, struct iw_request_info *info, struct iw_param *rrq, char *extra)
+
+{
+	struct wl_private *lp = wl_priv(dev);
+	unsigned long flags;
+	int     ret = 0;
+	int     status = -1;
+	hcf_16  txRate;
+	/*------------------------------------------------------------------------*/
+
+
+	DBG_FUNC( "wireless_get_rate" );
+	DBG_ENTER( DbgInfo );
+
+	if(lp->portState == WVLAN_PORT_STATE_DISABLED) {
+		ret = -EBUSY;
+		goto out;
+	}
+
+	wl_lock( lp, &flags );
+
+    	wl_act_int_off( lp );
+
+	/* Get the current transmit rate from the adapter */
+	lp->ltvRecord.len = 1 + ( sizeof(txRate)/sizeof(hcf_16));
+	lp->ltvRecord.typ = CFG_CUR_TX_RATE;
+
+	status = hcf_get_info( &( lp->hcfCtx ), (LTVP)&( lp->ltvRecord ));
+
+	if( status == HCF_SUCCESS ) {
+#ifdef WARP
+
+		txRate = CNV_LITTLE_TO_INT( lp->ltvRecord.u.u16[0] );
+
+		if( txRate & 0x0001 ) {
+			txRate = 1;
+		}
+		else if( txRate & 0x0002 ) {
+			txRate = 2;
+		}
+		else if( txRate & 0x0004 ) {
+			txRate = 5;
+		}
+		else if( txRate & 0x0008 ) {
+			txRate = 11;
+		}
+		else if( txRate & 0x00010 ) {
+			txRate = 6;
+		}
+		else if( txRate & 0x00020 ) {
+			txRate = 9;
+		}
+		else if( txRate & 0x00040 ) {
+			txRate = 12;
+		}
+		else if( txRate & 0x00080 ) {
+			txRate = 18;
+		}
+		else if( txRate & 0x00100 ) {
+			txRate = 24;
+		}
+		else if( txRate & 0x00200 ) {
+			txRate = 36;
+		}
+		else if( txRate & 0x00400 ) {
+			txRate = 48;
+		}
+		else if( txRate & 0x00800 ) {
+			txRate = 54;
+		}
+
+#else
+
+		txRate = (hcf_16)CNV_LITTLE_TO_LONG( lp->ltvRecord.u.u32[0] );
+
+#endif  // WARP
+
+		rrq->value = txRate * MEGABIT;
+	} else {
+		rrq->value = 0;
+		ret = -EFAULT;
+	}
+
+    	wl_act_int_on( lp );
+
+	wl_unlock(lp, &flags);
+
+out:
+	DBG_LEAVE( DbgInfo );
+	return ret;
+} // wireless_get_rate
+/*============================================================================*/
+
+
+
+
+#if 0 //;? Not used anymore
+/*******************************************************************************
+ *	wireless_get_private_interface()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Returns the Linux Wireless Extensions' compatible private interface of
+ *  the driver.
+ *
+ *  PARAMETERS:
+ *
+ *      wrq - the wireless request buffer
+ *      lp  - the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+int wireless_get_private_interface( struct iwreq *wrq, struct wl_private *lp )
+{
+	int ret = 0;
+	/*------------------------------------------------------------------------*/
+
+
+	DBG_FUNC( "wireless_get_private_interface" );
+	DBG_ENTER( DbgInfo );
+
+	if(lp->portState == WVLAN_PORT_STATE_DISABLED) {
+		ret = -EBUSY;
+		goto out;
+	}
+
+	if( wrq->u.data.pointer != NULL ) {
+		struct iw_priv_args priv[] =
+		{
+			{ SIOCSIWNETNAME, IW_PRIV_TYPE_CHAR | HCF_MAX_NAME_LEN, 0, "snetwork_name" },
+			{ SIOCGIWNETNAME, 0, IW_PRIV_TYPE_CHAR | HCF_MAX_NAME_LEN, "gnetwork_name" },
+			{ SIOCSIWSTANAME, IW_PRIV_TYPE_CHAR | HCF_MAX_NAME_LEN, 0, "sstation_name" },
+			{ SIOCGIWSTANAME, 0, IW_PRIV_TYPE_CHAR | HCF_MAX_NAME_LEN, "gstation_name" },
+			{ SIOCSIWPORTTYPE, IW_PRIV_TYPE_BYTE | IW_PRIV_SIZE_FIXED | 1, 0, "sport_type" },
+			{ SIOCGIWPORTTYPE, 0, IW_PRIV_TYPE_BYTE | IW_PRIV_SIZE_FIXED | 1, "gport_type" },
+		};
+
+		/* Verify the user buffer */
+		ret = verify_area( VERIFY_WRITE, wrq->u.data.pointer, sizeof( priv ));
+
+		if( ret != 0 ) {
+			DBG_LEAVE( DbgInfo );
+			return ret;
+		}
+
+		/* Copy the data into the user's buffer */
+		wrq->u.data.length = NELEM( priv );
+		copy_to_user( wrq->u.data.pointer, &priv, sizeof( priv ));
+	}
+
+out:
+	DBG_LEAVE( DbgInfo );
+	return ret;
+} // wireless_get_private_interface
+/*============================================================================*/
+#endif
+
+
+
+#if WIRELESS_EXT > 13
+
+/*******************************************************************************
+ *	wireless_set_scan()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Instructs the driver to initiate a network scan.
+ *
+ *  PARAMETERS:
+ *
+ *      wrq - the wireless request buffer
+ *      lp  - the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+static int wireless_set_scan(struct net_device *dev, struct iw_request_info *info, struct iw_point *data, char *extra)
+{
+	struct wl_private *lp = wl_priv(dev);
+	unsigned long flags;
+	int                 ret = 0;
+	int                 status = -1;
+	int		    retries = 0;
+	/*------------------------------------------------------------------------*/
+
+	//;? Note: shows results as trace, retruns always 0 unless BUSY
+
+	DBG_FUNC( "wireless_set_scan" );
+	DBG_ENTER( DbgInfo );
+
+	if(lp->portState == WVLAN_PORT_STATE_DISABLED) {
+		ret = -EBUSY;
+		goto out;
+	}
+
+	wl_lock( lp, &flags );
+
+    	wl_act_int_off( lp );
+
+	/*
+         * This looks like a nice place to test if the HCF is still
+         * communicating with the card. It seems that sometimes BAP_1
+         * gets corrupted. By looking at the comments in HCF the
+         * cause is still a mistery. Okay, the communication to the
+         * card is dead, reset the card to revive.
+         */
+	if((lp->hcfCtx.IFB_CardStat & CARD_STAT_DEFUNCT) != 0)
+	{
+		DBG_TRACE( DbgInfo, "CARD is in DEFUNCT mode, reset it to bring it back to life\n" );
+		wl_reset( dev );
+	}
+
+retry:
+	/* Set the completion state to FALSE */
+	lp->probe_results.scan_complete = FALSE;
+
+
+	/* Channels to scan */
+#ifdef WARP
+	lp->ltvRecord.len       = 5;
+	lp->ltvRecord.typ       = CFG_SCAN_CHANNEL;
+	lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( 0x3FFF );  // 2.4 GHz Band
+	lp->ltvRecord.u.u16[1]  = CNV_INT_TO_LITTLE( 0xFFFF );  // 5.0 GHz Band
+	lp->ltvRecord.u.u16[2]  = CNV_INT_TO_LITTLE( 0xFFFF );  //      ..
+	lp->ltvRecord.u.u16[3]  = CNV_INT_TO_LITTLE( 0x0007 );  //      ..
+#else
+	lp->ltvRecord.len       = 2;
+	lp->ltvRecord.typ       = CFG_SCAN_CHANNEL;
+	lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( 0x7FFF );
+#endif  // WARP
+
+	status = hcf_put_info( &( lp->hcfCtx ), (LTVP)&( lp->ltvRecord ));
+
+	DBG_TRACE( DbgInfo, "CFG_SCAN_CHANNEL result      : 0x%x\n", status );
+
+	// Holding the lock too long, make a gap to allow other processes
+	wl_unlock(lp, &flags);
+	wl_lock( lp, &flags );
+
+	if( status != HCF_SUCCESS ) {
+		//Recovery
+		retries++;
+		if(retries <= 10) {
+			DBG_TRACE( DbgInfo, "Reset card to recover, attempt: %d\n", retries );
+			wl_reset( dev );
+
+			// Holding the lock too long, make a gap to allow other processes
+			wl_unlock(lp, &flags);
+			wl_lock( lp, &flags );
+
+			goto retry;
+		}
+	}
+
+	/* Set the SCAN_SSID to "ANY". Using this RID for scan prevents the need to
+	   disassociate from the network we are currently on */
+	lp->ltvRecord.len       = 18;
+	lp->ltvRecord.typ       = CFG_SCAN_SSID;
+	lp->ltvRecord.u.u16[0]  = CNV_INT_TO_LITTLE( 0 );
+	lp->ltvRecord.u.u16[1]  = CNV_INT_TO_LITTLE( 0 );
+
+	status = hcf_put_info( &( lp->hcfCtx ), (LTVP)&( lp->ltvRecord ));
+
+	// Holding the lock too long, make a gap to allow other processes
+	wl_unlock(lp, &flags);
+	wl_lock( lp, &flags );
+
+	DBG_TRACE( DbgInfo, "CFG_SCAN_SSID to 'any' status: 0x%x\n", status );
+
+	/* Initiate the scan */
+	/* NOTE: Using HCF_ACT_SCAN has been removed, as using HCF_ACT_ACS_SCAN to
+	   retrieve probe responses must always be used to support WPA */
+	status = hcf_action( &( lp->hcfCtx ), HCF_ACT_ACS_SCAN );
+
+	if( status == HCF_SUCCESS ) {
+		DBG_TRACE( DbgInfo, "SUCCESSFULLY INITIATED SCAN...\n" );
+	} else {
+		DBG_TRACE( DbgInfo, "INITIATE SCAN FAILED...\n" );
+	}
+
+    	wl_act_int_on( lp );
+
+	wl_unlock(lp, &flags);
+
+out:
+	DBG_LEAVE(DbgInfo);
+	return ret;
+} // wireless_set_scan
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wireless_get_scan()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Instructs the driver to gather and return the results of a network scan.
+ *
+ *  PARAMETERS:
+ *
+ *      wrq - the wireless request buffer
+ *      lp  - the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+static int wireless_get_scan(struct net_device *dev, struct iw_request_info *info, struct iw_point *data, char *extra)
+{
+	struct wl_private *lp = wl_priv(dev);
+	unsigned long flags;
+	int                 ret = 0;
+	int                 count;
+	char                *buf;
+	char                *buf_end;
+	struct iw_event     iwe;
+	PROBE_RESP          *probe_resp;
+	hcf_8               msg[512];
+	hcf_8               *wpa_ie;
+	hcf_16              wpa_ie_len;
+	/*------------------------------------------------------------------------*/
+
+
+	DBG_FUNC( "wireless_get_scan" );
+	DBG_ENTER( DbgInfo );
+
+	if(lp->portState == WVLAN_PORT_STATE_DISABLED) {
+		ret = -EBUSY;
+		goto out;
+	}
+
+	wl_lock( lp, &flags );
+
+    	wl_act_int_off( lp );
+
+	/* If the scan is not done, tell the calling process to try again later */
+	if( !lp->probe_results.scan_complete ) {
+		ret = -EAGAIN;
+		goto out_unlock;
+	}
+
+	DBG_TRACE( DbgInfo, "SCAN COMPLETE, Num of APs: %d\n",
+			   lp->probe_results.num_aps );
+
+	buf     = extra;
+	buf_end = extra + IW_SCAN_MAX_DATA;
+
+	for( count = 0; count < lp->probe_results.num_aps; count++ ) {
+		/* Reference the probe response from the table */
+		probe_resp = (PROBE_RESP *)&lp->probe_results.ProbeTable[count];
+
+
+		/* First entry MUST be the MAC address */
+		memset( &iwe, 0, sizeof( iwe ));
+
+		iwe.cmd                 = SIOCGIWAP;
+		iwe.u.ap_addr.sa_family = ARPHRD_ETHER;
+		memcpy( iwe.u.ap_addr.sa_data, probe_resp->BSSID, ETH_ALEN);
+		iwe.len                 = IW_EV_ADDR_LEN;
+
+		buf = IWE_STREAM_ADD_EVENT(info, buf, buf_end, &iwe, IW_EV_ADDR_LEN);
+
+
+		/* Use the mode to indicate if it's a station or AP */
+		/* Won't always be an AP if in IBSS mode */
+		memset( &iwe, 0, sizeof( iwe ));
+
+		iwe.cmd = SIOCGIWMODE;
+
+		if( probe_resp->capability & CAPABILITY_IBSS ) {
+			iwe.u.mode = IW_MODE_INFRA;
+		} else {
+			iwe.u.mode = IW_MODE_MASTER;
+		}
+
+		iwe.len = IW_EV_UINT_LEN;
+
+		buf = IWE_STREAM_ADD_EVENT(info, buf, buf_end, &iwe, IW_EV_UINT_LEN);
+
+
+		/* Any quality information */
+		memset(&iwe, 0, sizeof(iwe));
+
+		iwe.cmd             = IWEVQUAL;
+		iwe.u.qual.level    = dbm(probe_resp->signal);
+		iwe.u.qual.noise    = dbm(probe_resp->silence);
+		iwe.u.qual.qual     = iwe.u.qual.level - iwe.u.qual.noise;
+		iwe.u.qual.updated  = lp->probe_results.scan_complete | IW_QUAL_DBM;
+		iwe.len             = IW_EV_QUAL_LEN;
+
+		buf = IWE_STREAM_ADD_EVENT(info, buf, buf_end, &iwe, IW_EV_QUAL_LEN);
+
+
+		/* ESSID information */
+		if( probe_resp->rawData[1] > 0 ) {
+			memset( &iwe, 0, sizeof( iwe ));
+
+			iwe.cmd = SIOCGIWESSID;
+			iwe.u.data.length = probe_resp->rawData[1];
+			iwe.u.data.flags = 1;
+
+			buf = IWE_STREAM_ADD_POINT(info, buf, buf_end, &iwe, &probe_resp->rawData[2]);
+		}
+
+
+		/* Encryption Information */
+		memset( &iwe, 0, sizeof( iwe ));
+
+		iwe.cmd             = SIOCGIWENCODE;
+		iwe.u.data.length   = 0;
+
+		/* Check the capabilities field of the Probe Response to see if
+		   'privacy' is supported on the AP in question */
+		if( probe_resp->capability & CAPABILITY_PRIVACY ) {
+			iwe.u.data.flags |= IW_ENCODE_ENABLED;
+		} else {
+			iwe.u.data.flags |= IW_ENCODE_DISABLED;
+		}
+
+		buf = IWE_STREAM_ADD_POINT(info, buf, buf_end, &iwe, NULL);
+
+
+		/* Frequency Info */
+		memset( &iwe, 0, sizeof( iwe ));
+
+		iwe.cmd = SIOCGIWFREQ;
+		iwe.len = IW_EV_FREQ_LEN;
+		iwe.u.freq.m = wl_parse_ds_ie( probe_resp );
+		iwe.u.freq.e = 0;
+
+		buf = IWE_STREAM_ADD_EVENT(info, buf, buf_end, &iwe, IW_EV_FREQ_LEN);
+
+
+#if WIRELESS_EXT > 14
+		/* Custom info (Beacon Interval) */
+		memset( &iwe, 0, sizeof( iwe ));
+		memset( msg, 0, sizeof( msg ));
+
+		iwe.cmd = IWEVCUSTOM;
+		sprintf( msg, "beacon_interval=%d", probe_resp->beaconInterval );
+		iwe.u.data.length = strlen( msg );
+
+		buf = IWE_STREAM_ADD_POINT(info, buf, buf_end, &iwe, msg);
+
+
+		/* Custom info (WPA-IE) */
+		wpa_ie = NULL;
+		wpa_ie_len = 0;
+
+		wpa_ie = wl_parse_wpa_ie( probe_resp, &wpa_ie_len );
+		if( wpa_ie != NULL ) {
+			memset( &iwe, 0, sizeof( iwe ));
+			memset( msg, 0, sizeof( msg ));
+
+			iwe.cmd = IWEVCUSTOM;
+			sprintf( msg, "wpa_ie=%s", wl_print_wpa_ie( wpa_ie, wpa_ie_len ));
+			iwe.u.data.length = strlen( msg );
+
+			buf = IWE_STREAM_ADD_POINT(info, buf, buf_end, &iwe, msg);
+		}
+
+		/* Add other custom info in formatted string format as needed... */
+#endif
+	}
+
+	data->length = buf - extra;
+
+out_unlock:
+
+    	wl_act_int_on( lp );
+
+	wl_unlock(lp, &flags);
+
+out:
+	DBG_LEAVE( DbgInfo );
+	return ret;
+} // wireless_get_scan
+/*============================================================================*/
+
+#endif  // WIRELESS_EXT > 13
+
+
+#if WIRELESS_EXT > 17
+
+static int wireless_set_auth(struct net_device *dev,
+			  struct iw_request_info *info,
+			  struct iw_param *data, char *extra)
+{
+	struct wl_private *lp = wl_priv(dev);
+	unsigned long flags;
+	int			      ret;
+	int			      iwa_idx = data->flags & IW_AUTH_INDEX;
+	int			      iwa_val = data->value;
+
+	DBG_FUNC( "wireless_set_auth" );
+	DBG_ENTER( DbgInfo );
+
+	if(lp->portState == WVLAN_PORT_STATE_DISABLED) {
+		ret = -EBUSY;
+		goto out;
+	}
+
+	wl_lock( lp, &flags );
+
+    	wl_act_int_off( lp );
+
+	switch (iwa_idx) {
+		case IW_AUTH_WPA_VERSION:
+			DBG_TRACE( DbgInfo, "IW_AUTH_WPA_VERSION\n");
+			/* We do support WPA only; how should DISABLED be treated? */
+			if (iwa_val == IW_AUTH_WPA_VERSION_WPA)
+				ret = 0;
+			else
+				ret = -EINVAL;
+			break;
+
+		case IW_AUTH_WPA_ENABLED:
+			DBG_TRACE( DbgInfo, "IW_AUTH_WPA_ENABLED: val = %d\n", iwa_val);
+			if (iwa_val)
+				lp->EnableEncryption = 2;
+			else
+				lp->EnableEncryption = 0;
+			ret = 0;
+			break;
+
+		case IW_AUTH_TKIP_COUNTERMEASURES:
+			DBG_TRACE( DbgInfo, "IW_AUTH_TKIP_COUNTERMEASURES\n");
+			lp->driverEnable = !iwa_val;
+			if(lp->driverEnable)
+				hcf_cntl(&(lp->hcfCtx), HCF_CNTL_ENABLE | HCF_PORT_0);
+			else
+				hcf_cntl(&(lp->hcfCtx), HCF_CNTL_DISABLE | HCF_PORT_0);
+			ret = 0;
+			break;
+
+		case IW_AUTH_DROP_UNENCRYPTED:
+			DBG_TRACE( DbgInfo, "IW_AUTH_DROP_UNENCRYPTED\n");
+			/* We do not actually do anything here, just to silence
+			 * wpa_supplicant */
+			ret = 0;
+			break;
+
+		case IW_AUTH_CIPHER_PAIRWISE:
+			DBG_TRACE( DbgInfo, "IW_AUTH_CIPHER_PAIRWISE\n");
+			/* not implemented, return an error */
+			ret = -EINVAL;
+			break;
+
+		case IW_AUTH_CIPHER_GROUP:
+			DBG_TRACE( DbgInfo, "IW_AUTH_CIPHER_GROUP\n");
+			/* not implemented, return an error */
+			ret = -EINVAL;
+			break;
+
+		case IW_AUTH_KEY_MGMT:
+			DBG_TRACE( DbgInfo, "IW_AUTH_KEY_MGMT\n");
+			/* not implemented, return an error */
+			ret = -EINVAL;
+			break;
+
+		case IW_AUTH_80211_AUTH_ALG:
+			DBG_TRACE( DbgInfo, "IW_AUTH_80211_AUTH_ALG\n");
+			/* not implemented, return an error */
+			ret = -EINVAL;
+			break;
+
+		case IW_AUTH_RX_UNENCRYPTED_EAPOL:
+			DBG_TRACE( DbgInfo, "IW_AUTH_RX_UNENCRYPTED_EAPOL\n");
+			/* not implemented, return an error */
+			ret = -EINVAL;
+			break;
+
+		case IW_AUTH_ROAMING_CONTROL:
+			DBG_TRACE( DbgInfo, "IW_AUTH_ROAMING_CONTROL\n");
+			/* not implemented, return an error */
+			ret = -EINVAL;
+			break;
+
+		case IW_AUTH_PRIVACY_INVOKED:
+			DBG_TRACE( DbgInfo, "IW_AUTH_PRIVACY_INVOKED\n");
+			/* not implemented, return an error */
+			ret = -EINVAL;
+			break;
+
+		default:
+			DBG_TRACE( DbgInfo, "IW_AUTH_?? (%d) unknown\n", iwa_idx);
+			/* return an error */
+			ret = -EINVAL;
+			break;
+	}
+
+    	wl_act_int_on( lp );
+
+	wl_unlock(lp, &flags);
+
+out:
+	DBG_LEAVE( DbgInfo );
+	return ret;
+} // wireless_set_auth
+/*============================================================================*/
+
+
+
+static int hermes_set_key(ltv_t *ltv, int alg, int key_idx, u8 *addr,
+			  int set_tx, u8 *seq, u8 *key, size_t key_len)
+{
+	int ret = -EINVAL;
+	// int   count = 0;
+	int   buf_idx = 0;
+	hcf_8 tsc[IW_ENCODE_SEQ_MAX_SIZE] =
+		{ 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00 };
+
+	DBG_FUNC( "hermes_set_key" );
+	DBG_ENTER( DbgInfo );
+
+	/*
+         * Check the key index here; if 0, load as Pairwise Key, otherwise,
+         * load as a group key. Note that for the Hermes, the RIDs for
+         * group/pariwise keys are different from each other and different
+         * than the default WEP keys as well.
+         */
+	switch (alg)
+	{
+	case IW_ENCODE_ALG_TKIP:
+		DBG_TRACE( DbgInfo, "IW_ENCODE_ALG_TKIP: key(%d)\n", key_idx);
+#if 0
+		/*
+                 * Make sure that there is no data queued up in the firmware
+                 * before setting the TKIP keys. If this check is not
+                 * performed, some data may be sent out with incorrect MIC
+                 * and cause synchronizarion errors with the AP
+                 */
+		/* Check every 1ms for 100ms */
+		for( count = 0; count < 100; count++ )
+		{
+			usleep( 1000 );
+
+			ltv.len = 2;
+			ltv.typ = 0xFD91;  // This RID not defined in HCF yet!!!
+			ltv.u.u16[0] = 0;
+
+			wl_get_info( sock, &ltv, ifname );
+
+			if( ltv.u.u16[0] == 0 )
+			{
+				break;
+			}
+		}
+
+		if( count == 100 )
+		{
+			wpa_printf( MSG_DEBUG, "Timed out waiting for TxQ!" );
+		}
+#endif
+
+		switch (key_idx) {
+		case 0:
+			ltv->len = 28;
+			ltv->typ = CFG_ADD_TKIP_MAPPED_KEY;
+
+			/* Load the BSSID */
+			memcpy(&ltv->u.u8[buf_idx], addr, ETH_ALEN);
+			buf_idx += ETH_ALEN;
+
+			/* Load the TKIP key */
+			memcpy(&ltv->u.u8[buf_idx], &key[0], 16);
+			buf_idx += 16;
+
+			/* Load the TSC */
+			memcpy(&ltv->u.u8[buf_idx], tsc, IW_ENCODE_SEQ_MAX_SIZE);
+			buf_idx += IW_ENCODE_SEQ_MAX_SIZE;
+
+			/* Load the RSC */
+			memcpy(&ltv->u.u8[buf_idx], seq, IW_ENCODE_SEQ_MAX_SIZE);
+			buf_idx += IW_ENCODE_SEQ_MAX_SIZE;
+
+			/* Load the TxMIC key */
+			memcpy(&ltv->u.u8[buf_idx], &key[16], 8);
+			buf_idx += 8;
+
+			/* Load the RxMIC key */
+			memcpy(&ltv->u.u8[buf_idx], &key[24], 8);
+
+			ret = 0;
+			break;
+		case 1:
+		case 2:
+		case 3:
+			ltv->len = 26;
+			ltv->typ = CFG_ADD_TKIP_DEFAULT_KEY;
+
+			/* Load the key Index */
+			ltv->u.u16[buf_idx] = key_idx;
+			/* If this is a Tx Key, set bit 8000 */
+			if(set_tx)
+				ltv->u.u16[buf_idx] |= 0x8000;
+			buf_idx += 2;
+
+			/* Load the RSC */
+			memcpy(&ltv->u.u8[buf_idx], seq, IW_ENCODE_SEQ_MAX_SIZE);
+			buf_idx += IW_ENCODE_SEQ_MAX_SIZE;
+
+			/* Load the TKIP, TxMIC, and RxMIC keys in one shot, because in
+			   CFG_ADD_TKIP_DEFAULT_KEY they are back-to-back */
+			memcpy(&ltv->u.u8[buf_idx], key, key_len);
+			buf_idx += key_len;
+
+			/* Load the TSC */
+			memcpy(&ltv->u.u8[buf_idx], tsc, IW_ENCODE_SEQ_MAX_SIZE);
+
+			ltv->u.u16[0] = CNV_INT_TO_LITTLE(ltv->u.u16[0]);
+
+			ret = 0;
+			break;
+		default:
+			break;
+		}
+
+		break;
+
+	case IW_ENCODE_ALG_WEP:
+		DBG_TRACE( DbgInfo, "IW_ENCODE_ALG_WEP: key(%d)\n", key_idx);
+		break;
+
+	case IW_ENCODE_ALG_CCMP:
+		DBG_TRACE( DbgInfo, "IW_ENCODE_ALG_CCMP: key(%d)\n", key_idx);
+		break;
+
+	case IW_ENCODE_ALG_NONE:
+		DBG_TRACE( DbgInfo, "IW_ENCODE_ALG_NONE: key(%d)\n", key_idx);
+		switch (key_idx) {
+		case 0:
+			if (memcmp(addr, "\xff\xff\xff\xff\xff\xff", ETH_ALEN) != 0) {
+			//if (addr != NULL) {
+				ltv->len = 7;
+				ltv->typ = CFG_REMOVE_TKIP_MAPPED_KEY;
+				memcpy(&ltv->u.u8[0], addr, ETH_ALEN);
+				ret = 0;
+			}
+			break;
+		case 1:
+		case 2:
+		case 3:
+			/* Clear the Group TKIP keys by index */
+			ltv->len = 2;
+			ltv->typ = CFG_REMOVE_TKIP_DEFAULT_KEY;
+			ltv->u.u16[0] = key_idx;
+
+			ret = 0;
+			break;
+		default:
+			break;
+		}
+		break;
+	default:
+		DBG_TRACE( DbgInfo, "IW_ENCODE_??: key(%d)\n", key_idx);
+		break;
+	}
+
+	DBG_LEAVE( DbgInfo );
+	return ret;
+} // hermes_set_key
+/*============================================================================*/
+
+
+
+static int wireless_set_encodeext (struct net_device *dev,
+					struct iw_request_info *info,
+					struct iw_point *erq, char *keybuf)
+{
+	struct wl_private *lp = wl_priv(dev);
+	unsigned long flags;
+	int			      ret;
+	int key_idx = (erq->flags&IW_ENCODE_INDEX) - 1;
+	ltv_t ltv;
+	struct iw_encode_ext *ext = (struct iw_encode_ext *)keybuf;
+
+	DBG_FUNC( "wireless_set_encodeext" );
+	DBG_ENTER( DbgInfo );
+
+	if(lp->portState == WVLAN_PORT_STATE_DISABLED) {
+		ret = -EBUSY;
+		goto out;
+	}
+
+	if (sizeof(ext->rx_seq) != 8) {
+		DBG_TRACE(DbgInfo, "rz_seq size mismatch\n");
+		DBG_LEAVE(DbgInfo);
+		return -EINVAL;
+	}
+
+	/* Handle WEP keys via the old set encode procedure */
+	if(ext->alg == IW_ENCODE_ALG_WEP) {
+		struct iw_point  wep_erq;
+		char            *wep_keybuf;
+
+		/* Build request structure */
+		wep_erq.flags  = erq->flags;   // take over flags with key index
+		wep_erq.length = ext->key_len; // take length from extended key info
+		wep_keybuf     = ext->key;     // pointer to the key text
+
+		/* Call wireless_set_encode tot handle the WEP key */
+		ret = wireless_set_encode(dev, info, &wep_erq, wep_keybuf);
+		goto out;
+	}
+
+	/* Proceed for extended encode functions for WAP and NONE */
+	wl_lock( lp, &flags );
+
+    	wl_act_int_off( lp );
+
+	memset(&ltv, 0, sizeof(ltv));
+	ret = hermes_set_key(&ltv, ext->alg, key_idx, ext->addr.sa_data,
+				ext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY,
+				ext->rx_seq, ext->key, ext->key_len);
+
+	if (ret != 0) {
+		DBG_TRACE( DbgInfo, "hermes_set_key returned != 0, key not set\n");
+		goto out_unlock;
+	}
+
+	/* Put the key in HCF */
+	ret = hcf_put_info(&(lp->hcfCtx), (LTVP)&ltv);
+
+out_unlock:
+	if(ret == HCF_SUCCESS) {
+		DBG_TRACE( DbgInfo, "Put key info succes\n");
+	} else {
+		DBG_TRACE( DbgInfo, "Put key info failed, key not set\n");
+	}
+
+    	wl_act_int_on( lp );
+
+	wl_unlock(lp, &flags);
+
+out:
+	DBG_LEAVE( DbgInfo );
+	return ret;
+} // wireless_set_encodeext
+/*============================================================================*/
+
+
+
+static int wireless_get_genie(struct net_device *dev,
+					   struct iw_request_info *info,
+					   struct iw_point *data, char *extra)
+
+{
+	struct wl_private *lp = wl_priv(dev);
+	unsigned long flags;
+	int   ret = 0;
+	ltv_t ltv;
+
+	DBG_FUNC( "wireless_get_genie" );
+	DBG_ENTER( DbgInfo );
+
+	if(lp->portState == WVLAN_PORT_STATE_DISABLED) {
+		ret = -EBUSY;
+		goto out;
+	}
+
+	wl_lock( lp, &flags );
+
+    	wl_act_int_off( lp );
+
+	memset(&ltv, 0, sizeof(ltv));
+	ltv.len = 2;
+	ltv.typ = CFG_SET_WPA_AUTH_KEY_MGMT_SUITE;
+	lp->AuthKeyMgmtSuite = ltv.u.u16[0] = 4;
+	ltv.u.u16[0]  = CNV_INT_TO_LITTLE(ltv.u.u16[0]);
+
+	ret = hcf_put_info(&(lp->hcfCtx), (LTVP)&ltv);
+
+    	wl_act_int_on( lp );
+
+	wl_unlock(lp, &flags);
+
+out:
+	DBG_LEAVE( DbgInfo );
+	return ret;
+}
+/*============================================================================*/
+
+
+#endif // WIRELESS_EXT > 17
+
+/*******************************************************************************
+ *	wl_wireless_stats()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Return the current device wireless statistics.
+ *
+ *  PARAMETERS:
+ *
+ *      wrq - the wireless request buffer
+ *      lp  - the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+struct iw_statistics * wl_wireless_stats( struct net_device *dev )
+{
+	struct iw_statistics    *pStats;
+	struct wl_private       *lp = wl_priv(dev);
+	/*------------------------------------------------------------------------*/
+
+
+	DBG_FUNC( "wl_wireless_stats" );
+	DBG_ENTER(DbgInfo);
+	DBG_PARAM(DbgInfo, "dev", "%s (0x%p)", dev->name, dev);
+
+	pStats = NULL;
+
+	/* Initialize the statistics */
+	pStats			= &( lp->wstats );
+	pStats->qual.updated    = 0x00;
+
+	if( !( lp->flags & WVLAN2_UIL_BUSY ))
+	{
+		CFG_COMMS_QUALITY_STRCT *pQual;
+		CFG_HERMES_TALLIES_STRCT tallies;
+		int                         status;
+
+		/* Update driver status */
+		pStats->status = 0;
+
+		/* Get the current link quality information */
+		lp->ltvRecord.len = 1 + ( sizeof( *pQual ) / sizeof( hcf_16 ));
+		lp->ltvRecord.typ = CFG_COMMS_QUALITY;
+		status = hcf_get_info( &( lp->hcfCtx ), (LTVP)&( lp->ltvRecord ));
+
+		if( status == HCF_SUCCESS ) {
+			pQual = (CFG_COMMS_QUALITY_STRCT *)&( lp->ltvRecord );
+
+#ifdef USE_DBM
+			pStats->qual.qual  = (u_char) CNV_LITTLE_TO_INT( pQual->coms_qual );
+			pStats->qual.level = (u_char) dbm( CNV_LITTLE_TO_INT( pQual->signal_lvl ));
+			pStats->qual.noise = (u_char) dbm( CNV_LITTLE_TO_INT( pQual->noise_lvl ));
+
+			pStats->qual.updated |= (IW_QUAL_QUAL_UPDATED  |
+                                                 IW_QUAL_LEVEL_UPDATED |
+                                                 IW_QUAL_NOISE_UPDATED |
+                                                 IW_QUAL_DBM);
+#else
+			pStats->qual.qual = percent( CNV_LITTLE_TO_INT( pQual->coms_qual ),
+						     HCF_MIN_COMM_QUALITY,
+						     HCF_MAX_COMM_QUALITY );
+
+			pStats->qual.level = percent( CNV_LITTLE_TO_INT( pQual->signal_lvl ),
+						      HCF_MIN_SIGNAL_LEVEL,
+						      HCF_MAX_SIGNAL_LEVEL );
+
+			pStats->qual.noise = percent( CNV_LITTLE_TO_INT( pQual->noise_lvl ),
+						      HCF_MIN_NOISE_LEVEL,
+						      HCF_MAX_NOISE_LEVEL );
+
+			pStats->qual.updated |= (IW_QUAL_QUAL_UPDATED  |
+                                                 IW_QUAL_LEVEL_UPDATED |
+                                                 IW_QUAL_NOISE_UPDATED);
+#endif /* USE_DBM */
+		} else {
+			memset( &( pStats->qual ), 0, sizeof( pStats->qual ));
+		}
+
+		/* Get the current tallies from the adapter */
+                /* Only possible when the device is open */
+		if(lp->portState == WVLAN_PORT_STATE_DISABLED) {
+			if( wl_get_tallies( lp, &tallies ) == 0 ) {
+				/* No endian translation is needed here, as CFG_TALLIES is an
+				   MSF RID; all processing is done on the host, not the card! */
+				pStats->discard.nwid = 0L;
+				pStats->discard.code = tallies.RxWEPUndecryptable;
+				pStats->discard.misc = tallies.TxDiscards +
+						       tallies.RxFCSErrors +
+						       //tallies.RxDiscardsNoBuffer +
+						       tallies.TxDiscardsWrongSA;
+				//;? Extra taken over from Linux driver based on 7.18 version
+				pStats->discard.retries = tallies.TxRetryLimitExceeded;
+				pStats->discard.fragment = tallies.RxMsgInBadMsgFragments;
+			} else {
+				memset( &( pStats->discard ), 0, sizeof( pStats->discard ));
+			}
+		} else {
+			memset( &( pStats->discard ), 0, sizeof( pStats->discard ));
+		}
+	}
+
+	DBG_LEAVE( DbgInfo );
+	return pStats;
+} // wl_wireless_stats
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wl_get_wireless_stats()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Return the current device wireless statistics. This function calls
+ *      wl_wireless_stats, but acquires spinlocks first as it can be called
+ *      directly by the network layer.
+ *
+ *  PARAMETERS:
+ *
+ *      wrq - the wireless request buffer
+ *      lp  - the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+struct iw_statistics * wl_get_wireless_stats( struct net_device *dev )
+{
+	unsigned long           flags;
+	struct wl_private       *lp = wl_priv(dev);
+	struct iw_statistics    *pStats = NULL;
+	/*------------------------------------------------------------------------*/
+
+	DBG_FUNC( "wl_get_wireless_stats" );
+	DBG_ENTER(DbgInfo);
+
+	wl_lock( lp, &flags );
+
+    	wl_act_int_off( lp );
+
+#ifdef USE_RTS
+	if( lp->useRTS == 1 ) {
+		DBG_TRACE( DbgInfo, "Skipping wireless stats, in RTS mode\n" );
+	} else
+#endif
+	{
+		pStats = wl_wireless_stats( dev );
+	}
+    	wl_act_int_on( lp );
+
+	wl_unlock(lp, &flags);
+
+	DBG_LEAVE( DbgInfo );
+	return pStats;
+} // wl_get_wireless_stats
+
+
+/*******************************************************************************
+ *	wl_spy_gather()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      Gather wireless spy statistics.
+ *
+ *  PARAMETERS:
+ *
+ *      wrq - the wireless request buffer
+ *      lp  - the device's private adapter structure
+ *
+ *  RETURNS:
+ *
+ *      0 on success
+ *      errno value otherwise
+ *
+ ******************************************************************************/
+inline void wl_spy_gather( struct net_device *dev, u_char *mac )
+{
+	struct iw_quality wstats;
+	int                     status;
+	u_char                  stats[2];
+	DESC_STRCT              desc[1];
+	struct wl_private   *lp = wl_priv(dev);
+	/*------------------------------------------------------------------------*/
+
+	/* shortcut */
+	if (!lp->spy_data.spy_number) {
+		return;
+	}
+
+	/* Gather wireless spy statistics: for each packet, compare the source
+	   address with out list, and if match, get the stats. */
+	memset( stats, 0, sizeof(stats));
+	memset( desc, 0, sizeof(DESC_STRCT));
+
+	desc[0].buf_addr	= stats;
+	desc[0].BUF_SIZE	= sizeof(stats);
+	desc[0].next_desc_addr  = 0;		// terminate list
+
+	status = hcf_rcv_msg( &( lp->hcfCtx ), &desc[0], 0 );
+
+	if( status == HCF_SUCCESS ) {
+		wstats.level = (u_char) dbm(stats[1]);
+		wstats.noise = (u_char) dbm(stats[0]);
+		wstats.qual  = wstats.level > wstats.noise ? wstats.level - wstats.noise : 0;
+
+		wstats.updated = (IW_QUAL_QUAL_UPDATED  |
+				  IW_QUAL_LEVEL_UPDATED |
+				  IW_QUAL_NOISE_UPDATED |
+				  IW_QUAL_DBM);
+
+		wireless_spy_update( dev, mac, &wstats );
+	}
+} // wl_spy_gather
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wl_wext_event_freq()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      This function is used to send an event that the channel/freq
+ *      configuration for a specific device has changed.
+ *
+ *
+ *  PARAMETERS:
+ *
+ *      dev - the network device for which this event is to be issued
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+void wl_wext_event_freq( struct net_device *dev )
+{
+#if WIRELESS_EXT > 13
+	union iwreq_data wrqu;
+	struct wl_private *lp = wl_priv(dev);
+	/*------------------------------------------------------------------------*/
+
+
+	memset( &wrqu, 0, sizeof( wrqu ));
+
+	wrqu.freq.m = lp->Channel;
+	wrqu.freq.e = 0;
+
+	wireless_send_event( dev, SIOCSIWFREQ, &wrqu, NULL );
+#endif /* WIRELESS_EXT > 13 */
+
+	return;
+} // wl_wext_event_freq
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wl_wext_event_mode()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      This function is used to send an event that the mode of operation
+ *      for a specific device has changed.
+ *
+ *
+ *  PARAMETERS:
+ *
+ *      dev - the network device for which this event is to be issued
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+void wl_wext_event_mode( struct net_device *dev )
+{
+#if WIRELESS_EXT > 13
+	union iwreq_data wrqu;
+	struct wl_private *lp = wl_priv(dev);
+	/*------------------------------------------------------------------------*/
+
+
+	memset( &wrqu, 0, sizeof( wrqu ));
+
+	if ( CNV_INT_TO_LITTLE( lp->hcfCtx.IFB_FWIdentity.comp_id ) == COMP_ID_FW_STA  ) {
+		wrqu.mode = IW_MODE_INFRA;
+	} else {
+		wrqu.mode = IW_MODE_MASTER;
+	}
+
+	wireless_send_event( dev, SIOCSIWMODE, &wrqu, NULL );
+#endif /* WIRELESS_EXT > 13 */
+
+	return;
+} // wl_wext_event_mode
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wl_wext_event_essid()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      This function is used to send an event that the ESSID configuration for
+ *      a specific device has changed.
+ *
+ *
+ *  PARAMETERS:
+ *
+ *      dev - the network device for which this event is to be issued
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+void wl_wext_event_essid( struct net_device *dev )
+{
+#if WIRELESS_EXT > 13
+	union iwreq_data wrqu;
+	struct wl_private *lp = wl_priv(dev);
+	/*------------------------------------------------------------------------*/
+
+
+	memset( &wrqu, 0, sizeof( wrqu ));
+
+	/* Fill out the buffer. Note that the buffer doesn't actually contain the
+	   ESSID, but a pointer to the contents. In addition, the 'extra' field of
+	   the call to wireless_send_event() must also point to where the ESSID
+	   lives */
+	wrqu.essid.length  = strlen( lp->NetworkName );
+	wrqu.essid.pointer = (caddr_t)lp->NetworkName;
+	wrqu.essid.flags   = 1;
+
+	wireless_send_event( dev, SIOCSIWESSID, &wrqu, lp->NetworkName );
+#endif /* WIRELESS_EXT > 13 */
+
+	return;
+} // wl_wext_event_essid
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wl_wext_event_encode()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      This function is used to send an event that the encryption configuration
+ *      for a specific device has changed.
+ *
+ *
+ *  PARAMETERS:
+ *
+ *      dev - the network device for which this event is to be issued
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+void wl_wext_event_encode( struct net_device *dev )
+{
+#if WIRELESS_EXT > 13
+	union iwreq_data wrqu;
+	struct wl_private *lp = wl_priv(dev);
+	int index = 0;
+	/*------------------------------------------------------------------------*/
+
+
+	memset( &wrqu, 0, sizeof( wrqu ));
+
+	if( lp->EnableEncryption == 0 ) {
+		wrqu.encoding.flags = IW_ENCODE_DISABLED;
+	} else {
+		wrqu.encoding.flags |= lp->TransmitKeyID;
+
+		index = lp->TransmitKeyID - 1;
+
+		/* Only set IW_ENCODE_RESTRICTED/OPEN flag using lp->ExcludeUnencrypted
+		   if we're in AP mode */
+#if 1 //;? (HCF_TYPE) & HCF_TYPE_AP
+		//;?should we restore this to allow smaller memory footprint
+
+		if ( CNV_INT_TO_LITTLE( lp->hcfCtx.IFB_FWIdentity.comp_id ) == COMP_ID_FW_AP  ) {
+			if( lp->ExcludeUnencrypted ) {
+				wrqu.encoding.flags |= IW_ENCODE_RESTRICTED;
+			} else {
+				wrqu.encoding.flags |= IW_ENCODE_OPEN;
+			}
+		}
+
+#endif  // HCF_TYPE_AP
+
+		/* Only provide the key if permissions allow */
+		if( capable( CAP_NET_ADMIN )) {
+			wrqu.encoding.pointer = (caddr_t)lp->DefaultKeys.key[index].key;
+			wrqu.encoding.length  = lp->DefaultKeys.key[index].len;
+		} else {
+			wrqu.encoding.flags |= IW_ENCODE_NOKEY;
+		}
+	}
+
+	wireless_send_event( dev, SIOCSIWENCODE, &wrqu,
+						 lp->DefaultKeys.key[index].key );
+#endif /* WIRELESS_EXT > 13 */
+
+	return;
+} // wl_wext_event_encode
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wl_wext_event_ap()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      This function is used to send an event that the device has been
+ *      associated to a new AP.
+ *
+ *
+ *  PARAMETERS:
+ *
+ *      dev - the network device for which this event is to be issued
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+void wl_wext_event_ap( struct net_device *dev )
+{
+#if WIRELESS_EXT > 13
+	union iwreq_data wrqu;
+	struct wl_private *lp = wl_priv(dev);
+	int status;
+	/*------------------------------------------------------------------------*/
+
+
+	/* Retrieve the WPA-IEs used by the firmware and send an event. We must send
+	   this event BEFORE sending the association event, as there are timing
+	   issues with the hostap supplicant. The supplicant will attempt to process
+	   an EAPOL-Key frame from an AP before receiving this information, which
+	   is required properly process the said frame. */
+	wl_wext_event_assoc_ie( dev );
+
+	/* Get the BSSID */
+	lp->ltvRecord.typ = CFG_CUR_BSSID;
+	lp->ltvRecord.len = 4;
+
+	status = hcf_get_info( &( lp->hcfCtx ), (LTVP)&( lp->ltvRecord ));
+	if( status == HCF_SUCCESS ) {
+		memset( &wrqu, 0, sizeof( wrqu ));
+
+		memcpy( wrqu.addr.sa_data, lp->ltvRecord.u.u8, ETH_ALEN );
+
+		wrqu.addr.sa_family = ARPHRD_ETHER;
+
+		wireless_send_event( dev, SIOCGIWAP, &wrqu, NULL );
+	}
+
+#endif /* WIRELESS_EXT > 13 */
+
+	return;
+} // wl_wext_event_ap
+/*============================================================================*/
+
+
+
+/*******************************************************************************
+ *	wl_wext_event_scan_complete()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      This function is used to send an event that a request for a network scan
+ *      has completed.
+ *
+ *
+ *  PARAMETERS:
+ *
+ *      dev - the network device for which this event is to be issued
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+void wl_wext_event_scan_complete( struct net_device *dev )
+{
+#if WIRELESS_EXT > 13
+	union iwreq_data wrqu;
+	/*------------------------------------------------------------------------*/
+
+
+	memset( &wrqu, 0, sizeof( wrqu ));
+
+	wrqu.addr.sa_family = ARPHRD_ETHER;
+	wireless_send_event( dev, SIOCGIWSCAN, &wrqu, NULL );
+#endif /* WIRELESS_EXT > 13 */
+
+	return;
+} // wl_wext_event_scan_complete
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wl_wext_event_new_sta()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      This function is used to send an event that an AP has registered a new
+ *      station.
+ *
+ *
+ *  PARAMETERS:
+ *
+ *      dev - the network device for which this event is to be issued
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+void wl_wext_event_new_sta( struct net_device *dev )
+{
+#if WIRELESS_EXT > 14
+	union iwreq_data wrqu;
+	/*------------------------------------------------------------------------*/
+
+
+	memset( &wrqu, 0, sizeof( wrqu ));
+
+	/* Send the station's mac address here */
+	memcpy( wrqu.addr.sa_data, dev->dev_addr, ETH_ALEN );
+	wrqu.addr.sa_family = ARPHRD_ETHER;
+	wireless_send_event( dev, IWEVREGISTERED, &wrqu, NULL );
+#endif /* WIRELESS_EXT > 14 */
+
+	return;
+} // wl_wext_event_new_sta
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wl_wext_event_expired_sta()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      This function is used to send an event that an AP has deregistered a
+ *      station.
+ *
+ *
+ *  PARAMETERS:
+ *
+ *      dev - the network device for which this event is to be issued
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+void wl_wext_event_expired_sta( struct net_device *dev )
+{
+#if WIRELESS_EXT > 14
+	union iwreq_data wrqu;
+	/*------------------------------------------------------------------------*/
+
+
+	memset( &wrqu, 0, sizeof( wrqu ));
+
+	memcpy( wrqu.addr.sa_data, dev->dev_addr, ETH_ALEN );
+	wrqu.addr.sa_family = ARPHRD_ETHER;
+	wireless_send_event( dev, IWEVEXPIRED, &wrqu, NULL );
+#endif /* WIRELESS_EXT > 14 */
+
+	return;
+} // wl_wext_event_expired_sta
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wl_wext_event_mic_failed()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      This function is used to send an event that MIC calculations failed.
+ *
+ *
+ *  PARAMETERS:
+ *
+ *      dev - the network device for which this event is to be issued
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+void wl_wext_event_mic_failed( struct net_device *dev )
+{
+#if WIRELESS_EXT > 14
+	char               msg[512];
+	union iwreq_data   wrqu;
+	struct wl_private *lp = wl_priv(dev);
+	int                key_idx;
+	char              *addr1;
+	char              *addr2;
+	WVLAN_RX_WMP_HDR  *hdr;
+	/*------------------------------------------------------------------------*/
+
+
+	key_idx = lp->lookAheadBuf[HFS_STAT+1] >> 3;
+	key_idx &= 0x03;
+
+	/* Cast the lookahead buffer into a RFS format */
+	hdr = (WVLAN_RX_WMP_HDR *)&lp->lookAheadBuf[HFS_STAT];
+
+	/* Cast the addresses to byte buffers, as in the above RFS they are word
+	   length */
+	addr1 = (char *)hdr->address1;
+	addr2 = (char *)hdr->address2;
+
+	DBG_PRINT( "MIC FAIL - KEY USED : %d, STATUS : 0x%04x\n", key_idx,
+			   hdr->status );
+
+	memset( &wrqu, 0, sizeof( wrqu ));
+	memset( msg, 0, sizeof( msg ));
+
+
+	/* Becuase MIC failures are not part of the Wireless Extensions yet, they
+	   must be passed as a string using an IWEVCUSTOM event. In order for the
+	   event to be effective, the string format must be known by both the
+	   driver and the supplicant. The following is the string format used by the
+	   hostap project's WPA supplicant, and will be used here until the Wireless
+	   Extensions interface adds this support:
+
+	   MLME-MICHAELMICFAILURE.indication(keyid=# broadcast/unicast addr=addr2)
+   */
+
+	/* NOTE: Format of MAC address (using colons to seperate bytes) may cause
+			 a problem in future versions of the supplicant, if they ever
+			 actually parse these parameters */
+#if DBG
+	sprintf( msg, "MLME-MICHAELMICFAILURE.indication(keyid=%d %scast addr="
+			 "%s)", key_idx, addr1[0] & 0x01 ? "broad" : "uni",
+			 DbgHwAddr( addr2 ));
+#endif
+	wrqu.data.length = strlen( msg );
+	wireless_send_event( dev, IWEVCUSTOM, &wrqu, msg );
+#endif /* WIRELESS_EXT > 14 */
+
+	return;
+} // wl_wext_event_mic_failed
+/*============================================================================*/
+
+
+
+
+/*******************************************************************************
+ *	wl_wext_event_assoc_ie()
+ *******************************************************************************
+ *
+ *  DESCRIPTION:
+ *
+ *      This function is used to send an event containing the WPA-IE generated
+ *      by the firmware in an association request.
+ *
+ *
+ *  PARAMETERS:
+ *
+ *      dev - the network device for which this event is to be issued
+ *
+ *  RETURNS:
+ *
+ *      N/A
+ *
+ ******************************************************************************/
+void wl_wext_event_assoc_ie( struct net_device *dev )
+{
+#if WIRELESS_EXT > 14
+	char               msg[512];
+	union iwreq_data   wrqu;
+	struct wl_private *lp = wl_priv(dev);
+	int status;
+	PROBE_RESP         data;
+	hcf_16             length;
+	hcf_8              *wpa_ie;
+	/*------------------------------------------------------------------------*/
+
+
+	memset( &wrqu, 0, sizeof( wrqu ));
+	memset( msg, 0, sizeof( msg ));
+
+	/* Retrieve the Association Request IE */
+	lp->ltvRecord.len = 45;
+	lp->ltvRecord.typ = CFG_CUR_ASSOC_REQ_INFO;
+
+	status = hcf_get_info( &( lp->hcfCtx ), (LTVP)&( lp->ltvRecord ));
+	if( status == HCF_SUCCESS )
+	{
+		length = 0;
+		memcpy( &data.rawData, &( lp->ltvRecord.u.u8[1] ), 88 );
+		wpa_ie = wl_parse_wpa_ie( &data, &length );
+
+		/* Becuase this event (Association WPA-IE) is not part of the Wireless
+		Extensions yet, it must be passed as a string using an IWEVCUSTOM event.
+		In order for the event to be effective, the string format must be known
+		by both the driver and the supplicant. The following is the string format
+		used by the hostap project's WPA supplicant, and will be used here until
+		the Wireless Extensions interface adds this support:
+
+		ASSOCINFO(ReqIEs=WPA-IE RespIEs=WPA-IE)
+		*/
+
+		if( length != 0 )
+		{
+			sprintf( msg, "ASSOCINFO(ReqIEs=%s)", wl_print_wpa_ie( wpa_ie, length ));
+			wrqu.data.length = strlen( msg );
+			wireless_send_event( dev, IWEVCUSTOM, &wrqu, msg );
+		}
+	}
+#endif /* WIRELESS_EXT > 14 */
+
+	return;
+}  // wl_wext_event_assoc_ie
+/*============================================================================*/
+/* Structures to export the Wireless Handlers */
+
+static const iw_handler wl_handler[] =
+{
+                (iw_handler) wireless_commit,           /* SIOCSIWCOMMIT */
+                (iw_handler) wireless_get_protocol,     /* SIOCGIWNAME */
+                (iw_handler) NULL,                      /* SIOCSIWNWID */
+                (iw_handler) NULL,                      /* SIOCGIWNWID */
+                (iw_handler) wireless_set_frequency,    /* SIOCSIWFREQ */
+                (iw_handler) wireless_get_frequency,    /* SIOCGIWFREQ */
+                (iw_handler) wireless_set_porttype,     /* SIOCSIWMODE */
+                (iw_handler) wireless_get_porttype,     /* SIOCGIWMODE */
+                (iw_handler) wireless_set_sensitivity,  /* SIOCSIWSENS */
+                (iw_handler) wireless_get_sensitivity,  /* SIOCGIWSENS */
+                (iw_handler) NULL ,                     /* SIOCSIWRANGE */
+                (iw_handler) wireless_get_range,        /* SIOCGIWRANGE */
+                (iw_handler) NULL ,                     /* SIOCSIWPRIV */
+                (iw_handler) NULL /* kernel code */,    /* SIOCGIWPRIV */
+                (iw_handler) NULL ,                     /* SIOCSIWSTATS */
+                (iw_handler) NULL /* kernel code */,    /* SIOCGIWSTATS */
+                iw_handler_set_spy,                     /* SIOCSIWSPY */
+                iw_handler_get_spy,                     /* SIOCGIWSPY */
+                NULL,                                   /* SIOCSIWTHRSPY */
+                NULL,                                   /* SIOCGIWTHRSPY */
+                (iw_handler) NULL,                      /* SIOCSIWAP */
+#if 1 //;? (HCF_TYPE) & HCF_TYPE_STA
+                (iw_handler) wireless_get_bssid,        /* SIOCGIWAP */
+#else
+                (iw_handler) NULL,                      /* SIOCGIWAP */
+#endif
+                (iw_handler) NULL,                      /* SIOCSIWMLME */
+                (iw_handler) wireless_get_ap_list,      /* SIOCGIWAPLIST */
+                (iw_handler) wireless_set_scan,         /* SIOCSIWSCAN */
+                (iw_handler) wireless_get_scan,         /* SIOCGIWSCAN */
+                (iw_handler) wireless_set_essid,        /* SIOCSIWESSID */
+                (iw_handler) wireless_get_essid,        /* SIOCGIWESSID */
+                (iw_handler) wireless_set_nickname,     /* SIOCSIWNICKN */
+                (iw_handler) wireless_get_nickname,     /* SIOCGIWNICKN */
+                (iw_handler) NULL,                      /* -- hole -- */
+                (iw_handler) NULL,                      /* -- hole -- */
+                (iw_handler) wireless_set_rate,         /* SIOCSIWRATE */
+                (iw_handler) wireless_get_rate,         /* SIOCGIWRATE */
+                (iw_handler) wireless_set_rts_threshold,/* SIOCSIWRTS */
+                (iw_handler) wireless_get_rts_threshold,/* SIOCGIWRTS */
+                (iw_handler) NULL,                      /* SIOCSIWFRAG */
+                (iw_handler) NULL,                      /* SIOCGIWFRAG */
+                (iw_handler) NULL,                      /* SIOCSIWTXPOW */
+                (iw_handler) wireless_get_tx_power,     /* SIOCGIWTXPOW */
+                (iw_handler) NULL,                      /* SIOCSIWRETRY */
+                (iw_handler) NULL,                      /* SIOCGIWRETRY */
+                (iw_handler) wireless_set_encode,       /* SIOCSIWENCODE */
+                (iw_handler) wireless_get_encode,       /* SIOCGIWENCODE */
+                (iw_handler) wireless_set_power,        /* SIOCSIWPOWER */
+                (iw_handler) wireless_get_power,        /* SIOCGIWPOWER */
+                (iw_handler) NULL,                      /* -- hole -- */
+                (iw_handler) NULL,                      /* -- hole -- */
+                (iw_handler) wireless_get_genie,        /* SIOCSIWGENIE */
+                (iw_handler) NULL,                      /* SIOCGIWGENIE */
+                (iw_handler) wireless_set_auth,         /* SIOCSIWAUTH */
+                (iw_handler) NULL,                      /* SIOCGIWAUTH */
+                (iw_handler) wireless_set_encodeext,    /* SIOCSIWENCODEEXT */
+                (iw_handler) NULL,                      /* SIOCGIWENCODEEXT */
+                (iw_handler) NULL,                      /* SIOCSIWPMKSA */
+                (iw_handler) NULL,                      /* -- hole -- */
+};
+
+static const iw_handler wl_private_handler[] =
+{                                                       /* SIOCIWFIRSTPRIV + */
+                wvlan_set_netname,                      /* 0: SIOCSIWNETNAME */
+                wvlan_get_netname,                      /* 1: SIOCGIWNETNAME */
+                wvlan_set_station_nickname,             /* 2: SIOCSIWSTANAME */
+                wvlan_get_station_nickname,             /* 3: SIOCGIWSTANAME */
+#if 1 //;? (HCF_TYPE) & HCF_TYPE_STA
+                wvlan_set_porttype,                     /* 4: SIOCSIWPORTTYPE */
+                wvlan_get_porttype,                     /* 5: SIOCGIWPORTTYPE */
+#endif
+};
+
+struct iw_priv_args wl_priv_args[] = {
+        {SIOCSIWNETNAME,    IW_PRIV_TYPE_CHAR | HCF_MAX_NAME_LEN, 0, "snetwork_name" },
+        {SIOCGIWNETNAME, 0, IW_PRIV_TYPE_CHAR | HCF_MAX_NAME_LEN,    "gnetwork_name" },
+        {SIOCSIWSTANAME,    IW_PRIV_TYPE_CHAR | HCF_MAX_NAME_LEN, 0, "sstation_name" },
+        {SIOCGIWSTANAME, 0, IW_PRIV_TYPE_CHAR | HCF_MAX_NAME_LEN,    "gstation_name" },
+#if 1 //;? #if (HCF_TYPE) & HCF_TYPE_STA
+        {SIOCSIWPORTTYPE,    IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "sport_type" },
+        {SIOCGIWPORTTYPE, 0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,    "gport_type" },
+#endif
+};
+
+const struct iw_handler_def wl_iw_handler_def =
+{
+        .num_private        = sizeof(wl_private_handler) / sizeof(iw_handler),
+        .private            = (iw_handler *) wl_private_handler,
+        .private_args       = (struct iw_priv_args *) wl_priv_args,
+        .num_private_args   = sizeof(wl_priv_args) / sizeof(struct iw_priv_args),
+        .num_standard       = sizeof(wl_handler) / sizeof(iw_handler),
+        .standard           = (iw_handler *) wl_handler,
+        .get_wireless_stats = wl_get_wireless_stats,
+};
+
+#endif // WIRELESS_EXT
diff --git a/drivers/staging/wlags49_h2/wl_wext.h b/drivers/staging/wlags49_h2/wl_wext.h
new file mode 100644
index 000000000000..39d39a47b05a
--- /dev/null
+++ b/drivers/staging/wlags49_h2/wl_wext.h
@@ -0,0 +1,96 @@
+/*******************************************************************************
+ * Agere Systems Inc.
+ * Wireless device driver for Linux (wlags49).
+ *
+ * Copyright (c) 1998-2003 Agere Systems Inc.
+ * All rights reserved.
+ *   http://www.agere.com
+ *
+ * Initially developed by TriplePoint, Inc.
+ *   http://www.triplepoint.com
+ *
+ *------------------------------------------------------------------------------
+ *
+ *   Header describing information required for the wireless IOCTL handlers.
+ *
+ *------------------------------------------------------------------------------
+ *
+ * SOFTWARE LICENSE
+ *
+ * This software is provided subject to the following terms and conditions,
+ * which you should read carefully before using the software.  Using this
+ * software indicates your acceptance of these terms and conditions.  If you do
+ * not agree with these terms and conditions, do not use the software.
+ *
+ * Copyright © 2003 Agere Systems Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source or binary forms, with or without
+ * modifications, are permitted provided that the following conditions are met:
+ *
+ * . Redistributions of source code must retain the above copyright notice, this
+ *    list of conditions and the following Disclaimer as comments in the code as
+ *    well as in the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * . Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following Disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ *
+ * . Neither the name of Agere Systems Inc. nor the names of the contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * Disclaimer
+ *
+ * THIS SOFTWARE IS PROVIDED “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, INFRINGEMENT AND THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  ANY
+ * USE, MODIFICATION OR DISTRIBUTION OF THIS SOFTWARE IS SOLELY AT THE USERS OWN
+ * RISK. IN NO EVENT SHALL AGERE SYSTEMS INC. OR CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, INCLUDING, BUT NOT LIMITED TO, CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ *
+ ******************************************************************************/
+
+#ifndef __WL_WEXT_H__
+#define __WL_WEXT_H__
+
+
+#ifdef WIRELESS_EXT
+
+
+/*******************************************************************************
+ *  function protoypes
+ ******************************************************************************/
+
+struct iw_statistics *wl_wireless_stats( struct net_device *dev );
+
+struct iw_statistics * wl_get_wireless_stats( struct net_device *dev );
+
+inline void wl_spy_gather (struct net_device *dev, u_char *mac);
+
+void wl_wext_event_freq( struct net_device *dev );
+void wl_wext_event_mode( struct net_device *dev );
+void wl_wext_event_essid( struct net_device *dev );
+void wl_wext_event_encode( struct net_device *dev );
+void wl_wext_event_ap( struct net_device *dev );
+void wl_wext_event_scan_complete( struct net_device *dev );
+void wl_wext_event_new_sta( struct net_device *dev );
+void wl_wext_event_expired_sta( struct net_device *dev );
+void wl_wext_event_mic_failed( struct net_device *dev );
+void wl_wext_event_assoc_ie( struct net_device *dev );
+
+extern const struct iw_handler_def wl_iw_handler_def;
+
+#else
+#error WIRELESS_EXT
+#endif // WIRELESS_EXT
+
+
+#endif  // __WL_WEXT_H__
diff --git a/drivers/staging/wlags49_h25/Kconfig b/drivers/staging/wlags49_h25/Kconfig
new file mode 100644
index 000000000000..304a8c96ce33
--- /dev/null
+++ b/drivers/staging/wlags49_h25/Kconfig
@@ -0,0 +1,9 @@
+config WLAGS49_H25
+	tristate "Linksys HERMES II.5 WCF54G_Wireless-G_CompactFlash_Card"
+	depends on WLAN_80211 && WIRELESS_EXT && PCMCIA
+	select WEXT_SPY
+	---help---
+	  Driver for wireless cards using Agere's HERMES II.5 chipset
+	  which are identified with Manufacture ID: 0156,0004
+	  The software is a modified version of wl_lkm_722_abg.tar.gz
+	  from the Agere Systems website, addapted for Ubuntu 9.04.
diff --git a/drivers/staging/wlags49_h25/Makefile b/drivers/staging/wlags49_h25/Makefile
new file mode 100644
index 000000000000..d0b23d4ff95a
--- /dev/null
+++ b/drivers/staging/wlags49_h25/Makefile
@@ -0,0 +1,81 @@
+#
+# Makefile for wlags49_h2_cs.ko and wlags49_h25_cs.ko
+#
+# Default build for Hermes-II base cards (possibly identified with
+# "manfid: 0x0156, 0x0003" in "pccardctl ident" output), comment
+# -DHERMES25 below
+#
+# If you want to build for Hermes-II.5 base cards (possibly identified with
+# "manfid: 0x0156, 0x0004" in "pccardctl ident" output), uncomment
+# -DHERMES25 below
+#
+#  If you want to build AP support (untested), comment out -DSTA_ONLY
+
+INSTALLDIR := /lib/modules/$(shell uname -r)/kernel/drivers/net/wireless
+EXTRA_CFLAGS += -I$(KERNELDIR)/include
+EXTRA_CFLAGS += -I$(src) \
+		-DBUS_PCMCIA \
+		-DUSE_WPA \
+		-DUSE_WEXT \
+		-DSTA_ONLY \
+		-DWVLAN_49 \
+		-DHERMES25 \
+#		-DDBG \
+#		-DDBG_LVL=5 \
+#		-DUSE_UIL \
+#		-DUSE_PROFILE \
+
+ifeq ($(findstring HERMES25,$(EXTRA_CFLAGS)),)
+WLNAME := wlags49_h2_cs
+$(WLNAME)-y := sta_h2.o
+ifeq ($(findstring STA_ONLY,$(EXTRA_CFLAGS)),)
+$(WLNAME)-y += ap_h2.o
+endif
+else
+WLNAME=wlags49_h25_cs
+$(WLNAME)-y := sta_h25.o
+ifeq ($(findstring STA_ONLY,$(EXTRA_CFLAGS)),)
+$(WLNAME)-y += ap_h25.o
+endif
+endif
+
+# If KERNELRELEASE is defined, we've been invoked from the
+# kernel build system and can use its language.
+ifneq ($(KERNELRELEASE),)
+
+obj-m		+= $(WLNAME).o
+
+$(WLNAME)-y +=	wl_profile.o \
+		wl_wext.o \
+		wl_priv.o \
+		wl_main.o \
+		wl_enc.o \
+		wl_util.o \
+		wl_netdev.o \
+		wl_cs.o \
+		mmd.o \
+		hcf.o \
+		dhf.o
+
+$(WLNAME)-$(CONFIG_SYSFS)	+= wl_sysfs.o
+
+# Otherwise we were called directly from the command
+# line; invoke the kernel build system.
+else
+	KERNELDIR ?= /lib/modules/$(shell uname -r)/build
+	PWD := $(shell pwd)
+
+default:
+	$(MAKE) -C $(KERNELDIR) M=$(PWD) modules
+endif
+
+clean:
+	rm -fr *.o *.ko *.mod.c *.mod.o .*.*.cmd Module.symvers \
+		Module.markers modules.order .tmp_versions
+
+install: default
+	-rmmod $(WLNAME)
+	install -d $(INSTALLDIR)
+	install -m 0644 -o root -g root $(WLNAME).ko $(INSTALLDIR)
+	/sbin/depmod -aq
+
diff --git a/drivers/staging/wlags49_h25/README.txt b/drivers/staging/wlags49_h25/README.txt
new file mode 100644
index 000000000000..4c7a836972d7
--- /dev/null
+++ b/drivers/staging/wlags49_h25/README.txt
@@ -0,0 +1,30 @@
+=======================================================================
+WLAN driver for cards using the HERMES II and HERMES II.5 chipset
+
+HERMES II Card
+
+PCMCIA Info: "Agere Systems" "Wireless PC Card Model 0110"
+             Manufacture ID: 0156,0003
+
+HERMES II.5 Card
+
+PCMCIA Info: "Linksys" "WCF54G_Wireless-G_CompactFlash_Card"
+             Manufacture ID: 0156,0004
+
+Based on Agere Systems Linux LKM Wireless Driver Source Code,
+Version 7.22; complies with Open Source BSD License.
+=======================================================================
+
+DESCRIPTION
+
+This directory only contains files that refer to the source in wlags49_h2.
+Only real sourcefiles are the Makefile which has been configured to build
+the driver for the HERMES II.5 chipset and Kconfig to describe the driver.
+
+The wlags49_h2 directory contains the full source, including the files
+exclusively used by this driver.
+
+For more information about the driver look at the wlags49_h2 direcory.
+
+=======================================================================
+
diff --git a/drivers/staging/wlags49_h25/TODO b/drivers/staging/wlags49_h25/TODO
new file mode 100644
index 000000000000..14aa415b1a82
--- /dev/null
+++ b/drivers/staging/wlags49_h25/TODO
@@ -0,0 +1,33 @@
+First of all, the best thing would be that this driver becomes obsolte by
+adding support for Hermes II and Hermes II.5 cards to the existing orinoco
+driver. The orinoco driver currently only supports Hermes I based cards.
+Since this will not happen by magic and has not happend until now this
+driver provides a stop-gap solution for these type of cards.
+
+Having said that, the following wishlist comes to mind to make the driver
+suitable as fully supported kernel driver. Feel free to expand/enhance the
+list.
+
+TODO:
+	- verify against a Hermes II.5 card
+	- verify with WPA encription (both with H2 and H2.5 cards)
+	- sometimes the card does not initialize correctly, retry mechanisms
+	  are build in to catch most cases but not all
+	- once the driver runs it is very stable, but I have the impression
+	  some the crittical sections take to long
+	- the driver is split into a Hermes II and a Hermes II.5 part, it
+	  would be nice to handle both with one module instead of two
+	- review by the wireless developer community
+	- verify the code against the coding standards for a propper linux
+	  driver
+	- resolve license issues (?)
+
+DONE:
+	- verified against a Hermes II card (Thomson Speedtouch 110 PCMCIA
+	  card)
+	- verified with WEP encription
+
+Please send any patches or complaints about this driver to Greg
+Kroah-Hartman <greg@kroah.com> and Cc: Henk de Groot <pe1dnn@amsat.org>
+Don't bother the upstream wireless kernel developers about it, they
+want nothing to do with it.
diff --git a/drivers/staging/wlags49_h25/ap_h25.c b/drivers/staging/wlags49_h25/ap_h25.c
new file mode 100644
index 000000000000..0344fa58dda6
--- /dev/null
+++ b/drivers/staging/wlags49_h25/ap_h25.c
@@ -0,0 +1,2 @@
+/* Use common source from wlags49_h2 */
+#include "../wlags49_h2/ap_h25.c"
diff --git a/drivers/staging/wlags49_h25/debug.h b/drivers/staging/wlags49_h25/debug.h
new file mode 100644
index 000000000000..b5fb136a2d54
--- /dev/null
+++ b/drivers/staging/wlags49_h25/debug.h
@@ -0,0 +1,2 @@
+/* Use common source from wlags49_h2 */
+#include "../wlags49_h2/debug.h"
diff --git a/drivers/staging/wlags49_h25/dhf.c b/drivers/staging/wlags49_h25/dhf.c
new file mode 100644
index 000000000000..81762c80189c
--- /dev/null
+++ b/drivers/staging/wlags49_h25/dhf.c
@@ -0,0 +1,2 @@
+/* Use common source from wlags49_h2 */
+#include "../wlags49_h2/dhf.c"
diff --git a/drivers/staging/wlags49_h25/dhf.h b/drivers/staging/wlags49_h25/dhf.h
new file mode 100644
index 000000000000..54181dc70a72
--- /dev/null
+++ b/drivers/staging/wlags49_h25/dhf.h
@@ -0,0 +1,2 @@
+/* Use common source from wlags49_h2 */
+#include "../wlags49_h2/dhf.h"
diff --git a/drivers/staging/wlags49_h25/dhfcfg.h b/drivers/staging/wlags49_h25/dhfcfg.h
new file mode 100644
index 000000000000..2586e3980214
--- /dev/null
+++ b/drivers/staging/wlags49_h25/dhfcfg.h
@@ -0,0 +1,2 @@
+/* Use common source from wlags49_h2 */
+#include "../wlags49_h2/dhfcfg.h"
diff --git a/drivers/staging/wlags49_h25/hcf.c b/drivers/staging/wlags49_h25/hcf.c
new file mode 100644
index 000000000000..eeeba1f5553e
--- /dev/null
+++ b/drivers/staging/wlags49_h25/hcf.c
@@ -0,0 +1,2 @@
+/* Use common source from wlags49_h2 */
+#include "../wlags49_h2/hcf.c"
diff --git a/drivers/staging/wlags49_h25/hcf.h b/drivers/staging/wlags49_h25/hcf.h
new file mode 100644
index 000000000000..d1143d9fce2d
--- /dev/null
+++ b/drivers/staging/wlags49_h25/hcf.h
@@ -0,0 +1,2 @@
+/* Use common source from wlags49_h2 */
+#include "../wlags49_h2/hcf.h"
diff --git a/drivers/staging/wlags49_h25/hcfcfg.h b/drivers/staging/wlags49_h25/hcfcfg.h
new file mode 100644
index 000000000000..f88c4bcb3ff8
--- /dev/null
+++ b/drivers/staging/wlags49_h25/hcfcfg.h
@@ -0,0 +1,2 @@
+/* Use common source from wlags49_h2 */
+#include "../wlags49_h2/hcfcfg.h"
diff --git a/drivers/staging/wlags49_h25/hcfdef.h b/drivers/staging/wlags49_h25/hcfdef.h
new file mode 100644
index 000000000000..f6a0060c3a53
--- /dev/null
+++ b/drivers/staging/wlags49_h25/hcfdef.h
@@ -0,0 +1,2 @@
+/* Use common source from wlags49_h2 */
+#include "../wlags49_h2/hcfdef.h"
diff --git a/drivers/staging/wlags49_h25/mdd.h b/drivers/staging/wlags49_h25/mdd.h
new file mode 100644
index 000000000000..4d8e142ffa34
--- /dev/null
+++ b/drivers/staging/wlags49_h25/mdd.h
@@ -0,0 +1,2 @@
+/* Use common source from wlags49_h2 */
+#include "../wlags49_h2/mdd.h"
diff --git a/drivers/staging/wlags49_h25/mmd.c b/drivers/staging/wlags49_h25/mmd.c
new file mode 100644
index 000000000000..b20782d334d2
--- /dev/null
+++ b/drivers/staging/wlags49_h25/mmd.c
@@ -0,0 +1,2 @@
+/* Use common source from wlags49_h2 */
+#include "../wlags49_h2/mmd.c"
diff --git a/drivers/staging/wlags49_h25/mmd.h b/drivers/staging/wlags49_h25/mmd.h
new file mode 100644
index 000000000000..8284dd9155ed
--- /dev/null
+++ b/drivers/staging/wlags49_h25/mmd.h
@@ -0,0 +1,2 @@
+/* Use common source from wlags49_h2 */
+#include "../wlags49_h2/mmd.h"
diff --git a/drivers/staging/wlags49_h25/sta_h25.c b/drivers/staging/wlags49_h25/sta_h25.c
new file mode 100644
index 000000000000..83c76bbdc6e7
--- /dev/null
+++ b/drivers/staging/wlags49_h25/sta_h25.c
@@ -0,0 +1,2 @@
+/* Use common source from wlags49_h2 */
+#include "../wlags49_h2/sta_h25.c"
diff --git a/drivers/staging/wlags49_h25/wl_cs.c b/drivers/staging/wlags49_h25/wl_cs.c
new file mode 100644
index 000000000000..e6e1f199ea68
--- /dev/null
+++ b/drivers/staging/wlags49_h25/wl_cs.c
@@ -0,0 +1,2 @@
+/* Use common source from wlags49_h2 */
+#include "../wlags49_h2/wl_cs.c"
diff --git a/drivers/staging/wlags49_h25/wl_cs.h b/drivers/staging/wlags49_h25/wl_cs.h
new file mode 100644
index 000000000000..657acee525cb
--- /dev/null
+++ b/drivers/staging/wlags49_h25/wl_cs.h
@@ -0,0 +1,2 @@
+/* Use common source from wlags49_h2 */
+#include "../wlags49_h2/wl_cs.h"
diff --git a/drivers/staging/wlags49_h25/wl_enc.c b/drivers/staging/wlags49_h25/wl_enc.c
new file mode 100644
index 000000000000..fe59df145150
--- /dev/null
+++ b/drivers/staging/wlags49_h25/wl_enc.c
@@ -0,0 +1,2 @@
+/* Use common source from wlags49_h2 */
+#include "../wlags49_h2/wl_enc.c"
diff --git a/drivers/staging/wlags49_h25/wl_enc.h b/drivers/staging/wlags49_h25/wl_enc.h
new file mode 100644
index 000000000000..f2e860e14be9
--- /dev/null
+++ b/drivers/staging/wlags49_h25/wl_enc.h
@@ -0,0 +1,2 @@
+/* Use common source from wlags49_h2 */
+#include "../wlags49_h2/wl_enc.h"
diff --git a/drivers/staging/wlags49_h25/wl_if.h b/drivers/staging/wlags49_h25/wl_if.h
new file mode 100644
index 000000000000..70d86f09f87a
--- /dev/null
+++ b/drivers/staging/wlags49_h25/wl_if.h
@@ -0,0 +1,2 @@
+/* Use common source from wlags49_h2 */
+#include "../wlags49_h2/wl_if.h"
diff --git a/drivers/staging/wlags49_h25/wl_internal.h b/drivers/staging/wlags49_h25/wl_internal.h
new file mode 100644
index 000000000000..c1687a3056cd
--- /dev/null
+++ b/drivers/staging/wlags49_h25/wl_internal.h
@@ -0,0 +1,2 @@
+/* Use common source from wlags49_h2 */
+#include "../wlags49_h2/wl_internal.h"
diff --git a/drivers/staging/wlags49_h25/wl_main.c b/drivers/staging/wlags49_h25/wl_main.c
new file mode 100644
index 000000000000..d2c06ad8f88a
--- /dev/null
+++ b/drivers/staging/wlags49_h25/wl_main.c
@@ -0,0 +1,2 @@
+/* Use common source from wlags49_h2 */
+#include "../wlags49_h2/wl_main.c"
diff --git a/drivers/staging/wlags49_h25/wl_main.h b/drivers/staging/wlags49_h25/wl_main.h
new file mode 100644
index 000000000000..c98376e71957
--- /dev/null
+++ b/drivers/staging/wlags49_h25/wl_main.h
@@ -0,0 +1,2 @@
+/* Use common source from wlags49_h2 */
+#include "../wlags49_h2/wl_main.h"
diff --git a/drivers/staging/wlags49_h25/wl_netdev.c b/drivers/staging/wlags49_h25/wl_netdev.c
new file mode 100644
index 000000000000..f7512c3891a8
--- /dev/null
+++ b/drivers/staging/wlags49_h25/wl_netdev.c
@@ -0,0 +1,2 @@
+/* Use common source from wlags49_h2 */
+#include "../wlags49_h2/wl_netdev.c"
diff --git a/drivers/staging/wlags49_h25/wl_netdev.h b/drivers/staging/wlags49_h25/wl_netdev.h
new file mode 100644
index 000000000000..519cd5f0461c
--- /dev/null
+++ b/drivers/staging/wlags49_h25/wl_netdev.h
@@ -0,0 +1,2 @@
+/* Use common source from wlags49_h2 */
+#include "../wlags49_h2/wl_netdev.h"
diff --git a/drivers/staging/wlags49_h25/wl_priv.c b/drivers/staging/wlags49_h25/wl_priv.c
new file mode 100644
index 000000000000..160c8014051a
--- /dev/null
+++ b/drivers/staging/wlags49_h25/wl_priv.c
@@ -0,0 +1,2 @@
+/* Use common source from wlags49_h2 */
+#include "../wlags49_h2/wl_priv.c"
diff --git a/drivers/staging/wlags49_h25/wl_priv.h b/drivers/staging/wlags49_h25/wl_priv.h
new file mode 100644
index 000000000000..28492b362db4
--- /dev/null
+++ b/drivers/staging/wlags49_h25/wl_priv.h
@@ -0,0 +1,2 @@
+/* Use common source from wlags49_h2 */
+#include "../wlags49_h2/wl_priv.h"
diff --git a/drivers/staging/wlags49_h25/wl_profile.c b/drivers/staging/wlags49_h25/wl_profile.c
new file mode 100644
index 000000000000..6baa201c132a
--- /dev/null
+++ b/drivers/staging/wlags49_h25/wl_profile.c
@@ -0,0 +1,2 @@
+/* Use common source from wlags49_h2 */
+#include "../wlags49_h2/wl_profile.c"
diff --git a/drivers/staging/wlags49_h25/wl_profile.h b/drivers/staging/wlags49_h25/wl_profile.h
new file mode 100644
index 000000000000..5f253a5fb60e
--- /dev/null
+++ b/drivers/staging/wlags49_h25/wl_profile.h
@@ -0,0 +1,2 @@
+/* Use common source from wlags49_h2 */
+#include "../wlags49_h2/wl_profile.h"
diff --git a/drivers/staging/wlags49_h25/wl_sysfs.c b/drivers/staging/wlags49_h25/wl_sysfs.c
new file mode 100644
index 000000000000..6458ee63350d
--- /dev/null
+++ b/drivers/staging/wlags49_h25/wl_sysfs.c
@@ -0,0 +1,2 @@
+/* Use common source from wlags49_h2 */
+#include "../wlags49_h2/wl_sysfs.c"
diff --git a/drivers/staging/wlags49_h25/wl_sysfs.h b/drivers/staging/wlags49_h25/wl_sysfs.h
new file mode 100644
index 000000000000..eb819a5ef8b5
--- /dev/null
+++ b/drivers/staging/wlags49_h25/wl_sysfs.h
@@ -0,0 +1,2 @@
+/* Use common source from wlags49_h2 */
+#include "../wlags49_h2/wl_sysfs.h"
diff --git a/drivers/staging/wlags49_h25/wl_util.c b/drivers/staging/wlags49_h25/wl_util.c
new file mode 100644
index 000000000000..771bebeeac4c
--- /dev/null
+++ b/drivers/staging/wlags49_h25/wl_util.c
@@ -0,0 +1,2 @@
+/* Use common source from wlags49_h2 */
+#include "../wlags49_h2/wl_util.c"
diff --git a/drivers/staging/wlags49_h25/wl_util.h b/drivers/staging/wlags49_h25/wl_util.h
new file mode 100644
index 000000000000..ccd74e73a4be
--- /dev/null
+++ b/drivers/staging/wlags49_h25/wl_util.h
@@ -0,0 +1,2 @@
+/* Use common source from wlags49_h2 */
+#include "../wlags49_h2/wl_util.h"
diff --git a/drivers/staging/wlags49_h25/wl_version.h b/drivers/staging/wlags49_h25/wl_version.h
new file mode 100644
index 000000000000..ad38e8f7214c
--- /dev/null
+++ b/drivers/staging/wlags49_h25/wl_version.h
@@ -0,0 +1,2 @@
+/* Use common source from wlags49_h2 */
+#include "../wlags49_h2/wl_version.h"
diff --git a/drivers/staging/wlags49_h25/wl_wext.c b/drivers/staging/wlags49_h25/wl_wext.c
new file mode 100644
index 000000000000..f660e791b620
--- /dev/null
+++ b/drivers/staging/wlags49_h25/wl_wext.c
@@ -0,0 +1,2 @@
+/* Use common source from wlags49_h2 */
+#include "../wlags49_h2/wl_wext.c"
diff --git a/drivers/staging/wlags49_h25/wl_wext.h b/drivers/staging/wlags49_h25/wl_wext.h
new file mode 100644
index 000000000000..31d63865c222
--- /dev/null
+++ b/drivers/staging/wlags49_h25/wl_wext.h
@@ -0,0 +1,2 @@
+/* Use common source from wlags49_h2 */
+#include "../wlags49_h2/wl_wext.h"
diff --git a/drivers/staging/wlan-ng/prism2fw.c b/drivers/staging/wlan-ng/prism2fw.c
index 7d76a7f92a33..aaa70ed57710 100644
--- a/drivers/staging/wlan-ng/prism2fw.c
+++ b/drivers/staging/wlan-ng/prism2fw.c
@@ -439,7 +439,7 @@ void free_chunks(imgchunk_t *fchunk, unsigned int *nfchunks)
 		}
 	}
 	*nfchunks = 0;
-	memset(fchunk, 0, sizeof(fchunk));
+	memset(fchunk, 0, sizeof(*fchunk));
 
 }
 
diff --git a/drivers/telephony/ixj.c b/drivers/telephony/ixj.c
index 40de151f2789..e89304c72568 100644
--- a/drivers/telephony/ixj.c
+++ b/drivers/telephony/ixj.c
@@ -4190,7 +4190,7 @@ static void ixj_aec_start(IXJ *j, int level)
 				ixj_WriteDSPCommand(0x1224, j);
 
 			ixj_WriteDSPCommand(0xE014, j);
-			ixj_WriteDSPCommand(0x0003, j);	/* Lock threashold at 3dB */
+			ixj_WriteDSPCommand(0x0003, j);	/* Lock threshold at 3dB */
 
 			ixj_WriteDSPCommand(0xE338, j);	/* Set Echo Suppresser Attenuation to 0dB */
 
@@ -4235,7 +4235,7 @@ static void ixj_aec_start(IXJ *j, int level)
 				ixj_WriteDSPCommand(0x1224, j);
 
 			ixj_WriteDSPCommand(0xE014, j);
-			ixj_WriteDSPCommand(0x0003, j);	/* Lock threashold at 3dB */
+			ixj_WriteDSPCommand(0x0003, j);	/* Lock threshold at 3dB */
 
 			ixj_WriteDSPCommand(0xE338, j);	/* Set Echo Suppresser Attenuation to 0dB */
 
diff --git a/drivers/thermal/thermal_sys.c b/drivers/thermal/thermal_sys.c
index 6f8d8f971212..5066de5cfc0c 100644
--- a/drivers/thermal/thermal_sys.c
+++ b/drivers/thermal/thermal_sys.c
@@ -225,6 +225,12 @@ passive_store(struct device *dev, struct device_attribute *attr,
 	if (!sscanf(buf, "%d\n", &state))
 		return -EINVAL;
 
+	/* sanity check: values below 1000 millicelcius don't make sense
+	 * and can cause the system to go into a thermal heart attack
+	 */
+	if (state && state < 1000)
+		return -EINVAL;
+
 	if (state && !tz->forced_passive) {
 		mutex_lock(&thermal_list_lock);
 		list_for_each_entry(cdev, &thermal_cdev_list, node) {
@@ -235,6 +241,8 @@ passive_store(struct device *dev, struct device_attribute *attr,
 								 cdev);
 		}
 		mutex_unlock(&thermal_list_lock);
+		if (!tz->passive_delay)
+			tz->passive_delay = 1000;
 	} else if (!state && tz->forced_passive) {
 		mutex_lock(&thermal_list_lock);
 		list_for_each_entry(cdev, &thermal_cdev_list, node) {
@@ -245,17 +253,12 @@ passive_store(struct device *dev, struct device_attribute *attr,
 								   cdev);
 		}
 		mutex_unlock(&thermal_list_lock);
+		tz->passive_delay = 0;
 	}
 
 	tz->tc1 = 1;
 	tz->tc2 = 1;
 
-	if (!tz->passive_delay)
-		tz->passive_delay = 1000;
-
-	if (!tz->polling_delay)
-		tz->polling_delay = 10000;
-
 	tz->forced_passive = state;
 
 	thermal_zone_device_update(tz);
@@ -374,7 +377,7 @@ thermal_cooling_device_cur_state_store(struct device *dev,
 	if (!sscanf(buf, "%ld\n", &state))
 		return -EINVAL;
 
-	if (state < 0)
+	if ((long)state < 0)
 		return -EINVAL;
 
 	result = cdev->ops->set_cur_state(cdev, state);
@@ -1016,6 +1019,8 @@ void thermal_zone_device_update(struct thermal_zone_device *tz)
 		thermal_zone_device_set_polling(tz, tz->passive_delay);
 	else if (tz->polling_delay)
 		thermal_zone_device_set_polling(tz, tz->polling_delay);
+	else
+		thermal_zone_device_set_polling(tz, 0);
 	mutex_unlock(&tz->lock);
 }
 EXPORT_SYMBOL(thermal_zone_device_update);
diff --git a/drivers/uio/uio_pdrv_genirq.c b/drivers/uio/uio_pdrv_genirq.c
index aa53db9f2e88..1ef3b8fc50b3 100644
--- a/drivers/uio/uio_pdrv_genirq.c
+++ b/drivers/uio/uio_pdrv_genirq.c
@@ -210,7 +210,7 @@ static int uio_pdrv_genirq_runtime_nop(struct device *dev)
 	return 0;
 }
 
-static struct dev_pm_ops uio_pdrv_genirq_dev_pm_ops = {
+static const struct dev_pm_ops uio_pdrv_genirq_dev_pm_ops = {
 	.runtime_suspend = uio_pdrv_genirq_runtime_nop,
 	.runtime_resume = uio_pdrv_genirq_runtime_nop,
 };
diff --git a/drivers/usb/Kconfig b/drivers/usb/Kconfig
index 240750881d28..81aac7f4ca59 100644
--- a/drivers/usb/Kconfig
+++ b/drivers/usb/Kconfig
@@ -60,6 +60,8 @@ config USB_ARCH_HAS_EHCI
 	default y if ARCH_IXP4XX
 	default y if ARCH_W90X900
 	default y if ARCH_AT91SAM9G45
+	default y if ARCH_MXC
+	default y if ARCH_OMAP34XX
 	default PCI
 
 # ARM SA1111 chips have a non-PCI based "OHCI-compatible" USB host interface.
diff --git a/drivers/usb/atm/ueagle-atm.c b/drivers/usb/atm/ueagle-atm.c
index d171b563e94c..c5395246886d 100644
--- a/drivers/usb/atm/ueagle-atm.c
+++ b/drivers/usb/atm/ueagle-atm.c
@@ -667,12 +667,12 @@ static void uea_upload_pre_firmware(const struct firmware *fw_entry, void *conte
 	else
 		uea_info(usb, "firmware uploaded\n");
 
-	uea_leaves(usb);
-	return;
+	goto err;
 
 err_fw_corrupted:
 	uea_err(usb, "firmware is corrupted\n");
 err:
+	release_firmware(fw_entry);
 	uea_leaves(usb);
 }
 
@@ -705,7 +705,8 @@ static int uea_load_firmware(struct usb_device *usb, unsigned int ver)
 		break;
 	}
 
-	ret = request_firmware_nowait(THIS_MODULE, 1, fw_name, &usb->dev, usb, uea_upload_pre_firmware);
+	ret = request_firmware_nowait(THIS_MODULE, 1, fw_name, &usb->dev,
+				      GFP_KERNEL, usb, uea_upload_pre_firmware);
 	if (ret)
 		uea_err(usb, "firmware %s is not available\n", fw_name);
 	else
@@ -1958,7 +1959,7 @@ static void uea_dispatch_cmv_e1(struct uea_softc *sc, struct intr_pkt *intr)
 		goto bad1;
 
 	/* FIXME : ADI930 reply wrong preambule (func = 2, sub = 2) to
-	 * the first MEMACESS cmv. Ignore it...
+	 * the first MEMACCESS cmv. Ignore it...
 	 */
 	if (cmv->bFunction != dsc->function) {
 		if (UEA_CHIP_VERSION(sc) == ADI930
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index e4eca7810bcf..34d4eb98829e 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1461,6 +1461,12 @@ err_out:
 }
 
 #endif /* CONFIG_PM */
+
+#define NOKIA_PCSUITE_ACM_INFO(x) \
+		USB_DEVICE_AND_INTERFACE_INFO(0x0421, x, \
+		USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM, \
+		USB_CDC_ACM_PROTO_VENDOR)
+
 /*
  * USB driver structure.
  */
@@ -1519,6 +1525,57 @@ static struct usb_device_id acm_ids[] = {
 	.driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */
 	},
 
+	/* Nokia S60 phones expose two ACM channels. The first is
+	 * a modem and is picked up by the standard AT-command
+	 * information below. The second is 'vendor-specific' but
+	 * is treated as a serial device at the S60 end, so we want
+	 * to expose it on Linux too. */
+	{ NOKIA_PCSUITE_ACM_INFO(0x042D), }, /* Nokia 3250 */
+	{ NOKIA_PCSUITE_ACM_INFO(0x04D8), }, /* Nokia 5500 Sport */
+	{ NOKIA_PCSUITE_ACM_INFO(0x04C9), }, /* Nokia E50 */
+	{ NOKIA_PCSUITE_ACM_INFO(0x0419), }, /* Nokia E60 */
+	{ NOKIA_PCSUITE_ACM_INFO(0x044D), }, /* Nokia E61 */
+	{ NOKIA_PCSUITE_ACM_INFO(0x0001), }, /* Nokia E61i */
+	{ NOKIA_PCSUITE_ACM_INFO(0x0475), }, /* Nokia E62 */
+	{ NOKIA_PCSUITE_ACM_INFO(0x0508), }, /* Nokia E65 */
+	{ NOKIA_PCSUITE_ACM_INFO(0x0418), }, /* Nokia E70 */
+	{ NOKIA_PCSUITE_ACM_INFO(0x0425), }, /* Nokia N71 */
+	{ NOKIA_PCSUITE_ACM_INFO(0x0486), }, /* Nokia N73 */
+	{ NOKIA_PCSUITE_ACM_INFO(0x04DF), }, /* Nokia N75 */
+	{ NOKIA_PCSUITE_ACM_INFO(0x000e), }, /* Nokia N77 */
+	{ NOKIA_PCSUITE_ACM_INFO(0x0445), }, /* Nokia N80 */
+	{ NOKIA_PCSUITE_ACM_INFO(0x042F), }, /* Nokia N91 & N91 8GB */
+	{ NOKIA_PCSUITE_ACM_INFO(0x048E), }, /* Nokia N92 */
+	{ NOKIA_PCSUITE_ACM_INFO(0x0420), }, /* Nokia N93 */
+	{ NOKIA_PCSUITE_ACM_INFO(0x04E6), }, /* Nokia N93i  */
+	{ NOKIA_PCSUITE_ACM_INFO(0x04B2), }, /* Nokia 5700 XpressMusic */
+	{ NOKIA_PCSUITE_ACM_INFO(0x0134), }, /* Nokia 6110 Navigator (China) */
+	{ NOKIA_PCSUITE_ACM_INFO(0x046E), }, /* Nokia 6110 Navigator */
+	{ NOKIA_PCSUITE_ACM_INFO(0x002f), }, /* Nokia 6120 classic &  */
+	{ NOKIA_PCSUITE_ACM_INFO(0x0088), }, /* Nokia 6121 classic */
+	{ NOKIA_PCSUITE_ACM_INFO(0x00fc), }, /* Nokia 6124 classic */
+	{ NOKIA_PCSUITE_ACM_INFO(0x0042), }, /* Nokia E51 */
+	{ NOKIA_PCSUITE_ACM_INFO(0x00b0), }, /* Nokia E66 */
+	{ NOKIA_PCSUITE_ACM_INFO(0x00ab), }, /* Nokia E71 */
+	{ NOKIA_PCSUITE_ACM_INFO(0x0481), }, /* Nokia N76 */
+	{ NOKIA_PCSUITE_ACM_INFO(0x0007), }, /* Nokia N81 & N81 8GB */
+	{ NOKIA_PCSUITE_ACM_INFO(0x0071), }, /* Nokia N82 */
+	{ NOKIA_PCSUITE_ACM_INFO(0x04F0), }, /* Nokia N95 & N95-3 NAM */
+	{ NOKIA_PCSUITE_ACM_INFO(0x0070), }, /* Nokia N95 8GB  */
+	{ NOKIA_PCSUITE_ACM_INFO(0x00e9), }, /* Nokia 5320 XpressMusic */
+	{ NOKIA_PCSUITE_ACM_INFO(0x0099), }, /* Nokia 6210 Navigator, RM-367 */
+	{ NOKIA_PCSUITE_ACM_INFO(0x0128), }, /* Nokia 6210 Navigator, RM-419 */
+	{ NOKIA_PCSUITE_ACM_INFO(0x008f), }, /* Nokia 6220 Classic */
+	{ NOKIA_PCSUITE_ACM_INFO(0x00a0), }, /* Nokia 6650 */
+	{ NOKIA_PCSUITE_ACM_INFO(0x007b), }, /* Nokia N78 */
+	{ NOKIA_PCSUITE_ACM_INFO(0x0094), }, /* Nokia N85 */
+	{ NOKIA_PCSUITE_ACM_INFO(0x003a), }, /* Nokia N96 & N96-3  */
+	{ NOKIA_PCSUITE_ACM_INFO(0x00e9), }, /* Nokia 5320 XpressMusic */
+	{ NOKIA_PCSUITE_ACM_INFO(0x0108), }, /* Nokia 5320 XpressMusic 2G */
+	{ NOKIA_PCSUITE_ACM_INFO(0x01f5), }, /* Nokia N97, RM-505 */
+
+	/* NOTE: non-Nokia COMM/ACM/0xff is likely MSFT RNDIS... NOT a modem! */
+
 	/* control interfaces with various AT-command sets */
 	{ USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
 		USB_CDC_ACM_PROTO_AT_V25TER) },
@@ -1533,7 +1590,6 @@ static struct usb_device_id acm_ids[] = {
 	{ USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
 		USB_CDC_ACM_PROTO_AT_CDMA) },
 
-	/* NOTE:  COMM/ACM/0xff is likely MSFT RNDIS ... NOT a modem!! */
 	{ }
 };
 
diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c
index 2473cf0c6b1d..7c5f4e32c920 100644
--- a/drivers/usb/class/usbtmc.c
+++ b/drivers/usb/class/usbtmc.c
@@ -1,5 +1,5 @@
 /**
- * drivers/usb/class/usbtmc.c - USB Test & Measurment class driver
+ * drivers/usb/class/usbtmc.c - USB Test & Measurement class driver
  *
  * Copyright (C) 2007 Stefan Kopp, Gechingen, Germany
  * Copyright (C) 2008 Novell, Inc.
@@ -347,13 +347,8 @@ usbtmc_abort_bulk_out_check_status:
 	goto exit;
 
 usbtmc_abort_bulk_out_clear_halt:
-	rv = usb_control_msg(data->usb_dev,
-			     usb_sndctrlpipe(data->usb_dev, 0),
-			     USB_REQ_CLEAR_FEATURE,
-			     USB_DIR_OUT | USB_TYPE_STANDARD |
-			     USB_RECIP_ENDPOINT,
-			     USB_ENDPOINT_HALT, data->bulk_out, buffer,
-			     0, USBTMC_TIMEOUT);
+	rv = usb_clear_halt(data->usb_dev,
+			    usb_sndbulkpipe(data->usb_dev, data->bulk_out));
 
 	if (rv < 0) {
 		dev_err(dev, "usb_control_msg returned %d\n", rv);
@@ -562,10 +557,16 @@ static ssize_t usbtmc_write(struct file *filp, const char __user *buf,
 		n_bytes = roundup(12 + this_part, 4);
 		memset(buffer + 12 + this_part, 0, n_bytes - (12 + this_part));
 
-		retval = usb_bulk_msg(data->usb_dev,
-				      usb_sndbulkpipe(data->usb_dev,
-						      data->bulk_out),
-				      buffer, n_bytes, &actual, USBTMC_TIMEOUT);
+		do {
+			retval = usb_bulk_msg(data->usb_dev,
+					      usb_sndbulkpipe(data->usb_dev,
+							      data->bulk_out),
+					      buffer, n_bytes,
+					      &actual, USBTMC_TIMEOUT);
+			if (retval != 0)
+				break;
+			n_bytes -= actual;
+		} while (n_bytes);
 
 		data->bTag_last_write = data->bTag;
 		data->bTag++;
@@ -702,14 +703,8 @@ usbtmc_clear_check_status:
 
 usbtmc_clear_bulk_out_halt:
 
-	rv = usb_control_msg(data->usb_dev,
-			     usb_sndctrlpipe(data->usb_dev, 0),
-			     USB_REQ_CLEAR_FEATURE,
-			     USB_DIR_OUT | USB_TYPE_STANDARD |
-			     USB_RECIP_ENDPOINT,
-			     USB_ENDPOINT_HALT,
-			     data->bulk_out, buffer, 0,
-			     USBTMC_TIMEOUT);
+	rv = usb_clear_halt(data->usb_dev,
+			    usb_sndbulkpipe(data->usb_dev, data->bulk_out));
 	if (rv < 0) {
 		dev_err(dev, "usb_control_msg returned %d\n", rv);
 		goto exit;
@@ -730,13 +725,8 @@ static int usbtmc_ioctl_clear_out_halt(struct usbtmc_device_data *data)
 	if (!buffer)
 		return -ENOMEM;
 
-	rv = usb_control_msg(data->usb_dev,
-			     usb_sndctrlpipe(data->usb_dev, 0),
-			     USB_REQ_CLEAR_FEATURE,
-			     USB_DIR_OUT | USB_TYPE_STANDARD |
-			     USB_RECIP_ENDPOINT,
-			     USB_ENDPOINT_HALT, data->bulk_out,
-			     buffer, 0, USBTMC_TIMEOUT);
+	rv = usb_clear_halt(data->usb_dev,
+			    usb_sndbulkpipe(data->usb_dev, data->bulk_out));
 
 	if (rv < 0) {
 		dev_err(&data->usb_dev->dev, "usb_control_msg returned %d\n",
@@ -759,12 +749,8 @@ static int usbtmc_ioctl_clear_in_halt(struct usbtmc_device_data *data)
 	if (!buffer)
 		return -ENOMEM;
 
-	rv = usb_control_msg(data->usb_dev, usb_sndctrlpipe(data->usb_dev, 0),
-			     USB_REQ_CLEAR_FEATURE,
-			     USB_DIR_OUT | USB_TYPE_STANDARD |
-			     USB_RECIP_ENDPOINT,
-			     USB_ENDPOINT_HALT, data->bulk_in, buffer, 0,
-			     USBTMC_TIMEOUT);
+	rv = usb_clear_halt(data->usb_dev,
+			    usb_rcvbulkpipe(data->usb_dev, data->bulk_in));
 
 	if (rv < 0) {
 		dev_err(&data->usb_dev->dev, "usb_control_msg returned %d\n",
@@ -1109,13 +1095,13 @@ static void usbtmc_disconnect(struct usb_interface *intf)
 	kref_put(&data->kref, usbtmc_delete);
 }
 
-static int usbtmc_suspend (struct usb_interface *intf, pm_message_t message)
+static int usbtmc_suspend(struct usb_interface *intf, pm_message_t message)
 {
 	/* this driver does not have pending URBs */
 	return 0;
 }
 
-static int usbtmc_resume (struct usb_interface *intf)
+static int usbtmc_resume(struct usb_interface *intf)
 {
 	return 0;
 }
diff --git a/drivers/usb/core/devices.c b/drivers/usb/core/devices.c
index 96f11715cd26..355dffcc23b0 100644
--- a/drivers/usb/core/devices.c
+++ b/drivers/usb/core/devices.c
@@ -494,7 +494,7 @@ static ssize_t usb_device_dump(char __user **buffer, size_t *nbytes,
 		return 0;
 	/* allocate 2^1 pages = 8K (on i386);
 	 * should be more than enough for one device */
-	pages_start = (char *)__get_free_pages(GFP_KERNEL, 1);
+	pages_start = (char *)__get_free_pages(GFP_NOIO, 1);
 	if (!pages_start)
 		return -ENOMEM;
 
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index 181f78c84105..6e8bcdfd23b4 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -1388,6 +1388,46 @@ static int proc_reapurbnonblock(struct dev_state *ps, void __user *arg)
 }
 
 #ifdef CONFIG_COMPAT
+static int proc_control_compat(struct dev_state *ps,
+				struct usbdevfs_ctrltransfer32 __user *p32)
+{
+        struct usbdevfs_ctrltransfer __user *p;
+        __u32 udata;
+        p = compat_alloc_user_space(sizeof(*p));
+        if (copy_in_user(p, p32, (sizeof(*p32) - sizeof(compat_caddr_t))) ||
+            get_user(udata, &p32->data) ||
+	    put_user(compat_ptr(udata), &p->data))
+		return -EFAULT;
+        return proc_control(ps, p);
+}
+
+static int proc_bulk_compat(struct dev_state *ps,
+			struct usbdevfs_bulktransfer32 __user *p32)
+{
+        struct usbdevfs_bulktransfer __user *p;
+        compat_uint_t n;
+        compat_caddr_t addr;
+
+        p = compat_alloc_user_space(sizeof(*p));
+
+        if (get_user(n, &p32->ep) || put_user(n, &p->ep) ||
+            get_user(n, &p32->len) || put_user(n, &p->len) ||
+            get_user(n, &p32->timeout) || put_user(n, &p->timeout) ||
+            get_user(addr, &p32->data) || put_user(compat_ptr(addr), &p->data))
+                return -EFAULT;
+
+        return proc_bulk(ps, p);
+}
+static int proc_disconnectsignal_compat(struct dev_state *ps, void __user *arg)
+{
+	struct usbdevfs_disconnectsignal32 ds;
+
+	if (copy_from_user(&ds, arg, sizeof(ds)))
+		return -EFAULT;
+	ps->discsignr = ds.signr;
+	ps->disccontext = compat_ptr(ds.context);
+	return 0;
+}
 
 static int get_urb32(struct usbdevfs_urb *kurb,
 		     struct usbdevfs_urb32 __user *uurb)
@@ -1482,6 +1522,7 @@ static int proc_reapurbnonblock_compat(struct dev_state *ps, void __user *arg)
 	return processcompl_compat(as, (void __user * __user *)arg);
 }
 
+
 #endif
 
 static int proc_disconnectsignal(struct dev_state *ps, void __user *arg)
@@ -1648,12 +1689,12 @@ static int proc_release_port(struct dev_state *ps, void __user *arg)
  * are assuming that somehow the configuration has been prevented from
  * changing.  But there's no mechanism to ensure that...
  */
-static int usbdev_ioctl(struct inode *inode, struct file *file,
-			unsigned int cmd, unsigned long arg)
+static long usbdev_do_ioctl(struct file *file, unsigned int cmd,
+				void __user *p)
 {
 	struct dev_state *ps = file->private_data;
+	struct inode *inode = file->f_path.dentry->d_inode;
 	struct usb_device *dev = ps->dev;
-	void __user *p = (void __user *)arg;
 	int ret = -ENOTTY;
 
 	if (!(file->f_mode & FMODE_WRITE))
@@ -1726,6 +1767,24 @@ static int usbdev_ioctl(struct inode *inode, struct file *file,
 		break;
 
 #ifdef CONFIG_COMPAT
+	case USBDEVFS_CONTROL32:
+		snoop(&dev->dev, "%s: CONTROL32\n", __func__);
+		ret = proc_control_compat(ps, p);
+		if (ret >= 0)
+			inode->i_mtime = CURRENT_TIME;
+		break;
+
+	case USBDEVFS_BULK32:
+		snoop(&dev->dev, "%s: BULK32\n", __func__);
+		ret = proc_bulk_compat(ps, p);
+		if (ret >= 0)
+			inode->i_mtime = CURRENT_TIME;
+		break;
+
+	case USBDEVFS_DISCSIGNAL32:
+		snoop(&dev->dev, "%s: DISCSIGNAL32\n", __func__);
+		ret = proc_disconnectsignal_compat(ps, p);
+		break;
 
 	case USBDEVFS_SUBMITURB32:
 		snoop(&dev->dev, "%s: SUBMITURB32\n", __func__);
@@ -1745,7 +1804,7 @@ static int usbdev_ioctl(struct inode *inode, struct file *file,
 		break;
 
 	case USBDEVFS_IOCTL32:
-		snoop(&dev->dev, "%s: IOCTL\n", __func__);
+		snoop(&dev->dev, "%s: IOCTL32\n", __func__);
 		ret = proc_ioctl_compat(ps, ptr_to_compat(p));
 		break;
 #endif
@@ -1801,6 +1860,32 @@ static int usbdev_ioctl(struct inode *inode, struct file *file,
 	return ret;
 }
 
+static long usbdev_ioctl(struct file *file, unsigned int cmd,
+			unsigned long arg)
+{
+	int ret;
+
+	lock_kernel();
+	ret = usbdev_do_ioctl(file, cmd, (void __user *)arg);
+	unlock_kernel();
+
+	return ret;
+}
+
+#ifdef CONFIG_COMPAT
+static long usbdev_compat_ioctl(struct file *file, unsigned int cmd,
+			unsigned long arg)
+{
+	int ret;
+
+	lock_kernel();
+	ret = usbdev_do_ioctl(file, cmd, compat_ptr(arg));
+	unlock_kernel();
+
+	return ret;
+}
+#endif
+
 /* No kernel lock - fine */
 static unsigned int usbdev_poll(struct file *file,
 				struct poll_table_struct *wait)
@@ -1817,13 +1902,16 @@ static unsigned int usbdev_poll(struct file *file,
 }
 
 const struct file_operations usbdev_file_operations = {
-	.owner = 	THIS_MODULE,
-	.llseek =	usbdev_lseek,
-	.read =		usbdev_read,
-	.poll =		usbdev_poll,
-	.ioctl =	usbdev_ioctl,
-	.open =		usbdev_open,
-	.release =	usbdev_release,
+	.owner =	  THIS_MODULE,
+	.llseek =	  usbdev_lseek,
+	.read =		  usbdev_read,
+	.poll =		  usbdev_poll,
+	.unlocked_ioctl = usbdev_ioctl,
+#ifdef CONFIG_COMPAT
+	.compat_ioctl =   usbdev_compat_ioctl,
+#endif
+	.open =		  usbdev_open,
+	.release =	  usbdev_release,
 };
 
 static void usbdev_remove(struct usb_device *udev)
diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index 4f864472c5c4..60a45f1e3a67 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -83,6 +83,47 @@ static ssize_t store_new_id(struct device_driver *driver,
 }
 static DRIVER_ATTR(new_id, S_IWUSR, NULL, store_new_id);
 
+/**
+ * store_remove_id - remove a USB device ID from this driver
+ * @driver: target device driver
+ * @buf: buffer for scanning device ID data
+ * @count: input size
+ *
+ * Removes a dynamic usb device ID from this driver.
+ */
+static ssize_t
+store_remove_id(struct device_driver *driver, const char *buf, size_t count)
+{
+	struct usb_dynid *dynid, *n;
+	struct usb_driver *usb_driver = to_usb_driver(driver);
+	u32 idVendor = 0;
+	u32 idProduct = 0;
+	int fields = 0;
+	int retval = 0;
+
+	fields = sscanf(buf, "%x %x", &idVendor, &idProduct);
+	if (fields < 2)
+		return -EINVAL;
+
+	spin_lock(&usb_driver->dynids.lock);
+	list_for_each_entry_safe(dynid, n, &usb_driver->dynids.list, node) {
+		struct usb_device_id *id = &dynid->id;
+		if ((id->idVendor == idVendor) &&
+		    (id->idProduct == idProduct)) {
+			list_del(&dynid->node);
+			kfree(dynid);
+			retval = 0;
+			break;
+		}
+	}
+	spin_unlock(&usb_driver->dynids.lock);
+
+	if (retval)
+		return retval;
+	return count;
+}
+static DRIVER_ATTR(remove_id, S_IWUSR, NULL, store_remove_id);
+
 static int usb_create_newid_file(struct usb_driver *usb_drv)
 {
 	int error = 0;
@@ -107,6 +148,21 @@ static void usb_remove_newid_file(struct usb_driver *usb_drv)
 				   &driver_attr_new_id);
 }
 
+static int
+usb_create_removeid_file(struct usb_driver *drv)
+{
+	int error = 0;
+	if (drv->probe != NULL)
+		error = driver_create_file(&drv->drvwrap.driver,
+				&driver_attr_remove_id);
+	return error;
+}
+
+static void usb_remove_removeid_file(struct usb_driver *drv)
+{
+	driver_remove_file(&drv->drvwrap.driver, &driver_attr_remove_id);
+}
+
 static void usb_free_dynids(struct usb_driver *usb_drv)
 {
 	struct usb_dynid *dynid, *n;
@@ -128,6 +184,16 @@ static void usb_remove_newid_file(struct usb_driver *usb_drv)
 {
 }
 
+static int
+usb_create_removeid_file(struct usb_driver *drv)
+{
+	return 0;
+}
+
+static void usb_remove_removeid_file(struct usb_driver *drv)
+{
+}
+
 static inline void usb_free_dynids(struct usb_driver *usb_drv)
 {
 }
@@ -774,19 +840,34 @@ int usb_register_driver(struct usb_driver *new_driver, struct module *owner,
 	INIT_LIST_HEAD(&new_driver->dynids.list);
 
 	retval = driver_register(&new_driver->drvwrap.driver);
+	if (retval)
+		goto out;
 
-	if (!retval) {
-		pr_info("%s: registered new interface driver %s\n",
+	usbfs_update_special();
+
+	retval = usb_create_newid_file(new_driver);
+	if (retval)
+		goto out_newid;
+
+	retval = usb_create_removeid_file(new_driver);
+	if (retval)
+		goto out_removeid;
+
+	pr_info("%s: registered new interface driver %s\n",
 			usbcore_name, new_driver->name);
-		usbfs_update_special();
-		usb_create_newid_file(new_driver);
-	} else {
-		printk(KERN_ERR "%s: error %d registering interface "
-			"	driver %s\n",
-			usbcore_name, retval, new_driver->name);
-	}
 
+out:
 	return retval;
+
+out_removeid:
+	usb_remove_newid_file(new_driver);
+out_newid:
+	driver_unregister(&new_driver->drvwrap.driver);
+
+	printk(KERN_ERR "%s: error %d registering interface "
+			"	driver %s\n",
+			usbcore_name, retval, new_driver->name);
+	goto out;
 }
 EXPORT_SYMBOL_GPL(usb_register_driver);
 
@@ -806,6 +887,7 @@ void usb_deregister(struct usb_driver *driver)
 	pr_info("%s: deregistering interface driver %s\n",
 			usbcore_name, driver->name);
 
+	usb_remove_removeid_file(driver);
 	usb_remove_newid_file(driver);
 	usb_free_dynids(driver);
 	driver_unregister(&driver->drvwrap.driver);
@@ -948,8 +1030,6 @@ static int usb_resume_device(struct usb_device *udev, pm_message_t msg)
 
  done:
 	dev_vdbg(&udev->dev, "%s: status %d\n", __func__, status);
-	if (status == 0)
-		udev->autoresume_disabled = 0;
 	return status;
 }
 
@@ -1280,11 +1360,6 @@ static int usb_resume_both(struct usb_device *udev, pm_message_t msg)
 
 	/* Propagate the resume up the tree, if necessary */
 	if (udev->state == USB_STATE_SUSPENDED) {
-		if ((msg.event & PM_EVENT_AUTO) &&
-				udev->autoresume_disabled) {
-			status = -EPERM;
-			goto done;
-		}
 		if (parent) {
 			status = usb_autoresume_device(parent);
 			if (status == 0) {
@@ -1341,7 +1416,6 @@ static int usb_autopm_do_device(struct usb_device *udev, int inc_usage_cnt)
 	int	status = 0;
 
 	usb_pm_lock(udev);
-	udev->auto_pm = 1;
 	udev->pm_usage_cnt += inc_usage_cnt;
 	WARN_ON(udev->pm_usage_cnt < 0);
 	if (inc_usage_cnt)
@@ -1473,7 +1547,6 @@ static int usb_autopm_do_interface(struct usb_interface *intf,
 	if (intf->condition == USB_INTERFACE_UNBOUND)
 		status = -ENODEV;
 	else {
-		udev->auto_pm = 1;
 		atomic_add(inc_usage_cnt, &intf->pm_usage_cnt);
 		udev->last_busy = jiffies;
 		if (inc_usage_cnt >= 0 &&
@@ -1640,8 +1713,6 @@ int usb_autopm_get_interface_async(struct usb_interface *intf)
 
 	if (intf->condition == USB_INTERFACE_UNBOUND)
 		status = -ENODEV;
-	else if (udev->autoresume_disabled)
-		status = -EPERM;
 	else {
 		atomic_inc(&intf->pm_usage_cnt);
 		if (atomic_read(&intf->pm_usage_cnt) > 0 &&
@@ -1654,28 +1725,6 @@ int usb_autopm_get_interface_async(struct usb_interface *intf)
 }
 EXPORT_SYMBOL_GPL(usb_autopm_get_interface_async);
 
-/**
- * usb_autopm_set_interface - set a USB interface's autosuspend state
- * @intf: the usb_interface whose state should be set
- *
- * This routine sets the autosuspend state of @intf's device according
- * to @intf's usage counter, which the caller must have set previously.
- * If the counter is <= 0, the device is autosuspended (if it isn't
- * already suspended and if nothing else prevents the autosuspend).  If
- * the counter is > 0, the device is autoresumed (if it isn't already
- * awake).
- */
-int usb_autopm_set_interface(struct usb_interface *intf)
-{
-	int	status;
-
-	status = usb_autopm_do_interface(intf, 0);
-	dev_vdbg(&intf->dev, "%s: status %d cnt %d\n",
-			__func__, status, atomic_read(&intf->pm_usage_cnt));
-	return status;
-}
-EXPORT_SYMBOL_GPL(usb_autopm_set_interface);
-
 #else
 
 void usb_autosuspend_work(struct work_struct *work)
@@ -1707,7 +1756,6 @@ int usb_external_suspend_device(struct usb_device *udev, pm_message_t msg)
 
 	do_unbind_rebind(udev, DO_UNBIND);
 	usb_pm_lock(udev);
-	udev->auto_pm = 0;
 	status = usb_suspend_both(udev, msg);
 	usb_pm_unlock(udev);
 	return status;
@@ -1730,7 +1778,6 @@ int usb_external_resume_device(struct usb_device *udev, pm_message_t msg)
 	int	status;
 
 	usb_pm_lock(udev);
-	udev->auto_pm = 0;
 	status = usb_resume_both(udev, msg);
 	udev->last_busy = jiffies;
 	usb_pm_unlock(udev);
diff --git a/drivers/usb/core/file.c b/drivers/usb/core/file.c
index 222ee07ea680..bfc6c2eea647 100644
--- a/drivers/usb/core/file.c
+++ b/drivers/usb/core/file.c
@@ -99,6 +99,7 @@ static int init_usb_class(void)
 		printk(KERN_ERR "class_create failed for usb devices\n");
 		kfree(usb_class);
 		usb_class = NULL;
+		goto exit;
 	}
 	usb_class->class->devnode = usb_devnode;
 
diff --git a/drivers/usb/core/generic.c b/drivers/usb/core/generic.c
index 05e6d313961e..bdf87a8414a1 100644
--- a/drivers/usb/core/generic.c
+++ b/drivers/usb/core/generic.c
@@ -139,7 +139,7 @@ int usb_choose_configuration(struct usb_device *udev)
 
 	if (best) {
 		i = best->desc.bConfigurationValue;
-		dev_info(&udev->dev,
+		dev_dbg(&udev->dev,
 			"configuration #%d chosen from %d choice%s\n",
 			i, num_configs, plural(num_configs));
 	} else {
diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
index 91f2885b6ee1..2dcf906df569 100644
--- a/drivers/usb/core/hcd-pci.c
+++ b/drivers/usb/core/hcd-pci.c
@@ -363,7 +363,7 @@ static int hcd_pci_restore(struct device *dev)
 	return resume_common(dev, true);
 }
 
-struct dev_pm_ops usb_hcd_pci_pm_ops = {
+const struct dev_pm_ops usb_hcd_pci_pm_ops = {
 	.suspend	= hcd_pci_suspend,
 	.suspend_noirq	= hcd_pci_suspend_noirq,
 	.resume_noirq	= hcd_pci_resume_noirq,
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index 34de475f016e..80995ef0868c 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -38,6 +38,7 @@
 #include <asm/unaligned.h>
 #include <linux/platform_device.h>
 #include <linux/workqueue.h>
+#include <linux/mutex.h>
 
 #include <linux/usb.h>
 
@@ -1275,13 +1276,16 @@ static int map_urb_for_dma(struct usb_hcd *hcd, struct urb *urb,
 
 	if (usb_endpoint_xfer_control(&urb->ep->desc)
 	    && !(urb->transfer_flags & URB_NO_SETUP_DMA_MAP)) {
-		if (hcd->self.uses_dma)
+		if (hcd->self.uses_dma) {
 			urb->setup_dma = dma_map_single(
 					hcd->self.controller,
 					urb->setup_packet,
 					sizeof(struct usb_ctrlrequest),
 					DMA_TO_DEVICE);
-		else if (hcd->driver->flags & HCD_LOCAL_MEM)
+			if (dma_mapping_error(hcd->self.controller,
+						urb->setup_dma))
+				return -EAGAIN;
+		} else if (hcd->driver->flags & HCD_LOCAL_MEM)
 			ret = hcd_alloc_coherent(
 					urb->dev->bus, mem_flags,
 					&urb->setup_dma,
@@ -1293,13 +1297,16 @@ static int map_urb_for_dma(struct usb_hcd *hcd, struct urb *urb,
 	dir = usb_urb_dir_in(urb) ? DMA_FROM_DEVICE : DMA_TO_DEVICE;
 	if (ret == 0 && urb->transfer_buffer_length != 0
 	    && !(urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP)) {
-		if (hcd->self.uses_dma)
+		if (hcd->self.uses_dma) {
 			urb->transfer_dma = dma_map_single (
 					hcd->self.controller,
 					urb->transfer_buffer,
 					urb->transfer_buffer_length,
 					dir);
-		else if (hcd->driver->flags & HCD_LOCAL_MEM) {
+			if (dma_mapping_error(hcd->self.controller,
+						urb->transfer_dma))
+				return -EAGAIN;
+		} else if (hcd->driver->flags & HCD_LOCAL_MEM) {
 			ret = hcd_alloc_coherent(
 					urb->dev->bus, mem_flags,
 					&urb->transfer_dma,
@@ -1589,19 +1596,34 @@ rescan:
 	}
 }
 
-/* Check whether a new configuration or alt setting for an interface
- * will exceed the bandwidth for the bus (or the host controller resources).
- * Only pass in a non-NULL config or interface, not both!
- * Passing NULL for both new_config and new_intf means the device will be
- * de-configured by issuing a set configuration 0 command.
+/**
+ * usb_hcd_alloc_bandwidth - check whether a new bandwidth setting exceeds
+ *				the bus bandwidth
+ * @udev: target &usb_device
+ * @new_config: new configuration to install
+ * @cur_alt: the current alternate interface setting
+ * @new_alt: alternate interface setting that is being installed
+ *
+ * To change configurations, pass in the new configuration in new_config,
+ * and pass NULL for cur_alt and new_alt.
+ *
+ * To reset a device's configuration (put the device in the ADDRESSED state),
+ * pass in NULL for new_config, cur_alt, and new_alt.
+ *
+ * To change alternate interface settings, pass in NULL for new_config,
+ * pass in the current alternate interface setting in cur_alt,
+ * and pass in the new alternate interface setting in new_alt.
+ *
+ * Returns an error if the requested bandwidth change exceeds the
+ * bus bandwidth or host controller internal resources.
  */
-int usb_hcd_check_bandwidth(struct usb_device *udev,
+int usb_hcd_alloc_bandwidth(struct usb_device *udev,
 		struct usb_host_config *new_config,
-		struct usb_interface *new_intf)
+		struct usb_host_interface *cur_alt,
+		struct usb_host_interface *new_alt)
 {
 	int num_intfs, i, j;
-	struct usb_interface_cache *intf_cache;
-	struct usb_host_interface *alt = 0;
+	struct usb_host_interface *alt = NULL;
 	int ret = 0;
 	struct usb_hcd *hcd;
 	struct usb_host_endpoint *ep;
@@ -1611,7 +1633,7 @@ int usb_hcd_check_bandwidth(struct usb_device *udev,
 		return 0;
 
 	/* Configuration is being removed - set configuration 0 */
-	if (!new_config && !new_intf) {
+	if (!new_config && !cur_alt) {
 		for (i = 1; i < 16; ++i) {
 			ep = udev->ep_out[i];
 			if (ep)
@@ -1648,19 +1670,12 @@ int usb_hcd_check_bandwidth(struct usb_device *udev,
 			}
 		}
 		for (i = 0; i < num_intfs; ++i) {
+			/* Set up endpoints for alternate interface setting 0 */
+			alt = usb_find_alt_setting(new_config, i, 0);
+			if (!alt)
+				/* No alt setting 0? Pick the first setting. */
+				alt = &new_config->intf_cache[i]->altsetting[0];
 
-			/* Dig the endpoints for alt setting 0 out of the
-			 * interface cache for this interface
-			 */
-			intf_cache = new_config->intf_cache[i];
-			for (j = 0; j < intf_cache->num_altsetting; j++) {
-				if (intf_cache->altsetting[j].desc.bAlternateSetting == 0)
-					alt = &intf_cache->altsetting[j];
-			}
-			if (!alt) {
-				printk(KERN_DEBUG "Did not find alt setting 0 for intf %d\n", i);
-				continue;
-			}
 			for (j = 0; j < alt->desc.bNumEndpoints; j++) {
 				ret = hcd->driver->add_endpoint(hcd, udev, &alt->endpoint[j]);
 				if (ret < 0)
@@ -1668,6 +1683,40 @@ int usb_hcd_check_bandwidth(struct usb_device *udev,
 			}
 		}
 	}
+	if (cur_alt && new_alt) {
+		struct usb_interface *iface = usb_ifnum_to_if(udev,
+				cur_alt->desc.bInterfaceNumber);
+
+		if (iface->resetting_device) {
+			/*
+			 * The USB core just reset the device, so the xHCI host
+			 * and the device will think alt setting 0 is installed.
+			 * However, the USB core will pass in the alternate
+			 * setting installed before the reset as cur_alt.  Dig
+			 * out the alternate setting 0 structure, or the first
+			 * alternate setting if a broken device doesn't have alt
+			 * setting 0.
+			 */
+			cur_alt = usb_altnum_to_altsetting(iface, 0);
+			if (!cur_alt)
+				cur_alt = &iface->altsetting[0];
+		}
+
+		/* Drop all the endpoints in the current alt setting */
+		for (i = 0; i < cur_alt->desc.bNumEndpoints; i++) {
+			ret = hcd->driver->drop_endpoint(hcd, udev,
+					&cur_alt->endpoint[i]);
+			if (ret < 0)
+				goto reset;
+		}
+		/* Add all the endpoints in the new alt setting */
+		for (i = 0; i < new_alt->desc.bNumEndpoints; i++) {
+			ret = hcd->driver->add_endpoint(hcd, udev,
+					&new_alt->endpoint[i]);
+			if (ret < 0)
+				goto reset;
+		}
+	}
 	ret = hcd->driver->check_bandwidth(hcd, udev);
 reset:
 	if (ret < 0)
@@ -1984,6 +2033,7 @@ struct usb_hcd *usb_create_hcd (const struct hc_driver *driver,
 #ifdef CONFIG_PM
 	INIT_WORK(&hcd->wakeup_work, hcd_resume_work);
 #endif
+	mutex_init(&hcd->bandwidth_mutex);
 
 	hcd->driver = driver;
 	hcd->product_desc = (driver->product_desc) ? driver->product_desc :
diff --git a/drivers/usb/core/hcd.h b/drivers/usb/core/hcd.h
index 79782a1c43f6..bbe2b924aae8 100644
--- a/drivers/usb/core/hcd.h
+++ b/drivers/usb/core/hcd.h
@@ -111,6 +111,20 @@ struct usb_hcd {
 	u64			rsrc_len;	/* memory/io resource length */
 	unsigned		power_budget;	/* in mA, 0 = no limit */
 
+	/* bandwidth_mutex should be taken before adding or removing
+	 * any new bus bandwidth constraints:
+	 *   1. Before adding a configuration for a new device.
+	 *   2. Before removing the configuration to put the device into
+	 *      the addressed state.
+	 *   3. Before selecting a different configuration.
+	 *   4. Before selecting an alternate interface setting.
+	 *
+	 * bandwidth_mutex should be dropped after a successful control message
+	 * to the device, or resetting the bandwidth after a failed attempt.
+	 */
+	struct mutex		bandwidth_mutex;
+
+
 #define HCD_BUFFER_POOLS	4
 	struct dma_pool		*pool [HCD_BUFFER_POOLS];
 
@@ -290,9 +304,10 @@ extern void usb_hcd_disable_endpoint(struct usb_device *udev,
 extern void usb_hcd_reset_endpoint(struct usb_device *udev,
 		struct usb_host_endpoint *ep);
 extern void usb_hcd_synchronize_unlinks(struct usb_device *udev);
-extern int usb_hcd_check_bandwidth(struct usb_device *udev,
+extern int usb_hcd_alloc_bandwidth(struct usb_device *udev,
 		struct usb_host_config *new_config,
-		struct usb_interface *new_intf);
+		struct usb_host_interface *old_alt,
+		struct usb_host_interface *new_alt);
 extern int usb_hcd_get_frame_number(struct usb_device *udev);
 
 extern struct usb_hcd *usb_create_hcd(const struct hc_driver *driver,
@@ -315,7 +330,7 @@ extern void usb_hcd_pci_remove(struct pci_dev *dev);
 extern void usb_hcd_pci_shutdown(struct pci_dev *dev);
 
 #ifdef CONFIG_PM_SLEEP
-extern struct dev_pm_ops	usb_hcd_pci_pm_ops;
+extern const struct dev_pm_ops usb_hcd_pci_pm_ops;
 #endif
 #endif /* CONFIG_PCI */
 
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 0f857e645058..35cc8b9ba1f5 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -45,7 +45,6 @@ struct usb_hub {
 
 	/* buffer for urb ... with extra space in case of babble */
 	char			(*buffer)[8];
-	dma_addr_t		buffer_dma;	/* DMA address for buffer */
 	union {
 		struct usb_hub_status	hub;
 		struct usb_port_status	port;
@@ -61,6 +60,8 @@ struct usb_hub {
 							status change */
 	unsigned long		busy_bits[1];	/* ports being reset or
 							resumed */
+	unsigned long		removed_bits[1]; /* ports with a "removed"
+							device present */
 #if USB_MAXCHILDREN > 31 /* 8*sizeof(unsigned long) - 1 */
 #error event_bits[] is too short!
 #endif
@@ -70,6 +71,7 @@ struct usb_hub {
 
 	unsigned		mA_per_port;	/* current for each child */
 
+	unsigned		init_done:1;
 	unsigned		limited_power:1;
 	unsigned		quiescing:1;
 	unsigned		disconnected:1;
@@ -374,12 +376,13 @@ static void kick_khubd(struct usb_hub *hub)
 {
 	unsigned long	flags;
 
-	/* Suppress autosuspend until khubd runs */
-	atomic_set(&to_usb_interface(hub->intfdev)->pm_usage_cnt, 1);
-
 	spin_lock_irqsave(&hub_event_lock, flags);
 	if (!hub->disconnected && list_empty(&hub->event_list)) {
 		list_add_tail(&hub->event_list, &hub_event_list);
+
+		/* Suppress autosuspend until khubd runs */
+		usb_autopm_get_interface_no_resume(
+				to_usb_interface(hub->intfdev));
 		wake_up(&khubd_wait);
 	}
 	spin_unlock_irqrestore(&hub_event_lock, flags);
@@ -636,8 +639,35 @@ static void hub_port_logical_disconnect(struct usb_hub *hub, int port1)
  	kick_khubd(hub);
 }
 
+/**
+ * usb_remove_device - disable a device's port on its parent hub
+ * @udev: device to be disabled and removed
+ * Context: @udev locked, must be able to sleep.
+ *
+ * After @udev's port has been disabled, khubd is notified and it will
+ * see that the device has been disconnected.  When the device is
+ * physically unplugged and something is plugged in, the events will
+ * be received and processed normally.
+ */
+int usb_remove_device(struct usb_device *udev)
+{
+	struct usb_hub *hub;
+	struct usb_interface *intf;
+
+	if (!udev->parent)	/* Can't remove a root hub */
+		return -EINVAL;
+	hub = hdev_to_hub(udev->parent);
+	intf = to_usb_interface(hub->intfdev);
+
+	usb_autopm_get_interface(intf);
+	set_bit(udev->portnum, hub->removed_bits);
+	hub_port_logical_disconnect(hub, udev->portnum);
+	usb_autopm_put_interface(intf);
+	return 0;
+}
+
 enum hub_activation_type {
-	HUB_INIT, HUB_INIT2, HUB_INIT3,
+	HUB_INIT, HUB_INIT2, HUB_INIT3,		/* INITs must come first */
 	HUB_POST_RESET, HUB_RESUME, HUB_RESET_RESUME,
 };
 
@@ -682,8 +712,8 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
 					msecs_to_jiffies(delay));
 
 			/* Suppress autosuspend until init is done */
-			atomic_set(&to_usb_interface(hub->intfdev)->
-					pm_usage_cnt, 1);
+			usb_autopm_get_interface_no_resume(
+					to_usb_interface(hub->intfdev));
 			return;		/* Continues at init2: below */
 		} else {
 			hub_power_on(hub, true);
@@ -731,6 +761,13 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
 					USB_PORT_FEAT_C_ENABLE);
 		}
 
+		/* We can forget about a "removed" device when there's a
+		 * physical disconnect or the connect status changes.
+		 */
+		if (!(portstatus & USB_PORT_STAT_CONNECTION) ||
+				(portchange & USB_PORT_STAT_C_CONNECTION))
+			clear_bit(port1, hub->removed_bits);
+
 		if (!udev || udev->state == USB_STATE_NOTATTACHED) {
 			/* Tell khubd to disconnect the device or
 			 * check for a new connection
@@ -783,6 +820,7 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
 	}
  init3:
 	hub->quiescing = 0;
+	hub->init_done = 1;
 
 	status = usb_submit_urb(hub->urb, GFP_NOIO);
 	if (status < 0)
@@ -792,6 +830,10 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
 
 	/* Scan all ports that need attention */
 	kick_khubd(hub);
+
+	/* Allow autosuspend if it was suppressed */
+	if (type <= HUB_INIT3)
+		usb_autopm_put_interface_async(to_usb_interface(hub->intfdev));
 }
 
 /* Implement the continuations for the delays above */
@@ -819,6 +861,11 @@ static void hub_quiesce(struct usb_hub *hub, enum hub_quiescing_type type)
 	int i;
 
 	cancel_delayed_work_sync(&hub->init_work);
+	if (!hub->init_done) {
+		hub->init_done = 1;
+		usb_autopm_put_interface_no_suspend(
+				to_usb_interface(hub->intfdev));
+	}
 
 	/* khubd and related activity won't re-trigger */
 	hub->quiescing = 1;
@@ -869,8 +916,7 @@ static int hub_configure(struct usb_hub *hub,
 	int maxp, ret;
 	char *message = "out of memory";
 
-	hub->buffer = usb_buffer_alloc(hdev, sizeof(*hub->buffer), GFP_KERNEL,
-			&hub->buffer_dma);
+	hub->buffer = kmalloc(sizeof(*hub->buffer), GFP_KERNEL);
 	if (!hub->buffer) {
 		ret = -ENOMEM;
 		goto fail;
@@ -1111,8 +1157,6 @@ static int hub_configure(struct usb_hub *hub,
 
 	usb_fill_int_urb(hub->urb, hdev, pipe, *hub->buffer, maxp, hub_irq,
 		hub, endpoint->bInterval);
-	hub->urb->transfer_dma = hub->buffer_dma;
-	hub->urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
 
 	/* maybe cycle the hub leds */
 	if (hub->has_indicators && blinkenlights)
@@ -1144,7 +1188,10 @@ static void hub_disconnect(struct usb_interface *intf)
 
 	/* Take the hub off the event list and don't let it be added again */
 	spin_lock_irq(&hub_event_lock);
-	list_del_init(&hub->event_list);
+	if (!list_empty(&hub->event_list)) {
+		list_del_init(&hub->event_list);
+		usb_autopm_put_interface_no_suspend(intf);
+	}
 	hub->disconnected = 1;
 	spin_unlock_irq(&hub_event_lock);
 
@@ -1162,8 +1209,7 @@ static void hub_disconnect(struct usb_interface *intf)
 	kfree(hub->port_owners);
 	kfree(hub->descriptor);
 	kfree(hub->status);
-	usb_buffer_free(hub->hdev, sizeof(*hub->buffer), hub->buffer,
-			hub->buffer_dma);
+	kfree(hub->buffer);
 
 	kref_put(&hub->kref, hub_release);
 }
@@ -1612,12 +1658,12 @@ static inline void announce_device(struct usb_device *udev) { }
 #endif
 
 /**
- * usb_configure_device_otg - FIXME (usbcore-internal)
+ * usb_enumerate_device_otg - FIXME (usbcore-internal)
  * @udev: newly addressed device (in ADDRESS state)
  *
- * Do configuration for On-The-Go devices
+ * Finish enumeration for On-The-Go devices
  */
-static int usb_configure_device_otg(struct usb_device *udev)
+static int usb_enumerate_device_otg(struct usb_device *udev)
 {
 	int err = 0;
 
@@ -1630,7 +1676,7 @@ static int usb_configure_device_otg(struct usb_device *udev)
 	if (!udev->bus->is_b_host
 			&& udev->config
 			&& udev->parent == udev->bus->root_hub) {
-		struct usb_otg_descriptor	*desc = 0;
+		struct usb_otg_descriptor	*desc = NULL;
 		struct usb_bus			*bus = udev->bus;
 
 		/* descriptor may appear anywhere in config */
@@ -1688,7 +1734,7 @@ fail:
 
 
 /**
- * usb_configure_device - Detect and probe device intfs/otg (usbcore-internal)
+ * usb_enumerate_device - Read device configs/intfs/otg (usbcore-internal)
  * @udev: newly addressed device (in ADDRESS state)
  *
  * This is only called by usb_new_device() and usb_authorize_device()
@@ -1699,7 +1745,7 @@ fail:
  * the string descriptors, as they will be errored out by the device
  * until it has been authorized.
  */
-static int usb_configure_device(struct usb_device *udev)
+static int usb_enumerate_device(struct usb_device *udev)
 {
 	int err;
 
@@ -1723,7 +1769,7 @@ static int usb_configure_device(struct usb_device *udev)
 						      udev->descriptor.iManufacturer);
 		udev->serial = usb_cache_string(udev, udev->descriptor.iSerialNumber);
 	}
-	err = usb_configure_device_otg(udev);
+	err = usb_enumerate_device_otg(udev);
 fail:
 	return err;
 }
@@ -1733,8 +1779,8 @@ fail:
  * usb_new_device - perform initial device setup (usbcore-internal)
  * @udev: newly addressed device (in ADDRESS state)
  *
- * This is called with devices which have been enumerated, but not yet
- * configured.  The device descriptor is available, but not descriptors
+ * This is called with devices which have been detected but not fully
+ * enumerated.  The device descriptor is available, but not descriptors
  * for any device configuration.  The caller must have locked either
  * the parent hub (if udev is a normal device) or else the
  * usb_bus_list_lock (if udev is a root hub).  The parent's pointer to
@@ -1757,8 +1803,8 @@ int usb_new_device(struct usb_device *udev)
 	if (udev->parent)
 		usb_autoresume_device(udev->parent);
 
-	usb_detect_quirks(udev);		/* Determine quirks */
-	err = usb_configure_device(udev);	/* detect & probe dev/intfs */
+	usb_detect_quirks(udev);
+	err = usb_enumerate_device(udev);	/* Read descriptors */
 	if (err < 0)
 		goto fail;
 	dev_dbg(&udev->dev, "udev %d, busnum %d, minor = %d\n",
@@ -1803,21 +1849,23 @@ fail:
  */
 int usb_deauthorize_device(struct usb_device *usb_dev)
 {
-	unsigned cnt;
 	usb_lock_device(usb_dev);
 	if (usb_dev->authorized == 0)
 		goto out_unauthorized;
+
 	usb_dev->authorized = 0;
 	usb_set_configuration(usb_dev, -1);
+
+	kfree(usb_dev->product);
 	usb_dev->product = kstrdup("n/a (unauthorized)", GFP_KERNEL);
+	kfree(usb_dev->manufacturer);
 	usb_dev->manufacturer = kstrdup("n/a (unauthorized)", GFP_KERNEL);
+	kfree(usb_dev->serial);
 	usb_dev->serial = kstrdup("n/a (unauthorized)", GFP_KERNEL);
-	kfree(usb_dev->config);
-	usb_dev->config = NULL;
-	for (cnt = 0; cnt < usb_dev->descriptor.bNumConfigurations; cnt++)
-		kfree(usb_dev->rawdescriptors[cnt]);
+
+	usb_destroy_configuration(usb_dev);
 	usb_dev->descriptor.bNumConfigurations = 0;
-	kfree(usb_dev->rawdescriptors);
+
 out_unauthorized:
 	usb_unlock_device(usb_dev);
 	return 0;
@@ -1827,15 +1875,11 @@ out_unauthorized:
 int usb_authorize_device(struct usb_device *usb_dev)
 {
 	int result = 0, c;
+
 	usb_lock_device(usb_dev);
 	if (usb_dev->authorized == 1)
 		goto out_authorized;
-	kfree(usb_dev->product);
-	usb_dev->product = NULL;
-	kfree(usb_dev->manufacturer);
-	usb_dev->manufacturer = NULL;
-	kfree(usb_dev->serial);
-	usb_dev->serial = NULL;
+
 	result = usb_autoresume_device(usb_dev);
 	if (result < 0) {
 		dev_err(&usb_dev->dev,
@@ -1848,10 +1892,18 @@ int usb_authorize_device(struct usb_device *usb_dev)
 			"authorization: %d\n", result);
 		goto error_device_descriptor;
 	}
+
+	kfree(usb_dev->product);
+	usb_dev->product = NULL;
+	kfree(usb_dev->manufacturer);
+	usb_dev->manufacturer = NULL;
+	kfree(usb_dev->serial);
+	usb_dev->serial = NULL;
+
 	usb_dev->authorized = 1;
-	result = usb_configure_device(usb_dev);
+	result = usb_enumerate_device(usb_dev);
 	if (result < 0)
-		goto error_configure;
+		goto error_enumerate;
 	/* Choose and set the configuration.  This registers the interfaces
 	 * with the driver core and lets interface drivers bind to them.
 	 */
@@ -1866,8 +1918,10 @@ int usb_authorize_device(struct usb_device *usb_dev)
 		}
 	}
 	dev_info(&usb_dev->dev, "authorized to connect\n");
-error_configure:
+
+error_enumerate:
 error_device_descriptor:
+	usb_autosuspend_device(usb_dev);
 error_autoresume:
 out_authorized:
 	usb_unlock_device(usb_dev);	// complements locktree
@@ -2123,9 +2177,13 @@ int usb_port_suspend(struct usb_device *udev, pm_message_t msg)
 				USB_DEVICE_REMOTE_WAKEUP, 0,
 				NULL, 0,
 				USB_CTRL_SET_TIMEOUT);
-		if (status)
+		if (status) {
 			dev_dbg(&udev->dev, "won't remote wakeup, status %d\n",
 					status);
+			/* bail if autosuspend is requested */
+			if (msg.event & PM_EVENT_AUTO)
+				return status;
+		}
 	}
 
 	/* see 7.1.7.6 */
@@ -2134,7 +2192,8 @@ int usb_port_suspend(struct usb_device *udev, pm_message_t msg)
 		dev_dbg(hub->intfdev, "can't suspend port %d, status %d\n",
 				port1, status);
 		/* paranoia:  "should not happen" */
-		(void) usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
+		if (udev->do_remote_wakeup)
+			(void) usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
 				USB_REQ_CLEAR_FEATURE, USB_RECIP_DEVICE,
 				USB_DEVICE_REMOTE_WAKEUP, 0,
 				NULL, 0,
@@ -2965,6 +3024,13 @@ static void hub_port_connect_change(struct usb_hub *hub, int port1,
 		usb_disconnect(&hdev->children[port1-1]);
 	clear_bit(port1, hub->change_bits);
 
+	/* We can forget about a "removed" device when there's a physical
+	 * disconnect or the connect status changes.
+	 */
+	if (!(portstatus & USB_PORT_STAT_CONNECTION) ||
+			(portchange & USB_PORT_STAT_C_CONNECTION))
+		clear_bit(port1, hub->removed_bits);
+
 	if (portchange & (USB_PORT_STAT_C_CONNECTION |
 				USB_PORT_STAT_C_ENABLE)) {
 		status = hub_port_debounce(hub, port1);
@@ -2978,8 +3044,11 @@ static void hub_port_connect_change(struct usb_hub *hub, int port1,
 		}
 	}
 
-	/* Return now if debouncing failed or nothing is connected */
-	if (!(portstatus & USB_PORT_STAT_CONNECTION)) {
+	/* Return now if debouncing failed or nothing is connected or
+	 * the device was "removed".
+	 */
+	if (!(portstatus & USB_PORT_STAT_CONNECTION) ||
+			test_bit(port1, hub->removed_bits)) {
 
 		/* maybe switch power back on (e.g. root hub was reset) */
 		if ((wHubCharacteristics & HUB_CHAR_LPSM) < 2
@@ -3189,7 +3258,7 @@ static void hub_events(void)
 		 * disconnected while waiting for the lock to succeed. */
 		usb_lock_device(hdev);
 		if (unlikely(hub->disconnected))
-			goto loop;
+			goto loop2;
 
 		/* If the hub has died, clean up after it */
 		if (hdev->state == USB_STATE_NOTATTACHED) {
@@ -3278,6 +3347,9 @@ static void hub_events(void)
 					USB_PORT_FEAT_C_SUSPEND);
 				udev = hdev->children[i-1];
 				if (udev) {
+					/* TRSMRCY = 10 msec */
+					msleep(10);
+
 					usb_lock_device(udev);
 					ret = remote_wakeup(hdev->
 							children[i-1]);
@@ -3338,11 +3410,15 @@ static void hub_events(void)
 			}
 		}
 
-loop_autopm:
-		/* Allow autosuspend if we're not going to run again */
-		if (list_empty(&hub->event_list))
-			usb_autopm_enable(intf);
-loop:
+ loop_autopm:
+		/* Balance the usb_autopm_get_interface() above */
+		usb_autopm_put_interface_no_suspend(intf);
+ loop:
+		/* Balance the usb_autopm_get_interface_no_resume() in
+		 * kick_khubd() and allow autosuspend.
+		 */
+		usb_autopm_put_interface(intf);
+ loop2:
 		usb_unlock_device(hdev);
 		kref_put(&hub->kref, hub_release);
 
@@ -3534,6 +3610,7 @@ static int usb_reset_and_verify_device(struct usb_device *udev)
 {
 	struct usb_device		*parent_hdev = udev->parent;
 	struct usb_hub			*parent_hub;
+	struct usb_hcd			*hcd = bus_to_hcd(udev->bus);
 	struct usb_device_descriptor	descriptor = udev->descriptor;
 	int 				i, ret = 0;
 	int				port1 = udev->portnum;
@@ -3577,6 +3654,16 @@ static int usb_reset_and_verify_device(struct usb_device *udev)
 	/* Restore the device's previous configuration */
 	if (!udev->actconfig)
 		goto done;
+
+	mutex_lock(&hcd->bandwidth_mutex);
+	ret = usb_hcd_alloc_bandwidth(udev, udev->actconfig, NULL, NULL);
+	if (ret < 0) {
+		dev_warn(&udev->dev,
+				"Busted HC?  Not enough HCD resources for "
+				"old configuration.\n");
+		mutex_unlock(&hcd->bandwidth_mutex);
+		goto re_enumerate;
+	}
 	ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
 			USB_REQ_SET_CONFIGURATION, 0,
 			udev->actconfig->desc.bConfigurationValue, 0,
@@ -3585,8 +3672,10 @@ static int usb_reset_and_verify_device(struct usb_device *udev)
 		dev_err(&udev->dev,
 			"can't restore configuration #%d (error=%d)\n",
 			udev->actconfig->desc.bConfigurationValue, ret);
+		mutex_unlock(&hcd->bandwidth_mutex);
 		goto re_enumerate;
   	}
+	mutex_unlock(&hcd->bandwidth_mutex);
 	usb_set_device_state(udev, USB_STATE_CONFIGURED);
 
 	/* Put interfaces back into the same altsettings as before.
@@ -3596,7 +3685,8 @@ static int usb_reset_and_verify_device(struct usb_device *udev)
 	 * endpoint state.
 	 */
 	for (i = 0; i < udev->actconfig->desc.bNumInterfaces; i++) {
-		struct usb_interface *intf = udev->actconfig->interface[i];
+		struct usb_host_config *config = udev->actconfig;
+		struct usb_interface *intf = config->interface[i];
 		struct usb_interface_descriptor *desc;
 
 		desc = &intf->cur_altsetting->desc;
@@ -3605,8 +3695,14 @@ static int usb_reset_and_verify_device(struct usb_device *udev)
 			usb_enable_interface(udev, intf, true);
 			ret = 0;
 		} else {
+			/* Let the bandwidth allocation function know that this
+			 * device has been reset, and it will have to use
+			 * alternate setting 0 as the current alternate setting.
+			 */
+			intf->resetting_device = 1;
 			ret = usb_set_interface(udev, desc->bInterfaceNumber,
 					desc->bAlternateSetting);
+			intf->resetting_device = 0;
 		}
 		if (ret < 0) {
 			dev_err(&udev->dev, "failed to restore interface %d "
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index da718e84d58d..9bc95fec793f 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -393,13 +393,7 @@ int usb_sg_init(struct usb_sg_request *io, struct usb_device *dev,
 	if (io->entries <= 0)
 		return io->entries;
 
-	/* If we're running on an xHCI host controller, queue the whole scatter
-	 * gather list with one call to urb_enqueue().  This is only for bulk,
-	 * as that endpoint type does not care how the data gets broken up
-	 * across frames.
-	 */
-	if (usb_pipebulk(pipe) &&
-			bus_to_hcd(dev->bus)->driver->flags & HCD_USB3) {
+	if (dev->bus->sg_tablesize > 0) {
 		io->urbs = kmalloc(sizeof *io->urbs, mem_flags);
 		use_sg = true;
 	} else {
@@ -409,7 +403,7 @@ int usb_sg_init(struct usb_sg_request *io, struct usb_device *dev,
 	if (!io->urbs)
 		goto nomem;
 
-	urb_flags = URB_NO_INTERRUPT;
+	urb_flags = 0;
 	if (dma)
 		urb_flags |= URB_NO_TRANSFER_DMA_MAP;
 	if (usb_pipein(pipe))
@@ -441,6 +435,7 @@ int usb_sg_init(struct usb_sg_request *io, struct usb_device *dev,
 		io->urbs[0]->num_sgs = io->entries;
 		io->entries = 1;
 	} else {
+		urb_flags |= URB_NO_INTERRUPT;
 		for_each_sg(sg, sg, io->entries, i) {
 			unsigned len;
 
@@ -911,11 +906,11 @@ char *usb_cache_string(struct usb_device *udev, int index)
 	if (index <= 0)
 		return NULL;
 
-	buf = kmalloc(MAX_USB_STRING_SIZE, GFP_KERNEL);
+	buf = kmalloc(MAX_USB_STRING_SIZE, GFP_NOIO);
 	if (buf) {
 		len = usb_string(udev, index, buf, MAX_USB_STRING_SIZE);
 		if (len > 0) {
-			smallbuf = kmalloc(++len, GFP_KERNEL);
+			smallbuf = kmalloc(++len, GFP_NOIO);
 			if (!smallbuf)
 				return buf;
 			memcpy(smallbuf, buf, len);
@@ -1303,6 +1298,7 @@ int usb_set_interface(struct usb_device *dev, int interface, int alternate)
 {
 	struct usb_interface *iface;
 	struct usb_host_interface *alt;
+	struct usb_hcd *hcd = bus_to_hcd(dev->bus);
 	int ret;
 	int manual = 0;
 	unsigned int epaddr;
@@ -1325,6 +1321,18 @@ int usb_set_interface(struct usb_device *dev, int interface, int alternate)
 		return -EINVAL;
 	}
 
+	/* Make sure we have enough bandwidth for this alternate interface.
+	 * Remove the current alt setting and add the new alt setting.
+	 */
+	mutex_lock(&hcd->bandwidth_mutex);
+	ret = usb_hcd_alloc_bandwidth(dev, NULL, iface->cur_altsetting, alt);
+	if (ret < 0) {
+		dev_info(&dev->dev, "Not enough bandwidth for altsetting %d\n",
+				alternate);
+		mutex_unlock(&hcd->bandwidth_mutex);
+		return ret;
+	}
+
 	if (dev->quirks & USB_QUIRK_NO_SET_INTF)
 		ret = -EPIPE;
 	else
@@ -1340,8 +1348,13 @@ int usb_set_interface(struct usb_device *dev, int interface, int alternate)
 			"manual set_interface for iface %d, alt %d\n",
 			interface, alternate);
 		manual = 1;
-	} else if (ret < 0)
+	} else if (ret < 0) {
+		/* Re-instate the old alt setting */
+		usb_hcd_alloc_bandwidth(dev, NULL, alt, iface->cur_altsetting);
+		mutex_unlock(&hcd->bandwidth_mutex);
 		return ret;
+	}
+	mutex_unlock(&hcd->bandwidth_mutex);
 
 	/* FIXME drivers shouldn't need to replicate/bugfix the logic here
 	 * when they implement async or easily-killable versions of this or
@@ -1423,6 +1436,7 @@ int usb_reset_configuration(struct usb_device *dev)
 {
 	int			i, retval;
 	struct usb_host_config	*config;
+	struct usb_hcd *hcd = bus_to_hcd(dev->bus);
 
 	if (dev->state == USB_STATE_SUSPENDED)
 		return -EHOSTUNREACH;
@@ -1438,12 +1452,46 @@ int usb_reset_configuration(struct usb_device *dev)
 	}
 
 	config = dev->actconfig;
+	retval = 0;
+	mutex_lock(&hcd->bandwidth_mutex);
+	/* Make sure we have enough bandwidth for each alternate setting 0 */
+	for (i = 0; i < config->desc.bNumInterfaces; i++) {
+		struct usb_interface *intf = config->interface[i];
+		struct usb_host_interface *alt;
+
+		alt = usb_altnum_to_altsetting(intf, 0);
+		if (!alt)
+			alt = &intf->altsetting[0];
+		if (alt != intf->cur_altsetting)
+			retval = usb_hcd_alloc_bandwidth(dev, NULL,
+					intf->cur_altsetting, alt);
+		if (retval < 0)
+			break;
+	}
+	/* If not, reinstate the old alternate settings */
+	if (retval < 0) {
+reset_old_alts:
+		for (; i >= 0; i--) {
+			struct usb_interface *intf = config->interface[i];
+			struct usb_host_interface *alt;
+
+			alt = usb_altnum_to_altsetting(intf, 0);
+			if (!alt)
+				alt = &intf->altsetting[0];
+			if (alt != intf->cur_altsetting)
+				usb_hcd_alloc_bandwidth(dev, NULL,
+						alt, intf->cur_altsetting);
+		}
+		mutex_unlock(&hcd->bandwidth_mutex);
+		return retval;
+	}
 	retval = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
 			USB_REQ_SET_CONFIGURATION, 0,
 			config->desc.bConfigurationValue, 0,
 			NULL, 0, USB_CTRL_SET_TIMEOUT);
 	if (retval < 0)
-		return retval;
+		goto reset_old_alts;
+	mutex_unlock(&hcd->bandwidth_mutex);
 
 	/* re-init hc/hcd interface/endpoint state */
 	for (i = 0; i < config->desc.bNumInterfaces; i++) {
@@ -1585,7 +1633,7 @@ static struct usb_interface_assoc_descriptor *find_iad(struct usb_device *dev,
  *
  * See usb_queue_reset_device() for more details
  */
-void __usb_queue_reset_device(struct work_struct *ws)
+static void __usb_queue_reset_device(struct work_struct *ws)
 {
 	int rc;
 	struct usb_interface *iface =
@@ -1652,6 +1700,7 @@ int usb_set_configuration(struct usb_device *dev, int configuration)
 	int i, ret;
 	struct usb_host_config *cp = NULL;
 	struct usb_interface **new_interfaces = NULL;
+	struct usb_hcd *hcd = bus_to_hcd(dev->bus);
 	int n, nintf;
 
 	if (dev->authorized == 0 || configuration == -1)
@@ -1682,7 +1731,7 @@ int usb_set_configuration(struct usb_device *dev, int configuration)
 	if (cp) {
 		nintf = cp->desc.bNumInterfaces;
 		new_interfaces = kmalloc(nintf * sizeof(*new_interfaces),
-				GFP_KERNEL);
+				GFP_NOIO);
 		if (!new_interfaces) {
 			dev_err(&dev->dev, "Out of memory\n");
 			return -ENOMEM;
@@ -1691,7 +1740,7 @@ int usb_set_configuration(struct usb_device *dev, int configuration)
 		for (; n < nintf; ++n) {
 			new_interfaces[n] = kzalloc(
 					sizeof(struct usb_interface),
-					GFP_KERNEL);
+					GFP_NOIO);
 			if (!new_interfaces[n]) {
 				dev_err(&dev->dev, "Out of memory\n");
 				ret = -ENOMEM;
@@ -1721,12 +1770,11 @@ free_interfaces:
 	 * host controller will not allow submissions to dropped endpoints.  If
 	 * this call fails, the device state is unchanged.
 	 */
-	if (cp)
-		ret = usb_hcd_check_bandwidth(dev, cp, NULL);
-	else
-		ret = usb_hcd_check_bandwidth(dev, NULL, NULL);
+	mutex_lock(&hcd->bandwidth_mutex);
+	ret = usb_hcd_alloc_bandwidth(dev, cp, NULL, NULL);
 	if (ret < 0) {
 		usb_autosuspend_device(dev);
+		mutex_unlock(&hcd->bandwidth_mutex);
 		goto free_interfaces;
 	}
 
@@ -1752,10 +1800,12 @@ free_interfaces:
 	dev->actconfig = cp;
 	if (!cp) {
 		usb_set_device_state(dev, USB_STATE_ADDRESS);
-		usb_hcd_check_bandwidth(dev, NULL, NULL);
+		usb_hcd_alloc_bandwidth(dev, NULL, NULL, NULL);
 		usb_autosuspend_device(dev);
+		mutex_unlock(&hcd->bandwidth_mutex);
 		goto free_interfaces;
 	}
+	mutex_unlock(&hcd->bandwidth_mutex);
 	usb_set_device_state(dev, USB_STATE_CONFIGURED);
 
 	/* Initialize the new interface structures and the
@@ -1890,7 +1940,7 @@ static void cancel_async_set_config(struct usb_device *udev)
  * routine gets around the normal restrictions by using a work thread to
  * submit the change-config request.
  *
- * Returns 0 if the request was succesfully queued, error code otherwise.
+ * Returns 0 if the request was successfully queued, error code otherwise.
  * The caller has no way to know whether the queued request will eventually
  * succeed.
  */
diff --git a/drivers/usb/core/sysfs.c b/drivers/usb/core/sysfs.c
index 7ec3041ae79e..5f3908f6e2dc 100644
--- a/drivers/usb/core/sysfs.c
+++ b/drivers/usb/core/sysfs.c
@@ -82,9 +82,13 @@ static ssize_t  show_##name(struct device *dev,				\
 		struct device_attribute *attr, char *buf)		\
 {									\
 	struct usb_device *udev;					\
+	int retval;							\
 									\
 	udev = to_usb_device(dev);					\
-	return sprintf(buf, "%s\n", udev->name);			\
+	usb_lock_device(udev);						\
+	retval = sprintf(buf, "%s\n", udev->name);			\
+	usb_unlock_device(udev);					\
+	return retval;							\
 }									\
 static DEVICE_ATTR(name, S_IRUGO, show_##name, NULL);
 
@@ -111,6 +115,12 @@ show_speed(struct device *dev, struct device_attribute *attr, char *buf)
 	case USB_SPEED_HIGH:
 		speed = "480";
 		break;
+	case USB_SPEED_VARIABLE:
+		speed = "480";
+		break;
+	case USB_SPEED_SUPER:
+		speed = "5000";
+		break;
 	default:
 		speed = "unknown";
 	}
@@ -139,6 +149,16 @@ show_devnum(struct device *dev, struct device_attribute *attr, char *buf)
 static DEVICE_ATTR(devnum, S_IRUGO, show_devnum, NULL);
 
 static ssize_t
+show_devpath(struct device *dev, struct device_attribute *attr, char *buf)
+{
+	struct usb_device *udev;
+
+	udev = to_usb_device(dev);
+	return sprintf(buf, "%s\n", udev->devpath);
+}
+static DEVICE_ATTR(devpath, S_IRUGO, show_devpath, NULL);
+
+static ssize_t
 show_version(struct device *dev, struct device_attribute *attr, char *buf)
 {
 	struct usb_device *udev;
@@ -317,7 +337,6 @@ static DEVICE_ATTR(autosuspend, S_IRUGO | S_IWUSR,
 
 static const char on_string[] = "on";
 static const char auto_string[] = "auto";
-static const char suspend_string[] = "suspend";
 
 static ssize_t
 show_level(struct device *dev, struct device_attribute *attr, char *buf)
@@ -325,13 +344,8 @@ show_level(struct device *dev, struct device_attribute *attr, char *buf)
 	struct usb_device *udev = to_usb_device(dev);
 	const char *p = auto_string;
 
-	if (udev->state == USB_STATE_SUSPENDED) {
-		if (udev->autoresume_disabled)
-			p = suspend_string;
-	} else {
-		if (udev->autosuspend_disabled)
-			p = on_string;
-	}
+	if (udev->state != USB_STATE_SUSPENDED && udev->autosuspend_disabled)
+		p = on_string;
 	return sprintf(buf, "%s\n", p);
 }
 
@@ -343,7 +357,7 @@ set_level(struct device *dev, struct device_attribute *attr,
 	int len = count;
 	char *cp;
 	int rc = 0;
-	int old_autosuspend_disabled, old_autoresume_disabled;
+	int old_autosuspend_disabled;
 
 	cp = memchr(buf, '\n', count);
 	if (cp)
@@ -351,7 +365,6 @@ set_level(struct device *dev, struct device_attribute *attr,
 
 	usb_lock_device(udev);
 	old_autosuspend_disabled = udev->autosuspend_disabled;
-	old_autoresume_disabled = udev->autoresume_disabled;
 
 	/* Setting the flags without calling usb_pm_lock is a subject to
 	 * races, but who cares...
@@ -359,28 +372,18 @@ set_level(struct device *dev, struct device_attribute *attr,
 	if (len == sizeof on_string - 1 &&
 			strncmp(buf, on_string, len) == 0) {
 		udev->autosuspend_disabled = 1;
-		udev->autoresume_disabled = 0;
 		rc = usb_external_resume_device(udev, PMSG_USER_RESUME);
 
 	} else if (len == sizeof auto_string - 1 &&
 			strncmp(buf, auto_string, len) == 0) {
 		udev->autosuspend_disabled = 0;
-		udev->autoresume_disabled = 0;
 		rc = usb_external_resume_device(udev, PMSG_USER_RESUME);
 
-	} else if (len == sizeof suspend_string - 1 &&
-			strncmp(buf, suspend_string, len) == 0) {
-		udev->autosuspend_disabled = 0;
-		udev->autoresume_disabled = 1;
-		rc = usb_external_suspend_device(udev, PMSG_USER_SUSPEND);
-
 	} else
 		rc = -EINVAL;
 
-	if (rc) {
+	if (rc)
 		udev->autosuspend_disabled = old_autosuspend_disabled;
-		udev->autoresume_disabled = old_autoresume_disabled;
-	}
 	usb_unlock_device(udev);
 	return (rc < 0 ? rc : count);
 }
@@ -508,6 +511,28 @@ static ssize_t usb_dev_authorized_store(struct device *dev,
 static DEVICE_ATTR(authorized, 0644,
 	    usb_dev_authorized_show, usb_dev_authorized_store);
 
+/* "Safely remove a device" */
+static ssize_t usb_remove_store(struct device *dev,
+		struct device_attribute *attr,
+		const char *buf, size_t count)
+{
+	struct usb_device *udev = to_usb_device(dev);
+	int rc = 0;
+
+	usb_lock_device(udev);
+	if (udev->state != USB_STATE_NOTATTACHED) {
+
+		/* To avoid races, first unconfigure and then remove */
+		usb_set_configuration(udev, -1);
+		rc = usb_remove_device(udev);
+	}
+	if (rc == 0)
+		rc = count;
+	usb_unlock_device(udev);
+	return rc;
+}
+static DEVICE_ATTR(remove, 0200, NULL, usb_remove_store);
+
 
 static struct attribute *dev_attrs[] = {
 	/* current configuration's attributes */
@@ -516,8 +541,8 @@ static struct attribute *dev_attrs[] = {
 	&dev_attr_bConfigurationValue.attr,
 	&dev_attr_bmAttributes.attr,
 	&dev_attr_bMaxPower.attr,
-	&dev_attr_urbnum.attr,
 	/* device attributes */
+	&dev_attr_urbnum.attr,
 	&dev_attr_idVendor.attr,
 	&dev_attr_idProduct.attr,
 	&dev_attr_bcdDevice.attr,
@@ -529,10 +554,12 @@ static struct attribute *dev_attrs[] = {
 	&dev_attr_speed.attr,
 	&dev_attr_busnum.attr,
 	&dev_attr_devnum.attr,
+	&dev_attr_devpath.attr,
 	&dev_attr_version.attr,
 	&dev_attr_maxchild.attr,
 	&dev_attr_quirks.attr,
 	&dev_attr_authorized.attr,
+	&dev_attr_remove.attr,
 	NULL,
 };
 static struct attribute_group dev_attr_grp = {
diff --git a/drivers/usb/core/urb.c b/drivers/usb/core/urb.c
index 0885d4abdc62..e7cae1334693 100644
--- a/drivers/usb/core/urb.c
+++ b/drivers/usb/core/urb.c
@@ -429,8 +429,16 @@ int usb_submit_urb(struct urb *urb, gfp_t mem_flags)
 	case USB_ENDPOINT_XFER_ISOC:
 	case USB_ENDPOINT_XFER_INT:
 		/* too small? */
-		if (urb->interval <= 0)
-			return -EINVAL;
+		switch (dev->speed) {
+		case USB_SPEED_VARIABLE:
+			if (urb->interval < 6)
+				return -EINVAL;
+			break;
+		default:
+			if (urb->interval <= 0)
+				return -EINVAL;
+			break;
+		}
 		/* too big? */
 		switch (dev->speed) {
 		case USB_SPEED_SUPER:	/* units are 125us */
@@ -438,6 +446,10 @@ int usb_submit_urb(struct urb *urb, gfp_t mem_flags)
 			if (urb->interval > (1 << 15))
 				return -EINVAL;
 			max = 1 << 15;
+		case USB_SPEED_VARIABLE:
+			if (urb->interval > 16)
+				return -EINVAL;
+			break;
 		case USB_SPEED_HIGH:	/* units are microframes */
 			/* NOTE usb handles 2^15 */
 			if (urb->interval > (1024 * 8))
@@ -461,8 +473,10 @@ int usb_submit_urb(struct urb *urb, gfp_t mem_flags)
 		default:
 			return -EINVAL;
 		}
-		/* Round down to a power of 2, no more than max */
-		urb->interval = min(max, 1 << ilog2(urb->interval));
+		if (dev->speed != USB_SPEED_VARIABLE) {
+			/* Round down to a power of 2, no more than max */
+			urb->interval = min(max, 1 << ilog2(urb->interval));
+		}
 	}
 
 	return usb_hcd_submit_urb(urb, mem_flags);
diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c
index b1b85abb9a2d..0daff0d968ba 100644
--- a/drivers/usb/core/usb.c
+++ b/drivers/usb/core/usb.c
@@ -64,6 +64,43 @@ MODULE_PARM_DESC(autosuspend, "default autosuspend delay");
 
 
 /**
+ * usb_find_alt_setting() - Given a configuration, find the alternate setting
+ * for the given interface.
+ * @config: the configuration to search (not necessarily the current config).
+ * @iface_num: interface number to search in
+ * @alt_num: alternate interface setting number to search for.
+ *
+ * Search the configuration's interface cache for the given alt setting.
+ */
+struct usb_host_interface *usb_find_alt_setting(
+		struct usb_host_config *config,
+		unsigned int iface_num,
+		unsigned int alt_num)
+{
+	struct usb_interface_cache *intf_cache = NULL;
+	int i;
+
+	for (i = 0; i < config->desc.bNumInterfaces; i++) {
+		if (config->intf_cache[i]->altsetting[0].desc.bInterfaceNumber
+				== iface_num) {
+			intf_cache = config->intf_cache[i];
+			break;
+		}
+	}
+	if (!intf_cache)
+		return NULL;
+	for (i = 0; i < intf_cache->num_altsetting; i++)
+		if (intf_cache->altsetting[i].desc.bAlternateSetting == alt_num)
+			return &intf_cache->altsetting[i];
+
+	printk(KERN_DEBUG "Did not find alt setting %u for intf %u, "
+			"config %u\n", alt_num, iface_num,
+			config->desc.bConfigurationValue);
+	return NULL;
+}
+EXPORT_SYMBOL_GPL(usb_find_alt_setting);
+
+/**
  * usb_ifnum_to_if - get the interface object with a given interface number
  * @dev: the device whose current configuration is considered
  * @ifnum: the desired interface
@@ -132,7 +169,7 @@ EXPORT_SYMBOL_GPL(usb_altnum_to_altsetting);
 
 struct find_interface_arg {
 	int minor;
-	struct usb_interface *interface;
+	struct device_driver *drv;
 };
 
 static int __find_interface(struct device *dev, void *data)
@@ -143,12 +180,10 @@ static int __find_interface(struct device *dev, void *data)
 	if (!is_usb_interface(dev))
 		return 0;
 
+	if (dev->driver != arg->drv)
+		return 0;
 	intf = to_usb_interface(dev);
-	if (intf->minor != -1 && intf->minor == arg->minor) {
-		arg->interface = intf;
-		return 1;
-	}
-	return 0;
+	return intf->minor == arg->minor;
 }
 
 /**
@@ -156,21 +191,24 @@ static int __find_interface(struct device *dev, void *data)
  * @drv: the driver whose current configuration is considered
  * @minor: the minor number of the desired device
  *
- * This walks the driver device list and returns a pointer to the interface
- * with the matching minor.  Note, this only works for devices that share the
- * USB major number.
+ * This walks the bus device list and returns a pointer to the interface
+ * with the matching minor and driver.  Note, this only works for devices
+ * that share the USB major number.
  */
 struct usb_interface *usb_find_interface(struct usb_driver *drv, int minor)
 {
 	struct find_interface_arg argb;
-	int retval;
+	struct device *dev;
 
 	argb.minor = minor;
-	argb.interface = NULL;
-	/* eat the error, it will be in argb.interface */
-	retval = driver_for_each_device(&drv->drvwrap.driver, NULL, &argb,
-					__find_interface);
-	return argb.interface;
+	argb.drv = &drv->drvwrap.driver;
+
+	dev = bus_find_device(&usb_bus_type, NULL, &argb, __find_interface);
+
+	/* Drop reference count from bus_find_device */
+	put_device(dev);
+
+	return dev ? to_usb_interface(dev) : NULL;
 }
 EXPORT_SYMBOL_GPL(usb_find_interface);
 
@@ -291,7 +329,7 @@ static int usb_dev_restore(struct device *dev)
 	return usb_resume(dev, PMSG_RESTORE);
 }
 
-static struct dev_pm_ops usb_device_pm_ops = {
+static const struct dev_pm_ops usb_device_pm_ops = {
 	.prepare =	usb_dev_prepare,
 	.complete =	usb_dev_complete,
 	.suspend =	usb_dev_suspend,
@@ -1038,7 +1076,7 @@ static struct notifier_block usb_bus_nb = {
 struct dentry *usb_debug_root;
 EXPORT_SYMBOL_GPL(usb_debug_root);
 
-struct dentry *usb_debug_devices;
+static struct dentry *usb_debug_devices;
 
 static int usb_debugfs_init(void)
 {
diff --git a/drivers/usb/core/usb.h b/drivers/usb/core/usb.h
index 9a8b15e6377a..4c36c7f512a0 100644
--- a/drivers/usb/core/usb.h
+++ b/drivers/usb/core/usb.h
@@ -24,6 +24,7 @@ extern void usb_disable_device(struct usb_device *dev, int skip_ep0);
 extern int usb_deauthorize_device(struct usb_device *);
 extern int usb_authorize_device(struct usb_device *);
 extern void usb_detect_quirks(struct usb_device *udev);
+extern int usb_remove_device(struct usb_device *udev);
 
 extern int usb_get_device_descriptor(struct usb_device *dev,
 		unsigned int size);
diff --git a/drivers/usb/early/ehci-dbgp.c b/drivers/usb/early/ehci-dbgp.c
index 1206a26ef893..2958a1271b20 100644
--- a/drivers/usb/early/ehci-dbgp.c
+++ b/drivers/usb/early/ehci-dbgp.c
@@ -613,7 +613,7 @@ err:
 }
 EXPORT_SYMBOL_GPL(dbgp_external_startup);
 
-static int __init ehci_reset_port(int port)
+static int ehci_reset_port(int port)
 {
 	u32 portsc;
 	u32 delay_time, delay;
diff --git a/drivers/usb/gadget/Kconfig b/drivers/usb/gadget/Kconfig
index a18e3c5dd82e..ee411206c699 100644
--- a/drivers/usb/gadget/Kconfig
+++ b/drivers/usb/gadget/Kconfig
@@ -732,6 +732,24 @@ config USB_FILE_STORAGE_TEST
 	  behavior of USB Mass Storage hosts.  Not needed for
 	  normal operation.
 
+config USB_MASS_STORAGE
+	tristate "Mass Storage Gadget"
+	depends on BLOCK
+	help
+	  The Mass Storage Gadget acts as a USB Mass Storage disk drive.
+	  As its storage repository it can use a regular file or a block
+	  device (in much the same way as the "loop" device driver),
+	  specified as a module parameter or sysfs option.
+
+	  This is heavily based on File-backed Storage Gadget and in most
+	  cases you will want to use FSG instead.  This gadget is mostly
+	  here to test the functionality of the Mass Storage Function
+	  which may be used with composite framework.
+
+	  Say "y" to link the driver statically, or "m" to build
+	  a dynamically linked module called "g_file_storage".  If unsure,
+	  consider File-backed Storage Gadget.
+
 config USB_G_SERIAL
 	tristate "Serial Gadget (with CDC ACM and CDC OBEX support)"
 	help
@@ -794,6 +812,48 @@ config USB_CDC_COMPOSITE
 	  Say "y" to link the driver statically, or "m" to build a
 	  dynamically linked module.
 
+config USB_G_MULTI
+	tristate "Multifunction Composite Gadget (EXPERIMENTAL)"
+	depends on BLOCK && NET
+	help
+	  The Multifunction Composite Gadget provides Ethernet (RNDIS
+	  and/or CDC Ethernet), mass storage and ACM serial link
+	  interfaces.
+
+	  You will be asked to choose which of the two configurations is
+	  to be available in the gadget.  At least one configuration must
+	  be chosen to make the gadget usable.  Selecting more than one
+	  configuration will prevent Windows from automatically detecting
+	  the gadget as a composite gadget, so an INF file will be needed to
+	  use the gadget.
+
+	  Say "y" to link the driver statically, or "m" to build a
+	  dynamically linked module called "g_multi".
+
+config USB_G_MULTI_RNDIS
+	bool "RNDIS + CDC Serial + Storage configuration"
+	depends on USB_G_MULTI
+	default y
+	help
+	  This option enables a configuration with RNDIS, CDC Serial and
+	  Mass Storage functions available in the Multifunction Composite
+	  Gadget.  This is the configuration dedicated for Windows since RNDIS
+	  is Microsoft's protocol.
+
+	  If unsure, say "y".
+
+config USB_G_MULTI_CDC
+	bool "CDC Ethernet + CDC Serial + Storage configuration"
+	depends on USB_G_MULTI
+	default n
+	help
+	  This option enables a configuration with CDC Ethernet (ECM), CDC
+	  Serial and Mass Storage functions available in the Multifunction
+	  Composite Gadget.
+
+	  If unsure, say "y".
+
+
 # put drivers that need isochronous transfer support (for audio
 # or video class gadget drivers), or specific hardware, here.
 
diff --git a/drivers/usb/gadget/Makefile b/drivers/usb/gadget/Makefile
index 9d7b87c52e9f..2e2c047262b7 100644
--- a/drivers/usb/gadget/Makefile
+++ b/drivers/usb/gadget/Makefile
@@ -39,16 +39,20 @@ g_serial-objs			:= serial.o
 g_midi-objs			:= gmidi.o
 gadgetfs-objs			:= inode.o
 g_file_storage-objs		:= file_storage.o
+g_mass_storage-objs		:= mass_storage.o
 g_printer-objs			:= printer.o
 g_cdc-objs			:= cdc2.o
+g_multi-objs			:= multi.o
 
 obj-$(CONFIG_USB_ZERO)		+= g_zero.o
 obj-$(CONFIG_USB_AUDIO)		+= g_audio.o
 obj-$(CONFIG_USB_ETH)		+= g_ether.o
 obj-$(CONFIG_USB_GADGETFS)	+= gadgetfs.o
 obj-$(CONFIG_USB_FILE_STORAGE)	+= g_file_storage.o
+obj-$(CONFIG_USB_MASS_STORAGE)	+= g_mass_storage.o
 obj-$(CONFIG_USB_G_SERIAL)	+= g_serial.o
 obj-$(CONFIG_USB_G_PRINTER)	+= g_printer.o
 obj-$(CONFIG_USB_MIDI_GADGET)	+= g_midi.o
 obj-$(CONFIG_USB_CDC_COMPOSITE) += g_cdc.o
+obj-$(CONFIG_USB_G_MULTI)	+= g_multi.o
 
diff --git a/drivers/usb/gadget/at91_udc.c b/drivers/usb/gadget/at91_udc.c
index 66450a1abc22..043e04db2a05 100644
--- a/drivers/usb/gadget/at91_udc.c
+++ b/drivers/usb/gadget/at91_udc.c
@@ -892,7 +892,7 @@ static void pullup(struct at91_udc *udc, int is_on)
 
 			txvc |= AT91_UDP_TXVC_PUON;
 			at91_udp_write(udc, AT91_UDP_TXVC, txvc);
-		} else if (cpu_is_at91sam9261()) {
+		} else if (cpu_is_at91sam9261() || cpu_is_at91sam9g10()) {
 			u32	usbpucr;
 
 			usbpucr = at91_sys_read(AT91_MATRIX_USBPUCR);
@@ -910,7 +910,7 @@ static void pullup(struct at91_udc *udc, int is_on)
 
 			txvc &= ~AT91_UDP_TXVC_PUON;
 			at91_udp_write(udc, AT91_UDP_TXVC, txvc);
-		} else if (cpu_is_at91sam9261()) {
+		} else if (cpu_is_at91sam9261() || cpu_is_at91sam9g10()) {
 			u32	usbpucr;
 
 			usbpucr = at91_sys_read(AT91_MATRIX_USBPUCR);
@@ -1692,7 +1692,7 @@ static int __init at91udc_probe(struct platform_device *pdev)
 		udc->ep[3].maxpacket = 64;
 		udc->ep[4].maxpacket = 512;
 		udc->ep[5].maxpacket = 512;
-	} else if (cpu_is_at91sam9261()) {
+	} else if (cpu_is_at91sam9261() || cpu_is_at91sam9g10()) {
 		udc->ep[3].maxpacket = 64;
 	} else if (cpu_is_at91sam9263()) {
 		udc->ep[0].maxpacket = 64;
diff --git a/drivers/usb/gadget/audio.c b/drivers/usb/gadget/audio.c
index a3a0f4a27ef0..a62af7b59094 100644
--- a/drivers/usb/gadget/audio.c
+++ b/drivers/usb/gadget/audio.c
@@ -89,120 +89,6 @@ static const struct usb_descriptor_header *otg_desc[] = {
 
 /*-------------------------------------------------------------------------*/
 
-/**
- * Handle USB audio endpoint set/get command in setup class request
- */
-
-static int audio_set_endpoint_req(struct usb_configuration *c,
-		const struct usb_ctrlrequest *ctrl)
-{
-	struct usb_composite_dev *cdev = c->cdev;
-	int			value = -EOPNOTSUPP;
-	u16			ep = le16_to_cpu(ctrl->wIndex);
-	u16			len = le16_to_cpu(ctrl->wLength);
-	u16			w_value = le16_to_cpu(ctrl->wValue);
-
-	DBG(cdev, "bRequest 0x%x, w_value 0x%04x, len %d, endpoint %d\n",
-			ctrl->bRequest, w_value, len, ep);
-
-	switch (ctrl->bRequest) {
-	case UAC_SET_CUR:
-		value = 0;
-		break;
-
-	case UAC_SET_MIN:
-		break;
-
-	case UAC_SET_MAX:
-		break;
-
-	case UAC_SET_RES:
-		break;
-
-	case UAC_SET_MEM:
-		break;
-
-	default:
-		break;
-	}
-
-	return value;
-}
-
-static int audio_get_endpoint_req(struct usb_configuration *c,
-		const struct usb_ctrlrequest *ctrl)
-{
-	struct usb_composite_dev *cdev = c->cdev;
-	int value = -EOPNOTSUPP;
-	u8 ep = ((le16_to_cpu(ctrl->wIndex) >> 8) & 0xFF);
-	u16 len = le16_to_cpu(ctrl->wLength);
-	u16 w_value = le16_to_cpu(ctrl->wValue);
-
-	DBG(cdev, "bRequest 0x%x, w_value 0x%04x, len %d, endpoint %d\n",
-			ctrl->bRequest, w_value, len, ep);
-
-	switch (ctrl->bRequest) {
-	case UAC_GET_CUR:
-	case UAC_GET_MIN:
-	case UAC_GET_MAX:
-	case UAC_GET_RES:
-		value = 3;
-		break;
-	case UAC_GET_MEM:
-		break;
-	default:
-		break;
-	}
-
-	return value;
-}
-
-static int
-audio_setup(struct usb_configuration *c, const struct usb_ctrlrequest *ctrl)
-{
-	struct usb_composite_dev *cdev = c->cdev;
-	struct usb_request *req = cdev->req;
-	int value = -EOPNOTSUPP;
-	u16 w_index = le16_to_cpu(ctrl->wIndex);
-	u16 w_value = le16_to_cpu(ctrl->wValue);
-	u16 w_length = le16_to_cpu(ctrl->wLength);
-
-	/* composite driver infrastructure handles everything except
-	 * Audio class messages; interface activation uses set_alt().
-	 */
-	switch (ctrl->bRequestType) {
-	case USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_ENDPOINT:
-		value = audio_set_endpoint_req(c, ctrl);
-		break;
-
-	case USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_ENDPOINT:
-		value = audio_get_endpoint_req(c, ctrl);
-		break;
-
-	default:
-		ERROR(cdev, "Invalid control req%02x.%02x v%04x i%04x l%d\n",
-			ctrl->bRequestType, ctrl->bRequest,
-			w_value, w_index, w_length);
-	}
-
-	/* respond with data transfer or status phase? */
-	if (value >= 0) {
-		DBG(cdev, "Audio req%02x.%02x v%04x i%04x l%d\n",
-			ctrl->bRequestType, ctrl->bRequest,
-			w_value, w_index, w_length);
-		req->zero = 0;
-		req->length = value;
-		value = usb_ep_queue(cdev->gadget->ep0, req, GFP_ATOMIC);
-		if (value < 0)
-			ERROR(cdev, "Audio response on err %d\n", value);
-	}
-
-	/* device either stalls (value < 0) or reports success */
-	return value;
-}
-
-/*-------------------------------------------------------------------------*/
-
 static int __init audio_do_config(struct usb_configuration *c)
 {
 	/* FIXME alloc iConfiguration string, set it in c->strings */
@@ -220,7 +106,6 @@ static int __init audio_do_config(struct usb_configuration *c)
 static struct usb_configuration audio_config_driver = {
 	.label			= DRIVER_DESC,
 	.bind			= audio_do_config,
-	.setup			= audio_setup,
 	.bConfigurationValue	= 1,
 	/* .iConfiguration = DYNAMIC */
 	.bmAttributes		= USB_CONFIG_ATT_SELFPOWER,
@@ -273,6 +158,7 @@ fail:
 
 static int __exit audio_unbind(struct usb_composite_dev *cdev)
 {
+	gaudio_cleanup();
 	return 0;
 }
 
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index d05397ec8a18..09289bb1e20f 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -373,6 +373,8 @@ static void reset_config(struct usb_composite_dev *cdev)
 	list_for_each_entry(f, &cdev->config->functions, list) {
 		if (f->disable)
 			f->disable(f);
+
+		bitmap_zero(f->endpoints, 32);
 	}
 	cdev->config = NULL;
 }
@@ -418,10 +420,35 @@ static int set_config(struct usb_composite_dev *cdev,
 	/* Initialize all interfaces by setting them to altsetting zero. */
 	for (tmp = 0; tmp < MAX_CONFIG_INTERFACES; tmp++) {
 		struct usb_function	*f = c->interface[tmp];
+		struct usb_descriptor_header **descriptors;
 
 		if (!f)
 			break;
 
+		/*
+		 * Record which endpoints are used by the function. This is used
+		 * to dispatch control requests targeted at that endpoint to the
+		 * function's setup callback instead of the current
+		 * configuration's setup callback.
+		 */
+		if (gadget->speed == USB_SPEED_HIGH)
+			descriptors = f->hs_descriptors;
+		else
+			descriptors = f->descriptors;
+
+		for (; *descriptors; ++descriptors) {
+			struct usb_endpoint_descriptor *ep;
+			int addr;
+
+			if ((*descriptors)->bDescriptorType != USB_DT_ENDPOINT)
+				continue;
+
+			ep = (struct usb_endpoint_descriptor *)*descriptors;
+			addr = ((ep->bEndpointAddress & 0x80) >> 3)
+			     |  (ep->bEndpointAddress & 0x0f);
+			set_bit(addr, f->endpoints);
+		}
+
 		result = f->set_alt(f, tmp, 0);
 		if (result < 0) {
 			DBG(cdev, "interface %d (%s/%p) alt 0 --> %d\n",
@@ -688,6 +715,7 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
 	u16				w_value = le16_to_cpu(ctrl->wValue);
 	u16				w_length = le16_to_cpu(ctrl->wLength);
 	struct usb_function		*f = NULL;
+	u8				endp;
 
 	/* partial re-init of the response message; the function or the
 	 * gadget might need to intercept e.g. a control-OUT completion
@@ -800,23 +828,33 @@ unknown:
 			ctrl->bRequestType, ctrl->bRequest,
 			w_value, w_index, w_length);
 
-		/* functions always handle their interfaces ... punt other
-		 * recipients (endpoint, other, WUSB, ...) to the current
+		/* functions always handle their interfaces and endpoints...
+		 * punt other recipients (other, WUSB, ...) to the current
 		 * configuration code.
 		 *
 		 * REVISIT it could make sense to let the composite device
 		 * take such requests too, if that's ever needed:  to work
 		 * in config 0, etc.
 		 */
-		if ((ctrl->bRequestType & USB_RECIP_MASK)
-				== USB_RECIP_INTERFACE) {
+		switch (ctrl->bRequestType & USB_RECIP_MASK) {
+		case USB_RECIP_INTERFACE:
 			f = cdev->config->interface[intf];
-			if (f && f->setup)
-				value = f->setup(f, ctrl);
-			else
+			break;
+
+		case USB_RECIP_ENDPOINT:
+			endp = ((w_index & 0x80) >> 3) | (w_index & 0x0f);
+			list_for_each_entry(f, &cdev->config->functions, list) {
+				if (test_bit(endp, f->endpoints))
+					break;
+			}
+			if (&f->list == &cdev->config->functions)
 				f = NULL;
+			break;
 		}
-		if (value < 0 && !f) {
+
+		if (f && f->setup)
+			value = f->setup(f, ctrl);
+		else {
 			struct usb_configuration	*c;
 
 			c = cdev->config;
@@ -1054,7 +1092,8 @@ static struct usb_gadget_driver composite_driver = {
 	.speed		= USB_SPEED_HIGH,
 
 	.bind		= composite_bind,
-	.unbind		= __exit_p(composite_unbind),
+	/* .unbind		= __exit_p(composite_unbind), */
+	.unbind		= composite_unbind,
 
 	.setup		= composite_setup,
 	.disconnect	= composite_disconnect,
@@ -1103,7 +1142,7 @@ int __init usb_composite_register(struct usb_composite_driver *driver)
  * This function is used to unregister drivers using the composite
  * driver framework.
  */
-void __exit usb_composite_unregister(struct usb_composite_driver *driver)
+void /* __exit */ usb_composite_unregister(struct usb_composite_driver *driver)
 {
 	if (composite != driver)
 		return;
diff --git a/drivers/usb/gadget/ether.c b/drivers/usb/gadget/ether.c
index 167cb2a8ecef..141372b6e7a1 100644
--- a/drivers/usb/gadget/ether.c
+++ b/drivers/usb/gadget/ether.c
@@ -25,6 +25,14 @@
 #include <linux/kernel.h>
 #include <linux/utsname.h>
 
+
+#if defined USB_ETH_RNDIS
+#  undef USB_ETH_RNDIS
+#endif
+#ifdef CONFIG_USB_ETH_RNDIS
+#  define USB_ETH_RNDIS y
+#endif
+
 #include "u_ether.h"
 
 
@@ -66,7 +74,7 @@
 #define DRIVER_DESC		"Ethernet Gadget"
 #define DRIVER_VERSION		"Memorial Day 2008"
 
-#ifdef CONFIG_USB_ETH_RNDIS
+#ifdef USB_ETH_RNDIS
 #define PREFIX			"RNDIS/"
 #else
 #define PREFIX			""
@@ -87,7 +95,7 @@
 
 static inline bool has_rndis(void)
 {
-#ifdef	CONFIG_USB_ETH_RNDIS
+#ifdef	USB_ETH_RNDIS
 	return true;
 #else
 	return false;
@@ -110,7 +118,7 @@ static inline bool has_rndis(void)
 
 #include "f_ecm.c"
 #include "f_subset.c"
-#ifdef	CONFIG_USB_ETH_RNDIS
+#ifdef	USB_ETH_RNDIS
 #include "f_rndis.c"
 #include "rndis.c"
 #endif
@@ -251,7 +259,7 @@ static struct usb_configuration rndis_config_driver = {
 
 /*-------------------------------------------------------------------------*/
 
-#ifdef CONFIG_USB_ETH_EEM
+#ifdef USB_ETH_EEM
 static int use_eem = 1;
 #else
 static int use_eem;
diff --git a/drivers/usb/gadget/f_acm.c b/drivers/usb/gadget/f_acm.c
index 7953948bfe4a..d10353d46b86 100644
--- a/drivers/usb/gadget/f_acm.c
+++ b/drivers/usb/gadget/f_acm.c
@@ -4,6 +4,8 @@
  * Copyright (C) 2003 Al Borchers (alborchers@steinerpoint.com)
  * Copyright (C) 2008 by David Brownell
  * Copyright (C) 2008 by Nokia Corporation
+ * Copyright (C) 2009 by Samsung Electronics
+ * Author: Michal Nazarewicz (m.nazarewicz@samsung.com)
  *
  * This software is distributed under the terms of the GNU General
  * Public License ("GPL") as published by the Free Software Foundation,
@@ -99,6 +101,20 @@ static inline struct f_acm *port_to_acm(struct gserial *p)
 
 /* interface and class descriptors: */
 
+static struct usb_interface_assoc_descriptor
+acm_iad_descriptor = {
+	.bLength =		sizeof acm_iad_descriptor,
+	.bDescriptorType =	USB_DT_INTERFACE_ASSOCIATION,
+
+	/* .bFirstInterface =	DYNAMIC, */
+	.bInterfaceCount = 	2,	// control + data
+	.bFunctionClass =	USB_CLASS_COMM,
+	.bFunctionSubClass =	USB_CDC_SUBCLASS_ACM,
+	.bFunctionProtocol =	USB_CDC_PROTO_NONE,
+	/* .iFunction =		DYNAMIC */
+};
+
+
 static struct usb_interface_descriptor acm_control_interface_desc __initdata = {
 	.bLength =		USB_DT_INTERFACE_SIZE,
 	.bDescriptorType =	USB_DT_INTERFACE,
@@ -178,6 +194,7 @@ static struct usb_endpoint_descriptor acm_fs_out_desc __initdata = {
 };
 
 static struct usb_descriptor_header *acm_fs_function[] __initdata = {
+	(struct usb_descriptor_header *) &acm_iad_descriptor,
 	(struct usb_descriptor_header *) &acm_control_interface_desc,
 	(struct usb_descriptor_header *) &acm_header_desc,
 	(struct usb_descriptor_header *) &acm_call_mgmt_descriptor,
@@ -216,6 +233,7 @@ static struct usb_endpoint_descriptor acm_hs_out_desc __initdata = {
 };
 
 static struct usb_descriptor_header *acm_hs_function[] __initdata = {
+	(struct usb_descriptor_header *) &acm_iad_descriptor,
 	(struct usb_descriptor_header *) &acm_control_interface_desc,
 	(struct usb_descriptor_header *) &acm_header_desc,
 	(struct usb_descriptor_header *) &acm_call_mgmt_descriptor,
@@ -232,11 +250,13 @@ static struct usb_descriptor_header *acm_hs_function[] __initdata = {
 
 #define ACM_CTRL_IDX	0
 #define ACM_DATA_IDX	1
+#define ACM_IAD_IDX	2
 
 /* static strings, in UTF-8 */
 static struct usb_string acm_string_defs[] = {
 	[ACM_CTRL_IDX].s = "CDC Abstract Control Model (ACM)",
 	[ACM_DATA_IDX].s = "CDC ACM Data",
+	[ACM_IAD_IDX ].s = "CDC Serial",
 	{  /* ZEROES END LIST */ },
 };
 
@@ -432,7 +452,7 @@ static void acm_disable(struct usb_function *f)
  * @length: size of data
  * Context: irqs blocked, acm->lock held, acm_notify_req non-null
  *
- * Returns zero on sucess or a negative errno.
+ * Returns zero on success or a negative errno.
  *
  * See section 6.3.5 of the CDC 1.1 specification for information
  * about the only notification we issue:  SerialState change.
@@ -563,6 +583,7 @@ acm_bind(struct usb_configuration *c, struct usb_function *f)
 	if (status < 0)
 		goto fail;
 	acm->ctrl_id = status;
+	acm_iad_descriptor.bFirstInterface = status;
 
 	acm_control_interface_desc.bInterfaceNumber = status;
 	acm_union_desc .bMasterInterface0 = status;
@@ -732,6 +753,13 @@ int __init acm_bind_config(struct usb_configuration *c, u8 port_num)
 		acm_string_defs[ACM_DATA_IDX].id = status;
 
 		acm_data_interface_desc.iInterface = status;
+
+		status = usb_string_id(c->cdev);
+		if (status < 0)
+			return status;
+		acm_string_defs[ACM_IAD_IDX].id = status;
+
+		acm_iad_descriptor.iFunction = status;
 	}
 
 	/* allocate and initialize one new instance */
diff --git a/drivers/usb/gadget/f_audio.c b/drivers/usb/gadget/f_audio.c
index 98e9bb977291..df77f6131c73 100644
--- a/drivers/usb/gadget/f_audio.c
+++ b/drivers/usb/gadget/f_audio.c
@@ -56,13 +56,16 @@ static struct usb_interface_descriptor ac_interface_desc __initdata = {
 DECLARE_UAC_AC_HEADER_DESCRIPTOR(2);
 
 #define UAC_DT_AC_HEADER_LENGTH	UAC_DT_AC_HEADER_SIZE(F_AUDIO_NUM_INTERFACES)
+/* 1 input terminal, 1 output terminal and 1 feature unit */
+#define UAC_DT_TOTAL_LENGTH (UAC_DT_AC_HEADER_LENGTH + UAC_DT_INPUT_TERMINAL_SIZE \
+	+ UAC_DT_OUTPUT_TERMINAL_SIZE + UAC_DT_FEATURE_UNIT_SIZE(0))
 /* B.3.2  Class-Specific AC Interface Descriptor */
 static struct uac_ac_header_descriptor_2 ac_header_desc = {
 	.bLength =		UAC_DT_AC_HEADER_LENGTH,
 	.bDescriptorType =	USB_DT_CS_INTERFACE,
 	.bDescriptorSubtype =	UAC_HEADER,
 	.bcdADC =		__constant_cpu_to_le16(0x0100),
-	.wTotalLength =		__constant_cpu_to_le16(UAC_DT_AC_HEADER_LENGTH),
+	.wTotalLength =		__constant_cpu_to_le16(UAC_DT_TOTAL_LENGTH),
 	.bInCollection =	F_AUDIO_NUM_INTERFACES,
 	.baInterfaceNr = {
 		[0] =		F_AUDIO_AC_INTERFACE,
@@ -252,12 +255,12 @@ static struct f_audio_buf *f_audio_buffer_alloc(int buf_size)
 
 	copy_buf = kzalloc(sizeof *copy_buf, GFP_ATOMIC);
 	if (!copy_buf)
-		return (struct f_audio_buf *)-ENOMEM;
+		return ERR_PTR(-ENOMEM);
 
 	copy_buf->buf = kzalloc(buf_size, GFP_ATOMIC);
 	if (!copy_buf->buf) {
 		kfree(copy_buf);
-		return (struct f_audio_buf *)-ENOMEM;
+		return ERR_PTR(-ENOMEM);
 	}
 
 	return copy_buf;
@@ -332,7 +335,7 @@ static int f_audio_out_ep_complete(struct usb_ep *ep, struct usb_request *req)
 		list_add_tail(&copy_buf->list, &audio->play_queue);
 		schedule_work(&audio->playback_work);
 		copy_buf = f_audio_buffer_alloc(audio_buf_size);
-		if (copy_buf < 0)
+		if (IS_ERR(copy_buf))
 			return -ENOMEM;
 	}
 
@@ -445,6 +448,70 @@ static int audio_get_intf_req(struct usb_function *f,
 	return len;
 }
 
+static int audio_set_endpoint_req(struct usb_function *f,
+		const struct usb_ctrlrequest *ctrl)
+{
+	struct usb_composite_dev *cdev = f->config->cdev;
+	int			value = -EOPNOTSUPP;
+	u16			ep = le16_to_cpu(ctrl->wIndex);
+	u16			len = le16_to_cpu(ctrl->wLength);
+	u16			w_value = le16_to_cpu(ctrl->wValue);
+
+	DBG(cdev, "bRequest 0x%x, w_value 0x%04x, len %d, endpoint %d\n",
+			ctrl->bRequest, w_value, len, ep);
+
+	switch (ctrl->bRequest) {
+	case UAC_SET_CUR:
+		value = 0;
+		break;
+
+	case UAC_SET_MIN:
+		break;
+
+	case UAC_SET_MAX:
+		break;
+
+	case UAC_SET_RES:
+		break;
+
+	case UAC_SET_MEM:
+		break;
+
+	default:
+		break;
+	}
+
+	return value;
+}
+
+static int audio_get_endpoint_req(struct usb_function *f,
+		const struct usb_ctrlrequest *ctrl)
+{
+	struct usb_composite_dev *cdev = f->config->cdev;
+	int value = -EOPNOTSUPP;
+	u8 ep = ((le16_to_cpu(ctrl->wIndex) >> 8) & 0xFF);
+	u16 len = le16_to_cpu(ctrl->wLength);
+	u16 w_value = le16_to_cpu(ctrl->wValue);
+
+	DBG(cdev, "bRequest 0x%x, w_value 0x%04x, len %d, endpoint %d\n",
+			ctrl->bRequest, w_value, len, ep);
+
+	switch (ctrl->bRequest) {
+	case UAC_GET_CUR:
+	case UAC_GET_MIN:
+	case UAC_GET_MAX:
+	case UAC_GET_RES:
+		value = 3;
+		break;
+	case UAC_GET_MEM:
+		break;
+	default:
+		break;
+	}
+
+	return value;
+}
+
 static int
 f_audio_setup(struct usb_function *f, const struct usb_ctrlrequest *ctrl)
 {
@@ -455,8 +522,8 @@ f_audio_setup(struct usb_function *f, const struct usb_ctrlrequest *ctrl)
 	u16			w_value = le16_to_cpu(ctrl->wValue);
 	u16			w_length = le16_to_cpu(ctrl->wLength);
 
-	/* composite driver infrastructure handles everything except
-	 * Audio class messages; interface activation uses set_alt().
+	/* composite driver infrastructure handles everything; interface
+	 * activation uses set_alt().
 	 */
 	switch (ctrl->bRequestType) {
 	case USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE:
@@ -467,6 +534,14 @@ f_audio_setup(struct usb_function *f, const struct usb_ctrlrequest *ctrl)
 		value = audio_get_intf_req(f, ctrl);
 		break;
 
+	case USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_ENDPOINT:
+		value = audio_set_endpoint_req(f, ctrl);
+		break;
+
+	case USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_ENDPOINT:
+		value = audio_get_endpoint_req(f, ctrl);
+		break;
+
 	default:
 		ERROR(cdev, "invalid control req%02x.%02x v%04x i%04x l%d\n",
 			ctrl->bRequestType, ctrl->bRequest,
@@ -504,6 +579,8 @@ static int f_audio_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
 			usb_ep_enable(out_ep, audio->out_desc);
 			out_ep->driver_data = audio;
 			audio->copy_buf = f_audio_buffer_alloc(audio_buf_size);
+			if (IS_ERR(audio->copy_buf))
+				return -ENOMEM;
 
 			/*
 			 * allocate a bunch of read buffers
@@ -715,7 +792,7 @@ int __init audio_bind_config(struct usb_configuration *c)
 	return status;
 
 add_fail:
-	gaudio_cleanup(&audio->card);
+	gaudio_cleanup();
 setup_fail:
 	kfree(audio);
 	return status;
diff --git a/drivers/usb/gadget/f_mass_storage.c b/drivers/usb/gadget/f_mass_storage.c
new file mode 100644
index 000000000000..a37640eba434
--- /dev/null
+++ b/drivers/usb/gadget/f_mass_storage.c
@@ -0,0 +1,3091 @@
+/*
+ * f_mass_storage.c -- Mass Storage USB Composite Function
+ *
+ * Copyright (C) 2003-2008 Alan Stern
+ * Copyright (C) 2009 Samsung Electronics
+ *                    Author: Michal Nazarewicz <m.nazarewicz@samsung.com>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions, and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The names of the above-listed copyright holders may not be used
+ *    to endorse or promote products derived from this software without
+ *    specific prior written permission.
+ *
+ * ALTERNATIVELY, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") as published by the Free Software
+ * Foundation, either version 2 of that License or (at your option) any
+ * later version.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+ * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+/*
+ * The Mass Storage Function acts as a USB Mass Storage device,
+ * appearing to the host as a disk drive or as a CD-ROM drive.  In
+ * addition to providing an example of a genuinely useful composite
+ * function for a USB device, it also illustrates a technique of
+ * double-buffering for increased throughput.
+ *
+ * Function supports multiple logical units (LUNs).  Backing storage
+ * for each LUN is provided by a regular file or a block device.
+ * Access for each LUN can be limited to read-only.  Moreover, the
+ * function can indicate that LUN is removable and/or CD-ROM.  (The
+ * later implies read-only access.)
+ *
+ * MSF is configured by specifying a fsg_config structure.  It has the
+ * following fields:
+ *
+ *	nluns		Number of LUNs function have (anywhere from 1
+ *				to FSG_MAX_LUNS which is 8).
+ *	luns		An array of LUN configuration values.  This
+ *				should be filled for each LUN that
+ *				function will include (ie. for "nluns"
+ *				LUNs).  Each element of the array has
+ *				the following fields:
+ *	->filename	The path to the backing file for the LUN.
+ *				Required if LUN is not marked as
+ *				removable.
+ *	->ro		Flag specifying access to the LUN shall be
+ *				read-only.  This is implied if CD-ROM
+ *				emulation is enabled as well as when
+ *				it was impossible to open "filename"
+ *				in R/W mode.
+ *	->removable	Flag specifying that LUN shall be indicated as
+ *				being removable.
+ *	->cdrom		Flag specifying that LUN shall be reported as
+ *				being a CD-ROM.
+ *
+ *	lun_name_format	A printf-like format for names of the LUN
+ *				devices.  This determines how the
+ *				directory in sysfs will be named.
+ *				Unless you are using several MSFs in
+ *				a single gadget (as opposed to single
+ *				MSF in many configurations) you may
+ *				leave it as NULL (in which case
+ *				"lun%d" will be used).  In the format
+ *				you can use "%d" to index LUNs for
+ *				MSF's with more than one LUN.  (Beware
+ *				that there is only one integer given
+ *				as an argument for the format and
+ *				specifying invalid format may cause
+ *				unspecified behaviour.)
+ *	thread_name	Name of the kernel thread process used by the
+ *				MSF.  You can safely set it to NULL
+ *				(in which case default "file-storage"
+ *				will be used).
+ *
+ *	vendor_name
+ *	product_name
+ *	release		Information used as a reply to INQUIRY
+ *				request.  To use default set to NULL,
+ *				NULL, 0xffff respectively.  The first
+ *				field should be 8 and the second 16
+ *				characters or less.
+ *
+ *	can_stall	Set to permit function to halt bulk endpoints.
+ *				Disabled on some USB devices known not
+ *				to work correctly.  You should set it
+ *				to true.
+ *
+ * If "removable" is not set for a LUN then a backing file must be
+ * specified.  If it is set, then NULL filename means the LUN's medium
+ * is not loaded (an empty string as "filename" in the fsg_config
+ * structure causes error).  The CD-ROM emulation includes a single
+ * data track and no audio tracks; hence there need be only one
+ * backing file per LUN.  Note also that the CD-ROM block length is
+ * set to 512 rather than the more common value 2048.
+ *
+ *
+ * MSF includes support for module parameters.  If gadget using it
+ * decides to use it, the following module parameters will be
+ * available:
+ *
+ *	file=filename[,filename...]
+ *			Names of the files or block devices used for
+ *				backing storage.
+ *	ro=b[,b...]	Default false, boolean for read-only access.
+ *	removable=b[,b...]
+ *			Default true, boolean for removable media.
+ *	cdrom=b[,b...]	Default false, boolean for whether to emulate
+ *				a CD-ROM drive.
+ *	luns=N		Default N = number of filenames, number of
+ *				LUNs to support.
+ *	stall		Default determined according to the type of
+ *				USB device controller (usually true),
+ *				boolean to permit the driver to halt
+ *				bulk endpoints.
+ *
+ * The module parameters may be prefixed with some string.  You need
+ * to consult gadget's documentation or source to verify whether it is
+ * using those module parameters and if it does what are the prefixes
+ * (look for FSG_MODULE_PARAMETERS() macro usage, what's inside it is
+ * the prefix).
+ *
+ *
+ * Requirements are modest; only a bulk-in and a bulk-out endpoint are
+ * needed.  The memory requirement amounts to two 16K buffers, size
+ * configurable by a parameter.  Support is included for both
+ * full-speed and high-speed operation.
+ *
+ * Note that the driver is slightly non-portable in that it assumes a
+ * single memory/DMA buffer will be useable for bulk-in, bulk-out, and
+ * interrupt-in endpoints.  With most device controllers this isn't an
+ * issue, but there may be some with hardware restrictions that prevent
+ * a buffer from being used by more than one endpoint.
+ *
+ *
+ * The pathnames of the backing files and the ro settings are
+ * available in the attribute files "file" and "ro" in the lun<n> (or
+ * to be more precise in a directory which name comes from
+ * "lun_name_format" option!) subdirectory of the gadget's sysfs
+ * directory.  If the "removable" option is set, writing to these
+ * files will simulate ejecting/loading the medium (writing an empty
+ * line means eject) and adjusting a write-enable tab.  Changes to the
+ * ro setting are not allowed when the medium is loaded or if CD-ROM
+ * emulation is being used.
+ *
+ *
+ * This function is heavily based on "File-backed Storage Gadget" by
+ * Alan Stern which in turn is heavily based on "Gadget Zero" by David
+ * Brownell.  The driver's SCSI command interface was based on the
+ * "Information technology - Small Computer System Interface - 2"
+ * document from X3T9.2 Project 375D, Revision 10L, 7-SEP-93,
+ * available at <http://www.t10.org/ftp/t10/drafts/s2/s2-r10l.pdf>.
+ * The single exception is opcode 0x23 (READ FORMAT CAPACITIES), which
+ * was based on the "Universal Serial Bus Mass Storage Class UFI
+ * Command Specification" document, Revision 1.0, December 14, 1998,
+ * available at
+ * <http://www.usb.org/developers/devclass_docs/usbmass-ufi10.pdf>.
+ */
+
+
+/*
+ *				Driver Design
+ *
+ * The MSF is fairly straightforward.  There is a main kernel
+ * thread that handles most of the work.  Interrupt routines field
+ * callbacks from the controller driver: bulk- and interrupt-request
+ * completion notifications, endpoint-0 events, and disconnect events.
+ * Completion events are passed to the main thread by wakeup calls.  Many
+ * ep0 requests are handled at interrupt time, but SetInterface,
+ * SetConfiguration, and device reset requests are forwarded to the
+ * thread in the form of "exceptions" using SIGUSR1 signals (since they
+ * should interrupt any ongoing file I/O operations).
+ *
+ * The thread's main routine implements the standard command/data/status
+ * parts of a SCSI interaction.  It and its subroutines are full of tests
+ * for pending signals/exceptions -- all this polling is necessary since
+ * the kernel has no setjmp/longjmp equivalents.  (Maybe this is an
+ * indication that the driver really wants to be running in userspace.)
+ * An important point is that so long as the thread is alive it keeps an
+ * open reference to the backing file.  This will prevent unmounting
+ * the backing file's underlying filesystem and could cause problems
+ * during system shutdown, for example.  To prevent such problems, the
+ * thread catches INT, TERM, and KILL signals and converts them into
+ * an EXIT exception.
+ *
+ * In normal operation the main thread is started during the gadget's
+ * fsg_bind() callback and stopped during fsg_unbind().  But it can
+ * also exit when it receives a signal, and there's no point leaving
+ * the gadget running when the thread is dead.  At of this moment, MSF
+ * provides no way to deregister the gadget when thread dies -- maybe
+ * a callback functions is needed.
+ *
+ * To provide maximum throughput, the driver uses a circular pipeline of
+ * buffer heads (struct fsg_buffhd).  In principle the pipeline can be
+ * arbitrarily long; in practice the benefits don't justify having more
+ * than 2 stages (i.e., double buffering).  But it helps to think of the
+ * pipeline as being a long one.  Each buffer head contains a bulk-in and
+ * a bulk-out request pointer (since the buffer can be used for both
+ * output and input -- directions always are given from the host's
+ * point of view) as well as a pointer to the buffer and various state
+ * variables.
+ *
+ * Use of the pipeline follows a simple protocol.  There is a variable
+ * (fsg->next_buffhd_to_fill) that points to the next buffer head to use.
+ * At any time that buffer head may still be in use from an earlier
+ * request, so each buffer head has a state variable indicating whether
+ * it is EMPTY, FULL, or BUSY.  Typical use involves waiting for the
+ * buffer head to be EMPTY, filling the buffer either by file I/O or by
+ * USB I/O (during which the buffer head is BUSY), and marking the buffer
+ * head FULL when the I/O is complete.  Then the buffer will be emptied
+ * (again possibly by USB I/O, during which it is marked BUSY) and
+ * finally marked EMPTY again (possibly by a completion routine).
+ *
+ * A module parameter tells the driver to avoid stalling the bulk
+ * endpoints wherever the transport specification allows.  This is
+ * necessary for some UDCs like the SuperH, which cannot reliably clear a
+ * halt on a bulk endpoint.  However, under certain circumstances the
+ * Bulk-only specification requires a stall.  In such cases the driver
+ * will halt the endpoint and set a flag indicating that it should clear
+ * the halt in software during the next device reset.  Hopefully this
+ * will permit everything to work correctly.  Furthermore, although the
+ * specification allows the bulk-out endpoint to halt when the host sends
+ * too much data, implementing this would cause an unavoidable race.
+ * The driver will always use the "no-stall" approach for OUT transfers.
+ *
+ * One subtle point concerns sending status-stage responses for ep0
+ * requests.  Some of these requests, such as device reset, can involve
+ * interrupting an ongoing file I/O operation, which might take an
+ * arbitrarily long time.  During that delay the host might give up on
+ * the original ep0 request and issue a new one.  When that happens the
+ * driver should not notify the host about completion of the original
+ * request, as the host will no longer be waiting for it.  So the driver
+ * assigns to each ep0 request a unique tag, and it keeps track of the
+ * tag value of the request associated with a long-running exception
+ * (device-reset, interface-change, or configuration-change).  When the
+ * exception handler is finished, the status-stage response is submitted
+ * only if the current ep0 request tag is equal to the exception request
+ * tag.  Thus only the most recently received ep0 request will get a
+ * status-stage response.
+ *
+ * Warning: This driver source file is too long.  It ought to be split up
+ * into a header file plus about 3 separate .c files, to handle the details
+ * of the Gadget, USB Mass Storage, and SCSI protocols.
+ */
+
+
+/* #define VERBOSE_DEBUG */
+/* #define DUMP_MSGS */
+
+
+#include <linux/blkdev.h>
+#include <linux/completion.h>
+#include <linux/dcache.h>
+#include <linux/delay.h>
+#include <linux/device.h>
+#include <linux/fcntl.h>
+#include <linux/file.h>
+#include <linux/fs.h>
+#include <linux/kref.h>
+#include <linux/kthread.h>
+#include <linux/limits.h>
+#include <linux/rwsem.h>
+#include <linux/slab.h>
+#include <linux/spinlock.h>
+#include <linux/string.h>
+#include <linux/freezer.h>
+#include <linux/utsname.h>
+
+#include <linux/usb/ch9.h>
+#include <linux/usb/gadget.h>
+
+#include "gadget_chips.h"
+
+
+
+/*------------------------------------------------------------------------*/
+
+#define FSG_DRIVER_DESC		"Mass Storage Function"
+#define FSG_DRIVER_VERSION	"2009/09/11"
+
+static const char fsg_string_interface[] = "Mass Storage";
+
+
+#define FSG_NO_INTR_EP 1
+#define FSG_BUFFHD_STATIC_BUFFER 1
+#define FSG_NO_DEVICE_STRINGS    1
+#define FSG_NO_OTG               1
+#define FSG_NO_INTR_EP           1
+
+#include "storage_common.c"
+
+
+/*-------------------------------------------------------------------------*/
+
+struct fsg_dev;
+
+
+/* Data shared by all the FSG instances. */
+struct fsg_common {
+	struct usb_gadget	*gadget;
+	struct fsg_dev		*fsg;
+	struct fsg_dev		*prev_fsg;
+
+	/* filesem protects: backing files in use */
+	struct rw_semaphore	filesem;
+
+	/* lock protects: state, all the req_busy's */
+	spinlock_t		lock;
+
+	struct usb_ep		*ep0;		/* Copy of gadget->ep0 */
+	struct usb_request	*ep0req;	/* Copy of cdev->req */
+	unsigned int		ep0_req_tag;
+	const char		*ep0req_name;
+
+	struct fsg_buffhd	*next_buffhd_to_fill;
+	struct fsg_buffhd	*next_buffhd_to_drain;
+	struct fsg_buffhd	buffhds[FSG_NUM_BUFFERS];
+
+	int			cmnd_size;
+	u8			cmnd[MAX_COMMAND_SIZE];
+
+	unsigned int		nluns;
+	unsigned int		lun;
+	struct fsg_lun		*luns;
+	struct fsg_lun		*curlun;
+
+	unsigned int		bulk_out_maxpacket;
+	enum fsg_state		state;		/* For exception handling */
+	unsigned int		exception_req_tag;
+
+	u8			config, new_config;
+	enum data_direction	data_dir;
+	u32			data_size;
+	u32			data_size_from_cmnd;
+	u32			tag;
+	u32			residue;
+	u32			usb_amount_left;
+
+	unsigned int		can_stall:1;
+	unsigned int		free_storage_on_release:1;
+	unsigned int		phase_error:1;
+	unsigned int		short_packet_received:1;
+	unsigned int		bad_lun_okay:1;
+	unsigned int		running:1;
+
+	int			thread_wakeup_needed;
+	struct completion	thread_notifier;
+	struct task_struct	*thread_task;
+
+	/* Callback function to call when thread exits. */
+	void			(*thread_exits)(struct fsg_common *common);
+	/* Gadget's private data. */
+	void			*private_data;
+
+	/* Vendor (8 chars), product (16 chars), release (4
+	 * hexadecimal digits) and NUL byte */
+	char inquiry_string[8 + 16 + 4 + 1];
+
+	struct kref		ref;
+};
+
+
+struct fsg_config {
+	unsigned nluns;
+	struct fsg_lun_config {
+		const char *filename;
+		char ro;
+		char removable;
+		char cdrom;
+	} luns[FSG_MAX_LUNS];
+
+	const char		*lun_name_format;
+	const char		*thread_name;
+
+	/* Callback function to call when thread exits. */
+	void			(*thread_exits)(struct fsg_common *common);
+	/* Gadget's private data. */
+	void			*private_data;
+
+	const char *vendor_name;		/*  8 characters or less */
+	const char *product_name;		/* 16 characters or less */
+	u16 release;
+
+	char			can_stall;
+};
+
+
+struct fsg_dev {
+	struct usb_function	function;
+	struct usb_gadget	*gadget;	/* Copy of cdev->gadget */
+	struct fsg_common	*common;
+
+	u16			interface_number;
+
+	unsigned int		bulk_in_enabled:1;
+	unsigned int		bulk_out_enabled:1;
+
+	unsigned long		atomic_bitflags;
+#define IGNORE_BULK_OUT		0
+
+	struct usb_ep		*bulk_in;
+	struct usb_ep		*bulk_out;
+};
+
+
+static inline int __fsg_is_set(struct fsg_common *common,
+			       const char *func, unsigned line)
+{
+	if (common->fsg)
+		return 1;
+	ERROR(common, "common->fsg is NULL in %s at %u\n", func, line);
+	return 0;
+}
+
+#define fsg_is_set(common) likely(__fsg_is_set(common, __func__, __LINE__))
+
+
+static inline struct fsg_dev *fsg_from_func(struct usb_function *f)
+{
+	return container_of(f, struct fsg_dev, function);
+}
+
+
+typedef void (*fsg_routine_t)(struct fsg_dev *);
+
+static int exception_in_progress(struct fsg_common *common)
+{
+	return common->state > FSG_STATE_IDLE;
+}
+
+/* Make bulk-out requests be divisible by the maxpacket size */
+static void set_bulk_out_req_length(struct fsg_common *common,
+		struct fsg_buffhd *bh, unsigned int length)
+{
+	unsigned int	rem;
+
+	bh->bulk_out_intended_length = length;
+	rem = length % common->bulk_out_maxpacket;
+	if (rem > 0)
+		length += common->bulk_out_maxpacket - rem;
+	bh->outreq->length = length;
+}
+
+/*-------------------------------------------------------------------------*/
+
+static int fsg_set_halt(struct fsg_dev *fsg, struct usb_ep *ep)
+{
+	const char	*name;
+
+	if (ep == fsg->bulk_in)
+		name = "bulk-in";
+	else if (ep == fsg->bulk_out)
+		name = "bulk-out";
+	else
+		name = ep->name;
+	DBG(fsg, "%s set halt\n", name);
+	return usb_ep_set_halt(ep);
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/* These routines may be called in process context or in_irq */
+
+/* Caller must hold fsg->lock */
+static void wakeup_thread(struct fsg_common *common)
+{
+	/* Tell the main thread that something has happened */
+	common->thread_wakeup_needed = 1;
+	if (common->thread_task)
+		wake_up_process(common->thread_task);
+}
+
+
+static void raise_exception(struct fsg_common *common, enum fsg_state new_state)
+{
+	unsigned long		flags;
+
+	/* Do nothing if a higher-priority exception is already in progress.
+	 * If a lower-or-equal priority exception is in progress, preempt it
+	 * and notify the main thread by sending it a signal. */
+	spin_lock_irqsave(&common->lock, flags);
+	if (common->state <= new_state) {
+		common->exception_req_tag = common->ep0_req_tag;
+		common->state = new_state;
+		if (common->thread_task)
+			send_sig_info(SIGUSR1, SEND_SIG_FORCED,
+				      common->thread_task);
+	}
+	spin_unlock_irqrestore(&common->lock, flags);
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static int ep0_queue(struct fsg_common *common)
+{
+	int	rc;
+
+	rc = usb_ep_queue(common->ep0, common->ep0req, GFP_ATOMIC);
+	common->ep0->driver_data = common;
+	if (rc != 0 && rc != -ESHUTDOWN) {
+		/* We can't do much more than wait for a reset */
+		WARNING(common, "error in submission: %s --> %d\n",
+			common->ep0->name, rc);
+	}
+	return rc;
+}
+
+/*-------------------------------------------------------------------------*/
+
+/* Bulk and interrupt endpoint completion handlers.
+ * These always run in_irq. */
+
+static void bulk_in_complete(struct usb_ep *ep, struct usb_request *req)
+{
+	struct fsg_common	*common = ep->driver_data;
+	struct fsg_buffhd	*bh = req->context;
+
+	if (req->status || req->actual != req->length)
+		DBG(common, "%s --> %d, %u/%u\n", __func__,
+				req->status, req->actual, req->length);
+	if (req->status == -ECONNRESET)		/* Request was cancelled */
+		usb_ep_fifo_flush(ep);
+
+	/* Hold the lock while we update the request and buffer states */
+	smp_wmb();
+	spin_lock(&common->lock);
+	bh->inreq_busy = 0;
+	bh->state = BUF_STATE_EMPTY;
+	wakeup_thread(common);
+	spin_unlock(&common->lock);
+}
+
+static void bulk_out_complete(struct usb_ep *ep, struct usb_request *req)
+{
+	struct fsg_common	*common = ep->driver_data;
+	struct fsg_buffhd	*bh = req->context;
+
+	dump_msg(common, "bulk-out", req->buf, req->actual);
+	if (req->status || req->actual != bh->bulk_out_intended_length)
+		DBG(common, "%s --> %d, %u/%u\n", __func__,
+				req->status, req->actual,
+				bh->bulk_out_intended_length);
+	if (req->status == -ECONNRESET)		/* Request was cancelled */
+		usb_ep_fifo_flush(ep);
+
+	/* Hold the lock while we update the request and buffer states */
+	smp_wmb();
+	spin_lock(&common->lock);
+	bh->outreq_busy = 0;
+	bh->state = BUF_STATE_FULL;
+	wakeup_thread(common);
+	spin_unlock(&common->lock);
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/* Ep0 class-specific handlers.  These always run in_irq. */
+
+static int fsg_setup(struct usb_function *f,
+		const struct usb_ctrlrequest *ctrl)
+{
+	struct fsg_dev		*fsg = fsg_from_func(f);
+	struct usb_request	*req = fsg->common->ep0req;
+	u16			w_index = le16_to_cpu(ctrl->wIndex);
+	u16			w_value = le16_to_cpu(ctrl->wValue);
+	u16			w_length = le16_to_cpu(ctrl->wLength);
+
+	if (!fsg->common->config)
+		return -EOPNOTSUPP;
+
+	switch (ctrl->bRequest) {
+
+	case USB_BULK_RESET_REQUEST:
+		if (ctrl->bRequestType !=
+		    (USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE))
+			break;
+		if (w_index != fsg->interface_number || w_value != 0)
+			return -EDOM;
+
+		/* Raise an exception to stop the current operation
+		 * and reinitialize our state. */
+		DBG(fsg, "bulk reset request\n");
+		raise_exception(fsg->common, FSG_STATE_RESET);
+		return DELAYED_STATUS;
+
+	case USB_BULK_GET_MAX_LUN_REQUEST:
+		if (ctrl->bRequestType !=
+		    (USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE))
+			break;
+		if (w_index != fsg->interface_number || w_value != 0)
+			return -EDOM;
+		VDBG(fsg, "get max LUN\n");
+		*(u8 *) req->buf = fsg->common->nluns - 1;
+		return 1;
+	}
+
+	VDBG(fsg,
+	     "unknown class-specific control req "
+	     "%02x.%02x v%04x i%04x l%u\n",
+	     ctrl->bRequestType, ctrl->bRequest,
+	     le16_to_cpu(ctrl->wValue), w_index, w_length);
+	return -EOPNOTSUPP;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/* All the following routines run in process context */
+
+
+/* Use this for bulk or interrupt transfers, not ep0 */
+static void start_transfer(struct fsg_dev *fsg, struct usb_ep *ep,
+		struct usb_request *req, int *pbusy,
+		enum fsg_buffer_state *state)
+{
+	int	rc;
+
+	if (ep == fsg->bulk_in)
+		dump_msg(fsg, "bulk-in", req->buf, req->length);
+
+	spin_lock_irq(&fsg->common->lock);
+	*pbusy = 1;
+	*state = BUF_STATE_BUSY;
+	spin_unlock_irq(&fsg->common->lock);
+	rc = usb_ep_queue(ep, req, GFP_KERNEL);
+	if (rc != 0) {
+		*pbusy = 0;
+		*state = BUF_STATE_EMPTY;
+
+		/* We can't do much more than wait for a reset */
+
+		/* Note: currently the net2280 driver fails zero-length
+		 * submissions if DMA is enabled. */
+		if (rc != -ESHUTDOWN && !(rc == -EOPNOTSUPP &&
+						req->length == 0))
+			WARNING(fsg, "error in submission: %s --> %d\n",
+					ep->name, rc);
+	}
+}
+
+#define START_TRANSFER_OR(common, ep_name, req, pbusy, state)		\
+	if (fsg_is_set(common))						\
+		start_transfer((common)->fsg, (common)->fsg->ep_name,	\
+			       req, pbusy, state);			\
+	else
+
+#define START_TRANSFER(common, ep_name, req, pbusy, state)		\
+	START_TRANSFER_OR(common, ep_name, req, pbusy, state) (void)0
+
+
+
+static int sleep_thread(struct fsg_common *common)
+{
+	int	rc = 0;
+
+	/* Wait until a signal arrives or we are woken up */
+	for (;;) {
+		try_to_freeze();
+		set_current_state(TASK_INTERRUPTIBLE);
+		if (signal_pending(current)) {
+			rc = -EINTR;
+			break;
+		}
+		if (common->thread_wakeup_needed)
+			break;
+		schedule();
+	}
+	__set_current_state(TASK_RUNNING);
+	common->thread_wakeup_needed = 0;
+	return rc;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static int do_read(struct fsg_common *common)
+{
+	struct fsg_lun		*curlun = common->curlun;
+	u32			lba;
+	struct fsg_buffhd	*bh;
+	int			rc;
+	u32			amount_left;
+	loff_t			file_offset, file_offset_tmp;
+	unsigned int		amount;
+	unsigned int		partial_page;
+	ssize_t			nread;
+
+	/* Get the starting Logical Block Address and check that it's
+	 * not too big */
+	if (common->cmnd[0] == SC_READ_6)
+		lba = get_unaligned_be24(&common->cmnd[1]);
+	else {
+		lba = get_unaligned_be32(&common->cmnd[2]);
+
+		/* We allow DPO (Disable Page Out = don't save data in the
+		 * cache) and FUA (Force Unit Access = don't read from the
+		 * cache), but we don't implement them. */
+		if ((common->cmnd[1] & ~0x18) != 0) {
+			curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+			return -EINVAL;
+		}
+	}
+	if (lba >= curlun->num_sectors) {
+		curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
+		return -EINVAL;
+	}
+	file_offset = ((loff_t) lba) << 9;
+
+	/* Carry out the file reads */
+	amount_left = common->data_size_from_cmnd;
+	if (unlikely(amount_left == 0))
+		return -EIO;		/* No default reply */
+
+	for (;;) {
+
+		/* Figure out how much we need to read:
+		 * Try to read the remaining amount.
+		 * But don't read more than the buffer size.
+		 * And don't try to read past the end of the file.
+		 * Finally, if we're not at a page boundary, don't read past
+		 *	the next page.
+		 * If this means reading 0 then we were asked to read past
+		 *	the end of file. */
+		amount = min(amount_left, FSG_BUFLEN);
+		amount = min((loff_t) amount,
+				curlun->file_length - file_offset);
+		partial_page = file_offset & (PAGE_CACHE_SIZE - 1);
+		if (partial_page > 0)
+			amount = min(amount, (unsigned int) PAGE_CACHE_SIZE -
+					partial_page);
+
+		/* Wait for the next buffer to become available */
+		bh = common->next_buffhd_to_fill;
+		while (bh->state != BUF_STATE_EMPTY) {
+			rc = sleep_thread(common);
+			if (rc)
+				return rc;
+		}
+
+		/* If we were asked to read past the end of file,
+		 * end with an empty buffer. */
+		if (amount == 0) {
+			curlun->sense_data =
+					SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
+			curlun->sense_data_info = file_offset >> 9;
+			curlun->info_valid = 1;
+			bh->inreq->length = 0;
+			bh->state = BUF_STATE_FULL;
+			break;
+		}
+
+		/* Perform the read */
+		file_offset_tmp = file_offset;
+		nread = vfs_read(curlun->filp,
+				(char __user *) bh->buf,
+				amount, &file_offset_tmp);
+		VLDBG(curlun, "file read %u @ %llu -> %d\n", amount,
+				(unsigned long long) file_offset,
+				(int) nread);
+		if (signal_pending(current))
+			return -EINTR;
+
+		if (nread < 0) {
+			LDBG(curlun, "error in file read: %d\n",
+					(int) nread);
+			nread = 0;
+		} else if (nread < amount) {
+			LDBG(curlun, "partial file read: %d/%u\n",
+					(int) nread, amount);
+			nread -= (nread & 511);	/* Round down to a block */
+		}
+		file_offset  += nread;
+		amount_left  -= nread;
+		common->residue -= nread;
+		bh->inreq->length = nread;
+		bh->state = BUF_STATE_FULL;
+
+		/* If an error occurred, report it and its position */
+		if (nread < amount) {
+			curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
+			curlun->sense_data_info = file_offset >> 9;
+			curlun->info_valid = 1;
+			break;
+		}
+
+		if (amount_left == 0)
+			break;		/* No more left to read */
+
+		/* Send this buffer and go read some more */
+		bh->inreq->zero = 0;
+		START_TRANSFER_OR(common, bulk_in, bh->inreq,
+			       &bh->inreq_busy, &bh->state)
+			/* Don't know what to do if
+			 * common->fsg is NULL */
+			return -EIO;
+		common->next_buffhd_to_fill = bh->next;
+	}
+
+	return -EIO;		/* No default reply */
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static int do_write(struct fsg_common *common)
+{
+	struct fsg_lun		*curlun = common->curlun;
+	u32			lba;
+	struct fsg_buffhd	*bh;
+	int			get_some_more;
+	u32			amount_left_to_req, amount_left_to_write;
+	loff_t			usb_offset, file_offset, file_offset_tmp;
+	unsigned int		amount;
+	unsigned int		partial_page;
+	ssize_t			nwritten;
+	int			rc;
+
+	if (curlun->ro) {
+		curlun->sense_data = SS_WRITE_PROTECTED;
+		return -EINVAL;
+	}
+	spin_lock(&curlun->filp->f_lock);
+	curlun->filp->f_flags &= ~O_SYNC;	/* Default is not to wait */
+	spin_unlock(&curlun->filp->f_lock);
+
+	/* Get the starting Logical Block Address and check that it's
+	 * not too big */
+	if (common->cmnd[0] == SC_WRITE_6)
+		lba = get_unaligned_be24(&common->cmnd[1]);
+	else {
+		lba = get_unaligned_be32(&common->cmnd[2]);
+
+		/* We allow DPO (Disable Page Out = don't save data in the
+		 * cache) and FUA (Force Unit Access = write directly to the
+		 * medium).  We don't implement DPO; we implement FUA by
+		 * performing synchronous output. */
+		if (common->cmnd[1] & ~0x18) {
+			curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+			return -EINVAL;
+		}
+		if (common->cmnd[1] & 0x08) {	/* FUA */
+			spin_lock(&curlun->filp->f_lock);
+			curlun->filp->f_flags |= O_SYNC;
+			spin_unlock(&curlun->filp->f_lock);
+		}
+	}
+	if (lba >= curlun->num_sectors) {
+		curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
+		return -EINVAL;
+	}
+
+	/* Carry out the file writes */
+	get_some_more = 1;
+	file_offset = usb_offset = ((loff_t) lba) << 9;
+	amount_left_to_req = common->data_size_from_cmnd;
+	amount_left_to_write = common->data_size_from_cmnd;
+
+	while (amount_left_to_write > 0) {
+
+		/* Queue a request for more data from the host */
+		bh = common->next_buffhd_to_fill;
+		if (bh->state == BUF_STATE_EMPTY && get_some_more) {
+
+			/* Figure out how much we want to get:
+			 * Try to get the remaining amount.
+			 * But don't get more than the buffer size.
+			 * And don't try to go past the end of the file.
+			 * If we're not at a page boundary,
+			 *	don't go past the next page.
+			 * If this means getting 0, then we were asked
+			 *	to write past the end of file.
+			 * Finally, round down to a block boundary. */
+			amount = min(amount_left_to_req, FSG_BUFLEN);
+			amount = min((loff_t) amount, curlun->file_length -
+					usb_offset);
+			partial_page = usb_offset & (PAGE_CACHE_SIZE - 1);
+			if (partial_page > 0)
+				amount = min(amount,
+	(unsigned int) PAGE_CACHE_SIZE - partial_page);
+
+			if (amount == 0) {
+				get_some_more = 0;
+				curlun->sense_data =
+					SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
+				curlun->sense_data_info = usb_offset >> 9;
+				curlun->info_valid = 1;
+				continue;
+			}
+			amount -= (amount & 511);
+			if (amount == 0) {
+
+				/* Why were we were asked to transfer a
+				 * partial block? */
+				get_some_more = 0;
+				continue;
+			}
+
+			/* Get the next buffer */
+			usb_offset += amount;
+			common->usb_amount_left -= amount;
+			amount_left_to_req -= amount;
+			if (amount_left_to_req == 0)
+				get_some_more = 0;
+
+			/* amount is always divisible by 512, hence by
+			 * the bulk-out maxpacket size */
+			bh->outreq->length = amount;
+			bh->bulk_out_intended_length = amount;
+			bh->outreq->short_not_ok = 1;
+			START_TRANSFER_OR(common, bulk_out, bh->outreq,
+					  &bh->outreq_busy, &bh->state)
+				/* Don't know what to do if
+				 * common->fsg is NULL */
+				return -EIO;
+			common->next_buffhd_to_fill = bh->next;
+			continue;
+		}
+
+		/* Write the received data to the backing file */
+		bh = common->next_buffhd_to_drain;
+		if (bh->state == BUF_STATE_EMPTY && !get_some_more)
+			break;			/* We stopped early */
+		if (bh->state == BUF_STATE_FULL) {
+			smp_rmb();
+			common->next_buffhd_to_drain = bh->next;
+			bh->state = BUF_STATE_EMPTY;
+
+			/* Did something go wrong with the transfer? */
+			if (bh->outreq->status != 0) {
+				curlun->sense_data = SS_COMMUNICATION_FAILURE;
+				curlun->sense_data_info = file_offset >> 9;
+				curlun->info_valid = 1;
+				break;
+			}
+
+			amount = bh->outreq->actual;
+			if (curlun->file_length - file_offset < amount) {
+				LERROR(curlun,
+	"write %u @ %llu beyond end %llu\n",
+	amount, (unsigned long long) file_offset,
+	(unsigned long long) curlun->file_length);
+				amount = curlun->file_length - file_offset;
+			}
+
+			/* Perform the write */
+			file_offset_tmp = file_offset;
+			nwritten = vfs_write(curlun->filp,
+					(char __user *) bh->buf,
+					amount, &file_offset_tmp);
+			VLDBG(curlun, "file write %u @ %llu -> %d\n", amount,
+					(unsigned long long) file_offset,
+					(int) nwritten);
+			if (signal_pending(current))
+				return -EINTR;		/* Interrupted! */
+
+			if (nwritten < 0) {
+				LDBG(curlun, "error in file write: %d\n",
+						(int) nwritten);
+				nwritten = 0;
+			} else if (nwritten < amount) {
+				LDBG(curlun, "partial file write: %d/%u\n",
+						(int) nwritten, amount);
+				nwritten -= (nwritten & 511);
+				/* Round down to a block */
+			}
+			file_offset += nwritten;
+			amount_left_to_write -= nwritten;
+			common->residue -= nwritten;
+
+			/* If an error occurred, report it and its position */
+			if (nwritten < amount) {
+				curlun->sense_data = SS_WRITE_ERROR;
+				curlun->sense_data_info = file_offset >> 9;
+				curlun->info_valid = 1;
+				break;
+			}
+
+			/* Did the host decide to stop early? */
+			if (bh->outreq->actual != bh->outreq->length) {
+				common->short_packet_received = 1;
+				break;
+			}
+			continue;
+		}
+
+		/* Wait for something to happen */
+		rc = sleep_thread(common);
+		if (rc)
+			return rc;
+	}
+
+	return -EIO;		/* No default reply */
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static int do_synchronize_cache(struct fsg_common *common)
+{
+	struct fsg_lun	*curlun = common->curlun;
+	int		rc;
+
+	/* We ignore the requested LBA and write out all file's
+	 * dirty data buffers. */
+	rc = fsg_lun_fsync_sub(curlun);
+	if (rc)
+		curlun->sense_data = SS_WRITE_ERROR;
+	return 0;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static void invalidate_sub(struct fsg_lun *curlun)
+{
+	struct file	*filp = curlun->filp;
+	struct inode	*inode = filp->f_path.dentry->d_inode;
+	unsigned long	rc;
+
+	rc = invalidate_mapping_pages(inode->i_mapping, 0, -1);
+	VLDBG(curlun, "invalidate_inode_pages -> %ld\n", rc);
+}
+
+static int do_verify(struct fsg_common *common)
+{
+	struct fsg_lun		*curlun = common->curlun;
+	u32			lba;
+	u32			verification_length;
+	struct fsg_buffhd	*bh = common->next_buffhd_to_fill;
+	loff_t			file_offset, file_offset_tmp;
+	u32			amount_left;
+	unsigned int		amount;
+	ssize_t			nread;
+
+	/* Get the starting Logical Block Address and check that it's
+	 * not too big */
+	lba = get_unaligned_be32(&common->cmnd[2]);
+	if (lba >= curlun->num_sectors) {
+		curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
+		return -EINVAL;
+	}
+
+	/* We allow DPO (Disable Page Out = don't save data in the
+	 * cache) but we don't implement it. */
+	if (common->cmnd[1] & ~0x10) {
+		curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+		return -EINVAL;
+	}
+
+	verification_length = get_unaligned_be16(&common->cmnd[7]);
+	if (unlikely(verification_length == 0))
+		return -EIO;		/* No default reply */
+
+	/* Prepare to carry out the file verify */
+	amount_left = verification_length << 9;
+	file_offset = ((loff_t) lba) << 9;
+
+	/* Write out all the dirty buffers before invalidating them */
+	fsg_lun_fsync_sub(curlun);
+	if (signal_pending(current))
+		return -EINTR;
+
+	invalidate_sub(curlun);
+	if (signal_pending(current))
+		return -EINTR;
+
+	/* Just try to read the requested blocks */
+	while (amount_left > 0) {
+
+		/* Figure out how much we need to read:
+		 * Try to read the remaining amount, but not more than
+		 * the buffer size.
+		 * And don't try to read past the end of the file.
+		 * If this means reading 0 then we were asked to read
+		 * past the end of file. */
+		amount = min(amount_left, FSG_BUFLEN);
+		amount = min((loff_t) amount,
+				curlun->file_length - file_offset);
+		if (amount == 0) {
+			curlun->sense_data =
+					SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
+			curlun->sense_data_info = file_offset >> 9;
+			curlun->info_valid = 1;
+			break;
+		}
+
+		/* Perform the read */
+		file_offset_tmp = file_offset;
+		nread = vfs_read(curlun->filp,
+				(char __user *) bh->buf,
+				amount, &file_offset_tmp);
+		VLDBG(curlun, "file read %u @ %llu -> %d\n", amount,
+				(unsigned long long) file_offset,
+				(int) nread);
+		if (signal_pending(current))
+			return -EINTR;
+
+		if (nread < 0) {
+			LDBG(curlun, "error in file verify: %d\n",
+					(int) nread);
+			nread = 0;
+		} else if (nread < amount) {
+			LDBG(curlun, "partial file verify: %d/%u\n",
+					(int) nread, amount);
+			nread -= (nread & 511);	/* Round down to a sector */
+		}
+		if (nread == 0) {
+			curlun->sense_data = SS_UNRECOVERED_READ_ERROR;
+			curlun->sense_data_info = file_offset >> 9;
+			curlun->info_valid = 1;
+			break;
+		}
+		file_offset += nread;
+		amount_left -= nread;
+	}
+	return 0;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static int do_inquiry(struct fsg_common *common, struct fsg_buffhd *bh)
+{
+	struct fsg_lun *curlun = common->curlun;
+	u8	*buf = (u8 *) bh->buf;
+
+	if (!curlun) {		/* Unsupported LUNs are okay */
+		common->bad_lun_okay = 1;
+		memset(buf, 0, 36);
+		buf[0] = 0x7f;		/* Unsupported, no device-type */
+		buf[4] = 31;		/* Additional length */
+		return 36;
+	}
+
+	buf[0] = curlun->cdrom ? TYPE_CDROM : TYPE_DISK;
+	buf[1] = curlun->removable ? 0x80 : 0;
+	buf[2] = 2;		/* ANSI SCSI level 2 */
+	buf[3] = 2;		/* SCSI-2 INQUIRY data format */
+	buf[4] = 31;		/* Additional length */
+	buf[5] = 0;		/* No special options */
+	buf[6] = 0;
+	buf[7] = 0;
+	memcpy(buf + 8, common->inquiry_string, sizeof common->inquiry_string);
+	return 36;
+}
+
+
+static int do_request_sense(struct fsg_common *common, struct fsg_buffhd *bh)
+{
+	struct fsg_lun	*curlun = common->curlun;
+	u8		*buf = (u8 *) bh->buf;
+	u32		sd, sdinfo;
+	int		valid;
+
+	/*
+	 * From the SCSI-2 spec., section 7.9 (Unit attention condition):
+	 *
+	 * If a REQUEST SENSE command is received from an initiator
+	 * with a pending unit attention condition (before the target
+	 * generates the contingent allegiance condition), then the
+	 * target shall either:
+	 *   a) report any pending sense data and preserve the unit
+	 *	attention condition on the logical unit, or,
+	 *   b) report the unit attention condition, may discard any
+	 *	pending sense data, and clear the unit attention
+	 *	condition on the logical unit for that initiator.
+	 *
+	 * FSG normally uses option a); enable this code to use option b).
+	 */
+#if 0
+	if (curlun && curlun->unit_attention_data != SS_NO_SENSE) {
+		curlun->sense_data = curlun->unit_attention_data;
+		curlun->unit_attention_data = SS_NO_SENSE;
+	}
+#endif
+
+	if (!curlun) {		/* Unsupported LUNs are okay */
+		common->bad_lun_okay = 1;
+		sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
+		sdinfo = 0;
+		valid = 0;
+	} else {
+		sd = curlun->sense_data;
+		sdinfo = curlun->sense_data_info;
+		valid = curlun->info_valid << 7;
+		curlun->sense_data = SS_NO_SENSE;
+		curlun->sense_data_info = 0;
+		curlun->info_valid = 0;
+	}
+
+	memset(buf, 0, 18);
+	buf[0] = valid | 0x70;			/* Valid, current error */
+	buf[2] = SK(sd);
+	put_unaligned_be32(sdinfo, &buf[3]);	/* Sense information */
+	buf[7] = 18 - 8;			/* Additional sense length */
+	buf[12] = ASC(sd);
+	buf[13] = ASCQ(sd);
+	return 18;
+}
+
+
+static int do_read_capacity(struct fsg_common *common, struct fsg_buffhd *bh)
+{
+	struct fsg_lun	*curlun = common->curlun;
+	u32		lba = get_unaligned_be32(&common->cmnd[2]);
+	int		pmi = common->cmnd[8];
+	u8		*buf = (u8 *) bh->buf;
+
+	/* Check the PMI and LBA fields */
+	if (pmi > 1 || (pmi == 0 && lba != 0)) {
+		curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+		return -EINVAL;
+	}
+
+	put_unaligned_be32(curlun->num_sectors - 1, &buf[0]);
+						/* Max logical block */
+	put_unaligned_be32(512, &buf[4]);	/* Block length */
+	return 8;
+}
+
+
+static int do_read_header(struct fsg_common *common, struct fsg_buffhd *bh)
+{
+	struct fsg_lun	*curlun = common->curlun;
+	int		msf = common->cmnd[1] & 0x02;
+	u32		lba = get_unaligned_be32(&common->cmnd[2]);
+	u8		*buf = (u8 *) bh->buf;
+
+	if (common->cmnd[1] & ~0x02) {		/* Mask away MSF */
+		curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+		return -EINVAL;
+	}
+	if (lba >= curlun->num_sectors) {
+		curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
+		return -EINVAL;
+	}
+
+	memset(buf, 0, 8);
+	buf[0] = 0x01;		/* 2048 bytes of user data, rest is EC */
+	store_cdrom_address(&buf[4], msf, lba);
+	return 8;
+}
+
+
+static int do_read_toc(struct fsg_common *common, struct fsg_buffhd *bh)
+{
+	struct fsg_lun	*curlun = common->curlun;
+	int		msf = common->cmnd[1] & 0x02;
+	int		start_track = common->cmnd[6];
+	u8		*buf = (u8 *) bh->buf;
+
+	if ((common->cmnd[1] & ~0x02) != 0 ||	/* Mask away MSF */
+			start_track > 1) {
+		curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+		return -EINVAL;
+	}
+
+	memset(buf, 0, 20);
+	buf[1] = (20-2);		/* TOC data length */
+	buf[2] = 1;			/* First track number */
+	buf[3] = 1;			/* Last track number */
+	buf[5] = 0x16;			/* Data track, copying allowed */
+	buf[6] = 0x01;			/* Only track is number 1 */
+	store_cdrom_address(&buf[8], msf, 0);
+
+	buf[13] = 0x16;			/* Lead-out track is data */
+	buf[14] = 0xAA;			/* Lead-out track number */
+	store_cdrom_address(&buf[16], msf, curlun->num_sectors);
+	return 20;
+}
+
+
+static int do_mode_sense(struct fsg_common *common, struct fsg_buffhd *bh)
+{
+	struct fsg_lun	*curlun = common->curlun;
+	int		mscmnd = common->cmnd[0];
+	u8		*buf = (u8 *) bh->buf;
+	u8		*buf0 = buf;
+	int		pc, page_code;
+	int		changeable_values, all_pages;
+	int		valid_page = 0;
+	int		len, limit;
+
+	if ((common->cmnd[1] & ~0x08) != 0) {	/* Mask away DBD */
+		curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+		return -EINVAL;
+	}
+	pc = common->cmnd[2] >> 6;
+	page_code = common->cmnd[2] & 0x3f;
+	if (pc == 3) {
+		curlun->sense_data = SS_SAVING_PARAMETERS_NOT_SUPPORTED;
+		return -EINVAL;
+	}
+	changeable_values = (pc == 1);
+	all_pages = (page_code == 0x3f);
+
+	/* Write the mode parameter header.  Fixed values are: default
+	 * medium type, no cache control (DPOFUA), and no block descriptors.
+	 * The only variable value is the WriteProtect bit.  We will fill in
+	 * the mode data length later. */
+	memset(buf, 0, 8);
+	if (mscmnd == SC_MODE_SENSE_6) {
+		buf[2] = (curlun->ro ? 0x80 : 0x00);		/* WP, DPOFUA */
+		buf += 4;
+		limit = 255;
+	} else {			/* SC_MODE_SENSE_10 */
+		buf[3] = (curlun->ro ? 0x80 : 0x00);		/* WP, DPOFUA */
+		buf += 8;
+		limit = 65535;		/* Should really be FSG_BUFLEN */
+	}
+
+	/* No block descriptors */
+
+	/* The mode pages, in numerical order.  The only page we support
+	 * is the Caching page. */
+	if (page_code == 0x08 || all_pages) {
+		valid_page = 1;
+		buf[0] = 0x08;		/* Page code */
+		buf[1] = 10;		/* Page length */
+		memset(buf+2, 0, 10);	/* None of the fields are changeable */
+
+		if (!changeable_values) {
+			buf[2] = 0x04;	/* Write cache enable, */
+					/* Read cache not disabled */
+					/* No cache retention priorities */
+			put_unaligned_be16(0xffff, &buf[4]);
+					/* Don't disable prefetch */
+					/* Minimum prefetch = 0 */
+			put_unaligned_be16(0xffff, &buf[8]);
+					/* Maximum prefetch */
+			put_unaligned_be16(0xffff, &buf[10]);
+					/* Maximum prefetch ceiling */
+		}
+		buf += 12;
+	}
+
+	/* Check that a valid page was requested and the mode data length
+	 * isn't too long. */
+	len = buf - buf0;
+	if (!valid_page || len > limit) {
+		curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+		return -EINVAL;
+	}
+
+	/*  Store the mode data length */
+	if (mscmnd == SC_MODE_SENSE_6)
+		buf0[0] = len - 1;
+	else
+		put_unaligned_be16(len - 2, buf0);
+	return len;
+}
+
+
+static int do_start_stop(struct fsg_common *common)
+{
+	if (!common->curlun) {
+		return -EINVAL;
+	} else if (!common->curlun->removable) {
+		common->curlun->sense_data = SS_INVALID_COMMAND;
+		return -EINVAL;
+	}
+	return 0;
+}
+
+
+static int do_prevent_allow(struct fsg_common *common)
+{
+	struct fsg_lun	*curlun = common->curlun;
+	int		prevent;
+
+	if (!common->curlun) {
+		return -EINVAL;
+	} else if (!common->curlun->removable) {
+		common->curlun->sense_data = SS_INVALID_COMMAND;
+		return -EINVAL;
+	}
+
+	prevent = common->cmnd[4] & 0x01;
+	if ((common->cmnd[4] & ~0x01) != 0) {	/* Mask away Prevent */
+		curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+		return -EINVAL;
+	}
+
+	if (curlun->prevent_medium_removal && !prevent)
+		fsg_lun_fsync_sub(curlun);
+	curlun->prevent_medium_removal = prevent;
+	return 0;
+}
+
+
+static int do_read_format_capacities(struct fsg_common *common,
+			struct fsg_buffhd *bh)
+{
+	struct fsg_lun	*curlun = common->curlun;
+	u8		*buf = (u8 *) bh->buf;
+
+	buf[0] = buf[1] = buf[2] = 0;
+	buf[3] = 8;	/* Only the Current/Maximum Capacity Descriptor */
+	buf += 4;
+
+	put_unaligned_be32(curlun->num_sectors, &buf[0]);
+						/* Number of blocks */
+	put_unaligned_be32(512, &buf[4]);	/* Block length */
+	buf[4] = 0x02;				/* Current capacity */
+	return 12;
+}
+
+
+static int do_mode_select(struct fsg_common *common, struct fsg_buffhd *bh)
+{
+	struct fsg_lun	*curlun = common->curlun;
+
+	/* We don't support MODE SELECT */
+	if (curlun)
+		curlun->sense_data = SS_INVALID_COMMAND;
+	return -EINVAL;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static int halt_bulk_in_endpoint(struct fsg_dev *fsg)
+{
+	int	rc;
+
+	rc = fsg_set_halt(fsg, fsg->bulk_in);
+	if (rc == -EAGAIN)
+		VDBG(fsg, "delayed bulk-in endpoint halt\n");
+	while (rc != 0) {
+		if (rc != -EAGAIN) {
+			WARNING(fsg, "usb_ep_set_halt -> %d\n", rc);
+			rc = 0;
+			break;
+		}
+
+		/* Wait for a short time and then try again */
+		if (msleep_interruptible(100) != 0)
+			return -EINTR;
+		rc = usb_ep_set_halt(fsg->bulk_in);
+	}
+	return rc;
+}
+
+static int wedge_bulk_in_endpoint(struct fsg_dev *fsg)
+{
+	int	rc;
+
+	DBG(fsg, "bulk-in set wedge\n");
+	rc = usb_ep_set_wedge(fsg->bulk_in);
+	if (rc == -EAGAIN)
+		VDBG(fsg, "delayed bulk-in endpoint wedge\n");
+	while (rc != 0) {
+		if (rc != -EAGAIN) {
+			WARNING(fsg, "usb_ep_set_wedge -> %d\n", rc);
+			rc = 0;
+			break;
+		}
+
+		/* Wait for a short time and then try again */
+		if (msleep_interruptible(100) != 0)
+			return -EINTR;
+		rc = usb_ep_set_wedge(fsg->bulk_in);
+	}
+	return rc;
+}
+
+static int pad_with_zeros(struct fsg_dev *fsg)
+{
+	struct fsg_buffhd	*bh = fsg->common->next_buffhd_to_fill;
+	u32			nkeep = bh->inreq->length;
+	u32			nsend;
+	int			rc;
+
+	bh->state = BUF_STATE_EMPTY;		/* For the first iteration */
+	fsg->common->usb_amount_left = nkeep + fsg->common->residue;
+	while (fsg->common->usb_amount_left > 0) {
+
+		/* Wait for the next buffer to be free */
+		while (bh->state != BUF_STATE_EMPTY) {
+			rc = sleep_thread(fsg->common);
+			if (rc)
+				return rc;
+		}
+
+		nsend = min(fsg->common->usb_amount_left, FSG_BUFLEN);
+		memset(bh->buf + nkeep, 0, nsend - nkeep);
+		bh->inreq->length = nsend;
+		bh->inreq->zero = 0;
+		start_transfer(fsg, fsg->bulk_in, bh->inreq,
+				&bh->inreq_busy, &bh->state);
+		bh = fsg->common->next_buffhd_to_fill = bh->next;
+		fsg->common->usb_amount_left -= nsend;
+		nkeep = 0;
+	}
+	return 0;
+}
+
+static int throw_away_data(struct fsg_common *common)
+{
+	struct fsg_buffhd	*bh;
+	u32			amount;
+	int			rc;
+
+	for (bh = common->next_buffhd_to_drain;
+	     bh->state != BUF_STATE_EMPTY || common->usb_amount_left > 0;
+	     bh = common->next_buffhd_to_drain) {
+
+		/* Throw away the data in a filled buffer */
+		if (bh->state == BUF_STATE_FULL) {
+			smp_rmb();
+			bh->state = BUF_STATE_EMPTY;
+			common->next_buffhd_to_drain = bh->next;
+
+			/* A short packet or an error ends everything */
+			if (bh->outreq->actual != bh->outreq->length ||
+					bh->outreq->status != 0) {
+				raise_exception(common,
+						FSG_STATE_ABORT_BULK_OUT);
+				return -EINTR;
+			}
+			continue;
+		}
+
+		/* Try to submit another request if we need one */
+		bh = common->next_buffhd_to_fill;
+		if (bh->state == BUF_STATE_EMPTY
+		 && common->usb_amount_left > 0) {
+			amount = min(common->usb_amount_left, FSG_BUFLEN);
+
+			/* amount is always divisible by 512, hence by
+			 * the bulk-out maxpacket size */
+			bh->outreq->length = amount;
+			bh->bulk_out_intended_length = amount;
+			bh->outreq->short_not_ok = 1;
+			START_TRANSFER_OR(common, bulk_out, bh->outreq,
+					  &bh->outreq_busy, &bh->state)
+				/* Don't know what to do if
+				 * common->fsg is NULL */
+				return -EIO;
+			common->next_buffhd_to_fill = bh->next;
+			common->usb_amount_left -= amount;
+			continue;
+		}
+
+		/* Otherwise wait for something to happen */
+		rc = sleep_thread(common);
+		if (rc)
+			return rc;
+	}
+	return 0;
+}
+
+
+static int finish_reply(struct fsg_common *common)
+{
+	struct fsg_buffhd	*bh = common->next_buffhd_to_fill;
+	int			rc = 0;
+
+	switch (common->data_dir) {
+	case DATA_DIR_NONE:
+		break;			/* Nothing to send */
+
+	/* If we don't know whether the host wants to read or write,
+	 * this must be CB or CBI with an unknown command.  We mustn't
+	 * try to send or receive any data.  So stall both bulk pipes
+	 * if we can and wait for a reset. */
+	case DATA_DIR_UNKNOWN:
+		if (!common->can_stall) {
+			/* Nothing */
+		} else if (fsg_is_set(common)) {
+			fsg_set_halt(common->fsg, common->fsg->bulk_out);
+			rc = halt_bulk_in_endpoint(common->fsg);
+		} else {
+			/* Don't know what to do if common->fsg is NULL */
+			rc = -EIO;
+		}
+		break;
+
+	/* All but the last buffer of data must have already been sent */
+	case DATA_DIR_TO_HOST:
+		if (common->data_size == 0) {
+			/* Nothing to send */
+
+		/* If there's no residue, simply send the last buffer */
+		} else if (common->residue == 0) {
+			bh->inreq->zero = 0;
+			START_TRANSFER_OR(common, bulk_in, bh->inreq,
+					  &bh->inreq_busy, &bh->state)
+				return -EIO;
+			common->next_buffhd_to_fill = bh->next;
+
+		/* For Bulk-only, if we're allowed to stall then send the
+		 * short packet and halt the bulk-in endpoint.  If we can't
+		 * stall, pad out the remaining data with 0's. */
+		} else if (common->can_stall) {
+			bh->inreq->zero = 1;
+			START_TRANSFER_OR(common, bulk_in, bh->inreq,
+					  &bh->inreq_busy, &bh->state)
+				/* Don't know what to do if
+				 * common->fsg is NULL */
+				rc = -EIO;
+			common->next_buffhd_to_fill = bh->next;
+			if (common->fsg)
+				rc = halt_bulk_in_endpoint(common->fsg);
+		} else if (fsg_is_set(common)) {
+			rc = pad_with_zeros(common->fsg);
+		} else {
+			/* Don't know what to do if common->fsg is NULL */
+			rc = -EIO;
+		}
+		break;
+
+	/* We have processed all we want from the data the host has sent.
+	 * There may still be outstanding bulk-out requests. */
+	case DATA_DIR_FROM_HOST:
+		if (common->residue == 0) {
+			/* Nothing to receive */
+
+		/* Did the host stop sending unexpectedly early? */
+		} else if (common->short_packet_received) {
+			raise_exception(common, FSG_STATE_ABORT_BULK_OUT);
+			rc = -EINTR;
+
+		/* We haven't processed all the incoming data.  Even though
+		 * we may be allowed to stall, doing so would cause a race.
+		 * The controller may already have ACK'ed all the remaining
+		 * bulk-out packets, in which case the host wouldn't see a
+		 * STALL.  Not realizing the endpoint was halted, it wouldn't
+		 * clear the halt -- leading to problems later on. */
+#if 0
+		} else if (common->can_stall) {
+			if (fsg_is_set(common))
+				fsg_set_halt(common->fsg,
+					     common->fsg->bulk_out);
+			raise_exception(common, FSG_STATE_ABORT_BULK_OUT);
+			rc = -EINTR;
+#endif
+
+		/* We can't stall.  Read in the excess data and throw it
+		 * all away. */
+		} else {
+			rc = throw_away_data(common);
+		}
+		break;
+	}
+	return rc;
+}
+
+
+static int send_status(struct fsg_common *common)
+{
+	struct fsg_lun		*curlun = common->curlun;
+	struct fsg_buffhd	*bh;
+	struct bulk_cs_wrap	*csw;
+	int			rc;
+	u8			status = USB_STATUS_PASS;
+	u32			sd, sdinfo = 0;
+
+	/* Wait for the next buffer to become available */
+	bh = common->next_buffhd_to_fill;
+	while (bh->state != BUF_STATE_EMPTY) {
+		rc = sleep_thread(common);
+		if (rc)
+			return rc;
+	}
+
+	if (curlun) {
+		sd = curlun->sense_data;
+		sdinfo = curlun->sense_data_info;
+	} else if (common->bad_lun_okay)
+		sd = SS_NO_SENSE;
+	else
+		sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
+
+	if (common->phase_error) {
+		DBG(common, "sending phase-error status\n");
+		status = USB_STATUS_PHASE_ERROR;
+		sd = SS_INVALID_COMMAND;
+	} else if (sd != SS_NO_SENSE) {
+		DBG(common, "sending command-failure status\n");
+		status = USB_STATUS_FAIL;
+		VDBG(common, "  sense data: SK x%02x, ASC x%02x, ASCQ x%02x;"
+				"  info x%x\n",
+				SK(sd), ASC(sd), ASCQ(sd), sdinfo);
+	}
+
+	/* Store and send the Bulk-only CSW */
+	csw = (void *)bh->buf;
+
+	csw->Signature = cpu_to_le32(USB_BULK_CS_SIG);
+	csw->Tag = common->tag;
+	csw->Residue = cpu_to_le32(common->residue);
+	csw->Status = status;
+
+	bh->inreq->length = USB_BULK_CS_WRAP_LEN;
+	bh->inreq->zero = 0;
+	START_TRANSFER_OR(common, bulk_in, bh->inreq,
+			  &bh->inreq_busy, &bh->state)
+		/* Don't know what to do if common->fsg is NULL */
+		return -EIO;
+
+	common->next_buffhd_to_fill = bh->next;
+	return 0;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/* Check whether the command is properly formed and whether its data size
+ * and direction agree with the values we already have. */
+static int check_command(struct fsg_common *common, int cmnd_size,
+		enum data_direction data_dir, unsigned int mask,
+		int needs_medium, const char *name)
+{
+	int			i;
+	int			lun = common->cmnd[1] >> 5;
+	static const char	dirletter[4] = {'u', 'o', 'i', 'n'};
+	char			hdlen[20];
+	struct fsg_lun		*curlun;
+
+	hdlen[0] = 0;
+	if (common->data_dir != DATA_DIR_UNKNOWN)
+		sprintf(hdlen, ", H%c=%u", dirletter[(int) common->data_dir],
+				common->data_size);
+	VDBG(common, "SCSI command: %s;  Dc=%d, D%c=%u;  Hc=%d%s\n",
+	     name, cmnd_size, dirletter[(int) data_dir],
+	     common->data_size_from_cmnd, common->cmnd_size, hdlen);
+
+	/* We can't reply at all until we know the correct data direction
+	 * and size. */
+	if (common->data_size_from_cmnd == 0)
+		data_dir = DATA_DIR_NONE;
+	if (common->data_size < common->data_size_from_cmnd) {
+		/* Host data size < Device data size is a phase error.
+		 * Carry out the command, but only transfer as much as
+		 * we are allowed. */
+		common->data_size_from_cmnd = common->data_size;
+		common->phase_error = 1;
+	}
+	common->residue = common->data_size;
+	common->usb_amount_left = common->data_size;
+
+	/* Conflicting data directions is a phase error */
+	if (common->data_dir != data_dir
+	 && common->data_size_from_cmnd > 0) {
+		common->phase_error = 1;
+		return -EINVAL;
+	}
+
+	/* Verify the length of the command itself */
+	if (cmnd_size != common->cmnd_size) {
+
+		/* Special case workaround: There are plenty of buggy SCSI
+		 * implementations. Many have issues with cbw->Length
+		 * field passing a wrong command size. For those cases we
+		 * always try to work around the problem by using the length
+		 * sent by the host side provided it is at least as large
+		 * as the correct command length.
+		 * Examples of such cases would be MS-Windows, which issues
+		 * REQUEST SENSE with cbw->Length == 12 where it should
+		 * be 6, and xbox360 issuing INQUIRY, TEST UNIT READY and
+		 * REQUEST SENSE with cbw->Length == 10 where it should
+		 * be 6 as well.
+		 */
+		if (cmnd_size <= common->cmnd_size) {
+			DBG(common, "%s is buggy! Expected length %d "
+			    "but we got %d\n", name,
+			    cmnd_size, common->cmnd_size);
+			cmnd_size = common->cmnd_size;
+		} else {
+			common->phase_error = 1;
+			return -EINVAL;
+		}
+	}
+
+	/* Check that the LUN values are consistent */
+	if (common->lun != lun)
+		DBG(common, "using LUN %d from CBW, not LUN %d from CDB\n",
+		    common->lun, lun);
+
+	/* Check the LUN */
+	if (common->lun >= 0 && common->lun < common->nluns) {
+		curlun = &common->luns[common->lun];
+		common->curlun = curlun;
+		if (common->cmnd[0] != SC_REQUEST_SENSE) {
+			curlun->sense_data = SS_NO_SENSE;
+			curlun->sense_data_info = 0;
+			curlun->info_valid = 0;
+		}
+	} else {
+		common->curlun = NULL;
+		curlun = NULL;
+		common->bad_lun_okay = 0;
+
+		/* INQUIRY and REQUEST SENSE commands are explicitly allowed
+		 * to use unsupported LUNs; all others may not. */
+		if (common->cmnd[0] != SC_INQUIRY &&
+		    common->cmnd[0] != SC_REQUEST_SENSE) {
+			DBG(common, "unsupported LUN %d\n", common->lun);
+			return -EINVAL;
+		}
+	}
+
+	/* If a unit attention condition exists, only INQUIRY and
+	 * REQUEST SENSE commands are allowed; anything else must fail. */
+	if (curlun && curlun->unit_attention_data != SS_NO_SENSE &&
+			common->cmnd[0] != SC_INQUIRY &&
+			common->cmnd[0] != SC_REQUEST_SENSE) {
+		curlun->sense_data = curlun->unit_attention_data;
+		curlun->unit_attention_data = SS_NO_SENSE;
+		return -EINVAL;
+	}
+
+	/* Check that only command bytes listed in the mask are non-zero */
+	common->cmnd[1] &= 0x1f;			/* Mask away the LUN */
+	for (i = 1; i < cmnd_size; ++i) {
+		if (common->cmnd[i] && !(mask & (1 << i))) {
+			if (curlun)
+				curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
+			return -EINVAL;
+		}
+	}
+
+	/* If the medium isn't mounted and the command needs to access
+	 * it, return an error. */
+	if (curlun && !fsg_lun_is_open(curlun) && needs_medium) {
+		curlun->sense_data = SS_MEDIUM_NOT_PRESENT;
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+
+static int do_scsi_command(struct fsg_common *common)
+{
+	struct fsg_buffhd	*bh;
+	int			rc;
+	int			reply = -EINVAL;
+	int			i;
+	static char		unknown[16];
+
+	dump_cdb(common);
+
+	/* Wait for the next buffer to become available for data or status */
+	bh = common->next_buffhd_to_fill;
+	common->next_buffhd_to_drain = bh;
+	while (bh->state != BUF_STATE_EMPTY) {
+		rc = sleep_thread(common);
+		if (rc)
+			return rc;
+	}
+	common->phase_error = 0;
+	common->short_packet_received = 0;
+
+	down_read(&common->filesem);	/* We're using the backing file */
+	switch (common->cmnd[0]) {
+
+	case SC_INQUIRY:
+		common->data_size_from_cmnd = common->cmnd[4];
+		reply = check_command(common, 6, DATA_DIR_TO_HOST,
+				      (1<<4), 0,
+				      "INQUIRY");
+		if (reply == 0)
+			reply = do_inquiry(common, bh);
+		break;
+
+	case SC_MODE_SELECT_6:
+		common->data_size_from_cmnd = common->cmnd[4];
+		reply = check_command(common, 6, DATA_DIR_FROM_HOST,
+				      (1<<1) | (1<<4), 0,
+				      "MODE SELECT(6)");
+		if (reply == 0)
+			reply = do_mode_select(common, bh);
+		break;
+
+	case SC_MODE_SELECT_10:
+		common->data_size_from_cmnd =
+			get_unaligned_be16(&common->cmnd[7]);
+		reply = check_command(common, 10, DATA_DIR_FROM_HOST,
+				      (1<<1) | (3<<7), 0,
+				      "MODE SELECT(10)");
+		if (reply == 0)
+			reply = do_mode_select(common, bh);
+		break;
+
+	case SC_MODE_SENSE_6:
+		common->data_size_from_cmnd = common->cmnd[4];
+		reply = check_command(common, 6, DATA_DIR_TO_HOST,
+				      (1<<1) | (1<<2) | (1<<4), 0,
+				      "MODE SENSE(6)");
+		if (reply == 0)
+			reply = do_mode_sense(common, bh);
+		break;
+
+	case SC_MODE_SENSE_10:
+		common->data_size_from_cmnd =
+			get_unaligned_be16(&common->cmnd[7]);
+		reply = check_command(common, 10, DATA_DIR_TO_HOST,
+				      (1<<1) | (1<<2) | (3<<7), 0,
+				      "MODE SENSE(10)");
+		if (reply == 0)
+			reply = do_mode_sense(common, bh);
+		break;
+
+	case SC_PREVENT_ALLOW_MEDIUM_REMOVAL:
+		common->data_size_from_cmnd = 0;
+		reply = check_command(common, 6, DATA_DIR_NONE,
+				      (1<<4), 0,
+				      "PREVENT-ALLOW MEDIUM REMOVAL");
+		if (reply == 0)
+			reply = do_prevent_allow(common);
+		break;
+
+	case SC_READ_6:
+		i = common->cmnd[4];
+		common->data_size_from_cmnd = (i == 0 ? 256 : i) << 9;
+		reply = check_command(common, 6, DATA_DIR_TO_HOST,
+				      (7<<1) | (1<<4), 1,
+				      "READ(6)");
+		if (reply == 0)
+			reply = do_read(common);
+		break;
+
+	case SC_READ_10:
+		common->data_size_from_cmnd =
+				get_unaligned_be16(&common->cmnd[7]) << 9;
+		reply = check_command(common, 10, DATA_DIR_TO_HOST,
+				      (1<<1) | (0xf<<2) | (3<<7), 1,
+				      "READ(10)");
+		if (reply == 0)
+			reply = do_read(common);
+		break;
+
+	case SC_READ_12:
+		common->data_size_from_cmnd =
+				get_unaligned_be32(&common->cmnd[6]) << 9;
+		reply = check_command(common, 12, DATA_DIR_TO_HOST,
+				      (1<<1) | (0xf<<2) | (0xf<<6), 1,
+				      "READ(12)");
+		if (reply == 0)
+			reply = do_read(common);
+		break;
+
+	case SC_READ_CAPACITY:
+		common->data_size_from_cmnd = 8;
+		reply = check_command(common, 10, DATA_DIR_TO_HOST,
+				      (0xf<<2) | (1<<8), 1,
+				      "READ CAPACITY");
+		if (reply == 0)
+			reply = do_read_capacity(common, bh);
+		break;
+
+	case SC_READ_HEADER:
+		if (!common->curlun || !common->curlun->cdrom)
+			goto unknown_cmnd;
+		common->data_size_from_cmnd =
+			get_unaligned_be16(&common->cmnd[7]);
+		reply = check_command(common, 10, DATA_DIR_TO_HOST,
+				      (3<<7) | (0x1f<<1), 1,
+				      "READ HEADER");
+		if (reply == 0)
+			reply = do_read_header(common, bh);
+		break;
+
+	case SC_READ_TOC:
+		if (!common->curlun || !common->curlun->cdrom)
+			goto unknown_cmnd;
+		common->data_size_from_cmnd =
+			get_unaligned_be16(&common->cmnd[7]);
+		reply = check_command(common, 10, DATA_DIR_TO_HOST,
+				      (7<<6) | (1<<1), 1,
+				      "READ TOC");
+		if (reply == 0)
+			reply = do_read_toc(common, bh);
+		break;
+
+	case SC_READ_FORMAT_CAPACITIES:
+		common->data_size_from_cmnd =
+			get_unaligned_be16(&common->cmnd[7]);
+		reply = check_command(common, 10, DATA_DIR_TO_HOST,
+				      (3<<7), 1,
+				      "READ FORMAT CAPACITIES");
+		if (reply == 0)
+			reply = do_read_format_capacities(common, bh);
+		break;
+
+	case SC_REQUEST_SENSE:
+		common->data_size_from_cmnd = common->cmnd[4];
+		reply = check_command(common, 6, DATA_DIR_TO_HOST,
+				      (1<<4), 0,
+				      "REQUEST SENSE");
+		if (reply == 0)
+			reply = do_request_sense(common, bh);
+		break;
+
+	case SC_START_STOP_UNIT:
+		common->data_size_from_cmnd = 0;
+		reply = check_command(common, 6, DATA_DIR_NONE,
+				      (1<<1) | (1<<4), 0,
+				      "START-STOP UNIT");
+		if (reply == 0)
+			reply = do_start_stop(common);
+		break;
+
+	case SC_SYNCHRONIZE_CACHE:
+		common->data_size_from_cmnd = 0;
+		reply = check_command(common, 10, DATA_DIR_NONE,
+				      (0xf<<2) | (3<<7), 1,
+				      "SYNCHRONIZE CACHE");
+		if (reply == 0)
+			reply = do_synchronize_cache(common);
+		break;
+
+	case SC_TEST_UNIT_READY:
+		common->data_size_from_cmnd = 0;
+		reply = check_command(common, 6, DATA_DIR_NONE,
+				0, 1,
+				"TEST UNIT READY");
+		break;
+
+	/* Although optional, this command is used by MS-Windows.  We
+	 * support a minimal version: BytChk must be 0. */
+	case SC_VERIFY:
+		common->data_size_from_cmnd = 0;
+		reply = check_command(common, 10, DATA_DIR_NONE,
+				      (1<<1) | (0xf<<2) | (3<<7), 1,
+				      "VERIFY");
+		if (reply == 0)
+			reply = do_verify(common);
+		break;
+
+	case SC_WRITE_6:
+		i = common->cmnd[4];
+		common->data_size_from_cmnd = (i == 0 ? 256 : i) << 9;
+		reply = check_command(common, 6, DATA_DIR_FROM_HOST,
+				      (7<<1) | (1<<4), 1,
+				      "WRITE(6)");
+		if (reply == 0)
+			reply = do_write(common);
+		break;
+
+	case SC_WRITE_10:
+		common->data_size_from_cmnd =
+				get_unaligned_be16(&common->cmnd[7]) << 9;
+		reply = check_command(common, 10, DATA_DIR_FROM_HOST,
+				      (1<<1) | (0xf<<2) | (3<<7), 1,
+				      "WRITE(10)");
+		if (reply == 0)
+			reply = do_write(common);
+		break;
+
+	case SC_WRITE_12:
+		common->data_size_from_cmnd =
+				get_unaligned_be32(&common->cmnd[6]) << 9;
+		reply = check_command(common, 12, DATA_DIR_FROM_HOST,
+				      (1<<1) | (0xf<<2) | (0xf<<6), 1,
+				      "WRITE(12)");
+		if (reply == 0)
+			reply = do_write(common);
+		break;
+
+	/* Some mandatory commands that we recognize but don't implement.
+	 * They don't mean much in this setting.  It's left as an exercise
+	 * for anyone interested to implement RESERVE and RELEASE in terms
+	 * of Posix locks. */
+	case SC_FORMAT_UNIT:
+	case SC_RELEASE:
+	case SC_RESERVE:
+	case SC_SEND_DIAGNOSTIC:
+		/* Fall through */
+
+	default:
+unknown_cmnd:
+		common->data_size_from_cmnd = 0;
+		sprintf(unknown, "Unknown x%02x", common->cmnd[0]);
+		reply = check_command(common, common->cmnd_size,
+				      DATA_DIR_UNKNOWN, 0xff, 0, unknown);
+		if (reply == 0) {
+			common->curlun->sense_data = SS_INVALID_COMMAND;
+			reply = -EINVAL;
+		}
+		break;
+	}
+	up_read(&common->filesem);
+
+	if (reply == -EINTR || signal_pending(current))
+		return -EINTR;
+
+	/* Set up the single reply buffer for finish_reply() */
+	if (reply == -EINVAL)
+		reply = 0;		/* Error reply length */
+	if (reply >= 0 && common->data_dir == DATA_DIR_TO_HOST) {
+		reply = min((u32) reply, common->data_size_from_cmnd);
+		bh->inreq->length = reply;
+		bh->state = BUF_STATE_FULL;
+		common->residue -= reply;
+	}				/* Otherwise it's already set */
+
+	return 0;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static int received_cbw(struct fsg_dev *fsg, struct fsg_buffhd *bh)
+{
+	struct usb_request	*req = bh->outreq;
+	struct fsg_bulk_cb_wrap	*cbw = req->buf;
+	struct fsg_common	*common = fsg->common;
+
+	/* Was this a real packet?  Should it be ignored? */
+	if (req->status || test_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags))
+		return -EINVAL;
+
+	/* Is the CBW valid? */
+	if (req->actual != USB_BULK_CB_WRAP_LEN ||
+			cbw->Signature != cpu_to_le32(
+				USB_BULK_CB_SIG)) {
+		DBG(fsg, "invalid CBW: len %u sig 0x%x\n",
+				req->actual,
+				le32_to_cpu(cbw->Signature));
+
+		/* The Bulk-only spec says we MUST stall the IN endpoint
+		 * (6.6.1), so it's unavoidable.  It also says we must
+		 * retain this state until the next reset, but there's
+		 * no way to tell the controller driver it should ignore
+		 * Clear-Feature(HALT) requests.
+		 *
+		 * We aren't required to halt the OUT endpoint; instead
+		 * we can simply accept and discard any data received
+		 * until the next reset. */
+		wedge_bulk_in_endpoint(fsg);
+		set_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
+		return -EINVAL;
+	}
+
+	/* Is the CBW meaningful? */
+	if (cbw->Lun >= FSG_MAX_LUNS || cbw->Flags & ~USB_BULK_IN_FLAG ||
+			cbw->Length <= 0 || cbw->Length > MAX_COMMAND_SIZE) {
+		DBG(fsg, "non-meaningful CBW: lun = %u, flags = 0x%x, "
+				"cmdlen %u\n",
+				cbw->Lun, cbw->Flags, cbw->Length);
+
+		/* We can do anything we want here, so let's stall the
+		 * bulk pipes if we are allowed to. */
+		if (common->can_stall) {
+			fsg_set_halt(fsg, fsg->bulk_out);
+			halt_bulk_in_endpoint(fsg);
+		}
+		return -EINVAL;
+	}
+
+	/* Save the command for later */
+	common->cmnd_size = cbw->Length;
+	memcpy(common->cmnd, cbw->CDB, common->cmnd_size);
+	if (cbw->Flags & USB_BULK_IN_FLAG)
+		common->data_dir = DATA_DIR_TO_HOST;
+	else
+		common->data_dir = DATA_DIR_FROM_HOST;
+	common->data_size = le32_to_cpu(cbw->DataTransferLength);
+	if (common->data_size == 0)
+		common->data_dir = DATA_DIR_NONE;
+	common->lun = cbw->Lun;
+	common->tag = cbw->Tag;
+	return 0;
+}
+
+
+static int get_next_command(struct fsg_common *common)
+{
+	struct fsg_buffhd	*bh;
+	int			rc = 0;
+
+	/* Wait for the next buffer to become available */
+	bh = common->next_buffhd_to_fill;
+	while (bh->state != BUF_STATE_EMPTY) {
+		rc = sleep_thread(common);
+		if (rc)
+			return rc;
+	}
+
+	/* Queue a request to read a Bulk-only CBW */
+	set_bulk_out_req_length(common, bh, USB_BULK_CB_WRAP_LEN);
+	bh->outreq->short_not_ok = 1;
+	START_TRANSFER_OR(common, bulk_out, bh->outreq,
+			  &bh->outreq_busy, &bh->state)
+		/* Don't know what to do if common->fsg is NULL */
+		return -EIO;
+
+	/* We will drain the buffer in software, which means we
+	 * can reuse it for the next filling.  No need to advance
+	 * next_buffhd_to_fill. */
+
+	/* Wait for the CBW to arrive */
+	while (bh->state != BUF_STATE_FULL) {
+		rc = sleep_thread(common);
+		if (rc)
+			return rc;
+	}
+	smp_rmb();
+	rc = fsg_is_set(common) ? received_cbw(common->fsg, bh) : -EIO;
+	bh->state = BUF_STATE_EMPTY;
+
+	return rc;
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static int enable_endpoint(struct fsg_common *common, struct usb_ep *ep,
+		const struct usb_endpoint_descriptor *d)
+{
+	int	rc;
+
+	ep->driver_data = common;
+	rc = usb_ep_enable(ep, d);
+	if (rc)
+		ERROR(common, "can't enable %s, result %d\n", ep->name, rc);
+	return rc;
+}
+
+static int alloc_request(struct fsg_common *common, struct usb_ep *ep,
+		struct usb_request **preq)
+{
+	*preq = usb_ep_alloc_request(ep, GFP_ATOMIC);
+	if (*preq)
+		return 0;
+	ERROR(common, "can't allocate request for %s\n", ep->name);
+	return -ENOMEM;
+}
+
+/*
+ * Reset interface setting and re-init endpoint state (toggle etc).
+ * Call with altsetting < 0 to disable the interface.  The only other
+ * available altsetting is 0, which enables the interface.
+ */
+static int do_set_interface(struct fsg_common *common, int altsetting)
+{
+	int	rc = 0;
+	int	i;
+	const struct usb_endpoint_descriptor	*d;
+
+	if (common->running)
+		DBG(common, "reset interface\n");
+
+reset:
+	/* Deallocate the requests */
+	if (common->prev_fsg) {
+		struct fsg_dev *fsg = common->prev_fsg;
+
+		for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
+			struct fsg_buffhd *bh = &common->buffhds[i];
+
+			if (bh->inreq) {
+				usb_ep_free_request(fsg->bulk_in, bh->inreq);
+				bh->inreq = NULL;
+			}
+			if (bh->outreq) {
+				usb_ep_free_request(fsg->bulk_out, bh->outreq);
+				bh->outreq = NULL;
+			}
+		}
+
+		/* Disable the endpoints */
+		if (fsg->bulk_in_enabled) {
+			usb_ep_disable(fsg->bulk_in);
+			fsg->bulk_in_enabled = 0;
+		}
+		if (fsg->bulk_out_enabled) {
+			usb_ep_disable(fsg->bulk_out);
+			fsg->bulk_out_enabled = 0;
+		}
+
+		common->prev_fsg = 0;
+	}
+
+	common->running = 0;
+	if (altsetting < 0 || rc != 0)
+		return rc;
+
+	DBG(common, "set interface %d\n", altsetting);
+
+	if (fsg_is_set(common)) {
+		struct fsg_dev *fsg = common->fsg;
+		common->prev_fsg = common->fsg;
+
+		/* Enable the endpoints */
+		d = fsg_ep_desc(common->gadget,
+				&fsg_fs_bulk_in_desc, &fsg_hs_bulk_in_desc);
+		rc = enable_endpoint(common, fsg->bulk_in, d);
+		if (rc)
+			goto reset;
+		fsg->bulk_in_enabled = 1;
+
+		d = fsg_ep_desc(common->gadget,
+				&fsg_fs_bulk_out_desc, &fsg_hs_bulk_out_desc);
+		rc = enable_endpoint(common, fsg->bulk_out, d);
+		if (rc)
+			goto reset;
+		fsg->bulk_out_enabled = 1;
+		common->bulk_out_maxpacket = le16_to_cpu(d->wMaxPacketSize);
+		clear_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
+
+		/* Allocate the requests */
+		for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
+			struct fsg_buffhd	*bh = &common->buffhds[i];
+
+			rc = alloc_request(common, fsg->bulk_in, &bh->inreq);
+			if (rc)
+				goto reset;
+			rc = alloc_request(common, fsg->bulk_out, &bh->outreq);
+			if (rc)
+				goto reset;
+			bh->inreq->buf = bh->outreq->buf = bh->buf;
+			bh->inreq->context = bh->outreq->context = bh;
+			bh->inreq->complete = bulk_in_complete;
+			bh->outreq->complete = bulk_out_complete;
+		}
+
+		common->running = 1;
+		for (i = 0; i < common->nluns; ++i)
+			common->luns[i].unit_attention_data = SS_RESET_OCCURRED;
+		return rc;
+	} else {
+		return -EIO;
+	}
+}
+
+
+/*
+ * Change our operational configuration.  This code must agree with the code
+ * that returns config descriptors, and with interface altsetting code.
+ *
+ * It's also responsible for power management interactions.  Some
+ * configurations might not work with our current power sources.
+ * For now we just assume the gadget is always self-powered.
+ */
+static int do_set_config(struct fsg_common *common, u8 new_config)
+{
+	int	rc = 0;
+
+	/* Disable the single interface */
+	if (common->config != 0) {
+		DBG(common, "reset config\n");
+		common->config = 0;
+		rc = do_set_interface(common, -1);
+	}
+
+	/* Enable the interface */
+	if (new_config != 0) {
+		common->config = new_config;
+		rc = do_set_interface(common, 0);
+		if (rc != 0)
+			common->config = 0;	/* Reset on errors */
+	}
+	return rc;
+}
+
+
+/****************************** ALT CONFIGS ******************************/
+
+
+static int fsg_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
+{
+	struct fsg_dev *fsg = fsg_from_func(f);
+	fsg->common->prev_fsg = fsg->common->fsg;
+	fsg->common->fsg = fsg;
+	fsg->common->new_config = 1;
+	raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
+	return 0;
+}
+
+static void fsg_disable(struct usb_function *f)
+{
+	struct fsg_dev *fsg = fsg_from_func(f);
+	fsg->common->prev_fsg = fsg->common->fsg;
+	fsg->common->fsg = fsg;
+	fsg->common->new_config = 0;
+	raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static void handle_exception(struct fsg_common *common)
+{
+	siginfo_t		info;
+	int			sig;
+	int			i;
+	struct fsg_buffhd	*bh;
+	enum fsg_state		old_state;
+	u8			new_config;
+	struct fsg_lun		*curlun;
+	unsigned int		exception_req_tag;
+	int			rc;
+
+	/* Clear the existing signals.  Anything but SIGUSR1 is converted
+	 * into a high-priority EXIT exception. */
+	for (;;) {
+		sig = dequeue_signal_lock(current, &current->blocked, &info);
+		if (!sig)
+			break;
+		if (sig != SIGUSR1) {
+			if (common->state < FSG_STATE_EXIT)
+				DBG(common, "Main thread exiting on signal\n");
+			raise_exception(common, FSG_STATE_EXIT);
+		}
+	}
+
+	/* Cancel all the pending transfers */
+	if (fsg_is_set(common)) {
+		for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
+			bh = &common->buffhds[i];
+			if (bh->inreq_busy)
+				usb_ep_dequeue(common->fsg->bulk_in, bh->inreq);
+			if (bh->outreq_busy)
+				usb_ep_dequeue(common->fsg->bulk_out,
+					       bh->outreq);
+		}
+
+		/* Wait until everything is idle */
+		for (;;) {
+			int num_active = 0;
+			for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
+				bh = &common->buffhds[i];
+				num_active += bh->inreq_busy + bh->outreq_busy;
+			}
+			if (num_active == 0)
+				break;
+			if (sleep_thread(common))
+				return;
+		}
+
+		/* Clear out the controller's fifos */
+		if (common->fsg->bulk_in_enabled)
+			usb_ep_fifo_flush(common->fsg->bulk_in);
+		if (common->fsg->bulk_out_enabled)
+			usb_ep_fifo_flush(common->fsg->bulk_out);
+	}
+
+	/* Reset the I/O buffer states and pointers, the SCSI
+	 * state, and the exception.  Then invoke the handler. */
+	spin_lock_irq(&common->lock);
+
+	for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
+		bh = &common->buffhds[i];
+		bh->state = BUF_STATE_EMPTY;
+	}
+	common->next_buffhd_to_fill = &common->buffhds[0];
+	common->next_buffhd_to_drain = &common->buffhds[0];
+	exception_req_tag = common->exception_req_tag;
+	new_config = common->new_config;
+	old_state = common->state;
+
+	if (old_state == FSG_STATE_ABORT_BULK_OUT)
+		common->state = FSG_STATE_STATUS_PHASE;
+	else {
+		for (i = 0; i < common->nluns; ++i) {
+			curlun = &common->luns[i];
+			curlun->prevent_medium_removal = 0;
+			curlun->sense_data = SS_NO_SENSE;
+			curlun->unit_attention_data = SS_NO_SENSE;
+			curlun->sense_data_info = 0;
+			curlun->info_valid = 0;
+		}
+		common->state = FSG_STATE_IDLE;
+	}
+	spin_unlock_irq(&common->lock);
+
+	/* Carry out any extra actions required for the exception */
+	switch (old_state) {
+	case FSG_STATE_ABORT_BULK_OUT:
+		send_status(common);
+		spin_lock_irq(&common->lock);
+		if (common->state == FSG_STATE_STATUS_PHASE)
+			common->state = FSG_STATE_IDLE;
+		spin_unlock_irq(&common->lock);
+		break;
+
+	case FSG_STATE_RESET:
+		/* In case we were forced against our will to halt a
+		 * bulk endpoint, clear the halt now.  (The SuperH UDC
+		 * requires this.) */
+		if (!fsg_is_set(common))
+			break;
+		if (test_and_clear_bit(IGNORE_BULK_OUT,
+				       &common->fsg->atomic_bitflags))
+			usb_ep_clear_halt(common->fsg->bulk_in);
+
+		if (common->ep0_req_tag == exception_req_tag)
+			ep0_queue(common);	/* Complete the status stage */
+
+		/* Technically this should go here, but it would only be
+		 * a waste of time.  Ditto for the INTERFACE_CHANGE and
+		 * CONFIG_CHANGE cases. */
+		/* for (i = 0; i < common->nluns; ++i) */
+		/*	common->luns[i].unit_attention_data = */
+		/*		SS_RESET_OCCURRED;  */
+		break;
+
+	case FSG_STATE_CONFIG_CHANGE:
+		rc = do_set_config(common, new_config);
+		if (common->ep0_req_tag != exception_req_tag)
+			break;
+		if (rc != 0) {			/* STALL on errors */
+			DBG(common, "ep0 set halt\n");
+			usb_ep_set_halt(common->ep0);
+		} else {			/* Complete the status stage */
+			ep0_queue(common);
+		}
+		break;
+
+	case FSG_STATE_EXIT:
+	case FSG_STATE_TERMINATED:
+		do_set_config(common, 0);		/* Free resources */
+		spin_lock_irq(&common->lock);
+		common->state = FSG_STATE_TERMINATED;	/* Stop the thread */
+		spin_unlock_irq(&common->lock);
+		break;
+
+	case FSG_STATE_INTERFACE_CHANGE:
+	case FSG_STATE_DISCONNECT:
+	case FSG_STATE_COMMAND_PHASE:
+	case FSG_STATE_DATA_PHASE:
+	case FSG_STATE_STATUS_PHASE:
+	case FSG_STATE_IDLE:
+		break;
+	}
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+static int fsg_main_thread(void *common_)
+{
+	struct fsg_common	*common = common_;
+
+	/* Allow the thread to be killed by a signal, but set the signal mask
+	 * to block everything but INT, TERM, KILL, and USR1. */
+	allow_signal(SIGINT);
+	allow_signal(SIGTERM);
+	allow_signal(SIGKILL);
+	allow_signal(SIGUSR1);
+
+	/* Allow the thread to be frozen */
+	set_freezable();
+
+	/* Arrange for userspace references to be interpreted as kernel
+	 * pointers.  That way we can pass a kernel pointer to a routine
+	 * that expects a __user pointer and it will work okay. */
+	set_fs(get_ds());
+
+	/* The main loop */
+	while (common->state != FSG_STATE_TERMINATED) {
+		if (exception_in_progress(common) || signal_pending(current)) {
+			handle_exception(common);
+			continue;
+		}
+
+		if (!common->running) {
+			sleep_thread(common);
+			continue;
+		}
+
+		if (get_next_command(common))
+			continue;
+
+		spin_lock_irq(&common->lock);
+		if (!exception_in_progress(common))
+			common->state = FSG_STATE_DATA_PHASE;
+		spin_unlock_irq(&common->lock);
+
+		if (do_scsi_command(common) || finish_reply(common))
+			continue;
+
+		spin_lock_irq(&common->lock);
+		if (!exception_in_progress(common))
+			common->state = FSG_STATE_STATUS_PHASE;
+		spin_unlock_irq(&common->lock);
+
+		if (send_status(common))
+			continue;
+
+		spin_lock_irq(&common->lock);
+		if (!exception_in_progress(common))
+			common->state = FSG_STATE_IDLE;
+		spin_unlock_irq(&common->lock);
+	}
+
+	spin_lock_irq(&common->lock);
+	common->thread_task = NULL;
+	spin_unlock_irq(&common->lock);
+
+	if (common->thread_exits)
+		common->thread_exits(common);
+
+	/* Let the unbind and cleanup routines know the thread has exited */
+	complete_and_exit(&common->thread_notifier, 0);
+}
+
+
+/*************************** DEVICE ATTRIBUTES ***************************/
+
+/* Write permission is checked per LUN in store_*() functions. */
+static DEVICE_ATTR(ro, 0644, fsg_show_ro, fsg_store_ro);
+static DEVICE_ATTR(file, 0644, fsg_show_file, fsg_store_file);
+
+
+/****************************** FSG COMMON ******************************/
+
+static void fsg_common_release(struct kref *ref);
+
+static void fsg_lun_release(struct device *dev)
+{
+	/* Nothing needs to be done */
+}
+
+static inline void fsg_common_get(struct fsg_common *common)
+{
+	kref_get(&common->ref);
+}
+
+static inline void fsg_common_put(struct fsg_common *common)
+{
+	kref_put(&common->ref, fsg_common_release);
+}
+
+
+static struct fsg_common *fsg_common_init(struct fsg_common *common,
+					  struct usb_composite_dev *cdev,
+					  struct fsg_config *cfg)
+{
+	struct usb_gadget *gadget = cdev->gadget;
+	struct fsg_buffhd *bh;
+	struct fsg_lun *curlun;
+	struct fsg_lun_config *lcfg;
+	int nluns, i, rc;
+	char *pathbuf;
+
+	/* Find out how many LUNs there should be */
+	nluns = cfg->nluns;
+	if (nluns < 1 || nluns > FSG_MAX_LUNS) {
+		dev_err(&gadget->dev, "invalid number of LUNs: %u\n", nluns);
+		return ERR_PTR(-EINVAL);
+	}
+
+	/* Allocate? */
+	if (!common) {
+		common = kzalloc(sizeof *common, GFP_KERNEL);
+		if (!common)
+			return ERR_PTR(-ENOMEM);
+		common->free_storage_on_release = 1;
+	} else {
+		memset(common, 0, sizeof common);
+		common->free_storage_on_release = 0;
+	}
+
+	common->private_data = cfg->private_data;
+
+	common->gadget = gadget;
+	common->ep0 = gadget->ep0;
+	common->ep0req = cdev->req;
+
+	/* Maybe allocate device-global string IDs, and patch descriptors */
+	if (fsg_strings[FSG_STRING_INTERFACE].id == 0) {
+		rc = usb_string_id(cdev);
+		if (rc < 0) {
+			kfree(common);
+			return ERR_PTR(rc);
+		}
+		fsg_strings[FSG_STRING_INTERFACE].id = rc;
+		fsg_intf_desc.iInterface = rc;
+	}
+
+	/* Create the LUNs, open their backing files, and register the
+	 * LUN devices in sysfs. */
+	curlun = kzalloc(nluns * sizeof *curlun, GFP_KERNEL);
+	if (!curlun) {
+		kfree(common);
+		return ERR_PTR(-ENOMEM);
+	}
+	common->luns = curlun;
+
+	init_rwsem(&common->filesem);
+
+	for (i = 0, lcfg = cfg->luns; i < nluns; ++i, ++curlun, ++lcfg) {
+		curlun->cdrom = !!lcfg->cdrom;
+		curlun->ro = lcfg->cdrom || lcfg->ro;
+		curlun->removable = lcfg->removable;
+		curlun->dev.release = fsg_lun_release;
+		curlun->dev.parent = &gadget->dev;
+		/* curlun->dev.driver = &fsg_driver.driver; XXX */
+		dev_set_drvdata(&curlun->dev, &common->filesem);
+		dev_set_name(&curlun->dev,
+			     cfg->lun_name_format
+			   ? cfg->lun_name_format
+			   : "lun%d",
+			     i);
+
+		rc = device_register(&curlun->dev);
+		if (rc) {
+			INFO(common, "failed to register LUN%d: %d\n", i, rc);
+			common->nluns = i;
+			goto error_release;
+		}
+
+		rc = device_create_file(&curlun->dev, &dev_attr_ro);
+		if (rc)
+			goto error_luns;
+		rc = device_create_file(&curlun->dev, &dev_attr_file);
+		if (rc)
+			goto error_luns;
+
+		if (lcfg->filename) {
+			rc = fsg_lun_open(curlun, lcfg->filename);
+			if (rc)
+				goto error_luns;
+		} else if (!curlun->removable) {
+			ERROR(common, "no file given for LUN%d\n", i);
+			rc = -EINVAL;
+			goto error_luns;
+		}
+	}
+	common->nluns = nluns;
+
+
+	/* Data buffers cyclic list */
+	/* Buffers in buffhds are static -- no need for additional
+	 * allocation. */
+	bh = common->buffhds;
+	i = FSG_NUM_BUFFERS - 1;
+	do {
+		bh->next = bh + 1;
+	} while (++bh, --i);
+	bh->next = common->buffhds;
+
+
+	/* Prepare inquiryString */
+	if (cfg->release != 0xffff) {
+		i = cfg->release;
+	} else {
+		/* The sa1100 controller is not supported */
+		i = gadget_is_sa1100(gadget)
+			? -1
+			: usb_gadget_controller_number(gadget);
+		if (i >= 0) {
+			i = 0x0300 + i;
+		} else {
+			WARNING(common, "controller '%s' not recognized\n",
+				gadget->name);
+			i = 0x0399;
+		}
+	}
+#define OR(x, y) ((x) ? (x) : (y))
+	snprintf(common->inquiry_string, sizeof common->inquiry_string,
+		 "%-8s%-16s%04x",
+		 OR(cfg->vendor_name, "Linux   "),
+		 /* Assume product name dependent on the first LUN */
+		 OR(cfg->product_name, common->luns->cdrom
+				     ? "File-Stor Gadget"
+				     : "File-CD Gadget  "),
+		 i);
+
+
+	/* Some peripheral controllers are known not to be able to
+	 * halt bulk endpoints correctly.  If one of them is present,
+	 * disable stalls.
+	 */
+	common->can_stall = cfg->can_stall &&
+		!(gadget_is_sh(common->gadget) ||
+		  gadget_is_at91(common->gadget));
+
+
+	spin_lock_init(&common->lock);
+	kref_init(&common->ref);
+
+
+	/* Tell the thread to start working */
+	common->thread_exits = cfg->thread_exits;
+	common->thread_task =
+		kthread_create(fsg_main_thread, common,
+			       OR(cfg->thread_name, "file-storage"));
+	if (IS_ERR(common->thread_task)) {
+		rc = PTR_ERR(common->thread_task);
+		goto error_release;
+	}
+	init_completion(&common->thread_notifier);
+#undef OR
+
+
+	/* Information */
+	INFO(common, FSG_DRIVER_DESC ", version: " FSG_DRIVER_VERSION "\n");
+	INFO(common, "Number of LUNs=%d\n", common->nluns);
+
+	pathbuf = kmalloc(PATH_MAX, GFP_KERNEL);
+	for (i = 0, nluns = common->nluns, curlun = common->luns;
+	     i < nluns;
+	     ++curlun, ++i) {
+		char *p = "(no medium)";
+		if (fsg_lun_is_open(curlun)) {
+			p = "(error)";
+			if (pathbuf) {
+				p = d_path(&curlun->filp->f_path,
+					   pathbuf, PATH_MAX);
+				if (IS_ERR(p))
+					p = "(error)";
+			}
+		}
+		LINFO(curlun, "LUN: %s%s%sfile: %s\n",
+		      curlun->removable ? "removable " : "",
+		      curlun->ro ? "read only " : "",
+		      curlun->cdrom ? "CD-ROM " : "",
+		      p);
+	}
+	kfree(pathbuf);
+
+	DBG(common, "I/O thread pid: %d\n", task_pid_nr(common->thread_task));
+
+	wake_up_process(common->thread_task);
+
+	return common;
+
+
+error_luns:
+	common->nluns = i + 1;
+error_release:
+	common->state = FSG_STATE_TERMINATED;	/* The thread is dead */
+	/* Call fsg_common_release() directly, ref might be not
+	 * initialised */
+	fsg_common_release(&common->ref);
+	complete(&common->thread_notifier);
+	return ERR_PTR(rc);
+}
+
+
+static void fsg_common_release(struct kref *ref)
+{
+	struct fsg_common *common =
+		container_of(ref, struct fsg_common, ref);
+	unsigned i = common->nluns;
+	struct fsg_lun *lun = common->luns;
+
+	/* If the thread isn't already dead, tell it to exit now */
+	if (common->state != FSG_STATE_TERMINATED) {
+		raise_exception(common, FSG_STATE_EXIT);
+		wait_for_completion(&common->thread_notifier);
+
+		/* The cleanup routine waits for this completion also */
+		complete(&common->thread_notifier);
+	}
+
+	/* Beware tempting for -> do-while optimization: when in error
+	 * recovery nluns may be zero. */
+
+	for (; i; --i, ++lun) {
+		device_remove_file(&lun->dev, &dev_attr_ro);
+		device_remove_file(&lun->dev, &dev_attr_file);
+		fsg_lun_close(lun);
+		device_unregister(&lun->dev);
+	}
+
+	kfree(common->luns);
+	if (common->free_storage_on_release)
+		kfree(common);
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+
+static void fsg_unbind(struct usb_configuration *c, struct usb_function *f)
+{
+	struct fsg_dev		*fsg = fsg_from_func(f);
+
+	DBG(fsg, "unbind\n");
+	fsg_common_put(fsg->common);
+	kfree(fsg);
+}
+
+
+static int fsg_bind(struct usb_configuration *c, struct usb_function *f)
+{
+	struct fsg_dev		*fsg = fsg_from_func(f);
+	struct usb_gadget	*gadget = c->cdev->gadget;
+	int			rc;
+	int			i;
+	struct usb_ep		*ep;
+
+	fsg->gadget = gadget;
+
+	/* New interface */
+	i = usb_interface_id(c, f);
+	if (i < 0)
+		return i;
+	fsg_intf_desc.bInterfaceNumber = i;
+	fsg->interface_number = i;
+
+	/* Find all the endpoints we will use */
+	ep = usb_ep_autoconfig(gadget, &fsg_fs_bulk_in_desc);
+	if (!ep)
+		goto autoconf_fail;
+	ep->driver_data = fsg->common;	/* claim the endpoint */
+	fsg->bulk_in = ep;
+
+	ep = usb_ep_autoconfig(gadget, &fsg_fs_bulk_out_desc);
+	if (!ep)
+		goto autoconf_fail;
+	ep->driver_data = fsg->common;	/* claim the endpoint */
+	fsg->bulk_out = ep;
+
+	if (gadget_is_dualspeed(gadget)) {
+		/* Assume endpoint addresses are the same for both speeds */
+		fsg_hs_bulk_in_desc.bEndpointAddress =
+			fsg_fs_bulk_in_desc.bEndpointAddress;
+		fsg_hs_bulk_out_desc.bEndpointAddress =
+			fsg_fs_bulk_out_desc.bEndpointAddress;
+		f->hs_descriptors = fsg_hs_function;
+	}
+
+	return 0;
+
+autoconf_fail:
+	ERROR(fsg, "unable to autoconfigure all endpoints\n");
+	rc = -ENOTSUPP;
+	fsg_unbind(c, f);
+	return rc;
+}
+
+
+/****************************** ADD FUNCTION ******************************/
+
+static struct usb_gadget_strings *fsg_strings_array[] = {
+	&fsg_stringtab,
+	NULL,
+};
+
+static int fsg_add(struct usb_composite_dev *cdev,
+		   struct usb_configuration *c,
+		   struct fsg_common *common)
+{
+	struct fsg_dev *fsg;
+	int rc;
+
+	fsg = kzalloc(sizeof *fsg, GFP_KERNEL);
+	if (unlikely(!fsg))
+		return -ENOMEM;
+
+	fsg->function.name        = FSG_DRIVER_DESC;
+	fsg->function.strings     = fsg_strings_array;
+	fsg->function.descriptors = fsg_fs_function;
+	fsg->function.bind        = fsg_bind;
+	fsg->function.unbind      = fsg_unbind;
+	fsg->function.setup       = fsg_setup;
+	fsg->function.set_alt     = fsg_set_alt;
+	fsg->function.disable     = fsg_disable;
+
+	fsg->common               = common;
+	/* Our caller holds a reference to common structure so we
+	 * don't have to be worry about it being freed until we return
+	 * from this function.  So instead of incrementing counter now
+	 * and decrement in error recovery we increment it only when
+	 * call to usb_add_function() was successful. */
+
+	rc = usb_add_function(c, &fsg->function);
+
+	if (likely(rc == 0))
+		fsg_common_get(fsg->common);
+	else
+		kfree(fsg);
+
+	return rc;
+}
+
+
+
+/************************* Module parameters *************************/
+
+
+struct fsg_module_parameters {
+	char		*file[FSG_MAX_LUNS];
+	int		ro[FSG_MAX_LUNS];
+	int		removable[FSG_MAX_LUNS];
+	int		cdrom[FSG_MAX_LUNS];
+
+	unsigned int	file_count, ro_count, removable_count, cdrom_count;
+	unsigned int	luns;	/* nluns */
+	int		stall;	/* can_stall */
+};
+
+
+#define _FSG_MODULE_PARAM_ARRAY(prefix, params, name, type, desc)	\
+	module_param_array_named(prefix ## name, params.name, type,	\
+				 &prefix ## params.name ## _count,	\
+				 S_IRUGO);				\
+	MODULE_PARM_DESC(prefix ## name, desc)
+
+#define _FSG_MODULE_PARAM(prefix, params, name, type, desc)		\
+	module_param_named(prefix ## name, params.name, type,		\
+			   S_IRUGO);					\
+	MODULE_PARM_DESC(prefix ## name, desc)
+
+#define FSG_MODULE_PARAMETERS(prefix, params)				\
+	_FSG_MODULE_PARAM_ARRAY(prefix, params, file, charp,		\
+				"names of backing files or devices");	\
+	_FSG_MODULE_PARAM_ARRAY(prefix, params, ro, bool,		\
+				"true to force read-only");		\
+	_FSG_MODULE_PARAM_ARRAY(prefix, params, removable, bool,	\
+				"true to simulate removable media");	\
+	_FSG_MODULE_PARAM_ARRAY(prefix, params, cdrom, bool,		\
+				"true to simulate CD-ROM instead of disk"); \
+	_FSG_MODULE_PARAM(prefix, params, luns, uint,			\
+			  "number of LUNs");				\
+	_FSG_MODULE_PARAM(prefix, params, stall, bool,			\
+			  "false to prevent bulk stalls")
+
+
+static void
+fsg_config_from_params(struct fsg_config *cfg,
+		       const struct fsg_module_parameters *params)
+{
+	struct fsg_lun_config *lun;
+	unsigned i;
+
+	/* Configure LUNs */
+	cfg->nluns =
+		min(params->luns ?: (params->file_count ?: 1u),
+		    (unsigned)FSG_MAX_LUNS);
+	for (i = 0, lun = cfg->luns; i < cfg->nluns; ++i, ++lun) {
+		lun->ro = !!params->ro[i];
+		lun->cdrom = !!params->cdrom[i];
+		lun->removable = /* Removable by default */
+			params->removable_count <= i || params->removable[i];
+		lun->filename =
+			params->file_count > i && params->file[i][0]
+			? params->file[i]
+			: 0;
+	}
+
+	/* Let MSF use defaults */
+	cfg->lun_name_format = 0;
+	cfg->thread_name = 0;
+	cfg->vendor_name = 0;
+	cfg->product_name = 0;
+	cfg->release = 0xffff;
+
+	cfg->thread_exits = 0;
+	cfg->private_data = 0;
+
+	/* Finalise */
+	cfg->can_stall = params->stall;
+}
+
+static inline struct fsg_common *
+fsg_common_from_params(struct fsg_common *common,
+		       struct usb_composite_dev *cdev,
+		       const struct fsg_module_parameters *params)
+	__attribute__((unused));
+static inline struct fsg_common *
+fsg_common_from_params(struct fsg_common *common,
+		       struct usb_composite_dev *cdev,
+		       const struct fsg_module_parameters *params)
+{
+	struct fsg_config cfg;
+	fsg_config_from_params(&cfg, params);
+	return fsg_common_init(common, cdev, &cfg);
+}
+
diff --git a/drivers/usb/gadget/f_rndis.c b/drivers/usb/gadget/f_rndis.c
index c9966cc07d3a..95dae4c1ea40 100644
--- a/drivers/usb/gadget/f_rndis.c
+++ b/drivers/usb/gadget/f_rndis.c
@@ -4,6 +4,8 @@
  * Copyright (C) 2003-2005,2008 David Brownell
  * Copyright (C) 2003-2004 Robert Schwebel, Benedikt Spranger
  * Copyright (C) 2008 Nokia Corporation
+ * Copyright (C) 2009 Samsung Electronics
+ *                    Author: Michal Nazarewicz (m.nazarewicz@samsung.com)
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -149,8 +151,8 @@ static struct usb_cdc_call_mgmt_descriptor call_mgmt_descriptor __initdata = {
 	.bDataInterface =	0x01,
 };
 
-static struct usb_cdc_acm_descriptor acm_descriptor __initdata = {
-	.bLength =		sizeof acm_descriptor,
+static struct usb_cdc_acm_descriptor rndis_acm_descriptor __initdata = {
+	.bLength =		sizeof rndis_acm_descriptor,
 	.bDescriptorType =	USB_DT_CS_INTERFACE,
 	.bDescriptorSubType =	USB_CDC_ACM_TYPE,
 
@@ -179,6 +181,20 @@ static struct usb_interface_descriptor rndis_data_intf __initdata = {
 	/* .iInterface = DYNAMIC */
 };
 
+
+static struct usb_interface_assoc_descriptor
+rndis_iad_descriptor = {
+	.bLength =		sizeof rndis_iad_descriptor,
+	.bDescriptorType =	USB_DT_INTERFACE_ASSOCIATION,
+
+	.bFirstInterface =	0, /* XXX, hardcoded */
+	.bInterfaceCount = 	2,	// control + data
+	.bFunctionClass =	USB_CLASS_COMM,
+	.bFunctionSubClass =	USB_CDC_SUBCLASS_ETHERNET,
+	.bFunctionProtocol =	USB_CDC_PROTO_NONE,
+	/* .iFunction = DYNAMIC */
+};
+
 /* full speed support: */
 
 static struct usb_endpoint_descriptor fs_notify_desc __initdata = {
@@ -208,11 +224,12 @@ static struct usb_endpoint_descriptor fs_out_desc __initdata = {
 };
 
 static struct usb_descriptor_header *eth_fs_function[] __initdata = {
+	(struct usb_descriptor_header *) &rndis_iad_descriptor,
 	/* control interface matches ACM, not Ethernet */
 	(struct usb_descriptor_header *) &rndis_control_intf,
 	(struct usb_descriptor_header *) &header_desc,
 	(struct usb_descriptor_header *) &call_mgmt_descriptor,
-	(struct usb_descriptor_header *) &acm_descriptor,
+	(struct usb_descriptor_header *) &rndis_acm_descriptor,
 	(struct usb_descriptor_header *) &rndis_union_desc,
 	(struct usb_descriptor_header *) &fs_notify_desc,
 	/* data interface has no altsetting */
@@ -252,11 +269,12 @@ static struct usb_endpoint_descriptor hs_out_desc __initdata = {
 };
 
 static struct usb_descriptor_header *eth_hs_function[] __initdata = {
+	(struct usb_descriptor_header *) &rndis_iad_descriptor,
 	/* control interface matches ACM, not Ethernet */
 	(struct usb_descriptor_header *) &rndis_control_intf,
 	(struct usb_descriptor_header *) &header_desc,
 	(struct usb_descriptor_header *) &call_mgmt_descriptor,
-	(struct usb_descriptor_header *) &acm_descriptor,
+	(struct usb_descriptor_header *) &rndis_acm_descriptor,
 	(struct usb_descriptor_header *) &rndis_union_desc,
 	(struct usb_descriptor_header *) &hs_notify_desc,
 	/* data interface has no altsetting */
@@ -271,6 +289,7 @@ static struct usb_descriptor_header *eth_hs_function[] __initdata = {
 static struct usb_string rndis_string_defs[] = {
 	[0].s = "RNDIS Communications Control",
 	[1].s = "RNDIS Ethernet Data",
+	[2].s = "RNDIS",
 	{  } /* end of list */
 };
 
@@ -587,6 +606,7 @@ rndis_bind(struct usb_configuration *c, struct usb_function *f)
 	if (status < 0)
 		goto fail;
 	rndis->ctrl_id = status;
+	rndis_iad_descriptor.bFirstInterface = status;
 
 	rndis_control_intf.bInterfaceNumber = status;
 	rndis_union_desc.bMasterInterface0 = status;
@@ -798,6 +818,13 @@ int __init rndis_bind_config(struct usb_configuration *c, u8 ethaddr[ETH_ALEN])
 			return status;
 		rndis_string_defs[1].id = status;
 		rndis_data_intf.iInterface = status;
+
+		/* IAD iFunction label */
+		status = usb_string_id(c->cdev);
+		if (status < 0)
+			return status;
+		rndis_string_defs[2].id = status;
+		rndis_iad_descriptor.iFunction = status;
 	}
 
 	/* allocate and initialize one new instance */
diff --git a/drivers/usb/gadget/file_storage.c b/drivers/usb/gadget/file_storage.c
index 1e6aa504d58a..29dfb0277ffb 100644
--- a/drivers/usb/gadget/file_storage.c
+++ b/drivers/usb/gadget/file_storage.c
@@ -248,8 +248,6 @@
 #include <linux/freezer.h>
 #include <linux/utsname.h>
 
-#include <asm/unaligned.h>
-
 #include <linux/usb/ch9.h>
 #include <linux/usb/gadget.h>
 
@@ -274,21 +272,20 @@
 #define DRIVER_NAME		"g_file_storage"
 #define DRIVER_VERSION		"20 November 2008"
 
-static const char longname[] = DRIVER_DESC;
-static const char shortname[] = DRIVER_NAME;
+static       char fsg_string_manufacturer[64];
+static const char fsg_string_product[] = DRIVER_DESC;
+static       char fsg_string_serial[13];
+static const char fsg_string_config[] = "Self-powered";
+static const char fsg_string_interface[] = "Mass Storage";
+
+
+#include "storage_common.c"
+
 
 MODULE_DESCRIPTION(DRIVER_DESC);
 MODULE_AUTHOR("Alan Stern");
 MODULE_LICENSE("Dual BSD/GPL");
 
-/* Thanks to NetChip Technologies for donating this product ID.
- *
- * DO NOT REUSE THESE IDs with any other driver!!  Ever!!
- * Instead:  allocate your own, using normal USB-IF procedures. */
-#define DRIVER_VENDOR_ID	0x0525	// NetChip
-#define DRIVER_PRODUCT_ID	0xa4a5	// Linux-USB File-backed Storage Gadget
-
-
 /*
  * This driver assumes self-powered hardware and has no way for users to
  * trigger remote wakeup.  It uses autoconfiguration to select endpoints
@@ -298,54 +295,12 @@ MODULE_LICENSE("Dual BSD/GPL");
 
 /*-------------------------------------------------------------------------*/
 
-#define LDBG(lun,fmt,args...) \
-	dev_dbg(&(lun)->dev , fmt , ## args)
-#define MDBG(fmt,args...) \
-	pr_debug(DRIVER_NAME ": " fmt , ## args)
-
-#ifndef DEBUG
-#undef VERBOSE_DEBUG
-#undef DUMP_MSGS
-#endif /* !DEBUG */
-
-#ifdef VERBOSE_DEBUG
-#define VLDBG	LDBG
-#else
-#define VLDBG(lun,fmt,args...) \
-	do { } while (0)
-#endif /* VERBOSE_DEBUG */
-
-#define LERROR(lun,fmt,args...) \
-	dev_err(&(lun)->dev , fmt , ## args)
-#define LWARN(lun,fmt,args...) \
-	dev_warn(&(lun)->dev , fmt , ## args)
-#define LINFO(lun,fmt,args...) \
-	dev_info(&(lun)->dev , fmt , ## args)
-
-#define MINFO(fmt,args...) \
-	pr_info(DRIVER_NAME ": " fmt , ## args)
-
-#define DBG(d, fmt, args...) \
-	dev_dbg(&(d)->gadget->dev , fmt , ## args)
-#define VDBG(d, fmt, args...) \
-	dev_vdbg(&(d)->gadget->dev , fmt , ## args)
-#define ERROR(d, fmt, args...) \
-	dev_err(&(d)->gadget->dev , fmt , ## args)
-#define WARNING(d, fmt, args...) \
-	dev_warn(&(d)->gadget->dev , fmt , ## args)
-#define INFO(d, fmt, args...) \
-	dev_info(&(d)->gadget->dev , fmt , ## args)
-
-
-/*-------------------------------------------------------------------------*/
 
 /* Encapsulate the module parameter settings */
 
-#define MAX_LUNS	8
-
 static struct {
-	char		*file[MAX_LUNS];
-	int		ro[MAX_LUNS];
+	char		*file[FSG_MAX_LUNS];
+	int		ro[FSG_MAX_LUNS];
 	unsigned int	num_filenames;
 	unsigned int	num_ros;
 	unsigned int	nluns;
@@ -372,8 +327,8 @@ static struct {
 	.removable		= 0,
 	.can_stall		= 1,
 	.cdrom			= 0,
-	.vendor			= DRIVER_VENDOR_ID,
-	.product		= DRIVER_PRODUCT_ID,
+	.vendor			= FSG_VENDOR_ID,
+	.product		= FSG_PRODUCT_ID,
 	.release		= 0xffff,	// Use controller chip type
 	.buflen			= 16384,
 	};
@@ -425,125 +380,6 @@ MODULE_PARM_DESC(buflen, "I/O buffer size");
 #endif /* CONFIG_USB_FILE_STORAGE_TEST */
 
 
-/*-------------------------------------------------------------------------*/
-
-/* SCSI device types */
-#define TYPE_DISK	0x00
-#define TYPE_CDROM	0x05
-
-/* USB protocol value = the transport method */
-#define USB_PR_CBI	0x00		// Control/Bulk/Interrupt
-#define USB_PR_CB	0x01		// Control/Bulk w/o interrupt
-#define USB_PR_BULK	0x50		// Bulk-only
-
-/* USB subclass value = the protocol encapsulation */
-#define USB_SC_RBC	0x01		// Reduced Block Commands (flash)
-#define USB_SC_8020	0x02		// SFF-8020i, MMC-2, ATAPI (CD-ROM)
-#define USB_SC_QIC	0x03		// QIC-157 (tape)
-#define USB_SC_UFI	0x04		// UFI (floppy)
-#define USB_SC_8070	0x05		// SFF-8070i (removable)
-#define USB_SC_SCSI	0x06		// Transparent SCSI
-
-/* Bulk-only data structures */
-
-/* Command Block Wrapper */
-struct bulk_cb_wrap {
-	__le32	Signature;		// Contains 'USBC'
-	u32	Tag;			// Unique per command id
-	__le32	DataTransferLength;	// Size of the data
-	u8	Flags;			// Direction in bit 7
-	u8	Lun;			// LUN (normally 0)
-	u8	Length;			// Of the CDB, <= MAX_COMMAND_SIZE
-	u8	CDB[16];		// Command Data Block
-};
-
-#define USB_BULK_CB_WRAP_LEN	31
-#define USB_BULK_CB_SIG		0x43425355	// Spells out USBC
-#define USB_BULK_IN_FLAG	0x80
-
-/* Command Status Wrapper */
-struct bulk_cs_wrap {
-	__le32	Signature;		// Should = 'USBS'
-	u32	Tag;			// Same as original command
-	__le32	Residue;		// Amount not transferred
-	u8	Status;			// See below
-};
-
-#define USB_BULK_CS_WRAP_LEN	13
-#define USB_BULK_CS_SIG		0x53425355	// Spells out 'USBS'
-#define USB_STATUS_PASS		0
-#define USB_STATUS_FAIL		1
-#define USB_STATUS_PHASE_ERROR	2
-
-/* Bulk-only class specific requests */
-#define USB_BULK_RESET_REQUEST		0xff
-#define USB_BULK_GET_MAX_LUN_REQUEST	0xfe
-
-
-/* CBI Interrupt data structure */
-struct interrupt_data {
-	u8	bType;
-	u8	bValue;
-};
-
-#define CBI_INTERRUPT_DATA_LEN		2
-
-/* CBI Accept Device-Specific Command request */
-#define USB_CBI_ADSC_REQUEST		0x00
-
-
-#define MAX_COMMAND_SIZE	16	// Length of a SCSI Command Data Block
-
-/* SCSI commands that we recognize */
-#define SC_FORMAT_UNIT			0x04
-#define SC_INQUIRY			0x12
-#define SC_MODE_SELECT_6		0x15
-#define SC_MODE_SELECT_10		0x55
-#define SC_MODE_SENSE_6			0x1a
-#define SC_MODE_SENSE_10		0x5a
-#define SC_PREVENT_ALLOW_MEDIUM_REMOVAL	0x1e
-#define SC_READ_6			0x08
-#define SC_READ_10			0x28
-#define SC_READ_12			0xa8
-#define SC_READ_CAPACITY		0x25
-#define SC_READ_FORMAT_CAPACITIES	0x23
-#define SC_READ_HEADER			0x44
-#define SC_READ_TOC			0x43
-#define SC_RELEASE			0x17
-#define SC_REQUEST_SENSE		0x03
-#define SC_RESERVE			0x16
-#define SC_SEND_DIAGNOSTIC		0x1d
-#define SC_START_STOP_UNIT		0x1b
-#define SC_SYNCHRONIZE_CACHE		0x35
-#define SC_TEST_UNIT_READY		0x00
-#define SC_VERIFY			0x2f
-#define SC_WRITE_6			0x0a
-#define SC_WRITE_10			0x2a
-#define SC_WRITE_12			0xaa
-
-/* SCSI Sense Key/Additional Sense Code/ASC Qualifier values */
-#define SS_NO_SENSE				0
-#define SS_COMMUNICATION_FAILURE		0x040800
-#define SS_INVALID_COMMAND			0x052000
-#define SS_INVALID_FIELD_IN_CDB			0x052400
-#define SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE	0x052100
-#define SS_LOGICAL_UNIT_NOT_SUPPORTED		0x052500
-#define SS_MEDIUM_NOT_PRESENT			0x023a00
-#define SS_MEDIUM_REMOVAL_PREVENTED		0x055302
-#define SS_NOT_READY_TO_READY_TRANSITION	0x062800
-#define SS_RESET_OCCURRED			0x062900
-#define SS_SAVING_PARAMETERS_NOT_SUPPORTED	0x053900
-#define SS_UNRECOVERED_READ_ERROR		0x031100
-#define SS_WRITE_ERROR				0x030c02
-#define SS_WRITE_PROTECTED			0x072700
-
-#define SK(x)		((u8) ((x) >> 16))	// Sense Key byte, etc.
-#define ASC(x)		((u8) ((x) >> 8))
-#define ASCQ(x)		((u8) (x))
-
-
-/*-------------------------------------------------------------------------*/
-
 /*
  * These definitions will permit the compiler to avoid generating code for
  * parts of the driver that aren't used in the non-TEST version.  Even gcc
@@ -566,81 +402,8 @@ struct interrupt_data {
 #endif /* CONFIG_USB_FILE_STORAGE_TEST */
 
 
-struct lun {
-	struct file	*filp;
-	loff_t		file_length;
-	loff_t		num_sectors;
-
-	unsigned int	ro : 1;
-	unsigned int	prevent_medium_removal : 1;
-	unsigned int	registered : 1;
-	unsigned int	info_valid : 1;
-
-	u32		sense_data;
-	u32		sense_data_info;
-	u32		unit_attention_data;
-
-	struct device	dev;
-};
-
-#define backing_file_is_open(curlun)	((curlun)->filp != NULL)
-
-static struct lun *dev_to_lun(struct device *dev)
-{
-	return container_of(dev, struct lun, dev);
-}
-
-
-/* Big enough to hold our biggest descriptor */
-#define EP0_BUFSIZE	256
-#define DELAYED_STATUS	(EP0_BUFSIZE + 999)	// An impossibly large value
-
-/* Number of buffers we will use.  2 is enough for double-buffering */
-#define NUM_BUFFERS	2
-
-enum fsg_buffer_state {
-	BUF_STATE_EMPTY = 0,
-	BUF_STATE_FULL,
-	BUF_STATE_BUSY
-};
-
-struct fsg_buffhd {
-	void				*buf;
-	enum fsg_buffer_state		state;
-	struct fsg_buffhd		*next;
-
-	/* The NetChip 2280 is faster, and handles some protocol faults
-	 * better, if we don't submit any short bulk-out read requests.
-	 * So we will record the intended request length here. */
-	unsigned int			bulk_out_intended_length;
-
-	struct usb_request		*inreq;
-	int				inreq_busy;
-	struct usb_request		*outreq;
-	int				outreq_busy;
-};
-
-enum fsg_state {
-	FSG_STATE_COMMAND_PHASE = -10,		// This one isn't used anywhere
-	FSG_STATE_DATA_PHASE,
-	FSG_STATE_STATUS_PHASE,
-
-	FSG_STATE_IDLE = 0,
-	FSG_STATE_ABORT_BULK_OUT,
-	FSG_STATE_RESET,
-	FSG_STATE_INTERFACE_CHANGE,
-	FSG_STATE_CONFIG_CHANGE,
-	FSG_STATE_DISCONNECT,
-	FSG_STATE_EXIT,
-	FSG_STATE_TERMINATED
-};
+/*-------------------------------------------------------------------------*/
 
-enum data_direction {
-	DATA_DIR_UNKNOWN = 0,
-	DATA_DIR_FROM_HOST,
-	DATA_DIR_TO_HOST,
-	DATA_DIR_NONE
-};
 
 struct fsg_dev {
 	/* lock protects: state, all the req_busy's, and cbbuf_cmnd */
@@ -662,7 +425,7 @@ struct fsg_dev {
 	int			intreq_busy;
 	struct fsg_buffhd	*intr_buffhd;
 
- 	unsigned int		bulk_out_maxpacket;
+	unsigned int		bulk_out_maxpacket;
 	enum fsg_state		state;		// For exception handling
 	unsigned int		exception_req_tag;
 
@@ -687,7 +450,7 @@ struct fsg_dev {
 
 	struct fsg_buffhd	*next_buffhd_to_fill;
 	struct fsg_buffhd	*next_buffhd_to_drain;
-	struct fsg_buffhd	buffhds[NUM_BUFFERS];
+	struct fsg_buffhd	buffhds[FSG_NUM_BUFFERS];
 
 	int			thread_wakeup_needed;
 	struct completion	thread_notifier;
@@ -712,8 +475,8 @@ struct fsg_dev {
 	u8			cbbuf_cmnd[MAX_COMMAND_SIZE];
 
 	unsigned int		nluns;
-	struct lun		*luns;
-	struct lun		*curlun;
+	struct fsg_lun		*luns;
+	struct fsg_lun		*curlun;
 };
 
 typedef void (*fsg_routine_t)(struct fsg_dev *);
@@ -739,49 +502,9 @@ static void set_bulk_out_req_length(struct fsg_dev *fsg,
 static struct fsg_dev			*the_fsg;
 static struct usb_gadget_driver		fsg_driver;
 
-static void	close_backing_file(struct lun *curlun);
-
 
 /*-------------------------------------------------------------------------*/
 
-#ifdef DUMP_MSGS
-
-static void dump_msg(struct fsg_dev *fsg, const char *label,
-		const u8 *buf, unsigned int length)
-{
-	if (length < 512) {
-		DBG(fsg, "%s, length %u:\n", label, length);
-		print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_OFFSET,
-				16, 1, buf, length, 0);
-	}
-}
-
-static void dump_cdb(struct fsg_dev *fsg)
-{}
-
-#else
-
-static void dump_msg(struct fsg_dev *fsg, const char *label,
-		const u8 *buf, unsigned int length)
-{}
-
-#ifdef VERBOSE_DEBUG
-
-static void dump_cdb(struct fsg_dev *fsg)
-{
-	print_hex_dump(KERN_DEBUG, "SCSI CDB: ", DUMP_PREFIX_NONE,
-			16, 1, fsg->cmnd, fsg->cmnd_size, 0);
-}
-
-#else
-
-static void dump_cdb(struct fsg_dev *fsg)
-{}
-
-#endif /* VERBOSE_DEBUG */
-#endif /* DUMP_MSGS */
-
-
 static int fsg_set_halt(struct fsg_dev *fsg, struct usb_ep *ep)
 {
 	const char	*name;
@@ -799,26 +522,11 @@ static int fsg_set_halt(struct fsg_dev *fsg, struct usb_ep *ep)
 
 /*-------------------------------------------------------------------------*/
 
-/* Routines for unaligned data access */
-
-static u32 get_unaligned_be24(u8 *buf)
-{
-	return 0xffffff & (u32) get_unaligned_be32(buf - 1);
-}
-
-
-/*-------------------------------------------------------------------------*/
-
 /*
  * DESCRIPTORS ... most are static, but strings and (full) configuration
  * descriptors are built on demand.  Also the (static) config and interface
  * descriptors are adjusted during fsg_bind().
  */
-#define STRING_MANUFACTURER	1
-#define STRING_PRODUCT		2
-#define STRING_SERIAL		3
-#define STRING_CONFIG		4
-#define STRING_INTERFACE	5
 
 /* There is only one configuration. */
 #define	CONFIG_VALUE		1
@@ -832,13 +540,13 @@ device_desc = {
 	.bDeviceClass =		USB_CLASS_PER_INTERFACE,
 
 	/* The next three values can be overridden by module parameters */
-	.idVendor =		cpu_to_le16(DRIVER_VENDOR_ID),
-	.idProduct =		cpu_to_le16(DRIVER_PRODUCT_ID),
+	.idVendor =		cpu_to_le16(FSG_VENDOR_ID),
+	.idProduct =		cpu_to_le16(FSG_PRODUCT_ID),
 	.bcdDevice =		cpu_to_le16(0xffff),
 
-	.iManufacturer =	STRING_MANUFACTURER,
-	.iProduct =		STRING_PRODUCT,
-	.iSerialNumber =	STRING_SERIAL,
+	.iManufacturer =	FSG_STRING_MANUFACTURER,
+	.iProduct =		FSG_STRING_PRODUCT,
+	.iSerialNumber =	FSG_STRING_SERIAL,
 	.bNumConfigurations =	1,
 };
 
@@ -850,86 +558,12 @@ config_desc = {
 	/* wTotalLength computed by usb_gadget_config_buf() */
 	.bNumInterfaces =	1,
 	.bConfigurationValue =	CONFIG_VALUE,
-	.iConfiguration =	STRING_CONFIG,
+	.iConfiguration =	FSG_STRING_CONFIG,
 	.bmAttributes =		USB_CONFIG_ATT_ONE | USB_CONFIG_ATT_SELFPOWER,
 	.bMaxPower =		CONFIG_USB_GADGET_VBUS_DRAW / 2,
 };
 
-static struct usb_otg_descriptor
-otg_desc = {
-	.bLength =		sizeof(otg_desc),
-	.bDescriptorType =	USB_DT_OTG,
-
-	.bmAttributes =		USB_OTG_SRP,
-};
-
-/* There is only one interface. */
 
-static struct usb_interface_descriptor
-intf_desc = {
-	.bLength =		sizeof intf_desc,
-	.bDescriptorType =	USB_DT_INTERFACE,
-
-	.bNumEndpoints =	2,		// Adjusted during fsg_bind()
-	.bInterfaceClass =	USB_CLASS_MASS_STORAGE,
-	.bInterfaceSubClass =	USB_SC_SCSI,	// Adjusted during fsg_bind()
-	.bInterfaceProtocol =	USB_PR_BULK,	// Adjusted during fsg_bind()
-	.iInterface =		STRING_INTERFACE,
-};
-
-/* Three full-speed endpoint descriptors: bulk-in, bulk-out,
- * and interrupt-in. */
-
-static struct usb_endpoint_descriptor
-fs_bulk_in_desc = {
-	.bLength =		USB_DT_ENDPOINT_SIZE,
-	.bDescriptorType =	USB_DT_ENDPOINT,
-
-	.bEndpointAddress =	USB_DIR_IN,
-	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
-	/* wMaxPacketSize set by autoconfiguration */
-};
-
-static struct usb_endpoint_descriptor
-fs_bulk_out_desc = {
-	.bLength =		USB_DT_ENDPOINT_SIZE,
-	.bDescriptorType =	USB_DT_ENDPOINT,
-
-	.bEndpointAddress =	USB_DIR_OUT,
-	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
-	/* wMaxPacketSize set by autoconfiguration */
-};
-
-static struct usb_endpoint_descriptor
-fs_intr_in_desc = {
-	.bLength =		USB_DT_ENDPOINT_SIZE,
-	.bDescriptorType =	USB_DT_ENDPOINT,
-
-	.bEndpointAddress =	USB_DIR_IN,
-	.bmAttributes =		USB_ENDPOINT_XFER_INT,
-	.wMaxPacketSize =	cpu_to_le16(2),
-	.bInterval =		32,	// frames -> 32 ms
-};
-
-static const struct usb_descriptor_header *fs_function[] = {
-	(struct usb_descriptor_header *) &otg_desc,
-	(struct usb_descriptor_header *) &intf_desc,
-	(struct usb_descriptor_header *) &fs_bulk_in_desc,
-	(struct usb_descriptor_header *) &fs_bulk_out_desc,
-	(struct usb_descriptor_header *) &fs_intr_in_desc,
-	NULL,
-};
-#define FS_FUNCTION_PRE_EP_ENTRIES	2
-
-
-/*
- * USB 2.0 devices need to expose both high speed and full speed
- * descriptors, unless they only run at full speed.
- *
- * That means alternate endpoint descriptors (bigger packets)
- * and a "device qualifier" ... plus more construction options
- * for the config descriptor.
- */
 static struct usb_qualifier_descriptor
 dev_qualifier = {
 	.bLength =		sizeof dev_qualifier,
@@ -941,78 +575,6 @@ dev_qualifier = {
 	.bNumConfigurations =	1,
 };
 
-static struct usb_endpoint_descriptor
-hs_bulk_in_desc = {
-	.bLength =		USB_DT_ENDPOINT_SIZE,
-	.bDescriptorType =	USB_DT_ENDPOINT,
-
-	/* bEndpointAddress copied from fs_bulk_in_desc during fsg_bind() */
-	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
-	.wMaxPacketSize =	cpu_to_le16(512),
-};
-
-static struct usb_endpoint_descriptor
-hs_bulk_out_desc = {
-	.bLength =		USB_DT_ENDPOINT_SIZE,
-	.bDescriptorType =	USB_DT_ENDPOINT,
-
-	/* bEndpointAddress copied from fs_bulk_out_desc during fsg_bind() */
-	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
-	.wMaxPacketSize =	cpu_to_le16(512),
-	.bInterval =		1,	// NAK every 1 uframe
-};
-
-static struct usb_endpoint_descriptor
-hs_intr_in_desc = {
-	.bLength =		USB_DT_ENDPOINT_SIZE,
-	.bDescriptorType =	USB_DT_ENDPOINT,
-
-	/* bEndpointAddress copied from fs_intr_in_desc during fsg_bind() */
-	.bmAttributes =		USB_ENDPOINT_XFER_INT,
-	.wMaxPacketSize =	cpu_to_le16(2),
-	.bInterval =		9,	// 2**(9-1) = 256 uframes -> 32 ms
-};
-
-static const struct usb_descriptor_header *hs_function[] = {
-	(struct usb_descriptor_header *) &otg_desc,
-	(struct usb_descriptor_header *) &intf_desc,
-	(struct usb_descriptor_header *) &hs_bulk_in_desc,
-	(struct usb_descriptor_header *) &hs_bulk_out_desc,
-	(struct usb_descriptor_header *) &hs_intr_in_desc,
-	NULL,
-};
-#define HS_FUNCTION_PRE_EP_ENTRIES	2
-
-/* Maxpacket and other transfer characteristics vary by speed. */
-static struct usb_endpoint_descriptor *
-ep_desc(struct usb_gadget *g, struct usb_endpoint_descriptor *fs,
-		struct usb_endpoint_descriptor *hs)
-{
-	if (gadget_is_dualspeed(g) && g->speed == USB_SPEED_HIGH)
-		return hs;
-	return fs;
-}
-
-
-/* The CBI specification limits the serial string to 12 uppercase hexadecimal
- * characters. */
-static char				manufacturer[64];
-static char				serial[13];
-
-/* Static strings, in UTF-8 (for simplicity we use only ASCII characters) */
-static struct usb_string		strings[] = {
-	{STRING_MANUFACTURER,	manufacturer},
-	{STRING_PRODUCT,	longname},
-	{STRING_SERIAL,		serial},
-	{STRING_CONFIG,		"Self-powered"},
-	{STRING_INTERFACE,	"Mass Storage"},
-	{}
-};
-
-static struct usb_gadget_strings	stringtab = {
-	.language	= 0x0409,		// en-us
-	.strings	= strings,
-};
 
 
 /*
@@ -1032,10 +594,9 @@ static int populate_config_buf(struct usb_gadget *gadget,
 
 	if (gadget_is_dualspeed(gadget) && type == USB_DT_OTHER_SPEED_CONFIG)
 		speed = (USB_SPEED_FULL + USB_SPEED_HIGH) - speed;
-	if (gadget_is_dualspeed(gadget) && speed == USB_SPEED_HIGH)
-		function = hs_function;
-	else
-		function = fs_function;
+	function = gadget_is_dualspeed(gadget) && speed == USB_SPEED_HIGH
+		? (const struct usb_descriptor_header **)fsg_hs_function
+		: (const struct usb_descriptor_header **)fsg_fs_function;
 
 	/* for now, don't advertise srp-only devices */
 	if (!gadget_is_otg(gadget))
@@ -1386,7 +947,7 @@ get_config:
 			VDBG(fsg, "get string descriptor\n");
 
 			/* wIndex == language code */
-			value = usb_gadget_get_string(&stringtab,
+			value = usb_gadget_get_string(&fsg_stringtab,
 					w_value & 0xff, req->buf);
 			break;
 		}
@@ -1551,7 +1112,7 @@ static int sleep_thread(struct fsg_dev *fsg)
 
 static int do_read(struct fsg_dev *fsg)
 {
-	struct lun		*curlun = fsg->curlun;
+	struct fsg_lun		*curlun = fsg->curlun;
 	u32			lba;
 	struct fsg_buffhd	*bh;
 	int			rc;
@@ -1677,7 +1238,7 @@ static int do_read(struct fsg_dev *fsg)
 
 static int do_write(struct fsg_dev *fsg)
 {
-	struct lun		*curlun = fsg->curlun;
+	struct fsg_lun		*curlun = fsg->curlun;
 	u32			lba;
 	struct fsg_buffhd	*bh;
 	int			get_some_more;
@@ -1713,7 +1274,7 @@ static int do_write(struct fsg_dev *fsg)
 		}
 		if (fsg->cmnd[1] & 0x08) {	// FUA
 			spin_lock(&curlun->filp->f_lock);
-			curlun->filp->f_flags |= O_SYNC;
+			curlun->filp->f_flags |= O_DSYNC;
 			spin_unlock(&curlun->filp->f_lock);
 		}
 	}
@@ -1864,33 +1425,14 @@ static int do_write(struct fsg_dev *fsg)
 
 /*-------------------------------------------------------------------------*/
 
-/* Sync the file data, don't bother with the metadata.
- * This code was copied from fs/buffer.c:sys_fdatasync(). */
-static int fsync_sub(struct lun *curlun)
-{
-	struct file	*filp = curlun->filp;
-
-	if (curlun->ro || !filp)
-		return 0;
-	return vfs_fsync(filp, filp->f_path.dentry, 1);
-}
-
-static void fsync_all(struct fsg_dev *fsg)
-{
-	int	i;
-
-	for (i = 0; i < fsg->nluns; ++i)
-		fsync_sub(&fsg->luns[i]);
-}
-
 static int do_synchronize_cache(struct fsg_dev *fsg)
 {
-	struct lun	*curlun = fsg->curlun;
+	struct fsg_lun	*curlun = fsg->curlun;
 	int		rc;
 
 	/* We ignore the requested LBA and write out all file's
 	 * dirty data buffers. */
-	rc = fsync_sub(curlun);
+	rc = fsg_lun_fsync_sub(curlun);
 	if (rc)
 		curlun->sense_data = SS_WRITE_ERROR;
 	return 0;
@@ -1899,7 +1441,7 @@ static int do_synchronize_cache(struct fsg_dev *fsg)
 
 /*-------------------------------------------------------------------------*/
 
-static void invalidate_sub(struct lun *curlun)
+static void invalidate_sub(struct fsg_lun *curlun)
 {
 	struct file	*filp = curlun->filp;
 	struct inode	*inode = filp->f_path.dentry->d_inode;
@@ -1911,7 +1453,7 @@ static void invalidate_sub(struct lun *curlun)
 
 static int do_verify(struct fsg_dev *fsg)
 {
-	struct lun		*curlun = fsg->curlun;
+	struct fsg_lun		*curlun = fsg->curlun;
 	u32			lba;
 	u32			verification_length;
 	struct fsg_buffhd	*bh = fsg->next_buffhd_to_fill;
@@ -1944,7 +1486,7 @@ static int do_verify(struct fsg_dev *fsg)
 	file_offset = ((loff_t) lba) << 9;
 
 	/* Write out all the dirty buffers before invalidating them */
-	fsync_sub(curlun);
+	fsg_lun_fsync_sub(curlun);
 	if (signal_pending(current))
 		return -EINTR;
 
@@ -2041,7 +1583,7 @@ static int do_inquiry(struct fsg_dev *fsg, struct fsg_buffhd *bh)
 
 static int do_request_sense(struct fsg_dev *fsg, struct fsg_buffhd *bh)
 {
-	struct lun	*curlun = fsg->curlun;
+	struct fsg_lun	*curlun = fsg->curlun;
 	u8		*buf = (u8 *) bh->buf;
 	u32		sd, sdinfo;
 	int		valid;
@@ -2095,7 +1637,7 @@ static int do_request_sense(struct fsg_dev *fsg, struct fsg_buffhd *bh)
 
 static int do_read_capacity(struct fsg_dev *fsg, struct fsg_buffhd *bh)
 {
-	struct lun	*curlun = fsg->curlun;
+	struct fsg_lun	*curlun = fsg->curlun;
 	u32		lba = get_unaligned_be32(&fsg->cmnd[2]);
 	int		pmi = fsg->cmnd[8];
 	u8		*buf = (u8 *) bh->buf;
@@ -2113,27 +1655,9 @@ static int do_read_capacity(struct fsg_dev *fsg, struct fsg_buffhd *bh)
 }
 
 
-static void store_cdrom_address(u8 *dest, int msf, u32 addr)
-{
-	if (msf) {
-		/* Convert to Minutes-Seconds-Frames */
-		addr >>= 2;		/* Convert to 2048-byte frames */
-		addr += 2*75;		/* Lead-in occupies 2 seconds */
-		dest[3] = addr % 75;	/* Frames */
-		addr /= 75;
-		dest[2] = addr % 60;	/* Seconds */
-		addr /= 60;
-		dest[1] = addr;		/* Minutes */
-		dest[0] = 0;		/* Reserved */
-	} else {
-		/* Absolute sector */
-		put_unaligned_be32(addr, dest);
-	}
-}
-
 static int do_read_header(struct fsg_dev *fsg, struct fsg_buffhd *bh)
 {
-	struct lun	*curlun = fsg->curlun;
+	struct fsg_lun	*curlun = fsg->curlun;
 	int		msf = fsg->cmnd[1] & 0x02;
 	u32		lba = get_unaligned_be32(&fsg->cmnd[2]);
 	u8		*buf = (u8 *) bh->buf;
@@ -2156,7 +1680,7 @@ static int do_read_header(struct fsg_dev *fsg, struct fsg_buffhd *bh)
 
 static int do_read_toc(struct fsg_dev *fsg, struct fsg_buffhd *bh)
 {
-	struct lun	*curlun = fsg->curlun;
+	struct fsg_lun	*curlun = fsg->curlun;
 	int		msf = fsg->cmnd[1] & 0x02;
 	int		start_track = fsg->cmnd[6];
 	u8		*buf = (u8 *) bh->buf;
@@ -2184,7 +1708,7 @@ static int do_read_toc(struct fsg_dev *fsg, struct fsg_buffhd *bh)
 
 static int do_mode_sense(struct fsg_dev *fsg, struct fsg_buffhd *bh)
 {
-	struct lun	*curlun = fsg->curlun;
+	struct fsg_lun	*curlun = fsg->curlun;
 	int		mscmnd = fsg->cmnd[0];
 	u8		*buf = (u8 *) bh->buf;
 	u8		*buf0 = buf;
@@ -2265,7 +1789,7 @@ static int do_mode_sense(struct fsg_dev *fsg, struct fsg_buffhd *bh)
 
 static int do_start_stop(struct fsg_dev *fsg)
 {
-	struct lun	*curlun = fsg->curlun;
+	struct fsg_lun	*curlun = fsg->curlun;
 	int		loej, start;
 
 	if (!mod_data.removable) {
@@ -2295,7 +1819,7 @@ static int do_start_stop(struct fsg_dev *fsg)
 		if (loej) {		// Simulate an unload/eject
 			up_read(&fsg->filesem);
 			down_write(&fsg->filesem);
-			close_backing_file(curlun);
+			fsg_lun_close(curlun);
 			up_write(&fsg->filesem);
 			down_read(&fsg->filesem);
 		}
@@ -2303,7 +1827,7 @@ static int do_start_stop(struct fsg_dev *fsg)
 
 		/* Our emulation doesn't support mounting; the medium is
 		 * available for use as soon as it is loaded. */
-		if (!backing_file_is_open(curlun)) {
+		if (!fsg_lun_is_open(curlun)) {
 			curlun->sense_data = SS_MEDIUM_NOT_PRESENT;
 			return -EINVAL;
 		}
@@ -2315,7 +1839,7 @@ static int do_start_stop(struct fsg_dev *fsg)
 
 static int do_prevent_allow(struct fsg_dev *fsg)
 {
-	struct lun	*curlun = fsg->curlun;
+	struct fsg_lun	*curlun = fsg->curlun;
 	int		prevent;
 
 	if (!mod_data.removable) {
@@ -2330,7 +1854,7 @@ static int do_prevent_allow(struct fsg_dev *fsg)
 	}
 
 	if (curlun->prevent_medium_removal && !prevent)
-		fsync_sub(curlun);
+		fsg_lun_fsync_sub(curlun);
 	curlun->prevent_medium_removal = prevent;
 	return 0;
 }
@@ -2339,7 +1863,7 @@ static int do_prevent_allow(struct fsg_dev *fsg)
 static int do_read_format_capacities(struct fsg_dev *fsg,
 			struct fsg_buffhd *bh)
 {
-	struct lun	*curlun = fsg->curlun;
+	struct fsg_lun	*curlun = fsg->curlun;
 	u8		*buf = (u8 *) bh->buf;
 
 	buf[0] = buf[1] = buf[2] = 0;
@@ -2356,7 +1880,7 @@ static int do_read_format_capacities(struct fsg_dev *fsg,
 
 static int do_mode_select(struct fsg_dev *fsg, struct fsg_buffhd *bh)
 {
-	struct lun	*curlun = fsg->curlun;
+	struct fsg_lun	*curlun = fsg->curlun;
 
 	/* We don't support MODE SELECT */
 	curlun->sense_data = SS_INVALID_COMMAND;
@@ -2599,7 +2123,7 @@ static int finish_reply(struct fsg_dev *fsg)
 
 static int send_status(struct fsg_dev *fsg)
 {
-	struct lun		*curlun = fsg->curlun;
+	struct fsg_lun		*curlun = fsg->curlun;
 	struct fsg_buffhd	*bh;
 	int			rc;
 	u8			status = USB_STATUS_PASS;
@@ -2691,7 +2215,7 @@ static int check_command(struct fsg_dev *fsg, int cmnd_size,
 	int			lun = fsg->cmnd[1] >> 5;
 	static const char	dirletter[4] = {'u', 'o', 'i', 'n'};
 	char			hdlen[20];
-	struct lun		*curlun;
+	struct fsg_lun		*curlun;
 
 	/* Adjust the expected cmnd_size for protocol encapsulation padding.
 	 * Transparent SCSI doesn't pad. */
@@ -2820,7 +2344,7 @@ static int check_command(struct fsg_dev *fsg, int cmnd_size,
 
 	/* If the medium isn't mounted and the command needs to access
 	 * it, return an error. */
-	if (curlun && !backing_file_is_open(curlun) && needs_medium) {
+	if (curlun && !fsg_lun_is_open(curlun) && needs_medium) {
 		curlun->sense_data = SS_MEDIUM_NOT_PRESENT;
 		return -EINVAL;
 	}
@@ -3075,8 +2599,8 @@ static int do_scsi_command(struct fsg_dev *fsg)
 
 static int received_cbw(struct fsg_dev *fsg, struct fsg_buffhd *bh)
 {
-	struct usb_request	*req = bh->outreq;
-	struct bulk_cb_wrap	*cbw = req->buf;
+	struct usb_request		*req = bh->outreq;
+	struct fsg_bulk_cb_wrap	*cbw = req->buf;
 
 	/* Was this a real packet?  Should it be ignored? */
 	if (req->status || test_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags))
@@ -3105,7 +2629,7 @@ static int received_cbw(struct fsg_dev *fsg, struct fsg_buffhd *bh)
 	}
 
 	/* Is the CBW meaningful? */
-	if (cbw->Lun >= MAX_LUNS || cbw->Flags & ~USB_BULK_IN_FLAG ||
+	if (cbw->Lun >= FSG_MAX_LUNS || cbw->Flags & ~USB_BULK_IN_FLAG ||
 			cbw->Length <= 0 || cbw->Length > MAX_COMMAND_SIZE) {
 		DBG(fsg, "non-meaningful CBW: lun = %u, flags = 0x%x, "
 				"cmdlen %u\n",
@@ -3238,7 +2762,7 @@ static int do_set_interface(struct fsg_dev *fsg, int altsetting)
 
 reset:
 	/* Deallocate the requests */
-	for (i = 0; i < NUM_BUFFERS; ++i) {
+	for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
 		struct fsg_buffhd *bh = &fsg->buffhds[i];
 
 		if (bh->inreq) {
@@ -3276,12 +2800,14 @@ reset:
 	DBG(fsg, "set interface %d\n", altsetting);
 
 	/* Enable the endpoints */
-	d = ep_desc(fsg->gadget, &fs_bulk_in_desc, &hs_bulk_in_desc);
+	d = fsg_ep_desc(fsg->gadget,
+			&fsg_fs_bulk_in_desc, &fsg_hs_bulk_in_desc);
 	if ((rc = enable_endpoint(fsg, fsg->bulk_in, d)) != 0)
 		goto reset;
 	fsg->bulk_in_enabled = 1;
 
-	d = ep_desc(fsg->gadget, &fs_bulk_out_desc, &hs_bulk_out_desc);
+	d = fsg_ep_desc(fsg->gadget,
+			&fsg_fs_bulk_out_desc, &fsg_hs_bulk_out_desc);
 	if ((rc = enable_endpoint(fsg, fsg->bulk_out, d)) != 0)
 		goto reset;
 	fsg->bulk_out_enabled = 1;
@@ -3289,14 +2815,15 @@ reset:
 	clear_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
 
 	if (transport_is_cbi()) {
-		d = ep_desc(fsg->gadget, &fs_intr_in_desc, &hs_intr_in_desc);
+		d = fsg_ep_desc(fsg->gadget,
+				&fsg_fs_intr_in_desc, &fsg_hs_intr_in_desc);
 		if ((rc = enable_endpoint(fsg, fsg->intr_in, d)) != 0)
 			goto reset;
 		fsg->intr_in_enabled = 1;
 	}
 
 	/* Allocate the requests */
-	for (i = 0; i < NUM_BUFFERS; ++i) {
+	for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
 		struct fsg_buffhd	*bh = &fsg->buffhds[i];
 
 		if ((rc = alloc_request(fsg, fsg->bulk_in, &bh->inreq)) != 0)
@@ -3372,7 +2899,7 @@ static void handle_exception(struct fsg_dev *fsg)
 	struct fsg_buffhd	*bh;
 	enum fsg_state		old_state;
 	u8			new_config;
-	struct lun		*curlun;
+	struct fsg_lun		*curlun;
 	unsigned int		exception_req_tag;
 	int			rc;
 
@@ -3392,7 +2919,7 @@ static void handle_exception(struct fsg_dev *fsg)
 	/* Cancel all the pending transfers */
 	if (fsg->intreq_busy)
 		usb_ep_dequeue(fsg->intr_in, fsg->intreq);
-	for (i = 0; i < NUM_BUFFERS; ++i) {
+	for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
 		bh = &fsg->buffhds[i];
 		if (bh->inreq_busy)
 			usb_ep_dequeue(fsg->bulk_in, bh->inreq);
@@ -3403,7 +2930,7 @@ static void handle_exception(struct fsg_dev *fsg)
 	/* Wait until everything is idle */
 	for (;;) {
 		num_active = fsg->intreq_busy;
-		for (i = 0; i < NUM_BUFFERS; ++i) {
+		for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
 			bh = &fsg->buffhds[i];
 			num_active += bh->inreq_busy + bh->outreq_busy;
 		}
@@ -3425,7 +2952,7 @@ static void handle_exception(struct fsg_dev *fsg)
 	 * state, and the exception.  Then invoke the handler. */
 	spin_lock_irq(&fsg->lock);
 
-	for (i = 0; i < NUM_BUFFERS; ++i) {
+	for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
 		bh = &fsg->buffhds[i];
 		bh->state = BUF_STATE_EMPTY;
 	}
@@ -3506,7 +3033,8 @@ static void handle_exception(struct fsg_dev *fsg)
 		break;
 
 	case FSG_STATE_DISCONNECT:
-		fsync_all(fsg);
+		for (i = 0; i < fsg->nluns; ++i)
+			fsg_lun_fsync_sub(fsg->luns + i);
 		do_set_config(fsg, 0);		// Unconfigured state
 		break;
 
@@ -3595,201 +3123,10 @@ static int fsg_main_thread(void *fsg_)
 
 /*-------------------------------------------------------------------------*/
 
-/* If the next two routines are called while the gadget is registered,
- * the caller must own fsg->filesem for writing. */
-
-static int open_backing_file(struct lun *curlun, const char *filename)
-{
-	int				ro;
-	struct file			*filp = NULL;
-	int				rc = -EINVAL;
-	struct inode			*inode = NULL;
-	loff_t				size;
-	loff_t				num_sectors;
-	loff_t				min_sectors;
-
-	/* R/W if we can, R/O if we must */
-	ro = curlun->ro;
-	if (!ro) {
-		filp = filp_open(filename, O_RDWR | O_LARGEFILE, 0);
-		if (-EROFS == PTR_ERR(filp))
-			ro = 1;
-	}
-	if (ro)
-		filp = filp_open(filename, O_RDONLY | O_LARGEFILE, 0);
-	if (IS_ERR(filp)) {
-		LINFO(curlun, "unable to open backing file: %s\n", filename);
-		return PTR_ERR(filp);
-	}
-
-	if (!(filp->f_mode & FMODE_WRITE))
-		ro = 1;
-
-	if (filp->f_path.dentry)
-		inode = filp->f_path.dentry->d_inode;
-	if (inode && S_ISBLK(inode->i_mode)) {
-		if (bdev_read_only(inode->i_bdev))
-			ro = 1;
-	} else if (!inode || !S_ISREG(inode->i_mode)) {
-		LINFO(curlun, "invalid file type: %s\n", filename);
-		goto out;
-	}
-
-	/* If we can't read the file, it's no good.
-	 * If we can't write the file, use it read-only. */
-	if (!filp->f_op || !(filp->f_op->read || filp->f_op->aio_read)) {
-		LINFO(curlun, "file not readable: %s\n", filename);
-		goto out;
-	}
-	if (!(filp->f_op->write || filp->f_op->aio_write))
-		ro = 1;
-
-	size = i_size_read(inode->i_mapping->host);
-	if (size < 0) {
-		LINFO(curlun, "unable to find file size: %s\n", filename);
-		rc = (int) size;
-		goto out;
-	}
-	num_sectors = size >> 9;	// File size in 512-byte blocks
-	min_sectors = 1;
-	if (mod_data.cdrom) {
-		num_sectors &= ~3;	// Reduce to a multiple of 2048
-		min_sectors = 300*4;	// Smallest track is 300 frames
-		if (num_sectors >= 256*60*75*4) {
-			num_sectors = (256*60*75 - 1) * 4;
-			LINFO(curlun, "file too big: %s\n", filename);
-			LINFO(curlun, "using only first %d blocks\n",
-					(int) num_sectors);
-		}
-	}
-	if (num_sectors < min_sectors) {
-		LINFO(curlun, "file too small: %s\n", filename);
-		rc = -ETOOSMALL;
-		goto out;
-	}
-
-	get_file(filp);
-	curlun->ro = ro;
-	curlun->filp = filp;
-	curlun->file_length = size;
-	curlun->num_sectors = num_sectors;
-	LDBG(curlun, "open backing file: %s\n", filename);
-	rc = 0;
-
-out:
-	filp_close(filp, current->files);
-	return rc;
-}
-
-
-static void close_backing_file(struct lun *curlun)
-{
-	if (curlun->filp) {
-		LDBG(curlun, "close backing file\n");
-		fput(curlun->filp);
-		curlun->filp = NULL;
-	}
-}
-
-
-static ssize_t show_ro(struct device *dev, struct device_attribute *attr, char *buf)
-{
-	struct lun	*curlun = dev_to_lun(dev);
-
-	return sprintf(buf, "%d\n", curlun->ro);
-}
-
-static ssize_t show_file(struct device *dev, struct device_attribute *attr,
-		char *buf)
-{
-	struct lun	*curlun = dev_to_lun(dev);
-	struct fsg_dev	*fsg = dev_get_drvdata(dev);
-	char		*p;
-	ssize_t		rc;
-
-	down_read(&fsg->filesem);
-	if (backing_file_is_open(curlun)) {	// Get the complete pathname
-		p = d_path(&curlun->filp->f_path, buf, PAGE_SIZE - 1);
-		if (IS_ERR(p))
-			rc = PTR_ERR(p);
-		else {
-			rc = strlen(p);
-			memmove(buf, p, rc);
-			buf[rc] = '\n';		// Add a newline
-			buf[++rc] = 0;
-		}
-	} else {				// No file, return 0 bytes
-		*buf = 0;
-		rc = 0;
-	}
-	up_read(&fsg->filesem);
-	return rc;
-}
-
-
-static ssize_t store_ro(struct device *dev, struct device_attribute *attr,
-		const char *buf, size_t count)
-{
-	ssize_t		rc = count;
-	struct lun	*curlun = dev_to_lun(dev);
-	struct fsg_dev	*fsg = dev_get_drvdata(dev);
-	int		i;
-
-	if (sscanf(buf, "%d", &i) != 1)
-		return -EINVAL;
-
-	/* Allow the write-enable status to change only while the backing file
-	 * is closed. */
-	down_read(&fsg->filesem);
-	if (backing_file_is_open(curlun)) {
-		LDBG(curlun, "read-only status change prevented\n");
-		rc = -EBUSY;
-	} else {
-		curlun->ro = !!i;
-		LDBG(curlun, "read-only status set to %d\n", curlun->ro);
-	}
-	up_read(&fsg->filesem);
-	return rc;
-}
-
-static ssize_t store_file(struct device *dev, struct device_attribute *attr,
-		const char *buf, size_t count)
-{
-	struct lun	*curlun = dev_to_lun(dev);
-	struct fsg_dev	*fsg = dev_get_drvdata(dev);
-	int		rc = 0;
-
-	if (curlun->prevent_medium_removal && backing_file_is_open(curlun)) {
-		LDBG(curlun, "eject attempt prevented\n");
-		return -EBUSY;				// "Door is locked"
-	}
-
-	/* Remove a trailing newline */
-	if (count > 0 && buf[count-1] == '\n')
-		((char *) buf)[count-1] = 0;		// Ugh!
-
-	/* Eject current medium */
-	down_write(&fsg->filesem);
-	if (backing_file_is_open(curlun)) {
-		close_backing_file(curlun);
-		curlun->unit_attention_data = SS_MEDIUM_NOT_PRESENT;
-	}
-
-	/* Load new medium */
-	if (count > 0 && buf[0]) {
-		rc = open_backing_file(curlun, buf);
-		if (rc == 0)
-			curlun->unit_attention_data =
-					SS_NOT_READY_TO_READY_TRANSITION;
-	}
-	up_write(&fsg->filesem);
-	return (rc < 0 ? rc : count);
-}
-
 
 /* The write permissions and store_xxx pointers are set in fsg_bind() */
-static DEVICE_ATTR(ro, 0444, show_ro, NULL);
-static DEVICE_ATTR(file, 0444, show_file, NULL);
+static DEVICE_ATTR(ro, 0444, fsg_show_ro, NULL);
+static DEVICE_ATTR(file, 0444, fsg_show_file, NULL);
 
 
 /*-------------------------------------------------------------------------*/
@@ -3804,7 +3141,9 @@ static void fsg_release(struct kref *ref)
 
 static void lun_release(struct device *dev)
 {
-	struct fsg_dev	*fsg = dev_get_drvdata(dev);
+	struct rw_semaphore	*filesem = dev_get_drvdata(dev);
+	struct fsg_dev		*fsg =
+		container_of(filesem, struct fsg_dev, filesem);
 
 	kref_put(&fsg->ref, fsg_release);
 }
@@ -3813,7 +3152,7 @@ static void /* __init_or_exit */ fsg_unbind(struct usb_gadget *gadget)
 {
 	struct fsg_dev		*fsg = get_gadget_data(gadget);
 	int			i;
-	struct lun		*curlun;
+	struct fsg_lun		*curlun;
 	struct usb_request	*req = fsg->ep0req;
 
 	DBG(fsg, "unbind\n");
@@ -3825,7 +3164,7 @@ static void /* __init_or_exit */ fsg_unbind(struct usb_gadget *gadget)
 		if (curlun->registered) {
 			device_remove_file(&curlun->dev, &dev_attr_ro);
 			device_remove_file(&curlun->dev, &dev_attr_file);
-			close_backing_file(curlun);
+			fsg_lun_close(curlun);
 			device_unregister(&curlun->dev);
 			curlun->registered = 0;
 		}
@@ -3841,7 +3180,7 @@ static void /* __init_or_exit */ fsg_unbind(struct usb_gadget *gadget)
 	}
 
 	/* Free the data buffers */
-	for (i = 0; i < NUM_BUFFERS; ++i)
+	for (i = 0; i < FSG_NUM_BUFFERS; ++i)
 		kfree(fsg->buffhds[i].buf);
 
 	/* Free the request and buffer for endpoint 0 */
@@ -3948,7 +3287,7 @@ static int __init fsg_bind(struct usb_gadget *gadget)
 	struct fsg_dev		*fsg = the_fsg;
 	int			rc;
 	int			i;
-	struct lun		*curlun;
+	struct fsg_lun		*curlun;
 	struct usb_ep		*ep;
 	struct usb_request	*req;
 	char			*pathbuf, *p;
@@ -3963,10 +3302,10 @@ static int __init fsg_bind(struct usb_gadget *gadget)
 
 	if (mod_data.removable) {	// Enable the store_xxx attributes
 		dev_attr_file.attr.mode = 0644;
-		dev_attr_file.store = store_file;
+		dev_attr_file.store = fsg_store_file;
 		if (!mod_data.cdrom) {
 			dev_attr_ro.attr.mode = 0644;
-			dev_attr_ro.store = store_ro;
+			dev_attr_ro.store = fsg_store_ro;
 		}
 	}
 
@@ -3974,7 +3313,7 @@ static int __init fsg_bind(struct usb_gadget *gadget)
 	i = mod_data.nluns;
 	if (i == 0)
 		i = max(mod_data.num_filenames, 1u);
-	if (i > MAX_LUNS) {
+	if (i > FSG_MAX_LUNS) {
 		ERROR(fsg, "invalid number of LUNs: %d\n", i);
 		rc = -EINVAL;
 		goto out;
@@ -3982,7 +3321,7 @@ static int __init fsg_bind(struct usb_gadget *gadget)
 
 	/* Create the LUNs, open their backing files, and register the
 	 * LUN devices in sysfs. */
-	fsg->luns = kzalloc(i * sizeof(struct lun), GFP_KERNEL);
+	fsg->luns = kzalloc(i * sizeof(struct fsg_lun), GFP_KERNEL);
 	if (!fsg->luns) {
 		rc = -ENOMEM;
 		goto out;
@@ -3991,13 +3330,14 @@ static int __init fsg_bind(struct usb_gadget *gadget)
 
 	for (i = 0; i < fsg->nluns; ++i) {
 		curlun = &fsg->luns[i];
-		curlun->ro = mod_data.ro[i];
-		if (mod_data.cdrom)
-			curlun->ro = 1;
+		curlun->cdrom = !!mod_data.cdrom;
+		curlun->ro = mod_data.cdrom || mod_data.ro[i];
+		curlun->initially_ro = curlun->ro;
+		curlun->removable = mod_data.removable;
 		curlun->dev.release = lun_release;
 		curlun->dev.parent = &gadget->dev;
 		curlun->dev.driver = &fsg_driver.driver;
-		dev_set_drvdata(&curlun->dev, fsg);
+		dev_set_drvdata(&curlun->dev, &fsg->filesem);
 		dev_set_name(&curlun->dev,"%s-lun%d",
 			     dev_name(&gadget->dev), i);
 
@@ -4016,7 +3356,7 @@ static int __init fsg_bind(struct usb_gadget *gadget)
 		kref_get(&fsg->ref);
 
 		if (mod_data.file[i] && *mod_data.file[i]) {
-			if ((rc = open_backing_file(curlun,
+			if ((rc = fsg_lun_open(curlun,
 					mod_data.file[i])) != 0)
 				goto out;
 		} else if (!mod_data.removable) {
@@ -4028,20 +3368,20 @@ static int __init fsg_bind(struct usb_gadget *gadget)
 
 	/* Find all the endpoints we will use */
 	usb_ep_autoconfig_reset(gadget);
-	ep = usb_ep_autoconfig(gadget, &fs_bulk_in_desc);
+	ep = usb_ep_autoconfig(gadget, &fsg_fs_bulk_in_desc);
 	if (!ep)
 		goto autoconf_fail;
 	ep->driver_data = fsg;		// claim the endpoint
 	fsg->bulk_in = ep;
 
-	ep = usb_ep_autoconfig(gadget, &fs_bulk_out_desc);
+	ep = usb_ep_autoconfig(gadget, &fsg_fs_bulk_out_desc);
 	if (!ep)
 		goto autoconf_fail;
 	ep->driver_data = fsg;		// claim the endpoint
 	fsg->bulk_out = ep;
 
 	if (transport_is_cbi()) {
-		ep = usb_ep_autoconfig(gadget, &fs_intr_in_desc);
+		ep = usb_ep_autoconfig(gadget, &fsg_fs_intr_in_desc);
 		if (!ep)
 			goto autoconf_fail;
 		ep->driver_data = fsg;		// claim the endpoint
@@ -4055,28 +3395,28 @@ static int __init fsg_bind(struct usb_gadget *gadget)
 	device_desc.bcdDevice = cpu_to_le16(mod_data.release);
 
 	i = (transport_is_cbi() ? 3 : 2);	// Number of endpoints
-	intf_desc.bNumEndpoints = i;
-	intf_desc.bInterfaceSubClass = mod_data.protocol_type;
-	intf_desc.bInterfaceProtocol = mod_data.transport_type;
-	fs_function[i + FS_FUNCTION_PRE_EP_ENTRIES] = NULL;
+	fsg_intf_desc.bNumEndpoints = i;
+	fsg_intf_desc.bInterfaceSubClass = mod_data.protocol_type;
+	fsg_intf_desc.bInterfaceProtocol = mod_data.transport_type;
+	fsg_fs_function[i + FSG_FS_FUNCTION_PRE_EP_ENTRIES] = NULL;
 
 	if (gadget_is_dualspeed(gadget)) {
-		hs_function[i + HS_FUNCTION_PRE_EP_ENTRIES] = NULL;
+		fsg_hs_function[i + FSG_HS_FUNCTION_PRE_EP_ENTRIES] = NULL;
 
 		/* Assume ep0 uses the same maxpacket value for both speeds */
 		dev_qualifier.bMaxPacketSize0 = fsg->ep0->maxpacket;
 
 		/* Assume endpoint addresses are the same for both speeds */
-		hs_bulk_in_desc.bEndpointAddress =
-				fs_bulk_in_desc.bEndpointAddress;
-		hs_bulk_out_desc.bEndpointAddress =
-				fs_bulk_out_desc.bEndpointAddress;
-		hs_intr_in_desc.bEndpointAddress =
-				fs_intr_in_desc.bEndpointAddress;
+		fsg_hs_bulk_in_desc.bEndpointAddress =
+			fsg_fs_bulk_in_desc.bEndpointAddress;
+		fsg_hs_bulk_out_desc.bEndpointAddress =
+			fsg_fs_bulk_out_desc.bEndpointAddress;
+		fsg_hs_intr_in_desc.bEndpointAddress =
+			fsg_fs_intr_in_desc.bEndpointAddress;
 	}
 
 	if (gadget_is_otg(gadget))
-		otg_desc.bmAttributes |= USB_OTG_HNP;
+		fsg_otg_desc.bmAttributes |= USB_OTG_HNP;
 
 	rc = -ENOMEM;
 
@@ -4090,7 +3430,7 @@ static int __init fsg_bind(struct usb_gadget *gadget)
 	req->complete = ep0_complete;
 
 	/* Allocate the data buffers */
-	for (i = 0; i < NUM_BUFFERS; ++i) {
+	for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
 		struct fsg_buffhd	*bh = &fsg->buffhds[i];
 
 		/* Allocate for the bulk-in endpoint.  We assume that
@@ -4101,23 +3441,24 @@ static int __init fsg_bind(struct usb_gadget *gadget)
 			goto out;
 		bh->next = bh + 1;
 	}
-	fsg->buffhds[NUM_BUFFERS - 1].next = &fsg->buffhds[0];
+	fsg->buffhds[FSG_NUM_BUFFERS - 1].next = &fsg->buffhds[0];
 
 	/* This should reflect the actual gadget power source */
 	usb_gadget_set_selfpowered(gadget);
 
-	snprintf(manufacturer, sizeof manufacturer, "%s %s with %s",
+	snprintf(fsg_string_manufacturer, sizeof fsg_string_manufacturer,
+			"%s %s with %s",
 			init_utsname()->sysname, init_utsname()->release,
 			gadget->name);
 
 	/* On a real device, serial[] would be loaded from permanent
 	 * storage.  We just encode it from the driver version string. */
-	for (i = 0; i < sizeof(serial) - 2; i += 2) {
+	for (i = 0; i < sizeof fsg_string_serial - 2; i += 2) {
 		unsigned char		c = DRIVER_VERSION[i / 2];
 
 		if (!c)
 			break;
-		sprintf(&serial[i], "%02X", c);
+		sprintf(&fsg_string_serial[i], "%02X", c);
 	}
 
 	fsg->thread_task = kthread_create(fsg_main_thread, fsg,
@@ -4133,7 +3474,7 @@ static int __init fsg_bind(struct usb_gadget *gadget)
 	pathbuf = kmalloc(PATH_MAX, GFP_KERNEL);
 	for (i = 0; i < fsg->nluns; ++i) {
 		curlun = &fsg->luns[i];
-		if (backing_file_is_open(curlun)) {
+		if (fsg_lun_is_open(curlun)) {
 			p = NULL;
 			if (pathbuf) {
 				p = d_path(&curlun->filp->f_path,
@@ -4203,7 +3544,7 @@ static struct usb_gadget_driver		fsg_driver = {
 #else
 	.speed		= USB_SPEED_FULL,
 #endif
-	.function	= (char *) longname,
+	.function	= (char *) fsg_string_product,
 	.bind		= fsg_bind,
 	.unbind		= fsg_unbind,
 	.disconnect	= fsg_disconnect,
@@ -4212,7 +3553,7 @@ static struct usb_gadget_driver		fsg_driver = {
 	.resume		= fsg_resume,
 
 	.driver		= {
-		.name		= (char *) shortname,
+		.name		= DRIVER_NAME,
 		.owner		= THIS_MODULE,
 		// .release = ...
 		// .suspend = ...
diff --git a/drivers/usb/gadget/fsl_qe_udc.h b/drivers/usb/gadget/fsl_qe_udc.h
index 31b2710882e4..bea5b827bebe 100644
--- a/drivers/usb/gadget/fsl_qe_udc.h
+++ b/drivers/usb/gadget/fsl_qe_udc.h
@@ -419,19 +419,4 @@ struct qe_udc {
 #define CPM_USB_RESTART_TX_OPCODE 0x0b
 #define CPM_USB_EP_SHIFT 5
 
-#ifndef CONFIG_CPM
-inline int cpm_command(u32 command, u8 opcode)
-{
-	return -EOPNOTSUPP;
-}
-#endif
-
-#ifndef CONFIG_QUICC_ENGINE
-inline int qe_issue_cmd(u32 cmd, u32 device, u8 mcn_protocol,
-	u32 cmd_input)
-{
-	return -EOPNOTSUPP;
-}
-#endif
-
 #endif  /* __FSL_QE_UDC_H */
diff --git a/drivers/usb/gadget/mass_storage.c b/drivers/usb/gadget/mass_storage.c
new file mode 100644
index 000000000000..19619fbf20ac
--- /dev/null
+++ b/drivers/usb/gadget/mass_storage.c
@@ -0,0 +1,240 @@
+/*
+ * mass_storage.c -- Mass Storage USB Gadget
+ *
+ * Copyright (C) 2003-2008 Alan Stern
+ * Copyright (C) 2009 Samsung Electronics
+ *                    Author: Michal Nazarewicz <m.nazarewicz@samsung.com>
+ * All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+
+/*
+ * The Mass Storage Gadget acts as a USB Mass Storage device,
+ * appearing to the host as a disk drive or as a CD-ROM drive.  In
+ * addition to providing an example of a genuinely useful gadget
+ * driver for a USB device, it also illustrates a technique of
+ * double-buffering for increased throughput.  Last but not least, it
+ * gives an easy way to probe the behavior of the Mass Storage drivers
+ * in a USB host.
+ *
+ * Since this file serves only administrative purposes and all the
+ * business logic is implemented in f_mass_storage.* file.  Read
+ * comments in this file for more detailed description.
+ */
+
+
+#include <linux/kernel.h>
+#include <linux/utsname.h>
+#include <linux/usb/ch9.h>
+
+
+/*-------------------------------------------------------------------------*/
+
+#define DRIVER_DESC		"Mass Storage Gadget"
+#define DRIVER_VERSION		"2009/09/11"
+
+/*-------------------------------------------------------------------------*/
+
+/*
+ * kbuild is not very cooperative with respect to linking separately
+ * compiled library objects into one module.  So for now we won't use
+ * separate compilation ... ensuring init/exit sections work to shrink
+ * the runtime footprint, and giving us at least some parts of what
+ * a "gcc --combine ... part1.c part2.c part3.c ... " build would.
+ */
+
+#include "composite.c"
+#include "usbstring.c"
+#include "config.c"
+#include "epautoconf.c"
+#include "f_mass_storage.c"
+
+/*-------------------------------------------------------------------------*/
+
+static struct usb_device_descriptor msg_device_desc = {
+	.bLength =		sizeof msg_device_desc,
+	.bDescriptorType =	USB_DT_DEVICE,
+
+	.bcdUSB =		cpu_to_le16(0x0200),
+	.bDeviceClass =		USB_CLASS_PER_INTERFACE,
+
+	/* Vendor and product id can be overridden by module parameters.  */
+	.idVendor =		cpu_to_le16(FSG_VENDOR_ID),
+	.idProduct =		cpu_to_le16(FSG_PRODUCT_ID),
+	/* .bcdDevice = f(hardware) */
+	/* .iManufacturer = DYNAMIC */
+	/* .iProduct = DYNAMIC */
+	/* NO SERIAL NUMBER */
+	.bNumConfigurations =	1,
+};
+
+static struct usb_otg_descriptor otg_descriptor = {
+	.bLength =		sizeof otg_descriptor,
+	.bDescriptorType =	USB_DT_OTG,
+
+	/* REVISIT SRP-only hardware is possible, although
+	 * it would not be called "OTG" ...
+	 */
+	.bmAttributes =		USB_OTG_SRP | USB_OTG_HNP,
+};
+
+static const struct usb_descriptor_header *otg_desc[] = {
+	(struct usb_descriptor_header *) &otg_descriptor,
+	NULL,
+};
+
+
+/* string IDs are assigned dynamically */
+
+#define STRING_MANUFACTURER_IDX		0
+#define STRING_PRODUCT_IDX		1
+#define STRING_CONFIGURATION_IDX	2
+
+static char manufacturer[50];
+
+static struct usb_string strings_dev[] = {
+	[STRING_MANUFACTURER_IDX].s = manufacturer,
+	[STRING_PRODUCT_IDX].s = DRIVER_DESC,
+	[STRING_CONFIGURATION_IDX].s = "Self Powered",
+	{  } /* end of list */
+};
+
+static struct usb_gadget_strings stringtab_dev = {
+	.language	= 0x0409,	/* en-us */
+	.strings	= strings_dev,
+};
+
+static struct usb_gadget_strings *dev_strings[] = {
+	&stringtab_dev,
+	NULL,
+};
+
+
+
+/****************************** Configurations ******************************/
+
+static struct fsg_module_parameters mod_data = {
+	.stall = 1
+};
+FSG_MODULE_PARAMETERS(/* no prefix */, mod_data);
+
+static unsigned long msg_registered = 0;
+static void msg_cleanup(void);
+
+static int __init msg_do_config(struct usb_configuration *c)
+{
+	struct fsg_common *common;
+	struct fsg_config config;
+	int ret;
+
+	if (gadget_is_otg(c->cdev->gadget)) {
+		c->descriptors = otg_desc;
+		c->bmAttributes |= USB_CONFIG_ATT_WAKEUP;
+	}
+
+	fsg_config_from_params(&config, &mod_data);
+	config.thread_exits = (void(*)(struct fsg_common*))&msg_cleanup;
+	common = fsg_common_init(0, c->cdev, &config);
+	if (IS_ERR(common))
+		return PTR_ERR(common);
+
+	ret = fsg_add(c->cdev, c, common);
+	fsg_common_put(common);
+	return ret;
+}
+
+static struct usb_configuration msg_config_driver = {
+	.label			= "Linux File-Backed Storage",
+	.bind			= msg_do_config,
+	.bConfigurationValue	= 1,
+	/* .iConfiguration = DYNAMIC */
+	.bmAttributes		= USB_CONFIG_ATT_SELFPOWER,
+};
+
+
+
+/****************************** Gadget Bind ******************************/
+
+
+static int __init msg_bind(struct usb_composite_dev *cdev)
+{
+	struct usb_gadget *gadget = cdev->gadget;
+	int status;
+
+	/* Allocate string descriptor numbers ... note that string
+	 * contents can be overridden by the composite_dev glue.
+	 */
+
+	/* device descriptor strings: manufacturer, product */
+	snprintf(manufacturer, sizeof manufacturer, "%s %s with %s",
+	         init_utsname()->sysname, init_utsname()->release,
+	         gadget->name);
+	status = usb_string_id(cdev);
+	if (status < 0)
+		return status;
+	strings_dev[STRING_MANUFACTURER_IDX].id = status;
+	msg_device_desc.iManufacturer = status;
+
+	status = usb_string_id(cdev);
+	if (status < 0)
+		return status;
+	strings_dev[STRING_PRODUCT_IDX].id = status;
+	msg_device_desc.iProduct = status;
+
+	status = usb_string_id(cdev);
+	if (status < 0)
+		return status;
+	strings_dev[STRING_CONFIGURATION_IDX].id = status;
+	msg_config_driver.iConfiguration = status;
+
+	/* register our second configuration */
+	status = usb_add_config(cdev, &msg_config_driver);
+	if (status < 0)
+		return status;
+
+	dev_info(&gadget->dev, DRIVER_DESC ", version: " DRIVER_VERSION "\n");
+	set_bit(0, &msg_registered);
+	return 0;
+}
+
+
+/****************************** Some noise ******************************/
+
+
+static struct usb_composite_driver msg_driver = {
+	.name		= "g_mass_storage",
+	.dev		= &msg_device_desc,
+	.strings	= dev_strings,
+	.bind		= msg_bind,
+};
+
+MODULE_DESCRIPTION(DRIVER_DESC);
+MODULE_AUTHOR("Michal Nazarewicz");
+MODULE_LICENSE("GPL");
+
+static int __init msg_init(void)
+{
+	return usb_composite_register(&msg_driver);
+}
+module_init(msg_init);
+
+static void msg_cleanup(void)
+{
+	if (test_and_clear_bit(0, &msg_registered))
+		usb_composite_unregister(&msg_driver);
+}
+module_exit(msg_cleanup);
diff --git a/drivers/usb/gadget/multi.c b/drivers/usb/gadget/multi.c
new file mode 100644
index 000000000000..429560100b10
--- /dev/null
+++ b/drivers/usb/gadget/multi.c
@@ -0,0 +1,358 @@
+/*
+ * multi.c -- Multifunction Composite driver
+ *
+ * Copyright (C) 2008 David Brownell
+ * Copyright (C) 2008 Nokia Corporation
+ * Copyright (C) 2009 Samsung Electronics
+ * Author: Michal Nazarewicz (m.nazarewicz@samsung.com)
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+
+#include <linux/kernel.h>
+#include <linux/utsname.h>
+
+
+#if defined USB_ETH_RNDIS
+#  undef USB_ETH_RNDIS
+#endif
+#ifdef CONFIG_USB_ETH_RNDIS
+#  define USB_ETH_RNDIS y
+#endif
+
+
+#define DRIVER_DESC		"Multifunction Composite Gadget"
+#define DRIVER_VERSION		"2009/07/21"
+
+/*-------------------------------------------------------------------------*/
+
+#define MULTI_VENDOR_NUM	0x0525	/* XXX NetChip */
+#define MULTI_PRODUCT_NUM	0xa4ab	/* XXX */
+
+/*-------------------------------------------------------------------------*/
+
+/*
+ * kbuild is not very cooperative with respect to linking separately
+ * compiled library objects into one module.  So for now we won't use
+ * separate compilation ... ensuring init/exit sections work to shrink
+ * the runtime footprint, and giving us at least some parts of what
+ * a "gcc --combine ... part1.c part2.c part3.c ... " build would.
+ */
+
+#include "composite.c"
+#include "usbstring.c"
+#include "config.c"
+#include "epautoconf.c"
+
+#include "u_serial.c"
+#include "f_acm.c"
+
+#include "f_ecm.c"
+#include "f_subset.c"
+#ifdef USB_ETH_RNDIS
+#  include "f_rndis.c"
+#  include "rndis.c"
+#endif
+#include "u_ether.c"
+
+#undef DBG     /* u_ether.c has broken idea about macros */
+#undef VDBG    /* so clean up after it */
+#undef ERROR
+#undef INFO
+#include "f_mass_storage.c"
+
+/*-------------------------------------------------------------------------*/
+
+static struct usb_device_descriptor device_desc = {
+	.bLength =		sizeof device_desc,
+	.bDescriptorType =	USB_DT_DEVICE,
+
+	.bcdUSB =		cpu_to_le16(0x0200),
+
+	/* .bDeviceClass =		USB_CLASS_COMM, */
+	/* .bDeviceSubClass =	0, */
+	/* .bDeviceProtocol =	0, */
+	.bDeviceClass =		0xEF,
+	.bDeviceSubClass =	2,
+	.bDeviceProtocol =	1,
+	/* .bMaxPacketSize0 = f(hardware) */
+
+	/* Vendor and product id can be overridden by module parameters.  */
+	.idVendor =		cpu_to_le16(MULTI_VENDOR_NUM),
+	.idProduct =		cpu_to_le16(MULTI_PRODUCT_NUM),
+	/* .bcdDevice = f(hardware) */
+	/* .iManufacturer = DYNAMIC */
+	/* .iProduct = DYNAMIC */
+	/* NO SERIAL NUMBER */
+	.bNumConfigurations =	1,
+};
+
+static struct usb_otg_descriptor otg_descriptor = {
+	.bLength =		sizeof otg_descriptor,
+	.bDescriptorType =	USB_DT_OTG,
+
+	/* REVISIT SRP-only hardware is possible, although
+	 * it would not be called "OTG" ...
+	 */
+	.bmAttributes =		USB_OTG_SRP | USB_OTG_HNP,
+};
+
+static const struct usb_descriptor_header *otg_desc[] = {
+	(struct usb_descriptor_header *) &otg_descriptor,
+	NULL,
+};
+
+
+/* string IDs are assigned dynamically */
+
+#define STRING_MANUFACTURER_IDX		0
+#define STRING_PRODUCT_IDX		1
+
+static char manufacturer[50];
+
+static struct usb_string strings_dev[] = {
+	[STRING_MANUFACTURER_IDX].s = manufacturer,
+	[STRING_PRODUCT_IDX].s = DRIVER_DESC,
+	{  } /* end of list */
+};
+
+static struct usb_gadget_strings stringtab_dev = {
+	.language	= 0x0409,	/* en-us */
+	.strings	= strings_dev,
+};
+
+static struct usb_gadget_strings *dev_strings[] = {
+	&stringtab_dev,
+	NULL,
+};
+
+static u8 hostaddr[ETH_ALEN];
+
+
+
+/****************************** Configurations ******************************/
+
+static struct fsg_module_parameters mod_data = {
+	.stall = 1
+};
+FSG_MODULE_PARAMETERS(/* no prefix */, mod_data);
+
+static struct fsg_common *fsg_common;
+
+
+#ifdef USB_ETH_RNDIS
+
+static int __init rndis_do_config(struct usb_configuration *c)
+{
+	int ret;
+
+	if (gadget_is_otg(c->cdev->gadget)) {
+		c->descriptors = otg_desc;
+		c->bmAttributes |= USB_CONFIG_ATT_WAKEUP;
+	}
+
+	ret = rndis_bind_config(c, hostaddr);
+	if (ret < 0)
+		return ret;
+
+	ret = acm_bind_config(c, 0);
+	if (ret < 0)
+		return ret;
+
+	ret = fsg_add(c->cdev, c, fsg_common);
+	if (ret < 0)
+		return ret;
+
+	return 0;
+}
+
+static struct usb_configuration rndis_config_driver = {
+	.label			= "Multifunction Composite (RNDIS + MS + ACM)",
+	.bind			= rndis_do_config,
+	.bConfigurationValue	= 2,
+	/* .iConfiguration = DYNAMIC */
+	.bmAttributes		= USB_CONFIG_ATT_SELFPOWER,
+};
+
+#endif
+
+#ifdef CONFIG_USB_G_MULTI_CDC
+
+static int __init cdc_do_config(struct usb_configuration *c)
+{
+	int ret;
+
+	if (gadget_is_otg(c->cdev->gadget)) {
+		c->descriptors = otg_desc;
+		c->bmAttributes |= USB_CONFIG_ATT_WAKEUP;
+	}
+
+	ret = ecm_bind_config(c, hostaddr);
+	if (ret < 0)
+		return ret;
+
+	ret = acm_bind_config(c, 0);
+	if (ret < 0)
+		return ret;
+
+	ret = fsg_add(c->cdev, c, fsg_common);
+	if (ret < 0)
+		return ret;
+	if (ret < 0)
+		return ret;
+
+	return 0;
+}
+
+static struct usb_configuration cdc_config_driver = {
+	.label			= "Multifunction Composite (CDC + MS + ACM)",
+	.bind			= cdc_do_config,
+	.bConfigurationValue	= 1,
+	/* .iConfiguration = DYNAMIC */
+	.bmAttributes		= USB_CONFIG_ATT_SELFPOWER,
+};
+
+#endif
+
+
+
+/****************************** Gadget Bind ******************************/
+
+
+static int __init multi_bind(struct usb_composite_dev *cdev)
+{
+	struct usb_gadget *gadget = cdev->gadget;
+	int status, gcnum;
+
+	if (!can_support_ecm(cdev->gadget)) {
+		dev_err(&gadget->dev, "controller '%s' not usable\n",
+		        gadget->name);
+		return -EINVAL;
+	}
+
+	/* set up network link layer */
+	status = gether_setup(cdev->gadget, hostaddr);
+	if (status < 0)
+		return status;
+
+	/* set up serial link layer */
+	status = gserial_setup(cdev->gadget, 1);
+	if (status < 0)
+		goto fail0;
+
+	/* set up mass storage function */
+	fsg_common = fsg_common_from_params(0, cdev, &mod_data);
+	if (IS_ERR(fsg_common)) {
+		status = PTR_ERR(fsg_common);
+		goto fail1;
+	}
+
+
+	gcnum = usb_gadget_controller_number(gadget);
+	if (gcnum >= 0)
+		device_desc.bcdDevice = cpu_to_le16(0x0300 | gcnum);
+	else {
+		/* We assume that can_support_ecm() tells the truth;
+		 * but if the controller isn't recognized at all then
+		 * that assumption is a bit more likely to be wrong.
+		 */
+		WARNING(cdev, "controller '%s' not recognized\n",
+		        gadget->name);
+		device_desc.bcdDevice = cpu_to_le16(0x0300 | 0x0099);
+	}
+
+
+	/* Allocate string descriptor numbers ... note that string
+	 * contents can be overridden by the composite_dev glue.
+	 */
+
+	/* device descriptor strings: manufacturer, product */
+	snprintf(manufacturer, sizeof manufacturer, "%s %s with %s",
+	         init_utsname()->sysname, init_utsname()->release,
+	         gadget->name);
+	status = usb_string_id(cdev);
+	if (status < 0)
+		goto fail2;
+	strings_dev[STRING_MANUFACTURER_IDX].id = status;
+	device_desc.iManufacturer = status;
+
+	status = usb_string_id(cdev);
+	if (status < 0)
+		goto fail2;
+	strings_dev[STRING_PRODUCT_IDX].id = status;
+	device_desc.iProduct = status;
+
+#ifdef USB_ETH_RNDIS
+	/* register our first configuration */
+	status = usb_add_config(cdev, &rndis_config_driver);
+	if (status < 0)
+		goto fail2;
+#endif
+
+#ifdef CONFIG_USB_G_MULTI_CDC
+	/* register our second configuration */
+	status = usb_add_config(cdev, &cdc_config_driver);
+	if (status < 0)
+		goto fail2;
+#endif
+
+	dev_info(&gadget->dev, DRIVER_DESC ", version: " DRIVER_VERSION "\n");
+	fsg_common_put(fsg_common);
+	return 0;
+
+fail2:
+	fsg_common_put(fsg_common);
+fail1:
+	gserial_cleanup();
+fail0:
+	gether_cleanup();
+	return status;
+}
+
+static int __exit multi_unbind(struct usb_composite_dev *cdev)
+{
+	gserial_cleanup();
+	gether_cleanup();
+	return 0;
+}
+
+
+/****************************** Some noise ******************************/
+
+
+static struct usb_composite_driver multi_driver = {
+	.name		= "g_multi",
+	.dev		= &device_desc,
+	.strings	= dev_strings,
+	.bind		= multi_bind,
+	.unbind		= __exit_p(multi_unbind),
+};
+
+MODULE_DESCRIPTION(DRIVER_DESC);
+MODULE_AUTHOR("Michal Nazarewicz");
+MODULE_LICENSE("GPL");
+
+static int __init g_multi_init(void)
+{
+	return usb_composite_register(&multi_driver);
+}
+module_init(g_multi_init);
+
+static void __exit g_multi_cleanup(void)
+{
+	usb_composite_unregister(&multi_driver);
+}
+module_exit(g_multi_cleanup);
diff --git a/drivers/usb/gadget/pxa27x_udc.c b/drivers/usb/gadget/pxa27x_udc.c
index 1937d8c7b433..adda1208a1ec 100644
--- a/drivers/usb/gadget/pxa27x_udc.c
+++ b/drivers/usb/gadget/pxa27x_udc.c
@@ -1524,7 +1524,7 @@ static int pxa_udc_get_frame(struct usb_gadget *_gadget)
  * pxa_udc_wakeup - Force udc device out of suspend
  * @_gadget: usb gadget
  *
- * Returns 0 if succesfull, error code otherwise
+ * Returns 0 if successfull, error code otherwise
  */
 static int pxa_udc_wakeup(struct usb_gadget *_gadget)
 {
diff --git a/drivers/usb/gadget/storage_common.c b/drivers/usb/gadget/storage_common.c
new file mode 100644
index 000000000000..868d8ee86756
--- /dev/null
+++ b/drivers/usb/gadget/storage_common.c
@@ -0,0 +1,778 @@
+/*
+ * storage_common.c -- Common definitions for mass storage functionality
+ *
+ * Copyright (C) 2003-2008 Alan Stern
+ * Copyeight (C) 2009 Samsung Electronics
+ * Author: Michal Nazarewicz (m.nazarewicz@samsung.com)
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+
+/*
+ * This file requires the following identifiers used in USB strings to
+ * be defined (each of type pointer to char):
+ *  - fsg_string_manufacturer -- name of the manufacturer
+ *  - fsg_string_product      -- name of the product
+ *  - fsg_string_serial       -- product's serial
+ *  - fsg_string_config       -- name of the configuration
+ *  - fsg_string_interface    -- name of the interface
+ * The first four are only needed when FSG_DESCRIPTORS_DEVICE_STRINGS
+ * macro is defined prior to including this file.
+ */
+
+/*
+ * When FSG_NO_INTR_EP is defined fsg_fs_intr_in_desc and
+ * fsg_hs_intr_in_desc objects as well as
+ * FSG_FS_FUNCTION_PRE_EP_ENTRIES and FSG_HS_FUNCTION_PRE_EP_ENTRIES
+ * macros are not defined.
+ *
+ * When FSG_NO_DEVICE_STRINGS is defined FSG_STRING_MANUFACTURER,
+ * FSG_STRING_PRODUCT, FSG_STRING_SERIAL and FSG_STRING_CONFIG are not
+ * defined (as well as corresponding entries in string tables are
+ * missing) and FSG_STRING_INTERFACE has value of zero.
+ *
+ * When FSG_NO_OTG is defined fsg_otg_desc won't be defined.
+ */
+
+/*
+ * When FSG_BUFFHD_STATIC_BUFFER is defined when this file is included
+ * the fsg_buffhd structure's buf field will be an array of FSG_BUFLEN
+ * characters rather then a pointer to void.
+ */
+
+
+#include <asm/unaligned.h>
+
+
+/* Thanks to NetChip Technologies for donating this product ID.
+ *
+ * DO NOT REUSE THESE IDs with any other driver!!  Ever!!
+ * Instead:  allocate your own, using normal USB-IF procedures. */
+#define FSG_VENDOR_ID	0x0525	/* NetChip */
+#define FSG_PRODUCT_ID	0xa4a5	/* Linux-USB File-backed Storage Gadget */
+
+
+/*-------------------------------------------------------------------------*/
+
+
+#ifndef DEBUG
+#undef VERBOSE_DEBUG
+#undef DUMP_MSGS
+#endif /* !DEBUG */
+
+#ifdef VERBOSE_DEBUG
+#define VLDBG	LDBG
+#else
+#define VLDBG(lun, fmt, args...) do { } while (0)
+#endif /* VERBOSE_DEBUG */
+
+#define LDBG(lun, fmt, args...)   dev_dbg (&(lun)->dev, fmt, ## args)
+#define LERROR(lun, fmt, args...) dev_err (&(lun)->dev, fmt, ## args)
+#define LWARN(lun, fmt, args...)  dev_warn(&(lun)->dev, fmt, ## args)
+#define LINFO(lun, fmt, args...)  dev_info(&(lun)->dev, fmt, ## args)
+
+/* Keep those macros in sync with thos in
+ * include/linux/ubs/composite.h or else GCC will complain.  If they
+ * are identical (the same names of arguments, white spaces in the
+ * same places) GCC will allow redefinition otherwise (even if some
+ * white space is removed or added) warning will be issued.  No
+ * checking if those symbols is defined is performed because warning
+ * is desired when those macros were defined by someone else to mean
+ * something else. */
+#define DBG(d, fmt, args...)     dev_dbg(&(d)->gadget->dev , fmt , ## args)
+#define VDBG(d, fmt, args...)    dev_vdbg(&(d)->gadget->dev , fmt , ## args)
+#define ERROR(d, fmt, args...)   dev_err(&(d)->gadget->dev , fmt , ## args)
+#define WARNING(d, fmt, args...) dev_warn(&(d)->gadget->dev , fmt , ## args)
+#define INFO(d, fmt, args...)    dev_info(&(d)->gadget->dev , fmt , ## args)
+
+
+
+#ifdef DUMP_MSGS
+
+#  define dump_msg(fsg, /* const char * */ label,			\
+		   /* const u8 * */ buf, /* unsigned */ length) do {	\
+	if (length < 512) {						\
+		DBG(fsg, "%s, length %u:\n", label, length);		\
+		print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_OFFSET,	\
+			       16, 1, buf, length, 0);			\
+	}								\
+} while (0)
+
+#  define dump_cdb(fsg) do { } while (0)
+
+#else
+
+#  define dump_msg(fsg, /* const char * */ label, \
+		   /* const u8 * */ buf, /* unsigned */ length) do { } while (0)
+
+#  ifdef VERBOSE_DEBUG
+
+#    define dump_cdb(fsg)						\
+	print_hex_dump(KERN_DEBUG, "SCSI CDB: ", DUMP_PREFIX_NONE,	\
+		       16, 1, (fsg)->cmnd, (fsg)->cmnd_size, 0)		\
+
+#  else
+
+#    define dump_cdb(fsg) do { } while (0)
+
+#  endif /* VERBOSE_DEBUG */
+
+#endif /* DUMP_MSGS */
+
+
+
+
+
+/*-------------------------------------------------------------------------*/
+
+/* SCSI device types */
+#define TYPE_DISK	0x00
+#define TYPE_CDROM	0x05
+
+/* USB protocol value = the transport method */
+#define USB_PR_CBI	0x00		/* Control/Bulk/Interrupt */
+#define USB_PR_CB	0x01		/* Control/Bulk w/o interrupt */
+#define USB_PR_BULK	0x50		/* Bulk-only */
+
+/* USB subclass value = the protocol encapsulation */
+#define USB_SC_RBC	0x01		/* Reduced Block Commands (flash) */
+#define USB_SC_8020	0x02		/* SFF-8020i, MMC-2, ATAPI (CD-ROM) */
+#define USB_SC_QIC	0x03		/* QIC-157 (tape) */
+#define USB_SC_UFI	0x04		/* UFI (floppy) */
+#define USB_SC_8070	0x05		/* SFF-8070i (removable) */
+#define USB_SC_SCSI	0x06		/* Transparent SCSI */
+
+/* Bulk-only data structures */
+
+/* Command Block Wrapper */
+struct fsg_bulk_cb_wrap {
+	__le32	Signature;		/* Contains 'USBC' */
+	u32	Tag;			/* Unique per command id */
+	__le32	DataTransferLength;	/* Size of the data */
+	u8	Flags;			/* Direction in bit 7 */
+	u8	Lun;			/* LUN (normally 0) */
+	u8	Length;			/* Of the CDB, <= MAX_COMMAND_SIZE */
+	u8	CDB[16];		/* Command Data Block */
+};
+
+#define USB_BULK_CB_WRAP_LEN	31
+#define USB_BULK_CB_SIG		0x43425355	/* Spells out USBC */
+#define USB_BULK_IN_FLAG	0x80
+
+/* Command Status Wrapper */
+struct bulk_cs_wrap {
+	__le32	Signature;		/* Should = 'USBS' */
+	u32	Tag;			/* Same as original command */
+	__le32	Residue;		/* Amount not transferred */
+	u8	Status;			/* See below */
+};
+
+#define USB_BULK_CS_WRAP_LEN	13
+#define USB_BULK_CS_SIG		0x53425355	/* Spells out 'USBS' */
+#define USB_STATUS_PASS		0
+#define USB_STATUS_FAIL		1
+#define USB_STATUS_PHASE_ERROR	2
+
+/* Bulk-only class specific requests */
+#define USB_BULK_RESET_REQUEST		0xff
+#define USB_BULK_GET_MAX_LUN_REQUEST	0xfe
+
+
+/* CBI Interrupt data structure */
+struct interrupt_data {
+	u8	bType;
+	u8	bValue;
+};
+
+#define CBI_INTERRUPT_DATA_LEN		2
+
+/* CBI Accept Device-Specific Command request */
+#define USB_CBI_ADSC_REQUEST		0x00
+
+
+/* Length of a SCSI Command Data Block */
+#define MAX_COMMAND_SIZE	16
+
+/* SCSI commands that we recognize */
+#define SC_FORMAT_UNIT			0x04
+#define SC_INQUIRY			0x12
+#define SC_MODE_SELECT_6		0x15
+#define SC_MODE_SELECT_10		0x55
+#define SC_MODE_SENSE_6			0x1a
+#define SC_MODE_SENSE_10		0x5a
+#define SC_PREVENT_ALLOW_MEDIUM_REMOVAL	0x1e
+#define SC_READ_6			0x08
+#define SC_READ_10			0x28
+#define SC_READ_12			0xa8
+#define SC_READ_CAPACITY		0x25
+#define SC_READ_FORMAT_CAPACITIES	0x23
+#define SC_READ_HEADER			0x44
+#define SC_READ_TOC			0x43
+#define SC_RELEASE			0x17
+#define SC_REQUEST_SENSE		0x03
+#define SC_RESERVE			0x16
+#define SC_SEND_DIAGNOSTIC		0x1d
+#define SC_START_STOP_UNIT		0x1b
+#define SC_SYNCHRONIZE_CACHE		0x35
+#define SC_TEST_UNIT_READY		0x00
+#define SC_VERIFY			0x2f
+#define SC_WRITE_6			0x0a
+#define SC_WRITE_10			0x2a
+#define SC_WRITE_12			0xaa
+
+/* SCSI Sense Key/Additional Sense Code/ASC Qualifier values */
+#define SS_NO_SENSE				0
+#define SS_COMMUNICATION_FAILURE		0x040800
+#define SS_INVALID_COMMAND			0x052000
+#define SS_INVALID_FIELD_IN_CDB			0x052400
+#define SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE	0x052100
+#define SS_LOGICAL_UNIT_NOT_SUPPORTED		0x052500
+#define SS_MEDIUM_NOT_PRESENT			0x023a00
+#define SS_MEDIUM_REMOVAL_PREVENTED		0x055302
+#define SS_NOT_READY_TO_READY_TRANSITION	0x062800
+#define SS_RESET_OCCURRED			0x062900
+#define SS_SAVING_PARAMETERS_NOT_SUPPORTED	0x053900
+#define SS_UNRECOVERED_READ_ERROR		0x031100
+#define SS_WRITE_ERROR				0x030c02
+#define SS_WRITE_PROTECTED			0x072700
+
+#define SK(x)		((u8) ((x) >> 16))	/* Sense Key byte, etc. */
+#define ASC(x)		((u8) ((x) >> 8))
+#define ASCQ(x)		((u8) (x))
+
+
+/*-------------------------------------------------------------------------*/
+
+
+struct fsg_lun {
+	struct file	*filp;
+	loff_t		file_length;
+	loff_t		num_sectors;
+
+	unsigned int	initially_ro:1;
+	unsigned int	ro:1;
+	unsigned int	removable:1;
+	unsigned int	cdrom:1;
+	unsigned int	prevent_medium_removal:1;
+	unsigned int	registered:1;
+	unsigned int	info_valid:1;
+
+	u32		sense_data;
+	u32		sense_data_info;
+	u32		unit_attention_data;
+
+	struct device	dev;
+};
+
+#define fsg_lun_is_open(curlun)	((curlun)->filp != NULL)
+
+static struct fsg_lun *fsg_lun_from_dev(struct device *dev)
+{
+	return container_of(dev, struct fsg_lun, dev);
+}
+
+
+/* Big enough to hold our biggest descriptor */
+#define EP0_BUFSIZE	256
+#define DELAYED_STATUS	(EP0_BUFSIZE + 999)	/* An impossibly large value */
+
+/* Number of buffers we will use.  2 is enough for double-buffering */
+#define FSG_NUM_BUFFERS	2
+
+/* Default size of buffer length. */
+#define FSG_BUFLEN	((u32)16384)
+
+/* Maximal number of LUNs supported in mass storage function */
+#define FSG_MAX_LUNS	8
+
+enum fsg_buffer_state {
+	BUF_STATE_EMPTY = 0,
+	BUF_STATE_FULL,
+	BUF_STATE_BUSY
+};
+
+struct fsg_buffhd {
+#ifdef FSG_BUFFHD_STATIC_BUFFER
+	char				buf[FSG_BUFLEN];
+#else
+	void				*buf;
+#endif
+	enum fsg_buffer_state		state;
+	struct fsg_buffhd		*next;
+
+	/* The NetChip 2280 is faster, and handles some protocol faults
+	 * better, if we don't submit any short bulk-out read requests.
+	 * So we will record the intended request length here. */
+	unsigned int			bulk_out_intended_length;
+
+	struct usb_request		*inreq;
+	int				inreq_busy;
+	struct usb_request		*outreq;
+	int				outreq_busy;
+};
+
+enum fsg_state {
+	/* This one isn't used anywhere */
+	FSG_STATE_COMMAND_PHASE = -10,
+	FSG_STATE_DATA_PHASE,
+	FSG_STATE_STATUS_PHASE,
+
+	FSG_STATE_IDLE = 0,
+	FSG_STATE_ABORT_BULK_OUT,
+	FSG_STATE_RESET,
+	FSG_STATE_INTERFACE_CHANGE,
+	FSG_STATE_CONFIG_CHANGE,
+	FSG_STATE_DISCONNECT,
+	FSG_STATE_EXIT,
+	FSG_STATE_TERMINATED
+};
+
+enum data_direction {
+	DATA_DIR_UNKNOWN = 0,
+	DATA_DIR_FROM_HOST,
+	DATA_DIR_TO_HOST,
+	DATA_DIR_NONE
+};
+
+
+/*-------------------------------------------------------------------------*/
+
+
+static inline u32 get_unaligned_be24(u8 *buf)
+{
+	return 0xffffff & (u32) get_unaligned_be32(buf - 1);
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+
+enum {
+#ifndef FSG_NO_DEVICE_STRINGS
+	FSG_STRING_MANUFACTURER	= 1,
+	FSG_STRING_PRODUCT,
+	FSG_STRING_SERIAL,
+	FSG_STRING_CONFIG,
+#endif
+	FSG_STRING_INTERFACE
+};
+
+
+#ifndef FSG_NO_OTG
+static struct usb_otg_descriptor
+fsg_otg_desc = {
+	.bLength =		sizeof fsg_otg_desc,
+	.bDescriptorType =	USB_DT_OTG,
+
+	.bmAttributes =		USB_OTG_SRP,
+};
+#endif
+
+/* There is only one interface. */
+
+static struct usb_interface_descriptor
+fsg_intf_desc = {
+	.bLength =		sizeof fsg_intf_desc,
+	.bDescriptorType =	USB_DT_INTERFACE,
+
+	.bNumEndpoints =	2,		/* Adjusted during fsg_bind() */
+	.bInterfaceClass =	USB_CLASS_MASS_STORAGE,
+	.bInterfaceSubClass =	USB_SC_SCSI,	/* Adjusted during fsg_bind() */
+	.bInterfaceProtocol =	USB_PR_BULK,	/* Adjusted during fsg_bind() */
+	.iInterface =		FSG_STRING_INTERFACE,
+};
+
+/* Three full-speed endpoint descriptors: bulk-in, bulk-out,
+ * and interrupt-in. */
+
+static struct usb_endpoint_descriptor
+fsg_fs_bulk_in_desc = {
+	.bLength =		USB_DT_ENDPOINT_SIZE,
+	.bDescriptorType =	USB_DT_ENDPOINT,
+
+	.bEndpointAddress =	USB_DIR_IN,
+	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
+	/* wMaxPacketSize set by autoconfiguration */
+};
+
+static struct usb_endpoint_descriptor
+fsg_fs_bulk_out_desc = {
+	.bLength =		USB_DT_ENDPOINT_SIZE,
+	.bDescriptorType =	USB_DT_ENDPOINT,
+
+	.bEndpointAddress =	USB_DIR_OUT,
+	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
+	/* wMaxPacketSize set by autoconfiguration */
+};
+
+#ifndef FSG_NO_INTR_EP
+
+static struct usb_endpoint_descriptor
+fsg_fs_intr_in_desc = {
+	.bLength =		USB_DT_ENDPOINT_SIZE,
+	.bDescriptorType =	USB_DT_ENDPOINT,
+
+	.bEndpointAddress =	USB_DIR_IN,
+	.bmAttributes =		USB_ENDPOINT_XFER_INT,
+	.wMaxPacketSize =	cpu_to_le16(2),
+	.bInterval =		32,	/* frames -> 32 ms */
+};
+
+#ifndef FSG_NO_OTG
+#  define FSG_FS_FUNCTION_PRE_EP_ENTRIES	2
+#else
+#  define FSG_FS_FUNCTION_PRE_EP_ENTRIES	1
+#endif
+
+#endif
+
+static struct usb_descriptor_header *fsg_fs_function[] = {
+#ifndef FSG_NO_OTG
+	(struct usb_descriptor_header *) &fsg_otg_desc,
+#endif
+	(struct usb_descriptor_header *) &fsg_intf_desc,
+	(struct usb_descriptor_header *) &fsg_fs_bulk_in_desc,
+	(struct usb_descriptor_header *) &fsg_fs_bulk_out_desc,
+#ifndef FSG_NO_INTR_EP
+	(struct usb_descriptor_header *) &fsg_fs_intr_in_desc,
+#endif
+	NULL,
+};
+
+
+/*
+ * USB 2.0 devices need to expose both high speed and full speed
+ * descriptors, unless they only run at full speed.
+ *
+ * That means alternate endpoint descriptors (bigger packets)
+ * and a "device qualifier" ... plus more construction options
+ * for the config descriptor.
+ */
+static struct usb_endpoint_descriptor
+fsg_hs_bulk_in_desc = {
+	.bLength =		USB_DT_ENDPOINT_SIZE,
+	.bDescriptorType =	USB_DT_ENDPOINT,
+
+	/* bEndpointAddress copied from fs_bulk_in_desc during fsg_bind() */
+	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
+	.wMaxPacketSize =	cpu_to_le16(512),
+};
+
+static struct usb_endpoint_descriptor
+fsg_hs_bulk_out_desc = {
+	.bLength =		USB_DT_ENDPOINT_SIZE,
+	.bDescriptorType =	USB_DT_ENDPOINT,
+
+	/* bEndpointAddress copied from fs_bulk_out_desc during fsg_bind() */
+	.bmAttributes =		USB_ENDPOINT_XFER_BULK,
+	.wMaxPacketSize =	cpu_to_le16(512),
+	.bInterval =		1,	/* NAK every 1 uframe */
+};
+
+#ifndef FSG_NO_INTR_EP
+
+static struct usb_endpoint_descriptor
+fsg_hs_intr_in_desc = {
+	.bLength =		USB_DT_ENDPOINT_SIZE,
+	.bDescriptorType =	USB_DT_ENDPOINT,
+
+	/* bEndpointAddress copied from fs_intr_in_desc during fsg_bind() */
+	.bmAttributes =		USB_ENDPOINT_XFER_INT,
+	.wMaxPacketSize =	cpu_to_le16(2),
+	.bInterval =		9,	/* 2**(9-1) = 256 uframes -> 32 ms */
+};
+
+#ifndef FSG_NO_OTG
+#  define FSG_HS_FUNCTION_PRE_EP_ENTRIES	2
+#else
+#  define FSG_HS_FUNCTION_PRE_EP_ENTRIES	1
+#endif
+
+#endif
+
+static struct usb_descriptor_header *fsg_hs_function[] = {
+#ifndef FSG_NO_OTG
+	(struct usb_descriptor_header *) &fsg_otg_desc,
+#endif
+	(struct usb_descriptor_header *) &fsg_intf_desc,
+	(struct usb_descriptor_header *) &fsg_hs_bulk_in_desc,
+	(struct usb_descriptor_header *) &fsg_hs_bulk_out_desc,
+#ifndef FSG_NO_INTR_EP
+	(struct usb_descriptor_header *) &fsg_hs_intr_in_desc,
+#endif
+	NULL,
+};
+
+/* Maxpacket and other transfer characteristics vary by speed. */
+static struct usb_endpoint_descriptor *
+fsg_ep_desc(struct usb_gadget *g, struct usb_endpoint_descriptor *fs,
+		struct usb_endpoint_descriptor *hs)
+{
+	if (gadget_is_dualspeed(g) && g->speed == USB_SPEED_HIGH)
+		return hs;
+	return fs;
+}
+
+
+/* Static strings, in UTF-8 (for simplicity we use only ASCII characters) */
+static struct usb_string		fsg_strings[] = {
+#ifndef FSG_NO_DEVICE_STRINGS
+	{FSG_STRING_MANUFACTURER,	fsg_string_manufacturer},
+	{FSG_STRING_PRODUCT,		fsg_string_product},
+	{FSG_STRING_SERIAL,		fsg_string_serial},
+	{FSG_STRING_CONFIG,		fsg_string_config},
+#endif
+	{FSG_STRING_INTERFACE,		fsg_string_interface},
+	{}
+};
+
+static struct usb_gadget_strings	fsg_stringtab = {
+	.language	= 0x0409,		/* en-us */
+	.strings	= fsg_strings,
+};
+
+
+ /*-------------------------------------------------------------------------*/
+
+/* If the next two routines are called while the gadget is registered,
+ * the caller must own fsg->filesem for writing. */
+
+static int fsg_lun_open(struct fsg_lun *curlun, const char *filename)
+{
+	int				ro;
+	struct file			*filp = NULL;
+	int				rc = -EINVAL;
+	struct inode			*inode = NULL;
+	loff_t				size;
+	loff_t				num_sectors;
+	loff_t				min_sectors;
+
+	/* R/W if we can, R/O if we must */
+	ro = curlun->initially_ro;
+	if (!ro) {
+		filp = filp_open(filename, O_RDWR | O_LARGEFILE, 0);
+		if (-EROFS == PTR_ERR(filp))
+			ro = 1;
+	}
+	if (ro)
+		filp = filp_open(filename, O_RDONLY | O_LARGEFILE, 0);
+	if (IS_ERR(filp)) {
+		LINFO(curlun, "unable to open backing file: %s\n", filename);
+		return PTR_ERR(filp);
+	}
+
+	if (!(filp->f_mode & FMODE_WRITE))
+		ro = 1;
+
+	if (filp->f_path.dentry)
+		inode = filp->f_path.dentry->d_inode;
+	if (inode && S_ISBLK(inode->i_mode)) {
+		if (bdev_read_only(inode->i_bdev))
+			ro = 1;
+	} else if (!inode || !S_ISREG(inode->i_mode)) {
+		LINFO(curlun, "invalid file type: %s\n", filename);
+		goto out;
+	}
+
+	/* If we can't read the file, it's no good.
+	 * If we can't write the file, use it read-only. */
+	if (!filp->f_op || !(filp->f_op->read || filp->f_op->aio_read)) {
+		LINFO(curlun, "file not readable: %s\n", filename);
+		goto out;
+	}
+	if (!(filp->f_op->write || filp->f_op->aio_write))
+		ro = 1;
+
+	size = i_size_read(inode->i_mapping->host);
+	if (size < 0) {
+		LINFO(curlun, "unable to find file size: %s\n", filename);
+		rc = (int) size;
+		goto out;
+	}
+	num_sectors = size >> 9;	/* File size in 512-byte blocks */
+	min_sectors = 1;
+	if (curlun->cdrom) {
+		num_sectors &= ~3;	/* Reduce to a multiple of 2048 */
+		min_sectors = 300*4;	/* Smallest track is 300 frames */
+		if (num_sectors >= 256*60*75*4) {
+			num_sectors = (256*60*75 - 1) * 4;
+			LINFO(curlun, "file too big: %s\n", filename);
+			LINFO(curlun, "using only first %d blocks\n",
+					(int) num_sectors);
+		}
+	}
+	if (num_sectors < min_sectors) {
+		LINFO(curlun, "file too small: %s\n", filename);
+		rc = -ETOOSMALL;
+		goto out;
+	}
+
+	get_file(filp);
+	curlun->ro = ro;
+	curlun->filp = filp;
+	curlun->file_length = size;
+	curlun->num_sectors = num_sectors;
+	LDBG(curlun, "open backing file: %s\n", filename);
+	rc = 0;
+
+out:
+	filp_close(filp, current->files);
+	return rc;
+}
+
+
+static void fsg_lun_close(struct fsg_lun *curlun)
+{
+	if (curlun->filp) {
+		LDBG(curlun, "close backing file\n");
+		fput(curlun->filp);
+		curlun->filp = NULL;
+	}
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+/* Sync the file data, don't bother with the metadata.
+ * This code was copied from fs/buffer.c:sys_fdatasync(). */
+static int fsg_lun_fsync_sub(struct fsg_lun *curlun)
+{
+	struct file	*filp = curlun->filp;
+
+	if (curlun->ro || !filp)
+		return 0;
+	return vfs_fsync(filp, filp->f_path.dentry, 1);
+}
+
+static void store_cdrom_address(u8 *dest, int msf, u32 addr)
+{
+	if (msf) {
+		/* Convert to Minutes-Seconds-Frames */
+		addr >>= 2;		/* Convert to 2048-byte frames */
+		addr += 2*75;		/* Lead-in occupies 2 seconds */
+		dest[3] = addr % 75;	/* Frames */
+		addr /= 75;
+		dest[2] = addr % 60;	/* Seconds */
+		addr /= 60;
+		dest[1] = addr;		/* Minutes */
+		dest[0] = 0;		/* Reserved */
+	} else {
+		/* Absolute sector */
+		put_unaligned_be32(addr, dest);
+	}
+}
+
+
+/*-------------------------------------------------------------------------*/
+
+
+static ssize_t fsg_show_ro(struct device *dev, struct device_attribute *attr,
+			   char *buf)
+{
+	struct fsg_lun	*curlun = fsg_lun_from_dev(dev);
+
+	return sprintf(buf, "%d\n", fsg_lun_is_open(curlun)
+				  ? curlun->ro
+				  : curlun->initially_ro);
+}
+
+static ssize_t fsg_show_file(struct device *dev, struct device_attribute *attr,
+			     char *buf)
+{
+	struct fsg_lun	*curlun = fsg_lun_from_dev(dev);
+	struct rw_semaphore	*filesem = dev_get_drvdata(dev);
+	char		*p;
+	ssize_t		rc;
+
+	down_read(filesem);
+	if (fsg_lun_is_open(curlun)) {	/* Get the complete pathname */
+		p = d_path(&curlun->filp->f_path, buf, PAGE_SIZE - 1);
+		if (IS_ERR(p))
+			rc = PTR_ERR(p);
+		else {
+			rc = strlen(p);
+			memmove(buf, p, rc);
+			buf[rc] = '\n';		/* Add a newline */
+			buf[++rc] = 0;
+		}
+	} else {				/* No file, return 0 bytes */
+		*buf = 0;
+		rc = 0;
+	}
+	up_read(filesem);
+	return rc;
+}
+
+
+static ssize_t fsg_store_ro(struct device *dev, struct device_attribute *attr,
+			    const char *buf, size_t count)
+{
+	ssize_t		rc = count;
+	struct fsg_lun	*curlun = fsg_lun_from_dev(dev);
+	struct rw_semaphore	*filesem = dev_get_drvdata(dev);
+	int		i;
+
+	if (sscanf(buf, "%d", &i) != 1)
+		return -EINVAL;
+
+	/* Allow the write-enable status to change only while the backing file
+	 * is closed. */
+	down_read(filesem);
+	if (fsg_lun_is_open(curlun)) {
+		LDBG(curlun, "read-only status change prevented\n");
+		rc = -EBUSY;
+	} else {
+		curlun->ro = !!i;
+		curlun->initially_ro = !!i;
+		LDBG(curlun, "read-only status set to %d\n", curlun->ro);
+	}
+	up_read(filesem);
+	return rc;
+}
+
+static ssize_t fsg_store_file(struct device *dev, struct device_attribute *attr,
+			      const char *buf, size_t count)
+{
+	struct fsg_lun	*curlun = fsg_lun_from_dev(dev);
+	struct rw_semaphore	*filesem = dev_get_drvdata(dev);
+	int		rc = 0;
+
+	if (curlun->prevent_medium_removal && fsg_lun_is_open(curlun)) {
+		LDBG(curlun, "eject attempt prevented\n");
+		return -EBUSY;				/* "Door is locked" */
+	}
+
+	/* Remove a trailing newline */
+	if (count > 0 && buf[count-1] == '\n')
+		((char *) buf)[count-1] = 0;		/* Ugh! */
+
+	/* Eject current medium */
+	down_write(filesem);
+	if (fsg_lun_is_open(curlun)) {
+		fsg_lun_close(curlun);
+		curlun->unit_attention_data = SS_MEDIUM_NOT_PRESENT;
+	}
+
+	/* Load new medium */
+	if (count > 0 && buf[0]) {
+		rc = fsg_lun_open(curlun, buf);
+		if (rc == 0)
+			curlun->unit_attention_data =
+					SS_NOT_READY_TO_READY_TRANSITION;
+	}
+	up_write(filesem);
+	return (rc < 0 ? rc : count);
+}
diff --git a/drivers/usb/gadget/u_audio.c b/drivers/usb/gadget/u_audio.c
index 8252595d619d..35e0930f5bbb 100644
--- a/drivers/usb/gadget/u_audio.c
+++ b/drivers/usb/gadget/u_audio.c
@@ -288,6 +288,7 @@ static int gaudio_close_snd_dev(struct gaudio *gau)
 	return 0;
 }
 
+static struct gaudio *the_card;
 /**
  * gaudio_setup - setup ALSA interface and preparing for USB transfer
  *
@@ -303,6 +304,9 @@ int __init gaudio_setup(struct gaudio *card)
 	if (ret)
 		ERROR(card, "we need at least one control device\n");
 
+	if (!the_card)
+		the_card = card;
+
 	return ret;
 
 }
@@ -312,9 +316,11 @@ int __init gaudio_setup(struct gaudio *card)
  *
  * This is called to free all resources allocated by @gaudio_setup().
  */
-void gaudio_cleanup(struct gaudio *card)
+void gaudio_cleanup(void)
 {
-	if (card)
-		gaudio_close_snd_dev(card);
+	if (the_card) {
+		gaudio_close_snd_dev(the_card);
+		the_card = NULL;
+	}
 }
 
diff --git a/drivers/usb/gadget/u_audio.h b/drivers/usb/gadget/u_audio.h
index cc8d159c648a..08ffce3298e6 100644
--- a/drivers/usb/gadget/u_audio.h
+++ b/drivers/usb/gadget/u_audio.h
@@ -51,6 +51,6 @@ struct gaudio {
 };
 
 int gaudio_setup(struct gaudio *card);
-void gaudio_cleanup(struct gaudio *card);
+void gaudio_cleanup(void);
 
 #endif /* __U_AUDIO_H */
diff --git a/drivers/usb/gadget/u_ether.h b/drivers/usb/gadget/u_ether.h
index 91b39ffdf6ea..fd55f450bc0e 100644
--- a/drivers/usb/gadget/u_ether.h
+++ b/drivers/usb/gadget/u_ether.h
@@ -112,7 +112,7 @@ int geth_bind_config(struct usb_configuration *c, u8 ethaddr[ETH_ALEN]);
 int ecm_bind_config(struct usb_configuration *c, u8 ethaddr[ETH_ALEN]);
 int eem_bind_config(struct usb_configuration *c);
 
-#ifdef CONFIG_USB_ETH_RNDIS
+#ifdef USB_ETH_RNDIS
 
 int rndis_bind_config(struct usb_configuration *c, u8 ethaddr[ETH_ALEN]);
 
diff --git a/drivers/usb/host/Kconfig b/drivers/usb/host/Kconfig
index 9b43b226817f..2678a1624fcc 100644
--- a/drivers/usb/host/Kconfig
+++ b/drivers/usb/host/Kconfig
@@ -90,14 +90,25 @@ config USB_EHCI_TT_NEWSCHED
 
 config USB_EHCI_BIG_ENDIAN_MMIO
 	bool
-	depends on USB_EHCI_HCD && (PPC_CELLEB || PPC_PS3 || 440EPX || ARCH_IXP4XX)
+	depends on USB_EHCI_HCD && (PPC_CELLEB || PPC_PS3 || 440EPX || ARCH_IXP4XX || XPS_USB_HCD_XILINX)
 	default y
 
 config USB_EHCI_BIG_ENDIAN_DESC
 	bool
-	depends on USB_EHCI_HCD && (440EPX || ARCH_IXP4XX)
+	depends on USB_EHCI_HCD && (440EPX || ARCH_IXP4XX || XPS_USB_HCD_XILINX)
 	default y
 
+config XPS_USB_HCD_XILINX
+	bool "Use Xilinx usb host EHCI controller core"
+	depends on USB_EHCI_HCD && (PPC32 || MICROBLAZE)
+	select USB_EHCI_BIG_ENDIAN_DESC
+	select USB_EHCI_BIG_ENDIAN_MMIO
+	---help---
+		Xilinx xps USB host controller core is EHCI compilant and has
+		transaction translator built-in. It can be configured to either
+		support both high speed and full speed devices, or high speed
+		devices only.
+
 config USB_EHCI_FSL
 	bool "Support for Freescale on-chip EHCI USB controller"
 	depends on USB_EHCI_HCD && FSL_SOC
@@ -105,6 +116,13 @@ config USB_EHCI_FSL
 	---help---
 	  Variation of ARC USB block used in some Freescale chips.
 
+config USB_EHCI_MXC
+	bool "Support for Freescale on-chip EHCI USB controller"
+	depends on USB_EHCI_HCD && ARCH_MXC
+	select USB_EHCI_ROOT_HUB_TT
+	---help---
+	  Variation of ARC USB block used in some Freescale chips.
+
 config USB_EHCI_HCD_PPC_OF
 	bool "EHCI support for PPC USB controller on OF platform bus"
 	depends on USB_EHCI_HCD && PPC_OF
diff --git a/drivers/usb/host/ehci-au1xxx.c b/drivers/usb/host/ehci-au1xxx.c
index ed77be76d6bb..dbfb482a94e3 100644
--- a/drivers/usb/host/ehci-au1xxx.c
+++ b/drivers/usb/host/ehci-au1xxx.c
@@ -297,7 +297,7 @@ static int ehci_hcd_au1xxx_drv_resume(struct device *dev)
 	return 0;
 }
 
-static struct dev_pm_ops au1xxx_ehci_pmops = {
+static const struct dev_pm_ops au1xxx_ehci_pmops = {
 	.suspend	= ehci_hcd_au1xxx_drv_suspend,
 	.resume		= ehci_hcd_au1xxx_drv_resume,
 };
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index f5f5601701c9..1ec3857f22e6 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -210,7 +210,7 @@ static int handshake_on_error_set_halt(struct ehci_hcd *ehci, void __iomem *ptr,
 	if (error) {
 		ehci_halt(ehci);
 		ehci_to_hcd(ehci)->state = HC_STATE_HALT;
-		ehci_err(ehci, "force halt; handhake %p %08x %08x -> %d\n",
+		ehci_err(ehci, "force halt; handshake %p %08x %08x -> %d\n",
 			ptr, mask, done, error);
 	}
 
@@ -549,7 +549,7 @@ static int ehci_init(struct usb_hcd *hcd)
 	/* controllers may cache some of the periodic schedule ... */
 	hcc_params = ehci_readl(ehci, &ehci->caps->hcc_params);
 	if (HCC_ISOC_CACHE(hcc_params))		// full frame cache
-		ehci->i_thresh = 8;
+		ehci->i_thresh = 2 + 8;
 	else					// N microframes cached
 		ehci->i_thresh = 2 + HCC_ISOC_THRES(hcc_params);
 
@@ -605,6 +605,8 @@ static int ehci_init(struct usb_hcd *hcd)
 	}
 	ehci->command = temp;
 
+	/* Accept arbitrarily long scatter-gather lists */
+	hcd->self.sg_tablesize = ~0;
 	return 0;
 }
 
@@ -785,9 +787,10 @@ static irqreturn_t ehci_irq (struct usb_hcd *hcd)
 
 			/* start 20 msec resume signaling from this port,
 			 * and make khubd collect PORT_STAT_C_SUSPEND to
-			 * stop that signaling.
+			 * stop that signaling.  Use 5 ms extra for safety,
+			 * like usb_port_resume() does.
 			 */
-			ehci->reset_done [i] = jiffies + msecs_to_jiffies (20);
+			ehci->reset_done[i] = jiffies + msecs_to_jiffies(25);
 			ehci_dbg (ehci, "port %d remote wakeup\n", i + 1);
 			mod_timer(&hcd->rh_timer, ehci->reset_done[i]);
 		}
@@ -1105,11 +1108,21 @@ MODULE_LICENSE ("GPL");
 #define	PLATFORM_DRIVER		ehci_fsl_driver
 #endif
 
+#ifdef CONFIG_USB_EHCI_MXC
+#include "ehci-mxc.c"
+#define PLATFORM_DRIVER		ehci_mxc_driver
+#endif
+
 #ifdef CONFIG_SOC_AU1200
 #include "ehci-au1xxx.c"
 #define	PLATFORM_DRIVER		ehci_hcd_au1xxx_driver
 #endif
 
+#ifdef CONFIG_ARCH_OMAP34XX
+#include "ehci-omap.c"
+#define        PLATFORM_DRIVER         ehci_hcd_omap_driver
+#endif
+
 #ifdef CONFIG_PPC_PS3
 #include "ehci-ps3.c"
 #define	PS3_SYSTEM_BUS_DRIVER	ps3_ehci_driver
@@ -1120,6 +1133,11 @@ MODULE_LICENSE ("GPL");
 #define OF_PLATFORM_DRIVER	ehci_hcd_ppc_of_driver
 #endif
 
+#ifdef CONFIG_XPS_USB_HCD_XILINX
+#include "ehci-xilinx-of.c"
+#define OF_PLATFORM_DRIVER	ehci_hcd_xilinx_of_driver
+#endif
+
 #ifdef CONFIG_PLAT_ORION
 #include "ehci-orion.c"
 #define	PLATFORM_DRIVER		ehci_orion_driver
diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
index 1b6f1c0e5cee..c75d9270c752 100644
--- a/drivers/usb/host/ehci-hub.c
+++ b/drivers/usb/host/ehci-hub.c
@@ -120,9 +120,26 @@ static int ehci_bus_suspend (struct usb_hcd *hcd)
 	del_timer_sync(&ehci->watchdog);
 	del_timer_sync(&ehci->iaa_watchdog);
 
-	port = HCS_N_PORTS (ehci->hcs_params);
 	spin_lock_irq (&ehci->lock);
 
+	/* Once the controller is stopped, port resumes that are already
+	 * in progress won't complete.  Hence if remote wakeup is enabled
+	 * for the root hub and any ports are in the middle of a resume or
+	 * remote wakeup, we must fail the suspend.
+	 */
+	if (hcd->self.root_hub->do_remote_wakeup) {
+		port = HCS_N_PORTS(ehci->hcs_params);
+		while (port--) {
+			if (ehci->reset_done[port] != 0) {
+				spin_unlock_irq(&ehci->lock);
+				ehci_dbg(ehci, "suspend failed because "
+						"port %d is resuming\n",
+						port + 1);
+				return -EBUSY;
+			}
+		}
+	}
+
 	/* stop schedules, clean any completed work */
 	if (HC_IS_RUNNING(hcd->state)) {
 		ehci_quiesce (ehci);
@@ -138,6 +155,7 @@ static int ehci_bus_suspend (struct usb_hcd *hcd)
 	 */
 	ehci->bus_suspended = 0;
 	ehci->owned_ports = 0;
+	port = HCS_N_PORTS(ehci->hcs_params);
 	while (port--) {
 		u32 __iomem	*reg = &ehci->regs->port_status [port];
 		u32		t1 = ehci_readl(ehci, reg) & ~PORT_RWC_BITS;
@@ -236,7 +254,7 @@ static int ehci_bus_resume (struct usb_hcd *hcd)
 	}
 
 	if (unlikely(ehci->debug)) {
-		if (ehci->debug && !dbgp_reset_prep())
+		if (!dbgp_reset_prep())
 			ehci->debug = NULL;
 		else
 			dbgp_external_startup();
diff --git a/drivers/usb/host/ehci-mxc.c b/drivers/usb/host/ehci-mxc.c
new file mode 100644
index 000000000000..35c56f40bdbb
--- /dev/null
+++ b/drivers/usb/host/ehci-mxc.c
@@ -0,0 +1,296 @@
+/*
+ * Copyright (c) 2008 Sascha Hauer <s.hauer@pengutronix.de>, Pengutronix
+ * Copyright (c) 2009 Daniel Mack <daniel@caiaq.de>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include <linux/platform_device.h>
+#include <linux/clk.h>
+#include <linux/delay.h>
+#include <linux/usb/otg.h>
+
+#include <mach/mxc_ehci.h>
+
+#define ULPI_VIEWPORT_OFFSET	0x170
+#define PORTSC_OFFSET		0x184
+#define USBMODE_OFFSET		0x1a8
+#define USBMODE_CM_HOST		3
+
+struct ehci_mxc_priv {
+	struct clk *usbclk, *ahbclk;
+	struct usb_hcd *hcd;
+};
+
+/* called during probe() after chip reset completes */
+static int ehci_mxc_setup(struct usb_hcd *hcd)
+{
+	struct ehci_hcd *ehci = hcd_to_ehci(hcd);
+	int retval;
+
+	/* EHCI registers start at offset 0x100 */
+	ehci->caps = hcd->regs + 0x100;
+	ehci->regs = hcd->regs + 0x100 +
+	    HC_LENGTH(ehci_readl(ehci, &ehci->caps->hc_capbase));
+	dbg_hcs_params(ehci, "reset");
+	dbg_hcc_params(ehci, "reset");
+
+	/* cache this readonly data; minimize chip reads */
+	ehci->hcs_params = ehci_readl(ehci, &ehci->caps->hcs_params);
+
+	retval = ehci_halt(ehci);
+	if (retval)
+		return retval;
+
+	/* data structure init */
+	retval = ehci_init(hcd);
+	if (retval)
+		return retval;
+
+	hcd->has_tt = 1;
+
+	ehci->sbrn = 0x20;
+
+	ehci_reset(ehci);
+
+	ehci_port_power(ehci, 0);
+	return 0;
+}
+
+static const struct hc_driver ehci_mxc_hc_driver = {
+	.description = hcd_name,
+	.product_desc = "Freescale On-Chip EHCI Host Controller",
+	.hcd_priv_size = sizeof(struct ehci_hcd),
+
+	/*
+	 * generic hardware linkage
+	 */
+	.irq = ehci_irq,
+	.flags = HCD_USB2 | HCD_MEMORY,
+
+	/*
+	 * basic lifecycle operations
+	 */
+	.reset = ehci_mxc_setup,
+	.start = ehci_run,
+	.stop = ehci_stop,
+	.shutdown = ehci_shutdown,
+
+	/*
+	 * managing i/o requests and associated device resources
+	 */
+	.urb_enqueue = ehci_urb_enqueue,
+	.urb_dequeue = ehci_urb_dequeue,
+	.endpoint_disable = ehci_endpoint_disable,
+
+	/*
+	 * scheduling support
+	 */
+	.get_frame_number = ehci_get_frame,
+
+	/*
+	 * root hub support
+	 */
+	.hub_status_data = ehci_hub_status_data,
+	.hub_control = ehci_hub_control,
+	.bus_suspend = ehci_bus_suspend,
+	.bus_resume = ehci_bus_resume,
+	.relinquish_port = ehci_relinquish_port,
+	.port_handed_over = ehci_port_handed_over,
+};
+
+static int ehci_mxc_drv_probe(struct platform_device *pdev)
+{
+	struct mxc_usbh_platform_data *pdata = pdev->dev.platform_data;
+	struct usb_hcd *hcd;
+	struct resource *res;
+	int irq, ret, temp;
+	struct ehci_mxc_priv *priv;
+	struct device *dev = &pdev->dev;
+
+	dev_info(&pdev->dev, "initializing i.MX USB Controller\n");
+
+	if (!pdata) {
+		dev_err(dev, "No platform data given, bailing out.\n");
+		return -EINVAL;
+	}
+
+	irq = platform_get_irq(pdev, 0);
+
+	hcd = usb_create_hcd(&ehci_mxc_hc_driver, dev, dev_name(dev));
+	if (!hcd)
+		return -ENOMEM;
+
+	priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+	if (!priv) {
+		ret = -ENOMEM;
+		goto err_alloc;
+	}
+
+	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	if (!res) {
+		dev_err(dev, "Found HC with no register addr. Check setup!\n");
+		ret = -ENODEV;
+		goto err_get_resource;
+	}
+
+	hcd->rsrc_start = res->start;
+	hcd->rsrc_len = resource_size(res);
+
+	if (!request_mem_region(hcd->rsrc_start, hcd->rsrc_len, hcd_name)) {
+		dev_dbg(dev, "controller already in use\n");
+		ret = -EBUSY;
+		goto err_request_mem;
+	}
+
+	hcd->regs = ioremap(hcd->rsrc_start, hcd->rsrc_len);
+	if (!hcd->regs) {
+		dev_err(dev, "error mapping memory\n");
+		ret = -EFAULT;
+		goto err_ioremap;
+	}
+
+	/* enable clocks */
+	priv->usbclk = clk_get(dev, "usb");
+	if (IS_ERR(priv->usbclk)) {
+		ret = PTR_ERR(priv->usbclk);
+		goto err_clk;
+	}
+	clk_enable(priv->usbclk);
+
+	if (!cpu_is_mx35()) {
+		priv->ahbclk = clk_get(dev, "usb_ahb");
+		if (IS_ERR(priv->ahbclk)) {
+			ret = PTR_ERR(priv->ahbclk);
+			goto err_clk_ahb;
+		}
+		clk_enable(priv->ahbclk);
+	}
+
+	/* set USBMODE to host mode */
+	temp = readl(hcd->regs + USBMODE_OFFSET);
+	writel(temp | USBMODE_CM_HOST, hcd->regs + USBMODE_OFFSET);
+
+	/* set up the PORTSCx register */
+	writel(pdata->portsc, hcd->regs + PORTSC_OFFSET);
+	mdelay(10);
+
+	/* setup USBCONTROL. */
+	ret = mxc_set_usbcontrol(pdev->id, pdata->flags);
+	if (ret < 0)
+		goto err_init;
+
+	/* call platform specific init function */
+	if (pdata->init) {
+		ret = pdata->init(pdev);
+		if (ret) {
+			dev_err(dev, "platform init failed\n");
+			goto err_init;
+		}
+	}
+
+	/* most platforms need some time to settle changed IO settings */
+	mdelay(10);
+
+	/* Initialize the transceiver */
+	if (pdata->otg) {
+		pdata->otg->io_priv = hcd->regs + ULPI_VIEWPORT_OFFSET;
+		if (otg_init(pdata->otg) != 0)
+			dev_err(dev, "unable to init transceiver\n");
+		else if (otg_set_vbus(pdata->otg, 1) != 0)
+			dev_err(dev, "unable to enable vbus on transceiver\n");
+	}
+
+	priv->hcd = hcd;
+	platform_set_drvdata(pdev, priv);
+
+	ret = usb_add_hcd(hcd, irq, IRQF_DISABLED | IRQF_SHARED);
+	if (ret)
+		goto err_add;
+
+	return 0;
+
+err_add:
+	if (pdata && pdata->exit)
+		pdata->exit(pdev);
+err_init:
+	if (priv->ahbclk) {
+		clk_disable(priv->ahbclk);
+		clk_put(priv->ahbclk);
+	}
+err_clk_ahb:
+	clk_disable(priv->usbclk);
+	clk_put(priv->usbclk);
+err_clk:
+	iounmap(hcd->regs);
+err_ioremap:
+	release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+err_request_mem:
+err_get_resource:
+	kfree(priv);
+err_alloc:
+	usb_put_hcd(hcd);
+	return ret;
+}
+
+static int __exit ehci_mxc_drv_remove(struct platform_device *pdev)
+{
+	struct mxc_usbh_platform_data *pdata = pdev->dev.platform_data;
+	struct ehci_mxc_priv *priv = platform_get_drvdata(pdev);
+	struct usb_hcd *hcd = priv->hcd;
+
+	if (pdata && pdata->exit)
+		pdata->exit(pdev);
+
+	if (pdata->otg)
+		otg_shutdown(pdata->otg);
+
+	usb_remove_hcd(hcd);
+	iounmap(hcd->regs);
+	release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+	usb_put_hcd(hcd);
+	platform_set_drvdata(pdev, NULL);
+
+	clk_disable(priv->usbclk);
+	clk_put(priv->usbclk);
+	if (priv->ahbclk) {
+		clk_disable(priv->ahbclk);
+		clk_put(priv->ahbclk);
+	}
+
+	kfree(priv);
+
+	return 0;
+}
+
+static void ehci_mxc_drv_shutdown(struct platform_device *pdev)
+{
+	struct ehci_mxc_priv *priv = platform_get_drvdata(pdev);
+	struct usb_hcd *hcd = priv->hcd;
+
+	if (hcd->driver->shutdown)
+		hcd->driver->shutdown(hcd);
+}
+
+MODULE_ALIAS("platform:mxc-ehci");
+
+static struct platform_driver ehci_mxc_driver = {
+	.probe = ehci_mxc_drv_probe,
+	.remove = __exit_p(ehci_mxc_drv_remove),
+	.shutdown = ehci_mxc_drv_shutdown,
+	.driver = {
+		   .name = "mxc-ehci",
+	},
+};
diff --git a/drivers/usb/host/ehci-omap.c b/drivers/usb/host/ehci-omap.c
new file mode 100644
index 000000000000..74d07f4e8b7d
--- /dev/null
+++ b/drivers/usb/host/ehci-omap.c
@@ -0,0 +1,756 @@
+/*
+ * ehci-omap.c - driver for USBHOST on OMAP 34xx processor
+ *
+ * Bus Glue for OMAP34xx USBHOST 3 port EHCI controller
+ * Tested on OMAP3430 ES2.0 SDP
+ *
+ * Copyright (C) 2007-2008 Texas Instruments, Inc.
+ *	Author: Vikram Pandita <vikram.pandita@ti.com>
+ *
+ * Copyright (C) 2009 Nokia Corporation
+ *	Contact: Felipe Balbi <felipe.balbi@nokia.com>
+ *
+ * Based on "ehci-fsl.c" and "ehci-au1xxx.c" ehci glue layers
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
+ *
+ * TODO (last updated Feb 23rd, 2009):
+ *	- add kernel-doc
+ *	- enable AUTOIDLE
+ *	- move DPLL5 programming to clock fw
+ *	- add suspend/resume
+ *	- move workarounds to board-files
+ */
+
+#include <linux/platform_device.h>
+#include <linux/clk.h>
+#include <linux/gpio.h>
+#include <plat/usb.h>
+
+/*
+ * OMAP USBHOST Register addresses: VIRTUAL ADDRESSES
+ *	Use ehci_omap_readl()/ehci_omap_writel() functions
+ */
+
+/* TLL Register Set */
+#define	OMAP_USBTLL_REVISION				(0x00)
+#define	OMAP_USBTLL_SYSCONFIG				(0x10)
+#define	OMAP_USBTLL_SYSCONFIG_CACTIVITY			(1 << 8)
+#define	OMAP_USBTLL_SYSCONFIG_SIDLEMODE			(1 << 3)
+#define	OMAP_USBTLL_SYSCONFIG_ENAWAKEUP			(1 << 2)
+#define	OMAP_USBTLL_SYSCONFIG_SOFTRESET			(1 << 1)
+#define	OMAP_USBTLL_SYSCONFIG_AUTOIDLE			(1 << 0)
+
+#define	OMAP_USBTLL_SYSSTATUS				(0x14)
+#define	OMAP_USBTLL_SYSSTATUS_RESETDONE			(1 << 0)
+
+#define	OMAP_USBTLL_IRQSTATUS				(0x18)
+#define	OMAP_USBTLL_IRQENABLE				(0x1C)
+
+#define	OMAP_TLL_SHARED_CONF				(0x30)
+#define	OMAP_TLL_SHARED_CONF_USB_90D_DDR_EN		(1 << 6)
+#define	OMAP_TLL_SHARED_CONF_USB_180D_SDR_EN		(1 << 5)
+#define	OMAP_TLL_SHARED_CONF_USB_DIVRATION		(1 << 2)
+#define	OMAP_TLL_SHARED_CONF_FCLK_REQ			(1 << 1)
+#define	OMAP_TLL_SHARED_CONF_FCLK_IS_ON			(1 << 0)
+
+#define	OMAP_TLL_CHANNEL_CONF(num)			(0x040 + 0x004 * num)
+#define	OMAP_TLL_CHANNEL_CONF_ULPINOBITSTUFF		(1 << 11)
+#define	OMAP_TLL_CHANNEL_CONF_ULPI_ULPIAUTOIDLE		(1 << 10)
+#define	OMAP_TLL_CHANNEL_CONF_UTMIAUTOIDLE		(1 << 9)
+#define	OMAP_TLL_CHANNEL_CONF_ULPIDDRMODE		(1 << 8)
+#define	OMAP_TLL_CHANNEL_CONF_CHANEN			(1 << 0)
+
+#define	OMAP_TLL_ULPI_FUNCTION_CTRL(num)		(0x804 + 0x100 * num)
+#define	OMAP_TLL_ULPI_INTERFACE_CTRL(num)		(0x807 + 0x100 * num)
+#define	OMAP_TLL_ULPI_OTG_CTRL(num)			(0x80A + 0x100 * num)
+#define	OMAP_TLL_ULPI_INT_EN_RISE(num)			(0x80D + 0x100 * num)
+#define	OMAP_TLL_ULPI_INT_EN_FALL(num)			(0x810 + 0x100 * num)
+#define	OMAP_TLL_ULPI_INT_STATUS(num)			(0x813 + 0x100 * num)
+#define	OMAP_TLL_ULPI_INT_LATCH(num)			(0x814 + 0x100 * num)
+#define	OMAP_TLL_ULPI_DEBUG(num)			(0x815 + 0x100 * num)
+#define	OMAP_TLL_ULPI_SCRATCH_REGISTER(num)		(0x816 + 0x100 * num)
+
+#define OMAP_TLL_CHANNEL_COUNT				3
+#define OMAP_TLL_CHANNEL_1_EN_MASK			(1 << 1)
+#define OMAP_TLL_CHANNEL_2_EN_MASK			(1 << 2)
+#define OMAP_TLL_CHANNEL_3_EN_MASK			(1 << 4)
+
+/* UHH Register Set */
+#define	OMAP_UHH_REVISION				(0x00)
+#define	OMAP_UHH_SYSCONFIG				(0x10)
+#define	OMAP_UHH_SYSCONFIG_MIDLEMODE			(1 << 12)
+#define	OMAP_UHH_SYSCONFIG_CACTIVITY			(1 << 8)
+#define	OMAP_UHH_SYSCONFIG_SIDLEMODE			(1 << 3)
+#define	OMAP_UHH_SYSCONFIG_ENAWAKEUP			(1 << 2)
+#define	OMAP_UHH_SYSCONFIG_SOFTRESET			(1 << 1)
+#define	OMAP_UHH_SYSCONFIG_AUTOIDLE			(1 << 0)
+
+#define	OMAP_UHH_SYSSTATUS				(0x14)
+#define	OMAP_UHH_HOSTCONFIG				(0x40)
+#define	OMAP_UHH_HOSTCONFIG_ULPI_BYPASS			(1 << 0)
+#define	OMAP_UHH_HOSTCONFIG_ULPI_P1_BYPASS		(1 << 0)
+#define	OMAP_UHH_HOSTCONFIG_ULPI_P2_BYPASS		(1 << 11)
+#define	OMAP_UHH_HOSTCONFIG_ULPI_P3_BYPASS		(1 << 12)
+#define OMAP_UHH_HOSTCONFIG_INCR4_BURST_EN		(1 << 2)
+#define OMAP_UHH_HOSTCONFIG_INCR8_BURST_EN		(1 << 3)
+#define OMAP_UHH_HOSTCONFIG_INCR16_BURST_EN		(1 << 4)
+#define OMAP_UHH_HOSTCONFIG_INCRX_ALIGN_EN		(1 << 5)
+#define OMAP_UHH_HOSTCONFIG_P1_CONNECT_STATUS		(1 << 8)
+#define OMAP_UHH_HOSTCONFIG_P2_CONNECT_STATUS		(1 << 9)
+#define OMAP_UHH_HOSTCONFIG_P3_CONNECT_STATUS		(1 << 10)
+
+#define	OMAP_UHH_DEBUG_CSR				(0x44)
+
+/* EHCI Register Set */
+#define	EHCI_INSNREG05_ULPI				(0xA4)
+#define	EHCI_INSNREG05_ULPI_CONTROL_SHIFT		31
+#define	EHCI_INSNREG05_ULPI_PORTSEL_SHIFT		24
+#define	EHCI_INSNREG05_ULPI_OPSEL_SHIFT			22
+#define	EHCI_INSNREG05_ULPI_REGADD_SHIFT		16
+#define	EHCI_INSNREG05_ULPI_EXTREGADD_SHIFT		8
+#define	EHCI_INSNREG05_ULPI_WRDATA_SHIFT		0
+
+/*-------------------------------------------------------------------------*/
+
+static inline void ehci_omap_writel(void __iomem *base, u32 reg, u32 val)
+{
+	__raw_writel(val, base + reg);
+}
+
+static inline u32 ehci_omap_readl(void __iomem *base, u32 reg)
+{
+	return __raw_readl(base + reg);
+}
+
+static inline void ehci_omap_writeb(void __iomem *base, u8 reg, u8 val)
+{
+	__raw_writeb(val, base + reg);
+}
+
+static inline u8 ehci_omap_readb(void __iomem *base, u8 reg)
+{
+	return __raw_readb(base + reg);
+}
+
+/*-------------------------------------------------------------------------*/
+
+struct ehci_hcd_omap {
+	struct ehci_hcd		*ehci;
+	struct device		*dev;
+
+	struct clk		*usbhost_ick;
+	struct clk		*usbhost2_120m_fck;
+	struct clk		*usbhost1_48m_fck;
+	struct clk		*usbtll_fck;
+	struct clk		*usbtll_ick;
+
+	/* FIXME the following two workarounds are
+	 * board specific not silicon-specific so these
+	 * should be moved to board-file instead.
+	 *
+	 * Maybe someone from TI will know better which
+	 * board is affected and needs the workarounds
+	 * to be applied
+	 */
+
+	/* gpio for resetting phy */
+	int			reset_gpio_port[OMAP3_HS_USB_PORTS];
+
+	/* phy reset workaround */
+	int			phy_reset;
+
+	/* desired phy_mode: TLL, PHY */
+	enum ehci_hcd_omap_mode	port_mode[OMAP3_HS_USB_PORTS];
+
+	void __iomem		*uhh_base;
+	void __iomem		*tll_base;
+	void __iomem		*ehci_base;
+};
+
+/*-------------------------------------------------------------------------*/
+
+static void omap_usb_utmi_init(struct ehci_hcd_omap *omap, u8 tll_channel_mask)
+{
+	unsigned reg;
+	int i;
+
+	/* Program the 3 TLL channels upfront */
+	for (i = 0; i < OMAP_TLL_CHANNEL_COUNT; i++) {
+		reg = ehci_omap_readl(omap->tll_base, OMAP_TLL_CHANNEL_CONF(i));
+
+		/* Disable AutoIdle, BitStuffing and use SDR Mode */
+		reg &= ~(OMAP_TLL_CHANNEL_CONF_UTMIAUTOIDLE
+				| OMAP_TLL_CHANNEL_CONF_ULPINOBITSTUFF
+				| OMAP_TLL_CHANNEL_CONF_ULPIDDRMODE);
+		ehci_omap_writel(omap->tll_base, OMAP_TLL_CHANNEL_CONF(i), reg);
+	}
+
+	/* Program Common TLL register */
+	reg = ehci_omap_readl(omap->tll_base, OMAP_TLL_SHARED_CONF);
+	reg |= (OMAP_TLL_SHARED_CONF_FCLK_IS_ON
+			| OMAP_TLL_SHARED_CONF_USB_DIVRATION
+			| OMAP_TLL_SHARED_CONF_USB_180D_SDR_EN);
+	reg &= ~OMAP_TLL_SHARED_CONF_USB_90D_DDR_EN;
+
+	ehci_omap_writel(omap->tll_base, OMAP_TLL_SHARED_CONF, reg);
+
+	/* Enable channels now */
+	for (i = 0; i < OMAP_TLL_CHANNEL_COUNT; i++) {
+		reg = ehci_omap_readl(omap->tll_base, OMAP_TLL_CHANNEL_CONF(i));
+
+		/* Enable only the reg that is needed */
+		if (!(tll_channel_mask & 1<<i))
+			continue;
+
+		reg |= OMAP_TLL_CHANNEL_CONF_CHANEN;
+		ehci_omap_writel(omap->tll_base, OMAP_TLL_CHANNEL_CONF(i), reg);
+
+		ehci_omap_writeb(omap->tll_base,
+				OMAP_TLL_ULPI_SCRATCH_REGISTER(i), 0xbe);
+		dev_dbg(omap->dev, "ULPI_SCRATCH_REG[ch=%d]= 0x%02x\n",
+				i+1, ehci_omap_readb(omap->tll_base,
+				OMAP_TLL_ULPI_SCRATCH_REGISTER(i)));
+	}
+}
+
+/*-------------------------------------------------------------------------*/
+
+/* omap_start_ehc
+ *	- Start the TI USBHOST controller
+ */
+static int omap_start_ehc(struct ehci_hcd_omap *omap, struct usb_hcd *hcd)
+{
+	unsigned long timeout = jiffies + msecs_to_jiffies(1000);
+	u8 tll_ch_mask = 0;
+	unsigned reg = 0;
+	int ret = 0;
+
+	dev_dbg(omap->dev, "starting TI EHCI USB Controller\n");
+
+	/* Enable Clocks for USBHOST */
+	omap->usbhost_ick = clk_get(omap->dev, "usbhost_ick");
+	if (IS_ERR(omap->usbhost_ick)) {
+		ret =  PTR_ERR(omap->usbhost_ick);
+		goto err_host_ick;
+	}
+	clk_enable(omap->usbhost_ick);
+
+	omap->usbhost2_120m_fck = clk_get(omap->dev, "usbhost_120m_fck");
+	if (IS_ERR(omap->usbhost2_120m_fck)) {
+		ret = PTR_ERR(omap->usbhost2_120m_fck);
+		goto err_host_120m_fck;
+	}
+	clk_enable(omap->usbhost2_120m_fck);
+
+	omap->usbhost1_48m_fck = clk_get(omap->dev, "usbhost_48m_fck");
+	if (IS_ERR(omap->usbhost1_48m_fck)) {
+		ret = PTR_ERR(omap->usbhost1_48m_fck);
+		goto err_host_48m_fck;
+	}
+	clk_enable(omap->usbhost1_48m_fck);
+
+	if (omap->phy_reset) {
+		/* Refer: ISSUE1 */
+		if (gpio_is_valid(omap->reset_gpio_port[0])) {
+			gpio_request(omap->reset_gpio_port[0],
+						"USB1 PHY reset");
+			gpio_direction_output(omap->reset_gpio_port[0], 0);
+		}
+
+		if (gpio_is_valid(omap->reset_gpio_port[1])) {
+			gpio_request(omap->reset_gpio_port[1],
+						"USB2 PHY reset");
+			gpio_direction_output(omap->reset_gpio_port[1], 0);
+		}
+
+		/* Hold the PHY in RESET for enough time till DIR is high */
+		udelay(10);
+	}
+
+	/* Configure TLL for 60Mhz clk for ULPI */
+	omap->usbtll_fck = clk_get(omap->dev, "usbtll_fck");
+	if (IS_ERR(omap->usbtll_fck)) {
+		ret = PTR_ERR(omap->usbtll_fck);
+		goto err_tll_fck;
+	}
+	clk_enable(omap->usbtll_fck);
+
+	omap->usbtll_ick = clk_get(omap->dev, "usbtll_ick");
+	if (IS_ERR(omap->usbtll_ick)) {
+		ret = PTR_ERR(omap->usbtll_ick);
+		goto err_tll_ick;
+	}
+	clk_enable(omap->usbtll_ick);
+
+	/* perform TLL soft reset, and wait until reset is complete */
+	ehci_omap_writel(omap->tll_base, OMAP_USBTLL_SYSCONFIG,
+			OMAP_USBTLL_SYSCONFIG_SOFTRESET);
+
+	/* Wait for TLL reset to complete */
+	while (!(ehci_omap_readl(omap->tll_base, OMAP_USBTLL_SYSSTATUS)
+			& OMAP_USBTLL_SYSSTATUS_RESETDONE)) {
+		cpu_relax();
+
+		if (time_after(jiffies, timeout)) {
+			dev_dbg(omap->dev, "operation timed out\n");
+			ret = -EINVAL;
+			goto err_sys_status;
+		}
+	}
+
+	dev_dbg(omap->dev, "TLL RESET DONE\n");
+
+	/* (1<<3) = no idle mode only for initial debugging */
+	ehci_omap_writel(omap->tll_base, OMAP_USBTLL_SYSCONFIG,
+			OMAP_USBTLL_SYSCONFIG_ENAWAKEUP |
+			OMAP_USBTLL_SYSCONFIG_SIDLEMODE |
+			OMAP_USBTLL_SYSCONFIG_CACTIVITY);
+
+
+	/* Put UHH in NoIdle/NoStandby mode */
+	reg = ehci_omap_readl(omap->uhh_base, OMAP_UHH_SYSCONFIG);
+	reg |= (OMAP_UHH_SYSCONFIG_ENAWAKEUP
+			| OMAP_UHH_SYSCONFIG_SIDLEMODE
+			| OMAP_UHH_SYSCONFIG_CACTIVITY
+			| OMAP_UHH_SYSCONFIG_MIDLEMODE);
+	reg &= ~OMAP_UHH_SYSCONFIG_AUTOIDLE;
+
+	ehci_omap_writel(omap->uhh_base, OMAP_UHH_SYSCONFIG, reg);
+
+	reg = ehci_omap_readl(omap->uhh_base, OMAP_UHH_HOSTCONFIG);
+
+	/* setup ULPI bypass and burst configurations */
+	reg |= (OMAP_UHH_HOSTCONFIG_INCR4_BURST_EN
+			| OMAP_UHH_HOSTCONFIG_INCR8_BURST_EN
+			| OMAP_UHH_HOSTCONFIG_INCR16_BURST_EN);
+	reg &= ~OMAP_UHH_HOSTCONFIG_INCRX_ALIGN_EN;
+
+	if (omap->port_mode[0] == EHCI_HCD_OMAP_MODE_UNKNOWN)
+		reg &= ~OMAP_UHH_HOSTCONFIG_P1_CONNECT_STATUS;
+	if (omap->port_mode[1] == EHCI_HCD_OMAP_MODE_UNKNOWN)
+		reg &= ~OMAP_UHH_HOSTCONFIG_P2_CONNECT_STATUS;
+	if (omap->port_mode[2] == EHCI_HCD_OMAP_MODE_UNKNOWN)
+		reg &= ~OMAP_UHH_HOSTCONFIG_P3_CONNECT_STATUS;
+
+	/* Bypass the TLL module for PHY mode operation */
+	 if (omap_rev() <= OMAP3430_REV_ES2_1) {
+		dev_dbg(omap->dev, "OMAP3 ES version <= ES2.1 \n");
+		if ((omap->port_mode[0] == EHCI_HCD_OMAP_MODE_PHY) ||
+			(omap->port_mode[1] == EHCI_HCD_OMAP_MODE_PHY) ||
+				(omap->port_mode[2] == EHCI_HCD_OMAP_MODE_PHY))
+			reg &= ~OMAP_UHH_HOSTCONFIG_ULPI_BYPASS;
+		else
+			reg |= OMAP_UHH_HOSTCONFIG_ULPI_BYPASS;
+	} else {
+		dev_dbg(omap->dev, "OMAP3 ES version > ES2.1\n");
+		if (omap->port_mode[0] == EHCI_HCD_OMAP_MODE_PHY)
+			reg &= ~OMAP_UHH_HOSTCONFIG_ULPI_P1_BYPASS;
+		else if (omap->port_mode[0] == EHCI_HCD_OMAP_MODE_TLL)
+			reg |= OMAP_UHH_HOSTCONFIG_ULPI_P1_BYPASS;
+
+		if (omap->port_mode[1] == EHCI_HCD_OMAP_MODE_PHY)
+			reg &= ~OMAP_UHH_HOSTCONFIG_ULPI_P2_BYPASS;
+		else if (omap->port_mode[1] == EHCI_HCD_OMAP_MODE_TLL)
+			reg |= OMAP_UHH_HOSTCONFIG_ULPI_P2_BYPASS;
+
+		if (omap->port_mode[2] == EHCI_HCD_OMAP_MODE_PHY)
+			reg &= ~OMAP_UHH_HOSTCONFIG_ULPI_P3_BYPASS;
+		else if (omap->port_mode[2] == EHCI_HCD_OMAP_MODE_TLL)
+			reg |= OMAP_UHH_HOSTCONFIG_ULPI_P3_BYPASS;
+
+	}
+	ehci_omap_writel(omap->uhh_base, OMAP_UHH_HOSTCONFIG, reg);
+	dev_dbg(omap->dev, "UHH setup done, uhh_hostconfig=%x\n", reg);
+
+
+	if ((omap->port_mode[0] == EHCI_HCD_OMAP_MODE_TLL) ||
+		(omap->port_mode[1] == EHCI_HCD_OMAP_MODE_TLL) ||
+			(omap->port_mode[2] == EHCI_HCD_OMAP_MODE_TLL)) {
+
+		if (omap->port_mode[0] == EHCI_HCD_OMAP_MODE_TLL)
+			tll_ch_mask |= OMAP_TLL_CHANNEL_1_EN_MASK;
+		if (omap->port_mode[1] == EHCI_HCD_OMAP_MODE_TLL)
+			tll_ch_mask |= OMAP_TLL_CHANNEL_2_EN_MASK;
+		if (omap->port_mode[2] == EHCI_HCD_OMAP_MODE_TLL)
+			tll_ch_mask |= OMAP_TLL_CHANNEL_3_EN_MASK;
+
+		/* Enable UTMI mode for required TLL channels */
+		omap_usb_utmi_init(omap, tll_ch_mask);
+	}
+
+	if (omap->phy_reset) {
+		/* Refer ISSUE1:
+		 * Hold the PHY in RESET for enough time till
+		 * PHY is settled and ready
+		 */
+		udelay(10);
+
+		if (gpio_is_valid(omap->reset_gpio_port[0]))
+			gpio_set_value(omap->reset_gpio_port[0], 1);
+
+		if (gpio_is_valid(omap->reset_gpio_port[1]))
+			gpio_set_value(omap->reset_gpio_port[1], 1);
+	}
+
+	return 0;
+
+err_sys_status:
+	clk_disable(omap->usbtll_ick);
+	clk_put(omap->usbtll_ick);
+
+err_tll_ick:
+	clk_disable(omap->usbtll_fck);
+	clk_put(omap->usbtll_fck);
+
+err_tll_fck:
+	clk_disable(omap->usbhost1_48m_fck);
+	clk_put(omap->usbhost1_48m_fck);
+
+	if (omap->phy_reset) {
+		if (gpio_is_valid(omap->reset_gpio_port[0]))
+			gpio_free(omap->reset_gpio_port[0]);
+
+		if (gpio_is_valid(omap->reset_gpio_port[1]))
+			gpio_free(omap->reset_gpio_port[1]);
+	}
+
+err_host_48m_fck:
+	clk_disable(omap->usbhost2_120m_fck);
+	clk_put(omap->usbhost2_120m_fck);
+
+err_host_120m_fck:
+	clk_disable(omap->usbhost_ick);
+	clk_put(omap->usbhost_ick);
+
+err_host_ick:
+	return ret;
+}
+
+static void omap_stop_ehc(struct ehci_hcd_omap *omap, struct usb_hcd *hcd)
+{
+	unsigned long timeout = jiffies + msecs_to_jiffies(100);
+
+	dev_dbg(omap->dev, "stopping TI EHCI USB Controller\n");
+
+	/* Reset OMAP modules for insmod/rmmod to work */
+	ehci_omap_writel(omap->uhh_base, OMAP_UHH_SYSCONFIG,
+			OMAP_UHH_SYSCONFIG_SOFTRESET);
+	while (!(ehci_omap_readl(omap->uhh_base, OMAP_UHH_SYSSTATUS)
+				& (1 << 0))) {
+		cpu_relax();
+
+		if (time_after(jiffies, timeout))
+			dev_dbg(omap->dev, "operation timed out\n");
+	}
+
+	while (!(ehci_omap_readl(omap->uhh_base, OMAP_UHH_SYSSTATUS)
+				& (1 << 1))) {
+		cpu_relax();
+
+		if (time_after(jiffies, timeout))
+			dev_dbg(omap->dev, "operation timed out\n");
+	}
+
+	while (!(ehci_omap_readl(omap->uhh_base, OMAP_UHH_SYSSTATUS)
+				& (1 << 2))) {
+		cpu_relax();
+
+		if (time_after(jiffies, timeout))
+			dev_dbg(omap->dev, "operation timed out\n");
+	}
+
+	ehci_omap_writel(omap->tll_base, OMAP_USBTLL_SYSCONFIG, (1 << 1));
+
+	while (!(ehci_omap_readl(omap->tll_base, OMAP_USBTLL_SYSSTATUS)
+				& (1 << 0))) {
+		cpu_relax();
+
+		if (time_after(jiffies, timeout))
+			dev_dbg(omap->dev, "operation timed out\n");
+	}
+
+	if (omap->usbtll_fck != NULL) {
+		clk_disable(omap->usbtll_fck);
+		clk_put(omap->usbtll_fck);
+		omap->usbtll_fck = NULL;
+	}
+
+	if (omap->usbhost_ick != NULL) {
+		clk_disable(omap->usbhost_ick);
+		clk_put(omap->usbhost_ick);
+		omap->usbhost_ick = NULL;
+	}
+
+	if (omap->usbhost1_48m_fck != NULL) {
+		clk_disable(omap->usbhost1_48m_fck);
+		clk_put(omap->usbhost1_48m_fck);
+		omap->usbhost1_48m_fck = NULL;
+	}
+
+	if (omap->usbhost2_120m_fck != NULL) {
+		clk_disable(omap->usbhost2_120m_fck);
+		clk_put(omap->usbhost2_120m_fck);
+		omap->usbhost2_120m_fck = NULL;
+	}
+
+	if (omap->usbtll_ick != NULL) {
+		clk_disable(omap->usbtll_ick);
+		clk_put(omap->usbtll_ick);
+		omap->usbtll_ick = NULL;
+	}
+
+	if (omap->phy_reset) {
+		if (gpio_is_valid(omap->reset_gpio_port[0]))
+			gpio_free(omap->reset_gpio_port[0]);
+
+		if (gpio_is_valid(omap->reset_gpio_port[1]))
+			gpio_free(omap->reset_gpio_port[1]);
+	}
+
+	dev_dbg(omap->dev, "Clock to USB host has been disabled\n");
+}
+
+/*-------------------------------------------------------------------------*/
+
+static const struct hc_driver ehci_omap_hc_driver;
+
+/* configure so an HC device and id are always provided */
+/* always called with process context; sleeping is OK */
+
+/**
+ * ehci_hcd_omap_probe - initialize TI-based HCDs
+ *
+ * Allocates basic resources for this USB host controller, and
+ * then invokes the start() method for the HCD associated with it
+ * through the hotplug entry's driver_data.
+ */
+static int ehci_hcd_omap_probe(struct platform_device *pdev)
+{
+	struct ehci_hcd_omap_platform_data *pdata = pdev->dev.platform_data;
+	struct ehci_hcd_omap *omap;
+	struct resource *res;
+	struct usb_hcd *hcd;
+
+	int irq = platform_get_irq(pdev, 0);
+	int ret = -ENODEV;
+
+	if (!pdata) {
+		dev_dbg(&pdev->dev, "missing platform_data\n");
+		goto err_pdata;
+	}
+
+	if (usb_disabled())
+		goto err_disabled;
+
+	omap = kzalloc(sizeof(*omap), GFP_KERNEL);
+	if (!omap) {
+		ret = -ENOMEM;
+		goto err_disabled;
+	}
+
+	hcd = usb_create_hcd(&ehci_omap_hc_driver, &pdev->dev,
+			dev_name(&pdev->dev));
+	if (!hcd) {
+		dev_dbg(&pdev->dev, "failed to create hcd with err %d\n", ret);
+		ret = -ENOMEM;
+		goto err_create_hcd;
+	}
+
+	platform_set_drvdata(pdev, omap);
+	omap->dev		= &pdev->dev;
+	omap->phy_reset		= pdata->phy_reset;
+	omap->reset_gpio_port[0]	= pdata->reset_gpio_port[0];
+	omap->reset_gpio_port[1]	= pdata->reset_gpio_port[1];
+	omap->reset_gpio_port[2]	= pdata->reset_gpio_port[2];
+	omap->port_mode[0]		= pdata->port_mode[0];
+	omap->port_mode[1]		= pdata->port_mode[1];
+	omap->port_mode[2]		= pdata->port_mode[2];
+	omap->ehci		= hcd_to_ehci(hcd);
+	omap->ehci->sbrn	= 0x20;
+
+	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+
+	hcd->rsrc_start = res->start;
+	hcd->rsrc_len = resource_size(res);
+
+	hcd->regs = ioremap(hcd->rsrc_start, hcd->rsrc_len);
+	if (!hcd->regs) {
+		dev_err(&pdev->dev, "EHCI ioremap failed\n");
+		ret = -ENOMEM;
+		goto err_ioremap;
+	}
+
+	/* we know this is the memory we want, no need to ioremap again */
+	omap->ehci->caps = hcd->regs;
+	omap->ehci_base = hcd->regs;
+
+	res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
+	omap->uhh_base = ioremap(res->start, resource_size(res));
+	if (!omap->uhh_base) {
+		dev_err(&pdev->dev, "UHH ioremap failed\n");
+		ret = -ENOMEM;
+		goto err_uhh_ioremap;
+	}
+
+	res = platform_get_resource(pdev, IORESOURCE_MEM, 2);
+	omap->tll_base = ioremap(res->start, resource_size(res));
+	if (!omap->tll_base) {
+		dev_err(&pdev->dev, "TLL ioremap failed\n");
+		ret = -ENOMEM;
+		goto err_tll_ioremap;
+	}
+
+	ret = omap_start_ehc(omap, hcd);
+	if (ret) {
+		dev_dbg(&pdev->dev, "failed to start ehci\n");
+		goto err_start;
+	}
+
+	omap->ehci->regs = hcd->regs
+		+ HC_LENGTH(readl(&omap->ehci->caps->hc_capbase));
+
+	/* cache this readonly data; minimize chip reads */
+	omap->ehci->hcs_params = readl(&omap->ehci->caps->hcs_params);
+
+	/* SET 1 micro-frame Interrupt interval */
+	writel(readl(&omap->ehci->regs->command) | (1 << 16),
+			&omap->ehci->regs->command);
+
+	ret = usb_add_hcd(hcd, irq, IRQF_DISABLED | IRQF_SHARED);
+	if (ret) {
+		dev_dbg(&pdev->dev, "failed to add hcd with err %d\n", ret);
+		goto err_add_hcd;
+	}
+
+	return 0;
+
+err_add_hcd:
+	omap_stop_ehc(omap, hcd);
+
+err_start:
+	iounmap(omap->tll_base);
+
+err_tll_ioremap:
+	iounmap(omap->uhh_base);
+
+err_uhh_ioremap:
+	iounmap(hcd->regs);
+
+err_ioremap:
+	usb_put_hcd(hcd);
+
+err_create_hcd:
+	kfree(omap);
+err_disabled:
+err_pdata:
+	return ret;
+}
+
+/* may be called without controller electrically present */
+/* may be called with controller, bus, and devices active */
+
+/**
+ * ehci_hcd_omap_remove - shutdown processing for EHCI HCDs
+ * @pdev: USB Host Controller being removed
+ *
+ * Reverses the effect of usb_ehci_hcd_omap_probe(), first invoking
+ * the HCD's stop() method.  It is always called from a thread
+ * context, normally "rmmod", "apmd", or something similar.
+ */
+static int ehci_hcd_omap_remove(struct platform_device *pdev)
+{
+	struct ehci_hcd_omap *omap = platform_get_drvdata(pdev);
+	struct usb_hcd *hcd = ehci_to_hcd(omap->ehci);
+
+	usb_remove_hcd(hcd);
+	omap_stop_ehc(omap, hcd);
+	iounmap(hcd->regs);
+	iounmap(omap->tll_base);
+	iounmap(omap->uhh_base);
+	usb_put_hcd(hcd);
+
+	return 0;
+}
+
+static void ehci_hcd_omap_shutdown(struct platform_device *pdev)
+{
+	struct ehci_hcd_omap *omap = platform_get_drvdata(pdev);
+	struct usb_hcd *hcd = ehci_to_hcd(omap->ehci);
+
+	if (hcd->driver->shutdown)
+		hcd->driver->shutdown(hcd);
+}
+
+static struct platform_driver ehci_hcd_omap_driver = {
+	.probe			= ehci_hcd_omap_probe,
+	.remove			= ehci_hcd_omap_remove,
+	.shutdown		= ehci_hcd_omap_shutdown,
+	/*.suspend		= ehci_hcd_omap_suspend, */
+	/*.resume		= ehci_hcd_omap_resume, */
+	.driver = {
+		.name		= "ehci-omap",
+	}
+};
+
+/*-------------------------------------------------------------------------*/
+
+static const struct hc_driver ehci_omap_hc_driver = {
+	.description		= hcd_name,
+	.product_desc		= "OMAP-EHCI Host Controller",
+	.hcd_priv_size		= sizeof(struct ehci_hcd),
+
+	/*
+	 * generic hardware linkage
+	 */
+	.irq			= ehci_irq,
+	.flags			= HCD_MEMORY | HCD_USB2,
+
+	/*
+	 * basic lifecycle operations
+	 */
+	.reset			= ehci_init,
+	.start			= ehci_run,
+	.stop			= ehci_stop,
+	.shutdown		= ehci_shutdown,
+
+	/*
+	 * managing i/o requests and associated device resources
+	 */
+	.urb_enqueue		= ehci_urb_enqueue,
+	.urb_dequeue		= ehci_urb_dequeue,
+	.endpoint_disable	= ehci_endpoint_disable,
+	.endpoint_reset		= ehci_endpoint_reset,
+
+	/*
+	 * scheduling support
+	 */
+	.get_frame_number	= ehci_get_frame,
+
+	/*
+	 * root hub support
+	 */
+	.hub_status_data	= ehci_hub_status_data,
+	.hub_control		= ehci_hub_control,
+	.bus_suspend		= ehci_bus_suspend,
+	.bus_resume		= ehci_bus_resume,
+
+	.clear_tt_buffer_complete = ehci_clear_tt_buffer_complete,
+};
+
+MODULE_ALIAS("platform:omap-ehci");
+MODULE_AUTHOR("Texas Instruments, Inc.");
+MODULE_AUTHOR("Felipe Balbi <felipe.balbi@nokia.com>");
+
diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
index 139a2cc3f641..89521775c567 100644
--- a/drivers/usb/host/ehci-q.c
+++ b/drivers/usb/host/ehci-q.c
@@ -616,9 +616,11 @@ qh_urb_transaction (
 ) {
 	struct ehci_qtd		*qtd, *qtd_prev;
 	dma_addr_t		buf;
-	int			len, maxpacket;
+	int			len, this_sg_len, maxpacket;
 	int			is_input;
 	u32			token;
+	int			i;
+	struct scatterlist	*sg;
 
 	/*
 	 * URBs map to sequences of QTDs:  one logical transaction
@@ -659,7 +661,20 @@ qh_urb_transaction (
 	/*
 	 * data transfer stage:  buffer setup
 	 */
-	buf = urb->transfer_dma;
+	i = urb->num_sgs;
+	if (len > 0 && i > 0) {
+		sg = urb->sg->sg;
+		buf = sg_dma_address(sg);
+
+		/* urb->transfer_buffer_length may be smaller than the
+		 * size of the scatterlist (or vice versa)
+		 */
+		this_sg_len = min_t(int, sg_dma_len(sg), len);
+	} else {
+		sg = NULL;
+		buf = urb->transfer_dma;
+		this_sg_len = len;
+	}
 
 	if (is_input)
 		token |= (1 /* "in" */ << 8);
@@ -675,7 +690,9 @@ qh_urb_transaction (
 	for (;;) {
 		int this_qtd_len;
 
-		this_qtd_len = qtd_fill(ehci, qtd, buf, len, token, maxpacket);
+		this_qtd_len = qtd_fill(ehci, qtd, buf, this_sg_len, token,
+				maxpacket);
+		this_sg_len -= this_qtd_len;
 		len -= this_qtd_len;
 		buf += this_qtd_len;
 
@@ -691,8 +708,13 @@ qh_urb_transaction (
 		if ((maxpacket & (this_qtd_len + (maxpacket - 1))) == 0)
 			token ^= QTD_TOGGLE;
 
-		if (likely (len <= 0))
-			break;
+		if (likely(this_sg_len <= 0)) {
+			if (--i <= 0 || len <= 0)
+				break;
+			sg = sg_next(sg);
+			buf = sg_dma_address(sg);
+			this_sg_len = min_t(int, sg_dma_len(sg), len);
+		}
 
 		qtd_prev = qtd;
 		qtd = ehci_qtd_alloc (ehci, flags);
@@ -827,9 +849,10 @@ qh_make (
 				 * But interval 1 scheduling is simpler, and
 				 * includes high bandwidth.
 				 */
-				dbg ("intr period %d uframes, NYET!",
-						urb->interval);
-				goto done;
+				urb->interval = 1;
+			} else if (qh->period > ehci->periodic_size) {
+				qh->period = ehci->periodic_size;
+				urb->interval = qh->period << 3;
 			}
 		} else {
 			int		think_time;
@@ -852,6 +875,10 @@ qh_make (
 					usb_calc_bus_time (urb->dev->speed,
 					is_input, 0, max_packet (maxp)));
 			qh->period = urb->interval;
+			if (qh->period > ehci->periodic_size) {
+				qh->period = ehci->periodic_size;
+				urb->interval = qh->period;
+			}
 		}
 	}
 
diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
index a5535b5e3fe2..1e391e624c8a 100644
--- a/drivers/usb/host/ehci-sched.c
+++ b/drivers/usb/host/ehci-sched.c
@@ -1385,7 +1385,7 @@ sitd_slot_ok (
  * given EHCI_TUNE_FLS and the slop).  Or, write a smarter scheduler!
  */
 
-#define SCHEDULE_SLOP	10	/* frames */
+#define SCHEDULE_SLOP	80	/* microframes */
 
 static int
 iso_stream_schedule (
@@ -1394,12 +1394,13 @@ iso_stream_schedule (
 	struct ehci_iso_stream	*stream
 )
 {
-	u32			now, start, max, period;
+	u32			now, next, start, period;
 	int			status;
 	unsigned		mod = ehci->periodic_size << 3;
 	struct ehci_iso_sched	*sched = urb->hcpriv;
+	struct pci_dev		*pdev;
 
-	if (sched->span > (mod - 8 * SCHEDULE_SLOP)) {
+	if (sched->span > (mod - SCHEDULE_SLOP)) {
 		ehci_dbg (ehci, "iso request %p too long\n", urb);
 		status = -EFBIG;
 		goto fail;
@@ -1418,26 +1419,35 @@ iso_stream_schedule (
 
 	now = ehci_readl(ehci, &ehci->regs->frame_index) % mod;
 
-	/* when's the last uframe this urb could start? */
-	max = now + mod;
-
 	/* Typical case: reuse current schedule, stream is still active.
 	 * Hopefully there are no gaps from the host falling behind
 	 * (irq delays etc), but if there are we'll take the next
 	 * slot in the schedule, implicitly assuming URB_ISO_ASAP.
 	 */
 	if (likely (!list_empty (&stream->td_list))) {
+		pdev = to_pci_dev(ehci_to_hcd(ehci)->self.controller);
 		start = stream->next_uframe;
-		if (start < now)
-			start += mod;
+
+		/* For high speed devices, allow scheduling within the
+		 * isochronous scheduling threshold.  For full speed devices,
+		 * don't. (Work around for Intel ICH9 bug.)
+		 */
+		if (!stream->highspeed &&
+				pdev->vendor == PCI_VENDOR_ID_INTEL)
+			next = now + ehci->i_thresh;
+		else
+			next = now;
 
 		/* Fell behind (by up to twice the slop amount)? */
-		if (start >= max - 2 * 8 * SCHEDULE_SLOP)
+		if (((start - next) & (mod - 1)) >=
+				mod - 2 * SCHEDULE_SLOP)
 			start += period * DIV_ROUND_UP(
-					max - start, period) - mod;
+					(next - start) & (mod - 1),
+					period);
 
 		/* Tried to schedule too far into the future? */
-		if (unlikely((start + sched->span) >= max)) {
+		if (unlikely(((start - now) & (mod - 1)) + sched->span
+					>= mod - 2 * SCHEDULE_SLOP)) {
 			status = -EFBIG;
 			goto fail;
 		}
@@ -1451,7 +1461,7 @@ iso_stream_schedule (
 	 * can also help high bandwidth if the dma and irq loads don't
 	 * jump until after the queue is primed.
 	 */
-	start = SCHEDULE_SLOP * 8 + (now & ~0x07);
+	start = SCHEDULE_SLOP + (now & ~0x07);
 	start %= mod;
 	stream->next_uframe = start;
 
@@ -1482,7 +1492,7 @@ iso_stream_schedule (
 	/* no room in the schedule */
 	ehci_dbg (ehci, "iso %ssched full %p (now %d max %d)\n",
 		list_empty (&stream->td_list) ? "" : "re",
-		urb, now, max);
+		urb, now, now + mod);
 	status = -ENOSPC;
 
 fail:
diff --git a/drivers/usb/host/ehci-xilinx-of.c b/drivers/usb/host/ehci-xilinx-of.c
new file mode 100644
index 000000000000..a5861531ad3e
--- /dev/null
+++ b/drivers/usb/host/ehci-xilinx-of.c
@@ -0,0 +1,300 @@
+/*
+ * EHCI HCD (Host Controller Driver) for USB.
+ *
+ * Bus Glue for Xilinx EHCI core on the of_platform bus
+ *
+ * Copyright (c) 2009 Xilinx, Inc.
+ *
+ * Based on "ehci-ppc-of.c" by Valentine Barshak <vbarshak@ru.mvista.com>
+ * and "ehci-ppc-soc.c" by Stefan Roese <sr@denx.de>
+ * and "ohci-ppc-of.c" by Sylvain Munaut <tnt@246tNt.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ *
+ */
+
+#include <linux/signal.h>
+
+#include <linux/of.h>
+#include <linux/of_platform.h>
+
+/**
+ * ehci_xilinx_of_setup - Initialize the device for ehci_reset()
+ * @hcd:	Pointer to the usb_hcd device to which the host controller bound
+ *
+ * called during probe() after chip reset completes.
+ */
+static int ehci_xilinx_of_setup(struct usb_hcd *hcd)
+{
+	struct ehci_hcd	*ehci = hcd_to_ehci(hcd);
+	int		retval;
+
+	retval = ehci_halt(ehci);
+	if (retval)
+		return retval;
+
+	retval = ehci_init(hcd);
+	if (retval)
+		return retval;
+
+	ehci->sbrn = 0x20;
+
+	return ehci_reset(ehci);
+}
+
+/**
+ * ehci_xilinx_port_handed_over - hand the port out if failed to enable it
+ * @hcd:	Pointer to the usb_hcd device to which the host controller bound
+ * @portnum:Port number to which the device is attached.
+ *
+ * This function is used as a place to tell the user that the Xilinx USB host
+ * controller does support LS devices. And in an HS only configuration, it
+ * does not support FS devices either. It is hoped that this can help a
+ * confused user.
+ *
+ * There are cases when the host controller fails to enable the port due to,
+ * for example, insufficient power that can be supplied to the device from
+ * the USB bus. In those cases, the messages printed here are not helpful.
+ */
+static int ehci_xilinx_port_handed_over(struct usb_hcd *hcd, int portnum)
+{
+	dev_warn(hcd->self.controller, "port %d cannot be enabled\n", portnum);
+	if (hcd->has_tt) {
+		dev_warn(hcd->self.controller,
+			"Maybe you have connected a low speed device?\n");
+
+		dev_warn(hcd->self.controller,
+			"We do not support low speed devices\n");
+	} else {
+		dev_warn(hcd->self.controller,
+			"Maybe your device is not a high speed device?\n");
+		dev_warn(hcd->self.controller,
+			"The USB host controller does not support full speed "
+			"nor low speed devices\n");
+		dev_warn(hcd->self.controller,
+			"You can reconfigure the host controller to have "
+			"full speed support\n");
+	}
+
+	return 0;
+}
+
+
+static const struct hc_driver ehci_xilinx_of_hc_driver = {
+	.description		= hcd_name,
+	.product_desc		= "OF EHCI",
+	.hcd_priv_size		= sizeof(struct ehci_hcd),
+
+	/*
+	 * generic hardware linkage
+	 */
+	.irq			= ehci_irq,
+	.flags			= HCD_MEMORY | HCD_USB2,
+
+	/*
+	 * basic lifecycle operations
+	 */
+	.reset			= ehci_xilinx_of_setup,
+	.start			= ehci_run,
+	.stop			= ehci_stop,
+	.shutdown		= ehci_shutdown,
+
+	/*
+	 * managing i/o requests and associated device resources
+	 */
+	.urb_enqueue		= ehci_urb_enqueue,
+	.urb_dequeue		= ehci_urb_dequeue,
+	.endpoint_disable	= ehci_endpoint_disable,
+
+	/*
+	 * scheduling support
+	 */
+	.get_frame_number	= ehci_get_frame,
+
+	/*
+	 * root hub support
+	 */
+	.hub_status_data	= ehci_hub_status_data,
+	.hub_control		= ehci_hub_control,
+#ifdef	CONFIG_PM
+	.bus_suspend		= ehci_bus_suspend,
+	.bus_resume		= ehci_bus_resume,
+#endif
+	.relinquish_port	= NULL,
+	.port_handed_over	= ehci_xilinx_port_handed_over,
+
+	.clear_tt_buffer_complete = ehci_clear_tt_buffer_complete,
+};
+
+/**
+ * ehci_hcd_xilinx_of_probe - Probe method for the USB host controller
+ * @op:		pointer to the of_device to which the host controller bound
+ * @match:	pointer to of_device_id structure, not used
+ *
+ * This function requests resources and sets up appropriate properties for the
+ * host controller. Because the Xilinx USB host controller can be configured
+ * as HS only or HS/FS only, it checks the configuration in the device tree
+ * entry, and sets an appropriate value for hcd->has_tt.
+ */
+static int __devinit
+ehci_hcd_xilinx_of_probe(struct of_device *op, const struct of_device_id *match)
+{
+	struct device_node *dn = op->node;
+	struct usb_hcd *hcd;
+	struct ehci_hcd	*ehci;
+	struct resource res;
+	int irq;
+	int rv;
+	int *value;
+
+	if (usb_disabled())
+		return -ENODEV;
+
+	dev_dbg(&op->dev, "initializing XILINX-OF USB Controller\n");
+
+	rv = of_address_to_resource(dn, 0, &res);
+	if (rv)
+		return rv;
+
+	hcd = usb_create_hcd(&ehci_xilinx_of_hc_driver, &op->dev,
+				"XILINX-OF USB");
+	if (!hcd)
+		return -ENOMEM;
+
+	hcd->rsrc_start = res.start;
+	hcd->rsrc_len = res.end - res.start + 1;
+
+	if (!request_mem_region(hcd->rsrc_start, hcd->rsrc_len, hcd_name)) {
+		printk(KERN_ERR __FILE__ ": request_mem_region failed\n");
+		rv = -EBUSY;
+		goto err_rmr;
+	}
+
+	irq = irq_of_parse_and_map(dn, 0);
+	if (irq == NO_IRQ) {
+		printk(KERN_ERR __FILE__ ": irq_of_parse_and_map failed\n");
+		rv = -EBUSY;
+		goto err_irq;
+	}
+
+	hcd->regs = ioremap(hcd->rsrc_start, hcd->rsrc_len);
+	if (!hcd->regs) {
+		printk(KERN_ERR __FILE__ ": ioremap failed\n");
+		rv = -ENOMEM;
+		goto err_ioremap;
+	}
+
+	ehci = hcd_to_ehci(hcd);
+
+	/* This core always has big-endian register interface and uses
+	 * big-endian memory descriptors.
+	 */
+	ehci->big_endian_mmio = 1;
+	ehci->big_endian_desc = 1;
+
+	/* Check whether the FS support option is selected in the hardware.
+	 */
+	value = (int *)of_get_property(dn, "xlnx,support-usb-fs", NULL);
+	if (value && (*value == 1)) {
+		ehci_dbg(ehci, "USB host controller supports FS devices\n");
+		hcd->has_tt = 1;
+	} else {
+		ehci_dbg(ehci,
+			"USB host controller is HS only\n");
+		hcd->has_tt = 0;
+	}
+
+	/* Debug registers are at the first 0x100 region
+	 */
+	ehci->caps = hcd->regs + 0x100;
+	ehci->regs = hcd->regs + 0x100 +
+			HC_LENGTH(ehci_readl(ehci, &ehci->caps->hc_capbase));
+
+	/* cache this readonly data; minimize chip reads */
+	ehci->hcs_params = ehci_readl(ehci, &ehci->caps->hcs_params);
+
+	rv = usb_add_hcd(hcd, irq, 0);
+	if (rv == 0)
+		return 0;
+
+	iounmap(hcd->regs);
+
+err_ioremap:
+err_irq:
+	release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+err_rmr:
+	usb_put_hcd(hcd);
+
+	return rv;
+}
+
+/**
+ * ehci_hcd_xilinx_of_remove - shutdown hcd and release resources
+ * @op:		pointer to of_device structure that is to be removed
+ *
+ * Remove the hcd structure, and release resources that has been requested
+ * during probe.
+ */
+static int ehci_hcd_xilinx_of_remove(struct of_device *op)
+{
+	struct usb_hcd *hcd = dev_get_drvdata(&op->dev);
+	dev_set_drvdata(&op->dev, NULL);
+
+	dev_dbg(&op->dev, "stopping XILINX-OF USB Controller\n");
+
+	usb_remove_hcd(hcd);
+
+	iounmap(hcd->regs);
+	release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
+
+	usb_put_hcd(hcd);
+
+	return 0;
+}
+
+/**
+ * ehci_hcd_xilinx_of_shutdown - shutdown the hcd
+ * @op:		pointer to of_device structure that is to be removed
+ *
+ * Properly shutdown the hcd, call driver's shutdown routine.
+ */
+static int ehci_hcd_xilinx_of_shutdown(struct of_device *op)
+{
+	struct usb_hcd *hcd = dev_get_drvdata(&op->dev);
+
+	if (hcd->driver->shutdown)
+		hcd->driver->shutdown(hcd);
+
+	return 0;
+}
+
+
+static struct of_device_id ehci_hcd_xilinx_of_match[] = {
+		{.compatible = "xlnx,xps-usb-host-1.00.a",},
+	{},
+};
+MODULE_DEVICE_TABLE(of, ehci_hcd_xilinx_of_match);
+
+static struct of_platform_driver ehci_hcd_xilinx_of_driver = {
+	.name		= "xilinx-of-ehci",
+	.match_table	= ehci_hcd_xilinx_of_match,
+	.probe		= ehci_hcd_xilinx_of_probe,
+	.remove		= ehci_hcd_xilinx_of_remove,
+	.shutdown	= ehci_hcd_xilinx_of_shutdown,
+	.driver		= {
+		.name	= "xilinx-of-ehci",
+		.owner	= THIS_MODULE,
+	},
+};
diff --git a/drivers/usb/host/fhci-hcd.c b/drivers/usb/host/fhci-hcd.c
index 0951818ef93b..78e7c3cfcb72 100644
--- a/drivers/usb/host/fhci-hcd.c
+++ b/drivers/usb/host/fhci-hcd.c
@@ -242,9 +242,10 @@ err:
 static void fhci_usb_free(void *lld)
 {
 	struct fhci_usb *usb = lld;
-	struct fhci_hcd *fhci = usb->fhci;
+	struct fhci_hcd *fhci;
 
 	if (usb) {
+		fhci = usb->fhci;
 		fhci_config_transceiver(fhci, FHCI_PORT_POWER_OFF);
 		fhci_ep0_free(usb);
 		kfree(usb->actual_frame);
diff --git a/drivers/usb/host/fhci-sched.c b/drivers/usb/host/fhci-sched.c
index 62a226b61670..ff43747a614f 100644
--- a/drivers/usb/host/fhci-sched.c
+++ b/drivers/usb/host/fhci-sched.c
@@ -37,7 +37,7 @@ static void recycle_frame(struct fhci_usb *usb, struct packet *pkt)
 	pkt->info = 0;
 	pkt->priv_data = NULL;
 
-	cq_put(usb->ep0->empty_frame_Q, pkt);
+	cq_put(&usb->ep0->empty_frame_Q, pkt);
 }
 
 /* confirm submitted packet */
@@ -57,7 +57,7 @@ void fhci_transaction_confirm(struct fhci_usb *usb, struct packet *pkt)
 		if ((td->data + td->actual_len) && trans_len)
 			memcpy(td->data + td->actual_len, pkt->data,
 			       trans_len);
-		cq_put(usb->ep0->dummy_packets_Q, pkt->data);
+		cq_put(&usb->ep0->dummy_packets_Q, pkt->data);
 	}
 
 	recycle_frame(usb, pkt);
@@ -213,7 +213,7 @@ static int add_packet(struct fhci_usb *usb, struct ed *ed, struct td *td)
 	}
 
 	/* update frame object fields before transmitting */
-	pkt = cq_get(usb->ep0->empty_frame_Q);
+	pkt = cq_get(&usb->ep0->empty_frame_Q);
 	if (!pkt) {
 		fhci_dbg(usb->fhci, "there is no empty frame\n");
 		return -1;
@@ -222,7 +222,7 @@ static int add_packet(struct fhci_usb *usb, struct ed *ed, struct td *td)
 
 	pkt->info = 0;
 	if (data == NULL) {
-		data = cq_get(usb->ep0->dummy_packets_Q);
+		data = cq_get(&usb->ep0->dummy_packets_Q);
 		BUG_ON(!data);
 		pkt->info = PKT_DUMMY_PACKET;
 	}
@@ -246,7 +246,7 @@ static int add_packet(struct fhci_usb *usb, struct ed *ed, struct td *td)
 		list_del_init(&td->frame_lh);
 		td->status = USB_TD_OK;
 		if (pkt->info & PKT_DUMMY_PACKET)
-			cq_put(usb->ep0->dummy_packets_Q, pkt->data);
+			cq_put(&usb->ep0->dummy_packets_Q, pkt->data);
 		recycle_frame(usb, pkt);
 		usb->actual_frame->total_bytes -= (len + PROTOCOL_OVERHEAD);
 		fhci_err(usb->fhci, "host transaction failed\n");
@@ -627,7 +627,7 @@ irqreturn_t fhci_irq(struct usb_hcd *hcd)
 
 
 /*
- * Process normal completions(error or sucess) and clean the schedule.
+ * Process normal completions(error or success) and clean the schedule.
  *
  * This is the main path for handing urbs back to drivers. The only other patth
  * is process_del_list(),which unlinks URBs by scanning EDs,instead of scanning
diff --git a/drivers/usb/host/fhci-tds.c b/drivers/usb/host/fhci-tds.c
index b40332290319..d224ab467a40 100644
--- a/drivers/usb/host/fhci-tds.c
+++ b/drivers/usb/host/fhci-tds.c
@@ -106,33 +106,33 @@ void fhci_ep0_free(struct fhci_usb *usb)
 			cpm_muram_free(cpm_muram_offset(ep->td_base));
 
 		if (ep->conf_frame_Q) {
-			size = cq_howmany(ep->conf_frame_Q);
+			size = cq_howmany(&ep->conf_frame_Q);
 			for (; size; size--) {
-				struct packet *pkt = cq_get(ep->conf_frame_Q);
+				struct packet *pkt = cq_get(&ep->conf_frame_Q);
 
 				kfree(pkt);
 			}
-			cq_delete(ep->conf_frame_Q);
+			cq_delete(&ep->conf_frame_Q);
 		}
 
 		if (ep->empty_frame_Q) {
-			size = cq_howmany(ep->empty_frame_Q);
+			size = cq_howmany(&ep->empty_frame_Q);
 			for (; size; size--) {
-				struct packet *pkt = cq_get(ep->empty_frame_Q);
+				struct packet *pkt = cq_get(&ep->empty_frame_Q);
 
 				kfree(pkt);
 			}
-			cq_delete(ep->empty_frame_Q);
+			cq_delete(&ep->empty_frame_Q);
 		}
 
 		if (ep->dummy_packets_Q) {
-			size = cq_howmany(ep->dummy_packets_Q);
+			size = cq_howmany(&ep->dummy_packets_Q);
 			for (; size; size--) {
-				u8 *buff = cq_get(ep->dummy_packets_Q);
+				u8 *buff = cq_get(&ep->dummy_packets_Q);
 
 				kfree(buff);
 			}
-			cq_delete(ep->dummy_packets_Q);
+			cq_delete(&ep->dummy_packets_Q);
 		}
 
 		kfree(ep);
@@ -175,10 +175,9 @@ u32 fhci_create_ep(struct fhci_usb *usb, enum fhci_mem_alloc data_mem,
 	ep->td_base = cpm_muram_addr(ep_offset);
 
 	/* zero all queue pointers */
-	ep->conf_frame_Q = cq_new(ring_len + 2);
-	ep->empty_frame_Q = cq_new(ring_len + 2);
-	ep->dummy_packets_Q = cq_new(ring_len + 2);
-	if (!ep->conf_frame_Q || !ep->empty_frame_Q || !ep->dummy_packets_Q) {
+	if (cq_new(&ep->conf_frame_Q, ring_len + 2) ||
+	    cq_new(&ep->empty_frame_Q, ring_len + 2) ||
+	    cq_new(&ep->dummy_packets_Q, ring_len + 2)) {
 		err_for = "frame_queues";
 		goto err;
 	}
@@ -199,8 +198,8 @@ u32 fhci_create_ep(struct fhci_usb *usb, enum fhci_mem_alloc data_mem,
 			err_for = "buffer";
 			goto err;
 		}
-		cq_put(ep->empty_frame_Q, pkt);
-		cq_put(ep->dummy_packets_Q, buff);
+		cq_put(&ep->empty_frame_Q, pkt);
+		cq_put(&ep->dummy_packets_Q, buff);
 	}
 
 	/* we put the endpoint parameter RAM right behind the TD ring */
@@ -319,7 +318,7 @@ static void fhci_td_transaction_confirm(struct fhci_usb *usb)
 		if ((buf == DUMMY2_BD_BUFFER) && !(td_status & ~TD_W))
 			continue;
 
-		pkt = cq_get(ep->conf_frame_Q);
+		pkt = cq_get(&ep->conf_frame_Q);
 		if (!pkt)
 			fhci_err(usb->fhci, "no frame to confirm\n");
 
@@ -460,9 +459,9 @@ u32 fhci_host_transaction(struct fhci_usb *usb,
 		out_be16(&td->length, pkt->len);
 
 	/* put the frame to the confirmation queue */
-	cq_put(ep->conf_frame_Q, pkt);
+	cq_put(&ep->conf_frame_Q, pkt);
 
-	if (cq_howmany(ep->conf_frame_Q) == 1)
+	if (cq_howmany(&ep->conf_frame_Q) == 1)
 		out_8(&usb->fhci->regs->usb_comm, USB_CMD_STR_FIFO);
 
 	return 0;
diff --git a/drivers/usb/host/fhci.h b/drivers/usb/host/fhci.h
index 7116284ed21a..72dae1c5ab38 100644
--- a/drivers/usb/host/fhci.h
+++ b/drivers/usb/host/fhci.h
@@ -423,9 +423,9 @@ struct endpoint {
 	struct usb_td __iomem *td_base; /* first TD in the ring */
 	struct usb_td __iomem *conf_td; /* next TD for confirm after transac */
 	struct usb_td __iomem *empty_td;/* next TD for new transaction req. */
-	struct kfifo *empty_frame_Q;  /* Empty frames list to use */
-	struct kfifo *conf_frame_Q;   /* frames passed to TDs,waiting for tx */
-	struct kfifo *dummy_packets_Q;/* dummy packets for the CRC overun */
+	struct kfifo empty_frame_Q;  /* Empty frames list to use */
+	struct kfifo conf_frame_Q;   /* frames passed to TDs,waiting for tx */
+	struct kfifo dummy_packets_Q;/* dummy packets for the CRC overun */
 
 	bool already_pushed_dummy_bd;
 };
@@ -493,9 +493,9 @@ static inline struct usb_hcd *fhci_to_hcd(struct fhci_hcd *fhci)
 }
 
 /* fifo of pointers */
-static inline struct kfifo *cq_new(int size)
+static inline int cq_new(struct kfifo *fifo, int size)
 {
-	return kfifo_alloc(size * sizeof(void *), GFP_KERNEL, NULL);
+	return kfifo_alloc(fifo, size * sizeof(void *), GFP_KERNEL);
 }
 
 static inline void cq_delete(struct kfifo *kfifo)
@@ -505,19 +505,19 @@ static inline void cq_delete(struct kfifo *kfifo)
 
 static inline unsigned int cq_howmany(struct kfifo *kfifo)
 {
-	return __kfifo_len(kfifo) / sizeof(void *);
+	return kfifo_len(kfifo) / sizeof(void *);
 }
 
 static inline int cq_put(struct kfifo *kfifo, void *p)
 {
-	return __kfifo_put(kfifo, (void *)&p, sizeof(p));
+	return kfifo_in(kfifo, (void *)&p, sizeof(p));
 }
 
 static inline void *cq_get(struct kfifo *kfifo)
 {
 	void *p = NULL;
 
-	__kfifo_get(kfifo, (void *)&p, sizeof(p));
+	kfifo_out(kfifo, (void *)&p, sizeof(p));
 	return p;
 }
 
diff --git a/drivers/usb/host/isp1362-hcd.c b/drivers/usb/host/isp1362-hcd.c
index 5c774ab98252..42971657fde2 100644
--- a/drivers/usb/host/isp1362-hcd.c
+++ b/drivers/usb/host/isp1362-hcd.c
@@ -80,7 +80,7 @@
 #include <linux/platform_device.h>
 #include <linux/pm.h>
 #include <linux/io.h>
-#include <linux/bitops.h>
+#include <linux/bitmap.h>
 
 #include <asm/irq.h>
 #include <asm/system.h>
@@ -190,10 +190,8 @@ static int claim_ptd_buffers(struct isp1362_ep_queue *epq,
 			     struct isp1362_ep *ep, u16 len)
 {
 	int ptd_offset = -EINVAL;
-	int index;
 	int num_ptds = ((len + PTD_HEADER_SIZE - 1) / epq->blk_size) + 1;
-	int found = -1;
-	int last = -1;
+	int found;
 
 	BUG_ON(len > epq->buf_size);
 
@@ -205,20 +203,9 @@ static int claim_ptd_buffers(struct isp1362_ep_queue *epq,
 		    epq->name, len, epq->blk_size, num_ptds, epq->buf_map, epq->skip_map);
 	BUG_ON(ep->num_ptds != 0);
 
-	for (index = 0; index <= epq->buf_count - num_ptds; index++) {
-		if (test_bit(index, &epq->buf_map))
-			continue;
-		found = index;
-		for (last = index + 1; last < index + num_ptds; last++) {
-			if (test_bit(last, &epq->buf_map)) {
-				found = -1;
-				break;
-			}
-		}
-		if (found >= 0)
-			break;
-	}
-	if (found < 0)
+	found = bitmap_find_next_zero_area(&epq->buf_map, epq->buf_count, 0,
+						num_ptds, 0);
+	if (found >= epq->buf_count)
 		return -EOVERFLOW;
 
 	DBG(1, "%s: Found %d PTDs[%d] for %d/%d byte\n", __func__,
@@ -230,8 +217,7 @@ static int claim_ptd_buffers(struct isp1362_ep_queue *epq,
 	epq->buf_avail -= num_ptds;
 	BUG_ON(epq->buf_avail > epq->buf_count);
 	ep->ptd_index = found;
-	for (index = found; index < last; index++)
-		__set_bit(index, &epq->buf_map);
+	bitmap_set(&epq->buf_map, found, num_ptds);
 	DBG(1, "%s: Done %s PTD[%d] $%04x, avail %d count %d claimed %d %08lx:%08lx\n",
 	    __func__, epq->name, ep->ptd_index, ep->ptd_offset,
 	    epq->buf_avail, epq->buf_count, num_ptds, epq->buf_map, epq->skip_map);
@@ -2284,10 +2270,10 @@ static int isp1362_mem_config(struct usb_hcd *hcd)
 	dev_info(hcd->self.controller, "ISP1362 Memory usage:\n");
 	dev_info(hcd->self.controller, "  ISTL:    2 * %4d:     %4d @ $%04x:$%04x\n",
 		 istl_size / 2, istl_size, 0, istl_size / 2);
-	dev_info(hcd->self.controller, "  INTL: %4d * (%3lu+8):  %4d @ $%04x\n",
+	dev_info(hcd->self.controller, "  INTL: %4d * (%3zu+8):  %4d @ $%04x\n",
 		 ISP1362_INTL_BUFFERS, intl_blksize - PTD_HEADER_SIZE,
 		 intl_size, istl_size);
-	dev_info(hcd->self.controller, "  ATL : %4d * (%3lu+8):  %4d @ $%04x\n",
+	dev_info(hcd->self.controller, "  ATL : %4d * (%3zu+8):  %4d @ $%04x\n",
 		 atl_buffers, atl_blksize - PTD_HEADER_SIZE,
 		 atl_size, istl_size + intl_size);
 	dev_info(hcd->self.controller, "  USED/FREE:   %4d      %4d\n", total,
@@ -2711,6 +2697,8 @@ static int __init isp1362_probe(struct platform_device *pdev)
 	void __iomem *data_reg;
 	int irq;
 	int retval = 0;
+	struct resource *irq_res;
+	unsigned int irq_flags = 0;
 
 	/* basic sanity checks first.  board-specific init logic should
 	 * have initialized this the three resources and probably board
@@ -2724,11 +2712,12 @@ static int __init isp1362_probe(struct platform_device *pdev)
 
 	data = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 	addr = platform_get_resource(pdev, IORESOURCE_MEM, 1);
-	irq = platform_get_irq(pdev, 0);
-	if (!addr || !data || irq < 0) {
+	irq_res = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+	if (!addr || !data || !irq_res) {
 		retval = -ENODEV;
 		goto err1;
 	}
+	irq = irq_res->start;
 
 #ifdef CONFIG_USB_HCD_DMA
 	if (pdev->dev.dma_mask) {
@@ -2795,12 +2784,16 @@ static int __init isp1362_probe(struct platform_device *pdev)
 	}
 #endif
 
-#ifdef CONFIG_ARM
-	if (isp1362_hcd->board)
-		set_irq_type(irq, isp1362_hcd->board->int_act_high ? IRQT_RISING : IRQT_FALLING);
-#endif
+	if (irq_res->flags & IORESOURCE_IRQ_HIGHEDGE)
+		irq_flags |= IRQF_TRIGGER_RISING;
+	if (irq_res->flags & IORESOURCE_IRQ_LOWEDGE)
+		irq_flags |= IRQF_TRIGGER_FALLING;
+	if (irq_res->flags & IORESOURCE_IRQ_HIGHLEVEL)
+		irq_flags |= IRQF_TRIGGER_HIGH;
+	if (irq_res->flags & IORESOURCE_IRQ_LOWLEVEL)
+		irq_flags |= IRQF_TRIGGER_LOW;
 
-	retval = usb_add_hcd(hcd, irq, IRQF_TRIGGER_LOW | IRQF_DISABLED | IRQF_SHARED);
+	retval = usb_add_hcd(hcd, irq, irq_flags | IRQF_DISABLED | IRQF_SHARED);
 	if (retval != 0)
 		goto err6;
 	pr_info("%s, irq %d\n", hcd->product_desc, irq);
diff --git a/drivers/usb/host/isp1362.h b/drivers/usb/host/isp1362.h
index 1a253ebf7e50..5151516ea1de 100644
--- a/drivers/usb/host/isp1362.h
+++ b/drivers/usb/host/isp1362.h
@@ -534,8 +534,8 @@ struct isp1362_hcd {
 
 	/* periodic schedule: isochronous */
 	struct list_head	isoc;
-	int			istl_flip:1;
-	int			irq_active:1;
+	unsigned int		istl_flip:1;
+	unsigned int		irq_active:1;
 
 	/* Schedules for the current frame */
 	struct isp1362_ep_queue atl_queue;
diff --git a/drivers/usb/host/isp1760-hcd.c b/drivers/usb/host/isp1760-hcd.c
index 9600a58299db..27b8f7cb4471 100644
--- a/drivers/usb/host/isp1760-hcd.c
+++ b/drivers/usb/host/isp1760-hcd.c
@@ -1039,12 +1039,12 @@ static void do_atl_int(struct usb_hcd *usb_hcd)
 		if (!nakcount && (dw3 & DW3_QTD_ACTIVE)) {
 			u32 buffstatus;
 
-			/* XXX
+			/*
 			 * NAKs are handled in HW by the chip. Usually if the
 			 * device is not able to send data fast enough.
-			 * This did not trigger for a long time now.
+			 * This happens mostly on slower hardware.
 			 */
-			printk(KERN_ERR "Reloading ptd %p/%p... qh %p readed: "
+			printk(KERN_NOTICE "Reloading ptd %p/%p... qh %p read: "
 					"%d of %zu done: %08x cur: %08x\n", qtd,
 					urb, qh, PTD_XFERRED_LENGTH(dw3),
 					qtd->length, done_map,
diff --git a/drivers/usb/host/ohci-at91.c b/drivers/usb/host/ohci-at91.c
index 7ccffcbe7b6f..68b83ab70719 100644
--- a/drivers/usb/host/ohci-at91.c
+++ b/drivers/usb/host/ohci-at91.c
@@ -35,7 +35,7 @@ extern int usb_disabled(void);
 
 static void at91_start_clock(void)
 {
-	if (cpu_is_at91sam9261())
+	if (cpu_is_at91sam9261() || cpu_is_at91sam9g10())
 		clk_enable(hclk);
 	clk_enable(iclk);
 	clk_enable(fclk);
@@ -46,7 +46,7 @@ static void at91_stop_clock(void)
 {
 	clk_disable(fclk);
 	clk_disable(iclk);
-	if (cpu_is_at91sam9261())
+	if (cpu_is_at91sam9261() || cpu_is_at91sam9g10())
 		clk_disable(hclk);
 	clocked = 0;
 }
@@ -142,7 +142,7 @@ static int usb_hcd_at91_probe(const struct hc_driver *driver,
 
 	iclk = clk_get(&pdev->dev, "ohci_clk");
 	fclk = clk_get(&pdev->dev, "uhpck");
-	if (cpu_is_at91sam9261())
+	if (cpu_is_at91sam9261() || cpu_is_at91sam9g10())
 		hclk = clk_get(&pdev->dev, "hck0");
 
 	at91_start_hc(pdev);
@@ -155,7 +155,7 @@ static int usb_hcd_at91_probe(const struct hc_driver *driver,
 	/* Error handling */
 	at91_stop_hc(pdev);
 
-	if (cpu_is_at91sam9261())
+	if (cpu_is_at91sam9261() || cpu_is_at91sam9g10())
 		clk_put(hclk);
 	clk_put(fclk);
 	clk_put(iclk);
@@ -192,7 +192,7 @@ static void usb_hcd_at91_remove(struct usb_hcd *hcd,
 	release_mem_region(hcd->rsrc_start, hcd->rsrc_len);
 	usb_put_hcd(hcd);
 
-	if (cpu_is_at91sam9261())
+	if (cpu_is_at91sam9261() || cpu_is_at91sam9g10())
 		clk_put(hclk);
 	clk_put(fclk);
 	clk_put(iclk);
diff --git a/drivers/usb/host/ohci-au1xxx.c b/drivers/usb/host/ohci-au1xxx.c
index e4380082ebb1..17a6043c1fa0 100644
--- a/drivers/usb/host/ohci-au1xxx.c
+++ b/drivers/usb/host/ohci-au1xxx.c
@@ -294,7 +294,7 @@ static int ohci_hcd_au1xxx_drv_resume(struct device *dev)
 	return 0;
 }
 
-static struct dev_pm_ops au1xxx_ohci_pmops = {
+static const struct dev_pm_ops au1xxx_ohci_pmops = {
 	.suspend	= ohci_hcd_au1xxx_drv_suspend,
 	.resume		= ohci_hcd_au1xxx_drv_resume,
 };
diff --git a/drivers/usb/host/ohci-pnx4008.c b/drivers/usb/host/ohci-pnx4008.c
index 100bf3d8437c..2769326da42e 100644
--- a/drivers/usb/host/ohci-pnx4008.c
+++ b/drivers/usb/host/ohci-pnx4008.c
@@ -98,8 +98,8 @@
 #define ISP1301_I2C_INTERRUPT_RISING 0xE
 #define ISP1301_I2C_REG_CLEAR_ADDR 1
 
-struct i2c_driver isp1301_driver;
-struct i2c_client *isp1301_i2c_client;
+static struct i2c_driver isp1301_driver;
+static struct i2c_client *isp1301_i2c_client;
 
 extern int usb_disabled(void);
 extern int ocpi_enable(void);
@@ -120,12 +120,12 @@ static int isp1301_remove(struct i2c_client *client)
 	return 0;
 }
 
-const struct i2c_device_id isp1301_id[] = {
+static const struct i2c_device_id isp1301_id[] = {
 	{ "isp1301_pnx", 0 },
 	{ }
 };
 
-struct i2c_driver isp1301_driver = {
+static struct i2c_driver isp1301_driver = {
 	.driver = {
 		.name = "isp1301_pnx",
 	},
diff --git a/drivers/usb/host/ohci-pxa27x.c b/drivers/usb/host/ohci-pxa27x.c
index f1c06202fdf2..a18debdd79b8 100644
--- a/drivers/usb/host/ohci-pxa27x.c
+++ b/drivers/usb/host/ohci-pxa27x.c
@@ -518,7 +518,7 @@ static int ohci_hcd_pxa27x_drv_resume(struct device *dev)
 	return 0;
 }
 
-static struct dev_pm_ops ohci_hcd_pxa27x_pm_ops = {
+static const struct dev_pm_ops ohci_hcd_pxa27x_pm_ops = {
 	.suspend	= ohci_hcd_pxa27x_drv_suspend,
 	.resume		= ohci_hcd_pxa27x_drv_resume,
 };
diff --git a/drivers/usb/host/r8a66597-hcd.c b/drivers/usb/host/r8a66597-hcd.c
index e33d36256350..b7a661c02bcd 100644
--- a/drivers/usb/host/r8a66597-hcd.c
+++ b/drivers/usb/host/r8a66597-hcd.c
@@ -822,8 +822,6 @@ static void force_dequeue(struct r8a66597 *r8a66597, u16 pipenum, u16 address)
 		return;
 
 	list_for_each_entry_safe(td, next, list, queue) {
-		if (!td)
-			continue;
 		if (td->address != address)
 			continue;
 
@@ -2025,8 +2023,6 @@ static struct r8a66597_device *get_r8a66597_device(struct r8a66597 *r8a66597,
 	struct list_head *list = &r8a66597->child_device;
 
 	list_for_each_entry(dev, list, device_list) {
-		if (!dev)
-			continue;
 		if (dev->usb_address != addr)
 			continue;
 
@@ -2357,7 +2353,7 @@ static int r8a66597_resume(struct device *dev)
 	return 0;
 }
 
-static struct dev_pm_ops r8a66597_dev_pm_ops = {
+static const struct dev_pm_ops r8a66597_dev_pm_ops = {
 	.suspend = r8a66597_suspend,
 	.resume = r8a66597_resume,
 	.poweroff = r8a66597_suspend,
diff --git a/drivers/usb/host/uhci-hcd.c b/drivers/usb/host/uhci-hcd.c
index 5cd0e48f67fb..99cd00fd3514 100644
--- a/drivers/usb/host/uhci-hcd.c
+++ b/drivers/usb/host/uhci-hcd.c
@@ -749,7 +749,20 @@ static int uhci_rh_suspend(struct usb_hcd *hcd)
 	spin_lock_irq(&uhci->lock);
 	if (!test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags))
 		rc = -ESHUTDOWN;
-	else if (!uhci->dead)
+	else if (uhci->dead)
+		;		/* Dead controllers tell no tales */
+
+	/* Once the controller is stopped, port resumes that are already
+	 * in progress won't complete.  Hence if remote wakeup is enabled
+	 * for the root hub and any ports are in the middle of a resume or
+	 * remote wakeup, we must fail the suspend.
+	 */
+	else if (hcd->self.root_hub->do_remote_wakeup &&
+			uhci->resuming_ports) {
+		dev_dbg(uhci_dev(uhci), "suspend failed because a port "
+				"is resuming\n");
+		rc = -EBUSY;
+	} else
 		suspend_rh(uhci, UHCI_RH_SUSPENDED);
 	spin_unlock_irq(&uhci->lock);
 	return rc;
diff --git a/drivers/usb/host/uhci-hub.c b/drivers/usb/host/uhci-hub.c
index 885b585360b9..8270055848ca 100644
--- a/drivers/usb/host/uhci-hub.c
+++ b/drivers/usb/host/uhci-hub.c
@@ -167,7 +167,7 @@ static void uhci_check_ports(struct uhci_hcd *uhci)
 				/* Port received a wakeup request */
 				set_bit(port, &uhci->resuming_ports);
 				uhci->ports_timeout = jiffies +
-						msecs_to_jiffies(20);
+						msecs_to_jiffies(25);
 
 				/* Make sure we see the port again
 				 * after the resuming period is over. */
diff --git a/drivers/usb/host/whci/debug.c b/drivers/usb/host/whci/debug.c
index 2273c815941f..8c1c610c9513 100644
--- a/drivers/usb/host/whci/debug.c
+++ b/drivers/usb/host/whci/debug.c
@@ -31,17 +31,29 @@ struct whc_dbg {
 
 void qset_print(struct seq_file *s, struct whc_qset *qset)
 {
+	static const char *qh_type[] = {
+		"ctrl", "isoc", "bulk", "intr", "rsvd", "rsvd", "rsvd", "lpintr", };
 	struct whc_std *std;
 	struct urb *urb = NULL;
 	int i;
 
-	seq_printf(s, "qset %08x\n", (u32)qset->qset_dma);
+	seq_printf(s, "qset %08x", (u32)qset->qset_dma);
+	if (&qset->list_node == qset->whc->async_list.prev) {
+		seq_printf(s, " (dummy)\n");
+	} else {
+		seq_printf(s, " ep%d%s-%s maxpkt: %d\n",
+			   qset->qh.info1 & 0x0f,
+			   (qset->qh.info1 >> 4) & 0x1 ? "in" : "out",
+			   qh_type[(qset->qh.info1 >> 5) & 0x7],
+			   (qset->qh.info1 >> 16) & 0xffff);
+	}
 	seq_printf(s, "  -> %08x\n", (u32)qset->qh.link);
 	seq_printf(s, "  info: %08x %08x %08x\n",
-		qset->qh.info1, qset->qh.info2,  qset->qh.info3);
-	seq_printf(s, "  sts: %04x errs: %d\n", qset->qh.status, qset->qh.err_count);
+		   qset->qh.info1, qset->qh.info2,  qset->qh.info3);
+	seq_printf(s, "  sts: %04x errs: %d curwin: %08x\n",
+		   qset->qh.status, qset->qh.err_count, qset->qh.cur_window);
 	seq_printf(s, "  TD: sts: %08x opts: %08x\n",
-		qset->qh.overlay.qtd.status, qset->qh.overlay.qtd.options);
+		   qset->qh.overlay.qtd.status, qset->qh.overlay.qtd.options);
 
 	for (i = 0; i < WHCI_QSET_TD_MAX; i++) {
 		seq_printf(s, "  %c%c TD[%d]: sts: %08x opts: %08x ptr: %08x\n",
diff --git a/drivers/usb/host/whci/hcd.c b/drivers/usb/host/whci/hcd.c
index 687b622a1612..e0d3401285c8 100644
--- a/drivers/usb/host/whci/hcd.c
+++ b/drivers/usb/host/whci/hcd.c
@@ -250,6 +250,7 @@ static int whc_probe(struct umc_dev *umc)
 	}
 
 	usb_hcd->wireless = 1;
+	usb_hcd->self.sg_tablesize = 2048; /* somewhat arbitrary */
 
 	wusbhc = usb_hcd_to_wusbhc(usb_hcd);
 	whc = wusbhc_to_whc(wusbhc);
diff --git a/drivers/usb/host/whci/qset.c b/drivers/usb/host/whci/qset.c
index 1b9dc1571570..7d4204db0f61 100644
--- a/drivers/usb/host/whci/qset.c
+++ b/drivers/usb/host/whci/qset.c
@@ -49,16 +49,19 @@ struct whc_qset *qset_alloc(struct whc *whc, gfp_t mem_flags)
  *        state
  * @urb:  an urb for a transfer to this endpoint
  */
-static void qset_fill_qh(struct whc_qset *qset, struct urb *urb)
+static void qset_fill_qh(struct whc *whc, struct whc_qset *qset, struct urb *urb)
 {
 	struct usb_device *usb_dev = urb->dev;
+	struct wusb_dev *wusb_dev = usb_dev->wusb_dev;
 	struct usb_wireless_ep_comp_descriptor *epcd;
 	bool is_out;
+	uint8_t phy_rate;
 
 	is_out = usb_pipeout(urb->pipe);
 
-	epcd = (struct usb_wireless_ep_comp_descriptor *)qset->ep->extra;
+	qset->max_packet = le16_to_cpu(urb->ep->desc.wMaxPacketSize);
 
+	epcd = (struct usb_wireless_ep_comp_descriptor *)qset->ep->extra;
 	if (epcd) {
 		qset->max_seq = epcd->bMaxSequence;
 		qset->max_burst = epcd->bMaxBurst;
@@ -67,12 +70,28 @@ static void qset_fill_qh(struct whc_qset *qset, struct urb *urb)
 		qset->max_burst = 1;
 	}
 
+	/*
+	 * Initial PHY rate is 53.3 Mbit/s for control endpoints or
+	 * the maximum supported by the device for other endpoints
+	 * (unless limited by the user).
+	 */
+	if (usb_pipecontrol(urb->pipe))
+		phy_rate = UWB_PHY_RATE_53;
+	else {
+		uint16_t phy_rates;
+
+		phy_rates = le16_to_cpu(wusb_dev->wusb_cap_descr->wPHYRates);
+		phy_rate = fls(phy_rates) - 1;
+		if (phy_rate > whc->wusbhc.phy_rate)
+			phy_rate = whc->wusbhc.phy_rate;
+	}
+
 	qset->qh.info1 = cpu_to_le32(
 		QH_INFO1_EP(usb_pipeendpoint(urb->pipe))
 		| (is_out ? QH_INFO1_DIR_OUT : QH_INFO1_DIR_IN)
 		| usb_pipe_to_qh_type(urb->pipe)
 		| QH_INFO1_DEV_INFO_IDX(wusb_port_no_to_idx(usb_dev->portnum))
-		| QH_INFO1_MAX_PKT_LEN(usb_maxpacket(urb->dev, urb->pipe, is_out))
+		| QH_INFO1_MAX_PKT_LEN(qset->max_packet)
 		);
 	qset->qh.info2 = cpu_to_le32(
 		QH_INFO2_BURST(qset->max_burst)
@@ -86,7 +105,7 @@ static void qset_fill_qh(struct whc_qset *qset, struct urb *urb)
 	 * strength and can presumably guess the Tx power required
 	 * from that? */
 	qset->qh.info3 = cpu_to_le32(
-		QH_INFO3_TX_RATE_53_3
+		QH_INFO3_TX_RATE(phy_rate)
 		| QH_INFO3_TX_PWR(0) /* 0 == max power */
 		);
 
@@ -148,7 +167,7 @@ struct whc_qset *get_qset(struct whc *whc, struct urb *urb,
 
 		qset->ep = urb->ep;
 		urb->ep->hcpriv = qset;
-		qset_fill_qh(qset, urb);
+		qset_fill_qh(whc, qset, urb);
 	}
 	return qset;
 }
@@ -241,6 +260,36 @@ static void qset_remove_qtd(struct whc *whc, struct whc_qset *qset)
 	qset->ntds--;
 }
 
+static void qset_copy_bounce_to_sg(struct whc *whc, struct whc_std *std)
+{
+	struct scatterlist *sg;
+	void *bounce;
+	size_t remaining, offset;
+
+	bounce = std->bounce_buf;
+	remaining = std->len;
+
+	sg = std->bounce_sg;
+	offset = std->bounce_offset;
+
+	while (remaining) {
+		size_t len;
+
+		len = min(sg->length - offset, remaining);
+		memcpy(sg_virt(sg) + offset, bounce, len);
+
+		bounce += len;
+		remaining -= len;
+
+		offset += len;
+		if (offset >= sg->length) {
+			sg = sg_next(sg);
+			offset = 0;
+		}
+	}
+
+}
+
 /**
  * qset_free_std - remove an sTD and free it.
  * @whc: the WHCI host controller
@@ -249,13 +298,29 @@ static void qset_remove_qtd(struct whc *whc, struct whc_qset *qset)
 void qset_free_std(struct whc *whc, struct whc_std *std)
 {
 	list_del(&std->list_node);
-	if (std->num_pointers) {
-		dma_unmap_single(whc->wusbhc.dev, std->dma_addr,
-				 std->num_pointers * sizeof(struct whc_page_list_entry),
-				 DMA_TO_DEVICE);
+	if (std->bounce_buf) {
+		bool is_out = usb_pipeout(std->urb->pipe);
+		dma_addr_t dma_addr;
+
+		if (std->num_pointers)
+			dma_addr = le64_to_cpu(std->pl_virt[0].buf_ptr);
+		else
+			dma_addr = std->dma_addr;
+
+		dma_unmap_single(whc->wusbhc.dev, dma_addr,
+				 std->len, is_out ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
+		if (!is_out)
+			qset_copy_bounce_to_sg(whc, std);
+		kfree(std->bounce_buf);
+	}
+	if (std->pl_virt) {
+		if (std->dma_addr)
+			dma_unmap_single(whc->wusbhc.dev, std->dma_addr,
+					 std->num_pointers * sizeof(struct whc_page_list_entry),
+					 DMA_TO_DEVICE);
 		kfree(std->pl_virt);
+		std->pl_virt = NULL;
 	}
-
 	kfree(std);
 }
 
@@ -293,12 +358,17 @@ static int qset_fill_page_list(struct whc *whc, struct whc_std *std, gfp_t mem_f
 {
 	dma_addr_t dma_addr = std->dma_addr;
 	dma_addr_t sp, ep;
-	size_t std_len = std->len;
 	size_t pl_len;
 	int p;
 
-	sp = ALIGN(dma_addr, WHCI_PAGE_SIZE);
-	ep = dma_addr + std_len;
+	/* Short buffers don't need a page list. */
+	if (std->len <= WHCI_PAGE_SIZE) {
+		std->num_pointers = 0;
+		return 0;
+	}
+
+	sp = dma_addr & ~(WHCI_PAGE_SIZE-1);
+	ep = dma_addr + std->len;
 	std->num_pointers = DIV_ROUND_UP(ep - sp, WHCI_PAGE_SIZE);
 
 	pl_len = std->num_pointers * sizeof(struct whc_page_list_entry);
@@ -309,7 +379,7 @@ static int qset_fill_page_list(struct whc *whc, struct whc_std *std, gfp_t mem_f
 
 	for (p = 0; p < std->num_pointers; p++) {
 		std->pl_virt[p].buf_ptr = cpu_to_le64(dma_addr);
-		dma_addr = ALIGN(dma_addr + WHCI_PAGE_SIZE, WHCI_PAGE_SIZE);
+		dma_addr = (dma_addr + WHCI_PAGE_SIZE) & ~(WHCI_PAGE_SIZE-1);
 	}
 
 	return 0;
@@ -339,6 +409,218 @@ static void urb_dequeue_work(struct work_struct *work)
 	spin_unlock_irqrestore(&whc->lock, flags);
 }
 
+static struct whc_std *qset_new_std(struct whc *whc, struct whc_qset *qset,
+				    struct urb *urb, gfp_t mem_flags)
+{
+	struct whc_std *std;
+
+	std = kzalloc(sizeof(struct whc_std), mem_flags);
+	if (std == NULL)
+		return NULL;
+
+	std->urb = urb;
+	std->qtd = NULL;
+
+	INIT_LIST_HEAD(&std->list_node);
+	list_add_tail(&std->list_node, &qset->stds);
+
+	return std;
+}
+
+static int qset_add_urb_sg(struct whc *whc, struct whc_qset *qset, struct urb *urb,
+			   gfp_t mem_flags)
+{
+	size_t remaining;
+	struct scatterlist *sg;
+	int i;
+	int ntds = 0;
+	struct whc_std *std = NULL;
+	struct whc_page_list_entry *entry;
+	dma_addr_t prev_end = 0;
+	size_t pl_len;
+	int p = 0;
+
+	remaining = urb->transfer_buffer_length;
+
+	for_each_sg(urb->sg->sg, sg, urb->num_sgs, i) {
+		dma_addr_t dma_addr;
+		size_t dma_remaining;
+		dma_addr_t sp, ep;
+		int num_pointers;
+
+		if (remaining == 0) {
+			break;
+		}
+
+		dma_addr = sg_dma_address(sg);
+		dma_remaining = min_t(size_t, sg_dma_len(sg), remaining);
+
+		while (dma_remaining) {
+			size_t dma_len;
+
+			/*
+			 * We can use the previous std (if it exists) provided that:
+			 * - the previous one ended on a page boundary.
+			 * - the current one begins on a page boundary.
+			 * - the previous one isn't full.
+			 *
+			 * If a new std is needed but the previous one
+			 * was not a whole number of packets then this
+			 * sg list cannot be mapped onto multiple
+			 * qTDs.  Return an error and let the caller
+			 * sort it out.
+			 */
+			if (!std
+			    || (prev_end & (WHCI_PAGE_SIZE-1))
+			    || (dma_addr & (WHCI_PAGE_SIZE-1))
+			    || std->len + WHCI_PAGE_SIZE > QTD_MAX_XFER_SIZE) {
+				if (std->len % qset->max_packet != 0)
+					return -EINVAL;
+				std = qset_new_std(whc, qset, urb, mem_flags);
+				if (std == NULL) {
+					return -ENOMEM;
+				}
+				ntds++;
+				p = 0;
+			}
+
+			dma_len = dma_remaining;
+
+			/*
+			 * If the remainder of this element doesn't
+			 * fit in a single qTD, limit the qTD to a
+			 * whole number of packets.  This allows the
+			 * remainder to go into the next qTD.
+			 */
+			if (std->len + dma_len > QTD_MAX_XFER_SIZE) {
+				dma_len = (QTD_MAX_XFER_SIZE / qset->max_packet)
+					* qset->max_packet - std->len;
+			}
+
+			std->len += dma_len;
+			std->ntds_remaining = -1; /* filled in later */
+
+			sp = dma_addr & ~(WHCI_PAGE_SIZE-1);
+			ep = dma_addr + dma_len;
+			num_pointers = DIV_ROUND_UP(ep - sp, WHCI_PAGE_SIZE);
+			std->num_pointers += num_pointers;
+
+			pl_len = std->num_pointers * sizeof(struct whc_page_list_entry);
+
+			std->pl_virt = krealloc(std->pl_virt, pl_len, mem_flags);
+			if (std->pl_virt == NULL) {
+				return -ENOMEM;
+			}
+
+			for (;p < std->num_pointers; p++, entry++) {
+				std->pl_virt[p].buf_ptr = cpu_to_le64(dma_addr);
+				dma_addr = (dma_addr + WHCI_PAGE_SIZE) & ~(WHCI_PAGE_SIZE-1);
+			}
+
+			prev_end = dma_addr = ep;
+			dma_remaining -= dma_len;
+			remaining -= dma_len;
+		}
+	}
+
+	/* Now the number of stds is know, go back and fill in
+	   std->ntds_remaining. */
+	list_for_each_entry(std, &qset->stds, list_node) {
+		if (std->ntds_remaining == -1) {
+			pl_len = std->num_pointers * sizeof(struct whc_page_list_entry);
+			std->ntds_remaining = ntds--;
+			std->dma_addr = dma_map_single(whc->wusbhc.dev, std->pl_virt,
+						       pl_len, DMA_TO_DEVICE);
+		}
+	}
+	return 0;
+}
+
+/**
+ * qset_add_urb_sg_linearize - add an urb with sg list, copying the data
+ *
+ * If the URB contains an sg list whose elements cannot be directly
+ * mapped to qTDs then the data must be transferred via bounce
+ * buffers.
+ */
+static int qset_add_urb_sg_linearize(struct whc *whc, struct whc_qset *qset,
+				     struct urb *urb, gfp_t mem_flags)
+{
+	bool is_out = usb_pipeout(urb->pipe);
+	size_t max_std_len;
+	size_t remaining;
+	int ntds = 0;
+	struct whc_std *std = NULL;
+	void *bounce = NULL;
+	struct scatterlist *sg;
+	int i;
+
+	/* limit maximum bounce buffer to 16 * 3.5 KiB ~= 28 k */
+	max_std_len = qset->max_burst * qset->max_packet;
+
+	remaining = urb->transfer_buffer_length;
+
+	for_each_sg(urb->sg->sg, sg, urb->sg->nents, i) {
+		size_t len;
+		size_t sg_remaining;
+		void *orig;
+
+		if (remaining == 0) {
+			break;
+		}
+
+		sg_remaining = min_t(size_t, remaining, sg->length);
+		orig = sg_virt(sg);
+
+		while (sg_remaining) {
+			if (!std || std->len == max_std_len) {
+				std = qset_new_std(whc, qset, urb, mem_flags);
+				if (std == NULL)
+					return -ENOMEM;
+				std->bounce_buf = kmalloc(max_std_len, mem_flags);
+				if (std->bounce_buf == NULL)
+					return -ENOMEM;
+				std->bounce_sg = sg;
+				std->bounce_offset = orig - sg_virt(sg);
+				bounce = std->bounce_buf;
+				ntds++;
+			}
+
+			len = min(sg_remaining, max_std_len - std->len);
+
+			if (is_out)
+				memcpy(bounce, orig, len);
+
+			std->len += len;
+			std->ntds_remaining = -1; /* filled in later */
+
+			bounce += len;
+			orig += len;
+			sg_remaining -= len;
+			remaining -= len;
+		}
+	}
+
+	/*
+	 * For each of the new sTDs, map the bounce buffers, create
+	 * page lists (if necessary), and fill in std->ntds_remaining.
+	 */
+	list_for_each_entry(std, &qset->stds, list_node) {
+		if (std->ntds_remaining != -1)
+			continue;
+
+		std->dma_addr = dma_map_single(&whc->umc->dev, std->bounce_buf, std->len,
+					       is_out ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
+
+		if (qset_fill_page_list(whc, std, mem_flags) < 0)
+			return -ENOMEM;
+
+		std->ntds_remaining = ntds--;
+	}
+
+	return 0;
+}
+
 /**
  * qset_add_urb - add an urb to the qset's queue.
  *
@@ -353,10 +635,7 @@ int qset_add_urb(struct whc *whc, struct whc_qset *qset, struct urb *urb,
 	int remaining = urb->transfer_buffer_length;
 	u64 transfer_dma = urb->transfer_dma;
 	int ntds_remaining;
-
-	ntds_remaining = DIV_ROUND_UP(remaining, QTD_MAX_XFER_SIZE);
-	if (ntds_remaining == 0)
-		ntds_remaining = 1;
+	int ret;
 
 	wurb = kzalloc(sizeof(struct whc_urb), mem_flags);
 	if (wurb == NULL)
@@ -366,32 +645,39 @@ int qset_add_urb(struct whc *whc, struct whc_qset *qset, struct urb *urb,
 	wurb->urb = urb;
 	INIT_WORK(&wurb->dequeue_work, urb_dequeue_work);
 
+	if (urb->sg) {
+		ret = qset_add_urb_sg(whc, qset, urb, mem_flags);
+		if (ret == -EINVAL) {
+			qset_free_stds(qset, urb);
+			ret = qset_add_urb_sg_linearize(whc, qset, urb, mem_flags);
+		}
+		if (ret < 0)
+			goto err_no_mem;
+		return 0;
+	}
+
+	ntds_remaining = DIV_ROUND_UP(remaining, QTD_MAX_XFER_SIZE);
+	if (ntds_remaining == 0)
+		ntds_remaining = 1;
+
 	while (ntds_remaining) {
 		struct whc_std *std;
 		size_t std_len;
 
-		std = kmalloc(sizeof(struct whc_std), mem_flags);
-		if (std == NULL)
-			goto err_no_mem;
-
 		std_len = remaining;
 		if (std_len > QTD_MAX_XFER_SIZE)
 			std_len = QTD_MAX_XFER_SIZE;
 
-		std->urb = urb;
+		std = qset_new_std(whc, qset, urb, mem_flags);
+		if (std == NULL)
+			goto err_no_mem;
+
 		std->dma_addr = transfer_dma;
 		std->len = std_len;
 		std->ntds_remaining = ntds_remaining;
-		std->qtd = NULL;
 
-		INIT_LIST_HEAD(&std->list_node);
-		list_add_tail(&std->list_node, &qset->stds);
-
-		if (std_len > WHCI_PAGE_SIZE) {
-			if (qset_fill_page_list(whc, std, mem_flags) < 0)
-				goto err_no_mem;
-		} else
-			std->num_pointers = 0;
+		if (qset_fill_page_list(whc, std, mem_flags) < 0)
+			goto err_no_mem;
 
 		ntds_remaining--;
 		remaining -= std_len;
diff --git a/drivers/usb/host/whci/whcd.h b/drivers/usb/host/whci/whcd.h
index 24e94d983c5e..c80c7d93bc4a 100644
--- a/drivers/usb/host/whci/whcd.h
+++ b/drivers/usb/host/whci/whcd.h
@@ -84,6 +84,11 @@ struct whc {
  * @len: the length of data in the associated TD.
  * @ntds_remaining: number of TDs (starting from this one) in this transfer.
  *
+ * @bounce_buf: a bounce buffer if the std was from an urb with a sg
+ * list that could not be mapped to qTDs directly.
+ * @bounce_sg: the first scatterlist element bounce_buf is for.
+ * @bounce_offset: the offset into bounce_sg for the start of bounce_buf.
+ *
  * Queued URBs may require more TDs than are available in a qset so we
  * use a list of these "software TDs" (sTDs) to hold per-TD data.
  */
@@ -97,6 +102,10 @@ struct whc_std {
 	int num_pointers;
 	dma_addr_t dma_addr;
 	struct whc_page_list_entry *pl_virt;
+
+	void *bounce_buf;
+	struct scatterlist *bounce_sg;
+	unsigned bounce_offset;
 };
 
 /**
diff --git a/drivers/usb/host/whci/whci-hc.h b/drivers/usb/host/whci/whci-hc.h
index e8d0001605be..4d4cbc0730bf 100644
--- a/drivers/usb/host/whci/whci-hc.h
+++ b/drivers/usb/host/whci/whci-hc.h
@@ -172,14 +172,7 @@ struct whc_qhead {
 #define QH_INFO3_MAX_DELAY(d)    ((d) << 0)  /* maximum stream delay in 125 us units (isoc only) */
 #define QH_INFO3_INTERVAL(i)     ((i) << 16) /* segment interval in 125 us units (isoc only) */
 
-#define QH_INFO3_TX_RATE_53_3    (0 << 24)
-#define QH_INFO3_TX_RATE_80      (1 << 24)
-#define QH_INFO3_TX_RATE_106_7   (2 << 24)
-#define QH_INFO3_TX_RATE_160     (3 << 24)
-#define QH_INFO3_TX_RATE_200     (4 << 24)
-#define QH_INFO3_TX_RATE_320     (5 << 24)
-#define QH_INFO3_TX_RATE_400     (6 << 24)
-#define QH_INFO3_TX_RATE_480     (7 << 24)
+#define QH_INFO3_TX_RATE(r)      ((r) << 24) /* PHY rate (see [ECMA-368] section 10.3.1.1) */
 #define QH_INFO3_TX_PWR(p)       ((p) << 29) /* transmit power (see [WUSB] section 5.2.1.2) */
 
 #define QH_STATUS_FLOW_CTRL      (1 << 15)
@@ -267,8 +260,9 @@ struct whc_qset {
 	unsigned reset:1;
 	struct urb *pause_after_urb;
 	struct completion remove_complete;
-	int max_burst;
-	int max_seq;
+	uint16_t max_packet;
+	uint8_t max_burst;
+	uint8_t max_seq;
 };
 
 static inline void whc_qset_set_link_ptr(u64 *ptr, u64 target)
diff --git a/drivers/usb/host/xhci-hcd.c b/drivers/usb/host/xhci-hcd.c
index 932f99938481..5e92c72df642 100644
--- a/drivers/usb/host/xhci-hcd.c
+++ b/drivers/usb/host/xhci-hcd.c
@@ -67,22 +67,14 @@ static int handshake(struct xhci_hcd *xhci, void __iomem *ptr,
 }
 
 /*
- * Force HC into halt state.
- *
- * Disable any IRQs and clear the run/stop bit.
- * HC will complete any current and actively pipelined transactions, and
- * should halt within 16 microframes of the run/stop bit being cleared.
- * Read HC Halted bit in the status register to see when the HC is finished.
- * XXX: shouldn't we set HC_STATE_HALT here somewhere?
+ * Disable interrupts and begin the xHCI halting process.
  */
-int xhci_halt(struct xhci_hcd *xhci)
+void xhci_quiesce(struct xhci_hcd *xhci)
 {
 	u32 halted;
 	u32 cmd;
 	u32 mask;
 
-	xhci_dbg(xhci, "// Halt the HC\n");
-	/* Disable all interrupts from the host controller */
 	mask = ~(XHCI_IRQS);
 	halted = xhci_readl(xhci, &xhci->op_regs->status) & STS_HALT;
 	if (!halted)
@@ -91,6 +83,21 @@ int xhci_halt(struct xhci_hcd *xhci)
 	cmd = xhci_readl(xhci, &xhci->op_regs->command);
 	cmd &= mask;
 	xhci_writel(xhci, cmd, &xhci->op_regs->command);
+}
+
+/*
+ * Force HC into halt state.
+ *
+ * Disable any IRQs and clear the run/stop bit.
+ * HC will complete any current and actively pipelined transactions, and
+ * should halt within 16 microframes of the run/stop bit being cleared.
+ * Read HC Halted bit in the status register to see when the HC is finished.
+ * XXX: shouldn't we set HC_STATE_HALT here somewhere?
+ */
+int xhci_halt(struct xhci_hcd *xhci)
+{
+	xhci_dbg(xhci, "// Halt the HC\n");
+	xhci_quiesce(xhci);
 
 	return handshake(xhci, &xhci->op_regs->status,
 			STS_HALT, STS_HALT, XHCI_MAX_HALT_USEC);
@@ -124,28 +131,6 @@ int xhci_reset(struct xhci_hcd *xhci)
 	return handshake(xhci, &xhci->op_regs->command, CMD_RESET, 0, 250 * 1000);
 }
 
-/*
- * Stop the HC from processing the endpoint queues.
- */
-static void xhci_quiesce(struct xhci_hcd *xhci)
-{
-	/*
-	 * Queues are per endpoint, so we need to disable an endpoint or slot.
-	 *
-	 * To disable a slot, we need to insert a disable slot command on the
-	 * command ring and ring the doorbell.  This will also free any internal
-	 * resources associated with the slot (which might not be what we want).
-	 *
-	 * A Release Endpoint command sounds better - doesn't free internal HC
-	 * memory, but removes the endpoints from the schedule and releases the
-	 * bandwidth, disables the doorbells, and clears the endpoint enable
-	 * flag.  Usually used prior to a set interface command.
-	 *
-	 * TODO: Implement after command ring code is done.
-	 */
-	BUG_ON(!HC_IS_RUNNING(xhci_to_hcd(xhci)->state));
-	xhci_dbg(xhci, "Finished quiescing -- code not written yet\n");
-}
 
 #if 0
 /* Set up MSI-X table for entry 0 (may claim other entries later) */
@@ -261,8 +246,14 @@ static void xhci_work(struct xhci_hcd *xhci)
 	/* Flush posted writes */
 	xhci_readl(xhci, &xhci->ir_set->irq_pending);
 
-	/* FIXME this should be a delayed service routine that clears the EHB */
-	xhci_handle_event(xhci);
+	if (xhci->xhc_state & XHCI_STATE_DYING)
+		xhci_dbg(xhci, "xHCI dying, ignoring interrupt. "
+				"Shouldn't IRQs be disabled?\n");
+	else
+		/* FIXME this should be a delayed service routine
+		 * that clears the EHB.
+		 */
+		xhci_handle_event(xhci);
 
 	/* Clear the event handler busy flag (RW1C); the event ring should be empty. */
 	temp_64 = xhci_read_64(xhci, &xhci->ir_set->erst_dequeue);
@@ -335,7 +326,7 @@ void xhci_event_ring_work(unsigned long arg)
 	spin_lock_irqsave(&xhci->lock, flags);
 	temp = xhci_readl(xhci, &xhci->op_regs->status);
 	xhci_dbg(xhci, "op reg status = 0x%x\n", temp);
-	if (temp == 0xffffffff) {
+	if (temp == 0xffffffff || (xhci->xhc_state & XHCI_STATE_DYING)) {
 		xhci_dbg(xhci, "HW died, polling stopped.\n");
 		spin_unlock_irqrestore(&xhci->lock, flags);
 		return;
@@ -490,8 +481,6 @@ void xhci_stop(struct usb_hcd *hcd)
 	struct xhci_hcd *xhci = hcd_to_xhci(hcd);
 
 	spin_lock_irq(&xhci->lock);
-	if (HC_IS_RUNNING(hcd->state))
-		xhci_quiesce(xhci);
 	xhci_halt(xhci);
 	xhci_reset(xhci);
 	spin_unlock_irq(&xhci->lock);
@@ -727,16 +716,22 @@ int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flags)
 		 * atomic context to this function, which may allocate memory.
 		 */
 		spin_lock_irqsave(&xhci->lock, flags);
+		if (xhci->xhc_state & XHCI_STATE_DYING)
+			goto dying;
 		ret = xhci_queue_ctrl_tx(xhci, GFP_ATOMIC, urb,
 				slot_id, ep_index);
 		spin_unlock_irqrestore(&xhci->lock, flags);
 	} else if (usb_endpoint_xfer_bulk(&urb->ep->desc)) {
 		spin_lock_irqsave(&xhci->lock, flags);
+		if (xhci->xhc_state & XHCI_STATE_DYING)
+			goto dying;
 		ret = xhci_queue_bulk_tx(xhci, GFP_ATOMIC, urb,
 				slot_id, ep_index);
 		spin_unlock_irqrestore(&xhci->lock, flags);
 	} else if (usb_endpoint_xfer_int(&urb->ep->desc)) {
 		spin_lock_irqsave(&xhci->lock, flags);
+		if (xhci->xhc_state & XHCI_STATE_DYING)
+			goto dying;
 		ret = xhci_queue_intr_tx(xhci, GFP_ATOMIC, urb,
 				slot_id, ep_index);
 		spin_unlock_irqrestore(&xhci->lock, flags);
@@ -745,6 +740,12 @@ int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flags)
 	}
 exit:
 	return ret;
+dying:
+	xhci_dbg(xhci, "Ep 0x%x: URB %p submitted for "
+			"non-responsive xHCI host.\n",
+			urb->ep->desc.bEndpointAddress, urb);
+	spin_unlock_irqrestore(&xhci->lock, flags);
+	return -ESHUTDOWN;
 }
 
 /*
@@ -806,6 +807,17 @@ int xhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
 		kfree(td);
 		return ret;
 	}
+	if (xhci->xhc_state & XHCI_STATE_DYING) {
+		xhci_dbg(xhci, "Ep 0x%x: URB %p to be canceled on "
+				"non-responsive xHCI host.\n",
+				urb->ep->desc.bEndpointAddress, urb);
+		/* Let the stop endpoint command watchdog timer (which set this
+		 * state) finish cleaning up the endpoint TD lists.  We must
+		 * have caught it in the middle of dropping a lock and giving
+		 * back an URB.
+		 */
+		goto done;
+	}
 
 	xhci_dbg(xhci, "Cancel URB %p\n", urb);
 	xhci_dbg(xhci, "Event ring:\n");
@@ -817,12 +829,16 @@ int xhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
 	xhci_debug_ring(xhci, ep_ring);
 	td = (struct xhci_td *) urb->hcpriv;
 
-	ep->cancels_pending++;
 	list_add_tail(&td->cancelled_td_list, &ep->cancelled_td_list);
 	/* Queue a stop endpoint command, but only if this is
 	 * the first cancellation to be handled.
 	 */
-	if (ep->cancels_pending == 1) {
+	if (!(ep->ep_state & EP_HALT_PENDING)) {
+		ep->ep_state |= EP_HALT_PENDING;
+		ep->stop_cmds_pending++;
+		ep->stop_cmd_timer.expires = jiffies +
+			XHCI_STOP_EP_CMD_TIMEOUT * HZ;
+		add_timer(&ep->stop_cmd_timer);
 		xhci_queue_stop_endpoint(xhci, urb->dev->slot_id, ep_index);
 		xhci_ring_cmd_db(xhci);
 	}
@@ -1246,13 +1262,35 @@ int xhci_check_bandwidth(struct usb_hcd *hcd, struct usb_device *udev)
 			LAST_CTX_TO_EP_NUM(slot_ctx->dev_info));
 
 	xhci_zero_in_ctx(xhci, virt_dev);
-	/* Free any old rings */
+	/* Install new rings and free or cache any old rings */
 	for (i = 1; i < 31; ++i) {
-		if (virt_dev->eps[i].new_ring) {
-			xhci_ring_free(xhci, virt_dev->eps[i].ring);
-			virt_dev->eps[i].ring = virt_dev->eps[i].new_ring;
-			virt_dev->eps[i].new_ring = NULL;
+		int rings_cached;
+
+		if (!virt_dev->eps[i].new_ring)
+			continue;
+		/* Only cache or free the old ring if it exists.
+		 * It may not if this is the first add of an endpoint.
+		 */
+		if (virt_dev->eps[i].ring) {
+			rings_cached = virt_dev->num_rings_cached;
+			if (rings_cached < XHCI_MAX_RINGS_CACHED) {
+				virt_dev->num_rings_cached++;
+				rings_cached = virt_dev->num_rings_cached;
+				virt_dev->ring_cache[rings_cached] =
+					virt_dev->eps[i].ring;
+				xhci_dbg(xhci, "Cached old ring, "
+						"%d ring%s cached\n",
+						rings_cached,
+						(rings_cached > 1) ? "s" : "");
+			} else {
+				xhci_ring_free(xhci, virt_dev->eps[i].ring);
+				xhci_dbg(xhci, "Ring cache full (%d rings), "
+						"freeing ring\n",
+						virt_dev->num_rings_cached);
+			}
 		}
+		virt_dev->eps[i].ring = virt_dev->eps[i].new_ring;
+		virt_dev->eps[i].new_ring = NULL;
 	}
 
 	return ret;
@@ -1427,16 +1465,27 @@ void xhci_endpoint_reset(struct usb_hcd *hcd,
 void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev)
 {
 	struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+	struct xhci_virt_device *virt_dev;
 	unsigned long flags;
 	u32 state;
+	int i;
 
 	if (udev->slot_id == 0)
 		return;
+	virt_dev = xhci->devs[udev->slot_id];
+	if (!virt_dev)
+		return;
+
+	/* Stop any wayward timer functions (which may grab the lock) */
+	for (i = 0; i < 31; ++i) {
+		virt_dev->eps[i].ep_state &= ~EP_HALT_PENDING;
+		del_timer_sync(&virt_dev->eps[i].stop_cmd_timer);
+	}
 
 	spin_lock_irqsave(&xhci->lock, flags);
 	/* Don't disable the slot if the host controller is dead. */
 	state = xhci_readl(xhci, &xhci->op_regs->status);
-	if (state == 0xffffffff) {
+	if (state == 0xffffffff || (xhci->xhc_state & XHCI_STATE_DYING)) {
 		xhci_free_virt_device(xhci, udev->slot_id);
 		spin_unlock_irqrestore(&xhci->lock, flags);
 		return;
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index b8fd270a8b0d..bffcef7a5545 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -125,6 +125,23 @@ void xhci_ring_free(struct xhci_hcd *xhci, struct xhci_ring *ring)
 	kfree(ring);
 }
 
+static void xhci_initialize_ring_info(struct xhci_ring *ring)
+{
+	/* The ring is empty, so the enqueue pointer == dequeue pointer */
+	ring->enqueue = ring->first_seg->trbs;
+	ring->enq_seg = ring->first_seg;
+	ring->dequeue = ring->enqueue;
+	ring->deq_seg = ring->first_seg;
+	/* The ring is initialized to 0. The producer must write 1 to the cycle
+	 * bit to handover ownership of the TRB, so PCS = 1.  The consumer must
+	 * compare CCS to the cycle bit to check ownership, so CCS = 1.
+	 */
+	ring->cycle_state = 1;
+	/* Not necessary for new rings, but needed for re-initialized rings */
+	ring->enq_updates = 0;
+	ring->deq_updates = 0;
+}
+
 /**
  * Create a new ring with zero or more segments.
  *
@@ -173,17 +190,7 @@ static struct xhci_ring *xhci_ring_alloc(struct xhci_hcd *xhci,
 				" segment %p (virtual), 0x%llx (DMA)\n",
 				prev, (unsigned long long)prev->dma);
 	}
-	/* The ring is empty, so the enqueue pointer == dequeue pointer */
-	ring->enqueue = ring->first_seg->trbs;
-	ring->enq_seg = ring->first_seg;
-	ring->dequeue = ring->enqueue;
-	ring->deq_seg = ring->first_seg;
-	/* The ring is initialized to 0. The producer must write 1 to the cycle
-	 * bit to handover ownership of the TRB, so PCS = 1.  The consumer must
-	 * compare CCS to the cycle bit to check ownership, so CCS = 1.
-	 */
-	ring->cycle_state = 1;
-
+	xhci_initialize_ring_info(ring);
 	return ring;
 
 fail:
@@ -191,6 +198,27 @@ fail:
 	return 0;
 }
 
+/* Zero an endpoint ring (except for link TRBs) and move the enqueue and dequeue
+ * pointers to the beginning of the ring.
+ */
+static void xhci_reinit_cached_ring(struct xhci_hcd *xhci,
+		struct xhci_ring *ring)
+{
+	struct xhci_segment	*seg = ring->first_seg;
+	do {
+		memset(seg->trbs, 0,
+				sizeof(union xhci_trb)*TRBS_PER_SEGMENT);
+		/* All endpoint rings have link TRBs */
+		xhci_link_segments(xhci, seg, seg->next, 1);
+		seg = seg->next;
+	} while (seg != ring->first_seg);
+	xhci_initialize_ring_info(ring);
+	/* td list should be empty since all URBs have been cancelled,
+	 * but just in case...
+	 */
+	INIT_LIST_HEAD(&ring->td_list);
+}
+
 #define CTX_SIZE(_hcc) (HCC_64BYTE_CONTEXT(_hcc) ? 64 : 32)
 
 struct xhci_container_ctx *xhci_alloc_container_ctx(struct xhci_hcd *xhci,
@@ -248,6 +276,15 @@ struct xhci_ep_ctx *xhci_get_ep_ctx(struct xhci_hcd *xhci,
 		(ctx->bytes + (ep_index * CTX_SIZE(xhci->hcc_params)));
 }
 
+static void xhci_init_endpoint_timer(struct xhci_hcd *xhci,
+		struct xhci_virt_ep *ep)
+{
+	init_timer(&ep->stop_cmd_timer);
+	ep->stop_cmd_timer.data = (unsigned long) ep;
+	ep->stop_cmd_timer.function = xhci_stop_endpoint_command_watchdog;
+	ep->xhci = xhci;
+}
+
 /* All the xhci_tds in the ring's TD list should be freed at this point */
 void xhci_free_virt_device(struct xhci_hcd *xhci, int slot_id)
 {
@@ -267,6 +304,12 @@ void xhci_free_virt_device(struct xhci_hcd *xhci, int slot_id)
 		if (dev->eps[i].ring)
 			xhci_ring_free(xhci, dev->eps[i].ring);
 
+	if (dev->ring_cache) {
+		for (i = 0; i < dev->num_rings_cached; i++)
+			xhci_ring_free(xhci, dev->ring_cache[i]);
+		kfree(dev->ring_cache);
+	}
+
 	if (dev->in_ctx)
 		xhci_free_container_ctx(xhci, dev->in_ctx);
 	if (dev->out_ctx)
@@ -309,15 +352,25 @@ int xhci_alloc_virt_device(struct xhci_hcd *xhci, int slot_id,
 	xhci_dbg(xhci, "Slot %d input ctx = 0x%llx (dma)\n", slot_id,
 			(unsigned long long)dev->in_ctx->dma);
 
-	/* Initialize the cancellation list for each endpoint */
-	for (i = 0; i < 31; i++)
+	/* Initialize the cancellation list and watchdog timers for each ep */
+	for (i = 0; i < 31; i++) {
+		xhci_init_endpoint_timer(xhci, &dev->eps[i]);
 		INIT_LIST_HEAD(&dev->eps[i].cancelled_td_list);
+	}
 
 	/* Allocate endpoint 0 ring */
 	dev->eps[0].ring = xhci_ring_alloc(xhci, 1, true, flags);
 	if (!dev->eps[0].ring)
 		goto fail;
 
+	/* Allocate pointers to the ring cache */
+	dev->ring_cache = kzalloc(
+			sizeof(struct xhci_ring *)*XHCI_MAX_RINGS_CACHED,
+			flags);
+	if (!dev->ring_cache)
+		goto fail;
+	dev->num_rings_cached = 0;
+
 	init_completion(&dev->cmd_completion);
 	INIT_LIST_HEAD(&dev->cmd_list);
 
@@ -544,8 +597,16 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
 	/* Set up the endpoint ring */
 	virt_dev->eps[ep_index].new_ring =
 		xhci_ring_alloc(xhci, 1, true, mem_flags);
-	if (!virt_dev->eps[ep_index].new_ring)
-		return -ENOMEM;
+	if (!virt_dev->eps[ep_index].new_ring) {
+		/* Attempt to use the ring cache */
+		if (virt_dev->num_rings_cached == 0)
+			return -ENOMEM;
+		virt_dev->eps[ep_index].new_ring =
+			virt_dev->ring_cache[virt_dev->num_rings_cached];
+		virt_dev->ring_cache[virt_dev->num_rings_cached] = NULL;
+		virt_dev->num_rings_cached--;
+		xhci_reinit_cached_ring(xhci, virt_dev->eps[ep_index].new_ring);
+	}
 	ep_ring = virt_dev->eps[ep_index].new_ring;
 	ep_ctx->deq = ep_ring->first_seg->dma | ep_ring->cycle_state;
 
@@ -768,14 +829,17 @@ struct xhci_command *xhci_alloc_command(struct xhci_hcd *xhci,
 
 	command->in_ctx =
 		xhci_alloc_container_ctx(xhci, XHCI_CTX_TYPE_INPUT, mem_flags);
-	if (!command->in_ctx)
+	if (!command->in_ctx) {
+		kfree(command);
 		return NULL;
+	}
 
 	if (allocate_completion) {
 		command->completion =
 			kzalloc(sizeof(struct completion), mem_flags);
 		if (!command->completion) {
 			xhci_free_container_ctx(xhci, command->in_ctx);
+			kfree(command);
 			return NULL;
 		}
 		init_completion(command->completion);
@@ -848,6 +912,163 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
 	xhci->page_shift = 0;
 }
 
+static int xhci_test_trb_in_td(struct xhci_hcd *xhci,
+		struct xhci_segment *input_seg,
+		union xhci_trb *start_trb,
+		union xhci_trb *end_trb,
+		dma_addr_t input_dma,
+		struct xhci_segment *result_seg,
+		char *test_name, int test_number)
+{
+	unsigned long long start_dma;
+	unsigned long long end_dma;
+	struct xhci_segment *seg;
+
+	start_dma = xhci_trb_virt_to_dma(input_seg, start_trb);
+	end_dma = xhci_trb_virt_to_dma(input_seg, end_trb);
+
+	seg = trb_in_td(input_seg, start_trb, end_trb, input_dma);
+	if (seg != result_seg) {
+		xhci_warn(xhci, "WARN: %s TRB math test %d failed!\n",
+				test_name, test_number);
+		xhci_warn(xhci, "Tested TRB math w/ seg %p and "
+				"input DMA 0x%llx\n",
+				input_seg,
+				(unsigned long long) input_dma);
+		xhci_warn(xhci, "starting TRB %p (0x%llx DMA), "
+				"ending TRB %p (0x%llx DMA)\n",
+				start_trb, start_dma,
+				end_trb, end_dma);
+		xhci_warn(xhci, "Expected seg %p, got seg %p\n",
+				result_seg, seg);
+		return -1;
+	}
+	return 0;
+}
+
+/* TRB math checks for xhci_trb_in_td(), using the command and event rings. */
+static int xhci_check_trb_in_td_math(struct xhci_hcd *xhci, gfp_t mem_flags)
+{
+	struct {
+		dma_addr_t		input_dma;
+		struct xhci_segment	*result_seg;
+	} simple_test_vector [] = {
+		/* A zeroed DMA field should fail */
+		{ 0, NULL },
+		/* One TRB before the ring start should fail */
+		{ xhci->event_ring->first_seg->dma - 16, NULL },
+		/* One byte before the ring start should fail */
+		{ xhci->event_ring->first_seg->dma - 1, NULL },
+		/* Starting TRB should succeed */
+		{ xhci->event_ring->first_seg->dma, xhci->event_ring->first_seg },
+		/* Ending TRB should succeed */
+		{ xhci->event_ring->first_seg->dma + (TRBS_PER_SEGMENT - 1)*16,
+			xhci->event_ring->first_seg },
+		/* One byte after the ring end should fail */
+		{ xhci->event_ring->first_seg->dma + (TRBS_PER_SEGMENT - 1)*16 + 1, NULL },
+		/* One TRB after the ring end should fail */
+		{ xhci->event_ring->first_seg->dma + (TRBS_PER_SEGMENT)*16, NULL },
+		/* An address of all ones should fail */
+		{ (dma_addr_t) (~0), NULL },
+	};
+	struct {
+		struct xhci_segment	*input_seg;
+		union xhci_trb		*start_trb;
+		union xhci_trb		*end_trb;
+		dma_addr_t		input_dma;
+		struct xhci_segment	*result_seg;
+	} complex_test_vector [] = {
+		/* Test feeding a valid DMA address from a different ring */
+		{	.input_seg = xhci->event_ring->first_seg,
+			.start_trb = xhci->event_ring->first_seg->trbs,
+			.end_trb = &xhci->event_ring->first_seg->trbs[TRBS_PER_SEGMENT - 1],
+			.input_dma = xhci->cmd_ring->first_seg->dma,
+			.result_seg = NULL,
+		},
+		/* Test feeding a valid end TRB from a different ring */
+		{	.input_seg = xhci->event_ring->first_seg,
+			.start_trb = xhci->event_ring->first_seg->trbs,
+			.end_trb = &xhci->cmd_ring->first_seg->trbs[TRBS_PER_SEGMENT - 1],
+			.input_dma = xhci->cmd_ring->first_seg->dma,
+			.result_seg = NULL,
+		},
+		/* Test feeding a valid start and end TRB from a different ring */
+		{	.input_seg = xhci->event_ring->first_seg,
+			.start_trb = xhci->cmd_ring->first_seg->trbs,
+			.end_trb = &xhci->cmd_ring->first_seg->trbs[TRBS_PER_SEGMENT - 1],
+			.input_dma = xhci->cmd_ring->first_seg->dma,
+			.result_seg = NULL,
+		},
+		/* TRB in this ring, but after this TD */
+		{	.input_seg = xhci->event_ring->first_seg,
+			.start_trb = &xhci->event_ring->first_seg->trbs[0],
+			.end_trb = &xhci->event_ring->first_seg->trbs[3],
+			.input_dma = xhci->event_ring->first_seg->dma + 4*16,
+			.result_seg = NULL,
+		},
+		/* TRB in this ring, but before this TD */
+		{	.input_seg = xhci->event_ring->first_seg,
+			.start_trb = &xhci->event_ring->first_seg->trbs[3],
+			.end_trb = &xhci->event_ring->first_seg->trbs[6],
+			.input_dma = xhci->event_ring->first_seg->dma + 2*16,
+			.result_seg = NULL,
+		},
+		/* TRB in this ring, but after this wrapped TD */
+		{	.input_seg = xhci->event_ring->first_seg,
+			.start_trb = &xhci->event_ring->first_seg->trbs[TRBS_PER_SEGMENT - 3],
+			.end_trb = &xhci->event_ring->first_seg->trbs[1],
+			.input_dma = xhci->event_ring->first_seg->dma + 2*16,
+			.result_seg = NULL,
+		},
+		/* TRB in this ring, but before this wrapped TD */
+		{	.input_seg = xhci->event_ring->first_seg,
+			.start_trb = &xhci->event_ring->first_seg->trbs[TRBS_PER_SEGMENT - 3],
+			.end_trb = &xhci->event_ring->first_seg->trbs[1],
+			.input_dma = xhci->event_ring->first_seg->dma + (TRBS_PER_SEGMENT - 4)*16,
+			.result_seg = NULL,
+		},
+		/* TRB not in this ring, and we have a wrapped TD */
+		{	.input_seg = xhci->event_ring->first_seg,
+			.start_trb = &xhci->event_ring->first_seg->trbs[TRBS_PER_SEGMENT - 3],
+			.end_trb = &xhci->event_ring->first_seg->trbs[1],
+			.input_dma = xhci->cmd_ring->first_seg->dma + 2*16,
+			.result_seg = NULL,
+		},
+	};
+
+	unsigned int num_tests;
+	int i, ret;
+
+	num_tests = sizeof(simple_test_vector) / sizeof(simple_test_vector[0]);
+	for (i = 0; i < num_tests; i++) {
+		ret = xhci_test_trb_in_td(xhci,
+				xhci->event_ring->first_seg,
+				xhci->event_ring->first_seg->trbs,
+				&xhci->event_ring->first_seg->trbs[TRBS_PER_SEGMENT - 1],
+				simple_test_vector[i].input_dma,
+				simple_test_vector[i].result_seg,
+				"Simple", i);
+		if (ret < 0)
+			return ret;
+	}
+
+	num_tests = sizeof(complex_test_vector) / sizeof(complex_test_vector[0]);
+	for (i = 0; i < num_tests; i++) {
+		ret = xhci_test_trb_in_td(xhci,
+				complex_test_vector[i].input_seg,
+				complex_test_vector[i].start_trb,
+				complex_test_vector[i].end_trb,
+				complex_test_vector[i].input_dma,
+				complex_test_vector[i].result_seg,
+				"Complex", i);
+		if (ret < 0)
+			return ret;
+	}
+	xhci_dbg(xhci, "TRB math tests passed.\n");
+	return 0;
+}
+
+
 int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
 {
 	dma_addr_t	dma;
@@ -951,6 +1172,8 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
 	xhci->event_ring = xhci_ring_alloc(xhci, ERST_NUM_SEGS, false, flags);
 	if (!xhci->event_ring)
 		goto fail;
+	if (xhci_check_trb_in_td_math(xhci, flags) < 0)
+		goto fail;
 
 	xhci->erst.entries = pci_alloc_consistent(to_pci_dev(dev),
 			sizeof(struct xhci_erst_entry)*ERST_NUM_SEGS, &dma);
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 06595ec27bb7..e097008d6fb1 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -54,6 +54,8 @@ static int xhci_pci_setup(struct usb_hcd *hcd)
 	struct pci_dev		*pdev = to_pci_dev(hcd->self.controller);
 	int			retval;
 
+	hcd->self.sg_tablesize = TRBS_PER_SEGMENT - 1;
+
 	xhci->cap_regs = hcd->regs;
 	xhci->op_regs = hcd->regs +
 		HC_LENGTH(xhci_readl(xhci, &xhci->cap_regs->hc_capbase));
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 821b7b4709de..ee7bc7ecbc59 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -306,7 +306,7 @@ static void ring_ep_doorbell(struct xhci_hcd *xhci,
 	/* Don't ring the doorbell for this endpoint if there are pending
 	 * cancellations because the we don't want to interrupt processing.
 	 */
-	if (!ep->cancels_pending && !(ep_state & SET_DEQ_PENDING)
+	if (!(ep_state & EP_HALT_PENDING) && !(ep_state & SET_DEQ_PENDING)
 			&& !(ep_state & EP_HALTED)) {
 		field = xhci_readl(xhci, db_addr) & DB_MASK;
 		xhci_writel(xhci, field | EPI_TO_DB(ep_index), db_addr);
@@ -475,6 +475,35 @@ void xhci_queue_new_dequeue_state(struct xhci_hcd *xhci,
 	ep->ep_state |= SET_DEQ_PENDING;
 }
 
+static inline void xhci_stop_watchdog_timer_in_irq(struct xhci_hcd *xhci,
+		struct xhci_virt_ep *ep)
+{
+	ep->ep_state &= ~EP_HALT_PENDING;
+	/* Can't del_timer_sync in interrupt, so we attempt to cancel.  If the
+	 * timer is running on another CPU, we don't decrement stop_cmds_pending
+	 * (since we didn't successfully stop the watchdog timer).
+	 */
+	if (del_timer(&ep->stop_cmd_timer))
+		ep->stop_cmds_pending--;
+}
+
+/* Must be called with xhci->lock held in interrupt context */
+static void xhci_giveback_urb_in_irq(struct xhci_hcd *xhci,
+		struct xhci_td *cur_td, int status, char *adjective)
+{
+	struct usb_hcd *hcd = xhci_to_hcd(xhci);
+
+	cur_td->urb->hcpriv = NULL;
+	usb_hcd_unlink_urb_from_ep(hcd, cur_td->urb);
+	xhci_dbg(xhci, "Giveback %s URB %p\n", adjective, cur_td->urb);
+
+	spin_unlock(&xhci->lock);
+	usb_hcd_giveback_urb(hcd, cur_td->urb, status);
+	kfree(cur_td);
+	spin_lock(&xhci->lock);
+	xhci_dbg(xhci, "%s URB given back\n", adjective);
+}
+
 /*
  * When we get a command completion for a Stop Endpoint Command, we need to
  * unlink any cancelled TDs from the ring.  There are two ways to do that:
@@ -497,9 +526,6 @@ static void handle_stopped_endpoint(struct xhci_hcd *xhci,
 	struct xhci_td *last_unlinked_td;
 
 	struct xhci_dequeue_state deq_state;
-#ifdef CONFIG_USB_HCD_STAT
-	ktime_t stop_time = ktime_get();
-#endif
 
 	memset(&deq_state, 0, sizeof(deq_state));
 	slot_id = TRB_TO_SLOT_ID(trb->generic.field[3]);
@@ -507,8 +533,11 @@ static void handle_stopped_endpoint(struct xhci_hcd *xhci,
 	ep = &xhci->devs[slot_id]->eps[ep_index];
 	ep_ring = ep->ring;
 
-	if (list_empty(&ep->cancelled_td_list))
+	if (list_empty(&ep->cancelled_td_list)) {
+		xhci_stop_watchdog_timer_in_irq(xhci, ep);
+		ring_ep_doorbell(xhci, slot_id, ep_index);
 		return;
+	}
 
 	/* Fix up the ep ring first, so HW stops executing cancelled TDs.
 	 * We have the xHCI lock, so nothing can modify this list until we drop
@@ -535,9 +564,9 @@ static void handle_stopped_endpoint(struct xhci_hcd *xhci,
 		 * the cancelled TD list for URB completion later.
 		 */
 		list_del(&cur_td->td_list);
-		ep->cancels_pending--;
 	}
 	last_unlinked_td = cur_td;
+	xhci_stop_watchdog_timer_in_irq(xhci, ep);
 
 	/* If necessary, queue a Set Transfer Ring Dequeue Pointer command */
 	if (deq_state.new_deq_ptr && deq_state.new_deq_seg) {
@@ -561,27 +590,136 @@ static void handle_stopped_endpoint(struct xhci_hcd *xhci,
 		list_del(&cur_td->cancelled_td_list);
 
 		/* Clean up the cancelled URB */
-#ifdef CONFIG_USB_HCD_STAT
-		hcd_stat_update(xhci->tp_stat, cur_td->urb->actual_length,
-				ktime_sub(stop_time, cur_td->start_time));
-#endif
-		cur_td->urb->hcpriv = NULL;
-		usb_hcd_unlink_urb_from_ep(xhci_to_hcd(xhci), cur_td->urb);
-
-		xhci_dbg(xhci, "Giveback cancelled URB %p\n", cur_td->urb);
-		spin_unlock(&xhci->lock);
 		/* Doesn't matter what we pass for status, since the core will
 		 * just overwrite it (because the URB has been unlinked).
 		 */
-		usb_hcd_giveback_urb(xhci_to_hcd(xhci), cur_td->urb, 0);
-		kfree(cur_td);
+		xhci_giveback_urb_in_irq(xhci, cur_td, 0, "cancelled");
 
-		spin_lock(&xhci->lock);
+		/* Stop processing the cancelled list if the watchdog timer is
+		 * running.
+		 */
+		if (xhci->xhc_state & XHCI_STATE_DYING)
+			return;
 	} while (cur_td != last_unlinked_td);
 
 	/* Return to the event handler with xhci->lock re-acquired */
 }
 
+/* Watchdog timer function for when a stop endpoint command fails to complete.
+ * In this case, we assume the host controller is broken or dying or dead.  The
+ * host may still be completing some other events, so we have to be careful to
+ * let the event ring handler and the URB dequeueing/enqueueing functions know
+ * through xhci->state.
+ *
+ * The timer may also fire if the host takes a very long time to respond to the
+ * command, and the stop endpoint command completion handler cannot delete the
+ * timer before the timer function is called.  Another endpoint cancellation may
+ * sneak in before the timer function can grab the lock, and that may queue
+ * another stop endpoint command and add the timer back.  So we cannot use a
+ * simple flag to say whether there is a pending stop endpoint command for a
+ * particular endpoint.
+ *
+ * Instead we use a combination of that flag and a counter for the number of
+ * pending stop endpoint commands.  If the timer is the tail end of the last
+ * stop endpoint command, and the endpoint's command is still pending, we assume
+ * the host is dying.
+ */
+void xhci_stop_endpoint_command_watchdog(unsigned long arg)
+{
+	struct xhci_hcd *xhci;
+	struct xhci_virt_ep *ep;
+	struct xhci_virt_ep *temp_ep;
+	struct xhci_ring *ring;
+	struct xhci_td *cur_td;
+	int ret, i, j;
+
+	ep = (struct xhci_virt_ep *) arg;
+	xhci = ep->xhci;
+
+	spin_lock(&xhci->lock);
+
+	ep->stop_cmds_pending--;
+	if (xhci->xhc_state & XHCI_STATE_DYING) {
+		xhci_dbg(xhci, "Stop EP timer ran, but another timer marked "
+				"xHCI as DYING, exiting.\n");
+		spin_unlock(&xhci->lock);
+		return;
+	}
+	if (!(ep->stop_cmds_pending == 0 && (ep->ep_state & EP_HALT_PENDING))) {
+		xhci_dbg(xhci, "Stop EP timer ran, but no command pending, "
+				"exiting.\n");
+		spin_unlock(&xhci->lock);
+		return;
+	}
+
+	xhci_warn(xhci, "xHCI host not responding to stop endpoint command.\n");
+	xhci_warn(xhci, "Assuming host is dying, halting host.\n");
+	/* Oops, HC is dead or dying or at least not responding to the stop
+	 * endpoint command.
+	 */
+	xhci->xhc_state |= XHCI_STATE_DYING;
+	/* Disable interrupts from the host controller and start halting it */
+	xhci_quiesce(xhci);
+	spin_unlock(&xhci->lock);
+
+	ret = xhci_halt(xhci);
+
+	spin_lock(&xhci->lock);
+	if (ret < 0) {
+		/* This is bad; the host is not responding to commands and it's
+		 * not allowing itself to be halted.  At least interrupts are
+		 * disabled, so we can set HC_STATE_HALT and notify the
+		 * USB core.  But if we call usb_hc_died(), it will attempt to
+		 * disconnect all device drivers under this host.  Those
+		 * disconnect() methods will wait for all URBs to be unlinked,
+		 * so we must complete them.
+		 */
+		xhci_warn(xhci, "Non-responsive xHCI host is not halting.\n");
+		xhci_warn(xhci, "Completing active URBs anyway.\n");
+		/* We could turn all TDs on the rings to no-ops.  This won't
+		 * help if the host has cached part of the ring, and is slow if
+		 * we want to preserve the cycle bit.  Skip it and hope the host
+		 * doesn't touch the memory.
+		 */
+	}
+	for (i = 0; i < MAX_HC_SLOTS; i++) {
+		if (!xhci->devs[i])
+			continue;
+		for (j = 0; j < 31; j++) {
+			temp_ep = &xhci->devs[i]->eps[j];
+			ring = temp_ep->ring;
+			if (!ring)
+				continue;
+			xhci_dbg(xhci, "Killing URBs for slot ID %u, "
+					"ep index %u\n", i, j);
+			while (!list_empty(&ring->td_list)) {
+				cur_td = list_first_entry(&ring->td_list,
+						struct xhci_td,
+						td_list);
+				list_del(&cur_td->td_list);
+				if (!list_empty(&cur_td->cancelled_td_list))
+					list_del(&cur_td->cancelled_td_list);
+				xhci_giveback_urb_in_irq(xhci, cur_td,
+						-ESHUTDOWN, "killed");
+			}
+			while (!list_empty(&temp_ep->cancelled_td_list)) {
+				cur_td = list_first_entry(
+						&temp_ep->cancelled_td_list,
+						struct xhci_td,
+						cancelled_td_list);
+				list_del(&cur_td->cancelled_td_list);
+				xhci_giveback_urb_in_irq(xhci, cur_td,
+						-ESHUTDOWN, "killed");
+			}
+		}
+	}
+	spin_unlock(&xhci->lock);
+	xhci_to_hcd(xhci)->state = HC_STATE_HALT;
+	xhci_dbg(xhci, "Calling usb_hc_died()\n");
+	usb_hc_died(xhci_to_hcd(xhci));
+	xhci_dbg(xhci, "xHCI host controller is dead.\n");
+}
+
 /*
  * When we get a completion for a Set Transfer Ring Dequeue Pointer command,
  * we need to clear the set deq pending flag in the endpoint ring state, so that
@@ -765,28 +903,32 @@ static void handle_cmd_completion(struct xhci_hcd *xhci,
 				virt_dev->in_ctx);
 		/* Input ctx add_flags are the endpoint index plus one */
 		ep_index = xhci_last_valid_endpoint(ctrl_ctx->add_flags) - 1;
-		ep_ring = xhci->devs[slot_id]->eps[ep_index].ring;
-		if (!ep_ring) {
-			/* This must have been an initial configure endpoint */
-			xhci->devs[slot_id]->cmd_status =
-				GET_COMP_CODE(event->status);
-			complete(&xhci->devs[slot_id]->cmd_completion);
-			break;
-		}
-		ep_state = xhci->devs[slot_id]->eps[ep_index].ep_state;
-		xhci_dbg(xhci, "Completed config ep cmd - last ep index = %d, "
-				"state = %d\n", ep_index, ep_state);
+		/* A usb_set_interface() call directly after clearing a halted
+		 * condition may race on this quirky hardware.
+		 * Not worth worrying about, since this is prototype hardware.
+		 */
 		if (xhci->quirks & XHCI_RESET_EP_QUIRK &&
-				ep_state & EP_HALTED) {
+				ep_index != (unsigned int) -1 &&
+				ctrl_ctx->add_flags - SLOT_FLAG ==
+					ctrl_ctx->drop_flags) {
+			ep_ring = xhci->devs[slot_id]->eps[ep_index].ring;
+			ep_state = xhci->devs[slot_id]->eps[ep_index].ep_state;
+			if (!(ep_state & EP_HALTED))
+				goto bandwidth_change;
+			xhci_dbg(xhci, "Completed config ep cmd - "
+					"last ep index = %d, state = %d\n",
+					ep_index, ep_state);
 			/* Clear our internal halted state and restart ring */
 			xhci->devs[slot_id]->eps[ep_index].ep_state &=
 				~EP_HALTED;
 			ring_ep_doorbell(xhci, slot_id, ep_index);
-		} else {
-			xhci->devs[slot_id]->cmd_status =
-				GET_COMP_CODE(event->status);
-			complete(&xhci->devs[slot_id]->cmd_completion);
+			break;
 		}
+bandwidth_change:
+		xhci_dbg(xhci, "Completed config ep cmd\n");
+		xhci->devs[slot_id]->cmd_status =
+			GET_COMP_CODE(event->status);
+		complete(&xhci->devs[slot_id]->cmd_completion);
 		break;
 	case TRB_TYPE(TRB_EVAL_CONTEXT):
 		virt_dev = xhci->devs[slot_id];
@@ -849,8 +991,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
  * TRB in this TD, this function returns that TRB's segment.  Otherwise it
  * returns 0.
  */
-static struct xhci_segment *trb_in_td(
-		struct xhci_segment *start_seg,
+struct xhci_segment *trb_in_td(struct xhci_segment *start_seg,
 		union xhci_trb	*start_trb,
 		union xhci_trb	*end_trb,
 		dma_addr_t	suspect_dma)
@@ -900,6 +1041,45 @@ static struct xhci_segment *trb_in_td(
 	return 0;
 }
 
+static void xhci_cleanup_halted_endpoint(struct xhci_hcd *xhci,
+		unsigned int slot_id, unsigned int ep_index,
+		struct xhci_td *td, union xhci_trb *event_trb)
+{
+	struct xhci_virt_ep *ep = &xhci->devs[slot_id]->eps[ep_index];
+	ep->ep_state |= EP_HALTED;
+	ep->stopped_td = td;
+	ep->stopped_trb = event_trb;
+	xhci_queue_reset_ep(xhci, slot_id, ep_index);
+	xhci_cleanup_stalled_ring(xhci, td->urb->dev, ep_index);
+	xhci_ring_cmd_db(xhci);
+}
+
+/* Check if an error has halted the endpoint ring.  The class driver will
+ * cleanup the halt for a non-default control endpoint if we indicate a stall.
+ * However, a babble and other errors also halt the endpoint ring, and the class
+ * driver won't clear the halt in that case, so we need to issue a Set Transfer
+ * Ring Dequeue Pointer command manually.
+ */
+static int xhci_requires_manual_halt_cleanup(struct xhci_hcd *xhci,
+		struct xhci_ep_ctx *ep_ctx,
+		unsigned int trb_comp_code)
+{
+	/* TRB completion codes that may require a manual halt cleanup */
+	if (trb_comp_code == COMP_TX_ERR ||
+			trb_comp_code == COMP_BABBLE ||
+			trb_comp_code == COMP_SPLIT_ERR)
+		/* The 0.96 spec says a babbling control endpoint
+		 * is not halted. The 0.96 spec says it is.  Some HW
+		 * claims to be 0.95 compliant, but it halts the control
+		 * endpoint anyway.  Check if a babble halted the
+		 * endpoint.
+		 */
+		if ((ep_ctx->ep_info & EP_STATE_MASK) == EP_STATE_HALTED)
+			return 1;
+
+	return 0;
+}
+
 /*
  * If this function returns an error condition, it means it got a Transfer
  * event with a corrupted Slot ID, Endpoint ID, or TRB DMA address.
@@ -1002,6 +1182,7 @@ static int handle_tx_event(struct xhci_hcd *xhci,
 		xhci_warn(xhci, "WARN: TRB error on endpoint\n");
 		status = -EILSEQ;
 		break;
+	case COMP_SPLIT_ERR:
 	case COMP_TX_ERR:
 		xhci_warn(xhci, "WARN: transfer error on endpoint\n");
 		status = -EPROTO;
@@ -1015,6 +1196,16 @@ static int handle_tx_event(struct xhci_hcd *xhci,
 		status = -ENOSR;
 		break;
 	default:
+		if (trb_comp_code >= 224 && trb_comp_code <= 255) {
+			/* Vendor defined "informational" completion code,
+			 * treat as not-an-error.
+			 */
+			xhci_dbg(xhci, "Vendor defined info completion code %u\n",
+					trb_comp_code);
+			xhci_dbg(xhci, "Treating code as success.\n");
+			status = 0;
+			break;
+		}
 		xhci_warn(xhci, "ERROR Unknown event condition, HC probably busted\n");
 		urb = NULL;
 		goto cleanup;
@@ -1043,15 +1234,14 @@ static int handle_tx_event(struct xhci_hcd *xhci,
 			else
 				status = 0;
 			break;
-		case COMP_BABBLE:
-			/* The 0.96 spec says a babbling control endpoint
-			 * is not halted. The 0.96 spec says it is.  Some HW
-			 * claims to be 0.95 compliant, but it halts the control
-			 * endpoint anyway.  Check if a babble halted the
-			 * endpoint.
-			 */
-			if (ep_ctx->ep_info != EP_STATE_HALTED)
+
+		default:
+			if (!xhci_requires_manual_halt_cleanup(xhci,
+						ep_ctx, trb_comp_code))
 				break;
+			xhci_dbg(xhci, "TRB error code %u, "
+					"halted endpoint index = %u\n",
+					trb_comp_code, ep_index);
 			/* else fall through */
 		case COMP_STALL:
 			/* Did we transfer part of the data (middle) phase? */
@@ -1063,15 +1253,9 @@ static int handle_tx_event(struct xhci_hcd *xhci,
 			else
 				td->urb->actual_length = 0;
 
-			ep->stopped_td = td;
-			ep->stopped_trb = event_trb;
-			xhci_queue_reset_ep(xhci, slot_id, ep_index);
-			xhci_cleanup_stalled_ring(xhci, td->urb->dev, ep_index);
-			xhci_ring_cmd_db(xhci);
+			xhci_cleanup_halted_endpoint(xhci,
+					slot_id, ep_index, td, event_trb);
 			goto td_cleanup;
-		default:
-			/* Others already handled above */
-			break;
 		}
 		/*
 		 * Did we transfer any data, despite the errors that might have
@@ -1209,16 +1393,25 @@ static int handle_tx_event(struct xhci_hcd *xhci,
 		ep->stopped_td = td;
 		ep->stopped_trb = event_trb;
 	} else {
-		if (trb_comp_code == COMP_STALL ||
-				trb_comp_code == COMP_BABBLE) {
+		if (trb_comp_code == COMP_STALL) {
 			/* The transfer is completed from the driver's
 			 * perspective, but we need to issue a set dequeue
 			 * command for this stalled endpoint to move the dequeue
 			 * pointer past the TD.  We can't do that here because
-			 * the halt condition must be cleared first.
+			 * the halt condition must be cleared first.  Let the
+			 * USB class driver clear the stall later.
 			 */
 			ep->stopped_td = td;
 			ep->stopped_trb = event_trb;
+		} else if (xhci_requires_manual_halt_cleanup(xhci,
+					ep_ctx, trb_comp_code)) {
+			/* Other types of errors halt the endpoint, but the
+			 * class driver doesn't call usb_reset_endpoint() unless
+			 * the error is -EPIPE.  Clear the halted status in the
+			 * xHCI hardware manually.
+			 */
+			xhci_cleanup_halted_endpoint(xhci,
+					slot_id, ep_index, td, event_trb);
 		} else {
 			/* Update ring dequeue pointer */
 			while (ep_ring->dequeue != td->last_trb)
@@ -1249,10 +1442,9 @@ td_cleanup:
 		}
 		list_del(&td->td_list);
 		/* Was this TD slated to be cancelled but completed anyway? */
-		if (!list_empty(&td->cancelled_td_list)) {
+		if (!list_empty(&td->cancelled_td_list))
 			list_del(&td->cancelled_td_list);
-			ep->cancels_pending--;
-		}
+
 		/* Leave the TD around for the reset endpoint function to use
 		 * (but only if it's not a control endpoint, since we already
 		 * queued the Set TR dequeue pointer command for stalled
@@ -1331,6 +1523,14 @@ void xhci_handle_event(struct xhci_hcd *xhci)
 	default:
 		xhci->error_bitmask |= 1 << 3;
 	}
+	/* Any of the above functions may drop and re-acquire the lock, so check
+	 * to make sure a watchdog timer didn't mark the host as non-responsive.
+	 */
+	if (xhci->xhc_state & XHCI_STATE_DYING) {
+		xhci_dbg(xhci, "xHCI host dying, returning from "
+				"event handler.\n");
+		return;
+	}
 
 	if (update_ptrs) {
 		/* Update SW and HC event ring dequeue pointer */
@@ -1555,6 +1755,21 @@ int xhci_queue_intr_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
 	return xhci_queue_bulk_tx(xhci, GFP_ATOMIC, urb, slot_id, ep_index);
 }
 
+/*
+ * The TD size is the number of bytes remaining in the TD (including this TRB),
+ * right shifted by 10.
+ * It must fit in bits 21:17, so it can't be bigger than 31.
+ */
+static u32 xhci_td_remainder(unsigned int remainder)
+{
+	u32 max = (1 << (21 - 17 + 1)) - 1;
+
+	if ((remainder >> 10) >= max)
+		return max << 17;
+	else
+		return (remainder >> 10) << 17;
+}
+
 static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
 		struct urb *urb, int slot_id, unsigned int ep_index)
 {
@@ -1612,6 +1827,7 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
 	do {
 		u32 field = 0;
 		u32 length_field = 0;
+		u32 remainder = 0;
 
 		/* Don't change the cycle bit of the first TRB until later */
 		if (first_trb)
@@ -1641,8 +1857,10 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
 					(unsigned int) (addr + TRB_MAX_BUFF_SIZE) & ~(TRB_MAX_BUFF_SIZE - 1),
 					(unsigned int) addr + trb_buff_len);
 		}
+		remainder = xhci_td_remainder(urb->transfer_buffer_length -
+				running_total) ;
 		length_field = TRB_LEN(trb_buff_len) |
-			TD_REMAINDER(urb->transfer_buffer_length - running_total) |
+			remainder |
 			TRB_INTR_TARGET(0);
 		queue_trb(xhci, ep_ring, false,
 				lower_32_bits(addr),
@@ -1755,6 +1973,7 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
 
 	/* Queue the first TRB, even if it's zero-length */
 	do {
+		u32 remainder = 0;
 		field = 0;
 
 		/* Don't change the cycle bit of the first TRB until later */
@@ -1773,8 +1992,10 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
 			td->last_trb = ep_ring->enqueue;
 			field |= TRB_IOC;
 		}
+		remainder = xhci_td_remainder(urb->transfer_buffer_length -
+				running_total);
 		length_field = TRB_LEN(trb_buff_len) |
-			TD_REMAINDER(urb->transfer_buffer_length - running_total) |
+			remainder |
 			TRB_INTR_TARGET(0);
 		queue_trb(xhci, ep_ring, false,
 				lower_32_bits(addr),
@@ -1862,7 +2083,7 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
 	/* If there's data, queue data TRBs */
 	field = 0;
 	length_field = TRB_LEN(urb->transfer_buffer_length) |
-		TD_REMAINDER(urb->transfer_buffer_length) |
+		xhci_td_remainder(urb->transfer_buffer_length) |
 		TRB_INTR_TARGET(0);
 	if (urb->transfer_buffer_length > 0) {
 		if (setup->bRequestType & USB_DIR_IN)
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 4b254b6fa245..877813505ef2 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -652,13 +652,17 @@ struct xhci_virt_ep {
 	struct xhci_ring		*new_ring;
 	unsigned int			ep_state;
 #define SET_DEQ_PENDING		(1 << 0)
-#define EP_HALTED		(1 << 1)
+#define EP_HALTED		(1 << 1)	/* For stall handling */
+#define EP_HALT_PENDING		(1 << 2)	/* For URB cancellation */
 	/* ----  Related to URB cancellation ---- */
 	struct list_head	cancelled_td_list;
-	unsigned int		cancels_pending;
 	/* The TRB that was last reported in a stopped endpoint ring */
 	union xhci_trb		*stopped_trb;
 	struct xhci_td		*stopped_td;
+	/* Watchdog timer for stop endpoint command to cancel URBs */
+	struct timer_list	stop_cmd_timer;
+	int			stop_cmds_pending;
+	struct xhci_hcd		*xhci;
 };
 
 struct xhci_virt_device {
@@ -673,6 +677,10 @@ struct xhci_virt_device {
 	struct xhci_container_ctx       *out_ctx;
 	/* Used for addressing devices and configuration changes */
 	struct xhci_container_ctx       *in_ctx;
+	/* Rings saved to ensure old alt settings can be re-instated */
+	struct xhci_ring		**ring_cache;
+	int				num_rings_cached;
+#define	XHCI_MAX_RINGS_CACHED	31
 	struct xhci_virt_ep		eps[31];
 	struct completion		cmd_completion;
 	/* Status of the last command issued for this device */
@@ -824,9 +832,6 @@ struct xhci_event_cmd {
 /* Normal TRB fields */
 /* transfer_len bitmasks - bits 0:16 */
 #define	TRB_LEN(p)		((p) & 0x1ffff)
-/* TD size - number of bytes remaining in the TD (including this TRB):
- * bits 17 - 21.  Shift the number of bytes by 10. */
-#define TD_REMAINDER(p)		((((p) >> 10) & 0x1f) << 17)
 /* Interrupter Target - which MSI-X vector to target the completion event at */
 #define TRB_INTR_TARGET(p)	(((p) & 0x3ff) << 22)
 #define GET_INTR_TARGET(p)	(((p) >> 22) & 0x3ff)
@@ -1022,6 +1027,8 @@ struct xhci_scratchpad {
 #define	ERST_ENTRIES	1
 /* Poll every 60 seconds */
 #define	POLL_TIMEOUT	60
+/* Stop endpoint command timeout (secs) for URB cancellation watchdog timer */
+#define XHCI_STOP_EP_CMD_TIMEOUT	5
 /* XXX: Make these module parameters */
 
 
@@ -1083,6 +1090,21 @@ struct xhci_hcd {
 	struct timer_list	event_ring_timer;
 	int			zombie;
 #endif
+	/* Host controller watchdog timer structures */
+	unsigned int		xhc_state;
+/* Host controller is dying - not responding to commands. "I'm not dead yet!"
+ *
+ * xHC interrupts have been disabled and a watchdog timer will (or has already)
+ * halt the xHCI host, and complete all URBs with an -ESHUTDOWN code.  Any code
+ * that sees this status (other than the timer that set it) should stop touching
+ * hardware immediately.  Interrupt handlers should return immediately when
+ * they see this status (any time they drop and re-acquire xhci->lock).
+ * xhci_urb_dequeue() should call usb_hcd_check_unlink_urb() and return without
+ * putting the TD on the canceled list, etc.
+ *
+ * There are no reports of xHCI host controllers that display this issue.
+ */
+#define XHCI_STATE_DYING	(1 << 0)
 	/* Statistics */
 	int			noops_submitted;
 	int			noops_handled;
@@ -1223,6 +1245,7 @@ void xhci_unregister_pci(void);
 #endif
 
 /* xHCI host controller glue */
+void xhci_quiesce(struct xhci_hcd *xhci);
 int xhci_halt(struct xhci_hcd *xhci);
 int xhci_reset(struct xhci_hcd *xhci);
 int xhci_init(struct usb_hcd *hcd);
@@ -1246,6 +1269,9 @@ void xhci_reset_bandwidth(struct usb_hcd *hcd, struct usb_device *udev);
 
 /* xHCI ring, segment, TRB, and TD functions */
 dma_addr_t xhci_trb_virt_to_dma(struct xhci_segment *seg, union xhci_trb *trb);
+struct xhci_segment *trb_in_td(struct xhci_segment *start_seg,
+		union xhci_trb *start_trb, union xhci_trb *end_trb,
+		dma_addr_t suspect_dma);
 void xhci_ring_cmd_db(struct xhci_hcd *xhci);
 void *xhci_setup_one_noop(struct xhci_hcd *xhci);
 void xhci_handle_event(struct xhci_hcd *xhci);
@@ -1278,6 +1304,7 @@ void xhci_cleanup_stalled_ring(struct xhci_hcd *xhci,
 void xhci_queue_config_ep_quirk(struct xhci_hcd *xhci,
 		unsigned int slot_id, unsigned int ep_index,
 		struct xhci_dequeue_state *deq_state);
+void xhci_stop_endpoint_command_watchdog(unsigned long arg);
 
 /* xHCI roothub code */
 int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, u16 wIndex,
diff --git a/drivers/usb/misc/appledisplay.c b/drivers/usb/misc/appledisplay.c
index 1d8e39a557d9..1eb9e4162cc6 100644
--- a/drivers/usb/misc/appledisplay.c
+++ b/drivers/usb/misc/appledisplay.c
@@ -60,6 +60,7 @@
 static struct usb_device_id appledisplay_table [] = {
 	{ APPLEDISPLAY_DEVICE(0x9218) },
 	{ APPLEDISPLAY_DEVICE(0x9219) },
+	{ APPLEDISPLAY_DEVICE(0x921c) },
 	{ APPLEDISPLAY_DEVICE(0x921d) },
 
 	/* Terminating entry */
@@ -72,8 +73,8 @@ struct appledisplay {
 	struct usb_device *udev;	/* usb device */
 	struct urb *urb;		/* usb request block */
 	struct backlight_device *bd;	/* backlight device */
-	char *urbdata;			/* interrupt URB data buffer */
-	char *msgdata;			/* control message data buffer */
+	u8 *urbdata;			/* interrupt URB data buffer */
+	u8 *msgdata;			/* control message data buffer */
 
 	struct delayed_work work;
 	int button_pressed;
diff --git a/drivers/usb/misc/emi62.c b/drivers/usb/misc/emi62.c
index 602ee05ba9ff..59860b328534 100644
--- a/drivers/usb/misc/emi62.c
+++ b/drivers/usb/misc/emi62.c
@@ -167,7 +167,7 @@ static int emi62_load_firmware (struct usb_device *dev)
 			err("%s - error loading firmware: error = %d", __func__, err);
 			goto wraperr;
 		}
-	} while (i > 0);
+	} while (rec);
 
 	/* Assert reset (stop the CPU in the EMI) */
 	err = emi62_set_reset(dev,1);
diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
index a9f06d76960f..3dab0c0b196f 100644
--- a/drivers/usb/misc/usbtest.c
+++ b/drivers/usb/misc/usbtest.c
@@ -213,8 +213,9 @@ static struct urb *simple_alloc_urb (
 }
 
 static unsigned pattern = 0;
-module_param (pattern, uint, S_IRUGO);
-MODULE_PARM_DESC(pattern, "i/o pattern (0 == zeroes)");
+static unsigned mod_pattern;
+module_param_named(pattern, mod_pattern, uint, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(mod_pattern, "i/o pattern (0 == zeroes)");
 
 static inline void simple_fill_buf (struct urb *urb)
 {
@@ -1567,6 +1568,8 @@ usbtest_ioctl (struct usb_interface *intf, unsigned int code, void *buf)
 
 	// FIXME USBDEVFS_CONNECTINFO doesn't say how fast the device is.
 
+	pattern = mod_pattern;
+
 	if (code != USBTEST_REQUEST)
 		return -EOPNOTSUPP;
 
diff --git a/drivers/usb/mon/mon_bin.c b/drivers/usb/mon/mon_bin.c
index 10f3205798e8..385ec0520167 100644
--- a/drivers/usb/mon/mon_bin.c
+++ b/drivers/usb/mon/mon_bin.c
@@ -16,6 +16,7 @@
 #include <linux/compat.h>
 #include <linux/mm.h>
 #include <linux/smp_lock.h>
+#include <linux/scatterlist.h>
 
 #include <asm/uaccess.h>
 
@@ -221,7 +222,7 @@ static void mon_free_buff(struct mon_pgmap *map, int npages);
 /*
  * This is a "chunked memcpy". It does not manipulate any counters.
  */
-static void mon_copy_to_buff(const struct mon_reader_bin *this,
+static unsigned int mon_copy_to_buff(const struct mon_reader_bin *this,
     unsigned int off, const unsigned char *from, unsigned int length)
 {
 	unsigned int step_len;
@@ -246,6 +247,7 @@ static void mon_copy_to_buff(const struct mon_reader_bin *this,
 		from += step_len;
 		length -= step_len;
 	}
+	return off;
 }
 
 /*
@@ -394,14 +396,44 @@ static inline char mon_bin_get_setup(unsigned char *setupb,
 	return 0;
 }
 
-static char mon_bin_get_data(const struct mon_reader_bin *rp,
-    unsigned int offset, struct urb *urb, unsigned int length)
+static unsigned int mon_bin_get_data(const struct mon_reader_bin *rp,
+    unsigned int offset, struct urb *urb, unsigned int length,
+    char *flag)
 {
+	int i;
+	struct scatterlist *sg;
+	unsigned int this_len;
+
+	*flag = 0;
+	if (urb->num_sgs == 0) {
+		if (urb->transfer_buffer == NULL) {
+			*flag = 'Z';
+			return length;
+		}
+		mon_copy_to_buff(rp, offset, urb->transfer_buffer, length);
+		length = 0;
 
-	if (urb->transfer_buffer == NULL)
-		return 'Z';
-	mon_copy_to_buff(rp, offset, urb->transfer_buffer, length);
-	return 0;
+	} else {
+		/* If IOMMU coalescing occurred, we cannot trust sg_page */
+		if (urb->sg->nents != urb->num_sgs) {
+			*flag = 'D';
+			return length;
+		}
+
+		/* Copy up to the first non-addressable segment */
+		for_each_sg(urb->sg->sg, sg, urb->num_sgs, i) {
+			if (length == 0 || PageHighMem(sg_page(sg)))
+				break;
+			this_len = min_t(unsigned int, sg->length, length);
+			offset = mon_copy_to_buff(rp, offset, sg_virt(sg),
+					this_len);
+			length -= this_len;
+		}
+		if (i == 0)
+			*flag = 'D';
+	}
+
+	return length;
 }
 
 static void mon_bin_get_isodesc(const struct mon_reader_bin *rp,
@@ -536,8 +568,9 @@ static void mon_bin_event(struct mon_reader_bin *rp, struct urb *urb,
 	}
 
 	if (length != 0) {
-		ep->flag_data = mon_bin_get_data(rp, offset, urb, length);
-		if (ep->flag_data != 0) {	/* Yes, it's 0x00, not '0' */
+		length = mon_bin_get_data(rp, offset, urb, length,
+				&ep->flag_data);
+		if (length > 0) {
 			delta = (ep->len_cap + PKT_ALIGN-1) & ~(PKT_ALIGN-1);
 			ep->len_cap -= length;
 			delta -= (ep->len_cap + PKT_ALIGN-1) & ~(PKT_ALIGN-1);
diff --git a/drivers/usb/mon/mon_text.c b/drivers/usb/mon/mon_text.c
index 9f1a9227ebe6..047568ff223d 100644
--- a/drivers/usb/mon/mon_text.c
+++ b/drivers/usb/mon/mon_text.c
@@ -10,6 +10,7 @@
 #include <linux/time.h>
 #include <linux/mutex.h>
 #include <linux/debugfs.h>
+#include <linux/scatterlist.h>
 #include <asm/uaccess.h>
 
 #include "usb_mon.h"
@@ -137,6 +138,8 @@ static inline char mon_text_get_setup(struct mon_event_text *ep,
 static inline char mon_text_get_data(struct mon_event_text *ep, struct urb *urb,
     int len, char ev_type, struct mon_bus *mbus)
 {
+	void *src;
+
 	if (len <= 0)
 		return 'L';
 	if (len >= DATA_MAX)
@@ -150,10 +153,24 @@ static inline char mon_text_get_data(struct mon_event_text *ep, struct urb *urb,
 			return '>';
 	}
 
-	if (urb->transfer_buffer == NULL)
-		return 'Z';	/* '0' would be not as pretty. */
+	if (urb->num_sgs == 0) {
+		src = urb->transfer_buffer;
+		if (src == NULL)
+			return 'Z';	/* '0' would be not as pretty. */
+	} else {
+		struct scatterlist *sg = urb->sg->sg;
+
+		/* If IOMMU coalescing occurred, we cannot trust sg_page */
+		if (urb->sg->nents != urb->num_sgs ||
+				PageHighMem(sg_page(sg)))
+			return 'D';
+
+		/* For the text interface we copy only the first sg buffer */
+		len = min_t(int, sg->length, len);
+		src = sg_virt(sg);
+	}
 
-	memcpy(ep->data, urb->transfer_buffer, len);
+	memcpy(ep->data, src, len);
 	return 0;
 }
 
diff --git a/drivers/usb/musb/Kconfig b/drivers/usb/musb/Kconfig
index b84abd8ee8a5..d9db86498022 100644
--- a/drivers/usb/musb/Kconfig
+++ b/drivers/usb/musb/Kconfig
@@ -9,10 +9,9 @@ comment "Enable Host or Gadget support to see Inventra options"
 # (M)HDRC = (Multipoint) Highspeed Dual-Role Controller
 config USB_MUSB_HDRC
 	depends on (USB || USB_GADGET)
-	depends on (ARM || BLACKFIN)
-	select NOP_USB_XCEIV if ARCH_DAVINCI
+	depends on (ARM || (BF54x && !BF544) || (BF52x && !BF522 && !BF523))
+	select NOP_USB_XCEIV if (ARCH_DAVINCI || MACH_OMAP3EVM || BLACKFIN)
 	select TWL4030_USB if MACH_OMAP_3430SDP
-	select NOP_USB_XCEIV if MACH_OMAP3EVM
 	select USB_OTG_UTILS
 	tristate 'Inventra Highspeed Dual Role Controller (TI, ADI, ...)'
 	help
diff --git a/drivers/usb/musb/blackfin.c b/drivers/usb/musb/blackfin.c
index fcec87ea709e..ad26e6569665 100644
--- a/drivers/usb/musb/blackfin.c
+++ b/drivers/usb/musb/blackfin.c
@@ -29,6 +29,8 @@ void musb_write_fifo(struct musb_hw_ep *hw_ep, u16 len, const u8 *src)
 {
 	void __iomem *fifo = hw_ep->fifo;
 	void __iomem *epio = hw_ep->regs;
+	u8 epnum = hw_ep->epnum;
+	u16 dma_reg = 0;
 
 	prefetch((u8 *)src);
 
@@ -39,14 +41,52 @@ void musb_write_fifo(struct musb_hw_ep *hw_ep, u16 len, const u8 *src)
 
 	dump_fifo_data(src, len);
 
-	if (unlikely((unsigned long)src & 0x01))
-		outsw_8((unsigned long)fifo, src,
-			len & 0x01 ? (len >> 1) + 1 : len >> 1);
-	else
-		outsw((unsigned long)fifo, src,
-			len & 0x01 ? (len >> 1) + 1 : len >> 1);
-}
+	if (!ANOMALY_05000380 && epnum != 0) {
+		flush_dcache_range((unsigned int)src,
+			(unsigned int)(src + len));
+
+		/* Setup DMA address register */
+		dma_reg = (u16) ((u32) src & 0xFFFF);
+		bfin_write16(USB_DMA_REG(epnum, USB_DMAx_ADDR_LOW), dma_reg);
+		SSYNC();
+
+		dma_reg = (u16) (((u32) src >> 16) & 0xFFFF);
+		bfin_write16(USB_DMA_REG(epnum, USB_DMAx_ADDR_HIGH), dma_reg);
+		SSYNC();
+
+		/* Setup DMA count register */
+		bfin_write16(USB_DMA_REG(epnum, USB_DMAx_COUNT_LOW), len);
+		bfin_write16(USB_DMA_REG(epnum, USB_DMAx_COUNT_HIGH), 0);
+		SSYNC();
+
+		/* Enable the DMA */
+		dma_reg = (epnum << 4) | DMA_ENA | INT_ENA | DIRECTION;
+		bfin_write16(USB_DMA_REG(epnum, USB_DMAx_CTRL), dma_reg);
+		SSYNC();
+
+		/* Wait for compelete */
+		while (!(bfin_read_USB_DMA_INTERRUPT() & (1 << epnum)))
+			cpu_relax();
+
+		/* acknowledge dma interrupt */
+		bfin_write_USB_DMA_INTERRUPT(1 << epnum);
+		SSYNC();
 
+		/* Reset DMA */
+		bfin_write16(USB_DMA_REG(epnum, USB_DMAx_CTRL), 0);
+		SSYNC();
+	} else {
+		SSYNC();
+
+		if (unlikely((unsigned long)src & 0x01))
+			outsw_8((unsigned long)fifo, src,
+				len & 0x01 ? (len >> 1) + 1 : len >> 1);
+		else
+			outsw((unsigned long)fifo, src,
+				len & 0x01 ? (len >> 1) + 1 : len >> 1);
+
+	}
+}
 /*
  * Unload an endpoint's FIFO
  */
@@ -56,51 +96,60 @@ void musb_read_fifo(struct musb_hw_ep *hw_ep, u16 len, u8 *dst)
 	u8 epnum = hw_ep->epnum;
 	u16 dma_reg = 0;
 
-	DBG(4, "%cX ep%d fifo %p count %d buf %p\n",
-			'R', hw_ep->epnum, fifo, len, dst);
+	if (ANOMALY_05000467 && epnum != 0) {
 
-#ifdef CONFIG_BF52x
-	invalidate_dcache_range((unsigned int)dst,
-		(unsigned int)(dst + len));
+		invalidate_dcache_range((unsigned int)dst,
+			(unsigned int)(dst + len));
 
-	/* Setup DMA address register */
-	dma_reg = (u16) ((u32) dst & 0xFFFF);
-	bfin_write16(USB_DMA_REG(epnum, USB_DMAx_ADDR_LOW), dma_reg);
-	SSYNC();
+		/* Setup DMA address register */
+		dma_reg = (u16) ((u32) dst & 0xFFFF);
+		bfin_write16(USB_DMA_REG(epnum, USB_DMAx_ADDR_LOW), dma_reg);
+		SSYNC();
 
-	dma_reg = (u16) (((u32) dst >> 16) & 0xFFFF);
-	bfin_write16(USB_DMA_REG(epnum, USB_DMAx_ADDR_HIGH), dma_reg);
-	SSYNC();
+		dma_reg = (u16) (((u32) dst >> 16) & 0xFFFF);
+		bfin_write16(USB_DMA_REG(epnum, USB_DMAx_ADDR_HIGH), dma_reg);
+		SSYNC();
 
-	/* Setup DMA count register */
-	bfin_write16(USB_DMA_REG(epnum, USB_DMAx_COUNT_LOW), len);
-	bfin_write16(USB_DMA_REG(epnum, USB_DMAx_COUNT_HIGH), 0);
-	SSYNC();
+		/* Setup DMA count register */
+		bfin_write16(USB_DMA_REG(epnum, USB_DMAx_COUNT_LOW), len);
+		bfin_write16(USB_DMA_REG(epnum, USB_DMAx_COUNT_HIGH), 0);
+		SSYNC();
 
-	/* Enable the DMA */
-	dma_reg = (epnum << 4) | DMA_ENA | INT_ENA;
-	bfin_write16(USB_DMA_REG(epnum, USB_DMAx_CTRL), dma_reg);
-	SSYNC();
+		/* Enable the DMA */
+		dma_reg = (epnum << 4) | DMA_ENA | INT_ENA;
+		bfin_write16(USB_DMA_REG(epnum, USB_DMAx_CTRL), dma_reg);
+		SSYNC();
 
-	/* Wait for compelete */
-	while (!(bfin_read_USB_DMA_INTERRUPT() & (1 << epnum)))
-		cpu_relax();
+		/* Wait for compelete */
+		while (!(bfin_read_USB_DMA_INTERRUPT() & (1 << epnum)))
+			cpu_relax();
 
-	/* acknowledge dma interrupt */
-	bfin_write_USB_DMA_INTERRUPT(1 << epnum);
-	SSYNC();
+		/* acknowledge dma interrupt */
+		bfin_write_USB_DMA_INTERRUPT(1 << epnum);
+		SSYNC();
 
-	/* Reset DMA */
-	bfin_write16(USB_DMA_REG(epnum, USB_DMAx_CTRL), 0);
-	SSYNC();
-#else
-	if (unlikely((unsigned long)dst & 0x01))
-		insw_8((unsigned long)fifo, dst,
-			len & 0x01 ? (len >> 1) + 1 : len >> 1);
-	else
-		insw((unsigned long)fifo, dst,
-			len & 0x01 ? (len >> 1) + 1 : len >> 1);
-#endif
+		/* Reset DMA */
+		bfin_write16(USB_DMA_REG(epnum, USB_DMAx_CTRL), 0);
+		SSYNC();
+	} else {
+		SSYNC();
+		/* Read the last byte of packet with odd size from address fifo + 4
+		 * to trigger 1 byte access to EP0 FIFO.
+		 */
+		if (len == 1)
+			*dst = (u8)inw((unsigned long)fifo + 4);
+		else {
+			if (unlikely((unsigned long)dst & 0x01))
+				insw_8((unsigned long)fifo, dst, len >> 1);
+			else
+				insw((unsigned long)fifo, dst, len >> 1);
+
+			if (len & 0x01)
+				*(dst + len - 1) = (u8)inw((unsigned long)fifo + 4);
+		}
+	}
+	DBG(4, "%cX ep%d fifo %p count %d buf %p\n",
+			'R', hw_ep->epnum, fifo, len, dst);
 
 	dump_fifo_data(dst, len);
 }
@@ -225,8 +274,9 @@ int musb_platform_get_vbus_status(struct musb *musb)
 	return 0;
 }
 
-void musb_platform_set_mode(struct musb *musb, u8 musb_mode)
+int musb_platform_set_mode(struct musb *musb, u8 musb_mode)
 {
+	return -EIO;
 }
 
 int __init musb_platform_init(struct musb *musb)
@@ -261,10 +311,6 @@ int __init musb_platform_init(struct musb *musb)
 		SSYNC();
 	}
 
-	/* TODO
-	 * Set SIC-IVG register
-	 */
-
 	/* Configure PLL oscillator register */
 	bfin_write_USB_PLLOSC_CTRL(0x30a8);
 	SSYNC();
diff --git a/drivers/usb/musb/blackfin.h b/drivers/usb/musb/blackfin.h
index a240c1e53d16..bd9352a2ef2a 100644
--- a/drivers/usb/musb/blackfin.h
+++ b/drivers/usb/musb/blackfin.h
@@ -14,6 +14,43 @@
  * Blackfin specific definitions
  */
 
+/* Anomalies notes:
+ *
+ *  05000450 - USB DMA Mode 1 Short Packet Data Corruption:
+ *             MUSB driver is designed to transfer buffer of N * maxpacket size
+ *             in DMA mode 1 and leave the rest of the data to the next
+ *             transfer in DMA mode 0, so we never transmit a short packet in
+ *             DMA mode 1.
+ *
+ *  05000463 - This anomaly doesn't affect this driver since it
+ *             never uses L1 or L2 memory as data destination.
+ *
+ *  05000464 - This anomaly doesn't affect this driver since it
+ *             never uses L1 or L2 memory as data source.
+ *
+ *  05000465 - The anomaly can be seen when SCLK is over 100 MHz, and there is
+ *             no way to workaround for bulk endpoints.  Since the wMaxPackSize
+ *             of bulk is less than or equal to 512, while the fifo size of
+ *             endpoint 5, 6, 7 is 1024, the double buffer mode is enabled
+ *             automatically when these endpoints are used for bulk OUT.
+ *
+ *  05000466 - This anomaly doesn't affect this driver since it never mixes
+ *             concurrent DMA and core accesses to the TX endpoint FIFOs.
+ *
+ *  05000467 - The workaround for this anomaly will introduce another
+ *             anomaly - 05000465.
+ */
+
+/* The Mentor USB DMA engine on BF52x (silicon v0.0 and v0.1) seems to be
+ * unstable in host mode.  This may be caused by Anomaly 05000380.  After
+ * digging out the root cause, we will change this number accordingly.
+ * So, need to either use silicon v0.2+ or disable DMA mode in MUSB.
+ */
+#if ANOMALY_05000380 && defined(CONFIG_BF52x) && \
+    defined(CONFIG_USB_MUSB_HDRC) && !defined(CONFIG_MUSB_PIO_ONLY)
+# error "Please use PIO mode in MUSB driver on bf52x chip v0.0 and v0.1"
+#endif
+
 #undef DUMP_FIFO_DATA
 #ifdef DUMP_FIFO_DATA
 static void dump_fifo_data(u8 *buf, u16 len)
@@ -32,7 +69,6 @@ static void dump_fifo_data(u8 *buf, u16 len)
 #define dump_fifo_data(buf, len)	do {} while (0)
 #endif
 
-#ifdef CONFIG_BF52x
 
 #define USB_DMA_BASE		USB_DMA_INTERRUPT
 #define USB_DMAx_CTRL		0x04
@@ -42,7 +78,6 @@ static void dump_fifo_data(u8 *buf, u16 len)
 #define USB_DMAx_COUNT_HIGH	0x14
 
 #define USB_DMA_REG(ep, reg)	(USB_DMA_BASE + 0x20 * ep + reg)
-#endif
 
 /* Almost 1 second */
 #define TIMER_DELAY	(1 * HZ)
diff --git a/drivers/usb/musb/cppi_dma.c b/drivers/usb/musb/cppi_dma.c
index ef2332a9941d..a44a450c860d 100644
--- a/drivers/usb/musb/cppi_dma.c
+++ b/drivers/usb/musb/cppi_dma.c
@@ -1154,8 +1154,11 @@ irqreturn_t cppi_interrupt(int irq, void *dev_id)
 	struct musb_hw_ep	*hw_ep = NULL;
 	u32			rx, tx;
 	int			i, index;
+	unsigned long		flags;
 
 	cppi = container_of(musb->dma_controller, struct cppi, controller);
+	if (cppi->irq)
+		spin_lock_irqsave(&musb->lock, flags);
 
 	tibase = musb->ctrl_base;
 
@@ -1285,6 +1288,9 @@ irqreturn_t cppi_interrupt(int irq, void *dev_id)
 	/* write to CPPI EOI register to re-enable interrupts */
 	musb_writel(tibase, DAVINCI_CPPI_EOI_REG, 0);
 
+	if (cppi->irq)
+		spin_unlock_irqrestore(&musb->lock, flags);
+
 	return IRQ_HANDLED;
 }
 
diff --git a/drivers/usb/musb/davinci.c b/drivers/usb/musb/davinci.c
index e16ff605c458..66913811af5e 100644
--- a/drivers/usb/musb/davinci.c
+++ b/drivers/usb/musb/davinci.c
@@ -42,7 +42,7 @@
 #include "musb_core.h"
 
 #ifdef CONFIG_MACH_DAVINCI_EVM
-#define GPIO_nVBUS_DRV		144
+#define GPIO_nVBUS_DRV		160
 #endif
 
 #include "davinci.h"
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index 547e0e390726..5eb9318cff77 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -1319,8 +1319,7 @@ static int __init musb_core_init(u16 musb_type, struct musb *musb)
 #endif
 	u8 reg;
 	char *type;
-	u16 hwvers, rev_major, rev_minor;
-	char aInfo[78], aRevision[32], aDate[12];
+	char aInfo[90], aRevision[32], aDate[12];
 	void __iomem	*mbase = musb->mregs;
 	int		status = 0;
 	int		i;
@@ -1391,11 +1390,10 @@ static int __init musb_core_init(u16 musb_type, struct musb *musb)
 	}
 
 	/* log release info */
-	hwvers = musb_read_hwvers(mbase);
-	rev_major = (hwvers >> 10) & 0x1f;
-	rev_minor = hwvers & 0x3ff;
-	snprintf(aRevision, 32, "%d.%d%s", rev_major,
-		rev_minor, (hwvers & 0x8000) ? "RC" : "");
+	musb->hwvers = musb_read_hwvers(mbase);
+	snprintf(aRevision, 32, "%d.%d%s", MUSB_HWVERS_MAJOR(musb->hwvers),
+		MUSB_HWVERS_MINOR(musb->hwvers),
+		(musb->hwvers & MUSB_HWVERS_RC) ? "RC" : "");
 	printk(KERN_DEBUG "%s: %sHDRC RTL version %s %s\n",
 			musb_driver_name, type, aRevision, aDate);
 
@@ -1523,6 +1521,14 @@ irqreturn_t musb_interrupt(struct musb *musb)
 		(devctl & MUSB_DEVCTL_HM) ? "host" : "peripheral",
 		musb->int_usb, musb->int_tx, musb->int_rx);
 
+#ifdef CONFIG_USB_GADGET_MUSB_HDRC
+	if (is_otg_enabled(musb) || is_peripheral_enabled(musb))
+		if (!musb->gadget_driver) {
+			DBG(5, "No gadget driver loaded\n");
+			return IRQ_HANDLED;
+		}
+#endif
+
 	/* the core can interrupt us for multiple reasons; docs have
 	 * a generic interrupt flowchart to follow
 	 */
@@ -2141,7 +2147,7 @@ static int __init musb_probe(struct platform_device *pdev)
 	return musb_init_controller(dev, irq, base);
 }
 
-static int __devexit musb_remove(struct platform_device *pdev)
+static int __exit musb_remove(struct platform_device *pdev)
 {
 	struct musb	*musb = dev_to_musb(&pdev->dev);
 	void __iomem	*ctrl_base = musb->ctrl_base;
@@ -2216,7 +2222,7 @@ static int musb_resume_noirq(struct device *dev)
 	return 0;
 }
 
-static struct dev_pm_ops musb_dev_pm_ops = {
+static const struct dev_pm_ops musb_dev_pm_ops = {
 	.suspend	= musb_suspend,
 	.resume_noirq	= musb_resume_noirq,
 };
@@ -2233,7 +2239,7 @@ static struct platform_driver musb_driver = {
 		.owner		= THIS_MODULE,
 		.pm		= MUSB_DEV_PM_OPS,
 	},
-	.remove		= __devexit_p(musb_remove),
+	.remove		= __exit_p(musb_remove),
 	.shutdown	= musb_shutdown,
 };
 
diff --git a/drivers/usb/musb/musb_core.h b/drivers/usb/musb/musb_core.h
index 6aa5f22e5274..03d50909b078 100644
--- a/drivers/usb/musb/musb_core.h
+++ b/drivers/usb/musb/musb_core.h
@@ -322,6 +322,14 @@ struct musb {
 	struct clk		*clock;
 	irqreturn_t		(*isr)(int, void *);
 	struct work_struct	irq_work;
+#define MUSB_HWVERS_MAJOR(x)	((x >> 10) & 0x1f)
+#define MUSB_HWVERS_MINOR(x)	(x & 0x3ff)
+#define MUSB_HWVERS_RC		0x8000
+#define MUSB_HWVERS_1300	0x52C
+#define MUSB_HWVERS_1400	0x590
+#define MUSB_HWVERS_1800	0x720
+#define MUSB_HWVERS_2000	0x800
+	u16			hwvers;
 
 /* this hub status bit is reserved by USB 2.0 and not seen by usbcore */
 #define MUSB_PORT_STAT_RESUME	(1 << 31)
diff --git a/drivers/usb/musb/musb_dma.h b/drivers/usb/musb/musb_dma.h
index 0a2c4e3602c1..916065ba9e70 100644
--- a/drivers/usb/musb/musb_dma.h
+++ b/drivers/usb/musb/musb_dma.h
@@ -80,6 +80,17 @@ struct musb_hw_ep;
 #define tusb_dma_omap()			0
 #endif
 
+/* Anomaly 05000456 - USB Receive Interrupt Is Not Generated in DMA Mode 1
+ *	Only allow DMA mode 1 to be used when the USB will actually generate the
+ *	interrupts we expect.
+ */
+#ifdef CONFIG_BLACKFIN
+# undef USE_MODE1
+# if !ANOMALY_05000456
+#  define USE_MODE1
+# endif
+#endif
+
 /*
  * DMA channel status ... updated by the dma controller driver whenever that
  * status changes, and protected by the overall controller spinlock.
diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
index 74073f9a43f0..cbcf14a236e6 100644
--- a/drivers/usb/musb/musb_gadget.c
+++ b/drivers/usb/musb/musb_gadget.c
@@ -309,7 +309,7 @@ static void txstate(struct musb *musb, struct musb_request *req)
 			size_t request_size;
 
 			/* setup DMA, then program endpoint CSR */
-			request_size = min(request->length,
+			request_size = min_t(size_t, request->length,
 						musb_ep->dma->max_len);
 			if (request_size < musb_ep->packet_sz)
 				musb_ep->dma->desired_mode = 0;
@@ -319,7 +319,7 @@ static void txstate(struct musb *musb, struct musb_request *req)
 			use_dma = use_dma && c->channel_program(
 					musb_ep->dma, musb_ep->packet_sz,
 					musb_ep->dma->desired_mode,
-					request->dma, request_size);
+					request->dma + request->actual, request_size);
 			if (use_dma) {
 				if (musb_ep->dma->desired_mode == 0) {
 					/*
@@ -429,112 +429,102 @@ void musb_g_tx(struct musb *musb, u8 epnum)
 	DBG(4, "<== %s, txcsr %04x\n", musb_ep->end_point.name, csr);
 
 	dma = is_dma_capable() ? musb_ep->dma : NULL;
-	do {
-		/* REVISIT for high bandwidth, MUSB_TXCSR_P_INCOMPTX
-		 * probably rates reporting as a host error
+
+	/*
+	 * REVISIT: for high bandwidth, MUSB_TXCSR_P_INCOMPTX
+	 * probably rates reporting as a host error.
+	 */
+	if (csr & MUSB_TXCSR_P_SENTSTALL) {
+		csr |=	MUSB_TXCSR_P_WZC_BITS;
+		csr &= ~MUSB_TXCSR_P_SENTSTALL;
+		musb_writew(epio, MUSB_TXCSR, csr);
+		return;
+	}
+
+	if (csr & MUSB_TXCSR_P_UNDERRUN) {
+		/* We NAKed, no big deal... little reason to care. */
+		csr |=	 MUSB_TXCSR_P_WZC_BITS;
+		csr &= ~(MUSB_TXCSR_P_UNDERRUN | MUSB_TXCSR_TXPKTRDY);
+		musb_writew(epio, MUSB_TXCSR, csr);
+		DBG(20, "underrun on ep%d, req %p\n", epnum, request);
+	}
+
+	if (dma_channel_status(dma) == MUSB_DMA_STATUS_BUSY) {
+		/*
+		 * SHOULD NOT HAPPEN... has with CPPI though, after
+		 * changing SENDSTALL (and other cases); harmless?
 		 */
-		if (csr & MUSB_TXCSR_P_SENTSTALL) {
-			csr |= MUSB_TXCSR_P_WZC_BITS;
-			csr &= ~MUSB_TXCSR_P_SENTSTALL;
-			musb_writew(epio, MUSB_TXCSR, csr);
-			break;
-		}
+		DBG(5, "%s dma still busy?\n", musb_ep->end_point.name);
+		return;
+	}
+
+	if (request) {
+		u8	is_dma = 0;
 
-		if (csr & MUSB_TXCSR_P_UNDERRUN) {
-			/* we NAKed, no big deal ... little reason to care */
+		if (dma && (csr & MUSB_TXCSR_DMAENAB)) {
+			is_dma = 1;
 			csr |= MUSB_TXCSR_P_WZC_BITS;
-			csr &= ~(MUSB_TXCSR_P_UNDERRUN
-					| MUSB_TXCSR_TXPKTRDY);
+			csr &= ~(MUSB_TXCSR_DMAENAB | MUSB_TXCSR_P_UNDERRUN |
+				 MUSB_TXCSR_TXPKTRDY);
 			musb_writew(epio, MUSB_TXCSR, csr);
-			DBG(20, "underrun on ep%d, req %p\n", epnum, request);
+			/* Ensure writebuffer is empty. */
+			csr = musb_readw(epio, MUSB_TXCSR);
+			request->actual += musb_ep->dma->actual_len;
+			DBG(4, "TXCSR%d %04x, DMA off, len %zu, req %p\n",
+				epnum, csr, musb_ep->dma->actual_len, request);
 		}
 
-		if (dma_channel_status(dma) == MUSB_DMA_STATUS_BUSY) {
-			/* SHOULD NOT HAPPEN ... has with cppi though, after
-			 * changing SENDSTALL (and other cases); harmless?
+		if (is_dma || request->actual == request->length) {
+			/*
+			 * First, maybe a terminating short packet. Some DMA
+			 * engines might handle this by themselves.
 			 */
-			DBG(5, "%s dma still busy?\n", musb_ep->end_point.name);
-			break;
-		}
-
-		if (request) {
-			u8	is_dma = 0;
+			if ((request->zero && request->length
+				&& request->length % musb_ep->packet_sz == 0)
+#ifdef CONFIG_USB_INVENTRA_DMA
+				|| (is_dma && (!dma->desired_mode ||
+					(request->actual &
+						(musb_ep->packet_sz - 1))))
+#endif
+			) {
+				/*
+				 * On DMA completion, FIFO may not be
+				 * available yet...
+				 */
+				if (csr & MUSB_TXCSR_TXPKTRDY)
+					return;
 
-			if (dma && (csr & MUSB_TXCSR_DMAENAB)) {
-				is_dma = 1;
-				csr |= MUSB_TXCSR_P_WZC_BITS;
-				csr &= ~(MUSB_TXCSR_DMAENAB
-						| MUSB_TXCSR_P_UNDERRUN
+				DBG(4, "sending zero pkt\n");
+				musb_writew(epio, MUSB_TXCSR, MUSB_TXCSR_MODE
 						| MUSB_TXCSR_TXPKTRDY);
-				musb_writew(epio, MUSB_TXCSR, csr);
-				/* ensure writebuffer is empty */
-				csr = musb_readw(epio, MUSB_TXCSR);
-				request->actual += musb_ep->dma->actual_len;
-				DBG(4, "TXCSR%d %04x, dma off, "
-						"len %zu, req %p\n",
-					epnum, csr,
-					musb_ep->dma->actual_len,
-					request);
+				request->zero = 0;
 			}
 
-			if (is_dma || request->actual == request->length) {
-
-				/* First, maybe a terminating short packet.
-				 * Some DMA engines might handle this by
-				 * themselves.
-				 */
-				if ((request->zero
-						&& request->length
-						&& (request->length
-							% musb_ep->packet_sz)
-							== 0)
-#ifdef CONFIG_USB_INVENTRA_DMA
-					|| (is_dma &&
-						((!dma->desired_mode) ||
-						    (request->actual &
-						    (musb_ep->packet_sz - 1))))
-#endif
-				) {
-					/* on dma completion, fifo may not
-					 * be available yet ...
-					 */
-					if (csr & MUSB_TXCSR_TXPKTRDY)
-						break;
-
-					DBG(4, "sending zero pkt\n");
-					musb_writew(epio, MUSB_TXCSR,
-							MUSB_TXCSR_MODE
-							| MUSB_TXCSR_TXPKTRDY);
-					request->zero = 0;
-				}
-
-				/* ... or if not, then complete it */
-				musb_g_giveback(musb_ep, request, 0);
+			/* ... or if not, then complete it. */
+			musb_g_giveback(musb_ep, request, 0);
 
-				/* kickstart next transfer if appropriate;
-				 * the packet that just completed might not
-				 * be transmitted for hours or days.
-				 * REVISIT for double buffering...
-				 * FIXME revisit for stalls too...
-				 */
-				musb_ep_select(mbase, epnum);
-				csr = musb_readw(epio, MUSB_TXCSR);
-				if (csr & MUSB_TXCSR_FIFONOTEMPTY)
-					break;
-				request = musb_ep->desc
-						? next_request(musb_ep)
-						: NULL;
-				if (!request) {
-					DBG(4, "%s idle now\n",
-						musb_ep->end_point.name);
-					break;
-				}
+			/*
+			 * Kickstart next transfer if appropriate;
+			 * the packet that just completed might not
+			 * be transmitted for hours or days.
+			 * REVISIT for double buffering...
+			 * FIXME revisit for stalls too...
+			 */
+			musb_ep_select(mbase, epnum);
+			csr = musb_readw(epio, MUSB_TXCSR);
+			if (csr & MUSB_TXCSR_FIFONOTEMPTY)
+				return;
+
+			request = musb_ep->desc ? next_request(musb_ep) : NULL;
+			if (!request) {
+				DBG(4, "%s idle now\n",
+					musb_ep->end_point.name);
+				return;
 			}
-
-			txstate(musb, to_musb_request(request));
 		}
 
-	} while (0);
+		txstate(musb, to_musb_request(request));
+	}
 }
 
 /* ------------------------------------------------------------ */
@@ -756,6 +746,8 @@ void musb_g_rx(struct musb *musb, u8 epnum)
 	musb_ep_select(mbase, epnum);
 
 	request = next_request(musb_ep);
+	if (!request)
+		return;
 
 	csr = musb_readw(epio, MUSB_RXCSR);
 	dma = is_dma_capable() ? musb_ep->dma : NULL;
@@ -966,6 +958,7 @@ static int musb_gadget_enable(struct usb_ep *ep,
 
 	musb_ep->desc = desc;
 	musb_ep->busy = 0;
+	musb_ep->wedged = 0;
 	status = 0;
 
 	pr_debug("%s periph: enabled %s for %s %s, %smaxpacket %d\n",
@@ -1220,7 +1213,7 @@ done:
  *
  * exported to ep0 code
  */
-int musb_gadget_set_halt(struct usb_ep *ep, int value)
+static int musb_gadget_set_halt(struct usb_ep *ep, int value)
 {
 	struct musb_ep		*musb_ep = to_musb_ep(ep);
 	u8			epnum = musb_ep->current_epnum;
@@ -1262,7 +1255,8 @@ int musb_gadget_set_halt(struct usb_ep *ep, int value)
 				goto done;
 			}
 		}
-	}
+	} else
+		musb_ep->wedged = 0;
 
 	/* set/clear the stall and toggle bits */
 	DBG(2, "%s: %s stall\n", ep->name, value ? "set" : "clear");
@@ -1301,6 +1295,21 @@ done:
 	return status;
 }
 
+/*
+ * Sets the halt feature with the clear requests ignored
+ */
+static int musb_gadget_set_wedge(struct usb_ep *ep)
+{
+	struct musb_ep		*musb_ep = to_musb_ep(ep);
+
+	if (!ep)
+		return -EINVAL;
+
+	musb_ep->wedged = 1;
+
+	return usb_ep_set_halt(ep);
+}
+
 static int musb_gadget_fifo_status(struct usb_ep *ep)
 {
 	struct musb_ep		*musb_ep = to_musb_ep(ep);
@@ -1371,6 +1380,7 @@ static const struct usb_ep_ops musb_ep_ops = {
 	.queue		= musb_gadget_queue,
 	.dequeue	= musb_gadget_dequeue,
 	.set_halt	= musb_gadget_set_halt,
+	.set_wedge	= musb_gadget_set_wedge,
 	.fifo_status	= musb_gadget_fifo_status,
 	.fifo_flush	= musb_gadget_fifo_flush
 };
@@ -1723,6 +1733,7 @@ int usb_gadget_register_driver(struct usb_gadget_driver *driver)
 		spin_lock_irqsave(&musb->lock, flags);
 
 		otg_set_peripheral(musb->xceiv, &musb->g);
+		musb->xceiv->state = OTG_STATE_B_IDLE;
 		musb->is_active = 1;
 
 		/* FIXME this ignores the softconnect flag.  Drivers are
diff --git a/drivers/usb/musb/musb_gadget.h b/drivers/usb/musb/musb_gadget.h
index 59502da9f739..c8b140325d82 100644
--- a/drivers/usb/musb/musb_gadget.h
+++ b/drivers/usb/musb/musb_gadget.h
@@ -75,6 +75,8 @@ struct musb_ep {
 	/* later things are modified based on usage */
 	struct list_head		req_list;
 
+	u8				wedged;
+
 	/* true if lock must be dropped but req_list may not be advanced */
 	u8				busy;
 };
@@ -103,6 +105,4 @@ extern void musb_gadget_cleanup(struct musb *);
 
 extern void musb_g_giveback(struct musb_ep *, struct usb_request *, int);
 
-extern int musb_gadget_set_halt(struct usb_ep *ep, int value);
-
 #endif		/* __MUSB_GADGET_H */
diff --git a/drivers/usb/musb/musb_gadget_ep0.c b/drivers/usb/musb/musb_gadget_ep0.c
index 522efb31b56b..53d06451f820 100644
--- a/drivers/usb/musb/musb_gadget_ep0.c
+++ b/drivers/usb/musb/musb_gadget_ep0.c
@@ -199,7 +199,6 @@ service_in_request(struct musb *musb, const struct usb_ctrlrequest *ctrlrequest)
 static void musb_g_ep0_giveback(struct musb *musb, struct usb_request *req)
 {
 	musb_g_giveback(&musb->endpoints[0].ep_in, req, 0);
-	musb->ep0_state = MUSB_EP0_STAGE_SETUP;
 }
 
 /*
@@ -258,30 +257,53 @@ __acquires(musb->lock)
 			case USB_RECIP_INTERFACE:
 				break;
 			case USB_RECIP_ENDPOINT:{
-				const u8 num = ctrlrequest->wIndex & 0x0f;
-				struct musb_ep *musb_ep;
+				const u8		epnum =
+					ctrlrequest->wIndex & 0x0f;
+				struct musb_ep		*musb_ep;
+				struct musb_hw_ep	*ep;
+				void __iomem		*regs;
+				int			is_in;
+				u16			csr;
 
-				if (num == 0
-						|| num >= MUSB_C_NUM_EPS
-						|| ctrlrequest->wValue
-							!= USB_ENDPOINT_HALT)
+				if (epnum == 0 || epnum >= MUSB_C_NUM_EPS ||
+				    ctrlrequest->wValue != USB_ENDPOINT_HALT)
 					break;
 
-				if (ctrlrequest->wIndex & USB_DIR_IN)
-					musb_ep = &musb->endpoints[num].ep_in;
+				ep = musb->endpoints + epnum;
+				regs = ep->regs;
+				is_in = ctrlrequest->wIndex & USB_DIR_IN;
+				if (is_in)
+					musb_ep = &ep->ep_in;
 				else
-					musb_ep = &musb->endpoints[num].ep_out;
+					musb_ep = &ep->ep_out;
 				if (!musb_ep->desc)
 					break;
 
-				/* REVISIT do it directly, no locking games */
-				spin_unlock(&musb->lock);
-				musb_gadget_set_halt(&musb_ep->end_point, 0);
-				spin_lock(&musb->lock);
+				handled = 1;
+				/* Ignore request if endpoint is wedged */
+				if (musb_ep->wedged)
+					break;
+
+				musb_ep_select(mbase, epnum);
+				if (is_in) {
+					csr  = musb_readw(regs, MUSB_TXCSR);
+					csr |= MUSB_TXCSR_CLRDATATOG |
+					       MUSB_TXCSR_P_WZC_BITS;
+					csr &= ~(MUSB_TXCSR_P_SENDSTALL |
+						 MUSB_TXCSR_P_SENTSTALL |
+						 MUSB_TXCSR_TXPKTRDY);
+					musb_writew(regs, MUSB_TXCSR, csr);
+				} else {
+					csr  = musb_readw(regs, MUSB_RXCSR);
+					csr |= MUSB_RXCSR_CLRDATATOG |
+					       MUSB_RXCSR_P_WZC_BITS;
+					csr &= ~(MUSB_RXCSR_P_SENDSTALL |
+						 MUSB_RXCSR_P_SENTSTALL);
+					musb_writew(regs, MUSB_RXCSR, csr);
+				}
 
 				/* select ep0 again */
 				musb_ep_select(mbase, 0);
-				handled = 1;
 				} break;
 			default:
 				/* class, vendor, etc ... delegate */
@@ -374,10 +396,8 @@ stall:
 				int			is_in;
 				u16			csr;
 
-				if (epnum == 0
-						|| epnum >= MUSB_C_NUM_EPS
-						|| ctrlrequest->wValue
-							!= USB_ENDPOINT_HALT)
+				if (epnum == 0 || epnum >= MUSB_C_NUM_EPS ||
+				    ctrlrequest->wValue	!= USB_ENDPOINT_HALT)
 					break;
 
 				ep = musb->endpoints + epnum;
@@ -392,24 +412,20 @@ stall:
 
 				musb_ep_select(mbase, epnum);
 				if (is_in) {
-					csr = musb_readw(regs,
-							MUSB_TXCSR);
+					csr = musb_readw(regs, MUSB_TXCSR);
 					if (csr & MUSB_TXCSR_FIFONOTEMPTY)
 						csr |= MUSB_TXCSR_FLUSHFIFO;
 					csr |= MUSB_TXCSR_P_SENDSTALL
 						| MUSB_TXCSR_CLRDATATOG
 						| MUSB_TXCSR_P_WZC_BITS;
-					musb_writew(regs, MUSB_TXCSR,
-							csr);
+					musb_writew(regs, MUSB_TXCSR, csr);
 				} else {
-					csr = musb_readw(regs,
-							MUSB_RXCSR);
+					csr = musb_readw(regs, MUSB_RXCSR);
 					csr |= MUSB_RXCSR_P_SENDSTALL
 						| MUSB_RXCSR_FLUSHFIFO
 						| MUSB_RXCSR_CLRDATATOG
 						| MUSB_RXCSR_P_WZC_BITS;
-					musb_writew(regs, MUSB_RXCSR,
-							csr);
+					musb_writew(regs, MUSB_RXCSR, csr);
 				}
 
 				/* select ep0 again */
@@ -648,7 +664,7 @@ irqreturn_t musb_g_ep0_irq(struct musb *musb)
 			musb->ep0_state = MUSB_EP0_STAGE_STATUSIN;
 			break;
 		default:
-			ERR("SetupEnd came in a wrong ep0stage %s",
+			ERR("SetupEnd came in a wrong ep0stage %s\n",
 			    decode_ep0stage(musb->ep0_state));
 		}
 		csr = musb_readw(regs, MUSB_CSR0);
@@ -771,12 +787,18 @@ setup:
 				handled = service_zero_data_request(
 						musb, &setup);
 
+				/*
+				 * We're expecting no data in any case, so
+				 * always set the DATAEND bit -- doing this
+				 * here helps avoid SetupEnd interrupt coming
+				 * in the idle stage when we're stalling...
+				 */
+				musb->ackpend |= MUSB_CSR0_P_DATAEND;
+
 				/* status stage might be immediate */
-				if (handled > 0) {
-					musb->ackpend |= MUSB_CSR0_P_DATAEND;
+				if (handled > 0)
 					musb->ep0_state =
 						MUSB_EP0_STAGE_STATUSIN;
-				}
 				break;
 
 			/* sequence #1 (IN to host), includes GET_STATUS
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index e3ab40a966eb..74c4c3698f1e 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -1642,18 +1642,18 @@ void musb_host_rx(struct musb *musb, u8 epnum)
 			c = musb->dma_controller;
 
 			if (usb_pipeisoc(pipe)) {
-				int status = 0;
+				int d_status = 0;
 				struct usb_iso_packet_descriptor *d;
 
 				d = urb->iso_frame_desc + qh->iso_idx;
 
 				if (iso_err) {
-					status = -EILSEQ;
+					d_status = -EILSEQ;
 					urb->error_count++;
 				}
 				if (rx_count > d->length) {
-					if (status == 0) {
-						status = -EOVERFLOW;
+					if (d_status == 0) {
+						d_status = -EOVERFLOW;
 						urb->error_count++;
 					}
 					DBG(2, "** OVERFLOW %d into %d\n",\
@@ -1662,7 +1662,7 @@ void musb_host_rx(struct musb *musb, u8 epnum)
 					length = d->length;
 				} else
 					length = rx_count;
-				d->status = status;
+				d->status = d_status;
 				buf = urb->transfer_dma + d->offset;
 			} else {
 				length = rx_count;
diff --git a/drivers/usb/musb/musb_regs.h b/drivers/usb/musb/musb_regs.h
index cc1d71b57d3c..473a94ef905f 100644
--- a/drivers/usb/musb/musb_regs.h
+++ b/drivers/usb/musb/musb_regs.h
@@ -465,9 +465,9 @@ static inline u16 musb_read_hwvers(void __iomem *mbase)
 	return 0;
 }
 
-static inline u16 musb_read_target_reg_base(u8 i, void __iomem *mbase)
+static inline void __iomem *musb_read_target_reg_base(u8 i, void __iomem *mbase)
 {
-	return 0;
+	return NULL;
 }
 
 static inline void musb_write_rxfunaddr(void __iomem *ep_target_regs,
diff --git a/drivers/usb/musb/musbhsdma.c b/drivers/usb/musb/musbhsdma.c
index 5e83f96d6b77..a237550f91bf 100644
--- a/drivers/usb/musb/musbhsdma.c
+++ b/drivers/usb/musb/musbhsdma.c
@@ -259,6 +259,11 @@ static irqreturn_t dma_controller_irq(int irq, void *private_data)
 	if (!int_hsdma)
 		goto done;
 
+#ifdef CONFIG_BLACKFIN
+	/* Clear DMA interrupt flags */
+	musb_writeb(mbase, MUSB_HSDMA_INTR, int_hsdma);
+#endif
+
 	for (bchannel = 0; bchannel < MUSB_HSDMA_CHANNELS; bchannel++) {
 		if (int_hsdma & (1 << bchannel)) {
 			musb_channel = (struct musb_dma_channel *)
@@ -280,7 +285,7 @@ static irqreturn_t dma_controller_irq(int irq, void *private_data)
 				channel->actual_len = addr
 					- musb_channel->start_addr;
 
-				DBG(2, "ch %p, 0x%x -> 0x%x (%d / %d) %s\n",
+				DBG(2, "ch %p, 0x%x -> 0x%x (%zu / %d) %s\n",
 					channel, musb_channel->start_addr,
 					addr, channel->actual_len,
 					musb_channel->len,
@@ -324,11 +329,6 @@ static irqreturn_t dma_controller_irq(int irq, void *private_data)
 		}
 	}
 
-#ifdef CONFIG_BLACKFIN
-	/* Clear DMA interrup flags */
-	musb_writeb(mbase, MUSB_HSDMA_INTR, int_hsdma);
-#endif
-
 	retval = IRQ_HANDLED;
 done:
 	spin_unlock_irqrestore(&musb->lock, flags);
diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
index 6761d2088db8..83beeac5e7bf 100644
--- a/drivers/usb/musb/omap2430.c
+++ b/drivers/usb/musb/omap2430.c
@@ -315,7 +315,7 @@ int musb_platform_exit(struct musb *musb)
 	musb_platform_suspend(musb);
 
 	clk_put(musb->clock);
-	musb->clock = 0;
+	musb->clock = NULL;
 
 	return 0;
 }
diff --git a/drivers/usb/otg/Kconfig b/drivers/usb/otg/Kconfig
index aa884d072f0b..de56b3d743d7 100644
--- a/drivers/usb/otg/Kconfig
+++ b/drivers/usb/otg/Kconfig
@@ -41,6 +41,15 @@ config ISP1301_OMAP
 	  This driver can also be built as a module.  If so, the module
 	  will be called isp1301_omap.
 
+config USB_ULPI
+	bool "Generic ULPI Transceiver Driver"
+	depends on ARM
+	help
+	  Enable this to support ULPI connected USB OTG transceivers which
+	  are likely found on embedded boards.
+
+	  The only chip currently supported is NXP's ISP1504
+
 config TWL4030_USB
 	tristate "TWL4030 USB Transceiver Driver"
 	depends on TWL4030_CORE && REGULATOR_TWL4030
diff --git a/drivers/usb/otg/Makefile b/drivers/usb/otg/Makefile
index 208167856529..aeb49a8ec412 100644
--- a/drivers/usb/otg/Makefile
+++ b/drivers/usb/otg/Makefile
@@ -10,6 +10,7 @@ obj-$(CONFIG_USB_GPIO_VBUS)	+= gpio_vbus.o
 obj-$(CONFIG_ISP1301_OMAP)	+= isp1301_omap.o
 obj-$(CONFIG_TWL4030_USB)	+= twl4030-usb.o
 obj-$(CONFIG_NOP_USB_XCEIV)	+= nop-usb-xceiv.o
+obj-$(CONFIG_USB_ULPI)		+= ulpi.o
 
 ccflags-$(CONFIG_USB_DEBUG)	+= -DDEBUG
 ccflags-$(CONFIG_USB_GADGET_DEBUG) += -DDEBUG
diff --git a/drivers/usb/otg/isp1301_omap.c b/drivers/usb/otg/isp1301_omap.c
index d54460a88173..78a209709260 100644
--- a/drivers/usb/otg/isp1301_omap.c
+++ b/drivers/usb/otg/isp1301_omap.c
@@ -843,7 +843,7 @@ static irqreturn_t omap_otg_irq(int irq, void *_isp)
 
 static struct platform_device *otg_dev;
 
-static int otg_init(struct isp1301 *isp)
+static int isp1301_otg_init(struct isp1301 *isp)
 {
 	u32 l;
 
@@ -1275,7 +1275,7 @@ static int __exit isp1301_remove(struct i2c_client *i2c)
 static int isp1301_otg_enable(struct isp1301 *isp)
 {
 	power_up(isp);
-	otg_init(isp);
+	isp1301_otg_init(isp);
 
 	/* NOTE:  since we don't change this, this provides
 	 * a few more interrupts than are strictly needed.
diff --git a/drivers/usb/otg/twl4030-usb.c b/drivers/usb/otg/twl4030-usb.c
index 9e3e7a5c258b..2be9f2fa41f9 100644
--- a/drivers/usb/otg/twl4030-usb.c
+++ b/drivers/usb/otg/twl4030-usb.c
@@ -33,7 +33,7 @@
 #include <linux/io.h>
 #include <linux/delay.h>
 #include <linux/usb/otg.h>
-#include <linux/i2c/twl4030.h>
+#include <linux/i2c/twl.h>
 #include <linux/regulator/consumer.h>
 #include <linux/err.h>
 
@@ -276,16 +276,16 @@ static int twl4030_i2c_write_u8_verify(struct twl4030_usb *twl,
 {
 	u8 check;
 
-	if ((twl4030_i2c_write_u8(module, data, address) >= 0) &&
-	    (twl4030_i2c_read_u8(module, &check, address) >= 0) &&
+	if ((twl_i2c_write_u8(module, data, address) >= 0) &&
+	    (twl_i2c_read_u8(module, &check, address) >= 0) &&
 						(check == data))
 		return 0;
 	dev_dbg(twl->dev, "Write%d[%d,0x%x] wrote %02x but read %02x\n",
 			1, module, address, check, data);
 
 	/* Failed once: Try again */
-	if ((twl4030_i2c_write_u8(module, data, address) >= 0) &&
-	    (twl4030_i2c_read_u8(module, &check, address) >= 0) &&
+	if ((twl_i2c_write_u8(module, data, address) >= 0) &&
+	    (twl_i2c_read_u8(module, &check, address) >= 0) &&
 						(check == data))
 		return 0;
 	dev_dbg(twl->dev, "Write%d[%d,0x%x] wrote %02x but read %02x\n",
@@ -303,7 +303,7 @@ static inline int twl4030_usb_write(struct twl4030_usb *twl,
 {
 	int ret = 0;
 
-	ret = twl4030_i2c_write_u8(TWL4030_MODULE_USB, data, address);
+	ret = twl_i2c_write_u8(TWL4030_MODULE_USB, data, address);
 	if (ret < 0)
 		dev_dbg(twl->dev,
 			"TWL4030:USB:Write[0x%x] Error %d\n", address, ret);
@@ -315,7 +315,7 @@ static inline int twl4030_readb(struct twl4030_usb *twl, u8 module, u8 address)
 	u8 data;
 	int ret = 0;
 
-	ret = twl4030_i2c_read_u8(module, &data, address);
+	ret = twl_i2c_read_u8(module, &data, address);
 	if (ret >= 0)
 		ret = data;
 	else
@@ -462,7 +462,7 @@ static void twl4030_phy_power(struct twl4030_usb *twl, int on)
 		 * SLEEP. We work around this by clearing the bit after usv3v1
 		 * is re-activated. This ensures that VUSB3V1 is really active.
 		 */
-		twl4030_i2c_write_u8(TWL4030_MODULE_PM_RECEIVER, 0,
+		twl_i2c_write_u8(TWL4030_MODULE_PM_RECEIVER, 0,
 							VUSB_DEDICATED2);
 		regulator_enable(twl->usb1v5);
 		pwr &= ~PHY_PWR_PHYPWD;
@@ -505,44 +505,44 @@ static void twl4030_phy_resume(struct twl4030_usb *twl)
 static int twl4030_usb_ldo_init(struct twl4030_usb *twl)
 {
 	/* Enable writing to power configuration registers */
-	twl4030_i2c_write_u8(TWL4030_MODULE_PM_MASTER, 0xC0, PROTECT_KEY);
-	twl4030_i2c_write_u8(TWL4030_MODULE_PM_MASTER, 0x0C, PROTECT_KEY);
+	twl_i2c_write_u8(TWL4030_MODULE_PM_MASTER, 0xC0, PROTECT_KEY);
+	twl_i2c_write_u8(TWL4030_MODULE_PM_MASTER, 0x0C, PROTECT_KEY);
 
 	/* put VUSB3V1 LDO in active state */
-	twl4030_i2c_write_u8(TWL4030_MODULE_PM_RECEIVER, 0, VUSB_DEDICATED2);
+	twl_i2c_write_u8(TWL4030_MODULE_PM_RECEIVER, 0, VUSB_DEDICATED2);
 
 	/* input to VUSB3V1 LDO is from VBAT, not VBUS */
-	twl4030_i2c_write_u8(TWL4030_MODULE_PM_RECEIVER, 0x14, VUSB_DEDICATED1);
+	twl_i2c_write_u8(TWL4030_MODULE_PM_RECEIVER, 0x14, VUSB_DEDICATED1);
 
 	/* Initialize 3.1V regulator */
-	twl4030_i2c_write_u8(TWL4030_MODULE_PM_RECEIVER, 0, VUSB3V1_DEV_GRP);
+	twl_i2c_write_u8(TWL4030_MODULE_PM_RECEIVER, 0, VUSB3V1_DEV_GRP);
 
 	twl->usb3v1 = regulator_get(twl->dev, "usb3v1");
 	if (IS_ERR(twl->usb3v1))
 		return -ENODEV;
 
-	twl4030_i2c_write_u8(TWL4030_MODULE_PM_RECEIVER, 0, VUSB3V1_TYPE);
+	twl_i2c_write_u8(TWL4030_MODULE_PM_RECEIVER, 0, VUSB3V1_TYPE);
 
 	/* Initialize 1.5V regulator */
-	twl4030_i2c_write_u8(TWL4030_MODULE_PM_RECEIVER, 0, VUSB1V5_DEV_GRP);
+	twl_i2c_write_u8(TWL4030_MODULE_PM_RECEIVER, 0, VUSB1V5_DEV_GRP);
 
 	twl->usb1v5 = regulator_get(twl->dev, "usb1v5");
 	if (IS_ERR(twl->usb1v5))
 		goto fail1;
 
-	twl4030_i2c_write_u8(TWL4030_MODULE_PM_RECEIVER, 0, VUSB1V5_TYPE);
+	twl_i2c_write_u8(TWL4030_MODULE_PM_RECEIVER, 0, VUSB1V5_TYPE);
 
 	/* Initialize 1.8V regulator */
-	twl4030_i2c_write_u8(TWL4030_MODULE_PM_RECEIVER, 0, VUSB1V8_DEV_GRP);
+	twl_i2c_write_u8(TWL4030_MODULE_PM_RECEIVER, 0, VUSB1V8_DEV_GRP);
 
 	twl->usb1v8 = regulator_get(twl->dev, "usb1v8");
 	if (IS_ERR(twl->usb1v8))
 		goto fail2;
 
-	twl4030_i2c_write_u8(TWL4030_MODULE_PM_RECEIVER, 0, VUSB1V8_TYPE);
+	twl_i2c_write_u8(TWL4030_MODULE_PM_RECEIVER, 0, VUSB1V8_TYPE);
 
 	/* disable access to power configuration registers */
-	twl4030_i2c_write_u8(TWL4030_MODULE_PM_MASTER, 0, PROTECT_KEY);
+	twl_i2c_write_u8(TWL4030_MODULE_PM_MASTER, 0, PROTECT_KEY);
 
 	return 0;
 
@@ -598,12 +598,12 @@ static irqreturn_t twl4030_usb_irq(int irq, void *_twl)
 		 * USB_LINK_VBUS state.  musb_hdrc won't care until it
 		 * starts to handle softconnect right.
 		 */
-		twl4030charger_usb_en(status == USB_LINK_VBUS);
-
 		if (status == USB_LINK_NONE)
 			twl4030_phy_suspend(twl, 0);
 		else
 			twl4030_phy_resume(twl);
+
+		twl4030charger_usb_en(status == USB_LINK_VBUS);
 	}
 	sysfs_notify(&twl->dev->kobj, NULL, "vbus");
 
diff --git a/drivers/usb/otg/ulpi.c b/drivers/usb/otg/ulpi.c
new file mode 100644
index 000000000000..896527456b7e
--- /dev/null
+++ b/drivers/usb/otg/ulpi.c
@@ -0,0 +1,136 @@
+/*
+ * Generic ULPI USB transceiver support
+ *
+ * Copyright (C) 2009 Daniel Mack <daniel@caiaq.de>
+ *
+ * Based on sources from
+ *
+ *   Sascha Hauer <s.hauer@pengutronix.de>
+ *   Freescale Semiconductors
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include <linux/kernel.h>
+#include <linux/usb.h>
+#include <linux/usb/otg.h>
+#include <linux/usb/ulpi.h>
+
+/* ULPI register addresses */
+#define ULPI_VID_LOW         0x00    /* Vendor ID low */
+#define ULPI_VID_HIGH        0x01    /* Vendor ID high */
+#define ULPI_PID_LOW         0x02    /* Product ID low */
+#define ULPI_PID_HIGH        0x03    /* Product ID high */
+#define ULPI_ITFCTL          0x07    /* Interface Control */
+#define ULPI_OTGCTL          0x0A    /* OTG Control */
+
+/* add to above register address to access Set/Clear functions */
+#define ULPI_REG_SET         0x01
+#define ULPI_REG_CLEAR       0x02
+
+/* ULPI OTG Control Register bits */
+#define ID_PULL_UP              (1 << 0)        /* enable ID Pull Up */
+#define DP_PULL_DOWN            (1 << 1)        /* enable DP Pull Down */
+#define DM_PULL_DOWN            (1 << 2)        /* enable DM Pull Down */
+#define DISCHRG_VBUS            (1 << 3)        /* Discharge Vbus */
+#define CHRG_VBUS               (1 << 4)        /* Charge Vbus */
+#define DRV_VBUS                (1 << 5)        /* Drive Vbus */
+#define DRV_VBUS_EXT            (1 << 6)        /* Drive Vbus external */
+#define USE_EXT_VBUS_IND        (1 << 7)        /* Use ext. Vbus indicator */
+
+#define ULPI_ID(vendor, product) (((vendor) << 16) | (product))
+
+#define TR_FLAG(flags, a, b)	(((flags) & a) ? b : 0)
+
+/* ULPI hardcoded IDs, used for probing */
+static unsigned int ulpi_ids[] = {
+	ULPI_ID(0x04cc, 0x1504),	/* NXP ISP1504 */
+};
+
+static int ulpi_set_flags(struct otg_transceiver *otg)
+{
+	unsigned int flags = 0;
+
+	if (otg->flags & USB_OTG_PULLUP_ID)
+		flags |= ID_PULL_UP;
+
+	if (otg->flags & USB_OTG_PULLDOWN_DM)
+		flags |= DM_PULL_DOWN;
+
+	if (otg->flags & USB_OTG_PULLDOWN_DP)
+		flags |= DP_PULL_DOWN;
+
+	if (otg->flags & USB_OTG_EXT_VBUS_INDICATOR)
+		flags |= USE_EXT_VBUS_IND;
+
+	return otg_io_write(otg, flags, ULPI_OTGCTL + ULPI_REG_SET);
+}
+
+static int ulpi_init(struct otg_transceiver *otg)
+{
+	int i, vid, pid;
+
+	vid = (otg_io_read(otg, ULPI_VID_HIGH) << 8) |
+	       otg_io_read(otg, ULPI_VID_LOW);
+	pid = (otg_io_read(otg, ULPI_PID_HIGH) << 8) |
+	       otg_io_read(otg, ULPI_PID_LOW);
+
+	pr_info("ULPI transceiver vendor/product ID 0x%04x/0x%04x\n", vid, pid);
+
+	for (i = 0; i < ARRAY_SIZE(ulpi_ids); i++)
+		if (ulpi_ids[i] == ULPI_ID(vid, pid))
+			return ulpi_set_flags(otg);
+
+	pr_err("ULPI ID does not match any known transceiver.\n");
+	return -ENODEV;
+}
+
+static int ulpi_set_vbus(struct otg_transceiver *otg, bool on)
+{
+	unsigned int flags = otg_io_read(otg, ULPI_OTGCTL);
+
+	flags &= ~(DRV_VBUS | DRV_VBUS_EXT);
+
+	if (on) {
+		if (otg->flags & USB_OTG_DRV_VBUS)
+			flags |= DRV_VBUS;
+
+		if (otg->flags & USB_OTG_DRV_VBUS_EXT)
+			flags |= DRV_VBUS_EXT;
+	}
+
+	return otg_io_write(otg, flags, ULPI_OTGCTL + ULPI_REG_SET);
+}
+
+struct otg_transceiver *
+otg_ulpi_create(struct otg_io_access_ops *ops,
+		unsigned int flags)
+{
+	struct otg_transceiver *otg;
+
+	otg = kzalloc(sizeof(*otg), GFP_KERNEL);
+	if (!otg)
+		return NULL;
+
+	otg->label	= "ULPI";
+	otg->flags	= flags;
+	otg->io_ops	= ops;
+	otg->init	= ulpi_init;
+	otg->set_vbus	= ulpi_set_vbus;
+
+	return otg;
+}
+EXPORT_SYMBOL_GPL(otg_ulpi_create);
+
diff --git a/drivers/usb/serial/ark3116.c b/drivers/usb/serial/ark3116.c
index 131e61adaaf7..a9c2dec8e3fb 100644
--- a/drivers/usb/serial/ark3116.c
+++ b/drivers/usb/serial/ark3116.c
@@ -1,4 +1,6 @@
 /*
+ * Copyright (C) 2009 by Bart Hartgers (bart.hartgers+ark3116@gmail.com)
+ * Original version:
  * Copyright (C) 2006
  *   Simon Schulz (ark3116_driver <at> auctionant.de)
  *
@@ -6,10 +8,13 @@
  * - implements a driver for the arkmicro ark3116 chipset (vendor=0x6547,
  *   productid=0x0232) (used in a datacable called KQ-U8A)
  *
- * - based on code by krisfx -> thanks !!
- *   (see http://www.linuxquestions.org/questions/showthread.php?p=2184457#post2184457)
+ * Supports full modem status lines, break, hardware flow control. Does not
+ * support software flow control, since I do not know how to enable it in hw.
  *
- *  - based on logs created by usbsnoopy
+ * This driver is a essentially new implementation. I initially dug
+ * into the old ark3116.c driver and suddenly realized the ark3116 is
+ * a 16450 with a USB interface glued to it. See comments at the
+ * bottom of this file.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License as published by the
@@ -19,15 +24,31 @@
 
 #include <linux/kernel.h>
 #include <linux/init.h>
+#include <linux/ioctl.h>
 #include <linux/tty.h>
+#include <linux/tty_flip.h>
 #include <linux/module.h>
 #include <linux/usb.h>
 #include <linux/usb/serial.h>
 #include <linux/serial.h>
+#include <linux/serial_reg.h>
 #include <linux/uaccess.h>
-
+#include <linux/mutex.h>
+#include <linux/spinlock.h>
 
 static int debug;
+/*
+ * Version information
+ */
+
+#define DRIVER_VERSION "v0.5"
+#define DRIVER_AUTHOR "Bart Hartgers <bart.hartgers+ark3116@gmail.com>"
+#define DRIVER_DESC "USB ARK3116 serial/IrDA driver"
+#define DRIVER_DEV_DESC "ARK3116 RS232/IrDA"
+#define DRIVER_NAME "ark3116"
+
+/* usb timeout of 1 second */
+#define ARK_TIMEOUT (1*HZ)
 
 static struct usb_device_id id_table [] = {
 	{ USB_DEVICE(0x6547, 0x0232) },
@@ -45,118 +66,152 @@ static int is_irda(struct usb_serial *serial)
 	return 0;
 }
 
-static inline void ARK3116_SND(struct usb_serial *serial, int seq,
-			       __u8 request, __u8 requesttype,
-			       __u16 value, __u16 index)
+struct ark3116_private {
+	wait_queue_head_t       delta_msr_wait;
+	struct async_icount	icount;
+	int			irda;	/* 1 for irda device */
+
+	/* protects hw register updates */
+	struct mutex		hw_lock;
+
+	int			quot;	/* baudrate divisor */
+	__u32			lcr;	/* line control register value */
+	__u32			hcr;	/* handshake control register (0x8)
+					 * value */
+	__u32			mcr;	/* modem contol register value */
+
+	/* protects the status values below */
+	spinlock_t		status_lock;
+	__u32			msr;	/* modem status register value */
+	__u32			lsr;	/* line status register value */
+};
+
+static int ark3116_write_reg(struct usb_serial *serial,
+			     unsigned reg, __u8 val)
 {
 	int result;
+	 /* 0xfe 0x40 are magic values taken from original driver */
 	result = usb_control_msg(serial->dev,
 				 usb_sndctrlpipe(serial->dev, 0),
-				 request, requesttype, value, index,
-				 NULL, 0x00, 1000);
-	dbg("%03d > ok", seq);
+				 0xfe, 0x40, val, reg,
+				 NULL, 0, ARK_TIMEOUT);
+	return result;
 }
 
-static inline void ARK3116_RCV(struct usb_serial *serial, int seq,
-			       __u8 request, __u8 requesttype,
-			       __u16 value, __u16 index, __u8 expected,
-			       char *buf)
+static int ark3116_read_reg(struct usb_serial *serial,
+			    unsigned reg, unsigned char *buf)
 {
 	int result;
+	/* 0xfe 0xc0 are magic values taken from original driver */
 	result = usb_control_msg(serial->dev,
 				 usb_rcvctrlpipe(serial->dev, 0),
-				 request, requesttype, value, index,
-				 buf, 0x0000001, 1000);
-	if (result)
-		dbg("%03d < %d bytes [0x%02X]", seq, result,
-		    ((unsigned char *)buf)[0]);
+				 0xfe, 0xc0, 0, reg,
+				 buf, 1, ARK_TIMEOUT);
+	if (result < 0)
+		return result;
 	else
-		dbg("%03d < 0 bytes", seq);
+		return buf[0];
 }
 
-static inline void ARK3116_RCV_QUIET(struct usb_serial *serial,
-				     __u8 request, __u8 requesttype,
-				     __u16 value, __u16 index, char *buf)
+static inline int calc_divisor(int bps)
 {
-	usb_control_msg(serial->dev,
-			usb_rcvctrlpipe(serial->dev, 0),
-			request, requesttype, value, index,
-			buf, 0x0000001, 1000);
+	/* Original ark3116 made some exceptions in rounding here
+	 * because windows did the same. Assume that is not really
+	 * necessary.
+	 * Crystal is 12MHz, probably because of USB, but we divide by 4?
+	 */
+	return (12000000 + 2*bps) / (4*bps);
 }
 
 static int ark3116_attach(struct usb_serial *serial)
 {
-	char *buf;
+	struct usb_serial_port *port = serial->port[0];
+	struct ark3116_private *priv;
+
+	/* make sure we have our end-points */
+	if ((serial->num_bulk_in == 0) ||
+	    (serial->num_bulk_out == 0) ||
+	    (serial->num_interrupt_in == 0)) {
+		dev_err(&serial->dev->dev,
+			"%s - missing endpoint - "
+			"bulk in: %d, bulk out: %d, int in %d\n",
+			KBUILD_MODNAME,
+			serial->num_bulk_in,
+			serial->num_bulk_out,
+			serial->num_interrupt_in);
+		return -EINVAL;
+	}
 
-	buf = kmalloc(1, GFP_KERNEL);
-	if (!buf) {
-		dbg("error kmalloc -> out of mem?");
+	priv = kzalloc(sizeof(struct ark3116_private),
+		       GFP_KERNEL);
+	if (!priv)
 		return -ENOMEM;
-	}
 
-	if (is_irda(serial))
-		dbg("IrDA mode");
+	init_waitqueue_head(&priv->delta_msr_wait);
+	mutex_init(&priv->hw_lock);
+	spin_lock_init(&priv->status_lock);
+
+	priv->irda = is_irda(serial);
 
-	/* 3 */
-	ARK3116_SND(serial, 3, 0xFE, 0x40, 0x0008, 0x0002);
-	ARK3116_SND(serial, 4, 0xFE, 0x40, 0x0008, 0x0001);
-	ARK3116_SND(serial, 5, 0xFE, 0x40, 0x0000, 0x0008);
-	ARK3116_SND(serial, 6, 0xFE, 0x40, is_irda(serial) ? 0x0001 : 0x0000,
-		    0x000B);
+	usb_set_serial_port_data(port, priv);
 
-	if (is_irda(serial)) {
-		ARK3116_SND(serial, 1001, 0xFE, 0x40, 0x0000, 0x000C);
-		ARK3116_SND(serial, 1002, 0xFE, 0x40, 0x0041, 0x000D);
-		ARK3116_SND(serial, 1003, 0xFE, 0x40, 0x0001, 0x000A);
+	/* setup the hardware */
+	ark3116_write_reg(serial, UART_IER, 0);
+	/* disable DMA */
+	ark3116_write_reg(serial, UART_FCR, 0);
+	/* handshake control */
+	priv->hcr = 0;
+	ark3116_write_reg(serial, 0x8     , 0);
+	/* modem control */
+	priv->mcr = 0;
+	ark3116_write_reg(serial, UART_MCR, 0);
+
+	if (!(priv->irda)) {
+		ark3116_write_reg(serial, 0xb , 0);
+	} else {
+		ark3116_write_reg(serial, 0xb , 1);
+		ark3116_write_reg(serial, 0xc , 0);
+		ark3116_write_reg(serial, 0xd , 0x41);
+		ark3116_write_reg(serial, 0xa , 1);
 	}
 
-	/* <-- seq7 */
-	ARK3116_RCV(serial,  7, 0xFE, 0xC0, 0x0000, 0x0003, 0x00, buf);
-	ARK3116_SND(serial,  8, 0xFE, 0x40, 0x0080, 0x0003);
-	ARK3116_SND(serial,  9, 0xFE, 0x40, 0x001A, 0x0000);
-	ARK3116_SND(serial, 10, 0xFE, 0x40, 0x0000, 0x0001);
-	ARK3116_SND(serial, 11, 0xFE, 0x40, 0x0000, 0x0003);
-
-	/* <-- seq12 */
-	ARK3116_RCV(serial, 12, 0xFE, 0xC0, 0x0000, 0x0004, 0x00, buf);
-	ARK3116_SND(serial, 13, 0xFE, 0x40, 0x0000, 0x0004);
-
-	/* 14 */
-	ARK3116_RCV(serial, 14, 0xFE, 0xC0, 0x0000, 0x0004, 0x00, buf);
-	ARK3116_SND(serial, 15, 0xFE, 0x40, 0x0000, 0x0004);
-
-	/* 16 */
-	ARK3116_RCV(serial, 16, 0xFE, 0xC0, 0x0000, 0x0004, 0x00, buf);
-	/* --> seq17 */
-	ARK3116_SND(serial, 17, 0xFE, 0x40, 0x0001, 0x0004);
-
-	/* <-- seq18 */
-	ARK3116_RCV(serial, 18, 0xFE, 0xC0, 0x0000, 0x0004, 0x01, buf);
-
-	/* --> seq19 */
-	ARK3116_SND(serial, 19, 0xFE, 0x40, 0x0003, 0x0004);
-
-	/* <-- seq20 */
-	/* seems like serial port status info (RTS, CTS, ...) */
-	/* returns modem control line status?! */
-	ARK3116_RCV(serial, 20, 0xFE, 0xC0, 0x0000, 0x0006, 0xFF, buf);
-
-	/* set 9600 baud & do some init?! */
-	ARK3116_SND(serial, 147, 0xFE, 0x40, 0x0083, 0x0003);
-	ARK3116_SND(serial, 148, 0xFE, 0x40, 0x0038, 0x0000);
-	ARK3116_SND(serial, 149, 0xFE, 0x40, 0x0001, 0x0001);
-	if (is_irda(serial))
-		ARK3116_SND(serial, 1004, 0xFE, 0x40, 0x0000, 0x0009);
-	ARK3116_SND(serial, 150, 0xFE, 0x40, 0x0003, 0x0003);
-	ARK3116_RCV(serial, 151, 0xFE, 0xC0, 0x0000, 0x0004, 0x03, buf);
-	ARK3116_SND(serial, 152, 0xFE, 0x40, 0x0000, 0x0003);
-	ARK3116_RCV(serial, 153, 0xFE, 0xC0, 0x0000, 0x0003, 0x00, buf);
-	ARK3116_SND(serial, 154, 0xFE, 0x40, 0x0003, 0x0003);
+	/* setup baudrate */
+	ark3116_write_reg(serial, UART_LCR, UART_LCR_DLAB);
 
-	kfree(buf);
+	/* setup for 9600 8N1 */
+	priv->quot = calc_divisor(9600);
+	ark3116_write_reg(serial, UART_DLL, priv->quot & 0xff);
+	ark3116_write_reg(serial, UART_DLM, (priv->quot>>8) & 0xff);
+
+	priv->lcr = UART_LCR_WLEN8;
+	ark3116_write_reg(serial, UART_LCR, UART_LCR_WLEN8);
+
+	ark3116_write_reg(serial, 0xe, 0);
+
+	if (priv->irda)
+		ark3116_write_reg(serial, 0x9, 0);
+
+	dev_info(&serial->dev->dev,
+		"%s using %s mode\n",
+		KBUILD_MODNAME,
+		priv->irda ? "IrDA" : "RS232");
 	return 0;
 }
 
+static void ark3116_release(struct usb_serial *serial)
+{
+	struct usb_serial_port *port = serial->port[0];
+	struct ark3116_private *priv = usb_get_serial_port_data(port);
+
+	/* device is closed, so URBs and DMA should be down */
+
+	usb_set_serial_port_data(port, NULL);
+
+	mutex_destroy(&priv->hw_lock);
+
+	kfree(priv);
+}
+
 static void ark3116_init_termios(struct tty_struct *tty)
 {
 	struct ktermios *termios = tty->termios;
@@ -172,200 +227,189 @@ static void ark3116_set_termios(struct tty_struct *tty,
 				struct ktermios *old_termios)
 {
 	struct usb_serial *serial = port->serial;
+	struct ark3116_private *priv = usb_get_serial_port_data(port);
 	struct ktermios *termios = tty->termios;
 	unsigned int cflag = termios->c_cflag;
-	int baud;
-	int ark3116_baud;
-	char *buf;
-	char config;
-
-	config = 0;
-
-	dbg("%s - port %d", __func__, port->number);
+	int bps = tty_get_baud_rate(tty);
+	int quot;
+	__u8 lcr, hcr, eval;
+
+	/* set data bit count */
+	switch (cflag & CSIZE) {
+	case CS5:
+		lcr = UART_LCR_WLEN5;
+		break;
+	case CS6:
+		lcr = UART_LCR_WLEN6;
+		break;
+	case CS7:
+		lcr = UART_LCR_WLEN7;
+		break;
+	default:
+	case CS8:
+		lcr = UART_LCR_WLEN8;
+		break;
+	}
+	if (cflag & CSTOPB)
+		lcr |= UART_LCR_STOP;
+	if (cflag & PARENB)
+		lcr |= UART_LCR_PARITY;
+	if (!(cflag & PARODD))
+		lcr |= UART_LCR_EPAR;
+#ifdef CMSPAR
+	if (cflag & CMSPAR)
+		lcr |= UART_LCR_SPAR;
+#endif
+	/* handshake control */
+	hcr = (cflag & CRTSCTS) ? 0x03 : 0x00;
+
+	/* calc baudrate */
+	dbg("%s - setting bps to %d", __func__, bps);
+	eval = 0;
+	switch (bps) {
+	case 0:
+		quot = calc_divisor(9600);
+		break;
+	default:
+		if ((bps < 75) || (bps > 3000000))
+			bps = 9600;
+		quot = calc_divisor(bps);
+		break;
+	case 460800:
+		eval = 1;
+		quot = calc_divisor(bps);
+		break;
+	case 921600:
+		eval = 2;
+		quot = calc_divisor(bps);
+		break;
+	}
 
+	/* Update state: synchronize */
+	mutex_lock(&priv->hw_lock);
 
-	cflag = termios->c_cflag;
-	termios->c_cflag &= ~(CMSPAR|CRTSCTS);
+	/* keep old LCR_SBC bit */
+	lcr |= (priv->lcr & UART_LCR_SBC);
 
-	buf = kmalloc(1, GFP_KERNEL);
-	if (!buf) {
-		dbg("error kmalloc");
-		*termios = *old_termios;
-		return;
-	}
+	dbg("%s - setting hcr:0x%02x,lcr:0x%02x,quot:%d",
+	    __func__, hcr, lcr, quot);
 
-	/* set data bit count (8/7/6/5) */
-	if (cflag & CSIZE) {
-		switch (cflag & CSIZE) {
-		case CS5:
-			config |= 0x00;
-			dbg("setting CS5");
-			break;
-		case CS6:
-			config |= 0x01;
-			dbg("setting CS6");
-			break;
-		case CS7:
-			config |= 0x02;
-			dbg("setting CS7");
-			break;
-		default:
-			dbg("CSIZE was set but not CS5-CS8, using CS8!");
-			/* fall through */
-		case CS8:
-			config |= 0x03;
-			dbg("setting CS8");
-			break;
-		}
+	/* handshake control */
+	if (priv->hcr != hcr) {
+		priv->hcr = hcr;
+		ark3116_write_reg(serial, 0x8, hcr);
 	}
 
-	/* set parity (NONE/EVEN/ODD) */
-	if (cflag & PARENB) {
-		if (cflag & PARODD) {
-			config |= 0x08;
-			dbg("setting parity to ODD");
-		} else {
-			config |= 0x18;
-			dbg("setting parity to EVEN");
-		}
-	} else {
-		dbg("setting parity to NONE");
+	/* baudrate */
+	if (priv->quot != quot) {
+		priv->quot = quot;
+		priv->lcr = lcr; /* need to write lcr anyway */
+
+		/* disable DMA since transmit/receive is
+		 * shadowed by UART_DLL
+		 */
+		ark3116_write_reg(serial, UART_FCR, 0);
+
+		ark3116_write_reg(serial, UART_LCR,
+				  lcr|UART_LCR_DLAB);
+		ark3116_write_reg(serial, UART_DLL, quot & 0xff);
+		ark3116_write_reg(serial, UART_DLM, (quot>>8) & 0xff);
+
+		/* restore lcr */
+		ark3116_write_reg(serial, UART_LCR, lcr);
+		/* magic baudrate thingy: not sure what it does,
+		 * but windows does this as well.
+		 */
+		ark3116_write_reg(serial, 0xe, eval);
+
+		/* enable DMA */
+		ark3116_write_reg(serial, UART_FCR, UART_FCR_DMA_SELECT);
+	} else if (priv->lcr != lcr) {
+		priv->lcr = lcr;
+		ark3116_write_reg(serial, UART_LCR, lcr);
 	}
 
-	/* set stop bit (1/2) */
-	if (cflag & CSTOPB) {
-		config |= 0x04;
-		dbg("setting 2 stop bits");
-	} else {
-		dbg("setting 1 stop bit");
-	}
+	mutex_unlock(&priv->hw_lock);
 
-	/* set baudrate */
-	baud = tty_get_baud_rate(tty);
-
-	switch (baud) {
-	case 75:
-	case 150:
-	case 300:
-	case 600:
-	case 1200:
-	case 1800:
-	case 2400:
-	case 4800:
-	case 9600:
-	case 19200:
-	case 38400:
-	case 57600:
-	case 115200:
-	case 230400:
-	case 460800:
-		/* Report the resulting rate back to the caller */
-		tty_encode_baud_rate(tty, baud, baud);
-		break;
-	/* set 9600 as default (if given baudrate is invalid for example) */
-	default:
-		tty_encode_baud_rate(tty, 9600, 9600);
-	case 0:
-		baud = 9600;
+	/* check for software flow control */
+	if (I_IXOFF(tty) || I_IXON(tty)) {
+		dev_warn(&serial->dev->dev,
+			 "%s: don't know how to do software flow control\n",
+			 KBUILD_MODNAME);
 	}
 
-	/*
-	 * found by try'n'error, be careful, maybe there are other options
-	 * for multiplicator etc! (3.5 for example)
-	 */
-	if (baud == 460800)
-		/* strange, for 460800 the formula is wrong
-		 * if using round() then 9600baud is wrong) */
-		ark3116_baud = 7;
-	else
-		ark3116_baud = 3000000 / baud;
-
-	/* ? */
-	ARK3116_RCV(serial, 0, 0xFE, 0xC0, 0x0000, 0x0003, 0x03, buf);
-
-	/* offset = buf[0]; */
-	/* offset = 0x03; */
-	/* dbg("using 0x%04X as target for 0x0003:", 0x0080 + offset); */
-
-	/* set baudrate */
-	dbg("setting baudrate to %d (->reg=%d)", baud, ark3116_baud);
-	ARK3116_SND(serial, 147, 0xFE, 0x40, 0x0083, 0x0003);
-	ARK3116_SND(serial, 148, 0xFE, 0x40,
-			    (ark3116_baud & 0x00FF), 0x0000);
-	ARK3116_SND(serial, 149, 0xFE, 0x40,
-			    (ark3116_baud & 0xFF00) >> 8, 0x0001);
-	ARK3116_SND(serial, 150, 0xFE, 0x40, 0x0003, 0x0003);
-
-	/* ? */
-	ARK3116_RCV(serial, 151, 0xFE, 0xC0, 0x0000, 0x0004, 0x03, buf);
-	ARK3116_SND(serial, 152, 0xFE, 0x40, 0x0000, 0x0003);
-
-	/* set data bit count, stop bit count & parity: */
-	dbg("updating bit count, stop bit or parity (cfg=0x%02X)", config);
-	ARK3116_RCV(serial, 153, 0xFE, 0xC0, 0x0000, 0x0003, 0x00, buf);
-	ARK3116_SND(serial, 154, 0xFE, 0x40, config, 0x0003);
+	/* Don't rewrite B0 */
+	if (tty_termios_baud_rate(termios))
+		tty_termios_encode_baud_rate(termios, bps, bps);
+}
 
-	if (cflag & CRTSCTS)
-		dbg("CRTSCTS not supported by chipset?!");
+static void ark3116_close(struct usb_serial_port *port)
+{
+	struct usb_serial *serial = port->serial;
 
-	/* TEST ARK3116_SND(154, 0xFE, 0x40, 0xFFFF, 0x0006); */
+	if (serial->dev) {
+		/* disable DMA */
+		ark3116_write_reg(serial, UART_FCR, 0);
 
-	kfree(buf);
+		/* deactivate interrupts */
+		ark3116_write_reg(serial, UART_IER, 0);
 
-	return;
+		/* shutdown any bulk reads that might be going on */
+		if (serial->num_bulk_out)
+			usb_kill_urb(port->write_urb);
+		if (serial->num_bulk_in)
+			usb_kill_urb(port->read_urb);
+		if (serial->num_interrupt_in)
+			usb_kill_urb(port->interrupt_in_urb);
+	}
 }
 
 static int ark3116_open(struct tty_struct *tty, struct usb_serial_port *port)
 {
-	struct ktermios tmp_termios;
+	struct ark3116_private *priv = usb_get_serial_port_data(port);
 	struct usb_serial *serial = port->serial;
-	char *buf;
-	int result = 0;
-
-	dbg("%s - port %d", __func__, port->number);
+	unsigned char *buf;
+	int result;
 
 	buf = kmalloc(1, GFP_KERNEL);
-	if (!buf) {
-		dbg("error kmalloc -> out of mem?");
+	if (buf == NULL)
 		return -ENOMEM;
-	}
 
 	result = usb_serial_generic_open(tty, port);
-	if (result)
+	if (result) {
+		dbg("%s - usb_serial_generic_open failed: %d",
+		    __func__, result);
 		goto err_out;
+	}
 
-	/* open */
-	ARK3116_RCV(serial, 111, 0xFE, 0xC0, 0x0000, 0x0003, 0x02, buf);
-
-	ARK3116_SND(serial, 112, 0xFE, 0x40, 0x0082, 0x0003);
-	ARK3116_SND(serial, 113, 0xFE, 0x40, 0x001A, 0x0000);
-	ARK3116_SND(serial, 114, 0xFE, 0x40, 0x0000, 0x0001);
-	ARK3116_SND(serial, 115, 0xFE, 0x40, 0x0002, 0x0003);
-
-	ARK3116_RCV(serial, 116, 0xFE, 0xC0, 0x0000, 0x0004, 0x03, buf);
-	ARK3116_SND(serial, 117, 0xFE, 0x40, 0x0002, 0x0004);
-
-	ARK3116_RCV(serial, 118, 0xFE, 0xC0, 0x0000, 0x0004, 0x02, buf);
-	ARK3116_SND(serial, 119, 0xFE, 0x40, 0x0000, 0x0004);
-
-	ARK3116_RCV(serial, 120, 0xFE, 0xC0, 0x0000, 0x0004, 0x00, buf);
+	/* setup termios */
+	if (tty)
+		ark3116_set_termios(tty, port, NULL);
 
-	ARK3116_SND(serial, 121, 0xFE, 0x40, 0x0001, 0x0004);
+	/* remove any data still left: also clears error state */
+	ark3116_read_reg(serial, UART_RX, buf);
 
-	ARK3116_RCV(serial, 122, 0xFE, 0xC0, 0x0000, 0x0004, 0x01, buf);
+	/* read modem status */
+	priv->msr = ark3116_read_reg(serial, UART_MSR, buf);
+	/* read line status */
+	priv->lsr = ark3116_read_reg(serial, UART_LSR, buf);
 
-	ARK3116_SND(serial, 123, 0xFE, 0x40, 0x0003, 0x0004);
+	result = usb_submit_urb(port->interrupt_in_urb, GFP_KERNEL);
+	if (result) {
+		dev_err(&port->dev, "submit irq_in urb failed %d\n",
+			result);
+		ark3116_close(port);
+		goto err_out;
+	}
 
-	/* returns different values (control lines?!) */
-	ARK3116_RCV(serial, 124, 0xFE, 0xC0, 0x0000, 0x0006, 0xFF, buf);
+	/* activate interrupts */
+	ark3116_write_reg(port->serial, UART_IER, UART_IER_MSI|UART_IER_RLSI);
 
-	/* initialise termios */
-	if (tty)
-		ark3116_set_termios(tty, port, &tmp_termios);
+	/* enable DMA */
+	ark3116_write_reg(port->serial, UART_FCR, UART_FCR_DMA_SELECT);
 
 err_out:
 	kfree(buf);
-
 	return result;
 }
 
@@ -373,6 +417,7 @@ static int ark3116_ioctl(struct tty_struct *tty, struct file *file,
 			 unsigned int cmd, unsigned long arg)
 {
 	struct usb_serial_port *port = tty->driver_data;
+	struct ark3116_private *priv = usb_get_serial_port_data(port);
 	struct serial_struct serstruct;
 	void __user *user_arg = (void __user *)arg;
 
@@ -394,9 +439,48 @@ static int ark3116_ioctl(struct tty_struct *tty, struct file *file,
 		if (copy_from_user(&serstruct, user_arg, sizeof(serstruct)))
 			return -EFAULT;
 		return 0;
-	default:
-		dbg("%s cmd 0x%04x not supported", __func__, cmd);
+	case TIOCMIWAIT:
+		for (;;) {
+			struct async_icount prev = priv->icount;
+			interruptible_sleep_on(&priv->delta_msr_wait);
+			/* see if a signal did it */
+			if (signal_pending(current))
+				return -ERESTARTSYS;
+			if ((prev.rng == priv->icount.rng) &&
+			    (prev.dsr == priv->icount.dsr) &&
+			    (prev.dcd == priv->icount.dcd) &&
+			    (prev.cts == priv->icount.cts))
+				return -EIO;
+			if ((arg & TIOCM_RNG &&
+			     (prev.rng != priv->icount.rng)) ||
+			    (arg & TIOCM_DSR &&
+			     (prev.dsr != priv->icount.dsr)) ||
+			    (arg & TIOCM_CD  &&
+			     (prev.dcd != priv->icount.dcd)) ||
+			    (arg & TIOCM_CTS &&
+			     (prev.cts != priv->icount.cts)))
+				return 0;
+		}
 		break;
+	case TIOCGICOUNT: {
+		struct serial_icounter_struct icount;
+		struct async_icount cnow = priv->icount;
+		memset(&icount, 0, sizeof(icount));
+		icount.cts = cnow.cts;
+		icount.dsr = cnow.dsr;
+		icount.rng = cnow.rng;
+		icount.dcd = cnow.dcd;
+		icount.rx = cnow.rx;
+		icount.tx = cnow.tx;
+		icount.frame = cnow.frame;
+		icount.overrun = cnow.overrun;
+		icount.parity = cnow.parity;
+		icount.brk = cnow.brk;
+		icount.buf_overrun = cnow.buf_overrun;
+		if (copy_to_user(user_arg, &icount, sizeof(icount)))
+			return -EFAULT;
+		return 0;
+	}
 	}
 
 	return -ENOIOCTLCMD;
@@ -405,32 +489,273 @@ static int ark3116_ioctl(struct tty_struct *tty, struct file *file,
 static int ark3116_tiocmget(struct tty_struct *tty, struct file *file)
 {
 	struct usb_serial_port *port = tty->driver_data;
-	struct usb_serial *serial = port->serial;
-	char *buf;
-	char temp;
+	struct ark3116_private *priv = usb_get_serial_port_data(port);
+	__u32 status;
+	__u32 ctrl;
+	unsigned long flags;
+
+	mutex_lock(&priv->hw_lock);
+	ctrl = priv->mcr;
+	mutex_unlock(&priv->hw_lock);
+
+	spin_lock_irqsave(&priv->status_lock, flags);
+	status = priv->msr;
+	spin_unlock_irqrestore(&priv->status_lock, flags);
+
+	return  (status & UART_MSR_DSR  ? TIOCM_DSR  : 0) |
+		(status & UART_MSR_CTS  ? TIOCM_CTS  : 0) |
+		(status & UART_MSR_RI   ? TIOCM_RI   : 0) |
+		(status & UART_MSR_DCD  ? TIOCM_CD   : 0) |
+		(ctrl   & UART_MCR_DTR  ? TIOCM_DTR  : 0) |
+		(ctrl   & UART_MCR_RTS  ? TIOCM_RTS  : 0) |
+		(ctrl   & UART_MCR_OUT1 ? TIOCM_OUT1 : 0) |
+		(ctrl   & UART_MCR_OUT2 ? TIOCM_OUT2 : 0);
+}
 
-	/* seems like serial port status info (RTS, CTS, ...) is stored
-	 * in reg(?) 0x0006
-	 * pcb connection point 11 = GND -> sets bit4 of response
-	 * pcb connection point  7 = GND -> sets bit6 of response
+static int ark3116_tiocmset(struct tty_struct *tty, struct file *file,
+			unsigned set, unsigned clr)
+{
+	struct usb_serial_port *port = tty->driver_data;
+	struct ark3116_private *priv = usb_get_serial_port_data(port);
+
+	/* we need to take the mutex here, to make sure that the value
+	 * in priv->mcr is actually the one that is in the hardware
 	 */
 
-	buf = kmalloc(1, GFP_KERNEL);
-	if (!buf) {
-		dbg("error kmalloc");
-		return -ENOMEM;
+	mutex_lock(&priv->hw_lock);
+
+	if (set & TIOCM_RTS)
+		priv->mcr |= UART_MCR_RTS;
+	if (set & TIOCM_DTR)
+		priv->mcr |= UART_MCR_DTR;
+	if (set & TIOCM_OUT1)
+		priv->mcr |= UART_MCR_OUT1;
+	if (set & TIOCM_OUT2)
+		priv->mcr |= UART_MCR_OUT2;
+	if (clr & TIOCM_RTS)
+		priv->mcr &= ~UART_MCR_RTS;
+	if (clr & TIOCM_DTR)
+		priv->mcr &= ~UART_MCR_DTR;
+	if (clr & TIOCM_OUT1)
+		priv->mcr &= ~UART_MCR_OUT1;
+	if (clr & TIOCM_OUT2)
+		priv->mcr &= ~UART_MCR_OUT2;
+
+	ark3116_write_reg(port->serial, UART_MCR, priv->mcr);
+
+	mutex_unlock(&priv->hw_lock);
+
+	return 0;
+}
+
+static void ark3116_break_ctl(struct tty_struct *tty, int break_state)
+{
+	struct usb_serial_port *port = tty->driver_data;
+	struct ark3116_private *priv = usb_get_serial_port_data(port);
+
+	/* LCR is also used for other things: protect access */
+	mutex_lock(&priv->hw_lock);
+
+	if (break_state)
+		priv->lcr |= UART_LCR_SBC;
+	else
+		priv->lcr &= ~UART_LCR_SBC;
+
+	ark3116_write_reg(port->serial, UART_LCR, priv->lcr);
+
+	mutex_unlock(&priv->hw_lock);
+}
+
+static void ark3116_update_msr(struct usb_serial_port *port, __u8 msr)
+{
+	struct ark3116_private *priv = usb_get_serial_port_data(port);
+	unsigned long flags;
+
+	spin_lock_irqsave(&priv->status_lock, flags);
+	priv->msr = msr;
+	spin_unlock_irqrestore(&priv->status_lock, flags);
+
+	if (msr & UART_MSR_ANY_DELTA) {
+		/* update input line counters */
+		if (msr & UART_MSR_DCTS)
+			priv->icount.cts++;
+		if (msr & UART_MSR_DDSR)
+			priv->icount.dsr++;
+		if (msr & UART_MSR_DDCD)
+			priv->icount.dcd++;
+		if (msr & UART_MSR_TERI)
+			priv->icount.rng++;
+		wake_up_interruptible(&priv->delta_msr_wait);
 	}
+}
 
-	/* read register */
-	ARK3116_RCV_QUIET(serial, 0xFE, 0xC0, 0x0000, 0x0006, buf);
-	temp = buf[0];
-	kfree(buf);
+static void ark3116_update_lsr(struct usb_serial_port *port, __u8 lsr)
+{
+	struct ark3116_private *priv = usb_get_serial_port_data(port);
+	unsigned long flags;
+
+	spin_lock_irqsave(&priv->status_lock, flags);
+	/* combine bits */
+	priv->lsr |= lsr;
+	spin_unlock_irqrestore(&priv->status_lock, flags);
+
+	if (lsr&UART_LSR_BRK_ERROR_BITS) {
+		if (lsr & UART_LSR_BI)
+			priv->icount.brk++;
+		if (lsr & UART_LSR_FE)
+			priv->icount.frame++;
+		if (lsr & UART_LSR_PE)
+			priv->icount.parity++;
+		if (lsr & UART_LSR_OE)
+			priv->icount.overrun++;
+	}
+}
 
-	/* i do not really know if bit4=CTS and bit6=DSR... just a
-	 * quick guess!
-	 */
-	return (temp & (1<<4) ? TIOCM_CTS : 0)
-	       | (temp & (1<<6) ? TIOCM_DSR : 0);
+static void ark3116_read_int_callback(struct urb *urb)
+{
+	struct usb_serial_port *port = urb->context;
+	int status = urb->status;
+	const __u8 *data = urb->transfer_buffer;
+	int result;
+
+	switch (status) {
+	case -ECONNRESET:
+	case -ENOENT:
+	case -ESHUTDOWN:
+		/* this urb is terminated, clean up */
+		dbg("%s - urb shutting down with status: %d",
+		    __func__, status);
+		return;
+	default:
+		dbg("%s - nonzero urb status received: %d",
+		    __func__, status);
+		break;
+	case 0: /* success */
+		/* discovered this by trail and error... */
+		if ((urb->actual_length == 4) && (data[0] == 0xe8)) {
+			const __u8 id = data[1]&UART_IIR_ID;
+			dbg("%s: iir=%02x", __func__, data[1]);
+			if (id == UART_IIR_MSI) {
+				dbg("%s: msr=%02x", __func__, data[3]);
+				ark3116_update_msr(port, data[3]);
+				break;
+			} else if (id == UART_IIR_RLSI) {
+				dbg("%s: lsr=%02x", __func__, data[2]);
+				ark3116_update_lsr(port, data[2]);
+				break;
+			}
+		}
+		/*
+		 * Not sure what this data meant...
+		 */
+		usb_serial_debug_data(debug, &port->dev,
+				      __func__,
+				      urb->actual_length,
+				      urb->transfer_buffer);
+		break;
+	}
+
+	result = usb_submit_urb(urb, GFP_ATOMIC);
+	if (result)
+		dev_err(&urb->dev->dev,
+			"%s - Error %d submitting interrupt urb\n",
+			__func__, result);
+}
+
+
+/* Data comes in via the bulk (data) URB, erors/interrupts via the int URB.
+ * This means that we cannot be sure which data byte has an associated error
+ * condition, so we report an error for all data in the next bulk read.
+ *
+ * Actually, there might even be a window between the bulk data leaving the
+ * ark and reading/resetting the lsr in the read_bulk_callback where an
+ * interrupt for the next data block could come in.
+ * Without somekind of ordering on the ark, we would have to report the
+ * error for the next block of data as well...
+ * For now, let's pretend this can't happen.
+ */
+
+static void send_to_tty(struct tty_struct *tty,
+			const unsigned char *chars,
+			size_t size, char flag)
+{
+	if (size == 0)
+		return;
+	if (flag == TTY_NORMAL) {
+		tty_insert_flip_string(tty, chars, size);
+	} else {
+		int i;
+		for (i = 0; i < size; ++i)
+			tty_insert_flip_char(tty, chars[i], flag);
+	}
+}
+
+static void ark3116_read_bulk_callback(struct urb *urb)
+{
+	struct usb_serial_port *port =  urb->context;
+	struct ark3116_private *priv = usb_get_serial_port_data(port);
+	const __u8 *data = urb->transfer_buffer;
+	int status = urb->status;
+	struct tty_struct *tty;
+	unsigned long flags;
+	int result;
+	char flag;
+	__u32 lsr;
+
+	switch (status) {
+	case -ECONNRESET:
+	case -ENOENT:
+	case -ESHUTDOWN:
+		/* this urb is terminated, clean up */
+		dbg("%s - urb shutting down with status: %d",
+		    __func__, status);
+		return;
+	default:
+		dbg("%s - nonzero urb status received: %d",
+		    __func__, status);
+		break;
+	case 0: /* success */
+
+		spin_lock_irqsave(&priv->status_lock, flags);
+		lsr = priv->lsr;
+		/* clear error bits */
+		priv->lsr &= ~UART_LSR_BRK_ERROR_BITS;
+		spin_unlock_irqrestore(&priv->status_lock, flags);
+
+		if (unlikely(lsr & UART_LSR_BI))
+			flag = TTY_BREAK;
+		else if (unlikely(lsr & UART_LSR_PE))
+			flag = TTY_PARITY;
+		else if (unlikely(lsr & UART_LSR_FE))
+			flag = TTY_FRAME;
+		else
+			flag = TTY_NORMAL;
+
+		tty = tty_port_tty_get(&port->port);
+		if (tty) {
+			tty_buffer_request_room(tty, urb->actual_length + 1);
+			/* overrun is special, not associated with a char */
+			if (unlikely(lsr & UART_LSR_OE))
+				tty_insert_flip_char(tty, 0, TTY_OVERRUN);
+			send_to_tty(tty, data, urb->actual_length, flag);
+			tty_flip_buffer_push(tty);
+			tty_kref_put(tty);
+		}
+
+		/* Throttle the device if requested by tty */
+		spin_lock_irqsave(&port->lock, flags);
+		port->throttled = port->throttle_req;
+		if (port->throttled) {
+			spin_unlock_irqrestore(&port->lock, flags);
+			return;
+		} else
+			spin_unlock_irqrestore(&port->lock, flags);
+	}
+	/* Continue reading from device */
+	result = usb_submit_urb(urb, GFP_ATOMIC);
+	if (result)
+		dev_err(&urb->dev->dev, "%s - failed resubmitting"
+			" read urb, error %d\n", __func__, result);
 }
 
 static struct usb_driver ark3116_driver = {
@@ -450,11 +775,17 @@ static struct usb_serial_driver ark3116_device = {
 	.usb_driver =		&ark3116_driver,
 	.num_ports =		1,
 	.attach =		ark3116_attach,
+	.release =		ark3116_release,
 	.set_termios =		ark3116_set_termios,
 	.init_termios =		ark3116_init_termios,
 	.ioctl =		ark3116_ioctl,
 	.tiocmget =		ark3116_tiocmget,
+	.tiocmset =		ark3116_tiocmset,
 	.open =			ark3116_open,
+	.close =		ark3116_close,
+	.break_ctl = 		ark3116_break_ctl,
+	.read_int_callback = 	ark3116_read_int_callback,
+	.read_bulk_callback =	ark3116_read_bulk_callback,
 };
 
 static int __init ark3116_init(void)
@@ -465,7 +796,12 @@ static int __init ark3116_init(void)
 	if (retval)
 		return retval;
 	retval = usb_register(&ark3116_driver);
-	if (retval)
+	if (retval == 0) {
+		printk(KERN_INFO "%s:"
+		       DRIVER_VERSION ":"
+		       DRIVER_DESC "\n",
+		       KBUILD_MODNAME);
+	} else
 		usb_serial_deregister(&ark3116_device);
 	return retval;
 }
@@ -480,6 +816,109 @@ module_init(ark3116_init);
 module_exit(ark3116_exit);
 MODULE_LICENSE("GPL");
 
+MODULE_AUTHOR(DRIVER_AUTHOR);
+MODULE_DESCRIPTION(DRIVER_DESC);
+
 module_param(debug, bool, S_IRUGO | S_IWUSR);
-MODULE_PARM_DESC(debug, "Debug enabled or not");
+MODULE_PARM_DESC(debug, "Enable debug");
 
+/*
+ * The following describes what I learned from studying the old
+ * ark3116.c driver, disassembling the windows driver, and some lucky
+ * guesses. Since I do not have any datasheet or other
+ * documentation, inaccuracies are almost guaranteed.
+ *
+ * Some specs for the ARK3116 can be found here:
+ * http://web.archive.org/web/20060318000438/
+ *   www.arkmicro.com/en/products/view.php?id=10
+ * On that page, 2 GPIO pins are mentioned: I assume these are the
+ * OUT1 and OUT2 pins of the UART, so I added support for those
+ * through the MCR. Since the pins are not available on my hardware,
+ * I could not verify this.
+ * Also, it states there is "on-chip hardware flow control". I have
+ * discovered how to enable that. Unfortunately, I do not know how to
+ * enable XON/XOFF (software) flow control, which would need support
+ * from the chip as well to work. Because of the wording on the web
+ * page there is a real possibility the chip simply does not support
+ * software flow control.
+ *
+ * I got my ark3116 as part of a mobile phone adapter cable. On the
+ * PCB, the following numbered contacts are present:
+ *
+ *  1:- +5V
+ *  2:o DTR
+ *  3:i RX
+ *  4:i DCD
+ *  5:o RTS
+ *  6:o TX
+ *  7:i RI
+ *  8:i DSR
+ * 10:- 0V
+ * 11:i CTS
+ *
+ * On my chip, all signals seem to be 3.3V, but 5V tolerant. But that
+ * may be different for the one you have ;-).
+ *
+ * The windows driver limits the registers to 0-F, so I assume there
+ * are actually 16 present on the device.
+ *
+ * On an UART interrupt, 4 bytes of data come in on the interrupt
+ * endpoint. The bytes are 0xe8 IIR LSR MSR.
+ *
+ * The baudrate seems to be generated from the 12MHz crystal, using
+ * 4-times subsampling. So quot=12e6/(4*baud). Also see description
+ * of register E.
+ *
+ * Registers 0-7:
+ * These seem to be the same as for a regular 16450. The FCR is set
+ * to UART_FCR_DMA_SELECT (0x8), I guess to enable transfers between
+ * the UART and the USB bridge/DMA engine.
+ *
+ * Register 8:
+ * By trial and error, I found out that bit 0 enables hardware CTS,
+ * stopping TX when CTS is +5V. Bit 1 does the same for RTS, making
+ * RTS +5V when the 3116 cannot transfer the data to the USB bus
+ * (verified by disabling the reading URB). Note that as far as I can
+ * tell, the windows driver does NOT use this, so there might be some
+ * hardware bug or something.
+ *
+ * According to a patch provided here
+ * (http://lkml.org/lkml/2009/7/26/56), the ARK3116 can also be used
+ * as an IrDA dongle. Since I do not have such a thing, I could not
+ * investigate that aspect. However, I can speculate ;-).
+ *
+ * - IrDA encodes data differently than RS232. Most likely, one of
+ *   the bits in registers 9..E enables the IR ENDEC (encoder/decoder).
+ * - Depending on the IR transceiver, the input and output need to be
+ *   inverted, so there are probably bits for that as well.
+ * - IrDA is half-duplex, so there should be a bit for selecting that.
+ *
+ * This still leaves at least two registers unaccounted for. Perhaps
+ * The chip can do XON/XOFF or CRC in HW?
+ *
+ * Register 9:
+ * Set to 0x00 for IrDA, when the baudrate is initialised.
+ *
+ * Register A:
+ * Set to 0x01 for IrDA, at init.
+ *
+ * Register B:
+ * Set to 0x01 for IrDA, 0x00 for RS232, at init.
+ *
+ * Register C:
+ * Set to 00 for IrDA, at init.
+ *
+ * Register D:
+ * Set to 0x41 for IrDA, at init.
+ *
+ * Register E:
+ * Somekind of baudrate override. The windows driver seems to set
+ * this to 0x00 for normal baudrates, 0x01 for 460800, 0x02 for 921600.
+ * Since 460800 and 921600 cannot be obtained by dividing 3MHz by an integer,
+ * it could be somekind of subdivisor thingy.
+ * However,it does not seem to do anything: selecting 921600 (divisor 3,
+ * reg E=2), still gets 1 MHz. I also checked if registers 9, C or F would
+ * work, but they don't.
+ *
+ * Register F: unknown
+ */
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index ebcc6d0e2e91..216f187582ab 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -44,6 +44,7 @@
 #include <linux/serial.h>
 #include <linux/usb/serial.h>
 #include "ftdi_sio.h"
+#include "ftdi_sio_ids.h"
 
 /*
  * Version Information
@@ -598,6 +599,20 @@ static struct usb_device_id id_table_combined [] = {
 	{ USB_DEVICE(BANDB_VID, BANDB_USOTL4_PID) },
 	{ USB_DEVICE(BANDB_VID, BANDB_USTL4_PID) },
 	{ USB_DEVICE(BANDB_VID, BANDB_USO9ML2_PID) },
+	{ USB_DEVICE(BANDB_VID, BANDB_USOPTL4_PID) },
+	{ USB_DEVICE(BANDB_VID, BANDB_USPTL4_PID) },
+	{ USB_DEVICE(BANDB_VID, BANDB_USO9ML2DR_2_PID) },
+	{ USB_DEVICE(BANDB_VID, BANDB_USO9ML2DR_PID) },
+	{ USB_DEVICE(BANDB_VID, BANDB_USOPTL4DR2_PID) },
+	{ USB_DEVICE(BANDB_VID, BANDB_USOPTL4DR_PID) },
+	{ USB_DEVICE(BANDB_VID, BANDB_485USB9F_2W_PID) },
+	{ USB_DEVICE(BANDB_VID, BANDB_485USB9F_4W_PID) },
+	{ USB_DEVICE(BANDB_VID, BANDB_232USB9M_PID) },
+	{ USB_DEVICE(BANDB_VID, BANDB_485USBTB_2W_PID) },
+	{ USB_DEVICE(BANDB_VID, BANDB_485USBTB_4W_PID) },
+	{ USB_DEVICE(BANDB_VID, BANDB_TTL5USB9M_PID) },
+	{ USB_DEVICE(BANDB_VID, BANDB_TTL3USB9M_PID) },
+	{ USB_DEVICE(BANDB_VID, BANDB_ZZ_PROG1_USB_PID) },
 	{ USB_DEVICE(FTDI_VID, EVER_ECO_PRO_CDS) },
 	{ USB_DEVICE(FTDI_VID, FTDI_4N_GALAXY_DE_1_PID) },
 	{ USB_DEVICE(FTDI_VID, FTDI_4N_GALAXY_DE_2_PID) },
@@ -2195,15 +2210,21 @@ static void ftdi_set_termios(struct tty_struct *tty,
 
 	/* Set number of data bits, parity, stop bits */
 
-	termios->c_cflag &= ~CMSPAR;
-
 	urb_value = 0;
 	urb_value |= (cflag & CSTOPB ? FTDI_SIO_SET_DATA_STOP_BITS_2 :
 		      FTDI_SIO_SET_DATA_STOP_BITS_1);
-	urb_value |= (cflag & PARENB ?
-		      (cflag & PARODD ? FTDI_SIO_SET_DATA_PARITY_ODD :
-		       FTDI_SIO_SET_DATA_PARITY_EVEN) :
-		      FTDI_SIO_SET_DATA_PARITY_NONE);
+	if (cflag & PARENB) {
+		if (cflag & CMSPAR)
+			urb_value |= cflag & PARODD ?
+				     FTDI_SIO_SET_DATA_PARITY_MARK :
+				     FTDI_SIO_SET_DATA_PARITY_SPACE;
+		else
+			urb_value |= cflag & PARODD ?
+				     FTDI_SIO_SET_DATA_PARITY_ODD :
+				     FTDI_SIO_SET_DATA_PARITY_EVEN;
+	} else {
+		urb_value |= FTDI_SIO_SET_DATA_PARITY_NONE;
+	}
 	if (cflag & CSIZE) {
 		switch (cflag & CSIZE) {
 		case CS5: urb_value |= 5; dbg("Setting CS5"); break;
diff --git a/drivers/usb/serial/ftdi_sio.h b/drivers/usb/serial/ftdi_sio.h
index 6f31e0d71898..b0e0d64f822e 100644
--- a/drivers/usb/serial/ftdi_sio.h
+++ b/drivers/usb/serial/ftdi_sio.h
@@ -1,7 +1,10 @@
 /*
- * Definitions for the FTDI USB Single Port Serial Converter -
+ * Driver definitions for the FTDI USB Single Port Serial Converter -
  * known as FTDI_SIO (Serial Input/Output application of the chipset)
  *
+ * For USB vendor/product IDs (VID/PID), please see ftdi_sio_ids.h
+ *
+ *
  * The example I have is known as the USC-1000 which is available from
  * http://www.dse.co.nz - cat no XH4214 It looks similar to this:
  * http://www.dansdata.com/usbser.htm but I can't be sure There are other
@@ -17,866 +20,7 @@
  * Bill Ryder - bryder@sgi.com formerly of Silicon Graphics, Inc.- wrote the
  * FTDI_SIO implementation.
  *
- * Philipp Gühring - pg@futureware.at - added the Device ID of the USB relais
- * from Rudolf Gugler
- *
- */
-
-#define FTDI_VID	0x0403	/* Vendor Id */
-#define FTDI_SIO_PID	0x8372	/* Product Id SIO application of 8U100AX  */
-#define FTDI_8U232AM_PID 0x6001 /* Similar device to SIO above */
-#define FTDI_8U232AM_ALT_PID 0x6006 /* FTDI's alternate PID for above */
-#define FTDI_8U2232C_PID 0x6010 /* Dual channel device */
-#define FTDI_232RL_PID  0xFBFA  /* Product ID for FT232RL */
-#define FTDI_4232H_PID 0x6011 /* Quad channel hi-speed device */
-#define FTDI_RELAIS_PID	0xFA10  /* Relais device from Rudolf Gugler */
-#define FTDI_NF_RIC_VID	0x0DCD	/* Vendor Id */
-#define FTDI_NF_RIC_PID	0x0001	/* Product Id */
-#define FTDI_USBX_707_PID 0xF857	/* ADSTech IR Blaster USBX-707 */
-
-/* Larsen and Brusgaard AltiTrack/USBtrack  */
-#define LARSENBRUSGAARD_VID		0x0FD8
-#define LB_ALTITRACK_PID		0x0001
-
-/* www.canusb.com Lawicel CANUSB device */
-#define FTDI_CANUSB_PID 0xFFA8 /* Product Id */
-
-/* AlphaMicro Components AMC-232USB01 device */
-#define FTDI_AMC232_PID 0xFF00 /* Product Id */
-
-/* www.candapter.com Ewert Energy Systems CANdapter device */
-#define FTDI_CANDAPTER_PID 0x9F80 /* Product Id */
-
-/* SCS HF Radio Modems PID's (http://www.scs-ptc.com) */
-/* the VID is the standard ftdi vid (FTDI_VID) */
-#define FTDI_SCS_DEVICE_0_PID 0xD010    /* SCS PTC-IIusb */
-#define FTDI_SCS_DEVICE_1_PID 0xD011    /* SCS Tracker / DSP TNC */
-#define FTDI_SCS_DEVICE_2_PID 0xD012
-#define FTDI_SCS_DEVICE_3_PID 0xD013
-#define FTDI_SCS_DEVICE_4_PID 0xD014
-#define FTDI_SCS_DEVICE_5_PID 0xD015
-#define FTDI_SCS_DEVICE_6_PID 0xD016
-#define FTDI_SCS_DEVICE_7_PID 0xD017
-
-/* ACT Solutions HomePro ZWave interface (http://www.act-solutions.com/HomePro.htm) */
-#define FTDI_ACTZWAVE_PID	0xF2D0
-
-
-/* www.starting-point-systems.com µChameleon device */
-#define FTDI_MICRO_CHAMELEON_PID	0xCAA0	/* Product Id */
-
-/* www.irtrans.de device */
-#define FTDI_IRTRANS_PID 0xFC60 /* Product Id */
-
-
-/* www.thoughttechnology.com/ TT-USB provide with procomp use ftdi_sio */
-#define FTDI_TTUSB_PID 0xFF20 /* Product Id */
-
-/* iPlus device */
-#define FTDI_IPLUS_PID 0xD070 /* Product Id */
-#define FTDI_IPLUS2_PID 0xD071 /* Product Id */
-
-/* DMX4ALL DMX Interfaces */
-#define FTDI_DMX4ALL 0xC850
-
-/* OpenDCC (www.opendcc.de) product id */
-#define FTDI_OPENDCC_PID	0xBFD8
-#define FTDI_OPENDCC_SNIFFER_PID	0xBFD9
-#define FTDI_OPENDCC_THROTTLE_PID	0xBFDA
-#define FTDI_OPENDCC_GATEWAY_PID	0xBFDB
-
-/* Sprog II (Andrew Crosland's SprogII DCC interface) */
-#define FTDI_SPROG_II		0xF0C8
-
-/* www.crystalfontz.com devices - thanx for providing free devices for evaluation ! */
-/* they use the ftdi chipset for the USB interface and the vendor id is the same */
-#define FTDI_XF_632_PID 0xFC08	/* 632: 16x2 Character Display */
-#define FTDI_XF_634_PID 0xFC09	/* 634: 20x4 Character Display */
-#define FTDI_XF_547_PID 0xFC0A	/* 547: Two line Display */
-#define FTDI_XF_633_PID 0xFC0B	/* 633: 16x2 Character Display with Keys */
-#define FTDI_XF_631_PID 0xFC0C	/* 631: 20x2 Character Display */
-#define FTDI_XF_635_PID 0xFC0D	/* 635: 20x4 Character Display */
-#define FTDI_XF_640_PID 0xFC0E	/* 640: Two line Display */
-#define FTDI_XF_642_PID 0xFC0F	/* 642: Two line Display */
-
-/* Video Networks Limited / Homechoice in the UK use an ftdi-based device for their 1Mb */
-/* broadband internet service.  The following PID is exhibited by the usb device supplied */
-/* (the VID is the standard ftdi vid (FTDI_VID) */
-#define FTDI_VNHCPCUSB_D_PID 0xfe38 /* Product Id */
-
-/*
- * PCDJ use ftdi based dj-controllers.  The following PID is for their DAC-2 device
- * http://www.pcdjhardware.com/DAC2.asp (PID sent by Wouter Paesen)
- * (the VID is the standard ftdi vid (FTDI_VID) */
-#define FTDI_PCDJ_DAC2_PID 0xFA88
-
-/*
- * The following are the values for the Matrix Orbital LCD displays,
- * which are the FT232BM ( similar to the 8U232AM )
- */
-#define FTDI_MTXORB_0_PID      0xFA00  /* Matrix Orbital Product Id */
-#define FTDI_MTXORB_1_PID      0xFA01  /* Matrix Orbital Product Id */
-#define FTDI_MTXORB_2_PID      0xFA02  /* Matrix Orbital Product Id */
-#define FTDI_MTXORB_3_PID      0xFA03  /* Matrix Orbital Product Id */
-#define FTDI_MTXORB_4_PID      0xFA04  /* Matrix Orbital Product Id */
-#define FTDI_MTXORB_5_PID      0xFA05  /* Matrix Orbital Product Id */
-#define FTDI_MTXORB_6_PID      0xFA06  /* Matrix Orbital Product Id */
-
-/* OOCDlink by Joern Kaipf <joernk@web.de>
- * (http://www.joernonline.de/dw/doku.php?id=start&idx=projects:oocdlink) */
-#define FTDI_OOCDLINK_PID	0xbaf8	/* Amontec JTAGkey */
-
-/*
- * The following are the values for the Matrix Orbital FTDI Range
- * Anything in this range will use an FT232RL.
- */
-#define MTXORB_VID			0x1B3D
-#define MTXORB_FTDI_RANGE_0100_PID	0x0100
-#define MTXORB_FTDI_RANGE_0101_PID	0x0101
-#define MTXORB_FTDI_RANGE_0102_PID	0x0102
-#define MTXORB_FTDI_RANGE_0103_PID	0x0103
-#define MTXORB_FTDI_RANGE_0104_PID	0x0104
-#define MTXORB_FTDI_RANGE_0105_PID	0x0105
-#define MTXORB_FTDI_RANGE_0106_PID	0x0106
-#define MTXORB_FTDI_RANGE_0107_PID	0x0107
-#define MTXORB_FTDI_RANGE_0108_PID	0x0108
-#define MTXORB_FTDI_RANGE_0109_PID	0x0109
-#define MTXORB_FTDI_RANGE_010A_PID	0x010A
-#define MTXORB_FTDI_RANGE_010B_PID	0x010B
-#define MTXORB_FTDI_RANGE_010C_PID	0x010C
-#define MTXORB_FTDI_RANGE_010D_PID	0x010D
-#define MTXORB_FTDI_RANGE_010E_PID	0x010E
-#define MTXORB_FTDI_RANGE_010F_PID	0x010F
-#define MTXORB_FTDI_RANGE_0110_PID	0x0110
-#define MTXORB_FTDI_RANGE_0111_PID	0x0111
-#define MTXORB_FTDI_RANGE_0112_PID	0x0112
-#define MTXORB_FTDI_RANGE_0113_PID	0x0113
-#define MTXORB_FTDI_RANGE_0114_PID	0x0114
-#define MTXORB_FTDI_RANGE_0115_PID	0x0115
-#define MTXORB_FTDI_RANGE_0116_PID	0x0116
-#define MTXORB_FTDI_RANGE_0117_PID	0x0117
-#define MTXORB_FTDI_RANGE_0118_PID	0x0118
-#define MTXORB_FTDI_RANGE_0119_PID	0x0119
-#define MTXORB_FTDI_RANGE_011A_PID	0x011A
-#define MTXORB_FTDI_RANGE_011B_PID	0x011B
-#define MTXORB_FTDI_RANGE_011C_PID	0x011C
-#define MTXORB_FTDI_RANGE_011D_PID	0x011D
-#define MTXORB_FTDI_RANGE_011E_PID	0x011E
-#define MTXORB_FTDI_RANGE_011F_PID	0x011F
-#define MTXORB_FTDI_RANGE_0120_PID	0x0120
-#define MTXORB_FTDI_RANGE_0121_PID	0x0121
-#define MTXORB_FTDI_RANGE_0122_PID	0x0122
-#define MTXORB_FTDI_RANGE_0123_PID	0x0123
-#define MTXORB_FTDI_RANGE_0124_PID	0x0124
-#define MTXORB_FTDI_RANGE_0125_PID	0x0125
-#define MTXORB_FTDI_RANGE_0126_PID	0x0126
-#define MTXORB_FTDI_RANGE_0127_PID	0x0127
-#define MTXORB_FTDI_RANGE_0128_PID	0x0128
-#define MTXORB_FTDI_RANGE_0129_PID	0x0129
-#define MTXORB_FTDI_RANGE_012A_PID	0x012A
-#define MTXORB_FTDI_RANGE_012B_PID	0x012B
-#define MTXORB_FTDI_RANGE_012C_PID	0x012C
-#define MTXORB_FTDI_RANGE_012D_PID	0x012D
-#define MTXORB_FTDI_RANGE_012E_PID	0x012E
-#define MTXORB_FTDI_RANGE_012F_PID	0x012F
-#define MTXORB_FTDI_RANGE_0130_PID	0x0130
-#define MTXORB_FTDI_RANGE_0131_PID	0x0131
-#define MTXORB_FTDI_RANGE_0132_PID	0x0132
-#define MTXORB_FTDI_RANGE_0133_PID	0x0133
-#define MTXORB_FTDI_RANGE_0134_PID	0x0134
-#define MTXORB_FTDI_RANGE_0135_PID	0x0135
-#define MTXORB_FTDI_RANGE_0136_PID	0x0136
-#define MTXORB_FTDI_RANGE_0137_PID	0x0137
-#define MTXORB_FTDI_RANGE_0138_PID	0x0138
-#define MTXORB_FTDI_RANGE_0139_PID	0x0139
-#define MTXORB_FTDI_RANGE_013A_PID	0x013A
-#define MTXORB_FTDI_RANGE_013B_PID	0x013B
-#define MTXORB_FTDI_RANGE_013C_PID	0x013C
-#define MTXORB_FTDI_RANGE_013D_PID	0x013D
-#define MTXORB_FTDI_RANGE_013E_PID	0x013E
-#define MTXORB_FTDI_RANGE_013F_PID	0x013F
-#define MTXORB_FTDI_RANGE_0140_PID	0x0140
-#define MTXORB_FTDI_RANGE_0141_PID	0x0141
-#define MTXORB_FTDI_RANGE_0142_PID	0x0142
-#define MTXORB_FTDI_RANGE_0143_PID	0x0143
-#define MTXORB_FTDI_RANGE_0144_PID	0x0144
-#define MTXORB_FTDI_RANGE_0145_PID	0x0145
-#define MTXORB_FTDI_RANGE_0146_PID	0x0146
-#define MTXORB_FTDI_RANGE_0147_PID	0x0147
-#define MTXORB_FTDI_RANGE_0148_PID	0x0148
-#define MTXORB_FTDI_RANGE_0149_PID	0x0149
-#define MTXORB_FTDI_RANGE_014A_PID	0x014A
-#define MTXORB_FTDI_RANGE_014B_PID	0x014B
-#define MTXORB_FTDI_RANGE_014C_PID	0x014C
-#define MTXORB_FTDI_RANGE_014D_PID	0x014D
-#define MTXORB_FTDI_RANGE_014E_PID	0x014E
-#define MTXORB_FTDI_RANGE_014F_PID	0x014F
-#define MTXORB_FTDI_RANGE_0150_PID	0x0150
-#define MTXORB_FTDI_RANGE_0151_PID	0x0151
-#define MTXORB_FTDI_RANGE_0152_PID	0x0152
-#define MTXORB_FTDI_RANGE_0153_PID	0x0153
-#define MTXORB_FTDI_RANGE_0154_PID	0x0154
-#define MTXORB_FTDI_RANGE_0155_PID	0x0155
-#define MTXORB_FTDI_RANGE_0156_PID	0x0156
-#define MTXORB_FTDI_RANGE_0157_PID	0x0157
-#define MTXORB_FTDI_RANGE_0158_PID	0x0158
-#define MTXORB_FTDI_RANGE_0159_PID	0x0159
-#define MTXORB_FTDI_RANGE_015A_PID	0x015A
-#define MTXORB_FTDI_RANGE_015B_PID	0x015B
-#define MTXORB_FTDI_RANGE_015C_PID	0x015C
-#define MTXORB_FTDI_RANGE_015D_PID	0x015D
-#define MTXORB_FTDI_RANGE_015E_PID	0x015E
-#define MTXORB_FTDI_RANGE_015F_PID	0x015F
-#define MTXORB_FTDI_RANGE_0160_PID	0x0160
-#define MTXORB_FTDI_RANGE_0161_PID	0x0161
-#define MTXORB_FTDI_RANGE_0162_PID	0x0162
-#define MTXORB_FTDI_RANGE_0163_PID	0x0163
-#define MTXORB_FTDI_RANGE_0164_PID	0x0164
-#define MTXORB_FTDI_RANGE_0165_PID	0x0165
-#define MTXORB_FTDI_RANGE_0166_PID	0x0166
-#define MTXORB_FTDI_RANGE_0167_PID	0x0167
-#define MTXORB_FTDI_RANGE_0168_PID	0x0168
-#define MTXORB_FTDI_RANGE_0169_PID	0x0169
-#define MTXORB_FTDI_RANGE_016A_PID	0x016A
-#define MTXORB_FTDI_RANGE_016B_PID	0x016B
-#define MTXORB_FTDI_RANGE_016C_PID	0x016C
-#define MTXORB_FTDI_RANGE_016D_PID	0x016D
-#define MTXORB_FTDI_RANGE_016E_PID	0x016E
-#define MTXORB_FTDI_RANGE_016F_PID	0x016F
-#define MTXORB_FTDI_RANGE_0170_PID	0x0170
-#define MTXORB_FTDI_RANGE_0171_PID	0x0171
-#define MTXORB_FTDI_RANGE_0172_PID	0x0172
-#define MTXORB_FTDI_RANGE_0173_PID	0x0173
-#define MTXORB_FTDI_RANGE_0174_PID	0x0174
-#define MTXORB_FTDI_RANGE_0175_PID	0x0175
-#define MTXORB_FTDI_RANGE_0176_PID	0x0176
-#define MTXORB_FTDI_RANGE_0177_PID	0x0177
-#define MTXORB_FTDI_RANGE_0178_PID	0x0178
-#define MTXORB_FTDI_RANGE_0179_PID	0x0179
-#define MTXORB_FTDI_RANGE_017A_PID	0x017A
-#define MTXORB_FTDI_RANGE_017B_PID	0x017B
-#define MTXORB_FTDI_RANGE_017C_PID	0x017C
-#define MTXORB_FTDI_RANGE_017D_PID	0x017D
-#define MTXORB_FTDI_RANGE_017E_PID	0x017E
-#define MTXORB_FTDI_RANGE_017F_PID	0x017F
-#define MTXORB_FTDI_RANGE_0180_PID	0x0180
-#define MTXORB_FTDI_RANGE_0181_PID	0x0181
-#define MTXORB_FTDI_RANGE_0182_PID	0x0182
-#define MTXORB_FTDI_RANGE_0183_PID	0x0183
-#define MTXORB_FTDI_RANGE_0184_PID	0x0184
-#define MTXORB_FTDI_RANGE_0185_PID	0x0185
-#define MTXORB_FTDI_RANGE_0186_PID	0x0186
-#define MTXORB_FTDI_RANGE_0187_PID	0x0187
-#define MTXORB_FTDI_RANGE_0188_PID	0x0188
-#define MTXORB_FTDI_RANGE_0189_PID	0x0189
-#define MTXORB_FTDI_RANGE_018A_PID	0x018A
-#define MTXORB_FTDI_RANGE_018B_PID	0x018B
-#define MTXORB_FTDI_RANGE_018C_PID	0x018C
-#define MTXORB_FTDI_RANGE_018D_PID	0x018D
-#define MTXORB_FTDI_RANGE_018E_PID	0x018E
-#define MTXORB_FTDI_RANGE_018F_PID	0x018F
-#define MTXORB_FTDI_RANGE_0190_PID	0x0190
-#define MTXORB_FTDI_RANGE_0191_PID	0x0191
-#define MTXORB_FTDI_RANGE_0192_PID	0x0192
-#define MTXORB_FTDI_RANGE_0193_PID	0x0193
-#define MTXORB_FTDI_RANGE_0194_PID	0x0194
-#define MTXORB_FTDI_RANGE_0195_PID	0x0195
-#define MTXORB_FTDI_RANGE_0196_PID	0x0196
-#define MTXORB_FTDI_RANGE_0197_PID	0x0197
-#define MTXORB_FTDI_RANGE_0198_PID	0x0198
-#define MTXORB_FTDI_RANGE_0199_PID	0x0199
-#define MTXORB_FTDI_RANGE_019A_PID	0x019A
-#define MTXORB_FTDI_RANGE_019B_PID	0x019B
-#define MTXORB_FTDI_RANGE_019C_PID	0x019C
-#define MTXORB_FTDI_RANGE_019D_PID	0x019D
-#define MTXORB_FTDI_RANGE_019E_PID	0x019E
-#define MTXORB_FTDI_RANGE_019F_PID	0x019F
-#define MTXORB_FTDI_RANGE_01A0_PID	0x01A0
-#define MTXORB_FTDI_RANGE_01A1_PID	0x01A1
-#define MTXORB_FTDI_RANGE_01A2_PID	0x01A2
-#define MTXORB_FTDI_RANGE_01A3_PID	0x01A3
-#define MTXORB_FTDI_RANGE_01A4_PID	0x01A4
-#define MTXORB_FTDI_RANGE_01A5_PID	0x01A5
-#define MTXORB_FTDI_RANGE_01A6_PID	0x01A6
-#define MTXORB_FTDI_RANGE_01A7_PID	0x01A7
-#define MTXORB_FTDI_RANGE_01A8_PID	0x01A8
-#define MTXORB_FTDI_RANGE_01A9_PID	0x01A9
-#define MTXORB_FTDI_RANGE_01AA_PID	0x01AA
-#define MTXORB_FTDI_RANGE_01AB_PID	0x01AB
-#define MTXORB_FTDI_RANGE_01AC_PID	0x01AC
-#define MTXORB_FTDI_RANGE_01AD_PID	0x01AD
-#define MTXORB_FTDI_RANGE_01AE_PID	0x01AE
-#define MTXORB_FTDI_RANGE_01AF_PID	0x01AF
-#define MTXORB_FTDI_RANGE_01B0_PID	0x01B0
-#define MTXORB_FTDI_RANGE_01B1_PID	0x01B1
-#define MTXORB_FTDI_RANGE_01B2_PID	0x01B2
-#define MTXORB_FTDI_RANGE_01B3_PID	0x01B3
-#define MTXORB_FTDI_RANGE_01B4_PID	0x01B4
-#define MTXORB_FTDI_RANGE_01B5_PID	0x01B5
-#define MTXORB_FTDI_RANGE_01B6_PID	0x01B6
-#define MTXORB_FTDI_RANGE_01B7_PID	0x01B7
-#define MTXORB_FTDI_RANGE_01B8_PID	0x01B8
-#define MTXORB_FTDI_RANGE_01B9_PID	0x01B9
-#define MTXORB_FTDI_RANGE_01BA_PID	0x01BA
-#define MTXORB_FTDI_RANGE_01BB_PID	0x01BB
-#define MTXORB_FTDI_RANGE_01BC_PID	0x01BC
-#define MTXORB_FTDI_RANGE_01BD_PID	0x01BD
-#define MTXORB_FTDI_RANGE_01BE_PID	0x01BE
-#define MTXORB_FTDI_RANGE_01BF_PID	0x01BF
-#define MTXORB_FTDI_RANGE_01C0_PID	0x01C0
-#define MTXORB_FTDI_RANGE_01C1_PID	0x01C1
-#define MTXORB_FTDI_RANGE_01C2_PID	0x01C2
-#define MTXORB_FTDI_RANGE_01C3_PID	0x01C3
-#define MTXORB_FTDI_RANGE_01C4_PID	0x01C4
-#define MTXORB_FTDI_RANGE_01C5_PID	0x01C5
-#define MTXORB_FTDI_RANGE_01C6_PID	0x01C6
-#define MTXORB_FTDI_RANGE_01C7_PID	0x01C7
-#define MTXORB_FTDI_RANGE_01C8_PID	0x01C8
-#define MTXORB_FTDI_RANGE_01C9_PID	0x01C9
-#define MTXORB_FTDI_RANGE_01CA_PID	0x01CA
-#define MTXORB_FTDI_RANGE_01CB_PID	0x01CB
-#define MTXORB_FTDI_RANGE_01CC_PID	0x01CC
-#define MTXORB_FTDI_RANGE_01CD_PID	0x01CD
-#define MTXORB_FTDI_RANGE_01CE_PID	0x01CE
-#define MTXORB_FTDI_RANGE_01CF_PID	0x01CF
-#define MTXORB_FTDI_RANGE_01D0_PID	0x01D0
-#define MTXORB_FTDI_RANGE_01D1_PID	0x01D1
-#define MTXORB_FTDI_RANGE_01D2_PID	0x01D2
-#define MTXORB_FTDI_RANGE_01D3_PID	0x01D3
-#define MTXORB_FTDI_RANGE_01D4_PID	0x01D4
-#define MTXORB_FTDI_RANGE_01D5_PID	0x01D5
-#define MTXORB_FTDI_RANGE_01D6_PID	0x01D6
-#define MTXORB_FTDI_RANGE_01D7_PID	0x01D7
-#define MTXORB_FTDI_RANGE_01D8_PID	0x01D8
-#define MTXORB_FTDI_RANGE_01D9_PID	0x01D9
-#define MTXORB_FTDI_RANGE_01DA_PID	0x01DA
-#define MTXORB_FTDI_RANGE_01DB_PID	0x01DB
-#define MTXORB_FTDI_RANGE_01DC_PID	0x01DC
-#define MTXORB_FTDI_RANGE_01DD_PID	0x01DD
-#define MTXORB_FTDI_RANGE_01DE_PID	0x01DE
-#define MTXORB_FTDI_RANGE_01DF_PID	0x01DF
-#define MTXORB_FTDI_RANGE_01E0_PID	0x01E0
-#define MTXORB_FTDI_RANGE_01E1_PID	0x01E1
-#define MTXORB_FTDI_RANGE_01E2_PID	0x01E2
-#define MTXORB_FTDI_RANGE_01E3_PID	0x01E3
-#define MTXORB_FTDI_RANGE_01E4_PID	0x01E4
-#define MTXORB_FTDI_RANGE_01E5_PID	0x01E5
-#define MTXORB_FTDI_RANGE_01E6_PID	0x01E6
-#define MTXORB_FTDI_RANGE_01E7_PID	0x01E7
-#define MTXORB_FTDI_RANGE_01E8_PID	0x01E8
-#define MTXORB_FTDI_RANGE_01E9_PID	0x01E9
-#define MTXORB_FTDI_RANGE_01EA_PID	0x01EA
-#define MTXORB_FTDI_RANGE_01EB_PID	0x01EB
-#define MTXORB_FTDI_RANGE_01EC_PID	0x01EC
-#define MTXORB_FTDI_RANGE_01ED_PID	0x01ED
-#define MTXORB_FTDI_RANGE_01EE_PID	0x01EE
-#define MTXORB_FTDI_RANGE_01EF_PID	0x01EF
-#define MTXORB_FTDI_RANGE_01F0_PID	0x01F0
-#define MTXORB_FTDI_RANGE_01F1_PID	0x01F1
-#define MTXORB_FTDI_RANGE_01F2_PID	0x01F2
-#define MTXORB_FTDI_RANGE_01F3_PID	0x01F3
-#define MTXORB_FTDI_RANGE_01F4_PID	0x01F4
-#define MTXORB_FTDI_RANGE_01F5_PID	0x01F5
-#define MTXORB_FTDI_RANGE_01F6_PID	0x01F6
-#define MTXORB_FTDI_RANGE_01F7_PID	0x01F7
-#define MTXORB_FTDI_RANGE_01F8_PID	0x01F8
-#define MTXORB_FTDI_RANGE_01F9_PID	0x01F9
-#define MTXORB_FTDI_RANGE_01FA_PID	0x01FA
-#define MTXORB_FTDI_RANGE_01FB_PID	0x01FB
-#define MTXORB_FTDI_RANGE_01FC_PID	0x01FC
-#define MTXORB_FTDI_RANGE_01FD_PID	0x01FD
-#define MTXORB_FTDI_RANGE_01FE_PID	0x01FE
-#define MTXORB_FTDI_RANGE_01FF_PID	0x01FF
-
-
-
-/* Interbiometrics USB I/O Board */
-/* Developed for Interbiometrics by Rudolf Gugler */
-#define INTERBIOMETRICS_VID              0x1209
-#define INTERBIOMETRICS_IOBOARD_PID      0x1002
-#define INTERBIOMETRICS_MINI_IOBOARD_PID 0x1006
-
-/*
- * The following are the values for the Perle Systems
- * UltraPort USB serial converters
- */
-#define FTDI_PERLE_ULTRAPORT_PID 0xF0C0	/* Perle UltraPort Product Id */
-
-/*
- * The following are the values for the Sealevel SeaLINK+ adapters.
- * (Original list sent by Tuan Hoang.  Ian Abbott renamed the macros and
- * removed some PIDs that don't seem to match any existing products.)
- */
-#define SEALEVEL_VID		0x0c52	/* Sealevel Vendor ID */
-#define SEALEVEL_2101_PID	0x2101	/* SeaLINK+232 (2101/2105) */
-#define SEALEVEL_2102_PID	0x2102	/* SeaLINK+485 (2102) */
-#define SEALEVEL_2103_PID	0x2103	/* SeaLINK+232I (2103) */
-#define SEALEVEL_2104_PID	0x2104	/* SeaLINK+485I (2104) */
-#define SEALEVEL_2106_PID	0x9020	/* SeaLINK+422 (2106) */
-#define SEALEVEL_2201_1_PID	0x2211	/* SeaPORT+2/232 (2201) Port 1 */
-#define SEALEVEL_2201_2_PID	0x2221	/* SeaPORT+2/232 (2201) Port 2 */
-#define SEALEVEL_2202_1_PID	0x2212	/* SeaPORT+2/485 (2202) Port 1 */
-#define SEALEVEL_2202_2_PID	0x2222	/* SeaPORT+2/485 (2202) Port 2 */
-#define SEALEVEL_2203_1_PID	0x2213	/* SeaPORT+2 (2203) Port 1 */
-#define SEALEVEL_2203_2_PID	0x2223	/* SeaPORT+2 (2203) Port 2 */
-#define SEALEVEL_2401_1_PID	0x2411	/* SeaPORT+4/232 (2401) Port 1 */
-#define SEALEVEL_2401_2_PID	0x2421	/* SeaPORT+4/232 (2401) Port 2 */
-#define SEALEVEL_2401_3_PID	0x2431	/* SeaPORT+4/232 (2401) Port 3 */
-#define SEALEVEL_2401_4_PID	0x2441	/* SeaPORT+4/232 (2401) Port 4 */
-#define SEALEVEL_2402_1_PID	0x2412	/* SeaPORT+4/485 (2402) Port 1 */
-#define SEALEVEL_2402_2_PID	0x2422	/* SeaPORT+4/485 (2402) Port 2 */
-#define SEALEVEL_2402_3_PID	0x2432	/* SeaPORT+4/485 (2402) Port 3 */
-#define SEALEVEL_2402_4_PID	0x2442	/* SeaPORT+4/485 (2402) Port 4 */
-#define SEALEVEL_2403_1_PID	0x2413	/* SeaPORT+4 (2403) Port 1 */
-#define SEALEVEL_2403_2_PID	0x2423	/* SeaPORT+4 (2403) Port 2 */
-#define SEALEVEL_2403_3_PID	0x2433	/* SeaPORT+4 (2403) Port 3 */
-#define SEALEVEL_2403_4_PID	0x2443	/* SeaPORT+4 (2403) Port 4 */
-#define SEALEVEL_2801_1_PID	0X2811	/* SeaLINK+8/232 (2801) Port 1 */
-#define SEALEVEL_2801_2_PID	0X2821	/* SeaLINK+8/232 (2801) Port 2 */
-#define SEALEVEL_2801_3_PID	0X2831	/* SeaLINK+8/232 (2801) Port 3 */
-#define SEALEVEL_2801_4_PID	0X2841	/* SeaLINK+8/232 (2801) Port 4 */
-#define SEALEVEL_2801_5_PID	0X2851	/* SeaLINK+8/232 (2801) Port 5 */
-#define SEALEVEL_2801_6_PID	0X2861	/* SeaLINK+8/232 (2801) Port 6 */
-#define SEALEVEL_2801_7_PID	0X2871	/* SeaLINK+8/232 (2801) Port 7 */
-#define SEALEVEL_2801_8_PID	0X2881	/* SeaLINK+8/232 (2801) Port 8 */
-#define SEALEVEL_2802_1_PID	0X2812	/* SeaLINK+8/485 (2802) Port 1 */
-#define SEALEVEL_2802_2_PID	0X2822	/* SeaLINK+8/485 (2802) Port 2 */
-#define SEALEVEL_2802_3_PID	0X2832	/* SeaLINK+8/485 (2802) Port 3 */
-#define SEALEVEL_2802_4_PID	0X2842	/* SeaLINK+8/485 (2802) Port 4 */
-#define SEALEVEL_2802_5_PID	0X2852	/* SeaLINK+8/485 (2802) Port 5 */
-#define SEALEVEL_2802_6_PID	0X2862	/* SeaLINK+8/485 (2802) Port 6 */
-#define SEALEVEL_2802_7_PID	0X2872	/* SeaLINK+8/485 (2802) Port 7 */
-#define SEALEVEL_2802_8_PID	0X2882	/* SeaLINK+8/485 (2802) Port 8 */
-#define SEALEVEL_2803_1_PID	0X2813	/* SeaLINK+8 (2803) Port 1 */
-#define SEALEVEL_2803_2_PID	0X2823 	/* SeaLINK+8 (2803) Port 2 */
-#define SEALEVEL_2803_3_PID	0X2833 	/* SeaLINK+8 (2803) Port 3 */
-#define SEALEVEL_2803_4_PID	0X2843 	/* SeaLINK+8 (2803) Port 4 */
-#define SEALEVEL_2803_5_PID	0X2853 	/* SeaLINK+8 (2803) Port 5 */
-#define SEALEVEL_2803_6_PID	0X2863 	/* SeaLINK+8 (2803) Port 6 */
-#define SEALEVEL_2803_7_PID	0X2873 	/* SeaLINK+8 (2803) Port 7 */
-#define SEALEVEL_2803_8_PID	0X2883 	/* SeaLINK+8 (2803) Port 8 */
-
-/*
- * The following are the values for two KOBIL chipcard terminals.
- */
-#define KOBIL_VID		0x0d46	/* KOBIL Vendor ID */
-#define KOBIL_CONV_B1_PID	0x2020	/* KOBIL Konverter for B1 */
-#define KOBIL_CONV_KAAN_PID	0x2021	/* KOBIL_Konverter for KAAN */
-
-/*
- * Icom ID-1 digital transceiver
- */
-
-#define ICOM_ID1_VID            0x0C26
-#define ICOM_ID1_PID            0x0004
-
-/*
- * ASK.fr devices
- */
-#define FTDI_ASK_RDR400_PID	0xC991	/* ASK RDR 400 series card reader */
-
-/*
- * FTDI USB UART chips used in construction projects from the
- * Elektor Electronics magazine (http://elektor-electronics.co.uk)
- */
-#define ELEKTOR_VID		0x0C7D
-#define ELEKTOR_FT323R_PID	0x0005	/* RFID-Reader, issue 09-2006 */
-
-/*
- * DSS-20 Sync Station for Sony Ericsson P800
- */
-#define FTDI_DSS20_PID          0xFC82
-
-/*
- * Home Electronics (www.home-electro.com) USB gadgets
- */
-#define FTDI_HE_TIRA1_PID	0xFA78	/* Tira-1 IR transceiver */
-
-/* USB-UIRT - An infrared receiver and transmitter using the 8U232AM chip */
-/* http://home.earthlink.net/~jrhees/USBUIRT/index.htm */
-#define FTDI_USB_UIRT_PID	0xF850	/* Product Id */
-
-/* TNC-X USB-to-packet-radio adapter, versions prior to 3.0 (DLP module) */
-
-#define FTDI_TNC_X_PID		0xEBE0
-
-/*
- * ELV USB devices submitted by Christian Abt of ELV (www.elv.de).
- * All of these devices use FTDI's vendor ID (0x0403).
- *
- * The previously included PID for the UO 100 module was incorrect.
- * In fact, that PID was for ELV's UR 100 USB-RS232 converter (0xFB58).
- *
- * Armin Laeuger originally sent the PID for the UM 100 module.
- */
-#define FTDI_R2000KU_TRUE_RNG	0xFB80  /* R2000KU TRUE RNG */
-#define FTDI_ELV_UR100_PID	0xFB58	/* USB-RS232-Umsetzer (UR 100) */
-#define FTDI_ELV_UM100_PID	0xFB5A	/* USB-Modul UM 100 */
-#define FTDI_ELV_UO100_PID	0xFB5B	/* USB-Modul UO 100 */
-#define FTDI_ELV_ALC8500_PID	0xF06E	/* ALC 8500 Expert */
-/* Additional ELV PIDs that default to using the FTDI D2XX drivers on
- * MS Windows, rather than the FTDI Virtual Com Port drivers.
- * Maybe these will be easier to use with the libftdi/libusb user-space
- * drivers, or possibly the Comedi drivers in some cases. */
-#define FTDI_ELV_CLI7000_PID	0xFB59	/* Computer-Light-Interface (CLI 7000) */
-#define FTDI_ELV_PPS7330_PID	0xFB5C	/* Processor-Power-Supply (PPS 7330) */
-#define FTDI_ELV_TFM100_PID	0xFB5D	/* Temperartur-Feuchte Messgeraet (TFM 100) */
-#define FTDI_ELV_UDF77_PID	0xFB5E	/* USB DCF Funkurh (UDF 77) */
-#define FTDI_ELV_UIO88_PID	0xFB5F	/* USB-I/O Interface (UIO 88) */
-#define FTDI_ELV_UAD8_PID	0xF068	/* USB-AD-Wandler (UAD 8) */
-#define FTDI_ELV_UDA7_PID	0xF069	/* USB-DA-Wandler (UDA 7) */
-#define FTDI_ELV_USI2_PID	0xF06A	/* USB-Schrittmotoren-Interface (USI 2) */
-#define FTDI_ELV_T1100_PID	0xF06B	/* Thermometer (T 1100) */
-#define FTDI_ELV_PCD200_PID	0xF06C	/* PC-Datenlogger (PCD 200) */
-#define FTDI_ELV_ULA200_PID	0xF06D	/* USB-LCD-Ansteuerung (ULA 200) */
-#define FTDI_ELV_FHZ1000PC_PID	0xF06F	/* FHZ 1000 PC */
-#define FTDI_ELV_CSI8_PID	0xE0F0	/* Computer-Schalt-Interface (CSI 8) */
-#define FTDI_ELV_EM1000DL_PID	0xE0F1	/* PC-Datenlogger fuer Energiemonitor (EM 1000 DL) */
-#define FTDI_ELV_PCK100_PID	0xE0F2	/* PC-Kabeltester (PCK 100) */
-#define FTDI_ELV_RFP500_PID	0xE0F3	/* HF-Leistungsmesser (RFP 500) */
-#define FTDI_ELV_FS20SIG_PID	0xE0F4	/* Signalgeber (FS 20 SIG) */
-#define FTDI_ELV_WS300PC_PID	0xE0F6	/* PC-Wetterstation (WS 300 PC) */
-#define FTDI_ELV_FHZ1300PC_PID	0xE0E8	/* FHZ 1300 PC */
-#define FTDI_ELV_WS500_PID	0xE0E9	/* PC-Wetterstation (WS 500) */
-#define FTDI_ELV_HS485_PID	0xE0EA	/* USB to RS-485 adapter */
-#define FTDI_ELV_EM1010PC_PID	0xE0EF	/* Engery monitor EM 1010 PC */
-#define FTDI_PHI_FISCO_PID      0xE40B  /* PHI Fisco USB to Serial cable */
-
-/*
- * Definitions for ID TECH (www.idt-net.com) devices
- */
-#define IDTECH_VID		0x0ACD	/* ID TECH Vendor ID */
-#define IDTECH_IDT1221U_PID	0x0300	/* IDT1221U USB to RS-232 adapter */
-
-/*
- * Definitions for Omnidirectional Control Technology, Inc. devices
- */
-#define OCT_VID			0x0B39	/* OCT vendor ID */
-/* Note: OCT US101 is also rebadged as Dick Smith Electronics (NZ) XH6381 */
-/* Also rebadged as Dick Smith Electronics (Aus) XH6451 */
-/* Also rebadged as SIIG Inc. model US2308 hardware version 1 */
-#define OCT_US101_PID		0x0421	/* OCT US101 USB to RS-232 */
-
-/* an infrared receiver for user access control with IR tags */
-#define FTDI_PIEGROUP_PID	0xF208	/* Product Id */
-
-/*
- * Definitions for Artemis astronomical USB based cameras
- * Check it at http://www.artemisccd.co.uk/
- */
-#define FTDI_ARTEMIS_PID	0xDF28	/* All Artemis Cameras */
-
-/*
- * Definitions for ATIK Instruments astronomical USB based cameras
- * Check it at http://www.atik-instruments.com/
- */
-#define FTDI_ATIK_ATK16_PID	0xDF30	/* ATIK ATK-16 Grayscale Camera */
-#define FTDI_ATIK_ATK16C_PID	0xDF32	/* ATIK ATK-16C Colour Camera */
-#define FTDI_ATIK_ATK16HR_PID	0xDF31	/* ATIK ATK-16HR Grayscale Camera */
-#define FTDI_ATIK_ATK16HRC_PID	0xDF33	/* ATIK ATK-16HRC Colour Camera */
-#define FTDI_ATIK_ATK16IC_PID   0xDF35  /* ATIK ATK-16IC Grayscale Camera */
-
-/*
- * Protego product ids
- */
-#define PROTEGO_SPECIAL_1	0xFC70	/* special/unknown device */
-#define PROTEGO_R2X0		0xFC71	/* R200-USB TRNG unit (R210, R220, and R230) */
-#define PROTEGO_SPECIAL_3	0xFC72	/* special/unknown device */
-#define PROTEGO_SPECIAL_4	0xFC73	/* special/unknown device */
-
-/*
- * Gude Analog- und Digitalsysteme GmbH
- */
-#define FTDI_GUDEADS_E808_PID    0xE808
-#define FTDI_GUDEADS_E809_PID    0xE809
-#define FTDI_GUDEADS_E80A_PID    0xE80A
-#define FTDI_GUDEADS_E80B_PID    0xE80B
-#define FTDI_GUDEADS_E80C_PID    0xE80C
-#define FTDI_GUDEADS_E80D_PID    0xE80D
-#define FTDI_GUDEADS_E80E_PID    0xE80E
-#define FTDI_GUDEADS_E80F_PID    0xE80F
-#define FTDI_GUDEADS_E888_PID    0xE888  /* Expert ISDN Control USB */
-#define FTDI_GUDEADS_E889_PID    0xE889  /* USB RS-232 OptoBridge */
-#define FTDI_GUDEADS_E88A_PID    0xE88A
-#define FTDI_GUDEADS_E88B_PID    0xE88B
-#define FTDI_GUDEADS_E88C_PID    0xE88C
-#define FTDI_GUDEADS_E88D_PID    0xE88D
-#define FTDI_GUDEADS_E88E_PID    0xE88E
-#define FTDI_GUDEADS_E88F_PID    0xE88F
-
-/*
- * Linx Technologies product ids
- */
-#define LINX_SDMUSBQSS_PID	0xF448	/* Linx SDM-USB-QS-S */
-#define LINX_MASTERDEVEL2_PID   0xF449   /* Linx Master Development 2.0 */
-#define LINX_FUTURE_0_PID   0xF44A   /* Linx future device */
-#define LINX_FUTURE_1_PID   0xF44B   /* Linx future device */
-#define LINX_FUTURE_2_PID   0xF44C   /* Linx future device */
-
-/* CCS Inc. ICDU/ICDU40 product ID - the FT232BM is used in an in-circuit-debugger */
-/* unit for PIC16's/PIC18's */
-#define FTDI_CCSICDU20_0_PID    0xF9D0
-#define FTDI_CCSICDU40_1_PID    0xF9D1
-#define FTDI_CCSMACHX_2_PID     0xF9D2
-#define FTDI_CCSLOAD_N_GO_3_PID 0xF9D3
-#define FTDI_CCSICDU64_4_PID    0xF9D4
-#define FTDI_CCSPRIME8_5_PID    0xF9D5
-
-/* Inside Accesso contactless reader (http://www.insidefr.com) */
-#define INSIDE_ACCESSO		0xFAD0
-
-/*
- * Intrepid Control Systems (http://www.intrepidcs.com/) ValueCAN and NeoVI
- */
-#define INTREPID_VID		0x093C
-#define INTREPID_VALUECAN_PID	0x0601
-#define INTREPID_NEOVI_PID	0x0701
-
-/*
- * Falcom Wireless Communications GmbH
- */
-#define FALCOM_VID		0x0F94	/* Vendor Id */
-#define FALCOM_TWIST_PID	0x0001	/* Falcom Twist USB GPRS modem */
-#define FALCOM_SAMBA_PID	0x0005	/* Falcom Samba USB GPRS modem */
-
-/*
- * SUUNTO product ids
- */
-#define FTDI_SUUNTO_SPORTS_PID	0xF680	/* Suunto Sports instrument */
-
-/*
- * Oceanic product ids
- */
-#define FTDI_OCEANIC_PID	0xF460  /* Oceanic dive instrument */
-
-/*
- * TTi (Thurlby Thandar Instruments)
- */
-#define TTI_VID			0x103E	/* Vendor Id */
-#define TTI_QL355P_PID		0x03E8	/* TTi QL355P power supply */
-
-/*
- * Definitions for B&B Electronics products.
- */
-#define BANDB_VID		0x0856	/* B&B Electronics Vendor ID */
-#define BANDB_USOTL4_PID	0xAC01	/* USOTL4 Isolated RS-485 Converter */
-#define BANDB_USTL4_PID		0xAC02	/* USTL4 RS-485 Converter */
-#define BANDB_USO9ML2_PID	0xAC03	/* USO9ML2 Isolated RS-232 Converter */
-
-/*
- * RM Michaelides CANview USB (http://www.rmcan.com)
- * CAN fieldbus interface adapter, added by port GmbH www.port.de)
- * Ian Abbott changed the macro names for consistency.
- */
-#define FTDI_RM_CANVIEW_PID	0xfd60	/* Product Id */
-
-/*
- * EVER Eco Pro UPS (http://www.ever.com.pl/)
- */
-
-#define	EVER_ECO_PRO_CDS	0xe520	/* RS-232 converter */
-
-/*
- * 4N-GALAXY.DE PIDs for CAN-USB, USB-RS232, USB-RS422, USB-RS485,
- * USB-TTY activ, USB-TTY passiv.  Some PIDs are used by several devices
- * and I'm not entirely sure which are used by which.
- */
-#define FTDI_4N_GALAXY_DE_1_PID	0xF3C0
-#define FTDI_4N_GALAXY_DE_2_PID	0xF3C1
-
-/*
- * Mobility Electronics products.
- */
-#define MOBILITY_VID			0x1342
-#define MOBILITY_USB_SERIAL_PID		0x0202	/* EasiDock USB 200 serial */
-
-/*
- * microHAM product IDs (http://www.microham.com).
- * Submitted by Justin Burket (KL1RL) <zorton@jtan.com>
- * and Mike Studer (K6EEP) <k6eep@hamsoftware.org>.
- * Ian Abbott <abbotti@mev.co.uk> added a few more from the driver INF file.
- */
-#define FTDI_MHAM_KW_PID 0xEEE8		/* USB-KW interface */
-#define FTDI_MHAM_YS_PID 0xEEE9		/* USB-YS interface */
-#define FTDI_MHAM_Y6_PID 0xEEEA		/* USB-Y6 interface */
-#define FTDI_MHAM_Y8_PID 0xEEEB		/* USB-Y8 interface */
-#define FTDI_MHAM_IC_PID 0xEEEC		/* USB-IC interface */
-#define FTDI_MHAM_DB9_PID 0xEEED	/* USB-DB9 interface */
-#define FTDI_MHAM_RS232_PID 0xEEEE	/* USB-RS232 interface */
-#define FTDI_MHAM_Y9_PID 0xEEEF		/* USB-Y9 interface */
-
-/*
- * Active Robots product ids.
- */
-#define FTDI_ACTIVE_ROBOTS_PID	0xE548	/* USB comms board */
-
-/*
- * Xsens Technologies BV products (http://www.xsens.com).
- */
-#define XSENS_CONVERTER_0_PID	0xD388
-#define XSENS_CONVERTER_1_PID	0xD389
-#define XSENS_CONVERTER_2_PID	0xD38A
-#define XSENS_CONVERTER_3_PID	0xD38B
-#define XSENS_CONVERTER_4_PID	0xD38C
-#define XSENS_CONVERTER_5_PID	0xD38D
-#define XSENS_CONVERTER_6_PID	0xD38E
-#define XSENS_CONVERTER_7_PID	0xD38F
-
-/*
- * Teratronik product ids.
- * Submitted by O. Wölfelschneider.
- */
-#define FTDI_TERATRONIK_VCP_PID	 0xEC88	/* Teratronik device (preferring VCP driver on windows) */
-#define FTDI_TERATRONIK_D2XX_PID 0xEC89	/* Teratronik device (preferring D2XX driver on windows) */
-
-/*
- * Evolution Robotics products (http://www.evolution.com/).
- * Submitted by Shawn M. Lavelle.
- */
-#define EVOLUTION_VID		0xDEEE	/* Vendor ID */
-#define EVOLUTION_ER1_PID	0x0300	/* ER1 Control Module */
-#define EVO_8U232AM_PID	0x02FF	/* Evolution robotics RCM2 (FT232AM)*/
-#define EVO_HYBRID_PID		0x0302	/* Evolution robotics RCM4 PID (FT232BM)*/
-#define EVO_RCM4_PID		0x0303	/* Evolution robotics RCM4 PID */
-
-/* Pyramid Computer GmbH */
-#define FTDI_PYRAMID_PID	0xE6C8	/* Pyramid Appliance Display */
-
-/*
- * NDI (www.ndigital.com) product ids
- */
-#define FTDI_NDI_HUC_PID		0xDA70	/* NDI Host USB Converter */
-#define FTDI_NDI_SPECTRA_SCU_PID	0xDA71	/* NDI Spectra SCU */
-#define FTDI_NDI_FUTURE_2_PID		0xDA72	/* NDI future device #2 */
-#define FTDI_NDI_FUTURE_3_PID		0xDA73	/* NDI future device #3 */
-#define FTDI_NDI_AURORA_SCU_PID		0xDA74	/* NDI Aurora SCU */
-
-/*
- * Posiflex inc retail equipment (http://www.posiflex.com.tw)
- */
-#define POSIFLEX_VID		0x0d3a  /* Vendor ID */
-#define POSIFLEX_PP7000_PID	0x0300  /* PP-7000II thermal printer */
-
-/*
- * Westrex International devices submitted by Cory Lee
- */
-#define FTDI_WESTREX_MODEL_777_PID	0xDC00	/* Model 777 */
-#define FTDI_WESTREX_MODEL_8900F_PID	0xDC01	/* Model 8900F */
-
-/*
- * RR-CirKits LocoBuffer USB (http://www.rr-cirkits.com)
- */
-#define FTDI_RRCIRKITS_LOCOBUFFER_PID	0xc7d0	/* LocoBuffer USB */
-
-/*
- * Eclo (http://www.eclo.pt/) product IDs.
- * PID 0xEA90 submitted by Martin Grill.
- */
-#define FTDI_ECLO_COM_1WIRE_PID	0xEA90	/* COM to 1-Wire USB adaptor */
-
-/*
- * Papouch products (http://www.papouch.com/)
- * Submitted by Folkert van Heusden
- */
-
-#define PAPOUCH_VID			0x5050	/* Vendor ID */
-#define PAPOUCH_TMU_PID			0x0400	/* TMU USB Thermometer */
-#define PAPOUCH_QUIDO4x4_PID		0x0900	/* Quido 4/4 Module */
-
-/*
- * ACG Identification Technologies GmbH products (http://www.acg.de/).
- * Submitted by anton -at- goto10 -dot- org.
  */
-#define FTDI_ACG_HFDUAL_PID		0xDD20	/* HF Dual ISO Reader (RFID) */
-
-/*
- * Yost Engineering, Inc. products (www.yostengineering.com).
- * PID 0xE050 submitted by Aaron Prose.
- */
-#define FTDI_YEI_SERVOCENTER31_PID	0xE050	/* YEI ServoCenter3.1 USB */
-
-/*
- * ThorLabs USB motor drivers
- */
-#define FTDI_THORLABS_PID		0xfaf0 /* ThorLabs USB motor drivers */
-
-/*
- * Testo products (http://www.testo.com/)
- * Submitted by Colin Leroy
- */
-#define TESTO_VID			0x128D
-#define TESTO_USB_INTERFACE_PID		0x0001
-
-/*
- * Gamma Scout (http://gamma-scout.com/). Submitted by rsc@runtux.com.
- */
-#define FTDI_GAMMA_SCOUT_PID		0xD678	/* Gamma Scout online */
-
-/*
- * Tactrix OpenPort (ECU) devices.
- * OpenPort 1.3M submitted by Donour Sizemore.
- * OpenPort 1.3S and 1.3U submitted by Ian Abbott.
- */
-#define FTDI_TACTRIX_OPENPORT_13M_PID	0xCC48	/* OpenPort 1.3 Mitsubishi */
-#define FTDI_TACTRIX_OPENPORT_13S_PID	0xCC49	/* OpenPort 1.3 Subaru */
-#define FTDI_TACTRIX_OPENPORT_13U_PID	0xCC4A	/* OpenPort 1.3 Universal */
-
-/*
- * Telldus Technologies
- */
-#define TELLDUS_VID			0x1781	/* Vendor ID */
-#define TELLDUS_TELLSTICK_PID		0x0C30	/* RF control dongle 433 MHz using FT232RL */
-
-/*
- * IBS elektronik product ids
- * Submitted by Thomas Schleusener
- */
-#define FTDI_IBS_US485_PID	0xff38  /* IBS US485 (USB<-->RS422/485 interface) */
-#define FTDI_IBS_PICPRO_PID	0xff39  /* IBS PIC-Programmer */
-#define FTDI_IBS_PCMCIA_PID	0xff3a  /* IBS Card reader for PCMCIA SRAM-cards */
-#define FTDI_IBS_PK1_PID	0xff3b  /* IBS PK1 - Particel counter */
-#define FTDI_IBS_RS232MON_PID	0xff3c  /* IBS RS232 - Monitor */
-#define FTDI_IBS_APP70_PID	0xff3d  /* APP 70 (dust monitoring system) */
-#define FTDI_IBS_PEDO_PID	0xff3e  /* IBS PEDO-Modem (RF modem 868.35 MHz) */
-#define FTDI_IBS_PROD_PID	0xff3f  /* future device */
-
-/*
- *  MaxStream devices	www.maxstream.net
- */
-#define FTDI_MAXSTREAM_PID	0xEE18	/* Xbee PKG-U Module */
-
-/* Olimex */
-#define OLIMEX_VID			0x15BA
-#define OLIMEX_ARM_USB_OCD_PID		0x0003
-
-/* Luminary Micro Stellaris Boards, VID = FTDI_VID */
-/* FTDI 2332C Dual channel device, side A=245 FIFO (JTAG), Side B=RS232 UART */
-#define LMI_LM3S_DEVEL_BOARD_PID	0xbcd8
-#define LMI_LM3S_EVAL_BOARD_PID		0xbcd9
-
-/* www.elsterelectricity.com Elster Unicom III Optical Probe */
-#define FTDI_ELSTER_UNICOM_PID		0xE700 /* Product Id */
-
-/*
- * The Mobility Lab (TML)
- * Submitted by Pierre Castella
- */
-#define TML_VID			0x1B91	/* Vendor ID */
-#define TML_USB_SERIAL_PID	0x0064	/* USB - Serial Converter */
-
-/* Propox devices */
-#define FTDI_PROPOX_JTAGCABLEII_PID	0xD738
-
-/* Rig Expert Ukraine devices */
-#define FTDI_REU_TINY_PID		0xED22	/* RigExpert Tiny */
-
-/* Domintell products  http://www.domintell.com */
-#define FTDI_DOMINTELL_DGQG_PID	0xEF50	/* Master */
-#define FTDI_DOMINTELL_DUSB_PID	0xEF51	/* DUSB01 module */
-
-/* Alti-2 products  http://www.alti-2.com */
-#define ALTI2_VID	0x1BC9
-#define ALTI2_N3_PID	0x6001	/* Neptune 3 */
 
 /* Commands */
 #define FTDI_SIO_RESET 		0 /* Reset the port */
@@ -896,86 +40,6 @@
 #define INTERFACE_C		3
 #define INTERFACE_D		4
 
-/*
- * FIC / OpenMoko, Inc. http://wiki.openmoko.org/wiki/Neo1973_Debug_Board_v3
- * Submitted by Harald Welte <laforge@openmoko.org>
- */
-#define	FIC_VID			0x1457
-#define	FIC_NEO1973_DEBUG_PID	0x5118
-
-/*
- * RATOC REX-USB60F
- */
-#define RATOC_VENDOR_ID		0x0584
-#define RATOC_PRODUCT_ID_USB60F	0xb020
-
-/*
- * DIEBOLD BCS SE923
- */
-#define DIEBOLD_BCS_SE923_PID	0xfb99
-
-/*
- * Atmel STK541
- */
-#define ATMEL_VID		0x03eb /* Vendor ID */
-#define STK541_PID		0x2109 /* Zigbee Controller */
-
-/*
- * Dresden Elektronic Sensor Terminal Board
- */
-#define DE_VID			0x1cf1 /* Vendor ID */
-#define STB_PID			0x0001 /* Sensor Terminal Board */
-#define WHT_PID			0x0004 /* Wireless Handheld Terminal */
-
-/*
- * Blackfin gnICE JTAG
- * http://docs.blackfin.uclinux.org/doku.php?id=hw:jtag:gnice
- */
-#define ADI_VID 		0x0456
-#define ADI_GNICE_PID 		0xF000
-#define ADI_GNICEPLUS_PID 	0xF001
-
-/*
- * JETI SPECTROMETER SPECBOS 1201
- * http://www.jeti.com/products/sys/scb/scb1201.php
- */
-#define JETI_VID		0x0c6c
-#define JETI_SPC1201_PID	0x04b2
-
-/*
- * Marvell SheevaPlug
- */
-#define MARVELL_VID		0x9e88
-#define MARVELL_SHEEVAPLUG_PID	0x9e8f
-
-#define FTDI_TURTELIZER_PID	0xBDC8 /* JTAG/RS-232 adapter by egnite GmBH */
-
-/*
- * GN Otometrics (http://www.otometrics.com)
- * Submitted by Ville Sundberg.
- */
-#define GN_OTOMETRICS_VID	0x0c33	/* Vendor ID */
-#define AURICAL_USB_PID		0x0010	/* Aurical USB Audiometer */
-
-/*
- * Bayer Ascensia Contour blood glucose meter USB-converter cable.
- * http://winglucofacts.com/cables/
- */
-#define BAYER_VID                      0x1A79
-#define BAYER_CONTOUR_CABLE_PID        0x6001
-
-/*
- * Marvell OpenRD Base, Client
- * http://www.open-rd.org
- * OpenRD Base, Client use VID 0x0403
- */
-#define MARVELL_OPENRD_PID	0x9e90
-
-/*
- * Hameg HO820 and HO870 interface (using VID 0x0403)
- */
-#define        HAMEG_HO820_PID         0xed74
-#define        HAMEG_HO870_PID         0xed71
 
 /*
  *   BmRequestType:  1100 0000b
@@ -1490,4 +554,3 @@ typedef enum {
  * B2..7	Length of message - (not including Byte 0)
  *
  */
-
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
new file mode 100644
index 000000000000..da92b4952ffb
--- /dev/null
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -0,0 +1,986 @@
+/*
+ * vendor/product IDs (VID/PID) of devices using FTDI USB serial converters.
+ * Please keep numerically sorted within individual areas, thanks!
+ *
+ * Philipp Gühring - pg@futureware.at - added the Device ID of the USB relais
+ * from Rudolf Gugler
+ *
+ */
+
+
+/**********************************/
+/***** devices using FTDI VID *****/
+/**********************************/
+
+
+#define FTDI_VID	0x0403	/* Vendor Id */
+
+
+/*** "original" FTDI device PIDs ***/
+
+#define FTDI_8U232AM_PID 0x6001 /* Similar device to SIO above */
+#define FTDI_8U232AM_ALT_PID 0x6006 /* FTDI's alternate PID for above */
+#define FTDI_8U2232C_PID 0x6010 /* Dual channel device */
+#define FTDI_4232H_PID 0x6011 /* Quad channel hi-speed device */
+#define FTDI_SIO_PID	0x8372	/* Product Id SIO application of 8U100AX  */
+#define FTDI_232RL_PID  0xFBFA  /* Product ID for FT232RL */
+
+
+/*** third-party PIDs (using FTDI_VID) ***/
+
+/*
+ * Marvell OpenRD Base, Client
+ * http://www.open-rd.org
+ * OpenRD Base, Client use VID 0x0403
+ */
+#define MARVELL_OPENRD_PID	0x9e90
+
+/* www.candapter.com Ewert Energy Systems CANdapter device */
+#define FTDI_CANDAPTER_PID 0x9F80 /* Product Id */
+
+/* OOCDlink by Joern Kaipf <joernk@web.de>
+ * (http://www.joernonline.de/dw/doku.php?id=start&idx=projects:oocdlink) */
+#define FTDI_OOCDLINK_PID	0xbaf8	/* Amontec JTAGkey */
+
+/* Luminary Micro Stellaris Boards, VID = FTDI_VID */
+/* FTDI 2332C Dual channel device, side A=245 FIFO (JTAG), Side B=RS232 UART */
+#define LMI_LM3S_DEVEL_BOARD_PID	0xbcd8
+#define LMI_LM3S_EVAL_BOARD_PID		0xbcd9
+
+#define FTDI_TURTELIZER_PID	0xBDC8 /* JTAG/RS-232 adapter by egnite GmBH */
+
+/* OpenDCC (www.opendcc.de) product id */
+#define FTDI_OPENDCC_PID	0xBFD8
+#define FTDI_OPENDCC_SNIFFER_PID	0xBFD9
+#define FTDI_OPENDCC_THROTTLE_PID	0xBFDA
+#define FTDI_OPENDCC_GATEWAY_PID	0xBFDB
+
+/*
+ * RR-CirKits LocoBuffer USB (http://www.rr-cirkits.com)
+ */
+#define FTDI_RRCIRKITS_LOCOBUFFER_PID	0xc7d0	/* LocoBuffer USB */
+
+/* DMX4ALL DMX Interfaces */
+#define FTDI_DMX4ALL 0xC850
+
+/*
+ * ASK.fr devices
+ */
+#define FTDI_ASK_RDR400_PID	0xC991	/* ASK RDR 400 series card reader */
+
+/* www.starting-point-systems.com µChameleon device */
+#define FTDI_MICRO_CHAMELEON_PID	0xCAA0	/* Product Id */
+
+/*
+ * Tactrix OpenPort (ECU) devices.
+ * OpenPort 1.3M submitted by Donour Sizemore.
+ * OpenPort 1.3S and 1.3U submitted by Ian Abbott.
+ */
+#define FTDI_TACTRIX_OPENPORT_13M_PID	0xCC48	/* OpenPort 1.3 Mitsubishi */
+#define FTDI_TACTRIX_OPENPORT_13S_PID	0xCC49	/* OpenPort 1.3 Subaru */
+#define FTDI_TACTRIX_OPENPORT_13U_PID	0xCC4A	/* OpenPort 1.3 Universal */
+
+/* SCS HF Radio Modems PID's (http://www.scs-ptc.com) */
+/* the VID is the standard ftdi vid (FTDI_VID) */
+#define FTDI_SCS_DEVICE_0_PID 0xD010    /* SCS PTC-IIusb */
+#define FTDI_SCS_DEVICE_1_PID 0xD011    /* SCS Tracker / DSP TNC */
+#define FTDI_SCS_DEVICE_2_PID 0xD012
+#define FTDI_SCS_DEVICE_3_PID 0xD013
+#define FTDI_SCS_DEVICE_4_PID 0xD014
+#define FTDI_SCS_DEVICE_5_PID 0xD015
+#define FTDI_SCS_DEVICE_6_PID 0xD016
+#define FTDI_SCS_DEVICE_7_PID 0xD017
+
+/* iPlus device */
+#define FTDI_IPLUS_PID 0xD070 /* Product Id */
+#define FTDI_IPLUS2_PID 0xD071 /* Product Id */
+
+/*
+ * Gamma Scout (http://gamma-scout.com/). Submitted by rsc@runtux.com.
+ */
+#define FTDI_GAMMA_SCOUT_PID		0xD678	/* Gamma Scout online */
+
+/* Propox devices */
+#define FTDI_PROPOX_JTAGCABLEII_PID	0xD738
+
+/*
+ * Xsens Technologies BV products (http://www.xsens.com).
+ */
+#define XSENS_CONVERTER_0_PID	0xD388
+#define XSENS_CONVERTER_1_PID	0xD389
+#define XSENS_CONVERTER_2_PID	0xD38A
+#define XSENS_CONVERTER_3_PID	0xD38B
+#define XSENS_CONVERTER_4_PID	0xD38C
+#define XSENS_CONVERTER_5_PID	0xD38D
+#define XSENS_CONVERTER_6_PID	0xD38E
+#define XSENS_CONVERTER_7_PID	0xD38F
+
+/*
+ * NDI (www.ndigital.com) product ids
+ */
+#define FTDI_NDI_HUC_PID		0xDA70	/* NDI Host USB Converter */
+#define FTDI_NDI_SPECTRA_SCU_PID	0xDA71	/* NDI Spectra SCU */
+#define FTDI_NDI_FUTURE_2_PID		0xDA72	/* NDI future device #2 */
+#define FTDI_NDI_FUTURE_3_PID		0xDA73	/* NDI future device #3 */
+#define FTDI_NDI_AURORA_SCU_PID		0xDA74	/* NDI Aurora SCU */
+
+/*
+ * Westrex International devices submitted by Cory Lee
+ */
+#define FTDI_WESTREX_MODEL_777_PID	0xDC00	/* Model 777 */
+#define FTDI_WESTREX_MODEL_8900F_PID	0xDC01	/* Model 8900F */
+
+/*
+ * ACG Identification Technologies GmbH products (http://www.acg.de/).
+ * Submitted by anton -at- goto10 -dot- org.
+ */
+#define FTDI_ACG_HFDUAL_PID		0xDD20	/* HF Dual ISO Reader (RFID) */
+
+/*
+ * Definitions for Artemis astronomical USB based cameras
+ * Check it at http://www.artemisccd.co.uk/
+ */
+#define FTDI_ARTEMIS_PID	0xDF28	/* All Artemis Cameras */
+
+/*
+ * Definitions for ATIK Instruments astronomical USB based cameras
+ * Check it at http://www.atik-instruments.com/
+ */
+#define FTDI_ATIK_ATK16_PID	0xDF30	/* ATIK ATK-16 Grayscale Camera */
+#define FTDI_ATIK_ATK16C_PID	0xDF32	/* ATIK ATK-16C Colour Camera */
+#define FTDI_ATIK_ATK16HR_PID	0xDF31	/* ATIK ATK-16HR Grayscale Camera */
+#define FTDI_ATIK_ATK16HRC_PID	0xDF33	/* ATIK ATK-16HRC Colour Camera */
+#define FTDI_ATIK_ATK16IC_PID   0xDF35  /* ATIK ATK-16IC Grayscale Camera */
+
+/*
+ * Yost Engineering, Inc. products (www.yostengineering.com).
+ * PID 0xE050 submitted by Aaron Prose.
+ */
+#define FTDI_YEI_SERVOCENTER31_PID	0xE050	/* YEI ServoCenter3.1 USB */
+
+/*
+ * ELV USB devices submitted by Christian Abt of ELV (www.elv.de).
+ * All of these devices use FTDI's vendor ID (0x0403).
+ *
+ * The previously included PID for the UO 100 module was incorrect.
+ * In fact, that PID was for ELV's UR 100 USB-RS232 converter (0xFB58).
+ *
+ * Armin Laeuger originally sent the PID for the UM 100 module.
+ */
+#define FTDI_ELV_FHZ1300PC_PID	0xE0E8	/* FHZ 1300 PC */
+#define FTDI_ELV_WS500_PID	0xE0E9	/* PC-Wetterstation (WS 500) */
+#define FTDI_ELV_HS485_PID	0xE0EA	/* USB to RS-485 adapter */
+#define FTDI_ELV_EM1010PC_PID	0xE0EF	/* Engery monitor EM 1010 PC */
+#define FTDI_ELV_CSI8_PID	0xE0F0	/* Computer-Schalt-Interface (CSI 8) */
+#define FTDI_ELV_EM1000DL_PID	0xE0F1	/* PC-Datenlogger fuer Energiemonitor (EM 1000 DL) */
+#define FTDI_ELV_PCK100_PID	0xE0F2	/* PC-Kabeltester (PCK 100) */
+#define FTDI_ELV_RFP500_PID	0xE0F3	/* HF-Leistungsmesser (RFP 500) */
+#define FTDI_ELV_FS20SIG_PID	0xE0F4	/* Signalgeber (FS 20 SIG) */
+#define FTDI_ELV_WS300PC_PID	0xE0F6	/* PC-Wetterstation (WS 300 PC) */
+#define FTDI_PHI_FISCO_PID      0xE40B  /* PHI Fisco USB to Serial cable */
+#define FTDI_ELV_UAD8_PID	0xF068	/* USB-AD-Wandler (UAD 8) */
+#define FTDI_ELV_UDA7_PID	0xF069	/* USB-DA-Wandler (UDA 7) */
+#define FTDI_ELV_USI2_PID	0xF06A	/* USB-Schrittmotoren-Interface (USI 2) */
+#define FTDI_ELV_T1100_PID	0xF06B	/* Thermometer (T 1100) */
+#define FTDI_ELV_PCD200_PID	0xF06C	/* PC-Datenlogger (PCD 200) */
+#define FTDI_ELV_ULA200_PID	0xF06D	/* USB-LCD-Ansteuerung (ULA 200) */
+#define FTDI_ELV_ALC8500_PID	0xF06E	/* ALC 8500 Expert */
+#define FTDI_ELV_FHZ1000PC_PID	0xF06F	/* FHZ 1000 PC */
+#define FTDI_ELV_UR100_PID	0xFB58	/* USB-RS232-Umsetzer (UR 100) */
+#define FTDI_ELV_UM100_PID	0xFB5A	/* USB-Modul UM 100 */
+#define FTDI_ELV_UO100_PID	0xFB5B	/* USB-Modul UO 100 */
+/* Additional ELV PIDs that default to using the FTDI D2XX drivers on
+ * MS Windows, rather than the FTDI Virtual Com Port drivers.
+ * Maybe these will be easier to use with the libftdi/libusb user-space
+ * drivers, or possibly the Comedi drivers in some cases. */
+#define FTDI_ELV_CLI7000_PID	0xFB59	/* Computer-Light-Interface (CLI 7000) */
+#define FTDI_ELV_PPS7330_PID	0xFB5C	/* Processor-Power-Supply (PPS 7330) */
+#define FTDI_ELV_TFM100_PID	0xFB5D	/* Temperartur-Feuchte Messgeraet (TFM 100) */
+#define FTDI_ELV_UDF77_PID	0xFB5E	/* USB DCF Funkurh (UDF 77) */
+#define FTDI_ELV_UIO88_PID	0xFB5F	/* USB-I/O Interface (UIO 88) */
+
+/*
+ * EVER Eco Pro UPS (http://www.ever.com.pl/)
+ */
+
+#define	EVER_ECO_PRO_CDS	0xe520	/* RS-232 converter */
+
+/*
+ * Active Robots product ids.
+ */
+#define FTDI_ACTIVE_ROBOTS_PID	0xE548	/* USB comms board */
+
+/* Pyramid Computer GmbH */
+#define FTDI_PYRAMID_PID	0xE6C8	/* Pyramid Appliance Display */
+
+/* www.elsterelectricity.com Elster Unicom III Optical Probe */
+#define FTDI_ELSTER_UNICOM_PID		0xE700 /* Product Id */
+
+/*
+ * Gude Analog- und Digitalsysteme GmbH
+ */
+#define FTDI_GUDEADS_E808_PID    0xE808
+#define FTDI_GUDEADS_E809_PID    0xE809
+#define FTDI_GUDEADS_E80A_PID    0xE80A
+#define FTDI_GUDEADS_E80B_PID    0xE80B
+#define FTDI_GUDEADS_E80C_PID    0xE80C
+#define FTDI_GUDEADS_E80D_PID    0xE80D
+#define FTDI_GUDEADS_E80E_PID    0xE80E
+#define FTDI_GUDEADS_E80F_PID    0xE80F
+#define FTDI_GUDEADS_E888_PID    0xE888  /* Expert ISDN Control USB */
+#define FTDI_GUDEADS_E889_PID    0xE889  /* USB RS-232 OptoBridge */
+#define FTDI_GUDEADS_E88A_PID    0xE88A
+#define FTDI_GUDEADS_E88B_PID    0xE88B
+#define FTDI_GUDEADS_E88C_PID    0xE88C
+#define FTDI_GUDEADS_E88D_PID    0xE88D
+#define FTDI_GUDEADS_E88E_PID    0xE88E
+#define FTDI_GUDEADS_E88F_PID    0xE88F
+
+/*
+ * Eclo (http://www.eclo.pt/) product IDs.
+ * PID 0xEA90 submitted by Martin Grill.
+ */
+#define FTDI_ECLO_COM_1WIRE_PID	0xEA90	/* COM to 1-Wire USB adaptor */
+
+/* TNC-X USB-to-packet-radio adapter, versions prior to 3.0 (DLP module) */
+#define FTDI_TNC_X_PID		0xEBE0
+
+/*
+ * Teratronik product ids.
+ * Submitted by O. Wölfelschneider.
+ */
+#define FTDI_TERATRONIK_VCP_PID	 0xEC88	/* Teratronik device (preferring VCP driver on windows) */
+#define FTDI_TERATRONIK_D2XX_PID 0xEC89	/* Teratronik device (preferring D2XX driver on windows) */
+
+/* Rig Expert Ukraine devices */
+#define FTDI_REU_TINY_PID		0xED22	/* RigExpert Tiny */
+
+/*
+ * Hameg HO820 and HO870 interface (using VID 0x0403)
+ */
+#define        HAMEG_HO820_PID         0xed74
+#define        HAMEG_HO870_PID         0xed71
+
+/*
+ *  MaxStream devices	www.maxstream.net
+ */
+#define FTDI_MAXSTREAM_PID	0xEE18	/* Xbee PKG-U Module */
+
+/*
+ * microHAM product IDs (http://www.microham.com).
+ * Submitted by Justin Burket (KL1RL) <zorton@jtan.com>
+ * and Mike Studer (K6EEP) <k6eep@hamsoftware.org>.
+ * Ian Abbott <abbotti@mev.co.uk> added a few more from the driver INF file.
+ */
+#define FTDI_MHAM_KW_PID 0xEEE8		/* USB-KW interface */
+#define FTDI_MHAM_YS_PID 0xEEE9		/* USB-YS interface */
+#define FTDI_MHAM_Y6_PID 0xEEEA		/* USB-Y6 interface */
+#define FTDI_MHAM_Y8_PID 0xEEEB		/* USB-Y8 interface */
+#define FTDI_MHAM_IC_PID 0xEEEC		/* USB-IC interface */
+#define FTDI_MHAM_DB9_PID 0xEEED	/* USB-DB9 interface */
+#define FTDI_MHAM_RS232_PID 0xEEEE	/* USB-RS232 interface */
+#define FTDI_MHAM_Y9_PID 0xEEEF		/* USB-Y9 interface */
+
+/* Domintell products  http://www.domintell.com */
+#define FTDI_DOMINTELL_DGQG_PID	0xEF50	/* Master */
+#define FTDI_DOMINTELL_DUSB_PID	0xEF51	/* DUSB01 module */
+
+/*
+ * The following are the values for the Perle Systems
+ * UltraPort USB serial converters
+ */
+#define FTDI_PERLE_ULTRAPORT_PID 0xF0C0	/* Perle UltraPort Product Id */
+
+/* Sprog II (Andrew Crosland's SprogII DCC interface) */
+#define FTDI_SPROG_II		0xF0C8
+
+/* an infrared receiver for user access control with IR tags */
+#define FTDI_PIEGROUP_PID	0xF208	/* Product Id */
+
+/* ACT Solutions HomePro ZWave interface
+   (http://www.act-solutions.com/HomePro.htm) */
+#define FTDI_ACTZWAVE_PID	0xF2D0
+
+/*
+ * 4N-GALAXY.DE PIDs for CAN-USB, USB-RS232, USB-RS422, USB-RS485,
+ * USB-TTY activ, USB-TTY passiv.  Some PIDs are used by several devices
+ * and I'm not entirely sure which are used by which.
+ */
+#define FTDI_4N_GALAXY_DE_1_PID	0xF3C0
+#define FTDI_4N_GALAXY_DE_2_PID	0xF3C1
+
+/*
+ * Linx Technologies product ids
+ */
+#define LINX_SDMUSBQSS_PID	0xF448	/* Linx SDM-USB-QS-S */
+#define LINX_MASTERDEVEL2_PID   0xF449   /* Linx Master Development 2.0 */
+#define LINX_FUTURE_0_PID   0xF44A   /* Linx future device */
+#define LINX_FUTURE_1_PID   0xF44B   /* Linx future device */
+#define LINX_FUTURE_2_PID   0xF44C   /* Linx future device */
+
+/*
+ * Oceanic product ids
+ */
+#define FTDI_OCEANIC_PID	0xF460  /* Oceanic dive instrument */
+
+/*
+ * SUUNTO product ids
+ */
+#define FTDI_SUUNTO_SPORTS_PID	0xF680	/* Suunto Sports instrument */
+
+/* USB-UIRT - An infrared receiver and transmitter using the 8U232AM chip */
+/* http://home.earthlink.net/~jrhees/USBUIRT/index.htm */
+#define FTDI_USB_UIRT_PID	0xF850	/* Product Id */
+
+/* CCS Inc. ICDU/ICDU40 product ID -
+ * the FT232BM is used in an in-circuit-debugger unit for PIC16's/PIC18's */
+#define FTDI_CCSICDU20_0_PID    0xF9D0
+#define FTDI_CCSICDU40_1_PID    0xF9D1
+#define FTDI_CCSMACHX_2_PID     0xF9D2
+#define FTDI_CCSLOAD_N_GO_3_PID 0xF9D3
+#define FTDI_CCSICDU64_4_PID    0xF9D4
+#define FTDI_CCSPRIME8_5_PID    0xF9D5
+
+/*
+ * The following are the values for the Matrix Orbital LCD displays,
+ * which are the FT232BM ( similar to the 8U232AM )
+ */
+#define FTDI_MTXORB_0_PID      0xFA00  /* Matrix Orbital Product Id */
+#define FTDI_MTXORB_1_PID      0xFA01  /* Matrix Orbital Product Id */
+#define FTDI_MTXORB_2_PID      0xFA02  /* Matrix Orbital Product Id */
+#define FTDI_MTXORB_3_PID      0xFA03  /* Matrix Orbital Product Id */
+#define FTDI_MTXORB_4_PID      0xFA04  /* Matrix Orbital Product Id */
+#define FTDI_MTXORB_5_PID      0xFA05  /* Matrix Orbital Product Id */
+#define FTDI_MTXORB_6_PID      0xFA06  /* Matrix Orbital Product Id */
+
+/*
+ * Home Electronics (www.home-electro.com) USB gadgets
+ */
+#define FTDI_HE_TIRA1_PID	0xFA78	/* Tira-1 IR transceiver */
+
+/* Inside Accesso contactless reader (http://www.insidefr.com) */
+#define INSIDE_ACCESSO		0xFAD0
+
+/*
+ * ThorLabs USB motor drivers
+ */
+#define FTDI_THORLABS_PID		0xfaf0 /* ThorLabs USB motor drivers */
+
+/*
+ * Protego product ids
+ */
+#define PROTEGO_SPECIAL_1	0xFC70	/* special/unknown device */
+#define PROTEGO_R2X0		0xFC71	/* R200-USB TRNG unit (R210, R220, and R230) */
+#define PROTEGO_SPECIAL_3	0xFC72	/* special/unknown device */
+#define PROTEGO_SPECIAL_4	0xFC73	/* special/unknown device */
+
+/*
+ * DSS-20 Sync Station for Sony Ericsson P800
+ */
+#define FTDI_DSS20_PID          0xFC82
+
+/* www.irtrans.de device */
+#define FTDI_IRTRANS_PID 0xFC60 /* Product Id */
+
+/*
+ * RM Michaelides CANview USB (http://www.rmcan.com) (FTDI_VID)
+ * CAN fieldbus interface adapter, added by port GmbH www.port.de)
+ * Ian Abbott changed the macro names for consistency.
+ */
+#define FTDI_RM_CANVIEW_PID	0xfd60	/* Product Id */
+/* www.thoughttechnology.com/ TT-USB provide with procomp use ftdi_sio */
+#define FTDI_TTUSB_PID 0xFF20 /* Product Id */
+
+#define FTDI_USBX_707_PID 0xF857	/* ADSTech IR Blaster USBX-707 (FTDI_VID) */
+
+#define FTDI_RELAIS_PID	0xFA10  /* Relais device from Rudolf Gugler */
+
+/*
+ * PCDJ use ftdi based dj-controllers. The following PID is
+ * for their DAC-2 device http://www.pcdjhardware.com/DAC2.asp
+ * (the VID is the standard ftdi vid (FTDI_VID), PID sent by Wouter Paesen)
+ */
+#define FTDI_PCDJ_DAC2_PID 0xFA88
+
+#define FTDI_R2000KU_TRUE_RNG	0xFB80  /* R2000KU TRUE RNG (FTDI_VID) */
+
+/*
+ * DIEBOLD BCS SE923 (FTDI_VID)
+ */
+#define DIEBOLD_BCS_SE923_PID	0xfb99
+
+/* www.crystalfontz.com devices
+ * - thanx for providing free devices for evaluation !
+ * they use the ftdi chipset for the USB interface
+ * and the vendor id is the same
+ */
+#define FTDI_XF_632_PID 0xFC08	/* 632: 16x2 Character Display */
+#define FTDI_XF_634_PID 0xFC09	/* 634: 20x4 Character Display */
+#define FTDI_XF_547_PID 0xFC0A	/* 547: Two line Display */
+#define FTDI_XF_633_PID 0xFC0B	/* 633: 16x2 Character Display with Keys */
+#define FTDI_XF_631_PID 0xFC0C	/* 631: 20x2 Character Display */
+#define FTDI_XF_635_PID 0xFC0D	/* 635: 20x4 Character Display */
+#define FTDI_XF_640_PID 0xFC0E	/* 640: Two line Display */
+#define FTDI_XF_642_PID 0xFC0F	/* 642: Two line Display */
+
+/*
+ * Video Networks Limited / Homechoice in the UK use an ftdi-based device
+ * for their 1Mb broadband internet service.  The following PID is exhibited
+ * by the usb device supplied (the VID is the standard ftdi vid (FTDI_VID)
+ */
+#define FTDI_VNHCPCUSB_D_PID 0xfe38 /* Product Id */
+
+/* AlphaMicro Components AMC-232USB01 device (FTDI_VID) */
+#define FTDI_AMC232_PID 0xFF00 /* Product Id */
+
+/*
+ * IBS elektronik product ids (FTDI_VID)
+ * Submitted by Thomas Schleusener
+ */
+#define FTDI_IBS_US485_PID	0xff38  /* IBS US485 (USB<-->RS422/485 interface) */
+#define FTDI_IBS_PICPRO_PID	0xff39  /* IBS PIC-Programmer */
+#define FTDI_IBS_PCMCIA_PID	0xff3a  /* IBS Card reader for PCMCIA SRAM-cards */
+#define FTDI_IBS_PK1_PID	0xff3b  /* IBS PK1 - Particel counter */
+#define FTDI_IBS_RS232MON_PID	0xff3c  /* IBS RS232 - Monitor */
+#define FTDI_IBS_APP70_PID	0xff3d  /* APP 70 (dust monitoring system) */
+#define FTDI_IBS_PEDO_PID	0xff3e  /* IBS PEDO-Modem (RF modem 868.35 MHz) */
+#define FTDI_IBS_PROD_PID	0xff3f  /* future device */
+/* www.canusb.com Lawicel CANUSB device (FTDI_VID) */
+#define FTDI_CANUSB_PID 0xFFA8 /* Product Id */
+
+
+
+/********************************/
+/** third-party VID/PID combos **/
+/********************************/
+
+
+
+/*
+ * Atmel STK541
+ */
+#define ATMEL_VID		0x03eb /* Vendor ID */
+#define STK541_PID		0x2109 /* Zigbee Controller */
+
+/*
+ * Blackfin gnICE JTAG
+ * http://docs.blackfin.uclinux.org/doku.php?id=hw:jtag:gnice
+ */
+#define ADI_VID 		0x0456
+#define ADI_GNICE_PID 		0xF000
+#define ADI_GNICEPLUS_PID 	0xF001
+
+/*
+ * RATOC REX-USB60F
+ */
+#define RATOC_VENDOR_ID		0x0584
+#define RATOC_PRODUCT_ID_USB60F	0xb020
+
+/*
+ * Definitions for B&B Electronics products.
+ */
+#define BANDB_VID		0x0856	/* B&B Electronics Vendor ID */
+#define BANDB_USOTL4_PID	0xAC01	/* USOTL4 Isolated RS-485 Converter */
+#define BANDB_USTL4_PID		0xAC02	/* USTL4 RS-485 Converter */
+#define BANDB_USO9ML2_PID	0xAC03	/* USO9ML2 Isolated RS-232 Converter */
+#define BANDB_USOPTL4_PID	0xAC11
+#define BANDB_USPTL4_PID	0xAC12
+#define BANDB_USO9ML2DR_2_PID	0xAC16
+#define BANDB_USO9ML2DR_PID	0xAC17
+#define BANDB_USOPTL4DR2_PID	0xAC18	/* USOPTL4R-2 2-port Isolated RS-232 Converter */
+#define BANDB_USOPTL4DR_PID	0xAC19
+#define BANDB_485USB9F_2W_PID	0xAC25
+#define BANDB_485USB9F_4W_PID	0xAC26
+#define BANDB_232USB9M_PID	0xAC27
+#define BANDB_485USBTB_2W_PID	0xAC33
+#define BANDB_485USBTB_4W_PID	0xAC34
+#define BANDB_TTL5USB9M_PID	0xAC49
+#define BANDB_TTL3USB9M_PID	0xAC50
+#define BANDB_ZZ_PROG1_USB_PID	0xBA02
+
+/*
+ * Intrepid Control Systems (http://www.intrepidcs.com/) ValueCAN and NeoVI
+ */
+#define INTREPID_VID		0x093C
+#define INTREPID_VALUECAN_PID	0x0601
+#define INTREPID_NEOVI_PID	0x0701
+
+/*
+ * Definitions for ID TECH (www.idt-net.com) devices
+ */
+#define IDTECH_VID		0x0ACD	/* ID TECH Vendor ID */
+#define IDTECH_IDT1221U_PID	0x0300	/* IDT1221U USB to RS-232 adapter */
+
+/*
+ * Definitions for Omnidirectional Control Technology, Inc. devices
+ */
+#define OCT_VID			0x0B39	/* OCT vendor ID */
+/* Note: OCT US101 is also rebadged as Dick Smith Electronics (NZ) XH6381 */
+/* Also rebadged as Dick Smith Electronics (Aus) XH6451 */
+/* Also rebadged as SIIG Inc. model US2308 hardware version 1 */
+#define OCT_US101_PID		0x0421	/* OCT US101 USB to RS-232 */
+
+/*
+ * Icom ID-1 digital transceiver
+ */
+
+#define ICOM_ID1_VID            0x0C26
+#define ICOM_ID1_PID            0x0004
+
+/*
+ * GN Otometrics (http://www.otometrics.com)
+ * Submitted by Ville Sundberg.
+ */
+#define GN_OTOMETRICS_VID	0x0c33	/* Vendor ID */
+#define AURICAL_USB_PID		0x0010	/* Aurical USB Audiometer */
+
+/*
+ * The following are the values for the Sealevel SeaLINK+ adapters.
+ * (Original list sent by Tuan Hoang.  Ian Abbott renamed the macros and
+ * removed some PIDs that don't seem to match any existing products.)
+ */
+#define SEALEVEL_VID		0x0c52	/* Sealevel Vendor ID */
+#define SEALEVEL_2101_PID	0x2101	/* SeaLINK+232 (2101/2105) */
+#define SEALEVEL_2102_PID	0x2102	/* SeaLINK+485 (2102) */
+#define SEALEVEL_2103_PID	0x2103	/* SeaLINK+232I (2103) */
+#define SEALEVEL_2104_PID	0x2104	/* SeaLINK+485I (2104) */
+#define SEALEVEL_2106_PID	0x9020	/* SeaLINK+422 (2106) */
+#define SEALEVEL_2201_1_PID	0x2211	/* SeaPORT+2/232 (2201) Port 1 */
+#define SEALEVEL_2201_2_PID	0x2221	/* SeaPORT+2/232 (2201) Port 2 */
+#define SEALEVEL_2202_1_PID	0x2212	/* SeaPORT+2/485 (2202) Port 1 */
+#define SEALEVEL_2202_2_PID	0x2222	/* SeaPORT+2/485 (2202) Port 2 */
+#define SEALEVEL_2203_1_PID	0x2213	/* SeaPORT+2 (2203) Port 1 */
+#define SEALEVEL_2203_2_PID	0x2223	/* SeaPORT+2 (2203) Port 2 */
+#define SEALEVEL_2401_1_PID	0x2411	/* SeaPORT+4/232 (2401) Port 1 */
+#define SEALEVEL_2401_2_PID	0x2421	/* SeaPORT+4/232 (2401) Port 2 */
+#define SEALEVEL_2401_3_PID	0x2431	/* SeaPORT+4/232 (2401) Port 3 */
+#define SEALEVEL_2401_4_PID	0x2441	/* SeaPORT+4/232 (2401) Port 4 */
+#define SEALEVEL_2402_1_PID	0x2412	/* SeaPORT+4/485 (2402) Port 1 */
+#define SEALEVEL_2402_2_PID	0x2422	/* SeaPORT+4/485 (2402) Port 2 */
+#define SEALEVEL_2402_3_PID	0x2432	/* SeaPORT+4/485 (2402) Port 3 */
+#define SEALEVEL_2402_4_PID	0x2442	/* SeaPORT+4/485 (2402) Port 4 */
+#define SEALEVEL_2403_1_PID	0x2413	/* SeaPORT+4 (2403) Port 1 */
+#define SEALEVEL_2403_2_PID	0x2423	/* SeaPORT+4 (2403) Port 2 */
+#define SEALEVEL_2403_3_PID	0x2433	/* SeaPORT+4 (2403) Port 3 */
+#define SEALEVEL_2403_4_PID	0x2443	/* SeaPORT+4 (2403) Port 4 */
+#define SEALEVEL_2801_1_PID	0X2811	/* SeaLINK+8/232 (2801) Port 1 */
+#define SEALEVEL_2801_2_PID	0X2821	/* SeaLINK+8/232 (2801) Port 2 */
+#define SEALEVEL_2801_3_PID	0X2831	/* SeaLINK+8/232 (2801) Port 3 */
+#define SEALEVEL_2801_4_PID	0X2841	/* SeaLINK+8/232 (2801) Port 4 */
+#define SEALEVEL_2801_5_PID	0X2851	/* SeaLINK+8/232 (2801) Port 5 */
+#define SEALEVEL_2801_6_PID	0X2861	/* SeaLINK+8/232 (2801) Port 6 */
+#define SEALEVEL_2801_7_PID	0X2871	/* SeaLINK+8/232 (2801) Port 7 */
+#define SEALEVEL_2801_8_PID	0X2881	/* SeaLINK+8/232 (2801) Port 8 */
+#define SEALEVEL_2802_1_PID	0X2812	/* SeaLINK+8/485 (2802) Port 1 */
+#define SEALEVEL_2802_2_PID	0X2822	/* SeaLINK+8/485 (2802) Port 2 */
+#define SEALEVEL_2802_3_PID	0X2832	/* SeaLINK+8/485 (2802) Port 3 */
+#define SEALEVEL_2802_4_PID	0X2842	/* SeaLINK+8/485 (2802) Port 4 */
+#define SEALEVEL_2802_5_PID	0X2852	/* SeaLINK+8/485 (2802) Port 5 */
+#define SEALEVEL_2802_6_PID	0X2862	/* SeaLINK+8/485 (2802) Port 6 */
+#define SEALEVEL_2802_7_PID	0X2872	/* SeaLINK+8/485 (2802) Port 7 */
+#define SEALEVEL_2802_8_PID	0X2882	/* SeaLINK+8/485 (2802) Port 8 */
+#define SEALEVEL_2803_1_PID	0X2813	/* SeaLINK+8 (2803) Port 1 */
+#define SEALEVEL_2803_2_PID	0X2823 	/* SeaLINK+8 (2803) Port 2 */
+#define SEALEVEL_2803_3_PID	0X2833 	/* SeaLINK+8 (2803) Port 3 */
+#define SEALEVEL_2803_4_PID	0X2843 	/* SeaLINK+8 (2803) Port 4 */
+#define SEALEVEL_2803_5_PID	0X2853 	/* SeaLINK+8 (2803) Port 5 */
+#define SEALEVEL_2803_6_PID	0X2863 	/* SeaLINK+8 (2803) Port 6 */
+#define SEALEVEL_2803_7_PID	0X2873 	/* SeaLINK+8 (2803) Port 7 */
+#define SEALEVEL_2803_8_PID	0X2883 	/* SeaLINK+8 (2803) Port 8 */
+
+/*
+ * JETI SPECTROMETER SPECBOS 1201
+ * http://www.jeti.com/products/sys/scb/scb1201.php
+ */
+#define JETI_VID		0x0c6c
+#define JETI_SPC1201_PID	0x04b2
+
+/*
+ * FTDI USB UART chips used in construction projects from the
+ * Elektor Electronics magazine (http://elektor-electronics.co.uk)
+ */
+#define ELEKTOR_VID		0x0C7D
+#define ELEKTOR_FT323R_PID	0x0005	/* RFID-Reader, issue 09-2006 */
+
+/*
+ * Posiflex inc retail equipment (http://www.posiflex.com.tw)
+ */
+#define POSIFLEX_VID		0x0d3a  /* Vendor ID */
+#define POSIFLEX_PP7000_PID	0x0300  /* PP-7000II thermal printer */
+
+/*
+ * The following are the values for two KOBIL chipcard terminals.
+ */
+#define KOBIL_VID		0x0d46	/* KOBIL Vendor ID */
+#define KOBIL_CONV_B1_PID	0x2020	/* KOBIL Konverter for B1 */
+#define KOBIL_CONV_KAAN_PID	0x2021	/* KOBIL_Konverter for KAAN */
+
+#define FTDI_NF_RIC_VID	0x0DCD	/* Vendor Id */
+#define FTDI_NF_RIC_PID	0x0001	/* Product Id */
+
+/*
+ * Falcom Wireless Communications GmbH
+ */
+#define FALCOM_VID		0x0F94	/* Vendor Id */
+#define FALCOM_TWIST_PID	0x0001	/* Falcom Twist USB GPRS modem */
+#define FALCOM_SAMBA_PID	0x0005	/* Falcom Samba USB GPRS modem */
+
+/* Larsen and Brusgaard AltiTrack/USBtrack  */
+#define LARSENBRUSGAARD_VID		0x0FD8
+#define LB_ALTITRACK_PID		0x0001
+
+/*
+ * TTi (Thurlby Thandar Instruments)
+ */
+#define TTI_VID			0x103E	/* Vendor Id */
+#define TTI_QL355P_PID		0x03E8	/* TTi QL355P power supply */
+
+/* Interbiometrics USB I/O Board */
+/* Developed for Interbiometrics by Rudolf Gugler */
+#define INTERBIOMETRICS_VID              0x1209
+#define INTERBIOMETRICS_IOBOARD_PID      0x1002
+#define INTERBIOMETRICS_MINI_IOBOARD_PID 0x1006
+
+/*
+ * Testo products (http://www.testo.com/)
+ * Submitted by Colin Leroy
+ */
+#define TESTO_VID			0x128D
+#define TESTO_USB_INTERFACE_PID		0x0001
+
+/*
+ * Mobility Electronics products.
+ */
+#define MOBILITY_VID			0x1342
+#define MOBILITY_USB_SERIAL_PID		0x0202	/* EasiDock USB 200 serial */
+
+/*
+ * FIC / OpenMoko, Inc. http://wiki.openmoko.org/wiki/Neo1973_Debug_Board_v3
+ * Submitted by Harald Welte <laforge@openmoko.org>
+ */
+#define	FIC_VID			0x1457
+#define	FIC_NEO1973_DEBUG_PID	0x5118
+
+/* Olimex */
+#define OLIMEX_VID			0x15BA
+#define OLIMEX_ARM_USB_OCD_PID		0x0003
+
+/*
+ * Telldus Technologies
+ */
+#define TELLDUS_VID			0x1781	/* Vendor ID */
+#define TELLDUS_TELLSTICK_PID		0x0C30	/* RF control dongle 433 MHz using FT232RL */
+
+/*
+ * Bayer Ascensia Contour blood glucose meter USB-converter cable.
+ * http://winglucofacts.com/cables/
+ */
+#define BAYER_VID                      0x1A79
+#define BAYER_CONTOUR_CABLE_PID        0x6001
+
+/*
+ * The following are the values for the Matrix Orbital FTDI Range
+ * Anything in this range will use an FT232RL.
+ */
+#define MTXORB_VID			0x1B3D
+#define MTXORB_FTDI_RANGE_0100_PID	0x0100
+#define MTXORB_FTDI_RANGE_0101_PID	0x0101
+#define MTXORB_FTDI_RANGE_0102_PID	0x0102
+#define MTXORB_FTDI_RANGE_0103_PID	0x0103
+#define MTXORB_FTDI_RANGE_0104_PID	0x0104
+#define MTXORB_FTDI_RANGE_0105_PID	0x0105
+#define MTXORB_FTDI_RANGE_0106_PID	0x0106
+#define MTXORB_FTDI_RANGE_0107_PID	0x0107
+#define MTXORB_FTDI_RANGE_0108_PID	0x0108
+#define MTXORB_FTDI_RANGE_0109_PID	0x0109
+#define MTXORB_FTDI_RANGE_010A_PID	0x010A
+#define MTXORB_FTDI_RANGE_010B_PID	0x010B
+#define MTXORB_FTDI_RANGE_010C_PID	0x010C
+#define MTXORB_FTDI_RANGE_010D_PID	0x010D
+#define MTXORB_FTDI_RANGE_010E_PID	0x010E
+#define MTXORB_FTDI_RANGE_010F_PID	0x010F
+#define MTXORB_FTDI_RANGE_0110_PID	0x0110
+#define MTXORB_FTDI_RANGE_0111_PID	0x0111
+#define MTXORB_FTDI_RANGE_0112_PID	0x0112
+#define MTXORB_FTDI_RANGE_0113_PID	0x0113
+#define MTXORB_FTDI_RANGE_0114_PID	0x0114
+#define MTXORB_FTDI_RANGE_0115_PID	0x0115
+#define MTXORB_FTDI_RANGE_0116_PID	0x0116
+#define MTXORB_FTDI_RANGE_0117_PID	0x0117
+#define MTXORB_FTDI_RANGE_0118_PID	0x0118
+#define MTXORB_FTDI_RANGE_0119_PID	0x0119
+#define MTXORB_FTDI_RANGE_011A_PID	0x011A
+#define MTXORB_FTDI_RANGE_011B_PID	0x011B
+#define MTXORB_FTDI_RANGE_011C_PID	0x011C
+#define MTXORB_FTDI_RANGE_011D_PID	0x011D
+#define MTXORB_FTDI_RANGE_011E_PID	0x011E
+#define MTXORB_FTDI_RANGE_011F_PID	0x011F
+#define MTXORB_FTDI_RANGE_0120_PID	0x0120
+#define MTXORB_FTDI_RANGE_0121_PID	0x0121
+#define MTXORB_FTDI_RANGE_0122_PID	0x0122
+#define MTXORB_FTDI_RANGE_0123_PID	0x0123
+#define MTXORB_FTDI_RANGE_0124_PID	0x0124
+#define MTXORB_FTDI_RANGE_0125_PID	0x0125
+#define MTXORB_FTDI_RANGE_0126_PID	0x0126
+#define MTXORB_FTDI_RANGE_0127_PID	0x0127
+#define MTXORB_FTDI_RANGE_0128_PID	0x0128
+#define MTXORB_FTDI_RANGE_0129_PID	0x0129
+#define MTXORB_FTDI_RANGE_012A_PID	0x012A
+#define MTXORB_FTDI_RANGE_012B_PID	0x012B
+#define MTXORB_FTDI_RANGE_012C_PID	0x012C
+#define MTXORB_FTDI_RANGE_012D_PID	0x012D
+#define MTXORB_FTDI_RANGE_012E_PID	0x012E
+#define MTXORB_FTDI_RANGE_012F_PID	0x012F
+#define MTXORB_FTDI_RANGE_0130_PID	0x0130
+#define MTXORB_FTDI_RANGE_0131_PID	0x0131
+#define MTXORB_FTDI_RANGE_0132_PID	0x0132
+#define MTXORB_FTDI_RANGE_0133_PID	0x0133
+#define MTXORB_FTDI_RANGE_0134_PID	0x0134
+#define MTXORB_FTDI_RANGE_0135_PID	0x0135
+#define MTXORB_FTDI_RANGE_0136_PID	0x0136
+#define MTXORB_FTDI_RANGE_0137_PID	0x0137
+#define MTXORB_FTDI_RANGE_0138_PID	0x0138
+#define MTXORB_FTDI_RANGE_0139_PID	0x0139
+#define MTXORB_FTDI_RANGE_013A_PID	0x013A
+#define MTXORB_FTDI_RANGE_013B_PID	0x013B
+#define MTXORB_FTDI_RANGE_013C_PID	0x013C
+#define MTXORB_FTDI_RANGE_013D_PID	0x013D
+#define MTXORB_FTDI_RANGE_013E_PID	0x013E
+#define MTXORB_FTDI_RANGE_013F_PID	0x013F
+#define MTXORB_FTDI_RANGE_0140_PID	0x0140
+#define MTXORB_FTDI_RANGE_0141_PID	0x0141
+#define MTXORB_FTDI_RANGE_0142_PID	0x0142
+#define MTXORB_FTDI_RANGE_0143_PID	0x0143
+#define MTXORB_FTDI_RANGE_0144_PID	0x0144
+#define MTXORB_FTDI_RANGE_0145_PID	0x0145
+#define MTXORB_FTDI_RANGE_0146_PID	0x0146
+#define MTXORB_FTDI_RANGE_0147_PID	0x0147
+#define MTXORB_FTDI_RANGE_0148_PID	0x0148
+#define MTXORB_FTDI_RANGE_0149_PID	0x0149
+#define MTXORB_FTDI_RANGE_014A_PID	0x014A
+#define MTXORB_FTDI_RANGE_014B_PID	0x014B
+#define MTXORB_FTDI_RANGE_014C_PID	0x014C
+#define MTXORB_FTDI_RANGE_014D_PID	0x014D
+#define MTXORB_FTDI_RANGE_014E_PID	0x014E
+#define MTXORB_FTDI_RANGE_014F_PID	0x014F
+#define MTXORB_FTDI_RANGE_0150_PID	0x0150
+#define MTXORB_FTDI_RANGE_0151_PID	0x0151
+#define MTXORB_FTDI_RANGE_0152_PID	0x0152
+#define MTXORB_FTDI_RANGE_0153_PID	0x0153
+#define MTXORB_FTDI_RANGE_0154_PID	0x0154
+#define MTXORB_FTDI_RANGE_0155_PID	0x0155
+#define MTXORB_FTDI_RANGE_0156_PID	0x0156
+#define MTXORB_FTDI_RANGE_0157_PID	0x0157
+#define MTXORB_FTDI_RANGE_0158_PID	0x0158
+#define MTXORB_FTDI_RANGE_0159_PID	0x0159
+#define MTXORB_FTDI_RANGE_015A_PID	0x015A
+#define MTXORB_FTDI_RANGE_015B_PID	0x015B
+#define MTXORB_FTDI_RANGE_015C_PID	0x015C
+#define MTXORB_FTDI_RANGE_015D_PID	0x015D
+#define MTXORB_FTDI_RANGE_015E_PID	0x015E
+#define MTXORB_FTDI_RANGE_015F_PID	0x015F
+#define MTXORB_FTDI_RANGE_0160_PID	0x0160
+#define MTXORB_FTDI_RANGE_0161_PID	0x0161
+#define MTXORB_FTDI_RANGE_0162_PID	0x0162
+#define MTXORB_FTDI_RANGE_0163_PID	0x0163
+#define MTXORB_FTDI_RANGE_0164_PID	0x0164
+#define MTXORB_FTDI_RANGE_0165_PID	0x0165
+#define MTXORB_FTDI_RANGE_0166_PID	0x0166
+#define MTXORB_FTDI_RANGE_0167_PID	0x0167
+#define MTXORB_FTDI_RANGE_0168_PID	0x0168
+#define MTXORB_FTDI_RANGE_0169_PID	0x0169
+#define MTXORB_FTDI_RANGE_016A_PID	0x016A
+#define MTXORB_FTDI_RANGE_016B_PID	0x016B
+#define MTXORB_FTDI_RANGE_016C_PID	0x016C
+#define MTXORB_FTDI_RANGE_016D_PID	0x016D
+#define MTXORB_FTDI_RANGE_016E_PID	0x016E
+#define MTXORB_FTDI_RANGE_016F_PID	0x016F
+#define MTXORB_FTDI_RANGE_0170_PID	0x0170
+#define MTXORB_FTDI_RANGE_0171_PID	0x0171
+#define MTXORB_FTDI_RANGE_0172_PID	0x0172
+#define MTXORB_FTDI_RANGE_0173_PID	0x0173
+#define MTXORB_FTDI_RANGE_0174_PID	0x0174
+#define MTXORB_FTDI_RANGE_0175_PID	0x0175
+#define MTXORB_FTDI_RANGE_0176_PID	0x0176
+#define MTXORB_FTDI_RANGE_0177_PID	0x0177
+#define MTXORB_FTDI_RANGE_0178_PID	0x0178
+#define MTXORB_FTDI_RANGE_0179_PID	0x0179
+#define MTXORB_FTDI_RANGE_017A_PID	0x017A
+#define MTXORB_FTDI_RANGE_017B_PID	0x017B
+#define MTXORB_FTDI_RANGE_017C_PID	0x017C
+#define MTXORB_FTDI_RANGE_017D_PID	0x017D
+#define MTXORB_FTDI_RANGE_017E_PID	0x017E
+#define MTXORB_FTDI_RANGE_017F_PID	0x017F
+#define MTXORB_FTDI_RANGE_0180_PID	0x0180
+#define MTXORB_FTDI_RANGE_0181_PID	0x0181
+#define MTXORB_FTDI_RANGE_0182_PID	0x0182
+#define MTXORB_FTDI_RANGE_0183_PID	0x0183
+#define MTXORB_FTDI_RANGE_0184_PID	0x0184
+#define MTXORB_FTDI_RANGE_0185_PID	0x0185
+#define MTXORB_FTDI_RANGE_0186_PID	0x0186
+#define MTXORB_FTDI_RANGE_0187_PID	0x0187
+#define MTXORB_FTDI_RANGE_0188_PID	0x0188
+#define MTXORB_FTDI_RANGE_0189_PID	0x0189
+#define MTXORB_FTDI_RANGE_018A_PID	0x018A
+#define MTXORB_FTDI_RANGE_018B_PID	0x018B
+#define MTXORB_FTDI_RANGE_018C_PID	0x018C
+#define MTXORB_FTDI_RANGE_018D_PID	0x018D
+#define MTXORB_FTDI_RANGE_018E_PID	0x018E
+#define MTXORB_FTDI_RANGE_018F_PID	0x018F
+#define MTXORB_FTDI_RANGE_0190_PID	0x0190
+#define MTXORB_FTDI_RANGE_0191_PID	0x0191
+#define MTXORB_FTDI_RANGE_0192_PID	0x0192
+#define MTXORB_FTDI_RANGE_0193_PID	0x0193
+#define MTXORB_FTDI_RANGE_0194_PID	0x0194
+#define MTXORB_FTDI_RANGE_0195_PID	0x0195
+#define MTXORB_FTDI_RANGE_0196_PID	0x0196
+#define MTXORB_FTDI_RANGE_0197_PID	0x0197
+#define MTXORB_FTDI_RANGE_0198_PID	0x0198
+#define MTXORB_FTDI_RANGE_0199_PID	0x0199
+#define MTXORB_FTDI_RANGE_019A_PID	0x019A
+#define MTXORB_FTDI_RANGE_019B_PID	0x019B
+#define MTXORB_FTDI_RANGE_019C_PID	0x019C
+#define MTXORB_FTDI_RANGE_019D_PID	0x019D
+#define MTXORB_FTDI_RANGE_019E_PID	0x019E
+#define MTXORB_FTDI_RANGE_019F_PID	0x019F
+#define MTXORB_FTDI_RANGE_01A0_PID	0x01A0
+#define MTXORB_FTDI_RANGE_01A1_PID	0x01A1
+#define MTXORB_FTDI_RANGE_01A2_PID	0x01A2
+#define MTXORB_FTDI_RANGE_01A3_PID	0x01A3
+#define MTXORB_FTDI_RANGE_01A4_PID	0x01A4
+#define MTXORB_FTDI_RANGE_01A5_PID	0x01A5
+#define MTXORB_FTDI_RANGE_01A6_PID	0x01A6
+#define MTXORB_FTDI_RANGE_01A7_PID	0x01A7
+#define MTXORB_FTDI_RANGE_01A8_PID	0x01A8
+#define MTXORB_FTDI_RANGE_01A9_PID	0x01A9
+#define MTXORB_FTDI_RANGE_01AA_PID	0x01AA
+#define MTXORB_FTDI_RANGE_01AB_PID	0x01AB
+#define MTXORB_FTDI_RANGE_01AC_PID	0x01AC
+#define MTXORB_FTDI_RANGE_01AD_PID	0x01AD
+#define MTXORB_FTDI_RANGE_01AE_PID	0x01AE
+#define MTXORB_FTDI_RANGE_01AF_PID	0x01AF
+#define MTXORB_FTDI_RANGE_01B0_PID	0x01B0
+#define MTXORB_FTDI_RANGE_01B1_PID	0x01B1
+#define MTXORB_FTDI_RANGE_01B2_PID	0x01B2
+#define MTXORB_FTDI_RANGE_01B3_PID	0x01B3
+#define MTXORB_FTDI_RANGE_01B4_PID	0x01B4
+#define MTXORB_FTDI_RANGE_01B5_PID	0x01B5
+#define MTXORB_FTDI_RANGE_01B6_PID	0x01B6
+#define MTXORB_FTDI_RANGE_01B7_PID	0x01B7
+#define MTXORB_FTDI_RANGE_01B8_PID	0x01B8
+#define MTXORB_FTDI_RANGE_01B9_PID	0x01B9
+#define MTXORB_FTDI_RANGE_01BA_PID	0x01BA
+#define MTXORB_FTDI_RANGE_01BB_PID	0x01BB
+#define MTXORB_FTDI_RANGE_01BC_PID	0x01BC
+#define MTXORB_FTDI_RANGE_01BD_PID	0x01BD
+#define MTXORB_FTDI_RANGE_01BE_PID	0x01BE
+#define MTXORB_FTDI_RANGE_01BF_PID	0x01BF
+#define MTXORB_FTDI_RANGE_01C0_PID	0x01C0
+#define MTXORB_FTDI_RANGE_01C1_PID	0x01C1
+#define MTXORB_FTDI_RANGE_01C2_PID	0x01C2
+#define MTXORB_FTDI_RANGE_01C3_PID	0x01C3
+#define MTXORB_FTDI_RANGE_01C4_PID	0x01C4
+#define MTXORB_FTDI_RANGE_01C5_PID	0x01C5
+#define MTXORB_FTDI_RANGE_01C6_PID	0x01C6
+#define MTXORB_FTDI_RANGE_01C7_PID	0x01C7
+#define MTXORB_FTDI_RANGE_01C8_PID	0x01C8
+#define MTXORB_FTDI_RANGE_01C9_PID	0x01C9
+#define MTXORB_FTDI_RANGE_01CA_PID	0x01CA
+#define MTXORB_FTDI_RANGE_01CB_PID	0x01CB
+#define MTXORB_FTDI_RANGE_01CC_PID	0x01CC
+#define MTXORB_FTDI_RANGE_01CD_PID	0x01CD
+#define MTXORB_FTDI_RANGE_01CE_PID	0x01CE
+#define MTXORB_FTDI_RANGE_01CF_PID	0x01CF
+#define MTXORB_FTDI_RANGE_01D0_PID	0x01D0
+#define MTXORB_FTDI_RANGE_01D1_PID	0x01D1
+#define MTXORB_FTDI_RANGE_01D2_PID	0x01D2
+#define MTXORB_FTDI_RANGE_01D3_PID	0x01D3
+#define MTXORB_FTDI_RANGE_01D4_PID	0x01D4
+#define MTXORB_FTDI_RANGE_01D5_PID	0x01D5
+#define MTXORB_FTDI_RANGE_01D6_PID	0x01D6
+#define MTXORB_FTDI_RANGE_01D7_PID	0x01D7
+#define MTXORB_FTDI_RANGE_01D8_PID	0x01D8
+#define MTXORB_FTDI_RANGE_01D9_PID	0x01D9
+#define MTXORB_FTDI_RANGE_01DA_PID	0x01DA
+#define MTXORB_FTDI_RANGE_01DB_PID	0x01DB
+#define MTXORB_FTDI_RANGE_01DC_PID	0x01DC
+#define MTXORB_FTDI_RANGE_01DD_PID	0x01DD
+#define MTXORB_FTDI_RANGE_01DE_PID	0x01DE
+#define MTXORB_FTDI_RANGE_01DF_PID	0x01DF
+#define MTXORB_FTDI_RANGE_01E0_PID	0x01E0
+#define MTXORB_FTDI_RANGE_01E1_PID	0x01E1
+#define MTXORB_FTDI_RANGE_01E2_PID	0x01E2
+#define MTXORB_FTDI_RANGE_01E3_PID	0x01E3
+#define MTXORB_FTDI_RANGE_01E4_PID	0x01E4
+#define MTXORB_FTDI_RANGE_01E5_PID	0x01E5
+#define MTXORB_FTDI_RANGE_01E6_PID	0x01E6
+#define MTXORB_FTDI_RANGE_01E7_PID	0x01E7
+#define MTXORB_FTDI_RANGE_01E8_PID	0x01E8
+#define MTXORB_FTDI_RANGE_01E9_PID	0x01E9
+#define MTXORB_FTDI_RANGE_01EA_PID	0x01EA
+#define MTXORB_FTDI_RANGE_01EB_PID	0x01EB
+#define MTXORB_FTDI_RANGE_01EC_PID	0x01EC
+#define MTXORB_FTDI_RANGE_01ED_PID	0x01ED
+#define MTXORB_FTDI_RANGE_01EE_PID	0x01EE
+#define MTXORB_FTDI_RANGE_01EF_PID	0x01EF
+#define MTXORB_FTDI_RANGE_01F0_PID	0x01F0
+#define MTXORB_FTDI_RANGE_01F1_PID	0x01F1
+#define MTXORB_FTDI_RANGE_01F2_PID	0x01F2
+#define MTXORB_FTDI_RANGE_01F3_PID	0x01F3
+#define MTXORB_FTDI_RANGE_01F4_PID	0x01F4
+#define MTXORB_FTDI_RANGE_01F5_PID	0x01F5
+#define MTXORB_FTDI_RANGE_01F6_PID	0x01F6
+#define MTXORB_FTDI_RANGE_01F7_PID	0x01F7
+#define MTXORB_FTDI_RANGE_01F8_PID	0x01F8
+#define MTXORB_FTDI_RANGE_01F9_PID	0x01F9
+#define MTXORB_FTDI_RANGE_01FA_PID	0x01FA
+#define MTXORB_FTDI_RANGE_01FB_PID	0x01FB
+#define MTXORB_FTDI_RANGE_01FC_PID	0x01FC
+#define MTXORB_FTDI_RANGE_01FD_PID	0x01FD
+#define MTXORB_FTDI_RANGE_01FE_PID	0x01FE
+#define MTXORB_FTDI_RANGE_01FF_PID	0x01FF
+
+
+
+/*
+ * The Mobility Lab (TML)
+ * Submitted by Pierre Castella
+ */
+#define TML_VID			0x1B91	/* Vendor ID */
+#define TML_USB_SERIAL_PID	0x0064	/* USB - Serial Converter */
+
+/* Alti-2 products  http://www.alti-2.com */
+#define ALTI2_VID	0x1BC9
+#define ALTI2_N3_PID	0x6001	/* Neptune 3 */
+
+/*
+ * Dresden Elektronic Sensor Terminal Board
+ */
+#define DE_VID			0x1cf1 /* Vendor ID */
+#define STB_PID			0x0001 /* Sensor Terminal Board */
+#define WHT_PID			0x0004 /* Wireless Handheld Terminal */
+
+/*
+ * Papouch products (http://www.papouch.com/)
+ * Submitted by Folkert van Heusden
+ */
+
+#define PAPOUCH_VID			0x5050	/* Vendor ID */
+#define PAPOUCH_TMU_PID			0x0400	/* TMU USB Thermometer */
+#define PAPOUCH_QUIDO4x4_PID		0x0900	/* Quido 4/4 Module */
+
+/*
+ * Marvell SheevaPlug
+ */
+#define MARVELL_VID		0x9e88
+#define MARVELL_SHEEVAPLUG_PID	0x9e8f
+
+/*
+ * Evolution Robotics products (http://www.evolution.com/).
+ * Submitted by Shawn M. Lavelle.
+ */
+#define EVOLUTION_VID		0xDEEE	/* Vendor ID */
+#define EVOLUTION_ER1_PID	0x0300	/* ER1 Control Module */
+#define EVO_8U232AM_PID	0x02FF	/* Evolution robotics RCM2 (FT232AM)*/
+#define EVO_HYBRID_PID		0x0302	/* Evolution robotics RCM4 PID (FT232BM)*/
+#define EVO_RCM4_PID		0x0303	/* Evolution robotics RCM4 PID */
diff --git a/drivers/usb/serial/generic.c b/drivers/usb/serial/generic.c
index bbe005cefcfb..83443d6306d6 100644
--- a/drivers/usb/serial/generic.c
+++ b/drivers/usb/serial/generic.c
@@ -276,7 +276,7 @@ static int usb_serial_generic_write_start(struct usb_serial_port *port)
 	if (port->write_urb_busy)
 		start_io = false;
 	else {
-		start_io = (__kfifo_len(port->write_fifo) != 0);
+		start_io = (kfifo_len(&port->write_fifo) != 0);
 		port->write_urb_busy = start_io;
 	}
 	spin_unlock_irqrestore(&port->lock, flags);
@@ -285,7 +285,7 @@ static int usb_serial_generic_write_start(struct usb_serial_port *port)
 		return 0;
 
 	data = port->write_urb->transfer_buffer;
-	count = kfifo_get(port->write_fifo, data, port->bulk_out_size);
+	count = kfifo_out_locked(&port->write_fifo, data, port->bulk_out_size, &port->lock);
 	usb_serial_debug_data(debug, &port->dev, __func__, count, data);
 
 	/* set up our urb */
@@ -345,7 +345,7 @@ int usb_serial_generic_write(struct tty_struct *tty,
 		return usb_serial_multi_urb_write(tty, port,
 						  buf, count);
 
-	count = kfifo_put(port->write_fifo, buf, count);
+	count = kfifo_in_locked(&port->write_fifo, buf, count, &port->lock);
 	result = usb_serial_generic_write_start(port);
 
 	if (result >= 0)
@@ -370,7 +370,7 @@ int usb_serial_generic_write_room(struct tty_struct *tty)
 				(serial->type->max_in_flight_urbs -
 				 port->urbs_in_flight);
 	} else if (serial->num_bulk_out)
-		room = port->write_fifo->size - __kfifo_len(port->write_fifo);
+		room = kfifo_avail(&port->write_fifo);
 	spin_unlock_irqrestore(&port->lock, flags);
 
 	dbg("%s - returns %d", __func__, room);
@@ -386,12 +386,12 @@ int usb_serial_generic_chars_in_buffer(struct tty_struct *tty)
 
 	dbg("%s - port %d", __func__, port->number);
 
-	if (serial->type->max_in_flight_urbs) {
-		spin_lock_irqsave(&port->lock, flags);
+	spin_lock_irqsave(&port->lock, flags);
+	if (serial->type->max_in_flight_urbs)
 		chars = port->tx_bytes_flight;
-		spin_unlock_irqrestore(&port->lock, flags);
-	} else if (serial->num_bulk_out)
-		chars = kfifo_len(port->write_fifo);
+	else if (serial->num_bulk_out)
+		chars = kfifo_len(&port->write_fifo);
+	spin_unlock_irqrestore(&port->lock, flags);
 
 	dbg("%s - returns %d", __func__, chars);
 	return chars;
@@ -489,6 +489,8 @@ void usb_serial_generic_write_bulk_callback(struct urb *urb)
 	dbg("%s - port %d", __func__, port->number);
 
 	if (port->serial->type->max_in_flight_urbs) {
+		kfree(urb->transfer_buffer);
+
 		spin_lock_irqsave(&port->lock, flags);
 		--port->urbs_in_flight;
 		port->tx_bytes_flight -= urb->transfer_buffer_length;
@@ -507,7 +509,7 @@ void usb_serial_generic_write_bulk_callback(struct urb *urb)
 		if (status) {
 			dbg("%s - nonzero multi-urb write bulk status "
 				"received: %d", __func__, status);
-			kfifo_reset(port->write_fifo);
+			kfifo_reset_out(&port->write_fifo);
 		} else
 			usb_serial_generic_write_start(port);
 	}
diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
index f11abf52be7d..2cfe2451ed97 100644
--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -121,8 +121,15 @@
  * moschip_id_table_combined
  */
 #define USB_VENDOR_ID_BANDB             0x0856
-#define BANDB_DEVICE_ID_USOPTL4_4       0xAC44
-#define BANDB_DEVICE_ID_USOPTL4_2       0xAC42
+#define BANDB_DEVICE_ID_USO9ML2_2	0xAC22
+#define BANDB_DEVICE_ID_USO9ML2_4	0xAC24
+#define BANDB_DEVICE_ID_US9ML2_2	0xAC29
+#define BANDB_DEVICE_ID_US9ML2_4	0xAC30
+#define BANDB_DEVICE_ID_USPTL4_2	0xAC31
+#define BANDB_DEVICE_ID_USPTL4_4	0xAC32
+#define BANDB_DEVICE_ID_USOPTL4_2	0xAC42
+#define BANDB_DEVICE_ID_USOPTL4_4	0xAC44
+#define BANDB_DEVICE_ID_USOPTL2_4	0xAC24
 
 /* This driver also supports
  * ATEN UC2324 device using Moschip MCS7840
@@ -177,8 +184,15 @@
 static struct usb_device_id moschip_port_id_table[] = {
 	{USB_DEVICE(USB_VENDOR_ID_MOSCHIP, MOSCHIP_DEVICE_ID_7840)},
 	{USB_DEVICE(USB_VENDOR_ID_MOSCHIP, MOSCHIP_DEVICE_ID_7820)},
-	{USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL4_4)},
+	{USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USO9ML2_2)},
+	{USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USO9ML2_4)},
+	{USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_US9ML2_2)},
+	{USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_US9ML2_4)},
+	{USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USPTL4_2)},
+	{USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USPTL4_4)},
 	{USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL4_2)},
+	{USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL4_4)},
+	{USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL2_4)},
 	{USB_DEVICE(USB_VENDOR_ID_ATENINTL, ATENINTL_DEVICE_ID_UC2324)},
 	{USB_DEVICE(USB_VENDOR_ID_ATENINTL, ATENINTL_DEVICE_ID_UC2322)},
 	{}			/* terminating entry */
@@ -187,8 +201,15 @@ static struct usb_device_id moschip_port_id_table[] = {
 static __devinitdata struct usb_device_id moschip_id_table_combined[] = {
 	{USB_DEVICE(USB_VENDOR_ID_MOSCHIP, MOSCHIP_DEVICE_ID_7840)},
 	{USB_DEVICE(USB_VENDOR_ID_MOSCHIP, MOSCHIP_DEVICE_ID_7820)},
-	{USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL4_4)},
+	{USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USO9ML2_2)},
+	{USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USO9ML2_4)},
+	{USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_US9ML2_2)},
+	{USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_US9ML2_4)},
+	{USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USPTL4_2)},
+	{USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USPTL4_4)},
 	{USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL4_2)},
+	{USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL4_4)},
+	{USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL2_4)},
 	{USB_DEVICE(USB_VENDOR_ID_ATENINTL, ATENINTL_DEVICE_ID_UC2324)},
 	{USB_DEVICE(USB_VENDOR_ID_ATENINTL, ATENINTL_DEVICE_ID_UC2322)},
 	{}			/* terminating entry */
diff --git a/drivers/usb/serial/opticon.c b/drivers/usb/serial/opticon.c
index 80f59b6350cb..4cdb975caa89 100644
--- a/drivers/usb/serial/opticon.c
+++ b/drivers/usb/serial/opticon.c
@@ -501,12 +501,13 @@ static int opticon_resume(struct usb_interface *intf)
 	struct usb_serial_port *port = serial->port[0];
 	int result;
 
-	mutex_lock(&port->mutex);
-	if (port->port.count)
+	mutex_lock(&port->port.mutex);
+	/* This is protected by the port mutex against close/open */
+	if (test_bit(ASYNCB_INITIALIZED, &port->port.flags))
 		result = usb_submit_urb(priv->bulk_read_urb, GFP_NOIO);
 	else
 		result = 0;
-	mutex_unlock(&port->mutex);
+	mutex_unlock(&port->port.mutex);
 	return result;
 }
 
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 0577e4b61114..6e94a6711f08 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -340,6 +340,10 @@ static int  option_resume(struct usb_serial *serial);
 #define FOUR_G_SYSTEMS_VENDOR_ID		0x1c9e
 #define FOUR_G_SYSTEMS_PRODUCT_W14		0x9603
 
+/* Haier products */
+#define HAIER_VENDOR_ID				0x201e
+#define HAIER_PRODUCT_CE100			0x2009
+
 static struct usb_device_id option_ids[] = {
 	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
 	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) },
@@ -580,12 +584,48 @@ static struct usb_device_id option_ids[] = {
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0086, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2002, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2003, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0104, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0106, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0108, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0113, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0117, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0118, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0121, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0122, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0123, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0124, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0125, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0126, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0128, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0142, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0143, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0144, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0145, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0146, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0147, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0148, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0149, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0150, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0151, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0152, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0153, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0154, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0155, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0156, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0157, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0158, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0159, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0160, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0161, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0162, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0014, 0xff, 0xff, 0xff) }, /* ZTE CDMA products */
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0027, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0059, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0060, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0070, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0073, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0130, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0141, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC8710, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) },
@@ -599,11 +639,13 @@ static struct usb_device_id option_ids[] = {
 	{ USB_DEVICE(TOSHIBA_VENDOR_ID, TOSHIBA_PRODUCT_G450) },
 	{ USB_DEVICE(TOSHIBA_VENDOR_ID, TOSHIBA_PRODUCT_HSDPA_MINICARD ) }, /* Toshiba 3G HSDPA == Novatel Expedite EU870D MiniCard */
 	{ USB_DEVICE(ALINK_VENDOR_ID, 0x9000) },
+	{ USB_DEVICE(ALINK_VENDOR_ID, 0xce16) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ALINK_VENDOR_ID, ALINK_PRODUCT_3GU, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S) },
 	{ USB_DEVICE(AIRPLUS_VENDOR_ID, AIRPLUS_PRODUCT_MCD650) },
 	{ USB_DEVICE(TLAYTECH_VENDOR_ID, TLAYTECH_PRODUCT_TEU800) },
 	{ USB_DEVICE(FOUR_G_SYSTEMS_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14) },
+	{ USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) },
 	{ } /* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, option_ids);
@@ -1312,7 +1354,7 @@ static int option_suspend(struct usb_serial *serial, pm_message_t message)
 
 	dbg("%s entered", __func__);
 
-	if (serial->dev->auto_pm) {
+	if (message.event & PM_EVENT_AUTO) {
 		spin_lock_irq(&intfdata->susp_lock);
 		b = intfdata->in_flight;
 		spin_unlock_irq(&intfdata->susp_lock);
diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
index 5019325ba25d..ac1b6449fb6a 100644
--- a/drivers/usb/serial/sierra.c
+++ b/drivers/usb/serial/sierra.c
@@ -16,8 +16,9 @@
   Portions based on the option driver by Matthias Urlichs <smurf@smurf.noris.de>
   Whom based his on the Keyspan driver by Hugh Blemings <hugh@blemings.org>
 */
-
-#define DRIVER_VERSION "v.1.3.8"
+/* Uncomment to log function calls */
+/* #define DEBUG */
+#define DRIVER_VERSION "v.1.7.16"
 #define DRIVER_AUTHOR "Kevin Lloyd, Elina Pasheva, Matthew Safar, Rory Filer"
 #define DRIVER_DESC "USB Driver for Sierra Wireless USB modems"
 
@@ -33,8 +34,10 @@
 #define SWIMS_USB_REQUEST_SetPower	0x00
 #define SWIMS_USB_REQUEST_SetNmea	0x07
 
-#define N_IN_URB	8
-#define N_OUT_URB	64
+#define N_IN_URB_HM	8
+#define N_OUT_URB_HM	64
+#define N_IN_URB	4
+#define N_OUT_URB	4
 #define IN_BUFLEN	4096
 
 #define MAX_TRANSFER		(PAGE_SIZE - 512)
@@ -124,6 +127,23 @@ static int is_blacklisted(const u8 ifnum,
 	return 0;
 }
 
+static int is_himemory(const u8 ifnum,
+				const struct sierra_iface_info *himemorylist)
+{
+	const u8  *info;
+	int i;
+
+	if (himemorylist) {
+		info = himemorylist->ifaceinfo;
+
+		for (i=0; i < himemorylist->infolen; i++) {
+			if (info[i] == ifnum)
+				return 1;
+		}
+	}
+	return 0;
+}
+
 static int sierra_calc_interface(struct usb_serial *serial)
 {
 	int interface;
@@ -186,6 +206,20 @@ static int sierra_probe(struct usb_serial *serial,
 	return result;
 }
 
+/* interfaces with higher memory requirements */
+static const u8 hi_memory_typeA_ifaces[] = { 0, 2 };
+static const struct sierra_iface_info typeA_interface_list = {
+	.infolen = ARRAY_SIZE(hi_memory_typeA_ifaces),
+	.ifaceinfo = hi_memory_typeA_ifaces,
+};
+
+static const u8 hi_memory_typeB_ifaces[] = { 3, 4, 5, 6 };
+static const struct sierra_iface_info typeB_interface_list = {
+	.infolen = ARRAY_SIZE(hi_memory_typeB_ifaces),
+	.ifaceinfo = hi_memory_typeB_ifaces,
+};
+
+/* 'blacklist' of interfaces not served by this driver */
 static const u8 direct_ip_non_serial_ifaces[] = { 7, 8, 9, 10, 11 };
 static const struct sierra_iface_info direct_ip_interface_blacklist = {
 	.infolen = ARRAY_SIZE(direct_ip_non_serial_ifaces),
@@ -286,8 +320,10 @@ struct sierra_port_private {
 	struct usb_anchor active;
 	struct usb_anchor delayed;
 
+	int num_out_urbs;
+	int num_in_urbs;
 	/* Input endpoints and buffers for this port */
-	struct urb *in_urbs[N_IN_URB];
+	struct urb *in_urbs[N_IN_URB_HM];
 
 	/* Settings for the port */
 	int rts_state;	/* Handshaking pins (outputs) */
@@ -460,7 +496,7 @@ static int sierra_write(struct tty_struct *tty, struct usb_serial_port *port,
 	spin_lock_irqsave(&portdata->lock, flags);
 	dev_dbg(&port->dev, "%s - outstanding_urbs: %d\n", __func__,
 		portdata->outstanding_urbs);
-	if (portdata->outstanding_urbs > N_OUT_URB) {
+	if (portdata->outstanding_urbs > portdata->num_out_urbs) {
 		spin_unlock_irqrestore(&portdata->lock, flags);
 		dev_dbg(&port->dev, "%s - write limit hit\n", __func__);
 		return 0;
@@ -665,7 +701,7 @@ static int sierra_write_room(struct tty_struct *tty)
 	/* try to give a good number back based on if we have any free urbs at
 	 * this point in time */
 	spin_lock_irqsave(&portdata->lock, flags);
-	if (portdata->outstanding_urbs > N_OUT_URB * 2 / 3) {
+	if (portdata->outstanding_urbs > (portdata->num_out_urbs * 2) / 3) {
 		spin_unlock_irqrestore(&portdata->lock, flags);
 		dev_dbg(&port->dev, "%s - write limit hit\n", __func__);
 		return 0;
@@ -680,7 +716,7 @@ static void sierra_stop_rx_urbs(struct usb_serial_port *port)
 	int i;
 	struct sierra_port_private *portdata = usb_get_serial_port_data(port);
 
-	for (i = 0; i < ARRAY_SIZE(portdata->in_urbs); i++)
+	for (i = 0; i < portdata->num_in_urbs; i++)
 		usb_kill_urb(portdata->in_urbs[i]);
 
 	usb_kill_urb(port->interrupt_in_urb);
@@ -695,7 +731,7 @@ static int sierra_submit_rx_urbs(struct usb_serial_port *port, gfp_t mem_flags)
 	struct sierra_port_private *portdata = usb_get_serial_port_data(port);
 
 	ok_cnt = 0;
-	for (i = 0; i < ARRAY_SIZE(portdata->in_urbs); i++) {
+	for (i = 0; i < portdata->num_in_urbs; i++) {
 		urb = portdata->in_urbs[i];
 		if (!urb)
 			continue;
@@ -791,7 +827,7 @@ static void sierra_close(struct usb_serial_port *port)
 		/* Stop reading urbs */
 		sierra_stop_rx_urbs(port);
 		/* .. and release them */
-		for (i = 0; i < N_IN_URB; i++) {
+		for (i = 0; i < portdata->num_in_urbs; i++) {
 			sierra_release_urb(portdata->in_urbs[i]);
 			portdata->in_urbs[i] = NULL;
 		}
@@ -818,7 +854,7 @@ static int sierra_open(struct tty_struct *tty, struct usb_serial_port *port)
 
 
 	endpoint = port->bulk_in_endpointAddress;
-	for (i = 0; i < ARRAY_SIZE(portdata->in_urbs); i++) {
+	for (i = 0; i < portdata->num_in_urbs; i++) {
 		urb = sierra_setup_urb(serial, endpoint, USB_DIR_IN, port,
 					IN_BUFLEN, GFP_KERNEL,
 					sierra_indat_callback);
@@ -869,7 +905,9 @@ static int sierra_startup(struct usb_serial *serial)
 {
 	struct usb_serial_port *port;
 	struct sierra_port_private *portdata;
+	struct sierra_iface_info *himemoryp = NULL;
 	int i;
+	u8 ifnum;
 
 	dev_dbg(&serial->dev->dev, "%s\n", __func__);
 
@@ -886,13 +924,40 @@ static int sierra_startup(struct usb_serial *serial)
 		portdata = kzalloc(sizeof(*portdata), GFP_KERNEL);
 		if (!portdata) {
 			dev_dbg(&port->dev, "%s: kmalloc for "
-				"sierra_port_private (%d) failed!.\n",
+				"sierra_port_private (%d) failed!\n",
 				__func__, i);
 			return -ENOMEM;
 		}
 		spin_lock_init(&portdata->lock);
 		init_usb_anchor(&portdata->active);
 		init_usb_anchor(&portdata->delayed);
+		ifnum = i;
+		/* Assume low memory requirements */
+		portdata->num_out_urbs = N_OUT_URB;
+		portdata->num_in_urbs  = N_IN_URB;
+
+		/* Determine actual memory requirements */
+		if (serial->num_ports == 1) {
+			/* Get interface number for composite device */
+			ifnum = sierra_calc_interface(serial);
+			himemoryp =
+			    (struct sierra_iface_info *)&typeB_interface_list;
+			if (is_himemory(ifnum, himemoryp)) {
+				portdata->num_out_urbs = N_OUT_URB_HM;
+				portdata->num_in_urbs  = N_IN_URB_HM;
+			}
+		}
+		else {
+			himemoryp =
+			    (struct sierra_iface_info *)&typeA_interface_list;
+			if (is_himemory(i, himemoryp)) {
+				portdata->num_out_urbs = N_OUT_URB_HM;
+				portdata->num_in_urbs  = N_IN_URB_HM;
+			}
+		}
+		dev_dbg(&serial->dev->dev,
+			"Memory usage (urbs) interface #%d, in=%d, out=%d\n",
+			ifnum,portdata->num_in_urbs, portdata->num_out_urbs );
 		/* Set the port private data pointer */
 		usb_set_serial_port_data(port, portdata);
 	}
@@ -940,7 +1005,7 @@ static int sierra_suspend(struct usb_serial *serial, pm_message_t message)
 	struct sierra_intf_private *intfdata;
 	int b;
 
-	if (serial->dev->auto_pm) {
+	if (message.event & PM_EVENT_AUTO) {
 		intfdata = serial->private;
 		spin_lock_irq(&intfdata->susp_lock);
 		b = intfdata->in_flight;
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index bd3fa7ff15b1..33c85f7084f8 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -247,96 +247,66 @@ static int serial_install(struct tty_driver *driver, struct tty_struct *tty)
 	return retval;
 }
 
-static int serial_open(struct tty_struct *tty, struct file *filp)
+static int serial_activate(struct tty_port *tport, struct tty_struct *tty)
 {
-	struct usb_serial_port *port = tty->driver_data;
+	struct usb_serial_port *port =
+		container_of(tport, struct usb_serial_port, port);
 	struct usb_serial *serial = port->serial;
 	int retval;
 
-	dbg("%s - port %d", __func__, port->number);
-
-	spin_lock_irq(&port->port.lock);
-	if (!tty_hung_up_p(filp))
-		++port->port.count;
-	spin_unlock_irq(&port->port.lock);
-	tty_port_tty_set(&port->port, tty);
+	mutex_lock(&serial->disc_mutex);
+	if (serial->disconnected)
+		retval = -ENODEV;
+	else
+		retval = port->serial->type->open(tty, port);
+	mutex_unlock(&serial->disc_mutex);
+	return retval;
+}
 
-	/* Do the device-specific open only if the hardware isn't
-	 * already initialized.
-	 */
-	if (!test_bit(ASYNCB_INITIALIZED, &port->port.flags)) {
-		if (mutex_lock_interruptible(&port->mutex))
-			return -ERESTARTSYS;
-		mutex_lock(&serial->disc_mutex);
-		if (serial->disconnected)
-			retval = -ENODEV;
-		else
-			retval = port->serial->type->open(tty, port);
-		mutex_unlock(&serial->disc_mutex);
-		mutex_unlock(&port->mutex);
-		if (retval)
-			return retval;
-		set_bit(ASYNCB_INITIALIZED, &port->port.flags);
-	}
+static int serial_open(struct tty_struct *tty, struct file *filp)
+{
+	struct usb_serial_port *port = tty->driver_data;
 
-	/* Now do the correct tty layer semantics */
-	retval = tty_port_block_til_ready(&port->port, tty, filp);
-	return retval;
+	dbg("%s - port %d", __func__, port->number);
+	return tty_port_open(&port->port, tty, filp);
 }
 
 /**
  * serial_down - shut down hardware
- * @port: port to shut down
+ * @tport: tty port to shut down
  *
  * Shut down a USB serial port unless it is the console.  We never
- * shut down the console hardware as it will always be in use.
+ * shut down the console hardware as it will always be in use. Serialized
+ * against activate by the tport mutex and kept to matching open/close pairs
+ * of calls by the ASYNCB_INITIALIZED flag.
  */
-static void serial_down(struct usb_serial_port *port)
+static void serial_down(struct tty_port *tport)
 {
+	struct usb_serial_port *port =
+		container_of(tport, struct usb_serial_port, port);
 	struct usb_serial_driver *drv = port->serial->type;
-
 	/*
 	 * The console is magical.  Do not hang up the console hardware
 	 * or there will be tears.
 	 */
 	if (port->console)
 		return;
-
-	/* Don't call the close method if the hardware hasn't been
-	 * initialized.
-	 */
-	if (!test_and_clear_bit(ASYNCB_INITIALIZED, &port->port.flags))
-		return;
-
-	mutex_lock(&port->mutex);
 	if (drv->close)
 		drv->close(port);
-	mutex_unlock(&port->mutex);
 }
 
 static void serial_hangup(struct tty_struct *tty)
 {
 	struct usb_serial_port *port = tty->driver_data;
-
 	dbg("%s - port %d", __func__, port->number);
-
-	serial_down(port);
 	tty_port_hangup(&port->port);
 }
 
 static void serial_close(struct tty_struct *tty, struct file *filp)
 {
 	struct usb_serial_port *port = tty->driver_data;
-
 	dbg("%s - port %d", __func__, port->number);
-
-	if (tty_hung_up_p(filp))
-		return;
-	if (tty_port_close_start(&port->port, tty, filp) == 0)
-		return;
-	serial_down(port);
-	tty_port_close_end(&port->port, tty);
-	tty_port_tty_set(&port->port, NULL);
+	tty_port_close(&port->port, tty, filp);
 }
 
 /**
@@ -625,8 +595,7 @@ static void port_release(struct device *dev)
 	usb_free_urb(port->write_urb);
 	usb_free_urb(port->interrupt_in_urb);
 	usb_free_urb(port->interrupt_out_urb);
-	if (!IS_ERR(port->write_fifo) && port->write_fifo)
-		kfifo_free(port->write_fifo);
+	kfifo_free(&port->write_fifo);
 	kfree(port->bulk_in_buffer);
 	kfree(port->bulk_out_buffer);
 	kfree(port->interrupt_in_buffer);
@@ -725,6 +694,8 @@ static void serial_dtr_rts(struct tty_port *port, int on)
 static const struct tty_port_operations serial_port_ops = {
 	.carrier_raised = serial_carrier_raised,
 	.dtr_rts = serial_dtr_rts,
+	.activate = serial_activate,
+	.shutdown = serial_down,
 };
 
 int usb_serial_probe(struct usb_interface *interface,
@@ -923,7 +894,8 @@ int usb_serial_probe(struct usb_interface *interface,
 		port->port.ops = &serial_port_ops;
 		port->serial = serial;
 		spin_lock_init(&port->lock);
-		mutex_init(&port->mutex);
+		/* Keep this for private driver use for the moment but
+		   should probably go away */
 		INIT_WORK(&port->work, usb_serial_port_work);
 		serial->port[i] = port;
 		port->dev.parent = &interface->dev;
@@ -966,9 +938,7 @@ int usb_serial_probe(struct usb_interface *interface,
 			dev_err(&interface->dev, "No free urbs available\n");
 			goto probe_error;
 		}
-		port->write_fifo = kfifo_alloc(PAGE_SIZE, GFP_KERNEL,
-			&port->lock);
-		if (IS_ERR(port->write_fifo))
+		if (kfifo_alloc(&port->write_fifo, PAGE_SIZE, GFP_KERNEL))
 			goto probe_error;
 		buffer_size = le16_to_cpu(endpoint->wMaxPacketSize);
 		port->bulk_out_size = buffer_size;
diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c
index cfa26d56ce60..e5e6df39e737 100644
--- a/drivers/usb/storage/scsiglue.c
+++ b/drivers/usb/storage/scsiglue.c
@@ -73,7 +73,8 @@
 
 static const char* host_info(struct Scsi_Host *host)
 {
-	return "SCSI emulation for USB Mass Storage devices";
+	struct us_data *us = host_to_us(host);
+	return us->scsi_name;
 }
 
 static int slave_alloc (struct scsi_device *sdev)
diff --git a/drivers/usb/storage/transport.c b/drivers/usb/storage/transport.c
index 589f6b4404f0..cc313d16d727 100644
--- a/drivers/usb/storage/transport.c
+++ b/drivers/usb/storage/transport.c
@@ -666,10 +666,11 @@ void usb_stor_invoke_transport(struct scsi_cmnd *srb, struct us_data *us)
 	 * to wait for at least one CHECK_CONDITION to determine
 	 * SANE_SENSE support
 	 */
-	if ((srb->cmnd[0] == ATA_16 || srb->cmnd[0] == ATA_12) &&
+	if (unlikely((srb->cmnd[0] == ATA_16 || srb->cmnd[0] == ATA_12) &&
 	    result == USB_STOR_TRANSPORT_GOOD &&
 	    !(us->fflags & US_FL_SANE_SENSE) &&
-	    !(srb->cmnd[2] & 0x20)) {
+	    !(us->fflags & US_FL_BAD_SENSE) &&
+	    !(srb->cmnd[2] & 0x20))) {
 		US_DEBUGP("-- SAT supported, increasing auto-sense\n");
 		us->fflags |= US_FL_SANE_SENSE;
 	}
@@ -718,6 +719,12 @@ Retry_Sense:
 		if (test_bit(US_FLIDX_TIMED_OUT, &us->dflags)) {
 			US_DEBUGP("-- auto-sense aborted\n");
 			srb->result = DID_ABORT << 16;
+
+			/* If SANE_SENSE caused this problem, disable it */
+			if (sense_size != US_SENSE_SIZE) {
+				us->fflags &= ~US_FL_SANE_SENSE;
+				us->fflags |= US_FL_BAD_SENSE;
+			}
 			goto Handle_Errors;
 		}
 
@@ -727,10 +734,11 @@ Retry_Sense:
 		 * (small) sense request. This fixes some USB GSM modems
 		 */
 		if (temp_result == USB_STOR_TRANSPORT_FAILED &&
-		    (us->fflags & US_FL_SANE_SENSE) &&
-		    sense_size != US_SENSE_SIZE) {
+				sense_size != US_SENSE_SIZE) {
 			US_DEBUGP("-- auto-sense failure, retry small sense\n");
 			sense_size = US_SENSE_SIZE;
+			us->fflags &= ~US_FL_SANE_SENSE;
+			us->fflags |= US_FL_BAD_SENSE;
 			goto Retry_Sense;
 		}
 
@@ -754,6 +762,7 @@ Retry_Sense:
 		 */
 		if (srb->sense_buffer[7] > (US_SENSE_SIZE - 8) &&
 		    !(us->fflags & US_FL_SANE_SENSE) &&
+		    !(us->fflags & US_FL_BAD_SENSE) &&
 		    (srb->sense_buffer[0] & 0x7C) == 0x70) {
 			US_DEBUGP("-- SANE_SENSE support enabled\n");
 			us->fflags |= US_FL_SANE_SENSE;
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index d4f034ebaa8a..c932f9053188 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -818,6 +818,13 @@ UNUSUAL_DEV( 0x066f, 0x8000, 0x0001, 0x0001,
 		US_SC_DEVICE, US_PR_DEVICE, NULL,
 		US_FL_FIX_CAPACITY ),
 
+/* Reported by Daniel Kukula <daniel.kuku@gmail.com> */
+UNUSUAL_DEV( 0x067b, 0x1063, 0x0100, 0x0100,
+		"Prolific Technology, Inc.",
+		"Prolific Storage Gadget",
+		US_SC_DEVICE, US_PR_DEVICE, NULL,
+		US_FL_BAD_SENSE ),
+
 /* Reported by Rogerio Brito <rbrito@ime.usp.br> */
 UNUSUAL_DEV( 0x067b, 0x2317, 0x0001, 0x001,
 		"Prolific Technology, Inc.",
@@ -1800,13 +1807,6 @@ UNUSUAL_DEV(  0x2735, 0x100b, 0x0000, 0x9999,
 		US_SC_DEVICE, US_PR_DEVICE, NULL,
 		US_FL_GO_SLOW ),
 
-/* Reported by Rohan Hart <rohan.hart17@gmail.com> */
-UNUSUAL_DEV(  0x2770, 0x915d, 0x0010, 0x0010,
-		"INTOVA",
-		"Pixtreme",
-		US_SC_DEVICE, US_PR_DEVICE, NULL,
-		US_FL_FIX_CAPACITY ),
-
 /* Reported by Frederic Marchal <frederic.marchal@wowcompany.com>
  * Mio Moov 330
  */
diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c
index 8060b85fe1a3..e9f995486ec1 100644
--- a/drivers/usb/storage/usb.c
+++ b/drivers/usb/storage/usb.c
@@ -45,6 +45,10 @@
  * 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+#ifdef CONFIG_USB_STORAGE_DEBUG
+#define DEBUG
+#endif
+
 #include <linux/sched.h>
 #include <linux/errno.h>
 #include <linux/freezer.h>
@@ -228,6 +232,7 @@ void fill_inquiry_response(struct us_data *us, unsigned char *data,
 	if (data_len<36) // You lose.
 		return;
 
+	memset(data+8, ' ', 28);
 	if(data[0]&0x20) { /* USB device currently not connected. Return
 			      peripheral qualifier 001b ("...however, the
 			      physical device is not currently connected
@@ -237,15 +242,15 @@ void fill_inquiry_response(struct us_data *us, unsigned char *data,
 			      device, it may return zeros or ASCII spaces 
 			      (20h) in those fields until the data is
 			      available from the device."). */
-		memset(data+8,0,28);
 	} else {
 		u16 bcdDevice = le16_to_cpu(us->pusb_dev->descriptor.bcdDevice);
-		memcpy(data+8, us->unusual_dev->vendorName, 
-			strlen(us->unusual_dev->vendorName) > 8 ? 8 :
-			strlen(us->unusual_dev->vendorName));
-		memcpy(data+16, us->unusual_dev->productName, 
-			strlen(us->unusual_dev->productName) > 16 ? 16 :
-			strlen(us->unusual_dev->productName));
+		int n;
+
+		n = strlen(us->unusual_dev->vendorName);
+		memcpy(data+8, us->unusual_dev->vendorName, min(8, n));
+		n = strlen(us->unusual_dev->productName);
+		memcpy(data+16, us->unusual_dev->productName, min(16, n));
+
 		data[32] = 0x30 + ((bcdDevice>>12) & 0x0F);
 		data[33] = 0x30 + ((bcdDevice>>8) & 0x0F);
 		data[34] = 0x30 + ((bcdDevice>>4) & 0x0F);
@@ -429,7 +434,8 @@ static void adjust_quirks(struct us_data *us)
 	u16 vid = le16_to_cpu(us->pusb_dev->descriptor.idVendor);
 	u16 pid = le16_to_cpu(us->pusb_dev->descriptor.idProduct);
 	unsigned f = 0;
-	unsigned int mask = (US_FL_SANE_SENSE | US_FL_FIX_CAPACITY |
+	unsigned int mask = (US_FL_SANE_SENSE | US_FL_BAD_SENSE |
+			US_FL_FIX_CAPACITY |
 			US_FL_CAPACITY_HEURISTICS | US_FL_IGNORE_DEVICE |
 			US_FL_NOT_LOCKABLE | US_FL_MAX_SECTORS_64 |
 			US_FL_CAPACITY_OK | US_FL_IGNORE_RESIDUE |
@@ -459,6 +465,9 @@ static void adjust_quirks(struct us_data *us)
 		case 'a':
 			f |= US_FL_SANE_SENSE;
 			break;
+		case 'b':
+			f |= US_FL_BAD_SENSE;
+			break;
 		case 'c':
 			f |= US_FL_FIX_CAPACITY;
 			break;
@@ -808,14 +817,13 @@ static int usb_stor_scan_thread(void * __us)
 {
 	struct us_data *us = (struct us_data *)__us;
 
-	printk(KERN_DEBUG
-		"usb-storage: device found at %d\n", us->pusb_dev->devnum);
+	dev_dbg(&us->pusb_intf->dev, "device found\n");
 
 	set_freezable();
 	/* Wait for the timeout to expire or for a disconnect */
 	if (delay_use > 0) {
-		printk(KERN_DEBUG "usb-storage: waiting for device "
-				"to settle before scanning\n");
+		dev_dbg(&us->pusb_intf->dev, "waiting for device to settle "
+				"before scanning\n");
 		wait_event_freezable_timeout(us->delay_wait,
 				test_bit(US_FLIDX_DONT_SCAN, &us->dflags),
 				delay_use * HZ);
@@ -832,7 +840,7 @@ static int usb_stor_scan_thread(void * __us)
 			mutex_unlock(&us->dev_mutex);
 		}
 		scsi_scan_host(us_to_host(us));
-		printk(KERN_DEBUG "usb-storage: device scan complete\n");
+		dev_dbg(&us->pusb_intf->dev, "scan complete\n");
 
 		/* Should we unbind if no devices were detected? */
 	}
@@ -840,6 +848,15 @@ static int usb_stor_scan_thread(void * __us)
 	complete_and_exit(&us->scanning_done, 0);
 }
 
+static unsigned int usb_stor_sg_tablesize(struct usb_interface *intf)
+{
+	struct usb_device *usb_dev = interface_to_usbdev(intf);
+
+	if (usb_dev->bus->sg_tablesize) {
+		return usb_dev->bus->sg_tablesize;
+	}
+	return SG_ALL;
+}
 
 /* First part of general USB mass-storage probing */
 int usb_stor_probe1(struct us_data **pus,
@@ -868,6 +885,7 @@ int usb_stor_probe1(struct us_data **pus,
 	 * Allow 16-byte CDBs and thus > 2TB
 	 */
 	host->max_cmd_len = 16;
+	host->sg_tablesize = usb_stor_sg_tablesize(intf);
 	*pus = us = host_to_us(host);
 	memset(us, 0, sizeof(struct us_data));
 	mutex_init(&(us->dev_mutex));
@@ -929,6 +947,8 @@ int usb_stor_probe2(struct us_data *us)
 	result = usb_stor_acquire_resources(us);
 	if (result)
 		goto BadDevice;
+	snprintf(us->scsi_name, sizeof(us->scsi_name), "usb-storage %s",
+					dev_name(&us->pusb_intf->dev));
 	result = scsi_add_host(us_to_host(us), &us->pusb_intf->dev);
 	if (result) {
 		printk(KERN_WARNING USB_STORAGE
diff --git a/drivers/usb/storage/usb.h b/drivers/usb/storage/usb.h
index 2609efb2bd7e..69717134231b 100644
--- a/drivers/usb/storage/usb.h
+++ b/drivers/usb/storage/usb.h
@@ -132,6 +132,7 @@ struct us_data {
 	/* SCSI interfaces */
 	struct scsi_cmnd	*srb;		 /* current srb		*/
 	unsigned int		tag;		 /* current dCBWTag	*/
+	char			scsi_name[32];	 /* scsi_host name	*/
 
 	/* control and bulk communications data */
 	struct urb		*current_urb;	 /* USB requests	 */
diff --git a/drivers/usb/usb-skeleton.c b/drivers/usb/usb-skeleton.c
index b62f2bc064f6..b1e579c5c97c 100644
--- a/drivers/usb/usb-skeleton.c
+++ b/drivers/usb/usb-skeleton.c
@@ -358,7 +358,7 @@ retry:
 		rv = skel_do_read_io(dev, count);
 		if (rv < 0)
 			goto exit;
-		else if (!file->f_flags & O_NONBLOCK)
+		else if (!(file->f_flags & O_NONBLOCK))
 			goto retry;
 		rv = -EAGAIN;
 	}
@@ -411,7 +411,7 @@ static ssize_t skel_write(struct file *file, const char *user_buffer,
 	 * limit the number of URBs in flight to stop a user from using up all
 	 * RAM
 	 */
-	if (!file->f_flags & O_NONBLOCK) {
+	if (!(file->f_flags & O_NONBLOCK)) {
 		if (down_interruptible(&dev->limit_sem)) {
 			retval = -ERESTARTSYS;
 			goto exit;
diff --git a/drivers/usb/wusbcore/crypto.c b/drivers/usb/wusbcore/crypto.c
index 9ec7fd5da489..9579cf4c38bf 100644
--- a/drivers/usb/wusbcore/crypto.c
+++ b/drivers/usb/wusbcore/crypto.c
@@ -111,7 +111,7 @@ struct aes_ccm_b1 {
  *
  * CCM uses Ax blocks to generate a keystream with which the MIC and
  * the message's payload are encoded. A0 always encrypts/decrypts the
- * MIC. Ax (x>0) are used for the sucesive payload blocks.
+ * MIC. Ax (x>0) are used for the successive payload blocks.
  *
  * The x is the counter, and is increased for each block.
  */
diff --git a/drivers/usb/wusbcore/devconnect.c b/drivers/usb/wusbcore/devconnect.c
index 4ac4300a3f9a..dced419f7aba 100644
--- a/drivers/usb/wusbcore/devconnect.c
+++ b/drivers/usb/wusbcore/devconnect.c
@@ -119,10 +119,12 @@ static struct wusb_dev *wusb_dev_alloc(struct wusbhc *wusbhc)
 	urb = usb_alloc_urb(0, GFP_KERNEL);
 	if (urb == NULL)
 		goto err;
+	wusb_dev->set_gtk_urb = urb;
 
-	req = kmalloc(sizeof(struct usb_ctrlrequest), GFP_KERNEL);
+	req = kmalloc(sizeof(*req), GFP_KERNEL);
 	if (req == NULL)
 		goto err;
+	wusb_dev->set_gtk_req = req;
 
 	req->bRequestType = USB_DIR_OUT | USB_TYPE_STANDARD | USB_RECIP_DEVICE;
 	req->bRequest = USB_REQ_SET_DESCRIPTOR;
@@ -130,9 +132,6 @@ static struct wusb_dev *wusb_dev_alloc(struct wusbhc *wusbhc)
 	req->wIndex = 0;
 	req->wLength = cpu_to_le16(wusbhc->gtk.descr.bLength);
 
-	wusb_dev->set_gtk_urb = urb;
-	wusb_dev->set_gtk_req = req;
-
 	return wusb_dev;
 err:
 	wusb_dev_free(wusb_dev);
diff --git a/drivers/usb/wusbcore/security.c b/drivers/usb/wusbcore/security.c
index 4516c36436e6..edcd2d756037 100644
--- a/drivers/usb/wusbcore/security.c
+++ b/drivers/usb/wusbcore/security.c
@@ -205,15 +205,15 @@ int wusb_dev_sec_add(struct wusbhc *wusbhc,
 	const void *itr, *top;
 	char buf[64];
 
-	secd = kmalloc(sizeof(struct usb_security_descriptor), GFP_KERNEL);
+	secd = kmalloc(sizeof(*secd), GFP_KERNEL);
 	if (secd == NULL) {
 		result = -ENOMEM;
 		goto out;
 	}
 
 	result = usb_get_descriptor(usb_dev, USB_DT_SECURITY,
-				    0, secd, sizeof(struct usb_security_descriptor));
-	if (result < sizeof(secd)) {
+				    0, secd, sizeof(*secd));
+	if (result < sizeof(*secd)) {
 		dev_err(dev, "Can't read security descriptor or "
 			"not enough data: %d\n", result);
 		goto out;
diff --git a/drivers/usb/wusbcore/wa-xfer.c b/drivers/usb/wusbcore/wa-xfer.c
index 613a5fc490d3..489b47833e2c 100644
--- a/drivers/usb/wusbcore/wa-xfer.c
+++ b/drivers/usb/wusbcore/wa-xfer.c
@@ -558,7 +558,7 @@ static void wa_seg_dto_cb(struct urb *urb)
 /*
  * Callback for the segment request
  *
- * If succesful transition state (unless already transitioned or
+ * If successful transition state (unless already transitioned or
  * outbound transfer); otherwise, take a note of the error, mark this
  * segment done and try completion.
  *
@@ -1364,7 +1364,7 @@ segment_aborted:
 /*
  * Callback for the IN data phase
  *
- * If succesful transition state; otherwise, take a note of the
+ * If successful transition state; otherwise, take a note of the
  * error, mark this segment done and try completion.
  *
  * Note we don't access until we are sure that the transfer hasn't
diff --git a/drivers/usb/wusbcore/wusbhc.c b/drivers/usb/wusbcore/wusbhc.c
index ee6256f23636..eab86e4bc770 100644
--- a/drivers/usb/wusbcore/wusbhc.c
+++ b/drivers/usb/wusbcore/wusbhc.c
@@ -147,10 +147,40 @@ static ssize_t wusb_chid_store(struct device *dev,
 }
 static DEVICE_ATTR(wusb_chid, 0644, wusb_chid_show, wusb_chid_store);
 
+
+static ssize_t wusb_phy_rate_show(struct device *dev,
+				  struct device_attribute *attr,
+				  char *buf)
+{
+	struct wusbhc *wusbhc = usbhc_dev_to_wusbhc(dev);
+
+	return sprintf(buf, "%d\n", wusbhc->phy_rate);
+}
+
+static ssize_t wusb_phy_rate_store(struct device *dev,
+				   struct device_attribute *attr,
+				   const char *buf, size_t size)
+{
+	struct wusbhc *wusbhc = usbhc_dev_to_wusbhc(dev);
+	uint8_t phy_rate;
+	ssize_t result;
+
+	result = sscanf(buf, "%hhu", &phy_rate);
+	if (result != 1)
+		return -EINVAL;
+	if (phy_rate >= UWB_PHY_RATE_INVALID)
+		return -EINVAL;
+
+	wusbhc->phy_rate = phy_rate;
+	return size;
+}
+static DEVICE_ATTR(wusb_phy_rate, 0644, wusb_phy_rate_show, wusb_phy_rate_store);
+
 /* Group all the WUSBHC attributes */
 static struct attribute *wusbhc_attrs[] = {
 		&dev_attr_wusb_trust_timeout.attr,
 		&dev_attr_wusb_chid.attr,
+		&dev_attr_wusb_phy_rate.attr,
 		NULL,
 };
 
@@ -177,6 +207,8 @@ int wusbhc_create(struct wusbhc *wusbhc)
 	int result = 0;
 
 	wusbhc->trust_timeout = WUSB_TRUST_TIMEOUT_MS;
+	wusbhc->phy_rate = UWB_PHY_RATE_INVALID - 1;
+
 	mutex_init(&wusbhc->mutex);
 	result = wusbhc_mmcie_create(wusbhc);
 	if (result < 0)
diff --git a/drivers/usb/wusbcore/wusbhc.h b/drivers/usb/wusbcore/wusbhc.h
index 797c2453a35b..fd2fd4e277e1 100644
--- a/drivers/usb/wusbcore/wusbhc.h
+++ b/drivers/usb/wusbcore/wusbhc.h
@@ -253,6 +253,7 @@ struct wusbhc {
 
 	unsigned trust_timeout;			/* in jiffies */
 	struct wusb_ckhdid chid;
+	uint8_t phy_rate;
 	struct wuie_host_info *wuie_host_info;
 
 	struct mutex mutex;			/* locks everything else */
diff --git a/drivers/uwb/i1480/dfu/usb.c b/drivers/uwb/i1480/dfu/usb.c
index c7080d497311..0bb665a0c024 100644
--- a/drivers/uwb/i1480/dfu/usb.c
+++ b/drivers/uwb/i1480/dfu/usb.c
@@ -229,7 +229,7 @@ void i1480_usb_neep_cb(struct urb *urb)
  * will verify it.
  *
  * Set i1480->evt_result with the result of getting the event or its
- * size (if succesful).
+ * size (if successful).
  *
  * Delivers the data directly to i1480->evt_buf
  */
diff --git a/drivers/uwb/neh.c b/drivers/uwb/neh.c
index 0af8916d9bef..78510a1f410d 100644
--- a/drivers/uwb/neh.c
+++ b/drivers/uwb/neh.c
@@ -150,7 +150,7 @@ void uwb_rc_neh_put(struct uwb_rc_neh *neh)
  *	 0xff is invalid, so they must not be used. Initialization
  *	 fills up those two in the bitmap so they are not allocated.
  *
- * We spread the allocation around to reduce the posiblity of two
+ * We spread the allocation around to reduce the possibility of two
  * consecutive opened @neh's getting the same context ID assigned (to
  * avoid surprises with late events that timed out long time ago). So
  * first we search from where @rc->ctx_roll is, if not found, we
diff --git a/drivers/uwb/wlp/txrx.c b/drivers/uwb/wlp/txrx.c
index 86a853b84119..7350ed6909f8 100644
--- a/drivers/uwb/wlp/txrx.c
+++ b/drivers/uwb/wlp/txrx.c
@@ -282,7 +282,7 @@ EXPORT_SYMBOL_GPL(wlp_receive_frame);
  *         and transmission will be done by the calling function.
  * @dst:   On return this will contain the device address to which the
  *         frame is destined.
- * @returns: 0 on success no tx : WLP header sucessfully applied to skb buffer,
+ * @returns: 0 on success no tx : WLP header successfully applied to skb buffer,
  *                                calling function can proceed with tx
  *           1 on success with tx : WLP will take over transmission of this
  *                                  frame
diff --git a/drivers/video/Kconfig b/drivers/video/Kconfig
index 6b89eb55ed32..5a5c303a6373 100644
--- a/drivers/video/Kconfig
+++ b/drivers/video/Kconfig
@@ -614,6 +614,21 @@ config FB_BFIN_T350MCQB
 	 This display is a QVGA 320x240 24-bit RGB display interfaced by an 8-bit wide PPI
 	 It uses PPI[0..7] PPI_FS1, PPI_FS2 and PPI_CLK.
 
+config FB_BFIN_LQ035Q1
+	tristate "SHARP LQ035Q1DH02 TFT LCD"
+	depends on FB && BLACKFIN && SPI
+	select FB_CFB_FILLRECT
+	select FB_CFB_COPYAREA
+	select FB_CFB_IMAGEBLIT
+	select BFIN_GPTIMERS
+	help
+	  This is the framebuffer device driver for a SHARP LQ035Q1DH02 TFT display found on
+	  the Blackfin Landscape LCD EZ-Extender Card.
+	  This display is a QVGA 320x240 18-bit RGB display interfaced by an 16-bit wide PPI
+	  It uses PPI[0..15] PPI_FS1, PPI_FS2 and PPI_CLK.
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called bfin-lq035q1-fb.
 
 config FB_STI
 	tristate "HP STI frame buffer device support"
@@ -2066,6 +2081,7 @@ config XEN_FBDEV_FRONTEND
 	select FB_SYS_IMAGEBLIT
 	select FB_SYS_FOPS
 	select FB_DEFERRED_IO
+	select XEN_XENBUS_FRONTEND
 	default y
 	help
 	  This driver implements the front-end of the Xen virtual
@@ -2130,7 +2146,7 @@ config FB_PRE_INIT_FB
 	  the bootloader.
 
 config FB_MSM
-	tristate
+	tristate "MSM Framebuffer support"
 	depends on FB && ARCH_MSM
 	select FB_CFB_FILLRECT
 	select FB_CFB_COPYAREA
@@ -2164,6 +2180,7 @@ config FB_BROADSHEET
 	  a bridge adapter.
 
 source "drivers/video/omap/Kconfig"
+source "drivers/video/omap2/Kconfig"
 
 source "drivers/video/backlight/Kconfig"
 source "drivers/video/display/Kconfig"
diff --git a/drivers/video/Makefile b/drivers/video/Makefile
index 80232e124889..4ecb30c4f3f2 100644
--- a/drivers/video/Makefile
+++ b/drivers/video/Makefile
@@ -124,6 +124,7 @@ obj-$(CONFIG_FB_SM501)            += sm501fb.o
 obj-$(CONFIG_FB_XILINX)           += xilinxfb.o
 obj-$(CONFIG_FB_SH_MOBILE_LCDC)	  += sh_mobile_lcdcfb.o
 obj-$(CONFIG_FB_OMAP)             += omap/
+obj-y                             += omap2/
 obj-$(CONFIG_XEN_FBDEV_FRONTEND)  += xen-fbfront.o
 obj-$(CONFIG_FB_CARMINE)          += carminefb.o
 obj-$(CONFIG_FB_MB862XX)	  += mb862xx/
@@ -136,6 +137,7 @@ obj-$(CONFIG_FB_EFI)              += efifb.o
 obj-$(CONFIG_FB_VGA16)            += vga16fb.o
 obj-$(CONFIG_FB_OF)               += offb.o
 obj-$(CONFIG_FB_BF54X_LQ043)	  += bf54x-lq043fb.o
+obj-$(CONFIG_FB_BFIN_LQ035Q1)     += bfin-lq035q1-fb.o
 obj-$(CONFIG_FB_BFIN_T350MCQB)	  += bfin-t350mcqb-fb.o
 obj-$(CONFIG_FB_MX3)		  += mx3fb.o
 obj-$(CONFIG_FB_DA8XX)		  += da8xx-fb.o
diff --git a/drivers/video/atmel_lcdfb.c b/drivers/video/atmel_lcdfb.c
index d5e801076d33..3d886c6902f9 100644
--- a/drivers/video/atmel_lcdfb.c
+++ b/drivers/video/atmel_lcdfb.c
@@ -964,7 +964,7 @@ static int __init atmel_lcdfb_probe(struct platform_device *pdev)
 	if (sinfo->atmel_lcdfb_power_control)
 		sinfo->atmel_lcdfb_power_control(1);
 
-	dev_info(dev, "fb%d: Atmel LCDC at 0x%08lx (mapped at %p), irq %lu\n",
+	dev_info(dev, "fb%d: Atmel LCDC at 0x%08lx (mapped at %p), irq %d\n",
 		       info->node, info->fix.mmio_start, sinfo->mmio, sinfo->irq_base);
 
 	return 0;
diff --git a/drivers/video/aty/atyfb_base.c b/drivers/video/aty/atyfb_base.c
index 913b4a47ae52..1ddeb4c34763 100644
--- a/drivers/video/aty/atyfb_base.c
+++ b/drivers/video/aty/atyfb_base.c
@@ -3276,7 +3276,7 @@ static void __devinit aty_init_lcd(struct atyfb_par *par, u32 bios_base)
 				txtformat = "24 bit interface";
 				break;
 			default:
-				txtformat = "unkown format";
+				txtformat = "unknown format";
 			}
 		} else {
 			switch (format & 7) {
@@ -3299,7 +3299,7 @@ static void __devinit aty_init_lcd(struct atyfb_par *par, u32 bios_base)
 				txtformat = "262144 colours (FDPI-2 mode)";
 				break;
 			default:
-				txtformat = "unkown format";
+				txtformat = "unknown format";
 			}
 		}
 		PRINTKI("%s%s %s monitor detected: %s\n",
diff --git a/drivers/video/backlight/adp5520_bl.c b/drivers/video/backlight/adp5520_bl.c
index ad05da5ba3c7..86d95c228adb 100644
--- a/drivers/video/backlight/adp5520_bl.c
+++ b/drivers/video/backlight/adp5520_bl.c
@@ -15,7 +15,7 @@
 
 struct adp5520_bl {
 	struct device *master;
-	struct adp5520_backlight_platfrom_data *pdata;
+	struct adp5520_backlight_platform_data *pdata;
 	struct mutex lock;
 	unsigned long cached_daylight_max;
 	int id;
@@ -31,29 +31,30 @@ static int adp5520_bl_set(struct backlight_device *bl, int brightness)
 	if (data->pdata->en_ambl_sens) {
 		if ((brightness > 0) && (brightness < ADP5020_MAX_BRIGHTNESS)) {
 			/* Disable Ambient Light auto adjust */
-			ret |= adp5520_clr_bits(master, BL_CONTROL,
-					BL_AUTO_ADJ);
-			ret |= adp5520_write(master, DAYLIGHT_MAX, brightness);
+			ret |= adp5520_clr_bits(master, ADP5520_BL_CONTROL,
+					ADP5520_BL_AUTO_ADJ);
+			ret |= adp5520_write(master, ADP5520_DAYLIGHT_MAX,
+					brightness);
 		} else {
 			/*
 			 * MAX_BRIGHTNESS -> Enable Ambient Light auto adjust
 			 * restore daylight l3 sysfs brightness
 			 */
-			ret |= adp5520_write(master, DAYLIGHT_MAX,
+			ret |= adp5520_write(master, ADP5520_DAYLIGHT_MAX,
 					 data->cached_daylight_max);
-			ret |= adp5520_set_bits(master, BL_CONTROL,
-					 BL_AUTO_ADJ);
+			ret |= adp5520_set_bits(master, ADP5520_BL_CONTROL,
+					 ADP5520_BL_AUTO_ADJ);
 		}
 	} else {
-		ret |= adp5520_write(master, DAYLIGHT_MAX, brightness);
+		ret |= adp5520_write(master, ADP5520_DAYLIGHT_MAX, brightness);
 	}
 
 	if (data->current_brightness && brightness == 0)
 		ret |= adp5520_set_bits(master,
-				MODE_STATUS, DIM_EN);
+				ADP5520_MODE_STATUS, ADP5520_DIM_EN);
 	else if (data->current_brightness == 0 && brightness)
 		ret |= adp5520_clr_bits(master,
-				MODE_STATUS, DIM_EN);
+				ADP5520_MODE_STATUS, ADP5520_DIM_EN);
 
 	if (!ret)
 		data->current_brightness = brightness;
@@ -79,12 +80,12 @@ static int adp5520_bl_get_brightness(struct backlight_device *bl)
 	int error;
 	uint8_t reg_val;
 
-	error = adp5520_read(data->master, BL_VALUE, &reg_val);
+	error = adp5520_read(data->master, ADP5520_BL_VALUE, &reg_val);
 
 	return error ? data->current_brightness : reg_val;
 }
 
-static struct backlight_ops adp5520_bl_ops = {
+static const struct backlight_ops adp5520_bl_ops = {
 	.update_status	= adp5520_bl_update_status,
 	.get_brightness	= adp5520_bl_get_brightness,
 };
@@ -93,33 +94,46 @@ static int adp5520_bl_setup(struct backlight_device *bl)
 {
 	struct adp5520_bl *data = bl_get_data(bl);
 	struct device *master = data->master;
-	struct adp5520_backlight_platfrom_data *pdata = data->pdata;
+	struct adp5520_backlight_platform_data *pdata = data->pdata;
 	int ret = 0;
 
-	ret |= adp5520_write(master, DAYLIGHT_MAX, pdata->l1_daylight_max);
-	ret |= adp5520_write(master, DAYLIGHT_DIM, pdata->l1_daylight_dim);
+	ret |= adp5520_write(master, ADP5520_DAYLIGHT_MAX,
+				pdata->l1_daylight_max);
+	ret |= adp5520_write(master, ADP5520_DAYLIGHT_DIM,
+				pdata->l1_daylight_dim);
 
 	if (pdata->en_ambl_sens) {
 		data->cached_daylight_max = pdata->l1_daylight_max;
-		ret |= adp5520_write(master, OFFICE_MAX, pdata->l2_office_max);
-		ret |= adp5520_write(master, OFFICE_DIM, pdata->l2_office_dim);
-		ret |= adp5520_write(master, DARK_MAX, pdata->l3_dark_max);
-		ret |= adp5520_write(master, DARK_DIM, pdata->l3_dark_dim);
-		ret |= adp5520_write(master, L2_TRIP, pdata->l2_trip);
-		ret |= adp5520_write(master, L2_HYS, pdata->l2_hyst);
-		ret |= adp5520_write(master, L3_TRIP, pdata->l3_trip);
-		ret |= adp5520_write(master, L3_HYS, pdata->l3_hyst);
-		ret |= adp5520_write(master, ALS_CMPR_CFG,
-			ALS_CMPR_CFG_VAL(pdata->abml_filt, L3_EN));
+		ret |= adp5520_write(master, ADP5520_OFFICE_MAX,
+				pdata->l2_office_max);
+		ret |= adp5520_write(master, ADP5520_OFFICE_DIM,
+				pdata->l2_office_dim);
+		ret |= adp5520_write(master, ADP5520_DARK_MAX,
+				pdata->l3_dark_max);
+		ret |= adp5520_write(master, ADP5520_DARK_DIM,
+				pdata->l3_dark_dim);
+		ret |= adp5520_write(master, ADP5520_L2_TRIP,
+				pdata->l2_trip);
+		ret |= adp5520_write(master, ADP5520_L2_HYS,
+				pdata->l2_hyst);
+		ret |= adp5520_write(master, ADP5520_L3_TRIP,
+				 pdata->l3_trip);
+		ret |= adp5520_write(master, ADP5520_L3_HYS,
+				pdata->l3_hyst);
+		ret |= adp5520_write(master, ADP5520_ALS_CMPR_CFG,
+				ALS_CMPR_CFG_VAL(pdata->abml_filt,
+				ADP5520_L3_EN));
 	}
 
-	ret |= adp5520_write(master, BL_CONTROL,
-			BL_CTRL_VAL(pdata->fade_led_law, pdata->en_ambl_sens));
+	ret |= adp5520_write(master, ADP5520_BL_CONTROL,
+			BL_CTRL_VAL(pdata->fade_led_law,
+					pdata->en_ambl_sens));
 
-	ret |= adp5520_write(master, BL_FADE, FADE_VAL(pdata->fade_in,
+	ret |= adp5520_write(master, ADP5520_BL_FADE, FADE_VAL(pdata->fade_in,
 			pdata->fade_out));
 
-	ret |= adp5520_set_bits(master, MODE_STATUS, BL_EN | DIM_EN);
+	ret |= adp5520_set_bits(master, ADP5520_MODE_STATUS,
+			ADP5520_BL_EN | ADP5520_DIM_EN);
 
 	return ret;
 }
@@ -156,29 +170,31 @@ static ssize_t adp5520_store(struct device *dev, const char *buf,
 }
 
 static ssize_t adp5520_bl_dark_max_show(struct device *dev,
-		struct device_attribute *attr, char *buf)
+			struct device_attribute *attr, char *buf)
 {
-	return adp5520_show(dev, buf, DARK_MAX);
+	return adp5520_show(dev, buf, ADP5520_DARK_MAX);
 }
 
 static ssize_t adp5520_bl_dark_max_store(struct device *dev,
-		struct device_attribute *attr, const char *buf, size_t count)
+			struct device_attribute *attr,
+			const char *buf, size_t count)
 {
-	return adp5520_store(dev, buf, count, DARK_MAX);
+	return adp5520_store(dev, buf, count, ADP5520_DARK_MAX);
 }
 static DEVICE_ATTR(dark_max, 0664, adp5520_bl_dark_max_show,
 			adp5520_bl_dark_max_store);
 
 static ssize_t adp5520_bl_office_max_show(struct device *dev,
-				     struct device_attribute *attr, char *buf)
+			struct device_attribute *attr, char *buf)
 {
-	return adp5520_show(dev, buf, OFFICE_MAX);
+	return adp5520_show(dev, buf, ADP5520_OFFICE_MAX);
 }
 
 static ssize_t adp5520_bl_office_max_store(struct device *dev,
-		struct device_attribute *attr, const char *buf, size_t count)
+			struct device_attribute *attr,
+			const char *buf, size_t count)
 {
-	return adp5520_store(dev, buf, count, OFFICE_MAX);
+	return adp5520_store(dev, buf, count, ADP5520_OFFICE_MAX);
 }
 static DEVICE_ATTR(office_max, 0664, adp5520_bl_office_max_show,
 			adp5520_bl_office_max_store);
@@ -186,16 +202,17 @@ static DEVICE_ATTR(office_max, 0664, adp5520_bl_office_max_show,
 static ssize_t adp5520_bl_daylight_max_show(struct device *dev,
 			struct device_attribute *attr, char *buf)
 {
-	return adp5520_show(dev, buf, DAYLIGHT_MAX);
+	return adp5520_show(dev, buf, ADP5520_DAYLIGHT_MAX);
 }
 
 static ssize_t adp5520_bl_daylight_max_store(struct device *dev,
-		struct device_attribute *attr, const char *buf, size_t count)
+			struct device_attribute *attr,
+			const char *buf, size_t count)
 {
 	struct adp5520_bl *data = dev_get_drvdata(dev);
 
 	strict_strtoul(buf, 10, &data->cached_daylight_max);
-	return adp5520_store(dev, buf, count, DAYLIGHT_MAX);
+	return adp5520_store(dev, buf, count, ADP5520_DAYLIGHT_MAX);
 }
 static DEVICE_ATTR(daylight_max, 0664, adp5520_bl_daylight_max_show,
 			adp5520_bl_daylight_max_store);
@@ -203,14 +220,14 @@ static DEVICE_ATTR(daylight_max, 0664, adp5520_bl_daylight_max_show,
 static ssize_t adp5520_bl_dark_dim_show(struct device *dev,
 			struct device_attribute *attr, char *buf)
 {
-	return adp5520_show(dev, buf, DARK_DIM);
+	return adp5520_show(dev, buf, ADP5520_DARK_DIM);
 }
 
 static ssize_t adp5520_bl_dark_dim_store(struct device *dev,
-				     struct device_attribute *attr,
-				     const char *buf, size_t count)
+			struct device_attribute *attr,
+			const char *buf, size_t count)
 {
-	return adp5520_store(dev, buf, count, DARK_DIM);
+	return adp5520_store(dev, buf, count, ADP5520_DARK_DIM);
 }
 static DEVICE_ATTR(dark_dim, 0664, adp5520_bl_dark_dim_show,
 			adp5520_bl_dark_dim_store);
@@ -218,29 +235,29 @@ static DEVICE_ATTR(dark_dim, 0664, adp5520_bl_dark_dim_show,
 static ssize_t adp5520_bl_office_dim_show(struct device *dev,
 			struct device_attribute *attr, char *buf)
 {
-	return adp5520_show(dev, buf, OFFICE_DIM);
+	return adp5520_show(dev, buf, ADP5520_OFFICE_DIM);
 }
 
 static ssize_t adp5520_bl_office_dim_store(struct device *dev,
-				     struct device_attribute *attr,
-				     const char *buf, size_t count)
+			struct device_attribute *attr,
+			const char *buf, size_t count)
 {
-	return adp5520_store(dev, buf, count, OFFICE_DIM);
+	return adp5520_store(dev, buf, count, ADP5520_OFFICE_DIM);
 }
 static DEVICE_ATTR(office_dim, 0664, adp5520_bl_office_dim_show,
 			adp5520_bl_office_dim_store);
 
 static ssize_t adp5520_bl_daylight_dim_show(struct device *dev,
-				     struct device_attribute *attr, char *buf)
+			struct device_attribute *attr, char *buf)
 {
-	return adp5520_show(dev, buf, DAYLIGHT_DIM);
+	return adp5520_show(dev, buf, ADP5520_DAYLIGHT_DIM);
 }
 
 static ssize_t adp5520_bl_daylight_dim_store(struct device *dev,
-				     struct device_attribute *attr,
-				     const char *buf, size_t count)
+			struct device_attribute *attr,
+			const char *buf, size_t count)
 {
-	return adp5520_store(dev, buf, count, DAYLIGHT_DIM);
+	return adp5520_store(dev, buf, count, ADP5520_DAYLIGHT_DIM);
 }
 static DEVICE_ATTR(daylight_dim, 0664, adp5520_bl_daylight_dim_show,
 			adp5520_bl_daylight_dim_store);
@@ -316,7 +333,7 @@ static int __devexit adp5520_bl_remove(struct platform_device *pdev)
 	struct backlight_device *bl = platform_get_drvdata(pdev);
 	struct adp5520_bl *data = bl_get_data(bl);
 
-	adp5520_clr_bits(data->master, MODE_STATUS, BL_EN);
+	adp5520_clr_bits(data->master, ADP5520_MODE_STATUS, ADP5520_BL_EN);
 
 	if (data->pdata->en_ambl_sens)
 		sysfs_remove_group(&bl->dev.kobj,
diff --git a/drivers/video/backlight/adx_bl.c b/drivers/video/backlight/adx_bl.c
index 2c3bdfc620b7..d769b0bab21a 100644
--- a/drivers/video/backlight/adx_bl.c
+++ b/drivers/video/backlight/adx_bl.c
@@ -61,7 +61,7 @@ static int adx_backlight_check_fb(struct fb_info *fb)
 	return 1;
 }
 
-static struct backlight_ops adx_backlight_ops = {
+static const struct backlight_ops adx_backlight_ops = {
 	.options = 0,
 	.update_status = adx_backlight_update_status,
 	.get_brightness = adx_backlight_get_brightness,
diff --git a/drivers/video/backlight/atmel-pwm-bl.c b/drivers/video/backlight/atmel-pwm-bl.c
index 505c0823a105..f625ffc69ad3 100644
--- a/drivers/video/backlight/atmel-pwm-bl.c
+++ b/drivers/video/backlight/atmel-pwm-bl.c
@@ -113,7 +113,7 @@ static int atmel_pwm_bl_init_pwm(struct atmel_pwm_bl *pwmbl)
 	return pwm_channel_enable(&pwmbl->pwmc);
 }
 
-static struct backlight_ops atmel_pwm_bl_ops = {
+static const struct backlight_ops atmel_pwm_bl_ops = {
 	.get_brightness = atmel_pwm_bl_get_intensity,
 	.update_status  = atmel_pwm_bl_set_intensity,
 };
@@ -158,7 +158,7 @@ static int atmel_pwm_bl_probe(struct platform_device *pdev)
 			goto err_free_pwm;
 		}
 
-		/* Turn display off by defatult. */
+		/* Turn display off by default. */
 		retval = gpio_direction_output(pwmbl->gpio_on,
 				0 ^ pdata->on_active_low);
 		if (retval)
diff --git a/drivers/video/backlight/backlight.c b/drivers/video/backlight/backlight.c
index 6615ac7fa60a..18829cf68b1b 100644
--- a/drivers/video/backlight/backlight.c
+++ b/drivers/video/backlight/backlight.c
@@ -269,7 +269,7 @@ EXPORT_SYMBOL(backlight_force_update);
  * ERR_PTR() or a pointer to the newly allocated device.
  */
 struct backlight_device *backlight_device_register(const char *name,
-		struct device *parent, void *devdata, struct backlight_ops *ops)
+		struct device *parent, void *devdata, const struct backlight_ops *ops)
 {
 	struct backlight_device *new_bd;
 	int rc;
diff --git a/drivers/video/backlight/corgi_lcd.c b/drivers/video/backlight/corgi_lcd.c
index 96774949cd30..b4bcf8043797 100644
--- a/drivers/video/backlight/corgi_lcd.c
+++ b/drivers/video/backlight/corgi_lcd.c
@@ -451,7 +451,7 @@ void corgi_lcd_limit_intensity(int limit)
 }
 EXPORT_SYMBOL(corgi_lcd_limit_intensity);
 
-static struct backlight_ops corgi_bl_ops = {
+static const struct backlight_ops corgi_bl_ops = {
 	.get_brightness	= corgi_bl_get_intensity,
 	.update_status  = corgi_bl_update_status,
 };
diff --git a/drivers/video/backlight/cr_bllcd.c b/drivers/video/backlight/cr_bllcd.c
index b9fe62b475c6..da86db4374a0 100644
--- a/drivers/video/backlight/cr_bllcd.c
+++ b/drivers/video/backlight/cr_bllcd.c
@@ -108,7 +108,7 @@ static int cr_backlight_get_intensity(struct backlight_device *bd)
 	return intensity;
 }
 
-static struct backlight_ops cr_backlight_ops = {
+static const struct backlight_ops cr_backlight_ops = {
 	.get_brightness = cr_backlight_get_intensity,
 	.update_status = cr_backlight_set_intensity,
 };
@@ -201,7 +201,7 @@ static int cr_backlight_probe(struct platform_device *pdev)
 	if (IS_ERR(ldp)) {
 		backlight_device_unregister(bdp);
 		pci_dev_put(lpc_dev);
-		return PTR_ERR(bdp);
+		return PTR_ERR(ldp);
 	}
 
 	pci_read_config_dword(lpc_dev, CRVML_REG_GPIOBAR,
diff --git a/drivers/video/backlight/da903x_bl.c b/drivers/video/backlight/da903x_bl.c
index 7fcb0eb54c60..74cdc640173d 100644
--- a/drivers/video/backlight/da903x_bl.c
+++ b/drivers/video/backlight/da903x_bl.c
@@ -95,7 +95,7 @@ static int da903x_backlight_get_brightness(struct backlight_device *bl)
 	return data->current_brightness;
 }
 
-static struct backlight_ops da903x_backlight_ops = {
+static const struct backlight_ops da903x_backlight_ops = {
 	.update_status	= da903x_backlight_update_status,
 	.get_brightness	= da903x_backlight_get_brightness,
 };
@@ -177,7 +177,7 @@ static int da903x_backlight_resume(struct device *dev)
 	return 0;
 }
 
-static struct dev_pm_ops da903x_backlight_pm_ops = {
+static const struct dev_pm_ops da903x_backlight_pm_ops = {
 	.suspend	= da903x_backlight_suspend,
 	.resume		= da903x_backlight_resume,
 };
diff --git a/drivers/video/backlight/generic_bl.c b/drivers/video/backlight/generic_bl.c
index 6d27f62fdcd0..e6d348e63596 100644
--- a/drivers/video/backlight/generic_bl.c
+++ b/drivers/video/backlight/generic_bl.c
@@ -70,7 +70,7 @@ void corgibl_limit_intensity(int limit)
 }
 EXPORT_SYMBOL(corgibl_limit_intensity);
 
-static struct backlight_ops genericbl_ops = {
+static const struct backlight_ops genericbl_ops = {
 	.options = BL_CORE_SUSPENDRESUME,
 	.get_brightness = genericbl_get_intensity,
 	.update_status  = genericbl_send_intensity,
diff --git a/drivers/video/backlight/hp680_bl.c b/drivers/video/backlight/hp680_bl.c
index 7fb4eefff80d..f7cc528d5be7 100644
--- a/drivers/video/backlight/hp680_bl.c
+++ b/drivers/video/backlight/hp680_bl.c
@@ -98,7 +98,7 @@ static int hp680bl_get_intensity(struct backlight_device *bd)
 	return current_intensity;
 }
 
-static struct backlight_ops hp680bl_ops = {
+static const struct backlight_ops hp680bl_ops = {
 	.get_brightness = hp680bl_get_intensity,
 	.update_status  = hp680bl_set_intensity,
 };
diff --git a/drivers/video/backlight/jornada720_bl.c b/drivers/video/backlight/jornada720_bl.c
index 7aed2565c1bd..db9071fc5665 100644
--- a/drivers/video/backlight/jornada720_bl.c
+++ b/drivers/video/backlight/jornada720_bl.c
@@ -93,7 +93,7 @@ out:
 	return ret;
 }
 
-static struct backlight_ops jornada_bl_ops = {
+static const struct backlight_ops jornada_bl_ops = {
 	.get_brightness = jornada_bl_get_brightness,
 	.update_status = jornada_bl_update_status,
 	.options = BL_CORE_SUSPENDRESUME,
diff --git a/drivers/video/backlight/kb3886_bl.c b/drivers/video/backlight/kb3886_bl.c
index a38fda1742dd..939e7b830cf3 100644
--- a/drivers/video/backlight/kb3886_bl.c
+++ b/drivers/video/backlight/kb3886_bl.c
@@ -134,7 +134,7 @@ static int kb3886bl_get_intensity(struct backlight_device *bd)
 	return kb3886bl_intensity;
 }
 
-static struct backlight_ops kb3886bl_ops = {
+static const struct backlight_ops kb3886bl_ops = {
 	.get_brightness = kb3886bl_get_intensity,
 	.update_status  = kb3886bl_send_intensity,
 };
diff --git a/drivers/video/backlight/lcd.c b/drivers/video/backlight/lcd.c
index a482dd7b0311..9b3be74cee5a 100644
--- a/drivers/video/backlight/lcd.c
+++ b/drivers/video/backlight/lcd.c
@@ -101,7 +101,7 @@ static ssize_t lcd_store_power(struct device *dev,
 	int power = simple_strtoul(buf, &endp, 0);
 	size_t size = endp - buf;
 
-	if (*endp && isspace(*endp))
+	if (isspace(*endp))
 		size++;
 	if (size != count)
 		return -EINVAL;
@@ -140,7 +140,7 @@ static ssize_t lcd_store_contrast(struct device *dev,
 	int contrast = simple_strtoul(buf, &endp, 0);
 	size_t size = endp - buf;
 
-	if (*endp && isspace(*endp))
+	if (isspace(*endp))
 		size++;
 	if (size != count)
 		return -EINVAL;
diff --git a/drivers/video/backlight/locomolcd.c b/drivers/video/backlight/locomolcd.c
index 6b488b8a7eee..00a9591b0003 100644
--- a/drivers/video/backlight/locomolcd.c
+++ b/drivers/video/backlight/locomolcd.c
@@ -141,7 +141,7 @@ static int locomolcd_get_intensity(struct backlight_device *bd)
 	return current_intensity;
 }
 
-static struct backlight_ops locomobl_data = {
+static const struct backlight_ops locomobl_data = {
 	.get_brightness = locomolcd_get_intensity,
 	.update_status  = locomolcd_set_intensity,
 };
diff --git a/drivers/video/backlight/mbp_nvidia_bl.c b/drivers/video/backlight/mbp_nvidia_bl.c
index 9edb8d7c295f..2e78b0784bdc 100644
--- a/drivers/video/backlight/mbp_nvidia_bl.c
+++ b/drivers/video/backlight/mbp_nvidia_bl.c
@@ -33,7 +33,7 @@ struct dmi_match_data {
 	unsigned long iostart;
 	unsigned long iolen;
 	/* Backlight operations structure. */
-	struct backlight_ops backlight_ops;
+	const struct backlight_ops backlight_ops;
 };
 
 /* Module parameters. */
@@ -220,6 +220,24 @@ static const struct dmi_system_id __initdata mbp_device_table[] = {
 	},
 	{
 		.callback	= mbp_dmi_match,
+		.ident		= "MacBookPro 5,3",
+		.matches	= {
+			DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro5,3"),
+		},
+		.driver_data	= (void *)&nvidia_chipset_data,
+	},
+	{
+		.callback	= mbp_dmi_match,
+		.ident		= "MacBookPro 5,4",
+		.matches	= {
+			DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro5,4"),
+		},
+		.driver_data	= (void *)&nvidia_chipset_data,
+	},
+	{
+		.callback	= mbp_dmi_match,
 		.ident		= "MacBookPro 5,5",
 		.matches	= {
 			DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
diff --git a/drivers/video/backlight/omap1_bl.c b/drivers/video/backlight/omap1_bl.c
index 8693e5fcd2eb..a3a7f8938175 100644
--- a/drivers/video/backlight/omap1_bl.c
+++ b/drivers/video/backlight/omap1_bl.c
@@ -125,7 +125,7 @@ static int omapbl_get_intensity(struct backlight_device *dev)
 	return bl->current_intensity;
 }
 
-static struct backlight_ops omapbl_ops = {
+static const struct backlight_ops omapbl_ops = {
 	.get_brightness = omapbl_get_intensity,
 	.update_status  = omapbl_update_status,
 };
@@ -139,8 +139,6 @@ static int omapbl_probe(struct platform_device *pdev)
 	if (!pdata)
 		return -ENXIO;
 
-	omapbl_ops.check_fb = pdata->check_fb;
-
 	bl = kzalloc(sizeof(struct omap_backlight), GFP_KERNEL);
 	if (unlikely(!bl))
 		return -ENOMEM;
diff --git a/drivers/video/backlight/progear_bl.c b/drivers/video/backlight/progear_bl.c
index 9edaf24fd82d..075786e05034 100644
--- a/drivers/video/backlight/progear_bl.c
+++ b/drivers/video/backlight/progear_bl.c
@@ -54,7 +54,7 @@ static int progearbl_get_intensity(struct backlight_device *bd)
 	return intensity - HW_LEVEL_MIN;
 }
 
-static struct backlight_ops progearbl_ops = {
+static const struct backlight_ops progearbl_ops = {
 	.get_brightness = progearbl_get_intensity,
 	.update_status = progearbl_set_intensity,
 };
diff --git a/drivers/video/backlight/pwm_bl.c b/drivers/video/backlight/pwm_bl.c
index 887166267443..9d2ec2a1cce8 100644
--- a/drivers/video/backlight/pwm_bl.c
+++ b/drivers/video/backlight/pwm_bl.c
@@ -22,8 +22,10 @@
 
 struct pwm_bl_data {
 	struct pwm_device	*pwm;
+	struct device		*dev;
 	unsigned int		period;
-	int			(*notify)(int brightness);
+	int			(*notify)(struct device *,
+					  int brightness);
 };
 
 static int pwm_backlight_update_status(struct backlight_device *bl)
@@ -39,7 +41,7 @@ static int pwm_backlight_update_status(struct backlight_device *bl)
 		brightness = 0;
 
 	if (pb->notify)
-		brightness = pb->notify(brightness);
+		brightness = pb->notify(pb->dev, brightness);
 
 	if (brightness == 0) {
 		pwm_config(pb->pwm, 0, pb->period);
@@ -56,7 +58,7 @@ static int pwm_backlight_get_brightness(struct backlight_device *bl)
 	return bl->props.brightness;
 }
 
-static struct backlight_ops pwm_backlight_ops = {
+static const struct backlight_ops pwm_backlight_ops = {
 	.update_status	= pwm_backlight_update_status,
 	.get_brightness	= pwm_backlight_get_brightness,
 };
@@ -88,6 +90,7 @@ static int pwm_backlight_probe(struct platform_device *pdev)
 
 	pb->period = data->pwm_period_ns;
 	pb->notify = data->notify;
+	pb->dev = &pdev->dev;
 
 	pb->pwm = pwm_request(data->pwm_id, "backlight");
 	if (IS_ERR(pb->pwm)) {
@@ -146,7 +149,7 @@ static int pwm_backlight_suspend(struct platform_device *pdev,
 	struct pwm_bl_data *pb = dev_get_drvdata(&bl->dev);
 
 	if (pb->notify)
-		pb->notify(0);
+		pb->notify(pb->dev, 0);
 	pwm_config(pb->pwm, 0, pb->period);
 	pwm_disable(pb->pwm);
 	return 0;
diff --git a/drivers/video/backlight/tosa_bl.c b/drivers/video/backlight/tosa_bl.c
index 43edbada12d1..e14ce4d469f5 100644
--- a/drivers/video/backlight/tosa_bl.c
+++ b/drivers/video/backlight/tosa_bl.c
@@ -72,7 +72,7 @@ static int tosa_bl_get_brightness(struct backlight_device *dev)
 	return props->brightness;
 }
 
-static struct backlight_ops bl_ops = {
+static const struct backlight_ops bl_ops = {
 	.get_brightness		= tosa_bl_get_brightness,
 	.update_status		= tosa_bl_update_status,
 };
diff --git a/drivers/video/backlight/tosa_lcd.c b/drivers/video/backlight/tosa_lcd.c
index 50ec17dfc517..fa32b94a4546 100644
--- a/drivers/video/backlight/tosa_lcd.c
+++ b/drivers/video/backlight/tosa_lcd.c
@@ -177,7 +177,7 @@ static int __devinit tosa_lcd_probe(struct spi_device *spi)
 	if (!data)
 		return -ENOMEM;
 
-	data->is_vga = true; /* defaut to VGA mode */
+	data->is_vga = true; /* default to VGA mode */
 
 	/*
 	 * bits_per_word cannot be configured in platform data
diff --git a/drivers/video/backlight/wm831x_bl.c b/drivers/video/backlight/wm831x_bl.c
index 467bdb7efb23..e32add37a203 100644
--- a/drivers/video/backlight/wm831x_bl.c
+++ b/drivers/video/backlight/wm831x_bl.c
@@ -112,7 +112,7 @@ static int wm831x_backlight_get_brightness(struct backlight_device *bl)
 	return data->current_brightness;
 }
 
-static struct backlight_ops wm831x_backlight_ops = {
+static const struct backlight_ops wm831x_backlight_ops = {
 	.options = BL_CORE_SUSPENDRESUME,
 	.update_status	= wm831x_backlight_update_status,
 	.get_brightness	= wm831x_backlight_get_brightness,
diff --git a/drivers/video/bfin-lq035q1-fb.c b/drivers/video/bfin-lq035q1-fb.c
new file mode 100644
index 000000000000..b690c269784a
--- /dev/null
+++ b/drivers/video/bfin-lq035q1-fb.c
@@ -0,0 +1,826 @@
+/*
+ * Blackfin LCD Framebuffer driver SHARP LQ035Q1DH02
+ *
+ * Copyright 2008-2009 Analog Devices Inc.
+ * Licensed under the GPL-2 or later.
+ */
+
+#define DRIVER_NAME "bfin-lq035q1"
+#define pr_fmt(fmt) DRIVER_NAME ": " fmt
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/string.h>
+#include <linux/fb.h>
+#include <linux/init.h>
+#include <linux/types.h>
+#include <linux/interrupt.h>
+#include <linux/device.h>
+#include <linux/backlight.h>
+#include <linux/lcd.h>
+#include <linux/dma-mapping.h>
+#include <linux/platform_device.h>
+#include <linux/spi/spi.h>
+#include <linux/dma-mapping.h>
+
+#include <asm/blackfin.h>
+#include <asm/irq.h>
+#include <asm/dma.h>
+#include <asm/portmux.h>
+#include <asm/gptimers.h>
+
+#include <asm/bfin-lq035q1.h>
+
+#if defined(BF533_FAMILY) || defined(BF538_FAMILY)
+#define TIMER_HSYNC_id			TIMER1_id
+#define TIMER_HSYNCbit			TIMER1bit
+#define TIMER_HSYNC_STATUS_TRUN		TIMER_STATUS_TRUN1
+#define TIMER_HSYNC_STATUS_TIMIL	TIMER_STATUS_TIMIL1
+#define TIMER_HSYNC_STATUS_TOVF		TIMER_STATUS_TOVF1
+
+#define TIMER_VSYNC_id			TIMER2_id
+#define TIMER_VSYNCbit			TIMER2bit
+#define TIMER_VSYNC_STATUS_TRUN		TIMER_STATUS_TRUN2
+#define TIMER_VSYNC_STATUS_TIMIL	TIMER_STATUS_TIMIL2
+#define TIMER_VSYNC_STATUS_TOVF		TIMER_STATUS_TOVF2
+#else
+#define TIMER_HSYNC_id			TIMER0_id
+#define TIMER_HSYNCbit			TIMER0bit
+#define TIMER_HSYNC_STATUS_TRUN		TIMER_STATUS_TRUN0
+#define TIMER_HSYNC_STATUS_TIMIL	TIMER_STATUS_TIMIL0
+#define TIMER_HSYNC_STATUS_TOVF		TIMER_STATUS_TOVF0
+
+#define TIMER_VSYNC_id			TIMER1_id
+#define TIMER_VSYNCbit			TIMER1bit
+#define TIMER_VSYNC_STATUS_TRUN		TIMER_STATUS_TRUN1
+#define TIMER_VSYNC_STATUS_TIMIL	TIMER_STATUS_TIMIL1
+#define TIMER_VSYNC_STATUS_TOVF		TIMER_STATUS_TOVF1
+#endif
+
+#define LCD_X_RES		320	/* Horizontal Resolution */
+#define LCD_Y_RES		240	/* Vertical Resolution */
+#define	DMA_BUS_SIZE		16
+
+#define USE_RGB565_16_BIT_PPI
+
+#ifdef USE_RGB565_16_BIT_PPI
+#define LCD_BPP		16	/* Bit Per Pixel */
+#define CLOCKS_PER_PIX	1
+#define CPLD_PIPELINE_DELAY_COR 0	/* NO CPLB */
+#endif
+
+/* Interface 16/18-bit TFT over an 8-bit wide PPI using a small Programmable Logic Device (CPLD)
+ * http://blackfin.uclinux.org/gf/project/stamp/frs/?action=FrsReleaseBrowse&frs_package_id=165
+ */
+
+#ifdef USE_RGB565_8_BIT_PPI
+#define LCD_BPP		16	/* Bit Per Pixel */
+#define CLOCKS_PER_PIX	2
+#define CPLD_PIPELINE_DELAY_COR 3	/* RGB565 */
+#endif
+
+#ifdef USE_RGB888_8_BIT_PPI
+#define LCD_BPP		24	/* Bit Per Pixel */
+#define CLOCKS_PER_PIX	3
+#define CPLD_PIPELINE_DELAY_COR 5	/* RGB888 */
+#endif
+
+	/*
+	 * HS and VS timing parameters (all in number of PPI clk ticks)
+	 */
+
+#define U_LINE		4				/* Blanking Lines */
+
+#define H_ACTPIX	(LCD_X_RES * CLOCKS_PER_PIX)	/* active horizontal pixel */
+#define H_PERIOD	(336 * CLOCKS_PER_PIX)		/* HS period */
+#define H_PULSE		(2 * CLOCKS_PER_PIX)				/* HS pulse width */
+#define H_START		(7 * CLOCKS_PER_PIX + CPLD_PIPELINE_DELAY_COR)	/* first valid pixel */
+
+#define	V_LINES		(LCD_Y_RES + U_LINE)		/* total vertical lines */
+#define V_PULSE		(2 * CLOCKS_PER_PIX)		/* VS pulse width (1-5 H_PERIODs) */
+#define V_PERIOD	(H_PERIOD * V_LINES)		/* VS period */
+
+#define ACTIVE_VIDEO_MEM_OFFSET		((U_LINE / 2) * LCD_X_RES * (LCD_BPP / 8))
+
+#define BFIN_LCD_NBR_PALETTE_ENTRIES	256
+
+#define PPI_TX_MODE			0x2
+#define PPI_XFER_TYPE_11		0xC
+#define PPI_PORT_CFG_01			0x10
+#define PPI_POLS_1			0x8000
+
+#if (CLOCKS_PER_PIX > 1)
+#define PPI_PMODE (DLEN_8 | PACK_EN)
+#else
+#define PPI_PMODE (DLEN_16)
+#endif
+
+#define LQ035_INDEX			0x74
+#define LQ035_DATA			0x76
+
+#define LQ035_DRIVER_OUTPUT_CTL		0x1
+#define LQ035_SHUT_CTL			0x11
+
+#define LQ035_DRIVER_OUTPUT_MASK	(LQ035_LR | LQ035_TB | LQ035_BGR | LQ035_REV)
+#define LQ035_DRIVER_OUTPUT_DEFAULT	(0x2AEF & ~LQ035_DRIVER_OUTPUT_MASK)
+
+#define LQ035_SHUT			(1 << 0)	/* Shutdown */
+#define LQ035_ON			(0 << 0)	/* Shutdown */
+
+struct bfin_lq035q1fb_info {
+	struct fb_info *fb;
+	struct device *dev;
+	struct spi_driver spidrv;
+	struct bfin_lq035q1fb_disp_info *disp_info;
+	unsigned char *fb_buffer;	/* RGB Buffer */
+	dma_addr_t dma_handle;
+	int lq035_open_cnt;
+	int irq;
+	spinlock_t lock;	/* lock */
+	u32 pseudo_pal[16];
+};
+
+static int nocursor;
+module_param(nocursor, int, 0644);
+MODULE_PARM_DESC(nocursor, "cursor enable/disable");
+
+struct spi_control {
+	unsigned short mode;
+};
+
+static int lq035q1_control(struct spi_device *spi, unsigned char reg, unsigned short value)
+{
+	int ret;
+	u8 regs[3] = { LQ035_INDEX, 0, 0 };
+	u8 dat[3] = { LQ035_DATA, 0, 0 };
+
+	if (!spi)
+		return -ENODEV;
+
+	regs[2] = reg;
+	dat[1] = value >> 8;
+	dat[2] = value & 0xFF;
+
+	ret = spi_write(spi, regs, ARRAY_SIZE(regs));
+	ret |= spi_write(spi, dat, ARRAY_SIZE(dat));
+	return ret;
+}
+
+static int __devinit lq035q1_spidev_probe(struct spi_device *spi)
+{
+	int ret;
+	struct spi_control *ctl;
+	struct bfin_lq035q1fb_info *info = container_of(spi->dev.driver,
+						struct bfin_lq035q1fb_info,
+						spidrv.driver);
+
+	ctl = kzalloc(sizeof(*ctl), GFP_KERNEL);
+
+	if (!ctl)
+		return -ENOMEM;
+
+	ctl->mode = (info->disp_info->mode &
+		LQ035_DRIVER_OUTPUT_MASK) | LQ035_DRIVER_OUTPUT_DEFAULT;
+
+	ret = lq035q1_control(spi, LQ035_SHUT_CTL, LQ035_ON);
+	ret |= lq035q1_control(spi, LQ035_DRIVER_OUTPUT_CTL, ctl->mode);
+	if (ret)
+		return ret;
+
+	spi_set_drvdata(spi, ctl);
+
+	return 0;
+}
+
+static int lq035q1_spidev_remove(struct spi_device *spi)
+{
+	return lq035q1_control(spi, LQ035_SHUT_CTL, LQ035_SHUT);
+}
+
+#ifdef CONFIG_PM
+static int lq035q1_spidev_suspend(struct spi_device *spi, pm_message_t state)
+{
+	return lq035q1_control(spi, LQ035_SHUT_CTL, LQ035_SHUT);
+}
+
+static int lq035q1_spidev_resume(struct spi_device *spi)
+{
+	int ret;
+	struct spi_control *ctl = spi_get_drvdata(spi);
+
+	ret = lq035q1_control(spi, LQ035_DRIVER_OUTPUT_CTL, ctl->mode);
+	if (ret)
+		return ret;
+
+	return lq035q1_control(spi, LQ035_SHUT_CTL, LQ035_ON);
+}
+#else
+# define lq035q1_spidev_suspend NULL
+# define lq035q1_spidev_resume  NULL
+#endif
+
+/* Power down all displays on reboot, poweroff or halt */
+static void lq035q1_spidev_shutdown(struct spi_device *spi)
+{
+	lq035q1_control(spi, LQ035_SHUT_CTL, LQ035_SHUT);
+}
+
+static int lq035q1_backlight(struct bfin_lq035q1fb_info *info, unsigned arg)
+{
+	if (info->disp_info->use_bl)
+		gpio_set_value(info->disp_info->gpio_bl, arg);
+
+	return 0;
+}
+
+static void bfin_lq035q1_config_ppi(struct bfin_lq035q1fb_info *fbi)
+{
+	bfin_write_PPI_DELAY(H_START);
+	bfin_write_PPI_COUNT(H_ACTPIX - 1);
+	bfin_write_PPI_FRAME(V_LINES);
+
+	bfin_write_PPI_CONTROL(PPI_TX_MODE |	   /* output mode , PORT_DIR */
+				PPI_XFER_TYPE_11 | /* sync mode XFR_TYPE */
+				PPI_PORT_CFG_01 |  /* two frame sync PORT_CFG */
+				PPI_PMODE |	   /* 8/16 bit data length / PACK_EN? */
+				PPI_POLS_1);	   /* faling edge syncs POLS */
+}
+
+static inline void bfin_lq035q1_disable_ppi(void)
+{
+	bfin_write_PPI_CONTROL(bfin_read_PPI_CONTROL() & ~PORT_EN);
+}
+
+static inline void bfin_lq035q1_enable_ppi(void)
+{
+	bfin_write_PPI_CONTROL(bfin_read_PPI_CONTROL() | PORT_EN);
+}
+
+static void bfin_lq035q1_start_timers(void)
+{
+	enable_gptimers(TIMER_VSYNCbit | TIMER_HSYNCbit);
+}
+
+static void bfin_lq035q1_stop_timers(void)
+{
+	disable_gptimers(TIMER_HSYNCbit | TIMER_VSYNCbit);
+
+	set_gptimer_status(0, TIMER_HSYNC_STATUS_TRUN | TIMER_VSYNC_STATUS_TRUN |
+				TIMER_HSYNC_STATUS_TIMIL | TIMER_VSYNC_STATUS_TIMIL |
+				 TIMER_HSYNC_STATUS_TOVF | TIMER_VSYNC_STATUS_TOVF);
+
+}
+
+static void bfin_lq035q1_init_timers(void)
+{
+
+	bfin_lq035q1_stop_timers();
+
+	set_gptimer_period(TIMER_HSYNC_id, H_PERIOD);
+	set_gptimer_pwidth(TIMER_HSYNC_id, H_PULSE);
+	set_gptimer_config(TIMER_HSYNC_id, TIMER_MODE_PWM | TIMER_PERIOD_CNT |
+				      TIMER_TIN_SEL | TIMER_CLK_SEL|
+				      TIMER_EMU_RUN);
+
+	set_gptimer_period(TIMER_VSYNC_id, V_PERIOD);
+	set_gptimer_pwidth(TIMER_VSYNC_id, V_PULSE);
+	set_gptimer_config(TIMER_VSYNC_id, TIMER_MODE_PWM | TIMER_PERIOD_CNT |
+				      TIMER_TIN_SEL | TIMER_CLK_SEL |
+				      TIMER_EMU_RUN);
+
+}
+
+static void bfin_lq035q1_config_dma(struct bfin_lq035q1fb_info *fbi)
+{
+
+	set_dma_config(CH_PPI,
+		       set_bfin_dma_config(DIR_READ, DMA_FLOW_AUTO,
+					   INTR_DISABLE, DIMENSION_2D,
+					   DATA_SIZE_16,
+					   DMA_NOSYNC_KEEP_DMA_BUF));
+	set_dma_x_count(CH_PPI, (LCD_X_RES * LCD_BPP) / DMA_BUS_SIZE);
+	set_dma_x_modify(CH_PPI, DMA_BUS_SIZE / 8);
+	set_dma_y_count(CH_PPI, V_LINES);
+
+	set_dma_y_modify(CH_PPI, DMA_BUS_SIZE / 8);
+	set_dma_start_addr(CH_PPI, (unsigned long)fbi->fb_buffer);
+
+}
+
+#if (CLOCKS_PER_PIX == 1)
+static const u16 ppi0_req_16[] = {P_PPI0_CLK, P_PPI0_FS1, P_PPI0_FS2,
+			    P_PPI0_D0, P_PPI0_D1, P_PPI0_D2,
+			    P_PPI0_D3, P_PPI0_D4, P_PPI0_D5,
+			    P_PPI0_D6, P_PPI0_D7, P_PPI0_D8,
+			    P_PPI0_D9, P_PPI0_D10, P_PPI0_D11,
+			    P_PPI0_D12, P_PPI0_D13, P_PPI0_D14,
+			    P_PPI0_D15, 0};
+#else
+static const u16 ppi0_req_16[] = {P_PPI0_CLK, P_PPI0_FS1, P_PPI0_FS2,
+			    P_PPI0_D0, P_PPI0_D1, P_PPI0_D2,
+			    P_PPI0_D3, P_PPI0_D4, P_PPI0_D5,
+			    P_PPI0_D6, P_PPI0_D7, 0};
+#endif
+
+static inline void bfin_lq035q1_free_ports(void)
+{
+	peripheral_free_list(ppi0_req_16);
+	if (ANOMALY_05000400)
+		gpio_free(P_IDENT(P_PPI0_FS3));
+}
+
+static int __devinit bfin_lq035q1_request_ports(struct platform_device *pdev)
+{
+	/* ANOMALY_05000400 - PPI Does Not Start Properly In Specific Mode:
+	 * Drive PPI_FS3 Low
+	 */
+	if (ANOMALY_05000400) {
+		int ret = gpio_request(P_IDENT(P_PPI0_FS3), "PPI_FS3");
+		if (ret)
+			return ret;
+		gpio_direction_output(P_IDENT(P_PPI0_FS3), 0);
+	}
+
+	if (peripheral_request_list(ppi0_req_16, DRIVER_NAME)) {
+		dev_err(&pdev->dev, "requesting peripherals failed\n");
+		return -EFAULT;
+	}
+
+	return 0;
+}
+
+static int bfin_lq035q1_fb_open(struct fb_info *info, int user)
+{
+	struct bfin_lq035q1fb_info *fbi = info->par;
+
+	spin_lock(&fbi->lock);
+	fbi->lq035_open_cnt++;
+
+	if (fbi->lq035_open_cnt <= 1) {
+
+		bfin_lq035q1_disable_ppi();
+		SSYNC();
+
+		bfin_lq035q1_config_dma(fbi);
+		bfin_lq035q1_config_ppi(fbi);
+		bfin_lq035q1_init_timers();
+
+		/* start dma */
+		enable_dma(CH_PPI);
+		bfin_lq035q1_enable_ppi();
+		bfin_lq035q1_start_timers();
+		lq035q1_backlight(fbi, 1);
+	}
+
+	spin_unlock(&fbi->lock);
+
+	return 0;
+}
+
+static int bfin_lq035q1_fb_release(struct fb_info *info, int user)
+{
+	struct bfin_lq035q1fb_info *fbi = info->par;
+
+	spin_lock(&fbi->lock);
+
+	fbi->lq035_open_cnt--;
+
+	if (fbi->lq035_open_cnt <= 0) {
+		lq035q1_backlight(fbi, 0);
+		bfin_lq035q1_disable_ppi();
+		SSYNC();
+		disable_dma(CH_PPI);
+		bfin_lq035q1_stop_timers();
+	}
+
+	spin_unlock(&fbi->lock);
+
+	return 0;
+}
+
+static int bfin_lq035q1_fb_check_var(struct fb_var_screeninfo *var,
+				     struct fb_info *info)
+{
+	switch (var->bits_per_pixel) {
+#if (LCD_BPP == 24)
+	case 24:/* TRUECOLOUR, 16m */
+#else
+	case 16:/* DIRECTCOLOUR, 64k */
+#endif
+		var->red.offset = info->var.red.offset;
+		var->green.offset = info->var.green.offset;
+		var->blue.offset = info->var.blue.offset;
+		var->red.length = info->var.red.length;
+		var->green.length = info->var.green.length;
+		var->blue.length = info->var.blue.length;
+		var->transp.offset = 0;
+		var->transp.length = 0;
+		var->transp.msb_right = 0;
+		var->red.msb_right = 0;
+		var->green.msb_right = 0;
+		var->blue.msb_right = 0;
+		break;
+	default:
+		pr_debug("%s: depth not supported: %u BPP\n", __func__,
+			 var->bits_per_pixel);
+		return -EINVAL;
+	}
+
+	if (info->var.xres != var->xres || info->var.yres != var->yres ||
+	    info->var.xres_virtual != var->xres_virtual ||
+	    info->var.yres_virtual != var->yres_virtual) {
+		pr_debug("%s: Resolution not supported: X%u x Y%u \n",
+			 __func__, var->xres, var->yres);
+		return -EINVAL;
+	}
+
+	/*
+	 *  Memory limit
+	 */
+
+	if ((info->fix.line_length * var->yres_virtual) > info->fix.smem_len) {
+		pr_debug("%s: Memory Limit requested yres_virtual = %u\n",
+			 __func__, var->yres_virtual);
+		return -ENOMEM;
+	}
+
+
+	return 0;
+}
+
+int bfin_lq035q1_fb_cursor(struct fb_info *info, struct fb_cursor *cursor)
+{
+	if (nocursor)
+		return 0;
+	else
+		return -EINVAL;	/* just to force soft_cursor() call */
+}
+
+static int bfin_lq035q1_fb_setcolreg(u_int regno, u_int red, u_int green,
+				   u_int blue, u_int transp,
+				   struct fb_info *info)
+{
+	if (regno >= BFIN_LCD_NBR_PALETTE_ENTRIES)
+		return -EINVAL;
+
+	if (info->var.grayscale) {
+		/* grayscale = 0.30*R + 0.59*G + 0.11*B */
+		red = green = blue = (red * 77 + green * 151 + blue * 28) >> 8;
+	}
+
+	if (info->fix.visual == FB_VISUAL_TRUECOLOR) {
+
+		u32 value;
+		/* Place color in the pseudopalette */
+		if (regno > 16)
+			return -EINVAL;
+
+		red >>= (16 - info->var.red.length);
+		green >>= (16 - info->var.green.length);
+		blue >>= (16 - info->var.blue.length);
+
+		value = (red << info->var.red.offset) |
+		    (green << info->var.green.offset) |
+		    (blue << info->var.blue.offset);
+		value &= 0xFFFFFF;
+
+		((u32 *) (info->pseudo_palette))[regno] = value;
+
+	}
+
+	return 0;
+}
+
+static struct fb_ops bfin_lq035q1_fb_ops = {
+	.owner = THIS_MODULE,
+	.fb_open = bfin_lq035q1_fb_open,
+	.fb_release = bfin_lq035q1_fb_release,
+	.fb_check_var = bfin_lq035q1_fb_check_var,
+	.fb_fillrect = cfb_fillrect,
+	.fb_copyarea = cfb_copyarea,
+	.fb_imageblit = cfb_imageblit,
+	.fb_cursor = bfin_lq035q1_fb_cursor,
+	.fb_setcolreg = bfin_lq035q1_fb_setcolreg,
+};
+
+static irqreturn_t bfin_lq035q1_irq_error(int irq, void *dev_id)
+{
+	/*struct bfin_lq035q1fb_info *info = (struct bfin_lq035q1fb_info *)dev_id;*/
+
+	u16 status = bfin_read_PPI_STATUS();
+	bfin_write_PPI_STATUS(-1);
+
+	if (status) {
+		bfin_lq035q1_disable_ppi();
+		disable_dma(CH_PPI);
+
+		/* start dma */
+		enable_dma(CH_PPI);
+		bfin_lq035q1_enable_ppi();
+		bfin_write_PPI_STATUS(-1);
+	}
+
+	return IRQ_HANDLED;
+}
+
+static int __devinit bfin_lq035q1_probe(struct platform_device *pdev)
+{
+	struct bfin_lq035q1fb_info *info;
+	struct fb_info *fbinfo;
+	int ret;
+
+	ret = request_dma(CH_PPI, DRIVER_NAME"_CH_PPI");
+	if (ret < 0) {
+		dev_err(&pdev->dev, "PPI DMA unavailable\n");
+		goto out1;
+	}
+
+	fbinfo = framebuffer_alloc(sizeof(*info), &pdev->dev);
+	if (!fbinfo) {
+		ret = -ENOMEM;
+		goto out2;
+	}
+
+	info = fbinfo->par;
+	info->fb = fbinfo;
+	info->dev = &pdev->dev;
+
+	info->disp_info = pdev->dev.platform_data;
+
+	platform_set_drvdata(pdev, fbinfo);
+
+	strcpy(fbinfo->fix.id, DRIVER_NAME);
+
+	fbinfo->fix.type = FB_TYPE_PACKED_PIXELS;
+	fbinfo->fix.type_aux = 0;
+	fbinfo->fix.xpanstep = 0;
+	fbinfo->fix.ypanstep = 0;
+	fbinfo->fix.ywrapstep = 0;
+	fbinfo->fix.accel = FB_ACCEL_NONE;
+	fbinfo->fix.visual = FB_VISUAL_TRUECOLOR;
+
+	fbinfo->var.nonstd = 0;
+	fbinfo->var.activate = FB_ACTIVATE_NOW;
+	fbinfo->var.height = -1;
+	fbinfo->var.width = -1;
+	fbinfo->var.accel_flags = 0;
+	fbinfo->var.vmode = FB_VMODE_NONINTERLACED;
+
+	fbinfo->var.xres = LCD_X_RES;
+	fbinfo->var.xres_virtual = LCD_X_RES;
+	fbinfo->var.yres = LCD_Y_RES;
+	fbinfo->var.yres_virtual = LCD_Y_RES;
+	fbinfo->var.bits_per_pixel = LCD_BPP;
+
+	if (info->disp_info->mode & LQ035_BGR) {
+#if (LCD_BPP == 24)
+		fbinfo->var.red.offset = 0;
+		fbinfo->var.green.offset = 8;
+		fbinfo->var.blue.offset = 16;
+#else
+		fbinfo->var.red.offset = 0;
+		fbinfo->var.green.offset = 5;
+		fbinfo->var.blue.offset = 11;
+#endif
+	} else {
+#if (LCD_BPP == 24)
+		fbinfo->var.red.offset = 16;
+		fbinfo->var.green.offset = 8;
+		fbinfo->var.blue.offset = 0;
+#else
+		fbinfo->var.red.offset = 11;
+		fbinfo->var.green.offset = 5;
+		fbinfo->var.blue.offset = 0;
+#endif
+	}
+
+	fbinfo->var.transp.offset = 0;
+
+#if (LCD_BPP == 24)
+	fbinfo->var.red.length = 8;
+	fbinfo->var.green.length = 8;
+	fbinfo->var.blue.length = 8;
+#else
+	fbinfo->var.red.length = 5;
+	fbinfo->var.green.length = 6;
+	fbinfo->var.blue.length = 5;
+#endif
+
+	fbinfo->var.transp.length = 0;
+
+	fbinfo->fix.smem_len = LCD_X_RES * LCD_Y_RES * LCD_BPP / 8
+				+ ACTIVE_VIDEO_MEM_OFFSET;
+
+	fbinfo->fix.line_length = fbinfo->var.xres_virtual *
+	    fbinfo->var.bits_per_pixel / 8;
+
+
+	fbinfo->fbops = &bfin_lq035q1_fb_ops;
+	fbinfo->flags = FBINFO_FLAG_DEFAULT;
+
+	info->fb_buffer =
+	    dma_alloc_coherent(NULL, fbinfo->fix.smem_len, &info->dma_handle,
+			       GFP_KERNEL);
+
+	if (NULL == info->fb_buffer) {
+		dev_err(&pdev->dev, "couldn't allocate dma buffer\n");
+		ret = -ENOMEM;
+		goto out3;
+	}
+
+	fbinfo->screen_base = (void *)info->fb_buffer + ACTIVE_VIDEO_MEM_OFFSET;
+	fbinfo->fix.smem_start = (int)info->fb_buffer + ACTIVE_VIDEO_MEM_OFFSET;
+
+	fbinfo->fbops = &bfin_lq035q1_fb_ops;
+
+	fbinfo->pseudo_palette = &info->pseudo_pal;
+
+	ret = fb_alloc_cmap(&fbinfo->cmap, BFIN_LCD_NBR_PALETTE_ENTRIES, 0);
+	if (ret < 0) {
+		dev_err(&pdev->dev, "failed to allocate colormap (%d entries)\n",
+		       BFIN_LCD_NBR_PALETTE_ENTRIES);
+		goto out4;
+	}
+
+	ret = bfin_lq035q1_request_ports(pdev);
+	if (ret) {
+		dev_err(&pdev->dev, "couldn't request gpio port\n");
+		goto out6;
+	}
+
+	info->irq = platform_get_irq(pdev, 0);
+	if (info->irq < 0) {
+		ret = -EINVAL;
+		goto out7;
+	}
+
+	ret = request_irq(info->irq, bfin_lq035q1_irq_error, IRQF_DISABLED,
+			DRIVER_NAME" PPI ERROR", info);
+	if (ret < 0) {
+		dev_err(&pdev->dev, "unable to request PPI ERROR IRQ\n");
+		goto out7;
+	}
+
+	info->spidrv.driver.name = DRIVER_NAME"-spi";
+	info->spidrv.probe    = lq035q1_spidev_probe;
+	info->spidrv.remove   = __devexit_p(lq035q1_spidev_remove);
+	info->spidrv.shutdown = lq035q1_spidev_shutdown;
+	info->spidrv.suspend  = lq035q1_spidev_suspend;
+	info->spidrv.resume   = lq035q1_spidev_resume;
+
+	ret = spi_register_driver(&info->spidrv);
+	if (ret < 0) {
+		dev_err(&pdev->dev, "couldn't register SPI Interface\n");
+		goto out8;
+	}
+
+	if (info->disp_info->use_bl) {
+		ret = gpio_request(info->disp_info->gpio_bl, "LQ035 Backlight");
+
+		if (ret) {
+			dev_err(&pdev->dev, "failed to request GPIO %d\n",
+				info->disp_info->gpio_bl);
+			goto out9;
+		}
+		gpio_direction_output(info->disp_info->gpio_bl, 0);
+	}
+
+	ret = register_framebuffer(fbinfo);
+	if (ret < 0) {
+		dev_err(&pdev->dev, "unable to register framebuffer\n");
+		goto out10;
+	}
+
+	dev_info(&pdev->dev, "%dx%d %d-bit RGB FrameBuffer initialized\n",
+		LCD_X_RES, LCD_Y_RES, LCD_BPP);
+
+	return 0;
+
+ out10:
+	if (info->disp_info->use_bl)
+		gpio_free(info->disp_info->gpio_bl);
+ out9:
+	spi_unregister_driver(&info->spidrv);
+ out8:
+	free_irq(info->irq, info);
+ out7:
+	bfin_lq035q1_free_ports();
+ out6:
+	fb_dealloc_cmap(&fbinfo->cmap);
+ out4:
+	dma_free_coherent(NULL, fbinfo->fix.smem_len, info->fb_buffer,
+			  info->dma_handle);
+ out3:
+	framebuffer_release(fbinfo);
+ out2:
+	free_dma(CH_PPI);
+ out1:
+	platform_set_drvdata(pdev, NULL);
+
+	return ret;
+}
+
+static int __devexit bfin_lq035q1_remove(struct platform_device *pdev)
+{
+	struct fb_info *fbinfo = platform_get_drvdata(pdev);
+	struct bfin_lq035q1fb_info *info = fbinfo->par;
+
+	if (info->disp_info->use_bl)
+		gpio_free(info->disp_info->gpio_bl);
+
+	spi_unregister_driver(&info->spidrv);
+
+	unregister_framebuffer(fbinfo);
+
+	free_dma(CH_PPI);
+	free_irq(info->irq, info);
+
+	if (info->fb_buffer != NULL)
+		dma_free_coherent(NULL, fbinfo->fix.smem_len, info->fb_buffer,
+				  info->dma_handle);
+
+	fb_dealloc_cmap(&fbinfo->cmap);
+
+	bfin_lq035q1_free_ports();
+
+	platform_set_drvdata(pdev, NULL);
+	framebuffer_release(fbinfo);
+
+	dev_info(&pdev->dev, "unregistered LCD driver\n");
+
+	return 0;
+}
+
+#ifdef CONFIG_PM
+static int bfin_lq035q1_suspend(struct device *dev)
+{
+	struct fb_info *fbinfo = dev_get_drvdata(dev);
+	struct bfin_lq035q1fb_info *info = fbinfo->par;
+
+	if (info->lq035_open_cnt) {
+		lq035q1_backlight(info, 0);
+		bfin_lq035q1_disable_ppi();
+		SSYNC();
+		disable_dma(CH_PPI);
+		bfin_lq035q1_stop_timers();
+		bfin_write_PPI_STATUS(-1);
+	}
+
+	return 0;
+}
+
+static int bfin_lq035q1_resume(struct device *dev)
+{
+	struct fb_info *fbinfo = dev_get_drvdata(dev);
+	struct bfin_lq035q1fb_info *info = fbinfo->par;
+
+	if (info->lq035_open_cnt) {
+		bfin_lq035q1_disable_ppi();
+		SSYNC();
+
+		bfin_lq035q1_config_dma(info);
+		bfin_lq035q1_config_ppi(info);
+		bfin_lq035q1_init_timers();
+
+		/* start dma */
+		enable_dma(CH_PPI);
+		bfin_lq035q1_enable_ppi();
+		bfin_lq035q1_start_timers();
+		lq035q1_backlight(info, 1);
+	}
+
+	return 0;
+}
+
+static struct dev_pm_ops bfin_lq035q1_dev_pm_ops = {
+	.suspend = bfin_lq035q1_suspend,
+	.resume  = bfin_lq035q1_resume,
+};
+#endif
+
+static struct platform_driver bfin_lq035q1_driver = {
+	.probe   = bfin_lq035q1_probe,
+	.remove  = __devexit_p(bfin_lq035q1_remove),
+	.driver = {
+		.name = DRIVER_NAME,
+#ifdef CONFIG_PM
+		.pm   = &bfin_lq035q1_dev_pm_ops,
+#endif
+	},
+};
+
+static int __init bfin_lq035q1_driver_init(void)
+{
+	return platform_driver_register(&bfin_lq035q1_driver);
+}
+module_init(bfin_lq035q1_driver_init);
+
+static void __exit bfin_lq035q1_driver_cleanup(void)
+{
+	platform_driver_unregister(&bfin_lq035q1_driver);
+}
+module_exit(bfin_lq035q1_driver_cleanup);
+
+MODULE_DESCRIPTION("Blackfin TFT LCD Driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/video/bfin-t350mcqb-fb.c b/drivers/video/bfin-t350mcqb-fb.c
index 5cc36cfbf07b..2549c53b26a0 100644
--- a/drivers/video/bfin-t350mcqb-fb.c
+++ b/drivers/video/bfin-t350mcqb-fb.c
@@ -487,8 +487,8 @@ static int __devinit bfin_t350mcqb_probe(struct platform_device *pdev)
 
 	fbinfo->var.nonstd = 0;
 	fbinfo->var.activate = FB_ACTIVATE_NOW;
-	fbinfo->var.height = -1;
-	fbinfo->var.width = -1;
+	fbinfo->var.height = 53;
+	fbinfo->var.width = 70;
 	fbinfo->var.accel_flags = 0;
 	fbinfo->var.vmode = FB_VMODE_NONINTERLACED;
 
@@ -634,17 +634,35 @@ static int __devexit bfin_t350mcqb_remove(struct platform_device *pdev)
 #ifdef CONFIG_PM
 static int bfin_t350mcqb_suspend(struct platform_device *pdev, pm_message_t state)
 {
-	bfin_t350mcqb_disable_ppi();
-	disable_dma(CH_PPI);
-	bfin_write_PPI_STATUS(0xFFFF);
+	struct fb_info *fbinfo = platform_get_drvdata(pdev);
+	struct bfin_t350mcqbfb_info *fbi = fbinfo->par;
+
+	if (fbi->lq043_open_cnt) {
+		bfin_t350mcqb_disable_ppi();
+		disable_dma(CH_PPI);
+		bfin_t350mcqb_stop_timers();
+		bfin_write_PPI_STATUS(-1);
+	}
+
 
 	return 0;
 }
 
 static int bfin_t350mcqb_resume(struct platform_device *pdev)
 {
-	enable_dma(CH_PPI);
-	bfin_t350mcqb_enable_ppi();
+	struct fb_info *fbinfo = platform_get_drvdata(pdev);
+	struct bfin_t350mcqbfb_info *fbi = fbinfo->par;
+
+	if (fbi->lq043_open_cnt) {
+		bfin_t350mcqb_config_dma(fbi);
+		bfin_t350mcqb_config_ppi(fbi);
+		bfin_t350mcqb_init_timers();
+
+		/* start dma */
+		enable_dma(CH_PPI);
+		bfin_t350mcqb_enable_ppi();
+		bfin_t350mcqb_start_timers();
+	}
 
 	return 0;
 }
diff --git a/drivers/video/broadsheetfb.c b/drivers/video/broadsheetfb.c
index 509cb92e8731..df9ccb901d86 100644
--- a/drivers/video/broadsheetfb.c
+++ b/drivers/video/broadsheetfb.c
@@ -470,7 +470,7 @@ static int __devinit broadsheetfb_probe(struct platform_device *dev)
 	par->read_reg = broadsheet_read_reg;
 	init_waitqueue_head(&par->waitq);
 
-	info->flags = FBINFO_FLAG_DEFAULT;
+	info->flags = FBINFO_FLAG_DEFAULT | FBINFO_VIRTFB;
 
 	info->fbdefio = &broadsheetfb_defio;
 	fb_deferred_io_init(info);
diff --git a/drivers/video/clps711xfb.c b/drivers/video/clps711xfb.c
index 16f5db471ab5..99b354b8e257 100644
--- a/drivers/video/clps711xfb.c
+++ b/drivers/video/clps711xfb.c
@@ -19,8 +19,10 @@
  *
  *  Framebuffer driver for the CLPS7111 and EP7212 processors.
  */
+#include <linux/mm.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
+#include <linux/seq_file.h>
 #include <linux/slab.h>
 #include <linux/fb.h>
 #include <linux/init.h>
@@ -38,14 +40,6 @@ struct fb_info	*cfb;
 
 #define CMAP_MAX_SIZE	16
 
-/* The /proc entry for the backlight. */
-static struct proc_dir_entry *clps7111fb_backlight_proc_entry = NULL;
-
-static int clps7111fb_proc_backlight_read(char *page, char **start, off_t off,
-		int count, int *eof, void *data);
-static int clps7111fb_proc_backlight_write(struct file *file, 
-		const char *buffer, unsigned long count, void *data);
-
 /*
  * LCD AC Prescale.  This comes from the LCD panel manufacturers specifications.
  * This determines how many clocks + 1 of CL1 before the M signal toggles.
@@ -221,26 +215,23 @@ static struct fb_ops clps7111fb_ops = {
 	.fb_imageblit	= cfb_imageblit,
 };
 
-static int 
-clps7111fb_proc_backlight_read(char *page, char **start, off_t off,
-		int count, int *eof, void *data)
+static int backlight_proc_show(struct seq_file *m, void *v)
 {
-	/* We need at least two characters, one for the digit, and one for
-	 * the terminating NULL. */
-	if (count < 2) 
-		return -EINVAL;
-
 	if (machine_is_edb7211()) {
-		return sprintf(page, "%d\n", 
+		seq_printf(m, "%d\n",
 				(clps_readb(PDDR) & EDB_PD3_LCDBL) ? 1 : 0);
 	}
 
 	return 0;
 }
 
-static int 
-clps7111fb_proc_backlight_write(struct file *file, const char *buffer, 
-		unsigned long count, void *data)
+static int backlight_proc_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, backlight_proc_show, NULL);
+}
+
+static ssize_t backlight_proc_write(struct file *file, const char *buffer,
+				    size_t count, loff_t *pos)
 {
 	unsigned char char_value;
 	int value;
@@ -271,6 +262,15 @@ clps7111fb_proc_backlight_write(struct file *file, const char *buffer,
 	return count;
 }
 
+static const struct file_operations backlight_proc_fops = {
+	.owner		= THIS_MODULE,
+	.open		= backlight_proc_open,
+	.read		= seq_read,
+	.llseek		= seq_lseek,
+	.release	= single_release,
+	.write		= backlight_proc_write,
+};
+
 static void __init clps711x_guess_lcd_params(struct fb_info *info)
 {
 	unsigned int lcdcon, syscon, size;
@@ -379,19 +379,11 @@ int __init clps711xfb_init(void)
 
 	fb_alloc_cmap(&cfb->cmap, CMAP_MAX_SIZE, 0);
 
-	/* Register the /proc entries. */
-	clps7111fb_backlight_proc_entry = create_proc_entry("backlight", 0444,
-		NULL);
-	if (clps7111fb_backlight_proc_entry == NULL) {
+	if (!proc_create("backlight", 0444, NULL, &backlight_proc_fops)) {
 		printk("Couldn't create the /proc entry for the backlight.\n");
 		return -EINVAL;
 	}
 
-	clps7111fb_backlight_proc_entry->read_proc = 
-		&clps7111fb_proc_backlight_read;
-	clps7111fb_backlight_proc_entry->write_proc = 
-		&clps7111fb_proc_backlight_write;
-
 	/*
 	 * Power up the LCD
 	 */
diff --git a/drivers/video/console/sticore.c b/drivers/video/console/sticore.c
index 857b3668b3ba..6468a297e341 100644
--- a/drivers/video/console/sticore.c
+++ b/drivers/video/console/sticore.c
@@ -436,7 +436,7 @@ sti_init_glob_cfg(struct sti_struct *sti,
 			    (offs < PCI_BASE_ADDRESS_0 ||
 			     offs > PCI_BASE_ADDRESS_5)) {
 				printk (KERN_WARNING
-					"STI pci region maping for region %d (%02x) can't be mapped\n",
+					"STI pci region mapping for region %d (%02x) can't be mapped\n",
 					i,sti->rm_entry[i]);
 				continue;
 			}
diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c
index da55ccaf4d55..cc4bbbe44aca 100644
--- a/drivers/video/console/vgacon.c
+++ b/drivers/video/console/vgacon.c
@@ -585,6 +585,11 @@ static void vgacon_init(struct vc_data *c, int init)
 	vgacon_uni_pagedir[1]++;
 	if (!vgacon_uni_pagedir[0] && p)
 		con_set_default_unimap(c);
+
+	/* Only set the default if the user didn't deliberately override it */
+	if (global_cursor_default == -1)
+		global_cursor_default =
+			!(screen_info.flags & VIDEO_FLAGS_NOCURSOR);
 }
 
 static void vgacon_deinit(struct vc_data *c)
diff --git a/drivers/video/cyber2000fb.c b/drivers/video/cyber2000fb.c
index da7c01b39be2..3a561df2e8a2 100644
--- a/drivers/video/cyber2000fb.c
+++ b/drivers/video/cyber2000fb.c
@@ -1573,15 +1573,15 @@ cyberpro_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
 	if (err)
 		return err;
 
-	err = pci_request_regions(dev, name);
-	if (err)
-		return err;
-
 	err = -ENOMEM;
 	cfb = cyberpro_alloc_fb_info(id->driver_data, name);
 	if (!cfb)
 		goto failed_release;
 
+	err = pci_request_regions(dev, cfb->fb.fix.id);
+	if (err)
+		goto failed_regions;
+
 	cfb->dev = dev;
 	cfb->region = pci_ioremap_bar(dev, 0);
 	if (!cfb->region)
@@ -1633,10 +1633,10 @@ cyberpro_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
 failed:
 	iounmap(cfb->region);
 failed_ioremap:
+	pci_release_regions(dev);
+failed_regions:
 	cyberpro_free_fb_info(cfb);
 failed_release:
-	pci_release_regions(dev);
-
 	return err;
 }
 
diff --git a/drivers/video/da8xx-fb.c b/drivers/video/da8xx-fb.c
index ea1fd3f47511..369a5b3ac649 100644
--- a/drivers/video/da8xx-fb.c
+++ b/drivers/video/da8xx-fb.c
@@ -28,6 +28,8 @@
 #include <linux/uaccess.h>
 #include <linux/interrupt.h>
 #include <linux/clk.h>
+#include <linux/cpufreq.h>
+#include <linux/console.h>
 #include <video/da8xx-fb.h>
 
 #define DRIVER_NAME "da8xx_lcdc"
@@ -113,6 +115,12 @@ struct da8xx_fb_par {
 	unsigned short pseudo_palette[16];
 	unsigned int databuf_sz;
 	unsigned int palette_sz;
+	unsigned int pxl_clk;
+	int blank;
+#ifdef CONFIG_CPU_FREQ
+	struct notifier_block	freq_transition;
+#endif
+	void (*panel_power_ctrl)(int);
 };
 
 /* Variable Screen Information */
@@ -155,7 +163,7 @@ struct da8xx_panel {
 	int		vfp;		/* Vertical front porch */
 	int		vbp;		/* Vertical back porch */
 	int		vsw;		/* Vertical Sync Pulse Width */
-	int		pxl_clk;	/* Pixel clock */
+	unsigned int	pxl_clk;	/* Pixel clock */
 	unsigned char	invert_pxl_clk;	/* Invert Pixel clock */
 };
 
@@ -171,7 +179,7 @@ static struct da8xx_panel known_lcd_panels[] = {
 		.vfp = 2,
 		.vbp = 2,
 		.vsw = 0,
-		.pxl_clk = 0x10,
+		.pxl_clk = 4608000,
 		.invert_pxl_clk = 1,
 	},
 	/* Sharp LK043T1DG01 */
@@ -185,13 +193,23 @@ static struct da8xx_panel known_lcd_panels[] = {
 		.vfp = 2,
 		.vbp = 2,
 		.vsw = 10,
-		.pxl_clk = 0x12,
+		.pxl_clk = 7833600,
 		.invert_pxl_clk = 0,
 	},
 };
 
+/* Enable the Raster Engine of the LCD Controller */
+static inline void lcd_enable_raster(void)
+{
+	u32 reg;
+
+	reg = lcdc_read(LCD_RASTER_CTRL_REG);
+	if (!(reg & LCD_RASTER_ENABLE))
+		lcdc_write(reg | LCD_RASTER_ENABLE, LCD_RASTER_CTRL_REG);
+}
+
 /* Disable the Raster Engine of the LCD Controller */
-static void lcd_disable_raster(struct da8xx_fb_par *par)
+static inline void lcd_disable_raster(void)
 {
 	u32 reg;
 
@@ -443,14 +461,25 @@ static int fb_setcolreg(unsigned regno, unsigned red, unsigned green,
 static void lcd_reset(struct da8xx_fb_par *par)
 {
 	/* Disable the Raster if previously Enabled */
-	if (lcdc_read(LCD_RASTER_CTRL_REG) & LCD_RASTER_ENABLE)
-		lcd_disable_raster(par);
+	lcd_disable_raster();
 
 	/* DMA has to be disabled */
 	lcdc_write(0, LCD_DMA_CTRL_REG);
 	lcdc_write(0, LCD_RASTER_CTRL_REG);
 }
 
+static void lcd_calc_clk_divider(struct da8xx_fb_par *par)
+{
+	unsigned int lcd_clk, div;
+
+	lcd_clk = clk_get_rate(par->lcdc_clk);
+	div = lcd_clk / par->pxl_clk;
+
+	/* Configure the LCD clock divisor. */
+	lcdc_write(LCD_CLK_DIVISOR(div) |
+			(LCD_RASTER_MODE & 0x1), LCD_CTRL_REG);
+}
+
 static int lcd_init(struct da8xx_fb_par *par, const struct lcd_ctrl_config *cfg,
 		struct da8xx_panel *panel)
 {
@@ -459,9 +488,8 @@ static int lcd_init(struct da8xx_fb_par *par, const struct lcd_ctrl_config *cfg,
 
 	lcd_reset(par);
 
-	/* Configure the LCD clock divisor. */
-	lcdc_write(LCD_CLK_DIVISOR(panel->pxl_clk) |
-			(LCD_RASTER_MODE & 0x1), LCD_CTRL_REG);
+	/* Calculate the divider */
+	lcd_calc_clk_divider(par);
 
 	if (panel->invert_pxl_clk)
 		lcdc_write((lcdc_read(LCD_RASTER_TIMING_2_REG) |
@@ -513,13 +541,11 @@ static int lcd_init(struct da8xx_fb_par *par, const struct lcd_ctrl_config *cfg,
 static irqreturn_t lcdc_irq_handler(int irq, void *arg)
 {
 	u32 stat = lcdc_read(LCD_STAT_REG);
-	u32 reg;
 
 	if ((stat & LCD_SYNC_LOST) && (stat & LCD_FIFO_UNDERFLOW)) {
-		reg = lcdc_read(LCD_RASTER_CTRL_REG);
-		lcdc_write(reg & ~LCD_RASTER_ENABLE, LCD_RASTER_CTRL_REG);
+		lcd_disable_raster();
 		lcdc_write(stat, LCD_STAT_REG);
-		lcdc_write(reg | LCD_RASTER_ENABLE, LCD_RASTER_CTRL_REG);
+		lcd_enable_raster();
 	} else
 		lcdc_write(stat, LCD_STAT_REG);
 
@@ -574,6 +600,38 @@ static int fb_check_var(struct fb_var_screeninfo *var,
 	return err;
 }
 
+#ifdef CONFIG_CPU_FREQ
+static int lcd_da8xx_cpufreq_transition(struct notifier_block *nb,
+				     unsigned long val, void *data)
+{
+	struct da8xx_fb_par *par;
+
+	par = container_of(nb, struct da8xx_fb_par, freq_transition);
+	if (val == CPUFREQ_PRECHANGE) {
+		lcd_disable_raster();
+	} else if (val == CPUFREQ_POSTCHANGE) {
+		lcd_calc_clk_divider(par);
+		lcd_enable_raster();
+	}
+
+	return 0;
+}
+
+static inline int lcd_da8xx_cpufreq_register(struct da8xx_fb_par *par)
+{
+	par->freq_transition.notifier_call = lcd_da8xx_cpufreq_transition;
+
+	return cpufreq_register_notifier(&par->freq_transition,
+					 CPUFREQ_TRANSITION_NOTIFIER);
+}
+
+static inline void lcd_da8xx_cpufreq_deregister(struct da8xx_fb_par *par)
+{
+	cpufreq_unregister_notifier(&par->freq_transition,
+				    CPUFREQ_TRANSITION_NOTIFIER);
+}
+#endif
+
 static int __devexit fb_remove(struct platform_device *dev)
 {
 	struct fb_info *info = dev_get_drvdata(&dev->dev);
@@ -581,8 +639,13 @@ static int __devexit fb_remove(struct platform_device *dev)
 	if (info) {
 		struct da8xx_fb_par *par = info->par;
 
-		if (lcdc_read(LCD_RASTER_CTRL_REG) & LCD_RASTER_ENABLE)
-			lcd_disable_raster(par);
+#ifdef CONFIG_CPU_FREQ
+		lcd_da8xx_cpufreq_deregister(par);
+#endif
+		if (par->panel_power_ctrl)
+			par->panel_power_ctrl(0);
+
+		lcd_disable_raster();
 		lcdc_write(0, LCD_RASTER_CTRL_REG);
 
 		/* disable DMA  */
@@ -639,6 +702,35 @@ static int fb_ioctl(struct fb_info *info, unsigned int cmd,
 	return 0;
 }
 
+static int cfb_blank(int blank, struct fb_info *info)
+{
+	struct da8xx_fb_par *par = info->par;
+	int ret = 0;
+
+	if (par->blank == blank)
+		return 0;
+
+	par->blank = blank;
+	switch (blank) {
+	case FB_BLANK_UNBLANK:
+		if (par->panel_power_ctrl)
+			par->panel_power_ctrl(1);
+
+		lcd_enable_raster();
+		break;
+	case FB_BLANK_POWERDOWN:
+		if (par->panel_power_ctrl)
+			par->panel_power_ctrl(0);
+
+		lcd_disable_raster();
+		break;
+	default:
+		ret = -EINVAL;
+	}
+
+	return ret;
+}
+
 static struct fb_ops da8xx_fb_ops = {
 	.owner = THIS_MODULE,
 	.fb_check_var = fb_check_var,
@@ -647,6 +739,7 @@ static struct fb_ops da8xx_fb_ops = {
 	.fb_fillrect = cfb_fillrect,
 	.fb_copyarea = cfb_copyarea,
 	.fb_imageblit = cfb_imageblit,
+	.fb_blank = cfb_blank,
 };
 
 static int __init fb_probe(struct platform_device *device)
@@ -721,6 +814,12 @@ static int __init fb_probe(struct platform_device *device)
 	}
 
 	par = da8xx_fb_info->par;
+	par->lcdc_clk = fb_clk;
+	par->pxl_clk = lcdc_info->pxl_clk;
+	if (fb_pdata->panel_power_ctrl) {
+		par->panel_power_ctrl = fb_pdata->panel_power_ctrl;
+		par->panel_power_ctrl(1);
+	}
 
 	if (lcd_init(par, lcd_cfg, lcdc_info) < 0) {
 		dev_err(&device->dev, "lcd_init failed\n");
@@ -754,8 +853,6 @@ static int __init fb_probe(struct platform_device *device)
 	da8xx_fb_fix.smem_len = par->databuf_sz - par->palette_sz;
 	da8xx_fb_fix.line_length = (lcdc_info->width * lcd_cfg->bpp) / 8;
 
-	par->lcdc_clk = fb_clk;
-
 	par->irq = platform_get_irq(device, 0);
 	if (par->irq < 0) {
 		ret = -ENOENT;
@@ -814,12 +911,24 @@ static int __init fb_probe(struct platform_device *device)
 		goto err_dealloc_cmap;
 	}
 
+#ifdef CONFIG_CPU_FREQ
+	ret = lcd_da8xx_cpufreq_register(par);
+	if (ret) {
+		dev_err(&device->dev, "failed to register cpufreq\n");
+		goto err_cpu_freq;
+	}
+#endif
+
 	/* enable raster engine */
-	lcdc_write(lcdc_read(LCD_RASTER_CTRL_REG) |
-			LCD_RASTER_ENABLE, LCD_RASTER_CTRL_REG);
+	lcd_enable_raster();
 
 	return 0;
 
+#ifdef CONFIG_CPU_FREQ
+err_cpu_freq:
+	unregister_framebuffer(da8xx_fb_info);
+#endif
+
 err_dealloc_cmap:
 	fb_dealloc_cmap(&da8xx_fb_info->cmap);
 
@@ -852,11 +961,35 @@ err_request_mem:
 #ifdef CONFIG_PM
 static int fb_suspend(struct platform_device *dev, pm_message_t state)
 {
-	 return -EBUSY;
+	struct fb_info *info = platform_get_drvdata(dev);
+	struct da8xx_fb_par *par = info->par;
+
+	acquire_console_sem();
+	if (par->panel_power_ctrl)
+		par->panel_power_ctrl(0);
+
+	fb_set_suspend(info, 1);
+	lcd_disable_raster();
+	clk_disable(par->lcdc_clk);
+	release_console_sem();
+
+	return 0;
 }
 static int fb_resume(struct platform_device *dev)
 {
-	 return -EBUSY;
+	struct fb_info *info = platform_get_drvdata(dev);
+	struct da8xx_fb_par *par = info->par;
+
+	acquire_console_sem();
+	if (par->panel_power_ctrl)
+		par->panel_power_ctrl(1);
+
+	clk_enable(par->lcdc_clk);
+	lcd_enable_raster();
+	fb_set_suspend(info, 0);
+	release_console_sem();
+
+	return 0;
 }
 #else
 #define fb_suspend NULL
diff --git a/drivers/video/display/display-sysfs.c b/drivers/video/display/display-sysfs.c
index 4830b1bf51e5..80abbf323b99 100644
--- a/drivers/video/display/display-sysfs.c
+++ b/drivers/video/display/display-sysfs.c
@@ -67,7 +67,7 @@ static ssize_t display_store_contrast(struct device *dev,
 	contrast = simple_strtoul(buf, &endp, 0);
 	size = endp - buf;
 
-	if (*endp && isspace(*endp))
+	if (isspace(*endp))
 		size++;
 
 	if (size != count)
diff --git a/drivers/video/ep93xx-fb.c b/drivers/video/ep93xx-fb.c
index bd9d46f95291..27aab4a06198 100644
--- a/drivers/video/ep93xx-fb.c
+++ b/drivers/video/ep93xx-fb.c
@@ -358,6 +358,8 @@ static int ep93xxfb_setcolreg(unsigned int regno, unsigned int red,
 
 	switch (info->fix.visual) {
 	case FB_VISUAL_PSEUDOCOLOR:
+		if (regno > 255)
+			return 1;
 		rgb = ((red & 0xff00) << 8) | (green & 0xff00) |
 			((blue & 0xff00) >> 8);
 
diff --git a/drivers/video/fb_defio.c b/drivers/video/fb_defio.c
index c27ab1ed9604..44ce908a478b 100644
--- a/drivers/video/fb_defio.c
+++ b/drivers/video/fb_defio.c
@@ -71,7 +71,7 @@ int fb_deferred_io_fsync(struct file *file, struct dentry *dentry, int datasync)
 {
 	struct fb_info *info = file->private_data;
 
-	/* Skip if deferred io is complied-in but disabled on this fbdev */
+	/* Skip if deferred io is compiled-in but disabled on this fbdev */
 	if (!info->fbdefio)
 		return 0;
 
@@ -144,7 +144,9 @@ static const struct address_space_operations fb_deferred_io_aops = {
 static int fb_deferred_io_mmap(struct fb_info *info, struct vm_area_struct *vma)
 {
 	vma->vm_ops = &fb_deferred_io_vm_ops;
-	vma->vm_flags |= ( VM_IO | VM_RESERVED | VM_DONTEXPAND );
+	vma->vm_flags |= ( VM_RESERVED | VM_DONTEXPAND );
+	if (!(info->flags & FBINFO_VIRTFB))
+		vma->vm_flags |= VM_IO;
 	vma->vm_private_data = info;
 	return 0;
 }
diff --git a/drivers/video/gbefb.c b/drivers/video/gbefb.c
index f67db4268374..695fa013fe7e 100644
--- a/drivers/video/gbefb.c
+++ b/drivers/video/gbefb.c
@@ -701,7 +701,7 @@ static int gbefb_set_par(struct fb_info *info)
 	   blocks of 512x128, 256x128 or 128x128 pixels, respectively for 8bit,
 	   16bit and 32 bit modes (64 kB). They cover the screen with partial
 	   tiles on the right and/or bottom of the screen if needed.
-	   For exemple in 640x480 8 bit mode the mapping is:
+	   For example in 640x480 8 bit mode the mapping is:
 
 	   <-------- 640 ----->
 	   <---- 512 ----><128|384 offscreen>
diff --git a/drivers/video/geode/display_gx.c b/drivers/video/geode/display_gx.c
index e759895bf3d3..f0af911a096d 100644
--- a/drivers/video/geode/display_gx.c
+++ b/drivers/video/geode/display_gx.c
@@ -17,7 +17,7 @@
 #include <asm/io.h>
 #include <asm/div64.h>
 #include <asm/delay.h>
-#include <asm/geode.h>
+#include <linux/cs5535.h>
 
 #include "gxfb.h"
 
@@ -25,7 +25,7 @@ unsigned int gx_frame_buffer_size(void)
 {
 	unsigned int val;
 
-	if (!geode_has_vsa2()) {
+	if (!cs5535_has_vsa2()) {
 		uint32_t hi, lo;
 
 		/* The number of pages is (PMAX - PMIN)+1 */
diff --git a/drivers/video/geode/gxfb.h b/drivers/video/geode/gxfb.h
index 16a96f8fd8c5..d19e9378b0c0 100644
--- a/drivers/video/geode/gxfb.h
+++ b/drivers/video/geode/gxfb.h
@@ -340,7 +340,7 @@ static inline void write_fp(struct gxfb_par *par, int reg, uint32_t val)
 }
 
 
-/* MSRs are defined in asm/geode.h; their bitfields are here */
+/* MSRs are defined in linux/cs5535.h; their bitfields are here */
 
 #define MSR_GLCP_SYS_RSTPLL_DOTPOSTDIV3	(1 << 3)
 #define MSR_GLCP_SYS_RSTPLL_DOTPREMULT2	(1 << 2)
diff --git a/drivers/video/geode/gxfb_core.c b/drivers/video/geode/gxfb_core.c
index 2552cac39e1c..b3e639d1e12c 100644
--- a/drivers/video/geode/gxfb_core.c
+++ b/drivers/video/geode/gxfb_core.c
@@ -32,7 +32,7 @@
 #include <linux/suspend.h>
 #include <linux/init.h>
 #include <linux/pci.h>
-#include <asm/geode.h>
+#include <linux/cs5535.h>
 
 #include "gxfb.h"
 
diff --git a/drivers/video/geode/lxfb.h b/drivers/video/geode/lxfb.h
index 6a51448fd3f7..cc781c00f75d 100644
--- a/drivers/video/geode/lxfb.h
+++ b/drivers/video/geode/lxfb.h
@@ -1,3 +1,13 @@
+/* Geode LX framebuffer driver
+ *
+ * Copyright (C) 2006-2007, Advanced Micro Devices,Inc.
+ * Copyright (c) 2008  Andres Salomon <dilinger@debian.org>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.
+ */
 #ifndef _LXFB_H_
 #define _LXFB_H_
 
@@ -409,7 +419,7 @@ static inline void write_fp(struct lxfb_par *par, int reg, uint32_t val)
 }
 
 
-/* MSRs are defined in asm/geode.h; their bitfields are here */
+/* MSRs are defined in linux/cs5535.h; their bitfields are here */
 
 #define MSR_GLCP_DOTPLL_LOCK		(1 << 25)	/* r/o */
 #define MSR_GLCP_DOTPLL_HALFPIX		(1 << 24)
diff --git a/drivers/video/geode/lxfb_ops.c b/drivers/video/geode/lxfb_ops.c
index b1cd49c99356..0e5d8c7c3eba 100644
--- a/drivers/video/geode/lxfb_ops.c
+++ b/drivers/video/geode/lxfb_ops.c
@@ -13,7 +13,7 @@
 #include <linux/fb.h>
 #include <linux/uaccess.h>
 #include <linux/delay.h>
-#include <asm/geode.h>
+#include <linux/cs5535.h>
 
 #include "lxfb.h"
 
@@ -307,7 +307,7 @@ unsigned int lx_framebuffer_size(void)
 {
 	unsigned int val;
 
-	if (!geode_has_vsa2()) {
+	if (!cs5535_has_vsa2()) {
 		uint32_t hi, lo;
 
 		/* The number of pages is (PMAX - PMIN)+1 */
diff --git a/drivers/video/geode/suspend_gx.c b/drivers/video/geode/suspend_gx.c
index 9aff32ef8bb6..1bb043d70c64 100644
--- a/drivers/video/geode/suspend_gx.c
+++ b/drivers/video/geode/suspend_gx.c
@@ -10,7 +10,7 @@
 #include <linux/fb.h>
 #include <asm/io.h>
 #include <asm/msr.h>
-#include <asm/geode.h>
+#include <linux/cs5535.h>
 #include <asm/delay.h>
 
 #include "gxfb.h"
diff --git a/drivers/video/geode/video_gx.c b/drivers/video/geode/video_gx.c
index b8d52a8360db..6082f653c68a 100644
--- a/drivers/video/geode/video_gx.c
+++ b/drivers/video/geode/video_gx.c
@@ -16,7 +16,7 @@
 #include <asm/io.h>
 #include <asm/delay.h>
 #include <asm/msr.h>
-#include <asm/geode.h>
+#include <linux/cs5535.h>
 
 #include "gxfb.h"
 
diff --git a/drivers/video/hecubafb.c b/drivers/video/hecubafb.c
index 0b4bffbe67c8..f9d77adf035d 100644
--- a/drivers/video/hecubafb.c
+++ b/drivers/video/hecubafb.c
@@ -253,7 +253,7 @@ static int __devinit hecubafb_probe(struct platform_device *dev)
 	par->send_command = apollo_send_command;
 	par->send_data = apollo_send_data;
 
-	info->flags = FBINFO_FLAG_DEFAULT;
+	info->flags = FBINFO_FLAG_DEFAULT | FBINFO_VIRTFB;
 
 	info->fbdefio = &hecubafb_defio;
 	fb_deferred_io_init(info);
diff --git a/drivers/video/hitfb.c b/drivers/video/hitfb.c
index e7116a6d82d3..73c83a8de2d3 100644
--- a/drivers/video/hitfb.c
+++ b/drivers/video/hitfb.c
@@ -456,7 +456,7 @@ static int hitfb_resume(struct device *dev)
 	return 0;
 }
 
-static struct dev_pm_ops hitfb_dev_pm_ops = {
+static const struct dev_pm_ops hitfb_dev_pm_ops = {
 	.suspend	= hitfb_suspend,
 	.resume		= hitfb_resume,
 };
diff --git a/drivers/video/i810/i810_dvt.c b/drivers/video/i810/i810_dvt.c
index 27fa703a2e0a..b4b3670667ab 100644
--- a/drivers/video/i810/i810_dvt.c
+++ b/drivers/video/i810/i810_dvt.c
@@ -212,24 +212,29 @@ inline void round_off_yres(u32 *xres, u32 *yres)
 	*yres = (*xres * 3) >> 2;
 }
 
-void i810fb_encode_registers(const struct fb_var_screeninfo *var,
-			     struct i810fb_par *par, u32 xres, u32 yres)
+static int i810fb_find_best_mode(u32 xres, u32 yres, u32 pixclock)
 { 
 	u32 diff = 0, diff_best = 0xFFFFFFFF, i = 0, i_best = 0; 
-	u8 hfl;
+	u8 hfl = (u8) ((xres >> 3) - 1);
 
-	hfl = (u8) ((xres >> 3) - 1);
 	for (i = 0; i < ARRAY_SIZE(std_modes); i++) { 
 		if (std_modes[i].cr01 == hfl) { 
-			if (std_modes[i].pixclock <= par->regs.pixclock)
-				diff = par->regs.pixclock - 
-					std_modes[i].pixclock;
+			if (std_modes[i].pixclock <= pixclock)
+				diff = pixclock - std_modes[i].pixclock;
 			if (diff < diff_best) {	 
 		    		i_best = i;
 		    		diff_best = diff;
 			}
 		}
 	}
+	return i_best;
+}
+
+void i810fb_encode_registers(const struct fb_var_screeninfo *var,
+			     struct i810fb_par *par, u32 xres, u32 yres)
+{
+	u32 i_best = i810fb_find_best_mode(xres, yres, par->regs.pixclock);
+
 	par->regs = std_modes[i_best];
 
 	/* overlay */
@@ -239,36 +244,36 @@ void i810fb_encode_registers(const struct fb_var_screeninfo *var,
 
 void i810fb_fill_var_timings(struct fb_var_screeninfo *var)
 {
-	struct i810fb_par par;
 	u32 total, xres, yres;
+	u32 mode, pixclock;
 
 	xres = var->xres;
 	yres = var->yres;
 	
-	par.regs.pixclock = 1000000000/var->pixclock;
-	i810fb_encode_registers(var, &par, xres, yres);
+	pixclock = 1000000000 / var->pixclock;
+	mode = i810fb_find_best_mode(xres, yres, pixclock);
 	
-	total = ((par.regs.cr00 | (par.regs.cr35 & 1) << 8) + 3) << 3;
+	total = (std_modes[mode].cr00 | (std_modes[mode].cr35 & 1) << 8) + 3;
+	total <<= 3;
 	
-	var->pixclock = 1000000000/par.regs.pixclock;
-	var->right_margin = (par.regs.cr04 << 3) - xres;
-	var->hsync_len = ((par.regs.cr05 & 0x1F) - 
-			       (par.regs.cr04 & 0x1F)) << 3;
+	var->pixclock = 1000000000 / std_modes[mode].pixclock;
+	var->right_margin = (std_modes[mode].cr04 << 3) - xres;
+	var->hsync_len = ((std_modes[mode].cr05 & 0x1F) -
+			 (std_modes[mode].cr04 & 0x1F)) << 3;
 	var->left_margin = (total - (xres + var->right_margin + 
 				     var->hsync_len));
 	var->sync = FB_SYNC_ON_GREEN;
-	if (~(par.regs.msr & (1 << 6)))
+	if (~(std_modes[mode].msr & (1 << 6)))
 		var->sync |= FB_SYNC_HOR_HIGH_ACT;
-	if (~(par.regs.msr & (1 << 7)))
+	if (~(std_modes[mode].msr & (1 << 7)))
 		var->sync |= FB_SYNC_VERT_HIGH_ACT;
 
-
-	total = ((par.regs.cr06 | (par.regs.cr30 & 0x0F)  << 8)) + 2;
-	var->lower_margin = (par.regs.cr10 | 
-			     (par.regs.cr32 & 0x0F) << 8) - yres;
-	var->vsync_len = (par.regs.cr11 & 0x0F) - (var->lower_margin & 0x0F);
-	var->upper_margin = total - (yres + var->lower_margin + 
-				     var->vsync_len);
+	total = (std_modes[mode].cr06 | (std_modes[mode].cr30 & 0xF)  << 8) + 2;
+	var->lower_margin = (std_modes[mode].cr10 |
+			    (std_modes[mode].cr32 & 0x0F) << 8) - yres;
+	var->vsync_len = (std_modes[mode].cr11 & 0x0F) -
+			 (var->lower_margin & 0x0F);
+	var->upper_margin = total - (yres + var->lower_margin + var->vsync_len);
 }
 
 u32 i810_get_watermark(struct fb_var_screeninfo *var,
diff --git a/drivers/video/intelfb/intelfbdrv.c b/drivers/video/intelfb/intelfbdrv.c
index 0cafd642fbc0..5ba399991050 100644
--- a/drivers/video/intelfb/intelfbdrv.c
+++ b/drivers/video/intelfb/intelfbdrv.c
@@ -874,6 +874,9 @@ static int __devinit intelfb_pci_register(struct pci_dev *pdev,
 	if (bailearly == 18)
 		bailout(dinfo);
 
+	/* read active pipe */
+	dinfo->pipe = intelfbhw_active_pipe(&dinfo->save_state);
+
 	/* Cursor initialisation */
 	if (dinfo->hwcursor) {
 		intelfbhw_cursor_init(dinfo);
diff --git a/drivers/video/intelfb/intelfbhw.c b/drivers/video/intelfb/intelfbhw.c
index 0689f97c5238..81627466804e 100644
--- a/drivers/video/intelfb/intelfbhw.c
+++ b/drivers/video/intelfb/intelfbhw.c
@@ -469,6 +469,32 @@ void intelfbhw_do_blank(int blank, struct fb_info *info)
 }
 
 
+/* Check which pipe is connected to an active display plane. */
+int intelfbhw_active_pipe(const struct intelfb_hwstate *hw)
+{
+	int pipe = -1;
+
+	/* keep old default behaviour - prefer PIPE_A */
+	if (hw->disp_b_ctrl & DISPPLANE_PLANE_ENABLE) {
+		pipe = (hw->disp_b_ctrl >> DISPPLANE_SEL_PIPE_SHIFT);
+		pipe &= PIPE_MASK;
+		if (unlikely(pipe == PIPE_A))
+			return PIPE_A;
+	}
+	if (hw->disp_a_ctrl & DISPPLANE_PLANE_ENABLE) {
+		pipe = (hw->disp_a_ctrl >> DISPPLANE_SEL_PIPE_SHIFT);
+		pipe &= PIPE_MASK;
+		if (likely(pipe == PIPE_A))
+			return PIPE_A;
+	}
+	/* Impossible that no pipe is selected - return PIPE_A */
+	WARN_ON(pipe == -1);
+	if (unlikely(pipe == -1))
+		pipe = PIPE_A;
+
+	return pipe;
+}
+
 void intelfbhw_setcolreg(struct intelfb_info *dinfo, unsigned regno,
 			 unsigned red, unsigned green, unsigned blue,
 			 unsigned transp)
@@ -1019,7 +1045,7 @@ int intelfbhw_mode_to_hw(struct intelfb_info *dinfo,
 			 struct intelfb_hwstate *hw,
 			 struct fb_var_screeninfo *var)
 {
-	int pipe = PIPE_A;
+	int pipe = intelfbhw_active_pipe(hw);
 	u32 *dpll, *fp0, *fp1;
 	u32 m1, m2, n, p1, p2, clock_target, clock;
 	u32 hsync_start, hsync_end, hblank_start, hblank_end, htotal, hactive;
@@ -1033,12 +1059,6 @@ int intelfbhw_mode_to_hw(struct intelfb_info *dinfo,
 	/* Disable VGA */
 	hw->vgacntrl |= VGA_DISABLE;
 
-	/* Check whether pipe A or pipe B is enabled. */
-	if (hw->pipe_a_conf & PIPECONF_ENABLE)
-		pipe = PIPE_A;
-	else if (hw->pipe_b_conf & PIPECONF_ENABLE)
-		pipe = PIPE_B;
-
 	/* Set which pipe's registers will be set. */
 	if (pipe == PIPE_B) {
 		dpll = &hw->dpll_b;
@@ -1262,7 +1282,6 @@ int intelfbhw_mode_to_hw(struct intelfb_info *dinfo,
 int intelfbhw_program_mode(struct intelfb_info *dinfo,
 			   const struct intelfb_hwstate *hw, int blank)
 {
-	int pipe = PIPE_A;
 	u32 tmp;
 	const u32 *dpll, *fp0, *fp1, *pipe_conf;
 	const u32 *hs, *ht, *hb, *vs, *vt, *vb, *ss;
@@ -1272,7 +1291,7 @@ int intelfbhw_program_mode(struct intelfb_info *dinfo,
 	u32 src_size_reg;
 	u32 count, tmp_val[3];
 
-	/* Assume single pipe, display plane A, analog CRT. */
+	/* Assume single pipe */
 
 #if VERBOSE > 0
 	DBG_MSG("intelfbhw_program_mode\n");
@@ -1283,15 +1302,9 @@ int intelfbhw_program_mode(struct intelfb_info *dinfo,
 	tmp |= VGA_DISABLE;
 	OUTREG(VGACNTRL, tmp);
 
-	/* Check whether pipe A or pipe B is enabled. */
-	if (hw->pipe_a_conf & PIPECONF_ENABLE)
-		pipe = PIPE_A;
-	else if (hw->pipe_b_conf & PIPECONF_ENABLE)
-		pipe = PIPE_B;
-
-	dinfo->pipe = pipe;
+	dinfo->pipe = intelfbhw_active_pipe(hw);
 
-	if (pipe == PIPE_B) {
+	if (dinfo->pipe == PIPE_B) {
 		dpll = &hw->dpll_b;
 		fp0 = &hw->fpb0;
 		fp1 = &hw->fpb1;
diff --git a/drivers/video/intelfb/intelfbhw.h b/drivers/video/intelfb/intelfbhw.h
index 0b076bac321b..216ca20f259f 100644
--- a/drivers/video/intelfb/intelfbhw.h
+++ b/drivers/video/intelfb/intelfbhw.h
@@ -604,5 +604,6 @@ extern void intelfbhw_cursor_reset(struct intelfb_info *dinfo);
 extern int intelfbhw_enable_irq(struct intelfb_info *dinfo);
 extern void intelfbhw_disable_irq(struct intelfb_info *dinfo);
 extern int intelfbhw_wait_for_vsync(struct intelfb_info *dinfo, u32 pipe);
+extern int intelfbhw_active_pipe(const struct intelfb_hwstate *hw);
 
 #endif /* _INTELFBHW_H */
diff --git a/drivers/video/matrox/g450_pll.c b/drivers/video/matrox/g450_pll.c
index 09f6e045d5be..c15f8a57498e 100644
--- a/drivers/video/matrox/g450_pll.c
+++ b/drivers/video/matrox/g450_pll.c
@@ -368,7 +368,8 @@ static int __g450_setclk(struct matrox_fb_info *minfo, unsigned int fout,
 					M1064_XDVICLKCTRL_C1DVICLKEN |
 					M1064_XDVICLKCTRL_DVILOOPCTL |
 					M1064_XDVICLKCTRL_P1LOOPBWDTCTL;
-				matroxfb_DAC_out(minfo, M1064_XDVICLKCTRL, tmp);
+                                /* Setting this breaks PC systems so don't do it */
+				/* matroxfb_DAC_out(minfo, M1064_XDVICLKCTRL, tmp); */
 				matroxfb_DAC_out(minfo, M1064_XPWRCTRL,
 						 xpwrctrl);
 
diff --git a/drivers/video/maxinefb.c b/drivers/video/maxinefb.c
index 5e91c2b30af9..7854c7a37dc5 100644
--- a/drivers/video/maxinefb.c
+++ b/drivers/video/maxinefb.c
@@ -92,6 +92,9 @@ static int maxinefb_setcolreg(unsigned regno, unsigned red, unsigned green,
 	/* value to be written into the palette reg. */
 	unsigned long hw_colorvalue = 0;
 
+	if (regno > 255)
+		return 1;
+
 	red   >>= 8;    /* The cmap fields are 16 bits    */
 	green >>= 8;    /* wide, but the harware colormap */
 	blue  >>= 8;    /* registers are only 8 bits wide */
diff --git a/drivers/video/mb862xx/Makefile b/drivers/video/mb862xx/Makefile
index 07664814bb1d..d7777714166b 100644
--- a/drivers/video/mb862xx/Makefile
+++ b/drivers/video/mb862xx/Makefile
@@ -2,4 +2,4 @@
 # Makefile for the MB862xx framebuffer driver
 #
 
-obj-$(CONFIG_FB_MB862XX)	:= mb862xxfb.o
+obj-$(CONFIG_FB_MB862XX)	:= mb862xxfb.o mb862xxfb_accel.o
diff --git a/drivers/video/mb862xx/mb862xxfb.c b/drivers/video/mb862xx/mb862xxfb.c
index a28e3cfbbf70..fabb0c59a211 100644
--- a/drivers/video/mb862xx/mb862xxfb.c
+++ b/drivers/video/mb862xx/mb862xxfb.c
@@ -214,6 +214,8 @@ static int mb862xxfb_set_par(struct fb_info *fbi)
 	unsigned long reg, sc;
 
 	dev_dbg(par->dev, "%s\n", __func__);
+	if (par->type == BT_CORALP)
+		mb862xxfb_init_accel(fbi, fbi->var.xres);
 
 	if (par->pre_init)
 		return 0;
@@ -453,6 +455,18 @@ static ssize_t mb862xxfb_show_dispregs(struct device *dev,
 		ptr += sprintf(ptr, "%08x = %08x\n",
 			       reg, inreg(disp, reg));
 
+	for (reg = 0x400; reg <= 0x410; reg += 4)
+		ptr += sprintf(ptr, "geo %08x = %08x\n",
+			       reg, inreg(geo, reg));
+
+	for (reg = 0x400; reg <= 0x410; reg += 4)
+		ptr += sprintf(ptr, "draw %08x = %08x\n",
+			       reg, inreg(draw, reg));
+
+	for (reg = 0x440; reg <= 0x450; reg += 4)
+		ptr += sprintf(ptr, "draw %08x = %08x\n",
+			       reg, inreg(draw, reg));
+
 	return ptr - buf;
 }
 
diff --git a/drivers/video/mb862xx/mb862xxfb.h b/drivers/video/mb862xx/mb862xxfb.h
index c4c8f4dd2217..d7e7cb76bbf2 100644
--- a/drivers/video/mb862xx/mb862xxfb.h
+++ b/drivers/video/mb862xx/mb862xxfb.h
@@ -61,6 +61,8 @@ struct mb862xxfb_par {
 	u32			pseudo_palette[16];
 };
 
+extern void mb862xxfb_init_accel(struct fb_info *info, int xres);
+
 #if defined(CONFIG_FB_MB862XX_LIME) && defined(CONFIG_FB_MB862XX_PCI_GDC)
 #error	"Select Lime GDC or CoralP/Carmine support, but not both together"
 #endif
diff --git a/drivers/video/mb862xx/mb862xxfb_accel.c b/drivers/video/mb862xx/mb862xxfb_accel.c
new file mode 100644
index 000000000000..049256052b1a
--- /dev/null
+++ b/drivers/video/mb862xx/mb862xxfb_accel.c
@@ -0,0 +1,331 @@
+/*
+ * drivers/mb862xx/mb862xxfb_accel.c
+ *
+ * Fujitsu Carmine/Coral-P(A)/Lime framebuffer driver acceleration support
+ *
+ * (C) 2007 Alexander Shishkin <virtuoso@slind.org>
+ * (C) 2009 Valentin Sitdikov <valentin.sitdikov@siemens.com>
+ * (C) 2009 Siemens AG
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+#include <linux/fb.h>
+#include <linux/delay.h>
+#include <linux/init.h>
+#include <linux/interrupt.h>
+#include <linux/pci.h>
+#if defined(CONFIG_OF)
+#include <linux/of_platform.h>
+#endif
+#include "mb862xxfb.h"
+#include "mb862xx_reg.h"
+#include "mb862xxfb_accel.h"
+
+static void mb862xxfb_write_fifo(u32 count, u32 *data, struct fb_info *info)
+{
+	struct mb862xxfb_par *par = info->par;
+	static u32 free;
+
+	u32 total = 0;
+	while (total < count) {
+		if (free) {
+			outreg(geo, GDC_GEO_REG_INPUT_FIFO, data[total]);
+			total++;
+			free--;
+		} else {
+			free = (u32) inreg(draw, GDC_REG_FIFO_COUNT);
+		}
+	}
+}
+
+static void mb86290fb_copyarea(struct fb_info *info,
+			       const struct fb_copyarea *area)
+{
+	__u32 cmd[6];
+
+	cmd[0] = (GDC_TYPE_SETREGISTER << 24) | (1 << 16) | GDC_REG_MODE_BITMAP;
+	/* Set raster operation */
+	cmd[1] = (2 << 7) | (GDC_ROP_COPY << 9);
+	cmd[2] = GDC_TYPE_BLTCOPYP << 24;
+
+	if (area->sx >= area->dx && area->sy >= area->dy)
+		cmd[2] |= GDC_CMD_BLTCOPY_TOP_LEFT << 16;
+	else if (area->sx >= area->dx && area->sy <= area->dy)
+		cmd[2] |= GDC_CMD_BLTCOPY_BOTTOM_LEFT << 16;
+	else if (area->sx <= area->dx && area->sy >= area->dy)
+		cmd[2] |= GDC_CMD_BLTCOPY_TOP_RIGHT << 16;
+	else
+		cmd[2] |= GDC_CMD_BLTCOPY_BOTTOM_RIGHT << 16;
+
+	cmd[3] = (area->sy << 16) | area->sx;
+	cmd[4] = (area->dy << 16) | area->dx;
+	cmd[5] = (area->height << 16) | area->width;
+	mb862xxfb_write_fifo(6, cmd, info);
+}
+
+/*
+ * Fill in the cmd array /GDC FIFO commands/ to draw a 1bit image.
+ * Make sure cmd has enough room!
+ */
+static void mb86290fb_imageblit1(u32 *cmd, u16 step, u16 dx, u16 dy,
+				 u16 width, u16 height, u32 fgcolor,
+				 u32 bgcolor, const struct fb_image *image,
+				 struct fb_info *info)
+{
+	int i;
+	unsigned const char *line;
+	u16 bytes;
+
+	/* set colors and raster operation regs */
+	cmd[0] = (GDC_TYPE_SETREGISTER << 24) | (1 << 16) | GDC_REG_MODE_BITMAP;
+	/* Set raster operation */
+	cmd[1] = (2 << 7) | (GDC_ROP_COPY << 9);
+	cmd[2] =
+	    (GDC_TYPE_SETCOLORREGISTER << 24) | (GDC_CMD_BODY_FORE_COLOR << 16);
+	cmd[3] = fgcolor;
+	cmd[4] =
+	    (GDC_TYPE_SETCOLORREGISTER << 24) | (GDC_CMD_BODY_BACK_COLOR << 16);
+	cmd[5] = bgcolor;
+
+	i = 0;
+	line = image->data;
+	bytes = (image->width + 7) >> 3;
+
+	/* and the image */
+	cmd[6] = (GDC_TYPE_DRAWBITMAPP << 24) |
+	    (GDC_CMD_BITMAP << 16) | (2 + (step * height));
+	cmd[7] = (dy << 16) | dx;
+	cmd[8] = (height << 16) | width;
+
+	while (i < height) {
+		memcpy(&cmd[9 + i * step], line, step << 2);
+#ifdef __LITTLE_ENDIAN
+		{
+			int k = 0;
+			for (k = 0; k < step; k++)
+				cmd[9 + i * step + k] =
+				    cpu_to_be32(cmd[9 + i * step + k]);
+		}
+#endif
+		line += bytes;
+		i++;
+	}
+}
+
+/*
+ * Fill in the cmd array /GDC FIFO commands/ to draw a 8bit image.
+ * Make sure cmd has enough room!
+ */
+static void mb86290fb_imageblit8(u32 *cmd, u16 step, u16 dx, u16 dy,
+				 u16 width, u16 height, u32 fgcolor,
+				 u32 bgcolor, const struct fb_image *image,
+				 struct fb_info *info)
+{
+	int i, j;
+	unsigned const char *line, *ptr;
+	u16 bytes;
+
+	cmd[0] = (GDC_TYPE_DRAWBITMAPP << 24) |
+	    (GDC_CMD_BLT_DRAW << 16) | (2 + (height * step));
+	cmd[1] = (dy << 16) | dx;
+	cmd[2] = (height << 16) | width;
+
+	i = 0;
+	line = ptr = image->data;
+	bytes = image->width;
+
+	while (i < height) {
+		ptr = line;
+		for (j = 0; j < step; j++) {
+			cmd[3 + i * step + j] =
+			    (((u32 *) (info->pseudo_palette))[*ptr]) & 0xffff;
+			ptr++;
+			cmd[3 + i * step + j] |=
+			    ((((u32 *) (info->
+					pseudo_palette))[*ptr]) & 0xffff) << 16;
+			ptr++;
+		}
+
+		line += bytes;
+		i++;
+	}
+}
+
+/*
+ * Fill in the cmd array /GDC FIFO commands/ to draw a 16bit image.
+ * Make sure cmd has enough room!
+ */
+static void mb86290fb_imageblit16(u32 *cmd, u16 step, u16 dx, u16 dy,
+				  u16 width, u16 height, u32 fgcolor,
+				  u32 bgcolor, const struct fb_image *image,
+				  struct fb_info *info)
+{
+	int i;
+	unsigned const char *line;
+	u16 bytes;
+
+	i = 0;
+	line = image->data;
+	bytes = image->width << 1;
+
+	cmd[0] = (GDC_TYPE_DRAWBITMAPP << 24) |
+	    (GDC_CMD_BLT_DRAW << 16) | (2 + step * height);
+	cmd[1] = (dy << 16) | dx;
+	cmd[2] = (height << 16) | width;
+
+	while (i < height) {
+		memcpy(&cmd[3 + i * step], line, step);
+		line += bytes;
+		i++;
+	}
+}
+
+static void mb86290fb_imageblit(struct fb_info *info,
+				const struct fb_image *image)
+{
+	int mdr;
+	u32 *cmd = NULL;
+	void (*cmdfn) (u32 *, u16, u16, u16, u16, u16, u32, u32,
+		       const struct fb_image *, struct fb_info *) = NULL;
+	u32 cmdlen;
+	u32 fgcolor = 0, bgcolor = 0;
+	u16 step;
+
+	u16 width = image->width, height = image->height;
+	u16 dx = image->dx, dy = image->dy;
+	int x2, y2, vxres, vyres;
+
+	mdr = (GDC_ROP_COPY << 9);
+	x2 = image->dx + image->width;
+	y2 = image->dy + image->height;
+	vxres = info->var.xres_virtual;
+	vyres = info->var.yres_virtual;
+	x2 = min(x2, vxres);
+	y2 = min(y2, vyres);
+	width = x2 - dx;
+	height = y2 - dy;
+
+	switch (image->depth) {
+	case 1:
+		step = (width + 31) >> 5;
+		cmdlen = 9 + height * step;
+		cmdfn = mb86290fb_imageblit1;
+		if (info->fix.visual == FB_VISUAL_TRUECOLOR ||
+		    info->fix.visual == FB_VISUAL_DIRECTCOLOR) {
+			fgcolor =
+			    ((u32 *) (info->pseudo_palette))[image->fg_color];
+			bgcolor =
+			    ((u32 *) (info->pseudo_palette))[image->bg_color];
+		} else {
+			fgcolor = image->fg_color;
+			bgcolor = image->bg_color;
+		}
+
+		break;
+
+	case 8:
+		step = (width + 1) >> 1;
+		cmdlen = 3 + height * step;
+		cmdfn = mb86290fb_imageblit8;
+		break;
+
+	case 16:
+		step = (width + 1) >> 1;
+		cmdlen = 3 + height * step;
+		cmdfn = mb86290fb_imageblit16;
+		break;
+
+	default:
+		cfb_imageblit(info, image);
+		return;
+	}
+
+	cmd = kmalloc(cmdlen * 4, GFP_DMA);
+	if (!cmd)
+		return cfb_imageblit(info, image);
+	cmdfn(cmd, step, dx, dy, width, height, fgcolor, bgcolor, image, info);
+	mb862xxfb_write_fifo(cmdlen, cmd, info);
+	kfree(cmd);
+}
+
+static void mb86290fb_fillrect(struct fb_info *info,
+			       const struct fb_fillrect *rect)
+{
+
+	u32 x2, y2, vxres, vyres, height, width, fg;
+	u32 cmd[7];
+
+	vxres = info->var.xres_virtual;
+	vyres = info->var.yres_virtual;
+
+	if (!rect->width || !rect->height || rect->dx > vxres
+	    || rect->dy > vyres)
+		return;
+
+	/* We could use hardware clipping but on many cards you get around
+	 * hardware clipping by writing to framebuffer directly. */
+	x2 = rect->dx + rect->width;
+	y2 = rect->dy + rect->height;
+	x2 = min(x2, vxres);
+	y2 = min(y2, vyres);
+	width = x2 - rect->dx;
+	height = y2 - rect->dy;
+	if (info->fix.visual == FB_VISUAL_TRUECOLOR ||
+	    info->fix.visual == FB_VISUAL_DIRECTCOLOR)
+		fg = ((u32 *) (info->pseudo_palette))[rect->color];
+	else
+		fg = rect->color;
+
+	switch (rect->rop) {
+
+	case ROP_XOR:
+		/* Set raster operation */
+		cmd[1] = (2 << 7) | (GDC_ROP_XOR << 9);
+		break;
+
+	case ROP_COPY:
+		/* Set raster operation */
+		cmd[1] = (2 << 7) | (GDC_ROP_COPY << 9);
+		break;
+
+	}
+
+	cmd[0] = (GDC_TYPE_SETREGISTER << 24) | (1 << 16) | GDC_REG_MODE_BITMAP;
+	/* cmd[1] set earlier */
+	cmd[2] =
+	    (GDC_TYPE_SETCOLORREGISTER << 24) | (GDC_CMD_BODY_FORE_COLOR << 16);
+	cmd[3] = fg;
+	cmd[4] = (GDC_TYPE_DRAWRECTP << 24) | (GDC_CMD_BLT_FILL << 16);
+	cmd[5] = (rect->dy << 16) | (rect->dx);
+	cmd[6] = (height << 16) | width;
+
+	mb862xxfb_write_fifo(7, cmd, info);
+}
+
+void mb862xxfb_init_accel(struct fb_info *info, int xres)
+{
+	struct mb862xxfb_par *par = info->par;
+
+	if (info->var.bits_per_pixel == 32) {
+		info->fbops->fb_fillrect = cfb_fillrect;
+		info->fbops->fb_copyarea = cfb_copyarea;
+		info->fbops->fb_imageblit = cfb_imageblit;
+	} else {
+		outreg(disp, GC_L0EM, 3);
+		info->fbops->fb_fillrect = mb86290fb_fillrect;
+		info->fbops->fb_copyarea = mb86290fb_copyarea;
+		info->fbops->fb_imageblit = mb86290fb_imageblit;
+	}
+	outreg(draw, GDC_REG_DRAW_BASE, 0);
+	outreg(draw, GDC_REG_MODE_MISC, 0x8000);
+	outreg(draw, GDC_REG_X_RESOLUTION, xres);
+
+	info->flags |=
+	    FBINFO_HWACCEL_COPYAREA | FBINFO_HWACCEL_FILLRECT |
+	    FBINFO_HWACCEL_IMAGEBLIT;
+	info->fix.accel = 0xff;	/*FIXME: add right define */
+}
+EXPORT_SYMBOL(mb862xxfb_init_accel);
diff --git a/drivers/video/mb862xx/mb862xxfb_accel.h b/drivers/video/mb862xx/mb862xxfb_accel.h
new file mode 100644
index 000000000000..96a2dfef0f60
--- /dev/null
+++ b/drivers/video/mb862xx/mb862xxfb_accel.h
@@ -0,0 +1,203 @@
+#ifndef __MB826XXFB_ACCEL_H__
+#define __MB826XXFB_ACCEL_H__
+
+/* registers */
+#define GDC_GEO_REG_INPUT_FIFO 0x00000400L
+
+/* Special Registers */
+#define GDC_REG_CTRL                0x00000400L
+#define GDC_REG_FIFO_STATUS         0x00000404L
+#define GDC_REG_FIFO_COUNT          0x00000408L
+#define GDC_REG_SETUP_STATUS        0x0000040CL
+#define GDC_REG_DDA_STATUS          0x00000410L
+#define GDC_REG_ENGINE_STATUS       0x00000414L
+#define GDC_REG_ERROR_STATUS        0x00000418L
+#define GDC_REG_MODE_MISC           0x00000420L	/* MDR0 */
+#define GDC_REG_MODE_LINE           0x00000424L	/* MDR1 */
+#define GDC_REG_MODE_POLYGON        0x00000428L	/* MDR2 */
+#define GDC_REG_MODE_TEXTURE        0x0000042CL	/* MDR3 */
+#define GDC_REG_MODE_BITMAP         0x00000430L	/* MDR4 */
+#define GDC_REG_MODE_EXTENSION      0x0000043CL	/* MDR7 */
+
+/* Configuration Registers */
+#define GDC_REG_DRAW_BASE           0x00000440L
+#define GDC_REG_X_RESOLUTION        0x00000444L
+#define GDC_REG_Z_BASE              0x00000448L
+#define GDC_REG_TEXTURE_BASE        0x0000044CL
+#define GDC_REG_POLYGON_FLAG_BASE   0x00000450L
+#define GDC_REG_CLIP_XMIN           0x00000454L
+#define GDC_REG_CLIP_XMAX           0x00000458L
+#define GDC_REG_CLIP_YMIN           0x0000045CL
+#define GDC_REG_CLIP_YMAX           0x00000460L
+#define GDC_REG_TEXURE_SIZE         0x00000464L
+#define GDC_REG_TILE_SIZE           0x00000468L
+#define GDC_REG_TEX_BUF_OFFSET      0x0000046CL
+
+/* for MB86293 or later */
+#define GDC_REG_ALPHA_MAP_BASE      0x00000474L	/* ABR */
+
+/* Constant Registers */
+#define GDC_REG_FOREGROUND_COLOR    0x00000480L
+#define GDC_REG_BACKGROUND_COLOR    0x00000484L
+#define GDC_REG_ALPHA               0x00000488L
+#define GDC_REG_LINE_PATTERN        0x0000048CL
+#define GDC_REG_TEX_BORDER_COLOR    0x00000494L
+#define GDC_REG_LINE_PATTERN_OFFSET 0x000003E0L
+
+/* Coomand Code */
+#define GDC_CMD_PIXEL                   0x00000000L
+#define GDC_CMD_PIXEL_Z                 0x00000001L
+
+#define GDC_CMD_X_VECTOR                0x00000020L
+#define GDC_CMD_Y_VECTOR                0x00000021L
+#define GDC_CMD_X_VECTOR_NOEND          0x00000022L
+#define GDC_CMD_Y_VECTOR_NOEND          0x00000023L
+#define GDC_CMD_X_VECTOR_BLPO           0x00000024L
+#define GDC_CMD_Y_VECTOR_BLPO           0x00000025L
+#define GDC_CMD_X_VECTOR_NOEND_BLPO     0x00000026L
+#define GDC_CMD_Y_VECTOR_NOEND_BLPO     0x00000027L
+#define GDC_CMD_AA_X_VECTOR             0x00000028L
+#define GDC_CMD_AA_Y_VECTOR             0x00000029L
+#define GDC_CMD_AA_X_VECTOR_NOEND       0x0000002AL
+#define GDC_CMD_AA_Y_VECTOR_NOEND       0x0000002BL
+#define GDC_CMD_AA_X_VECTOR_BLPO        0x0000002CL
+#define GDC_CMD_AA_Y_VECTOR_BLPO        0x0000002DL
+#define GDC_CMD_AA_X_VECTOR_NOEND_BLPO  0x0000002EL
+#define GDC_CMD_AA_Y_VECTOR_NOEND_BLPO  0x0000002FL
+
+#define GDC_CMD_0_VECTOR                0x00000030L
+#define GDC_CMD_1_VECTOR                0x00000031L
+#define GDC_CMD_0_VECTOR_NOEND          0x00000032L
+#define GDC_CMD_1_VECTOR_NOEND          0x00000033L
+#define GDC_CMD_0_VECTOR_BLPO           0x00000034L
+#define GDC_CMD_1_VECTOR_BLPO           0x00000035L
+#define GDC_CMD_0_VECTOR_NOEND_BLPO     0x00000036L
+#define GDC_CMD_1_VECTOR_NOEND_BLPO     0x00000037L
+#define GDC_CMD_AA_0_VECTOR             0x00000038L
+#define GDC_CMD_AA_1_VECTOR             0x00000039L
+#define GDC_CMD_AA_0_VECTOR_NOEND       0x0000003AL
+#define GDC_CMD_AA_1_VECTOR_NOEND       0x0000003BL
+#define GDC_CMD_AA_0_VECTOR_BLPO        0x0000003CL
+#define GDC_CMD_AA_1_VECTOR_BLPO        0x0000003DL
+#define GDC_CMD_AA_0_VECTOR_NOEND_BLPO  0x0000003EL
+#define GDC_CMD_AA_1_VECTOR_NOEND_BLPO  0x0000003FL
+
+#define GDC_CMD_BLT_FILL                0x00000041L
+#define GDC_CMD_BLT_DRAW                0x00000042L
+#define GDC_CMD_BITMAP                  0x00000043L
+#define GDC_CMD_BLTCOPY_TOP_LEFT        0x00000044L
+#define GDC_CMD_BLTCOPY_TOP_RIGHT       0x00000045L
+#define GDC_CMD_BLTCOPY_BOTTOM_LEFT     0x00000046L
+#define GDC_CMD_BLTCOPY_BOTTOM_RIGHT    0x00000047L
+#define GDC_CMD_LOAD_TEXTURE            0x00000048L
+#define GDC_CMD_LOAD_TILE               0x00000049L
+
+#define GDC_CMD_TRAP_RIGHT              0x00000060L
+#define GDC_CMD_TRAP_LEFT               0x00000061L
+#define GDC_CMD_TRIANGLE_FAN            0x00000062L
+#define GDC_CMD_FLAG_TRIANGLE_FAN       0x00000063L
+
+#define GDC_CMD_FLUSH_FB                0x000000C1L
+#define GDC_CMD_FLUSH_Z                 0x000000C2L
+
+#define GDC_CMD_POLYGON_BEGIN           0x000000E0L
+#define GDC_CMD_POLYGON_END             0x000000E1L
+#define GDC_CMD_CLEAR_POLY_FLAG         0x000000E2L
+#define GDC_CMD_NORMAL                  0x000000FFL
+
+#define GDC_CMD_VECTOR_BLPO_FLAG        0x00040000L
+#define GDC_CMD_FAST_VECTOR_BLPO_FLAG   0x00000004L
+
+/* for MB86293 or later */
+#define GDC_CMD_MDR1                            0x00000000L
+#define GDC_CMD_MDR1S                           0x00000002L
+#define GDC_CMD_MDR1B                           0x00000004L
+#define GDC_CMD_MDR2                            0x00000001L
+#define GDC_CMD_MDR2S                           0x00000003L
+#define GDC_CMD_MDR2TL                          0x00000007L
+#define GDC_CMD_GMDR1E                          0x00000010L
+#define GDC_CMD_GMDR2E                          0x00000020L
+#define GDC_CMD_OVERLAP_SHADOW_XY               0x00000000L
+#define GDC_CMD_OVERLAP_SHADOW_XY_COMPOSITION   0x00000001L
+#define GDC_CMD_OVERLAP_Z_PACKED_ONBS           0x00000007L
+#define GDC_CMD_OVERLAP_Z_ORIGIN                0x00000000L
+#define GDC_CMD_OVERLAP_Z_NON_TOPLEFT           0x00000001L
+#define GDC_CMD_OVERLAP_Z_BORDER                0x00000002L
+#define GDC_CMD_OVERLAP_Z_SHADOW                0x00000003L
+#define GDC_CMD_BLTCOPY_ALT_ALPHA               0x00000000L	/* Reserverd */
+#define GDC_CMD_DC_LOGOUT                       0x00000000L	/* Reserverd */
+#define GDC_CMD_BODY_FORE_COLOR                 0x00000000L
+#define GDC_CMD_BODY_BACK_COLOR                 0x00000001L
+#define GDC_CMD_SHADOW_FORE_COLOR               0x00000002L
+#define GDC_CMD_SHADOW_BACK_COLOR               0x00000003L
+#define GDC_CMD_BORDER_FORE_COLOR               0x00000004L
+#define GDC_CMD_BORDER_BACK_COLOR               0x00000005L
+
+/* Type Code Table */
+#define GDC_TYPE_G_NOP                                  0x00000020L
+#define GDC_TYPE_G_BEGIN                                0x00000021L
+#define GDC_TYPE_G_BEGINCONT                            0x00000022L
+#define GDC_TYPE_G_END                                  0x00000023L
+#define GDC_TYPE_G_VERTEX                               0x00000030L
+#define GDC_TYPE_G_VERTEXLOG                            0x00000032L
+#define GDC_TYPE_G_VERTEXNOPLOG                         0x00000033L
+#define GDC_TYPE_G_INIT                                 0x00000040L
+#define GDC_TYPE_G_VIEWPORT                             0x00000041L
+#define GDC_TYPE_G_DEPTHRANGE                           0x00000042L
+#define GDC_TYPE_G_LOADMATRIX                           0x00000043L
+#define GDC_TYPE_G_VIEWVOLUMEXYCLIP                     0x00000044L
+#define GDC_TYPE_G_VIEWVOLUMEZCLIP                      0x00000045L
+#define GDC_TYPE_G_VIEWVOLUMEWCLIP                      0x00000046L
+#define GDC_TYPE_SETLVERTEX2I                           0x00000072L
+#define GDC_TYPE_SETLVERTEX2IP                          0x00000073L
+#define GDC_TYPE_SETMODEREGISTER                        0x000000C0L
+#define GDC_TYPE_SETGMODEREGISTER                       0x000000C1L
+#define GDC_TYPE_OVERLAPXYOFFT                          0x000000C8L
+#define GDC_TYPE_OVERLAPZOFFT                           0x000000C9L
+#define GDC_TYPE_DC_LOGOUTADDR                          0x000000CCL
+#define GDC_TYPE_SETCOLORREGISTER                       0x000000CEL
+#define GDC_TYPE_G_BEGINE                               0x000000E1L
+#define GDC_TYPE_G_BEGINCONTE                           0x000000E2L
+#define GDC_TYPE_G_ENDE                                 0x000000E3L
+#define GDC_TYPE_DRAWPIXEL                              0x00000000L
+#define GDC_TYPE_DRAWPIXELZ                             0x00000001L
+#define GDC_TYPE_DRAWLINE                               0x00000002L
+#define GDC_TYPE_DRAWLINE2I                             0x00000003L
+#define GDC_TYPE_DRAWLINE2IP                            0x00000004L
+#define GDC_TYPE_DRAWTRAP                               0x00000005L
+#define GDC_TYPE_DRAWVERTEX2I                           0x00000006L
+#define GDC_TYPE_DRAWVERTEX2IP                          0x00000007L
+#define GDC_TYPE_DRAWRECTP                              0x00000009L
+#define GDC_TYPE_DRAWBITMAPP                            0x0000000BL
+#define GDC_TYPE_BLTCOPYP                               0x0000000DL
+#define GDC_TYPE_BLTCOPYALTERNATEP                      0x0000000FL
+#define GDC_TYPE_LOADTEXTUREP                           0x00000011L
+#define GDC_TYPE_BLTTEXTUREP                            0x00000013L
+#define GDC_TYPE_BLTCOPYALTALPHABLENDP                  0x0000001FL
+#define GDC_TYPE_SETVERTEX2I                            0x00000070L
+#define GDC_TYPE_SETVERTEX2IP                           0x00000071L
+#define GDC_TYPE_DRAW                                   0x000000F0L
+#define GDC_TYPE_SETREGISTER                            0x000000F1L
+#define GDC_TYPE_SYNC                                   0x000000FCL
+#define GDC_TYPE_INTERRUPT                              0x000000FDL
+#define GDC_TYPE_NOP                                    0x0
+
+/* Raster operation */
+#define GDC_ROP_CLEAR                   0x0000
+#define GDC_ROP_AND                     0x0001
+#define GDC_ROP_AND_REVERSE             0x0002
+#define GDC_ROP_COPY                    0x0003
+#define GDC_ROP_AND_INVERTED            0x0004
+#define GDC_ROP_NOP                     0x0005
+#define GDC_ROP_XOR                     0x0006
+#define GDC_ROP_OR                      0x0007
+#define GDC_ROP_NOR                     0x0008
+#define GDC_ROP_EQUIV                   0x0009
+#define GDC_ROP_INVERT                  0x000A
+#define GDC_ROP_OR_REVERSE              0x000B
+#define GDC_ROP_COPY_INVERTED           0x000C
+#define GDC_ROP_OR_INVERTED             0x000D
+#define GDC_ROP_NAND                    0x000E
+#define GDC_ROP_SET                     0x000F
+
+#endif
diff --git a/drivers/video/metronomefb.c b/drivers/video/metronomefb.c
index df1f757a6161..661bfd20d194 100644
--- a/drivers/video/metronomefb.c
+++ b/drivers/video/metronomefb.c
@@ -700,7 +700,7 @@ static int __devinit metronomefb_probe(struct platform_device *dev)
 	if (retval < 0)
 		goto err_free_irq;
 
-	info->flags = FBINFO_FLAG_DEFAULT;
+	info->flags = FBINFO_FLAG_DEFAULT | FBINFO_VIRTFB;
 
 	info->fbdefio = &metronomefb_defio;
 	fb_deferred_io_init(info);
diff --git a/drivers/video/modedb.c b/drivers/video/modedb.c
index 34e4e7995169..0129f1bc3522 100644
--- a/drivers/video/modedb.c
+++ b/drivers/video/modedb.c
@@ -13,6 +13,7 @@
 
 #include <linux/module.h>
 #include <linux/fb.h>
+#include <linux/kernel.h>
 
 #undef DEBUG
 
@@ -402,21 +403,6 @@ const struct fb_videomode vesa_modes[] = {
 EXPORT_SYMBOL(vesa_modes);
 #endif /* CONFIG_FB_MODE_HELPERS */
 
-static int my_atoi(const char *name)
-{
-    int val = 0;
-
-    for (;; name++) {
-	switch (*name) {
-	    case '0' ... '9':
-		val = 10*val+(*name-'0');
-		break;
-	    default:
-		return val;
-	}
-    }
-}
-
 /**
  *	fb_try_mode - test a video mode
  *	@var: frame buffer user defined part of display
@@ -539,7 +525,7 @@ int fb_find_mode(struct fb_var_screeninfo *var,
 		    namelen = i;
 		    if (!refresh_specified && !bpp_specified &&
 			!yres_specified) {
-			refresh = my_atoi(&name[i+1]);
+			refresh = simple_strtol(&name[i+1], NULL, 10);
 			refresh_specified = 1;
 			if (cvt || rb)
 			    cvt = 0;
@@ -549,7 +535,7 @@ int fb_find_mode(struct fb_var_screeninfo *var,
 		case '-':
 		    namelen = i;
 		    if (!bpp_specified && !yres_specified) {
-			bpp = my_atoi(&name[i+1]);
+			bpp = simple_strtol(&name[i+1], NULL, 10);
 			bpp_specified = 1;
 			if (cvt || rb)
 			    cvt = 0;
@@ -558,7 +544,7 @@ int fb_find_mode(struct fb_var_screeninfo *var,
 		    break;
 		case 'x':
 		    if (!yres_specified) {
-			yres = my_atoi(&name[i+1]);
+			yres = simple_strtol(&name[i+1], NULL, 10);
 			yres_specified = 1;
 		    } else
 			goto done;
@@ -586,7 +572,7 @@ int fb_find_mode(struct fb_var_screeninfo *var,
 	    }
 	}
 	if (i < 0 && yres_specified) {
-	    xres = my_atoi(name);
+	    xres = simple_strtol(name, NULL, 10);
 	    res_specified = 1;
 	}
 done:
diff --git a/drivers/video/offb.c b/drivers/video/offb.c
index 4d8c54c23dd7..b043ac83c412 100644
--- a/drivers/video/offb.c
+++ b/drivers/video/offb.c
@@ -282,8 +282,17 @@ static int offb_set_par(struct fb_info *info)
 	return 0;
 }
 
+static void offb_destroy(struct fb_info *info)
+{
+	if (info->screen_base)
+		iounmap(info->screen_base);
+	release_mem_region(info->aperture_base, info->aperture_size);
+	framebuffer_release(info);
+}
+
 static struct fb_ops offb_ops = {
 	.owner		= THIS_MODULE,
+	.fb_destroy	= offb_destroy,
 	.fb_setcolreg	= offb_setcolreg,
 	.fb_set_par	= offb_set_par,
 	.fb_blank	= offb_blank,
@@ -482,10 +491,14 @@ static void __init offb_init_fb(const char *name, const char *full_name,
 	var->sync = 0;
 	var->vmode = FB_VMODE_NONINTERLACED;
 
+	/* set offb aperture size for generic probing */
+	info->aperture_base = address;
+	info->aperture_size = fix->smem_len;
+
 	info->fbops = &offb_ops;
 	info->screen_base = ioremap(address, fix->smem_len);
 	info->pseudo_palette = (void *) (info + 1);
-	info->flags = FBINFO_DEFAULT | foreign_endian;
+	info->flags = FBINFO_DEFAULT | FBINFO_MISC_FIRMWARE | foreign_endian;
 
 	fb_alloc_cmap(&info->cmap, 256, 0);
 
diff --git a/drivers/video/omap/Kconfig b/drivers/video/omap/Kconfig
index 551e3e9c4cbe..455c6055325d 100644
--- a/drivers/video/omap/Kconfig
+++ b/drivers/video/omap/Kconfig
@@ -1,6 +1,7 @@
 config FB_OMAP
 	tristate "OMAP frame buffer support (EXPERIMENTAL)"
-	depends on FB && ARCH_OMAP
+	depends on FB && ARCH_OMAP && (OMAP2_DSS = "n")
+
 	select FB_CFB_FILLRECT
 	select FB_CFB_COPYAREA
 	select FB_CFB_IMAGEBLIT
@@ -72,7 +73,7 @@ config FB_OMAP_LCD_MIPID
 
 config FB_OMAP_BOOTLOADER_INIT
 	bool "Check bootloader initialization"
-	depends on FB_OMAP
+	depends on FB_OMAP || FB_OMAP2
 	help
 	  Say Y here if you want to enable checking if the bootloader has
 	  already initialized the display controller. In this case the
diff --git a/drivers/video/omap/blizzard.c b/drivers/video/omap/blizzard.c
index f5d75f22cef9..2ffb34af4c59 100644
--- a/drivers/video/omap/blizzard.c
+++ b/drivers/video/omap/blizzard.c
@@ -27,9 +27,9 @@
 #include <linux/clk.h>
 
 #include <plat/dma.h>
-#include <plat/omapfb.h>
 #include <plat/blizzard.h>
 
+#include "omapfb.h"
 #include "dispc.h"
 
 #define MODULE_NAME				"blizzard"
diff --git a/drivers/video/omap/dispc.c b/drivers/video/omap/dispc.c
index 7c833db4f9b7..e192b058a688 100644
--- a/drivers/video/omap/dispc.c
+++ b/drivers/video/omap/dispc.c
@@ -24,11 +24,12 @@
 #include <linux/vmalloc.h>
 #include <linux/clk.h>
 #include <linux/io.h>
+#include <linux/platform_device.h>
 
 #include <plat/sram.h>
-#include <plat/omapfb.h>
 #include <plat/board.h>
 
+#include "omapfb.h"
 #include "dispc.h"
 
 #define MODULE_NAME			"dispc"
@@ -914,20 +915,20 @@ static irqreturn_t omap_dispc_irq_handler(int irq, void *dev)
 
 static int get_dss_clocks(void)
 {
-	dispc.dss_ick = clk_get(dispc.fbdev->dev, "ick");
+	dispc.dss_ick = clk_get(&dispc.fbdev->dssdev->dev, "ick");
 	if (IS_ERR(dispc.dss_ick)) {
 		dev_err(dispc.fbdev->dev, "can't get ick\n");
 		return PTR_ERR(dispc.dss_ick);
 	}
 
-	dispc.dss1_fck = clk_get(dispc.fbdev->dev, "dss1_fck");
+	dispc.dss1_fck = clk_get(&dispc.fbdev->dssdev->dev, "dss1_fck");
 	if (IS_ERR(dispc.dss1_fck)) {
 		dev_err(dispc.fbdev->dev, "can't get dss1_fck\n");
 		clk_put(dispc.dss_ick);
 		return PTR_ERR(dispc.dss1_fck);
 	}
 
-	dispc.dss_54m_fck = clk_get(dispc.fbdev->dev, "tv_fck");
+	dispc.dss_54m_fck = clk_get(&dispc.fbdev->dssdev->dev, "tv_fck");
 	if (IS_ERR(dispc.dss_54m_fck)) {
 		dev_err(dispc.fbdev->dev, "can't get tv_fck\n");
 		clk_put(dispc.dss_ick);
diff --git a/drivers/video/omap/hwa742.c b/drivers/video/omap/hwa742.c
index 17a975e4c9c9..0016f77cd13f 100644
--- a/drivers/video/omap/hwa742.c
+++ b/drivers/video/omap/hwa742.c
@@ -25,10 +25,11 @@
 #include <linux/fb.h>
 #include <linux/delay.h>
 #include <linux/clk.h>
+#include <linux/interrupt.h>
 
 #include <plat/dma.h>
-#include <plat/omapfb.h>
 #include <plat/hwa742.h>
+#include "omapfb.h"
 
 #define HWA742_REV_CODE_REG       0x0
 #define HWA742_CONFIG_REG         0x2
diff --git a/drivers/video/omap/lcd_2430sdp.c b/drivers/video/omap/lcd_2430sdp.c
index fea7feee0b77..e3eccc9af78e 100644
--- a/drivers/video/omap/lcd_2430sdp.c
+++ b/drivers/video/omap/lcd_2430sdp.c
@@ -25,12 +25,13 @@
 #include <linux/platform_device.h>
 #include <linux/delay.h>
 #include <linux/gpio.h>
-#include <linux/i2c/twl4030.h>
+#include <linux/i2c/twl.h>
 
 #include <plat/mux.h>
-#include <plat/omapfb.h>
 #include <asm/mach-types.h>
 
+#include "omapfb.h"
+
 #define SDP2430_LCD_PANEL_BACKLIGHT_GPIO	91
 #define SDP2430_LCD_PANEL_ENABLE_GPIO		154
 #define SDP3430_LCD_PANEL_BACKLIGHT_GPIO	24
@@ -51,7 +52,7 @@ static unsigned enable_gpio;
 #define TWL4030_VPLL2_DEV_GRP           0x33
 #define TWL4030_VPLL2_DEDICATED         0x36
 
-#define t2_out(c, r, v) twl4030_i2c_write_u8(c, r, v)
+#define t2_out(c, r, v) twl_i2c_write_u8(c, r, v)
 
 
 static int sdp2430_panel_init(struct lcd_panel *panel,
diff --git a/drivers/video/omap/lcd_ams_delta.c b/drivers/video/omap/lcd_ams_delta.c
index 3d5277252ca3..567db6ac32c8 100644
--- a/drivers/video/omap/lcd_ams_delta.c
+++ b/drivers/video/omap/lcd_ams_delta.c
@@ -27,7 +27,8 @@
 
 #include <plat/board-ams-delta.h>
 #include <mach/hardware.h>
-#include <plat/omapfb.h>
+
+#include "omapfb.h"
 
 #define AMS_DELTA_DEFAULT_CONTRAST	112
 
@@ -123,12 +124,12 @@ struct platform_driver ams_delta_panel_driver = {
 	},
 };
 
-static int ams_delta_panel_drv_init(void)
+static int __init ams_delta_panel_drv_init(void)
 {
 	return platform_driver_register(&ams_delta_panel_driver);
 }
 
-static void ams_delta_panel_drv_cleanup(void)
+static void __exit ams_delta_panel_drv_cleanup(void)
 {
 	platform_driver_unregister(&ams_delta_panel_driver);
 }
diff --git a/drivers/video/omap/lcd_apollon.c b/drivers/video/omap/lcd_apollon.c
index 4c5cefc5153b..2be94eb3bbf5 100644
--- a/drivers/video/omap/lcd_apollon.c
+++ b/drivers/video/omap/lcd_apollon.c
@@ -26,7 +26,8 @@
 
 #include <mach/gpio.h>
 #include <plat/mux.h>
-#include <plat/omapfb.h>
+
+#include "omapfb.h"
 
 /* #define USE_35INCH_LCD 1 */
 
diff --git a/drivers/video/omap/lcd_h3.c b/drivers/video/omap/lcd_h3.c
index 240b4fb10741..8df688748b5a 100644
--- a/drivers/video/omap/lcd_h3.c
+++ b/drivers/video/omap/lcd_h3.c
@@ -24,7 +24,7 @@
 #include <linux/i2c/tps65010.h>
 
 #include <mach/gpio.h>
-#include <plat/omapfb.h>
+#include "omapfb.h"
 
 #define MODULE_NAME	"omapfb-lcd_h3"
 
diff --git a/drivers/video/omap/lcd_h4.c b/drivers/video/omap/lcd_h4.c
index 720625da1f4e..03a06a982750 100644
--- a/drivers/video/omap/lcd_h4.c
+++ b/drivers/video/omap/lcd_h4.c
@@ -22,7 +22,7 @@
 #include <linux/module.h>
 #include <linux/platform_device.h>
 
-#include <plat/omapfb.h>
+#include "omapfb.h"
 
 static int h4_panel_init(struct lcd_panel *panel, struct omapfb_device *fbdev)
 {
diff --git a/drivers/video/omap/lcd_htcherald.c b/drivers/video/omap/lcd_htcherald.c
index 2e0c81ea7483..4802419da83b 100644
--- a/drivers/video/omap/lcd_htcherald.c
+++ b/drivers/video/omap/lcd_htcherald.c
@@ -29,7 +29,7 @@
 #include <linux/module.h>
 #include <linux/platform_device.h>
 
-#include <plat/omapfb.h>
+#include "omapfb.h"
 
 static int htcherald_panel_init(struct lcd_panel *panel,
 					struct omapfb_device *fbdev)
@@ -115,12 +115,12 @@ struct platform_driver htcherald_panel_driver = {
 	},
 };
 
-static int htcherald_panel_drv_init(void)
+static int __init htcherald_panel_drv_init(void)
 {
 	return platform_driver_register(&htcherald_panel_driver);
 }
 
-static void htcherald_panel_drv_cleanup(void)
+static void __exit htcherald_panel_drv_cleanup(void)
 {
 	platform_driver_unregister(&htcherald_panel_driver);
 }
diff --git a/drivers/video/omap/lcd_inn1510.c b/drivers/video/omap/lcd_inn1510.c
index aafe9b497e2d..3271f1643b26 100644
--- a/drivers/video/omap/lcd_inn1510.c
+++ b/drivers/video/omap/lcd_inn1510.c
@@ -24,7 +24,7 @@
 #include <linux/io.h>
 
 #include <plat/fpga.h>
-#include <plat/omapfb.h>
+#include "omapfb.h"
 
 static int innovator1510_panel_init(struct lcd_panel *panel,
 				    struct omapfb_device *fbdev)
diff --git a/drivers/video/omap/lcd_inn1610.c b/drivers/video/omap/lcd_inn1610.c
index 0de338264a8a..9fff86f67bde 100644
--- a/drivers/video/omap/lcd_inn1610.c
+++ b/drivers/video/omap/lcd_inn1610.c
@@ -23,7 +23,7 @@
 #include <linux/platform_device.h>
 
 #include <mach/gpio.h>
-#include <plat/omapfb.h>
+#include "omapfb.h"
 
 #define MODULE_NAME	"omapfb-lcd_h3"
 
diff --git a/drivers/video/omap/lcd_ldp.c b/drivers/video/omap/lcd_ldp.c
index 6a260dfdadc5..0f5952cae85e 100644
--- a/drivers/video/omap/lcd_ldp.c
+++ b/drivers/video/omap/lcd_ldp.c
@@ -24,13 +24,14 @@
 #include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/delay.h>
-#include <linux/i2c/twl4030.h>
+#include <linux/i2c/twl.h>
 
 #include <mach/gpio.h>
 #include <plat/mux.h>
-#include <plat/omapfb.h>
 #include <asm/mach-types.h>
 
+#include "omapfb.h"
+
 #define LCD_PANEL_BACKLIGHT_GPIO	(15 + OMAP_MAX_GPIO_LINES)
 #define LCD_PANEL_ENABLE_GPIO		(7 + OMAP_MAX_GPIO_LINES)
 
@@ -58,7 +59,7 @@
 #define TWL4030_VPLL2_DEV_GRP           0x33
 #define TWL4030_VPLL2_DEDICATED         0x36
 
-#define t2_out(c, r, v) twl4030_i2c_write_u8(c, r, v)
+#define t2_out(c, r, v) twl_i2c_write_u8(c, r, v)
 
 
 static int ldp_panel_init(struct lcd_panel *panel,
diff --git a/drivers/video/omap/lcd_mipid.c b/drivers/video/omap/lcd_mipid.c
index 2162eb09e0fe..abe1c76a3257 100644
--- a/drivers/video/omap/lcd_mipid.c
+++ b/drivers/video/omap/lcd_mipid.c
@@ -23,9 +23,10 @@
 #include <linux/workqueue.h>
 #include <linux/spi/spi.h>
 
-#include <plat/omapfb.h>
 #include <plat/lcd_mipid.h>
 
+#include "omapfb.h"
+
 #define MIPID_MODULE_NAME		"lcd_mipid"
 
 #define MIPID_CMD_READ_DISP_ID		0x04
@@ -607,7 +608,7 @@ static struct spi_driver mipid_spi_driver = {
 	.remove	= __devexit_p(mipid_spi_remove),
 };
 
-static int mipid_drv_init(void)
+static int __init mipid_drv_init(void)
 {
 	spi_register_driver(&mipid_spi_driver);
 
@@ -615,7 +616,7 @@ static int mipid_drv_init(void)
 }
 module_init(mipid_drv_init);
 
-static void mipid_drv_cleanup(void)
+static void __exit mipid_drv_cleanup(void)
 {
 	spi_unregister_driver(&mipid_spi_driver);
 }
diff --git a/drivers/video/omap/lcd_omap2evm.c b/drivers/video/omap/lcd_omap2evm.c
index e1a38abca3e7..7e7a65c08452 100644
--- a/drivers/video/omap/lcd_omap2evm.c
+++ b/drivers/video/omap/lcd_omap2evm.c
@@ -24,12 +24,13 @@
 #include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/gpio.h>
-#include <linux/i2c/twl4030.h>
+#include <linux/i2c/twl.h>
 
 #include <plat/mux.h>
-#include <plat/omapfb.h>
 #include <asm/mach-types.h>
 
+#include "omapfb.h"
+
 #define LCD_PANEL_ENABLE_GPIO	154
 #define LCD_PANEL_LR		128
 #define LCD_PANEL_UD		129
@@ -60,9 +61,9 @@ static int omap2evm_panel_init(struct lcd_panel *panel,
 	gpio_direction_output(LCD_PANEL_LR, 1);
 	gpio_direction_output(LCD_PANEL_UD, 1);
 
-	twl4030_i2c_write_u8(TWL4030_MODULE_LED, 0x11, TWL_LED_LEDEN);
-	twl4030_i2c_write_u8(TWL4030_MODULE_PWMA, 0x01, TWL_PWMA_PWMAON);
-	twl4030_i2c_write_u8(TWL4030_MODULE_PWMA, 0x02, TWL_PWMA_PWMAOFF);
+	twl_i2c_write_u8(TWL4030_MODULE_LED, 0x11, TWL_LED_LEDEN);
+	twl_i2c_write_u8(TWL4030_MODULE_PWMA, 0x01, TWL_PWMA_PWMAON);
+	twl_i2c_write_u8(TWL4030_MODULE_PWMA, 0x02, TWL_PWMA_PWMAOFF);
 	bklight_level = 100;
 
 	return 0;
@@ -100,7 +101,7 @@ static int omap2evm_bklight_setlevel(struct lcd_panel *panel,
 	u8 c;
 	if ((level >= 0) && (level <= 100)) {
 		c = (125 * (100 - level)) / 100 + 2;
-		twl4030_i2c_write_u8(TWL4030_MODULE_PWMA, c, TWL_PWMA_PWMAOFF);
+		twl_i2c_write_u8(TWL4030_MODULE_PWMA, c, TWL_PWMA_PWMAOFF);
 		bklight_level = level;
 	}
 	return 0;
diff --git a/drivers/video/omap/lcd_omap3beagle.c b/drivers/video/omap/lcd_omap3beagle.c
index ccec084ed647..ca75cc2a87a5 100644
--- a/drivers/video/omap/lcd_omap3beagle.c
+++ b/drivers/video/omap/lcd_omap3beagle.c
@@ -23,12 +23,14 @@
 #include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/gpio.h>
-#include <linux/i2c/twl4030.h>
+#include <linux/i2c/twl.h>
 
 #include <plat/mux.h>
-#include <plat/omapfb.h>
+#include <plat/mux.h>
 #include <asm/mach-types.h>
 
+#include "omapfb.h"
+
 #define LCD_PANEL_ENABLE_GPIO       170
 
 static int omap3beagle_panel_init(struct lcd_panel *panel,
diff --git a/drivers/video/omap/lcd_omap3evm.c b/drivers/video/omap/lcd_omap3evm.c
index 556eb31db24c..06840da0b094 100644
--- a/drivers/video/omap/lcd_omap3evm.c
+++ b/drivers/video/omap/lcd_omap3evm.c
@@ -23,12 +23,13 @@
 #include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/gpio.h>
-#include <linux/i2c/twl4030.h>
+#include <linux/i2c/twl.h>
 
 #include <plat/mux.h>
-#include <plat/omapfb.h>
 #include <asm/mach-types.h>
 
+#include "omapfb.h"
+
 #define LCD_PANEL_ENABLE_GPIO       153
 #define LCD_PANEL_LR                2
 #define LCD_PANEL_UD                3
@@ -62,9 +63,9 @@ static int omap3evm_panel_init(struct lcd_panel *panel,
 	gpio_direction_output(LCD_PANEL_LR, 1);
 	gpio_direction_output(LCD_PANEL_UD, 1);
 
-	twl4030_i2c_write_u8(TWL4030_MODULE_LED, 0x11, TWL_LED_LEDEN);
-	twl4030_i2c_write_u8(TWL4030_MODULE_PWMA, 0x01, TWL_PWMA_PWMAON);
-	twl4030_i2c_write_u8(TWL4030_MODULE_PWMA, 0x02, TWL_PWMA_PWMAOFF);
+	twl_i2c_write_u8(TWL4030_MODULE_LED, 0x11, TWL_LED_LEDEN);
+	twl_i2c_write_u8(TWL4030_MODULE_PWMA, 0x01, TWL_PWMA_PWMAON);
+	twl_i2c_write_u8(TWL4030_MODULE_PWMA, 0x02, TWL_PWMA_PWMAOFF);
 	bklight_level = 100;
 
 	return 0;
@@ -101,7 +102,7 @@ static int omap3evm_bklight_setlevel(struct lcd_panel *panel,
 	u8 c;
 	if ((level >= 0) && (level <= 100)) {
 		c = (125 * (100 - level)) / 100 + 2;
-		twl4030_i2c_write_u8(TWL4030_MODULE_PWMA, c, TWL_PWMA_PWMAOFF);
+		twl_i2c_write_u8(TWL4030_MODULE_PWMA, c, TWL_PWMA_PWMAOFF);
 		bklight_level = level;
 	}
 	return 0;
diff --git a/drivers/video/omap/lcd_osk.c b/drivers/video/omap/lcd_osk.c
index bb21d7dca39e..b87e8b83f29c 100644
--- a/drivers/video/omap/lcd_osk.c
+++ b/drivers/video/omap/lcd_osk.c
@@ -25,7 +25,7 @@
 
 #include <mach/gpio.h>
 #include <plat/mux.h>
-#include <plat/omapfb.h>
+#include "omapfb.h"
 
 static int osk_panel_init(struct lcd_panel *panel, struct omapfb_device *fbdev)
 {
diff --git a/drivers/video/omap/lcd_overo.c b/drivers/video/omap/lcd_overo.c
index b0f86e514cde..564933ffac6e 100644
--- a/drivers/video/omap/lcd_overo.c
+++ b/drivers/video/omap/lcd_overo.c
@@ -21,13 +21,14 @@
 
 #include <linux/module.h>
 #include <linux/platform_device.h>
-#include <linux/i2c/twl4030.h>
+#include <linux/i2c/twl.h>
 
 #include <mach/gpio.h>
 #include <plat/mux.h>
-#include <plat/omapfb.h>
 #include <asm/mach-types.h>
 
+#include "omapfb.h"
+
 #define LCD_ENABLE       144
 
 static int overo_panel_init(struct lcd_panel *panel,
diff --git a/drivers/video/omap/lcd_palmte.c b/drivers/video/omap/lcd_palmte.c
index d30289603ce8..4cb301750d02 100644
--- a/drivers/video/omap/lcd_palmte.c
+++ b/drivers/video/omap/lcd_palmte.c
@@ -24,7 +24,7 @@
 #include <linux/io.h>
 
 #include <plat/fpga.h>
-#include <plat/omapfb.h>
+#include "omapfb.h"
 
 static int palmte_panel_init(struct lcd_panel *panel,
 				struct omapfb_device *fbdev)
diff --git a/drivers/video/omap/lcd_palmtt.c b/drivers/video/omap/lcd_palmtt.c
index 557424fb6df1..ff0e6d7ab3a2 100644
--- a/drivers/video/omap/lcd_palmtt.c
+++ b/drivers/video/omap/lcd_palmtt.c
@@ -30,7 +30,7 @@ GPIO13 - screen blanking
 #include <linux/io.h>
 
 #include <mach/gpio.h>
-#include <plat/omapfb.h>
+#include "omapfb.h"
 
 static int palmtt_panel_init(struct lcd_panel *panel,
 	struct omapfb_device *fbdev)
diff --git a/drivers/video/omap/lcd_palmz71.c b/drivers/video/omap/lcd_palmz71.c
index 5f4b5b2c1f41..2334e56536bc 100644
--- a/drivers/video/omap/lcd_palmz71.c
+++ b/drivers/video/omap/lcd_palmz71.c
@@ -24,7 +24,7 @@
 #include <linux/platform_device.h>
 #include <linux/io.h>
 
-#include <plat/omapfb.h>
+#include "omapfb.h"
 
 static int palmz71_panel_init(struct lcd_panel *panel,
 			      struct omapfb_device *fbdev)
diff --git a/drivers/video/omap/lcdc.c b/drivers/video/omap/lcdc.c
index 5f32cafbf74c..a33483910dc8 100644
--- a/drivers/video/omap/lcdc.c
+++ b/drivers/video/omap/lcdc.c
@@ -29,47 +29,17 @@
 #include <linux/vmalloc.h>
 #include <linux/clk.h>
 
+#include <mach/lcdc.h>
 #include <plat/dma.h>
-#include <plat/omapfb.h>
 
 #include <asm/mach-types.h>
 
+#include "omapfb.h"
+
 #include "lcdc.h"
 
 #define MODULE_NAME			"lcdc"
 
-#define OMAP_LCDC_BASE			0xfffec000
-#define OMAP_LCDC_SIZE			256
-#define OMAP_LCDC_IRQ			INT_LCD_CTRL
-
-#define OMAP_LCDC_CONTROL		(OMAP_LCDC_BASE + 0x00)
-#define OMAP_LCDC_TIMING0		(OMAP_LCDC_BASE + 0x04)
-#define OMAP_LCDC_TIMING1		(OMAP_LCDC_BASE + 0x08)
-#define OMAP_LCDC_TIMING2		(OMAP_LCDC_BASE + 0x0c)
-#define OMAP_LCDC_STATUS		(OMAP_LCDC_BASE + 0x10)
-#define OMAP_LCDC_SUBPANEL		(OMAP_LCDC_BASE + 0x14)
-#define OMAP_LCDC_LINE_INT		(OMAP_LCDC_BASE + 0x18)
-#define OMAP_LCDC_DISPLAY_STATUS	(OMAP_LCDC_BASE + 0x1c)
-
-#define OMAP_LCDC_STAT_DONE		(1 << 0)
-#define OMAP_LCDC_STAT_VSYNC		(1 << 1)
-#define OMAP_LCDC_STAT_SYNC_LOST	(1 << 2)
-#define OMAP_LCDC_STAT_ABC		(1 << 3)
-#define OMAP_LCDC_STAT_LINE_INT		(1 << 4)
-#define OMAP_LCDC_STAT_FUF		(1 << 5)
-#define OMAP_LCDC_STAT_LOADED_PALETTE	(1 << 6)
-
-#define OMAP_LCDC_CTRL_LCD_EN		(1 << 0)
-#define OMAP_LCDC_CTRL_LCD_TFT		(1 << 7)
-#define OMAP_LCDC_CTRL_LINE_IRQ_CLR_SEL	(1 << 10)
-
-#define OMAP_LCDC_IRQ_VSYNC		(1 << 2)
-#define OMAP_LCDC_IRQ_DONE		(1 << 3)
-#define OMAP_LCDC_IRQ_LOADED_PALETTE	(1 << 4)
-#define OMAP_LCDC_IRQ_LINE_NIRQ		(1 << 5)
-#define OMAP_LCDC_IRQ_LINE		(1 << 6)
-#define OMAP_LCDC_IRQ_MASK		(((1 << 5) - 1) << 2)
-
 #define MAX_PALETTE_SIZE		PAGE_SIZE
 
 enum lcdc_load_mode {
diff --git a/drivers/video/omap/omapfb.h b/drivers/video/omap/omapfb.h
new file mode 100644
index 000000000000..af3c9e571ec3
--- /dev/null
+++ b/drivers/video/omap/omapfb.h
@@ -0,0 +1,229 @@
+/*
+ * File: drivers/video/omap/omapfb.h
+ *
+ * Framebuffer driver for TI OMAP boards
+ *
+ * Copyright (C) 2004 Nokia Corporation
+ * Author: Imre Deak <imre.deak@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
+ */
+
+#ifndef __OMAPFB_H
+#define __OMAPFB_H
+
+#include <linux/fb.h>
+#include <linux/mutex.h>
+#include <linux/omapfb.h>
+
+#define OMAPFB_EVENT_READY	1
+#define OMAPFB_EVENT_DISABLED	2
+
+#define OMAP_LCDC_INV_VSYNC             0x0001
+#define OMAP_LCDC_INV_HSYNC             0x0002
+#define OMAP_LCDC_INV_PIX_CLOCK         0x0004
+#define OMAP_LCDC_INV_OUTPUT_EN         0x0008
+#define OMAP_LCDC_HSVS_RISING_EDGE      0x0010
+#define OMAP_LCDC_HSVS_OPPOSITE         0x0020
+
+#define OMAP_LCDC_SIGNAL_MASK		0x003f
+
+#define OMAP_LCDC_PANEL_TFT		0x0100
+
+#define OMAPFB_PLANE_XRES_MIN		8
+#define OMAPFB_PLANE_YRES_MIN		8
+
+struct omapfb_device;
+
+struct lcd_panel {
+	const char	*name;
+	int		config;		/* TFT/STN, signal inversion */
+	int		bpp;		/* Pixel format in fb mem */
+	int		data_lines;	/* Lines on LCD HW interface */
+
+	int		x_res, y_res;
+	int		pixel_clock;	/* In kHz */
+	int		hsw;		/* Horizontal synchronization
+					   pulse width */
+	int		hfp;		/* Horizontal front porch */
+	int		hbp;		/* Horizontal back porch */
+	int		vsw;		/* Vertical synchronization
+					   pulse width */
+	int		vfp;		/* Vertical front porch */
+	int		vbp;		/* Vertical back porch */
+	int		acb;		/* ac-bias pin frequency */
+	int		pcd;		/* pixel clock divider.
+					   Obsolete use pixel_clock instead */
+
+	int		(*init)		(struct lcd_panel *panel,
+					 struct omapfb_device *fbdev);
+	void		(*cleanup)	(struct lcd_panel *panel);
+	int		(*enable)	(struct lcd_panel *panel);
+	void		(*disable)	(struct lcd_panel *panel);
+	unsigned long	(*get_caps)	(struct lcd_panel *panel);
+	int		(*set_bklight_level)(struct lcd_panel *panel,
+					     unsigned int level);
+	unsigned int	(*get_bklight_level)(struct lcd_panel *panel);
+	unsigned int	(*get_bklight_max)  (struct lcd_panel *panel);
+	int		(*run_test)	(struct lcd_panel *panel, int test_num);
+};
+
+struct extif_timings {
+	int cs_on_time;
+	int cs_off_time;
+	int we_on_time;
+	int we_off_time;
+	int re_on_time;
+	int re_off_time;
+	int we_cycle_time;
+	int re_cycle_time;
+	int cs_pulse_width;
+	int access_time;
+
+	int clk_div;
+
+	u32 tim[5];		/* set by extif->convert_timings */
+
+	int converted;
+};
+
+struct lcd_ctrl_extif {
+	int  (*init)		(struct omapfb_device *fbdev);
+	void (*cleanup)		(void);
+	void (*get_clk_info)	(u32 *clk_period, u32 *max_clk_div);
+	unsigned long (*get_max_tx_rate)(void);
+	int  (*convert_timings)	(struct extif_timings *timings);
+	void (*set_timings)	(const struct extif_timings *timings);
+	void (*set_bits_per_cycle)(int bpc);
+	void (*write_command)	(const void *buf, unsigned int len);
+	void (*read_data)	(void *buf, unsigned int len);
+	void (*write_data)	(const void *buf, unsigned int len);
+	void (*transfer_area)	(int width, int height,
+				 void (callback)(void *data), void *data);
+	int  (*setup_tearsync)	(unsigned pin_cnt,
+				 unsigned hs_pulse_time, unsigned vs_pulse_time,
+				 int hs_pol_inv, int vs_pol_inv, int div);
+	int  (*enable_tearsync) (int enable, unsigned line);
+
+	unsigned long		max_transmit_size;
+};
+
+struct omapfb_notifier_block {
+	struct notifier_block	nb;
+	void			*data;
+	int			plane_idx;
+};
+
+typedef int (*omapfb_notifier_callback_t)(struct notifier_block *,
+					  unsigned long event,
+					  void *fbi);
+
+struct lcd_ctrl {
+	const char	*name;
+	void		*data;
+
+	int		(*init)		  (struct omapfb_device *fbdev,
+					   int ext_mode,
+					   struct omapfb_mem_desc *req_md);
+	void		(*cleanup)	  (void);
+	void		(*bind_client)	  (struct omapfb_notifier_block *nb);
+	void		(*get_caps)	  (int plane, struct omapfb_caps *caps);
+	int		(*set_update_mode)(enum omapfb_update_mode mode);
+	enum omapfb_update_mode (*get_update_mode)(void);
+	int		(*setup_plane)	  (int plane, int channel_out,
+					   unsigned long offset,
+					   int screen_width,
+					   int pos_x, int pos_y, int width,
+					   int height, int color_mode);
+	int		(*set_rotate)	  (int angle);
+	int		(*setup_mem)	  (int plane, size_t size,
+					   int mem_type, unsigned long *paddr);
+	int		(*mmap)		  (struct fb_info *info,
+					   struct vm_area_struct *vma);
+	int		(*set_scale)	  (int plane,
+					   int orig_width, int orig_height,
+					   int out_width, int out_height);
+	int		(*enable_plane)	  (int plane, int enable);
+	int		(*update_window)  (struct fb_info *fbi,
+					   struct omapfb_update_window *win,
+					   void (*callback)(void *),
+					   void *callback_data);
+	void		(*sync)		  (void);
+	void		(*suspend)	  (void);
+	void		(*resume)	  (void);
+	int		(*run_test)	  (int test_num);
+	int		(*setcolreg)	  (u_int regno, u16 red, u16 green,
+					   u16 blue, u16 transp,
+					   int update_hw_mem);
+	int		(*set_color_key)  (struct omapfb_color_key *ck);
+	int		(*get_color_key)  (struct omapfb_color_key *ck);
+};
+
+enum omapfb_state {
+	OMAPFB_DISABLED		= 0,
+	OMAPFB_SUSPENDED	= 99,
+	OMAPFB_ACTIVE		= 100
+};
+
+struct omapfb_plane_struct {
+	int				idx;
+	struct omapfb_plane_info	info;
+	enum omapfb_color_format	color_mode;
+	struct omapfb_device		*fbdev;
+};
+
+struct omapfb_device {
+	int			state;
+	int                     ext_lcdc;		/* Using external
+							   LCD controller */
+	struct mutex		rqueue_mutex;
+
+	int			palette_size;
+	u32			pseudo_palette[17];
+
+	struct lcd_panel	*panel;			/* LCD panel */
+	const struct lcd_ctrl	*ctrl;			/* LCD controller */
+	const struct lcd_ctrl	*int_ctrl;		/* internal LCD ctrl */
+	struct lcd_ctrl_extif	*ext_if;		/* LCD ctrl external
+							   interface */
+	struct device		*dev;
+	struct fb_var_screeninfo	new_var;	/* for mode changes */
+
+	struct omapfb_mem_desc		mem_desc;
+	struct fb_info			*fb_info[OMAPFB_PLANE_NUM];
+
+	struct platform_device	*dssdev;	/* dummy dev for clocks */
+};
+
+#ifdef CONFIG_ARCH_OMAP1
+extern struct lcd_ctrl omap1_lcd_ctrl;
+#else
+extern struct lcd_ctrl omap2_disp_ctrl;
+#endif
+
+extern void omapfb_register_panel(struct lcd_panel *panel);
+extern void omapfb_write_first_pixel(struct omapfb_device *fbdev, u16 pixval);
+extern void omapfb_notify_clients(struct omapfb_device *fbdev,
+				  unsigned long event);
+extern int  omapfb_register_client(struct omapfb_notifier_block *nb,
+				   omapfb_notifier_callback_t callback,
+				   void *callback_data);
+extern int  omapfb_unregister_client(struct omapfb_notifier_block *nb);
+extern int  omapfb_update_window_async(struct fb_info *fbi,
+				       struct omapfb_update_window *win,
+				       void (*callback)(void *),
+				       void *callback_data);
+
+#endif /* __OMAPFB_H */
diff --git a/drivers/video/omap/omapfb_main.c b/drivers/video/omap/omapfb_main.c
index f900a43db8d7..2c4f470fa086 100644
--- a/drivers/video/omap/omapfb_main.c
+++ b/drivers/video/omap/omapfb_main.c
@@ -29,8 +29,8 @@
 #include <linux/uaccess.h>
 
 #include <plat/dma.h>
-#include <plat/omapfb.h>
 
+#include "omapfb.h"
 #include "lcdc.h"
 #include "dispc.h"
 
@@ -83,6 +83,19 @@ static struct caps_table_struct color_caps[] = {
 	{ 1 << OMAPFB_COLOR_YUY422,	"YUY422", },
 };
 
+static void omapdss_release(struct device *dev)
+{
+}
+
+/* dummy device for clocks */
+static struct platform_device omapdss_device = {
+	.name		= "omapdss",
+	.id		= -1,
+	.dev            = {
+		.release = omapdss_release,
+	},
+};
+
 /*
  * ---------------------------------------------------------------------------
  * LCD panel
@@ -1700,6 +1713,7 @@ static int omapfb_do_probe(struct platform_device *pdev,
 
 	fbdev->dev = &pdev->dev;
 	fbdev->panel = panel;
+	fbdev->dssdev = &omapdss_device;
 	platform_set_drvdata(pdev, fbdev);
 
 	mutex_init(&fbdev->rqueue_mutex);
@@ -1814,8 +1828,16 @@ cleanup:
 
 static int omapfb_probe(struct platform_device *pdev)
 {
+	int r;
+
 	BUG_ON(fbdev_pdev != NULL);
 
+	r = platform_device_register(&omapdss_device);
+	if (r) {
+		dev_err(&pdev->dev, "can't register omapdss device\n");
+		return r;
+	}
+
 	/* Delay actual initialization until the LCD is registered */
 	fbdev_pdev = pdev;
 	if (fbdev_panel != NULL)
@@ -1843,6 +1865,9 @@ static int omapfb_remove(struct platform_device *pdev)
 	fbdev->state = OMAPFB_DISABLED;
 	omapfb_free_resources(fbdev, saved_state);
 
+	platform_device_unregister(&omapdss_device);
+	fbdev->dssdev = NULL;
+
 	return 0;
 }
 
diff --git a/drivers/video/omap/rfbi.c b/drivers/video/omap/rfbi.c
index c90fa39486b4..1162603c72e5 100644
--- a/drivers/video/omap/rfbi.c
+++ b/drivers/video/omap/rfbi.c
@@ -27,8 +27,7 @@
 #include <linux/clk.h>
 #include <linux/io.h>
 
-#include <plat/omapfb.h>
-
+#include "omapfb.h"
 #include "dispc.h"
 
 /* To work around an RFBI transfer rate limitation */
@@ -84,13 +83,13 @@ static inline u32 rfbi_read_reg(int idx)
 
 static int rfbi_get_clocks(void)
 {
-	rfbi.dss_ick = clk_get(rfbi.fbdev->dev, "ick");
+	rfbi.dss_ick = clk_get(&dispc.fbdev->dssdev->dev, "ick");
 	if (IS_ERR(rfbi.dss_ick)) {
 		dev_err(rfbi.fbdev->dev, "can't get ick\n");
 		return PTR_ERR(rfbi.dss_ick);
 	}
 
-	rfbi.dss1_fck = clk_get(rfbi.fbdev->dev, "dss1_fck");
+	rfbi.dss1_fck = clk_get(&dispc.fbdev->dssdev->dev, "dss1_fck");
 	if (IS_ERR(rfbi.dss1_fck)) {
 		dev_err(rfbi.fbdev->dev, "can't get dss1_fck\n");
 		clk_put(rfbi.dss_ick);
diff --git a/drivers/video/omap/sossi.c b/drivers/video/omap/sossi.c
index 79dc84f09713..8fb7c708f563 100644
--- a/drivers/video/omap/sossi.c
+++ b/drivers/video/omap/sossi.c
@@ -23,10 +23,11 @@
 #include <linux/clk.h>
 #include <linux/irq.h>
 #include <linux/io.h>
+#include <linux/interrupt.h>
 
 #include <plat/dma.h>
-#include <plat/omapfb.h>
 
+#include "omapfb.h"
 #include "lcdc.h"
 
 #define MODULE_NAME		"omapfb-sossi"
diff --git a/drivers/video/omap2/Kconfig b/drivers/video/omap2/Kconfig
new file mode 100644
index 000000000000..d877c361abda
--- /dev/null
+++ b/drivers/video/omap2/Kconfig
@@ -0,0 +1,9 @@
+config OMAP2_VRAM
+	bool
+
+config OMAP2_VRFB
+	bool
+
+source "drivers/video/omap2/dss/Kconfig"
+source "drivers/video/omap2/omapfb/Kconfig"
+source "drivers/video/omap2/displays/Kconfig"
diff --git a/drivers/video/omap2/Makefile b/drivers/video/omap2/Makefile
new file mode 100644
index 000000000000..d853d05dad31
--- /dev/null
+++ b/drivers/video/omap2/Makefile
@@ -0,0 +1,6 @@
+obj-$(CONFIG_OMAP2_VRAM) += vram.o
+obj-$(CONFIG_OMAP2_VRFB) += vrfb.o
+
+obj-y += dss/
+obj-y += omapfb/
+obj-y += displays/
diff --git a/drivers/video/omap2/displays/Kconfig b/drivers/video/omap2/displays/Kconfig
new file mode 100644
index 000000000000..b12a59c9c50a
--- /dev/null
+++ b/drivers/video/omap2/displays/Kconfig
@@ -0,0 +1,22 @@
+menu "OMAP2/3 Display Device Drivers"
+        depends on OMAP2_DSS
+
+config PANEL_GENERIC
+        tristate "Generic Panel"
+        help
+	  Generic panel driver.
+	  Used for DVI output for Beagle and OMAP3 SDP.
+
+config PANEL_SHARP_LS037V7DW01
+        tristate "Sharp LS037V7DW01 LCD Panel"
+        depends on OMAP2_DSS
+        help
+          LCD Panel used in TI's SDP3430 and EVM boards
+
+config PANEL_TAAL
+        tristate "Taal DSI Panel"
+        depends on OMAP2_DSS_DSI
+        help
+          Taal DSI command mode panel from TPO.
+
+endmenu
diff --git a/drivers/video/omap2/displays/Makefile b/drivers/video/omap2/displays/Makefile
new file mode 100644
index 000000000000..955646440b3a
--- /dev/null
+++ b/drivers/video/omap2/displays/Makefile
@@ -0,0 +1,4 @@
+obj-$(CONFIG_PANEL_GENERIC) += panel-generic.o
+obj-$(CONFIG_PANEL_SHARP_LS037V7DW01) += panel-sharp-ls037v7dw01.o
+
+obj-$(CONFIG_PANEL_TAAL) += panel-taal.o
diff --git a/drivers/video/omap2/displays/panel-generic.c b/drivers/video/omap2/displays/panel-generic.c
new file mode 100644
index 000000000000..eb48d1afd800
--- /dev/null
+++ b/drivers/video/omap2/displays/panel-generic.c
@@ -0,0 +1,104 @@
+/*
+ * Generic panel support
+ *
+ * Copyright (C) 2008 Nokia Corporation
+ * Author: Tomi Valkeinen <tomi.valkeinen@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <linux/module.h>
+#include <linux/delay.h>
+
+#include <plat/display.h>
+
+static struct omap_video_timings generic_panel_timings = {
+	/* 640 x 480 @ 60 Hz  Reduced blanking VESA CVT 0.31M3-R */
+	.x_res		= 640,
+	.y_res		= 480,
+	.pixel_clock	= 23500,
+	.hfp		= 48,
+	.hsw		= 32,
+	.hbp		= 80,
+	.vfp		= 3,
+	.vsw		= 4,
+	.vbp		= 7,
+};
+
+static int generic_panel_probe(struct omap_dss_device *dssdev)
+{
+	dssdev->panel.config = OMAP_DSS_LCD_TFT;
+	dssdev->panel.timings = generic_panel_timings;
+
+	return 0;
+}
+
+static void generic_panel_remove(struct omap_dss_device *dssdev)
+{
+}
+
+static int generic_panel_enable(struct omap_dss_device *dssdev)
+{
+	int r = 0;
+
+	if (dssdev->platform_enable)
+		r = dssdev->platform_enable(dssdev);
+
+	return r;
+}
+
+static void generic_panel_disable(struct omap_dss_device *dssdev)
+{
+	if (dssdev->platform_disable)
+		dssdev->platform_disable(dssdev);
+}
+
+static int generic_panel_suspend(struct omap_dss_device *dssdev)
+{
+	generic_panel_disable(dssdev);
+	return 0;
+}
+
+static int generic_panel_resume(struct omap_dss_device *dssdev)
+{
+	return generic_panel_enable(dssdev);
+}
+
+static struct omap_dss_driver generic_driver = {
+	.probe		= generic_panel_probe,
+	.remove		= generic_panel_remove,
+
+	.enable		= generic_panel_enable,
+	.disable	= generic_panel_disable,
+	.suspend	= generic_panel_suspend,
+	.resume		= generic_panel_resume,
+
+	.driver         = {
+		.name   = "generic_panel",
+		.owner  = THIS_MODULE,
+	},
+};
+
+static int __init generic_panel_drv_init(void)
+{
+	return omap_dss_register_driver(&generic_driver);
+}
+
+static void __exit generic_panel_drv_exit(void)
+{
+	omap_dss_unregister_driver(&generic_driver);
+}
+
+module_init(generic_panel_drv_init);
+module_exit(generic_panel_drv_exit);
+MODULE_LICENSE("GPL");
diff --git a/drivers/video/omap2/displays/panel-sharp-ls037v7dw01.c b/drivers/video/omap2/displays/panel-sharp-ls037v7dw01.c
new file mode 100644
index 000000000000..bbe880bbe795
--- /dev/null
+++ b/drivers/video/omap2/displays/panel-sharp-ls037v7dw01.c
@@ -0,0 +1,153 @@
+/*
+ * LCD panel driver for Sharp LS037V7DW01
+ *
+ * Copyright (C) 2008 Nokia Corporation
+ * Author: Tomi Valkeinen <tomi.valkeinen@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <linux/module.h>
+#include <linux/delay.h>
+#include <linux/device.h>
+#include <linux/regulator/consumer.h>
+#include <linux/err.h>
+
+#include <plat/display.h>
+
+struct sharp_data {
+	/* XXX This regulator should actually be in SDP board file, not here,
+	 * as it doesn't actually power the LCD, but something else that
+	 * affects the output to LCD (I think. Somebody clarify). It doesn't do
+	 * harm here, as SDP is the only board using this currently */
+	struct regulator *vdvi_reg;
+};
+
+static struct omap_video_timings sharp_ls_timings = {
+	.x_res = 480,
+	.y_res = 640,
+
+	.pixel_clock	= 19200,
+
+	.hsw		= 2,
+	.hfp		= 1,
+	.hbp		= 28,
+
+	.vsw		= 1,
+	.vfp		= 1,
+	.vbp		= 1,
+};
+
+static int sharp_ls_panel_probe(struct omap_dss_device *dssdev)
+{
+	struct sharp_data *sd;
+
+	dssdev->panel.config = OMAP_DSS_LCD_TFT | OMAP_DSS_LCD_IVS |
+		OMAP_DSS_LCD_IHS;
+	dssdev->panel.acb = 0x28;
+	dssdev->panel.timings = sharp_ls_timings;
+
+	sd = kzalloc(sizeof(*sd), GFP_KERNEL);
+	if (!sd)
+		return -ENOMEM;
+
+	dev_set_drvdata(&dssdev->dev, sd);
+
+	sd->vdvi_reg = regulator_get(&dssdev->dev, "vdvi");
+	if (IS_ERR(sd->vdvi_reg)) {
+		kfree(sd);
+		pr_err("failed to get VDVI regulator\n");
+		return PTR_ERR(sd->vdvi_reg);
+	}
+
+	return 0;
+}
+
+static void sharp_ls_panel_remove(struct omap_dss_device *dssdev)
+{
+	struct sharp_data *sd = dev_get_drvdata(&dssdev->dev);
+
+	regulator_put(sd->vdvi_reg);
+
+	kfree(sd);
+}
+
+static int sharp_ls_panel_enable(struct omap_dss_device *dssdev)
+{
+	struct sharp_data *sd = dev_get_drvdata(&dssdev->dev);
+	int r = 0;
+
+	/* wait couple of vsyncs until enabling the LCD */
+	msleep(50);
+
+	regulator_enable(sd->vdvi_reg);
+
+	if (dssdev->platform_enable)
+		r = dssdev->platform_enable(dssdev);
+
+	return r;
+}
+
+static void sharp_ls_panel_disable(struct omap_dss_device *dssdev)
+{
+	struct sharp_data *sd = dev_get_drvdata(&dssdev->dev);
+
+	if (dssdev->platform_disable)
+		dssdev->platform_disable(dssdev);
+
+	regulator_disable(sd->vdvi_reg);
+
+	/* wait at least 5 vsyncs after disabling the LCD */
+
+	msleep(100);
+}
+
+static int sharp_ls_panel_suspend(struct omap_dss_device *dssdev)
+{
+	sharp_ls_panel_disable(dssdev);
+	return 0;
+}
+
+static int sharp_ls_panel_resume(struct omap_dss_device *dssdev)
+{
+	return sharp_ls_panel_enable(dssdev);
+}
+
+static struct omap_dss_driver sharp_ls_driver = {
+	.probe		= sharp_ls_panel_probe,
+	.remove		= sharp_ls_panel_remove,
+
+	.enable		= sharp_ls_panel_enable,
+	.disable	= sharp_ls_panel_disable,
+	.suspend	= sharp_ls_panel_suspend,
+	.resume		= sharp_ls_panel_resume,
+
+	.driver         = {
+		.name   = "sharp_ls_panel",
+		.owner  = THIS_MODULE,
+	},
+};
+
+static int __init sharp_ls_panel_drv_init(void)
+{
+	return omap_dss_register_driver(&sharp_ls_driver);
+}
+
+static void __exit sharp_ls_panel_drv_exit(void)
+{
+	omap_dss_unregister_driver(&sharp_ls_driver);
+}
+
+module_init(sharp_ls_panel_drv_init);
+module_exit(sharp_ls_panel_drv_exit);
+MODULE_LICENSE("GPL");
diff --git a/drivers/video/omap2/displays/panel-taal.c b/drivers/video/omap2/displays/panel-taal.c
new file mode 100644
index 000000000000..1f01dfc5e52e
--- /dev/null
+++ b/drivers/video/omap2/displays/panel-taal.c
@@ -0,0 +1,1003 @@
+/*
+ * Taal DSI command mode panel
+ *
+ * Copyright (C) 2009 Nokia Corporation
+ * Author: Tomi Valkeinen <tomi.valkeinen@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+/*#define DEBUG*/
+
+#include <linux/module.h>
+#include <linux/delay.h>
+#include <linux/err.h>
+#include <linux/jiffies.h>
+#include <linux/sched.h>
+#include <linux/backlight.h>
+#include <linux/fb.h>
+#include <linux/interrupt.h>
+#include <linux/gpio.h>
+#include <linux/completion.h>
+#include <linux/workqueue.h>
+
+#include <plat/display.h>
+
+/* DSI Virtual channel. Hardcoded for now. */
+#define TCH 0
+
+#define DCS_READ_NUM_ERRORS	0x05
+#define DCS_READ_POWER_MODE	0x0a
+#define DCS_READ_MADCTL		0x0b
+#define DCS_READ_PIXEL_FORMAT	0x0c
+#define DCS_RDDSDR		0x0f
+#define DCS_SLEEP_IN		0x10
+#define DCS_SLEEP_OUT		0x11
+#define DCS_DISPLAY_OFF		0x28
+#define DCS_DISPLAY_ON		0x29
+#define DCS_COLUMN_ADDR		0x2a
+#define DCS_PAGE_ADDR		0x2b
+#define DCS_MEMORY_WRITE	0x2c
+#define DCS_TEAR_OFF		0x34
+#define DCS_TEAR_ON		0x35
+#define DCS_MEM_ACC_CTRL	0x36
+#define DCS_PIXEL_FORMAT	0x3a
+#define DCS_BRIGHTNESS		0x51
+#define DCS_CTRL_DISPLAY	0x53
+#define DCS_WRITE_CABC		0x55
+#define DCS_READ_CABC		0x56
+#define DCS_GET_ID1		0xda
+#define DCS_GET_ID2		0xdb
+#define DCS_GET_ID3		0xdc
+
+/* #define TAAL_USE_ESD_CHECK */
+#define TAAL_ESD_CHECK_PERIOD	msecs_to_jiffies(5000)
+
+struct taal_data {
+	struct backlight_device *bldev;
+
+	unsigned long	hw_guard_end;	/* next value of jiffies when we can
+					 * issue the next sleep in/out command
+					 */
+	unsigned long	hw_guard_wait;	/* max guard time in jiffies */
+
+	struct omap_dss_device *dssdev;
+
+	bool enabled;
+	u8 rotate;
+	bool mirror;
+
+	bool te_enabled;
+	bool use_ext_te;
+	struct completion te_completion;
+
+	bool use_dsi_bl;
+
+	bool cabc_broken;
+	unsigned cabc_mode;
+
+	bool intro_printed;
+
+	struct workqueue_struct *esd_wq;
+	struct delayed_work esd_work;
+};
+
+static void taal_esd_work(struct work_struct *work);
+
+static void hw_guard_start(struct taal_data *td, int guard_msec)
+{
+	td->hw_guard_wait = msecs_to_jiffies(guard_msec);
+	td->hw_guard_end = jiffies + td->hw_guard_wait;
+}
+
+static void hw_guard_wait(struct taal_data *td)
+{
+	unsigned long wait = td->hw_guard_end - jiffies;
+
+	if ((long)wait > 0 && wait <= td->hw_guard_wait) {
+		set_current_state(TASK_UNINTERRUPTIBLE);
+		schedule_timeout(wait);
+	}
+}
+
+static int taal_dcs_read_1(u8 dcs_cmd, u8 *data)
+{
+	int r;
+	u8 buf[1];
+
+	r = dsi_vc_dcs_read(TCH, dcs_cmd, buf, 1);
+
+	if (r < 0)
+		return r;
+
+	*data = buf[0];
+
+	return 0;
+}
+
+static int taal_dcs_write_0(u8 dcs_cmd)
+{
+	return dsi_vc_dcs_write(TCH, &dcs_cmd, 1);
+}
+
+static int taal_dcs_write_1(u8 dcs_cmd, u8 param)
+{
+	u8 buf[2];
+	buf[0] = dcs_cmd;
+	buf[1] = param;
+	return dsi_vc_dcs_write(TCH, buf, 2);
+}
+
+static int taal_sleep_in(struct taal_data *td)
+
+{
+	u8 cmd;
+	int r;
+
+	hw_guard_wait(td);
+
+	cmd = DCS_SLEEP_IN;
+	r = dsi_vc_dcs_write_nosync(TCH, &cmd, 1);
+	if (r)
+		return r;
+
+	hw_guard_start(td, 120);
+
+	msleep(5);
+
+	return 0;
+}
+
+static int taal_sleep_out(struct taal_data *td)
+{
+	int r;
+
+	hw_guard_wait(td);
+
+	r = taal_dcs_write_0(DCS_SLEEP_OUT);
+	if (r)
+		return r;
+
+	hw_guard_start(td, 120);
+
+	msleep(5);
+
+	return 0;
+}
+
+static int taal_get_id(u8 *id1, u8 *id2, u8 *id3)
+{
+	int r;
+
+	r = taal_dcs_read_1(DCS_GET_ID1, id1);
+	if (r)
+		return r;
+	r = taal_dcs_read_1(DCS_GET_ID2, id2);
+	if (r)
+		return r;
+	r = taal_dcs_read_1(DCS_GET_ID3, id3);
+	if (r)
+		return r;
+
+	return 0;
+}
+
+static int taal_set_addr_mode(u8 rotate, bool mirror)
+{
+	int r;
+	u8 mode;
+	int b5, b6, b7;
+
+	r = taal_dcs_read_1(DCS_READ_MADCTL, &mode);
+	if (r)
+		return r;
+
+	switch (rotate) {
+	default:
+	case 0:
+		b7 = 0;
+		b6 = 0;
+		b5 = 0;
+		break;
+	case 1:
+		b7 = 0;
+		b6 = 1;
+		b5 = 1;
+		break;
+	case 2:
+		b7 = 1;
+		b6 = 1;
+		b5 = 0;
+		break;
+	case 3:
+		b7 = 1;
+		b6 = 0;
+		b5 = 1;
+		break;
+	}
+
+	if (mirror)
+		b6 = !b6;
+
+	mode &= ~((1<<7) | (1<<6) | (1<<5));
+	mode |= (b7 << 7) | (b6 << 6) | (b5 << 5);
+
+	return taal_dcs_write_1(DCS_MEM_ACC_CTRL, mode);
+}
+
+static int taal_set_update_window(u16 x, u16 y, u16 w, u16 h)
+{
+	int r;
+	u16 x1 = x;
+	u16 x2 = x + w - 1;
+	u16 y1 = y;
+	u16 y2 = y + h - 1;
+
+	u8 buf[5];
+	buf[0] = DCS_COLUMN_ADDR;
+	buf[1] = (x1 >> 8) & 0xff;
+	buf[2] = (x1 >> 0) & 0xff;
+	buf[3] = (x2 >> 8) & 0xff;
+	buf[4] = (x2 >> 0) & 0xff;
+
+	r = dsi_vc_dcs_write_nosync(TCH, buf, sizeof(buf));
+	if (r)
+		return r;
+
+	buf[0] = DCS_PAGE_ADDR;
+	buf[1] = (y1 >> 8) & 0xff;
+	buf[2] = (y1 >> 0) & 0xff;
+	buf[3] = (y2 >> 8) & 0xff;
+	buf[4] = (y2 >> 0) & 0xff;
+
+	r = dsi_vc_dcs_write_nosync(TCH, buf, sizeof(buf));
+	if (r)
+		return r;
+
+	dsi_vc_send_bta_sync(TCH);
+
+	return r;
+}
+
+static int taal_bl_update_status(struct backlight_device *dev)
+{
+	struct omap_dss_device *dssdev = dev_get_drvdata(&dev->dev);
+	struct taal_data *td = dev_get_drvdata(&dssdev->dev);
+	int r;
+	int level;
+
+	if (dev->props.fb_blank == FB_BLANK_UNBLANK &&
+			dev->props.power == FB_BLANK_UNBLANK)
+		level = dev->props.brightness;
+	else
+		level = 0;
+
+	dev_dbg(&dssdev->dev, "update brightness to %d\n", level);
+
+	if (td->use_dsi_bl) {
+		if (td->enabled) {
+			dsi_bus_lock();
+			r = taal_dcs_write_1(DCS_BRIGHTNESS, level);
+			dsi_bus_unlock();
+			if (r)
+				return r;
+		}
+	} else {
+		if (!dssdev->set_backlight)
+			return -EINVAL;
+
+		r = dssdev->set_backlight(dssdev, level);
+		if (r)
+			return r;
+	}
+
+	return 0;
+}
+
+static int taal_bl_get_intensity(struct backlight_device *dev)
+{
+	if (dev->props.fb_blank == FB_BLANK_UNBLANK &&
+			dev->props.power == FB_BLANK_UNBLANK)
+		return dev->props.brightness;
+
+	return 0;
+}
+
+static struct backlight_ops taal_bl_ops = {
+	.get_brightness = taal_bl_get_intensity,
+	.update_status  = taal_bl_update_status,
+};
+
+static void taal_get_timings(struct omap_dss_device *dssdev,
+			struct omap_video_timings *timings)
+{
+	*timings = dssdev->panel.timings;
+}
+
+static void taal_get_resolution(struct omap_dss_device *dssdev,
+		u16 *xres, u16 *yres)
+{
+	struct taal_data *td = dev_get_drvdata(&dssdev->dev);
+
+	if (td->rotate == 0 || td->rotate == 2) {
+		*xres = dssdev->panel.timings.x_res;
+		*yres = dssdev->panel.timings.y_res;
+	} else {
+		*yres = dssdev->panel.timings.x_res;
+		*xres = dssdev->panel.timings.y_res;
+	}
+}
+
+static irqreturn_t taal_te_isr(int irq, void *data)
+{
+	struct omap_dss_device *dssdev = data;
+	struct taal_data *td = dev_get_drvdata(&dssdev->dev);
+
+	complete_all(&td->te_completion);
+
+	return IRQ_HANDLED;
+}
+
+static ssize_t taal_num_errors_show(struct device *dev,
+		struct device_attribute *attr, char *buf)
+{
+	struct omap_dss_device *dssdev = to_dss_device(dev);
+	struct taal_data *td = dev_get_drvdata(&dssdev->dev);
+	u8 errors;
+	int r;
+
+	if (td->enabled) {
+		dsi_bus_lock();
+		r = taal_dcs_read_1(DCS_READ_NUM_ERRORS, &errors);
+		dsi_bus_unlock();
+	} else {
+		r = -ENODEV;
+	}
+
+	if (r)
+		return r;
+
+	return snprintf(buf, PAGE_SIZE, "%d\n", errors);
+}
+
+static ssize_t taal_hw_revision_show(struct device *dev,
+		struct device_attribute *attr, char *buf)
+{
+	struct omap_dss_device *dssdev = to_dss_device(dev);
+	struct taal_data *td = dev_get_drvdata(&dssdev->dev);
+	u8 id1, id2, id3;
+	int r;
+
+	if (td->enabled) {
+		dsi_bus_lock();
+		r = taal_get_id(&id1, &id2, &id3);
+		dsi_bus_unlock();
+	} else {
+		r = -ENODEV;
+	}
+
+	if (r)
+		return r;
+
+	return snprintf(buf, PAGE_SIZE, "%02x.%02x.%02x\n", id1, id2, id3);
+}
+
+static const char *cabc_modes[] = {
+	"off",		/* used also always when CABC is not supported */
+	"ui",
+	"still-image",
+	"moving-image",
+};
+
+static ssize_t show_cabc_mode(struct device *dev,
+		struct device_attribute *attr,
+		char *buf)
+{
+	struct omap_dss_device *dssdev = to_dss_device(dev);
+	struct taal_data *td = dev_get_drvdata(&dssdev->dev);
+	const char *mode_str;
+	int mode;
+	int len;
+
+	mode = td->cabc_mode;
+
+	mode_str = "unknown";
+	if (mode >= 0 && mode < ARRAY_SIZE(cabc_modes))
+		mode_str = cabc_modes[mode];
+	len = snprintf(buf, PAGE_SIZE, "%s\n", mode_str);
+
+	return len < PAGE_SIZE - 1 ? len : PAGE_SIZE - 1;
+}
+
+static ssize_t store_cabc_mode(struct device *dev,
+		struct device_attribute *attr,
+		const char *buf, size_t count)
+{
+	struct omap_dss_device *dssdev = to_dss_device(dev);
+	struct taal_data *td = dev_get_drvdata(&dssdev->dev);
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(cabc_modes); i++) {
+		if (sysfs_streq(cabc_modes[i], buf))
+			break;
+	}
+
+	if (i == ARRAY_SIZE(cabc_modes))
+		return -EINVAL;
+
+	if (td->enabled) {
+		dsi_bus_lock();
+		if (!td->cabc_broken)
+			taal_dcs_write_1(DCS_WRITE_CABC, i);
+		dsi_bus_unlock();
+	}
+
+	td->cabc_mode = i;
+
+	return count;
+}
+
+static ssize_t show_cabc_available_modes(struct device *dev,
+		struct device_attribute *attr,
+		char *buf)
+{
+	int len;
+	int i;
+
+	for (i = 0, len = 0;
+	     len < PAGE_SIZE && i < ARRAY_SIZE(cabc_modes); i++)
+		len += snprintf(&buf[len], PAGE_SIZE - len, "%s%s%s",
+			i ? " " : "", cabc_modes[i],
+			i == ARRAY_SIZE(cabc_modes) - 1 ? "\n" : "");
+
+	return len < PAGE_SIZE ? len : PAGE_SIZE - 1;
+}
+
+static DEVICE_ATTR(num_dsi_errors, S_IRUGO, taal_num_errors_show, NULL);
+static DEVICE_ATTR(hw_revision, S_IRUGO, taal_hw_revision_show, NULL);
+static DEVICE_ATTR(cabc_mode, S_IRUGO | S_IWUSR,
+		show_cabc_mode, store_cabc_mode);
+static DEVICE_ATTR(cabc_available_modes, S_IRUGO,
+		show_cabc_available_modes, NULL);
+
+static struct attribute *taal_attrs[] = {
+	&dev_attr_num_dsi_errors.attr,
+	&dev_attr_hw_revision.attr,
+	&dev_attr_cabc_mode.attr,
+	&dev_attr_cabc_available_modes.attr,
+	NULL,
+};
+
+static struct attribute_group taal_attr_group = {
+	.attrs = taal_attrs,
+};
+
+static int taal_probe(struct omap_dss_device *dssdev)
+{
+	struct taal_data *td;
+	struct backlight_device *bldev;
+	int r;
+
+	const struct omap_video_timings taal_panel_timings = {
+		.x_res		= 864,
+		.y_res		= 480,
+	};
+
+	dev_dbg(&dssdev->dev, "probe\n");
+
+	dssdev->panel.config = OMAP_DSS_LCD_TFT;
+	dssdev->panel.timings = taal_panel_timings;
+	dssdev->ctrl.pixel_size = 24;
+
+	td = kzalloc(sizeof(*td), GFP_KERNEL);
+	if (!td) {
+		r = -ENOMEM;
+		goto err0;
+	}
+	td->dssdev = dssdev;
+
+	td->esd_wq = create_singlethread_workqueue("taal_esd");
+	if (td->esd_wq == NULL) {
+		dev_err(&dssdev->dev, "can't create ESD workqueue\n");
+		r = -ENOMEM;
+		goto err2;
+	}
+	INIT_DELAYED_WORK_DEFERRABLE(&td->esd_work, taal_esd_work);
+
+	dev_set_drvdata(&dssdev->dev, td);
+
+	dssdev->get_timings = taal_get_timings;
+	dssdev->get_resolution = taal_get_resolution;
+
+	/* if no platform set_backlight() defined, presume DSI backlight
+	 * control */
+	if (!dssdev->set_backlight)
+		td->use_dsi_bl = true;
+
+	bldev = backlight_device_register("taal", &dssdev->dev, dssdev,
+			&taal_bl_ops);
+	if (IS_ERR(bldev)) {
+		r = PTR_ERR(bldev);
+		goto err1;
+	}
+
+	td->bldev = bldev;
+
+	bldev->props.fb_blank = FB_BLANK_UNBLANK;
+	bldev->props.power = FB_BLANK_UNBLANK;
+	if (td->use_dsi_bl) {
+		bldev->props.max_brightness = 255;
+		bldev->props.brightness = 255;
+	} else {
+		bldev->props.max_brightness = 127;
+		bldev->props.brightness = 127;
+	}
+
+	taal_bl_update_status(bldev);
+
+	if (dssdev->phy.dsi.ext_te) {
+		int gpio = dssdev->phy.dsi.ext_te_gpio;
+
+		r = gpio_request(gpio, "taal irq");
+		if (r) {
+			dev_err(&dssdev->dev, "GPIO request failed\n");
+			goto err3;
+		}
+
+		gpio_direction_input(gpio);
+
+		r = request_irq(gpio_to_irq(gpio), taal_te_isr,
+				IRQF_DISABLED | IRQF_TRIGGER_RISING,
+				"taal vsync", dssdev);
+
+		if (r) {
+			dev_err(&dssdev->dev, "IRQ request failed\n");
+			gpio_free(gpio);
+			goto err3;
+		}
+
+		init_completion(&td->te_completion);
+
+		td->use_ext_te = true;
+	}
+
+	r = sysfs_create_group(&dssdev->dev.kobj, &taal_attr_group);
+	if (r) {
+		dev_err(&dssdev->dev, "failed to create sysfs files\n");
+		goto err4;
+	}
+
+	return 0;
+err4:
+	if (td->use_ext_te) {
+		int gpio = dssdev->phy.dsi.ext_te_gpio;
+		free_irq(gpio_to_irq(gpio), dssdev);
+		gpio_free(gpio);
+	}
+err3:
+	backlight_device_unregister(bldev);
+err2:
+	cancel_delayed_work_sync(&td->esd_work);
+	destroy_workqueue(td->esd_wq);
+err1:
+	kfree(td);
+err0:
+	return r;
+}
+
+static void taal_remove(struct omap_dss_device *dssdev)
+{
+	struct taal_data *td = dev_get_drvdata(&dssdev->dev);
+	struct backlight_device *bldev;
+
+	dev_dbg(&dssdev->dev, "remove\n");
+
+	sysfs_remove_group(&dssdev->dev.kobj, &taal_attr_group);
+
+	if (td->use_ext_te) {
+		int gpio = dssdev->phy.dsi.ext_te_gpio;
+		free_irq(gpio_to_irq(gpio), dssdev);
+		gpio_free(gpio);
+	}
+
+	bldev = td->bldev;
+	bldev->props.power = FB_BLANK_POWERDOWN;
+	taal_bl_update_status(bldev);
+	backlight_device_unregister(bldev);
+
+	cancel_delayed_work_sync(&td->esd_work);
+	destroy_workqueue(td->esd_wq);
+
+	kfree(td);
+}
+
+static int taal_enable(struct omap_dss_device *dssdev)
+{
+	struct taal_data *td = dev_get_drvdata(&dssdev->dev);
+	u8 id1, id2, id3;
+	int r;
+
+	dev_dbg(&dssdev->dev, "enable\n");
+
+	if (dssdev->platform_enable) {
+		r = dssdev->platform_enable(dssdev);
+		if (r)
+			return r;
+	}
+
+	/* it seems we have to wait a bit until taal is ready */
+	msleep(5);
+
+	r = taal_sleep_out(td);
+	if (r)
+		goto err;
+
+	r = taal_get_id(&id1, &id2, &id3);
+	if (r)
+		goto err;
+
+	/* on early revisions CABC is broken */
+	if (id2 == 0x00 || id2 == 0xff || id2 == 0x81)
+		td->cabc_broken = true;
+
+	taal_dcs_write_1(DCS_BRIGHTNESS, 0xff);
+	taal_dcs_write_1(DCS_CTRL_DISPLAY, (1<<2) | (1<<5)); /* BL | BCTRL */
+
+	taal_dcs_write_1(DCS_PIXEL_FORMAT, 0x7); /* 24bit/pixel */
+
+	taal_set_addr_mode(td->rotate, td->mirror);
+	if (!td->cabc_broken)
+		taal_dcs_write_1(DCS_WRITE_CABC, td->cabc_mode);
+
+	taal_dcs_write_0(DCS_DISPLAY_ON);
+
+#ifdef TAAL_USE_ESD_CHECK
+	queue_delayed_work(td->esd_wq, &td->esd_work, TAAL_ESD_CHECK_PERIOD);
+#endif
+
+	td->enabled = 1;
+
+	if (!td->intro_printed) {
+		dev_info(&dssdev->dev, "revision %02x.%02x.%02x\n",
+				id1, id2, id3);
+		if (td->cabc_broken)
+			dev_info(&dssdev->dev,
+					"old Taal version, CABC disabled\n");
+		td->intro_printed = true;
+	}
+
+	return 0;
+err:
+	if (dssdev->platform_disable)
+		dssdev->platform_disable(dssdev);
+
+	return r;
+}
+
+static void taal_disable(struct omap_dss_device *dssdev)
+{
+	struct taal_data *td = dev_get_drvdata(&dssdev->dev);
+
+	dev_dbg(&dssdev->dev, "disable\n");
+
+	cancel_delayed_work(&td->esd_work);
+
+	taal_dcs_write_0(DCS_DISPLAY_OFF);
+	taal_sleep_in(td);
+
+	/* wait a bit so that the message goes through */
+	msleep(10);
+
+	if (dssdev->platform_disable)
+		dssdev->platform_disable(dssdev);
+
+	td->enabled = 0;
+}
+
+static int taal_suspend(struct omap_dss_device *dssdev)
+{
+	struct taal_data *td = dev_get_drvdata(&dssdev->dev);
+	struct backlight_device *bldev = td->bldev;
+
+	bldev->props.power = FB_BLANK_POWERDOWN;
+	taal_bl_update_status(bldev);
+
+	return 0;
+}
+
+static int taal_resume(struct omap_dss_device *dssdev)
+{
+	struct taal_data *td = dev_get_drvdata(&dssdev->dev);
+	struct backlight_device *bldev = td->bldev;
+
+	bldev->props.power = FB_BLANK_UNBLANK;
+	taal_bl_update_status(bldev);
+
+	return 0;
+}
+
+static void taal_setup_update(struct omap_dss_device *dssdev,
+				    u16 x, u16 y, u16 w, u16 h)
+{
+	taal_set_update_window(x, y, w, h);
+}
+
+static int taal_enable_te(struct omap_dss_device *dssdev, bool enable)
+{
+	struct taal_data *td = dev_get_drvdata(&dssdev->dev);
+	int r;
+
+	td->te_enabled = enable;
+
+	if (enable)
+		r = taal_dcs_write_1(DCS_TEAR_ON, 0);
+	else
+		r = taal_dcs_write_0(DCS_TEAR_OFF);
+
+	return r;
+}
+
+static int taal_wait_te(struct omap_dss_device *dssdev)
+{
+	struct taal_data *td = dev_get_drvdata(&dssdev->dev);
+	long wait = msecs_to_jiffies(500);
+
+	if (!td->use_ext_te || !td->te_enabled)
+		return 0;
+
+	INIT_COMPLETION(td->te_completion);
+	wait = wait_for_completion_timeout(&td->te_completion, wait);
+	if (wait == 0) {
+		dev_err(&dssdev->dev, "timeout waiting TE\n");
+		return -ETIME;
+	}
+
+	return 0;
+}
+
+static int taal_rotate(struct omap_dss_device *dssdev, u8 rotate)
+{
+	struct taal_data *td = dev_get_drvdata(&dssdev->dev);
+	int r;
+
+	dev_dbg(&dssdev->dev, "rotate %d\n", rotate);
+
+	if (td->enabled) {
+		r = taal_set_addr_mode(rotate, td->mirror);
+
+		if (r)
+			return r;
+	}
+
+	td->rotate = rotate;
+
+	return 0;
+}
+
+static u8 taal_get_rotate(struct omap_dss_device *dssdev)
+{
+	struct taal_data *td = dev_get_drvdata(&dssdev->dev);
+	return td->rotate;
+}
+
+static int taal_mirror(struct omap_dss_device *dssdev, bool enable)
+{
+	struct taal_data *td = dev_get_drvdata(&dssdev->dev);
+	int r;
+
+	dev_dbg(&dssdev->dev, "mirror %d\n", enable);
+
+	if (td->enabled) {
+		r = taal_set_addr_mode(td->rotate, enable);
+
+		if (r)
+			return r;
+	}
+
+	td->mirror = enable;
+
+	return 0;
+}
+
+static bool taal_get_mirror(struct omap_dss_device *dssdev)
+{
+	struct taal_data *td = dev_get_drvdata(&dssdev->dev);
+	return td->mirror;
+}
+
+static int taal_run_test(struct omap_dss_device *dssdev, int test_num)
+{
+	u8 id1, id2, id3;
+	int r;
+
+	r = taal_dcs_read_1(DCS_GET_ID1, &id1);
+	if (r)
+		return r;
+	r = taal_dcs_read_1(DCS_GET_ID2, &id2);
+	if (r)
+		return r;
+	r = taal_dcs_read_1(DCS_GET_ID3, &id3);
+	if (r)
+		return r;
+
+	return 0;
+}
+
+static int taal_memory_read(struct omap_dss_device *dssdev,
+		void *buf, size_t size,
+		u16 x, u16 y, u16 w, u16 h)
+{
+	int r;
+	int first = 1;
+	int plen;
+	unsigned buf_used = 0;
+
+	if (size < w * h * 3)
+		return -ENOMEM;
+
+	size = min(w * h * 3,
+			dssdev->panel.timings.x_res *
+			dssdev->panel.timings.y_res * 3);
+
+	/* plen 1 or 2 goes into short packet. until checksum error is fixed,
+	 * use short packets. plen 32 works, but bigger packets seem to cause
+	 * an error. */
+	if (size % 2)
+		plen = 1;
+	else
+		plen = 2;
+
+	taal_setup_update(dssdev, x, y, w, h);
+
+	r = dsi_vc_set_max_rx_packet_size(TCH, plen);
+	if (r)
+		return r;
+
+	while (buf_used < size) {
+		u8 dcs_cmd = first ? 0x2e : 0x3e;
+		first = 0;
+
+		r = dsi_vc_dcs_read(TCH, dcs_cmd,
+				buf + buf_used, size - buf_used);
+
+		if (r < 0) {
+			dev_err(&dssdev->dev, "read error\n");
+			goto err;
+		}
+
+		buf_used += r;
+
+		if (r < plen) {
+			dev_err(&dssdev->dev, "short read\n");
+			break;
+		}
+
+		if (signal_pending(current)) {
+			dev_err(&dssdev->dev, "signal pending, "
+					"aborting memory read\n");
+			r = -ERESTARTSYS;
+			goto err;
+		}
+	}
+
+	r = buf_used;
+
+err:
+	dsi_vc_set_max_rx_packet_size(TCH, 1);
+
+	return r;
+}
+
+static void taal_esd_work(struct work_struct *work)
+{
+	struct taal_data *td = container_of(work, struct taal_data,
+			esd_work.work);
+	struct omap_dss_device *dssdev = td->dssdev;
+	u8 state1, state2;
+	int r;
+
+	if (!td->enabled)
+		return;
+
+	dsi_bus_lock();
+
+	r = taal_dcs_read_1(DCS_RDDSDR, &state1);
+	if (r) {
+		dev_err(&dssdev->dev, "failed to read Taal status\n");
+		goto err;
+	}
+
+	/* Run self diagnostics */
+	r = taal_sleep_out(td);
+	if (r) {
+		dev_err(&dssdev->dev, "failed to run Taal self-diagnostics\n");
+		goto err;
+	}
+
+	r = taal_dcs_read_1(DCS_RDDSDR, &state2);
+	if (r) {
+		dev_err(&dssdev->dev, "failed to read Taal status\n");
+		goto err;
+	}
+
+	/* Each sleep out command will trigger a self diagnostic and flip
+	 * Bit6 if the test passes.
+	 */
+	if (!((state1 ^ state2) & (1 << 6))) {
+		dev_err(&dssdev->dev, "LCD self diagnostics failed\n");
+		goto err;
+	}
+	/* Self-diagnostics result is also shown on TE GPIO line. We need
+	 * to re-enable TE after self diagnostics */
+	if (td->use_ext_te && td->te_enabled)
+		taal_enable_te(dssdev, true);
+
+	dsi_bus_unlock();
+
+	queue_delayed_work(td->esd_wq, &td->esd_work, TAAL_ESD_CHECK_PERIOD);
+
+	return;
+err:
+	dev_err(&dssdev->dev, "performing LCD reset\n");
+
+	taal_disable(dssdev);
+	taal_enable(dssdev);
+
+	dsi_bus_unlock();
+
+	queue_delayed_work(td->esd_wq, &td->esd_work, TAAL_ESD_CHECK_PERIOD);
+}
+
+static struct omap_dss_driver taal_driver = {
+	.probe		= taal_probe,
+	.remove		= taal_remove,
+
+	.enable		= taal_enable,
+	.disable	= taal_disable,
+	.suspend	= taal_suspend,
+	.resume		= taal_resume,
+
+	.setup_update	= taal_setup_update,
+	.enable_te	= taal_enable_te,
+	.wait_for_te	= taal_wait_te,
+	.set_rotate	= taal_rotate,
+	.get_rotate	= taal_get_rotate,
+	.set_mirror	= taal_mirror,
+	.get_mirror	= taal_get_mirror,
+	.run_test	= taal_run_test,
+	.memory_read	= taal_memory_read,
+
+	.driver         = {
+		.name   = "taal",
+		.owner  = THIS_MODULE,
+	},
+};
+
+static int __init taal_init(void)
+{
+	omap_dss_register_driver(&taal_driver);
+
+	return 0;
+}
+
+static void __exit taal_exit(void)
+{
+	omap_dss_unregister_driver(&taal_driver);
+}
+
+module_init(taal_init);
+module_exit(taal_exit);
+
+MODULE_AUTHOR("Tomi Valkeinen <tomi.valkeinen@nokia.com>");
+MODULE_DESCRIPTION("Taal Driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/video/omap2/dss/Kconfig b/drivers/video/omap2/dss/Kconfig
new file mode 100644
index 000000000000..c63ce767b277
--- /dev/null
+++ b/drivers/video/omap2/dss/Kconfig
@@ -0,0 +1,96 @@
+menuconfig OMAP2_DSS
+        tristate "OMAP2/3 Display Subsystem support (EXPERIMENTAL)"
+        depends on ARCH_OMAP2 || ARCH_OMAP3
+        help
+          OMAP2/3 Display Subsystem support.
+
+if OMAP2_DSS
+
+config OMAP2_VRAM_SIZE
+	int "VRAM size (MB)"
+	range 0 32
+	default 0
+	help
+	  The amount of SDRAM to reserve at boot time for video RAM use.
+	  This VRAM will be used by omapfb and other drivers that need
+	  large continuous RAM area for video use.
+
+	  You can also set this with "vram=<bytes>" kernel argument, or
+	  in the board file.
+
+config OMAP2_DSS_DEBUG_SUPPORT
+        bool "Debug support"
+	default y
+	help
+	  This enables debug messages. You need to enable printing
+	  with 'debug' module parameter.
+
+config OMAP2_DSS_COLLECT_IRQ_STATS
+	bool "Collect DSS IRQ statistics"
+	depends on OMAP2_DSS_DEBUG_SUPPORT
+	default n
+	help
+	  Collect DSS IRQ statistics, printable via debugfs
+
+config OMAP2_DSS_RFBI
+	bool "RFBI support"
+        default n
+	help
+	  MIPI DBI, or RFBI (Remote Framebuffer Interface), support.
+
+config OMAP2_DSS_VENC
+	bool "VENC support"
+        default y
+	help
+	  OMAP Video Encoder support.
+
+config OMAP2_DSS_SDI
+	bool "SDI support"
+	depends on ARCH_OMAP3
+        default n
+	help
+	  SDI (Serial Display Interface) support.
+
+config OMAP2_DSS_DSI
+	bool "DSI support"
+	depends on ARCH_OMAP3
+        default n
+	help
+	  MIPI DSI support.
+
+config OMAP2_DSS_USE_DSI_PLL
+	bool "Use DSI PLL for PCLK (EXPERIMENTAL)"
+	default n
+	depends on OMAP2_DSS_DSI
+	help
+	  Use DSI PLL to generate pixel clock.  Currently only for DPI output.
+	  DSI PLL can be used to generate higher and more precise pixel clocks.
+
+config OMAP2_DSS_FAKE_VSYNC
+	bool "Fake VSYNC irq from manual update displays"
+	default n
+	help
+	  If this is selected, DSI will generate a fake DISPC VSYNC interrupt
+	  when DSI has sent a frame. This is only needed with DSI or RFBI
+	  displays using manual mode, and you want VSYNC to, for example,
+	  time animation.
+
+config OMAP2_DSS_MIN_FCK_PER_PCK
+	int "Minimum FCK/PCK ratio (for scaling)"
+	range 0 32
+	default 0
+	help
+	  This can be used to adjust the minimum FCK/PCK ratio.
+
+	  With this you can make sure that DISPC FCK is at least
+	  n x PCK. Video plane scaling requires higher FCK than
+	  normally.
+
+	  If this is set to 0, there's no extra constraint on the
+	  DISPC FCK. However, the FCK will at minimum be
+	  2xPCK (if active matrix) or 3xPCK (if passive matrix).
+
+	  Max FCK is 173MHz, so this doesn't work if your PCK
+	  is very high.
+
+endif
diff --git a/drivers/video/omap2/dss/Makefile b/drivers/video/omap2/dss/Makefile
new file mode 100644
index 000000000000..980c72c2db98
--- /dev/null
+++ b/drivers/video/omap2/dss/Makefile
@@ -0,0 +1,6 @@
+obj-$(CONFIG_OMAP2_DSS) += omapdss.o
+omapdss-y := core.o dss.o dispc.o dpi.o display.o manager.o overlay.o
+omapdss-$(CONFIG_OMAP2_DSS_RFBI) += rfbi.o
+omapdss-$(CONFIG_OMAP2_DSS_VENC) += venc.o
+omapdss-$(CONFIG_OMAP2_DSS_SDI) += sdi.o
+omapdss-$(CONFIG_OMAP2_DSS_DSI) += dsi.o
diff --git a/drivers/video/omap2/dss/core.c b/drivers/video/omap2/dss/core.c
new file mode 100644
index 000000000000..82918eec6d2e
--- /dev/null
+++ b/drivers/video/omap2/dss/core.c
@@ -0,0 +1,929 @@
+/*
+ * linux/drivers/video/omap2/dss/core.c
+ *
+ * Copyright (C) 2009 Nokia Corporation
+ * Author: Tomi Valkeinen <tomi.valkeinen@nokia.com>
+ *
+ * Some code and ideas taken from drivers/video/omap/ driver
+ * by Imre Deak.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#define DSS_SUBSYS_NAME "CORE"
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/clk.h>
+#include <linux/err.h>
+#include <linux/platform_device.h>
+#include <linux/seq_file.h>
+#include <linux/debugfs.h>
+#include <linux/io.h>
+#include <linux/device.h>
+
+#include <plat/display.h>
+#include <plat/clock.h>
+
+#include "dss.h"
+
+static struct {
+	struct platform_device *pdev;
+	int		ctx_id;
+
+	struct clk      *dss_ick;
+	struct clk	*dss1_fck;
+	struct clk	*dss2_fck;
+	struct clk      *dss_54m_fck;
+	struct clk	*dss_96m_fck;
+	unsigned	num_clks_enabled;
+} core;
+
+static void dss_clk_enable_all_no_ctx(void);
+static void dss_clk_disable_all_no_ctx(void);
+static void dss_clk_enable_no_ctx(enum dss_clock clks);
+static void dss_clk_disable_no_ctx(enum dss_clock clks);
+
+static char *def_disp_name;
+module_param_named(def_disp, def_disp_name, charp, 0);
+MODULE_PARM_DESC(def_disp_name, "default display name");
+
+#ifdef DEBUG
+unsigned int dss_debug;
+module_param_named(debug, dss_debug, bool, 0644);
+#endif
+
+/* CONTEXT */
+static int dss_get_ctx_id(void)
+{
+	struct omap_dss_board_info *pdata = core.pdev->dev.platform_data;
+	int r;
+
+	if (!pdata->get_last_off_on_transaction_id)
+		return 0;
+	r = pdata->get_last_off_on_transaction_id(&core.pdev->dev);
+	if (r < 0) {
+		dev_err(&core.pdev->dev, "getting transaction ID failed, "
+				"will force context restore\n");
+		r = -1;
+	}
+	return r;
+}
+
+int dss_need_ctx_restore(void)
+{
+	int id = dss_get_ctx_id();
+
+	if (id < 0 || id != core.ctx_id) {
+		DSSDBG("ctx id %d -> id %d\n",
+				core.ctx_id, id);
+		core.ctx_id = id;
+		return 1;
+	} else {
+		return 0;
+	}
+}
+
+static void save_all_ctx(void)
+{
+	DSSDBG("save context\n");
+
+	dss_clk_enable_no_ctx(DSS_CLK_ICK | DSS_CLK_FCK1);
+
+	dss_save_context();
+	dispc_save_context();
+#ifdef CONFIG_OMAP2_DSS_DSI
+	dsi_save_context();
+#endif
+
+	dss_clk_disable_no_ctx(DSS_CLK_ICK | DSS_CLK_FCK1);
+}
+
+static void restore_all_ctx(void)
+{
+	DSSDBG("restore context\n");
+
+	dss_clk_enable_all_no_ctx();
+
+	dss_restore_context();
+	dispc_restore_context();
+#ifdef CONFIG_OMAP2_DSS_DSI
+	dsi_restore_context();
+#endif
+
+	dss_clk_disable_all_no_ctx();
+}
+
+#if defined(CONFIG_DEBUG_FS) && defined(CONFIG_OMAP2_DSS_DEBUG_SUPPORT)
+/* CLOCKS */
+static void core_dump_clocks(struct seq_file *s)
+{
+	int i;
+	struct clk *clocks[5] = {
+		core.dss_ick,
+		core.dss1_fck,
+		core.dss2_fck,
+		core.dss_54m_fck,
+		core.dss_96m_fck
+	};
+
+	seq_printf(s, "- CORE -\n");
+
+	seq_printf(s, "internal clk count\t\t%u\n", core.num_clks_enabled);
+
+	for (i = 0; i < 5; i++) {
+		if (!clocks[i])
+			continue;
+		seq_printf(s, "%-15s\t%lu\t%d\n",
+				clocks[i]->name,
+				clk_get_rate(clocks[i]),
+				clocks[i]->usecount);
+	}
+}
+#endif /* defined(CONFIG_DEBUG_FS) && defined(CONFIG_OMAP2_DSS_DEBUG_SUPPORT) */
+
+static int dss_get_clock(struct clk **clock, const char *clk_name)
+{
+	struct clk *clk;
+
+	clk = clk_get(&core.pdev->dev, clk_name);
+
+	if (IS_ERR(clk)) {
+		DSSERR("can't get clock %s", clk_name);
+		return PTR_ERR(clk);
+	}
+
+	*clock = clk;
+
+	DSSDBG("clk %s, rate %ld\n", clk_name, clk_get_rate(clk));
+
+	return 0;
+}
+
+static int dss_get_clocks(void)
+{
+	int r;
+
+	core.dss_ick = NULL;
+	core.dss1_fck = NULL;
+	core.dss2_fck = NULL;
+	core.dss_54m_fck = NULL;
+	core.dss_96m_fck = NULL;
+
+	r = dss_get_clock(&core.dss_ick, "ick");
+	if (r)
+		goto err;
+
+	r = dss_get_clock(&core.dss1_fck, "dss1_fck");
+	if (r)
+		goto err;
+
+	r = dss_get_clock(&core.dss2_fck, "dss2_fck");
+	if (r)
+		goto err;
+
+	r = dss_get_clock(&core.dss_54m_fck, "tv_fck");
+	if (r)
+		goto err;
+
+	r = dss_get_clock(&core.dss_96m_fck, "video_fck");
+	if (r)
+		goto err;
+
+	return 0;
+
+err:
+	if (core.dss_ick)
+		clk_put(core.dss_ick);
+	if (core.dss1_fck)
+		clk_put(core.dss1_fck);
+	if (core.dss2_fck)
+		clk_put(core.dss2_fck);
+	if (core.dss_54m_fck)
+		clk_put(core.dss_54m_fck);
+	if (core.dss_96m_fck)
+		clk_put(core.dss_96m_fck);
+
+	return r;
+}
+
+static void dss_put_clocks(void)
+{
+	if (core.dss_96m_fck)
+		clk_put(core.dss_96m_fck);
+	clk_put(core.dss_54m_fck);
+	clk_put(core.dss1_fck);
+	clk_put(core.dss2_fck);
+	clk_put(core.dss_ick);
+}
+
+unsigned long dss_clk_get_rate(enum dss_clock clk)
+{
+	switch (clk) {
+	case DSS_CLK_ICK:
+		return clk_get_rate(core.dss_ick);
+	case DSS_CLK_FCK1:
+		return clk_get_rate(core.dss1_fck);
+	case DSS_CLK_FCK2:
+		return clk_get_rate(core.dss2_fck);
+	case DSS_CLK_54M:
+		return clk_get_rate(core.dss_54m_fck);
+	case DSS_CLK_96M:
+		return clk_get_rate(core.dss_96m_fck);
+	}
+
+	BUG();
+	return 0;
+}
+
+static unsigned count_clk_bits(enum dss_clock clks)
+{
+	unsigned num_clks = 0;
+
+	if (clks & DSS_CLK_ICK)
+		++num_clks;
+	if (clks & DSS_CLK_FCK1)
+		++num_clks;
+	if (clks & DSS_CLK_FCK2)
+		++num_clks;
+	if (clks & DSS_CLK_54M)
+		++num_clks;
+	if (clks & DSS_CLK_96M)
+		++num_clks;
+
+	return num_clks;
+}
+
+static void dss_clk_enable_no_ctx(enum dss_clock clks)
+{
+	unsigned num_clks = count_clk_bits(clks);
+
+	if (clks & DSS_CLK_ICK)
+		clk_enable(core.dss_ick);
+	if (clks & DSS_CLK_FCK1)
+		clk_enable(core.dss1_fck);
+	if (clks & DSS_CLK_FCK2)
+		clk_enable(core.dss2_fck);
+	if (clks & DSS_CLK_54M)
+		clk_enable(core.dss_54m_fck);
+	if (clks & DSS_CLK_96M)
+		clk_enable(core.dss_96m_fck);
+
+	core.num_clks_enabled += num_clks;
+}
+
+void dss_clk_enable(enum dss_clock clks)
+{
+	dss_clk_enable_no_ctx(clks);
+
+	if (cpu_is_omap34xx() && dss_need_ctx_restore())
+		restore_all_ctx();
+}
+
+static void dss_clk_disable_no_ctx(enum dss_clock clks)
+{
+	unsigned num_clks = count_clk_bits(clks);
+
+	if (clks & DSS_CLK_ICK)
+		clk_disable(core.dss_ick);
+	if (clks & DSS_CLK_FCK1)
+		clk_disable(core.dss1_fck);
+	if (clks & DSS_CLK_FCK2)
+		clk_disable(core.dss2_fck);
+	if (clks & DSS_CLK_54M)
+		clk_disable(core.dss_54m_fck);
+	if (clks & DSS_CLK_96M)
+		clk_disable(core.dss_96m_fck);
+
+	core.num_clks_enabled -= num_clks;
+}
+
+void dss_clk_disable(enum dss_clock clks)
+{
+	if (cpu_is_omap34xx()) {
+		unsigned num_clks = count_clk_bits(clks);
+
+		BUG_ON(core.num_clks_enabled < num_clks);
+
+		if (core.num_clks_enabled == num_clks)
+			save_all_ctx();
+	}
+
+	dss_clk_disable_no_ctx(clks);
+}
+
+static void dss_clk_enable_all_no_ctx(void)
+{
+	enum dss_clock clks;
+
+	clks = DSS_CLK_ICK | DSS_CLK_FCK1 | DSS_CLK_FCK2 | DSS_CLK_54M;
+	if (cpu_is_omap34xx())
+		clks |= DSS_CLK_96M;
+	dss_clk_enable_no_ctx(clks);
+}
+
+static void dss_clk_disable_all_no_ctx(void)
+{
+	enum dss_clock clks;
+
+	clks = DSS_CLK_ICK | DSS_CLK_FCK1 | DSS_CLK_FCK2 | DSS_CLK_54M;
+	if (cpu_is_omap34xx())
+		clks |= DSS_CLK_96M;
+	dss_clk_disable_no_ctx(clks);
+}
+
+static void dss_clk_disable_all(void)
+{
+	enum dss_clock clks;
+
+	clks = DSS_CLK_ICK | DSS_CLK_FCK1 | DSS_CLK_FCK2 | DSS_CLK_54M;
+	if (cpu_is_omap34xx())
+		clks |= DSS_CLK_96M;
+	dss_clk_disable(clks);
+}
+
+/* DEBUGFS */
+#if defined(CONFIG_DEBUG_FS) && defined(CONFIG_OMAP2_DSS_DEBUG_SUPPORT)
+static void dss_debug_dump_clocks(struct seq_file *s)
+{
+	core_dump_clocks(s);
+	dss_dump_clocks(s);
+	dispc_dump_clocks(s);
+#ifdef CONFIG_OMAP2_DSS_DSI
+	dsi_dump_clocks(s);
+#endif
+}
+
+static int dss_debug_show(struct seq_file *s, void *unused)
+{
+	void (*func)(struct seq_file *) = s->private;
+	func(s);
+	return 0;
+}
+
+static int dss_debug_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, dss_debug_show, inode->i_private);
+}
+
+static const struct file_operations dss_debug_fops = {
+	.open           = dss_debug_open,
+	.read           = seq_read,
+	.llseek         = seq_lseek,
+	.release        = single_release,
+};
+
+static struct dentry *dss_debugfs_dir;
+
+static int dss_initialize_debugfs(void)
+{
+	dss_debugfs_dir = debugfs_create_dir("omapdss", NULL);
+	if (IS_ERR(dss_debugfs_dir)) {
+		int err = PTR_ERR(dss_debugfs_dir);
+		dss_debugfs_dir = NULL;
+		return err;
+	}
+
+	debugfs_create_file("clk", S_IRUGO, dss_debugfs_dir,
+			&dss_debug_dump_clocks, &dss_debug_fops);
+
+	debugfs_create_file("dispc_irq", S_IRUGO, dss_debugfs_dir,
+			&dispc_dump_irqs, &dss_debug_fops);
+
+#ifdef CONFIG_OMAP2_DSS_DSI
+	debugfs_create_file("dsi_irq", S_IRUGO, dss_debugfs_dir,
+			&dsi_dump_irqs, &dss_debug_fops);
+#endif
+
+	debugfs_create_file("dss", S_IRUGO, dss_debugfs_dir,
+			&dss_dump_regs, &dss_debug_fops);
+	debugfs_create_file("dispc", S_IRUGO, dss_debugfs_dir,
+			&dispc_dump_regs, &dss_debug_fops);
+#ifdef CONFIG_OMAP2_DSS_RFBI
+	debugfs_create_file("rfbi", S_IRUGO, dss_debugfs_dir,
+			&rfbi_dump_regs, &dss_debug_fops);
+#endif
+#ifdef CONFIG_OMAP2_DSS_DSI
+	debugfs_create_file("dsi", S_IRUGO, dss_debugfs_dir,
+			&dsi_dump_regs, &dss_debug_fops);
+#endif
+#ifdef CONFIG_OMAP2_DSS_VENC
+	debugfs_create_file("venc", S_IRUGO, dss_debugfs_dir,
+			&venc_dump_regs, &dss_debug_fops);
+#endif
+	return 0;
+}
+
+static void dss_uninitialize_debugfs(void)
+{
+	if (dss_debugfs_dir)
+		debugfs_remove_recursive(dss_debugfs_dir);
+}
+#endif /* CONFIG_DEBUG_FS && CONFIG_OMAP2_DSS_DEBUG_SUPPORT */
+
+/* PLATFORM DEVICE */
+static int omap_dss_probe(struct platform_device *pdev)
+{
+	struct omap_dss_board_info *pdata = pdev->dev.platform_data;
+	int skip_init = 0;
+	int r;
+	int i;
+
+	core.pdev = pdev;
+
+	dss_init_overlay_managers(pdev);
+	dss_init_overlays(pdev);
+
+	r = dss_get_clocks();
+	if (r)
+		goto fail0;
+
+	dss_clk_enable_all_no_ctx();
+
+	core.ctx_id = dss_get_ctx_id();
+	DSSDBG("initial ctx id %u\n", core.ctx_id);
+
+#ifdef CONFIG_FB_OMAP_BOOTLOADER_INIT
+	/* DISPC_CONTROL */
+	if (omap_readl(0x48050440) & 1)	/* LCD enabled? */
+		skip_init = 1;
+#endif
+
+	r = dss_init(skip_init);
+	if (r) {
+		DSSERR("Failed to initialize DSS\n");
+		goto fail0;
+	}
+
+#ifdef CONFIG_OMAP2_DSS_RFBI
+	r = rfbi_init();
+	if (r) {
+		DSSERR("Failed to initialize rfbi\n");
+		goto fail0;
+	}
+#endif
+
+	r = dpi_init();
+	if (r) {
+		DSSERR("Failed to initialize dpi\n");
+		goto fail0;
+	}
+
+	r = dispc_init();
+	if (r) {
+		DSSERR("Failed to initialize dispc\n");
+		goto fail0;
+	}
+#ifdef CONFIG_OMAP2_DSS_VENC
+	r = venc_init(pdev);
+	if (r) {
+		DSSERR("Failed to initialize venc\n");
+		goto fail0;
+	}
+#endif
+	if (cpu_is_omap34xx()) {
+#ifdef CONFIG_OMAP2_DSS_SDI
+		r = sdi_init(skip_init);
+		if (r) {
+			DSSERR("Failed to initialize SDI\n");
+			goto fail0;
+		}
+#endif
+#ifdef CONFIG_OMAP2_DSS_DSI
+		r = dsi_init(pdev);
+		if (r) {
+			DSSERR("Failed to initialize DSI\n");
+			goto fail0;
+		}
+#endif
+	}
+
+#if defined(CONFIG_DEBUG_FS) && defined(CONFIG_OMAP2_DSS_DEBUG_SUPPORT)
+	r = dss_initialize_debugfs();
+	if (r)
+		goto fail0;
+#endif
+
+	for (i = 0; i < pdata->num_devices; ++i) {
+		struct omap_dss_device *dssdev = pdata->devices[i];
+
+		r = omap_dss_register_device(dssdev);
+		if (r)
+			DSSERR("device reg failed %d\n", i);
+
+		if (def_disp_name && strcmp(def_disp_name, dssdev->name) == 0)
+			pdata->default_device = dssdev;
+	}
+
+	dss_clk_disable_all();
+
+	return 0;
+
+	/* XXX fail correctly */
+fail0:
+	return r;
+}
+
+static int omap_dss_remove(struct platform_device *pdev)
+{
+	struct omap_dss_board_info *pdata = pdev->dev.platform_data;
+	int i;
+	int c;
+
+#if defined(CONFIG_DEBUG_FS) && defined(CONFIG_OMAP2_DSS_DEBUG_SUPPORT)
+	dss_uninitialize_debugfs();
+#endif
+
+#ifdef CONFIG_OMAP2_DSS_VENC
+	venc_exit();
+#endif
+	dispc_exit();
+	dpi_exit();
+#ifdef CONFIG_OMAP2_DSS_RFBI
+	rfbi_exit();
+#endif
+	if (cpu_is_omap34xx()) {
+#ifdef CONFIG_OMAP2_DSS_DSI
+		dsi_exit();
+#endif
+#ifdef CONFIG_OMAP2_DSS_SDI
+		sdi_exit();
+#endif
+	}
+
+	dss_exit();
+
+	/* these should be removed at some point */
+	c = core.dss_ick->usecount;
+	if (c > 0) {
+		DSSERR("warning: dss_ick usecount %d, disabling\n", c);
+		while (c-- > 0)
+			clk_disable(core.dss_ick);
+	}
+
+	c = core.dss1_fck->usecount;
+	if (c > 0) {
+		DSSERR("warning: dss1_fck usecount %d, disabling\n", c);
+		while (c-- > 0)
+			clk_disable(core.dss1_fck);
+	}
+
+	c = core.dss2_fck->usecount;
+	if (c > 0) {
+		DSSERR("warning: dss2_fck usecount %d, disabling\n", c);
+		while (c-- > 0)
+			clk_disable(core.dss2_fck);
+	}
+
+	c = core.dss_54m_fck->usecount;
+	if (c > 0) {
+		DSSERR("warning: dss_54m_fck usecount %d, disabling\n", c);
+		while (c-- > 0)
+			clk_disable(core.dss_54m_fck);
+	}
+
+	if (core.dss_96m_fck) {
+		c = core.dss_96m_fck->usecount;
+		if (c > 0) {
+			DSSERR("warning: dss_96m_fck usecount %d, disabling\n",
+					c);
+			while (c-- > 0)
+				clk_disable(core.dss_96m_fck);
+		}
+	}
+
+	dss_put_clocks();
+
+	dss_uninit_overlays(pdev);
+	dss_uninit_overlay_managers(pdev);
+
+	for (i = 0; i < pdata->num_devices; ++i)
+		omap_dss_unregister_device(pdata->devices[i]);
+
+	return 0;
+}
+
+static void omap_dss_shutdown(struct platform_device *pdev)
+{
+	DSSDBG("shutdown\n");
+	dss_disable_all_devices();
+}
+
+static int omap_dss_suspend(struct platform_device *pdev, pm_message_t state)
+{
+	DSSDBG("suspend %d\n", state.event);
+
+	return dss_suspend_all_devices();
+}
+
+static int omap_dss_resume(struct platform_device *pdev)
+{
+	DSSDBG("resume\n");
+
+	return dss_resume_all_devices();
+}
+
+static struct platform_driver omap_dss_driver = {
+	.probe          = omap_dss_probe,
+	.remove         = omap_dss_remove,
+	.shutdown	= omap_dss_shutdown,
+	.suspend	= omap_dss_suspend,
+	.resume		= omap_dss_resume,
+	.driver         = {
+		.name   = "omapdss",
+		.owner  = THIS_MODULE,
+	},
+};
+
+/* BUS */
+static int dss_bus_match(struct device *dev, struct device_driver *driver)
+{
+	struct omap_dss_device *dssdev = to_dss_device(dev);
+
+	DSSDBG("bus_match. dev %s/%s, drv %s\n",
+			dev_name(dev), dssdev->driver_name, driver->name);
+
+	return strcmp(dssdev->driver_name, driver->name) == 0;
+}
+
+static ssize_t device_name_show(struct device *dev,
+		struct device_attribute *attr, char *buf)
+{
+	struct omap_dss_device *dssdev = to_dss_device(dev);
+	return snprintf(buf, PAGE_SIZE, "%s\n",
+			dssdev->name ?
+			dssdev->name : "");
+}
+
+static struct device_attribute default_dev_attrs[] = {
+	__ATTR(name, S_IRUGO, device_name_show, NULL),
+	__ATTR_NULL,
+};
+
+static ssize_t driver_name_show(struct device_driver *drv, char *buf)
+{
+	struct omap_dss_driver *dssdrv = to_dss_driver(drv);
+	return snprintf(buf, PAGE_SIZE, "%s\n",
+			dssdrv->driver.name ?
+			dssdrv->driver.name : "");
+}
+static struct driver_attribute default_drv_attrs[] = {
+	__ATTR(name, S_IRUGO, driver_name_show, NULL),
+	__ATTR_NULL,
+};
+
+static struct bus_type dss_bus_type = {
+	.name = "omapdss",
+	.match = dss_bus_match,
+	.dev_attrs = default_dev_attrs,
+	.drv_attrs = default_drv_attrs,
+};
+
+static void dss_bus_release(struct device *dev)
+{
+	DSSDBG("bus_release\n");
+}
+
+static struct device dss_bus = {
+	.release = dss_bus_release,
+};
+
+struct bus_type *dss_get_bus(void)
+{
+	return &dss_bus_type;
+}
+
+/* DRIVER */
+static int dss_driver_probe(struct device *dev)
+{
+	int r;
+	struct omap_dss_driver *dssdrv = to_dss_driver(dev->driver);
+	struct omap_dss_device *dssdev = to_dss_device(dev);
+	struct omap_dss_board_info *pdata = core.pdev->dev.platform_data;
+	bool force;
+
+	DSSDBG("driver_probe: dev %s/%s, drv %s\n",
+				dev_name(dev), dssdev->driver_name,
+				dssdrv->driver.name);
+
+	dss_init_device(core.pdev, dssdev);
+
+	/* skip this if the device is behind a ctrl */
+	if (!dssdev->panel.ctrl) {
+		force = pdata->default_device == dssdev;
+		dss_recheck_connections(dssdev, force);
+	}
+
+	r = dssdrv->probe(dssdev);
+
+	if (r) {
+		DSSERR("driver probe failed: %d\n", r);
+		return r;
+	}
+
+	DSSDBG("probe done for device %s\n", dev_name(dev));
+
+	dssdev->driver = dssdrv;
+
+	return 0;
+}
+
+static int dss_driver_remove(struct device *dev)
+{
+	struct omap_dss_driver *dssdrv = to_dss_driver(dev->driver);
+	struct omap_dss_device *dssdev = to_dss_device(dev);
+
+	DSSDBG("driver_remove: dev %s/%s\n", dev_name(dev),
+			dssdev->driver_name);
+
+	dssdrv->remove(dssdev);
+
+	dss_uninit_device(core.pdev, dssdev);
+
+	dssdev->driver = NULL;
+
+	return 0;
+}
+
+int omap_dss_register_driver(struct omap_dss_driver *dssdriver)
+{
+	dssdriver->driver.bus = &dss_bus_type;
+	dssdriver->driver.probe = dss_driver_probe;
+	dssdriver->driver.remove = dss_driver_remove;
+	return driver_register(&dssdriver->driver);
+}
+EXPORT_SYMBOL(omap_dss_register_driver);
+
+void omap_dss_unregister_driver(struct omap_dss_driver *dssdriver)
+{
+	driver_unregister(&dssdriver->driver);
+}
+EXPORT_SYMBOL(omap_dss_unregister_driver);
+
+/* DEVICE */
+static void reset_device(struct device *dev, int check)
+{
+	u8 *dev_p = (u8 *)dev;
+	u8 *dev_end = dev_p + sizeof(*dev);
+	void *saved_pdata;
+
+	saved_pdata = dev->platform_data;
+	if (check) {
+		/*
+		 * Check if there is any other setting than platform_data
+		 * in struct device; warn that these will be reset by our
+		 * init.
+		 */
+		dev->platform_data = NULL;
+		while (dev_p < dev_end) {
+			if (*dev_p) {
+				WARN("%s: struct device fields will be "
+						"discarded\n",
+				     __func__);
+				break;
+			}
+			dev_p++;
+		}
+	}
+	memset(dev, 0, sizeof(*dev));
+	dev->platform_data = saved_pdata;
+}
+
+
+static void omap_dss_dev_release(struct device *dev)
+{
+	reset_device(dev, 0);
+}
+
+int omap_dss_register_device(struct omap_dss_device *dssdev)
+{
+	static int dev_num;
+	static int panel_num;
+	int r;
+
+	WARN_ON(!dssdev->driver_name);
+
+	reset_device(&dssdev->dev, 1);
+	dssdev->dev.bus = &dss_bus_type;
+	dssdev->dev.parent = &dss_bus;
+	dssdev->dev.release = omap_dss_dev_release;
+	dev_set_name(&dssdev->dev, "display%d", dev_num++);
+	r = device_register(&dssdev->dev);
+	if (r)
+		return r;
+
+	if (dssdev->ctrl.panel) {
+		struct omap_dss_device *panel = dssdev->ctrl.panel;
+
+		panel->panel.ctrl = dssdev;
+
+		reset_device(&panel->dev, 1);
+		panel->dev.bus = &dss_bus_type;
+		panel->dev.parent = &dssdev->dev;
+		panel->dev.release = omap_dss_dev_release;
+		dev_set_name(&panel->dev, "panel%d", panel_num++);
+		r = device_register(&panel->dev);
+		if (r)
+			return r;
+	}
+
+	return 0;
+}
+
+void omap_dss_unregister_device(struct omap_dss_device *dssdev)
+{
+	device_unregister(&dssdev->dev);
+
+	if (dssdev->ctrl.panel) {
+		struct omap_dss_device *panel = dssdev->ctrl.panel;
+		device_unregister(&panel->dev);
+	}
+}
+
+/* BUS */
+static int omap_dss_bus_register(void)
+{
+	int r;
+
+	r = bus_register(&dss_bus_type);
+	if (r) {
+		DSSERR("bus register failed\n");
+		return r;
+	}
+
+	dev_set_name(&dss_bus, "omapdss");
+	r = device_register(&dss_bus);
+	if (r) {
+		DSSERR("bus driver register failed\n");
+		bus_unregister(&dss_bus_type);
+		return r;
+	}
+
+	return 0;
+}
+
+/* INIT */
+
+#ifdef CONFIG_OMAP2_DSS_MODULE
+static void omap_dss_bus_unregister(void)
+{
+	device_unregister(&dss_bus);
+
+	bus_unregister(&dss_bus_type);
+}
+
+static int __init omap_dss_init(void)
+{
+	int r;
+
+	r = omap_dss_bus_register();
+	if (r)
+		return r;
+
+	r = platform_driver_register(&omap_dss_driver);
+	if (r) {
+		omap_dss_bus_unregister();
+		return r;
+	}
+
+	return 0;
+}
+
+static void __exit omap_dss_exit(void)
+{
+	platform_driver_unregister(&omap_dss_driver);
+
+	omap_dss_bus_unregister();
+}
+
+module_init(omap_dss_init);
+module_exit(omap_dss_exit);
+#else
+static int __init omap_dss_init(void)
+{
+	return omap_dss_bus_register();
+}
+
+static int __init omap_dss_init2(void)
+{
+	return platform_driver_register(&omap_dss_driver);
+}
+
+core_initcall(omap_dss_init);
+device_initcall(omap_dss_init2);
+#endif
+
+MODULE_AUTHOR("Tomi Valkeinen <tomi.valkeinen@nokia.com>");
+MODULE_DESCRIPTION("OMAP2/3 Display Subsystem");
+MODULE_LICENSE("GPL v2");
+
diff --git a/drivers/video/omap2/dss/dispc.c b/drivers/video/omap2/dss/dispc.c
new file mode 100644
index 000000000000..de8bfbac9e26
--- /dev/null
+++ b/drivers/video/omap2/dss/dispc.c
@@ -0,0 +1,3161 @@
+/*
+ * linux/drivers/video/omap2/dss/dispc.c
+ *
+ * Copyright (C) 2009 Nokia Corporation
+ * Author: Tomi Valkeinen <tomi.valkeinen@nokia.com>
+ *
+ * Some code and ideas taken from drivers/video/omap/ driver
+ * by Imre Deak.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#define DSS_SUBSYS_NAME "DISPC"
+
+#include <linux/kernel.h>
+#include <linux/dma-mapping.h>
+#include <linux/vmalloc.h>
+#include <linux/clk.h>
+#include <linux/io.h>
+#include <linux/jiffies.h>
+#include <linux/seq_file.h>
+#include <linux/delay.h>
+#include <linux/workqueue.h>
+
+#include <plat/sram.h>
+#include <plat/clock.h>
+
+#include <plat/display.h>
+
+#include "dss.h"
+
+/* DISPC */
+#define DISPC_BASE			0x48050400
+
+#define DISPC_SZ_REGS			SZ_1K
+
+struct dispc_reg { u16 idx; };
+
+#define DISPC_REG(idx)			((const struct dispc_reg) { idx })
+
+/* DISPC common */
+#define DISPC_REVISION			DISPC_REG(0x0000)
+#define DISPC_SYSCONFIG			DISPC_REG(0x0010)
+#define DISPC_SYSSTATUS			DISPC_REG(0x0014)
+#define DISPC_IRQSTATUS			DISPC_REG(0x0018)
+#define DISPC_IRQENABLE			DISPC_REG(0x001C)
+#define DISPC_CONTROL			DISPC_REG(0x0040)
+#define DISPC_CONFIG			DISPC_REG(0x0044)
+#define DISPC_CAPABLE			DISPC_REG(0x0048)
+#define DISPC_DEFAULT_COLOR0		DISPC_REG(0x004C)
+#define DISPC_DEFAULT_COLOR1		DISPC_REG(0x0050)
+#define DISPC_TRANS_COLOR0		DISPC_REG(0x0054)
+#define DISPC_TRANS_COLOR1		DISPC_REG(0x0058)
+#define DISPC_LINE_STATUS		DISPC_REG(0x005C)
+#define DISPC_LINE_NUMBER		DISPC_REG(0x0060)
+#define DISPC_TIMING_H			DISPC_REG(0x0064)
+#define DISPC_TIMING_V			DISPC_REG(0x0068)
+#define DISPC_POL_FREQ			DISPC_REG(0x006C)
+#define DISPC_DIVISOR			DISPC_REG(0x0070)
+#define DISPC_GLOBAL_ALPHA		DISPC_REG(0x0074)
+#define DISPC_SIZE_DIG			DISPC_REG(0x0078)
+#define DISPC_SIZE_LCD			DISPC_REG(0x007C)
+
+/* DISPC GFX plane */
+#define DISPC_GFX_BA0			DISPC_REG(0x0080)
+#define DISPC_GFX_BA1			DISPC_REG(0x0084)
+#define DISPC_GFX_POSITION		DISPC_REG(0x0088)
+#define DISPC_GFX_SIZE			DISPC_REG(0x008C)
+#define DISPC_GFX_ATTRIBUTES		DISPC_REG(0x00A0)
+#define DISPC_GFX_FIFO_THRESHOLD	DISPC_REG(0x00A4)
+#define DISPC_GFX_FIFO_SIZE_STATUS	DISPC_REG(0x00A8)
+#define DISPC_GFX_ROW_INC		DISPC_REG(0x00AC)
+#define DISPC_GFX_PIXEL_INC		DISPC_REG(0x00B0)
+#define DISPC_GFX_WINDOW_SKIP		DISPC_REG(0x00B4)
+#define DISPC_GFX_TABLE_BA		DISPC_REG(0x00B8)
+
+#define DISPC_DATA_CYCLE1		DISPC_REG(0x01D4)
+#define DISPC_DATA_CYCLE2		DISPC_REG(0x01D8)
+#define DISPC_DATA_CYCLE3		DISPC_REG(0x01DC)
+
+#define DISPC_CPR_COEF_R		DISPC_REG(0x0220)
+#define DISPC_CPR_COEF_G		DISPC_REG(0x0224)
+#define DISPC_CPR_COEF_B		DISPC_REG(0x0228)
+
+#define DISPC_GFX_PRELOAD		DISPC_REG(0x022C)
+
+/* DISPC Video plane, n = 0 for VID1 and n = 1 for VID2 */
+#define DISPC_VID_REG(n, idx)		DISPC_REG(0x00BC + (n)*0x90 + idx)
+
+#define DISPC_VID_BA0(n)		DISPC_VID_REG(n, 0x0000)
+#define DISPC_VID_BA1(n)		DISPC_VID_REG(n, 0x0004)
+#define DISPC_VID_POSITION(n)		DISPC_VID_REG(n, 0x0008)
+#define DISPC_VID_SIZE(n)		DISPC_VID_REG(n, 0x000C)
+#define DISPC_VID_ATTRIBUTES(n)		DISPC_VID_REG(n, 0x0010)
+#define DISPC_VID_FIFO_THRESHOLD(n)	DISPC_VID_REG(n, 0x0014)
+#define DISPC_VID_FIFO_SIZE_STATUS(n)	DISPC_VID_REG(n, 0x0018)
+#define DISPC_VID_ROW_INC(n)		DISPC_VID_REG(n, 0x001C)
+#define DISPC_VID_PIXEL_INC(n)		DISPC_VID_REG(n, 0x0020)
+#define DISPC_VID_FIR(n)		DISPC_VID_REG(n, 0x0024)
+#define DISPC_VID_PICTURE_SIZE(n)	DISPC_VID_REG(n, 0x0028)
+#define DISPC_VID_ACCU0(n)		DISPC_VID_REG(n, 0x002C)
+#define DISPC_VID_ACCU1(n)		DISPC_VID_REG(n, 0x0030)
+
+/* coef index i = {0, 1, 2, 3, 4, 5, 6, 7} */
+#define DISPC_VID_FIR_COEF_H(n, i)	DISPC_REG(0x00F0 + (n)*0x90 + (i)*0x8)
+/* coef index i = {0, 1, 2, 3, 4, 5, 6, 7} */
+#define DISPC_VID_FIR_COEF_HV(n, i)	DISPC_REG(0x00F4 + (n)*0x90 + (i)*0x8)
+/* coef index i = {0, 1, 2, 3, 4} */
+#define DISPC_VID_CONV_COEF(n, i)	DISPC_REG(0x0130 + (n)*0x90 + (i)*0x4)
+/* coef index i = {0, 1, 2, 3, 4, 5, 6, 7} */
+#define DISPC_VID_FIR_COEF_V(n, i)	DISPC_REG(0x01E0 + (n)*0x20 + (i)*0x4)
+
+#define DISPC_VID_PRELOAD(n)		DISPC_REG(0x230 + (n)*0x04)
+
+
+#define DISPC_IRQ_MASK_ERROR            (DISPC_IRQ_GFX_FIFO_UNDERFLOW | \
+					 DISPC_IRQ_OCP_ERR | \
+					 DISPC_IRQ_VID1_FIFO_UNDERFLOW | \
+					 DISPC_IRQ_VID2_FIFO_UNDERFLOW | \
+					 DISPC_IRQ_SYNC_LOST | \
+					 DISPC_IRQ_SYNC_LOST_DIGIT)
+
+#define DISPC_MAX_NR_ISRS		8
+
+struct omap_dispc_isr_data {
+	omap_dispc_isr_t	isr;
+	void			*arg;
+	u32			mask;
+};
+
+#define REG_GET(idx, start, end) \
+	FLD_GET(dispc_read_reg(idx), start, end)
+
+#define REG_FLD_MOD(idx, val, start, end)				\
+	dispc_write_reg(idx, FLD_MOD(dispc_read_reg(idx), val, start, end))
+
+static const struct dispc_reg dispc_reg_att[] = { DISPC_GFX_ATTRIBUTES,
+	DISPC_VID_ATTRIBUTES(0),
+	DISPC_VID_ATTRIBUTES(1) };
+
+struct dispc_irq_stats {
+	unsigned long last_reset;
+	unsigned irq_count;
+	unsigned irqs[32];
+};
+
+static struct {
+	void __iomem    *base;
+
+	u32	fifo_size[3];
+
+	spinlock_t irq_lock;
+	u32 irq_error_mask;
+	struct omap_dispc_isr_data registered_isr[DISPC_MAX_NR_ISRS];
+	u32 error_irqs;
+	struct work_struct error_work;
+
+	u32		ctx[DISPC_SZ_REGS / sizeof(u32)];
+
+#ifdef CONFIG_OMAP2_DSS_COLLECT_IRQ_STATS
+	spinlock_t irq_stats_lock;
+	struct dispc_irq_stats irq_stats;
+#endif
+} dispc;
+
+static void _omap_dispc_set_irqs(void);
+
+static inline void dispc_write_reg(const struct dispc_reg idx, u32 val)
+{
+	__raw_writel(val, dispc.base + idx.idx);
+}
+
+static inline u32 dispc_read_reg(const struct dispc_reg idx)
+{
+	return __raw_readl(dispc.base + idx.idx);
+}
+
+#define SR(reg) \
+	dispc.ctx[(DISPC_##reg).idx / sizeof(u32)] = dispc_read_reg(DISPC_##reg)
+#define RR(reg) \
+	dispc_write_reg(DISPC_##reg, dispc.ctx[(DISPC_##reg).idx / sizeof(u32)])
+
+void dispc_save_context(void)
+{
+	if (cpu_is_omap24xx())
+		return;
+
+	SR(SYSCONFIG);
+	SR(IRQENABLE);
+	SR(CONTROL);
+	SR(CONFIG);
+	SR(DEFAULT_COLOR0);
+	SR(DEFAULT_COLOR1);
+	SR(TRANS_COLOR0);
+	SR(TRANS_COLOR1);
+	SR(LINE_NUMBER);
+	SR(TIMING_H);
+	SR(TIMING_V);
+	SR(POL_FREQ);
+	SR(DIVISOR);
+	SR(GLOBAL_ALPHA);
+	SR(SIZE_DIG);
+	SR(SIZE_LCD);
+
+	SR(GFX_BA0);
+	SR(GFX_BA1);
+	SR(GFX_POSITION);
+	SR(GFX_SIZE);
+	SR(GFX_ATTRIBUTES);
+	SR(GFX_FIFO_THRESHOLD);
+	SR(GFX_ROW_INC);
+	SR(GFX_PIXEL_INC);
+	SR(GFX_WINDOW_SKIP);
+	SR(GFX_TABLE_BA);
+
+	SR(DATA_CYCLE1);
+	SR(DATA_CYCLE2);
+	SR(DATA_CYCLE3);
+
+	SR(CPR_COEF_R);
+	SR(CPR_COEF_G);
+	SR(CPR_COEF_B);
+
+	SR(GFX_PRELOAD);
+
+	/* VID1 */
+	SR(VID_BA0(0));
+	SR(VID_BA1(0));
+	SR(VID_POSITION(0));
+	SR(VID_SIZE(0));
+	SR(VID_ATTRIBUTES(0));
+	SR(VID_FIFO_THRESHOLD(0));
+	SR(VID_ROW_INC(0));
+	SR(VID_PIXEL_INC(0));
+	SR(VID_FIR(0));
+	SR(VID_PICTURE_SIZE(0));
+	SR(VID_ACCU0(0));
+	SR(VID_ACCU1(0));
+
+	SR(VID_FIR_COEF_H(0, 0));
+	SR(VID_FIR_COEF_H(0, 1));
+	SR(VID_FIR_COEF_H(0, 2));
+	SR(VID_FIR_COEF_H(0, 3));
+	SR(VID_FIR_COEF_H(0, 4));
+	SR(VID_FIR_COEF_H(0, 5));
+	SR(VID_FIR_COEF_H(0, 6));
+	SR(VID_FIR_COEF_H(0, 7));
+
+	SR(VID_FIR_COEF_HV(0, 0));
+	SR(VID_FIR_COEF_HV(0, 1));
+	SR(VID_FIR_COEF_HV(0, 2));
+	SR(VID_FIR_COEF_HV(0, 3));
+	SR(VID_FIR_COEF_HV(0, 4));
+	SR(VID_FIR_COEF_HV(0, 5));
+	SR(VID_FIR_COEF_HV(0, 6));
+	SR(VID_FIR_COEF_HV(0, 7));
+
+	SR(VID_CONV_COEF(0, 0));
+	SR(VID_CONV_COEF(0, 1));
+	SR(VID_CONV_COEF(0, 2));
+	SR(VID_CONV_COEF(0, 3));
+	SR(VID_CONV_COEF(0, 4));
+
+	SR(VID_FIR_COEF_V(0, 0));
+	SR(VID_FIR_COEF_V(0, 1));
+	SR(VID_FIR_COEF_V(0, 2));
+	SR(VID_FIR_COEF_V(0, 3));
+	SR(VID_FIR_COEF_V(0, 4));
+	SR(VID_FIR_COEF_V(0, 5));
+	SR(VID_FIR_COEF_V(0, 6));
+	SR(VID_FIR_COEF_V(0, 7));
+
+	SR(VID_PRELOAD(0));
+
+	/* VID2 */
+	SR(VID_BA0(1));
+	SR(VID_BA1(1));
+	SR(VID_POSITION(1));
+	SR(VID_SIZE(1));
+	SR(VID_ATTRIBUTES(1));
+	SR(VID_FIFO_THRESHOLD(1));
+	SR(VID_ROW_INC(1));
+	SR(VID_PIXEL_INC(1));
+	SR(VID_FIR(1));
+	SR(VID_PICTURE_SIZE(1));
+	SR(VID_ACCU0(1));
+	SR(VID_ACCU1(1));
+
+	SR(VID_FIR_COEF_H(1, 0));
+	SR(VID_FIR_COEF_H(1, 1));
+	SR(VID_FIR_COEF_H(1, 2));
+	SR(VID_FIR_COEF_H(1, 3));
+	SR(VID_FIR_COEF_H(1, 4));
+	SR(VID_FIR_COEF_H(1, 5));
+	SR(VID_FIR_COEF_H(1, 6));
+	SR(VID_FIR_COEF_H(1, 7));
+
+	SR(VID_FIR_COEF_HV(1, 0));
+	SR(VID_FIR_COEF_HV(1, 1));
+	SR(VID_FIR_COEF_HV(1, 2));
+	SR(VID_FIR_COEF_HV(1, 3));
+	SR(VID_FIR_COEF_HV(1, 4));
+	SR(VID_FIR_COEF_HV(1, 5));
+	SR(VID_FIR_COEF_HV(1, 6));
+	SR(VID_FIR_COEF_HV(1, 7));
+
+	SR(VID_CONV_COEF(1, 0));
+	SR(VID_CONV_COEF(1, 1));
+	SR(VID_CONV_COEF(1, 2));
+	SR(VID_CONV_COEF(1, 3));
+	SR(VID_CONV_COEF(1, 4));
+
+	SR(VID_FIR_COEF_V(1, 0));
+	SR(VID_FIR_COEF_V(1, 1));
+	SR(VID_FIR_COEF_V(1, 2));
+	SR(VID_FIR_COEF_V(1, 3));
+	SR(VID_FIR_COEF_V(1, 4));
+	SR(VID_FIR_COEF_V(1, 5));
+	SR(VID_FIR_COEF_V(1, 6));
+	SR(VID_FIR_COEF_V(1, 7));
+
+	SR(VID_PRELOAD(1));
+}
+
+void dispc_restore_context(void)
+{
+	RR(SYSCONFIG);
+	RR(IRQENABLE);
+	/*RR(CONTROL);*/
+	RR(CONFIG);
+	RR(DEFAULT_COLOR0);
+	RR(DEFAULT_COLOR1);
+	RR(TRANS_COLOR0);
+	RR(TRANS_COLOR1);
+	RR(LINE_NUMBER);
+	RR(TIMING_H);
+	RR(TIMING_V);
+	RR(POL_FREQ);
+	RR(DIVISOR);
+	RR(GLOBAL_ALPHA);
+	RR(SIZE_DIG);
+	RR(SIZE_LCD);
+
+	RR(GFX_BA0);
+	RR(GFX_BA1);
+	RR(GFX_POSITION);
+	RR(GFX_SIZE);
+	RR(GFX_ATTRIBUTES);
+	RR(GFX_FIFO_THRESHOLD);
+	RR(GFX_ROW_INC);
+	RR(GFX_PIXEL_INC);
+	RR(GFX_WINDOW_SKIP);
+	RR(GFX_TABLE_BA);
+
+	RR(DATA_CYCLE1);
+	RR(DATA_CYCLE2);
+	RR(DATA_CYCLE3);
+
+	RR(CPR_COEF_R);
+	RR(CPR_COEF_G);
+	RR(CPR_COEF_B);
+
+	RR(GFX_PRELOAD);
+
+	/* VID1 */
+	RR(VID_BA0(0));
+	RR(VID_BA1(0));
+	RR(VID_POSITION(0));
+	RR(VID_SIZE(0));
+	RR(VID_ATTRIBUTES(0));
+	RR(VID_FIFO_THRESHOLD(0));
+	RR(VID_ROW_INC(0));
+	RR(VID_PIXEL_INC(0));
+	RR(VID_FIR(0));
+	RR(VID_PICTURE_SIZE(0));
+	RR(VID_ACCU0(0));
+	RR(VID_ACCU1(0));
+
+	RR(VID_FIR_COEF_H(0, 0));
+	RR(VID_FIR_COEF_H(0, 1));
+	RR(VID_FIR_COEF_H(0, 2));
+	RR(VID_FIR_COEF_H(0, 3));
+	RR(VID_FIR_COEF_H(0, 4));
+	RR(VID_FIR_COEF_H(0, 5));
+	RR(VID_FIR_COEF_H(0, 6));
+	RR(VID_FIR_COEF_H(0, 7));
+
+	RR(VID_FIR_COEF_HV(0, 0));
+	RR(VID_FIR_COEF_HV(0, 1));
+	RR(VID_FIR_COEF_HV(0, 2));
+	RR(VID_FIR_COEF_HV(0, 3));
+	RR(VID_FIR_COEF_HV(0, 4));
+	RR(VID_FIR_COEF_HV(0, 5));
+	RR(VID_FIR_COEF_HV(0, 6));
+	RR(VID_FIR_COEF_HV(0, 7));
+
+	RR(VID_CONV_COEF(0, 0));
+	RR(VID_CONV_COEF(0, 1));
+	RR(VID_CONV_COEF(0, 2));
+	RR(VID_CONV_COEF(0, 3));
+	RR(VID_CONV_COEF(0, 4));
+
+	RR(VID_FIR_COEF_V(0, 0));
+	RR(VID_FIR_COEF_V(0, 1));
+	RR(VID_FIR_COEF_V(0, 2));
+	RR(VID_FIR_COEF_V(0, 3));
+	RR(VID_FIR_COEF_V(0, 4));
+	RR(VID_FIR_COEF_V(0, 5));
+	RR(VID_FIR_COEF_V(0, 6));
+	RR(VID_FIR_COEF_V(0, 7));
+
+	RR(VID_PRELOAD(0));
+
+	/* VID2 */
+	RR(VID_BA0(1));
+	RR(VID_BA1(1));
+	RR(VID_POSITION(1));
+	RR(VID_SIZE(1));
+	RR(VID_ATTRIBUTES(1));
+	RR(VID_FIFO_THRESHOLD(1));
+	RR(VID_ROW_INC(1));
+	RR(VID_PIXEL_INC(1));
+	RR(VID_FIR(1));
+	RR(VID_PICTURE_SIZE(1));
+	RR(VID_ACCU0(1));
+	RR(VID_ACCU1(1));
+
+	RR(VID_FIR_COEF_H(1, 0));
+	RR(VID_FIR_COEF_H(1, 1));
+	RR(VID_FIR_COEF_H(1, 2));
+	RR(VID_FIR_COEF_H(1, 3));
+	RR(VID_FIR_COEF_H(1, 4));
+	RR(VID_FIR_COEF_H(1, 5));
+	RR(VID_FIR_COEF_H(1, 6));
+	RR(VID_FIR_COEF_H(1, 7));
+
+	RR(VID_FIR_COEF_HV(1, 0));
+	RR(VID_FIR_COEF_HV(1, 1));
+	RR(VID_FIR_COEF_HV(1, 2));
+	RR(VID_FIR_COEF_HV(1, 3));
+	RR(VID_FIR_COEF_HV(1, 4));
+	RR(VID_FIR_COEF_HV(1, 5));
+	RR(VID_FIR_COEF_HV(1, 6));
+	RR(VID_FIR_COEF_HV(1, 7));
+
+	RR(VID_CONV_COEF(1, 0));
+	RR(VID_CONV_COEF(1, 1));
+	RR(VID_CONV_COEF(1, 2));
+	RR(VID_CONV_COEF(1, 3));
+	RR(VID_CONV_COEF(1, 4));
+
+	RR(VID_FIR_COEF_V(1, 0));
+	RR(VID_FIR_COEF_V(1, 1));
+	RR(VID_FIR_COEF_V(1, 2));
+	RR(VID_FIR_COEF_V(1, 3));
+	RR(VID_FIR_COEF_V(1, 4));
+	RR(VID_FIR_COEF_V(1, 5));
+	RR(VID_FIR_COEF_V(1, 6));
+	RR(VID_FIR_COEF_V(1, 7));
+
+	RR(VID_PRELOAD(1));
+
+	/* enable last, because LCD & DIGIT enable are here */
+	RR(CONTROL);
+}
+
+#undef SR
+#undef RR
+
+static inline void enable_clocks(bool enable)
+{
+	if (enable)
+		dss_clk_enable(DSS_CLK_ICK | DSS_CLK_FCK1);
+	else
+		dss_clk_disable(DSS_CLK_ICK | DSS_CLK_FCK1);
+}
+
+bool dispc_go_busy(enum omap_channel channel)
+{
+	int bit;
+
+	if (channel == OMAP_DSS_CHANNEL_LCD)
+		bit = 5; /* GOLCD */
+	else
+		bit = 6; /* GODIGIT */
+
+	return REG_GET(DISPC_CONTROL, bit, bit) == 1;
+}
+
+void dispc_go(enum omap_channel channel)
+{
+	int bit;
+
+	enable_clocks(1);
+
+	if (channel == OMAP_DSS_CHANNEL_LCD)
+		bit = 0; /* LCDENABLE */
+	else
+		bit = 1; /* DIGITALENABLE */
+
+	/* if the channel is not enabled, we don't need GO */
+	if (REG_GET(DISPC_CONTROL, bit, bit) == 0)
+		goto end;
+
+	if (channel == OMAP_DSS_CHANNEL_LCD)
+		bit = 5; /* GOLCD */
+	else
+		bit = 6; /* GODIGIT */
+
+	if (REG_GET(DISPC_CONTROL, bit, bit) == 1) {
+		DSSERR("GO bit not down for channel %d\n", channel);
+		goto end;
+	}
+
+	DSSDBG("GO %s\n", channel == OMAP_DSS_CHANNEL_LCD ? "LCD" : "DIGIT");
+
+	REG_FLD_MOD(DISPC_CONTROL, 1, bit, bit);
+end:
+	enable_clocks(0);
+}
+
+static void _dispc_write_firh_reg(enum omap_plane plane, int reg, u32 value)
+{
+	BUG_ON(plane == OMAP_DSS_GFX);
+
+	dispc_write_reg(DISPC_VID_FIR_COEF_H(plane-1, reg), value);
+}
+
+static void _dispc_write_firhv_reg(enum omap_plane plane, int reg, u32 value)
+{
+	BUG_ON(plane == OMAP_DSS_GFX);
+
+	dispc_write_reg(DISPC_VID_FIR_COEF_HV(plane-1, reg), value);
+}
+
+static void _dispc_write_firv_reg(enum omap_plane plane, int reg, u32 value)
+{
+	BUG_ON(plane == OMAP_DSS_GFX);
+
+	dispc_write_reg(DISPC_VID_FIR_COEF_V(plane-1, reg), value);
+}
+
+static void _dispc_set_scale_coef(enum omap_plane plane, int hscaleup,
+		int vscaleup, int five_taps)
+{
+	/* Coefficients for horizontal up-sampling */
+	static const u32 coef_hup[8] = {
+		0x00800000,
+		0x0D7CF800,
+		0x1E70F5FF,
+		0x335FF5FE,
+		0xF74949F7,
+		0xF55F33FB,
+		0xF5701EFE,
+		0xF87C0DFF,
+	};
+
+	/* Coefficients for horizontal down-sampling */
+	static const u32 coef_hdown[8] = {
+		0x24382400,
+		0x28371FFE,
+		0x2C361BFB,
+		0x303516F9,
+		0x11343311,
+		0x1635300C,
+		0x1B362C08,
+		0x1F372804,
+	};
+
+	/* Coefficients for horizontal and vertical up-sampling */
+	static const u32 coef_hvup[2][8] = {
+		{
+		0x00800000,
+		0x037B02FF,
+		0x0C6F05FE,
+		0x205907FB,
+		0x00404000,
+		0x075920FE,
+		0x056F0CFF,
+		0x027B0300,
+		},
+		{
+		0x00800000,
+		0x0D7CF8FF,
+		0x1E70F5FE,
+		0x335FF5FB,
+		0xF7404000,
+		0xF55F33FE,
+		0xF5701EFF,
+		0xF87C0D00,
+		},
+	};
+
+	/* Coefficients for horizontal and vertical down-sampling */
+	static const u32 coef_hvdown[2][8] = {
+		{
+		0x24382400,
+		0x28391F04,
+		0x2D381B08,
+		0x3237170C,
+		0x123737F7,
+		0x173732F9,
+		0x1B382DFB,
+		0x1F3928FE,
+		},
+		{
+		0x24382400,
+		0x28371F04,
+		0x2C361B08,
+		0x3035160C,
+		0x113433F7,
+		0x163530F9,
+		0x1B362CFB,
+		0x1F3728FE,
+		},
+	};
+
+	/* Coefficients for vertical up-sampling */
+	static const u32 coef_vup[8] = {
+		0x00000000,
+		0x0000FF00,
+		0x0000FEFF,
+		0x0000FBFE,
+		0x000000F7,
+		0x0000FEFB,
+		0x0000FFFE,
+		0x000000FF,
+	};
+
+
+	/* Coefficients for vertical down-sampling */
+	static const u32 coef_vdown[8] = {
+		0x00000000,
+		0x000004FE,
+		0x000008FB,
+		0x00000CF9,
+		0x0000F711,
+		0x0000F90C,
+		0x0000FB08,
+		0x0000FE04,
+	};
+
+	const u32 *h_coef;
+	const u32 *hv_coef;
+	const u32 *hv_coef_mod;
+	const u32 *v_coef;
+	int i;
+
+	if (hscaleup)
+		h_coef = coef_hup;
+	else
+		h_coef = coef_hdown;
+
+	if (vscaleup) {
+		hv_coef = coef_hvup[five_taps];
+		v_coef = coef_vup;
+
+		if (hscaleup)
+			hv_coef_mod = NULL;
+		else
+			hv_coef_mod = coef_hvdown[five_taps];
+	} else {
+		hv_coef = coef_hvdown[five_taps];
+		v_coef = coef_vdown;
+
+		if (hscaleup)
+			hv_coef_mod = coef_hvup[five_taps];
+		else
+			hv_coef_mod = NULL;
+	}
+
+	for (i = 0; i < 8; i++) {
+		u32 h, hv;
+
+		h = h_coef[i];
+
+		hv = hv_coef[i];
+
+		if (hv_coef_mod) {
+			hv &= 0xffffff00;
+			hv |= (hv_coef_mod[i] & 0xff);
+		}
+
+		_dispc_write_firh_reg(plane, i, h);
+		_dispc_write_firhv_reg(plane, i, hv);
+	}
+
+	if (!five_taps)
+		return;
+
+	for (i = 0; i < 8; i++) {
+		u32 v;
+		v = v_coef[i];
+		_dispc_write_firv_reg(plane, i, v);
+	}
+}
+
+static void _dispc_setup_color_conv_coef(void)
+{
+	const struct color_conv_coef {
+		int  ry,  rcr,  rcb,   gy,  gcr,  gcb,   by,  bcr,  bcb;
+		int  full_range;
+	}  ctbl_bt601_5 = {
+		298,  409,    0,  298, -208, -100,  298,    0,  517, 0,
+	};
+
+	const struct color_conv_coef *ct;
+
+#define CVAL(x, y) (FLD_VAL(x, 26, 16) | FLD_VAL(y, 10, 0))
+
+	ct = &ctbl_bt601_5;
+
+	dispc_write_reg(DISPC_VID_CONV_COEF(0, 0), CVAL(ct->rcr, ct->ry));
+	dispc_write_reg(DISPC_VID_CONV_COEF(0, 1), CVAL(ct->gy,	 ct->rcb));
+	dispc_write_reg(DISPC_VID_CONV_COEF(0, 2), CVAL(ct->gcb, ct->gcr));
+	dispc_write_reg(DISPC_VID_CONV_COEF(0, 3), CVAL(ct->bcr, ct->by));
+	dispc_write_reg(DISPC_VID_CONV_COEF(0, 4), CVAL(0,       ct->bcb));
+
+	dispc_write_reg(DISPC_VID_CONV_COEF(1, 0), CVAL(ct->rcr, ct->ry));
+	dispc_write_reg(DISPC_VID_CONV_COEF(1, 1), CVAL(ct->gy,	 ct->rcb));
+	dispc_write_reg(DISPC_VID_CONV_COEF(1, 2), CVAL(ct->gcb, ct->gcr));
+	dispc_write_reg(DISPC_VID_CONV_COEF(1, 3), CVAL(ct->bcr, ct->by));
+	dispc_write_reg(DISPC_VID_CONV_COEF(1, 4), CVAL(0,       ct->bcb));
+
+#undef CVAL
+
+	REG_FLD_MOD(DISPC_VID_ATTRIBUTES(0), ct->full_range, 11, 11);
+	REG_FLD_MOD(DISPC_VID_ATTRIBUTES(1), ct->full_range, 11, 11);
+}
+
+
+static void _dispc_set_plane_ba0(enum omap_plane plane, u32 paddr)
+{
+	const struct dispc_reg ba0_reg[] = { DISPC_GFX_BA0,
+		DISPC_VID_BA0(0),
+		DISPC_VID_BA0(1) };
+
+	dispc_write_reg(ba0_reg[plane], paddr);
+}
+
+static void _dispc_set_plane_ba1(enum omap_plane plane, u32 paddr)
+{
+	const struct dispc_reg ba1_reg[] = { DISPC_GFX_BA1,
+				      DISPC_VID_BA1(0),
+				      DISPC_VID_BA1(1) };
+
+	dispc_write_reg(ba1_reg[plane], paddr);
+}
+
+static void _dispc_set_plane_pos(enum omap_plane plane, int x, int y)
+{
+	const struct dispc_reg pos_reg[] = { DISPC_GFX_POSITION,
+				      DISPC_VID_POSITION(0),
+				      DISPC_VID_POSITION(1) };
+
+	u32 val = FLD_VAL(y, 26, 16) | FLD_VAL(x, 10, 0);
+	dispc_write_reg(pos_reg[plane], val);
+}
+
+static void _dispc_set_pic_size(enum omap_plane plane, int width, int height)
+{
+	const struct dispc_reg siz_reg[] = { DISPC_GFX_SIZE,
+				      DISPC_VID_PICTURE_SIZE(0),
+				      DISPC_VID_PICTURE_SIZE(1) };
+	u32 val = FLD_VAL(height - 1, 26, 16) | FLD_VAL(width - 1, 10, 0);
+	dispc_write_reg(siz_reg[plane], val);
+}
+
+static void _dispc_set_vid_size(enum omap_plane plane, int width, int height)
+{
+	u32 val;
+	const struct dispc_reg vsi_reg[] = { DISPC_VID_SIZE(0),
+				      DISPC_VID_SIZE(1) };
+
+	BUG_ON(plane == OMAP_DSS_GFX);
+
+	val = FLD_VAL(height - 1, 26, 16) | FLD_VAL(width - 1, 10, 0);
+	dispc_write_reg(vsi_reg[plane-1], val);
+}
+
+static void _dispc_setup_global_alpha(enum omap_plane plane, u8 global_alpha)
+{
+
+	BUG_ON(plane == OMAP_DSS_VIDEO1);
+
+	if (cpu_is_omap24xx())
+		return;
+
+	if (plane == OMAP_DSS_GFX)
+		REG_FLD_MOD(DISPC_GLOBAL_ALPHA, global_alpha, 7, 0);
+	else if (plane == OMAP_DSS_VIDEO2)
+		REG_FLD_MOD(DISPC_GLOBAL_ALPHA, global_alpha, 23, 16);
+}
+
+static void _dispc_set_pix_inc(enum omap_plane plane, s32 inc)
+{
+	const struct dispc_reg ri_reg[] = { DISPC_GFX_PIXEL_INC,
+				     DISPC_VID_PIXEL_INC(0),
+				     DISPC_VID_PIXEL_INC(1) };
+
+	dispc_write_reg(ri_reg[plane], inc);
+}
+
+static void _dispc_set_row_inc(enum omap_plane plane, s32 inc)
+{
+	const struct dispc_reg ri_reg[] = { DISPC_GFX_ROW_INC,
+				     DISPC_VID_ROW_INC(0),
+				     DISPC_VID_ROW_INC(1) };
+
+	dispc_write_reg(ri_reg[plane], inc);
+}
+
+static void _dispc_set_color_mode(enum omap_plane plane,
+		enum omap_color_mode color_mode)
+{
+	u32 m = 0;
+
+	switch (color_mode) {
+	case OMAP_DSS_COLOR_CLUT1:
+		m = 0x0; break;
+	case OMAP_DSS_COLOR_CLUT2:
+		m = 0x1; break;
+	case OMAP_DSS_COLOR_CLUT4:
+		m = 0x2; break;
+	case OMAP_DSS_COLOR_CLUT8:
+		m = 0x3; break;
+	case OMAP_DSS_COLOR_RGB12U:
+		m = 0x4; break;
+	case OMAP_DSS_COLOR_ARGB16:
+		m = 0x5; break;
+	case OMAP_DSS_COLOR_RGB16:
+		m = 0x6; break;
+	case OMAP_DSS_COLOR_RGB24U:
+		m = 0x8; break;
+	case OMAP_DSS_COLOR_RGB24P:
+		m = 0x9; break;
+	case OMAP_DSS_COLOR_YUV2:
+		m = 0xa; break;
+	case OMAP_DSS_COLOR_UYVY:
+		m = 0xb; break;
+	case OMAP_DSS_COLOR_ARGB32:
+		m = 0xc; break;
+	case OMAP_DSS_COLOR_RGBA32:
+		m = 0xd; break;
+	case OMAP_DSS_COLOR_RGBX32:
+		m = 0xe; break;
+	default:
+		BUG(); break;
+	}
+
+	REG_FLD_MOD(dispc_reg_att[plane], m, 4, 1);
+}
+
+static void _dispc_set_channel_out(enum omap_plane plane,
+		enum omap_channel channel)
+{
+	int shift;
+	u32 val;
+
+	switch (plane) {
+	case OMAP_DSS_GFX:
+		shift = 8;
+		break;
+	case OMAP_DSS_VIDEO1:
+	case OMAP_DSS_VIDEO2:
+		shift = 16;
+		break;
+	default:
+		BUG();
+		return;
+	}
+
+	val = dispc_read_reg(dispc_reg_att[plane]);
+	val = FLD_MOD(val, channel, shift, shift);
+	dispc_write_reg(dispc_reg_att[plane], val);
+}
+
+void dispc_set_burst_size(enum omap_plane plane,
+		enum omap_burst_size burst_size)
+{
+	int shift;
+	u32 val;
+
+	enable_clocks(1);
+
+	switch (plane) {
+	case OMAP_DSS_GFX:
+		shift = 6;
+		break;
+	case OMAP_DSS_VIDEO1:
+	case OMAP_DSS_VIDEO2:
+		shift = 14;
+		break;
+	default:
+		BUG();
+		return;
+	}
+
+	val = dispc_read_reg(dispc_reg_att[plane]);
+	val = FLD_MOD(val, burst_size, shift+1, shift);
+	dispc_write_reg(dispc_reg_att[plane], val);
+
+	enable_clocks(0);
+}
+
+static void _dispc_set_vid_color_conv(enum omap_plane plane, bool enable)
+{
+	u32 val;
+
+	BUG_ON(plane == OMAP_DSS_GFX);
+
+	val = dispc_read_reg(dispc_reg_att[plane]);
+	val = FLD_MOD(val, enable, 9, 9);
+	dispc_write_reg(dispc_reg_att[plane], val);
+}
+
+void dispc_enable_replication(enum omap_plane plane, bool enable)
+{
+	int bit;
+
+	if (plane == OMAP_DSS_GFX)
+		bit = 5;
+	else
+		bit = 10;
+
+	enable_clocks(1);
+	REG_FLD_MOD(dispc_reg_att[plane], enable, bit, bit);
+	enable_clocks(0);
+}
+
+void dispc_set_lcd_size(u16 width, u16 height)
+{
+	u32 val;
+	BUG_ON((width > (1 << 11)) || (height > (1 << 11)));
+	val = FLD_VAL(height - 1, 26, 16) | FLD_VAL(width - 1, 10, 0);
+	enable_clocks(1);
+	dispc_write_reg(DISPC_SIZE_LCD, val);
+	enable_clocks(0);
+}
+
+void dispc_set_digit_size(u16 width, u16 height)
+{
+	u32 val;
+	BUG_ON((width > (1 << 11)) || (height > (1 << 11)));
+	val = FLD_VAL(height - 1, 26, 16) | FLD_VAL(width - 1, 10, 0);
+	enable_clocks(1);
+	dispc_write_reg(DISPC_SIZE_DIG, val);
+	enable_clocks(0);
+}
+
+static void dispc_read_plane_fifo_sizes(void)
+{
+	const struct dispc_reg fsz_reg[] = { DISPC_GFX_FIFO_SIZE_STATUS,
+				      DISPC_VID_FIFO_SIZE_STATUS(0),
+				      DISPC_VID_FIFO_SIZE_STATUS(1) };
+	u32 size;
+	int plane;
+
+	enable_clocks(1);
+
+	for (plane = 0; plane < ARRAY_SIZE(dispc.fifo_size); ++plane) {
+		if (cpu_is_omap24xx())
+			size = FLD_GET(dispc_read_reg(fsz_reg[plane]), 8, 0);
+		else if (cpu_is_omap34xx())
+			size = FLD_GET(dispc_read_reg(fsz_reg[plane]), 10, 0);
+		else
+			BUG();
+
+		dispc.fifo_size[plane] = size;
+	}
+
+	enable_clocks(0);
+}
+
+u32 dispc_get_plane_fifo_size(enum omap_plane plane)
+{
+	return dispc.fifo_size[plane];
+}
+
+void dispc_setup_plane_fifo(enum omap_plane plane, u32 low, u32 high)
+{
+	const struct dispc_reg ftrs_reg[] = { DISPC_GFX_FIFO_THRESHOLD,
+				       DISPC_VID_FIFO_THRESHOLD(0),
+				       DISPC_VID_FIFO_THRESHOLD(1) };
+	enable_clocks(1);
+
+	DSSDBG("fifo(%d) low/high old %u/%u, new %u/%u\n",
+			plane,
+			REG_GET(ftrs_reg[plane], 11, 0),
+			REG_GET(ftrs_reg[plane], 27, 16),
+			low, high);
+
+	if (cpu_is_omap24xx())
+		dispc_write_reg(ftrs_reg[plane],
+				FLD_VAL(high, 24, 16) | FLD_VAL(low, 8, 0));
+	else
+		dispc_write_reg(ftrs_reg[plane],
+				FLD_VAL(high, 27, 16) | FLD_VAL(low, 11, 0));
+
+	enable_clocks(0);
+}
+
+void dispc_enable_fifomerge(bool enable)
+{
+	enable_clocks(1);
+
+	DSSDBG("FIFO merge %s\n", enable ? "enabled" : "disabled");
+	REG_FLD_MOD(DISPC_CONFIG, enable ? 1 : 0, 14, 14);
+
+	enable_clocks(0);
+}
+
+static void _dispc_set_fir(enum omap_plane plane, int hinc, int vinc)
+{
+	u32 val;
+	const struct dispc_reg fir_reg[] = { DISPC_VID_FIR(0),
+				      DISPC_VID_FIR(1) };
+
+	BUG_ON(plane == OMAP_DSS_GFX);
+
+	if (cpu_is_omap24xx())
+		val = FLD_VAL(vinc, 27, 16) | FLD_VAL(hinc, 11, 0);
+	else
+		val = FLD_VAL(vinc, 28, 16) | FLD_VAL(hinc, 12, 0);
+	dispc_write_reg(fir_reg[plane-1], val);
+}
+
+static void _dispc_set_vid_accu0(enum omap_plane plane, int haccu, int vaccu)
+{
+	u32 val;
+	const struct dispc_reg ac0_reg[] = { DISPC_VID_ACCU0(0),
+				      DISPC_VID_ACCU0(1) };
+
+	BUG_ON(plane == OMAP_DSS_GFX);
+
+	val = FLD_VAL(vaccu, 25, 16) | FLD_VAL(haccu, 9, 0);
+	dispc_write_reg(ac0_reg[plane-1], val);
+}
+
+static void _dispc_set_vid_accu1(enum omap_plane plane, int haccu, int vaccu)
+{
+	u32 val;
+	const struct dispc_reg ac1_reg[] = { DISPC_VID_ACCU1(0),
+				      DISPC_VID_ACCU1(1) };
+
+	BUG_ON(plane == OMAP_DSS_GFX);
+
+	val = FLD_VAL(vaccu, 25, 16) | FLD_VAL(haccu, 9, 0);
+	dispc_write_reg(ac1_reg[plane-1], val);
+}
+
+
+static void _dispc_set_scaling(enum omap_plane plane,
+		u16 orig_width, u16 orig_height,
+		u16 out_width, u16 out_height,
+		bool ilace, bool five_taps,
+		bool fieldmode)
+{
+	int fir_hinc;
+	int fir_vinc;
+	int hscaleup, vscaleup;
+	int accu0 = 0;
+	int accu1 = 0;
+	u32 l;
+
+	BUG_ON(plane == OMAP_DSS_GFX);
+
+	hscaleup = orig_width <= out_width;
+	vscaleup = orig_height <= out_height;
+
+	_dispc_set_scale_coef(plane, hscaleup, vscaleup, five_taps);
+
+	if (!orig_width || orig_width == out_width)
+		fir_hinc = 0;
+	else
+		fir_hinc = 1024 * orig_width / out_width;
+
+	if (!orig_height || orig_height == out_height)
+		fir_vinc = 0;
+	else
+		fir_vinc = 1024 * orig_height / out_height;
+
+	_dispc_set_fir(plane, fir_hinc, fir_vinc);
+
+	l = dispc_read_reg(dispc_reg_att[plane]);
+	l &= ~((0x0f << 5) | (0x3 << 21));
+
+	l |= fir_hinc ? (1 << 5) : 0;
+	l |= fir_vinc ? (1 << 6) : 0;
+
+	l |= hscaleup ? 0 : (1 << 7);
+	l |= vscaleup ? 0 : (1 << 8);
+
+	l |= five_taps ? (1 << 21) : 0;
+	l |= five_taps ? (1 << 22) : 0;
+
+	dispc_write_reg(dispc_reg_att[plane], l);
+
+	/*
+	 * field 0 = even field = bottom field
+	 * field 1 = odd field = top field
+	 */
+	if (ilace && !fieldmode) {
+		accu1 = 0;
+		accu0 = (fir_vinc / 2) & 0x3ff;
+		if (accu0 >= 1024/2) {
+			accu1 = 1024/2;
+			accu0 -= accu1;
+		}
+	}
+
+	_dispc_set_vid_accu0(plane, 0, accu0);
+	_dispc_set_vid_accu1(plane, 0, accu1);
+}
+
+static void _dispc_set_rotation_attrs(enum omap_plane plane, u8 rotation,
+		bool mirroring, enum omap_color_mode color_mode)
+{
+	if (color_mode == OMAP_DSS_COLOR_YUV2 ||
+			color_mode == OMAP_DSS_COLOR_UYVY) {
+		int vidrot = 0;
+
+		if (mirroring) {
+			switch (rotation) {
+			case OMAP_DSS_ROT_0:
+				vidrot = 2;
+				break;
+			case OMAP_DSS_ROT_90:
+				vidrot = 1;
+				break;
+			case OMAP_DSS_ROT_180:
+				vidrot = 0;
+				break;
+			case OMAP_DSS_ROT_270:
+				vidrot = 3;
+				break;
+			}
+		} else {
+			switch (rotation) {
+			case OMAP_DSS_ROT_0:
+				vidrot = 0;
+				break;
+			case OMAP_DSS_ROT_90:
+				vidrot = 1;
+				break;
+			case OMAP_DSS_ROT_180:
+				vidrot = 2;
+				break;
+			case OMAP_DSS_ROT_270:
+				vidrot = 3;
+				break;
+			}
+		}
+
+		REG_FLD_MOD(dispc_reg_att[plane], vidrot, 13, 12);
+
+		if (rotation == OMAP_DSS_ROT_90 || rotation == OMAP_DSS_ROT_270)
+			REG_FLD_MOD(dispc_reg_att[plane], 0x1, 18, 18);
+		else
+			REG_FLD_MOD(dispc_reg_att[plane], 0x0, 18, 18);
+	} else {
+		REG_FLD_MOD(dispc_reg_att[plane], 0, 13, 12);
+		REG_FLD_MOD(dispc_reg_att[plane], 0, 18, 18);
+	}
+}
+
+static int color_mode_to_bpp(enum omap_color_mode color_mode)
+{
+	switch (color_mode) {
+	case OMAP_DSS_COLOR_CLUT1:
+		return 1;
+	case OMAP_DSS_COLOR_CLUT2:
+		return 2;
+	case OMAP_DSS_COLOR_CLUT4:
+		return 4;
+	case OMAP_DSS_COLOR_CLUT8:
+		return 8;
+	case OMAP_DSS_COLOR_RGB12U:
+	case OMAP_DSS_COLOR_RGB16:
+	case OMAP_DSS_COLOR_ARGB16:
+	case OMAP_DSS_COLOR_YUV2:
+	case OMAP_DSS_COLOR_UYVY:
+		return 16;
+	case OMAP_DSS_COLOR_RGB24P:
+		return 24;
+	case OMAP_DSS_COLOR_RGB24U:
+	case OMAP_DSS_COLOR_ARGB32:
+	case OMAP_DSS_COLOR_RGBA32:
+	case OMAP_DSS_COLOR_RGBX32:
+		return 32;
+	default:
+		BUG();
+	}
+}
+
+static s32 pixinc(int pixels, u8 ps)
+{
+	if (pixels == 1)
+		return 1;
+	else if (pixels > 1)
+		return 1 + (pixels - 1) * ps;
+	else if (pixels < 0)
+		return 1 - (-pixels + 1) * ps;
+	else
+		BUG();
+}
+
+static void calc_vrfb_rotation_offset(u8 rotation, bool mirror,
+		u16 screen_width,
+		u16 width, u16 height,
+		enum omap_color_mode color_mode, bool fieldmode,
+		unsigned int field_offset,
+		unsigned *offset0, unsigned *offset1,
+		s32 *row_inc, s32 *pix_inc)
+{
+	u8 ps;
+
+	/* FIXME CLUT formats */
+	switch (color_mode) {
+	case OMAP_DSS_COLOR_CLUT1:
+	case OMAP_DSS_COLOR_CLUT2:
+	case OMAP_DSS_COLOR_CLUT4:
+	case OMAP_DSS_COLOR_CLUT8:
+		BUG();
+		return;
+	case OMAP_DSS_COLOR_YUV2:
+	case OMAP_DSS_COLOR_UYVY:
+		ps = 4;
+		break;
+	default:
+		ps = color_mode_to_bpp(color_mode) / 8;
+		break;
+	}
+
+	DSSDBG("calc_rot(%d): scrw %d, %dx%d\n", rotation, screen_width,
+			width, height);
+
+	/*
+	 * field 0 = even field = bottom field
+	 * field 1 = odd field = top field
+	 */
+	switch (rotation + mirror * 4) {
+	case OMAP_DSS_ROT_0:
+	case OMAP_DSS_ROT_180:
+		/*
+		 * If the pixel format is YUV or UYVY divide the width
+		 * of the image by 2 for 0 and 180 degree rotation.
+		 */
+		if (color_mode == OMAP_DSS_COLOR_YUV2 ||
+			color_mode == OMAP_DSS_COLOR_UYVY)
+			width = width >> 1;
+	case OMAP_DSS_ROT_90:
+	case OMAP_DSS_ROT_270:
+		*offset1 = 0;
+		if (field_offset)
+			*offset0 = field_offset * screen_width * ps;
+		else
+			*offset0 = 0;
+
+		*row_inc = pixinc(1 + (screen_width - width) +
+				(fieldmode ? screen_width : 0),
+				ps);
+		*pix_inc = pixinc(1, ps);
+		break;
+
+	case OMAP_DSS_ROT_0 + 4:
+	case OMAP_DSS_ROT_180 + 4:
+		/* If the pixel format is YUV or UYVY divide the width
+		 * of the image by 2  for 0 degree and 180 degree
+		 */
+		if (color_mode == OMAP_DSS_COLOR_YUV2 ||
+			color_mode == OMAP_DSS_COLOR_UYVY)
+			width = width >> 1;
+	case OMAP_DSS_ROT_90 + 4:
+	case OMAP_DSS_ROT_270 + 4:
+		*offset1 = 0;
+		if (field_offset)
+			*offset0 = field_offset * screen_width * ps;
+		else
+			*offset0 = 0;
+		*row_inc = pixinc(1 - (screen_width + width) -
+				(fieldmode ? screen_width : 0),
+				ps);
+		*pix_inc = pixinc(1, ps);
+		break;
+
+	default:
+		BUG();
+	}
+}
+
+static void calc_dma_rotation_offset(u8 rotation, bool mirror,
+		u16 screen_width,
+		u16 width, u16 height,
+		enum omap_color_mode color_mode, bool fieldmode,
+		unsigned int field_offset,
+		unsigned *offset0, unsigned *offset1,
+		s32 *row_inc, s32 *pix_inc)
+{
+	u8 ps;
+	u16 fbw, fbh;
+
+	/* FIXME CLUT formats */
+	switch (color_mode) {
+	case OMAP_DSS_COLOR_CLUT1:
+	case OMAP_DSS_COLOR_CLUT2:
+	case OMAP_DSS_COLOR_CLUT4:
+	case OMAP_DSS_COLOR_CLUT8:
+		BUG();
+		return;
+	default:
+		ps = color_mode_to_bpp(color_mode) / 8;
+		break;
+	}
+
+	DSSDBG("calc_rot(%d): scrw %d, %dx%d\n", rotation, screen_width,
+			width, height);
+
+	/* width & height are overlay sizes, convert to fb sizes */
+
+	if (rotation == OMAP_DSS_ROT_0 || rotation == OMAP_DSS_ROT_180) {
+		fbw = width;
+		fbh = height;
+	} else {
+		fbw = height;
+		fbh = width;
+	}
+
+	/*
+	 * field 0 = even field = bottom field
+	 * field 1 = odd field = top field
+	 */
+	switch (rotation + mirror * 4) {
+	case OMAP_DSS_ROT_0:
+		*offset1 = 0;
+		if (field_offset)
+			*offset0 = *offset1 + field_offset * screen_width * ps;
+		else
+			*offset0 = *offset1;
+		*row_inc = pixinc(1 + (screen_width - fbw) +
+				(fieldmode ? screen_width : 0),
+				ps);
+		*pix_inc = pixinc(1, ps);
+		break;
+	case OMAP_DSS_ROT_90:
+		*offset1 = screen_width * (fbh - 1) * ps;
+		if (field_offset)
+			*offset0 = *offset1 + field_offset * ps;
+		else
+			*offset0 = *offset1;
+		*row_inc = pixinc(screen_width * (fbh - 1) + 1 +
+				(fieldmode ? 1 : 0), ps);
+		*pix_inc = pixinc(-screen_width, ps);
+		break;
+	case OMAP_DSS_ROT_180:
+		*offset1 = (screen_width * (fbh - 1) + fbw - 1) * ps;
+		if (field_offset)
+			*offset0 = *offset1 - field_offset * screen_width * ps;
+		else
+			*offset0 = *offset1;
+		*row_inc = pixinc(-1 -
+				(screen_width - fbw) -
+				(fieldmode ? screen_width : 0),
+				ps);
+		*pix_inc = pixinc(-1, ps);
+		break;
+	case OMAP_DSS_ROT_270:
+		*offset1 = (fbw - 1) * ps;
+		if (field_offset)
+			*offset0 = *offset1 - field_offset * ps;
+		else
+			*offset0 = *offset1;
+		*row_inc = pixinc(-screen_width * (fbh - 1) - 1 -
+				(fieldmode ? 1 : 0), ps);
+		*pix_inc = pixinc(screen_width, ps);
+		break;
+
+	/* mirroring */
+	case OMAP_DSS_ROT_0 + 4:
+		*offset1 = (fbw - 1) * ps;
+		if (field_offset)
+			*offset0 = *offset1 + field_offset * screen_width * ps;
+		else
+			*offset0 = *offset1;
+		*row_inc = pixinc(screen_width * 2 - 1 +
+				(fieldmode ? screen_width : 0),
+				ps);
+		*pix_inc = pixinc(-1, ps);
+		break;
+
+	case OMAP_DSS_ROT_90 + 4:
+		*offset1 = 0;
+		if (field_offset)
+			*offset0 = *offset1 + field_offset * ps;
+		else
+			*offset0 = *offset1;
+		*row_inc = pixinc(-screen_width * (fbh - 1) + 1 +
+				(fieldmode ? 1 : 0),
+				ps);
+		*pix_inc = pixinc(screen_width, ps);
+		break;
+
+	case OMAP_DSS_ROT_180 + 4:
+		*offset1 = screen_width * (fbh - 1) * ps;
+		if (field_offset)
+			*offset0 = *offset1 - field_offset * screen_width * ps;
+		else
+			*offset0 = *offset1;
+		*row_inc = pixinc(1 - screen_width * 2 -
+				(fieldmode ? screen_width : 0),
+				ps);
+		*pix_inc = pixinc(1, ps);
+		break;
+
+	case OMAP_DSS_ROT_270 + 4:
+		*offset1 = (screen_width * (fbh - 1) + fbw - 1) * ps;
+		if (field_offset)
+			*offset0 = *offset1 - field_offset * ps;
+		else
+			*offset0 = *offset1;
+		*row_inc = pixinc(screen_width * (fbh - 1) - 1 -
+				(fieldmode ? 1 : 0),
+				ps);
+		*pix_inc = pixinc(-screen_width, ps);
+		break;
+
+	default:
+		BUG();
+	}
+}
+
+static unsigned long calc_fclk_five_taps(u16 width, u16 height,
+		u16 out_width, u16 out_height, enum omap_color_mode color_mode)
+{
+	u32 fclk = 0;
+	/* FIXME venc pclk? */
+	u64 tmp, pclk = dispc_pclk_rate();
+
+	if (height > out_height) {
+		/* FIXME get real display PPL */
+		unsigned int ppl = 800;
+
+		tmp = pclk * height * out_width;
+		do_div(tmp, 2 * out_height * ppl);
+		fclk = tmp;
+
+		if (height > 2 * out_height) {
+			if (ppl == out_width)
+				return 0;
+
+			tmp = pclk * (height - 2 * out_height) * out_width;
+			do_div(tmp, 2 * out_height * (ppl - out_width));
+			fclk = max(fclk, (u32) tmp);
+		}
+	}
+
+	if (width > out_width) {
+		tmp = pclk * width;
+		do_div(tmp, out_width);
+		fclk = max(fclk, (u32) tmp);
+
+		if (color_mode == OMAP_DSS_COLOR_RGB24U)
+			fclk <<= 1;
+	}
+
+	return fclk;
+}
+
+static unsigned long calc_fclk(u16 width, u16 height,
+		u16 out_width, u16 out_height)
+{
+	unsigned int hf, vf;
+
+	/*
+	 * FIXME how to determine the 'A' factor
+	 * for the no downscaling case ?
+	 */
+
+	if (width > 3 * out_width)
+		hf = 4;
+	else if (width > 2 * out_width)
+		hf = 3;
+	else if (width > out_width)
+		hf = 2;
+	else
+		hf = 1;
+
+	if (height > out_height)
+		vf = 2;
+	else
+		vf = 1;
+
+	/* FIXME venc pclk? */
+	return dispc_pclk_rate() * vf * hf;
+}
+
+void dispc_set_channel_out(enum omap_plane plane, enum omap_channel channel_out)
+{
+	enable_clocks(1);
+	_dispc_set_channel_out(plane, channel_out);
+	enable_clocks(0);
+}
+
+static int _dispc_setup_plane(enum omap_plane plane,
+		u32 paddr, u16 screen_width,
+		u16 pos_x, u16 pos_y,
+		u16 width, u16 height,
+		u16 out_width, u16 out_height,
+		enum omap_color_mode color_mode,
+		bool ilace,
+		enum omap_dss_rotation_type rotation_type,
+		u8 rotation, int mirror,
+		u8 global_alpha)
+{
+	const int maxdownscale = cpu_is_omap34xx() ? 4 : 2;
+	bool five_taps = 0;
+	bool fieldmode = 0;
+	int cconv = 0;
+	unsigned offset0, offset1;
+	s32 row_inc;
+	s32 pix_inc;
+	u16 frame_height = height;
+	unsigned int field_offset = 0;
+
+	if (paddr == 0)
+		return -EINVAL;
+
+	if (ilace && height == out_height)
+		fieldmode = 1;
+
+	if (ilace) {
+		if (fieldmode)
+			height /= 2;
+		pos_y /= 2;
+		out_height /= 2;
+
+		DSSDBG("adjusting for ilace: height %d, pos_y %d, "
+				"out_height %d\n",
+				height, pos_y, out_height);
+	}
+
+	if (plane == OMAP_DSS_GFX) {
+		if (width != out_width || height != out_height)
+			return -EINVAL;
+
+		switch (color_mode) {
+		case OMAP_DSS_COLOR_ARGB16:
+		case OMAP_DSS_COLOR_ARGB32:
+		case OMAP_DSS_COLOR_RGBA32:
+		case OMAP_DSS_COLOR_RGBX32:
+			if (cpu_is_omap24xx())
+				return -EINVAL;
+			/* fall through */
+		case OMAP_DSS_COLOR_RGB12U:
+		case OMAP_DSS_COLOR_RGB16:
+		case OMAP_DSS_COLOR_RGB24P:
+		case OMAP_DSS_COLOR_RGB24U:
+			break;
+
+		default:
+			return -EINVAL;
+		}
+	} else {
+		/* video plane */
+
+		unsigned long fclk = 0;
+
+		if (out_width < width / maxdownscale ||
+		   out_width > width * 8)
+			return -EINVAL;
+
+		if (out_height < height / maxdownscale ||
+		   out_height > height * 8)
+			return -EINVAL;
+
+		switch (color_mode) {
+		case OMAP_DSS_COLOR_RGBX32:
+		case OMAP_DSS_COLOR_RGB12U:
+			if (cpu_is_omap24xx())
+				return -EINVAL;
+			/* fall through */
+		case OMAP_DSS_COLOR_RGB16:
+		case OMAP_DSS_COLOR_RGB24P:
+		case OMAP_DSS_COLOR_RGB24U:
+			break;
+
+		case OMAP_DSS_COLOR_ARGB16:
+		case OMAP_DSS_COLOR_ARGB32:
+		case OMAP_DSS_COLOR_RGBA32:
+			if (cpu_is_omap24xx())
+				return -EINVAL;
+			if (plane == OMAP_DSS_VIDEO1)
+				return -EINVAL;
+			break;
+
+		case OMAP_DSS_COLOR_YUV2:
+		case OMAP_DSS_COLOR_UYVY:
+			cconv = 1;
+			break;
+
+		default:
+			return -EINVAL;
+		}
+
+		/* Must use 5-tap filter? */
+		five_taps = height > out_height * 2;
+
+		if (!five_taps) {
+			fclk = calc_fclk(width, height,
+					out_width, out_height);
+
+			/* Try 5-tap filter if 3-tap fclk is too high */
+			if (cpu_is_omap34xx() && height > out_height &&
+					fclk > dispc_fclk_rate())
+				five_taps = true;
+		}
+
+		if (width > (2048 >> five_taps)) {
+			DSSERR("failed to set up scaling, fclk too low\n");
+			return -EINVAL;
+		}
+
+		if (five_taps)
+			fclk = calc_fclk_five_taps(width, height,
+					out_width, out_height, color_mode);
+
+		DSSDBG("required fclk rate = %lu Hz\n", fclk);
+		DSSDBG("current fclk rate = %lu Hz\n", dispc_fclk_rate());
+
+		if (!fclk || fclk > dispc_fclk_rate()) {
+			DSSERR("failed to set up scaling, "
+					"required fclk rate = %lu Hz, "
+					"current fclk rate = %lu Hz\n",
+					fclk, dispc_fclk_rate());
+			return -EINVAL;
+		}
+	}
+
+	if (ilace && !fieldmode) {
+		/*
+		 * when downscaling the bottom field may have to start several
+		 * source lines below the top field. Unfortunately ACCUI
+		 * registers will only hold the fractional part of the offset
+		 * so the integer part must be added to the base address of the
+		 * bottom field.
+		 */
+		if (!height || height == out_height)
+			field_offset = 0;
+		else
+			field_offset = height / out_height / 2;
+	}
+
+	/* Fields are independent but interleaved in memory. */
+	if (fieldmode)
+		field_offset = 1;
+
+	if (rotation_type == OMAP_DSS_ROT_DMA)
+		calc_dma_rotation_offset(rotation, mirror,
+				screen_width, width, frame_height, color_mode,
+				fieldmode, field_offset,
+				&offset0, &offset1, &row_inc, &pix_inc);
+	else
+		calc_vrfb_rotation_offset(rotation, mirror,
+				screen_width, width, frame_height, color_mode,
+				fieldmode, field_offset,
+				&offset0, &offset1, &row_inc, &pix_inc);
+
+	DSSDBG("offset0 %u, offset1 %u, row_inc %d, pix_inc %d\n",
+			offset0, offset1, row_inc, pix_inc);
+
+	_dispc_set_color_mode(plane, color_mode);
+
+	_dispc_set_plane_ba0(plane, paddr + offset0);
+	_dispc_set_plane_ba1(plane, paddr + offset1);
+
+	_dispc_set_row_inc(plane, row_inc);
+	_dispc_set_pix_inc(plane, pix_inc);
+
+	DSSDBG("%d,%d %dx%d -> %dx%d\n", pos_x, pos_y, width, height,
+			out_width, out_height);
+
+	_dispc_set_plane_pos(plane, pos_x, pos_y);
+
+	_dispc_set_pic_size(plane, width, height);
+
+	if (plane != OMAP_DSS_GFX) {
+		_dispc_set_scaling(plane, width, height,
+				   out_width, out_height,
+				   ilace, five_taps, fieldmode);
+		_dispc_set_vid_size(plane, out_width, out_height);
+		_dispc_set_vid_color_conv(plane, cconv);
+	}
+
+	_dispc_set_rotation_attrs(plane, rotation, mirror, color_mode);
+
+	if (plane != OMAP_DSS_VIDEO1)
+		_dispc_setup_global_alpha(plane, global_alpha);
+
+	return 0;
+}
+
+static void _dispc_enable_plane(enum omap_plane plane, bool enable)
+{
+	REG_FLD_MOD(dispc_reg_att[plane], enable ? 1 : 0, 0, 0);
+}
+
+static void dispc_disable_isr(void *data, u32 mask)
+{
+	struct completion *compl = data;
+	complete(compl);
+}
+
+static void _enable_lcd_out(bool enable)
+{
+	REG_FLD_MOD(DISPC_CONTROL, enable ? 1 : 0, 0, 0);
+}
+
+void dispc_enable_lcd_out(bool enable)
+{
+	struct completion frame_done_completion;
+	bool is_on;
+	int r;
+
+	enable_clocks(1);
+
+	/* When we disable LCD output, we need to wait until frame is done.
+	 * Otherwise the DSS is still working, and turning off the clocks
+	 * prevents DSS from going to OFF mode */
+	is_on = REG_GET(DISPC_CONTROL, 0, 0);
+
+	if (!enable && is_on) {
+		init_completion(&frame_done_completion);
+
+		r = omap_dispc_register_isr(dispc_disable_isr,
+				&frame_done_completion,
+				DISPC_IRQ_FRAMEDONE);
+
+		if (r)
+			DSSERR("failed to register FRAMEDONE isr\n");
+	}
+
+	_enable_lcd_out(enable);
+
+	if (!enable && is_on) {
+		if (!wait_for_completion_timeout(&frame_done_completion,
+					msecs_to_jiffies(100)))
+			DSSERR("timeout waiting for FRAME DONE\n");
+
+		r = omap_dispc_unregister_isr(dispc_disable_isr,
+				&frame_done_completion,
+				DISPC_IRQ_FRAMEDONE);
+
+		if (r)
+			DSSERR("failed to unregister FRAMEDONE isr\n");
+	}
+
+	enable_clocks(0);
+}
+
+static void _enable_digit_out(bool enable)
+{
+	REG_FLD_MOD(DISPC_CONTROL, enable ? 1 : 0, 1, 1);
+}
+
+void dispc_enable_digit_out(bool enable)
+{
+	struct completion frame_done_completion;
+	int r;
+
+	enable_clocks(1);
+
+	if (REG_GET(DISPC_CONTROL, 1, 1) == enable) {
+		enable_clocks(0);
+		return;
+	}
+
+	if (enable) {
+		unsigned long flags;
+		/* When we enable digit output, we'll get an extra digit
+		 * sync lost interrupt, that we need to ignore */
+		spin_lock_irqsave(&dispc.irq_lock, flags);
+		dispc.irq_error_mask &= ~DISPC_IRQ_SYNC_LOST_DIGIT;
+		_omap_dispc_set_irqs();
+		spin_unlock_irqrestore(&dispc.irq_lock, flags);
+	}
+
+	/* When we disable digit output, we need to wait until fields are done.
+	 * Otherwise the DSS is still working, and turning off the clocks
+	 * prevents DSS from going to OFF mode. And when enabling, we need to
+	 * wait for the extra sync losts */
+	init_completion(&frame_done_completion);
+
+	r = omap_dispc_register_isr(dispc_disable_isr, &frame_done_completion,
+			DISPC_IRQ_EVSYNC_EVEN | DISPC_IRQ_EVSYNC_ODD);
+	if (r)
+		DSSERR("failed to register EVSYNC isr\n");
+
+	_enable_digit_out(enable);
+
+	/* XXX I understand from TRM that we should only wait for the
+	 * current field to complete. But it seems we have to wait
+	 * for both fields */
+	if (!wait_for_completion_timeout(&frame_done_completion,
+				msecs_to_jiffies(100)))
+		DSSERR("timeout waiting for EVSYNC\n");
+
+	if (!wait_for_completion_timeout(&frame_done_completion,
+				msecs_to_jiffies(100)))
+		DSSERR("timeout waiting for EVSYNC\n");
+
+	r = omap_dispc_unregister_isr(dispc_disable_isr,
+			&frame_done_completion,
+			DISPC_IRQ_EVSYNC_EVEN | DISPC_IRQ_EVSYNC_ODD);
+	if (r)
+		DSSERR("failed to unregister EVSYNC isr\n");
+
+	if (enable) {
+		unsigned long flags;
+		spin_lock_irqsave(&dispc.irq_lock, flags);
+		dispc.irq_error_mask = DISPC_IRQ_MASK_ERROR;
+		dispc_write_reg(DISPC_IRQSTATUS, DISPC_IRQ_SYNC_LOST_DIGIT);
+		_omap_dispc_set_irqs();
+		spin_unlock_irqrestore(&dispc.irq_lock, flags);
+	}
+
+	enable_clocks(0);
+}
+
+void dispc_lcd_enable_signal_polarity(bool act_high)
+{
+	enable_clocks(1);
+	REG_FLD_MOD(DISPC_CONTROL, act_high ? 1 : 0, 29, 29);
+	enable_clocks(0);
+}
+
+void dispc_lcd_enable_signal(bool enable)
+{
+	enable_clocks(1);
+	REG_FLD_MOD(DISPC_CONTROL, enable ? 1 : 0, 28, 28);
+	enable_clocks(0);
+}
+
+void dispc_pck_free_enable(bool enable)
+{
+	enable_clocks(1);
+	REG_FLD_MOD(DISPC_CONTROL, enable ? 1 : 0, 27, 27);
+	enable_clocks(0);
+}
+
+void dispc_enable_fifohandcheck(bool enable)
+{
+	enable_clocks(1);
+	REG_FLD_MOD(DISPC_CONFIG, enable ? 1 : 0, 16, 16);
+	enable_clocks(0);
+}
+
+
+void dispc_set_lcd_display_type(enum omap_lcd_display_type type)
+{
+	int mode;
+
+	switch (type) {
+	case OMAP_DSS_LCD_DISPLAY_STN:
+		mode = 0;
+		break;
+
+	case OMAP_DSS_LCD_DISPLAY_TFT:
+		mode = 1;
+		break;
+
+	default:
+		BUG();
+		return;
+	}
+
+	enable_clocks(1);
+	REG_FLD_MOD(DISPC_CONTROL, mode, 3, 3);
+	enable_clocks(0);
+}
+
+void dispc_set_loadmode(enum omap_dss_load_mode mode)
+{
+	enable_clocks(1);
+	REG_FLD_MOD(DISPC_CONFIG, mode, 2, 1);
+	enable_clocks(0);
+}
+
+
+void dispc_set_default_color(enum omap_channel channel, u32 color)
+{
+	const struct dispc_reg def_reg[] = { DISPC_DEFAULT_COLOR0,
+				DISPC_DEFAULT_COLOR1 };
+
+	enable_clocks(1);
+	dispc_write_reg(def_reg[channel], color);
+	enable_clocks(0);
+}
+
+u32 dispc_get_default_color(enum omap_channel channel)
+{
+	const struct dispc_reg def_reg[] = { DISPC_DEFAULT_COLOR0,
+				DISPC_DEFAULT_COLOR1 };
+	u32 l;
+
+	BUG_ON(channel != OMAP_DSS_CHANNEL_DIGIT &&
+	       channel != OMAP_DSS_CHANNEL_LCD);
+
+	enable_clocks(1);
+	l = dispc_read_reg(def_reg[channel]);
+	enable_clocks(0);
+
+	return l;
+}
+
+void dispc_set_trans_key(enum omap_channel ch,
+		enum omap_dss_trans_key_type type,
+		u32 trans_key)
+{
+	const struct dispc_reg tr_reg[] = {
+		DISPC_TRANS_COLOR0, DISPC_TRANS_COLOR1 };
+
+	enable_clocks(1);
+	if (ch == OMAP_DSS_CHANNEL_LCD)
+		REG_FLD_MOD(DISPC_CONFIG, type, 11, 11);
+	else /* OMAP_DSS_CHANNEL_DIGIT */
+		REG_FLD_MOD(DISPC_CONFIG, type, 13, 13);
+
+	dispc_write_reg(tr_reg[ch], trans_key);
+	enable_clocks(0);
+}
+
+void dispc_get_trans_key(enum omap_channel ch,
+		enum omap_dss_trans_key_type *type,
+		u32 *trans_key)
+{
+	const struct dispc_reg tr_reg[] = {
+		DISPC_TRANS_COLOR0, DISPC_TRANS_COLOR1 };
+
+	enable_clocks(1);
+	if (type) {
+		if (ch == OMAP_DSS_CHANNEL_LCD)
+			*type = REG_GET(DISPC_CONFIG, 11, 11);
+		else if (ch == OMAP_DSS_CHANNEL_DIGIT)
+			*type = REG_GET(DISPC_CONFIG, 13, 13);
+		else
+			BUG();
+	}
+
+	if (trans_key)
+		*trans_key = dispc_read_reg(tr_reg[ch]);
+	enable_clocks(0);
+}
+
+void dispc_enable_trans_key(enum omap_channel ch, bool enable)
+{
+	enable_clocks(1);
+	if (ch == OMAP_DSS_CHANNEL_LCD)
+		REG_FLD_MOD(DISPC_CONFIG, enable, 10, 10);
+	else /* OMAP_DSS_CHANNEL_DIGIT */
+		REG_FLD_MOD(DISPC_CONFIG, enable, 12, 12);
+	enable_clocks(0);
+}
+void dispc_enable_alpha_blending(enum omap_channel ch, bool enable)
+{
+	if (cpu_is_omap24xx())
+		return;
+
+	enable_clocks(1);
+	if (ch == OMAP_DSS_CHANNEL_LCD)
+		REG_FLD_MOD(DISPC_CONFIG, enable, 18, 18);
+	else /* OMAP_DSS_CHANNEL_DIGIT */
+		REG_FLD_MOD(DISPC_CONFIG, enable, 19, 19);
+	enable_clocks(0);
+}
+bool dispc_alpha_blending_enabled(enum omap_channel ch)
+{
+	bool enabled;
+
+	if (cpu_is_omap24xx())
+		return false;
+
+	enable_clocks(1);
+	if (ch == OMAP_DSS_CHANNEL_LCD)
+		enabled = REG_GET(DISPC_CONFIG, 18, 18);
+	else if (ch == OMAP_DSS_CHANNEL_DIGIT)
+		enabled = REG_GET(DISPC_CONFIG, 18, 18);
+	else
+		BUG();
+	enable_clocks(0);
+
+	return enabled;
+
+}
+
+
+bool dispc_trans_key_enabled(enum omap_channel ch)
+{
+	bool enabled;
+
+	enable_clocks(1);
+	if (ch == OMAP_DSS_CHANNEL_LCD)
+		enabled = REG_GET(DISPC_CONFIG, 10, 10);
+	else if (ch == OMAP_DSS_CHANNEL_DIGIT)
+		enabled = REG_GET(DISPC_CONFIG, 12, 12);
+	else
+		BUG();
+	enable_clocks(0);
+
+	return enabled;
+}
+
+
+void dispc_set_tft_data_lines(u8 data_lines)
+{
+	int code;
+
+	switch (data_lines) {
+	case 12:
+		code = 0;
+		break;
+	case 16:
+		code = 1;
+		break;
+	case 18:
+		code = 2;
+		break;
+	case 24:
+		code = 3;
+		break;
+	default:
+		BUG();
+		return;
+	}
+
+	enable_clocks(1);
+	REG_FLD_MOD(DISPC_CONTROL, code, 9, 8);
+	enable_clocks(0);
+}
+
+void dispc_set_parallel_interface_mode(enum omap_parallel_interface_mode mode)
+{
+	u32 l;
+	int stallmode;
+	int gpout0 = 1;
+	int gpout1;
+
+	switch (mode) {
+	case OMAP_DSS_PARALLELMODE_BYPASS:
+		stallmode = 0;
+		gpout1 = 1;
+		break;
+
+	case OMAP_DSS_PARALLELMODE_RFBI:
+		stallmode = 1;
+		gpout1 = 0;
+		break;
+
+	case OMAP_DSS_PARALLELMODE_DSI:
+		stallmode = 1;
+		gpout1 = 1;
+		break;
+
+	default:
+		BUG();
+		return;
+	}
+
+	enable_clocks(1);
+
+	l = dispc_read_reg(DISPC_CONTROL);
+
+	l = FLD_MOD(l, stallmode, 11, 11);
+	l = FLD_MOD(l, gpout0, 15, 15);
+	l = FLD_MOD(l, gpout1, 16, 16);
+
+	dispc_write_reg(DISPC_CONTROL, l);
+
+	enable_clocks(0);
+}
+
+static bool _dispc_lcd_timings_ok(int hsw, int hfp, int hbp,
+		int vsw, int vfp, int vbp)
+{
+	if (cpu_is_omap24xx() || omap_rev() < OMAP3430_REV_ES3_0) {
+		if (hsw < 1 || hsw > 64 ||
+				hfp < 1 || hfp > 256 ||
+				hbp < 1 || hbp > 256 ||
+				vsw < 1 || vsw > 64 ||
+				vfp < 0 || vfp > 255 ||
+				vbp < 0 || vbp > 255)
+			return false;
+	} else {
+		if (hsw < 1 || hsw > 256 ||
+				hfp < 1 || hfp > 4096 ||
+				hbp < 1 || hbp > 4096 ||
+				vsw < 1 || vsw > 256 ||
+				vfp < 0 || vfp > 4095 ||
+				vbp < 0 || vbp > 4095)
+			return false;
+	}
+
+	return true;
+}
+
+bool dispc_lcd_timings_ok(struct omap_video_timings *timings)
+{
+	return _dispc_lcd_timings_ok(timings->hsw, timings->hfp,
+			timings->hbp, timings->vsw,
+			timings->vfp, timings->vbp);
+}
+
+static void _dispc_set_lcd_timings(int hsw, int hfp, int hbp,
+				   int vsw, int vfp, int vbp)
+{
+	u32 timing_h, timing_v;
+
+	if (cpu_is_omap24xx() || omap_rev() < OMAP3430_REV_ES3_0) {
+		timing_h = FLD_VAL(hsw-1, 5, 0) | FLD_VAL(hfp-1, 15, 8) |
+			FLD_VAL(hbp-1, 27, 20);
+
+		timing_v = FLD_VAL(vsw-1, 5, 0) | FLD_VAL(vfp, 15, 8) |
+			FLD_VAL(vbp, 27, 20);
+	} else {
+		timing_h = FLD_VAL(hsw-1, 7, 0) | FLD_VAL(hfp-1, 19, 8) |
+			FLD_VAL(hbp-1, 31, 20);
+
+		timing_v = FLD_VAL(vsw-1, 7, 0) | FLD_VAL(vfp, 19, 8) |
+			FLD_VAL(vbp, 31, 20);
+	}
+
+	enable_clocks(1);
+	dispc_write_reg(DISPC_TIMING_H, timing_h);
+	dispc_write_reg(DISPC_TIMING_V, timing_v);
+	enable_clocks(0);
+}
+
+/* change name to mode? */
+void dispc_set_lcd_timings(struct omap_video_timings *timings)
+{
+	unsigned xtot, ytot;
+	unsigned long ht, vt;
+
+	if (!_dispc_lcd_timings_ok(timings->hsw, timings->hfp,
+				timings->hbp, timings->vsw,
+				timings->vfp, timings->vbp))
+		BUG();
+
+	_dispc_set_lcd_timings(timings->hsw, timings->hfp, timings->hbp,
+			timings->vsw, timings->vfp, timings->vbp);
+
+	dispc_set_lcd_size(timings->x_res, timings->y_res);
+
+	xtot = timings->x_res + timings->hfp + timings->hsw + timings->hbp;
+	ytot = timings->y_res + timings->vfp + timings->vsw + timings->vbp;
+
+	ht = (timings->pixel_clock * 1000) / xtot;
+	vt = (timings->pixel_clock * 1000) / xtot / ytot;
+
+	DSSDBG("xres %u yres %u\n", timings->x_res, timings->y_res);
+	DSSDBG("pck %u\n", timings->pixel_clock);
+	DSSDBG("hsw %d hfp %d hbp %d vsw %d vfp %d vbp %d\n",
+			timings->hsw, timings->hfp, timings->hbp,
+			timings->vsw, timings->vfp, timings->vbp);
+
+	DSSDBG("hsync %luHz, vsync %luHz\n", ht, vt);
+}
+
+static void dispc_set_lcd_divisor(u16 lck_div, u16 pck_div)
+{
+	BUG_ON(lck_div < 1);
+	BUG_ON(pck_div < 2);
+
+	enable_clocks(1);
+	dispc_write_reg(DISPC_DIVISOR,
+			FLD_VAL(lck_div, 23, 16) | FLD_VAL(pck_div, 7, 0));
+	enable_clocks(0);
+}
+
+static void dispc_get_lcd_divisor(int *lck_div, int *pck_div)
+{
+	u32 l;
+	l = dispc_read_reg(DISPC_DIVISOR);
+	*lck_div = FLD_GET(l, 23, 16);
+	*pck_div = FLD_GET(l, 7, 0);
+}
+
+unsigned long dispc_fclk_rate(void)
+{
+	unsigned long r = 0;
+
+	if (dss_get_dispc_clk_source() == 0)
+		r = dss_clk_get_rate(DSS_CLK_FCK1);
+	else
+#ifdef CONFIG_OMAP2_DSS_DSI
+		r = dsi_get_dsi1_pll_rate();
+#else
+	BUG();
+#endif
+	return r;
+}
+
+unsigned long dispc_lclk_rate(void)
+{
+	int lcd;
+	unsigned long r;
+	u32 l;
+
+	l = dispc_read_reg(DISPC_DIVISOR);
+
+	lcd = FLD_GET(l, 23, 16);
+
+	r = dispc_fclk_rate();
+
+	return r / lcd;
+}
+
+unsigned long dispc_pclk_rate(void)
+{
+	int lcd, pcd;
+	unsigned long r;
+	u32 l;
+
+	l = dispc_read_reg(DISPC_DIVISOR);
+
+	lcd = FLD_GET(l, 23, 16);
+	pcd = FLD_GET(l, 7, 0);
+
+	r = dispc_fclk_rate();
+
+	return r / lcd / pcd;
+}
+
+void dispc_dump_clocks(struct seq_file *s)
+{
+	int lcd, pcd;
+
+	enable_clocks(1);
+
+	dispc_get_lcd_divisor(&lcd, &pcd);
+
+	seq_printf(s, "- DISPC -\n");
+
+	seq_printf(s, "dispc fclk source = %s\n",
+			dss_get_dispc_clk_source() == 0 ?
+			"dss1_alwon_fclk" : "dsi1_pll_fclk");
+
+	seq_printf(s, "fck\t\t%-16lu\n", dispc_fclk_rate());
+	seq_printf(s, "lck\t\t%-16lulck div\t%u\n", dispc_lclk_rate(), lcd);
+	seq_printf(s, "pck\t\t%-16lupck div\t%u\n", dispc_pclk_rate(), pcd);
+
+	enable_clocks(0);
+}
+
+#ifdef CONFIG_OMAP2_DSS_COLLECT_IRQ_STATS
+void dispc_dump_irqs(struct seq_file *s)
+{
+	unsigned long flags;
+	struct dispc_irq_stats stats;
+
+	spin_lock_irqsave(&dispc.irq_stats_lock, flags);
+
+	stats = dispc.irq_stats;
+	memset(&dispc.irq_stats, 0, sizeof(dispc.irq_stats));
+	dispc.irq_stats.last_reset = jiffies;
+
+	spin_unlock_irqrestore(&dispc.irq_stats_lock, flags);
+
+	seq_printf(s, "period %u ms\n",
+			jiffies_to_msecs(jiffies - stats.last_reset));
+
+	seq_printf(s, "irqs %d\n", stats.irq_count);
+#define PIS(x) \
+	seq_printf(s, "%-20s %10d\n", #x, stats.irqs[ffs(DISPC_IRQ_##x)-1]);
+
+	PIS(FRAMEDONE);
+	PIS(VSYNC);
+	PIS(EVSYNC_EVEN);
+	PIS(EVSYNC_ODD);
+	PIS(ACBIAS_COUNT_STAT);
+	PIS(PROG_LINE_NUM);
+	PIS(GFX_FIFO_UNDERFLOW);
+	PIS(GFX_END_WIN);
+	PIS(PAL_GAMMA_MASK);
+	PIS(OCP_ERR);
+	PIS(VID1_FIFO_UNDERFLOW);
+	PIS(VID1_END_WIN);
+	PIS(VID2_FIFO_UNDERFLOW);
+	PIS(VID2_END_WIN);
+	PIS(SYNC_LOST);
+	PIS(SYNC_LOST_DIGIT);
+	PIS(WAKEUP);
+#undef PIS
+}
+#else
+void dispc_dump_irqs(struct seq_file *s) { }
+#endif
+
+void dispc_dump_regs(struct seq_file *s)
+{
+#define DUMPREG(r) seq_printf(s, "%-35s %08x\n", #r, dispc_read_reg(r))
+
+	dss_clk_enable(DSS_CLK_ICK | DSS_CLK_FCK1);
+
+	DUMPREG(DISPC_REVISION);
+	DUMPREG(DISPC_SYSCONFIG);
+	DUMPREG(DISPC_SYSSTATUS);
+	DUMPREG(DISPC_IRQSTATUS);
+	DUMPREG(DISPC_IRQENABLE);
+	DUMPREG(DISPC_CONTROL);
+	DUMPREG(DISPC_CONFIG);
+	DUMPREG(DISPC_CAPABLE);
+	DUMPREG(DISPC_DEFAULT_COLOR0);
+	DUMPREG(DISPC_DEFAULT_COLOR1);
+	DUMPREG(DISPC_TRANS_COLOR0);
+	DUMPREG(DISPC_TRANS_COLOR1);
+	DUMPREG(DISPC_LINE_STATUS);
+	DUMPREG(DISPC_LINE_NUMBER);
+	DUMPREG(DISPC_TIMING_H);
+	DUMPREG(DISPC_TIMING_V);
+	DUMPREG(DISPC_POL_FREQ);
+	DUMPREG(DISPC_DIVISOR);
+	DUMPREG(DISPC_GLOBAL_ALPHA);
+	DUMPREG(DISPC_SIZE_DIG);
+	DUMPREG(DISPC_SIZE_LCD);
+
+	DUMPREG(DISPC_GFX_BA0);
+	DUMPREG(DISPC_GFX_BA1);
+	DUMPREG(DISPC_GFX_POSITION);
+	DUMPREG(DISPC_GFX_SIZE);
+	DUMPREG(DISPC_GFX_ATTRIBUTES);
+	DUMPREG(DISPC_GFX_FIFO_THRESHOLD);
+	DUMPREG(DISPC_GFX_FIFO_SIZE_STATUS);
+	DUMPREG(DISPC_GFX_ROW_INC);
+	DUMPREG(DISPC_GFX_PIXEL_INC);
+	DUMPREG(DISPC_GFX_WINDOW_SKIP);
+	DUMPREG(DISPC_GFX_TABLE_BA);
+
+	DUMPREG(DISPC_DATA_CYCLE1);
+	DUMPREG(DISPC_DATA_CYCLE2);
+	DUMPREG(DISPC_DATA_CYCLE3);
+
+	DUMPREG(DISPC_CPR_COEF_R);
+	DUMPREG(DISPC_CPR_COEF_G);
+	DUMPREG(DISPC_CPR_COEF_B);
+
+	DUMPREG(DISPC_GFX_PRELOAD);
+
+	DUMPREG(DISPC_VID_BA0(0));
+	DUMPREG(DISPC_VID_BA1(0));
+	DUMPREG(DISPC_VID_POSITION(0));
+	DUMPREG(DISPC_VID_SIZE(0));
+	DUMPREG(DISPC_VID_ATTRIBUTES(0));
+	DUMPREG(DISPC_VID_FIFO_THRESHOLD(0));
+	DUMPREG(DISPC_VID_FIFO_SIZE_STATUS(0));
+	DUMPREG(DISPC_VID_ROW_INC(0));
+	DUMPREG(DISPC_VID_PIXEL_INC(0));
+	DUMPREG(DISPC_VID_FIR(0));
+	DUMPREG(DISPC_VID_PICTURE_SIZE(0));
+	DUMPREG(DISPC_VID_ACCU0(0));
+	DUMPREG(DISPC_VID_ACCU1(0));
+
+	DUMPREG(DISPC_VID_BA0(1));
+	DUMPREG(DISPC_VID_BA1(1));
+	DUMPREG(DISPC_VID_POSITION(1));
+	DUMPREG(DISPC_VID_SIZE(1));
+	DUMPREG(DISPC_VID_ATTRIBUTES(1));
+	DUMPREG(DISPC_VID_FIFO_THRESHOLD(1));
+	DUMPREG(DISPC_VID_FIFO_SIZE_STATUS(1));
+	DUMPREG(DISPC_VID_ROW_INC(1));
+	DUMPREG(DISPC_VID_PIXEL_INC(1));
+	DUMPREG(DISPC_VID_FIR(1));
+	DUMPREG(DISPC_VID_PICTURE_SIZE(1));
+	DUMPREG(DISPC_VID_ACCU0(1));
+	DUMPREG(DISPC_VID_ACCU1(1));
+
+	DUMPREG(DISPC_VID_FIR_COEF_H(0, 0));
+	DUMPREG(DISPC_VID_FIR_COEF_H(0, 1));
+	DUMPREG(DISPC_VID_FIR_COEF_H(0, 2));
+	DUMPREG(DISPC_VID_FIR_COEF_H(0, 3));
+	DUMPREG(DISPC_VID_FIR_COEF_H(0, 4));
+	DUMPREG(DISPC_VID_FIR_COEF_H(0, 5));
+	DUMPREG(DISPC_VID_FIR_COEF_H(0, 6));
+	DUMPREG(DISPC_VID_FIR_COEF_H(0, 7));
+	DUMPREG(DISPC_VID_FIR_COEF_HV(0, 0));
+	DUMPREG(DISPC_VID_FIR_COEF_HV(0, 1));
+	DUMPREG(DISPC_VID_FIR_COEF_HV(0, 2));
+	DUMPREG(DISPC_VID_FIR_COEF_HV(0, 3));
+	DUMPREG(DISPC_VID_FIR_COEF_HV(0, 4));
+	DUMPREG(DISPC_VID_FIR_COEF_HV(0, 5));
+	DUMPREG(DISPC_VID_FIR_COEF_HV(0, 6));
+	DUMPREG(DISPC_VID_FIR_COEF_HV(0, 7));
+	DUMPREG(DISPC_VID_CONV_COEF(0, 0));
+	DUMPREG(DISPC_VID_CONV_COEF(0, 1));
+	DUMPREG(DISPC_VID_CONV_COEF(0, 2));
+	DUMPREG(DISPC_VID_CONV_COEF(0, 3));
+	DUMPREG(DISPC_VID_CONV_COEF(0, 4));
+	DUMPREG(DISPC_VID_FIR_COEF_V(0, 0));
+	DUMPREG(DISPC_VID_FIR_COEF_V(0, 1));
+	DUMPREG(DISPC_VID_FIR_COEF_V(0, 2));
+	DUMPREG(DISPC_VID_FIR_COEF_V(0, 3));
+	DUMPREG(DISPC_VID_FIR_COEF_V(0, 4));
+	DUMPREG(DISPC_VID_FIR_COEF_V(0, 5));
+	DUMPREG(DISPC_VID_FIR_COEF_V(0, 6));
+	DUMPREG(DISPC_VID_FIR_COEF_V(0, 7));
+
+	DUMPREG(DISPC_VID_FIR_COEF_H(1, 0));
+	DUMPREG(DISPC_VID_FIR_COEF_H(1, 1));
+	DUMPREG(DISPC_VID_FIR_COEF_H(1, 2));
+	DUMPREG(DISPC_VID_FIR_COEF_H(1, 3));
+	DUMPREG(DISPC_VID_FIR_COEF_H(1, 4));
+	DUMPREG(DISPC_VID_FIR_COEF_H(1, 5));
+	DUMPREG(DISPC_VID_FIR_COEF_H(1, 6));
+	DUMPREG(DISPC_VID_FIR_COEF_H(1, 7));
+	DUMPREG(DISPC_VID_FIR_COEF_HV(1, 0));
+	DUMPREG(DISPC_VID_FIR_COEF_HV(1, 1));
+	DUMPREG(DISPC_VID_FIR_COEF_HV(1, 2));
+	DUMPREG(DISPC_VID_FIR_COEF_HV(1, 3));
+	DUMPREG(DISPC_VID_FIR_COEF_HV(1, 4));
+	DUMPREG(DISPC_VID_FIR_COEF_HV(1, 5));
+	DUMPREG(DISPC_VID_FIR_COEF_HV(1, 6));
+	DUMPREG(DISPC_VID_FIR_COEF_HV(1, 7));
+	DUMPREG(DISPC_VID_CONV_COEF(1, 0));
+	DUMPREG(DISPC_VID_CONV_COEF(1, 1));
+	DUMPREG(DISPC_VID_CONV_COEF(1, 2));
+	DUMPREG(DISPC_VID_CONV_COEF(1, 3));
+	DUMPREG(DISPC_VID_CONV_COEF(1, 4));
+	DUMPREG(DISPC_VID_FIR_COEF_V(1, 0));
+	DUMPREG(DISPC_VID_FIR_COEF_V(1, 1));
+	DUMPREG(DISPC_VID_FIR_COEF_V(1, 2));
+	DUMPREG(DISPC_VID_FIR_COEF_V(1, 3));
+	DUMPREG(DISPC_VID_FIR_COEF_V(1, 4));
+	DUMPREG(DISPC_VID_FIR_COEF_V(1, 5));
+	DUMPREG(DISPC_VID_FIR_COEF_V(1, 6));
+	DUMPREG(DISPC_VID_FIR_COEF_V(1, 7));
+
+	DUMPREG(DISPC_VID_PRELOAD(0));
+	DUMPREG(DISPC_VID_PRELOAD(1));
+
+	dss_clk_disable(DSS_CLK_ICK | DSS_CLK_FCK1);
+#undef DUMPREG
+}
+
+static void _dispc_set_pol_freq(bool onoff, bool rf, bool ieo, bool ipc,
+				bool ihs, bool ivs, u8 acbi, u8 acb)
+{
+	u32 l = 0;
+
+	DSSDBG("onoff %d rf %d ieo %d ipc %d ihs %d ivs %d acbi %d acb %d\n",
+			onoff, rf, ieo, ipc, ihs, ivs, acbi, acb);
+
+	l |= FLD_VAL(onoff, 17, 17);
+	l |= FLD_VAL(rf, 16, 16);
+	l |= FLD_VAL(ieo, 15, 15);
+	l |= FLD_VAL(ipc, 14, 14);
+	l |= FLD_VAL(ihs, 13, 13);
+	l |= FLD_VAL(ivs, 12, 12);
+	l |= FLD_VAL(acbi, 11, 8);
+	l |= FLD_VAL(acb, 7, 0);
+
+	enable_clocks(1);
+	dispc_write_reg(DISPC_POL_FREQ, l);
+	enable_clocks(0);
+}
+
+void dispc_set_pol_freq(enum omap_panel_config config, u8 acbi, u8 acb)
+{
+	_dispc_set_pol_freq((config & OMAP_DSS_LCD_ONOFF) != 0,
+			(config & OMAP_DSS_LCD_RF) != 0,
+			(config & OMAP_DSS_LCD_IEO) != 0,
+			(config & OMAP_DSS_LCD_IPC) != 0,
+			(config & OMAP_DSS_LCD_IHS) != 0,
+			(config & OMAP_DSS_LCD_IVS) != 0,
+			acbi, acb);
+}
+
+/* with fck as input clock rate, find dispc dividers that produce req_pck */
+void dispc_find_clk_divs(bool is_tft, unsigned long req_pck, unsigned long fck,
+		struct dispc_clock_info *cinfo)
+{
+	u16 pcd_min = is_tft ? 2 : 3;
+	unsigned long best_pck;
+	u16 best_ld, cur_ld;
+	u16 best_pd, cur_pd;
+
+	best_pck = 0;
+	best_ld = 0;
+	best_pd = 0;
+
+	for (cur_ld = 1; cur_ld <= 255; ++cur_ld) {
+		unsigned long lck = fck / cur_ld;
+
+		for (cur_pd = pcd_min; cur_pd <= 255; ++cur_pd) {
+			unsigned long pck = lck / cur_pd;
+			long old_delta = abs(best_pck - req_pck);
+			long new_delta = abs(pck - req_pck);
+
+			if (best_pck == 0 || new_delta < old_delta) {
+				best_pck = pck;
+				best_ld = cur_ld;
+				best_pd = cur_pd;
+
+				if (pck == req_pck)
+					goto found;
+			}
+
+			if (pck < req_pck)
+				break;
+		}
+
+		if (lck / pcd_min < req_pck)
+			break;
+	}
+
+found:
+	cinfo->lck_div = best_ld;
+	cinfo->pck_div = best_pd;
+	cinfo->lck = fck / cinfo->lck_div;
+	cinfo->pck = cinfo->lck / cinfo->pck_div;
+}
+
+/* calculate clock rates using dividers in cinfo */
+int dispc_calc_clock_rates(unsigned long dispc_fclk_rate,
+		struct dispc_clock_info *cinfo)
+{
+	if (cinfo->lck_div > 255 || cinfo->lck_div == 0)
+		return -EINVAL;
+	if (cinfo->pck_div < 2 || cinfo->pck_div > 255)
+		return -EINVAL;
+
+	cinfo->lck = dispc_fclk_rate / cinfo->lck_div;
+	cinfo->pck = cinfo->lck / cinfo->pck_div;
+
+	return 0;
+}
+
+int dispc_set_clock_div(struct dispc_clock_info *cinfo)
+{
+	DSSDBG("lck = %lu (%u)\n", cinfo->lck, cinfo->lck_div);
+	DSSDBG("pck = %lu (%u)\n", cinfo->pck, cinfo->pck_div);
+
+	dispc_set_lcd_divisor(cinfo->lck_div, cinfo->pck_div);
+
+	return 0;
+}
+
+int dispc_get_clock_div(struct dispc_clock_info *cinfo)
+{
+	unsigned long fck;
+
+	fck = dispc_fclk_rate();
+
+	cinfo->lck_div = REG_GET(DISPC_DIVISOR, 23, 16);
+	cinfo->pck_div = REG_GET(DISPC_DIVISOR, 7, 0);
+
+	cinfo->lck = fck / cinfo->lck_div;
+	cinfo->pck = cinfo->lck / cinfo->pck_div;
+
+	return 0;
+}
+
+/* dispc.irq_lock has to be locked by the caller */
+static void _omap_dispc_set_irqs(void)
+{
+	u32 mask;
+	u32 old_mask;
+	int i;
+	struct omap_dispc_isr_data *isr_data;
+
+	mask = dispc.irq_error_mask;
+
+	for (i = 0; i < DISPC_MAX_NR_ISRS; i++) {
+		isr_data = &dispc.registered_isr[i];
+
+		if (isr_data->isr == NULL)
+			continue;
+
+		mask |= isr_data->mask;
+	}
+
+	enable_clocks(1);
+
+	old_mask = dispc_read_reg(DISPC_IRQENABLE);
+	/* clear the irqstatus for newly enabled irqs */
+	dispc_write_reg(DISPC_IRQSTATUS, (mask ^ old_mask) & mask);
+
+	dispc_write_reg(DISPC_IRQENABLE, mask);
+
+	enable_clocks(0);
+}
+
+int omap_dispc_register_isr(omap_dispc_isr_t isr, void *arg, u32 mask)
+{
+	int i;
+	int ret;
+	unsigned long flags;
+	struct omap_dispc_isr_data *isr_data;
+
+	if (isr == NULL)
+		return -EINVAL;
+
+	spin_lock_irqsave(&dispc.irq_lock, flags);
+
+	/* check for duplicate entry */
+	for (i = 0; i < DISPC_MAX_NR_ISRS; i++) {
+		isr_data = &dispc.registered_isr[i];
+		if (isr_data->isr == isr && isr_data->arg == arg &&
+				isr_data->mask == mask) {
+			ret = -EINVAL;
+			goto err;
+		}
+	}
+
+	isr_data = NULL;
+	ret = -EBUSY;
+
+	for (i = 0; i < DISPC_MAX_NR_ISRS; i++) {
+		isr_data = &dispc.registered_isr[i];
+
+		if (isr_data->isr != NULL)
+			continue;
+
+		isr_data->isr = isr;
+		isr_data->arg = arg;
+		isr_data->mask = mask;
+		ret = 0;
+
+		break;
+	}
+
+	_omap_dispc_set_irqs();
+
+	spin_unlock_irqrestore(&dispc.irq_lock, flags);
+
+	return 0;
+err:
+	spin_unlock_irqrestore(&dispc.irq_lock, flags);
+
+	return ret;
+}
+EXPORT_SYMBOL(omap_dispc_register_isr);
+
+int omap_dispc_unregister_isr(omap_dispc_isr_t isr, void *arg, u32 mask)
+{
+	int i;
+	unsigned long flags;
+	int ret = -EINVAL;
+	struct omap_dispc_isr_data *isr_data;
+
+	spin_lock_irqsave(&dispc.irq_lock, flags);
+
+	for (i = 0; i < DISPC_MAX_NR_ISRS; i++) {
+		isr_data = &dispc.registered_isr[i];
+		if (isr_data->isr != isr || isr_data->arg != arg ||
+				isr_data->mask != mask)
+			continue;
+
+		/* found the correct isr */
+
+		isr_data->isr = NULL;
+		isr_data->arg = NULL;
+		isr_data->mask = 0;
+
+		ret = 0;
+		break;
+	}
+
+	if (ret == 0)
+		_omap_dispc_set_irqs();
+
+	spin_unlock_irqrestore(&dispc.irq_lock, flags);
+
+	return ret;
+}
+EXPORT_SYMBOL(omap_dispc_unregister_isr);
+
+#ifdef DEBUG
+static void print_irq_status(u32 status)
+{
+	if ((status & dispc.irq_error_mask) == 0)
+		return;
+
+	printk(KERN_DEBUG "DISPC IRQ: 0x%x: ", status);
+
+#define PIS(x) \
+	if (status & DISPC_IRQ_##x) \
+		printk(#x " ");
+	PIS(GFX_FIFO_UNDERFLOW);
+	PIS(OCP_ERR);
+	PIS(VID1_FIFO_UNDERFLOW);
+	PIS(VID2_FIFO_UNDERFLOW);
+	PIS(SYNC_LOST);
+	PIS(SYNC_LOST_DIGIT);
+#undef PIS
+
+	printk("\n");
+}
+#endif
+
+/* Called from dss.c. Note that we don't touch clocks here,
+ * but we presume they are on because we got an IRQ. However,
+ * an irq handler may turn the clocks off, so we may not have
+ * clock later in the function. */
+void dispc_irq_handler(void)
+{
+	int i;
+	u32 irqstatus;
+	u32 handledirqs = 0;
+	u32 unhandled_errors;
+	struct omap_dispc_isr_data *isr_data;
+	struct omap_dispc_isr_data registered_isr[DISPC_MAX_NR_ISRS];
+
+	spin_lock(&dispc.irq_lock);
+
+	irqstatus = dispc_read_reg(DISPC_IRQSTATUS);
+
+#ifdef CONFIG_OMAP2_DSS_COLLECT_IRQ_STATS
+	spin_lock(&dispc.irq_stats_lock);
+	dispc.irq_stats.irq_count++;
+	dss_collect_irq_stats(irqstatus, dispc.irq_stats.irqs);
+	spin_unlock(&dispc.irq_stats_lock);
+#endif
+
+#ifdef DEBUG
+	if (dss_debug)
+		print_irq_status(irqstatus);
+#endif
+	/* Ack the interrupt. Do it here before clocks are possibly turned
+	 * off */
+	dispc_write_reg(DISPC_IRQSTATUS, irqstatus);
+	/* flush posted write */
+	dispc_read_reg(DISPC_IRQSTATUS);
+
+	/* make a copy and unlock, so that isrs can unregister
+	 * themselves */
+	memcpy(registered_isr, dispc.registered_isr,
+			sizeof(registered_isr));
+
+	spin_unlock(&dispc.irq_lock);
+
+	for (i = 0; i < DISPC_MAX_NR_ISRS; i++) {
+		isr_data = &registered_isr[i];
+
+		if (!isr_data->isr)
+			continue;
+
+		if (isr_data->mask & irqstatus) {
+			isr_data->isr(isr_data->arg, irqstatus);
+			handledirqs |= isr_data->mask;
+		}
+	}
+
+	spin_lock(&dispc.irq_lock);
+
+	unhandled_errors = irqstatus & ~handledirqs & dispc.irq_error_mask;
+
+	if (unhandled_errors) {
+		dispc.error_irqs |= unhandled_errors;
+
+		dispc.irq_error_mask &= ~unhandled_errors;
+		_omap_dispc_set_irqs();
+
+		schedule_work(&dispc.error_work);
+	}
+
+	spin_unlock(&dispc.irq_lock);
+}
+
+static void dispc_error_worker(struct work_struct *work)
+{
+	int i;
+	u32 errors;
+	unsigned long flags;
+
+	spin_lock_irqsave(&dispc.irq_lock, flags);
+	errors = dispc.error_irqs;
+	dispc.error_irqs = 0;
+	spin_unlock_irqrestore(&dispc.irq_lock, flags);
+
+	if (errors & DISPC_IRQ_GFX_FIFO_UNDERFLOW) {
+		DSSERR("GFX_FIFO_UNDERFLOW, disabling GFX\n");
+		for (i = 0; i < omap_dss_get_num_overlays(); ++i) {
+			struct omap_overlay *ovl;
+			ovl = omap_dss_get_overlay(i);
+
+			if (!(ovl->caps & OMAP_DSS_OVL_CAP_DISPC))
+				continue;
+
+			if (ovl->id == 0) {
+				dispc_enable_plane(ovl->id, 0);
+				dispc_go(ovl->manager->id);
+				mdelay(50);
+				break;
+			}
+		}
+	}
+
+	if (errors & DISPC_IRQ_VID1_FIFO_UNDERFLOW) {
+		DSSERR("VID1_FIFO_UNDERFLOW, disabling VID1\n");
+		for (i = 0; i < omap_dss_get_num_overlays(); ++i) {
+			struct omap_overlay *ovl;
+			ovl = omap_dss_get_overlay(i);
+
+			if (!(ovl->caps & OMAP_DSS_OVL_CAP_DISPC))
+				continue;
+
+			if (ovl->id == 1) {
+				dispc_enable_plane(ovl->id, 0);
+				dispc_go(ovl->manager->id);
+				mdelay(50);
+				break;
+			}
+		}
+	}
+
+	if (errors & DISPC_IRQ_VID2_FIFO_UNDERFLOW) {
+		DSSERR("VID2_FIFO_UNDERFLOW, disabling VID2\n");
+		for (i = 0; i < omap_dss_get_num_overlays(); ++i) {
+			struct omap_overlay *ovl;
+			ovl = omap_dss_get_overlay(i);
+
+			if (!(ovl->caps & OMAP_DSS_OVL_CAP_DISPC))
+				continue;
+
+			if (ovl->id == 2) {
+				dispc_enable_plane(ovl->id, 0);
+				dispc_go(ovl->manager->id);
+				mdelay(50);
+				break;
+			}
+		}
+	}
+
+	if (errors & DISPC_IRQ_SYNC_LOST) {
+		struct omap_overlay_manager *manager = NULL;
+		bool enable = false;
+
+		DSSERR("SYNC_LOST, disabling LCD\n");
+
+		for (i = 0; i < omap_dss_get_num_overlay_managers(); ++i) {
+			struct omap_overlay_manager *mgr;
+			mgr = omap_dss_get_overlay_manager(i);
+
+			if (mgr->id == OMAP_DSS_CHANNEL_LCD) {
+				manager = mgr;
+				enable = mgr->device->state ==
+						OMAP_DSS_DISPLAY_ACTIVE;
+				mgr->device->disable(mgr->device);
+				break;
+			}
+		}
+
+		if (manager) {
+			for (i = 0; i < omap_dss_get_num_overlays(); ++i) {
+				struct omap_overlay *ovl;
+				ovl = omap_dss_get_overlay(i);
+
+				if (!(ovl->caps & OMAP_DSS_OVL_CAP_DISPC))
+					continue;
+
+				if (ovl->id != 0 && ovl->manager == manager)
+					dispc_enable_plane(ovl->id, 0);
+			}
+
+			dispc_go(manager->id);
+			mdelay(50);
+			if (enable)
+				manager->device->enable(manager->device);
+		}
+	}
+
+	if (errors & DISPC_IRQ_SYNC_LOST_DIGIT) {
+		struct omap_overlay_manager *manager = NULL;
+		bool enable = false;
+
+		DSSERR("SYNC_LOST_DIGIT, disabling TV\n");
+
+		for (i = 0; i < omap_dss_get_num_overlay_managers(); ++i) {
+			struct omap_overlay_manager *mgr;
+			mgr = omap_dss_get_overlay_manager(i);
+
+			if (mgr->id == OMAP_DSS_CHANNEL_DIGIT) {
+				manager = mgr;
+				enable = mgr->device->state ==
+						OMAP_DSS_DISPLAY_ACTIVE;
+				mgr->device->disable(mgr->device);
+				break;
+			}
+		}
+
+		if (manager) {
+			for (i = 0; i < omap_dss_get_num_overlays(); ++i) {
+				struct omap_overlay *ovl;
+				ovl = omap_dss_get_overlay(i);
+
+				if (!(ovl->caps & OMAP_DSS_OVL_CAP_DISPC))
+					continue;
+
+				if (ovl->id != 0 && ovl->manager == manager)
+					dispc_enable_plane(ovl->id, 0);
+			}
+
+			dispc_go(manager->id);
+			mdelay(50);
+			if (enable)
+				manager->device->enable(manager->device);
+		}
+	}
+
+	if (errors & DISPC_IRQ_OCP_ERR) {
+		DSSERR("OCP_ERR\n");
+		for (i = 0; i < omap_dss_get_num_overlay_managers(); ++i) {
+			struct omap_overlay_manager *mgr;
+			mgr = omap_dss_get_overlay_manager(i);
+
+			if (mgr->caps & OMAP_DSS_OVL_CAP_DISPC)
+				mgr->device->disable(mgr->device);
+		}
+	}
+
+	spin_lock_irqsave(&dispc.irq_lock, flags);
+	dispc.irq_error_mask |= errors;
+	_omap_dispc_set_irqs();
+	spin_unlock_irqrestore(&dispc.irq_lock, flags);
+}
+
+int omap_dispc_wait_for_irq_timeout(u32 irqmask, unsigned long timeout)
+{
+	void dispc_irq_wait_handler(void *data, u32 mask)
+	{
+		complete((struct completion *)data);
+	}
+
+	int r;
+	DECLARE_COMPLETION_ONSTACK(completion);
+
+	r = omap_dispc_register_isr(dispc_irq_wait_handler, &completion,
+			irqmask);
+
+	if (r)
+		return r;
+
+	timeout = wait_for_completion_timeout(&completion, timeout);
+
+	omap_dispc_unregister_isr(dispc_irq_wait_handler, &completion, irqmask);
+
+	if (timeout == 0)
+		return -ETIMEDOUT;
+
+	if (timeout == -ERESTARTSYS)
+		return -ERESTARTSYS;
+
+	return 0;
+}
+
+int omap_dispc_wait_for_irq_interruptible_timeout(u32 irqmask,
+		unsigned long timeout)
+{
+	void dispc_irq_wait_handler(void *data, u32 mask)
+	{
+		complete((struct completion *)data);
+	}
+
+	int r;
+	DECLARE_COMPLETION_ONSTACK(completion);
+
+	r = omap_dispc_register_isr(dispc_irq_wait_handler, &completion,
+			irqmask);
+
+	if (r)
+		return r;
+
+	timeout = wait_for_completion_interruptible_timeout(&completion,
+			timeout);
+
+	omap_dispc_unregister_isr(dispc_irq_wait_handler, &completion, irqmask);
+
+	if (timeout == 0)
+		return -ETIMEDOUT;
+
+	if (timeout == -ERESTARTSYS)
+		return -ERESTARTSYS;
+
+	return 0;
+}
+
+#ifdef CONFIG_OMAP2_DSS_FAKE_VSYNC
+void dispc_fake_vsync_irq(void)
+{
+	u32 irqstatus = DISPC_IRQ_VSYNC;
+	int i;
+
+	local_irq_disable();
+
+	for (i = 0; i < DISPC_MAX_NR_ISRS; i++) {
+		struct omap_dispc_isr_data *isr_data;
+		isr_data = &dispc.registered_isr[i];
+
+		if (!isr_data->isr)
+			continue;
+
+		if (isr_data->mask & irqstatus)
+			isr_data->isr(isr_data->arg, irqstatus);
+	}
+
+	local_irq_enable();
+}
+#endif
+
+static void _omap_dispc_initialize_irq(void)
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(&dispc.irq_lock, flags);
+
+	memset(dispc.registered_isr, 0, sizeof(dispc.registered_isr));
+
+	dispc.irq_error_mask = DISPC_IRQ_MASK_ERROR;
+
+	/* there's SYNC_LOST_DIGIT waiting after enabling the DSS,
+	 * so clear it */
+	dispc_write_reg(DISPC_IRQSTATUS, dispc_read_reg(DISPC_IRQSTATUS));
+
+	_omap_dispc_set_irqs();
+
+	spin_unlock_irqrestore(&dispc.irq_lock, flags);
+}
+
+void dispc_enable_sidle(void)
+{
+	REG_FLD_MOD(DISPC_SYSCONFIG, 2, 4, 3);	/* SIDLEMODE: smart idle */
+}
+
+void dispc_disable_sidle(void)
+{
+	REG_FLD_MOD(DISPC_SYSCONFIG, 1, 4, 3);	/* SIDLEMODE: no idle */
+}
+
+static void _omap_dispc_initial_config(void)
+{
+	u32 l;
+
+	l = dispc_read_reg(DISPC_SYSCONFIG);
+	l = FLD_MOD(l, 2, 13, 12);	/* MIDLEMODE: smart standby */
+	l = FLD_MOD(l, 2, 4, 3);	/* SIDLEMODE: smart idle */
+	l = FLD_MOD(l, 1, 2, 2);	/* ENWAKEUP */
+	l = FLD_MOD(l, 1, 0, 0);	/* AUTOIDLE */
+	dispc_write_reg(DISPC_SYSCONFIG, l);
+
+	/* FUNCGATED */
+	REG_FLD_MOD(DISPC_CONFIG, 1, 9, 9);
+
+	/* L3 firewall setting: enable access to OCM RAM */
+	/* XXX this should be somewhere in plat-omap */
+	if (cpu_is_omap24xx())
+		__raw_writel(0x402000b0, OMAP2_L3_IO_ADDRESS(0x680050a0));
+
+	_dispc_setup_color_conv_coef();
+
+	dispc_set_loadmode(OMAP_DSS_LOAD_FRAME_ONLY);
+
+	dispc_read_plane_fifo_sizes();
+}
+
+int dispc_init(void)
+{
+	u32 rev;
+
+	spin_lock_init(&dispc.irq_lock);
+
+#ifdef CONFIG_OMAP2_DSS_COLLECT_IRQ_STATS
+	spin_lock_init(&dispc.irq_stats_lock);
+	dispc.irq_stats.last_reset = jiffies;
+#endif
+
+	INIT_WORK(&dispc.error_work, dispc_error_worker);
+
+	dispc.base = ioremap(DISPC_BASE, DISPC_SZ_REGS);
+	if (!dispc.base) {
+		DSSERR("can't ioremap DISPC\n");
+		return -ENOMEM;
+	}
+
+	enable_clocks(1);
+
+	_omap_dispc_initial_config();
+
+	_omap_dispc_initialize_irq();
+
+	dispc_save_context();
+
+	rev = dispc_read_reg(DISPC_REVISION);
+	printk(KERN_INFO "OMAP DISPC rev %d.%d\n",
+	       FLD_GET(rev, 7, 4), FLD_GET(rev, 3, 0));
+
+	enable_clocks(0);
+
+	return 0;
+}
+
+void dispc_exit(void)
+{
+	iounmap(dispc.base);
+}
+
+int dispc_enable_plane(enum omap_plane plane, bool enable)
+{
+	DSSDBG("dispc_enable_plane %d, %d\n", plane, enable);
+
+	enable_clocks(1);
+	_dispc_enable_plane(plane, enable);
+	enable_clocks(0);
+
+	return 0;
+}
+
+int dispc_setup_plane(enum omap_plane plane,
+		       u32 paddr, u16 screen_width,
+		       u16 pos_x, u16 pos_y,
+		       u16 width, u16 height,
+		       u16 out_width, u16 out_height,
+		       enum omap_color_mode color_mode,
+		       bool ilace,
+		       enum omap_dss_rotation_type rotation_type,
+		       u8 rotation, bool mirror, u8 global_alpha)
+{
+	int r = 0;
+
+	DSSDBG("dispc_setup_plane %d, pa %x, sw %d, %d,%d, %dx%d -> "
+	       "%dx%d, ilace %d, cmode %x, rot %d, mir %d\n",
+	       plane, paddr, screen_width, pos_x, pos_y,
+	       width, height,
+	       out_width, out_height,
+	       ilace, color_mode,
+	       rotation, mirror);
+
+	enable_clocks(1);
+
+	r = _dispc_setup_plane(plane,
+			   paddr, screen_width,
+			   pos_x, pos_y,
+			   width, height,
+			   out_width, out_height,
+			   color_mode, ilace,
+			   rotation_type,
+			   rotation, mirror,
+			   global_alpha);
+
+	enable_clocks(0);
+
+	return r;
+}
diff --git a/drivers/video/omap2/dss/display.c b/drivers/video/omap2/dss/display.c
new file mode 100644
index 000000000000..3b92b84b9560
--- /dev/null
+++ b/drivers/video/omap2/dss/display.c
@@ -0,0 +1,671 @@
+/*
+ * linux/drivers/video/omap2/dss/display.c
+ *
+ * Copyright (C) 2009 Nokia Corporation
+ * Author: Tomi Valkeinen <tomi.valkeinen@nokia.com>
+ *
+ * Some code and ideas taken from drivers/video/omap/ driver
+ * by Imre Deak.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#define DSS_SUBSYS_NAME "DISPLAY"
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/jiffies.h>
+#include <linux/list.h>
+#include <linux/platform_device.h>
+
+#include <plat/display.h>
+#include "dss.h"
+
+static LIST_HEAD(display_list);
+
+static ssize_t display_enabled_show(struct device *dev,
+		struct device_attribute *attr, char *buf)
+{
+	struct omap_dss_device *dssdev = to_dss_device(dev);
+	bool enabled = dssdev->state != OMAP_DSS_DISPLAY_DISABLED;
+
+	return snprintf(buf, PAGE_SIZE, "%d\n", enabled);
+}
+
+static ssize_t display_enabled_store(struct device *dev,
+		struct device_attribute *attr,
+		const char *buf, size_t size)
+{
+	struct omap_dss_device *dssdev = to_dss_device(dev);
+	bool enabled, r;
+
+	enabled = simple_strtoul(buf, NULL, 10);
+
+	if (enabled != (dssdev->state != OMAP_DSS_DISPLAY_DISABLED)) {
+		if (enabled) {
+			r = dssdev->enable(dssdev);
+			if (r)
+				return r;
+		} else {
+			dssdev->disable(dssdev);
+		}
+	}
+
+	return size;
+}
+
+static ssize_t display_upd_mode_show(struct device *dev,
+		struct device_attribute *attr, char *buf)
+{
+	struct omap_dss_device *dssdev = to_dss_device(dev);
+	enum omap_dss_update_mode mode = OMAP_DSS_UPDATE_AUTO;
+	if (dssdev->get_update_mode)
+		mode = dssdev->get_update_mode(dssdev);
+	return snprintf(buf, PAGE_SIZE, "%d\n", mode);
+}
+
+static ssize_t display_upd_mode_store(struct device *dev,
+		struct device_attribute *attr,
+		const char *buf, size_t size)
+{
+	struct omap_dss_device *dssdev = to_dss_device(dev);
+	int val, r;
+	enum omap_dss_update_mode mode;
+
+	val = simple_strtoul(buf, NULL, 10);
+
+	switch (val) {
+	case OMAP_DSS_UPDATE_DISABLED:
+	case OMAP_DSS_UPDATE_AUTO:
+	case OMAP_DSS_UPDATE_MANUAL:
+		mode = (enum omap_dss_update_mode)val;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	r = dssdev->set_update_mode(dssdev, mode);
+	if (r)
+		return r;
+
+	return size;
+}
+
+static ssize_t display_tear_show(struct device *dev,
+		struct device_attribute *attr, char *buf)
+{
+	struct omap_dss_device *dssdev = to_dss_device(dev);
+	return snprintf(buf, PAGE_SIZE, "%d\n",
+			dssdev->get_te ? dssdev->get_te(dssdev) : 0);
+}
+
+static ssize_t display_tear_store(struct device *dev,
+		struct device_attribute *attr, const char *buf, size_t size)
+{
+	struct omap_dss_device *dssdev = to_dss_device(dev);
+	unsigned long te;
+	int r;
+
+	if (!dssdev->enable_te || !dssdev->get_te)
+		return -ENOENT;
+
+	te = simple_strtoul(buf, NULL, 0);
+
+	r = dssdev->enable_te(dssdev, te);
+	if (r)
+		return r;
+
+	return size;
+}
+
+static ssize_t display_timings_show(struct device *dev,
+		struct device_attribute *attr, char *buf)
+{
+	struct omap_dss_device *dssdev = to_dss_device(dev);
+	struct omap_video_timings t;
+
+	if (!dssdev->get_timings)
+		return -ENOENT;
+
+	dssdev->get_timings(dssdev, &t);
+
+	return snprintf(buf, PAGE_SIZE, "%u,%u/%u/%u/%u,%u/%u/%u/%u\n",
+			t.pixel_clock,
+			t.x_res, t.hfp, t.hbp, t.hsw,
+			t.y_res, t.vfp, t.vbp, t.vsw);
+}
+
+static ssize_t display_timings_store(struct device *dev,
+		struct device_attribute *attr, const char *buf, size_t size)
+{
+	struct omap_dss_device *dssdev = to_dss_device(dev);
+	struct omap_video_timings t;
+	int r, found;
+
+	if (!dssdev->set_timings || !dssdev->check_timings)
+		return -ENOENT;
+
+	found = 0;
+#ifdef CONFIG_OMAP2_DSS_VENC
+	if (strncmp("pal", buf, 3) == 0) {
+		t = omap_dss_pal_timings;
+		found = 1;
+	} else if (strncmp("ntsc", buf, 4) == 0) {
+		t = omap_dss_ntsc_timings;
+		found = 1;
+	}
+#endif
+	if (!found && sscanf(buf, "%u,%hu/%hu/%hu/%hu,%hu/%hu/%hu/%hu",
+				&t.pixel_clock,
+				&t.x_res, &t.hfp, &t.hbp, &t.hsw,
+				&t.y_res, &t.vfp, &t.vbp, &t.vsw) != 9)
+		return -EINVAL;
+
+	r = dssdev->check_timings(dssdev, &t);
+	if (r)
+		return r;
+
+	dssdev->set_timings(dssdev, &t);
+
+	return size;
+}
+
+static ssize_t display_rotate_show(struct device *dev,
+		struct device_attribute *attr, char *buf)
+{
+	struct omap_dss_device *dssdev = to_dss_device(dev);
+	int rotate;
+	if (!dssdev->get_rotate)
+		return -ENOENT;
+	rotate = dssdev->get_rotate(dssdev);
+	return snprintf(buf, PAGE_SIZE, "%u\n", rotate);
+}
+
+static ssize_t display_rotate_store(struct device *dev,
+		struct device_attribute *attr, const char *buf, size_t size)
+{
+	struct omap_dss_device *dssdev = to_dss_device(dev);
+	unsigned long rot;
+	int r;
+
+	if (!dssdev->set_rotate || !dssdev->get_rotate)
+		return -ENOENT;
+
+	rot = simple_strtoul(buf, NULL, 0);
+
+	r = dssdev->set_rotate(dssdev, rot);
+	if (r)
+		return r;
+
+	return size;
+}
+
+static ssize_t display_mirror_show(struct device *dev,
+		struct device_attribute *attr, char *buf)
+{
+	struct omap_dss_device *dssdev = to_dss_device(dev);
+	int mirror;
+	if (!dssdev->get_mirror)
+		return -ENOENT;
+	mirror = dssdev->get_mirror(dssdev);
+	return snprintf(buf, PAGE_SIZE, "%u\n", mirror);
+}
+
+static ssize_t display_mirror_store(struct device *dev,
+		struct device_attribute *attr, const char *buf, size_t size)
+{
+	struct omap_dss_device *dssdev = to_dss_device(dev);
+	unsigned long mirror;
+	int r;
+
+	if (!dssdev->set_mirror || !dssdev->get_mirror)
+		return -ENOENT;
+
+	mirror = simple_strtoul(buf, NULL, 0);
+
+	r = dssdev->set_mirror(dssdev, mirror);
+	if (r)
+		return r;
+
+	return size;
+}
+
+static ssize_t display_wss_show(struct device *dev,
+		struct device_attribute *attr, char *buf)
+{
+	struct omap_dss_device *dssdev = to_dss_device(dev);
+	unsigned int wss;
+
+	if (!dssdev->get_wss)
+		return -ENOENT;
+
+	wss = dssdev->get_wss(dssdev);
+
+	return snprintf(buf, PAGE_SIZE, "0x%05x\n", wss);
+}
+
+static ssize_t display_wss_store(struct device *dev,
+		struct device_attribute *attr, const char *buf, size_t size)
+{
+	struct omap_dss_device *dssdev = to_dss_device(dev);
+	unsigned long wss;
+	int r;
+
+	if (!dssdev->get_wss || !dssdev->set_wss)
+		return -ENOENT;
+
+	if (strict_strtoul(buf, 0, &wss))
+		return -EINVAL;
+
+	if (wss > 0xfffff)
+		return -EINVAL;
+
+	r = dssdev->set_wss(dssdev, wss);
+	if (r)
+		return r;
+
+	return size;
+}
+
+static DEVICE_ATTR(enabled, S_IRUGO|S_IWUSR,
+		display_enabled_show, display_enabled_store);
+static DEVICE_ATTR(update_mode, S_IRUGO|S_IWUSR,
+		display_upd_mode_show, display_upd_mode_store);
+static DEVICE_ATTR(tear_elim, S_IRUGO|S_IWUSR,
+		display_tear_show, display_tear_store);
+static DEVICE_ATTR(timings, S_IRUGO|S_IWUSR,
+		display_timings_show, display_timings_store);
+static DEVICE_ATTR(rotate, S_IRUGO|S_IWUSR,
+		display_rotate_show, display_rotate_store);
+static DEVICE_ATTR(mirror, S_IRUGO|S_IWUSR,
+		display_mirror_show, display_mirror_store);
+static DEVICE_ATTR(wss, S_IRUGO|S_IWUSR,
+		display_wss_show, display_wss_store);
+
+static struct device_attribute *display_sysfs_attrs[] = {
+	&dev_attr_enabled,
+	&dev_attr_update_mode,
+	&dev_attr_tear_elim,
+	&dev_attr_timings,
+	&dev_attr_rotate,
+	&dev_attr_mirror,
+	&dev_attr_wss,
+	NULL
+};
+
+static void default_get_resolution(struct omap_dss_device *dssdev,
+			u16 *xres, u16 *yres)
+{
+	*xres = dssdev->panel.timings.x_res;
+	*yres = dssdev->panel.timings.y_res;
+}
+
+void default_get_overlay_fifo_thresholds(enum omap_plane plane,
+		u32 fifo_size, enum omap_burst_size *burst_size,
+		u32 *fifo_low, u32 *fifo_high)
+{
+	unsigned burst_size_bytes;
+
+	*burst_size = OMAP_DSS_BURST_16x32;
+	burst_size_bytes = 16 * 32 / 8;
+
+	*fifo_high = fifo_size - 1;
+	*fifo_low = fifo_size - burst_size_bytes;
+}
+
+static int default_wait_vsync(struct omap_dss_device *dssdev)
+{
+	unsigned long timeout = msecs_to_jiffies(500);
+	u32 irq;
+
+	if (dssdev->type == OMAP_DISPLAY_TYPE_VENC)
+		irq = DISPC_IRQ_EVSYNC_ODD;
+	else
+		irq = DISPC_IRQ_VSYNC;
+
+	return omap_dispc_wait_for_irq_interruptible_timeout(irq, timeout);
+}
+
+static int default_get_recommended_bpp(struct omap_dss_device *dssdev)
+{
+	if (dssdev->panel.recommended_bpp)
+		return dssdev->panel.recommended_bpp;
+
+	switch (dssdev->type) {
+	case OMAP_DISPLAY_TYPE_DPI:
+		if (dssdev->phy.dpi.data_lines == 24)
+			return 24;
+		else
+			return 16;
+
+	case OMAP_DISPLAY_TYPE_DBI:
+	case OMAP_DISPLAY_TYPE_DSI:
+		if (dssdev->ctrl.pixel_size == 24)
+			return 24;
+		else
+			return 16;
+	case OMAP_DISPLAY_TYPE_VENC:
+	case OMAP_DISPLAY_TYPE_SDI:
+		return 24;
+		return 24;
+	default:
+		BUG();
+	}
+}
+
+/* Checks if replication logic should be used. Only use for active matrix,
+ * when overlay is in RGB12U or RGB16 mode, and LCD interface is
+ * 18bpp or 24bpp */
+bool dss_use_replication(struct omap_dss_device *dssdev,
+		enum omap_color_mode mode)
+{
+	int bpp;
+
+	if (mode != OMAP_DSS_COLOR_RGB12U && mode != OMAP_DSS_COLOR_RGB16)
+		return false;
+
+	if (dssdev->type == OMAP_DISPLAY_TYPE_DPI &&
+			(dssdev->panel.config & OMAP_DSS_LCD_TFT) == 0)
+		return false;
+
+	switch (dssdev->type) {
+	case OMAP_DISPLAY_TYPE_DPI:
+		bpp = dssdev->phy.dpi.data_lines;
+		break;
+	case OMAP_DISPLAY_TYPE_VENC:
+	case OMAP_DISPLAY_TYPE_SDI:
+		bpp = 24;
+		break;
+	case OMAP_DISPLAY_TYPE_DBI:
+	case OMAP_DISPLAY_TYPE_DSI:
+		bpp = dssdev->ctrl.pixel_size;
+		break;
+	default:
+		BUG();
+	}
+
+	return bpp > 16;
+}
+
+void dss_init_device(struct platform_device *pdev,
+		struct omap_dss_device *dssdev)
+{
+	struct device_attribute *attr;
+	int i;
+	int r;
+
+	switch (dssdev->type) {
+	case OMAP_DISPLAY_TYPE_DPI:
+#ifdef CONFIG_OMAP2_DSS_RFBI
+	case OMAP_DISPLAY_TYPE_DBI:
+#endif
+#ifdef CONFIG_OMAP2_DSS_SDI
+	case OMAP_DISPLAY_TYPE_SDI:
+#endif
+#ifdef CONFIG_OMAP2_DSS_DSI
+	case OMAP_DISPLAY_TYPE_DSI:
+#endif
+#ifdef CONFIG_OMAP2_DSS_VENC
+	case OMAP_DISPLAY_TYPE_VENC:
+#endif
+		break;
+	default:
+		DSSERR("Support for display '%s' not compiled in.\n",
+				dssdev->name);
+		return;
+	}
+
+	dssdev->get_resolution = default_get_resolution;
+	dssdev->get_recommended_bpp = default_get_recommended_bpp;
+	dssdev->wait_vsync = default_wait_vsync;
+
+	switch (dssdev->type) {
+	case OMAP_DISPLAY_TYPE_DPI:
+		r = dpi_init_display(dssdev);
+		break;
+#ifdef CONFIG_OMAP2_DSS_RFBI
+	case OMAP_DISPLAY_TYPE_DBI:
+		r = rfbi_init_display(dssdev);
+		break;
+#endif
+#ifdef CONFIG_OMAP2_DSS_VENC
+	case OMAP_DISPLAY_TYPE_VENC:
+		r = venc_init_display(dssdev);
+		break;
+#endif
+#ifdef CONFIG_OMAP2_DSS_SDI
+	case OMAP_DISPLAY_TYPE_SDI:
+		r = sdi_init_display(dssdev);
+		break;
+#endif
+#ifdef CONFIG_OMAP2_DSS_DSI
+	case OMAP_DISPLAY_TYPE_DSI:
+		r = dsi_init_display(dssdev);
+		break;
+#endif
+	default:
+		BUG();
+	}
+
+	if (r) {
+		DSSERR("failed to init display %s\n", dssdev->name);
+		return;
+	}
+
+	/* create device sysfs files */
+	i = 0;
+	while ((attr = display_sysfs_attrs[i++]) != NULL) {
+		r = device_create_file(&dssdev->dev, attr);
+		if (r)
+			DSSERR("failed to create sysfs file\n");
+	}
+
+	/* create display? sysfs links */
+	r = sysfs_create_link(&pdev->dev.kobj, &dssdev->dev.kobj,
+			dev_name(&dssdev->dev));
+	if (r)
+		DSSERR("failed to create sysfs display link\n");
+}
+
+void dss_uninit_device(struct platform_device *pdev,
+		struct omap_dss_device *dssdev)
+{
+	struct device_attribute *attr;
+	int i = 0;
+
+	sysfs_remove_link(&pdev->dev.kobj, dev_name(&dssdev->dev));
+
+	while ((attr = display_sysfs_attrs[i++]) != NULL)
+		device_remove_file(&dssdev->dev, attr);
+
+	if (dssdev->manager)
+		dssdev->manager->unset_device(dssdev->manager);
+}
+
+static int dss_suspend_device(struct device *dev, void *data)
+{
+	int r;
+	struct omap_dss_device *dssdev = to_dss_device(dev);
+
+	if (dssdev->state != OMAP_DSS_DISPLAY_ACTIVE) {
+		dssdev->activate_after_resume = false;
+		return 0;
+	}
+
+	if (!dssdev->suspend) {
+		DSSERR("display '%s' doesn't implement suspend\n",
+				dssdev->name);
+		return -ENOSYS;
+	}
+
+	r = dssdev->suspend(dssdev);
+	if (r)
+		return r;
+
+	dssdev->activate_after_resume = true;
+
+	return 0;
+}
+
+int dss_suspend_all_devices(void)
+{
+	int r;
+	struct bus_type *bus = dss_get_bus();
+
+	r = bus_for_each_dev(bus, NULL, NULL, dss_suspend_device);
+	if (r) {
+		/* resume all displays that were suspended */
+		dss_resume_all_devices();
+		return r;
+	}
+
+	return 0;
+}
+
+static int dss_resume_device(struct device *dev, void *data)
+{
+	int r;
+	struct omap_dss_device *dssdev = to_dss_device(dev);
+
+	if (dssdev->activate_after_resume && dssdev->resume) {
+		r = dssdev->resume(dssdev);
+		if (r)
+			return r;
+	}
+
+	dssdev->activate_after_resume = false;
+
+	return 0;
+}
+
+int dss_resume_all_devices(void)
+{
+	struct bus_type *bus = dss_get_bus();
+
+	return bus_for_each_dev(bus, NULL, NULL, dss_resume_device);
+}
+
+static int dss_disable_device(struct device *dev, void *data)
+{
+	struct omap_dss_device *dssdev = to_dss_device(dev);
+	dssdev->disable(dssdev);
+	return 0;
+}
+
+void dss_disable_all_devices(void)
+{
+	struct bus_type *bus = dss_get_bus();
+	bus_for_each_dev(bus, NULL, NULL, dss_disable_device);
+}
+
+
+void omap_dss_get_device(struct omap_dss_device *dssdev)
+{
+	get_device(&dssdev->dev);
+}
+EXPORT_SYMBOL(omap_dss_get_device);
+
+void omap_dss_put_device(struct omap_dss_device *dssdev)
+{
+	put_device(&dssdev->dev);
+}
+EXPORT_SYMBOL(omap_dss_put_device);
+
+/* ref count of the found device is incremented. ref count
+ * of from-device is decremented. */
+struct omap_dss_device *omap_dss_get_next_device(struct omap_dss_device *from)
+{
+	struct device *dev;
+	struct device *dev_start = NULL;
+	struct omap_dss_device *dssdev = NULL;
+
+	int match(struct device *dev, void *data)
+	{
+		/* skip panels connected to controllers */
+		if (to_dss_device(dev)->panel.ctrl)
+			return 0;
+
+		return 1;
+	}
+
+	if (from)
+		dev_start = &from->dev;
+	dev = bus_find_device(dss_get_bus(), dev_start, NULL, match);
+	if (dev)
+		dssdev = to_dss_device(dev);
+	if (from)
+		put_device(&from->dev);
+
+	return dssdev;
+}
+EXPORT_SYMBOL(omap_dss_get_next_device);
+
+struct omap_dss_device *omap_dss_find_device(void *data,
+		int (*match)(struct omap_dss_device *dssdev, void *data))
+{
+	struct omap_dss_device *dssdev = NULL;
+
+	while ((dssdev = omap_dss_get_next_device(dssdev)) != NULL) {
+		if (match(dssdev, data))
+			return dssdev;
+	}
+
+	return NULL;
+}
+EXPORT_SYMBOL(omap_dss_find_device);
+
+int omap_dss_start_device(struct omap_dss_device *dssdev)
+{
+	int r;
+
+	if (!dssdev->driver) {
+		DSSDBG("no driver\n");
+		r = -ENODEV;
+		goto err0;
+	}
+
+	if (dssdev->ctrl.panel && !dssdev->ctrl.panel->driver) {
+		DSSDBG("no panel driver\n");
+		r = -ENODEV;
+		goto err0;
+	}
+
+	if (!try_module_get(dssdev->dev.driver->owner)) {
+		r = -ENODEV;
+		goto err0;
+	}
+
+	if (dssdev->ctrl.panel) {
+		if (!try_module_get(dssdev->ctrl.panel->dev.driver->owner)) {
+			r = -ENODEV;
+			goto err1;
+		}
+	}
+
+	return 0;
+err1:
+	module_put(dssdev->dev.driver->owner);
+err0:
+	return r;
+}
+EXPORT_SYMBOL(omap_dss_start_device);
+
+void omap_dss_stop_device(struct omap_dss_device *dssdev)
+{
+	if (dssdev->ctrl.panel)
+		module_put(dssdev->ctrl.panel->dev.driver->owner);
+
+	module_put(dssdev->dev.driver->owner);
+}
+EXPORT_SYMBOL(omap_dss_stop_device);
+
diff --git a/drivers/video/omap2/dss/dpi.c b/drivers/video/omap2/dss/dpi.c
new file mode 100644
index 000000000000..2d71031baa25
--- /dev/null
+++ b/drivers/video/omap2/dss/dpi.c
@@ -0,0 +1,399 @@
+/*
+ * linux/drivers/video/omap2/dss/dpi.c
+ *
+ * Copyright (C) 2009 Nokia Corporation
+ * Author: Tomi Valkeinen <tomi.valkeinen@nokia.com>
+ *
+ * Some code and ideas taken from drivers/video/omap/ driver
+ * by Imre Deak.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#define DSS_SUBSYS_NAME "DPI"
+
+#include <linux/kernel.h>
+#include <linux/clk.h>
+#include <linux/delay.h>
+#include <linux/errno.h>
+
+#include <plat/display.h>
+#include <plat/cpu.h>
+
+#include "dss.h"
+
+static struct {
+	int update_enabled;
+} dpi;
+
+#ifdef CONFIG_OMAP2_DSS_USE_DSI_PLL
+static int dpi_set_dsi_clk(bool is_tft, unsigned long pck_req,
+		unsigned long *fck, int *lck_div, int *pck_div)
+{
+	struct dsi_clock_info dsi_cinfo;
+	struct dispc_clock_info dispc_cinfo;
+	int r;
+
+	r = dsi_pll_calc_clock_div_pck(is_tft, pck_req, &dsi_cinfo,
+			&dispc_cinfo);
+	if (r)
+		return r;
+
+	r = dsi_pll_set_clock_div(&dsi_cinfo);
+	if (r)
+		return r;
+
+	dss_select_clk_source(0, 1);
+
+	r = dispc_set_clock_div(&dispc_cinfo);
+	if (r)
+		return r;
+
+	*fck = dsi_cinfo.dsi1_pll_fclk;
+	*lck_div = dispc_cinfo.lck_div;
+	*pck_div = dispc_cinfo.pck_div;
+
+	return 0;
+}
+#else
+static int dpi_set_dispc_clk(bool is_tft, unsigned long pck_req,
+		unsigned long *fck, int *lck_div, int *pck_div)
+{
+	struct dss_clock_info dss_cinfo;
+	struct dispc_clock_info dispc_cinfo;
+	int r;
+
+	r = dss_calc_clock_div(is_tft, pck_req, &dss_cinfo, &dispc_cinfo);
+	if (r)
+		return r;
+
+	r = dss_set_clock_div(&dss_cinfo);
+	if (r)
+		return r;
+
+	r = dispc_set_clock_div(&dispc_cinfo);
+	if (r)
+		return r;
+
+	*fck = dss_cinfo.fck;
+	*lck_div = dispc_cinfo.lck_div;
+	*pck_div = dispc_cinfo.pck_div;
+
+	return 0;
+}
+#endif
+
+static int dpi_set_mode(struct omap_dss_device *dssdev)
+{
+	struct omap_video_timings *t = &dssdev->panel.timings;
+	int lck_div, pck_div;
+	unsigned long fck;
+	unsigned long pck;
+	bool is_tft;
+	int r = 0;
+
+	dss_clk_enable(DSS_CLK_ICK | DSS_CLK_FCK1);
+
+	dispc_set_pol_freq(dssdev->panel.config, dssdev->panel.acbi,
+			dssdev->panel.acb);
+
+	is_tft = (dssdev->panel.config & OMAP_DSS_LCD_TFT) != 0;
+
+#ifdef CONFIG_OMAP2_DSS_USE_DSI_PLL
+	r = dpi_set_dsi_clk(is_tft, t->pixel_clock * 1000,
+			&fck, &lck_div, &pck_div);
+#else
+	r = dpi_set_dispc_clk(is_tft, t->pixel_clock * 1000,
+			&fck, &lck_div, &pck_div);
+#endif
+	if (r)
+		goto err0;
+
+	pck = fck / lck_div / pck_div / 1000;
+
+	if (pck != t->pixel_clock) {
+		DSSWARN("Could not find exact pixel clock. "
+				"Requested %d kHz, got %lu kHz\n",
+				t->pixel_clock, pck);
+
+		t->pixel_clock = pck;
+	}
+
+	dispc_set_lcd_timings(t);
+
+err0:
+	dss_clk_disable(DSS_CLK_ICK | DSS_CLK_FCK1);
+	return r;
+}
+
+static int dpi_basic_init(struct omap_dss_device *dssdev)
+{
+	bool is_tft;
+
+	is_tft = (dssdev->panel.config & OMAP_DSS_LCD_TFT) != 0;
+
+	dispc_set_parallel_interface_mode(OMAP_DSS_PARALLELMODE_BYPASS);
+	dispc_set_lcd_display_type(is_tft ? OMAP_DSS_LCD_DISPLAY_TFT :
+			OMAP_DSS_LCD_DISPLAY_STN);
+	dispc_set_tft_data_lines(dssdev->phy.dpi.data_lines);
+
+	return 0;
+}
+
+static int dpi_display_enable(struct omap_dss_device *dssdev)
+{
+	int r;
+
+	r = omap_dss_start_device(dssdev);
+	if (r) {
+		DSSERR("failed to start device\n");
+		goto err0;
+	}
+
+	if (dssdev->state != OMAP_DSS_DISPLAY_DISABLED) {
+		DSSERR("display already enabled\n");
+		r = -EINVAL;
+		goto err1;
+	}
+
+	dss_clk_enable(DSS_CLK_ICK | DSS_CLK_FCK1);
+
+	r = dpi_basic_init(dssdev);
+	if (r)
+		goto err2;
+
+#ifdef CONFIG_OMAP2_DSS_USE_DSI_PLL
+	dss_clk_enable(DSS_CLK_FCK2);
+	r = dsi_pll_init(dssdev, 0, 1);
+	if (r)
+		goto err3;
+#endif
+	r = dpi_set_mode(dssdev);
+	if (r)
+		goto err4;
+
+	mdelay(2);
+
+	dispc_enable_lcd_out(1);
+
+	r = dssdev->driver->enable(dssdev);
+	if (r)
+		goto err5;
+
+	dssdev->state = OMAP_DSS_DISPLAY_ACTIVE;
+
+	return 0;
+
+err5:
+	dispc_enable_lcd_out(0);
+err4:
+#ifdef CONFIG_OMAP2_DSS_USE_DSI_PLL
+	dsi_pll_uninit();
+err3:
+	dss_clk_disable(DSS_CLK_FCK2);
+#endif
+err2:
+	dss_clk_disable(DSS_CLK_ICK | DSS_CLK_FCK1);
+err1:
+	omap_dss_stop_device(dssdev);
+err0:
+	return r;
+}
+
+static int dpi_display_resume(struct omap_dss_device *dssdev);
+
+static void dpi_display_disable(struct omap_dss_device *dssdev)
+{
+	if (dssdev->state == OMAP_DSS_DISPLAY_DISABLED)
+		return;
+
+	if (dssdev->state == OMAP_DSS_DISPLAY_SUSPENDED)
+		dpi_display_resume(dssdev);
+
+	dssdev->driver->disable(dssdev);
+
+	dispc_enable_lcd_out(0);
+
+#ifdef CONFIG_OMAP2_DSS_USE_DSI_PLL
+	dss_select_clk_source(0, 0);
+	dsi_pll_uninit();
+	dss_clk_disable(DSS_CLK_FCK2);
+#endif
+
+	dss_clk_disable(DSS_CLK_ICK | DSS_CLK_FCK1);
+
+	dssdev->state = OMAP_DSS_DISPLAY_DISABLED;
+
+	omap_dss_stop_device(dssdev);
+}
+
+static int dpi_display_suspend(struct omap_dss_device *dssdev)
+{
+	if (dssdev->state != OMAP_DSS_DISPLAY_ACTIVE)
+		return -EINVAL;
+
+	DSSDBG("dpi_display_suspend\n");
+
+	if (dssdev->driver->suspend)
+		dssdev->driver->suspend(dssdev);
+
+	dispc_enable_lcd_out(0);
+
+	dss_clk_disable(DSS_CLK_ICK | DSS_CLK_FCK1);
+
+	dssdev->state = OMAP_DSS_DISPLAY_SUSPENDED;
+
+	return 0;
+}
+
+static int dpi_display_resume(struct omap_dss_device *dssdev)
+{
+	if (dssdev->state != OMAP_DSS_DISPLAY_SUSPENDED)
+		return -EINVAL;
+
+	DSSDBG("dpi_display_resume\n");
+
+	dss_clk_enable(DSS_CLK_ICK | DSS_CLK_FCK1);
+
+	dispc_enable_lcd_out(1);
+
+	if (dssdev->driver->resume)
+		dssdev->driver->resume(dssdev);
+
+	dssdev->state = OMAP_DSS_DISPLAY_ACTIVE;
+
+	return 0;
+}
+
+static void dpi_set_timings(struct omap_dss_device *dssdev,
+			struct omap_video_timings *timings)
+{
+	DSSDBG("dpi_set_timings\n");
+	dssdev->panel.timings = *timings;
+	if (dssdev->state == OMAP_DSS_DISPLAY_ACTIVE) {
+		dpi_set_mode(dssdev);
+		dispc_go(OMAP_DSS_CHANNEL_LCD);
+	}
+}
+
+static int dpi_check_timings(struct omap_dss_device *dssdev,
+			struct omap_video_timings *timings)
+{
+	bool is_tft;
+	int r;
+	int lck_div, pck_div;
+	unsigned long fck;
+	unsigned long pck;
+
+	if (!dispc_lcd_timings_ok(timings))
+		return -EINVAL;
+
+	if (timings->pixel_clock == 0)
+		return -EINVAL;
+
+	is_tft = (dssdev->panel.config & OMAP_DSS_LCD_TFT) != 0;
+
+#ifdef CONFIG_OMAP2_DSS_USE_DSI_PLL
+	{
+		struct dsi_clock_info dsi_cinfo;
+		struct dispc_clock_info dispc_cinfo;
+		r = dsi_pll_calc_clock_div_pck(is_tft,
+				timings->pixel_clock * 1000,
+				&dsi_cinfo, &dispc_cinfo);
+
+		if (r)
+			return r;
+
+		fck = dsi_cinfo.dsi1_pll_fclk;
+		lck_div = dispc_cinfo.lck_div;
+		pck_div = dispc_cinfo.pck_div;
+	}
+#else
+	{
+		struct dss_clock_info dss_cinfo;
+		struct dispc_clock_info dispc_cinfo;
+		r = dss_calc_clock_div(is_tft, timings->pixel_clock * 1000,
+				&dss_cinfo, &dispc_cinfo);
+
+		if (r)
+			return r;
+
+		fck = dss_cinfo.fck;
+		lck_div = dispc_cinfo.lck_div;
+		pck_div = dispc_cinfo.pck_div;
+	}
+#endif
+
+	pck = fck / lck_div / pck_div / 1000;
+
+	timings->pixel_clock = pck;
+
+	return 0;
+}
+
+static void dpi_get_timings(struct omap_dss_device *dssdev,
+			struct omap_video_timings *timings)
+{
+	*timings = dssdev->panel.timings;
+}
+
+static int dpi_display_set_update_mode(struct omap_dss_device *dssdev,
+		enum omap_dss_update_mode mode)
+{
+	if (mode == OMAP_DSS_UPDATE_MANUAL)
+		return -EINVAL;
+
+	if (mode == OMAP_DSS_UPDATE_DISABLED) {
+		dispc_enable_lcd_out(0);
+		dpi.update_enabled = 0;
+	} else {
+		dispc_enable_lcd_out(1);
+		dpi.update_enabled = 1;
+	}
+
+	return 0;
+}
+
+static enum omap_dss_update_mode dpi_display_get_update_mode(
+		struct omap_dss_device *dssdev)
+{
+	return dpi.update_enabled ? OMAP_DSS_UPDATE_AUTO :
+		OMAP_DSS_UPDATE_DISABLED;
+}
+
+int dpi_init_display(struct omap_dss_device *dssdev)
+{
+	DSSDBG("init_display\n");
+
+	dssdev->enable = dpi_display_enable;
+	dssdev->disable = dpi_display_disable;
+	dssdev->suspend = dpi_display_suspend;
+	dssdev->resume = dpi_display_resume;
+	dssdev->set_timings = dpi_set_timings;
+	dssdev->check_timings = dpi_check_timings;
+	dssdev->get_timings = dpi_get_timings;
+	dssdev->set_update_mode = dpi_display_set_update_mode;
+	dssdev->get_update_mode = dpi_display_get_update_mode;
+
+	return 0;
+}
+
+int dpi_init(void)
+{
+	return 0;
+}
+
+void dpi_exit(void)
+{
+}
+
diff --git a/drivers/video/omap2/dss/dsi.c b/drivers/video/omap2/dss/dsi.c
new file mode 100644
index 000000000000..6122178f5f85
--- /dev/null
+++ b/drivers/video/omap2/dss/dsi.c
@@ -0,0 +1,3839 @@
+/*
+ * linux/drivers/video/omap2/dss/dsi.c
+ *
+ * Copyright (C) 2009 Nokia Corporation
+ * Author: Tomi Valkeinen <tomi.valkeinen@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#define DSS_SUBSYS_NAME "DSI"
+
+#include <linux/kernel.h>
+#include <linux/io.h>
+#include <linux/clk.h>
+#include <linux/device.h>
+#include <linux/err.h>
+#include <linux/interrupt.h>
+#include <linux/delay.h>
+#include <linux/mutex.h>
+#include <linux/seq_file.h>
+#include <linux/platform_device.h>
+#include <linux/regulator/consumer.h>
+#include <linux/kthread.h>
+#include <linux/wait.h>
+
+#include <plat/display.h>
+#include <plat/clock.h>
+
+#include "dss.h"
+
+/*#define VERBOSE_IRQ*/
+#define DSI_CATCH_MISSING_TE
+
+#define DSI_BASE		0x4804FC00
+
+struct dsi_reg { u16 idx; };
+
+#define DSI_REG(idx)		((const struct dsi_reg) { idx })
+
+#define DSI_SZ_REGS		SZ_1K
+/* DSI Protocol Engine */
+
+#define DSI_REVISION			DSI_REG(0x0000)
+#define DSI_SYSCONFIG			DSI_REG(0x0010)
+#define DSI_SYSSTATUS			DSI_REG(0x0014)
+#define DSI_IRQSTATUS			DSI_REG(0x0018)
+#define DSI_IRQENABLE			DSI_REG(0x001C)
+#define DSI_CTRL			DSI_REG(0x0040)
+#define DSI_COMPLEXIO_CFG1		DSI_REG(0x0048)
+#define DSI_COMPLEXIO_IRQ_STATUS	DSI_REG(0x004C)
+#define DSI_COMPLEXIO_IRQ_ENABLE	DSI_REG(0x0050)
+#define DSI_CLK_CTRL			DSI_REG(0x0054)
+#define DSI_TIMING1			DSI_REG(0x0058)
+#define DSI_TIMING2			DSI_REG(0x005C)
+#define DSI_VM_TIMING1			DSI_REG(0x0060)
+#define DSI_VM_TIMING2			DSI_REG(0x0064)
+#define DSI_VM_TIMING3			DSI_REG(0x0068)
+#define DSI_CLK_TIMING			DSI_REG(0x006C)
+#define DSI_TX_FIFO_VC_SIZE		DSI_REG(0x0070)
+#define DSI_RX_FIFO_VC_SIZE		DSI_REG(0x0074)
+#define DSI_COMPLEXIO_CFG2		DSI_REG(0x0078)
+#define DSI_RX_FIFO_VC_FULLNESS		DSI_REG(0x007C)
+#define DSI_VM_TIMING4			DSI_REG(0x0080)
+#define DSI_TX_FIFO_VC_EMPTINESS	DSI_REG(0x0084)
+#define DSI_VM_TIMING5			DSI_REG(0x0088)
+#define DSI_VM_TIMING6			DSI_REG(0x008C)
+#define DSI_VM_TIMING7			DSI_REG(0x0090)
+#define DSI_STOPCLK_TIMING		DSI_REG(0x0094)
+#define DSI_VC_CTRL(n)			DSI_REG(0x0100 + (n * 0x20))
+#define DSI_VC_TE(n)			DSI_REG(0x0104 + (n * 0x20))
+#define DSI_VC_LONG_PACKET_HEADER(n)	DSI_REG(0x0108 + (n * 0x20))
+#define DSI_VC_LONG_PACKET_PAYLOAD(n)	DSI_REG(0x010C + (n * 0x20))
+#define DSI_VC_SHORT_PACKET_HEADER(n)	DSI_REG(0x0110 + (n * 0x20))
+#define DSI_VC_IRQSTATUS(n)		DSI_REG(0x0118 + (n * 0x20))
+#define DSI_VC_IRQENABLE(n)		DSI_REG(0x011C + (n * 0x20))
+
+/* DSIPHY_SCP */
+
+#define DSI_DSIPHY_CFG0			DSI_REG(0x200 + 0x0000)
+#define DSI_DSIPHY_CFG1			DSI_REG(0x200 + 0x0004)
+#define DSI_DSIPHY_CFG2			DSI_REG(0x200 + 0x0008)
+#define DSI_DSIPHY_CFG5			DSI_REG(0x200 + 0x0014)
+
+/* DSI_PLL_CTRL_SCP */
+
+#define DSI_PLL_CONTROL			DSI_REG(0x300 + 0x0000)
+#define DSI_PLL_STATUS			DSI_REG(0x300 + 0x0004)
+#define DSI_PLL_GO			DSI_REG(0x300 + 0x0008)
+#define DSI_PLL_CONFIGURATION1		DSI_REG(0x300 + 0x000C)
+#define DSI_PLL_CONFIGURATION2		DSI_REG(0x300 + 0x0010)
+
+#define REG_GET(idx, start, end) \
+	FLD_GET(dsi_read_reg(idx), start, end)
+
+#define REG_FLD_MOD(idx, val, start, end) \
+	dsi_write_reg(idx, FLD_MOD(dsi_read_reg(idx), val, start, end))
+
+/* Global interrupts */
+#define DSI_IRQ_VC0		(1 << 0)
+#define DSI_IRQ_VC1		(1 << 1)
+#define DSI_IRQ_VC2		(1 << 2)
+#define DSI_IRQ_VC3		(1 << 3)
+#define DSI_IRQ_WAKEUP		(1 << 4)
+#define DSI_IRQ_RESYNC		(1 << 5)
+#define DSI_IRQ_PLL_LOCK	(1 << 7)
+#define DSI_IRQ_PLL_UNLOCK	(1 << 8)
+#define DSI_IRQ_PLL_RECALL	(1 << 9)
+#define DSI_IRQ_COMPLEXIO_ERR	(1 << 10)
+#define DSI_IRQ_HS_TX_TIMEOUT	(1 << 14)
+#define DSI_IRQ_LP_RX_TIMEOUT	(1 << 15)
+#define DSI_IRQ_TE_TRIGGER	(1 << 16)
+#define DSI_IRQ_ACK_TRIGGER	(1 << 17)
+#define DSI_IRQ_SYNC_LOST	(1 << 18)
+#define DSI_IRQ_LDO_POWER_GOOD	(1 << 19)
+#define DSI_IRQ_TA_TIMEOUT	(1 << 20)
+#define DSI_IRQ_ERROR_MASK \
+	(DSI_IRQ_HS_TX_TIMEOUT | DSI_IRQ_LP_RX_TIMEOUT | DSI_IRQ_SYNC_LOST | \
+	DSI_IRQ_TA_TIMEOUT)
+#define DSI_IRQ_CHANNEL_MASK	0xf
+
+/* Virtual channel interrupts */
+#define DSI_VC_IRQ_CS		(1 << 0)
+#define DSI_VC_IRQ_ECC_CORR	(1 << 1)
+#define DSI_VC_IRQ_PACKET_SENT	(1 << 2)
+#define DSI_VC_IRQ_FIFO_TX_OVF	(1 << 3)
+#define DSI_VC_IRQ_FIFO_RX_OVF	(1 << 4)
+#define DSI_VC_IRQ_BTA		(1 << 5)
+#define DSI_VC_IRQ_ECC_NO_CORR	(1 << 6)
+#define DSI_VC_IRQ_FIFO_TX_UDF	(1 << 7)
+#define DSI_VC_IRQ_PP_BUSY_CHANGE (1 << 8)
+#define DSI_VC_IRQ_ERROR_MASK \
+	(DSI_VC_IRQ_CS | DSI_VC_IRQ_ECC_CORR | DSI_VC_IRQ_FIFO_TX_OVF | \
+	DSI_VC_IRQ_FIFO_RX_OVF | DSI_VC_IRQ_ECC_NO_CORR | \
+	DSI_VC_IRQ_FIFO_TX_UDF)
+
+/* ComplexIO interrupts */
+#define DSI_CIO_IRQ_ERRSYNCESC1		(1 << 0)
+#define DSI_CIO_IRQ_ERRSYNCESC2		(1 << 1)
+#define DSI_CIO_IRQ_ERRSYNCESC3		(1 << 2)
+#define DSI_CIO_IRQ_ERRESC1		(1 << 5)
+#define DSI_CIO_IRQ_ERRESC2		(1 << 6)
+#define DSI_CIO_IRQ_ERRESC3		(1 << 7)
+#define DSI_CIO_IRQ_ERRCONTROL1		(1 << 10)
+#define DSI_CIO_IRQ_ERRCONTROL2		(1 << 11)
+#define DSI_CIO_IRQ_ERRCONTROL3		(1 << 12)
+#define DSI_CIO_IRQ_STATEULPS1		(1 << 15)
+#define DSI_CIO_IRQ_STATEULPS2		(1 << 16)
+#define DSI_CIO_IRQ_STATEULPS3		(1 << 17)
+#define DSI_CIO_IRQ_ERRCONTENTIONLP0_1	(1 << 20)
+#define DSI_CIO_IRQ_ERRCONTENTIONLP1_1	(1 << 21)
+#define DSI_CIO_IRQ_ERRCONTENTIONLP0_2	(1 << 22)
+#define DSI_CIO_IRQ_ERRCONTENTIONLP1_2	(1 << 23)
+#define DSI_CIO_IRQ_ERRCONTENTIONLP0_3	(1 << 24)
+#define DSI_CIO_IRQ_ERRCONTENTIONLP1_3	(1 << 25)
+#define DSI_CIO_IRQ_ULPSACTIVENOT_ALL0	(1 << 30)
+#define DSI_CIO_IRQ_ULPSACTIVENOT_ALL1	(1 << 31)
+
+#define DSI_DT_DCS_SHORT_WRITE_0	0x05
+#define DSI_DT_DCS_SHORT_WRITE_1	0x15
+#define DSI_DT_DCS_READ			0x06
+#define DSI_DT_SET_MAX_RET_PKG_SIZE	0x37
+#define DSI_DT_NULL_PACKET		0x09
+#define DSI_DT_DCS_LONG_WRITE		0x39
+
+#define DSI_DT_RX_ACK_WITH_ERR		0x02
+#define DSI_DT_RX_DCS_LONG_READ		0x1c
+#define DSI_DT_RX_SHORT_READ_1		0x21
+#define DSI_DT_RX_SHORT_READ_2		0x22
+
+#define FINT_MAX 2100000
+#define FINT_MIN 750000
+#define REGN_MAX (1 << 7)
+#define REGM_MAX ((1 << 11) - 1)
+#define REGM3_MAX (1 << 4)
+#define REGM4_MAX (1 << 4)
+#define LP_DIV_MAX ((1 << 13) - 1)
+
+enum fifo_size {
+	DSI_FIFO_SIZE_0		= 0,
+	DSI_FIFO_SIZE_32	= 1,
+	DSI_FIFO_SIZE_64	= 2,
+	DSI_FIFO_SIZE_96	= 3,
+	DSI_FIFO_SIZE_128	= 4,
+};
+
+enum dsi_vc_mode {
+	DSI_VC_MODE_L4 = 0,
+	DSI_VC_MODE_VP,
+};
+
+struct dsi_update_region {
+	bool dirty;
+	u16 x, y, w, h;
+	struct omap_dss_device *device;
+};
+
+struct dsi_irq_stats {
+	unsigned long last_reset;
+	unsigned irq_count;
+	unsigned dsi_irqs[32];
+	unsigned vc_irqs[4][32];
+	unsigned cio_irqs[32];
+};
+
+static struct
+{
+	void __iomem	*base;
+
+	struct dsi_clock_info current_cinfo;
+
+	struct regulator *vdds_dsi_reg;
+
+	struct {
+		enum dsi_vc_mode mode;
+		struct omap_dss_device *dssdev;
+		enum fifo_size fifo_size;
+		int dest_per;	/* destination peripheral 0-3 */
+	} vc[4];
+
+	struct mutex lock;
+	struct mutex bus_lock;
+
+	unsigned pll_locked;
+
+	struct completion bta_completion;
+
+	struct task_struct *thread;
+	wait_queue_head_t waitqueue;
+
+	spinlock_t update_lock;
+	bool framedone_received;
+	struct dsi_update_region update_region;
+	struct dsi_update_region active_update_region;
+	struct completion update_completion;
+
+	enum omap_dss_update_mode user_update_mode;
+	enum omap_dss_update_mode update_mode;
+	bool te_enabled;
+	bool use_ext_te;
+
+#ifdef DSI_CATCH_MISSING_TE
+	struct timer_list te_timer;
+#endif
+
+	unsigned long cache_req_pck;
+	unsigned long cache_clk_freq;
+	struct dsi_clock_info cache_cinfo;
+
+	u32		errors;
+	spinlock_t	errors_lock;
+#ifdef DEBUG
+	ktime_t perf_setup_time;
+	ktime_t perf_start_time;
+	ktime_t perf_start_time_auto;
+	int perf_measure_frames;
+#endif
+	int debug_read;
+	int debug_write;
+
+#ifdef CONFIG_OMAP2_DSS_COLLECT_IRQ_STATS
+	spinlock_t irq_stats_lock;
+	struct dsi_irq_stats irq_stats;
+#endif
+} dsi;
+
+#ifdef DEBUG
+static unsigned int dsi_perf;
+module_param_named(dsi_perf, dsi_perf, bool, 0644);
+#endif
+
+static inline void dsi_write_reg(const struct dsi_reg idx, u32 val)
+{
+	__raw_writel(val, dsi.base + idx.idx);
+}
+
+static inline u32 dsi_read_reg(const struct dsi_reg idx)
+{
+	return __raw_readl(dsi.base + idx.idx);
+}
+
+
+void dsi_save_context(void)
+{
+}
+
+void dsi_restore_context(void)
+{
+}
+
+void dsi_bus_lock(void)
+{
+	mutex_lock(&dsi.bus_lock);
+}
+EXPORT_SYMBOL(dsi_bus_lock);
+
+void dsi_bus_unlock(void)
+{
+	mutex_unlock(&dsi.bus_lock);
+}
+EXPORT_SYMBOL(dsi_bus_unlock);
+
+static inline int wait_for_bit_change(const struct dsi_reg idx, int bitnum,
+		int value)
+{
+	int t = 100000;
+
+	while (REG_GET(idx, bitnum, bitnum) != value) {
+		if (--t == 0)
+			return !value;
+	}
+
+	return value;
+}
+
+#ifdef DEBUG
+static void dsi_perf_mark_setup(void)
+{
+	dsi.perf_setup_time = ktime_get();
+}
+
+static void dsi_perf_mark_start(void)
+{
+	dsi.perf_start_time = ktime_get();
+}
+
+static void dsi_perf_mark_start_auto(void)
+{
+	dsi.perf_measure_frames = 0;
+	dsi.perf_start_time_auto = ktime_get();
+}
+
+static void dsi_perf_show(const char *name)
+{
+	ktime_t t, setup_time, trans_time;
+	u32 total_bytes;
+	u32 setup_us, trans_us, total_us;
+
+	if (!dsi_perf)
+		return;
+
+	if (dsi.update_mode == OMAP_DSS_UPDATE_DISABLED)
+		return;
+
+	t = ktime_get();
+
+	setup_time = ktime_sub(dsi.perf_start_time, dsi.perf_setup_time);
+	setup_us = (u32)ktime_to_us(setup_time);
+	if (setup_us == 0)
+		setup_us = 1;
+
+	trans_time = ktime_sub(t, dsi.perf_start_time);
+	trans_us = (u32)ktime_to_us(trans_time);
+	if (trans_us == 0)
+		trans_us = 1;
+
+	total_us = setup_us + trans_us;
+
+	total_bytes = dsi.active_update_region.w *
+		dsi.active_update_region.h *
+		dsi.active_update_region.device->ctrl.pixel_size / 8;
+
+	if (dsi.update_mode == OMAP_DSS_UPDATE_AUTO) {
+		static u32 s_total_trans_us, s_total_setup_us;
+		static u32 s_min_trans_us = 0xffffffff, s_min_setup_us;
+		static u32 s_max_trans_us, s_max_setup_us;
+		const int numframes = 100;
+		ktime_t total_time_auto;
+		u32 total_time_auto_us;
+
+		dsi.perf_measure_frames++;
+
+		if (setup_us < s_min_setup_us)
+			s_min_setup_us = setup_us;
+
+		if (setup_us > s_max_setup_us)
+			s_max_setup_us = setup_us;
+
+		s_total_setup_us += setup_us;
+
+		if (trans_us < s_min_trans_us)
+			s_min_trans_us = trans_us;
+
+		if (trans_us > s_max_trans_us)
+			s_max_trans_us = trans_us;
+
+		s_total_trans_us += trans_us;
+
+		if (dsi.perf_measure_frames < numframes)
+			return;
+
+		total_time_auto = ktime_sub(t, dsi.perf_start_time_auto);
+		total_time_auto_us = (u32)ktime_to_us(total_time_auto);
+
+		printk(KERN_INFO "DSI(%s): %u fps, setup %u/%u/%u, "
+				"trans %u/%u/%u\n",
+				name,
+				1000 * 1000 * numframes / total_time_auto_us,
+				s_min_setup_us,
+				s_max_setup_us,
+				s_total_setup_us / numframes,
+				s_min_trans_us,
+				s_max_trans_us,
+				s_total_trans_us / numframes);
+
+		s_total_setup_us = 0;
+		s_min_setup_us = 0xffffffff;
+		s_max_setup_us = 0;
+		s_total_trans_us = 0;
+		s_min_trans_us = 0xffffffff;
+		s_max_trans_us = 0;
+		dsi_perf_mark_start_auto();
+	} else {
+		printk(KERN_INFO "DSI(%s): %u us + %u us = %u us (%uHz), "
+				"%u bytes, %u kbytes/sec\n",
+				name,
+				setup_us,
+				trans_us,
+				total_us,
+				1000*1000 / total_us,
+				total_bytes,
+				total_bytes * 1000 / total_us);
+	}
+}
+#else
+#define dsi_perf_mark_setup()
+#define dsi_perf_mark_start()
+#define dsi_perf_mark_start_auto()
+#define dsi_perf_show(x)
+#endif
+
+static void print_irq_status(u32 status)
+{
+#ifndef VERBOSE_IRQ
+	if ((status & ~DSI_IRQ_CHANNEL_MASK) == 0)
+		return;
+#endif
+	printk(KERN_DEBUG "DSI IRQ: 0x%x: ", status);
+
+#define PIS(x) \
+	if (status & DSI_IRQ_##x) \
+		printk(#x " ");
+#ifdef VERBOSE_IRQ
+	PIS(VC0);
+	PIS(VC1);
+	PIS(VC2);
+	PIS(VC3);
+#endif
+	PIS(WAKEUP);
+	PIS(RESYNC);
+	PIS(PLL_LOCK);
+	PIS(PLL_UNLOCK);
+	PIS(PLL_RECALL);
+	PIS(COMPLEXIO_ERR);
+	PIS(HS_TX_TIMEOUT);
+	PIS(LP_RX_TIMEOUT);
+	PIS(TE_TRIGGER);
+	PIS(ACK_TRIGGER);
+	PIS(SYNC_LOST);
+	PIS(LDO_POWER_GOOD);
+	PIS(TA_TIMEOUT);
+#undef PIS
+
+	printk("\n");
+}
+
+static void print_irq_status_vc(int channel, u32 status)
+{
+#ifndef VERBOSE_IRQ
+	if ((status & ~DSI_VC_IRQ_PACKET_SENT) == 0)
+		return;
+#endif
+	printk(KERN_DEBUG "DSI VC(%d) IRQ 0x%x: ", channel, status);
+
+#define PIS(x) \
+	if (status & DSI_VC_IRQ_##x) \
+		printk(#x " ");
+	PIS(CS);
+	PIS(ECC_CORR);
+#ifdef VERBOSE_IRQ
+	PIS(PACKET_SENT);
+#endif
+	PIS(FIFO_TX_OVF);
+	PIS(FIFO_RX_OVF);
+	PIS(BTA);
+	PIS(ECC_NO_CORR);
+	PIS(FIFO_TX_UDF);
+	PIS(PP_BUSY_CHANGE);
+#undef PIS
+	printk("\n");
+}
+
+static void print_irq_status_cio(u32 status)
+{
+	printk(KERN_DEBUG "DSI CIO IRQ 0x%x: ", status);
+
+#define PIS(x) \
+	if (status & DSI_CIO_IRQ_##x) \
+		printk(#x " ");
+	PIS(ERRSYNCESC1);
+	PIS(ERRSYNCESC2);
+	PIS(ERRSYNCESC3);
+	PIS(ERRESC1);
+	PIS(ERRESC2);
+	PIS(ERRESC3);
+	PIS(ERRCONTROL1);
+	PIS(ERRCONTROL2);
+	PIS(ERRCONTROL3);
+	PIS(STATEULPS1);
+	PIS(STATEULPS2);
+	PIS(STATEULPS3);
+	PIS(ERRCONTENTIONLP0_1);
+	PIS(ERRCONTENTIONLP1_1);
+	PIS(ERRCONTENTIONLP0_2);
+	PIS(ERRCONTENTIONLP1_2);
+	PIS(ERRCONTENTIONLP0_3);
+	PIS(ERRCONTENTIONLP1_3);
+	PIS(ULPSACTIVENOT_ALL0);
+	PIS(ULPSACTIVENOT_ALL1);
+#undef PIS
+
+	printk("\n");
+}
+
+static int debug_irq;
+
+/* called from dss */
+void dsi_irq_handler(void)
+{
+	u32 irqstatus, vcstatus, ciostatus;
+	int i;
+
+	irqstatus = dsi_read_reg(DSI_IRQSTATUS);
+
+#ifdef CONFIG_OMAP2_DSS_COLLECT_IRQ_STATS
+	spin_lock(&dsi.irq_stats_lock);
+	dsi.irq_stats.irq_count++;
+	dss_collect_irq_stats(irqstatus, dsi.irq_stats.dsi_irqs);
+#endif
+
+	if (irqstatus & DSI_IRQ_ERROR_MASK) {
+		DSSERR("DSI error, irqstatus %x\n", irqstatus);
+		print_irq_status(irqstatus);
+		spin_lock(&dsi.errors_lock);
+		dsi.errors |= irqstatus & DSI_IRQ_ERROR_MASK;
+		spin_unlock(&dsi.errors_lock);
+	} else if (debug_irq) {
+		print_irq_status(irqstatus);
+	}
+
+#ifdef DSI_CATCH_MISSING_TE
+	if (irqstatus & DSI_IRQ_TE_TRIGGER)
+		del_timer(&dsi.te_timer);
+#endif
+
+	for (i = 0; i < 4; ++i) {
+		if ((irqstatus & (1<<i)) == 0)
+			continue;
+
+		vcstatus = dsi_read_reg(DSI_VC_IRQSTATUS(i));
+
+#ifdef CONFIG_OMAP2_DSS_COLLECT_IRQ_STATS
+		dss_collect_irq_stats(vcstatus, dsi.irq_stats.vc_irqs[i]);
+#endif
+
+		if (vcstatus & DSI_VC_IRQ_BTA)
+			complete(&dsi.bta_completion);
+
+		if (vcstatus & DSI_VC_IRQ_ERROR_MASK) {
+			DSSERR("DSI VC(%d) error, vc irqstatus %x\n",
+				       i, vcstatus);
+			print_irq_status_vc(i, vcstatus);
+		} else if (debug_irq) {
+			print_irq_status_vc(i, vcstatus);
+		}
+
+		dsi_write_reg(DSI_VC_IRQSTATUS(i), vcstatus);
+		/* flush posted write */
+		dsi_read_reg(DSI_VC_IRQSTATUS(i));
+	}
+
+	if (irqstatus & DSI_IRQ_COMPLEXIO_ERR) {
+		ciostatus = dsi_read_reg(DSI_COMPLEXIO_IRQ_STATUS);
+
+#ifdef CONFIG_OMAP2_DSS_COLLECT_IRQ_STATS
+		dss_collect_irq_stats(ciostatus, dsi.irq_stats.cio_irqs);
+#endif
+
+		dsi_write_reg(DSI_COMPLEXIO_IRQ_STATUS, ciostatus);
+		/* flush posted write */
+		dsi_read_reg(DSI_COMPLEXIO_IRQ_STATUS);
+
+		DSSERR("DSI CIO error, cio irqstatus %x\n", ciostatus);
+		print_irq_status_cio(ciostatus);
+	}
+
+	dsi_write_reg(DSI_IRQSTATUS, irqstatus & ~DSI_IRQ_CHANNEL_MASK);
+	/* flush posted write */
+	dsi_read_reg(DSI_IRQSTATUS);
+
+#ifdef CONFIG_OMAP2_DSS_COLLECT_IRQ_STATS
+	spin_unlock(&dsi.irq_stats_lock);
+#endif
+}
+
+
+static void _dsi_initialize_irq(void)
+{
+	u32 l;
+	int i;
+
+	/* disable all interrupts */
+	dsi_write_reg(DSI_IRQENABLE, 0);
+	for (i = 0; i < 4; ++i)
+		dsi_write_reg(DSI_VC_IRQENABLE(i), 0);
+	dsi_write_reg(DSI_COMPLEXIO_IRQ_ENABLE, 0);
+
+	/* clear interrupt status */
+	l = dsi_read_reg(DSI_IRQSTATUS);
+	dsi_write_reg(DSI_IRQSTATUS, l & ~DSI_IRQ_CHANNEL_MASK);
+
+	for (i = 0; i < 4; ++i) {
+		l = dsi_read_reg(DSI_VC_IRQSTATUS(i));
+		dsi_write_reg(DSI_VC_IRQSTATUS(i), l);
+	}
+
+	l = dsi_read_reg(DSI_COMPLEXIO_IRQ_STATUS);
+	dsi_write_reg(DSI_COMPLEXIO_IRQ_STATUS, l);
+
+	/* enable error irqs */
+	l = DSI_IRQ_ERROR_MASK;
+#ifdef DSI_CATCH_MISSING_TE
+	l |= DSI_IRQ_TE_TRIGGER;
+#endif
+	dsi_write_reg(DSI_IRQENABLE, l);
+
+	l = DSI_VC_IRQ_ERROR_MASK;
+	for (i = 0; i < 4; ++i)
+		dsi_write_reg(DSI_VC_IRQENABLE(i), l);
+
+	/* XXX zonda responds incorrectly, causing control error:
+	   Exit from LP-ESC mode to LP11 uses wrong transition states on the
+	   data lines LP0 and LN0. */
+	dsi_write_reg(DSI_COMPLEXIO_IRQ_ENABLE,
+			-1 & (~DSI_CIO_IRQ_ERRCONTROL2));
+}
+
+static u32 dsi_get_errors(void)
+{
+	unsigned long flags;
+	u32 e;
+	spin_lock_irqsave(&dsi.errors_lock, flags);
+	e = dsi.errors;
+	dsi.errors = 0;
+	spin_unlock_irqrestore(&dsi.errors_lock, flags);
+	return e;
+}
+
+static void dsi_vc_enable_bta_irq(int channel)
+{
+	u32 l;
+
+	dsi_write_reg(DSI_VC_IRQSTATUS(channel), DSI_VC_IRQ_BTA);
+
+	l = dsi_read_reg(DSI_VC_IRQENABLE(channel));
+	l |= DSI_VC_IRQ_BTA;
+	dsi_write_reg(DSI_VC_IRQENABLE(channel), l);
+}
+
+static void dsi_vc_disable_bta_irq(int channel)
+{
+	u32 l;
+
+	l = dsi_read_reg(DSI_VC_IRQENABLE(channel));
+	l &= ~DSI_VC_IRQ_BTA;
+	dsi_write_reg(DSI_VC_IRQENABLE(channel), l);
+}
+
+/* DSI func clock. this could also be DSI2_PLL_FCLK */
+static inline void enable_clocks(bool enable)
+{
+	if (enable)
+		dss_clk_enable(DSS_CLK_ICK | DSS_CLK_FCK1);
+	else
+		dss_clk_disable(DSS_CLK_ICK | DSS_CLK_FCK1);
+}
+
+/* source clock for DSI PLL. this could also be PCLKFREE */
+static inline void dsi_enable_pll_clock(bool enable)
+{
+	if (enable)
+		dss_clk_enable(DSS_CLK_FCK2);
+	else
+		dss_clk_disable(DSS_CLK_FCK2);
+
+	if (enable && dsi.pll_locked) {
+		if (wait_for_bit_change(DSI_PLL_STATUS, 1, 1) != 1)
+			DSSERR("cannot lock PLL when enabling clocks\n");
+	}
+}
+
+#ifdef DEBUG
+static void _dsi_print_reset_status(void)
+{
+	u32 l;
+
+	if (!dss_debug)
+		return;
+
+	/* A dummy read using the SCP interface to any DSIPHY register is
+	 * required after DSIPHY reset to complete the reset of the DSI complex
+	 * I/O. */
+	l = dsi_read_reg(DSI_DSIPHY_CFG5);
+
+	printk(KERN_DEBUG "DSI resets: ");
+
+	l = dsi_read_reg(DSI_PLL_STATUS);
+	printk("PLL (%d) ", FLD_GET(l, 0, 0));
+
+	l = dsi_read_reg(DSI_COMPLEXIO_CFG1);
+	printk("CIO (%d) ", FLD_GET(l, 29, 29));
+
+	l = dsi_read_reg(DSI_DSIPHY_CFG5);
+	printk("PHY (%x, %d, %d, %d)\n",
+			FLD_GET(l, 28, 26),
+			FLD_GET(l, 29, 29),
+			FLD_GET(l, 30, 30),
+			FLD_GET(l, 31, 31));
+}
+#else
+#define _dsi_print_reset_status()
+#endif
+
+static inline int dsi_if_enable(bool enable)
+{
+	DSSDBG("dsi_if_enable(%d)\n", enable);
+
+	enable = enable ? 1 : 0;
+	REG_FLD_MOD(DSI_CTRL, enable, 0, 0); /* IF_EN */
+
+	if (wait_for_bit_change(DSI_CTRL, 0, enable) != enable) {
+			DSSERR("Failed to set dsi_if_enable to %d\n", enable);
+			return -EIO;
+	}
+
+	return 0;
+}
+
+unsigned long dsi_get_dsi1_pll_rate(void)
+{
+	return dsi.current_cinfo.dsi1_pll_fclk;
+}
+
+static unsigned long dsi_get_dsi2_pll_rate(void)
+{
+	return dsi.current_cinfo.dsi2_pll_fclk;
+}
+
+static unsigned long dsi_get_txbyteclkhs(void)
+{
+	return dsi.current_cinfo.clkin4ddr / 16;
+}
+
+static unsigned long dsi_fclk_rate(void)
+{
+	unsigned long r;
+
+	if (dss_get_dsi_clk_source() == 0) {
+		/* DSI FCLK source is DSS1_ALWON_FCK, which is dss1_fck */
+		r = dss_clk_get_rate(DSS_CLK_FCK1);
+	} else {
+		/* DSI FCLK source is DSI2_PLL_FCLK */
+		r = dsi_get_dsi2_pll_rate();
+	}
+
+	return r;
+}
+
+static int dsi_set_lp_clk_divisor(struct omap_dss_device *dssdev)
+{
+	unsigned long dsi_fclk;
+	unsigned lp_clk_div;
+	unsigned long lp_clk;
+
+	lp_clk_div = dssdev->phy.dsi.div.lp_clk_div;
+
+	if (lp_clk_div == 0 || lp_clk_div > LP_DIV_MAX)
+		return -EINVAL;
+
+	dsi_fclk = dsi_fclk_rate();
+
+	lp_clk = dsi_fclk / 2 / lp_clk_div;
+
+	DSSDBG("LP_CLK_DIV %u, LP_CLK %lu\n", lp_clk_div, lp_clk);
+	dsi.current_cinfo.lp_clk = lp_clk;
+	dsi.current_cinfo.lp_clk_div = lp_clk_div;
+
+	REG_FLD_MOD(DSI_CLK_CTRL, lp_clk_div, 12, 0);   /* LP_CLK_DIVISOR */
+
+	REG_FLD_MOD(DSI_CLK_CTRL, dsi_fclk > 30000000 ? 1 : 0,
+			21, 21);		/* LP_RX_SYNCHRO_ENABLE */
+
+	return 0;
+}
+
+
+enum dsi_pll_power_state {
+	DSI_PLL_POWER_OFF	= 0x0,
+	DSI_PLL_POWER_ON_HSCLK	= 0x1,
+	DSI_PLL_POWER_ON_ALL	= 0x2,
+	DSI_PLL_POWER_ON_DIV	= 0x3,
+};
+
+static int dsi_pll_power(enum dsi_pll_power_state state)
+{
+	int t = 0;
+
+	REG_FLD_MOD(DSI_CLK_CTRL, state, 31, 30);	/* PLL_PWR_CMD */
+
+	/* PLL_PWR_STATUS */
+	while (FLD_GET(dsi_read_reg(DSI_CLK_CTRL), 29, 28) != state) {
+		if (++t > 1000) {
+			DSSERR("Failed to set DSI PLL power mode to %d\n",
+					state);
+			return -ENODEV;
+		}
+		udelay(1);
+	}
+
+	return 0;
+}
+
+/* calculate clock rates using dividers in cinfo */
+static int dsi_calc_clock_rates(struct dsi_clock_info *cinfo)
+{
+	if (cinfo->regn == 0 || cinfo->regn > REGN_MAX)
+		return -EINVAL;
+
+	if (cinfo->regm == 0 || cinfo->regm > REGM_MAX)
+		return -EINVAL;
+
+	if (cinfo->regm3 > REGM3_MAX)
+		return -EINVAL;
+
+	if (cinfo->regm4 > REGM4_MAX)
+		return -EINVAL;
+
+	if (cinfo->use_dss2_fck) {
+		cinfo->clkin = dss_clk_get_rate(DSS_CLK_FCK2);
+		/* XXX it is unclear if highfreq should be used
+		 * with DSS2_FCK source also */
+		cinfo->highfreq = 0;
+	} else {
+		cinfo->clkin = dispc_pclk_rate();
+
+		if (cinfo->clkin < 32000000)
+			cinfo->highfreq = 0;
+		else
+			cinfo->highfreq = 1;
+	}
+
+	cinfo->fint = cinfo->clkin / (cinfo->regn * (cinfo->highfreq ? 2 : 1));
+
+	if (cinfo->fint > FINT_MAX || cinfo->fint < FINT_MIN)
+		return -EINVAL;
+
+	cinfo->clkin4ddr = 2 * cinfo->regm * cinfo->fint;
+
+	if (cinfo->clkin4ddr > 1800 * 1000 * 1000)
+		return -EINVAL;
+
+	if (cinfo->regm3 > 0)
+		cinfo->dsi1_pll_fclk = cinfo->clkin4ddr / cinfo->regm3;
+	else
+		cinfo->dsi1_pll_fclk = 0;
+
+	if (cinfo->regm4 > 0)
+		cinfo->dsi2_pll_fclk = cinfo->clkin4ddr / cinfo->regm4;
+	else
+		cinfo->dsi2_pll_fclk = 0;
+
+	return 0;
+}
+
+int dsi_pll_calc_clock_div_pck(bool is_tft, unsigned long req_pck,
+		struct dsi_clock_info *dsi_cinfo,
+		struct dispc_clock_info *dispc_cinfo)
+{
+	struct dsi_clock_info cur, best;
+	struct dispc_clock_info best_dispc;
+	int min_fck_per_pck;
+	int match = 0;
+	unsigned long dss_clk_fck2;
+
+	dss_clk_fck2 = dss_clk_get_rate(DSS_CLK_FCK2);
+
+	if (req_pck == dsi.cache_req_pck &&
+			dsi.cache_cinfo.clkin == dss_clk_fck2) {
+		DSSDBG("DSI clock info found from cache\n");
+		*dsi_cinfo = dsi.cache_cinfo;
+		dispc_find_clk_divs(is_tft, req_pck, dsi_cinfo->dsi1_pll_fclk,
+				dispc_cinfo);
+		return 0;
+	}
+
+	min_fck_per_pck = CONFIG_OMAP2_DSS_MIN_FCK_PER_PCK;
+
+	if (min_fck_per_pck &&
+		req_pck * min_fck_per_pck > DISPC_MAX_FCK) {
+		DSSERR("Requested pixel clock not possible with the current "
+				"OMAP2_DSS_MIN_FCK_PER_PCK setting. Turning "
+				"the constraint off.\n");
+		min_fck_per_pck = 0;
+	}
+
+	DSSDBG("dsi_pll_calc\n");
+
+retry:
+	memset(&best, 0, sizeof(best));
+	memset(&best_dispc, 0, sizeof(best_dispc));
+
+	memset(&cur, 0, sizeof(cur));
+	cur.clkin = dss_clk_fck2;
+	cur.use_dss2_fck = 1;
+	cur.highfreq = 0;
+
+	/* no highfreq: 0.75MHz < Fint = clkin / regn < 2.1MHz */
+	/* highfreq: 0.75MHz < Fint = clkin / (2*regn) < 2.1MHz */
+	/* To reduce PLL lock time, keep Fint high (around 2 MHz) */
+	for (cur.regn = 1; cur.regn < REGN_MAX; ++cur.regn) {
+		if (cur.highfreq == 0)
+			cur.fint = cur.clkin / cur.regn;
+		else
+			cur.fint = cur.clkin / (2 * cur.regn);
+
+		if (cur.fint > FINT_MAX || cur.fint < FINT_MIN)
+			continue;
+
+		/* DSIPHY(MHz) = (2 * regm / regn) * (clkin / (highfreq + 1)) */
+		for (cur.regm = 1; cur.regm < REGM_MAX; ++cur.regm) {
+			unsigned long a, b;
+
+			a = 2 * cur.regm * (cur.clkin/1000);
+			b = cur.regn * (cur.highfreq + 1);
+			cur.clkin4ddr = a / b * 1000;
+
+			if (cur.clkin4ddr > 1800 * 1000 * 1000)
+				break;
+
+			/* DSI1_PLL_FCLK(MHz) = DSIPHY(MHz) / regm3  < 173MHz */
+			for (cur.regm3 = 1; cur.regm3 < REGM3_MAX;
+					++cur.regm3) {
+				struct dispc_clock_info cur_dispc;
+				cur.dsi1_pll_fclk = cur.clkin4ddr / cur.regm3;
+
+				/* this will narrow down the search a bit,
+				 * but still give pixclocks below what was
+				 * requested */
+				if (cur.dsi1_pll_fclk  < req_pck)
+					break;
+
+				if (cur.dsi1_pll_fclk > DISPC_MAX_FCK)
+					continue;
+
+				if (min_fck_per_pck &&
+					cur.dsi1_pll_fclk <
+						req_pck * min_fck_per_pck)
+					continue;
+
+				match = 1;
+
+				dispc_find_clk_divs(is_tft, req_pck,
+						cur.dsi1_pll_fclk,
+						&cur_dispc);
+
+				if (abs(cur_dispc.pck - req_pck) <
+						abs(best_dispc.pck - req_pck)) {
+					best = cur;
+					best_dispc = cur_dispc;
+
+					if (cur_dispc.pck == req_pck)
+						goto found;
+				}
+			}
+		}
+	}
+found:
+	if (!match) {
+		if (min_fck_per_pck) {
+			DSSERR("Could not find suitable clock settings.\n"
+					"Turning FCK/PCK constraint off and"
+					"trying again.\n");
+			min_fck_per_pck = 0;
+			goto retry;
+		}
+
+		DSSERR("Could not find suitable clock settings.\n");
+
+		return -EINVAL;
+	}
+
+	/* DSI2_PLL_FCLK (regm4) is not used */
+	best.regm4 = 0;
+	best.dsi2_pll_fclk = 0;
+
+	if (dsi_cinfo)
+		*dsi_cinfo = best;
+	if (dispc_cinfo)
+		*dispc_cinfo = best_dispc;
+
+	dsi.cache_req_pck = req_pck;
+	dsi.cache_clk_freq = 0;
+	dsi.cache_cinfo = best;
+
+	return 0;
+}
+
+int dsi_pll_set_clock_div(struct dsi_clock_info *cinfo)
+{
+	int r = 0;
+	u32 l;
+	int f;
+
+	DSSDBGF();
+
+	dsi.current_cinfo.fint = cinfo->fint;
+	dsi.current_cinfo.clkin4ddr = cinfo->clkin4ddr;
+	dsi.current_cinfo.dsi1_pll_fclk = cinfo->dsi1_pll_fclk;
+	dsi.current_cinfo.dsi2_pll_fclk = cinfo->dsi2_pll_fclk;
+
+	dsi.current_cinfo.regn = cinfo->regn;
+	dsi.current_cinfo.regm = cinfo->regm;
+	dsi.current_cinfo.regm3 = cinfo->regm3;
+	dsi.current_cinfo.regm4 = cinfo->regm4;
+
+	DSSDBG("DSI Fint %ld\n", cinfo->fint);
+
+	DSSDBG("clkin (%s) rate %ld, highfreq %d\n",
+			cinfo->use_dss2_fck ? "dss2_fck" : "pclkfree",
+			cinfo->clkin,
+			cinfo->highfreq);
+
+	/* DSIPHY == CLKIN4DDR */
+	DSSDBG("CLKIN4DDR = 2 * %d / %d * %lu / %d = %lu\n",
+			cinfo->regm,
+			cinfo->regn,
+			cinfo->clkin,
+			cinfo->highfreq + 1,
+			cinfo->clkin4ddr);
+
+	DSSDBG("Data rate on 1 DSI lane %ld Mbps\n",
+			cinfo->clkin4ddr / 1000 / 1000 / 2);
+
+	DSSDBG("Clock lane freq %ld Hz\n", cinfo->clkin4ddr / 4);
+
+	DSSDBG("regm3 = %d, dsi1_pll_fclk = %lu\n",
+			cinfo->regm3, cinfo->dsi1_pll_fclk);
+	DSSDBG("regm4 = %d, dsi2_pll_fclk = %lu\n",
+			cinfo->regm4, cinfo->dsi2_pll_fclk);
+
+	REG_FLD_MOD(DSI_PLL_CONTROL, 0, 0, 0); /* DSI_PLL_AUTOMODE = manual */
+
+	l = dsi_read_reg(DSI_PLL_CONFIGURATION1);
+	l = FLD_MOD(l, 1, 0, 0);		/* DSI_PLL_STOPMODE */
+	l = FLD_MOD(l, cinfo->regn - 1, 7, 1);	/* DSI_PLL_REGN */
+	l = FLD_MOD(l, cinfo->regm, 18, 8);	/* DSI_PLL_REGM */
+	l = FLD_MOD(l, cinfo->regm3 > 0 ? cinfo->regm3 - 1 : 0,
+			22, 19);		/* DSI_CLOCK_DIV */
+	l = FLD_MOD(l, cinfo->regm4 > 0 ? cinfo->regm4 - 1 : 0,
+			26, 23);		/* DSIPROTO_CLOCK_DIV */
+	dsi_write_reg(DSI_PLL_CONFIGURATION1, l);
+
+	BUG_ON(cinfo->fint < 750000 || cinfo->fint > 2100000);
+	if (cinfo->fint < 1000000)
+		f = 0x3;
+	else if (cinfo->fint < 1250000)
+		f = 0x4;
+	else if (cinfo->fint < 1500000)
+		f = 0x5;
+	else if (cinfo->fint < 1750000)
+		f = 0x6;
+	else
+		f = 0x7;
+
+	l = dsi_read_reg(DSI_PLL_CONFIGURATION2);
+	l = FLD_MOD(l, f, 4, 1);		/* DSI_PLL_FREQSEL */
+	l = FLD_MOD(l, cinfo->use_dss2_fck ? 0 : 1,
+			11, 11);		/* DSI_PLL_CLKSEL */
+	l = FLD_MOD(l, cinfo->highfreq,
+			12, 12);		/* DSI_PLL_HIGHFREQ */
+	l = FLD_MOD(l, 1, 13, 13);		/* DSI_PLL_REFEN */
+	l = FLD_MOD(l, 0, 14, 14);		/* DSIPHY_CLKINEN */
+	l = FLD_MOD(l, 1, 20, 20);		/* DSI_HSDIVBYPASS */
+	dsi_write_reg(DSI_PLL_CONFIGURATION2, l);
+
+	REG_FLD_MOD(DSI_PLL_GO, 1, 0, 0);	/* DSI_PLL_GO */
+
+	if (wait_for_bit_change(DSI_PLL_GO, 0, 0) != 0) {
+		DSSERR("dsi pll go bit not going down.\n");
+		r = -EIO;
+		goto err;
+	}
+
+	if (wait_for_bit_change(DSI_PLL_STATUS, 1, 1) != 1) {
+		DSSERR("cannot lock PLL\n");
+		r = -EIO;
+		goto err;
+	}
+
+	dsi.pll_locked = 1;
+
+	l = dsi_read_reg(DSI_PLL_CONFIGURATION2);
+	l = FLD_MOD(l, 0, 0, 0);	/* DSI_PLL_IDLE */
+	l = FLD_MOD(l, 0, 5, 5);	/* DSI_PLL_PLLLPMODE */
+	l = FLD_MOD(l, 0, 6, 6);	/* DSI_PLL_LOWCURRSTBY */
+	l = FLD_MOD(l, 0, 7, 7);	/* DSI_PLL_TIGHTPHASELOCK */
+	l = FLD_MOD(l, 0, 8, 8);	/* DSI_PLL_DRIFTGUARDEN */
+	l = FLD_MOD(l, 0, 10, 9);	/* DSI_PLL_LOCKSEL */
+	l = FLD_MOD(l, 1, 13, 13);	/* DSI_PLL_REFEN */
+	l = FLD_MOD(l, 1, 14, 14);	/* DSIPHY_CLKINEN */
+	l = FLD_MOD(l, 0, 15, 15);	/* DSI_BYPASSEN */
+	l = FLD_MOD(l, 1, 16, 16);	/* DSS_CLOCK_EN */
+	l = FLD_MOD(l, 0, 17, 17);	/* DSS_CLOCK_PWDN */
+	l = FLD_MOD(l, 1, 18, 18);	/* DSI_PROTO_CLOCK_EN */
+	l = FLD_MOD(l, 0, 19, 19);	/* DSI_PROTO_CLOCK_PWDN */
+	l = FLD_MOD(l, 0, 20, 20);	/* DSI_HSDIVBYPASS */
+	dsi_write_reg(DSI_PLL_CONFIGURATION2, l);
+
+	DSSDBG("PLL config done\n");
+err:
+	return r;
+}
+
+int dsi_pll_init(struct omap_dss_device *dssdev, bool enable_hsclk,
+		bool enable_hsdiv)
+{
+	int r = 0;
+	enum dsi_pll_power_state pwstate;
+
+	DSSDBG("PLL init\n");
+
+	enable_clocks(1);
+	dsi_enable_pll_clock(1);
+
+	r = regulator_enable(dsi.vdds_dsi_reg);
+	if (r)
+		goto err0;
+
+	/* XXX PLL does not come out of reset without this... */
+	dispc_pck_free_enable(1);
+
+	if (wait_for_bit_change(DSI_PLL_STATUS, 0, 1) != 1) {
+		DSSERR("PLL not coming out of reset.\n");
+		r = -ENODEV;
+		goto err1;
+	}
+
+	/* XXX ... but if left on, we get problems when planes do not
+	 * fill the whole display. No idea about this */
+	dispc_pck_free_enable(0);
+
+	if (enable_hsclk && enable_hsdiv)
+		pwstate = DSI_PLL_POWER_ON_ALL;
+	else if (enable_hsclk)
+		pwstate = DSI_PLL_POWER_ON_HSCLK;
+	else if (enable_hsdiv)
+		pwstate = DSI_PLL_POWER_ON_DIV;
+	else
+		pwstate = DSI_PLL_POWER_OFF;
+
+	r = dsi_pll_power(pwstate);
+
+	if (r)
+		goto err1;
+
+	DSSDBG("PLL init done\n");
+
+	return 0;
+err1:
+	regulator_disable(dsi.vdds_dsi_reg);
+err0:
+	enable_clocks(0);
+	dsi_enable_pll_clock(0);
+	return r;
+}
+
+void dsi_pll_uninit(void)
+{
+	enable_clocks(0);
+	dsi_enable_pll_clock(0);
+
+	dsi.pll_locked = 0;
+	dsi_pll_power(DSI_PLL_POWER_OFF);
+	regulator_disable(dsi.vdds_dsi_reg);
+	DSSDBG("PLL uninit done\n");
+}
+
+void dsi_dump_clocks(struct seq_file *s)
+{
+	int clksel;
+	struct dsi_clock_info *cinfo = &dsi.current_cinfo;
+
+	enable_clocks(1);
+
+	clksel = REG_GET(DSI_PLL_CONFIGURATION2, 11, 11);
+
+	seq_printf(s,	"- DSI PLL -\n");
+
+	seq_printf(s,	"dsi pll source = %s\n",
+			clksel == 0 ?
+			"dss2_alwon_fclk" : "pclkfree");
+
+	seq_printf(s,	"Fint\t\t%-16luregn %u\n", cinfo->fint, cinfo->regn);
+
+	seq_printf(s,	"CLKIN4DDR\t%-16luregm %u\n",
+			cinfo->clkin4ddr, cinfo->regm);
+
+	seq_printf(s,	"dsi1_pll_fck\t%-16luregm3 %u\t(%s)\n",
+			cinfo->dsi1_pll_fclk,
+			cinfo->regm3,
+			dss_get_dispc_clk_source() == 0 ? "off" : "on");
+
+	seq_printf(s,	"dsi2_pll_fck\t%-16luregm4 %u\t(%s)\n",
+			cinfo->dsi2_pll_fclk,
+			cinfo->regm4,
+			dss_get_dsi_clk_source() == 0 ? "off" : "on");
+
+	seq_printf(s,	"- DSI -\n");
+
+	seq_printf(s,	"dsi fclk source = %s\n",
+			dss_get_dsi_clk_source() == 0 ?
+			"dss1_alwon_fclk" : "dsi2_pll_fclk");
+
+	seq_printf(s,	"DSI_FCLK\t%lu\n", dsi_fclk_rate());
+
+	seq_printf(s,	"DDR_CLK\t\t%lu\n",
+			cinfo->clkin4ddr / 4);
+
+	seq_printf(s,	"TxByteClkHS\t%lu\n", dsi_get_txbyteclkhs());
+
+	seq_printf(s,	"LP_CLK\t\t%lu\n", cinfo->lp_clk);
+
+	seq_printf(s,	"VP_CLK\t\t%lu\n"
+			"VP_PCLK\t\t%lu\n",
+			dispc_lclk_rate(),
+			dispc_pclk_rate());
+
+	enable_clocks(0);
+}
+
+#ifdef CONFIG_OMAP2_DSS_COLLECT_IRQ_STATS
+void dsi_dump_irqs(struct seq_file *s)
+{
+	unsigned long flags;
+	struct dsi_irq_stats stats;
+
+	spin_lock_irqsave(&dsi.irq_stats_lock, flags);
+
+	stats = dsi.irq_stats;
+	memset(&dsi.irq_stats, 0, sizeof(dsi.irq_stats));
+	dsi.irq_stats.last_reset = jiffies;
+
+	spin_unlock_irqrestore(&dsi.irq_stats_lock, flags);
+
+	seq_printf(s, "period %u ms\n",
+			jiffies_to_msecs(jiffies - stats.last_reset));
+
+	seq_printf(s, "irqs %d\n", stats.irq_count);
+#define PIS(x) \
+	seq_printf(s, "%-20s %10d\n", #x, stats.dsi_irqs[ffs(DSI_IRQ_##x)-1]);
+
+	seq_printf(s, "-- DSI interrupts --\n");
+	PIS(VC0);
+	PIS(VC1);
+	PIS(VC2);
+	PIS(VC3);
+	PIS(WAKEUP);
+	PIS(RESYNC);
+	PIS(PLL_LOCK);
+	PIS(PLL_UNLOCK);
+	PIS(PLL_RECALL);
+	PIS(COMPLEXIO_ERR);
+	PIS(HS_TX_TIMEOUT);
+	PIS(LP_RX_TIMEOUT);
+	PIS(TE_TRIGGER);
+	PIS(ACK_TRIGGER);
+	PIS(SYNC_LOST);
+	PIS(LDO_POWER_GOOD);
+	PIS(TA_TIMEOUT);
+#undef PIS
+
+#define PIS(x) \
+	seq_printf(s, "%-20s %10d %10d %10d %10d\n", #x, \
+			stats.vc_irqs[0][ffs(DSI_VC_IRQ_##x)-1], \
+			stats.vc_irqs[1][ffs(DSI_VC_IRQ_##x)-1], \
+			stats.vc_irqs[2][ffs(DSI_VC_IRQ_##x)-1], \
+			stats.vc_irqs[3][ffs(DSI_VC_IRQ_##x)-1]);
+
+	seq_printf(s, "-- VC interrupts --\n");
+	PIS(CS);
+	PIS(ECC_CORR);
+	PIS(PACKET_SENT);
+	PIS(FIFO_TX_OVF);
+	PIS(FIFO_RX_OVF);
+	PIS(BTA);
+	PIS(ECC_NO_CORR);
+	PIS(FIFO_TX_UDF);
+	PIS(PP_BUSY_CHANGE);
+#undef PIS
+
+#define PIS(x) \
+	seq_printf(s, "%-20s %10d\n", #x, \
+			stats.cio_irqs[ffs(DSI_CIO_IRQ_##x)-1]);
+
+	seq_printf(s, "-- CIO interrupts --\n");
+	PIS(ERRSYNCESC1);
+	PIS(ERRSYNCESC2);
+	PIS(ERRSYNCESC3);
+	PIS(ERRESC1);
+	PIS(ERRESC2);
+	PIS(ERRESC3);
+	PIS(ERRCONTROL1);
+	PIS(ERRCONTROL2);
+	PIS(ERRCONTROL3);
+	PIS(STATEULPS1);
+	PIS(STATEULPS2);
+	PIS(STATEULPS3);
+	PIS(ERRCONTENTIONLP0_1);
+	PIS(ERRCONTENTIONLP1_1);
+	PIS(ERRCONTENTIONLP0_2);
+	PIS(ERRCONTENTIONLP1_2);
+	PIS(ERRCONTENTIONLP0_3);
+	PIS(ERRCONTENTIONLP1_3);
+	PIS(ULPSACTIVENOT_ALL0);
+	PIS(ULPSACTIVENOT_ALL1);
+#undef PIS
+}
+#endif
+
+void dsi_dump_regs(struct seq_file *s)
+{
+#define DUMPREG(r) seq_printf(s, "%-35s %08x\n", #r, dsi_read_reg(r))
+
+	dss_clk_enable(DSS_CLK_ICK | DSS_CLK_FCK1);
+
+	DUMPREG(DSI_REVISION);
+	DUMPREG(DSI_SYSCONFIG);
+	DUMPREG(DSI_SYSSTATUS);
+	DUMPREG(DSI_IRQSTATUS);
+	DUMPREG(DSI_IRQENABLE);
+	DUMPREG(DSI_CTRL);
+	DUMPREG(DSI_COMPLEXIO_CFG1);
+	DUMPREG(DSI_COMPLEXIO_IRQ_STATUS);
+	DUMPREG(DSI_COMPLEXIO_IRQ_ENABLE);
+	DUMPREG(DSI_CLK_CTRL);
+	DUMPREG(DSI_TIMING1);
+	DUMPREG(DSI_TIMING2);
+	DUMPREG(DSI_VM_TIMING1);
+	DUMPREG(DSI_VM_TIMING2);
+	DUMPREG(DSI_VM_TIMING3);
+	DUMPREG(DSI_CLK_TIMING);
+	DUMPREG(DSI_TX_FIFO_VC_SIZE);
+	DUMPREG(DSI_RX_FIFO_VC_SIZE);
+	DUMPREG(DSI_COMPLEXIO_CFG2);
+	DUMPREG(DSI_RX_FIFO_VC_FULLNESS);
+	DUMPREG(DSI_VM_TIMING4);
+	DUMPREG(DSI_TX_FIFO_VC_EMPTINESS);
+	DUMPREG(DSI_VM_TIMING5);
+	DUMPREG(DSI_VM_TIMING6);
+	DUMPREG(DSI_VM_TIMING7);
+	DUMPREG(DSI_STOPCLK_TIMING);
+
+	DUMPREG(DSI_VC_CTRL(0));
+	DUMPREG(DSI_VC_TE(0));
+	DUMPREG(DSI_VC_LONG_PACKET_HEADER(0));
+	DUMPREG(DSI_VC_LONG_PACKET_PAYLOAD(0));
+	DUMPREG(DSI_VC_SHORT_PACKET_HEADER(0));
+	DUMPREG(DSI_VC_IRQSTATUS(0));
+	DUMPREG(DSI_VC_IRQENABLE(0));
+
+	DUMPREG(DSI_VC_CTRL(1));
+	DUMPREG(DSI_VC_TE(1));
+	DUMPREG(DSI_VC_LONG_PACKET_HEADER(1));
+	DUMPREG(DSI_VC_LONG_PACKET_PAYLOAD(1));
+	DUMPREG(DSI_VC_SHORT_PACKET_HEADER(1));
+	DUMPREG(DSI_VC_IRQSTATUS(1));
+	DUMPREG(DSI_VC_IRQENABLE(1));
+
+	DUMPREG(DSI_VC_CTRL(2));
+	DUMPREG(DSI_VC_TE(2));
+	DUMPREG(DSI_VC_LONG_PACKET_HEADER(2));
+	DUMPREG(DSI_VC_LONG_PACKET_PAYLOAD(2));
+	DUMPREG(DSI_VC_SHORT_PACKET_HEADER(2));
+	DUMPREG(DSI_VC_IRQSTATUS(2));
+	DUMPREG(DSI_VC_IRQENABLE(2));
+
+	DUMPREG(DSI_VC_CTRL(3));
+	DUMPREG(DSI_VC_TE(3));
+	DUMPREG(DSI_VC_LONG_PACKET_HEADER(3));
+	DUMPREG(DSI_VC_LONG_PACKET_PAYLOAD(3));
+	DUMPREG(DSI_VC_SHORT_PACKET_HEADER(3));
+	DUMPREG(DSI_VC_IRQSTATUS(3));
+	DUMPREG(DSI_VC_IRQENABLE(3));
+
+	DUMPREG(DSI_DSIPHY_CFG0);
+	DUMPREG(DSI_DSIPHY_CFG1);
+	DUMPREG(DSI_DSIPHY_CFG2);
+	DUMPREG(DSI_DSIPHY_CFG5);
+
+	DUMPREG(DSI_PLL_CONTROL);
+	DUMPREG(DSI_PLL_STATUS);
+	DUMPREG(DSI_PLL_GO);
+	DUMPREG(DSI_PLL_CONFIGURATION1);
+	DUMPREG(DSI_PLL_CONFIGURATION2);
+
+	dss_clk_disable(DSS_CLK_ICK | DSS_CLK_FCK1);
+#undef DUMPREG
+}
+
+enum dsi_complexio_power_state {
+	DSI_COMPLEXIO_POWER_OFF		= 0x0,
+	DSI_COMPLEXIO_POWER_ON		= 0x1,
+	DSI_COMPLEXIO_POWER_ULPS	= 0x2,
+};
+
+static int dsi_complexio_power(enum dsi_complexio_power_state state)
+{
+	int t = 0;
+
+	/* PWR_CMD */
+	REG_FLD_MOD(DSI_COMPLEXIO_CFG1, state, 28, 27);
+
+	/* PWR_STATUS */
+	while (FLD_GET(dsi_read_reg(DSI_COMPLEXIO_CFG1), 26, 25) != state) {
+		if (++t > 1000) {
+			DSSERR("failed to set complexio power state to "
+					"%d\n", state);
+			return -ENODEV;
+		}
+		udelay(1);
+	}
+
+	return 0;
+}
+
+static void dsi_complexio_config(struct omap_dss_device *dssdev)
+{
+	u32 r;
+
+	int clk_lane   = dssdev->phy.dsi.clk_lane;
+	int data1_lane = dssdev->phy.dsi.data1_lane;
+	int data2_lane = dssdev->phy.dsi.data2_lane;
+	int clk_pol    = dssdev->phy.dsi.clk_pol;
+	int data1_pol  = dssdev->phy.dsi.data1_pol;
+	int data2_pol  = dssdev->phy.dsi.data2_pol;
+
+	r = dsi_read_reg(DSI_COMPLEXIO_CFG1);
+	r = FLD_MOD(r, clk_lane, 2, 0);
+	r = FLD_MOD(r, clk_pol, 3, 3);
+	r = FLD_MOD(r, data1_lane, 6, 4);
+	r = FLD_MOD(r, data1_pol, 7, 7);
+	r = FLD_MOD(r, data2_lane, 10, 8);
+	r = FLD_MOD(r, data2_pol, 11, 11);
+	dsi_write_reg(DSI_COMPLEXIO_CFG1, r);
+
+	/* The configuration of the DSI complex I/O (number of data lanes,
+	   position, differential order) should not be changed while
+	   DSS.DSI_CLK_CRTRL[20] LP_CLK_ENABLE bit is set to 1. In order for
+	   the hardware to take into account a new configuration of the complex
+	   I/O (done in DSS.DSI_COMPLEXIO_CFG1 register), it is recommended to
+	   follow this sequence: First set the DSS.DSI_CTRL[0] IF_EN bit to 1,
+	   then reset the DSS.DSI_CTRL[0] IF_EN to 0, then set
+	   DSS.DSI_CLK_CTRL[20] LP_CLK_ENABLE to 1 and finally set again the
+	   DSS.DSI_CTRL[0] IF_EN bit to 1. If the sequence is not followed, the
+	   DSI complex I/O configuration is unknown. */
+
+	/*
+	REG_FLD_MOD(DSI_CTRL, 1, 0, 0);
+	REG_FLD_MOD(DSI_CTRL, 0, 0, 0);
+	REG_FLD_MOD(DSI_CLK_CTRL, 1, 20, 20);
+	REG_FLD_MOD(DSI_CTRL, 1, 0, 0);
+	*/
+}
+
+static inline unsigned ns2ddr(unsigned ns)
+{
+	/* convert time in ns to ddr ticks, rounding up */
+	unsigned long ddr_clk = dsi.current_cinfo.clkin4ddr / 4;
+	return (ns * (ddr_clk / 1000 / 1000) + 999) / 1000;
+}
+
+static inline unsigned ddr2ns(unsigned ddr)
+{
+	unsigned long ddr_clk = dsi.current_cinfo.clkin4ddr / 4;
+	return ddr * 1000 * 1000 / (ddr_clk / 1000);
+}
+
+static void dsi_complexio_timings(void)
+{
+	u32 r;
+	u32 ths_prepare, ths_prepare_ths_zero, ths_trail, ths_exit;
+	u32 tlpx_half, tclk_trail, tclk_zero;
+	u32 tclk_prepare;
+
+	/* calculate timings */
+
+	/* 1 * DDR_CLK = 2 * UI */
+
+	/* min 40ns + 4*UI	max 85ns + 6*UI */
+	ths_prepare = ns2ddr(70) + 2;
+
+	/* min 145ns + 10*UI */
+	ths_prepare_ths_zero = ns2ddr(175) + 2;
+
+	/* min max(8*UI, 60ns+4*UI) */
+	ths_trail = ns2ddr(60) + 5;
+
+	/* min 100ns */
+	ths_exit = ns2ddr(145);
+
+	/* tlpx min 50n */
+	tlpx_half = ns2ddr(25);
+
+	/* min 60ns */
+	tclk_trail = ns2ddr(60) + 2;
+
+	/* min 38ns, max 95ns */
+	tclk_prepare = ns2ddr(65);
+
+	/* min tclk-prepare + tclk-zero = 300ns */
+	tclk_zero = ns2ddr(260);
+
+	DSSDBG("ths_prepare %u (%uns), ths_prepare_ths_zero %u (%uns)\n",
+		ths_prepare, ddr2ns(ths_prepare),
+		ths_prepare_ths_zero, ddr2ns(ths_prepare_ths_zero));
+	DSSDBG("ths_trail %u (%uns), ths_exit %u (%uns)\n",
+			ths_trail, ddr2ns(ths_trail),
+			ths_exit, ddr2ns(ths_exit));
+
+	DSSDBG("tlpx_half %u (%uns), tclk_trail %u (%uns), "
+			"tclk_zero %u (%uns)\n",
+			tlpx_half, ddr2ns(tlpx_half),
+			tclk_trail, ddr2ns(tclk_trail),
+			tclk_zero, ddr2ns(tclk_zero));
+	DSSDBG("tclk_prepare %u (%uns)\n",
+			tclk_prepare, ddr2ns(tclk_prepare));
+
+	/* program timings */
+
+	r = dsi_read_reg(DSI_DSIPHY_CFG0);
+	r = FLD_MOD(r, ths_prepare, 31, 24);
+	r = FLD_MOD(r, ths_prepare_ths_zero, 23, 16);
+	r = FLD_MOD(r, ths_trail, 15, 8);
+	r = FLD_MOD(r, ths_exit, 7, 0);
+	dsi_write_reg(DSI_DSIPHY_CFG0, r);
+
+	r = dsi_read_reg(DSI_DSIPHY_CFG1);
+	r = FLD_MOD(r, tlpx_half, 22, 16);
+	r = FLD_MOD(r, tclk_trail, 15, 8);
+	r = FLD_MOD(r, tclk_zero, 7, 0);
+	dsi_write_reg(DSI_DSIPHY_CFG1, r);
+
+	r = dsi_read_reg(DSI_DSIPHY_CFG2);
+	r = FLD_MOD(r, tclk_prepare, 7, 0);
+	dsi_write_reg(DSI_DSIPHY_CFG2, r);
+}
+
+
+static int dsi_complexio_init(struct omap_dss_device *dssdev)
+{
+	int r = 0;
+
+	DSSDBG("dsi_complexio_init\n");
+
+	/* CIO_CLK_ICG, enable L3 clk to CIO */
+	REG_FLD_MOD(DSI_CLK_CTRL, 1, 14, 14);
+
+	/* A dummy read using the SCP interface to any DSIPHY register is
+	 * required after DSIPHY reset to complete the reset of the DSI complex
+	 * I/O. */
+	dsi_read_reg(DSI_DSIPHY_CFG5);
+
+	if (wait_for_bit_change(DSI_DSIPHY_CFG5, 30, 1) != 1) {
+		DSSERR("ComplexIO PHY not coming out of reset.\n");
+		r = -ENODEV;
+		goto err;
+	}
+
+	dsi_complexio_config(dssdev);
+
+	r = dsi_complexio_power(DSI_COMPLEXIO_POWER_ON);
+
+	if (r)
+		goto err;
+
+	if (wait_for_bit_change(DSI_COMPLEXIO_CFG1, 29, 1) != 1) {
+		DSSERR("ComplexIO not coming out of reset.\n");
+		r = -ENODEV;
+		goto err;
+	}
+
+	if (wait_for_bit_change(DSI_COMPLEXIO_CFG1, 21, 1) != 1) {
+		DSSERR("ComplexIO LDO power down.\n");
+		r = -ENODEV;
+		goto err;
+	}
+
+	dsi_complexio_timings();
+
+	/*
+	   The configuration of the DSI complex I/O (number of data lanes,
+	   position, differential order) should not be changed while
+	   DSS.DSI_CLK_CRTRL[20] LP_CLK_ENABLE bit is set to 1. For the
+	   hardware to recognize a new configuration of the complex I/O (done
+	   in DSS.DSI_COMPLEXIO_CFG1 register), it is recommended to follow
+	   this sequence: First set the DSS.DSI_CTRL[0] IF_EN bit to 1, next
+	   reset the DSS.DSI_CTRL[0] IF_EN to 0, then set DSS.DSI_CLK_CTRL[20]
+	   LP_CLK_ENABLE to 1, and finally, set again the DSS.DSI_CTRL[0] IF_EN
+	   bit to 1. If the sequence is not followed, the DSi complex I/O
+	   configuration is undetermined.
+	   */
+	dsi_if_enable(1);
+	dsi_if_enable(0);
+	REG_FLD_MOD(DSI_CLK_CTRL, 1, 20, 20); /* LP_CLK_ENABLE */
+	dsi_if_enable(1);
+	dsi_if_enable(0);
+
+	DSSDBG("CIO init done\n");
+err:
+	return r;
+}
+
+static void dsi_complexio_uninit(void)
+{
+	dsi_complexio_power(DSI_COMPLEXIO_POWER_OFF);
+}
+
+static int _dsi_wait_reset(void)
+{
+	int t = 0;
+
+	while (REG_GET(DSI_SYSSTATUS, 0, 0) == 0) {
+		if (++t > 5) {
+			DSSERR("soft reset failed\n");
+			return -ENODEV;
+		}
+		udelay(1);
+	}
+
+	return 0;
+}
+
+static int _dsi_reset(void)
+{
+	/* Soft reset */
+	REG_FLD_MOD(DSI_SYSCONFIG, 1, 1, 1);
+	return _dsi_wait_reset();
+}
+
+static void dsi_reset_tx_fifo(int channel)
+{
+	u32 mask;
+	u32 l;
+
+	/* set fifosize of the channel to 0, then return the old size */
+	l = dsi_read_reg(DSI_TX_FIFO_VC_SIZE);
+
+	mask = FLD_MASK((8 * channel) + 7, (8 * channel) + 4);
+	dsi_write_reg(DSI_TX_FIFO_VC_SIZE, l & ~mask);
+
+	dsi_write_reg(DSI_TX_FIFO_VC_SIZE, l);
+}
+
+static void dsi_config_tx_fifo(enum fifo_size size1, enum fifo_size size2,
+		enum fifo_size size3, enum fifo_size size4)
+{
+	u32 r = 0;
+	int add = 0;
+	int i;
+
+	dsi.vc[0].fifo_size = size1;
+	dsi.vc[1].fifo_size = size2;
+	dsi.vc[2].fifo_size = size3;
+	dsi.vc[3].fifo_size = size4;
+
+	for (i = 0; i < 4; i++) {
+		u8 v;
+		int size = dsi.vc[i].fifo_size;
+
+		if (add + size > 4) {
+			DSSERR("Illegal FIFO configuration\n");
+			BUG();
+		}
+
+		v = FLD_VAL(add, 2, 0) | FLD_VAL(size, 7, 4);
+		r |= v << (8 * i);
+		/*DSSDBG("TX FIFO vc %d: size %d, add %d\n", i, size, add); */
+		add += size;
+	}
+
+	dsi_write_reg(DSI_TX_FIFO_VC_SIZE, r);
+}
+
+static void dsi_config_rx_fifo(enum fifo_size size1, enum fifo_size size2,
+		enum fifo_size size3, enum fifo_size size4)
+{
+	u32 r = 0;
+	int add = 0;
+	int i;
+
+	dsi.vc[0].fifo_size = size1;
+	dsi.vc[1].fifo_size = size2;
+	dsi.vc[2].fifo_size = size3;
+	dsi.vc[3].fifo_size = size4;
+
+	for (i = 0; i < 4; i++) {
+		u8 v;
+		int size = dsi.vc[i].fifo_size;
+
+		if (add + size > 4) {
+			DSSERR("Illegal FIFO configuration\n");
+			BUG();
+		}
+
+		v = FLD_VAL(add, 2, 0) | FLD_VAL(size, 7, 4);
+		r |= v << (8 * i);
+		/*DSSDBG("RX FIFO vc %d: size %d, add %d\n", i, size, add); */
+		add += size;
+	}
+
+	dsi_write_reg(DSI_RX_FIFO_VC_SIZE, r);
+}
+
+static int dsi_force_tx_stop_mode_io(void)
+{
+	u32 r;
+
+	r = dsi_read_reg(DSI_TIMING1);
+	r = FLD_MOD(r, 1, 15, 15);	/* FORCE_TX_STOP_MODE_IO */
+	dsi_write_reg(DSI_TIMING1, r);
+
+	if (wait_for_bit_change(DSI_TIMING1, 15, 0) != 0) {
+		DSSERR("TX_STOP bit not going down\n");
+		return -EIO;
+	}
+
+	return 0;
+}
+
+static void dsi_vc_print_status(int channel)
+{
+	u32 r;
+
+	r = dsi_read_reg(DSI_VC_CTRL(channel));
+	DSSDBG("vc %d: TX_FIFO_NOT_EMPTY %d, BTA_EN %d, VC_BUSY %d, "
+			"TX_FIFO_FULL %d, RX_FIFO_NOT_EMPTY %d, ",
+			channel,
+			FLD_GET(r, 5, 5),
+			FLD_GET(r, 6, 6),
+			FLD_GET(r, 15, 15),
+			FLD_GET(r, 16, 16),
+			FLD_GET(r, 20, 20));
+
+	r = dsi_read_reg(DSI_TX_FIFO_VC_EMPTINESS);
+	DSSDBG("EMPTINESS %d\n", (r >> (8 * channel)) & 0xff);
+}
+
+static int dsi_vc_enable(int channel, bool enable)
+{
+	if (dsi.update_mode != OMAP_DSS_UPDATE_AUTO)
+		DSSDBG("dsi_vc_enable channel %d, enable %d\n",
+				channel, enable);
+
+	enable = enable ? 1 : 0;
+
+	REG_FLD_MOD(DSI_VC_CTRL(channel), enable, 0, 0);
+
+	if (wait_for_bit_change(DSI_VC_CTRL(channel), 0, enable) != enable) {
+			DSSERR("Failed to set dsi_vc_enable to %d\n", enable);
+			return -EIO;
+	}
+
+	return 0;
+}
+
+static void dsi_vc_initial_config(int channel)
+{
+	u32 r;
+
+	DSSDBGF("%d", channel);
+
+	r = dsi_read_reg(DSI_VC_CTRL(channel));
+
+	if (FLD_GET(r, 15, 15)) /* VC_BUSY */
+		DSSERR("VC(%d) busy when trying to configure it!\n",
+				channel);
+
+	r = FLD_MOD(r, 0, 1, 1); /* SOURCE, 0 = L4 */
+	r = FLD_MOD(r, 0, 2, 2); /* BTA_SHORT_EN  */
+	r = FLD_MOD(r, 0, 3, 3); /* BTA_LONG_EN */
+	r = FLD_MOD(r, 0, 4, 4); /* MODE, 0 = command */
+	r = FLD_MOD(r, 1, 7, 7); /* CS_TX_EN */
+	r = FLD_MOD(r, 1, 8, 8); /* ECC_TX_EN */
+	r = FLD_MOD(r, 0, 9, 9); /* MODE_SPEED, high speed on/off */
+
+	r = FLD_MOD(r, 4, 29, 27); /* DMA_RX_REQ_NB = no dma */
+	r = FLD_MOD(r, 4, 23, 21); /* DMA_TX_REQ_NB = no dma */
+
+	dsi_write_reg(DSI_VC_CTRL(channel), r);
+
+	dsi.vc[channel].mode = DSI_VC_MODE_L4;
+}
+
+static void dsi_vc_config_l4(int channel)
+{
+	if (dsi.vc[channel].mode == DSI_VC_MODE_L4)
+		return;
+
+	DSSDBGF("%d", channel);
+
+	dsi_vc_enable(channel, 0);
+
+	if (REG_GET(DSI_VC_CTRL(channel), 15, 15)) /* VC_BUSY */
+		DSSERR("vc(%d) busy when trying to config for L4\n", channel);
+
+	REG_FLD_MOD(DSI_VC_CTRL(channel), 0, 1, 1); /* SOURCE, 0 = L4 */
+
+	dsi_vc_enable(channel, 1);
+
+	dsi.vc[channel].mode = DSI_VC_MODE_L4;
+}
+
+static void dsi_vc_config_vp(int channel)
+{
+	if (dsi.vc[channel].mode == DSI_VC_MODE_VP)
+		return;
+
+	DSSDBGF("%d", channel);
+
+	dsi_vc_enable(channel, 0);
+
+	if (REG_GET(DSI_VC_CTRL(channel), 15, 15)) /* VC_BUSY */
+		DSSERR("vc(%d) busy when trying to config for VP\n", channel);
+
+	REG_FLD_MOD(DSI_VC_CTRL(channel), 1, 1, 1); /* SOURCE, 1 = video port */
+
+	dsi_vc_enable(channel, 1);
+
+	dsi.vc[channel].mode = DSI_VC_MODE_VP;
+}
+
+
+static void dsi_vc_enable_hs(int channel, bool enable)
+{
+	DSSDBG("dsi_vc_enable_hs(%d, %d)\n", channel, enable);
+
+	dsi_vc_enable(channel, 0);
+	dsi_if_enable(0);
+
+	REG_FLD_MOD(DSI_VC_CTRL(channel), enable, 9, 9);
+
+	dsi_vc_enable(channel, 1);
+	dsi_if_enable(1);
+
+	dsi_force_tx_stop_mode_io();
+}
+
+static void dsi_vc_flush_long_data(int channel)
+{
+	while (REG_GET(DSI_VC_CTRL(channel), 20, 20)) {
+		u32 val;
+		val = dsi_read_reg(DSI_VC_SHORT_PACKET_HEADER(channel));
+		DSSDBG("\t\tb1 %#02x b2 %#02x b3 %#02x b4 %#02x\n",
+				(val >> 0) & 0xff,
+				(val >> 8) & 0xff,
+				(val >> 16) & 0xff,
+				(val >> 24) & 0xff);
+	}
+}
+
+static void dsi_show_rx_ack_with_err(u16 err)
+{
+	DSSERR("\tACK with ERROR (%#x):\n", err);
+	if (err & (1 << 0))
+		DSSERR("\t\tSoT Error\n");
+	if (err & (1 << 1))
+		DSSERR("\t\tSoT Sync Error\n");
+	if (err & (1 << 2))
+		DSSERR("\t\tEoT Sync Error\n");
+	if (err & (1 << 3))
+		DSSERR("\t\tEscape Mode Entry Command Error\n");
+	if (err & (1 << 4))
+		DSSERR("\t\tLP Transmit Sync Error\n");
+	if (err & (1 << 5))
+		DSSERR("\t\tHS Receive Timeout Error\n");
+	if (err & (1 << 6))
+		DSSERR("\t\tFalse Control Error\n");
+	if (err & (1 << 7))
+		DSSERR("\t\t(reserved7)\n");
+	if (err & (1 << 8))
+		DSSERR("\t\tECC Error, single-bit (corrected)\n");
+	if (err & (1 << 9))
+		DSSERR("\t\tECC Error, multi-bit (not corrected)\n");
+	if (err & (1 << 10))
+		DSSERR("\t\tChecksum Error\n");
+	if (err & (1 << 11))
+		DSSERR("\t\tData type not recognized\n");
+	if (err & (1 << 12))
+		DSSERR("\t\tInvalid VC ID\n");
+	if (err & (1 << 13))
+		DSSERR("\t\tInvalid Transmission Length\n");
+	if (err & (1 << 14))
+		DSSERR("\t\t(reserved14)\n");
+	if (err & (1 << 15))
+		DSSERR("\t\tDSI Protocol Violation\n");
+}
+
+static u16 dsi_vc_flush_receive_data(int channel)
+{
+	/* RX_FIFO_NOT_EMPTY */
+	while (REG_GET(DSI_VC_CTRL(channel), 20, 20)) {
+		u32 val;
+		u8 dt;
+		val = dsi_read_reg(DSI_VC_SHORT_PACKET_HEADER(channel));
+		DSSDBG("\trawval %#08x\n", val);
+		dt = FLD_GET(val, 5, 0);
+		if (dt == DSI_DT_RX_ACK_WITH_ERR) {
+			u16 err = FLD_GET(val, 23, 8);
+			dsi_show_rx_ack_with_err(err);
+		} else if (dt == DSI_DT_RX_SHORT_READ_1) {
+			DSSDBG("\tDCS short response, 1 byte: %#x\n",
+					FLD_GET(val, 23, 8));
+		} else if (dt == DSI_DT_RX_SHORT_READ_2) {
+			DSSDBG("\tDCS short response, 2 byte: %#x\n",
+					FLD_GET(val, 23, 8));
+		} else if (dt == DSI_DT_RX_DCS_LONG_READ) {
+			DSSDBG("\tDCS long response, len %d\n",
+					FLD_GET(val, 23, 8));
+			dsi_vc_flush_long_data(channel);
+		} else {
+			DSSERR("\tunknown datatype 0x%02x\n", dt);
+		}
+	}
+	return 0;
+}
+
+static int dsi_vc_send_bta(int channel)
+{
+	if (dsi.update_mode != OMAP_DSS_UPDATE_AUTO &&
+			(dsi.debug_write || dsi.debug_read))
+		DSSDBG("dsi_vc_send_bta %d\n", channel);
+
+	WARN_ON(!mutex_is_locked(&dsi.bus_lock));
+
+	if (REG_GET(DSI_VC_CTRL(channel), 20, 20)) {	/* RX_FIFO_NOT_EMPTY */
+		DSSERR("rx fifo not empty when sending BTA, dumping data:\n");
+		dsi_vc_flush_receive_data(channel);
+	}
+
+	REG_FLD_MOD(DSI_VC_CTRL(channel), 1, 6, 6); /* BTA_EN */
+
+	return 0;
+}
+
+int dsi_vc_send_bta_sync(int channel)
+{
+	int r = 0;
+	u32 err;
+
+	INIT_COMPLETION(dsi.bta_completion);
+
+	dsi_vc_enable_bta_irq(channel);
+
+	r = dsi_vc_send_bta(channel);
+	if (r)
+		goto err;
+
+	if (wait_for_completion_timeout(&dsi.bta_completion,
+				msecs_to_jiffies(500)) == 0) {
+		DSSERR("Failed to receive BTA\n");
+		r = -EIO;
+		goto err;
+	}
+
+	err = dsi_get_errors();
+	if (err) {
+		DSSERR("Error while sending BTA: %x\n", err);
+		r = -EIO;
+		goto err;
+	}
+err:
+	dsi_vc_disable_bta_irq(channel);
+
+	return r;
+}
+EXPORT_SYMBOL(dsi_vc_send_bta_sync);
+
+static inline void dsi_vc_write_long_header(int channel, u8 data_type,
+		u16 len, u8 ecc)
+{
+	u32 val;
+	u8 data_id;
+
+	WARN_ON(!mutex_is_locked(&dsi.bus_lock));
+
+	/*data_id = data_type | channel << 6; */
+	data_id = data_type | dsi.vc[channel].dest_per << 6;
+
+	val = FLD_VAL(data_id, 7, 0) | FLD_VAL(len, 23, 8) |
+		FLD_VAL(ecc, 31, 24);
+
+	dsi_write_reg(DSI_VC_LONG_PACKET_HEADER(channel), val);
+}
+
+static inline void dsi_vc_write_long_payload(int channel,
+		u8 b1, u8 b2, u8 b3, u8 b4)
+{
+	u32 val;
+
+	val = b4 << 24 | b3 << 16 | b2 << 8  | b1 << 0;
+
+/*	DSSDBG("\twriting %02x, %02x, %02x, %02x (%#010x)\n",
+			b1, b2, b3, b4, val); */
+
+	dsi_write_reg(DSI_VC_LONG_PACKET_PAYLOAD(channel), val);
+}
+
+static int dsi_vc_send_long(int channel, u8 data_type, u8 *data, u16 len,
+		u8 ecc)
+{
+	/*u32 val; */
+	int i;
+	u8 *p;
+	int r = 0;
+	u8 b1, b2, b3, b4;
+
+	if (dsi.debug_write)
+		DSSDBG("dsi_vc_send_long, %d bytes\n", len);
+
+	/* len + header */
+	if (dsi.vc[channel].fifo_size * 32 * 4 < len + 4) {
+		DSSERR("unable to send long packet: packet too long.\n");
+		return -EINVAL;
+	}
+
+	dsi_vc_config_l4(channel);
+
+	dsi_vc_write_long_header(channel, data_type, len, ecc);
+
+	/*dsi_vc_print_status(0); */
+
+	p = data;
+	for (i = 0; i < len >> 2; i++) {
+		if (dsi.debug_write)
+			DSSDBG("\tsending full packet %d\n", i);
+		/*dsi_vc_print_status(0); */
+
+		b1 = *p++;
+		b2 = *p++;
+		b3 = *p++;
+		b4 = *p++;
+
+		dsi_vc_write_long_payload(channel, b1, b2, b3, b4);
+	}
+
+	i = len % 4;
+	if (i) {
+		b1 = 0; b2 = 0; b3 = 0;
+
+		if (dsi.debug_write)
+			DSSDBG("\tsending remainder bytes %d\n", i);
+
+		switch (i) {
+		case 3:
+			b1 = *p++;
+			b2 = *p++;
+			b3 = *p++;
+			break;
+		case 2:
+			b1 = *p++;
+			b2 = *p++;
+			break;
+		case 1:
+			b1 = *p++;
+			break;
+		}
+
+		dsi_vc_write_long_payload(channel, b1, b2, b3, 0);
+	}
+
+	return r;
+}
+
+static int dsi_vc_send_short(int channel, u8 data_type, u16 data, u8 ecc)
+{
+	u32 r;
+	u8 data_id;
+
+	WARN_ON(!mutex_is_locked(&dsi.bus_lock));
+
+	if (dsi.debug_write)
+		DSSDBG("dsi_vc_send_short(ch%d, dt %#x, b1 %#x, b2 %#x)\n",
+				channel,
+				data_type, data & 0xff, (data >> 8) & 0xff);
+
+	dsi_vc_config_l4(channel);
+
+	if (FLD_GET(dsi_read_reg(DSI_VC_CTRL(channel)), 16, 16)) {
+		DSSERR("ERROR FIFO FULL, aborting transfer\n");
+		return -EINVAL;
+	}
+
+	data_id = data_type | dsi.vc[channel].dest_per << 6;
+
+	r = (data_id << 0) | (data << 8) | (ecc << 24);
+
+	dsi_write_reg(DSI_VC_SHORT_PACKET_HEADER(channel), r);
+
+	return 0;
+}
+
+int dsi_vc_send_null(int channel)
+{
+	u8 nullpkg[] = {0, 0, 0, 0};
+	return dsi_vc_send_long(channel, DSI_DT_NULL_PACKET, nullpkg, 4, 0);
+}
+EXPORT_SYMBOL(dsi_vc_send_null);
+
+int dsi_vc_dcs_write_nosync(int channel, u8 *data, int len)
+{
+	int r;
+
+	BUG_ON(len == 0);
+
+	if (len == 1) {
+		r = dsi_vc_send_short(channel, DSI_DT_DCS_SHORT_WRITE_0,
+				data[0], 0);
+	} else if (len == 2) {
+		r = dsi_vc_send_short(channel, DSI_DT_DCS_SHORT_WRITE_1,
+				data[0] | (data[1] << 8), 0);
+	} else {
+		/* 0x39 = DCS Long Write */
+		r = dsi_vc_send_long(channel, DSI_DT_DCS_LONG_WRITE,
+				data, len, 0);
+	}
+
+	return r;
+}
+EXPORT_SYMBOL(dsi_vc_dcs_write_nosync);
+
+int dsi_vc_dcs_write(int channel, u8 *data, int len)
+{
+	int r;
+
+	r = dsi_vc_dcs_write_nosync(channel, data, len);
+	if (r)
+		return r;
+
+	r = dsi_vc_send_bta_sync(channel);
+
+	return r;
+}
+EXPORT_SYMBOL(dsi_vc_dcs_write);
+
+int dsi_vc_dcs_read(int channel, u8 dcs_cmd, u8 *buf, int buflen)
+{
+	u32 val;
+	u8 dt;
+	int r;
+
+	if (dsi.debug_read)
+		DSSDBG("dsi_vc_dcs_read(ch%d, dcs_cmd %x)\n", channel, dcs_cmd);
+
+	r = dsi_vc_send_short(channel, DSI_DT_DCS_READ, dcs_cmd, 0);
+	if (r)
+		return r;
+
+	r = dsi_vc_send_bta_sync(channel);
+	if (r)
+		return r;
+
+	/* RX_FIFO_NOT_EMPTY */
+	if (REG_GET(DSI_VC_CTRL(channel), 20, 20) == 0) {
+		DSSERR("RX fifo empty when trying to read.\n");
+		return -EIO;
+	}
+
+	val = dsi_read_reg(DSI_VC_SHORT_PACKET_HEADER(channel));
+	if (dsi.debug_read)
+		DSSDBG("\theader: %08x\n", val);
+	dt = FLD_GET(val, 5, 0);
+	if (dt == DSI_DT_RX_ACK_WITH_ERR) {
+		u16 err = FLD_GET(val, 23, 8);
+		dsi_show_rx_ack_with_err(err);
+		return -EIO;
+
+	} else if (dt == DSI_DT_RX_SHORT_READ_1) {
+		u8 data = FLD_GET(val, 15, 8);
+		if (dsi.debug_read)
+			DSSDBG("\tDCS short response, 1 byte: %02x\n", data);
+
+		if (buflen < 1)
+			return -EIO;
+
+		buf[0] = data;
+
+		return 1;
+	} else if (dt == DSI_DT_RX_SHORT_READ_2) {
+		u16 data = FLD_GET(val, 23, 8);
+		if (dsi.debug_read)
+			DSSDBG("\tDCS short response, 2 byte: %04x\n", data);
+
+		if (buflen < 2)
+			return -EIO;
+
+		buf[0] = data & 0xff;
+		buf[1] = (data >> 8) & 0xff;
+
+		return 2;
+	} else if (dt == DSI_DT_RX_DCS_LONG_READ) {
+		int w;
+		int len = FLD_GET(val, 23, 8);
+		if (dsi.debug_read)
+			DSSDBG("\tDCS long response, len %d\n", len);
+
+		if (len > buflen)
+			return -EIO;
+
+		/* two byte checksum ends the packet, not included in len */
+		for (w = 0; w < len + 2;) {
+			int b;
+			val = dsi_read_reg(DSI_VC_SHORT_PACKET_HEADER(channel));
+			if (dsi.debug_read)
+				DSSDBG("\t\t%02x %02x %02x %02x\n",
+						(val >> 0) & 0xff,
+						(val >> 8) & 0xff,
+						(val >> 16) & 0xff,
+						(val >> 24) & 0xff);
+
+			for (b = 0; b < 4; ++b) {
+				if (w < len)
+					buf[w] = (val >> (b * 8)) & 0xff;
+				/* we discard the 2 byte checksum */
+				++w;
+			}
+		}
+
+		return len;
+
+	} else {
+		DSSERR("\tunknown datatype 0x%02x\n", dt);
+		return -EIO;
+	}
+}
+EXPORT_SYMBOL(dsi_vc_dcs_read);
+
+
+int dsi_vc_set_max_rx_packet_size(int channel, u16 len)
+{
+	int r;
+	r = dsi_vc_send_short(channel, DSI_DT_SET_MAX_RET_PKG_SIZE,
+			len, 0);
+
+	if (r)
+		return r;
+
+	r = dsi_vc_send_bta_sync(channel);
+
+	return r;
+}
+EXPORT_SYMBOL(dsi_vc_set_max_rx_packet_size);
+
+static void dsi_set_lp_rx_timeout(unsigned long ns)
+{
+	u32 r;
+	unsigned x4, x16;
+	unsigned long fck;
+	unsigned long ticks;
+
+	/* ticks in DSI_FCK */
+
+	fck = dsi_fclk_rate();
+	ticks = (fck / 1000 / 1000) * ns / 1000;
+	x4 = 0;
+	x16 = 0;
+
+	if (ticks > 0x1fff) {
+		ticks = (fck / 1000 / 1000) * ns / 1000 / 4;
+		x4 = 1;
+		x16 = 0;
+	}
+
+	if (ticks > 0x1fff) {
+		ticks = (fck / 1000 / 1000) * ns / 1000 / 16;
+		x4 = 0;
+		x16 = 1;
+	}
+
+	if (ticks > 0x1fff) {
+		ticks = (fck / 1000 / 1000) * ns / 1000 / (4 * 16);
+		x4 = 1;
+		x16 = 1;
+	}
+
+	if (ticks > 0x1fff) {
+		DSSWARN("LP_TX_TO over limit, setting it to max\n");
+		ticks = 0x1fff;
+		x4 = 1;
+		x16 = 1;
+	}
+
+	r = dsi_read_reg(DSI_TIMING2);
+	r = FLD_MOD(r, 1, 15, 15);	/* LP_RX_TO */
+	r = FLD_MOD(r, x16, 14, 14);	/* LP_RX_TO_X16 */
+	r = FLD_MOD(r, x4, 13, 13);	/* LP_RX_TO_X4 */
+	r = FLD_MOD(r, ticks, 12, 0);	/* LP_RX_COUNTER */
+	dsi_write_reg(DSI_TIMING2, r);
+
+	DSSDBG("LP_RX_TO %lu ns (%#lx ticks%s%s)\n",
+			(ticks * (x16 ? 16 : 1) * (x4 ? 4 : 1) * 1000) /
+			(fck / 1000 / 1000),
+			ticks, x4 ? " x4" : "", x16 ? " x16" : "");
+}
+
+static void dsi_set_ta_timeout(unsigned long ns)
+{
+	u32 r;
+	unsigned x8, x16;
+	unsigned long fck;
+	unsigned long ticks;
+
+	/* ticks in DSI_FCK */
+	fck = dsi_fclk_rate();
+	ticks = (fck / 1000 / 1000) * ns / 1000;
+	x8 = 0;
+	x16 = 0;
+
+	if (ticks > 0x1fff) {
+		ticks = (fck / 1000 / 1000) * ns / 1000 / 8;
+		x8 = 1;
+		x16 = 0;
+	}
+
+	if (ticks > 0x1fff) {
+		ticks = (fck / 1000 / 1000) * ns / 1000 / 16;
+		x8 = 0;
+		x16 = 1;
+	}
+
+	if (ticks > 0x1fff) {
+		ticks = (fck / 1000 / 1000) * ns / 1000 / (8 * 16);
+		x8 = 1;
+		x16 = 1;
+	}
+
+	if (ticks > 0x1fff) {
+		DSSWARN("TA_TO over limit, setting it to max\n");
+		ticks = 0x1fff;
+		x8 = 1;
+		x16 = 1;
+	}
+
+	r = dsi_read_reg(DSI_TIMING1);
+	r = FLD_MOD(r, 1, 31, 31);	/* TA_TO */
+	r = FLD_MOD(r, x16, 30, 30);	/* TA_TO_X16 */
+	r = FLD_MOD(r, x8, 29, 29);	/* TA_TO_X8 */
+	r = FLD_MOD(r, ticks, 28, 16);	/* TA_TO_COUNTER */
+	dsi_write_reg(DSI_TIMING1, r);
+
+	DSSDBG("TA_TO %lu ns (%#lx ticks%s%s)\n",
+			(ticks * (x16 ? 16 : 1) * (x8 ? 8 : 1) * 1000) /
+			(fck / 1000 / 1000),
+			ticks, x8 ? " x8" : "", x16 ? " x16" : "");
+}
+
+static void dsi_set_stop_state_counter(unsigned long ns)
+{
+	u32 r;
+	unsigned x4, x16;
+	unsigned long fck;
+	unsigned long ticks;
+
+	/* ticks in DSI_FCK */
+
+	fck = dsi_fclk_rate();
+	ticks = (fck / 1000 / 1000) * ns / 1000;
+	x4 = 0;
+	x16 = 0;
+
+	if (ticks > 0x1fff) {
+		ticks = (fck / 1000 / 1000) * ns / 1000 / 4;
+		x4 = 1;
+		x16 = 0;
+	}
+
+	if (ticks > 0x1fff) {
+		ticks = (fck / 1000 / 1000) * ns / 1000 / 16;
+		x4 = 0;
+		x16 = 1;
+	}
+
+	if (ticks > 0x1fff) {
+		ticks = (fck / 1000 / 1000) * ns / 1000 / (4 * 16);
+		x4 = 1;
+		x16 = 1;
+	}
+
+	if (ticks > 0x1fff) {
+		DSSWARN("STOP_STATE_COUNTER_IO over limit, "
+				"setting it to max\n");
+		ticks = 0x1fff;
+		x4 = 1;
+		x16 = 1;
+	}
+
+	r = dsi_read_reg(DSI_TIMING1);
+	r = FLD_MOD(r, 1, 15, 15);	/* FORCE_TX_STOP_MODE_IO */
+	r = FLD_MOD(r, x16, 14, 14);	/* STOP_STATE_X16_IO */
+	r = FLD_MOD(r, x4, 13, 13);	/* STOP_STATE_X4_IO */
+	r = FLD_MOD(r, ticks, 12, 0);	/* STOP_STATE_COUNTER_IO */
+	dsi_write_reg(DSI_TIMING1, r);
+
+	DSSDBG("STOP_STATE_COUNTER %lu ns (%#lx ticks%s%s)\n",
+			(ticks * (x16 ? 16 : 1) * (x4 ? 4 : 1) * 1000) /
+			(fck / 1000 / 1000),
+			ticks, x4 ? " x4" : "", x16 ? " x16" : "");
+}
+
+static void dsi_set_hs_tx_timeout(unsigned long ns)
+{
+	u32 r;
+	unsigned x4, x16;
+	unsigned long fck;
+	unsigned long ticks;
+
+	/* ticks in TxByteClkHS */
+
+	fck = dsi_get_txbyteclkhs();
+	ticks = (fck / 1000 / 1000) * ns / 1000;
+	x4 = 0;
+	x16 = 0;
+
+	if (ticks > 0x1fff) {
+		ticks = (fck / 1000 / 1000) * ns / 1000 / 4;
+		x4 = 1;
+		x16 = 0;
+	}
+
+	if (ticks > 0x1fff) {
+		ticks = (fck / 1000 / 1000) * ns / 1000 / 16;
+		x4 = 0;
+		x16 = 1;
+	}
+
+	if (ticks > 0x1fff) {
+		ticks = (fck / 1000 / 1000) * ns / 1000 / (4 * 16);
+		x4 = 1;
+		x16 = 1;
+	}
+
+	if (ticks > 0x1fff) {
+		DSSWARN("HS_TX_TO over limit, setting it to max\n");
+		ticks = 0x1fff;
+		x4 = 1;
+		x16 = 1;
+	}
+
+	r = dsi_read_reg(DSI_TIMING2);
+	r = FLD_MOD(r, 1, 31, 31);	/* HS_TX_TO */
+	r = FLD_MOD(r, x16, 30, 30);	/* HS_TX_TO_X16 */
+	r = FLD_MOD(r, x4, 29, 29);	/* HS_TX_TO_X8 (4 really) */
+	r = FLD_MOD(r, ticks, 28, 16);	/* HS_TX_TO_COUNTER */
+	dsi_write_reg(DSI_TIMING2, r);
+
+	DSSDBG("HS_TX_TO %lu ns (%#lx ticks%s%s)\n",
+			(ticks * (x16 ? 16 : 1) * (x4 ? 4 : 1) * 1000) /
+			(fck / 1000 / 1000),
+			ticks, x4 ? " x4" : "", x16 ? " x16" : "");
+}
+static int dsi_proto_config(struct omap_dss_device *dssdev)
+{
+	u32 r;
+	int buswidth = 0;
+
+	dsi_config_tx_fifo(DSI_FIFO_SIZE_128,
+			DSI_FIFO_SIZE_0,
+			DSI_FIFO_SIZE_0,
+			DSI_FIFO_SIZE_0);
+
+	dsi_config_rx_fifo(DSI_FIFO_SIZE_128,
+			DSI_FIFO_SIZE_0,
+			DSI_FIFO_SIZE_0,
+			DSI_FIFO_SIZE_0);
+
+	/* XXX what values for the timeouts? */
+	dsi_set_stop_state_counter(1000);
+	dsi_set_ta_timeout(6400000);
+	dsi_set_lp_rx_timeout(48000);
+	dsi_set_hs_tx_timeout(1000000);
+
+	switch (dssdev->ctrl.pixel_size) {
+	case 16:
+		buswidth = 0;
+		break;
+	case 18:
+		buswidth = 1;
+		break;
+	case 24:
+		buswidth = 2;
+		break;
+	default:
+		BUG();
+	}
+
+	r = dsi_read_reg(DSI_CTRL);
+	r = FLD_MOD(r, 1, 1, 1);	/* CS_RX_EN */
+	r = FLD_MOD(r, 1, 2, 2);	/* ECC_RX_EN */
+	r = FLD_MOD(r, 1, 3, 3);	/* TX_FIFO_ARBITRATION */
+	r = FLD_MOD(r, 1, 4, 4);	/* VP_CLK_RATIO, always 1, see errata*/
+	r = FLD_MOD(r, buswidth, 7, 6); /* VP_DATA_BUS_WIDTH */
+	r = FLD_MOD(r, 0, 8, 8);	/* VP_CLK_POL */
+	r = FLD_MOD(r, 2, 13, 12);	/* LINE_BUFFER, 2 lines */
+	r = FLD_MOD(r, 1, 14, 14);	/* TRIGGER_RESET_MODE */
+	r = FLD_MOD(r, 1, 19, 19);	/* EOT_ENABLE */
+	r = FLD_MOD(r, 1, 24, 24);	/* DCS_CMD_ENABLE */
+	r = FLD_MOD(r, 0, 25, 25);	/* DCS_CMD_CODE, 1=start, 0=continue */
+
+	dsi_write_reg(DSI_CTRL, r);
+
+	dsi_vc_initial_config(0);
+
+	/* set all vc targets to peripheral 0 */
+	dsi.vc[0].dest_per = 0;
+	dsi.vc[1].dest_per = 0;
+	dsi.vc[2].dest_per = 0;
+	dsi.vc[3].dest_per = 0;
+
+	return 0;
+}
+
+static void dsi_proto_timings(struct omap_dss_device *dssdev)
+{
+	unsigned tlpx, tclk_zero, tclk_prepare, tclk_trail;
+	unsigned tclk_pre, tclk_post;
+	unsigned ths_prepare, ths_prepare_ths_zero, ths_zero;
+	unsigned ths_trail, ths_exit;
+	unsigned ddr_clk_pre, ddr_clk_post;
+	unsigned enter_hs_mode_lat, exit_hs_mode_lat;
+	unsigned ths_eot;
+	u32 r;
+
+	r = dsi_read_reg(DSI_DSIPHY_CFG0);
+	ths_prepare = FLD_GET(r, 31, 24);
+	ths_prepare_ths_zero = FLD_GET(r, 23, 16);
+	ths_zero = ths_prepare_ths_zero - ths_prepare;
+	ths_trail = FLD_GET(r, 15, 8);
+	ths_exit = FLD_GET(r, 7, 0);
+
+	r = dsi_read_reg(DSI_DSIPHY_CFG1);
+	tlpx = FLD_GET(r, 22, 16) * 2;
+	tclk_trail = FLD_GET(r, 15, 8);
+	tclk_zero = FLD_GET(r, 7, 0);
+
+	r = dsi_read_reg(DSI_DSIPHY_CFG2);
+	tclk_prepare = FLD_GET(r, 7, 0);
+
+	/* min 8*UI */
+	tclk_pre = 20;
+	/* min 60ns + 52*UI */
+	tclk_post = ns2ddr(60) + 26;
+
+	/* ths_eot is 2 for 2 datalanes and 4 for 1 datalane */
+	if (dssdev->phy.dsi.data1_lane != 0 &&
+			dssdev->phy.dsi.data2_lane != 0)
+		ths_eot = 2;
+	else
+		ths_eot = 4;
+
+	ddr_clk_pre = DIV_ROUND_UP(tclk_pre + tlpx + tclk_zero + tclk_prepare,
+			4);
+	ddr_clk_post = DIV_ROUND_UP(tclk_post + ths_trail, 4) + ths_eot;
+
+	BUG_ON(ddr_clk_pre == 0 || ddr_clk_pre > 255);
+	BUG_ON(ddr_clk_post == 0 || ddr_clk_post > 255);
+
+	r = dsi_read_reg(DSI_CLK_TIMING);
+	r = FLD_MOD(r, ddr_clk_pre, 15, 8);
+	r = FLD_MOD(r, ddr_clk_post, 7, 0);
+	dsi_write_reg(DSI_CLK_TIMING, r);
+
+	DSSDBG("ddr_clk_pre %u, ddr_clk_post %u\n",
+			ddr_clk_pre,
+			ddr_clk_post);
+
+	enter_hs_mode_lat = 1 + DIV_ROUND_UP(tlpx, 4) +
+		DIV_ROUND_UP(ths_prepare, 4) +
+		DIV_ROUND_UP(ths_zero + 3, 4);
+
+	exit_hs_mode_lat = DIV_ROUND_UP(ths_trail + ths_exit, 4) + 1 + ths_eot;
+
+	r = FLD_VAL(enter_hs_mode_lat, 31, 16) |
+		FLD_VAL(exit_hs_mode_lat, 15, 0);
+	dsi_write_reg(DSI_VM_TIMING7, r);
+
+	DSSDBG("enter_hs_mode_lat %u, exit_hs_mode_lat %u\n",
+			enter_hs_mode_lat, exit_hs_mode_lat);
+}
+
+
+#define DSI_DECL_VARS \
+	int __dsi_cb = 0; u32 __dsi_cv = 0;
+
+#define DSI_FLUSH(ch) \
+	if (__dsi_cb > 0) { \
+		/*DSSDBG("sending long packet %#010x\n", __dsi_cv);*/ \
+		dsi_write_reg(DSI_VC_LONG_PACKET_PAYLOAD(ch), __dsi_cv); \
+		__dsi_cb = __dsi_cv = 0; \
+	}
+
+#define DSI_PUSH(ch, data) \
+	do { \
+		__dsi_cv |= (data) << (__dsi_cb * 8); \
+		/*DSSDBG("cv = %#010x, cb = %d\n", __dsi_cv, __dsi_cb);*/ \
+		if (++__dsi_cb > 3) \
+			DSI_FLUSH(ch); \
+	} while (0)
+
+static int dsi_update_screen_l4(struct omap_dss_device *dssdev,
+			int x, int y, int w, int h)
+{
+	/* Note: supports only 24bit colors in 32bit container */
+	int first = 1;
+	int fifo_stalls = 0;
+	int max_dsi_packet_size;
+	int max_data_per_packet;
+	int max_pixels_per_packet;
+	int pixels_left;
+	int bytespp = dssdev->ctrl.pixel_size / 8;
+	int scr_width;
+	u32 __iomem *data;
+	int start_offset;
+	int horiz_inc;
+	int current_x;
+	struct omap_overlay *ovl;
+
+	debug_irq = 0;
+
+	DSSDBG("dsi_update_screen_l4 (%d,%d %dx%d)\n",
+			x, y, w, h);
+
+	ovl = dssdev->manager->overlays[0];
+
+	if (ovl->info.color_mode != OMAP_DSS_COLOR_RGB24U)
+		return -EINVAL;
+
+	if (dssdev->ctrl.pixel_size != 24)
+		return -EINVAL;
+
+	scr_width = ovl->info.screen_width;
+	data = ovl->info.vaddr;
+
+	start_offset = scr_width * y + x;
+	horiz_inc = scr_width - w;
+	current_x = x;
+
+	/* We need header(4) + DCSCMD(1) + pixels(numpix*bytespp) bytes
+	 * in fifo */
+
+	/* When using CPU, max long packet size is TX buffer size */
+	max_dsi_packet_size = dsi.vc[0].fifo_size * 32 * 4;
+
+	/* we seem to get better perf if we divide the tx fifo to half,
+	   and while the other half is being sent, we fill the other half
+	   max_dsi_packet_size /= 2; */
+
+	max_data_per_packet = max_dsi_packet_size - 4 - 1;
+
+	max_pixels_per_packet = max_data_per_packet / bytespp;
+
+	DSSDBG("max_pixels_per_packet %d\n", max_pixels_per_packet);
+
+	pixels_left = w * h;
+
+	DSSDBG("total pixels %d\n", pixels_left);
+
+	data += start_offset;
+
+	while (pixels_left > 0) {
+		/* 0x2c = write_memory_start */
+		/* 0x3c = write_memory_continue */
+		u8 dcs_cmd = first ? 0x2c : 0x3c;
+		int pixels;
+		DSI_DECL_VARS;
+		first = 0;
+
+#if 1
+		/* using fifo not empty */
+		/* TX_FIFO_NOT_EMPTY */
+		while (FLD_GET(dsi_read_reg(DSI_VC_CTRL(0)), 5, 5)) {
+			fifo_stalls++;
+			if (fifo_stalls > 0xfffff) {
+				DSSERR("fifo stalls overflow, pixels left %d\n",
+						pixels_left);
+				dsi_if_enable(0);
+				return -EIO;
+			}
+			udelay(1);
+		}
+#elif 1
+		/* using fifo emptiness */
+		while ((REG_GET(DSI_TX_FIFO_VC_EMPTINESS, 7, 0)+1)*4 <
+				max_dsi_packet_size) {
+			fifo_stalls++;
+			if (fifo_stalls > 0xfffff) {
+				DSSERR("fifo stalls overflow, pixels left %d\n",
+					       pixels_left);
+				dsi_if_enable(0);
+				return -EIO;
+			}
+		}
+#else
+		while ((REG_GET(DSI_TX_FIFO_VC_EMPTINESS, 7, 0)+1)*4 == 0) {
+			fifo_stalls++;
+			if (fifo_stalls > 0xfffff) {
+				DSSERR("fifo stalls overflow, pixels left %d\n",
+					       pixels_left);
+				dsi_if_enable(0);
+				return -EIO;
+			}
+		}
+#endif
+		pixels = min(max_pixels_per_packet, pixels_left);
+
+		pixels_left -= pixels;
+
+		dsi_vc_write_long_header(0, DSI_DT_DCS_LONG_WRITE,
+				1 + pixels * bytespp, 0);
+
+		DSI_PUSH(0, dcs_cmd);
+
+		while (pixels-- > 0) {
+			u32 pix = __raw_readl(data++);
+
+			DSI_PUSH(0, (pix >> 16) & 0xff);
+			DSI_PUSH(0, (pix >> 8) & 0xff);
+			DSI_PUSH(0, (pix >> 0) & 0xff);
+
+			current_x++;
+			if (current_x == x+w) {
+				current_x = x;
+				data += horiz_inc;
+			}
+		}
+
+		DSI_FLUSH(0);
+	}
+
+	return 0;
+}
+
+static void dsi_update_screen_dispc(struct omap_dss_device *dssdev,
+		u16 x, u16 y, u16 w, u16 h)
+{
+	unsigned bytespp;
+	unsigned bytespl;
+	unsigned bytespf;
+	unsigned total_len;
+	unsigned packet_payload;
+	unsigned packet_len;
+	u32 l;
+	bool use_te_trigger;
+	const unsigned channel = 0;
+	/* line buffer is 1024 x 24bits */
+	/* XXX: for some reason using full buffer size causes considerable TX
+	 * slowdown with update sizes that fill the whole buffer */
+	const unsigned line_buf_size = 1023 * 3;
+
+	use_te_trigger = dsi.te_enabled && !dsi.use_ext_te;
+
+	if (dsi.update_mode != OMAP_DSS_UPDATE_AUTO)
+		DSSDBG("dsi_update_screen_dispc(%d,%d %dx%d)\n",
+				x, y, w, h);
+
+	bytespp	= dssdev->ctrl.pixel_size / 8;
+	bytespl = w * bytespp;
+	bytespf = bytespl * h;
+
+	/* NOTE: packet_payload has to be equal to N * bytespl, where N is
+	 * number of lines in a packet.  See errata about VP_CLK_RATIO */
+
+	if (bytespf < line_buf_size)
+		packet_payload = bytespf;
+	else
+		packet_payload = (line_buf_size) / bytespl * bytespl;
+
+	packet_len = packet_payload + 1;	/* 1 byte for DCS cmd */
+	total_len = (bytespf / packet_payload) * packet_len;
+
+	if (bytespf % packet_payload)
+		total_len += (bytespf % packet_payload) + 1;
+
+	if (0)
+		dsi_vc_print_status(1);
+
+	l = FLD_VAL(total_len, 23, 0); /* TE_SIZE */
+	dsi_write_reg(DSI_VC_TE(channel), l);
+
+	dsi_vc_write_long_header(channel, DSI_DT_DCS_LONG_WRITE, packet_len, 0);
+
+	if (use_te_trigger)
+		l = FLD_MOD(l, 1, 30, 30); /* TE_EN */
+	else
+		l = FLD_MOD(l, 1, 31, 31); /* TE_START */
+	dsi_write_reg(DSI_VC_TE(channel), l);
+
+	/* We put SIDLEMODE to no-idle for the duration of the transfer,
+	 * because DSS interrupts are not capable of waking up the CPU and the
+	 * framedone interrupt could be delayed for quite a long time. I think
+	 * the same goes for any DSS interrupts, but for some reason I have not
+	 * seen the problem anywhere else than here.
+	 */
+	dispc_disable_sidle();
+
+	dss_start_update(dssdev);
+
+	if (use_te_trigger) {
+		/* disable LP_RX_TO, so that we can receive TE.  Time to wait
+		 * for TE is longer than the timer allows */
+		REG_FLD_MOD(DSI_TIMING2, 0, 15, 15); /* LP_RX_TO */
+
+		dsi_vc_send_bta(channel);
+
+#ifdef DSI_CATCH_MISSING_TE
+		mod_timer(&dsi.te_timer, jiffies + msecs_to_jiffies(250));
+#endif
+	}
+}
+
+#ifdef DSI_CATCH_MISSING_TE
+static void dsi_te_timeout(unsigned long arg)
+{
+	DSSERR("TE not received for 250ms!\n");
+}
+#endif
+
+static void dsi_framedone_irq_callback(void *data, u32 mask)
+{
+	/* Note: We get FRAMEDONE when DISPC has finished sending pixels and
+	 * turns itself off. However, DSI still has the pixels in its buffers,
+	 * and is sending the data.
+	 */
+
+	/* SIDLEMODE back to smart-idle */
+	dispc_enable_sidle();
+
+	dsi.framedone_received = true;
+	wake_up(&dsi.waitqueue);
+}
+
+static void dsi_set_update_region(struct omap_dss_device *dssdev,
+		u16 x, u16 y, u16 w, u16 h)
+{
+	spin_lock(&dsi.update_lock);
+	if (dsi.update_region.dirty) {
+		dsi.update_region.x = min(x, dsi.update_region.x);
+		dsi.update_region.y = min(y, dsi.update_region.y);
+		dsi.update_region.w = max(w, dsi.update_region.w);
+		dsi.update_region.h = max(h, dsi.update_region.h);
+	} else {
+		dsi.update_region.x = x;
+		dsi.update_region.y = y;
+		dsi.update_region.w = w;
+		dsi.update_region.h = h;
+	}
+
+	dsi.update_region.device = dssdev;
+	dsi.update_region.dirty = true;
+
+	spin_unlock(&dsi.update_lock);
+
+}
+
+static int dsi_set_update_mode(struct omap_dss_device *dssdev,
+		enum omap_dss_update_mode mode)
+{
+	int r = 0;
+	int i;
+
+	WARN_ON(!mutex_is_locked(&dsi.bus_lock));
+
+	if (dsi.update_mode != mode) {
+		dsi.update_mode = mode;
+
+		/* Mark the overlays dirty, and do apply(), so that we get the
+		 * overlays configured properly after update mode change. */
+		for (i = 0; i < omap_dss_get_num_overlays(); ++i) {
+			struct omap_overlay *ovl;
+			ovl = omap_dss_get_overlay(i);
+			if (ovl->manager == dssdev->manager)
+				ovl->info_dirty = true;
+		}
+
+		r = dssdev->manager->apply(dssdev->manager);
+
+		if (dssdev->state == OMAP_DSS_DISPLAY_ACTIVE &&
+				mode == OMAP_DSS_UPDATE_AUTO) {
+			u16 w, h;
+
+			DSSDBG("starting auto update\n");
+
+			dssdev->get_resolution(dssdev, &w, &h);
+
+			dsi_set_update_region(dssdev, 0, 0, w, h);
+
+			dsi_perf_mark_start_auto();
+
+			wake_up(&dsi.waitqueue);
+		}
+	}
+
+	return r;
+}
+
+static int dsi_set_te(struct omap_dss_device *dssdev, bool enable)
+{
+	int r = 0;
+
+	if (dssdev->driver->enable_te) {
+		r = dssdev->driver->enable_te(dssdev, enable);
+		/* XXX for some reason, DSI TE breaks if we don't wait here.
+		 * Panel bug? Needs more studying */
+		msleep(100);
+	}
+
+	return r;
+}
+
+static void dsi_handle_framedone(void)
+{
+	int r;
+	const int channel = 0;
+	bool use_te_trigger;
+
+	use_te_trigger = dsi.te_enabled && !dsi.use_ext_te;
+
+	if (dsi.update_mode != OMAP_DSS_UPDATE_AUTO)
+		DSSDBG("FRAMEDONE\n");
+
+	if (use_te_trigger) {
+		/* enable LP_RX_TO again after the TE */
+		REG_FLD_MOD(DSI_TIMING2, 1, 15, 15); /* LP_RX_TO */
+	}
+
+	/* Send BTA after the frame. We need this for the TE to work, as TE
+	 * trigger is only sent for BTAs without preceding packet. Thus we need
+	 * to BTA after the pixel packets so that next BTA will cause TE
+	 * trigger.
+	 *
+	 * This is not needed when TE is not in use, but we do it anyway to
+	 * make sure that the transfer has been completed. It would be more
+	 * optimal, but more complex, to wait only just before starting next
+	 * transfer. */
+	r = dsi_vc_send_bta_sync(channel);
+	if (r)
+		DSSERR("BTA after framedone failed\n");
+
+	/* RX_FIFO_NOT_EMPTY */
+	if (REG_GET(DSI_VC_CTRL(channel), 20, 20)) {
+		DSSERR("Received error during frame transfer:\n");
+		dsi_vc_flush_receive_data(0);
+	}
+
+#ifdef CONFIG_OMAP2_DSS_FAKE_VSYNC
+	dispc_fake_vsync_irq();
+#endif
+}
+
+static int dsi_update_thread(void *data)
+{
+	unsigned long timeout;
+	struct omap_dss_device *device;
+	u16 x, y, w, h;
+
+	while (1) {
+		bool sched;
+
+		wait_event_interruptible(dsi.waitqueue,
+				dsi.update_mode == OMAP_DSS_UPDATE_AUTO ||
+				(dsi.update_mode == OMAP_DSS_UPDATE_MANUAL &&
+				 dsi.update_region.dirty == true) ||
+				kthread_should_stop());
+
+		if (kthread_should_stop())
+			break;
+
+		dsi_bus_lock();
+
+		if (dsi.update_mode == OMAP_DSS_UPDATE_DISABLED ||
+				kthread_should_stop()) {
+			dsi_bus_unlock();
+			break;
+		}
+
+		dsi_perf_mark_setup();
+
+		if (dsi.update_region.dirty) {
+			spin_lock(&dsi.update_lock);
+			dsi.active_update_region = dsi.update_region;
+			dsi.update_region.dirty = false;
+			spin_unlock(&dsi.update_lock);
+		}
+
+		device = dsi.active_update_region.device;
+		x = dsi.active_update_region.x;
+		y = dsi.active_update_region.y;
+		w = dsi.active_update_region.w;
+		h = dsi.active_update_region.h;
+
+		if (device->manager->caps & OMAP_DSS_OVL_MGR_CAP_DISPC) {
+
+			if (dsi.update_mode == OMAP_DSS_UPDATE_MANUAL)
+				dss_setup_partial_planes(device,
+						&x, &y, &w, &h);
+
+			dispc_set_lcd_size(w, h);
+		}
+
+		if (dsi.active_update_region.dirty) {
+			dsi.active_update_region.dirty = false;
+			/* XXX TODO we don't need to send the coords, if they
+			 * are the same that are already programmed to the
+			 * panel. That should speed up manual update a bit */
+			device->driver->setup_update(device, x, y, w, h);
+		}
+
+		dsi_perf_mark_start();
+
+		if (device->manager->caps & OMAP_DSS_OVL_MGR_CAP_DISPC) {
+			dsi_vc_config_vp(0);
+
+			if (dsi.te_enabled && dsi.use_ext_te)
+				device->driver->wait_for_te(device);
+
+			dsi.framedone_received = false;
+
+			dsi_update_screen_dispc(device, x, y, w, h);
+
+			/* wait for framedone */
+			timeout = msecs_to_jiffies(1000);
+			wait_event_timeout(dsi.waitqueue,
+					dsi.framedone_received == true,
+					timeout);
+
+			if (!dsi.framedone_received) {
+				DSSERR("framedone timeout\n");
+				DSSERR("failed update %d,%d %dx%d\n",
+						x, y, w, h);
+
+				dispc_enable_sidle();
+				dispc_enable_lcd_out(0);
+
+				dsi_reset_tx_fifo(0);
+			} else {
+				dsi_handle_framedone();
+				dsi_perf_show("DISPC");
+			}
+		} else {
+			dsi_update_screen_l4(device, x, y, w, h);
+			dsi_perf_show("L4");
+		}
+
+		sched = atomic_read(&dsi.bus_lock.count) < 0;
+
+		complete_all(&dsi.update_completion);
+
+		dsi_bus_unlock();
+
+		/* XXX We need to give others chance to get the bus lock. Is
+		 * there a better way for this? */
+		if (dsi.update_mode == OMAP_DSS_UPDATE_AUTO && sched)
+			schedule_timeout_interruptible(1);
+	}
+
+	DSSDBG("update thread exiting\n");
+
+	return 0;
+}
+
+
+
+/* Display funcs */
+
+static int dsi_display_init_dispc(struct omap_dss_device *dssdev)
+{
+	int r;
+
+	r = omap_dispc_register_isr(dsi_framedone_irq_callback, NULL,
+			DISPC_IRQ_FRAMEDONE);
+	if (r) {
+		DSSERR("can't get FRAMEDONE irq\n");
+		return r;
+	}
+
+	dispc_set_lcd_display_type(OMAP_DSS_LCD_DISPLAY_TFT);
+
+	dispc_set_parallel_interface_mode(OMAP_DSS_PARALLELMODE_DSI);
+	dispc_enable_fifohandcheck(1);
+
+	dispc_set_tft_data_lines(dssdev->ctrl.pixel_size);
+
+	{
+		struct omap_video_timings timings = {
+			.hsw		= 1,
+			.hfp		= 1,
+			.hbp		= 1,
+			.vsw		= 1,
+			.vfp		= 0,
+			.vbp		= 0,
+		};
+
+		dispc_set_lcd_timings(&timings);
+	}
+
+	return 0;
+}
+
+static void dsi_display_uninit_dispc(struct omap_dss_device *dssdev)
+{
+	omap_dispc_unregister_isr(dsi_framedone_irq_callback, NULL,
+			DISPC_IRQ_FRAMEDONE);
+}
+
+static int dsi_configure_dsi_clocks(struct omap_dss_device *dssdev)
+{
+	struct dsi_clock_info cinfo;
+	int r;
+
+	/* we always use DSS2_FCK as input clock */
+	cinfo.use_dss2_fck = true;
+	cinfo.regn  = dssdev->phy.dsi.div.regn;
+	cinfo.regm  = dssdev->phy.dsi.div.regm;
+	cinfo.regm3 = dssdev->phy.dsi.div.regm3;
+	cinfo.regm4 = dssdev->phy.dsi.div.regm4;
+	r = dsi_calc_clock_rates(&cinfo);
+	if (r)
+		return r;
+
+	r = dsi_pll_set_clock_div(&cinfo);
+	if (r) {
+		DSSERR("Failed to set dsi clocks\n");
+		return r;
+	}
+
+	return 0;
+}
+
+static int dsi_configure_dispc_clocks(struct omap_dss_device *dssdev)
+{
+	struct dispc_clock_info dispc_cinfo;
+	int r;
+	unsigned long long fck;
+
+	fck = dsi_get_dsi1_pll_rate();
+
+	dispc_cinfo.lck_div = dssdev->phy.dsi.div.lck_div;
+	dispc_cinfo.pck_div = dssdev->phy.dsi.div.pck_div;
+
+	r = dispc_calc_clock_rates(fck, &dispc_cinfo);
+	if (r) {
+		DSSERR("Failed to calc dispc clocks\n");
+		return r;
+	}
+
+	r = dispc_set_clock_div(&dispc_cinfo);
+	if (r) {
+		DSSERR("Failed to set dispc clocks\n");
+		return r;
+	}
+
+	return 0;
+}
+
+static int dsi_display_init_dsi(struct omap_dss_device *dssdev)
+{
+	int r;
+
+	_dsi_print_reset_status();
+
+	r = dsi_pll_init(dssdev, true, true);
+	if (r)
+		goto err0;
+
+	r = dsi_configure_dsi_clocks(dssdev);
+	if (r)
+		goto err1;
+
+	dss_select_clk_source(true, true);
+
+	DSSDBG("PLL OK\n");
+
+	r = dsi_configure_dispc_clocks(dssdev);
+	if (r)
+		goto err2;
+
+	r = dsi_complexio_init(dssdev);
+	if (r)
+		goto err2;
+
+	_dsi_print_reset_status();
+
+	dsi_proto_timings(dssdev);
+	dsi_set_lp_clk_divisor(dssdev);
+
+	if (1)
+		_dsi_print_reset_status();
+
+	r = dsi_proto_config(dssdev);
+	if (r)
+		goto err3;
+
+	/* enable interface */
+	dsi_vc_enable(0, 1);
+	dsi_if_enable(1);
+	dsi_force_tx_stop_mode_io();
+
+	if (dssdev->driver->enable) {
+		r = dssdev->driver->enable(dssdev);
+		if (r)
+			goto err4;
+	}
+
+	/* enable high-speed after initial config */
+	dsi_vc_enable_hs(0, 1);
+
+	return 0;
+err4:
+	dsi_if_enable(0);
+err3:
+	dsi_complexio_uninit();
+err2:
+	dss_select_clk_source(false, false);
+err1:
+	dsi_pll_uninit();
+err0:
+	return r;
+}
+
+static void dsi_display_uninit_dsi(struct omap_dss_device *dssdev)
+{
+	if (dssdev->driver->disable)
+		dssdev->driver->disable(dssdev);
+
+	dss_select_clk_source(false, false);
+	dsi_complexio_uninit();
+	dsi_pll_uninit();
+}
+
+static int dsi_core_init(void)
+{
+	/* Autoidle */
+	REG_FLD_MOD(DSI_SYSCONFIG, 1, 0, 0);
+
+	/* ENWAKEUP */
+	REG_FLD_MOD(DSI_SYSCONFIG, 1, 2, 2);
+
+	/* SIDLEMODE smart-idle */
+	REG_FLD_MOD(DSI_SYSCONFIG, 2, 4, 3);
+
+	_dsi_initialize_irq();
+
+	return 0;
+}
+
+static int dsi_display_enable(struct omap_dss_device *dssdev)
+{
+	int r = 0;
+
+	DSSDBG("dsi_display_enable\n");
+
+	mutex_lock(&dsi.lock);
+	dsi_bus_lock();
+
+	r = omap_dss_start_device(dssdev);
+	if (r) {
+		DSSERR("failed to start device\n");
+		goto err0;
+	}
+
+	if (dssdev->state != OMAP_DSS_DISPLAY_DISABLED) {
+		DSSERR("dssdev already enabled\n");
+		r = -EINVAL;
+		goto err1;
+	}
+
+	enable_clocks(1);
+	dsi_enable_pll_clock(1);
+
+	r = _dsi_reset();
+	if (r)
+		goto err2;
+
+	dsi_core_init();
+
+	r = dsi_display_init_dispc(dssdev);
+	if (r)
+		goto err2;
+
+	r = dsi_display_init_dsi(dssdev);
+	if (r)
+		goto err3;
+
+	dssdev->state = OMAP_DSS_DISPLAY_ACTIVE;
+
+	dsi.use_ext_te = dssdev->phy.dsi.ext_te;
+	r = dsi_set_te(dssdev, dsi.te_enabled);
+	if (r)
+		goto err4;
+
+	dsi_set_update_mode(dssdev, dsi.user_update_mode);
+
+	dsi_bus_unlock();
+	mutex_unlock(&dsi.lock);
+
+	return 0;
+
+err4:
+
+	dsi_display_uninit_dsi(dssdev);
+err3:
+	dsi_display_uninit_dispc(dssdev);
+err2:
+	enable_clocks(0);
+	dsi_enable_pll_clock(0);
+err1:
+	omap_dss_stop_device(dssdev);
+err0:
+	dsi_bus_unlock();
+	mutex_unlock(&dsi.lock);
+	DSSDBG("dsi_display_enable FAILED\n");
+	return r;
+}
+
+static void dsi_display_disable(struct omap_dss_device *dssdev)
+{
+	DSSDBG("dsi_display_disable\n");
+
+	mutex_lock(&dsi.lock);
+	dsi_bus_lock();
+
+	if (dssdev->state == OMAP_DSS_DISPLAY_DISABLED ||
+			dssdev->state == OMAP_DSS_DISPLAY_SUSPENDED)
+		goto end;
+
+	dsi.update_mode = OMAP_DSS_UPDATE_DISABLED;
+	dssdev->state = OMAP_DSS_DISPLAY_DISABLED;
+
+	dsi_display_uninit_dispc(dssdev);
+
+	dsi_display_uninit_dsi(dssdev);
+
+	enable_clocks(0);
+	dsi_enable_pll_clock(0);
+
+	omap_dss_stop_device(dssdev);
+end:
+	dsi_bus_unlock();
+	mutex_unlock(&dsi.lock);
+}
+
+static int dsi_display_suspend(struct omap_dss_device *dssdev)
+{
+	DSSDBG("dsi_display_suspend\n");
+
+	mutex_lock(&dsi.lock);
+	dsi_bus_lock();
+
+	if (dssdev->state == OMAP_DSS_DISPLAY_DISABLED ||
+			dssdev->state == OMAP_DSS_DISPLAY_SUSPENDED)
+		goto end;
+
+	dsi.update_mode = OMAP_DSS_UPDATE_DISABLED;
+	dssdev->state = OMAP_DSS_DISPLAY_SUSPENDED;
+
+	dsi_display_uninit_dispc(dssdev);
+
+	dsi_display_uninit_dsi(dssdev);
+
+	enable_clocks(0);
+	dsi_enable_pll_clock(0);
+end:
+	dsi_bus_unlock();
+	mutex_unlock(&dsi.lock);
+
+	return 0;
+}
+
+static int dsi_display_resume(struct omap_dss_device *dssdev)
+{
+	int r;
+
+	DSSDBG("dsi_display_resume\n");
+
+	mutex_lock(&dsi.lock);
+	dsi_bus_lock();
+
+	if (dssdev->state != OMAP_DSS_DISPLAY_SUSPENDED) {
+		DSSERR("dssdev not suspended\n");
+		r = -EINVAL;
+		goto err0;
+	}
+
+	enable_clocks(1);
+	dsi_enable_pll_clock(1);
+
+	r = _dsi_reset();
+	if (r)
+		goto err1;
+
+	dsi_core_init();
+
+	r = dsi_display_init_dispc(dssdev);
+	if (r)
+		goto err1;
+
+	r = dsi_display_init_dsi(dssdev);
+	if (r)
+		goto err2;
+
+	dssdev->state = OMAP_DSS_DISPLAY_ACTIVE;
+
+	r = dsi_set_te(dssdev, dsi.te_enabled);
+	if (r)
+		goto err2;
+
+	dsi_set_update_mode(dssdev, dsi.user_update_mode);
+
+	dsi_bus_unlock();
+	mutex_unlock(&dsi.lock);
+
+	return 0;
+
+err2:
+	dsi_display_uninit_dispc(dssdev);
+err1:
+	enable_clocks(0);
+	dsi_enable_pll_clock(0);
+err0:
+	dsi_bus_unlock();
+	mutex_unlock(&dsi.lock);
+	DSSDBG("dsi_display_resume FAILED\n");
+	return r;
+}
+
+static int dsi_display_update(struct omap_dss_device *dssdev,
+			u16 x, u16 y, u16 w, u16 h)
+{
+	int r = 0;
+	u16 dw, dh;
+
+	DSSDBG("dsi_display_update(%d,%d %dx%d)\n", x, y, w, h);
+
+	mutex_lock(&dsi.lock);
+
+	if (dsi.update_mode != OMAP_DSS_UPDATE_MANUAL)
+		goto end;
+
+	if (dssdev->state != OMAP_DSS_DISPLAY_ACTIVE)
+		goto end;
+
+	dssdev->get_resolution(dssdev, &dw, &dh);
+
+	if  (x > dw || y > dh)
+		goto end;
+
+	if (x + w > dw)
+		w = dw - x;
+
+	if (y + h > dh)
+		h = dh - y;
+
+	if (w == 0 || h == 0)
+		goto end;
+
+	if (w == 1) {
+		r = -EINVAL;
+		goto end;
+	}
+
+	dsi_set_update_region(dssdev, x, y, w, h);
+
+	wake_up(&dsi.waitqueue);
+
+end:
+	mutex_unlock(&dsi.lock);
+
+	return r;
+}
+
+static int dsi_display_sync(struct omap_dss_device *dssdev)
+{
+	bool wait;
+
+	DSSDBG("dsi_display_sync()\n");
+
+	mutex_lock(&dsi.lock);
+	dsi_bus_lock();
+
+	if (dsi.update_mode == OMAP_DSS_UPDATE_MANUAL &&
+			dsi.update_region.dirty) {
+		INIT_COMPLETION(dsi.update_completion);
+		wait = true;
+	} else {
+		wait = false;
+	}
+
+	dsi_bus_unlock();
+	mutex_unlock(&dsi.lock);
+
+	if (wait)
+		wait_for_completion_interruptible(&dsi.update_completion);
+
+	DSSDBG("dsi_display_sync() done\n");
+	return 0;
+}
+
+static int dsi_display_set_update_mode(struct omap_dss_device *dssdev,
+		enum omap_dss_update_mode mode)
+{
+	int r = 0;
+
+	DSSDBGF("%d", mode);
+
+	mutex_lock(&dsi.lock);
+	dsi_bus_lock();
+
+	dsi.user_update_mode = mode;
+	r = dsi_set_update_mode(dssdev, mode);
+
+	dsi_bus_unlock();
+	mutex_unlock(&dsi.lock);
+
+	return r;
+}
+
+static enum omap_dss_update_mode dsi_display_get_update_mode(
+		struct omap_dss_device *dssdev)
+{
+	return dsi.update_mode;
+}
+
+
+static int dsi_display_enable_te(struct omap_dss_device *dssdev, bool enable)
+{
+	int r = 0;
+
+	DSSDBGF("%d", enable);
+
+	if (!dssdev->driver->enable_te)
+		return -ENOENT;
+
+	dsi_bus_lock();
+
+	dsi.te_enabled = enable;
+
+	if (dssdev->state != OMAP_DSS_DISPLAY_ACTIVE)
+		goto end;
+
+	r = dsi_set_te(dssdev, enable);
+end:
+	dsi_bus_unlock();
+
+	return r;
+}
+
+static int dsi_display_get_te(struct omap_dss_device *dssdev)
+{
+	return dsi.te_enabled;
+}
+
+static int dsi_display_set_rotate(struct omap_dss_device *dssdev, u8 rotate)
+{
+
+	DSSDBGF("%d", rotate);
+
+	if (!dssdev->driver->set_rotate || !dssdev->driver->get_rotate)
+		return -EINVAL;
+
+	dsi_bus_lock();
+	dssdev->driver->set_rotate(dssdev, rotate);
+	if (dsi.update_mode == OMAP_DSS_UPDATE_AUTO) {
+		u16 w, h;
+		/* the display dimensions may have changed, so set a new
+		 * update region */
+		dssdev->get_resolution(dssdev, &w, &h);
+		dsi_set_update_region(dssdev, 0, 0, w, h);
+	}
+	dsi_bus_unlock();
+
+	return 0;
+}
+
+static u8 dsi_display_get_rotate(struct omap_dss_device *dssdev)
+{
+	if (!dssdev->driver->set_rotate || !dssdev->driver->get_rotate)
+		return 0;
+
+	return dssdev->driver->get_rotate(dssdev);
+}
+
+static int dsi_display_set_mirror(struct omap_dss_device *dssdev, bool mirror)
+{
+	DSSDBGF("%d", mirror);
+
+	if (!dssdev->driver->set_mirror || !dssdev->driver->get_mirror)
+		return -EINVAL;
+
+	dsi_bus_lock();
+	dssdev->driver->set_mirror(dssdev, mirror);
+	dsi_bus_unlock();
+
+	return 0;
+}
+
+static bool dsi_display_get_mirror(struct omap_dss_device *dssdev)
+{
+	if (!dssdev->driver->set_mirror || !dssdev->driver->get_mirror)
+		return 0;
+
+	return dssdev->driver->get_mirror(dssdev);
+}
+
+static int dsi_display_run_test(struct omap_dss_device *dssdev, int test_num)
+{
+	int r;
+
+	if (dssdev->state != OMAP_DSS_DISPLAY_ACTIVE)
+		return -EIO;
+
+	DSSDBGF("%d", test_num);
+
+	dsi_bus_lock();
+
+	/* run test first in low speed mode */
+	dsi_vc_enable_hs(0, 0);
+
+	if (dssdev->driver->run_test) {
+		r = dssdev->driver->run_test(dssdev, test_num);
+		if (r)
+			goto end;
+	}
+
+	/* then in high speed */
+	dsi_vc_enable_hs(0, 1);
+
+	if (dssdev->driver->run_test) {
+		r = dssdev->driver->run_test(dssdev, test_num);
+		if (r)
+			goto end;
+	}
+
+end:
+	dsi_vc_enable_hs(0, 1);
+
+	dsi_bus_unlock();
+
+	return r;
+}
+
+static int dsi_display_memory_read(struct omap_dss_device *dssdev,
+		void *buf, size_t size,
+		u16 x, u16 y, u16 w, u16 h)
+{
+	int r;
+
+	DSSDBGF("");
+
+	if (!dssdev->driver->memory_read)
+		return -EINVAL;
+
+	if (dssdev->state != OMAP_DSS_DISPLAY_ACTIVE)
+		return -EIO;
+
+	dsi_bus_lock();
+
+	r = dssdev->driver->memory_read(dssdev, buf, size,
+			x, y, w, h);
+
+	/* Memory read usually changes the update area. This will
+	 * force the next update to re-set the update area */
+	dsi.active_update_region.dirty = true;
+
+	dsi_bus_unlock();
+
+	return r;
+}
+
+void dsi_get_overlay_fifo_thresholds(enum omap_plane plane,
+		u32 fifo_size, enum omap_burst_size *burst_size,
+		u32 *fifo_low, u32 *fifo_high)
+{
+	unsigned burst_size_bytes;
+
+	*burst_size = OMAP_DSS_BURST_16x32;
+	burst_size_bytes = 16 * 32 / 8;
+
+	*fifo_high = fifo_size - burst_size_bytes;
+	*fifo_low = fifo_size - burst_size_bytes * 8;
+}
+
+int dsi_init_display(struct omap_dss_device *dssdev)
+{
+	DSSDBG("DSI init\n");
+
+	dssdev->enable = dsi_display_enable;
+	dssdev->disable = dsi_display_disable;
+	dssdev->suspend = dsi_display_suspend;
+	dssdev->resume = dsi_display_resume;
+	dssdev->update = dsi_display_update;
+	dssdev->sync = dsi_display_sync;
+	dssdev->set_update_mode = dsi_display_set_update_mode;
+	dssdev->get_update_mode = dsi_display_get_update_mode;
+	dssdev->enable_te = dsi_display_enable_te;
+	dssdev->get_te = dsi_display_get_te;
+
+	dssdev->get_rotate = dsi_display_get_rotate;
+	dssdev->set_rotate = dsi_display_set_rotate;
+
+	dssdev->get_mirror = dsi_display_get_mirror;
+	dssdev->set_mirror = dsi_display_set_mirror;
+
+	dssdev->run_test = dsi_display_run_test;
+	dssdev->memory_read = dsi_display_memory_read;
+
+	/* XXX these should be figured out dynamically */
+	dssdev->caps = OMAP_DSS_DISPLAY_CAP_MANUAL_UPDATE |
+		OMAP_DSS_DISPLAY_CAP_TEAR_ELIM;
+
+	dsi.vc[0].dssdev = dssdev;
+	dsi.vc[1].dssdev = dssdev;
+
+	return 0;
+}
+
+int dsi_init(struct platform_device *pdev)
+{
+	u32 rev;
+	int r;
+	struct sched_param param = {
+		.sched_priority = MAX_USER_RT_PRIO-1
+	};
+
+	spin_lock_init(&dsi.errors_lock);
+	dsi.errors = 0;
+
+#ifdef CONFIG_OMAP2_DSS_COLLECT_IRQ_STATS
+	spin_lock_init(&dsi.irq_stats_lock);
+	dsi.irq_stats.last_reset = jiffies;
+#endif
+
+	init_completion(&dsi.bta_completion);
+	init_completion(&dsi.update_completion);
+
+	dsi.thread = kthread_create(dsi_update_thread, NULL, "dsi");
+	if (IS_ERR(dsi.thread)) {
+		DSSERR("cannot create kthread\n");
+		r = PTR_ERR(dsi.thread);
+		goto err0;
+	}
+	sched_setscheduler(dsi.thread, SCHED_FIFO, &param);
+
+	init_waitqueue_head(&dsi.waitqueue);
+	spin_lock_init(&dsi.update_lock);
+
+	mutex_init(&dsi.lock);
+	mutex_init(&dsi.bus_lock);
+
+#ifdef DSI_CATCH_MISSING_TE
+	init_timer(&dsi.te_timer);
+	dsi.te_timer.function = dsi_te_timeout;
+	dsi.te_timer.data = 0;
+#endif
+
+	dsi.update_mode = OMAP_DSS_UPDATE_DISABLED;
+	dsi.user_update_mode = OMAP_DSS_UPDATE_DISABLED;
+
+	dsi.base = ioremap(DSI_BASE, DSI_SZ_REGS);
+	if (!dsi.base) {
+		DSSERR("can't ioremap DSI\n");
+		r = -ENOMEM;
+		goto err1;
+	}
+
+	dsi.vdds_dsi_reg = regulator_get(&pdev->dev, "vdds_dsi");
+	if (IS_ERR(dsi.vdds_dsi_reg)) {
+		iounmap(dsi.base);
+		DSSERR("can't get VDDS_DSI regulator\n");
+		r = PTR_ERR(dsi.vdds_dsi_reg);
+		goto err2;
+	}
+
+	enable_clocks(1);
+
+	rev = dsi_read_reg(DSI_REVISION);
+	printk(KERN_INFO "OMAP DSI rev %d.%d\n",
+	       FLD_GET(rev, 7, 4), FLD_GET(rev, 3, 0));
+
+	enable_clocks(0);
+
+	wake_up_process(dsi.thread);
+
+	return 0;
+err2:
+	iounmap(dsi.base);
+err1:
+	kthread_stop(dsi.thread);
+err0:
+	return r;
+}
+
+void dsi_exit(void)
+{
+	kthread_stop(dsi.thread);
+
+	regulator_put(dsi.vdds_dsi_reg);
+
+	iounmap(dsi.base);
+
+	DSSDBG("omap_dsi_exit\n");
+}
+
diff --git a/drivers/video/omap2/dss/dss.c b/drivers/video/omap2/dss/dss.c
new file mode 100644
index 000000000000..0a26b7d84d41
--- /dev/null
+++ b/drivers/video/omap2/dss/dss.c
@@ -0,0 +1,596 @@
+/*
+ * linux/drivers/video/omap2/dss/dss.c
+ *
+ * Copyright (C) 2009 Nokia Corporation
+ * Author: Tomi Valkeinen <tomi.valkeinen@nokia.com>
+ *
+ * Some code and ideas taken from drivers/video/omap/ driver
+ * by Imre Deak.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#define DSS_SUBSYS_NAME "DSS"
+
+#include <linux/kernel.h>
+#include <linux/io.h>
+#include <linux/err.h>
+#include <linux/delay.h>
+#include <linux/interrupt.h>
+#include <linux/seq_file.h>
+#include <linux/clk.h>
+
+#include <plat/display.h>
+#include "dss.h"
+
+#define DSS_BASE			0x48050000
+
+#define DSS_SZ_REGS			SZ_512
+
+struct dss_reg {
+	u16 idx;
+};
+
+#define DSS_REG(idx)			((const struct dss_reg) { idx })
+
+#define DSS_REVISION			DSS_REG(0x0000)
+#define DSS_SYSCONFIG			DSS_REG(0x0010)
+#define DSS_SYSSTATUS			DSS_REG(0x0014)
+#define DSS_IRQSTATUS			DSS_REG(0x0018)
+#define DSS_CONTROL			DSS_REG(0x0040)
+#define DSS_SDI_CONTROL			DSS_REG(0x0044)
+#define DSS_PLL_CONTROL			DSS_REG(0x0048)
+#define DSS_SDI_STATUS			DSS_REG(0x005C)
+
+#define REG_GET(idx, start, end) \
+	FLD_GET(dss_read_reg(idx), start, end)
+
+#define REG_FLD_MOD(idx, val, start, end) \
+	dss_write_reg(idx, FLD_MOD(dss_read_reg(idx), val, start, end))
+
+static struct {
+	void __iomem    *base;
+
+	struct clk	*dpll4_m4_ck;
+
+	unsigned long	cache_req_pck;
+	unsigned long	cache_prate;
+	struct dss_clock_info cache_dss_cinfo;
+	struct dispc_clock_info cache_dispc_cinfo;
+
+	u32		ctx[DSS_SZ_REGS / sizeof(u32)];
+} dss;
+
+static int _omap_dss_wait_reset(void);
+
+static inline void dss_write_reg(const struct dss_reg idx, u32 val)
+{
+	__raw_writel(val, dss.base + idx.idx);
+}
+
+static inline u32 dss_read_reg(const struct dss_reg idx)
+{
+	return __raw_readl(dss.base + idx.idx);
+}
+
+#define SR(reg) \
+	dss.ctx[(DSS_##reg).idx / sizeof(u32)] = dss_read_reg(DSS_##reg)
+#define RR(reg) \
+	dss_write_reg(DSS_##reg, dss.ctx[(DSS_##reg).idx / sizeof(u32)])
+
+void dss_save_context(void)
+{
+	if (cpu_is_omap24xx())
+		return;
+
+	SR(SYSCONFIG);
+	SR(CONTROL);
+
+#ifdef CONFIG_OMAP2_DSS_SDI
+	SR(SDI_CONTROL);
+	SR(PLL_CONTROL);
+#endif
+}
+
+void dss_restore_context(void)
+{
+	if (_omap_dss_wait_reset())
+		DSSERR("DSS not coming out of reset after sleep\n");
+
+	RR(SYSCONFIG);
+	RR(CONTROL);
+
+#ifdef CONFIG_OMAP2_DSS_SDI
+	RR(SDI_CONTROL);
+	RR(PLL_CONTROL);
+#endif
+}
+
+#undef SR
+#undef RR
+
+void dss_sdi_init(u8 datapairs)
+{
+	u32 l;
+
+	BUG_ON(datapairs > 3 || datapairs < 1);
+
+	l = dss_read_reg(DSS_SDI_CONTROL);
+	l = FLD_MOD(l, 0xf, 19, 15);		/* SDI_PDIV */
+	l = FLD_MOD(l, datapairs-1, 3, 2);	/* SDI_PRSEL */
+	l = FLD_MOD(l, 2, 1, 0);		/* SDI_BWSEL */
+	dss_write_reg(DSS_SDI_CONTROL, l);
+
+	l = dss_read_reg(DSS_PLL_CONTROL);
+	l = FLD_MOD(l, 0x7, 25, 22);	/* SDI_PLL_FREQSEL */
+	l = FLD_MOD(l, 0xb, 16, 11);	/* SDI_PLL_REGN */
+	l = FLD_MOD(l, 0xb4, 10, 1);	/* SDI_PLL_REGM */
+	dss_write_reg(DSS_PLL_CONTROL, l);
+}
+
+int dss_sdi_enable(void)
+{
+	unsigned long timeout;
+
+	dispc_pck_free_enable(1);
+
+	/* Reset SDI PLL */
+	REG_FLD_MOD(DSS_PLL_CONTROL, 1, 18, 18); /* SDI_PLL_SYSRESET */
+	udelay(1);	/* wait 2x PCLK */
+
+	/* Lock SDI PLL */
+	REG_FLD_MOD(DSS_PLL_CONTROL, 1, 28, 28); /* SDI_PLL_GOBIT */
+
+	/* Waiting for PLL lock request to complete */
+	timeout = jiffies + msecs_to_jiffies(500);
+	while (dss_read_reg(DSS_SDI_STATUS) & (1 << 6)) {
+		if (time_after_eq(jiffies, timeout)) {
+			DSSERR("PLL lock request timed out\n");
+			goto err1;
+		}
+	}
+
+	/* Clearing PLL_GO bit */
+	REG_FLD_MOD(DSS_PLL_CONTROL, 0, 28, 28);
+
+	/* Waiting for PLL to lock */
+	timeout = jiffies + msecs_to_jiffies(500);
+	while (!(dss_read_reg(DSS_SDI_STATUS) & (1 << 5))) {
+		if (time_after_eq(jiffies, timeout)) {
+			DSSERR("PLL lock timed out\n");
+			goto err1;
+		}
+	}
+
+	dispc_lcd_enable_signal(1);
+
+	/* Waiting for SDI reset to complete */
+	timeout = jiffies + msecs_to_jiffies(500);
+	while (!(dss_read_reg(DSS_SDI_STATUS) & (1 << 2))) {
+		if (time_after_eq(jiffies, timeout)) {
+			DSSERR("SDI reset timed out\n");
+			goto err2;
+		}
+	}
+
+	return 0;
+
+ err2:
+	dispc_lcd_enable_signal(0);
+ err1:
+	/* Reset SDI PLL */
+	REG_FLD_MOD(DSS_PLL_CONTROL, 0, 18, 18); /* SDI_PLL_SYSRESET */
+
+	dispc_pck_free_enable(0);
+
+	return -ETIMEDOUT;
+}
+
+void dss_sdi_disable(void)
+{
+	dispc_lcd_enable_signal(0);
+
+	dispc_pck_free_enable(0);
+
+	/* Reset SDI PLL */
+	REG_FLD_MOD(DSS_PLL_CONTROL, 0, 18, 18); /* SDI_PLL_SYSRESET */
+}
+
+void dss_dump_clocks(struct seq_file *s)
+{
+	unsigned long dpll4_ck_rate;
+	unsigned long dpll4_m4_ck_rate;
+
+	dss_clk_enable(DSS_CLK_ICK | DSS_CLK_FCK1);
+
+	dpll4_ck_rate = clk_get_rate(clk_get_parent(dss.dpll4_m4_ck));
+	dpll4_m4_ck_rate = clk_get_rate(dss.dpll4_m4_ck);
+
+	seq_printf(s, "- DSS -\n");
+
+	seq_printf(s, "dpll4_ck %lu\n", dpll4_ck_rate);
+
+	seq_printf(s, "dss1_alwon_fclk = %lu / %lu * 2 = %lu\n",
+			dpll4_ck_rate,
+			dpll4_ck_rate / dpll4_m4_ck_rate,
+			dss_clk_get_rate(DSS_CLK_FCK1));
+
+	dss_clk_disable(DSS_CLK_ICK | DSS_CLK_FCK1);
+}
+
+void dss_dump_regs(struct seq_file *s)
+{
+#define DUMPREG(r) seq_printf(s, "%-35s %08x\n", #r, dss_read_reg(r))
+
+	dss_clk_enable(DSS_CLK_ICK | DSS_CLK_FCK1);
+
+	DUMPREG(DSS_REVISION);
+	DUMPREG(DSS_SYSCONFIG);
+	DUMPREG(DSS_SYSSTATUS);
+	DUMPREG(DSS_IRQSTATUS);
+	DUMPREG(DSS_CONTROL);
+	DUMPREG(DSS_SDI_CONTROL);
+	DUMPREG(DSS_PLL_CONTROL);
+	DUMPREG(DSS_SDI_STATUS);
+
+	dss_clk_disable(DSS_CLK_ICK | DSS_CLK_FCK1);
+#undef DUMPREG
+}
+
+void dss_select_clk_source(bool dsi, bool dispc)
+{
+	u32 r;
+	r = dss_read_reg(DSS_CONTROL);
+	r = FLD_MOD(r, dsi, 1, 1);	/* DSI_CLK_SWITCH */
+	r = FLD_MOD(r, dispc, 0, 0);	/* DISPC_CLK_SWITCH */
+	dss_write_reg(DSS_CONTROL, r);
+}
+
+int dss_get_dsi_clk_source(void)
+{
+	return FLD_GET(dss_read_reg(DSS_CONTROL), 1, 1);
+}
+
+int dss_get_dispc_clk_source(void)
+{
+	return FLD_GET(dss_read_reg(DSS_CONTROL), 0, 0);
+}
+
+/* calculate clock rates using dividers in cinfo */
+int dss_calc_clock_rates(struct dss_clock_info *cinfo)
+{
+	unsigned long prate;
+
+	if (cinfo->fck_div > 16 || cinfo->fck_div == 0)
+		return -EINVAL;
+
+	prate = clk_get_rate(clk_get_parent(dss.dpll4_m4_ck));
+
+	cinfo->fck = prate / cinfo->fck_div;
+
+	return 0;
+}
+
+int dss_set_clock_div(struct dss_clock_info *cinfo)
+{
+	unsigned long prate;
+	int r;
+
+	if (cpu_is_omap34xx()) {
+		prate = clk_get_rate(clk_get_parent(dss.dpll4_m4_ck));
+		DSSDBG("dpll4_m4 = %ld\n", prate);
+
+		r = clk_set_rate(dss.dpll4_m4_ck, prate / cinfo->fck_div);
+		if (r)
+			return r;
+	}
+
+	DSSDBG("fck = %ld (%d)\n", cinfo->fck, cinfo->fck_div);
+
+	return 0;
+}
+
+int dss_get_clock_div(struct dss_clock_info *cinfo)
+{
+	cinfo->fck = dss_clk_get_rate(DSS_CLK_FCK1);
+
+	if (cpu_is_omap34xx()) {
+		unsigned long prate;
+		prate = clk_get_rate(clk_get_parent(dss.dpll4_m4_ck));
+		cinfo->fck_div = prate / (cinfo->fck / 2);
+	} else {
+		cinfo->fck_div = 0;
+	}
+
+	return 0;
+}
+
+unsigned long dss_get_dpll4_rate(void)
+{
+	if (cpu_is_omap34xx())
+		return clk_get_rate(clk_get_parent(dss.dpll4_m4_ck));
+	else
+		return 0;
+}
+
+int dss_calc_clock_div(bool is_tft, unsigned long req_pck,
+		struct dss_clock_info *dss_cinfo,
+		struct dispc_clock_info *dispc_cinfo)
+{
+	unsigned long prate;
+	struct dss_clock_info best_dss;
+	struct dispc_clock_info best_dispc;
+
+	unsigned long fck;
+
+	u16 fck_div;
+
+	int match = 0;
+	int min_fck_per_pck;
+
+	prate = dss_get_dpll4_rate();
+
+	fck = dss_clk_get_rate(DSS_CLK_FCK1);
+	if (req_pck == dss.cache_req_pck &&
+			((cpu_is_omap34xx() && prate == dss.cache_prate) ||
+			 dss.cache_dss_cinfo.fck == fck)) {
+		DSSDBG("dispc clock info found from cache.\n");
+		*dss_cinfo = dss.cache_dss_cinfo;
+		*dispc_cinfo = dss.cache_dispc_cinfo;
+		return 0;
+	}
+
+	min_fck_per_pck = CONFIG_OMAP2_DSS_MIN_FCK_PER_PCK;
+
+	if (min_fck_per_pck &&
+		req_pck * min_fck_per_pck > DISPC_MAX_FCK) {
+		DSSERR("Requested pixel clock not possible with the current "
+				"OMAP2_DSS_MIN_FCK_PER_PCK setting. Turning "
+				"the constraint off.\n");
+		min_fck_per_pck = 0;
+	}
+
+retry:
+	memset(&best_dss, 0, sizeof(best_dss));
+	memset(&best_dispc, 0, sizeof(best_dispc));
+
+	if (cpu_is_omap24xx()) {
+		struct dispc_clock_info cur_dispc;
+		/* XXX can we change the clock on omap2? */
+		fck = dss_clk_get_rate(DSS_CLK_FCK1);
+		fck_div = 1;
+
+		dispc_find_clk_divs(is_tft, req_pck, fck, &cur_dispc);
+		match = 1;
+
+		best_dss.fck = fck;
+		best_dss.fck_div = fck_div;
+
+		best_dispc = cur_dispc;
+
+		goto found;
+	} else if (cpu_is_omap34xx()) {
+		for (fck_div = 16; fck_div > 0; --fck_div) {
+			struct dispc_clock_info cur_dispc;
+
+			fck = prate / fck_div * 2;
+
+			if (fck > DISPC_MAX_FCK)
+				continue;
+
+			if (min_fck_per_pck &&
+					fck < req_pck * min_fck_per_pck)
+				continue;
+
+			match = 1;
+
+			dispc_find_clk_divs(is_tft, req_pck, fck, &cur_dispc);
+
+			if (abs(cur_dispc.pck - req_pck) <
+					abs(best_dispc.pck - req_pck)) {
+
+				best_dss.fck = fck;
+				best_dss.fck_div = fck_div;
+
+				best_dispc = cur_dispc;
+
+				if (cur_dispc.pck == req_pck)
+					goto found;
+			}
+		}
+	} else {
+		BUG();
+	}
+
+found:
+	if (!match) {
+		if (min_fck_per_pck) {
+			DSSERR("Could not find suitable clock settings.\n"
+					"Turning FCK/PCK constraint off and"
+					"trying again.\n");
+			min_fck_per_pck = 0;
+			goto retry;
+		}
+
+		DSSERR("Could not find suitable clock settings.\n");
+
+		return -EINVAL;
+	}
+
+	if (dss_cinfo)
+		*dss_cinfo = best_dss;
+	if (dispc_cinfo)
+		*dispc_cinfo = best_dispc;
+
+	dss.cache_req_pck = req_pck;
+	dss.cache_prate = prate;
+	dss.cache_dss_cinfo = best_dss;
+	dss.cache_dispc_cinfo = best_dispc;
+
+	return 0;
+}
+
+
+
+static irqreturn_t dss_irq_handler_omap2(int irq, void *arg)
+{
+	dispc_irq_handler();
+
+	return IRQ_HANDLED;
+}
+
+static irqreturn_t dss_irq_handler_omap3(int irq, void *arg)
+{
+	u32 irqstatus;
+
+	irqstatus = dss_read_reg(DSS_IRQSTATUS);
+
+	if (irqstatus & (1<<0))	/* DISPC_IRQ */
+		dispc_irq_handler();
+#ifdef CONFIG_OMAP2_DSS_DSI
+	if (irqstatus & (1<<1))	/* DSI_IRQ */
+		dsi_irq_handler();
+#endif
+
+	return IRQ_HANDLED;
+}
+
+static int _omap_dss_wait_reset(void)
+{
+	int t = 0;
+
+	while (REG_GET(DSS_SYSSTATUS, 0, 0) == 0) {
+		if (++t > 1000) {
+			DSSERR("soft reset failed\n");
+			return -ENODEV;
+		}
+		udelay(1);
+	}
+
+	return 0;
+}
+
+static int _omap_dss_reset(void)
+{
+	/* Soft reset */
+	REG_FLD_MOD(DSS_SYSCONFIG, 1, 1, 1);
+	return _omap_dss_wait_reset();
+}
+
+void dss_set_venc_output(enum omap_dss_venc_type type)
+{
+	int l = 0;
+
+	if (type == OMAP_DSS_VENC_TYPE_COMPOSITE)
+		l = 0;
+	else if (type == OMAP_DSS_VENC_TYPE_SVIDEO)
+		l = 1;
+	else
+		BUG();
+
+	/* venc out selection. 0 = comp, 1 = svideo */
+	REG_FLD_MOD(DSS_CONTROL, l, 6, 6);
+}
+
+void dss_set_dac_pwrdn_bgz(bool enable)
+{
+	REG_FLD_MOD(DSS_CONTROL, enable, 5, 5);	/* DAC Power-Down Control */
+}
+
+int dss_init(bool skip_init)
+{
+	int r;
+	u32 rev;
+
+	dss.base = ioremap(DSS_BASE, DSS_SZ_REGS);
+	if (!dss.base) {
+		DSSERR("can't ioremap DSS\n");
+		r = -ENOMEM;
+		goto fail0;
+	}
+
+	if (!skip_init) {
+		/* disable LCD and DIGIT output. This seems to fix the synclost
+		 * problem that we get, if the bootloader starts the DSS and
+		 * the kernel resets it */
+		omap_writel(omap_readl(0x48050440) & ~0x3, 0x48050440);
+
+		/* We need to wait here a bit, otherwise we sometimes start to
+		 * get synclost errors, and after that only power cycle will
+		 * restore DSS functionality. I have no idea why this happens.
+		 * And we have to wait _before_ resetting the DSS, but after
+		 * enabling clocks.
+		 */
+		msleep(50);
+
+		_omap_dss_reset();
+	}
+
+	/* autoidle */
+	REG_FLD_MOD(DSS_SYSCONFIG, 1, 0, 0);
+
+	/* Select DPLL */
+	REG_FLD_MOD(DSS_CONTROL, 0, 0, 0);
+
+#ifdef CONFIG_OMAP2_DSS_VENC
+	REG_FLD_MOD(DSS_CONTROL, 1, 4, 4);	/* venc dac demen */
+	REG_FLD_MOD(DSS_CONTROL, 1, 3, 3);	/* venc clock 4x enable */
+	REG_FLD_MOD(DSS_CONTROL, 0, 2, 2);	/* venc clock mode = normal */
+#endif
+
+	r = request_irq(INT_24XX_DSS_IRQ,
+			cpu_is_omap24xx()
+			? dss_irq_handler_omap2
+			: dss_irq_handler_omap3,
+			0, "OMAP DSS", NULL);
+
+	if (r < 0) {
+		DSSERR("omap2 dss: request_irq failed\n");
+		goto fail1;
+	}
+
+	if (cpu_is_omap34xx()) {
+		dss.dpll4_m4_ck = clk_get(NULL, "dpll4_m4_ck");
+		if (IS_ERR(dss.dpll4_m4_ck)) {
+			DSSERR("Failed to get dpll4_m4_ck\n");
+			r = PTR_ERR(dss.dpll4_m4_ck);
+			goto fail2;
+		}
+	}
+
+	dss_save_context();
+
+	rev = dss_read_reg(DSS_REVISION);
+	printk(KERN_INFO "OMAP DSS rev %d.%d\n",
+			FLD_GET(rev, 7, 4), FLD_GET(rev, 3, 0));
+
+	return 0;
+
+fail2:
+	free_irq(INT_24XX_DSS_IRQ, NULL);
+fail1:
+	iounmap(dss.base);
+fail0:
+	return r;
+}
+
+void dss_exit(void)
+{
+	if (cpu_is_omap34xx())
+		clk_put(dss.dpll4_m4_ck);
+
+	free_irq(INT_24XX_DSS_IRQ, NULL);
+
+	iounmap(dss.base);
+}
+
diff --git a/drivers/video/omap2/dss/dss.h b/drivers/video/omap2/dss/dss.h
new file mode 100644
index 000000000000..2bcb1245d6c2
--- /dev/null
+++ b/drivers/video/omap2/dss/dss.h
@@ -0,0 +1,384 @@
+/*
+ * linux/drivers/video/omap2/dss/dss.h
+ *
+ * Copyright (C) 2009 Nokia Corporation
+ * Author: Tomi Valkeinen <tomi.valkeinen@nokia.com>
+ *
+ * Some code and ideas taken from drivers/video/omap/ driver
+ * by Imre Deak.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef __OMAP2_DSS_H
+#define __OMAP2_DSS_H
+
+#ifdef CONFIG_OMAP2_DSS_DEBUG_SUPPORT
+#define DEBUG
+#endif
+
+#ifdef DEBUG
+extern unsigned int dss_debug;
+#ifdef DSS_SUBSYS_NAME
+#define DSSDBG(format, ...) \
+	if (dss_debug) \
+		printk(KERN_DEBUG "omapdss " DSS_SUBSYS_NAME ": " format, \
+		## __VA_ARGS__)
+#else
+#define DSSDBG(format, ...) \
+	if (dss_debug) \
+		printk(KERN_DEBUG "omapdss: " format, ## __VA_ARGS__)
+#endif
+
+#ifdef DSS_SUBSYS_NAME
+#define DSSDBGF(format, ...) \
+	if (dss_debug) \
+		printk(KERN_DEBUG "omapdss " DSS_SUBSYS_NAME \
+				": %s(" format ")\n", \
+				__func__, \
+				## __VA_ARGS__)
+#else
+#define DSSDBGF(format, ...) \
+	if (dss_debug) \
+		printk(KERN_DEBUG "omapdss: " \
+				": %s(" format ")\n", \
+				__func__, \
+				## __VA_ARGS__)
+#endif
+
+#else /* DEBUG */
+#define DSSDBG(format, ...)
+#define DSSDBGF(format, ...)
+#endif
+
+
+#ifdef DSS_SUBSYS_NAME
+#define DSSERR(format, ...) \
+	printk(KERN_ERR "omapdss " DSS_SUBSYS_NAME " error: " format, \
+	## __VA_ARGS__)
+#else
+#define DSSERR(format, ...) \
+	printk(KERN_ERR "omapdss error: " format, ## __VA_ARGS__)
+#endif
+
+#ifdef DSS_SUBSYS_NAME
+#define DSSINFO(format, ...) \
+	printk(KERN_INFO "omapdss " DSS_SUBSYS_NAME ": " format, \
+	## __VA_ARGS__)
+#else
+#define DSSINFO(format, ...) \
+	printk(KERN_INFO "omapdss: " format, ## __VA_ARGS__)
+#endif
+
+#ifdef DSS_SUBSYS_NAME
+#define DSSWARN(format, ...) \
+	printk(KERN_WARNING "omapdss " DSS_SUBSYS_NAME ": " format, \
+	## __VA_ARGS__)
+#else
+#define DSSWARN(format, ...) \
+	printk(KERN_WARNING "omapdss: " format, ## __VA_ARGS__)
+#endif
+
+/* OMAP TRM gives bitfields as start:end, where start is the higher bit
+   number. For example 7:0 */
+#define FLD_MASK(start, end)	(((1 << ((start) - (end) + 1)) - 1) << (end))
+#define FLD_VAL(val, start, end) (((val) << (end)) & FLD_MASK(start, end))
+#define FLD_GET(val, start, end) (((val) & FLD_MASK(start, end)) >> (end))
+#define FLD_MOD(orig, val, start, end) \
+	(((orig) & ~FLD_MASK(start, end)) | FLD_VAL(val, start, end))
+
+#define DISPC_MAX_FCK 173000000
+
+enum omap_burst_size {
+	OMAP_DSS_BURST_4x32 = 0,
+	OMAP_DSS_BURST_8x32 = 1,
+	OMAP_DSS_BURST_16x32 = 2,
+};
+
+enum omap_parallel_interface_mode {
+	OMAP_DSS_PARALLELMODE_BYPASS,		/* MIPI DPI */
+	OMAP_DSS_PARALLELMODE_RFBI,		/* MIPI DBI */
+	OMAP_DSS_PARALLELMODE_DSI,
+};
+
+enum dss_clock {
+	DSS_CLK_ICK	= 1 << 0,
+	DSS_CLK_FCK1	= 1 << 1,
+	DSS_CLK_FCK2	= 1 << 2,
+	DSS_CLK_54M	= 1 << 3,
+	DSS_CLK_96M	= 1 << 4,
+};
+
+struct dss_clock_info {
+	/* rates that we get with dividers below */
+	unsigned long fck;
+
+	/* dividers */
+	u16 fck_div;
+};
+
+struct dispc_clock_info {
+	/* rates that we get with dividers below */
+	unsigned long lck;
+	unsigned long pck;
+
+	/* dividers */
+	u16 lck_div;
+	u16 pck_div;
+};
+
+struct dsi_clock_info {
+	/* rates that we get with dividers below */
+	unsigned long fint;
+	unsigned long clkin4ddr;
+	unsigned long clkin;
+	unsigned long dsi1_pll_fclk;
+	unsigned long dsi2_pll_fclk;
+
+	unsigned long lp_clk;
+
+	/* dividers */
+	u16 regn;
+	u16 regm;
+	u16 regm3;
+	u16 regm4;
+
+	u16 lp_clk_div;
+
+	u8 highfreq;
+	bool use_dss2_fck;
+};
+
+struct seq_file;
+struct platform_device;
+
+/* core */
+void dss_clk_enable(enum dss_clock clks);
+void dss_clk_disable(enum dss_clock clks);
+unsigned long dss_clk_get_rate(enum dss_clock clk);
+int dss_need_ctx_restore(void);
+void dss_dump_clocks(struct seq_file *s);
+struct bus_type *dss_get_bus(void);
+
+/* display */
+int dss_suspend_all_devices(void);
+int dss_resume_all_devices(void);
+void dss_disable_all_devices(void);
+
+void dss_init_device(struct platform_device *pdev,
+		struct omap_dss_device *dssdev);
+void dss_uninit_device(struct platform_device *pdev,
+		struct omap_dss_device *dssdev);
+bool dss_use_replication(struct omap_dss_device *dssdev,
+		enum omap_color_mode mode);
+void default_get_overlay_fifo_thresholds(enum omap_plane plane,
+		u32 fifo_size, enum omap_burst_size *burst_size,
+		u32 *fifo_low, u32 *fifo_high);
+
+/* manager */
+int dss_init_overlay_managers(struct platform_device *pdev);
+void dss_uninit_overlay_managers(struct platform_device *pdev);
+int dss_mgr_wait_for_go_ovl(struct omap_overlay *ovl);
+void dss_setup_partial_planes(struct omap_dss_device *dssdev,
+				u16 *x, u16 *y, u16 *w, u16 *h);
+void dss_start_update(struct omap_dss_device *dssdev);
+
+/* overlay */
+void dss_init_overlays(struct platform_device *pdev);
+void dss_uninit_overlays(struct platform_device *pdev);
+int dss_check_overlay(struct omap_overlay *ovl, struct omap_dss_device *dssdev);
+void dss_overlay_setup_dispc_manager(struct omap_overlay_manager *mgr);
+#ifdef L4_EXAMPLE
+void dss_overlay_setup_l4_manager(struct omap_overlay_manager *mgr);
+#endif
+void dss_recheck_connections(struct omap_dss_device *dssdev, bool force);
+
+/* DSS */
+int dss_init(bool skip_init);
+void dss_exit(void);
+
+void dss_save_context(void);
+void dss_restore_context(void);
+
+void dss_dump_regs(struct seq_file *s);
+
+void dss_sdi_init(u8 datapairs);
+int dss_sdi_enable(void);
+void dss_sdi_disable(void);
+
+void dss_select_clk_source(bool dsi, bool dispc);
+int dss_get_dsi_clk_source(void);
+int dss_get_dispc_clk_source(void);
+void dss_set_venc_output(enum omap_dss_venc_type type);
+void dss_set_dac_pwrdn_bgz(bool enable);
+
+unsigned long dss_get_dpll4_rate(void);
+int dss_calc_clock_rates(struct dss_clock_info *cinfo);
+int dss_set_clock_div(struct dss_clock_info *cinfo);
+int dss_get_clock_div(struct dss_clock_info *cinfo);
+int dss_calc_clock_div(bool is_tft, unsigned long req_pck,
+		struct dss_clock_info *dss_cinfo,
+		struct dispc_clock_info *dispc_cinfo);
+
+/* SDI */
+int sdi_init(bool skip_init);
+void sdi_exit(void);
+int sdi_init_display(struct omap_dss_device *display);
+
+/* DSI */
+int dsi_init(struct platform_device *pdev);
+void dsi_exit(void);
+
+void dsi_dump_clocks(struct seq_file *s);
+void dsi_dump_irqs(struct seq_file *s);
+void dsi_dump_regs(struct seq_file *s);
+
+void dsi_save_context(void);
+void dsi_restore_context(void);
+
+int dsi_init_display(struct omap_dss_device *display);
+void dsi_irq_handler(void);
+unsigned long dsi_get_dsi1_pll_rate(void);
+int dsi_pll_set_clock_div(struct dsi_clock_info *cinfo);
+int dsi_pll_calc_clock_div_pck(bool is_tft, unsigned long req_pck,
+		struct dsi_clock_info *cinfo,
+		struct dispc_clock_info *dispc_cinfo);
+int dsi_pll_init(struct omap_dss_device *dssdev, bool enable_hsclk,
+		bool enable_hsdiv);
+void dsi_pll_uninit(void);
+void dsi_get_overlay_fifo_thresholds(enum omap_plane plane,
+		u32 fifo_size, enum omap_burst_size *burst_size,
+		u32 *fifo_low, u32 *fifo_high);
+
+/* DPI */
+int dpi_init(void);
+void dpi_exit(void);
+int dpi_init_display(struct omap_dss_device *dssdev);
+
+/* DISPC */
+int dispc_init(void);
+void dispc_exit(void);
+void dispc_dump_clocks(struct seq_file *s);
+void dispc_dump_irqs(struct seq_file *s);
+void dispc_dump_regs(struct seq_file *s);
+void dispc_irq_handler(void);
+void dispc_fake_vsync_irq(void);
+
+void dispc_save_context(void);
+void dispc_restore_context(void);
+
+void dispc_enable_sidle(void);
+void dispc_disable_sidle(void);
+
+void dispc_lcd_enable_signal_polarity(bool act_high);
+void dispc_lcd_enable_signal(bool enable);
+void dispc_pck_free_enable(bool enable);
+void dispc_enable_fifohandcheck(bool enable);
+
+void dispc_set_lcd_size(u16 width, u16 height);
+void dispc_set_digit_size(u16 width, u16 height);
+u32 dispc_get_plane_fifo_size(enum omap_plane plane);
+void dispc_setup_plane_fifo(enum omap_plane plane, u32 low, u32 high);
+void dispc_enable_fifomerge(bool enable);
+void dispc_set_burst_size(enum omap_plane plane,
+		enum omap_burst_size burst_size);
+
+void dispc_set_plane_ba0(enum omap_plane plane, u32 paddr);
+void dispc_set_plane_ba1(enum omap_plane plane, u32 paddr);
+void dispc_set_plane_pos(enum omap_plane plane, u16 x, u16 y);
+void dispc_set_plane_size(enum omap_plane plane, u16 width, u16 height);
+void dispc_set_channel_out(enum omap_plane plane,
+		enum omap_channel channel_out);
+
+int dispc_setup_plane(enum omap_plane plane,
+		      u32 paddr, u16 screen_width,
+		      u16 pos_x, u16 pos_y,
+		      u16 width, u16 height,
+		      u16 out_width, u16 out_height,
+		      enum omap_color_mode color_mode,
+		      bool ilace,
+		      enum omap_dss_rotation_type rotation_type,
+		      u8 rotation, bool mirror,
+		      u8 global_alpha);
+
+bool dispc_go_busy(enum omap_channel channel);
+void dispc_go(enum omap_channel channel);
+void dispc_enable_lcd_out(bool enable);
+void dispc_enable_digit_out(bool enable);
+int dispc_enable_plane(enum omap_plane plane, bool enable);
+void dispc_enable_replication(enum omap_plane plane, bool enable);
+
+void dispc_set_parallel_interface_mode(enum omap_parallel_interface_mode mode);
+void dispc_set_tft_data_lines(u8 data_lines);
+void dispc_set_lcd_display_type(enum omap_lcd_display_type type);
+void dispc_set_loadmode(enum omap_dss_load_mode mode);
+
+void dispc_set_default_color(enum omap_channel channel, u32 color);
+u32 dispc_get_default_color(enum omap_channel channel);
+void dispc_set_trans_key(enum omap_channel ch,
+		enum omap_dss_trans_key_type type,
+		u32 trans_key);
+void dispc_get_trans_key(enum omap_channel ch,
+		enum omap_dss_trans_key_type *type,
+		u32 *trans_key);
+void dispc_enable_trans_key(enum omap_channel ch, bool enable);
+void dispc_enable_alpha_blending(enum omap_channel ch, bool enable);
+bool dispc_trans_key_enabled(enum omap_channel ch);
+bool dispc_alpha_blending_enabled(enum omap_channel ch);
+
+bool dispc_lcd_timings_ok(struct omap_video_timings *timings);
+void dispc_set_lcd_timings(struct omap_video_timings *timings);
+unsigned long dispc_fclk_rate(void);
+unsigned long dispc_lclk_rate(void);
+unsigned long dispc_pclk_rate(void);
+void dispc_set_pol_freq(enum omap_panel_config config, u8 acbi, u8 acb);
+void dispc_find_clk_divs(bool is_tft, unsigned long req_pck, unsigned long fck,
+		struct dispc_clock_info *cinfo);
+int dispc_calc_clock_rates(unsigned long dispc_fclk_rate,
+		struct dispc_clock_info *cinfo);
+int dispc_set_clock_div(struct dispc_clock_info *cinfo);
+int dispc_get_clock_div(struct dispc_clock_info *cinfo);
+
+
+/* VENC */
+int venc_init(struct platform_device *pdev);
+void venc_exit(void);
+void venc_dump_regs(struct seq_file *s);
+int venc_init_display(struct omap_dss_device *display);
+
+/* RFBI */
+int rfbi_init(void);
+void rfbi_exit(void);
+void rfbi_dump_regs(struct seq_file *s);
+
+int rfbi_configure(int rfbi_module, int bpp, int lines);
+void rfbi_enable_rfbi(bool enable);
+void rfbi_transfer_area(u16 width, u16 height,
+			     void (callback)(void *data), void *data);
+void rfbi_set_timings(int rfbi_module, struct rfbi_timings *t);
+unsigned long rfbi_get_max_tx_rate(void);
+int rfbi_init_display(struct omap_dss_device *display);
+
+
+#ifdef CONFIG_OMAP2_DSS_COLLECT_IRQ_STATS
+static inline void dss_collect_irq_stats(u32 irqstatus, unsigned *irq_arr)
+{
+	int b;
+	for (b = 0; b < 32; ++b) {
+		if (irqstatus & (1 << b))
+			irq_arr[b]++;
+	}
+}
+#endif
+
+#endif
diff --git a/drivers/video/omap2/dss/manager.c b/drivers/video/omap2/dss/manager.c
new file mode 100644
index 000000000000..27d9c465c851
--- /dev/null
+++ b/drivers/video/omap2/dss/manager.c
@@ -0,0 +1,1487 @@
+/*
+ * linux/drivers/video/omap2/dss/manager.c
+ *
+ * Copyright (C) 2009 Nokia Corporation
+ * Author: Tomi Valkeinen <tomi.valkeinen@nokia.com>
+ *
+ * Some code and ideas taken from drivers/video/omap/ driver
+ * by Imre Deak.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#define DSS_SUBSYS_NAME "MANAGER"
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/spinlock.h>
+#include <linux/jiffies.h>
+
+#include <plat/display.h>
+#include <plat/cpu.h>
+
+#include "dss.h"
+
+static int num_managers;
+static struct list_head manager_list;
+
+static ssize_t manager_name_show(struct omap_overlay_manager *mgr, char *buf)
+{
+	return snprintf(buf, PAGE_SIZE, "%s\n", mgr->name);
+}
+
+static ssize_t manager_display_show(struct omap_overlay_manager *mgr, char *buf)
+{
+	return snprintf(buf, PAGE_SIZE, "%s\n",
+			mgr->device ? mgr->device->name : "<none>");
+}
+
+static ssize_t manager_display_store(struct omap_overlay_manager *mgr,
+		const char *buf, size_t size)
+{
+	int r = 0;
+	size_t len = size;
+	struct omap_dss_device *dssdev = NULL;
+
+	int match(struct omap_dss_device *dssdev, void *data)
+	{
+		const char *str = data;
+		return sysfs_streq(dssdev->name, str);
+	}
+
+	if (buf[size-1] == '\n')
+		--len;
+
+	if (len > 0)
+		dssdev = omap_dss_find_device((void *)buf, match);
+
+	if (len > 0 && dssdev == NULL)
+		return -EINVAL;
+
+	if (dssdev)
+		DSSDBG("display %s found\n", dssdev->name);
+
+	if (mgr->device) {
+		r = mgr->unset_device(mgr);
+		if (r) {
+			DSSERR("failed to unset display\n");
+			goto put_device;
+		}
+	}
+
+	if (dssdev) {
+		r = mgr->set_device(mgr, dssdev);
+		if (r) {
+			DSSERR("failed to set manager\n");
+			goto put_device;
+		}
+
+		r = mgr->apply(mgr);
+		if (r) {
+			DSSERR("failed to apply dispc config\n");
+			goto put_device;
+		}
+	}
+
+put_device:
+	if (dssdev)
+		omap_dss_put_device(dssdev);
+
+	return r ? r : size;
+}
+
+static ssize_t manager_default_color_show(struct omap_overlay_manager *mgr,
+					  char *buf)
+{
+	return snprintf(buf, PAGE_SIZE, "%d\n", mgr->info.default_color);
+}
+
+static ssize_t manager_default_color_store(struct omap_overlay_manager *mgr,
+					   const char *buf, size_t size)
+{
+	struct omap_overlay_manager_info info;
+	u32 color;
+	int r;
+
+	if (sscanf(buf, "%d", &color) != 1)
+		return -EINVAL;
+
+	mgr->get_manager_info(mgr, &info);
+
+	info.default_color = color;
+
+	r = mgr->set_manager_info(mgr, &info);
+	if (r)
+		return r;
+
+	r = mgr->apply(mgr);
+	if (r)
+		return r;
+
+	return size;
+}
+
+static const char *trans_key_type_str[] = {
+	"gfx-destination",
+	"video-source",
+};
+
+static ssize_t manager_trans_key_type_show(struct omap_overlay_manager *mgr,
+					   char *buf)
+{
+	enum omap_dss_trans_key_type key_type;
+
+	key_type = mgr->info.trans_key_type;
+	BUG_ON(key_type >= ARRAY_SIZE(trans_key_type_str));
+
+	return snprintf(buf, PAGE_SIZE, "%s\n", trans_key_type_str[key_type]);
+}
+
+static ssize_t manager_trans_key_type_store(struct omap_overlay_manager *mgr,
+					    const char *buf, size_t size)
+{
+	enum omap_dss_trans_key_type key_type;
+	struct omap_overlay_manager_info info;
+	int r;
+
+	for (key_type = OMAP_DSS_COLOR_KEY_GFX_DST;
+			key_type < ARRAY_SIZE(trans_key_type_str); key_type++) {
+		if (sysfs_streq(buf, trans_key_type_str[key_type]))
+			break;
+	}
+
+	if (key_type == ARRAY_SIZE(trans_key_type_str))
+		return -EINVAL;
+
+	mgr->get_manager_info(mgr, &info);
+
+	info.trans_key_type = key_type;
+
+	r = mgr->set_manager_info(mgr, &info);
+	if (r)
+		return r;
+
+	r = mgr->apply(mgr);
+	if (r)
+		return r;
+
+	return size;
+}
+
+static ssize_t manager_trans_key_value_show(struct omap_overlay_manager *mgr,
+					    char *buf)
+{
+	return snprintf(buf, PAGE_SIZE, "%d\n", mgr->info.trans_key);
+}
+
+static ssize_t manager_trans_key_value_store(struct omap_overlay_manager *mgr,
+					     const char *buf, size_t size)
+{
+	struct omap_overlay_manager_info info;
+	u32 key_value;
+	int r;
+
+	if (sscanf(buf, "%d", &key_value) != 1)
+		return -EINVAL;
+
+	mgr->get_manager_info(mgr, &info);
+
+	info.trans_key = key_value;
+
+	r = mgr->set_manager_info(mgr, &info);
+	if (r)
+		return r;
+
+	r = mgr->apply(mgr);
+	if (r)
+		return r;
+
+	return size;
+}
+
+static ssize_t manager_trans_key_enabled_show(struct omap_overlay_manager *mgr,
+					      char *buf)
+{
+	return snprintf(buf, PAGE_SIZE, "%d\n", mgr->info.trans_enabled);
+}
+
+static ssize_t manager_trans_key_enabled_store(struct omap_overlay_manager *mgr,
+					       const char *buf, size_t size)
+{
+	struct omap_overlay_manager_info info;
+	int enable;
+	int r;
+
+	if (sscanf(buf, "%d", &enable) != 1)
+		return -EINVAL;
+
+	mgr->get_manager_info(mgr, &info);
+
+	info.trans_enabled = enable ? true : false;
+
+	r = mgr->set_manager_info(mgr, &info);
+	if (r)
+		return r;
+
+	r = mgr->apply(mgr);
+	if (r)
+		return r;
+
+	return size;
+}
+
+static ssize_t manager_alpha_blending_enabled_show(
+		struct omap_overlay_manager *mgr, char *buf)
+{
+	return snprintf(buf, PAGE_SIZE, "%d\n", mgr->info.alpha_enabled);
+}
+
+static ssize_t manager_alpha_blending_enabled_store(
+		struct omap_overlay_manager *mgr,
+		const char *buf, size_t size)
+{
+	struct omap_overlay_manager_info info;
+	int enable;
+	int r;
+
+	if (sscanf(buf, "%d", &enable) != 1)
+		return -EINVAL;
+
+	mgr->get_manager_info(mgr, &info);
+
+	info.alpha_enabled = enable ? true : false;
+
+	r = mgr->set_manager_info(mgr, &info);
+	if (r)
+		return r;
+
+	r = mgr->apply(mgr);
+	if (r)
+		return r;
+
+	return size;
+}
+
+struct manager_attribute {
+	struct attribute attr;
+	ssize_t (*show)(struct omap_overlay_manager *, char *);
+	ssize_t	(*store)(struct omap_overlay_manager *, const char *, size_t);
+};
+
+#define MANAGER_ATTR(_name, _mode, _show, _store) \
+	struct manager_attribute manager_attr_##_name = \
+	__ATTR(_name, _mode, _show, _store)
+
+static MANAGER_ATTR(name, S_IRUGO, manager_name_show, NULL);
+static MANAGER_ATTR(display, S_IRUGO|S_IWUSR,
+		manager_display_show, manager_display_store);
+static MANAGER_ATTR(default_color, S_IRUGO|S_IWUSR,
+		manager_default_color_show, manager_default_color_store);
+static MANAGER_ATTR(trans_key_type, S_IRUGO|S_IWUSR,
+		manager_trans_key_type_show, manager_trans_key_type_store);
+static MANAGER_ATTR(trans_key_value, S_IRUGO|S_IWUSR,
+		manager_trans_key_value_show, manager_trans_key_value_store);
+static MANAGER_ATTR(trans_key_enabled, S_IRUGO|S_IWUSR,
+		manager_trans_key_enabled_show,
+		manager_trans_key_enabled_store);
+static MANAGER_ATTR(alpha_blending_enabled, S_IRUGO|S_IWUSR,
+		manager_alpha_blending_enabled_show,
+		manager_alpha_blending_enabled_store);
+
+
+static struct attribute *manager_sysfs_attrs[] = {
+	&manager_attr_name.attr,
+	&manager_attr_display.attr,
+	&manager_attr_default_color.attr,
+	&manager_attr_trans_key_type.attr,
+	&manager_attr_trans_key_value.attr,
+	&manager_attr_trans_key_enabled.attr,
+	&manager_attr_alpha_blending_enabled.attr,
+	NULL
+};
+
+static ssize_t manager_attr_show(struct kobject *kobj, struct attribute *attr,
+		char *buf)
+{
+	struct omap_overlay_manager *manager;
+	struct manager_attribute *manager_attr;
+
+	manager = container_of(kobj, struct omap_overlay_manager, kobj);
+	manager_attr = container_of(attr, struct manager_attribute, attr);
+
+	if (!manager_attr->show)
+		return -ENOENT;
+
+	return manager_attr->show(manager, buf);
+}
+
+static ssize_t manager_attr_store(struct kobject *kobj, struct attribute *attr,
+		const char *buf, size_t size)
+{
+	struct omap_overlay_manager *manager;
+	struct manager_attribute *manager_attr;
+
+	manager = container_of(kobj, struct omap_overlay_manager, kobj);
+	manager_attr = container_of(attr, struct manager_attribute, attr);
+
+	if (!manager_attr->store)
+		return -ENOENT;
+
+	return manager_attr->store(manager, buf, size);
+}
+
+static struct sysfs_ops manager_sysfs_ops = {
+	.show = manager_attr_show,
+	.store = manager_attr_store,
+};
+
+static struct kobj_type manager_ktype = {
+	.sysfs_ops = &manager_sysfs_ops,
+	.default_attrs = manager_sysfs_attrs,
+};
+
+/*
+ * We have 4 levels of cache for the dispc settings. First two are in SW and
+ * the latter two in HW.
+ *
+ * +--------------------+
+ * |overlay/manager_info|
+ * +--------------------+
+ *          v
+ *        apply()
+ *          v
+ * +--------------------+
+ * |     dss_cache      |
+ * +--------------------+
+ *          v
+ *      configure()
+ *          v
+ * +--------------------+
+ * |  shadow registers  |
+ * +--------------------+
+ *          v
+ * VFP or lcd/digit_enable
+ *          v
+ * +--------------------+
+ * |      registers     |
+ * +--------------------+
+ */
+
+struct overlay_cache_data {
+	/* If true, cache changed, but not written to shadow registers. Set
+	 * in apply(), cleared when registers written. */
+	bool dirty;
+	/* If true, shadow registers contain changed values not yet in real
+	 * registers. Set when writing to shadow registers, cleared at
+	 * VSYNC/EVSYNC */
+	bool shadow_dirty;
+
+	bool enabled;
+
+	u32 paddr;
+	void __iomem *vaddr;
+	u16 screen_width;
+	u16 width;
+	u16 height;
+	enum omap_color_mode color_mode;
+	u8 rotation;
+	enum omap_dss_rotation_type rotation_type;
+	bool mirror;
+
+	u16 pos_x;
+	u16 pos_y;
+	u16 out_width;	/* if 0, out_width == width */
+	u16 out_height;	/* if 0, out_height == height */
+	u8 global_alpha;
+
+	enum omap_channel channel;
+	bool replication;
+	bool ilace;
+
+	enum omap_burst_size burst_size;
+	u32 fifo_low;
+	u32 fifo_high;
+
+	bool manual_update;
+};
+
+struct manager_cache_data {
+	/* If true, cache changed, but not written to shadow registers. Set
+	 * in apply(), cleared when registers written. */
+	bool dirty;
+	/* If true, shadow registers contain changed values not yet in real
+	 * registers. Set when writing to shadow registers, cleared at
+	 * VSYNC/EVSYNC */
+	bool shadow_dirty;
+
+	u32 default_color;
+
+	enum omap_dss_trans_key_type trans_key_type;
+	u32 trans_key;
+	bool trans_enabled;
+
+	bool alpha_enabled;
+
+	bool manual_upd_display;
+	bool manual_update;
+	bool do_manual_update;
+
+	/* manual update region */
+	u16 x, y, w, h;
+};
+
+static struct {
+	spinlock_t lock;
+	struct overlay_cache_data overlay_cache[3];
+	struct manager_cache_data manager_cache[2];
+
+	bool irq_enabled;
+} dss_cache;
+
+
+
+static int omap_dss_set_device(struct omap_overlay_manager *mgr,
+		struct omap_dss_device *dssdev)
+{
+	int i;
+	int r;
+
+	if (dssdev->manager) {
+		DSSERR("display '%s' already has a manager '%s'\n",
+			       dssdev->name, dssdev->manager->name);
+		return -EINVAL;
+	}
+
+	if ((mgr->supported_displays & dssdev->type) == 0) {
+		DSSERR("display '%s' does not support manager '%s'\n",
+			       dssdev->name, mgr->name);
+		return -EINVAL;
+	}
+
+	for (i = 0; i < mgr->num_overlays; i++) {
+		struct omap_overlay *ovl = mgr->overlays[i];
+
+		if (ovl->manager != mgr || !ovl->info.enabled)
+			continue;
+
+		r = dss_check_overlay(ovl, dssdev);
+		if (r)
+			return r;
+	}
+
+	dssdev->manager = mgr;
+	mgr->device = dssdev;
+	mgr->device_changed = true;
+
+	return 0;
+}
+
+static int omap_dss_unset_device(struct omap_overlay_manager *mgr)
+{
+	if (!mgr->device) {
+		DSSERR("failed to unset display, display not set.\n");
+		return -EINVAL;
+	}
+
+	mgr->device->manager = NULL;
+	mgr->device = NULL;
+	mgr->device_changed = true;
+
+	return 0;
+}
+
+static int dss_mgr_wait_for_go(struct omap_overlay_manager *mgr)
+{
+	unsigned long timeout = msecs_to_jiffies(500);
+	struct manager_cache_data *mc;
+	enum omap_channel channel;
+	u32 irq;
+	int r;
+	int i;
+
+	if (!mgr->device)
+		return 0;
+
+	if (mgr->device->type == OMAP_DISPLAY_TYPE_VENC) {
+		irq = DISPC_IRQ_EVSYNC_ODD | DISPC_IRQ_EVSYNC_EVEN;
+		channel = OMAP_DSS_CHANNEL_DIGIT;
+	} else {
+		if (mgr->device->caps & OMAP_DSS_DISPLAY_CAP_MANUAL_UPDATE) {
+			enum omap_dss_update_mode mode;
+			mode = mgr->device->get_update_mode(mgr->device);
+			if (mode != OMAP_DSS_UPDATE_AUTO)
+				return 0;
+
+			irq = DISPC_IRQ_FRAMEDONE;
+		} else {
+			irq = DISPC_IRQ_VSYNC;
+		}
+		channel = OMAP_DSS_CHANNEL_LCD;
+	}
+
+	mc = &dss_cache.manager_cache[mgr->id];
+	i = 0;
+	while (1) {
+		unsigned long flags;
+		bool shadow_dirty, dirty;
+
+		spin_lock_irqsave(&dss_cache.lock, flags);
+		dirty = mc->dirty;
+		shadow_dirty = mc->shadow_dirty;
+		spin_unlock_irqrestore(&dss_cache.lock, flags);
+
+		if (!dirty && !shadow_dirty) {
+			r = 0;
+			break;
+		}
+
+		/* 4 iterations is the worst case:
+		 * 1 - initial iteration, dirty = true (between VFP and VSYNC)
+		 * 2 - first VSYNC, dirty = true
+		 * 3 - dirty = false, shadow_dirty = true
+		 * 4 - shadow_dirty = false */
+		if (i++ == 3) {
+			DSSERR("mgr(%d)->wait_for_go() not finishing\n",
+					mgr->id);
+			r = 0;
+			break;
+		}
+
+		r = omap_dispc_wait_for_irq_interruptible_timeout(irq, timeout);
+		if (r == -ERESTARTSYS)
+			break;
+
+		if (r) {
+			DSSERR("mgr(%d)->wait_for_go() timeout\n", mgr->id);
+			break;
+		}
+	}
+
+	return r;
+}
+
+int dss_mgr_wait_for_go_ovl(struct omap_overlay *ovl)
+{
+	unsigned long timeout = msecs_to_jiffies(500);
+	enum omap_channel channel;
+	struct overlay_cache_data *oc;
+	struct omap_dss_device *dssdev;
+	u32 irq;
+	int r;
+	int i;
+
+	if (!ovl->manager || !ovl->manager->device)
+		return 0;
+
+	dssdev = ovl->manager->device;
+
+	if (dssdev->type == OMAP_DISPLAY_TYPE_VENC) {
+		irq = DISPC_IRQ_EVSYNC_ODD | DISPC_IRQ_EVSYNC_EVEN;
+		channel = OMAP_DSS_CHANNEL_DIGIT;
+	} else {
+		if (dssdev->caps & OMAP_DSS_DISPLAY_CAP_MANUAL_UPDATE) {
+			enum omap_dss_update_mode mode;
+			mode = dssdev->get_update_mode(dssdev);
+			if (mode != OMAP_DSS_UPDATE_AUTO)
+				return 0;
+
+			irq = DISPC_IRQ_FRAMEDONE;
+		} else {
+			irq = DISPC_IRQ_VSYNC;
+		}
+		channel = OMAP_DSS_CHANNEL_LCD;
+	}
+
+	oc = &dss_cache.overlay_cache[ovl->id];
+	i = 0;
+	while (1) {
+		unsigned long flags;
+		bool shadow_dirty, dirty;
+
+		spin_lock_irqsave(&dss_cache.lock, flags);
+		dirty = oc->dirty;
+		shadow_dirty = oc->shadow_dirty;
+		spin_unlock_irqrestore(&dss_cache.lock, flags);
+
+		if (!dirty && !shadow_dirty) {
+			r = 0;
+			break;
+		}
+
+		/* 4 iterations is the worst case:
+		 * 1 - initial iteration, dirty = true (between VFP and VSYNC)
+		 * 2 - first VSYNC, dirty = true
+		 * 3 - dirty = false, shadow_dirty = true
+		 * 4 - shadow_dirty = false */
+		if (i++ == 3) {
+			DSSERR("ovl(%d)->wait_for_go() not finishing\n",
+					ovl->id);
+			r = 0;
+			break;
+		}
+
+		r = omap_dispc_wait_for_irq_interruptible_timeout(irq, timeout);
+		if (r == -ERESTARTSYS)
+			break;
+
+		if (r) {
+			DSSERR("ovl(%d)->wait_for_go() timeout\n", ovl->id);
+			break;
+		}
+	}
+
+	return r;
+}
+
+static int overlay_enabled(struct omap_overlay *ovl)
+{
+	return ovl->info.enabled && ovl->manager && ovl->manager->device;
+}
+
+/* Is rect1 a subset of rect2? */
+static bool rectangle_subset(int x1, int y1, int w1, int h1,
+		int x2, int y2, int w2, int h2)
+{
+	if (x1 < x2 || y1 < y2)
+		return false;
+
+	if (x1 + w1 > x2 + w2)
+		return false;
+
+	if (y1 + h1 > y2 + h2)
+		return false;
+
+	return true;
+}
+
+/* Do rect1 and rect2 overlap? */
+static bool rectangle_intersects(int x1, int y1, int w1, int h1,
+		int x2, int y2, int w2, int h2)
+{
+	if (x1 >= x2 + w2)
+		return false;
+
+	if (x2 >= x1 + w1)
+		return false;
+
+	if (y1 >= y2 + h2)
+		return false;
+
+	if (y2 >= y1 + h1)
+		return false;
+
+	return true;
+}
+
+static bool dispc_is_overlay_scaled(struct overlay_cache_data *oc)
+{
+	if (oc->out_width != 0 && oc->width != oc->out_width)
+		return true;
+
+	if (oc->out_height != 0 && oc->height != oc->out_height)
+		return true;
+
+	return false;
+}
+
+static int configure_overlay(enum omap_plane plane)
+{
+	struct overlay_cache_data *c;
+	struct manager_cache_data *mc;
+	u16 outw, outh;
+	u16 x, y, w, h;
+	u32 paddr;
+	int r;
+
+	DSSDBGF("%d", plane);
+
+	c = &dss_cache.overlay_cache[plane];
+
+	if (!c->enabled) {
+		dispc_enable_plane(plane, 0);
+		return 0;
+	}
+
+	mc = &dss_cache.manager_cache[c->channel];
+
+	x = c->pos_x;
+	y = c->pos_y;
+	w = c->width;
+	h = c->height;
+	outw = c->out_width == 0 ? c->width : c->out_width;
+	outh = c->out_height == 0 ? c->height : c->out_height;
+	paddr = c->paddr;
+
+	if (c->manual_update && mc->do_manual_update) {
+		unsigned bpp;
+		/* If the overlay is outside the update region, disable it */
+		if (!rectangle_intersects(mc->x, mc->y, mc->w, mc->h,
+					x, y, outw, outh)) {
+			dispc_enable_plane(plane, 0);
+			return 0;
+		}
+
+		switch (c->color_mode) {
+		case OMAP_DSS_COLOR_RGB16:
+		case OMAP_DSS_COLOR_ARGB16:
+		case OMAP_DSS_COLOR_YUV2:
+		case OMAP_DSS_COLOR_UYVY:
+			bpp = 16;
+			break;
+
+		case OMAP_DSS_COLOR_RGB24P:
+			bpp = 24;
+			break;
+
+		case OMAP_DSS_COLOR_RGB24U:
+		case OMAP_DSS_COLOR_ARGB32:
+		case OMAP_DSS_COLOR_RGBA32:
+		case OMAP_DSS_COLOR_RGBX32:
+			bpp = 32;
+			break;
+
+		default:
+			BUG();
+		}
+
+		if (dispc_is_overlay_scaled(c)) {
+			/* If the overlay is scaled, the update area has
+			 * already been enlarged to cover the whole overlay. We
+			 * only need to adjust x/y here */
+			x = c->pos_x - mc->x;
+			y = c->pos_y - mc->y;
+		} else {
+			if (mc->x > c->pos_x) {
+				x = 0;
+				w -= (mc->x - c->pos_x);
+				paddr += (mc->x - c->pos_x) * bpp / 8;
+			} else {
+				x = c->pos_x - mc->x;
+			}
+
+			if (mc->y > c->pos_y) {
+				y = 0;
+				h -= (mc->y - c->pos_y);
+				paddr += (mc->y - c->pos_y) * c->screen_width *
+					bpp / 8;
+			} else {
+				y = c->pos_y - mc->y;
+			}
+
+			if (mc->w < (x+w))
+				w -= (x+w) - (mc->w);
+
+			if (mc->h < (y+h))
+				h -= (y+h) - (mc->h);
+
+			outw = w;
+			outh = h;
+		}
+	}
+
+	r = dispc_setup_plane(plane,
+			paddr,
+			c->screen_width,
+			x, y,
+			w, h,
+			outw, outh,
+			c->color_mode,
+			c->ilace,
+			c->rotation_type,
+			c->rotation,
+			c->mirror,
+			c->global_alpha);
+
+	if (r) {
+		/* this shouldn't happen */
+		DSSERR("dispc_setup_plane failed for ovl %d\n", plane);
+		dispc_enable_plane(plane, 0);
+		return r;
+	}
+
+	dispc_enable_replication(plane, c->replication);
+
+	dispc_set_burst_size(plane, c->burst_size);
+	dispc_setup_plane_fifo(plane, c->fifo_low, c->fifo_high);
+
+	dispc_enable_plane(plane, 1);
+
+	return 0;
+}
+
+static void configure_manager(enum omap_channel channel)
+{
+	struct manager_cache_data *c;
+
+	DSSDBGF("%d", channel);
+
+	c = &dss_cache.manager_cache[channel];
+
+	dispc_set_trans_key(channel, c->trans_key_type, c->trans_key);
+	dispc_enable_trans_key(channel, c->trans_enabled);
+	dispc_enable_alpha_blending(channel, c->alpha_enabled);
+}
+
+/* configure_dispc() tries to write values from cache to shadow registers.
+ * It writes only to those managers/overlays that are not busy.
+ * returns 0 if everything could be written to shadow registers.
+ * returns 1 if not everything could be written to shadow registers. */
+static int configure_dispc(void)
+{
+	struct overlay_cache_data *oc;
+	struct manager_cache_data *mc;
+	const int num_ovls = ARRAY_SIZE(dss_cache.overlay_cache);
+	const int num_mgrs = ARRAY_SIZE(dss_cache.manager_cache);
+	int i;
+	int r;
+	bool mgr_busy[2];
+	bool mgr_go[2];
+	bool busy;
+
+	r = 0;
+	busy = false;
+
+	mgr_busy[0] = dispc_go_busy(0);
+	mgr_busy[1] = dispc_go_busy(1);
+	mgr_go[0] = false;
+	mgr_go[1] = false;
+
+	/* Commit overlay settings */
+	for (i = 0; i < num_ovls; ++i) {
+		oc = &dss_cache.overlay_cache[i];
+		mc = &dss_cache.manager_cache[oc->channel];
+
+		if (!oc->dirty)
+			continue;
+
+		if (oc->manual_update && !mc->do_manual_update)
+			continue;
+
+		if (mgr_busy[oc->channel]) {
+			busy = true;
+			continue;
+		}
+
+		r = configure_overlay(i);
+		if (r)
+			DSSERR("configure_overlay %d failed\n", i);
+
+		oc->dirty = false;
+		oc->shadow_dirty = true;
+		mgr_go[oc->channel] = true;
+	}
+
+	/* Commit manager settings */
+	for (i = 0; i < num_mgrs; ++i) {
+		mc = &dss_cache.manager_cache[i];
+
+		if (!mc->dirty)
+			continue;
+
+		if (mc->manual_update && !mc->do_manual_update)
+			continue;
+
+		if (mgr_busy[i]) {
+			busy = true;
+			continue;
+		}
+
+		configure_manager(i);
+		mc->dirty = false;
+		mc->shadow_dirty = true;
+		mgr_go[i] = true;
+	}
+
+	/* set GO */
+	for (i = 0; i < num_mgrs; ++i) {
+		mc = &dss_cache.manager_cache[i];
+
+		if (!mgr_go[i])
+			continue;
+
+		/* We don't need GO with manual update display. LCD iface will
+		 * always be turned off after frame, and new settings will be
+		 * taken in to use at next update */
+		if (!mc->manual_upd_display)
+			dispc_go(i);
+	}
+
+	if (busy)
+		r = 1;
+	else
+		r = 0;
+
+	return r;
+}
+
+/* Configure dispc for partial update. Return possibly modified update
+ * area */
+void dss_setup_partial_planes(struct omap_dss_device *dssdev,
+		u16 *xi, u16 *yi, u16 *wi, u16 *hi)
+{
+	struct overlay_cache_data *oc;
+	struct manager_cache_data *mc;
+	const int num_ovls = ARRAY_SIZE(dss_cache.overlay_cache);
+	struct omap_overlay_manager *mgr;
+	int i;
+	u16 x, y, w, h;
+	unsigned long flags;
+
+	x = *xi;
+	y = *yi;
+	w = *wi;
+	h = *hi;
+
+	DSSDBG("dispc_setup_partial_planes %d,%d %dx%d\n",
+		*xi, *yi, *wi, *hi);
+
+	mgr = dssdev->manager;
+
+	if (!mgr) {
+		DSSDBG("no manager\n");
+		return;
+	}
+
+	spin_lock_irqsave(&dss_cache.lock, flags);
+
+	/* We need to show the whole overlay if it is scaled. So look for
+	 * those, and make the update area larger if found.
+	 * Also mark the overlay cache dirty */
+	for (i = 0; i < num_ovls; ++i) {
+		unsigned x1, y1, x2, y2;
+		unsigned outw, outh;
+
+		oc = &dss_cache.overlay_cache[i];
+
+		if (oc->channel != mgr->id)
+			continue;
+
+		oc->dirty = true;
+
+		if (!oc->enabled)
+			continue;
+
+		if (!dispc_is_overlay_scaled(oc))
+			continue;
+
+		outw = oc->out_width == 0 ? oc->width : oc->out_width;
+		outh = oc->out_height == 0 ? oc->height : oc->out_height;
+
+		/* is the overlay outside the update region? */
+		if (!rectangle_intersects(x, y, w, h,
+					oc->pos_x, oc->pos_y,
+					outw, outh))
+			continue;
+
+		/* if the overlay totally inside the update region? */
+		if (rectangle_subset(oc->pos_x, oc->pos_y, outw, outh,
+					x, y, w, h))
+			continue;
+
+		if (x > oc->pos_x)
+			x1 = oc->pos_x;
+		else
+			x1 = x;
+
+		if (y > oc->pos_y)
+			y1 = oc->pos_y;
+		else
+			y1 = y;
+
+		if ((x + w) < (oc->pos_x + outw))
+			x2 = oc->pos_x + outw;
+		else
+			x2 = x + w;
+
+		if ((y + h) < (oc->pos_y + outh))
+			y2 = oc->pos_y + outh;
+		else
+			y2 = y + h;
+
+		x = x1;
+		y = y1;
+		w = x2 - x1;
+		h = y2 - y1;
+
+		DSSDBG("changing upd area due to ovl(%d) scaling %d,%d %dx%d\n",
+				i, x, y, w, h);
+	}
+
+	mc = &dss_cache.manager_cache[mgr->id];
+	mc->do_manual_update = true;
+	mc->x = x;
+	mc->y = y;
+	mc->w = w;
+	mc->h = h;
+
+	configure_dispc();
+
+	mc->do_manual_update = false;
+
+	spin_unlock_irqrestore(&dss_cache.lock, flags);
+
+	*xi = x;
+	*yi = y;
+	*wi = w;
+	*hi = h;
+}
+
+void dss_start_update(struct omap_dss_device *dssdev)
+{
+	struct manager_cache_data *mc;
+	struct overlay_cache_data *oc;
+	const int num_ovls = ARRAY_SIZE(dss_cache.overlay_cache);
+	const int num_mgrs = ARRAY_SIZE(dss_cache.manager_cache);
+	struct omap_overlay_manager *mgr;
+	int i;
+
+	mgr = dssdev->manager;
+
+	for (i = 0; i < num_ovls; ++i) {
+		oc = &dss_cache.overlay_cache[i];
+		if (oc->channel != mgr->id)
+			continue;
+
+		oc->shadow_dirty = false;
+	}
+
+	for (i = 0; i < num_mgrs; ++i) {
+		mc = &dss_cache.manager_cache[i];
+		if (mgr->id != i)
+			continue;
+
+		mc->shadow_dirty = false;
+	}
+
+	dispc_enable_lcd_out(1);
+}
+
+static void dss_apply_irq_handler(void *data, u32 mask)
+{
+	struct manager_cache_data *mc;
+	struct overlay_cache_data *oc;
+	const int num_ovls = ARRAY_SIZE(dss_cache.overlay_cache);
+	const int num_mgrs = ARRAY_SIZE(dss_cache.manager_cache);
+	int i, r;
+	bool mgr_busy[2];
+
+	mgr_busy[0] = dispc_go_busy(0);
+	mgr_busy[1] = dispc_go_busy(1);
+
+	spin_lock(&dss_cache.lock);
+
+	for (i = 0; i < num_ovls; ++i) {
+		oc = &dss_cache.overlay_cache[i];
+		if (!mgr_busy[oc->channel])
+			oc->shadow_dirty = false;
+	}
+
+	for (i = 0; i < num_mgrs; ++i) {
+		mc = &dss_cache.manager_cache[i];
+		if (!mgr_busy[i])
+			mc->shadow_dirty = false;
+	}
+
+	r = configure_dispc();
+	if (r == 1)
+		goto end;
+
+	/* re-read busy flags */
+	mgr_busy[0] = dispc_go_busy(0);
+	mgr_busy[1] = dispc_go_busy(1);
+
+	/* keep running as long as there are busy managers, so that
+	 * we can collect overlay-applied information */
+	for (i = 0; i < num_mgrs; ++i) {
+		if (mgr_busy[i])
+			goto end;
+	}
+
+	omap_dispc_unregister_isr(dss_apply_irq_handler, NULL,
+			DISPC_IRQ_VSYNC	| DISPC_IRQ_EVSYNC_ODD |
+			DISPC_IRQ_EVSYNC_EVEN);
+	dss_cache.irq_enabled = false;
+
+end:
+	spin_unlock(&dss_cache.lock);
+}
+
+static int omap_dss_mgr_apply(struct omap_overlay_manager *mgr)
+{
+	struct overlay_cache_data *oc;
+	struct manager_cache_data *mc;
+	int i;
+	struct omap_overlay *ovl;
+	int num_planes_enabled = 0;
+	bool use_fifomerge;
+	unsigned long flags;
+	int r;
+
+	DSSDBG("omap_dss_mgr_apply(%s)\n", mgr->name);
+
+	spin_lock_irqsave(&dss_cache.lock, flags);
+
+	/* Configure overlays */
+	for (i = 0; i < omap_dss_get_num_overlays(); ++i) {
+		struct omap_dss_device *dssdev;
+
+		ovl = omap_dss_get_overlay(i);
+
+		if (!(ovl->caps & OMAP_DSS_OVL_CAP_DISPC))
+			continue;
+
+		oc = &dss_cache.overlay_cache[ovl->id];
+
+		if (!overlay_enabled(ovl)) {
+			if (oc->enabled) {
+				oc->enabled = false;
+				oc->dirty = true;
+			}
+			continue;
+		}
+
+		if (!ovl->info_dirty) {
+			if (oc->enabled)
+				++num_planes_enabled;
+			continue;
+		}
+
+		dssdev = ovl->manager->device;
+
+		if (dss_check_overlay(ovl, dssdev)) {
+			if (oc->enabled) {
+				oc->enabled = false;
+				oc->dirty = true;
+			}
+			continue;
+		}
+
+		ovl->info_dirty = false;
+		oc->dirty = true;
+
+		oc->paddr = ovl->info.paddr;
+		oc->vaddr = ovl->info.vaddr;
+		oc->screen_width = ovl->info.screen_width;
+		oc->width = ovl->info.width;
+		oc->height = ovl->info.height;
+		oc->color_mode = ovl->info.color_mode;
+		oc->rotation = ovl->info.rotation;
+		oc->rotation_type = ovl->info.rotation_type;
+		oc->mirror = ovl->info.mirror;
+		oc->pos_x = ovl->info.pos_x;
+		oc->pos_y = ovl->info.pos_y;
+		oc->out_width = ovl->info.out_width;
+		oc->out_height = ovl->info.out_height;
+		oc->global_alpha = ovl->info.global_alpha;
+
+		oc->replication =
+			dss_use_replication(dssdev, ovl->info.color_mode);
+
+		oc->ilace = dssdev->type == OMAP_DISPLAY_TYPE_VENC;
+
+		oc->channel = ovl->manager->id;
+
+		oc->enabled = true;
+
+		oc->manual_update =
+			dssdev->caps & OMAP_DSS_DISPLAY_CAP_MANUAL_UPDATE &&
+			dssdev->get_update_mode(dssdev) != OMAP_DSS_UPDATE_AUTO;
+
+		++num_planes_enabled;
+	}
+
+	/* Configure managers */
+	list_for_each_entry(mgr, &manager_list, list) {
+		struct omap_dss_device *dssdev;
+
+		if (!(mgr->caps & OMAP_DSS_OVL_MGR_CAP_DISPC))
+			continue;
+
+		mc = &dss_cache.manager_cache[mgr->id];
+
+		if (mgr->device_changed) {
+			mgr->device_changed = false;
+			mgr->info_dirty  = true;
+		}
+
+		if (!mgr->info_dirty)
+			continue;
+
+		if (!mgr->device)
+			continue;
+
+		dssdev = mgr->device;
+
+		mgr->info_dirty = false;
+		mc->dirty = true;
+
+		mc->default_color = mgr->info.default_color;
+		mc->trans_key_type = mgr->info.trans_key_type;
+		mc->trans_key = mgr->info.trans_key;
+		mc->trans_enabled = mgr->info.trans_enabled;
+		mc->alpha_enabled = mgr->info.alpha_enabled;
+
+		mc->manual_upd_display =
+			dssdev->caps & OMAP_DSS_DISPLAY_CAP_MANUAL_UPDATE;
+
+		mc->manual_update =
+			dssdev->caps & OMAP_DSS_DISPLAY_CAP_MANUAL_UPDATE &&
+			dssdev->get_update_mode(dssdev) != OMAP_DSS_UPDATE_AUTO;
+	}
+
+	/* XXX TODO: Try to get fifomerge working. The problem is that it
+	 * affects both managers, not individually but at the same time. This
+	 * means the change has to be well synchronized. I guess the proper way
+	 * is to have a two step process for fifo merge:
+	 *        fifomerge enable:
+	 *             1. disable other planes, leaving one plane enabled
+	 *             2. wait until the planes are disabled on HW
+	 *             3. config merged fifo thresholds, enable fifomerge
+	 *        fifomerge disable:
+	 *             1. config unmerged fifo thresholds, disable fifomerge
+	 *             2. wait until fifo changes are in HW
+	 *             3. enable planes
+	 */
+	use_fifomerge = false;
+
+	/* Configure overlay fifos */
+	for (i = 0; i < omap_dss_get_num_overlays(); ++i) {
+		struct omap_dss_device *dssdev;
+		u32 size;
+
+		ovl = omap_dss_get_overlay(i);
+
+		if (!(ovl->caps & OMAP_DSS_OVL_CAP_DISPC))
+			continue;
+
+		oc = &dss_cache.overlay_cache[ovl->id];
+
+		if (!oc->enabled)
+			continue;
+
+		dssdev = ovl->manager->device;
+
+		size = dispc_get_plane_fifo_size(ovl->id);
+		if (use_fifomerge)
+			size *= 3;
+
+		switch (dssdev->type) {
+		case OMAP_DISPLAY_TYPE_DPI:
+		case OMAP_DISPLAY_TYPE_DBI:
+		case OMAP_DISPLAY_TYPE_SDI:
+		case OMAP_DISPLAY_TYPE_VENC:
+			default_get_overlay_fifo_thresholds(ovl->id, size,
+					&oc->burst_size, &oc->fifo_low,
+					&oc->fifo_high);
+			break;
+#ifdef CONFIG_OMAP2_DSS_DSI
+		case OMAP_DISPLAY_TYPE_DSI:
+			dsi_get_overlay_fifo_thresholds(ovl->id, size,
+					&oc->burst_size, &oc->fifo_low,
+					&oc->fifo_high);
+			break;
+#endif
+		default:
+			BUG();
+		}
+	}
+
+	r = 0;
+	dss_clk_enable(DSS_CLK_ICK | DSS_CLK_FCK1);
+	if (!dss_cache.irq_enabled) {
+		r = omap_dispc_register_isr(dss_apply_irq_handler, NULL,
+				DISPC_IRQ_VSYNC	| DISPC_IRQ_EVSYNC_ODD |
+				DISPC_IRQ_EVSYNC_EVEN);
+		dss_cache.irq_enabled = true;
+	}
+	configure_dispc();
+	dss_clk_disable(DSS_CLK_ICK | DSS_CLK_FCK1);
+
+	spin_unlock_irqrestore(&dss_cache.lock, flags);
+
+	return r;
+}
+
+static int dss_check_manager(struct omap_overlay_manager *mgr)
+{
+	/* OMAP supports only graphics source transparency color key and alpha
+	 * blending simultaneously. See TRM 15.4.2.4.2.2 Alpha Mode */
+
+	if (mgr->info.alpha_enabled && mgr->info.trans_enabled &&
+			mgr->info.trans_key_type != OMAP_DSS_COLOR_KEY_GFX_DST)
+		return -EINVAL;
+
+	return 0;
+}
+
+static int omap_dss_mgr_set_info(struct omap_overlay_manager *mgr,
+		struct omap_overlay_manager_info *info)
+{
+	int r;
+	struct omap_overlay_manager_info old_info;
+
+	old_info = mgr->info;
+	mgr->info = *info;
+
+	r = dss_check_manager(mgr);
+	if (r) {
+		mgr->info = old_info;
+		return r;
+	}
+
+	mgr->info_dirty = true;
+
+	return 0;
+}
+
+static void omap_dss_mgr_get_info(struct omap_overlay_manager *mgr,
+		struct omap_overlay_manager_info *info)
+{
+	*info = mgr->info;
+}
+
+static void omap_dss_add_overlay_manager(struct omap_overlay_manager *manager)
+{
+	++num_managers;
+	list_add_tail(&manager->list, &manager_list);
+}
+
+int dss_init_overlay_managers(struct platform_device *pdev)
+{
+	int i, r;
+
+	spin_lock_init(&dss_cache.lock);
+
+	INIT_LIST_HEAD(&manager_list);
+
+	num_managers = 0;
+
+	for (i = 0; i < 2; ++i) {
+		struct omap_overlay_manager *mgr;
+		mgr = kzalloc(sizeof(*mgr), GFP_KERNEL);
+
+		BUG_ON(mgr == NULL);
+
+		switch (i) {
+		case 0:
+			mgr->name = "lcd";
+			mgr->id = OMAP_DSS_CHANNEL_LCD;
+			mgr->supported_displays =
+				OMAP_DISPLAY_TYPE_DPI | OMAP_DISPLAY_TYPE_DBI |
+				OMAP_DISPLAY_TYPE_SDI | OMAP_DISPLAY_TYPE_DSI;
+			break;
+		case 1:
+			mgr->name = "tv";
+			mgr->id = OMAP_DSS_CHANNEL_DIGIT;
+			mgr->supported_displays = OMAP_DISPLAY_TYPE_VENC;
+			break;
+		}
+
+		mgr->set_device = &omap_dss_set_device;
+		mgr->unset_device = &omap_dss_unset_device;
+		mgr->apply = &omap_dss_mgr_apply;
+		mgr->set_manager_info = &omap_dss_mgr_set_info;
+		mgr->get_manager_info = &omap_dss_mgr_get_info;
+		mgr->wait_for_go = &dss_mgr_wait_for_go;
+
+		mgr->caps = OMAP_DSS_OVL_MGR_CAP_DISPC;
+
+		dss_overlay_setup_dispc_manager(mgr);
+
+		omap_dss_add_overlay_manager(mgr);
+
+		r = kobject_init_and_add(&mgr->kobj, &manager_ktype,
+				&pdev->dev.kobj, "manager%d", i);
+
+		if (r) {
+			DSSERR("failed to create sysfs file\n");
+			continue;
+		}
+	}
+
+#ifdef L4_EXAMPLE
+	{
+		int omap_dss_mgr_apply_l4(struct omap_overlay_manager *mgr)
+		{
+			DSSDBG("omap_dss_mgr_apply_l4(%s)\n", mgr->name);
+
+			return 0;
+		}
+
+		struct omap_overlay_manager *mgr;
+		mgr = kzalloc(sizeof(*mgr), GFP_KERNEL);
+
+		BUG_ON(mgr == NULL);
+
+		mgr->name = "l4";
+		mgr->supported_displays =
+			OMAP_DISPLAY_TYPE_DBI | OMAP_DISPLAY_TYPE_DSI;
+
+		mgr->set_device = &omap_dss_set_device;
+		mgr->unset_device = &omap_dss_unset_device;
+		mgr->apply = &omap_dss_mgr_apply_l4;
+		mgr->set_manager_info = &omap_dss_mgr_set_info;
+		mgr->get_manager_info = &omap_dss_mgr_get_info;
+
+		dss_overlay_setup_l4_manager(mgr);
+
+		omap_dss_add_overlay_manager(mgr);
+
+		r = kobject_init_and_add(&mgr->kobj, &manager_ktype,
+				&pdev->dev.kobj, "managerl4");
+
+		if (r)
+			DSSERR("failed to create sysfs file\n");
+	}
+#endif
+
+	return 0;
+}
+
+void dss_uninit_overlay_managers(struct platform_device *pdev)
+{
+	struct omap_overlay_manager *mgr;
+
+	while (!list_empty(&manager_list)) {
+		mgr = list_first_entry(&manager_list,
+				struct omap_overlay_manager, list);
+		list_del(&mgr->list);
+		kobject_del(&mgr->kobj);
+		kobject_put(&mgr->kobj);
+		kfree(mgr);
+	}
+
+	num_managers = 0;
+}
+
+int omap_dss_get_num_overlay_managers(void)
+{
+	return num_managers;
+}
+EXPORT_SYMBOL(omap_dss_get_num_overlay_managers);
+
+struct omap_overlay_manager *omap_dss_get_overlay_manager(int num)
+{
+	int i = 0;
+	struct omap_overlay_manager *mgr;
+
+	list_for_each_entry(mgr, &manager_list, list) {
+		if (i++ == num)
+			return mgr;
+	}
+
+	return NULL;
+}
+EXPORT_SYMBOL(omap_dss_get_overlay_manager);
+
diff --git a/drivers/video/omap2/dss/overlay.c b/drivers/video/omap2/dss/overlay.c
new file mode 100644
index 000000000000..b7f9a7339842
--- /dev/null
+++ b/drivers/video/omap2/dss/overlay.c
@@ -0,0 +1,680 @@
+/*
+ * linux/drivers/video/omap2/dss/overlay.c
+ *
+ * Copyright (C) 2009 Nokia Corporation
+ * Author: Tomi Valkeinen <tomi.valkeinen@nokia.com>
+ *
+ * Some code and ideas taken from drivers/video/omap/ driver
+ * by Imre Deak.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#define DSS_SUBSYS_NAME "OVERLAY"
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/err.h>
+#include <linux/sysfs.h>
+#include <linux/kobject.h>
+#include <linux/platform_device.h>
+#include <linux/delay.h>
+
+#include <plat/display.h>
+#include <plat/cpu.h>
+
+#include "dss.h"
+
+static int num_overlays;
+static struct list_head overlay_list;
+
+static ssize_t overlay_name_show(struct omap_overlay *ovl, char *buf)
+{
+	return snprintf(buf, PAGE_SIZE, "%s\n", ovl->name);
+}
+
+static ssize_t overlay_manager_show(struct omap_overlay *ovl, char *buf)
+{
+	return snprintf(buf, PAGE_SIZE, "%s\n",
+			ovl->manager ? ovl->manager->name : "<none>");
+}
+
+static ssize_t overlay_manager_store(struct omap_overlay *ovl, const char *buf,
+		size_t size)
+{
+	int i, r;
+	struct omap_overlay_manager *mgr = NULL;
+	struct omap_overlay_manager *old_mgr;
+	int len = size;
+
+	if (buf[size-1] == '\n')
+		--len;
+
+	if (len > 0) {
+		for (i = 0; i < omap_dss_get_num_overlay_managers(); ++i) {
+			mgr = omap_dss_get_overlay_manager(i);
+
+			if (strncmp(buf, mgr->name, len) == 0)
+				break;
+
+			mgr = NULL;
+		}
+	}
+
+	if (len > 0 && mgr == NULL)
+		return -EINVAL;
+
+	if (mgr)
+		DSSDBG("manager %s found\n", mgr->name);
+
+	if (mgr == ovl->manager)
+		return size;
+
+	old_mgr = ovl->manager;
+
+	/* detach old manager */
+	if (old_mgr) {
+		r = ovl->unset_manager(ovl);
+		if (r) {
+			DSSERR("detach failed\n");
+			return r;
+		}
+
+		r = old_mgr->apply(old_mgr);
+		if (r)
+			return r;
+	}
+
+	if (mgr) {
+		r = ovl->set_manager(ovl, mgr);
+		if (r) {
+			DSSERR("Failed to attach overlay\n");
+			return r;
+		}
+
+		r = mgr->apply(mgr);
+		if (r)
+			return r;
+	}
+
+	return size;
+}
+
+static ssize_t overlay_input_size_show(struct omap_overlay *ovl, char *buf)
+{
+	return snprintf(buf, PAGE_SIZE, "%d,%d\n",
+			ovl->info.width, ovl->info.height);
+}
+
+static ssize_t overlay_screen_width_show(struct omap_overlay *ovl, char *buf)
+{
+	return snprintf(buf, PAGE_SIZE, "%d\n", ovl->info.screen_width);
+}
+
+static ssize_t overlay_position_show(struct omap_overlay *ovl, char *buf)
+{
+	return snprintf(buf, PAGE_SIZE, "%d,%d\n",
+			ovl->info.pos_x, ovl->info.pos_y);
+}
+
+static ssize_t overlay_position_store(struct omap_overlay *ovl,
+		const char *buf, size_t size)
+{
+	int r;
+	char *last;
+	struct omap_overlay_info info;
+
+	ovl->get_overlay_info(ovl, &info);
+
+	info.pos_x = simple_strtoul(buf, &last, 10);
+	++last;
+	if (last - buf >= size)
+		return -EINVAL;
+
+	info.pos_y = simple_strtoul(last, &last, 10);
+
+	r = ovl->set_overlay_info(ovl, &info);
+	if (r)
+		return r;
+
+	if (ovl->manager) {
+		r = ovl->manager->apply(ovl->manager);
+		if (r)
+			return r;
+	}
+
+	return size;
+}
+
+static ssize_t overlay_output_size_show(struct omap_overlay *ovl, char *buf)
+{
+	return snprintf(buf, PAGE_SIZE, "%d,%d\n",
+			ovl->info.out_width, ovl->info.out_height);
+}
+
+static ssize_t overlay_output_size_store(struct omap_overlay *ovl,
+		const char *buf, size_t size)
+{
+	int r;
+	char *last;
+	struct omap_overlay_info info;
+
+	ovl->get_overlay_info(ovl, &info);
+
+	info.out_width = simple_strtoul(buf, &last, 10);
+	++last;
+	if (last - buf >= size)
+		return -EINVAL;
+
+	info.out_height = simple_strtoul(last, &last, 10);
+
+	r = ovl->set_overlay_info(ovl, &info);
+	if (r)
+		return r;
+
+	if (ovl->manager) {
+		r = ovl->manager->apply(ovl->manager);
+		if (r)
+			return r;
+	}
+
+	return size;
+}
+
+static ssize_t overlay_enabled_show(struct omap_overlay *ovl, char *buf)
+{
+	return snprintf(buf, PAGE_SIZE, "%d\n", ovl->info.enabled);
+}
+
+static ssize_t overlay_enabled_store(struct omap_overlay *ovl, const char *buf,
+		size_t size)
+{
+	int r;
+	struct omap_overlay_info info;
+
+	ovl->get_overlay_info(ovl, &info);
+
+	info.enabled = simple_strtoul(buf, NULL, 10);
+
+	r = ovl->set_overlay_info(ovl, &info);
+	if (r)
+		return r;
+
+	if (ovl->manager) {
+		r = ovl->manager->apply(ovl->manager);
+		if (r)
+			return r;
+	}
+
+	return size;
+}
+
+static ssize_t overlay_global_alpha_show(struct omap_overlay *ovl, char *buf)
+{
+	return snprintf(buf, PAGE_SIZE, "%d\n",
+			ovl->info.global_alpha);
+}
+
+static ssize_t overlay_global_alpha_store(struct omap_overlay *ovl,
+		const char *buf, size_t size)
+{
+	int r;
+	struct omap_overlay_info info;
+
+	ovl->get_overlay_info(ovl, &info);
+
+	/* Video1 plane does not support global alpha
+	 * to always make it 255 completely opaque
+	 */
+	if (ovl->id == OMAP_DSS_VIDEO1)
+		info.global_alpha = 255;
+	else
+		info.global_alpha = simple_strtoul(buf, NULL, 10);
+
+	r = ovl->set_overlay_info(ovl, &info);
+	if (r)
+		return r;
+
+	if (ovl->manager) {
+		r = ovl->manager->apply(ovl->manager);
+		if (r)
+			return r;
+	}
+
+	return size;
+}
+
+struct overlay_attribute {
+	struct attribute attr;
+	ssize_t (*show)(struct omap_overlay *, char *);
+	ssize_t	(*store)(struct omap_overlay *, const char *, size_t);
+};
+
+#define OVERLAY_ATTR(_name, _mode, _show, _store) \
+	struct overlay_attribute overlay_attr_##_name = \
+	__ATTR(_name, _mode, _show, _store)
+
+static OVERLAY_ATTR(name, S_IRUGO, overlay_name_show, NULL);
+static OVERLAY_ATTR(manager, S_IRUGO|S_IWUSR,
+		overlay_manager_show, overlay_manager_store);
+static OVERLAY_ATTR(input_size, S_IRUGO, overlay_input_size_show, NULL);
+static OVERLAY_ATTR(screen_width, S_IRUGO, overlay_screen_width_show, NULL);
+static OVERLAY_ATTR(position, S_IRUGO|S_IWUSR,
+		overlay_position_show, overlay_position_store);
+static OVERLAY_ATTR(output_size, S_IRUGO|S_IWUSR,
+		overlay_output_size_show, overlay_output_size_store);
+static OVERLAY_ATTR(enabled, S_IRUGO|S_IWUSR,
+		overlay_enabled_show, overlay_enabled_store);
+static OVERLAY_ATTR(global_alpha, S_IRUGO|S_IWUSR,
+		overlay_global_alpha_show, overlay_global_alpha_store);
+
+static struct attribute *overlay_sysfs_attrs[] = {
+	&overlay_attr_name.attr,
+	&overlay_attr_manager.attr,
+	&overlay_attr_input_size.attr,
+	&overlay_attr_screen_width.attr,
+	&overlay_attr_position.attr,
+	&overlay_attr_output_size.attr,
+	&overlay_attr_enabled.attr,
+	&overlay_attr_global_alpha.attr,
+	NULL
+};
+
+static ssize_t overlay_attr_show(struct kobject *kobj, struct attribute *attr,
+		char *buf)
+{
+	struct omap_overlay *overlay;
+	struct overlay_attribute *overlay_attr;
+
+	overlay = container_of(kobj, struct omap_overlay, kobj);
+	overlay_attr = container_of(attr, struct overlay_attribute, attr);
+
+	if (!overlay_attr->show)
+		return -ENOENT;
+
+	return overlay_attr->show(overlay, buf);
+}
+
+static ssize_t overlay_attr_store(struct kobject *kobj, struct attribute *attr,
+		const char *buf, size_t size)
+{
+	struct omap_overlay *overlay;
+	struct overlay_attribute *overlay_attr;
+
+	overlay = container_of(kobj, struct omap_overlay, kobj);
+	overlay_attr = container_of(attr, struct overlay_attribute, attr);
+
+	if (!overlay_attr->store)
+		return -ENOENT;
+
+	return overlay_attr->store(overlay, buf, size);
+}
+
+static struct sysfs_ops overlay_sysfs_ops = {
+	.show = overlay_attr_show,
+	.store = overlay_attr_store,
+};
+
+static struct kobj_type overlay_ktype = {
+	.sysfs_ops = &overlay_sysfs_ops,
+	.default_attrs = overlay_sysfs_attrs,
+};
+
+/* Check if overlay parameters are compatible with display */
+int dss_check_overlay(struct omap_overlay *ovl, struct omap_dss_device *dssdev)
+{
+	struct omap_overlay_info *info;
+	u16 outw, outh;
+	u16 dw, dh;
+
+	if (!dssdev)
+		return 0;
+
+	if (!ovl->info.enabled)
+		return 0;
+
+	info = &ovl->info;
+
+	if (info->paddr == 0) {
+		DSSDBG("check_overlay failed: paddr 0\n");
+		return -EINVAL;
+	}
+
+	dssdev->get_resolution(dssdev, &dw, &dh);
+
+	DSSDBG("check_overlay %d: (%d,%d %dx%d -> %dx%d) disp (%dx%d)\n",
+			ovl->id,
+			info->pos_x, info->pos_y,
+			info->width, info->height,
+			info->out_width, info->out_height,
+			dw, dh);
+
+	if ((ovl->caps & OMAP_DSS_OVL_CAP_SCALE) == 0) {
+		outw = info->width;
+		outh = info->height;
+	} else {
+		if (info->out_width == 0)
+			outw = info->width;
+		else
+			outw = info->out_width;
+
+		if (info->out_height == 0)
+			outh = info->height;
+		else
+			outh = info->out_height;
+	}
+
+	if (dw < info->pos_x + outw) {
+		DSSDBG("check_overlay failed 1: %d < %d + %d\n",
+				dw, info->pos_x, outw);
+		return -EINVAL;
+	}
+
+	if (dh < info->pos_y + outh) {
+		DSSDBG("check_overlay failed 2: %d < %d + %d\n",
+				dh, info->pos_y, outh);
+		return -EINVAL;
+	}
+
+	if ((ovl->supported_modes & info->color_mode) == 0) {
+		DSSERR("overlay doesn't support mode %d\n", info->color_mode);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+static int dss_ovl_set_overlay_info(struct omap_overlay *ovl,
+		struct omap_overlay_info *info)
+{
+	int r;
+	struct omap_overlay_info old_info;
+
+	old_info = ovl->info;
+	ovl->info = *info;
+
+	if (ovl->manager) {
+		r = dss_check_overlay(ovl, ovl->manager->device);
+		if (r) {
+			ovl->info = old_info;
+			return r;
+		}
+	}
+
+	ovl->info_dirty = true;
+
+	return 0;
+}
+
+static void dss_ovl_get_overlay_info(struct omap_overlay *ovl,
+		struct omap_overlay_info *info)
+{
+	*info = ovl->info;
+}
+
+static int dss_ovl_wait_for_go(struct omap_overlay *ovl)
+{
+	return dss_mgr_wait_for_go_ovl(ovl);
+}
+
+static int omap_dss_set_manager(struct omap_overlay *ovl,
+		struct omap_overlay_manager *mgr)
+{
+	if (!mgr)
+		return -EINVAL;
+
+	if (ovl->manager) {
+		DSSERR("overlay '%s' already has a manager '%s'\n",
+				ovl->name, ovl->manager->name);
+		return -EINVAL;
+	}
+
+	if (ovl->info.enabled) {
+		DSSERR("overlay has to be disabled to change the manager\n");
+		return -EINVAL;
+	}
+
+	ovl->manager = mgr;
+
+	dss_clk_enable(DSS_CLK_ICK | DSS_CLK_FCK1);
+	/* XXX: on manual update display, in auto update mode, a bug happens
+	 * here. When an overlay is first enabled on LCD, then it's disabled,
+	 * and the manager is changed to TV, we sometimes get SYNC_LOST_DIGIT
+	 * errors. Waiting before changing the channel_out fixes it. I'm
+	 * guessing that the overlay is still somehow being used for the LCD,
+	 * but I don't understand how or why. */
+	msleep(40);
+	dispc_set_channel_out(ovl->id, mgr->id);
+	dss_clk_disable(DSS_CLK_ICK | DSS_CLK_FCK1);
+
+	return 0;
+}
+
+static int omap_dss_unset_manager(struct omap_overlay *ovl)
+{
+	int r;
+
+	if (!ovl->manager) {
+		DSSERR("failed to detach overlay: manager not set\n");
+		return -EINVAL;
+	}
+
+	if (ovl->info.enabled) {
+		DSSERR("overlay has to be disabled to unset the manager\n");
+		return -EINVAL;
+	}
+
+	r = ovl->wait_for_go(ovl);
+	if (r)
+		return r;
+
+	ovl->manager = NULL;
+
+	return 0;
+}
+
+int omap_dss_get_num_overlays(void)
+{
+	return num_overlays;
+}
+EXPORT_SYMBOL(omap_dss_get_num_overlays);
+
+struct omap_overlay *omap_dss_get_overlay(int num)
+{
+	int i = 0;
+	struct omap_overlay *ovl;
+
+	list_for_each_entry(ovl, &overlay_list, list) {
+		if (i++ == num)
+			return ovl;
+	}
+
+	return NULL;
+}
+EXPORT_SYMBOL(omap_dss_get_overlay);
+
+static void omap_dss_add_overlay(struct omap_overlay *overlay)
+{
+	++num_overlays;
+	list_add_tail(&overlay->list, &overlay_list);
+}
+
+static struct omap_overlay *dispc_overlays[3];
+
+void dss_overlay_setup_dispc_manager(struct omap_overlay_manager *mgr)
+{
+	mgr->num_overlays = 3;
+	mgr->overlays = dispc_overlays;
+}
+
+#ifdef L4_EXAMPLE
+static struct omap_overlay *l4_overlays[1];
+void dss_overlay_setup_l4_manager(struct omap_overlay_manager *mgr)
+{
+	mgr->num_overlays = 1;
+	mgr->overlays = l4_overlays;
+}
+#endif
+
+void dss_init_overlays(struct platform_device *pdev)
+{
+	int i, r;
+
+	INIT_LIST_HEAD(&overlay_list);
+
+	num_overlays = 0;
+
+	for (i = 0; i < 3; ++i) {
+		struct omap_overlay *ovl;
+		ovl = kzalloc(sizeof(*ovl), GFP_KERNEL);
+
+		BUG_ON(ovl == NULL);
+
+		switch (i) {
+		case 0:
+			ovl->name = "gfx";
+			ovl->id = OMAP_DSS_GFX;
+			ovl->supported_modes = cpu_is_omap34xx() ?
+				OMAP_DSS_COLOR_GFX_OMAP3 :
+				OMAP_DSS_COLOR_GFX_OMAP2;
+			ovl->caps = OMAP_DSS_OVL_CAP_DISPC;
+			ovl->info.global_alpha = 255;
+			break;
+		case 1:
+			ovl->name = "vid1";
+			ovl->id = OMAP_DSS_VIDEO1;
+			ovl->supported_modes = cpu_is_omap34xx() ?
+				OMAP_DSS_COLOR_VID1_OMAP3 :
+				OMAP_DSS_COLOR_VID_OMAP2;
+			ovl->caps = OMAP_DSS_OVL_CAP_SCALE |
+				OMAP_DSS_OVL_CAP_DISPC;
+			ovl->info.global_alpha = 255;
+			break;
+		case 2:
+			ovl->name = "vid2";
+			ovl->id = OMAP_DSS_VIDEO2;
+			ovl->supported_modes = cpu_is_omap34xx() ?
+				OMAP_DSS_COLOR_VID2_OMAP3 :
+				OMAP_DSS_COLOR_VID_OMAP2;
+			ovl->caps = OMAP_DSS_OVL_CAP_SCALE |
+				OMAP_DSS_OVL_CAP_DISPC;
+			ovl->info.global_alpha = 255;
+			break;
+		}
+
+		ovl->set_manager = &omap_dss_set_manager;
+		ovl->unset_manager = &omap_dss_unset_manager;
+		ovl->set_overlay_info = &dss_ovl_set_overlay_info;
+		ovl->get_overlay_info = &dss_ovl_get_overlay_info;
+		ovl->wait_for_go = &dss_ovl_wait_for_go;
+
+		omap_dss_add_overlay(ovl);
+
+		r = kobject_init_and_add(&ovl->kobj, &overlay_ktype,
+				&pdev->dev.kobj, "overlay%d", i);
+
+		if (r) {
+			DSSERR("failed to create sysfs file\n");
+			continue;
+		}
+
+		dispc_overlays[i] = ovl;
+	}
+
+#ifdef L4_EXAMPLE
+	{
+		struct omap_overlay *ovl;
+		ovl = kzalloc(sizeof(*ovl), GFP_KERNEL);
+
+		BUG_ON(ovl == NULL);
+
+		ovl->name = "l4";
+		ovl->supported_modes = OMAP_DSS_COLOR_RGB24U;
+
+		ovl->set_manager = &omap_dss_set_manager;
+		ovl->unset_manager = &omap_dss_unset_manager;
+		ovl->set_overlay_info = &dss_ovl_set_overlay_info;
+		ovl->get_overlay_info = &dss_ovl_get_overlay_info;
+
+		omap_dss_add_overlay(ovl);
+
+		r = kobject_init_and_add(&ovl->kobj, &overlay_ktype,
+				&pdev->dev.kobj, "overlayl4");
+
+		if (r)
+			DSSERR("failed to create sysfs file\n");
+
+		l4_overlays[0] = ovl;
+	}
+#endif
+}
+
+/* connect overlays to the new device, if not already connected. if force
+ * selected, connect always. */
+void dss_recheck_connections(struct omap_dss_device *dssdev, bool force)
+{
+	int i;
+	struct omap_overlay_manager *lcd_mgr;
+	struct omap_overlay_manager *tv_mgr;
+	struct omap_overlay_manager *mgr = NULL;
+
+	lcd_mgr = omap_dss_get_overlay_manager(OMAP_DSS_OVL_MGR_LCD);
+	tv_mgr = omap_dss_get_overlay_manager(OMAP_DSS_OVL_MGR_TV);
+
+	if (dssdev->type != OMAP_DISPLAY_TYPE_VENC) {
+		if (!lcd_mgr->device || force) {
+			if (lcd_mgr->device)
+				lcd_mgr->unset_device(lcd_mgr);
+			lcd_mgr->set_device(lcd_mgr, dssdev);
+			mgr = lcd_mgr;
+		}
+	}
+
+	if (dssdev->type == OMAP_DISPLAY_TYPE_VENC) {
+		if (!tv_mgr->device || force) {
+			if (tv_mgr->device)
+				tv_mgr->unset_device(tv_mgr);
+			tv_mgr->set_device(tv_mgr, dssdev);
+			mgr = tv_mgr;
+		}
+	}
+
+	if (mgr) {
+		for (i = 0; i < 3; i++) {
+			struct omap_overlay *ovl;
+			ovl = omap_dss_get_overlay(i);
+			if (!ovl->manager || force) {
+				if (ovl->manager)
+					omap_dss_unset_manager(ovl);
+				omap_dss_set_manager(ovl, mgr);
+			}
+		}
+	}
+}
+
+void dss_uninit_overlays(struct platform_device *pdev)
+{
+	struct omap_overlay *ovl;
+
+	while (!list_empty(&overlay_list)) {
+		ovl = list_first_entry(&overlay_list,
+				struct omap_overlay, list);
+		list_del(&ovl->list);
+		kobject_del(&ovl->kobj);
+		kobject_put(&ovl->kobj);
+		kfree(ovl);
+	}
+
+	num_overlays = 0;
+}
+
diff --git a/drivers/video/omap2/dss/rfbi.c b/drivers/video/omap2/dss/rfbi.c
new file mode 100644
index 000000000000..b936495c065d
--- /dev/null
+++ b/drivers/video/omap2/dss/rfbi.c
@@ -0,0 +1,1309 @@
+/*
+ * linux/drivers/video/omap2/dss/rfbi.c
+ *
+ * Copyright (C) 2009 Nokia Corporation
+ * Author: Tomi Valkeinen <tomi.valkeinen@nokia.com>
+ *
+ * Some code and ideas taken from drivers/video/omap/ driver
+ * by Imre Deak.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#define DSS_SUBSYS_NAME "RFBI"
+
+#include <linux/kernel.h>
+#include <linux/dma-mapping.h>
+#include <linux/vmalloc.h>
+#include <linux/clk.h>
+#include <linux/io.h>
+#include <linux/delay.h>
+#include <linux/kfifo.h>
+#include <linux/ktime.h>
+#include <linux/hrtimer.h>
+#include <linux/seq_file.h>
+
+#include <plat/display.h>
+#include "dss.h"
+
+/*#define MEASURE_PERF*/
+
+#define RFBI_BASE               0x48050800
+
+struct rfbi_reg { u16 idx; };
+
+#define RFBI_REG(idx)		((const struct rfbi_reg) { idx })
+
+#define RFBI_REVISION		RFBI_REG(0x0000)
+#define RFBI_SYSCONFIG		RFBI_REG(0x0010)
+#define RFBI_SYSSTATUS		RFBI_REG(0x0014)
+#define RFBI_CONTROL		RFBI_REG(0x0040)
+#define RFBI_PIXEL_CNT		RFBI_REG(0x0044)
+#define RFBI_LINE_NUMBER	RFBI_REG(0x0048)
+#define RFBI_CMD		RFBI_REG(0x004c)
+#define RFBI_PARAM		RFBI_REG(0x0050)
+#define RFBI_DATA		RFBI_REG(0x0054)
+#define RFBI_READ		RFBI_REG(0x0058)
+#define RFBI_STATUS		RFBI_REG(0x005c)
+
+#define RFBI_CONFIG(n)		RFBI_REG(0x0060 + (n)*0x18)
+#define RFBI_ONOFF_TIME(n)	RFBI_REG(0x0064 + (n)*0x18)
+#define RFBI_CYCLE_TIME(n)	RFBI_REG(0x0068 + (n)*0x18)
+#define RFBI_DATA_CYCLE1(n)	RFBI_REG(0x006c + (n)*0x18)
+#define RFBI_DATA_CYCLE2(n)	RFBI_REG(0x0070 + (n)*0x18)
+#define RFBI_DATA_CYCLE3(n)	RFBI_REG(0x0074 + (n)*0x18)
+
+#define RFBI_VSYNC_WIDTH	RFBI_REG(0x0090)
+#define RFBI_HSYNC_WIDTH	RFBI_REG(0x0094)
+
+#define RFBI_CMD_FIFO_LEN_BYTES (16 * sizeof(struct update_param))
+
+#define REG_FLD_MOD(idx, val, start, end) \
+	rfbi_write_reg(idx, FLD_MOD(rfbi_read_reg(idx), val, start, end))
+
+/* To work around an RFBI transfer rate limitation */
+#define OMAP_RFBI_RATE_LIMIT    1
+
+enum omap_rfbi_cycleformat {
+	OMAP_DSS_RFBI_CYCLEFORMAT_1_1 = 0,
+	OMAP_DSS_RFBI_CYCLEFORMAT_2_1 = 1,
+	OMAP_DSS_RFBI_CYCLEFORMAT_3_1 = 2,
+	OMAP_DSS_RFBI_CYCLEFORMAT_3_2 = 3,
+};
+
+enum omap_rfbi_datatype {
+	OMAP_DSS_RFBI_DATATYPE_12 = 0,
+	OMAP_DSS_RFBI_DATATYPE_16 = 1,
+	OMAP_DSS_RFBI_DATATYPE_18 = 2,
+	OMAP_DSS_RFBI_DATATYPE_24 = 3,
+};
+
+enum omap_rfbi_parallelmode {
+	OMAP_DSS_RFBI_PARALLELMODE_8 = 0,
+	OMAP_DSS_RFBI_PARALLELMODE_9 = 1,
+	OMAP_DSS_RFBI_PARALLELMODE_12 = 2,
+	OMAP_DSS_RFBI_PARALLELMODE_16 = 3,
+};
+
+enum update_cmd {
+	RFBI_CMD_UPDATE = 0,
+	RFBI_CMD_SYNC   = 1,
+};
+
+static int rfbi_convert_timings(struct rfbi_timings *t);
+static void rfbi_get_clk_info(u32 *clk_period, u32 *max_clk_div);
+static void process_cmd_fifo(void);
+
+static struct {
+	void __iomem	*base;
+
+	unsigned long	l4_khz;
+
+	enum omap_rfbi_datatype datatype;
+	enum omap_rfbi_parallelmode parallelmode;
+
+	enum omap_rfbi_te_mode te_mode;
+	int te_enabled;
+
+	void (*framedone_callback)(void *data);
+	void *framedone_callback_data;
+
+	struct omap_dss_device *dssdev[2];
+
+	struct kfifo      cmd_fifo;
+	spinlock_t        cmd_lock;
+	struct completion cmd_done;
+	atomic_t          cmd_fifo_full;
+	atomic_t          cmd_pending;
+#ifdef MEASURE_PERF
+	unsigned perf_bytes;
+	ktime_t perf_setup_time;
+	ktime_t perf_start_time;
+#endif
+} rfbi;
+
+struct update_region {
+	u16	x;
+	u16     y;
+	u16     w;
+	u16     h;
+};
+
+struct update_param {
+	u8 rfbi_module;
+	u8 cmd;
+
+	union {
+		struct update_region r;
+		struct completion *sync;
+	} par;
+};
+
+static inline void rfbi_write_reg(const struct rfbi_reg idx, u32 val)
+{
+	__raw_writel(val, rfbi.base + idx.idx);
+}
+
+static inline u32 rfbi_read_reg(const struct rfbi_reg idx)
+{
+	return __raw_readl(rfbi.base + idx.idx);
+}
+
+static void rfbi_enable_clocks(bool enable)
+{
+	if (enable)
+		dss_clk_enable(DSS_CLK_ICK | DSS_CLK_FCK1);
+	else
+		dss_clk_disable(DSS_CLK_ICK | DSS_CLK_FCK1);
+}
+
+void omap_rfbi_write_command(const void *buf, u32 len)
+{
+	rfbi_enable_clocks(1);
+	switch (rfbi.parallelmode) {
+	case OMAP_DSS_RFBI_PARALLELMODE_8:
+	{
+		const u8 *b = buf;
+		for (; len; len--)
+			rfbi_write_reg(RFBI_CMD, *b++);
+		break;
+	}
+
+	case OMAP_DSS_RFBI_PARALLELMODE_16:
+	{
+		const u16 *w = buf;
+		BUG_ON(len & 1);
+		for (; len; len -= 2)
+			rfbi_write_reg(RFBI_CMD, *w++);
+		break;
+	}
+
+	case OMAP_DSS_RFBI_PARALLELMODE_9:
+	case OMAP_DSS_RFBI_PARALLELMODE_12:
+	default:
+		BUG();
+	}
+	rfbi_enable_clocks(0);
+}
+EXPORT_SYMBOL(omap_rfbi_write_command);
+
+void omap_rfbi_read_data(void *buf, u32 len)
+{
+	rfbi_enable_clocks(1);
+	switch (rfbi.parallelmode) {
+	case OMAP_DSS_RFBI_PARALLELMODE_8:
+	{
+		u8 *b = buf;
+		for (; len; len--) {
+			rfbi_write_reg(RFBI_READ, 0);
+			*b++ = rfbi_read_reg(RFBI_READ);
+		}
+		break;
+	}
+
+	case OMAP_DSS_RFBI_PARALLELMODE_16:
+	{
+		u16 *w = buf;
+		BUG_ON(len & ~1);
+		for (; len; len -= 2) {
+			rfbi_write_reg(RFBI_READ, 0);
+			*w++ = rfbi_read_reg(RFBI_READ);
+		}
+		break;
+	}
+
+	case OMAP_DSS_RFBI_PARALLELMODE_9:
+	case OMAP_DSS_RFBI_PARALLELMODE_12:
+	default:
+		BUG();
+	}
+	rfbi_enable_clocks(0);
+}
+EXPORT_SYMBOL(omap_rfbi_read_data);
+
+void omap_rfbi_write_data(const void *buf, u32 len)
+{
+	rfbi_enable_clocks(1);
+	switch (rfbi.parallelmode) {
+	case OMAP_DSS_RFBI_PARALLELMODE_8:
+	{
+		const u8 *b = buf;
+		for (; len; len--)
+			rfbi_write_reg(RFBI_PARAM, *b++);
+		break;
+	}
+
+	case OMAP_DSS_RFBI_PARALLELMODE_16:
+	{
+		const u16 *w = buf;
+		BUG_ON(len & 1);
+		for (; len; len -= 2)
+			rfbi_write_reg(RFBI_PARAM, *w++);
+		break;
+	}
+
+	case OMAP_DSS_RFBI_PARALLELMODE_9:
+	case OMAP_DSS_RFBI_PARALLELMODE_12:
+	default:
+		BUG();
+
+	}
+	rfbi_enable_clocks(0);
+}
+EXPORT_SYMBOL(omap_rfbi_write_data);
+
+void omap_rfbi_write_pixels(const void __iomem *buf, int scr_width,
+		u16 x, u16 y,
+		u16 w, u16 h)
+{
+	int start_offset = scr_width * y + x;
+	int horiz_offset = scr_width - w;
+	int i;
+
+	rfbi_enable_clocks(1);
+
+	if (rfbi.datatype == OMAP_DSS_RFBI_DATATYPE_16 &&
+	   rfbi.parallelmode == OMAP_DSS_RFBI_PARALLELMODE_8) {
+		const u16 __iomem *pd = buf;
+		pd += start_offset;
+
+		for (; h; --h) {
+			for (i = 0; i < w; ++i) {
+				const u8 __iomem *b = (const u8 __iomem *)pd;
+				rfbi_write_reg(RFBI_PARAM, __raw_readb(b+1));
+				rfbi_write_reg(RFBI_PARAM, __raw_readb(b+0));
+				++pd;
+			}
+			pd += horiz_offset;
+		}
+	} else if (rfbi.datatype == OMAP_DSS_RFBI_DATATYPE_24 &&
+	   rfbi.parallelmode == OMAP_DSS_RFBI_PARALLELMODE_8) {
+		const u32 __iomem *pd = buf;
+		pd += start_offset;
+
+		for (; h; --h) {
+			for (i = 0; i < w; ++i) {
+				const u8 __iomem *b = (const u8 __iomem *)pd;
+				rfbi_write_reg(RFBI_PARAM, __raw_readb(b+2));
+				rfbi_write_reg(RFBI_PARAM, __raw_readb(b+1));
+				rfbi_write_reg(RFBI_PARAM, __raw_readb(b+0));
+				++pd;
+			}
+			pd += horiz_offset;
+		}
+	} else if (rfbi.datatype == OMAP_DSS_RFBI_DATATYPE_16 &&
+	   rfbi.parallelmode == OMAP_DSS_RFBI_PARALLELMODE_16) {
+		const u16 __iomem *pd = buf;
+		pd += start_offset;
+
+		for (; h; --h) {
+			for (i = 0; i < w; ++i) {
+				rfbi_write_reg(RFBI_PARAM, __raw_readw(pd));
+				++pd;
+			}
+			pd += horiz_offset;
+		}
+	} else {
+		BUG();
+	}
+
+	rfbi_enable_clocks(0);
+}
+EXPORT_SYMBOL(omap_rfbi_write_pixels);
+
+#ifdef MEASURE_PERF
+static void perf_mark_setup(void)
+{
+	rfbi.perf_setup_time = ktime_get();
+}
+
+static void perf_mark_start(void)
+{
+	rfbi.perf_start_time = ktime_get();
+}
+
+static void perf_show(const char *name)
+{
+	ktime_t t, setup_time, trans_time;
+	u32 total_bytes;
+	u32 setup_us, trans_us, total_us;
+
+	t = ktime_get();
+
+	setup_time = ktime_sub(rfbi.perf_start_time, rfbi.perf_setup_time);
+	setup_us = (u32)ktime_to_us(setup_time);
+	if (setup_us == 0)
+		setup_us = 1;
+
+	trans_time = ktime_sub(t, rfbi.perf_start_time);
+	trans_us = (u32)ktime_to_us(trans_time);
+	if (trans_us == 0)
+		trans_us = 1;
+
+	total_us = setup_us + trans_us;
+
+	total_bytes = rfbi.perf_bytes;
+
+	DSSINFO("%s update %u us + %u us = %u us (%uHz), %u bytes, "
+			"%u kbytes/sec\n",
+			name,
+			setup_us,
+			trans_us,
+			total_us,
+			1000*1000 / total_us,
+			total_bytes,
+			total_bytes * 1000 / total_us);
+}
+#else
+#define perf_mark_setup()
+#define perf_mark_start()
+#define perf_show(x)
+#endif
+
+void rfbi_transfer_area(u16 width, u16 height,
+			     void (callback)(void *data), void *data)
+{
+	u32 l;
+
+	/*BUG_ON(callback == 0);*/
+	BUG_ON(rfbi.framedone_callback != NULL);
+
+	DSSDBG("rfbi_transfer_area %dx%d\n", width, height);
+
+	dispc_set_lcd_size(width, height);
+
+	dispc_enable_lcd_out(1);
+
+	rfbi.framedone_callback = callback;
+	rfbi.framedone_callback_data = data;
+
+	rfbi_enable_clocks(1);
+
+	rfbi_write_reg(RFBI_PIXEL_CNT, width * height);
+
+	l = rfbi_read_reg(RFBI_CONTROL);
+	l = FLD_MOD(l, 1, 0, 0); /* enable */
+	if (!rfbi.te_enabled)
+		l = FLD_MOD(l, 1, 4, 4); /* ITE */
+
+	perf_mark_start();
+
+	rfbi_write_reg(RFBI_CONTROL, l);
+}
+
+static void framedone_callback(void *data, u32 mask)
+{
+	void (*callback)(void *data);
+
+	DSSDBG("FRAMEDONE\n");
+
+	perf_show("DISPC");
+
+	REG_FLD_MOD(RFBI_CONTROL, 0, 0, 0);
+
+	rfbi_enable_clocks(0);
+
+	callback = rfbi.framedone_callback;
+	rfbi.framedone_callback = NULL;
+
+	/*callback(rfbi.framedone_callback_data);*/
+
+	atomic_set(&rfbi.cmd_pending, 0);
+
+	process_cmd_fifo();
+}
+
+#if 1 /* VERBOSE */
+static void rfbi_print_timings(void)
+{
+	u32 l;
+	u32 time;
+
+	l = rfbi_read_reg(RFBI_CONFIG(0));
+	time = 1000000000 / rfbi.l4_khz;
+	if (l & (1 << 4))
+		time *= 2;
+
+	DSSDBG("Tick time %u ps\n", time);
+	l = rfbi_read_reg(RFBI_ONOFF_TIME(0));
+	DSSDBG("CSONTIME %d, CSOFFTIME %d, WEONTIME %d, WEOFFTIME %d, "
+		"REONTIME %d, REOFFTIME %d\n",
+		l & 0x0f, (l >> 4) & 0x3f, (l >> 10) & 0x0f, (l >> 14) & 0x3f,
+		(l >> 20) & 0x0f, (l >> 24) & 0x3f);
+
+	l = rfbi_read_reg(RFBI_CYCLE_TIME(0));
+	DSSDBG("WECYCLETIME %d, RECYCLETIME %d, CSPULSEWIDTH %d, "
+		"ACCESSTIME %d\n",
+		(l & 0x3f), (l >> 6) & 0x3f, (l >> 12) & 0x3f,
+		(l >> 22) & 0x3f);
+}
+#else
+static void rfbi_print_timings(void) {}
+#endif
+
+
+
+
+static u32 extif_clk_period;
+
+static inline unsigned long round_to_extif_ticks(unsigned long ps, int div)
+{
+	int bus_tick = extif_clk_period * div;
+	return (ps + bus_tick - 1) / bus_tick * bus_tick;
+}
+
+static int calc_reg_timing(struct rfbi_timings *t, int div)
+{
+	t->clk_div = div;
+
+	t->cs_on_time = round_to_extif_ticks(t->cs_on_time, div);
+
+	t->we_on_time = round_to_extif_ticks(t->we_on_time, div);
+	t->we_off_time = round_to_extif_ticks(t->we_off_time, div);
+	t->we_cycle_time = round_to_extif_ticks(t->we_cycle_time, div);
+
+	t->re_on_time = round_to_extif_ticks(t->re_on_time, div);
+	t->re_off_time = round_to_extif_ticks(t->re_off_time, div);
+	t->re_cycle_time = round_to_extif_ticks(t->re_cycle_time, div);
+
+	t->access_time = round_to_extif_ticks(t->access_time, div);
+	t->cs_off_time = round_to_extif_ticks(t->cs_off_time, div);
+	t->cs_pulse_width = round_to_extif_ticks(t->cs_pulse_width, div);
+
+	DSSDBG("[reg]cson %d csoff %d reon %d reoff %d\n",
+	       t->cs_on_time, t->cs_off_time, t->re_on_time, t->re_off_time);
+	DSSDBG("[reg]weon %d weoff %d recyc %d wecyc %d\n",
+	       t->we_on_time, t->we_off_time, t->re_cycle_time,
+	       t->we_cycle_time);
+	DSSDBG("[reg]rdaccess %d cspulse %d\n",
+	       t->access_time, t->cs_pulse_width);
+
+	return rfbi_convert_timings(t);
+}
+
+static int calc_extif_timings(struct rfbi_timings *t)
+{
+	u32 max_clk_div;
+	int div;
+
+	rfbi_get_clk_info(&extif_clk_period, &max_clk_div);
+	for (div = 1; div <= max_clk_div; div++) {
+		if (calc_reg_timing(t, div) == 0)
+			break;
+	}
+
+	if (div <= max_clk_div)
+		return 0;
+
+	DSSERR("can't setup timings\n");
+	return -1;
+}
+
+
+void rfbi_set_timings(int rfbi_module, struct rfbi_timings *t)
+{
+	int r;
+
+	if (!t->converted) {
+		r = calc_extif_timings(t);
+		if (r < 0)
+			DSSERR("Failed to calc timings\n");
+	}
+
+	BUG_ON(!t->converted);
+
+	rfbi_enable_clocks(1);
+	rfbi_write_reg(RFBI_ONOFF_TIME(rfbi_module), t->tim[0]);
+	rfbi_write_reg(RFBI_CYCLE_TIME(rfbi_module), t->tim[1]);
+
+	/* TIMEGRANULARITY */
+	REG_FLD_MOD(RFBI_CONFIG(rfbi_module),
+		    (t->tim[2] ? 1 : 0), 4, 4);
+
+	rfbi_print_timings();
+	rfbi_enable_clocks(0);
+}
+
+static int ps_to_rfbi_ticks(int time, int div)
+{
+	unsigned long tick_ps;
+	int ret;
+
+	/* Calculate in picosecs to yield more exact results */
+	tick_ps = 1000000000 / (rfbi.l4_khz) * div;
+
+	ret = (time + tick_ps - 1) / tick_ps;
+
+	return ret;
+}
+
+#ifdef OMAP_RFBI_RATE_LIMIT
+unsigned long rfbi_get_max_tx_rate(void)
+{
+	unsigned long   l4_rate, dss1_rate;
+	int             min_l4_ticks = 0;
+	int             i;
+
+	/* According to TI this can't be calculated so make the
+	 * adjustments for a couple of known frequencies and warn for
+	 * others.
+	 */
+	static const struct {
+		unsigned long l4_clk;           /* HZ */
+		unsigned long dss1_clk;         /* HZ */
+		unsigned long min_l4_ticks;
+	} ftab[] = {
+		{ 55,   132,    7, },           /* 7.86 MPix/s */
+		{ 110,  110,    12, },          /* 9.16 MPix/s */
+		{ 110,  132,    10, },          /* 11   Mpix/s */
+		{ 120,  120,    10, },          /* 12   Mpix/s */
+		{ 133,  133,    10, },          /* 13.3 Mpix/s */
+	};
+
+	l4_rate = rfbi.l4_khz / 1000;
+	dss1_rate = dss_clk_get_rate(DSS_CLK_FCK1) / 1000000;
+
+	for (i = 0; i < ARRAY_SIZE(ftab); i++) {
+		/* Use a window instead of an exact match, to account
+		 * for different DPLL multiplier / divider pairs.
+		 */
+		if (abs(ftab[i].l4_clk - l4_rate) < 3 &&
+		    abs(ftab[i].dss1_clk - dss1_rate) < 3) {
+			min_l4_ticks = ftab[i].min_l4_ticks;
+			break;
+		}
+	}
+	if (i == ARRAY_SIZE(ftab)) {
+		/* Can't be sure, return anyway the maximum not
+		 * rate-limited. This might cause a problem only for the
+		 * tearing synchronisation.
+		 */
+		DSSERR("can't determine maximum RFBI transfer rate\n");
+		return rfbi.l4_khz * 1000;
+	}
+	return rfbi.l4_khz * 1000 / min_l4_ticks;
+}
+#else
+int rfbi_get_max_tx_rate(void)
+{
+	return rfbi.l4_khz * 1000;
+}
+#endif
+
+static void rfbi_get_clk_info(u32 *clk_period, u32 *max_clk_div)
+{
+	*clk_period = 1000000000 / rfbi.l4_khz;
+	*max_clk_div = 2;
+}
+
+static int rfbi_convert_timings(struct rfbi_timings *t)
+{
+	u32 l;
+	int reon, reoff, weon, weoff, cson, csoff, cs_pulse;
+	int actim, recyc, wecyc;
+	int div = t->clk_div;
+
+	if (div <= 0 || div > 2)
+		return -1;
+
+	/* Make sure that after conversion it still holds that:
+	 * weoff > weon, reoff > reon, recyc >= reoff, wecyc >= weoff,
+	 * csoff > cson, csoff >= max(weoff, reoff), actim > reon
+	 */
+	weon = ps_to_rfbi_ticks(t->we_on_time, div);
+	weoff = ps_to_rfbi_ticks(t->we_off_time, div);
+	if (weoff <= weon)
+		weoff = weon + 1;
+	if (weon > 0x0f)
+		return -1;
+	if (weoff > 0x3f)
+		return -1;
+
+	reon = ps_to_rfbi_ticks(t->re_on_time, div);
+	reoff = ps_to_rfbi_ticks(t->re_off_time, div);
+	if (reoff <= reon)
+		reoff = reon + 1;
+	if (reon > 0x0f)
+		return -1;
+	if (reoff > 0x3f)
+		return -1;
+
+	cson = ps_to_rfbi_ticks(t->cs_on_time, div);
+	csoff = ps_to_rfbi_ticks(t->cs_off_time, div);
+	if (csoff <= cson)
+		csoff = cson + 1;
+	if (csoff < max(weoff, reoff))
+		csoff = max(weoff, reoff);
+	if (cson > 0x0f)
+		return -1;
+	if (csoff > 0x3f)
+		return -1;
+
+	l =  cson;
+	l |= csoff << 4;
+	l |= weon  << 10;
+	l |= weoff << 14;
+	l |= reon  << 20;
+	l |= reoff << 24;
+
+	t->tim[0] = l;
+
+	actim = ps_to_rfbi_ticks(t->access_time, div);
+	if (actim <= reon)
+		actim = reon + 1;
+	if (actim > 0x3f)
+		return -1;
+
+	wecyc = ps_to_rfbi_ticks(t->we_cycle_time, div);
+	if (wecyc < weoff)
+		wecyc = weoff;
+	if (wecyc > 0x3f)
+		return -1;
+
+	recyc = ps_to_rfbi_ticks(t->re_cycle_time, div);
+	if (recyc < reoff)
+		recyc = reoff;
+	if (recyc > 0x3f)
+		return -1;
+
+	cs_pulse = ps_to_rfbi_ticks(t->cs_pulse_width, div);
+	if (cs_pulse > 0x3f)
+		return -1;
+
+	l =  wecyc;
+	l |= recyc    << 6;
+	l |= cs_pulse << 12;
+	l |= actim    << 22;
+
+	t->tim[1] = l;
+
+	t->tim[2] = div - 1;
+
+	t->converted = 1;
+
+	return 0;
+}
+
+/* xxx FIX module selection missing */
+int omap_rfbi_setup_te(enum omap_rfbi_te_mode mode,
+			     unsigned hs_pulse_time, unsigned vs_pulse_time,
+			     int hs_pol_inv, int vs_pol_inv, int extif_div)
+{
+	int hs, vs;
+	int min;
+	u32 l;
+
+	hs = ps_to_rfbi_ticks(hs_pulse_time, 1);
+	vs = ps_to_rfbi_ticks(vs_pulse_time, 1);
+	if (hs < 2)
+		return -EDOM;
+	if (mode == OMAP_DSS_RFBI_TE_MODE_2)
+		min = 2;
+	else /* OMAP_DSS_RFBI_TE_MODE_1 */
+		min = 4;
+	if (vs < min)
+		return -EDOM;
+	if (vs == hs)
+		return -EINVAL;
+	rfbi.te_mode = mode;
+	DSSDBG("setup_te: mode %d hs %d vs %d hs_inv %d vs_inv %d\n",
+		mode, hs, vs, hs_pol_inv, vs_pol_inv);
+
+	rfbi_enable_clocks(1);
+	rfbi_write_reg(RFBI_HSYNC_WIDTH, hs);
+	rfbi_write_reg(RFBI_VSYNC_WIDTH, vs);
+
+	l = rfbi_read_reg(RFBI_CONFIG(0));
+	if (hs_pol_inv)
+		l &= ~(1 << 21);
+	else
+		l |= 1 << 21;
+	if (vs_pol_inv)
+		l &= ~(1 << 20);
+	else
+		l |= 1 << 20;
+	rfbi_enable_clocks(0);
+
+	return 0;
+}
+EXPORT_SYMBOL(omap_rfbi_setup_te);
+
+/* xxx FIX module selection missing */
+int omap_rfbi_enable_te(bool enable, unsigned line)
+{
+	u32 l;
+
+	DSSDBG("te %d line %d mode %d\n", enable, line, rfbi.te_mode);
+	if (line > (1 << 11) - 1)
+		return -EINVAL;
+
+	rfbi_enable_clocks(1);
+	l = rfbi_read_reg(RFBI_CONFIG(0));
+	l &= ~(0x3 << 2);
+	if (enable) {
+		rfbi.te_enabled = 1;
+		l |= rfbi.te_mode << 2;
+	} else
+		rfbi.te_enabled = 0;
+	rfbi_write_reg(RFBI_CONFIG(0), l);
+	rfbi_write_reg(RFBI_LINE_NUMBER, line);
+	rfbi_enable_clocks(0);
+
+	return 0;
+}
+EXPORT_SYMBOL(omap_rfbi_enable_te);
+
+#if 0
+static void rfbi_enable_config(int enable1, int enable2)
+{
+	u32 l;
+	int cs = 0;
+
+	if (enable1)
+		cs |= 1<<0;
+	if (enable2)
+		cs |= 1<<1;
+
+	rfbi_enable_clocks(1);
+
+	l = rfbi_read_reg(RFBI_CONTROL);
+
+	l = FLD_MOD(l, cs, 3, 2);
+	l = FLD_MOD(l, 0, 1, 1);
+
+	rfbi_write_reg(RFBI_CONTROL, l);
+
+
+	l = rfbi_read_reg(RFBI_CONFIG(0));
+	l = FLD_MOD(l, 0, 3, 2); /* TRIGGERMODE: ITE */
+	/*l |= FLD_VAL(2, 8, 7); */ /* L4FORMAT, 2pix/L4 */
+	/*l |= FLD_VAL(0, 8, 7); */ /* L4FORMAT, 1pix/L4 */
+
+	l = FLD_MOD(l, 0, 16, 16); /* A0POLARITY */
+	l = FLD_MOD(l, 1, 20, 20); /* TE_VSYNC_POLARITY */
+	l = FLD_MOD(l, 1, 21, 21); /* HSYNCPOLARITY */
+
+	l = FLD_MOD(l, OMAP_DSS_RFBI_PARALLELMODE_8, 1, 0);
+	rfbi_write_reg(RFBI_CONFIG(0), l);
+
+	rfbi_enable_clocks(0);
+}
+#endif
+
+int rfbi_configure(int rfbi_module, int bpp, int lines)
+{
+	u32 l;
+	int cycle1 = 0, cycle2 = 0, cycle3 = 0;
+	enum omap_rfbi_cycleformat cycleformat;
+	enum omap_rfbi_datatype datatype;
+	enum omap_rfbi_parallelmode parallelmode;
+
+	switch (bpp) {
+	case 12:
+		datatype = OMAP_DSS_RFBI_DATATYPE_12;
+		break;
+	case 16:
+		datatype = OMAP_DSS_RFBI_DATATYPE_16;
+		break;
+	case 18:
+		datatype = OMAP_DSS_RFBI_DATATYPE_18;
+		break;
+	case 24:
+		datatype = OMAP_DSS_RFBI_DATATYPE_24;
+		break;
+	default:
+		BUG();
+		return 1;
+	}
+	rfbi.datatype = datatype;
+
+	switch (lines) {
+	case 8:
+		parallelmode = OMAP_DSS_RFBI_PARALLELMODE_8;
+		break;
+	case 9:
+		parallelmode = OMAP_DSS_RFBI_PARALLELMODE_9;
+		break;
+	case 12:
+		parallelmode = OMAP_DSS_RFBI_PARALLELMODE_12;
+		break;
+	case 16:
+		parallelmode = OMAP_DSS_RFBI_PARALLELMODE_16;
+		break;
+	default:
+		BUG();
+		return 1;
+	}
+	rfbi.parallelmode = parallelmode;
+
+	if ((bpp % lines) == 0) {
+		switch (bpp / lines) {
+		case 1:
+			cycleformat = OMAP_DSS_RFBI_CYCLEFORMAT_1_1;
+			break;
+		case 2:
+			cycleformat = OMAP_DSS_RFBI_CYCLEFORMAT_2_1;
+			break;
+		case 3:
+			cycleformat = OMAP_DSS_RFBI_CYCLEFORMAT_3_1;
+			break;
+		default:
+			BUG();
+			return 1;
+		}
+	} else if ((2 * bpp % lines) == 0) {
+		if ((2 * bpp / lines) == 3)
+			cycleformat = OMAP_DSS_RFBI_CYCLEFORMAT_3_2;
+		else {
+			BUG();
+			return 1;
+		}
+	} else {
+		BUG();
+		return 1;
+	}
+
+	switch (cycleformat) {
+	case OMAP_DSS_RFBI_CYCLEFORMAT_1_1:
+		cycle1 = lines;
+		break;
+
+	case OMAP_DSS_RFBI_CYCLEFORMAT_2_1:
+		cycle1 = lines;
+		cycle2 = lines;
+		break;
+
+	case OMAP_DSS_RFBI_CYCLEFORMAT_3_1:
+		cycle1 = lines;
+		cycle2 = lines;
+		cycle3 = lines;
+		break;
+
+	case OMAP_DSS_RFBI_CYCLEFORMAT_3_2:
+		cycle1 = lines;
+		cycle2 = (lines / 2) | ((lines / 2) << 16);
+		cycle3 = (lines << 16);
+		break;
+	}
+
+	rfbi_enable_clocks(1);
+
+	REG_FLD_MOD(RFBI_CONTROL, 0, 3, 2); /* clear CS */
+
+	l = 0;
+	l |= FLD_VAL(parallelmode, 1, 0);
+	l |= FLD_VAL(0, 3, 2);		/* TRIGGERMODE: ITE */
+	l |= FLD_VAL(0, 4, 4);		/* TIMEGRANULARITY */
+	l |= FLD_VAL(datatype, 6, 5);
+	/* l |= FLD_VAL(2, 8, 7); */	/* L4FORMAT, 2pix/L4 */
+	l |= FLD_VAL(0, 8, 7);	/* L4FORMAT, 1pix/L4 */
+	l |= FLD_VAL(cycleformat, 10, 9);
+	l |= FLD_VAL(0, 12, 11);	/* UNUSEDBITS */
+	l |= FLD_VAL(0, 16, 16);	/* A0POLARITY */
+	l |= FLD_VAL(0, 17, 17);	/* REPOLARITY */
+	l |= FLD_VAL(0, 18, 18);	/* WEPOLARITY */
+	l |= FLD_VAL(0, 19, 19);	/* CSPOLARITY */
+	l |= FLD_VAL(1, 20, 20);	/* TE_VSYNC_POLARITY */
+	l |= FLD_VAL(1, 21, 21);	/* HSYNCPOLARITY */
+	rfbi_write_reg(RFBI_CONFIG(rfbi_module), l);
+
+	rfbi_write_reg(RFBI_DATA_CYCLE1(rfbi_module), cycle1);
+	rfbi_write_reg(RFBI_DATA_CYCLE2(rfbi_module), cycle2);
+	rfbi_write_reg(RFBI_DATA_CYCLE3(rfbi_module), cycle3);
+
+
+	l = rfbi_read_reg(RFBI_CONTROL);
+	l = FLD_MOD(l, rfbi_module+1, 3, 2); /* Select CSx */
+	l = FLD_MOD(l, 0, 1, 1); /* clear bypass */
+	rfbi_write_reg(RFBI_CONTROL, l);
+
+
+	DSSDBG("RFBI config: bpp %d, lines %d, cycles: 0x%x 0x%x 0x%x\n",
+	       bpp, lines, cycle1, cycle2, cycle3);
+
+	rfbi_enable_clocks(0);
+
+	return 0;
+}
+EXPORT_SYMBOL(rfbi_configure);
+
+static int rfbi_find_display(struct omap_dss_device *dssdev)
+{
+	if (dssdev == rfbi.dssdev[0])
+		return 0;
+
+	if (dssdev == rfbi.dssdev[1])
+		return 1;
+
+	BUG();
+	return -1;
+}
+
+
+static void signal_fifo_waiters(void)
+{
+	if (atomic_read(&rfbi.cmd_fifo_full) > 0) {
+		/* DSSDBG("SIGNALING: Fifo not full for waiter!\n"); */
+		complete(&rfbi.cmd_done);
+		atomic_dec(&rfbi.cmd_fifo_full);
+	}
+}
+
+/* returns 1 for async op, and 0 for sync op */
+static int do_update(struct omap_dss_device *dssdev, struct update_region *upd)
+{
+	u16 x = upd->x;
+	u16 y = upd->y;
+	u16 w = upd->w;
+	u16 h = upd->h;
+
+	perf_mark_setup();
+
+	if (dssdev->manager->caps & OMAP_DSS_OVL_MGR_CAP_DISPC) {
+		/*dssdev->driver->enable_te(dssdev, 1); */
+		dss_setup_partial_planes(dssdev, &x, &y, &w, &h);
+	}
+
+#ifdef MEASURE_PERF
+	rfbi.perf_bytes = w * h * 2; /* XXX always 16bit */
+#endif
+
+	dssdev->driver->setup_update(dssdev, x, y, w, h);
+
+	if (dssdev->manager->caps & OMAP_DSS_OVL_MGR_CAP_DISPC) {
+		rfbi_transfer_area(w, h, NULL, NULL);
+		return 1;
+	} else {
+		struct omap_overlay *ovl;
+		void __iomem *addr;
+		int scr_width;
+
+		ovl = dssdev->manager->overlays[0];
+		scr_width = ovl->info.screen_width;
+		addr = ovl->info.vaddr;
+
+		omap_rfbi_write_pixels(addr, scr_width, x, y, w, h);
+
+		perf_show("L4");
+
+		return 0;
+	}
+}
+
+static void process_cmd_fifo(void)
+{
+	int len;
+	struct update_param p;
+	struct omap_dss_device *dssdev;
+	unsigned long flags;
+
+	if (atomic_inc_return(&rfbi.cmd_pending) != 1)
+		return;
+
+	while (true) {
+		spin_lock_irqsave(&rfbi.cmd_lock, flags);
+
+		len = kfifo_out(&rfbi.cmd_fifo, (unsigned char *)&p,
+				  sizeof(struct update_param));
+		if (len == 0) {
+			DSSDBG("nothing more in fifo\n");
+			atomic_set(&rfbi.cmd_pending, 0);
+			spin_unlock_irqrestore(&rfbi.cmd_lock, flags);
+			break;
+		}
+
+		/* DSSDBG("fifo full %d\n", rfbi.cmd_fifo_full.counter);*/
+
+		spin_unlock_irqrestore(&rfbi.cmd_lock, flags);
+
+		BUG_ON(len != sizeof(struct update_param));
+		BUG_ON(p.rfbi_module > 1);
+
+		dssdev = rfbi.dssdev[p.rfbi_module];
+
+		if (p.cmd == RFBI_CMD_UPDATE) {
+			if (do_update(dssdev, &p.par.r))
+				break; /* async op */
+		} else if (p.cmd == RFBI_CMD_SYNC) {
+			DSSDBG("Signaling SYNC done!\n");
+			complete(p.par.sync);
+		} else
+			BUG();
+	}
+
+	signal_fifo_waiters();
+}
+
+static void rfbi_push_cmd(struct update_param *p)
+{
+	int ret;
+
+	while (1) {
+		unsigned long flags;
+		int available;
+
+		spin_lock_irqsave(&rfbi.cmd_lock, flags);
+		available = RFBI_CMD_FIFO_LEN_BYTES -
+			kfifo_len(&rfbi.cmd_fifo);
+
+/*		DSSDBG("%d bytes left in fifo\n", available); */
+		if (available < sizeof(struct update_param)) {
+			DSSDBG("Going to wait because FIFO FULL..\n");
+			spin_unlock_irqrestore(&rfbi.cmd_lock, flags);
+			atomic_inc(&rfbi.cmd_fifo_full);
+			wait_for_completion(&rfbi.cmd_done);
+			/*DSSDBG("Woke up because fifo not full anymore\n");*/
+			continue;
+		}
+
+		ret = kfifo_in(&rfbi.cmd_fifo, (unsigned char *)p,
+				  sizeof(struct update_param));
+/*		DSSDBG("pushed %d bytes\n", ret);*/
+
+		spin_unlock_irqrestore(&rfbi.cmd_lock, flags);
+
+		BUG_ON(ret != sizeof(struct update_param));
+
+		break;
+	}
+}
+
+static void rfbi_push_update(int rfbi_module, int x, int y, int w, int h)
+{
+	struct update_param p;
+
+	p.rfbi_module = rfbi_module;
+	p.cmd = RFBI_CMD_UPDATE;
+
+	p.par.r.x = x;
+	p.par.r.y = y;
+	p.par.r.w = w;
+	p.par.r.h = h;
+
+	DSSDBG("RFBI pushed %d,%d %dx%d\n", x, y, w, h);
+
+	rfbi_push_cmd(&p);
+
+	process_cmd_fifo();
+}
+
+static void rfbi_push_sync(int rfbi_module, struct completion *sync_comp)
+{
+	struct update_param p;
+
+	p.rfbi_module = rfbi_module;
+	p.cmd = RFBI_CMD_SYNC;
+	p.par.sync = sync_comp;
+
+	rfbi_push_cmd(&p);
+
+	DSSDBG("RFBI sync pushed to cmd fifo\n");
+
+	process_cmd_fifo();
+}
+
+void rfbi_dump_regs(struct seq_file *s)
+{
+#define DUMPREG(r) seq_printf(s, "%-35s %08x\n", #r, rfbi_read_reg(r))
+
+	dss_clk_enable(DSS_CLK_ICK | DSS_CLK_FCK1);
+
+	DUMPREG(RFBI_REVISION);
+	DUMPREG(RFBI_SYSCONFIG);
+	DUMPREG(RFBI_SYSSTATUS);
+	DUMPREG(RFBI_CONTROL);
+	DUMPREG(RFBI_PIXEL_CNT);
+	DUMPREG(RFBI_LINE_NUMBER);
+	DUMPREG(RFBI_CMD);
+	DUMPREG(RFBI_PARAM);
+	DUMPREG(RFBI_DATA);
+	DUMPREG(RFBI_READ);
+	DUMPREG(RFBI_STATUS);
+
+	DUMPREG(RFBI_CONFIG(0));
+	DUMPREG(RFBI_ONOFF_TIME(0));
+	DUMPREG(RFBI_CYCLE_TIME(0));
+	DUMPREG(RFBI_DATA_CYCLE1(0));
+	DUMPREG(RFBI_DATA_CYCLE2(0));
+	DUMPREG(RFBI_DATA_CYCLE3(0));
+
+	DUMPREG(RFBI_CONFIG(1));
+	DUMPREG(RFBI_ONOFF_TIME(1));
+	DUMPREG(RFBI_CYCLE_TIME(1));
+	DUMPREG(RFBI_DATA_CYCLE1(1));
+	DUMPREG(RFBI_DATA_CYCLE2(1));
+	DUMPREG(RFBI_DATA_CYCLE3(1));
+
+	DUMPREG(RFBI_VSYNC_WIDTH);
+	DUMPREG(RFBI_HSYNC_WIDTH);
+
+	dss_clk_disable(DSS_CLK_ICK | DSS_CLK_FCK1);
+#undef DUMPREG
+}
+
+int rfbi_init(void)
+{
+	u32 rev;
+	u32 l;
+	int r;
+
+	spin_lock_init(&rfbi.cmd_lock);
+	r = kfifo_alloc(&rfbi.cmd_fifo, RFBI_CMD_FIFO_LEN_BYTES, GFP_KERNEL);
+	if (r)
+		return r;
+
+	init_completion(&rfbi.cmd_done);
+	atomic_set(&rfbi.cmd_fifo_full, 0);
+	atomic_set(&rfbi.cmd_pending, 0);
+
+	rfbi.base = ioremap(RFBI_BASE, SZ_256);
+	if (!rfbi.base) {
+		DSSERR("can't ioremap RFBI\n");
+		return -ENOMEM;
+	}
+
+	rfbi_enable_clocks(1);
+
+	msleep(10);
+
+	rfbi.l4_khz = dss_clk_get_rate(DSS_CLK_ICK) / 1000;
+
+	/* Enable autoidle and smart-idle */
+	l = rfbi_read_reg(RFBI_SYSCONFIG);
+	l |= (1 << 0) | (2 << 3);
+	rfbi_write_reg(RFBI_SYSCONFIG, l);
+
+	rev = rfbi_read_reg(RFBI_REVISION);
+	printk(KERN_INFO "OMAP RFBI rev %d.%d\n",
+	       FLD_GET(rev, 7, 4), FLD_GET(rev, 3, 0));
+
+	rfbi_enable_clocks(0);
+
+	return 0;
+}
+
+void rfbi_exit(void)
+{
+	DSSDBG("rfbi_exit\n");
+
+	kfifo_free(&rfbi.cmd_fifo);
+
+	iounmap(rfbi.base);
+}
+
+/* struct omap_display support */
+static int rfbi_display_update(struct omap_dss_device *dssdev,
+			u16 x, u16 y, u16 w, u16 h)
+{
+	int rfbi_module;
+
+	if (w == 0 || h == 0)
+		return 0;
+
+	rfbi_module = rfbi_find_display(dssdev);
+
+	rfbi_push_update(rfbi_module, x, y, w, h);
+
+	return 0;
+}
+
+static int rfbi_display_sync(struct omap_dss_device *dssdev)
+{
+	struct completion sync_comp;
+	int rfbi_module;
+
+	rfbi_module = rfbi_find_display(dssdev);
+
+	init_completion(&sync_comp);
+	rfbi_push_sync(rfbi_module, &sync_comp);
+	DSSDBG("Waiting for SYNC to happen...\n");
+	wait_for_completion(&sync_comp);
+	DSSDBG("Released from SYNC\n");
+	return 0;
+}
+
+static int rfbi_display_enable_te(struct omap_dss_device *dssdev, bool enable)
+{
+	dssdev->driver->enable_te(dssdev, enable);
+	return 0;
+}
+
+static int rfbi_display_enable(struct omap_dss_device *dssdev)
+{
+	int r;
+
+	r = omap_dss_start_device(dssdev);
+	if (r) {
+		DSSERR("failed to start device\n");
+		goto err0;
+	}
+
+	r = omap_dispc_register_isr(framedone_callback, NULL,
+			DISPC_IRQ_FRAMEDONE);
+	if (r) {
+		DSSERR("can't get FRAMEDONE irq\n");
+		goto err1;
+	}
+
+	dispc_set_lcd_display_type(OMAP_DSS_LCD_DISPLAY_TFT);
+
+	dispc_set_parallel_interface_mode(OMAP_DSS_PARALLELMODE_RFBI);
+
+	dispc_set_tft_data_lines(dssdev->ctrl.pixel_size);
+
+	rfbi_configure(dssdev->phy.rfbi.channel,
+			       dssdev->ctrl.pixel_size,
+			       dssdev->phy.rfbi.data_lines);
+
+	rfbi_set_timings(dssdev->phy.rfbi.channel,
+			 &dssdev->ctrl.rfbi_timings);
+
+
+	if (dssdev->driver->enable) {
+		r = dssdev->driver->enable(dssdev);
+		if (r)
+			goto err2;
+	}
+
+	return 0;
+err2:
+	omap_dispc_unregister_isr(framedone_callback, NULL,
+			DISPC_IRQ_FRAMEDONE);
+err1:
+	omap_dss_stop_device(dssdev);
+err0:
+	return r;
+}
+
+static void rfbi_display_disable(struct omap_dss_device *dssdev)
+{
+	dssdev->driver->disable(dssdev);
+	omap_dispc_unregister_isr(framedone_callback, NULL,
+			DISPC_IRQ_FRAMEDONE);
+	omap_dss_stop_device(dssdev);
+}
+
+int rfbi_init_display(struct omap_dss_device *dssdev)
+{
+	dssdev->enable = rfbi_display_enable;
+	dssdev->disable = rfbi_display_disable;
+	dssdev->update = rfbi_display_update;
+	dssdev->sync = rfbi_display_sync;
+	dssdev->enable_te = rfbi_display_enable_te;
+
+	rfbi.dssdev[dssdev->phy.rfbi.channel] = dssdev;
+
+	dssdev->caps = OMAP_DSS_DISPLAY_CAP_MANUAL_UPDATE;
+
+	return 0;
+}
diff --git a/drivers/video/omap2/dss/sdi.c b/drivers/video/omap2/dss/sdi.c
new file mode 100644
index 000000000000..c24f307d3da1
--- /dev/null
+++ b/drivers/video/omap2/dss/sdi.c
@@ -0,0 +1,277 @@
+/*
+ * linux/drivers/video/omap2/dss/sdi.c
+ *
+ * Copyright (C) 2009 Nokia Corporation
+ * Author: Tomi Valkeinen <tomi.valkeinen@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#define DSS_SUBSYS_NAME "SDI"
+
+#include <linux/kernel.h>
+#include <linux/clk.h>
+#include <linux/delay.h>
+#include <linux/err.h>
+
+#include <plat/display.h>
+#include "dss.h"
+
+static struct {
+	bool skip_init;
+	bool update_enabled;
+} sdi;
+
+static void sdi_basic_init(void)
+{
+	dispc_set_parallel_interface_mode(OMAP_DSS_PARALLELMODE_BYPASS);
+
+	dispc_set_lcd_display_type(OMAP_DSS_LCD_DISPLAY_TFT);
+	dispc_set_tft_data_lines(24);
+	dispc_lcd_enable_signal_polarity(1);
+}
+
+static int sdi_display_enable(struct omap_dss_device *dssdev)
+{
+	struct omap_video_timings *t = &dssdev->panel.timings;
+	struct dss_clock_info dss_cinfo;
+	struct dispc_clock_info dispc_cinfo;
+	u16 lck_div, pck_div;
+	unsigned long fck;
+	unsigned long pck;
+	int r;
+
+	r = omap_dss_start_device(dssdev);
+	if (r) {
+		DSSERR("failed to start device\n");
+		goto err0;
+	}
+
+	if (dssdev->state != OMAP_DSS_DISPLAY_DISABLED) {
+		DSSERR("dssdev already enabled\n");
+		r = -EINVAL;
+		goto err1;
+	}
+
+	/* In case of skip_init sdi_init has already enabled the clocks */
+	if (!sdi.skip_init)
+		dss_clk_enable(DSS_CLK_ICK | DSS_CLK_FCK1);
+
+	sdi_basic_init();
+
+	/* 15.5.9.1.2 */
+	dssdev->panel.config |= OMAP_DSS_LCD_RF | OMAP_DSS_LCD_ONOFF;
+
+	dispc_set_pol_freq(dssdev->panel.config, dssdev->panel.acbi,
+			dssdev->panel.acb);
+
+	if (!sdi.skip_init) {
+		r = dss_calc_clock_div(1, t->pixel_clock * 1000,
+				&dss_cinfo, &dispc_cinfo);
+	} else {
+		r = dss_get_clock_div(&dss_cinfo);
+		r = dispc_get_clock_div(&dispc_cinfo);
+	}
+
+	if (r)
+		goto err2;
+
+	fck = dss_cinfo.fck;
+	lck_div = dispc_cinfo.lck_div;
+	pck_div = dispc_cinfo.pck_div;
+
+	pck = fck / lck_div / pck_div / 1000;
+
+	if (pck != t->pixel_clock) {
+		DSSWARN("Could not find exact pixel clock. Requested %d kHz, "
+				"got %lu kHz\n",
+				t->pixel_clock, pck);
+
+		t->pixel_clock = pck;
+	}
+
+
+	dispc_set_lcd_timings(t);
+
+	r = dss_set_clock_div(&dss_cinfo);
+	if (r)
+		goto err2;
+
+	r = dispc_set_clock_div(&dispc_cinfo);
+	if (r)
+		goto err2;
+
+	if (!sdi.skip_init) {
+		dss_sdi_init(dssdev->phy.sdi.datapairs);
+		r = dss_sdi_enable();
+		if (r)
+			goto err1;
+		mdelay(2);
+	}
+
+	dispc_enable_lcd_out(1);
+
+	if (dssdev->driver->enable) {
+		r = dssdev->driver->enable(dssdev);
+		if (r)
+			goto err3;
+	}
+
+	dssdev->state = OMAP_DSS_DISPLAY_ACTIVE;
+
+	sdi.skip_init = 0;
+
+	return 0;
+err3:
+	dispc_enable_lcd_out(0);
+err2:
+	dss_clk_disable(DSS_CLK_ICK | DSS_CLK_FCK1);
+err1:
+	omap_dss_stop_device(dssdev);
+err0:
+	return r;
+}
+
+static int sdi_display_resume(struct omap_dss_device *dssdev);
+
+static void sdi_display_disable(struct omap_dss_device *dssdev)
+{
+	if (dssdev->state == OMAP_DSS_DISPLAY_DISABLED)
+		return;
+
+	if (dssdev->state == OMAP_DSS_DISPLAY_SUSPENDED)
+		if (sdi_display_resume(dssdev))
+			return;
+
+	if (dssdev->driver->disable)
+		dssdev->driver->disable(dssdev);
+
+	dispc_enable_lcd_out(0);
+
+	dss_sdi_disable();
+
+	dss_clk_disable(DSS_CLK_ICK | DSS_CLK_FCK1);
+
+	dssdev->state = OMAP_DSS_DISPLAY_DISABLED;
+
+	omap_dss_stop_device(dssdev);
+}
+
+static int sdi_display_suspend(struct omap_dss_device *dssdev)
+{
+	if (dssdev->state != OMAP_DSS_DISPLAY_ACTIVE)
+		return -EINVAL;
+
+	if (dssdev->driver->suspend)
+		dssdev->driver->suspend(dssdev);
+
+	dispc_enable_lcd_out(0);
+
+	dss_sdi_disable();
+
+	dss_clk_disable(DSS_CLK_ICK | DSS_CLK_FCK1);
+
+	dssdev->state = OMAP_DSS_DISPLAY_SUSPENDED;
+
+	return 0;
+}
+
+static int sdi_display_resume(struct omap_dss_device *dssdev)
+{
+	int r;
+
+	if (dssdev->state != OMAP_DSS_DISPLAY_SUSPENDED)
+		return -EINVAL;
+
+	dss_clk_enable(DSS_CLK_ICK | DSS_CLK_FCK1);
+
+	r = dss_sdi_enable();
+	if (r)
+		goto err;
+	mdelay(2);
+
+	dispc_enable_lcd_out(1);
+
+	if (dssdev->driver->resume)
+		dssdev->driver->resume(dssdev);
+
+	dssdev->state = OMAP_DSS_DISPLAY_ACTIVE;
+
+	return 0;
+err:
+	dss_clk_disable(DSS_CLK_ICK | DSS_CLK_FCK1);
+	return r;
+}
+
+static int sdi_display_set_update_mode(struct omap_dss_device *dssdev,
+		enum omap_dss_update_mode mode)
+{
+	if (mode == OMAP_DSS_UPDATE_MANUAL)
+		return -EINVAL;
+
+	if (mode == OMAP_DSS_UPDATE_DISABLED) {
+		dispc_enable_lcd_out(0);
+		sdi.update_enabled = 0;
+	} else {
+		dispc_enable_lcd_out(1);
+		sdi.update_enabled = 1;
+	}
+
+	return 0;
+}
+
+static enum omap_dss_update_mode sdi_display_get_update_mode(
+		struct omap_dss_device *dssdev)
+{
+	return sdi.update_enabled ? OMAP_DSS_UPDATE_AUTO :
+		OMAP_DSS_UPDATE_DISABLED;
+}
+
+static void sdi_get_timings(struct omap_dss_device *dssdev,
+			struct omap_video_timings *timings)
+{
+	*timings = dssdev->panel.timings;
+}
+
+int sdi_init_display(struct omap_dss_device *dssdev)
+{
+	DSSDBG("SDI init\n");
+
+	dssdev->enable = sdi_display_enable;
+	dssdev->disable = sdi_display_disable;
+	dssdev->suspend = sdi_display_suspend;
+	dssdev->resume = sdi_display_resume;
+	dssdev->set_update_mode = sdi_display_set_update_mode;
+	dssdev->get_update_mode = sdi_display_get_update_mode;
+	dssdev->get_timings = sdi_get_timings;
+
+	return 0;
+}
+
+int sdi_init(bool skip_init)
+{
+	/* we store this for first display enable, then clear it */
+	sdi.skip_init = skip_init;
+
+	/*
+	 * Enable clocks already here, otherwise there would be a toggle
+	 * of them until sdi_display_enable is called.
+	 */
+	if (skip_init)
+		dss_clk_enable(DSS_CLK_ICK | DSS_CLK_FCK1);
+	return 0;
+}
+
+void sdi_exit(void)
+{
+}
diff --git a/drivers/video/omap2/dss/venc.c b/drivers/video/omap2/dss/venc.c
new file mode 100644
index 000000000000..749a5a0f5be4
--- /dev/null
+++ b/drivers/video/omap2/dss/venc.c
@@ -0,0 +1,797 @@
+/*
+ * linux/drivers/video/omap2/dss/venc.c
+ *
+ * Copyright (C) 2009 Nokia Corporation
+ * Author: Tomi Valkeinen <tomi.valkeinen@nokia.com>
+ *
+ * VENC settings from TI's DSS driver
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#define DSS_SUBSYS_NAME "VENC"
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/clk.h>
+#include <linux/err.h>
+#include <linux/io.h>
+#include <linux/mutex.h>
+#include <linux/completion.h>
+#include <linux/delay.h>
+#include <linux/string.h>
+#include <linux/seq_file.h>
+#include <linux/platform_device.h>
+#include <linux/regulator/consumer.h>
+
+#include <plat/display.h>
+#include <plat/cpu.h>
+
+#include "dss.h"
+
+#define VENC_BASE	0x48050C00
+
+/* Venc registers */
+#define VENC_REV_ID				0x00
+#define VENC_STATUS				0x04
+#define VENC_F_CONTROL				0x08
+#define VENC_VIDOUT_CTRL			0x10
+#define VENC_SYNC_CTRL				0x14
+#define VENC_LLEN				0x1C
+#define VENC_FLENS				0x20
+#define VENC_HFLTR_CTRL				0x24
+#define VENC_CC_CARR_WSS_CARR			0x28
+#define VENC_C_PHASE				0x2C
+#define VENC_GAIN_U				0x30
+#define VENC_GAIN_V				0x34
+#define VENC_GAIN_Y				0x38
+#define VENC_BLACK_LEVEL			0x3C
+#define VENC_BLANK_LEVEL			0x40
+#define VENC_X_COLOR				0x44
+#define VENC_M_CONTROL				0x48
+#define VENC_BSTAMP_WSS_DATA			0x4C
+#define VENC_S_CARR				0x50
+#define VENC_LINE21				0x54
+#define VENC_LN_SEL				0x58
+#define VENC_L21__WC_CTL			0x5C
+#define VENC_HTRIGGER_VTRIGGER			0x60
+#define VENC_SAVID__EAVID			0x64
+#define VENC_FLEN__FAL				0x68
+#define VENC_LAL__PHASE_RESET			0x6C
+#define VENC_HS_INT_START_STOP_X		0x70
+#define VENC_HS_EXT_START_STOP_X		0x74
+#define VENC_VS_INT_START_X			0x78
+#define VENC_VS_INT_STOP_X__VS_INT_START_Y	0x7C
+#define VENC_VS_INT_STOP_Y__VS_EXT_START_X	0x80
+#define VENC_VS_EXT_STOP_X__VS_EXT_START_Y	0x84
+#define VENC_VS_EXT_STOP_Y			0x88
+#define VENC_AVID_START_STOP_X			0x90
+#define VENC_AVID_START_STOP_Y			0x94
+#define VENC_FID_INT_START_X__FID_INT_START_Y	0xA0
+#define VENC_FID_INT_OFFSET_Y__FID_EXT_START_X	0xA4
+#define VENC_FID_EXT_START_Y__FID_EXT_OFFSET_Y	0xA8
+#define VENC_TVDETGP_INT_START_STOP_X		0xB0
+#define VENC_TVDETGP_INT_START_STOP_Y		0xB4
+#define VENC_GEN_CTRL				0xB8
+#define VENC_OUTPUT_CONTROL			0xC4
+#define VENC_OUTPUT_TEST			0xC8
+#define VENC_DAC_B__DAC_C			0xC8
+
+struct venc_config {
+	u32 f_control;
+	u32 vidout_ctrl;
+	u32 sync_ctrl;
+	u32 llen;
+	u32 flens;
+	u32 hfltr_ctrl;
+	u32 cc_carr_wss_carr;
+	u32 c_phase;
+	u32 gain_u;
+	u32 gain_v;
+	u32 gain_y;
+	u32 black_level;
+	u32 blank_level;
+	u32 x_color;
+	u32 m_control;
+	u32 bstamp_wss_data;
+	u32 s_carr;
+	u32 line21;
+	u32 ln_sel;
+	u32 l21__wc_ctl;
+	u32 htrigger_vtrigger;
+	u32 savid__eavid;
+	u32 flen__fal;
+	u32 lal__phase_reset;
+	u32 hs_int_start_stop_x;
+	u32 hs_ext_start_stop_x;
+	u32 vs_int_start_x;
+	u32 vs_int_stop_x__vs_int_start_y;
+	u32 vs_int_stop_y__vs_ext_start_x;
+	u32 vs_ext_stop_x__vs_ext_start_y;
+	u32 vs_ext_stop_y;
+	u32 avid_start_stop_x;
+	u32 avid_start_stop_y;
+	u32 fid_int_start_x__fid_int_start_y;
+	u32 fid_int_offset_y__fid_ext_start_x;
+	u32 fid_ext_start_y__fid_ext_offset_y;
+	u32 tvdetgp_int_start_stop_x;
+	u32 tvdetgp_int_start_stop_y;
+	u32 gen_ctrl;
+};
+
+/* from TRM */
+static const struct venc_config venc_config_pal_trm = {
+	.f_control				= 0,
+	.vidout_ctrl				= 1,
+	.sync_ctrl				= 0x40,
+	.llen					= 0x35F, /* 863 */
+	.flens					= 0x270, /* 624 */
+	.hfltr_ctrl				= 0,
+	.cc_carr_wss_carr			= 0x2F7225ED,
+	.c_phase				= 0,
+	.gain_u					= 0x111,
+	.gain_v					= 0x181,
+	.gain_y					= 0x140,
+	.black_level				= 0x3B,
+	.blank_level				= 0x3B,
+	.x_color				= 0x7,
+	.m_control				= 0x2,
+	.bstamp_wss_data			= 0x3F,
+	.s_carr					= 0x2A098ACB,
+	.line21					= 0,
+	.ln_sel					= 0x01290015,
+	.l21__wc_ctl				= 0x0000F603,
+	.htrigger_vtrigger			= 0,
+
+	.savid__eavid				= 0x06A70108,
+	.flen__fal				= 0x00180270,
+	.lal__phase_reset			= 0x00040135,
+	.hs_int_start_stop_x			= 0x00880358,
+	.hs_ext_start_stop_x			= 0x000F035F,
+	.vs_int_start_x				= 0x01A70000,
+	.vs_int_stop_x__vs_int_start_y		= 0x000001A7,
+	.vs_int_stop_y__vs_ext_start_x		= 0x01AF0000,
+	.vs_ext_stop_x__vs_ext_start_y		= 0x000101AF,
+	.vs_ext_stop_y				= 0x00000025,
+	.avid_start_stop_x			= 0x03530083,
+	.avid_start_stop_y			= 0x026C002E,
+	.fid_int_start_x__fid_int_start_y	= 0x0001008A,
+	.fid_int_offset_y__fid_ext_start_x	= 0x002E0138,
+	.fid_ext_start_y__fid_ext_offset_y	= 0x01380001,
+
+	.tvdetgp_int_start_stop_x		= 0x00140001,
+	.tvdetgp_int_start_stop_y		= 0x00010001,
+	.gen_ctrl				= 0x00FF0000,
+};
+
+/* from TRM */
+static const struct venc_config venc_config_ntsc_trm = {
+	.f_control				= 0,
+	.vidout_ctrl				= 1,
+	.sync_ctrl				= 0x8040,
+	.llen					= 0x359,
+	.flens					= 0x20C,
+	.hfltr_ctrl				= 0,
+	.cc_carr_wss_carr			= 0x043F2631,
+	.c_phase				= 0,
+	.gain_u					= 0x102,
+	.gain_v					= 0x16C,
+	.gain_y					= 0x12F,
+	.black_level				= 0x43,
+	.blank_level				= 0x38,
+	.x_color				= 0x7,
+	.m_control				= 0x1,
+	.bstamp_wss_data			= 0x38,
+	.s_carr					= 0x21F07C1F,
+	.line21					= 0,
+	.ln_sel					= 0x01310011,
+	.l21__wc_ctl				= 0x0000F003,
+	.htrigger_vtrigger			= 0,
+
+	.savid__eavid				= 0x069300F4,
+	.flen__fal				= 0x0016020C,
+	.lal__phase_reset			= 0x00060107,
+	.hs_int_start_stop_x			= 0x008E0350,
+	.hs_ext_start_stop_x			= 0x000F0359,
+	.vs_int_start_x				= 0x01A00000,
+	.vs_int_stop_x__vs_int_start_y		= 0x020701A0,
+	.vs_int_stop_y__vs_ext_start_x		= 0x01AC0024,
+	.vs_ext_stop_x__vs_ext_start_y		= 0x020D01AC,
+	.vs_ext_stop_y				= 0x00000006,
+	.avid_start_stop_x			= 0x03480078,
+	.avid_start_stop_y			= 0x02060024,
+	.fid_int_start_x__fid_int_start_y	= 0x0001008A,
+	.fid_int_offset_y__fid_ext_start_x	= 0x01AC0106,
+	.fid_ext_start_y__fid_ext_offset_y	= 0x01060006,
+
+	.tvdetgp_int_start_stop_x		= 0x00140001,
+	.tvdetgp_int_start_stop_y		= 0x00010001,
+	.gen_ctrl				= 0x00F90000,
+};
+
+static const struct venc_config venc_config_pal_bdghi = {
+	.f_control				= 0,
+	.vidout_ctrl				= 0,
+	.sync_ctrl				= 0,
+	.hfltr_ctrl				= 0,
+	.x_color				= 0,
+	.line21					= 0,
+	.ln_sel					= 21,
+	.htrigger_vtrigger			= 0,
+	.tvdetgp_int_start_stop_x		= 0x00140001,
+	.tvdetgp_int_start_stop_y		= 0x00010001,
+	.gen_ctrl				= 0x00FB0000,
+
+	.llen					= 864-1,
+	.flens					= 625-1,
+	.cc_carr_wss_carr			= 0x2F7625ED,
+	.c_phase				= 0xDF,
+	.gain_u					= 0x111,
+	.gain_v					= 0x181,
+	.gain_y					= 0x140,
+	.black_level				= 0x3e,
+	.blank_level				= 0x3e,
+	.m_control				= 0<<2 | 1<<1,
+	.bstamp_wss_data			= 0x42,
+	.s_carr					= 0x2a098acb,
+	.l21__wc_ctl				= 0<<13 | 0x16<<8 | 0<<0,
+	.savid__eavid				= 0x06A70108,
+	.flen__fal				= 23<<16 | 624<<0,
+	.lal__phase_reset			= 2<<17 | 310<<0,
+	.hs_int_start_stop_x			= 0x00920358,
+	.hs_ext_start_stop_x			= 0x000F035F,
+	.vs_int_start_x				= 0x1a7<<16,
+	.vs_int_stop_x__vs_int_start_y		= 0x000601A7,
+	.vs_int_stop_y__vs_ext_start_x		= 0x01AF0036,
+	.vs_ext_stop_x__vs_ext_start_y		= 0x27101af,
+	.vs_ext_stop_y				= 0x05,
+	.avid_start_stop_x			= 0x03530082,
+	.avid_start_stop_y			= 0x0270002E,
+	.fid_int_start_x__fid_int_start_y	= 0x0005008A,
+	.fid_int_offset_y__fid_ext_start_x	= 0x002E0138,
+	.fid_ext_start_y__fid_ext_offset_y	= 0x01380005,
+};
+
+const struct omap_video_timings omap_dss_pal_timings = {
+	.x_res		= 720,
+	.y_res		= 574,
+	.pixel_clock	= 13500,
+	.hsw		= 64,
+	.hfp		= 12,
+	.hbp		= 68,
+	.vsw		= 5,
+	.vfp		= 5,
+	.vbp		= 41,
+};
+EXPORT_SYMBOL(omap_dss_pal_timings);
+
+const struct omap_video_timings omap_dss_ntsc_timings = {
+	.x_res		= 720,
+	.y_res		= 482,
+	.pixel_clock	= 13500,
+	.hsw		= 64,
+	.hfp		= 16,
+	.hbp		= 58,
+	.vsw		= 6,
+	.vfp		= 6,
+	.vbp		= 31,
+};
+EXPORT_SYMBOL(omap_dss_ntsc_timings);
+
+static struct {
+	void __iomem *base;
+	struct mutex venc_lock;
+	u32 wss_data;
+	struct regulator *vdda_dac_reg;
+} venc;
+
+static inline void venc_write_reg(int idx, u32 val)
+{
+	__raw_writel(val, venc.base + idx);
+}
+
+static inline u32 venc_read_reg(int idx)
+{
+	u32 l = __raw_readl(venc.base + idx);
+	return l;
+}
+
+static void venc_write_config(const struct venc_config *config)
+{
+	DSSDBG("write venc conf\n");
+
+	venc_write_reg(VENC_LLEN, config->llen);
+	venc_write_reg(VENC_FLENS, config->flens);
+	venc_write_reg(VENC_CC_CARR_WSS_CARR, config->cc_carr_wss_carr);
+	venc_write_reg(VENC_C_PHASE, config->c_phase);
+	venc_write_reg(VENC_GAIN_U, config->gain_u);
+	venc_write_reg(VENC_GAIN_V, config->gain_v);
+	venc_write_reg(VENC_GAIN_Y, config->gain_y);
+	venc_write_reg(VENC_BLACK_LEVEL, config->black_level);
+	venc_write_reg(VENC_BLANK_LEVEL, config->blank_level);
+	venc_write_reg(VENC_M_CONTROL, config->m_control);
+	venc_write_reg(VENC_BSTAMP_WSS_DATA, config->bstamp_wss_data |
+			venc.wss_data);
+	venc_write_reg(VENC_S_CARR, config->s_carr);
+	venc_write_reg(VENC_L21__WC_CTL, config->l21__wc_ctl);
+	venc_write_reg(VENC_SAVID__EAVID, config->savid__eavid);
+	venc_write_reg(VENC_FLEN__FAL, config->flen__fal);
+	venc_write_reg(VENC_LAL__PHASE_RESET, config->lal__phase_reset);
+	venc_write_reg(VENC_HS_INT_START_STOP_X, config->hs_int_start_stop_x);
+	venc_write_reg(VENC_HS_EXT_START_STOP_X, config->hs_ext_start_stop_x);
+	venc_write_reg(VENC_VS_INT_START_X, config->vs_int_start_x);
+	venc_write_reg(VENC_VS_INT_STOP_X__VS_INT_START_Y,
+		       config->vs_int_stop_x__vs_int_start_y);
+	venc_write_reg(VENC_VS_INT_STOP_Y__VS_EXT_START_X,
+		       config->vs_int_stop_y__vs_ext_start_x);
+	venc_write_reg(VENC_VS_EXT_STOP_X__VS_EXT_START_Y,
+		       config->vs_ext_stop_x__vs_ext_start_y);
+	venc_write_reg(VENC_VS_EXT_STOP_Y, config->vs_ext_stop_y);
+	venc_write_reg(VENC_AVID_START_STOP_X, config->avid_start_stop_x);
+	venc_write_reg(VENC_AVID_START_STOP_Y, config->avid_start_stop_y);
+	venc_write_reg(VENC_FID_INT_START_X__FID_INT_START_Y,
+		       config->fid_int_start_x__fid_int_start_y);
+	venc_write_reg(VENC_FID_INT_OFFSET_Y__FID_EXT_START_X,
+		       config->fid_int_offset_y__fid_ext_start_x);
+	venc_write_reg(VENC_FID_EXT_START_Y__FID_EXT_OFFSET_Y,
+		       config->fid_ext_start_y__fid_ext_offset_y);
+
+	venc_write_reg(VENC_DAC_B__DAC_C,  venc_read_reg(VENC_DAC_B__DAC_C));
+	venc_write_reg(VENC_VIDOUT_CTRL, config->vidout_ctrl);
+	venc_write_reg(VENC_HFLTR_CTRL, config->hfltr_ctrl);
+	venc_write_reg(VENC_X_COLOR, config->x_color);
+	venc_write_reg(VENC_LINE21, config->line21);
+	venc_write_reg(VENC_LN_SEL, config->ln_sel);
+	venc_write_reg(VENC_HTRIGGER_VTRIGGER, config->htrigger_vtrigger);
+	venc_write_reg(VENC_TVDETGP_INT_START_STOP_X,
+		       config->tvdetgp_int_start_stop_x);
+	venc_write_reg(VENC_TVDETGP_INT_START_STOP_Y,
+		       config->tvdetgp_int_start_stop_y);
+	venc_write_reg(VENC_GEN_CTRL, config->gen_ctrl);
+	venc_write_reg(VENC_F_CONTROL, config->f_control);
+	venc_write_reg(VENC_SYNC_CTRL, config->sync_ctrl);
+}
+
+static void venc_reset(void)
+{
+	int t = 1000;
+
+	venc_write_reg(VENC_F_CONTROL, 1<<8);
+	while (venc_read_reg(VENC_F_CONTROL) & (1<<8)) {
+		if (--t == 0) {
+			DSSERR("Failed to reset venc\n");
+			return;
+		}
+	}
+
+	/* the magical sleep that makes things work */
+	msleep(20);
+}
+
+static void venc_enable_clocks(int enable)
+{
+	if (enable)
+		dss_clk_enable(DSS_CLK_ICK | DSS_CLK_FCK1 | DSS_CLK_54M |
+				DSS_CLK_96M);
+	else
+		dss_clk_disable(DSS_CLK_ICK | DSS_CLK_FCK1 | DSS_CLK_54M |
+				DSS_CLK_96M);
+}
+
+static const struct venc_config *venc_timings_to_config(
+		struct omap_video_timings *timings)
+{
+	if (memcmp(&omap_dss_pal_timings, timings, sizeof(*timings)) == 0)
+		return &venc_config_pal_trm;
+
+	if (memcmp(&omap_dss_ntsc_timings, timings, sizeof(*timings)) == 0)
+		return &venc_config_ntsc_trm;
+
+	BUG();
+}
+
+
+
+
+
+/* driver */
+static int venc_panel_probe(struct omap_dss_device *dssdev)
+{
+	dssdev->panel.timings = omap_dss_pal_timings;
+
+	return 0;
+}
+
+static void venc_panel_remove(struct omap_dss_device *dssdev)
+{
+}
+
+static int venc_panel_enable(struct omap_dss_device *dssdev)
+{
+	int r = 0;
+
+	/* wait couple of vsyncs until enabling the LCD */
+	msleep(50);
+
+	if (dssdev->platform_enable)
+		r = dssdev->platform_enable(dssdev);
+
+	return r;
+}
+
+static void venc_panel_disable(struct omap_dss_device *dssdev)
+{
+	if (dssdev->platform_disable)
+		dssdev->platform_disable(dssdev);
+
+	/* wait at least 5 vsyncs after disabling the LCD */
+
+	msleep(100);
+}
+
+static int venc_panel_suspend(struct omap_dss_device *dssdev)
+{
+	venc_panel_disable(dssdev);
+	return 0;
+}
+
+static int venc_panel_resume(struct omap_dss_device *dssdev)
+{
+	return venc_panel_enable(dssdev);
+}
+
+static struct omap_dss_driver venc_driver = {
+	.probe		= venc_panel_probe,
+	.remove		= venc_panel_remove,
+
+	.enable		= venc_panel_enable,
+	.disable	= venc_panel_disable,
+	.suspend	= venc_panel_suspend,
+	.resume		= venc_panel_resume,
+
+	.driver         = {
+		.name   = "venc",
+		.owner  = THIS_MODULE,
+	},
+};
+/* driver end */
+
+
+
+int venc_init(struct platform_device *pdev)
+{
+	u8 rev_id;
+
+	mutex_init(&venc.venc_lock);
+
+	venc.wss_data = 0;
+
+	venc.base = ioremap(VENC_BASE, SZ_1K);
+	if (!venc.base) {
+		DSSERR("can't ioremap VENC\n");
+		return -ENOMEM;
+	}
+
+	venc.vdda_dac_reg = regulator_get(&pdev->dev, "vdda_dac");
+	if (IS_ERR(venc.vdda_dac_reg)) {
+		iounmap(venc.base);
+		DSSERR("can't get VDDA_DAC regulator\n");
+		return PTR_ERR(venc.vdda_dac_reg);
+	}
+
+	venc_enable_clocks(1);
+
+	rev_id = (u8)(venc_read_reg(VENC_REV_ID) & 0xff);
+	printk(KERN_INFO "OMAP VENC rev %d\n", rev_id);
+
+	venc_enable_clocks(0);
+
+	return omap_dss_register_driver(&venc_driver);
+}
+
+void venc_exit(void)
+{
+	omap_dss_unregister_driver(&venc_driver);
+
+	regulator_put(venc.vdda_dac_reg);
+
+	iounmap(venc.base);
+}
+
+static void venc_power_on(struct omap_dss_device *dssdev)
+{
+	u32 l;
+
+	venc_enable_clocks(1);
+
+	venc_reset();
+	venc_write_config(venc_timings_to_config(&dssdev->panel.timings));
+
+	dss_set_venc_output(dssdev->phy.venc.type);
+	dss_set_dac_pwrdn_bgz(1);
+
+	l = 0;
+
+	if (dssdev->phy.venc.type == OMAP_DSS_VENC_TYPE_COMPOSITE)
+		l |= 1 << 1;
+	else /* S-Video */
+		l |= (1 << 0) | (1 << 2);
+
+	if (dssdev->phy.venc.invert_polarity == false)
+		l |= 1 << 3;
+
+	venc_write_reg(VENC_OUTPUT_CONTROL, l);
+
+	dispc_set_digit_size(dssdev->panel.timings.x_res,
+			dssdev->panel.timings.y_res/2);
+
+	regulator_enable(venc.vdda_dac_reg);
+
+	if (dssdev->platform_enable)
+		dssdev->platform_enable(dssdev);
+
+	dispc_enable_digit_out(1);
+}
+
+static void venc_power_off(struct omap_dss_device *dssdev)
+{
+	venc_write_reg(VENC_OUTPUT_CONTROL, 0);
+	dss_set_dac_pwrdn_bgz(0);
+
+	dispc_enable_digit_out(0);
+
+	if (dssdev->platform_disable)
+		dssdev->platform_disable(dssdev);
+
+	regulator_disable(venc.vdda_dac_reg);
+
+	venc_enable_clocks(0);
+}
+
+static int venc_enable_display(struct omap_dss_device *dssdev)
+{
+	int r = 0;
+
+	DSSDBG("venc_enable_display\n");
+
+	mutex_lock(&venc.venc_lock);
+
+	if (dssdev->state != OMAP_DSS_DISPLAY_DISABLED) {
+		r = -EINVAL;
+		goto err;
+	}
+
+	venc_power_on(dssdev);
+
+	venc.wss_data = 0;
+
+	dssdev->state = OMAP_DSS_DISPLAY_ACTIVE;
+err:
+	mutex_unlock(&venc.venc_lock);
+
+	return r;
+}
+
+static void venc_disable_display(struct omap_dss_device *dssdev)
+{
+	DSSDBG("venc_disable_display\n");
+
+	mutex_lock(&venc.venc_lock);
+
+	if (dssdev->state == OMAP_DSS_DISPLAY_DISABLED)
+		goto end;
+
+	if (dssdev->state == OMAP_DSS_DISPLAY_SUSPENDED) {
+		/* suspended is the same as disabled with venc */
+		dssdev->state = OMAP_DSS_DISPLAY_DISABLED;
+		goto end;
+	}
+
+	venc_power_off(dssdev);
+
+	dssdev->state = OMAP_DSS_DISPLAY_DISABLED;
+end:
+	mutex_unlock(&venc.venc_lock);
+}
+
+static int venc_display_suspend(struct omap_dss_device *dssdev)
+{
+	int r = 0;
+
+	DSSDBG("venc_display_suspend\n");
+
+	mutex_lock(&venc.venc_lock);
+
+	if (dssdev->state != OMAP_DSS_DISPLAY_ACTIVE) {
+		r = -EINVAL;
+		goto err;
+	}
+
+	venc_power_off(dssdev);
+
+	dssdev->state = OMAP_DSS_DISPLAY_SUSPENDED;
+err:
+	mutex_unlock(&venc.venc_lock);
+
+	return r;
+}
+
+static int venc_display_resume(struct omap_dss_device *dssdev)
+{
+	int r = 0;
+
+	DSSDBG("venc_display_resume\n");
+
+	mutex_lock(&venc.venc_lock);
+
+	if (dssdev->state != OMAP_DSS_DISPLAY_SUSPENDED) {
+		r = -EINVAL;
+		goto err;
+	}
+
+	venc_power_on(dssdev);
+
+	dssdev->state = OMAP_DSS_DISPLAY_ACTIVE;
+err:
+	mutex_unlock(&venc.venc_lock);
+
+	return r;
+}
+
+static void venc_get_timings(struct omap_dss_device *dssdev,
+			struct omap_video_timings *timings)
+{
+	*timings = dssdev->panel.timings;
+}
+
+static void venc_set_timings(struct omap_dss_device *dssdev,
+			struct omap_video_timings *timings)
+{
+	DSSDBG("venc_set_timings\n");
+
+	/* Reset WSS data when the TV standard changes. */
+	if (memcmp(&dssdev->panel.timings, timings, sizeof(*timings)))
+		venc.wss_data = 0;
+
+	dssdev->panel.timings = *timings;
+	if (dssdev->state == OMAP_DSS_DISPLAY_ACTIVE) {
+		/* turn the venc off and on to get new timings to use */
+		venc_disable_display(dssdev);
+		venc_enable_display(dssdev);
+	}
+}
+
+static int venc_check_timings(struct omap_dss_device *dssdev,
+			struct omap_video_timings *timings)
+{
+	DSSDBG("venc_check_timings\n");
+
+	if (memcmp(&omap_dss_pal_timings, timings, sizeof(*timings)) == 0)
+		return 0;
+
+	if (memcmp(&omap_dss_ntsc_timings, timings, sizeof(*timings)) == 0)
+		return 0;
+
+	return -EINVAL;
+}
+
+static u32 venc_get_wss(struct omap_dss_device *dssdev)
+{
+	/* Invert due to VENC_L21_WC_CTL:INV=1 */
+	return (venc.wss_data >> 8) ^ 0xfffff;
+}
+
+static int venc_set_wss(struct omap_dss_device *dssdev,	u32 wss)
+{
+	const struct venc_config *config;
+
+	DSSDBG("venc_set_wss\n");
+
+	mutex_lock(&venc.venc_lock);
+
+	config = venc_timings_to_config(&dssdev->panel.timings);
+
+	/* Invert due to VENC_L21_WC_CTL:INV=1 */
+	venc.wss_data = (wss ^ 0xfffff) << 8;
+
+	venc_enable_clocks(1);
+
+	venc_write_reg(VENC_BSTAMP_WSS_DATA, config->bstamp_wss_data |
+			venc.wss_data);
+
+	venc_enable_clocks(0);
+
+	mutex_unlock(&venc.venc_lock);
+
+	return 0;
+}
+
+static enum omap_dss_update_mode venc_display_get_update_mode(
+		struct omap_dss_device *dssdev)
+{
+	if (dssdev->state == OMAP_DSS_DISPLAY_ACTIVE)
+		return OMAP_DSS_UPDATE_AUTO;
+	else
+		return OMAP_DSS_UPDATE_DISABLED;
+}
+
+int venc_init_display(struct omap_dss_device *dssdev)
+{
+	DSSDBG("init_display\n");
+
+	dssdev->enable = venc_enable_display;
+	dssdev->disable = venc_disable_display;
+	dssdev->suspend = venc_display_suspend;
+	dssdev->resume = venc_display_resume;
+	dssdev->get_timings = venc_get_timings;
+	dssdev->set_timings = venc_set_timings;
+	dssdev->check_timings = venc_check_timings;
+	dssdev->get_wss = venc_get_wss;
+	dssdev->set_wss = venc_set_wss;
+	dssdev->get_update_mode = venc_display_get_update_mode;
+
+	return 0;
+}
+
+void venc_dump_regs(struct seq_file *s)
+{
+#define DUMPREG(r) seq_printf(s, "%-35s %08x\n", #r, venc_read_reg(r))
+
+	venc_enable_clocks(1);
+
+	DUMPREG(VENC_F_CONTROL);
+	DUMPREG(VENC_VIDOUT_CTRL);
+	DUMPREG(VENC_SYNC_CTRL);
+	DUMPREG(VENC_LLEN);
+	DUMPREG(VENC_FLENS);
+	DUMPREG(VENC_HFLTR_CTRL);
+	DUMPREG(VENC_CC_CARR_WSS_CARR);
+	DUMPREG(VENC_C_PHASE);
+	DUMPREG(VENC_GAIN_U);
+	DUMPREG(VENC_GAIN_V);
+	DUMPREG(VENC_GAIN_Y);
+	DUMPREG(VENC_BLACK_LEVEL);
+	DUMPREG(VENC_BLANK_LEVEL);
+	DUMPREG(VENC_X_COLOR);
+	DUMPREG(VENC_M_CONTROL);
+	DUMPREG(VENC_BSTAMP_WSS_DATA);
+	DUMPREG(VENC_S_CARR);
+	DUMPREG(VENC_LINE21);
+	DUMPREG(VENC_LN_SEL);
+	DUMPREG(VENC_L21__WC_CTL);
+	DUMPREG(VENC_HTRIGGER_VTRIGGER);
+	DUMPREG(VENC_SAVID__EAVID);
+	DUMPREG(VENC_FLEN__FAL);
+	DUMPREG(VENC_LAL__PHASE_RESET);
+	DUMPREG(VENC_HS_INT_START_STOP_X);
+	DUMPREG(VENC_HS_EXT_START_STOP_X);
+	DUMPREG(VENC_VS_INT_START_X);
+	DUMPREG(VENC_VS_INT_STOP_X__VS_INT_START_Y);
+	DUMPREG(VENC_VS_INT_STOP_Y__VS_EXT_START_X);
+	DUMPREG(VENC_VS_EXT_STOP_X__VS_EXT_START_Y);
+	DUMPREG(VENC_VS_EXT_STOP_Y);
+	DUMPREG(VENC_AVID_START_STOP_X);
+	DUMPREG(VENC_AVID_START_STOP_Y);
+	DUMPREG(VENC_FID_INT_START_X__FID_INT_START_Y);
+	DUMPREG(VENC_FID_INT_OFFSET_Y__FID_EXT_START_X);
+	DUMPREG(VENC_FID_EXT_START_Y__FID_EXT_OFFSET_Y);
+	DUMPREG(VENC_TVDETGP_INT_START_STOP_X);
+	DUMPREG(VENC_TVDETGP_INT_START_STOP_Y);
+	DUMPREG(VENC_GEN_CTRL);
+	DUMPREG(VENC_OUTPUT_CONTROL);
+	DUMPREG(VENC_OUTPUT_TEST);
+
+	venc_enable_clocks(0);
+
+#undef DUMPREG
+}
diff --git a/drivers/video/omap2/omapfb/Kconfig b/drivers/video/omap2/omapfb/Kconfig
new file mode 100644
index 000000000000..bb694cc52a50
--- /dev/null
+++ b/drivers/video/omap2/omapfb/Kconfig
@@ -0,0 +1,37 @@
+menuconfig FB_OMAP2
+        tristate "OMAP2/3 frame buffer support (EXPERIMENTAL)"
+        depends on FB && OMAP2_DSS
+
+	select OMAP2_VRAM
+	select OMAP2_VRFB
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        help
+          Frame buffer driver for OMAP2/3 based boards.
+
+config FB_OMAP2_DEBUG_SUPPORT
+	bool "Debug support for OMAP2/3 FB"
+	default y
+	depends on FB_OMAP2
+	help
+	  Support for debug output. You have to enable the actual printing
+	  with debug module parameter.
+
+config FB_OMAP2_FORCE_AUTO_UPDATE
+	bool "Force main display to automatic update mode"
+	depends on FB_OMAP2
+	help
+	  Forces main display to automatic update mode (if possible),
+	  and also enables tearsync (if possible). By default
+	  displays that support manual update are started in manual
+	  update mode.
+
+config FB_OMAP2_NUM_FBS
+	int "Number of framebuffers"
+	range 1 10
+	default 3
+	depends on FB_OMAP2
+	help
+	  Select the number of framebuffers created. OMAP2/3 has 3 overlays
+	  so normally this would be 3.
diff --git a/drivers/video/omap2/omapfb/Makefile b/drivers/video/omap2/omapfb/Makefile
new file mode 100644
index 000000000000..51c2e00d9bf8
--- /dev/null
+++ b/drivers/video/omap2/omapfb/Makefile
@@ -0,0 +1,2 @@
+obj-$(CONFIG_FB_OMAP2) += omapfb.o
+omapfb-y := omapfb-main.o omapfb-sysfs.o omapfb-ioctl.o
diff --git a/drivers/video/omap2/omapfb/omapfb-ioctl.c b/drivers/video/omap2/omapfb/omapfb-ioctl.c
new file mode 100644
index 000000000000..4c4bafdfaa43
--- /dev/null
+++ b/drivers/video/omap2/omapfb/omapfb-ioctl.c
@@ -0,0 +1,755 @@
+/*
+ * linux/drivers/video/omap2/omapfb-ioctl.c
+ *
+ * Copyright (C) 2008 Nokia Corporation
+ * Author: Tomi Valkeinen <tomi.valkeinen@nokia.com>
+ *
+ * Some code and ideas taken from drivers/video/omap/ driver
+ * by Imre Deak.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <linux/fb.h>
+#include <linux/device.h>
+#include <linux/uaccess.h>
+#include <linux/platform_device.h>
+#include <linux/mm.h>
+#include <linux/omapfb.h>
+#include <linux/vmalloc.h>
+
+#include <plat/display.h>
+#include <plat/vrfb.h>
+#include <plat/vram.h>
+
+#include "omapfb.h"
+
+static int omapfb_setup_plane(struct fb_info *fbi, struct omapfb_plane_info *pi)
+{
+	struct omapfb_info *ofbi = FB2OFB(fbi);
+	struct omapfb2_device *fbdev = ofbi->fbdev;
+	struct omap_overlay *ovl;
+	struct omap_overlay_info info;
+	int r = 0;
+
+	DBG("omapfb_setup_plane\n");
+
+	if (ofbi->num_overlays != 1) {
+		r = -EINVAL;
+		goto out;
+	}
+
+	/* XXX uses only the first overlay */
+	ovl = ofbi->overlays[0];
+
+	if (pi->enabled && !ofbi->region.size) {
+		/*
+		 * This plane's memory was freed, can't enable it
+		 * until it's reallocated.
+		 */
+		r = -EINVAL;
+		goto out;
+	}
+
+	ovl->get_overlay_info(ovl, &info);
+
+	info.pos_x = pi->pos_x;
+	info.pos_y = pi->pos_y;
+	info.out_width = pi->out_width;
+	info.out_height = pi->out_height;
+	info.enabled = pi->enabled;
+
+	r = ovl->set_overlay_info(ovl, &info);
+	if (r)
+		goto out;
+
+	if (ovl->manager) {
+		r = ovl->manager->apply(ovl->manager);
+		if (r)
+			goto out;
+	}
+
+out:
+	if (r)
+		dev_err(fbdev->dev, "setup_plane failed\n");
+	return r;
+}
+
+static int omapfb_query_plane(struct fb_info *fbi, struct omapfb_plane_info *pi)
+{
+	struct omapfb_info *ofbi = FB2OFB(fbi);
+
+	if (ofbi->num_overlays != 1) {
+		memset(pi, 0, sizeof(*pi));
+	} else {
+		struct omap_overlay_info *ovli;
+		struct omap_overlay *ovl;
+
+		ovl = ofbi->overlays[0];
+		ovli = &ovl->info;
+
+		pi->pos_x = ovli->pos_x;
+		pi->pos_y = ovli->pos_y;
+		pi->enabled = ovli->enabled;
+		pi->channel_out = 0; /* xxx */
+		pi->mirror = 0;
+		pi->out_width = ovli->out_width;
+		pi->out_height = ovli->out_height;
+	}
+
+	return 0;
+}
+
+static int omapfb_setup_mem(struct fb_info *fbi, struct omapfb_mem_info *mi)
+{
+	struct omapfb_info *ofbi = FB2OFB(fbi);
+	struct omapfb2_device *fbdev = ofbi->fbdev;
+	struct omapfb2_mem_region *rg;
+	int r, i;
+	size_t size;
+
+	if (mi->type > OMAPFB_MEMTYPE_MAX)
+		return -EINVAL;
+
+	size = PAGE_ALIGN(mi->size);
+
+	rg = &ofbi->region;
+
+	for (i = 0; i < ofbi->num_overlays; i++) {
+		if (ofbi->overlays[i]->info.enabled)
+			return -EBUSY;
+	}
+
+	if (rg->size != size || rg->type != mi->type) {
+		r = omapfb_realloc_fbmem(fbi, size, mi->type);
+		if (r) {
+			dev_err(fbdev->dev, "realloc fbmem failed\n");
+			return r;
+		}
+	}
+
+	return 0;
+}
+
+static int omapfb_query_mem(struct fb_info *fbi, struct omapfb_mem_info *mi)
+{
+	struct omapfb_info *ofbi = FB2OFB(fbi);
+	struct omapfb2_mem_region *rg;
+
+	rg = &ofbi->region;
+	memset(mi, 0, sizeof(*mi));
+
+	mi->size = rg->size;
+	mi->type = rg->type;
+
+	return 0;
+}
+
+static int omapfb_update_window_nolock(struct fb_info *fbi,
+		u32 x, u32 y, u32 w, u32 h)
+{
+	struct omap_dss_device *display = fb2display(fbi);
+	u16 dw, dh;
+
+	if (!display)
+		return 0;
+
+	if (w == 0 || h == 0)
+		return 0;
+
+	display->get_resolution(display, &dw, &dh);
+
+	if (x + w > dw || y + h > dh)
+		return -EINVAL;
+
+	return display->update(display, x, y, w, h);
+}
+
+/* This function is exported for SGX driver use */
+int omapfb_update_window(struct fb_info *fbi,
+		u32 x, u32 y, u32 w, u32 h)
+{
+	struct omapfb_info *ofbi = FB2OFB(fbi);
+	struct omapfb2_device *fbdev = ofbi->fbdev;
+	int r;
+
+	omapfb_lock(fbdev);
+	lock_fb_info(fbi);
+
+	r = omapfb_update_window_nolock(fbi, x, y, w, h);
+
+	unlock_fb_info(fbi);
+	omapfb_unlock(fbdev);
+
+	return r;
+}
+EXPORT_SYMBOL(omapfb_update_window);
+
+static int omapfb_set_update_mode(struct fb_info *fbi,
+				   enum omapfb_update_mode mode)
+{
+	struct omap_dss_device *display = fb2display(fbi);
+	enum omap_dss_update_mode um;
+	int r;
+
+	if (!display || !display->set_update_mode)
+		return -EINVAL;
+
+	switch (mode) {
+	case OMAPFB_UPDATE_DISABLED:
+		um = OMAP_DSS_UPDATE_DISABLED;
+		break;
+
+	case OMAPFB_AUTO_UPDATE:
+		um = OMAP_DSS_UPDATE_AUTO;
+		break;
+
+	case OMAPFB_MANUAL_UPDATE:
+		um = OMAP_DSS_UPDATE_MANUAL;
+		break;
+
+	default:
+		return -EINVAL;
+	}
+
+	r = display->set_update_mode(display, um);
+
+	return r;
+}
+
+static int omapfb_get_update_mode(struct fb_info *fbi,
+		enum omapfb_update_mode *mode)
+{
+	struct omap_dss_device *display = fb2display(fbi);
+	enum omap_dss_update_mode m;
+
+	if (!display || !display->get_update_mode)
+		return -EINVAL;
+
+	m = display->get_update_mode(display);
+
+	switch (m) {
+	case OMAP_DSS_UPDATE_DISABLED:
+		*mode = OMAPFB_UPDATE_DISABLED;
+		break;
+	case OMAP_DSS_UPDATE_AUTO:
+		*mode = OMAPFB_AUTO_UPDATE;
+		break;
+	case OMAP_DSS_UPDATE_MANUAL:
+		*mode = OMAPFB_MANUAL_UPDATE;
+		break;
+	default:
+		BUG();
+	}
+
+	return 0;
+}
+
+/* XXX this color key handling is a hack... */
+static struct omapfb_color_key omapfb_color_keys[2];
+
+static int _omapfb_set_color_key(struct omap_overlay_manager *mgr,
+		struct omapfb_color_key *ck)
+{
+	struct omap_overlay_manager_info info;
+	enum omap_dss_trans_key_type kt;
+	int r;
+
+	mgr->get_manager_info(mgr, &info);
+
+	if (ck->key_type == OMAPFB_COLOR_KEY_DISABLED) {
+		info.trans_enabled = false;
+		omapfb_color_keys[mgr->id] = *ck;
+
+		r = mgr->set_manager_info(mgr, &info);
+		if (r)
+			return r;
+
+		r = mgr->apply(mgr);
+
+		return r;
+	}
+
+	switch (ck->key_type) {
+	case OMAPFB_COLOR_KEY_GFX_DST:
+		kt = OMAP_DSS_COLOR_KEY_GFX_DST;
+		break;
+	case OMAPFB_COLOR_KEY_VID_SRC:
+		kt = OMAP_DSS_COLOR_KEY_VID_SRC;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	info.default_color = ck->background;
+	info.trans_key = ck->trans_key;
+	info.trans_key_type = kt;
+	info.trans_enabled = true;
+
+	omapfb_color_keys[mgr->id] = *ck;
+
+	r = mgr->set_manager_info(mgr, &info);
+	if (r)
+		return r;
+
+	r = mgr->apply(mgr);
+
+	return r;
+}
+
+static int omapfb_set_color_key(struct fb_info *fbi,
+		struct omapfb_color_key *ck)
+{
+	struct omapfb_info *ofbi = FB2OFB(fbi);
+	struct omapfb2_device *fbdev = ofbi->fbdev;
+	int r;
+	int i;
+	struct omap_overlay_manager *mgr = NULL;
+
+	omapfb_lock(fbdev);
+
+	for (i = 0; i < ofbi->num_overlays; i++) {
+		if (ofbi->overlays[i]->manager) {
+			mgr = ofbi->overlays[i]->manager;
+			break;
+		}
+	}
+
+	if (!mgr) {
+		r = -EINVAL;
+		goto err;
+	}
+
+	r = _omapfb_set_color_key(mgr, ck);
+err:
+	omapfb_unlock(fbdev);
+
+	return r;
+}
+
+static int omapfb_get_color_key(struct fb_info *fbi,
+		struct omapfb_color_key *ck)
+{
+	struct omapfb_info *ofbi = FB2OFB(fbi);
+	struct omapfb2_device *fbdev = ofbi->fbdev;
+	struct omap_overlay_manager *mgr = NULL;
+	int r = 0;
+	int i;
+
+	omapfb_lock(fbdev);
+
+	for (i = 0; i < ofbi->num_overlays; i++) {
+		if (ofbi->overlays[i]->manager) {
+			mgr = ofbi->overlays[i]->manager;
+			break;
+		}
+	}
+
+	if (!mgr) {
+		r = -EINVAL;
+		goto err;
+	}
+
+	*ck = omapfb_color_keys[mgr->id];
+err:
+	omapfb_unlock(fbdev);
+
+	return r;
+}
+
+static int omapfb_memory_read(struct fb_info *fbi,
+		struct omapfb_memory_read *mr)
+{
+	struct omap_dss_device *display = fb2display(fbi);
+	void *buf;
+	int r;
+
+	if (!display || !display->memory_read)
+		return -ENOENT;
+
+	if (!access_ok(VERIFY_WRITE, mr->buffer, mr->buffer_size))
+		return -EFAULT;
+
+	if (mr->w * mr->h * 3 > mr->buffer_size)
+		return -EINVAL;
+
+	buf = vmalloc(mr->buffer_size);
+	if (!buf) {
+		DBG("vmalloc failed\n");
+		return -ENOMEM;
+	}
+
+	r = display->memory_read(display, buf, mr->buffer_size,
+			mr->x, mr->y, mr->w, mr->h);
+
+	if (r > 0) {
+		if (copy_to_user(mr->buffer, buf, mr->buffer_size))
+			r = -EFAULT;
+	}
+
+	vfree(buf);
+
+	return r;
+}
+
+static int omapfb_get_ovl_colormode(struct omapfb2_device *fbdev,
+			     struct omapfb_ovl_colormode *mode)
+{
+	int ovl_idx = mode->overlay_idx;
+	int mode_idx = mode->mode_idx;
+	struct omap_overlay *ovl;
+	enum omap_color_mode supported_modes;
+	struct fb_var_screeninfo var;
+	int i;
+
+	if (ovl_idx >= fbdev->num_overlays)
+		return -ENODEV;
+	ovl = fbdev->overlays[ovl_idx];
+	supported_modes = ovl->supported_modes;
+
+	mode_idx = mode->mode_idx;
+
+	for (i = 0; i < sizeof(supported_modes) * 8; i++) {
+		if (!(supported_modes & (1 << i)))
+			continue;
+		/*
+		 * It's possible that the FB doesn't support a mode
+		 * that is supported by the overlay, so call the
+		 * following here.
+		 */
+		if (dss_mode_to_fb_mode(1 << i, &var) < 0)
+			continue;
+
+		mode_idx--;
+		if (mode_idx < 0)
+			break;
+	}
+
+	if (i == sizeof(supported_modes) * 8)
+		return -ENOENT;
+
+	mode->bits_per_pixel = var.bits_per_pixel;
+	mode->nonstd = var.nonstd;
+	mode->red = var.red;
+	mode->green = var.green;
+	mode->blue = var.blue;
+	mode->transp = var.transp;
+
+	return 0;
+}
+
+static int omapfb_wait_for_go(struct fb_info *fbi)
+{
+	struct omapfb_info *ofbi = FB2OFB(fbi);
+	int r = 0;
+	int i;
+
+	for (i = 0; i < ofbi->num_overlays; ++i) {
+		struct omap_overlay *ovl = ofbi->overlays[i];
+		r = ovl->wait_for_go(ovl);
+		if (r)
+			break;
+	}
+
+	return r;
+}
+
+int omapfb_ioctl(struct fb_info *fbi, unsigned int cmd, unsigned long arg)
+{
+	struct omapfb_info *ofbi = FB2OFB(fbi);
+	struct omapfb2_device *fbdev = ofbi->fbdev;
+	struct omap_dss_device *display = fb2display(fbi);
+
+	union {
+		struct omapfb_update_window_old	uwnd_o;
+		struct omapfb_update_window	uwnd;
+		struct omapfb_plane_info	plane_info;
+		struct omapfb_caps		caps;
+		struct omapfb_mem_info          mem_info;
+		struct omapfb_color_key		color_key;
+		struct omapfb_ovl_colormode	ovl_colormode;
+		enum omapfb_update_mode		update_mode;
+		int test_num;
+		struct omapfb_memory_read	memory_read;
+		struct omapfb_vram_info		vram_info;
+		struct omapfb_tearsync_info	tearsync_info;
+	} p;
+
+	int r = 0;
+
+	switch (cmd) {
+	case OMAPFB_SYNC_GFX:
+		DBG("ioctl SYNC_GFX\n");
+		if (!display || !display->sync) {
+			/* DSS1 never returns an error here, so we neither */
+			/*r = -EINVAL;*/
+			break;
+		}
+
+		r = display->sync(display);
+		break;
+
+	case OMAPFB_UPDATE_WINDOW_OLD:
+		DBG("ioctl UPDATE_WINDOW_OLD\n");
+		if (!display || !display->update) {
+			r = -EINVAL;
+			break;
+		}
+
+		if (copy_from_user(&p.uwnd_o,
+					(void __user *)arg,
+					sizeof(p.uwnd_o))) {
+			r = -EFAULT;
+			break;
+		}
+
+		r = omapfb_update_window_nolock(fbi, p.uwnd_o.x, p.uwnd_o.y,
+				p.uwnd_o.width, p.uwnd_o.height);
+		break;
+
+	case OMAPFB_UPDATE_WINDOW:
+		DBG("ioctl UPDATE_WINDOW\n");
+		if (!display || !display->update) {
+			r = -EINVAL;
+			break;
+		}
+
+		if (copy_from_user(&p.uwnd, (void __user *)arg,
+					sizeof(p.uwnd))) {
+			r = -EFAULT;
+			break;
+		}
+
+		r = omapfb_update_window_nolock(fbi, p.uwnd.x, p.uwnd.y,
+				p.uwnd.width, p.uwnd.height);
+		break;
+
+	case OMAPFB_SETUP_PLANE:
+		DBG("ioctl SETUP_PLANE\n");
+		if (copy_from_user(&p.plane_info, (void __user *)arg,
+					sizeof(p.plane_info)))
+			r = -EFAULT;
+		else
+			r = omapfb_setup_plane(fbi, &p.plane_info);
+		break;
+
+	case OMAPFB_QUERY_PLANE:
+		DBG("ioctl QUERY_PLANE\n");
+		r = omapfb_query_plane(fbi, &p.plane_info);
+		if (r < 0)
+			break;
+		if (copy_to_user((void __user *)arg, &p.plane_info,
+					sizeof(p.plane_info)))
+			r = -EFAULT;
+		break;
+
+	case OMAPFB_SETUP_MEM:
+		DBG("ioctl SETUP_MEM\n");
+		if (copy_from_user(&p.mem_info, (void __user *)arg,
+					sizeof(p.mem_info)))
+			r = -EFAULT;
+		else
+			r = omapfb_setup_mem(fbi, &p.mem_info);
+		break;
+
+	case OMAPFB_QUERY_MEM:
+		DBG("ioctl QUERY_MEM\n");
+		r = omapfb_query_mem(fbi, &p.mem_info);
+		if (r < 0)
+			break;
+		if (copy_to_user((void __user *)arg, &p.mem_info,
+					sizeof(p.mem_info)))
+			r = -EFAULT;
+		break;
+
+	case OMAPFB_GET_CAPS:
+		DBG("ioctl GET_CAPS\n");
+		if (!display) {
+			r = -EINVAL;
+			break;
+		}
+
+		memset(&p.caps, 0, sizeof(p.caps));
+		if (display->caps & OMAP_DSS_DISPLAY_CAP_MANUAL_UPDATE)
+			p.caps.ctrl |= OMAPFB_CAPS_MANUAL_UPDATE;
+		if (display->caps & OMAP_DSS_DISPLAY_CAP_TEAR_ELIM)
+			p.caps.ctrl |= OMAPFB_CAPS_TEARSYNC;
+
+		if (copy_to_user((void __user *)arg, &p.caps, sizeof(p.caps)))
+			r = -EFAULT;
+		break;
+
+	case OMAPFB_GET_OVERLAY_COLORMODE:
+		DBG("ioctl GET_OVERLAY_COLORMODE\n");
+		if (copy_from_user(&p.ovl_colormode, (void __user *)arg,
+				   sizeof(p.ovl_colormode))) {
+			r = -EFAULT;
+			break;
+		}
+		r = omapfb_get_ovl_colormode(fbdev, &p.ovl_colormode);
+		if (r < 0)
+			break;
+		if (copy_to_user((void __user *)arg, &p.ovl_colormode,
+				 sizeof(p.ovl_colormode)))
+			r = -EFAULT;
+		break;
+
+	case OMAPFB_SET_UPDATE_MODE:
+		DBG("ioctl SET_UPDATE_MODE\n");
+		if (get_user(p.update_mode, (int __user *)arg))
+			r = -EFAULT;
+		else
+			r = omapfb_set_update_mode(fbi, p.update_mode);
+		break;
+
+	case OMAPFB_GET_UPDATE_MODE:
+		DBG("ioctl GET_UPDATE_MODE\n");
+		r = omapfb_get_update_mode(fbi, &p.update_mode);
+		if (r)
+			break;
+		if (put_user(p.update_mode,
+					(enum omapfb_update_mode __user *)arg))
+			r = -EFAULT;
+		break;
+
+	case OMAPFB_SET_COLOR_KEY:
+		DBG("ioctl SET_COLOR_KEY\n");
+		if (copy_from_user(&p.color_key, (void __user *)arg,
+				   sizeof(p.color_key)))
+			r = -EFAULT;
+		else
+			r = omapfb_set_color_key(fbi, &p.color_key);
+		break;
+
+	case OMAPFB_GET_COLOR_KEY:
+		DBG("ioctl GET_COLOR_KEY\n");
+		r = omapfb_get_color_key(fbi, &p.color_key);
+		if (r)
+			break;
+		if (copy_to_user((void __user *)arg, &p.color_key,
+				 sizeof(p.color_key)))
+			r = -EFAULT;
+		break;
+
+	case OMAPFB_WAITFORVSYNC:
+		DBG("ioctl WAITFORVSYNC\n");
+		if (!display) {
+			r = -EINVAL;
+			break;
+		}
+
+		r = display->wait_vsync(display);
+		break;
+
+	case OMAPFB_WAITFORGO:
+		DBG("ioctl WAITFORGO\n");
+		if (!display) {
+			r = -EINVAL;
+			break;
+		}
+
+		r = omapfb_wait_for_go(fbi);
+		break;
+
+	/* LCD and CTRL tests do the same thing for backward
+	 * compatibility */
+	case OMAPFB_LCD_TEST:
+		DBG("ioctl LCD_TEST\n");
+		if (get_user(p.test_num, (int __user *)arg)) {
+			r = -EFAULT;
+			break;
+		}
+		if (!display || !display->run_test) {
+			r = -EINVAL;
+			break;
+		}
+
+		r = display->run_test(display, p.test_num);
+
+		break;
+
+	case OMAPFB_CTRL_TEST:
+		DBG("ioctl CTRL_TEST\n");
+		if (get_user(p.test_num, (int __user *)arg)) {
+			r = -EFAULT;
+			break;
+		}
+		if (!display || !display->run_test) {
+			r = -EINVAL;
+			break;
+		}
+
+		r = display->run_test(display, p.test_num);
+
+		break;
+
+	case OMAPFB_MEMORY_READ:
+		DBG("ioctl MEMORY_READ\n");
+
+		if (copy_from_user(&p.memory_read, (void __user *)arg,
+					sizeof(p.memory_read))) {
+			r = -EFAULT;
+			break;
+		}
+
+		r = omapfb_memory_read(fbi, &p.memory_read);
+
+		break;
+
+	case OMAPFB_GET_VRAM_INFO: {
+		unsigned long vram, free, largest;
+
+		DBG("ioctl GET_VRAM_INFO\n");
+
+		omap_vram_get_info(&vram, &free, &largest);
+		p.vram_info.total = vram;
+		p.vram_info.free = free;
+		p.vram_info.largest_free_block = largest;
+
+		if (copy_to_user((void __user *)arg, &p.vram_info,
+					sizeof(p.vram_info)))
+			r = -EFAULT;
+		break;
+	}
+
+	case OMAPFB_SET_TEARSYNC: {
+		DBG("ioctl SET_TEARSYNC\n");
+
+		if (copy_from_user(&p.tearsync_info, (void __user *)arg,
+					sizeof(p.tearsync_info))) {
+			r = -EFAULT;
+			break;
+		}
+
+		if (!display->enable_te) {
+			r = -ENODEV;
+			break;
+		}
+
+		r = display->enable_te(display, !!p.tearsync_info.enabled);
+
+		break;
+	}
+
+	default:
+		dev_err(fbdev->dev, "Unknown ioctl 0x%x\n", cmd);
+		r = -EINVAL;
+	}
+
+	if (r < 0)
+		DBG("ioctl failed: %d\n", r);
+
+	return r;
+}
+
+
diff --git a/drivers/video/omap2/omapfb/omapfb-main.c b/drivers/video/omap2/omapfb/omapfb-main.c
new file mode 100644
index 000000000000..d17caef6915a
--- /dev/null
+++ b/drivers/video/omap2/omapfb/omapfb-main.c
@@ -0,0 +1,2267 @@
+/*
+ * linux/drivers/video/omap2/omapfb-main.c
+ *
+ * Copyright (C) 2008 Nokia Corporation
+ * Author: Tomi Valkeinen <tomi.valkeinen@nokia.com>
+ *
+ * Some code and ideas taken from drivers/video/omap/ driver
+ * by Imre Deak.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <linux/module.h>
+#include <linux/delay.h>
+#include <linux/fb.h>
+#include <linux/dma-mapping.h>
+#include <linux/vmalloc.h>
+#include <linux/device.h>
+#include <linux/platform_device.h>
+#include <linux/omapfb.h>
+
+#include <plat/display.h>
+#include <plat/vram.h>
+#include <plat/vrfb.h>
+
+#include "omapfb.h"
+
+#define MODULE_NAME     "omapfb"
+
+#define OMAPFB_PLANE_XRES_MIN		8
+#define OMAPFB_PLANE_YRES_MIN		8
+
+static char *def_mode;
+static char *def_vram;
+static int def_vrfb;
+static int def_rotate;
+static int def_mirror;
+
+#ifdef DEBUG
+unsigned int omapfb_debug;
+module_param_named(debug, omapfb_debug, bool, 0644);
+static unsigned int omapfb_test_pattern;
+module_param_named(test, omapfb_test_pattern, bool, 0644);
+#endif
+
+static int omapfb_fb_init(struct omapfb2_device *fbdev, struct fb_info *fbi);
+
+#ifdef DEBUG
+static void draw_pixel(struct fb_info *fbi, int x, int y, unsigned color)
+{
+	struct fb_var_screeninfo *var = &fbi->var;
+	struct fb_fix_screeninfo *fix = &fbi->fix;
+	void __iomem *addr = fbi->screen_base;
+	const unsigned bytespp = var->bits_per_pixel >> 3;
+	const unsigned line_len = fix->line_length / bytespp;
+
+	int r = (color >> 16) & 0xff;
+	int g = (color >> 8) & 0xff;
+	int b = (color >> 0) & 0xff;
+
+	if (var->bits_per_pixel == 16) {
+		u16 __iomem *p = (u16 __iomem *)addr;
+		p += y * line_len + x;
+
+		r = r * 32 / 256;
+		g = g * 64 / 256;
+		b = b * 32 / 256;
+
+		__raw_writew((r << 11) | (g << 5) | (b << 0), p);
+	} else if (var->bits_per_pixel == 24) {
+		u8 __iomem *p = (u8 __iomem *)addr;
+		p += (y * line_len + x) * 3;
+
+		__raw_writeb(b, p + 0);
+		__raw_writeb(g, p + 1);
+		__raw_writeb(r, p + 2);
+	} else if (var->bits_per_pixel == 32) {
+		u32 __iomem *p = (u32 __iomem *)addr;
+		p += y * line_len + x;
+		__raw_writel(color, p);
+	}
+}
+
+static void fill_fb(struct fb_info *fbi)
+{
+	struct fb_var_screeninfo *var = &fbi->var;
+	const short w = var->xres_virtual;
+	const short h = var->yres_virtual;
+	void __iomem *addr = fbi->screen_base;
+	int y, x;
+
+	if (!addr)
+		return;
+
+	DBG("fill_fb %dx%d, line_len %d bytes\n", w, h, fbi->fix.line_length);
+
+	for (y = 0; y < h; y++) {
+		for (x = 0; x < w; x++) {
+			if (x < 20 && y < 20)
+				draw_pixel(fbi, x, y, 0xffffff);
+			else if (x < 20 && (y > 20 && y < h - 20))
+				draw_pixel(fbi, x, y, 0xff);
+			else if (y < 20 && (x > 20 && x < w - 20))
+				draw_pixel(fbi, x, y, 0xff00);
+			else if (x > w - 20 && (y > 20 && y < h - 20))
+				draw_pixel(fbi, x, y, 0xff0000);
+			else if (y > h - 20 && (x > 20 && x < w - 20))
+				draw_pixel(fbi, x, y, 0xffff00);
+			else if (x == 20 || x == w - 20 ||
+					y == 20 || y == h - 20)
+				draw_pixel(fbi, x, y, 0xffffff);
+			else if (x == y || w - x == h - y)
+				draw_pixel(fbi, x, y, 0xff00ff);
+			else if (w - x == y || x == h - y)
+				draw_pixel(fbi, x, y, 0x00ffff);
+			else if (x > 20 && y > 20 && x < w - 20 && y < h - 20) {
+				int t = x * 3 / w;
+				unsigned r = 0, g = 0, b = 0;
+				unsigned c;
+				if (var->bits_per_pixel == 16) {
+					if (t == 0)
+						b = (y % 32) * 256 / 32;
+					else if (t == 1)
+						g = (y % 64) * 256 / 64;
+					else if (t == 2)
+						r = (y % 32) * 256 / 32;
+				} else {
+					if (t == 0)
+						b = (y % 256);
+					else if (t == 1)
+						g = (y % 256);
+					else if (t == 2)
+						r = (y % 256);
+				}
+				c = (r << 16) | (g << 8) | (b << 0);
+				draw_pixel(fbi, x, y, c);
+			} else {
+				draw_pixel(fbi, x, y, 0);
+			}
+		}
+	}
+}
+#endif
+
+static unsigned omapfb_get_vrfb_offset(struct omapfb_info *ofbi, int rot)
+{
+	struct vrfb *vrfb = &ofbi->region.vrfb;
+	unsigned offset;
+
+	switch (rot) {
+	case FB_ROTATE_UR:
+		offset = 0;
+		break;
+	case FB_ROTATE_CW:
+		offset = vrfb->yoffset;
+		break;
+	case FB_ROTATE_UD:
+		offset = vrfb->yoffset * OMAP_VRFB_LINE_LEN + vrfb->xoffset;
+		break;
+	case FB_ROTATE_CCW:
+		offset = vrfb->xoffset * OMAP_VRFB_LINE_LEN;
+		break;
+	default:
+		BUG();
+	}
+
+	offset *= vrfb->bytespp;
+
+	return offset;
+}
+
+static u32 omapfb_get_region_rot_paddr(struct omapfb_info *ofbi, int rot)
+{
+	if (ofbi->rotation_type == OMAP_DSS_ROT_VRFB) {
+		return ofbi->region.vrfb.paddr[rot]
+			+ omapfb_get_vrfb_offset(ofbi, rot);
+	} else {
+		return ofbi->region.paddr;
+	}
+}
+
+static u32 omapfb_get_region_paddr(struct omapfb_info *ofbi)
+{
+	if (ofbi->rotation_type == OMAP_DSS_ROT_VRFB)
+		return ofbi->region.vrfb.paddr[0];
+	else
+		return ofbi->region.paddr;
+}
+
+static void __iomem *omapfb_get_region_vaddr(struct omapfb_info *ofbi)
+{
+	if (ofbi->rotation_type == OMAP_DSS_ROT_VRFB)
+		return ofbi->region.vrfb.vaddr[0];
+	else
+		return ofbi->region.vaddr;
+}
+
+static struct omapfb_colormode omapfb_colormodes[] = {
+	{
+		.dssmode = OMAP_DSS_COLOR_UYVY,
+		.bits_per_pixel = 16,
+		.nonstd = OMAPFB_COLOR_YUV422,
+	}, {
+		.dssmode = OMAP_DSS_COLOR_YUV2,
+		.bits_per_pixel = 16,
+		.nonstd = OMAPFB_COLOR_YUY422,
+	}, {
+		.dssmode = OMAP_DSS_COLOR_ARGB16,
+		.bits_per_pixel = 16,
+		.red	= { .length = 4, .offset = 8, .msb_right = 0 },
+		.green	= { .length = 4, .offset = 4, .msb_right = 0 },
+		.blue	= { .length = 4, .offset = 0, .msb_right = 0 },
+		.transp	= { .length = 4, .offset = 12, .msb_right = 0 },
+	}, {
+		.dssmode = OMAP_DSS_COLOR_RGB16,
+		.bits_per_pixel = 16,
+		.red	= { .length = 5, .offset = 11, .msb_right = 0 },
+		.green	= { .length = 6, .offset = 5, .msb_right = 0 },
+		.blue	= { .length = 5, .offset = 0, .msb_right = 0 },
+		.transp	= { .length = 0, .offset = 0, .msb_right = 0 },
+	}, {
+		.dssmode = OMAP_DSS_COLOR_RGB24P,
+		.bits_per_pixel = 24,
+		.red	= { .length = 8, .offset = 16, .msb_right = 0 },
+		.green	= { .length = 8, .offset = 8, .msb_right = 0 },
+		.blue	= { .length = 8, .offset = 0, .msb_right = 0 },
+		.transp	= { .length = 0, .offset = 0, .msb_right = 0 },
+	}, {
+		.dssmode = OMAP_DSS_COLOR_RGB24U,
+		.bits_per_pixel = 32,
+		.red	= { .length = 8, .offset = 16, .msb_right = 0 },
+		.green	= { .length = 8, .offset = 8, .msb_right = 0 },
+		.blue	= { .length = 8, .offset = 0, .msb_right = 0 },
+		.transp	= { .length = 0, .offset = 0, .msb_right = 0 },
+	}, {
+		.dssmode = OMAP_DSS_COLOR_ARGB32,
+		.bits_per_pixel = 32,
+		.red	= { .length = 8, .offset = 16, .msb_right = 0 },
+		.green	= { .length = 8, .offset = 8, .msb_right = 0 },
+		.blue	= { .length = 8, .offset = 0, .msb_right = 0 },
+		.transp	= { .length = 8, .offset = 24, .msb_right = 0 },
+	}, {
+		.dssmode = OMAP_DSS_COLOR_RGBA32,
+		.bits_per_pixel = 32,
+		.red	= { .length = 8, .offset = 24, .msb_right = 0 },
+		.green	= { .length = 8, .offset = 16, .msb_right = 0 },
+		.blue	= { .length = 8, .offset = 8, .msb_right = 0 },
+		.transp	= { .length = 8, .offset = 0, .msb_right = 0 },
+	}, {
+		.dssmode = OMAP_DSS_COLOR_RGBX32,
+		.bits_per_pixel = 32,
+		.red	= { .length = 8, .offset = 24, .msb_right = 0 },
+		.green	= { .length = 8, .offset = 16, .msb_right = 0 },
+		.blue	= { .length = 8, .offset = 8, .msb_right = 0 },
+		.transp	= { .length = 0, .offset = 0, .msb_right = 0 },
+	},
+};
+
+static bool cmp_var_to_colormode(struct fb_var_screeninfo *var,
+		struct omapfb_colormode *color)
+{
+	bool cmp_component(struct fb_bitfield *f1, struct fb_bitfield *f2)
+	{
+		return f1->length == f2->length &&
+			f1->offset == f2->offset &&
+			f1->msb_right == f2->msb_right;
+	}
+
+	if (var->bits_per_pixel == 0 ||
+			var->red.length == 0 ||
+			var->blue.length == 0 ||
+			var->green.length == 0)
+		return 0;
+
+	return var->bits_per_pixel == color->bits_per_pixel &&
+		cmp_component(&var->red, &color->red) &&
+		cmp_component(&var->green, &color->green) &&
+		cmp_component(&var->blue, &color->blue) &&
+		cmp_component(&var->transp, &color->transp);
+}
+
+static void assign_colormode_to_var(struct fb_var_screeninfo *var,
+		struct omapfb_colormode *color)
+{
+	var->bits_per_pixel = color->bits_per_pixel;
+	var->nonstd = color->nonstd;
+	var->red = color->red;
+	var->green = color->green;
+	var->blue = color->blue;
+	var->transp = color->transp;
+}
+
+static int fb_mode_to_dss_mode(struct fb_var_screeninfo *var,
+		enum omap_color_mode *mode)
+{
+	enum omap_color_mode dssmode;
+	int i;
+
+	/* first match with nonstd field */
+	if (var->nonstd) {
+		for (i = 0; i < ARRAY_SIZE(omapfb_colormodes); ++i) {
+			struct omapfb_colormode *m = &omapfb_colormodes[i];
+			if (var->nonstd == m->nonstd) {
+				assign_colormode_to_var(var, m);
+				*mode = m->dssmode;
+				return 0;
+			}
+		}
+
+		return -EINVAL;
+	}
+
+	/* then try exact match of bpp and colors */
+	for (i = 0; i < ARRAY_SIZE(omapfb_colormodes); ++i) {
+		struct omapfb_colormode *m = &omapfb_colormodes[i];
+		if (cmp_var_to_colormode(var, m)) {
+			assign_colormode_to_var(var, m);
+			*mode = m->dssmode;
+			return 0;
+		}
+	}
+
+	/* match with bpp if user has not filled color fields
+	 * properly */
+	switch (var->bits_per_pixel) {
+	case 1:
+		dssmode = OMAP_DSS_COLOR_CLUT1;
+		break;
+	case 2:
+		dssmode = OMAP_DSS_COLOR_CLUT2;
+		break;
+	case 4:
+		dssmode = OMAP_DSS_COLOR_CLUT4;
+		break;
+	case 8:
+		dssmode = OMAP_DSS_COLOR_CLUT8;
+		break;
+	case 12:
+		dssmode = OMAP_DSS_COLOR_RGB12U;
+		break;
+	case 16:
+		dssmode = OMAP_DSS_COLOR_RGB16;
+		break;
+	case 24:
+		dssmode = OMAP_DSS_COLOR_RGB24P;
+		break;
+	case 32:
+		dssmode = OMAP_DSS_COLOR_RGB24U;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	for (i = 0; i < ARRAY_SIZE(omapfb_colormodes); ++i) {
+		struct omapfb_colormode *m = &omapfb_colormodes[i];
+		if (dssmode == m->dssmode) {
+			assign_colormode_to_var(var, m);
+			*mode = m->dssmode;
+			return 0;
+		}
+	}
+
+	return -EINVAL;
+}
+
+static int check_fb_res_bounds(struct fb_var_screeninfo *var)
+{
+	int xres_min = OMAPFB_PLANE_XRES_MIN;
+	int xres_max = 2048;
+	int yres_min = OMAPFB_PLANE_YRES_MIN;
+	int yres_max = 2048;
+
+	/* XXX: some applications seem to set virtual res to 0. */
+	if (var->xres_virtual == 0)
+		var->xres_virtual = var->xres;
+
+	if (var->yres_virtual == 0)
+		var->yres_virtual = var->yres;
+
+	if (var->xres_virtual < xres_min || var->yres_virtual < yres_min)
+		return -EINVAL;
+
+	if (var->xres < xres_min)
+		var->xres = xres_min;
+	if (var->yres < yres_min)
+		var->yres = yres_min;
+	if (var->xres > xres_max)
+		var->xres = xres_max;
+	if (var->yres > yres_max)
+		var->yres = yres_max;
+
+	if (var->xres > var->xres_virtual)
+		var->xres = var->xres_virtual;
+	if (var->yres > var->yres_virtual)
+		var->yres = var->yres_virtual;
+
+	return 0;
+}
+
+static void shrink_height(unsigned long max_frame_size,
+		struct fb_var_screeninfo *var)
+{
+	DBG("can't fit FB into memory, reducing y\n");
+	var->yres_virtual = max_frame_size /
+		(var->xres_virtual * var->bits_per_pixel >> 3);
+
+	if (var->yres_virtual < OMAPFB_PLANE_YRES_MIN)
+		var->yres_virtual = OMAPFB_PLANE_YRES_MIN;
+
+	if (var->yres > var->yres_virtual)
+		var->yres = var->yres_virtual;
+}
+
+static void shrink_width(unsigned long max_frame_size,
+		struct fb_var_screeninfo *var)
+{
+	DBG("can't fit FB into memory, reducing x\n");
+	var->xres_virtual = max_frame_size / var->yres_virtual /
+		(var->bits_per_pixel >> 3);
+
+	if (var->xres_virtual < OMAPFB_PLANE_XRES_MIN)
+		var->xres_virtual = OMAPFB_PLANE_XRES_MIN;
+
+	if (var->xres > var->xres_virtual)
+		var->xres = var->xres_virtual;
+}
+
+static int check_vrfb_fb_size(unsigned long region_size,
+		const struct fb_var_screeninfo *var)
+{
+	unsigned long min_phys_size = omap_vrfb_min_phys_size(var->xres_virtual,
+		var->yres_virtual, var->bits_per_pixel >> 3);
+
+	return min_phys_size > region_size ? -EINVAL : 0;
+}
+
+static int check_fb_size(const struct omapfb_info *ofbi,
+		struct fb_var_screeninfo *var)
+{
+	unsigned long max_frame_size = ofbi->region.size;
+	int bytespp = var->bits_per_pixel >> 3;
+	unsigned long line_size = var->xres_virtual * bytespp;
+
+	if (ofbi->rotation_type == OMAP_DSS_ROT_VRFB) {
+		/* One needs to check for both VRFB and OMAPFB limitations. */
+		if (check_vrfb_fb_size(max_frame_size, var))
+			shrink_height(omap_vrfb_max_height(
+				max_frame_size, var->xres_virtual, bytespp) *
+				line_size, var);
+
+		if (check_vrfb_fb_size(max_frame_size, var)) {
+			DBG("cannot fit FB to memory\n");
+			return -EINVAL;
+		}
+
+		return 0;
+	}
+
+	DBG("max frame size %lu, line size %lu\n", max_frame_size, line_size);
+
+	if (line_size * var->yres_virtual > max_frame_size)
+		shrink_height(max_frame_size, var);
+
+	if (line_size * var->yres_virtual > max_frame_size) {
+		shrink_width(max_frame_size, var);
+		line_size = var->xres_virtual * bytespp;
+	}
+
+	if (line_size * var->yres_virtual > max_frame_size) {
+		DBG("cannot fit FB to memory\n");
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
+/*
+ * Consider if VRFB assisted rotation is in use and if the virtual space for
+ * the zero degree view needs to be mapped. The need for mapping also acts as
+ * the trigger for setting up the hardware on the context in question. This
+ * ensures that one does not attempt to access the virtual view before the
+ * hardware is serving the address translations.
+ */
+static int setup_vrfb_rotation(struct fb_info *fbi)
+{
+	struct omapfb_info *ofbi = FB2OFB(fbi);
+	struct omapfb2_mem_region *rg = &ofbi->region;
+	struct vrfb *vrfb = &rg->vrfb;
+	struct fb_var_screeninfo *var = &fbi->var;
+	struct fb_fix_screeninfo *fix = &fbi->fix;
+	unsigned bytespp;
+	bool yuv_mode;
+	enum omap_color_mode mode;
+	int r;
+	bool reconf;
+
+	if (!rg->size || ofbi->rotation_type != OMAP_DSS_ROT_VRFB)
+		return 0;
+
+	DBG("setup_vrfb_rotation\n");
+
+	r = fb_mode_to_dss_mode(var, &mode);
+	if (r)
+		return r;
+
+	bytespp = var->bits_per_pixel >> 3;
+
+	yuv_mode = mode == OMAP_DSS_COLOR_YUV2 || mode == OMAP_DSS_COLOR_UYVY;
+
+	/* We need to reconfigure VRFB if the resolution changes, if yuv mode
+	 * is enabled/disabled, or if bytes per pixel changes */
+
+	/* XXX we shouldn't allow this when framebuffer is mmapped */
+
+	reconf = false;
+
+	if (yuv_mode != vrfb->yuv_mode)
+		reconf = true;
+	else if (bytespp != vrfb->bytespp)
+		reconf = true;
+	else if (vrfb->xres != var->xres_virtual ||
+			vrfb->yres != var->yres_virtual)
+		reconf = true;
+
+	if (vrfb->vaddr[0] && reconf) {
+		fbi->screen_base = NULL;
+		fix->smem_start = 0;
+		fix->smem_len = 0;
+		iounmap(vrfb->vaddr[0]);
+		vrfb->vaddr[0] = NULL;
+		DBG("setup_vrfb_rotation: reset fb\n");
+	}
+
+	if (vrfb->vaddr[0])
+		return 0;
+
+	omap_vrfb_setup(&rg->vrfb, rg->paddr,
+			var->xres_virtual,
+			var->yres_virtual,
+			bytespp, yuv_mode);
+
+	/* Now one can ioremap the 0 angle view */
+	r = omap_vrfb_map_angle(vrfb, var->yres_virtual, 0);
+	if (r)
+		return r;
+
+	/* used by open/write in fbmem.c */
+	fbi->screen_base = ofbi->region.vrfb.vaddr[0];
+
+	fix->smem_start = ofbi->region.vrfb.paddr[0];
+
+	switch (var->nonstd) {
+	case OMAPFB_COLOR_YUV422:
+	case OMAPFB_COLOR_YUY422:
+		fix->line_length =
+			(OMAP_VRFB_LINE_LEN * var->bits_per_pixel) >> 2;
+		break;
+	default:
+		fix->line_length =
+			(OMAP_VRFB_LINE_LEN * var->bits_per_pixel) >> 3;
+		break;
+	}
+
+	fix->smem_len = var->yres_virtual * fix->line_length;
+
+	return 0;
+}
+
+int dss_mode_to_fb_mode(enum omap_color_mode dssmode,
+			struct fb_var_screeninfo *var)
+{
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(omapfb_colormodes); ++i) {
+		struct omapfb_colormode *mode = &omapfb_colormodes[i];
+		if (dssmode == mode->dssmode) {
+			assign_colormode_to_var(var, mode);
+			return 0;
+		}
+	}
+	return -ENOENT;
+}
+
+void set_fb_fix(struct fb_info *fbi)
+{
+	struct fb_fix_screeninfo *fix = &fbi->fix;
+	struct fb_var_screeninfo *var = &fbi->var;
+	struct omapfb_info *ofbi = FB2OFB(fbi);
+	struct omapfb2_mem_region *rg = &ofbi->region;
+
+	DBG("set_fb_fix\n");
+
+	/* used by open/write in fbmem.c */
+	fbi->screen_base = (char __iomem *)omapfb_get_region_vaddr(ofbi);
+
+	/* used by mmap in fbmem.c */
+	if (ofbi->rotation_type == OMAP_DSS_ROT_VRFB) {
+		switch (var->nonstd) {
+		case OMAPFB_COLOR_YUV422:
+		case OMAPFB_COLOR_YUY422:
+			fix->line_length =
+				(OMAP_VRFB_LINE_LEN * var->bits_per_pixel) >> 2;
+			break;
+		default:
+			fix->line_length =
+				(OMAP_VRFB_LINE_LEN * var->bits_per_pixel) >> 3;
+			break;
+		}
+
+		fix->smem_len = var->yres_virtual * fix->line_length;
+	} else {
+		fix->line_length =
+			(var->xres_virtual * var->bits_per_pixel) >> 3;
+		fix->smem_len = rg->size;
+	}
+
+	fix->smem_start = omapfb_get_region_paddr(ofbi);
+
+	fix->type = FB_TYPE_PACKED_PIXELS;
+
+	if (var->nonstd)
+		fix->visual = FB_VISUAL_PSEUDOCOLOR;
+	else {
+		switch (var->bits_per_pixel) {
+		case 32:
+		case 24:
+		case 16:
+		case 12:
+			fix->visual = FB_VISUAL_TRUECOLOR;
+			/* 12bpp is stored in 16 bits */
+			break;
+		case 1:
+		case 2:
+		case 4:
+		case 8:
+			fix->visual = FB_VISUAL_PSEUDOCOLOR;
+			break;
+		}
+	}
+
+	fix->accel = FB_ACCEL_NONE;
+
+	fix->xpanstep = 1;
+	fix->ypanstep = 1;
+}
+
+/* check new var and possibly modify it to be ok */
+int check_fb_var(struct fb_info *fbi, struct fb_var_screeninfo *var)
+{
+	struct omapfb_info *ofbi = FB2OFB(fbi);
+	struct omap_dss_device *display = fb2display(fbi);
+	enum omap_color_mode mode = 0;
+	int i;
+	int r;
+
+	DBG("check_fb_var %d\n", ofbi->id);
+
+	if (ofbi->region.size == 0)
+		return 0;
+
+	r = fb_mode_to_dss_mode(var, &mode);
+	if (r) {
+		DBG("cannot convert var to omap dss mode\n");
+		return r;
+	}
+
+	for (i = 0; i < ofbi->num_overlays; ++i) {
+		if ((ofbi->overlays[i]->supported_modes & mode) == 0) {
+			DBG("invalid mode\n");
+			return -EINVAL;
+		}
+	}
+
+	if (var->rotate < 0 || var->rotate > 3)
+		return -EINVAL;
+
+	if (check_fb_res_bounds(var))
+		return -EINVAL;
+
+	if (check_fb_size(ofbi, var))
+		return -EINVAL;
+
+	if (var->xres + var->xoffset > var->xres_virtual)
+		var->xoffset = var->xres_virtual - var->xres;
+	if (var->yres + var->yoffset > var->yres_virtual)
+		var->yoffset = var->yres_virtual - var->yres;
+
+	DBG("xres = %d, yres = %d, vxres = %d, vyres = %d\n",
+			var->xres, var->yres,
+			var->xres_virtual, var->yres_virtual);
+
+	var->height             = -1;
+	var->width              = -1;
+	var->grayscale          = 0;
+
+	if (display && display->get_timings) {
+		struct omap_video_timings timings;
+		display->get_timings(display, &timings);
+
+		/* pixclock in ps, the rest in pixclock */
+		var->pixclock = timings.pixel_clock != 0 ?
+			KHZ2PICOS(timings.pixel_clock) :
+			0;
+		var->left_margin = timings.hfp;
+		var->right_margin = timings.hbp;
+		var->upper_margin = timings.vfp;
+		var->lower_margin = timings.vbp;
+		var->hsync_len = timings.hsw;
+		var->vsync_len = timings.vsw;
+	} else {
+		var->pixclock = 0;
+		var->left_margin = 0;
+		var->right_margin = 0;
+		var->upper_margin = 0;
+		var->lower_margin = 0;
+		var->hsync_len = 0;
+		var->vsync_len = 0;
+	}
+
+	/* TODO: get these from panel->config */
+	var->vmode              = FB_VMODE_NONINTERLACED;
+	var->sync               = 0;
+
+	return 0;
+}
+
+/*
+ * ---------------------------------------------------------------------------
+ * fbdev framework callbacks
+ * ---------------------------------------------------------------------------
+ */
+static int omapfb_open(struct fb_info *fbi, int user)
+{
+	return 0;
+}
+
+static int omapfb_release(struct fb_info *fbi, int user)
+{
+#if 0
+	struct omapfb_info *ofbi = FB2OFB(fbi);
+	struct omapfb2_device *fbdev = ofbi->fbdev;
+	struct omap_dss_device *display = fb2display(fbi);
+
+	DBG("Closing fb with plane index %d\n", ofbi->id);
+
+	omapfb_lock(fbdev);
+
+	if (display && display->get_update_mode && display->update) {
+		/* XXX this update should be removed, I think. But it's
+		 * good for debugging */
+		if (display->get_update_mode(display) ==
+				OMAP_DSS_UPDATE_MANUAL) {
+			u16 w, h;
+
+			if (display->sync)
+				display->sync(display);
+
+			display->get_resolution(display, &w, &h);
+			display->update(display, 0, 0, w, h);
+		}
+	}
+
+	if (display && display->sync)
+		display->sync(display);
+
+	omapfb_unlock(fbdev);
+#endif
+	return 0;
+}
+
+static unsigned calc_rotation_offset_dma(struct fb_var_screeninfo *var,
+		struct fb_fix_screeninfo *fix, int rotation)
+{
+	unsigned offset;
+
+	offset = var->yoffset * fix->line_length +
+		var->xoffset * (var->bits_per_pixel >> 3);
+
+	return offset;
+}
+
+static unsigned calc_rotation_offset_vrfb(struct fb_var_screeninfo *var,
+		struct fb_fix_screeninfo *fix, int rotation)
+{
+	unsigned offset;
+
+	if (rotation == FB_ROTATE_UD)
+		offset = (var->yres_virtual - var->yres) *
+			fix->line_length;
+	else if (rotation == FB_ROTATE_CW)
+		offset = (var->yres_virtual - var->yres) *
+			(var->bits_per_pixel >> 3);
+	else
+		offset = 0;
+
+	if (rotation == FB_ROTATE_UR)
+		offset += var->yoffset * fix->line_length +
+			var->xoffset * (var->bits_per_pixel >> 3);
+	else if (rotation == FB_ROTATE_UD)
+		offset -= var->yoffset * fix->line_length +
+			var->xoffset * (var->bits_per_pixel >> 3);
+	else if (rotation == FB_ROTATE_CW)
+		offset -= var->xoffset * fix->line_length +
+			var->yoffset * (var->bits_per_pixel >> 3);
+	else if (rotation == FB_ROTATE_CCW)
+		offset += var->xoffset * fix->line_length +
+			var->yoffset * (var->bits_per_pixel >> 3);
+
+	return offset;
+}
+
+
+/* setup overlay according to the fb */
+static int omapfb_setup_overlay(struct fb_info *fbi, struct omap_overlay *ovl,
+		u16 posx, u16 posy, u16 outw, u16 outh)
+{
+	int r = 0;
+	struct omapfb_info *ofbi = FB2OFB(fbi);
+	struct fb_var_screeninfo *var = &fbi->var;
+	struct fb_fix_screeninfo *fix = &fbi->fix;
+	enum omap_color_mode mode = 0;
+	int offset;
+	u32 data_start_p;
+	void __iomem *data_start_v;
+	struct omap_overlay_info info;
+	int xres, yres;
+	int screen_width;
+	int mirror;
+	int rotation = var->rotate;
+	int i;
+
+	for (i = 0; i < ofbi->num_overlays; i++) {
+		if (ovl != ofbi->overlays[i])
+			continue;
+
+		rotation = (rotation + ofbi->rotation[i]) % 4;
+		break;
+	}
+
+	DBG("setup_overlay %d, posx %d, posy %d, outw %d, outh %d\n", ofbi->id,
+			posx, posy, outw, outh);
+
+	if (rotation == FB_ROTATE_CW || rotation == FB_ROTATE_CCW) {
+		xres = var->yres;
+		yres = var->xres;
+	} else {
+		xres = var->xres;
+		yres = var->yres;
+	}
+
+
+	if (ofbi->rotation_type == OMAP_DSS_ROT_VRFB) {
+		data_start_p = omapfb_get_region_rot_paddr(ofbi, rotation);
+		data_start_v = NULL;
+	} else {
+		data_start_p = omapfb_get_region_paddr(ofbi);
+		data_start_v = omapfb_get_region_vaddr(ofbi);
+	}
+
+	if (ofbi->rotation_type == OMAP_DSS_ROT_VRFB)
+		offset = calc_rotation_offset_vrfb(var, fix, rotation);
+	else
+		offset = calc_rotation_offset_dma(var, fix, rotation);
+
+	data_start_p += offset;
+	data_start_v += offset;
+
+	if (offset)
+		DBG("offset %d, %d = %d\n",
+				var->xoffset, var->yoffset, offset);
+
+	DBG("paddr %x, vaddr %p\n", data_start_p, data_start_v);
+
+	r = fb_mode_to_dss_mode(var, &mode);
+	if (r) {
+		DBG("fb_mode_to_dss_mode failed");
+		goto err;
+	}
+
+	switch (var->nonstd) {
+	case OMAPFB_COLOR_YUV422:
+	case OMAPFB_COLOR_YUY422:
+		if (ofbi->rotation_type == OMAP_DSS_ROT_VRFB) {
+			screen_width = fix->line_length
+				/ (var->bits_per_pixel >> 2);
+			break;
+		}
+	default:
+		screen_width = fix->line_length / (var->bits_per_pixel >> 3);
+		break;
+	}
+
+	ovl->get_overlay_info(ovl, &info);
+
+	if (ofbi->rotation_type == OMAP_DSS_ROT_VRFB)
+		mirror = 0;
+	else
+		mirror = ofbi->mirror;
+
+	info.paddr = data_start_p;
+	info.vaddr = data_start_v;
+	info.screen_width = screen_width;
+	info.width = xres;
+	info.height = yres;
+	info.color_mode = mode;
+	info.rotation_type = ofbi->rotation_type;
+	info.rotation = rotation;
+	info.mirror = mirror;
+
+	info.pos_x = posx;
+	info.pos_y = posy;
+	info.out_width = outw;
+	info.out_height = outh;
+
+	r = ovl->set_overlay_info(ovl, &info);
+	if (r) {
+		DBG("ovl->setup_overlay_info failed\n");
+		goto err;
+	}
+
+	return 0;
+
+err:
+	DBG("setup_overlay failed\n");
+	return r;
+}
+
+/* apply var to the overlay */
+int omapfb_apply_changes(struct fb_info *fbi, int init)
+{
+	int r = 0;
+	struct omapfb_info *ofbi = FB2OFB(fbi);
+	struct fb_var_screeninfo *var = &fbi->var;
+	struct omap_overlay *ovl;
+	u16 posx, posy;
+	u16 outw, outh;
+	int i;
+
+#ifdef DEBUG
+	if (omapfb_test_pattern)
+		fill_fb(fbi);
+#endif
+
+	for (i = 0; i < ofbi->num_overlays; i++) {
+		ovl = ofbi->overlays[i];
+
+		DBG("apply_changes, fb %d, ovl %d\n", ofbi->id, ovl->id);
+
+		if (ofbi->region.size == 0) {
+			/* the fb is not available. disable the overlay */
+			omapfb_overlay_enable(ovl, 0);
+			if (!init && ovl->manager)
+				ovl->manager->apply(ovl->manager);
+			continue;
+		}
+
+		if (init || (ovl->caps & OMAP_DSS_OVL_CAP_SCALE) == 0) {
+			int rotation = (var->rotate + ofbi->rotation[i]) % 4;
+			if (rotation == FB_ROTATE_CW ||
+					rotation == FB_ROTATE_CCW) {
+				outw = var->yres;
+				outh = var->xres;
+			} else {
+				outw = var->xres;
+				outh = var->yres;
+			}
+		} else {
+			outw = ovl->info.out_width;
+			outh = ovl->info.out_height;
+		}
+
+		if (init) {
+			posx = 0;
+			posy = 0;
+		} else {
+			posx = ovl->info.pos_x;
+			posy = ovl->info.pos_y;
+		}
+
+		r = omapfb_setup_overlay(fbi, ovl, posx, posy, outw, outh);
+		if (r)
+			goto err;
+
+		if (!init && ovl->manager)
+			ovl->manager->apply(ovl->manager);
+	}
+	return 0;
+err:
+	DBG("apply_changes failed\n");
+	return r;
+}
+
+/* checks var and eventually tweaks it to something supported,
+ * DO NOT MODIFY PAR */
+static int omapfb_check_var(struct fb_var_screeninfo *var, struct fb_info *fbi)
+{
+	int r;
+
+	DBG("check_var(%d)\n", FB2OFB(fbi)->id);
+
+	r = check_fb_var(fbi, var);
+
+	return r;
+}
+
+/* set the video mode according to info->var */
+static int omapfb_set_par(struct fb_info *fbi)
+{
+	int r;
+
+	DBG("set_par(%d)\n", FB2OFB(fbi)->id);
+
+	set_fb_fix(fbi);
+
+	r = setup_vrfb_rotation(fbi);
+	if (r)
+		return r;
+
+	r = omapfb_apply_changes(fbi, 0);
+
+	return r;
+}
+
+static int omapfb_pan_display(struct fb_var_screeninfo *var,
+		struct fb_info *fbi)
+{
+	struct fb_var_screeninfo new_var;
+	int r;
+
+	DBG("pan_display(%d)\n", FB2OFB(fbi)->id);
+
+	if (var->xoffset == fbi->var.xoffset &&
+	    var->yoffset == fbi->var.yoffset)
+		return 0;
+
+	new_var = fbi->var;
+	new_var.xoffset = var->xoffset;
+	new_var.yoffset = var->yoffset;
+
+	fbi->var = new_var;
+
+	r = omapfb_apply_changes(fbi, 0);
+
+	return r;
+}
+
+static void mmap_user_open(struct vm_area_struct *vma)
+{
+	struct omapfb_info *ofbi = (struct omapfb_info *)vma->vm_private_data;
+
+	atomic_inc(&ofbi->map_count);
+}
+
+static void mmap_user_close(struct vm_area_struct *vma)
+{
+	struct omapfb_info *ofbi = (struct omapfb_info *)vma->vm_private_data;
+
+	atomic_dec(&ofbi->map_count);
+}
+
+static struct vm_operations_struct mmap_user_ops = {
+	.open = mmap_user_open,
+	.close = mmap_user_close,
+};
+
+static int omapfb_mmap(struct fb_info *fbi, struct vm_area_struct *vma)
+{
+	struct omapfb_info *ofbi = FB2OFB(fbi);
+	struct fb_fix_screeninfo *fix = &fbi->fix;
+	unsigned long off;
+	unsigned long start;
+	u32 len;
+
+	if (vma->vm_end - vma->vm_start == 0)
+		return 0;
+	if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT))
+		return -EINVAL;
+	off = vma->vm_pgoff << PAGE_SHIFT;
+
+	start = omapfb_get_region_paddr(ofbi);
+	len = fix->smem_len;
+	if (off >= len)
+		return -EINVAL;
+	if ((vma->vm_end - vma->vm_start + off) > len)
+		return -EINVAL;
+
+	off += start;
+
+	DBG("user mmap region start %lx, len %d, off %lx\n", start, len, off);
+
+	vma->vm_pgoff = off >> PAGE_SHIFT;
+	vma->vm_flags |= VM_IO | VM_RESERVED;
+	vma->vm_page_prot = pgprot_writecombine(vma->vm_page_prot);
+	vma->vm_ops = &mmap_user_ops;
+	vma->vm_private_data = ofbi;
+	if (io_remap_pfn_range(vma, vma->vm_start, off >> PAGE_SHIFT,
+			     vma->vm_end - vma->vm_start, vma->vm_page_prot))
+		return -EAGAIN;
+	/* vm_ops.open won't be called for mmap itself. */
+	atomic_inc(&ofbi->map_count);
+	return 0;
+}
+
+/* Store a single color palette entry into a pseudo palette or the hardware
+ * palette if one is available. For now we support only 16bpp and thus store
+ * the entry only to the pseudo palette.
+ */
+static int _setcolreg(struct fb_info *fbi, u_int regno, u_int red, u_int green,
+		u_int blue, u_int transp, int update_hw_pal)
+{
+	/*struct omapfb_info *ofbi = FB2OFB(fbi);*/
+	/*struct omapfb2_device *fbdev = ofbi->fbdev;*/
+	struct fb_var_screeninfo *var = &fbi->var;
+	int r = 0;
+
+	enum omapfb_color_format mode = OMAPFB_COLOR_RGB24U; /* XXX */
+
+	/*switch (plane->color_mode) {*/
+	switch (mode) {
+	case OMAPFB_COLOR_YUV422:
+	case OMAPFB_COLOR_YUV420:
+	case OMAPFB_COLOR_YUY422:
+		r = -EINVAL;
+		break;
+	case OMAPFB_COLOR_CLUT_8BPP:
+	case OMAPFB_COLOR_CLUT_4BPP:
+	case OMAPFB_COLOR_CLUT_2BPP:
+	case OMAPFB_COLOR_CLUT_1BPP:
+		/*
+		   if (fbdev->ctrl->setcolreg)
+		   r = fbdev->ctrl->setcolreg(regno, red, green, blue,
+		   transp, update_hw_pal);
+		   */
+		/* Fallthrough */
+		r = -EINVAL;
+		break;
+	case OMAPFB_COLOR_RGB565:
+	case OMAPFB_COLOR_RGB444:
+	case OMAPFB_COLOR_RGB24P:
+	case OMAPFB_COLOR_RGB24U:
+		if (r != 0)
+			break;
+
+		if (regno < 0) {
+			r = -EINVAL;
+			break;
+		}
+
+		if (regno < 16) {
+			u16 pal;
+			pal = ((red >> (16 - var->red.length)) <<
+					var->red.offset) |
+				((green >> (16 - var->green.length)) <<
+				 var->green.offset) |
+				(blue >> (16 - var->blue.length));
+			((u32 *)(fbi->pseudo_palette))[regno] = pal;
+		}
+		break;
+	default:
+		BUG();
+	}
+	return r;
+}
+
+static int omapfb_setcolreg(u_int regno, u_int red, u_int green, u_int blue,
+		u_int transp, struct fb_info *info)
+{
+	DBG("setcolreg\n");
+
+	return _setcolreg(info, regno, red, green, blue, transp, 1);
+}
+
+static int omapfb_setcmap(struct fb_cmap *cmap, struct fb_info *info)
+{
+	int count, index, r;
+	u16 *red, *green, *blue, *transp;
+	u16 trans = 0xffff;
+
+	DBG("setcmap\n");
+
+	red     = cmap->red;
+	green   = cmap->green;
+	blue    = cmap->blue;
+	transp  = cmap->transp;
+	index   = cmap->start;
+
+	for (count = 0; count < cmap->len; count++) {
+		if (transp)
+			trans = *transp++;
+		r = _setcolreg(info, index++, *red++, *green++, *blue++, trans,
+				count == cmap->len - 1);
+		if (r != 0)
+			return r;
+	}
+
+	return 0;
+}
+
+static int omapfb_blank(int blank, struct fb_info *fbi)
+{
+	struct omapfb_info *ofbi = FB2OFB(fbi);
+	struct omapfb2_device *fbdev = ofbi->fbdev;
+	struct omap_dss_device *display = fb2display(fbi);
+	int do_update = 0;
+	int r = 0;
+
+	omapfb_lock(fbdev);
+
+	switch (blank) {
+	case FB_BLANK_UNBLANK:
+		if (display->state != OMAP_DSS_DISPLAY_SUSPENDED)
+			goto exit;
+
+		if (display->resume)
+			r = display->resume(display);
+
+		if (r == 0 && display->get_update_mode &&
+				display->get_update_mode(display) ==
+				OMAP_DSS_UPDATE_MANUAL)
+			do_update = 1;
+
+		break;
+
+	case FB_BLANK_NORMAL:
+		/* FB_BLANK_NORMAL could be implemented.
+		 * Needs DSS additions. */
+	case FB_BLANK_VSYNC_SUSPEND:
+	case FB_BLANK_HSYNC_SUSPEND:
+	case FB_BLANK_POWERDOWN:
+		if (display->state != OMAP_DSS_DISPLAY_ACTIVE)
+			goto exit;
+
+		if (display->suspend)
+			r = display->suspend(display);
+
+		break;
+
+	default:
+		r = -EINVAL;
+	}
+
+exit:
+	omapfb_unlock(fbdev);
+
+	if (r == 0 && do_update && display->update) {
+		u16 w, h;
+		display->get_resolution(display, &w, &h);
+
+		r = display->update(display, 0, 0, w, h);
+	}
+
+	return r;
+}
+
+#if 0
+/* XXX fb_read and fb_write are needed for VRFB */
+ssize_t omapfb_write(struct fb_info *info, const char __user *buf,
+		size_t count, loff_t *ppos)
+{
+	DBG("omapfb_write %d, %lu\n", count, (unsigned long)*ppos);
+	/* XXX needed for VRFB */
+	return count;
+}
+#endif
+
+static struct fb_ops omapfb_ops = {
+	.owner          = THIS_MODULE,
+	.fb_open        = omapfb_open,
+	.fb_release     = omapfb_release,
+	.fb_fillrect    = cfb_fillrect,
+	.fb_copyarea    = cfb_copyarea,
+	.fb_imageblit   = cfb_imageblit,
+	.fb_blank       = omapfb_blank,
+	.fb_ioctl       = omapfb_ioctl,
+	.fb_check_var   = omapfb_check_var,
+	.fb_set_par     = omapfb_set_par,
+	.fb_pan_display = omapfb_pan_display,
+	.fb_mmap	= omapfb_mmap,
+	.fb_setcolreg	= omapfb_setcolreg,
+	.fb_setcmap	= omapfb_setcmap,
+	/*.fb_write	= omapfb_write,*/
+};
+
+static void omapfb_free_fbmem(struct fb_info *fbi)
+{
+	struct omapfb_info *ofbi = FB2OFB(fbi);
+	struct omapfb2_device *fbdev = ofbi->fbdev;
+	struct omapfb2_mem_region *rg;
+
+	rg = &ofbi->region;
+
+	if (rg->paddr)
+		if (omap_vram_free(rg->paddr, rg->size))
+			dev_err(fbdev->dev, "VRAM FREE failed\n");
+
+	if (rg->vaddr)
+		iounmap(rg->vaddr);
+
+	if (ofbi->rotation_type == OMAP_DSS_ROT_VRFB) {
+		/* unmap the 0 angle rotation */
+		if (rg->vrfb.vaddr[0]) {
+			iounmap(rg->vrfb.vaddr[0]);
+			omap_vrfb_release_ctx(&rg->vrfb);
+			rg->vrfb.vaddr[0] = NULL;
+		}
+	}
+
+	rg->vaddr = NULL;
+	rg->paddr = 0;
+	rg->alloc = 0;
+	rg->size = 0;
+}
+
+static void clear_fb_info(struct fb_info *fbi)
+{
+	memset(&fbi->var, 0, sizeof(fbi->var));
+	memset(&fbi->fix, 0, sizeof(fbi->fix));
+	strlcpy(fbi->fix.id, MODULE_NAME, sizeof(fbi->fix.id));
+}
+
+static int omapfb_free_all_fbmem(struct omapfb2_device *fbdev)
+{
+	int i;
+
+	DBG("free all fbmem\n");
+
+	for (i = 0; i < fbdev->num_fbs; i++) {
+		struct fb_info *fbi = fbdev->fbs[i];
+		omapfb_free_fbmem(fbi);
+		clear_fb_info(fbi);
+	}
+
+	return 0;
+}
+
+static int omapfb_alloc_fbmem(struct fb_info *fbi, unsigned long size,
+		unsigned long paddr)
+{
+	struct omapfb_info *ofbi = FB2OFB(fbi);
+	struct omapfb2_device *fbdev = ofbi->fbdev;
+	struct omapfb2_mem_region *rg;
+	void __iomem *vaddr;
+	int r;
+
+	rg = &ofbi->region;
+	memset(rg, 0, sizeof(*rg));
+
+	size = PAGE_ALIGN(size);
+
+	if (!paddr) {
+		DBG("allocating %lu bytes for fb %d\n", size, ofbi->id);
+		r = omap_vram_alloc(OMAP_VRAM_MEMTYPE_SDRAM, size, &paddr);
+	} else {
+		DBG("reserving %lu bytes at %lx for fb %d\n", size, paddr,
+				ofbi->id);
+		r = omap_vram_reserve(paddr, size);
+	}
+
+	if (r) {
+		dev_err(fbdev->dev, "failed to allocate framebuffer\n");
+		return -ENOMEM;
+	}
+
+	if (ofbi->rotation_type != OMAP_DSS_ROT_VRFB) {
+		vaddr = ioremap_wc(paddr, size);
+
+		if (!vaddr) {
+			dev_err(fbdev->dev, "failed to ioremap framebuffer\n");
+			omap_vram_free(paddr, size);
+			return -ENOMEM;
+		}
+
+		DBG("allocated VRAM paddr %lx, vaddr %p\n", paddr, vaddr);
+	} else {
+		r = omap_vrfb_request_ctx(&rg->vrfb);
+		if (r) {
+			dev_err(fbdev->dev, "vrfb create ctx failed\n");
+			return r;
+		}
+
+		vaddr = NULL;
+	}
+
+	rg->paddr = paddr;
+	rg->vaddr = vaddr;
+	rg->size = size;
+	rg->alloc = 1;
+
+	return 0;
+}
+
+/* allocate fbmem using display resolution as reference */
+static int omapfb_alloc_fbmem_display(struct fb_info *fbi, unsigned long size,
+		unsigned long paddr)
+{
+	struct omapfb_info *ofbi = FB2OFB(fbi);
+	struct omap_dss_device *display;
+	int bytespp;
+
+	display =  fb2display(fbi);
+
+	if (!display)
+		return 0;
+
+	switch (display->get_recommended_bpp(display)) {
+	case 16:
+		bytespp = 2;
+		break;
+	case 24:
+		bytespp = 4;
+		break;
+	default:
+		bytespp = 4;
+		break;
+	}
+
+	if (!size) {
+		u16 w, h;
+
+		display->get_resolution(display, &w, &h);
+
+		if (ofbi->rotation_type == OMAP_DSS_ROT_VRFB) {
+			size = max(omap_vrfb_min_phys_size(w, h, bytespp),
+					omap_vrfb_min_phys_size(h, w, bytespp));
+
+			DBG("adjusting fb mem size for VRFB, %u -> %lu\n",
+					w * h * bytespp, size);
+		} else {
+			size = w * h * bytespp;
+		}
+	}
+
+	if (!size)
+		return 0;
+
+	return omapfb_alloc_fbmem(fbi, size, paddr);
+}
+
+static enum omap_color_mode fb_format_to_dss_mode(enum omapfb_color_format fmt)
+{
+	enum omap_color_mode mode;
+
+	switch (fmt) {
+	case OMAPFB_COLOR_RGB565:
+		mode = OMAP_DSS_COLOR_RGB16;
+		break;
+	case OMAPFB_COLOR_YUV422:
+		mode = OMAP_DSS_COLOR_YUV2;
+		break;
+	case OMAPFB_COLOR_CLUT_8BPP:
+		mode = OMAP_DSS_COLOR_CLUT8;
+		break;
+	case OMAPFB_COLOR_CLUT_4BPP:
+		mode = OMAP_DSS_COLOR_CLUT4;
+		break;
+	case OMAPFB_COLOR_CLUT_2BPP:
+		mode = OMAP_DSS_COLOR_CLUT2;
+		break;
+	case OMAPFB_COLOR_CLUT_1BPP:
+		mode = OMAP_DSS_COLOR_CLUT1;
+		break;
+	case OMAPFB_COLOR_RGB444:
+		mode = OMAP_DSS_COLOR_RGB12U;
+		break;
+	case OMAPFB_COLOR_YUY422:
+		mode = OMAP_DSS_COLOR_UYVY;
+		break;
+	case OMAPFB_COLOR_ARGB16:
+		mode = OMAP_DSS_COLOR_ARGB16;
+		break;
+	case OMAPFB_COLOR_RGB24U:
+		mode = OMAP_DSS_COLOR_RGB24U;
+		break;
+	case OMAPFB_COLOR_RGB24P:
+		mode = OMAP_DSS_COLOR_RGB24P;
+		break;
+	case OMAPFB_COLOR_ARGB32:
+		mode = OMAP_DSS_COLOR_ARGB32;
+		break;
+	case OMAPFB_COLOR_RGBA32:
+		mode = OMAP_DSS_COLOR_RGBA32;
+		break;
+	case OMAPFB_COLOR_RGBX32:
+		mode = OMAP_DSS_COLOR_RGBX32;
+		break;
+	default:
+		mode = -EINVAL;
+	}
+
+	return mode;
+}
+
+static int omapfb_parse_vram_param(const char *param, int max_entries,
+		unsigned long *sizes, unsigned long *paddrs)
+{
+	int fbnum;
+	unsigned long size;
+	unsigned long paddr = 0;
+	char *p, *start;
+
+	start = (char *)param;
+
+	while (1) {
+		p = start;
+
+		fbnum = simple_strtoul(p, &p, 10);
+
+		if (p == param)
+			return -EINVAL;
+
+		if (*p != ':')
+			return -EINVAL;
+
+		if (fbnum >= max_entries)
+			return -EINVAL;
+
+		size = memparse(p + 1, &p);
+
+		if (!size)
+			return -EINVAL;
+
+		paddr = 0;
+
+		if (*p == '@') {
+			paddr = simple_strtoul(p + 1, &p, 16);
+
+			if (!paddr)
+				return -EINVAL;
+
+		}
+
+		paddrs[fbnum] = paddr;
+		sizes[fbnum] = size;
+
+		if (*p == 0)
+			break;
+
+		if (*p != ',')
+			return -EINVAL;
+
+		++p;
+
+		start = p;
+	}
+
+	return 0;
+}
+
+static int omapfb_allocate_all_fbs(struct omapfb2_device *fbdev)
+{
+	int i, r;
+	unsigned long vram_sizes[10];
+	unsigned long vram_paddrs[10];
+
+	memset(&vram_sizes, 0, sizeof(vram_sizes));
+	memset(&vram_paddrs, 0, sizeof(vram_paddrs));
+
+	if (def_vram &&	omapfb_parse_vram_param(def_vram, 10,
+				vram_sizes, vram_paddrs)) {
+		dev_err(fbdev->dev, "failed to parse vram parameter\n");
+
+		memset(&vram_sizes, 0, sizeof(vram_sizes));
+		memset(&vram_paddrs, 0, sizeof(vram_paddrs));
+	}
+
+	if (fbdev->dev->platform_data) {
+		struct omapfb_platform_data *opd;
+		opd = fbdev->dev->platform_data;
+		for (i = 0; i < opd->mem_desc.region_cnt; ++i) {
+			if (!vram_sizes[i]) {
+				unsigned long size;
+				unsigned long paddr;
+
+				size = opd->mem_desc.region[i].size;
+				paddr = opd->mem_desc.region[i].paddr;
+
+				vram_sizes[i] = size;
+				vram_paddrs[i] = paddr;
+			}
+		}
+	}
+
+	for (i = 0; i < fbdev->num_fbs; i++) {
+		/* allocate memory automatically only for fb0, or if
+		 * excplicitly defined with vram or plat data option */
+		if (i == 0 || vram_sizes[i] != 0) {
+			r = omapfb_alloc_fbmem_display(fbdev->fbs[i],
+					vram_sizes[i], vram_paddrs[i]);
+
+			if (r)
+				return r;
+		}
+	}
+
+	for (i = 0; i < fbdev->num_fbs; i++) {
+		struct omapfb_info *ofbi = FB2OFB(fbdev->fbs[i]);
+		struct omapfb2_mem_region *rg;
+		rg = &ofbi->region;
+
+		DBG("region%d phys %08x virt %p size=%lu\n",
+				i,
+				rg->paddr,
+				rg->vaddr,
+				rg->size);
+	}
+
+	return 0;
+}
+
+int omapfb_realloc_fbmem(struct fb_info *fbi, unsigned long size, int type)
+{
+	struct omapfb_info *ofbi = FB2OFB(fbi);
+	struct omapfb2_device *fbdev = ofbi->fbdev;
+	struct omap_dss_device *display = fb2display(fbi);
+	struct omapfb2_mem_region *rg = &ofbi->region;
+	unsigned long old_size = rg->size;
+	unsigned long old_paddr = rg->paddr;
+	int old_type = rg->type;
+	int r;
+
+	if (type > OMAPFB_MEMTYPE_MAX)
+		return -EINVAL;
+
+	size = PAGE_ALIGN(size);
+
+	if (old_size == size && old_type == type)
+		return 0;
+
+	if (display && display->sync)
+			display->sync(display);
+
+	omapfb_free_fbmem(fbi);
+
+	if (size == 0) {
+		clear_fb_info(fbi);
+		return 0;
+	}
+
+	r = omapfb_alloc_fbmem(fbi, size, 0);
+
+	if (r) {
+		if (old_size)
+			omapfb_alloc_fbmem(fbi, old_size, old_paddr);
+
+		if (rg->size == 0)
+			clear_fb_info(fbi);
+
+		return r;
+	}
+
+	if (old_size == size)
+		return 0;
+
+	if (old_size == 0) {
+		DBG("initializing fb %d\n", ofbi->id);
+		r = omapfb_fb_init(fbdev, fbi);
+		if (r) {
+			DBG("omapfb_fb_init failed\n");
+			goto err;
+		}
+		r = omapfb_apply_changes(fbi, 1);
+		if (r) {
+			DBG("omapfb_apply_changes failed\n");
+			goto err;
+		}
+	} else {
+		struct fb_var_screeninfo new_var;
+		memcpy(&new_var, &fbi->var, sizeof(new_var));
+		r = check_fb_var(fbi, &new_var);
+		if (r)
+			goto err;
+		memcpy(&fbi->var, &new_var, sizeof(fbi->var));
+		set_fb_fix(fbi);
+		r = setup_vrfb_rotation(fbi);
+		if (r)
+			goto err;
+	}
+
+	return 0;
+err:
+	omapfb_free_fbmem(fbi);
+	clear_fb_info(fbi);
+	return r;
+}
+
+/* initialize fb_info, var, fix to something sane based on the display */
+static int omapfb_fb_init(struct omapfb2_device *fbdev, struct fb_info *fbi)
+{
+	struct fb_var_screeninfo *var = &fbi->var;
+	struct omap_dss_device *display = fb2display(fbi);
+	struct omapfb_info *ofbi = FB2OFB(fbi);
+	int r = 0;
+
+	fbi->fbops = &omapfb_ops;
+	fbi->flags = FBINFO_FLAG_DEFAULT;
+	fbi->pseudo_palette = fbdev->pseudo_palette;
+
+	if (ofbi->region.size == 0) {
+		clear_fb_info(fbi);
+		return 0;
+	}
+
+	var->nonstd = 0;
+	var->bits_per_pixel = 0;
+
+	var->rotate = def_rotate;
+
+	/*
+	 * Check if there is a default color format set in the board file,
+	 * and use this format instead the default deducted from the
+	 * display bpp.
+	 */
+	if (fbdev->dev->platform_data) {
+		struct omapfb_platform_data *opd;
+		int id = ofbi->id;
+
+		opd = fbdev->dev->platform_data;
+		if (opd->mem_desc.region[id].format_used) {
+			enum omap_color_mode mode;
+			enum omapfb_color_format format;
+
+			format = opd->mem_desc.region[id].format;
+			mode = fb_format_to_dss_mode(format);
+			if (mode < 0) {
+				r = mode;
+				goto err;
+			}
+			r = dss_mode_to_fb_mode(mode, var);
+			if (r < 0)
+				goto err;
+		}
+	}
+
+	if (display) {
+		u16 w, h;
+		int rotation = (var->rotate + ofbi->rotation[0]) % 4;
+
+		display->get_resolution(display, &w, &h);
+
+		if (rotation == FB_ROTATE_CW ||
+				rotation == FB_ROTATE_CCW) {
+			var->xres = h;
+			var->yres = w;
+		} else {
+			var->xres = w;
+			var->yres = h;
+		}
+
+		var->xres_virtual = var->xres;
+		var->yres_virtual = var->yres;
+
+		if (!var->bits_per_pixel) {
+			switch (display->get_recommended_bpp(display)) {
+			case 16:
+				var->bits_per_pixel = 16;
+				break;
+			case 24:
+				var->bits_per_pixel = 32;
+				break;
+			default:
+				dev_err(fbdev->dev, "illegal display "
+						"bpp\n");
+				return -EINVAL;
+			}
+		}
+	} else {
+		/* if there's no display, let's just guess some basic values */
+		var->xres = 320;
+		var->yres = 240;
+		var->xres_virtual = var->xres;
+		var->yres_virtual = var->yres;
+		if (!var->bits_per_pixel)
+			var->bits_per_pixel = 16;
+	}
+
+	r = check_fb_var(fbi, var);
+	if (r)
+		goto err;
+
+	set_fb_fix(fbi);
+	r = setup_vrfb_rotation(fbi);
+	if (r)
+		goto err;
+
+	r = fb_alloc_cmap(&fbi->cmap, 256, 0);
+	if (r)
+		dev_err(fbdev->dev, "unable to allocate color map memory\n");
+
+err:
+	return r;
+}
+
+static void fbinfo_cleanup(struct omapfb2_device *fbdev, struct fb_info *fbi)
+{
+	fb_dealloc_cmap(&fbi->cmap);
+}
+
+
+static void omapfb_free_resources(struct omapfb2_device *fbdev)
+{
+	int i;
+
+	DBG("free_resources\n");
+
+	if (fbdev == NULL)
+		return;
+
+	for (i = 0; i < fbdev->num_fbs; i++)
+		unregister_framebuffer(fbdev->fbs[i]);
+
+	/* free the reserved fbmem */
+	omapfb_free_all_fbmem(fbdev);
+
+	for (i = 0; i < fbdev->num_fbs; i++) {
+		fbinfo_cleanup(fbdev, fbdev->fbs[i]);
+		framebuffer_release(fbdev->fbs[i]);
+	}
+
+	for (i = 0; i < fbdev->num_displays; i++) {
+		if (fbdev->displays[i]->state != OMAP_DSS_DISPLAY_DISABLED)
+			fbdev->displays[i]->disable(fbdev->displays[i]);
+
+		omap_dss_put_device(fbdev->displays[i]);
+	}
+
+	dev_set_drvdata(fbdev->dev, NULL);
+	kfree(fbdev);
+}
+
+static int omapfb_create_framebuffers(struct omapfb2_device *fbdev)
+{
+	int r, i;
+
+	fbdev->num_fbs = 0;
+
+	DBG("create %d framebuffers\n",	CONFIG_FB_OMAP2_NUM_FBS);
+
+	/* allocate fb_infos */
+	for (i = 0; i < CONFIG_FB_OMAP2_NUM_FBS; i++) {
+		struct fb_info *fbi;
+		struct omapfb_info *ofbi;
+
+		fbi = framebuffer_alloc(sizeof(struct omapfb_info),
+				fbdev->dev);
+
+		if (fbi == NULL) {
+			dev_err(fbdev->dev,
+				"unable to allocate memory for plane info\n");
+			return -ENOMEM;
+		}
+
+		clear_fb_info(fbi);
+
+		fbdev->fbs[i] = fbi;
+
+		ofbi = FB2OFB(fbi);
+		ofbi->fbdev = fbdev;
+		ofbi->id = i;
+
+		/* assign these early, so that fb alloc can use them */
+		ofbi->rotation_type = def_vrfb ? OMAP_DSS_ROT_VRFB :
+			OMAP_DSS_ROT_DMA;
+		ofbi->mirror = def_mirror;
+
+		fbdev->num_fbs++;
+	}
+
+	DBG("fb_infos allocated\n");
+
+	/* assign overlays for the fbs */
+	for (i = 0; i < min(fbdev->num_fbs, fbdev->num_overlays); i++) {
+		struct omapfb_info *ofbi = FB2OFB(fbdev->fbs[i]);
+
+		ofbi->overlays[0] = fbdev->overlays[i];
+		ofbi->num_overlays = 1;
+	}
+
+	/* allocate fb memories */
+	r = omapfb_allocate_all_fbs(fbdev);
+	if (r) {
+		dev_err(fbdev->dev, "failed to allocate fbmem\n");
+		return r;
+	}
+
+	DBG("fbmems allocated\n");
+
+	/* setup fb_infos */
+	for (i = 0; i < fbdev->num_fbs; i++) {
+		r = omapfb_fb_init(fbdev, fbdev->fbs[i]);
+		if (r) {
+			dev_err(fbdev->dev, "failed to setup fb_info\n");
+			return r;
+		}
+	}
+
+	DBG("fb_infos initialized\n");
+
+	for (i = 0; i < fbdev->num_fbs; i++) {
+		r = register_framebuffer(fbdev->fbs[i]);
+		if (r != 0) {
+			dev_err(fbdev->dev,
+				"registering framebuffer %d failed\n", i);
+			return r;
+		}
+	}
+
+	DBG("framebuffers registered\n");
+
+	for (i = 0; i < fbdev->num_fbs; i++) {
+		r = omapfb_apply_changes(fbdev->fbs[i], 1);
+		if (r) {
+			dev_err(fbdev->dev, "failed to change mode\n");
+			return r;
+		}
+	}
+
+	DBG("create sysfs for fbs\n");
+	r = omapfb_create_sysfs(fbdev);
+	if (r) {
+		dev_err(fbdev->dev, "failed to create sysfs entries\n");
+		return r;
+	}
+
+	/* Enable fb0 */
+	if (fbdev->num_fbs > 0) {
+		struct omapfb_info *ofbi = FB2OFB(fbdev->fbs[0]);
+
+		if (ofbi->num_overlays > 0) {
+			struct omap_overlay *ovl = ofbi->overlays[0];
+
+			r = omapfb_overlay_enable(ovl, 1);
+
+			if (r) {
+				dev_err(fbdev->dev,
+						"failed to enable overlay\n");
+				return r;
+			}
+		}
+	}
+
+	DBG("create_framebuffers done\n");
+
+	return 0;
+}
+
+static int omapfb_mode_to_timings(const char *mode_str,
+		struct omap_video_timings *timings, u8 *bpp)
+{
+	struct fb_info fbi;
+	struct fb_var_screeninfo var;
+	struct fb_ops fbops;
+	int r;
+
+#ifdef CONFIG_OMAP2_DSS_VENC
+	if (strcmp(mode_str, "pal") == 0) {
+		*timings = omap_dss_pal_timings;
+		*bpp = 0;
+		return 0;
+	} else if (strcmp(mode_str, "ntsc") == 0) {
+		*timings = omap_dss_ntsc_timings;
+		*bpp = 0;
+		return 0;
+	}
+#endif
+
+	/* this is quite a hack, but I wanted to use the modedb and for
+	 * that we need fb_info and var, so we create dummy ones */
+
+	memset(&fbi, 0, sizeof(fbi));
+	memset(&var, 0, sizeof(var));
+	memset(&fbops, 0, sizeof(fbops));
+	fbi.fbops = &fbops;
+
+	r = fb_find_mode(&var, &fbi, mode_str, NULL, 0, NULL, 24);
+
+	if (r != 0) {
+		timings->pixel_clock = PICOS2KHZ(var.pixclock);
+		timings->hfp = var.left_margin;
+		timings->hbp = var.right_margin;
+		timings->vfp = var.upper_margin;
+		timings->vbp = var.lower_margin;
+		timings->hsw = var.hsync_len;
+		timings->vsw = var.vsync_len;
+		timings->x_res = var.xres;
+		timings->y_res = var.yres;
+
+		switch (var.bits_per_pixel) {
+		case 16:
+			*bpp = 16;
+			break;
+		case 24:
+		case 32:
+		default:
+			*bpp = 24;
+			break;
+		}
+
+		return 0;
+	} else {
+		return -EINVAL;
+	}
+}
+
+static int omapfb_set_def_mode(struct omap_dss_device *display, char *mode_str)
+{
+	int r;
+	u8 bpp;
+	struct omap_video_timings timings;
+
+	r = omapfb_mode_to_timings(mode_str, &timings, &bpp);
+	if (r)
+		return r;
+
+	display->panel.recommended_bpp = bpp;
+
+	if (!display->check_timings || !display->set_timings)
+		return -EINVAL;
+
+	r = display->check_timings(display, &timings);
+	if (r)
+		return r;
+
+	display->set_timings(display, &timings);
+
+	return 0;
+}
+
+static int omapfb_parse_def_modes(struct omapfb2_device *fbdev)
+{
+	char *str, *options, *this_opt;
+	int r = 0;
+
+	str = kmalloc(strlen(def_mode) + 1, GFP_KERNEL);
+	strcpy(str, def_mode);
+	options = str;
+
+	while (!r && (this_opt = strsep(&options, ",")) != NULL) {
+		char *p, *display_str, *mode_str;
+		struct omap_dss_device *display;
+		int i;
+
+		p = strchr(this_opt, ':');
+		if (!p) {
+			r = -EINVAL;
+			break;
+		}
+
+		*p = 0;
+		display_str = this_opt;
+		mode_str = p + 1;
+
+		display = NULL;
+		for (i = 0; i < fbdev->num_displays; ++i) {
+			if (strcmp(fbdev->displays[i]->name,
+						display_str) == 0) {
+				display = fbdev->displays[i];
+				break;
+			}
+		}
+
+		if (!display) {
+			r = -EINVAL;
+			break;
+		}
+
+		r = omapfb_set_def_mode(display, mode_str);
+		if (r)
+			break;
+	}
+
+	kfree(str);
+
+	return r;
+}
+
+static int omapfb_probe(struct platform_device *pdev)
+{
+	struct omapfb2_device *fbdev = NULL;
+	int r = 0;
+	int i;
+	struct omap_overlay *ovl;
+	struct omap_dss_device *def_display;
+	struct omap_dss_device *dssdev;
+
+	DBG("omapfb_probe\n");
+
+	if (pdev->num_resources != 0) {
+		dev_err(&pdev->dev, "probed for an unknown device\n");
+		r = -ENODEV;
+		goto err0;
+	}
+
+	fbdev = kzalloc(sizeof(struct omapfb2_device), GFP_KERNEL);
+	if (fbdev == NULL) {
+		r = -ENOMEM;
+		goto err0;
+	}
+
+	mutex_init(&fbdev->mtx);
+
+	fbdev->dev = &pdev->dev;
+	platform_set_drvdata(pdev, fbdev);
+
+	fbdev->num_displays = 0;
+	dssdev = NULL;
+	for_each_dss_dev(dssdev) {
+		omap_dss_get_device(dssdev);
+		if (!dssdev->driver) {
+			dev_err(&pdev->dev, "no driver for display\n");
+			r = -EINVAL;
+			goto cleanup;
+		}
+		fbdev->displays[fbdev->num_displays++] = dssdev;
+	}
+
+	if (fbdev->num_displays == 0) {
+		dev_err(&pdev->dev, "no displays\n");
+		r = -EINVAL;
+		goto cleanup;
+	}
+
+	fbdev->num_overlays = omap_dss_get_num_overlays();
+	for (i = 0; i < fbdev->num_overlays; i++)
+		fbdev->overlays[i] = omap_dss_get_overlay(i);
+
+	fbdev->num_managers = omap_dss_get_num_overlay_managers();
+	for (i = 0; i < fbdev->num_managers; i++)
+		fbdev->managers[i] = omap_dss_get_overlay_manager(i);
+
+	if (def_mode && strlen(def_mode) > 0) {
+		if (omapfb_parse_def_modes(fbdev))
+			dev_warn(&pdev->dev, "cannot parse default modes\n");
+	}
+
+	r = omapfb_create_framebuffers(fbdev);
+	if (r)
+		goto cleanup;
+
+	for (i = 0; i < fbdev->num_managers; i++) {
+		struct omap_overlay_manager *mgr;
+		mgr = fbdev->managers[i];
+		r = mgr->apply(mgr);
+		if (r)
+			dev_warn(fbdev->dev, "failed to apply dispc config\n");
+	}
+
+	DBG("mgr->apply'ed\n");
+
+	/* gfx overlay should be the default one. find a display
+	 * connected to that, and use it as default display */
+	ovl = omap_dss_get_overlay(0);
+	if (ovl->manager && ovl->manager->device) {
+		def_display = ovl->manager->device;
+	} else {
+		dev_warn(&pdev->dev, "cannot find default display\n");
+		def_display = NULL;
+	}
+
+	if (def_display) {
+#ifndef CONFIG_FB_OMAP2_FORCE_AUTO_UPDATE
+		u16 w, h;
+#endif
+		r = def_display->enable(def_display);
+		if (r)
+			dev_warn(fbdev->dev, "Failed to enable display '%s'\n",
+					def_display->name);
+
+		/* set the update mode */
+		if (def_display->caps & OMAP_DSS_DISPLAY_CAP_MANUAL_UPDATE) {
+#ifdef CONFIG_FB_OMAP2_FORCE_AUTO_UPDATE
+			if (def_display->enable_te)
+				def_display->enable_te(def_display, 1);
+			if (def_display->set_update_mode)
+				def_display->set_update_mode(def_display,
+						OMAP_DSS_UPDATE_AUTO);
+#else /* MANUAL_UPDATE */
+			if (def_display->enable_te)
+				def_display->enable_te(def_display, 0);
+			if (def_display->set_update_mode)
+				def_display->set_update_mode(def_display,
+						OMAP_DSS_UPDATE_MANUAL);
+
+			def_display->get_resolution(def_display, &w, &h);
+			def_display->update(def_display, 0, 0, w, h);
+#endif
+		} else {
+			if (def_display->set_update_mode)
+				def_display->set_update_mode(def_display,
+						OMAP_DSS_UPDATE_AUTO);
+		}
+	}
+
+	return 0;
+
+cleanup:
+	omapfb_free_resources(fbdev);
+err0:
+	dev_err(&pdev->dev, "failed to setup omapfb\n");
+	return r;
+}
+
+static int omapfb_remove(struct platform_device *pdev)
+{
+	struct omapfb2_device *fbdev = platform_get_drvdata(pdev);
+
+	/* FIXME: wait till completion of pending events */
+
+	omapfb_remove_sysfs(fbdev);
+
+	omapfb_free_resources(fbdev);
+
+	return 0;
+}
+
+static struct platform_driver omapfb_driver = {
+	.probe          = omapfb_probe,
+	.remove         = omapfb_remove,
+	.driver         = {
+		.name   = "omapfb",
+		.owner  = THIS_MODULE,
+	},
+};
+
+static int __init omapfb_init(void)
+{
+	DBG("omapfb_init\n");
+
+	if (platform_driver_register(&omapfb_driver)) {
+		printk(KERN_ERR "failed to register omapfb driver\n");
+		return -ENODEV;
+	}
+
+	return 0;
+}
+
+static void __exit omapfb_exit(void)
+{
+	DBG("omapfb_exit\n");
+	platform_driver_unregister(&omapfb_driver);
+}
+
+module_param_named(mode, def_mode, charp, 0);
+module_param_named(vram, def_vram, charp, 0);
+module_param_named(rotate, def_rotate, int, 0);
+module_param_named(vrfb, def_vrfb, bool, 0);
+module_param_named(mirror, def_mirror, bool, 0);
+
+/* late_initcall to let panel/ctrl drivers loaded first.
+ * I guess better option would be a more dynamic approach,
+ * so that omapfb reacts to new panels when they are loaded */
+late_initcall(omapfb_init);
+/*module_init(omapfb_init);*/
+module_exit(omapfb_exit);
+
+MODULE_AUTHOR("Tomi Valkeinen <tomi.valkeinen@nokia.com>");
+MODULE_DESCRIPTION("OMAP2/3 Framebuffer");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/video/omap2/omapfb/omapfb-sysfs.c b/drivers/video/omap2/omapfb/omapfb-sysfs.c
new file mode 100644
index 000000000000..62bb88f5c192
--- /dev/null
+++ b/drivers/video/omap2/omapfb/omapfb-sysfs.c
@@ -0,0 +1,507 @@
+/*
+ * linux/drivers/video/omap2/omapfb-sysfs.c
+ *
+ * Copyright (C) 2008 Nokia Corporation
+ * Author: Tomi Valkeinen <tomi.valkeinen@nokia.com>
+ *
+ * Some code and ideas taken from drivers/video/omap/ driver
+ * by Imre Deak.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <linux/fb.h>
+#include <linux/sysfs.h>
+#include <linux/device.h>
+#include <linux/uaccess.h>
+#include <linux/platform_device.h>
+#include <linux/kernel.h>
+#include <linux/mm.h>
+#include <linux/omapfb.h>
+
+#include <plat/display.h>
+#include <plat/vrfb.h>
+
+#include "omapfb.h"
+
+static ssize_t show_rotate_type(struct device *dev,
+		struct device_attribute *attr, char *buf)
+{
+	struct fb_info *fbi = dev_get_drvdata(dev);
+	struct omapfb_info *ofbi = FB2OFB(fbi);
+
+	return snprintf(buf, PAGE_SIZE, "%d\n", ofbi->rotation_type);
+}
+
+static ssize_t store_rotate_type(struct device *dev,
+		struct device_attribute *attr,
+		const char *buf, size_t count)
+{
+	struct fb_info *fbi = dev_get_drvdata(dev);
+	struct omapfb_info *ofbi = FB2OFB(fbi);
+	enum omap_dss_rotation_type rot_type;
+	int r;
+
+	rot_type = simple_strtoul(buf, NULL, 0);
+
+	if (rot_type != OMAP_DSS_ROT_DMA && rot_type != OMAP_DSS_ROT_VRFB)
+		return -EINVAL;
+
+	lock_fb_info(fbi);
+
+	r = 0;
+	if (rot_type == ofbi->rotation_type)
+		goto out;
+
+	if (ofbi->region.size) {
+		r = -EBUSY;
+		goto out;
+	}
+
+	ofbi->rotation_type = rot_type;
+
+	/*
+	 * Since the VRAM for this FB is not allocated at the moment we don't
+	 * need to do any further parameter checking at this point.
+	 */
+out:
+	unlock_fb_info(fbi);
+
+	return r ? r : count;
+}
+
+
+static ssize_t show_mirror(struct device *dev,
+		struct device_attribute *attr, char *buf)
+{
+	struct fb_info *fbi = dev_get_drvdata(dev);
+	struct omapfb_info *ofbi = FB2OFB(fbi);
+
+	return snprintf(buf, PAGE_SIZE, "%d\n", ofbi->mirror);
+}
+
+static ssize_t store_mirror(struct device *dev,
+		struct device_attribute *attr,
+		const char *buf, size_t count)
+{
+	struct fb_info *fbi = dev_get_drvdata(dev);
+	struct omapfb_info *ofbi = FB2OFB(fbi);
+	bool mirror;
+	int r;
+	struct fb_var_screeninfo new_var;
+
+	mirror = simple_strtoul(buf, NULL, 0);
+
+	if (mirror != 0 && mirror != 1)
+		return -EINVAL;
+
+	lock_fb_info(fbi);
+
+	ofbi->mirror = mirror;
+
+	memcpy(&new_var, &fbi->var, sizeof(new_var));
+	r = check_fb_var(fbi, &new_var);
+	if (r)
+		goto out;
+	memcpy(&fbi->var, &new_var, sizeof(fbi->var));
+
+	set_fb_fix(fbi);
+
+	r = omapfb_apply_changes(fbi, 0);
+	if (r)
+		goto out;
+
+	r = count;
+out:
+	unlock_fb_info(fbi);
+
+	return r;
+}
+
+static ssize_t show_overlays(struct device *dev,
+		struct device_attribute *attr, char *buf)
+{
+	struct fb_info *fbi = dev_get_drvdata(dev);
+	struct omapfb_info *ofbi = FB2OFB(fbi);
+	struct omapfb2_device *fbdev = ofbi->fbdev;
+	ssize_t l = 0;
+	int t;
+
+	omapfb_lock(fbdev);
+	lock_fb_info(fbi);
+
+	for (t = 0; t < ofbi->num_overlays; t++) {
+		struct omap_overlay *ovl = ofbi->overlays[t];
+		int ovlnum;
+
+		for (ovlnum = 0; ovlnum < fbdev->num_overlays; ++ovlnum)
+			if (ovl == fbdev->overlays[ovlnum])
+				break;
+
+		l += snprintf(buf + l, PAGE_SIZE - l, "%s%d",
+				t == 0 ? "" : ",", ovlnum);
+	}
+
+	l += snprintf(buf + l, PAGE_SIZE - l, "\n");
+
+	unlock_fb_info(fbi);
+	omapfb_unlock(fbdev);
+
+	return l;
+}
+
+static struct omapfb_info *get_overlay_fb(struct omapfb2_device *fbdev,
+		struct omap_overlay *ovl)
+{
+	int i, t;
+
+	for (i = 0; i < fbdev->num_fbs; i++) {
+		struct omapfb_info *ofbi = FB2OFB(fbdev->fbs[i]);
+
+		for (t = 0; t < ofbi->num_overlays; t++) {
+			if (ofbi->overlays[t] == ovl)
+				return ofbi;
+		}
+	}
+
+	return NULL;
+}
+
+static ssize_t store_overlays(struct device *dev, struct device_attribute *attr,
+		const char *buf, size_t count)
+{
+	struct fb_info *fbi = dev_get_drvdata(dev);
+	struct omapfb_info *ofbi = FB2OFB(fbi);
+	struct omapfb2_device *fbdev = ofbi->fbdev;
+	struct omap_overlay *ovls[OMAPFB_MAX_OVL_PER_FB];
+	struct omap_overlay *ovl;
+	int num_ovls, r, i;
+	int len;
+	bool added = false;
+
+	num_ovls = 0;
+
+	len = strlen(buf);
+	if (buf[len - 1] == '\n')
+		len = len - 1;
+
+	omapfb_lock(fbdev);
+	lock_fb_info(fbi);
+
+	if (len > 0) {
+		char *p = (char *)buf;
+		int ovlnum;
+
+		while (p < buf + len) {
+			int found;
+			if (num_ovls == OMAPFB_MAX_OVL_PER_FB) {
+				r = -EINVAL;
+				goto out;
+			}
+
+			ovlnum = simple_strtoul(p, &p, 0);
+			if (ovlnum > fbdev->num_overlays) {
+				r = -EINVAL;
+				goto out;
+			}
+
+			found = 0;
+			for (i = 0; i < num_ovls; ++i) {
+				if (ovls[i] == fbdev->overlays[ovlnum]) {
+					found = 1;
+					break;
+				}
+			}
+
+			if (!found)
+				ovls[num_ovls++] = fbdev->overlays[ovlnum];
+
+			p++;
+		}
+	}
+
+	for (i = 0; i < num_ovls; ++i) {
+		struct omapfb_info *ofbi2 = get_overlay_fb(fbdev, ovls[i]);
+		if (ofbi2 && ofbi2 != ofbi) {
+			dev_err(fbdev->dev, "overlay already in use\n");
+			r = -EINVAL;
+			goto out;
+		}
+	}
+
+	/* detach unused overlays */
+	for (i = 0; i < ofbi->num_overlays; ++i) {
+		int t, found;
+
+		ovl = ofbi->overlays[i];
+
+		found = 0;
+
+		for (t = 0; t < num_ovls; ++t) {
+			if (ovl == ovls[t]) {
+				found = 1;
+				break;
+			}
+		}
+
+		if (found)
+			continue;
+
+		DBG("detaching %d\n", ofbi->overlays[i]->id);
+
+		omapfb_overlay_enable(ovl, 0);
+
+		if (ovl->manager)
+			ovl->manager->apply(ovl->manager);
+
+		for (t = i + 1; t < ofbi->num_overlays; t++) {
+			ofbi->rotation[t-1] = ofbi->rotation[t];
+			ofbi->overlays[t-1] = ofbi->overlays[t];
+		}
+
+		ofbi->num_overlays--;
+		i--;
+	}
+
+	for (i = 0; i < num_ovls; ++i) {
+		int t, found;
+
+		ovl = ovls[i];
+
+		found = 0;
+
+		for (t = 0; t < ofbi->num_overlays; ++t) {
+			if (ovl == ofbi->overlays[t]) {
+				found = 1;
+				break;
+			}
+		}
+
+		if (found)
+			continue;
+		ofbi->rotation[ofbi->num_overlays] = 0;
+		ofbi->overlays[ofbi->num_overlays++] = ovl;
+
+		added = true;
+	}
+
+	if (added) {
+		r = omapfb_apply_changes(fbi, 0);
+		if (r)
+			goto out;
+	}
+
+	r = count;
+out:
+	unlock_fb_info(fbi);
+	omapfb_unlock(fbdev);
+
+	return r;
+}
+
+static ssize_t show_overlays_rotate(struct device *dev,
+		struct device_attribute *attr, char *buf)
+{
+	struct fb_info *fbi = dev_get_drvdata(dev);
+	struct omapfb_info *ofbi = FB2OFB(fbi);
+	ssize_t l = 0;
+	int t;
+
+	lock_fb_info(fbi);
+
+	for (t = 0; t < ofbi->num_overlays; t++) {
+		l += snprintf(buf + l, PAGE_SIZE - l, "%s%d",
+				t == 0 ? "" : ",", ofbi->rotation[t]);
+	}
+
+	l += snprintf(buf + l, PAGE_SIZE - l, "\n");
+
+	unlock_fb_info(fbi);
+
+	return l;
+}
+
+static ssize_t store_overlays_rotate(struct device *dev,
+		struct device_attribute *attr, const char *buf, size_t count)
+{
+	struct fb_info *fbi = dev_get_drvdata(dev);
+	struct omapfb_info *ofbi = FB2OFB(fbi);
+	int num_ovls = 0, r, i;
+	int len;
+	bool changed = false;
+	u8 rotation[OMAPFB_MAX_OVL_PER_FB];
+
+	len = strlen(buf);
+	if (buf[len - 1] == '\n')
+		len = len - 1;
+
+	lock_fb_info(fbi);
+
+	if (len > 0) {
+		char *p = (char *)buf;
+
+		while (p < buf + len) {
+			int rot;
+
+			if (num_ovls == ofbi->num_overlays) {
+				r = -EINVAL;
+				goto out;
+			}
+
+			rot = simple_strtoul(p, &p, 0);
+			if (rot < 0 || rot > 3) {
+				r = -EINVAL;
+				goto out;
+			}
+
+			if (ofbi->rotation[num_ovls] != rot)
+				changed = true;
+
+			rotation[num_ovls++] = rot;
+
+			p++;
+		}
+	}
+
+	if (num_ovls != ofbi->num_overlays) {
+		r = -EINVAL;
+		goto out;
+	}
+
+	if (changed) {
+		for (i = 0; i < num_ovls; ++i)
+			ofbi->rotation[i] = rotation[i];
+
+		r = omapfb_apply_changes(fbi, 0);
+		if (r)
+			goto out;
+
+		/* FIXME error handling? */
+	}
+
+	r = count;
+out:
+	unlock_fb_info(fbi);
+
+	return r;
+}
+
+static ssize_t show_size(struct device *dev,
+		struct device_attribute *attr, char *buf)
+{
+	struct fb_info *fbi = dev_get_drvdata(dev);
+	struct omapfb_info *ofbi = FB2OFB(fbi);
+
+	return snprintf(buf, PAGE_SIZE, "%lu\n", ofbi->region.size);
+}
+
+static ssize_t store_size(struct device *dev, struct device_attribute *attr,
+		const char *buf, size_t count)
+{
+	struct fb_info *fbi = dev_get_drvdata(dev);
+	struct omapfb_info *ofbi = FB2OFB(fbi);
+	unsigned long size;
+	int r;
+	int i;
+
+	size = PAGE_ALIGN(simple_strtoul(buf, NULL, 0));
+
+	lock_fb_info(fbi);
+
+	for (i = 0; i < ofbi->num_overlays; i++) {
+		if (ofbi->overlays[i]->info.enabled) {
+			r = -EBUSY;
+			goto out;
+		}
+	}
+
+	if (size != ofbi->region.size) {
+		r = omapfb_realloc_fbmem(fbi, size, ofbi->region.type);
+		if (r) {
+			dev_err(dev, "realloc fbmem failed\n");
+			goto out;
+		}
+	}
+
+	r = count;
+out:
+	unlock_fb_info(fbi);
+
+	return r;
+}
+
+static ssize_t show_phys(struct device *dev,
+		struct device_attribute *attr, char *buf)
+{
+	struct fb_info *fbi = dev_get_drvdata(dev);
+	struct omapfb_info *ofbi = FB2OFB(fbi);
+
+	return snprintf(buf, PAGE_SIZE, "%0x\n", ofbi->region.paddr);
+}
+
+static ssize_t show_virt(struct device *dev,
+		struct device_attribute *attr, char *buf)
+{
+	struct fb_info *fbi = dev_get_drvdata(dev);
+	struct omapfb_info *ofbi = FB2OFB(fbi);
+
+	return snprintf(buf, PAGE_SIZE, "%p\n", ofbi->region.vaddr);
+}
+
+static struct device_attribute omapfb_attrs[] = {
+	__ATTR(rotate_type, S_IRUGO | S_IWUSR, show_rotate_type,
+			store_rotate_type),
+	__ATTR(mirror, S_IRUGO | S_IWUSR, show_mirror, store_mirror),
+	__ATTR(size, S_IRUGO | S_IWUSR, show_size, store_size),
+	__ATTR(overlays, S_IRUGO | S_IWUSR, show_overlays, store_overlays),
+	__ATTR(overlays_rotate, S_IRUGO | S_IWUSR, show_overlays_rotate,
+			store_overlays_rotate),
+	__ATTR(phys_addr, S_IRUGO, show_phys, NULL),
+	__ATTR(virt_addr, S_IRUGO, show_virt, NULL),
+};
+
+int omapfb_create_sysfs(struct omapfb2_device *fbdev)
+{
+	int i;
+	int r;
+
+	DBG("create sysfs for fbs\n");
+	for (i = 0; i < fbdev->num_fbs; i++) {
+		int t;
+		for (t = 0; t < ARRAY_SIZE(omapfb_attrs); t++) {
+			r = device_create_file(fbdev->fbs[i]->dev,
+					&omapfb_attrs[t]);
+
+			if (r) {
+				dev_err(fbdev->dev, "failed to create sysfs "
+						"file\n");
+				return r;
+			}
+		}
+	}
+
+	return 0;
+}
+
+void omapfb_remove_sysfs(struct omapfb2_device *fbdev)
+{
+	int i, t;
+
+	DBG("remove sysfs for fbs\n");
+	for (i = 0; i < fbdev->num_fbs; i++) {
+		for (t = 0; t < ARRAY_SIZE(omapfb_attrs); t++)
+			device_remove_file(fbdev->fbs[i]->dev,
+					&omapfb_attrs[t]);
+	}
+}
+
diff --git a/drivers/video/omap2/omapfb/omapfb.h b/drivers/video/omap2/omapfb/omapfb.h
new file mode 100644
index 000000000000..f7c9c739e5ef
--- /dev/null
+++ b/drivers/video/omap2/omapfb/omapfb.h
@@ -0,0 +1,146 @@
+/*
+ * linux/drivers/video/omap2/omapfb.h
+ *
+ * Copyright (C) 2008 Nokia Corporation
+ * Author: Tomi Valkeinen <tomi.valkeinen@nokia.com>
+ *
+ * Some code and ideas taken from drivers/video/omap/ driver
+ * by Imre Deak.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef __DRIVERS_VIDEO_OMAP2_OMAPFB_H__
+#define __DRIVERS_VIDEO_OMAP2_OMAPFB_H__
+
+#ifdef CONFIG_FB_OMAP2_DEBUG_SUPPORT
+#define DEBUG
+#endif
+
+#include <plat/display.h>
+
+#ifdef DEBUG
+extern unsigned int omapfb_debug;
+#define DBG(format, ...) \
+	if (omapfb_debug) \
+		printk(KERN_DEBUG "OMAPFB: " format, ## __VA_ARGS__)
+#else
+#define DBG(format, ...)
+#endif
+
+#define FB2OFB(fb_info) ((struct omapfb_info *)(fb_info->par))
+
+/* max number of overlays to which a framebuffer data can be direct */
+#define OMAPFB_MAX_OVL_PER_FB 3
+
+struct omapfb2_mem_region {
+	u32		paddr;
+	void __iomem	*vaddr;
+	struct vrfb	vrfb;
+	unsigned long	size;
+	u8		type;		/* OMAPFB_PLANE_MEM_* */
+	bool		alloc;		/* allocated by the driver */
+	bool		map;		/* kernel mapped by the driver */
+};
+
+/* appended to fb_info */
+struct omapfb_info {
+	int id;
+	struct omapfb2_mem_region region;
+	atomic_t map_count;
+	int num_overlays;
+	struct omap_overlay *overlays[OMAPFB_MAX_OVL_PER_FB];
+	struct omapfb2_device *fbdev;
+	enum omap_dss_rotation_type rotation_type;
+	u8 rotation[OMAPFB_MAX_OVL_PER_FB];
+	bool mirror;
+};
+
+struct omapfb2_device {
+	struct device *dev;
+	struct mutex  mtx;
+
+	u32 pseudo_palette[17];
+
+	int state;
+
+	unsigned num_fbs;
+	struct fb_info *fbs[10];
+
+	unsigned num_displays;
+	struct omap_dss_device *displays[10];
+	unsigned num_overlays;
+	struct omap_overlay *overlays[10];
+	unsigned num_managers;
+	struct omap_overlay_manager *managers[10];
+};
+
+struct omapfb_colormode {
+	enum omap_color_mode dssmode;
+	u32 bits_per_pixel;
+	u32 nonstd;
+	struct fb_bitfield red;
+	struct fb_bitfield green;
+	struct fb_bitfield blue;
+	struct fb_bitfield transp;
+};
+
+void set_fb_fix(struct fb_info *fbi);
+int check_fb_var(struct fb_info *fbi, struct fb_var_screeninfo *var);
+int omapfb_realloc_fbmem(struct fb_info *fbi, unsigned long size, int type);
+int omapfb_apply_changes(struct fb_info *fbi, int init);
+
+int omapfb_create_sysfs(struct omapfb2_device *fbdev);
+void omapfb_remove_sysfs(struct omapfb2_device *fbdev);
+
+int omapfb_ioctl(struct fb_info *fbi, unsigned int cmd, unsigned long arg);
+
+int dss_mode_to_fb_mode(enum omap_color_mode dssmode,
+			struct fb_var_screeninfo *var);
+
+/* find the display connected to this fb, if any */
+static inline struct omap_dss_device *fb2display(struct fb_info *fbi)
+{
+	struct omapfb_info *ofbi = FB2OFB(fbi);
+	int i;
+
+	/* XXX: returns the display connected to first attached overlay */
+	for (i = 0; i < ofbi->num_overlays; i++) {
+		if (ofbi->overlays[i]->manager)
+			return ofbi->overlays[i]->manager->device;
+	}
+
+	return NULL;
+}
+
+static inline void omapfb_lock(struct omapfb2_device *fbdev)
+{
+	mutex_lock(&fbdev->mtx);
+}
+
+static inline void omapfb_unlock(struct omapfb2_device *fbdev)
+{
+	mutex_unlock(&fbdev->mtx);
+}
+
+static inline int omapfb_overlay_enable(struct omap_overlay *ovl,
+		int enable)
+{
+	struct omap_overlay_info info;
+
+	ovl->get_overlay_info(ovl, &info);
+	info.enabled = enable;
+	return ovl->set_overlay_info(ovl, &info);
+}
+
+#endif
diff --git a/drivers/video/omap2/vram.c b/drivers/video/omap2/vram.c
new file mode 100644
index 000000000000..55a4de5e5d10
--- /dev/null
+++ b/drivers/video/omap2/vram.c
@@ -0,0 +1,655 @@
+/*
+ * VRAM manager for OMAP
+ *
+ * Copyright (C) 2009 Nokia Corporation
+ * Author: Tomi Valkeinen <tomi.valkeinen@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
+ */
+
+/*#define DEBUG*/
+
+#include <linux/kernel.h>
+#include <linux/mm.h>
+#include <linux/list.h>
+#include <linux/seq_file.h>
+#include <linux/bootmem.h>
+#include <linux/completion.h>
+#include <linux/debugfs.h>
+#include <linux/jiffies.h>
+#include <linux/module.h>
+
+#include <asm/setup.h>
+
+#include <plat/sram.h>
+#include <plat/vram.h>
+#include <plat/dma.h>
+
+#ifdef DEBUG
+#define DBG(format, ...) pr_debug("VRAM: " format, ## __VA_ARGS__)
+#else
+#define DBG(format, ...)
+#endif
+
+#define OMAP2_SRAM_START		0x40200000
+/* Maximum size, in reality this is smaller if SRAM is partially locked. */
+#define OMAP2_SRAM_SIZE			0xa0000		/* 640k */
+
+/* postponed regions are used to temporarily store region information at boot
+ * time when we cannot yet allocate the region list */
+#define MAX_POSTPONED_REGIONS 10
+
+static bool vram_initialized;
+static int postponed_cnt;
+static struct {
+	unsigned long paddr;
+	size_t size;
+} postponed_regions[MAX_POSTPONED_REGIONS];
+
+struct vram_alloc {
+	struct list_head list;
+	unsigned long paddr;
+	unsigned pages;
+};
+
+struct vram_region {
+	struct list_head list;
+	struct list_head alloc_list;
+	unsigned long paddr;
+	unsigned pages;
+};
+
+static DEFINE_MUTEX(region_mutex);
+static LIST_HEAD(region_list);
+
+static inline int region_mem_type(unsigned long paddr)
+{
+	if (paddr >= OMAP2_SRAM_START &&
+	    paddr < OMAP2_SRAM_START + OMAP2_SRAM_SIZE)
+		return OMAP_VRAM_MEMTYPE_SRAM;
+	else
+		return OMAP_VRAM_MEMTYPE_SDRAM;
+}
+
+static struct vram_region *omap_vram_create_region(unsigned long paddr,
+		unsigned pages)
+{
+	struct vram_region *rm;
+
+	rm = kzalloc(sizeof(*rm), GFP_KERNEL);
+
+	if (rm) {
+		INIT_LIST_HEAD(&rm->alloc_list);
+		rm->paddr = paddr;
+		rm->pages = pages;
+	}
+
+	return rm;
+}
+
+#if 0
+static void omap_vram_free_region(struct vram_region *vr)
+{
+	list_del(&vr->list);
+	kfree(vr);
+}
+#endif
+
+static struct vram_alloc *omap_vram_create_allocation(struct vram_region *vr,
+		unsigned long paddr, unsigned pages)
+{
+	struct vram_alloc *va;
+	struct vram_alloc *new;
+
+	new = kzalloc(sizeof(*va), GFP_KERNEL);
+
+	if (!new)
+		return NULL;
+
+	new->paddr = paddr;
+	new->pages = pages;
+
+	list_for_each_entry(va, &vr->alloc_list, list) {
+		if (va->paddr > new->paddr)
+			break;
+	}
+
+	list_add_tail(&new->list, &va->list);
+
+	return new;
+}
+
+static void omap_vram_free_allocation(struct vram_alloc *va)
+{
+	list_del(&va->list);
+	kfree(va);
+}
+
+int omap_vram_add_region(unsigned long paddr, size_t size)
+{
+	struct vram_region *rm;
+	unsigned pages;
+
+	if (vram_initialized) {
+		DBG("adding region paddr %08lx size %d\n",
+				paddr, size);
+
+		size &= PAGE_MASK;
+		pages = size >> PAGE_SHIFT;
+
+		rm = omap_vram_create_region(paddr, pages);
+		if (rm == NULL)
+			return -ENOMEM;
+
+		list_add(&rm->list, &region_list);
+	} else {
+		if (postponed_cnt == MAX_POSTPONED_REGIONS)
+			return -ENOMEM;
+
+		postponed_regions[postponed_cnt].paddr = paddr;
+		postponed_regions[postponed_cnt].size = size;
+
+		++postponed_cnt;
+	}
+	return 0;
+}
+
+int omap_vram_free(unsigned long paddr, size_t size)
+{
+	struct vram_region *rm;
+	struct vram_alloc *alloc;
+	unsigned start, end;
+
+	DBG("free mem paddr %08lx size %d\n", paddr, size);
+
+	size = PAGE_ALIGN(size);
+
+	mutex_lock(&region_mutex);
+
+	list_for_each_entry(rm, &region_list, list) {
+		list_for_each_entry(alloc, &rm->alloc_list, list) {
+			start = alloc->paddr;
+			end = alloc->paddr + (alloc->pages >> PAGE_SHIFT);
+
+			if (start >= paddr && end < paddr + size)
+				goto found;
+		}
+	}
+
+	mutex_unlock(&region_mutex);
+	return -EINVAL;
+
+found:
+	omap_vram_free_allocation(alloc);
+
+	mutex_unlock(&region_mutex);
+	return 0;
+}
+EXPORT_SYMBOL(omap_vram_free);
+
+static int _omap_vram_reserve(unsigned long paddr, unsigned pages)
+{
+	struct vram_region *rm;
+	struct vram_alloc *alloc;
+	size_t size;
+
+	size = pages << PAGE_SHIFT;
+
+	list_for_each_entry(rm, &region_list, list) {
+		unsigned long start, end;
+
+		DBG("checking region %lx %d\n", rm->paddr, rm->pages);
+
+		if (region_mem_type(rm->paddr) != region_mem_type(paddr))
+			continue;
+
+		start = rm->paddr;
+		end = start + (rm->pages << PAGE_SHIFT) - 1;
+		if (start > paddr || end < paddr + size - 1)
+			continue;
+
+		DBG("block ok, checking allocs\n");
+
+		list_for_each_entry(alloc, &rm->alloc_list, list) {
+			end = alloc->paddr - 1;
+
+			if (start <= paddr && end >= paddr + size - 1)
+				goto found;
+
+			start = alloc->paddr + (alloc->pages << PAGE_SHIFT);
+		}
+
+		end = rm->paddr + (rm->pages << PAGE_SHIFT) - 1;
+
+		if (!(start <= paddr && end >= paddr + size - 1))
+			continue;
+found:
+		DBG("found area start %lx, end %lx\n", start, end);
+
+		if (omap_vram_create_allocation(rm, paddr, pages) == NULL)
+			return -ENOMEM;
+
+		return 0;
+	}
+
+	return -ENOMEM;
+}
+
+int omap_vram_reserve(unsigned long paddr, size_t size)
+{
+	unsigned pages;
+	int r;
+
+	DBG("reserve mem paddr %08lx size %d\n", paddr, size);
+
+	size = PAGE_ALIGN(size);
+	pages = size >> PAGE_SHIFT;
+
+	mutex_lock(&region_mutex);
+
+	r = _omap_vram_reserve(paddr, pages);
+
+	mutex_unlock(&region_mutex);
+
+	return r;
+}
+EXPORT_SYMBOL(omap_vram_reserve);
+
+static void _omap_vram_dma_cb(int lch, u16 ch_status, void *data)
+{
+	struct completion *compl = data;
+	complete(compl);
+}
+
+static int _omap_vram_clear(u32 paddr, unsigned pages)
+{
+	struct completion compl;
+	unsigned elem_count;
+	unsigned frame_count;
+	int r;
+	int lch;
+
+	init_completion(&compl);
+
+	r = omap_request_dma(OMAP_DMA_NO_DEVICE, "VRAM DMA",
+			_omap_vram_dma_cb,
+			&compl, &lch);
+	if (r) {
+		pr_err("VRAM: request_dma failed for memory clear\n");
+		return -EBUSY;
+	}
+
+	elem_count = pages * PAGE_SIZE / 4;
+	frame_count = 1;
+
+	omap_set_dma_transfer_params(lch, OMAP_DMA_DATA_TYPE_S32,
+			elem_count, frame_count,
+			OMAP_DMA_SYNC_ELEMENT,
+			0, 0);
+
+	omap_set_dma_dest_params(lch, 0, OMAP_DMA_AMODE_POST_INC,
+			paddr, 0, 0);
+
+	omap_set_dma_color_mode(lch, OMAP_DMA_CONSTANT_FILL, 0x000000);
+
+	omap_start_dma(lch);
+
+	if (wait_for_completion_timeout(&compl, msecs_to_jiffies(1000)) == 0) {
+		omap_stop_dma(lch);
+		pr_err("VRAM: dma timeout while clearing memory\n");
+		r = -EIO;
+		goto err;
+	}
+
+	r = 0;
+err:
+	omap_free_dma(lch);
+
+	return r;
+}
+
+static int _omap_vram_alloc(int mtype, unsigned pages, unsigned long *paddr)
+{
+	struct vram_region *rm;
+	struct vram_alloc *alloc;
+
+	list_for_each_entry(rm, &region_list, list) {
+		unsigned long start, end;
+
+		DBG("checking region %lx %d\n", rm->paddr, rm->pages);
+
+		if (region_mem_type(rm->paddr) != mtype)
+			continue;
+
+		start = rm->paddr;
+
+		list_for_each_entry(alloc, &rm->alloc_list, list) {
+			end = alloc->paddr;
+
+			if (end - start >= pages << PAGE_SHIFT)
+				goto found;
+
+			start = alloc->paddr + (alloc->pages << PAGE_SHIFT);
+		}
+
+		end = rm->paddr + (rm->pages << PAGE_SHIFT);
+found:
+		if (end - start < pages << PAGE_SHIFT)
+			continue;
+
+		DBG("found %lx, end %lx\n", start, end);
+
+		alloc = omap_vram_create_allocation(rm, start, pages);
+		if (alloc == NULL)
+			return -ENOMEM;
+
+		*paddr = start;
+
+		_omap_vram_clear(start, pages);
+
+		return 0;
+	}
+
+	return -ENOMEM;
+}
+
+int omap_vram_alloc(int mtype, size_t size, unsigned long *paddr)
+{
+	unsigned pages;
+	int r;
+
+	BUG_ON(mtype > OMAP_VRAM_MEMTYPE_MAX || !size);
+
+	DBG("alloc mem type %d size %d\n", mtype, size);
+
+	size = PAGE_ALIGN(size);
+	pages = size >> PAGE_SHIFT;
+
+	mutex_lock(&region_mutex);
+
+	r = _omap_vram_alloc(mtype, pages, paddr);
+
+	mutex_unlock(&region_mutex);
+
+	return r;
+}
+EXPORT_SYMBOL(omap_vram_alloc);
+
+void omap_vram_get_info(unsigned long *vram,
+		unsigned long *free_vram,
+		unsigned long *largest_free_block)
+{
+	struct vram_region *vr;
+	struct vram_alloc *va;
+
+	*vram = 0;
+	*free_vram = 0;
+	*largest_free_block = 0;
+
+	mutex_lock(&region_mutex);
+
+	list_for_each_entry(vr, &region_list, list) {
+		unsigned free;
+		unsigned long pa;
+
+		pa = vr->paddr;
+		*vram += vr->pages << PAGE_SHIFT;
+
+		list_for_each_entry(va, &vr->alloc_list, list) {
+			free = va->paddr - pa;
+			*free_vram += free;
+			if (free > *largest_free_block)
+				*largest_free_block = free;
+			pa = va->paddr + (va->pages << PAGE_SHIFT);
+		}
+
+		free = vr->paddr + (vr->pages << PAGE_SHIFT) - pa;
+		*free_vram += free;
+		if (free > *largest_free_block)
+			*largest_free_block = free;
+	}
+
+	mutex_unlock(&region_mutex);
+}
+EXPORT_SYMBOL(omap_vram_get_info);
+
+#if defined(CONFIG_DEBUG_FS)
+static int vram_debug_show(struct seq_file *s, void *unused)
+{
+	struct vram_region *vr;
+	struct vram_alloc *va;
+	unsigned size;
+
+	mutex_lock(&region_mutex);
+
+	list_for_each_entry(vr, &region_list, list) {
+		size = vr->pages << PAGE_SHIFT;
+		seq_printf(s, "%08lx-%08lx (%d bytes)\n",
+				vr->paddr, vr->paddr + size - 1,
+				size);
+
+		list_for_each_entry(va, &vr->alloc_list, list) {
+			size = va->pages << PAGE_SHIFT;
+			seq_printf(s, "    %08lx-%08lx (%d bytes)\n",
+					va->paddr, va->paddr + size - 1,
+					size);
+		}
+	}
+
+	mutex_unlock(&region_mutex);
+
+	return 0;
+}
+
+static int vram_debug_open(struct inode *inode, struct file *file)
+{
+	return single_open(file, vram_debug_show, inode->i_private);
+}
+
+static const struct file_operations vram_debug_fops = {
+	.open           = vram_debug_open,
+	.read           = seq_read,
+	.llseek         = seq_lseek,
+	.release        = single_release,
+};
+
+static int __init omap_vram_create_debugfs(void)
+{
+	struct dentry *d;
+
+	d = debugfs_create_file("vram", S_IRUGO, NULL,
+			NULL, &vram_debug_fops);
+	if (IS_ERR(d))
+		return PTR_ERR(d);
+
+	return 0;
+}
+#endif
+
+static __init int omap_vram_init(void)
+{
+	int i;
+
+	vram_initialized = 1;
+
+	for (i = 0; i < postponed_cnt; i++)
+		omap_vram_add_region(postponed_regions[i].paddr,
+				postponed_regions[i].size);
+
+#ifdef CONFIG_DEBUG_FS
+	if (omap_vram_create_debugfs())
+		pr_err("VRAM: Failed to create debugfs file\n");
+#endif
+
+	return 0;
+}
+
+arch_initcall(omap_vram_init);
+
+/* boottime vram alloc stuff */
+
+/* set from board file */
+static u32 omap_vram_sram_start __initdata;
+static u32 omap_vram_sram_size __initdata;
+
+/* set from board file */
+static u32 omap_vram_sdram_start __initdata;
+static u32 omap_vram_sdram_size __initdata;
+
+/* set from kernel cmdline */
+static u32 omap_vram_def_sdram_size __initdata;
+static u32 omap_vram_def_sdram_start __initdata;
+
+static void __init omap_vram_early_vram(char **p)
+{
+	omap_vram_def_sdram_size = memparse(*p, p);
+	if (**p == ',')
+		omap_vram_def_sdram_start = simple_strtoul((*p) + 1, p, 16);
+}
+__early_param("vram=", omap_vram_early_vram);
+
+/*
+ * Called from map_io. We need to call to this early enough so that we
+ * can reserve the fixed SDRAM regions before VM could get hold of them.
+ */
+void __init omap_vram_reserve_sdram(void)
+{
+	struct bootmem_data	*bdata;
+	unsigned long		sdram_start, sdram_size;
+	u32 paddr;
+	u32 size = 0;
+
+	/* cmdline arg overrides the board file definition */
+	if (omap_vram_def_sdram_size) {
+		size = omap_vram_def_sdram_size;
+		paddr = omap_vram_def_sdram_start;
+	}
+
+	if (!size) {
+		size = omap_vram_sdram_size;
+		paddr = omap_vram_sdram_start;
+	}
+
+#ifdef CONFIG_OMAP2_VRAM_SIZE
+	if (!size) {
+		size = CONFIG_OMAP2_VRAM_SIZE * 1024 * 1024;
+		paddr = 0;
+	}
+#endif
+
+	if (!size)
+		return;
+
+	size = PAGE_ALIGN(size);
+
+	bdata = NODE_DATA(0)->bdata;
+	sdram_start = bdata->node_min_pfn << PAGE_SHIFT;
+	sdram_size = (bdata->node_low_pfn << PAGE_SHIFT) - sdram_start;
+
+	if (paddr) {
+		if ((paddr & ~PAGE_MASK) || paddr < sdram_start ||
+				paddr + size > sdram_start + sdram_size) {
+			pr_err("Illegal SDRAM region for VRAM\n");
+			return;
+		}
+
+		if (reserve_bootmem(paddr, size, BOOTMEM_EXCLUSIVE) < 0) {
+			pr_err("FB: failed to reserve VRAM\n");
+			return;
+		}
+	} else {
+		if (size > sdram_size) {
+			pr_err("Illegal SDRAM size for VRAM\n");
+			return;
+		}
+
+		paddr = virt_to_phys(alloc_bootmem_pages(size));
+		BUG_ON(paddr & ~PAGE_MASK);
+	}
+
+	omap_vram_add_region(paddr, size);
+
+	pr_info("Reserving %u bytes SDRAM for VRAM\n", size);
+}
+
+/*
+ * Called at sram init time, before anything is pushed to the SRAM stack.
+ * Because of the stack scheme, we will allocate everything from the
+ * start of the lowest address region to the end of SRAM. This will also
+ * include padding for page alignment and possible holes between regions.
+ *
+ * As opposed to the SDRAM case, we'll also do any dynamic allocations at
+ * this point, since the driver built as a module would have problem with
+ * freeing / reallocating the regions.
+ */
+unsigned long __init omap_vram_reserve_sram(unsigned long sram_pstart,
+				  unsigned long sram_vstart,
+				  unsigned long sram_size,
+				  unsigned long pstart_avail,
+				  unsigned long size_avail)
+{
+	unsigned long			pend_avail;
+	unsigned long			reserved;
+	u32 paddr;
+	u32 size;
+
+	paddr = omap_vram_sram_start;
+	size = omap_vram_sram_size;
+
+	if (!size)
+		return 0;
+
+	reserved = 0;
+	pend_avail = pstart_avail + size_avail;
+
+	if (!paddr) {
+		/* Dynamic allocation */
+		if ((size_avail & PAGE_MASK) < size) {
+			pr_err("Not enough SRAM for VRAM\n");
+			return 0;
+		}
+		size_avail = (size_avail - size) & PAGE_MASK;
+		paddr = pstart_avail + size_avail;
+	}
+
+	if (paddr < sram_pstart ||
+			paddr + size > sram_pstart + sram_size) {
+		pr_err("Illegal SRAM region for VRAM\n");
+		return 0;
+	}
+
+	/* Reserve everything above the start of the region. */
+	if (pend_avail - paddr > reserved)
+		reserved = pend_avail - paddr;
+	size_avail = pend_avail - reserved - pstart_avail;
+
+	omap_vram_add_region(paddr, size);
+
+	if (reserved)
+		pr_info("Reserving %lu bytes SRAM for VRAM\n", reserved);
+
+	return reserved;
+}
+
+void __init omap_vram_set_sdram_vram(u32 size, u32 start)
+{
+	omap_vram_sdram_start = start;
+	omap_vram_sdram_size = size;
+}
+
+void __init omap_vram_set_sram_vram(u32 size, u32 start)
+{
+	omap_vram_sram_start = start;
+	omap_vram_sram_size = size;
+}
diff --git a/drivers/video/omap2/vrfb.c b/drivers/video/omap2/vrfb.c
new file mode 100644
index 000000000000..fd2271600370
--- /dev/null
+++ b/drivers/video/omap2/vrfb.c
@@ -0,0 +1,315 @@
+/*
+ * VRFB Rotation Engine
+ *
+ * Copyright (C) 2009 Nokia Corporation
+ * Author: Tomi Valkeinen <tomi.valkeinen@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
+ */
+
+/*#define DEBUG*/
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/ioport.h>
+#include <linux/io.h>
+#include <linux/bitops.h>
+#include <linux/mutex.h>
+
+#include <mach/io.h>
+#include <plat/vrfb.h>
+#include <plat/sdrc.h>
+
+#ifdef DEBUG
+#define DBG(format, ...) pr_debug("VRFB: " format, ## __VA_ARGS__)
+#else
+#define DBG(format, ...)
+#endif
+
+#define SMS_ROT_VIRT_BASE(context, rot) \
+	(((context >= 4) ? 0xD0000000 : 0x70000000) \
+	 + (0x4000000 * (context)) \
+	 + (0x1000000 * (rot)))
+
+#define OMAP_VRFB_SIZE			(2048 * 2048 * 4)
+
+#define VRFB_PAGE_WIDTH_EXP	5 /* Assuming SDRAM pagesize= 1024 */
+#define VRFB_PAGE_HEIGHT_EXP	5 /* 1024 = 2^5 * 2^5 */
+#define VRFB_PAGE_WIDTH		(1 << VRFB_PAGE_WIDTH_EXP)
+#define VRFB_PAGE_HEIGHT	(1 << VRFB_PAGE_HEIGHT_EXP)
+#define SMS_IMAGEHEIGHT_OFFSET	16
+#define SMS_IMAGEWIDTH_OFFSET	0
+#define SMS_PH_OFFSET		8
+#define SMS_PW_OFFSET		4
+#define SMS_PS_OFFSET		0
+
+#define VRFB_NUM_CTXS 12
+/* bitmap of reserved contexts */
+static unsigned long ctx_map;
+
+static DEFINE_MUTEX(ctx_lock);
+
+/*
+ * Access to this happens from client drivers or the PM core after wake-up.
+ * For the first case we require locking at the driver level, for the second
+ * we don't need locking, since no drivers will run until after the wake-up
+ * has finished.
+ */
+static struct {
+	u32 physical_ba;
+	u32 control;
+	u32 size;
+} vrfb_hw_context[VRFB_NUM_CTXS];
+
+static inline void restore_hw_context(int ctx)
+{
+	omap2_sms_write_rot_control(vrfb_hw_context[ctx].control, ctx);
+	omap2_sms_write_rot_size(vrfb_hw_context[ctx].size, ctx);
+	omap2_sms_write_rot_physical_ba(vrfb_hw_context[ctx].physical_ba, ctx);
+}
+
+static u32 get_image_width_roundup(u16 width, u8 bytespp)
+{
+	unsigned long stride = width * bytespp;
+	unsigned long ceil_pages_per_stride = (stride / VRFB_PAGE_WIDTH) +
+		(stride % VRFB_PAGE_WIDTH != 0);
+
+	return ceil_pages_per_stride * VRFB_PAGE_WIDTH / bytespp;
+}
+
+/*
+ * This the extra space needed in the VRFB physical area for VRFB to safely wrap
+ * any memory accesses to the invisible part of the virtual view to the physical
+ * area.
+ */
+static inline u32 get_extra_physical_size(u16 image_width_roundup, u8 bytespp)
+{
+	return (OMAP_VRFB_LINE_LEN - image_width_roundup) * VRFB_PAGE_HEIGHT *
+		bytespp;
+}
+
+void omap_vrfb_restore_context(void)
+{
+	int i;
+	unsigned long map = ctx_map;
+
+	for (i = ffs(map); i; i = ffs(map)) {
+		/* i=1..32 */
+		i--;
+		map &= ~(1 << i);
+		restore_hw_context(i);
+	}
+}
+
+void omap_vrfb_adjust_size(u16 *width, u16 *height,
+		u8 bytespp)
+{
+	*width = ALIGN(*width * bytespp, VRFB_PAGE_WIDTH) / bytespp;
+	*height = ALIGN(*height, VRFB_PAGE_HEIGHT);
+}
+EXPORT_SYMBOL(omap_vrfb_adjust_size);
+
+u32 omap_vrfb_min_phys_size(u16 width, u16 height, u8 bytespp)
+{
+	unsigned long image_width_roundup = get_image_width_roundup(width,
+		bytespp);
+
+	if (image_width_roundup > OMAP_VRFB_LINE_LEN)
+		return 0;
+
+	return (width * height * bytespp) + get_extra_physical_size(
+		image_width_roundup, bytespp);
+}
+EXPORT_SYMBOL(omap_vrfb_min_phys_size);
+
+u16 omap_vrfb_max_height(u32 phys_size, u16 width, u8 bytespp)
+{
+	unsigned long image_width_roundup = get_image_width_roundup(width,
+		bytespp);
+	unsigned long height;
+	unsigned long extra;
+
+	if (image_width_roundup > OMAP_VRFB_LINE_LEN)
+		return 0;
+
+	extra = get_extra_physical_size(image_width_roundup, bytespp);
+
+	if (phys_size < extra)
+		return 0;
+
+	height = (phys_size - extra) / (width * bytespp);
+
+	/* Virtual views provided by VRFB are limited to 2048x2048. */
+	return min_t(unsigned long, height, 2048);
+}
+EXPORT_SYMBOL(omap_vrfb_max_height);
+
+void omap_vrfb_setup(struct vrfb *vrfb, unsigned long paddr,
+		u16 width, u16 height,
+		unsigned bytespp, bool yuv_mode)
+{
+	unsigned pixel_size_exp;
+	u16 vrfb_width;
+	u16 vrfb_height;
+	u8 ctx = vrfb->context;
+	u32 size;
+	u32 control;
+
+	DBG("omapfb_set_vrfb(%d, %lx, %dx%d, %d, %d)\n", ctx, paddr,
+			width, height, bytespp, yuv_mode);
+
+	/* For YUV2 and UYVY modes VRFB needs to handle pixels a bit
+	 * differently. See TRM. */
+	if (yuv_mode) {
+		bytespp *= 2;
+		width /= 2;
+	}
+
+	if (bytespp == 4)
+		pixel_size_exp = 2;
+	else if (bytespp == 2)
+		pixel_size_exp = 1;
+	else
+		BUG();
+
+	vrfb_width = ALIGN(width * bytespp, VRFB_PAGE_WIDTH) / bytespp;
+	vrfb_height = ALIGN(height, VRFB_PAGE_HEIGHT);
+
+	DBG("vrfb w %u, h %u bytespp %d\n", vrfb_width, vrfb_height, bytespp);
+
+	size  = vrfb_width << SMS_IMAGEWIDTH_OFFSET;
+	size |= vrfb_height << SMS_IMAGEHEIGHT_OFFSET;
+
+	control  = pixel_size_exp << SMS_PS_OFFSET;
+	control |= VRFB_PAGE_WIDTH_EXP  << SMS_PW_OFFSET;
+	control |= VRFB_PAGE_HEIGHT_EXP << SMS_PH_OFFSET;
+
+	vrfb_hw_context[ctx].physical_ba = paddr;
+	vrfb_hw_context[ctx].size = size;
+	vrfb_hw_context[ctx].control = control;
+
+	omap2_sms_write_rot_physical_ba(paddr, ctx);
+	omap2_sms_write_rot_size(size, ctx);
+	omap2_sms_write_rot_control(control, ctx);
+
+	DBG("vrfb offset pixels %d, %d\n",
+			vrfb_width - width, vrfb_height - height);
+
+	vrfb->xres = width;
+	vrfb->yres = height;
+	vrfb->xoffset = vrfb_width - width;
+	vrfb->yoffset = vrfb_height - height;
+	vrfb->bytespp = bytespp;
+	vrfb->yuv_mode = yuv_mode;
+}
+EXPORT_SYMBOL(omap_vrfb_setup);
+
+int omap_vrfb_map_angle(struct vrfb *vrfb, u16 height, u8 rot)
+{
+	unsigned long size = height * OMAP_VRFB_LINE_LEN * vrfb->bytespp;
+
+	vrfb->vaddr[rot] = ioremap_wc(vrfb->paddr[rot], size);
+
+	if (!vrfb->vaddr[rot]) {
+		printk(KERN_ERR "vrfb: ioremap failed\n");
+		return -ENOMEM;
+	}
+
+	DBG("ioremapped vrfb area %d of size %lu into %p\n", rot, size,
+		vrfb->vaddr[rot]);
+
+	return 0;
+}
+EXPORT_SYMBOL(omap_vrfb_map_angle);
+
+void omap_vrfb_release_ctx(struct vrfb *vrfb)
+{
+	int rot;
+	int ctx = vrfb->context;
+
+	if (ctx == 0xff)
+		return;
+
+	DBG("release ctx %d\n", ctx);
+
+	mutex_lock(&ctx_lock);
+
+	BUG_ON(!(ctx_map & (1 << ctx)));
+
+	clear_bit(ctx, &ctx_map);
+
+	for (rot = 0; rot < 4; ++rot) {
+		if (vrfb->paddr[rot]) {
+			release_mem_region(vrfb->paddr[rot], OMAP_VRFB_SIZE);
+			vrfb->paddr[rot] = 0;
+		}
+	}
+
+	vrfb->context = 0xff;
+
+	mutex_unlock(&ctx_lock);
+}
+EXPORT_SYMBOL(omap_vrfb_release_ctx);
+
+int omap_vrfb_request_ctx(struct vrfb *vrfb)
+{
+	int rot;
+	u32 paddr;
+	u8 ctx;
+	int r;
+
+	DBG("request ctx\n");
+
+	mutex_lock(&ctx_lock);
+
+	for (ctx = 0; ctx < VRFB_NUM_CTXS; ++ctx)
+		if ((ctx_map & (1 << ctx)) == 0)
+			break;
+
+	if (ctx == VRFB_NUM_CTXS) {
+		pr_err("vrfb: no free contexts\n");
+		r = -EBUSY;
+		goto out;
+	}
+
+	DBG("found free ctx %d\n", ctx);
+
+	set_bit(ctx, &ctx_map);
+
+	memset(vrfb, 0, sizeof(*vrfb));
+
+	vrfb->context = ctx;
+
+	for (rot = 0; rot < 4; ++rot) {
+		paddr = SMS_ROT_VIRT_BASE(ctx, rot);
+		if (!request_mem_region(paddr, OMAP_VRFB_SIZE, "vrfb")) {
+			pr_err("vrfb: failed to reserve VRFB "
+					"area for ctx %d, rotation %d\n",
+					ctx, rot * 90);
+			omap_vrfb_release_ctx(vrfb);
+			r = -ENOMEM;
+			goto out;
+		}
+
+		vrfb->paddr[rot] = paddr;
+
+		DBG("VRFB %d/%d: %lx\n", ctx, rot*90, vrfb->paddr[rot]);
+	}
+
+	r = 0;
+out:
+	mutex_unlock(&ctx_lock);
+	return r;
+}
+EXPORT_SYMBOL(omap_vrfb_request_ctx);
diff --git a/drivers/video/output.c b/drivers/video/output.c
index 5e6439ae7394..5137aa016b83 100644
--- a/drivers/video/output.c
+++ b/drivers/video/output.c
@@ -50,7 +50,7 @@ static ssize_t video_output_store_state(struct device *dev,
 	int request_state = simple_strtoul(buf,&endp,0);
 	size_t size = endp - buf;
 
-	if (*endp && isspace(*endp))
+	if (isspace(*endp))
 		size++;
 	if (size != count)
 		return -EINVAL;
diff --git a/drivers/video/pmag-ba-fb.c b/drivers/video/pmag-ba-fb.c
index 0573ec685a57..0f361b6100d2 100644
--- a/drivers/video/pmag-ba-fb.c
+++ b/drivers/video/pmag-ba-fb.c
@@ -98,7 +98,8 @@ static int pmagbafb_setcolreg(unsigned int regno, unsigned int red,
 {
 	struct pmagbafb_par *par = info->par;
 
-	BUG_ON(regno >= info->cmap.len);
+	if (regno >= info->cmap.len)
+		return 1;
 
 	red   >>= 8;	/* The cmap fields are 16 bits    */
 	green >>= 8;	/* wide, but the hardware colormap */
diff --git a/drivers/video/pmagb-b-fb.c b/drivers/video/pmagb-b-fb.c
index 98748723af9f..2de0806421b4 100644
--- a/drivers/video/pmagb-b-fb.c
+++ b/drivers/video/pmagb-b-fb.c
@@ -102,7 +102,8 @@ static int pmagbbfb_setcolreg(unsigned int regno, unsigned int red,
 {
 	struct pmagbbfb_par *par = info->par;
 
-	BUG_ON(regno >= info->cmap.len);
+	if (regno >= info->cmap.len)
+		return 1;
 
 	red   >>= 8;	/* The cmap fields are 16 bits    */
 	green >>= 8;	/* wide, but the hardware colormap */
diff --git a/drivers/video/pxafb.c b/drivers/video/pxafb.c
index f58a3aae6ea6..825b665245bb 100644
--- a/drivers/video/pxafb.c
+++ b/drivers/video/pxafb.c
@@ -1223,11 +1223,12 @@ static int pxafb_smart_thread(void *arg)
 	struct pxafb_info *fbi = arg;
 	struct pxafb_mach_info *inf = fbi->dev->platform_data;
 
-	if (!fbi || !inf->smart_update) {
+	if (!inf->smart_update) {
 		pr_err("%s: not properly initialized, thread terminated\n",
 				__func__);
 		return -EINVAL;
 	}
+	inf = fbi->dev->platform_data;
 
 	pr_debug("%s(): task starting\n", __func__);
 
@@ -1667,7 +1668,7 @@ static int pxafb_resume(struct device *dev)
 	return 0;
 }
 
-static struct dev_pm_ops pxafb_pm_ops = {
+static const struct dev_pm_ops pxafb_pm_ops = {
 	.suspend	= pxafb_suspend,
 	.resume		= pxafb_resume,
 };
diff --git a/drivers/video/s3c-fb.c b/drivers/video/s3c-fb.c
index adf9632c6b1f..53cb722c45a0 100644
--- a/drivers/video/s3c-fb.c
+++ b/drivers/video/s3c-fb.c
@@ -211,21 +211,23 @@ static int s3c_fb_check_var(struct fb_var_screeninfo *var,
 
 /**
  * s3c_fb_calc_pixclk() - calculate the divider to create the pixel clock.
- * @id: window id.
  * @sfb: The hardware state.
  * @pixclock: The pixel clock wanted, in picoseconds.
  *
  * Given the specified pixel clock, work out the necessary divider to get
  * close to the output frequency.
  */
-static int s3c_fb_calc_pixclk(unsigned char id, struct s3c_fb *sfb, unsigned int pixclk)
+static int s3c_fb_calc_pixclk(struct s3c_fb *sfb, unsigned int pixclk)
 {
-	struct s3c_fb_pd_win *win = sfb->pdata->win[id];
 	unsigned long clk = clk_get_rate(sfb->bus_clk);
+	unsigned long long tmp;
 	unsigned int result;
 
-	pixclk *= win->win_mode.refresh;
-	result = clk / pixclk;
+	tmp = (unsigned long long)clk;
+	tmp *= pixclk;
+
+	do_div(tmp, 1000000000UL);
+	result = (unsigned int)tmp / 1000;
 
 	dev_dbg(sfb->dev, "pixclk=%u, clk=%lu, div=%d (%lu)\n",
 		pixclk, clk, result, clk / result);
@@ -301,7 +303,7 @@ static int s3c_fb_set_par(struct fb_info *info)
 	/* use window 0 as the basis for the lcd output timings */
 
 	if (win_no == 0) {
-		clkdiv = s3c_fb_calc_pixclk(win_no, sfb, var->pixclock);
+		clkdiv = s3c_fb_calc_pixclk(sfb, var->pixclock);
 
 		data = sfb->pdata->vidcon0;
 		data &= ~(VIDCON0_CLKVAL_F_MASK | VIDCON0_CLKDIR);
diff --git a/drivers/video/sgivwfb.c b/drivers/video/sgivwfb.c
index bba53714a7b1..f86012239bff 100644
--- a/drivers/video/sgivwfb.c
+++ b/drivers/video/sgivwfb.c
@@ -260,13 +260,13 @@ static int sgivwfb_check_var(struct fb_var_screeninfo *var,
 	var->grayscale = 0;	/* No grayscale for now */
 
 	/* determine valid resolution and timing */
-	for (min_mode = 0; min_mode < DBE_VT_SIZE; min_mode++) {
+	for (min_mode = 0; min_mode < ARRAY_SIZE(dbeVTimings); min_mode++) {
 		if (dbeVTimings[min_mode].width >= var->xres &&
 		    dbeVTimings[min_mode].height >= var->yres)
 			break;
 	}
 
-	if (min_mode == DBE_VT_SIZE)
+	if (min_mode == ARRAY_SIZE(dbeVTimings))
 		return -EINVAL;	/* Resolution to high */
 
 	/* XXX FIXME - should try to pick best refresh rate */
diff --git a/drivers/video/sh_mobile_lcdcfb.c b/drivers/video/sh_mobile_lcdcfb.c
index 3ad5157f9899..a69830d26f7f 100644
--- a/drivers/video/sh_mobile_lcdcfb.c
+++ b/drivers/video/sh_mobile_lcdcfb.c
@@ -281,18 +281,42 @@ static void sh_mobile_lcdc_deferred_io(struct fb_info *info,
 				       struct list_head *pagelist)
 {
 	struct sh_mobile_lcdc_chan *ch = info->par;
-	unsigned int nr_pages;
+	struct sh_mobile_lcdc_board_cfg	*bcfg = &ch->cfg.board_cfg;
 
 	/* enable clocks before accessing hardware */
 	sh_mobile_lcdc_clk_on(ch->lcdc);
 
-	nr_pages = sh_mobile_lcdc_sginit(info, pagelist);
-	dma_map_sg(info->dev, ch->sglist, nr_pages, DMA_TO_DEVICE);
-
-	/* trigger panel update */
-	lcdc_write_chan(ch, LDSM2R, 1);
-
-	dma_unmap_sg(info->dev, ch->sglist, nr_pages, DMA_TO_DEVICE);
+	/*
+	 * It's possible to get here without anything on the pagelist via
+	 * sh_mobile_lcdc_deferred_io_touch() or via a userspace fsync()
+	 * invocation. In the former case, the acceleration routines are
+	 * stepped in to when using the framebuffer console causing the
+	 * workqueue to be scheduled without any dirty pages on the list.
+	 *
+	 * Despite this, a panel update is still needed given that the
+	 * acceleration routines have their own methods for writing in
+	 * that still need to be updated.
+	 *
+	 * The fsync() and empty pagelist case could be optimized for,
+	 * but we don't bother, as any application exhibiting such
+	 * behaviour is fundamentally broken anyways.
+	 */
+	if (!list_empty(pagelist)) {
+		unsigned int nr_pages = sh_mobile_lcdc_sginit(info, pagelist);
+
+		/* trigger panel update */
+		dma_map_sg(info->dev, ch->sglist, nr_pages, DMA_TO_DEVICE);
+		if (bcfg->start_transfer)
+			bcfg->start_transfer(bcfg->board_data, ch,
+					     &sh_mobile_lcdc_sys_bus_ops);
+		lcdc_write_chan(ch, LDSM2R, 1);
+		dma_unmap_sg(info->dev, ch->sglist, nr_pages, DMA_TO_DEVICE);
+	} else {
+		if (bcfg->start_transfer)
+			bcfg->start_transfer(bcfg->board_data, ch,
+					     &sh_mobile_lcdc_sys_bus_ops);
+		lcdc_write_chan(ch, LDSM2R, 1);
+	}
 }
 
 static void sh_mobile_lcdc_deferred_io_touch(struct fb_info *info)
@@ -874,7 +898,7 @@ static int sh_mobile_lcdc_runtime_resume(struct device *dev)
 	return 0;
 }
 
-static struct dev_pm_ops sh_mobile_lcdc_dev_pm_ops = {
+static const struct dev_pm_ops sh_mobile_lcdc_dev_pm_ops = {
 	.suspend = sh_mobile_lcdc_suspend,
 	.resume = sh_mobile_lcdc_resume,
 	.runtime_suspend = sh_mobile_lcdc_runtime_suspend,
diff --git a/drivers/video/sis/sis_main.c b/drivers/video/sis/sis_main.c
index a4e05e4d7501..9d2b6bc49036 100644
--- a/drivers/video/sis/sis_main.c
+++ b/drivers/video/sis/sis_main.c
@@ -2115,7 +2115,7 @@ sisfb_detect_VB_connect(struct sis_video_info *ivideo)
 	   if( (!(ivideo->vbflags2 & VB2_SISBRIDGE)) &&
 	       (!((ivideo->sisvga_engine == SIS_315_VGA) &&
 			(ivideo->vbflags2 & VB2_CHRONTEL))) ) {
-	      if(ivideo->sisfb_tvstd & (TV_PALN | TV_PALN | TV_NTSCJ)) {
+	      if(ivideo->sisfb_tvstd & (TV_PALM | TV_PALN | TV_NTSCJ)) {
 		 ivideo->sisfb_tvstd = -1;
 		 printk(KERN_ERR "sisfb: PALM/PALN/NTSCJ not supported\n");
 	      }
diff --git a/drivers/video/sm501fb.c b/drivers/video/sm501fb.c
index 924d79462780..35370d0ecf03 100644
--- a/drivers/video/sm501fb.c
+++ b/drivers/video/sm501fb.c
@@ -29,8 +29,8 @@
 #include <linux/platform_device.h>
 #include <linux/clk.h>
 #include <linux/console.h>
+#include <linux/io.h>
 
-#include <asm/io.h>
 #include <asm/uaccess.h>
 #include <asm/div64.h>
 
@@ -66,6 +66,7 @@ struct sm501fb_info {
 	struct fb_info		*fb[2];		/* fb info for both heads */
 	struct resource		*fbmem_res;	/* framebuffer resource */
 	struct resource		*regs_res;	/* registers resource */
+	struct resource		*regs2d_res;	/* 2d registers resource */
 	struct sm501_platdata_fb *pdata;	/* our platform data */
 
 	unsigned long		 pm_crt_ctrl;	/* pm: crt ctrl save */
@@ -73,6 +74,7 @@ struct sm501fb_info {
 	int			 irq;
 	int			 swap_endian;	/* set to swap rgb=>bgr */
 	void __iomem		*regs;		/* remapped registers */
+	void __iomem		*regs2d;	/* 2d remapped registers */
 	void __iomem		*fbmem;		/* remapped framebuffer */
 	size_t			 fbmem_len;	/* length of remapped region */
 };
@@ -123,9 +125,9 @@ static inline void sm501fb_sync_regs(struct sm501fb_info *info)
  * This is an attempt to lay out memory for the two framebuffers and
  * everything else
  *
- * |fbmem_res->start	                                       fbmem_res->end|
- * |                                                                         |
- * |fb[0].fix.smem_start    |         |fb[1].fix.smem_start    |     2K      |
+ * |fbmem_res->start					       fbmem_res->end|
+ * |									     |
+ * |fb[0].fix.smem_start    |	      |fb[1].fix.smem_start    |     2K	     |
  * |-> fb[0].fix.smem_len <-| spare   |-> fb[1].fix.smem_len <-|-> cursors <-|
  *
  * The "spare" space is for the 2d engine data
@@ -1246,7 +1248,173 @@ static ssize_t sm501fb_debug_show_pnl(struct device *dev,
 
 static DEVICE_ATTR(fbregs_pnl, 0444, sm501fb_debug_show_pnl, NULL);
 
-/* framebuffer ops */
+/* acceleration operations */
+static int sm501fb_sync(struct fb_info *info)
+{
+	int count = 1000000;
+	struct sm501fb_par  *par = info->par;
+	struct sm501fb_info *fbi = par->info;
+
+	/* wait for the 2d engine to be ready */
+	while ((count > 0) &&
+	       (readl(fbi->regs + SM501_SYSTEM_CONTROL) &
+		SM501_SYSCTRL_2D_ENGINE_STATUS) != 0)
+		count--;
+
+	if (count <= 0) {
+		dev_err(info->dev, "Timeout waiting for 2d engine sync\n");
+		return 1;
+	}
+	return 0;
+}
+
+static void sm501fb_copyarea(struct fb_info *info, const struct fb_copyarea *area)
+{
+	struct sm501fb_par  *par = info->par;
+	struct sm501fb_info *fbi = par->info;
+	int width = area->width;
+	int height = area->height;
+	int sx = area->sx;
+	int sy = area->sy;
+	int dx = area->dx;
+	int dy = area->dy;
+	unsigned long rtl = 0;
+
+	/* source clip */
+	if ((sx >= info->var.xres_virtual) ||
+	    (sy >= info->var.yres_virtual))
+		/* source Area not within virtual screen, skipping */
+		return;
+	if ((sx + width) >= info->var.xres_virtual)
+		width = info->var.xres_virtual - sx - 1;
+	if ((sy + height) >= info->var.yres_virtual)
+		height = info->var.yres_virtual - sy - 1;
+
+	/* dest clip */
+	if ((dx >= info->var.xres_virtual) ||
+	    (dy >= info->var.yres_virtual))
+		/* Destination Area not within virtual screen, skipping */
+		return;
+	if ((dx + width) >= info->var.xres_virtual)
+		width = info->var.xres_virtual - dx - 1;
+	if ((dy + height) >= info->var.yres_virtual)
+		height = info->var.yres_virtual - dy - 1;
+
+	if ((sx < dx) || (sy < dy)) {
+		rtl = 1 << 27;
+		sx += width - 1;
+		dx += width - 1;
+		sy += height - 1;
+		dy += height - 1;
+	}
+
+	if (sm501fb_sync(info))
+		return;
+
+	/* set the base addresses */
+	writel(par->screen.sm_addr, fbi->regs2d + SM501_2D_SOURCE_BASE);
+	writel(par->screen.sm_addr, fbi->regs2d + SM501_2D_DESTINATION_BASE);
+
+	/* set the window width */
+	writel((info->var.xres << 16) | info->var.xres,
+	       fbi->regs2d + SM501_2D_WINDOW_WIDTH);
+
+	/* set window stride */
+	writel((info->var.xres_virtual << 16) | info->var.xres_virtual,
+	       fbi->regs2d + SM501_2D_PITCH);
+
+	/* set data format */
+	switch (info->var.bits_per_pixel) {
+	case 8:
+		writel(0, fbi->regs2d + SM501_2D_STRETCH);
+		break;
+	case 16:
+		writel(0x00100000, fbi->regs2d + SM501_2D_STRETCH);
+		break;
+	case 32:
+		writel(0x00200000, fbi->regs2d + SM501_2D_STRETCH);
+		break;
+	}
+
+	/* 2d compare mask */
+	writel(0xffffffff, fbi->regs2d + SM501_2D_COLOR_COMPARE_MASK);
+
+	/* 2d mask */
+	writel(0xffffffff, fbi->regs2d + SM501_2D_MASK);
+
+	/* source and destination x y */
+	writel((sx << 16) | sy, fbi->regs2d + SM501_2D_SOURCE);
+	writel((dx << 16) | dy, fbi->regs2d + SM501_2D_DESTINATION);
+
+	/* w/h */
+	writel((width << 16) | height, fbi->regs2d + SM501_2D_DIMENSION);
+
+	/* do area move */
+	writel(0x800000cc | rtl, fbi->regs2d + SM501_2D_CONTROL);
+}
+
+static void sm501fb_fillrect(struct fb_info *info, const struct fb_fillrect *rect)
+{
+	struct sm501fb_par  *par = info->par;
+	struct sm501fb_info *fbi = par->info;
+	int width = rect->width, height = rect->height;
+
+	if ((rect->dx >= info->var.xres_virtual) ||
+	    (rect->dy >= info->var.yres_virtual))
+		/* Rectangle not within virtual screen, skipping */
+		return;
+	if ((rect->dx + width) >= info->var.xres_virtual)
+		width = info->var.xres_virtual - rect->dx - 1;
+	if ((rect->dy + height) >= info->var.yres_virtual)
+		height = info->var.yres_virtual - rect->dy - 1;
+
+	if (sm501fb_sync(info))
+		return;
+
+	/* set the base addresses */
+	writel(par->screen.sm_addr, fbi->regs2d + SM501_2D_SOURCE_BASE);
+	writel(par->screen.sm_addr, fbi->regs2d + SM501_2D_DESTINATION_BASE);
+
+	/* set the window width */
+	writel((info->var.xres << 16) | info->var.xres,
+	       fbi->regs2d + SM501_2D_WINDOW_WIDTH);
+
+	/* set window stride */
+	writel((info->var.xres_virtual << 16) | info->var.xres_virtual,
+	       fbi->regs2d + SM501_2D_PITCH);
+
+	/* set data format */
+	switch (info->var.bits_per_pixel) {
+	case 8:
+		writel(0, fbi->regs2d + SM501_2D_STRETCH);
+		break;
+	case 16:
+		writel(0x00100000, fbi->regs2d + SM501_2D_STRETCH);
+		break;
+	case 32:
+		writel(0x00200000, fbi->regs2d + SM501_2D_STRETCH);
+		break;
+	}
+
+	/* 2d compare mask */
+	writel(0xffffffff, fbi->regs2d + SM501_2D_COLOR_COMPARE_MASK);
+
+	/* 2d mask */
+	writel(0xffffffff, fbi->regs2d + SM501_2D_MASK);
+
+	/* colour */
+	writel(rect->color, fbi->regs2d + SM501_2D_FOREGROUND);
+
+	/* x y */
+	writel((rect->dx << 16) | rect->dy, fbi->regs2d + SM501_2D_DESTINATION);
+
+	/* w/h */
+	writel((width << 16) | height, fbi->regs2d + SM501_2D_DIMENSION);
+
+	/* do rectangle fill */
+	writel(0x800100cc, fbi->regs2d + SM501_2D_CONTROL);
+}
+
 
 static struct fb_ops sm501fb_ops_crt = {
 	.owner		= THIS_MODULE,
@@ -1256,9 +1424,10 @@ static struct fb_ops sm501fb_ops_crt = {
 	.fb_setcolreg	= sm501fb_setcolreg,
 	.fb_pan_display	= sm501fb_pan_crt,
 	.fb_cursor	= sm501fb_cursor,
-	.fb_fillrect	= cfb_fillrect,
-	.fb_copyarea	= cfb_copyarea,
+	.fb_fillrect	= sm501fb_fillrect,
+	.fb_copyarea	= sm501fb_copyarea,
 	.fb_imageblit	= cfb_imageblit,
+	.fb_sync	= sm501fb_sync,
 };
 
 static struct fb_ops sm501fb_ops_pnl = {
@@ -1269,9 +1438,10 @@ static struct fb_ops sm501fb_ops_pnl = {
 	.fb_blank	= sm501fb_blank_pnl,
 	.fb_setcolreg	= sm501fb_setcolreg,
 	.fb_cursor	= sm501fb_cursor,
-	.fb_fillrect	= cfb_fillrect,
-	.fb_copyarea	= cfb_copyarea,
+	.fb_fillrect	= sm501fb_fillrect,
+	.fb_copyarea	= sm501fb_copyarea,
 	.fb_imageblit	= cfb_imageblit,
+	.fb_sync	= sm501fb_sync,
 };
 
 /* sm501_init_cursor
@@ -1329,7 +1499,8 @@ static int sm501fb_start(struct sm501fb_info *info,
 		dev_warn(dev, "no irq for device\n");
 	}
 
-	/* allocate, reserve and remap resources for registers */
+	/* allocate, reserve and remap resources for display
+	 * controller registers */
 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 	if (res == NULL) {
 		dev_err(dev, "no resource definition for registers\n");
@@ -1338,7 +1509,7 @@ static int sm501fb_start(struct sm501fb_info *info,
 	}
 
 	info->regs_res = request_mem_region(res->start,
-					    res->end - res->start,
+					    resource_size(res),
 					    pdev->name);
 
 	if (info->regs_res == NULL) {
@@ -1347,37 +1518,63 @@ static int sm501fb_start(struct sm501fb_info *info,
 		goto err_release;
 	}
 
-	info->regs = ioremap(res->start, (res->end - res->start)+1);
+	info->regs = ioremap(res->start, resource_size(res));
 	if (info->regs == NULL) {
 		dev_err(dev, "cannot remap registers\n");
 		ret = -ENXIO;
 		goto err_regs_res;
 	}
 
+	/* allocate, reserve and remap resources for 2d
+	 * controller registers */
+	res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
+	if (res == NULL) {
+		dev_err(dev, "no resource definition for 2d registers\n");
+		ret = -ENOENT;
+		goto err_regs_map;
+	}
+
+	info->regs2d_res = request_mem_region(res->start,
+					      resource_size(res),
+					      pdev->name);
+
+	if (info->regs2d_res == NULL) {
+		dev_err(dev, "cannot claim registers\n");
+		ret = -ENXIO;
+		goto err_regs_map;
+	}
+
+	info->regs2d = ioremap(res->start, resource_size(res));
+	if (info->regs2d == NULL) {
+		dev_err(dev, "cannot remap registers\n");
+		ret = -ENXIO;
+		goto err_regs2d_res;
+	}
+
 	/* allocate, reserve resources for framebuffer */
 	res = platform_get_resource(pdev, IORESOURCE_MEM, 2);
 	if (res == NULL) {
 		dev_err(dev, "no memory resource defined\n");
 		ret = -ENXIO;
-		goto err_regs_map;
+		goto err_regs2d_map;
 	}
 
 	info->fbmem_res = request_mem_region(res->start,
-					     (res->end - res->start)+1,
+					     resource_size(res),
 					     pdev->name);
 	if (info->fbmem_res == NULL) {
 		dev_err(dev, "cannot claim framebuffer\n");
 		ret = -ENXIO;
-		goto err_regs_map;
+		goto err_regs2d_map;
 	}
 
-	info->fbmem = ioremap(res->start, (res->end - res->start)+1);
+	info->fbmem = ioremap(res->start, resource_size(res));
 	if (info->fbmem == NULL) {
 		dev_err(dev, "cannot remap framebuffer\n");
 		goto err_mem_res;
 	}
 
-	info->fbmem_len = (res->end - res->start)+1;
+	info->fbmem_len = resource_size(res);
 
 	/* clear framebuffer memory - avoids garbage data on unused fb */
 	memset(info->fbmem, 0, info->fbmem_len);
@@ -1389,8 +1586,10 @@ static int sm501fb_start(struct sm501fb_info *info,
 	/* enable display controller */
 	sm501_unit_power(dev->parent, SM501_GATE_DISPLAY, 1);
 
-	/* setup cursors */
+	/* enable 2d controller */
+	sm501_unit_power(dev->parent, SM501_GATE_2D_ENGINE, 1);
 
+	/* setup cursors */
 	sm501_init_cursor(info->fb[HEAD_CRT], SM501_DC_CRT_HWC_ADDR);
 	sm501_init_cursor(info->fb[HEAD_PANEL], SM501_DC_PANEL_HWC_ADDR);
 
@@ -1400,6 +1599,13 @@ static int sm501fb_start(struct sm501fb_info *info,
 	release_resource(info->fbmem_res);
 	kfree(info->fbmem_res);
 
+ err_regs2d_map:
+	iounmap(info->regs2d);
+
+ err_regs2d_res:
+	release_resource(info->regs2d_res);
+	kfree(info->regs2d_res);
+
  err_regs_map:
 	iounmap(info->regs);
 
@@ -1420,6 +1626,10 @@ static void sm501fb_stop(struct sm501fb_info *info)
 	release_resource(info->fbmem_res);
 	kfree(info->fbmem_res);
 
+	iounmap(info->regs2d);
+	release_resource(info->regs2d_res);
+	kfree(info->regs2d_res);
+
 	iounmap(info->regs);
 	release_resource(info->regs_res);
 	kfree(info->regs_res);
@@ -1486,7 +1696,8 @@ static int sm501fb_init_fb(struct fb_info *fb,
 		par->ops.fb_cursor = NULL;
 
 	fb->fbops = &par->ops;
-	fb->flags = FBINFO_FLAG_DEFAULT |
+	fb->flags = FBINFO_FLAG_DEFAULT | FBINFO_READS_FAST |
+		FBINFO_HWACCEL_COPYAREA | FBINFO_HWACCEL_FILLRECT |
 		FBINFO_HWACCEL_XPAN | FBINFO_HWACCEL_YPAN;
 
 	/* fixed data */
diff --git a/drivers/video/stifb.c b/drivers/video/stifb.c
index 6120f0c526fe..876648e15e9d 100644
--- a/drivers/video/stifb.c
+++ b/drivers/video/stifb.c
@@ -756,9 +756,9 @@ hyperResetPlanes(struct stifb_info *fb, int enable)
 		if (fb->info.var.bits_per_pixel == 32)
 			controlPlaneReg = 0x04000F00;
 		else
-			controlPlaneReg = 0x00000F00;   /* 0x00000800 should be enought, but lets clear all 4 bits */
+			controlPlaneReg = 0x00000F00;   /* 0x00000800 should be enough, but lets clear all 4 bits */
 	else
-		controlPlaneReg = 0x00000F00; /* 0x00000100 should be enought, but lets clear all 4 bits */
+		controlPlaneReg = 0x00000F00; /* 0x00000100 should be enough, but lets clear all 4 bits */
 
 	switch (enable) {
 	case ENABLE:
diff --git a/drivers/video/tdfxfb.c b/drivers/video/tdfxfb.c
index ff43c8885028..980548390048 100644
--- a/drivers/video/tdfxfb.c
+++ b/drivers/video/tdfxfb.c
@@ -52,7 +52,7 @@
  *
  * 0.1.3 (released 1999-11-02)	added Attila's panning support, code
  *				reorg, hwcursor address page size alignment
- *				(for mmaping both frame buffer and regs),
+ *				(for mmapping both frame buffer and regs),
  *				and my changes to get rid of hardcoded
  *				VGA i/o register locations (uses PCI
  *				configuration info now)
diff --git a/drivers/video/via/accel.c b/drivers/video/via/accel.c
index 9d4f3a49ba4a..d5077dfa9e00 100644
--- a/drivers/video/via/accel.c
+++ b/drivers/video/via/accel.c
@@ -137,7 +137,7 @@ static int hw_bitblt_1(void __iomem *engine, u8 op, u32 width, u32 height,
 			tmp, dst_pitch);
 		return -EINVAL;
 	}
-	tmp = (tmp >> 3) | (dst_pitch << (16 - 3));
+	tmp = VIA_PITCH_ENABLE | (tmp >> 3) | (dst_pitch << (16 - 3));
 	writel(tmp, engine + 0x38);
 
 	if (op == VIA_BITBLT_FILL)
@@ -352,6 +352,9 @@ int viafb_init_engine(struct fb_info *info)
 	viapar->shared->vq_vram_addr = viapar->fbmem_free;
 	viapar->fbmem_used += VQ_SIZE;
 
+	/* Init 2D engine reg to reset 2D engine */
+	writel(0x0, engine + VIA_REG_KEYCONTROL);
+
 	/* Init AGP and VQ regs */
 	switch (chip_name) {
 	case UNICHROME_K8M890:
diff --git a/drivers/video/via/dvi.c b/drivers/video/via/dvi.c
index c5c32b6b6e6c..67b36932212b 100644
--- a/drivers/video/via/dvi.c
+++ b/drivers/video/via/dvi.c
@@ -467,7 +467,7 @@ static int dvi_get_panel_size_from_DDCv1(void)
 	default:
 		viaparinfo->tmds_setting_info->dvi_panel_size =
 			VIA_RES_1024X768;
-		DEBUG_MSG(KERN_INFO "Unknow panel size max resolution = %d !\
+		DEBUG_MSG(KERN_INFO "Unknown panel size max resolution = %d !\
 					 set default panel size.\n", max_h);
 		break;
 	}
@@ -534,7 +534,7 @@ static int dvi_get_panel_size_from_DDCv2(void)
 	default:
 		viaparinfo->tmds_setting_info->dvi_panel_size =
 			VIA_RES_1024X768;
-		DEBUG_MSG(KERN_INFO "Unknow panel size max resolution = %d!\
+		DEBUG_MSG(KERN_INFO "Unknown panel size max resolution = %d!\
 					set default panel size.\n", HSize);
 		break;
 	}
diff --git a/drivers/video/via/lcd.c b/drivers/video/via/lcd.c
index e3e597f937a5..09353e2b92f6 100644
--- a/drivers/video/via/lcd.c
+++ b/drivers/video/via/lcd.c
@@ -1134,45 +1134,33 @@ static void integrated_lvds_enable(struct lvds_setting_information
 			    *plvds_setting_info,
 			    struct lvds_chip_information *plvds_chip_info)
 {
-	bool turn_on_first_powersequence = false;
-	bool turn_on_second_powersequence = false;
-
 	DEBUG_MSG(KERN_INFO "integrated_lvds_enable, out_interface:%d\n",
 		  plvds_chip_info->output_interface);
 	if (plvds_setting_info->lcd_mode == LCD_SPWG)
 		viafb_write_reg_mask(CRD2, VIACR, 0x00, BIT0 + BIT1);
-	 else
+	else
 		viafb_write_reg_mask(CRD2, VIACR, 0x03, BIT0 + BIT1);
-	if (INTERFACE_LVDS0LVDS1 == plvds_chip_info->output_interface)
-		turn_on_first_powersequence = true;
-	if (INTERFACE_LVDS0 == plvds_chip_info->output_interface)
-		turn_on_first_powersequence = true;
-	if (INTERFACE_LVDS1 == plvds_chip_info->output_interface)
-		turn_on_second_powersequence = true;
-
-	if (turn_on_second_powersequence) {
-		/* Use second power sequence control: */
-
-		/* Use hardware control power sequence. */
-		viafb_write_reg_mask(CRD3, VIACR, 0, BIT0);
-
-		/* Turn on back light. */
-		viafb_write_reg_mask(CRD3, VIACR, 0, BIT6 + BIT7);
 
-		/* Turn on hardware power sequence. */
-		viafb_write_reg_mask(CRD4, VIACR, 0x02, BIT1);
-	}
-	if (turn_on_first_powersequence) {
+	switch (plvds_chip_info->output_interface) {
+	case INTERFACE_LVDS0LVDS1:
+	case INTERFACE_LVDS0:
 		/* Use first power sequence control: */
-
 		/* Use hardware control power sequence. */
 		viafb_write_reg_mask(CR91, VIACR, 0, BIT0);
-
 		/* Turn on back light. */
 		viafb_write_reg_mask(CR91, VIACR, 0, BIT6 + BIT7);
-
 		/* Turn on hardware power sequence. */
 		viafb_write_reg_mask(CR6A, VIACR, 0x08, BIT3);
+		break;
+	case INTERFACE_LVDS1:
+		/* Use second power sequence control: */
+		/* Use hardware control power sequence. */
+		viafb_write_reg_mask(CRD3, VIACR, 0, BIT0);
+		/* Turn on back light. */
+		viafb_write_reg_mask(CRD3, VIACR, 0, BIT6 + BIT7);
+		/* Turn on hardware power sequence. */
+		viafb_write_reg_mask(CRD4, VIACR, 0x02, BIT1);
+		break;
 	}
 
 	/* Turn DFP High/Low pad on. */
diff --git a/drivers/video/via/viafbdev.c b/drivers/video/via/viafbdev.c
index 56ec696e8afa..3028e7ddc3b5 100644
--- a/drivers/video/via/viafbdev.c
+++ b/drivers/video/via/viafbdev.c
@@ -177,16 +177,15 @@ static int viafb_set_par(struct fb_info *info)
 	}
 
 	if (vmode_index != VIA_RES_INVALID) {
-		viafb_setmode(vmode_index, info->var.xres, info->var.yres,
-			info->var.bits_per_pixel, vmode_index1,
-			viafb_second_xres, viafb_second_yres, viafb_bpp1);
-
 		viafb_update_fix(info);
 		viafb_bpp = info->var.bits_per_pixel;
 		if (info->var.accel_flags & FB_ACCELF_TEXT)
 			info->flags &= ~FBINFO_HWACCEL_DISABLED;
 		else
 			info->flags |= FBINFO_HWACCEL_DISABLED;
+		viafb_setmode(vmode_index, info->var.xres, info->var.yres,
+			info->var.bits_per_pixel, vmode_index1,
+			viafb_second_xres, viafb_second_yres, viafb_bpp1);
 	}
 
 	return 0;
@@ -680,7 +679,7 @@ static int viafb_ioctl(struct fb_info *info, u_int cmd, u_long arg)
 		if (!viafb_gamma_table)
 			return -ENOMEM;
 		if (copy_from_user(viafb_gamma_table, argp,
-				sizeof(viafb_gamma_table))) {
+				256 * sizeof(u32))) {
 			kfree(viafb_gamma_table);
 			return -EFAULT;
 		}
@@ -694,7 +693,7 @@ static int viafb_ioctl(struct fb_info *info, u_int cmd, u_long arg)
 			return -ENOMEM;
 		viafb_get_gamma_table(viafb_gamma_table);
 		if (copy_to_user(argp, viafb_gamma_table,
-			sizeof(viafb_gamma_table))) {
+			256 * sizeof(u32))) {
 			kfree(viafb_gamma_table);
 			return -EFAULT;
 		}
@@ -872,7 +871,9 @@ static int viafb_cursor(struct fb_info *info, struct fb_cursor *cursor)
 	if (info->flags & FBINFO_HWACCEL_DISABLED || info != viafbinfo)
 		return -ENODEV;
 
-	if (chip_name == UNICHROME_CLE266 && viapar->iga_path == IGA2)
+	/* LCD ouput does not support hw cursors (at least on VN896) */
+	if ((chip_name == UNICHROME_CLE266 && viapar->iga_path == IGA2) ||
+		viafb_LCD_ON)
 		return -ENODEV;
 
 	viafb_show_hw_cursor(info, HW_Cursor_OFF);
@@ -1797,7 +1798,7 @@ static const struct file_operations viafb_vt1636_proc_fops = {
 static void viafb_init_proc(struct proc_dir_entry **viafb_entry)
 {
 	*viafb_entry = proc_mkdir("viafb", NULL);
-	if (viafb_entry) {
+	if (*viafb_entry) {
 		proc_create("dvp0", 0, *viafb_entry, &viafb_dvp0_proc_fops);
 		proc_create("dvp1", 0, *viafb_entry, &viafb_dvp1_proc_fops);
 		proc_create("dfph", 0, *viafb_entry, &viafb_dfph_proc_fops);
diff --git a/drivers/video/vt8623fb.c b/drivers/video/vt8623fb.c
index 3df17dc8c3d7..65ccd215d496 100644
--- a/drivers/video/vt8623fb.c
+++ b/drivers/video/vt8623fb.c
@@ -446,7 +446,7 @@ static int vt8623fb_set_par(struct fb_info *info)
 
 	svga_wseq_mask(0x1E, 0xF0, 0xF0); // DI/DVP bus
 	svga_wseq_mask(0x2A, 0x0F, 0x0F); // DI/DVP bus
-	svga_wseq_mask(0x16, 0x08, 0xBF); // FIFO read treshold
+	svga_wseq_mask(0x16, 0x08, 0xBF); // FIFO read threshold
 	vga_wseq(NULL, 0x17, 0x1F);       // FIFO depth
 	vga_wseq(NULL, 0x18, 0x4E);
 	svga_wseq_mask(0x1A, 0x08, 0x08); // enable MMIO ?
diff --git a/drivers/video/xen-fbfront.c b/drivers/video/xen-fbfront.c
index 54cd91610174..603598f4dbb1 100644
--- a/drivers/video/xen-fbfront.c
+++ b/drivers/video/xen-fbfront.c
@@ -25,7 +25,10 @@
 #include <linux/module.h>
 #include <linux/vmalloc.h>
 #include <linux/mm.h>
+
 #include <asm/xen/hypervisor.h>
+
+#include <xen/xen.h>
 #include <xen/events.h>
 #include <xen/page.h>
 #include <xen/interface/io/fbif.h>
@@ -440,7 +443,7 @@ static int __devinit xenfb_probe(struct xenbus_device *dev,
 	fb_info->fix.type = FB_TYPE_PACKED_PIXELS;
 	fb_info->fix.accel = FB_ACCEL_NONE;
 
-	fb_info->flags = FBINFO_FLAG_DEFAULT;
+	fb_info->flags = FBINFO_FLAG_DEFAULT | FBINFO_VIRTFB;
 
 	ret = fb_alloc_cmap(&fb_info->cmap, 256, 0);
 	if (ret < 0) {
diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index 9dd588042880..505be88c82ae 100644
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -266,7 +266,7 @@ static void __devexit virtballoon_remove(struct virtio_device *vdev)
 
 static unsigned int features[] = { VIRTIO_BALLOON_F_MUST_TELL_HOST };
 
-static struct virtio_driver virtio_balloon = {
+static struct virtio_driver virtio_balloon_driver = {
 	.feature_table = features,
 	.feature_table_size = ARRAY_SIZE(features),
 	.driver.name =	KBUILD_MODNAME,
@@ -279,12 +279,12 @@ static struct virtio_driver virtio_balloon = {
 
 static int __init init(void)
 {
-	return register_virtio_driver(&virtio_balloon);
+	return register_virtio_driver(&virtio_balloon_driver);
 }
 
 static void __exit fini(void)
 {
-	unregister_virtio_driver(&virtio_balloon);
+	unregister_virtio_driver(&virtio_balloon_driver);
 }
 module_init(init);
 module_exit(fini);
diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
index 3711b888d482..088f32f29a6e 100644
--- a/drivers/watchdog/Kconfig
+++ b/drivers/watchdog/Kconfig
@@ -368,7 +368,7 @@ config ALIM7101_WDT
 
 config GEODE_WDT
 	tristate "AMD Geode CS5535/CS5536 Watchdog"
-	depends on MGEODE_LX
+	depends on CS5535_MFGPT
 	help
 	  This driver enables a watchdog capability built into the
 	  CS5535/CS5536 companion chips for the AMD Geode GX and LX
@@ -815,16 +815,6 @@ config PNX833X_WDT
 	  timer has expired and no process has written to /dev/watchdog during
 	  that time.
 
-config WDT_RM9K_GPI
-	tristate "RM9000/GPI hardware watchdog"
-	depends on CPU_RM9000
-	help
-	  Watchdog implementation using the GPI hardware found on
-	  PMC-Sierra RM9xxx CPUs.
-
-	  To compile this driver as a module, choose M here: the
-	  module will be called rm9k_wdt.
-
 config SIBYTE_WDOG
 	tristate "Sibyte SoC hardware watchdog"
 	depends on CPU_SB1
@@ -861,8 +851,10 @@ config GEF_WDT
 	  Watchdog timer found in a number of GE Fanuc single board computers.
 
 config MPC5200_WDT
-	tristate "MPC5200 Watchdog Timer"
+	bool "MPC52xx Watchdog Timer"
 	depends on PPC_MPC52xx
+	help
+	  Use General Purpose Timer (GPT) 0 on the MPC5200 as Watchdog.
 
 config 8xxx_WDT
 	tristate "MPC8xxx Platform Watchdog Timer"
diff --git a/drivers/watchdog/Makefile b/drivers/watchdog/Makefile
index 699199b1baa6..475c61100069 100644
--- a/drivers/watchdog/Makefile
+++ b/drivers/watchdog/Makefile
@@ -109,7 +109,6 @@ obj-$(CONFIG_RC32434_WDT) += rc32434_wdt.o
 obj-$(CONFIG_INDYDOG) += indydog.o
 obj-$(CONFIG_WDT_MTX1) += mtx-1_wdt.o
 obj-$(CONFIG_PNX833X_WDT) += pnx833x_wdt.o
-obj-$(CONFIG_WDT_RM9K_GPI) += rm9k_wdt.o
 obj-$(CONFIG_SIBYTE_WDOG) += sb_wdog.o
 obj-$(CONFIG_AR7_WDT) += ar7_wdt.o
 obj-$(CONFIG_TXX9_WDT) += txx9wdt.o
@@ -118,7 +117,6 @@ obj-$(CONFIG_TXX9_WDT) += txx9wdt.o
 
 # POWERPC Architecture
 obj-$(CONFIG_GEF_WDT) += gef_wdt.o
-obj-$(CONFIG_MPC5200_WDT) += mpc5200_wdt.o
 obj-$(CONFIG_8xxx_WDT) += mpc8xxx_wdt.o
 obj-$(CONFIG_MV64X60_WDT) += mv64x60_wdt.o
 obj-$(CONFIG_PIKA_WDT) += pika_wdt.o
diff --git a/drivers/watchdog/adx_wdt.c b/drivers/watchdog/adx_wdt.c
index 77afb0acc500..9d7d155364f8 100644
--- a/drivers/watchdog/adx_wdt.c
+++ b/drivers/watchdog/adx_wdt.c
@@ -242,14 +242,14 @@ static int __devinit adx_wdt_probe(struct platform_device *pdev)
 	}
 
 	res = devm_request_mem_region(&pdev->dev, res->start,
-			res->end - res->start + 1, res->name);
+			resource_size(res), res->name);
 	if (!res) {
 		dev_err(&pdev->dev, "cannot request I/O memory region\n");
 		return -ENXIO;
 	}
 
 	wdt->base = devm_ioremap_nocache(&pdev->dev, res->start,
-			res->end - res->start + 1);
+			resource_size(res));
 	if (!wdt->base) {
 		dev_err(&pdev->dev, "cannot remap I/O memory region\n");
 		return -ENXIO;
@@ -314,7 +314,7 @@ static int adx_wdt_resume(struct device *dev)
 	return 0;
 }
 
-static struct dev_pm_ops adx_wdt_pm_ops = {
+static const struct dev_pm_ops adx_wdt_pm_ops = {
 	.suspend = adx_wdt_suspend,
 	.resume = adx_wdt_resume,
 };
diff --git a/drivers/watchdog/at32ap700x_wdt.c b/drivers/watchdog/at32ap700x_wdt.c
index e8ae638e5804..037847923dcb 100644
--- a/drivers/watchdog/at32ap700x_wdt.c
+++ b/drivers/watchdog/at32ap700x_wdt.c
@@ -326,7 +326,7 @@ static int __init at32_wdt_probe(struct platform_device *pdev)
 		return -ENOMEM;
 	}
 
-	wdt->regs = ioremap(regs->start, regs->end - regs->start + 1);
+	wdt->regs = ioremap(regs->start, resource_size(regs));
 	if (!wdt->regs) {
 		ret = -ENOMEM;
 		dev_dbg(&pdev->dev, "could not map I/O memory\n");
diff --git a/drivers/watchdog/coh901327_wdt.c b/drivers/watchdog/coh901327_wdt.c
index 381026c0bd7b..923cc68dba26 100644
--- a/drivers/watchdog/coh901327_wdt.c
+++ b/drivers/watchdog/coh901327_wdt.c
@@ -508,7 +508,7 @@ void coh901327_watchdog_reset(void)
 	 * deactivating the watchdog before it is shut down by it.
 	 *
 	 * NOTE: on future versions of the watchdog, this restriction is
-	 * gone: the watchdog will be reloaded with a defaul value (1 min)
+	 * gone: the watchdog will be reloaded with a default value (1 min)
 	 * instead of last value, and you can conveniently set the watchdog
 	 * timeout to 10ms (value = 1) without any problems.
 	 */
diff --git a/drivers/watchdog/davinci_wdt.c b/drivers/watchdog/davinci_wdt.c
index 9d7520fa9e9c..887136de1857 100644
--- a/drivers/watchdog/davinci_wdt.c
+++ b/drivers/watchdog/davinci_wdt.c
@@ -221,7 +221,7 @@ static int __devinit davinci_wdt_probe(struct platform_device *pdev)
 		return -ENOENT;
 	}
 
-	size = res->end - res->start + 1;
+	size = resource_size(res);
 	wdt_mem = request_mem_region(res->start, size, pdev->name);
 
 	if (wdt_mem == NULL) {
diff --git a/drivers/watchdog/geodewdt.c b/drivers/watchdog/geodewdt.c
index 9acf0015a1e7..38252ff828ca 100644
--- a/drivers/watchdog/geodewdt.c
+++ b/drivers/watchdog/geodewdt.c
@@ -1,6 +1,7 @@
-/* Watchdog timer for the Geode GX/LX with the CS5535/CS5536 companion chip
+/* Watchdog timer for machines with the CS5535/CS5536 companion chip
  *
  * Copyright (C) 2006-2007, Advanced Micro Devices, Inc.
+ * Copyright (C) 2009  Andres Salomon <dilinger@collabora.co.uk>
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
@@ -19,7 +20,7 @@
 #include <linux/reboot.h>
 #include <linux/uaccess.h>
 
-#include <asm/geode.h>
+#include <linux/cs5535.h>
 
 #define GEODEWDT_HZ 500
 #define GEODEWDT_SCALE 6
@@ -46,25 +47,25 @@ MODULE_PARM_DESC(nowayout,
 
 static struct platform_device *geodewdt_platform_device;
 static unsigned long wdt_flags;
-static int wdt_timer;
+static struct cs5535_mfgpt_timer *wdt_timer;
 static int safe_close;
 
 static void geodewdt_ping(void)
 {
 	/* Stop the counter */
-	geode_mfgpt_write(wdt_timer, MFGPT_REG_SETUP, 0);
+	cs5535_mfgpt_write(wdt_timer, MFGPT_REG_SETUP, 0);
 
 	/* Reset the counter */
-	geode_mfgpt_write(wdt_timer, MFGPT_REG_COUNTER, 0);
+	cs5535_mfgpt_write(wdt_timer, MFGPT_REG_COUNTER, 0);
 
 	/* Enable the counter */
-	geode_mfgpt_write(wdt_timer, MFGPT_REG_SETUP, MFGPT_SETUP_CNTEN);
+	cs5535_mfgpt_write(wdt_timer, MFGPT_REG_SETUP, MFGPT_SETUP_CNTEN);
 }
 
 static void geodewdt_disable(void)
 {
-	geode_mfgpt_write(wdt_timer, MFGPT_REG_SETUP, 0);
-	geode_mfgpt_write(wdt_timer, MFGPT_REG_COUNTER, 0);
+	cs5535_mfgpt_write(wdt_timer, MFGPT_REG_SETUP, 0);
+	cs5535_mfgpt_write(wdt_timer, MFGPT_REG_COUNTER, 0);
 }
 
 static int geodewdt_set_heartbeat(int val)
@@ -72,10 +73,10 @@ static int geodewdt_set_heartbeat(int val)
 	if (val < 1 || val > GEODEWDT_MAX_SECONDS)
 		return -EINVAL;
 
-	geode_mfgpt_write(wdt_timer, MFGPT_REG_SETUP, 0);
-	geode_mfgpt_write(wdt_timer, MFGPT_REG_CMP2, val * GEODEWDT_HZ);
-	geode_mfgpt_write(wdt_timer, MFGPT_REG_COUNTER, 0);
-	geode_mfgpt_write(wdt_timer, MFGPT_REG_SETUP, MFGPT_SETUP_CNTEN);
+	cs5535_mfgpt_write(wdt_timer, MFGPT_REG_SETUP, 0);
+	cs5535_mfgpt_write(wdt_timer, MFGPT_REG_CMP2, val * GEODEWDT_HZ);
+	cs5535_mfgpt_write(wdt_timer, MFGPT_REG_COUNTER, 0);
+	cs5535_mfgpt_write(wdt_timer, MFGPT_REG_SETUP, MFGPT_SETUP_CNTEN);
 
 	timeout = val;
 	return 0;
@@ -215,28 +216,25 @@ static struct miscdevice geodewdt_miscdev = {
 
 static int __devinit geodewdt_probe(struct platform_device *dev)
 {
-	int ret, timer;
-
-	timer = geode_mfgpt_alloc_timer(MFGPT_TIMER_ANY, MFGPT_DOMAIN_WORKING);
+	int ret;
 
-	if (timer == -1) {
+	wdt_timer = cs5535_mfgpt_alloc_timer(MFGPT_TIMER_ANY, MFGPT_DOMAIN_WORKING);
+	if (!wdt_timer) {
 		printk(KERN_ERR "geodewdt:  No timers were available\n");
 		return -ENODEV;
 	}
 
-	wdt_timer = timer;
-
 	/* Set up the timer */
 
-	geode_mfgpt_write(wdt_timer, MFGPT_REG_SETUP,
+	cs5535_mfgpt_write(wdt_timer, MFGPT_REG_SETUP,
 			  GEODEWDT_SCALE | (3 << 8));
 
 	/* Set up comparator 2 to reset when the event fires */
-	geode_mfgpt_toggle_event(wdt_timer, MFGPT_CMP2, MFGPT_EVENT_RESET, 1);
+	cs5535_mfgpt_toggle_event(wdt_timer, MFGPT_CMP2, MFGPT_EVENT_RESET, 1);
 
 	/* Set up the initial timeout */
 
-	geode_mfgpt_write(wdt_timer, MFGPT_REG_CMP2,
+	cs5535_mfgpt_write(wdt_timer, MFGPT_REG_CMP2,
 		timeout * GEODEWDT_HZ);
 
 	ret = misc_register(&geodewdt_miscdev);
diff --git a/drivers/watchdog/iTCO_wdt.c b/drivers/watchdog/iTCO_wdt.c
index 6a51edde6ea7..4bdb7f1a9077 100644
--- a/drivers/watchdog/iTCO_wdt.c
+++ b/drivers/watchdog/iTCO_wdt.c
@@ -1,5 +1,5 @@
 /*
- *	intel TCO Watchdog Driver (Used in i82801 and i63xxESB chipsets)
+ *	intel TCO Watchdog Driver
  *
  *	(c) Copyright 2006-2009 Wim Van Sebroeck <wim@iguana.be>.
  *
@@ -14,47 +14,24 @@
  *
  *	The TCO watchdog is implemented in the following I/O controller hubs:
  *	(See the intel documentation on http://developer.intel.com.)
- *	82801AA  (ICH)       : document number 290655-003, 290677-014,
- *	82801AB  (ICHO)      : document number 290655-003, 290677-014,
- *	82801BA  (ICH2)      : document number 290687-002, 298242-027,
- *	82801BAM (ICH2-M)    : document number 290687-002, 298242-027,
- *	82801CA  (ICH3-S)    : document number 290733-003, 290739-013,
- *	82801CAM (ICH3-M)    : document number 290716-001, 290718-007,
- *	82801DB  (ICH4)      : document number 290744-001, 290745-025,
- *	82801DBM (ICH4-M)    : document number 252337-001, 252663-008,
- *	82801E   (C-ICH)     : document number 273599-001, 273645-002,
- *	82801EB  (ICH5)      : document number 252516-001, 252517-028,
- *	82801ER  (ICH5R)     : document number 252516-001, 252517-028,
- *	6300ESB  (6300ESB)   : document number 300641-004, 300884-013,
- *	82801FB  (ICH6)      : document number 301473-002, 301474-026,
- *	82801FR  (ICH6R)     : document number 301473-002, 301474-026,
- *	82801FBM (ICH6-M)    : document number 301473-002, 301474-026,
- *	82801FW  (ICH6W)     : document number 301473-001, 301474-026,
- *	82801FRW (ICH6RW)    : document number 301473-001, 301474-026,
- *	631xESB  (631xESB)   : document number 313082-001, 313075-006,
- *	632xESB  (632xESB)   : document number 313082-001, 313075-006,
- *	82801GB  (ICH7)      : document number 307013-003, 307014-024,
- *	82801GR  (ICH7R)     : document number 307013-003, 307014-024,
- *	82801GDH (ICH7DH)    : document number 307013-003, 307014-024,
- *	82801GBM (ICH7-M)    : document number 307013-003, 307014-024,
- *	82801GHM (ICH7-M DH) : document number 307013-003, 307014-024,
- *	82801GU  (ICH7-U)    : document number 307013-003, 307014-024,
- *	82801HB  (ICH8)      : document number 313056-003, 313057-017,
- *	82801HR  (ICH8R)     : document number 313056-003, 313057-017,
- *	82801HBM (ICH8M)     : document number 313056-003, 313057-017,
- *	82801HH  (ICH8DH)    : document number 313056-003, 313057-017,
- *	82801HO  (ICH8DO)    : document number 313056-003, 313057-017,
- *	82801HEM (ICH8M-E)   : document number 313056-003, 313057-017,
- *	82801IB  (ICH9)      : document number 316972-004, 316973-012,
- *	82801IR  (ICH9R)     : document number 316972-004, 316973-012,
- *	82801IH  (ICH9DH)    : document number 316972-004, 316973-012,
- *	82801IO  (ICH9DO)    : document number 316972-004, 316973-012,
- *	82801IBM (ICH9M)     : document number 316972-004, 316973-012,
- *	82801IEM (ICH9M-E)   : document number 316972-004, 316973-012,
- *	82801JIB (ICH10)     : document number 319973-002, 319974-002,
- *	82801JIR (ICH10R)    : document number 319973-002, 319974-002,
- *	82801JD  (ICH10D)    : document number 319973-002, 319974-002,
- *	82801JDO (ICH10DO)   : document number 319973-002, 319974-002
+ *	document number 290655-003, 290677-014: 82801AA (ICH), 82801AB (ICHO)
+ *	document number 290687-002, 298242-027: 82801BA (ICH2)
+ *	document number 290733-003, 290739-013: 82801CA (ICH3-S)
+ *	document number 290716-001, 290718-007: 82801CAM (ICH3-M)
+ *	document number 290744-001, 290745-025: 82801DB (ICH4)
+ *	document number 252337-001, 252663-008: 82801DBM (ICH4-M)
+ *	document number 273599-001, 273645-002: 82801E (C-ICH)
+ *	document number 252516-001, 252517-028: 82801EB (ICH5), 82801ER (ICH5R)
+ *	document number 300641-004, 300884-013: 6300ESB
+ *	document number 301473-002, 301474-026: 82801F (ICH6)
+ *	document number 313082-001, 313075-006: 631xESB, 632xESB
+ *	document number 307013-003, 307014-024: 82801G (ICH7)
+ *	document number 313056-003, 313057-017: 82801H (ICH8)
+ *	document number 316972-004, 316973-012: 82801I (ICH9)
+ *	document number 319973-002, 319974-002: 82801J (ICH10)
+ *	document number 322169-001, 322170-003: 5 Series, 3400 Series (PCH)
+ *	document number 320066-003, 320257-008: EP80597 (IICH)
+ *	document number TBD                   : Cougar Point (CPT)
  */
 
 /*
@@ -122,6 +99,24 @@ enum iTCO_chipsets {
 	TCO_ICH10R,	/* ICH10R */
 	TCO_ICH10D,	/* ICH10D */
 	TCO_ICH10DO,	/* ICH10DO */
+	TCO_PCH,	/* PCH Desktop Full Featured */
+	TCO_PCHM,	/* PCH Mobile Full Featured */
+	TCO_P55,	/* P55 */
+	TCO_PM55,	/* PM55 */
+	TCO_H55,	/* H55 */
+	TCO_QM57,	/* QM57 */
+	TCO_H57,	/* H57 */
+	TCO_HM55,	/* HM55 */
+	TCO_Q57,	/* Q57 */
+	TCO_HM57,	/* HM57 */
+	TCO_PCHMSFF,	/* PCH Mobile SFF Full Featured */
+	TCO_QS57,	/* QS57 */
+	TCO_3400,	/* 3400 */
+	TCO_3420,	/* 3420 */
+	TCO_3450,	/* 3450 */
+	TCO_EP80579,	/* EP80579 */
+	TCO_CPTD,	/* CPT Desktop */
+	TCO_CPTM,	/* CPT Mobile */
 };
 
 static struct {
@@ -162,6 +157,24 @@ static struct {
 	{"ICH10R", 2},
 	{"ICH10D", 2},
 	{"ICH10DO", 2},
+	{"PCH Desktop Full Featured", 2},
+	{"PCH Mobile Full Featured", 2},
+	{"P55", 2},
+	{"PM55", 2},
+	{"H55", 2},
+	{"QM57", 2},
+	{"H57", 2},
+	{"HM55", 2},
+	{"Q57", 2},
+	{"HM57", 2},
+	{"PCH Mobile SFF Full Featured", 2},
+	{"QS57", 2},
+	{"3400", 2},
+	{"3420", 2},
+	{"3450", 2},
+	{"EP80579", 2},
+	{"CPT Desktop", 2},
+	{"CPT Mobile", 2},
 	{NULL, 0}
 };
 
@@ -230,6 +243,24 @@ static struct pci_device_id iTCO_wdt_pci_tbl[] = {
 	{ ITCO_PCI_DEVICE(0x3a16,				TCO_ICH10R)},
 	{ ITCO_PCI_DEVICE(0x3a1a,				TCO_ICH10D)},
 	{ ITCO_PCI_DEVICE(0x3a14,				TCO_ICH10DO)},
+	{ ITCO_PCI_DEVICE(0x3b00,				TCO_PCH)},
+	{ ITCO_PCI_DEVICE(0x3b01,				TCO_PCHM)},
+	{ ITCO_PCI_DEVICE(0x3b02,				TCO_P55)},
+	{ ITCO_PCI_DEVICE(0x3b03,				TCO_PM55)},
+	{ ITCO_PCI_DEVICE(0x3b06,				TCO_H55)},
+	{ ITCO_PCI_DEVICE(0x3b07,				TCO_QM57)},
+	{ ITCO_PCI_DEVICE(0x3b08,				TCO_H57)},
+	{ ITCO_PCI_DEVICE(0x3b09,				TCO_HM55)},
+	{ ITCO_PCI_DEVICE(0x3b0a,				TCO_Q57)},
+	{ ITCO_PCI_DEVICE(0x3b0b,				TCO_HM57)},
+	{ ITCO_PCI_DEVICE(0x3b0d,				TCO_PCHMSFF)},
+	{ ITCO_PCI_DEVICE(0x3b0f,				TCO_QS57)},
+	{ ITCO_PCI_DEVICE(0x3b12,				TCO_3400)},
+	{ ITCO_PCI_DEVICE(0x3b14,				TCO_3420)},
+	{ ITCO_PCI_DEVICE(0x3b16,				TCO_3450)},
+	{ ITCO_PCI_DEVICE(0x5031,				TCO_EP80579)},
+	{ ITCO_PCI_DEVICE(0x1c42,				TCO_CPTD)},
+	{ ITCO_PCI_DEVICE(0x1c43,				TCO_CPTM)},
 	{ 0, },			/* End of list */
 };
 MODULE_DEVICE_TABLE(pci, iTCO_wdt_pci_tbl);
diff --git a/drivers/watchdog/machzwd.c b/drivers/watchdog/machzwd.c
index b6b3f59ab446..47d719717a3b 100644
--- a/drivers/watchdog/machzwd.c
+++ b/drivers/watchdog/machzwd.c
@@ -21,7 +21,7 @@
  *      wd#1 - 2 seconds;
  *      wd#2 - 7.2 ms;
  *  After the expiration of wd#1, it can generate a NMI, SCI, SMI, or
- *  a system RESET and it starts wd#2 that unconditionaly will RESET
+ *  a system RESET and it starts wd#2 that unconditionally will RESET
  *  the system when the counter reaches zero.
  *
  *  14-Dec-2001 Matt Domsch <Matt_Domsch@dell.com>
diff --git a/drivers/watchdog/mpc5200_wdt.c b/drivers/watchdog/mpc5200_wdt.c
deleted file mode 100644
index fa9c47ce0ae7..000000000000
--- a/drivers/watchdog/mpc5200_wdt.c
+++ /dev/null
@@ -1,293 +0,0 @@
-#include <linux/init.h>
-#include <linux/module.h>
-#include <linux/miscdevice.h>
-#include <linux/watchdog.h>
-#include <linux/io.h>
-#include <linux/spinlock.h>
-#include <linux/of_platform.h>
-#include <linux/uaccess.h>
-#include <asm/mpc52xx.h>
-
-
-#define GPT_MODE_WDT		(1 << 15)
-#define GPT_MODE_CE		(1 << 12)
-#define GPT_MODE_MS_TIMER	(0x4)
-
-
-struct mpc5200_wdt {
-	unsigned count;	/* timer ticks before watchdog kicks in */
-	long ipb_freq;
-	struct miscdevice miscdev;
-	struct resource mem;
-	struct mpc52xx_gpt __iomem *regs;
-	spinlock_t io_lock;
-};
-
-/* is_active stores wether or not the /dev/watchdog device is opened */
-static unsigned long is_active;
-
-/* misc devices don't provide a way, to get back to 'dev' or 'miscdev' from
- * file operations, which sucks. But there can be max 1 watchdog anyway, so...
- */
-static struct mpc5200_wdt *wdt_global;
-
-
-/* helper to calculate timeout in timer counts */
-static void mpc5200_wdt_set_timeout(struct mpc5200_wdt *wdt, int timeout)
-{
-	/* use biggest prescaler of 64k */
-	wdt->count = (wdt->ipb_freq + 0xffff) / 0x10000 * timeout;
-
-	if (wdt->count > 0xffff)
-		wdt->count = 0xffff;
-}
-/* return timeout in seconds (calculated from timer count) */
-static int mpc5200_wdt_get_timeout(struct mpc5200_wdt *wdt)
-{
-	return wdt->count * 0x10000 / wdt->ipb_freq;
-}
-
-
-/* watchdog operations */
-static int mpc5200_wdt_start(struct mpc5200_wdt *wdt)
-{
-	spin_lock(&wdt->io_lock);
-	/* disable */
-	out_be32(&wdt->regs->mode, 0);
-	/* set timeout, with maximum prescaler */
-	out_be32(&wdt->regs->count, 0x0 | wdt->count);
-	/* enable watchdog */
-	out_be32(&wdt->regs->mode, GPT_MODE_CE | GPT_MODE_WDT |
-						GPT_MODE_MS_TIMER);
-	spin_unlock(&wdt->io_lock);
-
-	return 0;
-}
-static int mpc5200_wdt_ping(struct mpc5200_wdt *wdt)
-{
-	spin_lock(&wdt->io_lock);
-	/* writing A5 to OCPW resets the watchdog */
-	out_be32(&wdt->regs->mode, 0xA5000000 |
-				(0xffffff & in_be32(&wdt->regs->mode)));
-	spin_unlock(&wdt->io_lock);
-	return 0;
-}
-static int mpc5200_wdt_stop(struct mpc5200_wdt *wdt)
-{
-	spin_lock(&wdt->io_lock);
-	/* disable */
-	out_be32(&wdt->regs->mode, 0);
-	spin_unlock(&wdt->io_lock);
-	return 0;
-}
-
-
-/* file operations */
-static ssize_t mpc5200_wdt_write(struct file *file, const char __user *data,
-		size_t len, loff_t *ppos)
-{
-	struct mpc5200_wdt *wdt = file->private_data;
-	mpc5200_wdt_ping(wdt);
-	return 0;
-}
-static struct watchdog_info mpc5200_wdt_info = {
-	.options	= WDIOF_SETTIMEOUT | WDIOF_KEEPALIVEPING,
-	.identity	= "mpc5200 watchdog on GPT0",
-};
-static long mpc5200_wdt_ioctl(struct file *file, unsigned int cmd,
-							unsigned long arg)
-{
-	struct mpc5200_wdt *wdt = file->private_data;
-	int __user *data = (int __user *)arg;
-	int timeout;
-	int ret = 0;
-
-	switch (cmd) {
-	case WDIOC_GETSUPPORT:
-		ret = copy_to_user(data, &mpc5200_wdt_info,
-						sizeof(mpc5200_wdt_info));
-		if (ret)
-			ret = -EFAULT;
-		break;
-
-	case WDIOC_GETSTATUS:
-	case WDIOC_GETBOOTSTATUS:
-		ret = put_user(0, data);
-		break;
-
-	case WDIOC_KEEPALIVE:
-		mpc5200_wdt_ping(wdt);
-		break;
-
-	case WDIOC_SETTIMEOUT:
-		ret = get_user(timeout, data);
-		if (ret)
-			break;
-		mpc5200_wdt_set_timeout(wdt, timeout);
-		mpc5200_wdt_start(wdt);
-		/* fall through and return the timeout */
-
-	case WDIOC_GETTIMEOUT:
-		timeout = mpc5200_wdt_get_timeout(wdt);
-		ret = put_user(timeout, data);
-		break;
-
-	default:
-		ret = -ENOTTY;
-	}
-	return ret;
-}
-
-static int mpc5200_wdt_open(struct inode *inode, struct file *file)
-{
-	/* /dev/watchdog can only be opened once */
-	if (test_and_set_bit(0, &is_active))
-		return -EBUSY;
-
-	/* Set and activate the watchdog */
-	mpc5200_wdt_set_timeout(wdt_global, 30);
-	mpc5200_wdt_start(wdt_global);
-	file->private_data = wdt_global;
-	return nonseekable_open(inode, file);
-}
-static int mpc5200_wdt_release(struct inode *inode, struct file *file)
-{
-#if WATCHDOG_NOWAYOUT == 0
-	struct mpc5200_wdt *wdt = file->private_data;
-	mpc5200_wdt_stop(wdt);
-	wdt->count = 0;		/* == disabled */
-#endif
-	clear_bit(0, &is_active);
-	return 0;
-}
-
-static const struct file_operations mpc5200_wdt_fops = {
-	.owner	= THIS_MODULE,
-	.write	= mpc5200_wdt_write,
-	.unlocked_ioctl	= mpc5200_wdt_ioctl,
-	.open	= mpc5200_wdt_open,
-	.release = mpc5200_wdt_release,
-};
-
-/* module operations */
-static int mpc5200_wdt_probe(struct of_device *op,
-					const struct of_device_id *match)
-{
-	struct mpc5200_wdt *wdt;
-	int err;
-	const void *has_wdt;
-	int size;
-
-	has_wdt = of_get_property(op->node, "has-wdt", NULL);
-	if (!has_wdt)
-		has_wdt = of_get_property(op->node, "fsl,has-wdt", NULL);
-	if (!has_wdt)
-		return -ENODEV;
-
-	wdt = kzalloc(sizeof(*wdt), GFP_KERNEL);
-	if (!wdt)
-		return -ENOMEM;
-
-	wdt->ipb_freq = mpc5xxx_get_bus_frequency(op->node);
-
-	err = of_address_to_resource(op->node, 0, &wdt->mem);
-	if (err)
-		goto out_free;
-	size = wdt->mem.end - wdt->mem.start + 1;
-	if (!request_mem_region(wdt->mem.start, size, "mpc5200_wdt")) {
-		err = -ENODEV;
-		goto out_free;
-	}
-	wdt->regs = ioremap(wdt->mem.start, size);
-	if (!wdt->regs) {
-		err = -ENODEV;
-		goto out_release;
-	}
-
-	dev_set_drvdata(&op->dev, wdt);
-	spin_lock_init(&wdt->io_lock);
-
-	wdt->miscdev = (struct miscdevice) {
-		.minor	= WATCHDOG_MINOR,
-		.name	= "watchdog",
-		.fops	= &mpc5200_wdt_fops,
-		.parent = &op->dev,
-	};
-	wdt_global = wdt;
-	err = misc_register(&wdt->miscdev);
-	if (!err)
-		return 0;
-
-	iounmap(wdt->regs);
-out_release:
-	release_mem_region(wdt->mem.start, size);
-out_free:
-	kfree(wdt);
-	return err;
-}
-
-static int mpc5200_wdt_remove(struct of_device *op)
-{
-	struct mpc5200_wdt *wdt = dev_get_drvdata(&op->dev);
-
-	mpc5200_wdt_stop(wdt);
-	misc_deregister(&wdt->miscdev);
-	iounmap(wdt->regs);
-	release_mem_region(wdt->mem.start, wdt->mem.end - wdt->mem.start + 1);
-	kfree(wdt);
-
-	return 0;
-}
-static int mpc5200_wdt_suspend(struct of_device *op, pm_message_t state)
-{
-	struct mpc5200_wdt *wdt = dev_get_drvdata(&op->dev);
-	mpc5200_wdt_stop(wdt);
-	return 0;
-}
-static int mpc5200_wdt_resume(struct of_device *op)
-{
-	struct mpc5200_wdt *wdt = dev_get_drvdata(&op->dev);
-	if (wdt->count)
-		mpc5200_wdt_start(wdt);
-	return 0;
-}
-static int mpc5200_wdt_shutdown(struct of_device *op)
-{
-	struct mpc5200_wdt *wdt = dev_get_drvdata(&op->dev);
-	mpc5200_wdt_stop(wdt);
-	return 0;
-}
-
-static struct of_device_id mpc5200_wdt_match[] = {
-	{ .compatible = "mpc5200-gpt", },
-	{ .compatible = "fsl,mpc5200-gpt", },
-	{},
-};
-static struct of_platform_driver mpc5200_wdt_driver = {
-	.owner		= THIS_MODULE,
-	.name		= "mpc5200-gpt-wdt",
-	.match_table	= mpc5200_wdt_match,
-	.probe		= mpc5200_wdt_probe,
-	.remove		= mpc5200_wdt_remove,
-	.suspend	= mpc5200_wdt_suspend,
-	.resume		= mpc5200_wdt_resume,
-	.shutdown	= mpc5200_wdt_shutdown,
-};
-
-
-static int __init mpc5200_wdt_init(void)
-{
-	return of_register_platform_driver(&mpc5200_wdt_driver);
-}
-
-static void __exit mpc5200_wdt_exit(void)
-{
-	of_unregister_platform_driver(&mpc5200_wdt_driver);
-}
-
-module_init(mpc5200_wdt_init);
-module_exit(mpc5200_wdt_exit);
-
-MODULE_AUTHOR("Domen Puncer <domen.puncer@telargo.com>");
-MODULE_LICENSE("Dual BSD/GPL");
-MODULE_ALIAS_MISCDEV(WATCHDOG_MINOR);
diff --git a/drivers/watchdog/mpcore_wdt.c b/drivers/watchdog/mpcore_wdt.c
index 83fa34b214b4..a2dc07c2ed49 100644
--- a/drivers/watchdog/mpcore_wdt.c
+++ b/drivers/watchdog/mpcore_wdt.c
@@ -350,7 +350,7 @@ static int __devinit mpcore_wdt_probe(struct platform_device *dev)
 		ret = -ENXIO;
 		goto err_free;
 	}
-	wdt->base = ioremap(res->start, res->end - res->start + 1);
+	wdt->base = ioremap(res->start, resource_size(res));
 	if (!wdt->base) {
 		ret = -ENOMEM;
 		goto err_free;
diff --git a/drivers/watchdog/mv64x60_wdt.c b/drivers/watchdog/mv64x60_wdt.c
index acf589dc057c..a51dbe4c43da 100644
--- a/drivers/watchdog/mv64x60_wdt.c
+++ b/drivers/watchdog/mv64x60_wdt.c
@@ -275,7 +275,7 @@ static int __devinit mv64x60_wdt_probe(struct platform_device *dev)
 	if (!r)
 		return -ENODEV;
 
-	mv64x60_wdt_regs = ioremap(r->start, r->end - r->start + 1);
+	mv64x60_wdt_regs = ioremap(r->start, resource_size(r));
 	if (mv64x60_wdt_regs == NULL)
 		return -ENOMEM;
 
diff --git a/drivers/watchdog/omap_wdt.c b/drivers/watchdog/omap_wdt.c
index 429ea99eaee5..c6aaf2845741 100644
--- a/drivers/watchdog/omap_wdt.c
+++ b/drivers/watchdog/omap_wdt.c
@@ -277,8 +277,7 @@ static int __devinit omap_wdt_probe(struct platform_device *pdev)
 		goto err_busy;
 	}
 
-	mem = request_mem_region(res->start, res->end - res->start + 1,
-				 pdev->name);
+	mem = request_mem_region(res->start, resource_size(res), pdev->name);
 	if (!mem) {
 		ret = -EBUSY;
 		goto err_busy;
@@ -306,7 +305,7 @@ static int __devinit omap_wdt_probe(struct platform_device *pdev)
 		goto err_clk;
 	}
 
-	wdev->base = ioremap(res->start, res->end - res->start + 1);
+	wdev->base = ioremap(res->start, resource_size(res));
 	if (!wdev->base) {
 		ret = -ENOMEM;
 		goto err_ioremap;
@@ -358,7 +357,7 @@ err_clk:
 	kfree(wdev);
 
 err_kzalloc:
-	release_mem_region(res->start, res->end - res->start + 1);
+	release_mem_region(res->start, resource_size(res));
 
 err_busy:
 err_get_resource:
@@ -383,7 +382,7 @@ static int __devexit omap_wdt_remove(struct platform_device *pdev)
 		return -ENOENT;
 
 	misc_deregister(&(wdev->omap_wdt_miscdev));
-	release_mem_region(res->start, res->end - res->start + 1);
+	release_mem_region(res->start, resource_size(res));
 	platform_set_drvdata(pdev, NULL);
 
 	clk_put(wdev->ick);
diff --git a/drivers/watchdog/pnx4008_wdt.c b/drivers/watchdog/pnx4008_wdt.c
index 4d227b152001..430a5848a9a5 100644
--- a/drivers/watchdog/pnx4008_wdt.c
+++ b/drivers/watchdog/pnx4008_wdt.c
@@ -264,7 +264,7 @@ static int __devinit pnx4008_wdt_probe(struct platform_device *pdev)
 		return -ENOENT;
 	}
 
-	size = res->end - res->start + 1;
+	size = resource_size(res);
 	wdt_mem = request_mem_region(res->start, size, pdev->name);
 
 	if (wdt_mem == NULL) {
diff --git a/drivers/watchdog/rm9k_wdt.c b/drivers/watchdog/rm9k_wdt.c
deleted file mode 100644
index bb66958b9433..000000000000
--- a/drivers/watchdog/rm9k_wdt.c
+++ /dev/null
@@ -1,419 +0,0 @@
-/*
- *  Watchdog implementation for GPI h/w found on PMC-Sierra RM9xxx
- *  chips.
- *
- *  Copyright (C) 2004 by Basler Vision Technologies AG
- *  Author: Thomas Koeller <thomas.koeller@baslerweb.com>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
- */
-
-#include <linux/platform_device.h>
-#include <linux/module.h>
-#include <linux/moduleparam.h>
-#include <linux/interrupt.h>
-#include <linux/fs.h>
-#include <linux/reboot.h>
-#include <linux/notifier.h>
-#include <linux/miscdevice.h>
-#include <linux/watchdog.h>
-#include <linux/io.h>
-#include <linux/uaccess.h>
-#include <asm/atomic.h>
-#include <asm/processor.h>
-#include <asm/system.h>
-#include <asm/rm9k-ocd.h>
-
-#include <rm9k_wdt.h>
-
-
-#define CLOCK                  125000000
-#define MAX_TIMEOUT_SECONDS    32
-#define CPCCR                  0x0080
-#define CPGIG1SR               0x0044
-#define CPGIG1ER               0x0054
-
-
-/* Function prototypes */
-static irqreturn_t wdt_gpi_irqhdl(int, void *);
-static void wdt_gpi_start(void);
-static void wdt_gpi_stop(void);
-static void wdt_gpi_set_timeout(unsigned int);
-static int wdt_gpi_open(struct inode *, struct file *);
-static int wdt_gpi_release(struct inode *, struct file *);
-static ssize_t wdt_gpi_write(struct file *, const char __user *, size_t,
-								loff_t *);
-static long wdt_gpi_ioctl(struct file *, unsigned int, unsigned long);
-static int wdt_gpi_notify(struct notifier_block *, unsigned long, void *);
-static const struct resource *wdt_gpi_get_resource(struct platform_device *,
-						const char *, unsigned int);
-static int __init wdt_gpi_probe(struct platform_device *);
-static int __exit wdt_gpi_remove(struct platform_device *);
-
-
-static const char wdt_gpi_name[] = "wdt_gpi";
-static atomic_t opencnt;
-static int expect_close;
-static int locked;
-
-
-/* These are set from device resources */
-static void __iomem *wd_regs;
-static unsigned int wd_irq, wd_ctr;
-
-
-/* Module arguments */
-static int timeout = MAX_TIMEOUT_SECONDS;
-module_param(timeout, int, 0444);
-MODULE_PARM_DESC(timeout, "Watchdog timeout in seconds");
-
-static unsigned long resetaddr = 0xbffdc200;
-module_param(resetaddr, ulong, 0444);
-MODULE_PARM_DESC(resetaddr, "Address to write to to force a reset");
-
-static unsigned long flagaddr = 0xbffdc104;
-module_param(flagaddr, ulong, 0444);
-MODULE_PARM_DESC(flagaddr, "Address to write to boot flags to");
-
-static int powercycle;
-module_param(powercycle, bool, 0444);
-MODULE_PARM_DESC(powercycle, "Cycle power if watchdog expires");
-
-static int nowayout = WATCHDOG_NOWAYOUT;
-module_param(nowayout, bool, 0444);
-MODULE_PARM_DESC(nowayout, "Watchdog cannot be disabled once started");
-
-
-/* Kernel interfaces */
-static const struct file_operations fops = {
-	.owner		= THIS_MODULE,
-	.open		= wdt_gpi_open,
-	.release	= wdt_gpi_release,
-	.write		= wdt_gpi_write,
-	.unlocked_ioctl	= wdt_gpi_ioctl,
-};
-
-static struct miscdevice miscdev = {
-	.minor		= WATCHDOG_MINOR,
-	.name		= wdt_gpi_name,
-	.fops		= &fops,
-};
-
-static struct notifier_block wdt_gpi_shutdown = {
-	.notifier_call	= wdt_gpi_notify,
-};
-
-
-/* Interrupt handler */
-static irqreturn_t wdt_gpi_irqhdl(int irq, void *ctxt)
-{
-	if (!unlikely(__raw_readl(wd_regs + 0x0008) & 0x1))
-		return IRQ_NONE;
-	__raw_writel(0x1, wd_regs + 0x0008);
-
-
-	printk(KERN_CRIT "%s: watchdog expired - resetting system\n",
-		wdt_gpi_name);
-
-	*(volatile char *) flagaddr |= 0x01;
-	*(volatile char *) resetaddr = powercycle ? 0x01 : 0x2;
-	iob();
-	while (1)
-		cpu_relax();
-}
-
-
-/* Watchdog functions */
-static void wdt_gpi_start(void)
-{
-	u32 reg;
-
-	lock_titan_regs();
-	reg = titan_readl(CPGIG1ER);
-	titan_writel(reg | (0x100 << wd_ctr), CPGIG1ER);
-	iob();
-	unlock_titan_regs();
-}
-
-static void wdt_gpi_stop(void)
-{
-	u32 reg;
-
-	lock_titan_regs();
-	reg = titan_readl(CPCCR) & ~(0xf << (wd_ctr * 4));
-	titan_writel(reg, CPCCR);
-	reg = titan_readl(CPGIG1ER);
-	titan_writel(reg & ~(0x100 << wd_ctr), CPGIG1ER);
-	iob();
-	unlock_titan_regs();
-}
-
-static void wdt_gpi_set_timeout(unsigned int to)
-{
-	u32 reg;
-	const u32 wdval = (to * CLOCK) & ~0x0000000f;
-
-	lock_titan_regs();
-	reg = titan_readl(CPCCR) & ~(0xf << (wd_ctr * 4));
-	titan_writel(reg, CPCCR);
-	wmb();
-	__raw_writel(wdval, wd_regs + 0x0000);
-	wmb();
-	titan_writel(reg | (0x2 << (wd_ctr * 4)), CPCCR);
-	wmb();
-	titan_writel(reg | (0x5 << (wd_ctr * 4)), CPCCR);
-	iob();
-	unlock_titan_regs();
-}
-
-
-/* /dev/watchdog operations */
-static int wdt_gpi_open(struct inode *inode, struct file *file)
-{
-	int res;
-
-	if (unlikely(atomic_dec_if_positive(&opencnt) < 0))
-		return -EBUSY;
-
-	expect_close = 0;
-	if (locked) {
-		module_put(THIS_MODULE);
-		free_irq(wd_irq, &miscdev);
-		locked = 0;
-	}
-
-	res = request_irq(wd_irq, wdt_gpi_irqhdl, IRQF_SHARED | IRQF_DISABLED,
-			  wdt_gpi_name, &miscdev);
-	if (unlikely(res))
-		return res;
-
-	wdt_gpi_set_timeout(timeout);
-	wdt_gpi_start();
-
-	printk(KERN_INFO "%s: watchdog started, timeout = %u seconds\n",
-		wdt_gpi_name, timeout);
-	return nonseekable_open(inode, file);
-}
-
-static int wdt_gpi_release(struct inode *inode, struct file *file)
-{
-	if (nowayout) {
-		printk(KERN_INFO "%s: no way out - watchdog left running\n",
-			wdt_gpi_name);
-		__module_get(THIS_MODULE);
-		locked = 1;
-	} else {
-		if (expect_close) {
-			wdt_gpi_stop();
-			free_irq(wd_irq, &miscdev);
-			printk(KERN_INFO "%s: watchdog stopped\n",
-							wdt_gpi_name);
-		} else {
-			printk(KERN_CRIT "%s: unexpected close() -"
-				" watchdog left running\n",
-				wdt_gpi_name);
-			wdt_gpi_set_timeout(timeout);
-			__module_get(THIS_MODULE);
-			locked = 1;
-		}
-	}
-
-	atomic_inc(&opencnt);
-	return 0;
-}
-
-static ssize_t wdt_gpi_write(struct file *f, const char __user *d, size_t s,
-								loff_t *o)
-{
-	char val;
-
-	wdt_gpi_set_timeout(timeout);
-	expect_close = (s > 0) && !get_user(val, d) && (val == 'V');
-	return s ? 1 : 0;
-}
-
-static long wdt_gpi_ioctl(struct file *f, unsigned int cmd, unsigned long arg)
-{
-	long res = -ENOTTY;
-	const long size = _IOC_SIZE(cmd);
-	int stat;
-	void __user *argp = (void __user *)arg;
-	static struct watchdog_info wdinfo = {
-		.identity               = "RM9xxx/GPI watchdog",
-		.firmware_version       = 0,
-		.options                = WDIOF_SETTIMEOUT | WDIOF_KEEPALIVEPING
-	};
-
-	if (unlikely(_IOC_TYPE(cmd) != WATCHDOG_IOCTL_BASE))
-		return -ENOTTY;
-
-	if ((_IOC_DIR(cmd) & _IOC_READ)
-	    && !access_ok(VERIFY_WRITE, arg, size))
-		return -EFAULT;
-
-	if ((_IOC_DIR(cmd) & _IOC_WRITE)
-	    && !access_ok(VERIFY_READ, arg, size))
-		return -EFAULT;
-
-	expect_close = 0;
-
-	switch (cmd) {
-	case WDIOC_GETSUPPORT:
-		wdinfo.options = nowayout ?
-			WDIOF_SETTIMEOUT | WDIOF_KEEPALIVEPING :
-			WDIOF_SETTIMEOUT | WDIOF_KEEPALIVEPING |
-			WDIOF_MAGICCLOSE;
-		res = __copy_to_user(argp, &wdinfo, size) ?  -EFAULT : size;
-		break;
-
-	case WDIOC_GETSTATUS:
-		break;
-
-	case WDIOC_GETBOOTSTATUS:
-		stat = (*(volatile char *) flagaddr & 0x01)
-			? WDIOF_CARDRESET : 0;
-		res = __copy_to_user(argp, &stat, size) ?
-			-EFAULT : size;
-		break;
-
-	case WDIOC_SETOPTIONS:
-		break;
-
-	case WDIOC_KEEPALIVE:
-		wdt_gpi_set_timeout(timeout);
-		res = size;
-		break;
-
-	case WDIOC_SETTIMEOUT:
-		{
-			int val;
-			if (unlikely(__copy_from_user(&val, argp, size))) {
-				res = -EFAULT;
-				break;
-			}
-
-			if (val > MAX_TIMEOUT_SECONDS)
-				val = MAX_TIMEOUT_SECONDS;
-			timeout = val;
-			wdt_gpi_set_timeout(val);
-			res = size;
-			printk(KERN_INFO "%s: timeout set to %u seconds\n",
-				wdt_gpi_name, timeout);
-		}
-		break;
-
-	case WDIOC_GETTIMEOUT:
-		res = __copy_to_user(argp, &timeout, size) ?
-			-EFAULT : size;
-		break;
-	}
-
-	return res;
-}
-
-
-/* Shutdown notifier */
-static int wdt_gpi_notify(struct notifier_block *this, unsigned long code,
-			  void *unused)
-{
-	if (code == SYS_DOWN || code == SYS_HALT)
-		wdt_gpi_stop();
-
-	return NOTIFY_DONE;
-}
-
-
-/* Init & exit procedures */
-static const struct resource *wdt_gpi_get_resource(struct platform_device *pdv,
-					const char *name, unsigned int type)
-{
-	char buf[80];
-	if (snprintf(buf, sizeof(buf), "%s_0", name) >= sizeof(buf))
-		return NULL;
-	return platform_get_resource_byname(pdv, type, buf);
-}
-
-/* No hotplugging on the platform bus - use __devinit */
-static int __devinit wdt_gpi_probe(struct platform_device *pdv)
-{
-	int res;
-	const struct resource
-		* const rr = wdt_gpi_get_resource(pdv, WDT_RESOURCE_REGS,
-						  IORESOURCE_MEM),
-		* const ri = wdt_gpi_get_resource(pdv, WDT_RESOURCE_IRQ,
-						  IORESOURCE_IRQ),
-		* const rc = wdt_gpi_get_resource(pdv, WDT_RESOURCE_COUNTER,
-						  0);
-
-	if (unlikely(!rr || !ri || !rc))
-		return -ENXIO;
-
-	wd_regs = ioremap_nocache(rr->start, rr->end + 1 - rr->start);
-	if (unlikely(!wd_regs))
-		return -ENOMEM;
-	wd_irq = ri->start;
-	wd_ctr = rc->start;
-	res = misc_register(&miscdev);
-	if (res)
-		iounmap(wd_regs);
-	else
-		register_reboot_notifier(&wdt_gpi_shutdown);
-	return res;
-}
-
-static int __devexit wdt_gpi_remove(struct platform_device *dev)
-{
-	int res;
-
-	unregister_reboot_notifier(&wdt_gpi_shutdown);
-	res = misc_deregister(&miscdev);
-	iounmap(wd_regs);
-	wd_regs = NULL;
-	return res;
-}
-
-
-/* Device driver init & exit */
-static struct platform_driver wgt_gpi_driver = {
-	.driver = {
-		.name		= wdt_gpi_name,
-		.owner		= THIS_MODULE,
-	},
-	.probe		= wdt_gpi_probe,
-	.remove		= __devexit_p(wdt_gpi_remove),
-};
-
-static int __init wdt_gpi_init_module(void)
-{
-	atomic_set(&opencnt, 1);
-	if (timeout > MAX_TIMEOUT_SECONDS)
-		timeout = MAX_TIMEOUT_SECONDS;
-	return platform_driver_register(&wdt_gpi_driver);
-}
-
-static void __exit wdt_gpi_cleanup_module(void)
-{
-	platform_driver_unregister(&wdt_gpi_driver);
-}
-
-module_init(wdt_gpi_init_module);
-module_exit(wdt_gpi_cleanup_module);
-
-MODULE_AUTHOR("Thomas Koeller <thomas.koeller@baslerweb.com>");
-MODULE_DESCRIPTION("Basler eXcite watchdog driver for gpi devices");
-MODULE_VERSION("0.1");
-MODULE_LICENSE("GPL");
-MODULE_ALIAS_MISCDEV(WATCHDOG_MINOR);
-
diff --git a/drivers/watchdog/s3c2410_wdt.c b/drivers/watchdog/s3c2410_wdt.c
index b57ac6b49147..8760a26ab2a3 100644
--- a/drivers/watchdog/s3c2410_wdt.c
+++ b/drivers/watchdog/s3c2410_wdt.c
@@ -36,6 +36,7 @@
 #include <linux/clk.h>
 #include <linux/uaccess.h>
 #include <linux/io.h>
+#include <linux/cpufreq.h>
 
 #include <mach/map.h>
 
@@ -142,9 +143,14 @@ static void s3c2410wdt_start(void)
 	spin_unlock(&wdt_lock);
 }
 
+static inline int s3c2410wdt_is_running(void)
+{
+	return readl(wdt_base + S3C2410_WTCON) & S3C2410_WTCON_ENABLE;
+}
+
 static int s3c2410wdt_set_heartbeat(int timeout)
 {
-	unsigned int freq = clk_get_rate(wdt_clock);
+	unsigned long freq = clk_get_rate(wdt_clock);
 	unsigned int count;
 	unsigned int divisor = 1;
 	unsigned long wtcon;
@@ -155,7 +161,7 @@ static int s3c2410wdt_set_heartbeat(int timeout)
 	freq /= 128;
 	count = timeout * freq;
 
-	DBG("%s: count=%d, timeout=%d, freq=%d\n",
+	DBG("%s: count=%d, timeout=%d, freq=%lu\n",
 	    __func__, count, timeout, freq);
 
 	/* if the count is bigger than the watchdog register,
@@ -324,6 +330,73 @@ static irqreturn_t s3c2410wdt_irq(int irqno, void *param)
 	s3c2410wdt_keepalive();
 	return IRQ_HANDLED;
 }
+
+
+#ifdef CONFIG_CPU_FREQ
+
+static int s3c2410wdt_cpufreq_transition(struct notifier_block *nb,
+					  unsigned long val, void *data)
+{
+	int ret;
+
+	if (!s3c2410wdt_is_running())
+		goto done;
+
+	if (val == CPUFREQ_PRECHANGE) {
+		/* To ensure that over the change we don't cause the
+		 * watchdog to trigger, we perform an keep-alive if
+		 * the watchdog is running.
+		 */
+
+		s3c2410wdt_keepalive();
+	} else if (val == CPUFREQ_POSTCHANGE) {
+		s3c2410wdt_stop();
+
+		ret = s3c2410wdt_set_heartbeat(tmr_margin);
+
+		if (ret >= 0)
+			s3c2410wdt_start();
+		else
+			goto err;
+	}
+
+done:
+	return 0;
+
+ err:
+	dev_err(wdt_dev, "cannot set new value for timeout %d\n", tmr_margin);
+	return ret;
+}
+
+static struct notifier_block s3c2410wdt_cpufreq_transition_nb = {
+	.notifier_call	= s3c2410wdt_cpufreq_transition,
+};
+
+static inline int s3c2410wdt_cpufreq_register(void)
+{
+	return cpufreq_register_notifier(&s3c2410wdt_cpufreq_transition_nb,
+					 CPUFREQ_TRANSITION_NOTIFIER);
+}
+
+static inline void s3c2410wdt_cpufreq_deregister(void)
+{
+	cpufreq_unregister_notifier(&s3c2410wdt_cpufreq_transition_nb,
+				    CPUFREQ_TRANSITION_NOTIFIER);
+}
+
+#else
+static inline int s3c2410wdt_cpufreq_register(void)
+{
+	return 0;
+}
+
+static inline void s3c2410wdt_cpufreq_deregister(void)
+{
+}
+#endif
+
+
+
 /* device interface */
 
 static int __devinit s3c2410wdt_probe(struct platform_device *pdev)
@@ -348,7 +421,7 @@ static int __devinit s3c2410wdt_probe(struct platform_device *pdev)
 		return -ENOENT;
 	}
 
-	size = (res->end - res->start) + 1;
+	size = resource_size(res);
 	wdt_mem = request_mem_region(res->start, size, pdev->name);
 	if (wdt_mem == NULL) {
 		dev_err(dev, "failed to get memory region\n");
@@ -387,6 +460,11 @@ static int __devinit s3c2410wdt_probe(struct platform_device *pdev)
 
 	clk_enable(wdt_clock);
 
+	if (s3c2410wdt_cpufreq_register() < 0) {
+		printk(KERN_ERR PFX "failed to register cpufreq\n");
+		goto err_clk;
+	}
+
 	/* see if we can actually set the requested timer margin, and if
 	 * not, try the default value */
 
@@ -407,7 +485,7 @@ static int __devinit s3c2410wdt_probe(struct platform_device *pdev)
 	if (ret) {
 		dev_err(dev, "cannot register miscdev on minor=%d (%d)\n",
 			WATCHDOG_MINOR, ret);
-		goto err_clk;
+		goto err_cpufreq;
 	}
 
 	if (tmr_atboot && started == 0) {
@@ -432,6 +510,9 @@ static int __devinit s3c2410wdt_probe(struct platform_device *pdev)
 
 	return 0;
 
+ err_cpufreq:
+	s3c2410wdt_cpufreq_deregister();
+
  err_clk:
 	clk_disable(wdt_clock);
 	clk_put(wdt_clock);
@@ -451,6 +532,8 @@ static int __devinit s3c2410wdt_probe(struct platform_device *pdev)
 
 static int __devexit s3c2410wdt_remove(struct platform_device *dev)
 {
+	s3c2410wdt_cpufreq_deregister();
+
 	release_resource(wdt_mem);
 	kfree(wdt_mem);
 	wdt_mem = NULL;
diff --git a/drivers/watchdog/sb_wdog.c b/drivers/watchdog/sb_wdog.c
index 9748eed73196..c8eadd478175 100644
--- a/drivers/watchdog/sb_wdog.c
+++ b/drivers/watchdog/sb_wdog.c
@@ -1,7 +1,7 @@
 /*
  * Watchdog driver for SiByte SB1 SoCs
  *
- * Copyright (C) 2007 OnStor, Inc. * Andrew Sharp <andy.sharp@onstor.com>
+ * Copyright (C) 2007 OnStor, Inc. * Andrew Sharp <andy.sharp@lsi.com>
  *
  * This driver is intended to make the second of two hardware watchdogs
  * on the Sibyte 12XX and 11XX SoCs available to the user.  There are two
@@ -326,7 +326,7 @@ static void __exit sbwdog_exit(void)
 module_init(sbwdog_init);
 module_exit(sbwdog_exit);
 
-MODULE_AUTHOR("Andrew Sharp <andy.sharp@onstor.com>");
+MODULE_AUTHOR("Andrew Sharp <andy.sharp@lsi.com>");
 MODULE_DESCRIPTION("SiByte Watchdog");
 
 module_param(timeout, ulong, 0);
diff --git a/drivers/watchdog/twl4030_wdt.c b/drivers/watchdog/twl4030_wdt.c
index cb46556f2973..8162a40d1522 100644
--- a/drivers/watchdog/twl4030_wdt.c
+++ b/drivers/watchdog/twl4030_wdt.c
@@ -26,7 +26,7 @@
 #include <linux/platform_device.h>
 #include <linux/miscdevice.h>
 #include <linux/uaccess.h>
-#include <linux/i2c/twl4030.h>
+#include <linux/i2c/twl.h>
 
 #define TWL4030_WATCHDOG_CFG_REG_OFFS	0x3
 
@@ -48,7 +48,7 @@ MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started "
 
 static int twl4030_wdt_write(unsigned char val)
 {
-	return twl4030_i2c_write_u8(TWL4030_MODULE_PM_RECEIVER, val,
+	return twl_i2c_write_u8(TWL4030_MODULE_PM_RECEIVER, val,
 					TWL4030_WATCHDOG_CFG_REG_OFFS);
 }
 
diff --git a/drivers/watchdog/txx9wdt.c b/drivers/watchdog/txx9wdt.c
index 6adab77fbbb0..d635566e9307 100644
--- a/drivers/watchdog/txx9wdt.c
+++ b/drivers/watchdog/txx9wdt.c
@@ -214,12 +214,10 @@ static int __init txx9wdt_probe(struct platform_device *dev)
 	res = platform_get_resource(dev, IORESOURCE_MEM, 0);
 	if (!res)
 		goto exit_busy;
-	if (!devm_request_mem_region(&dev->dev,
-				     res->start, res->end - res->start + 1,
+	if (!devm_request_mem_region(&dev->dev, res->start, resource_size(res),
 				     "txx9wdt"))
 		goto exit_busy;
-	txx9wdt_reg = devm_ioremap(&dev->dev,
-				   res->start, res->end - res->start + 1);
+	txx9wdt_reg = devm_ioremap(&dev->dev, res->start, resource_size(res));
 	if (!txx9wdt_reg)
 		goto exit_busy;
 
diff --git a/drivers/watchdog/wdrtas.c b/drivers/watchdog/wdrtas.c
index 3bde56bce63a..5bfb1f2c5319 100644
--- a/drivers/watchdog/wdrtas.c
+++ b/drivers/watchdog/wdrtas.c
@@ -542,7 +542,7 @@ static struct notifier_block wdrtas_notifier = {
 /**
  * wdrtas_get_tokens - reads in RTAS tokens
  *
- * returns 0 on succes, <0 on failure
+ * returns 0 on success, <0 on failure
  *
  * wdrtas_get_tokens reads in the tokens for the RTAS calls used in
  * this watchdog driver. It tolerates, if "get-sensor-state" and
@@ -598,7 +598,7 @@ static void wdrtas_unregister_devs(void)
 /**
  * wdrtas_register_devs - registers the misc dev handlers
  *
- * returns 0 on succes, <0 on failure
+ * returns 0 on success, <0 on failure
  *
  * wdrtas_register_devs registers the watchdog and temperature watchdog
  * misc devs
@@ -630,7 +630,7 @@ static int wdrtas_register_devs(void)
 /**
  * wdrtas_init - init function of the watchdog driver
  *
- * returns 0 on succes, <0 on failure
+ * returns 0 on success, <0 on failure
  *
  * registers the file handlers and the reboot notifier
  */
diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index d31505b6f7a4..f6738d8b02bc 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -52,6 +52,8 @@
 
 #include <asm/xen/hypervisor.h>
 #include <asm/xen/hypercall.h>
+
+#include <xen/xen.h>
 #include <xen/interface/xen.h>
 #include <xen/interface/memory.h>
 #include <xen/xenbus.h>
@@ -66,8 +68,6 @@ struct balloon_stats {
 	/* We aim for 'current allocation' == 'target allocation'. */
 	unsigned long current_pages;
 	unsigned long target_pages;
-	/* We may hit the hard limit in Xen. If we do then we remember it. */
-	unsigned long hard_limit;
 	/*
 	 * Drivers may alter the memory reservation independently, but they
 	 * must inform the balloon driver so we avoid hitting the hard limit.
@@ -136,6 +136,8 @@ static void balloon_append(struct page *page)
 		list_add(&page->lru, &ballooned_pages);
 		balloon_stats.balloon_low++;
 	}
+
+	totalram_pages--;
 }
 
 /* balloon_retrieve: rescue a page from the balloon, if it is not empty. */
@@ -156,6 +158,8 @@ static struct page *balloon_retrieve(void)
 	else
 		balloon_stats.balloon_low--;
 
+	totalram_pages++;
+
 	return page;
 }
 
@@ -181,7 +185,7 @@ static void balloon_alarm(unsigned long unused)
 
 static unsigned long current_target(void)
 {
-	unsigned long target = min(balloon_stats.target_pages, balloon_stats.hard_limit);
+	unsigned long target = balloon_stats.target_pages;
 
 	target = min(target,
 		     balloon_stats.current_pages +
@@ -217,23 +221,10 @@ static int increase_reservation(unsigned long nr_pages)
 	set_xen_guest_handle(reservation.extent_start, frame_list);
 	reservation.nr_extents = nr_pages;
 	rc = HYPERVISOR_memory_op(XENMEM_populate_physmap, &reservation);
-	if (rc < nr_pages) {
-		if (rc > 0) {
-			int ret;
-
-			/* We hit the Xen hard limit: reprobe. */
-			reservation.nr_extents = rc;
-			ret = HYPERVISOR_memory_op(XENMEM_decrease_reservation,
-						   &reservation);
-			BUG_ON(ret != rc);
-		}
-		if (rc >= 0)
-			balloon_stats.hard_limit = (balloon_stats.current_pages + rc -
-						    balloon_stats.driver_pages);
+	if (rc < 0)
 		goto out;
-	}
 
-	for (i = 0; i < nr_pages; i++) {
+	for (i = 0; i < rc; i++) {
 		page = balloon_retrieve();
 		BUG_ON(page == NULL);
 
@@ -259,13 +250,12 @@ static int increase_reservation(unsigned long nr_pages)
 		__free_page(page);
 	}
 
-	balloon_stats.current_pages += nr_pages;
-	totalram_pages = balloon_stats.current_pages;
+	balloon_stats.current_pages += rc;
 
  out:
 	spin_unlock_irqrestore(&balloon_lock, flags);
 
-	return 0;
+	return rc < 0 ? rc : rc != nr_pages;
 }
 
 static int decrease_reservation(unsigned long nr_pages)
@@ -323,7 +313,6 @@ static int decrease_reservation(unsigned long nr_pages)
 	BUG_ON(ret != nr_pages);
 
 	balloon_stats.current_pages -= nr_pages;
-	totalram_pages = balloon_stats.current_pages;
 
 	spin_unlock_irqrestore(&balloon_lock, flags);
 
@@ -367,7 +356,6 @@ static void balloon_process(struct work_struct *work)
 static void balloon_set_new_target(unsigned long target)
 {
 	/* No need for lock. Not read-modify-write updates. */
-	balloon_stats.hard_limit   = ~0UL;
 	balloon_stats.target_pages = target;
 	schedule_work(&balloon_worker);
 }
@@ -422,12 +410,10 @@ static int __init balloon_init(void)
 	pr_info("xen_balloon: Initialising balloon driver.\n");
 
 	balloon_stats.current_pages = min(xen_start_info->nr_pages, max_pfn);
-	totalram_pages   = balloon_stats.current_pages;
 	balloon_stats.target_pages  = balloon_stats.current_pages;
 	balloon_stats.balloon_low   = 0;
 	balloon_stats.balloon_high  = 0;
 	balloon_stats.driver_pages  = 0UL;
-	balloon_stats.hard_limit    = ~0UL;
 
 	init_timer(&balloon_timer);
 	balloon_timer.data = 0;
@@ -472,9 +458,6 @@ module_exit(balloon_exit);
 BALLOON_SHOW(current_kb, "%lu\n", PAGES2KB(balloon_stats.current_pages));
 BALLOON_SHOW(low_kb, "%lu\n", PAGES2KB(balloon_stats.balloon_low));
 BALLOON_SHOW(high_kb, "%lu\n", PAGES2KB(balloon_stats.balloon_high));
-BALLOON_SHOW(hard_limit_kb,
-	     (balloon_stats.hard_limit!=~0UL) ? "%lu\n" : "???\n",
-	     (balloon_stats.hard_limit!=~0UL) ? PAGES2KB(balloon_stats.hard_limit) : 0);
 BALLOON_SHOW(driver_kb, "%lu\n", PAGES2KB(balloon_stats.driver_pages));
 
 static ssize_t show_target_kb(struct sys_device *dev, struct sysdev_attribute *attr,
@@ -544,7 +527,6 @@ static struct attribute *balloon_info_attrs[] = {
 	&attr_current_kb.attr,
 	&attr_low_kb.attr,
 	&attr_high_kb.attr,
-	&attr_hard_limit_kb.attr,
 	&attr_driver_kb.attr,
 	NULL
 };
diff --git a/drivers/xen/cpu_hotplug.c b/drivers/xen/cpu_hotplug.c
index bdfd584ad853..14e2d995e958 100644
--- a/drivers/xen/cpu_hotplug.c
+++ b/drivers/xen/cpu_hotplug.c
@@ -1,5 +1,6 @@
 #include <linux/notifier.h>
 
+#include <xen/xen.h>
 #include <xen/xenbus.h>
 
 #include <asm/xen/hypervisor.h>
@@ -86,7 +87,7 @@ static int setup_cpu_watcher(struct notifier_block *notifier,
 	for_each_possible_cpu(cpu) {
 		if (vcpu_online(cpu) == 0) {
 			(void)cpu_down(cpu);
-			cpu_clear(cpu, cpu_present_map);
+			set_cpu_present(cpu, false);
 		}
 	}
 
diff --git a/drivers/xen/events.c b/drivers/xen/events.c
index 2f57276e87a2..ce602dd09bc1 100644
--- a/drivers/xen/events.c
+++ b/drivers/xen/events.c
@@ -474,6 +474,9 @@ static void unbind_from_irq(unsigned int irq)
 		bind_evtchn_to_cpu(evtchn, 0);
 
 		evtchn_to_irq[evtchn] = -1;
+	}
+
+	if (irq_info[irq].type != IRQT_UNBOUND) {
 		irq_info[irq] = mk_unbound_info();
 
 		dynamic_irq_cleanup(irq);
diff --git a/drivers/xen/evtchn.c b/drivers/xen/evtchn.c
index 79bedba44fee..f70a4f4698c5 100644
--- a/drivers/xen/evtchn.c
+++ b/drivers/xen/evtchn.c
@@ -48,6 +48,8 @@
 #include <linux/gfp.h>
 #include <linux/mutex.h>
 #include <linux/cpu.h>
+
+#include <xen/xen.h>
 #include <xen/events.h>
 #include <xen/evtchn.h>
 #include <asm/xen/hypervisor.h>
diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
index 7d8f531fb8e8..4c6c0bd636a8 100644
--- a/drivers/xen/grant-table.c
+++ b/drivers/xen/grant-table.c
@@ -37,6 +37,7 @@
 #include <linux/vmalloc.h>
 #include <linux/uaccess.h>
 
+#include <xen/xen.h>
 #include <xen/interface/xen.h>
 #include <xen/page.h>
 #include <xen/grant_table.h>
diff --git a/drivers/xen/manage.c b/drivers/xen/manage.c
index 10d03d7931c4..5d42d55e299b 100644
--- a/drivers/xen/manage.c
+++ b/drivers/xen/manage.c
@@ -43,7 +43,6 @@ static int xen_suspend(void *data)
 	if (err) {
 		printk(KERN_ERR "xen_suspend: sysdev_suspend failed: %d\n",
 			err);
-		dpm_resume_noirq(PMSG_RESUME);
 		return err;
 	}
 
@@ -69,7 +68,6 @@ static int xen_suspend(void *data)
 	}
 
 	sysdev_resume();
-	dpm_resume_noirq(PMSG_RESUME);
 
 	return 0;
 }
@@ -81,6 +79,12 @@ static void do_suspend(void)
 
 	shutting_down = SHUTDOWN_SUSPEND;
 
+	err = stop_machine_create();
+	if (err) {
+		printk(KERN_ERR "xen suspend: failed to setup stop_machine %d\n", err);
+		goto out;
+	}
+
 #ifdef CONFIG_PREEMPT
 	/* If the kernel is preemptible, we need to freeze all the processes
 	   to prevent them from being in the middle of a pagetable update
@@ -88,14 +92,14 @@ static void do_suspend(void)
 	err = freeze_processes();
 	if (err) {
 		printk(KERN_ERR "xen suspend: freeze failed %d\n", err);
-		return;
+		goto out_destroy_sm;
 	}
 #endif
 
 	err = dpm_suspend_start(PMSG_SUSPEND);
 	if (err) {
 		printk(KERN_ERR "xen suspend: dpm_suspend_start %d\n", err);
-		goto out;
+		goto out_thaw;
 	}
 
 	printk(KERN_DEBUG "suspending xenstore...\n");
@@ -104,32 +108,39 @@ static void do_suspend(void)
 	err = dpm_suspend_noirq(PMSG_SUSPEND);
 	if (err) {
 		printk(KERN_ERR "dpm_suspend_noirq failed: %d\n", err);
-		goto resume_devices;
+		goto out_resume;
 	}
 
 	err = stop_machine(xen_suspend, &cancelled, cpumask_of(0));
+
+	dpm_resume_noirq(PMSG_RESUME);
+
 	if (err) {
 		printk(KERN_ERR "failed to start xen_suspend: %d\n", err);
-		goto out;
+		cancelled = 1;
 	}
 
+out_resume:
 	if (!cancelled) {
 		xen_arch_resume();
 		xs_resume();
 	} else
 		xs_suspend_cancel();
 
-	dpm_resume_noirq(PMSG_RESUME);
-
-resume_devices:
 	dpm_resume_end(PMSG_RESUME);
 
 	/* Make sure timer events get retriggered on all CPUs */
 	clock_was_set();
-out:
+
+out_thaw:
 #ifdef CONFIG_PREEMPT
 	thaw_processes();
+
+out_destroy_sm:
 #endif
+	stop_machine_destroy();
+
+out:
 	shutting_down = SHUTDOWN_INVALID;
 }
 #endif	/* CONFIG_PM_SLEEP */
diff --git a/drivers/xen/sys-hypervisor.c b/drivers/xen/sys-hypervisor.c
index 88a60e03ccf0..ae5cb05a1a1c 100644
--- a/drivers/xen/sys-hypervisor.c
+++ b/drivers/xen/sys-hypervisor.c
@@ -14,6 +14,7 @@
 #include <asm/xen/hypervisor.h>
 #include <asm/xen/hypercall.h>
 
+#include <xen/xen.h>
 #include <xen/xenbus.h>
 #include <xen/interface/xen.h>
 #include <xen/interface/version.h>
diff --git a/drivers/xen/xenbus/xenbus_probe.c b/drivers/xen/xenbus/xenbus_probe.c
index d42e25d5968d..2f7aaa99dc47 100644
--- a/drivers/xen/xenbus/xenbus_probe.c
+++ b/drivers/xen/xenbus/xenbus_probe.c
@@ -49,6 +49,8 @@
 #include <asm/page.h>
 #include <asm/pgtable.h>
 #include <asm/xen/hypervisor.h>
+
+#include <xen/xen.h>
 #include <xen/xenbus.h>
 #include <xen/events.h>
 #include <xen/page.h>
@@ -454,21 +456,21 @@ static ssize_t xendev_show_nodename(struct device *dev,
 {
 	return sprintf(buf, "%s\n", to_xenbus_device(dev)->nodename);
 }
-DEVICE_ATTR(nodename, S_IRUSR | S_IRGRP | S_IROTH, xendev_show_nodename, NULL);
+static DEVICE_ATTR(nodename, S_IRUSR | S_IRGRP | S_IROTH, xendev_show_nodename, NULL);
 
 static ssize_t xendev_show_devtype(struct device *dev,
 				   struct device_attribute *attr, char *buf)
 {
 	return sprintf(buf, "%s\n", to_xenbus_device(dev)->devicetype);
 }
-DEVICE_ATTR(devtype, S_IRUSR | S_IRGRP | S_IROTH, xendev_show_devtype, NULL);
+static DEVICE_ATTR(devtype, S_IRUSR | S_IRGRP | S_IROTH, xendev_show_devtype, NULL);
 
 static ssize_t xendev_show_modalias(struct device *dev,
 				    struct device_attribute *attr, char *buf)
 {
 	return sprintf(buf, "xen:%s\n", to_xenbus_device(dev)->devicetype);
 }
-DEVICE_ATTR(modalias, S_IRUSR | S_IRGRP | S_IROTH, xendev_show_modalias, NULL);
+static DEVICE_ATTR(modalias, S_IRUSR | S_IRGRP | S_IROTH, xendev_show_modalias, NULL);
 
 int xenbus_probe_node(struct xen_bus_type *bus,
 		      const char *type,
@@ -843,7 +845,7 @@ postcore_initcall(xenbus_probe_init);
 
 MODULE_LICENSE("GPL");
 
-static int is_disconnected_device(struct device *dev, void *data)
+static int is_device_connecting(struct device *dev, void *data)
 {
 	struct xenbus_device *xendev = to_xenbus_device(dev);
 	struct device_driver *drv = data;
@@ -861,14 +863,15 @@ static int is_disconnected_device(struct device *dev, void *data)
 		return 0;
 
 	xendrv = to_xenbus_driver(dev->driver);
-	return (xendev->state != XenbusStateConnected ||
-		(xendrv->is_ready && !xendrv->is_ready(xendev)));
+	return (xendev->state < XenbusStateConnected ||
+		(xendev->state == XenbusStateConnected &&
+		 xendrv->is_ready && !xendrv->is_ready(xendev)));
 }
 
-static int exists_disconnected_device(struct device_driver *drv)
+static int exists_connecting_device(struct device_driver *drv)
 {
 	return bus_for_each_dev(&xenbus_frontend.bus, NULL, drv,
-				is_disconnected_device);
+				is_device_connecting);
 }
 
 static int print_device_status(struct device *dev, void *data)
@@ -884,10 +887,13 @@ static int print_device_status(struct device *dev, void *data)
 		/* Information only: is this too noisy? */
 		printk(KERN_INFO "XENBUS: Device with no driver: %s\n",
 		       xendev->nodename);
-	} else if (xendev->state != XenbusStateConnected) {
+	} else if (xendev->state < XenbusStateConnected) {
+		enum xenbus_state rstate = XenbusStateUnknown;
+		if (xendev->otherend)
+			rstate = xenbus_read_driver_state(xendev->otherend);
 		printk(KERN_WARNING "XENBUS: Timeout connecting "
-		       "to device: %s (state %d)\n",
-		       xendev->nodename, xendev->state);
+		       "to device: %s (local state %d, remote state %d)\n",
+		       xendev->nodename, xendev->state, rstate);
 	}
 
 	return 0;
@@ -897,7 +903,7 @@ static int print_device_status(struct device *dev, void *data)
 static int ready_to_wait_for_devices;
 
 /*
- * On a 10 second timeout, wait for all devices currently configured.  We need
+ * On a 5-minute timeout, wait for all devices currently configured.  We need
  * to do this to guarantee that the filesystems and / or network devices
  * needed for boot are available, before we can allow the boot to proceed.
  *
@@ -912,18 +918,30 @@ static int ready_to_wait_for_devices;
  */
 static void wait_for_devices(struct xenbus_driver *xendrv)
 {
-	unsigned long timeout = jiffies + 10*HZ;
+	unsigned long start = jiffies;
 	struct device_driver *drv = xendrv ? &xendrv->driver : NULL;
+	unsigned int seconds_waited = 0;
 
 	if (!ready_to_wait_for_devices || !xen_domain())
 		return;
 
-	while (exists_disconnected_device(drv)) {
-		if (time_after(jiffies, timeout))
-			break;
+	while (exists_connecting_device(drv)) {
+		if (time_after(jiffies, start + (seconds_waited+5)*HZ)) {
+			if (!seconds_waited)
+				printk(KERN_WARNING "XENBUS: Waiting for "
+				       "devices to initialise: ");
+			seconds_waited += 5;
+			printk("%us...", 300 - seconds_waited);
+			if (seconds_waited == 300)
+				break;
+		}
+
 		schedule_timeout_interruptible(HZ/10);
 	}
 
+	if (seconds_waited)
+		printk("\n");
+
 	bus_for_each_dev(&xenbus_frontend.bus, NULL, drv,
 			 print_device_status);
 }
diff --git a/drivers/xen/xenfs/super.c b/drivers/xen/xenfs/super.c
index 6559e0c752ce..8924d93136f1 100644
--- a/drivers/xen/xenfs/super.c
+++ b/drivers/xen/xenfs/super.c
@@ -13,6 +13,8 @@
 #include <linux/fs.h>
 #include <linux/magic.h>
 
+#include <xen/xen.h>
+
 #include "xenfs.h"
 
 #include <asm/xen/hypervisor.h>